xref: /openbmc/linux/drivers/block/aoe/aoecmd.c (revision 3180b64a)
1 /* Copyright (c) 2013 Coraid, Inc.  See COPYING for GPL terms. */
2 /*
3  * aoecmd.c
4  * Filesystem request handling methods
5  */
6 
7 #include <linux/ata.h>
8 #include <linux/slab.h>
9 #include <linux/hdreg.h>
10 #include <linux/blk-mq.h>
11 #include <linux/skbuff.h>
12 #include <linux/netdevice.h>
13 #include <linux/genhd.h>
14 #include <linux/moduleparam.h>
15 #include <linux/workqueue.h>
16 #include <linux/kthread.h>
17 #include <net/net_namespace.h>
18 #include <asm/unaligned.h>
19 #include <linux/uio.h>
20 #include "aoe.h"
21 
22 #define MAXIOC (8192)	/* default meant to avoid most soft lockups */
23 
24 static void ktcomplete(struct frame *, struct sk_buff *);
25 static int count_targets(struct aoedev *d, int *untainted);
26 
27 static struct buf *nextbuf(struct aoedev *);
28 
29 static int aoe_deadsecs = 60 * 3;
30 module_param(aoe_deadsecs, int, 0644);
31 MODULE_PARM_DESC(aoe_deadsecs, "After aoe_deadsecs seconds, give up and fail dev.");
32 
33 static int aoe_maxout = 64;
34 module_param(aoe_maxout, int, 0644);
35 MODULE_PARM_DESC(aoe_maxout,
36 	"Only aoe_maxout outstanding packets for every MAC on eX.Y.");
37 
38 /* The number of online cpus during module initialization gives us a
39  * convenient heuristic cap on the parallelism used for ktio threads
40  * doing I/O completion.  It is not important that the cap equal the
41  * actual number of running CPUs at any given time, but because of CPU
42  * hotplug, we take care to use ncpus instead of using
43  * num_online_cpus() after module initialization.
44  */
45 static int ncpus;
46 
47 /* mutex lock used for synchronization while thread spawning */
48 static DEFINE_MUTEX(ktio_spawn_lock);
49 
50 static wait_queue_head_t *ktiowq;
51 static struct ktstate *kts;
52 
53 /* io completion queue */
54 struct iocq_ktio {
55 	struct list_head head;
56 	spinlock_t lock;
57 };
58 static struct iocq_ktio *iocq;
59 
60 static struct page *empty_page;
61 
62 static struct sk_buff *
63 new_skb(ulong len)
64 {
65 	struct sk_buff *skb;
66 
67 	skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC);
68 	if (skb) {
69 		skb_reserve(skb, MAX_HEADER);
70 		skb_reset_mac_header(skb);
71 		skb_reset_network_header(skb);
72 		skb->protocol = __constant_htons(ETH_P_AOE);
73 		skb_checksum_none_assert(skb);
74 	}
75 	return skb;
76 }
77 
78 static struct frame *
79 getframe_deferred(struct aoedev *d, u32 tag)
80 {
81 	struct list_head *head, *pos, *nx;
82 	struct frame *f;
83 
84 	head = &d->rexmitq;
85 	list_for_each_safe(pos, nx, head) {
86 		f = list_entry(pos, struct frame, head);
87 		if (f->tag == tag) {
88 			list_del(pos);
89 			return f;
90 		}
91 	}
92 	return NULL;
93 }
94 
95 static struct frame *
96 getframe(struct aoedev *d, u32 tag)
97 {
98 	struct frame *f;
99 	struct list_head *head, *pos, *nx;
100 	u32 n;
101 
102 	n = tag % NFACTIVE;
103 	head = &d->factive[n];
104 	list_for_each_safe(pos, nx, head) {
105 		f = list_entry(pos, struct frame, head);
106 		if (f->tag == tag) {
107 			list_del(pos);
108 			return f;
109 		}
110 	}
111 	return NULL;
112 }
113 
114 /*
115  * Leave the top bit clear so we have tagspace for userland.
116  * The bottom 16 bits are the xmit tick for rexmit/rttavg processing.
117  * This driver reserves tag -1 to mean "unused frame."
118  */
119 static int
120 newtag(struct aoedev *d)
121 {
122 	register ulong n;
123 
124 	n = jiffies & 0xffff;
125 	return n |= (++d->lasttag & 0x7fff) << 16;
126 }
127 
128 static u32
129 aoehdr_atainit(struct aoedev *d, struct aoetgt *t, struct aoe_hdr *h)
130 {
131 	u32 host_tag = newtag(d);
132 
133 	memcpy(h->src, t->ifp->nd->dev_addr, sizeof h->src);
134 	memcpy(h->dst, t->addr, sizeof h->dst);
135 	h->type = __constant_cpu_to_be16(ETH_P_AOE);
136 	h->verfl = AOE_HVER;
137 	h->major = cpu_to_be16(d->aoemajor);
138 	h->minor = d->aoeminor;
139 	h->cmd = AOECMD_ATA;
140 	h->tag = cpu_to_be32(host_tag);
141 
142 	return host_tag;
143 }
144 
145 static inline void
146 put_lba(struct aoe_atahdr *ah, sector_t lba)
147 {
148 	ah->lba0 = lba;
149 	ah->lba1 = lba >>= 8;
150 	ah->lba2 = lba >>= 8;
151 	ah->lba3 = lba >>= 8;
152 	ah->lba4 = lba >>= 8;
153 	ah->lba5 = lba >>= 8;
154 }
155 
156 static struct aoeif *
157 ifrotate(struct aoetgt *t)
158 {
159 	struct aoeif *ifp;
160 
161 	ifp = t->ifp;
162 	ifp++;
163 	if (ifp >= &t->ifs[NAOEIFS] || ifp->nd == NULL)
164 		ifp = t->ifs;
165 	if (ifp->nd == NULL)
166 		return NULL;
167 	return t->ifp = ifp;
168 }
169 
170 static void
171 skb_pool_put(struct aoedev *d, struct sk_buff *skb)
172 {
173 	__skb_queue_tail(&d->skbpool, skb);
174 }
175 
176 static struct sk_buff *
177 skb_pool_get(struct aoedev *d)
178 {
179 	struct sk_buff *skb = skb_peek(&d->skbpool);
180 
181 	if (skb && atomic_read(&skb_shinfo(skb)->dataref) == 1) {
182 		__skb_unlink(skb, &d->skbpool);
183 		return skb;
184 	}
185 	if (skb_queue_len(&d->skbpool) < NSKBPOOLMAX &&
186 	    (skb = new_skb(ETH_ZLEN)))
187 		return skb;
188 
189 	return NULL;
190 }
191 
192 void
193 aoe_freetframe(struct frame *f)
194 {
195 	struct aoetgt *t;
196 
197 	t = f->t;
198 	f->buf = NULL;
199 	memset(&f->iter, 0, sizeof(f->iter));
200 	f->r_skb = NULL;
201 	f->flags = 0;
202 	list_add(&f->head, &t->ffree);
203 }
204 
205 static struct frame *
206 newtframe(struct aoedev *d, struct aoetgt *t)
207 {
208 	struct frame *f;
209 	struct sk_buff *skb;
210 	struct list_head *pos;
211 
212 	if (list_empty(&t->ffree)) {
213 		if (t->falloc >= NSKBPOOLMAX*2)
214 			return NULL;
215 		f = kcalloc(1, sizeof(*f), GFP_ATOMIC);
216 		if (f == NULL)
217 			return NULL;
218 		t->falloc++;
219 		f->t = t;
220 	} else {
221 		pos = t->ffree.next;
222 		list_del(pos);
223 		f = list_entry(pos, struct frame, head);
224 	}
225 
226 	skb = f->skb;
227 	if (skb == NULL) {
228 		f->skb = skb = new_skb(ETH_ZLEN);
229 		if (!skb) {
230 bail:			aoe_freetframe(f);
231 			return NULL;
232 		}
233 	}
234 
235 	if (atomic_read(&skb_shinfo(skb)->dataref) != 1) {
236 		skb = skb_pool_get(d);
237 		if (skb == NULL)
238 			goto bail;
239 		skb_pool_put(d, f->skb);
240 		f->skb = skb;
241 	}
242 
243 	skb->truesize -= skb->data_len;
244 	skb_shinfo(skb)->nr_frags = skb->data_len = 0;
245 	skb_trim(skb, 0);
246 	return f;
247 }
248 
249 static struct frame *
250 newframe(struct aoedev *d)
251 {
252 	struct frame *f;
253 	struct aoetgt *t, **tt;
254 	int totout = 0;
255 	int use_tainted;
256 	int has_untainted;
257 
258 	if (!d->targets || !d->targets[0]) {
259 		printk(KERN_ERR "aoe: NULL TARGETS!\n");
260 		return NULL;
261 	}
262 	tt = d->tgt;	/* last used target */
263 	for (use_tainted = 0, has_untainted = 0;;) {
264 		tt++;
265 		if (tt >= &d->targets[d->ntargets] || !*tt)
266 			tt = d->targets;
267 		t = *tt;
268 		if (!t->taint) {
269 			has_untainted = 1;
270 			totout += t->nout;
271 		}
272 		if (t->nout < t->maxout
273 		&& (use_tainted || !t->taint)
274 		&& t->ifp->nd) {
275 			f = newtframe(d, t);
276 			if (f) {
277 				ifrotate(t);
278 				d->tgt = tt;
279 				return f;
280 			}
281 		}
282 		if (tt == d->tgt) {	/* we've looped and found nada */
283 			if (!use_tainted && !has_untainted)
284 				use_tainted = 1;
285 			else
286 				break;
287 		}
288 	}
289 	if (totout == 0) {
290 		d->kicked++;
291 		d->flags |= DEVFL_KICKME;
292 	}
293 	return NULL;
294 }
295 
296 static void
297 skb_fillup(struct sk_buff *skb, struct bio *bio, struct bvec_iter iter)
298 {
299 	int frag = 0;
300 	struct bio_vec bv;
301 
302 	__bio_for_each_segment(bv, bio, iter, iter)
303 		skb_fill_page_desc(skb, frag++, bv.bv_page,
304 				   bv.bv_offset, bv.bv_len);
305 }
306 
307 static void
308 fhash(struct frame *f)
309 {
310 	struct aoedev *d = f->t->d;
311 	u32 n;
312 
313 	n = f->tag % NFACTIVE;
314 	list_add_tail(&f->head, &d->factive[n]);
315 }
316 
317 static void
318 ata_rw_frameinit(struct frame *f)
319 {
320 	struct aoetgt *t;
321 	struct aoe_hdr *h;
322 	struct aoe_atahdr *ah;
323 	struct sk_buff *skb;
324 	char writebit, extbit;
325 
326 	skb = f->skb;
327 	h = (struct aoe_hdr *) skb_mac_header(skb);
328 	ah = (struct aoe_atahdr *) (h + 1);
329 	skb_put(skb, sizeof(*h) + sizeof(*ah));
330 	memset(h, 0, skb->len);
331 
332 	writebit = 0x10;
333 	extbit = 0x4;
334 
335 	t = f->t;
336 	f->tag = aoehdr_atainit(t->d, t, h);
337 	fhash(f);
338 	t->nout++;
339 	f->waited = 0;
340 	f->waited_total = 0;
341 
342 	/* set up ata header */
343 	ah->scnt = f->iter.bi_size >> 9;
344 	put_lba(ah, f->iter.bi_sector);
345 	if (t->d->flags & DEVFL_EXT) {
346 		ah->aflags |= AOEAFL_EXT;
347 	} else {
348 		extbit = 0;
349 		ah->lba3 &= 0x0f;
350 		ah->lba3 |= 0xe0;	/* LBA bit + obsolete 0xa0 */
351 	}
352 	if (f->buf && bio_data_dir(f->buf->bio) == WRITE) {
353 		skb_fillup(skb, f->buf->bio, f->iter);
354 		ah->aflags |= AOEAFL_WRITE;
355 		skb->len += f->iter.bi_size;
356 		skb->data_len = f->iter.bi_size;
357 		skb->truesize += f->iter.bi_size;
358 		t->wpkts++;
359 	} else {
360 		t->rpkts++;
361 		writebit = 0;
362 	}
363 
364 	ah->cmdstat = ATA_CMD_PIO_READ | writebit | extbit;
365 	skb->dev = t->ifp->nd;
366 }
367 
368 static int
369 aoecmd_ata_rw(struct aoedev *d)
370 {
371 	struct frame *f;
372 	struct buf *buf;
373 	struct sk_buff *skb;
374 	struct sk_buff_head queue;
375 
376 	buf = nextbuf(d);
377 	if (buf == NULL)
378 		return 0;
379 	f = newframe(d);
380 	if (f == NULL)
381 		return 0;
382 
383 	/* initialize the headers & frame */
384 	f->buf = buf;
385 	f->iter = buf->iter;
386 	f->iter.bi_size = min_t(unsigned long,
387 				d->maxbcnt ?: DEFAULTBCNT,
388 				f->iter.bi_size);
389 	bio_advance_iter(buf->bio, &buf->iter, f->iter.bi_size);
390 
391 	if (!buf->iter.bi_size)
392 		d->ip.buf = NULL;
393 
394 	/* mark all tracking fields and load out */
395 	buf->nframesout += 1;
396 
397 	ata_rw_frameinit(f);
398 
399 	skb = skb_clone(f->skb, GFP_ATOMIC);
400 	if (skb) {
401 		f->sent = ktime_get();
402 		__skb_queue_head_init(&queue);
403 		__skb_queue_tail(&queue, skb);
404 		aoenet_xmit(&queue);
405 	}
406 	return 1;
407 }
408 
409 /* some callers cannot sleep, and they can call this function,
410  * transmitting the packets later, when interrupts are on
411  */
412 static void
413 aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *queue)
414 {
415 	struct aoe_hdr *h;
416 	struct aoe_cfghdr *ch;
417 	struct sk_buff *skb;
418 	struct net_device *ifp;
419 
420 	rcu_read_lock();
421 	for_each_netdev_rcu(&init_net, ifp) {
422 		dev_hold(ifp);
423 		if (!is_aoe_netif(ifp))
424 			goto cont;
425 
426 		skb = new_skb(sizeof *h + sizeof *ch);
427 		if (skb == NULL) {
428 			printk(KERN_INFO "aoe: skb alloc failure\n");
429 			goto cont;
430 		}
431 		skb_put(skb, sizeof *h + sizeof *ch);
432 		skb->dev = ifp;
433 		__skb_queue_tail(queue, skb);
434 		h = (struct aoe_hdr *) skb_mac_header(skb);
435 		memset(h, 0, sizeof *h + sizeof *ch);
436 
437 		memset(h->dst, 0xff, sizeof h->dst);
438 		memcpy(h->src, ifp->dev_addr, sizeof h->src);
439 		h->type = __constant_cpu_to_be16(ETH_P_AOE);
440 		h->verfl = AOE_HVER;
441 		h->major = cpu_to_be16(aoemajor);
442 		h->minor = aoeminor;
443 		h->cmd = AOECMD_CFG;
444 
445 cont:
446 		dev_put(ifp);
447 	}
448 	rcu_read_unlock();
449 }
450 
451 static void
452 resend(struct aoedev *d, struct frame *f)
453 {
454 	struct sk_buff *skb;
455 	struct sk_buff_head queue;
456 	struct aoe_hdr *h;
457 	struct aoetgt *t;
458 	char buf[128];
459 	u32 n;
460 
461 	t = f->t;
462 	n = newtag(d);
463 	skb = f->skb;
464 	if (ifrotate(t) == NULL) {
465 		/* probably can't happen, but set it up to fail anyway */
466 		pr_info("aoe: resend: no interfaces to rotate to.\n");
467 		ktcomplete(f, NULL);
468 		return;
469 	}
470 	h = (struct aoe_hdr *) skb_mac_header(skb);
471 
472 	if (!(f->flags & FFL_PROBE)) {
473 		snprintf(buf, sizeof(buf),
474 			"%15s e%ld.%d oldtag=%08x@%08lx newtag=%08x s=%pm d=%pm nout=%d\n",
475 			"retransmit", d->aoemajor, d->aoeminor,
476 			f->tag, jiffies, n,
477 			h->src, h->dst, t->nout);
478 		aoechr_error(buf);
479 	}
480 
481 	f->tag = n;
482 	fhash(f);
483 	h->tag = cpu_to_be32(n);
484 	memcpy(h->dst, t->addr, sizeof h->dst);
485 	memcpy(h->src, t->ifp->nd->dev_addr, sizeof h->src);
486 
487 	skb->dev = t->ifp->nd;
488 	skb = skb_clone(skb, GFP_ATOMIC);
489 	if (skb == NULL)
490 		return;
491 	f->sent = ktime_get();
492 	__skb_queue_head_init(&queue);
493 	__skb_queue_tail(&queue, skb);
494 	aoenet_xmit(&queue);
495 }
496 
497 static int
498 tsince_hr(struct frame *f)
499 {
500 	u64 delta = ktime_to_ns(ktime_sub(ktime_get(), f->sent));
501 
502 	/* delta is normally under 4.2 seconds, avoid 64-bit division */
503 	if (likely(delta <= UINT_MAX))
504 		return (u32)delta / NSEC_PER_USEC;
505 
506 	/* avoid overflow after 71 minutes */
507 	if (delta > ((u64)INT_MAX * NSEC_PER_USEC))
508 		return INT_MAX;
509 
510 	return div_u64(delta, NSEC_PER_USEC);
511 }
512 
513 static int
514 tsince(u32 tag)
515 {
516 	int n;
517 
518 	n = jiffies & 0xffff;
519 	n -= tag & 0xffff;
520 	if (n < 0)
521 		n += 1<<16;
522 	return jiffies_to_usecs(n + 1);
523 }
524 
525 static struct aoeif *
526 getif(struct aoetgt *t, struct net_device *nd)
527 {
528 	struct aoeif *p, *e;
529 
530 	p = t->ifs;
531 	e = p + NAOEIFS;
532 	for (; p < e; p++)
533 		if (p->nd == nd)
534 			return p;
535 	return NULL;
536 }
537 
538 static void
539 ejectif(struct aoetgt *t, struct aoeif *ifp)
540 {
541 	struct aoeif *e;
542 	struct net_device *nd;
543 	ulong n;
544 
545 	nd = ifp->nd;
546 	e = t->ifs + NAOEIFS - 1;
547 	n = (e - ifp) * sizeof *ifp;
548 	memmove(ifp, ifp+1, n);
549 	e->nd = NULL;
550 	dev_put(nd);
551 }
552 
553 static struct frame *
554 reassign_frame(struct frame *f)
555 {
556 	struct frame *nf;
557 	struct sk_buff *skb;
558 
559 	nf = newframe(f->t->d);
560 	if (!nf)
561 		return NULL;
562 	if (nf->t == f->t) {
563 		aoe_freetframe(nf);
564 		return NULL;
565 	}
566 
567 	skb = nf->skb;
568 	nf->skb = f->skb;
569 	nf->buf = f->buf;
570 	nf->iter = f->iter;
571 	nf->waited = 0;
572 	nf->waited_total = f->waited_total;
573 	nf->sent = f->sent;
574 	f->skb = skb;
575 
576 	return nf;
577 }
578 
579 static void
580 probe(struct aoetgt *t)
581 {
582 	struct aoedev *d;
583 	struct frame *f;
584 	struct sk_buff *skb;
585 	struct sk_buff_head queue;
586 	size_t n, m;
587 	int frag;
588 
589 	d = t->d;
590 	f = newtframe(d, t);
591 	if (!f) {
592 		pr_err("%s %pm for e%ld.%d: %s\n",
593 			"aoe: cannot probe remote address",
594 			t->addr,
595 			(long) d->aoemajor, d->aoeminor,
596 			"no frame available");
597 		return;
598 	}
599 	f->flags |= FFL_PROBE;
600 	ifrotate(t);
601 	f->iter.bi_size = t->d->maxbcnt ? t->d->maxbcnt : DEFAULTBCNT;
602 	ata_rw_frameinit(f);
603 	skb = f->skb;
604 	for (frag = 0, n = f->iter.bi_size; n > 0; ++frag, n -= m) {
605 		if (n < PAGE_SIZE)
606 			m = n;
607 		else
608 			m = PAGE_SIZE;
609 		skb_fill_page_desc(skb, frag, empty_page, 0, m);
610 	}
611 	skb->len += f->iter.bi_size;
612 	skb->data_len = f->iter.bi_size;
613 	skb->truesize += f->iter.bi_size;
614 
615 	skb = skb_clone(f->skb, GFP_ATOMIC);
616 	if (skb) {
617 		f->sent = ktime_get();
618 		__skb_queue_head_init(&queue);
619 		__skb_queue_tail(&queue, skb);
620 		aoenet_xmit(&queue);
621 	}
622 }
623 
624 static long
625 rto(struct aoedev *d)
626 {
627 	long t;
628 
629 	t = 2 * d->rttavg >> RTTSCALE;
630 	t += 8 * d->rttdev >> RTTDSCALE;
631 	if (t == 0)
632 		t = 1;
633 
634 	return t;
635 }
636 
637 static void
638 rexmit_deferred(struct aoedev *d)
639 {
640 	struct aoetgt *t;
641 	struct frame *f;
642 	struct frame *nf;
643 	struct list_head *pos, *nx, *head;
644 	int since;
645 	int untainted;
646 
647 	count_targets(d, &untainted);
648 
649 	head = &d->rexmitq;
650 	list_for_each_safe(pos, nx, head) {
651 		f = list_entry(pos, struct frame, head);
652 		t = f->t;
653 		if (t->taint) {
654 			if (!(f->flags & FFL_PROBE)) {
655 				nf = reassign_frame(f);
656 				if (nf) {
657 					if (t->nout_probes == 0
658 					&& untainted > 0) {
659 						probe(t);
660 						t->nout_probes++;
661 					}
662 					list_replace(&f->head, &nf->head);
663 					pos = &nf->head;
664 					aoe_freetframe(f);
665 					f = nf;
666 					t = f->t;
667 				}
668 			} else if (untainted < 1) {
669 				/* don't probe w/o other untainted aoetgts */
670 				goto stop_probe;
671 			} else if (tsince_hr(f) < t->taint * rto(d)) {
672 				/* reprobe slowly when taint is high */
673 				continue;
674 			}
675 		} else if (f->flags & FFL_PROBE) {
676 stop_probe:		/* don't probe untainted aoetgts */
677 			list_del(pos);
678 			aoe_freetframe(f);
679 			/* leaving d->kicked, because this is routine */
680 			f->t->d->flags |= DEVFL_KICKME;
681 			continue;
682 		}
683 		if (t->nout >= t->maxout)
684 			continue;
685 		list_del(pos);
686 		t->nout++;
687 		if (f->flags & FFL_PROBE)
688 			t->nout_probes++;
689 		since = tsince_hr(f);
690 		f->waited += since;
691 		f->waited_total += since;
692 		resend(d, f);
693 	}
694 }
695 
696 /* An aoetgt accumulates demerits quickly, and successful
697  * probing redeems the aoetgt slowly.
698  */
699 static void
700 scorn(struct aoetgt *t)
701 {
702 	int n;
703 
704 	n = t->taint++;
705 	t->taint += t->taint * 2;
706 	if (n > t->taint)
707 		t->taint = n;
708 	if (t->taint > MAX_TAINT)
709 		t->taint = MAX_TAINT;
710 }
711 
712 static int
713 count_targets(struct aoedev *d, int *untainted)
714 {
715 	int i, good;
716 
717 	for (i = good = 0; i < d->ntargets && d->targets[i]; ++i)
718 		if (d->targets[i]->taint == 0)
719 			good++;
720 
721 	if (untainted)
722 		*untainted = good;
723 	return i;
724 }
725 
726 static void
727 rexmit_timer(struct timer_list *timer)
728 {
729 	struct aoedev *d;
730 	struct aoetgt *t;
731 	struct aoeif *ifp;
732 	struct frame *f;
733 	struct list_head *head, *pos, *nx;
734 	LIST_HEAD(flist);
735 	register long timeout;
736 	ulong flags, n;
737 	int i;
738 	int utgts;	/* number of aoetgt descriptors (not slots) */
739 	int since;
740 
741 	d = from_timer(d, timer, timer);
742 
743 	spin_lock_irqsave(&d->lock, flags);
744 
745 	/* timeout based on observed timings and variations */
746 	timeout = rto(d);
747 
748 	utgts = count_targets(d, NULL);
749 
750 	if (d->flags & DEVFL_TKILL) {
751 		spin_unlock_irqrestore(&d->lock, flags);
752 		return;
753 	}
754 
755 	/* collect all frames to rexmit into flist */
756 	for (i = 0; i < NFACTIVE; i++) {
757 		head = &d->factive[i];
758 		list_for_each_safe(pos, nx, head) {
759 			f = list_entry(pos, struct frame, head);
760 			if (tsince_hr(f) < timeout)
761 				break;	/* end of expired frames */
762 			/* move to flist for later processing */
763 			list_move_tail(pos, &flist);
764 		}
765 	}
766 
767 	/* process expired frames */
768 	while (!list_empty(&flist)) {
769 		pos = flist.next;
770 		f = list_entry(pos, struct frame, head);
771 		since = tsince_hr(f);
772 		n = f->waited_total + since;
773 		n /= USEC_PER_SEC;
774 		if (aoe_deadsecs
775 		&& n > aoe_deadsecs
776 		&& !(f->flags & FFL_PROBE)) {
777 			/* Waited too long.  Device failure.
778 			 * Hang all frames on first hash bucket for downdev
779 			 * to clean up.
780 			 */
781 			list_splice(&flist, &d->factive[0]);
782 			aoedev_downdev(d);
783 			goto out;
784 		}
785 
786 		t = f->t;
787 		n = f->waited + since;
788 		n /= USEC_PER_SEC;
789 		if (aoe_deadsecs && utgts > 0
790 		&& (n > aoe_deadsecs / utgts || n > HARD_SCORN_SECS))
791 			scorn(t); /* avoid this target */
792 
793 		if (t->maxout != 1) {
794 			t->ssthresh = t->maxout / 2;
795 			t->maxout = 1;
796 		}
797 
798 		if (f->flags & FFL_PROBE) {
799 			t->nout_probes--;
800 		} else {
801 			ifp = getif(t, f->skb->dev);
802 			if (ifp && ++ifp->lost > (t->nframes << 1)
803 			&& (ifp != t->ifs || t->ifs[1].nd)) {
804 				ejectif(t, ifp);
805 				ifp = NULL;
806 			}
807 		}
808 		list_move_tail(pos, &d->rexmitq);
809 		t->nout--;
810 	}
811 	rexmit_deferred(d);
812 
813 out:
814 	if ((d->flags & DEVFL_KICKME) && d->blkq) {
815 		d->flags &= ~DEVFL_KICKME;
816 		blk_mq_run_hw_queues(d->blkq, true);
817 	}
818 
819 	d->timer.expires = jiffies + TIMERTICK;
820 	add_timer(&d->timer);
821 
822 	spin_unlock_irqrestore(&d->lock, flags);
823 }
824 
825 static void
826 bufinit(struct buf *buf, struct request *rq, struct bio *bio)
827 {
828 	memset(buf, 0, sizeof(*buf));
829 	buf->rq = rq;
830 	buf->bio = bio;
831 	buf->iter = bio->bi_iter;
832 }
833 
834 static struct buf *
835 nextbuf(struct aoedev *d)
836 {
837 	struct request *rq;
838 	struct request_queue *q;
839 	struct aoe_req *req;
840 	struct buf *buf;
841 	struct bio *bio;
842 
843 	q = d->blkq;
844 	if (q == NULL)
845 		return NULL;	/* initializing */
846 	if (d->ip.buf)
847 		return d->ip.buf;
848 	rq = d->ip.rq;
849 	if (rq == NULL) {
850 		rq = list_first_entry_or_null(&d->rq_list, struct request,
851 						queuelist);
852 		if (rq == NULL)
853 			return NULL;
854 		list_del_init(&rq->queuelist);
855 		blk_mq_start_request(rq);
856 		d->ip.rq = rq;
857 		d->ip.nxbio = rq->bio;
858 
859 		req = blk_mq_rq_to_pdu(rq);
860 		req->nr_bios = 0;
861 		__rq_for_each_bio(bio, rq)
862 			req->nr_bios++;
863 	}
864 	buf = mempool_alloc(d->bufpool, GFP_ATOMIC);
865 	if (buf == NULL) {
866 		pr_err("aoe: nextbuf: unable to mempool_alloc!\n");
867 		return NULL;
868 	}
869 	bio = d->ip.nxbio;
870 	bufinit(buf, rq, bio);
871 	bio = bio->bi_next;
872 	d->ip.nxbio = bio;
873 	if (bio == NULL)
874 		d->ip.rq = NULL;
875 	return d->ip.buf = buf;
876 }
877 
878 /* enters with d->lock held */
879 void
880 aoecmd_work(struct aoedev *d)
881 {
882 	rexmit_deferred(d);
883 	while (aoecmd_ata_rw(d))
884 		;
885 }
886 
887 /* this function performs work that has been deferred until sleeping is OK
888  */
889 void
890 aoecmd_sleepwork(struct work_struct *work)
891 {
892 	struct aoedev *d = container_of(work, struct aoedev, work);
893 	struct block_device *bd;
894 	u64 ssize;
895 
896 	if (d->flags & DEVFL_GDALLOC)
897 		aoeblk_gdalloc(d);
898 
899 	if (d->flags & DEVFL_NEWSIZE) {
900 		ssize = get_capacity(d->gd);
901 		bd = bdget_disk(d->gd, 0);
902 		if (bd) {
903 			bd_set_nr_sectors(bd, ssize);
904 			bdput(bd);
905 		}
906 		spin_lock_irq(&d->lock);
907 		d->flags |= DEVFL_UP;
908 		d->flags &= ~DEVFL_NEWSIZE;
909 		spin_unlock_irq(&d->lock);
910 	}
911 }
912 
913 static void
914 ata_ident_fixstring(u16 *id, int ns)
915 {
916 	u16 s;
917 
918 	while (ns-- > 0) {
919 		s = *id;
920 		*id++ = s >> 8 | s << 8;
921 	}
922 }
923 
924 static void
925 ataid_complete(struct aoedev *d, struct aoetgt *t, unsigned char *id)
926 {
927 	u64 ssize;
928 	u16 n;
929 
930 	/* word 83: command set supported */
931 	n = get_unaligned_le16(&id[83 << 1]);
932 
933 	/* word 86: command set/feature enabled */
934 	n |= get_unaligned_le16(&id[86 << 1]);
935 
936 	if (n & (1<<10)) {	/* bit 10: LBA 48 */
937 		d->flags |= DEVFL_EXT;
938 
939 		/* word 100: number lba48 sectors */
940 		ssize = get_unaligned_le64(&id[100 << 1]);
941 
942 		/* set as in ide-disk.c:init_idedisk_capacity */
943 		d->geo.cylinders = ssize;
944 		d->geo.cylinders /= (255 * 63);
945 		d->geo.heads = 255;
946 		d->geo.sectors = 63;
947 	} else {
948 		d->flags &= ~DEVFL_EXT;
949 
950 		/* number lba28 sectors */
951 		ssize = get_unaligned_le32(&id[60 << 1]);
952 
953 		/* NOTE: obsolete in ATA 6 */
954 		d->geo.cylinders = get_unaligned_le16(&id[54 << 1]);
955 		d->geo.heads = get_unaligned_le16(&id[55 << 1]);
956 		d->geo.sectors = get_unaligned_le16(&id[56 << 1]);
957 	}
958 
959 	ata_ident_fixstring((u16 *) &id[10<<1], 10);	/* serial */
960 	ata_ident_fixstring((u16 *) &id[23<<1], 4);	/* firmware */
961 	ata_ident_fixstring((u16 *) &id[27<<1], 20);	/* model */
962 	memcpy(d->ident, id, sizeof(d->ident));
963 
964 	if (d->ssize != ssize)
965 		printk(KERN_INFO
966 			"aoe: %pm e%ld.%d v%04x has %llu sectors\n",
967 			t->addr,
968 			d->aoemajor, d->aoeminor,
969 			d->fw_ver, (long long)ssize);
970 	d->ssize = ssize;
971 	d->geo.start = 0;
972 	if (d->flags & (DEVFL_GDALLOC|DEVFL_NEWSIZE))
973 		return;
974 	if (d->gd != NULL) {
975 		set_capacity(d->gd, ssize);
976 		d->flags |= DEVFL_NEWSIZE;
977 	} else
978 		d->flags |= DEVFL_GDALLOC;
979 	schedule_work(&d->work);
980 }
981 
982 static void
983 calc_rttavg(struct aoedev *d, struct aoetgt *t, int rtt)
984 {
985 	register long n;
986 
987 	n = rtt;
988 
989 	/* cf. Congestion Avoidance and Control, Jacobson & Karels, 1988 */
990 	n -= d->rttavg >> RTTSCALE;
991 	d->rttavg += n;
992 	if (n < 0)
993 		n = -n;
994 	n -= d->rttdev >> RTTDSCALE;
995 	d->rttdev += n;
996 
997 	if (!t || t->maxout >= t->nframes)
998 		return;
999 	if (t->maxout < t->ssthresh)
1000 		t->maxout += 1;
1001 	else if (t->nout == t->maxout && t->next_cwnd-- == 0) {
1002 		t->maxout += 1;
1003 		t->next_cwnd = t->maxout;
1004 	}
1005 }
1006 
1007 static struct aoetgt *
1008 gettgt(struct aoedev *d, char *addr)
1009 {
1010 	struct aoetgt **t, **e;
1011 
1012 	t = d->targets;
1013 	e = t + d->ntargets;
1014 	for (; t < e && *t; t++)
1015 		if (memcmp((*t)->addr, addr, sizeof((*t)->addr)) == 0)
1016 			return *t;
1017 	return NULL;
1018 }
1019 
1020 static void
1021 bvcpy(struct sk_buff *skb, struct bio *bio, struct bvec_iter iter, long cnt)
1022 {
1023 	int soff = 0;
1024 	struct bio_vec bv;
1025 
1026 	iter.bi_size = cnt;
1027 
1028 	__bio_for_each_segment(bv, bio, iter, iter) {
1029 		char *p = kmap_atomic(bv.bv_page) + bv.bv_offset;
1030 		skb_copy_bits(skb, soff, p, bv.bv_len);
1031 		kunmap_atomic(p);
1032 		soff += bv.bv_len;
1033 	}
1034 }
1035 
1036 void
1037 aoe_end_request(struct aoedev *d, struct request *rq, int fastfail)
1038 {
1039 	struct bio *bio;
1040 	int bok;
1041 	struct request_queue *q;
1042 	blk_status_t err = BLK_STS_OK;
1043 
1044 	q = d->blkq;
1045 	if (rq == d->ip.rq)
1046 		d->ip.rq = NULL;
1047 	do {
1048 		bio = rq->bio;
1049 		bok = !fastfail && !bio->bi_status;
1050 		if (!bok)
1051 			err = BLK_STS_IOERR;
1052 	} while (blk_update_request(rq, bok ? BLK_STS_OK : BLK_STS_IOERR, bio->bi_iter.bi_size));
1053 
1054 	__blk_mq_end_request(rq, err);
1055 
1056 	/* cf. http://lkml.org/lkml/2006/10/31/28 */
1057 	if (!fastfail)
1058 		blk_mq_run_hw_queues(q, true);
1059 }
1060 
1061 static void
1062 aoe_end_buf(struct aoedev *d, struct buf *buf)
1063 {
1064 	struct request *rq = buf->rq;
1065 	struct aoe_req *req = blk_mq_rq_to_pdu(rq);
1066 
1067 	if (buf == d->ip.buf)
1068 		d->ip.buf = NULL;
1069 	mempool_free(buf, d->bufpool);
1070 	if (--req->nr_bios == 0)
1071 		aoe_end_request(d, rq, 0);
1072 }
1073 
1074 static void
1075 ktiocomplete(struct frame *f)
1076 {
1077 	struct aoe_hdr *hin, *hout;
1078 	struct aoe_atahdr *ahin, *ahout;
1079 	struct buf *buf;
1080 	struct sk_buff *skb;
1081 	struct aoetgt *t;
1082 	struct aoeif *ifp;
1083 	struct aoedev *d;
1084 	long n;
1085 	int untainted;
1086 
1087 	if (f == NULL)
1088 		return;
1089 
1090 	t = f->t;
1091 	d = t->d;
1092 	skb = f->r_skb;
1093 	buf = f->buf;
1094 	if (f->flags & FFL_PROBE)
1095 		goto out;
1096 	if (!skb)		/* just fail the buf. */
1097 		goto noskb;
1098 
1099 	hout = (struct aoe_hdr *) skb_mac_header(f->skb);
1100 	ahout = (struct aoe_atahdr *) (hout+1);
1101 
1102 	hin = (struct aoe_hdr *) skb->data;
1103 	skb_pull(skb, sizeof(*hin));
1104 	ahin = (struct aoe_atahdr *) skb->data;
1105 	skb_pull(skb, sizeof(*ahin));
1106 	if (ahin->cmdstat & 0xa9) {	/* these bits cleared on success */
1107 		pr_err("aoe: ata error cmd=%2.2Xh stat=%2.2Xh from e%ld.%d\n",
1108 			ahout->cmdstat, ahin->cmdstat,
1109 			d->aoemajor, d->aoeminor);
1110 noskb:		if (buf)
1111 			buf->bio->bi_status = BLK_STS_IOERR;
1112 		goto out;
1113 	}
1114 
1115 	n = ahout->scnt << 9;
1116 	switch (ahout->cmdstat) {
1117 	case ATA_CMD_PIO_READ:
1118 	case ATA_CMD_PIO_READ_EXT:
1119 		if (skb->len < n) {
1120 			pr_err("%s e%ld.%d.  skb->len=%d need=%ld\n",
1121 				"aoe: runt data size in read from",
1122 				(long) d->aoemajor, d->aoeminor,
1123 			       skb->len, n);
1124 			buf->bio->bi_status = BLK_STS_IOERR;
1125 			break;
1126 		}
1127 		if (n > f->iter.bi_size) {
1128 			pr_err_ratelimited("%s e%ld.%d.  bytes=%ld need=%u\n",
1129 				"aoe: too-large data size in read from",
1130 				(long) d->aoemajor, d->aoeminor,
1131 				n, f->iter.bi_size);
1132 			buf->bio->bi_status = BLK_STS_IOERR;
1133 			break;
1134 		}
1135 		bvcpy(skb, f->buf->bio, f->iter, n);
1136 		fallthrough;
1137 	case ATA_CMD_PIO_WRITE:
1138 	case ATA_CMD_PIO_WRITE_EXT:
1139 		spin_lock_irq(&d->lock);
1140 		ifp = getif(t, skb->dev);
1141 		if (ifp)
1142 			ifp->lost = 0;
1143 		spin_unlock_irq(&d->lock);
1144 		break;
1145 	case ATA_CMD_ID_ATA:
1146 		if (skb->len < 512) {
1147 			pr_info("%s e%ld.%d.  skb->len=%d need=512\n",
1148 				"aoe: runt data size in ataid from",
1149 				(long) d->aoemajor, d->aoeminor,
1150 				skb->len);
1151 			break;
1152 		}
1153 		if (skb_linearize(skb))
1154 			break;
1155 		spin_lock_irq(&d->lock);
1156 		ataid_complete(d, t, skb->data);
1157 		spin_unlock_irq(&d->lock);
1158 		break;
1159 	default:
1160 		pr_info("aoe: unrecognized ata command %2.2Xh for %d.%d\n",
1161 			ahout->cmdstat,
1162 			be16_to_cpu(get_unaligned(&hin->major)),
1163 			hin->minor);
1164 	}
1165 out:
1166 	spin_lock_irq(&d->lock);
1167 	if (t->taint > 0
1168 	&& --t->taint > 0
1169 	&& t->nout_probes == 0) {
1170 		count_targets(d, &untainted);
1171 		if (untainted > 0) {
1172 			probe(t);
1173 			t->nout_probes++;
1174 		}
1175 	}
1176 
1177 	aoe_freetframe(f);
1178 
1179 	if (buf && --buf->nframesout == 0 && buf->iter.bi_size == 0)
1180 		aoe_end_buf(d, buf);
1181 
1182 	spin_unlock_irq(&d->lock);
1183 	aoedev_put(d);
1184 	dev_kfree_skb(skb);
1185 }
1186 
1187 /* Enters with iocq.lock held.
1188  * Returns true iff responses needing processing remain.
1189  */
1190 static int
1191 ktio(int id)
1192 {
1193 	struct frame *f;
1194 	struct list_head *pos;
1195 	int i;
1196 	int actual_id;
1197 
1198 	for (i = 0; ; ++i) {
1199 		if (i == MAXIOC)
1200 			return 1;
1201 		if (list_empty(&iocq[id].head))
1202 			return 0;
1203 		pos = iocq[id].head.next;
1204 		list_del(pos);
1205 		f = list_entry(pos, struct frame, head);
1206 		spin_unlock_irq(&iocq[id].lock);
1207 		ktiocomplete(f);
1208 
1209 		/* Figure out if extra threads are required. */
1210 		actual_id = f->t->d->aoeminor % ncpus;
1211 
1212 		if (!kts[actual_id].active) {
1213 			BUG_ON(id != 0);
1214 			mutex_lock(&ktio_spawn_lock);
1215 			if (!kts[actual_id].active
1216 				&& aoe_ktstart(&kts[actual_id]) == 0)
1217 				kts[actual_id].active = 1;
1218 			mutex_unlock(&ktio_spawn_lock);
1219 		}
1220 		spin_lock_irq(&iocq[id].lock);
1221 	}
1222 }
1223 
1224 static int
1225 kthread(void *vp)
1226 {
1227 	struct ktstate *k;
1228 	DECLARE_WAITQUEUE(wait, current);
1229 	int more;
1230 
1231 	k = vp;
1232 	current->flags |= PF_NOFREEZE;
1233 	set_user_nice(current, -10);
1234 	complete(&k->rendez);	/* tell spawner we're running */
1235 	do {
1236 		spin_lock_irq(k->lock);
1237 		more = k->fn(k->id);
1238 		if (!more) {
1239 			add_wait_queue(k->waitq, &wait);
1240 			__set_current_state(TASK_INTERRUPTIBLE);
1241 		}
1242 		spin_unlock_irq(k->lock);
1243 		if (!more) {
1244 			schedule();
1245 			remove_wait_queue(k->waitq, &wait);
1246 		} else
1247 			cond_resched();
1248 	} while (!kthread_should_stop());
1249 	complete(&k->rendez);	/* tell spawner we're stopping */
1250 	return 0;
1251 }
1252 
1253 void
1254 aoe_ktstop(struct ktstate *k)
1255 {
1256 	kthread_stop(k->task);
1257 	wait_for_completion(&k->rendez);
1258 }
1259 
1260 int
1261 aoe_ktstart(struct ktstate *k)
1262 {
1263 	struct task_struct *task;
1264 
1265 	init_completion(&k->rendez);
1266 	task = kthread_run(kthread, k, "%s", k->name);
1267 	if (task == NULL || IS_ERR(task))
1268 		return -ENOMEM;
1269 	k->task = task;
1270 	wait_for_completion(&k->rendez); /* allow kthread to start */
1271 	init_completion(&k->rendez);	/* for waiting for exit later */
1272 	return 0;
1273 }
1274 
1275 /* pass it off to kthreads for processing */
1276 static void
1277 ktcomplete(struct frame *f, struct sk_buff *skb)
1278 {
1279 	int id;
1280 	ulong flags;
1281 
1282 	f->r_skb = skb;
1283 	id = f->t->d->aoeminor % ncpus;
1284 	spin_lock_irqsave(&iocq[id].lock, flags);
1285 	if (!kts[id].active) {
1286 		spin_unlock_irqrestore(&iocq[id].lock, flags);
1287 		/* The thread with id has not been spawned yet,
1288 		 * so delegate the work to the main thread and
1289 		 * try spawning a new thread.
1290 		 */
1291 		id = 0;
1292 		spin_lock_irqsave(&iocq[id].lock, flags);
1293 	}
1294 	list_add_tail(&f->head, &iocq[id].head);
1295 	spin_unlock_irqrestore(&iocq[id].lock, flags);
1296 	wake_up(&ktiowq[id]);
1297 }
1298 
1299 struct sk_buff *
1300 aoecmd_ata_rsp(struct sk_buff *skb)
1301 {
1302 	struct aoedev *d;
1303 	struct aoe_hdr *h;
1304 	struct frame *f;
1305 	u32 n;
1306 	ulong flags;
1307 	char ebuf[128];
1308 	u16 aoemajor;
1309 
1310 	h = (struct aoe_hdr *) skb->data;
1311 	aoemajor = be16_to_cpu(get_unaligned(&h->major));
1312 	d = aoedev_by_aoeaddr(aoemajor, h->minor, 0);
1313 	if (d == NULL) {
1314 		snprintf(ebuf, sizeof ebuf, "aoecmd_ata_rsp: ata response "
1315 			"for unknown device %d.%d\n",
1316 			aoemajor, h->minor);
1317 		aoechr_error(ebuf);
1318 		return skb;
1319 	}
1320 
1321 	spin_lock_irqsave(&d->lock, flags);
1322 
1323 	n = be32_to_cpu(get_unaligned(&h->tag));
1324 	f = getframe(d, n);
1325 	if (f) {
1326 		calc_rttavg(d, f->t, tsince_hr(f));
1327 		f->t->nout--;
1328 		if (f->flags & FFL_PROBE)
1329 			f->t->nout_probes--;
1330 	} else {
1331 		f = getframe_deferred(d, n);
1332 		if (f) {
1333 			calc_rttavg(d, NULL, tsince_hr(f));
1334 		} else {
1335 			calc_rttavg(d, NULL, tsince(n));
1336 			spin_unlock_irqrestore(&d->lock, flags);
1337 			aoedev_put(d);
1338 			snprintf(ebuf, sizeof(ebuf),
1339 				 "%15s e%d.%d    tag=%08x@%08lx s=%pm d=%pm\n",
1340 				 "unexpected rsp",
1341 				 get_unaligned_be16(&h->major),
1342 				 h->minor,
1343 				 get_unaligned_be32(&h->tag),
1344 				 jiffies,
1345 				 h->src,
1346 				 h->dst);
1347 			aoechr_error(ebuf);
1348 			return skb;
1349 		}
1350 	}
1351 	aoecmd_work(d);
1352 
1353 	spin_unlock_irqrestore(&d->lock, flags);
1354 
1355 	ktcomplete(f, skb);
1356 
1357 	/*
1358 	 * Note here that we do not perform an aoedev_put, as we are
1359 	 * leaving this reference for the ktio to release.
1360 	 */
1361 	return NULL;
1362 }
1363 
1364 void
1365 aoecmd_cfg(ushort aoemajor, unsigned char aoeminor)
1366 {
1367 	struct sk_buff_head queue;
1368 
1369 	__skb_queue_head_init(&queue);
1370 	aoecmd_cfg_pkts(aoemajor, aoeminor, &queue);
1371 	aoenet_xmit(&queue);
1372 }
1373 
1374 struct sk_buff *
1375 aoecmd_ata_id(struct aoedev *d)
1376 {
1377 	struct aoe_hdr *h;
1378 	struct aoe_atahdr *ah;
1379 	struct frame *f;
1380 	struct sk_buff *skb;
1381 	struct aoetgt *t;
1382 
1383 	f = newframe(d);
1384 	if (f == NULL)
1385 		return NULL;
1386 
1387 	t = *d->tgt;
1388 
1389 	/* initialize the headers & frame */
1390 	skb = f->skb;
1391 	h = (struct aoe_hdr *) skb_mac_header(skb);
1392 	ah = (struct aoe_atahdr *) (h+1);
1393 	skb_put(skb, sizeof *h + sizeof *ah);
1394 	memset(h, 0, skb->len);
1395 	f->tag = aoehdr_atainit(d, t, h);
1396 	fhash(f);
1397 	t->nout++;
1398 	f->waited = 0;
1399 	f->waited_total = 0;
1400 
1401 	/* set up ata header */
1402 	ah->scnt = 1;
1403 	ah->cmdstat = ATA_CMD_ID_ATA;
1404 	ah->lba3 = 0xa0;
1405 
1406 	skb->dev = t->ifp->nd;
1407 
1408 	d->rttavg = RTTAVG_INIT;
1409 	d->rttdev = RTTDEV_INIT;
1410 	d->timer.function = rexmit_timer;
1411 
1412 	skb = skb_clone(skb, GFP_ATOMIC);
1413 	if (skb)
1414 		f->sent = ktime_get();
1415 
1416 	return skb;
1417 }
1418 
1419 static struct aoetgt **
1420 grow_targets(struct aoedev *d)
1421 {
1422 	ulong oldn, newn;
1423 	struct aoetgt **tt;
1424 
1425 	oldn = d->ntargets;
1426 	newn = oldn * 2;
1427 	tt = kcalloc(newn, sizeof(*d->targets), GFP_ATOMIC);
1428 	if (!tt)
1429 		return NULL;
1430 	memmove(tt, d->targets, sizeof(*d->targets) * oldn);
1431 	d->tgt = tt + (d->tgt - d->targets);
1432 	kfree(d->targets);
1433 	d->targets = tt;
1434 	d->ntargets = newn;
1435 
1436 	return &d->targets[oldn];
1437 }
1438 
1439 static struct aoetgt *
1440 addtgt(struct aoedev *d, char *addr, ulong nframes)
1441 {
1442 	struct aoetgt *t, **tt, **te;
1443 
1444 	tt = d->targets;
1445 	te = tt + d->ntargets;
1446 	for (; tt < te && *tt; tt++)
1447 		;
1448 
1449 	if (tt == te) {
1450 		tt = grow_targets(d);
1451 		if (!tt)
1452 			goto nomem;
1453 	}
1454 	t = kzalloc(sizeof(*t), GFP_ATOMIC);
1455 	if (!t)
1456 		goto nomem;
1457 	t->nframes = nframes;
1458 	t->d = d;
1459 	memcpy(t->addr, addr, sizeof t->addr);
1460 	t->ifp = t->ifs;
1461 	aoecmd_wreset(t);
1462 	t->maxout = t->nframes / 2;
1463 	INIT_LIST_HEAD(&t->ffree);
1464 	return *tt = t;
1465 
1466  nomem:
1467 	pr_info("aoe: cannot allocate memory to add target\n");
1468 	return NULL;
1469 }
1470 
1471 static void
1472 setdbcnt(struct aoedev *d)
1473 {
1474 	struct aoetgt **t, **e;
1475 	int bcnt = 0;
1476 
1477 	t = d->targets;
1478 	e = t + d->ntargets;
1479 	for (; t < e && *t; t++)
1480 		if (bcnt == 0 || bcnt > (*t)->minbcnt)
1481 			bcnt = (*t)->minbcnt;
1482 	if (bcnt != d->maxbcnt) {
1483 		d->maxbcnt = bcnt;
1484 		pr_info("aoe: e%ld.%d: setting %d byte data frames\n",
1485 			d->aoemajor, d->aoeminor, bcnt);
1486 	}
1487 }
1488 
1489 static void
1490 setifbcnt(struct aoetgt *t, struct net_device *nd, int bcnt)
1491 {
1492 	struct aoedev *d;
1493 	struct aoeif *p, *e;
1494 	int minbcnt;
1495 
1496 	d = t->d;
1497 	minbcnt = bcnt;
1498 	p = t->ifs;
1499 	e = p + NAOEIFS;
1500 	for (; p < e; p++) {
1501 		if (p->nd == NULL)
1502 			break;		/* end of the valid interfaces */
1503 		if (p->nd == nd) {
1504 			p->bcnt = bcnt;	/* we're updating */
1505 			nd = NULL;
1506 		} else if (minbcnt > p->bcnt)
1507 			minbcnt = p->bcnt; /* find the min interface */
1508 	}
1509 	if (nd) {
1510 		if (p == e) {
1511 			pr_err("aoe: device setifbcnt failure; too many interfaces.\n");
1512 			return;
1513 		}
1514 		dev_hold(nd);
1515 		p->nd = nd;
1516 		p->bcnt = bcnt;
1517 	}
1518 	t->minbcnt = minbcnt;
1519 	setdbcnt(d);
1520 }
1521 
1522 void
1523 aoecmd_cfg_rsp(struct sk_buff *skb)
1524 {
1525 	struct aoedev *d;
1526 	struct aoe_hdr *h;
1527 	struct aoe_cfghdr *ch;
1528 	struct aoetgt *t;
1529 	ulong flags, aoemajor;
1530 	struct sk_buff *sl;
1531 	struct sk_buff_head queue;
1532 	u16 n;
1533 
1534 	sl = NULL;
1535 	h = (struct aoe_hdr *) skb_mac_header(skb);
1536 	ch = (struct aoe_cfghdr *) (h+1);
1537 
1538 	/*
1539 	 * Enough people have their dip switches set backwards to
1540 	 * warrant a loud message for this special case.
1541 	 */
1542 	aoemajor = get_unaligned_be16(&h->major);
1543 	if (aoemajor == 0xfff) {
1544 		printk(KERN_ERR "aoe: Warning: shelf address is all ones.  "
1545 			"Check shelf dip switches.\n");
1546 		return;
1547 	}
1548 	if (aoemajor == 0xffff) {
1549 		pr_info("aoe: e%ld.%d: broadcast shelf number invalid\n",
1550 			aoemajor, (int) h->minor);
1551 		return;
1552 	}
1553 	if (h->minor == 0xff) {
1554 		pr_info("aoe: e%ld.%d: broadcast slot number invalid\n",
1555 			aoemajor, (int) h->minor);
1556 		return;
1557 	}
1558 
1559 	n = be16_to_cpu(ch->bufcnt);
1560 	if (n > aoe_maxout)	/* keep it reasonable */
1561 		n = aoe_maxout;
1562 
1563 	d = aoedev_by_aoeaddr(aoemajor, h->minor, 1);
1564 	if (d == NULL) {
1565 		pr_info("aoe: device allocation failure\n");
1566 		return;
1567 	}
1568 
1569 	spin_lock_irqsave(&d->lock, flags);
1570 
1571 	t = gettgt(d, h->src);
1572 	if (t) {
1573 		t->nframes = n;
1574 		if (n < t->maxout)
1575 			aoecmd_wreset(t);
1576 	} else {
1577 		t = addtgt(d, h->src, n);
1578 		if (!t)
1579 			goto bail;
1580 	}
1581 	n = skb->dev->mtu;
1582 	n -= sizeof(struct aoe_hdr) + sizeof(struct aoe_atahdr);
1583 	n /= 512;
1584 	if (n > ch->scnt)
1585 		n = ch->scnt;
1586 	n = n ? n * 512 : DEFAULTBCNT;
1587 	setifbcnt(t, skb->dev, n);
1588 
1589 	/* don't change users' perspective */
1590 	if (d->nopen == 0) {
1591 		d->fw_ver = be16_to_cpu(ch->fwver);
1592 		sl = aoecmd_ata_id(d);
1593 	}
1594 bail:
1595 	spin_unlock_irqrestore(&d->lock, flags);
1596 	aoedev_put(d);
1597 	if (sl) {
1598 		__skb_queue_head_init(&queue);
1599 		__skb_queue_tail(&queue, sl);
1600 		aoenet_xmit(&queue);
1601 	}
1602 }
1603 
1604 void
1605 aoecmd_wreset(struct aoetgt *t)
1606 {
1607 	t->maxout = 1;
1608 	t->ssthresh = t->nframes / 2;
1609 	t->next_cwnd = t->nframes;
1610 }
1611 
1612 void
1613 aoecmd_cleanslate(struct aoedev *d)
1614 {
1615 	struct aoetgt **t, **te;
1616 
1617 	d->rttavg = RTTAVG_INIT;
1618 	d->rttdev = RTTDEV_INIT;
1619 	d->maxbcnt = 0;
1620 
1621 	t = d->targets;
1622 	te = t + d->ntargets;
1623 	for (; t < te && *t; t++)
1624 		aoecmd_wreset(*t);
1625 }
1626 
1627 void
1628 aoe_failbuf(struct aoedev *d, struct buf *buf)
1629 {
1630 	if (buf == NULL)
1631 		return;
1632 	buf->iter.bi_size = 0;
1633 	buf->bio->bi_status = BLK_STS_IOERR;
1634 	if (buf->nframesout == 0)
1635 		aoe_end_buf(d, buf);
1636 }
1637 
1638 void
1639 aoe_flush_iocq(void)
1640 {
1641 	int i;
1642 
1643 	for (i = 0; i < ncpus; i++) {
1644 		if (kts[i].active)
1645 			aoe_flush_iocq_by_index(i);
1646 	}
1647 }
1648 
1649 void
1650 aoe_flush_iocq_by_index(int id)
1651 {
1652 	struct frame *f;
1653 	struct aoedev *d;
1654 	LIST_HEAD(flist);
1655 	struct list_head *pos;
1656 	struct sk_buff *skb;
1657 	ulong flags;
1658 
1659 	spin_lock_irqsave(&iocq[id].lock, flags);
1660 	list_splice_init(&iocq[id].head, &flist);
1661 	spin_unlock_irqrestore(&iocq[id].lock, flags);
1662 	while (!list_empty(&flist)) {
1663 		pos = flist.next;
1664 		list_del(pos);
1665 		f = list_entry(pos, struct frame, head);
1666 		d = f->t->d;
1667 		skb = f->r_skb;
1668 		spin_lock_irqsave(&d->lock, flags);
1669 		if (f->buf) {
1670 			f->buf->nframesout--;
1671 			aoe_failbuf(d, f->buf);
1672 		}
1673 		aoe_freetframe(f);
1674 		spin_unlock_irqrestore(&d->lock, flags);
1675 		dev_kfree_skb(skb);
1676 		aoedev_put(d);
1677 	}
1678 }
1679 
1680 int __init
1681 aoecmd_init(void)
1682 {
1683 	void *p;
1684 	int i;
1685 	int ret;
1686 
1687 	/* get_zeroed_page returns page with ref count 1 */
1688 	p = (void *) get_zeroed_page(GFP_KERNEL);
1689 	if (!p)
1690 		return -ENOMEM;
1691 	empty_page = virt_to_page(p);
1692 
1693 	ncpus = num_online_cpus();
1694 
1695 	iocq = kcalloc(ncpus, sizeof(struct iocq_ktio), GFP_KERNEL);
1696 	if (!iocq)
1697 		return -ENOMEM;
1698 
1699 	kts = kcalloc(ncpus, sizeof(struct ktstate), GFP_KERNEL);
1700 	if (!kts) {
1701 		ret = -ENOMEM;
1702 		goto kts_fail;
1703 	}
1704 
1705 	ktiowq = kcalloc(ncpus, sizeof(wait_queue_head_t), GFP_KERNEL);
1706 	if (!ktiowq) {
1707 		ret = -ENOMEM;
1708 		goto ktiowq_fail;
1709 	}
1710 
1711 	mutex_init(&ktio_spawn_lock);
1712 
1713 	for (i = 0; i < ncpus; i++) {
1714 		INIT_LIST_HEAD(&iocq[i].head);
1715 		spin_lock_init(&iocq[i].lock);
1716 		init_waitqueue_head(&ktiowq[i]);
1717 		snprintf(kts[i].name, sizeof(kts[i].name), "aoe_ktio%d", i);
1718 		kts[i].fn = ktio;
1719 		kts[i].waitq = &ktiowq[i];
1720 		kts[i].lock = &iocq[i].lock;
1721 		kts[i].id = i;
1722 		kts[i].active = 0;
1723 	}
1724 	kts[0].active = 1;
1725 	if (aoe_ktstart(&kts[0])) {
1726 		ret = -ENOMEM;
1727 		goto ktstart_fail;
1728 	}
1729 	return 0;
1730 
1731 ktstart_fail:
1732 	kfree(ktiowq);
1733 ktiowq_fail:
1734 	kfree(kts);
1735 kts_fail:
1736 	kfree(iocq);
1737 
1738 	return ret;
1739 }
1740 
1741 void
1742 aoecmd_exit(void)
1743 {
1744 	int i;
1745 
1746 	for (i = 0; i < ncpus; i++)
1747 		if (kts[i].active)
1748 			aoe_ktstop(&kts[i]);
1749 
1750 	aoe_flush_iocq();
1751 
1752 	/* Free up the iocq and thread speicific configuration
1753 	* allocated during startup.
1754 	*/
1755 	kfree(iocq);
1756 	kfree(kts);
1757 	kfree(ktiowq);
1758 
1759 	free_page((unsigned long) page_address(empty_page));
1760 	empty_page = NULL;
1761 }
1762