xref: /openbmc/linux/drivers/nvme/target/tcp.c (revision 32ced09d)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * NVMe over Fabrics TCP target.
4  * Copyright (c) 2018 Lightbits Labs. All rights reserved.
5  */
6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7 #include <linux/module.h>
8 #include <linux/init.h>
9 #include <linux/slab.h>
10 #include <linux/err.h>
11 #include <linux/nvme-tcp.h>
12 #include <net/sock.h>
13 #include <net/tcp.h>
14 #include <linux/inet.h>
15 #include <linux/llist.h>
16 #include <crypto/hash.h>
17 
18 #include "nvmet.h"
19 
20 #define NVMET_TCP_DEF_INLINE_DATA_SIZE	(4 * PAGE_SIZE)
21 
22 #define NVMET_TCP_RECV_BUDGET		8
23 #define NVMET_TCP_SEND_BUDGET		8
24 #define NVMET_TCP_IO_WORK_BUDGET	64
25 
26 enum nvmet_tcp_send_state {
27 	NVMET_TCP_SEND_DATA_PDU,
28 	NVMET_TCP_SEND_DATA,
29 	NVMET_TCP_SEND_R2T,
30 	NVMET_TCP_SEND_DDGST,
31 	NVMET_TCP_SEND_RESPONSE
32 };
33 
34 enum nvmet_tcp_recv_state {
35 	NVMET_TCP_RECV_PDU,
36 	NVMET_TCP_RECV_DATA,
37 	NVMET_TCP_RECV_DDGST,
38 	NVMET_TCP_RECV_ERR,
39 };
40 
41 enum {
42 	NVMET_TCP_F_INIT_FAILED = (1 << 0),
43 };
44 
45 struct nvmet_tcp_cmd {
46 	struct nvmet_tcp_queue		*queue;
47 	struct nvmet_req		req;
48 
49 	struct nvme_tcp_cmd_pdu		*cmd_pdu;
50 	struct nvme_tcp_rsp_pdu		*rsp_pdu;
51 	struct nvme_tcp_data_pdu	*data_pdu;
52 	struct nvme_tcp_r2t_pdu		*r2t_pdu;
53 
54 	u32				rbytes_done;
55 	u32				wbytes_done;
56 
57 	u32				pdu_len;
58 	u32				pdu_recv;
59 	int				sg_idx;
60 	int				nr_mapped;
61 	struct msghdr			recv_msg;
62 	struct kvec			*iov;
63 	u32				flags;
64 
65 	struct list_head		entry;
66 	struct llist_node		lentry;
67 
68 	/* send state */
69 	u32				offset;
70 	struct scatterlist		*cur_sg;
71 	enum nvmet_tcp_send_state	state;
72 
73 	__le32				exp_ddgst;
74 	__le32				recv_ddgst;
75 };
76 
77 enum nvmet_tcp_queue_state {
78 	NVMET_TCP_Q_CONNECTING,
79 	NVMET_TCP_Q_LIVE,
80 	NVMET_TCP_Q_DISCONNECTING,
81 };
82 
83 struct nvmet_tcp_queue {
84 	struct socket		*sock;
85 	struct nvmet_tcp_port	*port;
86 	struct work_struct	io_work;
87 	int			cpu;
88 	struct nvmet_cq		nvme_cq;
89 	struct nvmet_sq		nvme_sq;
90 
91 	/* send state */
92 	struct nvmet_tcp_cmd	*cmds;
93 	unsigned int		nr_cmds;
94 	struct list_head	free_list;
95 	struct llist_head	resp_list;
96 	struct list_head	resp_send_list;
97 	int			send_list_len;
98 	struct nvmet_tcp_cmd	*snd_cmd;
99 
100 	/* recv state */
101 	int			offset;
102 	int			left;
103 	enum nvmet_tcp_recv_state rcv_state;
104 	struct nvmet_tcp_cmd	*cmd;
105 	union nvme_tcp_pdu	pdu;
106 
107 	/* digest state */
108 	bool			hdr_digest;
109 	bool			data_digest;
110 	struct ahash_request	*snd_hash;
111 	struct ahash_request	*rcv_hash;
112 
113 	spinlock_t		state_lock;
114 	enum nvmet_tcp_queue_state state;
115 
116 	struct sockaddr_storage	sockaddr;
117 	struct sockaddr_storage	sockaddr_peer;
118 	struct work_struct	release_work;
119 
120 	int			idx;
121 	struct list_head	queue_list;
122 
123 	struct nvmet_tcp_cmd	connect;
124 
125 	struct page_frag_cache	pf_cache;
126 
127 	void (*data_ready)(struct sock *);
128 	void (*state_change)(struct sock *);
129 	void (*write_space)(struct sock *);
130 };
131 
132 struct nvmet_tcp_port {
133 	struct socket		*sock;
134 	struct work_struct	accept_work;
135 	struct nvmet_port	*nport;
136 	struct sockaddr_storage addr;
137 	int			last_cpu;
138 	void (*data_ready)(struct sock *);
139 };
140 
141 static DEFINE_IDA(nvmet_tcp_queue_ida);
142 static LIST_HEAD(nvmet_tcp_queue_list);
143 static DEFINE_MUTEX(nvmet_tcp_queue_mutex);
144 
145 static struct workqueue_struct *nvmet_tcp_wq;
146 static struct nvmet_fabrics_ops nvmet_tcp_ops;
147 static void nvmet_tcp_free_cmd(struct nvmet_tcp_cmd *c);
148 static void nvmet_tcp_finish_cmd(struct nvmet_tcp_cmd *cmd);
149 
150 static inline u16 nvmet_tcp_cmd_tag(struct nvmet_tcp_queue *queue,
151 		struct nvmet_tcp_cmd *cmd)
152 {
153 	return cmd - queue->cmds;
154 }
155 
156 static inline bool nvmet_tcp_has_data_in(struct nvmet_tcp_cmd *cmd)
157 {
158 	return nvme_is_write(cmd->req.cmd) &&
159 		cmd->rbytes_done < cmd->req.transfer_len;
160 }
161 
162 static inline bool nvmet_tcp_need_data_in(struct nvmet_tcp_cmd *cmd)
163 {
164 	return nvmet_tcp_has_data_in(cmd) && !cmd->req.cqe->status;
165 }
166 
167 static inline bool nvmet_tcp_need_data_out(struct nvmet_tcp_cmd *cmd)
168 {
169 	return !nvme_is_write(cmd->req.cmd) &&
170 		cmd->req.transfer_len > 0 &&
171 		!cmd->req.cqe->status;
172 }
173 
174 static inline bool nvmet_tcp_has_inline_data(struct nvmet_tcp_cmd *cmd)
175 {
176 	return nvme_is_write(cmd->req.cmd) && cmd->pdu_len &&
177 		!cmd->rbytes_done;
178 }
179 
180 static inline struct nvmet_tcp_cmd *
181 nvmet_tcp_get_cmd(struct nvmet_tcp_queue *queue)
182 {
183 	struct nvmet_tcp_cmd *cmd;
184 
185 	cmd = list_first_entry_or_null(&queue->free_list,
186 				struct nvmet_tcp_cmd, entry);
187 	if (!cmd)
188 		return NULL;
189 	list_del_init(&cmd->entry);
190 
191 	cmd->rbytes_done = cmd->wbytes_done = 0;
192 	cmd->pdu_len = 0;
193 	cmd->pdu_recv = 0;
194 	cmd->iov = NULL;
195 	cmd->flags = 0;
196 	return cmd;
197 }
198 
199 static inline void nvmet_tcp_put_cmd(struct nvmet_tcp_cmd *cmd)
200 {
201 	if (unlikely(cmd == &cmd->queue->connect))
202 		return;
203 
204 	list_add_tail(&cmd->entry, &cmd->queue->free_list);
205 }
206 
207 static inline u8 nvmet_tcp_hdgst_len(struct nvmet_tcp_queue *queue)
208 {
209 	return queue->hdr_digest ? NVME_TCP_DIGEST_LENGTH : 0;
210 }
211 
212 static inline u8 nvmet_tcp_ddgst_len(struct nvmet_tcp_queue *queue)
213 {
214 	return queue->data_digest ? NVME_TCP_DIGEST_LENGTH : 0;
215 }
216 
217 static inline void nvmet_tcp_hdgst(struct ahash_request *hash,
218 		void *pdu, size_t len)
219 {
220 	struct scatterlist sg;
221 
222 	sg_init_one(&sg, pdu, len);
223 	ahash_request_set_crypt(hash, &sg, pdu + len, len);
224 	crypto_ahash_digest(hash);
225 }
226 
227 static int nvmet_tcp_verify_hdgst(struct nvmet_tcp_queue *queue,
228 	void *pdu, size_t len)
229 {
230 	struct nvme_tcp_hdr *hdr = pdu;
231 	__le32 recv_digest;
232 	__le32 exp_digest;
233 
234 	if (unlikely(!(hdr->flags & NVME_TCP_F_HDGST))) {
235 		pr_err("queue %d: header digest enabled but no header digest\n",
236 			queue->idx);
237 		return -EPROTO;
238 	}
239 
240 	recv_digest = *(__le32 *)(pdu + hdr->hlen);
241 	nvmet_tcp_hdgst(queue->rcv_hash, pdu, len);
242 	exp_digest = *(__le32 *)(pdu + hdr->hlen);
243 	if (recv_digest != exp_digest) {
244 		pr_err("queue %d: header digest error: recv %#x expected %#x\n",
245 			queue->idx, le32_to_cpu(recv_digest),
246 			le32_to_cpu(exp_digest));
247 		return -EPROTO;
248 	}
249 
250 	return 0;
251 }
252 
253 static int nvmet_tcp_check_ddgst(struct nvmet_tcp_queue *queue, void *pdu)
254 {
255 	struct nvme_tcp_hdr *hdr = pdu;
256 	u8 digest_len = nvmet_tcp_hdgst_len(queue);
257 	u32 len;
258 
259 	len = le32_to_cpu(hdr->plen) - hdr->hlen -
260 		(hdr->flags & NVME_TCP_F_HDGST ? digest_len : 0);
261 
262 	if (unlikely(len && !(hdr->flags & NVME_TCP_F_DDGST))) {
263 		pr_err("queue %d: data digest flag is cleared\n", queue->idx);
264 		return -EPROTO;
265 	}
266 
267 	return 0;
268 }
269 
270 static void nvmet_tcp_unmap_pdu_iovec(struct nvmet_tcp_cmd *cmd)
271 {
272 	struct scatterlist *sg;
273 	int i;
274 
275 	sg = &cmd->req.sg[cmd->sg_idx];
276 
277 	for (i = 0; i < cmd->nr_mapped; i++)
278 		kunmap(sg_page(&sg[i]));
279 }
280 
281 static void nvmet_tcp_map_pdu_iovec(struct nvmet_tcp_cmd *cmd)
282 {
283 	struct kvec *iov = cmd->iov;
284 	struct scatterlist *sg;
285 	u32 length, offset, sg_offset;
286 
287 	length = cmd->pdu_len;
288 	cmd->nr_mapped = DIV_ROUND_UP(length, PAGE_SIZE);
289 	offset = cmd->rbytes_done;
290 	cmd->sg_idx = DIV_ROUND_UP(offset, PAGE_SIZE);
291 	sg_offset = offset % PAGE_SIZE;
292 	sg = &cmd->req.sg[cmd->sg_idx];
293 
294 	while (length) {
295 		u32 iov_len = min_t(u32, length, sg->length - sg_offset);
296 
297 		iov->iov_base = kmap(sg_page(sg)) + sg->offset + sg_offset;
298 		iov->iov_len = iov_len;
299 
300 		length -= iov_len;
301 		sg = sg_next(sg);
302 		iov++;
303 	}
304 
305 	iov_iter_kvec(&cmd->recv_msg.msg_iter, READ, cmd->iov,
306 		cmd->nr_mapped, cmd->pdu_len);
307 }
308 
309 static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
310 {
311 	queue->rcv_state = NVMET_TCP_RECV_ERR;
312 	if (queue->nvme_sq.ctrl)
313 		nvmet_ctrl_fatal_error(queue->nvme_sq.ctrl);
314 	else
315 		kernel_sock_shutdown(queue->sock, SHUT_RDWR);
316 }
317 
318 static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd)
319 {
320 	struct nvme_sgl_desc *sgl = &cmd->req.cmd->common.dptr.sgl;
321 	u32 len = le32_to_cpu(sgl->length);
322 
323 	if (!len)
324 		return 0;
325 
326 	if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) |
327 			  NVME_SGL_FMT_OFFSET)) {
328 		if (!nvme_is_write(cmd->req.cmd))
329 			return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
330 
331 		if (len > cmd->req.port->inline_data_size)
332 			return NVME_SC_SGL_INVALID_OFFSET | NVME_SC_DNR;
333 		cmd->pdu_len = len;
334 	}
335 	cmd->req.transfer_len += len;
336 
337 	cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt);
338 	if (!cmd->req.sg)
339 		return NVME_SC_INTERNAL;
340 	cmd->cur_sg = cmd->req.sg;
341 
342 	if (nvmet_tcp_has_data_in(cmd)) {
343 		cmd->iov = kmalloc_array(cmd->req.sg_cnt,
344 				sizeof(*cmd->iov), GFP_KERNEL);
345 		if (!cmd->iov)
346 			goto err;
347 	}
348 
349 	return 0;
350 err:
351 	sgl_free(cmd->req.sg);
352 	return NVME_SC_INTERNAL;
353 }
354 
355 static void nvmet_tcp_ddgst(struct ahash_request *hash,
356 		struct nvmet_tcp_cmd *cmd)
357 {
358 	ahash_request_set_crypt(hash, cmd->req.sg,
359 		(void *)&cmd->exp_ddgst, cmd->req.transfer_len);
360 	crypto_ahash_digest(hash);
361 }
362 
363 static void nvmet_setup_c2h_data_pdu(struct nvmet_tcp_cmd *cmd)
364 {
365 	struct nvme_tcp_data_pdu *pdu = cmd->data_pdu;
366 	struct nvmet_tcp_queue *queue = cmd->queue;
367 	u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
368 	u8 ddgst = nvmet_tcp_ddgst_len(cmd->queue);
369 
370 	cmd->offset = 0;
371 	cmd->state = NVMET_TCP_SEND_DATA_PDU;
372 
373 	pdu->hdr.type = nvme_tcp_c2h_data;
374 	pdu->hdr.flags = NVME_TCP_F_DATA_LAST | (queue->nvme_sq.sqhd_disabled ?
375 						NVME_TCP_F_DATA_SUCCESS : 0);
376 	pdu->hdr.hlen = sizeof(*pdu);
377 	pdu->hdr.pdo = pdu->hdr.hlen + hdgst;
378 	pdu->hdr.plen =
379 		cpu_to_le32(pdu->hdr.hlen + hdgst +
380 				cmd->req.transfer_len + ddgst);
381 	pdu->command_id = cmd->req.cqe->command_id;
382 	pdu->data_length = cpu_to_le32(cmd->req.transfer_len);
383 	pdu->data_offset = cpu_to_le32(cmd->wbytes_done);
384 
385 	if (queue->data_digest) {
386 		pdu->hdr.flags |= NVME_TCP_F_DDGST;
387 		nvmet_tcp_ddgst(queue->snd_hash, cmd);
388 	}
389 
390 	if (cmd->queue->hdr_digest) {
391 		pdu->hdr.flags |= NVME_TCP_F_HDGST;
392 		nvmet_tcp_hdgst(queue->snd_hash, pdu, sizeof(*pdu));
393 	}
394 }
395 
396 static void nvmet_setup_r2t_pdu(struct nvmet_tcp_cmd *cmd)
397 {
398 	struct nvme_tcp_r2t_pdu *pdu = cmd->r2t_pdu;
399 	struct nvmet_tcp_queue *queue = cmd->queue;
400 	u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
401 
402 	cmd->offset = 0;
403 	cmd->state = NVMET_TCP_SEND_R2T;
404 
405 	pdu->hdr.type = nvme_tcp_r2t;
406 	pdu->hdr.flags = 0;
407 	pdu->hdr.hlen = sizeof(*pdu);
408 	pdu->hdr.pdo = 0;
409 	pdu->hdr.plen = cpu_to_le32(pdu->hdr.hlen + hdgst);
410 
411 	pdu->command_id = cmd->req.cmd->common.command_id;
412 	pdu->ttag = nvmet_tcp_cmd_tag(cmd->queue, cmd);
413 	pdu->r2t_length = cpu_to_le32(cmd->req.transfer_len - cmd->rbytes_done);
414 	pdu->r2t_offset = cpu_to_le32(cmd->rbytes_done);
415 	if (cmd->queue->hdr_digest) {
416 		pdu->hdr.flags |= NVME_TCP_F_HDGST;
417 		nvmet_tcp_hdgst(queue->snd_hash, pdu, sizeof(*pdu));
418 	}
419 }
420 
421 static void nvmet_setup_response_pdu(struct nvmet_tcp_cmd *cmd)
422 {
423 	struct nvme_tcp_rsp_pdu *pdu = cmd->rsp_pdu;
424 	struct nvmet_tcp_queue *queue = cmd->queue;
425 	u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
426 
427 	cmd->offset = 0;
428 	cmd->state = NVMET_TCP_SEND_RESPONSE;
429 
430 	pdu->hdr.type = nvme_tcp_rsp;
431 	pdu->hdr.flags = 0;
432 	pdu->hdr.hlen = sizeof(*pdu);
433 	pdu->hdr.pdo = 0;
434 	pdu->hdr.plen = cpu_to_le32(pdu->hdr.hlen + hdgst);
435 	if (cmd->queue->hdr_digest) {
436 		pdu->hdr.flags |= NVME_TCP_F_HDGST;
437 		nvmet_tcp_hdgst(queue->snd_hash, pdu, sizeof(*pdu));
438 	}
439 }
440 
441 static void nvmet_tcp_process_resp_list(struct nvmet_tcp_queue *queue)
442 {
443 	struct llist_node *node;
444 
445 	node = llist_del_all(&queue->resp_list);
446 	if (!node)
447 		return;
448 
449 	while (node) {
450 		struct nvmet_tcp_cmd *cmd = llist_entry(node,
451 					struct nvmet_tcp_cmd, lentry);
452 
453 		list_add(&cmd->entry, &queue->resp_send_list);
454 		node = node->next;
455 		queue->send_list_len++;
456 	}
457 }
458 
459 static struct nvmet_tcp_cmd *nvmet_tcp_fetch_cmd(struct nvmet_tcp_queue *queue)
460 {
461 	queue->snd_cmd = list_first_entry_or_null(&queue->resp_send_list,
462 				struct nvmet_tcp_cmd, entry);
463 	if (!queue->snd_cmd) {
464 		nvmet_tcp_process_resp_list(queue);
465 		queue->snd_cmd =
466 			list_first_entry_or_null(&queue->resp_send_list,
467 					struct nvmet_tcp_cmd, entry);
468 		if (unlikely(!queue->snd_cmd))
469 			return NULL;
470 	}
471 
472 	list_del_init(&queue->snd_cmd->entry);
473 	queue->send_list_len--;
474 
475 	if (nvmet_tcp_need_data_out(queue->snd_cmd))
476 		nvmet_setup_c2h_data_pdu(queue->snd_cmd);
477 	else if (nvmet_tcp_need_data_in(queue->snd_cmd))
478 		nvmet_setup_r2t_pdu(queue->snd_cmd);
479 	else
480 		nvmet_setup_response_pdu(queue->snd_cmd);
481 
482 	return queue->snd_cmd;
483 }
484 
485 static void nvmet_tcp_queue_response(struct nvmet_req *req)
486 {
487 	struct nvmet_tcp_cmd *cmd =
488 		container_of(req, struct nvmet_tcp_cmd, req);
489 	struct nvmet_tcp_queue	*queue = cmd->queue;
490 
491 	llist_add(&cmd->lentry, &queue->resp_list);
492 	queue_work_on(cmd->queue->cpu, nvmet_tcp_wq, &cmd->queue->io_work);
493 }
494 
495 static int nvmet_try_send_data_pdu(struct nvmet_tcp_cmd *cmd)
496 {
497 	u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
498 	int left = sizeof(*cmd->data_pdu) - cmd->offset + hdgst;
499 	int ret;
500 
501 	ret = kernel_sendpage(cmd->queue->sock, virt_to_page(cmd->data_pdu),
502 			offset_in_page(cmd->data_pdu) + cmd->offset,
503 			left, MSG_DONTWAIT | MSG_MORE);
504 	if (ret <= 0)
505 		return ret;
506 
507 	cmd->offset += ret;
508 	left -= ret;
509 
510 	if (left)
511 		return -EAGAIN;
512 
513 	cmd->state = NVMET_TCP_SEND_DATA;
514 	cmd->offset  = 0;
515 	return 1;
516 }
517 
518 static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd)
519 {
520 	struct nvmet_tcp_queue *queue = cmd->queue;
521 	int ret;
522 
523 	while (cmd->cur_sg) {
524 		struct page *page = sg_page(cmd->cur_sg);
525 		u32 left = cmd->cur_sg->length - cmd->offset;
526 
527 		ret = kernel_sendpage(cmd->queue->sock, page, cmd->offset,
528 					left, MSG_DONTWAIT | MSG_MORE);
529 		if (ret <= 0)
530 			return ret;
531 
532 		cmd->offset += ret;
533 		cmd->wbytes_done += ret;
534 
535 		/* Done with sg?*/
536 		if (cmd->offset == cmd->cur_sg->length) {
537 			cmd->cur_sg = sg_next(cmd->cur_sg);
538 			cmd->offset = 0;
539 		}
540 	}
541 
542 	if (queue->data_digest) {
543 		cmd->state = NVMET_TCP_SEND_DDGST;
544 		cmd->offset = 0;
545 	} else {
546 		if (queue->nvme_sq.sqhd_disabled) {
547 			cmd->queue->snd_cmd = NULL;
548 			nvmet_tcp_put_cmd(cmd);
549 		} else {
550 			nvmet_setup_response_pdu(cmd);
551 		}
552 	}
553 
554 	if (queue->nvme_sq.sqhd_disabled) {
555 		kfree(cmd->iov);
556 		sgl_free(cmd->req.sg);
557 	}
558 
559 	return 1;
560 
561 }
562 
563 static int nvmet_try_send_response(struct nvmet_tcp_cmd *cmd,
564 		bool last_in_batch)
565 {
566 	u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
567 	int left = sizeof(*cmd->rsp_pdu) - cmd->offset + hdgst;
568 	int flags = MSG_DONTWAIT;
569 	int ret;
570 
571 	if (!last_in_batch && cmd->queue->send_list_len)
572 		flags |= MSG_MORE;
573 	else
574 		flags |= MSG_EOR;
575 
576 	ret = kernel_sendpage(cmd->queue->sock, virt_to_page(cmd->rsp_pdu),
577 		offset_in_page(cmd->rsp_pdu) + cmd->offset, left, flags);
578 	if (ret <= 0)
579 		return ret;
580 	cmd->offset += ret;
581 	left -= ret;
582 
583 	if (left)
584 		return -EAGAIN;
585 
586 	kfree(cmd->iov);
587 	sgl_free(cmd->req.sg);
588 	cmd->queue->snd_cmd = NULL;
589 	nvmet_tcp_put_cmd(cmd);
590 	return 1;
591 }
592 
593 static int nvmet_try_send_r2t(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
594 {
595 	u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
596 	int left = sizeof(*cmd->r2t_pdu) - cmd->offset + hdgst;
597 	int flags = MSG_DONTWAIT;
598 	int ret;
599 
600 	if (!last_in_batch && cmd->queue->send_list_len)
601 		flags |= MSG_MORE;
602 	else
603 		flags |= MSG_EOR;
604 
605 	ret = kernel_sendpage(cmd->queue->sock, virt_to_page(cmd->r2t_pdu),
606 		offset_in_page(cmd->r2t_pdu) + cmd->offset, left, flags);
607 	if (ret <= 0)
608 		return ret;
609 	cmd->offset += ret;
610 	left -= ret;
611 
612 	if (left)
613 		return -EAGAIN;
614 
615 	cmd->queue->snd_cmd = NULL;
616 	return 1;
617 }
618 
619 static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd)
620 {
621 	struct nvmet_tcp_queue *queue = cmd->queue;
622 	struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
623 	struct kvec iov = {
624 		.iov_base = &cmd->exp_ddgst + cmd->offset,
625 		.iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset
626 	};
627 	int ret;
628 
629 	ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
630 	if (unlikely(ret <= 0))
631 		return ret;
632 
633 	cmd->offset += ret;
634 
635 	if (queue->nvme_sq.sqhd_disabled) {
636 		cmd->queue->snd_cmd = NULL;
637 		nvmet_tcp_put_cmd(cmd);
638 	} else {
639 		nvmet_setup_response_pdu(cmd);
640 	}
641 	return 1;
642 }
643 
644 static int nvmet_tcp_try_send_one(struct nvmet_tcp_queue *queue,
645 		bool last_in_batch)
646 {
647 	struct nvmet_tcp_cmd *cmd = queue->snd_cmd;
648 	int ret = 0;
649 
650 	if (!cmd || queue->state == NVMET_TCP_Q_DISCONNECTING) {
651 		cmd = nvmet_tcp_fetch_cmd(queue);
652 		if (unlikely(!cmd))
653 			return 0;
654 	}
655 
656 	if (cmd->state == NVMET_TCP_SEND_DATA_PDU) {
657 		ret = nvmet_try_send_data_pdu(cmd);
658 		if (ret <= 0)
659 			goto done_send;
660 	}
661 
662 	if (cmd->state == NVMET_TCP_SEND_DATA) {
663 		ret = nvmet_try_send_data(cmd);
664 		if (ret <= 0)
665 			goto done_send;
666 	}
667 
668 	if (cmd->state == NVMET_TCP_SEND_DDGST) {
669 		ret = nvmet_try_send_ddgst(cmd);
670 		if (ret <= 0)
671 			goto done_send;
672 	}
673 
674 	if (cmd->state == NVMET_TCP_SEND_R2T) {
675 		ret = nvmet_try_send_r2t(cmd, last_in_batch);
676 		if (ret <= 0)
677 			goto done_send;
678 	}
679 
680 	if (cmd->state == NVMET_TCP_SEND_RESPONSE)
681 		ret = nvmet_try_send_response(cmd, last_in_batch);
682 
683 done_send:
684 	if (ret < 0) {
685 		if (ret == -EAGAIN)
686 			return 0;
687 		return ret;
688 	}
689 
690 	return 1;
691 }
692 
693 static int nvmet_tcp_try_send(struct nvmet_tcp_queue *queue,
694 		int budget, int *sends)
695 {
696 	int i, ret = 0;
697 
698 	for (i = 0; i < budget; i++) {
699 		ret = nvmet_tcp_try_send_one(queue, i == budget - 1);
700 		if (ret <= 0)
701 			break;
702 		(*sends)++;
703 	}
704 
705 	return ret;
706 }
707 
708 static void nvmet_prepare_receive_pdu(struct nvmet_tcp_queue *queue)
709 {
710 	queue->offset = 0;
711 	queue->left = sizeof(struct nvme_tcp_hdr);
712 	queue->cmd = NULL;
713 	queue->rcv_state = NVMET_TCP_RECV_PDU;
714 }
715 
716 static void nvmet_tcp_free_crypto(struct nvmet_tcp_queue *queue)
717 {
718 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(queue->rcv_hash);
719 
720 	ahash_request_free(queue->rcv_hash);
721 	ahash_request_free(queue->snd_hash);
722 	crypto_free_ahash(tfm);
723 }
724 
725 static int nvmet_tcp_alloc_crypto(struct nvmet_tcp_queue *queue)
726 {
727 	struct crypto_ahash *tfm;
728 
729 	tfm = crypto_alloc_ahash("crc32c", 0, CRYPTO_ALG_ASYNC);
730 	if (IS_ERR(tfm))
731 		return PTR_ERR(tfm);
732 
733 	queue->snd_hash = ahash_request_alloc(tfm, GFP_KERNEL);
734 	if (!queue->snd_hash)
735 		goto free_tfm;
736 	ahash_request_set_callback(queue->snd_hash, 0, NULL, NULL);
737 
738 	queue->rcv_hash = ahash_request_alloc(tfm, GFP_KERNEL);
739 	if (!queue->rcv_hash)
740 		goto free_snd_hash;
741 	ahash_request_set_callback(queue->rcv_hash, 0, NULL, NULL);
742 
743 	return 0;
744 free_snd_hash:
745 	ahash_request_free(queue->snd_hash);
746 free_tfm:
747 	crypto_free_ahash(tfm);
748 	return -ENOMEM;
749 }
750 
751 
752 static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
753 {
754 	struct nvme_tcp_icreq_pdu *icreq = &queue->pdu.icreq;
755 	struct nvme_tcp_icresp_pdu *icresp = &queue->pdu.icresp;
756 	struct msghdr msg = {};
757 	struct kvec iov;
758 	int ret;
759 
760 	if (le32_to_cpu(icreq->hdr.plen) != sizeof(struct nvme_tcp_icreq_pdu)) {
761 		pr_err("bad nvme-tcp pdu length (%d)\n",
762 			le32_to_cpu(icreq->hdr.plen));
763 		nvmet_tcp_fatal_error(queue);
764 	}
765 
766 	if (icreq->pfv != NVME_TCP_PFV_1_0) {
767 		pr_err("queue %d: bad pfv %d\n", queue->idx, icreq->pfv);
768 		return -EPROTO;
769 	}
770 
771 	if (icreq->hpda != 0) {
772 		pr_err("queue %d: unsupported hpda %d\n", queue->idx,
773 			icreq->hpda);
774 		return -EPROTO;
775 	}
776 
777 	queue->hdr_digest = !!(icreq->digest & NVME_TCP_HDR_DIGEST_ENABLE);
778 	queue->data_digest = !!(icreq->digest & NVME_TCP_DATA_DIGEST_ENABLE);
779 	if (queue->hdr_digest || queue->data_digest) {
780 		ret = nvmet_tcp_alloc_crypto(queue);
781 		if (ret)
782 			return ret;
783 	}
784 
785 	memset(icresp, 0, sizeof(*icresp));
786 	icresp->hdr.type = nvme_tcp_icresp;
787 	icresp->hdr.hlen = sizeof(*icresp);
788 	icresp->hdr.pdo = 0;
789 	icresp->hdr.plen = cpu_to_le32(icresp->hdr.hlen);
790 	icresp->pfv = cpu_to_le16(NVME_TCP_PFV_1_0);
791 	icresp->maxdata = cpu_to_le32(0xffff); /* FIXME: support r2t */
792 	icresp->cpda = 0;
793 	if (queue->hdr_digest)
794 		icresp->digest |= NVME_TCP_HDR_DIGEST_ENABLE;
795 	if (queue->data_digest)
796 		icresp->digest |= NVME_TCP_DATA_DIGEST_ENABLE;
797 
798 	iov.iov_base = icresp;
799 	iov.iov_len = sizeof(*icresp);
800 	ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
801 	if (ret < 0)
802 		goto free_crypto;
803 
804 	queue->state = NVMET_TCP_Q_LIVE;
805 	nvmet_prepare_receive_pdu(queue);
806 	return 0;
807 free_crypto:
808 	if (queue->hdr_digest || queue->data_digest)
809 		nvmet_tcp_free_crypto(queue);
810 	return ret;
811 }
812 
813 static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,
814 		struct nvmet_tcp_cmd *cmd, struct nvmet_req *req)
815 {
816 	size_t data_len = le32_to_cpu(req->cmd->common.dptr.sgl.length);
817 	int ret;
818 
819 	if (!nvme_is_write(cmd->req.cmd) ||
820 	    data_len > cmd->req.port->inline_data_size) {
821 		nvmet_prepare_receive_pdu(queue);
822 		return;
823 	}
824 
825 	ret = nvmet_tcp_map_data(cmd);
826 	if (unlikely(ret)) {
827 		pr_err("queue %d: failed to map data\n", queue->idx);
828 		nvmet_tcp_fatal_error(queue);
829 		return;
830 	}
831 
832 	queue->rcv_state = NVMET_TCP_RECV_DATA;
833 	nvmet_tcp_map_pdu_iovec(cmd);
834 	cmd->flags |= NVMET_TCP_F_INIT_FAILED;
835 }
836 
837 static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
838 {
839 	struct nvme_tcp_data_pdu *data = &queue->pdu.data;
840 	struct nvmet_tcp_cmd *cmd;
841 
842 	cmd = &queue->cmds[data->ttag];
843 
844 	if (le32_to_cpu(data->data_offset) != cmd->rbytes_done) {
845 		pr_err("ttag %u unexpected data offset %u (expected %u)\n",
846 			data->ttag, le32_to_cpu(data->data_offset),
847 			cmd->rbytes_done);
848 		/* FIXME: use path and transport errors */
849 		nvmet_req_complete(&cmd->req,
850 			NVME_SC_INVALID_FIELD | NVME_SC_DNR);
851 		return -EPROTO;
852 	}
853 
854 	cmd->pdu_len = le32_to_cpu(data->data_length);
855 	cmd->pdu_recv = 0;
856 	nvmet_tcp_map_pdu_iovec(cmd);
857 	queue->cmd = cmd;
858 	queue->rcv_state = NVMET_TCP_RECV_DATA;
859 
860 	return 0;
861 }
862 
863 static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue)
864 {
865 	struct nvme_tcp_hdr *hdr = &queue->pdu.cmd.hdr;
866 	struct nvme_command *nvme_cmd = &queue->pdu.cmd.cmd;
867 	struct nvmet_req *req;
868 	int ret;
869 
870 	if (unlikely(queue->state == NVMET_TCP_Q_CONNECTING)) {
871 		if (hdr->type != nvme_tcp_icreq) {
872 			pr_err("unexpected pdu type (%d) before icreq\n",
873 				hdr->type);
874 			nvmet_tcp_fatal_error(queue);
875 			return -EPROTO;
876 		}
877 		return nvmet_tcp_handle_icreq(queue);
878 	}
879 
880 	if (hdr->type == nvme_tcp_h2c_data) {
881 		ret = nvmet_tcp_handle_h2c_data_pdu(queue);
882 		if (unlikely(ret))
883 			return ret;
884 		return 0;
885 	}
886 
887 	queue->cmd = nvmet_tcp_get_cmd(queue);
888 	if (unlikely(!queue->cmd)) {
889 		/* This should never happen */
890 		pr_err("queue %d: out of commands (%d) send_list_len: %d, opcode: %d",
891 			queue->idx, queue->nr_cmds, queue->send_list_len,
892 			nvme_cmd->common.opcode);
893 		nvmet_tcp_fatal_error(queue);
894 		return -ENOMEM;
895 	}
896 
897 	req = &queue->cmd->req;
898 	memcpy(req->cmd, nvme_cmd, sizeof(*nvme_cmd));
899 
900 	if (unlikely(!nvmet_req_init(req, &queue->nvme_cq,
901 			&queue->nvme_sq, &nvmet_tcp_ops))) {
902 		pr_err("failed cmd %p id %d opcode %d, data_len: %d\n",
903 			req->cmd, req->cmd->common.command_id,
904 			req->cmd->common.opcode,
905 			le32_to_cpu(req->cmd->common.dptr.sgl.length));
906 
907 		nvmet_tcp_handle_req_failure(queue, queue->cmd, req);
908 		return -EAGAIN;
909 	}
910 
911 	ret = nvmet_tcp_map_data(queue->cmd);
912 	if (unlikely(ret)) {
913 		pr_err("queue %d: failed to map data\n", queue->idx);
914 		if (nvmet_tcp_has_inline_data(queue->cmd))
915 			nvmet_tcp_fatal_error(queue);
916 		else
917 			nvmet_req_complete(req, ret);
918 		ret = -EAGAIN;
919 		goto out;
920 	}
921 
922 	if (nvmet_tcp_need_data_in(queue->cmd)) {
923 		if (nvmet_tcp_has_inline_data(queue->cmd)) {
924 			queue->rcv_state = NVMET_TCP_RECV_DATA;
925 			nvmet_tcp_map_pdu_iovec(queue->cmd);
926 			return 0;
927 		}
928 		/* send back R2T */
929 		nvmet_tcp_queue_response(&queue->cmd->req);
930 		goto out;
931 	}
932 
933 	queue->cmd->req.execute(&queue->cmd->req);
934 out:
935 	nvmet_prepare_receive_pdu(queue);
936 	return ret;
937 }
938 
939 static const u8 nvme_tcp_pdu_sizes[] = {
940 	[nvme_tcp_icreq]	= sizeof(struct nvme_tcp_icreq_pdu),
941 	[nvme_tcp_cmd]		= sizeof(struct nvme_tcp_cmd_pdu),
942 	[nvme_tcp_h2c_data]	= sizeof(struct nvme_tcp_data_pdu),
943 };
944 
945 static inline u8 nvmet_tcp_pdu_size(u8 type)
946 {
947 	size_t idx = type;
948 
949 	return (idx < ARRAY_SIZE(nvme_tcp_pdu_sizes) &&
950 		nvme_tcp_pdu_sizes[idx]) ?
951 			nvme_tcp_pdu_sizes[idx] : 0;
952 }
953 
954 static inline bool nvmet_tcp_pdu_valid(u8 type)
955 {
956 	switch (type) {
957 	case nvme_tcp_icreq:
958 	case nvme_tcp_cmd:
959 	case nvme_tcp_h2c_data:
960 		/* fallthru */
961 		return true;
962 	}
963 
964 	return false;
965 }
966 
967 static int nvmet_tcp_try_recv_pdu(struct nvmet_tcp_queue *queue)
968 {
969 	struct nvme_tcp_hdr *hdr = &queue->pdu.cmd.hdr;
970 	int len;
971 	struct kvec iov;
972 	struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
973 
974 recv:
975 	iov.iov_base = (void *)&queue->pdu + queue->offset;
976 	iov.iov_len = queue->left;
977 	len = kernel_recvmsg(queue->sock, &msg, &iov, 1,
978 			iov.iov_len, msg.msg_flags);
979 	if (unlikely(len < 0))
980 		return len;
981 
982 	queue->offset += len;
983 	queue->left -= len;
984 	if (queue->left)
985 		return -EAGAIN;
986 
987 	if (queue->offset == sizeof(struct nvme_tcp_hdr)) {
988 		u8 hdgst = nvmet_tcp_hdgst_len(queue);
989 
990 		if (unlikely(!nvmet_tcp_pdu_valid(hdr->type))) {
991 			pr_err("unexpected pdu type %d\n", hdr->type);
992 			nvmet_tcp_fatal_error(queue);
993 			return -EIO;
994 		}
995 
996 		if (unlikely(hdr->hlen != nvmet_tcp_pdu_size(hdr->type))) {
997 			pr_err("pdu %d bad hlen %d\n", hdr->type, hdr->hlen);
998 			return -EIO;
999 		}
1000 
1001 		queue->left = hdr->hlen - queue->offset + hdgst;
1002 		goto recv;
1003 	}
1004 
1005 	if (queue->hdr_digest &&
1006 	    nvmet_tcp_verify_hdgst(queue, &queue->pdu, queue->offset)) {
1007 		nvmet_tcp_fatal_error(queue); /* fatal */
1008 		return -EPROTO;
1009 	}
1010 
1011 	if (queue->data_digest &&
1012 	    nvmet_tcp_check_ddgst(queue, &queue->pdu)) {
1013 		nvmet_tcp_fatal_error(queue); /* fatal */
1014 		return -EPROTO;
1015 	}
1016 
1017 	return nvmet_tcp_done_recv_pdu(queue);
1018 }
1019 
1020 static void nvmet_tcp_prep_recv_ddgst(struct nvmet_tcp_cmd *cmd)
1021 {
1022 	struct nvmet_tcp_queue *queue = cmd->queue;
1023 
1024 	nvmet_tcp_ddgst(queue->rcv_hash, cmd);
1025 	queue->offset = 0;
1026 	queue->left = NVME_TCP_DIGEST_LENGTH;
1027 	queue->rcv_state = NVMET_TCP_RECV_DDGST;
1028 }
1029 
1030 static int nvmet_tcp_try_recv_data(struct nvmet_tcp_queue *queue)
1031 {
1032 	struct nvmet_tcp_cmd  *cmd = queue->cmd;
1033 	int ret;
1034 
1035 	while (msg_data_left(&cmd->recv_msg)) {
1036 		ret = sock_recvmsg(cmd->queue->sock, &cmd->recv_msg,
1037 			cmd->recv_msg.msg_flags);
1038 		if (ret <= 0)
1039 			return ret;
1040 
1041 		cmd->pdu_recv += ret;
1042 		cmd->rbytes_done += ret;
1043 	}
1044 
1045 	nvmet_tcp_unmap_pdu_iovec(cmd);
1046 
1047 	if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED) &&
1048 	    cmd->rbytes_done == cmd->req.transfer_len) {
1049 		if (queue->data_digest) {
1050 			nvmet_tcp_prep_recv_ddgst(cmd);
1051 			return 0;
1052 		}
1053 		cmd->req.execute(&cmd->req);
1054 	}
1055 
1056 	nvmet_prepare_receive_pdu(queue);
1057 	return 0;
1058 }
1059 
1060 static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue)
1061 {
1062 	struct nvmet_tcp_cmd *cmd = queue->cmd;
1063 	int ret;
1064 	struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
1065 	struct kvec iov = {
1066 		.iov_base = (void *)&cmd->recv_ddgst + queue->offset,
1067 		.iov_len = queue->left
1068 	};
1069 
1070 	ret = kernel_recvmsg(queue->sock, &msg, &iov, 1,
1071 			iov.iov_len, msg.msg_flags);
1072 	if (unlikely(ret < 0))
1073 		return ret;
1074 
1075 	queue->offset += ret;
1076 	queue->left -= ret;
1077 	if (queue->left)
1078 		return -EAGAIN;
1079 
1080 	if (queue->data_digest && cmd->exp_ddgst != cmd->recv_ddgst) {
1081 		pr_err("queue %d: cmd %d pdu (%d) data digest error: recv %#x expected %#x\n",
1082 			queue->idx, cmd->req.cmd->common.command_id,
1083 			queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
1084 			le32_to_cpu(cmd->exp_ddgst));
1085 		nvmet_tcp_finish_cmd(cmd);
1086 		nvmet_tcp_fatal_error(queue);
1087 		ret = -EPROTO;
1088 		goto out;
1089 	}
1090 
1091 	if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED) &&
1092 	    cmd->rbytes_done == cmd->req.transfer_len)
1093 		cmd->req.execute(&cmd->req);
1094 	ret = 0;
1095 out:
1096 	nvmet_prepare_receive_pdu(queue);
1097 	return ret;
1098 }
1099 
1100 static int nvmet_tcp_try_recv_one(struct nvmet_tcp_queue *queue)
1101 {
1102 	int result = 0;
1103 
1104 	if (unlikely(queue->rcv_state == NVMET_TCP_RECV_ERR))
1105 		return 0;
1106 
1107 	if (queue->rcv_state == NVMET_TCP_RECV_PDU) {
1108 		result = nvmet_tcp_try_recv_pdu(queue);
1109 		if (result != 0)
1110 			goto done_recv;
1111 	}
1112 
1113 	if (queue->rcv_state == NVMET_TCP_RECV_DATA) {
1114 		result = nvmet_tcp_try_recv_data(queue);
1115 		if (result != 0)
1116 			goto done_recv;
1117 	}
1118 
1119 	if (queue->rcv_state == NVMET_TCP_RECV_DDGST) {
1120 		result = nvmet_tcp_try_recv_ddgst(queue);
1121 		if (result != 0)
1122 			goto done_recv;
1123 	}
1124 
1125 done_recv:
1126 	if (result < 0) {
1127 		if (result == -EAGAIN)
1128 			return 0;
1129 		return result;
1130 	}
1131 	return 1;
1132 }
1133 
1134 static int nvmet_tcp_try_recv(struct nvmet_tcp_queue *queue,
1135 		int budget, int *recvs)
1136 {
1137 	int i, ret = 0;
1138 
1139 	for (i = 0; i < budget; i++) {
1140 		ret = nvmet_tcp_try_recv_one(queue);
1141 		if (ret <= 0)
1142 			break;
1143 		(*recvs)++;
1144 	}
1145 
1146 	return ret;
1147 }
1148 
1149 static void nvmet_tcp_schedule_release_queue(struct nvmet_tcp_queue *queue)
1150 {
1151 	spin_lock(&queue->state_lock);
1152 	if (queue->state != NVMET_TCP_Q_DISCONNECTING) {
1153 		queue->state = NVMET_TCP_Q_DISCONNECTING;
1154 		schedule_work(&queue->release_work);
1155 	}
1156 	spin_unlock(&queue->state_lock);
1157 }
1158 
1159 static void nvmet_tcp_io_work(struct work_struct *w)
1160 {
1161 	struct nvmet_tcp_queue *queue =
1162 		container_of(w, struct nvmet_tcp_queue, io_work);
1163 	bool pending;
1164 	int ret, ops = 0;
1165 
1166 	do {
1167 		pending = false;
1168 
1169 		ret = nvmet_tcp_try_recv(queue, NVMET_TCP_RECV_BUDGET, &ops);
1170 		if (ret > 0) {
1171 			pending = true;
1172 		} else if (ret < 0) {
1173 			if (ret == -EPIPE || ret == -ECONNRESET)
1174 				kernel_sock_shutdown(queue->sock, SHUT_RDWR);
1175 			else
1176 				nvmet_tcp_fatal_error(queue);
1177 			return;
1178 		}
1179 
1180 		ret = nvmet_tcp_try_send(queue, NVMET_TCP_SEND_BUDGET, &ops);
1181 		if (ret > 0) {
1182 			/* transmitted message/data */
1183 			pending = true;
1184 		} else if (ret < 0) {
1185 			if (ret == -EPIPE || ret == -ECONNRESET)
1186 				kernel_sock_shutdown(queue->sock, SHUT_RDWR);
1187 			else
1188 				nvmet_tcp_fatal_error(queue);
1189 			return;
1190 		}
1191 
1192 	} while (pending && ops < NVMET_TCP_IO_WORK_BUDGET);
1193 
1194 	/*
1195 	 * We exahusted our budget, requeue our selves
1196 	 */
1197 	if (pending)
1198 		queue_work_on(queue->cpu, nvmet_tcp_wq, &queue->io_work);
1199 }
1200 
1201 static int nvmet_tcp_alloc_cmd(struct nvmet_tcp_queue *queue,
1202 		struct nvmet_tcp_cmd *c)
1203 {
1204 	u8 hdgst = nvmet_tcp_hdgst_len(queue);
1205 
1206 	c->queue = queue;
1207 	c->req.port = queue->port->nport;
1208 
1209 	c->cmd_pdu = page_frag_alloc(&queue->pf_cache,
1210 			sizeof(*c->cmd_pdu) + hdgst, GFP_KERNEL | __GFP_ZERO);
1211 	if (!c->cmd_pdu)
1212 		return -ENOMEM;
1213 	c->req.cmd = &c->cmd_pdu->cmd;
1214 
1215 	c->rsp_pdu = page_frag_alloc(&queue->pf_cache,
1216 			sizeof(*c->rsp_pdu) + hdgst, GFP_KERNEL | __GFP_ZERO);
1217 	if (!c->rsp_pdu)
1218 		goto out_free_cmd;
1219 	c->req.cqe = &c->rsp_pdu->cqe;
1220 
1221 	c->data_pdu = page_frag_alloc(&queue->pf_cache,
1222 			sizeof(*c->data_pdu) + hdgst, GFP_KERNEL | __GFP_ZERO);
1223 	if (!c->data_pdu)
1224 		goto out_free_rsp;
1225 
1226 	c->r2t_pdu = page_frag_alloc(&queue->pf_cache,
1227 			sizeof(*c->r2t_pdu) + hdgst, GFP_KERNEL | __GFP_ZERO);
1228 	if (!c->r2t_pdu)
1229 		goto out_free_data;
1230 
1231 	c->recv_msg.msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL;
1232 
1233 	list_add_tail(&c->entry, &queue->free_list);
1234 
1235 	return 0;
1236 out_free_data:
1237 	page_frag_free(c->data_pdu);
1238 out_free_rsp:
1239 	page_frag_free(c->rsp_pdu);
1240 out_free_cmd:
1241 	page_frag_free(c->cmd_pdu);
1242 	return -ENOMEM;
1243 }
1244 
1245 static void nvmet_tcp_free_cmd(struct nvmet_tcp_cmd *c)
1246 {
1247 	page_frag_free(c->r2t_pdu);
1248 	page_frag_free(c->data_pdu);
1249 	page_frag_free(c->rsp_pdu);
1250 	page_frag_free(c->cmd_pdu);
1251 }
1252 
1253 static int nvmet_tcp_alloc_cmds(struct nvmet_tcp_queue *queue)
1254 {
1255 	struct nvmet_tcp_cmd *cmds;
1256 	int i, ret = -EINVAL, nr_cmds = queue->nr_cmds;
1257 
1258 	cmds = kcalloc(nr_cmds, sizeof(struct nvmet_tcp_cmd), GFP_KERNEL);
1259 	if (!cmds)
1260 		goto out;
1261 
1262 	for (i = 0; i < nr_cmds; i++) {
1263 		ret = nvmet_tcp_alloc_cmd(queue, cmds + i);
1264 		if (ret)
1265 			goto out_free;
1266 	}
1267 
1268 	queue->cmds = cmds;
1269 
1270 	return 0;
1271 out_free:
1272 	while (--i >= 0)
1273 		nvmet_tcp_free_cmd(cmds + i);
1274 	kfree(cmds);
1275 out:
1276 	return ret;
1277 }
1278 
1279 static void nvmet_tcp_free_cmds(struct nvmet_tcp_queue *queue)
1280 {
1281 	struct nvmet_tcp_cmd *cmds = queue->cmds;
1282 	int i;
1283 
1284 	for (i = 0; i < queue->nr_cmds; i++)
1285 		nvmet_tcp_free_cmd(cmds + i);
1286 
1287 	nvmet_tcp_free_cmd(&queue->connect);
1288 	kfree(cmds);
1289 }
1290 
1291 static void nvmet_tcp_restore_socket_callbacks(struct nvmet_tcp_queue *queue)
1292 {
1293 	struct socket *sock = queue->sock;
1294 
1295 	write_lock_bh(&sock->sk->sk_callback_lock);
1296 	sock->sk->sk_data_ready =  queue->data_ready;
1297 	sock->sk->sk_state_change = queue->state_change;
1298 	sock->sk->sk_write_space = queue->write_space;
1299 	sock->sk->sk_user_data = NULL;
1300 	write_unlock_bh(&sock->sk->sk_callback_lock);
1301 }
1302 
1303 static void nvmet_tcp_finish_cmd(struct nvmet_tcp_cmd *cmd)
1304 {
1305 	nvmet_req_uninit(&cmd->req);
1306 	nvmet_tcp_unmap_pdu_iovec(cmd);
1307 	kfree(cmd->iov);
1308 	sgl_free(cmd->req.sg);
1309 }
1310 
1311 static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue)
1312 {
1313 	struct nvmet_tcp_cmd *cmd = queue->cmds;
1314 	int i;
1315 
1316 	for (i = 0; i < queue->nr_cmds; i++, cmd++) {
1317 		if (nvmet_tcp_need_data_in(cmd))
1318 			nvmet_tcp_finish_cmd(cmd);
1319 	}
1320 
1321 	if (!queue->nr_cmds && nvmet_tcp_need_data_in(&queue->connect)) {
1322 		/* failed in connect */
1323 		nvmet_tcp_finish_cmd(&queue->connect);
1324 	}
1325 }
1326 
1327 static void nvmet_tcp_release_queue_work(struct work_struct *w)
1328 {
1329 	struct nvmet_tcp_queue *queue =
1330 		container_of(w, struct nvmet_tcp_queue, release_work);
1331 
1332 	mutex_lock(&nvmet_tcp_queue_mutex);
1333 	list_del_init(&queue->queue_list);
1334 	mutex_unlock(&nvmet_tcp_queue_mutex);
1335 
1336 	nvmet_tcp_restore_socket_callbacks(queue);
1337 	flush_work(&queue->io_work);
1338 
1339 	nvmet_tcp_uninit_data_in_cmds(queue);
1340 	nvmet_sq_destroy(&queue->nvme_sq);
1341 	cancel_work_sync(&queue->io_work);
1342 	sock_release(queue->sock);
1343 	nvmet_tcp_free_cmds(queue);
1344 	if (queue->hdr_digest || queue->data_digest)
1345 		nvmet_tcp_free_crypto(queue);
1346 	ida_simple_remove(&nvmet_tcp_queue_ida, queue->idx);
1347 
1348 	kfree(queue);
1349 }
1350 
1351 static void nvmet_tcp_data_ready(struct sock *sk)
1352 {
1353 	struct nvmet_tcp_queue *queue;
1354 
1355 	read_lock_bh(&sk->sk_callback_lock);
1356 	queue = sk->sk_user_data;
1357 	if (likely(queue))
1358 		queue_work_on(queue->cpu, nvmet_tcp_wq, &queue->io_work);
1359 	read_unlock_bh(&sk->sk_callback_lock);
1360 }
1361 
1362 static void nvmet_tcp_write_space(struct sock *sk)
1363 {
1364 	struct nvmet_tcp_queue *queue;
1365 
1366 	read_lock_bh(&sk->sk_callback_lock);
1367 	queue = sk->sk_user_data;
1368 	if (unlikely(!queue))
1369 		goto out;
1370 
1371 	if (unlikely(queue->state == NVMET_TCP_Q_CONNECTING)) {
1372 		queue->write_space(sk);
1373 		goto out;
1374 	}
1375 
1376 	if (sk_stream_is_writeable(sk)) {
1377 		clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
1378 		queue_work_on(queue->cpu, nvmet_tcp_wq, &queue->io_work);
1379 	}
1380 out:
1381 	read_unlock_bh(&sk->sk_callback_lock);
1382 }
1383 
1384 static void nvmet_tcp_state_change(struct sock *sk)
1385 {
1386 	struct nvmet_tcp_queue *queue;
1387 
1388 	write_lock_bh(&sk->sk_callback_lock);
1389 	queue = sk->sk_user_data;
1390 	if (!queue)
1391 		goto done;
1392 
1393 	switch (sk->sk_state) {
1394 	case TCP_FIN_WAIT1:
1395 	case TCP_CLOSE_WAIT:
1396 	case TCP_CLOSE:
1397 		/* FALLTHRU */
1398 		sk->sk_user_data = NULL;
1399 		nvmet_tcp_schedule_release_queue(queue);
1400 		break;
1401 	default:
1402 		pr_warn("queue %d unhandled state %d\n",
1403 			queue->idx, sk->sk_state);
1404 	}
1405 done:
1406 	write_unlock_bh(&sk->sk_callback_lock);
1407 }
1408 
1409 static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue)
1410 {
1411 	struct socket *sock = queue->sock;
1412 	struct inet_sock *inet = inet_sk(sock->sk);
1413 	struct linger sol = { .l_onoff = 1, .l_linger = 0 };
1414 	int ret;
1415 
1416 	ret = kernel_getsockname(sock,
1417 		(struct sockaddr *)&queue->sockaddr);
1418 	if (ret < 0)
1419 		return ret;
1420 
1421 	ret = kernel_getpeername(sock,
1422 		(struct sockaddr *)&queue->sockaddr_peer);
1423 	if (ret < 0)
1424 		return ret;
1425 
1426 	/*
1427 	 * Cleanup whatever is sitting in the TCP transmit queue on socket
1428 	 * close. This is done to prevent stale data from being sent should
1429 	 * the network connection be restored before TCP times out.
1430 	 */
1431 	ret = kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER,
1432 			(char *)&sol, sizeof(sol));
1433 	if (ret)
1434 		return ret;
1435 
1436 	/* Set socket type of service */
1437 	if (inet->rcv_tos > 0) {
1438 		int tos = inet->rcv_tos;
1439 
1440 		ret = kernel_setsockopt(sock, SOL_IP, IP_TOS,
1441 				(char *)&tos, sizeof(tos));
1442 		if (ret)
1443 			return ret;
1444 	}
1445 
1446 	write_lock_bh(&sock->sk->sk_callback_lock);
1447 	sock->sk->sk_user_data = queue;
1448 	queue->data_ready = sock->sk->sk_data_ready;
1449 	sock->sk->sk_data_ready = nvmet_tcp_data_ready;
1450 	queue->state_change = sock->sk->sk_state_change;
1451 	sock->sk->sk_state_change = nvmet_tcp_state_change;
1452 	queue->write_space = sock->sk->sk_write_space;
1453 	sock->sk->sk_write_space = nvmet_tcp_write_space;
1454 	write_unlock_bh(&sock->sk->sk_callback_lock);
1455 
1456 	return 0;
1457 }
1458 
1459 static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port,
1460 		struct socket *newsock)
1461 {
1462 	struct nvmet_tcp_queue *queue;
1463 	int ret;
1464 
1465 	queue = kzalloc(sizeof(*queue), GFP_KERNEL);
1466 	if (!queue)
1467 		return -ENOMEM;
1468 
1469 	INIT_WORK(&queue->release_work, nvmet_tcp_release_queue_work);
1470 	INIT_WORK(&queue->io_work, nvmet_tcp_io_work);
1471 	queue->sock = newsock;
1472 	queue->port = port;
1473 	queue->nr_cmds = 0;
1474 	spin_lock_init(&queue->state_lock);
1475 	queue->state = NVMET_TCP_Q_CONNECTING;
1476 	INIT_LIST_HEAD(&queue->free_list);
1477 	init_llist_head(&queue->resp_list);
1478 	INIT_LIST_HEAD(&queue->resp_send_list);
1479 
1480 	queue->idx = ida_simple_get(&nvmet_tcp_queue_ida, 0, 0, GFP_KERNEL);
1481 	if (queue->idx < 0) {
1482 		ret = queue->idx;
1483 		goto out_free_queue;
1484 	}
1485 
1486 	ret = nvmet_tcp_alloc_cmd(queue, &queue->connect);
1487 	if (ret)
1488 		goto out_ida_remove;
1489 
1490 	ret = nvmet_sq_init(&queue->nvme_sq);
1491 	if (ret)
1492 		goto out_free_connect;
1493 
1494 	port->last_cpu = cpumask_next_wrap(port->last_cpu,
1495 				cpu_online_mask, -1, false);
1496 	queue->cpu = port->last_cpu;
1497 	nvmet_prepare_receive_pdu(queue);
1498 
1499 	mutex_lock(&nvmet_tcp_queue_mutex);
1500 	list_add_tail(&queue->queue_list, &nvmet_tcp_queue_list);
1501 	mutex_unlock(&nvmet_tcp_queue_mutex);
1502 
1503 	ret = nvmet_tcp_set_queue_sock(queue);
1504 	if (ret)
1505 		goto out_destroy_sq;
1506 
1507 	queue_work_on(queue->cpu, nvmet_tcp_wq, &queue->io_work);
1508 
1509 	return 0;
1510 out_destroy_sq:
1511 	mutex_lock(&nvmet_tcp_queue_mutex);
1512 	list_del_init(&queue->queue_list);
1513 	mutex_unlock(&nvmet_tcp_queue_mutex);
1514 	nvmet_sq_destroy(&queue->nvme_sq);
1515 out_free_connect:
1516 	nvmet_tcp_free_cmd(&queue->connect);
1517 out_ida_remove:
1518 	ida_simple_remove(&nvmet_tcp_queue_ida, queue->idx);
1519 out_free_queue:
1520 	kfree(queue);
1521 	return ret;
1522 }
1523 
1524 static void nvmet_tcp_accept_work(struct work_struct *w)
1525 {
1526 	struct nvmet_tcp_port *port =
1527 		container_of(w, struct nvmet_tcp_port, accept_work);
1528 	struct socket *newsock;
1529 	int ret;
1530 
1531 	while (true) {
1532 		ret = kernel_accept(port->sock, &newsock, O_NONBLOCK);
1533 		if (ret < 0) {
1534 			if (ret != -EAGAIN)
1535 				pr_warn("failed to accept err=%d\n", ret);
1536 			return;
1537 		}
1538 		ret = nvmet_tcp_alloc_queue(port, newsock);
1539 		if (ret) {
1540 			pr_err("failed to allocate queue\n");
1541 			sock_release(newsock);
1542 		}
1543 	}
1544 }
1545 
1546 static void nvmet_tcp_listen_data_ready(struct sock *sk)
1547 {
1548 	struct nvmet_tcp_port *port;
1549 
1550 	read_lock_bh(&sk->sk_callback_lock);
1551 	port = sk->sk_user_data;
1552 	if (!port)
1553 		goto out;
1554 
1555 	if (sk->sk_state == TCP_LISTEN)
1556 		schedule_work(&port->accept_work);
1557 out:
1558 	read_unlock_bh(&sk->sk_callback_lock);
1559 }
1560 
1561 static int nvmet_tcp_add_port(struct nvmet_port *nport)
1562 {
1563 	struct nvmet_tcp_port *port;
1564 	__kernel_sa_family_t af;
1565 	int opt, ret;
1566 
1567 	port = kzalloc(sizeof(*port), GFP_KERNEL);
1568 	if (!port)
1569 		return -ENOMEM;
1570 
1571 	switch (nport->disc_addr.adrfam) {
1572 	case NVMF_ADDR_FAMILY_IP4:
1573 		af = AF_INET;
1574 		break;
1575 	case NVMF_ADDR_FAMILY_IP6:
1576 		af = AF_INET6;
1577 		break;
1578 	default:
1579 		pr_err("address family %d not supported\n",
1580 				nport->disc_addr.adrfam);
1581 		ret = -EINVAL;
1582 		goto err_port;
1583 	}
1584 
1585 	ret = inet_pton_with_scope(&init_net, af, nport->disc_addr.traddr,
1586 			nport->disc_addr.trsvcid, &port->addr);
1587 	if (ret) {
1588 		pr_err("malformed ip/port passed: %s:%s\n",
1589 			nport->disc_addr.traddr, nport->disc_addr.trsvcid);
1590 		goto err_port;
1591 	}
1592 
1593 	port->nport = nport;
1594 	port->last_cpu = -1;
1595 	INIT_WORK(&port->accept_work, nvmet_tcp_accept_work);
1596 	if (port->nport->inline_data_size < 0)
1597 		port->nport->inline_data_size = NVMET_TCP_DEF_INLINE_DATA_SIZE;
1598 
1599 	ret = sock_create(port->addr.ss_family, SOCK_STREAM,
1600 				IPPROTO_TCP, &port->sock);
1601 	if (ret) {
1602 		pr_err("failed to create a socket\n");
1603 		goto err_port;
1604 	}
1605 
1606 	port->sock->sk->sk_user_data = port;
1607 	port->data_ready = port->sock->sk->sk_data_ready;
1608 	port->sock->sk->sk_data_ready = nvmet_tcp_listen_data_ready;
1609 
1610 	opt = 1;
1611 	ret = kernel_setsockopt(port->sock, IPPROTO_TCP,
1612 			TCP_NODELAY, (char *)&opt, sizeof(opt));
1613 	if (ret) {
1614 		pr_err("failed to set TCP_NODELAY sock opt %d\n", ret);
1615 		goto err_sock;
1616 	}
1617 
1618 	ret = kernel_setsockopt(port->sock, SOL_SOCKET, SO_REUSEADDR,
1619 			(char *)&opt, sizeof(opt));
1620 	if (ret) {
1621 		pr_err("failed to set SO_REUSEADDR sock opt %d\n", ret);
1622 		goto err_sock;
1623 	}
1624 
1625 	ret = kernel_bind(port->sock, (struct sockaddr *)&port->addr,
1626 			sizeof(port->addr));
1627 	if (ret) {
1628 		pr_err("failed to bind port socket %d\n", ret);
1629 		goto err_sock;
1630 	}
1631 
1632 	ret = kernel_listen(port->sock, 128);
1633 	if (ret) {
1634 		pr_err("failed to listen %d on port sock\n", ret);
1635 		goto err_sock;
1636 	}
1637 
1638 	nport->priv = port;
1639 	pr_info("enabling port %d (%pISpc)\n",
1640 		le16_to_cpu(nport->disc_addr.portid), &port->addr);
1641 
1642 	return 0;
1643 
1644 err_sock:
1645 	sock_release(port->sock);
1646 err_port:
1647 	kfree(port);
1648 	return ret;
1649 }
1650 
1651 static void nvmet_tcp_remove_port(struct nvmet_port *nport)
1652 {
1653 	struct nvmet_tcp_port *port = nport->priv;
1654 
1655 	write_lock_bh(&port->sock->sk->sk_callback_lock);
1656 	port->sock->sk->sk_data_ready = port->data_ready;
1657 	port->sock->sk->sk_user_data = NULL;
1658 	write_unlock_bh(&port->sock->sk->sk_callback_lock);
1659 	cancel_work_sync(&port->accept_work);
1660 
1661 	sock_release(port->sock);
1662 	kfree(port);
1663 }
1664 
1665 static void nvmet_tcp_delete_ctrl(struct nvmet_ctrl *ctrl)
1666 {
1667 	struct nvmet_tcp_queue *queue;
1668 
1669 	mutex_lock(&nvmet_tcp_queue_mutex);
1670 	list_for_each_entry(queue, &nvmet_tcp_queue_list, queue_list)
1671 		if (queue->nvme_sq.ctrl == ctrl)
1672 			kernel_sock_shutdown(queue->sock, SHUT_RDWR);
1673 	mutex_unlock(&nvmet_tcp_queue_mutex);
1674 }
1675 
1676 static u16 nvmet_tcp_install_queue(struct nvmet_sq *sq)
1677 {
1678 	struct nvmet_tcp_queue *queue =
1679 		container_of(sq, struct nvmet_tcp_queue, nvme_sq);
1680 
1681 	if (sq->qid == 0) {
1682 		/* Let inflight controller teardown complete */
1683 		flush_scheduled_work();
1684 	}
1685 
1686 	queue->nr_cmds = sq->size * 2;
1687 	if (nvmet_tcp_alloc_cmds(queue))
1688 		return NVME_SC_INTERNAL;
1689 	return 0;
1690 }
1691 
1692 static void nvmet_tcp_disc_port_addr(struct nvmet_req *req,
1693 		struct nvmet_port *nport, char *traddr)
1694 {
1695 	struct nvmet_tcp_port *port = nport->priv;
1696 
1697 	if (inet_addr_is_any((struct sockaddr *)&port->addr)) {
1698 		struct nvmet_tcp_cmd *cmd =
1699 			container_of(req, struct nvmet_tcp_cmd, req);
1700 		struct nvmet_tcp_queue *queue = cmd->queue;
1701 
1702 		sprintf(traddr, "%pISc", (struct sockaddr *)&queue->sockaddr);
1703 	} else {
1704 		memcpy(traddr, nport->disc_addr.traddr, NVMF_TRADDR_SIZE);
1705 	}
1706 }
1707 
1708 static struct nvmet_fabrics_ops nvmet_tcp_ops = {
1709 	.owner			= THIS_MODULE,
1710 	.type			= NVMF_TRTYPE_TCP,
1711 	.msdbd			= 1,
1712 	.has_keyed_sgls		= 0,
1713 	.add_port		= nvmet_tcp_add_port,
1714 	.remove_port		= nvmet_tcp_remove_port,
1715 	.queue_response		= nvmet_tcp_queue_response,
1716 	.delete_ctrl		= nvmet_tcp_delete_ctrl,
1717 	.install_queue		= nvmet_tcp_install_queue,
1718 	.disc_traddr		= nvmet_tcp_disc_port_addr,
1719 };
1720 
1721 static int __init nvmet_tcp_init(void)
1722 {
1723 	int ret;
1724 
1725 	nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", WQ_HIGHPRI, 0);
1726 	if (!nvmet_tcp_wq)
1727 		return -ENOMEM;
1728 
1729 	ret = nvmet_register_transport(&nvmet_tcp_ops);
1730 	if (ret)
1731 		goto err;
1732 
1733 	return 0;
1734 err:
1735 	destroy_workqueue(nvmet_tcp_wq);
1736 	return ret;
1737 }
1738 
1739 static void __exit nvmet_tcp_exit(void)
1740 {
1741 	struct nvmet_tcp_queue *queue;
1742 
1743 	nvmet_unregister_transport(&nvmet_tcp_ops);
1744 
1745 	flush_scheduled_work();
1746 	mutex_lock(&nvmet_tcp_queue_mutex);
1747 	list_for_each_entry(queue, &nvmet_tcp_queue_list, queue_list)
1748 		kernel_sock_shutdown(queue->sock, SHUT_RDWR);
1749 	mutex_unlock(&nvmet_tcp_queue_mutex);
1750 	flush_scheduled_work();
1751 
1752 	destroy_workqueue(nvmet_tcp_wq);
1753 }
1754 
1755 module_init(nvmet_tcp_init);
1756 module_exit(nvmet_tcp_exit);
1757 
1758 MODULE_LICENSE("GPL v2");
1759 MODULE_ALIAS("nvmet-transport-3"); /* 3 == NVMF_TRTYPE_TCP */
1760