xref: /openbmc/linux/drivers/scsi/libiscsi.c (revision 31e67366)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * iSCSI lib functions
4  *
5  * Copyright (C) 2006 Red Hat, Inc.  All rights reserved.
6  * Copyright (C) 2004 - 2006 Mike Christie
7  * Copyright (C) 2004 - 2005 Dmitry Yusupov
8  * Copyright (C) 2004 - 2005 Alex Aizman
9  * maintained by open-iscsi@googlegroups.com
10  */
11 #include <linux/types.h>
12 #include <linux/kfifo.h>
13 #include <linux/delay.h>
14 #include <linux/log2.h>
15 #include <linux/slab.h>
16 #include <linux/sched/signal.h>
17 #include <linux/module.h>
18 #include <asm/unaligned.h>
19 #include <net/tcp.h>
20 #include <scsi/scsi_cmnd.h>
21 #include <scsi/scsi_device.h>
22 #include <scsi/scsi_eh.h>
23 #include <scsi/scsi_tcq.h>
24 #include <scsi/scsi_host.h>
25 #include <scsi/scsi.h>
26 #include <scsi/iscsi_proto.h>
27 #include <scsi/scsi_transport.h>
28 #include <scsi/scsi_transport_iscsi.h>
29 #include <scsi/libiscsi.h>
30 #include <trace/events/iscsi.h>
31 
32 static int iscsi_dbg_lib_conn;
33 module_param_named(debug_libiscsi_conn, iscsi_dbg_lib_conn, int,
34 		   S_IRUGO | S_IWUSR);
35 MODULE_PARM_DESC(debug_libiscsi_conn,
36 		 "Turn on debugging for connections in libiscsi module. "
37 		 "Set to 1 to turn on, and zero to turn off. Default is off.");
38 
39 static int iscsi_dbg_lib_session;
40 module_param_named(debug_libiscsi_session, iscsi_dbg_lib_session, int,
41 		   S_IRUGO | S_IWUSR);
42 MODULE_PARM_DESC(debug_libiscsi_session,
43 		 "Turn on debugging for sessions in libiscsi module. "
44 		 "Set to 1 to turn on, and zero to turn off. Default is off.");
45 
46 static int iscsi_dbg_lib_eh;
47 module_param_named(debug_libiscsi_eh, iscsi_dbg_lib_eh, int,
48 		   S_IRUGO | S_IWUSR);
49 MODULE_PARM_DESC(debug_libiscsi_eh,
50 		 "Turn on debugging for error handling in libiscsi module. "
51 		 "Set to 1 to turn on, and zero to turn off. Default is off.");
52 
53 #define ISCSI_DBG_CONN(_conn, dbg_fmt, arg...)			\
54 	do {							\
55 		if (iscsi_dbg_lib_conn)				\
56 			iscsi_conn_printk(KERN_INFO, _conn,	\
57 					     "%s " dbg_fmt,	\
58 					     __func__, ##arg);	\
59 		iscsi_dbg_trace(trace_iscsi_dbg_conn,		\
60 				&(_conn)->cls_conn->dev,	\
61 				"%s " dbg_fmt, __func__, ##arg);\
62 	} while (0);
63 
64 #define ISCSI_DBG_SESSION(_session, dbg_fmt, arg...)			\
65 	do {								\
66 		if (iscsi_dbg_lib_session)				\
67 			iscsi_session_printk(KERN_INFO, _session,	\
68 					     "%s " dbg_fmt,		\
69 					     __func__, ##arg);		\
70 		iscsi_dbg_trace(trace_iscsi_dbg_session, 		\
71 				&(_session)->cls_session->dev,		\
72 				"%s " dbg_fmt, __func__, ##arg);	\
73 	} while (0);
74 
75 #define ISCSI_DBG_EH(_session, dbg_fmt, arg...)				\
76 	do {								\
77 		if (iscsi_dbg_lib_eh)					\
78 			iscsi_session_printk(KERN_INFO, _session,	\
79 					     "%s " dbg_fmt,		\
80 					     __func__, ##arg);		\
81 		iscsi_dbg_trace(trace_iscsi_dbg_eh,			\
82 				&(_session)->cls_session->dev,		\
83 				"%s " dbg_fmt, __func__, ##arg);	\
84 	} while (0);
85 
86 inline void iscsi_conn_queue_work(struct iscsi_conn *conn)
87 {
88 	struct Scsi_Host *shost = conn->session->host;
89 	struct iscsi_host *ihost = shost_priv(shost);
90 
91 	if (ihost->workq)
92 		queue_work(ihost->workq, &conn->xmitwork);
93 }
94 EXPORT_SYMBOL_GPL(iscsi_conn_queue_work);
95 
96 static void __iscsi_update_cmdsn(struct iscsi_session *session,
97 				 uint32_t exp_cmdsn, uint32_t max_cmdsn)
98 {
99 	/*
100 	 * standard specifies this check for when to update expected and
101 	 * max sequence numbers
102 	 */
103 	if (iscsi_sna_lt(max_cmdsn, exp_cmdsn - 1))
104 		return;
105 
106 	if (exp_cmdsn != session->exp_cmdsn &&
107 	    !iscsi_sna_lt(exp_cmdsn, session->exp_cmdsn))
108 		session->exp_cmdsn = exp_cmdsn;
109 
110 	if (max_cmdsn != session->max_cmdsn &&
111 	    !iscsi_sna_lt(max_cmdsn, session->max_cmdsn))
112 		session->max_cmdsn = max_cmdsn;
113 }
114 
115 void iscsi_update_cmdsn(struct iscsi_session *session, struct iscsi_nopin *hdr)
116 {
117 	__iscsi_update_cmdsn(session, be32_to_cpu(hdr->exp_cmdsn),
118 			     be32_to_cpu(hdr->max_cmdsn));
119 }
120 EXPORT_SYMBOL_GPL(iscsi_update_cmdsn);
121 
122 /**
123  * iscsi_prep_data_out_pdu - initialize Data-Out
124  * @task: scsi command task
125  * @r2t: R2T info
126  * @hdr: iscsi data in pdu
127  *
128  * Notes:
129  *	Initialize Data-Out within this R2T sequence and finds
130  *	proper data_offset within this SCSI command.
131  *
132  *	This function is called with connection lock taken.
133  **/
134 void iscsi_prep_data_out_pdu(struct iscsi_task *task, struct iscsi_r2t_info *r2t,
135 			   struct iscsi_data *hdr)
136 {
137 	struct iscsi_conn *conn = task->conn;
138 	unsigned int left = r2t->data_length - r2t->sent;
139 
140 	task->hdr_len = sizeof(struct iscsi_data);
141 
142 	memset(hdr, 0, sizeof(struct iscsi_data));
143 	hdr->ttt = r2t->ttt;
144 	hdr->datasn = cpu_to_be32(r2t->datasn);
145 	r2t->datasn++;
146 	hdr->opcode = ISCSI_OP_SCSI_DATA_OUT;
147 	hdr->lun = task->lun;
148 	hdr->itt = task->hdr_itt;
149 	hdr->exp_statsn = r2t->exp_statsn;
150 	hdr->offset = cpu_to_be32(r2t->data_offset + r2t->sent);
151 	if (left > conn->max_xmit_dlength) {
152 		hton24(hdr->dlength, conn->max_xmit_dlength);
153 		r2t->data_count = conn->max_xmit_dlength;
154 		hdr->flags = 0;
155 	} else {
156 		hton24(hdr->dlength, left);
157 		r2t->data_count = left;
158 		hdr->flags = ISCSI_FLAG_CMD_FINAL;
159 	}
160 	conn->dataout_pdus_cnt++;
161 }
162 EXPORT_SYMBOL_GPL(iscsi_prep_data_out_pdu);
163 
164 static int iscsi_add_hdr(struct iscsi_task *task, unsigned len)
165 {
166 	unsigned exp_len = task->hdr_len + len;
167 
168 	if (exp_len > task->hdr_max) {
169 		WARN_ON(1);
170 		return -EINVAL;
171 	}
172 
173 	WARN_ON(len & (ISCSI_PAD_LEN - 1)); /* caller must pad the AHS */
174 	task->hdr_len = exp_len;
175 	return 0;
176 }
177 
178 /*
179  * make an extended cdb AHS
180  */
181 static int iscsi_prep_ecdb_ahs(struct iscsi_task *task)
182 {
183 	struct scsi_cmnd *cmd = task->sc;
184 	unsigned rlen, pad_len;
185 	unsigned short ahslength;
186 	struct iscsi_ecdb_ahdr *ecdb_ahdr;
187 	int rc;
188 
189 	ecdb_ahdr = iscsi_next_hdr(task);
190 	rlen = cmd->cmd_len - ISCSI_CDB_SIZE;
191 
192 	BUG_ON(rlen > sizeof(ecdb_ahdr->ecdb));
193 	ahslength = rlen + sizeof(ecdb_ahdr->reserved);
194 
195 	pad_len = iscsi_padding(rlen);
196 
197 	rc = iscsi_add_hdr(task, sizeof(ecdb_ahdr->ahslength) +
198 	                   sizeof(ecdb_ahdr->ahstype) + ahslength + pad_len);
199 	if (rc)
200 		return rc;
201 
202 	if (pad_len)
203 		memset(&ecdb_ahdr->ecdb[rlen], 0, pad_len);
204 
205 	ecdb_ahdr->ahslength = cpu_to_be16(ahslength);
206 	ecdb_ahdr->ahstype = ISCSI_AHSTYPE_CDB;
207 	ecdb_ahdr->reserved = 0;
208 	memcpy(ecdb_ahdr->ecdb, cmd->cmnd + ISCSI_CDB_SIZE, rlen);
209 
210 	ISCSI_DBG_SESSION(task->conn->session,
211 			  "iscsi_prep_ecdb_ahs: varlen_cdb_len %d "
212 		          "rlen %d pad_len %d ahs_length %d iscsi_headers_size "
213 		          "%u\n", cmd->cmd_len, rlen, pad_len, ahslength,
214 		          task->hdr_len);
215 	return 0;
216 }
217 
218 /**
219  * iscsi_check_tmf_restrictions - check if a task is affected by TMF
220  * @task: iscsi task
221  * @opcode: opcode to check for
222  *
223  * During TMF a task has to be checked if it's affected.
224  * All unrelated I/O can be passed through, but I/O to the
225  * affected LUN should be restricted.
226  * If 'fast_abort' is set we won't be sending any I/O to the
227  * affected LUN.
228  * Otherwise the target is waiting for all TTTs to be completed,
229  * so we have to send all outstanding Data-Out PDUs to the target.
230  */
231 static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
232 {
233 	struct iscsi_conn *conn = task->conn;
234 	struct iscsi_tm *tmf = &conn->tmhdr;
235 	u64 hdr_lun;
236 
237 	if (conn->tmf_state == TMF_INITIAL)
238 		return 0;
239 
240 	if ((tmf->opcode & ISCSI_OPCODE_MASK) != ISCSI_OP_SCSI_TMFUNC)
241 		return 0;
242 
243 	switch (ISCSI_TM_FUNC_VALUE(tmf)) {
244 	case ISCSI_TM_FUNC_LOGICAL_UNIT_RESET:
245 		/*
246 		 * Allow PDUs for unrelated LUNs
247 		 */
248 		hdr_lun = scsilun_to_int(&tmf->lun);
249 		if (hdr_lun != task->sc->device->lun)
250 			return 0;
251 		fallthrough;
252 	case ISCSI_TM_FUNC_TARGET_WARM_RESET:
253 		/*
254 		 * Fail all SCSI cmd PDUs
255 		 */
256 		if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
257 			iscsi_conn_printk(KERN_INFO, conn,
258 					  "task [op %x itt "
259 					  "0x%x/0x%x] "
260 					  "rejected.\n",
261 					  opcode, task->itt,
262 					  task->hdr_itt);
263 			return -EACCES;
264 		}
265 		/*
266 		 * And also all data-out PDUs in response to R2T
267 		 * if fast_abort is set.
268 		 */
269 		if (conn->session->fast_abort) {
270 			iscsi_conn_printk(KERN_INFO, conn,
271 					  "task [op %x itt "
272 					  "0x%x/0x%x] fast abort.\n",
273 					  opcode, task->itt,
274 					  task->hdr_itt);
275 			return -EACCES;
276 		}
277 		break;
278 	case ISCSI_TM_FUNC_ABORT_TASK:
279 		/*
280 		 * the caller has already checked if the task
281 		 * they want to abort was in the pending queue so if
282 		 * we are here the cmd pdu has gone out already, and
283 		 * we will only hit this for data-outs
284 		 */
285 		if (opcode == ISCSI_OP_SCSI_DATA_OUT &&
286 		    task->hdr_itt == tmf->rtt) {
287 			ISCSI_DBG_SESSION(conn->session,
288 					  "Preventing task %x/%x from sending "
289 					  "data-out due to abort task in "
290 					  "progress\n", task->itt,
291 					  task->hdr_itt);
292 			return -EACCES;
293 		}
294 		break;
295 	}
296 
297 	return 0;
298 }
299 
300 /**
301  * iscsi_prep_scsi_cmd_pdu - prep iscsi scsi cmd pdu
302  * @task: iscsi task
303  *
304  * Prep basic iSCSI PDU fields for a scsi cmd pdu. The LLD should set
305  * fields like dlength or final based on how much data it sends
306  */
307 static int iscsi_prep_scsi_cmd_pdu(struct iscsi_task *task)
308 {
309 	struct iscsi_conn *conn = task->conn;
310 	struct iscsi_session *session = conn->session;
311 	struct scsi_cmnd *sc = task->sc;
312 	struct iscsi_scsi_req *hdr;
313 	unsigned hdrlength, cmd_len, transfer_length;
314 	itt_t itt;
315 	int rc;
316 
317 	rc = iscsi_check_tmf_restrictions(task, ISCSI_OP_SCSI_CMD);
318 	if (rc)
319 		return rc;
320 
321 	if (conn->session->tt->alloc_pdu) {
322 		rc = conn->session->tt->alloc_pdu(task, ISCSI_OP_SCSI_CMD);
323 		if (rc)
324 			return rc;
325 	}
326 	hdr = (struct iscsi_scsi_req *)task->hdr;
327 	itt = hdr->itt;
328 	memset(hdr, 0, sizeof(*hdr));
329 
330 	if (session->tt->parse_pdu_itt)
331 		hdr->itt = task->hdr_itt = itt;
332 	else
333 		hdr->itt = task->hdr_itt = build_itt(task->itt,
334 						     task->conn->session->age);
335 	task->hdr_len = 0;
336 	rc = iscsi_add_hdr(task, sizeof(*hdr));
337 	if (rc)
338 		return rc;
339 	hdr->opcode = ISCSI_OP_SCSI_CMD;
340 	hdr->flags = ISCSI_ATTR_SIMPLE;
341 	int_to_scsilun(sc->device->lun, &hdr->lun);
342 	task->lun = hdr->lun;
343 	hdr->exp_statsn = cpu_to_be32(conn->exp_statsn);
344 	cmd_len = sc->cmd_len;
345 	if (cmd_len < ISCSI_CDB_SIZE)
346 		memset(&hdr->cdb[cmd_len], 0, ISCSI_CDB_SIZE - cmd_len);
347 	else if (cmd_len > ISCSI_CDB_SIZE) {
348 		rc = iscsi_prep_ecdb_ahs(task);
349 		if (rc)
350 			return rc;
351 		cmd_len = ISCSI_CDB_SIZE;
352 	}
353 	memcpy(hdr->cdb, sc->cmnd, cmd_len);
354 
355 	task->imm_count = 0;
356 	if (scsi_get_prot_op(sc) != SCSI_PROT_NORMAL)
357 		task->protected = true;
358 
359 	transfer_length = scsi_transfer_length(sc);
360 	hdr->data_length = cpu_to_be32(transfer_length);
361 	if (sc->sc_data_direction == DMA_TO_DEVICE) {
362 		struct iscsi_r2t_info *r2t = &task->unsol_r2t;
363 
364 		hdr->flags |= ISCSI_FLAG_CMD_WRITE;
365 		/*
366 		 * Write counters:
367 		 *
368 		 *	imm_count	bytes to be sent right after
369 		 *			SCSI PDU Header
370 		 *
371 		 *	unsol_count	bytes(as Data-Out) to be sent
372 		 *			without	R2T ack right after
373 		 *			immediate data
374 		 *
375 		 *	r2t data_length bytes to be sent via R2T ack's
376 		 *
377 		 *      pad_count       bytes to be sent as zero-padding
378 		 */
379 		memset(r2t, 0, sizeof(*r2t));
380 
381 		if (session->imm_data_en) {
382 			if (transfer_length >= session->first_burst)
383 				task->imm_count = min(session->first_burst,
384 							conn->max_xmit_dlength);
385 			else
386 				task->imm_count = min(transfer_length,
387 						      conn->max_xmit_dlength);
388 			hton24(hdr->dlength, task->imm_count);
389 		} else
390 			zero_data(hdr->dlength);
391 
392 		if (!session->initial_r2t_en) {
393 			r2t->data_length = min(session->first_burst,
394 					       transfer_length) -
395 					       task->imm_count;
396 			r2t->data_offset = task->imm_count;
397 			r2t->ttt = cpu_to_be32(ISCSI_RESERVED_TAG);
398 			r2t->exp_statsn = cpu_to_be32(conn->exp_statsn);
399 		}
400 
401 		if (!task->unsol_r2t.data_length)
402 			/* No unsolicit Data-Out's */
403 			hdr->flags |= ISCSI_FLAG_CMD_FINAL;
404 	} else {
405 		hdr->flags |= ISCSI_FLAG_CMD_FINAL;
406 		zero_data(hdr->dlength);
407 
408 		if (sc->sc_data_direction == DMA_FROM_DEVICE)
409 			hdr->flags |= ISCSI_FLAG_CMD_READ;
410 	}
411 
412 	/* calculate size of additional header segments (AHSs) */
413 	hdrlength = task->hdr_len - sizeof(*hdr);
414 
415 	WARN_ON(hdrlength & (ISCSI_PAD_LEN-1));
416 	hdrlength /= ISCSI_PAD_LEN;
417 
418 	WARN_ON(hdrlength >= 256);
419 	hdr->hlength = hdrlength & 0xFF;
420 	hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
421 
422 	if (session->tt->init_task && session->tt->init_task(task))
423 		return -EIO;
424 
425 	task->state = ISCSI_TASK_RUNNING;
426 	session->cmdsn++;
427 
428 	conn->scsicmd_pdus_cnt++;
429 	ISCSI_DBG_SESSION(session, "iscsi prep [%s cid %d sc %p cdb 0x%x "
430 			  "itt 0x%x len %d cmdsn %d win %d]\n",
431 			  sc->sc_data_direction == DMA_TO_DEVICE ?
432 			  "write" : "read", conn->id, sc, sc->cmnd[0],
433 			  task->itt, transfer_length,
434 			  session->cmdsn,
435 			  session->max_cmdsn - session->exp_cmdsn + 1);
436 	return 0;
437 }
438 
439 /**
440  * iscsi_free_task - free a task
441  * @task: iscsi cmd task
442  *
443  * Must be called with session back_lock.
444  * This function returns the scsi command to scsi-ml or cleans
445  * up mgmt tasks then returns the task to the pool.
446  */
447 static void iscsi_free_task(struct iscsi_task *task)
448 {
449 	struct iscsi_conn *conn = task->conn;
450 	struct iscsi_session *session = conn->session;
451 	struct scsi_cmnd *sc = task->sc;
452 	int oldstate = task->state;
453 
454 	ISCSI_DBG_SESSION(session, "freeing task itt 0x%x state %d sc %p\n",
455 			  task->itt, task->state, task->sc);
456 
457 	session->tt->cleanup_task(task);
458 	task->state = ISCSI_TASK_FREE;
459 	task->sc = NULL;
460 	/*
461 	 * login task is preallocated so do not free
462 	 */
463 	if (conn->login_task == task)
464 		return;
465 
466 	kfifo_in(&session->cmdpool.queue, (void*)&task, sizeof(void*));
467 
468 	if (sc) {
469 		/* SCSI eh reuses commands to verify us */
470 		sc->SCp.ptr = NULL;
471 		/*
472 		 * queue command may call this to free the task, so
473 		 * it will decide how to return sc to scsi-ml.
474 		 */
475 		if (oldstate != ISCSI_TASK_REQUEUE_SCSIQ)
476 			sc->scsi_done(sc);
477 	}
478 }
479 
480 void __iscsi_get_task(struct iscsi_task *task)
481 {
482 	refcount_inc(&task->refcount);
483 }
484 EXPORT_SYMBOL_GPL(__iscsi_get_task);
485 
486 void __iscsi_put_task(struct iscsi_task *task)
487 {
488 	if (refcount_dec_and_test(&task->refcount))
489 		iscsi_free_task(task);
490 }
491 EXPORT_SYMBOL_GPL(__iscsi_put_task);
492 
493 void iscsi_put_task(struct iscsi_task *task)
494 {
495 	struct iscsi_session *session = task->conn->session;
496 
497 	/* regular RX path uses back_lock */
498 	spin_lock_bh(&session->back_lock);
499 	__iscsi_put_task(task);
500 	spin_unlock_bh(&session->back_lock);
501 }
502 EXPORT_SYMBOL_GPL(iscsi_put_task);
503 
504 /**
505  * iscsi_complete_task - finish a task
506  * @task: iscsi cmd task
507  * @state: state to complete task with
508  *
509  * Must be called with session back_lock.
510  */
511 static void iscsi_complete_task(struct iscsi_task *task, int state)
512 {
513 	struct iscsi_conn *conn = task->conn;
514 
515 	ISCSI_DBG_SESSION(conn->session,
516 			  "complete task itt 0x%x state %d sc %p\n",
517 			  task->itt, task->state, task->sc);
518 	if (task->state == ISCSI_TASK_COMPLETED ||
519 	    task->state == ISCSI_TASK_ABRT_TMF ||
520 	    task->state == ISCSI_TASK_ABRT_SESS_RECOV ||
521 	    task->state == ISCSI_TASK_REQUEUE_SCSIQ)
522 		return;
523 	WARN_ON_ONCE(task->state == ISCSI_TASK_FREE);
524 	task->state = state;
525 
526 	if (READ_ONCE(conn->ping_task) == task)
527 		WRITE_ONCE(conn->ping_task, NULL);
528 
529 	/* release get from queueing */
530 	__iscsi_put_task(task);
531 }
532 
533 /**
534  * iscsi_complete_scsi_task - finish scsi task normally
535  * @task: iscsi task for scsi cmd
536  * @exp_cmdsn: expected cmd sn in cpu format
537  * @max_cmdsn: max cmd sn in cpu format
538  *
539  * This is used when drivers do not need or cannot perform
540  * lower level pdu processing.
541  *
542  * Called with session back_lock
543  */
544 void iscsi_complete_scsi_task(struct iscsi_task *task,
545 			      uint32_t exp_cmdsn, uint32_t max_cmdsn)
546 {
547 	struct iscsi_conn *conn = task->conn;
548 
549 	ISCSI_DBG_SESSION(conn->session, "[itt 0x%x]\n", task->itt);
550 
551 	conn->last_recv = jiffies;
552 	__iscsi_update_cmdsn(conn->session, exp_cmdsn, max_cmdsn);
553 	iscsi_complete_task(task, ISCSI_TASK_COMPLETED);
554 }
555 EXPORT_SYMBOL_GPL(iscsi_complete_scsi_task);
556 
557 /*
558  * Must be called with back and frwd lock
559  */
560 static bool cleanup_queued_task(struct iscsi_task *task)
561 {
562 	struct iscsi_conn *conn = task->conn;
563 	bool early_complete = false;
564 
565 	/* Bad target might have completed task while it was still running */
566 	if (task->state == ISCSI_TASK_COMPLETED)
567 		early_complete = true;
568 
569 	if (!list_empty(&task->running)) {
570 		list_del_init(&task->running);
571 		/*
572 		 * If it's on a list but still running, this could be from
573 		 * a bad target sending a rsp early, cleanup from a TMF, or
574 		 * session recovery.
575 		 */
576 		if (task->state == ISCSI_TASK_RUNNING ||
577 		    task->state == ISCSI_TASK_COMPLETED)
578 			__iscsi_put_task(task);
579 	}
580 
581 	if (conn->task == task) {
582 		conn->task = NULL;
583 		__iscsi_put_task(task);
584 	}
585 
586 	return early_complete;
587 }
588 
589 /*
590  * session frwd lock must be held and if not called for a task that is still
591  * pending or from the xmit thread, then xmit thread must be suspended
592  */
593 static void fail_scsi_task(struct iscsi_task *task, int err)
594 {
595 	struct iscsi_conn *conn = task->conn;
596 	struct scsi_cmnd *sc;
597 	int state;
598 
599 	spin_lock_bh(&conn->session->back_lock);
600 	if (cleanup_queued_task(task)) {
601 		spin_unlock_bh(&conn->session->back_lock);
602 		return;
603 	}
604 
605 	if (task->state == ISCSI_TASK_PENDING) {
606 		/*
607 		 * cmd never made it to the xmit thread, so we should not count
608 		 * the cmd in the sequencing
609 		 */
610 		conn->session->queued_cmdsn--;
611 		/* it was never sent so just complete like normal */
612 		state = ISCSI_TASK_COMPLETED;
613 	} else if (err == DID_TRANSPORT_DISRUPTED)
614 		state = ISCSI_TASK_ABRT_SESS_RECOV;
615 	else
616 		state = ISCSI_TASK_ABRT_TMF;
617 
618 	sc = task->sc;
619 	sc->result = err << 16;
620 	scsi_set_resid(sc, scsi_bufflen(sc));
621 	iscsi_complete_task(task, state);
622 	spin_unlock_bh(&conn->session->back_lock);
623 }
624 
625 static int iscsi_prep_mgmt_task(struct iscsi_conn *conn,
626 				struct iscsi_task *task)
627 {
628 	struct iscsi_session *session = conn->session;
629 	struct iscsi_hdr *hdr = task->hdr;
630 	struct iscsi_nopout *nop = (struct iscsi_nopout *)hdr;
631 	uint8_t opcode = hdr->opcode & ISCSI_OPCODE_MASK;
632 
633 	if (conn->session->state == ISCSI_STATE_LOGGING_OUT)
634 		return -ENOTCONN;
635 
636 	if (opcode != ISCSI_OP_LOGIN && opcode != ISCSI_OP_TEXT)
637 		nop->exp_statsn = cpu_to_be32(conn->exp_statsn);
638 	/*
639 	 * pre-format CmdSN for outgoing PDU.
640 	 */
641 	nop->cmdsn = cpu_to_be32(session->cmdsn);
642 	if (hdr->itt != RESERVED_ITT) {
643 		/*
644 		 * TODO: We always use immediate for normal session pdus.
645 		 * If we start to send tmfs or nops as non-immediate then
646 		 * we should start checking the cmdsn numbers for mgmt tasks.
647 		 *
648 		 * During discovery sessions iscsid sends TEXT as non immediate,
649 		 * but we always only send one PDU at a time.
650 		 */
651 		if (conn->c_stage == ISCSI_CONN_STARTED &&
652 		    !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
653 			session->queued_cmdsn++;
654 			session->cmdsn++;
655 		}
656 	}
657 
658 	if (session->tt->init_task && session->tt->init_task(task))
659 		return -EIO;
660 
661 	if ((hdr->opcode & ISCSI_OPCODE_MASK) == ISCSI_OP_LOGOUT)
662 		session->state = ISCSI_STATE_LOGGING_OUT;
663 
664 	task->state = ISCSI_TASK_RUNNING;
665 	ISCSI_DBG_SESSION(session, "mgmtpdu [op 0x%x hdr->itt 0x%x "
666 			  "datalen %d]\n", hdr->opcode & ISCSI_OPCODE_MASK,
667 			  hdr->itt, task->data_count);
668 	return 0;
669 }
670 
671 static struct iscsi_task *
672 __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
673 		      char *data, uint32_t data_size)
674 {
675 	struct iscsi_session *session = conn->session;
676 	struct iscsi_host *ihost = shost_priv(session->host);
677 	uint8_t opcode = hdr->opcode & ISCSI_OPCODE_MASK;
678 	struct iscsi_task *task;
679 	itt_t itt;
680 
681 	if (session->state == ISCSI_STATE_TERMINATE)
682 		return NULL;
683 
684 	if (opcode == ISCSI_OP_LOGIN || opcode == ISCSI_OP_TEXT) {
685 		/*
686 		 * Login and Text are sent serially, in
687 		 * request-followed-by-response sequence.
688 		 * Same task can be used. Same ITT must be used.
689 		 * Note that login_task is preallocated at conn_create().
690 		 */
691 		if (conn->login_task->state != ISCSI_TASK_FREE) {
692 			iscsi_conn_printk(KERN_ERR, conn, "Login/Text in "
693 					  "progress. Cannot start new task.\n");
694 			return NULL;
695 		}
696 
697 		if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) {
698 			iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN);
699 			return NULL;
700 		}
701 
702 		task = conn->login_task;
703 	} else {
704 		if (session->state != ISCSI_STATE_LOGGED_IN)
705 			return NULL;
706 
707 		if (data_size != 0) {
708 			iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode);
709 			return NULL;
710 		}
711 
712 		BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
713 		BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
714 
715 		if (!kfifo_out(&session->cmdpool.queue,
716 				 (void*)&task, sizeof(void*)))
717 			return NULL;
718 	}
719 	/*
720 	 * released in complete pdu for task we expect a response for, and
721 	 * released by the lld when it has transmitted the task for
722 	 * pdus we do not expect a response for.
723 	 */
724 	refcount_set(&task->refcount, 1);
725 	task->conn = conn;
726 	task->sc = NULL;
727 	INIT_LIST_HEAD(&task->running);
728 	task->state = ISCSI_TASK_PENDING;
729 
730 	if (data_size) {
731 		memcpy(task->data, data, data_size);
732 		task->data_count = data_size;
733 	} else
734 		task->data_count = 0;
735 
736 	if (conn->session->tt->alloc_pdu) {
737 		if (conn->session->tt->alloc_pdu(task, hdr->opcode)) {
738 			iscsi_conn_printk(KERN_ERR, conn, "Could not allocate "
739 					 "pdu for mgmt task.\n");
740 			goto free_task;
741 		}
742 	}
743 
744 	itt = task->hdr->itt;
745 	task->hdr_len = sizeof(struct iscsi_hdr);
746 	memcpy(task->hdr, hdr, sizeof(struct iscsi_hdr));
747 
748 	if (hdr->itt != RESERVED_ITT) {
749 		if (session->tt->parse_pdu_itt)
750 			task->hdr->itt = itt;
751 		else
752 			task->hdr->itt = build_itt(task->itt,
753 						   task->conn->session->age);
754 	}
755 
756 	if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK))
757 		WRITE_ONCE(conn->ping_task, task);
758 
759 	if (!ihost->workq) {
760 		if (iscsi_prep_mgmt_task(conn, task))
761 			goto free_task;
762 
763 		if (session->tt->xmit_task(task))
764 			goto free_task;
765 	} else {
766 		list_add_tail(&task->running, &conn->mgmtqueue);
767 		iscsi_conn_queue_work(conn);
768 	}
769 
770 	return task;
771 
772 free_task:
773 	/* regular RX path uses back_lock */
774 	spin_lock(&session->back_lock);
775 	__iscsi_put_task(task);
776 	spin_unlock(&session->back_lock);
777 	return NULL;
778 }
779 
780 int iscsi_conn_send_pdu(struct iscsi_cls_conn *cls_conn, struct iscsi_hdr *hdr,
781 			char *data, uint32_t data_size)
782 {
783 	struct iscsi_conn *conn = cls_conn->dd_data;
784 	struct iscsi_session *session = conn->session;
785 	int err = 0;
786 
787 	spin_lock_bh(&session->frwd_lock);
788 	if (!__iscsi_conn_send_pdu(conn, hdr, data, data_size))
789 		err = -EPERM;
790 	spin_unlock_bh(&session->frwd_lock);
791 	return err;
792 }
793 EXPORT_SYMBOL_GPL(iscsi_conn_send_pdu);
794 
795 /**
796  * iscsi_scsi_cmd_rsp - SCSI Command Response processing
797  * @conn: iscsi connection
798  * @hdr: iscsi header
799  * @task: scsi command task
800  * @data: cmd data buffer
801  * @datalen: len of buffer
802  *
803  * iscsi_cmd_rsp sets up the scsi_cmnd fields based on the PDU and
804  * then completes the command and task. called under back_lock
805  **/
806 static void iscsi_scsi_cmd_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
807 			       struct iscsi_task *task, char *data,
808 			       int datalen)
809 {
810 	struct iscsi_scsi_rsp *rhdr = (struct iscsi_scsi_rsp *)hdr;
811 	struct iscsi_session *session = conn->session;
812 	struct scsi_cmnd *sc = task->sc;
813 
814 	iscsi_update_cmdsn(session, (struct iscsi_nopin*)rhdr);
815 	conn->exp_statsn = be32_to_cpu(rhdr->statsn) + 1;
816 
817 	sc->result = (DID_OK << 16) | rhdr->cmd_status;
818 
819 	if (task->protected) {
820 		sector_t sector;
821 		u8 ascq;
822 
823 		/**
824 		 * Transports that didn't implement check_protection
825 		 * callback but still published T10-PI support to scsi-mid
826 		 * deserve this BUG_ON.
827 		 **/
828 		BUG_ON(!session->tt->check_protection);
829 
830 		ascq = session->tt->check_protection(task, &sector);
831 		if (ascq) {
832 			sc->result = DRIVER_SENSE << 24 |
833 				     SAM_STAT_CHECK_CONDITION;
834 			scsi_build_sense_buffer(1, sc->sense_buffer,
835 						ILLEGAL_REQUEST, 0x10, ascq);
836 			scsi_set_sense_information(sc->sense_buffer,
837 						   SCSI_SENSE_BUFFERSIZE,
838 						   sector);
839 			goto out;
840 		}
841 	}
842 
843 	if (rhdr->response != ISCSI_STATUS_CMD_COMPLETED) {
844 		sc->result = DID_ERROR << 16;
845 		goto out;
846 	}
847 
848 	if (rhdr->cmd_status == SAM_STAT_CHECK_CONDITION) {
849 		uint16_t senselen;
850 
851 		if (datalen < 2) {
852 invalid_datalen:
853 			iscsi_conn_printk(KERN_ERR,  conn,
854 					 "Got CHECK_CONDITION but invalid data "
855 					 "buffer size of %d\n", datalen);
856 			sc->result = DID_BAD_TARGET << 16;
857 			goto out;
858 		}
859 
860 		senselen = get_unaligned_be16(data);
861 		if (datalen < senselen)
862 			goto invalid_datalen;
863 
864 		memcpy(sc->sense_buffer, data + 2,
865 		       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));
866 		ISCSI_DBG_SESSION(session, "copied %d bytes of sense\n",
867 				  min_t(uint16_t, senselen,
868 				  SCSI_SENSE_BUFFERSIZE));
869 	}
870 
871 	if (rhdr->flags & (ISCSI_FLAG_CMD_BIDI_UNDERFLOW |
872 			   ISCSI_FLAG_CMD_BIDI_OVERFLOW)) {
873 		sc->result = (DID_BAD_TARGET << 16) | rhdr->cmd_status;
874 	}
875 
876 	if (rhdr->flags & (ISCSI_FLAG_CMD_UNDERFLOW |
877 	                   ISCSI_FLAG_CMD_OVERFLOW)) {
878 		int res_count = be32_to_cpu(rhdr->residual_count);
879 
880 		if (res_count > 0 &&
881 		    (rhdr->flags & ISCSI_FLAG_CMD_OVERFLOW ||
882 		     res_count <= scsi_bufflen(sc)))
883 			/* write side for bidi or uni-io set_resid */
884 			scsi_set_resid(sc, res_count);
885 		else
886 			sc->result = (DID_BAD_TARGET << 16) | rhdr->cmd_status;
887 	}
888 out:
889 	ISCSI_DBG_SESSION(session, "cmd rsp done [sc %p res %d itt 0x%x]\n",
890 			  sc, sc->result, task->itt);
891 	conn->scsirsp_pdus_cnt++;
892 	iscsi_complete_task(task, ISCSI_TASK_COMPLETED);
893 }
894 
895 /**
896  * iscsi_data_in_rsp - SCSI Data-In Response processing
897  * @conn: iscsi connection
898  * @hdr:  iscsi pdu
899  * @task: scsi command task
900  *
901  * iscsi_data_in_rsp sets up the scsi_cmnd fields based on the data received
902  * then completes the command and task. called under back_lock
903  **/
904 static void
905 iscsi_data_in_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
906 		  struct iscsi_task *task)
907 {
908 	struct iscsi_data_rsp *rhdr = (struct iscsi_data_rsp *)hdr;
909 	struct scsi_cmnd *sc = task->sc;
910 
911 	if (!(rhdr->flags & ISCSI_FLAG_DATA_STATUS))
912 		return;
913 
914 	iscsi_update_cmdsn(conn->session, (struct iscsi_nopin *)hdr);
915 	sc->result = (DID_OK << 16) | rhdr->cmd_status;
916 	conn->exp_statsn = be32_to_cpu(rhdr->statsn) + 1;
917 	if (rhdr->flags & (ISCSI_FLAG_DATA_UNDERFLOW |
918 	                   ISCSI_FLAG_DATA_OVERFLOW)) {
919 		int res_count = be32_to_cpu(rhdr->residual_count);
920 
921 		if (res_count > 0 &&
922 		    (rhdr->flags & ISCSI_FLAG_CMD_OVERFLOW ||
923 		     res_count <= sc->sdb.length))
924 			scsi_set_resid(sc, res_count);
925 		else
926 			sc->result = (DID_BAD_TARGET << 16) | rhdr->cmd_status;
927 	}
928 
929 	ISCSI_DBG_SESSION(conn->session, "data in with status done "
930 			  "[sc %p res %d itt 0x%x]\n",
931 			  sc, sc->result, task->itt);
932 	conn->scsirsp_pdus_cnt++;
933 	iscsi_complete_task(task, ISCSI_TASK_COMPLETED);
934 }
935 
936 static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
937 {
938 	struct iscsi_tm_rsp *tmf = (struct iscsi_tm_rsp *)hdr;
939 
940 	conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
941 	conn->tmfrsp_pdus_cnt++;
942 
943 	if (conn->tmf_state != TMF_QUEUED)
944 		return;
945 
946 	if (tmf->response == ISCSI_TMF_RSP_COMPLETE)
947 		conn->tmf_state = TMF_SUCCESS;
948 	else if (tmf->response == ISCSI_TMF_RSP_NO_TASK)
949 		conn->tmf_state = TMF_NOT_FOUND;
950 	else
951 		conn->tmf_state = TMF_FAILED;
952 	wake_up(&conn->ehwait);
953 }
954 
955 static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
956 {
957         struct iscsi_nopout hdr;
958 	struct iscsi_task *task;
959 
960 	if (!rhdr) {
961 		if (READ_ONCE(conn->ping_task))
962 			return -EINVAL;
963 		WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK);
964 	}
965 
966 	memset(&hdr, 0, sizeof(struct iscsi_nopout));
967 	hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE;
968 	hdr.flags = ISCSI_FLAG_CMD_FINAL;
969 
970 	if (rhdr) {
971 		hdr.lun = rhdr->lun;
972 		hdr.ttt = rhdr->ttt;
973 		hdr.itt = RESERVED_ITT;
974 	} else
975 		hdr.ttt = RESERVED_ITT;
976 
977 	task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0);
978 	if (!task) {
979 		if (!rhdr)
980 			WRITE_ONCE(conn->ping_task, NULL);
981 		iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n");
982 		return -EIO;
983 	} else if (!rhdr) {
984 		/* only track our nops */
985 		conn->last_ping = jiffies;
986 	}
987 
988 	return 0;
989 }
990 
991 /**
992  * iscsi_nop_out_rsp - SCSI NOP Response processing
993  * @task: scsi command task
994  * @nop: the nop structure
995  * @data: where to put the data
996  * @datalen: length of data
997  *
998  * iscsi_nop_out_rsp handles nop response from use or
999  * from user space. called under back_lock
1000  **/
1001 static int iscsi_nop_out_rsp(struct iscsi_task *task,
1002 			     struct iscsi_nopin *nop, char *data, int datalen)
1003 {
1004 	struct iscsi_conn *conn = task->conn;
1005 	int rc = 0;
1006 
1007 	if (READ_ONCE(conn->ping_task) != task) {
1008 		/*
1009 		 * If this is not in response to one of our
1010 		 * nops then it must be from userspace.
1011 		 */
1012 		if (iscsi_recv_pdu(conn->cls_conn, (struct iscsi_hdr *)nop,
1013 				   data, datalen))
1014 			rc = ISCSI_ERR_CONN_FAILED;
1015 	} else
1016 		mod_timer(&conn->transport_timer, jiffies + conn->recv_timeout);
1017 	iscsi_complete_task(task, ISCSI_TASK_COMPLETED);
1018 	return rc;
1019 }
1020 
1021 static int iscsi_handle_reject(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
1022 			       char *data, int datalen)
1023 {
1024 	struct iscsi_reject *reject = (struct iscsi_reject *)hdr;
1025 	struct iscsi_hdr rejected_pdu;
1026 	int opcode, rc = 0;
1027 
1028 	conn->exp_statsn = be32_to_cpu(reject->statsn) + 1;
1029 
1030 	if (ntoh24(reject->dlength) > datalen ||
1031 	    ntoh24(reject->dlength) < sizeof(struct iscsi_hdr)) {
1032 		iscsi_conn_printk(KERN_ERR, conn, "Cannot handle rejected "
1033 				  "pdu. Invalid data length (pdu dlength "
1034 				  "%u, datalen %d\n", ntoh24(reject->dlength),
1035 				  datalen);
1036 		return ISCSI_ERR_PROTO;
1037 	}
1038 	memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr));
1039 	opcode = rejected_pdu.opcode & ISCSI_OPCODE_MASK;
1040 
1041 	switch (reject->reason) {
1042 	case ISCSI_REASON_DATA_DIGEST_ERROR:
1043 		iscsi_conn_printk(KERN_ERR, conn,
1044 				  "pdu (op 0x%x itt 0x%x) rejected "
1045 				  "due to DataDigest error.\n",
1046 				  opcode, rejected_pdu.itt);
1047 		break;
1048 	case ISCSI_REASON_IMM_CMD_REJECT:
1049 		iscsi_conn_printk(KERN_ERR, conn,
1050 				  "pdu (op 0x%x itt 0x%x) rejected. Too many "
1051 				  "immediate commands.\n",
1052 				  opcode, rejected_pdu.itt);
1053 		/*
1054 		 * We only send one TMF at a time so if the target could not
1055 		 * handle it, then it should get fixed (RFC mandates that
1056 		 * a target can handle one immediate TMF per conn).
1057 		 *
1058 		 * For nops-outs, we could have sent more than one if
1059 		 * the target is sending us lots of nop-ins
1060 		 */
1061 		if (opcode != ISCSI_OP_NOOP_OUT)
1062 			return 0;
1063 
1064 		if (rejected_pdu.itt == cpu_to_be32(ISCSI_RESERVED_TAG)) {
1065 			/*
1066 			 * nop-out in response to target's nop-out rejected.
1067 			 * Just resend.
1068 			 */
1069 			/* In RX path we are under back lock */
1070 			spin_unlock(&conn->session->back_lock);
1071 			spin_lock(&conn->session->frwd_lock);
1072 			iscsi_send_nopout(conn,
1073 					  (struct iscsi_nopin*)&rejected_pdu);
1074 			spin_unlock(&conn->session->frwd_lock);
1075 			spin_lock(&conn->session->back_lock);
1076 		} else {
1077 			struct iscsi_task *task;
1078 			/*
1079 			 * Our nop as ping got dropped. We know the target
1080 			 * and transport are ok so just clean up
1081 			 */
1082 			task = iscsi_itt_to_task(conn, rejected_pdu.itt);
1083 			if (!task) {
1084 				iscsi_conn_printk(KERN_ERR, conn,
1085 						 "Invalid pdu reject. Could "
1086 						 "not lookup rejected task.\n");
1087 				rc = ISCSI_ERR_BAD_ITT;
1088 			} else
1089 				rc = iscsi_nop_out_rsp(task,
1090 					(struct iscsi_nopin*)&rejected_pdu,
1091 					NULL, 0);
1092 		}
1093 		break;
1094 	default:
1095 		iscsi_conn_printk(KERN_ERR, conn,
1096 				  "pdu (op 0x%x itt 0x%x) rejected. Reason "
1097 				  "code 0x%x\n", rejected_pdu.opcode,
1098 				  rejected_pdu.itt, reject->reason);
1099 		break;
1100 	}
1101 	return rc;
1102 }
1103 
1104 /**
1105  * iscsi_itt_to_task - look up task by itt
1106  * @conn: iscsi connection
1107  * @itt: itt
1108  *
1109  * This should be used for mgmt tasks like login and nops, or if
1110  * the LDD's itt space does not include the session age.
1111  *
1112  * The session back_lock must be held.
1113  */
1114 struct iscsi_task *iscsi_itt_to_task(struct iscsi_conn *conn, itt_t itt)
1115 {
1116 	struct iscsi_session *session = conn->session;
1117 	int i;
1118 
1119 	if (itt == RESERVED_ITT)
1120 		return NULL;
1121 
1122 	if (session->tt->parse_pdu_itt)
1123 		session->tt->parse_pdu_itt(conn, itt, &i, NULL);
1124 	else
1125 		i = get_itt(itt);
1126 	if (i >= session->cmds_max)
1127 		return NULL;
1128 
1129 	return session->cmds[i];
1130 }
1131 EXPORT_SYMBOL_GPL(iscsi_itt_to_task);
1132 
1133 /**
1134  * __iscsi_complete_pdu - complete pdu
1135  * @conn: iscsi conn
1136  * @hdr: iscsi header
1137  * @data: data buffer
1138  * @datalen: len of data buffer
1139  *
1140  * Completes pdu processing by freeing any resources allocated at
1141  * queuecommand or send generic. session back_lock must be held and verify
1142  * itt must have been called.
1143  */
1144 int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
1145 			 char *data, int datalen)
1146 {
1147 	struct iscsi_session *session = conn->session;
1148 	int opcode = hdr->opcode & ISCSI_OPCODE_MASK, rc = 0;
1149 	struct iscsi_task *task;
1150 	uint32_t itt;
1151 
1152 	conn->last_recv = jiffies;
1153 	rc = iscsi_verify_itt(conn, hdr->itt);
1154 	if (rc)
1155 		return rc;
1156 
1157 	if (hdr->itt != RESERVED_ITT)
1158 		itt = get_itt(hdr->itt);
1159 	else
1160 		itt = ~0U;
1161 
1162 	ISCSI_DBG_SESSION(session, "[op 0x%x cid %d itt 0x%x len %d]\n",
1163 			  opcode, conn->id, itt, datalen);
1164 
1165 	if (itt == ~0U) {
1166 		iscsi_update_cmdsn(session, (struct iscsi_nopin*)hdr);
1167 
1168 		switch(opcode) {
1169 		case ISCSI_OP_NOOP_IN:
1170 			if (datalen) {
1171 				rc = ISCSI_ERR_PROTO;
1172 				break;
1173 			}
1174 
1175 			if (hdr->ttt == cpu_to_be32(ISCSI_RESERVED_TAG))
1176 				break;
1177 
1178 			/* In RX path we are under back lock */
1179 			spin_unlock(&session->back_lock);
1180 			spin_lock(&session->frwd_lock);
1181 			iscsi_send_nopout(conn, (struct iscsi_nopin*)hdr);
1182 			spin_unlock(&session->frwd_lock);
1183 			spin_lock(&session->back_lock);
1184 			break;
1185 		case ISCSI_OP_REJECT:
1186 			rc = iscsi_handle_reject(conn, hdr, data, datalen);
1187 			break;
1188 		case ISCSI_OP_ASYNC_EVENT:
1189 			conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
1190 			if (iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen))
1191 				rc = ISCSI_ERR_CONN_FAILED;
1192 			break;
1193 		default:
1194 			rc = ISCSI_ERR_BAD_OPCODE;
1195 			break;
1196 		}
1197 		goto out;
1198 	}
1199 
1200 	switch(opcode) {
1201 	case ISCSI_OP_SCSI_CMD_RSP:
1202 	case ISCSI_OP_SCSI_DATA_IN:
1203 		task = iscsi_itt_to_ctask(conn, hdr->itt);
1204 		if (!task)
1205 			return ISCSI_ERR_BAD_ITT;
1206 		task->last_xfer = jiffies;
1207 		break;
1208 	case ISCSI_OP_R2T:
1209 		/*
1210 		 * LLD handles R2Ts if they need to.
1211 		 */
1212 		return 0;
1213 	case ISCSI_OP_LOGOUT_RSP:
1214 	case ISCSI_OP_LOGIN_RSP:
1215 	case ISCSI_OP_TEXT_RSP:
1216 	case ISCSI_OP_SCSI_TMFUNC_RSP:
1217 	case ISCSI_OP_NOOP_IN:
1218 		task = iscsi_itt_to_task(conn, hdr->itt);
1219 		if (!task)
1220 			return ISCSI_ERR_BAD_ITT;
1221 		break;
1222 	default:
1223 		return ISCSI_ERR_BAD_OPCODE;
1224 	}
1225 
1226 	switch(opcode) {
1227 	case ISCSI_OP_SCSI_CMD_RSP:
1228 		iscsi_scsi_cmd_rsp(conn, hdr, task, data, datalen);
1229 		break;
1230 	case ISCSI_OP_SCSI_DATA_IN:
1231 		iscsi_data_in_rsp(conn, hdr, task);
1232 		break;
1233 	case ISCSI_OP_LOGOUT_RSP:
1234 		iscsi_update_cmdsn(session, (struct iscsi_nopin*)hdr);
1235 		if (datalen) {
1236 			rc = ISCSI_ERR_PROTO;
1237 			break;
1238 		}
1239 		conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
1240 		goto recv_pdu;
1241 	case ISCSI_OP_LOGIN_RSP:
1242 	case ISCSI_OP_TEXT_RSP:
1243 		iscsi_update_cmdsn(session, (struct iscsi_nopin*)hdr);
1244 		/*
1245 		 * login related PDU's exp_statsn is handled in
1246 		 * userspace
1247 		 */
1248 		goto recv_pdu;
1249 	case ISCSI_OP_SCSI_TMFUNC_RSP:
1250 		iscsi_update_cmdsn(session, (struct iscsi_nopin*)hdr);
1251 		if (datalen) {
1252 			rc = ISCSI_ERR_PROTO;
1253 			break;
1254 		}
1255 
1256 		iscsi_tmf_rsp(conn, hdr);
1257 		iscsi_complete_task(task, ISCSI_TASK_COMPLETED);
1258 		break;
1259 	case ISCSI_OP_NOOP_IN:
1260 		iscsi_update_cmdsn(session, (struct iscsi_nopin*)hdr);
1261 		if (hdr->ttt != cpu_to_be32(ISCSI_RESERVED_TAG) || datalen) {
1262 			rc = ISCSI_ERR_PROTO;
1263 			break;
1264 		}
1265 		conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
1266 
1267 		rc = iscsi_nop_out_rsp(task, (struct iscsi_nopin*)hdr,
1268 				       data, datalen);
1269 		break;
1270 	default:
1271 		rc = ISCSI_ERR_BAD_OPCODE;
1272 		break;
1273 	}
1274 
1275 out:
1276 	return rc;
1277 recv_pdu:
1278 	if (iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen))
1279 		rc = ISCSI_ERR_CONN_FAILED;
1280 	iscsi_complete_task(task, ISCSI_TASK_COMPLETED);
1281 	return rc;
1282 }
1283 EXPORT_SYMBOL_GPL(__iscsi_complete_pdu);
1284 
1285 int iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
1286 		       char *data, int datalen)
1287 {
1288 	int rc;
1289 
1290 	spin_lock(&conn->session->back_lock);
1291 	rc = __iscsi_complete_pdu(conn, hdr, data, datalen);
1292 	spin_unlock(&conn->session->back_lock);
1293 	return rc;
1294 }
1295 EXPORT_SYMBOL_GPL(iscsi_complete_pdu);
1296 
1297 int iscsi_verify_itt(struct iscsi_conn *conn, itt_t itt)
1298 {
1299 	struct iscsi_session *session = conn->session;
1300 	int age = 0, i = 0;
1301 
1302 	if (itt == RESERVED_ITT)
1303 		return 0;
1304 
1305 	if (session->tt->parse_pdu_itt)
1306 		session->tt->parse_pdu_itt(conn, itt, &i, &age);
1307 	else {
1308 		i = get_itt(itt);
1309 		age = ((__force u32)itt >> ISCSI_AGE_SHIFT) & ISCSI_AGE_MASK;
1310 	}
1311 
1312 	if (age != session->age) {
1313 		iscsi_conn_printk(KERN_ERR, conn,
1314 				  "received itt %x expected session age (%x)\n",
1315 				  (__force u32)itt, session->age);
1316 		return ISCSI_ERR_BAD_ITT;
1317 	}
1318 
1319 	if (i >= session->cmds_max) {
1320 		iscsi_conn_printk(KERN_ERR, conn,
1321 				  "received invalid itt index %u (max cmds "
1322 				   "%u.\n", i, session->cmds_max);
1323 		return ISCSI_ERR_BAD_ITT;
1324 	}
1325 	return 0;
1326 }
1327 EXPORT_SYMBOL_GPL(iscsi_verify_itt);
1328 
1329 /**
1330  * iscsi_itt_to_ctask - look up ctask by itt
1331  * @conn: iscsi connection
1332  * @itt: itt
1333  *
1334  * This should be used for cmd tasks.
1335  *
1336  * The session back_lock must be held.
1337  */
1338 struct iscsi_task *iscsi_itt_to_ctask(struct iscsi_conn *conn, itt_t itt)
1339 {
1340 	struct iscsi_task *task;
1341 
1342 	if (iscsi_verify_itt(conn, itt))
1343 		return NULL;
1344 
1345 	task = iscsi_itt_to_task(conn, itt);
1346 	if (!task || !task->sc)
1347 		return NULL;
1348 
1349 	if (task->sc->SCp.phase != conn->session->age) {
1350 		iscsi_session_printk(KERN_ERR, conn->session,
1351 				  "task's session age %d, expected %d\n",
1352 				  task->sc->SCp.phase, conn->session->age);
1353 		return NULL;
1354 	}
1355 
1356 	return task;
1357 }
1358 EXPORT_SYMBOL_GPL(iscsi_itt_to_ctask);
1359 
1360 void iscsi_session_failure(struct iscsi_session *session,
1361 			   enum iscsi_err err)
1362 {
1363 	struct iscsi_conn *conn;
1364 	struct device *dev;
1365 
1366 	spin_lock_bh(&session->frwd_lock);
1367 	conn = session->leadconn;
1368 	if (session->state == ISCSI_STATE_TERMINATE || !conn) {
1369 		spin_unlock_bh(&session->frwd_lock);
1370 		return;
1371 	}
1372 
1373 	dev = get_device(&conn->cls_conn->dev);
1374 	spin_unlock_bh(&session->frwd_lock);
1375 	if (!dev)
1376 	        return;
1377 	/*
1378 	 * if the host is being removed bypass the connection
1379 	 * recovery initialization because we are going to kill
1380 	 * the session.
1381 	 */
1382 	if (err == ISCSI_ERR_INVALID_HOST)
1383 		iscsi_conn_error_event(conn->cls_conn, err);
1384 	else
1385 		iscsi_conn_failure(conn, err);
1386 	put_device(dev);
1387 }
1388 EXPORT_SYMBOL_GPL(iscsi_session_failure);
1389 
1390 void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err)
1391 {
1392 	struct iscsi_session *session = conn->session;
1393 
1394 	spin_lock_bh(&session->frwd_lock);
1395 	if (session->state == ISCSI_STATE_FAILED) {
1396 		spin_unlock_bh(&session->frwd_lock);
1397 		return;
1398 	}
1399 
1400 	if (conn->stop_stage == 0)
1401 		session->state = ISCSI_STATE_FAILED;
1402 	spin_unlock_bh(&session->frwd_lock);
1403 
1404 	set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
1405 	set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
1406 	iscsi_conn_error_event(conn->cls_conn, err);
1407 }
1408 EXPORT_SYMBOL_GPL(iscsi_conn_failure);
1409 
1410 static int iscsi_check_cmdsn_window_closed(struct iscsi_conn *conn)
1411 {
1412 	struct iscsi_session *session = conn->session;
1413 
1414 	/*
1415 	 * Check for iSCSI window and take care of CmdSN wrap-around
1416 	 */
1417 	if (!iscsi_sna_lte(session->queued_cmdsn, session->max_cmdsn)) {
1418 		ISCSI_DBG_SESSION(session, "iSCSI CmdSN closed. ExpCmdSn "
1419 				  "%u MaxCmdSN %u CmdSN %u/%u\n",
1420 				  session->exp_cmdsn, session->max_cmdsn,
1421 				  session->cmdsn, session->queued_cmdsn);
1422 		return -ENOSPC;
1423 	}
1424 	return 0;
1425 }
1426 
1427 static int iscsi_xmit_task(struct iscsi_conn *conn, struct iscsi_task *task,
1428 			   bool was_requeue)
1429 {
1430 	int rc;
1431 
1432 	spin_lock_bh(&conn->session->back_lock);
1433 
1434 	if (!conn->task) {
1435 		/* Take a ref so we can access it after xmit_task() */
1436 		__iscsi_get_task(task);
1437 	} else {
1438 		/* Already have a ref from when we failed to send it last call */
1439 		conn->task = NULL;
1440 	}
1441 
1442 	/*
1443 	 * If this was a requeue for a R2T we have an extra ref on the task in
1444 	 * case a bad target sends a cmd rsp before we have handled the task.
1445 	 */
1446 	if (was_requeue)
1447 		__iscsi_put_task(task);
1448 
1449 	/*
1450 	 * Do this after dropping the extra ref because if this was a requeue
1451 	 * it's removed from that list and cleanup_queued_task would miss it.
1452 	 */
1453 	if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx)) {
1454 		/*
1455 		 * Save the task and ref in case we weren't cleaning up this
1456 		 * task and get woken up again.
1457 		 */
1458 		conn->task = task;
1459 		spin_unlock_bh(&conn->session->back_lock);
1460 		return -ENODATA;
1461 	}
1462 	spin_unlock_bh(&conn->session->back_lock);
1463 
1464 	spin_unlock_bh(&conn->session->frwd_lock);
1465 	rc = conn->session->tt->xmit_task(task);
1466 	spin_lock_bh(&conn->session->frwd_lock);
1467 	if (!rc) {
1468 		/* done with this task */
1469 		task->last_xfer = jiffies;
1470 	}
1471 	/* regular RX path uses back_lock */
1472 	spin_lock(&conn->session->back_lock);
1473 	if (rc && task->state == ISCSI_TASK_RUNNING) {
1474 		/*
1475 		 * get an extra ref that is released next time we access it
1476 		 * as conn->task above.
1477 		 */
1478 		__iscsi_get_task(task);
1479 		conn->task = task;
1480 	}
1481 
1482 	__iscsi_put_task(task);
1483 	spin_unlock(&conn->session->back_lock);
1484 	return rc;
1485 }
1486 
1487 /**
1488  * iscsi_requeue_task - requeue task to run from session workqueue
1489  * @task: task to requeue
1490  *
1491  * Callers must have taken a ref to the task that is going to be requeued.
1492  */
1493 void iscsi_requeue_task(struct iscsi_task *task)
1494 {
1495 	struct iscsi_conn *conn = task->conn;
1496 
1497 	/*
1498 	 * this may be on the requeue list already if the xmit_task callout
1499 	 * is handling the r2ts while we are adding new ones
1500 	 */
1501 	spin_lock_bh(&conn->session->frwd_lock);
1502 	if (list_empty(&task->running)) {
1503 		list_add_tail(&task->running, &conn->requeue);
1504 	} else {
1505 		/*
1506 		 * Don't need the extra ref since it's already requeued and
1507 		 * has a ref.
1508 		 */
1509 		iscsi_put_task(task);
1510 	}
1511 	iscsi_conn_queue_work(conn);
1512 	spin_unlock_bh(&conn->session->frwd_lock);
1513 }
1514 EXPORT_SYMBOL_GPL(iscsi_requeue_task);
1515 
1516 /**
1517  * iscsi_data_xmit - xmit any command into the scheduled connection
1518  * @conn: iscsi connection
1519  *
1520  * Notes:
1521  *	The function can return -EAGAIN in which case the caller must
1522  *	re-schedule it again later or recover. '0' return code means
1523  *	successful xmit.
1524  **/
1525 static int iscsi_data_xmit(struct iscsi_conn *conn)
1526 {
1527 	struct iscsi_task *task;
1528 	int rc = 0;
1529 
1530 	spin_lock_bh(&conn->session->frwd_lock);
1531 	if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx)) {
1532 		ISCSI_DBG_SESSION(conn->session, "Tx suspended!\n");
1533 		spin_unlock_bh(&conn->session->frwd_lock);
1534 		return -ENODATA;
1535 	}
1536 
1537 	if (conn->task) {
1538 		rc = iscsi_xmit_task(conn, conn->task, false);
1539 	        if (rc)
1540 		        goto done;
1541 	}
1542 
1543 	/*
1544 	 * process mgmt pdus like nops before commands since we should
1545 	 * only have one nop-out as a ping from us and targets should not
1546 	 * overflow us with nop-ins
1547 	 */
1548 check_mgmt:
1549 	while (!list_empty(&conn->mgmtqueue)) {
1550 		task = list_entry(conn->mgmtqueue.next, struct iscsi_task,
1551 				  running);
1552 		list_del_init(&task->running);
1553 		if (iscsi_prep_mgmt_task(conn, task)) {
1554 			/* regular RX path uses back_lock */
1555 			spin_lock_bh(&conn->session->back_lock);
1556 			__iscsi_put_task(task);
1557 			spin_unlock_bh(&conn->session->back_lock);
1558 			continue;
1559 		}
1560 		rc = iscsi_xmit_task(conn, task, false);
1561 		if (rc)
1562 			goto done;
1563 	}
1564 
1565 	/* process pending command queue */
1566 	while (!list_empty(&conn->cmdqueue)) {
1567 		task = list_entry(conn->cmdqueue.next, struct iscsi_task,
1568 				  running);
1569 		list_del_init(&task->running);
1570 		if (conn->session->state == ISCSI_STATE_LOGGING_OUT) {
1571 			fail_scsi_task(task, DID_IMM_RETRY);
1572 			continue;
1573 		}
1574 		rc = iscsi_prep_scsi_cmd_pdu(task);
1575 		if (rc) {
1576 			if (rc == -ENOMEM || rc == -EACCES)
1577 				fail_scsi_task(task, DID_IMM_RETRY);
1578 			else
1579 				fail_scsi_task(task, DID_ABORT);
1580 			continue;
1581 		}
1582 		rc = iscsi_xmit_task(conn, task, false);
1583 		if (rc)
1584 			goto done;
1585 		/*
1586 		 * we could continuously get new task requests so
1587 		 * we need to check the mgmt queue for nops that need to
1588 		 * be sent to aviod starvation
1589 		 */
1590 		if (!list_empty(&conn->mgmtqueue))
1591 			goto check_mgmt;
1592 	}
1593 
1594 	while (!list_empty(&conn->requeue)) {
1595 		/*
1596 		 * we always do fastlogout - conn stop code will clean up.
1597 		 */
1598 		if (conn->session->state == ISCSI_STATE_LOGGING_OUT)
1599 			break;
1600 
1601 		task = list_entry(conn->requeue.next, struct iscsi_task,
1602 				  running);
1603 
1604 		if (iscsi_check_tmf_restrictions(task, ISCSI_OP_SCSI_DATA_OUT))
1605 			break;
1606 
1607 		list_del_init(&task->running);
1608 		rc = iscsi_xmit_task(conn, task, true);
1609 		if (rc)
1610 			goto done;
1611 		if (!list_empty(&conn->mgmtqueue))
1612 			goto check_mgmt;
1613 	}
1614 	spin_unlock_bh(&conn->session->frwd_lock);
1615 	return -ENODATA;
1616 
1617 done:
1618 	spin_unlock_bh(&conn->session->frwd_lock);
1619 	return rc;
1620 }
1621 
1622 static void iscsi_xmitworker(struct work_struct *work)
1623 {
1624 	struct iscsi_conn *conn =
1625 		container_of(work, struct iscsi_conn, xmitwork);
1626 	int rc;
1627 	/*
1628 	 * serialize Xmit worker on a per-connection basis.
1629 	 */
1630 	do {
1631 		rc = iscsi_data_xmit(conn);
1632 	} while (rc >= 0 || rc == -EAGAIN);
1633 }
1634 
1635 static inline struct iscsi_task *iscsi_alloc_task(struct iscsi_conn *conn,
1636 						  struct scsi_cmnd *sc)
1637 {
1638 	struct iscsi_task *task;
1639 
1640 	if (!kfifo_out(&conn->session->cmdpool.queue,
1641 			 (void *) &task, sizeof(void *)))
1642 		return NULL;
1643 
1644 	sc->SCp.phase = conn->session->age;
1645 	sc->SCp.ptr = (char *) task;
1646 
1647 	refcount_set(&task->refcount, 1);
1648 	task->state = ISCSI_TASK_PENDING;
1649 	task->conn = conn;
1650 	task->sc = sc;
1651 	task->have_checked_conn = false;
1652 	task->last_timeout = jiffies;
1653 	task->last_xfer = jiffies;
1654 	task->protected = false;
1655 	INIT_LIST_HEAD(&task->running);
1656 	return task;
1657 }
1658 
1659 enum {
1660 	FAILURE_BAD_HOST = 1,
1661 	FAILURE_SESSION_FAILED,
1662 	FAILURE_SESSION_FREED,
1663 	FAILURE_WINDOW_CLOSED,
1664 	FAILURE_OOM,
1665 	FAILURE_SESSION_TERMINATE,
1666 	FAILURE_SESSION_IN_RECOVERY,
1667 	FAILURE_SESSION_RECOVERY_TIMEOUT,
1668 	FAILURE_SESSION_LOGGING_OUT,
1669 	FAILURE_SESSION_NOT_READY,
1670 };
1671 
1672 int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc)
1673 {
1674 	struct iscsi_cls_session *cls_session;
1675 	struct iscsi_host *ihost;
1676 	int reason = 0;
1677 	struct iscsi_session *session;
1678 	struct iscsi_conn *conn;
1679 	struct iscsi_task *task = NULL;
1680 
1681 	sc->result = 0;
1682 	sc->SCp.ptr = NULL;
1683 
1684 	ihost = shost_priv(host);
1685 
1686 	cls_session = starget_to_session(scsi_target(sc->device));
1687 	session = cls_session->dd_data;
1688 	spin_lock_bh(&session->frwd_lock);
1689 
1690 	reason = iscsi_session_chkready(cls_session);
1691 	if (reason) {
1692 		sc->result = reason;
1693 		goto fault;
1694 	}
1695 
1696 	if (session->state != ISCSI_STATE_LOGGED_IN) {
1697 		/*
1698 		 * to handle the race between when we set the recovery state
1699 		 * and block the session we requeue here (commands could
1700 		 * be entering our queuecommand while a block is starting
1701 		 * up because the block code is not locked)
1702 		 */
1703 		switch (session->state) {
1704 		case ISCSI_STATE_FAILED:
1705 			/*
1706 			 * cmds should fail during shutdown, if the session
1707 			 * state is bad, allowing completion to happen
1708 			 */
1709 			if (unlikely(system_state != SYSTEM_RUNNING)) {
1710 				reason = FAILURE_SESSION_FAILED;
1711 				sc->result = DID_NO_CONNECT << 16;
1712 				break;
1713 			}
1714 			fallthrough;
1715 		case ISCSI_STATE_IN_RECOVERY:
1716 			reason = FAILURE_SESSION_IN_RECOVERY;
1717 			sc->result = DID_IMM_RETRY << 16;
1718 			break;
1719 		case ISCSI_STATE_LOGGING_OUT:
1720 			reason = FAILURE_SESSION_LOGGING_OUT;
1721 			sc->result = DID_IMM_RETRY << 16;
1722 			break;
1723 		case ISCSI_STATE_RECOVERY_FAILED:
1724 			reason = FAILURE_SESSION_RECOVERY_TIMEOUT;
1725 			sc->result = DID_TRANSPORT_FAILFAST << 16;
1726 			break;
1727 		case ISCSI_STATE_TERMINATE:
1728 			reason = FAILURE_SESSION_TERMINATE;
1729 			sc->result = DID_NO_CONNECT << 16;
1730 			break;
1731 		default:
1732 			reason = FAILURE_SESSION_FREED;
1733 			sc->result = DID_NO_CONNECT << 16;
1734 		}
1735 		goto fault;
1736 	}
1737 
1738 	conn = session->leadconn;
1739 	if (!conn) {
1740 		reason = FAILURE_SESSION_FREED;
1741 		sc->result = DID_NO_CONNECT << 16;
1742 		goto fault;
1743 	}
1744 
1745 	if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx)) {
1746 		reason = FAILURE_SESSION_IN_RECOVERY;
1747 		sc->result = DID_REQUEUE << 16;
1748 		goto fault;
1749 	}
1750 
1751 	if (iscsi_check_cmdsn_window_closed(conn)) {
1752 		reason = FAILURE_WINDOW_CLOSED;
1753 		goto reject;
1754 	}
1755 
1756 	task = iscsi_alloc_task(conn, sc);
1757 	if (!task) {
1758 		reason = FAILURE_OOM;
1759 		goto reject;
1760 	}
1761 
1762 	if (!ihost->workq) {
1763 		reason = iscsi_prep_scsi_cmd_pdu(task);
1764 		if (reason) {
1765 			if (reason == -ENOMEM ||  reason == -EACCES) {
1766 				reason = FAILURE_OOM;
1767 				goto prepd_reject;
1768 			} else {
1769 				sc->result = DID_ABORT << 16;
1770 				goto prepd_fault;
1771 			}
1772 		}
1773 		if (session->tt->xmit_task(task)) {
1774 			session->cmdsn--;
1775 			reason = FAILURE_SESSION_NOT_READY;
1776 			goto prepd_reject;
1777 		}
1778 	} else {
1779 		list_add_tail(&task->running, &conn->cmdqueue);
1780 		iscsi_conn_queue_work(conn);
1781 	}
1782 
1783 	session->queued_cmdsn++;
1784 	spin_unlock_bh(&session->frwd_lock);
1785 	return 0;
1786 
1787 prepd_reject:
1788 	spin_lock_bh(&session->back_lock);
1789 	iscsi_complete_task(task, ISCSI_TASK_REQUEUE_SCSIQ);
1790 	spin_unlock_bh(&session->back_lock);
1791 reject:
1792 	spin_unlock_bh(&session->frwd_lock);
1793 	ISCSI_DBG_SESSION(session, "cmd 0x%x rejected (%d)\n",
1794 			  sc->cmnd[0], reason);
1795 	return SCSI_MLQUEUE_TARGET_BUSY;
1796 
1797 prepd_fault:
1798 	spin_lock_bh(&session->back_lock);
1799 	iscsi_complete_task(task, ISCSI_TASK_REQUEUE_SCSIQ);
1800 	spin_unlock_bh(&session->back_lock);
1801 fault:
1802 	spin_unlock_bh(&session->frwd_lock);
1803 	ISCSI_DBG_SESSION(session, "iscsi: cmd 0x%x is not queued (%d)\n",
1804 			  sc->cmnd[0], reason);
1805 	scsi_set_resid(sc, scsi_bufflen(sc));
1806 	sc->scsi_done(sc);
1807 	return 0;
1808 }
1809 EXPORT_SYMBOL_GPL(iscsi_queuecommand);
1810 
1811 int iscsi_target_alloc(struct scsi_target *starget)
1812 {
1813 	struct iscsi_cls_session *cls_session = starget_to_session(starget);
1814 	struct iscsi_session *session = cls_session->dd_data;
1815 
1816 	starget->can_queue = session->scsi_cmds_max;
1817 	return 0;
1818 }
1819 EXPORT_SYMBOL_GPL(iscsi_target_alloc);
1820 
1821 static void iscsi_tmf_timedout(struct timer_list *t)
1822 {
1823 	struct iscsi_conn *conn = from_timer(conn, t, tmf_timer);
1824 	struct iscsi_session *session = conn->session;
1825 
1826 	spin_lock(&session->frwd_lock);
1827 	if (conn->tmf_state == TMF_QUEUED) {
1828 		conn->tmf_state = TMF_TIMEDOUT;
1829 		ISCSI_DBG_EH(session, "tmf timedout\n");
1830 		/* unblock eh_abort() */
1831 		wake_up(&conn->ehwait);
1832 	}
1833 	spin_unlock(&session->frwd_lock);
1834 }
1835 
1836 static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn,
1837 				   struct iscsi_tm *hdr, int age,
1838 				   int timeout)
1839 	__must_hold(&session->frwd_lock)
1840 {
1841 	struct iscsi_session *session = conn->session;
1842 	struct iscsi_task *task;
1843 
1844 	task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)hdr,
1845 				      NULL, 0);
1846 	if (!task) {
1847 		spin_unlock_bh(&session->frwd_lock);
1848 		iscsi_conn_printk(KERN_ERR, conn, "Could not send TMF.\n");
1849 		iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
1850 		spin_lock_bh(&session->frwd_lock);
1851 		return -EPERM;
1852 	}
1853 	conn->tmfcmd_pdus_cnt++;
1854 	conn->tmf_timer.expires = timeout * HZ + jiffies;
1855 	add_timer(&conn->tmf_timer);
1856 	ISCSI_DBG_EH(session, "tmf set timeout\n");
1857 
1858 	spin_unlock_bh(&session->frwd_lock);
1859 	mutex_unlock(&session->eh_mutex);
1860 
1861 	/*
1862 	 * block eh thread until:
1863 	 *
1864 	 * 1) tmf response
1865 	 * 2) tmf timeout
1866 	 * 3) session is terminated or restarted or userspace has
1867 	 * given up on recovery
1868 	 */
1869 	wait_event_interruptible(conn->ehwait, age != session->age ||
1870 				 session->state != ISCSI_STATE_LOGGED_IN ||
1871 				 conn->tmf_state != TMF_QUEUED);
1872 	if (signal_pending(current))
1873 		flush_signals(current);
1874 	del_timer_sync(&conn->tmf_timer);
1875 
1876 	mutex_lock(&session->eh_mutex);
1877 	spin_lock_bh(&session->frwd_lock);
1878 	/* if the session drops it will clean up the task */
1879 	if (age != session->age ||
1880 	    session->state != ISCSI_STATE_LOGGED_IN)
1881 		return -ENOTCONN;
1882 	return 0;
1883 }
1884 
1885 /*
1886  * Fail commands. session frwd lock held and xmit thread flushed.
1887  */
1888 static void fail_scsi_tasks(struct iscsi_conn *conn, u64 lun, int error)
1889 {
1890 	struct iscsi_session *session = conn->session;
1891 	struct iscsi_task *task;
1892 	int i;
1893 
1894 	spin_lock_bh(&session->back_lock);
1895 	for (i = 0; i < session->cmds_max; i++) {
1896 		task = session->cmds[i];
1897 		if (!task->sc || task->state == ISCSI_TASK_FREE)
1898 			continue;
1899 
1900 		if (lun != -1 && lun != task->sc->device->lun)
1901 			continue;
1902 
1903 		__iscsi_get_task(task);
1904 		spin_unlock_bh(&session->back_lock);
1905 
1906 		ISCSI_DBG_SESSION(session,
1907 				  "failing sc %p itt 0x%x state %d\n",
1908 				  task->sc, task->itt, task->state);
1909 		fail_scsi_task(task, error);
1910 
1911 		spin_unlock_bh(&session->frwd_lock);
1912 		iscsi_put_task(task);
1913 		spin_lock_bh(&session->frwd_lock);
1914 
1915 		spin_lock_bh(&session->back_lock);
1916 	}
1917 
1918 	spin_unlock_bh(&session->back_lock);
1919 }
1920 
1921 /**
1922  * iscsi_suspend_queue - suspend iscsi_queuecommand
1923  * @conn: iscsi conn to stop queueing IO on
1924  *
1925  * This grabs the session frwd_lock to make sure no one is in
1926  * xmit_task/queuecommand, and then sets suspend to prevent
1927  * new commands from being queued. This only needs to be called
1928  * by offload drivers that need to sync a path like ep disconnect
1929  * with the iscsi_queuecommand/xmit_task. To start IO again libiscsi
1930  * will call iscsi_start_tx and iscsi_unblock_session when in FFP.
1931  */
1932 void iscsi_suspend_queue(struct iscsi_conn *conn)
1933 {
1934 	spin_lock_bh(&conn->session->frwd_lock);
1935 	set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
1936 	spin_unlock_bh(&conn->session->frwd_lock);
1937 }
1938 EXPORT_SYMBOL_GPL(iscsi_suspend_queue);
1939 
1940 /**
1941  * iscsi_suspend_tx - suspend iscsi_data_xmit
1942  * @conn: iscsi conn tp stop processing IO on.
1943  *
1944  * This function sets the suspend bit to prevent iscsi_data_xmit
1945  * from sending new IO, and if work is queued on the xmit thread
1946  * it will wait for it to be completed.
1947  */
1948 void iscsi_suspend_tx(struct iscsi_conn *conn)
1949 {
1950 	struct Scsi_Host *shost = conn->session->host;
1951 	struct iscsi_host *ihost = shost_priv(shost);
1952 
1953 	set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
1954 	if (ihost->workq)
1955 		flush_workqueue(ihost->workq);
1956 }
1957 EXPORT_SYMBOL_GPL(iscsi_suspend_tx);
1958 
1959 static void iscsi_start_tx(struct iscsi_conn *conn)
1960 {
1961 	clear_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
1962 	iscsi_conn_queue_work(conn);
1963 }
1964 
1965 /*
1966  * We want to make sure a ping is in flight. It has timed out.
1967  * And we are not busy processing a pdu that is making
1968  * progress but got started before the ping and is taking a while
1969  * to complete so the ping is just stuck behind it in a queue.
1970  */
1971 static int iscsi_has_ping_timed_out(struct iscsi_conn *conn)
1972 {
1973 	if (READ_ONCE(conn->ping_task) &&
1974 	    time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) +
1975 			   (conn->ping_timeout * HZ), jiffies))
1976 		return 1;
1977 	else
1978 		return 0;
1979 }
1980 
1981 enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
1982 {
1983 	enum blk_eh_timer_return rc = BLK_EH_DONE;
1984 	struct iscsi_task *task = NULL, *running_task;
1985 	struct iscsi_cls_session *cls_session;
1986 	struct iscsi_session *session;
1987 	struct iscsi_conn *conn;
1988 	int i;
1989 
1990 	cls_session = starget_to_session(scsi_target(sc->device));
1991 	session = cls_session->dd_data;
1992 
1993 	ISCSI_DBG_EH(session, "scsi cmd %p timedout\n", sc);
1994 
1995 	spin_lock_bh(&session->frwd_lock);
1996 	spin_lock(&session->back_lock);
1997 	task = (struct iscsi_task *)sc->SCp.ptr;
1998 	if (!task) {
1999 		/*
2000 		 * Raced with completion. Blk layer has taken ownership
2001 		 * so let timeout code complete it now.
2002 		 */
2003 		rc = BLK_EH_DONE;
2004 		spin_unlock(&session->back_lock);
2005 		goto done;
2006 	}
2007 	__iscsi_get_task(task);
2008 	spin_unlock(&session->back_lock);
2009 
2010 	if (session->state != ISCSI_STATE_LOGGED_IN) {
2011 		/*
2012 		 * During shutdown, if session is prematurely disconnected,
2013 		 * recovery won't happen and there will be hung cmds. Not
2014 		 * handling cmds would trigger EH, also bad in this case.
2015 		 * Instead, handle cmd, allow completion to happen and let
2016 		 * upper layer to deal with the result.
2017 		 */
2018 		if (unlikely(system_state != SYSTEM_RUNNING)) {
2019 			sc->result = DID_NO_CONNECT << 16;
2020 			ISCSI_DBG_EH(session, "sc on shutdown, handled\n");
2021 			rc = BLK_EH_DONE;
2022 			goto done;
2023 		}
2024 		/*
2025 		 * We are probably in the middle of iscsi recovery so let
2026 		 * that complete and handle the error.
2027 		 */
2028 		rc = BLK_EH_RESET_TIMER;
2029 		goto done;
2030 	}
2031 
2032 	conn = session->leadconn;
2033 	if (!conn) {
2034 		/* In the middle of shuting down */
2035 		rc = BLK_EH_RESET_TIMER;
2036 		goto done;
2037 	}
2038 
2039 	/*
2040 	 * If we have sent (at least queued to the network layer) a pdu or
2041 	 * recvd one for the task since the last timeout ask for
2042 	 * more time. If on the next timeout we have not made progress
2043 	 * we can check if it is the task or connection when we send the
2044 	 * nop as a ping.
2045 	 */
2046 	if (time_after(task->last_xfer, task->last_timeout)) {
2047 		ISCSI_DBG_EH(session, "Command making progress. Asking "
2048 			     "scsi-ml for more time to complete. "
2049 			     "Last data xfer at %lu. Last timeout was at "
2050 			     "%lu\n.", task->last_xfer, task->last_timeout);
2051 		task->have_checked_conn = false;
2052 		rc = BLK_EH_RESET_TIMER;
2053 		goto done;
2054 	}
2055 
2056 	if (!conn->recv_timeout && !conn->ping_timeout)
2057 		goto done;
2058 	/*
2059 	 * if the ping timedout then we are in the middle of cleaning up
2060 	 * and can let the iscsi eh handle it
2061 	 */
2062 	if (iscsi_has_ping_timed_out(conn)) {
2063 		rc = BLK_EH_RESET_TIMER;
2064 		goto done;
2065 	}
2066 
2067 	spin_lock(&session->back_lock);
2068 	for (i = 0; i < conn->session->cmds_max; i++) {
2069 		running_task = conn->session->cmds[i];
2070 		if (!running_task->sc || running_task == task ||
2071 		     running_task->state != ISCSI_TASK_RUNNING)
2072 			continue;
2073 
2074 		/*
2075 		 * Only check if cmds started before this one have made
2076 		 * progress, or this could never fail
2077 		 */
2078 		if (time_after(running_task->sc->jiffies_at_alloc,
2079 			       task->sc->jiffies_at_alloc))
2080 			continue;
2081 
2082 		if (time_after(running_task->last_xfer, task->last_timeout)) {
2083 			/*
2084 			 * This task has not made progress, but a task
2085 			 * started before us has transferred data since
2086 			 * we started/last-checked. We could be queueing
2087 			 * too many tasks or the LU is bad.
2088 			 *
2089 			 * If the device is bad the cmds ahead of us on
2090 			 * other devs will complete, and this loop will
2091 			 * eventually fail starting the scsi eh.
2092 			 */
2093 			ISCSI_DBG_EH(session, "Command has not made progress "
2094 				     "but commands ahead of it have. "
2095 				     "Asking scsi-ml for more time to "
2096 				     "complete. Our last xfer vs running task "
2097 				     "last xfer %lu/%lu. Last check %lu.\n",
2098 				     task->last_xfer, running_task->last_xfer,
2099 				     task->last_timeout);
2100 			spin_unlock(&session->back_lock);
2101 			rc = BLK_EH_RESET_TIMER;
2102 			goto done;
2103 		}
2104 	}
2105 	spin_unlock(&session->back_lock);
2106 
2107 	/* Assumes nop timeout is shorter than scsi cmd timeout */
2108 	if (task->have_checked_conn)
2109 		goto done;
2110 
2111 	/*
2112 	 * Checking the transport already or nop from a cmd timeout still
2113 	 * running
2114 	 */
2115 	if (READ_ONCE(conn->ping_task)) {
2116 		task->have_checked_conn = true;
2117 		rc = BLK_EH_RESET_TIMER;
2118 		goto done;
2119 	}
2120 
2121 	/* Make sure there is a transport check done */
2122 	iscsi_send_nopout(conn, NULL);
2123 	task->have_checked_conn = true;
2124 	rc = BLK_EH_RESET_TIMER;
2125 
2126 done:
2127 	spin_unlock_bh(&session->frwd_lock);
2128 
2129 	if (task) {
2130 		task->last_timeout = jiffies;
2131 		iscsi_put_task(task);
2132 	}
2133 	ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ?
2134 		     "timer reset" : "shutdown or nh");
2135 	return rc;
2136 }
2137 EXPORT_SYMBOL_GPL(iscsi_eh_cmd_timed_out);
2138 
2139 static void iscsi_check_transport_timeouts(struct timer_list *t)
2140 {
2141 	struct iscsi_conn *conn = from_timer(conn, t, transport_timer);
2142 	struct iscsi_session *session = conn->session;
2143 	unsigned long recv_timeout, next_timeout = 0, last_recv;
2144 
2145 	spin_lock(&session->frwd_lock);
2146 	if (session->state != ISCSI_STATE_LOGGED_IN)
2147 		goto done;
2148 
2149 	recv_timeout = conn->recv_timeout;
2150 	if (!recv_timeout)
2151 		goto done;
2152 
2153 	recv_timeout *= HZ;
2154 	last_recv = conn->last_recv;
2155 
2156 	if (iscsi_has_ping_timed_out(conn)) {
2157 		iscsi_conn_printk(KERN_ERR, conn, "ping timeout of %d secs "
2158 				  "expired, recv timeout %d, last rx %lu, "
2159 				  "last ping %lu, now %lu\n",
2160 				  conn->ping_timeout, conn->recv_timeout,
2161 				  last_recv, conn->last_ping, jiffies);
2162 		spin_unlock(&session->frwd_lock);
2163 		iscsi_conn_failure(conn, ISCSI_ERR_NOP_TIMEDOUT);
2164 		return;
2165 	}
2166 
2167 	if (time_before_eq(last_recv + recv_timeout, jiffies)) {
2168 		/* send a ping to try to provoke some traffic */
2169 		ISCSI_DBG_CONN(conn, "Sending nopout as ping\n");
2170 		if (iscsi_send_nopout(conn, NULL))
2171 			next_timeout = jiffies + (1 * HZ);
2172 		else
2173 			next_timeout = conn->last_ping + (conn->ping_timeout * HZ);
2174 	} else
2175 		next_timeout = last_recv + recv_timeout;
2176 
2177 	ISCSI_DBG_CONN(conn, "Setting next tmo %lu\n", next_timeout);
2178 	mod_timer(&conn->transport_timer, next_timeout);
2179 done:
2180 	spin_unlock(&session->frwd_lock);
2181 }
2182 
2183 static void iscsi_prep_abort_task_pdu(struct iscsi_task *task,
2184 				      struct iscsi_tm *hdr)
2185 {
2186 	memset(hdr, 0, sizeof(*hdr));
2187 	hdr->opcode = ISCSI_OP_SCSI_TMFUNC | ISCSI_OP_IMMEDIATE;
2188 	hdr->flags = ISCSI_TM_FUNC_ABORT_TASK & ISCSI_FLAG_TM_FUNC_MASK;
2189 	hdr->flags |= ISCSI_FLAG_CMD_FINAL;
2190 	hdr->lun = task->lun;
2191 	hdr->rtt = task->hdr_itt;
2192 	hdr->refcmdsn = task->cmdsn;
2193 }
2194 
2195 int iscsi_eh_abort(struct scsi_cmnd *sc)
2196 {
2197 	struct iscsi_cls_session *cls_session;
2198 	struct iscsi_session *session;
2199 	struct iscsi_conn *conn;
2200 	struct iscsi_task *task;
2201 	struct iscsi_tm *hdr;
2202 	int age;
2203 
2204 	cls_session = starget_to_session(scsi_target(sc->device));
2205 	session = cls_session->dd_data;
2206 
2207 	ISCSI_DBG_EH(session, "aborting sc %p\n", sc);
2208 
2209 	mutex_lock(&session->eh_mutex);
2210 	spin_lock_bh(&session->frwd_lock);
2211 	/*
2212 	 * if session was ISCSI_STATE_IN_RECOVERY then we may not have
2213 	 * got the command.
2214 	 */
2215 	if (!sc->SCp.ptr) {
2216 		ISCSI_DBG_EH(session, "sc never reached iscsi layer or "
2217 				      "it completed.\n");
2218 		spin_unlock_bh(&session->frwd_lock);
2219 		mutex_unlock(&session->eh_mutex);
2220 		return SUCCESS;
2221 	}
2222 
2223 	/*
2224 	 * If we are not logged in or we have started a new session
2225 	 * then let the host reset code handle this
2226 	 */
2227 	if (!session->leadconn || session->state != ISCSI_STATE_LOGGED_IN ||
2228 	    sc->SCp.phase != session->age) {
2229 		spin_unlock_bh(&session->frwd_lock);
2230 		mutex_unlock(&session->eh_mutex);
2231 		ISCSI_DBG_EH(session, "failing abort due to dropped "
2232 				  "session.\n");
2233 		return FAILED;
2234 	}
2235 
2236 	conn = session->leadconn;
2237 	conn->eh_abort_cnt++;
2238 	age = session->age;
2239 
2240 	spin_lock(&session->back_lock);
2241 	task = (struct iscsi_task *)sc->SCp.ptr;
2242 	if (!task || !task->sc) {
2243 		/* task completed before time out */
2244 		ISCSI_DBG_EH(session, "sc completed while abort in progress\n");
2245 
2246 		spin_unlock(&session->back_lock);
2247 		spin_unlock_bh(&session->frwd_lock);
2248 		mutex_unlock(&session->eh_mutex);
2249 		return SUCCESS;
2250 	}
2251 	ISCSI_DBG_EH(session, "aborting [sc %p itt 0x%x]\n", sc, task->itt);
2252 	__iscsi_get_task(task);
2253 	spin_unlock(&session->back_lock);
2254 
2255 	if (task->state == ISCSI_TASK_PENDING) {
2256 		fail_scsi_task(task, DID_ABORT);
2257 		goto success;
2258 	}
2259 
2260 	/* only have one tmf outstanding at a time */
2261 	if (conn->tmf_state != TMF_INITIAL)
2262 		goto failed;
2263 	conn->tmf_state = TMF_QUEUED;
2264 
2265 	hdr = &conn->tmhdr;
2266 	iscsi_prep_abort_task_pdu(task, hdr);
2267 
2268 	if (iscsi_exec_task_mgmt_fn(conn, hdr, age, session->abort_timeout))
2269 		goto failed;
2270 
2271 	switch (conn->tmf_state) {
2272 	case TMF_SUCCESS:
2273 		spin_unlock_bh(&session->frwd_lock);
2274 		/*
2275 		 * stop tx side incase the target had sent a abort rsp but
2276 		 * the initiator was still writing out data.
2277 		 */
2278 		iscsi_suspend_tx(conn);
2279 		/*
2280 		 * we do not stop the recv side because targets have been
2281 		 * good and have never sent us a successful tmf response
2282 		 * then sent more data for the cmd.
2283 		 */
2284 		spin_lock_bh(&session->frwd_lock);
2285 		fail_scsi_task(task, DID_ABORT);
2286 		conn->tmf_state = TMF_INITIAL;
2287 		memset(hdr, 0, sizeof(*hdr));
2288 		spin_unlock_bh(&session->frwd_lock);
2289 		iscsi_start_tx(conn);
2290 		goto success_unlocked;
2291 	case TMF_TIMEDOUT:
2292 		spin_unlock_bh(&session->frwd_lock);
2293 		iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
2294 		goto failed_unlocked;
2295 	case TMF_NOT_FOUND:
2296 		if (!sc->SCp.ptr) {
2297 			conn->tmf_state = TMF_INITIAL;
2298 			memset(hdr, 0, sizeof(*hdr));
2299 			/* task completed before tmf abort response */
2300 			ISCSI_DBG_EH(session, "sc completed while abort	in "
2301 					      "progress\n");
2302 			goto success;
2303 		}
2304 		fallthrough;
2305 	default:
2306 		conn->tmf_state = TMF_INITIAL;
2307 		goto failed;
2308 	}
2309 
2310 success:
2311 	spin_unlock_bh(&session->frwd_lock);
2312 success_unlocked:
2313 	ISCSI_DBG_EH(session, "abort success [sc %p itt 0x%x]\n",
2314 		     sc, task->itt);
2315 	iscsi_put_task(task);
2316 	mutex_unlock(&session->eh_mutex);
2317 	return SUCCESS;
2318 
2319 failed:
2320 	spin_unlock_bh(&session->frwd_lock);
2321 failed_unlocked:
2322 	ISCSI_DBG_EH(session, "abort failed [sc %p itt 0x%x]\n", sc,
2323 		     task ? task->itt : 0);
2324 	iscsi_put_task(task);
2325 	mutex_unlock(&session->eh_mutex);
2326 	return FAILED;
2327 }
2328 EXPORT_SYMBOL_GPL(iscsi_eh_abort);
2329 
2330 static void iscsi_prep_lun_reset_pdu(struct scsi_cmnd *sc, struct iscsi_tm *hdr)
2331 {
2332 	memset(hdr, 0, sizeof(*hdr));
2333 	hdr->opcode = ISCSI_OP_SCSI_TMFUNC | ISCSI_OP_IMMEDIATE;
2334 	hdr->flags = ISCSI_TM_FUNC_LOGICAL_UNIT_RESET & ISCSI_FLAG_TM_FUNC_MASK;
2335 	hdr->flags |= ISCSI_FLAG_CMD_FINAL;
2336 	int_to_scsilun(sc->device->lun, &hdr->lun);
2337 	hdr->rtt = RESERVED_ITT;
2338 }
2339 
2340 int iscsi_eh_device_reset(struct scsi_cmnd *sc)
2341 {
2342 	struct iscsi_cls_session *cls_session;
2343 	struct iscsi_session *session;
2344 	struct iscsi_conn *conn;
2345 	struct iscsi_tm *hdr;
2346 	int rc = FAILED;
2347 
2348 	cls_session = starget_to_session(scsi_target(sc->device));
2349 	session = cls_session->dd_data;
2350 
2351 	ISCSI_DBG_EH(session, "LU Reset [sc %p lun %llu]\n", sc,
2352 		     sc->device->lun);
2353 
2354 	mutex_lock(&session->eh_mutex);
2355 	spin_lock_bh(&session->frwd_lock);
2356 	/*
2357 	 * Just check if we are not logged in. We cannot check for
2358 	 * the phase because the reset could come from a ioctl.
2359 	 */
2360 	if (!session->leadconn || session->state != ISCSI_STATE_LOGGED_IN)
2361 		goto unlock;
2362 	conn = session->leadconn;
2363 
2364 	/* only have one tmf outstanding at a time */
2365 	if (conn->tmf_state != TMF_INITIAL)
2366 		goto unlock;
2367 	conn->tmf_state = TMF_QUEUED;
2368 
2369 	hdr = &conn->tmhdr;
2370 	iscsi_prep_lun_reset_pdu(sc, hdr);
2371 
2372 	if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age,
2373 				    session->lu_reset_timeout)) {
2374 		rc = FAILED;
2375 		goto unlock;
2376 	}
2377 
2378 	switch (conn->tmf_state) {
2379 	case TMF_SUCCESS:
2380 		break;
2381 	case TMF_TIMEDOUT:
2382 		spin_unlock_bh(&session->frwd_lock);
2383 		iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
2384 		goto done;
2385 	default:
2386 		conn->tmf_state = TMF_INITIAL;
2387 		goto unlock;
2388 	}
2389 
2390 	rc = SUCCESS;
2391 	spin_unlock_bh(&session->frwd_lock);
2392 
2393 	iscsi_suspend_tx(conn);
2394 
2395 	spin_lock_bh(&session->frwd_lock);
2396 	memset(hdr, 0, sizeof(*hdr));
2397 	fail_scsi_tasks(conn, sc->device->lun, DID_ERROR);
2398 	conn->tmf_state = TMF_INITIAL;
2399 	spin_unlock_bh(&session->frwd_lock);
2400 
2401 	iscsi_start_tx(conn);
2402 	goto done;
2403 
2404 unlock:
2405 	spin_unlock_bh(&session->frwd_lock);
2406 done:
2407 	ISCSI_DBG_EH(session, "dev reset result = %s\n",
2408 		     rc == SUCCESS ? "SUCCESS" : "FAILED");
2409 	mutex_unlock(&session->eh_mutex);
2410 	return rc;
2411 }
2412 EXPORT_SYMBOL_GPL(iscsi_eh_device_reset);
2413 
2414 void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session)
2415 {
2416 	struct iscsi_session *session = cls_session->dd_data;
2417 
2418 	spin_lock_bh(&session->frwd_lock);
2419 	if (session->state != ISCSI_STATE_LOGGED_IN) {
2420 		session->state = ISCSI_STATE_RECOVERY_FAILED;
2421 		if (session->leadconn)
2422 			wake_up(&session->leadconn->ehwait);
2423 	}
2424 	spin_unlock_bh(&session->frwd_lock);
2425 }
2426 EXPORT_SYMBOL_GPL(iscsi_session_recovery_timedout);
2427 
2428 /**
2429  * iscsi_eh_session_reset - drop session and attempt relogin
2430  * @sc: scsi command
2431  *
2432  * This function will wait for a relogin, session termination from
2433  * userspace, or a recovery/replacement timeout.
2434  */
2435 int iscsi_eh_session_reset(struct scsi_cmnd *sc)
2436 {
2437 	struct iscsi_cls_session *cls_session;
2438 	struct iscsi_session *session;
2439 	struct iscsi_conn *conn;
2440 
2441 	cls_session = starget_to_session(scsi_target(sc->device));
2442 	session = cls_session->dd_data;
2443 	conn = session->leadconn;
2444 
2445 	mutex_lock(&session->eh_mutex);
2446 	spin_lock_bh(&session->frwd_lock);
2447 	if (session->state == ISCSI_STATE_TERMINATE) {
2448 failed:
2449 		ISCSI_DBG_EH(session,
2450 			     "failing session reset: Could not log back into "
2451 			     "%s [age %d]\n", session->targetname,
2452 			     session->age);
2453 		spin_unlock_bh(&session->frwd_lock);
2454 		mutex_unlock(&session->eh_mutex);
2455 		return FAILED;
2456 	}
2457 
2458 	spin_unlock_bh(&session->frwd_lock);
2459 	mutex_unlock(&session->eh_mutex);
2460 	/*
2461 	 * we drop the lock here but the leadconn cannot be destoyed while
2462 	 * we are in the scsi eh
2463 	 */
2464 	iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
2465 
2466 	ISCSI_DBG_EH(session, "wait for relogin\n");
2467 	wait_event_interruptible(conn->ehwait,
2468 				 session->state == ISCSI_STATE_TERMINATE ||
2469 				 session->state == ISCSI_STATE_LOGGED_IN ||
2470 				 session->state == ISCSI_STATE_RECOVERY_FAILED);
2471 	if (signal_pending(current))
2472 		flush_signals(current);
2473 
2474 	mutex_lock(&session->eh_mutex);
2475 	spin_lock_bh(&session->frwd_lock);
2476 	if (session->state == ISCSI_STATE_LOGGED_IN) {
2477 		ISCSI_DBG_EH(session,
2478 			     "session reset succeeded for %s,%s\n",
2479 			     session->targetname, conn->persistent_address);
2480 	} else
2481 		goto failed;
2482 	spin_unlock_bh(&session->frwd_lock);
2483 	mutex_unlock(&session->eh_mutex);
2484 	return SUCCESS;
2485 }
2486 EXPORT_SYMBOL_GPL(iscsi_eh_session_reset);
2487 
2488 static void iscsi_prep_tgt_reset_pdu(struct scsi_cmnd *sc, struct iscsi_tm *hdr)
2489 {
2490 	memset(hdr, 0, sizeof(*hdr));
2491 	hdr->opcode = ISCSI_OP_SCSI_TMFUNC | ISCSI_OP_IMMEDIATE;
2492 	hdr->flags = ISCSI_TM_FUNC_TARGET_WARM_RESET & ISCSI_FLAG_TM_FUNC_MASK;
2493 	hdr->flags |= ISCSI_FLAG_CMD_FINAL;
2494 	hdr->rtt = RESERVED_ITT;
2495 }
2496 
2497 /**
2498  * iscsi_eh_target_reset - reset target
2499  * @sc: scsi command
2500  *
2501  * This will attempt to send a warm target reset.
2502  */
2503 static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
2504 {
2505 	struct iscsi_cls_session *cls_session;
2506 	struct iscsi_session *session;
2507 	struct iscsi_conn *conn;
2508 	struct iscsi_tm *hdr;
2509 	int rc = FAILED;
2510 
2511 	cls_session = starget_to_session(scsi_target(sc->device));
2512 	session = cls_session->dd_data;
2513 
2514 	ISCSI_DBG_EH(session, "tgt Reset [sc %p tgt %s]\n", sc,
2515 		     session->targetname);
2516 
2517 	mutex_lock(&session->eh_mutex);
2518 	spin_lock_bh(&session->frwd_lock);
2519 	/*
2520 	 * Just check if we are not logged in. We cannot check for
2521 	 * the phase because the reset could come from a ioctl.
2522 	 */
2523 	if (!session->leadconn || session->state != ISCSI_STATE_LOGGED_IN)
2524 		goto unlock;
2525 	conn = session->leadconn;
2526 
2527 	/* only have one tmf outstanding at a time */
2528 	if (conn->tmf_state != TMF_INITIAL)
2529 		goto unlock;
2530 	conn->tmf_state = TMF_QUEUED;
2531 
2532 	hdr = &conn->tmhdr;
2533 	iscsi_prep_tgt_reset_pdu(sc, hdr);
2534 
2535 	if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age,
2536 				    session->tgt_reset_timeout)) {
2537 		rc = FAILED;
2538 		goto unlock;
2539 	}
2540 
2541 	switch (conn->tmf_state) {
2542 	case TMF_SUCCESS:
2543 		break;
2544 	case TMF_TIMEDOUT:
2545 		spin_unlock_bh(&session->frwd_lock);
2546 		iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
2547 		goto done;
2548 	default:
2549 		conn->tmf_state = TMF_INITIAL;
2550 		goto unlock;
2551 	}
2552 
2553 	rc = SUCCESS;
2554 	spin_unlock_bh(&session->frwd_lock);
2555 
2556 	iscsi_suspend_tx(conn);
2557 
2558 	spin_lock_bh(&session->frwd_lock);
2559 	memset(hdr, 0, sizeof(*hdr));
2560 	fail_scsi_tasks(conn, -1, DID_ERROR);
2561 	conn->tmf_state = TMF_INITIAL;
2562 	spin_unlock_bh(&session->frwd_lock);
2563 
2564 	iscsi_start_tx(conn);
2565 	goto done;
2566 
2567 unlock:
2568 	spin_unlock_bh(&session->frwd_lock);
2569 done:
2570 	ISCSI_DBG_EH(session, "tgt %s reset result = %s\n", session->targetname,
2571 		     rc == SUCCESS ? "SUCCESS" : "FAILED");
2572 	mutex_unlock(&session->eh_mutex);
2573 	return rc;
2574 }
2575 
2576 /**
2577  * iscsi_eh_recover_target - reset target and possibly the session
2578  * @sc: scsi command
2579  *
2580  * This will attempt to send a warm target reset. If that fails,
2581  * we will escalate to ERL0 session recovery.
2582  */
2583 int iscsi_eh_recover_target(struct scsi_cmnd *sc)
2584 {
2585 	int rc;
2586 
2587 	rc = iscsi_eh_target_reset(sc);
2588 	if (rc == FAILED)
2589 		rc = iscsi_eh_session_reset(sc);
2590 	return rc;
2591 }
2592 EXPORT_SYMBOL_GPL(iscsi_eh_recover_target);
2593 
2594 /*
2595  * Pre-allocate a pool of @max items of @item_size. By default, the pool
2596  * should be accessed via kfifo_{get,put} on q->queue.
2597  * Optionally, the caller can obtain the array of object pointers
2598  * by passing in a non-NULL @items pointer
2599  */
2600 int
2601 iscsi_pool_init(struct iscsi_pool *q, int max, void ***items, int item_size)
2602 {
2603 	int i, num_arrays = 1;
2604 
2605 	memset(q, 0, sizeof(*q));
2606 
2607 	q->max = max;
2608 
2609 	/* If the user passed an items pointer, he wants a copy of
2610 	 * the array. */
2611 	if (items)
2612 		num_arrays++;
2613 	q->pool = kvcalloc(num_arrays * max, sizeof(void *), GFP_KERNEL);
2614 	if (q->pool == NULL)
2615 		return -ENOMEM;
2616 
2617 	kfifo_init(&q->queue, (void*)q->pool, max * sizeof(void*));
2618 
2619 	for (i = 0; i < max; i++) {
2620 		q->pool[i] = kzalloc(item_size, GFP_KERNEL);
2621 		if (q->pool[i] == NULL) {
2622 			q->max = i;
2623 			goto enomem;
2624 		}
2625 		kfifo_in(&q->queue, (void*)&q->pool[i], sizeof(void*));
2626 	}
2627 
2628 	if (items) {
2629 		*items = q->pool + max;
2630 		memcpy(*items, q->pool, max * sizeof(void *));
2631 	}
2632 
2633 	return 0;
2634 
2635 enomem:
2636 	iscsi_pool_free(q);
2637 	return -ENOMEM;
2638 }
2639 EXPORT_SYMBOL_GPL(iscsi_pool_init);
2640 
2641 void iscsi_pool_free(struct iscsi_pool *q)
2642 {
2643 	int i;
2644 
2645 	for (i = 0; i < q->max; i++)
2646 		kfree(q->pool[i]);
2647 	kvfree(q->pool);
2648 }
2649 EXPORT_SYMBOL_GPL(iscsi_pool_free);
2650 
2651 int iscsi_host_get_max_scsi_cmds(struct Scsi_Host *shost,
2652 				 uint16_t requested_cmds_max)
2653 {
2654 	int scsi_cmds, total_cmds = requested_cmds_max;
2655 
2656 check:
2657 	if (!total_cmds)
2658 		total_cmds = ISCSI_DEF_XMIT_CMDS_MAX;
2659 	/*
2660 	 * The iscsi layer needs some tasks for nop handling and tmfs,
2661 	 * so the cmds_max must at least be greater than ISCSI_MGMT_CMDS_MAX
2662 	 * + 1 command for scsi IO.
2663 	 */
2664 	if (total_cmds < ISCSI_TOTAL_CMDS_MIN) {
2665 		printk(KERN_ERR "iscsi: invalid max cmds of %d. Must be a power of two that is at least %d.\n",
2666 		       total_cmds, ISCSI_TOTAL_CMDS_MIN);
2667 		return -EINVAL;
2668 	}
2669 
2670 	if (total_cmds > ISCSI_TOTAL_CMDS_MAX) {
2671 		printk(KERN_INFO "iscsi: invalid max cmds of %d. Must be a power of 2 less than or equal to %d. Using %d.\n",
2672 		       requested_cmds_max, ISCSI_TOTAL_CMDS_MAX,
2673 		       ISCSI_TOTAL_CMDS_MAX);
2674 		total_cmds = ISCSI_TOTAL_CMDS_MAX;
2675 	}
2676 
2677 	if (!is_power_of_2(total_cmds)) {
2678 		total_cmds = rounddown_pow_of_two(total_cmds);
2679 		if (total_cmds < ISCSI_TOTAL_CMDS_MIN) {
2680 			printk(KERN_ERR "iscsi: invalid max cmds of %d. Must be a power of 2 greater than %d.\n", requested_cmds_max, ISCSI_TOTAL_CMDS_MIN);
2681 			return -EINVAL;
2682 		}
2683 
2684 		printk(KERN_INFO "iscsi: invalid max cmds %d. Must be a power of 2. Rounding max cmds down to %d.\n",
2685 		       requested_cmds_max, total_cmds);
2686 	}
2687 
2688 	scsi_cmds = total_cmds - ISCSI_MGMT_CMDS_MAX;
2689 	if (shost->can_queue && scsi_cmds > shost->can_queue) {
2690 		total_cmds = shost->can_queue;
2691 
2692 		printk(KERN_INFO "iscsi: requested max cmds %u is higher than driver limit. Using driver limit %u\n",
2693 		       requested_cmds_max, shost->can_queue);
2694 		goto check;
2695 	}
2696 
2697 	return scsi_cmds;
2698 }
2699 EXPORT_SYMBOL_GPL(iscsi_host_get_max_scsi_cmds);
2700 
2701 /**
2702  * iscsi_host_add - add host to system
2703  * @shost: scsi host
2704  * @pdev: parent device
2705  *
2706  * This should be called by partial offload and software iscsi drivers
2707  * to add a host to the system.
2708  */
2709 int iscsi_host_add(struct Scsi_Host *shost, struct device *pdev)
2710 {
2711 	if (!shost->can_queue)
2712 		shost->can_queue = ISCSI_DEF_XMIT_CMDS_MAX;
2713 
2714 	if (!shost->cmd_per_lun)
2715 		shost->cmd_per_lun = ISCSI_DEF_CMD_PER_LUN;
2716 
2717 	return scsi_add_host(shost, pdev);
2718 }
2719 EXPORT_SYMBOL_GPL(iscsi_host_add);
2720 
2721 /**
2722  * iscsi_host_alloc - allocate a host and driver data
2723  * @sht: scsi host template
2724  * @dd_data_size: driver host data size
2725  * @xmit_can_sleep: bool indicating if LLD will queue IO from a work queue
2726  *
2727  * This should be called by partial offload and software iscsi drivers.
2728  * To access the driver specific memory use the iscsi_host_priv() macro.
2729  */
2730 struct Scsi_Host *iscsi_host_alloc(struct scsi_host_template *sht,
2731 				   int dd_data_size, bool xmit_can_sleep)
2732 {
2733 	struct Scsi_Host *shost;
2734 	struct iscsi_host *ihost;
2735 
2736 	shost = scsi_host_alloc(sht, sizeof(struct iscsi_host) + dd_data_size);
2737 	if (!shost)
2738 		return NULL;
2739 	ihost = shost_priv(shost);
2740 
2741 	if (xmit_can_sleep) {
2742 		snprintf(ihost->workq_name, sizeof(ihost->workq_name),
2743 			"iscsi_q_%d", shost->host_no);
2744 		ihost->workq = alloc_workqueue("%s",
2745 			WQ_SYSFS | __WQ_LEGACY | WQ_MEM_RECLAIM | WQ_UNBOUND,
2746 			1, ihost->workq_name);
2747 		if (!ihost->workq)
2748 			goto free_host;
2749 	}
2750 
2751 	spin_lock_init(&ihost->lock);
2752 	ihost->state = ISCSI_HOST_SETUP;
2753 	ihost->num_sessions = 0;
2754 	init_waitqueue_head(&ihost->session_removal_wq);
2755 	return shost;
2756 
2757 free_host:
2758 	scsi_host_put(shost);
2759 	return NULL;
2760 }
2761 EXPORT_SYMBOL_GPL(iscsi_host_alloc);
2762 
2763 static void iscsi_notify_host_removed(struct iscsi_cls_session *cls_session)
2764 {
2765 	iscsi_session_failure(cls_session->dd_data, ISCSI_ERR_INVALID_HOST);
2766 }
2767 
2768 /**
2769  * iscsi_host_remove - remove host and sessions
2770  * @shost: scsi host
2771  *
2772  * If there are any sessions left, this will initiate the removal and wait
2773  * for the completion.
2774  */
2775 void iscsi_host_remove(struct Scsi_Host *shost)
2776 {
2777 	struct iscsi_host *ihost = shost_priv(shost);
2778 	unsigned long flags;
2779 
2780 	spin_lock_irqsave(&ihost->lock, flags);
2781 	ihost->state = ISCSI_HOST_REMOVED;
2782 	spin_unlock_irqrestore(&ihost->lock, flags);
2783 
2784 	iscsi_host_for_each_session(shost, iscsi_notify_host_removed);
2785 	wait_event_interruptible(ihost->session_removal_wq,
2786 				 ihost->num_sessions == 0);
2787 	if (signal_pending(current))
2788 		flush_signals(current);
2789 
2790 	scsi_remove_host(shost);
2791 }
2792 EXPORT_SYMBOL_GPL(iscsi_host_remove);
2793 
2794 void iscsi_host_free(struct Scsi_Host *shost)
2795 {
2796 	struct iscsi_host *ihost = shost_priv(shost);
2797 
2798 	if (ihost->workq)
2799 		destroy_workqueue(ihost->workq);
2800 
2801 	kfree(ihost->netdev);
2802 	kfree(ihost->hwaddress);
2803 	kfree(ihost->initiatorname);
2804 	scsi_host_put(shost);
2805 }
2806 EXPORT_SYMBOL_GPL(iscsi_host_free);
2807 
2808 static void iscsi_host_dec_session_cnt(struct Scsi_Host *shost)
2809 {
2810 	struct iscsi_host *ihost = shost_priv(shost);
2811 	unsigned long flags;
2812 
2813 	shost = scsi_host_get(shost);
2814 	if (!shost) {
2815 		printk(KERN_ERR "Invalid state. Cannot notify host removal "
2816 		      "of session teardown event because host already "
2817 		      "removed.\n");
2818 		return;
2819 	}
2820 
2821 	spin_lock_irqsave(&ihost->lock, flags);
2822 	ihost->num_sessions--;
2823 	if (ihost->num_sessions == 0)
2824 		wake_up(&ihost->session_removal_wq);
2825 	spin_unlock_irqrestore(&ihost->lock, flags);
2826 	scsi_host_put(shost);
2827 }
2828 
2829 /**
2830  * iscsi_session_setup - create iscsi cls session and host and session
2831  * @iscsit: iscsi transport template
2832  * @shost: scsi host
2833  * @cmds_max: session can queue
2834  * @dd_size: private driver data size, added to session allocation size
2835  * @cmd_task_size: LLD task private data size
2836  * @initial_cmdsn: initial CmdSN
2837  * @id: target ID to add to this session
2838  *
2839  * This can be used by software iscsi_transports that allocate
2840  * a session per scsi host.
2841  *
2842  * Callers should set cmds_max to the largest total numer (mgmt + scsi) of
2843  * tasks they support. The iscsi layer reserves ISCSI_MGMT_CMDS_MAX tasks
2844  * for nop handling and login/logout requests.
2845  */
2846 struct iscsi_cls_session *
2847 iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost,
2848 		    uint16_t cmds_max, int dd_size, int cmd_task_size,
2849 		    uint32_t initial_cmdsn, unsigned int id)
2850 {
2851 	struct iscsi_host *ihost = shost_priv(shost);
2852 	struct iscsi_session *session;
2853 	struct iscsi_cls_session *cls_session;
2854 	int cmd_i, scsi_cmds;
2855 	unsigned long flags;
2856 
2857 	spin_lock_irqsave(&ihost->lock, flags);
2858 	if (ihost->state == ISCSI_HOST_REMOVED) {
2859 		spin_unlock_irqrestore(&ihost->lock, flags);
2860 		return NULL;
2861 	}
2862 	ihost->num_sessions++;
2863 	spin_unlock_irqrestore(&ihost->lock, flags);
2864 
2865 	scsi_cmds = iscsi_host_get_max_scsi_cmds(shost, cmds_max);
2866 	if (scsi_cmds < 0)
2867 		goto dec_session_count;
2868 
2869 	cls_session = iscsi_alloc_session(shost, iscsit,
2870 					  sizeof(struct iscsi_session) +
2871 					  dd_size);
2872 	if (!cls_session)
2873 		goto dec_session_count;
2874 	session = cls_session->dd_data;
2875 	session->cls_session = cls_session;
2876 	session->host = shost;
2877 	session->state = ISCSI_STATE_FREE;
2878 	session->fast_abort = 1;
2879 	session->tgt_reset_timeout = 30;
2880 	session->lu_reset_timeout = 15;
2881 	session->abort_timeout = 10;
2882 	session->scsi_cmds_max = scsi_cmds;
2883 	session->cmds_max = scsi_cmds + ISCSI_MGMT_CMDS_MAX;
2884 	session->queued_cmdsn = session->cmdsn = initial_cmdsn;
2885 	session->exp_cmdsn = initial_cmdsn + 1;
2886 	session->max_cmdsn = initial_cmdsn + 1;
2887 	session->max_r2t = 1;
2888 	session->tt = iscsit;
2889 	session->dd_data = cls_session->dd_data + sizeof(*session);
2890 
2891 	mutex_init(&session->eh_mutex);
2892 	spin_lock_init(&session->frwd_lock);
2893 	spin_lock_init(&session->back_lock);
2894 
2895 	/* initialize SCSI PDU commands pool */
2896 	if (iscsi_pool_init(&session->cmdpool, session->cmds_max,
2897 			    (void***)&session->cmds,
2898 			    cmd_task_size + sizeof(struct iscsi_task)))
2899 		goto cmdpool_alloc_fail;
2900 
2901 	/* pre-format cmds pool with ITT */
2902 	for (cmd_i = 0; cmd_i < session->cmds_max; cmd_i++) {
2903 		struct iscsi_task *task = session->cmds[cmd_i];
2904 
2905 		if (cmd_task_size)
2906 			task->dd_data = &task[1];
2907 		task->itt = cmd_i;
2908 		task->state = ISCSI_TASK_FREE;
2909 		INIT_LIST_HEAD(&task->running);
2910 	}
2911 
2912 	if (!try_module_get(iscsit->owner))
2913 		goto module_get_fail;
2914 
2915 	if (iscsi_add_session(cls_session, id))
2916 		goto cls_session_fail;
2917 
2918 	return cls_session;
2919 
2920 cls_session_fail:
2921 	module_put(iscsit->owner);
2922 module_get_fail:
2923 	iscsi_pool_free(&session->cmdpool);
2924 cmdpool_alloc_fail:
2925 	iscsi_free_session(cls_session);
2926 dec_session_count:
2927 	iscsi_host_dec_session_cnt(shost);
2928 	return NULL;
2929 }
2930 EXPORT_SYMBOL_GPL(iscsi_session_setup);
2931 
2932 /**
2933  * iscsi_session_teardown - destroy session, host, and cls_session
2934  * @cls_session: iscsi session
2935  */
2936 void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
2937 {
2938 	struct iscsi_session *session = cls_session->dd_data;
2939 	struct module *owner = cls_session->transport->owner;
2940 	struct Scsi_Host *shost = session->host;
2941 
2942 	iscsi_pool_free(&session->cmdpool);
2943 
2944 	iscsi_remove_session(cls_session);
2945 
2946 	kfree(session->password);
2947 	kfree(session->password_in);
2948 	kfree(session->username);
2949 	kfree(session->username_in);
2950 	kfree(session->targetname);
2951 	kfree(session->targetalias);
2952 	kfree(session->initiatorname);
2953 	kfree(session->boot_root);
2954 	kfree(session->boot_nic);
2955 	kfree(session->boot_target);
2956 	kfree(session->ifacename);
2957 	kfree(session->portal_type);
2958 	kfree(session->discovery_parent_type);
2959 
2960 	iscsi_free_session(cls_session);
2961 
2962 	iscsi_host_dec_session_cnt(shost);
2963 	module_put(owner);
2964 }
2965 EXPORT_SYMBOL_GPL(iscsi_session_teardown);
2966 
2967 /**
2968  * iscsi_conn_setup - create iscsi_cls_conn and iscsi_conn
2969  * @cls_session: iscsi_cls_session
2970  * @dd_size: private driver data size
2971  * @conn_idx: cid
2972  */
2973 struct iscsi_cls_conn *
2974 iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
2975 		 uint32_t conn_idx)
2976 {
2977 	struct iscsi_session *session = cls_session->dd_data;
2978 	struct iscsi_conn *conn;
2979 	struct iscsi_cls_conn *cls_conn;
2980 	char *data;
2981 
2982 	cls_conn = iscsi_create_conn(cls_session, sizeof(*conn) + dd_size,
2983 				     conn_idx);
2984 	if (!cls_conn)
2985 		return NULL;
2986 	conn = cls_conn->dd_data;
2987 	memset(conn, 0, sizeof(*conn) + dd_size);
2988 
2989 	conn->dd_data = cls_conn->dd_data + sizeof(*conn);
2990 	conn->session = session;
2991 	conn->cls_conn = cls_conn;
2992 	conn->c_stage = ISCSI_CONN_INITIAL_STAGE;
2993 	conn->id = conn_idx;
2994 	conn->exp_statsn = 0;
2995 	conn->tmf_state = TMF_INITIAL;
2996 
2997 	timer_setup(&conn->transport_timer, iscsi_check_transport_timeouts, 0);
2998 
2999 	INIT_LIST_HEAD(&conn->mgmtqueue);
3000 	INIT_LIST_HEAD(&conn->cmdqueue);
3001 	INIT_LIST_HEAD(&conn->requeue);
3002 	INIT_WORK(&conn->xmitwork, iscsi_xmitworker);
3003 
3004 	/* allocate login_task used for the login/text sequences */
3005 	spin_lock_bh(&session->frwd_lock);
3006 	if (!kfifo_out(&session->cmdpool.queue,
3007                          (void*)&conn->login_task,
3008 			 sizeof(void*))) {
3009 		spin_unlock_bh(&session->frwd_lock);
3010 		goto login_task_alloc_fail;
3011 	}
3012 	spin_unlock_bh(&session->frwd_lock);
3013 
3014 	data = (char *) __get_free_pages(GFP_KERNEL,
3015 					 get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
3016 	if (!data)
3017 		goto login_task_data_alloc_fail;
3018 	conn->login_task->data = conn->data = data;
3019 
3020 	timer_setup(&conn->tmf_timer, iscsi_tmf_timedout, 0);
3021 	init_waitqueue_head(&conn->ehwait);
3022 
3023 	return cls_conn;
3024 
3025 login_task_data_alloc_fail:
3026 	kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
3027 		    sizeof(void*));
3028 login_task_alloc_fail:
3029 	iscsi_destroy_conn(cls_conn);
3030 	return NULL;
3031 }
3032 EXPORT_SYMBOL_GPL(iscsi_conn_setup);
3033 
3034 /**
3035  * iscsi_conn_teardown - teardown iscsi connection
3036  * @cls_conn: iscsi class connection
3037  *
3038  * TODO: we may need to make this into a two step process
3039  * like scsi-mls remove + put host
3040  */
3041 void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
3042 {
3043 	struct iscsi_conn *conn = cls_conn->dd_data;
3044 	struct iscsi_session *session = conn->session;
3045 
3046 	del_timer_sync(&conn->transport_timer);
3047 
3048 	mutex_lock(&session->eh_mutex);
3049 	spin_lock_bh(&session->frwd_lock);
3050 	conn->c_stage = ISCSI_CONN_CLEANUP_WAIT;
3051 	if (session->leadconn == conn) {
3052 		/*
3053 		 * leading connection? then give up on recovery.
3054 		 */
3055 		session->state = ISCSI_STATE_TERMINATE;
3056 		wake_up(&conn->ehwait);
3057 	}
3058 	spin_unlock_bh(&session->frwd_lock);
3059 
3060 	/* flush queued up work because we free the connection below */
3061 	iscsi_suspend_tx(conn);
3062 
3063 	spin_lock_bh(&session->frwd_lock);
3064 	free_pages((unsigned long) conn->data,
3065 		   get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
3066 	kfree(conn->persistent_address);
3067 	kfree(conn->local_ipaddr);
3068 	/* regular RX path uses back_lock */
3069 	spin_lock_bh(&session->back_lock);
3070 	kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
3071 		    sizeof(void*));
3072 	spin_unlock_bh(&session->back_lock);
3073 	if (session->leadconn == conn)
3074 		session->leadconn = NULL;
3075 	spin_unlock_bh(&session->frwd_lock);
3076 	mutex_unlock(&session->eh_mutex);
3077 
3078 	iscsi_destroy_conn(cls_conn);
3079 }
3080 EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
3081 
3082 int iscsi_conn_start(struct iscsi_cls_conn *cls_conn)
3083 {
3084 	struct iscsi_conn *conn = cls_conn->dd_data;
3085 	struct iscsi_session *session = conn->session;
3086 
3087 	if (!session) {
3088 		iscsi_conn_printk(KERN_ERR, conn,
3089 				  "can't start unbound connection\n");
3090 		return -EPERM;
3091 	}
3092 
3093 	if ((session->imm_data_en || !session->initial_r2t_en) &&
3094 	     session->first_burst > session->max_burst) {
3095 		iscsi_conn_printk(KERN_INFO, conn, "invalid burst lengths: "
3096 				  "first_burst %d max_burst %d\n",
3097 				  session->first_burst, session->max_burst);
3098 		return -EINVAL;
3099 	}
3100 
3101 	if (conn->ping_timeout && !conn->recv_timeout) {
3102 		iscsi_conn_printk(KERN_ERR, conn, "invalid recv timeout of "
3103 				  "zero. Using 5 seconds\n.");
3104 		conn->recv_timeout = 5;
3105 	}
3106 
3107 	if (conn->recv_timeout && !conn->ping_timeout) {
3108 		iscsi_conn_printk(KERN_ERR, conn, "invalid ping timeout of "
3109 				  "zero. Using 5 seconds.\n");
3110 		conn->ping_timeout = 5;
3111 	}
3112 
3113 	spin_lock_bh(&session->frwd_lock);
3114 	conn->c_stage = ISCSI_CONN_STARTED;
3115 	session->state = ISCSI_STATE_LOGGED_IN;
3116 	session->queued_cmdsn = session->cmdsn;
3117 
3118 	conn->last_recv = jiffies;
3119 	conn->last_ping = jiffies;
3120 	if (conn->recv_timeout && conn->ping_timeout)
3121 		mod_timer(&conn->transport_timer,
3122 			  jiffies + (conn->recv_timeout * HZ));
3123 
3124 	switch(conn->stop_stage) {
3125 	case STOP_CONN_RECOVER:
3126 		/*
3127 		 * unblock eh_abort() if it is blocked. re-try all
3128 		 * commands after successful recovery
3129 		 */
3130 		conn->stop_stage = 0;
3131 		conn->tmf_state = TMF_INITIAL;
3132 		session->age++;
3133 		if (session->age == 16)
3134 			session->age = 0;
3135 		break;
3136 	case STOP_CONN_TERM:
3137 		conn->stop_stage = 0;
3138 		break;
3139 	default:
3140 		break;
3141 	}
3142 	spin_unlock_bh(&session->frwd_lock);
3143 
3144 	iscsi_unblock_session(session->cls_session);
3145 	wake_up(&conn->ehwait);
3146 	return 0;
3147 }
3148 EXPORT_SYMBOL_GPL(iscsi_conn_start);
3149 
3150 static void
3151 fail_mgmt_tasks(struct iscsi_session *session, struct iscsi_conn *conn)
3152 {
3153 	struct iscsi_task *task;
3154 	int i, state;
3155 
3156 	for (i = 0; i < conn->session->cmds_max; i++) {
3157 		task = conn->session->cmds[i];
3158 		if (task->sc)
3159 			continue;
3160 
3161 		if (task->state == ISCSI_TASK_FREE)
3162 			continue;
3163 
3164 		ISCSI_DBG_SESSION(conn->session,
3165 				  "failing mgmt itt 0x%x state %d\n",
3166 				  task->itt, task->state);
3167 
3168 		spin_lock_bh(&session->back_lock);
3169 		if (cleanup_queued_task(task)) {
3170 			spin_unlock_bh(&session->back_lock);
3171 			continue;
3172 		}
3173 
3174 		state = ISCSI_TASK_ABRT_SESS_RECOV;
3175 		if (task->state == ISCSI_TASK_PENDING)
3176 			state = ISCSI_TASK_COMPLETED;
3177 		iscsi_complete_task(task, state);
3178 		spin_unlock_bh(&session->back_lock);
3179 	}
3180 }
3181 
3182 static void iscsi_start_session_recovery(struct iscsi_session *session,
3183 					 struct iscsi_conn *conn, int flag)
3184 {
3185 	int old_stop_stage;
3186 
3187 	mutex_lock(&session->eh_mutex);
3188 	spin_lock_bh(&session->frwd_lock);
3189 	if (conn->stop_stage == STOP_CONN_TERM) {
3190 		spin_unlock_bh(&session->frwd_lock);
3191 		mutex_unlock(&session->eh_mutex);
3192 		return;
3193 	}
3194 
3195 	/*
3196 	 * When this is called for the in_login state, we only want to clean
3197 	 * up the login task and connection. We do not need to block and set
3198 	 * the recovery state again
3199 	 */
3200 	if (flag == STOP_CONN_TERM)
3201 		session->state = ISCSI_STATE_TERMINATE;
3202 	else if (conn->stop_stage != STOP_CONN_RECOVER)
3203 		session->state = ISCSI_STATE_IN_RECOVERY;
3204 
3205 	old_stop_stage = conn->stop_stage;
3206 	conn->stop_stage = flag;
3207 	spin_unlock_bh(&session->frwd_lock);
3208 
3209 	del_timer_sync(&conn->transport_timer);
3210 	iscsi_suspend_tx(conn);
3211 
3212 	spin_lock_bh(&session->frwd_lock);
3213 	conn->c_stage = ISCSI_CONN_STOPPED;
3214 	spin_unlock_bh(&session->frwd_lock);
3215 
3216 	/*
3217 	 * for connection level recovery we should not calculate
3218 	 * header digest. conn->hdr_size used for optimization
3219 	 * in hdr_extract() and will be re-negotiated at
3220 	 * set_param() time.
3221 	 */
3222 	if (flag == STOP_CONN_RECOVER) {
3223 		conn->hdrdgst_en = 0;
3224 		conn->datadgst_en = 0;
3225 		if (session->state == ISCSI_STATE_IN_RECOVERY &&
3226 		    old_stop_stage != STOP_CONN_RECOVER) {
3227 			ISCSI_DBG_SESSION(session, "blocking session\n");
3228 			iscsi_block_session(session->cls_session);
3229 		}
3230 	}
3231 
3232 	/*
3233 	 * flush queues.
3234 	 */
3235 	spin_lock_bh(&session->frwd_lock);
3236 	fail_scsi_tasks(conn, -1, DID_TRANSPORT_DISRUPTED);
3237 	fail_mgmt_tasks(session, conn);
3238 	memset(&conn->tmhdr, 0, sizeof(conn->tmhdr));
3239 	spin_unlock_bh(&session->frwd_lock);
3240 	mutex_unlock(&session->eh_mutex);
3241 }
3242 
3243 void iscsi_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
3244 {
3245 	struct iscsi_conn *conn = cls_conn->dd_data;
3246 	struct iscsi_session *session = conn->session;
3247 
3248 	switch (flag) {
3249 	case STOP_CONN_RECOVER:
3250 		cls_conn->state = ISCSI_CONN_FAILED;
3251 		break;
3252 	case STOP_CONN_TERM:
3253 		cls_conn->state = ISCSI_CONN_DOWN;
3254 		break;
3255 	default:
3256 		iscsi_conn_printk(KERN_ERR, conn,
3257 				  "invalid stop flag %d\n", flag);
3258 		return;
3259 	}
3260 
3261 	iscsi_start_session_recovery(session, conn, flag);
3262 }
3263 EXPORT_SYMBOL_GPL(iscsi_conn_stop);
3264 
3265 int iscsi_conn_bind(struct iscsi_cls_session *cls_session,
3266 		    struct iscsi_cls_conn *cls_conn, int is_leading)
3267 {
3268 	struct iscsi_session *session = cls_session->dd_data;
3269 	struct iscsi_conn *conn = cls_conn->dd_data;
3270 
3271 	spin_lock_bh(&session->frwd_lock);
3272 	if (is_leading)
3273 		session->leadconn = conn;
3274 	spin_unlock_bh(&session->frwd_lock);
3275 
3276 	/*
3277 	 * The target could have reduced it's window size between logins, so
3278 	 * we have to reset max/exp cmdsn so we can see the new values.
3279 	 */
3280 	spin_lock_bh(&session->back_lock);
3281 	session->max_cmdsn = session->exp_cmdsn = session->cmdsn + 1;
3282 	spin_unlock_bh(&session->back_lock);
3283 	/*
3284 	 * Unblock xmitworker(), Login Phase will pass through.
3285 	 */
3286 	clear_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
3287 	clear_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
3288 	return 0;
3289 }
3290 EXPORT_SYMBOL_GPL(iscsi_conn_bind);
3291 
3292 int iscsi_switch_str_param(char **param, char *new_val_buf)
3293 {
3294 	char *new_val;
3295 
3296 	if (*param) {
3297 		if (!strcmp(*param, new_val_buf))
3298 			return 0;
3299 	}
3300 
3301 	new_val = kstrdup(new_val_buf, GFP_NOIO);
3302 	if (!new_val)
3303 		return -ENOMEM;
3304 
3305 	kfree(*param);
3306 	*param = new_val;
3307 	return 0;
3308 }
3309 EXPORT_SYMBOL_GPL(iscsi_switch_str_param);
3310 
3311 int iscsi_set_param(struct iscsi_cls_conn *cls_conn,
3312 		    enum iscsi_param param, char *buf, int buflen)
3313 {
3314 	struct iscsi_conn *conn = cls_conn->dd_data;
3315 	struct iscsi_session *session = conn->session;
3316 	int val;
3317 
3318 	switch(param) {
3319 	case ISCSI_PARAM_FAST_ABORT:
3320 		sscanf(buf, "%d", &session->fast_abort);
3321 		break;
3322 	case ISCSI_PARAM_ABORT_TMO:
3323 		sscanf(buf, "%d", &session->abort_timeout);
3324 		break;
3325 	case ISCSI_PARAM_LU_RESET_TMO:
3326 		sscanf(buf, "%d", &session->lu_reset_timeout);
3327 		break;
3328 	case ISCSI_PARAM_TGT_RESET_TMO:
3329 		sscanf(buf, "%d", &session->tgt_reset_timeout);
3330 		break;
3331 	case ISCSI_PARAM_PING_TMO:
3332 		sscanf(buf, "%d", &conn->ping_timeout);
3333 		break;
3334 	case ISCSI_PARAM_RECV_TMO:
3335 		sscanf(buf, "%d", &conn->recv_timeout);
3336 		break;
3337 	case ISCSI_PARAM_MAX_RECV_DLENGTH:
3338 		sscanf(buf, "%d", &conn->max_recv_dlength);
3339 		break;
3340 	case ISCSI_PARAM_MAX_XMIT_DLENGTH:
3341 		sscanf(buf, "%d", &conn->max_xmit_dlength);
3342 		break;
3343 	case ISCSI_PARAM_HDRDGST_EN:
3344 		sscanf(buf, "%d", &conn->hdrdgst_en);
3345 		break;
3346 	case ISCSI_PARAM_DATADGST_EN:
3347 		sscanf(buf, "%d", &conn->datadgst_en);
3348 		break;
3349 	case ISCSI_PARAM_INITIAL_R2T_EN:
3350 		sscanf(buf, "%d", &session->initial_r2t_en);
3351 		break;
3352 	case ISCSI_PARAM_MAX_R2T:
3353 		sscanf(buf, "%hu", &session->max_r2t);
3354 		break;
3355 	case ISCSI_PARAM_IMM_DATA_EN:
3356 		sscanf(buf, "%d", &session->imm_data_en);
3357 		break;
3358 	case ISCSI_PARAM_FIRST_BURST:
3359 		sscanf(buf, "%d", &session->first_burst);
3360 		break;
3361 	case ISCSI_PARAM_MAX_BURST:
3362 		sscanf(buf, "%d", &session->max_burst);
3363 		break;
3364 	case ISCSI_PARAM_PDU_INORDER_EN:
3365 		sscanf(buf, "%d", &session->pdu_inorder_en);
3366 		break;
3367 	case ISCSI_PARAM_DATASEQ_INORDER_EN:
3368 		sscanf(buf, "%d", &session->dataseq_inorder_en);
3369 		break;
3370 	case ISCSI_PARAM_ERL:
3371 		sscanf(buf, "%d", &session->erl);
3372 		break;
3373 	case ISCSI_PARAM_EXP_STATSN:
3374 		sscanf(buf, "%u", &conn->exp_statsn);
3375 		break;
3376 	case ISCSI_PARAM_USERNAME:
3377 		return iscsi_switch_str_param(&session->username, buf);
3378 	case ISCSI_PARAM_USERNAME_IN:
3379 		return iscsi_switch_str_param(&session->username_in, buf);
3380 	case ISCSI_PARAM_PASSWORD:
3381 		return iscsi_switch_str_param(&session->password, buf);
3382 	case ISCSI_PARAM_PASSWORD_IN:
3383 		return iscsi_switch_str_param(&session->password_in, buf);
3384 	case ISCSI_PARAM_TARGET_NAME:
3385 		return iscsi_switch_str_param(&session->targetname, buf);
3386 	case ISCSI_PARAM_TARGET_ALIAS:
3387 		return iscsi_switch_str_param(&session->targetalias, buf);
3388 	case ISCSI_PARAM_TPGT:
3389 		sscanf(buf, "%d", &session->tpgt);
3390 		break;
3391 	case ISCSI_PARAM_PERSISTENT_PORT:
3392 		sscanf(buf, "%d", &conn->persistent_port);
3393 		break;
3394 	case ISCSI_PARAM_PERSISTENT_ADDRESS:
3395 		return iscsi_switch_str_param(&conn->persistent_address, buf);
3396 	case ISCSI_PARAM_IFACE_NAME:
3397 		return iscsi_switch_str_param(&session->ifacename, buf);
3398 	case ISCSI_PARAM_INITIATOR_NAME:
3399 		return iscsi_switch_str_param(&session->initiatorname, buf);
3400 	case ISCSI_PARAM_BOOT_ROOT:
3401 		return iscsi_switch_str_param(&session->boot_root, buf);
3402 	case ISCSI_PARAM_BOOT_NIC:
3403 		return iscsi_switch_str_param(&session->boot_nic, buf);
3404 	case ISCSI_PARAM_BOOT_TARGET:
3405 		return iscsi_switch_str_param(&session->boot_target, buf);
3406 	case ISCSI_PARAM_PORTAL_TYPE:
3407 		return iscsi_switch_str_param(&session->portal_type, buf);
3408 	case ISCSI_PARAM_DISCOVERY_PARENT_TYPE:
3409 		return iscsi_switch_str_param(&session->discovery_parent_type,
3410 					      buf);
3411 	case ISCSI_PARAM_DISCOVERY_SESS:
3412 		sscanf(buf, "%d", &val);
3413 		session->discovery_sess = !!val;
3414 		break;
3415 	case ISCSI_PARAM_LOCAL_IPADDR:
3416 		return iscsi_switch_str_param(&conn->local_ipaddr, buf);
3417 	default:
3418 		return -ENOSYS;
3419 	}
3420 
3421 	return 0;
3422 }
3423 EXPORT_SYMBOL_GPL(iscsi_set_param);
3424 
3425 int iscsi_session_get_param(struct iscsi_cls_session *cls_session,
3426 			    enum iscsi_param param, char *buf)
3427 {
3428 	struct iscsi_session *session = cls_session->dd_data;
3429 	int len;
3430 
3431 	switch(param) {
3432 	case ISCSI_PARAM_FAST_ABORT:
3433 		len = sysfs_emit(buf, "%d\n", session->fast_abort);
3434 		break;
3435 	case ISCSI_PARAM_ABORT_TMO:
3436 		len = sysfs_emit(buf, "%d\n", session->abort_timeout);
3437 		break;
3438 	case ISCSI_PARAM_LU_RESET_TMO:
3439 		len = sysfs_emit(buf, "%d\n", session->lu_reset_timeout);
3440 		break;
3441 	case ISCSI_PARAM_TGT_RESET_TMO:
3442 		len = sysfs_emit(buf, "%d\n", session->tgt_reset_timeout);
3443 		break;
3444 	case ISCSI_PARAM_INITIAL_R2T_EN:
3445 		len = sysfs_emit(buf, "%d\n", session->initial_r2t_en);
3446 		break;
3447 	case ISCSI_PARAM_MAX_R2T:
3448 		len = sysfs_emit(buf, "%hu\n", session->max_r2t);
3449 		break;
3450 	case ISCSI_PARAM_IMM_DATA_EN:
3451 		len = sysfs_emit(buf, "%d\n", session->imm_data_en);
3452 		break;
3453 	case ISCSI_PARAM_FIRST_BURST:
3454 		len = sysfs_emit(buf, "%u\n", session->first_burst);
3455 		break;
3456 	case ISCSI_PARAM_MAX_BURST:
3457 		len = sysfs_emit(buf, "%u\n", session->max_burst);
3458 		break;
3459 	case ISCSI_PARAM_PDU_INORDER_EN:
3460 		len = sysfs_emit(buf, "%d\n", session->pdu_inorder_en);
3461 		break;
3462 	case ISCSI_PARAM_DATASEQ_INORDER_EN:
3463 		len = sysfs_emit(buf, "%d\n", session->dataseq_inorder_en);
3464 		break;
3465 	case ISCSI_PARAM_DEF_TASKMGMT_TMO:
3466 		len = sysfs_emit(buf, "%d\n", session->def_taskmgmt_tmo);
3467 		break;
3468 	case ISCSI_PARAM_ERL:
3469 		len = sysfs_emit(buf, "%d\n", session->erl);
3470 		break;
3471 	case ISCSI_PARAM_TARGET_NAME:
3472 		len = sysfs_emit(buf, "%s\n", session->targetname);
3473 		break;
3474 	case ISCSI_PARAM_TARGET_ALIAS:
3475 		len = sysfs_emit(buf, "%s\n", session->targetalias);
3476 		break;
3477 	case ISCSI_PARAM_TPGT:
3478 		len = sysfs_emit(buf, "%d\n", session->tpgt);
3479 		break;
3480 	case ISCSI_PARAM_USERNAME:
3481 		len = sysfs_emit(buf, "%s\n", session->username);
3482 		break;
3483 	case ISCSI_PARAM_USERNAME_IN:
3484 		len = sysfs_emit(buf, "%s\n", session->username_in);
3485 		break;
3486 	case ISCSI_PARAM_PASSWORD:
3487 		len = sysfs_emit(buf, "%s\n", session->password);
3488 		break;
3489 	case ISCSI_PARAM_PASSWORD_IN:
3490 		len = sysfs_emit(buf, "%s\n", session->password_in);
3491 		break;
3492 	case ISCSI_PARAM_IFACE_NAME:
3493 		len = sysfs_emit(buf, "%s\n", session->ifacename);
3494 		break;
3495 	case ISCSI_PARAM_INITIATOR_NAME:
3496 		len = sysfs_emit(buf, "%s\n", session->initiatorname);
3497 		break;
3498 	case ISCSI_PARAM_BOOT_ROOT:
3499 		len = sysfs_emit(buf, "%s\n", session->boot_root);
3500 		break;
3501 	case ISCSI_PARAM_BOOT_NIC:
3502 		len = sysfs_emit(buf, "%s\n", session->boot_nic);
3503 		break;
3504 	case ISCSI_PARAM_BOOT_TARGET:
3505 		len = sysfs_emit(buf, "%s\n", session->boot_target);
3506 		break;
3507 	case ISCSI_PARAM_AUTO_SND_TGT_DISABLE:
3508 		len = sysfs_emit(buf, "%u\n", session->auto_snd_tgt_disable);
3509 		break;
3510 	case ISCSI_PARAM_DISCOVERY_SESS:
3511 		len = sysfs_emit(buf, "%u\n", session->discovery_sess);
3512 		break;
3513 	case ISCSI_PARAM_PORTAL_TYPE:
3514 		len = sysfs_emit(buf, "%s\n", session->portal_type);
3515 		break;
3516 	case ISCSI_PARAM_CHAP_AUTH_EN:
3517 		len = sysfs_emit(buf, "%u\n", session->chap_auth_en);
3518 		break;
3519 	case ISCSI_PARAM_DISCOVERY_LOGOUT_EN:
3520 		len = sysfs_emit(buf, "%u\n", session->discovery_logout_en);
3521 		break;
3522 	case ISCSI_PARAM_BIDI_CHAP_EN:
3523 		len = sysfs_emit(buf, "%u\n", session->bidi_chap_en);
3524 		break;
3525 	case ISCSI_PARAM_DISCOVERY_AUTH_OPTIONAL:
3526 		len = sysfs_emit(buf, "%u\n", session->discovery_auth_optional);
3527 		break;
3528 	case ISCSI_PARAM_DEF_TIME2WAIT:
3529 		len = sysfs_emit(buf, "%d\n", session->time2wait);
3530 		break;
3531 	case ISCSI_PARAM_DEF_TIME2RETAIN:
3532 		len = sysfs_emit(buf, "%d\n", session->time2retain);
3533 		break;
3534 	case ISCSI_PARAM_TSID:
3535 		len = sysfs_emit(buf, "%u\n", session->tsid);
3536 		break;
3537 	case ISCSI_PARAM_ISID:
3538 		len = sysfs_emit(buf, "%02x%02x%02x%02x%02x%02x\n",
3539 			      session->isid[0], session->isid[1],
3540 			      session->isid[2], session->isid[3],
3541 			      session->isid[4], session->isid[5]);
3542 		break;
3543 	case ISCSI_PARAM_DISCOVERY_PARENT_IDX:
3544 		len = sysfs_emit(buf, "%u\n", session->discovery_parent_idx);
3545 		break;
3546 	case ISCSI_PARAM_DISCOVERY_PARENT_TYPE:
3547 		if (session->discovery_parent_type)
3548 			len = sysfs_emit(buf, "%s\n",
3549 				      session->discovery_parent_type);
3550 		else
3551 			len = sysfs_emit(buf, "\n");
3552 		break;
3553 	default:
3554 		return -ENOSYS;
3555 	}
3556 
3557 	return len;
3558 }
3559 EXPORT_SYMBOL_GPL(iscsi_session_get_param);
3560 
3561 int iscsi_conn_get_addr_param(struct sockaddr_storage *addr,
3562 			      enum iscsi_param param, char *buf)
3563 {
3564 	struct sockaddr_in6 *sin6 = NULL;
3565 	struct sockaddr_in *sin = NULL;
3566 	int len;
3567 
3568 	switch (addr->ss_family) {
3569 	case AF_INET:
3570 		sin = (struct sockaddr_in *)addr;
3571 		break;
3572 	case AF_INET6:
3573 		sin6 = (struct sockaddr_in6 *)addr;
3574 		break;
3575 	default:
3576 		return -EINVAL;
3577 	}
3578 
3579 	switch (param) {
3580 	case ISCSI_PARAM_CONN_ADDRESS:
3581 	case ISCSI_HOST_PARAM_IPADDRESS:
3582 		if (sin)
3583 			len = sysfs_emit(buf, "%pI4\n", &sin->sin_addr.s_addr);
3584 		else
3585 			len = sysfs_emit(buf, "%pI6\n", &sin6->sin6_addr);
3586 		break;
3587 	case ISCSI_PARAM_CONN_PORT:
3588 	case ISCSI_PARAM_LOCAL_PORT:
3589 		if (sin)
3590 			len = sysfs_emit(buf, "%hu\n", be16_to_cpu(sin->sin_port));
3591 		else
3592 			len = sysfs_emit(buf, "%hu\n",
3593 				      be16_to_cpu(sin6->sin6_port));
3594 		break;
3595 	default:
3596 		return -EINVAL;
3597 	}
3598 
3599 	return len;
3600 }
3601 EXPORT_SYMBOL_GPL(iscsi_conn_get_addr_param);
3602 
3603 int iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,
3604 			 enum iscsi_param param, char *buf)
3605 {
3606 	struct iscsi_conn *conn = cls_conn->dd_data;
3607 	int len;
3608 
3609 	switch(param) {
3610 	case ISCSI_PARAM_PING_TMO:
3611 		len = sysfs_emit(buf, "%u\n", conn->ping_timeout);
3612 		break;
3613 	case ISCSI_PARAM_RECV_TMO:
3614 		len = sysfs_emit(buf, "%u\n", conn->recv_timeout);
3615 		break;
3616 	case ISCSI_PARAM_MAX_RECV_DLENGTH:
3617 		len = sysfs_emit(buf, "%u\n", conn->max_recv_dlength);
3618 		break;
3619 	case ISCSI_PARAM_MAX_XMIT_DLENGTH:
3620 		len = sysfs_emit(buf, "%u\n", conn->max_xmit_dlength);
3621 		break;
3622 	case ISCSI_PARAM_HDRDGST_EN:
3623 		len = sysfs_emit(buf, "%d\n", conn->hdrdgst_en);
3624 		break;
3625 	case ISCSI_PARAM_DATADGST_EN:
3626 		len = sysfs_emit(buf, "%d\n", conn->datadgst_en);
3627 		break;
3628 	case ISCSI_PARAM_IFMARKER_EN:
3629 		len = sysfs_emit(buf, "%d\n", conn->ifmarker_en);
3630 		break;
3631 	case ISCSI_PARAM_OFMARKER_EN:
3632 		len = sysfs_emit(buf, "%d\n", conn->ofmarker_en);
3633 		break;
3634 	case ISCSI_PARAM_EXP_STATSN:
3635 		len = sysfs_emit(buf, "%u\n", conn->exp_statsn);
3636 		break;
3637 	case ISCSI_PARAM_PERSISTENT_PORT:
3638 		len = sysfs_emit(buf, "%d\n", conn->persistent_port);
3639 		break;
3640 	case ISCSI_PARAM_PERSISTENT_ADDRESS:
3641 		len = sysfs_emit(buf, "%s\n", conn->persistent_address);
3642 		break;
3643 	case ISCSI_PARAM_STATSN:
3644 		len = sysfs_emit(buf, "%u\n", conn->statsn);
3645 		break;
3646 	case ISCSI_PARAM_MAX_SEGMENT_SIZE:
3647 		len = sysfs_emit(buf, "%u\n", conn->max_segment_size);
3648 		break;
3649 	case ISCSI_PARAM_KEEPALIVE_TMO:
3650 		len = sysfs_emit(buf, "%u\n", conn->keepalive_tmo);
3651 		break;
3652 	case ISCSI_PARAM_LOCAL_PORT:
3653 		len = sysfs_emit(buf, "%u\n", conn->local_port);
3654 		break;
3655 	case ISCSI_PARAM_TCP_TIMESTAMP_STAT:
3656 		len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_stat);
3657 		break;
3658 	case ISCSI_PARAM_TCP_NAGLE_DISABLE:
3659 		len = sysfs_emit(buf, "%u\n", conn->tcp_nagle_disable);
3660 		break;
3661 	case ISCSI_PARAM_TCP_WSF_DISABLE:
3662 		len = sysfs_emit(buf, "%u\n", conn->tcp_wsf_disable);
3663 		break;
3664 	case ISCSI_PARAM_TCP_TIMER_SCALE:
3665 		len = sysfs_emit(buf, "%u\n", conn->tcp_timer_scale);
3666 		break;
3667 	case ISCSI_PARAM_TCP_TIMESTAMP_EN:
3668 		len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_en);
3669 		break;
3670 	case ISCSI_PARAM_IP_FRAGMENT_DISABLE:
3671 		len = sysfs_emit(buf, "%u\n", conn->fragment_disable);
3672 		break;
3673 	case ISCSI_PARAM_IPV4_TOS:
3674 		len = sysfs_emit(buf, "%u\n", conn->ipv4_tos);
3675 		break;
3676 	case ISCSI_PARAM_IPV6_TC:
3677 		len = sysfs_emit(buf, "%u\n", conn->ipv6_traffic_class);
3678 		break;
3679 	case ISCSI_PARAM_IPV6_FLOW_LABEL:
3680 		len = sysfs_emit(buf, "%u\n", conn->ipv6_flow_label);
3681 		break;
3682 	case ISCSI_PARAM_IS_FW_ASSIGNED_IPV6:
3683 		len = sysfs_emit(buf, "%u\n", conn->is_fw_assigned_ipv6);
3684 		break;
3685 	case ISCSI_PARAM_TCP_XMIT_WSF:
3686 		len = sysfs_emit(buf, "%u\n", conn->tcp_xmit_wsf);
3687 		break;
3688 	case ISCSI_PARAM_TCP_RECV_WSF:
3689 		len = sysfs_emit(buf, "%u\n", conn->tcp_recv_wsf);
3690 		break;
3691 	case ISCSI_PARAM_LOCAL_IPADDR:
3692 		len = sysfs_emit(buf, "%s\n", conn->local_ipaddr);
3693 		break;
3694 	default:
3695 		return -ENOSYS;
3696 	}
3697 
3698 	return len;
3699 }
3700 EXPORT_SYMBOL_GPL(iscsi_conn_get_param);
3701 
3702 int iscsi_host_get_param(struct Scsi_Host *shost, enum iscsi_host_param param,
3703 			 char *buf)
3704 {
3705 	struct iscsi_host *ihost = shost_priv(shost);
3706 	int len;
3707 
3708 	switch (param) {
3709 	case ISCSI_HOST_PARAM_NETDEV_NAME:
3710 		len = sysfs_emit(buf, "%s\n", ihost->netdev);
3711 		break;
3712 	case ISCSI_HOST_PARAM_HWADDRESS:
3713 		len = sysfs_emit(buf, "%s\n", ihost->hwaddress);
3714 		break;
3715 	case ISCSI_HOST_PARAM_INITIATOR_NAME:
3716 		len = sysfs_emit(buf, "%s\n", ihost->initiatorname);
3717 		break;
3718 	default:
3719 		return -ENOSYS;
3720 	}
3721 
3722 	return len;
3723 }
3724 EXPORT_SYMBOL_GPL(iscsi_host_get_param);
3725 
3726 int iscsi_host_set_param(struct Scsi_Host *shost, enum iscsi_host_param param,
3727 			 char *buf, int buflen)
3728 {
3729 	struct iscsi_host *ihost = shost_priv(shost);
3730 
3731 	switch (param) {
3732 	case ISCSI_HOST_PARAM_NETDEV_NAME:
3733 		return iscsi_switch_str_param(&ihost->netdev, buf);
3734 	case ISCSI_HOST_PARAM_HWADDRESS:
3735 		return iscsi_switch_str_param(&ihost->hwaddress, buf);
3736 	case ISCSI_HOST_PARAM_INITIATOR_NAME:
3737 		return iscsi_switch_str_param(&ihost->initiatorname, buf);
3738 	default:
3739 		return -ENOSYS;
3740 	}
3741 
3742 	return 0;
3743 }
3744 EXPORT_SYMBOL_GPL(iscsi_host_set_param);
3745 
3746 MODULE_AUTHOR("Mike Christie");
3747 MODULE_DESCRIPTION("iSCSI library functions");
3748 MODULE_LICENSE("GPL");
3749