1 /*******************************************************************************
2  * This file contains main functions related to the iSCSI Target Core Driver.
3  *
4  * (c) Copyright 2007-2013 Datera, Inc.
5  *
6  * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  ******************************************************************************/
18 
19 #include <linux/string.h>
20 #include <linux/kthread.h>
21 #include <linux/crypto.h>
22 #include <linux/completion.h>
23 #include <linux/module.h>
24 #include <linux/idr.h>
25 #include <asm/unaligned.h>
26 #include <scsi/scsi_device.h>
27 #include <scsi/iscsi_proto.h>
28 #include <scsi/scsi_tcq.h>
29 #include <target/target_core_base.h>
30 #include <target/target_core_fabric.h>
31 #include <target/target_core_configfs.h>
32 
33 #include "iscsi_target_core.h"
34 #include "iscsi_target_parameters.h"
35 #include "iscsi_target_seq_pdu_list.h"
36 #include "iscsi_target_tq.h"
37 #include "iscsi_target_configfs.h"
38 #include "iscsi_target_datain_values.h"
39 #include "iscsi_target_erl0.h"
40 #include "iscsi_target_erl1.h"
41 #include "iscsi_target_erl2.h"
42 #include "iscsi_target_login.h"
43 #include "iscsi_target_tmr.h"
44 #include "iscsi_target_tpg.h"
45 #include "iscsi_target_util.h"
46 #include "iscsi_target.h"
47 #include "iscsi_target_device.h"
48 #include "iscsi_target_stat.h"
49 
50 #include <target/iscsi/iscsi_transport.h>
51 
52 static LIST_HEAD(g_tiqn_list);
53 static LIST_HEAD(g_np_list);
54 static DEFINE_SPINLOCK(tiqn_lock);
55 static DEFINE_MUTEX(np_lock);
56 
57 static struct idr tiqn_idr;
58 struct idr sess_idr;
59 struct mutex auth_id_lock;
60 spinlock_t sess_idr_lock;
61 
62 struct iscsit_global *iscsit_global;
63 
64 struct kmem_cache *lio_qr_cache;
65 struct kmem_cache *lio_dr_cache;
66 struct kmem_cache *lio_ooo_cache;
67 struct kmem_cache *lio_r2t_cache;
68 
69 static int iscsit_handle_immediate_data(struct iscsi_cmd *,
70 			struct iscsi_scsi_req *, u32);
71 
72 struct iscsi_tiqn *iscsit_get_tiqn_for_login(unsigned char *buf)
73 {
74 	struct iscsi_tiqn *tiqn = NULL;
75 
76 	spin_lock(&tiqn_lock);
77 	list_for_each_entry(tiqn, &g_tiqn_list, tiqn_list) {
78 		if (!strcmp(tiqn->tiqn, buf)) {
79 
80 			spin_lock(&tiqn->tiqn_state_lock);
81 			if (tiqn->tiqn_state == TIQN_STATE_ACTIVE) {
82 				tiqn->tiqn_access_count++;
83 				spin_unlock(&tiqn->tiqn_state_lock);
84 				spin_unlock(&tiqn_lock);
85 				return tiqn;
86 			}
87 			spin_unlock(&tiqn->tiqn_state_lock);
88 		}
89 	}
90 	spin_unlock(&tiqn_lock);
91 
92 	return NULL;
93 }
94 
95 static int iscsit_set_tiqn_shutdown(struct iscsi_tiqn *tiqn)
96 {
97 	spin_lock(&tiqn->tiqn_state_lock);
98 	if (tiqn->tiqn_state == TIQN_STATE_ACTIVE) {
99 		tiqn->tiqn_state = TIQN_STATE_SHUTDOWN;
100 		spin_unlock(&tiqn->tiqn_state_lock);
101 		return 0;
102 	}
103 	spin_unlock(&tiqn->tiqn_state_lock);
104 
105 	return -1;
106 }
107 
108 void iscsit_put_tiqn_for_login(struct iscsi_tiqn *tiqn)
109 {
110 	spin_lock(&tiqn->tiqn_state_lock);
111 	tiqn->tiqn_access_count--;
112 	spin_unlock(&tiqn->tiqn_state_lock);
113 }
114 
115 /*
116  * Note that IQN formatting is expected to be done in userspace, and
117  * no explict IQN format checks are done here.
118  */
119 struct iscsi_tiqn *iscsit_add_tiqn(unsigned char *buf)
120 {
121 	struct iscsi_tiqn *tiqn = NULL;
122 	int ret;
123 
124 	if (strlen(buf) >= ISCSI_IQN_LEN) {
125 		pr_err("Target IQN exceeds %d bytes\n",
126 				ISCSI_IQN_LEN);
127 		return ERR_PTR(-EINVAL);
128 	}
129 
130 	tiqn = kzalloc(sizeof(struct iscsi_tiqn), GFP_KERNEL);
131 	if (!tiqn) {
132 		pr_err("Unable to allocate struct iscsi_tiqn\n");
133 		return ERR_PTR(-ENOMEM);
134 	}
135 
136 	sprintf(tiqn->tiqn, "%s", buf);
137 	INIT_LIST_HEAD(&tiqn->tiqn_list);
138 	INIT_LIST_HEAD(&tiqn->tiqn_tpg_list);
139 	spin_lock_init(&tiqn->tiqn_state_lock);
140 	spin_lock_init(&tiqn->tiqn_tpg_lock);
141 	spin_lock_init(&tiqn->sess_err_stats.lock);
142 	spin_lock_init(&tiqn->login_stats.lock);
143 	spin_lock_init(&tiqn->logout_stats.lock);
144 
145 	tiqn->tiqn_state = TIQN_STATE_ACTIVE;
146 
147 	idr_preload(GFP_KERNEL);
148 	spin_lock(&tiqn_lock);
149 
150 	ret = idr_alloc(&tiqn_idr, NULL, 0, 0, GFP_NOWAIT);
151 	if (ret < 0) {
152 		pr_err("idr_alloc() failed for tiqn->tiqn_index\n");
153 		spin_unlock(&tiqn_lock);
154 		idr_preload_end();
155 		kfree(tiqn);
156 		return ERR_PTR(ret);
157 	}
158 	tiqn->tiqn_index = ret;
159 	list_add_tail(&tiqn->tiqn_list, &g_tiqn_list);
160 
161 	spin_unlock(&tiqn_lock);
162 	idr_preload_end();
163 
164 	pr_debug("CORE[0] - Added iSCSI Target IQN: %s\n", tiqn->tiqn);
165 
166 	return tiqn;
167 
168 }
169 
170 static void iscsit_wait_for_tiqn(struct iscsi_tiqn *tiqn)
171 {
172 	/*
173 	 * Wait for accesses to said struct iscsi_tiqn to end.
174 	 */
175 	spin_lock(&tiqn->tiqn_state_lock);
176 	while (tiqn->tiqn_access_count != 0) {
177 		spin_unlock(&tiqn->tiqn_state_lock);
178 		msleep(10);
179 		spin_lock(&tiqn->tiqn_state_lock);
180 	}
181 	spin_unlock(&tiqn->tiqn_state_lock);
182 }
183 
184 void iscsit_del_tiqn(struct iscsi_tiqn *tiqn)
185 {
186 	/*
187 	 * iscsit_set_tiqn_shutdown sets tiqn->tiqn_state = TIQN_STATE_SHUTDOWN
188 	 * while holding tiqn->tiqn_state_lock.  This means that all subsequent
189 	 * attempts to access this struct iscsi_tiqn will fail from both transport
190 	 * fabric and control code paths.
191 	 */
192 	if (iscsit_set_tiqn_shutdown(tiqn) < 0) {
193 		pr_err("iscsit_set_tiqn_shutdown() failed\n");
194 		return;
195 	}
196 
197 	iscsit_wait_for_tiqn(tiqn);
198 
199 	spin_lock(&tiqn_lock);
200 	list_del(&tiqn->tiqn_list);
201 	idr_remove(&tiqn_idr, tiqn->tiqn_index);
202 	spin_unlock(&tiqn_lock);
203 
204 	pr_debug("CORE[0] - Deleted iSCSI Target IQN: %s\n",
205 			tiqn->tiqn);
206 	kfree(tiqn);
207 }
208 
209 int iscsit_access_np(struct iscsi_np *np, struct iscsi_portal_group *tpg)
210 {
211 	int ret;
212 	/*
213 	 * Determine if the network portal is accepting storage traffic.
214 	 */
215 	spin_lock_bh(&np->np_thread_lock);
216 	if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
217 		spin_unlock_bh(&np->np_thread_lock);
218 		return -1;
219 	}
220 	spin_unlock_bh(&np->np_thread_lock);
221 	/*
222 	 * Determine if the portal group is accepting storage traffic.
223 	 */
224 	spin_lock_bh(&tpg->tpg_state_lock);
225 	if (tpg->tpg_state != TPG_STATE_ACTIVE) {
226 		spin_unlock_bh(&tpg->tpg_state_lock);
227 		return -1;
228 	}
229 	spin_unlock_bh(&tpg->tpg_state_lock);
230 
231 	/*
232 	 * Here we serialize access across the TIQN+TPG Tuple.
233 	 */
234 	ret = down_interruptible(&tpg->np_login_sem);
235 	if ((ret != 0) || signal_pending(current))
236 		return -1;
237 
238 	spin_lock_bh(&tpg->tpg_state_lock);
239 	if (tpg->tpg_state != TPG_STATE_ACTIVE) {
240 		spin_unlock_bh(&tpg->tpg_state_lock);
241 		up(&tpg->np_login_sem);
242 		return -1;
243 	}
244 	spin_unlock_bh(&tpg->tpg_state_lock);
245 
246 	return 0;
247 }
248 
249 void iscsit_login_kref_put(struct kref *kref)
250 {
251 	struct iscsi_tpg_np *tpg_np = container_of(kref,
252 				struct iscsi_tpg_np, tpg_np_kref);
253 
254 	complete(&tpg_np->tpg_np_comp);
255 }
256 
257 int iscsit_deaccess_np(struct iscsi_np *np, struct iscsi_portal_group *tpg,
258 		       struct iscsi_tpg_np *tpg_np)
259 {
260 	struct iscsi_tiqn *tiqn = tpg->tpg_tiqn;
261 
262 	up(&tpg->np_login_sem);
263 
264 	if (tpg_np)
265 		kref_put(&tpg_np->tpg_np_kref, iscsit_login_kref_put);
266 
267 	if (tiqn)
268 		iscsit_put_tiqn_for_login(tiqn);
269 
270 	return 0;
271 }
272 
273 bool iscsit_check_np_match(
274 	struct __kernel_sockaddr_storage *sockaddr,
275 	struct iscsi_np *np,
276 	int network_transport)
277 {
278 	struct sockaddr_in *sock_in, *sock_in_e;
279 	struct sockaddr_in6 *sock_in6, *sock_in6_e;
280 	bool ip_match = false;
281 	u16 port;
282 
283 	if (sockaddr->ss_family == AF_INET6) {
284 		sock_in6 = (struct sockaddr_in6 *)sockaddr;
285 		sock_in6_e = (struct sockaddr_in6 *)&np->np_sockaddr;
286 
287 		if (!memcmp(&sock_in6->sin6_addr.in6_u,
288 			    &sock_in6_e->sin6_addr.in6_u,
289 			    sizeof(struct in6_addr)))
290 			ip_match = true;
291 
292 		port = ntohs(sock_in6->sin6_port);
293 	} else {
294 		sock_in = (struct sockaddr_in *)sockaddr;
295 		sock_in_e = (struct sockaddr_in *)&np->np_sockaddr;
296 
297 		if (sock_in->sin_addr.s_addr == sock_in_e->sin_addr.s_addr)
298 			ip_match = true;
299 
300 		port = ntohs(sock_in->sin_port);
301 	}
302 
303 	if ((ip_match == true) && (np->np_port == port) &&
304 	    (np->np_network_transport == network_transport))
305 		return true;
306 
307 	return false;
308 }
309 
310 /*
311  * Called with mutex np_lock held
312  */
313 static struct iscsi_np *iscsit_get_np(
314 	struct __kernel_sockaddr_storage *sockaddr,
315 	int network_transport)
316 {
317 	struct iscsi_np *np;
318 	bool match;
319 
320 	list_for_each_entry(np, &g_np_list, np_list) {
321 		spin_lock_bh(&np->np_thread_lock);
322 		if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
323 			spin_unlock_bh(&np->np_thread_lock);
324 			continue;
325 		}
326 
327 		match = iscsit_check_np_match(sockaddr, np, network_transport);
328 		if (match == true) {
329 			/*
330 			 * Increment the np_exports reference count now to
331 			 * prevent iscsit_del_np() below from being called
332 			 * while iscsi_tpg_add_network_portal() is called.
333 			 */
334 			np->np_exports++;
335 			spin_unlock_bh(&np->np_thread_lock);
336 			return np;
337 		}
338 		spin_unlock_bh(&np->np_thread_lock);
339 	}
340 
341 	return NULL;
342 }
343 
344 struct iscsi_np *iscsit_add_np(
345 	struct __kernel_sockaddr_storage *sockaddr,
346 	char *ip_str,
347 	int network_transport)
348 {
349 	struct sockaddr_in *sock_in;
350 	struct sockaddr_in6 *sock_in6;
351 	struct iscsi_np *np;
352 	int ret;
353 
354 	mutex_lock(&np_lock);
355 
356 	/*
357 	 * Locate the existing struct iscsi_np if already active..
358 	 */
359 	np = iscsit_get_np(sockaddr, network_transport);
360 	if (np) {
361 		mutex_unlock(&np_lock);
362 		return np;
363 	}
364 
365 	np = kzalloc(sizeof(struct iscsi_np), GFP_KERNEL);
366 	if (!np) {
367 		pr_err("Unable to allocate memory for struct iscsi_np\n");
368 		mutex_unlock(&np_lock);
369 		return ERR_PTR(-ENOMEM);
370 	}
371 
372 	np->np_flags |= NPF_IP_NETWORK;
373 	if (sockaddr->ss_family == AF_INET6) {
374 		sock_in6 = (struct sockaddr_in6 *)sockaddr;
375 		snprintf(np->np_ip, IPV6_ADDRESS_SPACE, "%s", ip_str);
376 		np->np_port = ntohs(sock_in6->sin6_port);
377 	} else {
378 		sock_in = (struct sockaddr_in *)sockaddr;
379 		sprintf(np->np_ip, "%s", ip_str);
380 		np->np_port = ntohs(sock_in->sin_port);
381 	}
382 
383 	np->np_network_transport = network_transport;
384 	spin_lock_init(&np->np_thread_lock);
385 	init_completion(&np->np_restart_comp);
386 	INIT_LIST_HEAD(&np->np_list);
387 
388 	ret = iscsi_target_setup_login_socket(np, sockaddr);
389 	if (ret != 0) {
390 		kfree(np);
391 		mutex_unlock(&np_lock);
392 		return ERR_PTR(ret);
393 	}
394 
395 	np->np_thread = kthread_run(iscsi_target_login_thread, np, "iscsi_np");
396 	if (IS_ERR(np->np_thread)) {
397 		pr_err("Unable to create kthread: iscsi_np\n");
398 		ret = PTR_ERR(np->np_thread);
399 		kfree(np);
400 		mutex_unlock(&np_lock);
401 		return ERR_PTR(ret);
402 	}
403 	/*
404 	 * Increment the np_exports reference count now to prevent
405 	 * iscsit_del_np() below from being run while a new call to
406 	 * iscsi_tpg_add_network_portal() for a matching iscsi_np is
407 	 * active.  We don't need to hold np->np_thread_lock at this
408 	 * point because iscsi_np has not been added to g_np_list yet.
409 	 */
410 	np->np_exports = 1;
411 	np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
412 
413 	list_add_tail(&np->np_list, &g_np_list);
414 	mutex_unlock(&np_lock);
415 
416 	pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n",
417 		np->np_ip, np->np_port, np->np_transport->name);
418 
419 	return np;
420 }
421 
422 int iscsit_reset_np_thread(
423 	struct iscsi_np *np,
424 	struct iscsi_tpg_np *tpg_np,
425 	struct iscsi_portal_group *tpg,
426 	bool shutdown)
427 {
428 	spin_lock_bh(&np->np_thread_lock);
429 	if (np->np_thread_state == ISCSI_NP_THREAD_INACTIVE) {
430 		spin_unlock_bh(&np->np_thread_lock);
431 		return 0;
432 	}
433 	np->np_thread_state = ISCSI_NP_THREAD_RESET;
434 
435 	if (np->np_thread) {
436 		spin_unlock_bh(&np->np_thread_lock);
437 		send_sig(SIGINT, np->np_thread, 1);
438 		wait_for_completion(&np->np_restart_comp);
439 		spin_lock_bh(&np->np_thread_lock);
440 	}
441 	spin_unlock_bh(&np->np_thread_lock);
442 
443 	if (tpg_np && shutdown) {
444 		kref_put(&tpg_np->tpg_np_kref, iscsit_login_kref_put);
445 
446 		wait_for_completion(&tpg_np->tpg_np_comp);
447 	}
448 
449 	return 0;
450 }
451 
452 static void iscsit_free_np(struct iscsi_np *np)
453 {
454 	if (np->np_socket)
455 		sock_release(np->np_socket);
456 }
457 
458 int iscsit_del_np(struct iscsi_np *np)
459 {
460 	spin_lock_bh(&np->np_thread_lock);
461 	np->np_exports--;
462 	if (np->np_exports) {
463 		spin_unlock_bh(&np->np_thread_lock);
464 		return 0;
465 	}
466 	np->np_thread_state = ISCSI_NP_THREAD_SHUTDOWN;
467 	spin_unlock_bh(&np->np_thread_lock);
468 
469 	if (np->np_thread) {
470 		/*
471 		 * We need to send the signal to wakeup Linux/Net
472 		 * which may be sleeping in sock_accept()..
473 		 */
474 		send_sig(SIGINT, np->np_thread, 1);
475 		kthread_stop(np->np_thread);
476 		np->np_thread = NULL;
477 	}
478 
479 	np->np_transport->iscsit_free_np(np);
480 
481 	mutex_lock(&np_lock);
482 	list_del(&np->np_list);
483 	mutex_unlock(&np_lock);
484 
485 	pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n",
486 		np->np_ip, np->np_port, np->np_transport->name);
487 
488 	iscsit_put_transport(np->np_transport);
489 	kfree(np);
490 	return 0;
491 }
492 
493 static int iscsit_immediate_queue(struct iscsi_conn *, struct iscsi_cmd *, int);
494 static int iscsit_response_queue(struct iscsi_conn *, struct iscsi_cmd *, int);
495 
496 static int iscsit_queue_rsp(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
497 {
498 	iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
499 	return 0;
500 }
501 
502 static void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
503 {
504 	bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD);
505 
506 	spin_lock_bh(&conn->cmd_lock);
507 	if (!list_empty(&cmd->i_conn_node))
508 		list_del_init(&cmd->i_conn_node);
509 	spin_unlock_bh(&conn->cmd_lock);
510 
511 	__iscsit_free_cmd(cmd, scsi_cmd, true);
512 }
513 
514 static enum target_prot_op iscsit_get_sup_prot_ops(struct iscsi_conn *conn)
515 {
516 	return TARGET_PROT_NORMAL;
517 }
518 
519 static struct iscsit_transport iscsi_target_transport = {
520 	.name			= "iSCSI/TCP",
521 	.transport_type		= ISCSI_TCP,
522 	.owner			= NULL,
523 	.iscsit_setup_np	= iscsit_setup_np,
524 	.iscsit_accept_np	= iscsit_accept_np,
525 	.iscsit_free_np		= iscsit_free_np,
526 	.iscsit_get_login_rx	= iscsit_get_login_rx,
527 	.iscsit_put_login_tx	= iscsit_put_login_tx,
528 	.iscsit_get_dataout	= iscsit_build_r2ts_for_cmd,
529 	.iscsit_immediate_queue	= iscsit_immediate_queue,
530 	.iscsit_response_queue	= iscsit_response_queue,
531 	.iscsit_queue_data_in	= iscsit_queue_rsp,
532 	.iscsit_queue_status	= iscsit_queue_rsp,
533 	.iscsit_aborted_task	= iscsit_aborted_task,
534 	.iscsit_get_sup_prot_ops = iscsit_get_sup_prot_ops,
535 };
536 
537 static int __init iscsi_target_init_module(void)
538 {
539 	int ret = 0;
540 
541 	pr_debug("iSCSI-Target "ISCSIT_VERSION"\n");
542 
543 	iscsit_global = kzalloc(sizeof(struct iscsit_global), GFP_KERNEL);
544 	if (!iscsit_global) {
545 		pr_err("Unable to allocate memory for iscsit_global\n");
546 		return -1;
547 	}
548 	mutex_init(&auth_id_lock);
549 	spin_lock_init(&sess_idr_lock);
550 	idr_init(&tiqn_idr);
551 	idr_init(&sess_idr);
552 
553 	ret = iscsi_target_register_configfs();
554 	if (ret < 0)
555 		goto out;
556 
557 	ret = iscsi_thread_set_init();
558 	if (ret < 0)
559 		goto configfs_out;
560 
561 	if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) !=
562 			TARGET_THREAD_SET_COUNT) {
563 		pr_err("iscsi_allocate_thread_sets() returned"
564 			" unexpected value!\n");
565 		goto ts_out1;
566 	}
567 
568 	lio_qr_cache = kmem_cache_create("lio_qr_cache",
569 			sizeof(struct iscsi_queue_req),
570 			__alignof__(struct iscsi_queue_req), 0, NULL);
571 	if (!lio_qr_cache) {
572 		pr_err("nable to kmem_cache_create() for"
573 				" lio_qr_cache\n");
574 		goto ts_out2;
575 	}
576 
577 	lio_dr_cache = kmem_cache_create("lio_dr_cache",
578 			sizeof(struct iscsi_datain_req),
579 			__alignof__(struct iscsi_datain_req), 0, NULL);
580 	if (!lio_dr_cache) {
581 		pr_err("Unable to kmem_cache_create() for"
582 				" lio_dr_cache\n");
583 		goto qr_out;
584 	}
585 
586 	lio_ooo_cache = kmem_cache_create("lio_ooo_cache",
587 			sizeof(struct iscsi_ooo_cmdsn),
588 			__alignof__(struct iscsi_ooo_cmdsn), 0, NULL);
589 	if (!lio_ooo_cache) {
590 		pr_err("Unable to kmem_cache_create() for"
591 				" lio_ooo_cache\n");
592 		goto dr_out;
593 	}
594 
595 	lio_r2t_cache = kmem_cache_create("lio_r2t_cache",
596 			sizeof(struct iscsi_r2t), __alignof__(struct iscsi_r2t),
597 			0, NULL);
598 	if (!lio_r2t_cache) {
599 		pr_err("Unable to kmem_cache_create() for"
600 				" lio_r2t_cache\n");
601 		goto ooo_out;
602 	}
603 
604 	iscsit_register_transport(&iscsi_target_transport);
605 
606 	if (iscsit_load_discovery_tpg() < 0)
607 		goto r2t_out;
608 
609 	return ret;
610 r2t_out:
611 	kmem_cache_destroy(lio_r2t_cache);
612 ooo_out:
613 	kmem_cache_destroy(lio_ooo_cache);
614 dr_out:
615 	kmem_cache_destroy(lio_dr_cache);
616 qr_out:
617 	kmem_cache_destroy(lio_qr_cache);
618 ts_out2:
619 	iscsi_deallocate_thread_sets();
620 ts_out1:
621 	iscsi_thread_set_free();
622 configfs_out:
623 	iscsi_target_deregister_configfs();
624 out:
625 	kfree(iscsit_global);
626 	return -ENOMEM;
627 }
628 
629 static void __exit iscsi_target_cleanup_module(void)
630 {
631 	iscsi_deallocate_thread_sets();
632 	iscsi_thread_set_free();
633 	iscsit_release_discovery_tpg();
634 	iscsit_unregister_transport(&iscsi_target_transport);
635 	kmem_cache_destroy(lio_qr_cache);
636 	kmem_cache_destroy(lio_dr_cache);
637 	kmem_cache_destroy(lio_ooo_cache);
638 	kmem_cache_destroy(lio_r2t_cache);
639 
640 	iscsi_target_deregister_configfs();
641 
642 	kfree(iscsit_global);
643 }
644 
645 static int iscsit_add_reject(
646 	struct iscsi_conn *conn,
647 	u8 reason,
648 	unsigned char *buf)
649 {
650 	struct iscsi_cmd *cmd;
651 
652 	cmd = iscsit_allocate_cmd(conn, TASK_INTERRUPTIBLE);
653 	if (!cmd)
654 		return -1;
655 
656 	cmd->iscsi_opcode = ISCSI_OP_REJECT;
657 	cmd->reject_reason = reason;
658 
659 	cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
660 	if (!cmd->buf_ptr) {
661 		pr_err("Unable to allocate memory for cmd->buf_ptr\n");
662 		iscsit_free_cmd(cmd, false);
663 		return -1;
664 	}
665 
666 	spin_lock_bh(&conn->cmd_lock);
667 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
668 	spin_unlock_bh(&conn->cmd_lock);
669 
670 	cmd->i_state = ISTATE_SEND_REJECT;
671 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
672 
673 	return -1;
674 }
675 
676 static int iscsit_add_reject_from_cmd(
677 	struct iscsi_cmd *cmd,
678 	u8 reason,
679 	bool add_to_conn,
680 	unsigned char *buf)
681 {
682 	struct iscsi_conn *conn;
683 
684 	if (!cmd->conn) {
685 		pr_err("cmd->conn is NULL for ITT: 0x%08x\n",
686 				cmd->init_task_tag);
687 		return -1;
688 	}
689 	conn = cmd->conn;
690 
691 	cmd->iscsi_opcode = ISCSI_OP_REJECT;
692 	cmd->reject_reason = reason;
693 
694 	cmd->buf_ptr = kmemdup(buf, ISCSI_HDR_LEN, GFP_KERNEL);
695 	if (!cmd->buf_ptr) {
696 		pr_err("Unable to allocate memory for cmd->buf_ptr\n");
697 		iscsit_free_cmd(cmd, false);
698 		return -1;
699 	}
700 
701 	if (add_to_conn) {
702 		spin_lock_bh(&conn->cmd_lock);
703 		list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
704 		spin_unlock_bh(&conn->cmd_lock);
705 	}
706 
707 	cmd->i_state = ISTATE_SEND_REJECT;
708 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
709 	/*
710 	 * Perform the kref_put now if se_cmd has already been setup by
711 	 * scsit_setup_scsi_cmd()
712 	 */
713 	if (cmd->se_cmd.se_tfo != NULL) {
714 		pr_debug("iscsi reject: calling target_put_sess_cmd >>>>>>\n");
715 		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
716 	}
717 	return -1;
718 }
719 
720 static int iscsit_add_reject_cmd(struct iscsi_cmd *cmd, u8 reason,
721 				 unsigned char *buf)
722 {
723 	return iscsit_add_reject_from_cmd(cmd, reason, true, buf);
724 }
725 
726 int iscsit_reject_cmd(struct iscsi_cmd *cmd, u8 reason, unsigned char *buf)
727 {
728 	return iscsit_add_reject_from_cmd(cmd, reason, false, buf);
729 }
730 
731 /*
732  * Map some portion of the allocated scatterlist to an iovec, suitable for
733  * kernel sockets to copy data in/out.
734  */
735 static int iscsit_map_iovec(
736 	struct iscsi_cmd *cmd,
737 	struct kvec *iov,
738 	u32 data_offset,
739 	u32 data_length)
740 {
741 	u32 i = 0;
742 	struct scatterlist *sg;
743 	unsigned int page_off;
744 
745 	/*
746 	 * We know each entry in t_data_sg contains a page.
747 	 */
748 	sg = &cmd->se_cmd.t_data_sg[data_offset / PAGE_SIZE];
749 	page_off = (data_offset % PAGE_SIZE);
750 
751 	cmd->first_data_sg = sg;
752 	cmd->first_data_sg_off = page_off;
753 
754 	while (data_length) {
755 		u32 cur_len = min_t(u32, data_length, sg->length - page_off);
756 
757 		iov[i].iov_base = kmap(sg_page(sg)) + sg->offset + page_off;
758 		iov[i].iov_len = cur_len;
759 
760 		data_length -= cur_len;
761 		page_off = 0;
762 		sg = sg_next(sg);
763 		i++;
764 	}
765 
766 	cmd->kmapped_nents = i;
767 
768 	return i;
769 }
770 
771 static void iscsit_unmap_iovec(struct iscsi_cmd *cmd)
772 {
773 	u32 i;
774 	struct scatterlist *sg;
775 
776 	sg = cmd->first_data_sg;
777 
778 	for (i = 0; i < cmd->kmapped_nents; i++)
779 		kunmap(sg_page(&sg[i]));
780 }
781 
782 static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
783 {
784 	LIST_HEAD(ack_list);
785 	struct iscsi_cmd *cmd, *cmd_p;
786 
787 	conn->exp_statsn = exp_statsn;
788 
789 	if (conn->sess->sess_ops->RDMAExtensions)
790 		return;
791 
792 	spin_lock_bh(&conn->cmd_lock);
793 	list_for_each_entry_safe(cmd, cmd_p, &conn->conn_cmd_list, i_conn_node) {
794 		spin_lock(&cmd->istate_lock);
795 		if ((cmd->i_state == ISTATE_SENT_STATUS) &&
796 		    iscsi_sna_lt(cmd->stat_sn, exp_statsn)) {
797 			cmd->i_state = ISTATE_REMOVE;
798 			spin_unlock(&cmd->istate_lock);
799 			list_move_tail(&cmd->i_conn_node, &ack_list);
800 			continue;
801 		}
802 		spin_unlock(&cmd->istate_lock);
803 	}
804 	spin_unlock_bh(&conn->cmd_lock);
805 
806 	list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
807 		list_del_init(&cmd->i_conn_node);
808 		iscsit_free_cmd(cmd, false);
809 	}
810 }
811 
812 static int iscsit_allocate_iovecs(struct iscsi_cmd *cmd)
813 {
814 	u32 iov_count = max(1UL, DIV_ROUND_UP(cmd->se_cmd.data_length, PAGE_SIZE));
815 
816 	iov_count += ISCSI_IOV_DATA_BUFFER;
817 
818 	cmd->iov_data = kzalloc(iov_count * sizeof(struct kvec), GFP_KERNEL);
819 	if (!cmd->iov_data) {
820 		pr_err("Unable to allocate cmd->iov_data\n");
821 		return -ENOMEM;
822 	}
823 
824 	cmd->orig_iov_data_count = iov_count;
825 	return 0;
826 }
827 
828 int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
829 			  unsigned char *buf)
830 {
831 	int data_direction, payload_length;
832 	struct iscsi_scsi_req *hdr;
833 	int iscsi_task_attr;
834 	int sam_task_attr;
835 
836 	atomic_long_inc(&conn->sess->cmd_pdus);
837 
838 	hdr			= (struct iscsi_scsi_req *) buf;
839 	payload_length		= ntoh24(hdr->dlength);
840 
841 	/* FIXME; Add checks for AdditionalHeaderSegment */
842 
843 	if (!(hdr->flags & ISCSI_FLAG_CMD_WRITE) &&
844 	    !(hdr->flags & ISCSI_FLAG_CMD_FINAL)) {
845 		pr_err("ISCSI_FLAG_CMD_WRITE & ISCSI_FLAG_CMD_FINAL"
846 				" not set. Bad iSCSI Initiator.\n");
847 		return iscsit_add_reject_cmd(cmd,
848 					     ISCSI_REASON_BOOKMARK_INVALID, buf);
849 	}
850 
851 	if (((hdr->flags & ISCSI_FLAG_CMD_READ) ||
852 	     (hdr->flags & ISCSI_FLAG_CMD_WRITE)) && !hdr->data_length) {
853 		/*
854 		 * From RFC-3720 Section 10.3.1:
855 		 *
856 		 * "Either or both of R and W MAY be 1 when either the
857 		 *  Expected Data Transfer Length and/or Bidirectional Read
858 		 *  Expected Data Transfer Length are 0"
859 		 *
860 		 * For this case, go ahead and clear the unnecssary bits
861 		 * to avoid any confusion with ->data_direction.
862 		 */
863 		hdr->flags &= ~ISCSI_FLAG_CMD_READ;
864 		hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
865 
866 		pr_warn("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
867 			" set when Expected Data Transfer Length is 0 for"
868 			" CDB: 0x%02x, Fixing up flags\n", hdr->cdb[0]);
869 	}
870 
871 	if (!(hdr->flags & ISCSI_FLAG_CMD_READ) &&
872 	    !(hdr->flags & ISCSI_FLAG_CMD_WRITE) && (hdr->data_length != 0)) {
873 		pr_err("ISCSI_FLAG_CMD_READ and/or ISCSI_FLAG_CMD_WRITE"
874 			" MUST be set if Expected Data Transfer Length is not 0."
875 			" Bad iSCSI Initiator\n");
876 		return iscsit_add_reject_cmd(cmd,
877 					     ISCSI_REASON_BOOKMARK_INVALID, buf);
878 	}
879 
880 	if ((hdr->flags & ISCSI_FLAG_CMD_READ) &&
881 	    (hdr->flags & ISCSI_FLAG_CMD_WRITE)) {
882 		pr_err("Bidirectional operations not supported!\n");
883 		return iscsit_add_reject_cmd(cmd,
884 					     ISCSI_REASON_BOOKMARK_INVALID, buf);
885 	}
886 
887 	if (hdr->opcode & ISCSI_OP_IMMEDIATE) {
888 		pr_err("Illegally set Immediate Bit in iSCSI Initiator"
889 				" Scsi Command PDU.\n");
890 		return iscsit_add_reject_cmd(cmd,
891 					     ISCSI_REASON_BOOKMARK_INVALID, buf);
892 	}
893 
894 	if (payload_length && !conn->sess->sess_ops->ImmediateData) {
895 		pr_err("ImmediateData=No but DataSegmentLength=%u,"
896 			" protocol error.\n", payload_length);
897 		return iscsit_add_reject_cmd(cmd,
898 					     ISCSI_REASON_PROTOCOL_ERROR, buf);
899 	}
900 
901 	if ((be32_to_cpu(hdr->data_length) == payload_length) &&
902 	    (!(hdr->flags & ISCSI_FLAG_CMD_FINAL))) {
903 		pr_err("Expected Data Transfer Length and Length of"
904 			" Immediate Data are the same, but ISCSI_FLAG_CMD_FINAL"
905 			" bit is not set protocol error\n");
906 		return iscsit_add_reject_cmd(cmd,
907 					     ISCSI_REASON_PROTOCOL_ERROR, buf);
908 	}
909 
910 	if (payload_length > be32_to_cpu(hdr->data_length)) {
911 		pr_err("DataSegmentLength: %u is greater than"
912 			" EDTL: %u, protocol error.\n", payload_length,
913 				hdr->data_length);
914 		return iscsit_add_reject_cmd(cmd,
915 					     ISCSI_REASON_PROTOCOL_ERROR, buf);
916 	}
917 
918 	if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
919 		pr_err("DataSegmentLength: %u is greater than"
920 			" MaxXmitDataSegmentLength: %u, protocol error.\n",
921 			payload_length, conn->conn_ops->MaxXmitDataSegmentLength);
922 		return iscsit_add_reject_cmd(cmd,
923 					     ISCSI_REASON_PROTOCOL_ERROR, buf);
924 	}
925 
926 	if (payload_length > conn->sess->sess_ops->FirstBurstLength) {
927 		pr_err("DataSegmentLength: %u is greater than"
928 			" FirstBurstLength: %u, protocol error.\n",
929 			payload_length, conn->sess->sess_ops->FirstBurstLength);
930 		return iscsit_add_reject_cmd(cmd,
931 					     ISCSI_REASON_BOOKMARK_INVALID, buf);
932 	}
933 
934 	data_direction = (hdr->flags & ISCSI_FLAG_CMD_WRITE) ? DMA_TO_DEVICE :
935 			 (hdr->flags & ISCSI_FLAG_CMD_READ) ? DMA_FROM_DEVICE :
936 			  DMA_NONE;
937 
938 	cmd->data_direction = data_direction;
939 	iscsi_task_attr = hdr->flags & ISCSI_FLAG_CMD_ATTR_MASK;
940 	/*
941 	 * Figure out the SAM Task Attribute for the incoming SCSI CDB
942 	 */
943 	if ((iscsi_task_attr == ISCSI_ATTR_UNTAGGED) ||
944 	    (iscsi_task_attr == ISCSI_ATTR_SIMPLE))
945 		sam_task_attr = MSG_SIMPLE_TAG;
946 	else if (iscsi_task_attr == ISCSI_ATTR_ORDERED)
947 		sam_task_attr = MSG_ORDERED_TAG;
948 	else if (iscsi_task_attr == ISCSI_ATTR_HEAD_OF_QUEUE)
949 		sam_task_attr = MSG_HEAD_TAG;
950 	else if (iscsi_task_attr == ISCSI_ATTR_ACA)
951 		sam_task_attr = MSG_ACA_TAG;
952 	else {
953 		pr_debug("Unknown iSCSI Task Attribute: 0x%02x, using"
954 			" MSG_SIMPLE_TAG\n", iscsi_task_attr);
955 		sam_task_attr = MSG_SIMPLE_TAG;
956 	}
957 
958 	cmd->iscsi_opcode	= ISCSI_OP_SCSI_CMD;
959 	cmd->i_state		= ISTATE_NEW_CMD;
960 	cmd->immediate_cmd	= ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
961 	cmd->immediate_data	= (payload_length) ? 1 : 0;
962 	cmd->unsolicited_data	= ((!(hdr->flags & ISCSI_FLAG_CMD_FINAL) &&
963 				     (hdr->flags & ISCSI_FLAG_CMD_WRITE)) ? 1 : 0);
964 	if (cmd->unsolicited_data)
965 		cmd->cmd_flags |= ICF_NON_IMMEDIATE_UNSOLICITED_DATA;
966 
967 	conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt;
968 	if (hdr->flags & ISCSI_FLAG_CMD_READ) {
969 		spin_lock_bh(&conn->sess->ttt_lock);
970 		cmd->targ_xfer_tag = conn->sess->targ_xfer_tag++;
971 		if (cmd->targ_xfer_tag == 0xFFFFFFFF)
972 			cmd->targ_xfer_tag = conn->sess->targ_xfer_tag++;
973 		spin_unlock_bh(&conn->sess->ttt_lock);
974 	} else if (hdr->flags & ISCSI_FLAG_CMD_WRITE)
975 		cmd->targ_xfer_tag = 0xFFFFFFFF;
976 	cmd->cmd_sn		= be32_to_cpu(hdr->cmdsn);
977 	cmd->exp_stat_sn	= be32_to_cpu(hdr->exp_statsn);
978 	cmd->first_burst_len	= payload_length;
979 
980 	if (!conn->sess->sess_ops->RDMAExtensions &&
981 	     cmd->data_direction == DMA_FROM_DEVICE) {
982 		struct iscsi_datain_req *dr;
983 
984 		dr = iscsit_allocate_datain_req();
985 		if (!dr)
986 			return iscsit_add_reject_cmd(cmd,
987 					ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
988 
989 		iscsit_attach_datain_req(cmd, dr);
990 	}
991 
992 	/*
993 	 * Initialize struct se_cmd descriptor from target_core_mod infrastructure
994 	 */
995 	transport_init_se_cmd(&cmd->se_cmd, &lio_target_fabric_configfs->tf_ops,
996 			conn->sess->se_sess, be32_to_cpu(hdr->data_length),
997 			cmd->data_direction, sam_task_attr,
998 			cmd->sense_buffer + 2);
999 
1000 	pr_debug("Got SCSI Command, ITT: 0x%08x, CmdSN: 0x%08x,"
1001 		" ExpXferLen: %u, Length: %u, CID: %hu\n", hdr->itt,
1002 		hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length,
1003 		conn->cid);
1004 
1005 	target_get_sess_cmd(conn->sess->se_sess, &cmd->se_cmd, true);
1006 
1007 	cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd,
1008 						     scsilun_to_int(&hdr->lun));
1009 	if (cmd->sense_reason)
1010 		goto attach_cmd;
1011 
1012 	cmd->sense_reason = target_setup_cmd_from_cdb(&cmd->se_cmd, hdr->cdb);
1013 	if (cmd->sense_reason) {
1014 		if (cmd->sense_reason == TCM_OUT_OF_RESOURCES) {
1015 			return iscsit_add_reject_cmd(cmd,
1016 					ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
1017 		}
1018 
1019 		goto attach_cmd;
1020 	}
1021 
1022 	if (iscsit_build_pdu_and_seq_lists(cmd, payload_length) < 0) {
1023 		return iscsit_add_reject_cmd(cmd,
1024 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
1025 	}
1026 
1027 attach_cmd:
1028 	spin_lock_bh(&conn->cmd_lock);
1029 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
1030 	spin_unlock_bh(&conn->cmd_lock);
1031 	/*
1032 	 * Check if we need to delay processing because of ALUA
1033 	 * Active/NonOptimized primary access state..
1034 	 */
1035 	core_alua_check_nonop_delay(&cmd->se_cmd);
1036 
1037 	return 0;
1038 }
1039 EXPORT_SYMBOL(iscsit_setup_scsi_cmd);
1040 
1041 void iscsit_set_unsoliticed_dataout(struct iscsi_cmd *cmd)
1042 {
1043 	iscsit_set_dataout_sequence_values(cmd);
1044 
1045 	spin_lock_bh(&cmd->dataout_timeout_lock);
1046 	iscsit_start_dataout_timer(cmd, cmd->conn);
1047 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1048 }
1049 EXPORT_SYMBOL(iscsit_set_unsoliticed_dataout);
1050 
1051 int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
1052 			    struct iscsi_scsi_req *hdr)
1053 {
1054 	int cmdsn_ret = 0;
1055 	/*
1056 	 * Check the CmdSN against ExpCmdSN/MaxCmdSN here if
1057 	 * the Immediate Bit is not set, and no Immediate
1058 	 * Data is attached.
1059 	 *
1060 	 * A PDU/CmdSN carrying Immediate Data can only
1061 	 * be processed after the DataCRC has passed.
1062 	 * If the DataCRC fails, the CmdSN MUST NOT
1063 	 * be acknowledged. (See below)
1064 	 */
1065 	if (!cmd->immediate_data) {
1066 		cmdsn_ret = iscsit_sequence_cmd(conn, cmd,
1067 					(unsigned char *)hdr, hdr->cmdsn);
1068 		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
1069 			return -1;
1070 		else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
1071 			target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
1072 			return 0;
1073 		}
1074 	}
1075 
1076 	iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
1077 
1078 	/*
1079 	 * If no Immediate Data is attached, it's OK to return now.
1080 	 */
1081 	if (!cmd->immediate_data) {
1082 		if (!cmd->sense_reason && cmd->unsolicited_data)
1083 			iscsit_set_unsoliticed_dataout(cmd);
1084 		if (!cmd->sense_reason)
1085 			return 0;
1086 
1087 		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
1088 		return 0;
1089 	}
1090 
1091 	/*
1092 	 * Early CHECK_CONDITIONs with ImmediateData never make it to command
1093 	 * execution.  These exceptions are processed in CmdSN order using
1094 	 * iscsit_check_received_cmdsn() in iscsit_get_immediate_data() below.
1095 	 */
1096 	if (cmd->sense_reason) {
1097 		if (cmd->reject_reason)
1098 			return 0;
1099 
1100 		return 1;
1101 	}
1102 	/*
1103 	 * Call directly into transport_generic_new_cmd() to perform
1104 	 * the backend memory allocation.
1105 	 */
1106 	cmd->sense_reason = transport_generic_new_cmd(&cmd->se_cmd);
1107 	if (cmd->sense_reason)
1108 		return 1;
1109 
1110 	return 0;
1111 }
1112 EXPORT_SYMBOL(iscsit_process_scsi_cmd);
1113 
1114 static int
1115 iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
1116 			  bool dump_payload)
1117 {
1118 	struct iscsi_conn *conn = cmd->conn;
1119 	int cmdsn_ret = 0, immed_ret = IMMEDIATE_DATA_NORMAL_OPERATION;
1120 	/*
1121 	 * Special case for Unsupported SAM WRITE Opcodes and ImmediateData=Yes.
1122 	 */
1123 	if (dump_payload == true)
1124 		goto after_immediate_data;
1125 
1126 	immed_ret = iscsit_handle_immediate_data(cmd, hdr,
1127 					cmd->first_burst_len);
1128 after_immediate_data:
1129 	if (immed_ret == IMMEDIATE_DATA_NORMAL_OPERATION) {
1130 		/*
1131 		 * A PDU/CmdSN carrying Immediate Data passed
1132 		 * DataCRC, check against ExpCmdSN/MaxCmdSN if
1133 		 * Immediate Bit is not set.
1134 		 */
1135 		cmdsn_ret = iscsit_sequence_cmd(cmd->conn, cmd,
1136 					(unsigned char *)hdr, hdr->cmdsn);
1137 		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
1138 			return -1;
1139 
1140 		if (cmd->sense_reason || cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
1141 			int rc;
1142 
1143 			rc = iscsit_dump_data_payload(cmd->conn,
1144 						      cmd->first_burst_len, 1);
1145 			target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
1146 			return rc;
1147 		} else if (cmd->unsolicited_data)
1148 			iscsit_set_unsoliticed_dataout(cmd);
1149 
1150 	} else if (immed_ret == IMMEDIATE_DATA_ERL1_CRC_FAILURE) {
1151 		/*
1152 		 * Immediate Data failed DataCRC and ERL>=1,
1153 		 * silently drop this PDU and let the initiator
1154 		 * plug the CmdSN gap.
1155 		 *
1156 		 * FIXME: Send Unsolicited NOPIN with reserved
1157 		 * TTT here to help the initiator figure out
1158 		 * the missing CmdSN, although they should be
1159 		 * intelligent enough to determine the missing
1160 		 * CmdSN and issue a retry to plug the sequence.
1161 		 */
1162 		cmd->i_state = ISTATE_REMOVE;
1163 		iscsit_add_cmd_to_immediate_queue(cmd, cmd->conn, cmd->i_state);
1164 	} else /* immed_ret == IMMEDIATE_DATA_CANNOT_RECOVER */
1165 		return -1;
1166 
1167 	return 0;
1168 }
1169 
1170 static int
1171 iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
1172 			   unsigned char *buf)
1173 {
1174 	struct iscsi_scsi_req *hdr = (struct iscsi_scsi_req *)buf;
1175 	int rc, immed_data;
1176 	bool dump_payload = false;
1177 
1178 	rc = iscsit_setup_scsi_cmd(conn, cmd, buf);
1179 	if (rc < 0)
1180 		return 0;
1181 	/*
1182 	 * Allocation iovecs needed for struct socket operations for
1183 	 * traditional iSCSI block I/O.
1184 	 */
1185 	if (iscsit_allocate_iovecs(cmd) < 0) {
1186 		return iscsit_add_reject_cmd(cmd,
1187 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
1188 	}
1189 	immed_data = cmd->immediate_data;
1190 
1191 	rc = iscsit_process_scsi_cmd(conn, cmd, hdr);
1192 	if (rc < 0)
1193 		return rc;
1194 	else if (rc > 0)
1195 		dump_payload = true;
1196 
1197 	if (!immed_data)
1198 		return 0;
1199 
1200 	return iscsit_get_immediate_data(cmd, hdr, dump_payload);
1201 }
1202 
1203 static u32 iscsit_do_crypto_hash_sg(
1204 	struct hash_desc *hash,
1205 	struct iscsi_cmd *cmd,
1206 	u32 data_offset,
1207 	u32 data_length,
1208 	u32 padding,
1209 	u8 *pad_bytes)
1210 {
1211 	u32 data_crc;
1212 	u32 i;
1213 	struct scatterlist *sg;
1214 	unsigned int page_off;
1215 
1216 	crypto_hash_init(hash);
1217 
1218 	sg = cmd->first_data_sg;
1219 	page_off = cmd->first_data_sg_off;
1220 
1221 	i = 0;
1222 	while (data_length) {
1223 		u32 cur_len = min_t(u32, data_length, (sg[i].length - page_off));
1224 
1225 		crypto_hash_update(hash, &sg[i], cur_len);
1226 
1227 		data_length -= cur_len;
1228 		page_off = 0;
1229 		i++;
1230 	}
1231 
1232 	if (padding) {
1233 		struct scatterlist pad_sg;
1234 
1235 		sg_init_one(&pad_sg, pad_bytes, padding);
1236 		crypto_hash_update(hash, &pad_sg, padding);
1237 	}
1238 	crypto_hash_final(hash, (u8 *) &data_crc);
1239 
1240 	return data_crc;
1241 }
1242 
1243 static void iscsit_do_crypto_hash_buf(
1244 	struct hash_desc *hash,
1245 	const void *buf,
1246 	u32 payload_length,
1247 	u32 padding,
1248 	u8 *pad_bytes,
1249 	u8 *data_crc)
1250 {
1251 	struct scatterlist sg;
1252 
1253 	crypto_hash_init(hash);
1254 
1255 	sg_init_one(&sg, buf, payload_length);
1256 	crypto_hash_update(hash, &sg, payload_length);
1257 
1258 	if (padding) {
1259 		sg_init_one(&sg, pad_bytes, padding);
1260 		crypto_hash_update(hash, &sg, padding);
1261 	}
1262 	crypto_hash_final(hash, data_crc);
1263 }
1264 
1265 int
1266 iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
1267 			  struct iscsi_cmd **out_cmd)
1268 {
1269 	struct iscsi_data *hdr = (struct iscsi_data *)buf;
1270 	struct iscsi_cmd *cmd = NULL;
1271 	struct se_cmd *se_cmd;
1272 	u32 payload_length = ntoh24(hdr->dlength);
1273 	int rc;
1274 
1275 	if (!payload_length) {
1276 		pr_warn("DataOUT payload is ZERO, ignoring.\n");
1277 		return 0;
1278 	}
1279 
1280 	/* iSCSI write */
1281 	atomic_long_add(payload_length, &conn->sess->rx_data_octets);
1282 
1283 	if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
1284 		pr_err("DataSegmentLength: %u is greater than"
1285 			" MaxXmitDataSegmentLength: %u\n", payload_length,
1286 			conn->conn_ops->MaxXmitDataSegmentLength);
1287 		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
1288 					 buf);
1289 	}
1290 
1291 	cmd = iscsit_find_cmd_from_itt_or_dump(conn, hdr->itt,
1292 			payload_length);
1293 	if (!cmd)
1294 		return 0;
1295 
1296 	pr_debug("Got DataOut ITT: 0x%08x, TTT: 0x%08x,"
1297 		" DataSN: 0x%08x, Offset: %u, Length: %u, CID: %hu\n",
1298 		hdr->itt, hdr->ttt, hdr->datasn, ntohl(hdr->offset),
1299 		payload_length, conn->cid);
1300 
1301 	if (cmd->cmd_flags & ICF_GOT_LAST_DATAOUT) {
1302 		pr_err("Command ITT: 0x%08x received DataOUT after"
1303 			" last DataOUT received, dumping payload\n",
1304 			cmd->init_task_tag);
1305 		return iscsit_dump_data_payload(conn, payload_length, 1);
1306 	}
1307 
1308 	if (cmd->data_direction != DMA_TO_DEVICE) {
1309 		pr_err("Command ITT: 0x%08x received DataOUT for a"
1310 			" NON-WRITE command.\n", cmd->init_task_tag);
1311 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
1312 	}
1313 	se_cmd = &cmd->se_cmd;
1314 	iscsit_mod_dataout_timer(cmd);
1315 
1316 	if ((be32_to_cpu(hdr->offset) + payload_length) > cmd->se_cmd.data_length) {
1317 		pr_err("DataOut Offset: %u, Length %u greater than"
1318 			" iSCSI Command EDTL %u, protocol error.\n",
1319 			hdr->offset, payload_length, cmd->se_cmd.data_length);
1320 		return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_INVALID, buf);
1321 	}
1322 
1323 	if (cmd->unsolicited_data) {
1324 		int dump_unsolicited_data = 0;
1325 
1326 		if (conn->sess->sess_ops->InitialR2T) {
1327 			pr_err("Received unexpected unsolicited data"
1328 				" while InitialR2T=Yes, protocol error.\n");
1329 			transport_send_check_condition_and_sense(&cmd->se_cmd,
1330 					TCM_UNEXPECTED_UNSOLICITED_DATA, 0);
1331 			return -1;
1332 		}
1333 		/*
1334 		 * Special case for dealing with Unsolicited DataOUT
1335 		 * and Unsupported SAM WRITE Opcodes and SE resource allocation
1336 		 * failures;
1337 		 */
1338 
1339 		/* Something's amiss if we're not in WRITE_PENDING state... */
1340 		WARN_ON(se_cmd->t_state != TRANSPORT_WRITE_PENDING);
1341 		if (!(se_cmd->se_cmd_flags & SCF_SUPPORTED_SAM_OPCODE))
1342 			dump_unsolicited_data = 1;
1343 
1344 		if (dump_unsolicited_data) {
1345 			/*
1346 			 * Check if a delayed TASK_ABORTED status needs to
1347 			 * be sent now if the ISCSI_FLAG_CMD_FINAL has been
1348 			 * received with the unsolicitied data out.
1349 			 */
1350 			if (hdr->flags & ISCSI_FLAG_CMD_FINAL)
1351 				iscsit_stop_dataout_timer(cmd);
1352 
1353 			transport_check_aborted_status(se_cmd,
1354 					(hdr->flags & ISCSI_FLAG_CMD_FINAL));
1355 			return iscsit_dump_data_payload(conn, payload_length, 1);
1356 		}
1357 	} else {
1358 		/*
1359 		 * For the normal solicited data path:
1360 		 *
1361 		 * Check for a delayed TASK_ABORTED status and dump any
1362 		 * incoming data out payload if one exists.  Also, when the
1363 		 * ISCSI_FLAG_CMD_FINAL is set to denote the end of the current
1364 		 * data out sequence, we decrement outstanding_r2ts.  Once
1365 		 * outstanding_r2ts reaches zero, go ahead and send the delayed
1366 		 * TASK_ABORTED status.
1367 		 */
1368 		if (se_cmd->transport_state & CMD_T_ABORTED) {
1369 			if (hdr->flags & ISCSI_FLAG_CMD_FINAL)
1370 				if (--cmd->outstanding_r2ts < 1) {
1371 					iscsit_stop_dataout_timer(cmd);
1372 					transport_check_aborted_status(
1373 							se_cmd, 1);
1374 				}
1375 
1376 			return iscsit_dump_data_payload(conn, payload_length, 1);
1377 		}
1378 	}
1379 	/*
1380 	 * Preform DataSN, DataSequenceInOrder, DataPDUInOrder, and
1381 	 * within-command recovery checks before receiving the payload.
1382 	 */
1383 	rc = iscsit_check_pre_dataout(cmd, buf);
1384 	if (rc == DATAOUT_WITHIN_COMMAND_RECOVERY)
1385 		return 0;
1386 	else if (rc == DATAOUT_CANNOT_RECOVER)
1387 		return -1;
1388 
1389 	*out_cmd = cmd;
1390 	return 0;
1391 }
1392 EXPORT_SYMBOL(iscsit_check_dataout_hdr);
1393 
1394 static int
1395 iscsit_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
1396 		   struct iscsi_data *hdr)
1397 {
1398 	struct kvec *iov;
1399 	u32 checksum, iov_count = 0, padding = 0, rx_got = 0, rx_size = 0;
1400 	u32 payload_length = ntoh24(hdr->dlength);
1401 	int iov_ret, data_crc_failed = 0;
1402 
1403 	rx_size += payload_length;
1404 	iov = &cmd->iov_data[0];
1405 
1406 	iov_ret = iscsit_map_iovec(cmd, iov, be32_to_cpu(hdr->offset),
1407 				   payload_length);
1408 	if (iov_ret < 0)
1409 		return -1;
1410 
1411 	iov_count += iov_ret;
1412 
1413 	padding = ((-payload_length) & 3);
1414 	if (padding != 0) {
1415 		iov[iov_count].iov_base	= cmd->pad_bytes;
1416 		iov[iov_count++].iov_len = padding;
1417 		rx_size += padding;
1418 		pr_debug("Receiving %u padding bytes.\n", padding);
1419 	}
1420 
1421 	if (conn->conn_ops->DataDigest) {
1422 		iov[iov_count].iov_base = &checksum;
1423 		iov[iov_count++].iov_len = ISCSI_CRC_LEN;
1424 		rx_size += ISCSI_CRC_LEN;
1425 	}
1426 
1427 	rx_got = rx_data(conn, &cmd->iov_data[0], iov_count, rx_size);
1428 
1429 	iscsit_unmap_iovec(cmd);
1430 
1431 	if (rx_got != rx_size)
1432 		return -1;
1433 
1434 	if (conn->conn_ops->DataDigest) {
1435 		u32 data_crc;
1436 
1437 		data_crc = iscsit_do_crypto_hash_sg(&conn->conn_rx_hash, cmd,
1438 						    be32_to_cpu(hdr->offset),
1439 						    payload_length, padding,
1440 						    cmd->pad_bytes);
1441 
1442 		if (checksum != data_crc) {
1443 			pr_err("ITT: 0x%08x, Offset: %u, Length: %u,"
1444 				" DataSN: 0x%08x, CRC32C DataDigest 0x%08x"
1445 				" does not match computed 0x%08x\n",
1446 				hdr->itt, hdr->offset, payload_length,
1447 				hdr->datasn, checksum, data_crc);
1448 			data_crc_failed = 1;
1449 		} else {
1450 			pr_debug("Got CRC32C DataDigest 0x%08x for"
1451 				" %u bytes of Data Out\n", checksum,
1452 				payload_length);
1453 		}
1454 	}
1455 
1456 	return data_crc_failed;
1457 }
1458 
1459 int
1460 iscsit_check_dataout_payload(struct iscsi_cmd *cmd, struct iscsi_data *hdr,
1461 			     bool data_crc_failed)
1462 {
1463 	struct iscsi_conn *conn = cmd->conn;
1464 	int rc, ooo_cmdsn;
1465 	/*
1466 	 * Increment post receive data and CRC values or perform
1467 	 * within-command recovery.
1468 	 */
1469 	rc = iscsit_check_post_dataout(cmd, (unsigned char *)hdr, data_crc_failed);
1470 	if ((rc == DATAOUT_NORMAL) || (rc == DATAOUT_WITHIN_COMMAND_RECOVERY))
1471 		return 0;
1472 	else if (rc == DATAOUT_SEND_R2T) {
1473 		iscsit_set_dataout_sequence_values(cmd);
1474 		conn->conn_transport->iscsit_get_dataout(conn, cmd, false);
1475 	} else if (rc == DATAOUT_SEND_TO_TRANSPORT) {
1476 		/*
1477 		 * Handle extra special case for out of order
1478 		 * Unsolicited Data Out.
1479 		 */
1480 		spin_lock_bh(&cmd->istate_lock);
1481 		ooo_cmdsn = (cmd->cmd_flags & ICF_OOO_CMDSN);
1482 		cmd->cmd_flags |= ICF_GOT_LAST_DATAOUT;
1483 		cmd->i_state = ISTATE_RECEIVED_LAST_DATAOUT;
1484 		spin_unlock_bh(&cmd->istate_lock);
1485 
1486 		iscsit_stop_dataout_timer(cmd);
1487 		if (ooo_cmdsn)
1488 			return 0;
1489 		target_execute_cmd(&cmd->se_cmd);
1490 		return 0;
1491 	} else /* DATAOUT_CANNOT_RECOVER */
1492 		return -1;
1493 
1494 	return 0;
1495 }
1496 EXPORT_SYMBOL(iscsit_check_dataout_payload);
1497 
1498 static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
1499 {
1500 	struct iscsi_cmd *cmd = NULL;
1501 	struct iscsi_data *hdr = (struct iscsi_data *)buf;
1502 	int rc;
1503 	bool data_crc_failed = false;
1504 
1505 	rc = iscsit_check_dataout_hdr(conn, buf, &cmd);
1506 	if (rc < 0)
1507 		return 0;
1508 	else if (!cmd)
1509 		return 0;
1510 
1511 	rc = iscsit_get_dataout(conn, cmd, hdr);
1512 	if (rc < 0)
1513 		return rc;
1514 	else if (rc > 0)
1515 		data_crc_failed = true;
1516 
1517 	return iscsit_check_dataout_payload(cmd, hdr, data_crc_failed);
1518 }
1519 
1520 int iscsit_setup_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
1521 			 struct iscsi_nopout *hdr)
1522 {
1523 	u32 payload_length = ntoh24(hdr->dlength);
1524 
1525 	if (!(hdr->flags & ISCSI_FLAG_CMD_FINAL)) {
1526 		pr_err("NopOUT Flag's, Left Most Bit not set, protocol error.\n");
1527 		if (!cmd)
1528 			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
1529 						 (unsigned char *)hdr);
1530 
1531 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
1532 					 (unsigned char *)hdr);
1533 	}
1534 
1535 	if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
1536 		pr_err("NOPOUT ITT is reserved, but Immediate Bit is"
1537 			" not set, protocol error.\n");
1538 		if (!cmd)
1539 			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
1540 						 (unsigned char *)hdr);
1541 
1542 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
1543 					 (unsigned char *)hdr);
1544 	}
1545 
1546 	if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
1547 		pr_err("NOPOUT Ping Data DataSegmentLength: %u is"
1548 			" greater than MaxXmitDataSegmentLength: %u, protocol"
1549 			" error.\n", payload_length,
1550 			conn->conn_ops->MaxXmitDataSegmentLength);
1551 		if (!cmd)
1552 			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
1553 						 (unsigned char *)hdr);
1554 
1555 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
1556 					 (unsigned char *)hdr);
1557 	}
1558 
1559 	pr_debug("Got NOPOUT Ping %s ITT: 0x%08x, TTT: 0x%08x,"
1560 		" CmdSN: 0x%08x, ExpStatSN: 0x%08x, Length: %u\n",
1561 		hdr->itt == RESERVED_ITT ? "Response" : "Request",
1562 		hdr->itt, hdr->ttt, hdr->cmdsn, hdr->exp_statsn,
1563 		payload_length);
1564 	/*
1565 	 * This is not a response to a Unsolicited NopIN, which means
1566 	 * it can either be a NOPOUT ping request (with a valid ITT),
1567 	 * or a NOPOUT not requesting a NOPIN (with a reserved ITT).
1568 	 * Either way, make sure we allocate an struct iscsi_cmd, as both
1569 	 * can contain ping data.
1570 	 */
1571 	if (hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
1572 		cmd->iscsi_opcode	= ISCSI_OP_NOOP_OUT;
1573 		cmd->i_state		= ISTATE_SEND_NOPIN;
1574 		cmd->immediate_cmd	= ((hdr->opcode & ISCSI_OP_IMMEDIATE) ?
1575 						1 : 0);
1576 		conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt;
1577 		cmd->targ_xfer_tag	= 0xFFFFFFFF;
1578 		cmd->cmd_sn		= be32_to_cpu(hdr->cmdsn);
1579 		cmd->exp_stat_sn	= be32_to_cpu(hdr->exp_statsn);
1580 		cmd->data_direction	= DMA_NONE;
1581 	}
1582 
1583 	return 0;
1584 }
1585 EXPORT_SYMBOL(iscsit_setup_nop_out);
1586 
1587 int iscsit_process_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
1588 			   struct iscsi_nopout *hdr)
1589 {
1590 	struct iscsi_cmd *cmd_p = NULL;
1591 	int cmdsn_ret = 0;
1592 	/*
1593 	 * Initiator is expecting a NopIN ping reply..
1594 	 */
1595 	if (hdr->itt != RESERVED_ITT) {
1596 		BUG_ON(!cmd);
1597 
1598 		spin_lock_bh(&conn->cmd_lock);
1599 		list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
1600 		spin_unlock_bh(&conn->cmd_lock);
1601 
1602 		iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
1603 
1604 		if (hdr->opcode & ISCSI_OP_IMMEDIATE) {
1605 			iscsit_add_cmd_to_response_queue(cmd, conn,
1606 							 cmd->i_state);
1607 			return 0;
1608 		}
1609 
1610 		cmdsn_ret = iscsit_sequence_cmd(conn, cmd,
1611 				(unsigned char *)hdr, hdr->cmdsn);
1612                 if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
1613 			return 0;
1614 		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
1615 			return -1;
1616 
1617 		return 0;
1618 	}
1619 	/*
1620 	 * This was a response to a unsolicited NOPIN ping.
1621 	 */
1622 	if (hdr->ttt != cpu_to_be32(0xFFFFFFFF)) {
1623 		cmd_p = iscsit_find_cmd_from_ttt(conn, be32_to_cpu(hdr->ttt));
1624 		if (!cmd_p)
1625 			return -EINVAL;
1626 
1627 		iscsit_stop_nopin_response_timer(conn);
1628 
1629 		cmd_p->i_state = ISTATE_REMOVE;
1630 		iscsit_add_cmd_to_immediate_queue(cmd_p, conn, cmd_p->i_state);
1631 
1632 		iscsit_start_nopin_timer(conn);
1633 		return 0;
1634 	}
1635 	/*
1636 	 * Otherwise, initiator is not expecting a NOPIN is response.
1637 	 * Just ignore for now.
1638 	 */
1639         return 0;
1640 }
1641 EXPORT_SYMBOL(iscsit_process_nop_out);
1642 
1643 static int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
1644 				 unsigned char *buf)
1645 {
1646 	unsigned char *ping_data = NULL;
1647 	struct iscsi_nopout *hdr = (struct iscsi_nopout *)buf;
1648 	struct kvec *iov = NULL;
1649 	u32 payload_length = ntoh24(hdr->dlength);
1650 	int ret;
1651 
1652 	ret = iscsit_setup_nop_out(conn, cmd, hdr);
1653 	if (ret < 0)
1654 		return 0;
1655 	/*
1656 	 * Handle NOP-OUT payload for traditional iSCSI sockets
1657 	 */
1658 	if (payload_length && hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
1659 		u32 checksum, data_crc, padding = 0;
1660 		int niov = 0, rx_got, rx_size = payload_length;
1661 
1662 		ping_data = kzalloc(payload_length + 1, GFP_KERNEL);
1663 		if (!ping_data) {
1664 			pr_err("Unable to allocate memory for"
1665 				" NOPOUT ping data.\n");
1666 			ret = -1;
1667 			goto out;
1668 		}
1669 
1670 		iov = &cmd->iov_misc[0];
1671 		iov[niov].iov_base	= ping_data;
1672 		iov[niov++].iov_len	= payload_length;
1673 
1674 		padding = ((-payload_length) & 3);
1675 		if (padding != 0) {
1676 			pr_debug("Receiving %u additional bytes"
1677 				" for padding.\n", padding);
1678 			iov[niov].iov_base	= &cmd->pad_bytes;
1679 			iov[niov++].iov_len	= padding;
1680 			rx_size += padding;
1681 		}
1682 		if (conn->conn_ops->DataDigest) {
1683 			iov[niov].iov_base	= &checksum;
1684 			iov[niov++].iov_len	= ISCSI_CRC_LEN;
1685 			rx_size += ISCSI_CRC_LEN;
1686 		}
1687 
1688 		rx_got = rx_data(conn, &cmd->iov_misc[0], niov, rx_size);
1689 		if (rx_got != rx_size) {
1690 			ret = -1;
1691 			goto out;
1692 		}
1693 
1694 		if (conn->conn_ops->DataDigest) {
1695 			iscsit_do_crypto_hash_buf(&conn->conn_rx_hash,
1696 					ping_data, payload_length,
1697 					padding, cmd->pad_bytes,
1698 					(u8 *)&data_crc);
1699 
1700 			if (checksum != data_crc) {
1701 				pr_err("Ping data CRC32C DataDigest"
1702 				" 0x%08x does not match computed 0x%08x\n",
1703 					checksum, data_crc);
1704 				if (!conn->sess->sess_ops->ErrorRecoveryLevel) {
1705 					pr_err("Unable to recover from"
1706 					" NOPOUT Ping DataCRC failure while in"
1707 						" ERL=0.\n");
1708 					ret = -1;
1709 					goto out;
1710 				} else {
1711 					/*
1712 					 * Silently drop this PDU and let the
1713 					 * initiator plug the CmdSN gap.
1714 					 */
1715 					pr_debug("Dropping NOPOUT"
1716 					" Command CmdSN: 0x%08x due to"
1717 					" DataCRC error.\n", hdr->cmdsn);
1718 					ret = 0;
1719 					goto out;
1720 				}
1721 			} else {
1722 				pr_debug("Got CRC32C DataDigest"
1723 				" 0x%08x for %u bytes of ping data.\n",
1724 					checksum, payload_length);
1725 			}
1726 		}
1727 
1728 		ping_data[payload_length] = '\0';
1729 		/*
1730 		 * Attach ping data to struct iscsi_cmd->buf_ptr.
1731 		 */
1732 		cmd->buf_ptr = ping_data;
1733 		cmd->buf_ptr_size = payload_length;
1734 
1735 		pr_debug("Got %u bytes of NOPOUT ping"
1736 			" data.\n", payload_length);
1737 		pr_debug("Ping Data: \"%s\"\n", ping_data);
1738 	}
1739 
1740 	return iscsit_process_nop_out(conn, cmd, hdr);
1741 out:
1742 	if (cmd)
1743 		iscsit_free_cmd(cmd, false);
1744 
1745 	kfree(ping_data);
1746 	return ret;
1747 }
1748 
1749 int
1750 iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
1751 			   unsigned char *buf)
1752 {
1753 	struct se_tmr_req *se_tmr;
1754 	struct iscsi_tmr_req *tmr_req;
1755 	struct iscsi_tm *hdr;
1756 	int out_of_order_cmdsn = 0, ret;
1757 	bool sess_ref = false;
1758 	u8 function;
1759 
1760 	hdr			= (struct iscsi_tm *) buf;
1761 	hdr->flags &= ~ISCSI_FLAG_CMD_FINAL;
1762 	function = hdr->flags;
1763 
1764 	pr_debug("Got Task Management Request ITT: 0x%08x, CmdSN:"
1765 		" 0x%08x, Function: 0x%02x, RefTaskTag: 0x%08x, RefCmdSN:"
1766 		" 0x%08x, CID: %hu\n", hdr->itt, hdr->cmdsn, function,
1767 		hdr->rtt, hdr->refcmdsn, conn->cid);
1768 
1769 	if ((function != ISCSI_TM_FUNC_ABORT_TASK) &&
1770 	    ((function != ISCSI_TM_FUNC_TASK_REASSIGN) &&
1771 	     hdr->rtt != RESERVED_ITT)) {
1772 		pr_err("RefTaskTag should be set to 0xFFFFFFFF.\n");
1773 		hdr->rtt = RESERVED_ITT;
1774 	}
1775 
1776 	if ((function == ISCSI_TM_FUNC_TASK_REASSIGN) &&
1777 			!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
1778 		pr_err("Task Management Request TASK_REASSIGN not"
1779 			" issued as immediate command, bad iSCSI Initiator"
1780 				"implementation\n");
1781 		return iscsit_add_reject_cmd(cmd,
1782 					     ISCSI_REASON_PROTOCOL_ERROR, buf);
1783 	}
1784 	if ((function != ISCSI_TM_FUNC_ABORT_TASK) &&
1785 	    be32_to_cpu(hdr->refcmdsn) != ISCSI_RESERVED_TAG)
1786 		hdr->refcmdsn = cpu_to_be32(ISCSI_RESERVED_TAG);
1787 
1788 	cmd->data_direction = DMA_NONE;
1789 
1790 	cmd->tmr_req = kzalloc(sizeof(struct iscsi_tmr_req), GFP_KERNEL);
1791 	if (!cmd->tmr_req) {
1792 		pr_err("Unable to allocate memory for"
1793 			" Task Management command!\n");
1794 		return iscsit_add_reject_cmd(cmd,
1795 					     ISCSI_REASON_BOOKMARK_NO_RESOURCES,
1796 					     buf);
1797 	}
1798 
1799 	/*
1800 	 * TASK_REASSIGN for ERL=2 / connection stays inside of
1801 	 * LIO-Target $FABRIC_MOD
1802 	 */
1803 	if (function != ISCSI_TM_FUNC_TASK_REASSIGN) {
1804 
1805 		u8 tcm_function;
1806 		int ret;
1807 
1808 		transport_init_se_cmd(&cmd->se_cmd,
1809 				      &lio_target_fabric_configfs->tf_ops,
1810 				      conn->sess->se_sess, 0, DMA_NONE,
1811 				      MSG_SIMPLE_TAG, cmd->sense_buffer + 2);
1812 
1813 		target_get_sess_cmd(conn->sess->se_sess, &cmd->se_cmd, true);
1814 		sess_ref = true;
1815 
1816 		switch (function) {
1817 		case ISCSI_TM_FUNC_ABORT_TASK:
1818 			tcm_function = TMR_ABORT_TASK;
1819 			break;
1820 		case ISCSI_TM_FUNC_ABORT_TASK_SET:
1821 			tcm_function = TMR_ABORT_TASK_SET;
1822 			break;
1823 		case ISCSI_TM_FUNC_CLEAR_ACA:
1824 			tcm_function = TMR_CLEAR_ACA;
1825 			break;
1826 		case ISCSI_TM_FUNC_CLEAR_TASK_SET:
1827 			tcm_function = TMR_CLEAR_TASK_SET;
1828 			break;
1829 		case ISCSI_TM_FUNC_LOGICAL_UNIT_RESET:
1830 			tcm_function = TMR_LUN_RESET;
1831 			break;
1832 		case ISCSI_TM_FUNC_TARGET_WARM_RESET:
1833 			tcm_function = TMR_TARGET_WARM_RESET;
1834 			break;
1835 		case ISCSI_TM_FUNC_TARGET_COLD_RESET:
1836 			tcm_function = TMR_TARGET_COLD_RESET;
1837 			break;
1838 		default:
1839 			pr_err("Unknown iSCSI TMR Function:"
1840 			       " 0x%02x\n", function);
1841 			return iscsit_add_reject_cmd(cmd,
1842 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
1843 		}
1844 
1845 		ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req,
1846 					 tcm_function, GFP_KERNEL);
1847 		if (ret < 0)
1848 			return iscsit_add_reject_cmd(cmd,
1849 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
1850 
1851 		cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req;
1852 	}
1853 
1854 	cmd->iscsi_opcode	= ISCSI_OP_SCSI_TMFUNC;
1855 	cmd->i_state		= ISTATE_SEND_TASKMGTRSP;
1856 	cmd->immediate_cmd	= ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
1857 	cmd->init_task_tag	= hdr->itt;
1858 	cmd->targ_xfer_tag	= 0xFFFFFFFF;
1859 	cmd->cmd_sn		= be32_to_cpu(hdr->cmdsn);
1860 	cmd->exp_stat_sn	= be32_to_cpu(hdr->exp_statsn);
1861 	se_tmr			= cmd->se_cmd.se_tmr_req;
1862 	tmr_req			= cmd->tmr_req;
1863 	/*
1864 	 * Locate the struct se_lun for all TMRs not related to ERL=2 TASK_REASSIGN
1865 	 */
1866 	if (function != ISCSI_TM_FUNC_TASK_REASSIGN) {
1867 		ret = transport_lookup_tmr_lun(&cmd->se_cmd,
1868 					       scsilun_to_int(&hdr->lun));
1869 		if (ret < 0) {
1870 			se_tmr->response = ISCSI_TMF_RSP_NO_LUN;
1871 			goto attach;
1872 		}
1873 	}
1874 
1875 	switch (function) {
1876 	case ISCSI_TM_FUNC_ABORT_TASK:
1877 		se_tmr->response = iscsit_tmr_abort_task(cmd, buf);
1878 		if (se_tmr->response)
1879 			goto attach;
1880 		break;
1881 	case ISCSI_TM_FUNC_ABORT_TASK_SET:
1882 	case ISCSI_TM_FUNC_CLEAR_ACA:
1883 	case ISCSI_TM_FUNC_CLEAR_TASK_SET:
1884 	case ISCSI_TM_FUNC_LOGICAL_UNIT_RESET:
1885 		break;
1886 	case ISCSI_TM_FUNC_TARGET_WARM_RESET:
1887 		if (iscsit_tmr_task_warm_reset(conn, tmr_req, buf) < 0) {
1888 			se_tmr->response = ISCSI_TMF_RSP_AUTH_FAILED;
1889 			goto attach;
1890 		}
1891 		break;
1892 	case ISCSI_TM_FUNC_TARGET_COLD_RESET:
1893 		if (iscsit_tmr_task_cold_reset(conn, tmr_req, buf) < 0) {
1894 			se_tmr->response = ISCSI_TMF_RSP_AUTH_FAILED;
1895 			goto attach;
1896 		}
1897 		break;
1898 	case ISCSI_TM_FUNC_TASK_REASSIGN:
1899 		se_tmr->response = iscsit_tmr_task_reassign(cmd, buf);
1900 		/*
1901 		 * Perform sanity checks on the ExpDataSN only if the
1902 		 * TASK_REASSIGN was successful.
1903 		 */
1904 		if (se_tmr->response)
1905 			break;
1906 
1907 		if (iscsit_check_task_reassign_expdatasn(tmr_req, conn) < 0)
1908 			return iscsit_add_reject_cmd(cmd,
1909 					ISCSI_REASON_BOOKMARK_INVALID, buf);
1910 		break;
1911 	default:
1912 		pr_err("Unknown TMR function: 0x%02x, protocol"
1913 			" error.\n", function);
1914 		se_tmr->response = ISCSI_TMF_RSP_NOT_SUPPORTED;
1915 		goto attach;
1916 	}
1917 
1918 	if ((function != ISCSI_TM_FUNC_TASK_REASSIGN) &&
1919 	    (se_tmr->response == ISCSI_TMF_RSP_COMPLETE))
1920 		se_tmr->call_transport = 1;
1921 attach:
1922 	spin_lock_bh(&conn->cmd_lock);
1923 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
1924 	spin_unlock_bh(&conn->cmd_lock);
1925 
1926 	if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
1927 		int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
1928 		if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP)
1929 			out_of_order_cmdsn = 1;
1930 		else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
1931 			return 0;
1932 		else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
1933 			return -1;
1934 	}
1935 	iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
1936 
1937 	if (out_of_order_cmdsn || !(hdr->opcode & ISCSI_OP_IMMEDIATE))
1938 		return 0;
1939 	/*
1940 	 * Found the referenced task, send to transport for processing.
1941 	 */
1942 	if (se_tmr->call_transport)
1943 		return transport_generic_handle_tmr(&cmd->se_cmd);
1944 
1945 	/*
1946 	 * Could not find the referenced LUN, task, or Task Management
1947 	 * command not authorized or supported.  Change state and
1948 	 * let the tx_thread send the response.
1949 	 *
1950 	 * For connection recovery, this is also the default action for
1951 	 * TMR TASK_REASSIGN.
1952 	 */
1953 	if (sess_ref) {
1954 		pr_debug("Handle TMR, using sess_ref=true check\n");
1955 		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
1956 	}
1957 
1958 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
1959 	return 0;
1960 }
1961 EXPORT_SYMBOL(iscsit_handle_task_mgt_cmd);
1962 
1963 /* #warning FIXME: Support Text Command parameters besides SendTargets */
1964 int
1965 iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
1966 		      struct iscsi_text *hdr)
1967 {
1968 	u32 payload_length = ntoh24(hdr->dlength);
1969 
1970 	if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
1971 		pr_err("Unable to accept text parameter length: %u"
1972 			"greater than MaxXmitDataSegmentLength %u.\n",
1973 		       payload_length, conn->conn_ops->MaxXmitDataSegmentLength);
1974 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
1975 					 (unsigned char *)hdr);
1976 	}
1977 
1978 	if (!(hdr->flags & ISCSI_FLAG_CMD_FINAL) ||
1979 	     (hdr->flags & ISCSI_FLAG_TEXT_CONTINUE)) {
1980 		pr_err("Multi sequence text commands currently not supported\n");
1981 		return iscsit_reject_cmd(cmd, ISCSI_REASON_CMD_NOT_SUPPORTED,
1982 					(unsigned char *)hdr);
1983 	}
1984 
1985 	pr_debug("Got Text Request: ITT: 0x%08x, CmdSN: 0x%08x,"
1986 		" ExpStatSN: 0x%08x, Length: %u\n", hdr->itt, hdr->cmdsn,
1987 		hdr->exp_statsn, payload_length);
1988 
1989 	cmd->iscsi_opcode	= ISCSI_OP_TEXT;
1990 	cmd->i_state		= ISTATE_SEND_TEXTRSP;
1991 	cmd->immediate_cmd	= ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
1992 	conn->sess->init_task_tag = cmd->init_task_tag  = hdr->itt;
1993 	cmd->targ_xfer_tag	= 0xFFFFFFFF;
1994 	cmd->cmd_sn		= be32_to_cpu(hdr->cmdsn);
1995 	cmd->exp_stat_sn	= be32_to_cpu(hdr->exp_statsn);
1996 	cmd->data_direction	= DMA_NONE;
1997 
1998 	return 0;
1999 }
2000 EXPORT_SYMBOL(iscsit_setup_text_cmd);
2001 
2002 int
2003 iscsit_process_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
2004 			struct iscsi_text *hdr)
2005 {
2006 	unsigned char *text_in = cmd->text_in_ptr, *text_ptr;
2007 	int cmdsn_ret;
2008 
2009 	if (!text_in) {
2010 		pr_err("Unable to locate text_in buffer for sendtargets"
2011 		       " discovery\n");
2012 		goto reject;
2013 	}
2014 	if (strncmp("SendTargets", text_in, 11) != 0) {
2015 		pr_err("Received Text Data that is not"
2016 			" SendTargets, cannot continue.\n");
2017 		goto reject;
2018 	}
2019 	text_ptr = strchr(text_in, '=');
2020 	if (!text_ptr) {
2021 		pr_err("No \"=\" separator found in Text Data,"
2022 			"  cannot continue.\n");
2023 		goto reject;
2024 	}
2025 	if (!strncmp("=All", text_ptr, 4)) {
2026 		cmd->cmd_flags |= IFC_SENDTARGETS_ALL;
2027 	} else if (!strncmp("=iqn.", text_ptr, 5) ||
2028 		   !strncmp("=eui.", text_ptr, 5)) {
2029 		cmd->cmd_flags |= IFC_SENDTARGETS_SINGLE;
2030 	} else {
2031 		pr_err("Unable to locate valid SendTargets=%s value\n", text_ptr);
2032 		goto reject;
2033 	}
2034 
2035 	spin_lock_bh(&conn->cmd_lock);
2036 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
2037 	spin_unlock_bh(&conn->cmd_lock);
2038 
2039 	iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
2040 
2041 	if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
2042 		cmdsn_ret = iscsit_sequence_cmd(conn, cmd,
2043 				(unsigned char *)hdr, hdr->cmdsn);
2044 		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
2045 			return -1;
2046 
2047 		return 0;
2048 	}
2049 
2050 	return iscsit_execute_cmd(cmd, 0);
2051 
2052 reject:
2053 	return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
2054 				 (unsigned char *)hdr);
2055 }
2056 EXPORT_SYMBOL(iscsit_process_text_cmd);
2057 
2058 static int
2059 iscsit_handle_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
2060 		       unsigned char *buf)
2061 {
2062 	struct iscsi_text *hdr = (struct iscsi_text *)buf;
2063 	char *text_in = NULL;
2064 	u32 payload_length = ntoh24(hdr->dlength);
2065 	int rx_size, rc;
2066 
2067 	rc = iscsit_setup_text_cmd(conn, cmd, hdr);
2068 	if (rc < 0)
2069 		return 0;
2070 
2071 	rx_size = payload_length;
2072 	if (payload_length) {
2073 		u32 checksum = 0, data_crc = 0;
2074 		u32 padding = 0, pad_bytes = 0;
2075 		int niov = 0, rx_got;
2076 		struct kvec iov[3];
2077 
2078 		text_in = kzalloc(payload_length, GFP_KERNEL);
2079 		if (!text_in) {
2080 			pr_err("Unable to allocate memory for"
2081 				" incoming text parameters\n");
2082 			goto reject;
2083 		}
2084 		cmd->text_in_ptr = text_in;
2085 
2086 		memset(iov, 0, 3 * sizeof(struct kvec));
2087 		iov[niov].iov_base	= text_in;
2088 		iov[niov++].iov_len	= payload_length;
2089 
2090 		padding = ((-payload_length) & 3);
2091 		if (padding != 0) {
2092 			iov[niov].iov_base = &pad_bytes;
2093 			iov[niov++].iov_len  = padding;
2094 			rx_size += padding;
2095 			pr_debug("Receiving %u additional bytes"
2096 					" for padding.\n", padding);
2097 		}
2098 		if (conn->conn_ops->DataDigest) {
2099 			iov[niov].iov_base	= &checksum;
2100 			iov[niov++].iov_len	= ISCSI_CRC_LEN;
2101 			rx_size += ISCSI_CRC_LEN;
2102 		}
2103 
2104 		rx_got = rx_data(conn, &iov[0], niov, rx_size);
2105 		if (rx_got != rx_size)
2106 			goto reject;
2107 
2108 		if (conn->conn_ops->DataDigest) {
2109 			iscsit_do_crypto_hash_buf(&conn->conn_rx_hash,
2110 					text_in, payload_length,
2111 					padding, (u8 *)&pad_bytes,
2112 					(u8 *)&data_crc);
2113 
2114 			if (checksum != data_crc) {
2115 				pr_err("Text data CRC32C DataDigest"
2116 					" 0x%08x does not match computed"
2117 					" 0x%08x\n", checksum, data_crc);
2118 				if (!conn->sess->sess_ops->ErrorRecoveryLevel) {
2119 					pr_err("Unable to recover from"
2120 					" Text Data digest failure while in"
2121 						" ERL=0.\n");
2122 					goto reject;
2123 				} else {
2124 					/*
2125 					 * Silently drop this PDU and let the
2126 					 * initiator plug the CmdSN gap.
2127 					 */
2128 					pr_debug("Dropping Text"
2129 					" Command CmdSN: 0x%08x due to"
2130 					" DataCRC error.\n", hdr->cmdsn);
2131 					kfree(text_in);
2132 					return 0;
2133 				}
2134 			} else {
2135 				pr_debug("Got CRC32C DataDigest"
2136 					" 0x%08x for %u bytes of text data.\n",
2137 						checksum, payload_length);
2138 			}
2139 		}
2140 		text_in[payload_length - 1] = '\0';
2141 		pr_debug("Successfully read %d bytes of text"
2142 				" data.\n", payload_length);
2143 	}
2144 
2145 	return iscsit_process_text_cmd(conn, cmd, hdr);
2146 
2147 reject:
2148 	kfree(cmd->text_in_ptr);
2149 	cmd->text_in_ptr = NULL;
2150 	return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
2151 }
2152 EXPORT_SYMBOL(iscsit_handle_text_cmd);
2153 
2154 int iscsit_logout_closesession(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
2155 {
2156 	struct iscsi_conn *conn_p;
2157 	struct iscsi_session *sess = conn->sess;
2158 
2159 	pr_debug("Received logout request CLOSESESSION on CID: %hu"
2160 		" for SID: %u.\n", conn->cid, conn->sess->sid);
2161 
2162 	atomic_set(&sess->session_logout, 1);
2163 	atomic_set(&conn->conn_logout_remove, 1);
2164 	conn->conn_logout_reason = ISCSI_LOGOUT_REASON_CLOSE_SESSION;
2165 
2166 	iscsit_inc_conn_usage_count(conn);
2167 	iscsit_inc_session_usage_count(sess);
2168 
2169 	spin_lock_bh(&sess->conn_lock);
2170 	list_for_each_entry(conn_p, &sess->sess_conn_list, conn_list) {
2171 		if (conn_p->conn_state != TARG_CONN_STATE_LOGGED_IN)
2172 			continue;
2173 
2174 		pr_debug("Moving to TARG_CONN_STATE_IN_LOGOUT.\n");
2175 		conn_p->conn_state = TARG_CONN_STATE_IN_LOGOUT;
2176 	}
2177 	spin_unlock_bh(&sess->conn_lock);
2178 
2179 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
2180 
2181 	return 0;
2182 }
2183 
2184 int iscsit_logout_closeconnection(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
2185 {
2186 	struct iscsi_conn *l_conn;
2187 	struct iscsi_session *sess = conn->sess;
2188 
2189 	pr_debug("Received logout request CLOSECONNECTION for CID:"
2190 		" %hu on CID: %hu.\n", cmd->logout_cid, conn->cid);
2191 
2192 	/*
2193 	 * A Logout Request with a CLOSECONNECTION reason code for a CID
2194 	 * can arrive on a connection with a differing CID.
2195 	 */
2196 	if (conn->cid == cmd->logout_cid) {
2197 		spin_lock_bh(&conn->state_lock);
2198 		pr_debug("Moving to TARG_CONN_STATE_IN_LOGOUT.\n");
2199 		conn->conn_state = TARG_CONN_STATE_IN_LOGOUT;
2200 
2201 		atomic_set(&conn->conn_logout_remove, 1);
2202 		conn->conn_logout_reason = ISCSI_LOGOUT_REASON_CLOSE_CONNECTION;
2203 		iscsit_inc_conn_usage_count(conn);
2204 
2205 		spin_unlock_bh(&conn->state_lock);
2206 	} else {
2207 		/*
2208 		 * Handle all different cid CLOSECONNECTION requests in
2209 		 * iscsit_logout_post_handler_diffcid() as to give enough
2210 		 * time for any non immediate command's CmdSN to be
2211 		 * acknowledged on the connection in question.
2212 		 *
2213 		 * Here we simply make sure the CID is still around.
2214 		 */
2215 		l_conn = iscsit_get_conn_from_cid(sess,
2216 				cmd->logout_cid);
2217 		if (!l_conn) {
2218 			cmd->logout_response = ISCSI_LOGOUT_CID_NOT_FOUND;
2219 			iscsit_add_cmd_to_response_queue(cmd, conn,
2220 					cmd->i_state);
2221 			return 0;
2222 		}
2223 
2224 		iscsit_dec_conn_usage_count(l_conn);
2225 	}
2226 
2227 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
2228 
2229 	return 0;
2230 }
2231 
2232 int iscsit_logout_removeconnforrecovery(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
2233 {
2234 	struct iscsi_session *sess = conn->sess;
2235 
2236 	pr_debug("Received explicit REMOVECONNFORRECOVERY logout for"
2237 		" CID: %hu on CID: %hu.\n", cmd->logout_cid, conn->cid);
2238 
2239 	if (sess->sess_ops->ErrorRecoveryLevel != 2) {
2240 		pr_err("Received Logout Request REMOVECONNFORRECOVERY"
2241 			" while ERL!=2.\n");
2242 		cmd->logout_response = ISCSI_LOGOUT_RECOVERY_UNSUPPORTED;
2243 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
2244 		return 0;
2245 	}
2246 
2247 	if (conn->cid == cmd->logout_cid) {
2248 		pr_err("Received Logout Request REMOVECONNFORRECOVERY"
2249 			" with CID: %hu on CID: %hu, implementation error.\n",
2250 				cmd->logout_cid, conn->cid);
2251 		cmd->logout_response = ISCSI_LOGOUT_CLEANUP_FAILED;
2252 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
2253 		return 0;
2254 	}
2255 
2256 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
2257 
2258 	return 0;
2259 }
2260 
2261 int
2262 iscsit_handle_logout_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
2263 			unsigned char *buf)
2264 {
2265 	int cmdsn_ret, logout_remove = 0;
2266 	u8 reason_code = 0;
2267 	struct iscsi_logout *hdr;
2268 	struct iscsi_tiqn *tiqn = iscsit_snmp_get_tiqn(conn);
2269 
2270 	hdr			= (struct iscsi_logout *) buf;
2271 	reason_code		= (hdr->flags & 0x7f);
2272 
2273 	if (tiqn) {
2274 		spin_lock(&tiqn->logout_stats.lock);
2275 		if (reason_code == ISCSI_LOGOUT_REASON_CLOSE_SESSION)
2276 			tiqn->logout_stats.normal_logouts++;
2277 		else
2278 			tiqn->logout_stats.abnormal_logouts++;
2279 		spin_unlock(&tiqn->logout_stats.lock);
2280 	}
2281 
2282 	pr_debug("Got Logout Request ITT: 0x%08x CmdSN: 0x%08x"
2283 		" ExpStatSN: 0x%08x Reason: 0x%02x CID: %hu on CID: %hu\n",
2284 		hdr->itt, hdr->cmdsn, hdr->exp_statsn, reason_code,
2285 		hdr->cid, conn->cid);
2286 
2287 	if (conn->conn_state != TARG_CONN_STATE_LOGGED_IN) {
2288 		pr_err("Received logout request on connection that"
2289 			" is not in logged in state, ignoring request.\n");
2290 		iscsit_free_cmd(cmd, false);
2291 		return 0;
2292 	}
2293 
2294 	cmd->iscsi_opcode       = ISCSI_OP_LOGOUT;
2295 	cmd->i_state            = ISTATE_SEND_LOGOUTRSP;
2296 	cmd->immediate_cmd      = ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
2297 	conn->sess->init_task_tag = cmd->init_task_tag  = hdr->itt;
2298 	cmd->targ_xfer_tag      = 0xFFFFFFFF;
2299 	cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
2300 	cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
2301 	cmd->logout_cid         = be16_to_cpu(hdr->cid);
2302 	cmd->logout_reason      = reason_code;
2303 	cmd->data_direction     = DMA_NONE;
2304 
2305 	/*
2306 	 * We need to sleep in these cases (by returning 1) until the Logout
2307 	 * Response gets sent in the tx thread.
2308 	 */
2309 	if ((reason_code == ISCSI_LOGOUT_REASON_CLOSE_SESSION) ||
2310 	   ((reason_code == ISCSI_LOGOUT_REASON_CLOSE_CONNECTION) &&
2311 	    be16_to_cpu(hdr->cid) == conn->cid))
2312 		logout_remove = 1;
2313 
2314 	spin_lock_bh(&conn->cmd_lock);
2315 	list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
2316 	spin_unlock_bh(&conn->cmd_lock);
2317 
2318 	if (reason_code != ISCSI_LOGOUT_REASON_RECOVERY)
2319 		iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
2320 
2321 	/*
2322 	 * Immediate commands are executed, well, immediately.
2323 	 * Non-Immediate Logout Commands are executed in CmdSN order.
2324 	 */
2325 	if (cmd->immediate_cmd) {
2326 		int ret = iscsit_execute_cmd(cmd, 0);
2327 
2328 		if (ret < 0)
2329 			return ret;
2330 	} else {
2331 		cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
2332 		if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
2333 			logout_remove = 0;
2334 		else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
2335 			return -1;
2336 	}
2337 
2338 	return logout_remove;
2339 }
2340 EXPORT_SYMBOL(iscsit_handle_logout_cmd);
2341 
2342 static int iscsit_handle_snack(
2343 	struct iscsi_conn *conn,
2344 	unsigned char *buf)
2345 {
2346 	struct iscsi_snack *hdr;
2347 
2348 	hdr			= (struct iscsi_snack *) buf;
2349 	hdr->flags		&= ~ISCSI_FLAG_CMD_FINAL;
2350 
2351 	pr_debug("Got ISCSI_INIT_SNACK, ITT: 0x%08x, ExpStatSN:"
2352 		" 0x%08x, Type: 0x%02x, BegRun: 0x%08x, RunLength: 0x%08x,"
2353 		" CID: %hu\n", hdr->itt, hdr->exp_statsn, hdr->flags,
2354 			hdr->begrun, hdr->runlength, conn->cid);
2355 
2356 	if (!conn->sess->sess_ops->ErrorRecoveryLevel) {
2357 		pr_err("Initiator sent SNACK request while in"
2358 			" ErrorRecoveryLevel=0.\n");
2359 		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
2360 					 buf);
2361 	}
2362 	/*
2363 	 * SNACK_DATA and SNACK_R2T are both 0,  so check which function to
2364 	 * call from inside iscsi_send_recovery_datain_or_r2t().
2365 	 */
2366 	switch (hdr->flags & ISCSI_FLAG_SNACK_TYPE_MASK) {
2367 	case 0:
2368 		return iscsit_handle_recovery_datain_or_r2t(conn, buf,
2369 			hdr->itt,
2370 			be32_to_cpu(hdr->ttt),
2371 			be32_to_cpu(hdr->begrun),
2372 			be32_to_cpu(hdr->runlength));
2373 	case ISCSI_FLAG_SNACK_TYPE_STATUS:
2374 		return iscsit_handle_status_snack(conn, hdr->itt,
2375 			be32_to_cpu(hdr->ttt),
2376 			be32_to_cpu(hdr->begrun), be32_to_cpu(hdr->runlength));
2377 	case ISCSI_FLAG_SNACK_TYPE_DATA_ACK:
2378 		return iscsit_handle_data_ack(conn, be32_to_cpu(hdr->ttt),
2379 			be32_to_cpu(hdr->begrun),
2380 			be32_to_cpu(hdr->runlength));
2381 	case ISCSI_FLAG_SNACK_TYPE_RDATA:
2382 		/* FIXME: Support R-Data SNACK */
2383 		pr_err("R-Data SNACK Not Supported.\n");
2384 		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
2385 					 buf);
2386 	default:
2387 		pr_err("Unknown SNACK type 0x%02x, protocol"
2388 			" error.\n", hdr->flags & 0x0f);
2389 		return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
2390 					 buf);
2391 	}
2392 
2393 	return 0;
2394 }
2395 
2396 static void iscsit_rx_thread_wait_for_tcp(struct iscsi_conn *conn)
2397 {
2398 	if ((conn->sock->sk->sk_shutdown & SEND_SHUTDOWN) ||
2399 	    (conn->sock->sk->sk_shutdown & RCV_SHUTDOWN)) {
2400 		wait_for_completion_interruptible_timeout(
2401 					&conn->rx_half_close_comp,
2402 					ISCSI_RX_THREAD_TCP_TIMEOUT * HZ);
2403 	}
2404 }
2405 
2406 static int iscsit_handle_immediate_data(
2407 	struct iscsi_cmd *cmd,
2408 	struct iscsi_scsi_req *hdr,
2409 	u32 length)
2410 {
2411 	int iov_ret, rx_got = 0, rx_size = 0;
2412 	u32 checksum, iov_count = 0, padding = 0;
2413 	struct iscsi_conn *conn = cmd->conn;
2414 	struct kvec *iov;
2415 
2416 	iov_ret = iscsit_map_iovec(cmd, cmd->iov_data, cmd->write_data_done, length);
2417 	if (iov_ret < 0)
2418 		return IMMEDIATE_DATA_CANNOT_RECOVER;
2419 
2420 	rx_size = length;
2421 	iov_count = iov_ret;
2422 	iov = &cmd->iov_data[0];
2423 
2424 	padding = ((-length) & 3);
2425 	if (padding != 0) {
2426 		iov[iov_count].iov_base	= cmd->pad_bytes;
2427 		iov[iov_count++].iov_len = padding;
2428 		rx_size += padding;
2429 	}
2430 
2431 	if (conn->conn_ops->DataDigest) {
2432 		iov[iov_count].iov_base		= &checksum;
2433 		iov[iov_count++].iov_len	= ISCSI_CRC_LEN;
2434 		rx_size += ISCSI_CRC_LEN;
2435 	}
2436 
2437 	rx_got = rx_data(conn, &cmd->iov_data[0], iov_count, rx_size);
2438 
2439 	iscsit_unmap_iovec(cmd);
2440 
2441 	if (rx_got != rx_size) {
2442 		iscsit_rx_thread_wait_for_tcp(conn);
2443 		return IMMEDIATE_DATA_CANNOT_RECOVER;
2444 	}
2445 
2446 	if (conn->conn_ops->DataDigest) {
2447 		u32 data_crc;
2448 
2449 		data_crc = iscsit_do_crypto_hash_sg(&conn->conn_rx_hash, cmd,
2450 						    cmd->write_data_done, length, padding,
2451 						    cmd->pad_bytes);
2452 
2453 		if (checksum != data_crc) {
2454 			pr_err("ImmediateData CRC32C DataDigest 0x%08x"
2455 				" does not match computed 0x%08x\n", checksum,
2456 				data_crc);
2457 
2458 			if (!conn->sess->sess_ops->ErrorRecoveryLevel) {
2459 				pr_err("Unable to recover from"
2460 					" Immediate Data digest failure while"
2461 					" in ERL=0.\n");
2462 				iscsit_reject_cmd(cmd,
2463 						ISCSI_REASON_DATA_DIGEST_ERROR,
2464 						(unsigned char *)hdr);
2465 				return IMMEDIATE_DATA_CANNOT_RECOVER;
2466 			} else {
2467 				iscsit_reject_cmd(cmd,
2468 						ISCSI_REASON_DATA_DIGEST_ERROR,
2469 						(unsigned char *)hdr);
2470 				return IMMEDIATE_DATA_ERL1_CRC_FAILURE;
2471 			}
2472 		} else {
2473 			pr_debug("Got CRC32C DataDigest 0x%08x for"
2474 				" %u bytes of Immediate Data\n", checksum,
2475 				length);
2476 		}
2477 	}
2478 
2479 	cmd->write_data_done += length;
2480 
2481 	if (cmd->write_data_done == cmd->se_cmd.data_length) {
2482 		spin_lock_bh(&cmd->istate_lock);
2483 		cmd->cmd_flags |= ICF_GOT_LAST_DATAOUT;
2484 		cmd->i_state = ISTATE_RECEIVED_LAST_DATAOUT;
2485 		spin_unlock_bh(&cmd->istate_lock);
2486 	}
2487 
2488 	return IMMEDIATE_DATA_NORMAL_OPERATION;
2489 }
2490 
2491 /*
2492  *	Called with sess->conn_lock held.
2493  */
2494 /* #warning iscsi_build_conn_drop_async_message() only sends out on connections
2495 	with active network interface */
2496 static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn)
2497 {
2498 	struct iscsi_cmd *cmd;
2499 	struct iscsi_conn *conn_p;
2500 	bool found = false;
2501 
2502 	/*
2503 	 * Only send a Asynchronous Message on connections whos network
2504 	 * interface is still functional.
2505 	 */
2506 	list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) {
2507 		if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) {
2508 			iscsit_inc_conn_usage_count(conn_p);
2509 			found = true;
2510 			break;
2511 		}
2512 	}
2513 
2514 	if (!found)
2515 		return;
2516 
2517 	cmd = iscsit_allocate_cmd(conn_p, TASK_RUNNING);
2518 	if (!cmd) {
2519 		iscsit_dec_conn_usage_count(conn_p);
2520 		return;
2521 	}
2522 
2523 	cmd->logout_cid = conn->cid;
2524 	cmd->iscsi_opcode = ISCSI_OP_ASYNC_EVENT;
2525 	cmd->i_state = ISTATE_SEND_ASYNCMSG;
2526 
2527 	spin_lock_bh(&conn_p->cmd_lock);
2528 	list_add_tail(&cmd->i_conn_node, &conn_p->conn_cmd_list);
2529 	spin_unlock_bh(&conn_p->cmd_lock);
2530 
2531 	iscsit_add_cmd_to_response_queue(cmd, conn_p, cmd->i_state);
2532 	iscsit_dec_conn_usage_count(conn_p);
2533 }
2534 
2535 static int iscsit_send_conn_drop_async_message(
2536 	struct iscsi_cmd *cmd,
2537 	struct iscsi_conn *conn)
2538 {
2539 	struct iscsi_async *hdr;
2540 
2541 	cmd->tx_size = ISCSI_HDR_LEN;
2542 	cmd->iscsi_opcode = ISCSI_OP_ASYNC_EVENT;
2543 
2544 	hdr			= (struct iscsi_async *) cmd->pdu;
2545 	hdr->opcode		= ISCSI_OP_ASYNC_EVENT;
2546 	hdr->flags		= ISCSI_FLAG_CMD_FINAL;
2547 	cmd->init_task_tag	= RESERVED_ITT;
2548 	cmd->targ_xfer_tag	= 0xFFFFFFFF;
2549 	put_unaligned_be64(0xFFFFFFFFFFFFFFFFULL, &hdr->rsvd4[0]);
2550 	cmd->stat_sn		= conn->stat_sn++;
2551 	hdr->statsn		= cpu_to_be32(cmd->stat_sn);
2552 	hdr->exp_cmdsn		= cpu_to_be32(conn->sess->exp_cmd_sn);
2553 	hdr->max_cmdsn		= cpu_to_be32(conn->sess->max_cmd_sn);
2554 	hdr->async_event	= ISCSI_ASYNC_MSG_DROPPING_CONNECTION;
2555 	hdr->param1		= cpu_to_be16(cmd->logout_cid);
2556 	hdr->param2		= cpu_to_be16(conn->sess->sess_ops->DefaultTime2Wait);
2557 	hdr->param3		= cpu_to_be16(conn->sess->sess_ops->DefaultTime2Retain);
2558 
2559 	if (conn->conn_ops->HeaderDigest) {
2560 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
2561 
2562 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
2563 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
2564 
2565 		cmd->tx_size += ISCSI_CRC_LEN;
2566 		pr_debug("Attaching CRC32C HeaderDigest to"
2567 			" Async Message 0x%08x\n", *header_digest);
2568 	}
2569 
2570 	cmd->iov_misc[0].iov_base	= cmd->pdu;
2571 	cmd->iov_misc[0].iov_len	= cmd->tx_size;
2572 	cmd->iov_misc_count		= 1;
2573 
2574 	pr_debug("Sending Connection Dropped Async Message StatSN:"
2575 		" 0x%08x, for CID: %hu on CID: %hu\n", cmd->stat_sn,
2576 			cmd->logout_cid, conn->cid);
2577 	return 0;
2578 }
2579 
2580 static void iscsit_tx_thread_wait_for_tcp(struct iscsi_conn *conn)
2581 {
2582 	if ((conn->sock->sk->sk_shutdown & SEND_SHUTDOWN) ||
2583 	    (conn->sock->sk->sk_shutdown & RCV_SHUTDOWN)) {
2584 		wait_for_completion_interruptible_timeout(
2585 					&conn->tx_half_close_comp,
2586 					ISCSI_TX_THREAD_TCP_TIMEOUT * HZ);
2587 	}
2588 }
2589 
2590 static void
2591 iscsit_build_datain_pdu(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
2592 			struct iscsi_datain *datain, struct iscsi_data_rsp *hdr,
2593 			bool set_statsn)
2594 {
2595 	hdr->opcode		= ISCSI_OP_SCSI_DATA_IN;
2596 	hdr->flags		= datain->flags;
2597 	if (hdr->flags & ISCSI_FLAG_DATA_STATUS) {
2598 		if (cmd->se_cmd.se_cmd_flags & SCF_OVERFLOW_BIT) {
2599 			hdr->flags |= ISCSI_FLAG_DATA_OVERFLOW;
2600 			hdr->residual_count = cpu_to_be32(cmd->se_cmd.residual_count);
2601 		} else if (cmd->se_cmd.se_cmd_flags & SCF_UNDERFLOW_BIT) {
2602 			hdr->flags |= ISCSI_FLAG_DATA_UNDERFLOW;
2603 			hdr->residual_count = cpu_to_be32(cmd->se_cmd.residual_count);
2604 		}
2605 	}
2606 	hton24(hdr->dlength, datain->length);
2607 	if (hdr->flags & ISCSI_FLAG_DATA_ACK)
2608 		int_to_scsilun(cmd->se_cmd.orig_fe_lun,
2609 				(struct scsi_lun *)&hdr->lun);
2610 	else
2611 		put_unaligned_le64(0xFFFFFFFFFFFFFFFFULL, &hdr->lun);
2612 
2613 	hdr->itt		= cmd->init_task_tag;
2614 
2615 	if (hdr->flags & ISCSI_FLAG_DATA_ACK)
2616 		hdr->ttt		= cpu_to_be32(cmd->targ_xfer_tag);
2617 	else
2618 		hdr->ttt		= cpu_to_be32(0xFFFFFFFF);
2619 	if (set_statsn)
2620 		hdr->statsn		= cpu_to_be32(cmd->stat_sn);
2621 	else
2622 		hdr->statsn		= cpu_to_be32(0xFFFFFFFF);
2623 
2624 	hdr->exp_cmdsn		= cpu_to_be32(conn->sess->exp_cmd_sn);
2625 	hdr->max_cmdsn		= cpu_to_be32(conn->sess->max_cmd_sn);
2626 	hdr->datasn		= cpu_to_be32(datain->data_sn);
2627 	hdr->offset		= cpu_to_be32(datain->offset);
2628 
2629 	pr_debug("Built DataIN ITT: 0x%08x, StatSN: 0x%08x,"
2630 		" DataSN: 0x%08x, Offset: %u, Length: %u, CID: %hu\n",
2631 		cmd->init_task_tag, ntohl(hdr->statsn), ntohl(hdr->datasn),
2632 		ntohl(hdr->offset), datain->length, conn->cid);
2633 }
2634 
2635 static int iscsit_send_datain(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
2636 {
2637 	struct iscsi_data_rsp *hdr = (struct iscsi_data_rsp *)&cmd->pdu[0];
2638 	struct iscsi_datain datain;
2639 	struct iscsi_datain_req *dr;
2640 	struct kvec *iov;
2641 	u32 iov_count = 0, tx_size = 0;
2642 	int eodr = 0, ret, iov_ret;
2643 	bool set_statsn = false;
2644 
2645 	memset(&datain, 0, sizeof(struct iscsi_datain));
2646 	dr = iscsit_get_datain_values(cmd, &datain);
2647 	if (!dr) {
2648 		pr_err("iscsit_get_datain_values failed for ITT: 0x%08x\n",
2649 				cmd->init_task_tag);
2650 		return -1;
2651 	}
2652 	/*
2653 	 * Be paranoid and double check the logic for now.
2654 	 */
2655 	if ((datain.offset + datain.length) > cmd->se_cmd.data_length) {
2656 		pr_err("Command ITT: 0x%08x, datain.offset: %u and"
2657 			" datain.length: %u exceeds cmd->data_length: %u\n",
2658 			cmd->init_task_tag, datain.offset, datain.length,
2659 			cmd->se_cmd.data_length);
2660 		return -1;
2661 	}
2662 
2663 	atomic_long_add(datain.length, &conn->sess->tx_data_octets);
2664 	/*
2665 	 * Special case for successfully execution w/ both DATAIN
2666 	 * and Sense Data.
2667 	 */
2668 	if ((datain.flags & ISCSI_FLAG_DATA_STATUS) &&
2669 	    (cmd->se_cmd.se_cmd_flags & SCF_TRANSPORT_TASK_SENSE))
2670 		datain.flags &= ~ISCSI_FLAG_DATA_STATUS;
2671 	else {
2672 		if ((dr->dr_complete == DATAIN_COMPLETE_NORMAL) ||
2673 		    (dr->dr_complete == DATAIN_COMPLETE_CONNECTION_RECOVERY)) {
2674 			iscsit_increment_maxcmdsn(cmd, conn->sess);
2675 			cmd->stat_sn = conn->stat_sn++;
2676 			set_statsn = true;
2677 		} else if (dr->dr_complete ==
2678 			   DATAIN_COMPLETE_WITHIN_COMMAND_RECOVERY)
2679 			set_statsn = true;
2680 	}
2681 
2682 	iscsit_build_datain_pdu(cmd, conn, &datain, hdr, set_statsn);
2683 
2684 	iov = &cmd->iov_data[0];
2685 	iov[iov_count].iov_base	= cmd->pdu;
2686 	iov[iov_count++].iov_len	= ISCSI_HDR_LEN;
2687 	tx_size += ISCSI_HDR_LEN;
2688 
2689 	if (conn->conn_ops->HeaderDigest) {
2690 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
2691 
2692 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, cmd->pdu,
2693 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
2694 
2695 		iov[0].iov_len += ISCSI_CRC_LEN;
2696 		tx_size += ISCSI_CRC_LEN;
2697 
2698 		pr_debug("Attaching CRC32 HeaderDigest"
2699 			" for DataIN PDU 0x%08x\n", *header_digest);
2700 	}
2701 
2702 	iov_ret = iscsit_map_iovec(cmd, &cmd->iov_data[1],
2703 				datain.offset, datain.length);
2704 	if (iov_ret < 0)
2705 		return -1;
2706 
2707 	iov_count += iov_ret;
2708 	tx_size += datain.length;
2709 
2710 	cmd->padding = ((-datain.length) & 3);
2711 	if (cmd->padding) {
2712 		iov[iov_count].iov_base		= cmd->pad_bytes;
2713 		iov[iov_count++].iov_len	= cmd->padding;
2714 		tx_size += cmd->padding;
2715 
2716 		pr_debug("Attaching %u padding bytes\n",
2717 				cmd->padding);
2718 	}
2719 	if (conn->conn_ops->DataDigest) {
2720 		cmd->data_crc = iscsit_do_crypto_hash_sg(&conn->conn_tx_hash, cmd,
2721 			 datain.offset, datain.length, cmd->padding, cmd->pad_bytes);
2722 
2723 		iov[iov_count].iov_base	= &cmd->data_crc;
2724 		iov[iov_count++].iov_len = ISCSI_CRC_LEN;
2725 		tx_size += ISCSI_CRC_LEN;
2726 
2727 		pr_debug("Attached CRC32C DataDigest %d bytes, crc"
2728 			" 0x%08x\n", datain.length+cmd->padding, cmd->data_crc);
2729 	}
2730 
2731 	cmd->iov_data_count = iov_count;
2732 	cmd->tx_size = tx_size;
2733 
2734 	/* sendpage is preferred but can't insert markers */
2735 	if (!conn->conn_ops->IFMarker)
2736 		ret = iscsit_fe_sendpage_sg(cmd, conn);
2737 	else
2738 		ret = iscsit_send_tx_data(cmd, conn, 0);
2739 
2740 	iscsit_unmap_iovec(cmd);
2741 
2742 	if (ret < 0) {
2743 		iscsit_tx_thread_wait_for_tcp(conn);
2744 		return ret;
2745 	}
2746 
2747 	if (dr->dr_complete) {
2748 		eodr = (cmd->se_cmd.se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) ?
2749 				2 : 1;
2750 		iscsit_free_datain_req(cmd, dr);
2751 	}
2752 
2753 	return eodr;
2754 }
2755 
2756 int
2757 iscsit_build_logout_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
2758 			struct iscsi_logout_rsp *hdr)
2759 {
2760 	struct iscsi_conn *logout_conn = NULL;
2761 	struct iscsi_conn_recovery *cr = NULL;
2762 	struct iscsi_session *sess = conn->sess;
2763 	/*
2764 	 * The actual shutting down of Sessions and/or Connections
2765 	 * for CLOSESESSION and CLOSECONNECTION Logout Requests
2766 	 * is done in scsi_logout_post_handler().
2767 	 */
2768 	switch (cmd->logout_reason) {
2769 	case ISCSI_LOGOUT_REASON_CLOSE_SESSION:
2770 		pr_debug("iSCSI session logout successful, setting"
2771 			" logout response to ISCSI_LOGOUT_SUCCESS.\n");
2772 		cmd->logout_response = ISCSI_LOGOUT_SUCCESS;
2773 		break;
2774 	case ISCSI_LOGOUT_REASON_CLOSE_CONNECTION:
2775 		if (cmd->logout_response == ISCSI_LOGOUT_CID_NOT_FOUND)
2776 			break;
2777 		/*
2778 		 * For CLOSECONNECTION logout requests carrying
2779 		 * a matching logout CID -> local CID, the reference
2780 		 * for the local CID will have been incremented in
2781 		 * iscsi_logout_closeconnection().
2782 		 *
2783 		 * For CLOSECONNECTION logout requests carrying
2784 		 * a different CID than the connection it arrived
2785 		 * on, the connection responding to cmd->logout_cid
2786 		 * is stopped in iscsit_logout_post_handler_diffcid().
2787 		 */
2788 
2789 		pr_debug("iSCSI CID: %hu logout on CID: %hu"
2790 			" successful.\n", cmd->logout_cid, conn->cid);
2791 		cmd->logout_response = ISCSI_LOGOUT_SUCCESS;
2792 		break;
2793 	case ISCSI_LOGOUT_REASON_RECOVERY:
2794 		if ((cmd->logout_response == ISCSI_LOGOUT_RECOVERY_UNSUPPORTED) ||
2795 		    (cmd->logout_response == ISCSI_LOGOUT_CLEANUP_FAILED))
2796 			break;
2797 		/*
2798 		 * If the connection is still active from our point of view
2799 		 * force connection recovery to occur.
2800 		 */
2801 		logout_conn = iscsit_get_conn_from_cid_rcfr(sess,
2802 				cmd->logout_cid);
2803 		if (logout_conn) {
2804 			iscsit_connection_reinstatement_rcfr(logout_conn);
2805 			iscsit_dec_conn_usage_count(logout_conn);
2806 		}
2807 
2808 		cr = iscsit_get_inactive_connection_recovery_entry(
2809 				conn->sess, cmd->logout_cid);
2810 		if (!cr) {
2811 			pr_err("Unable to locate CID: %hu for"
2812 			" REMOVECONNFORRECOVERY Logout Request.\n",
2813 				cmd->logout_cid);
2814 			cmd->logout_response = ISCSI_LOGOUT_CID_NOT_FOUND;
2815 			break;
2816 		}
2817 
2818 		iscsit_discard_cr_cmds_by_expstatsn(cr, cmd->exp_stat_sn);
2819 
2820 		pr_debug("iSCSI REMOVECONNFORRECOVERY logout"
2821 			" for recovery for CID: %hu on CID: %hu successful.\n",
2822 				cmd->logout_cid, conn->cid);
2823 		cmd->logout_response = ISCSI_LOGOUT_SUCCESS;
2824 		break;
2825 	default:
2826 		pr_err("Unknown cmd->logout_reason: 0x%02x\n",
2827 				cmd->logout_reason);
2828 		return -1;
2829 	}
2830 
2831 	hdr->opcode		= ISCSI_OP_LOGOUT_RSP;
2832 	hdr->flags		|= ISCSI_FLAG_CMD_FINAL;
2833 	hdr->response		= cmd->logout_response;
2834 	hdr->itt		= cmd->init_task_tag;
2835 	cmd->stat_sn		= conn->stat_sn++;
2836 	hdr->statsn		= cpu_to_be32(cmd->stat_sn);
2837 
2838 	iscsit_increment_maxcmdsn(cmd, conn->sess);
2839 	hdr->exp_cmdsn		= cpu_to_be32(conn->sess->exp_cmd_sn);
2840 	hdr->max_cmdsn		= cpu_to_be32(conn->sess->max_cmd_sn);
2841 
2842 	pr_debug("Built Logout Response ITT: 0x%08x StatSN:"
2843 		" 0x%08x Response: 0x%02x CID: %hu on CID: %hu\n",
2844 		cmd->init_task_tag, cmd->stat_sn, hdr->response,
2845 		cmd->logout_cid, conn->cid);
2846 
2847 	return 0;
2848 }
2849 EXPORT_SYMBOL(iscsit_build_logout_rsp);
2850 
2851 static int
2852 iscsit_send_logout(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
2853 {
2854 	struct kvec *iov;
2855 	int niov = 0, tx_size, rc;
2856 
2857 	rc = iscsit_build_logout_rsp(cmd, conn,
2858 			(struct iscsi_logout_rsp *)&cmd->pdu[0]);
2859 	if (rc < 0)
2860 		return rc;
2861 
2862 	tx_size = ISCSI_HDR_LEN;
2863 	iov = &cmd->iov_misc[0];
2864 	iov[niov].iov_base	= cmd->pdu;
2865 	iov[niov++].iov_len	= ISCSI_HDR_LEN;
2866 
2867 	if (conn->conn_ops->HeaderDigest) {
2868 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
2869 
2870 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, &cmd->pdu[0],
2871 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
2872 
2873 		iov[0].iov_len += ISCSI_CRC_LEN;
2874 		tx_size += ISCSI_CRC_LEN;
2875 		pr_debug("Attaching CRC32C HeaderDigest to"
2876 			" Logout Response 0x%08x\n", *header_digest);
2877 	}
2878 	cmd->iov_misc_count = niov;
2879 	cmd->tx_size = tx_size;
2880 
2881 	return 0;
2882 }
2883 
2884 void
2885 iscsit_build_nopin_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
2886 		       struct iscsi_nopin *hdr, bool nopout_response)
2887 {
2888 	hdr->opcode		= ISCSI_OP_NOOP_IN;
2889 	hdr->flags		|= ISCSI_FLAG_CMD_FINAL;
2890         hton24(hdr->dlength, cmd->buf_ptr_size);
2891 	if (nopout_response)
2892 		put_unaligned_le64(0xFFFFFFFFFFFFFFFFULL, &hdr->lun);
2893 	hdr->itt		= cmd->init_task_tag;
2894 	hdr->ttt		= cpu_to_be32(cmd->targ_xfer_tag);
2895 	cmd->stat_sn		= (nopout_response) ? conn->stat_sn++ :
2896 				  conn->stat_sn;
2897 	hdr->statsn		= cpu_to_be32(cmd->stat_sn);
2898 
2899 	if (nopout_response)
2900 		iscsit_increment_maxcmdsn(cmd, conn->sess);
2901 
2902 	hdr->exp_cmdsn		= cpu_to_be32(conn->sess->exp_cmd_sn);
2903 	hdr->max_cmdsn		= cpu_to_be32(conn->sess->max_cmd_sn);
2904 
2905 	pr_debug("Built NOPIN %s Response ITT: 0x%08x, TTT: 0x%08x,"
2906 		" StatSN: 0x%08x, Length %u\n", (nopout_response) ?
2907 		"Solicitied" : "Unsolicitied", cmd->init_task_tag,
2908 		cmd->targ_xfer_tag, cmd->stat_sn, cmd->buf_ptr_size);
2909 }
2910 EXPORT_SYMBOL(iscsit_build_nopin_rsp);
2911 
2912 /*
2913  *	Unsolicited NOPIN, either requesting a response or not.
2914  */
2915 static int iscsit_send_unsolicited_nopin(
2916 	struct iscsi_cmd *cmd,
2917 	struct iscsi_conn *conn,
2918 	int want_response)
2919 {
2920 	struct iscsi_nopin *hdr = (struct iscsi_nopin *)&cmd->pdu[0];
2921 	int tx_size = ISCSI_HDR_LEN, ret;
2922 
2923 	iscsit_build_nopin_rsp(cmd, conn, hdr, false);
2924 
2925 	if (conn->conn_ops->HeaderDigest) {
2926 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
2927 
2928 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
2929 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
2930 
2931 		tx_size += ISCSI_CRC_LEN;
2932 		pr_debug("Attaching CRC32C HeaderDigest to"
2933 			" NopIN 0x%08x\n", *header_digest);
2934 	}
2935 
2936 	cmd->iov_misc[0].iov_base	= cmd->pdu;
2937 	cmd->iov_misc[0].iov_len	= tx_size;
2938 	cmd->iov_misc_count	= 1;
2939 	cmd->tx_size		= tx_size;
2940 
2941 	pr_debug("Sending Unsolicited NOPIN TTT: 0x%08x StatSN:"
2942 		" 0x%08x CID: %hu\n", hdr->ttt, cmd->stat_sn, conn->cid);
2943 
2944 	ret = iscsit_send_tx_data(cmd, conn, 1);
2945 	if (ret < 0) {
2946 		iscsit_tx_thread_wait_for_tcp(conn);
2947 		return ret;
2948 	}
2949 
2950 	spin_lock_bh(&cmd->istate_lock);
2951 	cmd->i_state = want_response ?
2952 		ISTATE_SENT_NOPIN_WANT_RESPONSE : ISTATE_SENT_STATUS;
2953 	spin_unlock_bh(&cmd->istate_lock);
2954 
2955 	return 0;
2956 }
2957 
2958 static int
2959 iscsit_send_nopin(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
2960 {
2961 	struct iscsi_nopin *hdr = (struct iscsi_nopin *)&cmd->pdu[0];
2962 	struct kvec *iov;
2963 	u32 padding = 0;
2964 	int niov = 0, tx_size;
2965 
2966 	iscsit_build_nopin_rsp(cmd, conn, hdr, true);
2967 
2968 	tx_size = ISCSI_HDR_LEN;
2969 	iov = &cmd->iov_misc[0];
2970 	iov[niov].iov_base	= cmd->pdu;
2971 	iov[niov++].iov_len	= ISCSI_HDR_LEN;
2972 
2973 	if (conn->conn_ops->HeaderDigest) {
2974 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
2975 
2976 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
2977 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
2978 
2979 		iov[0].iov_len += ISCSI_CRC_LEN;
2980 		tx_size += ISCSI_CRC_LEN;
2981 		pr_debug("Attaching CRC32C HeaderDigest"
2982 			" to NopIn 0x%08x\n", *header_digest);
2983 	}
2984 
2985 	/*
2986 	 * NOPOUT Ping Data is attached to struct iscsi_cmd->buf_ptr.
2987 	 * NOPOUT DataSegmentLength is at struct iscsi_cmd->buf_ptr_size.
2988 	 */
2989 	if (cmd->buf_ptr_size) {
2990 		iov[niov].iov_base	= cmd->buf_ptr;
2991 		iov[niov++].iov_len	= cmd->buf_ptr_size;
2992 		tx_size += cmd->buf_ptr_size;
2993 
2994 		pr_debug("Echoing back %u bytes of ping"
2995 			" data.\n", cmd->buf_ptr_size);
2996 
2997 		padding = ((-cmd->buf_ptr_size) & 3);
2998 		if (padding != 0) {
2999 			iov[niov].iov_base = &cmd->pad_bytes;
3000 			iov[niov++].iov_len = padding;
3001 			tx_size += padding;
3002 			pr_debug("Attaching %u additional"
3003 				" padding bytes.\n", padding);
3004 		}
3005 		if (conn->conn_ops->DataDigest) {
3006 			iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
3007 				cmd->buf_ptr, cmd->buf_ptr_size,
3008 				padding, (u8 *)&cmd->pad_bytes,
3009 				(u8 *)&cmd->data_crc);
3010 
3011 			iov[niov].iov_base = &cmd->data_crc;
3012 			iov[niov++].iov_len = ISCSI_CRC_LEN;
3013 			tx_size += ISCSI_CRC_LEN;
3014 			pr_debug("Attached DataDigest for %u"
3015 				" bytes of ping data, CRC 0x%08x\n",
3016 				cmd->buf_ptr_size, cmd->data_crc);
3017 		}
3018 	}
3019 
3020 	cmd->iov_misc_count = niov;
3021 	cmd->tx_size = tx_size;
3022 
3023 	return 0;
3024 }
3025 
3026 static int iscsit_send_r2t(
3027 	struct iscsi_cmd *cmd,
3028 	struct iscsi_conn *conn)
3029 {
3030 	int tx_size = 0;
3031 	struct iscsi_r2t *r2t;
3032 	struct iscsi_r2t_rsp *hdr;
3033 	int ret;
3034 
3035 	r2t = iscsit_get_r2t_from_list(cmd);
3036 	if (!r2t)
3037 		return -1;
3038 
3039 	hdr			= (struct iscsi_r2t_rsp *) cmd->pdu;
3040 	memset(hdr, 0, ISCSI_HDR_LEN);
3041 	hdr->opcode		= ISCSI_OP_R2T;
3042 	hdr->flags		|= ISCSI_FLAG_CMD_FINAL;
3043 	int_to_scsilun(cmd->se_cmd.orig_fe_lun,
3044 			(struct scsi_lun *)&hdr->lun);
3045 	hdr->itt		= cmd->init_task_tag;
3046 	spin_lock_bh(&conn->sess->ttt_lock);
3047 	r2t->targ_xfer_tag	= conn->sess->targ_xfer_tag++;
3048 	if (r2t->targ_xfer_tag == 0xFFFFFFFF)
3049 		r2t->targ_xfer_tag = conn->sess->targ_xfer_tag++;
3050 	spin_unlock_bh(&conn->sess->ttt_lock);
3051 	hdr->ttt		= cpu_to_be32(r2t->targ_xfer_tag);
3052 	hdr->statsn		= cpu_to_be32(conn->stat_sn);
3053 	hdr->exp_cmdsn		= cpu_to_be32(conn->sess->exp_cmd_sn);
3054 	hdr->max_cmdsn		= cpu_to_be32(conn->sess->max_cmd_sn);
3055 	hdr->r2tsn		= cpu_to_be32(r2t->r2t_sn);
3056 	hdr->data_offset	= cpu_to_be32(r2t->offset);
3057 	hdr->data_length	= cpu_to_be32(r2t->xfer_len);
3058 
3059 	cmd->iov_misc[0].iov_base	= cmd->pdu;
3060 	cmd->iov_misc[0].iov_len	= ISCSI_HDR_LEN;
3061 	tx_size += ISCSI_HDR_LEN;
3062 
3063 	if (conn->conn_ops->HeaderDigest) {
3064 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
3065 
3066 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
3067 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
3068 
3069 		cmd->iov_misc[0].iov_len += ISCSI_CRC_LEN;
3070 		tx_size += ISCSI_CRC_LEN;
3071 		pr_debug("Attaching CRC32 HeaderDigest for R2T"
3072 			" PDU 0x%08x\n", *header_digest);
3073 	}
3074 
3075 	pr_debug("Built %sR2T, ITT: 0x%08x, TTT: 0x%08x, StatSN:"
3076 		" 0x%08x, R2TSN: 0x%08x, Offset: %u, DDTL: %u, CID: %hu\n",
3077 		(!r2t->recovery_r2t) ? "" : "Recovery ", cmd->init_task_tag,
3078 		r2t->targ_xfer_tag, ntohl(hdr->statsn), r2t->r2t_sn,
3079 			r2t->offset, r2t->xfer_len, conn->cid);
3080 
3081 	cmd->iov_misc_count = 1;
3082 	cmd->tx_size = tx_size;
3083 
3084 	spin_lock_bh(&cmd->r2t_lock);
3085 	r2t->sent_r2t = 1;
3086 	spin_unlock_bh(&cmd->r2t_lock);
3087 
3088 	ret = iscsit_send_tx_data(cmd, conn, 1);
3089 	if (ret < 0) {
3090 		iscsit_tx_thread_wait_for_tcp(conn);
3091 		return ret;
3092 	}
3093 
3094 	spin_lock_bh(&cmd->dataout_timeout_lock);
3095 	iscsit_start_dataout_timer(cmd, conn);
3096 	spin_unlock_bh(&cmd->dataout_timeout_lock);
3097 
3098 	return 0;
3099 }
3100 
3101 /*
3102  *	@recovery: If called from iscsi_task_reassign_complete_write() for
3103  *		connection recovery.
3104  */
3105 int iscsit_build_r2ts_for_cmd(
3106 	struct iscsi_conn *conn,
3107 	struct iscsi_cmd *cmd,
3108 	bool recovery)
3109 {
3110 	int first_r2t = 1;
3111 	u32 offset = 0, xfer_len = 0;
3112 
3113 	spin_lock_bh(&cmd->r2t_lock);
3114 	if (cmd->cmd_flags & ICF_SENT_LAST_R2T) {
3115 		spin_unlock_bh(&cmd->r2t_lock);
3116 		return 0;
3117 	}
3118 
3119 	if (conn->sess->sess_ops->DataSequenceInOrder &&
3120 	    !recovery)
3121 		cmd->r2t_offset = max(cmd->r2t_offset, cmd->write_data_done);
3122 
3123 	while (cmd->outstanding_r2ts < conn->sess->sess_ops->MaxOutstandingR2T) {
3124 		if (conn->sess->sess_ops->DataSequenceInOrder) {
3125 			offset = cmd->r2t_offset;
3126 
3127 			if (first_r2t && recovery) {
3128 				int new_data_end = offset +
3129 					conn->sess->sess_ops->MaxBurstLength -
3130 					cmd->next_burst_len;
3131 
3132 				if (new_data_end > cmd->se_cmd.data_length)
3133 					xfer_len = cmd->se_cmd.data_length - offset;
3134 				else
3135 					xfer_len =
3136 						conn->sess->sess_ops->MaxBurstLength -
3137 						cmd->next_burst_len;
3138 			} else {
3139 				int new_data_end = offset +
3140 					conn->sess->sess_ops->MaxBurstLength;
3141 
3142 				if (new_data_end > cmd->se_cmd.data_length)
3143 					xfer_len = cmd->se_cmd.data_length - offset;
3144 				else
3145 					xfer_len = conn->sess->sess_ops->MaxBurstLength;
3146 			}
3147 			cmd->r2t_offset += xfer_len;
3148 
3149 			if (cmd->r2t_offset == cmd->se_cmd.data_length)
3150 				cmd->cmd_flags |= ICF_SENT_LAST_R2T;
3151 		} else {
3152 			struct iscsi_seq *seq;
3153 
3154 			seq = iscsit_get_seq_holder_for_r2t(cmd);
3155 			if (!seq) {
3156 				spin_unlock_bh(&cmd->r2t_lock);
3157 				return -1;
3158 			}
3159 
3160 			offset = seq->offset;
3161 			xfer_len = seq->xfer_len;
3162 
3163 			if (cmd->seq_send_order == cmd->seq_count)
3164 				cmd->cmd_flags |= ICF_SENT_LAST_R2T;
3165 		}
3166 		cmd->outstanding_r2ts++;
3167 		first_r2t = 0;
3168 
3169 		if (iscsit_add_r2t_to_list(cmd, offset, xfer_len, 0, 0) < 0) {
3170 			spin_unlock_bh(&cmd->r2t_lock);
3171 			return -1;
3172 		}
3173 
3174 		if (cmd->cmd_flags & ICF_SENT_LAST_R2T)
3175 			break;
3176 	}
3177 	spin_unlock_bh(&cmd->r2t_lock);
3178 
3179 	return 0;
3180 }
3181 
3182 void iscsit_build_rsp_pdu(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
3183 			bool inc_stat_sn, struct iscsi_scsi_rsp *hdr)
3184 {
3185 	if (inc_stat_sn)
3186 		cmd->stat_sn = conn->stat_sn++;
3187 
3188 	atomic_long_inc(&conn->sess->rsp_pdus);
3189 
3190 	memset(hdr, 0, ISCSI_HDR_LEN);
3191 	hdr->opcode		= ISCSI_OP_SCSI_CMD_RSP;
3192 	hdr->flags		|= ISCSI_FLAG_CMD_FINAL;
3193 	if (cmd->se_cmd.se_cmd_flags & SCF_OVERFLOW_BIT) {
3194 		hdr->flags |= ISCSI_FLAG_CMD_OVERFLOW;
3195 		hdr->residual_count = cpu_to_be32(cmd->se_cmd.residual_count);
3196 	} else if (cmd->se_cmd.se_cmd_flags & SCF_UNDERFLOW_BIT) {
3197 		hdr->flags |= ISCSI_FLAG_CMD_UNDERFLOW;
3198 		hdr->residual_count = cpu_to_be32(cmd->se_cmd.residual_count);
3199 	}
3200 	hdr->response		= cmd->iscsi_response;
3201 	hdr->cmd_status		= cmd->se_cmd.scsi_status;
3202 	hdr->itt		= cmd->init_task_tag;
3203 	hdr->statsn		= cpu_to_be32(cmd->stat_sn);
3204 
3205 	iscsit_increment_maxcmdsn(cmd, conn->sess);
3206 	hdr->exp_cmdsn		= cpu_to_be32(conn->sess->exp_cmd_sn);
3207 	hdr->max_cmdsn		= cpu_to_be32(conn->sess->max_cmd_sn);
3208 
3209 	pr_debug("Built SCSI Response, ITT: 0x%08x, StatSN: 0x%08x,"
3210 		" Response: 0x%02x, SAM Status: 0x%02x, CID: %hu\n",
3211 		cmd->init_task_tag, cmd->stat_sn, cmd->se_cmd.scsi_status,
3212 		cmd->se_cmd.scsi_status, conn->cid);
3213 }
3214 EXPORT_SYMBOL(iscsit_build_rsp_pdu);
3215 
3216 static int iscsit_send_response(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
3217 {
3218 	struct iscsi_scsi_rsp *hdr = (struct iscsi_scsi_rsp *)&cmd->pdu[0];
3219 	struct kvec *iov;
3220 	u32 padding = 0, tx_size = 0;
3221 	int iov_count = 0;
3222 	bool inc_stat_sn = (cmd->i_state == ISTATE_SEND_STATUS);
3223 
3224 	iscsit_build_rsp_pdu(cmd, conn, inc_stat_sn, hdr);
3225 
3226 	iov = &cmd->iov_misc[0];
3227 	iov[iov_count].iov_base	= cmd->pdu;
3228 	iov[iov_count++].iov_len = ISCSI_HDR_LEN;
3229 	tx_size += ISCSI_HDR_LEN;
3230 
3231 	/*
3232 	 * Attach SENSE DATA payload to iSCSI Response PDU
3233 	 */
3234 	if (cmd->se_cmd.sense_buffer &&
3235 	   ((cmd->se_cmd.se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) ||
3236 	    (cmd->se_cmd.se_cmd_flags & SCF_EMULATED_TASK_SENSE))) {
3237 		put_unaligned_be16(cmd->se_cmd.scsi_sense_length, cmd->sense_buffer);
3238 		cmd->se_cmd.scsi_sense_length += sizeof (__be16);
3239 
3240 		padding		= -(cmd->se_cmd.scsi_sense_length) & 3;
3241 		hton24(hdr->dlength, (u32)cmd->se_cmd.scsi_sense_length);
3242 		iov[iov_count].iov_base	= cmd->sense_buffer;
3243 		iov[iov_count++].iov_len =
3244 				(cmd->se_cmd.scsi_sense_length + padding);
3245 		tx_size += cmd->se_cmd.scsi_sense_length;
3246 
3247 		if (padding) {
3248 			memset(cmd->sense_buffer +
3249 				cmd->se_cmd.scsi_sense_length, 0, padding);
3250 			tx_size += padding;
3251 			pr_debug("Adding %u bytes of padding to"
3252 				" SENSE.\n", padding);
3253 		}
3254 
3255 		if (conn->conn_ops->DataDigest) {
3256 			iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
3257 				cmd->sense_buffer,
3258 				(cmd->se_cmd.scsi_sense_length + padding),
3259 				0, NULL, (u8 *)&cmd->data_crc);
3260 
3261 			iov[iov_count].iov_base    = &cmd->data_crc;
3262 			iov[iov_count++].iov_len     = ISCSI_CRC_LEN;
3263 			tx_size += ISCSI_CRC_LEN;
3264 
3265 			pr_debug("Attaching CRC32 DataDigest for"
3266 				" SENSE, %u bytes CRC 0x%08x\n",
3267 				(cmd->se_cmd.scsi_sense_length + padding),
3268 				cmd->data_crc);
3269 		}
3270 
3271 		pr_debug("Attaching SENSE DATA: %u bytes to iSCSI"
3272 				" Response PDU\n",
3273 				cmd->se_cmd.scsi_sense_length);
3274 	}
3275 
3276 	if (conn->conn_ops->HeaderDigest) {
3277 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
3278 
3279 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, cmd->pdu,
3280 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
3281 
3282 		iov[0].iov_len += ISCSI_CRC_LEN;
3283 		tx_size += ISCSI_CRC_LEN;
3284 		pr_debug("Attaching CRC32 HeaderDigest for Response"
3285 				" PDU 0x%08x\n", *header_digest);
3286 	}
3287 
3288 	cmd->iov_misc_count = iov_count;
3289 	cmd->tx_size = tx_size;
3290 
3291 	return 0;
3292 }
3293 
3294 static u8 iscsit_convert_tcm_tmr_rsp(struct se_tmr_req *se_tmr)
3295 {
3296 	switch (se_tmr->response) {
3297 	case TMR_FUNCTION_COMPLETE:
3298 		return ISCSI_TMF_RSP_COMPLETE;
3299 	case TMR_TASK_DOES_NOT_EXIST:
3300 		return ISCSI_TMF_RSP_NO_TASK;
3301 	case TMR_LUN_DOES_NOT_EXIST:
3302 		return ISCSI_TMF_RSP_NO_LUN;
3303 	case TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED:
3304 		return ISCSI_TMF_RSP_NOT_SUPPORTED;
3305 	case TMR_FUNCTION_REJECTED:
3306 	default:
3307 		return ISCSI_TMF_RSP_REJECTED;
3308 	}
3309 }
3310 
3311 void
3312 iscsit_build_task_mgt_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
3313 			  struct iscsi_tm_rsp *hdr)
3314 {
3315 	struct se_tmr_req *se_tmr = cmd->se_cmd.se_tmr_req;
3316 
3317 	hdr->opcode		= ISCSI_OP_SCSI_TMFUNC_RSP;
3318 	hdr->flags		= ISCSI_FLAG_CMD_FINAL;
3319 	hdr->response		= iscsit_convert_tcm_tmr_rsp(se_tmr);
3320 	hdr->itt		= cmd->init_task_tag;
3321 	cmd->stat_sn		= conn->stat_sn++;
3322 	hdr->statsn		= cpu_to_be32(cmd->stat_sn);
3323 
3324 	iscsit_increment_maxcmdsn(cmd, conn->sess);
3325 	hdr->exp_cmdsn		= cpu_to_be32(conn->sess->exp_cmd_sn);
3326 	hdr->max_cmdsn		= cpu_to_be32(conn->sess->max_cmd_sn);
3327 
3328 	pr_debug("Built Task Management Response ITT: 0x%08x,"
3329 		" StatSN: 0x%08x, Response: 0x%02x, CID: %hu\n",
3330 		cmd->init_task_tag, cmd->stat_sn, hdr->response, conn->cid);
3331 }
3332 EXPORT_SYMBOL(iscsit_build_task_mgt_rsp);
3333 
3334 static int
3335 iscsit_send_task_mgt_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
3336 {
3337 	struct iscsi_tm_rsp *hdr = (struct iscsi_tm_rsp *)&cmd->pdu[0];
3338 	u32 tx_size = 0;
3339 
3340 	iscsit_build_task_mgt_rsp(cmd, conn, hdr);
3341 
3342 	cmd->iov_misc[0].iov_base	= cmd->pdu;
3343 	cmd->iov_misc[0].iov_len	= ISCSI_HDR_LEN;
3344 	tx_size += ISCSI_HDR_LEN;
3345 
3346 	if (conn->conn_ops->HeaderDigest) {
3347 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
3348 
3349 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
3350 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
3351 
3352 		cmd->iov_misc[0].iov_len += ISCSI_CRC_LEN;
3353 		tx_size += ISCSI_CRC_LEN;
3354 		pr_debug("Attaching CRC32 HeaderDigest for Task"
3355 			" Mgmt Response PDU 0x%08x\n", *header_digest);
3356 	}
3357 
3358 	cmd->iov_misc_count = 1;
3359 	cmd->tx_size = tx_size;
3360 
3361 	return 0;
3362 }
3363 
3364 static bool iscsit_check_inaddr_any(struct iscsi_np *np)
3365 {
3366 	bool ret = false;
3367 
3368 	if (np->np_sockaddr.ss_family == AF_INET6) {
3369 		const struct sockaddr_in6 sin6 = {
3370 			.sin6_addr = IN6ADDR_ANY_INIT };
3371 		struct sockaddr_in6 *sock_in6 =
3372 			 (struct sockaddr_in6 *)&np->np_sockaddr;
3373 
3374 		if (!memcmp(sock_in6->sin6_addr.s6_addr,
3375 				sin6.sin6_addr.s6_addr, 16))
3376 			ret = true;
3377 	} else {
3378 		struct sockaddr_in * sock_in =
3379 			(struct sockaddr_in *)&np->np_sockaddr;
3380 
3381 		if (sock_in->sin_addr.s_addr == htonl(INADDR_ANY))
3382 			ret = true;
3383 	}
3384 
3385 	return ret;
3386 }
3387 
3388 #define SENDTARGETS_BUF_LIMIT 32768U
3389 
3390 static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
3391 {
3392 	char *payload = NULL;
3393 	struct iscsi_conn *conn = cmd->conn;
3394 	struct iscsi_portal_group *tpg;
3395 	struct iscsi_tiqn *tiqn;
3396 	struct iscsi_tpg_np *tpg_np;
3397 	int buffer_len, end_of_buf = 0, len = 0, payload_len = 0;
3398 	int target_name_printed;
3399 	unsigned char buf[ISCSI_IQN_LEN+12]; /* iqn + "TargetName=" + \0 */
3400 	unsigned char *text_in = cmd->text_in_ptr, *text_ptr = NULL;
3401 
3402 	buffer_len = max(conn->conn_ops->MaxRecvDataSegmentLength,
3403 			 SENDTARGETS_BUF_LIMIT);
3404 
3405 	payload = kzalloc(buffer_len, GFP_KERNEL);
3406 	if (!payload) {
3407 		pr_err("Unable to allocate memory for sendtargets"
3408 				" response.\n");
3409 		return -ENOMEM;
3410 	}
3411 	/*
3412 	 * Locate pointer to iqn./eui. string for IFC_SENDTARGETS_SINGLE
3413 	 * explicit case..
3414 	 */
3415 	if (cmd->cmd_flags & IFC_SENDTARGETS_SINGLE) {
3416 		text_ptr = strchr(text_in, '=');
3417 		if (!text_ptr) {
3418 			pr_err("Unable to locate '=' string in text_in:"
3419 			       " %s\n", text_in);
3420 			kfree(payload);
3421 			return -EINVAL;
3422 		}
3423 		/*
3424 		 * Skip over '=' character..
3425 		 */
3426 		text_ptr += 1;
3427 	}
3428 
3429 	spin_lock(&tiqn_lock);
3430 	list_for_each_entry(tiqn, &g_tiqn_list, tiqn_list) {
3431 		if ((cmd->cmd_flags & IFC_SENDTARGETS_SINGLE) &&
3432 		     strcmp(tiqn->tiqn, text_ptr)) {
3433 			continue;
3434 		}
3435 
3436 		target_name_printed = 0;
3437 
3438 		spin_lock(&tiqn->tiqn_tpg_lock);
3439 		list_for_each_entry(tpg, &tiqn->tiqn_tpg_list, tpg_list) {
3440 
3441 			/* If demo_mode_discovery=0 and generate_node_acls=0
3442 			 * (demo mode dislabed) do not return
3443 			 * TargetName+TargetAddress unless a NodeACL exists.
3444 			 */
3445 
3446 			if ((tpg->tpg_attrib.generate_node_acls == 0) &&
3447 			    (tpg->tpg_attrib.demo_mode_discovery == 0) &&
3448 			    (!core_tpg_get_initiator_node_acl(&tpg->tpg_se_tpg,
3449 				cmd->conn->sess->sess_ops->InitiatorName))) {
3450 				continue;
3451 			}
3452 
3453 			spin_lock(&tpg->tpg_state_lock);
3454 			if ((tpg->tpg_state == TPG_STATE_FREE) ||
3455 			    (tpg->tpg_state == TPG_STATE_INACTIVE)) {
3456 				spin_unlock(&tpg->tpg_state_lock);
3457 				continue;
3458 			}
3459 			spin_unlock(&tpg->tpg_state_lock);
3460 
3461 			spin_lock(&tpg->tpg_np_lock);
3462 			list_for_each_entry(tpg_np, &tpg->tpg_gnp_list,
3463 						tpg_np_list) {
3464 				struct iscsi_np *np = tpg_np->tpg_np;
3465 				bool inaddr_any = iscsit_check_inaddr_any(np);
3466 
3467 				if (!target_name_printed) {
3468 					len = sprintf(buf, "TargetName=%s",
3469 						      tiqn->tiqn);
3470 					len += 1;
3471 
3472 					if ((len + payload_len) > buffer_len) {
3473 						spin_unlock(&tpg->tpg_np_lock);
3474 						spin_unlock(&tiqn->tiqn_tpg_lock);
3475 						end_of_buf = 1;
3476 						goto eob;
3477 					}
3478 					memcpy(payload + payload_len, buf, len);
3479 					payload_len += len;
3480 					target_name_printed = 1;
3481 				}
3482 
3483 				len = sprintf(buf, "TargetAddress="
3484 					"%s:%hu,%hu",
3485 					(inaddr_any == false) ?
3486 						np->np_ip : conn->local_ip,
3487 					(inaddr_any == false) ?
3488 						np->np_port : conn->local_port,
3489 					tpg->tpgt);
3490 				len += 1;
3491 
3492 				if ((len + payload_len) > buffer_len) {
3493 					spin_unlock(&tpg->tpg_np_lock);
3494 					spin_unlock(&tiqn->tiqn_tpg_lock);
3495 					end_of_buf = 1;
3496 					goto eob;
3497 				}
3498 				memcpy(payload + payload_len, buf, len);
3499 				payload_len += len;
3500 			}
3501 			spin_unlock(&tpg->tpg_np_lock);
3502 		}
3503 		spin_unlock(&tiqn->tiqn_tpg_lock);
3504 eob:
3505 		if (end_of_buf)
3506 			break;
3507 
3508 		if (cmd->cmd_flags & IFC_SENDTARGETS_SINGLE)
3509 			break;
3510 	}
3511 	spin_unlock(&tiqn_lock);
3512 
3513 	cmd->buf_ptr = payload;
3514 
3515 	return payload_len;
3516 }
3517 
3518 int
3519 iscsit_build_text_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
3520 		      struct iscsi_text_rsp *hdr)
3521 {
3522 	int text_length, padding;
3523 
3524 	text_length = iscsit_build_sendtargets_response(cmd);
3525 	if (text_length < 0)
3526 		return text_length;
3527 
3528 	hdr->opcode = ISCSI_OP_TEXT_RSP;
3529 	hdr->flags |= ISCSI_FLAG_CMD_FINAL;
3530 	padding = ((-text_length) & 3);
3531 	hton24(hdr->dlength, text_length);
3532 	hdr->itt = cmd->init_task_tag;
3533 	hdr->ttt = cpu_to_be32(cmd->targ_xfer_tag);
3534 	cmd->stat_sn = conn->stat_sn++;
3535 	hdr->statsn = cpu_to_be32(cmd->stat_sn);
3536 
3537 	iscsit_increment_maxcmdsn(cmd, conn->sess);
3538 	hdr->exp_cmdsn = cpu_to_be32(conn->sess->exp_cmd_sn);
3539 	hdr->max_cmdsn = cpu_to_be32(conn->sess->max_cmd_sn);
3540 
3541 	pr_debug("Built Text Response: ITT: 0x%08x, StatSN: 0x%08x,"
3542 		" Length: %u, CID: %hu\n", cmd->init_task_tag, cmd->stat_sn,
3543 		text_length, conn->cid);
3544 
3545 	return text_length + padding;
3546 }
3547 EXPORT_SYMBOL(iscsit_build_text_rsp);
3548 
3549 /*
3550  *	FIXME: Add support for F_BIT and C_BIT when the length is longer than
3551  *	MaxRecvDataSegmentLength.
3552  */
3553 static int iscsit_send_text_rsp(
3554 	struct iscsi_cmd *cmd,
3555 	struct iscsi_conn *conn)
3556 {
3557 	struct iscsi_text_rsp *hdr = (struct iscsi_text_rsp *)cmd->pdu;
3558 	struct kvec *iov;
3559 	u32 tx_size = 0;
3560 	int text_length, iov_count = 0, rc;
3561 
3562 	rc = iscsit_build_text_rsp(cmd, conn, hdr);
3563 	if (rc < 0)
3564 		return rc;
3565 
3566 	text_length = rc;
3567 	iov = &cmd->iov_misc[0];
3568 	iov[iov_count].iov_base = cmd->pdu;
3569 	iov[iov_count++].iov_len = ISCSI_HDR_LEN;
3570 	iov[iov_count].iov_base	= cmd->buf_ptr;
3571 	iov[iov_count++].iov_len = text_length;
3572 
3573 	tx_size += (ISCSI_HDR_LEN + text_length);
3574 
3575 	if (conn->conn_ops->HeaderDigest) {
3576 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
3577 
3578 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
3579 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
3580 
3581 		iov[0].iov_len += ISCSI_CRC_LEN;
3582 		tx_size += ISCSI_CRC_LEN;
3583 		pr_debug("Attaching CRC32 HeaderDigest for"
3584 			" Text Response PDU 0x%08x\n", *header_digest);
3585 	}
3586 
3587 	if (conn->conn_ops->DataDigest) {
3588 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
3589 				cmd->buf_ptr, text_length,
3590 				0, NULL, (u8 *)&cmd->data_crc);
3591 
3592 		iov[iov_count].iov_base	= &cmd->data_crc;
3593 		iov[iov_count++].iov_len = ISCSI_CRC_LEN;
3594 		tx_size	+= ISCSI_CRC_LEN;
3595 
3596 		pr_debug("Attaching DataDigest for %u bytes of text"
3597 			" data, CRC 0x%08x\n", text_length,
3598 			cmd->data_crc);
3599 	}
3600 
3601 	cmd->iov_misc_count = iov_count;
3602 	cmd->tx_size = tx_size;
3603 
3604 	return 0;
3605 }
3606 
3607 void
3608 iscsit_build_reject(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
3609 		    struct iscsi_reject *hdr)
3610 {
3611 	hdr->opcode		= ISCSI_OP_REJECT;
3612 	hdr->reason		= cmd->reject_reason;
3613 	hdr->flags		|= ISCSI_FLAG_CMD_FINAL;
3614 	hton24(hdr->dlength, ISCSI_HDR_LEN);
3615 	hdr->ffffffff		= cpu_to_be32(0xffffffff);
3616 	cmd->stat_sn		= conn->stat_sn++;
3617 	hdr->statsn		= cpu_to_be32(cmd->stat_sn);
3618 	hdr->exp_cmdsn		= cpu_to_be32(conn->sess->exp_cmd_sn);
3619 	hdr->max_cmdsn		= cpu_to_be32(conn->sess->max_cmd_sn);
3620 
3621 }
3622 EXPORT_SYMBOL(iscsit_build_reject);
3623 
3624 static int iscsit_send_reject(
3625 	struct iscsi_cmd *cmd,
3626 	struct iscsi_conn *conn)
3627 {
3628 	struct iscsi_reject *hdr = (struct iscsi_reject *)&cmd->pdu[0];
3629 	struct kvec *iov;
3630 	u32 iov_count = 0, tx_size;
3631 
3632 	iscsit_build_reject(cmd, conn, hdr);
3633 
3634 	iov = &cmd->iov_misc[0];
3635 	iov[iov_count].iov_base = cmd->pdu;
3636 	iov[iov_count++].iov_len = ISCSI_HDR_LEN;
3637 	iov[iov_count].iov_base = cmd->buf_ptr;
3638 	iov[iov_count++].iov_len = ISCSI_HDR_LEN;
3639 
3640 	tx_size = (ISCSI_HDR_LEN + ISCSI_HDR_LEN);
3641 
3642 	if (conn->conn_ops->HeaderDigest) {
3643 		u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
3644 
3645 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
3646 				ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
3647 
3648 		iov[0].iov_len += ISCSI_CRC_LEN;
3649 		tx_size += ISCSI_CRC_LEN;
3650 		pr_debug("Attaching CRC32 HeaderDigest for"
3651 			" REJECT PDU 0x%08x\n", *header_digest);
3652 	}
3653 
3654 	if (conn->conn_ops->DataDigest) {
3655 		iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, cmd->buf_ptr,
3656 				ISCSI_HDR_LEN, 0, NULL, (u8 *)&cmd->data_crc);
3657 
3658 		iov[iov_count].iov_base = &cmd->data_crc;
3659 		iov[iov_count++].iov_len  = ISCSI_CRC_LEN;
3660 		tx_size += ISCSI_CRC_LEN;
3661 		pr_debug("Attaching CRC32 DataDigest for REJECT"
3662 				" PDU 0x%08x\n", cmd->data_crc);
3663 	}
3664 
3665 	cmd->iov_misc_count = iov_count;
3666 	cmd->tx_size = tx_size;
3667 
3668 	pr_debug("Built Reject PDU StatSN: 0x%08x, Reason: 0x%02x,"
3669 		" CID: %hu\n", ntohl(hdr->statsn), hdr->reason, conn->cid);
3670 
3671 	return 0;
3672 }
3673 
3674 void iscsit_thread_get_cpumask(struct iscsi_conn *conn)
3675 {
3676 	struct iscsi_thread_set *ts = conn->thread_set;
3677 	int ord, cpu;
3678 	/*
3679 	 * thread_id is assigned from iscsit_global->ts_bitmap from
3680 	 * within iscsi_thread_set.c:iscsi_allocate_thread_sets()
3681 	 *
3682 	 * Here we use thread_id to determine which CPU that this
3683 	 * iSCSI connection's iscsi_thread_set will be scheduled to
3684 	 * execute upon.
3685 	 */
3686 	ord = ts->thread_id % cpumask_weight(cpu_online_mask);
3687 	for_each_online_cpu(cpu) {
3688 		if (ord-- == 0) {
3689 			cpumask_set_cpu(cpu, conn->conn_cpumask);
3690 			return;
3691 		}
3692 	}
3693 	/*
3694 	 * This should never be reached..
3695 	 */
3696 	dump_stack();
3697 	cpumask_setall(conn->conn_cpumask);
3698 }
3699 
3700 static inline void iscsit_thread_check_cpumask(
3701 	struct iscsi_conn *conn,
3702 	struct task_struct *p,
3703 	int mode)
3704 {
3705 	char buf[128];
3706 	/*
3707 	 * mode == 1 signals iscsi_target_tx_thread() usage.
3708 	 * mode == 0 signals iscsi_target_rx_thread() usage.
3709 	 */
3710 	if (mode == 1) {
3711 		if (!conn->conn_tx_reset_cpumask)
3712 			return;
3713 		conn->conn_tx_reset_cpumask = 0;
3714 	} else {
3715 		if (!conn->conn_rx_reset_cpumask)
3716 			return;
3717 		conn->conn_rx_reset_cpumask = 0;
3718 	}
3719 	/*
3720 	 * Update the CPU mask for this single kthread so that
3721 	 * both TX and RX kthreads are scheduled to run on the
3722 	 * same CPU.
3723 	 */
3724 	memset(buf, 0, 128);
3725 	cpumask_scnprintf(buf, 128, conn->conn_cpumask);
3726 	set_cpus_allowed_ptr(p, conn->conn_cpumask);
3727 }
3728 
3729 static int
3730 iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state)
3731 {
3732 	int ret;
3733 
3734 	switch (state) {
3735 	case ISTATE_SEND_R2T:
3736 		ret = iscsit_send_r2t(cmd, conn);
3737 		if (ret < 0)
3738 			goto err;
3739 		break;
3740 	case ISTATE_REMOVE:
3741 		spin_lock_bh(&conn->cmd_lock);
3742 		list_del_init(&cmd->i_conn_node);
3743 		spin_unlock_bh(&conn->cmd_lock);
3744 
3745 		iscsit_free_cmd(cmd, false);
3746 		break;
3747 	case ISTATE_SEND_NOPIN_WANT_RESPONSE:
3748 		iscsit_mod_nopin_response_timer(conn);
3749 		ret = iscsit_send_unsolicited_nopin(cmd, conn, 1);
3750 		if (ret < 0)
3751 			goto err;
3752 		break;
3753 	case ISTATE_SEND_NOPIN_NO_RESPONSE:
3754 		ret = iscsit_send_unsolicited_nopin(cmd, conn, 0);
3755 		if (ret < 0)
3756 			goto err;
3757 		break;
3758 	default:
3759 		pr_err("Unknown Opcode: 0x%02x ITT:"
3760 		       " 0x%08x, i_state: %d on CID: %hu\n",
3761 		       cmd->iscsi_opcode, cmd->init_task_tag, state,
3762 		       conn->cid);
3763 		goto err;
3764 	}
3765 
3766 	return 0;
3767 
3768 err:
3769 	return -1;
3770 }
3771 
3772 static int
3773 iscsit_handle_immediate_queue(struct iscsi_conn *conn)
3774 {
3775 	struct iscsit_transport *t = conn->conn_transport;
3776 	struct iscsi_queue_req *qr;
3777 	struct iscsi_cmd *cmd;
3778 	u8 state;
3779 	int ret;
3780 
3781 	while ((qr = iscsit_get_cmd_from_immediate_queue(conn))) {
3782 		atomic_set(&conn->check_immediate_queue, 0);
3783 		cmd = qr->cmd;
3784 		state = qr->state;
3785 		kmem_cache_free(lio_qr_cache, qr);
3786 
3787 		ret = t->iscsit_immediate_queue(conn, cmd, state);
3788 		if (ret < 0)
3789 			return ret;
3790 	}
3791 
3792 	return 0;
3793 }
3794 
3795 static int
3796 iscsit_response_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state)
3797 {
3798 	int ret;
3799 
3800 check_rsp_state:
3801 	switch (state) {
3802 	case ISTATE_SEND_DATAIN:
3803 		ret = iscsit_send_datain(cmd, conn);
3804 		if (ret < 0)
3805 			goto err;
3806 		else if (!ret)
3807 			/* more drs */
3808 			goto check_rsp_state;
3809 		else if (ret == 1) {
3810 			/* all done */
3811 			spin_lock_bh(&cmd->istate_lock);
3812 			cmd->i_state = ISTATE_SENT_STATUS;
3813 			spin_unlock_bh(&cmd->istate_lock);
3814 
3815 			if (atomic_read(&conn->check_immediate_queue))
3816 				return 1;
3817 
3818 			return 0;
3819 		} else if (ret == 2) {
3820 			/* Still must send status,
3821 			   SCF_TRANSPORT_TASK_SENSE was set */
3822 			spin_lock_bh(&cmd->istate_lock);
3823 			cmd->i_state = ISTATE_SEND_STATUS;
3824 			spin_unlock_bh(&cmd->istate_lock);
3825 			state = ISTATE_SEND_STATUS;
3826 			goto check_rsp_state;
3827 		}
3828 
3829 		break;
3830 	case ISTATE_SEND_STATUS:
3831 	case ISTATE_SEND_STATUS_RECOVERY:
3832 		ret = iscsit_send_response(cmd, conn);
3833 		break;
3834 	case ISTATE_SEND_LOGOUTRSP:
3835 		ret = iscsit_send_logout(cmd, conn);
3836 		break;
3837 	case ISTATE_SEND_ASYNCMSG:
3838 		ret = iscsit_send_conn_drop_async_message(
3839 			cmd, conn);
3840 		break;
3841 	case ISTATE_SEND_NOPIN:
3842 		ret = iscsit_send_nopin(cmd, conn);
3843 		break;
3844 	case ISTATE_SEND_REJECT:
3845 		ret = iscsit_send_reject(cmd, conn);
3846 		break;
3847 	case ISTATE_SEND_TASKMGTRSP:
3848 		ret = iscsit_send_task_mgt_rsp(cmd, conn);
3849 		if (ret != 0)
3850 			break;
3851 		ret = iscsit_tmr_post_handler(cmd, conn);
3852 		if (ret != 0)
3853 			iscsit_fall_back_to_erl0(conn->sess);
3854 		break;
3855 	case ISTATE_SEND_TEXTRSP:
3856 		ret = iscsit_send_text_rsp(cmd, conn);
3857 		break;
3858 	default:
3859 		pr_err("Unknown Opcode: 0x%02x ITT:"
3860 		       " 0x%08x, i_state: %d on CID: %hu\n",
3861 		       cmd->iscsi_opcode, cmd->init_task_tag,
3862 		       state, conn->cid);
3863 		goto err;
3864 	}
3865 	if (ret < 0)
3866 		goto err;
3867 
3868 	if (iscsit_send_tx_data(cmd, conn, 1) < 0) {
3869 		iscsit_tx_thread_wait_for_tcp(conn);
3870 		iscsit_unmap_iovec(cmd);
3871 		goto err;
3872 	}
3873 	iscsit_unmap_iovec(cmd);
3874 
3875 	switch (state) {
3876 	case ISTATE_SEND_LOGOUTRSP:
3877 		if (!iscsit_logout_post_handler(cmd, conn))
3878 			goto restart;
3879 		/* fall through */
3880 	case ISTATE_SEND_STATUS:
3881 	case ISTATE_SEND_ASYNCMSG:
3882 	case ISTATE_SEND_NOPIN:
3883 	case ISTATE_SEND_STATUS_RECOVERY:
3884 	case ISTATE_SEND_TEXTRSP:
3885 	case ISTATE_SEND_TASKMGTRSP:
3886 	case ISTATE_SEND_REJECT:
3887 		spin_lock_bh(&cmd->istate_lock);
3888 		cmd->i_state = ISTATE_SENT_STATUS;
3889 		spin_unlock_bh(&cmd->istate_lock);
3890 		break;
3891 	default:
3892 		pr_err("Unknown Opcode: 0x%02x ITT:"
3893 		       " 0x%08x, i_state: %d on CID: %hu\n",
3894 		       cmd->iscsi_opcode, cmd->init_task_tag,
3895 		       cmd->i_state, conn->cid);
3896 		goto err;
3897 	}
3898 
3899 	if (atomic_read(&conn->check_immediate_queue))
3900 		return 1;
3901 
3902 	return 0;
3903 
3904 err:
3905 	return -1;
3906 restart:
3907 	return -EAGAIN;
3908 }
3909 
3910 static int iscsit_handle_response_queue(struct iscsi_conn *conn)
3911 {
3912 	struct iscsit_transport *t = conn->conn_transport;
3913 	struct iscsi_queue_req *qr;
3914 	struct iscsi_cmd *cmd;
3915 	u8 state;
3916 	int ret;
3917 
3918 	while ((qr = iscsit_get_cmd_from_response_queue(conn))) {
3919 		cmd = qr->cmd;
3920 		state = qr->state;
3921 		kmem_cache_free(lio_qr_cache, qr);
3922 
3923 		ret = t->iscsit_response_queue(conn, cmd, state);
3924 		if (ret == 1 || ret < 0)
3925 			return ret;
3926 	}
3927 
3928 	return 0;
3929 }
3930 
3931 int iscsi_target_tx_thread(void *arg)
3932 {
3933 	int ret = 0;
3934 	struct iscsi_conn *conn;
3935 	struct iscsi_thread_set *ts = arg;
3936 	/*
3937 	 * Allow ourselves to be interrupted by SIGINT so that a
3938 	 * connection recovery / failure event can be triggered externally.
3939 	 */
3940 	allow_signal(SIGINT);
3941 
3942 restart:
3943 	conn = iscsi_tx_thread_pre_handler(ts);
3944 	if (!conn)
3945 		goto out;
3946 
3947 	ret = 0;
3948 
3949 	while (!kthread_should_stop()) {
3950 		/*
3951 		 * Ensure that both TX and RX per connection kthreads
3952 		 * are scheduled to run on the same CPU.
3953 		 */
3954 		iscsit_thread_check_cpumask(conn, current, 1);
3955 
3956 		wait_event_interruptible(conn->queues_wq,
3957 					 !iscsit_conn_all_queues_empty(conn) ||
3958 					 ts->status == ISCSI_THREAD_SET_RESET);
3959 
3960 		if ((ts->status == ISCSI_THREAD_SET_RESET) ||
3961 		     signal_pending(current))
3962 			goto transport_err;
3963 
3964 get_immediate:
3965 		ret = iscsit_handle_immediate_queue(conn);
3966 		if (ret < 0)
3967 			goto transport_err;
3968 
3969 		ret = iscsit_handle_response_queue(conn);
3970 		if (ret == 1)
3971 			goto get_immediate;
3972 		else if (ret == -EAGAIN)
3973 			goto restart;
3974 		else if (ret < 0)
3975 			goto transport_err;
3976 	}
3977 
3978 transport_err:
3979 	iscsit_take_action_for_connection_exit(conn);
3980 	goto restart;
3981 out:
3982 	return 0;
3983 }
3984 
3985 static int iscsi_target_rx_opcode(struct iscsi_conn *conn, unsigned char *buf)
3986 {
3987 	struct iscsi_hdr *hdr = (struct iscsi_hdr *)buf;
3988 	struct iscsi_cmd *cmd;
3989 	int ret = 0;
3990 
3991 	switch (hdr->opcode & ISCSI_OPCODE_MASK) {
3992 	case ISCSI_OP_SCSI_CMD:
3993 		cmd = iscsit_allocate_cmd(conn, TASK_INTERRUPTIBLE);
3994 		if (!cmd)
3995 			goto reject;
3996 
3997 		ret = iscsit_handle_scsi_cmd(conn, cmd, buf);
3998 		break;
3999 	case ISCSI_OP_SCSI_DATA_OUT:
4000 		ret = iscsit_handle_data_out(conn, buf);
4001 		break;
4002 	case ISCSI_OP_NOOP_OUT:
4003 		cmd = NULL;
4004 		if (hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
4005 			cmd = iscsit_allocate_cmd(conn, TASK_INTERRUPTIBLE);
4006 			if (!cmd)
4007 				goto reject;
4008 		}
4009 		ret = iscsit_handle_nop_out(conn, cmd, buf);
4010 		break;
4011 	case ISCSI_OP_SCSI_TMFUNC:
4012 		cmd = iscsit_allocate_cmd(conn, TASK_INTERRUPTIBLE);
4013 		if (!cmd)
4014 			goto reject;
4015 
4016 		ret = iscsit_handle_task_mgt_cmd(conn, cmd, buf);
4017 		break;
4018 	case ISCSI_OP_TEXT:
4019 		cmd = iscsit_allocate_cmd(conn, TASK_INTERRUPTIBLE);
4020 		if (!cmd)
4021 			goto reject;
4022 
4023 		ret = iscsit_handle_text_cmd(conn, cmd, buf);
4024 		break;
4025 	case ISCSI_OP_LOGOUT:
4026 		cmd = iscsit_allocate_cmd(conn, TASK_INTERRUPTIBLE);
4027 		if (!cmd)
4028 			goto reject;
4029 
4030 		ret = iscsit_handle_logout_cmd(conn, cmd, buf);
4031 		if (ret > 0)
4032 			wait_for_completion_timeout(&conn->conn_logout_comp,
4033 					SECONDS_FOR_LOGOUT_COMP * HZ);
4034 		break;
4035 	case ISCSI_OP_SNACK:
4036 		ret = iscsit_handle_snack(conn, buf);
4037 		break;
4038 	default:
4039 		pr_err("Got unknown iSCSI OpCode: 0x%02x\n", hdr->opcode);
4040 		if (!conn->sess->sess_ops->ErrorRecoveryLevel) {
4041 			pr_err("Cannot recover from unknown"
4042 			" opcode while ERL=0, closing iSCSI connection.\n");
4043 			return -1;
4044 		}
4045 		if (!conn->conn_ops->OFMarker) {
4046 			pr_err("Unable to recover from unknown"
4047 			" opcode while OFMarker=No, closing iSCSI"
4048 				" connection.\n");
4049 			return -1;
4050 		}
4051 		if (iscsit_recover_from_unknown_opcode(conn) < 0) {
4052 			pr_err("Unable to recover from unknown"
4053 				" opcode, closing iSCSI connection.\n");
4054 			return -1;
4055 		}
4056 		break;
4057 	}
4058 
4059 	return ret;
4060 reject:
4061 	return iscsit_add_reject(conn, ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
4062 }
4063 
4064 int iscsi_target_rx_thread(void *arg)
4065 {
4066 	int ret;
4067 	u8 buffer[ISCSI_HDR_LEN], opcode;
4068 	u32 checksum = 0, digest = 0;
4069 	struct iscsi_conn *conn = NULL;
4070 	struct iscsi_thread_set *ts = arg;
4071 	struct kvec iov;
4072 	/*
4073 	 * Allow ourselves to be interrupted by SIGINT so that a
4074 	 * connection recovery / failure event can be triggered externally.
4075 	 */
4076 	allow_signal(SIGINT);
4077 
4078 restart:
4079 	conn = iscsi_rx_thread_pre_handler(ts);
4080 	if (!conn)
4081 		goto out;
4082 
4083 	if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
4084 		struct completion comp;
4085 		int rc;
4086 
4087 		init_completion(&comp);
4088 		rc = wait_for_completion_interruptible(&comp);
4089 		if (rc < 0)
4090 			goto transport_err;
4091 
4092 		goto out;
4093 	}
4094 
4095 	while (!kthread_should_stop()) {
4096 		/*
4097 		 * Ensure that both TX and RX per connection kthreads
4098 		 * are scheduled to run on the same CPU.
4099 		 */
4100 		iscsit_thread_check_cpumask(conn, current, 0);
4101 
4102 		memset(buffer, 0, ISCSI_HDR_LEN);
4103 		memset(&iov, 0, sizeof(struct kvec));
4104 
4105 		iov.iov_base	= buffer;
4106 		iov.iov_len	= ISCSI_HDR_LEN;
4107 
4108 		ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN);
4109 		if (ret != ISCSI_HDR_LEN) {
4110 			iscsit_rx_thread_wait_for_tcp(conn);
4111 			goto transport_err;
4112 		}
4113 
4114 		if (conn->conn_ops->HeaderDigest) {
4115 			iov.iov_base	= &digest;
4116 			iov.iov_len	= ISCSI_CRC_LEN;
4117 
4118 			ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
4119 			if (ret != ISCSI_CRC_LEN) {
4120 				iscsit_rx_thread_wait_for_tcp(conn);
4121 				goto transport_err;
4122 			}
4123 
4124 			iscsit_do_crypto_hash_buf(&conn->conn_rx_hash,
4125 					buffer, ISCSI_HDR_LEN,
4126 					0, NULL, (u8 *)&checksum);
4127 
4128 			if (digest != checksum) {
4129 				pr_err("HeaderDigest CRC32C failed,"
4130 					" received 0x%08x, computed 0x%08x\n",
4131 					digest, checksum);
4132 				/*
4133 				 * Set the PDU to 0xff so it will intentionally
4134 				 * hit default in the switch below.
4135 				 */
4136 				memset(buffer, 0xff, ISCSI_HDR_LEN);
4137 				atomic_long_inc(&conn->sess->conn_digest_errors);
4138 			} else {
4139 				pr_debug("Got HeaderDigest CRC32C"
4140 						" 0x%08x\n", checksum);
4141 			}
4142 		}
4143 
4144 		if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)
4145 			goto transport_err;
4146 
4147 		opcode = buffer[0] & ISCSI_OPCODE_MASK;
4148 
4149 		if (conn->sess->sess_ops->SessionType &&
4150 		   ((!(opcode & ISCSI_OP_TEXT)) ||
4151 		    (!(opcode & ISCSI_OP_LOGOUT)))) {
4152 			pr_err("Received illegal iSCSI Opcode: 0x%02x"
4153 			" while in Discovery Session, rejecting.\n", opcode);
4154 			iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
4155 					  buffer);
4156 			goto transport_err;
4157 		}
4158 
4159 		ret = iscsi_target_rx_opcode(conn, buffer);
4160 		if (ret < 0)
4161 			goto transport_err;
4162 	}
4163 
4164 transport_err:
4165 	if (!signal_pending(current))
4166 		atomic_set(&conn->transport_failed, 1);
4167 	iscsit_take_action_for_connection_exit(conn);
4168 	goto restart;
4169 out:
4170 	return 0;
4171 }
4172 
4173 static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
4174 {
4175 	struct iscsi_cmd *cmd = NULL, *cmd_tmp = NULL;
4176 	struct iscsi_session *sess = conn->sess;
4177 	/*
4178 	 * We expect this function to only ever be called from either RX or TX
4179 	 * thread context via iscsit_close_connection() once the other context
4180 	 * has been reset -> returned sleeping pre-handler state.
4181 	 */
4182 	spin_lock_bh(&conn->cmd_lock);
4183 	list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
4184 
4185 		list_del_init(&cmd->i_conn_node);
4186 		spin_unlock_bh(&conn->cmd_lock);
4187 
4188 		iscsit_increment_maxcmdsn(cmd, sess);
4189 
4190 		iscsit_free_cmd(cmd, true);
4191 
4192 		spin_lock_bh(&conn->cmd_lock);
4193 	}
4194 	spin_unlock_bh(&conn->cmd_lock);
4195 }
4196 
4197 static void iscsit_stop_timers_for_cmds(
4198 	struct iscsi_conn *conn)
4199 {
4200 	struct iscsi_cmd *cmd;
4201 
4202 	spin_lock_bh(&conn->cmd_lock);
4203 	list_for_each_entry(cmd, &conn->conn_cmd_list, i_conn_node) {
4204 		if (cmd->data_direction == DMA_TO_DEVICE)
4205 			iscsit_stop_dataout_timer(cmd);
4206 	}
4207 	spin_unlock_bh(&conn->cmd_lock);
4208 }
4209 
4210 int iscsit_close_connection(
4211 	struct iscsi_conn *conn)
4212 {
4213 	int conn_logout = (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT);
4214 	struct iscsi_session	*sess = conn->sess;
4215 
4216 	pr_debug("Closing iSCSI connection CID %hu on SID:"
4217 		" %u\n", conn->cid, sess->sid);
4218 	/*
4219 	 * Always up conn_logout_comp just in case the RX Thread is sleeping
4220 	 * and the logout response never got sent because the connection
4221 	 * failed.
4222 	 */
4223 	complete(&conn->conn_logout_comp);
4224 
4225 	iscsi_release_thread_set(conn);
4226 
4227 	iscsit_stop_timers_for_cmds(conn);
4228 	iscsit_stop_nopin_response_timer(conn);
4229 	iscsit_stop_nopin_timer(conn);
4230 
4231 	if (conn->conn_transport->iscsit_wait_conn)
4232 		conn->conn_transport->iscsit_wait_conn(conn);
4233 
4234 	iscsit_free_queue_reqs_for_conn(conn);
4235 
4236 	/*
4237 	 * During Connection recovery drop unacknowledged out of order
4238 	 * commands for this connection, and prepare the other commands
4239 	 * for realligence.
4240 	 *
4241 	 * During normal operation clear the out of order commands (but
4242 	 * do not free the struct iscsi_ooo_cmdsn's) and release all
4243 	 * struct iscsi_cmds.
4244 	 */
4245 	if (atomic_read(&conn->connection_recovery)) {
4246 		iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(conn);
4247 		iscsit_prepare_cmds_for_realligance(conn);
4248 	} else {
4249 		iscsit_clear_ooo_cmdsns_for_conn(conn);
4250 		iscsit_release_commands_from_conn(conn);
4251 	}
4252 
4253 	/*
4254 	 * Handle decrementing session or connection usage count if
4255 	 * a logout response was not able to be sent because the
4256 	 * connection failed.  Fall back to Session Recovery here.
4257 	 */
4258 	if (atomic_read(&conn->conn_logout_remove)) {
4259 		if (conn->conn_logout_reason == ISCSI_LOGOUT_REASON_CLOSE_SESSION) {
4260 			iscsit_dec_conn_usage_count(conn);
4261 			iscsit_dec_session_usage_count(sess);
4262 		}
4263 		if (conn->conn_logout_reason == ISCSI_LOGOUT_REASON_CLOSE_CONNECTION)
4264 			iscsit_dec_conn_usage_count(conn);
4265 
4266 		atomic_set(&conn->conn_logout_remove, 0);
4267 		atomic_set(&sess->session_reinstatement, 0);
4268 		atomic_set(&sess->session_fall_back_to_erl0, 1);
4269 	}
4270 
4271 	spin_lock_bh(&sess->conn_lock);
4272 	list_del(&conn->conn_list);
4273 
4274 	/*
4275 	 * Attempt to let the Initiator know this connection failed by
4276 	 * sending an Connection Dropped Async Message on another
4277 	 * active connection.
4278 	 */
4279 	if (atomic_read(&conn->connection_recovery))
4280 		iscsit_build_conn_drop_async_message(conn);
4281 
4282 	spin_unlock_bh(&sess->conn_lock);
4283 
4284 	/*
4285 	 * If connection reinstatement is being performed on this connection,
4286 	 * up the connection reinstatement semaphore that is being blocked on
4287 	 * in iscsit_cause_connection_reinstatement().
4288 	 */
4289 	spin_lock_bh(&conn->state_lock);
4290 	if (atomic_read(&conn->sleep_on_conn_wait_comp)) {
4291 		spin_unlock_bh(&conn->state_lock);
4292 		complete(&conn->conn_wait_comp);
4293 		wait_for_completion(&conn->conn_post_wait_comp);
4294 		spin_lock_bh(&conn->state_lock);
4295 	}
4296 
4297 	/*
4298 	 * If connection reinstatement is being performed on this connection
4299 	 * by receiving a REMOVECONNFORRECOVERY logout request, up the
4300 	 * connection wait rcfr semaphore that is being blocked on
4301 	 * an iscsit_connection_reinstatement_rcfr().
4302 	 */
4303 	if (atomic_read(&conn->connection_wait_rcfr)) {
4304 		spin_unlock_bh(&conn->state_lock);
4305 		complete(&conn->conn_wait_rcfr_comp);
4306 		wait_for_completion(&conn->conn_post_wait_comp);
4307 		spin_lock_bh(&conn->state_lock);
4308 	}
4309 	atomic_set(&conn->connection_reinstatement, 1);
4310 	spin_unlock_bh(&conn->state_lock);
4311 
4312 	/*
4313 	 * If any other processes are accessing this connection pointer we
4314 	 * must wait until they have completed.
4315 	 */
4316 	iscsit_check_conn_usage_count(conn);
4317 
4318 	if (conn->conn_rx_hash.tfm)
4319 		crypto_free_hash(conn->conn_rx_hash.tfm);
4320 	if (conn->conn_tx_hash.tfm)
4321 		crypto_free_hash(conn->conn_tx_hash.tfm);
4322 
4323 	if (conn->conn_cpumask)
4324 		free_cpumask_var(conn->conn_cpumask);
4325 
4326 	kfree(conn->conn_ops);
4327 	conn->conn_ops = NULL;
4328 
4329 	if (conn->sock)
4330 		sock_release(conn->sock);
4331 
4332 	if (conn->conn_transport->iscsit_free_conn)
4333 		conn->conn_transport->iscsit_free_conn(conn);
4334 
4335 	iscsit_put_transport(conn->conn_transport);
4336 
4337 	conn->thread_set = NULL;
4338 
4339 	pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
4340 	conn->conn_state = TARG_CONN_STATE_FREE;
4341 	kfree(conn);
4342 
4343 	spin_lock_bh(&sess->conn_lock);
4344 	atomic_dec(&sess->nconn);
4345 	pr_debug("Decremented iSCSI connection count to %hu from node:"
4346 		" %s\n", atomic_read(&sess->nconn),
4347 		sess->sess_ops->InitiatorName);
4348 	/*
4349 	 * Make sure that if one connection fails in an non ERL=2 iSCSI
4350 	 * Session that they all fail.
4351 	 */
4352 	if ((sess->sess_ops->ErrorRecoveryLevel != 2) && !conn_logout &&
4353 	     !atomic_read(&sess->session_logout))
4354 		atomic_set(&sess->session_fall_back_to_erl0, 1);
4355 
4356 	/*
4357 	 * If this was not the last connection in the session, and we are
4358 	 * performing session reinstatement or falling back to ERL=0, call
4359 	 * iscsit_stop_session() without sleeping to shutdown the other
4360 	 * active connections.
4361 	 */
4362 	if (atomic_read(&sess->nconn)) {
4363 		if (!atomic_read(&sess->session_reinstatement) &&
4364 		    !atomic_read(&sess->session_fall_back_to_erl0)) {
4365 			spin_unlock_bh(&sess->conn_lock);
4366 			return 0;
4367 		}
4368 		if (!atomic_read(&sess->session_stop_active)) {
4369 			atomic_set(&sess->session_stop_active, 1);
4370 			spin_unlock_bh(&sess->conn_lock);
4371 			iscsit_stop_session(sess, 0, 0);
4372 			return 0;
4373 		}
4374 		spin_unlock_bh(&sess->conn_lock);
4375 		return 0;
4376 	}
4377 
4378 	/*
4379 	 * If this was the last connection in the session and one of the
4380 	 * following is occurring:
4381 	 *
4382 	 * Session Reinstatement is not being performed, and are falling back
4383 	 * to ERL=0 call iscsit_close_session().
4384 	 *
4385 	 * Session Logout was requested.  iscsit_close_session() will be called
4386 	 * elsewhere.
4387 	 *
4388 	 * Session Continuation is not being performed, start the Time2Retain
4389 	 * handler and check if sleep_on_sess_wait_sem is active.
4390 	 */
4391 	if (!atomic_read(&sess->session_reinstatement) &&
4392 	     atomic_read(&sess->session_fall_back_to_erl0)) {
4393 		spin_unlock_bh(&sess->conn_lock);
4394 		target_put_session(sess->se_sess);
4395 
4396 		return 0;
4397 	} else if (atomic_read(&sess->session_logout)) {
4398 		pr_debug("Moving to TARG_SESS_STATE_FREE.\n");
4399 		sess->session_state = TARG_SESS_STATE_FREE;
4400 		spin_unlock_bh(&sess->conn_lock);
4401 
4402 		if (atomic_read(&sess->sleep_on_sess_wait_comp))
4403 			complete(&sess->session_wait_comp);
4404 
4405 		return 0;
4406 	} else {
4407 		pr_debug("Moving to TARG_SESS_STATE_FAILED.\n");
4408 		sess->session_state = TARG_SESS_STATE_FAILED;
4409 
4410 		if (!atomic_read(&sess->session_continuation)) {
4411 			spin_unlock_bh(&sess->conn_lock);
4412 			iscsit_start_time2retain_handler(sess);
4413 		} else
4414 			spin_unlock_bh(&sess->conn_lock);
4415 
4416 		if (atomic_read(&sess->sleep_on_sess_wait_comp))
4417 			complete(&sess->session_wait_comp);
4418 
4419 		return 0;
4420 	}
4421 	spin_unlock_bh(&sess->conn_lock);
4422 
4423 	return 0;
4424 }
4425 
4426 int iscsit_close_session(struct iscsi_session *sess)
4427 {
4428 	struct iscsi_portal_group *tpg = sess->tpg;
4429 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
4430 
4431 	if (atomic_read(&sess->nconn)) {
4432 		pr_err("%d connection(s) still exist for iSCSI session"
4433 			" to %s\n", atomic_read(&sess->nconn),
4434 			sess->sess_ops->InitiatorName);
4435 		BUG();
4436 	}
4437 
4438 	spin_lock_bh(&se_tpg->session_lock);
4439 	atomic_set(&sess->session_logout, 1);
4440 	atomic_set(&sess->session_reinstatement, 1);
4441 	iscsit_stop_time2retain_timer(sess);
4442 	spin_unlock_bh(&se_tpg->session_lock);
4443 
4444 	/*
4445 	 * transport_deregister_session_configfs() will clear the
4446 	 * struct se_node_acl->nacl_sess pointer now as a iscsi_np process context
4447 	 * can be setting it again with __transport_register_session() in
4448 	 * iscsi_post_login_handler() again after the iscsit_stop_session()
4449 	 * completes in iscsi_np context.
4450 	 */
4451 	transport_deregister_session_configfs(sess->se_sess);
4452 
4453 	/*
4454 	 * If any other processes are accessing this session pointer we must
4455 	 * wait until they have completed.  If we are in an interrupt (the
4456 	 * time2retain handler) and contain and active session usage count we
4457 	 * restart the timer and exit.
4458 	 */
4459 	if (!in_interrupt()) {
4460 		if (iscsit_check_session_usage_count(sess) == 1)
4461 			iscsit_stop_session(sess, 1, 1);
4462 	} else {
4463 		if (iscsit_check_session_usage_count(sess) == 2) {
4464 			atomic_set(&sess->session_logout, 0);
4465 			iscsit_start_time2retain_handler(sess);
4466 			return 0;
4467 		}
4468 	}
4469 
4470 	transport_deregister_session(sess->se_sess);
4471 
4472 	if (sess->sess_ops->ErrorRecoveryLevel == 2)
4473 		iscsit_free_connection_recovery_entires(sess);
4474 
4475 	iscsit_free_all_ooo_cmdsns(sess);
4476 
4477 	spin_lock_bh(&se_tpg->session_lock);
4478 	pr_debug("Moving to TARG_SESS_STATE_FREE.\n");
4479 	sess->session_state = TARG_SESS_STATE_FREE;
4480 	pr_debug("Released iSCSI session from node: %s\n",
4481 			sess->sess_ops->InitiatorName);
4482 	tpg->nsessions--;
4483 	if (tpg->tpg_tiqn)
4484 		tpg->tpg_tiqn->tiqn_nsessions--;
4485 
4486 	pr_debug("Decremented number of active iSCSI Sessions on"
4487 		" iSCSI TPG: %hu to %u\n", tpg->tpgt, tpg->nsessions);
4488 
4489 	spin_lock(&sess_idr_lock);
4490 	idr_remove(&sess_idr, sess->session_index);
4491 	spin_unlock(&sess_idr_lock);
4492 
4493 	kfree(sess->sess_ops);
4494 	sess->sess_ops = NULL;
4495 	spin_unlock_bh(&se_tpg->session_lock);
4496 
4497 	kfree(sess);
4498 	return 0;
4499 }
4500 
4501 static void iscsit_logout_post_handler_closesession(
4502 	struct iscsi_conn *conn)
4503 {
4504 	struct iscsi_session *sess = conn->sess;
4505 
4506 	iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
4507 	iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
4508 
4509 	atomic_set(&conn->conn_logout_remove, 0);
4510 	complete(&conn->conn_logout_comp);
4511 
4512 	iscsit_dec_conn_usage_count(conn);
4513 	iscsit_stop_session(sess, 1, 1);
4514 	iscsit_dec_session_usage_count(sess);
4515 	target_put_session(sess->se_sess);
4516 }
4517 
4518 static void iscsit_logout_post_handler_samecid(
4519 	struct iscsi_conn *conn)
4520 {
4521 	iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
4522 	iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
4523 
4524 	atomic_set(&conn->conn_logout_remove, 0);
4525 	complete(&conn->conn_logout_comp);
4526 
4527 	iscsit_cause_connection_reinstatement(conn, 1);
4528 	iscsit_dec_conn_usage_count(conn);
4529 }
4530 
4531 static void iscsit_logout_post_handler_diffcid(
4532 	struct iscsi_conn *conn,
4533 	u16 cid)
4534 {
4535 	struct iscsi_conn *l_conn;
4536 	struct iscsi_session *sess = conn->sess;
4537 
4538 	if (!sess)
4539 		return;
4540 
4541 	spin_lock_bh(&sess->conn_lock);
4542 	list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) {
4543 		if (l_conn->cid == cid) {
4544 			iscsit_inc_conn_usage_count(l_conn);
4545 			break;
4546 		}
4547 	}
4548 	spin_unlock_bh(&sess->conn_lock);
4549 
4550 	if (!l_conn)
4551 		return;
4552 
4553 	if (l_conn->sock)
4554 		l_conn->sock->ops->shutdown(l_conn->sock, RCV_SHUTDOWN);
4555 
4556 	spin_lock_bh(&l_conn->state_lock);
4557 	pr_debug("Moving to TARG_CONN_STATE_IN_LOGOUT.\n");
4558 	l_conn->conn_state = TARG_CONN_STATE_IN_LOGOUT;
4559 	spin_unlock_bh(&l_conn->state_lock);
4560 
4561 	iscsit_cause_connection_reinstatement(l_conn, 1);
4562 	iscsit_dec_conn_usage_count(l_conn);
4563 }
4564 
4565 /*
4566  *	Return of 0 causes the TX thread to restart.
4567  */
4568 int iscsit_logout_post_handler(
4569 	struct iscsi_cmd *cmd,
4570 	struct iscsi_conn *conn)
4571 {
4572 	int ret = 0;
4573 
4574 	switch (cmd->logout_reason) {
4575 	case ISCSI_LOGOUT_REASON_CLOSE_SESSION:
4576 		switch (cmd->logout_response) {
4577 		case ISCSI_LOGOUT_SUCCESS:
4578 		case ISCSI_LOGOUT_CLEANUP_FAILED:
4579 		default:
4580 			iscsit_logout_post_handler_closesession(conn);
4581 			break;
4582 		}
4583 		ret = 0;
4584 		break;
4585 	case ISCSI_LOGOUT_REASON_CLOSE_CONNECTION:
4586 		if (conn->cid == cmd->logout_cid) {
4587 			switch (cmd->logout_response) {
4588 			case ISCSI_LOGOUT_SUCCESS:
4589 			case ISCSI_LOGOUT_CLEANUP_FAILED:
4590 			default:
4591 				iscsit_logout_post_handler_samecid(conn);
4592 				break;
4593 			}
4594 			ret = 0;
4595 		} else {
4596 			switch (cmd->logout_response) {
4597 			case ISCSI_LOGOUT_SUCCESS:
4598 				iscsit_logout_post_handler_diffcid(conn,
4599 					cmd->logout_cid);
4600 				break;
4601 			case ISCSI_LOGOUT_CID_NOT_FOUND:
4602 			case ISCSI_LOGOUT_CLEANUP_FAILED:
4603 			default:
4604 				break;
4605 			}
4606 			ret = 1;
4607 		}
4608 		break;
4609 	case ISCSI_LOGOUT_REASON_RECOVERY:
4610 		switch (cmd->logout_response) {
4611 		case ISCSI_LOGOUT_SUCCESS:
4612 		case ISCSI_LOGOUT_CID_NOT_FOUND:
4613 		case ISCSI_LOGOUT_RECOVERY_UNSUPPORTED:
4614 		case ISCSI_LOGOUT_CLEANUP_FAILED:
4615 		default:
4616 			break;
4617 		}
4618 		ret = 1;
4619 		break;
4620 	default:
4621 		break;
4622 
4623 	}
4624 	return ret;
4625 }
4626 EXPORT_SYMBOL(iscsit_logout_post_handler);
4627 
4628 void iscsit_fail_session(struct iscsi_session *sess)
4629 {
4630 	struct iscsi_conn *conn;
4631 
4632 	spin_lock_bh(&sess->conn_lock);
4633 	list_for_each_entry(conn, &sess->sess_conn_list, conn_list) {
4634 		pr_debug("Moving to TARG_CONN_STATE_CLEANUP_WAIT.\n");
4635 		conn->conn_state = TARG_CONN_STATE_CLEANUP_WAIT;
4636 	}
4637 	spin_unlock_bh(&sess->conn_lock);
4638 
4639 	pr_debug("Moving to TARG_SESS_STATE_FAILED.\n");
4640 	sess->session_state = TARG_SESS_STATE_FAILED;
4641 }
4642 
4643 int iscsit_free_session(struct iscsi_session *sess)
4644 {
4645 	u16 conn_count = atomic_read(&sess->nconn);
4646 	struct iscsi_conn *conn, *conn_tmp = NULL;
4647 	int is_last;
4648 
4649 	spin_lock_bh(&sess->conn_lock);
4650 	atomic_set(&sess->sleep_on_sess_wait_comp, 1);
4651 
4652 	list_for_each_entry_safe(conn, conn_tmp, &sess->sess_conn_list,
4653 			conn_list) {
4654 		if (conn_count == 0)
4655 			break;
4656 
4657 		if (list_is_last(&conn->conn_list, &sess->sess_conn_list)) {
4658 			is_last = 1;
4659 		} else {
4660 			iscsit_inc_conn_usage_count(conn_tmp);
4661 			is_last = 0;
4662 		}
4663 		iscsit_inc_conn_usage_count(conn);
4664 
4665 		spin_unlock_bh(&sess->conn_lock);
4666 		iscsit_cause_connection_reinstatement(conn, 1);
4667 		spin_lock_bh(&sess->conn_lock);
4668 
4669 		iscsit_dec_conn_usage_count(conn);
4670 		if (is_last == 0)
4671 			iscsit_dec_conn_usage_count(conn_tmp);
4672 
4673 		conn_count--;
4674 	}
4675 
4676 	if (atomic_read(&sess->nconn)) {
4677 		spin_unlock_bh(&sess->conn_lock);
4678 		wait_for_completion(&sess->session_wait_comp);
4679 	} else
4680 		spin_unlock_bh(&sess->conn_lock);
4681 
4682 	target_put_session(sess->se_sess);
4683 	return 0;
4684 }
4685 
4686 void iscsit_stop_session(
4687 	struct iscsi_session *sess,
4688 	int session_sleep,
4689 	int connection_sleep)
4690 {
4691 	u16 conn_count = atomic_read(&sess->nconn);
4692 	struct iscsi_conn *conn, *conn_tmp = NULL;
4693 	int is_last;
4694 
4695 	spin_lock_bh(&sess->conn_lock);
4696 	if (session_sleep)
4697 		atomic_set(&sess->sleep_on_sess_wait_comp, 1);
4698 
4699 	if (connection_sleep) {
4700 		list_for_each_entry_safe(conn, conn_tmp, &sess->sess_conn_list,
4701 				conn_list) {
4702 			if (conn_count == 0)
4703 				break;
4704 
4705 			if (list_is_last(&conn->conn_list, &sess->sess_conn_list)) {
4706 				is_last = 1;
4707 			} else {
4708 				iscsit_inc_conn_usage_count(conn_tmp);
4709 				is_last = 0;
4710 			}
4711 			iscsit_inc_conn_usage_count(conn);
4712 
4713 			spin_unlock_bh(&sess->conn_lock);
4714 			iscsit_cause_connection_reinstatement(conn, 1);
4715 			spin_lock_bh(&sess->conn_lock);
4716 
4717 			iscsit_dec_conn_usage_count(conn);
4718 			if (is_last == 0)
4719 				iscsit_dec_conn_usage_count(conn_tmp);
4720 			conn_count--;
4721 		}
4722 	} else {
4723 		list_for_each_entry(conn, &sess->sess_conn_list, conn_list)
4724 			iscsit_cause_connection_reinstatement(conn, 0);
4725 	}
4726 
4727 	if (session_sleep && atomic_read(&sess->nconn)) {
4728 		spin_unlock_bh(&sess->conn_lock);
4729 		wait_for_completion(&sess->session_wait_comp);
4730 	} else
4731 		spin_unlock_bh(&sess->conn_lock);
4732 }
4733 
4734 int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
4735 {
4736 	struct iscsi_session *sess;
4737 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
4738 	struct se_session *se_sess, *se_sess_tmp;
4739 	int session_count = 0;
4740 
4741 	spin_lock_bh(&se_tpg->session_lock);
4742 	if (tpg->nsessions && !force) {
4743 		spin_unlock_bh(&se_tpg->session_lock);
4744 		return -1;
4745 	}
4746 
4747 	list_for_each_entry_safe(se_sess, se_sess_tmp, &se_tpg->tpg_sess_list,
4748 			sess_list) {
4749 		sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
4750 
4751 		spin_lock(&sess->conn_lock);
4752 		if (atomic_read(&sess->session_fall_back_to_erl0) ||
4753 		    atomic_read(&sess->session_logout) ||
4754 		    (sess->time2retain_timer_flags & ISCSI_TF_EXPIRED)) {
4755 			spin_unlock(&sess->conn_lock);
4756 			continue;
4757 		}
4758 		atomic_set(&sess->session_reinstatement, 1);
4759 		spin_unlock(&sess->conn_lock);
4760 		spin_unlock_bh(&se_tpg->session_lock);
4761 
4762 		iscsit_free_session(sess);
4763 		spin_lock_bh(&se_tpg->session_lock);
4764 
4765 		session_count++;
4766 	}
4767 	spin_unlock_bh(&se_tpg->session_lock);
4768 
4769 	pr_debug("Released %d iSCSI Session(s) from Target Portal"
4770 			" Group: %hu\n", session_count, tpg->tpgt);
4771 	return 0;
4772 }
4773 
4774 MODULE_DESCRIPTION("iSCSI-Target Driver for mainline target infrastructure");
4775 MODULE_VERSION("4.1.x");
4776 MODULE_AUTHOR("nab@Linux-iSCSI.org");
4777 MODULE_LICENSE("GPL");
4778 
4779 module_init(iscsi_target_init_module);
4780 module_exit(iscsi_target_cleanup_module);
4781