1 /*******************************************************************************
2  * This file contains error recovery level one used by the iSCSI Target driver.
3  *
4  * (c) Copyright 2007-2013 Datera, Inc.
5  *
6  * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  ******************************************************************************/
18 
19 #include <linux/list.h>
20 #include <scsi/iscsi_proto.h>
21 #include <target/target_core_base.h>
22 #include <target/target_core_fabric.h>
23 #include <target/iscsi/iscsi_transport.h>
24 
25 #include "iscsi_target_core.h"
26 #include "iscsi_target_seq_pdu_list.h"
27 #include "iscsi_target_datain_values.h"
28 #include "iscsi_target_device.h"
29 #include "iscsi_target_tpg.h"
30 #include "iscsi_target_util.h"
31 #include "iscsi_target_erl0.h"
32 #include "iscsi_target_erl1.h"
33 #include "iscsi_target_erl2.h"
34 #include "iscsi_target.h"
35 
36 #define OFFLOAD_BUF_SIZE	32768
37 
38 /*
39  *	Used to dump excess datain payload for certain error recovery
40  *	situations.  Receive in OFFLOAD_BUF_SIZE max of datain per rx_data().
41  *
42  *	dump_padding_digest denotes if padding and data digests need
43  *	to be dumped.
44  */
45 int iscsit_dump_data_payload(
46 	struct iscsi_conn *conn,
47 	u32 buf_len,
48 	int dump_padding_digest)
49 {
50 	char *buf, pad_bytes[4];
51 	int ret = DATAOUT_WITHIN_COMMAND_RECOVERY, rx_got;
52 	u32 length, padding, offset = 0, size;
53 	struct kvec iov;
54 
55 	if (conn->sess->sess_ops->RDMAExtensions)
56 		return 0;
57 
58 	length = (buf_len > OFFLOAD_BUF_SIZE) ? OFFLOAD_BUF_SIZE : buf_len;
59 
60 	buf = kzalloc(length, GFP_ATOMIC);
61 	if (!buf) {
62 		pr_err("Unable to allocate %u bytes for offload"
63 				" buffer.\n", length);
64 		return -1;
65 	}
66 	memset(&iov, 0, sizeof(struct kvec));
67 
68 	while (offset < buf_len) {
69 		size = ((offset + length) > buf_len) ?
70 			(buf_len - offset) : length;
71 
72 		iov.iov_len = size;
73 		iov.iov_base = buf;
74 
75 		rx_got = rx_data(conn, &iov, 1, size);
76 		if (rx_got != size) {
77 			ret = DATAOUT_CANNOT_RECOVER;
78 			goto out;
79 		}
80 
81 		offset += size;
82 	}
83 
84 	if (!dump_padding_digest)
85 		goto out;
86 
87 	padding = ((-buf_len) & 3);
88 	if (padding != 0) {
89 		iov.iov_len = padding;
90 		iov.iov_base = pad_bytes;
91 
92 		rx_got = rx_data(conn, &iov, 1, padding);
93 		if (rx_got != padding) {
94 			ret = DATAOUT_CANNOT_RECOVER;
95 			goto out;
96 		}
97 	}
98 
99 	if (conn->conn_ops->DataDigest) {
100 		u32 data_crc;
101 
102 		iov.iov_len = ISCSI_CRC_LEN;
103 		iov.iov_base = &data_crc;
104 
105 		rx_got = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
106 		if (rx_got != ISCSI_CRC_LEN) {
107 			ret = DATAOUT_CANNOT_RECOVER;
108 			goto out;
109 		}
110 	}
111 
112 out:
113 	kfree(buf);
114 	return ret;
115 }
116 
117 /*
118  *	Used for retransmitting R2Ts from a R2T SNACK request.
119  */
120 static int iscsit_send_recovery_r2t_for_snack(
121 	struct iscsi_cmd *cmd,
122 	struct iscsi_r2t *r2t)
123 {
124 	/*
125 	 * If the struct iscsi_r2t has not been sent yet, we can safely
126 	 * ignore retransmission
127 	 * of the R2TSN in question.
128 	 */
129 	spin_lock_bh(&cmd->r2t_lock);
130 	if (!r2t->sent_r2t) {
131 		spin_unlock_bh(&cmd->r2t_lock);
132 		return 0;
133 	}
134 	r2t->sent_r2t = 0;
135 	spin_unlock_bh(&cmd->r2t_lock);
136 
137 	iscsit_add_cmd_to_immediate_queue(cmd, cmd->conn, ISTATE_SEND_R2T);
138 
139 	return 0;
140 }
141 
142 static int iscsit_handle_r2t_snack(
143 	struct iscsi_cmd *cmd,
144 	unsigned char *buf,
145 	u32 begrun,
146 	u32 runlength)
147 {
148 	u32 last_r2tsn;
149 	struct iscsi_r2t *r2t;
150 
151 	/*
152 	 * Make sure the initiator is not requesting retransmission
153 	 * of R2TSNs already acknowledged by a TMR TASK_REASSIGN.
154 	 */
155 	if ((cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
156 	    (begrun <= cmd->acked_data_sn)) {
157 		pr_err("ITT: 0x%08x, R2T SNACK requesting"
158 			" retransmission of R2TSN: 0x%08x to 0x%08x but already"
159 			" acked to  R2TSN: 0x%08x by TMR TASK_REASSIGN,"
160 			" protocol error.\n", cmd->init_task_tag, begrun,
161 			(begrun + runlength), cmd->acked_data_sn);
162 
163 			return iscsit_reject_cmd(cmd,
164 					ISCSI_REASON_PROTOCOL_ERROR, buf);
165 	}
166 
167 	if (runlength) {
168 		if ((begrun + runlength) > cmd->r2t_sn) {
169 			pr_err("Command ITT: 0x%08x received R2T SNACK"
170 			" with BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
171 			" current R2TSN: 0x%08x, protocol error.\n",
172 			cmd->init_task_tag, begrun, runlength, cmd->r2t_sn);
173 			return iscsit_reject_cmd(cmd,
174 					ISCSI_REASON_BOOKMARK_INVALID, buf);
175 		}
176 		last_r2tsn = (begrun + runlength);
177 	} else
178 		last_r2tsn = cmd->r2t_sn;
179 
180 	while (begrun < last_r2tsn) {
181 		r2t = iscsit_get_holder_for_r2tsn(cmd, begrun);
182 		if (!r2t)
183 			return -1;
184 		if (iscsit_send_recovery_r2t_for_snack(cmd, r2t) < 0)
185 			return -1;
186 
187 		begrun++;
188 	}
189 
190 	return 0;
191 }
192 
193 /*
194  *	Generates Offsets and NextBurstLength based on Begrun and Runlength
195  *	carried in a Data SNACK or ExpDataSN in TMR TASK_REASSIGN.
196  *
197  *	For DataSequenceInOrder=Yes and DataPDUInOrder=[Yes,No] only.
198  *
199  *	FIXME: How is this handled for a RData SNACK?
200  */
201 int iscsit_create_recovery_datain_values_datasequenceinorder_yes(
202 	struct iscsi_cmd *cmd,
203 	struct iscsi_datain_req *dr)
204 {
205 	u32 data_sn = 0, data_sn_count = 0;
206 	u32 pdu_start = 0, seq_no = 0;
207 	u32 begrun = dr->begrun;
208 	struct iscsi_conn *conn = cmd->conn;
209 
210 	while (begrun > data_sn++) {
211 		data_sn_count++;
212 		if ((dr->next_burst_len +
213 		     conn->conn_ops->MaxRecvDataSegmentLength) <
214 		     conn->sess->sess_ops->MaxBurstLength) {
215 			dr->read_data_done +=
216 				conn->conn_ops->MaxRecvDataSegmentLength;
217 			dr->next_burst_len +=
218 				conn->conn_ops->MaxRecvDataSegmentLength;
219 		} else {
220 			dr->read_data_done +=
221 				(conn->sess->sess_ops->MaxBurstLength -
222 				 dr->next_burst_len);
223 			dr->next_burst_len = 0;
224 			pdu_start += data_sn_count;
225 			data_sn_count = 0;
226 			seq_no++;
227 		}
228 	}
229 
230 	if (!conn->sess->sess_ops->DataPDUInOrder) {
231 		cmd->seq_no = seq_no;
232 		cmd->pdu_start = pdu_start;
233 		cmd->pdu_send_order = data_sn_count;
234 	}
235 
236 	return 0;
237 }
238 
239 /*
240  *	Generates Offsets and NextBurstLength based on Begrun and Runlength
241  *	carried in a Data SNACK or ExpDataSN in TMR TASK_REASSIGN.
242  *
243  *	For DataSequenceInOrder=No and DataPDUInOrder=[Yes,No] only.
244  *
245  *	FIXME: How is this handled for a RData SNACK?
246  */
247 int iscsit_create_recovery_datain_values_datasequenceinorder_no(
248 	struct iscsi_cmd *cmd,
249 	struct iscsi_datain_req *dr)
250 {
251 	int found_seq = 0, i;
252 	u32 data_sn, read_data_done = 0, seq_send_order = 0;
253 	u32 begrun = dr->begrun;
254 	u32 runlength = dr->runlength;
255 	struct iscsi_conn *conn = cmd->conn;
256 	struct iscsi_seq *first_seq = NULL, *seq = NULL;
257 
258 	if (!cmd->seq_list) {
259 		pr_err("struct iscsi_cmd->seq_list is NULL!\n");
260 		return -1;
261 	}
262 
263 	/*
264 	 * Calculate read_data_done for all sequences containing a
265 	 * first_datasn and last_datasn less than the BegRun.
266 	 *
267 	 * Locate the struct iscsi_seq the BegRun lies within and calculate
268 	 * NextBurstLenghth up to the DataSN based on MaxRecvDataSegmentLength.
269 	 *
270 	 * Also use struct iscsi_seq->seq_send_order to determine where to start.
271 	 */
272 	for (i = 0; i < cmd->seq_count; i++) {
273 		seq = &cmd->seq_list[i];
274 
275 		if (!seq->seq_send_order)
276 			first_seq = seq;
277 
278 		/*
279 		 * No data has been transferred for this DataIN sequence, so the
280 		 * seq->first_datasn and seq->last_datasn have not been set.
281 		 */
282 		if (!seq->sent) {
283 			pr_err("Ignoring non-sent sequence 0x%08x ->"
284 				" 0x%08x\n\n", seq->first_datasn,
285 				seq->last_datasn);
286 			continue;
287 		}
288 
289 		/*
290 		 * This DataIN sequence is precedes the received BegRun, add the
291 		 * total xfer_len of the sequence to read_data_done and reset
292 		 * seq->pdu_send_order.
293 		 */
294 		if ((seq->first_datasn < begrun) &&
295 				(seq->last_datasn < begrun)) {
296 			pr_err("Pre BegRun sequence 0x%08x ->"
297 				" 0x%08x\n", seq->first_datasn,
298 				seq->last_datasn);
299 
300 			read_data_done += cmd->seq_list[i].xfer_len;
301 			seq->next_burst_len = seq->pdu_send_order = 0;
302 			continue;
303 		}
304 
305 		/*
306 		 * The BegRun lies within this DataIN sequence.
307 		 */
308 		if ((seq->first_datasn <= begrun) &&
309 				(seq->last_datasn >= begrun)) {
310 			pr_err("Found sequence begrun: 0x%08x in"
311 				" 0x%08x -> 0x%08x\n", begrun,
312 				seq->first_datasn, seq->last_datasn);
313 
314 			seq_send_order = seq->seq_send_order;
315 			data_sn = seq->first_datasn;
316 			seq->next_burst_len = seq->pdu_send_order = 0;
317 			found_seq = 1;
318 
319 			/*
320 			 * For DataPDUInOrder=Yes, while the first DataSN of
321 			 * the sequence is less than the received BegRun, add
322 			 * the MaxRecvDataSegmentLength to read_data_done and
323 			 * to the sequence's next_burst_len;
324 			 *
325 			 * For DataPDUInOrder=No, while the first DataSN of the
326 			 * sequence is less than the received BegRun, find the
327 			 * struct iscsi_pdu of the DataSN in question and add the
328 			 * MaxRecvDataSegmentLength to read_data_done and to the
329 			 * sequence's next_burst_len;
330 			 */
331 			if (conn->sess->sess_ops->DataPDUInOrder) {
332 				while (data_sn < begrun) {
333 					seq->pdu_send_order++;
334 					read_data_done +=
335 						conn->conn_ops->MaxRecvDataSegmentLength;
336 					seq->next_burst_len +=
337 						conn->conn_ops->MaxRecvDataSegmentLength;
338 					data_sn++;
339 				}
340 			} else {
341 				int j;
342 				struct iscsi_pdu *pdu;
343 
344 				while (data_sn < begrun) {
345 					seq->pdu_send_order++;
346 
347 					for (j = 0; j < seq->pdu_count; j++) {
348 						pdu = &cmd->pdu_list[
349 							seq->pdu_start + j];
350 						if (pdu->data_sn == data_sn) {
351 							read_data_done +=
352 								pdu->length;
353 							seq->next_burst_len +=
354 								pdu->length;
355 						}
356 					}
357 					data_sn++;
358 				}
359 			}
360 			continue;
361 		}
362 
363 		/*
364 		 * This DataIN sequence is larger than the received BegRun,
365 		 * reset seq->pdu_send_order and continue.
366 		 */
367 		if ((seq->first_datasn > begrun) ||
368 				(seq->last_datasn > begrun)) {
369 			pr_err("Post BegRun sequence 0x%08x -> 0x%08x\n",
370 					seq->first_datasn, seq->last_datasn);
371 
372 			seq->next_burst_len = seq->pdu_send_order = 0;
373 			continue;
374 		}
375 	}
376 
377 	if (!found_seq) {
378 		if (!begrun) {
379 			if (!first_seq) {
380 				pr_err("ITT: 0x%08x, Begrun: 0x%08x"
381 					" but first_seq is NULL\n",
382 					cmd->init_task_tag, begrun);
383 				return -1;
384 			}
385 			seq_send_order = first_seq->seq_send_order;
386 			seq->next_burst_len = seq->pdu_send_order = 0;
387 			goto done;
388 		}
389 
390 		pr_err("Unable to locate struct iscsi_seq for ITT: 0x%08x,"
391 			" BegRun: 0x%08x, RunLength: 0x%08x while"
392 			" DataSequenceInOrder=No and DataPDUInOrder=%s.\n",
393 				cmd->init_task_tag, begrun, runlength,
394 			(conn->sess->sess_ops->DataPDUInOrder) ? "Yes" : "No");
395 		return -1;
396 	}
397 
398 done:
399 	dr->read_data_done = read_data_done;
400 	dr->seq_send_order = seq_send_order;
401 
402 	return 0;
403 }
404 
405 static int iscsit_handle_recovery_datain(
406 	struct iscsi_cmd *cmd,
407 	unsigned char *buf,
408 	u32 begrun,
409 	u32 runlength)
410 {
411 	struct iscsi_conn *conn = cmd->conn;
412 	struct iscsi_datain_req *dr;
413 	struct se_cmd *se_cmd = &cmd->se_cmd;
414 
415 	if (!(se_cmd->transport_state & CMD_T_COMPLETE)) {
416 		pr_err("Ignoring ITT: 0x%08x Data SNACK\n",
417 				cmd->init_task_tag);
418 		return 0;
419 	}
420 
421 	/*
422 	 * Make sure the initiator is not requesting retransmission
423 	 * of DataSNs already acknowledged by a Data ACK SNACK.
424 	 */
425 	if ((cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
426 	    (begrun <= cmd->acked_data_sn)) {
427 		pr_err("ITT: 0x%08x, Data SNACK requesting"
428 			" retransmission of DataSN: 0x%08x to 0x%08x but"
429 			" already acked to DataSN: 0x%08x by Data ACK SNACK,"
430 			" protocol error.\n", cmd->init_task_tag, begrun,
431 			(begrun + runlength), cmd->acked_data_sn);
432 
433 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
434 	}
435 
436 	/*
437 	 * Make sure BegRun and RunLength in the Data SNACK are sane.
438 	 * Note: (cmd->data_sn - 1) will carry the maximum DataSN sent.
439 	 */
440 	if ((begrun + runlength) > (cmd->data_sn - 1)) {
441 		pr_err("Initiator requesting BegRun: 0x%08x, RunLength"
442 			": 0x%08x greater than maximum DataSN: 0x%08x.\n",
443 				begrun, runlength, (cmd->data_sn - 1));
444 		return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_INVALID,
445 					 buf);
446 	}
447 
448 	dr = iscsit_allocate_datain_req();
449 	if (!dr)
450 		return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_NO_RESOURCES,
451 					 buf);
452 
453 	dr->data_sn = dr->begrun = begrun;
454 	dr->runlength = runlength;
455 	dr->generate_recovery_values = 1;
456 	dr->recovery = DATAIN_WITHIN_COMMAND_RECOVERY;
457 
458 	iscsit_attach_datain_req(cmd, dr);
459 
460 	cmd->i_state = ISTATE_SEND_DATAIN;
461 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
462 
463 	return 0;
464 }
465 
466 int iscsit_handle_recovery_datain_or_r2t(
467 	struct iscsi_conn *conn,
468 	unsigned char *buf,
469 	itt_t init_task_tag,
470 	u32 targ_xfer_tag,
471 	u32 begrun,
472 	u32 runlength)
473 {
474 	struct iscsi_cmd *cmd;
475 
476 	cmd = iscsit_find_cmd_from_itt(conn, init_task_tag);
477 	if (!cmd)
478 		return 0;
479 
480 	/*
481 	 * FIXME: This will not work for bidi commands.
482 	 */
483 	switch (cmd->data_direction) {
484 	case DMA_TO_DEVICE:
485 		return iscsit_handle_r2t_snack(cmd, buf, begrun, runlength);
486 	case DMA_FROM_DEVICE:
487 		return iscsit_handle_recovery_datain(cmd, buf, begrun,
488 				runlength);
489 	default:
490 		pr_err("Unknown cmd->data_direction: 0x%02x\n",
491 				cmd->data_direction);
492 		return -1;
493 	}
494 
495 	return 0;
496 }
497 
498 /* #warning FIXME: Status SNACK needs to be dependent on OPCODE!!! */
499 int iscsit_handle_status_snack(
500 	struct iscsi_conn *conn,
501 	itt_t init_task_tag,
502 	u32 targ_xfer_tag,
503 	u32 begrun,
504 	u32 runlength)
505 {
506 	struct iscsi_cmd *cmd = NULL;
507 	u32 last_statsn;
508 	int found_cmd;
509 
510 	if (conn->exp_statsn > begrun) {
511 		pr_err("Got Status SNACK Begrun: 0x%08x, RunLength:"
512 			" 0x%08x but already got ExpStatSN: 0x%08x on CID:"
513 			" %hu.\n", begrun, runlength, conn->exp_statsn,
514 			conn->cid);
515 		return 0;
516 	}
517 
518 	last_statsn = (!runlength) ? conn->stat_sn : (begrun + runlength);
519 
520 	while (begrun < last_statsn) {
521 		found_cmd = 0;
522 
523 		spin_lock_bh(&conn->cmd_lock);
524 		list_for_each_entry(cmd, &conn->conn_cmd_list, i_conn_node) {
525 			if (cmd->stat_sn == begrun) {
526 				found_cmd = 1;
527 				break;
528 			}
529 		}
530 		spin_unlock_bh(&conn->cmd_lock);
531 
532 		if (!found_cmd) {
533 			pr_err("Unable to find StatSN: 0x%08x for"
534 				" a Status SNACK, assuming this was a"
535 				" protactic SNACK for an untransmitted"
536 				" StatSN, ignoring.\n", begrun);
537 			begrun++;
538 			continue;
539 		}
540 
541 		spin_lock_bh(&cmd->istate_lock);
542 		if (cmd->i_state == ISTATE_SEND_DATAIN) {
543 			spin_unlock_bh(&cmd->istate_lock);
544 			pr_err("Ignoring Status SNACK for BegRun:"
545 				" 0x%08x, RunLength: 0x%08x, assuming this was"
546 				" a protactic SNACK for an untransmitted"
547 				" StatSN\n", begrun, runlength);
548 			begrun++;
549 			continue;
550 		}
551 		spin_unlock_bh(&cmd->istate_lock);
552 
553 		cmd->i_state = ISTATE_SEND_STATUS_RECOVERY;
554 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
555 		begrun++;
556 	}
557 
558 	return 0;
559 }
560 
561 int iscsit_handle_data_ack(
562 	struct iscsi_conn *conn,
563 	u32 targ_xfer_tag,
564 	u32 begrun,
565 	u32 runlength)
566 {
567 	struct iscsi_cmd *cmd = NULL;
568 
569 	cmd = iscsit_find_cmd_from_ttt(conn, targ_xfer_tag);
570 	if (!cmd) {
571 		pr_err("Data ACK SNACK for TTT: 0x%08x is"
572 			" invalid.\n", targ_xfer_tag);
573 		return -1;
574 	}
575 
576 	if (begrun <= cmd->acked_data_sn) {
577 		pr_err("ITT: 0x%08x Data ACK SNACK BegRUN: 0x%08x is"
578 			" less than the already acked DataSN: 0x%08x.\n",
579 			cmd->init_task_tag, begrun, cmd->acked_data_sn);
580 		return -1;
581 	}
582 
583 	/*
584 	 * For Data ACK SNACK, BegRun is the next expected DataSN.
585 	 * (see iSCSI v19: 10.16.6)
586 	 */
587 	cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
588 	cmd->acked_data_sn = (begrun - 1);
589 
590 	pr_debug("Received Data ACK SNACK for ITT: 0x%08x,"
591 		" updated acked DataSN to 0x%08x.\n",
592 			cmd->init_task_tag, cmd->acked_data_sn);
593 
594 	return 0;
595 }
596 
597 static int iscsit_send_recovery_r2t(
598 	struct iscsi_cmd *cmd,
599 	u32 offset,
600 	u32 xfer_len)
601 {
602 	int ret;
603 
604 	spin_lock_bh(&cmd->r2t_lock);
605 	ret = iscsit_add_r2t_to_list(cmd, offset, xfer_len, 1, 0);
606 	spin_unlock_bh(&cmd->r2t_lock);
607 
608 	return ret;
609 }
610 
611 int iscsit_dataout_datapduinorder_no_fbit(
612 	struct iscsi_cmd *cmd,
613 	struct iscsi_pdu *pdu)
614 {
615 	int i, send_recovery_r2t = 0, recovery = 0;
616 	u32 length = 0, offset = 0, pdu_count = 0, xfer_len = 0;
617 	struct iscsi_conn *conn = cmd->conn;
618 	struct iscsi_pdu *first_pdu = NULL;
619 
620 	/*
621 	 * Get an struct iscsi_pdu pointer to the first PDU, and total PDU count
622 	 * of the DataOUT sequence.
623 	 */
624 	if (conn->sess->sess_ops->DataSequenceInOrder) {
625 		for (i = 0; i < cmd->pdu_count; i++) {
626 			if (cmd->pdu_list[i].seq_no == pdu->seq_no) {
627 				if (!first_pdu)
628 					first_pdu = &cmd->pdu_list[i];
629 				 xfer_len += cmd->pdu_list[i].length;
630 				 pdu_count++;
631 			} else if (pdu_count)
632 				break;
633 		}
634 	} else {
635 		struct iscsi_seq *seq = cmd->seq_ptr;
636 
637 		first_pdu = &cmd->pdu_list[seq->pdu_start];
638 		pdu_count = seq->pdu_count;
639 	}
640 
641 	if (!first_pdu || !pdu_count)
642 		return DATAOUT_CANNOT_RECOVER;
643 
644 	/*
645 	 * Loop through the ending DataOUT Sequence checking each struct iscsi_pdu.
646 	 * The following ugly logic does batching of not received PDUs.
647 	 */
648 	for (i = 0; i < pdu_count; i++) {
649 		if (first_pdu[i].status == ISCSI_PDU_RECEIVED_OK) {
650 			if (!send_recovery_r2t)
651 				continue;
652 
653 			if (iscsit_send_recovery_r2t(cmd, offset, length) < 0)
654 				return DATAOUT_CANNOT_RECOVER;
655 
656 			send_recovery_r2t = length = offset = 0;
657 			continue;
658 		}
659 		/*
660 		 * Set recovery = 1 for any missing, CRC failed, or timed
661 		 * out PDUs to let the DataOUT logic know that this sequence
662 		 * has not been completed yet.
663 		 *
664 		 * Also, only send a Recovery R2T for ISCSI_PDU_NOT_RECEIVED.
665 		 * We assume if the PDU either failed CRC or timed out
666 		 * that a Recovery R2T has already been sent.
667 		 */
668 		recovery = 1;
669 
670 		if (first_pdu[i].status != ISCSI_PDU_NOT_RECEIVED)
671 			continue;
672 
673 		if (!offset)
674 			offset = first_pdu[i].offset;
675 		length += first_pdu[i].length;
676 
677 		send_recovery_r2t = 1;
678 	}
679 
680 	if (send_recovery_r2t)
681 		if (iscsit_send_recovery_r2t(cmd, offset, length) < 0)
682 			return DATAOUT_CANNOT_RECOVER;
683 
684 	return (!recovery) ? DATAOUT_NORMAL : DATAOUT_WITHIN_COMMAND_RECOVERY;
685 }
686 
687 static int iscsit_recalculate_dataout_values(
688 	struct iscsi_cmd *cmd,
689 	u32 pdu_offset,
690 	u32 pdu_length,
691 	u32 *r2t_offset,
692 	u32 *r2t_length)
693 {
694 	int i;
695 	struct iscsi_conn *conn = cmd->conn;
696 	struct iscsi_pdu *pdu = NULL;
697 
698 	if (conn->sess->sess_ops->DataSequenceInOrder) {
699 		cmd->data_sn = 0;
700 
701 		if (conn->sess->sess_ops->DataPDUInOrder) {
702 			*r2t_offset = cmd->write_data_done;
703 			*r2t_length = (cmd->seq_end_offset -
704 					cmd->write_data_done);
705 			return 0;
706 		}
707 
708 		*r2t_offset = cmd->seq_start_offset;
709 		*r2t_length = (cmd->seq_end_offset - cmd->seq_start_offset);
710 
711 		for (i = 0; i < cmd->pdu_count; i++) {
712 			pdu = &cmd->pdu_list[i];
713 
714 			if (pdu->status != ISCSI_PDU_RECEIVED_OK)
715 				continue;
716 
717 			if ((pdu->offset >= cmd->seq_start_offset) &&
718 			   ((pdu->offset + pdu->length) <=
719 			     cmd->seq_end_offset)) {
720 				if (!cmd->unsolicited_data)
721 					cmd->next_burst_len -= pdu->length;
722 				else
723 					cmd->first_burst_len -= pdu->length;
724 
725 				cmd->write_data_done -= pdu->length;
726 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
727 			}
728 		}
729 	} else {
730 		struct iscsi_seq *seq = NULL;
731 
732 		seq = iscsit_get_seq_holder(cmd, pdu_offset, pdu_length);
733 		if (!seq)
734 			return -1;
735 
736 		*r2t_offset = seq->orig_offset;
737 		*r2t_length = seq->xfer_len;
738 
739 		cmd->write_data_done -= (seq->offset - seq->orig_offset);
740 		if (cmd->immediate_data)
741 			cmd->first_burst_len = cmd->write_data_done;
742 
743 		seq->data_sn = 0;
744 		seq->offset = seq->orig_offset;
745 		seq->next_burst_len = 0;
746 		seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
747 
748 		if (conn->sess->sess_ops->DataPDUInOrder)
749 			return 0;
750 
751 		for (i = 0; i < seq->pdu_count; i++) {
752 			pdu = &cmd->pdu_list[i+seq->pdu_start];
753 
754 			if (pdu->status != ISCSI_PDU_RECEIVED_OK)
755 				continue;
756 
757 			pdu->status = ISCSI_PDU_NOT_RECEIVED;
758 		}
759 	}
760 
761 	return 0;
762 }
763 
764 int iscsit_recover_dataout_sequence(
765 	struct iscsi_cmd *cmd,
766 	u32 pdu_offset,
767 	u32 pdu_length)
768 {
769 	u32 r2t_length = 0, r2t_offset = 0;
770 
771 	spin_lock_bh(&cmd->istate_lock);
772 	cmd->cmd_flags |= ICF_WITHIN_COMMAND_RECOVERY;
773 	spin_unlock_bh(&cmd->istate_lock);
774 
775 	if (iscsit_recalculate_dataout_values(cmd, pdu_offset, pdu_length,
776 			&r2t_offset, &r2t_length) < 0)
777 		return DATAOUT_CANNOT_RECOVER;
778 
779 	iscsit_send_recovery_r2t(cmd, r2t_offset, r2t_length);
780 
781 	return DATAOUT_WITHIN_COMMAND_RECOVERY;
782 }
783 
784 static struct iscsi_ooo_cmdsn *iscsit_allocate_ooo_cmdsn(void)
785 {
786 	struct iscsi_ooo_cmdsn *ooo_cmdsn = NULL;
787 
788 	ooo_cmdsn = kmem_cache_zalloc(lio_ooo_cache, GFP_ATOMIC);
789 	if (!ooo_cmdsn) {
790 		pr_err("Unable to allocate memory for"
791 			" struct iscsi_ooo_cmdsn.\n");
792 		return NULL;
793 	}
794 	INIT_LIST_HEAD(&ooo_cmdsn->ooo_list);
795 
796 	return ooo_cmdsn;
797 }
798 
799 /*
800  *	Called with sess->cmdsn_mutex held.
801  */
802 static int iscsit_attach_ooo_cmdsn(
803 	struct iscsi_session *sess,
804 	struct iscsi_ooo_cmdsn *ooo_cmdsn)
805 {
806 	struct iscsi_ooo_cmdsn *ooo_tail, *ooo_tmp;
807 	/*
808 	 * We attach the struct iscsi_ooo_cmdsn entry to the out of order
809 	 * list in increasing CmdSN order.
810 	 * This allows iscsi_execute_ooo_cmdsns() to detect any
811 	 * additional CmdSN holes while performing delayed execution.
812 	 */
813 	if (list_empty(&sess->sess_ooo_cmdsn_list))
814 		list_add_tail(&ooo_cmdsn->ooo_list,
815 				&sess->sess_ooo_cmdsn_list);
816 	else {
817 		ooo_tail = list_entry(sess->sess_ooo_cmdsn_list.prev,
818 				typeof(*ooo_tail), ooo_list);
819 		/*
820 		 * CmdSN is greater than the tail of the list.
821 		 */
822 		if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn))
823 			list_add_tail(&ooo_cmdsn->ooo_list,
824 					&sess->sess_ooo_cmdsn_list);
825 		else {
826 			/*
827 			 * CmdSN is either lower than the head,  or somewhere
828 			 * in the middle.
829 			 */
830 			list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
831 						ooo_list) {
832 				if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn))
833 					continue;
834 
835 				/* Insert before this entry */
836 				list_add(&ooo_cmdsn->ooo_list,
837 					ooo_tmp->ooo_list.prev);
838 				break;
839 			}
840 		}
841 	}
842 
843 	return 0;
844 }
845 
846 /*
847  *	Removes an struct iscsi_ooo_cmdsn from a session's list,
848  *	called with struct iscsi_session->cmdsn_mutex held.
849  */
850 void iscsit_remove_ooo_cmdsn(
851 	struct iscsi_session *sess,
852 	struct iscsi_ooo_cmdsn *ooo_cmdsn)
853 {
854 	list_del(&ooo_cmdsn->ooo_list);
855 	kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
856 }
857 
858 void iscsit_clear_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
859 {
860 	struct iscsi_ooo_cmdsn *ooo_cmdsn;
861 	struct iscsi_session *sess = conn->sess;
862 
863 	mutex_lock(&sess->cmdsn_mutex);
864 	list_for_each_entry(ooo_cmdsn, &sess->sess_ooo_cmdsn_list, ooo_list) {
865 		if (ooo_cmdsn->cid != conn->cid)
866 			continue;
867 
868 		ooo_cmdsn->cmd = NULL;
869 	}
870 	mutex_unlock(&sess->cmdsn_mutex);
871 }
872 
873 /*
874  *	Called with sess->cmdsn_mutex held.
875  */
876 int iscsit_execute_ooo_cmdsns(struct iscsi_session *sess)
877 {
878 	int ooo_count = 0;
879 	struct iscsi_cmd *cmd = NULL;
880 	struct iscsi_ooo_cmdsn *ooo_cmdsn, *ooo_cmdsn_tmp;
881 
882 	list_for_each_entry_safe(ooo_cmdsn, ooo_cmdsn_tmp,
883 				&sess->sess_ooo_cmdsn_list, ooo_list) {
884 		if (ooo_cmdsn->cmdsn != sess->exp_cmd_sn)
885 			continue;
886 
887 		if (!ooo_cmdsn->cmd) {
888 			sess->exp_cmd_sn++;
889 			iscsit_remove_ooo_cmdsn(sess, ooo_cmdsn);
890 			continue;
891 		}
892 
893 		cmd = ooo_cmdsn->cmd;
894 		cmd->i_state = cmd->deferred_i_state;
895 		ooo_count++;
896 		sess->exp_cmd_sn++;
897 		pr_debug("Executing out of order CmdSN: 0x%08x,"
898 			" incremented ExpCmdSN to 0x%08x.\n",
899 			cmd->cmd_sn, sess->exp_cmd_sn);
900 
901 		iscsit_remove_ooo_cmdsn(sess, ooo_cmdsn);
902 
903 		if (iscsit_execute_cmd(cmd, 1) < 0)
904 			return -1;
905 
906 		continue;
907 	}
908 
909 	return ooo_count;
910 }
911 
912 /*
913  *	Called either:
914  *
915  *	1. With sess->cmdsn_mutex held from iscsi_execute_ooo_cmdsns()
916  *	or iscsi_check_received_cmdsn().
917  *	2. With no locks held directly from iscsi_handle_XXX_pdu() functions
918  *	for immediate commands.
919  */
920 int iscsit_execute_cmd(struct iscsi_cmd *cmd, int ooo)
921 {
922 	struct se_cmd *se_cmd = &cmd->se_cmd;
923 	struct iscsi_conn *conn = cmd->conn;
924 	int lr = 0;
925 
926 	spin_lock_bh(&cmd->istate_lock);
927 	if (ooo)
928 		cmd->cmd_flags &= ~ICF_OOO_CMDSN;
929 
930 	switch (cmd->iscsi_opcode) {
931 	case ISCSI_OP_SCSI_CMD:
932 		/*
933 		 * Go ahead and send the CHECK_CONDITION status for
934 		 * any SCSI CDB exceptions that may have occurred.
935 		 */
936 		if (cmd->sense_reason) {
937 			if (cmd->sense_reason == TCM_RESERVATION_CONFLICT) {
938 				cmd->i_state = ISTATE_SEND_STATUS;
939 				spin_unlock_bh(&cmd->istate_lock);
940 				iscsit_add_cmd_to_response_queue(cmd, cmd->conn,
941 						cmd->i_state);
942 				return 0;
943 			}
944 			spin_unlock_bh(&cmd->istate_lock);
945 			/*
946 			 * Determine if delayed TASK_ABORTED status for WRITEs
947 			 * should be sent now if no unsolicited data out
948 			 * payloads are expected, or if the delayed status
949 			 * should be sent after unsolicited data out with
950 			 * ISCSI_FLAG_CMD_FINAL set in iscsi_handle_data_out()
951 			 */
952 			if (transport_check_aborted_status(se_cmd,
953 					(cmd->unsolicited_data == 0)) != 0)
954 				return 0;
955 			/*
956 			 * Otherwise send CHECK_CONDITION and sense for
957 			 * exception
958 			 */
959 			return transport_send_check_condition_and_sense(se_cmd,
960 					cmd->sense_reason, 0);
961 		}
962 		/*
963 		 * Special case for delayed CmdSN with Immediate
964 		 * Data and/or Unsolicited Data Out attached.
965 		 */
966 		if (cmd->immediate_data) {
967 			if (cmd->cmd_flags & ICF_GOT_LAST_DATAOUT) {
968 				spin_unlock_bh(&cmd->istate_lock);
969 				target_execute_cmd(&cmd->se_cmd);
970 				return 0;
971 			}
972 			spin_unlock_bh(&cmd->istate_lock);
973 
974 			if (!(cmd->cmd_flags &
975 					ICF_NON_IMMEDIATE_UNSOLICITED_DATA)) {
976 				/*
977 				 * Send the delayed TASK_ABORTED status for
978 				 * WRITEs if no more unsolicitied data is
979 				 * expected.
980 				 */
981 				if (transport_check_aborted_status(se_cmd, 1)
982 						!= 0)
983 					return 0;
984 
985 				iscsit_set_dataout_sequence_values(cmd);
986 				conn->conn_transport->iscsit_get_dataout(conn, cmd, false);
987 			}
988 			return 0;
989 		}
990 		/*
991 		 * The default handler.
992 		 */
993 		spin_unlock_bh(&cmd->istate_lock);
994 
995 		if ((cmd->data_direction == DMA_TO_DEVICE) &&
996 		    !(cmd->cmd_flags & ICF_NON_IMMEDIATE_UNSOLICITED_DATA)) {
997 			/*
998 			 * Send the delayed TASK_ABORTED status for WRITEs if
999 			 * no more nsolicitied data is expected.
1000 			 */
1001 			if (transport_check_aborted_status(se_cmd, 1) != 0)
1002 				return 0;
1003 
1004 			iscsit_set_unsoliticed_dataout(cmd);
1005 		}
1006 		return transport_handle_cdb_direct(&cmd->se_cmd);
1007 
1008 	case ISCSI_OP_NOOP_OUT:
1009 	case ISCSI_OP_TEXT:
1010 		spin_unlock_bh(&cmd->istate_lock);
1011 		iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
1012 		break;
1013 	case ISCSI_OP_SCSI_TMFUNC:
1014 		if (cmd->se_cmd.se_tmr_req->response) {
1015 			spin_unlock_bh(&cmd->istate_lock);
1016 			iscsit_add_cmd_to_response_queue(cmd, cmd->conn,
1017 					cmd->i_state);
1018 			return 0;
1019 		}
1020 		spin_unlock_bh(&cmd->istate_lock);
1021 
1022 		return transport_generic_handle_tmr(&cmd->se_cmd);
1023 	case ISCSI_OP_LOGOUT:
1024 		spin_unlock_bh(&cmd->istate_lock);
1025 		switch (cmd->logout_reason) {
1026 		case ISCSI_LOGOUT_REASON_CLOSE_SESSION:
1027 			lr = iscsit_logout_closesession(cmd, cmd->conn);
1028 			break;
1029 		case ISCSI_LOGOUT_REASON_CLOSE_CONNECTION:
1030 			lr = iscsit_logout_closeconnection(cmd, cmd->conn);
1031 			break;
1032 		case ISCSI_LOGOUT_REASON_RECOVERY:
1033 			lr = iscsit_logout_removeconnforrecovery(cmd, cmd->conn);
1034 			break;
1035 		default:
1036 			pr_err("Unknown iSCSI Logout Request Code:"
1037 				" 0x%02x\n", cmd->logout_reason);
1038 			return -1;
1039 		}
1040 
1041 		return lr;
1042 	default:
1043 		spin_unlock_bh(&cmd->istate_lock);
1044 		pr_err("Cannot perform out of order execution for"
1045 		" unknown iSCSI Opcode: 0x%02x\n", cmd->iscsi_opcode);
1046 		return -1;
1047 	}
1048 
1049 	return 0;
1050 }
1051 
1052 void iscsit_free_all_ooo_cmdsns(struct iscsi_session *sess)
1053 {
1054 	struct iscsi_ooo_cmdsn *ooo_cmdsn, *ooo_cmdsn_tmp;
1055 
1056 	mutex_lock(&sess->cmdsn_mutex);
1057 	list_for_each_entry_safe(ooo_cmdsn, ooo_cmdsn_tmp,
1058 			&sess->sess_ooo_cmdsn_list, ooo_list) {
1059 
1060 		list_del(&ooo_cmdsn->ooo_list);
1061 		kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
1062 	}
1063 	mutex_unlock(&sess->cmdsn_mutex);
1064 }
1065 
1066 int iscsit_handle_ooo_cmdsn(
1067 	struct iscsi_session *sess,
1068 	struct iscsi_cmd *cmd,
1069 	u32 cmdsn)
1070 {
1071 	int batch = 0;
1072 	struct iscsi_ooo_cmdsn *ooo_cmdsn = NULL, *ooo_tail = NULL;
1073 
1074 	cmd->deferred_i_state		= cmd->i_state;
1075 	cmd->i_state			= ISTATE_DEFERRED_CMD;
1076 	cmd->cmd_flags			|= ICF_OOO_CMDSN;
1077 
1078 	if (list_empty(&sess->sess_ooo_cmdsn_list))
1079 		batch = 1;
1080 	else {
1081 		ooo_tail = list_entry(sess->sess_ooo_cmdsn_list.prev,
1082 				typeof(*ooo_tail), ooo_list);
1083 		if (ooo_tail->cmdsn != (cmdsn - 1))
1084 			batch = 1;
1085 	}
1086 
1087 	ooo_cmdsn = iscsit_allocate_ooo_cmdsn();
1088 	if (!ooo_cmdsn)
1089 		return -ENOMEM;
1090 
1091 	ooo_cmdsn->cmd			= cmd;
1092 	ooo_cmdsn->batch_count		= (batch) ?
1093 					  (cmdsn - sess->exp_cmd_sn) : 1;
1094 	ooo_cmdsn->cid			= cmd->conn->cid;
1095 	ooo_cmdsn->exp_cmdsn		= sess->exp_cmd_sn;
1096 	ooo_cmdsn->cmdsn		= cmdsn;
1097 
1098 	if (iscsit_attach_ooo_cmdsn(sess, ooo_cmdsn) < 0) {
1099 		kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
1100 		return -ENOMEM;
1101 	}
1102 
1103 	return 0;
1104 }
1105 
1106 static int iscsit_set_dataout_timeout_values(
1107 	struct iscsi_cmd *cmd,
1108 	u32 *offset,
1109 	u32 *length)
1110 {
1111 	struct iscsi_conn *conn = cmd->conn;
1112 	struct iscsi_r2t *r2t;
1113 
1114 	if (cmd->unsolicited_data) {
1115 		*offset = 0;
1116 		*length = (conn->sess->sess_ops->FirstBurstLength >
1117 			   cmd->se_cmd.data_length) ?
1118 			   cmd->se_cmd.data_length :
1119 			   conn->sess->sess_ops->FirstBurstLength;
1120 		return 0;
1121 	}
1122 
1123 	spin_lock_bh(&cmd->r2t_lock);
1124 	if (list_empty(&cmd->cmd_r2t_list)) {
1125 		pr_err("cmd->cmd_r2t_list is empty!\n");
1126 		spin_unlock_bh(&cmd->r2t_lock);
1127 		return -1;
1128 	}
1129 
1130 	list_for_each_entry(r2t, &cmd->cmd_r2t_list, r2t_list) {
1131 		if (r2t->sent_r2t && !r2t->recovery_r2t && !r2t->seq_complete) {
1132 			*offset = r2t->offset;
1133 			*length = r2t->xfer_len;
1134 			spin_unlock_bh(&cmd->r2t_lock);
1135 			return 0;
1136 		}
1137 	}
1138 	spin_unlock_bh(&cmd->r2t_lock);
1139 
1140 	pr_err("Unable to locate any incomplete DataOUT"
1141 		" sequences for ITT: 0x%08x.\n", cmd->init_task_tag);
1142 
1143 	return -1;
1144 }
1145 
1146 /*
1147  *	NOTE: Called from interrupt (timer) context.
1148  */
1149 static void iscsit_handle_dataout_timeout(unsigned long data)
1150 {
1151 	u32 pdu_length = 0, pdu_offset = 0;
1152 	u32 r2t_length = 0, r2t_offset = 0;
1153 	struct iscsi_cmd *cmd = (struct iscsi_cmd *) data;
1154 	struct iscsi_conn *conn = cmd->conn;
1155 	struct iscsi_session *sess = NULL;
1156 	struct iscsi_node_attrib *na;
1157 
1158 	iscsit_inc_conn_usage_count(conn);
1159 
1160 	spin_lock_bh(&cmd->dataout_timeout_lock);
1161 	if (cmd->dataout_timer_flags & ISCSI_TF_STOP) {
1162 		spin_unlock_bh(&cmd->dataout_timeout_lock);
1163 		iscsit_dec_conn_usage_count(conn);
1164 		return;
1165 	}
1166 	cmd->dataout_timer_flags &= ~ISCSI_TF_RUNNING;
1167 	sess = conn->sess;
1168 	na = iscsit_tpg_get_node_attrib(sess);
1169 
1170 	if (!sess->sess_ops->ErrorRecoveryLevel) {
1171 		pr_debug("Unable to recover from DataOut timeout while"
1172 			" in ERL=0.\n");
1173 		goto failure;
1174 	}
1175 
1176 	if (++cmd->dataout_timeout_retries == na->dataout_timeout_retries) {
1177 		pr_debug("Command ITT: 0x%08x exceeded max retries"
1178 			" for DataOUT timeout %u, closing iSCSI connection.\n",
1179 			cmd->init_task_tag, na->dataout_timeout_retries);
1180 		goto failure;
1181 	}
1182 
1183 	cmd->cmd_flags |= ICF_WITHIN_COMMAND_RECOVERY;
1184 
1185 	if (conn->sess->sess_ops->DataSequenceInOrder) {
1186 		if (conn->sess->sess_ops->DataPDUInOrder) {
1187 			pdu_offset = cmd->write_data_done;
1188 			if ((pdu_offset + (conn->sess->sess_ops->MaxBurstLength -
1189 			     cmd->next_burst_len)) > cmd->se_cmd.data_length)
1190 				pdu_length = (cmd->se_cmd.data_length -
1191 					cmd->write_data_done);
1192 			else
1193 				pdu_length = (conn->sess->sess_ops->MaxBurstLength -
1194 						cmd->next_burst_len);
1195 		} else {
1196 			pdu_offset = cmd->seq_start_offset;
1197 			pdu_length = (cmd->seq_end_offset -
1198 				cmd->seq_start_offset);
1199 		}
1200 	} else {
1201 		if (iscsit_set_dataout_timeout_values(cmd, &pdu_offset,
1202 				&pdu_length) < 0)
1203 			goto failure;
1204 	}
1205 
1206 	if (iscsit_recalculate_dataout_values(cmd, pdu_offset, pdu_length,
1207 			&r2t_offset, &r2t_length) < 0)
1208 		goto failure;
1209 
1210 	pr_debug("Command ITT: 0x%08x timed out waiting for"
1211 		" completion of %sDataOUT Sequence Offset: %u, Length: %u\n",
1212 		cmd->init_task_tag, (cmd->unsolicited_data) ? "Unsolicited " :
1213 		"", r2t_offset, r2t_length);
1214 
1215 	if (iscsit_send_recovery_r2t(cmd, r2t_offset, r2t_length) < 0)
1216 		goto failure;
1217 
1218 	iscsit_start_dataout_timer(cmd, conn);
1219 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1220 	iscsit_dec_conn_usage_count(conn);
1221 
1222 	return;
1223 
1224 failure:
1225 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1226 	iscsit_cause_connection_reinstatement(conn, 0);
1227 	iscsit_dec_conn_usage_count(conn);
1228 }
1229 
1230 void iscsit_mod_dataout_timer(struct iscsi_cmd *cmd)
1231 {
1232 	struct iscsi_conn *conn = cmd->conn;
1233 	struct iscsi_session *sess = conn->sess;
1234 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
1235 
1236 	spin_lock_bh(&cmd->dataout_timeout_lock);
1237 	if (!(cmd->dataout_timer_flags & ISCSI_TF_RUNNING)) {
1238 		spin_unlock_bh(&cmd->dataout_timeout_lock);
1239 		return;
1240 	}
1241 
1242 	mod_timer(&cmd->dataout_timer,
1243 		(get_jiffies_64() + na->dataout_timeout * HZ));
1244 	pr_debug("Updated DataOUT timer for ITT: 0x%08x",
1245 			cmd->init_task_tag);
1246 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1247 }
1248 
1249 /*
1250  *	Called with cmd->dataout_timeout_lock held.
1251  */
1252 void iscsit_start_dataout_timer(
1253 	struct iscsi_cmd *cmd,
1254 	struct iscsi_conn *conn)
1255 {
1256 	struct iscsi_session *sess = conn->sess;
1257 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
1258 
1259 	if (cmd->dataout_timer_flags & ISCSI_TF_RUNNING)
1260 		return;
1261 
1262 	pr_debug("Starting DataOUT timer for ITT: 0x%08x on"
1263 		" CID: %hu.\n", cmd->init_task_tag, conn->cid);
1264 
1265 	init_timer(&cmd->dataout_timer);
1266 	cmd->dataout_timer.expires = (get_jiffies_64() + na->dataout_timeout * HZ);
1267 	cmd->dataout_timer.data = (unsigned long)cmd;
1268 	cmd->dataout_timer.function = iscsit_handle_dataout_timeout;
1269 	cmd->dataout_timer_flags &= ~ISCSI_TF_STOP;
1270 	cmd->dataout_timer_flags |= ISCSI_TF_RUNNING;
1271 	add_timer(&cmd->dataout_timer);
1272 }
1273 
1274 void iscsit_stop_dataout_timer(struct iscsi_cmd *cmd)
1275 {
1276 	spin_lock_bh(&cmd->dataout_timeout_lock);
1277 	if (!(cmd->dataout_timer_flags & ISCSI_TF_RUNNING)) {
1278 		spin_unlock_bh(&cmd->dataout_timeout_lock);
1279 		return;
1280 	}
1281 	cmd->dataout_timer_flags |= ISCSI_TF_STOP;
1282 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1283 
1284 	del_timer_sync(&cmd->dataout_timer);
1285 
1286 	spin_lock_bh(&cmd->dataout_timeout_lock);
1287 	cmd->dataout_timer_flags &= ~ISCSI_TF_RUNNING;
1288 	pr_debug("Stopped DataOUT Timer for ITT: 0x%08x\n",
1289 			cmd->init_task_tag);
1290 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1291 }
1292 EXPORT_SYMBOL(iscsit_stop_dataout_timer);
1293