1 /*******************************************************************************
2  * This file contains error recovery level one used by the iSCSI Target driver.
3  *
4  * (c) Copyright 2007-2013 Datera, Inc.
5  *
6  * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  ******************************************************************************/
18 
19 #include <linux/list.h>
20 #include <linux/slab.h>
21 #include <scsi/iscsi_proto.h>
22 #include <target/target_core_base.h>
23 #include <target/target_core_fabric.h>
24 #include <target/iscsi/iscsi_transport.h>
25 
26 #include <target/iscsi/iscsi_target_core.h>
27 #include "iscsi_target_seq_pdu_list.h"
28 #include "iscsi_target_datain_values.h"
29 #include "iscsi_target_device.h"
30 #include "iscsi_target_tpg.h"
31 #include "iscsi_target_util.h"
32 #include "iscsi_target_erl0.h"
33 #include "iscsi_target_erl1.h"
34 #include "iscsi_target_erl2.h"
35 #include "iscsi_target.h"
36 
37 #define OFFLOAD_BUF_SIZE	32768U
38 
39 /*
40  *	Used to dump excess datain payload for certain error recovery
41  *	situations.  Receive in OFFLOAD_BUF_SIZE max of datain per rx_data().
42  *
43  *	dump_padding_digest denotes if padding and data digests need
44  *	to be dumped.
45  */
46 int iscsit_dump_data_payload(
47 	struct iscsi_conn *conn,
48 	u32 buf_len,
49 	int dump_padding_digest)
50 {
51 	char *buf, pad_bytes[4];
52 	int ret = DATAOUT_WITHIN_COMMAND_RECOVERY, rx_got;
53 	u32 length, padding, offset = 0, size;
54 	struct kvec iov;
55 
56 	if (conn->sess->sess_ops->RDMAExtensions)
57 		return 0;
58 
59 	length = min(buf_len, OFFLOAD_BUF_SIZE);
60 
61 	buf = kzalloc(length, GFP_ATOMIC);
62 	if (!buf) {
63 		pr_err("Unable to allocate %u bytes for offload"
64 				" buffer.\n", length);
65 		return -1;
66 	}
67 	memset(&iov, 0, sizeof(struct kvec));
68 
69 	while (offset < buf_len) {
70 		size = min(buf_len - offset, length);
71 
72 		iov.iov_len = size;
73 		iov.iov_base = buf;
74 
75 		rx_got = rx_data(conn, &iov, 1, size);
76 		if (rx_got != size) {
77 			ret = DATAOUT_CANNOT_RECOVER;
78 			goto out;
79 		}
80 
81 		offset += size;
82 	}
83 
84 	if (!dump_padding_digest)
85 		goto out;
86 
87 	padding = ((-buf_len) & 3);
88 	if (padding != 0) {
89 		iov.iov_len = padding;
90 		iov.iov_base = pad_bytes;
91 
92 		rx_got = rx_data(conn, &iov, 1, padding);
93 		if (rx_got != padding) {
94 			ret = DATAOUT_CANNOT_RECOVER;
95 			goto out;
96 		}
97 	}
98 
99 	if (conn->conn_ops->DataDigest) {
100 		u32 data_crc;
101 
102 		iov.iov_len = ISCSI_CRC_LEN;
103 		iov.iov_base = &data_crc;
104 
105 		rx_got = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
106 		if (rx_got != ISCSI_CRC_LEN) {
107 			ret = DATAOUT_CANNOT_RECOVER;
108 			goto out;
109 		}
110 	}
111 
112 out:
113 	kfree(buf);
114 	return ret;
115 }
116 
117 /*
118  *	Used for retransmitting R2Ts from a R2T SNACK request.
119  */
120 static int iscsit_send_recovery_r2t_for_snack(
121 	struct iscsi_cmd *cmd,
122 	struct iscsi_r2t *r2t)
123 {
124 	/*
125 	 * If the struct iscsi_r2t has not been sent yet, we can safely
126 	 * ignore retransmission
127 	 * of the R2TSN in question.
128 	 */
129 	spin_lock_bh(&cmd->r2t_lock);
130 	if (!r2t->sent_r2t) {
131 		spin_unlock_bh(&cmd->r2t_lock);
132 		return 0;
133 	}
134 	r2t->sent_r2t = 0;
135 	spin_unlock_bh(&cmd->r2t_lock);
136 
137 	iscsit_add_cmd_to_immediate_queue(cmd, cmd->conn, ISTATE_SEND_R2T);
138 
139 	return 0;
140 }
141 
142 static int iscsit_handle_r2t_snack(
143 	struct iscsi_cmd *cmd,
144 	unsigned char *buf,
145 	u32 begrun,
146 	u32 runlength)
147 {
148 	u32 last_r2tsn;
149 	struct iscsi_r2t *r2t;
150 
151 	/*
152 	 * Make sure the initiator is not requesting retransmission
153 	 * of R2TSNs already acknowledged by a TMR TASK_REASSIGN.
154 	 */
155 	if ((cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
156 	    (begrun <= cmd->acked_data_sn)) {
157 		pr_err("ITT: 0x%08x, R2T SNACK requesting"
158 			" retransmission of R2TSN: 0x%08x to 0x%08x but already"
159 			" acked to  R2TSN: 0x%08x by TMR TASK_REASSIGN,"
160 			" protocol error.\n", cmd->init_task_tag, begrun,
161 			(begrun + runlength), cmd->acked_data_sn);
162 
163 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
164 	}
165 
166 	if (runlength) {
167 		if ((begrun + runlength) > cmd->r2t_sn) {
168 			pr_err("Command ITT: 0x%08x received R2T SNACK"
169 			" with BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
170 			" current R2TSN: 0x%08x, protocol error.\n",
171 			cmd->init_task_tag, begrun, runlength, cmd->r2t_sn);
172 			return iscsit_reject_cmd(cmd,
173 					ISCSI_REASON_BOOKMARK_INVALID, buf);
174 		}
175 		last_r2tsn = (begrun + runlength);
176 	} else
177 		last_r2tsn = cmd->r2t_sn;
178 
179 	while (begrun < last_r2tsn) {
180 		r2t = iscsit_get_holder_for_r2tsn(cmd, begrun);
181 		if (!r2t)
182 			return -1;
183 		if (iscsit_send_recovery_r2t_for_snack(cmd, r2t) < 0)
184 			return -1;
185 
186 		begrun++;
187 	}
188 
189 	return 0;
190 }
191 
192 /*
193  *	Generates Offsets and NextBurstLength based on Begrun and Runlength
194  *	carried in a Data SNACK or ExpDataSN in TMR TASK_REASSIGN.
195  *
196  *	For DataSequenceInOrder=Yes and DataPDUInOrder=[Yes,No] only.
197  *
198  *	FIXME: How is this handled for a RData SNACK?
199  */
200 int iscsit_create_recovery_datain_values_datasequenceinorder_yes(
201 	struct iscsi_cmd *cmd,
202 	struct iscsi_datain_req *dr)
203 {
204 	u32 data_sn = 0, data_sn_count = 0;
205 	u32 pdu_start = 0, seq_no = 0;
206 	u32 begrun = dr->begrun;
207 	struct iscsi_conn *conn = cmd->conn;
208 
209 	while (begrun > data_sn++) {
210 		data_sn_count++;
211 		if ((dr->next_burst_len +
212 		     conn->conn_ops->MaxRecvDataSegmentLength) <
213 		     conn->sess->sess_ops->MaxBurstLength) {
214 			dr->read_data_done +=
215 				conn->conn_ops->MaxRecvDataSegmentLength;
216 			dr->next_burst_len +=
217 				conn->conn_ops->MaxRecvDataSegmentLength;
218 		} else {
219 			dr->read_data_done +=
220 				(conn->sess->sess_ops->MaxBurstLength -
221 				 dr->next_burst_len);
222 			dr->next_burst_len = 0;
223 			pdu_start += data_sn_count;
224 			data_sn_count = 0;
225 			seq_no++;
226 		}
227 	}
228 
229 	if (!conn->sess->sess_ops->DataPDUInOrder) {
230 		cmd->seq_no = seq_no;
231 		cmd->pdu_start = pdu_start;
232 		cmd->pdu_send_order = data_sn_count;
233 	}
234 
235 	return 0;
236 }
237 
238 /*
239  *	Generates Offsets and NextBurstLength based on Begrun and Runlength
240  *	carried in a Data SNACK or ExpDataSN in TMR TASK_REASSIGN.
241  *
242  *	For DataSequenceInOrder=No and DataPDUInOrder=[Yes,No] only.
243  *
244  *	FIXME: How is this handled for a RData SNACK?
245  */
246 int iscsit_create_recovery_datain_values_datasequenceinorder_no(
247 	struct iscsi_cmd *cmd,
248 	struct iscsi_datain_req *dr)
249 {
250 	int found_seq = 0, i;
251 	u32 data_sn, read_data_done = 0, seq_send_order = 0;
252 	u32 begrun = dr->begrun;
253 	u32 runlength = dr->runlength;
254 	struct iscsi_conn *conn = cmd->conn;
255 	struct iscsi_seq *first_seq = NULL, *seq = NULL;
256 
257 	if (!cmd->seq_list) {
258 		pr_err("struct iscsi_cmd->seq_list is NULL!\n");
259 		return -1;
260 	}
261 
262 	/*
263 	 * Calculate read_data_done for all sequences containing a
264 	 * first_datasn and last_datasn less than the BegRun.
265 	 *
266 	 * Locate the struct iscsi_seq the BegRun lies within and calculate
267 	 * NextBurstLenghth up to the DataSN based on MaxRecvDataSegmentLength.
268 	 *
269 	 * Also use struct iscsi_seq->seq_send_order to determine where to start.
270 	 */
271 	for (i = 0; i < cmd->seq_count; i++) {
272 		seq = &cmd->seq_list[i];
273 
274 		if (!seq->seq_send_order)
275 			first_seq = seq;
276 
277 		/*
278 		 * No data has been transferred for this DataIN sequence, so the
279 		 * seq->first_datasn and seq->last_datasn have not been set.
280 		 */
281 		if (!seq->sent) {
282 			pr_err("Ignoring non-sent sequence 0x%08x ->"
283 				" 0x%08x\n\n", seq->first_datasn,
284 				seq->last_datasn);
285 			continue;
286 		}
287 
288 		/*
289 		 * This DataIN sequence is precedes the received BegRun, add the
290 		 * total xfer_len of the sequence to read_data_done and reset
291 		 * seq->pdu_send_order.
292 		 */
293 		if ((seq->first_datasn < begrun) &&
294 				(seq->last_datasn < begrun)) {
295 			pr_err("Pre BegRun sequence 0x%08x ->"
296 				" 0x%08x\n", seq->first_datasn,
297 				seq->last_datasn);
298 
299 			read_data_done += cmd->seq_list[i].xfer_len;
300 			seq->next_burst_len = seq->pdu_send_order = 0;
301 			continue;
302 		}
303 
304 		/*
305 		 * The BegRun lies within this DataIN sequence.
306 		 */
307 		if ((seq->first_datasn <= begrun) &&
308 				(seq->last_datasn >= begrun)) {
309 			pr_err("Found sequence begrun: 0x%08x in"
310 				" 0x%08x -> 0x%08x\n", begrun,
311 				seq->first_datasn, seq->last_datasn);
312 
313 			seq_send_order = seq->seq_send_order;
314 			data_sn = seq->first_datasn;
315 			seq->next_burst_len = seq->pdu_send_order = 0;
316 			found_seq = 1;
317 
318 			/*
319 			 * For DataPDUInOrder=Yes, while the first DataSN of
320 			 * the sequence is less than the received BegRun, add
321 			 * the MaxRecvDataSegmentLength to read_data_done and
322 			 * to the sequence's next_burst_len;
323 			 *
324 			 * For DataPDUInOrder=No, while the first DataSN of the
325 			 * sequence is less than the received BegRun, find the
326 			 * struct iscsi_pdu of the DataSN in question and add the
327 			 * MaxRecvDataSegmentLength to read_data_done and to the
328 			 * sequence's next_burst_len;
329 			 */
330 			if (conn->sess->sess_ops->DataPDUInOrder) {
331 				while (data_sn < begrun) {
332 					seq->pdu_send_order++;
333 					read_data_done +=
334 						conn->conn_ops->MaxRecvDataSegmentLength;
335 					seq->next_burst_len +=
336 						conn->conn_ops->MaxRecvDataSegmentLength;
337 					data_sn++;
338 				}
339 			} else {
340 				int j;
341 				struct iscsi_pdu *pdu;
342 
343 				while (data_sn < begrun) {
344 					seq->pdu_send_order++;
345 
346 					for (j = 0; j < seq->pdu_count; j++) {
347 						pdu = &cmd->pdu_list[
348 							seq->pdu_start + j];
349 						if (pdu->data_sn == data_sn) {
350 							read_data_done +=
351 								pdu->length;
352 							seq->next_burst_len +=
353 								pdu->length;
354 						}
355 					}
356 					data_sn++;
357 				}
358 			}
359 			continue;
360 		}
361 
362 		/*
363 		 * This DataIN sequence is larger than the received BegRun,
364 		 * reset seq->pdu_send_order and continue.
365 		 */
366 		if ((seq->first_datasn > begrun) ||
367 				(seq->last_datasn > begrun)) {
368 			pr_err("Post BegRun sequence 0x%08x -> 0x%08x\n",
369 					seq->first_datasn, seq->last_datasn);
370 
371 			seq->next_burst_len = seq->pdu_send_order = 0;
372 			continue;
373 		}
374 	}
375 
376 	if (!found_seq) {
377 		if (!begrun) {
378 			if (!first_seq) {
379 				pr_err("ITT: 0x%08x, Begrun: 0x%08x"
380 					" but first_seq is NULL\n",
381 					cmd->init_task_tag, begrun);
382 				return -1;
383 			}
384 			seq_send_order = first_seq->seq_send_order;
385 			seq->next_burst_len = seq->pdu_send_order = 0;
386 			goto done;
387 		}
388 
389 		pr_err("Unable to locate struct iscsi_seq for ITT: 0x%08x,"
390 			" BegRun: 0x%08x, RunLength: 0x%08x while"
391 			" DataSequenceInOrder=No and DataPDUInOrder=%s.\n",
392 				cmd->init_task_tag, begrun, runlength,
393 			(conn->sess->sess_ops->DataPDUInOrder) ? "Yes" : "No");
394 		return -1;
395 	}
396 
397 done:
398 	dr->read_data_done = read_data_done;
399 	dr->seq_send_order = seq_send_order;
400 
401 	return 0;
402 }
403 
404 static int iscsit_handle_recovery_datain(
405 	struct iscsi_cmd *cmd,
406 	unsigned char *buf,
407 	u32 begrun,
408 	u32 runlength)
409 {
410 	struct iscsi_conn *conn = cmd->conn;
411 	struct iscsi_datain_req *dr;
412 	struct se_cmd *se_cmd = &cmd->se_cmd;
413 
414 	if (!(se_cmd->transport_state & CMD_T_COMPLETE)) {
415 		pr_err("Ignoring ITT: 0x%08x Data SNACK\n",
416 				cmd->init_task_tag);
417 		return 0;
418 	}
419 
420 	/*
421 	 * Make sure the initiator is not requesting retransmission
422 	 * of DataSNs already acknowledged by a Data ACK SNACK.
423 	 */
424 	if ((cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
425 	    (begrun <= cmd->acked_data_sn)) {
426 		pr_err("ITT: 0x%08x, Data SNACK requesting"
427 			" retransmission of DataSN: 0x%08x to 0x%08x but"
428 			" already acked to DataSN: 0x%08x by Data ACK SNACK,"
429 			" protocol error.\n", cmd->init_task_tag, begrun,
430 			(begrun + runlength), cmd->acked_data_sn);
431 
432 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
433 	}
434 
435 	/*
436 	 * Make sure BegRun and RunLength in the Data SNACK are sane.
437 	 * Note: (cmd->data_sn - 1) will carry the maximum DataSN sent.
438 	 */
439 	if ((begrun + runlength) > (cmd->data_sn - 1)) {
440 		pr_err("Initiator requesting BegRun: 0x%08x, RunLength"
441 			": 0x%08x greater than maximum DataSN: 0x%08x.\n",
442 				begrun, runlength, (cmd->data_sn - 1));
443 		return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_INVALID,
444 					 buf);
445 	}
446 
447 	dr = iscsit_allocate_datain_req();
448 	if (!dr)
449 		return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_NO_RESOURCES,
450 					 buf);
451 
452 	dr->data_sn = dr->begrun = begrun;
453 	dr->runlength = runlength;
454 	dr->generate_recovery_values = 1;
455 	dr->recovery = DATAIN_WITHIN_COMMAND_RECOVERY;
456 
457 	iscsit_attach_datain_req(cmd, dr);
458 
459 	cmd->i_state = ISTATE_SEND_DATAIN;
460 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
461 
462 	return 0;
463 }
464 
465 int iscsit_handle_recovery_datain_or_r2t(
466 	struct iscsi_conn *conn,
467 	unsigned char *buf,
468 	itt_t init_task_tag,
469 	u32 targ_xfer_tag,
470 	u32 begrun,
471 	u32 runlength)
472 {
473 	struct iscsi_cmd *cmd;
474 
475 	cmd = iscsit_find_cmd_from_itt(conn, init_task_tag);
476 	if (!cmd)
477 		return 0;
478 
479 	/*
480 	 * FIXME: This will not work for bidi commands.
481 	 */
482 	switch (cmd->data_direction) {
483 	case DMA_TO_DEVICE:
484 		return iscsit_handle_r2t_snack(cmd, buf, begrun, runlength);
485 	case DMA_FROM_DEVICE:
486 		return iscsit_handle_recovery_datain(cmd, buf, begrun,
487 				runlength);
488 	default:
489 		pr_err("Unknown cmd->data_direction: 0x%02x\n",
490 				cmd->data_direction);
491 		return -1;
492 	}
493 
494 	return 0;
495 }
496 
497 /* #warning FIXME: Status SNACK needs to be dependent on OPCODE!!! */
498 int iscsit_handle_status_snack(
499 	struct iscsi_conn *conn,
500 	itt_t init_task_tag,
501 	u32 targ_xfer_tag,
502 	u32 begrun,
503 	u32 runlength)
504 {
505 	struct iscsi_cmd *cmd = NULL;
506 	u32 last_statsn;
507 	int found_cmd;
508 
509 	if (!begrun) {
510 		begrun = conn->exp_statsn;
511 	} else if (conn->exp_statsn > begrun) {
512 		pr_err("Got Status SNACK Begrun: 0x%08x, RunLength:"
513 			" 0x%08x but already got ExpStatSN: 0x%08x on CID:"
514 			" %hu.\n", begrun, runlength, conn->exp_statsn,
515 			conn->cid);
516 		return 0;
517 	}
518 
519 	last_statsn = (!runlength) ? conn->stat_sn : (begrun + runlength);
520 
521 	while (begrun < last_statsn) {
522 		found_cmd = 0;
523 
524 		spin_lock_bh(&conn->cmd_lock);
525 		list_for_each_entry(cmd, &conn->conn_cmd_list, i_conn_node) {
526 			if (cmd->stat_sn == begrun) {
527 				found_cmd = 1;
528 				break;
529 			}
530 		}
531 		spin_unlock_bh(&conn->cmd_lock);
532 
533 		if (!found_cmd) {
534 			pr_err("Unable to find StatSN: 0x%08x for"
535 				" a Status SNACK, assuming this was a"
536 				" protactic SNACK for an untransmitted"
537 				" StatSN, ignoring.\n", begrun);
538 			begrun++;
539 			continue;
540 		}
541 
542 		spin_lock_bh(&cmd->istate_lock);
543 		if (cmd->i_state == ISTATE_SEND_DATAIN) {
544 			spin_unlock_bh(&cmd->istate_lock);
545 			pr_err("Ignoring Status SNACK for BegRun:"
546 				" 0x%08x, RunLength: 0x%08x, assuming this was"
547 				" a protactic SNACK for an untransmitted"
548 				" StatSN\n", begrun, runlength);
549 			begrun++;
550 			continue;
551 		}
552 		spin_unlock_bh(&cmd->istate_lock);
553 
554 		cmd->i_state = ISTATE_SEND_STATUS_RECOVERY;
555 		iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
556 		begrun++;
557 	}
558 
559 	return 0;
560 }
561 
562 int iscsit_handle_data_ack(
563 	struct iscsi_conn *conn,
564 	u32 targ_xfer_tag,
565 	u32 begrun,
566 	u32 runlength)
567 {
568 	struct iscsi_cmd *cmd = NULL;
569 
570 	cmd = iscsit_find_cmd_from_ttt(conn, targ_xfer_tag);
571 	if (!cmd) {
572 		pr_err("Data ACK SNACK for TTT: 0x%08x is"
573 			" invalid.\n", targ_xfer_tag);
574 		return -1;
575 	}
576 
577 	if (begrun <= cmd->acked_data_sn) {
578 		pr_err("ITT: 0x%08x Data ACK SNACK BegRUN: 0x%08x is"
579 			" less than the already acked DataSN: 0x%08x.\n",
580 			cmd->init_task_tag, begrun, cmd->acked_data_sn);
581 		return -1;
582 	}
583 
584 	/*
585 	 * For Data ACK SNACK, BegRun is the next expected DataSN.
586 	 * (see iSCSI v19: 10.16.6)
587 	 */
588 	cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
589 	cmd->acked_data_sn = (begrun - 1);
590 
591 	pr_debug("Received Data ACK SNACK for ITT: 0x%08x,"
592 		" updated acked DataSN to 0x%08x.\n",
593 			cmd->init_task_tag, cmd->acked_data_sn);
594 
595 	return 0;
596 }
597 
598 static int iscsit_send_recovery_r2t(
599 	struct iscsi_cmd *cmd,
600 	u32 offset,
601 	u32 xfer_len)
602 {
603 	int ret;
604 
605 	spin_lock_bh(&cmd->r2t_lock);
606 	ret = iscsit_add_r2t_to_list(cmd, offset, xfer_len, 1, 0);
607 	spin_unlock_bh(&cmd->r2t_lock);
608 
609 	return ret;
610 }
611 
612 int iscsit_dataout_datapduinorder_no_fbit(
613 	struct iscsi_cmd *cmd,
614 	struct iscsi_pdu *pdu)
615 {
616 	int i, send_recovery_r2t = 0, recovery = 0;
617 	u32 length = 0, offset = 0, pdu_count = 0, xfer_len = 0;
618 	struct iscsi_conn *conn = cmd->conn;
619 	struct iscsi_pdu *first_pdu = NULL;
620 
621 	/*
622 	 * Get an struct iscsi_pdu pointer to the first PDU, and total PDU count
623 	 * of the DataOUT sequence.
624 	 */
625 	if (conn->sess->sess_ops->DataSequenceInOrder) {
626 		for (i = 0; i < cmd->pdu_count; i++) {
627 			if (cmd->pdu_list[i].seq_no == pdu->seq_no) {
628 				if (!first_pdu)
629 					first_pdu = &cmd->pdu_list[i];
630 				xfer_len += cmd->pdu_list[i].length;
631 				pdu_count++;
632 			} else if (pdu_count)
633 				break;
634 		}
635 	} else {
636 		struct iscsi_seq *seq = cmd->seq_ptr;
637 
638 		first_pdu = &cmd->pdu_list[seq->pdu_start];
639 		pdu_count = seq->pdu_count;
640 	}
641 
642 	if (!first_pdu || !pdu_count)
643 		return DATAOUT_CANNOT_RECOVER;
644 
645 	/*
646 	 * Loop through the ending DataOUT Sequence checking each struct iscsi_pdu.
647 	 * The following ugly logic does batching of not received PDUs.
648 	 */
649 	for (i = 0; i < pdu_count; i++) {
650 		if (first_pdu[i].status == ISCSI_PDU_RECEIVED_OK) {
651 			if (!send_recovery_r2t)
652 				continue;
653 
654 			if (iscsit_send_recovery_r2t(cmd, offset, length) < 0)
655 				return DATAOUT_CANNOT_RECOVER;
656 
657 			send_recovery_r2t = length = offset = 0;
658 			continue;
659 		}
660 		/*
661 		 * Set recovery = 1 for any missing, CRC failed, or timed
662 		 * out PDUs to let the DataOUT logic know that this sequence
663 		 * has not been completed yet.
664 		 *
665 		 * Also, only send a Recovery R2T for ISCSI_PDU_NOT_RECEIVED.
666 		 * We assume if the PDU either failed CRC or timed out
667 		 * that a Recovery R2T has already been sent.
668 		 */
669 		recovery = 1;
670 
671 		if (first_pdu[i].status != ISCSI_PDU_NOT_RECEIVED)
672 			continue;
673 
674 		if (!offset)
675 			offset = first_pdu[i].offset;
676 		length += first_pdu[i].length;
677 
678 		send_recovery_r2t = 1;
679 	}
680 
681 	if (send_recovery_r2t)
682 		if (iscsit_send_recovery_r2t(cmd, offset, length) < 0)
683 			return DATAOUT_CANNOT_RECOVER;
684 
685 	return (!recovery) ? DATAOUT_NORMAL : DATAOUT_WITHIN_COMMAND_RECOVERY;
686 }
687 
688 static int iscsit_recalculate_dataout_values(
689 	struct iscsi_cmd *cmd,
690 	u32 pdu_offset,
691 	u32 pdu_length,
692 	u32 *r2t_offset,
693 	u32 *r2t_length)
694 {
695 	int i;
696 	struct iscsi_conn *conn = cmd->conn;
697 	struct iscsi_pdu *pdu = NULL;
698 
699 	if (conn->sess->sess_ops->DataSequenceInOrder) {
700 		cmd->data_sn = 0;
701 
702 		if (conn->sess->sess_ops->DataPDUInOrder) {
703 			*r2t_offset = cmd->write_data_done;
704 			*r2t_length = (cmd->seq_end_offset -
705 					cmd->write_data_done);
706 			return 0;
707 		}
708 
709 		*r2t_offset = cmd->seq_start_offset;
710 		*r2t_length = (cmd->seq_end_offset - cmd->seq_start_offset);
711 
712 		for (i = 0; i < cmd->pdu_count; i++) {
713 			pdu = &cmd->pdu_list[i];
714 
715 			if (pdu->status != ISCSI_PDU_RECEIVED_OK)
716 				continue;
717 
718 			if ((pdu->offset >= cmd->seq_start_offset) &&
719 			   ((pdu->offset + pdu->length) <=
720 			     cmd->seq_end_offset)) {
721 				if (!cmd->unsolicited_data)
722 					cmd->next_burst_len -= pdu->length;
723 				else
724 					cmd->first_burst_len -= pdu->length;
725 
726 				cmd->write_data_done -= pdu->length;
727 				pdu->status = ISCSI_PDU_NOT_RECEIVED;
728 			}
729 		}
730 	} else {
731 		struct iscsi_seq *seq = NULL;
732 
733 		seq = iscsit_get_seq_holder(cmd, pdu_offset, pdu_length);
734 		if (!seq)
735 			return -1;
736 
737 		*r2t_offset = seq->orig_offset;
738 		*r2t_length = seq->xfer_len;
739 
740 		cmd->write_data_done -= (seq->offset - seq->orig_offset);
741 		if (cmd->immediate_data)
742 			cmd->first_burst_len = cmd->write_data_done;
743 
744 		seq->data_sn = 0;
745 		seq->offset = seq->orig_offset;
746 		seq->next_burst_len = 0;
747 		seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
748 
749 		if (conn->sess->sess_ops->DataPDUInOrder)
750 			return 0;
751 
752 		for (i = 0; i < seq->pdu_count; i++) {
753 			pdu = &cmd->pdu_list[i+seq->pdu_start];
754 
755 			if (pdu->status != ISCSI_PDU_RECEIVED_OK)
756 				continue;
757 
758 			pdu->status = ISCSI_PDU_NOT_RECEIVED;
759 		}
760 	}
761 
762 	return 0;
763 }
764 
765 int iscsit_recover_dataout_sequence(
766 	struct iscsi_cmd *cmd,
767 	u32 pdu_offset,
768 	u32 pdu_length)
769 {
770 	u32 r2t_length = 0, r2t_offset = 0;
771 
772 	spin_lock_bh(&cmd->istate_lock);
773 	cmd->cmd_flags |= ICF_WITHIN_COMMAND_RECOVERY;
774 	spin_unlock_bh(&cmd->istate_lock);
775 
776 	if (iscsit_recalculate_dataout_values(cmd, pdu_offset, pdu_length,
777 			&r2t_offset, &r2t_length) < 0)
778 		return DATAOUT_CANNOT_RECOVER;
779 
780 	iscsit_send_recovery_r2t(cmd, r2t_offset, r2t_length);
781 
782 	return DATAOUT_WITHIN_COMMAND_RECOVERY;
783 }
784 
785 static struct iscsi_ooo_cmdsn *iscsit_allocate_ooo_cmdsn(void)
786 {
787 	struct iscsi_ooo_cmdsn *ooo_cmdsn = NULL;
788 
789 	ooo_cmdsn = kmem_cache_zalloc(lio_ooo_cache, GFP_ATOMIC);
790 	if (!ooo_cmdsn) {
791 		pr_err("Unable to allocate memory for"
792 			" struct iscsi_ooo_cmdsn.\n");
793 		return NULL;
794 	}
795 	INIT_LIST_HEAD(&ooo_cmdsn->ooo_list);
796 
797 	return ooo_cmdsn;
798 }
799 
800 /*
801  *	Called with sess->cmdsn_mutex held.
802  */
803 static int iscsit_attach_ooo_cmdsn(
804 	struct iscsi_session *sess,
805 	struct iscsi_ooo_cmdsn *ooo_cmdsn)
806 {
807 	struct iscsi_ooo_cmdsn *ooo_tail, *ooo_tmp;
808 	/*
809 	 * We attach the struct iscsi_ooo_cmdsn entry to the out of order
810 	 * list in increasing CmdSN order.
811 	 * This allows iscsi_execute_ooo_cmdsns() to detect any
812 	 * additional CmdSN holes while performing delayed execution.
813 	 */
814 	if (list_empty(&sess->sess_ooo_cmdsn_list))
815 		list_add_tail(&ooo_cmdsn->ooo_list,
816 				&sess->sess_ooo_cmdsn_list);
817 	else {
818 		ooo_tail = list_entry(sess->sess_ooo_cmdsn_list.prev,
819 				typeof(*ooo_tail), ooo_list);
820 		/*
821 		 * CmdSN is greater than the tail of the list.
822 		 */
823 		if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn))
824 			list_add_tail(&ooo_cmdsn->ooo_list,
825 					&sess->sess_ooo_cmdsn_list);
826 		else {
827 			/*
828 			 * CmdSN is either lower than the head,  or somewhere
829 			 * in the middle.
830 			 */
831 			list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
832 						ooo_list) {
833 				if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn))
834 					continue;
835 
836 				/* Insert before this entry */
837 				list_add(&ooo_cmdsn->ooo_list,
838 					ooo_tmp->ooo_list.prev);
839 				break;
840 			}
841 		}
842 	}
843 
844 	return 0;
845 }
846 
847 /*
848  *	Removes an struct iscsi_ooo_cmdsn from a session's list,
849  *	called with struct iscsi_session->cmdsn_mutex held.
850  */
851 void iscsit_remove_ooo_cmdsn(
852 	struct iscsi_session *sess,
853 	struct iscsi_ooo_cmdsn *ooo_cmdsn)
854 {
855 	list_del(&ooo_cmdsn->ooo_list);
856 	kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
857 }
858 
859 void iscsit_clear_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
860 {
861 	struct iscsi_ooo_cmdsn *ooo_cmdsn;
862 	struct iscsi_session *sess = conn->sess;
863 
864 	mutex_lock(&sess->cmdsn_mutex);
865 	list_for_each_entry(ooo_cmdsn, &sess->sess_ooo_cmdsn_list, ooo_list) {
866 		if (ooo_cmdsn->cid != conn->cid)
867 			continue;
868 
869 		ooo_cmdsn->cmd = NULL;
870 	}
871 	mutex_unlock(&sess->cmdsn_mutex);
872 }
873 
874 /*
875  *	Called with sess->cmdsn_mutex held.
876  */
877 int iscsit_execute_ooo_cmdsns(struct iscsi_session *sess)
878 {
879 	int ooo_count = 0;
880 	struct iscsi_cmd *cmd = NULL;
881 	struct iscsi_ooo_cmdsn *ooo_cmdsn, *ooo_cmdsn_tmp;
882 
883 	list_for_each_entry_safe(ooo_cmdsn, ooo_cmdsn_tmp,
884 				&sess->sess_ooo_cmdsn_list, ooo_list) {
885 		if (ooo_cmdsn->cmdsn != sess->exp_cmd_sn)
886 			continue;
887 
888 		if (!ooo_cmdsn->cmd) {
889 			sess->exp_cmd_sn++;
890 			iscsit_remove_ooo_cmdsn(sess, ooo_cmdsn);
891 			continue;
892 		}
893 
894 		cmd = ooo_cmdsn->cmd;
895 		cmd->i_state = cmd->deferred_i_state;
896 		ooo_count++;
897 		sess->exp_cmd_sn++;
898 		pr_debug("Executing out of order CmdSN: 0x%08x,"
899 			" incremented ExpCmdSN to 0x%08x.\n",
900 			cmd->cmd_sn, sess->exp_cmd_sn);
901 
902 		iscsit_remove_ooo_cmdsn(sess, ooo_cmdsn);
903 
904 		if (iscsit_execute_cmd(cmd, 1) < 0)
905 			return -1;
906 
907 		continue;
908 	}
909 
910 	return ooo_count;
911 }
912 
913 /*
914  *	Called either:
915  *
916  *	1. With sess->cmdsn_mutex held from iscsi_execute_ooo_cmdsns()
917  *	or iscsi_check_received_cmdsn().
918  *	2. With no locks held directly from iscsi_handle_XXX_pdu() functions
919  *	for immediate commands.
920  */
921 int iscsit_execute_cmd(struct iscsi_cmd *cmd, int ooo)
922 {
923 	struct se_cmd *se_cmd = &cmd->se_cmd;
924 	struct iscsi_conn *conn = cmd->conn;
925 	int lr = 0;
926 
927 	spin_lock_bh(&cmd->istate_lock);
928 	if (ooo)
929 		cmd->cmd_flags &= ~ICF_OOO_CMDSN;
930 
931 	switch (cmd->iscsi_opcode) {
932 	case ISCSI_OP_SCSI_CMD:
933 		/*
934 		 * Go ahead and send the CHECK_CONDITION status for
935 		 * any SCSI CDB exceptions that may have occurred.
936 		 */
937 		if (cmd->sense_reason) {
938 			if (cmd->sense_reason == TCM_RESERVATION_CONFLICT) {
939 				cmd->i_state = ISTATE_SEND_STATUS;
940 				spin_unlock_bh(&cmd->istate_lock);
941 				iscsit_add_cmd_to_response_queue(cmd, cmd->conn,
942 						cmd->i_state);
943 				return 0;
944 			}
945 			spin_unlock_bh(&cmd->istate_lock);
946 			if (cmd->se_cmd.transport_state & CMD_T_ABORTED)
947 				return 0;
948 			return transport_send_check_condition_and_sense(se_cmd,
949 					cmd->sense_reason, 0);
950 		}
951 		/*
952 		 * Special case for delayed CmdSN with Immediate
953 		 * Data and/or Unsolicited Data Out attached.
954 		 */
955 		if (cmd->immediate_data) {
956 			if (cmd->cmd_flags & ICF_GOT_LAST_DATAOUT) {
957 				spin_unlock_bh(&cmd->istate_lock);
958 				target_execute_cmd(&cmd->se_cmd);
959 				return 0;
960 			}
961 			spin_unlock_bh(&cmd->istate_lock);
962 
963 			if (!(cmd->cmd_flags &
964 					ICF_NON_IMMEDIATE_UNSOLICITED_DATA)) {
965 				if (cmd->se_cmd.transport_state & CMD_T_ABORTED)
966 					return 0;
967 
968 				iscsit_set_dataout_sequence_values(cmd);
969 				conn->conn_transport->iscsit_get_dataout(conn, cmd, false);
970 			}
971 			return 0;
972 		}
973 		/*
974 		 * The default handler.
975 		 */
976 		spin_unlock_bh(&cmd->istate_lock);
977 
978 		if ((cmd->data_direction == DMA_TO_DEVICE) &&
979 		    !(cmd->cmd_flags & ICF_NON_IMMEDIATE_UNSOLICITED_DATA)) {
980 			if (cmd->se_cmd.transport_state & CMD_T_ABORTED)
981 				return 0;
982 
983 			iscsit_set_unsoliticed_dataout(cmd);
984 		}
985 		return transport_handle_cdb_direct(&cmd->se_cmd);
986 
987 	case ISCSI_OP_NOOP_OUT:
988 	case ISCSI_OP_TEXT:
989 		spin_unlock_bh(&cmd->istate_lock);
990 		iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
991 		break;
992 	case ISCSI_OP_SCSI_TMFUNC:
993 		if (cmd->se_cmd.se_tmr_req->response) {
994 			spin_unlock_bh(&cmd->istate_lock);
995 			iscsit_add_cmd_to_response_queue(cmd, cmd->conn,
996 					cmd->i_state);
997 			return 0;
998 		}
999 		spin_unlock_bh(&cmd->istate_lock);
1000 
1001 		return transport_generic_handle_tmr(&cmd->se_cmd);
1002 	case ISCSI_OP_LOGOUT:
1003 		spin_unlock_bh(&cmd->istate_lock);
1004 		switch (cmd->logout_reason) {
1005 		case ISCSI_LOGOUT_REASON_CLOSE_SESSION:
1006 			lr = iscsit_logout_closesession(cmd, cmd->conn);
1007 			break;
1008 		case ISCSI_LOGOUT_REASON_CLOSE_CONNECTION:
1009 			lr = iscsit_logout_closeconnection(cmd, cmd->conn);
1010 			break;
1011 		case ISCSI_LOGOUT_REASON_RECOVERY:
1012 			lr = iscsit_logout_removeconnforrecovery(cmd, cmd->conn);
1013 			break;
1014 		default:
1015 			pr_err("Unknown iSCSI Logout Request Code:"
1016 				" 0x%02x\n", cmd->logout_reason);
1017 			return -1;
1018 		}
1019 
1020 		return lr;
1021 	default:
1022 		spin_unlock_bh(&cmd->istate_lock);
1023 		pr_err("Cannot perform out of order execution for"
1024 		" unknown iSCSI Opcode: 0x%02x\n", cmd->iscsi_opcode);
1025 		return -1;
1026 	}
1027 
1028 	return 0;
1029 }
1030 
1031 void iscsit_free_all_ooo_cmdsns(struct iscsi_session *sess)
1032 {
1033 	struct iscsi_ooo_cmdsn *ooo_cmdsn, *ooo_cmdsn_tmp;
1034 
1035 	mutex_lock(&sess->cmdsn_mutex);
1036 	list_for_each_entry_safe(ooo_cmdsn, ooo_cmdsn_tmp,
1037 			&sess->sess_ooo_cmdsn_list, ooo_list) {
1038 
1039 		list_del(&ooo_cmdsn->ooo_list);
1040 		kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
1041 	}
1042 	mutex_unlock(&sess->cmdsn_mutex);
1043 }
1044 
1045 int iscsit_handle_ooo_cmdsn(
1046 	struct iscsi_session *sess,
1047 	struct iscsi_cmd *cmd,
1048 	u32 cmdsn)
1049 {
1050 	int batch = 0;
1051 	struct iscsi_ooo_cmdsn *ooo_cmdsn = NULL, *ooo_tail = NULL;
1052 
1053 	cmd->deferred_i_state		= cmd->i_state;
1054 	cmd->i_state			= ISTATE_DEFERRED_CMD;
1055 	cmd->cmd_flags			|= ICF_OOO_CMDSN;
1056 
1057 	if (list_empty(&sess->sess_ooo_cmdsn_list))
1058 		batch = 1;
1059 	else {
1060 		ooo_tail = list_entry(sess->sess_ooo_cmdsn_list.prev,
1061 				typeof(*ooo_tail), ooo_list);
1062 		if (ooo_tail->cmdsn != (cmdsn - 1))
1063 			batch = 1;
1064 	}
1065 
1066 	ooo_cmdsn = iscsit_allocate_ooo_cmdsn();
1067 	if (!ooo_cmdsn)
1068 		return -ENOMEM;
1069 
1070 	ooo_cmdsn->cmd			= cmd;
1071 	ooo_cmdsn->batch_count		= (batch) ?
1072 					  (cmdsn - sess->exp_cmd_sn) : 1;
1073 	ooo_cmdsn->cid			= cmd->conn->cid;
1074 	ooo_cmdsn->exp_cmdsn		= sess->exp_cmd_sn;
1075 	ooo_cmdsn->cmdsn		= cmdsn;
1076 
1077 	if (iscsit_attach_ooo_cmdsn(sess, ooo_cmdsn) < 0) {
1078 		kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
1079 		return -ENOMEM;
1080 	}
1081 
1082 	return 0;
1083 }
1084 
1085 static int iscsit_set_dataout_timeout_values(
1086 	struct iscsi_cmd *cmd,
1087 	u32 *offset,
1088 	u32 *length)
1089 {
1090 	struct iscsi_conn *conn = cmd->conn;
1091 	struct iscsi_r2t *r2t;
1092 
1093 	if (cmd->unsolicited_data) {
1094 		*offset = 0;
1095 		*length = (conn->sess->sess_ops->FirstBurstLength >
1096 			   cmd->se_cmd.data_length) ?
1097 			   cmd->se_cmd.data_length :
1098 			   conn->sess->sess_ops->FirstBurstLength;
1099 		return 0;
1100 	}
1101 
1102 	spin_lock_bh(&cmd->r2t_lock);
1103 	if (list_empty(&cmd->cmd_r2t_list)) {
1104 		pr_err("cmd->cmd_r2t_list is empty!\n");
1105 		spin_unlock_bh(&cmd->r2t_lock);
1106 		return -1;
1107 	}
1108 
1109 	list_for_each_entry(r2t, &cmd->cmd_r2t_list, r2t_list) {
1110 		if (r2t->sent_r2t && !r2t->recovery_r2t && !r2t->seq_complete) {
1111 			*offset = r2t->offset;
1112 			*length = r2t->xfer_len;
1113 			spin_unlock_bh(&cmd->r2t_lock);
1114 			return 0;
1115 		}
1116 	}
1117 	spin_unlock_bh(&cmd->r2t_lock);
1118 
1119 	pr_err("Unable to locate any incomplete DataOUT"
1120 		" sequences for ITT: 0x%08x.\n", cmd->init_task_tag);
1121 
1122 	return -1;
1123 }
1124 
1125 /*
1126  *	NOTE: Called from interrupt (timer) context.
1127  */
1128 void iscsit_handle_dataout_timeout(struct timer_list *t)
1129 {
1130 	u32 pdu_length = 0, pdu_offset = 0;
1131 	u32 r2t_length = 0, r2t_offset = 0;
1132 	struct iscsi_cmd *cmd = from_timer(cmd, t, dataout_timer);
1133 	struct iscsi_conn *conn = cmd->conn;
1134 	struct iscsi_session *sess = NULL;
1135 	struct iscsi_node_attrib *na;
1136 
1137 	iscsit_inc_conn_usage_count(conn);
1138 
1139 	spin_lock_bh(&cmd->dataout_timeout_lock);
1140 	if (cmd->dataout_timer_flags & ISCSI_TF_STOP) {
1141 		spin_unlock_bh(&cmd->dataout_timeout_lock);
1142 		iscsit_dec_conn_usage_count(conn);
1143 		return;
1144 	}
1145 	cmd->dataout_timer_flags &= ~ISCSI_TF_RUNNING;
1146 	sess = conn->sess;
1147 	na = iscsit_tpg_get_node_attrib(sess);
1148 
1149 	if (!sess->sess_ops->ErrorRecoveryLevel) {
1150 		pr_err("Unable to recover from DataOut timeout while"
1151 			" in ERL=0, closing iSCSI connection for I_T Nexus"
1152 			" %s,i,0x%6phN,%s,t,0x%02x\n",
1153 			sess->sess_ops->InitiatorName, sess->isid,
1154 			sess->tpg->tpg_tiqn->tiqn, (u32)sess->tpg->tpgt);
1155 		goto failure;
1156 	}
1157 
1158 	if (++cmd->dataout_timeout_retries == na->dataout_timeout_retries) {
1159 		pr_err("Command ITT: 0x%08x exceeded max retries"
1160 			" for DataOUT timeout %u, closing iSCSI connection for"
1161 			" I_T Nexus %s,i,0x%6phN,%s,t,0x%02x\n",
1162 			cmd->init_task_tag, na->dataout_timeout_retries,
1163 			sess->sess_ops->InitiatorName, sess->isid,
1164 			sess->tpg->tpg_tiqn->tiqn, (u32)sess->tpg->tpgt);
1165 		goto failure;
1166 	}
1167 
1168 	cmd->cmd_flags |= ICF_WITHIN_COMMAND_RECOVERY;
1169 
1170 	if (conn->sess->sess_ops->DataSequenceInOrder) {
1171 		if (conn->sess->sess_ops->DataPDUInOrder) {
1172 			pdu_offset = cmd->write_data_done;
1173 			if ((pdu_offset + (conn->sess->sess_ops->MaxBurstLength -
1174 			     cmd->next_burst_len)) > cmd->se_cmd.data_length)
1175 				pdu_length = (cmd->se_cmd.data_length -
1176 					cmd->write_data_done);
1177 			else
1178 				pdu_length = (conn->sess->sess_ops->MaxBurstLength -
1179 						cmd->next_burst_len);
1180 		} else {
1181 			pdu_offset = cmd->seq_start_offset;
1182 			pdu_length = (cmd->seq_end_offset -
1183 				cmd->seq_start_offset);
1184 		}
1185 	} else {
1186 		if (iscsit_set_dataout_timeout_values(cmd, &pdu_offset,
1187 				&pdu_length) < 0)
1188 			goto failure;
1189 	}
1190 
1191 	if (iscsit_recalculate_dataout_values(cmd, pdu_offset, pdu_length,
1192 			&r2t_offset, &r2t_length) < 0)
1193 		goto failure;
1194 
1195 	pr_debug("Command ITT: 0x%08x timed out waiting for"
1196 		" completion of %sDataOUT Sequence Offset: %u, Length: %u\n",
1197 		cmd->init_task_tag, (cmd->unsolicited_data) ? "Unsolicited " :
1198 		"", r2t_offset, r2t_length);
1199 
1200 	if (iscsit_send_recovery_r2t(cmd, r2t_offset, r2t_length) < 0)
1201 		goto failure;
1202 
1203 	iscsit_start_dataout_timer(cmd, conn);
1204 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1205 	iscsit_dec_conn_usage_count(conn);
1206 
1207 	return;
1208 
1209 failure:
1210 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1211 	iscsit_fill_cxn_timeout_err_stats(sess);
1212 	iscsit_cause_connection_reinstatement(conn, 0);
1213 	iscsit_dec_conn_usage_count(conn);
1214 }
1215 
1216 void iscsit_mod_dataout_timer(struct iscsi_cmd *cmd)
1217 {
1218 	struct iscsi_conn *conn = cmd->conn;
1219 	struct iscsi_session *sess = conn->sess;
1220 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
1221 
1222 	spin_lock_bh(&cmd->dataout_timeout_lock);
1223 	if (!(cmd->dataout_timer_flags & ISCSI_TF_RUNNING)) {
1224 		spin_unlock_bh(&cmd->dataout_timeout_lock);
1225 		return;
1226 	}
1227 
1228 	mod_timer(&cmd->dataout_timer,
1229 		(get_jiffies_64() + na->dataout_timeout * HZ));
1230 	pr_debug("Updated DataOUT timer for ITT: 0x%08x",
1231 			cmd->init_task_tag);
1232 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1233 }
1234 
1235 /*
1236  *	Called with cmd->dataout_timeout_lock held.
1237  */
1238 void iscsit_start_dataout_timer(
1239 	struct iscsi_cmd *cmd,
1240 	struct iscsi_conn *conn)
1241 {
1242 	struct iscsi_session *sess = conn->sess;
1243 	struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
1244 
1245 	if (cmd->dataout_timer_flags & ISCSI_TF_RUNNING)
1246 		return;
1247 
1248 	pr_debug("Starting DataOUT timer for ITT: 0x%08x on"
1249 		" CID: %hu.\n", cmd->init_task_tag, conn->cid);
1250 
1251 	cmd->dataout_timer_flags &= ~ISCSI_TF_STOP;
1252 	cmd->dataout_timer_flags |= ISCSI_TF_RUNNING;
1253 	mod_timer(&cmd->dataout_timer, jiffies + na->dataout_timeout * HZ);
1254 }
1255 
1256 void iscsit_stop_dataout_timer(struct iscsi_cmd *cmd)
1257 {
1258 	spin_lock_bh(&cmd->dataout_timeout_lock);
1259 	if (!(cmd->dataout_timer_flags & ISCSI_TF_RUNNING)) {
1260 		spin_unlock_bh(&cmd->dataout_timeout_lock);
1261 		return;
1262 	}
1263 	cmd->dataout_timer_flags |= ISCSI_TF_STOP;
1264 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1265 
1266 	del_timer_sync(&cmd->dataout_timer);
1267 
1268 	spin_lock_bh(&cmd->dataout_timeout_lock);
1269 	cmd->dataout_timer_flags &= ~ISCSI_TF_RUNNING;
1270 	pr_debug("Stopped DataOUT Timer for ITT: 0x%08x\n",
1271 			cmd->init_task_tag);
1272 	spin_unlock_bh(&cmd->dataout_timeout_lock);
1273 }
1274 EXPORT_SYMBOL(iscsit_stop_dataout_timer);
1275