drivers/target/iscsi/iscsi_target_erl1.c

   1 /*******************************************************************************
   2  * This file contains error recovery level one used by the iSCSI Target driver.
   3  *
   4  * \u00a9 Copyright 2007-2011 RisingTide Systems LLC.
   5  *
   6  * Licensed to the Linux Foundation under the General Public License (GPL) version 2.
   7  *
   8  * Author: Nicholas A. Bellinger <nab@linux-iscsi.org>
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 2 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  ******************************************************************************/
  20
  21 #include <linux/list.h>
  22 #include <scsi/iscsi_proto.h>
  23 #include <target/target_core_base.h>
  24 #include <target/target_core_fabric.h>
  25 #include <target/iscsi/iscsi_transport.h>
  26
  27 #include "iscsi_target_core.h"
  28 #include "iscsi_target_seq_pdu_list.h"
  29 #include "iscsi_target_datain_values.h"
  30 #include "iscsi_target_device.h"
  31 #include "iscsi_target_tpg.h"
  32 #include "iscsi_target_util.h"
  33 #include "iscsi_target_erl0.h"
  34 #include "iscsi_target_erl1.h"
  35 #include "iscsi_target_erl2.h"
  36 #include "iscsi_target.h"
  37
  38 #define OFFLOAD_BUF_SIZE        32768
  39
  40 /*
  41  *      Used to dump excess datain payload for certain error recovery
  42  *      situations.  Receive in OFFLOAD_BUF_SIZE max of datain per rx_data().
  43  *
  44  *      dump_padding_digest denotes if padding and data digests need
  45  *      to be dumped.
  46  */
  47 int iscsit_dump_data_payload(
  48         struct iscsi_conn *conn,
  49         u32 buf_len,
  50         int dump_padding_digest)
  51 {
  52         char *buf, pad_bytes[4];
  53         int ret = DATAOUT_WITHIN_COMMAND_RECOVERY, rx_got;
  54         u32 length, padding, offset = 0, size;
  55         struct kvec iov;
  56
  57         if (conn->sess->sess_ops->RDMAExtensions)
  58                 return 0;
  59
  60         length = (buf_len > OFFLOAD_BUF_SIZE) ? OFFLOAD_BUF_SIZE : buf_len;
  61
  62         buf = kzalloc(length, GFP_ATOMIC);
  63         if (!buf) {
  64                 pr_err("Unable to allocate %u bytes for offload"
  65                                 " buffer.\n", length);
  66                 return -1;
  67         }
  68         memset(&iov, 0, sizeof(struct kvec));
  69
  70         while (offset < buf_len) {
  71                 size = ((offset + length) > buf_len) ?
  72                         (buf_len - offset) : length;
  73
  74                 iov.iov_len = size;
  75                 iov.iov_base = buf;
  76
  77                 rx_got = rx_data(conn, &iov, 1, size);
  78                 if (rx_got != size) {
  79                         ret = DATAOUT_CANNOT_RECOVER;
  80                         goto out;
  81                 }
  82
  83                 offset += size;
  84         }
  85
  86         if (!dump_padding_digest)
  87                 goto out;
  88
  89         padding = ((-buf_len) & 3);
  90         if (padding != 0) {
  91                 iov.iov_len = padding;
  92                 iov.iov_base = pad_bytes;
  93
  94                 rx_got = rx_data(conn, &iov, 1, padding);
  95                 if (rx_got != padding) {
  96                         ret = DATAOUT_CANNOT_RECOVER;
  97                         goto out;
  98                 }
  99         }
 100
 101         if (conn->conn_ops->DataDigest) {
 102                 u32 data_crc;
 103
 104                 iov.iov_len = ISCSI_CRC_LEN;
 105                 iov.iov_base = &data_crc;
 106
 107                 rx_got = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
 108                 if (rx_got != ISCSI_CRC_LEN) {
 109                         ret = DATAOUT_CANNOT_RECOVER;
 110                         goto out;
 111                 }
 112         }
 113
 114 out:
 115         kfree(buf);
 116         return ret;
 117 }
 118
 119 /*
 120  *      Used for retransmitting R2Ts from a R2T SNACK request.
 121  */
 122 static int iscsit_send_recovery_r2t_for_snack(
 123         struct iscsi_cmd *cmd,
 124         struct iscsi_r2t *r2t)
 125 {
 126         /*
 127          * If the struct iscsi_r2t has not been sent yet, we can safely
 128          * ignore retransmission
 129          * of the R2TSN in question.
 130          */
 131         spin_lock_bh(&cmd->r2t_lock);
 132         if (!r2t->sent_r2t) {
 133                 spin_unlock_bh(&cmd->r2t_lock);
 134                 return 0;
 135         }
 136         r2t->sent_r2t = 0;
 137         spin_unlock_bh(&cmd->r2t_lock);
 138
 139         iscsit_add_cmd_to_immediate_queue(cmd, cmd->conn, ISTATE_SEND_R2T);
 140
 141         return 0;
 142 }
 143
 144 static int iscsit_handle_r2t_snack(
 145         struct iscsi_cmd *cmd,
 146         unsigned char *buf,
 147         u32 begrun,
 148         u32 runlength)
 149 {
 150         u32 last_r2tsn;
 151         struct iscsi_r2t *r2t;
 152
 153         /*
 154          * Make sure the initiator is not requesting retransmission
 155          * of R2TSNs already acknowledged by a TMR TASK_REASSIGN.
 156          */
 157         if ((cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
 158             (begrun <= cmd->acked_data_sn)) {
 159                 pr_err("ITT: 0x%08x, R2T SNACK requesting"
 160                         " retransmission of R2TSN: 0x%08x to 0x%08x but already"
 161                         " acked to  R2TSN: 0x%08x by TMR TASK_REASSIGN,"
 162                         " protocol error.\n", cmd->init_task_tag, begrun,
 163                         (begrun + runlength), cmd->acked_data_sn);
 164
 165                         return iscsit_reject_cmd(cmd,
 166                                         ISCSI_REASON_PROTOCOL_ERROR, buf);
 167         }
 168
 169         if (runlength) {
 170                 if ((begrun + runlength) > cmd->r2t_sn) {
 171                         pr_err("Command ITT: 0x%08x received R2T SNACK"
 172                         " with BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
 173                         " current R2TSN: 0x%08x, protocol error.\n",
 174                         cmd->init_task_tag, begrun, runlength, cmd->r2t_sn);
 175                         return iscsit_reject_cmd(cmd,
 176                                         ISCSI_REASON_BOOKMARK_INVALID, buf);
 177                 }
 178                 last_r2tsn = (begrun + runlength);
 179         } else
 180                 last_r2tsn = cmd->r2t_sn;
 181
 182         while (begrun < last_r2tsn) {
 183                 r2t = iscsit_get_holder_for_r2tsn(cmd, begrun);
 184                 if (!r2t)
 185                         return -1;
 186                 if (iscsit_send_recovery_r2t_for_snack(cmd, r2t) < 0)
 187                         return -1;
 188
 189                 begrun++;
 190         }
 191
 192         return 0;
 193 }
 194
 195 /*
 196  *      Generates Offsets and NextBurstLength based on Begrun and Runlength
 197  *      carried in a Data SNACK or ExpDataSN in TMR TASK_REASSIGN.
 198  *
 199  *      For DataSequenceInOrder=Yes and DataPDUInOrder=[Yes,No] only.
 200  *
 201  *      FIXME: How is this handled for a RData SNACK?
 202  */
 203 int iscsit_create_recovery_datain_values_datasequenceinorder_yes(
 204         struct iscsi_cmd *cmd,
 205         struct iscsi_datain_req *dr)
 206 {
 207         u32 data_sn = 0, data_sn_count = 0;
 208         u32 pdu_start = 0, seq_no = 0;
 209         u32 begrun = dr->begrun;
 210         struct iscsi_conn *conn = cmd->conn;
 211
 212         while (begrun > data_sn++) {
 213                 data_sn_count++;
 214                 if ((dr->next_burst_len +
 215                      conn->conn_ops->MaxRecvDataSegmentLength) <
 216                      conn->sess->sess_ops->MaxBurstLength) {
 217                         dr->read_data_done +=
 218                                 conn->conn_ops->MaxRecvDataSegmentLength;
 219                         dr->next_burst_len +=
 220                                 conn->conn_ops->MaxRecvDataSegmentLength;
 221                 } else {
 222                         dr->read_data_done +=
 223                                 (conn->sess->sess_ops->MaxBurstLength -
 224                                  dr->next_burst_len);
 225                         dr->next_burst_len = 0;
 226                         pdu_start += data_sn_count;
 227                         data_sn_count = 0;
 228                         seq_no++;
 229                 }
 230         }
 231
 232         if (!conn->sess->sess_ops->DataPDUInOrder) {
 233                 cmd->seq_no = seq_no;
 234                 cmd->pdu_start = pdu_start;
 235                 cmd->pdu_send_order = data_sn_count;
 236         }
 237
 238         return 0;
 239 }
 240
 241 /*
 242  *      Generates Offsets and NextBurstLength based on Begrun and Runlength
 243  *      carried in a Data SNACK or ExpDataSN in TMR TASK_REASSIGN.
 244  *
 245  *      For DataSequenceInOrder=No and DataPDUInOrder=[Yes,No] only.
 246  *
 247  *      FIXME: How is this handled for a RData SNACK?
 248  */
 249 int iscsit_create_recovery_datain_values_datasequenceinorder_no(
 250         struct iscsi_cmd *cmd,
 251         struct iscsi_datain_req *dr)
 252 {
 253         int found_seq = 0, i;
 254         u32 data_sn, read_data_done = 0, seq_send_order = 0;
 255         u32 begrun = dr->begrun;
 256         u32 runlength = dr->runlength;
 257         struct iscsi_conn *conn = cmd->conn;
 258         struct iscsi_seq *first_seq = NULL, *seq = NULL;
 259
 260         if (!cmd->seq_list) {
 261                 pr_err("struct iscsi_cmd->seq_list is NULL!\n");
 262                 return -1;
 263         }
 264
 265         /*
 266          * Calculate read_data_done for all sequences containing a
 267          * first_datasn and last_datasn less than the BegRun.
 268          *
 269          * Locate the struct iscsi_seq the BegRun lies within and calculate
 270          * NextBurstLenghth up to the DataSN based on MaxRecvDataSegmentLength.
 271          *
 272          * Also use struct iscsi_seq->seq_send_order to determine where to start.
 273          */
 274         for (i = 0; i < cmd->seq_count; i++) {
 275                 seq = &cmd->seq_list[i];
 276
 277                 if (!seq->seq_send_order)
 278                         first_seq = seq;
 279
 280                 /*
 281                  * No data has been transferred for this DataIN sequence, so the
 282                  * seq->first_datasn and seq->last_datasn have not been set.
 283                  */
 284                 if (!seq->sent) {
 285                         pr_err("Ignoring non-sent sequence 0x%08x ->"
 286                                 " 0x%08x\n\n", seq->first_datasn,
 287                                 seq->last_datasn);
 288                         continue;
 289                 }
 290
 291                 /*
 292                  * This DataIN sequence is precedes the received BegRun, add the
 293                  * total xfer_len of the sequence to read_data_done and reset
 294                  * seq->pdu_send_order.
 295                  */
 296                 if ((seq->first_datasn < begrun) &&
 297                                 (seq->last_datasn < begrun)) {
 298                         pr_err("Pre BegRun sequence 0x%08x ->"
 299                                 " 0x%08x\n", seq->first_datasn,
 300                                 seq->last_datasn);
 301
 302                         read_data_done += cmd->seq_list[i].xfer_len;
 303                         seq->next_burst_len = seq->pdu_send_order = 0;
 304                         continue;
 305                 }
 306
 307                 /*
 308                  * The BegRun lies within this DataIN sequence.
 309                  */
 310                 if ((seq->first_datasn <= begrun) &&
 311                                 (seq->last_datasn >= begrun)) {
 312                         pr_err("Found sequence begrun: 0x%08x in"
 313                                 " 0x%08x -> 0x%08x\n", begrun,
 314                                 seq->first_datasn, seq->last_datasn);
 315
 316                         seq_send_order = seq->seq_send_order;
 317                         data_sn = seq->first_datasn;
 318                         seq->next_burst_len = seq->pdu_send_order = 0;
 319                         found_seq = 1;
 320
 321                         /*
 322                          * For DataPDUInOrder=Yes, while the first DataSN of
 323                          * the sequence is less than the received BegRun, add
 324                          * the MaxRecvDataSegmentLength to read_data_done and
 325                          * to the sequence's next_burst_len;
 326                          *
 327                          * For DataPDUInOrder=No, while the first DataSN of the
 328                          * sequence is less than the received BegRun, find the
 329                          * struct iscsi_pdu of the DataSN in question and add the
 330                          * MaxRecvDataSegmentLength to read_data_done and to the
 331                          * sequence's next_burst_len;
 332                          */
 333                         if (conn->sess->sess_ops->DataPDUInOrder) {
 334                                 while (data_sn < begrun) {
 335                                         seq->pdu_send_order++;
 336                                         read_data_done +=
 337                                                 conn->conn_ops->MaxRecvDataSegmentLength;
 338                                         seq->next_burst_len +=
 339                                                 conn->conn_ops->MaxRecvDataSegmentLength;
 340                                         data_sn++;
 341                                 }
 342                         } else {
 343                                 int j;
 344                                 struct iscsi_pdu *pdu;
 345
 346                                 while (data_sn < begrun) {
 347                                         seq->pdu_send_order++;
 348
 349                                         for (j = 0; j < seq->pdu_count; j++) {
 350                                                 pdu = &cmd->pdu_list[
 351                                                         seq->pdu_start + j];
 352                                                 if (pdu->data_sn == data_sn) {
 353                                                         read_data_done +=
 354                                                                 pdu->length;
 355                                                         seq->next_burst_len +=
 356                                                                 pdu->length;
 357                                                 }
 358                                         }
 359                                         data_sn++;
 360                                 }
 361                         }
 362                         continue;
 363                 }
 364
 365                 /*
 366                  * This DataIN sequence is larger than the received BegRun,
 367                  * reset seq->pdu_send_order and continue.
 368                  */
 369                 if ((seq->first_datasn > begrun) ||
 370                                 (seq->last_datasn > begrun)) {
 371                         pr_err("Post BegRun sequence 0x%08x -> 0x%08x\n",
 372                                         seq->first_datasn, seq->last_datasn);
 373
 374                         seq->next_burst_len = seq->pdu_send_order = 0;
 375                         continue;
 376                 }
 377         }
 378
 379         if (!found_seq) {
 380                 if (!begrun) {
 381                         if (!first_seq) {
 382                                 pr_err("ITT: 0x%08x, Begrun: 0x%08x"
 383                                         " but first_seq is NULL\n",
 384                                         cmd->init_task_tag, begrun);
 385                                 return -1;
 386                         }
 387                         seq_send_order = first_seq->seq_send_order;
 388                         seq->next_burst_len = seq->pdu_send_order = 0;
 389                         goto done;
 390                 }
 391
 392                 pr_err("Unable to locate struct iscsi_seq for ITT: 0x%08x,"
 393                         " BegRun: 0x%08x, RunLength: 0x%08x while"
 394                         " DataSequenceInOrder=No and DataPDUInOrder=%s.\n",
 395                                 cmd->init_task_tag, begrun, runlength,
 396                         (conn->sess->sess_ops->DataPDUInOrder) ? "Yes" : "No");
 397                 return -1;
 398         }
 399
 400 done:
 401         dr->read_data_done = read_data_done;
 402         dr->seq_send_order = seq_send_order;
 403
 404         return 0;
 405 }
 406
 407 static int iscsit_handle_recovery_datain(
 408         struct iscsi_cmd *cmd,
 409         unsigned char *buf,
 410         u32 begrun,
 411         u32 runlength)
 412 {
 413         struct iscsi_conn *conn = cmd->conn;
 414         struct iscsi_datain_req *dr;
 415         struct se_cmd *se_cmd = &cmd->se_cmd;
 416
 417         if (!(se_cmd->transport_state & CMD_T_COMPLETE)) {
 418                 pr_err("Ignoring ITT: 0x%08x Data SNACK\n",
 419                                 cmd->init_task_tag);
 420                 return 0;
 421         }
 422
 423         /*
 424          * Make sure the initiator is not requesting retransmission
 425          * of DataSNs already acknowledged by a Data ACK SNACK.
 426          */
 427         if ((cmd->cmd_flags & ICF_GOT_DATACK_SNACK) &&
 428             (begrun <= cmd->acked_data_sn)) {
 429                 pr_err("ITT: 0x%08x, Data SNACK requesting"
 430                         " retransmission of DataSN: 0x%08x to 0x%08x but"
 431                         " already acked to DataSN: 0x%08x by Data ACK SNACK,"
 432                         " protocol error.\n", cmd->init_task_tag, begrun,
 433                         (begrun + runlength), cmd->acked_data_sn);
 434
 435                 return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
 436         }
 437
 438         /*
 439          * Make sure BegRun and RunLength in the Data SNACK are sane.
 440          * Note: (cmd->data_sn - 1) will carry the maximum DataSN sent.
 441          */
 442         if ((begrun + runlength) > (cmd->data_sn - 1)) {
 443                 pr_err("Initiator requesting BegRun: 0x%08x, RunLength"
 444                         ": 0x%08x greater than maximum DataSN: 0x%08x.\n",
 445                                 begrun, runlength, (cmd->data_sn - 1));
 446                 return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_INVALID,
 447                                          buf);
 448         }
 449
 450         dr = iscsit_allocate_datain_req();
 451         if (!dr)
 452                 return iscsit_reject_cmd(cmd, ISCSI_REASON_BOOKMARK_NO_RESOURCES,
 453                                          buf);
 454
 455         dr->data_sn = dr->begrun = begrun;
 456         dr->runlength = runlength;
 457         dr->generate_recovery_values = 1;
 458         dr->recovery = DATAIN_WITHIN_COMMAND_RECOVERY;
 459
 460         iscsit_attach_datain_req(cmd, dr);
 461
 462         cmd->i_state = ISTATE_SEND_DATAIN;
 463         iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
 464
 465         return 0;
 466 }
 467
 468 int iscsit_handle_recovery_datain_or_r2t(
 469         struct iscsi_conn *conn,
 470         unsigned char *buf,
 471         itt_t init_task_tag,
 472         u32 targ_xfer_tag,
 473         u32 begrun,
 474         u32 runlength)
 475 {
 476         struct iscsi_cmd *cmd;
 477
 478         cmd = iscsit_find_cmd_from_itt(conn, init_task_tag);
 479         if (!cmd)
 480                 return 0;
 481
 482         /*
 483          * FIXME: This will not work for bidi commands.
 484          */
 485         switch (cmd->data_direction) {
 486         case DMA_TO_DEVICE:
 487                 return iscsit_handle_r2t_snack(cmd, buf, begrun, runlength);
 488         case DMA_FROM_DEVICE:
 489                 return iscsit_handle_recovery_datain(cmd, buf, begrun,
 490                                 runlength);
 491         default:
 492                 pr_err("Unknown cmd->data_direction: 0x%02x\n",
 493                                 cmd->data_direction);
 494                 return -1;
 495         }
 496
 497         return 0;
 498 }
 499
 500 /* #warning FIXME: Status SNACK needs to be dependent on OPCODE!!! */
 501 int iscsit_handle_status_snack(
 502         struct iscsi_conn *conn,
 503         itt_t init_task_tag,
 504         u32 targ_xfer_tag,
 505         u32 begrun,
 506         u32 runlength)
 507 {
 508         struct iscsi_cmd *cmd = NULL;
 509         u32 last_statsn;
 510         int found_cmd;
 511
 512         if (conn->exp_statsn > begrun) {
 513                 pr_err("Got Status SNACK Begrun: 0x%08x, RunLength:"
 514                         " 0x%08x but already got ExpStatSN: 0x%08x on CID:"
 515                         " %hu.\n", begrun, runlength, conn->exp_statsn,
 516                         conn->cid);
 517                 return 0;
 518         }
 519
 520         last_statsn = (!runlength) ? conn->stat_sn : (begrun + runlength);
 521
 522         while (begrun < last_statsn) {
 523                 found_cmd = 0;
 524
 525                 spin_lock_bh(&conn->cmd_lock);
 526                 list_for_each_entry(cmd, &conn->conn_cmd_list, i_conn_node) {
 527                         if (cmd->stat_sn == begrun) {
 528                                 found_cmd = 1;
 529                                 break;
 530                         }
 531                 }
 532                 spin_unlock_bh(&conn->cmd_lock);
 533
 534                 if (!found_cmd) {
 535                         pr_err("Unable to find StatSN: 0x%08x for"
 536                                 " a Status SNACK, assuming this was a"
 537                                 " protactic SNACK for an untransmitted"
 538                                 " StatSN, ignoring.\n", begrun);
 539                         begrun++;
 540                         continue;
 541                 }
 542
 543                 spin_lock_bh(&cmd->istate_lock);
 544                 if (cmd->i_state == ISTATE_SEND_DATAIN) {
 545                         spin_unlock_bh(&cmd->istate_lock);
 546                         pr_err("Ignoring Status SNACK for BegRun:"
 547                                 " 0x%08x, RunLength: 0x%08x, assuming this was"
 548                                 " a protactic SNACK for an untransmitted"
 549                                 " StatSN\n", begrun, runlength);
 550                         begrun++;
 551                         continue;
 552                 }
 553                 spin_unlock_bh(&cmd->istate_lock);
 554
 555                 cmd->i_state = ISTATE_SEND_STATUS_RECOVERY;
 556                 iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
 557                 begrun++;
 558         }
 559
 560         return 0;
 561 }
 562
 563 int iscsit_handle_data_ack(
 564         struct iscsi_conn *conn,
 565         u32 targ_xfer_tag,
 566         u32 begrun,
 567         u32 runlength)
 568 {
 569         struct iscsi_cmd *cmd = NULL;
 570
 571         cmd = iscsit_find_cmd_from_ttt(conn, targ_xfer_tag);
 572         if (!cmd) {
 573                 pr_err("Data ACK SNACK for TTT: 0x%08x is"
 574                         " invalid.\n", targ_xfer_tag);
 575                 return -1;
 576         }
 577
 578         if (begrun <= cmd->acked_data_sn) {
 579                 pr_err("ITT: 0x%08x Data ACK SNACK BegRUN: 0x%08x is"
 580                         " less than the already acked DataSN: 0x%08x.\n",
 581                         cmd->init_task_tag, begrun, cmd->acked_data_sn);
 582                 return -1;
 583         }
 584
 585         /*
 586          * For Data ACK SNACK, BegRun is the next expected DataSN.
 587          * (see iSCSI v19: 10.16.6)
 588          */
 589         cmd->cmd_flags |= ICF_GOT_DATACK_SNACK;
 590         cmd->acked_data_sn = (begrun - 1);
 591
 592         pr_debug("Received Data ACK SNACK for ITT: 0x%08x,"
 593                 " updated acked DataSN to 0x%08x.\n",
 594                         cmd->init_task_tag, cmd->acked_data_sn);
 595
 596         return 0;
 597 }
 598
 599 static int iscsit_send_recovery_r2t(
 600         struct iscsi_cmd *cmd,
 601         u32 offset,
 602         u32 xfer_len)
 603 {
 604         int ret;
 605
 606         spin_lock_bh(&cmd->r2t_lock);
 607         ret = iscsit_add_r2t_to_list(cmd, offset, xfer_len, 1, 0);
 608         spin_unlock_bh(&cmd->r2t_lock);
 609
 610         return ret;
 611 }
 612
 613 int iscsit_dataout_datapduinorder_no_fbit(
 614         struct iscsi_cmd *cmd,
 615         struct iscsi_pdu *pdu)
 616 {
 617         int i, send_recovery_r2t = 0, recovery = 0;
 618         u32 length = 0, offset = 0, pdu_count = 0, xfer_len = 0;
 619         struct iscsi_conn *conn = cmd->conn;
 620         struct iscsi_pdu *first_pdu = NULL;
 621
 622         /*
 623          * Get an struct iscsi_pdu pointer to the first PDU, and total PDU count
 624          * of the DataOUT sequence.
 625          */
 626         if (conn->sess->sess_ops->DataSequenceInOrder) {
 627                 for (i = 0; i < cmd->pdu_count; i++) {
 628                         if (cmd->pdu_list[i].seq_no == pdu->seq_no) {
 629                                 if (!first_pdu)
 630                                         first_pdu = &cmd->pdu_list[i];
 631                                  xfer_len += cmd->pdu_list[i].length;
 632                                  pdu_count++;
 633                         } else if (pdu_count)
 634                                 break;
 635                 }
 636         } else {
 637                 struct iscsi_seq *seq = cmd->seq_ptr;
 638
 639                 first_pdu = &cmd->pdu_list[seq->pdu_start];
 640                 pdu_count = seq->pdu_count;
 641         }
 642
 643         if (!first_pdu || !pdu_count)
 644                 return DATAOUT_CANNOT_RECOVER;
 645
 646         /*
 647          * Loop through the ending DataOUT Sequence checking each struct iscsi_pdu.
 648          * The following ugly logic does batching of not received PDUs.
 649          */
 650         for (i = 0; i < pdu_count; i++) {
 651                 if (first_pdu[i].status == ISCSI_PDU_RECEIVED_OK) {
 652                         if (!send_recovery_r2t)
 653                                 continue;
 654
 655                         if (iscsit_send_recovery_r2t(cmd, offset, length) < 0)
 656                                 return DATAOUT_CANNOT_RECOVER;
 657
 658                         send_recovery_r2t = length = offset = 0;
 659                         continue;
 660                 }
 661                 /*
 662                  * Set recovery = 1 for any missing, CRC failed, or timed
 663                  * out PDUs to let the DataOUT logic know that this sequence
 664                  * has not been completed yet.
 665                  *
 666                  * Also, only send a Recovery R2T for ISCSI_PDU_NOT_RECEIVED.
 667                  * We assume if the PDU either failed CRC or timed out
 668                  * that a Recovery R2T has already been sent.
 669                  */
 670                 recovery = 1;
 671
 672                 if (first_pdu[i].status != ISCSI_PDU_NOT_RECEIVED)
 673                         continue;
 674
 675                 if (!offset)
 676                         offset = first_pdu[i].offset;
 677                 length += first_pdu[i].length;
 678
 679                 send_recovery_r2t = 1;
 680         }
 681
 682         if (send_recovery_r2t)
 683                 if (iscsit_send_recovery_r2t(cmd, offset, length) < 0)
 684                         return DATAOUT_CANNOT_RECOVER;
 685
 686         return (!recovery) ? DATAOUT_NORMAL : DATAOUT_WITHIN_COMMAND_RECOVERY;
 687 }
 688
 689 static int iscsit_recalculate_dataout_values(
 690         struct iscsi_cmd *cmd,
 691         u32 pdu_offset,
 692         u32 pdu_length,
 693         u32 *r2t_offset,
 694         u32 *r2t_length)
 695 {
 696         int i;
 697         struct iscsi_conn *conn = cmd->conn;
 698         struct iscsi_pdu *pdu = NULL;
 699
 700         if (conn->sess->sess_ops->DataSequenceInOrder) {
 701                 cmd->data_sn = 0;
 702
 703                 if (conn->sess->sess_ops->DataPDUInOrder) {
 704                         *r2t_offset = cmd->write_data_done;
 705                         *r2t_length = (cmd->seq_end_offset -
 706                                         cmd->write_data_done);
 707                         return 0;
 708                 }
 709
 710                 *r2t_offset = cmd->seq_start_offset;
 711                 *r2t_length = (cmd->seq_end_offset - cmd->seq_start_offset);
 712
 713                 for (i = 0; i < cmd->pdu_count; i++) {
 714                         pdu = &cmd->pdu_list[i];
 715
 716                         if (pdu->status != ISCSI_PDU_RECEIVED_OK)
 717                                 continue;
 718
 719                         if ((pdu->offset >= cmd->seq_start_offset) &&
 720                            ((pdu->offset + pdu->length) <=
 721                              cmd->seq_end_offset)) {
 722                                 if (!cmd->unsolicited_data)
 723                                         cmd->next_burst_len -= pdu->length;
 724                                 else
 725                                         cmd->first_burst_len -= pdu->length;
 726
 727                                 cmd->write_data_done -= pdu->length;
 728                                 pdu->status = ISCSI_PDU_NOT_RECEIVED;
 729                         }
 730                 }
 731         } else {
 732                 struct iscsi_seq *seq = NULL;
 733
 734                 seq = iscsit_get_seq_holder(cmd, pdu_offset, pdu_length);
 735                 if (!seq)
 736                         return -1;
 737
 738                 *r2t_offset = seq->orig_offset;
 739                 *r2t_length = seq->xfer_len;
 740
 741                 cmd->write_data_done -= (seq->offset - seq->orig_offset);
 742                 if (cmd->immediate_data)
 743                         cmd->first_burst_len = cmd->write_data_done;
 744
 745                 seq->data_sn = 0;
 746                 seq->offset = seq->orig_offset;
 747                 seq->next_burst_len = 0;
 748                 seq->status = DATAOUT_SEQUENCE_WITHIN_COMMAND_RECOVERY;
 749
 750                 if (conn->sess->sess_ops->DataPDUInOrder)
 751                         return 0;
 752
 753                 for (i = 0; i < seq->pdu_count; i++) {
 754                         pdu = &cmd->pdu_list[i+seq->pdu_start];
 755
 756                         if (pdu->status != ISCSI_PDU_RECEIVED_OK)
 757                                 continue;
 758
 759                         pdu->status = ISCSI_PDU_NOT_RECEIVED;
 760                 }
 761         }
 762
 763         return 0;
 764 }
 765
 766 int iscsit_recover_dataout_sequence(
 767         struct iscsi_cmd *cmd,
 768         u32 pdu_offset,
 769         u32 pdu_length)
 770 {
 771         u32 r2t_length = 0, r2t_offset = 0;
 772
 773         spin_lock_bh(&cmd->istate_lock);
 774         cmd->cmd_flags |= ICF_WITHIN_COMMAND_RECOVERY;
 775         spin_unlock_bh(&cmd->istate_lock);
 776
 777         if (iscsit_recalculate_dataout_values(cmd, pdu_offset, pdu_length,
 778                         &r2t_offset, &r2t_length) < 0)
 779                 return DATAOUT_CANNOT_RECOVER;
 780
 781         iscsit_send_recovery_r2t(cmd, r2t_offset, r2t_length);
 782
 783         return DATAOUT_WITHIN_COMMAND_RECOVERY;
 784 }
 785
 786 static struct iscsi_ooo_cmdsn *iscsit_allocate_ooo_cmdsn(void)
 787 {
 788         struct iscsi_ooo_cmdsn *ooo_cmdsn = NULL;
 789
 790         ooo_cmdsn = kmem_cache_zalloc(lio_ooo_cache, GFP_ATOMIC);
 791         if (!ooo_cmdsn) {
 792                 pr_err("Unable to allocate memory for"
 793                         " struct iscsi_ooo_cmdsn.\n");
 794                 return NULL;
 795         }
 796         INIT_LIST_HEAD(&ooo_cmdsn->ooo_list);
 797
 798         return ooo_cmdsn;
 799 }
 800
 801 /*
 802  *      Called with sess->cmdsn_mutex held.
 803  */
 804 static int iscsit_attach_ooo_cmdsn(
 805         struct iscsi_session *sess,
 806         struct iscsi_ooo_cmdsn *ooo_cmdsn)
 807 {
 808         struct iscsi_ooo_cmdsn *ooo_tail, *ooo_tmp;
 809         /*
 810          * We attach the struct iscsi_ooo_cmdsn entry to the out of order
 811          * list in increasing CmdSN order.
 812          * This allows iscsi_execute_ooo_cmdsns() to detect any
 813          * additional CmdSN holes while performing delayed execution.
 814          */
 815         if (list_empty(&sess->sess_ooo_cmdsn_list))
 816                 list_add_tail(&ooo_cmdsn->ooo_list,
 817                                 &sess->sess_ooo_cmdsn_list);
 818         else {
 819                 ooo_tail = list_entry(sess->sess_ooo_cmdsn_list.prev,
 820                                 typeof(*ooo_tail), ooo_list);
 821                 /*
 822                  * CmdSN is greater than the tail of the list.
 823                  */
 824                 if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn))
 825                         list_add_tail(&ooo_cmdsn->ooo_list,
 826                                         &sess->sess_ooo_cmdsn_list);
 827                 else {
 828                         /*
 829                          * CmdSN is either lower than the head,  or somewhere
 830                          * in the middle.
 831                          */
 832                         list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
 833                                                 ooo_list) {
 834                                 if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn))
 835                                         continue;
 836
 837                                 /* Insert before this entry */
 838                                 list_add(&ooo_cmdsn->ooo_list,
 839                                         ooo_tmp->ooo_list.prev);
 840                                 break;
 841                         }
 842                 }
 843         }
 844
 845         return 0;
 846 }
 847
 848 /*
 849  *      Removes an struct iscsi_ooo_cmdsn from a session's list,
 850  *      called with struct iscsi_session->cmdsn_mutex held.
 851  */
 852 void iscsit_remove_ooo_cmdsn(
 853         struct iscsi_session *sess,
 854         struct iscsi_ooo_cmdsn *ooo_cmdsn)
 855 {
 856         list_del(&ooo_cmdsn->ooo_list);
 857         kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
 858 }
 859
 860 void iscsit_clear_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
 861 {
 862         struct iscsi_ooo_cmdsn *ooo_cmdsn;
 863         struct iscsi_session *sess = conn->sess;
 864
 865         mutex_lock(&sess->cmdsn_mutex);
 866         list_for_each_entry(ooo_cmdsn, &sess->sess_ooo_cmdsn_list, ooo_list) {
 867                 if (ooo_cmdsn->cid != conn->cid)
 868                         continue;
 869
 870                 ooo_cmdsn->cmd = NULL;
 871         }
 872         mutex_unlock(&sess->cmdsn_mutex);
 873 }
 874
 875 /*
 876  *      Called with sess->cmdsn_mutex held.
 877  */
 878 int iscsit_execute_ooo_cmdsns(struct iscsi_session *sess)
 879 {
 880         int ooo_count = 0;
 881         struct iscsi_cmd *cmd = NULL;
 882         struct iscsi_ooo_cmdsn *ooo_cmdsn, *ooo_cmdsn_tmp;
 883
 884         list_for_each_entry_safe(ooo_cmdsn, ooo_cmdsn_tmp,
 885                                 &sess->sess_ooo_cmdsn_list, ooo_list) {
 886                 if (ooo_cmdsn->cmdsn != sess->exp_cmd_sn)
 887                         continue;
 888
 889                 if (!ooo_cmdsn->cmd) {
 890                         sess->exp_cmd_sn++;
 891                         iscsit_remove_ooo_cmdsn(sess, ooo_cmdsn);
 892                         continue;
 893                 }
 894
 895                 cmd = ooo_cmdsn->cmd;
 896                 cmd->i_state = cmd->deferred_i_state;
 897                 ooo_count++;
 898                 sess->exp_cmd_sn++;
 899                 pr_debug("Executing out of order CmdSN: 0x%08x,"
 900                         " incremented ExpCmdSN to 0x%08x.\n",
 901                         cmd->cmd_sn, sess->exp_cmd_sn);
 902
 903                 iscsit_remove_ooo_cmdsn(sess, ooo_cmdsn);
 904
 905                 if (iscsit_execute_cmd(cmd, 1) < 0)
 906                         return -1;
 907
 908                 continue;
 909         }
 910
 911         return ooo_count;
 912 }
 913
 914 /*
 915  *      Called either:
 916  *
 917  *      1. With sess->cmdsn_mutex held from iscsi_execute_ooo_cmdsns()
 918  *      or iscsi_check_received_cmdsn().
 919  *      2. With no locks held directly from iscsi_handle_XXX_pdu() functions
 920  *      for immediate commands.
 921  */
 922 int iscsit_execute_cmd(struct iscsi_cmd *cmd, int ooo)
 923 {
 924         struct se_cmd *se_cmd = &cmd->se_cmd;
 925         struct iscsi_conn *conn = cmd->conn;
 926         int lr = 0;
 927
 928         spin_lock_bh(&cmd->istate_lock);
 929         if (ooo)
 930                 cmd->cmd_flags &= ~ICF_OOO_CMDSN;
 931
 932         switch (cmd->iscsi_opcode) {
 933         case ISCSI_OP_SCSI_CMD:
 934                 /*
 935                  * Go ahead and send the CHECK_CONDITION status for
 936                  * any SCSI CDB exceptions that may have occurred.
 937                  */
 938                 if (cmd->sense_reason) {
 939                         if (cmd->sense_reason == TCM_RESERVATION_CONFLICT) {
 940                                 cmd->i_state = ISTATE_SEND_STATUS;
 941                                 spin_unlock_bh(&cmd->istate_lock);
 942                                 iscsit_add_cmd_to_response_queue(cmd, cmd->conn,
 943                                                 cmd->i_state);
 944                                 return 0;
 945                         }
 946                         spin_unlock_bh(&cmd->istate_lock);
 947                         /*
 948                          * Determine if delayed TASK_ABORTED status for WRITEs
 949                          * should be sent now if no unsolicited data out
 950                          * payloads are expected, or if the delayed status
 951                          * should be sent after unsolicited data out with
 952                          * ISCSI_FLAG_CMD_FINAL set in iscsi_handle_data_out()
 953                          */
 954                         if (transport_check_aborted_status(se_cmd,
 955                                         (cmd->unsolicited_data == 0)) != 0)
 956                                 return 0;
 957                         /*
 958                          * Otherwise send CHECK_CONDITION and sense for
 959                          * exception
 960                          */
 961                         return transport_send_check_condition_and_sense(se_cmd,
 962                                         cmd->sense_reason, 0);
 963                 }
 964                 /*
 965                  * Special case for delayed CmdSN with Immediate
 966                  * Data and/or Unsolicited Data Out attached.
 967                  */
 968                 if (cmd->immediate_data) {
 969                         if (cmd->cmd_flags & ICF_GOT_LAST_DATAOUT) {
 970                                 spin_unlock_bh(&cmd->istate_lock);
 971                                 target_execute_cmd(&cmd->se_cmd);
 972                                 return 0;
 973                         }
 974                         spin_unlock_bh(&cmd->istate_lock);
 975
 976                         if (!(cmd->cmd_flags &
 977                                         ICF_NON_IMMEDIATE_UNSOLICITED_DATA)) {
 978                                 /*
 979                                  * Send the delayed TASK_ABORTED status for
 980                                  * WRITEs if no more unsolicitied data is
 981                                  * expected.
 982                                  */
 983                                 if (transport_check_aborted_status(se_cmd, 1)
 984                                                 != 0)
 985                                         return 0;
 986
 987                                 iscsit_set_dataout_sequence_values(cmd);
 988                                 conn->conn_transport->iscsit_get_dataout(conn, cmd, false);
 989                         }
 990                         return 0;
 991                 }
 992                 /*
 993                  * The default handler.
 994                  */
 995                 spin_unlock_bh(&cmd->istate_lock);
 996
 997                 if ((cmd->data_direction == DMA_TO_DEVICE) &&
 998                     !(cmd->cmd_flags & ICF_NON_IMMEDIATE_UNSOLICITED_DATA)) {
 999                         /*
1000                          * Send the delayed TASK_ABORTED status for WRITEs if
1001                          * no more nsolicitied data is expected.
1002                          */
1003                         if (transport_check_aborted_status(se_cmd, 1) != 0)
1004                                 return 0;
1005
1006                         iscsit_set_unsoliticed_dataout(cmd);
1007                 }
1008                 return transport_handle_cdb_direct(&cmd->se_cmd);
1009
1010         case ISCSI_OP_NOOP_OUT:
1011         case ISCSI_OP_TEXT:
1012                 spin_unlock_bh(&cmd->istate_lock);
1013                 iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
1014                 break;
1015         case ISCSI_OP_SCSI_TMFUNC:
1016                 if (cmd->se_cmd.se_tmr_req->response) {
1017                         spin_unlock_bh(&cmd->istate_lock);
1018                         iscsit_add_cmd_to_response_queue(cmd, cmd->conn,
1019                                         cmd->i_state);
1020                         return 0;
1021                 }
1022                 spin_unlock_bh(&cmd->istate_lock);
1023
1024                 return transport_generic_handle_tmr(&cmd->se_cmd);
1025         case ISCSI_OP_LOGOUT:
1026                 spin_unlock_bh(&cmd->istate_lock);
1027                 switch (cmd->logout_reason) {
1028                 case ISCSI_LOGOUT_REASON_CLOSE_SESSION:
1029                         lr = iscsit_logout_closesession(cmd, cmd->conn);
1030                         break;
1031                 case ISCSI_LOGOUT_REASON_CLOSE_CONNECTION:
1032                         lr = iscsit_logout_closeconnection(cmd, cmd->conn);
1033                         break;
1034                 case ISCSI_LOGOUT_REASON_RECOVERY:
1035                         lr = iscsit_logout_removeconnforrecovery(cmd, cmd->conn);
1036                         break;
1037                 default:
1038                         pr_err("Unknown iSCSI Logout Request Code:"
1039                                 " 0x%02x\n", cmd->logout_reason);
1040                         return -1;
1041                 }
1042
1043                 return lr;
1044         default:
1045                 spin_unlock_bh(&cmd->istate_lock);
1046                 pr_err("Cannot perform out of order execution for"
1047                 " unknown iSCSI Opcode: 0x%02x\n", cmd->iscsi_opcode);
1048                 return -1;
1049         }
1050
1051         return 0;
1052 }
1053
1054 void iscsit_free_all_ooo_cmdsns(struct iscsi_session *sess)
1055 {
1056         struct iscsi_ooo_cmdsn *ooo_cmdsn, *ooo_cmdsn_tmp;
1057
1058         mutex_lock(&sess->cmdsn_mutex);
1059         list_for_each_entry_safe(ooo_cmdsn, ooo_cmdsn_tmp,
1060                         &sess->sess_ooo_cmdsn_list, ooo_list) {
1061
1062                 list_del(&ooo_cmdsn->ooo_list);
1063                 kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
1064         }
1065         mutex_unlock(&sess->cmdsn_mutex);
1066 }
1067
1068 int iscsit_handle_ooo_cmdsn(
1069         struct iscsi_session *sess,
1070         struct iscsi_cmd *cmd,
1071         u32 cmdsn)
1072 {
1073         int batch = 0;
1074         struct iscsi_ooo_cmdsn *ooo_cmdsn = NULL, *ooo_tail = NULL;
1075
1076         cmd->deferred_i_state           = cmd->i_state;
1077         cmd->i_state                    = ISTATE_DEFERRED_CMD;
1078         cmd->cmd_flags                  |= ICF_OOO_CMDSN;
1079
1080         if (list_empty(&sess->sess_ooo_cmdsn_list))
1081                 batch = 1;
1082         else {
1083                 ooo_tail = list_entry(sess->sess_ooo_cmdsn_list.prev,
1084                                 typeof(*ooo_tail), ooo_list);
1085                 if (ooo_tail->cmdsn != (cmdsn - 1))
1086                         batch = 1;
1087         }
1088
1089         ooo_cmdsn = iscsit_allocate_ooo_cmdsn();
1090         if (!ooo_cmdsn)
1091                 return -ENOMEM;
1092
1093         ooo_cmdsn->cmd                  = cmd;
1094         ooo_cmdsn->batch_count          = (batch) ?
1095                                           (cmdsn - sess->exp_cmd_sn) : 1;
1096         ooo_cmdsn->cid                  = cmd->conn->cid;
1097         ooo_cmdsn->exp_cmdsn            = sess->exp_cmd_sn;
1098         ooo_cmdsn->cmdsn                = cmdsn;
1099
1100         if (iscsit_attach_ooo_cmdsn(sess, ooo_cmdsn) < 0) {
1101                 kmem_cache_free(lio_ooo_cache, ooo_cmdsn);
1102                 return -ENOMEM;
1103         }
1104
1105         return 0;
1106 }
1107
1108 static int iscsit_set_dataout_timeout_values(
1109         struct iscsi_cmd *cmd,
1110         u32 *offset,
1111         u32 *length)
1112 {
1113         struct iscsi_conn *conn = cmd->conn;
1114         struct iscsi_r2t *r2t;
1115
1116         if (cmd->unsolicited_data) {
1117                 *offset = 0;
1118                 *length = (conn->sess->sess_ops->FirstBurstLength >
1119                            cmd->se_cmd.data_length) ?
1120                            cmd->se_cmd.data_length :
1121                            conn->sess->sess_ops->FirstBurstLength;
1122                 return 0;
1123         }
1124
1125         spin_lock_bh(&cmd->r2t_lock);
1126         if (list_empty(&cmd->cmd_r2t_list)) {
1127                 pr_err("cmd->cmd_r2t_list is empty!\n");
1128                 spin_unlock_bh(&cmd->r2t_lock);
1129                 return -1;
1130         }
1131
1132         list_for_each_entry(r2t, &cmd->cmd_r2t_list, r2t_list) {
1133                 if (r2t->sent_r2t && !r2t->recovery_r2t && !r2t->seq_complete) {
1134                         *offset = r2t->offset;
1135                         *length = r2t->xfer_len;
1136                         spin_unlock_bh(&cmd->r2t_lock);
1137                         return 0;
1138                 }
1139         }
1140         spin_unlock_bh(&cmd->r2t_lock);
1141
1142         pr_err("Unable to locate any incomplete DataOUT"
1143                 " sequences for ITT: 0x%08x.\n", cmd->init_task_tag);
1144
1145         return -1;
1146 }
1147
1148 /*
1149  *      NOTE: Called from interrupt (timer) context.
1150  */
1151 static void iscsit_handle_dataout_timeout(unsigned long data)
1152 {
1153         u32 pdu_length = 0, pdu_offset = 0;
1154         u32 r2t_length = 0, r2t_offset = 0;
1155         struct iscsi_cmd *cmd = (struct iscsi_cmd *) data;
1156         struct iscsi_conn *conn = cmd->conn;
1157         struct iscsi_session *sess = NULL;
1158         struct iscsi_node_attrib *na;
1159
1160         iscsit_inc_conn_usage_count(conn);
1161
1162         spin_lock_bh(&cmd->dataout_timeout_lock);
1163         if (cmd->dataout_timer_flags & ISCSI_TF_STOP) {
1164                 spin_unlock_bh(&cmd->dataout_timeout_lock);
1165                 iscsit_dec_conn_usage_count(conn);
1166                 return;
1167         }
1168         cmd->dataout_timer_flags &= ~ISCSI_TF_RUNNING;
1169         sess = conn->sess;
1170         na = iscsit_tpg_get_node_attrib(sess);
1171
1172         if (!sess->sess_ops->ErrorRecoveryLevel) {
1173                 pr_debug("Unable to recover from DataOut timeout while"
1174                         " in ERL=0.\n");
1175                 goto failure;
1176         }
1177
1178         if (++cmd->dataout_timeout_retries == na->dataout_timeout_retries) {
1179                 pr_debug("Command ITT: 0x%08x exceeded max retries"
1180                         " for DataOUT timeout %u, closing iSCSI connection.\n",
1181                         cmd->init_task_tag, na->dataout_timeout_retries);
1182                 goto failure;
1183         }
1184
1185         cmd->cmd_flags |= ICF_WITHIN_COMMAND_RECOVERY;
1186
1187         if (conn->sess->sess_ops->DataSequenceInOrder) {
1188                 if (conn->sess->sess_ops->DataPDUInOrder) {
1189                         pdu_offset = cmd->write_data_done;
1190                         if ((pdu_offset + (conn->sess->sess_ops->MaxBurstLength -
1191                              cmd->next_burst_len)) > cmd->se_cmd.data_length)
1192                                 pdu_length = (cmd->se_cmd.data_length -
1193                                         cmd->write_data_done);
1194                         else
1195                                 pdu_length = (conn->sess->sess_ops->MaxBurstLength -
1196                                                 cmd->next_burst_len);
1197                 } else {
1198                         pdu_offset = cmd->seq_start_offset;
1199                         pdu_length = (cmd->seq_end_offset -
1200                                 cmd->seq_start_offset);
1201                 }
1202         } else {
1203                 if (iscsit_set_dataout_timeout_values(cmd, &pdu_offset,
1204                                 &pdu_length) < 0)
1205                         goto failure;
1206         }
1207
1208         if (iscsit_recalculate_dataout_values(cmd, pdu_offset, pdu_length,
1209                         &r2t_offset, &r2t_length) < 0)
1210                 goto failure;
1211
1212         pr_debug("Command ITT: 0x%08x timed out waiting for"
1213                 " completion of %sDataOUT Sequence Offset: %u, Length: %u\n",
1214                 cmd->init_task_tag, (cmd->unsolicited_data) ? "Unsolicited " :
1215                 "", r2t_offset, r2t_length);
1216
1217         if (iscsit_send_recovery_r2t(cmd, r2t_offset, r2t_length) < 0)
1218                 goto failure;
1219
1220         iscsit_start_dataout_timer(cmd, conn);
1221         spin_unlock_bh(&cmd->dataout_timeout_lock);
1222         iscsit_dec_conn_usage_count(conn);
1223
1224         return;
1225
1226 failure:
1227         spin_unlock_bh(&cmd->dataout_timeout_lock);
1228         iscsit_cause_connection_reinstatement(conn, 0);
1229         iscsit_dec_conn_usage_count(conn);
1230 }
1231
1232 void iscsit_mod_dataout_timer(struct iscsi_cmd *cmd)
1233 {
1234         struct iscsi_conn *conn = cmd->conn;
1235         struct iscsi_session *sess = conn->sess;
1236         struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
1237
1238         spin_lock_bh(&cmd->dataout_timeout_lock);
1239         if (!(cmd->dataout_timer_flags & ISCSI_TF_RUNNING)) {
1240                 spin_unlock_bh(&cmd->dataout_timeout_lock);
1241                 return;
1242         }
1243
1244         mod_timer(&cmd->dataout_timer,
1245                 (get_jiffies_64() + na->dataout_timeout * HZ));
1246         pr_debug("Updated DataOUT timer for ITT: 0x%08x",
1247                         cmd->init_task_tag);
1248         spin_unlock_bh(&cmd->dataout_timeout_lock);
1249 }
1250
1251 /*
1252  *      Called with cmd->dataout_timeout_lock held.
1253  */
1254 void iscsit_start_dataout_timer(
1255         struct iscsi_cmd *cmd,
1256         struct iscsi_conn *conn)
1257 {
1258         struct iscsi_session *sess = conn->sess;
1259         struct iscsi_node_attrib *na = iscsit_tpg_get_node_attrib(sess);
1260
1261         if (cmd->dataout_timer_flags & ISCSI_TF_RUNNING)
1262                 return;
1263
1264         pr_debug("Starting DataOUT timer for ITT: 0x%08x on"
1265                 " CID: %hu.\n", cmd->init_task_tag, conn->cid);
1266
1267         init_timer(&cmd->dataout_timer);
1268         cmd->dataout_timer.expires = (get_jiffies_64() + na->dataout_timeout * HZ);
1269         cmd->dataout_timer.data = (unsigned long)cmd;
1270         cmd->dataout_timer.function = iscsit_handle_dataout_timeout;
1271         cmd->dataout_timer_flags &= ~ISCSI_TF_STOP;
1272         cmd->dataout_timer_flags |= ISCSI_TF_RUNNING;
1273         add_timer(&cmd->dataout_timer);
1274 }
1275
1276 void iscsit_stop_dataout_timer(struct iscsi_cmd *cmd)
1277 {
1278         spin_lock_bh(&cmd->dataout_timeout_lock);
1279         if (!(cmd->dataout_timer_flags & ISCSI_TF_RUNNING)) {
1280                 spin_unlock_bh(&cmd->dataout_timeout_lock);
1281                 return;
1282         }
1283         cmd->dataout_timer_flags |= ISCSI_TF_STOP;
1284         spin_unlock_bh(&cmd->dataout_timeout_lock);
1285
1286         del_timer_sync(&cmd->dataout_timer);
1287
1288         spin_lock_bh(&cmd->dataout_timeout_lock);
1289         cmd->dataout_timer_flags &= ~ISCSI_TF_RUNNING;
1290         pr_debug("Stopped DataOUT Timer for ITT: 0x%08x\n",
1291                         cmd->init_task_tag);
1292         spin_unlock_bh(&cmd->dataout_timeout_lock);
1293 }
1294 EXPORT_SYMBOL(iscsit_stop_dataout_timer);