xref: /linux/drivers/block/aoe/aoecmd.c (revision c75c5ab575af7db707689cdbb5a5c458e9a034bb)
1 /* Copyright (c) 2012 Coraid, Inc.  See COPYING for GPL terms. */
2 /*
3  * aoecmd.c
4  * Filesystem request handling methods
5  */
6 
7 #include <linux/ata.h>
8 #include <linux/slab.h>
9 #include <linux/hdreg.h>
10 #include <linux/blkdev.h>
11 #include <linux/skbuff.h>
12 #include <linux/netdevice.h>
13 #include <linux/genhd.h>
14 #include <linux/moduleparam.h>
15 #include <linux/workqueue.h>
16 #include <linux/kthread.h>
17 #include <net/net_namespace.h>
18 #include <asm/unaligned.h>
19 #include <linux/uio.h>
20 #include "aoe.h"
21 
22 #define MAXIOC (8192)	/* default meant to avoid most soft lockups */
23 
24 static void ktcomplete(struct frame *, struct sk_buff *);
25 static int count_targets(struct aoedev *d, int *untainted);
26 
27 static struct buf *nextbuf(struct aoedev *);
28 
29 static int aoe_deadsecs = 60 * 3;
30 module_param(aoe_deadsecs, int, 0644);
31 MODULE_PARM_DESC(aoe_deadsecs, "After aoe_deadsecs seconds, give up and fail dev.");
32 
33 static int aoe_maxout = 64;
34 module_param(aoe_maxout, int, 0644);
35 MODULE_PARM_DESC(aoe_maxout,
36 	"Only aoe_maxout outstanding packets for every MAC on eX.Y.");
37 
38 static wait_queue_head_t ktiowq;
39 static struct ktstate kts;
40 
41 /* io completion queue */
42 static struct {
43 	struct list_head head;
44 	spinlock_t lock;
45 } iocq;
46 
47 static struct page *empty_page;
48 
49 static struct sk_buff *
50 new_skb(ulong len)
51 {
52 	struct sk_buff *skb;
53 
54 	skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC);
55 	if (skb) {
56 		skb_reserve(skb, MAX_HEADER);
57 		skb_reset_mac_header(skb);
58 		skb_reset_network_header(skb);
59 		skb->protocol = __constant_htons(ETH_P_AOE);
60 		skb_checksum_none_assert(skb);
61 	}
62 	return skb;
63 }
64 
65 static struct frame *
66 getframe_deferred(struct aoedev *d, u32 tag)
67 {
68 	struct list_head *head, *pos, *nx;
69 	struct frame *f;
70 
71 	head = &d->rexmitq;
72 	list_for_each_safe(pos, nx, head) {
73 		f = list_entry(pos, struct frame, head);
74 		if (f->tag == tag) {
75 			list_del(pos);
76 			return f;
77 		}
78 	}
79 	return NULL;
80 }
81 
82 static struct frame *
83 getframe(struct aoedev *d, u32 tag)
84 {
85 	struct frame *f;
86 	struct list_head *head, *pos, *nx;
87 	u32 n;
88 
89 	n = tag % NFACTIVE;
90 	head = &d->factive[n];
91 	list_for_each_safe(pos, nx, head) {
92 		f = list_entry(pos, struct frame, head);
93 		if (f->tag == tag) {
94 			list_del(pos);
95 			return f;
96 		}
97 	}
98 	return NULL;
99 }
100 
101 /*
102  * Leave the top bit clear so we have tagspace for userland.
103  * The bottom 16 bits are the xmit tick for rexmit/rttavg processing.
104  * This driver reserves tag -1 to mean "unused frame."
105  */
106 static int
107 newtag(struct aoedev *d)
108 {
109 	register ulong n;
110 
111 	n = jiffies & 0xffff;
112 	return n |= (++d->lasttag & 0x7fff) << 16;
113 }
114 
115 static u32
116 aoehdr_atainit(struct aoedev *d, struct aoetgt *t, struct aoe_hdr *h)
117 {
118 	u32 host_tag = newtag(d);
119 
120 	memcpy(h->src, t->ifp->nd->dev_addr, sizeof h->src);
121 	memcpy(h->dst, t->addr, sizeof h->dst);
122 	h->type = __constant_cpu_to_be16(ETH_P_AOE);
123 	h->verfl = AOE_HVER;
124 	h->major = cpu_to_be16(d->aoemajor);
125 	h->minor = d->aoeminor;
126 	h->cmd = AOECMD_ATA;
127 	h->tag = cpu_to_be32(host_tag);
128 
129 	return host_tag;
130 }
131 
132 static inline void
133 put_lba(struct aoe_atahdr *ah, sector_t lba)
134 {
135 	ah->lba0 = lba;
136 	ah->lba1 = lba >>= 8;
137 	ah->lba2 = lba >>= 8;
138 	ah->lba3 = lba >>= 8;
139 	ah->lba4 = lba >>= 8;
140 	ah->lba5 = lba >>= 8;
141 }
142 
143 static struct aoeif *
144 ifrotate(struct aoetgt *t)
145 {
146 	struct aoeif *ifp;
147 
148 	ifp = t->ifp;
149 	ifp++;
150 	if (ifp >= &t->ifs[NAOEIFS] || ifp->nd == NULL)
151 		ifp = t->ifs;
152 	if (ifp->nd == NULL)
153 		return NULL;
154 	return t->ifp = ifp;
155 }
156 
157 static void
158 skb_pool_put(struct aoedev *d, struct sk_buff *skb)
159 {
160 	__skb_queue_tail(&d->skbpool, skb);
161 }
162 
163 static struct sk_buff *
164 skb_pool_get(struct aoedev *d)
165 {
166 	struct sk_buff *skb = skb_peek(&d->skbpool);
167 
168 	if (skb && atomic_read(&skb_shinfo(skb)->dataref) == 1) {
169 		__skb_unlink(skb, &d->skbpool);
170 		return skb;
171 	}
172 	if (skb_queue_len(&d->skbpool) < NSKBPOOLMAX &&
173 	    (skb = new_skb(ETH_ZLEN)))
174 		return skb;
175 
176 	return NULL;
177 }
178 
179 void
180 aoe_freetframe(struct frame *f)
181 {
182 	struct aoetgt *t;
183 
184 	t = f->t;
185 	f->buf = NULL;
186 	f->lba = 0;
187 	f->bv = NULL;
188 	f->r_skb = NULL;
189 	f->flags = 0;
190 	list_add(&f->head, &t->ffree);
191 }
192 
193 static struct frame *
194 newtframe(struct aoedev *d, struct aoetgt *t)
195 {
196 	struct frame *f;
197 	struct sk_buff *skb;
198 	struct list_head *pos;
199 
200 	if (list_empty(&t->ffree)) {
201 		if (t->falloc >= NSKBPOOLMAX*2)
202 			return NULL;
203 		f = kcalloc(1, sizeof(*f), GFP_ATOMIC);
204 		if (f == NULL)
205 			return NULL;
206 		t->falloc++;
207 		f->t = t;
208 	} else {
209 		pos = t->ffree.next;
210 		list_del(pos);
211 		f = list_entry(pos, struct frame, head);
212 	}
213 
214 	skb = f->skb;
215 	if (skb == NULL) {
216 		f->skb = skb = new_skb(ETH_ZLEN);
217 		if (!skb) {
218 bail:			aoe_freetframe(f);
219 			return NULL;
220 		}
221 	}
222 
223 	if (atomic_read(&skb_shinfo(skb)->dataref) != 1) {
224 		skb = skb_pool_get(d);
225 		if (skb == NULL)
226 			goto bail;
227 		skb_pool_put(d, f->skb);
228 		f->skb = skb;
229 	}
230 
231 	skb->truesize -= skb->data_len;
232 	skb_shinfo(skb)->nr_frags = skb->data_len = 0;
233 	skb_trim(skb, 0);
234 	return f;
235 }
236 
237 static struct frame *
238 newframe(struct aoedev *d)
239 {
240 	struct frame *f;
241 	struct aoetgt *t, **tt;
242 	int totout = 0;
243 	int use_tainted;
244 	int has_untainted;
245 
246 	if (!d->targets || !d->targets[0]) {
247 		printk(KERN_ERR "aoe: NULL TARGETS!\n");
248 		return NULL;
249 	}
250 	tt = d->tgt;	/* last used target */
251 	for (use_tainted = 0, has_untainted = 0;;) {
252 		tt++;
253 		if (tt >= &d->targets[d->ntargets] || !*tt)
254 			tt = d->targets;
255 		t = *tt;
256 		if (!t->taint) {
257 			has_untainted = 1;
258 			totout += t->nout;
259 		}
260 		if (t->nout < t->maxout
261 		&& (use_tainted || !t->taint)
262 		&& t->ifp->nd) {
263 			f = newtframe(d, t);
264 			if (f) {
265 				ifrotate(t);
266 				d->tgt = tt;
267 				return f;
268 			}
269 		}
270 		if (tt == d->tgt) {	/* we've looped and found nada */
271 			if (!use_tainted && !has_untainted)
272 				use_tainted = 1;
273 			else
274 				break;
275 		}
276 	}
277 	if (totout == 0) {
278 		d->kicked++;
279 		d->flags |= DEVFL_KICKME;
280 	}
281 	return NULL;
282 }
283 
284 static void
285 skb_fillup(struct sk_buff *skb, struct bio_vec *bv, ulong off, ulong cnt)
286 {
287 	int frag = 0;
288 	ulong fcnt;
289 loop:
290 	fcnt = bv->bv_len - (off - bv->bv_offset);
291 	if (fcnt > cnt)
292 		fcnt = cnt;
293 	skb_fill_page_desc(skb, frag++, bv->bv_page, off, fcnt);
294 	cnt -= fcnt;
295 	if (cnt <= 0)
296 		return;
297 	bv++;
298 	off = bv->bv_offset;
299 	goto loop;
300 }
301 
302 static void
303 fhash(struct frame *f)
304 {
305 	struct aoedev *d = f->t->d;
306 	u32 n;
307 
308 	n = f->tag % NFACTIVE;
309 	list_add_tail(&f->head, &d->factive[n]);
310 }
311 
312 static void
313 ata_rw_frameinit(struct frame *f)
314 {
315 	struct aoetgt *t;
316 	struct aoe_hdr *h;
317 	struct aoe_atahdr *ah;
318 	struct sk_buff *skb;
319 	char writebit, extbit;
320 
321 	skb = f->skb;
322 	h = (struct aoe_hdr *) skb_mac_header(skb);
323 	ah = (struct aoe_atahdr *) (h + 1);
324 	skb_put(skb, sizeof(*h) + sizeof(*ah));
325 	memset(h, 0, skb->len);
326 
327 	writebit = 0x10;
328 	extbit = 0x4;
329 
330 	t = f->t;
331 	f->tag = aoehdr_atainit(t->d, t, h);
332 	fhash(f);
333 	t->nout++;
334 	f->waited = 0;
335 	f->waited_total = 0;
336 	if (f->buf)
337 		f->lba = f->buf->sector;
338 
339 	/* set up ata header */
340 	ah->scnt = f->bcnt >> 9;
341 	put_lba(ah, f->lba);
342 	if (t->d->flags & DEVFL_EXT) {
343 		ah->aflags |= AOEAFL_EXT;
344 	} else {
345 		extbit = 0;
346 		ah->lba3 &= 0x0f;
347 		ah->lba3 |= 0xe0;	/* LBA bit + obsolete 0xa0 */
348 	}
349 	if (f->buf && bio_data_dir(f->buf->bio) == WRITE) {
350 		skb_fillup(skb, f->bv, f->bv_off, f->bcnt);
351 		ah->aflags |= AOEAFL_WRITE;
352 		skb->len += f->bcnt;
353 		skb->data_len = f->bcnt;
354 		skb->truesize += f->bcnt;
355 		t->wpkts++;
356 	} else {
357 		t->rpkts++;
358 		writebit = 0;
359 	}
360 
361 	ah->cmdstat = ATA_CMD_PIO_READ | writebit | extbit;
362 	skb->dev = t->ifp->nd;
363 }
364 
365 static int
366 aoecmd_ata_rw(struct aoedev *d)
367 {
368 	struct frame *f;
369 	struct buf *buf;
370 	struct aoetgt *t;
371 	struct sk_buff *skb;
372 	struct sk_buff_head queue;
373 	ulong bcnt, fbcnt;
374 
375 	buf = nextbuf(d);
376 	if (buf == NULL)
377 		return 0;
378 	f = newframe(d);
379 	if (f == NULL)
380 		return 0;
381 	t = *d->tgt;
382 	bcnt = d->maxbcnt;
383 	if (bcnt == 0)
384 		bcnt = DEFAULTBCNT;
385 	if (bcnt > buf->resid)
386 		bcnt = buf->resid;
387 	fbcnt = bcnt;
388 	f->bv = buf->bv;
389 	f->bv_off = f->bv->bv_offset + (f->bv->bv_len - buf->bv_resid);
390 	do {
391 		if (fbcnt < buf->bv_resid) {
392 			buf->bv_resid -= fbcnt;
393 			buf->resid -= fbcnt;
394 			break;
395 		}
396 		fbcnt -= buf->bv_resid;
397 		buf->resid -= buf->bv_resid;
398 		if (buf->resid == 0) {
399 			d->ip.buf = NULL;
400 			break;
401 		}
402 		buf->bv++;
403 		buf->bv_resid = buf->bv->bv_len;
404 		WARN_ON(buf->bv_resid == 0);
405 	} while (fbcnt);
406 
407 	/* initialize the headers & frame */
408 	f->buf = buf;
409 	f->bcnt = bcnt;
410 	ata_rw_frameinit(f);
411 
412 	/* mark all tracking fields and load out */
413 	buf->nframesout += 1;
414 	buf->sector += bcnt >> 9;
415 
416 	skb = skb_clone(f->skb, GFP_ATOMIC);
417 	if (skb) {
418 		do_gettimeofday(&f->sent);
419 		f->sent_jiffs = (u32) jiffies;
420 		__skb_queue_head_init(&queue);
421 		__skb_queue_tail(&queue, skb);
422 		aoenet_xmit(&queue);
423 	}
424 	return 1;
425 }
426 
427 /* some callers cannot sleep, and they can call this function,
428  * transmitting the packets later, when interrupts are on
429  */
430 static void
431 aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *queue)
432 {
433 	struct aoe_hdr *h;
434 	struct aoe_cfghdr *ch;
435 	struct sk_buff *skb;
436 	struct net_device *ifp;
437 
438 	rcu_read_lock();
439 	for_each_netdev_rcu(&init_net, ifp) {
440 		dev_hold(ifp);
441 		if (!is_aoe_netif(ifp))
442 			goto cont;
443 
444 		skb = new_skb(sizeof *h + sizeof *ch);
445 		if (skb == NULL) {
446 			printk(KERN_INFO "aoe: skb alloc failure\n");
447 			goto cont;
448 		}
449 		skb_put(skb, sizeof *h + sizeof *ch);
450 		skb->dev = ifp;
451 		__skb_queue_tail(queue, skb);
452 		h = (struct aoe_hdr *) skb_mac_header(skb);
453 		memset(h, 0, sizeof *h + sizeof *ch);
454 
455 		memset(h->dst, 0xff, sizeof h->dst);
456 		memcpy(h->src, ifp->dev_addr, sizeof h->src);
457 		h->type = __constant_cpu_to_be16(ETH_P_AOE);
458 		h->verfl = AOE_HVER;
459 		h->major = cpu_to_be16(aoemajor);
460 		h->minor = aoeminor;
461 		h->cmd = AOECMD_CFG;
462 
463 cont:
464 		dev_put(ifp);
465 	}
466 	rcu_read_unlock();
467 }
468 
469 static void
470 resend(struct aoedev *d, struct frame *f)
471 {
472 	struct sk_buff *skb;
473 	struct sk_buff_head queue;
474 	struct aoe_hdr *h;
475 	struct aoe_atahdr *ah;
476 	struct aoetgt *t;
477 	char buf[128];
478 	u32 n;
479 
480 	t = f->t;
481 	n = newtag(d);
482 	skb = f->skb;
483 	if (ifrotate(t) == NULL) {
484 		/* probably can't happen, but set it up to fail anyway */
485 		pr_info("aoe: resend: no interfaces to rotate to.\n");
486 		ktcomplete(f, NULL);
487 		return;
488 	}
489 	h = (struct aoe_hdr *) skb_mac_header(skb);
490 	ah = (struct aoe_atahdr *) (h+1);
491 
492 	if (!(f->flags & FFL_PROBE)) {
493 		snprintf(buf, sizeof(buf),
494 			"%15s e%ld.%d oldtag=%08x@%08lx newtag=%08x s=%pm d=%pm nout=%d\n",
495 			"retransmit", d->aoemajor, d->aoeminor,
496 			f->tag, jiffies, n,
497 			h->src, h->dst, t->nout);
498 		aoechr_error(buf);
499 	}
500 
501 	f->tag = n;
502 	fhash(f);
503 	h->tag = cpu_to_be32(n);
504 	memcpy(h->dst, t->addr, sizeof h->dst);
505 	memcpy(h->src, t->ifp->nd->dev_addr, sizeof h->src);
506 
507 	skb->dev = t->ifp->nd;
508 	skb = skb_clone(skb, GFP_ATOMIC);
509 	if (skb == NULL)
510 		return;
511 	do_gettimeofday(&f->sent);
512 	f->sent_jiffs = (u32) jiffies;
513 	__skb_queue_head_init(&queue);
514 	__skb_queue_tail(&queue, skb);
515 	aoenet_xmit(&queue);
516 }
517 
518 static int
519 tsince_hr(struct frame *f)
520 {
521 	struct timeval now;
522 	int n;
523 
524 	do_gettimeofday(&now);
525 	n = now.tv_usec - f->sent.tv_usec;
526 	n += (now.tv_sec - f->sent.tv_sec) * USEC_PER_SEC;
527 
528 	if (n < 0)
529 		n = -n;
530 
531 	/* For relatively long periods, use jiffies to avoid
532 	 * discrepancies caused by updates to the system time.
533 	 *
534 	 * On system with HZ of 1000, 32-bits is over 49 days
535 	 * worth of jiffies, or over 71 minutes worth of usecs.
536 	 *
537 	 * Jiffies overflow is handled by subtraction of unsigned ints:
538 	 * (gdb) print (unsigned) 2 - (unsigned) 0xfffffffe
539 	 * $3 = 4
540 	 * (gdb)
541 	 */
542 	if (n > USEC_PER_SEC / 4) {
543 		n = ((u32) jiffies) - f->sent_jiffs;
544 		n *= USEC_PER_SEC / HZ;
545 	}
546 
547 	return n;
548 }
549 
550 static int
551 tsince(u32 tag)
552 {
553 	int n;
554 
555 	n = jiffies & 0xffff;
556 	n -= tag & 0xffff;
557 	if (n < 0)
558 		n += 1<<16;
559 	return jiffies_to_usecs(n + 1);
560 }
561 
562 static struct aoeif *
563 getif(struct aoetgt *t, struct net_device *nd)
564 {
565 	struct aoeif *p, *e;
566 
567 	p = t->ifs;
568 	e = p + NAOEIFS;
569 	for (; p < e; p++)
570 		if (p->nd == nd)
571 			return p;
572 	return NULL;
573 }
574 
575 static void
576 ejectif(struct aoetgt *t, struct aoeif *ifp)
577 {
578 	struct aoeif *e;
579 	struct net_device *nd;
580 	ulong n;
581 
582 	nd = ifp->nd;
583 	e = t->ifs + NAOEIFS - 1;
584 	n = (e - ifp) * sizeof *ifp;
585 	memmove(ifp, ifp+1, n);
586 	e->nd = NULL;
587 	dev_put(nd);
588 }
589 
590 static struct frame *
591 reassign_frame(struct frame *f)
592 {
593 	struct frame *nf;
594 	struct sk_buff *skb;
595 
596 	nf = newframe(f->t->d);
597 	if (!nf)
598 		return NULL;
599 	if (nf->t == f->t) {
600 		aoe_freetframe(nf);
601 		return NULL;
602 	}
603 
604 	skb = nf->skb;
605 	nf->skb = f->skb;
606 	nf->buf = f->buf;
607 	nf->bcnt = f->bcnt;
608 	nf->lba = f->lba;
609 	nf->bv = f->bv;
610 	nf->bv_off = f->bv_off;
611 	nf->waited = 0;
612 	nf->waited_total = f->waited_total;
613 	nf->sent = f->sent;
614 	nf->sent_jiffs = f->sent_jiffs;
615 	f->skb = skb;
616 
617 	return nf;
618 }
619 
620 static void
621 probe(struct aoetgt *t)
622 {
623 	struct aoedev *d;
624 	struct frame *f;
625 	struct sk_buff *skb;
626 	struct sk_buff_head queue;
627 	size_t n, m;
628 	int frag;
629 
630 	d = t->d;
631 	f = newtframe(d, t);
632 	if (!f) {
633 		pr_err("%s %pm for e%ld.%d: %s\n",
634 			"aoe: cannot probe remote address",
635 			t->addr,
636 			(long) d->aoemajor, d->aoeminor,
637 			"no frame available");
638 		return;
639 	}
640 	f->flags |= FFL_PROBE;
641 	ifrotate(t);
642 	f->bcnt = t->d->maxbcnt ? t->d->maxbcnt : DEFAULTBCNT;
643 	ata_rw_frameinit(f);
644 	skb = f->skb;
645 	for (frag = 0, n = f->bcnt; n > 0; ++frag, n -= m) {
646 		if (n < PAGE_SIZE)
647 			m = n;
648 		else
649 			m = PAGE_SIZE;
650 		skb_fill_page_desc(skb, frag, empty_page, 0, m);
651 	}
652 	skb->len += f->bcnt;
653 	skb->data_len = f->bcnt;
654 	skb->truesize += f->bcnt;
655 
656 	skb = skb_clone(f->skb, GFP_ATOMIC);
657 	if (skb) {
658 		do_gettimeofday(&f->sent);
659 		f->sent_jiffs = (u32) jiffies;
660 		__skb_queue_head_init(&queue);
661 		__skb_queue_tail(&queue, skb);
662 		aoenet_xmit(&queue);
663 	}
664 }
665 
666 static long
667 rto(struct aoedev *d)
668 {
669 	long t;
670 
671 	t = 2 * d->rttavg >> RTTSCALE;
672 	t += 8 * d->rttdev >> RTTDSCALE;
673 	if (t == 0)
674 		t = 1;
675 
676 	return t;
677 }
678 
679 static void
680 rexmit_deferred(struct aoedev *d)
681 {
682 	struct aoetgt *t;
683 	struct frame *f;
684 	struct frame *nf;
685 	struct list_head *pos, *nx, *head;
686 	int since;
687 	int untainted;
688 
689 	count_targets(d, &untainted);
690 
691 	head = &d->rexmitq;
692 	list_for_each_safe(pos, nx, head) {
693 		f = list_entry(pos, struct frame, head);
694 		t = f->t;
695 		if (t->taint) {
696 			if (!(f->flags & FFL_PROBE)) {
697 				nf = reassign_frame(f);
698 				if (nf) {
699 					if (t->nout_probes == 0
700 					&& untainted > 0) {
701 						probe(t);
702 						t->nout_probes++;
703 					}
704 					list_replace(&f->head, &nf->head);
705 					pos = &nf->head;
706 					aoe_freetframe(f);
707 					f = nf;
708 					t = f->t;
709 				}
710 			} else if (untainted < 1) {
711 				/* don't probe w/o other untainted aoetgts */
712 				goto stop_probe;
713 			} else if (tsince_hr(f) < t->taint * rto(d)) {
714 				/* reprobe slowly when taint is high */
715 				continue;
716 			}
717 		} else if (f->flags & FFL_PROBE) {
718 stop_probe:		/* don't probe untainted aoetgts */
719 			list_del(pos);
720 			aoe_freetframe(f);
721 			/* leaving d->kicked, because this is routine */
722 			f->t->d->flags |= DEVFL_KICKME;
723 			continue;
724 		}
725 		if (t->nout >= t->maxout)
726 			continue;
727 		list_del(pos);
728 		t->nout++;
729 		if (f->flags & FFL_PROBE)
730 			t->nout_probes++;
731 		since = tsince_hr(f);
732 		f->waited += since;
733 		f->waited_total += since;
734 		resend(d, f);
735 	}
736 }
737 
738 /* An aoetgt accumulates demerits quickly, and successful
739  * probing redeems the aoetgt slowly.
740  */
741 static void
742 scorn(struct aoetgt *t)
743 {
744 	int n;
745 
746 	n = t->taint++;
747 	t->taint += t->taint * 2;
748 	if (n > t->taint)
749 		t->taint = n;
750 	if (t->taint > MAX_TAINT)
751 		t->taint = MAX_TAINT;
752 }
753 
754 static int
755 count_targets(struct aoedev *d, int *untainted)
756 {
757 	int i, good;
758 
759 	for (i = good = 0; i < d->ntargets && d->targets[i]; ++i)
760 		if (d->targets[i]->taint == 0)
761 			good++;
762 
763 	if (untainted)
764 		*untainted = good;
765 	return i;
766 }
767 
768 static void
769 rexmit_timer(ulong vp)
770 {
771 	struct aoedev *d;
772 	struct aoetgt *t;
773 	struct aoeif *ifp;
774 	struct frame *f;
775 	struct list_head *head, *pos, *nx;
776 	LIST_HEAD(flist);
777 	register long timeout;
778 	ulong flags, n;
779 	int i;
780 	int utgts;	/* number of aoetgt descriptors (not slots) */
781 	int since;
782 
783 	d = (struct aoedev *) vp;
784 
785 	spin_lock_irqsave(&d->lock, flags);
786 
787 	/* timeout based on observed timings and variations */
788 	timeout = rto(d);
789 
790 	utgts = count_targets(d, NULL);
791 
792 	if (d->flags & DEVFL_TKILL) {
793 		spin_unlock_irqrestore(&d->lock, flags);
794 		return;
795 	}
796 
797 	/* collect all frames to rexmit into flist */
798 	for (i = 0; i < NFACTIVE; i++) {
799 		head = &d->factive[i];
800 		list_for_each_safe(pos, nx, head) {
801 			f = list_entry(pos, struct frame, head);
802 			if (tsince_hr(f) < timeout)
803 				break;	/* end of expired frames */
804 			/* move to flist for later processing */
805 			list_move_tail(pos, &flist);
806 		}
807 	}
808 
809 	/* process expired frames */
810 	while (!list_empty(&flist)) {
811 		pos = flist.next;
812 		f = list_entry(pos, struct frame, head);
813 		since = tsince_hr(f);
814 		n = f->waited_total + since;
815 		n /= USEC_PER_SEC;
816 		if (aoe_deadsecs
817 		&& n > aoe_deadsecs
818 		&& !(f->flags & FFL_PROBE)) {
819 			/* Waited too long.  Device failure.
820 			 * Hang all frames on first hash bucket for downdev
821 			 * to clean up.
822 			 */
823 			list_splice(&flist, &d->factive[0]);
824 			aoedev_downdev(d);
825 			goto out;
826 		}
827 
828 		t = f->t;
829 		n = f->waited + since;
830 		n /= USEC_PER_SEC;
831 		if (aoe_deadsecs && utgts > 0
832 		&& (n > aoe_deadsecs / utgts || n > HARD_SCORN_SECS))
833 			scorn(t); /* avoid this target */
834 
835 		if (t->maxout != 1) {
836 			t->ssthresh = t->maxout / 2;
837 			t->maxout = 1;
838 		}
839 
840 		if (f->flags & FFL_PROBE) {
841 			t->nout_probes--;
842 		} else {
843 			ifp = getif(t, f->skb->dev);
844 			if (ifp && ++ifp->lost > (t->nframes << 1)
845 			&& (ifp != t->ifs || t->ifs[1].nd)) {
846 				ejectif(t, ifp);
847 				ifp = NULL;
848 			}
849 		}
850 		list_move_tail(pos, &d->rexmitq);
851 		t->nout--;
852 	}
853 	rexmit_deferred(d);
854 
855 out:
856 	if ((d->flags & DEVFL_KICKME) && d->blkq) {
857 		d->flags &= ~DEVFL_KICKME;
858 		d->blkq->request_fn(d->blkq);
859 	}
860 
861 	d->timer.expires = jiffies + TIMERTICK;
862 	add_timer(&d->timer);
863 
864 	spin_unlock_irqrestore(&d->lock, flags);
865 }
866 
867 static unsigned long
868 rqbiocnt(struct request *r)
869 {
870 	struct bio *bio;
871 	unsigned long n = 0;
872 
873 	__rq_for_each_bio(bio, r)
874 		n++;
875 	return n;
876 }
877 
878 /* This can be removed if we are certain that no users of the block
879  * layer will ever use zero-count pages in bios.  Otherwise we have to
880  * protect against the put_page sometimes done by the network layer.
881  *
882  * See http://oss.sgi.com/archives/xfs/2007-01/msg00594.html for
883  * discussion.
884  *
885  * We cannot use get_page in the workaround, because it insists on a
886  * positive page count as a precondition.  So we use _count directly.
887  */
888 static void
889 bio_pageinc(struct bio *bio)
890 {
891 	struct bio_vec *bv;
892 	struct page *page;
893 	int i;
894 
895 	bio_for_each_segment(bv, bio, i) {
896 		page = bv->bv_page;
897 		/* Non-zero page count for non-head members of
898 		 * compound pages is no longer allowed by the kernel,
899 		 * but this has never been seen here.
900 		 */
901 		if (unlikely(PageCompound(page)))
902 			if (compound_trans_head(page) != page) {
903 				pr_crit("page tail used for block I/O\n");
904 				BUG();
905 			}
906 		atomic_inc(&page->_count);
907 	}
908 }
909 
910 static void
911 bio_pagedec(struct bio *bio)
912 {
913 	struct bio_vec *bv;
914 	int i;
915 
916 	bio_for_each_segment(bv, bio, i)
917 		atomic_dec(&bv->bv_page->_count);
918 }
919 
920 static void
921 bufinit(struct buf *buf, struct request *rq, struct bio *bio)
922 {
923 	struct bio_vec *bv;
924 
925 	memset(buf, 0, sizeof(*buf));
926 	buf->rq = rq;
927 	buf->bio = bio;
928 	buf->resid = bio->bi_size;
929 	buf->sector = bio->bi_sector;
930 	bio_pageinc(bio);
931 	buf->bv = bv = &bio->bi_io_vec[bio->bi_idx];
932 	buf->bv_resid = bv->bv_len;
933 	WARN_ON(buf->bv_resid == 0);
934 }
935 
936 static struct buf *
937 nextbuf(struct aoedev *d)
938 {
939 	struct request *rq;
940 	struct request_queue *q;
941 	struct buf *buf;
942 	struct bio *bio;
943 
944 	q = d->blkq;
945 	if (q == NULL)
946 		return NULL;	/* initializing */
947 	if (d->ip.buf)
948 		return d->ip.buf;
949 	rq = d->ip.rq;
950 	if (rq == NULL) {
951 		rq = blk_peek_request(q);
952 		if (rq == NULL)
953 			return NULL;
954 		blk_start_request(rq);
955 		d->ip.rq = rq;
956 		d->ip.nxbio = rq->bio;
957 		rq->special = (void *) rqbiocnt(rq);
958 	}
959 	buf = mempool_alloc(d->bufpool, GFP_ATOMIC);
960 	if (buf == NULL) {
961 		pr_err("aoe: nextbuf: unable to mempool_alloc!\n");
962 		return NULL;
963 	}
964 	bio = d->ip.nxbio;
965 	bufinit(buf, rq, bio);
966 	bio = bio->bi_next;
967 	d->ip.nxbio = bio;
968 	if (bio == NULL)
969 		d->ip.rq = NULL;
970 	return d->ip.buf = buf;
971 }
972 
973 /* enters with d->lock held */
974 void
975 aoecmd_work(struct aoedev *d)
976 {
977 	rexmit_deferred(d);
978 	while (aoecmd_ata_rw(d))
979 		;
980 }
981 
982 /* this function performs work that has been deferred until sleeping is OK
983  */
984 void
985 aoecmd_sleepwork(struct work_struct *work)
986 {
987 	struct aoedev *d = container_of(work, struct aoedev, work);
988 	struct block_device *bd;
989 	u64 ssize;
990 
991 	if (d->flags & DEVFL_GDALLOC)
992 		aoeblk_gdalloc(d);
993 
994 	if (d->flags & DEVFL_NEWSIZE) {
995 		ssize = get_capacity(d->gd);
996 		bd = bdget_disk(d->gd, 0);
997 		if (bd) {
998 			mutex_lock(&bd->bd_inode->i_mutex);
999 			i_size_write(bd->bd_inode, (loff_t)ssize<<9);
1000 			mutex_unlock(&bd->bd_inode->i_mutex);
1001 			bdput(bd);
1002 		}
1003 		spin_lock_irq(&d->lock);
1004 		d->flags |= DEVFL_UP;
1005 		d->flags &= ~DEVFL_NEWSIZE;
1006 		spin_unlock_irq(&d->lock);
1007 	}
1008 }
1009 
1010 static void
1011 ata_ident_fixstring(u16 *id, int ns)
1012 {
1013 	u16 s;
1014 
1015 	while (ns-- > 0) {
1016 		s = *id;
1017 		*id++ = s >> 8 | s << 8;
1018 	}
1019 }
1020 
1021 static void
1022 ataid_complete(struct aoedev *d, struct aoetgt *t, unsigned char *id)
1023 {
1024 	u64 ssize;
1025 	u16 n;
1026 
1027 	/* word 83: command set supported */
1028 	n = get_unaligned_le16(&id[83 << 1]);
1029 
1030 	/* word 86: command set/feature enabled */
1031 	n |= get_unaligned_le16(&id[86 << 1]);
1032 
1033 	if (n & (1<<10)) {	/* bit 10: LBA 48 */
1034 		d->flags |= DEVFL_EXT;
1035 
1036 		/* word 100: number lba48 sectors */
1037 		ssize = get_unaligned_le64(&id[100 << 1]);
1038 
1039 		/* set as in ide-disk.c:init_idedisk_capacity */
1040 		d->geo.cylinders = ssize;
1041 		d->geo.cylinders /= (255 * 63);
1042 		d->geo.heads = 255;
1043 		d->geo.sectors = 63;
1044 	} else {
1045 		d->flags &= ~DEVFL_EXT;
1046 
1047 		/* number lba28 sectors */
1048 		ssize = get_unaligned_le32(&id[60 << 1]);
1049 
1050 		/* NOTE: obsolete in ATA 6 */
1051 		d->geo.cylinders = get_unaligned_le16(&id[54 << 1]);
1052 		d->geo.heads = get_unaligned_le16(&id[55 << 1]);
1053 		d->geo.sectors = get_unaligned_le16(&id[56 << 1]);
1054 	}
1055 
1056 	ata_ident_fixstring((u16 *) &id[10<<1], 10);	/* serial */
1057 	ata_ident_fixstring((u16 *) &id[23<<1], 4);	/* firmware */
1058 	ata_ident_fixstring((u16 *) &id[27<<1], 20);	/* model */
1059 	memcpy(d->ident, id, sizeof(d->ident));
1060 
1061 	if (d->ssize != ssize)
1062 		printk(KERN_INFO
1063 			"aoe: %pm e%ld.%d v%04x has %llu sectors\n",
1064 			t->addr,
1065 			d->aoemajor, d->aoeminor,
1066 			d->fw_ver, (long long)ssize);
1067 	d->ssize = ssize;
1068 	d->geo.start = 0;
1069 	if (d->flags & (DEVFL_GDALLOC|DEVFL_NEWSIZE))
1070 		return;
1071 	if (d->gd != NULL) {
1072 		set_capacity(d->gd, ssize);
1073 		d->flags |= DEVFL_NEWSIZE;
1074 	} else
1075 		d->flags |= DEVFL_GDALLOC;
1076 	schedule_work(&d->work);
1077 }
1078 
1079 static void
1080 calc_rttavg(struct aoedev *d, struct aoetgt *t, int rtt)
1081 {
1082 	register long n;
1083 
1084 	n = rtt;
1085 
1086 	/* cf. Congestion Avoidance and Control, Jacobson & Karels, 1988 */
1087 	n -= d->rttavg >> RTTSCALE;
1088 	d->rttavg += n;
1089 	if (n < 0)
1090 		n = -n;
1091 	n -= d->rttdev >> RTTDSCALE;
1092 	d->rttdev += n;
1093 
1094 	if (!t || t->maxout >= t->nframes)
1095 		return;
1096 	if (t->maxout < t->ssthresh)
1097 		t->maxout += 1;
1098 	else if (t->nout == t->maxout && t->next_cwnd-- == 0) {
1099 		t->maxout += 1;
1100 		t->next_cwnd = t->maxout;
1101 	}
1102 }
1103 
1104 static struct aoetgt *
1105 gettgt(struct aoedev *d, char *addr)
1106 {
1107 	struct aoetgt **t, **e;
1108 
1109 	t = d->targets;
1110 	e = t + d->ntargets;
1111 	for (; t < e && *t; t++)
1112 		if (memcmp((*t)->addr, addr, sizeof((*t)->addr)) == 0)
1113 			return *t;
1114 	return NULL;
1115 }
1116 
1117 static void
1118 bvcpy(struct bio_vec *bv, ulong off, struct sk_buff *skb, long cnt)
1119 {
1120 	ulong fcnt;
1121 	char *p;
1122 	int soff = 0;
1123 loop:
1124 	fcnt = bv->bv_len - (off - bv->bv_offset);
1125 	if (fcnt > cnt)
1126 		fcnt = cnt;
1127 	p = page_address(bv->bv_page) + off;
1128 	skb_copy_bits(skb, soff, p, fcnt);
1129 	soff += fcnt;
1130 	cnt -= fcnt;
1131 	if (cnt <= 0)
1132 		return;
1133 	bv++;
1134 	off = bv->bv_offset;
1135 	goto loop;
1136 }
1137 
1138 void
1139 aoe_end_request(struct aoedev *d, struct request *rq, int fastfail)
1140 {
1141 	struct bio *bio;
1142 	int bok;
1143 	struct request_queue *q;
1144 
1145 	q = d->blkq;
1146 	if (rq == d->ip.rq)
1147 		d->ip.rq = NULL;
1148 	do {
1149 		bio = rq->bio;
1150 		bok = !fastfail && test_bit(BIO_UPTODATE, &bio->bi_flags);
1151 	} while (__blk_end_request(rq, bok ? 0 : -EIO, bio->bi_size));
1152 
1153 	/* cf. http://lkml.org/lkml/2006/10/31/28 */
1154 	if (!fastfail)
1155 		__blk_run_queue(q);
1156 }
1157 
1158 static void
1159 aoe_end_buf(struct aoedev *d, struct buf *buf)
1160 {
1161 	struct request *rq;
1162 	unsigned long n;
1163 
1164 	if (buf == d->ip.buf)
1165 		d->ip.buf = NULL;
1166 	rq = buf->rq;
1167 	bio_pagedec(buf->bio);
1168 	mempool_free(buf, d->bufpool);
1169 	n = (unsigned long) rq->special;
1170 	rq->special = (void *) --n;
1171 	if (n == 0)
1172 		aoe_end_request(d, rq, 0);
1173 }
1174 
1175 static void
1176 ktiocomplete(struct frame *f)
1177 {
1178 	struct aoe_hdr *hin, *hout;
1179 	struct aoe_atahdr *ahin, *ahout;
1180 	struct buf *buf;
1181 	struct sk_buff *skb;
1182 	struct aoetgt *t;
1183 	struct aoeif *ifp;
1184 	struct aoedev *d;
1185 	long n;
1186 	int untainted;
1187 
1188 	if (f == NULL)
1189 		return;
1190 
1191 	t = f->t;
1192 	d = t->d;
1193 	skb = f->r_skb;
1194 	buf = f->buf;
1195 	if (f->flags & FFL_PROBE)
1196 		goto out;
1197 	if (!skb)		/* just fail the buf. */
1198 		goto noskb;
1199 
1200 	hout = (struct aoe_hdr *) skb_mac_header(f->skb);
1201 	ahout = (struct aoe_atahdr *) (hout+1);
1202 
1203 	hin = (struct aoe_hdr *) skb->data;
1204 	skb_pull(skb, sizeof(*hin));
1205 	ahin = (struct aoe_atahdr *) skb->data;
1206 	skb_pull(skb, sizeof(*ahin));
1207 	if (ahin->cmdstat & 0xa9) {	/* these bits cleared on success */
1208 		pr_err("aoe: ata error cmd=%2.2Xh stat=%2.2Xh from e%ld.%d\n",
1209 			ahout->cmdstat, ahin->cmdstat,
1210 			d->aoemajor, d->aoeminor);
1211 noskb:		if (buf)
1212 			clear_bit(BIO_UPTODATE, &buf->bio->bi_flags);
1213 		goto out;
1214 	}
1215 
1216 	n = ahout->scnt << 9;
1217 	switch (ahout->cmdstat) {
1218 	case ATA_CMD_PIO_READ:
1219 	case ATA_CMD_PIO_READ_EXT:
1220 		if (skb->len < n) {
1221 			pr_err("%s e%ld.%d.  skb->len=%d need=%ld\n",
1222 				"aoe: runt data size in read from",
1223 				(long) d->aoemajor, d->aoeminor,
1224 			       skb->len, n);
1225 			clear_bit(BIO_UPTODATE, &buf->bio->bi_flags);
1226 			break;
1227 		}
1228 		bvcpy(f->bv, f->bv_off, skb, n);
1229 	case ATA_CMD_PIO_WRITE:
1230 	case ATA_CMD_PIO_WRITE_EXT:
1231 		spin_lock_irq(&d->lock);
1232 		ifp = getif(t, skb->dev);
1233 		if (ifp)
1234 			ifp->lost = 0;
1235 		spin_unlock_irq(&d->lock);
1236 		break;
1237 	case ATA_CMD_ID_ATA:
1238 		if (skb->len < 512) {
1239 			pr_info("%s e%ld.%d.  skb->len=%d need=512\n",
1240 				"aoe: runt data size in ataid from",
1241 				(long) d->aoemajor, d->aoeminor,
1242 				skb->len);
1243 			break;
1244 		}
1245 		if (skb_linearize(skb))
1246 			break;
1247 		spin_lock_irq(&d->lock);
1248 		ataid_complete(d, t, skb->data);
1249 		spin_unlock_irq(&d->lock);
1250 		break;
1251 	default:
1252 		pr_info("aoe: unrecognized ata command %2.2Xh for %d.%d\n",
1253 			ahout->cmdstat,
1254 			be16_to_cpu(get_unaligned(&hin->major)),
1255 			hin->minor);
1256 	}
1257 out:
1258 	spin_lock_irq(&d->lock);
1259 	if (t->taint > 0
1260 	&& --t->taint > 0
1261 	&& t->nout_probes == 0) {
1262 		count_targets(d, &untainted);
1263 		if (untainted > 0) {
1264 			probe(t);
1265 			t->nout_probes++;
1266 		}
1267 	}
1268 
1269 	aoe_freetframe(f);
1270 
1271 	if (buf && --buf->nframesout == 0 && buf->resid == 0)
1272 		aoe_end_buf(d, buf);
1273 
1274 	spin_unlock_irq(&d->lock);
1275 	aoedev_put(d);
1276 	dev_kfree_skb(skb);
1277 }
1278 
1279 /* Enters with iocq.lock held.
1280  * Returns true iff responses needing processing remain.
1281  */
1282 static int
1283 ktio(void)
1284 {
1285 	struct frame *f;
1286 	struct list_head *pos;
1287 	int i;
1288 
1289 	for (i = 0; ; ++i) {
1290 		if (i == MAXIOC)
1291 			return 1;
1292 		if (list_empty(&iocq.head))
1293 			return 0;
1294 		pos = iocq.head.next;
1295 		list_del(pos);
1296 		spin_unlock_irq(&iocq.lock);
1297 		f = list_entry(pos, struct frame, head);
1298 		ktiocomplete(f);
1299 		spin_lock_irq(&iocq.lock);
1300 	}
1301 }
1302 
1303 static int
1304 kthread(void *vp)
1305 {
1306 	struct ktstate *k;
1307 	DECLARE_WAITQUEUE(wait, current);
1308 	int more;
1309 
1310 	k = vp;
1311 	current->flags |= PF_NOFREEZE;
1312 	set_user_nice(current, -10);
1313 	complete(&k->rendez);	/* tell spawner we're running */
1314 	do {
1315 		spin_lock_irq(k->lock);
1316 		more = k->fn();
1317 		if (!more) {
1318 			add_wait_queue(k->waitq, &wait);
1319 			__set_current_state(TASK_INTERRUPTIBLE);
1320 		}
1321 		spin_unlock_irq(k->lock);
1322 		if (!more) {
1323 			schedule();
1324 			remove_wait_queue(k->waitq, &wait);
1325 		} else
1326 			cond_resched();
1327 	} while (!kthread_should_stop());
1328 	complete(&k->rendez);	/* tell spawner we're stopping */
1329 	return 0;
1330 }
1331 
1332 void
1333 aoe_ktstop(struct ktstate *k)
1334 {
1335 	kthread_stop(k->task);
1336 	wait_for_completion(&k->rendez);
1337 }
1338 
1339 int
1340 aoe_ktstart(struct ktstate *k)
1341 {
1342 	struct task_struct *task;
1343 
1344 	init_completion(&k->rendez);
1345 	task = kthread_run(kthread, k, k->name);
1346 	if (task == NULL || IS_ERR(task))
1347 		return -ENOMEM;
1348 	k->task = task;
1349 	wait_for_completion(&k->rendez); /* allow kthread to start */
1350 	init_completion(&k->rendez);	/* for waiting for exit later */
1351 	return 0;
1352 }
1353 
1354 /* pass it off to kthreads for processing */
1355 static void
1356 ktcomplete(struct frame *f, struct sk_buff *skb)
1357 {
1358 	ulong flags;
1359 
1360 	f->r_skb = skb;
1361 	spin_lock_irqsave(&iocq.lock, flags);
1362 	list_add_tail(&f->head, &iocq.head);
1363 	spin_unlock_irqrestore(&iocq.lock, flags);
1364 	wake_up(&ktiowq);
1365 }
1366 
1367 struct sk_buff *
1368 aoecmd_ata_rsp(struct sk_buff *skb)
1369 {
1370 	struct aoedev *d;
1371 	struct aoe_hdr *h;
1372 	struct frame *f;
1373 	u32 n;
1374 	ulong flags;
1375 	char ebuf[128];
1376 	u16 aoemajor;
1377 
1378 	h = (struct aoe_hdr *) skb->data;
1379 	aoemajor = be16_to_cpu(get_unaligned(&h->major));
1380 	d = aoedev_by_aoeaddr(aoemajor, h->minor, 0);
1381 	if (d == NULL) {
1382 		snprintf(ebuf, sizeof ebuf, "aoecmd_ata_rsp: ata response "
1383 			"for unknown device %d.%d\n",
1384 			aoemajor, h->minor);
1385 		aoechr_error(ebuf);
1386 		return skb;
1387 	}
1388 
1389 	spin_lock_irqsave(&d->lock, flags);
1390 
1391 	n = be32_to_cpu(get_unaligned(&h->tag));
1392 	f = getframe(d, n);
1393 	if (f) {
1394 		calc_rttavg(d, f->t, tsince_hr(f));
1395 		f->t->nout--;
1396 		if (f->flags & FFL_PROBE)
1397 			f->t->nout_probes--;
1398 	} else {
1399 		f = getframe_deferred(d, n);
1400 		if (f) {
1401 			calc_rttavg(d, NULL, tsince_hr(f));
1402 		} else {
1403 			calc_rttavg(d, NULL, tsince(n));
1404 			spin_unlock_irqrestore(&d->lock, flags);
1405 			aoedev_put(d);
1406 			snprintf(ebuf, sizeof(ebuf),
1407 				 "%15s e%d.%d    tag=%08x@%08lx s=%pm d=%pm\n",
1408 				 "unexpected rsp",
1409 				 get_unaligned_be16(&h->major),
1410 				 h->minor,
1411 				 get_unaligned_be32(&h->tag),
1412 				 jiffies,
1413 				 h->src,
1414 				 h->dst);
1415 			aoechr_error(ebuf);
1416 			return skb;
1417 		}
1418 	}
1419 	aoecmd_work(d);
1420 
1421 	spin_unlock_irqrestore(&d->lock, flags);
1422 
1423 	ktcomplete(f, skb);
1424 
1425 	/*
1426 	 * Note here that we do not perform an aoedev_put, as we are
1427 	 * leaving this reference for the ktio to release.
1428 	 */
1429 	return NULL;
1430 }
1431 
1432 void
1433 aoecmd_cfg(ushort aoemajor, unsigned char aoeminor)
1434 {
1435 	struct sk_buff_head queue;
1436 
1437 	__skb_queue_head_init(&queue);
1438 	aoecmd_cfg_pkts(aoemajor, aoeminor, &queue);
1439 	aoenet_xmit(&queue);
1440 }
1441 
1442 struct sk_buff *
1443 aoecmd_ata_id(struct aoedev *d)
1444 {
1445 	struct aoe_hdr *h;
1446 	struct aoe_atahdr *ah;
1447 	struct frame *f;
1448 	struct sk_buff *skb;
1449 	struct aoetgt *t;
1450 
1451 	f = newframe(d);
1452 	if (f == NULL)
1453 		return NULL;
1454 
1455 	t = *d->tgt;
1456 
1457 	/* initialize the headers & frame */
1458 	skb = f->skb;
1459 	h = (struct aoe_hdr *) skb_mac_header(skb);
1460 	ah = (struct aoe_atahdr *) (h+1);
1461 	skb_put(skb, sizeof *h + sizeof *ah);
1462 	memset(h, 0, skb->len);
1463 	f->tag = aoehdr_atainit(d, t, h);
1464 	fhash(f);
1465 	t->nout++;
1466 	f->waited = 0;
1467 	f->waited_total = 0;
1468 
1469 	/* set up ata header */
1470 	ah->scnt = 1;
1471 	ah->cmdstat = ATA_CMD_ID_ATA;
1472 	ah->lba3 = 0xa0;
1473 
1474 	skb->dev = t->ifp->nd;
1475 
1476 	d->rttavg = RTTAVG_INIT;
1477 	d->rttdev = RTTDEV_INIT;
1478 	d->timer.function = rexmit_timer;
1479 
1480 	skb = skb_clone(skb, GFP_ATOMIC);
1481 	if (skb) {
1482 		do_gettimeofday(&f->sent);
1483 		f->sent_jiffs = (u32) jiffies;
1484 	}
1485 
1486 	return skb;
1487 }
1488 
1489 static struct aoetgt **
1490 grow_targets(struct aoedev *d)
1491 {
1492 	ulong oldn, newn;
1493 	struct aoetgt **tt;
1494 
1495 	oldn = d->ntargets;
1496 	newn = oldn * 2;
1497 	tt = kcalloc(newn, sizeof(*d->targets), GFP_ATOMIC);
1498 	if (!tt)
1499 		return NULL;
1500 	memmove(tt, d->targets, sizeof(*d->targets) * oldn);
1501 	d->tgt = tt + (d->tgt - d->targets);
1502 	kfree(d->targets);
1503 	d->targets = tt;
1504 	d->ntargets = newn;
1505 
1506 	return &d->targets[oldn];
1507 }
1508 
1509 static struct aoetgt *
1510 addtgt(struct aoedev *d, char *addr, ulong nframes)
1511 {
1512 	struct aoetgt *t, **tt, **te;
1513 
1514 	tt = d->targets;
1515 	te = tt + d->ntargets;
1516 	for (; tt < te && *tt; tt++)
1517 		;
1518 
1519 	if (tt == te) {
1520 		tt = grow_targets(d);
1521 		if (!tt)
1522 			goto nomem;
1523 	}
1524 	t = kzalloc(sizeof(*t), GFP_ATOMIC);
1525 	if (!t)
1526 		goto nomem;
1527 	t->nframes = nframes;
1528 	t->d = d;
1529 	memcpy(t->addr, addr, sizeof t->addr);
1530 	t->ifp = t->ifs;
1531 	aoecmd_wreset(t);
1532 	t->maxout = t->nframes / 2;
1533 	INIT_LIST_HEAD(&t->ffree);
1534 	return *tt = t;
1535 
1536  nomem:
1537 	pr_info("aoe: cannot allocate memory to add target\n");
1538 	return NULL;
1539 }
1540 
1541 static void
1542 setdbcnt(struct aoedev *d)
1543 {
1544 	struct aoetgt **t, **e;
1545 	int bcnt = 0;
1546 
1547 	t = d->targets;
1548 	e = t + d->ntargets;
1549 	for (; t < e && *t; t++)
1550 		if (bcnt == 0 || bcnt > (*t)->minbcnt)
1551 			bcnt = (*t)->minbcnt;
1552 	if (bcnt != d->maxbcnt) {
1553 		d->maxbcnt = bcnt;
1554 		pr_info("aoe: e%ld.%d: setting %d byte data frames\n",
1555 			d->aoemajor, d->aoeminor, bcnt);
1556 	}
1557 }
1558 
1559 static void
1560 setifbcnt(struct aoetgt *t, struct net_device *nd, int bcnt)
1561 {
1562 	struct aoedev *d;
1563 	struct aoeif *p, *e;
1564 	int minbcnt;
1565 
1566 	d = t->d;
1567 	minbcnt = bcnt;
1568 	p = t->ifs;
1569 	e = p + NAOEIFS;
1570 	for (; p < e; p++) {
1571 		if (p->nd == NULL)
1572 			break;		/* end of the valid interfaces */
1573 		if (p->nd == nd) {
1574 			p->bcnt = bcnt;	/* we're updating */
1575 			nd = NULL;
1576 		} else if (minbcnt > p->bcnt)
1577 			minbcnt = p->bcnt; /* find the min interface */
1578 	}
1579 	if (nd) {
1580 		if (p == e) {
1581 			pr_err("aoe: device setifbcnt failure; too many interfaces.\n");
1582 			return;
1583 		}
1584 		dev_hold(nd);
1585 		p->nd = nd;
1586 		p->bcnt = bcnt;
1587 	}
1588 	t->minbcnt = minbcnt;
1589 	setdbcnt(d);
1590 }
1591 
1592 void
1593 aoecmd_cfg_rsp(struct sk_buff *skb)
1594 {
1595 	struct aoedev *d;
1596 	struct aoe_hdr *h;
1597 	struct aoe_cfghdr *ch;
1598 	struct aoetgt *t;
1599 	ulong flags, aoemajor;
1600 	struct sk_buff *sl;
1601 	struct sk_buff_head queue;
1602 	u16 n;
1603 
1604 	sl = NULL;
1605 	h = (struct aoe_hdr *) skb_mac_header(skb);
1606 	ch = (struct aoe_cfghdr *) (h+1);
1607 
1608 	/*
1609 	 * Enough people have their dip switches set backwards to
1610 	 * warrant a loud message for this special case.
1611 	 */
1612 	aoemajor = get_unaligned_be16(&h->major);
1613 	if (aoemajor == 0xfff) {
1614 		printk(KERN_ERR "aoe: Warning: shelf address is all ones.  "
1615 			"Check shelf dip switches.\n");
1616 		return;
1617 	}
1618 	if (aoemajor == 0xffff) {
1619 		pr_info("aoe: e%ld.%d: broadcast shelf number invalid\n",
1620 			aoemajor, (int) h->minor);
1621 		return;
1622 	}
1623 	if (h->minor == 0xff) {
1624 		pr_info("aoe: e%ld.%d: broadcast slot number invalid\n",
1625 			aoemajor, (int) h->minor);
1626 		return;
1627 	}
1628 
1629 	n = be16_to_cpu(ch->bufcnt);
1630 	if (n > aoe_maxout)	/* keep it reasonable */
1631 		n = aoe_maxout;
1632 
1633 	d = aoedev_by_aoeaddr(aoemajor, h->minor, 1);
1634 	if (d == NULL) {
1635 		pr_info("aoe: device allocation failure\n");
1636 		return;
1637 	}
1638 
1639 	spin_lock_irqsave(&d->lock, flags);
1640 
1641 	t = gettgt(d, h->src);
1642 	if (t) {
1643 		t->nframes = n;
1644 		if (n < t->maxout)
1645 			aoecmd_wreset(t);
1646 	} else {
1647 		t = addtgt(d, h->src, n);
1648 		if (!t)
1649 			goto bail;
1650 	}
1651 	n = skb->dev->mtu;
1652 	n -= sizeof(struct aoe_hdr) + sizeof(struct aoe_atahdr);
1653 	n /= 512;
1654 	if (n > ch->scnt)
1655 		n = ch->scnt;
1656 	n = n ? n * 512 : DEFAULTBCNT;
1657 	setifbcnt(t, skb->dev, n);
1658 
1659 	/* don't change users' perspective */
1660 	if (d->nopen == 0) {
1661 		d->fw_ver = be16_to_cpu(ch->fwver);
1662 		sl = aoecmd_ata_id(d);
1663 	}
1664 bail:
1665 	spin_unlock_irqrestore(&d->lock, flags);
1666 	aoedev_put(d);
1667 	if (sl) {
1668 		__skb_queue_head_init(&queue);
1669 		__skb_queue_tail(&queue, sl);
1670 		aoenet_xmit(&queue);
1671 	}
1672 }
1673 
1674 void
1675 aoecmd_wreset(struct aoetgt *t)
1676 {
1677 	t->maxout = 1;
1678 	t->ssthresh = t->nframes / 2;
1679 	t->next_cwnd = t->nframes;
1680 }
1681 
1682 void
1683 aoecmd_cleanslate(struct aoedev *d)
1684 {
1685 	struct aoetgt **t, **te;
1686 
1687 	d->rttavg = RTTAVG_INIT;
1688 	d->rttdev = RTTDEV_INIT;
1689 	d->maxbcnt = 0;
1690 
1691 	t = d->targets;
1692 	te = t + d->ntargets;
1693 	for (; t < te && *t; t++)
1694 		aoecmd_wreset(*t);
1695 }
1696 
1697 void
1698 aoe_failbuf(struct aoedev *d, struct buf *buf)
1699 {
1700 	if (buf == NULL)
1701 		return;
1702 	buf->resid = 0;
1703 	clear_bit(BIO_UPTODATE, &buf->bio->bi_flags);
1704 	if (buf->nframesout == 0)
1705 		aoe_end_buf(d, buf);
1706 }
1707 
1708 void
1709 aoe_flush_iocq(void)
1710 {
1711 	struct frame *f;
1712 	struct aoedev *d;
1713 	LIST_HEAD(flist);
1714 	struct list_head *pos;
1715 	struct sk_buff *skb;
1716 	ulong flags;
1717 
1718 	spin_lock_irqsave(&iocq.lock, flags);
1719 	list_splice_init(&iocq.head, &flist);
1720 	spin_unlock_irqrestore(&iocq.lock, flags);
1721 	while (!list_empty(&flist)) {
1722 		pos = flist.next;
1723 		list_del(pos);
1724 		f = list_entry(pos, struct frame, head);
1725 		d = f->t->d;
1726 		skb = f->r_skb;
1727 		spin_lock_irqsave(&d->lock, flags);
1728 		if (f->buf) {
1729 			f->buf->nframesout--;
1730 			aoe_failbuf(d, f->buf);
1731 		}
1732 		aoe_freetframe(f);
1733 		spin_unlock_irqrestore(&d->lock, flags);
1734 		dev_kfree_skb(skb);
1735 		aoedev_put(d);
1736 	}
1737 }
1738 
1739 int __init
1740 aoecmd_init(void)
1741 {
1742 	void *p;
1743 
1744 	/* get_zeroed_page returns page with ref count 1 */
1745 	p = (void *) get_zeroed_page(GFP_KERNEL | __GFP_REPEAT);
1746 	if (!p)
1747 		return -ENOMEM;
1748 	empty_page = virt_to_page(p);
1749 
1750 	INIT_LIST_HEAD(&iocq.head);
1751 	spin_lock_init(&iocq.lock);
1752 	init_waitqueue_head(&ktiowq);
1753 	kts.name = "aoe_ktio";
1754 	kts.fn = ktio;
1755 	kts.waitq = &ktiowq;
1756 	kts.lock = &iocq.lock;
1757 	return aoe_ktstart(&kts);
1758 }
1759 
1760 void
1761 aoecmd_exit(void)
1762 {
1763 	aoe_ktstop(&kts);
1764 	aoe_flush_iocq();
1765 
1766 	free_page((unsigned long) page_address(empty_page));
1767 	empty_page = NULL;
1768 }
1769