drivers/nvme/target/tcp.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * NVMe over Fabrics TCP target.
   4  * Copyright (c) 2018 Lightbits Labs. All rights reserved.
   5  */
   6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   7 #include <linux/module.h>
   8 #include <linux/init.h>
   9 #include <linux/slab.h>
  10 #include <linux/err.h>
  11 #include <linux/key.h>
  12 #include <linux/nvme-tcp.h>
  13 #include <linux/nvme-keyring.h>
  14 #include <net/sock.h>
  15 #include <net/tcp.h>
  16 #include <net/tls.h>
  17 #include <net/tls_prot.h>
  18 #include <net/handshake.h>
  19 #include <linux/inet.h>
  20 #include <linux/llist.h>
  21 #include <crypto/hash.h>
  22 #include <trace/events/sock.h>
  23
  24 #include "nvmet.h"
  25
  26 #define NVMET_TCP_DEF_INLINE_DATA_SIZE  (4 * PAGE_SIZE)
  27 #define NVMET_TCP_MAXH2CDATA            0x400000 /* 16M arbitrary limit */
  28 #define NVMET_TCP_BACKLOG 128
  29
  30 static int param_store_val(const char *str, int *val, int min, int max)
  31 {
  32         int ret, new_val;
  33
  34         ret = kstrtoint(str, 10, &new_val);
  35         if (ret)
  36                 return -EINVAL;
  37
  38         if (new_val < min || new_val > max)
  39                 return -EINVAL;
  40
  41         *val = new_val;
  42         return 0;
  43 }
  44
  45 static int set_params(const char *str, const struct kernel_param *kp)
  46 {
  47         return param_store_val(str, kp->arg, 0, INT_MAX);
  48 }
  49
  50 static const struct kernel_param_ops set_param_ops = {
  51         .set    = set_params,
  52         .get    = param_get_int,
  53 };
  54
  55 /* Define the socket priority to use for connections were it is desirable
  56  * that the NIC consider performing optimized packet processing or filtering.
  57  * A non-zero value being sufficient to indicate general consideration of any
  58  * possible optimization.  Making it a module param allows for alternative
  59  * values that may be unique for some NIC implementations.
  60  */
  61 static int so_priority;
  62 device_param_cb(so_priority, &set_param_ops, &so_priority, 0644);
  63 MODULE_PARM_DESC(so_priority, "nvmet tcp socket optimize priority: Default 0");
  64
  65 /* Define a time period (in usecs) that io_work() shall sample an activated
  66  * queue before determining it to be idle.  This optional module behavior
  67  * can enable NIC solutions that support socket optimized packet processing
  68  * using advanced interrupt moderation techniques.
  69  */
  70 static int idle_poll_period_usecs;
  71 device_param_cb(idle_poll_period_usecs, &set_param_ops,
  72                 &idle_poll_period_usecs, 0644);
  73 MODULE_PARM_DESC(idle_poll_period_usecs,
  74                 "nvmet tcp io_work poll till idle time period in usecs: Default 0");
  75
  76 #ifdef CONFIG_NVME_TARGET_TCP_TLS
  77 /*
  78  * TLS handshake timeout
  79  */
  80 static int tls_handshake_timeout = 10;
  81 module_param(tls_handshake_timeout, int, 0644);
  82 MODULE_PARM_DESC(tls_handshake_timeout,
  83                  "nvme TLS handshake timeout in seconds (default 10)");
  84 #endif
  85
  86 #define NVMET_TCP_RECV_BUDGET           8
  87 #define NVMET_TCP_SEND_BUDGET           8
  88 #define NVMET_TCP_IO_WORK_BUDGET        64
  89
  90 enum nvmet_tcp_send_state {
  91         NVMET_TCP_SEND_DATA_PDU,
  92         NVMET_TCP_SEND_DATA,
  93         NVMET_TCP_SEND_R2T,
  94         NVMET_TCP_SEND_DDGST,
  95         NVMET_TCP_SEND_RESPONSE
  96 };
  97
  98 enum nvmet_tcp_recv_state {
  99         NVMET_TCP_RECV_PDU,
 100         NVMET_TCP_RECV_DATA,
 101         NVMET_TCP_RECV_DDGST,
 102         NVMET_TCP_RECV_ERR,
 103 };
 104
 105 enum {
 106         NVMET_TCP_F_INIT_FAILED = (1 << 0),
 107 };
 108
 109 struct nvmet_tcp_cmd {
 110         struct nvmet_tcp_queue          *queue;
 111         struct nvmet_req                req;
 112
 113         struct nvme_tcp_cmd_pdu         *cmd_pdu;
 114         struct nvme_tcp_rsp_pdu         *rsp_pdu;
 115         struct nvme_tcp_data_pdu        *data_pdu;
 116         struct nvme_tcp_r2t_pdu         *r2t_pdu;
 117
 118         u32                             rbytes_done;
 119         u32                             wbytes_done;
 120
 121         u32                             pdu_len;
 122         u32                             pdu_recv;
 123         int                             sg_idx;
 124         char                            recv_cbuf[CMSG_LEN(sizeof(char))];
 125         struct msghdr                   recv_msg;
 126         struct bio_vec                  *iov;
 127         u32                             flags;
 128
 129         struct list_head                entry;
 130         struct llist_node               lentry;
 131
 132         /* send state */
 133         u32                             offset;
 134         struct scatterlist              *cur_sg;
 135         enum nvmet_tcp_send_state       state;
 136
 137         __le32                          exp_ddgst;
 138         __le32                          recv_ddgst;
 139 };
 140
 141 enum nvmet_tcp_queue_state {
 142         NVMET_TCP_Q_CONNECTING,
 143         NVMET_TCP_Q_TLS_HANDSHAKE,
 144         NVMET_TCP_Q_LIVE,
 145         NVMET_TCP_Q_DISCONNECTING,
 146         NVMET_TCP_Q_FAILED,
 147 };
 148
 149 struct nvmet_tcp_queue {
 150         struct socket           *sock;
 151         struct nvmet_tcp_port   *port;
 152         struct work_struct      io_work;
 153         struct nvmet_cq         nvme_cq;
 154         struct nvmet_sq         nvme_sq;
 155         struct kref             kref;
 156
 157         /* send state */
 158         struct nvmet_tcp_cmd    *cmds;
 159         unsigned int            nr_cmds;
 160         struct list_head        free_list;
 161         struct llist_head       resp_list;
 162         struct list_head        resp_send_list;
 163         int                     send_list_len;
 164         struct nvmet_tcp_cmd    *snd_cmd;
 165
 166         /* recv state */
 167         int                     offset;
 168         int                     left;
 169         enum nvmet_tcp_recv_state rcv_state;
 170         struct nvmet_tcp_cmd    *cmd;
 171         union nvme_tcp_pdu      pdu;
 172
 173         /* digest state */
 174         bool                    hdr_digest;
 175         bool                    data_digest;
 176         struct ahash_request    *snd_hash;
 177         struct ahash_request    *rcv_hash;
 178
 179         /* TLS state */
 180         key_serial_t            tls_pskid;
 181         struct delayed_work     tls_handshake_tmo_work;
 182
 183         unsigned long           poll_end;
 184
 185         spinlock_t              state_lock;
 186         enum nvmet_tcp_queue_state state;
 187
 188         struct sockaddr_storage sockaddr;
 189         struct sockaddr_storage sockaddr_peer;
 190         struct work_struct      release_work;
 191
 192         int                     idx;
 193         struct list_head        queue_list;
 194
 195         struct nvmet_tcp_cmd    connect;
 196
 197         struct page_frag_cache  pf_cache;
 198
 199         void (*data_ready)(struct sock *);
 200         void (*state_change)(struct sock *);
 201         void (*write_space)(struct sock *);
 202 };
 203
 204 struct nvmet_tcp_port {
 205         struct socket           *sock;
 206         struct work_struct      accept_work;
 207         struct nvmet_port       *nport;
 208         struct sockaddr_storage addr;
 209         void (*data_ready)(struct sock *);
 210 };
 211
 212 static DEFINE_IDA(nvmet_tcp_queue_ida);
 213 static LIST_HEAD(nvmet_tcp_queue_list);
 214 static DEFINE_MUTEX(nvmet_tcp_queue_mutex);
 215
 216 static struct workqueue_struct *nvmet_tcp_wq;
 217 static const struct nvmet_fabrics_ops nvmet_tcp_ops;
 218 static void nvmet_tcp_free_cmd(struct nvmet_tcp_cmd *c);
 219 static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd);
 220
 221 static inline u16 nvmet_tcp_cmd_tag(struct nvmet_tcp_queue *queue,
 222                 struct nvmet_tcp_cmd *cmd)
 223 {
 224         if (unlikely(!queue->nr_cmds)) {
 225                 /* We didn't allocate cmds yet, send 0xffff */
 226                 return USHRT_MAX;
 227         }
 228
 229         return cmd - queue->cmds;
 230 }
 231
 232 static inline bool nvmet_tcp_has_data_in(struct nvmet_tcp_cmd *cmd)
 233 {
 234         return nvme_is_write(cmd->req.cmd) &&
 235                 cmd->rbytes_done < cmd->req.transfer_len;
 236 }
 237
 238 static inline bool nvmet_tcp_need_data_in(struct nvmet_tcp_cmd *cmd)
 239 {
 240         return nvmet_tcp_has_data_in(cmd) && !cmd->req.cqe->status;
 241 }
 242
 243 static inline bool nvmet_tcp_need_data_out(struct nvmet_tcp_cmd *cmd)
 244 {
 245         return !nvme_is_write(cmd->req.cmd) &&
 246                 cmd->req.transfer_len > 0 &&
 247                 !cmd->req.cqe->status;
 248 }
 249
 250 static inline bool nvmet_tcp_has_inline_data(struct nvmet_tcp_cmd *cmd)
 251 {
 252         return nvme_is_write(cmd->req.cmd) && cmd->pdu_len &&
 253                 !cmd->rbytes_done;
 254 }
 255
 256 static inline struct nvmet_tcp_cmd *
 257 nvmet_tcp_get_cmd(struct nvmet_tcp_queue *queue)
 258 {
 259         struct nvmet_tcp_cmd *cmd;
 260
 261         cmd = list_first_entry_or_null(&queue->free_list,
 262                                 struct nvmet_tcp_cmd, entry);
 263         if (!cmd)
 264                 return NULL;
 265         list_del_init(&cmd->entry);
 266
 267         cmd->rbytes_done = cmd->wbytes_done = 0;
 268         cmd->pdu_len = 0;
 269         cmd->pdu_recv = 0;
 270         cmd->iov = NULL;
 271         cmd->flags = 0;
 272         return cmd;
 273 }
 274
 275 static inline void nvmet_tcp_put_cmd(struct nvmet_tcp_cmd *cmd)
 276 {
 277         if (unlikely(cmd == &cmd->queue->connect))
 278                 return;
 279
 280         list_add_tail(&cmd->entry, &cmd->queue->free_list);
 281 }
 282
 283 static inline int queue_cpu(struct nvmet_tcp_queue *queue)
 284 {
 285         return queue->sock->sk->sk_incoming_cpu;
 286 }
 287
 288 static inline u8 nvmet_tcp_hdgst_len(struct nvmet_tcp_queue *queue)
 289 {
 290         return queue->hdr_digest ? NVME_TCP_DIGEST_LENGTH : 0;
 291 }
 292
 293 static inline u8 nvmet_tcp_ddgst_len(struct nvmet_tcp_queue *queue)
 294 {
 295         return queue->data_digest ? NVME_TCP_DIGEST_LENGTH : 0;
 296 }
 297
 298 static inline void nvmet_tcp_hdgst(struct ahash_request *hash,
 299                 void *pdu, size_t len)
 300 {
 301         struct scatterlist sg;
 302
 303         sg_init_one(&sg, pdu, len);
 304         ahash_request_set_crypt(hash, &sg, pdu + len, len);
 305         crypto_ahash_digest(hash);
 306 }
 307
 308 static int nvmet_tcp_verify_hdgst(struct nvmet_tcp_queue *queue,
 309         void *pdu, size_t len)
 310 {
 311         struct nvme_tcp_hdr *hdr = pdu;
 312         __le32 recv_digest;
 313         __le32 exp_digest;
 314
 315         if (unlikely(!(hdr->flags & NVME_TCP_F_HDGST))) {
 316                 pr_err("queue %d: header digest enabled but no header digest\n",
 317                         queue->idx);
 318                 return -EPROTO;
 319         }
 320
 321         recv_digest = *(__le32 *)(pdu + hdr->hlen);
 322         nvmet_tcp_hdgst(queue->rcv_hash, pdu, len);
 323         exp_digest = *(__le32 *)(pdu + hdr->hlen);
 324         if (recv_digest != exp_digest) {
 325                 pr_err("queue %d: header digest error: recv %#x expected %#x\n",
 326                         queue->idx, le32_to_cpu(recv_digest),
 327                         le32_to_cpu(exp_digest));
 328                 return -EPROTO;
 329         }
 330
 331         return 0;
 332 }
 333
 334 static int nvmet_tcp_check_ddgst(struct nvmet_tcp_queue *queue, void *pdu)
 335 {
 336         struct nvme_tcp_hdr *hdr = pdu;
 337         u8 digest_len = nvmet_tcp_hdgst_len(queue);
 338         u32 len;
 339
 340         len = le32_to_cpu(hdr->plen) - hdr->hlen -
 341                 (hdr->flags & NVME_TCP_F_HDGST ? digest_len : 0);
 342
 343         if (unlikely(len && !(hdr->flags & NVME_TCP_F_DDGST))) {
 344                 pr_err("queue %d: data digest flag is cleared\n", queue->idx);
 345                 return -EPROTO;
 346         }
 347
 348         return 0;
 349 }
 350
 351 static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd)
 352 {
 353         kfree(cmd->iov);
 354         sgl_free(cmd->req.sg);
 355         cmd->iov = NULL;
 356         cmd->req.sg = NULL;
 357 }
 358
 359 static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
 360 {
 361         struct bio_vec *iov = cmd->iov;
 362         struct scatterlist *sg;
 363         u32 length, offset, sg_offset;
 364         int nr_pages;
 365
 366         length = cmd->pdu_len;
 367         nr_pages = DIV_ROUND_UP(length, PAGE_SIZE);
 368         offset = cmd->rbytes_done;
 369         cmd->sg_idx = offset / PAGE_SIZE;
 370         sg_offset = offset % PAGE_SIZE;
 371         sg = &cmd->req.sg[cmd->sg_idx];
 372
 373         while (length) {
 374                 u32 iov_len = min_t(u32, length, sg->length - sg_offset);
 375
 376                 bvec_set_page(iov, sg_page(sg), iov_len,
 377                                 sg->offset + sg_offset);
 378
 379                 length -= iov_len;
 380                 sg = sg_next(sg);
 381                 iov++;
 382                 sg_offset = 0;
 383         }
 384
 385         iov_iter_bvec(&cmd->recv_msg.msg_iter, ITER_DEST, cmd->iov,
 386                       nr_pages, cmd->pdu_len);
 387 }
 388
 389 static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
 390 {
 391         queue->rcv_state = NVMET_TCP_RECV_ERR;
 392         if (queue->nvme_sq.ctrl)
 393                 nvmet_ctrl_fatal_error(queue->nvme_sq.ctrl);
 394         else
 395                 kernel_sock_shutdown(queue->sock, SHUT_RDWR);
 396 }
 397
 398 static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)
 399 {
 400         queue->rcv_state = NVMET_TCP_RECV_ERR;
 401         if (status == -EPIPE || status == -ECONNRESET)
 402                 kernel_sock_shutdown(queue->sock, SHUT_RDWR);
 403         else
 404                 nvmet_tcp_fatal_error(queue);
 405 }
 406
 407 static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd)
 408 {
 409         struct nvme_sgl_desc *sgl = &cmd->req.cmd->common.dptr.sgl;
 410         u32 len = le32_to_cpu(sgl->length);
 411
 412         if (!len)
 413                 return 0;
 414
 415         if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) |
 416                           NVME_SGL_FMT_OFFSET)) {
 417                 if (!nvme_is_write(cmd->req.cmd))
 418                         return NVME_SC_INVALID_FIELD | NVME_SC_DNR;
 419
 420                 if (len > cmd->req.port->inline_data_size)
 421                         return NVME_SC_SGL_INVALID_OFFSET | NVME_SC_DNR;
 422                 cmd->pdu_len = len;
 423         }
 424         cmd->req.transfer_len += len;
 425
 426         cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt);
 427         if (!cmd->req.sg)
 428                 return NVME_SC_INTERNAL;
 429         cmd->cur_sg = cmd->req.sg;
 430
 431         if (nvmet_tcp_has_data_in(cmd)) {
 432                 cmd->iov = kmalloc_array(cmd->req.sg_cnt,
 433                                 sizeof(*cmd->iov), GFP_KERNEL);
 434                 if (!cmd->iov)
 435                         goto err;
 436         }
 437
 438         return 0;
 439 err:
 440         nvmet_tcp_free_cmd_buffers(cmd);
 441         return NVME_SC_INTERNAL;
 442 }
 443
 444 static void nvmet_tcp_calc_ddgst(struct ahash_request *hash,
 445                 struct nvmet_tcp_cmd *cmd)
 446 {
 447         ahash_request_set_crypt(hash, cmd->req.sg,
 448                 (void *)&cmd->exp_ddgst, cmd->req.transfer_len);
 449         crypto_ahash_digest(hash);
 450 }
 451
 452 static void nvmet_setup_c2h_data_pdu(struct nvmet_tcp_cmd *cmd)
 453 {
 454         struct nvme_tcp_data_pdu *pdu = cmd->data_pdu;
 455         struct nvmet_tcp_queue *queue = cmd->queue;
 456         u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
 457         u8 ddgst = nvmet_tcp_ddgst_len(cmd->queue);
 458
 459         cmd->offset = 0;
 460         cmd->state = NVMET_TCP_SEND_DATA_PDU;
 461
 462         pdu->hdr.type = nvme_tcp_c2h_data;
 463         pdu->hdr.flags = NVME_TCP_F_DATA_LAST | (queue->nvme_sq.sqhd_disabled ?
 464                                                 NVME_TCP_F_DATA_SUCCESS : 0);
 465         pdu->hdr.hlen = sizeof(*pdu);
 466         pdu->hdr.pdo = pdu->hdr.hlen + hdgst;
 467         pdu->hdr.plen =
 468                 cpu_to_le32(pdu->hdr.hlen + hdgst +
 469                                 cmd->req.transfer_len + ddgst);
 470         pdu->command_id = cmd->req.cqe->command_id;
 471         pdu->data_length = cpu_to_le32(cmd->req.transfer_len);
 472         pdu->data_offset = cpu_to_le32(cmd->wbytes_done);
 473
 474         if (queue->data_digest) {
 475                 pdu->hdr.flags |= NVME_TCP_F_DDGST;
 476                 nvmet_tcp_calc_ddgst(queue->snd_hash, cmd);
 477         }
 478
 479         if (cmd->queue->hdr_digest) {
 480                 pdu->hdr.flags |= NVME_TCP_F_HDGST;
 481                 nvmet_tcp_hdgst(queue->snd_hash, pdu, sizeof(*pdu));
 482         }
 483 }
 484
 485 static void nvmet_setup_r2t_pdu(struct nvmet_tcp_cmd *cmd)
 486 {
 487         struct nvme_tcp_r2t_pdu *pdu = cmd->r2t_pdu;
 488         struct nvmet_tcp_queue *queue = cmd->queue;
 489         u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
 490
 491         cmd->offset = 0;
 492         cmd->state = NVMET_TCP_SEND_R2T;
 493
 494         pdu->hdr.type = nvme_tcp_r2t;
 495         pdu->hdr.flags = 0;
 496         pdu->hdr.hlen = sizeof(*pdu);
 497         pdu->hdr.pdo = 0;
 498         pdu->hdr.plen = cpu_to_le32(pdu->hdr.hlen + hdgst);
 499
 500         pdu->command_id = cmd->req.cmd->common.command_id;
 501         pdu->ttag = nvmet_tcp_cmd_tag(cmd->queue, cmd);
 502         pdu->r2t_length = cpu_to_le32(cmd->req.transfer_len - cmd->rbytes_done);
 503         pdu->r2t_offset = cpu_to_le32(cmd->rbytes_done);
 504         if (cmd->queue->hdr_digest) {
 505                 pdu->hdr.flags |= NVME_TCP_F_HDGST;
 506                 nvmet_tcp_hdgst(queue->snd_hash, pdu, sizeof(*pdu));
 507         }
 508 }
 509
 510 static void nvmet_setup_response_pdu(struct nvmet_tcp_cmd *cmd)
 511 {
 512         struct nvme_tcp_rsp_pdu *pdu = cmd->rsp_pdu;
 513         struct nvmet_tcp_queue *queue = cmd->queue;
 514         u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
 515
 516         cmd->offset = 0;
 517         cmd->state = NVMET_TCP_SEND_RESPONSE;
 518
 519         pdu->hdr.type = nvme_tcp_rsp;
 520         pdu->hdr.flags = 0;
 521         pdu->hdr.hlen = sizeof(*pdu);
 522         pdu->hdr.pdo = 0;
 523         pdu->hdr.plen = cpu_to_le32(pdu->hdr.hlen + hdgst);
 524         if (cmd->queue->hdr_digest) {
 525                 pdu->hdr.flags |= NVME_TCP_F_HDGST;
 526                 nvmet_tcp_hdgst(queue->snd_hash, pdu, sizeof(*pdu));
 527         }
 528 }
 529
 530 static void nvmet_tcp_process_resp_list(struct nvmet_tcp_queue *queue)
 531 {
 532         struct llist_node *node;
 533         struct nvmet_tcp_cmd *cmd;
 534
 535         for (node = llist_del_all(&queue->resp_list); node; node = node->next) {
 536                 cmd = llist_entry(node, struct nvmet_tcp_cmd, lentry);
 537                 list_add(&cmd->entry, &queue->resp_send_list);
 538                 queue->send_list_len++;
 539         }
 540 }
 541
 542 static struct nvmet_tcp_cmd *nvmet_tcp_fetch_cmd(struct nvmet_tcp_queue *queue)
 543 {
 544         queue->snd_cmd = list_first_entry_or_null(&queue->resp_send_list,
 545                                 struct nvmet_tcp_cmd, entry);
 546         if (!queue->snd_cmd) {
 547                 nvmet_tcp_process_resp_list(queue);
 548                 queue->snd_cmd =
 549                         list_first_entry_or_null(&queue->resp_send_list,
 550                                         struct nvmet_tcp_cmd, entry);
 551                 if (unlikely(!queue->snd_cmd))
 552                         return NULL;
 553         }
 554
 555         list_del_init(&queue->snd_cmd->entry);
 556         queue->send_list_len--;
 557
 558         if (nvmet_tcp_need_data_out(queue->snd_cmd))
 559                 nvmet_setup_c2h_data_pdu(queue->snd_cmd);
 560         else if (nvmet_tcp_need_data_in(queue->snd_cmd))
 561                 nvmet_setup_r2t_pdu(queue->snd_cmd);
 562         else
 563                 nvmet_setup_response_pdu(queue->snd_cmd);
 564
 565         return queue->snd_cmd;
 566 }
 567
 568 static void nvmet_tcp_queue_response(struct nvmet_req *req)
 569 {
 570         struct nvmet_tcp_cmd *cmd =
 571                 container_of(req, struct nvmet_tcp_cmd, req);
 572         struct nvmet_tcp_queue  *queue = cmd->queue;
 573         struct nvme_sgl_desc *sgl;
 574         u32 len;
 575
 576         if (unlikely(cmd == queue->cmd)) {
 577                 sgl = &cmd->req.cmd->common.dptr.sgl;
 578                 len = le32_to_cpu(sgl->length);
 579
 580                 /*
 581                  * Wait for inline data before processing the response.
 582                  * Avoid using helpers, this might happen before
 583                  * nvmet_req_init is completed.
 584                  */
 585                 if (queue->rcv_state == NVMET_TCP_RECV_PDU &&
 586                     len && len <= cmd->req.port->inline_data_size &&
 587                     nvme_is_write(cmd->req.cmd))
 588                         return;
 589         }
 590
 591         llist_add(&cmd->lentry, &queue->resp_list);
 592         queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &cmd->queue->io_work);
 593 }
 594
 595 static void nvmet_tcp_execute_request(struct nvmet_tcp_cmd *cmd)
 596 {
 597         if (unlikely(cmd->flags & NVMET_TCP_F_INIT_FAILED))
 598                 nvmet_tcp_queue_response(&cmd->req);
 599         else
 600                 cmd->req.execute(&cmd->req);
 601 }
 602
 603 static int nvmet_try_send_data_pdu(struct nvmet_tcp_cmd *cmd)
 604 {
 605         struct msghdr msg = {
 606                 .msg_flags = MSG_DONTWAIT | MSG_MORE | MSG_SPLICE_PAGES,
 607         };
 608         struct bio_vec bvec;
 609         u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
 610         int left = sizeof(*cmd->data_pdu) - cmd->offset + hdgst;
 611         int ret;
 612
 613         bvec_set_virt(&bvec, (void *)cmd->data_pdu + cmd->offset, left);
 614         iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, left);
 615         ret = sock_sendmsg(cmd->queue->sock, &msg);
 616         if (ret <= 0)
 617                 return ret;
 618
 619         cmd->offset += ret;
 620         left -= ret;
 621
 622         if (left)
 623                 return -EAGAIN;
 624
 625         cmd->state = NVMET_TCP_SEND_DATA;
 626         cmd->offset  = 0;
 627         return 1;
 628 }
 629
 630 static int nvmet_try_send_data(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
 631 {
 632         struct nvmet_tcp_queue *queue = cmd->queue;
 633         int ret;
 634
 635         while (cmd->cur_sg) {
 636                 struct msghdr msg = {
 637                         .msg_flags = MSG_DONTWAIT | MSG_SPLICE_PAGES,
 638                 };
 639                 struct page *page = sg_page(cmd->cur_sg);
 640                 struct bio_vec bvec;
 641                 u32 left = cmd->cur_sg->length - cmd->offset;
 642
 643                 if ((!last_in_batch && cmd->queue->send_list_len) ||
 644                     cmd->wbytes_done + left < cmd->req.transfer_len ||
 645                     queue->data_digest || !queue->nvme_sq.sqhd_disabled)
 646                         msg.msg_flags |= MSG_MORE;
 647
 648                 bvec_set_page(&bvec, page, left, cmd->offset);
 649                 iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, left);
 650                 ret = sock_sendmsg(cmd->queue->sock, &msg);
 651                 if (ret <= 0)
 652                         return ret;
 653
 654                 cmd->offset += ret;
 655                 cmd->wbytes_done += ret;
 656
 657                 /* Done with sg?*/
 658                 if (cmd->offset == cmd->cur_sg->length) {
 659                         cmd->cur_sg = sg_next(cmd->cur_sg);
 660                         cmd->offset = 0;
 661                 }
 662         }
 663
 664         if (queue->data_digest) {
 665                 cmd->state = NVMET_TCP_SEND_DDGST;
 666                 cmd->offset = 0;
 667         } else {
 668                 if (queue->nvme_sq.sqhd_disabled) {
 669                         cmd->queue->snd_cmd = NULL;
 670                         nvmet_tcp_put_cmd(cmd);
 671                 } else {
 672                         nvmet_setup_response_pdu(cmd);
 673                 }
 674         }
 675
 676         if (queue->nvme_sq.sqhd_disabled)
 677                 nvmet_tcp_free_cmd_buffers(cmd);
 678
 679         return 1;
 680
 681 }
 682
 683 static int nvmet_try_send_response(struct nvmet_tcp_cmd *cmd,
 684                 bool last_in_batch)
 685 {
 686         struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_SPLICE_PAGES, };
 687         struct bio_vec bvec;
 688         u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
 689         int left = sizeof(*cmd->rsp_pdu) - cmd->offset + hdgst;
 690         int ret;
 691
 692         if (!last_in_batch && cmd->queue->send_list_len)
 693                 msg.msg_flags |= MSG_MORE;
 694         else
 695                 msg.msg_flags |= MSG_EOR;
 696
 697         bvec_set_virt(&bvec, (void *)cmd->rsp_pdu + cmd->offset, left);
 698         iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, left);
 699         ret = sock_sendmsg(cmd->queue->sock, &msg);
 700         if (ret <= 0)
 701                 return ret;
 702         cmd->offset += ret;
 703         left -= ret;
 704
 705         if (left)
 706                 return -EAGAIN;
 707
 708         nvmet_tcp_free_cmd_buffers(cmd);
 709         cmd->queue->snd_cmd = NULL;
 710         nvmet_tcp_put_cmd(cmd);
 711         return 1;
 712 }
 713
 714 static int nvmet_try_send_r2t(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
 715 {
 716         struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_SPLICE_PAGES, };
 717         struct bio_vec bvec;
 718         u8 hdgst = nvmet_tcp_hdgst_len(cmd->queue);
 719         int left = sizeof(*cmd->r2t_pdu) - cmd->offset + hdgst;
 720         int ret;
 721
 722         if (!last_in_batch && cmd->queue->send_list_len)
 723                 msg.msg_flags |= MSG_MORE;
 724         else
 725                 msg.msg_flags |= MSG_EOR;
 726
 727         bvec_set_virt(&bvec, (void *)cmd->r2t_pdu + cmd->offset, left);
 728         iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, left);
 729         ret = sock_sendmsg(cmd->queue->sock, &msg);
 730         if (ret <= 0)
 731                 return ret;
 732         cmd->offset += ret;
 733         left -= ret;
 734
 735         if (left)
 736                 return -EAGAIN;
 737
 738         cmd->queue->snd_cmd = NULL;
 739         return 1;
 740 }
 741
 742 static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
 743 {
 744         struct nvmet_tcp_queue *queue = cmd->queue;
 745         int left = NVME_TCP_DIGEST_LENGTH - cmd->offset;
 746         struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
 747         struct kvec iov = {
 748                 .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset,
 749                 .iov_len = left
 750         };
 751         int ret;
 752
 753         if (!last_in_batch && cmd->queue->send_list_len)
 754                 msg.msg_flags |= MSG_MORE;
 755         else
 756                 msg.msg_flags |= MSG_EOR;
 757
 758         ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
 759         if (unlikely(ret <= 0))
 760                 return ret;
 761
 762         cmd->offset += ret;
 763         left -= ret;
 764
 765         if (left)
 766                 return -EAGAIN;
 767
 768         if (queue->nvme_sq.sqhd_disabled) {
 769                 cmd->queue->snd_cmd = NULL;
 770                 nvmet_tcp_put_cmd(cmd);
 771         } else {
 772                 nvmet_setup_response_pdu(cmd);
 773         }
 774         return 1;
 775 }
 776
 777 static int nvmet_tcp_try_send_one(struct nvmet_tcp_queue *queue,
 778                 bool last_in_batch)
 779 {
 780         struct nvmet_tcp_cmd *cmd = queue->snd_cmd;
 781         int ret = 0;
 782
 783         if (!cmd || queue->state == NVMET_TCP_Q_DISCONNECTING) {
 784                 cmd = nvmet_tcp_fetch_cmd(queue);
 785                 if (unlikely(!cmd))
 786                         return 0;
 787         }
 788
 789         if (cmd->state == NVMET_TCP_SEND_DATA_PDU) {
 790                 ret = nvmet_try_send_data_pdu(cmd);
 791                 if (ret <= 0)
 792                         goto done_send;
 793         }
 794
 795         if (cmd->state == NVMET_TCP_SEND_DATA) {
 796                 ret = nvmet_try_send_data(cmd, last_in_batch);
 797                 if (ret <= 0)
 798                         goto done_send;
 799         }
 800
 801         if (cmd->state == NVMET_TCP_SEND_DDGST) {
 802                 ret = nvmet_try_send_ddgst(cmd, last_in_batch);
 803                 if (ret <= 0)
 804                         goto done_send;
 805         }
 806
 807         if (cmd->state == NVMET_TCP_SEND_R2T) {
 808                 ret = nvmet_try_send_r2t(cmd, last_in_batch);
 809                 if (ret <= 0)
 810                         goto done_send;
 811         }
 812
 813         if (cmd->state == NVMET_TCP_SEND_RESPONSE)
 814                 ret = nvmet_try_send_response(cmd, last_in_batch);
 815
 816 done_send:
 817         if (ret < 0) {
 818                 if (ret == -EAGAIN)
 819                         return 0;
 820                 return ret;
 821         }
 822
 823         return 1;
 824 }
 825
 826 static int nvmet_tcp_try_send(struct nvmet_tcp_queue *queue,
 827                 int budget, int *sends)
 828 {
 829         int i, ret = 0;
 830
 831         for (i = 0; i < budget; i++) {
 832                 ret = nvmet_tcp_try_send_one(queue, i == budget - 1);
 833                 if (unlikely(ret < 0)) {
 834                         nvmet_tcp_socket_error(queue, ret);
 835                         goto done;
 836                 } else if (ret == 0) {
 837                         break;
 838                 }
 839                 (*sends)++;
 840         }
 841 done:
 842         return ret;
 843 }
 844
 845 static void nvmet_prepare_receive_pdu(struct nvmet_tcp_queue *queue)
 846 {
 847         queue->offset = 0;
 848         queue->left = sizeof(struct nvme_tcp_hdr);
 849         queue->cmd = NULL;
 850         queue->rcv_state = NVMET_TCP_RECV_PDU;
 851 }
 852
 853 static void nvmet_tcp_free_crypto(struct nvmet_tcp_queue *queue)
 854 {
 855         struct crypto_ahash *tfm = crypto_ahash_reqtfm(queue->rcv_hash);
 856
 857         ahash_request_free(queue->rcv_hash);
 858         ahash_request_free(queue->snd_hash);
 859         crypto_free_ahash(tfm);
 860 }
 861
 862 static int nvmet_tcp_alloc_crypto(struct nvmet_tcp_queue *queue)
 863 {
 864         struct crypto_ahash *tfm;
 865
 866         tfm = crypto_alloc_ahash("crc32c", 0, CRYPTO_ALG_ASYNC);
 867         if (IS_ERR(tfm))
 868                 return PTR_ERR(tfm);
 869
 870         queue->snd_hash = ahash_request_alloc(tfm, GFP_KERNEL);
 871         if (!queue->snd_hash)
 872                 goto free_tfm;
 873         ahash_request_set_callback(queue->snd_hash, 0, NULL, NULL);
 874
 875         queue->rcv_hash = ahash_request_alloc(tfm, GFP_KERNEL);
 876         if (!queue->rcv_hash)
 877                 goto free_snd_hash;
 878         ahash_request_set_callback(queue->rcv_hash, 0, NULL, NULL);
 879
 880         return 0;
 881 free_snd_hash:
 882         ahash_request_free(queue->snd_hash);
 883 free_tfm:
 884         crypto_free_ahash(tfm);
 885         return -ENOMEM;
 886 }
 887
 888
 889 static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
 890 {
 891         struct nvme_tcp_icreq_pdu *icreq = &queue->pdu.icreq;
 892         struct nvme_tcp_icresp_pdu *icresp = &queue->pdu.icresp;
 893         struct msghdr msg = {};
 894         struct kvec iov;
 895         int ret;
 896
 897         if (le32_to_cpu(icreq->hdr.plen) != sizeof(struct nvme_tcp_icreq_pdu)) {
 898                 pr_err("bad nvme-tcp pdu length (%d)\n",
 899                         le32_to_cpu(icreq->hdr.plen));
 900                 nvmet_tcp_fatal_error(queue);
 901                 return -EPROTO;
 902         }
 903
 904         if (icreq->pfv != NVME_TCP_PFV_1_0) {
 905                 pr_err("queue %d: bad pfv %d\n", queue->idx, icreq->pfv);
 906                 return -EPROTO;
 907         }
 908
 909         if (icreq->hpda != 0) {
 910                 pr_err("queue %d: unsupported hpda %d\n", queue->idx,
 911                         icreq->hpda);
 912                 return -EPROTO;
 913         }
 914
 915         queue->hdr_digest = !!(icreq->digest & NVME_TCP_HDR_DIGEST_ENABLE);
 916         queue->data_digest = !!(icreq->digest & NVME_TCP_DATA_DIGEST_ENABLE);
 917         if (queue->hdr_digest || queue->data_digest) {
 918                 ret = nvmet_tcp_alloc_crypto(queue);
 919                 if (ret)
 920                         return ret;
 921         }
 922
 923         memset(icresp, 0, sizeof(*icresp));
 924         icresp->hdr.type = nvme_tcp_icresp;
 925         icresp->hdr.hlen = sizeof(*icresp);
 926         icresp->hdr.pdo = 0;
 927         icresp->hdr.plen = cpu_to_le32(icresp->hdr.hlen);
 928         icresp->pfv = cpu_to_le16(NVME_TCP_PFV_1_0);
 929         icresp->maxdata = cpu_to_le32(NVMET_TCP_MAXH2CDATA);
 930         icresp->cpda = 0;
 931         if (queue->hdr_digest)
 932                 icresp->digest |= NVME_TCP_HDR_DIGEST_ENABLE;
 933         if (queue->data_digest)
 934                 icresp->digest |= NVME_TCP_DATA_DIGEST_ENABLE;
 935
 936         iov.iov_base = icresp;
 937         iov.iov_len = sizeof(*icresp);
 938         ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
 939         if (ret < 0) {
 940                 queue->state = NVMET_TCP_Q_FAILED;
 941                 return ret; /* queue removal will cleanup */
 942         }
 943
 944         queue->state = NVMET_TCP_Q_LIVE;
 945         nvmet_prepare_receive_pdu(queue);
 946         return 0;
 947 }
 948
 949 static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,
 950                 struct nvmet_tcp_cmd *cmd, struct nvmet_req *req)
 951 {
 952         size_t data_len = le32_to_cpu(req->cmd->common.dptr.sgl.length);
 953         int ret;
 954
 955         /*
 956          * This command has not been processed yet, hence we are trying to
 957          * figure out if there is still pending data left to receive. If
 958          * we don't, we can simply prepare for the next pdu and bail out,
 959          * otherwise we will need to prepare a buffer and receive the
 960          * stale data before continuing forward.
 961          */
 962         if (!nvme_is_write(cmd->req.cmd) || !data_len ||
 963             data_len > cmd->req.port->inline_data_size) {
 964                 nvmet_prepare_receive_pdu(queue);
 965                 return;
 966         }
 967
 968         ret = nvmet_tcp_map_data(cmd);
 969         if (unlikely(ret)) {
 970                 pr_err("queue %d: failed to map data\n", queue->idx);
 971                 nvmet_tcp_fatal_error(queue);
 972                 return;
 973         }
 974
 975         queue->rcv_state = NVMET_TCP_RECV_DATA;
 976         nvmet_tcp_build_pdu_iovec(cmd);
 977         cmd->flags |= NVMET_TCP_F_INIT_FAILED;
 978 }
 979
 980 static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
 981 {
 982         struct nvme_tcp_data_pdu *data = &queue->pdu.data;
 983         struct nvmet_tcp_cmd *cmd;
 984         unsigned int exp_data_len;
 985
 986         if (likely(queue->nr_cmds)) {
 987                 if (unlikely(data->ttag >= queue->nr_cmds)) {
 988                         pr_err("queue %d: received out of bound ttag %u, nr_cmds %u\n",
 989                                 queue->idx, data->ttag, queue->nr_cmds);
 990                         goto err_proto;
 991                 }
 992                 cmd = &queue->cmds[data->ttag];
 993         } else {
 994                 cmd = &queue->connect;
 995         }
 996
 997         if (le32_to_cpu(data->data_offset) != cmd->rbytes_done) {
 998                 pr_err("ttag %u unexpected data offset %u (expected %u)\n",
 999                         data->ttag, le32_to_cpu(data->data_offset),
1000                         cmd->rbytes_done);
1001                 goto err_proto;
1002         }
1003
1004         exp_data_len = le32_to_cpu(data->hdr.plen) -
1005                         nvmet_tcp_hdgst_len(queue) -
1006                         nvmet_tcp_ddgst_len(queue) -
1007                         sizeof(*data);
1008
1009         cmd->pdu_len = le32_to_cpu(data->data_length);
1010         if (unlikely(cmd->pdu_len != exp_data_len ||
1011                      cmd->pdu_len == 0 ||
1012                      cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) {
1013                 pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len);
1014                 goto err_proto;
1015         }
1016         cmd->pdu_recv = 0;
1017         nvmet_tcp_build_pdu_iovec(cmd);
1018         queue->cmd = cmd;
1019         queue->rcv_state = NVMET_TCP_RECV_DATA;
1020
1021         return 0;
1022
1023 err_proto:
1024         /* FIXME: use proper transport errors */
1025         nvmet_tcp_fatal_error(queue);
1026         return -EPROTO;
1027 }
1028
1029 static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue)
1030 {
1031         struct nvme_tcp_hdr *hdr = &queue->pdu.cmd.hdr;
1032         struct nvme_command *nvme_cmd = &queue->pdu.cmd.cmd;
1033         struct nvmet_req *req;
1034         int ret;
1035
1036         if (unlikely(queue->state == NVMET_TCP_Q_CONNECTING)) {
1037                 if (hdr->type != nvme_tcp_icreq) {
1038                         pr_err("unexpected pdu type (%d) before icreq\n",
1039                                 hdr->type);
1040                         nvmet_tcp_fatal_error(queue);
1041                         return -EPROTO;
1042                 }
1043                 return nvmet_tcp_handle_icreq(queue);
1044         }
1045
1046         if (unlikely(hdr->type == nvme_tcp_icreq)) {
1047                 pr_err("queue %d: received icreq pdu in state %d\n",
1048                         queue->idx, queue->state);
1049                 nvmet_tcp_fatal_error(queue);
1050                 return -EPROTO;
1051         }
1052
1053         if (hdr->type == nvme_tcp_h2c_data) {
1054                 ret = nvmet_tcp_handle_h2c_data_pdu(queue);
1055                 if (unlikely(ret))
1056                         return ret;
1057                 return 0;
1058         }
1059
1060         queue->cmd = nvmet_tcp_get_cmd(queue);
1061         if (unlikely(!queue->cmd)) {
1062                 /* This should never happen */
1063                 pr_err("queue %d: out of commands (%d) send_list_len: %d, opcode: %d",
1064                         queue->idx, queue->nr_cmds, queue->send_list_len,
1065                         nvme_cmd->common.opcode);
1066                 nvmet_tcp_fatal_error(queue);
1067                 return -ENOMEM;
1068         }
1069
1070         req = &queue->cmd->req;
1071         memcpy(req->cmd, nvme_cmd, sizeof(*nvme_cmd));
1072
1073         if (unlikely(!nvmet_req_init(req, &queue->nvme_cq,
1074                         &queue->nvme_sq, &nvmet_tcp_ops))) {
1075                 pr_err("failed cmd %p id %d opcode %d, data_len: %d\n",
1076                         req->cmd, req->cmd->common.command_id,
1077                         req->cmd->common.opcode,
1078                         le32_to_cpu(req->cmd->common.dptr.sgl.length));
1079
1080                 nvmet_tcp_handle_req_failure(queue, queue->cmd, req);
1081                 return 0;
1082         }
1083
1084         ret = nvmet_tcp_map_data(queue->cmd);
1085         if (unlikely(ret)) {
1086                 pr_err("queue %d: failed to map data\n", queue->idx);
1087                 if (nvmet_tcp_has_inline_data(queue->cmd))
1088                         nvmet_tcp_fatal_error(queue);
1089                 else
1090                         nvmet_req_complete(req, ret);
1091                 ret = -EAGAIN;
1092                 goto out;
1093         }
1094
1095         if (nvmet_tcp_need_data_in(queue->cmd)) {
1096                 if (nvmet_tcp_has_inline_data(queue->cmd)) {
1097                         queue->rcv_state = NVMET_TCP_RECV_DATA;
1098                         nvmet_tcp_build_pdu_iovec(queue->cmd);
1099                         return 0;
1100                 }
1101                 /* send back R2T */
1102                 nvmet_tcp_queue_response(&queue->cmd->req);
1103                 goto out;
1104         }
1105
1106         queue->cmd->req.execute(&queue->cmd->req);
1107 out:
1108         nvmet_prepare_receive_pdu(queue);
1109         return ret;
1110 }
1111
1112 static const u8 nvme_tcp_pdu_sizes[] = {
1113         [nvme_tcp_icreq]        = sizeof(struct nvme_tcp_icreq_pdu),
1114         [nvme_tcp_cmd]          = sizeof(struct nvme_tcp_cmd_pdu),
1115         [nvme_tcp_h2c_data]     = sizeof(struct nvme_tcp_data_pdu),
1116 };
1117
1118 static inline u8 nvmet_tcp_pdu_size(u8 type)
1119 {
1120         size_t idx = type;
1121
1122         return (idx < ARRAY_SIZE(nvme_tcp_pdu_sizes) &&
1123                 nvme_tcp_pdu_sizes[idx]) ?
1124                         nvme_tcp_pdu_sizes[idx] : 0;
1125 }
1126
1127 static inline bool nvmet_tcp_pdu_valid(u8 type)
1128 {
1129         switch (type) {
1130         case nvme_tcp_icreq:
1131         case nvme_tcp_cmd:
1132         case nvme_tcp_h2c_data:
1133                 /* fallthru */
1134                 return true;
1135         }
1136
1137         return false;
1138 }
1139
1140 static int nvmet_tcp_tls_record_ok(struct nvmet_tcp_queue *queue,
1141                 struct msghdr *msg, char *cbuf)
1142 {
1143         struct cmsghdr *cmsg = (struct cmsghdr *)cbuf;
1144         u8 ctype, level, description;
1145         int ret = 0;
1146
1147         ctype = tls_get_record_type(queue->sock->sk, cmsg);
1148         switch (ctype) {
1149         case 0:
1150                 break;
1151         case TLS_RECORD_TYPE_DATA:
1152                 break;
1153         case TLS_RECORD_TYPE_ALERT:
1154                 tls_alert_recv(queue->sock->sk, msg, &level, &description);
1155                 if (level == TLS_ALERT_LEVEL_FATAL) {
1156                         pr_err("queue %d: TLS Alert desc %u\n",
1157                                queue->idx, description);
1158                         ret = -ENOTCONN;
1159                 } else {
1160                         pr_warn("queue %d: TLS Alert desc %u\n",
1161                                queue->idx, description);
1162                         ret = -EAGAIN;
1163                 }
1164                 break;
1165         default:
1166                 /* discard this record type */
1167                 pr_err("queue %d: TLS record %d unhandled\n",
1168                        queue->idx, ctype);
1169                 ret = -EAGAIN;
1170                 break;
1171         }
1172         return ret;
1173 }
1174
1175 static int nvmet_tcp_try_recv_pdu(struct nvmet_tcp_queue *queue)
1176 {
1177         struct nvme_tcp_hdr *hdr = &queue->pdu.cmd.hdr;
1178         int len, ret;
1179         struct kvec iov;
1180         char cbuf[CMSG_LEN(sizeof(char))] = {};
1181         struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
1182
1183 recv:
1184         iov.iov_base = (void *)&queue->pdu + queue->offset;
1185         iov.iov_len = queue->left;
1186         if (queue->tls_pskid) {
1187                 msg.msg_control = cbuf;
1188                 msg.msg_controllen = sizeof(cbuf);
1189         }
1190         len = kernel_recvmsg(queue->sock, &msg, &iov, 1,
1191                         iov.iov_len, msg.msg_flags);
1192         if (unlikely(len < 0))
1193                 return len;
1194         if (queue->tls_pskid) {
1195                 ret = nvmet_tcp_tls_record_ok(queue, &msg, cbuf);
1196                 if (ret < 0)
1197                         return ret;
1198         }
1199
1200         queue->offset += len;
1201         queue->left -= len;
1202         if (queue->left)
1203                 return -EAGAIN;
1204
1205         if (queue->offset == sizeof(struct nvme_tcp_hdr)) {
1206                 u8 hdgst = nvmet_tcp_hdgst_len(queue);
1207
1208                 if (unlikely(!nvmet_tcp_pdu_valid(hdr->type))) {
1209                         pr_err("unexpected pdu type %d\n", hdr->type);
1210                         nvmet_tcp_fatal_error(queue);
1211                         return -EIO;
1212                 }
1213
1214                 if (unlikely(hdr->hlen != nvmet_tcp_pdu_size(hdr->type))) {
1215                         pr_err("pdu %d bad hlen %d\n", hdr->type, hdr->hlen);
1216                         return -EIO;
1217                 }
1218
1219                 queue->left = hdr->hlen - queue->offset + hdgst;
1220                 goto recv;
1221         }
1222
1223         if (queue->hdr_digest &&
1224             nvmet_tcp_verify_hdgst(queue, &queue->pdu, hdr->hlen)) {
1225                 nvmet_tcp_fatal_error(queue); /* fatal */
1226                 return -EPROTO;
1227         }
1228
1229         if (queue->data_digest &&
1230             nvmet_tcp_check_ddgst(queue, &queue->pdu)) {
1231                 nvmet_tcp_fatal_error(queue); /* fatal */
1232                 return -EPROTO;
1233         }
1234
1235         return nvmet_tcp_done_recv_pdu(queue);
1236 }
1237
1238 static void nvmet_tcp_prep_recv_ddgst(struct nvmet_tcp_cmd *cmd)
1239 {
1240         struct nvmet_tcp_queue *queue = cmd->queue;
1241
1242         nvmet_tcp_calc_ddgst(queue->rcv_hash, cmd);
1243         queue->offset = 0;
1244         queue->left = NVME_TCP_DIGEST_LENGTH;
1245         queue->rcv_state = NVMET_TCP_RECV_DDGST;
1246 }
1247
1248 static int nvmet_tcp_try_recv_data(struct nvmet_tcp_queue *queue)
1249 {
1250         struct nvmet_tcp_cmd  *cmd = queue->cmd;
1251         int len, ret;
1252
1253         while (msg_data_left(&cmd->recv_msg)) {
1254                 len = sock_recvmsg(cmd->queue->sock, &cmd->recv_msg,
1255                         cmd->recv_msg.msg_flags);
1256                 if (len <= 0)
1257                         return len;
1258                 if (queue->tls_pskid) {
1259                         ret = nvmet_tcp_tls_record_ok(cmd->queue,
1260                                         &cmd->recv_msg, cmd->recv_cbuf);
1261                         if (ret < 0)
1262                                 return ret;
1263                 }
1264
1265                 cmd->pdu_recv += len;
1266                 cmd->rbytes_done += len;
1267         }
1268
1269         if (queue->data_digest) {
1270                 nvmet_tcp_prep_recv_ddgst(cmd);
1271                 return 0;
1272         }
1273
1274         if (cmd->rbytes_done == cmd->req.transfer_len)
1275                 nvmet_tcp_execute_request(cmd);
1276
1277         nvmet_prepare_receive_pdu(queue);
1278         return 0;
1279 }
1280
1281 static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue)
1282 {
1283         struct nvmet_tcp_cmd *cmd = queue->cmd;
1284         int ret, len;
1285         char cbuf[CMSG_LEN(sizeof(char))] = {};
1286         struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
1287         struct kvec iov = {
1288                 .iov_base = (void *)&cmd->recv_ddgst + queue->offset,
1289                 .iov_len = queue->left
1290         };
1291
1292         if (queue->tls_pskid) {
1293                 msg.msg_control = cbuf;
1294                 msg.msg_controllen = sizeof(cbuf);
1295         }
1296         len = kernel_recvmsg(queue->sock, &msg, &iov, 1,
1297                         iov.iov_len, msg.msg_flags);
1298         if (unlikely(len < 0))
1299                 return len;
1300         if (queue->tls_pskid) {
1301                 ret = nvmet_tcp_tls_record_ok(queue, &msg, cbuf);
1302                 if (ret < 0)
1303                         return ret;
1304         }
1305
1306         queue->offset += len;
1307         queue->left -= len;
1308         if (queue->left)
1309                 return -EAGAIN;
1310
1311         if (queue->data_digest && cmd->exp_ddgst != cmd->recv_ddgst) {
1312                 pr_err("queue %d: cmd %d pdu (%d) data digest error: recv %#x expected %#x\n",
1313                         queue->idx, cmd->req.cmd->common.command_id,
1314                         queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
1315                         le32_to_cpu(cmd->exp_ddgst));
1316                 nvmet_req_uninit(&cmd->req);
1317                 nvmet_tcp_free_cmd_buffers(cmd);
1318                 nvmet_tcp_fatal_error(queue);
1319                 ret = -EPROTO;
1320                 goto out;
1321         }
1322
1323         if (cmd->rbytes_done == cmd->req.transfer_len)
1324                 nvmet_tcp_execute_request(cmd);
1325
1326         ret = 0;
1327 out:
1328         nvmet_prepare_receive_pdu(queue);
1329         return ret;
1330 }
1331
1332 static int nvmet_tcp_try_recv_one(struct nvmet_tcp_queue *queue)
1333 {
1334         int result = 0;
1335
1336         if (unlikely(queue->rcv_state == NVMET_TCP_RECV_ERR))
1337                 return 0;
1338
1339         if (queue->rcv_state == NVMET_TCP_RECV_PDU) {
1340                 result = nvmet_tcp_try_recv_pdu(queue);
1341                 if (result != 0)
1342                         goto done_recv;
1343         }
1344
1345         if (queue->rcv_state == NVMET_TCP_RECV_DATA) {
1346                 result = nvmet_tcp_try_recv_data(queue);
1347                 if (result != 0)
1348                         goto done_recv;
1349         }
1350
1351         if (queue->rcv_state == NVMET_TCP_RECV_DDGST) {
1352                 result = nvmet_tcp_try_recv_ddgst(queue);
1353                 if (result != 0)
1354                         goto done_recv;
1355         }
1356
1357 done_recv:
1358         if (result < 0) {
1359                 if (result == -EAGAIN)
1360                         return 0;
1361                 return result;
1362         }
1363         return 1;
1364 }
1365
1366 static int nvmet_tcp_try_recv(struct nvmet_tcp_queue *queue,
1367                 int budget, int *recvs)
1368 {
1369         int i, ret = 0;
1370
1371         for (i = 0; i < budget; i++) {
1372                 ret = nvmet_tcp_try_recv_one(queue);
1373                 if (unlikely(ret < 0)) {
1374                         nvmet_tcp_socket_error(queue, ret);
1375                         goto done;
1376                 } else if (ret == 0) {
1377                         break;
1378                 }
1379                 (*recvs)++;
1380         }
1381 done:
1382         return ret;
1383 }
1384
1385 static void nvmet_tcp_release_queue(struct kref *kref)
1386 {
1387         struct nvmet_tcp_queue *queue =
1388                 container_of(kref, struct nvmet_tcp_queue, kref);
1389
1390         WARN_ON(queue->state != NVMET_TCP_Q_DISCONNECTING);
1391         queue_work(nvmet_wq, &queue->release_work);
1392 }
1393
1394 static void nvmet_tcp_schedule_release_queue(struct nvmet_tcp_queue *queue)
1395 {
1396         spin_lock_bh(&queue->state_lock);
1397         if (queue->state == NVMET_TCP_Q_TLS_HANDSHAKE) {
1398                 /* Socket closed during handshake */
1399                 tls_handshake_cancel(queue->sock->sk);
1400         }
1401         if (queue->state != NVMET_TCP_Q_DISCONNECTING) {
1402                 queue->state = NVMET_TCP_Q_DISCONNECTING;
1403                 kref_put(&queue->kref, nvmet_tcp_release_queue);
1404         }
1405         spin_unlock_bh(&queue->state_lock);
1406 }
1407
1408 static inline void nvmet_tcp_arm_queue_deadline(struct nvmet_tcp_queue *queue)
1409 {
1410         queue->poll_end = jiffies + usecs_to_jiffies(idle_poll_period_usecs);
1411 }
1412
1413 static bool nvmet_tcp_check_queue_deadline(struct nvmet_tcp_queue *queue,
1414                 int ops)
1415 {
1416         if (!idle_poll_period_usecs)
1417                 return false;
1418
1419         if (ops)
1420                 nvmet_tcp_arm_queue_deadline(queue);
1421
1422         return !time_after(jiffies, queue->poll_end);
1423 }
1424
1425 static void nvmet_tcp_io_work(struct work_struct *w)
1426 {
1427         struct nvmet_tcp_queue *queue =
1428                 container_of(w, struct nvmet_tcp_queue, io_work);
1429         bool pending;
1430         int ret, ops = 0;
1431
1432         do {
1433                 pending = false;
1434
1435                 ret = nvmet_tcp_try_recv(queue, NVMET_TCP_RECV_BUDGET, &ops);
1436                 if (ret > 0)
1437                         pending = true;
1438                 else if (ret < 0)
1439                         return;
1440
1441                 ret = nvmet_tcp_try_send(queue, NVMET_TCP_SEND_BUDGET, &ops);
1442                 if (ret > 0)
1443                         pending = true;
1444                 else if (ret < 0)
1445                         return;
1446
1447         } while (pending && ops < NVMET_TCP_IO_WORK_BUDGET);
1448
1449         /*
1450          * Requeue the worker if idle deadline period is in progress or any
1451          * ops activity was recorded during the do-while loop above.
1452          */
1453         if (nvmet_tcp_check_queue_deadline(queue, ops) || pending)
1454                 queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &queue->io_work);
1455 }
1456
1457 static int nvmet_tcp_alloc_cmd(struct nvmet_tcp_queue *queue,
1458                 struct nvmet_tcp_cmd *c)
1459 {
1460         u8 hdgst = nvmet_tcp_hdgst_len(queue);
1461
1462         c->queue = queue;
1463         c->req.port = queue->port->nport;
1464
1465         c->cmd_pdu = page_frag_alloc(&queue->pf_cache,
1466                         sizeof(*c->cmd_pdu) + hdgst, GFP_KERNEL | __GFP_ZERO);
1467         if (!c->cmd_pdu)
1468                 return -ENOMEM;
1469         c->req.cmd = &c->cmd_pdu->cmd;
1470
1471         c->rsp_pdu = page_frag_alloc(&queue->pf_cache,
1472                         sizeof(*c->rsp_pdu) + hdgst, GFP_KERNEL | __GFP_ZERO);
1473         if (!c->rsp_pdu)
1474                 goto out_free_cmd;
1475         c->req.cqe = &c->rsp_pdu->cqe;
1476
1477         c->data_pdu = page_frag_alloc(&queue->pf_cache,
1478                         sizeof(*c->data_pdu) + hdgst, GFP_KERNEL | __GFP_ZERO);
1479         if (!c->data_pdu)
1480                 goto out_free_rsp;
1481
1482         c->r2t_pdu = page_frag_alloc(&queue->pf_cache,
1483                         sizeof(*c->r2t_pdu) + hdgst, GFP_KERNEL | __GFP_ZERO);
1484         if (!c->r2t_pdu)
1485                 goto out_free_data;
1486
1487         if (queue->state == NVMET_TCP_Q_TLS_HANDSHAKE) {
1488                 c->recv_msg.msg_control = c->recv_cbuf;
1489                 c->recv_msg.msg_controllen = sizeof(c->recv_cbuf);
1490         }
1491         c->recv_msg.msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL;
1492
1493         list_add_tail(&c->entry, &queue->free_list);
1494
1495         return 0;
1496 out_free_data:
1497         page_frag_free(c->data_pdu);
1498 out_free_rsp:
1499         page_frag_free(c->rsp_pdu);
1500 out_free_cmd:
1501         page_frag_free(c->cmd_pdu);
1502         return -ENOMEM;
1503 }
1504
1505 static void nvmet_tcp_free_cmd(struct nvmet_tcp_cmd *c)
1506 {
1507         page_frag_free(c->r2t_pdu);
1508         page_frag_free(c->data_pdu);
1509         page_frag_free(c->rsp_pdu);
1510         page_frag_free(c->cmd_pdu);
1511 }
1512
1513 static int nvmet_tcp_alloc_cmds(struct nvmet_tcp_queue *queue)
1514 {
1515         struct nvmet_tcp_cmd *cmds;
1516         int i, ret = -EINVAL, nr_cmds = queue->nr_cmds;
1517
1518         cmds = kcalloc(nr_cmds, sizeof(struct nvmet_tcp_cmd), GFP_KERNEL);
1519         if (!cmds)
1520                 goto out;
1521
1522         for (i = 0; i < nr_cmds; i++) {
1523                 ret = nvmet_tcp_alloc_cmd(queue, cmds + i);
1524                 if (ret)
1525                         goto out_free;
1526         }
1527
1528         queue->cmds = cmds;
1529
1530         return 0;
1531 out_free:
1532         while (--i >= 0)
1533                 nvmet_tcp_free_cmd(cmds + i);
1534         kfree(cmds);
1535 out:
1536         return ret;
1537 }
1538
1539 static void nvmet_tcp_free_cmds(struct nvmet_tcp_queue *queue)
1540 {
1541         struct nvmet_tcp_cmd *cmds = queue->cmds;
1542         int i;
1543
1544         for (i = 0; i < queue->nr_cmds; i++)
1545                 nvmet_tcp_free_cmd(cmds + i);
1546
1547         nvmet_tcp_free_cmd(&queue->connect);
1548         kfree(cmds);
1549 }
1550
1551 static void nvmet_tcp_restore_socket_callbacks(struct nvmet_tcp_queue *queue)
1552 {
1553         struct socket *sock = queue->sock;
1554
1555         write_lock_bh(&sock->sk->sk_callback_lock);
1556         sock->sk->sk_data_ready =  queue->data_ready;
1557         sock->sk->sk_state_change = queue->state_change;
1558         sock->sk->sk_write_space = queue->write_space;
1559         sock->sk->sk_user_data = NULL;
1560         write_unlock_bh(&sock->sk->sk_callback_lock);
1561 }
1562
1563 static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue)
1564 {
1565         struct nvmet_tcp_cmd *cmd = queue->cmds;
1566         int i;
1567
1568         for (i = 0; i < queue->nr_cmds; i++, cmd++) {
1569                 if (nvmet_tcp_need_data_in(cmd))
1570                         nvmet_req_uninit(&cmd->req);
1571         }
1572
1573         if (!queue->nr_cmds && nvmet_tcp_need_data_in(&queue->connect)) {
1574                 /* failed in connect */
1575                 nvmet_req_uninit(&queue->connect.req);
1576         }
1577 }
1578
1579 static void nvmet_tcp_free_cmd_data_in_buffers(struct nvmet_tcp_queue *queue)
1580 {
1581         struct nvmet_tcp_cmd *cmd = queue->cmds;
1582         int i;
1583
1584         for (i = 0; i < queue->nr_cmds; i++, cmd++) {
1585                 if (nvmet_tcp_need_data_in(cmd))
1586                         nvmet_tcp_free_cmd_buffers(cmd);
1587         }
1588
1589         if (!queue->nr_cmds && nvmet_tcp_need_data_in(&queue->connect))
1590                 nvmet_tcp_free_cmd_buffers(&queue->connect);
1591 }
1592
1593 static void nvmet_tcp_release_queue_work(struct work_struct *w)
1594 {
1595         struct page *page;
1596         struct nvmet_tcp_queue *queue =
1597                 container_of(w, struct nvmet_tcp_queue, release_work);
1598
1599         mutex_lock(&nvmet_tcp_queue_mutex);
1600         list_del_init(&queue->queue_list);
1601         mutex_unlock(&nvmet_tcp_queue_mutex);
1602
1603         nvmet_tcp_restore_socket_callbacks(queue);
1604         cancel_delayed_work_sync(&queue->tls_handshake_tmo_work);
1605         cancel_work_sync(&queue->io_work);
1606         /* stop accepting incoming data */
1607         queue->rcv_state = NVMET_TCP_RECV_ERR;
1608
1609         nvmet_tcp_uninit_data_in_cmds(queue);
1610         nvmet_sq_destroy(&queue->nvme_sq);
1611         cancel_work_sync(&queue->io_work);
1612         nvmet_tcp_free_cmd_data_in_buffers(queue);
1613         /* ->sock will be released by fput() */
1614         fput(queue->sock->file);
1615         nvmet_tcp_free_cmds(queue);
1616         if (queue->hdr_digest || queue->data_digest)
1617                 nvmet_tcp_free_crypto(queue);
1618         ida_free(&nvmet_tcp_queue_ida, queue->idx);
1619         page = virt_to_head_page(queue->pf_cache.va);
1620         __page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias);
1621         kfree(queue);
1622 }
1623
1624 static void nvmet_tcp_data_ready(struct sock *sk)
1625 {
1626         struct nvmet_tcp_queue *queue;
1627
1628         trace_sk_data_ready(sk);
1629
1630         read_lock_bh(&sk->sk_callback_lock);
1631         queue = sk->sk_user_data;
1632         if (likely(queue)) {
1633                 if (queue->data_ready)
1634                         queue->data_ready(sk);
1635                 if (queue->state != NVMET_TCP_Q_TLS_HANDSHAKE)
1636                         queue_work_on(queue_cpu(queue), nvmet_tcp_wq,
1637                                       &queue->io_work);
1638         }
1639         read_unlock_bh(&sk->sk_callback_lock);
1640 }
1641
1642 static void nvmet_tcp_write_space(struct sock *sk)
1643 {
1644         struct nvmet_tcp_queue *queue;
1645
1646         read_lock_bh(&sk->sk_callback_lock);
1647         queue = sk->sk_user_data;
1648         if (unlikely(!queue))
1649                 goto out;
1650
1651         if (unlikely(queue->state == NVMET_TCP_Q_CONNECTING)) {
1652                 queue->write_space(sk);
1653                 goto out;
1654         }
1655
1656         if (sk_stream_is_writeable(sk)) {
1657                 clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
1658                 queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &queue->io_work);
1659         }
1660 out:
1661         read_unlock_bh(&sk->sk_callback_lock);
1662 }
1663
1664 static void nvmet_tcp_state_change(struct sock *sk)
1665 {
1666         struct nvmet_tcp_queue *queue;
1667
1668         read_lock_bh(&sk->sk_callback_lock);
1669         queue = sk->sk_user_data;
1670         if (!queue)
1671                 goto done;
1672
1673         switch (sk->sk_state) {
1674         case TCP_FIN_WAIT2:
1675         case TCP_LAST_ACK:
1676                 break;
1677         case TCP_FIN_WAIT1:
1678         case TCP_CLOSE_WAIT:
1679         case TCP_CLOSE:
1680                 /* FALLTHRU */
1681                 nvmet_tcp_schedule_release_queue(queue);
1682                 break;
1683         default:
1684                 pr_warn("queue %d unhandled state %d\n",
1685                         queue->idx, sk->sk_state);
1686         }
1687 done:
1688         read_unlock_bh(&sk->sk_callback_lock);
1689 }
1690
1691 static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue)
1692 {
1693         struct socket *sock = queue->sock;
1694         struct inet_sock *inet = inet_sk(sock->sk);
1695         int ret;
1696
1697         ret = kernel_getsockname(sock,
1698                 (struct sockaddr *)&queue->sockaddr);
1699         if (ret < 0)
1700                 return ret;
1701
1702         ret = kernel_getpeername(sock,
1703                 (struct sockaddr *)&queue->sockaddr_peer);
1704         if (ret < 0)
1705                 return ret;
1706
1707         /*
1708          * Cleanup whatever is sitting in the TCP transmit queue on socket
1709          * close. This is done to prevent stale data from being sent should
1710          * the network connection be restored before TCP times out.
1711          */
1712         sock_no_linger(sock->sk);
1713
1714         if (so_priority > 0)
1715                 sock_set_priority(sock->sk, so_priority);
1716
1717         /* Set socket type of service */
1718         if (inet->rcv_tos > 0)
1719                 ip_sock_set_tos(sock->sk, inet->rcv_tos);
1720
1721         ret = 0;
1722         write_lock_bh(&sock->sk->sk_callback_lock);
1723         if (sock->sk->sk_state != TCP_ESTABLISHED) {
1724                 /*
1725                  * If the socket is already closing, don't even start
1726                  * consuming it
1727                  */
1728                 ret = -ENOTCONN;
1729         } else {
1730                 sock->sk->sk_user_data = queue;
1731                 queue->data_ready = sock->sk->sk_data_ready;
1732                 sock->sk->sk_data_ready = nvmet_tcp_data_ready;
1733                 queue->state_change = sock->sk->sk_state_change;
1734                 sock->sk->sk_state_change = nvmet_tcp_state_change;
1735                 queue->write_space = sock->sk->sk_write_space;
1736                 sock->sk->sk_write_space = nvmet_tcp_write_space;
1737                 if (idle_poll_period_usecs)
1738                         nvmet_tcp_arm_queue_deadline(queue);
1739                 queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &queue->io_work);
1740         }
1741         write_unlock_bh(&sock->sk->sk_callback_lock);
1742
1743         return ret;
1744 }
1745
1746 #ifdef CONFIG_NVME_TARGET_TCP_TLS
1747 static int nvmet_tcp_try_peek_pdu(struct nvmet_tcp_queue *queue)
1748 {
1749         struct nvme_tcp_hdr *hdr = &queue->pdu.cmd.hdr;
1750         int len, ret;
1751         struct kvec iov = {
1752                 .iov_base = (u8 *)&queue->pdu + queue->offset,
1753                 .iov_len = sizeof(struct nvme_tcp_hdr),
1754         };
1755         char cbuf[CMSG_LEN(sizeof(char))] = {};
1756         struct msghdr msg = {
1757                 .msg_control = cbuf,
1758                 .msg_controllen = sizeof(cbuf),
1759                 .msg_flags = MSG_PEEK,
1760         };
1761
1762         if (nvmet_port_secure_channel_required(queue->port->nport))
1763                 return 0;
1764
1765         len = kernel_recvmsg(queue->sock, &msg, &iov, 1,
1766                         iov.iov_len, msg.msg_flags);
1767         if (unlikely(len < 0)) {
1768                 pr_debug("queue %d: peek error %d\n",
1769                          queue->idx, len);
1770                 return len;
1771         }
1772
1773         ret = nvmet_tcp_tls_record_ok(queue, &msg, cbuf);
1774         if (ret < 0)
1775                 return ret;
1776
1777         if (len < sizeof(struct nvme_tcp_hdr)) {
1778                 pr_debug("queue %d: short read, %d bytes missing\n",
1779                          queue->idx, (int)iov.iov_len - len);
1780                 return -EAGAIN;
1781         }
1782         pr_debug("queue %d: hdr type %d hlen %d plen %d size %d\n",
1783                  queue->idx, hdr->type, hdr->hlen, hdr->plen,
1784                  (int)sizeof(struct nvme_tcp_icreq_pdu));
1785         if (hdr->type == nvme_tcp_icreq &&
1786             hdr->hlen == sizeof(struct nvme_tcp_icreq_pdu) &&
1787             hdr->plen == cpu_to_le32(sizeof(struct nvme_tcp_icreq_pdu))) {
1788                 pr_debug("queue %d: icreq detected\n",
1789                          queue->idx);
1790                 return len;
1791         }
1792         return 0;
1793 }
1794
1795 static void nvmet_tcp_tls_handshake_done(void *data, int status,
1796                                          key_serial_t peerid)
1797 {
1798         struct nvmet_tcp_queue *queue = data;
1799
1800         pr_debug("queue %d: TLS handshake done, key %x, status %d\n",
1801                  queue->idx, peerid, status);
1802         spin_lock_bh(&queue->state_lock);
1803         if (WARN_ON(queue->state != NVMET_TCP_Q_TLS_HANDSHAKE)) {
1804                 spin_unlock_bh(&queue->state_lock);
1805                 return;
1806         }
1807         if (!status) {
1808                 queue->tls_pskid = peerid;
1809                 queue->state = NVMET_TCP_Q_CONNECTING;
1810         } else
1811                 queue->state = NVMET_TCP_Q_FAILED;
1812         spin_unlock_bh(&queue->state_lock);
1813
1814         cancel_delayed_work_sync(&queue->tls_handshake_tmo_work);
1815         if (status)
1816                 nvmet_tcp_schedule_release_queue(queue);
1817         else
1818                 nvmet_tcp_set_queue_sock(queue);
1819         kref_put(&queue->kref, nvmet_tcp_release_queue);
1820 }
1821
1822 static void nvmet_tcp_tls_handshake_timeout(struct work_struct *w)
1823 {
1824         struct nvmet_tcp_queue *queue = container_of(to_delayed_work(w),
1825                         struct nvmet_tcp_queue, tls_handshake_tmo_work);
1826
1827         pr_warn("queue %d: TLS handshake timeout\n", queue->idx);
1828         /*
1829          * If tls_handshake_cancel() fails we've lost the race with
1830          * nvmet_tcp_tls_handshake_done() */
1831         if (!tls_handshake_cancel(queue->sock->sk))
1832                 return;
1833         spin_lock_bh(&queue->state_lock);
1834         if (WARN_ON(queue->state != NVMET_TCP_Q_TLS_HANDSHAKE)) {
1835                 spin_unlock_bh(&queue->state_lock);
1836                 return;
1837         }
1838         queue->state = NVMET_TCP_Q_FAILED;
1839         spin_unlock_bh(&queue->state_lock);
1840         nvmet_tcp_schedule_release_queue(queue);
1841         kref_put(&queue->kref, nvmet_tcp_release_queue);
1842 }
1843
1844 static int nvmet_tcp_tls_handshake(struct nvmet_tcp_queue *queue)
1845 {
1846         int ret = -EOPNOTSUPP;
1847         struct tls_handshake_args args;
1848
1849         if (queue->state != NVMET_TCP_Q_TLS_HANDSHAKE) {
1850                 pr_warn("cannot start TLS in state %d\n", queue->state);
1851                 return -EINVAL;
1852         }
1853
1854         kref_get(&queue->kref);
1855         pr_debug("queue %d: TLS ServerHello\n", queue->idx);
1856         memset(&args, 0, sizeof(args));
1857         args.ta_sock = queue->sock;
1858         args.ta_done = nvmet_tcp_tls_handshake_done;
1859         args.ta_data = queue;
1860         args.ta_keyring = key_serial(queue->port->nport->keyring);
1861         args.ta_timeout_ms = tls_handshake_timeout * 1000;
1862
1863         ret = tls_server_hello_psk(&args, GFP_KERNEL);
1864         if (ret) {
1865                 kref_put(&queue->kref, nvmet_tcp_release_queue);
1866                 pr_err("failed to start TLS, err=%d\n", ret);
1867         } else {
1868                 queue_delayed_work(nvmet_wq, &queue->tls_handshake_tmo_work,
1869                                    tls_handshake_timeout * HZ);
1870         }
1871         return ret;
1872 }
1873 #else
1874 static void nvmet_tcp_tls_handshake_timeout(struct work_struct *w) {}
1875 #endif
1876
1877 static void nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port,
1878                 struct socket *newsock)
1879 {
1880         struct nvmet_tcp_queue *queue;
1881         struct file *sock_file = NULL;
1882         int ret;
1883
1884         queue = kzalloc(sizeof(*queue), GFP_KERNEL);
1885         if (!queue) {
1886                 ret = -ENOMEM;
1887                 goto out_release;
1888         }
1889
1890         INIT_WORK(&queue->release_work, nvmet_tcp_release_queue_work);
1891         INIT_WORK(&queue->io_work, nvmet_tcp_io_work);
1892         kref_init(&queue->kref);
1893         queue->sock = newsock;
1894         queue->port = port;
1895         queue->nr_cmds = 0;
1896         spin_lock_init(&queue->state_lock);
1897         if (queue->port->nport->disc_addr.tsas.tcp.sectype ==
1898             NVMF_TCP_SECTYPE_TLS13)
1899                 queue->state = NVMET_TCP_Q_TLS_HANDSHAKE;
1900         else
1901                 queue->state = NVMET_TCP_Q_CONNECTING;
1902         INIT_LIST_HEAD(&queue->free_list);
1903         init_llist_head(&queue->resp_list);
1904         INIT_LIST_HEAD(&queue->resp_send_list);
1905
1906         sock_file = sock_alloc_file(queue->sock, O_CLOEXEC, NULL);
1907         if (IS_ERR(sock_file)) {
1908                 ret = PTR_ERR(sock_file);
1909                 goto out_free_queue;
1910         }
1911
1912         queue->idx = ida_alloc(&nvmet_tcp_queue_ida, GFP_KERNEL);
1913         if (queue->idx < 0) {
1914                 ret = queue->idx;
1915                 goto out_sock;
1916         }
1917
1918         ret = nvmet_tcp_alloc_cmd(queue, &queue->connect);
1919         if (ret)
1920                 goto out_ida_remove;
1921
1922         ret = nvmet_sq_init(&queue->nvme_sq);
1923         if (ret)
1924                 goto out_free_connect;
1925
1926         nvmet_prepare_receive_pdu(queue);
1927
1928         mutex_lock(&nvmet_tcp_queue_mutex);
1929         list_add_tail(&queue->queue_list, &nvmet_tcp_queue_list);
1930         mutex_unlock(&nvmet_tcp_queue_mutex);
1931
1932         INIT_DELAYED_WORK(&queue->tls_handshake_tmo_work,
1933                           nvmet_tcp_tls_handshake_timeout);
1934 #ifdef CONFIG_NVME_TARGET_TCP_TLS
1935         if (queue->state == NVMET_TCP_Q_TLS_HANDSHAKE) {
1936                 struct sock *sk = queue->sock->sk;
1937
1938                 /* Restore the default callbacks before starting upcall */
1939                 read_lock_bh(&sk->sk_callback_lock);
1940                 sk->sk_user_data = NULL;
1941                 sk->sk_data_ready = port->data_ready;
1942                 read_unlock_bh(&sk->sk_callback_lock);
1943                 if (!nvmet_tcp_try_peek_pdu(queue)) {
1944                         if (!nvmet_tcp_tls_handshake(queue))
1945                                 return;
1946                         /* TLS handshake failed, terminate the connection */
1947                         goto out_destroy_sq;
1948                 }
1949                 /* Not a TLS connection, continue with normal processing */
1950                 queue->state = NVMET_TCP_Q_CONNECTING;
1951         }
1952 #endif
1953
1954         ret = nvmet_tcp_set_queue_sock(queue);
1955         if (ret)
1956                 goto out_destroy_sq;
1957
1958         return;
1959 out_destroy_sq:
1960         mutex_lock(&nvmet_tcp_queue_mutex);
1961         list_del_init(&queue->queue_list);
1962         mutex_unlock(&nvmet_tcp_queue_mutex);
1963         nvmet_sq_destroy(&queue->nvme_sq);
1964 out_free_connect:
1965         nvmet_tcp_free_cmd(&queue->connect);
1966 out_ida_remove:
1967         ida_free(&nvmet_tcp_queue_ida, queue->idx);
1968 out_sock:
1969         fput(queue->sock->file);
1970 out_free_queue:
1971         kfree(queue);
1972 out_release:
1973         pr_err("failed to allocate queue, error %d\n", ret);
1974         if (!sock_file)
1975                 sock_release(newsock);
1976 }
1977
1978 static void nvmet_tcp_accept_work(struct work_struct *w)
1979 {
1980         struct nvmet_tcp_port *port =
1981                 container_of(w, struct nvmet_tcp_port, accept_work);
1982         struct socket *newsock;
1983         int ret;
1984
1985         while (true) {
1986                 ret = kernel_accept(port->sock, &newsock, O_NONBLOCK);
1987                 if (ret < 0) {
1988                         if (ret != -EAGAIN)
1989                                 pr_warn("failed to accept err=%d\n", ret);
1990                         return;
1991                 }
1992                 nvmet_tcp_alloc_queue(port, newsock);
1993         }
1994 }
1995
1996 static void nvmet_tcp_listen_data_ready(struct sock *sk)
1997 {
1998         struct nvmet_tcp_port *port;
1999
2000         trace_sk_data_ready(sk);
2001
2002         read_lock_bh(&sk->sk_callback_lock);
2003         port = sk->sk_user_data;
2004         if (!port)
2005                 goto out;
2006
2007         if (sk->sk_state == TCP_LISTEN)
2008                 queue_work(nvmet_wq, &port->accept_work);
2009 out:
2010         read_unlock_bh(&sk->sk_callback_lock);
2011 }
2012
2013 static int nvmet_tcp_add_port(struct nvmet_port *nport)
2014 {
2015         struct nvmet_tcp_port *port;
2016         __kernel_sa_family_t af;
2017         int ret;
2018
2019         port = kzalloc(sizeof(*port), GFP_KERNEL);
2020         if (!port)
2021                 return -ENOMEM;
2022
2023         switch (nport->disc_addr.adrfam) {
2024         case NVMF_ADDR_FAMILY_IP4:
2025                 af = AF_INET;
2026                 break;
2027         case NVMF_ADDR_FAMILY_IP6:
2028                 af = AF_INET6;
2029                 break;
2030         default:
2031                 pr_err("address family %d not supported\n",
2032                                 nport->disc_addr.adrfam);
2033                 ret = -EINVAL;
2034                 goto err_port;
2035         }
2036
2037         ret = inet_pton_with_scope(&init_net, af, nport->disc_addr.traddr,
2038                         nport->disc_addr.trsvcid, &port->addr);
2039         if (ret) {
2040                 pr_err("malformed ip/port passed: %s:%s\n",
2041                         nport->disc_addr.traddr, nport->disc_addr.trsvcid);
2042                 goto err_port;
2043         }
2044
2045         port->nport = nport;
2046         INIT_WORK(&port->accept_work, nvmet_tcp_accept_work);
2047         if (port->nport->inline_data_size < 0)
2048                 port->nport->inline_data_size = NVMET_TCP_DEF_INLINE_DATA_SIZE;
2049
2050         ret = sock_create(port->addr.ss_family, SOCK_STREAM,
2051                                 IPPROTO_TCP, &port->sock);
2052         if (ret) {
2053                 pr_err("failed to create a socket\n");
2054                 goto err_port;
2055         }
2056
2057         port->sock->sk->sk_user_data = port;
2058         port->data_ready = port->sock->sk->sk_data_ready;
2059         port->sock->sk->sk_data_ready = nvmet_tcp_listen_data_ready;
2060         sock_set_reuseaddr(port->sock->sk);
2061         tcp_sock_set_nodelay(port->sock->sk);
2062         if (so_priority > 0)
2063                 sock_set_priority(port->sock->sk, so_priority);
2064
2065         ret = kernel_bind(port->sock, (struct sockaddr *)&port->addr,
2066                         sizeof(port->addr));
2067         if (ret) {
2068                 pr_err("failed to bind port socket %d\n", ret);
2069                 goto err_sock;
2070         }
2071
2072         ret = kernel_listen(port->sock, NVMET_TCP_BACKLOG);
2073         if (ret) {
2074                 pr_err("failed to listen %d on port sock\n", ret);
2075                 goto err_sock;
2076         }
2077
2078         nport->priv = port;
2079         pr_info("enabling port %d (%pISpc)\n",
2080                 le16_to_cpu(nport->disc_addr.portid), &port->addr);
2081
2082         return 0;
2083
2084 err_sock:
2085         sock_release(port->sock);
2086 err_port:
2087         kfree(port);
2088         return ret;
2089 }
2090
2091 static void nvmet_tcp_destroy_port_queues(struct nvmet_tcp_port *port)
2092 {
2093         struct nvmet_tcp_queue *queue;
2094
2095         mutex_lock(&nvmet_tcp_queue_mutex);
2096         list_for_each_entry(queue, &nvmet_tcp_queue_list, queue_list)
2097                 if (queue->port == port)
2098                         kernel_sock_shutdown(queue->sock, SHUT_RDWR);
2099         mutex_unlock(&nvmet_tcp_queue_mutex);
2100 }
2101
2102 static void nvmet_tcp_remove_port(struct nvmet_port *nport)
2103 {
2104         struct nvmet_tcp_port *port = nport->priv;
2105
2106         write_lock_bh(&port->sock->sk->sk_callback_lock);
2107         port->sock->sk->sk_data_ready = port->data_ready;
2108         port->sock->sk->sk_user_data = NULL;
2109         write_unlock_bh(&port->sock->sk->sk_callback_lock);
2110         cancel_work_sync(&port->accept_work);
2111         /*
2112          * Destroy the remaining queues, which are not belong to any
2113          * controller yet.
2114          */
2115         nvmet_tcp_destroy_port_queues(port);
2116
2117         sock_release(port->sock);
2118         kfree(port);
2119 }
2120
2121 static void nvmet_tcp_delete_ctrl(struct nvmet_ctrl *ctrl)
2122 {
2123         struct nvmet_tcp_queue *queue;
2124
2125         mutex_lock(&nvmet_tcp_queue_mutex);
2126         list_for_each_entry(queue, &nvmet_tcp_queue_list, queue_list)
2127                 if (queue->nvme_sq.ctrl == ctrl)
2128                         kernel_sock_shutdown(queue->sock, SHUT_RDWR);
2129         mutex_unlock(&nvmet_tcp_queue_mutex);
2130 }
2131
2132 static u16 nvmet_tcp_install_queue(struct nvmet_sq *sq)
2133 {
2134         struct nvmet_tcp_queue *queue =
2135                 container_of(sq, struct nvmet_tcp_queue, nvme_sq);
2136
2137         if (sq->qid == 0) {
2138                 struct nvmet_tcp_queue *q;
2139                 int pending = 0;
2140
2141                 /* Check for pending controller teardown */
2142                 mutex_lock(&nvmet_tcp_queue_mutex);
2143                 list_for_each_entry(q, &nvmet_tcp_queue_list, queue_list) {
2144                         if (q->nvme_sq.ctrl == sq->ctrl &&
2145                             q->state == NVMET_TCP_Q_DISCONNECTING)
2146                                 pending++;
2147                 }
2148                 mutex_unlock(&nvmet_tcp_queue_mutex);
2149                 if (pending > NVMET_TCP_BACKLOG)
2150                         return NVME_SC_CONNECT_CTRL_BUSY;
2151         }
2152
2153         queue->nr_cmds = sq->size * 2;
2154         if (nvmet_tcp_alloc_cmds(queue))
2155                 return NVME_SC_INTERNAL;
2156         return 0;
2157 }
2158
2159 static void nvmet_tcp_disc_port_addr(struct nvmet_req *req,
2160                 struct nvmet_port *nport, char *traddr)
2161 {
2162         struct nvmet_tcp_port *port = nport->priv;
2163
2164         if (inet_addr_is_any((struct sockaddr *)&port->addr)) {
2165                 struct nvmet_tcp_cmd *cmd =
2166                         container_of(req, struct nvmet_tcp_cmd, req);
2167                 struct nvmet_tcp_queue *queue = cmd->queue;
2168
2169                 sprintf(traddr, "%pISc", (struct sockaddr *)&queue->sockaddr);
2170         } else {
2171                 memcpy(traddr, nport->disc_addr.traddr, NVMF_TRADDR_SIZE);
2172         }
2173 }
2174
2175 static const struct nvmet_fabrics_ops nvmet_tcp_ops = {
2176         .owner                  = THIS_MODULE,
2177         .type                   = NVMF_TRTYPE_TCP,
2178         .msdbd                  = 1,
2179         .add_port               = nvmet_tcp_add_port,
2180         .remove_port            = nvmet_tcp_remove_port,
2181         .queue_response         = nvmet_tcp_queue_response,
2182         .delete_ctrl            = nvmet_tcp_delete_ctrl,
2183         .install_queue          = nvmet_tcp_install_queue,
2184         .disc_traddr            = nvmet_tcp_disc_port_addr,
2185 };
2186
2187 static int __init nvmet_tcp_init(void)
2188 {
2189         int ret;
2190
2191         nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq",
2192                                 WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
2193         if (!nvmet_tcp_wq)
2194                 return -ENOMEM;
2195
2196         ret = nvmet_register_transport(&nvmet_tcp_ops);
2197         if (ret)
2198                 goto err;
2199
2200         return 0;
2201 err:
2202         destroy_workqueue(nvmet_tcp_wq);
2203         return ret;
2204 }
2205
2206 static void __exit nvmet_tcp_exit(void)
2207 {
2208         struct nvmet_tcp_queue *queue;
2209
2210         nvmet_unregister_transport(&nvmet_tcp_ops);
2211
2212         flush_workqueue(nvmet_wq);
2213         mutex_lock(&nvmet_tcp_queue_mutex);
2214         list_for_each_entry(queue, &nvmet_tcp_queue_list, queue_list)
2215                 kernel_sock_shutdown(queue->sock, SHUT_RDWR);
2216         mutex_unlock(&nvmet_tcp_queue_mutex);
2217         flush_workqueue(nvmet_wq);
2218
2219         destroy_workqueue(nvmet_tcp_wq);
2220         ida_destroy(&nvmet_tcp_queue_ida);
2221 }
2222
2223 module_init(nvmet_tcp_init);
2224 module_exit(nvmet_tcp_exit);
2225
2226 MODULE_DESCRIPTION("NVMe target TCP transport driver");
2227 MODULE_LICENSE("GPL v2");
2228 MODULE_ALIAS("nvmet-transport-3"); /* 3 == NVMF_TRTYPE_TCP */