[SCSI] libiscsi, iscsi_tcp: add device support
[safe/jmp/linux-2.6] / drivers / scsi / libiscsi.c
index 63f0a15..176458f 100644 (file)
@@ -22,7 +22,6 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  */
 #include <linux/types.h>
-#include <linux/mutex.h>
 #include <linux/kfifo.h>
 #include <linux/delay.h>
 #include <asm/unaligned.h>
@@ -46,27 +45,53 @@ class_to_transport_session(struct iscsi_cls_session *cls_session)
 }
 EXPORT_SYMBOL_GPL(class_to_transport_session);
 
-#define INVALID_SN_DELTA       0xffff
+/* Serial Number Arithmetic, 32 bits, less than, RFC1982 */
+#define SNA32_CHECK 2147483648UL
 
-int
-iscsi_check_assign_cmdsn(struct iscsi_session *session, struct iscsi_nopin *hdr)
+static int iscsi_sna_lt(u32 n1, u32 n2)
+{
+       return n1 != n2 && ((n1 < n2 && (n2 - n1 < SNA32_CHECK)) ||
+                           (n1 > n2 && (n2 - n1 < SNA32_CHECK)));
+}
+
+/* Serial Number Arithmetic, 32 bits, less than, RFC1982 */
+static int iscsi_sna_lte(u32 n1, u32 n2)
+{
+       return n1 == n2 || ((n1 < n2 && (n2 - n1 < SNA32_CHECK)) ||
+                           (n1 > n2 && (n2 - n1 < SNA32_CHECK)));
+}
+
+void
+iscsi_update_cmdsn(struct iscsi_session *session, struct iscsi_nopin *hdr)
 {
        uint32_t max_cmdsn = be32_to_cpu(hdr->max_cmdsn);
        uint32_t exp_cmdsn = be32_to_cpu(hdr->exp_cmdsn);
 
-       if (max_cmdsn < exp_cmdsn -1 &&
-           max_cmdsn > exp_cmdsn - INVALID_SN_DELTA)
-               return ISCSI_ERR_MAX_CMDSN;
-       if (max_cmdsn > session->max_cmdsn ||
-           max_cmdsn < session->max_cmdsn - INVALID_SN_DELTA)
-               session->max_cmdsn = max_cmdsn;
-       if (exp_cmdsn > session->exp_cmdsn ||
-           exp_cmdsn < session->exp_cmdsn - INVALID_SN_DELTA)
+       /*
+        * standard specifies this check for when to update expected and
+        * max sequence numbers
+        */
+       if (iscsi_sna_lt(max_cmdsn, exp_cmdsn - 1))
+               return;
+
+       if (exp_cmdsn != session->exp_cmdsn &&
+           !iscsi_sna_lt(exp_cmdsn, session->exp_cmdsn))
                session->exp_cmdsn = exp_cmdsn;
 
-       return 0;
+       if (max_cmdsn != session->max_cmdsn &&
+           !iscsi_sna_lt(max_cmdsn, session->max_cmdsn)) {
+               session->max_cmdsn = max_cmdsn;
+               /*
+                * if the window closed with IO queued, then kick the
+                * xmit thread
+                */
+               if (!list_empty(&session->leadconn->xmitqueue) ||
+                   !list_empty(&session->leadconn->mgmtqueue))
+                       scsi_queue_work(session->host,
+                                       &session->leadconn->xmitwork);
+       }
 }
-EXPORT_SYMBOL_GPL(iscsi_check_assign_cmdsn);
+EXPORT_SYMBOL_GPL(iscsi_update_cmdsn);
 
 void iscsi_prep_unsolicit_data_pdu(struct iscsi_cmd_task *ctask,
                                   struct iscsi_data *hdr)
@@ -115,7 +140,7 @@ static void iscsi_prep_scsi_cmd_pdu(struct iscsi_cmd_task *ctask)
         hdr->flags = ISCSI_ATTR_SIMPLE;
         int_to_scsilun(sc->device->lun, (struct scsi_lun *)hdr->lun);
         hdr->itt = build_itt(ctask->itt, conn->id, session->age);
-        hdr->data_length = cpu_to_be32(sc->request_bufflen);
+        hdr->data_length = cpu_to_be32(scsi_bufflen(sc));
         hdr->cmdsn = cpu_to_be32(session->cmdsn);
         session->cmdsn++;
         hdr->exp_statsn = cpu_to_be32(conn->exp_statsn);
@@ -147,11 +172,11 @@ static void iscsi_prep_scsi_cmd_pdu(struct iscsi_cmd_task *ctask)
                ctask->unsol_datasn = 0;
 
                if (session->imm_data_en) {
-                       if (sc->request_bufflen >= session->first_burst)
+                       if (scsi_bufflen(sc) >= session->first_burst)
                                ctask->imm_count = min(session->first_burst,
                                                        conn->max_xmit_dlength);
                        else
-                               ctask->imm_count = min(sc->request_bufflen,
+                               ctask->imm_count = min(scsi_bufflen(sc),
                                                        conn->max_xmit_dlength);
                        hton24(ctask->hdr->dlength, ctask->imm_count);
                } else
@@ -159,7 +184,7 @@ static void iscsi_prep_scsi_cmd_pdu(struct iscsi_cmd_task *ctask)
 
                if (!session->initial_r2t_en) {
                        ctask->unsol_count = min((session->first_burst),
-                               (sc->request_bufflen)) - ctask->imm_count;
+                               (scsi_bufflen(sc))) - ctask->imm_count;
                        ctask->unsol_offset = ctask->imm_count;
                }
 
@@ -175,8 +200,13 @@ static void iscsi_prep_scsi_cmd_pdu(struct iscsi_cmd_task *ctask)
        }
 
        conn->scsicmd_pdus_cnt++;
+
+        debug_scsi("iscsi prep [%s cid %d sc %p cdb 0x%x itt 0x%x len %d "
+               "cmdsn %d win %d]\n",
+                sc->sc_data_direction == DMA_TO_DEVICE ? "write" : "read",
+               conn->id, sc, sc->cmnd[0], ctask->itt, scsi_bufflen(sc),
+                session->cmdsn, session->max_cmdsn - session->exp_cmdsn + 1);
 }
-EXPORT_SYMBOL_GPL(iscsi_prep_scsi_cmd_pdu);
 
 /**
  * iscsi_complete_command - return command back to scsi-ml
@@ -205,26 +235,12 @@ static void __iscsi_get_ctask(struct iscsi_cmd_task *ctask)
        atomic_inc(&ctask->refcount);
 }
 
-static void iscsi_get_ctask(struct iscsi_cmd_task *ctask)
-{
-       spin_lock_bh(&ctask->conn->session->lock);
-       __iscsi_get_ctask(ctask);
-       spin_unlock_bh(&ctask->conn->session->lock);
-}
-
 static void __iscsi_put_ctask(struct iscsi_cmd_task *ctask)
 {
        if (atomic_dec_and_test(&ctask->refcount))
                iscsi_complete_command(ctask);
 }
 
-static void iscsi_put_ctask(struct iscsi_cmd_task *ctask)
-{
-       spin_lock_bh(&ctask->conn->session->lock);
-       __iscsi_put_ctask(ctask);
-       spin_unlock_bh(&ctask->conn->session->lock);
-}
-
 /**
  * iscsi_cmd_rsp - SCSI Command Response processing
  * @conn: iscsi connection
@@ -236,21 +252,15 @@ static void iscsi_put_ctask(struct iscsi_cmd_task *ctask)
  * iscsi_cmd_rsp sets up the scsi_cmnd fields based on the PDU and
  * then completes the command and task.
  **/
-static int iscsi_scsi_cmd_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
-                             struct iscsi_cmd_task *ctask, char *data,
-                             int datalen)
+static void iscsi_scsi_cmd_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+                              struct iscsi_cmd_task *ctask, char *data,
+                              int datalen)
 {
-       int rc;
        struct iscsi_cmd_rsp *rhdr = (struct iscsi_cmd_rsp *)hdr;
        struct iscsi_session *session = conn->session;
        struct scsi_cmnd *sc = ctask->sc;
 
-       rc = iscsi_check_assign_cmdsn(session, (struct iscsi_nopin*)rhdr);
-       if (rc) {
-               sc->result = DID_ERROR << 16;
-               goto out;
-       }
-
+       iscsi_update_cmdsn(session, (struct iscsi_nopin*)rhdr);
        conn->exp_statsn = be32_to_cpu(rhdr->statsn) + 1;
 
        sc->result = (DID_OK << 16) | rhdr->cmd_status;
@@ -281,20 +291,17 @@ invalid_datalen:
                           min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));
        }
 
-       if (sc->sc_data_direction == DMA_TO_DEVICE)
-               goto out;
-
        if (rhdr->flags & ISCSI_FLAG_CMD_UNDERFLOW) {
                int res_count = be32_to_cpu(rhdr->residual_count);
 
-               if (res_count > 0 && res_count <= sc->request_bufflen)
-                       sc->resid = res_count;
+               if (res_count > 0 && res_count <= scsi_bufflen(sc))
+                       scsi_set_resid(sc, res_count);
                else
                        sc->result = (DID_BAD_TARGET << 16) | rhdr->cmd_status;
        } else if (rhdr->flags & ISCSI_FLAG_CMD_BIDI_UNDERFLOW)
                sc->result = (DID_BAD_TARGET << 16) | rhdr->cmd_status;
        else if (rhdr->flags & ISCSI_FLAG_CMD_OVERFLOW)
-               sc->resid = be32_to_cpu(rhdr->residual_count);
+               scsi_set_resid(sc, be32_to_cpu(rhdr->residual_count));
 
 out:
        debug_scsi("done [sc %lx res %d itt 0x%x]\n",
@@ -302,7 +309,6 @@ out:
        conn->scsirsp_pdus_cnt++;
 
        __iscsi_put_ctask(ctask);
-       return rc;
 }
 
 static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
@@ -312,15 +318,15 @@ static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
        conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
        conn->tmfrsp_pdus_cnt++;
 
-       if (conn->tmabort_state != TMABORT_INITIAL)
+       if (conn->tmf_state != TMF_QUEUED)
                return;
 
        if (tmf->response == ISCSI_TMF_RSP_COMPLETE)
-               conn->tmabort_state = TMABORT_SUCCESS;
+               conn->tmf_state = TMF_SUCCESS;
        else if (tmf->response == ISCSI_TMF_RSP_NO_TASK)
-               conn->tmabort_state = TMABORT_NOT_FOUND;
+               conn->tmf_state = TMF_NOT_FOUND;
        else
-               conn->tmabort_state = TMABORT_FAILED;
+               conn->tmf_state = TMF_FAILED;
        wake_up(&conn->ehwait);
 }
 
@@ -382,8 +388,8 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                switch(opcode) {
                case ISCSI_OP_SCSI_CMD_RSP:
                        BUG_ON((void*)ctask != ctask->sc->SCp.ptr);
-                       rc = iscsi_scsi_cmd_rsp(conn, hdr, ctask, data,
-                                               datalen);
+                       iscsi_scsi_cmd_rsp(conn, hdr, ctask, data,
+                                          datalen);
                        break;
                case ISCSI_OP_SCSI_DATA_IN:
                        BUG_ON((void*)ctask != ctask->sc->SCp.ptr);
@@ -406,11 +412,7 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                debug_scsi("immrsp [op 0x%x cid %d itt 0x%x len %d]\n",
                           opcode, conn->id, mtask->itt, datalen);
 
-               rc = iscsi_check_assign_cmdsn(session,
-                                             (struct iscsi_nopin*)hdr);
-               if (rc)
-                       goto done;
-
+               iscsi_update_cmdsn(session, (struct iscsi_nopin*)hdr);
                switch(opcode) {
                case ISCSI_OP_LOGOUT_RSP:
                        if (datalen) {
@@ -427,7 +429,7 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                         */
                        if (iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen))
                                rc = ISCSI_ERR_CONN_FAILED;
-                       list_del(&mtask->running);
+                       list_del_init(&mtask->running);
                        if (conn->login_mtask != mtask)
                                __kfifo_put(session->mgmtpool.queue,
                                            (void*)&mtask, sizeof(void*));
@@ -449,20 +451,16 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
 
                        if (iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen))
                                rc = ISCSI_ERR_CONN_FAILED;
-                       list_del(&mtask->running);
-                       if (conn->login_mtask != mtask)
-                               __kfifo_put(session->mgmtpool.queue,
-                                           (void*)&mtask, sizeof(void*));
+                       list_del_init(&mtask->running);
+                       __kfifo_put(session->mgmtpool.queue,
+                                   (void*)&mtask, sizeof(void*));
                        break;
                default:
                        rc = ISCSI_ERR_BAD_OPCODE;
                        break;
                }
        } else if (itt == ~0U) {
-               rc = iscsi_check_assign_cmdsn(session,
-                                            (struct iscsi_nopin*)hdr);
-               if (rc)
-                       goto done;
+               iscsi_update_cmdsn(session, (struct iscsi_nopin*)hdr);
 
                switch(opcode) {
                case ISCSI_OP_NOOP_IN:
@@ -492,7 +490,6 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
        } else
                rc = ISCSI_ERR_BAD_ITT;
 
-done:
        return rc;
 }
 EXPORT_SYMBOL_GPL(__iscsi_complete_pdu);
@@ -579,17 +576,55 @@ void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err)
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_failure);
 
+static void iscsi_prep_mtask(struct iscsi_conn *conn,
+                            struct iscsi_mgmt_task *mtask)
+{
+       struct iscsi_session *session = conn->session;
+       struct iscsi_hdr *hdr = mtask->hdr;
+       struct iscsi_nopout *nop = (struct iscsi_nopout *)hdr;
+
+       if (hdr->opcode != (ISCSI_OP_LOGIN | ISCSI_OP_IMMEDIATE) &&
+           hdr->opcode != (ISCSI_OP_TEXT | ISCSI_OP_IMMEDIATE))
+               nop->exp_statsn = cpu_to_be32(conn->exp_statsn);
+       /*
+        * pre-format CmdSN for outgoing PDU.
+        */
+       nop->cmdsn = cpu_to_be32(session->cmdsn);
+       if (hdr->itt != RESERVED_ITT) {
+               hdr->itt = build_itt(mtask->itt, conn->id, session->age);
+               /*
+                * TODO: We always use immediate, so we never hit this.
+                * If we start to send tmfs or nops as non-immediate then
+                * we should start checking the cmdsn numbers for mgmt tasks.
+                */
+               if (conn->c_stage == ISCSI_CONN_STARTED &&
+                   !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
+                       session->queued_cmdsn++;
+                       session->cmdsn++;
+               }
+       }
+
+       if (session->tt->init_mgmt_task)
+               session->tt->init_mgmt_task(conn, mtask);
+
+       debug_scsi("mgmtpdu [op 0x%x hdr->itt 0x%x datalen %d]\n",
+                  hdr->opcode & ISCSI_OPCODE_MASK, hdr->itt,
+                  mtask->data_count);
+}
+
 static int iscsi_xmit_mtask(struct iscsi_conn *conn)
 {
        struct iscsi_hdr *hdr = conn->mtask->hdr;
        int rc, was_logout = 0;
 
+       spin_unlock_bh(&conn->session->lock);
        if ((hdr->opcode & ISCSI_OPCODE_MASK) == ISCSI_OP_LOGOUT) {
                conn->session->state = ISCSI_STATE_IN_RECOVERY;
                iscsi_block_session(session_to_cls(conn->session));
                was_logout = 1;
        }
        rc = conn->session->tt->xmit_mgmt_task(conn, conn->mtask);
+       spin_lock_bh(&conn->session->lock);
        if (rc)
                return rc;
 
@@ -603,6 +638,55 @@ static int iscsi_xmit_mtask(struct iscsi_conn *conn)
        return 0;
 }
 
+static int iscsi_check_cmdsn_window_closed(struct iscsi_conn *conn)
+{
+       struct iscsi_session *session = conn->session;
+
+       /*
+        * Check for iSCSI window and take care of CmdSN wrap-around
+        */
+       if (!iscsi_sna_lte(session->queued_cmdsn, session->max_cmdsn)) {
+               debug_scsi("iSCSI CmdSN closed. ExpCmdSn %u MaxCmdSN %u "
+                          "CmdSN %u/%u\n", session->exp_cmdsn,
+                          session->max_cmdsn, session->cmdsn,
+                          session->queued_cmdsn);
+               return -ENOSPC;
+       }
+       return 0;
+}
+
+static int iscsi_xmit_ctask(struct iscsi_conn *conn)
+{
+       struct iscsi_cmd_task *ctask = conn->ctask;
+       int rc;
+
+       __iscsi_get_ctask(ctask);
+       spin_unlock_bh(&conn->session->lock);
+       rc = conn->session->tt->xmit_cmd_task(conn, ctask);
+       spin_lock_bh(&conn->session->lock);
+       __iscsi_put_ctask(ctask);
+       if (!rc)
+               /* done with this ctask */
+               conn->ctask = NULL;
+       return rc;
+}
+
+/**
+ * iscsi_requeue_ctask - requeue ctask to run from session workqueue
+ * @ctask: ctask to requeue
+ *
+ * LLDs that need to run a ctask from the session workqueue should call
+ * this. The session lock must be held.
+ */
+void iscsi_requeue_ctask(struct iscsi_cmd_task *ctask)
+{
+       struct iscsi_conn *conn = ctask->conn;
+
+       list_move_tail(&ctask->running, &conn->requeue);
+       scsi_queue_work(conn->session->host, &conn->xmitwork);
+}
+EXPORT_SYMBOL_GPL(iscsi_requeue_ctask);
+
 /**
  * iscsi_data_xmit - xmit any command into the scheduled connection
  * @conn: iscsi connection
@@ -614,106 +698,87 @@ static int iscsi_xmit_mtask(struct iscsi_conn *conn)
  **/
 static int iscsi_data_xmit(struct iscsi_conn *conn)
 {
-       struct iscsi_transport *tt;
        int rc = 0;
 
+       spin_lock_bh(&conn->session->lock);
        if (unlikely(conn->suspend_tx)) {
                debug_scsi("conn %d Tx suspended!\n", conn->id);
+               spin_unlock_bh(&conn->session->lock);
                return -ENODATA;
        }
-       tt = conn->session->tt;
-
-       /*
-        * Transmit in the following order:
-        *
-        * 1) un-finished xmit (ctask or mtask)
-        * 2) immediate control PDUs
-        * 3) write data
-        * 4) SCSI commands
-        * 5) non-immediate control PDUs
-        *
-        * No need to lock around __kfifo_get as long as
-        * there's one producer and one consumer.
-        */
-
-       BUG_ON(conn->ctask && conn->mtask);
 
        if (conn->ctask) {
-               iscsi_get_ctask(conn->ctask);
-               rc = tt->xmit_cmd_task(conn, conn->ctask);
-               iscsi_put_ctask(conn->ctask);
+               rc = iscsi_xmit_ctask(conn);
                if (rc)
                        goto again;
-               /* done with this in-progress ctask */
-               conn->ctask = NULL;
        }
+
        if (conn->mtask) {
                rc = iscsi_xmit_mtask(conn);
                if (rc)
                        goto again;
        }
 
-       /* process immediate first */
-        if (unlikely(__kfifo_len(conn->immqueue))) {
-               while (__kfifo_get(conn->immqueue, (void*)&conn->mtask,
-                                  sizeof(void*))) {
-                       spin_lock_bh(&conn->session->lock);
-                       list_add_tail(&conn->mtask->running,
-                                     &conn->mgmt_run_list);
-                       spin_unlock_bh(&conn->session->lock);
-                       rc = iscsi_xmit_mtask(conn);
-                       if (rc)
-                               goto again;
-               }
+       /*
+        * process mgmt pdus like nops before commands since we should
+        * only have one nop-out as a ping from us and targets should not
+        * overflow us with nop-ins
+        */
+check_mgmt:
+       while (!list_empty(&conn->mgmtqueue)) {
+               conn->mtask = list_entry(conn->mgmtqueue.next,
+                                        struct iscsi_mgmt_task, running);
+               iscsi_prep_mtask(conn, conn->mtask);
+               list_move_tail(conn->mgmtqueue.next, &conn->mgmt_run_list);
+               rc = iscsi_xmit_mtask(conn);
+               if (rc)
+                       goto again;
        }
 
-       /* process command queue */
-       spin_lock_bh(&conn->session->lock);
+       /* process pending command queue */
        while (!list_empty(&conn->xmitqueue)) {
-               /*
-                * iscsi tcp may readd the task to the xmitqueue to send
-                * write data
-                */
+               if (conn->tmf_state == TMF_QUEUED)
+                       break;
+
                conn->ctask = list_entry(conn->xmitqueue.next,
                                         struct iscsi_cmd_task, running);
+               iscsi_prep_scsi_cmd_pdu(conn->ctask);
+               conn->session->tt->init_cmd_task(conn->ctask);
                conn->ctask->state = ISCSI_TASK_RUNNING;
                list_move_tail(conn->xmitqueue.next, &conn->run_list);
-               __iscsi_get_ctask(conn->ctask);
-               spin_unlock_bh(&conn->session->lock);
+               rc = iscsi_xmit_ctask(conn);
+               if (rc)
+                       goto again;
+               /*
+                * we could continuously get new ctask requests so
+                * we need to check the mgmt queue for nops that need to
+                * be sent to aviod starvation
+                */
+               if (!list_empty(&conn->mgmtqueue))
+                       goto check_mgmt;
+       }
 
-               rc = tt->xmit_cmd_task(conn, conn->ctask);
+       while (!list_empty(&conn->requeue)) {
+               if (conn->session->fast_abort && conn->tmf_state != TMF_INITIAL)
+                       break;
 
-               spin_lock_bh(&conn->session->lock);
-               __iscsi_put_ctask(conn->ctask);
-               if (rc) {
-                       spin_unlock_bh(&conn->session->lock);
+               conn->ctask = list_entry(conn->requeue.next,
+                                        struct iscsi_cmd_task, running);
+               conn->ctask->state = ISCSI_TASK_RUNNING;
+               list_move_tail(conn->requeue.next, &conn->run_list);
+               rc = iscsi_xmit_ctask(conn);
+               if (rc)
                        goto again;
-               }
+               if (!list_empty(&conn->mgmtqueue))
+                       goto check_mgmt;
        }
        spin_unlock_bh(&conn->session->lock);
-       /* done with this ctask */
-       conn->ctask = NULL;
-
-       /* process the rest control plane PDUs, if any */
-        if (unlikely(__kfifo_len(conn->mgmtqueue))) {
-               while (__kfifo_get(conn->mgmtqueue, (void*)&conn->mtask,
-                                  sizeof(void*))) {
-                       spin_lock_bh(&conn->session->lock);
-                       list_add_tail(&conn->mtask->running,
-                                     &conn->mgmt_run_list);
-                       spin_unlock_bh(&conn->session->lock);
-                       rc = iscsi_xmit_mtask(conn);
-                       if (rc)
-                               goto again;
-               }
-       }
-
        return -ENODATA;
 
 again:
        if (unlikely(conn->suspend_tx))
-               return -ENODATA;
-
+               rc = -ENODATA;
+       spin_unlock_bh(&conn->session->lock);
        return rc;
 }
 
@@ -725,11 +790,9 @@ static void iscsi_xmitworker(struct work_struct *work)
        /*
         * serialize Xmit worker on a per-connection basis.
         */
-       mutex_lock(&conn->xmitmutex);
        do {
                rc = iscsi_data_xmit(conn);
        } while (rc >= 0 || rc == -EAGAIN);
-       mutex_unlock(&conn->xmitmutex);
 }
 
 enum {
@@ -787,45 +850,34 @@ int iscsi_queuecommand(struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
                goto fault;
        }
 
-       /*
-        * Check for iSCSI window and take care of CmdSN wrap-around
-        */
-       if ((int)(session->max_cmdsn - session->cmdsn) < 0) {
-               reason = FAILURE_WINDOW_CLOSED;
-               goto reject;
-       }
-
        conn = session->leadconn;
        if (!conn) {
                reason = FAILURE_SESSION_FREED;
                goto fault;
        }
 
+       if (iscsi_check_cmdsn_window_closed(conn)) {
+               reason = FAILURE_WINDOW_CLOSED;
+               goto reject;
+       }
+
        if (!__kfifo_get(session->cmdpool.queue, (void*)&ctask,
                         sizeof(void*))) {
                reason = FAILURE_OOM;
                goto reject;
        }
+       session->queued_cmdsn++;
+
        sc->SCp.phase = session->age;
        sc->SCp.ptr = (char *)ctask;
 
        atomic_set(&ctask->refcount, 1);
        ctask->state = ISCSI_TASK_PENDING;
-       ctask->mtask = NULL;
        ctask->conn = conn;
        ctask->sc = sc;
        INIT_LIST_HEAD(&ctask->running);
-       iscsi_prep_scsi_cmd_pdu(ctask);
-
-       session->tt->init_cmd_task(ctask);
 
        list_add_tail(&ctask->running, &conn->xmitqueue);
-       debug_scsi(
-              "ctask enq [%s cid %d sc %p cdb 0x%x itt 0x%x len %d cmdsn %d "
-               "win %d]\n",
-               sc->sc_data_direction == DMA_TO_DEVICE ? "write" : "read",
-               conn->id, sc, sc->cmnd[0], ctask->itt, sc->request_bufflen,
-               session->cmdsn, session->max_cmdsn - session->exp_cmdsn + 1);
        spin_unlock(&session->lock);
 
        scsi_queue_work(host, &conn->xmitwork);
@@ -841,7 +893,7 @@ fault:
        printk(KERN_ERR "iscsi: cmd 0x%x is not queued (%d)\n",
               sc->cmnd[0], reason);
        sc->result = (DID_NO_CONNECT << 16);
-       sc->resid = sc->request_bufflen;
+       scsi_set_resid(sc, scsi_bufflen(sc));
        sc->scsi_done(sc);
        return 0;
 }
@@ -856,19 +908,16 @@ int iscsi_change_queue_depth(struct scsi_device *sdev, int depth)
 }
 EXPORT_SYMBOL_GPL(iscsi_change_queue_depth);
 
-static int
-iscsi_conn_send_generic(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
-                       char *data, uint32_t data_size)
+static struct iscsi_mgmt_task *
+__iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+                     char *data, uint32_t data_size)
 {
        struct iscsi_session *session = conn->session;
-       struct iscsi_nopout *nop = (struct iscsi_nopout *)hdr;
        struct iscsi_mgmt_task *mtask;
 
-       spin_lock_bh(&session->lock);
-       if (session->state == ISCSI_STATE_TERMINATE) {
-               spin_unlock_bh(&session->lock);
-               return -EPERM;
-       }
+       if (session->state == ISCSI_STATE_TERMINATE)
+               return NULL;
+
        if (hdr->opcode == (ISCSI_OP_LOGIN | ISCSI_OP_IMMEDIATE) ||
            hdr->opcode == (ISCSI_OP_TEXT | ISCSI_OP_IMMEDIATE))
                /*
@@ -882,80 +931,48 @@ iscsi_conn_send_generic(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
                BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
 
-               nop->exp_statsn = cpu_to_be32(conn->exp_statsn);
                if (!__kfifo_get(session->mgmtpool.queue,
-                                (void*)&mtask, sizeof(void*))) {
-                       spin_unlock_bh(&session->lock);
-                       return -ENOSPC;
-               }
+                                (void*)&mtask, sizeof(void*)))
+                       return NULL;
        }
 
-       /*
-        * pre-format CmdSN for outgoing PDU.
-        */
-       if (hdr->itt != RESERVED_ITT) {
-               hdr->itt = build_itt(mtask->itt, conn->id, session->age);
-               nop->cmdsn = cpu_to_be32(session->cmdsn);
-               if (conn->c_stage == ISCSI_CONN_STARTED &&
-                   !(hdr->opcode & ISCSI_OP_IMMEDIATE))
-                       session->cmdsn++;
-       } else
-               /* do not advance CmdSN */
-               nop->cmdsn = cpu_to_be32(session->cmdsn);
-
        if (data_size) {
                memcpy(mtask->data, data, data_size);
                mtask->data_count = data_size;
        } else
                mtask->data_count = 0;
 
-       INIT_LIST_HEAD(&mtask->running);
        memcpy(mtask->hdr, hdr, sizeof(struct iscsi_hdr));
-       if (session->tt->init_mgmt_task)
-               session->tt->init_mgmt_task(conn, mtask, data, data_size);
-       spin_unlock_bh(&session->lock);
-
-       debug_scsi("mgmtpdu [op 0x%x hdr->itt 0x%x datalen %d]\n",
-                  hdr->opcode, hdr->itt, data_size);
-
-       /*
-        * since send_pdu() could be called at least from two contexts,
-        * we need to serialize __kfifo_put, so we don't have to take
-        * additional lock on fast data-path
-        */
-        if (hdr->opcode & ISCSI_OP_IMMEDIATE)
-               __kfifo_put(conn->immqueue, (void*)&mtask, sizeof(void*));
-       else
-               __kfifo_put(conn->mgmtqueue, (void*)&mtask, sizeof(void*));
-
-       scsi_queue_work(session->host, &conn->xmitwork);
-       return 0;
+       INIT_LIST_HEAD(&mtask->running);
+       list_add_tail(&mtask->running, &conn->mgmtqueue);
+       return mtask;
 }
 
 int iscsi_conn_send_pdu(struct iscsi_cls_conn *cls_conn, struct iscsi_hdr *hdr,
                        char *data, uint32_t data_size)
 {
        struct iscsi_conn *conn = cls_conn->dd_data;
-       int rc;
-
-       mutex_lock(&conn->xmitmutex);
-       rc = iscsi_conn_send_generic(conn, hdr, data, data_size);
-       mutex_unlock(&conn->xmitmutex);
+       struct iscsi_session *session = conn->session;
+       int err = 0;
 
-       return rc;
+       spin_lock_bh(&session->lock);
+       if (!__iscsi_conn_send_pdu(conn, hdr, data, data_size))
+               err = -EPERM;
+       spin_unlock_bh(&session->lock);
+       scsi_queue_work(session->host, &conn->xmitwork);
+       return err;
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_send_pdu);
 
 void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session)
 {
        struct iscsi_session *session = class_to_transport_session(cls_session);
-       struct iscsi_conn *conn = session->leadconn;
 
        spin_lock_bh(&session->lock);
        if (session->state != ISCSI_STATE_LOGGED_IN) {
                session->state = ISCSI_STATE_RECOVERY_FAILED;
-               if (conn)
-                       wake_up(&conn->ehwait);
+               if (session->leadconn)
+                       wake_up(&session->leadconn->ehwait);
        }
        spin_unlock_bh(&session->lock);
 }
@@ -966,7 +983,6 @@ int iscsi_eh_host_reset(struct scsi_cmnd *sc)
        struct Scsi_Host *host = sc->device->host;
        struct iscsi_session *session = iscsi_hostdata(host->hostdata);
        struct iscsi_conn *conn = session->leadconn;
-       int fail_session = 0;
 
        spin_lock_bh(&session->lock);
        if (session->state == ISCSI_STATE_TERMINATE) {
@@ -977,19 +993,13 @@ failed:
                return FAILED;
        }
 
-       if (sc->SCp.phase == session->age) {
-               debug_scsi("failing connection CID %d due to SCSI host reset\n",
-                          conn->id);
-               fail_session = 1;
-       }
        spin_unlock_bh(&session->lock);
 
        /*
         * we drop the lock here but the leadconn cannot be destoyed while
         * we are in the scsi eh
         */
-       if (fail_session)
-               iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+       iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
 
        debug_scsi("iscsi_eh_host_reset wait for relogin\n");
        wait_event_interruptible(conn->ehwait,
@@ -1010,133 +1020,79 @@ failed:
 }
 EXPORT_SYMBOL_GPL(iscsi_eh_host_reset);
 
-static void iscsi_tmabort_timedout(unsigned long data)
+static void iscsi_tmf_timedout(unsigned long data)
 {
-       struct iscsi_cmd_task *ctask = (struct iscsi_cmd_task *)data;
-       struct iscsi_conn *conn = ctask->conn;
+       struct iscsi_conn *conn = (struct iscsi_conn *)data;
        struct iscsi_session *session = conn->session;
 
        spin_lock(&session->lock);
-       if (conn->tmabort_state == TMABORT_INITIAL) {
-               conn->tmabort_state = TMABORT_TIMEDOUT;
-               debug_scsi("tmabort timedout [sc %p itt 0x%x]\n",
-                       ctask->sc, ctask->itt);
+       if (conn->tmf_state == TMF_QUEUED) {
+               conn->tmf_state = TMF_TIMEDOUT;
+               debug_scsi("tmf timedout\n");
                /* unblock eh_abort() */
                wake_up(&conn->ehwait);
        }
        spin_unlock(&session->lock);
 }
 
-/* must be called with the mutex lock */
-static int iscsi_exec_abort_task(struct scsi_cmnd *sc,
-                                struct iscsi_cmd_task *ctask)
+static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn,
+                                  struct iscsi_tm *hdr, int age)
 {
-       struct iscsi_conn *conn = ctask->conn;
        struct iscsi_session *session = conn->session;
-       struct iscsi_tm *hdr = &conn->tmhdr;
-       int rc;
-
-       /*
-        * ctask timed out but session is OK requests must be serialized.
-        */
-       memset(hdr, 0, sizeof(struct iscsi_tm));
-       hdr->opcode = ISCSI_OP_SCSI_TMFUNC | ISCSI_OP_IMMEDIATE;
-       hdr->flags = ISCSI_TM_FUNC_ABORT_TASK;
-       hdr->flags |= ISCSI_FLAG_CMD_FINAL;
-       memcpy(hdr->lun, ctask->hdr->lun, sizeof(hdr->lun));
-       hdr->rtt = ctask->hdr->itt;
-       hdr->refcmdsn = ctask->hdr->cmdsn;
+       struct iscsi_mgmt_task *mtask;
 
-       rc = iscsi_conn_send_generic(conn, (struct iscsi_hdr *)hdr,
-                                    NULL, 0);
-       if (rc) {
+       mtask = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)hdr,
+                                     NULL, 0);
+       if (!mtask) {
+               spin_unlock_bh(&session->lock);
                iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
-               debug_scsi("abort sent failure [itt 0x%x] %d\n", ctask->itt,
-                          rc);
-               return rc;
+               spin_lock_bh(&session->lock);
+               debug_scsi("tmf exec failure\n");
+               return -EPERM;
        }
+       conn->tmfcmd_pdus_cnt++;
+       conn->tmf_timer.expires = 30 * HZ + jiffies;
+       conn->tmf_timer.function = iscsi_tmf_timedout;
+       conn->tmf_timer.data = (unsigned long)conn;
+       add_timer(&conn->tmf_timer);
+       debug_scsi("tmf set timeout\n");
 
-       debug_scsi("abort sent [itt 0x%x]\n", ctask->itt);
-
-       spin_lock_bh(&session->lock);
-       ctask->mtask = (struct iscsi_mgmt_task *)
-                       session->mgmt_cmds[get_itt(hdr->itt) -
-                                       ISCSI_MGMT_ITT_OFFSET];
-
-       if (conn->tmabort_state == TMABORT_INITIAL) {
-               conn->tmfcmd_pdus_cnt++;
-               conn->tmabort_timer.expires = 10*HZ + jiffies;
-               conn->tmabort_timer.function = iscsi_tmabort_timedout;
-               conn->tmabort_timer.data = (unsigned long)ctask;
-               add_timer(&conn->tmabort_timer);
-               debug_scsi("abort set timeout [itt 0x%x]\n", ctask->itt);
-       }
        spin_unlock_bh(&session->lock);
-       mutex_unlock(&conn->xmitmutex);
+       mutex_unlock(&session->eh_mutex);
+       scsi_queue_work(session->host, &conn->xmitwork);
 
        /*
         * block eh thread until:
         *
-        * 1) abort response
-        * 2) abort timeout
+        * 1) tmf response
+        * 2) tmf timeout
         * 3) session is terminated or restarted or userspace has
         * given up on recovery
         */
-       wait_event_interruptible(conn->ehwait,
-                                sc->SCp.phase != session->age ||
+       wait_event_interruptible(conn->ehwait, age != session->age ||
                                 session->state != ISCSI_STATE_LOGGED_IN ||
-                                conn->tmabort_state != TMABORT_INITIAL);
+                                conn->tmf_state != TMF_QUEUED);
        if (signal_pending(current))
                flush_signals(current);
-       del_timer_sync(&conn->tmabort_timer);
+       del_timer_sync(&conn->tmf_timer);
 
-       mutex_lock(&conn->xmitmutex);
-       return 0;
-}
-
-/*
- * xmit mutex and session lock must be held
- */
-static struct iscsi_mgmt_task *
-iscsi_remove_mgmt_task(struct kfifo *fifo, uint32_t itt)
-{
-       int i, nr_tasks = __kfifo_len(fifo) / sizeof(void*);
-       struct iscsi_mgmt_task *task;
-
-       debug_scsi("searching %d tasks\n", nr_tasks);
-
-       for (i = 0; i < nr_tasks; i++) {
-               __kfifo_get(fifo, (void*)&task, sizeof(void*));
-               debug_scsi("check task %u\n", task->itt);
-
-               if (task->itt == itt) {
-                       debug_scsi("matched task\n");
-                       return task;
-               }
+       mutex_lock(&session->eh_mutex);
+       spin_lock_bh(&session->lock);
+       /* if the session drops it will clean up the mtask */
+       if (age != session->age ||
+           session->state != ISCSI_STATE_LOGGED_IN)
+               return -ENOTCONN;
 
-               __kfifo_put(fifo, (void*)&task, sizeof(void*));
+       if (!list_empty(&mtask->running)) {
+               list_del_init(&mtask->running);
+               __kfifo_put(session->mgmtpool.queue, (void*)&mtask,
+                           sizeof(void*));
        }
-       return NULL;
-}
-
-static int iscsi_ctask_mtask_cleanup(struct iscsi_cmd_task *ctask)
-{
-       struct iscsi_conn *conn = ctask->conn;
-       struct iscsi_session *session = conn->session;
-
-       if (!ctask->mtask)
-               return -EINVAL;
-
-       if (!iscsi_remove_mgmt_task(conn->immqueue, ctask->mtask->itt))
-               list_del(&ctask->mtask->running);
-       __kfifo_put(session->mgmtpool.queue, (void*)&ctask->mtask,
-                   sizeof(void*));
-       ctask->mtask = NULL;
        return 0;
 }
 
 /*
- * session lock and xmitmutex must be held
+ * session lock must be held
  */
 static void fail_command(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask,
                         int err)
@@ -1147,122 +1103,277 @@ static void fail_command(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask,
        if (!sc)
                return;
 
-       conn->session->tt->cleanup_cmd_task(conn, ctask);
-       iscsi_ctask_mtask_cleanup(ctask);
+       if (ctask->state == ISCSI_TASK_PENDING)
+               /*
+                * cmd never made it to the xmit thread, so we should not count
+                * the cmd in the sequencing
+                */
+               conn->session->queued_cmdsn--;
+       else
+               conn->session->tt->cleanup_cmd_task(conn, ctask);
 
        sc->result = err;
-       sc->resid = sc->request_bufflen;
+       scsi_set_resid(sc, scsi_bufflen(sc));
+       if (conn->ctask == ctask)
+               conn->ctask = NULL;
        /* release ref from queuecommand */
        __iscsi_put_ctask(ctask);
 }
 
+/*
+ * Fail commands. session lock held and recv side suspended and xmit
+ * thread flushed
+ */
+static void fail_all_commands(struct iscsi_conn *conn, unsigned lun)
+{
+       struct iscsi_cmd_task *ctask, *tmp;
+
+       if (conn->ctask && (conn->ctask->sc->device->lun == lun || lun == -1))
+               conn->ctask = NULL;
+
+       /* flush pending */
+       list_for_each_entry_safe(ctask, tmp, &conn->xmitqueue, running) {
+               if (lun == ctask->sc->device->lun || lun == -1) {
+                       debug_scsi("failing pending sc %p itt 0x%x\n",
+                                  ctask->sc, ctask->itt);
+                       fail_command(conn, ctask, DID_BUS_BUSY << 16);
+               }
+       }
+
+       list_for_each_entry_safe(ctask, tmp, &conn->requeue, running) {
+               if (lun == ctask->sc->device->lun || lun == -1) {
+                       debug_scsi("failing requeued sc %p itt 0x%x\n",
+                                  ctask->sc, ctask->itt);
+                       fail_command(conn, ctask, DID_BUS_BUSY << 16);
+               }
+       }
+
+       /* fail all other running */
+       list_for_each_entry_safe(ctask, tmp, &conn->run_list, running) {
+               if (lun == ctask->sc->device->lun || lun == -1) {
+                       debug_scsi("failing in progress sc %p itt 0x%x\n",
+                                  ctask->sc, ctask->itt);
+                       fail_command(conn, ctask, DID_BUS_BUSY << 16);
+               }
+       }
+}
+
+static void iscsi_suspend_tx(struct iscsi_conn *conn)
+{
+       set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
+       scsi_flush_work(conn->session->host);
+}
+
+static void iscsi_start_tx(struct iscsi_conn *conn)
+{
+       clear_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
+       scsi_queue_work(conn->session->host, &conn->xmitwork);
+}
+
+static void iscsi_prep_abort_task_pdu(struct iscsi_cmd_task *ctask,
+                                     struct iscsi_tm *hdr)
+{
+       memset(hdr, 0, sizeof(*hdr));
+       hdr->opcode = ISCSI_OP_SCSI_TMFUNC | ISCSI_OP_IMMEDIATE;
+       hdr->flags = ISCSI_TM_FUNC_ABORT_TASK & ISCSI_FLAG_TM_FUNC_MASK;
+       hdr->flags |= ISCSI_FLAG_CMD_FINAL;
+       memcpy(hdr->lun, ctask->hdr->lun, sizeof(hdr->lun));
+       hdr->rtt = ctask->hdr->itt;
+       hdr->refcmdsn = ctask->hdr->cmdsn;
+}
+
 int iscsi_eh_abort(struct scsi_cmnd *sc)
 {
-       struct iscsi_cmd_task *ctask;
+       struct Scsi_Host *host = sc->device->host;
+       struct iscsi_session *session = iscsi_hostdata(host->hostdata);
        struct iscsi_conn *conn;
-       struct iscsi_session *session;
-       int rc;
+       struct iscsi_cmd_task *ctask;
+       struct iscsi_tm *hdr;
+       int rc, age;
 
+       mutex_lock(&session->eh_mutex);
+       spin_lock_bh(&session->lock);
        /*
         * if session was ISCSI_STATE_IN_RECOVERY then we may not have
         * got the command.
         */
        if (!sc->SCp.ptr) {
                debug_scsi("sc never reached iscsi layer or it completed.\n");
+               spin_unlock_bh(&session->lock);
+               mutex_unlock(&session->eh_mutex);
                return SUCCESS;
        }
 
-       ctask = (struct iscsi_cmd_task *)sc->SCp.ptr;
-       conn = ctask->conn;
-       session = conn->session;
-
-       conn->eh_abort_cnt++;
-       debug_scsi("aborting [sc %p itt 0x%x]\n", sc, ctask->itt);
-
-       mutex_lock(&conn->xmitmutex);
-       spin_lock_bh(&session->lock);
-
        /*
         * If we are not logged in or we have started a new session
         * then let the host reset code handle this
         */
-       if (session->state != ISCSI_STATE_LOGGED_IN ||
-           sc->SCp.phase != session->age)
-               goto failed;
+       if (!session->leadconn || session->state != ISCSI_STATE_LOGGED_IN ||
+           sc->SCp.phase != session->age) {
+               spin_unlock_bh(&session->lock);
+               mutex_unlock(&session->eh_mutex);
+               return FAILED;
+       }
+
+       conn = session->leadconn;
+       conn->eh_abort_cnt++;
+       age = session->age;
+
+       ctask = (struct iscsi_cmd_task *)sc->SCp.ptr;
+       debug_scsi("aborting [sc %p itt 0x%x]\n", sc, ctask->itt);
 
        /* ctask completed before time out */
        if (!ctask->sc) {
-               spin_unlock_bh(&session->lock);
                debug_scsi("sc completed while abort in progress\n");
-               goto success_rel_mutex;
+               goto success;
        }
 
-       /* what should we do here ? */
-       if (conn->ctask == ctask) {
-               printk(KERN_INFO "iscsi: sc %p itt 0x%x partially sent. "
-                      "Failing abort\n", sc, ctask->itt);
-               goto failed;
+       if (ctask->state == ISCSI_TASK_PENDING) {
+               fail_command(conn, ctask, DID_ABORT << 16);
+               goto success;
        }
 
-       if (ctask->state == ISCSI_TASK_PENDING)
-               goto success_cleanup;
+       /* only have one tmf outstanding at a time */
+       if (conn->tmf_state != TMF_INITIAL)
+               goto failed;
+       conn->tmf_state = TMF_QUEUED;
 
-       conn->tmabort_state = TMABORT_INITIAL;
+       hdr = &conn->tmhdr;
+       iscsi_prep_abort_task_pdu(ctask, hdr);
 
-       spin_unlock_bh(&session->lock);
-       rc = iscsi_exec_abort_task(sc, ctask);
-       spin_lock_bh(&session->lock);
-
-       if (rc || sc->SCp.phase != session->age ||
-           session->state != ISCSI_STATE_LOGGED_IN)
+       if (iscsi_exec_task_mgmt_fn(conn, hdr, age)) {
+               rc = FAILED;
                goto failed;
-       iscsi_ctask_mtask_cleanup(ctask);
+       }
 
-       switch (conn->tmabort_state) {
-       case TMABORT_SUCCESS:
-               goto success_cleanup;
-       case TMABORT_NOT_FOUND:
-               if (!ctask->sc) {
+       switch (conn->tmf_state) {
+       case TMF_SUCCESS:
+               spin_unlock_bh(&session->lock);
+               iscsi_suspend_tx(conn);
+               /*
+                * clean up task if aborted. grab the recv lock as a writer
+                */
+               write_lock_bh(conn->recv_lock);
+               spin_lock(&session->lock);
+               fail_command(conn, ctask, DID_ABORT << 16);
+               conn->tmf_state = TMF_INITIAL;
+               spin_unlock(&session->lock);
+               write_unlock_bh(conn->recv_lock);
+               iscsi_start_tx(conn);
+               goto success_unlocked;
+       case TMF_TIMEDOUT:
+               spin_unlock_bh(&session->lock);
+               iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+               goto failed_unlocked;
+       case TMF_NOT_FOUND:
+               if (!sc->SCp.ptr) {
+                       conn->tmf_state = TMF_INITIAL;
                        /* ctask completed before tmf abort response */
-                       spin_unlock_bh(&session->lock);
                        debug_scsi("sc completed while abort in progress\n");
-                       goto success_rel_mutex;
+                       goto success;
                }
                /* fall through */
        default:
-               /* timedout or failed */
-               spin_unlock_bh(&session->lock);
-               iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
-               spin_lock_bh(&session->lock);
+               conn->tmf_state = TMF_INITIAL;
                goto failed;
        }
 
-success_cleanup:
+success:
+       spin_unlock_bh(&session->lock);
+success_unlocked:
        debug_scsi("abort success [sc %lx itt 0x%x]\n", (long)sc, ctask->itt);
+       mutex_unlock(&session->eh_mutex);
+       return SUCCESS;
+
+failed:
        spin_unlock_bh(&session->lock);
+failed_unlocked:
+       debug_scsi("abort failed [sc %p itt 0x%x]\n", sc,
+                   ctask ? ctask->itt : 0);
+       mutex_unlock(&session->eh_mutex);
+       return FAILED;
+}
+EXPORT_SYMBOL_GPL(iscsi_eh_abort);
+
+static void iscsi_prep_lun_reset_pdu(struct scsi_cmnd *sc, struct iscsi_tm *hdr)
+{
+       memset(hdr, 0, sizeof(*hdr));
+       hdr->opcode = ISCSI_OP_SCSI_TMFUNC | ISCSI_OP_IMMEDIATE;
+       hdr->flags = ISCSI_TM_FUNC_LOGICAL_UNIT_RESET & ISCSI_FLAG_TM_FUNC_MASK;
+       hdr->flags |= ISCSI_FLAG_CMD_FINAL;
+       int_to_scsilun(sc->device->lun, (struct scsi_lun *)hdr->lun);
+       hdr->rtt = ISCSI_RESERVED_TAG;
+}
 
+int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+{
+       struct Scsi_Host *host = sc->device->host;
+       struct iscsi_session *session = iscsi_hostdata(host->hostdata);
+       struct iscsi_conn *conn;
+       struct iscsi_tm *hdr;
+       int rc = FAILED;
+
+       debug_scsi("LU Reset [sc %p lun %u]\n", sc, sc->device->lun);
+
+       mutex_lock(&session->eh_mutex);
+       spin_lock_bh(&session->lock);
        /*
-        * clean up task if aborted. we have the xmitmutex so grab
-        * the recv lock as a writer
+        * Just check if we are not logged in. We cannot check for
+        * the phase because the reset could come from a ioctl.
         */
+       if (!session->leadconn || session->state != ISCSI_STATE_LOGGED_IN)
+               goto unlock;
+       conn = session->leadconn;
+
+       /* only have one tmf outstanding at a time */
+       if (conn->tmf_state != TMF_INITIAL)
+               goto unlock;
+       conn->tmf_state = TMF_QUEUED;
+
+       hdr = &conn->tmhdr;
+       iscsi_prep_lun_reset_pdu(sc, hdr);
+
+       if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age)) {
+               rc = FAILED;
+               goto unlock;
+       }
+
+       switch (conn->tmf_state) {
+       case TMF_SUCCESS:
+               break;
+       case TMF_TIMEDOUT:
+               spin_unlock_bh(&session->lock);
+               iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+               goto done;
+       default:
+               conn->tmf_state = TMF_INITIAL;
+               goto unlock;
+       }
+
+       rc = SUCCESS;
+       spin_unlock_bh(&session->lock);
+
+       iscsi_suspend_tx(conn);
+       /* need to grab the recv lock then session lock */
        write_lock_bh(conn->recv_lock);
        spin_lock(&session->lock);
-       fail_command(conn, ctask, DID_ABORT << 16);
+       fail_all_commands(conn, sc->device->lun);
+       conn->tmf_state = TMF_INITIAL;
        spin_unlock(&session->lock);
        write_unlock_bh(conn->recv_lock);
 
-success_rel_mutex:
-       mutex_unlock(&conn->xmitmutex);
-       return SUCCESS;
+       iscsi_start_tx(conn);
+       goto done;
 
-failed:
+unlock:
        spin_unlock_bh(&session->lock);
-       mutex_unlock(&conn->xmitmutex);
-
-       debug_scsi("abort failed [sc %lx itt 0x%x]\n", (long)sc, ctask->itt);
-       return FAILED;
+done:
+       debug_scsi("iscsi_eh_device_reset %s\n",
+                 rc == SUCCESS ? "SUCCESS" : "FAILED");
+       mutex_unlock(&session->eh_mutex);
+       return rc;
 }
-EXPORT_SYMBOL_GPL(iscsi_eh_abort);
+EXPORT_SYMBOL_GPL(iscsi_eh_device_reset);
 
 int
 iscsi_pool_init(struct iscsi_queue *q, int max, void ***items, int item_size)
@@ -1339,6 +1450,10 @@ EXPORT_SYMBOL_GPL(iscsi_pool_free);
  * iscsi_session_setup - create iscsi cls session and host and session
  * @scsit: scsi transport template
  * @iscsit: iscsi transport template
+ * @cmds_max: scsi host can queue
+ * @qdepth: scsi host cmds per lun
+ * @cmd_task_size: LLD ctask private data size
+ * @mgmt_task_size: LLD mtask private data size
  * @initial_cmdsn: initial CmdSN
  * @hostno: host no allocated
  *
@@ -1348,6 +1463,7 @@ EXPORT_SYMBOL_GPL(iscsi_pool_free);
 struct iscsi_cls_session *
 iscsi_session_setup(struct iscsi_transport *iscsit,
                    struct scsi_transport_template *scsit,
+                   uint16_t cmds_max, uint16_t qdepth,
                    int cmd_task_size, int mgmt_task_size,
                    uint32_t initial_cmdsn, uint32_t *hostno)
 {
@@ -1356,11 +1472,32 @@ iscsi_session_setup(struct iscsi_transport *iscsit,
        struct iscsi_cls_session *cls_session;
        int cmd_i;
 
+       if (qdepth > ISCSI_MAX_CMD_PER_LUN || qdepth < 1) {
+               if (qdepth != 0)
+                       printk(KERN_ERR "iscsi: invalid queue depth of %d. "
+                             "Queue depth must be between 1 and %d.\n",
+                             qdepth, ISCSI_MAX_CMD_PER_LUN);
+               qdepth = ISCSI_DEF_CMD_PER_LUN;
+       }
+
+       if (cmds_max < 2 || (cmds_max & (cmds_max - 1)) ||
+           cmds_max >= ISCSI_MGMT_ITT_OFFSET) {
+               if (cmds_max != 0)
+                       printk(KERN_ERR "iscsi: invalid can_queue of %d. "
+                              "can_queue must be a power of 2 and between "
+                              "2 and %d - setting to %d.\n", cmds_max,
+                              ISCSI_MGMT_ITT_OFFSET, ISCSI_DEF_XMIT_CMDS_MAX);
+               cmds_max = ISCSI_DEF_XMIT_CMDS_MAX;
+       }
+
        shost = scsi_host_alloc(iscsit->host_template,
                                hostdata_privsize(sizeof(*session)));
        if (!shost)
                return NULL;
 
+       /* the iscsi layer takes one task for reserve */
+       shost->can_queue = cmds_max - 1;
+       shost->cmd_per_lun = qdepth;
        shost->max_id = 1;
        shost->max_channel = 0;
        shost->max_lun = iscsit->max_lun;
@@ -1374,12 +1511,13 @@ iscsi_session_setup(struct iscsi_transport *iscsit,
        session->host = shost;
        session->state = ISCSI_STATE_FREE;
        session->mgmtpool_max = ISCSI_MGMT_CMDS_MAX;
-       session->cmds_max = ISCSI_XMIT_CMDS_MAX;
-       session->cmdsn = initial_cmdsn;
+       session->cmds_max = cmds_max;
+       session->queued_cmdsn = session->cmdsn = initial_cmdsn;
        session->exp_cmdsn = initial_cmdsn + 1;
        session->max_cmdsn = initial_cmdsn + 1;
        session->max_r2t = 1;
        session->tt = iscsit;
+       mutex_init(&session->eh_mutex);
 
        /* initialize SCSI PDU commands pool */
        if (iscsi_pool_init(&session->cmdpool, session->cmds_max,
@@ -1456,6 +1594,7 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
        struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
        struct module *owner = cls_session->transport->owner;
 
+       iscsi_unblock_session(cls_session);
        scsi_remove_host(shost);
 
        iscsi_pool_free(&session->mgmtpool, (void**)session->mgmt_cmds);
@@ -1466,6 +1605,7 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
        kfree(session->username);
        kfree(session->username_in);
        kfree(session->targetname);
+       kfree(session->netdev);
        kfree(session->hwaddress);
        kfree(session->initiatorname);
 
@@ -1499,22 +1639,12 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, uint32_t conn_idx)
        conn->c_stage = ISCSI_CONN_INITIAL_STAGE;
        conn->id = conn_idx;
        conn->exp_statsn = 0;
-       conn->tmabort_state = TMABORT_INITIAL;
+       conn->tmf_state = TMF_INITIAL;
        INIT_LIST_HEAD(&conn->run_list);
        INIT_LIST_HEAD(&conn->mgmt_run_list);
+       INIT_LIST_HEAD(&conn->mgmtqueue);
        INIT_LIST_HEAD(&conn->xmitqueue);
-
-       /* initialize general immediate & non-immediate PDU commands queue */
-       conn->immqueue = kfifo_alloc(session->mgmtpool_max * sizeof(void*),
-                                       GFP_KERNEL, NULL);
-       if (conn->immqueue == ERR_PTR(-ENOMEM))
-               goto immqueue_alloc_fail;
-
-       conn->mgmtqueue = kfifo_alloc(session->mgmtpool_max * sizeof(void*),
-                                       GFP_KERNEL, NULL);
-       if (conn->mgmtqueue == ERR_PTR(-ENOMEM))
-               goto mgmtqueue_alloc_fail;
-
+       INIT_LIST_HEAD(&conn->requeue);
        INIT_WORK(&conn->xmitwork, iscsi_xmitworker);
 
        /* allocate login_mtask used for the login/text sequences */
@@ -1532,8 +1662,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, uint32_t conn_idx)
                goto login_mtask_data_alloc_fail;
        conn->login_mtask->data = conn->data = data;
 
-       init_timer(&conn->tmabort_timer);
-       mutex_init(&conn->xmitmutex);
+       init_timer(&conn->tmf_timer);
        init_waitqueue_head(&conn->ehwait);
 
        return cls_conn;
@@ -1542,10 +1671,6 @@ login_mtask_data_alloc_fail:
        __kfifo_put(session->mgmtpool.queue, (void*)&conn->login_mtask,
                    sizeof(void*));
 login_mtask_alloc_fail:
-       kfifo_free(conn->mgmtqueue);
-mgmtqueue_alloc_fail:
-       kfifo_free(conn->immqueue);
-immqueue_alloc_fail:
        iscsi_destroy_conn(cls_conn);
        return NULL;
 }
@@ -1564,9 +1689,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
        struct iscsi_session *session = conn->session;
        unsigned long flags;
 
-       set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
-       mutex_lock(&conn->xmitmutex);
-
        spin_lock_bh(&session->lock);
        conn->c_stage = ISCSI_CONN_CLEANUP_WAIT;
        if (session->leadconn == conn) {
@@ -1578,8 +1700,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
        }
        spin_unlock_bh(&session->lock);
 
-       mutex_unlock(&conn->xmitmutex);
-
        /*
         * Block until all in-progress commands for this connection
         * time out or fail.
@@ -1602,23 +1722,17 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
        }
 
        /* flush queued up work because we free the connection below */
-       scsi_flush_work(session->host);
+       iscsi_suspend_tx(conn);
 
        spin_lock_bh(&session->lock);
        kfree(conn->data);
        kfree(conn->persistent_address);
        __kfifo_put(session->mgmtpool.queue, (void*)&conn->login_mtask,
                    sizeof(void*));
-       if (session->leadconn == conn) {
+       if (session->leadconn == conn)
                session->leadconn = NULL;
-               /* no connections exits.. reset sequencing */
-               session->cmdsn = session->max_cmdsn = session->exp_cmdsn = 1;
-       }
        spin_unlock_bh(&session->lock);
 
-       kfifo_free(conn->immqueue);
-       kfifo_free(conn->mgmtqueue);
-
        iscsi_destroy_conn(cls_conn);
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
@@ -1644,6 +1758,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn)
        spin_lock_bh(&session->lock);
        conn->c_stage = ISCSI_CONN_STARTED;
        session->state = ISCSI_STATE_LOGGED_IN;
+       session->queued_cmdsn = session->cmdsn;
 
        switch(conn->stop_stage) {
        case STOP_CONN_RECOVER:
@@ -1652,7 +1767,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn)
                 * commands after successful recovery
                 */
                conn->stop_stage = 0;
-               conn->tmabort_state = TMABORT_INITIAL;
+               conn->tmf_state = TMF_INITIAL;
                session->age++;
                spin_unlock_bh(&session->lock);
 
@@ -1677,11 +1792,11 @@ flush_control_queues(struct iscsi_session *session, struct iscsi_conn *conn)
        struct iscsi_mgmt_task *mtask, *tmp;
 
        /* handle pending */
-       while (__kfifo_get(conn->immqueue, (void*)&mtask, sizeof(void*)) ||
-              __kfifo_get(conn->mgmtqueue, (void*)&mtask, sizeof(void*))) {
+       list_for_each_entry_safe(mtask, tmp, &conn->mgmtqueue, running) {
+               debug_scsi("flushing pending mgmt task itt 0x%x\n", mtask->itt);
+               list_del_init(&mtask->running);
                if (mtask == conn->login_mtask)
                        continue;
-               debug_scsi("flushing pending mgmt task itt 0x%x\n", mtask->itt);
                __kfifo_put(session->mgmtpool.queue, (void*)&mtask,
                            sizeof(void*));
        }
@@ -1689,7 +1804,7 @@ flush_control_queues(struct iscsi_session *session, struct iscsi_conn *conn)
        /* handle running */
        list_for_each_entry_safe(mtask, tmp, &conn->mgmt_run_list, running) {
                debug_scsi("flushing running mgmt task itt 0x%x\n", mtask->itt);
-               list_del(&mtask->running);
+               list_del_init(&mtask->running);
 
                if (mtask == conn->login_mtask)
                        continue;
@@ -1700,36 +1815,27 @@ flush_control_queues(struct iscsi_session *session, struct iscsi_conn *conn)
        conn->mtask = NULL;
 }
 
-/* Fail commands. Mutex and session lock held and recv side suspended */
-static void fail_all_commands(struct iscsi_conn *conn)
-{
-       struct iscsi_cmd_task *ctask, *tmp;
-
-       /* flush pending */
-       list_for_each_entry_safe(ctask, tmp, &conn->xmitqueue, running) {
-               debug_scsi("failing pending sc %p itt 0x%x\n", ctask->sc,
-                          ctask->itt);
-               fail_command(conn, ctask, DID_BUS_BUSY << 16);
-       }
-
-       /* fail all other running */
-       list_for_each_entry_safe(ctask, tmp, &conn->run_list, running) {
-               debug_scsi("failing in progress sc %p itt 0x%x\n",
-                          ctask->sc, ctask->itt);
-               fail_command(conn, ctask, DID_BUS_BUSY << 16);
-       }
-
-       conn->ctask = NULL;
-}
-
 static void iscsi_start_session_recovery(struct iscsi_session *session,
                                         struct iscsi_conn *conn, int flag)
 {
        int old_stop_stage;
 
+       mutex_lock(&session->eh_mutex);
        spin_lock_bh(&session->lock);
        if (conn->stop_stage == STOP_CONN_TERM) {
                spin_unlock_bh(&session->lock);
+               mutex_unlock(&session->eh_mutex);
+               return;
+       }
+
+       /*
+        * The LLD either freed/unset the lock on us, or userspace called
+        * stop but did not create a proper connection (connection was never
+        * bound or it was unbound then stop was called).
+        */
+       if (!conn->recv_lock) {
+               spin_unlock_bh(&session->lock);
+               mutex_unlock(&session->eh_mutex);
                return;
        }
 
@@ -1746,14 +1852,14 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
        old_stop_stage = conn->stop_stage;
        conn->stop_stage = flag;
        conn->c_stage = ISCSI_CONN_STOPPED;
-       set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
        spin_unlock_bh(&session->lock);
 
+       iscsi_suspend_tx(conn);
+
        write_lock_bh(conn->recv_lock);
        set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
        write_unlock_bh(conn->recv_lock);
 
-       mutex_lock(&conn->xmitmutex);
        /*
         * for connection level recovery we should not calculate
         * header digest. conn->hdr_size used for optimization
@@ -1774,11 +1880,10 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
         * flush queues.
         */
        spin_lock_bh(&session->lock);
-       fail_all_commands(conn);
+       fail_all_commands(conn, -1);
        flush_control_queues(session, conn);
        spin_unlock_bh(&session->lock);
-
-       mutex_unlock(&conn->xmitmutex);
+       mutex_unlock(&session->eh_mutex);
 }
 
 void iscsi_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
@@ -1826,6 +1931,9 @@ int iscsi_set_param(struct iscsi_cls_conn *cls_conn,
        uint32_t value;
 
        switch(param) {
+       case ISCSI_PARAM_FAST_ABORT:
+               sscanf(buf, "%d", &session->fast_abort);
+               break;
        case ISCSI_PARAM_MAX_RECV_DLENGTH:
                sscanf(buf, "%d", &conn->max_recv_dlength);
                break;
@@ -1940,6 +2048,9 @@ int iscsi_session_get_param(struct iscsi_cls_session *cls_session,
        int len;
 
        switch(param) {
+       case ISCSI_PARAM_FAST_ABORT:
+               len = sprintf(buf, "%d\n", session->fast_abort);
+               break;
        case ISCSI_PARAM_INITIAL_R2T_EN:
                len = sprintf(buf, "%d\n", session->initial_r2t_en);
                break;
@@ -2039,6 +2150,12 @@ int iscsi_host_get_param(struct Scsi_Host *shost, enum iscsi_host_param param,
        int len;
 
        switch (param) {
+       case ISCSI_HOST_PARAM_NETDEV_NAME:
+               if (!session->netdev)
+                       len = sprintf(buf, "%s\n", "default");
+               else
+                       len = sprintf(buf, "%s\n", session->netdev);
+               break;
        case ISCSI_HOST_PARAM_HWADDRESS:
                if (!session->hwaddress)
                        len = sprintf(buf, "%s\n", "default");
@@ -2066,6 +2183,10 @@ int iscsi_host_set_param(struct Scsi_Host *shost, enum iscsi_host_param param,
        struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
 
        switch (param) {
+       case ISCSI_HOST_PARAM_NETDEV_NAME:
+               if (!session->netdev)
+                       session->netdev = kstrdup(buf, GFP_KERNEL);
+               break;
        case ISCSI_HOST_PARAM_HWADDRESS:
                if (!session->hwaddress)
                        session->hwaddress = kstrdup(buf, GFP_KERNEL);