iscsi_tcp_hdr_dissect(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
 {
        int rc = 0, opcode, ahslen;
-       struct iscsi_session *session = conn->session;
        struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
        struct iscsi_task *task;
 
 
        switch(opcode) {
        case ISCSI_OP_SCSI_DATA_IN:
+               spin_lock(&conn->session->lock);
                task = iscsi_itt_to_ctask(conn, hdr->itt);
                if (!task)
-                       return ISCSI_ERR_BAD_ITT;
-               if (!task->sc)
-                       return ISCSI_ERR_NO_SCSI_CMD;
+                       rc = ISCSI_ERR_BAD_ITT;
+               else
+                       rc = iscsi_data_rsp(conn, task);
+               if (rc) {
+                       spin_unlock(&conn->session->lock);
+                       break;
+               }
 
-               spin_lock(&conn->session->lock);
-               rc = iscsi_data_rsp(conn, task);
-               spin_unlock(&conn->session->lock);
-               if (rc)
-                       return rc;
                if (tcp_conn->in.datalen) {
                        struct iscsi_tcp_task *tcp_task = task->dd_data;
                        struct hash_desc *rx_hash = NULL;
                                  "datalen=%d)\n", tcp_conn,
                                  tcp_task->data_offset,
                                  tcp_conn->in.datalen);
-                       return iscsi_segment_seek_sg(&tcp_conn->in.segment,
-                                                    sdb->table.sgl,
-                                                    sdb->table.nents,
-                                                    tcp_task->data_offset,
-                                                    tcp_conn->in.datalen,
-                                                    iscsi_tcp_process_data_in,
-                                                    rx_hash);
+                       rc = iscsi_segment_seek_sg(&tcp_conn->in.segment,
+                                                  sdb->table.sgl,
+                                                  sdb->table.nents,
+                                                  tcp_task->data_offset,
+                                                  tcp_conn->in.datalen,
+                                                  iscsi_tcp_process_data_in,
+                                                  rx_hash);
+                       spin_unlock(&conn->session->lock);
+                       return rc;
                }
-               /* fall through */
+               rc = __iscsi_complete_pdu(conn, hdr, NULL, 0);
+               spin_unlock(&conn->session->lock);
+               break;
        case ISCSI_OP_SCSI_CMD_RSP:
                if (tcp_conn->in.datalen) {
                        iscsi_tcp_data_recv_prep(tcp_conn);
                rc = iscsi_complete_pdu(conn, hdr, NULL, 0);
                break;
        case ISCSI_OP_R2T:
+               spin_lock(&conn->session->lock);
                task = iscsi_itt_to_ctask(conn, hdr->itt);
                if (!task)
-                       return ISCSI_ERR_BAD_ITT;
-               if (!task->sc)
-                       return ISCSI_ERR_NO_SCSI_CMD;
-
-               if (ahslen)
+                       rc = ISCSI_ERR_BAD_ITT;
+               else if (ahslen)
                        rc = ISCSI_ERR_AHSLEN;
-               else if (task->sc->sc_data_direction == DMA_TO_DEVICE) {
-                       spin_lock(&session->lock);
+               else if (task->sc->sc_data_direction == DMA_TO_DEVICE)
                        rc = iscsi_r2t_rsp(conn, task);
-                       spin_unlock(&session->lock);
-               } else
+               else
                        rc = ISCSI_ERR_PROTO;
+               spin_unlock(&conn->session->lock);
                break;
        case ISCSI_OP_LOGIN_RSP:
        case ISCSI_OP_TEXT_RSP:
 
        spin_lock_bh(&session->lock);
        tcp_conn->sock = NULL;
-       conn->recv_lock = NULL;
        spin_unlock_bh(&session->lock);
        sockfd_put(sock);
 }
 iscsi_tcp_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
 {
        struct iscsi_conn *conn = cls_conn->dd_data;
+       struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
+
+       /* userspace may have goofed up and not bound us */
+       if (!tcp_conn->sock)
+               return;
+       /*
+        * Make sure our recv side is stopped.
+        * Older tools called conn stop before ep_disconnect
+        * so IO could still be coming in.
+        */
+       write_lock_bh(&tcp_conn->sock->sk->sk_callback_lock);
+       set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
+       write_unlock_bh(&tcp_conn->sock->sk->sk_callback_lock);
 
        iscsi_conn_stop(cls_conn, flag);
        iscsi_tcp_release_conn(conn);
        sk->sk_sndtimeo = 15 * HZ; /* FIXME: make it configurable */
        sk->sk_allocation = GFP_ATOMIC;
 
-       /* FIXME: disable Nagle's algorithm */
-
-       /*
-        * Intercept TCP callbacks for sendfile like receive
-        * processing.
-        */
-       conn->recv_lock = &sk->sk_callback_lock;
        iscsi_conn_set_callbacks(conn);
        tcp_conn->sendpage = tcp_conn->sock->ops->sendpage;
        /*
 
        }
 }
 
-static void __iscsi_get_task(struct iscsi_task *task)
+void __iscsi_get_task(struct iscsi_task *task)
 {
        atomic_inc(&task->refcount);
 }
+EXPORT_SYMBOL_GPL(__iscsi_get_task);
 
 static void __iscsi_put_task(struct iscsi_task *task)
 {
                conn->session->queued_cmdsn--;
        else
                conn->session->tt->cleanup_task(conn, task);
+       /*
+        * Check if cleanup_task dropped the lock and the command completed,
+        */
+       if (!task->sc)
+               return;
 
        sc->result = err;
-
        if (!scsi_bidi_cmnd(sc))
                scsi_set_resid(sc, scsi_bufflen(sc));
        else {
        return 0;
 }
 
+/**
+ * iscsi_itt_to_task - look up task by itt
+ * @conn: iscsi connection
+ * @itt: itt
+ *
+ * This should be used for mgmt tasks like login and nops, or if
+ * the LDD's itt space does not include the session age.
+ *
+ * The session lock must be held.
+ */
+static struct iscsi_task *iscsi_itt_to_task(struct iscsi_conn *conn, itt_t itt)
+{
+       struct iscsi_session *session = conn->session;
+       uint32_t i;
+
+       if (itt == RESERVED_ITT)
+               return NULL;
+
+       i = get_itt(itt);
+       if (i >= session->cmds_max)
+               return NULL;
+
+       return session->cmds[i];
+}
+
 /**
  * __iscsi_complete_pdu - complete pdu
  * @conn: iscsi conn
  * queuecommand or send generic. session lock must be held and verify
  * itt must have been called.
  */
-static int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
-                               char *data, int datalen)
+int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+                        char *data, int datalen)
 {
        struct iscsi_session *session = conn->session;
        int opcode = hdr->opcode & ISCSI_OPCODE_MASK, rc = 0;
                goto out;
        }
 
-       task = session->cmds[itt];
        switch(opcode) {
        case ISCSI_OP_SCSI_CMD_RSP:
-               if (!task->sc) {
-                       rc = ISCSI_ERR_NO_SCSI_CMD;
-                       break;
-               }
-               BUG_ON((void*)task != task->sc->SCp.ptr);
+       case ISCSI_OP_SCSI_DATA_IN:
+               task = iscsi_itt_to_ctask(conn, hdr->itt);
+               if (!task)
+                       return ISCSI_ERR_BAD_ITT;
+               break;
+       case ISCSI_OP_R2T:
+               /*
+                * LLD handles R2Ts if they need to.
+                */
+               return 0;
+       case ISCSI_OP_LOGOUT_RSP:
+       case ISCSI_OP_LOGIN_RSP:
+       case ISCSI_OP_TEXT_RSP:
+       case ISCSI_OP_SCSI_TMFUNC_RSP:
+       case ISCSI_OP_NOOP_IN:
+               task = iscsi_itt_to_task(conn, hdr->itt);
+               if (!task)
+                       return ISCSI_ERR_BAD_ITT;
+               break;
+       default:
+               return ISCSI_ERR_BAD_OPCODE;
+       }
+
+       switch(opcode) {
+       case ISCSI_OP_SCSI_CMD_RSP:
                iscsi_scsi_cmd_rsp(conn, hdr, task, data, datalen);
                break;
        case ISCSI_OP_SCSI_DATA_IN:
-               if (!task->sc) {
-                       rc = ISCSI_ERR_NO_SCSI_CMD;
-                       break;
-               }
-               BUG_ON((void*)task != task->sc->SCp.ptr);
                if (hdr->flags & ISCSI_FLAG_DATA_STATUS) {
                        conn->scsirsp_pdus_cnt++;
                        iscsi_update_cmdsn(session,
                        __iscsi_put_task(task);
                }
                break;
-       case ISCSI_OP_R2T:
-               /* LLD handles this for now */
-               break;
        case ISCSI_OP_LOGOUT_RSP:
                iscsi_update_cmdsn(session, (struct iscsi_nopin*)hdr);
                if (datalen) {
        __iscsi_put_task(task);
        return rc;
 }
+EXPORT_SYMBOL_GPL(__iscsi_complete_pdu);
 
 int iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                       char *data, int datalen)
 int iscsi_verify_itt(struct iscsi_conn *conn, itt_t itt)
 {
        struct iscsi_session *session = conn->session;
-       struct iscsi_task *task;
        uint32_t i;
 
        if (itt == RESERVED_ITT)
            (session->age << ISCSI_AGE_SHIFT)) {
                iscsi_conn_printk(KERN_ERR, conn,
                                  "received itt %x expected session age (%x)\n",
-                                 (__force u32)itt,
-                                 session->age & ISCSI_AGE_MASK);
+                                 (__force u32)itt, session->age);
                return ISCSI_ERR_BAD_ITT;
        }
 
                                   "%u.\n", i, session->cmds_max);
                return ISCSI_ERR_BAD_ITT;
        }
-
-       task = session->cmds[i];
-       if (task->sc && task->sc->SCp.phase != session->age) {
-               iscsi_conn_printk(KERN_ERR, conn,
-                                 "iscsi: task's session age %d, "
-                                 "expected %d\n", task->sc->SCp.phase,
-                                 session->age);
-               return ISCSI_ERR_SESSION_FAILED;
-       }
        return 0;
 }
 EXPORT_SYMBOL_GPL(iscsi_verify_itt);
 
-struct iscsi_task *
-iscsi_itt_to_ctask(struct iscsi_conn *conn, itt_t itt)
+/**
+ * iscsi_itt_to_ctask - look up ctask by itt
+ * @conn: iscsi connection
+ * @itt: itt
+ *
+ * This should be used for cmd tasks.
+ *
+ * The session lock must be held.
+ */
+struct iscsi_task *iscsi_itt_to_ctask(struct iscsi_conn *conn, itt_t itt)
 {
-       struct iscsi_session *session = conn->session;
        struct iscsi_task *task;
-       uint32_t i;
 
        if (iscsi_verify_itt(conn, itt))
                return NULL;
 
-       if (itt == RESERVED_ITT)
+       task = iscsi_itt_to_task(conn, itt);
+       if (!task || !task->sc)
                return NULL;
 
-       i = get_itt(itt);
-       if (i >= session->cmds_max)
-               return NULL;
-
-       task = session->cmds[i];
-       if (!task->sc)
-               return NULL;
-
-       if (task->sc->SCp.phase != session->age)
+       if (task->sc->SCp.phase != conn->session->age) {
+               iscsi_session_printk(KERN_ERR, conn->session,
+                                 "task's session age %d, expected %d\n",
+                                 task->sc->SCp.phase, conn->session->age);
                return NULL;
+       }
 
        return task;
 }
        switch (conn->tmf_state) {
        case TMF_SUCCESS:
                spin_unlock_bh(&session->lock);
+               /*
+                * stop tx side incase the target had sent a abort rsp but
+                * the initiator was still writing out data.
+                */
                iscsi_suspend_tx(conn);
                /*
-                * clean up task if aborted. grab the recv lock as a writer
+                * we do not stop the recv side because targets have been
+                * good and have never sent us a successful tmf response
+                * then sent more data for the cmd.
                 */
-               write_lock_bh(conn->recv_lock);
                spin_lock(&session->lock);
                fail_command(conn, task, DID_ABORT << 16);
                conn->tmf_state = TMF_INITIAL;
                spin_unlock(&session->lock);
-               write_unlock_bh(conn->recv_lock);
                iscsi_start_tx(conn);
                goto success_unlocked;
        case TMF_TIMEDOUT:
        spin_unlock_bh(&session->lock);
 
        iscsi_suspend_tx(conn);
-       /* need to grab the recv lock then session lock */
-       write_lock_bh(conn->recv_lock);
+
        spin_lock(&session->lock);
        fail_all_commands(conn, sc->device->lun, DID_ERROR);
        conn->tmf_state = TMF_INITIAL;
        spin_unlock(&session->lock);
-       write_unlock_bh(conn->recv_lock);
 
        iscsi_start_tx(conn);
        goto done;
                return;
        }
 
-       /*
-        * The LLD either freed/unset the lock on us, or userspace called
-        * stop but did not create a proper connection (connection was never
-        * bound or it was unbound then stop was called).
-        */
-       if (!conn->recv_lock) {
-               spin_unlock_bh(&session->lock);
-               mutex_unlock(&session->eh_mutex);
-               return;
-       }
-
        /*
         * When this is called for the in_login state, we only want to clean
         * up the login task and connection. We do not need to block and set
        spin_unlock_bh(&session->lock);
 
        iscsi_suspend_tx(conn);
-
-       write_lock_bh(conn->recv_lock);
-       set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
-       write_unlock_bh(conn->recv_lock);
-
        /*
         * for connection level recovery we should not calculate
         * header digest. conn->hdr_size used for optimization