u32                     data_len;
        u32                     pdu_len;
        u32                     pdu_sent;
+       u32                     h2cdata_left;
+       u32                     h2cdata_offset;
        u16                     ttag;
        __le16                  status;
        struct list_head        entry;
        struct nvme_tcp_request *request;
 
        int                     queue_size;
+       u32                     maxh2cdata;
        size_t                  cmnd_capsule_len;
        struct nvme_tcp_ctrl    *ctrl;
        unsigned long           flags;
        return ret;
 }
 
-static void nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,
-               struct nvme_tcp_r2t_pdu *pdu)
+static void nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req)
 {
        struct nvme_tcp_data_pdu *data = req->pdu;
        struct nvme_tcp_queue *queue = req->queue;
        struct request *rq = blk_mq_rq_from_pdu(req);
+       u32 h2cdata_sent = req->pdu_len;
        u8 hdgst = nvme_tcp_hdgst_len(queue);
        u8 ddgst = nvme_tcp_ddgst_len(queue);
 
        req->state = NVME_TCP_SEND_H2C_PDU;
        req->offset = 0;
-       req->pdu_len = le32_to_cpu(pdu->r2t_length);
+       req->pdu_len = min(req->h2cdata_left, queue->maxh2cdata);
        req->pdu_sent = 0;
+       req->h2cdata_left -= req->pdu_len;
+       req->h2cdata_offset += h2cdata_sent;
 
        memset(data, 0, sizeof(*data));
        data->hdr.type = nvme_tcp_h2c_data;
-       data->hdr.flags = NVME_TCP_F_DATA_LAST;
+       if (!req->h2cdata_left)
+               data->hdr.flags = NVME_TCP_F_DATA_LAST;
        if (queue->hdr_digest)
                data->hdr.flags |= NVME_TCP_F_HDGST;
        if (queue->data_digest)
        data->hdr.pdo = data->hdr.hlen + hdgst;
        data->hdr.plen =
                cpu_to_le32(data->hdr.hlen + hdgst + req->pdu_len + ddgst);
-       data->ttag = pdu->ttag;
+       data->ttag = req->ttag;
        data->command_id = nvme_cid(rq);
-       data->data_offset = pdu->r2t_offset;
+       data->data_offset = cpu_to_le32(req->h2cdata_offset);
        data->data_length = cpu_to_le32(req->pdu_len);
 }
 
        struct nvme_tcp_request *req;
        struct request *rq;
        u32 r2t_length = le32_to_cpu(pdu->r2t_length);
+       u32 r2t_offset = le32_to_cpu(pdu->r2t_offset);
 
        rq = nvme_find_rq(nvme_tcp_tagset(queue), pdu->command_id);
        if (!rq) {
                return -EPROTO;
        }
 
-       if (unlikely(le32_to_cpu(pdu->r2t_offset) < req->data_sent)) {
+       if (unlikely(r2t_offset < req->data_sent)) {
                dev_err(queue->ctrl->ctrl.device,
                        "req %d unexpected r2t offset %u (expected %zu)\n",
-                       rq->tag, le32_to_cpu(pdu->r2t_offset), req->data_sent);
+                       rq->tag, r2t_offset, req->data_sent);
                return -EPROTO;
        }
 
-       nvme_tcp_setup_h2c_data_pdu(req, pdu);
+       req->pdu_len = 0;
+       req->h2cdata_left = r2t_length;
+       req->h2cdata_offset = r2t_offset;
+       req->ttag = pdu->ttag;
+
+       nvme_tcp_setup_h2c_data_pdu(req);
        nvme_tcp_queue_request(req, false, true);
 
        return 0;
 {
        struct nvme_tcp_queue *queue = req->queue;
        int req_data_len = req->data_len;
+       u32 h2cdata_left = req->h2cdata_left;
 
        while (true) {
                struct page *page = nvme_tcp_req_cur_page(req);
                                req->state = NVME_TCP_SEND_DDGST;
                                req->offset = 0;
                        } else {
-                               nvme_tcp_done_send_req(queue);
+                               if (h2cdata_left)
+                                       nvme_tcp_setup_h2c_data_pdu(req);
+                               else
+                                       nvme_tcp_done_send_req(queue);
                        }
                        return 1;
                }
        if (queue->hdr_digest && !req->offset)
                nvme_tcp_hdgst(queue->snd_hash, pdu, sizeof(*pdu));
 
-       ret = kernel_sendpage(queue->sock, virt_to_page(pdu),
-                       offset_in_page(pdu) + req->offset, len,
-                       MSG_DONTWAIT | MSG_MORE | MSG_SENDPAGE_NOTLAST);
+       if (!req->h2cdata_left)
+               ret = kernel_sendpage(queue->sock, virt_to_page(pdu),
+                               offset_in_page(pdu) + req->offset, len,
+                               MSG_DONTWAIT | MSG_MORE | MSG_SENDPAGE_NOTLAST);
+       else
+               ret = sock_no_sendpage(queue->sock, virt_to_page(pdu),
+                               offset_in_page(pdu) + req->offset, len,
+                               MSG_DONTWAIT | MSG_MORE);
        if (unlikely(ret <= 0))
                return ret;
 
 {
        struct nvme_tcp_queue *queue = req->queue;
        size_t offset = req->offset;
+       u32 h2cdata_left = req->h2cdata_left;
        int ret;
        struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
        struct kvec iov = {
                return ret;
 
        if (offset + ret == NVME_TCP_DIGEST_LENGTH) {
-               nvme_tcp_done_send_req(queue);
+               if (h2cdata_left)
+                       nvme_tcp_setup_h2c_data_pdu(req);
+               else
+                       nvme_tcp_done_send_req(queue);
                return 1;
        }
 
        struct msghdr msg = {};
        struct kvec iov;
        bool ctrl_hdgst, ctrl_ddgst;
+       u32 maxh2cdata;
        int ret;
 
        icreq = kzalloc(sizeof(*icreq), GFP_KERNEL);
                goto free_icresp;
        }
 
+       maxh2cdata = le32_to_cpu(icresp->maxdata);
+       if ((maxh2cdata % 4) || (maxh2cdata < NVME_TCP_MIN_MAXH2CDATA)) {
+               pr_err("queue %d: invalid maxh2cdata returned %u\n",
+                      nvme_tcp_queue_id(queue), maxh2cdata);
+               goto free_icresp;
+       }
+       queue->maxh2cdata = maxh2cdata;
+
        ret = 0;
 free_icresp:
        kfree(icresp);
        req->data_sent = 0;
        req->pdu_len = 0;
        req->pdu_sent = 0;
+       req->h2cdata_left = 0;
        req->data_len = blk_rq_nr_phys_segments(rq) ?
                                blk_rq_payload_bytes(rq) : 0;
        req->curr_bio = rq->bio;