ctl_frontend_iscsi.c revision 268266
1/*-
2 * Copyright (c) 2012 The FreeBSD Foundation
3 * All rights reserved.
4 *
5 * This software was developed by Edward Tomasz Napierala under sponsorship
6 * from the FreeBSD Foundation.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 * $FreeBSD: head/sys/cam/ctl/ctl_frontend_iscsi.c 268266 2014-07-04 19:27:06Z mav $
30 */
31
32/*
33 * CTL frontend for the iSCSI protocol.
34 */
35
36#include <sys/cdefs.h>
37__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_frontend_iscsi.c 268266 2014-07-04 19:27:06Z mav $");
38
39#include <sys/param.h>
40#include <sys/capsicum.h>
41#include <sys/condvar.h>
42#include <sys/file.h>
43#include <sys/kernel.h>
44#include <sys/kthread.h>
45#include <sys/lock.h>
46#include <sys/malloc.h>
47#include <sys/module.h>
48#include <sys/mutex.h>
49#include <sys/queue.h>
50#include <sys/sbuf.h>
51#include <sys/sysctl.h>
52#include <sys/systm.h>
53#include <sys/uio.h>
54#include <sys/unistd.h>
55#include <vm/uma.h>
56
57#include <cam/scsi/scsi_all.h>
58#include <cam/scsi/scsi_da.h>
59#include <cam/ctl/ctl_io.h>
60#include <cam/ctl/ctl.h>
61#include <cam/ctl/ctl_backend.h>
62#include <cam/ctl/ctl_error.h>
63#include <cam/ctl/ctl_frontend.h>
64#include <cam/ctl/ctl_frontend_internal.h>
65#include <cam/ctl/ctl_debug.h>
66#include <cam/ctl/ctl_ha.h>
67#include <cam/ctl/ctl_ioctl.h>
68#include <cam/ctl/ctl_private.h>
69
70#include "../../dev/iscsi/icl.h"
71#include "../../dev/iscsi/iscsi_proto.h"
72#include "ctl_frontend_iscsi.h"
73
74#ifdef ICL_KERNEL_PROXY
75#include <sys/socketvar.h>
76#endif
77
78#ifdef ICL_KERNEL_PROXY
79FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
80#endif
81
82static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
83static uma_zone_t cfiscsi_data_wait_zone;
84
85SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
86    "CAM Target Layer iSCSI Frontend");
87static int debug = 3;
88SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
89    &debug, 1, "Enable debug messages");
90static int ping_timeout = 5;
91SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
92    &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
93static int login_timeout = 60;
94SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
95    &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
96static int maxcmdsn_delta = 256;
97SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
98    &maxcmdsn_delta, 256, "Number of commands the initiator can send "
99    "without confirmation");
100
101#define	CFISCSI_DEBUG(X, ...)						\
102	do {								\
103		if (debug > 1) {					\
104			printf("%s: " X "\n",				\
105			    __func__, ## __VA_ARGS__);			\
106		}							\
107	} while (0)
108
109#define	CFISCSI_WARN(X, ...)						\
110	do {								\
111		if (debug > 0) {					\
112			printf("WARNING: %s: " X "\n",			\
113			    __func__, ## __VA_ARGS__);			\
114		}							\
115	} while (0)
116
117#define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
118	do {								\
119		if (debug > 1) {					\
120			printf("%s: %s (%s): " X "\n",			\
121			    __func__, S->cs_initiator_addr,		\
122			    S->cs_initiator_name, ## __VA_ARGS__);	\
123		}							\
124	} while (0)
125
126#define	CFISCSI_SESSION_WARN(S, X, ...)					\
127	do  {								\
128		if (debug > 0) {					\
129			printf("WARNING: %s (%s): " X "\n",		\
130			    S->cs_initiator_addr,			\
131			    S->cs_initiator_name, ## __VA_ARGS__);	\
132		}							\
133	} while (0)
134
135#define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
136#define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
137#define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
138
139#define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
140#define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
141#define	PDU_EXPDATASN(X)		(X)->ip_prv0
142#define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
143#define	PDU_R2TSN(X)			(X)->ip_prv2
144
145int		cfiscsi_init(void);
146static void	cfiscsi_online(void *arg);
147static void	cfiscsi_offline(void *arg);
148static int	cfiscsi_lun_enable(void *arg,
149		    struct ctl_id target_id, int lun_id);
150static int	cfiscsi_lun_disable(void *arg,
151		    struct ctl_id target_id, int lun_id);
152static int	cfiscsi_ioctl(struct cdev *dev,
153		    u_long cmd, caddr_t addr, int flag, struct thread *td);
154static int	cfiscsi_devid(struct ctl_scsiio *ctsio, int alloc_len);
155static void	cfiscsi_datamove(union ctl_io *io);
156static void	cfiscsi_done(union ctl_io *io);
157static uint32_t	cfiscsi_map_lun(void *arg, uint32_t lun);
158static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
159static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
160static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
161static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
162static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
163static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
164static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
165static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
166		    *softc, const char *name);
167static void	cfiscsi_target_release(struct cfiscsi_target *ct);
168static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
169
170static struct cfiscsi_softc cfiscsi_softc;
171extern struct ctl_softc *control_softc;
172
173static struct ctl_frontend cfiscsi_frontend =
174{
175	.name = "iscsi",
176	.init = cfiscsi_init,
177	.ioctl = cfiscsi_ioctl,
178};
179CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
180
181static struct icl_pdu *
182cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
183{
184
185	return (icl_pdu_new_bhs(request->ip_conn, flags));
186}
187
188static bool
189cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
190{
191	const struct iscsi_bhs_scsi_command *bhssc;
192	struct cfiscsi_session *cs;
193	uint32_t cmdsn, expstatsn;
194
195	cs = PDU_SESSION(request);
196
197	/*
198	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
199	 * The purpose of the timeout is to reset the connection when it stalls;
200	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
201	 * in some queue.
202	 *
203	 * XXX: Locking?
204	 */
205	cs->cs_timeout = 0;
206
207	/*
208	 * Data-Out PDUs don't contain CmdSN.
209	 */
210	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
211	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
212		return (false);
213
214	/*
215	 * We're only using fields common for all the request
216	 * (initiator -> target) PDUs.
217	 */
218	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
219	cmdsn = ntohl(bhssc->bhssc_cmdsn);
220	expstatsn = ntohl(bhssc->bhssc_expstatsn);
221
222	CFISCSI_SESSION_LOCK(cs);
223#if 0
224	if (expstatsn != cs->cs_statsn) {
225		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
226		    "while current StatSN is %d", expstatsn,
227		    cs->cs_statsn);
228	}
229#endif
230
231	/*
232	 * The target MUST silently ignore any non-immediate command outside
233	 * of this range.
234	 */
235	if (cmdsn < cs->cs_cmdsn || cmdsn > cs->cs_cmdsn + maxcmdsn_delta) {
236		CFISCSI_SESSION_UNLOCK(cs);
237		CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %d, "
238		    "while expected CmdSN was %d", cmdsn, cs->cs_cmdsn);
239		return (true);
240	}
241
242	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0)
243		cs->cs_cmdsn++;
244
245	CFISCSI_SESSION_UNLOCK(cs);
246
247	return (false);
248}
249
250static void
251cfiscsi_pdu_handle(struct icl_pdu *request)
252{
253	struct cfiscsi_session *cs;
254	bool ignore;
255
256	cs = PDU_SESSION(request);
257
258	ignore = cfiscsi_pdu_update_cmdsn(request);
259	if (ignore) {
260		icl_pdu_free(request);
261		return;
262	}
263
264	/*
265	 * Handle the PDU; this includes e.g. receiving the remaining
266	 * part of PDU and submitting the SCSI command to CTL
267	 * or queueing a reply.  The handling routine is responsible
268	 * for freeing the PDU when it's no longer needed.
269	 */
270	switch (request->ip_bhs->bhs_opcode &
271	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
272	case ISCSI_BHS_OPCODE_NOP_OUT:
273		cfiscsi_pdu_handle_nop_out(request);
274		break;
275	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
276		cfiscsi_pdu_handle_scsi_command(request);
277		break;
278	case ISCSI_BHS_OPCODE_TASK_REQUEST:
279		cfiscsi_pdu_handle_task_request(request);
280		break;
281	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
282		cfiscsi_pdu_handle_data_out(request);
283		break;
284	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
285		cfiscsi_pdu_handle_logout_request(request);
286		break;
287	default:
288		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
289		    "opcode 0x%x; dropping connection",
290		    request->ip_bhs->bhs_opcode);
291		icl_pdu_free(request);
292		cfiscsi_session_terminate(cs);
293	}
294
295}
296
297static void
298cfiscsi_receive_callback(struct icl_pdu *request)
299{
300	struct cfiscsi_session *cs;
301
302	cs = PDU_SESSION(request);
303
304#ifdef ICL_KERNEL_PROXY
305	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
306		if (cs->cs_login_pdu == NULL)
307			cs->cs_login_pdu = request;
308		else
309			icl_pdu_free(request);
310		cv_signal(&cs->cs_login_cv);
311		return;
312	}
313#endif
314
315	cfiscsi_pdu_handle(request);
316}
317
318static void
319cfiscsi_error_callback(struct icl_conn *ic)
320{
321	struct cfiscsi_session *cs;
322
323	cs = CONN_SESSION(ic);
324
325	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
326	cfiscsi_session_terminate(cs);
327}
328
329static int
330cfiscsi_pdu_prepare(struct icl_pdu *response)
331{
332	struct cfiscsi_session *cs;
333	struct iscsi_bhs_scsi_response *bhssr;
334	bool advance_statsn = true;
335
336	cs = PDU_SESSION(response);
337
338	CFISCSI_SESSION_LOCK_ASSERT(cs);
339
340	/*
341	 * We're only using fields common for all the response
342	 * (target -> initiator) PDUs.
343	 */
344	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
345
346	/*
347	 * 10.8.3: "The StatSN for this connection is not advanced
348	 * after this PDU is sent."
349	 */
350	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
351		advance_statsn = false;
352
353	/*
354	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
355	 * StatSN for the connection is not advanced after this PDU is sent."
356	 */
357	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
358	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
359		advance_statsn = false;
360
361	/*
362	 * See the comment below - StatSN is not meaningful and must
363	 * not be advanced.
364	 */
365	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN)
366		advance_statsn = false;
367
368	/*
369	 * 10.7.3: "The fields StatSN, Status, and Residual Count
370	 * only have meaningful content if the S bit is set to 1."
371	 */
372	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN)
373		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
374	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
375	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
376
377	if (advance_statsn)
378		cs->cs_statsn++;
379
380	return (0);
381}
382
383static void
384cfiscsi_pdu_queue(struct icl_pdu *response)
385{
386	struct cfiscsi_session *cs;
387
388	cs = PDU_SESSION(response);
389
390	CFISCSI_SESSION_LOCK(cs);
391	cfiscsi_pdu_prepare(response);
392	icl_pdu_queue(response);
393	CFISCSI_SESSION_UNLOCK(cs);
394}
395
396static uint32_t
397cfiscsi_decode_lun(uint64_t encoded)
398{
399	uint8_t lun[8];
400	uint32_t result;
401
402	/*
403	 * The LUN field in iSCSI PDUs may look like an ordinary 64 bit number,
404	 * but is in fact an evil, multidimensional structure defined
405	 * in SCSI Architecture Model 5 (SAM-5), section 4.6.
406	 */
407	memcpy(lun, &encoded, sizeof(lun));
408	switch (lun[0] & 0xC0) {
409	case 0x00:
410		if ((lun[0] & 0x3f) != 0 || lun[2] != 0 || lun[3] != 0 ||
411		    lun[4] != 0 || lun[5] != 0 || lun[6] != 0 || lun[7] != 0) {
412			CFISCSI_WARN("malformed LUN "
413			    "(peripheral device addressing method): 0x%jx",
414			    (uintmax_t)encoded);
415			result = 0xffffffff;
416			break;
417		}
418		result = lun[1];
419		break;
420	case 0x40:
421		if (lun[2] != 0 || lun[3] != 0 || lun[4] != 0 || lun[5] != 0 ||
422		    lun[6] != 0 || lun[7] != 0) {
423			CFISCSI_WARN("malformed LUN "
424			    "(flat address space addressing method): 0x%jx",
425			    (uintmax_t)encoded);
426			result = 0xffffffff;
427			break;
428		}
429		result = ((lun[0] & 0x3f) << 8) + lun[1];
430		break;
431	case 0xC0:
432		if (lun[0] != 0xD2 || lun[4] != 0 || lun[5] != 0 ||
433		    lun[6] != 0 || lun[7] != 0) {
434			CFISCSI_WARN("malformed LUN (extended flat "
435			    "address space addressing method): 0x%jx",
436			    (uintmax_t)encoded);
437			result = 0xffffffff;
438			break;
439		}
440		result = (lun[1] << 16) + (lun[2] << 8) + lun[3];
441	default:
442		CFISCSI_WARN("unsupported LUN format 0x%jx",
443		    (uintmax_t)encoded);
444		result = 0xffffffff;
445		break;
446	}
447
448	return (result);
449}
450
451static void
452cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
453{
454	struct cfiscsi_session *cs;
455	struct iscsi_bhs_nop_out *bhsno;
456	struct iscsi_bhs_nop_in *bhsni;
457	struct icl_pdu *response;
458	void *data = NULL;
459	size_t datasize;
460	int error;
461
462	cs = PDU_SESSION(request);
463	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
464
465	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
466		/*
467		 * Nothing to do, iscsi_pdu_update_statsn() already
468		 * zeroed the timeout.
469		 */
470		icl_pdu_free(request);
471		return;
472	}
473
474	datasize = icl_pdu_data_segment_length(request);
475	if (datasize > 0) {
476		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
477		if (data == NULL) {
478			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
479			    "dropping connection");
480			icl_pdu_free(request);
481			cfiscsi_session_terminate(cs);
482			return;
483		}
484		icl_pdu_get_data(request, 0, data, datasize);
485	}
486
487	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
488	if (response == NULL) {
489		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
490		    "droppping connection");
491		free(data, M_CFISCSI);
492		icl_pdu_free(request);
493		cfiscsi_session_terminate(cs);
494		return;
495	}
496	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
497	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
498	bhsni->bhsni_flags = 0x80;
499	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
500	bhsni->bhsni_target_transfer_tag = 0xffffffff;
501	if (datasize > 0) {
502		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
503		if (error != 0) {
504			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
505			    "dropping connection");
506			free(data, M_CFISCSI);
507			icl_pdu_free(request);
508			icl_pdu_free(response);
509			cfiscsi_session_terminate(cs);
510			return;
511		}
512		free(data, M_CFISCSI);
513	}
514
515	icl_pdu_free(request);
516	cfiscsi_pdu_queue(response);
517}
518
519static void
520cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
521{
522	struct iscsi_bhs_scsi_command *bhssc;
523	struct cfiscsi_session *cs;
524	union ctl_io *io;
525	int error;
526
527	cs = PDU_SESSION(request);
528	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
529	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
530	//    bhssc->bhssc_initiator_task_tag);
531
532	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
533		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
534		    "ImmediateData=No; dropping connection");
535		icl_pdu_free(request);
536		cfiscsi_session_terminate(cs);
537		return;
538	}
539	io = ctl_alloc_io(cs->cs_target->ct_softc->port.ctl_pool_ref);
540	if (io == NULL) {
541		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io; "
542		    "dropping connection");
543		icl_pdu_free(request);
544		cfiscsi_session_terminate(cs);
545		return;
546	}
547	ctl_zero_io(io);
548	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
549	io->io_hdr.io_type = CTL_IO_SCSI;
550	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
551	io->io_hdr.nexus.targ_port = cs->cs_target->ct_softc->port.targ_port;
552	io->io_hdr.nexus.targ_target.id = 0;
553	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhssc->bhssc_lun);
554	io->io_hdr.nexus.lun_map_fn = cfiscsi_map_lun;
555	io->io_hdr.nexus.lun_map_arg = cs;
556	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
557	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
558	case BHSSC_FLAGS_ATTR_UNTAGGED:
559		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
560		break;
561	case BHSSC_FLAGS_ATTR_SIMPLE:
562		io->scsiio.tag_type = CTL_TAG_SIMPLE;
563		break;
564	case BHSSC_FLAGS_ATTR_ORDERED:
565        	io->scsiio.tag_type = CTL_TAG_ORDERED;
566		break;
567	case BHSSC_FLAGS_ATTR_HOQ:
568        	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
569		break;
570	case BHSSC_FLAGS_ATTR_ACA:
571		io->scsiio.tag_type = CTL_TAG_ACA;
572		break;
573	default:
574		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
575		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
576		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
577		break;
578	}
579	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
580	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
581	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
582	error = ctl_queue(io);
583	if (error != CTL_RETVAL_COMPLETE) {
584		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
585		    "dropping connection", error);
586		ctl_free_io(io);
587		refcount_release(&cs->cs_outstanding_ctl_pdus);
588		icl_pdu_free(request);
589		cfiscsi_session_terminate(cs);
590	}
591}
592
593static void
594cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
595{
596	struct iscsi_bhs_task_management_request *bhstmr;
597	struct iscsi_bhs_task_management_response *bhstmr2;
598	struct icl_pdu *response;
599	struct cfiscsi_session *cs;
600	union ctl_io *io;
601	int error;
602
603	cs = PDU_SESSION(request);
604	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
605	io = ctl_alloc_io(cs->cs_target->ct_softc->port.ctl_pool_ref);
606	if (io == NULL) {
607		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io;"
608		    "dropping connection");
609		icl_pdu_free(request);
610		cfiscsi_session_terminate(cs);
611		return;
612	}
613	ctl_zero_io(io);
614	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
615	io->io_hdr.io_type = CTL_IO_TASK;
616	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
617	io->io_hdr.nexus.targ_port = cs->cs_target->ct_softc->port.targ_port;
618	io->io_hdr.nexus.targ_target.id = 0;
619	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhstmr->bhstmr_lun);
620	io->io_hdr.nexus.lun_map_fn = cfiscsi_map_lun;
621	io->io_hdr.nexus.lun_map_arg = cs;
622	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
623
624	switch (bhstmr->bhstmr_function & ~0x80) {
625	case BHSTMR_FUNCTION_ABORT_TASK:
626#if 0
627		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
628#endif
629		io->taskio.task_action = CTL_TASK_ABORT_TASK;
630		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
631		break;
632	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
633#if 0
634		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
635#endif
636		io->taskio.task_action = CTL_TASK_LUN_RESET;
637		break;
638	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
639#if 0
640		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
641#endif
642		io->taskio.task_action = CTL_TASK_TARGET_RESET;
643		break;
644	default:
645		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
646		    bhstmr->bhstmr_function & ~0x80);
647		ctl_free_io(io);
648
649		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
650		if (response == NULL) {
651			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
652			    "dropping connection");
653			icl_pdu_free(request);
654			cfiscsi_session_terminate(cs);
655			return;
656		}
657		bhstmr2 = (struct iscsi_bhs_task_management_response *)
658		    response->ip_bhs;
659		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
660		bhstmr2->bhstmr_flags = 0x80;
661		bhstmr2->bhstmr_response =
662		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
663		bhstmr2->bhstmr_initiator_task_tag =
664		    bhstmr->bhstmr_initiator_task_tag;
665		icl_pdu_free(request);
666		cfiscsi_pdu_queue(response);
667		return;
668	}
669
670	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
671	error = ctl_queue(io);
672	if (error != CTL_RETVAL_COMPLETE) {
673		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
674		    "dropping connection", error);
675		ctl_free_io(io);
676		refcount_release(&cs->cs_outstanding_ctl_pdus);
677		icl_pdu_free(request);
678		cfiscsi_session_terminate(cs);
679	}
680}
681
682static bool
683cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
684{
685	struct iscsi_bhs_data_out *bhsdo;
686	struct cfiscsi_session *cs;
687	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
688	size_t copy_len, len, off, buffer_offset;
689	int ctl_sg_count;
690	union ctl_io *io;
691
692	cs = PDU_SESSION(request);
693
694	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
695	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
696	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
697	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
698	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
699
700	/*
701	 * We're only using fields common for Data-Out and SCSI Command PDUs.
702	 */
703	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
704
705	io = cdw->cdw_ctl_io;
706	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
707	    ("CTL_FLAG_DATA_IN"));
708
709#if 0
710	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
711	    request->ip_data_len, io->scsiio.kern_total_len);
712#endif
713
714	if (io->scsiio.kern_sg_entries > 0) {
715		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
716		ctl_sg_count = io->scsiio.kern_sg_entries;
717	} else {
718		ctl_sglist = &ctl_sg_entry;
719		ctl_sglist->addr = io->scsiio.kern_data_ptr;
720		ctl_sglist->len = io->scsiio.kern_data_len;
721		ctl_sg_count = 1;
722	}
723
724	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
725	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
726		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
727	else
728		buffer_offset = 0;
729	len = icl_pdu_data_segment_length(request);
730
731	/*
732	 * Make sure the offset, as sent by the initiator, matches the offset
733	 * we're supposed to be at in the scatter-gather list.
734	 */
735	if (buffer_offset >
736	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
737	    buffer_offset + len <=
738	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
739		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
740		    "expected %zd; dropping connection", buffer_offset,
741		    (size_t)io->scsiio.kern_rel_offset +
742		    (size_t)io->scsiio.ext_data_filled);
743		ctl_set_data_phase_error(&io->scsiio);
744		cfiscsi_session_terminate(cs);
745		return (true);
746	}
747
748	/*
749	 * This is the offset within the PDU data segment, as opposed
750	 * to buffer_offset, which is the offset within the task (SCSI
751	 * command).
752	 */
753	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
754	    buffer_offset;
755
756	/*
757	 * Iterate over the scatter/gather segments, filling them with data
758	 * from the PDU data segment.  Note that this can get called multiple
759	 * times for one SCSI command; the cdw structure holds state for the
760	 * scatter/gather list.
761	 */
762	for (;;) {
763		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
764		    ("cdw->cdw_sg_index >= ctl_sg_count"));
765		if (cdw->cdw_sg_len == 0) {
766			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
767			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
768		}
769		KASSERT(off <= len, ("len > off"));
770		copy_len = len - off;
771		if (copy_len > cdw->cdw_sg_len)
772			copy_len = cdw->cdw_sg_len;
773
774		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
775		cdw->cdw_sg_addr += copy_len;
776		cdw->cdw_sg_len -= copy_len;
777		off += copy_len;
778		io->scsiio.ext_data_filled += copy_len;
779
780		if (cdw->cdw_sg_len == 0) {
781			/*
782			 * End of current segment.
783			 */
784			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
785				/*
786				 * Last segment in scatter/gather list.
787				 */
788				break;
789			}
790			cdw->cdw_sg_index++;
791		}
792
793		if (off == len) {
794			/*
795			 * End of PDU payload.
796			 */
797			break;
798		}
799	}
800
801	if (len > off) {
802		/*
803		 * In case of unsolicited data, it's possible that the buffer
804		 * provided by CTL is smaller than negotiated FirstBurstLength.
805		 * Just ignore the superfluous data; will ask for them with R2T
806		 * on next call to cfiscsi_datamove().
807		 *
808		 * This obviously can only happen with SCSI Command PDU.
809		 */
810		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
811		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
812			return (true);
813
814		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
815		    "expected %zd; dropping connection",
816		    icl_pdu_data_segment_length(request), off);
817		ctl_set_data_phase_error(&io->scsiio);
818		cfiscsi_session_terminate(cs);
819		return (true);
820	}
821
822	if (io->scsiio.ext_data_filled == io->scsiio.kern_data_len &&
823	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
824		CFISCSI_SESSION_WARN(cs, "got the final packet without "
825		    "the F flag; flags = 0x%x; dropping connection",
826		    bhsdo->bhsdo_flags);
827		ctl_set_data_phase_error(&io->scsiio);
828		cfiscsi_session_terminate(cs);
829		return (true);
830	}
831
832	if (io->scsiio.ext_data_filled != io->scsiio.kern_data_len &&
833	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
834		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
835		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
836			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
837			    "transmitted size was %zd bytes instead of %d; "
838			    "dropping connection",
839			    (size_t)io->scsiio.ext_data_filled,
840			    io->scsiio.kern_data_len);
841			ctl_set_data_phase_error(&io->scsiio);
842			cfiscsi_session_terminate(cs);
843			return (true);
844		} else {
845			/*
846			 * For SCSI Command PDU, this just means we need to
847			 * solicit more data by sending R2T.
848			 */
849			return (false);
850		}
851	}
852
853	if (io->scsiio.ext_data_filled == io->scsiio.kern_data_len) {
854#if 0
855		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
856		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
857#endif
858
859		return (true);
860	}
861
862	return (false);
863}
864
865static void
866cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
867{
868	struct iscsi_bhs_data_out *bhsdo;
869	struct cfiscsi_session *cs;
870	struct cfiscsi_data_wait *cdw = NULL;
871	union ctl_io *io;
872	bool done;
873
874	cs = PDU_SESSION(request);
875	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
876
877	CFISCSI_SESSION_LOCK(cs);
878	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
879#if 0
880		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
881		    "ttt 0x%x, itt 0x%x",
882		    bhsdo->bhsdo_target_transfer_tag,
883		    bhsdo->bhsdo_initiator_task_tag,
884		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
885#endif
886		if (bhsdo->bhsdo_target_transfer_tag ==
887		    cdw->cdw_target_transfer_tag)
888			break;
889	}
890	CFISCSI_SESSION_UNLOCK(cs);
891	if (cdw == NULL) {
892		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
893		    "0x%x, not found; dropping connection",
894		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
895		icl_pdu_free(request);
896		cfiscsi_session_terminate(cs);
897		return;
898	}
899
900	io = cdw->cdw_ctl_io;
901	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
902	    ("CTL_FLAG_DATA_IN"));
903
904	done = cfiscsi_handle_data_segment(request, cdw);
905	if (done) {
906		CFISCSI_SESSION_LOCK(cs);
907		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
908		CFISCSI_SESSION_UNLOCK(cs);
909		uma_zfree(cfiscsi_data_wait_zone, cdw);
910		io->scsiio.be_move_done(io);
911	}
912
913	icl_pdu_free(request);
914}
915
916static void
917cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
918{
919	struct iscsi_bhs_logout_request *bhslr;
920	struct iscsi_bhs_logout_response *bhslr2;
921	struct icl_pdu *response;
922	struct cfiscsi_session *cs;
923
924	cs = PDU_SESSION(request);
925	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
926	switch (bhslr->bhslr_reason & 0x7f) {
927	case BHSLR_REASON_CLOSE_SESSION:
928	case BHSLR_REASON_CLOSE_CONNECTION:
929		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
930		if (response == NULL) {
931			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
932			icl_pdu_free(request);
933			cfiscsi_session_terminate(cs);
934			return;
935		}
936		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
937		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
938		bhslr2->bhslr_flags = 0x80;
939		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
940		bhslr2->bhslr_initiator_task_tag =
941		    bhslr->bhslr_initiator_task_tag;
942		icl_pdu_free(request);
943		cfiscsi_pdu_queue(response);
944		cfiscsi_session_terminate(cs);
945		break;
946	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
947		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
948		if (response == NULL) {
949			CFISCSI_SESSION_WARN(cs,
950			    "failed to allocate memory; dropping connection");
951			icl_pdu_free(request);
952			cfiscsi_session_terminate(cs);
953			return;
954		}
955		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
956		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
957		bhslr2->bhslr_flags = 0x80;
958		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
959		bhslr2->bhslr_initiator_task_tag =
960		    bhslr->bhslr_initiator_task_tag;
961		icl_pdu_free(request);
962		cfiscsi_pdu_queue(response);
963		break;
964	default:
965		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
966		    bhslr->bhslr_reason);
967		icl_pdu_free(request);
968		cfiscsi_session_terminate(cs);
969		break;
970	}
971}
972
973static void
974cfiscsi_callout(void *context)
975{
976	struct icl_pdu *cp;
977	struct iscsi_bhs_nop_in *bhsni;
978	struct cfiscsi_session *cs;
979
980	cs = context;
981
982	if (cs->cs_terminating)
983		return;
984
985	callout_schedule(&cs->cs_callout, 1 * hz);
986
987	atomic_add_int(&cs->cs_timeout, 1);
988
989#ifdef ICL_KERNEL_PROXY
990	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
991		if (cs->cs_timeout > login_timeout) {
992			CFISCSI_SESSION_WARN(cs, "login timed out after "
993			    "%d seconds; dropping connection", cs->cs_timeout);
994			cfiscsi_session_terminate(cs);
995		}
996		return;
997	}
998#endif
999
1000	if (cs->cs_timeout >= ping_timeout) {
1001		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1002		    "dropping connection",  ping_timeout);
1003		cfiscsi_session_terminate(cs);
1004		return;
1005	}
1006
1007	/*
1008	 * If the ping was reset less than one second ago - which means
1009	 * that we've received some PDU during the last second - assume
1010	 * the traffic flows correctly and don't bother sending a NOP-Out.
1011	 *
1012	 * (It's 2 - one for one second, and one for incrementing is_timeout
1013	 * earlier in this routine.)
1014	 */
1015	if (cs->cs_timeout < 2)
1016		return;
1017
1018	cp = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1019	if (cp == NULL) {
1020		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1021		return;
1022	}
1023	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1024	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1025	bhsni->bhsni_flags = 0x80;
1026	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1027
1028	cfiscsi_pdu_queue(cp);
1029}
1030
1031static void
1032cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1033{
1034	struct cfiscsi_data_wait *cdw, *tmpcdw;
1035	union ctl_io *io;
1036	int error, last;
1037
1038#ifdef notyet
1039	io = ctl_alloc_io(cs->cs_target->ct_softc->port.ctl_pool_ref);
1040	if (io == NULL) {
1041		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io");
1042		return;
1043	}
1044	ctl_zero_io(io);
1045	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = NULL;
1046	io->io_hdr.io_type = CTL_IO_TASK;
1047	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1048	io->io_hdr.nexus.targ_port = cs->cs_target->ct_softc->port.targ_port;
1049	io->io_hdr.nexus.targ_target.id = 0;
1050	io->io_hdr.nexus.targ_lun = lun;
1051	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1052	io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
1053	error = ctl_queue(io);
1054	if (error != CTL_RETVAL_COMPLETE) {
1055		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1056		ctl_free_io(io);
1057	}
1058#else
1059	/*
1060	 * CTL doesn't currently support CTL_TASK_ABORT_TASK_SET, so instead
1061	 * just iterate over tasks that are waiting for something - data - and
1062	 * terminate those.
1063	 */
1064	CFISCSI_SESSION_LOCK(cs);
1065	TAILQ_FOREACH_SAFE(cdw,
1066	    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
1067		io = ctl_alloc_io(cs->cs_target->ct_softc->port.ctl_pool_ref);
1068		if (io == NULL) {
1069			CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io");
1070			return;
1071		}
1072		ctl_zero_io(io);
1073		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = NULL;
1074		io->io_hdr.io_type = CTL_IO_TASK;
1075		io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1076		io->io_hdr.nexus.targ_port =
1077		    cs->cs_target->ct_softc->port.targ_port;
1078		io->io_hdr.nexus.targ_target.id = 0;
1079		//io->io_hdr.nexus.targ_lun = lun; /* Not needed? */
1080		io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1081		io->taskio.task_action = CTL_TASK_ABORT_TASK;
1082		io->taskio.tag_num = cdw->cdw_initiator_task_tag;
1083		error = ctl_queue(io);
1084		if (error != CTL_RETVAL_COMPLETE) {
1085			CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1086			ctl_free_io(io);
1087			return;
1088		}
1089#if 0
1090		CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task tag "
1091		    "0x%x", cdw->cdw_initiator_task_tag);
1092#endif
1093		/*
1094		 * Set nonzero port status; this prevents backends from
1095		 * assuming that the data transfer actually succeeded
1096		 * and writing uninitialized data to disk.
1097		 */
1098		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1099		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1100		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1101		uma_zfree(cfiscsi_data_wait_zone, cdw);
1102	}
1103	CFISCSI_SESSION_UNLOCK(cs);
1104#endif
1105
1106	/*
1107	 * Wait for CTL to terminate all the tasks.
1108	 */
1109	for (;;) {
1110		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1111		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1112		if (last != 0)
1113			break;
1114		CFISCSI_SESSION_WARN(cs, "waiting for CTL to terminate tasks, "
1115		    "%d remaining", cs->cs_outstanding_ctl_pdus);
1116		pause("cfiscsi_terminate", 1);
1117	}
1118}
1119
1120static void
1121cfiscsi_maintenance_thread(void *arg)
1122{
1123	struct cfiscsi_session *cs;
1124
1125	cs = arg;
1126
1127	for (;;) {
1128		CFISCSI_SESSION_LOCK(cs);
1129		if (cs->cs_terminating == false)
1130			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1131		CFISCSI_SESSION_UNLOCK(cs);
1132
1133		if (cs->cs_terminating) {
1134
1135			/*
1136			 * We used to wait up to 30 seconds to deliver queued
1137			 * PDUs to the initiator.  We also tried hard to deliver
1138			 * SCSI Responses for the aborted PDUs.  We don't do
1139			 * that anymore.  We might need to revisit that.
1140			 */
1141			callout_drain(&cs->cs_callout);
1142			icl_conn_shutdown(cs->cs_conn);
1143			icl_conn_close(cs->cs_conn);
1144
1145			/*
1146			 * At this point ICL receive thread is no longer
1147			 * running; no new tasks can be queued.
1148			 */
1149			cfiscsi_session_terminate_tasks(cs);
1150			cfiscsi_session_delete(cs);
1151			kthread_exit();
1152			return;
1153		}
1154		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1155	}
1156}
1157
1158static void
1159cfiscsi_session_terminate(struct cfiscsi_session *cs)
1160{
1161
1162	if (cs->cs_terminating)
1163		return;
1164	cs->cs_terminating = true;
1165	cv_signal(&cs->cs_maintenance_cv);
1166#ifdef ICL_KERNEL_PROXY
1167	cv_signal(&cs->cs_login_cv);
1168#endif
1169}
1170
1171static int
1172cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1173{
1174	int error, i;
1175	struct cfiscsi_softc *softc;
1176
1177	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1178
1179	softc = &cfiscsi_softc;
1180
1181	mtx_lock(&softc->lock);
1182	for (i = 0; i < softc->max_initiators; i++) {
1183		if (softc->ctl_initids[i] == 0)
1184			break;
1185	}
1186	if (i == softc->max_initiators) {
1187		CFISCSI_SESSION_WARN(cs, "too many concurrent sessions (%d)",
1188		    softc->max_initiators);
1189		mtx_unlock(&softc->lock);
1190		return (1);
1191	}
1192	softc->ctl_initids[i] = 1;
1193	mtx_unlock(&softc->lock);
1194
1195#if 0
1196	CFISCSI_SESSION_DEBUG(cs, "adding initiator id %d, max %d",
1197	    i, softc->max_initiators);
1198#endif
1199	cs->cs_ctl_initid = i;
1200	error = ctl_add_initiator(0x0, softc->port.targ_port, cs->cs_ctl_initid);
1201	if (error != 0) {
1202		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d", error);
1203		mtx_lock(&softc->lock);
1204		softc->ctl_initids[cs->cs_ctl_initid] = 0;
1205		mtx_unlock(&softc->lock);
1206		cs->cs_ctl_initid = -1;
1207		return (1);
1208	}
1209
1210	return (0);
1211}
1212
1213static void
1214cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1215{
1216	int error;
1217	struct cfiscsi_softc *softc;
1218
1219	if (cs->cs_ctl_initid == -1)
1220		return;
1221
1222	softc = &cfiscsi_softc;
1223
1224	error = ctl_remove_initiator(softc->port.targ_port, cs->cs_ctl_initid);
1225	if (error != 0) {
1226		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1227		    error);
1228	}
1229	mtx_lock(&softc->lock);
1230	softc->ctl_initids[cs->cs_ctl_initid] = 0;
1231	mtx_unlock(&softc->lock);
1232	cs->cs_ctl_initid = -1;
1233}
1234
1235static struct cfiscsi_session *
1236cfiscsi_session_new(struct cfiscsi_softc *softc)
1237{
1238	struct cfiscsi_session *cs;
1239	int error;
1240
1241	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1242	if (cs == NULL) {
1243		CFISCSI_WARN("malloc failed");
1244		return (NULL);
1245	}
1246	cs->cs_ctl_initid = -1;
1247
1248	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1249	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1250	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1251	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1252#ifdef ICL_KERNEL_PROXY
1253	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1254#endif
1255
1256	cs->cs_conn = icl_conn_new("cfiscsi", &cs->cs_lock);
1257	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1258	cs->cs_conn->ic_error = cfiscsi_error_callback;
1259	cs->cs_conn->ic_prv0 = cs;
1260
1261	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1262	if (error != 0) {
1263		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1264		free(cs, M_CFISCSI);
1265		return (NULL);
1266	}
1267
1268	mtx_lock(&softc->lock);
1269	cs->cs_id = softc->last_session_id + 1;
1270	softc->last_session_id++;
1271	mtx_unlock(&softc->lock);
1272
1273	mtx_lock(&softc->lock);
1274	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1275	mtx_unlock(&softc->lock);
1276
1277	/*
1278	 * Start pinging the initiator.
1279	 */
1280	callout_init(&cs->cs_callout, 1);
1281	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1282
1283	return (cs);
1284}
1285
1286static void
1287cfiscsi_session_delete(struct cfiscsi_session *cs)
1288{
1289	struct cfiscsi_softc *softc;
1290
1291	softc = &cfiscsi_softc;
1292
1293	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1294	    ("destroying session with outstanding CTL pdus"));
1295	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1296	    ("destroying session with non-empty queue"));
1297
1298	cfiscsi_session_unregister_initiator(cs);
1299	if (cs->cs_target != NULL)
1300		cfiscsi_target_release(cs->cs_target);
1301	icl_conn_close(cs->cs_conn);
1302	icl_conn_free(cs->cs_conn);
1303
1304	mtx_lock(&softc->lock);
1305	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1306	mtx_unlock(&softc->lock);
1307
1308	free(cs, M_CFISCSI);
1309}
1310
1311int
1312cfiscsi_init(void)
1313{
1314	struct cfiscsi_softc *softc;
1315	struct ctl_port *port;
1316	int retval;
1317
1318	softc = &cfiscsi_softc;
1319	retval = 0;
1320	bzero(softc, sizeof(*softc));
1321	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1322
1323#ifdef ICL_KERNEL_PROXY
1324	cv_init(&softc->accept_cv, "cfiscsi_accept");
1325#endif
1326	TAILQ_INIT(&softc->sessions);
1327	TAILQ_INIT(&softc->targets);
1328
1329	port = &softc->port;
1330	port->frontend = &cfiscsi_frontend;
1331	port->port_type = CTL_PORT_ISCSI;
1332	/* XXX KDM what should the real number be here? */
1333	port->num_requested_ctl_io = 4096;
1334	snprintf(softc->port_name, sizeof(softc->port_name), "iscsi");
1335	port->port_name = softc->port_name;
1336	port->port_online = cfiscsi_online;
1337	port->port_offline = cfiscsi_offline;
1338	port->onoff_arg = softc;
1339	port->lun_enable = cfiscsi_lun_enable;
1340	port->lun_disable = cfiscsi_lun_disable;
1341	port->targ_lun_arg = softc;
1342	port->devid = cfiscsi_devid;
1343	port->fe_datamove = cfiscsi_datamove;
1344	port->fe_done = cfiscsi_done;
1345
1346	/* XXX KDM what should we report here? */
1347	/* XXX These should probably be fetched from CTL. */
1348	port->max_targets = 1;
1349	port->max_target_id = 15;
1350
1351	retval = ctl_port_register(port, /*master_SC*/ 1);
1352	if (retval != 0) {
1353		CFISCSI_WARN("ctl_frontend_register() failed with error %d",
1354		    retval);
1355		retval = 1;
1356		goto bailout;
1357	}
1358
1359	softc->max_initiators = port->max_initiators;
1360
1361	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1362	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1363	    UMA_ALIGN_PTR, 0);
1364
1365	return (0);
1366
1367bailout:
1368	return (retval);
1369}
1370
1371#ifdef ICL_KERNEL_PROXY
1372static void
1373cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1374{
1375	struct cfiscsi_session *cs;
1376
1377	cs = cfiscsi_session_new(&cfiscsi_softc);
1378	if (cs == NULL) {
1379		CFISCSI_WARN("failed to create session");
1380		return;
1381	}
1382
1383	icl_conn_handoff_sock(cs->cs_conn, so);
1384	cs->cs_initiator_sa = sa;
1385	cs->cs_portal_id = portal_id;
1386	cs->cs_waiting_for_ctld = true;
1387	cv_signal(&cfiscsi_softc.accept_cv);
1388}
1389#endif
1390
1391static void
1392cfiscsi_online(void *arg)
1393{
1394	struct cfiscsi_softc *softc;
1395
1396	softc = (struct cfiscsi_softc *)arg;
1397
1398	softc->online = 1;
1399#ifdef ICL_KERNEL_PROXY
1400	if (softc->listener != NULL)
1401		icl_listen_free(softc->listener);
1402	softc->listener = icl_listen_new(cfiscsi_accept);
1403#endif
1404}
1405
1406static void
1407cfiscsi_offline(void *arg)
1408{
1409	struct cfiscsi_softc *softc;
1410	struct cfiscsi_session *cs;
1411
1412	softc = (struct cfiscsi_softc *)arg;
1413
1414	softc->online = 0;
1415
1416	mtx_lock(&softc->lock);
1417	TAILQ_FOREACH(cs, &softc->sessions, cs_next)
1418		cfiscsi_session_terminate(cs);
1419	mtx_unlock(&softc->lock);
1420
1421#ifdef ICL_KERNEL_PROXY
1422	icl_listen_free(softc->listener);
1423	softc->listener = NULL;
1424#endif
1425}
1426
1427static void
1428cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1429{
1430	struct cfiscsi_softc *softc;
1431	struct cfiscsi_session *cs;
1432	struct cfiscsi_target *ct;
1433	struct ctl_iscsi_handoff_params *cihp;
1434	int error;
1435
1436	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1437	softc = &cfiscsi_softc;
1438
1439	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1440	    cihp->initiator_name, cihp->initiator_addr,
1441	    cihp->target_name);
1442
1443	if (softc->online == 0) {
1444		ci->status = CTL_ISCSI_ERROR;
1445		snprintf(ci->error_str, sizeof(ci->error_str),
1446		    "%s: port offline", __func__);
1447		return;
1448	}
1449
1450	ct = cfiscsi_target_find(softc, cihp->target_name);
1451	if (ct == NULL) {
1452		ci->status = CTL_ISCSI_ERROR;
1453		snprintf(ci->error_str, sizeof(ci->error_str),
1454		    "%s: target not found", __func__);
1455		return;
1456	}
1457
1458#ifdef ICL_KERNEL_PROXY
1459	if (cihp->socket > 0 && cihp->connection_id > 0) {
1460		snprintf(ci->error_str, sizeof(ci->error_str),
1461		    "both socket and connection_id set");
1462		ci->status = CTL_ISCSI_ERROR;
1463		cfiscsi_target_release(ct);
1464		return;
1465	}
1466	if (cihp->socket == 0) {
1467		mtx_lock(&cfiscsi_softc.lock);
1468		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1469			if (cs->cs_id == cihp->socket)
1470				break;
1471		}
1472		if (cs == NULL) {
1473			mtx_unlock(&cfiscsi_softc.lock);
1474			snprintf(ci->error_str, sizeof(ci->error_str),
1475			    "connection not found");
1476			ci->status = CTL_ISCSI_ERROR;
1477			cfiscsi_target_release(ct);
1478			return;
1479		}
1480		mtx_unlock(&cfiscsi_softc.lock);
1481	} else {
1482#endif
1483		cs = cfiscsi_session_new(softc);
1484		if (cs == NULL) {
1485			ci->status = CTL_ISCSI_ERROR;
1486			snprintf(ci->error_str, sizeof(ci->error_str),
1487			    "%s: cfiscsi_session_new failed", __func__);
1488			cfiscsi_target_release(ct);
1489			return;
1490		}
1491#ifdef ICL_KERNEL_PROXY
1492	}
1493#endif
1494	cs->cs_target = ct;
1495
1496	/*
1497	 * First PDU of Full Feature phase has the same CmdSN as the last
1498	 * PDU from the Login Phase received from the initiator.  Thus,
1499	 * the -1 below.
1500	 */
1501	cs->cs_portal_group_tag = cihp->portal_group_tag;
1502	cs->cs_cmdsn = cihp->cmdsn;
1503	cs->cs_statsn = cihp->statsn;
1504	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1505	cs->cs_max_burst_length = cihp->max_burst_length;
1506	cs->cs_immediate_data = !!cihp->immediate_data;
1507	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1508		cs->cs_conn->ic_header_crc32c = true;
1509	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1510		cs->cs_conn->ic_data_crc32c = true;
1511
1512	strlcpy(cs->cs_initiator_name,
1513	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1514	strlcpy(cs->cs_initiator_addr,
1515	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1516	strlcpy(cs->cs_initiator_alias,
1517	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1518
1519#ifdef ICL_KERNEL_PROXY
1520	if (cihp->socket > 0) {
1521#endif
1522		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1523		if (error != 0) {
1524			cfiscsi_session_delete(cs);
1525			ci->status = CTL_ISCSI_ERROR;
1526			snprintf(ci->error_str, sizeof(ci->error_str),
1527			    "%s: icl_conn_handoff failed with error %d",
1528			    __func__, error);
1529			return;
1530		}
1531#ifdef ICL_KERNEL_PROXY
1532	}
1533#endif
1534
1535	/*
1536	 * Register initiator with CTL.
1537	 */
1538	cfiscsi_session_register_initiator(cs);
1539
1540#ifdef ICL_KERNEL_PROXY
1541	cs->cs_login_phase = false;
1542
1543	/*
1544	 * First PDU of the Full Feature phase has likely already arrived.
1545	 * We have to pick it up and execute properly.
1546	 */
1547	if (cs->cs_login_pdu != NULL) {
1548		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1549		cfiscsi_pdu_handle(cs->cs_login_pdu);
1550		cs->cs_login_pdu = NULL;
1551	}
1552#endif
1553
1554	ci->status = CTL_ISCSI_OK;
1555}
1556
1557static void
1558cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1559{
1560	struct ctl_iscsi_list_params *cilp;
1561	struct cfiscsi_session *cs;
1562	struct cfiscsi_softc *softc;
1563	struct sbuf *sb;
1564	int error;
1565
1566	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1567	softc = &cfiscsi_softc;
1568
1569	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1570	if (sb == NULL) {
1571		ci->status = CTL_ISCSI_ERROR;
1572		snprintf(ci->error_str, sizeof(ci->error_str),
1573		    "Unable to allocate %d bytes for iSCSI session list",
1574		    cilp->alloc_len);
1575		return;
1576	}
1577
1578	sbuf_printf(sb, "<ctlislist>\n");
1579	mtx_lock(&softc->lock);
1580	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1581#ifdef ICL_KERNEL_PROXY
1582		if (cs->cs_target == NULL)
1583			continue;
1584#endif
1585		error = sbuf_printf(sb, "<connection id=\"%d\">"
1586		    "<initiator>%s</initiator>"
1587		    "<initiator_addr>%s</initiator_addr>"
1588		    "<initiator_alias>%s</initiator_alias>"
1589		    "<target>%s</target>"
1590		    "<target_alias>%s</target_alias>"
1591		    "<header_digest>%s</header_digest>"
1592		    "<data_digest>%s</data_digest>"
1593		    "<max_data_segment_length>%zd</max_data_segment_length>"
1594		    "<immediate_data>%d</immediate_data>"
1595		    "<iser>%d</iser>"
1596		    "</connection>\n",
1597		    cs->cs_id,
1598		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1599		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1600		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1601		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1602		    cs->cs_max_data_segment_length,
1603		    cs->cs_immediate_data,
1604		    cs->cs_conn->ic_iser);
1605		if (error != 0)
1606			break;
1607	}
1608	mtx_unlock(&softc->lock);
1609	error = sbuf_printf(sb, "</ctlislist>\n");
1610	if (error != 0) {
1611		sbuf_delete(sb);
1612		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1613		snprintf(ci->error_str, sizeof(ci->error_str),
1614		    "Out of space, %d bytes is too small", cilp->alloc_len);
1615		return;
1616	}
1617	sbuf_finish(sb);
1618
1619	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1620	cilp->fill_len = sbuf_len(sb) + 1;
1621	ci->status = CTL_ISCSI_OK;
1622	sbuf_delete(sb);
1623}
1624
1625static void
1626cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1627{
1628	struct icl_pdu *response;
1629	struct iscsi_bhs_asynchronous_message *bhsam;
1630	struct ctl_iscsi_terminate_params *citp;
1631	struct cfiscsi_session *cs;
1632	struct cfiscsi_softc *softc;
1633	int found = 0;
1634
1635	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1636	softc = &cfiscsi_softc;
1637
1638	mtx_lock(&softc->lock);
1639	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1640		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1641		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1642		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1643			continue;
1644
1645		response = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1646		if (response == NULL) {
1647			/*
1648			 * Oh well.  Just terminate the connection.
1649			 */
1650		} else {
1651			bhsam = (struct iscsi_bhs_asynchronous_message *)
1652			    response->ip_bhs;
1653			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1654			bhsam->bhsam_flags = 0x80;
1655			bhsam->bhsam_0xffffffff = 0xffffffff;
1656			bhsam->bhsam_async_event =
1657			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1658			cfiscsi_pdu_queue(response);
1659		}
1660		cfiscsi_session_terminate(cs);
1661		found++;
1662	}
1663	mtx_unlock(&softc->lock);
1664
1665	if (found == 0) {
1666		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1667		snprintf(ci->error_str, sizeof(ci->error_str),
1668		    "No matching connections found");
1669		return;
1670	}
1671
1672	ci->status = CTL_ISCSI_OK;
1673}
1674
1675static void
1676cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1677{
1678	struct icl_pdu *response;
1679	struct iscsi_bhs_asynchronous_message *bhsam;
1680	struct ctl_iscsi_logout_params *cilp;
1681	struct cfiscsi_session *cs;
1682	struct cfiscsi_softc *softc;
1683	int found = 0;
1684
1685	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1686	softc = &cfiscsi_softc;
1687
1688	mtx_lock(&softc->lock);
1689	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1690		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1691		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1692		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1693			continue;
1694
1695		response = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1696		if (response == NULL) {
1697			ci->status = CTL_ISCSI_ERROR;
1698			snprintf(ci->error_str, sizeof(ci->error_str),
1699			    "Unable to allocate memory");
1700			mtx_unlock(&softc->lock);
1701			return;
1702		}
1703		bhsam =
1704		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1705		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1706		bhsam->bhsam_flags = 0x80;
1707		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1708		bhsam->bhsam_parameter3 = htons(10);
1709		cfiscsi_pdu_queue(response);
1710		found++;
1711	}
1712	mtx_unlock(&softc->lock);
1713
1714	if (found == 0) {
1715		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1716		snprintf(ci->error_str, sizeof(ci->error_str),
1717		    "No matching connections found");
1718		return;
1719	}
1720
1721	ci->status = CTL_ISCSI_OK;
1722}
1723
1724#ifdef ICL_KERNEL_PROXY
1725static void
1726cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1727{
1728	struct ctl_iscsi_listen_params *cilp;
1729	struct sockaddr *sa;
1730	int error;
1731
1732	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1733
1734	if (cfiscsi_softc.listener == NULL) {
1735		CFISCSI_DEBUG("no listener");
1736		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1737		ci->status = CTL_ISCSI_ERROR;
1738		return;
1739	}
1740
1741	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1742	if (error != 0) {
1743		CFISCSI_DEBUG("getsockaddr, error %d", error);
1744		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1745		ci->status = CTL_ISCSI_ERROR;
1746		return;
1747	}
1748
1749	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1750	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1751	if (error != 0) {
1752		free(sa, M_SONAME);
1753		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1754		snprintf(ci->error_str, sizeof(ci->error_str),
1755		    "icl_listen_add failed, error %d", error);
1756		ci->status = CTL_ISCSI_ERROR;
1757		return;
1758	}
1759
1760	ci->status = CTL_ISCSI_OK;
1761}
1762
1763static void
1764cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1765{
1766	struct ctl_iscsi_accept_params *ciap;
1767	struct cfiscsi_session *cs;
1768	int error;
1769
1770	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1771
1772	mtx_lock(&cfiscsi_softc.lock);
1773	for (;;) {
1774		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1775			if (cs->cs_waiting_for_ctld)
1776				break;
1777		}
1778		if (cs != NULL)
1779			break;
1780		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1781		if (error != 0) {
1782			mtx_unlock(&cfiscsi_softc.lock);
1783			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1784			ci->status = CTL_ISCSI_ERROR;
1785			return;
1786		}
1787	}
1788	mtx_unlock(&cfiscsi_softc.lock);
1789
1790	cs->cs_waiting_for_ctld = false;
1791	cs->cs_login_phase = true;
1792
1793	ciap->connection_id = cs->cs_id;
1794	ciap->portal_id = cs->cs_portal_id;
1795	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1796	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1797	    cs->cs_initiator_sa->sa_len);
1798	if (error != 0) {
1799		snprintf(ci->error_str, sizeof(ci->error_str),
1800		    "copyout failed with error %d", error);
1801		ci->status = CTL_ISCSI_ERROR;
1802		return;
1803	}
1804
1805	ci->status = CTL_ISCSI_OK;
1806}
1807
1808static void
1809cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1810{
1811	struct ctl_iscsi_send_params *cisp;
1812	struct cfiscsi_session *cs;
1813	struct icl_pdu *ip;
1814	size_t datalen;
1815	void *data;
1816	int error;
1817
1818	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1819
1820	mtx_lock(&cfiscsi_softc.lock);
1821	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1822		if (cs->cs_id == cisp->connection_id)
1823			break;
1824	}
1825	if (cs == NULL) {
1826		mtx_unlock(&cfiscsi_softc.lock);
1827		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1828		ci->status = CTL_ISCSI_ERROR;
1829		return;
1830	}
1831	mtx_unlock(&cfiscsi_softc.lock);
1832
1833#if 0
1834	if (cs->cs_login_phase == false)
1835		return (EBUSY);
1836#endif
1837
1838	if (cs->cs_terminating) {
1839		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1840		ci->status = CTL_ISCSI_ERROR;
1841		return;
1842	}
1843
1844	datalen = cisp->data_segment_len;
1845	/*
1846	 * XXX
1847	 */
1848	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1849	if (datalen > 65535) {
1850		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1851		ci->status = CTL_ISCSI_ERROR;
1852		return;
1853	}
1854	if (datalen > 0) {
1855		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1856		error = copyin(cisp->data_segment, data, datalen);
1857		if (error != 0) {
1858			free(data, M_CFISCSI);
1859			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1860			ci->status = CTL_ISCSI_ERROR;
1861			return;
1862		}
1863	}
1864
1865	ip = icl_pdu_new_bhs(cs->cs_conn, M_WAITOK);
1866	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1867	if (datalen > 0) {
1868		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1869		free(data, M_CFISCSI);
1870	}
1871	CFISCSI_SESSION_LOCK(cs);
1872	icl_pdu_queue(ip);
1873	CFISCSI_SESSION_UNLOCK(cs);
1874	ci->status = CTL_ISCSI_OK;
1875}
1876
1877static void
1878cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1879{
1880	struct ctl_iscsi_receive_params *cirp;
1881	struct cfiscsi_session *cs;
1882	struct icl_pdu *ip;
1883	void *data;
1884	int error;
1885
1886	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1887
1888	mtx_lock(&cfiscsi_softc.lock);
1889	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1890		if (cs->cs_id == cirp->connection_id)
1891			break;
1892	}
1893	if (cs == NULL) {
1894		mtx_unlock(&cfiscsi_softc.lock);
1895		snprintf(ci->error_str, sizeof(ci->error_str),
1896		    "connection not found");
1897		ci->status = CTL_ISCSI_ERROR;
1898		return;
1899	}
1900	mtx_unlock(&cfiscsi_softc.lock);
1901
1902#if 0
1903	if (is->is_login_phase == false)
1904		return (EBUSY);
1905#endif
1906
1907	CFISCSI_SESSION_LOCK(cs);
1908	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
1909		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
1910		if (error != 0) {
1911			CFISCSI_SESSION_UNLOCK(cs);
1912			snprintf(ci->error_str, sizeof(ci->error_str),
1913			    "interrupted by signal");
1914			ci->status = CTL_ISCSI_ERROR;
1915			return;
1916		}
1917	}
1918
1919	if (cs->cs_terminating) {
1920		CFISCSI_SESSION_UNLOCK(cs);
1921		snprintf(ci->error_str, sizeof(ci->error_str),
1922		    "connection terminating");
1923		ci->status = CTL_ISCSI_ERROR;
1924		return;
1925	}
1926	ip = cs->cs_login_pdu;
1927	cs->cs_login_pdu = NULL;
1928	CFISCSI_SESSION_UNLOCK(cs);
1929
1930	if (ip->ip_data_len > cirp->data_segment_len) {
1931		icl_pdu_free(ip);
1932		snprintf(ci->error_str, sizeof(ci->error_str),
1933		    "data segment too big");
1934		ci->status = CTL_ISCSI_ERROR;
1935		return;
1936	}
1937
1938	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
1939	if (ip->ip_data_len > 0) {
1940		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
1941		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
1942		copyout(data, cirp->data_segment, ip->ip_data_len);
1943		free(data, M_CFISCSI);
1944	}
1945
1946	icl_pdu_free(ip);
1947	ci->status = CTL_ISCSI_OK;
1948}
1949
1950#endif /* !ICL_KERNEL_PROXY */
1951
1952static int
1953cfiscsi_ioctl(struct cdev *dev,
1954    u_long cmd, caddr_t addr, int flag, struct thread *td)
1955{
1956	struct ctl_iscsi *ci;
1957
1958	if (cmd != CTL_ISCSI)
1959		return (ENOTTY);
1960
1961	ci = (struct ctl_iscsi *)addr;
1962	switch (ci->type) {
1963	case CTL_ISCSI_HANDOFF:
1964		cfiscsi_ioctl_handoff(ci);
1965		break;
1966	case CTL_ISCSI_LIST:
1967		cfiscsi_ioctl_list(ci);
1968		break;
1969	case CTL_ISCSI_TERMINATE:
1970		cfiscsi_ioctl_terminate(ci);
1971		break;
1972	case CTL_ISCSI_LOGOUT:
1973		cfiscsi_ioctl_logout(ci);
1974		break;
1975#ifdef ICL_KERNEL_PROXY
1976	case CTL_ISCSI_LISTEN:
1977		cfiscsi_ioctl_listen(ci);
1978		break;
1979	case CTL_ISCSI_ACCEPT:
1980		cfiscsi_ioctl_accept(ci);
1981		break;
1982	case CTL_ISCSI_SEND:
1983		cfiscsi_ioctl_send(ci);
1984		break;
1985	case CTL_ISCSI_RECEIVE:
1986		cfiscsi_ioctl_receive(ci);
1987		break;
1988#else
1989	case CTL_ISCSI_LISTEN:
1990	case CTL_ISCSI_ACCEPT:
1991	case CTL_ISCSI_SEND:
1992	case CTL_ISCSI_RECEIVE:
1993		ci->status = CTL_ISCSI_ERROR;
1994		snprintf(ci->error_str, sizeof(ci->error_str),
1995		    "%s: CTL compiled without ICL_KERNEL_PROXY",
1996		    __func__);
1997		break;
1998#endif /* !ICL_KERNEL_PROXY */
1999	default:
2000		ci->status = CTL_ISCSI_ERROR;
2001		snprintf(ci->error_str, sizeof(ci->error_str),
2002		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2003		break;
2004	}
2005
2006	return (0);
2007}
2008
2009static int
2010cfiscsi_devid(struct ctl_scsiio *ctsio, int alloc_len)
2011{
2012	struct cfiscsi_session *cs;
2013	struct scsi_vpd_device_id *devid_ptr;
2014	struct scsi_vpd_id_descriptor *desc, *desc1, *desc2, *desc3, *desc4;
2015	struct scsi_vpd_id_descriptor *desc5;
2016	struct scsi_vpd_id_t10 *t10id;
2017	struct ctl_lun *lun;
2018	const struct icl_pdu *request;
2019	int i, ret;
2020	char *val;
2021	size_t data_len, devid_len, wwnn_len, wwpn_len, lun_name_len;
2022
2023	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2024	request = ctsio->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2025	cs = PDU_SESSION(request);
2026
2027	wwpn_len = strlen(cs->cs_target->ct_name);
2028	wwpn_len += strlen(",t,0x0001");
2029	wwpn_len += 1; /* '\0' */
2030	if ((wwpn_len % 4) != 0)
2031		wwpn_len += (4 - (wwpn_len % 4));
2032
2033	wwnn_len = strlen(cs->cs_target->ct_name);
2034	wwnn_len += 1; /* '\0' */
2035	if ((wwnn_len % 4) != 0)
2036		wwnn_len += (4 - (wwnn_len % 4));
2037
2038	if (lun == NULL) {
2039		devid_len = CTL_DEVID_MIN_LEN;
2040		lun_name_len = 0;
2041	} else {
2042		devid_len = max(CTL_DEVID_MIN_LEN,
2043		    strnlen(lun->be_lun->device_id, CTL_DEVID_LEN));
2044		lun_name_len = strlen(cs->cs_target->ct_name);
2045		lun_name_len += strlen(",lun,XXXXXXXX");
2046		lun_name_len += 1; /* '\0' */
2047		if ((lun_name_len % 4) != 0)
2048			lun_name_len += (4 - (lun_name_len % 4));
2049	}
2050
2051	data_len = sizeof(struct scsi_vpd_device_id) +
2052		sizeof(struct scsi_vpd_id_descriptor) +
2053		sizeof(struct scsi_vpd_id_t10) + devid_len +
2054		sizeof(struct scsi_vpd_id_descriptor) + lun_name_len +
2055		sizeof(struct scsi_vpd_id_descriptor) + wwnn_len +
2056		sizeof(struct scsi_vpd_id_descriptor) + wwpn_len +
2057		sizeof(struct scsi_vpd_id_descriptor) +
2058		sizeof(struct scsi_vpd_id_rel_trgt_port_id) +
2059		sizeof(struct scsi_vpd_id_descriptor) +
2060		sizeof(struct scsi_vpd_id_trgt_port_grp_id);
2061
2062	ctsio->kern_data_ptr = malloc(data_len, M_CTL, M_WAITOK | M_ZERO);
2063	devid_ptr = (struct scsi_vpd_device_id *)ctsio->kern_data_ptr;
2064	ctsio->kern_sg_entries = 0;
2065
2066	if (data_len < alloc_len) {
2067		ctsio->residual = alloc_len - data_len;
2068		ctsio->kern_data_len = data_len;
2069		ctsio->kern_total_len = data_len;
2070	} else {
2071		ctsio->residual = 0;
2072		ctsio->kern_data_len = alloc_len;
2073		ctsio->kern_total_len = alloc_len;
2074	}
2075	ctsio->kern_data_resid = 0;
2076	ctsio->kern_rel_offset = 0;
2077	ctsio->kern_sg_entries = 0;
2078
2079	desc = (struct scsi_vpd_id_descriptor *)devid_ptr->desc_list;
2080	t10id = (struct scsi_vpd_id_t10 *)&desc->identifier[0];
2081	desc1 = (struct scsi_vpd_id_descriptor *)(&desc->identifier[0] +
2082	    sizeof(struct scsi_vpd_id_t10) + devid_len);
2083	desc2 = (struct scsi_vpd_id_descriptor *)(&desc1->identifier[0] +
2084	    lun_name_len);
2085	desc3 = (struct scsi_vpd_id_descriptor *)(&desc2->identifier[0] +
2086	    wwnn_len);
2087	desc4 = (struct scsi_vpd_id_descriptor *)(&desc3->identifier[0] +
2088	    wwpn_len);
2089	desc5 = (struct scsi_vpd_id_descriptor *)(&desc4->identifier[0] +
2090	    sizeof(struct scsi_vpd_id_rel_trgt_port_id));
2091
2092	if (lun != NULL)
2093		devid_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
2094		    lun->be_lun->lun_type;
2095	else
2096		devid_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
2097
2098	devid_ptr->page_code = SVPD_DEVICE_ID;
2099
2100	scsi_ulto2b(data_len - 4, devid_ptr->length);
2101
2102	/*
2103	 * We're using a LUN association here.  i.e., this device ID is a
2104	 * per-LUN identifier.
2105	 */
2106	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_ASCII;
2107	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_LUN | SVPD_ID_TYPE_T10;
2108	desc->length = sizeof(*t10id) + devid_len;
2109	if (lun == NULL || (val = ctl_get_opt(lun->be_lun, "vendor")) == NULL) {
2110		strncpy((char *)t10id->vendor, CTL_VENDOR, sizeof(t10id->vendor));
2111	} else {
2112		memset(t10id->vendor, ' ', sizeof(t10id->vendor));
2113		strncpy(t10id->vendor, val,
2114		    min(sizeof(t10id->vendor), strlen(val)));
2115	}
2116
2117	/*
2118	 * If we've actually got a backend, copy the device id from the
2119	 * per-LUN data.  Otherwise, set it to all spaces.
2120	 */
2121	if (lun != NULL) {
2122		/*
2123		 * Copy the backend's LUN ID.
2124		 */
2125		strncpy((char *)t10id->vendor_spec_id,
2126		    (char *)lun->be_lun->device_id, devid_len);
2127	} else {
2128		/*
2129		 * No backend, set this to spaces.
2130		 */
2131		memset(t10id->vendor_spec_id, 0x20, devid_len);
2132	}
2133
2134	/*
2135	 * desc1 is for the unique LUN name.
2136	 *
2137	 * XXX: According to SPC-3, LUN must report the same ID through
2138	 *      all the ports.  The code below, however, reports the
2139	 *      ID only via iSCSI.
2140	 */
2141	desc1->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2142	desc1->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_LUN |
2143		SVPD_ID_TYPE_SCSI_NAME;
2144	desc1->length = lun_name_len;
2145	if (lun != NULL) {
2146		/*
2147		 * Find the per-target LUN number.
2148		 */
2149		for (i = 0; i < CTL_MAX_LUNS; i++) {
2150			if (cs->cs_target->ct_luns[i] == lun->lun)
2151				break;
2152		}
2153		KASSERT(i < CTL_MAX_LUNS,
2154		    ("lun %jd not found", (uintmax_t)lun->lun));
2155		ret = snprintf(desc1->identifier, lun_name_len, "%s,lun,%d",
2156		    cs->cs_target->ct_name, i);
2157		KASSERT(ret > 0 && ret <= lun_name_len, ("bad snprintf"));
2158	} else {
2159		KASSERT(lun_name_len == 0, ("no lun, but lun_name_len != 0"));
2160	}
2161
2162	/*
2163	 * desc2 is for the Target Name.
2164	 */
2165	desc2->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2166	desc2->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2167	    SVPD_ID_TYPE_SCSI_NAME;
2168	desc2->length = wwnn_len;
2169	snprintf(desc2->identifier, wwnn_len, "%s", cs->cs_target->ct_name);
2170
2171	/*
2172	 * desc3 is for the WWPN which is a port asscociation.
2173	 */
2174	desc3->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2175	desc3->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2176	    SVPD_ID_TYPE_SCSI_NAME;
2177	desc3->length = wwpn_len;
2178	snprintf(desc3->identifier, wwpn_len, "%s,t,0x%4.4x",
2179	    cs->cs_target->ct_name, cs->cs_portal_group_tag);
2180
2181	/*
2182	 * desc3 is for the Relative Target Port(type 4h) identifier
2183	 */
2184	desc4->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_BINARY;
2185	desc4->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2186	    SVPD_ID_TYPE_RELTARG;
2187	desc4->length = 4;
2188	desc4->identifier[3] = 1;
2189
2190	/*
2191	 * desc4 is for the Target Port Group(type 5h) identifier
2192	 */
2193	desc5->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_BINARY;
2194	desc5->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2195	    SVPD_ID_TYPE_TPORTGRP;
2196	desc5->length = 4;
2197	desc5->identifier[3] = 1;
2198
2199	ctsio->scsi_status = SCSI_STATUS_OK;
2200
2201	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2202	ctsio->be_move_done = ctl_config_move_done;
2203	ctl_datamove((union ctl_io *)ctsio);
2204
2205	return (CTL_RETVAL_COMPLETE);
2206}
2207
2208static void
2209cfiscsi_target_hold(struct cfiscsi_target *ct)
2210{
2211
2212	refcount_acquire(&ct->ct_refcount);
2213}
2214
2215static void
2216cfiscsi_target_release(struct cfiscsi_target *ct)
2217{
2218	struct cfiscsi_softc *softc;
2219
2220	softc = ct->ct_softc;
2221	mtx_lock(&softc->lock);
2222	if (refcount_release(&ct->ct_refcount)) {
2223		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2224		mtx_unlock(&softc->lock);
2225		free(ct, M_CFISCSI);
2226
2227		return;
2228	}
2229	mtx_unlock(&softc->lock);
2230}
2231
2232static struct cfiscsi_target *
2233cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name)
2234{
2235	struct cfiscsi_target *ct;
2236
2237	mtx_lock(&softc->lock);
2238	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2239		if (strcmp(name, ct->ct_name) != 0)
2240			continue;
2241		cfiscsi_target_hold(ct);
2242		mtx_unlock(&softc->lock);
2243		return (ct);
2244	}
2245	mtx_unlock(&softc->lock);
2246
2247	return (NULL);
2248}
2249
2250static struct cfiscsi_target *
2251cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2252    const char *alias)
2253{
2254	struct cfiscsi_target *ct, *newct;
2255	int i;
2256
2257	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2258		return (NULL);
2259
2260	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2261
2262	mtx_lock(&softc->lock);
2263	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2264		if (strcmp(name, ct->ct_name) != 0)
2265			continue;
2266		cfiscsi_target_hold(ct);
2267		mtx_unlock(&softc->lock);
2268		free(newct, M_CFISCSI);
2269		return (ct);
2270	}
2271
2272	for (i = 0; i < CTL_MAX_LUNS; i++)
2273		newct->ct_luns[i] = -1;
2274
2275	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2276	if (alias != NULL)
2277		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2278	refcount_init(&newct->ct_refcount, 1);
2279	newct->ct_softc = softc;
2280	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2281	mtx_unlock(&softc->lock);
2282
2283	return (newct);
2284}
2285
2286/*
2287 * Takes LUN from the target space and returns LUN from the CTL space.
2288 */
2289static uint32_t
2290cfiscsi_map_lun(void *arg, uint32_t lun)
2291{
2292	struct cfiscsi_session *cs;
2293
2294	cs = arg;
2295
2296	if (lun >= CTL_MAX_LUNS) {
2297		CFISCSI_DEBUG("requested lun number %d is higher "
2298		    "than maximum %d", lun, CTL_MAX_LUNS - 1);
2299		return (0xffffffff);
2300	}
2301
2302	if (cs->cs_target->ct_luns[lun] < 0)
2303		return (0xffffffff);
2304
2305	return (cs->cs_target->ct_luns[lun]);
2306}
2307
2308static int
2309cfiscsi_target_set_lun(struct cfiscsi_target *ct,
2310    unsigned long lun_id, unsigned long ctl_lun_id)
2311{
2312
2313	if (lun_id >= CTL_MAX_LUNS) {
2314		CFISCSI_WARN("requested lun number %ld is higher "
2315		    "than maximum %d", lun_id, CTL_MAX_LUNS - 1);
2316		return (-1);
2317	}
2318
2319	if (ct->ct_luns[lun_id] >= 0) {
2320		/*
2321		 * CTL calls cfiscsi_lun_enable() twice for each LUN - once
2322		 * when the LUN is created, and a second time just before
2323		 * the port is brought online; don't emit warnings
2324		 * for that case.
2325		 */
2326		if (ct->ct_luns[lun_id] == ctl_lun_id)
2327			return (0);
2328		CFISCSI_WARN("lun %ld already allocated", lun_id);
2329		return (-1);
2330	}
2331
2332#if 0
2333	CFISCSI_DEBUG("adding mapping for lun %ld, target %s "
2334	    "to ctl lun %ld", lun_id, ct->ct_name, ctl_lun_id);
2335#endif
2336
2337	ct->ct_luns[lun_id] = ctl_lun_id;
2338	cfiscsi_target_hold(ct);
2339
2340	return (0);
2341}
2342
2343static int
2344cfiscsi_target_unset_lun(struct cfiscsi_target *ct, unsigned long lun_id)
2345{
2346
2347	if (ct->ct_luns[lun_id] < 0) {
2348		CFISCSI_WARN("lun %ld not allocated", lun_id);
2349		return (-1);
2350	}
2351
2352	ct->ct_luns[lun_id] = -1;
2353	cfiscsi_target_release(ct);
2354
2355	return (0);
2356}
2357
2358static int
2359cfiscsi_lun_enable(void *arg, struct ctl_id target_id, int lun_id)
2360{
2361	struct cfiscsi_softc *softc;
2362	struct cfiscsi_target *ct;
2363	const char *target = NULL, *target_alias = NULL;
2364	const char *lun = NULL;
2365	unsigned long tmp;
2366
2367	softc = (struct cfiscsi_softc *)arg;
2368
2369	target = ctl_get_opt(control_softc->ctl_luns[lun_id]->be_lun,
2370	    "cfiscsi_target");
2371	target_alias = ctl_get_opt(control_softc->ctl_luns[lun_id]->be_lun,
2372	    "cfiscsi_target_alias");
2373	lun = ctl_get_opt(control_softc->ctl_luns[lun_id]->be_lun,
2374	    "cfiscsi_lun");
2375
2376	if (target == NULL && lun == NULL)
2377		return (0);
2378
2379	if (target == NULL || lun == NULL) {
2380		CFISCSI_WARN("lun added with cfiscsi_target, but without "
2381		    "cfiscsi_lun, or the other way around; ignoring");
2382		return (0);
2383	}
2384
2385	ct = cfiscsi_target_find_or_create(softc, target, target_alias);
2386	if (ct == NULL) {
2387		CFISCSI_WARN("failed to create target \"%s\"", target);
2388		return (0);
2389	}
2390
2391	tmp = strtoul(lun, NULL, 10);
2392	cfiscsi_target_set_lun(ct, tmp, lun_id);
2393	cfiscsi_target_release(ct);
2394	return (0);
2395}
2396
2397static int
2398cfiscsi_lun_disable(void *arg, struct ctl_id target_id, int lun_id)
2399{
2400	struct cfiscsi_softc *softc;
2401	struct cfiscsi_target *ct;
2402	int i;
2403
2404	softc = (struct cfiscsi_softc *)arg;
2405
2406	mtx_lock(&softc->lock);
2407	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2408		for (i = 0; i < CTL_MAX_LUNS; i++) {
2409			if (ct->ct_luns[i] < 0)
2410				continue;
2411			if (ct->ct_luns[i] != lun_id)
2412				continue;
2413			mtx_unlock(&softc->lock);
2414			cfiscsi_target_unset_lun(ct, i);
2415			return (0);
2416		}
2417	}
2418	mtx_unlock(&softc->lock);
2419	return (0);
2420}
2421
2422static void
2423cfiscsi_datamove_in(union ctl_io *io)
2424{
2425	struct cfiscsi_session *cs;
2426	struct icl_pdu *request, *response;
2427	const struct iscsi_bhs_scsi_command *bhssc;
2428	struct iscsi_bhs_data_in *bhsdi;
2429	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2430	size_t len, expected_len, sg_len, buffer_offset;
2431	const char *sg_addr;
2432	int ctl_sg_count, error, i;
2433
2434	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2435	cs = PDU_SESSION(request);
2436
2437	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2438	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2439	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2440	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2441
2442	if (io->scsiio.kern_sg_entries > 0) {
2443		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2444		ctl_sg_count = io->scsiio.kern_sg_entries;
2445	} else {
2446		ctl_sglist = &ctl_sg_entry;
2447		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2448		ctl_sglist->len = io->scsiio.kern_data_len;
2449		ctl_sg_count = 1;
2450	}
2451
2452	/*
2453	 * This is the total amount of data to be transferred within the current
2454	 * SCSI command.  We need to record it so that we can properly report
2455	 * underflow/underflow.
2456	 */
2457	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2458
2459	/*
2460	 * This is the offset within the current SCSI command; for the first
2461	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2462	 * it will be the sum of lengths of previous ones.
2463	 */
2464	buffer_offset = io->scsiio.kern_rel_offset;
2465
2466	/*
2467	 * This is the transfer length expected by the initiator.  In theory,
2468	 * it could be different from the correct amount of data from the SCSI
2469	 * point of view, even if that doesn't make any sense.
2470	 */
2471	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2472#if 0
2473	if (expected_len != io->scsiio.kern_total_len) {
2474		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2475		    "actual length %zd", expected_len,
2476		    (size_t)io->scsiio.kern_total_len);
2477	}
2478#endif
2479
2480	if (buffer_offset >= expected_len) {
2481#if 0
2482		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2483		    "already sent the expected len", buffer_offset);
2484#endif
2485		io->scsiio.be_move_done(io);
2486		return;
2487	}
2488
2489	i = 0;
2490	sg_addr = NULL;
2491	sg_len = 0;
2492	response = NULL;
2493	bhsdi = NULL;
2494	for (;;) {
2495		if (response == NULL) {
2496			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2497			if (response == NULL) {
2498				CFISCSI_SESSION_WARN(cs, "failed to "
2499				    "allocate memory; dropping connection");
2500				ctl_set_busy(&io->scsiio);
2501				io->scsiio.be_move_done(io);
2502				cfiscsi_session_terminate(cs);
2503				return;
2504			}
2505			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2506			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2507			bhsdi->bhsdi_initiator_task_tag =
2508			    bhssc->bhssc_initiator_task_tag;
2509			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2510			PDU_EXPDATASN(request)++;
2511			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2512		}
2513
2514		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2515		if (sg_len == 0) {
2516			sg_addr = ctl_sglist[i].addr;
2517			sg_len = ctl_sglist[i].len;
2518			KASSERT(sg_len > 0, ("sg_len <= 0"));
2519		}
2520
2521		len = sg_len;
2522
2523		/*
2524		 * Truncate to maximum data segment length.
2525		 */
2526		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2527		    ("ip_data_len %zd >= max_data_segment_length %zd",
2528		    response->ip_data_len, cs->cs_max_data_segment_length));
2529		if (response->ip_data_len + len >
2530		    cs->cs_max_data_segment_length) {
2531			len = cs->cs_max_data_segment_length -
2532			    response->ip_data_len;
2533			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2534			    len, sg_len));
2535		}
2536
2537		/*
2538		 * Truncate to expected data transfer length.
2539		 */
2540		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2541		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2542		    buffer_offset, response->ip_data_len, expected_len));
2543		if (buffer_offset + response->ip_data_len + len > expected_len) {
2544			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2545			    "to expected data transfer length %zd",
2546			    buffer_offset + response->ip_data_len + len, expected_len);
2547			len = expected_len - (buffer_offset + response->ip_data_len);
2548			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2549			    len, sg_len));
2550		}
2551
2552		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2553		if (error != 0) {
2554			CFISCSI_SESSION_WARN(cs, "failed to "
2555			    "allocate memory; dropping connection");
2556			icl_pdu_free(response);
2557			ctl_set_busy(&io->scsiio);
2558			io->scsiio.be_move_done(io);
2559			cfiscsi_session_terminate(cs);
2560			return;
2561		}
2562		sg_addr += len;
2563		sg_len -= len;
2564
2565		KASSERT(buffer_offset + request->ip_data_len <= expected_len,
2566		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2567		    buffer_offset, request->ip_data_len, expected_len));
2568		if (buffer_offset + request->ip_data_len == expected_len) {
2569			/*
2570			 * Already have the amount of data the initiator wanted.
2571			 */
2572			break;
2573		}
2574
2575		if (sg_len == 0) {
2576			/*
2577			 * End of scatter-gather segment;
2578			 * proceed to the next one...
2579			 */
2580			if (i == ctl_sg_count - 1) {
2581				/*
2582				 * ... unless this was the last one.
2583				 */
2584				break;
2585			}
2586			i++;
2587		}
2588
2589		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2590			/*
2591			 * Can't stuff more data into the current PDU;
2592			 * queue it.  Note that's not enough to check
2593			 * for kern_data_resid == 0 instead; there
2594			 * may be several Data-In PDUs for the final
2595			 * call to cfiscsi_datamove(), and we want
2596			 * to set the F flag only on the last of them.
2597			 */
2598			buffer_offset += response->ip_data_len;
2599			if (buffer_offset == io->scsiio.kern_total_len ||
2600			    buffer_offset == expected_len)
2601				bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2602			cfiscsi_pdu_queue(response);
2603			response = NULL;
2604			bhsdi = NULL;
2605		}
2606	}
2607	if (response != NULL) {
2608		buffer_offset += response->ip_data_len;
2609		if (buffer_offset == io->scsiio.kern_total_len ||
2610		    buffer_offset == expected_len)
2611			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2612		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2613		cfiscsi_pdu_queue(response);
2614	}
2615
2616	io->scsiio.be_move_done(io);
2617}
2618
2619static void
2620cfiscsi_datamove_out(union ctl_io *io)
2621{
2622	struct cfiscsi_session *cs;
2623	struct icl_pdu *request, *response;
2624	const struct iscsi_bhs_scsi_command *bhssc;
2625	struct iscsi_bhs_r2t *bhsr2t;
2626	struct cfiscsi_data_wait *cdw;
2627	uint32_t target_transfer_tag;
2628	bool done;
2629
2630	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2631	cs = PDU_SESSION(request);
2632
2633	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2634	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2635	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2636	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2637
2638	/*
2639	 * We need to record it so that we can properly report
2640	 * underflow/underflow.
2641	 */
2642	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2643
2644	/*
2645	 * We hadn't received anything during this datamove yet.
2646	 */
2647	io->scsiio.ext_data_filled = 0;
2648
2649	target_transfer_tag =
2650	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2651
2652#if 0
2653	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2654	    "task tag 0x%x, target transfer tag 0x%x",
2655	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2656#endif
2657	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
2658	if (cdw == NULL) {
2659		CFISCSI_SESSION_WARN(cs, "failed to "
2660		    "allocate memory; dropping connection");
2661		ctl_set_busy(&io->scsiio);
2662		io->scsiio.be_move_done(io);
2663		cfiscsi_session_terminate(cs);
2664		return;
2665	}
2666	cdw->cdw_ctl_io = io;
2667	cdw->cdw_target_transfer_tag = target_transfer_tag;
2668	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2669
2670	if (cs->cs_immediate_data && io->scsiio.kern_rel_offset <
2671	    icl_pdu_data_segment_length(request)) {
2672		done = cfiscsi_handle_data_segment(request, cdw);
2673		if (done) {
2674			uma_zfree(cfiscsi_data_wait_zone, cdw);
2675			io->scsiio.be_move_done(io);
2676			return;
2677		}
2678	}
2679
2680	CFISCSI_SESSION_LOCK(cs);
2681	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2682	CFISCSI_SESSION_UNLOCK(cs);
2683
2684	/*
2685	 * XXX: We should limit the number of outstanding R2T PDUs
2686	 * 	per task to MaxOutstandingR2T.
2687	 */
2688	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2689	if (response == NULL) {
2690		CFISCSI_SESSION_WARN(cs, "failed to "
2691		    "allocate memory; dropping connection");
2692		ctl_set_busy(&io->scsiio);
2693		io->scsiio.be_move_done(io);
2694		cfiscsi_session_terminate(cs);
2695		return;
2696	}
2697	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2698	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2699	bhsr2t->bhsr2t_flags = 0x80;
2700	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2701	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2702	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2703	/*
2704	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2705	 *	be running concurrently on several CPUs for a given
2706	 *	command.
2707	 */
2708	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2709	PDU_R2TSN(request)++;
2710	/*
2711	 * This is the offset within the current SCSI command;
2712	 * i.e. for the first call of datamove(), it will be 0,
2713	 * and for subsequent ones it will be the sum of lengths
2714	 * of previous ones.
2715	 *
2716	 * The ext_data_filled is to account for unsolicited
2717	 * (immediate) data that might have already arrived.
2718	 */
2719	bhsr2t->bhsr2t_buffer_offset =
2720	    htonl(io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled);
2721	/*
2722	 * This is the total length (sum of S/G lengths) this call
2723	 * to cfiscsi_datamove() is supposed to handle.
2724	 *
2725	 * XXX: Limit it to MaxBurstLength.
2726	 */
2727	bhsr2t->bhsr2t_desired_data_transfer_length =
2728	    htonl(io->scsiio.kern_data_len - io->scsiio.ext_data_filled);
2729	cfiscsi_pdu_queue(response);
2730}
2731
2732static void
2733cfiscsi_datamove(union ctl_io *io)
2734{
2735
2736	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2737		cfiscsi_datamove_in(io);
2738	else
2739		cfiscsi_datamove_out(io);
2740}
2741
2742static void
2743cfiscsi_scsi_command_done(union ctl_io *io)
2744{
2745	struct icl_pdu *request, *response;
2746	struct iscsi_bhs_scsi_command *bhssc;
2747	struct iscsi_bhs_scsi_response *bhssr;
2748#ifdef DIAGNOSTIC
2749	struct cfiscsi_data_wait *cdw;
2750#endif
2751	struct cfiscsi_session *cs;
2752	uint16_t sense_length;
2753
2754	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2755	cs = PDU_SESSION(request);
2756	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2757	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2758	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2759	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2760
2761	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2762	//    bhssc->bhssc_initiator_task_tag);
2763
2764#ifdef DIAGNOSTIC
2765	CFISCSI_SESSION_LOCK(cs);
2766	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2767		KASSERT(bhssc->bhssc_initiator_task_tag !=
2768		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2769	CFISCSI_SESSION_UNLOCK(cs);
2770#endif
2771
2772	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2773	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2774	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2775	bhssr->bhssr_flags = 0x80;
2776	/*
2777	 * XXX: We don't deal with bidirectional under/overflows;
2778	 *	does anything actually support those?
2779	 */
2780	if (PDU_TOTAL_TRANSFER_LEN(request) <
2781	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2782		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2783		bhssr->bhssr_residual_count =
2784		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2785		    PDU_TOTAL_TRANSFER_LEN(request));
2786		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2787		//    ntohl(bhssr->bhssr_residual_count));
2788	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2789	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2790		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2791		bhssr->bhssr_residual_count =
2792		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2793		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2794		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2795		//    ntohl(bhssr->bhssr_residual_count));
2796	}
2797	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2798	bhssr->bhssr_status = io->scsiio.scsi_status;
2799	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2800	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2801
2802	if (io->scsiio.sense_len > 0) {
2803#if 0
2804		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2805		    io->scsiio.sense_len);
2806#endif
2807		sense_length = htons(io->scsiio.sense_len);
2808		icl_pdu_append_data(response,
2809		    &sense_length, sizeof(sense_length), M_WAITOK);
2810		icl_pdu_append_data(response,
2811		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2812	}
2813
2814	ctl_free_io(io);
2815	icl_pdu_free(request);
2816	cfiscsi_pdu_queue(response);
2817}
2818
2819static void
2820cfiscsi_task_management_done(union ctl_io *io)
2821{
2822	struct icl_pdu *request, *response;
2823	struct iscsi_bhs_task_management_request *bhstmr;
2824	struct iscsi_bhs_task_management_response *bhstmr2;
2825	struct cfiscsi_data_wait *cdw, *tmpcdw;
2826	struct cfiscsi_session *cs;
2827
2828	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2829	cs = PDU_SESSION(request);
2830	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2831	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2832	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2833	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2834
2835#if 0
2836	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2837	    bhstmr->bhstmr_initiator_task_tag,
2838	    bhstmr->bhstmr_referenced_task_tag);
2839#endif
2840
2841	if ((bhstmr->bhstmr_function & ~0x80) ==
2842	    BHSTMR_FUNCTION_ABORT_TASK) {
2843		/*
2844		 * Make sure we no longer wait for Data-Out for this command.
2845		 */
2846		CFISCSI_SESSION_LOCK(cs);
2847		TAILQ_FOREACH_SAFE(cdw,
2848		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2849			if (bhstmr->bhstmr_referenced_task_tag !=
2850			    cdw->cdw_initiator_task_tag)
2851				continue;
2852
2853#if 0
2854			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2855			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2856#endif
2857			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2858			    cdw, cdw_next);
2859			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2860			uma_zfree(cfiscsi_data_wait_zone, cdw);
2861		}
2862		CFISCSI_SESSION_UNLOCK(cs);
2863	}
2864
2865	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2866	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2867	    response->ip_bhs;
2868	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2869	bhstmr2->bhstmr_flags = 0x80;
2870	if (io->io_hdr.status == CTL_SUCCESS) {
2871		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2872	} else {
2873		/*
2874		 * XXX: How to figure out what exactly went wrong?  iSCSI spec
2875		 * 	expects us to provide detailed error, e.g. "Task does
2876		 * 	not exist" or "LUN does not exist".
2877		 */
2878		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED");
2879		bhstmr2->bhstmr_response =
2880		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2881	}
2882	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2883
2884	ctl_free_io(io);
2885	icl_pdu_free(request);
2886	cfiscsi_pdu_queue(response);
2887}
2888
2889static void
2890cfiscsi_done(union ctl_io *io)
2891{
2892	struct icl_pdu *request;
2893	struct cfiscsi_session *cs;
2894
2895	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2896		("invalid CTL status %#x", io->io_hdr.status));
2897
2898	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2899	if (request == NULL) {
2900		/*
2901		 * Implicit task termination has just completed; nothing to do.
2902		 */
2903		return;
2904	}
2905
2906	cs = PDU_SESSION(request);
2907	refcount_release(&cs->cs_outstanding_ctl_pdus);
2908
2909	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2910	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2911		cfiscsi_scsi_command_done(io);
2912		break;
2913	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2914		cfiscsi_task_management_done(io);
2915		break;
2916	default:
2917		panic("cfiscsi_done called with wrong opcode 0x%x",
2918		    request->ip_bhs->bhs_opcode);
2919	}
2920}
2921