ctl_frontend_iscsi.c revision 268280
1/*-
2 * Copyright (c) 2012 The FreeBSD Foundation
3 * All rights reserved.
4 *
5 * This software was developed by Edward Tomasz Napierala under sponsorship
6 * from the FreeBSD Foundation.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 * $FreeBSD: head/sys/cam/ctl/ctl_frontend_iscsi.c 268280 2014-07-05 03:34:52Z mav $
30 */
31
32/*
33 * CTL frontend for the iSCSI protocol.
34 */
35
36#include <sys/cdefs.h>
37__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_frontend_iscsi.c 268280 2014-07-05 03:34:52Z mav $");
38
39#include <sys/param.h>
40#include <sys/capsicum.h>
41#include <sys/condvar.h>
42#include <sys/file.h>
43#include <sys/kernel.h>
44#include <sys/kthread.h>
45#include <sys/lock.h>
46#include <sys/malloc.h>
47#include <sys/module.h>
48#include <sys/mutex.h>
49#include <sys/queue.h>
50#include <sys/sbuf.h>
51#include <sys/sysctl.h>
52#include <sys/systm.h>
53#include <sys/uio.h>
54#include <sys/unistd.h>
55#include <vm/uma.h>
56
57#include <cam/scsi/scsi_all.h>
58#include <cam/scsi/scsi_da.h>
59#include <cam/ctl/ctl_io.h>
60#include <cam/ctl/ctl.h>
61#include <cam/ctl/ctl_backend.h>
62#include <cam/ctl/ctl_error.h>
63#include <cam/ctl/ctl_frontend.h>
64#include <cam/ctl/ctl_frontend_internal.h>
65#include <cam/ctl/ctl_debug.h>
66#include <cam/ctl/ctl_ha.h>
67#include <cam/ctl/ctl_ioctl.h>
68#include <cam/ctl/ctl_private.h>
69
70#include "../../dev/iscsi/icl.h"
71#include "../../dev/iscsi/iscsi_proto.h"
72#include "ctl_frontend_iscsi.h"
73
74#ifdef ICL_KERNEL_PROXY
75#include <sys/socketvar.h>
76#endif
77
78#ifdef ICL_KERNEL_PROXY
79FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
80#endif
81
82static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
83static uma_zone_t cfiscsi_data_wait_zone;
84
85SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
86    "CAM Target Layer iSCSI Frontend");
87static int debug = 3;
88SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
89    &debug, 1, "Enable debug messages");
90static int ping_timeout = 5;
91SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
92    &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
93static int login_timeout = 60;
94SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
95    &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
96static int maxcmdsn_delta = 256;
97SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
98    &maxcmdsn_delta, 256, "Number of commands the initiator can send "
99    "without confirmation");
100
101#define	CFISCSI_DEBUG(X, ...)						\
102	do {								\
103		if (debug > 1) {					\
104			printf("%s: " X "\n",				\
105			    __func__, ## __VA_ARGS__);			\
106		}							\
107	} while (0)
108
109#define	CFISCSI_WARN(X, ...)						\
110	do {								\
111		if (debug > 0) {					\
112			printf("WARNING: %s: " X "\n",			\
113			    __func__, ## __VA_ARGS__);			\
114		}							\
115	} while (0)
116
117#define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
118	do {								\
119		if (debug > 1) {					\
120			printf("%s: %s (%s): " X "\n",			\
121			    __func__, S->cs_initiator_addr,		\
122			    S->cs_initiator_name, ## __VA_ARGS__);	\
123		}							\
124	} while (0)
125
126#define	CFISCSI_SESSION_WARN(S, X, ...)					\
127	do  {								\
128		if (debug > 0) {					\
129			printf("WARNING: %s (%s): " X "\n",		\
130			    S->cs_initiator_addr,			\
131			    S->cs_initiator_name, ## __VA_ARGS__);	\
132		}							\
133	} while (0)
134
135#define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
136#define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
137#define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
138
139#define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
140#define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
141#define	PDU_EXPDATASN(X)		(X)->ip_prv0
142#define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
143#define	PDU_R2TSN(X)			(X)->ip_prv2
144
145int		cfiscsi_init(void);
146static void	cfiscsi_online(void *arg);
147static void	cfiscsi_offline(void *arg);
148static int	cfiscsi_lun_enable(void *arg,
149		    struct ctl_id target_id, int lun_id);
150static int	cfiscsi_lun_disable(void *arg,
151		    struct ctl_id target_id, int lun_id);
152static int	cfiscsi_ioctl(struct cdev *dev,
153		    u_long cmd, caddr_t addr, int flag, struct thread *td);
154static int	cfiscsi_devid(struct ctl_scsiio *ctsio, int alloc_len);
155static void	cfiscsi_datamove(union ctl_io *io);
156static void	cfiscsi_done(union ctl_io *io);
157static uint32_t	cfiscsi_map_lun(void *arg, uint32_t lun);
158static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
159static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
160static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
161static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
162static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
163static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
164static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
165static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
166		    *softc, const char *name);
167static void	cfiscsi_target_release(struct cfiscsi_target *ct);
168static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
169
170static struct cfiscsi_softc cfiscsi_softc;
171extern struct ctl_softc *control_softc;
172
173static struct ctl_frontend cfiscsi_frontend =
174{
175	.name = "iscsi",
176	.init = cfiscsi_init,
177	.ioctl = cfiscsi_ioctl,
178};
179CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
180
181static struct icl_pdu *
182cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
183{
184
185	return (icl_pdu_new_bhs(request->ip_conn, flags));
186}
187
188static bool
189cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
190{
191	const struct iscsi_bhs_scsi_command *bhssc;
192	struct cfiscsi_session *cs;
193	uint32_t cmdsn, expstatsn;
194
195	cs = PDU_SESSION(request);
196
197	/*
198	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
199	 * The purpose of the timeout is to reset the connection when it stalls;
200	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
201	 * in some queue.
202	 *
203	 * XXX: Locking?
204	 */
205	cs->cs_timeout = 0;
206
207	/*
208	 * Data-Out PDUs don't contain CmdSN.
209	 */
210	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
211	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
212		return (false);
213
214	/*
215	 * We're only using fields common for all the request
216	 * (initiator -> target) PDUs.
217	 */
218	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
219	cmdsn = ntohl(bhssc->bhssc_cmdsn);
220	expstatsn = ntohl(bhssc->bhssc_expstatsn);
221
222	CFISCSI_SESSION_LOCK(cs);
223#if 0
224	if (expstatsn != cs->cs_statsn) {
225		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
226		    "while current StatSN is %d", expstatsn,
227		    cs->cs_statsn);
228	}
229#endif
230
231	/*
232	 * The target MUST silently ignore any non-immediate command outside
233	 * of this range.
234	 */
235	if (cmdsn < cs->cs_cmdsn || cmdsn > cs->cs_cmdsn + maxcmdsn_delta) {
236		CFISCSI_SESSION_UNLOCK(cs);
237		CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %d, "
238		    "while expected CmdSN was %d", cmdsn, cs->cs_cmdsn);
239		return (true);
240	}
241
242	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0)
243		cs->cs_cmdsn++;
244
245	CFISCSI_SESSION_UNLOCK(cs);
246
247	return (false);
248}
249
250static void
251cfiscsi_pdu_handle(struct icl_pdu *request)
252{
253	struct cfiscsi_session *cs;
254	bool ignore;
255
256	cs = PDU_SESSION(request);
257
258	ignore = cfiscsi_pdu_update_cmdsn(request);
259	if (ignore) {
260		icl_pdu_free(request);
261		return;
262	}
263
264	/*
265	 * Handle the PDU; this includes e.g. receiving the remaining
266	 * part of PDU and submitting the SCSI command to CTL
267	 * or queueing a reply.  The handling routine is responsible
268	 * for freeing the PDU when it's no longer needed.
269	 */
270	switch (request->ip_bhs->bhs_opcode &
271	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
272	case ISCSI_BHS_OPCODE_NOP_OUT:
273		cfiscsi_pdu_handle_nop_out(request);
274		break;
275	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
276		cfiscsi_pdu_handle_scsi_command(request);
277		break;
278	case ISCSI_BHS_OPCODE_TASK_REQUEST:
279		cfiscsi_pdu_handle_task_request(request);
280		break;
281	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
282		cfiscsi_pdu_handle_data_out(request);
283		break;
284	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
285		cfiscsi_pdu_handle_logout_request(request);
286		break;
287	default:
288		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
289		    "opcode 0x%x; dropping connection",
290		    request->ip_bhs->bhs_opcode);
291		icl_pdu_free(request);
292		cfiscsi_session_terminate(cs);
293	}
294
295}
296
297static void
298cfiscsi_receive_callback(struct icl_pdu *request)
299{
300	struct cfiscsi_session *cs;
301
302	cs = PDU_SESSION(request);
303
304#ifdef ICL_KERNEL_PROXY
305	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
306		if (cs->cs_login_pdu == NULL)
307			cs->cs_login_pdu = request;
308		else
309			icl_pdu_free(request);
310		cv_signal(&cs->cs_login_cv);
311		return;
312	}
313#endif
314
315	cfiscsi_pdu_handle(request);
316}
317
318static void
319cfiscsi_error_callback(struct icl_conn *ic)
320{
321	struct cfiscsi_session *cs;
322
323	cs = CONN_SESSION(ic);
324
325	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
326	cfiscsi_session_terminate(cs);
327}
328
329static int
330cfiscsi_pdu_prepare(struct icl_pdu *response)
331{
332	struct cfiscsi_session *cs;
333	struct iscsi_bhs_scsi_response *bhssr;
334	bool advance_statsn = true;
335
336	cs = PDU_SESSION(response);
337
338	CFISCSI_SESSION_LOCK_ASSERT(cs);
339
340	/*
341	 * We're only using fields common for all the response
342	 * (target -> initiator) PDUs.
343	 */
344	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
345
346	/*
347	 * 10.8.3: "The StatSN for this connection is not advanced
348	 * after this PDU is sent."
349	 */
350	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
351		advance_statsn = false;
352
353	/*
354	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
355	 * StatSN for the connection is not advanced after this PDU is sent."
356	 */
357	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
358	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
359		advance_statsn = false;
360
361	/*
362	 * See the comment below - StatSN is not meaningful and must
363	 * not be advanced.
364	 */
365	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN)
366		advance_statsn = false;
367
368	/*
369	 * 10.7.3: "The fields StatSN, Status, and Residual Count
370	 * only have meaningful content if the S bit is set to 1."
371	 */
372	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN)
373		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
374	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
375	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
376
377	if (advance_statsn)
378		cs->cs_statsn++;
379
380	return (0);
381}
382
383static void
384cfiscsi_pdu_queue(struct icl_pdu *response)
385{
386	struct cfiscsi_session *cs;
387
388	cs = PDU_SESSION(response);
389
390	CFISCSI_SESSION_LOCK(cs);
391	cfiscsi_pdu_prepare(response);
392	icl_pdu_queue(response);
393	CFISCSI_SESSION_UNLOCK(cs);
394}
395
396static uint32_t
397cfiscsi_decode_lun(uint64_t encoded)
398{
399	uint8_t lun[8];
400	uint32_t result;
401
402	/*
403	 * The LUN field in iSCSI PDUs may look like an ordinary 64 bit number,
404	 * but is in fact an evil, multidimensional structure defined
405	 * in SCSI Architecture Model 5 (SAM-5), section 4.6.
406	 */
407	memcpy(lun, &encoded, sizeof(lun));
408	switch (lun[0] & 0xC0) {
409	case 0x00:
410		if ((lun[0] & 0x3f) != 0 || lun[2] != 0 || lun[3] != 0 ||
411		    lun[4] != 0 || lun[5] != 0 || lun[6] != 0 || lun[7] != 0) {
412			CFISCSI_WARN("malformed LUN "
413			    "(peripheral device addressing method): 0x%jx",
414			    (uintmax_t)encoded);
415			result = 0xffffffff;
416			break;
417		}
418		result = lun[1];
419		break;
420	case 0x40:
421		if (lun[2] != 0 || lun[3] != 0 || lun[4] != 0 || lun[5] != 0 ||
422		    lun[6] != 0 || lun[7] != 0) {
423			CFISCSI_WARN("malformed LUN "
424			    "(flat address space addressing method): 0x%jx",
425			    (uintmax_t)encoded);
426			result = 0xffffffff;
427			break;
428		}
429		result = ((lun[0] & 0x3f) << 8) + lun[1];
430		break;
431	case 0xC0:
432		if (lun[0] != 0xD2 || lun[4] != 0 || lun[5] != 0 ||
433		    lun[6] != 0 || lun[7] != 0) {
434			CFISCSI_WARN("malformed LUN (extended flat "
435			    "address space addressing method): 0x%jx",
436			    (uintmax_t)encoded);
437			result = 0xffffffff;
438			break;
439		}
440		result = (lun[1] << 16) + (lun[2] << 8) + lun[3];
441	default:
442		CFISCSI_WARN("unsupported LUN format 0x%jx",
443		    (uintmax_t)encoded);
444		result = 0xffffffff;
445		break;
446	}
447
448	return (result);
449}
450
451static void
452cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
453{
454	struct cfiscsi_session *cs;
455	struct iscsi_bhs_nop_out *bhsno;
456	struct iscsi_bhs_nop_in *bhsni;
457	struct icl_pdu *response;
458	void *data = NULL;
459	size_t datasize;
460	int error;
461
462	cs = PDU_SESSION(request);
463	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
464
465	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
466		/*
467		 * Nothing to do, iscsi_pdu_update_statsn() already
468		 * zeroed the timeout.
469		 */
470		icl_pdu_free(request);
471		return;
472	}
473
474	datasize = icl_pdu_data_segment_length(request);
475	if (datasize > 0) {
476		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
477		if (data == NULL) {
478			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
479			    "dropping connection");
480			icl_pdu_free(request);
481			cfiscsi_session_terminate(cs);
482			return;
483		}
484		icl_pdu_get_data(request, 0, data, datasize);
485	}
486
487	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
488	if (response == NULL) {
489		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
490		    "droppping connection");
491		free(data, M_CFISCSI);
492		icl_pdu_free(request);
493		cfiscsi_session_terminate(cs);
494		return;
495	}
496	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
497	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
498	bhsni->bhsni_flags = 0x80;
499	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
500	bhsni->bhsni_target_transfer_tag = 0xffffffff;
501	if (datasize > 0) {
502		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
503		if (error != 0) {
504			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
505			    "dropping connection");
506			free(data, M_CFISCSI);
507			icl_pdu_free(request);
508			icl_pdu_free(response);
509			cfiscsi_session_terminate(cs);
510			return;
511		}
512		free(data, M_CFISCSI);
513	}
514
515	icl_pdu_free(request);
516	cfiscsi_pdu_queue(response);
517}
518
519static void
520cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
521{
522	struct iscsi_bhs_scsi_command *bhssc;
523	struct cfiscsi_session *cs;
524	union ctl_io *io;
525	int error;
526
527	cs = PDU_SESSION(request);
528	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
529	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
530	//    bhssc->bhssc_initiator_task_tag);
531
532	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
533		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
534		    "ImmediateData=No; dropping connection");
535		icl_pdu_free(request);
536		cfiscsi_session_terminate(cs);
537		return;
538	}
539	io = ctl_alloc_io(cs->cs_target->ct_softc->port.ctl_pool_ref);
540	if (io == NULL) {
541		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io; "
542		    "dropping connection");
543		icl_pdu_free(request);
544		cfiscsi_session_terminate(cs);
545		return;
546	}
547	ctl_zero_io(io);
548	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
549	io->io_hdr.io_type = CTL_IO_SCSI;
550	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
551	io->io_hdr.nexus.targ_port = cs->cs_target->ct_softc->port.targ_port;
552	io->io_hdr.nexus.targ_target.id = 0;
553	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhssc->bhssc_lun);
554	io->io_hdr.nexus.lun_map_fn = cfiscsi_map_lun;
555	io->io_hdr.nexus.lun_map_arg = cs;
556	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
557	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
558	case BHSSC_FLAGS_ATTR_UNTAGGED:
559		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
560		break;
561	case BHSSC_FLAGS_ATTR_SIMPLE:
562		io->scsiio.tag_type = CTL_TAG_SIMPLE;
563		break;
564	case BHSSC_FLAGS_ATTR_ORDERED:
565        	io->scsiio.tag_type = CTL_TAG_ORDERED;
566		break;
567	case BHSSC_FLAGS_ATTR_HOQ:
568        	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
569		break;
570	case BHSSC_FLAGS_ATTR_ACA:
571		io->scsiio.tag_type = CTL_TAG_ACA;
572		break;
573	default:
574		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
575		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
576		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
577		break;
578	}
579	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
580	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
581	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
582	error = ctl_queue(io);
583	if (error != CTL_RETVAL_COMPLETE) {
584		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
585		    "dropping connection", error);
586		ctl_free_io(io);
587		refcount_release(&cs->cs_outstanding_ctl_pdus);
588		icl_pdu_free(request);
589		cfiscsi_session_terminate(cs);
590	}
591}
592
593static void
594cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
595{
596	struct iscsi_bhs_task_management_request *bhstmr;
597	struct iscsi_bhs_task_management_response *bhstmr2;
598	struct icl_pdu *response;
599	struct cfiscsi_session *cs;
600	union ctl_io *io;
601	int error;
602
603	cs = PDU_SESSION(request);
604	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
605	io = ctl_alloc_io(cs->cs_target->ct_softc->port.ctl_pool_ref);
606	if (io == NULL) {
607		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io;"
608		    "dropping connection");
609		icl_pdu_free(request);
610		cfiscsi_session_terminate(cs);
611		return;
612	}
613	ctl_zero_io(io);
614	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
615	io->io_hdr.io_type = CTL_IO_TASK;
616	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
617	io->io_hdr.nexus.targ_port = cs->cs_target->ct_softc->port.targ_port;
618	io->io_hdr.nexus.targ_target.id = 0;
619	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhstmr->bhstmr_lun);
620	io->io_hdr.nexus.lun_map_fn = cfiscsi_map_lun;
621	io->io_hdr.nexus.lun_map_arg = cs;
622	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
623
624	switch (bhstmr->bhstmr_function & ~0x80) {
625	case BHSTMR_FUNCTION_ABORT_TASK:
626#if 0
627		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
628#endif
629		io->taskio.task_action = CTL_TASK_ABORT_TASK;
630		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
631		break;
632	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
633#if 0
634		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
635#endif
636		io->taskio.task_action = CTL_TASK_LUN_RESET;
637		break;
638	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
639#if 0
640		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
641#endif
642		io->taskio.task_action = CTL_TASK_TARGET_RESET;
643		break;
644	default:
645		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
646		    bhstmr->bhstmr_function & ~0x80);
647		ctl_free_io(io);
648
649		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
650		if (response == NULL) {
651			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
652			    "dropping connection");
653			icl_pdu_free(request);
654			cfiscsi_session_terminate(cs);
655			return;
656		}
657		bhstmr2 = (struct iscsi_bhs_task_management_response *)
658		    response->ip_bhs;
659		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
660		bhstmr2->bhstmr_flags = 0x80;
661		bhstmr2->bhstmr_response =
662		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
663		bhstmr2->bhstmr_initiator_task_tag =
664		    bhstmr->bhstmr_initiator_task_tag;
665		icl_pdu_free(request);
666		cfiscsi_pdu_queue(response);
667		return;
668	}
669
670	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
671	error = ctl_queue(io);
672	if (error != CTL_RETVAL_COMPLETE) {
673		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
674		    "dropping connection", error);
675		ctl_free_io(io);
676		refcount_release(&cs->cs_outstanding_ctl_pdus);
677		icl_pdu_free(request);
678		cfiscsi_session_terminate(cs);
679	}
680}
681
682static bool
683cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
684{
685	struct iscsi_bhs_data_out *bhsdo;
686	struct cfiscsi_session *cs;
687	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
688	size_t copy_len, len, off, buffer_offset;
689	int ctl_sg_count;
690	union ctl_io *io;
691
692	cs = PDU_SESSION(request);
693
694	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
695	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
696	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
697	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
698	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
699
700	/*
701	 * We're only using fields common for Data-Out and SCSI Command PDUs.
702	 */
703	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
704
705	io = cdw->cdw_ctl_io;
706	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
707	    ("CTL_FLAG_DATA_IN"));
708
709#if 0
710	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
711	    request->ip_data_len, io->scsiio.kern_total_len);
712#endif
713
714	if (io->scsiio.kern_sg_entries > 0) {
715		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
716		ctl_sg_count = io->scsiio.kern_sg_entries;
717	} else {
718		ctl_sglist = &ctl_sg_entry;
719		ctl_sglist->addr = io->scsiio.kern_data_ptr;
720		ctl_sglist->len = io->scsiio.kern_data_len;
721		ctl_sg_count = 1;
722	}
723
724	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
725	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
726		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
727	else
728		buffer_offset = 0;
729	len = icl_pdu_data_segment_length(request);
730
731	/*
732	 * Make sure the offset, as sent by the initiator, matches the offset
733	 * we're supposed to be at in the scatter-gather list.
734	 */
735	if (buffer_offset >
736	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
737	    buffer_offset + len <=
738	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
739		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
740		    "expected %zd; dropping connection", buffer_offset,
741		    (size_t)io->scsiio.kern_rel_offset +
742		    (size_t)io->scsiio.ext_data_filled);
743		ctl_set_data_phase_error(&io->scsiio);
744		cfiscsi_session_terminate(cs);
745		return (true);
746	}
747
748	/*
749	 * This is the offset within the PDU data segment, as opposed
750	 * to buffer_offset, which is the offset within the task (SCSI
751	 * command).
752	 */
753	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
754	    buffer_offset;
755
756	/*
757	 * Iterate over the scatter/gather segments, filling them with data
758	 * from the PDU data segment.  Note that this can get called multiple
759	 * times for one SCSI command; the cdw structure holds state for the
760	 * scatter/gather list.
761	 */
762	for (;;) {
763		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
764		    ("cdw->cdw_sg_index >= ctl_sg_count"));
765		if (cdw->cdw_sg_len == 0) {
766			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
767			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
768		}
769		KASSERT(off <= len, ("len > off"));
770		copy_len = len - off;
771		if (copy_len > cdw->cdw_sg_len)
772			copy_len = cdw->cdw_sg_len;
773
774		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
775		cdw->cdw_sg_addr += copy_len;
776		cdw->cdw_sg_len -= copy_len;
777		off += copy_len;
778		io->scsiio.ext_data_filled += copy_len;
779
780		if (cdw->cdw_sg_len == 0) {
781			/*
782			 * End of current segment.
783			 */
784			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
785				/*
786				 * Last segment in scatter/gather list.
787				 */
788				break;
789			}
790			cdw->cdw_sg_index++;
791		}
792
793		if (off == len) {
794			/*
795			 * End of PDU payload.
796			 */
797			break;
798		}
799	}
800
801	if (len > off) {
802		/*
803		 * In case of unsolicited data, it's possible that the buffer
804		 * provided by CTL is smaller than negotiated FirstBurstLength.
805		 * Just ignore the superfluous data; will ask for them with R2T
806		 * on next call to cfiscsi_datamove().
807		 *
808		 * This obviously can only happen with SCSI Command PDU.
809		 */
810		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
811		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
812			return (true);
813
814		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
815		    "expected %zd; dropping connection",
816		    icl_pdu_data_segment_length(request), off);
817		ctl_set_data_phase_error(&io->scsiio);
818		cfiscsi_session_terminate(cs);
819		return (true);
820	}
821
822	if (io->scsiio.ext_data_filled == io->scsiio.kern_data_len &&
823	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
824		CFISCSI_SESSION_WARN(cs, "got the final packet without "
825		    "the F flag; flags = 0x%x; dropping connection",
826		    bhsdo->bhsdo_flags);
827		ctl_set_data_phase_error(&io->scsiio);
828		cfiscsi_session_terminate(cs);
829		return (true);
830	}
831
832	if (io->scsiio.ext_data_filled != io->scsiio.kern_data_len &&
833	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
834		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
835		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
836			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
837			    "transmitted size was %zd bytes instead of %d; "
838			    "dropping connection",
839			    (size_t)io->scsiio.ext_data_filled,
840			    io->scsiio.kern_data_len);
841			ctl_set_data_phase_error(&io->scsiio);
842			cfiscsi_session_terminate(cs);
843			return (true);
844		} else {
845			/*
846			 * For SCSI Command PDU, this just means we need to
847			 * solicit more data by sending R2T.
848			 */
849			return (false);
850		}
851	}
852
853	if (io->scsiio.ext_data_filled == io->scsiio.kern_data_len) {
854#if 0
855		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
856		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
857#endif
858
859		return (true);
860	}
861
862	return (false);
863}
864
865static void
866cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
867{
868	struct iscsi_bhs_data_out *bhsdo;
869	struct cfiscsi_session *cs;
870	struct cfiscsi_data_wait *cdw = NULL;
871	union ctl_io *io;
872	bool done;
873
874	cs = PDU_SESSION(request);
875	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
876
877	CFISCSI_SESSION_LOCK(cs);
878	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
879#if 0
880		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
881		    "ttt 0x%x, itt 0x%x",
882		    bhsdo->bhsdo_target_transfer_tag,
883		    bhsdo->bhsdo_initiator_task_tag,
884		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
885#endif
886		if (bhsdo->bhsdo_target_transfer_tag ==
887		    cdw->cdw_target_transfer_tag)
888			break;
889	}
890	CFISCSI_SESSION_UNLOCK(cs);
891	if (cdw == NULL) {
892		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
893		    "0x%x, not found; dropping connection",
894		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
895		icl_pdu_free(request);
896		cfiscsi_session_terminate(cs);
897		return;
898	}
899
900	io = cdw->cdw_ctl_io;
901	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
902	    ("CTL_FLAG_DATA_IN"));
903
904	done = cfiscsi_handle_data_segment(request, cdw);
905	if (done) {
906		CFISCSI_SESSION_LOCK(cs);
907		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
908		CFISCSI_SESSION_UNLOCK(cs);
909		uma_zfree(cfiscsi_data_wait_zone, cdw);
910		io->scsiio.be_move_done(io);
911	}
912
913	icl_pdu_free(request);
914}
915
916static void
917cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
918{
919	struct iscsi_bhs_logout_request *bhslr;
920	struct iscsi_bhs_logout_response *bhslr2;
921	struct icl_pdu *response;
922	struct cfiscsi_session *cs;
923
924	cs = PDU_SESSION(request);
925	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
926	switch (bhslr->bhslr_reason & 0x7f) {
927	case BHSLR_REASON_CLOSE_SESSION:
928	case BHSLR_REASON_CLOSE_CONNECTION:
929		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
930		if (response == NULL) {
931			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
932			icl_pdu_free(request);
933			cfiscsi_session_terminate(cs);
934			return;
935		}
936		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
937		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
938		bhslr2->bhslr_flags = 0x80;
939		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
940		bhslr2->bhslr_initiator_task_tag =
941		    bhslr->bhslr_initiator_task_tag;
942		icl_pdu_free(request);
943		cfiscsi_pdu_queue(response);
944		cfiscsi_session_terminate(cs);
945		break;
946	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
947		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
948		if (response == NULL) {
949			CFISCSI_SESSION_WARN(cs,
950			    "failed to allocate memory; dropping connection");
951			icl_pdu_free(request);
952			cfiscsi_session_terminate(cs);
953			return;
954		}
955		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
956		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
957		bhslr2->bhslr_flags = 0x80;
958		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
959		bhslr2->bhslr_initiator_task_tag =
960		    bhslr->bhslr_initiator_task_tag;
961		icl_pdu_free(request);
962		cfiscsi_pdu_queue(response);
963		break;
964	default:
965		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
966		    bhslr->bhslr_reason);
967		icl_pdu_free(request);
968		cfiscsi_session_terminate(cs);
969		break;
970	}
971}
972
973static void
974cfiscsi_callout(void *context)
975{
976	struct icl_pdu *cp;
977	struct iscsi_bhs_nop_in *bhsni;
978	struct cfiscsi_session *cs;
979
980	cs = context;
981
982	if (cs->cs_terminating)
983		return;
984
985	callout_schedule(&cs->cs_callout, 1 * hz);
986
987	atomic_add_int(&cs->cs_timeout, 1);
988
989#ifdef ICL_KERNEL_PROXY
990	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
991		if (cs->cs_timeout > login_timeout) {
992			CFISCSI_SESSION_WARN(cs, "login timed out after "
993			    "%d seconds; dropping connection", cs->cs_timeout);
994			cfiscsi_session_terminate(cs);
995		}
996		return;
997	}
998#endif
999
1000	if (cs->cs_timeout >= ping_timeout) {
1001		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1002		    "dropping connection",  ping_timeout);
1003		cfiscsi_session_terminate(cs);
1004		return;
1005	}
1006
1007	/*
1008	 * If the ping was reset less than one second ago - which means
1009	 * that we've received some PDU during the last second - assume
1010	 * the traffic flows correctly and don't bother sending a NOP-Out.
1011	 *
1012	 * (It's 2 - one for one second, and one for incrementing is_timeout
1013	 * earlier in this routine.)
1014	 */
1015	if (cs->cs_timeout < 2)
1016		return;
1017
1018	cp = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1019	if (cp == NULL) {
1020		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1021		return;
1022	}
1023	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1024	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1025	bhsni->bhsni_flags = 0x80;
1026	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1027
1028	cfiscsi_pdu_queue(cp);
1029}
1030
1031static void
1032cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1033{
1034	struct cfiscsi_data_wait *cdw, *tmpcdw;
1035	union ctl_io *io;
1036	int error, last;
1037
1038#ifdef notyet
1039	io = ctl_alloc_io(cs->cs_target->ct_softc->port.ctl_pool_ref);
1040	if (io == NULL) {
1041		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io");
1042		return;
1043	}
1044	ctl_zero_io(io);
1045	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = NULL;
1046	io->io_hdr.io_type = CTL_IO_TASK;
1047	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1048	io->io_hdr.nexus.targ_port = cs->cs_target->ct_softc->port.targ_port;
1049	io->io_hdr.nexus.targ_target.id = 0;
1050	io->io_hdr.nexus.targ_lun = lun;
1051	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1052	io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
1053	error = ctl_queue(io);
1054	if (error != CTL_RETVAL_COMPLETE) {
1055		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1056		ctl_free_io(io);
1057	}
1058#else
1059	/*
1060	 * CTL doesn't currently support CTL_TASK_ABORT_TASK_SET, so instead
1061	 * just iterate over tasks that are waiting for something - data - and
1062	 * terminate those.
1063	 */
1064	CFISCSI_SESSION_LOCK(cs);
1065	TAILQ_FOREACH_SAFE(cdw,
1066	    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
1067		io = ctl_alloc_io(cs->cs_target->ct_softc->port.ctl_pool_ref);
1068		if (io == NULL) {
1069			CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io");
1070			return;
1071		}
1072		ctl_zero_io(io);
1073		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = NULL;
1074		io->io_hdr.io_type = CTL_IO_TASK;
1075		io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1076		io->io_hdr.nexus.targ_port =
1077		    cs->cs_target->ct_softc->port.targ_port;
1078		io->io_hdr.nexus.targ_target.id = 0;
1079		//io->io_hdr.nexus.targ_lun = lun; /* Not needed? */
1080		io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1081		io->taskio.task_action = CTL_TASK_ABORT_TASK;
1082		io->taskio.tag_num = cdw->cdw_initiator_task_tag;
1083		error = ctl_queue(io);
1084		if (error != CTL_RETVAL_COMPLETE) {
1085			CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1086			ctl_free_io(io);
1087			return;
1088		}
1089#if 0
1090		CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task tag "
1091		    "0x%x", cdw->cdw_initiator_task_tag);
1092#endif
1093		/*
1094		 * Set nonzero port status; this prevents backends from
1095		 * assuming that the data transfer actually succeeded
1096		 * and writing uninitialized data to disk.
1097		 */
1098		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1099		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1100		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1101		uma_zfree(cfiscsi_data_wait_zone, cdw);
1102	}
1103	CFISCSI_SESSION_UNLOCK(cs);
1104#endif
1105
1106	/*
1107	 * Wait for CTL to terminate all the tasks.
1108	 */
1109	for (;;) {
1110		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1111		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1112		if (last != 0)
1113			break;
1114		CFISCSI_SESSION_WARN(cs, "waiting for CTL to terminate tasks, "
1115		    "%d remaining", cs->cs_outstanding_ctl_pdus);
1116		pause("cfiscsi_terminate", 1);
1117	}
1118}
1119
1120static void
1121cfiscsi_maintenance_thread(void *arg)
1122{
1123	struct cfiscsi_session *cs;
1124
1125	cs = arg;
1126
1127	for (;;) {
1128		CFISCSI_SESSION_LOCK(cs);
1129		if (cs->cs_terminating == false)
1130			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1131		CFISCSI_SESSION_UNLOCK(cs);
1132
1133		if (cs->cs_terminating) {
1134
1135			/*
1136			 * We used to wait up to 30 seconds to deliver queued
1137			 * PDUs to the initiator.  We also tried hard to deliver
1138			 * SCSI Responses for the aborted PDUs.  We don't do
1139			 * that anymore.  We might need to revisit that.
1140			 */
1141			callout_drain(&cs->cs_callout);
1142			icl_conn_shutdown(cs->cs_conn);
1143			icl_conn_close(cs->cs_conn);
1144
1145			/*
1146			 * At this point ICL receive thread is no longer
1147			 * running; no new tasks can be queued.
1148			 */
1149			cfiscsi_session_terminate_tasks(cs);
1150			cfiscsi_session_delete(cs);
1151			kthread_exit();
1152			return;
1153		}
1154		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1155	}
1156}
1157
1158static void
1159cfiscsi_session_terminate(struct cfiscsi_session *cs)
1160{
1161
1162	if (cs->cs_terminating)
1163		return;
1164	cs->cs_terminating = true;
1165	cv_signal(&cs->cs_maintenance_cv);
1166#ifdef ICL_KERNEL_PROXY
1167	cv_signal(&cs->cs_login_cv);
1168#endif
1169}
1170
1171static int
1172cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1173{
1174	int error, i;
1175	struct cfiscsi_softc *softc;
1176
1177	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1178
1179	softc = &cfiscsi_softc;
1180
1181	mtx_lock(&softc->lock);
1182	for (i = 0; i < softc->max_initiators; i++) {
1183		if (softc->ctl_initids[i] == 0)
1184			break;
1185	}
1186	if (i == softc->max_initiators) {
1187		CFISCSI_SESSION_WARN(cs, "too many concurrent sessions (%d)",
1188		    softc->max_initiators);
1189		mtx_unlock(&softc->lock);
1190		return (1);
1191	}
1192	softc->ctl_initids[i] = 1;
1193	mtx_unlock(&softc->lock);
1194
1195#if 0
1196	CFISCSI_SESSION_DEBUG(cs, "adding initiator id %d, max %d",
1197	    i, softc->max_initiators);
1198#endif
1199	cs->cs_ctl_initid = i;
1200	error = ctl_add_initiator(0x0, softc->port.targ_port, cs->cs_ctl_initid);
1201	if (error != 0) {
1202		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d", error);
1203		mtx_lock(&softc->lock);
1204		softc->ctl_initids[cs->cs_ctl_initid] = 0;
1205		mtx_unlock(&softc->lock);
1206		cs->cs_ctl_initid = -1;
1207		return (1);
1208	}
1209
1210	return (0);
1211}
1212
1213static void
1214cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1215{
1216	int error;
1217	struct cfiscsi_softc *softc;
1218
1219	if (cs->cs_ctl_initid == -1)
1220		return;
1221
1222	softc = &cfiscsi_softc;
1223
1224	error = ctl_remove_initiator(softc->port.targ_port, cs->cs_ctl_initid);
1225	if (error != 0) {
1226		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1227		    error);
1228	}
1229	mtx_lock(&softc->lock);
1230	softc->ctl_initids[cs->cs_ctl_initid] = 0;
1231	mtx_unlock(&softc->lock);
1232	cs->cs_ctl_initid = -1;
1233}
1234
1235static struct cfiscsi_session *
1236cfiscsi_session_new(struct cfiscsi_softc *softc)
1237{
1238	struct cfiscsi_session *cs;
1239	int error;
1240
1241	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1242	if (cs == NULL) {
1243		CFISCSI_WARN("malloc failed");
1244		return (NULL);
1245	}
1246	cs->cs_ctl_initid = -1;
1247
1248	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1249	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1250	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1251	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1252#ifdef ICL_KERNEL_PROXY
1253	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1254#endif
1255
1256	cs->cs_conn = icl_conn_new("cfiscsi", &cs->cs_lock);
1257	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1258	cs->cs_conn->ic_error = cfiscsi_error_callback;
1259	cs->cs_conn->ic_prv0 = cs;
1260
1261	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1262	if (error != 0) {
1263		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1264		free(cs, M_CFISCSI);
1265		return (NULL);
1266	}
1267
1268	mtx_lock(&softc->lock);
1269	cs->cs_id = softc->last_session_id + 1;
1270	softc->last_session_id++;
1271	mtx_unlock(&softc->lock);
1272
1273	mtx_lock(&softc->lock);
1274	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1275	mtx_unlock(&softc->lock);
1276
1277	/*
1278	 * Start pinging the initiator.
1279	 */
1280	callout_init(&cs->cs_callout, 1);
1281	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1282
1283	return (cs);
1284}
1285
1286static void
1287cfiscsi_session_delete(struct cfiscsi_session *cs)
1288{
1289	struct cfiscsi_softc *softc;
1290
1291	softc = &cfiscsi_softc;
1292
1293	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1294	    ("destroying session with outstanding CTL pdus"));
1295	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1296	    ("destroying session with non-empty queue"));
1297
1298	cfiscsi_session_unregister_initiator(cs);
1299	if (cs->cs_target != NULL)
1300		cfiscsi_target_release(cs->cs_target);
1301	icl_conn_close(cs->cs_conn);
1302	icl_conn_free(cs->cs_conn);
1303
1304	mtx_lock(&softc->lock);
1305	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1306	mtx_unlock(&softc->lock);
1307
1308	free(cs, M_CFISCSI);
1309}
1310
1311int
1312cfiscsi_init(void)
1313{
1314	struct cfiscsi_softc *softc;
1315	struct ctl_port *port;
1316	int retval;
1317
1318	softc = &cfiscsi_softc;
1319	retval = 0;
1320	bzero(softc, sizeof(*softc));
1321	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1322
1323#ifdef ICL_KERNEL_PROXY
1324	cv_init(&softc->accept_cv, "cfiscsi_accept");
1325#endif
1326	TAILQ_INIT(&softc->sessions);
1327	TAILQ_INIT(&softc->targets);
1328
1329	port = &softc->port;
1330	port->frontend = &cfiscsi_frontend;
1331	port->port_type = CTL_PORT_ISCSI;
1332	/* XXX KDM what should the real number be here? */
1333	port->num_requested_ctl_io = 4096;
1334	snprintf(softc->port_name, sizeof(softc->port_name), "iscsi");
1335	port->port_name = softc->port_name;
1336	port->port_online = cfiscsi_online;
1337	port->port_offline = cfiscsi_offline;
1338	port->onoff_arg = softc;
1339	port->lun_enable = cfiscsi_lun_enable;
1340	port->lun_disable = cfiscsi_lun_disable;
1341	port->targ_lun_arg = softc;
1342	port->devid = cfiscsi_devid;
1343	port->fe_datamove = cfiscsi_datamove;
1344	port->fe_done = cfiscsi_done;
1345
1346	/* XXX KDM what should we report here? */
1347	/* XXX These should probably be fetched from CTL. */
1348	port->max_targets = 1;
1349	port->max_target_id = 15;
1350
1351	retval = ctl_port_register(port, /*master_SC*/ 1);
1352	if (retval != 0) {
1353		CFISCSI_WARN("ctl_frontend_register() failed with error %d",
1354		    retval);
1355		retval = 1;
1356		goto bailout;
1357	}
1358
1359	softc->max_initiators = port->max_initiators;
1360
1361	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1362	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1363	    UMA_ALIGN_PTR, 0);
1364
1365	return (0);
1366
1367bailout:
1368	return (retval);
1369}
1370
1371#ifdef ICL_KERNEL_PROXY
1372static void
1373cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1374{
1375	struct cfiscsi_session *cs;
1376
1377	cs = cfiscsi_session_new(&cfiscsi_softc);
1378	if (cs == NULL) {
1379		CFISCSI_WARN("failed to create session");
1380		return;
1381	}
1382
1383	icl_conn_handoff_sock(cs->cs_conn, so);
1384	cs->cs_initiator_sa = sa;
1385	cs->cs_portal_id = portal_id;
1386	cs->cs_waiting_for_ctld = true;
1387	cv_signal(&cfiscsi_softc.accept_cv);
1388}
1389#endif
1390
1391static void
1392cfiscsi_online(void *arg)
1393{
1394	struct cfiscsi_softc *softc;
1395
1396	softc = (struct cfiscsi_softc *)arg;
1397
1398	softc->online = 1;
1399#ifdef ICL_KERNEL_PROXY
1400	if (softc->listener != NULL)
1401		icl_listen_free(softc->listener);
1402	softc->listener = icl_listen_new(cfiscsi_accept);
1403#endif
1404}
1405
1406static void
1407cfiscsi_offline(void *arg)
1408{
1409	struct cfiscsi_softc *softc;
1410	struct cfiscsi_session *cs;
1411
1412	softc = (struct cfiscsi_softc *)arg;
1413
1414	softc->online = 0;
1415
1416	mtx_lock(&softc->lock);
1417	TAILQ_FOREACH(cs, &softc->sessions, cs_next)
1418		cfiscsi_session_terminate(cs);
1419	mtx_unlock(&softc->lock);
1420
1421#ifdef ICL_KERNEL_PROXY
1422	icl_listen_free(softc->listener);
1423	softc->listener = NULL;
1424#endif
1425}
1426
1427static void
1428cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1429{
1430	struct cfiscsi_softc *softc;
1431	struct cfiscsi_session *cs;
1432	struct cfiscsi_target *ct;
1433	struct ctl_iscsi_handoff_params *cihp;
1434	int error;
1435
1436	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1437	softc = &cfiscsi_softc;
1438
1439	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1440	    cihp->initiator_name, cihp->initiator_addr,
1441	    cihp->target_name);
1442
1443	if (softc->online == 0) {
1444		ci->status = CTL_ISCSI_ERROR;
1445		snprintf(ci->error_str, sizeof(ci->error_str),
1446		    "%s: port offline", __func__);
1447		return;
1448	}
1449
1450	ct = cfiscsi_target_find(softc, cihp->target_name);
1451	if (ct == NULL) {
1452		ci->status = CTL_ISCSI_ERROR;
1453		snprintf(ci->error_str, sizeof(ci->error_str),
1454		    "%s: target not found", __func__);
1455		return;
1456	}
1457
1458#ifdef ICL_KERNEL_PROXY
1459	if (cihp->socket > 0 && cihp->connection_id > 0) {
1460		snprintf(ci->error_str, sizeof(ci->error_str),
1461		    "both socket and connection_id set");
1462		ci->status = CTL_ISCSI_ERROR;
1463		cfiscsi_target_release(ct);
1464		return;
1465	}
1466	if (cihp->socket == 0) {
1467		mtx_lock(&cfiscsi_softc.lock);
1468		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1469			if (cs->cs_id == cihp->socket)
1470				break;
1471		}
1472		if (cs == NULL) {
1473			mtx_unlock(&cfiscsi_softc.lock);
1474			snprintf(ci->error_str, sizeof(ci->error_str),
1475			    "connection not found");
1476			ci->status = CTL_ISCSI_ERROR;
1477			cfiscsi_target_release(ct);
1478			return;
1479		}
1480		mtx_unlock(&cfiscsi_softc.lock);
1481	} else {
1482#endif
1483		cs = cfiscsi_session_new(softc);
1484		if (cs == NULL) {
1485			ci->status = CTL_ISCSI_ERROR;
1486			snprintf(ci->error_str, sizeof(ci->error_str),
1487			    "%s: cfiscsi_session_new failed", __func__);
1488			cfiscsi_target_release(ct);
1489			return;
1490		}
1491#ifdef ICL_KERNEL_PROXY
1492	}
1493#endif
1494	cs->cs_target = ct;
1495
1496	/*
1497	 * First PDU of Full Feature phase has the same CmdSN as the last
1498	 * PDU from the Login Phase received from the initiator.  Thus,
1499	 * the -1 below.
1500	 */
1501	cs->cs_portal_group_tag = cihp->portal_group_tag;
1502	cs->cs_cmdsn = cihp->cmdsn;
1503	cs->cs_statsn = cihp->statsn;
1504	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1505	cs->cs_max_burst_length = cihp->max_burst_length;
1506	cs->cs_immediate_data = !!cihp->immediate_data;
1507	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1508		cs->cs_conn->ic_header_crc32c = true;
1509	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1510		cs->cs_conn->ic_data_crc32c = true;
1511
1512	strlcpy(cs->cs_initiator_name,
1513	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1514	strlcpy(cs->cs_initiator_addr,
1515	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1516	strlcpy(cs->cs_initiator_alias,
1517	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1518
1519#ifdef ICL_KERNEL_PROXY
1520	if (cihp->socket > 0) {
1521#endif
1522		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1523		if (error != 0) {
1524			cfiscsi_session_delete(cs);
1525			ci->status = CTL_ISCSI_ERROR;
1526			snprintf(ci->error_str, sizeof(ci->error_str),
1527			    "%s: icl_conn_handoff failed with error %d",
1528			    __func__, error);
1529			return;
1530		}
1531#ifdef ICL_KERNEL_PROXY
1532	}
1533#endif
1534
1535	/*
1536	 * Register initiator with CTL.
1537	 */
1538	cfiscsi_session_register_initiator(cs);
1539
1540#ifdef ICL_KERNEL_PROXY
1541	cs->cs_login_phase = false;
1542
1543	/*
1544	 * First PDU of the Full Feature phase has likely already arrived.
1545	 * We have to pick it up and execute properly.
1546	 */
1547	if (cs->cs_login_pdu != NULL) {
1548		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1549		cfiscsi_pdu_handle(cs->cs_login_pdu);
1550		cs->cs_login_pdu = NULL;
1551	}
1552#endif
1553
1554	ci->status = CTL_ISCSI_OK;
1555}
1556
1557static void
1558cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1559{
1560	struct ctl_iscsi_list_params *cilp;
1561	struct cfiscsi_session *cs;
1562	struct cfiscsi_softc *softc;
1563	struct sbuf *sb;
1564	int error;
1565
1566	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1567	softc = &cfiscsi_softc;
1568
1569	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1570	if (sb == NULL) {
1571		ci->status = CTL_ISCSI_ERROR;
1572		snprintf(ci->error_str, sizeof(ci->error_str),
1573		    "Unable to allocate %d bytes for iSCSI session list",
1574		    cilp->alloc_len);
1575		return;
1576	}
1577
1578	sbuf_printf(sb, "<ctlislist>\n");
1579	mtx_lock(&softc->lock);
1580	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1581#ifdef ICL_KERNEL_PROXY
1582		if (cs->cs_target == NULL)
1583			continue;
1584#endif
1585		error = sbuf_printf(sb, "<connection id=\"%d\">"
1586		    "<initiator>%s</initiator>"
1587		    "<initiator_addr>%s</initiator_addr>"
1588		    "<initiator_alias>%s</initiator_alias>"
1589		    "<target>%s</target>"
1590		    "<target_alias>%s</target_alias>"
1591		    "<header_digest>%s</header_digest>"
1592		    "<data_digest>%s</data_digest>"
1593		    "<max_data_segment_length>%zd</max_data_segment_length>"
1594		    "<immediate_data>%d</immediate_data>"
1595		    "<iser>%d</iser>"
1596		    "</connection>\n",
1597		    cs->cs_id,
1598		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1599		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1600		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1601		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1602		    cs->cs_max_data_segment_length,
1603		    cs->cs_immediate_data,
1604		    cs->cs_conn->ic_iser);
1605		if (error != 0)
1606			break;
1607	}
1608	mtx_unlock(&softc->lock);
1609	error = sbuf_printf(sb, "</ctlislist>\n");
1610	if (error != 0) {
1611		sbuf_delete(sb);
1612		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1613		snprintf(ci->error_str, sizeof(ci->error_str),
1614		    "Out of space, %d bytes is too small", cilp->alloc_len);
1615		return;
1616	}
1617	sbuf_finish(sb);
1618
1619	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1620	cilp->fill_len = sbuf_len(sb) + 1;
1621	ci->status = CTL_ISCSI_OK;
1622	sbuf_delete(sb);
1623}
1624
1625static void
1626cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1627{
1628	struct icl_pdu *response;
1629	struct iscsi_bhs_asynchronous_message *bhsam;
1630	struct ctl_iscsi_terminate_params *citp;
1631	struct cfiscsi_session *cs;
1632	struct cfiscsi_softc *softc;
1633	int found = 0;
1634
1635	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1636	softc = &cfiscsi_softc;
1637
1638	mtx_lock(&softc->lock);
1639	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1640		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1641		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1642		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1643			continue;
1644
1645		response = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1646		if (response == NULL) {
1647			/*
1648			 * Oh well.  Just terminate the connection.
1649			 */
1650		} else {
1651			bhsam = (struct iscsi_bhs_asynchronous_message *)
1652			    response->ip_bhs;
1653			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1654			bhsam->bhsam_flags = 0x80;
1655			bhsam->bhsam_0xffffffff = 0xffffffff;
1656			bhsam->bhsam_async_event =
1657			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1658			cfiscsi_pdu_queue(response);
1659		}
1660		cfiscsi_session_terminate(cs);
1661		found++;
1662	}
1663	mtx_unlock(&softc->lock);
1664
1665	if (found == 0) {
1666		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1667		snprintf(ci->error_str, sizeof(ci->error_str),
1668		    "No matching connections found");
1669		return;
1670	}
1671
1672	ci->status = CTL_ISCSI_OK;
1673}
1674
1675static void
1676cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1677{
1678	struct icl_pdu *response;
1679	struct iscsi_bhs_asynchronous_message *bhsam;
1680	struct ctl_iscsi_logout_params *cilp;
1681	struct cfiscsi_session *cs;
1682	struct cfiscsi_softc *softc;
1683	int found = 0;
1684
1685	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1686	softc = &cfiscsi_softc;
1687
1688	mtx_lock(&softc->lock);
1689	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1690		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1691		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1692		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1693			continue;
1694
1695		response = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1696		if (response == NULL) {
1697			ci->status = CTL_ISCSI_ERROR;
1698			snprintf(ci->error_str, sizeof(ci->error_str),
1699			    "Unable to allocate memory");
1700			mtx_unlock(&softc->lock);
1701			return;
1702		}
1703		bhsam =
1704		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1705		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1706		bhsam->bhsam_flags = 0x80;
1707		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1708		bhsam->bhsam_parameter3 = htons(10);
1709		cfiscsi_pdu_queue(response);
1710		found++;
1711	}
1712	mtx_unlock(&softc->lock);
1713
1714	if (found == 0) {
1715		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1716		snprintf(ci->error_str, sizeof(ci->error_str),
1717		    "No matching connections found");
1718		return;
1719	}
1720
1721	ci->status = CTL_ISCSI_OK;
1722}
1723
1724#ifdef ICL_KERNEL_PROXY
1725static void
1726cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1727{
1728	struct ctl_iscsi_listen_params *cilp;
1729	struct sockaddr *sa;
1730	int error;
1731
1732	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1733
1734	if (cfiscsi_softc.listener == NULL) {
1735		CFISCSI_DEBUG("no listener");
1736		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1737		ci->status = CTL_ISCSI_ERROR;
1738		return;
1739	}
1740
1741	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1742	if (error != 0) {
1743		CFISCSI_DEBUG("getsockaddr, error %d", error);
1744		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1745		ci->status = CTL_ISCSI_ERROR;
1746		return;
1747	}
1748
1749	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1750	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1751	if (error != 0) {
1752		free(sa, M_SONAME);
1753		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1754		snprintf(ci->error_str, sizeof(ci->error_str),
1755		    "icl_listen_add failed, error %d", error);
1756		ci->status = CTL_ISCSI_ERROR;
1757		return;
1758	}
1759
1760	ci->status = CTL_ISCSI_OK;
1761}
1762
1763static void
1764cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1765{
1766	struct ctl_iscsi_accept_params *ciap;
1767	struct cfiscsi_session *cs;
1768	int error;
1769
1770	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1771
1772	mtx_lock(&cfiscsi_softc.lock);
1773	for (;;) {
1774		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1775			if (cs->cs_waiting_for_ctld)
1776				break;
1777		}
1778		if (cs != NULL)
1779			break;
1780		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1781		if (error != 0) {
1782			mtx_unlock(&cfiscsi_softc.lock);
1783			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1784			ci->status = CTL_ISCSI_ERROR;
1785			return;
1786		}
1787	}
1788	mtx_unlock(&cfiscsi_softc.lock);
1789
1790	cs->cs_waiting_for_ctld = false;
1791	cs->cs_login_phase = true;
1792
1793	ciap->connection_id = cs->cs_id;
1794	ciap->portal_id = cs->cs_portal_id;
1795	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1796	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1797	    cs->cs_initiator_sa->sa_len);
1798	if (error != 0) {
1799		snprintf(ci->error_str, sizeof(ci->error_str),
1800		    "copyout failed with error %d", error);
1801		ci->status = CTL_ISCSI_ERROR;
1802		return;
1803	}
1804
1805	ci->status = CTL_ISCSI_OK;
1806}
1807
1808static void
1809cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1810{
1811	struct ctl_iscsi_send_params *cisp;
1812	struct cfiscsi_session *cs;
1813	struct icl_pdu *ip;
1814	size_t datalen;
1815	void *data;
1816	int error;
1817
1818	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1819
1820	mtx_lock(&cfiscsi_softc.lock);
1821	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1822		if (cs->cs_id == cisp->connection_id)
1823			break;
1824	}
1825	if (cs == NULL) {
1826		mtx_unlock(&cfiscsi_softc.lock);
1827		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1828		ci->status = CTL_ISCSI_ERROR;
1829		return;
1830	}
1831	mtx_unlock(&cfiscsi_softc.lock);
1832
1833#if 0
1834	if (cs->cs_login_phase == false)
1835		return (EBUSY);
1836#endif
1837
1838	if (cs->cs_terminating) {
1839		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1840		ci->status = CTL_ISCSI_ERROR;
1841		return;
1842	}
1843
1844	datalen = cisp->data_segment_len;
1845	/*
1846	 * XXX
1847	 */
1848	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1849	if (datalen > 65535) {
1850		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1851		ci->status = CTL_ISCSI_ERROR;
1852		return;
1853	}
1854	if (datalen > 0) {
1855		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1856		error = copyin(cisp->data_segment, data, datalen);
1857		if (error != 0) {
1858			free(data, M_CFISCSI);
1859			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1860			ci->status = CTL_ISCSI_ERROR;
1861			return;
1862		}
1863	}
1864
1865	ip = icl_pdu_new_bhs(cs->cs_conn, M_WAITOK);
1866	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1867	if (datalen > 0) {
1868		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1869		free(data, M_CFISCSI);
1870	}
1871	CFISCSI_SESSION_LOCK(cs);
1872	icl_pdu_queue(ip);
1873	CFISCSI_SESSION_UNLOCK(cs);
1874	ci->status = CTL_ISCSI_OK;
1875}
1876
1877static void
1878cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1879{
1880	struct ctl_iscsi_receive_params *cirp;
1881	struct cfiscsi_session *cs;
1882	struct icl_pdu *ip;
1883	void *data;
1884	int error;
1885
1886	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1887
1888	mtx_lock(&cfiscsi_softc.lock);
1889	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1890		if (cs->cs_id == cirp->connection_id)
1891			break;
1892	}
1893	if (cs == NULL) {
1894		mtx_unlock(&cfiscsi_softc.lock);
1895		snprintf(ci->error_str, sizeof(ci->error_str),
1896		    "connection not found");
1897		ci->status = CTL_ISCSI_ERROR;
1898		return;
1899	}
1900	mtx_unlock(&cfiscsi_softc.lock);
1901
1902#if 0
1903	if (is->is_login_phase == false)
1904		return (EBUSY);
1905#endif
1906
1907	CFISCSI_SESSION_LOCK(cs);
1908	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
1909		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
1910		if (error != 0) {
1911			CFISCSI_SESSION_UNLOCK(cs);
1912			snprintf(ci->error_str, sizeof(ci->error_str),
1913			    "interrupted by signal");
1914			ci->status = CTL_ISCSI_ERROR;
1915			return;
1916		}
1917	}
1918
1919	if (cs->cs_terminating) {
1920		CFISCSI_SESSION_UNLOCK(cs);
1921		snprintf(ci->error_str, sizeof(ci->error_str),
1922		    "connection terminating");
1923		ci->status = CTL_ISCSI_ERROR;
1924		return;
1925	}
1926	ip = cs->cs_login_pdu;
1927	cs->cs_login_pdu = NULL;
1928	CFISCSI_SESSION_UNLOCK(cs);
1929
1930	if (ip->ip_data_len > cirp->data_segment_len) {
1931		icl_pdu_free(ip);
1932		snprintf(ci->error_str, sizeof(ci->error_str),
1933		    "data segment too big");
1934		ci->status = CTL_ISCSI_ERROR;
1935		return;
1936	}
1937
1938	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
1939	if (ip->ip_data_len > 0) {
1940		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
1941		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
1942		copyout(data, cirp->data_segment, ip->ip_data_len);
1943		free(data, M_CFISCSI);
1944	}
1945
1946	icl_pdu_free(ip);
1947	ci->status = CTL_ISCSI_OK;
1948}
1949
1950#endif /* !ICL_KERNEL_PROXY */
1951
1952static int
1953cfiscsi_ioctl(struct cdev *dev,
1954    u_long cmd, caddr_t addr, int flag, struct thread *td)
1955{
1956	struct ctl_iscsi *ci;
1957
1958	if (cmd != CTL_ISCSI)
1959		return (ENOTTY);
1960
1961	ci = (struct ctl_iscsi *)addr;
1962	switch (ci->type) {
1963	case CTL_ISCSI_HANDOFF:
1964		cfiscsi_ioctl_handoff(ci);
1965		break;
1966	case CTL_ISCSI_LIST:
1967		cfiscsi_ioctl_list(ci);
1968		break;
1969	case CTL_ISCSI_TERMINATE:
1970		cfiscsi_ioctl_terminate(ci);
1971		break;
1972	case CTL_ISCSI_LOGOUT:
1973		cfiscsi_ioctl_logout(ci);
1974		break;
1975#ifdef ICL_KERNEL_PROXY
1976	case CTL_ISCSI_LISTEN:
1977		cfiscsi_ioctl_listen(ci);
1978		break;
1979	case CTL_ISCSI_ACCEPT:
1980		cfiscsi_ioctl_accept(ci);
1981		break;
1982	case CTL_ISCSI_SEND:
1983		cfiscsi_ioctl_send(ci);
1984		break;
1985	case CTL_ISCSI_RECEIVE:
1986		cfiscsi_ioctl_receive(ci);
1987		break;
1988#else
1989	case CTL_ISCSI_LISTEN:
1990	case CTL_ISCSI_ACCEPT:
1991	case CTL_ISCSI_SEND:
1992	case CTL_ISCSI_RECEIVE:
1993		ci->status = CTL_ISCSI_ERROR;
1994		snprintf(ci->error_str, sizeof(ci->error_str),
1995		    "%s: CTL compiled without ICL_KERNEL_PROXY",
1996		    __func__);
1997		break;
1998#endif /* !ICL_KERNEL_PROXY */
1999	default:
2000		ci->status = CTL_ISCSI_ERROR;
2001		snprintf(ci->error_str, sizeof(ci->error_str),
2002		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2003		break;
2004	}
2005
2006	return (0);
2007}
2008
2009static int
2010cfiscsi_devid(struct ctl_scsiio *ctsio, int alloc_len)
2011{
2012	struct cfiscsi_session *cs;
2013	struct scsi_vpd_device_id *devid_ptr;
2014	struct scsi_vpd_id_descriptor *desc, *desc1, *desc2, *desc3, *desc4;
2015	struct scsi_vpd_id_descriptor *desc5;
2016	struct scsi_vpd_id_t10 *t10id;
2017	struct ctl_lun *lun;
2018	const struct icl_pdu *request;
2019	int i, ret;
2020	char *val;
2021	size_t data_len, devid_len, wwnn_len, wwpn_len, lun_name_len;
2022
2023	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2024	request = ctsio->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2025	cs = PDU_SESSION(request);
2026
2027	wwpn_len = strlen(cs->cs_target->ct_name);
2028	wwpn_len += strlen(",t,0x0001");
2029	wwpn_len += 1; /* '\0' */
2030	if ((wwpn_len % 4) != 0)
2031		wwpn_len += (4 - (wwpn_len % 4));
2032
2033	wwnn_len = strlen(cs->cs_target->ct_name);
2034	wwnn_len += 1; /* '\0' */
2035	if ((wwnn_len % 4) != 0)
2036		wwnn_len += (4 - (wwnn_len % 4));
2037
2038	if (lun == NULL) {
2039		devid_len = CTL_DEVID_MIN_LEN;
2040		lun_name_len = 0;
2041	} else {
2042		devid_len = max(CTL_DEVID_MIN_LEN,
2043		    strnlen(lun->be_lun->device_id, CTL_DEVID_LEN));
2044		lun_name_len = strlen(cs->cs_target->ct_name);
2045		lun_name_len += strlen(",lun,XXXXXXXX");
2046		lun_name_len += 1; /* '\0' */
2047		if ((lun_name_len % 4) != 0)
2048			lun_name_len += (4 - (lun_name_len % 4));
2049	}
2050
2051	data_len = sizeof(struct scsi_vpd_device_id) +
2052		sizeof(struct scsi_vpd_id_descriptor) +
2053		sizeof(struct scsi_vpd_id_t10) + devid_len +
2054		sizeof(struct scsi_vpd_id_descriptor) + lun_name_len +
2055		sizeof(struct scsi_vpd_id_descriptor) + wwnn_len +
2056		sizeof(struct scsi_vpd_id_descriptor) + wwpn_len +
2057		sizeof(struct scsi_vpd_id_descriptor) +
2058		sizeof(struct scsi_vpd_id_rel_trgt_port_id) +
2059		sizeof(struct scsi_vpd_id_descriptor) +
2060		sizeof(struct scsi_vpd_id_trgt_port_grp_id);
2061
2062	ctsio->kern_data_ptr = malloc(data_len, M_CTL, M_WAITOK | M_ZERO);
2063	devid_ptr = (struct scsi_vpd_device_id *)ctsio->kern_data_ptr;
2064	ctsio->kern_sg_entries = 0;
2065
2066	if (data_len < alloc_len) {
2067		ctsio->residual = alloc_len - data_len;
2068		ctsio->kern_data_len = data_len;
2069		ctsio->kern_total_len = data_len;
2070	} else {
2071		ctsio->residual = 0;
2072		ctsio->kern_data_len = alloc_len;
2073		ctsio->kern_total_len = alloc_len;
2074	}
2075	ctsio->kern_data_resid = 0;
2076	ctsio->kern_rel_offset = 0;
2077	ctsio->kern_sg_entries = 0;
2078
2079	desc = (struct scsi_vpd_id_descriptor *)devid_ptr->desc_list;
2080	t10id = (struct scsi_vpd_id_t10 *)&desc->identifier[0];
2081	desc1 = (struct scsi_vpd_id_descriptor *)(&desc->identifier[0] +
2082	    sizeof(struct scsi_vpd_id_t10) + devid_len);
2083	desc2 = (struct scsi_vpd_id_descriptor *)(&desc1->identifier[0] +
2084	    lun_name_len);
2085	desc3 = (struct scsi_vpd_id_descriptor *)(&desc2->identifier[0] +
2086	    wwnn_len);
2087	desc4 = (struct scsi_vpd_id_descriptor *)(&desc3->identifier[0] +
2088	    wwpn_len);
2089	desc5 = (struct scsi_vpd_id_descriptor *)(&desc4->identifier[0] +
2090	    sizeof(struct scsi_vpd_id_rel_trgt_port_id));
2091
2092	if (lun != NULL)
2093		devid_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
2094		    lun->be_lun->lun_type;
2095	else
2096		devid_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
2097
2098	devid_ptr->page_code = SVPD_DEVICE_ID;
2099
2100	scsi_ulto2b(data_len - 4, devid_ptr->length);
2101
2102	/*
2103	 * We're using a LUN association here.  i.e., this device ID is a
2104	 * per-LUN identifier.
2105	 */
2106	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_ASCII;
2107	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_LUN | SVPD_ID_TYPE_T10;
2108	desc->length = sizeof(*t10id) + devid_len;
2109	if (lun == NULL || (val = ctl_get_opt(&lun->be_lun->options,
2110	    "vendor")) == NULL) {
2111		strncpy((char *)t10id->vendor, CTL_VENDOR, sizeof(t10id->vendor));
2112	} else {
2113		memset(t10id->vendor, ' ', sizeof(t10id->vendor));
2114		strncpy(t10id->vendor, val,
2115		    min(sizeof(t10id->vendor), strlen(val)));
2116	}
2117
2118	/*
2119	 * If we've actually got a backend, copy the device id from the
2120	 * per-LUN data.  Otherwise, set it to all spaces.
2121	 */
2122	if (lun != NULL) {
2123		/*
2124		 * Copy the backend's LUN ID.
2125		 */
2126		strncpy((char *)t10id->vendor_spec_id,
2127		    (char *)lun->be_lun->device_id, devid_len);
2128	} else {
2129		/*
2130		 * No backend, set this to spaces.
2131		 */
2132		memset(t10id->vendor_spec_id, 0x20, devid_len);
2133	}
2134
2135	/*
2136	 * desc1 is for the unique LUN name.
2137	 *
2138	 * XXX: According to SPC-3, LUN must report the same ID through
2139	 *      all the ports.  The code below, however, reports the
2140	 *      ID only via iSCSI.
2141	 */
2142	desc1->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2143	desc1->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_LUN |
2144		SVPD_ID_TYPE_SCSI_NAME;
2145	desc1->length = lun_name_len;
2146	if (lun != NULL) {
2147		/*
2148		 * Find the per-target LUN number.
2149		 */
2150		for (i = 0; i < CTL_MAX_LUNS; i++) {
2151			if (cs->cs_target->ct_luns[i] == lun->lun)
2152				break;
2153		}
2154		KASSERT(i < CTL_MAX_LUNS,
2155		    ("lun %jd not found", (uintmax_t)lun->lun));
2156		ret = snprintf(desc1->identifier, lun_name_len, "%s,lun,%d",
2157		    cs->cs_target->ct_name, i);
2158		KASSERT(ret > 0 && ret <= lun_name_len, ("bad snprintf"));
2159	} else {
2160		KASSERT(lun_name_len == 0, ("no lun, but lun_name_len != 0"));
2161	}
2162
2163	/*
2164	 * desc2 is for the Target Name.
2165	 */
2166	desc2->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2167	desc2->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2168	    SVPD_ID_TYPE_SCSI_NAME;
2169	desc2->length = wwnn_len;
2170	snprintf(desc2->identifier, wwnn_len, "%s", cs->cs_target->ct_name);
2171
2172	/*
2173	 * desc3 is for the WWPN which is a port asscociation.
2174	 */
2175	desc3->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2176	desc3->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2177	    SVPD_ID_TYPE_SCSI_NAME;
2178	desc3->length = wwpn_len;
2179	snprintf(desc3->identifier, wwpn_len, "%s,t,0x%4.4x",
2180	    cs->cs_target->ct_name, cs->cs_portal_group_tag);
2181
2182	/*
2183	 * desc3 is for the Relative Target Port(type 4h) identifier
2184	 */
2185	desc4->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_BINARY;
2186	desc4->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2187	    SVPD_ID_TYPE_RELTARG;
2188	desc4->length = 4;
2189	desc4->identifier[3] = 1;
2190
2191	/*
2192	 * desc4 is for the Target Port Group(type 5h) identifier
2193	 */
2194	desc5->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_BINARY;
2195	desc5->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2196	    SVPD_ID_TYPE_TPORTGRP;
2197	desc5->length = 4;
2198	desc5->identifier[3] = 1;
2199
2200	ctsio->scsi_status = SCSI_STATUS_OK;
2201
2202	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2203	ctsio->be_move_done = ctl_config_move_done;
2204	ctl_datamove((union ctl_io *)ctsio);
2205
2206	return (CTL_RETVAL_COMPLETE);
2207}
2208
2209static void
2210cfiscsi_target_hold(struct cfiscsi_target *ct)
2211{
2212
2213	refcount_acquire(&ct->ct_refcount);
2214}
2215
2216static void
2217cfiscsi_target_release(struct cfiscsi_target *ct)
2218{
2219	struct cfiscsi_softc *softc;
2220
2221	softc = ct->ct_softc;
2222	mtx_lock(&softc->lock);
2223	if (refcount_release(&ct->ct_refcount)) {
2224		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2225		mtx_unlock(&softc->lock);
2226		free(ct, M_CFISCSI);
2227
2228		return;
2229	}
2230	mtx_unlock(&softc->lock);
2231}
2232
2233static struct cfiscsi_target *
2234cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name)
2235{
2236	struct cfiscsi_target *ct;
2237
2238	mtx_lock(&softc->lock);
2239	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2240		if (strcmp(name, ct->ct_name) != 0)
2241			continue;
2242		cfiscsi_target_hold(ct);
2243		mtx_unlock(&softc->lock);
2244		return (ct);
2245	}
2246	mtx_unlock(&softc->lock);
2247
2248	return (NULL);
2249}
2250
2251static struct cfiscsi_target *
2252cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2253    const char *alias)
2254{
2255	struct cfiscsi_target *ct, *newct;
2256	int i;
2257
2258	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2259		return (NULL);
2260
2261	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2262
2263	mtx_lock(&softc->lock);
2264	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2265		if (strcmp(name, ct->ct_name) != 0)
2266			continue;
2267		cfiscsi_target_hold(ct);
2268		mtx_unlock(&softc->lock);
2269		free(newct, M_CFISCSI);
2270		return (ct);
2271	}
2272
2273	for (i = 0; i < CTL_MAX_LUNS; i++)
2274		newct->ct_luns[i] = -1;
2275
2276	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2277	if (alias != NULL)
2278		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2279	refcount_init(&newct->ct_refcount, 1);
2280	newct->ct_softc = softc;
2281	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2282	mtx_unlock(&softc->lock);
2283
2284	return (newct);
2285}
2286
2287/*
2288 * Takes LUN from the target space and returns LUN from the CTL space.
2289 */
2290static uint32_t
2291cfiscsi_map_lun(void *arg, uint32_t lun)
2292{
2293	struct cfiscsi_session *cs;
2294
2295	cs = arg;
2296
2297	if (lun >= CTL_MAX_LUNS) {
2298		CFISCSI_DEBUG("requested lun number %d is higher "
2299		    "than maximum %d", lun, CTL_MAX_LUNS - 1);
2300		return (0xffffffff);
2301	}
2302
2303	if (cs->cs_target->ct_luns[lun] < 0)
2304		return (0xffffffff);
2305
2306	return (cs->cs_target->ct_luns[lun]);
2307}
2308
2309static int
2310cfiscsi_target_set_lun(struct cfiscsi_target *ct,
2311    unsigned long lun_id, unsigned long ctl_lun_id)
2312{
2313
2314	if (lun_id >= CTL_MAX_LUNS) {
2315		CFISCSI_WARN("requested lun number %ld is higher "
2316		    "than maximum %d", lun_id, CTL_MAX_LUNS - 1);
2317		return (-1);
2318	}
2319
2320	if (ct->ct_luns[lun_id] >= 0) {
2321		/*
2322		 * CTL calls cfiscsi_lun_enable() twice for each LUN - once
2323		 * when the LUN is created, and a second time just before
2324		 * the port is brought online; don't emit warnings
2325		 * for that case.
2326		 */
2327		if (ct->ct_luns[lun_id] == ctl_lun_id)
2328			return (0);
2329		CFISCSI_WARN("lun %ld already allocated", lun_id);
2330		return (-1);
2331	}
2332
2333#if 0
2334	CFISCSI_DEBUG("adding mapping for lun %ld, target %s "
2335	    "to ctl lun %ld", lun_id, ct->ct_name, ctl_lun_id);
2336#endif
2337
2338	ct->ct_luns[lun_id] = ctl_lun_id;
2339	cfiscsi_target_hold(ct);
2340
2341	return (0);
2342}
2343
2344static int
2345cfiscsi_target_unset_lun(struct cfiscsi_target *ct, unsigned long lun_id)
2346{
2347
2348	if (ct->ct_luns[lun_id] < 0) {
2349		CFISCSI_WARN("lun %ld not allocated", lun_id);
2350		return (-1);
2351	}
2352
2353	ct->ct_luns[lun_id] = -1;
2354	cfiscsi_target_release(ct);
2355
2356	return (0);
2357}
2358
2359static int
2360cfiscsi_lun_enable(void *arg, struct ctl_id target_id, int lun_id)
2361{
2362	struct cfiscsi_softc *softc;
2363	struct cfiscsi_target *ct;
2364	const char *target = NULL, *target_alias = NULL;
2365	const char *lun = NULL;
2366	unsigned long tmp;
2367
2368	softc = (struct cfiscsi_softc *)arg;
2369
2370	target = ctl_get_opt(&control_softc->ctl_luns[lun_id]->be_lun->options,
2371	    "cfiscsi_target");
2372	target_alias = ctl_get_opt(&control_softc->ctl_luns[lun_id]->be_lun->options,
2373	    "cfiscsi_target_alias");
2374	lun = ctl_get_opt(&control_softc->ctl_luns[lun_id]->be_lun->options,
2375	    "cfiscsi_lun");
2376
2377	if (target == NULL && lun == NULL)
2378		return (0);
2379
2380	if (target == NULL || lun == NULL) {
2381		CFISCSI_WARN("lun added with cfiscsi_target, but without "
2382		    "cfiscsi_lun, or the other way around; ignoring");
2383		return (0);
2384	}
2385
2386	ct = cfiscsi_target_find_or_create(softc, target, target_alias);
2387	if (ct == NULL) {
2388		CFISCSI_WARN("failed to create target \"%s\"", target);
2389		return (0);
2390	}
2391
2392	tmp = strtoul(lun, NULL, 10);
2393	cfiscsi_target_set_lun(ct, tmp, lun_id);
2394	cfiscsi_target_release(ct);
2395	return (0);
2396}
2397
2398static int
2399cfiscsi_lun_disable(void *arg, struct ctl_id target_id, int lun_id)
2400{
2401	struct cfiscsi_softc *softc;
2402	struct cfiscsi_target *ct;
2403	int i;
2404
2405	softc = (struct cfiscsi_softc *)arg;
2406
2407	mtx_lock(&softc->lock);
2408	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2409		for (i = 0; i < CTL_MAX_LUNS; i++) {
2410			if (ct->ct_luns[i] < 0)
2411				continue;
2412			if (ct->ct_luns[i] != lun_id)
2413				continue;
2414			mtx_unlock(&softc->lock);
2415			cfiscsi_target_unset_lun(ct, i);
2416			return (0);
2417		}
2418	}
2419	mtx_unlock(&softc->lock);
2420	return (0);
2421}
2422
2423static void
2424cfiscsi_datamove_in(union ctl_io *io)
2425{
2426	struct cfiscsi_session *cs;
2427	struct icl_pdu *request, *response;
2428	const struct iscsi_bhs_scsi_command *bhssc;
2429	struct iscsi_bhs_data_in *bhsdi;
2430	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2431	size_t len, expected_len, sg_len, buffer_offset;
2432	const char *sg_addr;
2433	int ctl_sg_count, error, i;
2434
2435	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2436	cs = PDU_SESSION(request);
2437
2438	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2439	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2440	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2441	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2442
2443	if (io->scsiio.kern_sg_entries > 0) {
2444		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2445		ctl_sg_count = io->scsiio.kern_sg_entries;
2446	} else {
2447		ctl_sglist = &ctl_sg_entry;
2448		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2449		ctl_sglist->len = io->scsiio.kern_data_len;
2450		ctl_sg_count = 1;
2451	}
2452
2453	/*
2454	 * This is the total amount of data to be transferred within the current
2455	 * SCSI command.  We need to record it so that we can properly report
2456	 * underflow/underflow.
2457	 */
2458	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2459
2460	/*
2461	 * This is the offset within the current SCSI command; for the first
2462	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2463	 * it will be the sum of lengths of previous ones.
2464	 */
2465	buffer_offset = io->scsiio.kern_rel_offset;
2466
2467	/*
2468	 * This is the transfer length expected by the initiator.  In theory,
2469	 * it could be different from the correct amount of data from the SCSI
2470	 * point of view, even if that doesn't make any sense.
2471	 */
2472	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2473#if 0
2474	if (expected_len != io->scsiio.kern_total_len) {
2475		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2476		    "actual length %zd", expected_len,
2477		    (size_t)io->scsiio.kern_total_len);
2478	}
2479#endif
2480
2481	if (buffer_offset >= expected_len) {
2482#if 0
2483		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2484		    "already sent the expected len", buffer_offset);
2485#endif
2486		io->scsiio.be_move_done(io);
2487		return;
2488	}
2489
2490	i = 0;
2491	sg_addr = NULL;
2492	sg_len = 0;
2493	response = NULL;
2494	bhsdi = NULL;
2495	for (;;) {
2496		if (response == NULL) {
2497			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2498			if (response == NULL) {
2499				CFISCSI_SESSION_WARN(cs, "failed to "
2500				    "allocate memory; dropping connection");
2501				ctl_set_busy(&io->scsiio);
2502				io->scsiio.be_move_done(io);
2503				cfiscsi_session_terminate(cs);
2504				return;
2505			}
2506			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2507			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2508			bhsdi->bhsdi_initiator_task_tag =
2509			    bhssc->bhssc_initiator_task_tag;
2510			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2511			PDU_EXPDATASN(request)++;
2512			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2513		}
2514
2515		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2516		if (sg_len == 0) {
2517			sg_addr = ctl_sglist[i].addr;
2518			sg_len = ctl_sglist[i].len;
2519			KASSERT(sg_len > 0, ("sg_len <= 0"));
2520		}
2521
2522		len = sg_len;
2523
2524		/*
2525		 * Truncate to maximum data segment length.
2526		 */
2527		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2528		    ("ip_data_len %zd >= max_data_segment_length %zd",
2529		    response->ip_data_len, cs->cs_max_data_segment_length));
2530		if (response->ip_data_len + len >
2531		    cs->cs_max_data_segment_length) {
2532			len = cs->cs_max_data_segment_length -
2533			    response->ip_data_len;
2534			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2535			    len, sg_len));
2536		}
2537
2538		/*
2539		 * Truncate to expected data transfer length.
2540		 */
2541		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2542		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2543		    buffer_offset, response->ip_data_len, expected_len));
2544		if (buffer_offset + response->ip_data_len + len > expected_len) {
2545			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2546			    "to expected data transfer length %zd",
2547			    buffer_offset + response->ip_data_len + len, expected_len);
2548			len = expected_len - (buffer_offset + response->ip_data_len);
2549			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2550			    len, sg_len));
2551		}
2552
2553		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2554		if (error != 0) {
2555			CFISCSI_SESSION_WARN(cs, "failed to "
2556			    "allocate memory; dropping connection");
2557			icl_pdu_free(response);
2558			ctl_set_busy(&io->scsiio);
2559			io->scsiio.be_move_done(io);
2560			cfiscsi_session_terminate(cs);
2561			return;
2562		}
2563		sg_addr += len;
2564		sg_len -= len;
2565
2566		KASSERT(buffer_offset + request->ip_data_len <= expected_len,
2567		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2568		    buffer_offset, request->ip_data_len, expected_len));
2569		if (buffer_offset + request->ip_data_len == expected_len) {
2570			/*
2571			 * Already have the amount of data the initiator wanted.
2572			 */
2573			break;
2574		}
2575
2576		if (sg_len == 0) {
2577			/*
2578			 * End of scatter-gather segment;
2579			 * proceed to the next one...
2580			 */
2581			if (i == ctl_sg_count - 1) {
2582				/*
2583				 * ... unless this was the last one.
2584				 */
2585				break;
2586			}
2587			i++;
2588		}
2589
2590		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2591			/*
2592			 * Can't stuff more data into the current PDU;
2593			 * queue it.  Note that's not enough to check
2594			 * for kern_data_resid == 0 instead; there
2595			 * may be several Data-In PDUs for the final
2596			 * call to cfiscsi_datamove(), and we want
2597			 * to set the F flag only on the last of them.
2598			 */
2599			buffer_offset += response->ip_data_len;
2600			if (buffer_offset == io->scsiio.kern_total_len ||
2601			    buffer_offset == expected_len)
2602				bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2603			cfiscsi_pdu_queue(response);
2604			response = NULL;
2605			bhsdi = NULL;
2606		}
2607	}
2608	if (response != NULL) {
2609		buffer_offset += response->ip_data_len;
2610		if (buffer_offset == io->scsiio.kern_total_len ||
2611		    buffer_offset == expected_len)
2612			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2613		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2614		cfiscsi_pdu_queue(response);
2615	}
2616
2617	io->scsiio.be_move_done(io);
2618}
2619
2620static void
2621cfiscsi_datamove_out(union ctl_io *io)
2622{
2623	struct cfiscsi_session *cs;
2624	struct icl_pdu *request, *response;
2625	const struct iscsi_bhs_scsi_command *bhssc;
2626	struct iscsi_bhs_r2t *bhsr2t;
2627	struct cfiscsi_data_wait *cdw;
2628	uint32_t target_transfer_tag;
2629	bool done;
2630
2631	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2632	cs = PDU_SESSION(request);
2633
2634	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2635	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2636	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2637	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2638
2639	/*
2640	 * We need to record it so that we can properly report
2641	 * underflow/underflow.
2642	 */
2643	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2644
2645	/*
2646	 * We hadn't received anything during this datamove yet.
2647	 */
2648	io->scsiio.ext_data_filled = 0;
2649
2650	target_transfer_tag =
2651	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2652
2653#if 0
2654	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2655	    "task tag 0x%x, target transfer tag 0x%x",
2656	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2657#endif
2658	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
2659	if (cdw == NULL) {
2660		CFISCSI_SESSION_WARN(cs, "failed to "
2661		    "allocate memory; dropping connection");
2662		ctl_set_busy(&io->scsiio);
2663		io->scsiio.be_move_done(io);
2664		cfiscsi_session_terminate(cs);
2665		return;
2666	}
2667	cdw->cdw_ctl_io = io;
2668	cdw->cdw_target_transfer_tag = target_transfer_tag;
2669	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2670
2671	if (cs->cs_immediate_data && io->scsiio.kern_rel_offset <
2672	    icl_pdu_data_segment_length(request)) {
2673		done = cfiscsi_handle_data_segment(request, cdw);
2674		if (done) {
2675			uma_zfree(cfiscsi_data_wait_zone, cdw);
2676			io->scsiio.be_move_done(io);
2677			return;
2678		}
2679	}
2680
2681	CFISCSI_SESSION_LOCK(cs);
2682	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2683	CFISCSI_SESSION_UNLOCK(cs);
2684
2685	/*
2686	 * XXX: We should limit the number of outstanding R2T PDUs
2687	 * 	per task to MaxOutstandingR2T.
2688	 */
2689	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2690	if (response == NULL) {
2691		CFISCSI_SESSION_WARN(cs, "failed to "
2692		    "allocate memory; dropping connection");
2693		ctl_set_busy(&io->scsiio);
2694		io->scsiio.be_move_done(io);
2695		cfiscsi_session_terminate(cs);
2696		return;
2697	}
2698	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2699	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2700	bhsr2t->bhsr2t_flags = 0x80;
2701	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2702	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2703	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2704	/*
2705	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2706	 *	be running concurrently on several CPUs for a given
2707	 *	command.
2708	 */
2709	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2710	PDU_R2TSN(request)++;
2711	/*
2712	 * This is the offset within the current SCSI command;
2713	 * i.e. for the first call of datamove(), it will be 0,
2714	 * and for subsequent ones it will be the sum of lengths
2715	 * of previous ones.
2716	 *
2717	 * The ext_data_filled is to account for unsolicited
2718	 * (immediate) data that might have already arrived.
2719	 */
2720	bhsr2t->bhsr2t_buffer_offset =
2721	    htonl(io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled);
2722	/*
2723	 * This is the total length (sum of S/G lengths) this call
2724	 * to cfiscsi_datamove() is supposed to handle.
2725	 *
2726	 * XXX: Limit it to MaxBurstLength.
2727	 */
2728	bhsr2t->bhsr2t_desired_data_transfer_length =
2729	    htonl(io->scsiio.kern_data_len - io->scsiio.ext_data_filled);
2730	cfiscsi_pdu_queue(response);
2731}
2732
2733static void
2734cfiscsi_datamove(union ctl_io *io)
2735{
2736
2737	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2738		cfiscsi_datamove_in(io);
2739	else
2740		cfiscsi_datamove_out(io);
2741}
2742
2743static void
2744cfiscsi_scsi_command_done(union ctl_io *io)
2745{
2746	struct icl_pdu *request, *response;
2747	struct iscsi_bhs_scsi_command *bhssc;
2748	struct iscsi_bhs_scsi_response *bhssr;
2749#ifdef DIAGNOSTIC
2750	struct cfiscsi_data_wait *cdw;
2751#endif
2752	struct cfiscsi_session *cs;
2753	uint16_t sense_length;
2754
2755	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2756	cs = PDU_SESSION(request);
2757	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2758	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2759	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2760	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2761
2762	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2763	//    bhssc->bhssc_initiator_task_tag);
2764
2765#ifdef DIAGNOSTIC
2766	CFISCSI_SESSION_LOCK(cs);
2767	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2768		KASSERT(bhssc->bhssc_initiator_task_tag !=
2769		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2770	CFISCSI_SESSION_UNLOCK(cs);
2771#endif
2772
2773	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2774	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2775	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2776	bhssr->bhssr_flags = 0x80;
2777	/*
2778	 * XXX: We don't deal with bidirectional under/overflows;
2779	 *	does anything actually support those?
2780	 */
2781	if (PDU_TOTAL_TRANSFER_LEN(request) <
2782	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2783		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2784		bhssr->bhssr_residual_count =
2785		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2786		    PDU_TOTAL_TRANSFER_LEN(request));
2787		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2788		//    ntohl(bhssr->bhssr_residual_count));
2789	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2790	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2791		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2792		bhssr->bhssr_residual_count =
2793		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2794		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2795		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2796		//    ntohl(bhssr->bhssr_residual_count));
2797	}
2798	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2799	bhssr->bhssr_status = io->scsiio.scsi_status;
2800	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2801	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2802
2803	if (io->scsiio.sense_len > 0) {
2804#if 0
2805		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2806		    io->scsiio.sense_len);
2807#endif
2808		sense_length = htons(io->scsiio.sense_len);
2809		icl_pdu_append_data(response,
2810		    &sense_length, sizeof(sense_length), M_WAITOK);
2811		icl_pdu_append_data(response,
2812		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2813	}
2814
2815	ctl_free_io(io);
2816	icl_pdu_free(request);
2817	cfiscsi_pdu_queue(response);
2818}
2819
2820static void
2821cfiscsi_task_management_done(union ctl_io *io)
2822{
2823	struct icl_pdu *request, *response;
2824	struct iscsi_bhs_task_management_request *bhstmr;
2825	struct iscsi_bhs_task_management_response *bhstmr2;
2826	struct cfiscsi_data_wait *cdw, *tmpcdw;
2827	struct cfiscsi_session *cs;
2828
2829	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2830	cs = PDU_SESSION(request);
2831	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2832	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2833	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2834	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2835
2836#if 0
2837	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2838	    bhstmr->bhstmr_initiator_task_tag,
2839	    bhstmr->bhstmr_referenced_task_tag);
2840#endif
2841
2842	if ((bhstmr->bhstmr_function & ~0x80) ==
2843	    BHSTMR_FUNCTION_ABORT_TASK) {
2844		/*
2845		 * Make sure we no longer wait for Data-Out for this command.
2846		 */
2847		CFISCSI_SESSION_LOCK(cs);
2848		TAILQ_FOREACH_SAFE(cdw,
2849		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2850			if (bhstmr->bhstmr_referenced_task_tag !=
2851			    cdw->cdw_initiator_task_tag)
2852				continue;
2853
2854#if 0
2855			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2856			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2857#endif
2858			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2859			    cdw, cdw_next);
2860			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2861			uma_zfree(cfiscsi_data_wait_zone, cdw);
2862		}
2863		CFISCSI_SESSION_UNLOCK(cs);
2864	}
2865
2866	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2867	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2868	    response->ip_bhs;
2869	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2870	bhstmr2->bhstmr_flags = 0x80;
2871	if (io->io_hdr.status == CTL_SUCCESS) {
2872		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2873	} else {
2874		/*
2875		 * XXX: How to figure out what exactly went wrong?  iSCSI spec
2876		 * 	expects us to provide detailed error, e.g. "Task does
2877		 * 	not exist" or "LUN does not exist".
2878		 */
2879		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED");
2880		bhstmr2->bhstmr_response =
2881		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2882	}
2883	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2884
2885	ctl_free_io(io);
2886	icl_pdu_free(request);
2887	cfiscsi_pdu_queue(response);
2888}
2889
2890static void
2891cfiscsi_done(union ctl_io *io)
2892{
2893	struct icl_pdu *request;
2894	struct cfiscsi_session *cs;
2895
2896	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2897		("invalid CTL status %#x", io->io_hdr.status));
2898
2899	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2900	if (request == NULL) {
2901		/*
2902		 * Implicit task termination has just completed; nothing to do.
2903		 */
2904		return;
2905	}
2906
2907	cs = PDU_SESSION(request);
2908	refcount_release(&cs->cs_outstanding_ctl_pdus);
2909
2910	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2911	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2912		cfiscsi_scsi_command_done(io);
2913		break;
2914	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2915		cfiscsi_task_management_done(io);
2916		break;
2917	default:
2918		panic("cfiscsi_done called with wrong opcode 0x%x",
2919		    request->ip_bhs->bhs_opcode);
2920	}
2921}
2922