ctl_frontend_iscsi.c revision 286806
1/*-
2 * Copyright (c) 2012 The FreeBSD Foundation
3 * All rights reserved.
4 *
5 * This software was developed by Edward Tomasz Napierala under sponsorship
6 * from the FreeBSD Foundation.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 * $FreeBSD: head/sys/cam/ctl/ctl_frontend_iscsi.c 286806 2015-08-15 13:34:38Z mav $
30 */
31
32/*
33 * CTL frontend for the iSCSI protocol.
34 */
35
36#include <sys/cdefs.h>
37__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_frontend_iscsi.c 286806 2015-08-15 13:34:38Z mav $");
38
39#include <sys/param.h>
40#include <sys/capsicum.h>
41#include <sys/condvar.h>
42#include <sys/file.h>
43#include <sys/kernel.h>
44#include <sys/kthread.h>
45#include <sys/lock.h>
46#include <sys/malloc.h>
47#include <sys/module.h>
48#include <sys/mutex.h>
49#include <sys/queue.h>
50#include <sys/sbuf.h>
51#include <sys/sysctl.h>
52#include <sys/systm.h>
53#include <sys/uio.h>
54#include <sys/unistd.h>
55#include <vm/uma.h>
56
57#include <cam/scsi/scsi_all.h>
58#include <cam/scsi/scsi_da.h>
59#include <cam/ctl/ctl_io.h>
60#include <cam/ctl/ctl.h>
61#include <cam/ctl/ctl_backend.h>
62#include <cam/ctl/ctl_error.h>
63#include <cam/ctl/ctl_frontend.h>
64#include <cam/ctl/ctl_debug.h>
65#include <cam/ctl/ctl_ha.h>
66#include <cam/ctl/ctl_ioctl.h>
67#include <cam/ctl/ctl_private.h>
68
69#include <dev/iscsi/icl.h>
70#include <dev/iscsi/icl_wrappers.h>
71#include <dev/iscsi/iscsi_proto.h>
72#include <cam/ctl/ctl_frontend_iscsi.h>
73
74#ifdef ICL_KERNEL_PROXY
75#include <sys/socketvar.h>
76#endif
77
78#ifdef ICL_KERNEL_PROXY
79FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
80#endif
81
82static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
83static uma_zone_t cfiscsi_data_wait_zone;
84
85SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
86    "CAM Target Layer iSCSI Frontend");
87static int debug = 1;
88SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
89    &debug, 1, "Enable debug messages");
90static int ping_timeout = 5;
91SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
92    &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
93static int login_timeout = 60;
94SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
95    &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
96static int maxcmdsn_delta = 256;
97SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
98    &maxcmdsn_delta, 256, "Number of commands the initiator can send "
99    "without confirmation");
100
101#define	CFISCSI_DEBUG(X, ...)						\
102	do {								\
103		if (debug > 1) {					\
104			printf("%s: " X "\n",				\
105			    __func__, ## __VA_ARGS__);			\
106		}							\
107	} while (0)
108
109#define	CFISCSI_WARN(X, ...)						\
110	do {								\
111		if (debug > 0) {					\
112			printf("WARNING: %s: " X "\n",			\
113			    __func__, ## __VA_ARGS__);			\
114		}							\
115	} while (0)
116
117#define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
118	do {								\
119		if (debug > 1) {					\
120			printf("%s: %s (%s): " X "\n",			\
121			    __func__, S->cs_initiator_addr,		\
122			    S->cs_initiator_name, ## __VA_ARGS__);	\
123		}							\
124	} while (0)
125
126#define	CFISCSI_SESSION_WARN(S, X, ...)					\
127	do  {								\
128		if (debug > 0) {					\
129			printf("WARNING: %s (%s): " X "\n",		\
130			    S->cs_initiator_addr,			\
131			    S->cs_initiator_name, ## __VA_ARGS__);	\
132		}							\
133	} while (0)
134
135#define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
136#define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
137#define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
138
139#define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
140#define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
141#define	PDU_EXPDATASN(X)		(X)->ip_prv0
142#define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
143#define	PDU_R2TSN(X)			(X)->ip_prv2
144
145int		cfiscsi_init(void);
146static void	cfiscsi_online(void *arg);
147static void	cfiscsi_offline(void *arg);
148static int	cfiscsi_info(void *arg, struct sbuf *sb);
149static int	cfiscsi_lun_enable(void *arg, int lun_id);
150static int	cfiscsi_lun_disable(void *arg, int lun_id);
151static int	cfiscsi_ioctl(struct cdev *dev,
152		    u_long cmd, caddr_t addr, int flag, struct thread *td);
153static void	cfiscsi_datamove(union ctl_io *io);
154static void	cfiscsi_datamove_in(union ctl_io *io);
155static void	cfiscsi_datamove_out(union ctl_io *io);
156static void	cfiscsi_done(union ctl_io *io);
157static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
158static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
159static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
160static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
161static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
162static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
163static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
164static struct cfiscsi_data_wait	*cfiscsi_data_wait_new(
165		    struct cfiscsi_session *cs, union ctl_io *io,
166		    uint32_t initiator_task_tag,
167		    uint32_t *target_transfer_tagp);
168static void	cfiscsi_data_wait_free(struct cfiscsi_session *cs,
169		    struct cfiscsi_data_wait *cdw);
170static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
171		    *softc, const char *name, uint16_t tag);
172static struct cfiscsi_target	*cfiscsi_target_find_or_create(
173    struct cfiscsi_softc *softc, const char *name, const char *alias,
174    uint16_t tag);
175static void	cfiscsi_target_release(struct cfiscsi_target *ct);
176static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
177
178static struct cfiscsi_softc cfiscsi_softc;
179extern struct ctl_softc *control_softc;
180
181static struct ctl_frontend cfiscsi_frontend =
182{
183	.name = "iscsi",
184	.init = cfiscsi_init,
185	.ioctl = cfiscsi_ioctl,
186};
187CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
188MODULE_DEPEND(ctlcfiscsi, icl, 1, 1, 1);
189
190static struct icl_pdu *
191cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
192{
193
194	return (icl_pdu_new(request->ip_conn, flags));
195}
196
197static bool
198cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
199{
200	const struct iscsi_bhs_scsi_command *bhssc;
201	struct cfiscsi_session *cs;
202	uint32_t cmdsn, expstatsn;
203
204	cs = PDU_SESSION(request);
205
206	/*
207	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
208	 * The purpose of the timeout is to reset the connection when it stalls;
209	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
210	 * in some queue.
211	 *
212	 * XXX: Locking?
213	 */
214	cs->cs_timeout = 0;
215
216	/*
217	 * Data-Out PDUs don't contain CmdSN.
218	 */
219	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
220	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
221		return (false);
222
223	/*
224	 * We're only using fields common for all the request
225	 * (initiator -> target) PDUs.
226	 */
227	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
228	cmdsn = ntohl(bhssc->bhssc_cmdsn);
229	expstatsn = ntohl(bhssc->bhssc_expstatsn);
230
231	CFISCSI_SESSION_LOCK(cs);
232#if 0
233	if (expstatsn != cs->cs_statsn) {
234		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
235		    "while current StatSN is %d", expstatsn,
236		    cs->cs_statsn);
237	}
238#endif
239
240	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0) {
241		/*
242		 * The target MUST silently ignore any non-immediate command
243		 * outside of this range.
244		 */
245		if (ISCSI_SNLT(cmdsn, cs->cs_cmdsn) ||
246		    ISCSI_SNGT(cmdsn, cs->cs_cmdsn + maxcmdsn_delta)) {
247			CFISCSI_SESSION_UNLOCK(cs);
248			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
249			    "while expected %u", cmdsn, cs->cs_cmdsn);
250			return (true);
251		}
252
253		/*
254		 * We don't support multiple connections now, so any
255		 * discontinuity in CmdSN means lost PDUs.  Since we don't
256		 * support PDU retransmission -- terminate the connection.
257		 */
258		if (cmdsn != cs->cs_cmdsn) {
259			CFISCSI_SESSION_UNLOCK(cs);
260			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
261			    "while expected %u; dropping connection",
262			    cmdsn, cs->cs_cmdsn);
263			cfiscsi_session_terminate(cs);
264			return (true);
265		}
266		cs->cs_cmdsn++;
267	}
268
269	CFISCSI_SESSION_UNLOCK(cs);
270
271	return (false);
272}
273
274static void
275cfiscsi_pdu_handle(struct icl_pdu *request)
276{
277	struct cfiscsi_session *cs;
278	bool ignore;
279
280	cs = PDU_SESSION(request);
281
282	ignore = cfiscsi_pdu_update_cmdsn(request);
283	if (ignore) {
284		icl_pdu_free(request);
285		return;
286	}
287
288	/*
289	 * Handle the PDU; this includes e.g. receiving the remaining
290	 * part of PDU and submitting the SCSI command to CTL
291	 * or queueing a reply.  The handling routine is responsible
292	 * for freeing the PDU when it's no longer needed.
293	 */
294	switch (request->ip_bhs->bhs_opcode &
295	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
296	case ISCSI_BHS_OPCODE_NOP_OUT:
297		cfiscsi_pdu_handle_nop_out(request);
298		break;
299	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
300		cfiscsi_pdu_handle_scsi_command(request);
301		break;
302	case ISCSI_BHS_OPCODE_TASK_REQUEST:
303		cfiscsi_pdu_handle_task_request(request);
304		break;
305	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
306		cfiscsi_pdu_handle_data_out(request);
307		break;
308	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
309		cfiscsi_pdu_handle_logout_request(request);
310		break;
311	default:
312		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
313		    "opcode 0x%x; dropping connection",
314		    request->ip_bhs->bhs_opcode);
315		icl_pdu_free(request);
316		cfiscsi_session_terminate(cs);
317	}
318
319}
320
321static void
322cfiscsi_receive_callback(struct icl_pdu *request)
323{
324	struct cfiscsi_session *cs;
325
326	cs = PDU_SESSION(request);
327
328#ifdef ICL_KERNEL_PROXY
329	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
330		if (cs->cs_login_pdu == NULL)
331			cs->cs_login_pdu = request;
332		else
333			icl_pdu_free(request);
334		cv_signal(&cs->cs_login_cv);
335		return;
336	}
337#endif
338
339	cfiscsi_pdu_handle(request);
340}
341
342static void
343cfiscsi_error_callback(struct icl_conn *ic)
344{
345	struct cfiscsi_session *cs;
346
347	cs = CONN_SESSION(ic);
348
349	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
350	cfiscsi_session_terminate(cs);
351}
352
353static int
354cfiscsi_pdu_prepare(struct icl_pdu *response)
355{
356	struct cfiscsi_session *cs;
357	struct iscsi_bhs_scsi_response *bhssr;
358	bool advance_statsn = true;
359
360	cs = PDU_SESSION(response);
361
362	CFISCSI_SESSION_LOCK_ASSERT(cs);
363
364	/*
365	 * We're only using fields common for all the response
366	 * (target -> initiator) PDUs.
367	 */
368	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
369
370	/*
371	 * 10.8.3: "The StatSN for this connection is not advanced
372	 * after this PDU is sent."
373	 */
374	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
375		advance_statsn = false;
376
377	/*
378	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
379	 * StatSN for the connection is not advanced after this PDU is sent."
380	 */
381	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
382	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
383		advance_statsn = false;
384
385	/*
386	 * See the comment below - StatSN is not meaningful and must
387	 * not be advanced.
388	 */
389	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN &&
390	    (bhssr->bhssr_flags & BHSDI_FLAGS_S) == 0)
391		advance_statsn = false;
392
393	/*
394	 * 10.7.3: "The fields StatSN, Status, and Residual Count
395	 * only have meaningful content if the S bit is set to 1."
396	 */
397	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
398	    (bhssr->bhssr_flags & BHSDI_FLAGS_S))
399		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
400	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
401	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
402
403	if (advance_statsn)
404		cs->cs_statsn++;
405
406	return (0);
407}
408
409static void
410cfiscsi_pdu_queue(struct icl_pdu *response)
411{
412	struct cfiscsi_session *cs;
413
414	cs = PDU_SESSION(response);
415
416	CFISCSI_SESSION_LOCK(cs);
417	cfiscsi_pdu_prepare(response);
418	icl_pdu_queue(response);
419	CFISCSI_SESSION_UNLOCK(cs);
420}
421
422static uint32_t
423cfiscsi_decode_lun(uint64_t encoded)
424{
425	uint8_t lun[8];
426	uint32_t result;
427
428	/*
429	 * The LUN field in iSCSI PDUs may look like an ordinary 64 bit number,
430	 * but is in fact an evil, multidimensional structure defined
431	 * in SCSI Architecture Model 5 (SAM-5), section 4.6.
432	 */
433	memcpy(lun, &encoded, sizeof(lun));
434	switch (lun[0] & 0xC0) {
435	case 0x00:
436		if ((lun[0] & 0x3f) != 0 || lun[2] != 0 || lun[3] != 0 ||
437		    lun[4] != 0 || lun[5] != 0 || lun[6] != 0 || lun[7] != 0) {
438			CFISCSI_WARN("malformed LUN "
439			    "(peripheral device addressing method): 0x%jx",
440			    (uintmax_t)encoded);
441			result = 0xffffffff;
442			break;
443		}
444		result = lun[1];
445		break;
446	case 0x40:
447		if (lun[2] != 0 || lun[3] != 0 || lun[4] != 0 || lun[5] != 0 ||
448		    lun[6] != 0 || lun[7] != 0) {
449			CFISCSI_WARN("malformed LUN "
450			    "(flat address space addressing method): 0x%jx",
451			    (uintmax_t)encoded);
452			result = 0xffffffff;
453			break;
454		}
455		result = ((lun[0] & 0x3f) << 8) + lun[1];
456		break;
457	case 0xC0:
458		if (lun[0] != 0xD2 || lun[4] != 0 || lun[5] != 0 ||
459		    lun[6] != 0 || lun[7] != 0) {
460			CFISCSI_WARN("malformed LUN (extended flat "
461			    "address space addressing method): 0x%jx",
462			    (uintmax_t)encoded);
463			result = 0xffffffff;
464			break;
465		}
466		result = (lun[1] << 16) + (lun[2] << 8) + lun[3];
467	default:
468		CFISCSI_WARN("unsupported LUN format 0x%jx",
469		    (uintmax_t)encoded);
470		result = 0xffffffff;
471		break;
472	}
473
474	return (result);
475}
476
477static void
478cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
479{
480	struct cfiscsi_session *cs;
481	struct iscsi_bhs_nop_out *bhsno;
482	struct iscsi_bhs_nop_in *bhsni;
483	struct icl_pdu *response;
484	void *data = NULL;
485	size_t datasize;
486	int error;
487
488	cs = PDU_SESSION(request);
489	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
490
491	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
492		/*
493		 * Nothing to do, iscsi_pdu_update_statsn() already
494		 * zeroed the timeout.
495		 */
496		icl_pdu_free(request);
497		return;
498	}
499
500	datasize = icl_pdu_data_segment_length(request);
501	if (datasize > 0) {
502		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
503		if (data == NULL) {
504			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
505			    "dropping connection");
506			icl_pdu_free(request);
507			cfiscsi_session_terminate(cs);
508			return;
509		}
510		icl_pdu_get_data(request, 0, data, datasize);
511	}
512
513	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
514	if (response == NULL) {
515		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
516		    "droppping connection");
517		free(data, M_CFISCSI);
518		icl_pdu_free(request);
519		cfiscsi_session_terminate(cs);
520		return;
521	}
522	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
523	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
524	bhsni->bhsni_flags = 0x80;
525	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
526	bhsni->bhsni_target_transfer_tag = 0xffffffff;
527	if (datasize > 0) {
528		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
529		if (error != 0) {
530			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
531			    "dropping connection");
532			free(data, M_CFISCSI);
533			icl_pdu_free(request);
534			icl_pdu_free(response);
535			cfiscsi_session_terminate(cs);
536			return;
537		}
538		free(data, M_CFISCSI);
539	}
540
541	icl_pdu_free(request);
542	cfiscsi_pdu_queue(response);
543}
544
545static void
546cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
547{
548	struct iscsi_bhs_scsi_command *bhssc;
549	struct cfiscsi_session *cs;
550	union ctl_io *io;
551	int error;
552
553	cs = PDU_SESSION(request);
554	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
555	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
556	//    bhssc->bhssc_initiator_task_tag);
557
558	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
559		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
560		    "ImmediateData=No; dropping connection");
561		icl_pdu_free(request);
562		cfiscsi_session_terminate(cs);
563		return;
564	}
565	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
566	ctl_zero_io(io);
567	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
568	io->io_hdr.io_type = CTL_IO_SCSI;
569	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
570	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
571	io->io_hdr.nexus.targ_target.id = 0;
572	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhssc->bhssc_lun);
573	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
574	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
575	case BHSSC_FLAGS_ATTR_UNTAGGED:
576		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
577		break;
578	case BHSSC_FLAGS_ATTR_SIMPLE:
579		io->scsiio.tag_type = CTL_TAG_SIMPLE;
580		break;
581	case BHSSC_FLAGS_ATTR_ORDERED:
582        	io->scsiio.tag_type = CTL_TAG_ORDERED;
583		break;
584	case BHSSC_FLAGS_ATTR_HOQ:
585        	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
586		break;
587	case BHSSC_FLAGS_ATTR_ACA:
588		io->scsiio.tag_type = CTL_TAG_ACA;
589		break;
590	default:
591		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
592		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
593		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
594		break;
595	}
596	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
597	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
598	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
599	error = ctl_queue(io);
600	if (error != CTL_RETVAL_COMPLETE) {
601		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
602		    "dropping connection", error);
603		ctl_free_io(io);
604		refcount_release(&cs->cs_outstanding_ctl_pdus);
605		icl_pdu_free(request);
606		cfiscsi_session_terminate(cs);
607	}
608}
609
610static void
611cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
612{
613	struct iscsi_bhs_task_management_request *bhstmr;
614	struct iscsi_bhs_task_management_response *bhstmr2;
615	struct icl_pdu *response;
616	struct cfiscsi_session *cs;
617	union ctl_io *io;
618	int error;
619
620	cs = PDU_SESSION(request);
621	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
622	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
623	ctl_zero_io(io);
624	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
625	io->io_hdr.io_type = CTL_IO_TASK;
626	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
627	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
628	io->io_hdr.nexus.targ_target.id = 0;
629	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhstmr->bhstmr_lun);
630	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
631
632	switch (bhstmr->bhstmr_function & ~0x80) {
633	case BHSTMR_FUNCTION_ABORT_TASK:
634#if 0
635		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
636#endif
637		io->taskio.task_action = CTL_TASK_ABORT_TASK;
638		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
639		break;
640	case BHSTMR_FUNCTION_ABORT_TASK_SET:
641#if 0
642		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
643#endif
644		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
645		break;
646	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
647#if 0
648		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
649#endif
650		io->taskio.task_action = CTL_TASK_LUN_RESET;
651		break;
652	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
653#if 0
654		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
655#endif
656		io->taskio.task_action = CTL_TASK_TARGET_RESET;
657		break;
658	default:
659		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
660		    bhstmr->bhstmr_function & ~0x80);
661		ctl_free_io(io);
662
663		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
664		if (response == NULL) {
665			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
666			    "dropping connection");
667			icl_pdu_free(request);
668			cfiscsi_session_terminate(cs);
669			return;
670		}
671		bhstmr2 = (struct iscsi_bhs_task_management_response *)
672		    response->ip_bhs;
673		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
674		bhstmr2->bhstmr_flags = 0x80;
675		bhstmr2->bhstmr_response =
676		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
677		bhstmr2->bhstmr_initiator_task_tag =
678		    bhstmr->bhstmr_initiator_task_tag;
679		icl_pdu_free(request);
680		cfiscsi_pdu_queue(response);
681		return;
682	}
683
684	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
685	error = ctl_queue(io);
686	if (error != CTL_RETVAL_COMPLETE) {
687		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
688		    "dropping connection", error);
689		ctl_free_io(io);
690		refcount_release(&cs->cs_outstanding_ctl_pdus);
691		icl_pdu_free(request);
692		cfiscsi_session_terminate(cs);
693	}
694}
695
696static bool
697cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
698{
699	struct iscsi_bhs_data_out *bhsdo;
700	struct cfiscsi_session *cs;
701	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
702	size_t copy_len, len, off, buffer_offset;
703	int ctl_sg_count;
704	union ctl_io *io;
705
706	cs = PDU_SESSION(request);
707
708	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
709	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
710	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
711	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
712	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
713
714	/*
715	 * We're only using fields common for Data-Out and SCSI Command PDUs.
716	 */
717	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
718
719	io = cdw->cdw_ctl_io;
720	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
721	    ("CTL_FLAG_DATA_IN"));
722
723#if 0
724	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
725	    request->ip_data_len, io->scsiio.kern_total_len);
726#endif
727
728	if (io->scsiio.kern_sg_entries > 0) {
729		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
730		ctl_sg_count = io->scsiio.kern_sg_entries;
731	} else {
732		ctl_sglist = &ctl_sg_entry;
733		ctl_sglist->addr = io->scsiio.kern_data_ptr;
734		ctl_sglist->len = io->scsiio.kern_data_len;
735		ctl_sg_count = 1;
736	}
737
738	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
739	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
740		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
741	else
742		buffer_offset = 0;
743	len = icl_pdu_data_segment_length(request);
744
745	/*
746	 * Make sure the offset, as sent by the initiator, matches the offset
747	 * we're supposed to be at in the scatter-gather list.
748	 */
749	if (buffer_offset >
750	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
751	    buffer_offset + len <=
752	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
753		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
754		    "expected %zd; dropping connection", buffer_offset,
755		    (size_t)io->scsiio.kern_rel_offset +
756		    (size_t)io->scsiio.ext_data_filled);
757		ctl_set_data_phase_error(&io->scsiio);
758		cfiscsi_session_terminate(cs);
759		return (true);
760	}
761
762	/*
763	 * This is the offset within the PDU data segment, as opposed
764	 * to buffer_offset, which is the offset within the task (SCSI
765	 * command).
766	 */
767	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
768	    buffer_offset;
769
770	/*
771	 * Iterate over the scatter/gather segments, filling them with data
772	 * from the PDU data segment.  Note that this can get called multiple
773	 * times for one SCSI command; the cdw structure holds state for the
774	 * scatter/gather list.
775	 */
776	for (;;) {
777		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
778		    ("cdw->cdw_sg_index >= ctl_sg_count"));
779		if (cdw->cdw_sg_len == 0) {
780			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
781			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
782		}
783		KASSERT(off <= len, ("len > off"));
784		copy_len = len - off;
785		if (copy_len > cdw->cdw_sg_len)
786			copy_len = cdw->cdw_sg_len;
787
788		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
789		cdw->cdw_sg_addr += copy_len;
790		cdw->cdw_sg_len -= copy_len;
791		off += copy_len;
792		io->scsiio.ext_data_filled += copy_len;
793
794		if (cdw->cdw_sg_len == 0) {
795			/*
796			 * End of current segment.
797			 */
798			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
799				/*
800				 * Last segment in scatter/gather list.
801				 */
802				break;
803			}
804			cdw->cdw_sg_index++;
805		}
806
807		if (off == len) {
808			/*
809			 * End of PDU payload.
810			 */
811			break;
812		}
813	}
814
815	if (len > off) {
816		/*
817		 * In case of unsolicited data, it's possible that the buffer
818		 * provided by CTL is smaller than negotiated FirstBurstLength.
819		 * Just ignore the superfluous data; will ask for them with R2T
820		 * on next call to cfiscsi_datamove().
821		 *
822		 * This obviously can only happen with SCSI Command PDU.
823		 */
824		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
825		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
826			return (true);
827
828		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
829		    "expected %zd; dropping connection",
830		    icl_pdu_data_segment_length(request), off);
831		ctl_set_data_phase_error(&io->scsiio);
832		cfiscsi_session_terminate(cs);
833		return (true);
834	}
835
836	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
837	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
838		CFISCSI_SESSION_WARN(cs, "got the final packet without "
839		    "the F flag; flags = 0x%x; dropping connection",
840		    bhsdo->bhsdo_flags);
841		ctl_set_data_phase_error(&io->scsiio);
842		cfiscsi_session_terminate(cs);
843		return (true);
844	}
845
846	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
847	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
848		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
849		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
850			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
851			    "transmitted size was %zd bytes instead of %d; "
852			    "dropping connection",
853			    (size_t)io->scsiio.ext_data_filled,
854			    cdw->cdw_r2t_end);
855			ctl_set_data_phase_error(&io->scsiio);
856			cfiscsi_session_terminate(cs);
857			return (true);
858		} else {
859			/*
860			 * For SCSI Command PDU, this just means we need to
861			 * solicit more data by sending R2T.
862			 */
863			return (false);
864		}
865	}
866
867	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
868#if 0
869		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
870		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
871#endif
872
873		return (true);
874	}
875
876	return (false);
877}
878
879static void
880cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
881{
882	struct iscsi_bhs_data_out *bhsdo;
883	struct cfiscsi_session *cs;
884	struct cfiscsi_data_wait *cdw = NULL;
885	union ctl_io *io;
886	bool done;
887
888	cs = PDU_SESSION(request);
889	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
890
891	CFISCSI_SESSION_LOCK(cs);
892	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
893#if 0
894		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
895		    "ttt 0x%x, itt 0x%x",
896		    bhsdo->bhsdo_target_transfer_tag,
897		    bhsdo->bhsdo_initiator_task_tag,
898		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
899#endif
900		if (bhsdo->bhsdo_target_transfer_tag ==
901		    cdw->cdw_target_transfer_tag)
902			break;
903	}
904	CFISCSI_SESSION_UNLOCK(cs);
905	if (cdw == NULL) {
906		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
907		    "0x%x, not found; dropping connection",
908		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
909		icl_pdu_free(request);
910		cfiscsi_session_terminate(cs);
911		return;
912	}
913
914	if (cdw->cdw_datasn != ntohl(bhsdo->bhsdo_datasn)) {
915		CFISCSI_SESSION_WARN(cs, "received Data-Out PDU with "
916		    "DataSN %u, while expected %u; dropping connection",
917		    ntohl(bhsdo->bhsdo_datasn), cdw->cdw_datasn);
918		icl_pdu_free(request);
919		cfiscsi_session_terminate(cs);
920		return;
921	}
922	cdw->cdw_datasn++;
923
924	io = cdw->cdw_ctl_io;
925	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
926	    ("CTL_FLAG_DATA_IN"));
927
928	done = cfiscsi_handle_data_segment(request, cdw);
929	if (done) {
930		CFISCSI_SESSION_LOCK(cs);
931		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
932		CFISCSI_SESSION_UNLOCK(cs);
933		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
934		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
935		cfiscsi_data_wait_free(cs, cdw);
936		if (done)
937			io->scsiio.be_move_done(io);
938		else
939			cfiscsi_datamove_out(io);
940	}
941
942	icl_pdu_free(request);
943}
944
945static void
946cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
947{
948	struct iscsi_bhs_logout_request *bhslr;
949	struct iscsi_bhs_logout_response *bhslr2;
950	struct icl_pdu *response;
951	struct cfiscsi_session *cs;
952
953	cs = PDU_SESSION(request);
954	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
955	switch (bhslr->bhslr_reason & 0x7f) {
956	case BHSLR_REASON_CLOSE_SESSION:
957	case BHSLR_REASON_CLOSE_CONNECTION:
958		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
959		if (response == NULL) {
960			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
961			icl_pdu_free(request);
962			cfiscsi_session_terminate(cs);
963			return;
964		}
965		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
966		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
967		bhslr2->bhslr_flags = 0x80;
968		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
969		bhslr2->bhslr_initiator_task_tag =
970		    bhslr->bhslr_initiator_task_tag;
971		icl_pdu_free(request);
972		cfiscsi_pdu_queue(response);
973		cfiscsi_session_terminate(cs);
974		break;
975	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
976		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
977		if (response == NULL) {
978			CFISCSI_SESSION_WARN(cs,
979			    "failed to allocate memory; dropping connection");
980			icl_pdu_free(request);
981			cfiscsi_session_terminate(cs);
982			return;
983		}
984		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
985		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
986		bhslr2->bhslr_flags = 0x80;
987		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
988		bhslr2->bhslr_initiator_task_tag =
989		    bhslr->bhslr_initiator_task_tag;
990		icl_pdu_free(request);
991		cfiscsi_pdu_queue(response);
992		break;
993	default:
994		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
995		    bhslr->bhslr_reason);
996		icl_pdu_free(request);
997		cfiscsi_session_terminate(cs);
998		break;
999	}
1000}
1001
1002static void
1003cfiscsi_callout(void *context)
1004{
1005	struct icl_pdu *cp;
1006	struct iscsi_bhs_nop_in *bhsni;
1007	struct cfiscsi_session *cs;
1008
1009	cs = context;
1010
1011	if (cs->cs_terminating)
1012		return;
1013
1014	callout_schedule(&cs->cs_callout, 1 * hz);
1015
1016	atomic_add_int(&cs->cs_timeout, 1);
1017
1018#ifdef ICL_KERNEL_PROXY
1019	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1020		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1021			CFISCSI_SESSION_WARN(cs, "login timed out after "
1022			    "%d seconds; dropping connection", cs->cs_timeout);
1023			cfiscsi_session_terminate(cs);
1024		}
1025		return;
1026	}
1027#endif
1028
1029	if (ping_timeout <= 0) {
1030		/*
1031		 * Pings are disabled.  Don't send NOP-In in this case;
1032		 * user might have disabled pings to work around problems
1033		 * with certain initiators that can't properly handle
1034		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1035		 * triggering reconnection, should the user decide to
1036		 * reenable them.
1037		 */
1038		cs->cs_timeout = 0;
1039		return;
1040	}
1041
1042	if (cs->cs_timeout >= ping_timeout) {
1043		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1044		    "dropping connection",  ping_timeout);
1045		cfiscsi_session_terminate(cs);
1046		return;
1047	}
1048
1049	/*
1050	 * If the ping was reset less than one second ago - which means
1051	 * that we've received some PDU during the last second - assume
1052	 * the traffic flows correctly and don't bother sending a NOP-Out.
1053	 *
1054	 * (It's 2 - one for one second, and one for incrementing is_timeout
1055	 * earlier in this routine.)
1056	 */
1057	if (cs->cs_timeout < 2)
1058		return;
1059
1060	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1061	if (cp == NULL) {
1062		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1063		return;
1064	}
1065	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1066	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1067	bhsni->bhsni_flags = 0x80;
1068	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1069
1070	cfiscsi_pdu_queue(cp);
1071}
1072
1073static struct cfiscsi_data_wait *
1074cfiscsi_data_wait_new(struct cfiscsi_session *cs, union ctl_io *io,
1075    uint32_t initiator_task_tag, uint32_t *target_transfer_tagp)
1076{
1077	struct cfiscsi_data_wait *cdw;
1078	int error;
1079
1080	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
1081	if (cdw == NULL) {
1082		CFISCSI_SESSION_WARN(cs,
1083		    "failed to allocate %zd bytes", sizeof(*cdw));
1084		return (NULL);
1085	}
1086
1087	error = icl_conn_transfer_setup(cs->cs_conn, io, target_transfer_tagp,
1088	    &cdw->cdw_icl_prv);
1089	if (error != 0) {
1090		CFISCSI_SESSION_WARN(cs,
1091		    "icl_conn_transfer_setup() failed with error %d", error);
1092		uma_zfree(cfiscsi_data_wait_zone, cdw);
1093		return (NULL);
1094	}
1095
1096	cdw->cdw_ctl_io = io;
1097	cdw->cdw_target_transfer_tag = *target_transfer_tagp;
1098	cdw->cdw_initiator_task_tag = initiator_task_tag;
1099
1100	return (cdw);
1101}
1102
1103static void
1104cfiscsi_data_wait_free(struct cfiscsi_session *cs,
1105    struct cfiscsi_data_wait *cdw)
1106{
1107
1108	icl_conn_transfer_done(cs->cs_conn, cdw->cdw_icl_prv);
1109	uma_zfree(cfiscsi_data_wait_zone, cdw);
1110}
1111
1112static void
1113cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1114{
1115	struct cfiscsi_data_wait *cdw;
1116	union ctl_io *io;
1117	int error, last, wait;
1118
1119	if (cs->cs_target == NULL)
1120		return;		/* No target yet, so nothing to do. */
1121	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1122	ctl_zero_io(io);
1123	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = cs;
1124	io->io_hdr.io_type = CTL_IO_TASK;
1125	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1126	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1127	io->io_hdr.nexus.targ_target.id = 0;
1128	io->io_hdr.nexus.targ_lun = 0;
1129	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1130	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1131	wait = cs->cs_outstanding_ctl_pdus;
1132	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1133	error = ctl_queue(io);
1134	if (error != CTL_RETVAL_COMPLETE) {
1135		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1136		refcount_release(&cs->cs_outstanding_ctl_pdus);
1137		ctl_free_io(io);
1138	}
1139
1140	CFISCSI_SESSION_LOCK(cs);
1141	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1142		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1143		CFISCSI_SESSION_UNLOCK(cs);
1144		/*
1145		 * Set nonzero port status; this prevents backends from
1146		 * assuming that the data transfer actually succeeded
1147		 * and writing uninitialized data to disk.
1148		 */
1149		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1150		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1151		cfiscsi_data_wait_free(cs, cdw);
1152		CFISCSI_SESSION_LOCK(cs);
1153	}
1154	CFISCSI_SESSION_UNLOCK(cs);
1155
1156	/*
1157	 * Wait for CTL to terminate all the tasks.
1158	 */
1159	if (wait > 0)
1160		CFISCSI_SESSION_WARN(cs,
1161		    "waiting for CTL to terminate %d tasks", wait);
1162	for (;;) {
1163		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1164		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1165		if (last != 0)
1166			break;
1167		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1168		    0, "cfiscsi_terminate", hz / 100);
1169	}
1170	if (wait > 0)
1171		CFISCSI_SESSION_WARN(cs, "tasks terminated");
1172}
1173
1174static void
1175cfiscsi_maintenance_thread(void *arg)
1176{
1177	struct cfiscsi_session *cs;
1178
1179	cs = arg;
1180
1181	for (;;) {
1182		CFISCSI_SESSION_LOCK(cs);
1183		if (cs->cs_terminating == false)
1184			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1185		CFISCSI_SESSION_UNLOCK(cs);
1186
1187		if (cs->cs_terminating) {
1188
1189			/*
1190			 * We used to wait up to 30 seconds to deliver queued
1191			 * PDUs to the initiator.  We also tried hard to deliver
1192			 * SCSI Responses for the aborted PDUs.  We don't do
1193			 * that anymore.  We might need to revisit that.
1194			 */
1195			callout_drain(&cs->cs_callout);
1196			icl_conn_close(cs->cs_conn);
1197
1198			/*
1199			 * At this point ICL receive thread is no longer
1200			 * running; no new tasks can be queued.
1201			 */
1202			cfiscsi_session_terminate_tasks(cs);
1203			cfiscsi_session_delete(cs);
1204			kthread_exit();
1205			return;
1206		}
1207		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1208	}
1209}
1210
1211static void
1212cfiscsi_session_terminate(struct cfiscsi_session *cs)
1213{
1214
1215	if (cs->cs_terminating)
1216		return;
1217	cs->cs_terminating = true;
1218	cv_signal(&cs->cs_maintenance_cv);
1219#ifdef ICL_KERNEL_PROXY
1220	cv_signal(&cs->cs_login_cv);
1221#endif
1222}
1223
1224static int
1225cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1226{
1227	struct cfiscsi_target *ct;
1228	char *name;
1229	int i;
1230
1231	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1232
1233	ct = cs->cs_target;
1234	name = strdup(cs->cs_initiator_id, M_CTL);
1235	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1236	if (i < 0) {
1237		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1238		    i);
1239		cs->cs_ctl_initid = -1;
1240		return (1);
1241	}
1242	cs->cs_ctl_initid = i;
1243#if 0
1244	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1245#endif
1246
1247	return (0);
1248}
1249
1250static void
1251cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1252{
1253	int error;
1254
1255	if (cs->cs_ctl_initid == -1)
1256		return;
1257
1258	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1259	if (error != 0) {
1260		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1261		    error);
1262	}
1263	cs->cs_ctl_initid = -1;
1264}
1265
1266static struct cfiscsi_session *
1267cfiscsi_session_new(struct cfiscsi_softc *softc, const char *offload)
1268{
1269	struct cfiscsi_session *cs;
1270	int error;
1271
1272	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1273	if (cs == NULL) {
1274		CFISCSI_WARN("malloc failed");
1275		return (NULL);
1276	}
1277	cs->cs_ctl_initid = -1;
1278
1279	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1280	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1281	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1282	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1283#ifdef ICL_KERNEL_PROXY
1284	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1285#endif
1286
1287	cs->cs_conn = icl_new_conn(offload, "cfiscsi", &cs->cs_lock);
1288	if (cs->cs_conn == NULL) {
1289		free(cs, M_CFISCSI);
1290		return (NULL);
1291	}
1292	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1293	cs->cs_conn->ic_error = cfiscsi_error_callback;
1294	cs->cs_conn->ic_prv0 = cs;
1295
1296	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1297	if (error != 0) {
1298		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1299		free(cs, M_CFISCSI);
1300		return (NULL);
1301	}
1302
1303	mtx_lock(&softc->lock);
1304	cs->cs_id = ++softc->last_session_id;
1305	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1306	mtx_unlock(&softc->lock);
1307
1308	/*
1309	 * Start pinging the initiator.
1310	 */
1311	callout_init(&cs->cs_callout, 1);
1312	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1313
1314	return (cs);
1315}
1316
1317static void
1318cfiscsi_session_delete(struct cfiscsi_session *cs)
1319{
1320	struct cfiscsi_softc *softc;
1321
1322	softc = &cfiscsi_softc;
1323
1324	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1325	    ("destroying session with outstanding CTL pdus"));
1326	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1327	    ("destroying session with non-empty queue"));
1328
1329	cfiscsi_session_unregister_initiator(cs);
1330	if (cs->cs_target != NULL)
1331		cfiscsi_target_release(cs->cs_target);
1332	icl_conn_close(cs->cs_conn);
1333	icl_conn_free(cs->cs_conn);
1334
1335	mtx_lock(&softc->lock);
1336	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1337	cv_signal(&softc->sessions_cv);
1338	mtx_unlock(&softc->lock);
1339
1340	free(cs, M_CFISCSI);
1341}
1342
1343int
1344cfiscsi_init(void)
1345{
1346	struct cfiscsi_softc *softc;
1347	int retval;
1348
1349	softc = &cfiscsi_softc;
1350	retval = 0;
1351	bzero(softc, sizeof(*softc));
1352	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1353
1354	cv_init(&softc->sessions_cv, "cfiscsi_sessions");
1355#ifdef ICL_KERNEL_PROXY
1356	cv_init(&softc->accept_cv, "cfiscsi_accept");
1357#endif
1358	TAILQ_INIT(&softc->sessions);
1359	TAILQ_INIT(&softc->targets);
1360
1361	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1362	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1363	    UMA_ALIGN_PTR, 0);
1364
1365	return (0);
1366}
1367
1368#ifdef ICL_KERNEL_PROXY
1369static void
1370cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1371{
1372	struct cfiscsi_session *cs;
1373
1374	cs = cfiscsi_session_new(&cfiscsi_softc, NULL);
1375	if (cs == NULL) {
1376		CFISCSI_WARN("failed to create session");
1377		return;
1378	}
1379
1380	icl_conn_handoff_sock(cs->cs_conn, so);
1381	cs->cs_initiator_sa = sa;
1382	cs->cs_portal_id = portal_id;
1383	cs->cs_waiting_for_ctld = true;
1384	cv_signal(&cfiscsi_softc.accept_cv);
1385}
1386#endif
1387
1388static void
1389cfiscsi_online(void *arg)
1390{
1391	struct cfiscsi_softc *softc;
1392	struct cfiscsi_target *ct;
1393	int online;
1394
1395	ct = (struct cfiscsi_target *)arg;
1396	softc = ct->ct_softc;
1397
1398	mtx_lock(&softc->lock);
1399	if (ct->ct_online) {
1400		mtx_unlock(&softc->lock);
1401		return;
1402	}
1403	ct->ct_online = 1;
1404	online = softc->online++;
1405	mtx_unlock(&softc->lock);
1406	if (online > 0)
1407		return;
1408
1409#ifdef ICL_KERNEL_PROXY
1410	if (softc->listener != NULL)
1411		icl_listen_free(softc->listener);
1412	softc->listener = icl_listen_new(cfiscsi_accept);
1413#endif
1414}
1415
1416static void
1417cfiscsi_offline(void *arg)
1418{
1419	struct cfiscsi_softc *softc;
1420	struct cfiscsi_target *ct;
1421	struct cfiscsi_session *cs;
1422	int online;
1423
1424	ct = (struct cfiscsi_target *)arg;
1425	softc = ct->ct_softc;
1426
1427	mtx_lock(&softc->lock);
1428	if (!ct->ct_online) {
1429		mtx_unlock(&softc->lock);
1430		return;
1431	}
1432	ct->ct_online = 0;
1433	online = --softc->online;
1434
1435	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1436		if (cs->cs_target == ct)
1437			cfiscsi_session_terminate(cs);
1438	}
1439	do {
1440		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1441			if (cs->cs_target == ct)
1442				break;
1443		}
1444		if (cs != NULL)
1445			cv_wait(&softc->sessions_cv, &softc->lock);
1446	} while (cs != NULL && ct->ct_online == 0);
1447	mtx_unlock(&softc->lock);
1448	if (online > 0)
1449		return;
1450
1451#ifdef ICL_KERNEL_PROXY
1452	icl_listen_free(softc->listener);
1453	softc->listener = NULL;
1454#endif
1455}
1456
1457static int
1458cfiscsi_info(void *arg, struct sbuf *sb)
1459{
1460	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1461	int retval;
1462
1463	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1464	    ct->ct_state);
1465	return (retval);
1466}
1467
1468static void
1469cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1470{
1471	struct cfiscsi_softc *softc;
1472	struct cfiscsi_session *cs, *cs2;
1473	struct cfiscsi_target *ct;
1474	struct ctl_iscsi_handoff_params *cihp;
1475	int error;
1476
1477	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1478	softc = &cfiscsi_softc;
1479
1480	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1481	    cihp->initiator_name, cihp->initiator_addr,
1482	    cihp->target_name);
1483
1484	ct = cfiscsi_target_find(softc, cihp->target_name,
1485	    cihp->portal_group_tag);
1486	if (ct == NULL) {
1487		ci->status = CTL_ISCSI_ERROR;
1488		snprintf(ci->error_str, sizeof(ci->error_str),
1489		    "%s: target not found", __func__);
1490		return;
1491	}
1492
1493#ifdef ICL_KERNEL_PROXY
1494	if (cihp->socket > 0 && cihp->connection_id > 0) {
1495		snprintf(ci->error_str, sizeof(ci->error_str),
1496		    "both socket and connection_id set");
1497		ci->status = CTL_ISCSI_ERROR;
1498		cfiscsi_target_release(ct);
1499		return;
1500	}
1501	if (cihp->socket == 0) {
1502		mtx_lock(&cfiscsi_softc.lock);
1503		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1504			if (cs->cs_id == cihp->connection_id)
1505				break;
1506		}
1507		if (cs == NULL) {
1508			mtx_unlock(&cfiscsi_softc.lock);
1509			snprintf(ci->error_str, sizeof(ci->error_str),
1510			    "connection not found");
1511			ci->status = CTL_ISCSI_ERROR;
1512			cfiscsi_target_release(ct);
1513			return;
1514		}
1515		mtx_unlock(&cfiscsi_softc.lock);
1516	} else {
1517#endif
1518		cs = cfiscsi_session_new(softc, cihp->offload);
1519		if (cs == NULL) {
1520			ci->status = CTL_ISCSI_ERROR;
1521			snprintf(ci->error_str, sizeof(ci->error_str),
1522			    "%s: cfiscsi_session_new failed", __func__);
1523			cfiscsi_target_release(ct);
1524			return;
1525		}
1526#ifdef ICL_KERNEL_PROXY
1527	}
1528#endif
1529
1530	/*
1531	 * First PDU of Full Feature phase has the same CmdSN as the last
1532	 * PDU from the Login Phase received from the initiator.  Thus,
1533	 * the -1 below.
1534	 */
1535	cs->cs_cmdsn = cihp->cmdsn;
1536	cs->cs_statsn = cihp->statsn;
1537	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1538	cs->cs_max_burst_length = cihp->max_burst_length;
1539	cs->cs_immediate_data = !!cihp->immediate_data;
1540	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1541		cs->cs_conn->ic_header_crc32c = true;
1542	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1543		cs->cs_conn->ic_data_crc32c = true;
1544
1545	strlcpy(cs->cs_initiator_name,
1546	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1547	strlcpy(cs->cs_initiator_addr,
1548	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1549	strlcpy(cs->cs_initiator_alias,
1550	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1551	memcpy(cs->cs_initiator_isid,
1552	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1553	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1554	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1555	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1556	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1557	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1558
1559	mtx_lock(&softc->lock);
1560	if (ct->ct_online == 0) {
1561		mtx_unlock(&softc->lock);
1562		cfiscsi_session_terminate(cs);
1563		cfiscsi_target_release(ct);
1564		ci->status = CTL_ISCSI_ERROR;
1565		snprintf(ci->error_str, sizeof(ci->error_str),
1566		    "%s: port offline", __func__);
1567		return;
1568	}
1569	cs->cs_target = ct;
1570	mtx_unlock(&softc->lock);
1571
1572	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1573restart:
1574	if (!cs->cs_terminating) {
1575		mtx_lock(&softc->lock);
1576		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1577			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1578			    cs->cs_target == cs2->cs_target &&
1579			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1580				cfiscsi_session_terminate(cs2);
1581				mtx_unlock(&softc->lock);
1582				pause("cfiscsi_reinstate", 1);
1583				goto restart;
1584			}
1585		}
1586		mtx_unlock(&softc->lock);
1587	}
1588
1589	/*
1590	 * Register initiator with CTL.
1591	 */
1592	cfiscsi_session_register_initiator(cs);
1593
1594#ifdef ICL_KERNEL_PROXY
1595	if (cihp->socket > 0) {
1596#endif
1597		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1598		if (error != 0) {
1599			cfiscsi_session_terminate(cs);
1600			refcount_release(&cs->cs_outstanding_ctl_pdus);
1601			ci->status = CTL_ISCSI_ERROR;
1602			snprintf(ci->error_str, sizeof(ci->error_str),
1603			    "%s: icl_conn_handoff failed with error %d",
1604			    __func__, error);
1605			return;
1606		}
1607#ifdef ICL_KERNEL_PROXY
1608	}
1609#endif
1610
1611#ifdef ICL_KERNEL_PROXY
1612	cs->cs_login_phase = false;
1613
1614	/*
1615	 * First PDU of the Full Feature phase has likely already arrived.
1616	 * We have to pick it up and execute properly.
1617	 */
1618	if (cs->cs_login_pdu != NULL) {
1619		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1620		cfiscsi_pdu_handle(cs->cs_login_pdu);
1621		cs->cs_login_pdu = NULL;
1622	}
1623#endif
1624
1625	refcount_release(&cs->cs_outstanding_ctl_pdus);
1626	ci->status = CTL_ISCSI_OK;
1627}
1628
1629static void
1630cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1631{
1632	struct ctl_iscsi_list_params *cilp;
1633	struct cfiscsi_session *cs;
1634	struct cfiscsi_softc *softc;
1635	struct sbuf *sb;
1636	int error;
1637
1638	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1639	softc = &cfiscsi_softc;
1640
1641	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1642	if (sb == NULL) {
1643		ci->status = CTL_ISCSI_ERROR;
1644		snprintf(ci->error_str, sizeof(ci->error_str),
1645		    "Unable to allocate %d bytes for iSCSI session list",
1646		    cilp->alloc_len);
1647		return;
1648	}
1649
1650	sbuf_printf(sb, "<ctlislist>\n");
1651	mtx_lock(&softc->lock);
1652	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1653#ifdef ICL_KERNEL_PROXY
1654		if (cs->cs_target == NULL)
1655			continue;
1656#endif
1657		error = sbuf_printf(sb, "<connection id=\"%d\">"
1658		    "<initiator>%s</initiator>"
1659		    "<initiator_addr>%s</initiator_addr>"
1660		    "<initiator_alias>%s</initiator_alias>"
1661		    "<target>%s</target>"
1662		    "<target_alias>%s</target_alias>"
1663		    "<target_portal_group_tag>%u</target_portal_group_tag>"
1664		    "<header_digest>%s</header_digest>"
1665		    "<data_digest>%s</data_digest>"
1666		    "<max_data_segment_length>%zd</max_data_segment_length>"
1667		    "<immediate_data>%d</immediate_data>"
1668		    "<iser>%d</iser>"
1669		    "<offload>%s</offload>"
1670		    "</connection>\n",
1671		    cs->cs_id,
1672		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1673		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1674		    cs->cs_target->ct_tag,
1675		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1676		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1677		    cs->cs_max_data_segment_length,
1678		    cs->cs_immediate_data,
1679		    cs->cs_conn->ic_iser,
1680		    cs->cs_conn->ic_offload);
1681		if (error != 0)
1682			break;
1683	}
1684	mtx_unlock(&softc->lock);
1685	error = sbuf_printf(sb, "</ctlislist>\n");
1686	if (error != 0) {
1687		sbuf_delete(sb);
1688		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1689		snprintf(ci->error_str, sizeof(ci->error_str),
1690		    "Out of space, %d bytes is too small", cilp->alloc_len);
1691		return;
1692	}
1693	sbuf_finish(sb);
1694
1695	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1696	cilp->fill_len = sbuf_len(sb) + 1;
1697	ci->status = CTL_ISCSI_OK;
1698	sbuf_delete(sb);
1699}
1700
1701static void
1702cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1703{
1704	struct icl_pdu *response;
1705	struct iscsi_bhs_asynchronous_message *bhsam;
1706	struct ctl_iscsi_logout_params *cilp;
1707	struct cfiscsi_session *cs;
1708	struct cfiscsi_softc *softc;
1709	int found = 0;
1710
1711	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1712	softc = &cfiscsi_softc;
1713
1714	mtx_lock(&softc->lock);
1715	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1716		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1717		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1718		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1719			continue;
1720
1721		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1722		if (response == NULL) {
1723			ci->status = CTL_ISCSI_ERROR;
1724			snprintf(ci->error_str, sizeof(ci->error_str),
1725			    "Unable to allocate memory");
1726			mtx_unlock(&softc->lock);
1727			return;
1728		}
1729		bhsam =
1730		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1731		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1732		bhsam->bhsam_flags = 0x80;
1733		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1734		bhsam->bhsam_parameter3 = htons(10);
1735		cfiscsi_pdu_queue(response);
1736		found++;
1737	}
1738	mtx_unlock(&softc->lock);
1739
1740	if (found == 0) {
1741		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1742		snprintf(ci->error_str, sizeof(ci->error_str),
1743		    "No matching connections found");
1744		return;
1745	}
1746
1747	ci->status = CTL_ISCSI_OK;
1748}
1749
1750static void
1751cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1752{
1753	struct icl_pdu *response;
1754	struct iscsi_bhs_asynchronous_message *bhsam;
1755	struct ctl_iscsi_terminate_params *citp;
1756	struct cfiscsi_session *cs;
1757	struct cfiscsi_softc *softc;
1758	int found = 0;
1759
1760	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1761	softc = &cfiscsi_softc;
1762
1763	mtx_lock(&softc->lock);
1764	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1765		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1766		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1767		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1768			continue;
1769
1770		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1771		if (response == NULL) {
1772			/*
1773			 * Oh well.  Just terminate the connection.
1774			 */
1775		} else {
1776			bhsam = (struct iscsi_bhs_asynchronous_message *)
1777			    response->ip_bhs;
1778			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1779			bhsam->bhsam_flags = 0x80;
1780			bhsam->bhsam_0xffffffff = 0xffffffff;
1781			bhsam->bhsam_async_event =
1782			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1783			cfiscsi_pdu_queue(response);
1784		}
1785		cfiscsi_session_terminate(cs);
1786		found++;
1787	}
1788	mtx_unlock(&softc->lock);
1789
1790	if (found == 0) {
1791		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1792		snprintf(ci->error_str, sizeof(ci->error_str),
1793		    "No matching connections found");
1794		return;
1795	}
1796
1797	ci->status = CTL_ISCSI_OK;
1798}
1799
1800static void
1801cfiscsi_ioctl_limits(struct ctl_iscsi *ci)
1802{
1803	struct ctl_iscsi_limits_params *cilp;
1804	int error;
1805
1806	cilp = (struct ctl_iscsi_limits_params *)&(ci->data);
1807
1808	error = icl_limits(cilp->offload, &cilp->data_segment_limit);
1809	if (error != 0) {
1810		ci->status = CTL_ISCSI_ERROR;
1811		snprintf(ci->error_str, sizeof(ci->error_str),
1812			"%s: icl_limits failed with error %d",
1813			__func__, error);
1814		return;
1815	}
1816
1817	ci->status = CTL_ISCSI_OK;
1818}
1819
1820#ifdef ICL_KERNEL_PROXY
1821static void
1822cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1823{
1824	struct ctl_iscsi_listen_params *cilp;
1825	struct sockaddr *sa;
1826	int error;
1827
1828	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1829
1830	if (cfiscsi_softc.listener == NULL) {
1831		CFISCSI_DEBUG("no listener");
1832		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1833		ci->status = CTL_ISCSI_ERROR;
1834		return;
1835	}
1836
1837	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1838	if (error != 0) {
1839		CFISCSI_DEBUG("getsockaddr, error %d", error);
1840		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1841		ci->status = CTL_ISCSI_ERROR;
1842		return;
1843	}
1844
1845	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1846	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1847	if (error != 0) {
1848		free(sa, M_SONAME);
1849		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1850		snprintf(ci->error_str, sizeof(ci->error_str),
1851		    "icl_listen_add failed, error %d", error);
1852		ci->status = CTL_ISCSI_ERROR;
1853		return;
1854	}
1855
1856	ci->status = CTL_ISCSI_OK;
1857}
1858
1859static void
1860cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1861{
1862	struct ctl_iscsi_accept_params *ciap;
1863	struct cfiscsi_session *cs;
1864	int error;
1865
1866	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1867
1868	mtx_lock(&cfiscsi_softc.lock);
1869	for (;;) {
1870		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1871			if (cs->cs_waiting_for_ctld)
1872				break;
1873		}
1874		if (cs != NULL)
1875			break;
1876		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1877		if (error != 0) {
1878			mtx_unlock(&cfiscsi_softc.lock);
1879			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1880			ci->status = CTL_ISCSI_ERROR;
1881			return;
1882		}
1883	}
1884	mtx_unlock(&cfiscsi_softc.lock);
1885
1886	cs->cs_waiting_for_ctld = false;
1887	cs->cs_login_phase = true;
1888
1889	ciap->connection_id = cs->cs_id;
1890	ciap->portal_id = cs->cs_portal_id;
1891	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1892	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1893	    cs->cs_initiator_sa->sa_len);
1894	if (error != 0) {
1895		snprintf(ci->error_str, sizeof(ci->error_str),
1896		    "copyout failed with error %d", error);
1897		ci->status = CTL_ISCSI_ERROR;
1898		return;
1899	}
1900
1901	ci->status = CTL_ISCSI_OK;
1902}
1903
1904static void
1905cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1906{
1907	struct ctl_iscsi_send_params *cisp;
1908	struct cfiscsi_session *cs;
1909	struct icl_pdu *ip;
1910	size_t datalen;
1911	void *data;
1912	int error;
1913
1914	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1915
1916	mtx_lock(&cfiscsi_softc.lock);
1917	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1918		if (cs->cs_id == cisp->connection_id)
1919			break;
1920	}
1921	if (cs == NULL) {
1922		mtx_unlock(&cfiscsi_softc.lock);
1923		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1924		ci->status = CTL_ISCSI_ERROR;
1925		return;
1926	}
1927	mtx_unlock(&cfiscsi_softc.lock);
1928
1929#if 0
1930	if (cs->cs_login_phase == false)
1931		return (EBUSY);
1932#endif
1933
1934	if (cs->cs_terminating) {
1935		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1936		ci->status = CTL_ISCSI_ERROR;
1937		return;
1938	}
1939
1940	datalen = cisp->data_segment_len;
1941	/*
1942	 * XXX
1943	 */
1944	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1945	if (datalen > 65535) {
1946		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1947		ci->status = CTL_ISCSI_ERROR;
1948		return;
1949	}
1950	if (datalen > 0) {
1951		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1952		error = copyin(cisp->data_segment, data, datalen);
1953		if (error != 0) {
1954			free(data, M_CFISCSI);
1955			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1956			ci->status = CTL_ISCSI_ERROR;
1957			return;
1958		}
1959	}
1960
1961	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
1962	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1963	if (datalen > 0) {
1964		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1965		free(data, M_CFISCSI);
1966	}
1967	CFISCSI_SESSION_LOCK(cs);
1968	icl_pdu_queue(ip);
1969	CFISCSI_SESSION_UNLOCK(cs);
1970	ci->status = CTL_ISCSI_OK;
1971}
1972
1973static void
1974cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1975{
1976	struct ctl_iscsi_receive_params *cirp;
1977	struct cfiscsi_session *cs;
1978	struct icl_pdu *ip;
1979	void *data;
1980	int error;
1981
1982	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1983
1984	mtx_lock(&cfiscsi_softc.lock);
1985	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1986		if (cs->cs_id == cirp->connection_id)
1987			break;
1988	}
1989	if (cs == NULL) {
1990		mtx_unlock(&cfiscsi_softc.lock);
1991		snprintf(ci->error_str, sizeof(ci->error_str),
1992		    "connection not found");
1993		ci->status = CTL_ISCSI_ERROR;
1994		return;
1995	}
1996	mtx_unlock(&cfiscsi_softc.lock);
1997
1998#if 0
1999	if (is->is_login_phase == false)
2000		return (EBUSY);
2001#endif
2002
2003	CFISCSI_SESSION_LOCK(cs);
2004	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
2005		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
2006		if (error != 0) {
2007			CFISCSI_SESSION_UNLOCK(cs);
2008			snprintf(ci->error_str, sizeof(ci->error_str),
2009			    "interrupted by signal");
2010			ci->status = CTL_ISCSI_ERROR;
2011			return;
2012		}
2013	}
2014
2015	if (cs->cs_terminating) {
2016		CFISCSI_SESSION_UNLOCK(cs);
2017		snprintf(ci->error_str, sizeof(ci->error_str),
2018		    "connection terminating");
2019		ci->status = CTL_ISCSI_ERROR;
2020		return;
2021	}
2022	ip = cs->cs_login_pdu;
2023	cs->cs_login_pdu = NULL;
2024	CFISCSI_SESSION_UNLOCK(cs);
2025
2026	if (ip->ip_data_len > cirp->data_segment_len) {
2027		icl_pdu_free(ip);
2028		snprintf(ci->error_str, sizeof(ci->error_str),
2029		    "data segment too big");
2030		ci->status = CTL_ISCSI_ERROR;
2031		return;
2032	}
2033
2034	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
2035	if (ip->ip_data_len > 0) {
2036		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
2037		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
2038		copyout(data, cirp->data_segment, ip->ip_data_len);
2039		free(data, M_CFISCSI);
2040	}
2041
2042	icl_pdu_free(ip);
2043	ci->status = CTL_ISCSI_OK;
2044}
2045
2046#endif /* !ICL_KERNEL_PROXY */
2047
2048static void
2049cfiscsi_ioctl_port_create(struct ctl_req *req)
2050{
2051	struct cfiscsi_target *ct;
2052	struct ctl_port *port;
2053	const char *target, *alias, *tags;
2054	struct scsi_vpd_id_descriptor *desc;
2055	ctl_options_t opts;
2056	int retval, len, idlen;
2057	uint16_t tag;
2058
2059	ctl_init_opts(&opts, req->num_args, req->kern_args);
2060	target = ctl_get_opt(&opts, "cfiscsi_target");
2061	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
2062	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2063	if (target == NULL || tags == NULL) {
2064		req->status = CTL_LUN_ERROR;
2065		snprintf(req->error_str, sizeof(req->error_str),
2066		    "Missing required argument");
2067		ctl_free_opts(&opts);
2068		return;
2069	}
2070	tag = strtol(tags, (char **)NULL, 10);
2071	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias, tag);
2072	if (ct == NULL) {
2073		req->status = CTL_LUN_ERROR;
2074		snprintf(req->error_str, sizeof(req->error_str),
2075		    "failed to create target \"%s\"", target);
2076		ctl_free_opts(&opts);
2077		return;
2078	}
2079	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
2080		req->status = CTL_LUN_ERROR;
2081		snprintf(req->error_str, sizeof(req->error_str),
2082		    "target \"%s\" already exists", target);
2083		cfiscsi_target_release(ct);
2084		ctl_free_opts(&opts);
2085		return;
2086	}
2087	port = &ct->ct_port;
2088	// WAT
2089	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
2090		goto done;
2091
2092	port->frontend = &cfiscsi_frontend;
2093	port->port_type = CTL_PORT_ISCSI;
2094	/* XXX KDM what should the real number be here? */
2095	port->num_requested_ctl_io = 4096;
2096	port->port_name = "iscsi";
2097	port->physical_port = tag;
2098	port->virtual_port = ct->ct_target_id;
2099	port->port_online = cfiscsi_online;
2100	port->port_offline = cfiscsi_offline;
2101	port->port_info = cfiscsi_info;
2102	port->onoff_arg = ct;
2103	port->lun_enable = cfiscsi_lun_enable;
2104	port->lun_disable = cfiscsi_lun_disable;
2105	port->targ_lun_arg = ct;
2106	port->fe_datamove = cfiscsi_datamove;
2107	port->fe_done = cfiscsi_done;
2108
2109	/* XXX KDM what should we report here? */
2110	/* XXX These should probably be fetched from CTL. */
2111	port->max_targets = 1;
2112	port->max_target_id = 15;
2113
2114	port->options = opts;
2115	STAILQ_INIT(&opts);
2116
2117	/* Generate Port ID. */
2118	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2119	idlen = roundup2(idlen, 4);
2120	len = sizeof(struct scsi_vpd_device_id) + idlen;
2121	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2122	    M_CTL, M_WAITOK | M_ZERO);
2123	port->port_devid->len = len;
2124	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2125	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2126	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2127	    SVPD_ID_TYPE_SCSI_NAME;
2128	desc->length = idlen;
2129	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x", target, tag);
2130
2131	/* Generate Target ID. */
2132	idlen = strlen(target) + 1;
2133	idlen = roundup2(idlen, 4);
2134	len = sizeof(struct scsi_vpd_device_id) + idlen;
2135	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2136	    M_CTL, M_WAITOK | M_ZERO);
2137	port->target_devid->len = len;
2138	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2139	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2140	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2141	    SVPD_ID_TYPE_SCSI_NAME;
2142	desc->length = idlen;
2143	strlcpy(desc->identifier, target, idlen);
2144
2145	retval = ctl_port_register(port);
2146	if (retval != 0) {
2147		ctl_free_opts(&port->options);
2148		cfiscsi_target_release(ct);
2149		free(port->port_devid, M_CFISCSI);
2150		free(port->target_devid, M_CFISCSI);
2151		req->status = CTL_LUN_ERROR;
2152		snprintf(req->error_str, sizeof(req->error_str),
2153		    "ctl_port_register() failed with error %d", retval);
2154		return;
2155	}
2156done:
2157	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2158	req->status = CTL_LUN_OK;
2159	memcpy(req->kern_args[0].kvalue, &port->targ_port,
2160	    sizeof(port->targ_port)); //XXX
2161}
2162
2163static void
2164cfiscsi_ioctl_port_remove(struct ctl_req *req)
2165{
2166	struct cfiscsi_target *ct;
2167	const char *target, *tags;
2168	ctl_options_t opts;
2169	uint16_t tag;
2170
2171	ctl_init_opts(&opts, req->num_args, req->kern_args);
2172	target = ctl_get_opt(&opts, "cfiscsi_target");
2173	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2174	if (target == NULL || tags == NULL) {
2175		ctl_free_opts(&opts);
2176		req->status = CTL_LUN_ERROR;
2177		snprintf(req->error_str, sizeof(req->error_str),
2178		    "Missing required argument");
2179		return;
2180	}
2181	tag = strtol(tags, (char **)NULL, 10);
2182	ct = cfiscsi_target_find(&cfiscsi_softc, target, tag);
2183	if (ct == NULL) {
2184		ctl_free_opts(&opts);
2185		req->status = CTL_LUN_ERROR;
2186		snprintf(req->error_str, sizeof(req->error_str),
2187		    "can't find target \"%s\"", target);
2188		return;
2189	}
2190	if (ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE) {
2191		ctl_free_opts(&opts);
2192		req->status = CTL_LUN_ERROR;
2193		snprintf(req->error_str, sizeof(req->error_str),
2194		    "target \"%s\" is already dying", target);
2195		return;
2196	}
2197	ctl_free_opts(&opts);
2198
2199	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2200	ctl_port_offline(&ct->ct_port);
2201	cfiscsi_target_release(ct);
2202	cfiscsi_target_release(ct);
2203	req->status = CTL_LUN_OK;
2204}
2205
2206static int
2207cfiscsi_ioctl(struct cdev *dev,
2208    u_long cmd, caddr_t addr, int flag, struct thread *td)
2209{
2210	struct ctl_iscsi *ci;
2211	struct ctl_req *req;
2212
2213	if (cmd == CTL_PORT_REQ) {
2214		req = (struct ctl_req *)addr;
2215		switch (req->reqtype) {
2216		case CTL_REQ_CREATE:
2217			cfiscsi_ioctl_port_create(req);
2218			break;
2219		case CTL_REQ_REMOVE:
2220			cfiscsi_ioctl_port_remove(req);
2221			break;
2222		default:
2223			req->status = CTL_LUN_ERROR;
2224			snprintf(req->error_str, sizeof(req->error_str),
2225			    "Unsupported request type %d", req->reqtype);
2226		}
2227		return (0);
2228	}
2229
2230	if (cmd != CTL_ISCSI)
2231		return (ENOTTY);
2232
2233	ci = (struct ctl_iscsi *)addr;
2234	switch (ci->type) {
2235	case CTL_ISCSI_HANDOFF:
2236		cfiscsi_ioctl_handoff(ci);
2237		break;
2238	case CTL_ISCSI_LIST:
2239		cfiscsi_ioctl_list(ci);
2240		break;
2241	case CTL_ISCSI_LOGOUT:
2242		cfiscsi_ioctl_logout(ci);
2243		break;
2244	case CTL_ISCSI_TERMINATE:
2245		cfiscsi_ioctl_terminate(ci);
2246		break;
2247	case CTL_ISCSI_LIMITS:
2248		cfiscsi_ioctl_limits(ci);
2249		break;
2250#ifdef ICL_KERNEL_PROXY
2251	case CTL_ISCSI_LISTEN:
2252		cfiscsi_ioctl_listen(ci);
2253		break;
2254	case CTL_ISCSI_ACCEPT:
2255		cfiscsi_ioctl_accept(ci);
2256		break;
2257	case CTL_ISCSI_SEND:
2258		cfiscsi_ioctl_send(ci);
2259		break;
2260	case CTL_ISCSI_RECEIVE:
2261		cfiscsi_ioctl_receive(ci);
2262		break;
2263#else
2264	case CTL_ISCSI_LISTEN:
2265	case CTL_ISCSI_ACCEPT:
2266	case CTL_ISCSI_SEND:
2267	case CTL_ISCSI_RECEIVE:
2268		ci->status = CTL_ISCSI_ERROR;
2269		snprintf(ci->error_str, sizeof(ci->error_str),
2270		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2271		    __func__);
2272		break;
2273#endif /* !ICL_KERNEL_PROXY */
2274	default:
2275		ci->status = CTL_ISCSI_ERROR;
2276		snprintf(ci->error_str, sizeof(ci->error_str),
2277		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2278		break;
2279	}
2280
2281	return (0);
2282}
2283
2284static void
2285cfiscsi_target_hold(struct cfiscsi_target *ct)
2286{
2287
2288	refcount_acquire(&ct->ct_refcount);
2289}
2290
2291static void
2292cfiscsi_target_release(struct cfiscsi_target *ct)
2293{
2294	struct cfiscsi_softc *softc;
2295
2296	softc = ct->ct_softc;
2297	mtx_lock(&softc->lock);
2298	if (refcount_release(&ct->ct_refcount)) {
2299		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2300		mtx_unlock(&softc->lock);
2301		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2302			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2303			if (ctl_port_deregister(&ct->ct_port) != 0)
2304				printf("%s: ctl_port_deregister() failed\n",
2305				    __func__);
2306		}
2307		free(ct, M_CFISCSI);
2308
2309		return;
2310	}
2311	mtx_unlock(&softc->lock);
2312}
2313
2314static struct cfiscsi_target *
2315cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name, uint16_t tag)
2316{
2317	struct cfiscsi_target *ct;
2318
2319	mtx_lock(&softc->lock);
2320	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2321		if (ct->ct_tag != tag ||
2322		    strcmp(name, ct->ct_name) != 0 ||
2323		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2324			continue;
2325		cfiscsi_target_hold(ct);
2326		mtx_unlock(&softc->lock);
2327		return (ct);
2328	}
2329	mtx_unlock(&softc->lock);
2330
2331	return (NULL);
2332}
2333
2334static struct cfiscsi_target *
2335cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2336    const char *alias, uint16_t tag)
2337{
2338	struct cfiscsi_target *ct, *newct;
2339
2340	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2341		return (NULL);
2342
2343	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2344
2345	mtx_lock(&softc->lock);
2346	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2347		if (ct->ct_tag != tag ||
2348		    strcmp(name, ct->ct_name) != 0 ||
2349		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2350			continue;
2351		cfiscsi_target_hold(ct);
2352		mtx_unlock(&softc->lock);
2353		free(newct, M_CFISCSI);
2354		return (ct);
2355	}
2356
2357	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2358	if (alias != NULL)
2359		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2360	newct->ct_tag = tag;
2361	refcount_init(&newct->ct_refcount, 1);
2362	newct->ct_softc = softc;
2363	if (TAILQ_EMPTY(&softc->targets))
2364		softc->last_target_id = 0;
2365	newct->ct_target_id = ++softc->last_target_id;
2366	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2367	mtx_unlock(&softc->lock);
2368
2369	return (newct);
2370}
2371
2372static int
2373cfiscsi_lun_enable(void *arg, int lun_id)
2374{
2375
2376	return (0);
2377}
2378
2379static int
2380cfiscsi_lun_disable(void *arg, int lun_id)
2381{
2382
2383	return (0);
2384}
2385
2386static void
2387cfiscsi_datamove_in(union ctl_io *io)
2388{
2389	struct cfiscsi_session *cs;
2390	struct icl_pdu *request, *response;
2391	const struct iscsi_bhs_scsi_command *bhssc;
2392	struct iscsi_bhs_data_in *bhsdi;
2393	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2394	size_t len, expected_len, sg_len, buffer_offset;
2395	const char *sg_addr;
2396	int ctl_sg_count, error, i;
2397
2398	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2399	cs = PDU_SESSION(request);
2400
2401	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2402	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2403	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2404	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2405
2406	if (io->scsiio.kern_sg_entries > 0) {
2407		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2408		ctl_sg_count = io->scsiio.kern_sg_entries;
2409	} else {
2410		ctl_sglist = &ctl_sg_entry;
2411		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2412		ctl_sglist->len = io->scsiio.kern_data_len;
2413		ctl_sg_count = 1;
2414	}
2415
2416	/*
2417	 * This is the total amount of data to be transferred within the current
2418	 * SCSI command.  We need to record it so that we can properly report
2419	 * underflow/underflow.
2420	 */
2421	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2422
2423	/*
2424	 * This is the offset within the current SCSI command; for the first
2425	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2426	 * it will be the sum of lengths of previous ones.
2427	 */
2428	buffer_offset = io->scsiio.kern_rel_offset;
2429
2430	/*
2431	 * This is the transfer length expected by the initiator.  In theory,
2432	 * it could be different from the correct amount of data from the SCSI
2433	 * point of view, even if that doesn't make any sense.
2434	 */
2435	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2436#if 0
2437	if (expected_len != io->scsiio.kern_total_len) {
2438		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2439		    "actual length %zd", expected_len,
2440		    (size_t)io->scsiio.kern_total_len);
2441	}
2442#endif
2443
2444	if (buffer_offset >= expected_len) {
2445#if 0
2446		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2447		    "already sent the expected len", buffer_offset);
2448#endif
2449		io->scsiio.be_move_done(io);
2450		return;
2451	}
2452
2453	i = 0;
2454	sg_addr = NULL;
2455	sg_len = 0;
2456	response = NULL;
2457	bhsdi = NULL;
2458	for (;;) {
2459		if (response == NULL) {
2460			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2461			if (response == NULL) {
2462				CFISCSI_SESSION_WARN(cs, "failed to "
2463				    "allocate memory; dropping connection");
2464				ctl_set_busy(&io->scsiio);
2465				io->scsiio.be_move_done(io);
2466				cfiscsi_session_terminate(cs);
2467				return;
2468			}
2469			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2470			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2471			bhsdi->bhsdi_initiator_task_tag =
2472			    bhssc->bhssc_initiator_task_tag;
2473			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2474			PDU_EXPDATASN(request)++;
2475			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2476		}
2477
2478		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2479		if (sg_len == 0) {
2480			sg_addr = ctl_sglist[i].addr;
2481			sg_len = ctl_sglist[i].len;
2482			KASSERT(sg_len > 0, ("sg_len <= 0"));
2483		}
2484
2485		len = sg_len;
2486
2487		/*
2488		 * Truncate to maximum data segment length.
2489		 */
2490		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2491		    ("ip_data_len %zd >= max_data_segment_length %zd",
2492		    response->ip_data_len, cs->cs_max_data_segment_length));
2493		if (response->ip_data_len + len >
2494		    cs->cs_max_data_segment_length) {
2495			len = cs->cs_max_data_segment_length -
2496			    response->ip_data_len;
2497			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2498			    len, sg_len));
2499		}
2500
2501		/*
2502		 * Truncate to expected data transfer length.
2503		 */
2504		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2505		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2506		    buffer_offset, response->ip_data_len, expected_len));
2507		if (buffer_offset + response->ip_data_len + len > expected_len) {
2508			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2509			    "to expected data transfer length %zd",
2510			    buffer_offset + response->ip_data_len + len, expected_len);
2511			len = expected_len - (buffer_offset + response->ip_data_len);
2512			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2513			    len, sg_len));
2514		}
2515
2516		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2517		if (error != 0) {
2518			CFISCSI_SESSION_WARN(cs, "failed to "
2519			    "allocate memory; dropping connection");
2520			icl_pdu_free(response);
2521			ctl_set_busy(&io->scsiio);
2522			io->scsiio.be_move_done(io);
2523			cfiscsi_session_terminate(cs);
2524			return;
2525		}
2526		sg_addr += len;
2527		sg_len -= len;
2528
2529		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2530		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2531		    buffer_offset, response->ip_data_len, expected_len));
2532		if (buffer_offset + response->ip_data_len == expected_len) {
2533			/*
2534			 * Already have the amount of data the initiator wanted.
2535			 */
2536			break;
2537		}
2538
2539		if (sg_len == 0) {
2540			/*
2541			 * End of scatter-gather segment;
2542			 * proceed to the next one...
2543			 */
2544			if (i == ctl_sg_count - 1) {
2545				/*
2546				 * ... unless this was the last one.
2547				 */
2548				break;
2549			}
2550			i++;
2551		}
2552
2553		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2554			/*
2555			 * Can't stuff more data into the current PDU;
2556			 * queue it.  Note that's not enough to check
2557			 * for kern_data_resid == 0 instead; there
2558			 * may be several Data-In PDUs for the final
2559			 * call to cfiscsi_datamove(), and we want
2560			 * to set the F flag only on the last of them.
2561			 */
2562			buffer_offset += response->ip_data_len;
2563			if (buffer_offset == io->scsiio.kern_total_len ||
2564			    buffer_offset == expected_len) {
2565				buffer_offset -= response->ip_data_len;
2566				break;
2567			}
2568			cfiscsi_pdu_queue(response);
2569			response = NULL;
2570			bhsdi = NULL;
2571		}
2572	}
2573	if (response != NULL) {
2574		buffer_offset += response->ip_data_len;
2575		if (buffer_offset == io->scsiio.kern_total_len ||
2576		    buffer_offset == expected_len) {
2577			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2578			if (io->io_hdr.status == CTL_SUCCESS) {
2579				bhsdi->bhsdi_flags |= BHSDI_FLAGS_S;
2580				if (PDU_TOTAL_TRANSFER_LEN(request) <
2581				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2582					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2583					bhsdi->bhsdi_residual_count =
2584					    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2585					    PDU_TOTAL_TRANSFER_LEN(request));
2586				} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2587				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2588					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2589					bhsdi->bhsdi_residual_count =
2590					    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2591					    ntohl(bhssc->bhssc_expected_data_transfer_length));
2592				}
2593				bhsdi->bhsdi_status = io->scsiio.scsi_status;
2594				io->io_hdr.flags |= CTL_FLAG_STATUS_SENT;
2595			}
2596		}
2597		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2598		cfiscsi_pdu_queue(response);
2599	}
2600
2601	io->scsiio.be_move_done(io);
2602}
2603
2604static void
2605cfiscsi_datamove_out(union ctl_io *io)
2606{
2607	struct cfiscsi_session *cs;
2608	struct icl_pdu *request, *response;
2609	const struct iscsi_bhs_scsi_command *bhssc;
2610	struct iscsi_bhs_r2t *bhsr2t;
2611	struct cfiscsi_data_wait *cdw;
2612	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2613	uint32_t expected_len, r2t_off, r2t_len;
2614	uint32_t target_transfer_tag;
2615	bool done;
2616
2617	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2618	cs = PDU_SESSION(request);
2619
2620	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2621	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2622	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2623	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2624
2625	/*
2626	 * We need to record it so that we can properly report
2627	 * underflow/underflow.
2628	 */
2629	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2630
2631	/*
2632	 * Report write underflow as error since CTL and backends don't
2633	 * really support it, and SCSI does not tell how to do it right.
2634	 */
2635	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2636	if (io->scsiio.kern_rel_offset + io->scsiio.kern_data_len >
2637	    expected_len) {
2638		io->scsiio.io_hdr.port_status = 43;
2639		io->scsiio.be_move_done(io);
2640		return;
2641	}
2642
2643	target_transfer_tag =
2644	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2645	cdw = cfiscsi_data_wait_new(cs, io, bhssc->bhssc_initiator_task_tag,
2646	    &target_transfer_tag);
2647	if (cdw == NULL) {
2648		CFISCSI_SESSION_WARN(cs, "failed to "
2649		    "allocate memory; dropping connection");
2650		ctl_set_busy(&io->scsiio);
2651		io->scsiio.be_move_done(io);
2652		cfiscsi_session_terminate(cs);
2653		return;
2654	}
2655#if 0
2656	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2657	    "task tag 0x%x, target transfer tag 0x%x",
2658	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2659#endif
2660
2661	cdw->cdw_ctl_io = io;
2662	cdw->cdw_target_transfer_tag = target_transfer_tag;
2663	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2664	cdw->cdw_r2t_end = io->scsiio.kern_data_len;
2665	cdw->cdw_datasn = 0;
2666
2667	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2668	if (io->scsiio.kern_sg_entries > 0) {
2669		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2670	} else {
2671		ctl_sglist = &ctl_sg_entry;
2672		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2673		ctl_sglist->len = io->scsiio.kern_data_len;
2674	}
2675	cdw->cdw_sg_index = 0;
2676	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2677	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2678	r2t_off = io->scsiio.ext_data_filled;
2679	while (r2t_off > 0) {
2680		if (r2t_off >= cdw->cdw_sg_len) {
2681			r2t_off -= cdw->cdw_sg_len;
2682			cdw->cdw_sg_index++;
2683			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2684			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2685			continue;
2686		}
2687		cdw->cdw_sg_addr += r2t_off;
2688		cdw->cdw_sg_len -= r2t_off;
2689		r2t_off = 0;
2690	}
2691
2692	if (cs->cs_immediate_data &&
2693	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2694	    icl_pdu_data_segment_length(request)) {
2695		done = cfiscsi_handle_data_segment(request, cdw);
2696		if (done) {
2697			cfiscsi_data_wait_free(cs, cdw);
2698			io->scsiio.be_move_done(io);
2699			return;
2700		}
2701	}
2702
2703	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2704	r2t_len = MIN(io->scsiio.kern_data_len - io->scsiio.ext_data_filled,
2705	    cs->cs_max_burst_length);
2706	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2707
2708	CFISCSI_SESSION_LOCK(cs);
2709	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2710	CFISCSI_SESSION_UNLOCK(cs);
2711
2712	/*
2713	 * XXX: We should limit the number of outstanding R2T PDUs
2714	 * 	per task to MaxOutstandingR2T.
2715	 */
2716	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2717	if (response == NULL) {
2718		CFISCSI_SESSION_WARN(cs, "failed to "
2719		    "allocate memory; dropping connection");
2720		ctl_set_busy(&io->scsiio);
2721		io->scsiio.be_move_done(io);
2722		cfiscsi_session_terminate(cs);
2723		return;
2724	}
2725	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2726	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2727	bhsr2t->bhsr2t_flags = 0x80;
2728	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2729	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2730	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2731	/*
2732	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2733	 *	be running concurrently on several CPUs for a given
2734	 *	command.
2735	 */
2736	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2737	PDU_R2TSN(request)++;
2738	/*
2739	 * This is the offset within the current SCSI command;
2740	 * i.e. for the first call of datamove(), it will be 0,
2741	 * and for subsequent ones it will be the sum of lengths
2742	 * of previous ones.
2743	 *
2744	 * The ext_data_filled is to account for unsolicited
2745	 * (immediate) data that might have already arrived.
2746	 */
2747	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2748	/*
2749	 * This is the total length (sum of S/G lengths) this call
2750	 * to cfiscsi_datamove() is supposed to handle, limited by
2751	 * MaxBurstLength.
2752	 */
2753	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2754	cfiscsi_pdu_queue(response);
2755}
2756
2757static void
2758cfiscsi_datamove(union ctl_io *io)
2759{
2760
2761	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2762		cfiscsi_datamove_in(io);
2763	else {
2764		/* We hadn't received anything during this datamove yet. */
2765		io->scsiio.ext_data_filled = 0;
2766		cfiscsi_datamove_out(io);
2767	}
2768}
2769
2770static void
2771cfiscsi_scsi_command_done(union ctl_io *io)
2772{
2773	struct icl_pdu *request, *response;
2774	struct iscsi_bhs_scsi_command *bhssc;
2775	struct iscsi_bhs_scsi_response *bhssr;
2776#ifdef DIAGNOSTIC
2777	struct cfiscsi_data_wait *cdw;
2778#endif
2779	struct cfiscsi_session *cs;
2780	uint16_t sense_length;
2781
2782	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2783	cs = PDU_SESSION(request);
2784	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2785	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2786	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2787	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2788
2789	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2790	//    bhssc->bhssc_initiator_task_tag);
2791
2792#ifdef DIAGNOSTIC
2793	CFISCSI_SESSION_LOCK(cs);
2794	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2795		KASSERT(bhssc->bhssc_initiator_task_tag !=
2796		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2797	CFISCSI_SESSION_UNLOCK(cs);
2798#endif
2799
2800	/*
2801	 * Do not return status for aborted commands.
2802	 * There are exceptions, but none supported by CTL yet.
2803	 */
2804	if (((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2805	     (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) ||
2806	    (io->io_hdr.flags & CTL_FLAG_STATUS_SENT)) {
2807		ctl_free_io(io);
2808		icl_pdu_free(request);
2809		return;
2810	}
2811
2812	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2813	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2814	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2815	bhssr->bhssr_flags = 0x80;
2816	/*
2817	 * XXX: We don't deal with bidirectional under/overflows;
2818	 *	does anything actually support those?
2819	 */
2820	if (PDU_TOTAL_TRANSFER_LEN(request) <
2821	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2822		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2823		bhssr->bhssr_residual_count =
2824		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2825		    PDU_TOTAL_TRANSFER_LEN(request));
2826		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2827		//    ntohl(bhssr->bhssr_residual_count));
2828	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2829	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2830		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2831		bhssr->bhssr_residual_count =
2832		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2833		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2834		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2835		//    ntohl(bhssr->bhssr_residual_count));
2836	}
2837	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2838	bhssr->bhssr_status = io->scsiio.scsi_status;
2839	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2840	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2841
2842	if (io->scsiio.sense_len > 0) {
2843#if 0
2844		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2845		    io->scsiio.sense_len);
2846#endif
2847		sense_length = htons(io->scsiio.sense_len);
2848		icl_pdu_append_data(response,
2849		    &sense_length, sizeof(sense_length), M_WAITOK);
2850		icl_pdu_append_data(response,
2851		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2852	}
2853
2854	ctl_free_io(io);
2855	icl_pdu_free(request);
2856	cfiscsi_pdu_queue(response);
2857}
2858
2859static void
2860cfiscsi_task_management_done(union ctl_io *io)
2861{
2862	struct icl_pdu *request, *response;
2863	struct iscsi_bhs_task_management_request *bhstmr;
2864	struct iscsi_bhs_task_management_response *bhstmr2;
2865	struct cfiscsi_data_wait *cdw, *tmpcdw;
2866	struct cfiscsi_session *cs;
2867
2868	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2869	cs = PDU_SESSION(request);
2870	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2871	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2872	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2873	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2874
2875#if 0
2876	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2877	    bhstmr->bhstmr_initiator_task_tag,
2878	    bhstmr->bhstmr_referenced_task_tag);
2879#endif
2880
2881	if ((bhstmr->bhstmr_function & ~0x80) ==
2882	    BHSTMR_FUNCTION_ABORT_TASK) {
2883		/*
2884		 * Make sure we no longer wait for Data-Out for this command.
2885		 */
2886		CFISCSI_SESSION_LOCK(cs);
2887		TAILQ_FOREACH_SAFE(cdw,
2888		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2889			if (bhstmr->bhstmr_referenced_task_tag !=
2890			    cdw->cdw_initiator_task_tag)
2891				continue;
2892
2893#if 0
2894			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2895			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2896#endif
2897			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2898			    cdw, cdw_next);
2899			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2900			cfiscsi_data_wait_free(cs, cdw);
2901		}
2902		CFISCSI_SESSION_UNLOCK(cs);
2903	}
2904
2905	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2906	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2907	    response->ip_bhs;
2908	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2909	bhstmr2->bhstmr_flags = 0x80;
2910	if (io->io_hdr.status == CTL_SUCCESS) {
2911		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2912	} else {
2913		/*
2914		 * XXX: How to figure out what exactly went wrong?  iSCSI spec
2915		 * 	expects us to provide detailed error, e.g. "Task does
2916		 * 	not exist" or "LUN does not exist".
2917		 */
2918		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED");
2919		bhstmr2->bhstmr_response =
2920		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2921	}
2922	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2923
2924	ctl_free_io(io);
2925	icl_pdu_free(request);
2926	cfiscsi_pdu_queue(response);
2927}
2928
2929static void
2930cfiscsi_done(union ctl_io *io)
2931{
2932	struct icl_pdu *request;
2933	struct cfiscsi_session *cs;
2934
2935	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2936		("invalid CTL status %#x", io->io_hdr.status));
2937
2938	if (io->io_hdr.io_type == CTL_IO_TASK &&
2939	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
2940		/*
2941		 * Implicit task termination has just completed; nothing to do.
2942		 */
2943		cs = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2944		cs->cs_tasks_aborted = true;
2945		refcount_release(&cs->cs_outstanding_ctl_pdus);
2946		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
2947		ctl_free_io(io);
2948		return;
2949	}
2950
2951	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2952	cs = PDU_SESSION(request);
2953	refcount_release(&cs->cs_outstanding_ctl_pdus);
2954
2955	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2956	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2957		cfiscsi_scsi_command_done(io);
2958		break;
2959	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2960		cfiscsi_task_management_done(io);
2961		break;
2962	default:
2963		panic("cfiscsi_done called with wrong opcode 0x%x",
2964		    request->ip_bhs->bhs_opcode);
2965	}
2966}
2967