ctl_frontend_iscsi.c revision 313364
1/*-
2 * Copyright (c) 2012 The FreeBSD Foundation
3 * All rights reserved.
4 *
5 * This software was developed by Edward Tomasz Napierala under sponsorship
6 * from the FreeBSD Foundation.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 * $FreeBSD: stable/11/sys/cam/ctl/ctl_frontend_iscsi.c 313364 2017-02-07 01:42:13Z mav $
30 */
31
32/*
33 * CTL frontend for the iSCSI protocol.
34 */
35
36#include <sys/cdefs.h>
37__FBSDID("$FreeBSD: stable/11/sys/cam/ctl/ctl_frontend_iscsi.c 313364 2017-02-07 01:42:13Z mav $");
38
39#include <sys/param.h>
40#include <sys/capsicum.h>
41#include <sys/condvar.h>
42#include <sys/endian.h>
43#include <sys/file.h>
44#include <sys/kernel.h>
45#include <sys/kthread.h>
46#include <sys/lock.h>
47#include <sys/malloc.h>
48#include <sys/module.h>
49#include <sys/mutex.h>
50#include <sys/queue.h>
51#include <sys/sbuf.h>
52#include <sys/socket.h>
53#include <sys/sysctl.h>
54#include <sys/systm.h>
55#include <sys/uio.h>
56#include <sys/unistd.h>
57#include <vm/uma.h>
58
59#include <cam/scsi/scsi_all.h>
60#include <cam/scsi/scsi_da.h>
61#include <cam/ctl/ctl_io.h>
62#include <cam/ctl/ctl.h>
63#include <cam/ctl/ctl_backend.h>
64#include <cam/ctl/ctl_error.h>
65#include <cam/ctl/ctl_frontend.h>
66#include <cam/ctl/ctl_debug.h>
67#include <cam/ctl/ctl_ha.h>
68#include <cam/ctl/ctl_ioctl.h>
69#include <cam/ctl/ctl_private.h>
70
71#include <dev/iscsi/icl.h>
72#include <dev/iscsi/icl_wrappers.h>
73#include <dev/iscsi/iscsi_proto.h>
74#include <cam/ctl/ctl_frontend_iscsi.h>
75
76#ifdef ICL_KERNEL_PROXY
77#include <sys/socketvar.h>
78#endif
79
80#ifdef ICL_KERNEL_PROXY
81FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
82#endif
83
84static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
85static uma_zone_t cfiscsi_data_wait_zone;
86
87SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
88    "CAM Target Layer iSCSI Frontend");
89static int debug = 1;
90SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
91    &debug, 1, "Enable debug messages");
92static int ping_timeout = 5;
93SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
94    &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
95static int login_timeout = 60;
96SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
97    &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
98static int maxcmdsn_delta = 256;
99SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
100    &maxcmdsn_delta, 256, "Number of commands the initiator can send "
101    "without confirmation");
102
103#define	CFISCSI_DEBUG(X, ...)						\
104	do {								\
105		if (debug > 1) {					\
106			printf("%s: " X "\n",				\
107			    __func__, ## __VA_ARGS__);			\
108		}							\
109	} while (0)
110
111#define	CFISCSI_WARN(X, ...)						\
112	do {								\
113		if (debug > 0) {					\
114			printf("WARNING: %s: " X "\n",			\
115			    __func__, ## __VA_ARGS__);			\
116		}							\
117	} while (0)
118
119#define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
120	do {								\
121		if (debug > 1) {					\
122			printf("%s: %s (%s): " X "\n",			\
123			    __func__, S->cs_initiator_addr,		\
124			    S->cs_initiator_name, ## __VA_ARGS__);	\
125		}							\
126	} while (0)
127
128#define	CFISCSI_SESSION_WARN(S, X, ...)					\
129	do  {								\
130		if (debug > 0) {					\
131			printf("WARNING: %s (%s): " X "\n",		\
132			    S->cs_initiator_addr,			\
133			    S->cs_initiator_name, ## __VA_ARGS__);	\
134		}							\
135	} while (0)
136
137#define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
138#define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
139#define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
140
141#define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
142#define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
143#define	PDU_EXPDATASN(X)		(X)->ip_prv0
144#define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
145#define	PDU_R2TSN(X)			(X)->ip_prv2
146
147int		cfiscsi_init(void);
148static void	cfiscsi_online(void *arg);
149static void	cfiscsi_offline(void *arg);
150static int	cfiscsi_info(void *arg, struct sbuf *sb);
151static int	cfiscsi_ioctl(struct cdev *dev,
152		    u_long cmd, caddr_t addr, int flag, struct thread *td);
153static void	cfiscsi_datamove(union ctl_io *io);
154static void	cfiscsi_datamove_in(union ctl_io *io);
155static void	cfiscsi_datamove_out(union ctl_io *io);
156static void	cfiscsi_done(union ctl_io *io);
157static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
158static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
159static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
160static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
161static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
162static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
163static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
164static struct cfiscsi_data_wait	*cfiscsi_data_wait_new(
165		    struct cfiscsi_session *cs, union ctl_io *io,
166		    uint32_t initiator_task_tag,
167		    uint32_t *target_transfer_tagp);
168static void	cfiscsi_data_wait_free(struct cfiscsi_session *cs,
169		    struct cfiscsi_data_wait *cdw);
170static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
171		    *softc, const char *name, uint16_t tag);
172static struct cfiscsi_target	*cfiscsi_target_find_or_create(
173    struct cfiscsi_softc *softc, const char *name, const char *alias,
174    uint16_t tag);
175static void	cfiscsi_target_release(struct cfiscsi_target *ct);
176static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
177
178static struct cfiscsi_softc cfiscsi_softc;
179
180static struct ctl_frontend cfiscsi_frontend =
181{
182	.name = "iscsi",
183	.init = cfiscsi_init,
184	.ioctl = cfiscsi_ioctl,
185};
186CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
187MODULE_DEPEND(ctlcfiscsi, icl, 1, 1, 1);
188
189static struct icl_pdu *
190cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
191{
192
193	return (icl_pdu_new(request->ip_conn, flags));
194}
195
196static bool
197cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
198{
199	const struct iscsi_bhs_scsi_command *bhssc;
200	struct cfiscsi_session *cs;
201	uint32_t cmdsn, expstatsn;
202
203	cs = PDU_SESSION(request);
204
205	/*
206	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
207	 * The purpose of the timeout is to reset the connection when it stalls;
208	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
209	 * in some queue.
210	 *
211	 * XXX: Locking?
212	 */
213	cs->cs_timeout = 0;
214
215	/*
216	 * Data-Out PDUs don't contain CmdSN.
217	 */
218	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
219	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
220		return (false);
221
222	/*
223	 * We're only using fields common for all the request
224	 * (initiator -> target) PDUs.
225	 */
226	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
227	cmdsn = ntohl(bhssc->bhssc_cmdsn);
228	expstatsn = ntohl(bhssc->bhssc_expstatsn);
229
230	CFISCSI_SESSION_LOCK(cs);
231#if 0
232	if (expstatsn != cs->cs_statsn) {
233		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
234		    "while current StatSN is %d", expstatsn,
235		    cs->cs_statsn);
236	}
237#endif
238
239	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0) {
240		/*
241		 * The target MUST silently ignore any non-immediate command
242		 * outside of this range.
243		 */
244		if (ISCSI_SNLT(cmdsn, cs->cs_cmdsn) ||
245		    ISCSI_SNGT(cmdsn, cs->cs_cmdsn + maxcmdsn_delta)) {
246			CFISCSI_SESSION_UNLOCK(cs);
247			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
248			    "while expected %u", cmdsn, cs->cs_cmdsn);
249			return (true);
250		}
251
252		/*
253		 * We don't support multiple connections now, so any
254		 * discontinuity in CmdSN means lost PDUs.  Since we don't
255		 * support PDU retransmission -- terminate the connection.
256		 */
257		if (cmdsn != cs->cs_cmdsn) {
258			CFISCSI_SESSION_UNLOCK(cs);
259			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
260			    "while expected %u; dropping connection",
261			    cmdsn, cs->cs_cmdsn);
262			cfiscsi_session_terminate(cs);
263			return (true);
264		}
265		cs->cs_cmdsn++;
266	}
267
268	CFISCSI_SESSION_UNLOCK(cs);
269
270	return (false);
271}
272
273static void
274cfiscsi_pdu_handle(struct icl_pdu *request)
275{
276	struct cfiscsi_session *cs;
277	bool ignore;
278
279	cs = PDU_SESSION(request);
280
281	ignore = cfiscsi_pdu_update_cmdsn(request);
282	if (ignore) {
283		icl_pdu_free(request);
284		return;
285	}
286
287	/*
288	 * Handle the PDU; this includes e.g. receiving the remaining
289	 * part of PDU and submitting the SCSI command to CTL
290	 * or queueing a reply.  The handling routine is responsible
291	 * for freeing the PDU when it's no longer needed.
292	 */
293	switch (request->ip_bhs->bhs_opcode &
294	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
295	case ISCSI_BHS_OPCODE_NOP_OUT:
296		cfiscsi_pdu_handle_nop_out(request);
297		break;
298	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
299		cfiscsi_pdu_handle_scsi_command(request);
300		break;
301	case ISCSI_BHS_OPCODE_TASK_REQUEST:
302		cfiscsi_pdu_handle_task_request(request);
303		break;
304	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
305		cfiscsi_pdu_handle_data_out(request);
306		break;
307	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
308		cfiscsi_pdu_handle_logout_request(request);
309		break;
310	default:
311		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
312		    "opcode 0x%x; dropping connection",
313		    request->ip_bhs->bhs_opcode);
314		icl_pdu_free(request);
315		cfiscsi_session_terminate(cs);
316	}
317
318}
319
320static void
321cfiscsi_receive_callback(struct icl_pdu *request)
322{
323	struct cfiscsi_session *cs;
324
325	cs = PDU_SESSION(request);
326
327#ifdef ICL_KERNEL_PROXY
328	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
329		if (cs->cs_login_pdu == NULL)
330			cs->cs_login_pdu = request;
331		else
332			icl_pdu_free(request);
333		cv_signal(&cs->cs_login_cv);
334		return;
335	}
336#endif
337
338	cfiscsi_pdu_handle(request);
339}
340
341static void
342cfiscsi_error_callback(struct icl_conn *ic)
343{
344	struct cfiscsi_session *cs;
345
346	cs = CONN_SESSION(ic);
347
348	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
349	cfiscsi_session_terminate(cs);
350}
351
352static int
353cfiscsi_pdu_prepare(struct icl_pdu *response)
354{
355	struct cfiscsi_session *cs;
356	struct iscsi_bhs_scsi_response *bhssr;
357	bool advance_statsn = true;
358
359	cs = PDU_SESSION(response);
360
361	CFISCSI_SESSION_LOCK_ASSERT(cs);
362
363	/*
364	 * We're only using fields common for all the response
365	 * (target -> initiator) PDUs.
366	 */
367	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
368
369	/*
370	 * 10.8.3: "The StatSN for this connection is not advanced
371	 * after this PDU is sent."
372	 */
373	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
374		advance_statsn = false;
375
376	/*
377	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
378	 * StatSN for the connection is not advanced after this PDU is sent."
379	 */
380	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
381	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
382		advance_statsn = false;
383
384	/*
385	 * See the comment below - StatSN is not meaningful and must
386	 * not be advanced.
387	 */
388	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN &&
389	    (bhssr->bhssr_flags & BHSDI_FLAGS_S) == 0)
390		advance_statsn = false;
391
392	/*
393	 * 10.7.3: "The fields StatSN, Status, and Residual Count
394	 * only have meaningful content if the S bit is set to 1."
395	 */
396	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
397	    (bhssr->bhssr_flags & BHSDI_FLAGS_S))
398		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
399	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
400	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
401
402	if (advance_statsn)
403		cs->cs_statsn++;
404
405	return (0);
406}
407
408static void
409cfiscsi_pdu_queue(struct icl_pdu *response)
410{
411	struct cfiscsi_session *cs;
412
413	cs = PDU_SESSION(response);
414
415	CFISCSI_SESSION_LOCK(cs);
416	cfiscsi_pdu_prepare(response);
417	icl_pdu_queue(response);
418	CFISCSI_SESSION_UNLOCK(cs);
419}
420
421static void
422cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
423{
424	struct cfiscsi_session *cs;
425	struct iscsi_bhs_nop_out *bhsno;
426	struct iscsi_bhs_nop_in *bhsni;
427	struct icl_pdu *response;
428	void *data = NULL;
429	size_t datasize;
430	int error;
431
432	cs = PDU_SESSION(request);
433	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
434
435	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
436		/*
437		 * Nothing to do, iscsi_pdu_update_statsn() already
438		 * zeroed the timeout.
439		 */
440		icl_pdu_free(request);
441		return;
442	}
443
444	datasize = icl_pdu_data_segment_length(request);
445	if (datasize > 0) {
446		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
447		if (data == NULL) {
448			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
449			    "dropping connection");
450			icl_pdu_free(request);
451			cfiscsi_session_terminate(cs);
452			return;
453		}
454		icl_pdu_get_data(request, 0, data, datasize);
455	}
456
457	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
458	if (response == NULL) {
459		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
460		    "droppping connection");
461		free(data, M_CFISCSI);
462		icl_pdu_free(request);
463		cfiscsi_session_terminate(cs);
464		return;
465	}
466	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
467	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
468	bhsni->bhsni_flags = 0x80;
469	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
470	bhsni->bhsni_target_transfer_tag = 0xffffffff;
471	if (datasize > 0) {
472		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
473		if (error != 0) {
474			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
475			    "dropping connection");
476			free(data, M_CFISCSI);
477			icl_pdu_free(request);
478			icl_pdu_free(response);
479			cfiscsi_session_terminate(cs);
480			return;
481		}
482		free(data, M_CFISCSI);
483	}
484
485	icl_pdu_free(request);
486	cfiscsi_pdu_queue(response);
487}
488
489static void
490cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
491{
492	struct iscsi_bhs_scsi_command *bhssc;
493	struct cfiscsi_session *cs;
494	union ctl_io *io;
495	int error;
496
497	cs = PDU_SESSION(request);
498	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
499	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
500	//    bhssc->bhssc_initiator_task_tag);
501
502	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
503		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
504		    "ImmediateData=No; dropping connection");
505		icl_pdu_free(request);
506		cfiscsi_session_terminate(cs);
507		return;
508	}
509	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
510	ctl_zero_io(io);
511	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
512	io->io_hdr.io_type = CTL_IO_SCSI;
513	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
514	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
515	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhssc->bhssc_lun));
516	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
517	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
518	case BHSSC_FLAGS_ATTR_UNTAGGED:
519		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
520		break;
521	case BHSSC_FLAGS_ATTR_SIMPLE:
522		io->scsiio.tag_type = CTL_TAG_SIMPLE;
523		break;
524	case BHSSC_FLAGS_ATTR_ORDERED:
525        	io->scsiio.tag_type = CTL_TAG_ORDERED;
526		break;
527	case BHSSC_FLAGS_ATTR_HOQ:
528        	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
529		break;
530	case BHSSC_FLAGS_ATTR_ACA:
531		io->scsiio.tag_type = CTL_TAG_ACA;
532		break;
533	default:
534		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
535		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
536		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
537		break;
538	}
539	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
540	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
541	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
542	error = ctl_queue(io);
543	if (error != CTL_RETVAL_COMPLETE) {
544		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
545		    "dropping connection", error);
546		ctl_free_io(io);
547		refcount_release(&cs->cs_outstanding_ctl_pdus);
548		icl_pdu_free(request);
549		cfiscsi_session_terminate(cs);
550	}
551}
552
553static void
554cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
555{
556	struct iscsi_bhs_task_management_request *bhstmr;
557	struct iscsi_bhs_task_management_response *bhstmr2;
558	struct icl_pdu *response;
559	struct cfiscsi_session *cs;
560	union ctl_io *io;
561	int error;
562
563	cs = PDU_SESSION(request);
564	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
565	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
566	ctl_zero_io(io);
567	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
568	io->io_hdr.io_type = CTL_IO_TASK;
569	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
570	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
571	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhstmr->bhstmr_lun));
572	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
573
574	switch (bhstmr->bhstmr_function & ~0x80) {
575	case BHSTMR_FUNCTION_ABORT_TASK:
576#if 0
577		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
578#endif
579		io->taskio.task_action = CTL_TASK_ABORT_TASK;
580		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
581		break;
582	case BHSTMR_FUNCTION_ABORT_TASK_SET:
583#if 0
584		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
585#endif
586		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
587		break;
588	case BHSTMR_FUNCTION_CLEAR_TASK_SET:
589#if 0
590		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_CLEAR_TASK_SET");
591#endif
592		io->taskio.task_action = CTL_TASK_CLEAR_TASK_SET;
593		break;
594	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
595#if 0
596		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
597#endif
598		io->taskio.task_action = CTL_TASK_LUN_RESET;
599		break;
600	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
601#if 0
602		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
603#endif
604		io->taskio.task_action = CTL_TASK_TARGET_RESET;
605		break;
606	case BHSTMR_FUNCTION_TARGET_COLD_RESET:
607#if 0
608		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_COLD_RESET");
609#endif
610		io->taskio.task_action = CTL_TASK_TARGET_RESET;
611		break;
612	case BHSTMR_FUNCTION_QUERY_TASK:
613#if 0
614		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK");
615#endif
616		io->taskio.task_action = CTL_TASK_QUERY_TASK;
617		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
618		break;
619	case BHSTMR_FUNCTION_QUERY_TASK_SET:
620#if 0
621		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK_SET");
622#endif
623		io->taskio.task_action = CTL_TASK_QUERY_TASK_SET;
624		break;
625	case BHSTMR_FUNCTION_I_T_NEXUS_RESET:
626#if 0
627		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_I_T_NEXUS_RESET");
628#endif
629		io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
630		break;
631	case BHSTMR_FUNCTION_QUERY_ASYNC_EVENT:
632#if 0
633		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_ASYNC_EVENT");
634#endif
635		io->taskio.task_action = CTL_TASK_QUERY_ASYNC_EVENT;
636		break;
637	default:
638		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
639		    bhstmr->bhstmr_function & ~0x80);
640		ctl_free_io(io);
641
642		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
643		if (response == NULL) {
644			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
645			    "dropping connection");
646			icl_pdu_free(request);
647			cfiscsi_session_terminate(cs);
648			return;
649		}
650		bhstmr2 = (struct iscsi_bhs_task_management_response *)
651		    response->ip_bhs;
652		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
653		bhstmr2->bhstmr_flags = 0x80;
654		bhstmr2->bhstmr_response =
655		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
656		bhstmr2->bhstmr_initiator_task_tag =
657		    bhstmr->bhstmr_initiator_task_tag;
658		icl_pdu_free(request);
659		cfiscsi_pdu_queue(response);
660		return;
661	}
662
663	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
664	error = ctl_queue(io);
665	if (error != CTL_RETVAL_COMPLETE) {
666		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
667		    "dropping connection", error);
668		ctl_free_io(io);
669		refcount_release(&cs->cs_outstanding_ctl_pdus);
670		icl_pdu_free(request);
671		cfiscsi_session_terminate(cs);
672	}
673}
674
675static bool
676cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
677{
678	struct iscsi_bhs_data_out *bhsdo;
679	struct cfiscsi_session *cs;
680	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
681	size_t copy_len, len, off, buffer_offset;
682	int ctl_sg_count;
683	union ctl_io *io;
684
685	cs = PDU_SESSION(request);
686
687	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
688	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
689	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
690	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
691	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
692
693	/*
694	 * We're only using fields common for Data-Out and SCSI Command PDUs.
695	 */
696	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
697
698	io = cdw->cdw_ctl_io;
699	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
700	    ("CTL_FLAG_DATA_IN"));
701
702#if 0
703	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
704	    request->ip_data_len, io->scsiio.kern_total_len);
705#endif
706
707	if (io->scsiio.kern_sg_entries > 0) {
708		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
709		ctl_sg_count = io->scsiio.kern_sg_entries;
710	} else {
711		ctl_sglist = &ctl_sg_entry;
712		ctl_sglist->addr = io->scsiio.kern_data_ptr;
713		ctl_sglist->len = io->scsiio.kern_data_len;
714		ctl_sg_count = 1;
715	}
716
717	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
718	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
719		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
720	else
721		buffer_offset = 0;
722	len = icl_pdu_data_segment_length(request);
723
724	/*
725	 * Make sure the offset, as sent by the initiator, matches the offset
726	 * we're supposed to be at in the scatter-gather list.
727	 */
728	if (buffer_offset >
729	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
730	    buffer_offset + len <=
731	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
732		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
733		    "expected %zd; dropping connection", buffer_offset,
734		    (size_t)io->scsiio.kern_rel_offset +
735		    (size_t)io->scsiio.ext_data_filled);
736		ctl_set_data_phase_error(&io->scsiio);
737		cfiscsi_session_terminate(cs);
738		return (true);
739	}
740
741	/*
742	 * This is the offset within the PDU data segment, as opposed
743	 * to buffer_offset, which is the offset within the task (SCSI
744	 * command).
745	 */
746	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
747	    buffer_offset;
748
749	/*
750	 * Iterate over the scatter/gather segments, filling them with data
751	 * from the PDU data segment.  Note that this can get called multiple
752	 * times for one SCSI command; the cdw structure holds state for the
753	 * scatter/gather list.
754	 */
755	for (;;) {
756		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
757		    ("cdw->cdw_sg_index >= ctl_sg_count"));
758		if (cdw->cdw_sg_len == 0) {
759			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
760			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
761		}
762		KASSERT(off <= len, ("len > off"));
763		copy_len = len - off;
764		if (copy_len > cdw->cdw_sg_len)
765			copy_len = cdw->cdw_sg_len;
766
767		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
768		cdw->cdw_sg_addr += copy_len;
769		cdw->cdw_sg_len -= copy_len;
770		off += copy_len;
771		io->scsiio.ext_data_filled += copy_len;
772		io->scsiio.kern_data_resid -= copy_len;
773
774		if (cdw->cdw_sg_len == 0) {
775			/*
776			 * End of current segment.
777			 */
778			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
779				/*
780				 * Last segment in scatter/gather list.
781				 */
782				break;
783			}
784			cdw->cdw_sg_index++;
785		}
786
787		if (off == len) {
788			/*
789			 * End of PDU payload.
790			 */
791			break;
792		}
793	}
794
795	if (len > off) {
796		/*
797		 * In case of unsolicited data, it's possible that the buffer
798		 * provided by CTL is smaller than negotiated FirstBurstLength.
799		 * Just ignore the superfluous data; will ask for them with R2T
800		 * on next call to cfiscsi_datamove().
801		 *
802		 * This obviously can only happen with SCSI Command PDU.
803		 */
804		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
805		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
806			return (true);
807
808		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
809		    "expected %zd; dropping connection",
810		    icl_pdu_data_segment_length(request), off);
811		ctl_set_data_phase_error(&io->scsiio);
812		cfiscsi_session_terminate(cs);
813		return (true);
814	}
815
816	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
817	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
818		CFISCSI_SESSION_WARN(cs, "got the final packet without "
819		    "the F flag; flags = 0x%x; dropping connection",
820		    bhsdo->bhsdo_flags);
821		ctl_set_data_phase_error(&io->scsiio);
822		cfiscsi_session_terminate(cs);
823		return (true);
824	}
825
826	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
827	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
828		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
829		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
830			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
831			    "transmitted size was %zd bytes instead of %d; "
832			    "dropping connection",
833			    (size_t)io->scsiio.ext_data_filled,
834			    cdw->cdw_r2t_end);
835			ctl_set_data_phase_error(&io->scsiio);
836			cfiscsi_session_terminate(cs);
837			return (true);
838		} else {
839			/*
840			 * For SCSI Command PDU, this just means we need to
841			 * solicit more data by sending R2T.
842			 */
843			return (false);
844		}
845	}
846
847	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
848#if 0
849		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
850		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
851#endif
852
853		return (true);
854	}
855
856	return (false);
857}
858
859static void
860cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
861{
862	struct iscsi_bhs_data_out *bhsdo;
863	struct cfiscsi_session *cs;
864	struct cfiscsi_data_wait *cdw = NULL;
865	union ctl_io *io;
866	bool done;
867
868	cs = PDU_SESSION(request);
869	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
870
871	CFISCSI_SESSION_LOCK(cs);
872	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
873#if 0
874		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
875		    "ttt 0x%x, itt 0x%x",
876		    bhsdo->bhsdo_target_transfer_tag,
877		    bhsdo->bhsdo_initiator_task_tag,
878		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
879#endif
880		if (bhsdo->bhsdo_target_transfer_tag ==
881		    cdw->cdw_target_transfer_tag)
882			break;
883	}
884	CFISCSI_SESSION_UNLOCK(cs);
885	if (cdw == NULL) {
886		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
887		    "0x%x, not found; dropping connection",
888		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
889		icl_pdu_free(request);
890		cfiscsi_session_terminate(cs);
891		return;
892	}
893
894	if (cdw->cdw_datasn != ntohl(bhsdo->bhsdo_datasn)) {
895		CFISCSI_SESSION_WARN(cs, "received Data-Out PDU with "
896		    "DataSN %u, while expected %u; dropping connection",
897		    ntohl(bhsdo->bhsdo_datasn), cdw->cdw_datasn);
898		icl_pdu_free(request);
899		cfiscsi_session_terminate(cs);
900		return;
901	}
902	cdw->cdw_datasn++;
903
904	io = cdw->cdw_ctl_io;
905	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
906	    ("CTL_FLAG_DATA_IN"));
907
908	done = cfiscsi_handle_data_segment(request, cdw);
909	if (done) {
910		CFISCSI_SESSION_LOCK(cs);
911		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
912		CFISCSI_SESSION_UNLOCK(cs);
913		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
914		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
915		cfiscsi_data_wait_free(cs, cdw);
916		io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
917		if (done)
918			io->scsiio.be_move_done(io);
919		else
920			cfiscsi_datamove_out(io);
921	}
922
923	icl_pdu_free(request);
924}
925
926static void
927cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
928{
929	struct iscsi_bhs_logout_request *bhslr;
930	struct iscsi_bhs_logout_response *bhslr2;
931	struct icl_pdu *response;
932	struct cfiscsi_session *cs;
933
934	cs = PDU_SESSION(request);
935	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
936	switch (bhslr->bhslr_reason & 0x7f) {
937	case BHSLR_REASON_CLOSE_SESSION:
938	case BHSLR_REASON_CLOSE_CONNECTION:
939		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
940		if (response == NULL) {
941			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
942			icl_pdu_free(request);
943			cfiscsi_session_terminate(cs);
944			return;
945		}
946		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
947		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
948		bhslr2->bhslr_flags = 0x80;
949		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
950		bhslr2->bhslr_initiator_task_tag =
951		    bhslr->bhslr_initiator_task_tag;
952		icl_pdu_free(request);
953		cfiscsi_pdu_queue(response);
954		cfiscsi_session_terminate(cs);
955		break;
956	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
957		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
958		if (response == NULL) {
959			CFISCSI_SESSION_WARN(cs,
960			    "failed to allocate memory; dropping connection");
961			icl_pdu_free(request);
962			cfiscsi_session_terminate(cs);
963			return;
964		}
965		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
966		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
967		bhslr2->bhslr_flags = 0x80;
968		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
969		bhslr2->bhslr_initiator_task_tag =
970		    bhslr->bhslr_initiator_task_tag;
971		icl_pdu_free(request);
972		cfiscsi_pdu_queue(response);
973		break;
974	default:
975		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
976		    bhslr->bhslr_reason);
977		icl_pdu_free(request);
978		cfiscsi_session_terminate(cs);
979		break;
980	}
981}
982
983static void
984cfiscsi_callout(void *context)
985{
986	struct icl_pdu *cp;
987	struct iscsi_bhs_nop_in *bhsni;
988	struct cfiscsi_session *cs;
989
990	cs = context;
991
992	if (cs->cs_terminating)
993		return;
994
995	callout_schedule(&cs->cs_callout, 1 * hz);
996
997	atomic_add_int(&cs->cs_timeout, 1);
998
999#ifdef ICL_KERNEL_PROXY
1000	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1001		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1002			CFISCSI_SESSION_WARN(cs, "login timed out after "
1003			    "%d seconds; dropping connection", cs->cs_timeout);
1004			cfiscsi_session_terminate(cs);
1005		}
1006		return;
1007	}
1008#endif
1009
1010	if (ping_timeout <= 0) {
1011		/*
1012		 * Pings are disabled.  Don't send NOP-In in this case;
1013		 * user might have disabled pings to work around problems
1014		 * with certain initiators that can't properly handle
1015		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1016		 * triggering reconnection, should the user decide to
1017		 * reenable them.
1018		 */
1019		cs->cs_timeout = 0;
1020		return;
1021	}
1022
1023	if (cs->cs_timeout >= ping_timeout) {
1024		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1025		    "dropping connection",  ping_timeout);
1026		cfiscsi_session_terminate(cs);
1027		return;
1028	}
1029
1030	/*
1031	 * If the ping was reset less than one second ago - which means
1032	 * that we've received some PDU during the last second - assume
1033	 * the traffic flows correctly and don't bother sending a NOP-Out.
1034	 *
1035	 * (It's 2 - one for one second, and one for incrementing is_timeout
1036	 * earlier in this routine.)
1037	 */
1038	if (cs->cs_timeout < 2)
1039		return;
1040
1041	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1042	if (cp == NULL) {
1043		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1044		return;
1045	}
1046	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1047	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1048	bhsni->bhsni_flags = 0x80;
1049	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1050
1051	cfiscsi_pdu_queue(cp);
1052}
1053
1054static struct cfiscsi_data_wait *
1055cfiscsi_data_wait_new(struct cfiscsi_session *cs, union ctl_io *io,
1056    uint32_t initiator_task_tag, uint32_t *target_transfer_tagp)
1057{
1058	struct cfiscsi_data_wait *cdw;
1059	int error;
1060
1061	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
1062	if (cdw == NULL) {
1063		CFISCSI_SESSION_WARN(cs,
1064		    "failed to allocate %zd bytes", sizeof(*cdw));
1065		return (NULL);
1066	}
1067
1068	error = icl_conn_transfer_setup(cs->cs_conn, io, target_transfer_tagp,
1069	    &cdw->cdw_icl_prv);
1070	if (error != 0) {
1071		CFISCSI_SESSION_WARN(cs,
1072		    "icl_conn_transfer_setup() failed with error %d", error);
1073		uma_zfree(cfiscsi_data_wait_zone, cdw);
1074		return (NULL);
1075	}
1076
1077	cdw->cdw_ctl_io = io;
1078	cdw->cdw_target_transfer_tag = *target_transfer_tagp;
1079	cdw->cdw_initiator_task_tag = initiator_task_tag;
1080
1081	return (cdw);
1082}
1083
1084static void
1085cfiscsi_data_wait_free(struct cfiscsi_session *cs,
1086    struct cfiscsi_data_wait *cdw)
1087{
1088
1089	icl_conn_transfer_done(cs->cs_conn, cdw->cdw_icl_prv);
1090	uma_zfree(cfiscsi_data_wait_zone, cdw);
1091}
1092
1093static void
1094cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1095{
1096	struct cfiscsi_data_wait *cdw;
1097	union ctl_io *io;
1098	int error, last, wait;
1099
1100	if (cs->cs_target == NULL)
1101		return;		/* No target yet, so nothing to do. */
1102	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1103	ctl_zero_io(io);
1104	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = cs;
1105	io->io_hdr.io_type = CTL_IO_TASK;
1106	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
1107	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1108	io->io_hdr.nexus.targ_lun = 0;
1109	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1110	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1111	wait = cs->cs_outstanding_ctl_pdus;
1112	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1113	error = ctl_queue(io);
1114	if (error != CTL_RETVAL_COMPLETE) {
1115		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1116		refcount_release(&cs->cs_outstanding_ctl_pdus);
1117		ctl_free_io(io);
1118	}
1119
1120	CFISCSI_SESSION_LOCK(cs);
1121	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1122		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1123		CFISCSI_SESSION_UNLOCK(cs);
1124		/*
1125		 * Set nonzero port status; this prevents backends from
1126		 * assuming that the data transfer actually succeeded
1127		 * and writing uninitialized data to disk.
1128		 */
1129		cdw->cdw_ctl_io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
1130		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1131		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1132		cfiscsi_data_wait_free(cs, cdw);
1133		CFISCSI_SESSION_LOCK(cs);
1134	}
1135	CFISCSI_SESSION_UNLOCK(cs);
1136
1137	/*
1138	 * Wait for CTL to terminate all the tasks.
1139	 */
1140	if (wait > 0)
1141		CFISCSI_SESSION_WARN(cs,
1142		    "waiting for CTL to terminate %d tasks", wait);
1143	for (;;) {
1144		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1145		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1146		if (last != 0)
1147			break;
1148		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1149		    0, "cfiscsi_terminate", hz / 100);
1150	}
1151	if (wait > 0)
1152		CFISCSI_SESSION_WARN(cs, "tasks terminated");
1153}
1154
1155static void
1156cfiscsi_maintenance_thread(void *arg)
1157{
1158	struct cfiscsi_session *cs;
1159
1160	cs = arg;
1161
1162	for (;;) {
1163		CFISCSI_SESSION_LOCK(cs);
1164		if (cs->cs_terminating == false)
1165			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1166		CFISCSI_SESSION_UNLOCK(cs);
1167
1168		if (cs->cs_terminating) {
1169
1170			/*
1171			 * We used to wait up to 30 seconds to deliver queued
1172			 * PDUs to the initiator.  We also tried hard to deliver
1173			 * SCSI Responses for the aborted PDUs.  We don't do
1174			 * that anymore.  We might need to revisit that.
1175			 */
1176			callout_drain(&cs->cs_callout);
1177			icl_conn_close(cs->cs_conn);
1178
1179			/*
1180			 * At this point ICL receive thread is no longer
1181			 * running; no new tasks can be queued.
1182			 */
1183			cfiscsi_session_terminate_tasks(cs);
1184			cfiscsi_session_delete(cs);
1185			kthread_exit();
1186			return;
1187		}
1188		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1189	}
1190}
1191
1192static void
1193cfiscsi_session_terminate(struct cfiscsi_session *cs)
1194{
1195
1196	if (cs->cs_terminating)
1197		return;
1198	cs->cs_terminating = true;
1199	cv_signal(&cs->cs_maintenance_cv);
1200#ifdef ICL_KERNEL_PROXY
1201	cv_signal(&cs->cs_login_cv);
1202#endif
1203}
1204
1205static int
1206cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1207{
1208	struct cfiscsi_target *ct;
1209	char *name;
1210	int i;
1211
1212	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1213
1214	ct = cs->cs_target;
1215	name = strdup(cs->cs_initiator_id, M_CTL);
1216	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1217	if (i < 0) {
1218		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1219		    i);
1220		cs->cs_ctl_initid = -1;
1221		return (1);
1222	}
1223	cs->cs_ctl_initid = i;
1224#if 0
1225	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1226#endif
1227
1228	return (0);
1229}
1230
1231static void
1232cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1233{
1234	int error;
1235
1236	if (cs->cs_ctl_initid == -1)
1237		return;
1238
1239	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1240	if (error != 0) {
1241		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1242		    error);
1243	}
1244	cs->cs_ctl_initid = -1;
1245}
1246
1247static struct cfiscsi_session *
1248cfiscsi_session_new(struct cfiscsi_softc *softc, const char *offload)
1249{
1250	struct cfiscsi_session *cs;
1251	int error;
1252
1253	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1254	if (cs == NULL) {
1255		CFISCSI_WARN("malloc failed");
1256		return (NULL);
1257	}
1258	cs->cs_ctl_initid = -1;
1259
1260	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1261	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1262	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1263	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1264#ifdef ICL_KERNEL_PROXY
1265	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1266#endif
1267
1268	cs->cs_conn = icl_new_conn(offload, false, "cfiscsi", &cs->cs_lock);
1269	if (cs->cs_conn == NULL) {
1270		free(cs, M_CFISCSI);
1271		return (NULL);
1272	}
1273	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1274	cs->cs_conn->ic_error = cfiscsi_error_callback;
1275	cs->cs_conn->ic_prv0 = cs;
1276
1277	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1278	if (error != 0) {
1279		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1280		free(cs, M_CFISCSI);
1281		return (NULL);
1282	}
1283
1284	mtx_lock(&softc->lock);
1285	cs->cs_id = ++softc->last_session_id;
1286	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1287	mtx_unlock(&softc->lock);
1288
1289	/*
1290	 * Start pinging the initiator.
1291	 */
1292	callout_init(&cs->cs_callout, 1);
1293	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1294
1295	return (cs);
1296}
1297
1298static void
1299cfiscsi_session_delete(struct cfiscsi_session *cs)
1300{
1301	struct cfiscsi_softc *softc;
1302
1303	softc = &cfiscsi_softc;
1304
1305	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1306	    ("destroying session with outstanding CTL pdus"));
1307	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1308	    ("destroying session with non-empty queue"));
1309
1310	cfiscsi_session_unregister_initiator(cs);
1311	if (cs->cs_target != NULL)
1312		cfiscsi_target_release(cs->cs_target);
1313	icl_conn_close(cs->cs_conn);
1314	icl_conn_free(cs->cs_conn);
1315
1316	mtx_lock(&softc->lock);
1317	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1318	cv_signal(&softc->sessions_cv);
1319	mtx_unlock(&softc->lock);
1320
1321	free(cs, M_CFISCSI);
1322}
1323
1324int
1325cfiscsi_init(void)
1326{
1327	struct cfiscsi_softc *softc;
1328
1329	softc = &cfiscsi_softc;
1330	bzero(softc, sizeof(*softc));
1331	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1332
1333	cv_init(&softc->sessions_cv, "cfiscsi_sessions");
1334#ifdef ICL_KERNEL_PROXY
1335	cv_init(&softc->accept_cv, "cfiscsi_accept");
1336#endif
1337	TAILQ_INIT(&softc->sessions);
1338	TAILQ_INIT(&softc->targets);
1339
1340	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1341	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1342	    UMA_ALIGN_PTR, 0);
1343
1344	return (0);
1345}
1346
1347#ifdef ICL_KERNEL_PROXY
1348static void
1349cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1350{
1351	struct cfiscsi_session *cs;
1352
1353	cs = cfiscsi_session_new(&cfiscsi_softc, NULL);
1354	if (cs == NULL) {
1355		CFISCSI_WARN("failed to create session");
1356		return;
1357	}
1358
1359	icl_conn_handoff_sock(cs->cs_conn, so);
1360	cs->cs_initiator_sa = sa;
1361	cs->cs_portal_id = portal_id;
1362	cs->cs_waiting_for_ctld = true;
1363	cv_signal(&cfiscsi_softc.accept_cv);
1364}
1365#endif
1366
1367static void
1368cfiscsi_online(void *arg)
1369{
1370	struct cfiscsi_softc *softc;
1371	struct cfiscsi_target *ct;
1372	int online;
1373
1374	ct = (struct cfiscsi_target *)arg;
1375	softc = ct->ct_softc;
1376
1377	mtx_lock(&softc->lock);
1378	if (ct->ct_online) {
1379		mtx_unlock(&softc->lock);
1380		return;
1381	}
1382	ct->ct_online = 1;
1383	online = softc->online++;
1384	mtx_unlock(&softc->lock);
1385	if (online > 0)
1386		return;
1387
1388#ifdef ICL_KERNEL_PROXY
1389	if (softc->listener != NULL)
1390		icl_listen_free(softc->listener);
1391	softc->listener = icl_listen_new(cfiscsi_accept);
1392#endif
1393}
1394
1395static void
1396cfiscsi_offline(void *arg)
1397{
1398	struct cfiscsi_softc *softc;
1399	struct cfiscsi_target *ct;
1400	struct cfiscsi_session *cs;
1401	int online;
1402
1403	ct = (struct cfiscsi_target *)arg;
1404	softc = ct->ct_softc;
1405
1406	mtx_lock(&softc->lock);
1407	if (!ct->ct_online) {
1408		mtx_unlock(&softc->lock);
1409		return;
1410	}
1411	ct->ct_online = 0;
1412	online = --softc->online;
1413
1414	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1415		if (cs->cs_target == ct)
1416			cfiscsi_session_terminate(cs);
1417	}
1418	do {
1419		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1420			if (cs->cs_target == ct)
1421				break;
1422		}
1423		if (cs != NULL)
1424			cv_wait(&softc->sessions_cv, &softc->lock);
1425	} while (cs != NULL && ct->ct_online == 0);
1426	mtx_unlock(&softc->lock);
1427	if (online > 0)
1428		return;
1429
1430#ifdef ICL_KERNEL_PROXY
1431	icl_listen_free(softc->listener);
1432	softc->listener = NULL;
1433#endif
1434}
1435
1436static int
1437cfiscsi_info(void *arg, struct sbuf *sb)
1438{
1439	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1440	int retval;
1441
1442	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1443	    ct->ct_state);
1444	return (retval);
1445}
1446
1447static void
1448cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1449{
1450	struct cfiscsi_softc *softc;
1451	struct cfiscsi_session *cs, *cs2;
1452	struct cfiscsi_target *ct;
1453	struct ctl_iscsi_handoff_params *cihp;
1454	int error;
1455
1456	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1457	softc = &cfiscsi_softc;
1458
1459	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1460	    cihp->initiator_name, cihp->initiator_addr,
1461	    cihp->target_name);
1462
1463	ct = cfiscsi_target_find(softc, cihp->target_name,
1464	    cihp->portal_group_tag);
1465	if (ct == NULL) {
1466		ci->status = CTL_ISCSI_ERROR;
1467		snprintf(ci->error_str, sizeof(ci->error_str),
1468		    "%s: target not found", __func__);
1469		return;
1470	}
1471
1472#ifdef ICL_KERNEL_PROXY
1473	if (cihp->socket > 0 && cihp->connection_id > 0) {
1474		snprintf(ci->error_str, sizeof(ci->error_str),
1475		    "both socket and connection_id set");
1476		ci->status = CTL_ISCSI_ERROR;
1477		cfiscsi_target_release(ct);
1478		return;
1479	}
1480	if (cihp->socket == 0) {
1481		mtx_lock(&cfiscsi_softc.lock);
1482		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1483			if (cs->cs_id == cihp->connection_id)
1484				break;
1485		}
1486		if (cs == NULL) {
1487			mtx_unlock(&cfiscsi_softc.lock);
1488			snprintf(ci->error_str, sizeof(ci->error_str),
1489			    "connection not found");
1490			ci->status = CTL_ISCSI_ERROR;
1491			cfiscsi_target_release(ct);
1492			return;
1493		}
1494		mtx_unlock(&cfiscsi_softc.lock);
1495	} else {
1496#endif
1497		cs = cfiscsi_session_new(softc, cihp->offload);
1498		if (cs == NULL) {
1499			ci->status = CTL_ISCSI_ERROR;
1500			snprintf(ci->error_str, sizeof(ci->error_str),
1501			    "%s: cfiscsi_session_new failed", __func__);
1502			cfiscsi_target_release(ct);
1503			return;
1504		}
1505#ifdef ICL_KERNEL_PROXY
1506	}
1507#endif
1508
1509	/*
1510	 * First PDU of Full Feature phase has the same CmdSN as the last
1511	 * PDU from the Login Phase received from the initiator.  Thus,
1512	 * the -1 below.
1513	 */
1514	cs->cs_cmdsn = cihp->cmdsn;
1515	cs->cs_statsn = cihp->statsn;
1516	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1517	cs->cs_max_burst_length = cihp->max_burst_length;
1518	cs->cs_first_burst_length = cihp->first_burst_length;
1519	cs->cs_immediate_data = !!cihp->immediate_data;
1520	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1521		cs->cs_conn->ic_header_crc32c = true;
1522	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1523		cs->cs_conn->ic_data_crc32c = true;
1524
1525	strlcpy(cs->cs_initiator_name,
1526	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1527	strlcpy(cs->cs_initiator_addr,
1528	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1529	strlcpy(cs->cs_initiator_alias,
1530	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1531	memcpy(cs->cs_initiator_isid,
1532	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1533	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1534	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1535	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1536	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1537	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1538
1539	mtx_lock(&softc->lock);
1540	if (ct->ct_online == 0) {
1541		mtx_unlock(&softc->lock);
1542		cfiscsi_session_terminate(cs);
1543		cfiscsi_target_release(ct);
1544		ci->status = CTL_ISCSI_ERROR;
1545		snprintf(ci->error_str, sizeof(ci->error_str),
1546		    "%s: port offline", __func__);
1547		return;
1548	}
1549	cs->cs_target = ct;
1550	mtx_unlock(&softc->lock);
1551
1552	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1553restart:
1554	if (!cs->cs_terminating) {
1555		mtx_lock(&softc->lock);
1556		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1557			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1558			    cs->cs_target == cs2->cs_target &&
1559			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1560				if (strcmp(cs->cs_initiator_addr,
1561				    cs2->cs_initiator_addr) != 0) {
1562					CFISCSI_SESSION_WARN(cs2,
1563					    "session reinstatement from "
1564					    "different address %s",
1565					    cs->cs_initiator_addr);
1566				} else {
1567					CFISCSI_SESSION_DEBUG(cs2,
1568					    "session reinstatement");
1569				}
1570				cfiscsi_session_terminate(cs2);
1571				mtx_unlock(&softc->lock);
1572				pause("cfiscsi_reinstate", 1);
1573				goto restart;
1574			}
1575		}
1576		mtx_unlock(&softc->lock);
1577	}
1578
1579	/*
1580	 * Register initiator with CTL.
1581	 */
1582	cfiscsi_session_register_initiator(cs);
1583
1584#ifdef ICL_KERNEL_PROXY
1585	if (cihp->socket > 0) {
1586#endif
1587		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1588		if (error != 0) {
1589			cfiscsi_session_terminate(cs);
1590			refcount_release(&cs->cs_outstanding_ctl_pdus);
1591			ci->status = CTL_ISCSI_ERROR;
1592			snprintf(ci->error_str, sizeof(ci->error_str),
1593			    "%s: icl_conn_handoff failed with error %d",
1594			    __func__, error);
1595			return;
1596		}
1597#ifdef ICL_KERNEL_PROXY
1598	}
1599#endif
1600
1601#ifdef ICL_KERNEL_PROXY
1602	cs->cs_login_phase = false;
1603
1604	/*
1605	 * First PDU of the Full Feature phase has likely already arrived.
1606	 * We have to pick it up and execute properly.
1607	 */
1608	if (cs->cs_login_pdu != NULL) {
1609		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1610		cfiscsi_pdu_handle(cs->cs_login_pdu);
1611		cs->cs_login_pdu = NULL;
1612	}
1613#endif
1614
1615	refcount_release(&cs->cs_outstanding_ctl_pdus);
1616	ci->status = CTL_ISCSI_OK;
1617}
1618
1619static void
1620cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1621{
1622	struct ctl_iscsi_list_params *cilp;
1623	struct cfiscsi_session *cs;
1624	struct cfiscsi_softc *softc;
1625	struct sbuf *sb;
1626	int error;
1627
1628	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1629	softc = &cfiscsi_softc;
1630
1631	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1632	if (sb == NULL) {
1633		ci->status = CTL_ISCSI_ERROR;
1634		snprintf(ci->error_str, sizeof(ci->error_str),
1635		    "Unable to allocate %d bytes for iSCSI session list",
1636		    cilp->alloc_len);
1637		return;
1638	}
1639
1640	sbuf_printf(sb, "<ctlislist>\n");
1641	mtx_lock(&softc->lock);
1642	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1643#ifdef ICL_KERNEL_PROXY
1644		if (cs->cs_target == NULL)
1645			continue;
1646#endif
1647		error = sbuf_printf(sb, "<connection id=\"%d\">"
1648		    "<initiator>%s</initiator>"
1649		    "<initiator_addr>%s</initiator_addr>"
1650		    "<initiator_alias>%s</initiator_alias>"
1651		    "<target>%s</target>"
1652		    "<target_alias>%s</target_alias>"
1653		    "<target_portal_group_tag>%u</target_portal_group_tag>"
1654		    "<header_digest>%s</header_digest>"
1655		    "<data_digest>%s</data_digest>"
1656		    "<max_data_segment_length>%zd</max_data_segment_length>"
1657		    "<max_burst_length>%zd</max_burst_length>"
1658		    "<first_burst_length>%zd</first_burst_length>"
1659		    "<immediate_data>%d</immediate_data>"
1660		    "<iser>%d</iser>"
1661		    "<offload>%s</offload>"
1662		    "</connection>\n",
1663		    cs->cs_id,
1664		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1665		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1666		    cs->cs_target->ct_tag,
1667		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1668		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1669		    cs->cs_max_data_segment_length,
1670		    cs->cs_max_burst_length,
1671		    cs->cs_first_burst_length,
1672		    cs->cs_immediate_data,
1673		    cs->cs_conn->ic_iser,
1674		    cs->cs_conn->ic_offload);
1675		if (error != 0)
1676			break;
1677	}
1678	mtx_unlock(&softc->lock);
1679	error = sbuf_printf(sb, "</ctlislist>\n");
1680	if (error != 0) {
1681		sbuf_delete(sb);
1682		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1683		snprintf(ci->error_str, sizeof(ci->error_str),
1684		    "Out of space, %d bytes is too small", cilp->alloc_len);
1685		return;
1686	}
1687	sbuf_finish(sb);
1688
1689	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1690	cilp->fill_len = sbuf_len(sb) + 1;
1691	ci->status = CTL_ISCSI_OK;
1692	sbuf_delete(sb);
1693}
1694
1695static void
1696cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1697{
1698	struct icl_pdu *response;
1699	struct iscsi_bhs_asynchronous_message *bhsam;
1700	struct ctl_iscsi_logout_params *cilp;
1701	struct cfiscsi_session *cs;
1702	struct cfiscsi_softc *softc;
1703	int found = 0;
1704
1705	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1706	softc = &cfiscsi_softc;
1707
1708	mtx_lock(&softc->lock);
1709	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1710		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1711		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1712		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1713			continue;
1714
1715		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1716		if (response == NULL) {
1717			ci->status = CTL_ISCSI_ERROR;
1718			snprintf(ci->error_str, sizeof(ci->error_str),
1719			    "Unable to allocate memory");
1720			mtx_unlock(&softc->lock);
1721			return;
1722		}
1723		bhsam =
1724		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1725		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1726		bhsam->bhsam_flags = 0x80;
1727		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1728		bhsam->bhsam_parameter3 = htons(10);
1729		cfiscsi_pdu_queue(response);
1730		found++;
1731	}
1732	mtx_unlock(&softc->lock);
1733
1734	if (found == 0) {
1735		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1736		snprintf(ci->error_str, sizeof(ci->error_str),
1737		    "No matching connections found");
1738		return;
1739	}
1740
1741	ci->status = CTL_ISCSI_OK;
1742}
1743
1744static void
1745cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1746{
1747	struct icl_pdu *response;
1748	struct iscsi_bhs_asynchronous_message *bhsam;
1749	struct ctl_iscsi_terminate_params *citp;
1750	struct cfiscsi_session *cs;
1751	struct cfiscsi_softc *softc;
1752	int found = 0;
1753
1754	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1755	softc = &cfiscsi_softc;
1756
1757	mtx_lock(&softc->lock);
1758	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1759		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1760		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1761		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1762			continue;
1763
1764		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1765		if (response == NULL) {
1766			/*
1767			 * Oh well.  Just terminate the connection.
1768			 */
1769		} else {
1770			bhsam = (struct iscsi_bhs_asynchronous_message *)
1771			    response->ip_bhs;
1772			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1773			bhsam->bhsam_flags = 0x80;
1774			bhsam->bhsam_0xffffffff = 0xffffffff;
1775			bhsam->bhsam_async_event =
1776			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1777			cfiscsi_pdu_queue(response);
1778		}
1779		cfiscsi_session_terminate(cs);
1780		found++;
1781	}
1782	mtx_unlock(&softc->lock);
1783
1784	if (found == 0) {
1785		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1786		snprintf(ci->error_str, sizeof(ci->error_str),
1787		    "No matching connections found");
1788		return;
1789	}
1790
1791	ci->status = CTL_ISCSI_OK;
1792}
1793
1794static void
1795cfiscsi_ioctl_limits(struct ctl_iscsi *ci)
1796{
1797	struct ctl_iscsi_limits_params *cilp;
1798	int error;
1799
1800	cilp = (struct ctl_iscsi_limits_params *)&(ci->data);
1801
1802	error = icl_limits(cilp->offload, false,
1803	    &cilp->data_segment_limit);
1804	if (error != 0) {
1805		ci->status = CTL_ISCSI_ERROR;
1806		snprintf(ci->error_str, sizeof(ci->error_str),
1807			"%s: icl_limits failed with error %d",
1808			__func__, error);
1809		return;
1810	}
1811
1812	ci->status = CTL_ISCSI_OK;
1813}
1814
1815#ifdef ICL_KERNEL_PROXY
1816static void
1817cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1818{
1819	struct ctl_iscsi_listen_params *cilp;
1820	struct sockaddr *sa;
1821	int error;
1822
1823	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1824
1825	if (cfiscsi_softc.listener == NULL) {
1826		CFISCSI_DEBUG("no listener");
1827		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1828		ci->status = CTL_ISCSI_ERROR;
1829		return;
1830	}
1831
1832	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1833	if (error != 0) {
1834		CFISCSI_DEBUG("getsockaddr, error %d", error);
1835		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1836		ci->status = CTL_ISCSI_ERROR;
1837		return;
1838	}
1839
1840	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1841	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1842	if (error != 0) {
1843		free(sa, M_SONAME);
1844		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1845		snprintf(ci->error_str, sizeof(ci->error_str),
1846		    "icl_listen_add failed, error %d", error);
1847		ci->status = CTL_ISCSI_ERROR;
1848		return;
1849	}
1850
1851	ci->status = CTL_ISCSI_OK;
1852}
1853
1854static void
1855cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1856{
1857	struct ctl_iscsi_accept_params *ciap;
1858	struct cfiscsi_session *cs;
1859	int error;
1860
1861	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1862
1863	mtx_lock(&cfiscsi_softc.lock);
1864	for (;;) {
1865		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1866			if (cs->cs_waiting_for_ctld)
1867				break;
1868		}
1869		if (cs != NULL)
1870			break;
1871		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1872		if (error != 0) {
1873			mtx_unlock(&cfiscsi_softc.lock);
1874			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1875			ci->status = CTL_ISCSI_ERROR;
1876			return;
1877		}
1878	}
1879	mtx_unlock(&cfiscsi_softc.lock);
1880
1881	cs->cs_waiting_for_ctld = false;
1882	cs->cs_login_phase = true;
1883
1884	ciap->connection_id = cs->cs_id;
1885	ciap->portal_id = cs->cs_portal_id;
1886	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1887	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1888	    cs->cs_initiator_sa->sa_len);
1889	if (error != 0) {
1890		snprintf(ci->error_str, sizeof(ci->error_str),
1891		    "copyout failed with error %d", error);
1892		ci->status = CTL_ISCSI_ERROR;
1893		return;
1894	}
1895
1896	ci->status = CTL_ISCSI_OK;
1897}
1898
1899static void
1900cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1901{
1902	struct ctl_iscsi_send_params *cisp;
1903	struct cfiscsi_session *cs;
1904	struct icl_pdu *ip;
1905	size_t datalen;
1906	void *data;
1907	int error;
1908
1909	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1910
1911	mtx_lock(&cfiscsi_softc.lock);
1912	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1913		if (cs->cs_id == cisp->connection_id)
1914			break;
1915	}
1916	if (cs == NULL) {
1917		mtx_unlock(&cfiscsi_softc.lock);
1918		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1919		ci->status = CTL_ISCSI_ERROR;
1920		return;
1921	}
1922	mtx_unlock(&cfiscsi_softc.lock);
1923
1924#if 0
1925	if (cs->cs_login_phase == false)
1926		return (EBUSY);
1927#endif
1928
1929	if (cs->cs_terminating) {
1930		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1931		ci->status = CTL_ISCSI_ERROR;
1932		return;
1933	}
1934
1935	datalen = cisp->data_segment_len;
1936	/*
1937	 * XXX
1938	 */
1939	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1940	if (datalen > 65535) {
1941		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1942		ci->status = CTL_ISCSI_ERROR;
1943		return;
1944	}
1945	if (datalen > 0) {
1946		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1947		error = copyin(cisp->data_segment, data, datalen);
1948		if (error != 0) {
1949			free(data, M_CFISCSI);
1950			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1951			ci->status = CTL_ISCSI_ERROR;
1952			return;
1953		}
1954	}
1955
1956	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
1957	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1958	if (datalen > 0) {
1959		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1960		free(data, M_CFISCSI);
1961	}
1962	CFISCSI_SESSION_LOCK(cs);
1963	icl_pdu_queue(ip);
1964	CFISCSI_SESSION_UNLOCK(cs);
1965	ci->status = CTL_ISCSI_OK;
1966}
1967
1968static void
1969cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1970{
1971	struct ctl_iscsi_receive_params *cirp;
1972	struct cfiscsi_session *cs;
1973	struct icl_pdu *ip;
1974	void *data;
1975	int error;
1976
1977	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1978
1979	mtx_lock(&cfiscsi_softc.lock);
1980	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1981		if (cs->cs_id == cirp->connection_id)
1982			break;
1983	}
1984	if (cs == NULL) {
1985		mtx_unlock(&cfiscsi_softc.lock);
1986		snprintf(ci->error_str, sizeof(ci->error_str),
1987		    "connection not found");
1988		ci->status = CTL_ISCSI_ERROR;
1989		return;
1990	}
1991	mtx_unlock(&cfiscsi_softc.lock);
1992
1993#if 0
1994	if (is->is_login_phase == false)
1995		return (EBUSY);
1996#endif
1997
1998	CFISCSI_SESSION_LOCK(cs);
1999	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
2000		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
2001		if (error != 0) {
2002			CFISCSI_SESSION_UNLOCK(cs);
2003			snprintf(ci->error_str, sizeof(ci->error_str),
2004			    "interrupted by signal");
2005			ci->status = CTL_ISCSI_ERROR;
2006			return;
2007		}
2008	}
2009
2010	if (cs->cs_terminating) {
2011		CFISCSI_SESSION_UNLOCK(cs);
2012		snprintf(ci->error_str, sizeof(ci->error_str),
2013		    "connection terminating");
2014		ci->status = CTL_ISCSI_ERROR;
2015		return;
2016	}
2017	ip = cs->cs_login_pdu;
2018	cs->cs_login_pdu = NULL;
2019	CFISCSI_SESSION_UNLOCK(cs);
2020
2021	if (ip->ip_data_len > cirp->data_segment_len) {
2022		icl_pdu_free(ip);
2023		snprintf(ci->error_str, sizeof(ci->error_str),
2024		    "data segment too big");
2025		ci->status = CTL_ISCSI_ERROR;
2026		return;
2027	}
2028
2029	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
2030	if (ip->ip_data_len > 0) {
2031		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
2032		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
2033		copyout(data, cirp->data_segment, ip->ip_data_len);
2034		free(data, M_CFISCSI);
2035	}
2036
2037	icl_pdu_free(ip);
2038	ci->status = CTL_ISCSI_OK;
2039}
2040
2041#endif /* !ICL_KERNEL_PROXY */
2042
2043static void
2044cfiscsi_ioctl_port_create(struct ctl_req *req)
2045{
2046	struct cfiscsi_target *ct;
2047	struct ctl_port *port;
2048	const char *target, *alias, *tags;
2049	struct scsi_vpd_id_descriptor *desc;
2050	ctl_options_t opts;
2051	int retval, len, idlen;
2052	uint16_t tag;
2053
2054	ctl_init_opts(&opts, req->num_args, req->kern_args);
2055	target = ctl_get_opt(&opts, "cfiscsi_target");
2056	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
2057	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2058	if (target == NULL || tags == NULL) {
2059		req->status = CTL_LUN_ERROR;
2060		snprintf(req->error_str, sizeof(req->error_str),
2061		    "Missing required argument");
2062		ctl_free_opts(&opts);
2063		return;
2064	}
2065	tag = strtol(tags, (char **)NULL, 10);
2066	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias, tag);
2067	if (ct == NULL) {
2068		req->status = CTL_LUN_ERROR;
2069		snprintf(req->error_str, sizeof(req->error_str),
2070		    "failed to create target \"%s\"", target);
2071		ctl_free_opts(&opts);
2072		return;
2073	}
2074	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
2075		req->status = CTL_LUN_ERROR;
2076		snprintf(req->error_str, sizeof(req->error_str),
2077		    "target \"%s\" for portal group tag %u already exists",
2078		    target, tag);
2079		cfiscsi_target_release(ct);
2080		ctl_free_opts(&opts);
2081		return;
2082	}
2083	port = &ct->ct_port;
2084	// WAT
2085	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
2086		goto done;
2087
2088	port->frontend = &cfiscsi_frontend;
2089	port->port_type = CTL_PORT_ISCSI;
2090	/* XXX KDM what should the real number be here? */
2091	port->num_requested_ctl_io = 4096;
2092	port->port_name = "iscsi";
2093	port->physical_port = tag;
2094	port->virtual_port = ct->ct_target_id;
2095	port->port_online = cfiscsi_online;
2096	port->port_offline = cfiscsi_offline;
2097	port->port_info = cfiscsi_info;
2098	port->onoff_arg = ct;
2099	port->fe_datamove = cfiscsi_datamove;
2100	port->fe_done = cfiscsi_done;
2101
2102	/* XXX KDM what should we report here? */
2103	/* XXX These should probably be fetched from CTL. */
2104	port->max_targets = 1;
2105	port->max_target_id = 15;
2106	port->targ_port = -1;
2107
2108	port->options = opts;
2109	STAILQ_INIT(&opts);
2110
2111	/* Generate Port ID. */
2112	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2113	idlen = roundup2(idlen, 4);
2114	len = sizeof(struct scsi_vpd_device_id) + idlen;
2115	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2116	    M_CTL, M_WAITOK | M_ZERO);
2117	port->port_devid->len = len;
2118	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2119	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2120	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2121	    SVPD_ID_TYPE_SCSI_NAME;
2122	desc->length = idlen;
2123	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x", target, tag);
2124
2125	/* Generate Target ID. */
2126	idlen = strlen(target) + 1;
2127	idlen = roundup2(idlen, 4);
2128	len = sizeof(struct scsi_vpd_device_id) + idlen;
2129	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2130	    M_CTL, M_WAITOK | M_ZERO);
2131	port->target_devid->len = len;
2132	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2133	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2134	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2135	    SVPD_ID_TYPE_SCSI_NAME;
2136	desc->length = idlen;
2137	strlcpy(desc->identifier, target, idlen);
2138
2139	retval = ctl_port_register(port);
2140	if (retval != 0) {
2141		ctl_free_opts(&port->options);
2142		cfiscsi_target_release(ct);
2143		free(port->port_devid, M_CFISCSI);
2144		free(port->target_devid, M_CFISCSI);
2145		req->status = CTL_LUN_ERROR;
2146		snprintf(req->error_str, sizeof(req->error_str),
2147		    "ctl_port_register() failed with error %d", retval);
2148		return;
2149	}
2150done:
2151	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2152	req->status = CTL_LUN_OK;
2153	memcpy(req->kern_args[0].kvalue, &port->targ_port,
2154	    sizeof(port->targ_port)); //XXX
2155}
2156
2157static void
2158cfiscsi_ioctl_port_remove(struct ctl_req *req)
2159{
2160	struct cfiscsi_target *ct;
2161	const char *target, *tags;
2162	ctl_options_t opts;
2163	uint16_t tag;
2164
2165	ctl_init_opts(&opts, req->num_args, req->kern_args);
2166	target = ctl_get_opt(&opts, "cfiscsi_target");
2167	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2168	if (target == NULL || tags == NULL) {
2169		ctl_free_opts(&opts);
2170		req->status = CTL_LUN_ERROR;
2171		snprintf(req->error_str, sizeof(req->error_str),
2172		    "Missing required argument");
2173		return;
2174	}
2175	tag = strtol(tags, (char **)NULL, 10);
2176	ct = cfiscsi_target_find(&cfiscsi_softc, target, tag);
2177	if (ct == NULL) {
2178		ctl_free_opts(&opts);
2179		req->status = CTL_LUN_ERROR;
2180		snprintf(req->error_str, sizeof(req->error_str),
2181		    "can't find target \"%s\"", target);
2182		return;
2183	}
2184	if (ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE) {
2185		ctl_free_opts(&opts);
2186		req->status = CTL_LUN_ERROR;
2187		snprintf(req->error_str, sizeof(req->error_str),
2188		    "target \"%s\" is already dying", target);
2189		return;
2190	}
2191	ctl_free_opts(&opts);
2192
2193	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2194	ctl_port_offline(&ct->ct_port);
2195	cfiscsi_target_release(ct);
2196	cfiscsi_target_release(ct);
2197	req->status = CTL_LUN_OK;
2198}
2199
2200static int
2201cfiscsi_ioctl(struct cdev *dev,
2202    u_long cmd, caddr_t addr, int flag, struct thread *td)
2203{
2204	struct ctl_iscsi *ci;
2205	struct ctl_req *req;
2206
2207	if (cmd == CTL_PORT_REQ) {
2208		req = (struct ctl_req *)addr;
2209		switch (req->reqtype) {
2210		case CTL_REQ_CREATE:
2211			cfiscsi_ioctl_port_create(req);
2212			break;
2213		case CTL_REQ_REMOVE:
2214			cfiscsi_ioctl_port_remove(req);
2215			break;
2216		default:
2217			req->status = CTL_LUN_ERROR;
2218			snprintf(req->error_str, sizeof(req->error_str),
2219			    "Unsupported request type %d", req->reqtype);
2220		}
2221		return (0);
2222	}
2223
2224	if (cmd != CTL_ISCSI)
2225		return (ENOTTY);
2226
2227	ci = (struct ctl_iscsi *)addr;
2228	switch (ci->type) {
2229	case CTL_ISCSI_HANDOFF:
2230		cfiscsi_ioctl_handoff(ci);
2231		break;
2232	case CTL_ISCSI_LIST:
2233		cfiscsi_ioctl_list(ci);
2234		break;
2235	case CTL_ISCSI_LOGOUT:
2236		cfiscsi_ioctl_logout(ci);
2237		break;
2238	case CTL_ISCSI_TERMINATE:
2239		cfiscsi_ioctl_terminate(ci);
2240		break;
2241	case CTL_ISCSI_LIMITS:
2242		cfiscsi_ioctl_limits(ci);
2243		break;
2244#ifdef ICL_KERNEL_PROXY
2245	case CTL_ISCSI_LISTEN:
2246		cfiscsi_ioctl_listen(ci);
2247		break;
2248	case CTL_ISCSI_ACCEPT:
2249		cfiscsi_ioctl_accept(ci);
2250		break;
2251	case CTL_ISCSI_SEND:
2252		cfiscsi_ioctl_send(ci);
2253		break;
2254	case CTL_ISCSI_RECEIVE:
2255		cfiscsi_ioctl_receive(ci);
2256		break;
2257#else
2258	case CTL_ISCSI_LISTEN:
2259	case CTL_ISCSI_ACCEPT:
2260	case CTL_ISCSI_SEND:
2261	case CTL_ISCSI_RECEIVE:
2262		ci->status = CTL_ISCSI_ERROR;
2263		snprintf(ci->error_str, sizeof(ci->error_str),
2264		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2265		    __func__);
2266		break;
2267#endif /* !ICL_KERNEL_PROXY */
2268	default:
2269		ci->status = CTL_ISCSI_ERROR;
2270		snprintf(ci->error_str, sizeof(ci->error_str),
2271		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2272		break;
2273	}
2274
2275	return (0);
2276}
2277
2278static void
2279cfiscsi_target_hold(struct cfiscsi_target *ct)
2280{
2281
2282	refcount_acquire(&ct->ct_refcount);
2283}
2284
2285static void
2286cfiscsi_target_release(struct cfiscsi_target *ct)
2287{
2288	struct cfiscsi_softc *softc;
2289
2290	softc = ct->ct_softc;
2291	mtx_lock(&softc->lock);
2292	if (refcount_release(&ct->ct_refcount)) {
2293		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2294		mtx_unlock(&softc->lock);
2295		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2296			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2297			if (ctl_port_deregister(&ct->ct_port) != 0)
2298				printf("%s: ctl_port_deregister() failed\n",
2299				    __func__);
2300		}
2301		free(ct, M_CFISCSI);
2302
2303		return;
2304	}
2305	mtx_unlock(&softc->lock);
2306}
2307
2308static struct cfiscsi_target *
2309cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name, uint16_t tag)
2310{
2311	struct cfiscsi_target *ct;
2312
2313	mtx_lock(&softc->lock);
2314	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2315		if (ct->ct_tag != tag ||
2316		    strcmp(name, ct->ct_name) != 0 ||
2317		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2318			continue;
2319		cfiscsi_target_hold(ct);
2320		mtx_unlock(&softc->lock);
2321		return (ct);
2322	}
2323	mtx_unlock(&softc->lock);
2324
2325	return (NULL);
2326}
2327
2328static struct cfiscsi_target *
2329cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2330    const char *alias, uint16_t tag)
2331{
2332	struct cfiscsi_target *ct, *newct;
2333
2334	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2335		return (NULL);
2336
2337	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2338
2339	mtx_lock(&softc->lock);
2340	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2341		if (ct->ct_tag != tag ||
2342		    strcmp(name, ct->ct_name) != 0 ||
2343		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2344			continue;
2345		cfiscsi_target_hold(ct);
2346		mtx_unlock(&softc->lock);
2347		free(newct, M_CFISCSI);
2348		return (ct);
2349	}
2350
2351	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2352	if (alias != NULL)
2353		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2354	newct->ct_tag = tag;
2355	refcount_init(&newct->ct_refcount, 1);
2356	newct->ct_softc = softc;
2357	if (TAILQ_EMPTY(&softc->targets))
2358		softc->last_target_id = 0;
2359	newct->ct_target_id = ++softc->last_target_id;
2360	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2361	mtx_unlock(&softc->lock);
2362
2363	return (newct);
2364}
2365
2366static void
2367cfiscsi_datamove_in(union ctl_io *io)
2368{
2369	struct cfiscsi_session *cs;
2370	struct icl_pdu *request, *response;
2371	const struct iscsi_bhs_scsi_command *bhssc;
2372	struct iscsi_bhs_data_in *bhsdi;
2373	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2374	size_t len, expected_len, sg_len, buffer_offset;
2375	const char *sg_addr;
2376	int ctl_sg_count, error, i;
2377
2378	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2379	cs = PDU_SESSION(request);
2380
2381	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2382	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2383	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2384	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2385
2386	if (io->scsiio.kern_sg_entries > 0) {
2387		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2388		ctl_sg_count = io->scsiio.kern_sg_entries;
2389	} else {
2390		ctl_sglist = &ctl_sg_entry;
2391		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2392		ctl_sglist->len = io->scsiio.kern_data_len;
2393		ctl_sg_count = 1;
2394	}
2395
2396	/*
2397	 * This is the total amount of data to be transferred within the current
2398	 * SCSI command.  We need to record it so that we can properly report
2399	 * underflow/underflow.
2400	 */
2401	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2402
2403	/*
2404	 * This is the offset within the current SCSI command; for the first
2405	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2406	 * it will be the sum of lengths of previous ones.
2407	 */
2408	buffer_offset = io->scsiio.kern_rel_offset;
2409
2410	/*
2411	 * This is the transfer length expected by the initiator.  In theory,
2412	 * it could be different from the correct amount of data from the SCSI
2413	 * point of view, even if that doesn't make any sense.
2414	 */
2415	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2416#if 0
2417	if (expected_len != io->scsiio.kern_total_len) {
2418		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2419		    "actual length %zd", expected_len,
2420		    (size_t)io->scsiio.kern_total_len);
2421	}
2422#endif
2423
2424	if (buffer_offset >= expected_len) {
2425#if 0
2426		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2427		    "already sent the expected len", buffer_offset);
2428#endif
2429		io->scsiio.be_move_done(io);
2430		return;
2431	}
2432
2433	i = 0;
2434	sg_addr = NULL;
2435	sg_len = 0;
2436	response = NULL;
2437	bhsdi = NULL;
2438	for (;;) {
2439		if (response == NULL) {
2440			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2441			if (response == NULL) {
2442				CFISCSI_SESSION_WARN(cs, "failed to "
2443				    "allocate memory; dropping connection");
2444				ctl_set_busy(&io->scsiio);
2445				io->scsiio.be_move_done(io);
2446				cfiscsi_session_terminate(cs);
2447				return;
2448			}
2449			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2450			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2451			bhsdi->bhsdi_initiator_task_tag =
2452			    bhssc->bhssc_initiator_task_tag;
2453			bhsdi->bhsdi_target_transfer_tag = 0xffffffff;
2454			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2455			PDU_EXPDATASN(request)++;
2456			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2457		}
2458
2459		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2460		if (sg_len == 0) {
2461			sg_addr = ctl_sglist[i].addr;
2462			sg_len = ctl_sglist[i].len;
2463			KASSERT(sg_len > 0, ("sg_len <= 0"));
2464		}
2465
2466		len = sg_len;
2467
2468		/*
2469		 * Truncate to maximum data segment length.
2470		 */
2471		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2472		    ("ip_data_len %zd >= max_data_segment_length %zd",
2473		    response->ip_data_len, cs->cs_max_data_segment_length));
2474		if (response->ip_data_len + len >
2475		    cs->cs_max_data_segment_length) {
2476			len = cs->cs_max_data_segment_length -
2477			    response->ip_data_len;
2478			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2479			    len, sg_len));
2480		}
2481
2482		/*
2483		 * Truncate to expected data transfer length.
2484		 */
2485		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2486		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2487		    buffer_offset, response->ip_data_len, expected_len));
2488		if (buffer_offset + response->ip_data_len + len > expected_len) {
2489			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2490			    "to expected data transfer length %zd",
2491			    buffer_offset + response->ip_data_len + len, expected_len);
2492			len = expected_len - (buffer_offset + response->ip_data_len);
2493			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2494			    len, sg_len));
2495		}
2496
2497		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2498		if (error != 0) {
2499			CFISCSI_SESSION_WARN(cs, "failed to "
2500			    "allocate memory; dropping connection");
2501			icl_pdu_free(response);
2502			ctl_set_busy(&io->scsiio);
2503			io->scsiio.be_move_done(io);
2504			cfiscsi_session_terminate(cs);
2505			return;
2506		}
2507		sg_addr += len;
2508		sg_len -= len;
2509		io->scsiio.kern_data_resid -= len;
2510
2511		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2512		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2513		    buffer_offset, response->ip_data_len, expected_len));
2514		if (buffer_offset + response->ip_data_len == expected_len) {
2515			/*
2516			 * Already have the amount of data the initiator wanted.
2517			 */
2518			break;
2519		}
2520
2521		if (sg_len == 0) {
2522			/*
2523			 * End of scatter-gather segment;
2524			 * proceed to the next one...
2525			 */
2526			if (i == ctl_sg_count - 1) {
2527				/*
2528				 * ... unless this was the last one.
2529				 */
2530				break;
2531			}
2532			i++;
2533		}
2534
2535		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2536			/*
2537			 * Can't stuff more data into the current PDU;
2538			 * queue it.  Note that's not enough to check
2539			 * for kern_data_resid == 0 instead; there
2540			 * may be several Data-In PDUs for the final
2541			 * call to cfiscsi_datamove(), and we want
2542			 * to set the F flag only on the last of them.
2543			 */
2544			buffer_offset += response->ip_data_len;
2545			if (buffer_offset == io->scsiio.kern_total_len ||
2546			    buffer_offset == expected_len) {
2547				buffer_offset -= response->ip_data_len;
2548				break;
2549			}
2550			cfiscsi_pdu_queue(response);
2551			response = NULL;
2552			bhsdi = NULL;
2553		}
2554	}
2555	if (response != NULL) {
2556		buffer_offset += response->ip_data_len;
2557		if (buffer_offset == io->scsiio.kern_total_len ||
2558		    buffer_offset == expected_len) {
2559			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2560			if (io->io_hdr.status == CTL_SUCCESS) {
2561				bhsdi->bhsdi_flags |= BHSDI_FLAGS_S;
2562				if (PDU_TOTAL_TRANSFER_LEN(request) <
2563				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2564					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2565					bhsdi->bhsdi_residual_count =
2566					    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2567					    PDU_TOTAL_TRANSFER_LEN(request));
2568				} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2569				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2570					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2571					bhsdi->bhsdi_residual_count =
2572					    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2573					    ntohl(bhssc->bhssc_expected_data_transfer_length));
2574				}
2575				bhsdi->bhsdi_status = io->scsiio.scsi_status;
2576				io->io_hdr.flags |= CTL_FLAG_STATUS_SENT;
2577			}
2578		}
2579		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2580		cfiscsi_pdu_queue(response);
2581	}
2582
2583	io->scsiio.be_move_done(io);
2584}
2585
2586static void
2587cfiscsi_datamove_out(union ctl_io *io)
2588{
2589	struct cfiscsi_session *cs;
2590	struct icl_pdu *request, *response;
2591	const struct iscsi_bhs_scsi_command *bhssc;
2592	struct iscsi_bhs_r2t *bhsr2t;
2593	struct cfiscsi_data_wait *cdw;
2594	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2595	uint32_t expected_len, datamove_len, r2t_off, r2t_len;
2596	uint32_t target_transfer_tag;
2597	bool done;
2598
2599	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2600	cs = PDU_SESSION(request);
2601
2602	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2603	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2604	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2605	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2606
2607	/*
2608	 * We need to record it so that we can properly report
2609	 * underflow/underflow.
2610	 */
2611	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2612
2613	/*
2614	 * Complete write underflow.  Not a single byte to read.  Return.
2615	 */
2616	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2617	if (io->scsiio.kern_rel_offset >= expected_len) {
2618		io->scsiio.be_move_done(io);
2619		return;
2620	}
2621	datamove_len = MIN(io->scsiio.kern_data_len,
2622	    expected_len - io->scsiio.kern_rel_offset);
2623
2624	target_transfer_tag =
2625	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2626	cdw = cfiscsi_data_wait_new(cs, io, bhssc->bhssc_initiator_task_tag,
2627	    &target_transfer_tag);
2628	if (cdw == NULL) {
2629		CFISCSI_SESSION_WARN(cs, "failed to "
2630		    "allocate memory; dropping connection");
2631		ctl_set_busy(&io->scsiio);
2632		io->scsiio.be_move_done(io);
2633		cfiscsi_session_terminate(cs);
2634		return;
2635	}
2636#if 0
2637	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2638	    "task tag 0x%x, target transfer tag 0x%x",
2639	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2640#endif
2641
2642	cdw->cdw_ctl_io = io;
2643	cdw->cdw_target_transfer_tag = target_transfer_tag;
2644	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2645	cdw->cdw_r2t_end = datamove_len;
2646	cdw->cdw_datasn = 0;
2647
2648	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2649	if (io->scsiio.kern_sg_entries > 0) {
2650		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2651	} else {
2652		ctl_sglist = &ctl_sg_entry;
2653		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2654		ctl_sglist->len = datamove_len;
2655	}
2656	cdw->cdw_sg_index = 0;
2657	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2658	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2659	r2t_off = io->scsiio.ext_data_filled;
2660	while (r2t_off > 0) {
2661		if (r2t_off >= cdw->cdw_sg_len) {
2662			r2t_off -= cdw->cdw_sg_len;
2663			cdw->cdw_sg_index++;
2664			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2665			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2666			continue;
2667		}
2668		cdw->cdw_sg_addr += r2t_off;
2669		cdw->cdw_sg_len -= r2t_off;
2670		r2t_off = 0;
2671	}
2672
2673	if (cs->cs_immediate_data &&
2674	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2675	    icl_pdu_data_segment_length(request)) {
2676		done = cfiscsi_handle_data_segment(request, cdw);
2677		if (done) {
2678			cfiscsi_data_wait_free(cs, cdw);
2679			io->scsiio.be_move_done(io);
2680			return;
2681		}
2682	}
2683
2684	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2685	r2t_len = MIN(datamove_len - io->scsiio.ext_data_filled,
2686	    cs->cs_max_burst_length);
2687	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2688
2689	CFISCSI_SESSION_LOCK(cs);
2690	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2691	CFISCSI_SESSION_UNLOCK(cs);
2692
2693	/*
2694	 * XXX: We should limit the number of outstanding R2T PDUs
2695	 * 	per task to MaxOutstandingR2T.
2696	 */
2697	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2698	if (response == NULL) {
2699		CFISCSI_SESSION_WARN(cs, "failed to "
2700		    "allocate memory; dropping connection");
2701		ctl_set_busy(&io->scsiio);
2702		io->scsiio.be_move_done(io);
2703		cfiscsi_session_terminate(cs);
2704		return;
2705	}
2706	io->io_hdr.flags |= CTL_FLAG_DMA_INPROG;
2707	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2708	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2709	bhsr2t->bhsr2t_flags = 0x80;
2710	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2711	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2712	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2713	/*
2714	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2715	 *	be running concurrently on several CPUs for a given
2716	 *	command.
2717	 */
2718	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2719	PDU_R2TSN(request)++;
2720	/*
2721	 * This is the offset within the current SCSI command;
2722	 * i.e. for the first call of datamove(), it will be 0,
2723	 * and for subsequent ones it will be the sum of lengths
2724	 * of previous ones.
2725	 *
2726	 * The ext_data_filled is to account for unsolicited
2727	 * (immediate) data that might have already arrived.
2728	 */
2729	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2730	/*
2731	 * This is the total length (sum of S/G lengths) this call
2732	 * to cfiscsi_datamove() is supposed to handle, limited by
2733	 * MaxBurstLength.
2734	 */
2735	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2736	cfiscsi_pdu_queue(response);
2737}
2738
2739static void
2740cfiscsi_datamove(union ctl_io *io)
2741{
2742
2743	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2744		cfiscsi_datamove_in(io);
2745	else {
2746		/* We hadn't received anything during this datamove yet. */
2747		io->scsiio.ext_data_filled = 0;
2748		cfiscsi_datamove_out(io);
2749	}
2750}
2751
2752static void
2753cfiscsi_scsi_command_done(union ctl_io *io)
2754{
2755	struct icl_pdu *request, *response;
2756	struct iscsi_bhs_scsi_command *bhssc;
2757	struct iscsi_bhs_scsi_response *bhssr;
2758#ifdef DIAGNOSTIC
2759	struct cfiscsi_data_wait *cdw;
2760#endif
2761	struct cfiscsi_session *cs;
2762	uint16_t sense_length;
2763
2764	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2765	cs = PDU_SESSION(request);
2766	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2767	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2768	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2769	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2770
2771	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2772	//    bhssc->bhssc_initiator_task_tag);
2773
2774#ifdef DIAGNOSTIC
2775	CFISCSI_SESSION_LOCK(cs);
2776	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2777		KASSERT(bhssc->bhssc_initiator_task_tag !=
2778		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2779	CFISCSI_SESSION_UNLOCK(cs);
2780#endif
2781
2782	/*
2783	 * Do not return status for aborted commands.
2784	 * There are exceptions, but none supported by CTL yet.
2785	 */
2786	if (((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2787	     (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) ||
2788	    (io->io_hdr.flags & CTL_FLAG_STATUS_SENT)) {
2789		ctl_free_io(io);
2790		icl_pdu_free(request);
2791		return;
2792	}
2793
2794	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2795	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2796	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2797	bhssr->bhssr_flags = 0x80;
2798	/*
2799	 * XXX: We don't deal with bidirectional under/overflows;
2800	 *	does anything actually support those?
2801	 */
2802	if (PDU_TOTAL_TRANSFER_LEN(request) <
2803	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2804		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2805		bhssr->bhssr_residual_count =
2806		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2807		    PDU_TOTAL_TRANSFER_LEN(request));
2808		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2809		//    ntohl(bhssr->bhssr_residual_count));
2810	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2811	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2812		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2813		bhssr->bhssr_residual_count =
2814		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2815		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2816		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2817		//    ntohl(bhssr->bhssr_residual_count));
2818	}
2819	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2820	bhssr->bhssr_status = io->scsiio.scsi_status;
2821	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2822	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2823
2824	if (io->scsiio.sense_len > 0) {
2825#if 0
2826		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2827		    io->scsiio.sense_len);
2828#endif
2829		sense_length = htons(io->scsiio.sense_len);
2830		icl_pdu_append_data(response,
2831		    &sense_length, sizeof(sense_length), M_WAITOK);
2832		icl_pdu_append_data(response,
2833		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2834	}
2835
2836	ctl_free_io(io);
2837	icl_pdu_free(request);
2838	cfiscsi_pdu_queue(response);
2839}
2840
2841static void
2842cfiscsi_task_management_done(union ctl_io *io)
2843{
2844	struct icl_pdu *request, *response;
2845	struct iscsi_bhs_task_management_request *bhstmr;
2846	struct iscsi_bhs_task_management_response *bhstmr2;
2847	struct cfiscsi_data_wait *cdw, *tmpcdw;
2848	struct cfiscsi_session *cs, *tcs;
2849	struct cfiscsi_softc *softc;
2850	int cold_reset = 0;
2851
2852	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2853	cs = PDU_SESSION(request);
2854	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2855	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2856	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2857	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2858
2859#if 0
2860	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2861	    bhstmr->bhstmr_initiator_task_tag,
2862	    bhstmr->bhstmr_referenced_task_tag);
2863#endif
2864
2865	if ((bhstmr->bhstmr_function & ~0x80) ==
2866	    BHSTMR_FUNCTION_ABORT_TASK) {
2867		/*
2868		 * Make sure we no longer wait for Data-Out for this command.
2869		 */
2870		CFISCSI_SESSION_LOCK(cs);
2871		TAILQ_FOREACH_SAFE(cdw,
2872		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2873			if (bhstmr->bhstmr_referenced_task_tag !=
2874			    cdw->cdw_initiator_task_tag)
2875				continue;
2876
2877#if 0
2878			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2879			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2880#endif
2881			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2882			    cdw, cdw_next);
2883			io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
2884			cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 43;
2885			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2886			cfiscsi_data_wait_free(cs, cdw);
2887		}
2888		CFISCSI_SESSION_UNLOCK(cs);
2889	}
2890	if ((bhstmr->bhstmr_function & ~0x80) ==
2891	    BHSTMR_FUNCTION_TARGET_COLD_RESET &&
2892	    io->io_hdr.status == CTL_SUCCESS)
2893		cold_reset = 1;
2894
2895	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2896	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2897	    response->ip_bhs;
2898	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2899	bhstmr2->bhstmr_flags = 0x80;
2900	switch (io->taskio.task_status) {
2901	case CTL_TASK_FUNCTION_COMPLETE:
2902		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2903		break;
2904	case CTL_TASK_FUNCTION_SUCCEEDED:
2905		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_SUCCEEDED;
2906		break;
2907	case CTL_TASK_LUN_DOES_NOT_EXIST:
2908		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_LUN_DOES_NOT_EXIST;
2909		break;
2910	case CTL_TASK_FUNCTION_NOT_SUPPORTED:
2911	default:
2912		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2913		break;
2914	}
2915	memcpy(bhstmr2->bhstmr_additional_reponse_information,
2916	    io->taskio.task_resp, sizeof(io->taskio.task_resp));
2917	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2918
2919	ctl_free_io(io);
2920	icl_pdu_free(request);
2921	cfiscsi_pdu_queue(response);
2922
2923	if (cold_reset) {
2924		softc = cs->cs_target->ct_softc;
2925		mtx_lock(&softc->lock);
2926		TAILQ_FOREACH(tcs, &softc->sessions, cs_next) {
2927			if (tcs->cs_target == cs->cs_target)
2928				cfiscsi_session_terminate(tcs);
2929		}
2930		mtx_unlock(&softc->lock);
2931	}
2932}
2933
2934static void
2935cfiscsi_done(union ctl_io *io)
2936{
2937	struct icl_pdu *request;
2938	struct cfiscsi_session *cs;
2939
2940	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2941		("invalid CTL status %#x", io->io_hdr.status));
2942
2943	if (io->io_hdr.io_type == CTL_IO_TASK &&
2944	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
2945		/*
2946		 * Implicit task termination has just completed; nothing to do.
2947		 */
2948		cs = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2949		cs->cs_tasks_aborted = true;
2950		refcount_release(&cs->cs_outstanding_ctl_pdus);
2951		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
2952		ctl_free_io(io);
2953		return;
2954	}
2955
2956	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2957	cs = PDU_SESSION(request);
2958	refcount_release(&cs->cs_outstanding_ctl_pdus);
2959
2960	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2961	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2962		cfiscsi_scsi_command_done(io);
2963		break;
2964	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2965		cfiscsi_task_management_done(io);
2966		break;
2967	default:
2968		panic("cfiscsi_done called with wrong opcode 0x%x",
2969		    request->ip_bhs->bhs_opcode);
2970	}
2971}
2972