xref: /freebsd/lib/libnvmf/nvmf_tcp.c (revision 7937bfbc0ca53fe7cdd0d54414f9296e273a518e)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2022-2024 Chelsio Communications, Inc.
5  * Written by: John Baldwin <jhb@FreeBSD.org>
6  */
7 
8 #include <sys/endian.h>
9 #include <sys/gsb_crc32.h>
10 #include <sys/queue.h>
11 #include <sys/uio.h>
12 #include <assert.h>
13 #include <errno.h>
14 #include <stdio.h>
15 #include <stdlib.h>
16 #include <string.h>
17 #include <unistd.h>
18 
19 #include "libnvmf.h"
20 #include "internal.h"
21 #include "nvmf_tcp.h"
22 
23 struct nvmf_tcp_qpair;
24 
25 struct nvmf_tcp_command_buffer {
26 	struct nvmf_tcp_qpair *qp;
27 
28 	void	*data;
29 	size_t	data_len;
30 	size_t	data_xfered;
31 	uint32_t data_offset;
32 
33 	uint16_t cid;
34 	uint16_t ttag;
35 
36 	LIST_ENTRY(nvmf_tcp_command_buffer) link;
37 };
38 
39 LIST_HEAD(nvmf_tcp_command_buffer_list, nvmf_tcp_command_buffer);
40 
41 struct nvmf_tcp_association {
42 	struct nvmf_association na;
43 
44 	uint32_t ioccsz;
45 };
46 
47 struct nvmf_tcp_rxpdu {
48 	struct nvme_tcp_common_pdu_hdr *hdr;
49 	uint32_t data_len;
50 };
51 
52 struct nvmf_tcp_capsule {
53 	struct nvmf_capsule nc;
54 
55 	struct nvmf_tcp_rxpdu rx_pdu;
56 	struct nvmf_tcp_command_buffer *cb;
57 
58 	TAILQ_ENTRY(nvmf_tcp_capsule) link;
59 };
60 
61 struct nvmf_tcp_qpair {
62 	struct nvmf_qpair qp;
63 	int s;
64 
65 	uint8_t	txpda;
66 	uint8_t rxpda;
67 	bool header_digests;
68 	bool data_digests;
69 	uint32_t maxr2t;
70 	uint32_t maxh2cdata;
71 	uint32_t max_icd;	/* Host only */
72 	uint16_t next_ttag;	/* Controller only */
73 
74 	struct nvmf_tcp_command_buffer_list tx_buffers;
75 	struct nvmf_tcp_command_buffer_list rx_buffers;
76 	TAILQ_HEAD(, nvmf_tcp_capsule) rx_capsules;
77 };
78 
79 #define	TASSOC(nc)	((struct nvmf_tcp_association *)(na))
80 #define	TCAP(nc)	((struct nvmf_tcp_capsule *)(nc))
81 #define	CTCAP(nc)	((const struct nvmf_tcp_capsule *)(nc))
82 #define	TQP(qp)		((struct nvmf_tcp_qpair *)(qp))
83 
84 static const char zero_padding[NVME_TCP_PDU_PDO_MAX_OFFSET];
85 
86 static uint32_t
87 compute_digest(const void *buf, size_t len)
88 {
89 	return (calculate_crc32c(0xffffffff, buf, len) ^ 0xffffffff);
90 }
91 
92 static struct nvmf_tcp_command_buffer *
93 tcp_alloc_command_buffer(struct nvmf_tcp_qpair *qp, void *data,
94     uint32_t data_offset, size_t data_len, uint16_t cid, uint16_t ttag,
95     bool receive)
96 {
97 	struct nvmf_tcp_command_buffer *cb;
98 
99 	cb = malloc(sizeof(*cb));
100 	cb->qp = qp;
101 	cb->data = data;
102 	cb->data_offset = data_offset;
103 	cb->data_len = data_len;
104 	cb->data_xfered = 0;
105 	cb->cid = cid;
106 	cb->ttag = ttag;
107 
108 	if (receive)
109 		LIST_INSERT_HEAD(&qp->rx_buffers, cb, link);
110 	else
111 		LIST_INSERT_HEAD(&qp->tx_buffers, cb, link);
112 	return (cb);
113 }
114 
115 static struct nvmf_tcp_command_buffer *
116 tcp_find_command_buffer(struct nvmf_tcp_qpair *qp, uint16_t cid, uint16_t ttag,
117     bool receive)
118 {
119 	struct nvmf_tcp_command_buffer_list *list;
120 	struct nvmf_tcp_command_buffer *cb;
121 
122 	list = receive ? &qp->rx_buffers : &qp->tx_buffers;
123 	LIST_FOREACH(cb, list, link) {
124 		if (cb->cid == cid && cb->ttag == ttag)
125 			return (cb);
126 	}
127 	return (NULL);
128 }
129 
130 static void
131 tcp_purge_command_buffer(struct nvmf_tcp_qpair *qp, uint16_t cid, uint16_t ttag,
132     bool receive)
133 {
134 	struct nvmf_tcp_command_buffer *cb;
135 
136 	cb = tcp_find_command_buffer(qp, cid, ttag, receive);
137 	if (cb != NULL)
138 		LIST_REMOVE(cb, link);
139 }
140 
141 static void
142 tcp_free_command_buffer(struct nvmf_tcp_command_buffer *cb)
143 {
144 	LIST_REMOVE(cb, link);
145 	free(cb);
146 }
147 
148 static int
149 nvmf_tcp_write_pdu(struct nvmf_tcp_qpair *qp, const void *pdu, size_t len)
150 {
151 	ssize_t nwritten;
152 	const char *cp;
153 
154 	cp = pdu;
155 	while (len != 0) {
156 		nwritten = write(qp->s, cp, len);
157 		if (nwritten < 0)
158 			return (errno);
159 		len -= nwritten;
160 		cp += nwritten;
161 	}
162 	return (0);
163 }
164 
165 static int
166 nvmf_tcp_write_pdu_iov(struct nvmf_tcp_qpair *qp, struct iovec *iov,
167     u_int iovcnt, size_t len)
168 {
169 	ssize_t nwritten;
170 
171 	for (;;) {
172 		nwritten = writev(qp->s, iov, iovcnt);
173 		if (nwritten < 0)
174 			return (errno);
175 
176 		len -= nwritten;
177 		if (len == 0)
178 			return (0);
179 
180 		while (iov->iov_len <= (size_t)nwritten) {
181 			nwritten -= iov->iov_len;
182 			iovcnt--;
183 			iov++;
184 		}
185 
186 		iov->iov_base = (char *)iov->iov_base + nwritten;
187 		iov->iov_len -= nwritten;
188 	}
189 }
190 
191 static void
192 nvmf_tcp_report_error(struct nvmf_association *na, struct nvmf_tcp_qpair *qp,
193     uint16_t fes, uint32_t fei, const void *rx_pdu, size_t pdu_len, u_int hlen)
194 {
195 	struct nvme_tcp_term_req_hdr hdr;
196 	struct iovec iov[2];
197 
198 	if (hlen != 0) {
199 		if (hlen > NVME_TCP_TERM_REQ_ERROR_DATA_MAX_SIZE)
200 			hlen = NVME_TCP_TERM_REQ_ERROR_DATA_MAX_SIZE;
201 		if (hlen > pdu_len)
202 			hlen = pdu_len;
203 	}
204 
205 	memset(&hdr, 0, sizeof(hdr));
206 	hdr.common.pdu_type = na->na_controller ?
207 	    NVME_TCP_PDU_TYPE_C2H_TERM_REQ : NVME_TCP_PDU_TYPE_H2C_TERM_REQ;
208 	hdr.common.hlen = sizeof(hdr);
209 	hdr.common.plen = sizeof(hdr) + hlen;
210 	hdr.fes = htole16(fes);
211 	le32enc(hdr.fei, fei);
212 	iov[0].iov_base = &hdr;
213 	iov[0].iov_len = sizeof(hdr);
214 	iov[1].iov_base = __DECONST(void *, rx_pdu);
215 	iov[1].iov_len = hlen;
216 
217 	(void)nvmf_tcp_write_pdu_iov(qp, iov, nitems(iov), sizeof(hdr) + hlen);
218 	close(qp->s);
219 	qp->s = -1;
220 }
221 
222 static int
223 nvmf_tcp_validate_pdu(struct nvmf_tcp_qpair *qp, struct nvmf_tcp_rxpdu *pdu,
224     size_t pdu_len)
225 {
226 	const struct nvme_tcp_common_pdu_hdr *ch;
227 	uint32_t data_len, fei, plen;
228 	uint32_t digest, rx_digest;
229 	u_int hlen;
230 	int error;
231 	uint16_t fes;
232 
233 	/* Determine how large of a PDU header to return for errors. */
234 	ch = pdu->hdr;
235 	hlen = ch->hlen;
236 	plen = le32toh(ch->plen);
237 	if (hlen < sizeof(*ch) || hlen > plen)
238 		hlen = sizeof(*ch);
239 
240 	error = nvmf_tcp_validate_pdu_header(ch,
241 	    qp->qp.nq_association->na_controller, qp->header_digests,
242 	    qp->data_digests, qp->rxpda, &data_len, &fes, &fei);
243 	if (error != 0) {
244 		if (error == ECONNRESET) {
245 			close(qp->s);
246 			qp->s = -1;
247 		} else {
248 			nvmf_tcp_report_error(qp->qp.nq_association, qp,
249 			    fes, fei, ch, pdu_len, hlen);
250 		}
251 		return (error);
252 	}
253 
254 	/* Check header digest if present. */
255 	if ((ch->flags & NVME_TCP_CH_FLAGS_HDGSTF) != 0) {
256 		digest = compute_digest(ch, ch->hlen);
257 		memcpy(&rx_digest, (const char *)ch + ch->hlen,
258 		    sizeof(rx_digest));
259 		if (digest != rx_digest) {
260 			printf("NVMe/TCP: Header digest mismatch\n");
261 			nvmf_tcp_report_error(qp->qp.nq_association, qp,
262 			    NVME_TCP_TERM_REQ_FES_HDGST_ERROR, rx_digest, ch,
263 			    pdu_len, hlen);
264 			return (EBADMSG);
265 		}
266 	}
267 
268 	/* Check data digest if present. */
269 	if ((ch->flags & NVME_TCP_CH_FLAGS_DDGSTF) != 0) {
270 		digest = compute_digest((const char *)ch + ch->pdo, data_len);
271 		memcpy(&rx_digest, (const char *)ch + plen - sizeof(rx_digest),
272 		    sizeof(rx_digest));
273 		if (digest != rx_digest) {
274 			printf("NVMe/TCP: Data digest mismatch\n");
275 			return (EBADMSG);
276 		}
277 	}
278 
279 	pdu->data_len = data_len;
280 	return (0);
281 }
282 
283 /*
284  * Read data from a socket, retrying until the data has been fully
285  * read or an error occurs.
286  */
287 static int
288 nvmf_tcp_read_buffer(int s, void *buf, size_t len)
289 {
290 	ssize_t nread;
291 	char *cp;
292 
293 	cp = buf;
294 	while (len != 0) {
295 		nread = read(s, cp, len);
296 		if (nread < 0)
297 			return (errno);
298 		if (nread == 0)
299 			return (ECONNRESET);
300 		len -= nread;
301 		cp += nread;
302 	}
303 	return (0);
304 }
305 
306 static int
307 nvmf_tcp_read_pdu(struct nvmf_tcp_qpair *qp, struct nvmf_tcp_rxpdu *pdu)
308 {
309 	struct nvme_tcp_common_pdu_hdr ch;
310 	uint32_t plen;
311 	int error;
312 
313 	memset(pdu, 0, sizeof(*pdu));
314 	error = nvmf_tcp_read_buffer(qp->s, &ch, sizeof(ch));
315 	if (error != 0)
316 		return (error);
317 
318 	plen = le32toh(ch.plen);
319 
320 	/*
321 	 * Validate a header with garbage lengths to trigger
322 	 * an error message without reading more.
323 	 */
324 	if (plen < sizeof(ch) || ch.hlen > plen) {
325 		pdu->hdr = &ch;
326 		error = nvmf_tcp_validate_pdu(qp, pdu, sizeof(ch));
327 		pdu->hdr = NULL;
328 		assert(error != 0);
329 		return (error);
330 	}
331 
332 	/* Read the rest of the PDU. */
333 	pdu->hdr = malloc(plen);
334 	memcpy(pdu->hdr, &ch, sizeof(ch));
335 	error = nvmf_tcp_read_buffer(qp->s, pdu->hdr + 1, plen - sizeof(ch));
336 	if (error != 0)
337 		return (error);
338 	error = nvmf_tcp_validate_pdu(qp, pdu, plen);
339 	if (error != 0) {
340 		free(pdu->hdr);
341 		pdu->hdr = NULL;
342 	}
343 	return (error);
344 }
345 
346 static void
347 nvmf_tcp_free_pdu(struct nvmf_tcp_rxpdu *pdu)
348 {
349 	free(pdu->hdr);
350 	pdu->hdr = NULL;
351 }
352 
353 static int
354 nvmf_tcp_handle_term_req(struct nvmf_tcp_rxpdu *pdu)
355 {
356 	struct nvme_tcp_term_req_hdr *hdr;
357 
358 	hdr = (void *)pdu->hdr;
359 
360 	printf("NVMe/TCP: Received termination request: fes %#x fei %#x\n",
361 	    le16toh(hdr->fes), le32dec(hdr->fei));
362 	nvmf_tcp_free_pdu(pdu);
363 	return (ECONNRESET);
364 }
365 
366 static int
367 nvmf_tcp_save_command_capsule(struct nvmf_tcp_qpair *qp,
368     struct nvmf_tcp_rxpdu *pdu)
369 {
370 	struct nvme_tcp_cmd *cmd;
371 	struct nvmf_capsule *nc;
372 	struct nvmf_tcp_capsule *tc;
373 
374 	cmd = (void *)pdu->hdr;
375 
376 	nc = nvmf_allocate_command(&qp->qp, &cmd->ccsqe);
377 	if (nc == NULL)
378 		return (ENOMEM);
379 
380 	tc = TCAP(nc);
381 	tc->rx_pdu = *pdu;
382 
383 	TAILQ_INSERT_TAIL(&qp->rx_capsules, tc, link);
384 	return (0);
385 }
386 
387 static int
388 nvmf_tcp_save_response_capsule(struct nvmf_tcp_qpair *qp,
389     struct nvmf_tcp_rxpdu *pdu)
390 {
391 	struct nvme_tcp_rsp *rsp;
392 	struct nvmf_capsule *nc;
393 	struct nvmf_tcp_capsule *tc;
394 
395 	rsp = (void *)pdu->hdr;
396 
397 	nc = nvmf_allocate_response(&qp->qp, &rsp->rccqe);
398 	if (nc == NULL)
399 		return (ENOMEM);
400 
401 	nc->nc_sqhd_valid = true;
402 	tc = TCAP(nc);
403 	tc->rx_pdu = *pdu;
404 
405 	TAILQ_INSERT_TAIL(&qp->rx_capsules, tc, link);
406 
407 	/*
408 	 * Once the CQE has been received, no further transfers to the
409 	 * command buffer for the associated CID can occur.
410 	 */
411 	tcp_purge_command_buffer(qp, rsp->rccqe.cid, 0, true);
412 	tcp_purge_command_buffer(qp, rsp->rccqe.cid, 0, false);
413 
414 	return (0);
415 }
416 
417 /*
418  * Construct and send a PDU that contains an optional data payload.
419  * This includes dealing with digests and the length fields in the
420  * common header.
421  */
422 static int
423 nvmf_tcp_construct_pdu(struct nvmf_tcp_qpair *qp, void *hdr, size_t hlen,
424     void *data, uint32_t data_len)
425 {
426 	struct nvme_tcp_common_pdu_hdr *ch;
427 	struct iovec iov[5];
428 	u_int iovcnt;
429 	uint32_t header_digest, data_digest, pad, pdo, plen;
430 
431 	plen = hlen;
432 	if (qp->header_digests)
433 		plen += sizeof(header_digest);
434 	if (data_len != 0) {
435 		pdo = roundup2(plen, qp->txpda);
436 		pad = pdo - plen;
437 		plen = pdo + data_len;
438 		if (qp->data_digests)
439 			plen += sizeof(data_digest);
440 	} else {
441 		assert(data == NULL);
442 		pdo = 0;
443 		pad = 0;
444 	}
445 
446 	ch = hdr;
447 	ch->hlen = hlen;
448 	if (qp->header_digests)
449 		ch->flags |= NVME_TCP_CH_FLAGS_HDGSTF;
450 	if (qp->data_digests && data_len != 0)
451 		ch->flags |= NVME_TCP_CH_FLAGS_DDGSTF;
452 	ch->pdo = pdo;
453 	ch->plen = htole32(plen);
454 
455 	/* CH + PSH */
456 	iov[0].iov_base = hdr;
457 	iov[0].iov_len = hlen;
458 	iovcnt = 1;
459 
460 	/* HDGST */
461 	if (qp->header_digests) {
462 		header_digest = compute_digest(hdr, hlen);
463 		iov[iovcnt].iov_base = &header_digest;
464 		iov[iovcnt].iov_len = sizeof(header_digest);
465 		iovcnt++;
466 	}
467 
468 	if (pad != 0) {
469 		/* PAD */
470 		iov[iovcnt].iov_base = __DECONST(char *, zero_padding);
471 		iov[iovcnt].iov_len = pad;
472 		iovcnt++;
473 	}
474 
475 	if (data_len != 0) {
476 		/* DATA */
477 		iov[iovcnt].iov_base = data;
478 		iov[iovcnt].iov_len = data_len;
479 		iovcnt++;
480 
481 		/* DDGST */
482 		if (qp->data_digests) {
483 			data_digest = compute_digest(data, data_len);
484 			iov[iovcnt].iov_base = &data_digest;
485 			iov[iovcnt].iov_len = sizeof(data_digest);
486 			iovcnt++;
487 		}
488 	}
489 
490 	return (nvmf_tcp_write_pdu_iov(qp, iov, iovcnt, plen));
491 }
492 
493 static int
494 nvmf_tcp_handle_h2c_data(struct nvmf_tcp_qpair *qp, struct nvmf_tcp_rxpdu *pdu)
495 {
496 	struct nvme_tcp_h2c_data_hdr *h2c;
497 	struct nvmf_tcp_command_buffer *cb;
498 	uint32_t data_len, data_offset;
499 	const char *icd;
500 
501 	h2c = (void *)pdu->hdr;
502 	if (le32toh(h2c->datal) > qp->maxh2cdata) {
503 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
504 		    NVME_TCP_TERM_REQ_FES_DATA_TRANSFER_LIMIT_EXCEEDED, 0,
505 		    pdu->hdr, le32toh(pdu->hdr->plen), pdu->hdr->hlen);
506 		nvmf_tcp_free_pdu(pdu);
507 		return (EBADMSG);
508 	}
509 
510 	cb = tcp_find_command_buffer(qp, h2c->cccid, h2c->ttag, true);
511 	if (cb == NULL) {
512 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
513 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD,
514 		    offsetof(struct nvme_tcp_h2c_data_hdr, ttag), pdu->hdr,
515 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
516 		nvmf_tcp_free_pdu(pdu);
517 		return (EBADMSG);
518 	}
519 
520 	data_len = le32toh(h2c->datal);
521 	if (data_len != pdu->data_len) {
522 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
523 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD,
524 		    offsetof(struct nvme_tcp_h2c_data_hdr, datal), pdu->hdr,
525 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
526 		nvmf_tcp_free_pdu(pdu);
527 		return (EBADMSG);
528 	}
529 
530 	data_offset = le32toh(h2c->datao);
531 	if (data_offset < cb->data_offset ||
532 	    data_offset + data_len > cb->data_offset + cb->data_len) {
533 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
534 		    NVME_TCP_TERM_REQ_FES_DATA_TRANSFER_OUT_OF_RANGE, 0,
535 		    pdu->hdr, le32toh(pdu->hdr->plen), pdu->hdr->hlen);
536 		nvmf_tcp_free_pdu(pdu);
537 		return (EBADMSG);
538 	}
539 
540 	if (data_offset != cb->data_offset + cb->data_xfered) {
541 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
542 		    NVME_TCP_TERM_REQ_FES_PDU_SEQUENCE_ERROR, 0, pdu->hdr,
543 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
544 		nvmf_tcp_free_pdu(pdu);
545 		return (EBADMSG);
546 	}
547 
548 	if ((cb->data_xfered + data_len == cb->data_len) !=
549 	    ((pdu->hdr->flags & NVME_TCP_H2C_DATA_FLAGS_LAST_PDU) != 0)) {
550 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
551 		    NVME_TCP_TERM_REQ_FES_PDU_SEQUENCE_ERROR, 0, pdu->hdr,
552 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
553 		nvmf_tcp_free_pdu(pdu);
554 		return (EBADMSG);
555 	}
556 
557 	cb->data_xfered += data_len;
558 	data_offset -= cb->data_offset;
559 	icd = (const char *)pdu->hdr + pdu->hdr->pdo;
560 	memcpy((char *)cb->data + data_offset, icd, data_len);
561 
562 	nvmf_tcp_free_pdu(pdu);
563 	return (0);
564 }
565 
566 static int
567 nvmf_tcp_handle_c2h_data(struct nvmf_tcp_qpair *qp, struct nvmf_tcp_rxpdu *pdu)
568 {
569 	struct nvme_tcp_c2h_data_hdr *c2h;
570 	struct nvmf_tcp_command_buffer *cb;
571 	uint32_t data_len, data_offset;
572 	const char *icd;
573 
574 	c2h = (void *)pdu->hdr;
575 
576 	cb = tcp_find_command_buffer(qp, c2h->cccid, 0, true);
577 	if (cb == NULL) {
578 		/*
579 		 * XXX: Could be PDU sequence error if cccid is for a
580 		 * command that doesn't use a command buffer.
581 		 */
582 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
583 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD,
584 		    offsetof(struct nvme_tcp_c2h_data_hdr, cccid), pdu->hdr,
585 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
586 		nvmf_tcp_free_pdu(pdu);
587 		return (EBADMSG);
588 	}
589 
590 	data_len = le32toh(c2h->datal);
591 	if (data_len != pdu->data_len) {
592 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
593 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD,
594 		    offsetof(struct nvme_tcp_c2h_data_hdr, datal), pdu->hdr,
595 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
596 		nvmf_tcp_free_pdu(pdu);
597 		return (EBADMSG);
598 	}
599 
600 	data_offset = le32toh(c2h->datao);
601 	if (data_offset < cb->data_offset ||
602 	    data_offset + data_len > cb->data_offset + cb->data_len) {
603 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
604 		    NVME_TCP_TERM_REQ_FES_DATA_TRANSFER_OUT_OF_RANGE, 0,
605 		    pdu->hdr, le32toh(pdu->hdr->plen), pdu->hdr->hlen);
606 		nvmf_tcp_free_pdu(pdu);
607 		return (EBADMSG);
608 	}
609 
610 	if (data_offset != cb->data_offset + cb->data_xfered) {
611 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
612 		    NVME_TCP_TERM_REQ_FES_PDU_SEQUENCE_ERROR, 0, pdu->hdr,
613 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
614 		nvmf_tcp_free_pdu(pdu);
615 		return (EBADMSG);
616 	}
617 
618 	if ((cb->data_xfered + data_len == cb->data_len) !=
619 	    ((pdu->hdr->flags & NVME_TCP_C2H_DATA_FLAGS_LAST_PDU) != 0)) {
620 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
621 		    NVME_TCP_TERM_REQ_FES_PDU_SEQUENCE_ERROR, 0, pdu->hdr,
622 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
623 		nvmf_tcp_free_pdu(pdu);
624 		return (EBADMSG);
625 	}
626 
627 	cb->data_xfered += data_len;
628 	data_offset -= cb->data_offset;
629 	icd = (const char *)pdu->hdr + pdu->hdr->pdo;
630 	memcpy((char *)cb->data + data_offset, icd, data_len);
631 
632 	if ((pdu->hdr->flags & NVME_TCP_C2H_DATA_FLAGS_SUCCESS) != 0) {
633 		struct nvme_completion cqe;
634 		struct nvmf_tcp_capsule *tc;
635 		struct nvmf_capsule *nc;
636 
637 		memset(&cqe, 0, sizeof(cqe));
638 		cqe.cid = cb->cid;
639 
640 		nc = nvmf_allocate_response(&qp->qp, &cqe);
641 		if (nc == NULL) {
642 			nvmf_tcp_free_pdu(pdu);
643 			return (ENOMEM);
644 		}
645 		nc->nc_sqhd_valid = false;
646 
647 		tc = TCAP(nc);
648 		TAILQ_INSERT_TAIL(&qp->rx_capsules, tc, link);
649 	}
650 
651 	nvmf_tcp_free_pdu(pdu);
652 	return (0);
653 }
654 
655 /* NB: cid and ttag and little-endian already. */
656 static int
657 tcp_send_h2c_pdu(struct nvmf_tcp_qpair *qp, uint16_t cid, uint16_t ttag,
658     uint32_t data_offset, void *buf, size_t len, bool last_pdu)
659 {
660 	struct nvme_tcp_h2c_data_hdr h2c;
661 
662 	memset(&h2c, 0, sizeof(h2c));
663 	h2c.common.pdu_type = NVME_TCP_PDU_TYPE_H2C_DATA;
664 	if (last_pdu)
665 		h2c.common.flags |= NVME_TCP_H2C_DATA_FLAGS_LAST_PDU;
666 	h2c.cccid = cid;
667 	h2c.ttag = ttag;
668 	h2c.datao = htole32(data_offset);
669 	h2c.datal = htole32(len);
670 
671 	return (nvmf_tcp_construct_pdu(qp, &h2c, sizeof(h2c), buf, len));
672 }
673 
674 /* Sends one or more H2C_DATA PDUs, subject to MAXH2CDATA. */
675 static int
676 tcp_send_h2c_pdus(struct nvmf_tcp_qpair *qp, uint16_t cid, uint16_t ttag,
677     uint32_t data_offset, void *buf, size_t len, bool last_pdu)
678 {
679 	char *p;
680 
681 	p = buf;
682 	while (len != 0) {
683 		size_t todo;
684 		int error;
685 
686 		todo = len;
687 		if (todo > qp->maxh2cdata)
688 			todo = qp->maxh2cdata;
689 		error = tcp_send_h2c_pdu(qp, cid, ttag, data_offset, p, todo,
690 		    last_pdu && todo == len);
691 		if (error != 0)
692 			return (error);
693 		p += todo;
694 		len -= todo;
695 	}
696 	return (0);
697 }
698 
699 static int
700 nvmf_tcp_handle_r2t(struct nvmf_tcp_qpair *qp, struct nvmf_tcp_rxpdu *pdu)
701 {
702 	struct nvmf_tcp_command_buffer *cb;
703 	struct nvme_tcp_r2t_hdr *r2t;
704 	uint32_t data_len, data_offset;
705 	int error;
706 
707 	r2t = (void *)pdu->hdr;
708 
709 	cb = tcp_find_command_buffer(qp, r2t->cccid, 0, false);
710 	if (cb == NULL) {
711 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
712 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD,
713 		    offsetof(struct nvme_tcp_r2t_hdr, cccid), pdu->hdr,
714 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
715 		nvmf_tcp_free_pdu(pdu);
716 		return (EBADMSG);
717 	}
718 
719 	data_offset = le32toh(r2t->r2to);
720 	if (data_offset != cb->data_xfered) {
721 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
722 		    NVME_TCP_TERM_REQ_FES_PDU_SEQUENCE_ERROR, 0, pdu->hdr,
723 		    le32toh(pdu->hdr->plen), pdu->hdr->hlen);
724 		nvmf_tcp_free_pdu(pdu);
725 		return (EBADMSG);
726 	}
727 
728 	/*
729 	 * XXX: The spec does not specify how to handle R2T tranfers
730 	 * out of range of the original command.
731 	 */
732 	data_len = le32toh(r2t->r2tl);
733 	if (data_offset + data_len > cb->data_len) {
734 		nvmf_tcp_report_error(qp->qp.nq_association, qp,
735 		    NVME_TCP_TERM_REQ_FES_DATA_TRANSFER_OUT_OF_RANGE, 0,
736 		    pdu->hdr, le32toh(pdu->hdr->plen), pdu->hdr->hlen);
737 		nvmf_tcp_free_pdu(pdu);
738 		return (EBADMSG);
739 	}
740 
741 	cb->data_xfered += data_len;
742 
743 	/*
744 	 * Write out one or more H2C_DATA PDUs containing the
745 	 * requested data.
746 	 */
747 	error = tcp_send_h2c_pdus(qp, r2t->cccid, r2t->ttag,
748 	    data_offset, (char *)cb->data + data_offset, data_len, true);
749 
750 	nvmf_tcp_free_pdu(pdu);
751 	return (error);
752 }
753 
754 static int
755 nvmf_tcp_receive_pdu(struct nvmf_tcp_qpair *qp)
756 {
757 	struct nvmf_tcp_rxpdu pdu;
758 	int error;
759 
760 	error = nvmf_tcp_read_pdu(qp, &pdu);
761 	if (error != 0)
762 		return (error);
763 
764 	switch (pdu.hdr->pdu_type) {
765 	default:
766 		__unreachable();
767 		break;
768 	case NVME_TCP_PDU_TYPE_H2C_TERM_REQ:
769 	case NVME_TCP_PDU_TYPE_C2H_TERM_REQ:
770 		return (nvmf_tcp_handle_term_req(&pdu));
771 	case NVME_TCP_PDU_TYPE_CAPSULE_CMD:
772 		return (nvmf_tcp_save_command_capsule(qp, &pdu));
773 	case NVME_TCP_PDU_TYPE_CAPSULE_RESP:
774 		return (nvmf_tcp_save_response_capsule(qp, &pdu));
775 	case NVME_TCP_PDU_TYPE_H2C_DATA:
776 		return (nvmf_tcp_handle_h2c_data(qp, &pdu));
777 	case NVME_TCP_PDU_TYPE_C2H_DATA:
778 		return (nvmf_tcp_handle_c2h_data(qp, &pdu));
779 	case NVME_TCP_PDU_TYPE_R2T:
780 		return (nvmf_tcp_handle_r2t(qp, &pdu));
781 	}
782 }
783 
784 static bool
785 nvmf_tcp_validate_ic_pdu(struct nvmf_association *na, struct nvmf_tcp_qpair *qp,
786     const struct nvme_tcp_common_pdu_hdr *ch, size_t pdu_len)
787 {
788 	const struct nvme_tcp_ic_req *pdu;
789 	uint32_t plen;
790 	u_int hlen;
791 
792 	/* Determine how large of a PDU header to return for errors. */
793 	hlen = ch->hlen;
794 	plen = le32toh(ch->plen);
795 	if (hlen < sizeof(*ch) || hlen > plen)
796 		hlen = sizeof(*ch);
797 
798 	/*
799 	 * Errors must be reported for the lowest incorrect field
800 	 * first, so validate fields in order.
801 	 */
802 
803 	/* Validate pdu_type. */
804 
805 	/* Controllers only receive PDUs with a PDU direction of 0. */
806 	if (na->na_controller != ((ch->pdu_type & 0x01) == 0)) {
807 		na_error(na, "NVMe/TCP: Invalid PDU type %u", ch->pdu_type);
808 		nvmf_tcp_report_error(na, qp,
809 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 0, ch, pdu_len,
810 		    hlen);
811 		return (false);
812 	}
813 
814 	switch (ch->pdu_type) {
815 	case NVME_TCP_PDU_TYPE_IC_REQ:
816 	case NVME_TCP_PDU_TYPE_IC_RESP:
817 		break;
818 	default:
819 		na_error(na, "NVMe/TCP: Invalid PDU type %u", ch->pdu_type);
820 		nvmf_tcp_report_error(na, qp,
821 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 0, ch, pdu_len,
822 		    hlen);
823 		return (false);
824 	}
825 
826 	/* Validate flags. */
827 	if (ch->flags != 0) {
828 		na_error(na, "NVMe/TCP: Invalid PDU header flags %#x",
829 		    ch->flags);
830 		nvmf_tcp_report_error(na, qp,
831 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 1, ch, pdu_len,
832 		    hlen);
833 		return (false);
834 	}
835 
836 	/* Validate hlen. */
837 	if (ch->hlen != 128) {
838 		na_error(na, "NVMe/TCP: Invalid PDU header length %u",
839 		    ch->hlen);
840 		nvmf_tcp_report_error(na, qp,
841 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 2, ch, pdu_len,
842 		    hlen);
843 		return (false);
844 	}
845 
846 	/* Validate pdo. */
847 	if (ch->pdo != 0) {
848 		na_error(na, "NVMe/TCP: Invalid PDU data offset %u", ch->pdo);
849 		nvmf_tcp_report_error(na, qp,
850 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 3, ch, pdu_len,
851 		    hlen);
852 		return (false);
853 	}
854 
855 	/* Validate plen. */
856 	if (plen != 128) {
857 		na_error(na, "NVMe/TCP: Invalid PDU length %u", plen);
858 		nvmf_tcp_report_error(na, qp,
859 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 4, ch, pdu_len,
860 		    hlen);
861 		return (false);
862 	}
863 
864 	/* Validate fields common to both ICReq and ICResp. */
865 	pdu = (const struct nvme_tcp_ic_req *)ch;
866 	if (le16toh(pdu->pfv) != 0) {
867 		na_error(na, "NVMe/TCP: Unsupported PDU version %u",
868 		    le16toh(pdu->pfv));
869 		nvmf_tcp_report_error(na, qp,
870 		    NVME_TCP_TERM_REQ_FES_INVALID_DATA_UNSUPPORTED_PARAMETER,
871 		    8, ch, pdu_len, hlen);
872 		return (false);
873 	}
874 
875 	if (pdu->hpda > NVME_TCP_HPDA_MAX) {
876 		na_error(na, "NVMe/TCP: Unsupported PDA %u", pdu->hpda);
877 		nvmf_tcp_report_error(na, qp,
878 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 10, ch, pdu_len,
879 		    hlen);
880 		return (false);
881 	}
882 
883 	if (pdu->dgst.bits.reserved != 0) {
884 		na_error(na, "NVMe/TCP: Invalid digest settings");
885 		nvmf_tcp_report_error(na, qp,
886 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 11, ch, pdu_len,
887 		    hlen);
888 		return (false);
889 	}
890 
891 	return (true);
892 }
893 
894 static bool
895 nvmf_tcp_read_ic_req(struct nvmf_association *na, struct nvmf_tcp_qpair *qp,
896     struct nvme_tcp_ic_req *pdu)
897 {
898 	int error;
899 
900 	error = nvmf_tcp_read_buffer(qp->s, pdu, sizeof(*pdu));
901 	if (error != 0) {
902 		na_error(na, "NVMe/TCP: Failed to read IC request: %s",
903 		    strerror(error));
904 		return (false);
905 	}
906 
907 	return (nvmf_tcp_validate_ic_pdu(na, qp, &pdu->common, sizeof(*pdu)));
908 }
909 
910 static bool
911 nvmf_tcp_read_ic_resp(struct nvmf_association *na, struct nvmf_tcp_qpair *qp,
912     struct nvme_tcp_ic_resp *pdu)
913 {
914 	int error;
915 
916 	error = nvmf_tcp_read_buffer(qp->s, pdu, sizeof(*pdu));
917 	if (error != 0) {
918 		na_error(na, "NVMe/TCP: Failed to read IC response: %s",
919 		    strerror(error));
920 		return (false);
921 	}
922 
923 	return (nvmf_tcp_validate_ic_pdu(na, qp, &pdu->common, sizeof(*pdu)));
924 }
925 
926 static struct nvmf_association *
927 tcp_allocate_association(bool controller,
928     const struct nvmf_association_params *params)
929 {
930 	struct nvmf_tcp_association *ta;
931 
932 	if (controller) {
933 		/* 7.4.10.3 */
934 		if (params->tcp.maxh2cdata < 4096 ||
935 		    params->tcp.maxh2cdata % 4 != 0)
936 			return (NULL);
937 	}
938 
939 	ta = calloc(1, sizeof(*ta));
940 
941 	return (&ta->na);
942 }
943 
944 static void
945 tcp_update_association(struct nvmf_association *na,
946     const struct nvme_controller_data *cdata)
947 {
948 	struct nvmf_tcp_association *ta = TASSOC(na);
949 
950 	ta->ioccsz = le32toh(cdata->ioccsz);
951 }
952 
953 static void
954 tcp_free_association(struct nvmf_association *na)
955 {
956 	free(na);
957 }
958 
959 static bool
960 tcp_connect(struct nvmf_tcp_qpair *qp, struct nvmf_association *na, bool admin)
961 {
962 	const struct nvmf_association_params *params = &na->na_params;
963 	struct nvmf_tcp_association *ta = TASSOC(na);
964 	struct nvme_tcp_ic_req ic_req;
965 	struct nvme_tcp_ic_resp ic_resp;
966 	uint32_t maxh2cdata;
967 	int error;
968 
969 	if (!admin) {
970 		if (ta->ioccsz == 0) {
971 			na_error(na, "TCP I/O queues require cdata");
972 			return (false);
973 		}
974 		if (ta->ioccsz < 4) {
975 			na_error(na, "Invalid IOCCSZ %u", ta->ioccsz);
976 			return (false);
977 		}
978 	}
979 
980 	memset(&ic_req, 0, sizeof(ic_req));
981 	ic_req.common.pdu_type = NVME_TCP_PDU_TYPE_IC_REQ;
982 	ic_req.common.hlen = sizeof(ic_req);
983 	ic_req.common.plen = htole32(sizeof(ic_req));
984 	ic_req.pfv = htole16(0);
985 	ic_req.hpda = params->tcp.pda;
986 	if (params->tcp.header_digests)
987 		ic_req.dgst.bits.hdgst_enable = 1;
988 	if (params->tcp.data_digests)
989 		ic_req.dgst.bits.ddgst_enable = 1;
990 	ic_req.maxr2t = htole32(params->tcp.maxr2t);
991 
992 	error = nvmf_tcp_write_pdu(qp, &ic_req, sizeof(ic_req));
993 	if (error != 0) {
994 		na_error(na, "Failed to write IC request: %s", strerror(error));
995 		return (false);
996 	}
997 
998 	if (!nvmf_tcp_read_ic_resp(na, qp, &ic_resp))
999 		return (false);
1000 
1001 	/* Ensure the controller didn't enable digests we didn't request. */
1002 	if ((!params->tcp.header_digests &&
1003 	    ic_resp.dgst.bits.hdgst_enable != 0) ||
1004 	    (!params->tcp.data_digests &&
1005 	    ic_resp.dgst.bits.ddgst_enable != 0)) {
1006 		na_error(na, "Controller enabled unrequested digests");
1007 		nvmf_tcp_report_error(na, qp,
1008 		    NVME_TCP_TERM_REQ_FES_INVALID_DATA_UNSUPPORTED_PARAMETER,
1009 		    11, &ic_resp, sizeof(ic_resp), sizeof(ic_resp));
1010 		return (false);
1011 	}
1012 
1013 	/*
1014 	 * XXX: Is there an upper-bound to enforce here?  Perhaps pick
1015 	 * some large value and report larger values as an unsupported
1016 	 * parameter?
1017 	 */
1018 	maxh2cdata = le32toh(ic_resp.maxh2cdata);
1019 	if (maxh2cdata < 4096 || maxh2cdata % 4 != 0) {
1020 		na_error(na, "Invalid MAXH2CDATA %u", maxh2cdata);
1021 		nvmf_tcp_report_error(na, qp,
1022 		    NVME_TCP_TERM_REQ_FES_INVALID_HEADER_FIELD, 12, &ic_resp,
1023 		    sizeof(ic_resp), sizeof(ic_resp));
1024 		return (false);
1025 	}
1026 
1027 	qp->txpda = (params->tcp.pda + 1) * 4;
1028 	qp->rxpda = (ic_resp.cpda + 1) * 4;
1029 	qp->header_digests = ic_resp.dgst.bits.hdgst_enable != 0;
1030 	qp->data_digests = ic_resp.dgst.bits.ddgst_enable != 0;
1031 	qp->maxr2t = params->tcp.maxr2t;
1032 	qp->maxh2cdata = maxh2cdata;
1033 	if (admin)
1034 		/* 7.4.3 */
1035 		qp->max_icd = 8192;
1036 	else
1037 		qp->max_icd = (ta->ioccsz - 4) * 16;
1038 
1039 	return (0);
1040 }
1041 
1042 static bool
1043 tcp_accept(struct nvmf_tcp_qpair *qp, struct nvmf_association *na)
1044 {
1045 	const struct nvmf_association_params *params = &na->na_params;
1046 	struct nvme_tcp_ic_req ic_req;
1047 	struct nvme_tcp_ic_resp ic_resp;
1048 	int error;
1049 
1050 	if (!nvmf_tcp_read_ic_req(na, qp, &ic_req))
1051 		return (false);
1052 
1053 	memset(&ic_resp, 0, sizeof(ic_resp));
1054 	ic_resp.common.pdu_type = NVME_TCP_PDU_TYPE_IC_RESP;
1055 	ic_resp.common.hlen = sizeof(ic_req);
1056 	ic_resp.common.plen = htole32(sizeof(ic_req));
1057 	ic_resp.pfv = htole16(0);
1058 	ic_resp.cpda = params->tcp.pda;
1059 	if (params->tcp.header_digests && ic_req.dgst.bits.hdgst_enable != 0)
1060 		ic_resp.dgst.bits.hdgst_enable = 1;
1061 	if (params->tcp.data_digests && ic_req.dgst.bits.ddgst_enable != 0)
1062 		ic_resp.dgst.bits.ddgst_enable = 1;
1063 	ic_resp.maxh2cdata = htole32(params->tcp.maxh2cdata);
1064 
1065 	error = nvmf_tcp_write_pdu(qp, &ic_resp, sizeof(ic_resp));
1066 	if (error != 0) {
1067 		na_error(na, "Failed to write IC response: %s",
1068 		    strerror(error));
1069 		return (false);
1070 	}
1071 
1072 	qp->txpda = (params->tcp.pda + 1) * 4;
1073 	qp->rxpda = (ic_req.hpda + 1) * 4;
1074 	qp->header_digests = ic_resp.dgst.bits.hdgst_enable != 0;
1075 	qp->data_digests = ic_resp.dgst.bits.ddgst_enable != 0;
1076 	qp->maxr2t = le32toh(ic_req.maxr2t);
1077 	qp->maxh2cdata = params->tcp.maxh2cdata;
1078 	qp->max_icd = 0;	/* XXX */
1079 	return (0);
1080 }
1081 
1082 static struct nvmf_qpair *
1083 tcp_allocate_qpair(struct nvmf_association *na,
1084     const struct nvmf_qpair_params *qparams)
1085 {
1086 	const struct nvmf_association_params *aparams = &na->na_params;
1087 	struct nvmf_tcp_qpair *qp;
1088 	int error;
1089 
1090 	if (aparams->tcp.pda > NVME_TCP_CPDA_MAX) {
1091 		na_error(na, "Invalid PDA");
1092 		return (NULL);
1093 	}
1094 
1095 	qp = calloc(1, sizeof(*qp));
1096 	qp->s = qparams->tcp.fd;
1097 	LIST_INIT(&qp->rx_buffers);
1098 	LIST_INIT(&qp->tx_buffers);
1099 	TAILQ_INIT(&qp->rx_capsules);
1100 	if (na->na_controller)
1101 		error = tcp_accept(qp, na);
1102 	else
1103 		error = tcp_connect(qp, na, qparams->admin);
1104 	if (error != 0) {
1105 		free(qp);
1106 		return (NULL);
1107 	}
1108 
1109 	return (&qp->qp);
1110 }
1111 
1112 static void
1113 tcp_free_qpair(struct nvmf_qpair *nq)
1114 {
1115 	struct nvmf_tcp_qpair *qp = TQP(nq);
1116 	struct nvmf_tcp_capsule *ntc, *tc;
1117 	struct nvmf_tcp_command_buffer *ncb, *cb;
1118 
1119 	TAILQ_FOREACH_SAFE(tc, &qp->rx_capsules, link, ntc) {
1120 		TAILQ_REMOVE(&qp->rx_capsules, tc, link);
1121 		nvmf_free_capsule(&tc->nc);
1122 	}
1123 	LIST_FOREACH_SAFE(cb, &qp->rx_buffers, link, ncb) {
1124 		tcp_free_command_buffer(cb);
1125 	}
1126 	LIST_FOREACH_SAFE(cb, &qp->tx_buffers, link, ncb) {
1127 		tcp_free_command_buffer(cb);
1128 	}
1129 	free(qp);
1130 }
1131 
1132 static int
1133 tcp_kernel_handoff_params(struct nvmf_qpair *nq,
1134     struct nvmf_handoff_qpair_params *qparams)
1135 {
1136 	struct nvmf_tcp_qpair *qp = TQP(nq);
1137 
1138 	qparams->tcp.fd = qp->s;
1139 	qparams->tcp.rxpda = qp->rxpda;
1140 	qparams->tcp.txpda = qp->txpda;
1141 	qparams->tcp.header_digests = qp->header_digests;
1142 	qparams->tcp.data_digests = qp->data_digests;
1143 	qparams->tcp.maxr2t = qp->maxr2t;
1144 	qparams->tcp.maxh2cdata = qp->maxh2cdata;
1145 	qparams->tcp.max_icd = qp->max_icd;
1146 
1147 	return (0);
1148 }
1149 
1150 static struct nvmf_capsule *
1151 tcp_allocate_capsule(struct nvmf_qpair *qp __unused)
1152 {
1153 	struct nvmf_tcp_capsule *nc;
1154 
1155 	nc = calloc(1, sizeof(*nc));
1156 	return (&nc->nc);
1157 }
1158 
1159 static void
1160 tcp_free_capsule(struct nvmf_capsule *nc)
1161 {
1162 	struct nvmf_tcp_capsule *tc = TCAP(nc);
1163 
1164 	nvmf_tcp_free_pdu(&tc->rx_pdu);
1165 	if (tc->cb != NULL)
1166 		tcp_free_command_buffer(tc->cb);
1167 	free(tc);
1168 }
1169 
1170 static int
1171 tcp_transmit_command(struct nvmf_capsule *nc)
1172 {
1173 	struct nvmf_tcp_qpair *qp = TQP(nc->nc_qpair);
1174 	struct nvmf_tcp_capsule *tc = TCAP(nc);
1175 	struct nvme_tcp_cmd cmd;
1176 	struct nvme_sgl_descriptor *sgl;
1177 	int error;
1178 	bool use_icd;
1179 
1180 	use_icd = false;
1181 	if (nc->nc_data_len != 0 && nc->nc_send_data &&
1182 	    nc->nc_data_len <= qp->max_icd)
1183 		use_icd = true;
1184 
1185 	memset(&cmd, 0, sizeof(cmd));
1186 	cmd.common.pdu_type = NVME_TCP_PDU_TYPE_CAPSULE_CMD;
1187 	cmd.ccsqe = nc->nc_sqe;
1188 
1189 	/* Populate SGL in SQE. */
1190 	sgl = &cmd.ccsqe.sgl;
1191 	memset(sgl, 0, sizeof(*sgl));
1192 	sgl->address = 0;
1193 	sgl->length = htole32(nc->nc_data_len);
1194 	if (use_icd) {
1195 		/* Use in-capsule data. */
1196 		sgl->type = NVME_SGL_TYPE_ICD;
1197 	} else {
1198 		/* Use a command buffer. */
1199 		sgl->type = NVME_SGL_TYPE_COMMAND_BUFFER;
1200 	}
1201 
1202 	/* Send command capsule. */
1203 	error = nvmf_tcp_construct_pdu(qp, &cmd, sizeof(cmd), use_icd ?
1204 	    nc->nc_data : NULL, use_icd ? nc->nc_data_len : 0);
1205 	if (error != 0)
1206 		return (error);
1207 
1208 	/*
1209 	 * If data will be transferred using a command buffer, allocate a
1210 	 * buffer structure and queue it.
1211 	 */
1212 	if (nc->nc_data_len != 0 && !use_icd)
1213 		tc->cb = tcp_alloc_command_buffer(qp, nc->nc_data, 0,
1214 		    nc->nc_data_len, cmd.ccsqe.cid, 0, !nc->nc_send_data);
1215 
1216 	return (0);
1217 }
1218 
1219 static int
1220 tcp_transmit_response(struct nvmf_capsule *nc)
1221 {
1222 	struct nvmf_tcp_qpair *qp = TQP(nc->nc_qpair);
1223 	struct nvme_tcp_rsp rsp;
1224 
1225 	memset(&rsp, 0, sizeof(rsp));
1226 	rsp.common.pdu_type = NVME_TCP_PDU_TYPE_CAPSULE_RESP;
1227 	rsp.rccqe = nc->nc_cqe;
1228 
1229 	return (nvmf_tcp_construct_pdu(qp, &rsp, sizeof(rsp), NULL, 0));
1230 }
1231 
1232 static int
1233 tcp_transmit_capsule(struct nvmf_capsule *nc)
1234 {
1235 	if (nc->nc_qe_len == sizeof(struct nvme_command))
1236 		return (tcp_transmit_command(nc));
1237 	else
1238 		return (tcp_transmit_response(nc));
1239 }
1240 
1241 static int
1242 tcp_receive_capsule(struct nvmf_qpair *nq, struct nvmf_capsule **ncp)
1243 {
1244 	struct nvmf_tcp_qpair *qp = TQP(nq);
1245 	struct nvmf_tcp_capsule *tc;
1246 	int error;
1247 
1248 	while (TAILQ_EMPTY(&qp->rx_capsules)) {
1249 		error = nvmf_tcp_receive_pdu(qp);
1250 		if (error != 0)
1251 			return (error);
1252 	}
1253 	tc = TAILQ_FIRST(&qp->rx_capsules);
1254 	TAILQ_REMOVE(&qp->rx_capsules, tc, link);
1255 	*ncp = &tc->nc;
1256 	return (0);
1257 }
1258 
1259 static uint8_t
1260 tcp_validate_command_capsule(const struct nvmf_capsule *nc)
1261 {
1262 	const struct nvmf_tcp_capsule *tc = CTCAP(nc);
1263 	const struct nvme_sgl_descriptor *sgl;
1264 
1265 	assert(tc->rx_pdu.hdr != NULL);
1266 
1267 	sgl = &nc->nc_sqe.sgl;
1268 	switch (sgl->type) {
1269 	case NVME_SGL_TYPE_ICD:
1270 		if (tc->rx_pdu.data_len != le32toh(sgl->length)) {
1271 			printf("NVMe/TCP: Command Capsule with mismatched ICD length\n");
1272 			return (NVME_SC_DATA_SGL_LENGTH_INVALID);
1273 		}
1274 		break;
1275 	case NVME_SGL_TYPE_COMMAND_BUFFER:
1276 		if (tc->rx_pdu.data_len != 0) {
1277 			printf("NVMe/TCP: Command Buffer SGL with ICD\n");
1278 			return (NVME_SC_INVALID_FIELD);
1279 		}
1280 		break;
1281 	default:
1282 		printf("NVMe/TCP: Invalid SGL type in Command Capsule\n");
1283 		return (NVME_SC_SGL_DESCRIPTOR_TYPE_INVALID);
1284 	}
1285 
1286 	if (sgl->address != 0) {
1287 		printf("NVMe/TCP: Invalid SGL offset in Command Capsule\n");
1288 		return (NVME_SC_SGL_OFFSET_INVALID);
1289 	}
1290 
1291 	return (NVME_SC_SUCCESS);
1292 }
1293 
1294 static size_t
1295 tcp_capsule_data_len(const struct nvmf_capsule *nc)
1296 {
1297 	assert(nc->nc_qe_len == sizeof(struct nvme_command));
1298 	return (le32toh(nc->nc_sqe.sgl.length));
1299 }
1300 
1301 /* NB: cid and ttag are both little-endian already. */
1302 static int
1303 tcp_send_r2t(struct nvmf_tcp_qpair *qp, uint16_t cid, uint16_t ttag,
1304     uint32_t data_offset, uint32_t data_len)
1305 {
1306 	struct nvme_tcp_r2t_hdr r2t;
1307 
1308 	memset(&r2t, 0, sizeof(r2t));
1309 	r2t.common.pdu_type = NVME_TCP_PDU_TYPE_R2T;
1310 	r2t.cccid = cid;
1311 	r2t.ttag = ttag;
1312 	r2t.r2to = htole32(data_offset);
1313 	r2t.r2tl = htole32(data_len);
1314 
1315 	return (nvmf_tcp_construct_pdu(qp, &r2t, sizeof(r2t), NULL, 0));
1316 }
1317 
1318 static int
1319 tcp_receive_r2t_data(const struct nvmf_capsule *nc, uint32_t data_offset,
1320     void *buf, size_t len)
1321 {
1322 	struct nvmf_tcp_qpair *qp = TQP(nc->nc_qpair);
1323 	struct nvmf_tcp_command_buffer *cb;
1324 	int error;
1325 	uint16_t ttag;
1326 
1327 	/*
1328 	 * Don't bother byte-swapping ttag as it is just a cookie
1329 	 * value returned by the other end as-is.
1330 	 */
1331 	ttag = qp->next_ttag++;
1332 
1333 	error = tcp_send_r2t(qp, nc->nc_sqe.cid, ttag, data_offset, len);
1334 	if (error != 0)
1335 		return (error);
1336 
1337 	cb = tcp_alloc_command_buffer(qp, buf, data_offset, len,
1338 	    nc->nc_sqe.cid, ttag, true);
1339 
1340 	/* Parse received PDUs until the data transfer is complete. */
1341 	while (cb->data_xfered < cb->data_len) {
1342 		error = nvmf_tcp_receive_pdu(qp);
1343 		if (error != 0)
1344 			break;
1345 	}
1346 	tcp_free_command_buffer(cb);
1347 	return (error);
1348 }
1349 
1350 static int
1351 tcp_receive_icd_data(const struct nvmf_capsule *nc, uint32_t data_offset,
1352     void *buf, size_t len)
1353 {
1354 	const struct nvmf_tcp_capsule *tc = CTCAP(nc);
1355 	const char *icd;
1356 
1357 	icd = (const char *)tc->rx_pdu.hdr + tc->rx_pdu.hdr->pdo + data_offset;
1358 	memcpy(buf, icd, len);
1359 	return (0);
1360 }
1361 
1362 static int
1363 tcp_receive_controller_data(const struct nvmf_capsule *nc, uint32_t data_offset,
1364     void *buf, size_t len)
1365 {
1366 	struct nvmf_association *na = nc->nc_qpair->nq_association;
1367 	const struct nvme_sgl_descriptor *sgl;
1368 	size_t data_len;
1369 
1370 	if (nc->nc_qe_len != sizeof(struct nvme_command) || !na->na_controller)
1371 		return (EINVAL);
1372 
1373 	sgl = &nc->nc_sqe.sgl;
1374 	data_len = le32toh(sgl->length);
1375 	if (data_offset + len > data_len)
1376 		return (EFBIG);
1377 
1378 	if (sgl->type == NVME_SGL_TYPE_ICD)
1379 		return (tcp_receive_icd_data(nc, data_offset, buf, len));
1380 	else
1381 		return (tcp_receive_r2t_data(nc, data_offset, buf, len));
1382 }
1383 
1384 /* NB: cid is little-endian already. */
1385 static int
1386 tcp_send_c2h_pdu(struct nvmf_tcp_qpair *qp, uint16_t cid,
1387     uint32_t data_offset, const void *buf, size_t len, bool last_pdu,
1388     bool success)
1389 {
1390 	struct nvme_tcp_c2h_data_hdr c2h;
1391 
1392 	memset(&c2h, 0, sizeof(c2h));
1393 	c2h.common.pdu_type = NVME_TCP_PDU_TYPE_C2H_DATA;
1394 	if (last_pdu)
1395 		c2h.common.flags |= NVME_TCP_C2H_DATA_FLAGS_LAST_PDU;
1396 	if (success)
1397 		c2h.common.flags |= NVME_TCP_C2H_DATA_FLAGS_SUCCESS;
1398 	c2h.cccid = cid;
1399 	c2h.datao = htole32(data_offset);
1400 	c2h.datal = htole32(len);
1401 
1402 	return (nvmf_tcp_construct_pdu(qp, &c2h, sizeof(c2h),
1403 	    __DECONST(void *, buf), len));
1404 }
1405 
1406 static int
1407 tcp_send_controller_data(const struct nvmf_capsule *nc, const void *buf,
1408     size_t len)
1409 {
1410 	struct nvmf_association *na = nc->nc_qpair->nq_association;
1411 	struct nvmf_tcp_qpair *qp = TQP(nc->nc_qpair);
1412 	const struct nvme_sgl_descriptor *sgl;
1413 	const char *src;
1414 	size_t todo;
1415 	uint32_t data_len, data_offset;
1416 	int error;
1417 	bool last_pdu, send_success_flag;
1418 
1419 	if (nc->nc_qe_len != sizeof(struct nvme_command) || !na->na_controller)
1420 		return (EINVAL);
1421 
1422 	sgl = &nc->nc_sqe.sgl;
1423 	data_len = le32toh(sgl->length);
1424 	if (len != data_len) {
1425 		nvmf_send_generic_error(nc, NVME_SC_INVALID_FIELD);
1426 		return (EFBIG);
1427 	}
1428 
1429 	if (sgl->type != NVME_SGL_TYPE_COMMAND_BUFFER) {
1430 		nvmf_send_generic_error(nc, NVME_SC_INVALID_FIELD);
1431 		return (EINVAL);
1432 	}
1433 
1434 	/* Use the SUCCESS flag if SQ flow control is disabled. */
1435 	send_success_flag = !qp->qp.nq_flow_control;
1436 
1437 	/*
1438 	 * Write out one or more C2H_DATA PDUs containing the data.
1439 	 * Each PDU is arbitrarily capped at 256k.
1440 	 */
1441 	data_offset = 0;
1442 	src = buf;
1443 	while (len > 0) {
1444 		if (len > 256 * 1024) {
1445 			todo = 256 * 1024;
1446 			last_pdu = false;
1447 		} else {
1448 			todo = len;
1449 			last_pdu = true;
1450 		}
1451 		error = tcp_send_c2h_pdu(qp, nc->nc_sqe.cid, data_offset,
1452 		    src, todo, last_pdu, last_pdu && send_success_flag);
1453 		if (error != 0) {
1454 			nvmf_send_generic_error(nc,
1455 			    NVME_SC_TRANSIENT_TRANSPORT_ERROR);
1456 			return (error);
1457 		}
1458 		data_offset += todo;
1459 		src += todo;
1460 		len -= todo;
1461 	}
1462 	if (!send_success_flag)
1463 		nvmf_send_success(nc);
1464 	return (0);
1465 }
1466 
1467 struct nvmf_transport_ops tcp_ops = {
1468 	.allocate_association = tcp_allocate_association,
1469 	.update_association = tcp_update_association,
1470 	.free_association = tcp_free_association,
1471 	.allocate_qpair = tcp_allocate_qpair,
1472 	.free_qpair = tcp_free_qpair,
1473 	.kernel_handoff_params = tcp_kernel_handoff_params,
1474 	.allocate_capsule = tcp_allocate_capsule,
1475 	.free_capsule = tcp_free_capsule,
1476 	.transmit_capsule = tcp_transmit_capsule,
1477 	.receive_capsule = tcp_receive_capsule,
1478 	.validate_command_capsule = tcp_validate_command_capsule,
1479 	.capsule_data_len = tcp_capsule_data_len,
1480 	.receive_controller_data = tcp_receive_controller_data,
1481 	.send_controller_data = tcp_send_controller_data,
1482 };
1483