xref: /freebsd/sys/cam/ctl/ctl_frontend_iscsi.c (revision 1f4bcc459a76b7aa664f3fd557684cd0ba6da352)
1 /*-
2  * Copyright (c) 2012 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Edward Tomasz Napierala under sponsorship
6  * from the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * CTL frontend for the iSCSI protocol.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/capsicum.h>
41 #include <sys/condvar.h>
42 #include <sys/endian.h>
43 #include <sys/file.h>
44 #include <sys/kernel.h>
45 #include <sys/kthread.h>
46 #include <sys/lock.h>
47 #include <sys/malloc.h>
48 #include <sys/module.h>
49 #include <sys/mutex.h>
50 #include <sys/queue.h>
51 #include <sys/sbuf.h>
52 #include <sys/sysctl.h>
53 #include <sys/systm.h>
54 #include <sys/uio.h>
55 #include <sys/unistd.h>
56 #include <vm/uma.h>
57 
58 #include <cam/scsi/scsi_all.h>
59 #include <cam/scsi/scsi_da.h>
60 #include <cam/ctl/ctl_io.h>
61 #include <cam/ctl/ctl.h>
62 #include <cam/ctl/ctl_backend.h>
63 #include <cam/ctl/ctl_error.h>
64 #include <cam/ctl/ctl_frontend.h>
65 #include <cam/ctl/ctl_debug.h>
66 #include <cam/ctl/ctl_ha.h>
67 #include <cam/ctl/ctl_ioctl.h>
68 #include <cam/ctl/ctl_private.h>
69 
70 #include <dev/iscsi/icl.h>
71 #include <dev/iscsi/icl_wrappers.h>
72 #include <dev/iscsi/iscsi_proto.h>
73 #include <cam/ctl/ctl_frontend_iscsi.h>
74 
75 #ifdef ICL_KERNEL_PROXY
76 #include <sys/socketvar.h>
77 #endif
78 
79 #ifdef ICL_KERNEL_PROXY
80 FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
81 #endif
82 
83 static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
84 static uma_zone_t cfiscsi_data_wait_zone;
85 
86 SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
87     "CAM Target Layer iSCSI Frontend");
88 static int debug = 1;
89 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
90     &debug, 1, "Enable debug messages");
91 static int ping_timeout = 5;
92 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
93     &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
94 static int login_timeout = 60;
95 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
96     &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
97 static int maxcmdsn_delta = 256;
98 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
99     &maxcmdsn_delta, 256, "Number of commands the initiator can send "
100     "without confirmation");
101 
102 #define	CFISCSI_DEBUG(X, ...)						\
103 	do {								\
104 		if (debug > 1) {					\
105 			printf("%s: " X "\n",				\
106 			    __func__, ## __VA_ARGS__);			\
107 		}							\
108 	} while (0)
109 
110 #define	CFISCSI_WARN(X, ...)						\
111 	do {								\
112 		if (debug > 0) {					\
113 			printf("WARNING: %s: " X "\n",			\
114 			    __func__, ## __VA_ARGS__);			\
115 		}							\
116 	} while (0)
117 
118 #define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
119 	do {								\
120 		if (debug > 1) {					\
121 			printf("%s: %s (%s): " X "\n",			\
122 			    __func__, S->cs_initiator_addr,		\
123 			    S->cs_initiator_name, ## __VA_ARGS__);	\
124 		}							\
125 	} while (0)
126 
127 #define	CFISCSI_SESSION_WARN(S, X, ...)					\
128 	do  {								\
129 		if (debug > 0) {					\
130 			printf("WARNING: %s (%s): " X "\n",		\
131 			    S->cs_initiator_addr,			\
132 			    S->cs_initiator_name, ## __VA_ARGS__);	\
133 		}							\
134 	} while (0)
135 
136 #define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
137 #define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
138 #define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
139 
140 #define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
141 #define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
142 #define	PDU_EXPDATASN(X)		(X)->ip_prv0
143 #define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
144 #define	PDU_R2TSN(X)			(X)->ip_prv2
145 
146 int		cfiscsi_init(void);
147 static void	cfiscsi_online(void *arg);
148 static void	cfiscsi_offline(void *arg);
149 static int	cfiscsi_info(void *arg, struct sbuf *sb);
150 static int	cfiscsi_ioctl(struct cdev *dev,
151 		    u_long cmd, caddr_t addr, int flag, struct thread *td);
152 static void	cfiscsi_datamove(union ctl_io *io);
153 static void	cfiscsi_datamove_in(union ctl_io *io);
154 static void	cfiscsi_datamove_out(union ctl_io *io);
155 static void	cfiscsi_done(union ctl_io *io);
156 static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
157 static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
158 static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
159 static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
160 static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
161 static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
162 static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
163 static struct cfiscsi_data_wait	*cfiscsi_data_wait_new(
164 		    struct cfiscsi_session *cs, union ctl_io *io,
165 		    uint32_t initiator_task_tag,
166 		    uint32_t *target_transfer_tagp);
167 static void	cfiscsi_data_wait_free(struct cfiscsi_session *cs,
168 		    struct cfiscsi_data_wait *cdw);
169 static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
170 		    *softc, const char *name, uint16_t tag);
171 static struct cfiscsi_target	*cfiscsi_target_find_or_create(
172     struct cfiscsi_softc *softc, const char *name, const char *alias,
173     uint16_t tag);
174 static void	cfiscsi_target_release(struct cfiscsi_target *ct);
175 static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
176 
177 static struct cfiscsi_softc cfiscsi_softc;
178 
179 static struct ctl_frontend cfiscsi_frontend =
180 {
181 	.name = "iscsi",
182 	.init = cfiscsi_init,
183 	.ioctl = cfiscsi_ioctl,
184 };
185 CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
186 MODULE_DEPEND(ctlcfiscsi, icl, 1, 1, 1);
187 
188 static struct icl_pdu *
189 cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
190 {
191 
192 	return (icl_pdu_new(request->ip_conn, flags));
193 }
194 
195 static bool
196 cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
197 {
198 	const struct iscsi_bhs_scsi_command *bhssc;
199 	struct cfiscsi_session *cs;
200 	uint32_t cmdsn, expstatsn;
201 
202 	cs = PDU_SESSION(request);
203 
204 	/*
205 	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
206 	 * The purpose of the timeout is to reset the connection when it stalls;
207 	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
208 	 * in some queue.
209 	 *
210 	 * XXX: Locking?
211 	 */
212 	cs->cs_timeout = 0;
213 
214 	/*
215 	 * Data-Out PDUs don't contain CmdSN.
216 	 */
217 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
218 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
219 		return (false);
220 
221 	/*
222 	 * We're only using fields common for all the request
223 	 * (initiator -> target) PDUs.
224 	 */
225 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
226 	cmdsn = ntohl(bhssc->bhssc_cmdsn);
227 	expstatsn = ntohl(bhssc->bhssc_expstatsn);
228 
229 	CFISCSI_SESSION_LOCK(cs);
230 #if 0
231 	if (expstatsn != cs->cs_statsn) {
232 		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
233 		    "while current StatSN is %d", expstatsn,
234 		    cs->cs_statsn);
235 	}
236 #endif
237 
238 	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0) {
239 		/*
240 		 * The target MUST silently ignore any non-immediate command
241 		 * outside of this range.
242 		 */
243 		if (ISCSI_SNLT(cmdsn, cs->cs_cmdsn) ||
244 		    ISCSI_SNGT(cmdsn, cs->cs_cmdsn + maxcmdsn_delta)) {
245 			CFISCSI_SESSION_UNLOCK(cs);
246 			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
247 			    "while expected %u", cmdsn, cs->cs_cmdsn);
248 			return (true);
249 		}
250 
251 		/*
252 		 * We don't support multiple connections now, so any
253 		 * discontinuity in CmdSN means lost PDUs.  Since we don't
254 		 * support PDU retransmission -- terminate the connection.
255 		 */
256 		if (cmdsn != cs->cs_cmdsn) {
257 			CFISCSI_SESSION_UNLOCK(cs);
258 			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
259 			    "while expected %u; dropping connection",
260 			    cmdsn, cs->cs_cmdsn);
261 			cfiscsi_session_terminate(cs);
262 			return (true);
263 		}
264 		cs->cs_cmdsn++;
265 	}
266 
267 	CFISCSI_SESSION_UNLOCK(cs);
268 
269 	return (false);
270 }
271 
272 static void
273 cfiscsi_pdu_handle(struct icl_pdu *request)
274 {
275 	struct cfiscsi_session *cs;
276 	bool ignore;
277 
278 	cs = PDU_SESSION(request);
279 
280 	ignore = cfiscsi_pdu_update_cmdsn(request);
281 	if (ignore) {
282 		icl_pdu_free(request);
283 		return;
284 	}
285 
286 	/*
287 	 * Handle the PDU; this includes e.g. receiving the remaining
288 	 * part of PDU and submitting the SCSI command to CTL
289 	 * or queueing a reply.  The handling routine is responsible
290 	 * for freeing the PDU when it's no longer needed.
291 	 */
292 	switch (request->ip_bhs->bhs_opcode &
293 	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
294 	case ISCSI_BHS_OPCODE_NOP_OUT:
295 		cfiscsi_pdu_handle_nop_out(request);
296 		break;
297 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
298 		cfiscsi_pdu_handle_scsi_command(request);
299 		break;
300 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
301 		cfiscsi_pdu_handle_task_request(request);
302 		break;
303 	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
304 		cfiscsi_pdu_handle_data_out(request);
305 		break;
306 	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
307 		cfiscsi_pdu_handle_logout_request(request);
308 		break;
309 	default:
310 		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
311 		    "opcode 0x%x; dropping connection",
312 		    request->ip_bhs->bhs_opcode);
313 		icl_pdu_free(request);
314 		cfiscsi_session_terminate(cs);
315 	}
316 
317 }
318 
319 static void
320 cfiscsi_receive_callback(struct icl_pdu *request)
321 {
322 	struct cfiscsi_session *cs;
323 
324 	cs = PDU_SESSION(request);
325 
326 #ifdef ICL_KERNEL_PROXY
327 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
328 		if (cs->cs_login_pdu == NULL)
329 			cs->cs_login_pdu = request;
330 		else
331 			icl_pdu_free(request);
332 		cv_signal(&cs->cs_login_cv);
333 		return;
334 	}
335 #endif
336 
337 	cfiscsi_pdu_handle(request);
338 }
339 
340 static void
341 cfiscsi_error_callback(struct icl_conn *ic)
342 {
343 	struct cfiscsi_session *cs;
344 
345 	cs = CONN_SESSION(ic);
346 
347 	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
348 	cfiscsi_session_terminate(cs);
349 }
350 
351 static int
352 cfiscsi_pdu_prepare(struct icl_pdu *response)
353 {
354 	struct cfiscsi_session *cs;
355 	struct iscsi_bhs_scsi_response *bhssr;
356 	bool advance_statsn = true;
357 
358 	cs = PDU_SESSION(response);
359 
360 	CFISCSI_SESSION_LOCK_ASSERT(cs);
361 
362 	/*
363 	 * We're only using fields common for all the response
364 	 * (target -> initiator) PDUs.
365 	 */
366 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
367 
368 	/*
369 	 * 10.8.3: "The StatSN for this connection is not advanced
370 	 * after this PDU is sent."
371 	 */
372 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
373 		advance_statsn = false;
374 
375 	/*
376 	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
377 	 * StatSN for the connection is not advanced after this PDU is sent."
378 	 */
379 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
380 	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
381 		advance_statsn = false;
382 
383 	/*
384 	 * See the comment below - StatSN is not meaningful and must
385 	 * not be advanced.
386 	 */
387 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN &&
388 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S) == 0)
389 		advance_statsn = false;
390 
391 	/*
392 	 * 10.7.3: "The fields StatSN, Status, and Residual Count
393 	 * only have meaningful content if the S bit is set to 1."
394 	 */
395 	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
396 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S))
397 		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
398 	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
399 	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
400 
401 	if (advance_statsn)
402 		cs->cs_statsn++;
403 
404 	return (0);
405 }
406 
407 static void
408 cfiscsi_pdu_queue(struct icl_pdu *response)
409 {
410 	struct cfiscsi_session *cs;
411 
412 	cs = PDU_SESSION(response);
413 
414 	CFISCSI_SESSION_LOCK(cs);
415 	cfiscsi_pdu_prepare(response);
416 	icl_pdu_queue(response);
417 	CFISCSI_SESSION_UNLOCK(cs);
418 }
419 
420 static void
421 cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
422 {
423 	struct cfiscsi_session *cs;
424 	struct iscsi_bhs_nop_out *bhsno;
425 	struct iscsi_bhs_nop_in *bhsni;
426 	struct icl_pdu *response;
427 	void *data = NULL;
428 	size_t datasize;
429 	int error;
430 
431 	cs = PDU_SESSION(request);
432 	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
433 
434 	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
435 		/*
436 		 * Nothing to do, iscsi_pdu_update_statsn() already
437 		 * zeroed the timeout.
438 		 */
439 		icl_pdu_free(request);
440 		return;
441 	}
442 
443 	datasize = icl_pdu_data_segment_length(request);
444 	if (datasize > 0) {
445 		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
446 		if (data == NULL) {
447 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
448 			    "dropping connection");
449 			icl_pdu_free(request);
450 			cfiscsi_session_terminate(cs);
451 			return;
452 		}
453 		icl_pdu_get_data(request, 0, data, datasize);
454 	}
455 
456 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
457 	if (response == NULL) {
458 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
459 		    "droppping connection");
460 		free(data, M_CFISCSI);
461 		icl_pdu_free(request);
462 		cfiscsi_session_terminate(cs);
463 		return;
464 	}
465 	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
466 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
467 	bhsni->bhsni_flags = 0x80;
468 	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
469 	bhsni->bhsni_target_transfer_tag = 0xffffffff;
470 	if (datasize > 0) {
471 		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
472 		if (error != 0) {
473 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
474 			    "dropping connection");
475 			free(data, M_CFISCSI);
476 			icl_pdu_free(request);
477 			icl_pdu_free(response);
478 			cfiscsi_session_terminate(cs);
479 			return;
480 		}
481 		free(data, M_CFISCSI);
482 	}
483 
484 	icl_pdu_free(request);
485 	cfiscsi_pdu_queue(response);
486 }
487 
488 static void
489 cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
490 {
491 	struct iscsi_bhs_scsi_command *bhssc;
492 	struct cfiscsi_session *cs;
493 	union ctl_io *io;
494 	int error;
495 
496 	cs = PDU_SESSION(request);
497 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
498 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
499 	//    bhssc->bhssc_initiator_task_tag);
500 
501 	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
502 		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
503 		    "ImmediateData=No; dropping connection");
504 		icl_pdu_free(request);
505 		cfiscsi_session_terminate(cs);
506 		return;
507 	}
508 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
509 	ctl_zero_io(io);
510 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
511 	io->io_hdr.io_type = CTL_IO_SCSI;
512 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
513 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
514 	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhssc->bhssc_lun));
515 	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
516 	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
517 	case BHSSC_FLAGS_ATTR_UNTAGGED:
518 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
519 		break;
520 	case BHSSC_FLAGS_ATTR_SIMPLE:
521 		io->scsiio.tag_type = CTL_TAG_SIMPLE;
522 		break;
523 	case BHSSC_FLAGS_ATTR_ORDERED:
524         	io->scsiio.tag_type = CTL_TAG_ORDERED;
525 		break;
526 	case BHSSC_FLAGS_ATTR_HOQ:
527         	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
528 		break;
529 	case BHSSC_FLAGS_ATTR_ACA:
530 		io->scsiio.tag_type = CTL_TAG_ACA;
531 		break;
532 	default:
533 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
534 		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
535 		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
536 		break;
537 	}
538 	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
539 	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
540 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
541 	error = ctl_queue(io);
542 	if (error != CTL_RETVAL_COMPLETE) {
543 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
544 		    "dropping connection", error);
545 		ctl_free_io(io);
546 		refcount_release(&cs->cs_outstanding_ctl_pdus);
547 		icl_pdu_free(request);
548 		cfiscsi_session_terminate(cs);
549 	}
550 }
551 
552 static void
553 cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
554 {
555 	struct iscsi_bhs_task_management_request *bhstmr;
556 	struct iscsi_bhs_task_management_response *bhstmr2;
557 	struct icl_pdu *response;
558 	struct cfiscsi_session *cs;
559 	union ctl_io *io;
560 	int error;
561 
562 	cs = PDU_SESSION(request);
563 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
564 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
565 	ctl_zero_io(io);
566 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
567 	io->io_hdr.io_type = CTL_IO_TASK;
568 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
569 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
570 	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhstmr->bhstmr_lun));
571 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
572 
573 	switch (bhstmr->bhstmr_function & ~0x80) {
574 	case BHSTMR_FUNCTION_ABORT_TASK:
575 #if 0
576 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
577 #endif
578 		io->taskio.task_action = CTL_TASK_ABORT_TASK;
579 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
580 		break;
581 	case BHSTMR_FUNCTION_ABORT_TASK_SET:
582 #if 0
583 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
584 #endif
585 		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
586 		break;
587 	case BHSTMR_FUNCTION_CLEAR_TASK_SET:
588 #if 0
589 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_CLEAR_TASK_SET");
590 #endif
591 		io->taskio.task_action = CTL_TASK_CLEAR_TASK_SET;
592 		break;
593 	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
594 #if 0
595 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
596 #endif
597 		io->taskio.task_action = CTL_TASK_LUN_RESET;
598 		break;
599 	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
600 #if 0
601 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
602 #endif
603 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
604 		break;
605 	case BHSTMR_FUNCTION_TARGET_COLD_RESET:
606 #if 0
607 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_COLD_RESET");
608 #endif
609 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
610 		break;
611 	case BHSTMR_FUNCTION_QUERY_TASK:
612 #if 0
613 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK");
614 #endif
615 		io->taskio.task_action = CTL_TASK_QUERY_TASK;
616 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
617 		break;
618 	case BHSTMR_FUNCTION_QUERY_TASK_SET:
619 #if 0
620 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK_SET");
621 #endif
622 		io->taskio.task_action = CTL_TASK_QUERY_TASK_SET;
623 		break;
624 	case BHSTMR_FUNCTION_I_T_NEXUS_RESET:
625 #if 0
626 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_I_T_NEXUS_RESET");
627 #endif
628 		io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
629 		break;
630 	case BHSTMR_FUNCTION_QUERY_ASYNC_EVENT:
631 #if 0
632 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_ASYNC_EVENT");
633 #endif
634 		io->taskio.task_action = CTL_TASK_QUERY_ASYNC_EVENT;
635 		break;
636 	default:
637 		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
638 		    bhstmr->bhstmr_function & ~0x80);
639 		ctl_free_io(io);
640 
641 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
642 		if (response == NULL) {
643 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
644 			    "dropping connection");
645 			icl_pdu_free(request);
646 			cfiscsi_session_terminate(cs);
647 			return;
648 		}
649 		bhstmr2 = (struct iscsi_bhs_task_management_response *)
650 		    response->ip_bhs;
651 		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
652 		bhstmr2->bhstmr_flags = 0x80;
653 		bhstmr2->bhstmr_response =
654 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
655 		bhstmr2->bhstmr_initiator_task_tag =
656 		    bhstmr->bhstmr_initiator_task_tag;
657 		icl_pdu_free(request);
658 		cfiscsi_pdu_queue(response);
659 		return;
660 	}
661 
662 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
663 	error = ctl_queue(io);
664 	if (error != CTL_RETVAL_COMPLETE) {
665 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
666 		    "dropping connection", error);
667 		ctl_free_io(io);
668 		refcount_release(&cs->cs_outstanding_ctl_pdus);
669 		icl_pdu_free(request);
670 		cfiscsi_session_terminate(cs);
671 	}
672 }
673 
674 static bool
675 cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
676 {
677 	struct iscsi_bhs_data_out *bhsdo;
678 	struct cfiscsi_session *cs;
679 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
680 	size_t copy_len, len, off, buffer_offset;
681 	int ctl_sg_count;
682 	union ctl_io *io;
683 
684 	cs = PDU_SESSION(request);
685 
686 	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
687 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
688 	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
689 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
690 	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
691 
692 	/*
693 	 * We're only using fields common for Data-Out and SCSI Command PDUs.
694 	 */
695 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
696 
697 	io = cdw->cdw_ctl_io;
698 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
699 	    ("CTL_FLAG_DATA_IN"));
700 
701 #if 0
702 	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
703 	    request->ip_data_len, io->scsiio.kern_total_len);
704 #endif
705 
706 	if (io->scsiio.kern_sg_entries > 0) {
707 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
708 		ctl_sg_count = io->scsiio.kern_sg_entries;
709 	} else {
710 		ctl_sglist = &ctl_sg_entry;
711 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
712 		ctl_sglist->len = io->scsiio.kern_data_len;
713 		ctl_sg_count = 1;
714 	}
715 
716 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
717 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
718 		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
719 	else
720 		buffer_offset = 0;
721 	len = icl_pdu_data_segment_length(request);
722 
723 	/*
724 	 * Make sure the offset, as sent by the initiator, matches the offset
725 	 * we're supposed to be at in the scatter-gather list.
726 	 */
727 	if (buffer_offset >
728 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
729 	    buffer_offset + len <=
730 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
731 		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
732 		    "expected %zd; dropping connection", buffer_offset,
733 		    (size_t)io->scsiio.kern_rel_offset +
734 		    (size_t)io->scsiio.ext_data_filled);
735 		ctl_set_data_phase_error(&io->scsiio);
736 		cfiscsi_session_terminate(cs);
737 		return (true);
738 	}
739 
740 	/*
741 	 * This is the offset within the PDU data segment, as opposed
742 	 * to buffer_offset, which is the offset within the task (SCSI
743 	 * command).
744 	 */
745 	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
746 	    buffer_offset;
747 
748 	/*
749 	 * Iterate over the scatter/gather segments, filling them with data
750 	 * from the PDU data segment.  Note that this can get called multiple
751 	 * times for one SCSI command; the cdw structure holds state for the
752 	 * scatter/gather list.
753 	 */
754 	for (;;) {
755 		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
756 		    ("cdw->cdw_sg_index >= ctl_sg_count"));
757 		if (cdw->cdw_sg_len == 0) {
758 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
759 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
760 		}
761 		KASSERT(off <= len, ("len > off"));
762 		copy_len = len - off;
763 		if (copy_len > cdw->cdw_sg_len)
764 			copy_len = cdw->cdw_sg_len;
765 
766 		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
767 		cdw->cdw_sg_addr += copy_len;
768 		cdw->cdw_sg_len -= copy_len;
769 		off += copy_len;
770 		io->scsiio.ext_data_filled += copy_len;
771 
772 		if (cdw->cdw_sg_len == 0) {
773 			/*
774 			 * End of current segment.
775 			 */
776 			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
777 				/*
778 				 * Last segment in scatter/gather list.
779 				 */
780 				break;
781 			}
782 			cdw->cdw_sg_index++;
783 		}
784 
785 		if (off == len) {
786 			/*
787 			 * End of PDU payload.
788 			 */
789 			break;
790 		}
791 	}
792 
793 	if (len > off) {
794 		/*
795 		 * In case of unsolicited data, it's possible that the buffer
796 		 * provided by CTL is smaller than negotiated FirstBurstLength.
797 		 * Just ignore the superfluous data; will ask for them with R2T
798 		 * on next call to cfiscsi_datamove().
799 		 *
800 		 * This obviously can only happen with SCSI Command PDU.
801 		 */
802 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
803 		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
804 			return (true);
805 
806 		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
807 		    "expected %zd; dropping connection",
808 		    icl_pdu_data_segment_length(request), off);
809 		ctl_set_data_phase_error(&io->scsiio);
810 		cfiscsi_session_terminate(cs);
811 		return (true);
812 	}
813 
814 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
815 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
816 		CFISCSI_SESSION_WARN(cs, "got the final packet without "
817 		    "the F flag; flags = 0x%x; dropping connection",
818 		    bhsdo->bhsdo_flags);
819 		ctl_set_data_phase_error(&io->scsiio);
820 		cfiscsi_session_terminate(cs);
821 		return (true);
822 	}
823 
824 	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
825 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
826 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
827 		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
828 			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
829 			    "transmitted size was %zd bytes instead of %d; "
830 			    "dropping connection",
831 			    (size_t)io->scsiio.ext_data_filled,
832 			    cdw->cdw_r2t_end);
833 			ctl_set_data_phase_error(&io->scsiio);
834 			cfiscsi_session_terminate(cs);
835 			return (true);
836 		} else {
837 			/*
838 			 * For SCSI Command PDU, this just means we need to
839 			 * solicit more data by sending R2T.
840 			 */
841 			return (false);
842 		}
843 	}
844 
845 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
846 #if 0
847 		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
848 		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
849 #endif
850 
851 		return (true);
852 	}
853 
854 	return (false);
855 }
856 
857 static void
858 cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
859 {
860 	struct iscsi_bhs_data_out *bhsdo;
861 	struct cfiscsi_session *cs;
862 	struct cfiscsi_data_wait *cdw = NULL;
863 	union ctl_io *io;
864 	bool done;
865 
866 	cs = PDU_SESSION(request);
867 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
868 
869 	CFISCSI_SESSION_LOCK(cs);
870 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
871 #if 0
872 		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
873 		    "ttt 0x%x, itt 0x%x",
874 		    bhsdo->bhsdo_target_transfer_tag,
875 		    bhsdo->bhsdo_initiator_task_tag,
876 		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
877 #endif
878 		if (bhsdo->bhsdo_target_transfer_tag ==
879 		    cdw->cdw_target_transfer_tag)
880 			break;
881 	}
882 	CFISCSI_SESSION_UNLOCK(cs);
883 	if (cdw == NULL) {
884 		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
885 		    "0x%x, not found; dropping connection",
886 		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
887 		icl_pdu_free(request);
888 		cfiscsi_session_terminate(cs);
889 		return;
890 	}
891 
892 	if (cdw->cdw_datasn != ntohl(bhsdo->bhsdo_datasn)) {
893 		CFISCSI_SESSION_WARN(cs, "received Data-Out PDU with "
894 		    "DataSN %u, while expected %u; dropping connection",
895 		    ntohl(bhsdo->bhsdo_datasn), cdw->cdw_datasn);
896 		icl_pdu_free(request);
897 		cfiscsi_session_terminate(cs);
898 		return;
899 	}
900 	cdw->cdw_datasn++;
901 
902 	io = cdw->cdw_ctl_io;
903 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
904 	    ("CTL_FLAG_DATA_IN"));
905 
906 	done = cfiscsi_handle_data_segment(request, cdw);
907 	if (done) {
908 		CFISCSI_SESSION_LOCK(cs);
909 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
910 		CFISCSI_SESSION_UNLOCK(cs);
911 		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
912 		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
913 		cfiscsi_data_wait_free(cs, cdw);
914 		io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
915 		if (done)
916 			io->scsiio.be_move_done(io);
917 		else
918 			cfiscsi_datamove_out(io);
919 	}
920 
921 	icl_pdu_free(request);
922 }
923 
924 static void
925 cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
926 {
927 	struct iscsi_bhs_logout_request *bhslr;
928 	struct iscsi_bhs_logout_response *bhslr2;
929 	struct icl_pdu *response;
930 	struct cfiscsi_session *cs;
931 
932 	cs = PDU_SESSION(request);
933 	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
934 	switch (bhslr->bhslr_reason & 0x7f) {
935 	case BHSLR_REASON_CLOSE_SESSION:
936 	case BHSLR_REASON_CLOSE_CONNECTION:
937 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
938 		if (response == NULL) {
939 			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
940 			icl_pdu_free(request);
941 			cfiscsi_session_terminate(cs);
942 			return;
943 		}
944 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
945 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
946 		bhslr2->bhslr_flags = 0x80;
947 		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
948 		bhslr2->bhslr_initiator_task_tag =
949 		    bhslr->bhslr_initiator_task_tag;
950 		icl_pdu_free(request);
951 		cfiscsi_pdu_queue(response);
952 		cfiscsi_session_terminate(cs);
953 		break;
954 	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
955 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
956 		if (response == NULL) {
957 			CFISCSI_SESSION_WARN(cs,
958 			    "failed to allocate memory; dropping connection");
959 			icl_pdu_free(request);
960 			cfiscsi_session_terminate(cs);
961 			return;
962 		}
963 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
964 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
965 		bhslr2->bhslr_flags = 0x80;
966 		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
967 		bhslr2->bhslr_initiator_task_tag =
968 		    bhslr->bhslr_initiator_task_tag;
969 		icl_pdu_free(request);
970 		cfiscsi_pdu_queue(response);
971 		break;
972 	default:
973 		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
974 		    bhslr->bhslr_reason);
975 		icl_pdu_free(request);
976 		cfiscsi_session_terminate(cs);
977 		break;
978 	}
979 }
980 
981 static void
982 cfiscsi_callout(void *context)
983 {
984 	struct icl_pdu *cp;
985 	struct iscsi_bhs_nop_in *bhsni;
986 	struct cfiscsi_session *cs;
987 
988 	cs = context;
989 
990 	if (cs->cs_terminating)
991 		return;
992 
993 	callout_schedule(&cs->cs_callout, 1 * hz);
994 
995 	atomic_add_int(&cs->cs_timeout, 1);
996 
997 #ifdef ICL_KERNEL_PROXY
998 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
999 		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1000 			CFISCSI_SESSION_WARN(cs, "login timed out after "
1001 			    "%d seconds; dropping connection", cs->cs_timeout);
1002 			cfiscsi_session_terminate(cs);
1003 		}
1004 		return;
1005 	}
1006 #endif
1007 
1008 	if (ping_timeout <= 0) {
1009 		/*
1010 		 * Pings are disabled.  Don't send NOP-In in this case;
1011 		 * user might have disabled pings to work around problems
1012 		 * with certain initiators that can't properly handle
1013 		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1014 		 * triggering reconnection, should the user decide to
1015 		 * reenable them.
1016 		 */
1017 		cs->cs_timeout = 0;
1018 		return;
1019 	}
1020 
1021 	if (cs->cs_timeout >= ping_timeout) {
1022 		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1023 		    "dropping connection",  ping_timeout);
1024 		cfiscsi_session_terminate(cs);
1025 		return;
1026 	}
1027 
1028 	/*
1029 	 * If the ping was reset less than one second ago - which means
1030 	 * that we've received some PDU during the last second - assume
1031 	 * the traffic flows correctly and don't bother sending a NOP-Out.
1032 	 *
1033 	 * (It's 2 - one for one second, and one for incrementing is_timeout
1034 	 * earlier in this routine.)
1035 	 */
1036 	if (cs->cs_timeout < 2)
1037 		return;
1038 
1039 	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1040 	if (cp == NULL) {
1041 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1042 		return;
1043 	}
1044 	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1045 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1046 	bhsni->bhsni_flags = 0x80;
1047 	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1048 
1049 	cfiscsi_pdu_queue(cp);
1050 }
1051 
1052 static struct cfiscsi_data_wait *
1053 cfiscsi_data_wait_new(struct cfiscsi_session *cs, union ctl_io *io,
1054     uint32_t initiator_task_tag, uint32_t *target_transfer_tagp)
1055 {
1056 	struct cfiscsi_data_wait *cdw;
1057 	int error;
1058 
1059 	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
1060 	if (cdw == NULL) {
1061 		CFISCSI_SESSION_WARN(cs,
1062 		    "failed to allocate %zd bytes", sizeof(*cdw));
1063 		return (NULL);
1064 	}
1065 
1066 	error = icl_conn_transfer_setup(cs->cs_conn, io, target_transfer_tagp,
1067 	    &cdw->cdw_icl_prv);
1068 	if (error != 0) {
1069 		CFISCSI_SESSION_WARN(cs,
1070 		    "icl_conn_transfer_setup() failed with error %d", error);
1071 		uma_zfree(cfiscsi_data_wait_zone, cdw);
1072 		return (NULL);
1073 	}
1074 
1075 	cdw->cdw_ctl_io = io;
1076 	cdw->cdw_target_transfer_tag = *target_transfer_tagp;
1077 	cdw->cdw_initiator_task_tag = initiator_task_tag;
1078 
1079 	return (cdw);
1080 }
1081 
1082 static void
1083 cfiscsi_data_wait_free(struct cfiscsi_session *cs,
1084     struct cfiscsi_data_wait *cdw)
1085 {
1086 
1087 	icl_conn_transfer_done(cs->cs_conn, cdw->cdw_icl_prv);
1088 	uma_zfree(cfiscsi_data_wait_zone, cdw);
1089 }
1090 
1091 static void
1092 cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1093 {
1094 	struct cfiscsi_data_wait *cdw;
1095 	union ctl_io *io;
1096 	int error, last, wait;
1097 
1098 	if (cs->cs_target == NULL)
1099 		return;		/* No target yet, so nothing to do. */
1100 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1101 	ctl_zero_io(io);
1102 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = cs;
1103 	io->io_hdr.io_type = CTL_IO_TASK;
1104 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
1105 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1106 	io->io_hdr.nexus.targ_lun = 0;
1107 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1108 	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1109 	wait = cs->cs_outstanding_ctl_pdus;
1110 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1111 	error = ctl_queue(io);
1112 	if (error != CTL_RETVAL_COMPLETE) {
1113 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1114 		refcount_release(&cs->cs_outstanding_ctl_pdus);
1115 		ctl_free_io(io);
1116 	}
1117 
1118 	CFISCSI_SESSION_LOCK(cs);
1119 	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1120 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1121 		CFISCSI_SESSION_UNLOCK(cs);
1122 		/*
1123 		 * Set nonzero port status; this prevents backends from
1124 		 * assuming that the data transfer actually succeeded
1125 		 * and writing uninitialized data to disk.
1126 		 */
1127 		cdw->cdw_ctl_io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
1128 		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1129 		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1130 		cfiscsi_data_wait_free(cs, cdw);
1131 		CFISCSI_SESSION_LOCK(cs);
1132 	}
1133 	CFISCSI_SESSION_UNLOCK(cs);
1134 
1135 	/*
1136 	 * Wait for CTL to terminate all the tasks.
1137 	 */
1138 	if (wait > 0)
1139 		CFISCSI_SESSION_WARN(cs,
1140 		    "waiting for CTL to terminate %d tasks", wait);
1141 	for (;;) {
1142 		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1143 		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1144 		if (last != 0)
1145 			break;
1146 		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1147 		    0, "cfiscsi_terminate", hz / 100);
1148 	}
1149 	if (wait > 0)
1150 		CFISCSI_SESSION_WARN(cs, "tasks terminated");
1151 }
1152 
1153 static void
1154 cfiscsi_maintenance_thread(void *arg)
1155 {
1156 	struct cfiscsi_session *cs;
1157 
1158 	cs = arg;
1159 
1160 	for (;;) {
1161 		CFISCSI_SESSION_LOCK(cs);
1162 		if (cs->cs_terminating == false)
1163 			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1164 		CFISCSI_SESSION_UNLOCK(cs);
1165 
1166 		if (cs->cs_terminating) {
1167 
1168 			/*
1169 			 * We used to wait up to 30 seconds to deliver queued
1170 			 * PDUs to the initiator.  We also tried hard to deliver
1171 			 * SCSI Responses for the aborted PDUs.  We don't do
1172 			 * that anymore.  We might need to revisit that.
1173 			 */
1174 			callout_drain(&cs->cs_callout);
1175 			icl_conn_close(cs->cs_conn);
1176 
1177 			/*
1178 			 * At this point ICL receive thread is no longer
1179 			 * running; no new tasks can be queued.
1180 			 */
1181 			cfiscsi_session_terminate_tasks(cs);
1182 			cfiscsi_session_delete(cs);
1183 			kthread_exit();
1184 			return;
1185 		}
1186 		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1187 	}
1188 }
1189 
1190 static void
1191 cfiscsi_session_terminate(struct cfiscsi_session *cs)
1192 {
1193 
1194 	if (cs->cs_terminating)
1195 		return;
1196 	cs->cs_terminating = true;
1197 	cv_signal(&cs->cs_maintenance_cv);
1198 #ifdef ICL_KERNEL_PROXY
1199 	cv_signal(&cs->cs_login_cv);
1200 #endif
1201 }
1202 
1203 static int
1204 cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1205 {
1206 	struct cfiscsi_target *ct;
1207 	char *name;
1208 	int i;
1209 
1210 	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1211 
1212 	ct = cs->cs_target;
1213 	name = strdup(cs->cs_initiator_id, M_CTL);
1214 	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1215 	if (i < 0) {
1216 		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1217 		    i);
1218 		cs->cs_ctl_initid = -1;
1219 		return (1);
1220 	}
1221 	cs->cs_ctl_initid = i;
1222 #if 0
1223 	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1224 #endif
1225 
1226 	return (0);
1227 }
1228 
1229 static void
1230 cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1231 {
1232 	int error;
1233 
1234 	if (cs->cs_ctl_initid == -1)
1235 		return;
1236 
1237 	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1238 	if (error != 0) {
1239 		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1240 		    error);
1241 	}
1242 	cs->cs_ctl_initid = -1;
1243 }
1244 
1245 static struct cfiscsi_session *
1246 cfiscsi_session_new(struct cfiscsi_softc *softc, const char *offload)
1247 {
1248 	struct cfiscsi_session *cs;
1249 	int error;
1250 
1251 	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1252 	if (cs == NULL) {
1253 		CFISCSI_WARN("malloc failed");
1254 		return (NULL);
1255 	}
1256 	cs->cs_ctl_initid = -1;
1257 
1258 	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1259 	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1260 	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1261 	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1262 #ifdef ICL_KERNEL_PROXY
1263 	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1264 #endif
1265 
1266 	cs->cs_conn = icl_new_conn(offload, "cfiscsi", &cs->cs_lock);
1267 	if (cs->cs_conn == NULL) {
1268 		free(cs, M_CFISCSI);
1269 		return (NULL);
1270 	}
1271 	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1272 	cs->cs_conn->ic_error = cfiscsi_error_callback;
1273 	cs->cs_conn->ic_prv0 = cs;
1274 
1275 	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1276 	if (error != 0) {
1277 		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1278 		free(cs, M_CFISCSI);
1279 		return (NULL);
1280 	}
1281 
1282 	mtx_lock(&softc->lock);
1283 	cs->cs_id = ++softc->last_session_id;
1284 	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1285 	mtx_unlock(&softc->lock);
1286 
1287 	/*
1288 	 * Start pinging the initiator.
1289 	 */
1290 	callout_init(&cs->cs_callout, 1);
1291 	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1292 
1293 	return (cs);
1294 }
1295 
1296 static void
1297 cfiscsi_session_delete(struct cfiscsi_session *cs)
1298 {
1299 	struct cfiscsi_softc *softc;
1300 
1301 	softc = &cfiscsi_softc;
1302 
1303 	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1304 	    ("destroying session with outstanding CTL pdus"));
1305 	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1306 	    ("destroying session with non-empty queue"));
1307 
1308 	cfiscsi_session_unregister_initiator(cs);
1309 	if (cs->cs_target != NULL)
1310 		cfiscsi_target_release(cs->cs_target);
1311 	icl_conn_close(cs->cs_conn);
1312 	icl_conn_free(cs->cs_conn);
1313 
1314 	mtx_lock(&softc->lock);
1315 	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1316 	cv_signal(&softc->sessions_cv);
1317 	mtx_unlock(&softc->lock);
1318 
1319 	free(cs, M_CFISCSI);
1320 }
1321 
1322 int
1323 cfiscsi_init(void)
1324 {
1325 	struct cfiscsi_softc *softc;
1326 
1327 	softc = &cfiscsi_softc;
1328 	bzero(softc, sizeof(*softc));
1329 	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1330 
1331 	cv_init(&softc->sessions_cv, "cfiscsi_sessions");
1332 #ifdef ICL_KERNEL_PROXY
1333 	cv_init(&softc->accept_cv, "cfiscsi_accept");
1334 #endif
1335 	TAILQ_INIT(&softc->sessions);
1336 	TAILQ_INIT(&softc->targets);
1337 
1338 	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1339 	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1340 	    UMA_ALIGN_PTR, 0);
1341 
1342 	return (0);
1343 }
1344 
1345 #ifdef ICL_KERNEL_PROXY
1346 static void
1347 cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1348 {
1349 	struct cfiscsi_session *cs;
1350 
1351 	cs = cfiscsi_session_new(&cfiscsi_softc, NULL);
1352 	if (cs == NULL) {
1353 		CFISCSI_WARN("failed to create session");
1354 		return;
1355 	}
1356 
1357 	icl_conn_handoff_sock(cs->cs_conn, so);
1358 	cs->cs_initiator_sa = sa;
1359 	cs->cs_portal_id = portal_id;
1360 	cs->cs_waiting_for_ctld = true;
1361 	cv_signal(&cfiscsi_softc.accept_cv);
1362 }
1363 #endif
1364 
1365 static void
1366 cfiscsi_online(void *arg)
1367 {
1368 	struct cfiscsi_softc *softc;
1369 	struct cfiscsi_target *ct;
1370 	int online;
1371 
1372 	ct = (struct cfiscsi_target *)arg;
1373 	softc = ct->ct_softc;
1374 
1375 	mtx_lock(&softc->lock);
1376 	if (ct->ct_online) {
1377 		mtx_unlock(&softc->lock);
1378 		return;
1379 	}
1380 	ct->ct_online = 1;
1381 	online = softc->online++;
1382 	mtx_unlock(&softc->lock);
1383 	if (online > 0)
1384 		return;
1385 
1386 #ifdef ICL_KERNEL_PROXY
1387 	if (softc->listener != NULL)
1388 		icl_listen_free(softc->listener);
1389 	softc->listener = icl_listen_new(cfiscsi_accept);
1390 #endif
1391 }
1392 
1393 static void
1394 cfiscsi_offline(void *arg)
1395 {
1396 	struct cfiscsi_softc *softc;
1397 	struct cfiscsi_target *ct;
1398 	struct cfiscsi_session *cs;
1399 	int online;
1400 
1401 	ct = (struct cfiscsi_target *)arg;
1402 	softc = ct->ct_softc;
1403 
1404 	mtx_lock(&softc->lock);
1405 	if (!ct->ct_online) {
1406 		mtx_unlock(&softc->lock);
1407 		return;
1408 	}
1409 	ct->ct_online = 0;
1410 	online = --softc->online;
1411 
1412 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1413 		if (cs->cs_target == ct)
1414 			cfiscsi_session_terminate(cs);
1415 	}
1416 	do {
1417 		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1418 			if (cs->cs_target == ct)
1419 				break;
1420 		}
1421 		if (cs != NULL)
1422 			cv_wait(&softc->sessions_cv, &softc->lock);
1423 	} while (cs != NULL && ct->ct_online == 0);
1424 	mtx_unlock(&softc->lock);
1425 	if (online > 0)
1426 		return;
1427 
1428 #ifdef ICL_KERNEL_PROXY
1429 	icl_listen_free(softc->listener);
1430 	softc->listener = NULL;
1431 #endif
1432 }
1433 
1434 static int
1435 cfiscsi_info(void *arg, struct sbuf *sb)
1436 {
1437 	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1438 	int retval;
1439 
1440 	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1441 	    ct->ct_state);
1442 	return (retval);
1443 }
1444 
1445 static void
1446 cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1447 {
1448 	struct cfiscsi_softc *softc;
1449 	struct cfiscsi_session *cs, *cs2;
1450 	struct cfiscsi_target *ct;
1451 	struct ctl_iscsi_handoff_params *cihp;
1452 	int error;
1453 
1454 	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1455 	softc = &cfiscsi_softc;
1456 
1457 	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1458 	    cihp->initiator_name, cihp->initiator_addr,
1459 	    cihp->target_name);
1460 
1461 	ct = cfiscsi_target_find(softc, cihp->target_name,
1462 	    cihp->portal_group_tag);
1463 	if (ct == NULL) {
1464 		ci->status = CTL_ISCSI_ERROR;
1465 		snprintf(ci->error_str, sizeof(ci->error_str),
1466 		    "%s: target not found", __func__);
1467 		return;
1468 	}
1469 
1470 #ifdef ICL_KERNEL_PROXY
1471 	if (cihp->socket > 0 && cihp->connection_id > 0) {
1472 		snprintf(ci->error_str, sizeof(ci->error_str),
1473 		    "both socket and connection_id set");
1474 		ci->status = CTL_ISCSI_ERROR;
1475 		cfiscsi_target_release(ct);
1476 		return;
1477 	}
1478 	if (cihp->socket == 0) {
1479 		mtx_lock(&cfiscsi_softc.lock);
1480 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1481 			if (cs->cs_id == cihp->connection_id)
1482 				break;
1483 		}
1484 		if (cs == NULL) {
1485 			mtx_unlock(&cfiscsi_softc.lock);
1486 			snprintf(ci->error_str, sizeof(ci->error_str),
1487 			    "connection not found");
1488 			ci->status = CTL_ISCSI_ERROR;
1489 			cfiscsi_target_release(ct);
1490 			return;
1491 		}
1492 		mtx_unlock(&cfiscsi_softc.lock);
1493 	} else {
1494 #endif
1495 		cs = cfiscsi_session_new(softc, cihp->offload);
1496 		if (cs == NULL) {
1497 			ci->status = CTL_ISCSI_ERROR;
1498 			snprintf(ci->error_str, sizeof(ci->error_str),
1499 			    "%s: cfiscsi_session_new failed", __func__);
1500 			cfiscsi_target_release(ct);
1501 			return;
1502 		}
1503 #ifdef ICL_KERNEL_PROXY
1504 	}
1505 #endif
1506 
1507 	/*
1508 	 * First PDU of Full Feature phase has the same CmdSN as the last
1509 	 * PDU from the Login Phase received from the initiator.  Thus,
1510 	 * the -1 below.
1511 	 */
1512 	cs->cs_cmdsn = cihp->cmdsn;
1513 	cs->cs_statsn = cihp->statsn;
1514 	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1515 	cs->cs_max_burst_length = cihp->max_burst_length;
1516 	cs->cs_immediate_data = !!cihp->immediate_data;
1517 	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1518 		cs->cs_conn->ic_header_crc32c = true;
1519 	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1520 		cs->cs_conn->ic_data_crc32c = true;
1521 
1522 	strlcpy(cs->cs_initiator_name,
1523 	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1524 	strlcpy(cs->cs_initiator_addr,
1525 	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1526 	strlcpy(cs->cs_initiator_alias,
1527 	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1528 	memcpy(cs->cs_initiator_isid,
1529 	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1530 	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1531 	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1532 	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1533 	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1534 	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1535 
1536 	mtx_lock(&softc->lock);
1537 	if (ct->ct_online == 0) {
1538 		mtx_unlock(&softc->lock);
1539 		cfiscsi_session_terminate(cs);
1540 		cfiscsi_target_release(ct);
1541 		ci->status = CTL_ISCSI_ERROR;
1542 		snprintf(ci->error_str, sizeof(ci->error_str),
1543 		    "%s: port offline", __func__);
1544 		return;
1545 	}
1546 	cs->cs_target = ct;
1547 	mtx_unlock(&softc->lock);
1548 
1549 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1550 restart:
1551 	if (!cs->cs_terminating) {
1552 		mtx_lock(&softc->lock);
1553 		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1554 			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1555 			    cs->cs_target == cs2->cs_target &&
1556 			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1557 				if (strcmp(cs->cs_initiator_addr,
1558 				    cs2->cs_initiator_addr) != 0) {
1559 					CFISCSI_SESSION_WARN(cs2,
1560 					    "session reinstatement from "
1561 					    "different address %s",
1562 					    cs->cs_initiator_addr);
1563 				} else {
1564 					CFISCSI_SESSION_DEBUG(cs2,
1565 					    "session reinstatement");
1566 				}
1567 				cfiscsi_session_terminate(cs2);
1568 				mtx_unlock(&softc->lock);
1569 				pause("cfiscsi_reinstate", 1);
1570 				goto restart;
1571 			}
1572 		}
1573 		mtx_unlock(&softc->lock);
1574 	}
1575 
1576 	/*
1577 	 * Register initiator with CTL.
1578 	 */
1579 	cfiscsi_session_register_initiator(cs);
1580 
1581 #ifdef ICL_KERNEL_PROXY
1582 	if (cihp->socket > 0) {
1583 #endif
1584 		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1585 		if (error != 0) {
1586 			cfiscsi_session_terminate(cs);
1587 			refcount_release(&cs->cs_outstanding_ctl_pdus);
1588 			ci->status = CTL_ISCSI_ERROR;
1589 			snprintf(ci->error_str, sizeof(ci->error_str),
1590 			    "%s: icl_conn_handoff failed with error %d",
1591 			    __func__, error);
1592 			return;
1593 		}
1594 #ifdef ICL_KERNEL_PROXY
1595 	}
1596 #endif
1597 
1598 #ifdef ICL_KERNEL_PROXY
1599 	cs->cs_login_phase = false;
1600 
1601 	/*
1602 	 * First PDU of the Full Feature phase has likely already arrived.
1603 	 * We have to pick it up and execute properly.
1604 	 */
1605 	if (cs->cs_login_pdu != NULL) {
1606 		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1607 		cfiscsi_pdu_handle(cs->cs_login_pdu);
1608 		cs->cs_login_pdu = NULL;
1609 	}
1610 #endif
1611 
1612 	refcount_release(&cs->cs_outstanding_ctl_pdus);
1613 	ci->status = CTL_ISCSI_OK;
1614 }
1615 
1616 static void
1617 cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1618 {
1619 	struct ctl_iscsi_list_params *cilp;
1620 	struct cfiscsi_session *cs;
1621 	struct cfiscsi_softc *softc;
1622 	struct sbuf *sb;
1623 	int error;
1624 
1625 	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1626 	softc = &cfiscsi_softc;
1627 
1628 	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1629 	if (sb == NULL) {
1630 		ci->status = CTL_ISCSI_ERROR;
1631 		snprintf(ci->error_str, sizeof(ci->error_str),
1632 		    "Unable to allocate %d bytes for iSCSI session list",
1633 		    cilp->alloc_len);
1634 		return;
1635 	}
1636 
1637 	sbuf_printf(sb, "<ctlislist>\n");
1638 	mtx_lock(&softc->lock);
1639 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1640 #ifdef ICL_KERNEL_PROXY
1641 		if (cs->cs_target == NULL)
1642 			continue;
1643 #endif
1644 		error = sbuf_printf(sb, "<connection id=\"%d\">"
1645 		    "<initiator>%s</initiator>"
1646 		    "<initiator_addr>%s</initiator_addr>"
1647 		    "<initiator_alias>%s</initiator_alias>"
1648 		    "<target>%s</target>"
1649 		    "<target_alias>%s</target_alias>"
1650 		    "<target_portal_group_tag>%u</target_portal_group_tag>"
1651 		    "<header_digest>%s</header_digest>"
1652 		    "<data_digest>%s</data_digest>"
1653 		    "<max_data_segment_length>%zd</max_data_segment_length>"
1654 		    "<immediate_data>%d</immediate_data>"
1655 		    "<iser>%d</iser>"
1656 		    "<offload>%s</offload>"
1657 		    "</connection>\n",
1658 		    cs->cs_id,
1659 		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1660 		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1661 		    cs->cs_target->ct_tag,
1662 		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1663 		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1664 		    cs->cs_max_data_segment_length,
1665 		    cs->cs_immediate_data,
1666 		    cs->cs_conn->ic_iser,
1667 		    cs->cs_conn->ic_offload);
1668 		if (error != 0)
1669 			break;
1670 	}
1671 	mtx_unlock(&softc->lock);
1672 	error = sbuf_printf(sb, "</ctlislist>\n");
1673 	if (error != 0) {
1674 		sbuf_delete(sb);
1675 		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1676 		snprintf(ci->error_str, sizeof(ci->error_str),
1677 		    "Out of space, %d bytes is too small", cilp->alloc_len);
1678 		return;
1679 	}
1680 	sbuf_finish(sb);
1681 
1682 	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1683 	cilp->fill_len = sbuf_len(sb) + 1;
1684 	ci->status = CTL_ISCSI_OK;
1685 	sbuf_delete(sb);
1686 }
1687 
1688 static void
1689 cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1690 {
1691 	struct icl_pdu *response;
1692 	struct iscsi_bhs_asynchronous_message *bhsam;
1693 	struct ctl_iscsi_logout_params *cilp;
1694 	struct cfiscsi_session *cs;
1695 	struct cfiscsi_softc *softc;
1696 	int found = 0;
1697 
1698 	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1699 	softc = &cfiscsi_softc;
1700 
1701 	mtx_lock(&softc->lock);
1702 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1703 		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1704 		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1705 		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1706 			continue;
1707 
1708 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1709 		if (response == NULL) {
1710 			ci->status = CTL_ISCSI_ERROR;
1711 			snprintf(ci->error_str, sizeof(ci->error_str),
1712 			    "Unable to allocate memory");
1713 			mtx_unlock(&softc->lock);
1714 			return;
1715 		}
1716 		bhsam =
1717 		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1718 		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1719 		bhsam->bhsam_flags = 0x80;
1720 		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1721 		bhsam->bhsam_parameter3 = htons(10);
1722 		cfiscsi_pdu_queue(response);
1723 		found++;
1724 	}
1725 	mtx_unlock(&softc->lock);
1726 
1727 	if (found == 0) {
1728 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1729 		snprintf(ci->error_str, sizeof(ci->error_str),
1730 		    "No matching connections found");
1731 		return;
1732 	}
1733 
1734 	ci->status = CTL_ISCSI_OK;
1735 }
1736 
1737 static void
1738 cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1739 {
1740 	struct icl_pdu *response;
1741 	struct iscsi_bhs_asynchronous_message *bhsam;
1742 	struct ctl_iscsi_terminate_params *citp;
1743 	struct cfiscsi_session *cs;
1744 	struct cfiscsi_softc *softc;
1745 	int found = 0;
1746 
1747 	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1748 	softc = &cfiscsi_softc;
1749 
1750 	mtx_lock(&softc->lock);
1751 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1752 		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1753 		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1754 		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1755 			continue;
1756 
1757 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1758 		if (response == NULL) {
1759 			/*
1760 			 * Oh well.  Just terminate the connection.
1761 			 */
1762 		} else {
1763 			bhsam = (struct iscsi_bhs_asynchronous_message *)
1764 			    response->ip_bhs;
1765 			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1766 			bhsam->bhsam_flags = 0x80;
1767 			bhsam->bhsam_0xffffffff = 0xffffffff;
1768 			bhsam->bhsam_async_event =
1769 			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1770 			cfiscsi_pdu_queue(response);
1771 		}
1772 		cfiscsi_session_terminate(cs);
1773 		found++;
1774 	}
1775 	mtx_unlock(&softc->lock);
1776 
1777 	if (found == 0) {
1778 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1779 		snprintf(ci->error_str, sizeof(ci->error_str),
1780 		    "No matching connections found");
1781 		return;
1782 	}
1783 
1784 	ci->status = CTL_ISCSI_OK;
1785 }
1786 
1787 static void
1788 cfiscsi_ioctl_limits(struct ctl_iscsi *ci)
1789 {
1790 	struct ctl_iscsi_limits_params *cilp;
1791 	int error;
1792 
1793 	cilp = (struct ctl_iscsi_limits_params *)&(ci->data);
1794 
1795 	error = icl_limits(cilp->offload, &cilp->data_segment_limit);
1796 	if (error != 0) {
1797 		ci->status = CTL_ISCSI_ERROR;
1798 		snprintf(ci->error_str, sizeof(ci->error_str),
1799 			"%s: icl_limits failed with error %d",
1800 			__func__, error);
1801 		return;
1802 	}
1803 
1804 	ci->status = CTL_ISCSI_OK;
1805 }
1806 
1807 #ifdef ICL_KERNEL_PROXY
1808 static void
1809 cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1810 {
1811 	struct ctl_iscsi_listen_params *cilp;
1812 	struct sockaddr *sa;
1813 	int error;
1814 
1815 	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1816 
1817 	if (cfiscsi_softc.listener == NULL) {
1818 		CFISCSI_DEBUG("no listener");
1819 		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1820 		ci->status = CTL_ISCSI_ERROR;
1821 		return;
1822 	}
1823 
1824 	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1825 	if (error != 0) {
1826 		CFISCSI_DEBUG("getsockaddr, error %d", error);
1827 		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1828 		ci->status = CTL_ISCSI_ERROR;
1829 		return;
1830 	}
1831 
1832 	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1833 	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1834 	if (error != 0) {
1835 		free(sa, M_SONAME);
1836 		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1837 		snprintf(ci->error_str, sizeof(ci->error_str),
1838 		    "icl_listen_add failed, error %d", error);
1839 		ci->status = CTL_ISCSI_ERROR;
1840 		return;
1841 	}
1842 
1843 	ci->status = CTL_ISCSI_OK;
1844 }
1845 
1846 static void
1847 cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1848 {
1849 	struct ctl_iscsi_accept_params *ciap;
1850 	struct cfiscsi_session *cs;
1851 	int error;
1852 
1853 	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1854 
1855 	mtx_lock(&cfiscsi_softc.lock);
1856 	for (;;) {
1857 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1858 			if (cs->cs_waiting_for_ctld)
1859 				break;
1860 		}
1861 		if (cs != NULL)
1862 			break;
1863 		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1864 		if (error != 0) {
1865 			mtx_unlock(&cfiscsi_softc.lock);
1866 			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1867 			ci->status = CTL_ISCSI_ERROR;
1868 			return;
1869 		}
1870 	}
1871 	mtx_unlock(&cfiscsi_softc.lock);
1872 
1873 	cs->cs_waiting_for_ctld = false;
1874 	cs->cs_login_phase = true;
1875 
1876 	ciap->connection_id = cs->cs_id;
1877 	ciap->portal_id = cs->cs_portal_id;
1878 	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1879 	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1880 	    cs->cs_initiator_sa->sa_len);
1881 	if (error != 0) {
1882 		snprintf(ci->error_str, sizeof(ci->error_str),
1883 		    "copyout failed with error %d", error);
1884 		ci->status = CTL_ISCSI_ERROR;
1885 		return;
1886 	}
1887 
1888 	ci->status = CTL_ISCSI_OK;
1889 }
1890 
1891 static void
1892 cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1893 {
1894 	struct ctl_iscsi_send_params *cisp;
1895 	struct cfiscsi_session *cs;
1896 	struct icl_pdu *ip;
1897 	size_t datalen;
1898 	void *data;
1899 	int error;
1900 
1901 	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1902 
1903 	mtx_lock(&cfiscsi_softc.lock);
1904 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1905 		if (cs->cs_id == cisp->connection_id)
1906 			break;
1907 	}
1908 	if (cs == NULL) {
1909 		mtx_unlock(&cfiscsi_softc.lock);
1910 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1911 		ci->status = CTL_ISCSI_ERROR;
1912 		return;
1913 	}
1914 	mtx_unlock(&cfiscsi_softc.lock);
1915 
1916 #if 0
1917 	if (cs->cs_login_phase == false)
1918 		return (EBUSY);
1919 #endif
1920 
1921 	if (cs->cs_terminating) {
1922 		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1923 		ci->status = CTL_ISCSI_ERROR;
1924 		return;
1925 	}
1926 
1927 	datalen = cisp->data_segment_len;
1928 	/*
1929 	 * XXX
1930 	 */
1931 	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1932 	if (datalen > 65535) {
1933 		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1934 		ci->status = CTL_ISCSI_ERROR;
1935 		return;
1936 	}
1937 	if (datalen > 0) {
1938 		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1939 		error = copyin(cisp->data_segment, data, datalen);
1940 		if (error != 0) {
1941 			free(data, M_CFISCSI);
1942 			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1943 			ci->status = CTL_ISCSI_ERROR;
1944 			return;
1945 		}
1946 	}
1947 
1948 	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
1949 	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1950 	if (datalen > 0) {
1951 		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1952 		free(data, M_CFISCSI);
1953 	}
1954 	CFISCSI_SESSION_LOCK(cs);
1955 	icl_pdu_queue(ip);
1956 	CFISCSI_SESSION_UNLOCK(cs);
1957 	ci->status = CTL_ISCSI_OK;
1958 }
1959 
1960 static void
1961 cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1962 {
1963 	struct ctl_iscsi_receive_params *cirp;
1964 	struct cfiscsi_session *cs;
1965 	struct icl_pdu *ip;
1966 	void *data;
1967 	int error;
1968 
1969 	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1970 
1971 	mtx_lock(&cfiscsi_softc.lock);
1972 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1973 		if (cs->cs_id == cirp->connection_id)
1974 			break;
1975 	}
1976 	if (cs == NULL) {
1977 		mtx_unlock(&cfiscsi_softc.lock);
1978 		snprintf(ci->error_str, sizeof(ci->error_str),
1979 		    "connection not found");
1980 		ci->status = CTL_ISCSI_ERROR;
1981 		return;
1982 	}
1983 	mtx_unlock(&cfiscsi_softc.lock);
1984 
1985 #if 0
1986 	if (is->is_login_phase == false)
1987 		return (EBUSY);
1988 #endif
1989 
1990 	CFISCSI_SESSION_LOCK(cs);
1991 	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
1992 		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
1993 		if (error != 0) {
1994 			CFISCSI_SESSION_UNLOCK(cs);
1995 			snprintf(ci->error_str, sizeof(ci->error_str),
1996 			    "interrupted by signal");
1997 			ci->status = CTL_ISCSI_ERROR;
1998 			return;
1999 		}
2000 	}
2001 
2002 	if (cs->cs_terminating) {
2003 		CFISCSI_SESSION_UNLOCK(cs);
2004 		snprintf(ci->error_str, sizeof(ci->error_str),
2005 		    "connection terminating");
2006 		ci->status = CTL_ISCSI_ERROR;
2007 		return;
2008 	}
2009 	ip = cs->cs_login_pdu;
2010 	cs->cs_login_pdu = NULL;
2011 	CFISCSI_SESSION_UNLOCK(cs);
2012 
2013 	if (ip->ip_data_len > cirp->data_segment_len) {
2014 		icl_pdu_free(ip);
2015 		snprintf(ci->error_str, sizeof(ci->error_str),
2016 		    "data segment too big");
2017 		ci->status = CTL_ISCSI_ERROR;
2018 		return;
2019 	}
2020 
2021 	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
2022 	if (ip->ip_data_len > 0) {
2023 		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
2024 		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
2025 		copyout(data, cirp->data_segment, ip->ip_data_len);
2026 		free(data, M_CFISCSI);
2027 	}
2028 
2029 	icl_pdu_free(ip);
2030 	ci->status = CTL_ISCSI_OK;
2031 }
2032 
2033 #endif /* !ICL_KERNEL_PROXY */
2034 
2035 static void
2036 cfiscsi_ioctl_port_create(struct ctl_req *req)
2037 {
2038 	struct cfiscsi_target *ct;
2039 	struct ctl_port *port;
2040 	const char *target, *alias, *tags;
2041 	struct scsi_vpd_id_descriptor *desc;
2042 	ctl_options_t opts;
2043 	int retval, len, idlen;
2044 	uint16_t tag;
2045 
2046 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2047 	target = ctl_get_opt(&opts, "cfiscsi_target");
2048 	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
2049 	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2050 	if (target == NULL || tags == NULL) {
2051 		req->status = CTL_LUN_ERROR;
2052 		snprintf(req->error_str, sizeof(req->error_str),
2053 		    "Missing required argument");
2054 		ctl_free_opts(&opts);
2055 		return;
2056 	}
2057 	tag = strtol(tags, (char **)NULL, 10);
2058 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias, tag);
2059 	if (ct == NULL) {
2060 		req->status = CTL_LUN_ERROR;
2061 		snprintf(req->error_str, sizeof(req->error_str),
2062 		    "failed to create target \"%s\"", target);
2063 		ctl_free_opts(&opts);
2064 		return;
2065 	}
2066 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
2067 		req->status = CTL_LUN_ERROR;
2068 		snprintf(req->error_str, sizeof(req->error_str),
2069 		    "target \"%s\" already exists", target);
2070 		cfiscsi_target_release(ct);
2071 		ctl_free_opts(&opts);
2072 		return;
2073 	}
2074 	port = &ct->ct_port;
2075 	// WAT
2076 	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
2077 		goto done;
2078 
2079 	port->frontend = &cfiscsi_frontend;
2080 	port->port_type = CTL_PORT_ISCSI;
2081 	/* XXX KDM what should the real number be here? */
2082 	port->num_requested_ctl_io = 4096;
2083 	port->port_name = "iscsi";
2084 	port->physical_port = tag;
2085 	port->virtual_port = ct->ct_target_id;
2086 	port->port_online = cfiscsi_online;
2087 	port->port_offline = cfiscsi_offline;
2088 	port->port_info = cfiscsi_info;
2089 	port->onoff_arg = ct;
2090 	port->fe_datamove = cfiscsi_datamove;
2091 	port->fe_done = cfiscsi_done;
2092 
2093 	/* XXX KDM what should we report here? */
2094 	/* XXX These should probably be fetched from CTL. */
2095 	port->max_targets = 1;
2096 	port->max_target_id = 15;
2097 	port->targ_port = -1;
2098 
2099 	port->options = opts;
2100 	STAILQ_INIT(&opts);
2101 
2102 	/* Generate Port ID. */
2103 	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2104 	idlen = roundup2(idlen, 4);
2105 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2106 	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2107 	    M_CTL, M_WAITOK | M_ZERO);
2108 	port->port_devid->len = len;
2109 	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2110 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2111 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2112 	    SVPD_ID_TYPE_SCSI_NAME;
2113 	desc->length = idlen;
2114 	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x", target, tag);
2115 
2116 	/* Generate Target ID. */
2117 	idlen = strlen(target) + 1;
2118 	idlen = roundup2(idlen, 4);
2119 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2120 	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2121 	    M_CTL, M_WAITOK | M_ZERO);
2122 	port->target_devid->len = len;
2123 	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2124 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2125 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2126 	    SVPD_ID_TYPE_SCSI_NAME;
2127 	desc->length = idlen;
2128 	strlcpy(desc->identifier, target, idlen);
2129 
2130 	retval = ctl_port_register(port);
2131 	if (retval != 0) {
2132 		ctl_free_opts(&port->options);
2133 		cfiscsi_target_release(ct);
2134 		free(port->port_devid, M_CFISCSI);
2135 		free(port->target_devid, M_CFISCSI);
2136 		req->status = CTL_LUN_ERROR;
2137 		snprintf(req->error_str, sizeof(req->error_str),
2138 		    "ctl_port_register() failed with error %d", retval);
2139 		return;
2140 	}
2141 done:
2142 	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2143 	req->status = CTL_LUN_OK;
2144 	memcpy(req->kern_args[0].kvalue, &port->targ_port,
2145 	    sizeof(port->targ_port)); //XXX
2146 }
2147 
2148 static void
2149 cfiscsi_ioctl_port_remove(struct ctl_req *req)
2150 {
2151 	struct cfiscsi_target *ct;
2152 	const char *target, *tags;
2153 	ctl_options_t opts;
2154 	uint16_t tag;
2155 
2156 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2157 	target = ctl_get_opt(&opts, "cfiscsi_target");
2158 	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2159 	if (target == NULL || tags == NULL) {
2160 		ctl_free_opts(&opts);
2161 		req->status = CTL_LUN_ERROR;
2162 		snprintf(req->error_str, sizeof(req->error_str),
2163 		    "Missing required argument");
2164 		return;
2165 	}
2166 	tag = strtol(tags, (char **)NULL, 10);
2167 	ct = cfiscsi_target_find(&cfiscsi_softc, target, tag);
2168 	if (ct == NULL) {
2169 		ctl_free_opts(&opts);
2170 		req->status = CTL_LUN_ERROR;
2171 		snprintf(req->error_str, sizeof(req->error_str),
2172 		    "can't find target \"%s\"", target);
2173 		return;
2174 	}
2175 	if (ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE) {
2176 		ctl_free_opts(&opts);
2177 		req->status = CTL_LUN_ERROR;
2178 		snprintf(req->error_str, sizeof(req->error_str),
2179 		    "target \"%s\" is already dying", target);
2180 		return;
2181 	}
2182 	ctl_free_opts(&opts);
2183 
2184 	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2185 	ctl_port_offline(&ct->ct_port);
2186 	cfiscsi_target_release(ct);
2187 	cfiscsi_target_release(ct);
2188 	req->status = CTL_LUN_OK;
2189 }
2190 
2191 static int
2192 cfiscsi_ioctl(struct cdev *dev,
2193     u_long cmd, caddr_t addr, int flag, struct thread *td)
2194 {
2195 	struct ctl_iscsi *ci;
2196 	struct ctl_req *req;
2197 
2198 	if (cmd == CTL_PORT_REQ) {
2199 		req = (struct ctl_req *)addr;
2200 		switch (req->reqtype) {
2201 		case CTL_REQ_CREATE:
2202 			cfiscsi_ioctl_port_create(req);
2203 			break;
2204 		case CTL_REQ_REMOVE:
2205 			cfiscsi_ioctl_port_remove(req);
2206 			break;
2207 		default:
2208 			req->status = CTL_LUN_ERROR;
2209 			snprintf(req->error_str, sizeof(req->error_str),
2210 			    "Unsupported request type %d", req->reqtype);
2211 		}
2212 		return (0);
2213 	}
2214 
2215 	if (cmd != CTL_ISCSI)
2216 		return (ENOTTY);
2217 
2218 	ci = (struct ctl_iscsi *)addr;
2219 	switch (ci->type) {
2220 	case CTL_ISCSI_HANDOFF:
2221 		cfiscsi_ioctl_handoff(ci);
2222 		break;
2223 	case CTL_ISCSI_LIST:
2224 		cfiscsi_ioctl_list(ci);
2225 		break;
2226 	case CTL_ISCSI_LOGOUT:
2227 		cfiscsi_ioctl_logout(ci);
2228 		break;
2229 	case CTL_ISCSI_TERMINATE:
2230 		cfiscsi_ioctl_terminate(ci);
2231 		break;
2232 	case CTL_ISCSI_LIMITS:
2233 		cfiscsi_ioctl_limits(ci);
2234 		break;
2235 #ifdef ICL_KERNEL_PROXY
2236 	case CTL_ISCSI_LISTEN:
2237 		cfiscsi_ioctl_listen(ci);
2238 		break;
2239 	case CTL_ISCSI_ACCEPT:
2240 		cfiscsi_ioctl_accept(ci);
2241 		break;
2242 	case CTL_ISCSI_SEND:
2243 		cfiscsi_ioctl_send(ci);
2244 		break;
2245 	case CTL_ISCSI_RECEIVE:
2246 		cfiscsi_ioctl_receive(ci);
2247 		break;
2248 #else
2249 	case CTL_ISCSI_LISTEN:
2250 	case CTL_ISCSI_ACCEPT:
2251 	case CTL_ISCSI_SEND:
2252 	case CTL_ISCSI_RECEIVE:
2253 		ci->status = CTL_ISCSI_ERROR;
2254 		snprintf(ci->error_str, sizeof(ci->error_str),
2255 		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2256 		    __func__);
2257 		break;
2258 #endif /* !ICL_KERNEL_PROXY */
2259 	default:
2260 		ci->status = CTL_ISCSI_ERROR;
2261 		snprintf(ci->error_str, sizeof(ci->error_str),
2262 		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2263 		break;
2264 	}
2265 
2266 	return (0);
2267 }
2268 
2269 static void
2270 cfiscsi_target_hold(struct cfiscsi_target *ct)
2271 {
2272 
2273 	refcount_acquire(&ct->ct_refcount);
2274 }
2275 
2276 static void
2277 cfiscsi_target_release(struct cfiscsi_target *ct)
2278 {
2279 	struct cfiscsi_softc *softc;
2280 
2281 	softc = ct->ct_softc;
2282 	mtx_lock(&softc->lock);
2283 	if (refcount_release(&ct->ct_refcount)) {
2284 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2285 		mtx_unlock(&softc->lock);
2286 		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2287 			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2288 			if (ctl_port_deregister(&ct->ct_port) != 0)
2289 				printf("%s: ctl_port_deregister() failed\n",
2290 				    __func__);
2291 		}
2292 		free(ct, M_CFISCSI);
2293 
2294 		return;
2295 	}
2296 	mtx_unlock(&softc->lock);
2297 }
2298 
2299 static struct cfiscsi_target *
2300 cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name, uint16_t tag)
2301 {
2302 	struct cfiscsi_target *ct;
2303 
2304 	mtx_lock(&softc->lock);
2305 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2306 		if (ct->ct_tag != tag ||
2307 		    strcmp(name, ct->ct_name) != 0 ||
2308 		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2309 			continue;
2310 		cfiscsi_target_hold(ct);
2311 		mtx_unlock(&softc->lock);
2312 		return (ct);
2313 	}
2314 	mtx_unlock(&softc->lock);
2315 
2316 	return (NULL);
2317 }
2318 
2319 static struct cfiscsi_target *
2320 cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2321     const char *alias, uint16_t tag)
2322 {
2323 	struct cfiscsi_target *ct, *newct;
2324 
2325 	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2326 		return (NULL);
2327 
2328 	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2329 
2330 	mtx_lock(&softc->lock);
2331 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2332 		if (ct->ct_tag != tag ||
2333 		    strcmp(name, ct->ct_name) != 0 ||
2334 		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2335 			continue;
2336 		cfiscsi_target_hold(ct);
2337 		mtx_unlock(&softc->lock);
2338 		free(newct, M_CFISCSI);
2339 		return (ct);
2340 	}
2341 
2342 	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2343 	if (alias != NULL)
2344 		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2345 	newct->ct_tag = tag;
2346 	refcount_init(&newct->ct_refcount, 1);
2347 	newct->ct_softc = softc;
2348 	if (TAILQ_EMPTY(&softc->targets))
2349 		softc->last_target_id = 0;
2350 	newct->ct_target_id = ++softc->last_target_id;
2351 	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2352 	mtx_unlock(&softc->lock);
2353 
2354 	return (newct);
2355 }
2356 
2357 static void
2358 cfiscsi_datamove_in(union ctl_io *io)
2359 {
2360 	struct cfiscsi_session *cs;
2361 	struct icl_pdu *request, *response;
2362 	const struct iscsi_bhs_scsi_command *bhssc;
2363 	struct iscsi_bhs_data_in *bhsdi;
2364 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2365 	size_t len, expected_len, sg_len, buffer_offset;
2366 	const char *sg_addr;
2367 	int ctl_sg_count, error, i;
2368 
2369 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2370 	cs = PDU_SESSION(request);
2371 
2372 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2373 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2374 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2375 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2376 
2377 	if (io->scsiio.kern_sg_entries > 0) {
2378 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2379 		ctl_sg_count = io->scsiio.kern_sg_entries;
2380 	} else {
2381 		ctl_sglist = &ctl_sg_entry;
2382 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2383 		ctl_sglist->len = io->scsiio.kern_data_len;
2384 		ctl_sg_count = 1;
2385 	}
2386 
2387 	/*
2388 	 * This is the total amount of data to be transferred within the current
2389 	 * SCSI command.  We need to record it so that we can properly report
2390 	 * underflow/underflow.
2391 	 */
2392 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2393 
2394 	/*
2395 	 * This is the offset within the current SCSI command; for the first
2396 	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2397 	 * it will be the sum of lengths of previous ones.
2398 	 */
2399 	buffer_offset = io->scsiio.kern_rel_offset;
2400 
2401 	/*
2402 	 * This is the transfer length expected by the initiator.  In theory,
2403 	 * it could be different from the correct amount of data from the SCSI
2404 	 * point of view, even if that doesn't make any sense.
2405 	 */
2406 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2407 #if 0
2408 	if (expected_len != io->scsiio.kern_total_len) {
2409 		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2410 		    "actual length %zd", expected_len,
2411 		    (size_t)io->scsiio.kern_total_len);
2412 	}
2413 #endif
2414 
2415 	if (buffer_offset >= expected_len) {
2416 #if 0
2417 		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2418 		    "already sent the expected len", buffer_offset);
2419 #endif
2420 		io->scsiio.be_move_done(io);
2421 		return;
2422 	}
2423 
2424 	i = 0;
2425 	sg_addr = NULL;
2426 	sg_len = 0;
2427 	response = NULL;
2428 	bhsdi = NULL;
2429 	for (;;) {
2430 		if (response == NULL) {
2431 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2432 			if (response == NULL) {
2433 				CFISCSI_SESSION_WARN(cs, "failed to "
2434 				    "allocate memory; dropping connection");
2435 				ctl_set_busy(&io->scsiio);
2436 				io->scsiio.be_move_done(io);
2437 				cfiscsi_session_terminate(cs);
2438 				return;
2439 			}
2440 			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2441 			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2442 			bhsdi->bhsdi_initiator_task_tag =
2443 			    bhssc->bhssc_initiator_task_tag;
2444 			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2445 			PDU_EXPDATASN(request)++;
2446 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2447 		}
2448 
2449 		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2450 		if (sg_len == 0) {
2451 			sg_addr = ctl_sglist[i].addr;
2452 			sg_len = ctl_sglist[i].len;
2453 			KASSERT(sg_len > 0, ("sg_len <= 0"));
2454 		}
2455 
2456 		len = sg_len;
2457 
2458 		/*
2459 		 * Truncate to maximum data segment length.
2460 		 */
2461 		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2462 		    ("ip_data_len %zd >= max_data_segment_length %zd",
2463 		    response->ip_data_len, cs->cs_max_data_segment_length));
2464 		if (response->ip_data_len + len >
2465 		    cs->cs_max_data_segment_length) {
2466 			len = cs->cs_max_data_segment_length -
2467 			    response->ip_data_len;
2468 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2469 			    len, sg_len));
2470 		}
2471 
2472 		/*
2473 		 * Truncate to expected data transfer length.
2474 		 */
2475 		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2476 		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2477 		    buffer_offset, response->ip_data_len, expected_len));
2478 		if (buffer_offset + response->ip_data_len + len > expected_len) {
2479 			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2480 			    "to expected data transfer length %zd",
2481 			    buffer_offset + response->ip_data_len + len, expected_len);
2482 			len = expected_len - (buffer_offset + response->ip_data_len);
2483 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2484 			    len, sg_len));
2485 		}
2486 
2487 		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2488 		if (error != 0) {
2489 			CFISCSI_SESSION_WARN(cs, "failed to "
2490 			    "allocate memory; dropping connection");
2491 			icl_pdu_free(response);
2492 			ctl_set_busy(&io->scsiio);
2493 			io->scsiio.be_move_done(io);
2494 			cfiscsi_session_terminate(cs);
2495 			return;
2496 		}
2497 		sg_addr += len;
2498 		sg_len -= len;
2499 
2500 		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2501 		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2502 		    buffer_offset, response->ip_data_len, expected_len));
2503 		if (buffer_offset + response->ip_data_len == expected_len) {
2504 			/*
2505 			 * Already have the amount of data the initiator wanted.
2506 			 */
2507 			break;
2508 		}
2509 
2510 		if (sg_len == 0) {
2511 			/*
2512 			 * End of scatter-gather segment;
2513 			 * proceed to the next one...
2514 			 */
2515 			if (i == ctl_sg_count - 1) {
2516 				/*
2517 				 * ... unless this was the last one.
2518 				 */
2519 				break;
2520 			}
2521 			i++;
2522 		}
2523 
2524 		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2525 			/*
2526 			 * Can't stuff more data into the current PDU;
2527 			 * queue it.  Note that's not enough to check
2528 			 * for kern_data_resid == 0 instead; there
2529 			 * may be several Data-In PDUs for the final
2530 			 * call to cfiscsi_datamove(), and we want
2531 			 * to set the F flag only on the last of them.
2532 			 */
2533 			buffer_offset += response->ip_data_len;
2534 			if (buffer_offset == io->scsiio.kern_total_len ||
2535 			    buffer_offset == expected_len) {
2536 				buffer_offset -= response->ip_data_len;
2537 				break;
2538 			}
2539 			cfiscsi_pdu_queue(response);
2540 			response = NULL;
2541 			bhsdi = NULL;
2542 		}
2543 	}
2544 	if (response != NULL) {
2545 		buffer_offset += response->ip_data_len;
2546 		if (buffer_offset == io->scsiio.kern_total_len ||
2547 		    buffer_offset == expected_len) {
2548 			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2549 			if (io->io_hdr.status == CTL_SUCCESS) {
2550 				bhsdi->bhsdi_flags |= BHSDI_FLAGS_S;
2551 				if (PDU_TOTAL_TRANSFER_LEN(request) <
2552 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2553 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2554 					bhsdi->bhsdi_residual_count =
2555 					    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2556 					    PDU_TOTAL_TRANSFER_LEN(request));
2557 				} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2558 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2559 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2560 					bhsdi->bhsdi_residual_count =
2561 					    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2562 					    ntohl(bhssc->bhssc_expected_data_transfer_length));
2563 				}
2564 				bhsdi->bhsdi_status = io->scsiio.scsi_status;
2565 				io->io_hdr.flags |= CTL_FLAG_STATUS_SENT;
2566 			}
2567 		}
2568 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2569 		cfiscsi_pdu_queue(response);
2570 	}
2571 
2572 	io->scsiio.be_move_done(io);
2573 }
2574 
2575 static void
2576 cfiscsi_datamove_out(union ctl_io *io)
2577 {
2578 	struct cfiscsi_session *cs;
2579 	struct icl_pdu *request, *response;
2580 	const struct iscsi_bhs_scsi_command *bhssc;
2581 	struct iscsi_bhs_r2t *bhsr2t;
2582 	struct cfiscsi_data_wait *cdw;
2583 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2584 	uint32_t expected_len, r2t_off, r2t_len;
2585 	uint32_t target_transfer_tag;
2586 	bool done;
2587 
2588 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2589 	cs = PDU_SESSION(request);
2590 
2591 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2592 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2593 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2594 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2595 
2596 	/*
2597 	 * We need to record it so that we can properly report
2598 	 * underflow/underflow.
2599 	 */
2600 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2601 
2602 	/*
2603 	 * Report write underflow as error since CTL and backends don't
2604 	 * really support it, and SCSI does not tell how to do it right.
2605 	 */
2606 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2607 	if (io->scsiio.kern_rel_offset + io->scsiio.kern_data_len >
2608 	    expected_len) {
2609 		io->scsiio.io_hdr.port_status = 43;
2610 		io->scsiio.be_move_done(io);
2611 		return;
2612 	}
2613 
2614 	target_transfer_tag =
2615 	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2616 	cdw = cfiscsi_data_wait_new(cs, io, bhssc->bhssc_initiator_task_tag,
2617 	    &target_transfer_tag);
2618 	if (cdw == NULL) {
2619 		CFISCSI_SESSION_WARN(cs, "failed to "
2620 		    "allocate memory; dropping connection");
2621 		ctl_set_busy(&io->scsiio);
2622 		io->scsiio.be_move_done(io);
2623 		cfiscsi_session_terminate(cs);
2624 		return;
2625 	}
2626 #if 0
2627 	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2628 	    "task tag 0x%x, target transfer tag 0x%x",
2629 	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2630 #endif
2631 
2632 	cdw->cdw_ctl_io = io;
2633 	cdw->cdw_target_transfer_tag = target_transfer_tag;
2634 	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2635 	cdw->cdw_r2t_end = io->scsiio.kern_data_len;
2636 	cdw->cdw_datasn = 0;
2637 
2638 	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2639 	if (io->scsiio.kern_sg_entries > 0) {
2640 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2641 	} else {
2642 		ctl_sglist = &ctl_sg_entry;
2643 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2644 		ctl_sglist->len = io->scsiio.kern_data_len;
2645 	}
2646 	cdw->cdw_sg_index = 0;
2647 	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2648 	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2649 	r2t_off = io->scsiio.ext_data_filled;
2650 	while (r2t_off > 0) {
2651 		if (r2t_off >= cdw->cdw_sg_len) {
2652 			r2t_off -= cdw->cdw_sg_len;
2653 			cdw->cdw_sg_index++;
2654 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2655 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2656 			continue;
2657 		}
2658 		cdw->cdw_sg_addr += r2t_off;
2659 		cdw->cdw_sg_len -= r2t_off;
2660 		r2t_off = 0;
2661 	}
2662 
2663 	if (cs->cs_immediate_data &&
2664 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2665 	    icl_pdu_data_segment_length(request)) {
2666 		done = cfiscsi_handle_data_segment(request, cdw);
2667 		if (done) {
2668 			cfiscsi_data_wait_free(cs, cdw);
2669 			io->scsiio.be_move_done(io);
2670 			return;
2671 		}
2672 	}
2673 
2674 	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2675 	r2t_len = MIN(io->scsiio.kern_data_len - io->scsiio.ext_data_filled,
2676 	    cs->cs_max_burst_length);
2677 	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2678 
2679 	CFISCSI_SESSION_LOCK(cs);
2680 	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2681 	CFISCSI_SESSION_UNLOCK(cs);
2682 
2683 	/*
2684 	 * XXX: We should limit the number of outstanding R2T PDUs
2685 	 * 	per task to MaxOutstandingR2T.
2686 	 */
2687 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2688 	if (response == NULL) {
2689 		CFISCSI_SESSION_WARN(cs, "failed to "
2690 		    "allocate memory; dropping connection");
2691 		ctl_set_busy(&io->scsiio);
2692 		io->scsiio.be_move_done(io);
2693 		cfiscsi_session_terminate(cs);
2694 		return;
2695 	}
2696 	io->io_hdr.flags |= CTL_FLAG_DMA_INPROG;
2697 	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2698 	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2699 	bhsr2t->bhsr2t_flags = 0x80;
2700 	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2701 	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2702 	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2703 	/*
2704 	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2705 	 *	be running concurrently on several CPUs for a given
2706 	 *	command.
2707 	 */
2708 	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2709 	PDU_R2TSN(request)++;
2710 	/*
2711 	 * This is the offset within the current SCSI command;
2712 	 * i.e. for the first call of datamove(), it will be 0,
2713 	 * and for subsequent ones it will be the sum of lengths
2714 	 * of previous ones.
2715 	 *
2716 	 * The ext_data_filled is to account for unsolicited
2717 	 * (immediate) data that might have already arrived.
2718 	 */
2719 	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2720 	/*
2721 	 * This is the total length (sum of S/G lengths) this call
2722 	 * to cfiscsi_datamove() is supposed to handle, limited by
2723 	 * MaxBurstLength.
2724 	 */
2725 	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2726 	cfiscsi_pdu_queue(response);
2727 }
2728 
2729 static void
2730 cfiscsi_datamove(union ctl_io *io)
2731 {
2732 
2733 	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2734 		cfiscsi_datamove_in(io);
2735 	else {
2736 		/* We hadn't received anything during this datamove yet. */
2737 		io->scsiio.ext_data_filled = 0;
2738 		cfiscsi_datamove_out(io);
2739 	}
2740 }
2741 
2742 static void
2743 cfiscsi_scsi_command_done(union ctl_io *io)
2744 {
2745 	struct icl_pdu *request, *response;
2746 	struct iscsi_bhs_scsi_command *bhssc;
2747 	struct iscsi_bhs_scsi_response *bhssr;
2748 #ifdef DIAGNOSTIC
2749 	struct cfiscsi_data_wait *cdw;
2750 #endif
2751 	struct cfiscsi_session *cs;
2752 	uint16_t sense_length;
2753 
2754 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2755 	cs = PDU_SESSION(request);
2756 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2757 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2758 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2759 	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2760 
2761 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2762 	//    bhssc->bhssc_initiator_task_tag);
2763 
2764 #ifdef DIAGNOSTIC
2765 	CFISCSI_SESSION_LOCK(cs);
2766 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2767 		KASSERT(bhssc->bhssc_initiator_task_tag !=
2768 		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2769 	CFISCSI_SESSION_UNLOCK(cs);
2770 #endif
2771 
2772 	/*
2773 	 * Do not return status for aborted commands.
2774 	 * There are exceptions, but none supported by CTL yet.
2775 	 */
2776 	if (((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2777 	     (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) ||
2778 	    (io->io_hdr.flags & CTL_FLAG_STATUS_SENT)) {
2779 		ctl_free_io(io);
2780 		icl_pdu_free(request);
2781 		return;
2782 	}
2783 
2784 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2785 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2786 	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2787 	bhssr->bhssr_flags = 0x80;
2788 	/*
2789 	 * XXX: We don't deal with bidirectional under/overflows;
2790 	 *	does anything actually support those?
2791 	 */
2792 	if (PDU_TOTAL_TRANSFER_LEN(request) <
2793 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2794 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2795 		bhssr->bhssr_residual_count =
2796 		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2797 		    PDU_TOTAL_TRANSFER_LEN(request));
2798 		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2799 		//    ntohl(bhssr->bhssr_residual_count));
2800 	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2801 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2802 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2803 		bhssr->bhssr_residual_count =
2804 		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2805 		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2806 		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2807 		//    ntohl(bhssr->bhssr_residual_count));
2808 	}
2809 	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2810 	bhssr->bhssr_status = io->scsiio.scsi_status;
2811 	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2812 	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2813 
2814 	if (io->scsiio.sense_len > 0) {
2815 #if 0
2816 		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2817 		    io->scsiio.sense_len);
2818 #endif
2819 		sense_length = htons(io->scsiio.sense_len);
2820 		icl_pdu_append_data(response,
2821 		    &sense_length, sizeof(sense_length), M_WAITOK);
2822 		icl_pdu_append_data(response,
2823 		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2824 	}
2825 
2826 	ctl_free_io(io);
2827 	icl_pdu_free(request);
2828 	cfiscsi_pdu_queue(response);
2829 }
2830 
2831 static void
2832 cfiscsi_task_management_done(union ctl_io *io)
2833 {
2834 	struct icl_pdu *request, *response;
2835 	struct iscsi_bhs_task_management_request *bhstmr;
2836 	struct iscsi_bhs_task_management_response *bhstmr2;
2837 	struct cfiscsi_data_wait *cdw, *tmpcdw;
2838 	struct cfiscsi_session *cs, *tcs;
2839 	struct cfiscsi_softc *softc;
2840 	int cold_reset = 0;
2841 
2842 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2843 	cs = PDU_SESSION(request);
2844 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2845 	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2846 	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2847 	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2848 
2849 #if 0
2850 	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2851 	    bhstmr->bhstmr_initiator_task_tag,
2852 	    bhstmr->bhstmr_referenced_task_tag);
2853 #endif
2854 
2855 	if ((bhstmr->bhstmr_function & ~0x80) ==
2856 	    BHSTMR_FUNCTION_ABORT_TASK) {
2857 		/*
2858 		 * Make sure we no longer wait for Data-Out for this command.
2859 		 */
2860 		CFISCSI_SESSION_LOCK(cs);
2861 		TAILQ_FOREACH_SAFE(cdw,
2862 		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2863 			if (bhstmr->bhstmr_referenced_task_tag !=
2864 			    cdw->cdw_initiator_task_tag)
2865 				continue;
2866 
2867 #if 0
2868 			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2869 			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2870 #endif
2871 			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2872 			    cdw, cdw_next);
2873 			io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
2874 			cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 43;
2875 			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2876 			cfiscsi_data_wait_free(cs, cdw);
2877 		}
2878 		CFISCSI_SESSION_UNLOCK(cs);
2879 	}
2880 	if ((bhstmr->bhstmr_function & ~0x80) ==
2881 	    BHSTMR_FUNCTION_TARGET_COLD_RESET &&
2882 	    io->io_hdr.status == CTL_SUCCESS)
2883 		cold_reset = 1;
2884 
2885 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2886 	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2887 	    response->ip_bhs;
2888 	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2889 	bhstmr2->bhstmr_flags = 0x80;
2890 	switch (io->taskio.task_status) {
2891 	case CTL_TASK_FUNCTION_COMPLETE:
2892 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2893 		break;
2894 	case CTL_TASK_FUNCTION_SUCCEEDED:
2895 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_SUCCEEDED;
2896 		break;
2897 	case CTL_TASK_LUN_DOES_NOT_EXIST:
2898 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_LUN_DOES_NOT_EXIST;
2899 		break;
2900 	case CTL_TASK_FUNCTION_NOT_SUPPORTED:
2901 	default:
2902 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2903 		break;
2904 	}
2905 	memcpy(bhstmr2->bhstmr_additional_reponse_information,
2906 	    io->taskio.task_resp, sizeof(io->taskio.task_resp));
2907 	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2908 
2909 	ctl_free_io(io);
2910 	icl_pdu_free(request);
2911 	cfiscsi_pdu_queue(response);
2912 
2913 	if (cold_reset) {
2914 		softc = cs->cs_target->ct_softc;
2915 		mtx_lock(&softc->lock);
2916 		TAILQ_FOREACH(tcs, &softc->sessions, cs_next) {
2917 			if (tcs->cs_target == cs->cs_target)
2918 				cfiscsi_session_terminate(tcs);
2919 		}
2920 		mtx_unlock(&softc->lock);
2921 	}
2922 }
2923 
2924 static void
2925 cfiscsi_done(union ctl_io *io)
2926 {
2927 	struct icl_pdu *request;
2928 	struct cfiscsi_session *cs;
2929 
2930 	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2931 		("invalid CTL status %#x", io->io_hdr.status));
2932 
2933 	if (io->io_hdr.io_type == CTL_IO_TASK &&
2934 	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
2935 		/*
2936 		 * Implicit task termination has just completed; nothing to do.
2937 		 */
2938 		cs = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2939 		cs->cs_tasks_aborted = true;
2940 		refcount_release(&cs->cs_outstanding_ctl_pdus);
2941 		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
2942 		ctl_free_io(io);
2943 		return;
2944 	}
2945 
2946 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2947 	cs = PDU_SESSION(request);
2948 	refcount_release(&cs->cs_outstanding_ctl_pdus);
2949 
2950 	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2951 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2952 		cfiscsi_scsi_command_done(io);
2953 		break;
2954 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2955 		cfiscsi_task_management_done(io);
2956 		break;
2957 	default:
2958 		panic("cfiscsi_done called with wrong opcode 0x%x",
2959 		    request->ip_bhs->bhs_opcode);
2960 	}
2961 }
2962