xref: /freebsd/sys/cam/ctl/ctl_frontend_iscsi.c (revision 23f6875a43f7ce365f2d52cf857da010c47fb03b)
1 /*-
2  * Copyright (c) 2012 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Edward Tomasz Napierala under sponsorship
6  * from the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * CTL frontend for the iSCSI protocol.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/capsicum.h>
41 #include <sys/condvar.h>
42 #include <sys/endian.h>
43 #include <sys/file.h>
44 #include <sys/kernel.h>
45 #include <sys/kthread.h>
46 #include <sys/lock.h>
47 #include <sys/malloc.h>
48 #include <sys/module.h>
49 #include <sys/mutex.h>
50 #include <sys/queue.h>
51 #include <sys/sbuf.h>
52 #include <sys/socket.h>
53 #include <sys/sysctl.h>
54 #include <sys/systm.h>
55 #include <sys/uio.h>
56 #include <sys/unistd.h>
57 #include <vm/uma.h>
58 
59 #include <cam/scsi/scsi_all.h>
60 #include <cam/scsi/scsi_da.h>
61 #include <cam/ctl/ctl_io.h>
62 #include <cam/ctl/ctl.h>
63 #include <cam/ctl/ctl_backend.h>
64 #include <cam/ctl/ctl_error.h>
65 #include <cam/ctl/ctl_frontend.h>
66 #include <cam/ctl/ctl_debug.h>
67 #include <cam/ctl/ctl_ha.h>
68 #include <cam/ctl/ctl_ioctl.h>
69 #include <cam/ctl/ctl_private.h>
70 
71 #include <dev/iscsi/icl.h>
72 #include <dev/iscsi/icl_wrappers.h>
73 #include <dev/iscsi/iscsi_proto.h>
74 #include <cam/ctl/ctl_frontend_iscsi.h>
75 
76 #ifdef ICL_KERNEL_PROXY
77 #include <sys/socketvar.h>
78 #endif
79 
80 #ifdef ICL_KERNEL_PROXY
81 FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
82 #endif
83 
84 static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
85 static uma_zone_t cfiscsi_data_wait_zone;
86 
87 SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
88     "CAM Target Layer iSCSI Frontend");
89 static int debug = 1;
90 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
91     &debug, 1, "Enable debug messages");
92 static int ping_timeout = 5;
93 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
94     &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
95 static int login_timeout = 60;
96 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
97     &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
98 static int maxcmdsn_delta = 256;
99 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
100     &maxcmdsn_delta, 256, "Number of commands the initiator can send "
101     "without confirmation");
102 
103 #define	CFISCSI_DEBUG(X, ...)						\
104 	do {								\
105 		if (debug > 1) {					\
106 			printf("%s: " X "\n",				\
107 			    __func__, ## __VA_ARGS__);			\
108 		}							\
109 	} while (0)
110 
111 #define	CFISCSI_WARN(X, ...)						\
112 	do {								\
113 		if (debug > 0) {					\
114 			printf("WARNING: %s: " X "\n",			\
115 			    __func__, ## __VA_ARGS__);			\
116 		}							\
117 	} while (0)
118 
119 #define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
120 	do {								\
121 		if (debug > 1) {					\
122 			printf("%s: %s (%s): " X "\n",			\
123 			    __func__, S->cs_initiator_addr,		\
124 			    S->cs_initiator_name, ## __VA_ARGS__);	\
125 		}							\
126 	} while (0)
127 
128 #define	CFISCSI_SESSION_WARN(S, X, ...)					\
129 	do  {								\
130 		if (debug > 0) {					\
131 			printf("WARNING: %s (%s): " X "\n",		\
132 			    S->cs_initiator_addr,			\
133 			    S->cs_initiator_name, ## __VA_ARGS__);	\
134 		}							\
135 	} while (0)
136 
137 #define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
138 #define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
139 #define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
140 
141 #define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
142 #define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
143 #define	PDU_EXPDATASN(X)		(X)->ip_prv0
144 #define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
145 #define	PDU_R2TSN(X)			(X)->ip_prv2
146 
147 int		cfiscsi_init(void);
148 static void	cfiscsi_online(void *arg);
149 static void	cfiscsi_offline(void *arg);
150 static int	cfiscsi_info(void *arg, struct sbuf *sb);
151 static int	cfiscsi_ioctl(struct cdev *dev,
152 		    u_long cmd, caddr_t addr, int flag, struct thread *td);
153 static void	cfiscsi_datamove(union ctl_io *io);
154 static void	cfiscsi_datamove_in(union ctl_io *io);
155 static void	cfiscsi_datamove_out(union ctl_io *io);
156 static void	cfiscsi_done(union ctl_io *io);
157 static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
158 static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
159 static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
160 static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
161 static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
162 static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
163 static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
164 static struct cfiscsi_data_wait	*cfiscsi_data_wait_new(
165 		    struct cfiscsi_session *cs, union ctl_io *io,
166 		    uint32_t initiator_task_tag,
167 		    uint32_t *target_transfer_tagp);
168 static void	cfiscsi_data_wait_free(struct cfiscsi_session *cs,
169 		    struct cfiscsi_data_wait *cdw);
170 static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
171 		    *softc, const char *name, uint16_t tag);
172 static struct cfiscsi_target	*cfiscsi_target_find_or_create(
173     struct cfiscsi_softc *softc, const char *name, const char *alias,
174     uint16_t tag);
175 static void	cfiscsi_target_release(struct cfiscsi_target *ct);
176 static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
177 
178 static struct cfiscsi_softc cfiscsi_softc;
179 
180 static struct ctl_frontend cfiscsi_frontend =
181 {
182 	.name = "iscsi",
183 	.init = cfiscsi_init,
184 	.ioctl = cfiscsi_ioctl,
185 };
186 CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
187 MODULE_DEPEND(ctlcfiscsi, icl, 1, 1, 1);
188 
189 static struct icl_pdu *
190 cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
191 {
192 
193 	return (icl_pdu_new(request->ip_conn, flags));
194 }
195 
196 static bool
197 cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
198 {
199 	const struct iscsi_bhs_scsi_command *bhssc;
200 	struct cfiscsi_session *cs;
201 	uint32_t cmdsn, expstatsn;
202 
203 	cs = PDU_SESSION(request);
204 
205 	/*
206 	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
207 	 * The purpose of the timeout is to reset the connection when it stalls;
208 	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
209 	 * in some queue.
210 	 *
211 	 * XXX: Locking?
212 	 */
213 	cs->cs_timeout = 0;
214 
215 	/*
216 	 * Data-Out PDUs don't contain CmdSN.
217 	 */
218 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
219 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
220 		return (false);
221 
222 	/*
223 	 * We're only using fields common for all the request
224 	 * (initiator -> target) PDUs.
225 	 */
226 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
227 	cmdsn = ntohl(bhssc->bhssc_cmdsn);
228 	expstatsn = ntohl(bhssc->bhssc_expstatsn);
229 
230 	CFISCSI_SESSION_LOCK(cs);
231 #if 0
232 	if (expstatsn != cs->cs_statsn) {
233 		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
234 		    "while current StatSN is %d", expstatsn,
235 		    cs->cs_statsn);
236 	}
237 #endif
238 
239 	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0) {
240 		/*
241 		 * The target MUST silently ignore any non-immediate command
242 		 * outside of this range.
243 		 */
244 		if (ISCSI_SNLT(cmdsn, cs->cs_cmdsn) ||
245 		    ISCSI_SNGT(cmdsn, cs->cs_cmdsn + maxcmdsn_delta)) {
246 			CFISCSI_SESSION_UNLOCK(cs);
247 			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
248 			    "while expected %u", cmdsn, cs->cs_cmdsn);
249 			return (true);
250 		}
251 
252 		/*
253 		 * We don't support multiple connections now, so any
254 		 * discontinuity in CmdSN means lost PDUs.  Since we don't
255 		 * support PDU retransmission -- terminate the connection.
256 		 */
257 		if (cmdsn != cs->cs_cmdsn) {
258 			CFISCSI_SESSION_UNLOCK(cs);
259 			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
260 			    "while expected %u; dropping connection",
261 			    cmdsn, cs->cs_cmdsn);
262 			cfiscsi_session_terminate(cs);
263 			return (true);
264 		}
265 		cs->cs_cmdsn++;
266 	}
267 
268 	CFISCSI_SESSION_UNLOCK(cs);
269 
270 	return (false);
271 }
272 
273 static void
274 cfiscsi_pdu_handle(struct icl_pdu *request)
275 {
276 	struct cfiscsi_session *cs;
277 	bool ignore;
278 
279 	cs = PDU_SESSION(request);
280 
281 	ignore = cfiscsi_pdu_update_cmdsn(request);
282 	if (ignore) {
283 		icl_pdu_free(request);
284 		return;
285 	}
286 
287 	/*
288 	 * Handle the PDU; this includes e.g. receiving the remaining
289 	 * part of PDU and submitting the SCSI command to CTL
290 	 * or queueing a reply.  The handling routine is responsible
291 	 * for freeing the PDU when it's no longer needed.
292 	 */
293 	switch (request->ip_bhs->bhs_opcode &
294 	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
295 	case ISCSI_BHS_OPCODE_NOP_OUT:
296 		cfiscsi_pdu_handle_nop_out(request);
297 		break;
298 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
299 		cfiscsi_pdu_handle_scsi_command(request);
300 		break;
301 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
302 		cfiscsi_pdu_handle_task_request(request);
303 		break;
304 	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
305 		cfiscsi_pdu_handle_data_out(request);
306 		break;
307 	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
308 		cfiscsi_pdu_handle_logout_request(request);
309 		break;
310 	default:
311 		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
312 		    "opcode 0x%x; dropping connection",
313 		    request->ip_bhs->bhs_opcode);
314 		icl_pdu_free(request);
315 		cfiscsi_session_terminate(cs);
316 	}
317 
318 }
319 
320 static void
321 cfiscsi_receive_callback(struct icl_pdu *request)
322 {
323 	struct cfiscsi_session *cs;
324 
325 	cs = PDU_SESSION(request);
326 
327 #ifdef ICL_KERNEL_PROXY
328 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
329 		if (cs->cs_login_pdu == NULL)
330 			cs->cs_login_pdu = request;
331 		else
332 			icl_pdu_free(request);
333 		cv_signal(&cs->cs_login_cv);
334 		return;
335 	}
336 #endif
337 
338 	cfiscsi_pdu_handle(request);
339 }
340 
341 static void
342 cfiscsi_error_callback(struct icl_conn *ic)
343 {
344 	struct cfiscsi_session *cs;
345 
346 	cs = CONN_SESSION(ic);
347 
348 	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
349 	cfiscsi_session_terminate(cs);
350 }
351 
352 static int
353 cfiscsi_pdu_prepare(struct icl_pdu *response)
354 {
355 	struct cfiscsi_session *cs;
356 	struct iscsi_bhs_scsi_response *bhssr;
357 	bool advance_statsn = true;
358 
359 	cs = PDU_SESSION(response);
360 
361 	CFISCSI_SESSION_LOCK_ASSERT(cs);
362 
363 	/*
364 	 * We're only using fields common for all the response
365 	 * (target -> initiator) PDUs.
366 	 */
367 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
368 
369 	/*
370 	 * 10.8.3: "The StatSN for this connection is not advanced
371 	 * after this PDU is sent."
372 	 */
373 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
374 		advance_statsn = false;
375 
376 	/*
377 	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
378 	 * StatSN for the connection is not advanced after this PDU is sent."
379 	 */
380 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
381 	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
382 		advance_statsn = false;
383 
384 	/*
385 	 * See the comment below - StatSN is not meaningful and must
386 	 * not be advanced.
387 	 */
388 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN &&
389 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S) == 0)
390 		advance_statsn = false;
391 
392 	/*
393 	 * 10.7.3: "The fields StatSN, Status, and Residual Count
394 	 * only have meaningful content if the S bit is set to 1."
395 	 */
396 	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
397 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S))
398 		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
399 	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
400 	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
401 
402 	if (advance_statsn)
403 		cs->cs_statsn++;
404 
405 	return (0);
406 }
407 
408 static void
409 cfiscsi_pdu_queue(struct icl_pdu *response)
410 {
411 	struct cfiscsi_session *cs;
412 
413 	cs = PDU_SESSION(response);
414 
415 	CFISCSI_SESSION_LOCK(cs);
416 	cfiscsi_pdu_prepare(response);
417 	icl_pdu_queue(response);
418 	CFISCSI_SESSION_UNLOCK(cs);
419 }
420 
421 static void
422 cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
423 {
424 	struct cfiscsi_session *cs;
425 	struct iscsi_bhs_nop_out *bhsno;
426 	struct iscsi_bhs_nop_in *bhsni;
427 	struct icl_pdu *response;
428 	void *data = NULL;
429 	size_t datasize;
430 	int error;
431 
432 	cs = PDU_SESSION(request);
433 	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
434 
435 	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
436 		/*
437 		 * Nothing to do, iscsi_pdu_update_statsn() already
438 		 * zeroed the timeout.
439 		 */
440 		icl_pdu_free(request);
441 		return;
442 	}
443 
444 	datasize = icl_pdu_data_segment_length(request);
445 	if (datasize > 0) {
446 		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
447 		if (data == NULL) {
448 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
449 			    "dropping connection");
450 			icl_pdu_free(request);
451 			cfiscsi_session_terminate(cs);
452 			return;
453 		}
454 		icl_pdu_get_data(request, 0, data, datasize);
455 	}
456 
457 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
458 	if (response == NULL) {
459 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
460 		    "droppping connection");
461 		free(data, M_CFISCSI);
462 		icl_pdu_free(request);
463 		cfiscsi_session_terminate(cs);
464 		return;
465 	}
466 	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
467 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
468 	bhsni->bhsni_flags = 0x80;
469 	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
470 	bhsni->bhsni_target_transfer_tag = 0xffffffff;
471 	if (datasize > 0) {
472 		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
473 		if (error != 0) {
474 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
475 			    "dropping connection");
476 			free(data, M_CFISCSI);
477 			icl_pdu_free(request);
478 			icl_pdu_free(response);
479 			cfiscsi_session_terminate(cs);
480 			return;
481 		}
482 		free(data, M_CFISCSI);
483 	}
484 
485 	icl_pdu_free(request);
486 	cfiscsi_pdu_queue(response);
487 }
488 
489 static void
490 cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
491 {
492 	struct iscsi_bhs_scsi_command *bhssc;
493 	struct cfiscsi_session *cs;
494 	union ctl_io *io;
495 	int error;
496 
497 	cs = PDU_SESSION(request);
498 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
499 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
500 	//    bhssc->bhssc_initiator_task_tag);
501 
502 	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
503 		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
504 		    "ImmediateData=No; dropping connection");
505 		icl_pdu_free(request);
506 		cfiscsi_session_terminate(cs);
507 		return;
508 	}
509 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
510 	ctl_zero_io(io);
511 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
512 	io->io_hdr.io_type = CTL_IO_SCSI;
513 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
514 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
515 	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhssc->bhssc_lun));
516 	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
517 	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
518 	case BHSSC_FLAGS_ATTR_UNTAGGED:
519 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
520 		break;
521 	case BHSSC_FLAGS_ATTR_SIMPLE:
522 		io->scsiio.tag_type = CTL_TAG_SIMPLE;
523 		break;
524 	case BHSSC_FLAGS_ATTR_ORDERED:
525         	io->scsiio.tag_type = CTL_TAG_ORDERED;
526 		break;
527 	case BHSSC_FLAGS_ATTR_HOQ:
528         	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
529 		break;
530 	case BHSSC_FLAGS_ATTR_ACA:
531 		io->scsiio.tag_type = CTL_TAG_ACA;
532 		break;
533 	default:
534 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
535 		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
536 		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
537 		break;
538 	}
539 	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
540 	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
541 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
542 	error = ctl_queue(io);
543 	if (error != CTL_RETVAL_COMPLETE) {
544 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
545 		    "dropping connection", error);
546 		ctl_free_io(io);
547 		refcount_release(&cs->cs_outstanding_ctl_pdus);
548 		icl_pdu_free(request);
549 		cfiscsi_session_terminate(cs);
550 	}
551 }
552 
553 static void
554 cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
555 {
556 	struct iscsi_bhs_task_management_request *bhstmr;
557 	struct iscsi_bhs_task_management_response *bhstmr2;
558 	struct icl_pdu *response;
559 	struct cfiscsi_session *cs;
560 	union ctl_io *io;
561 	int error;
562 
563 	cs = PDU_SESSION(request);
564 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
565 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
566 	ctl_zero_io(io);
567 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
568 	io->io_hdr.io_type = CTL_IO_TASK;
569 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
570 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
571 	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhstmr->bhstmr_lun));
572 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
573 
574 	switch (bhstmr->bhstmr_function & ~0x80) {
575 	case BHSTMR_FUNCTION_ABORT_TASK:
576 #if 0
577 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
578 #endif
579 		io->taskio.task_action = CTL_TASK_ABORT_TASK;
580 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
581 		break;
582 	case BHSTMR_FUNCTION_ABORT_TASK_SET:
583 #if 0
584 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
585 #endif
586 		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
587 		break;
588 	case BHSTMR_FUNCTION_CLEAR_TASK_SET:
589 #if 0
590 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_CLEAR_TASK_SET");
591 #endif
592 		io->taskio.task_action = CTL_TASK_CLEAR_TASK_SET;
593 		break;
594 	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
595 #if 0
596 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
597 #endif
598 		io->taskio.task_action = CTL_TASK_LUN_RESET;
599 		break;
600 	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
601 #if 0
602 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
603 #endif
604 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
605 		break;
606 	case BHSTMR_FUNCTION_TARGET_COLD_RESET:
607 #if 0
608 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_COLD_RESET");
609 #endif
610 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
611 		break;
612 	case BHSTMR_FUNCTION_QUERY_TASK:
613 #if 0
614 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK");
615 #endif
616 		io->taskio.task_action = CTL_TASK_QUERY_TASK;
617 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
618 		break;
619 	case BHSTMR_FUNCTION_QUERY_TASK_SET:
620 #if 0
621 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK_SET");
622 #endif
623 		io->taskio.task_action = CTL_TASK_QUERY_TASK_SET;
624 		break;
625 	case BHSTMR_FUNCTION_I_T_NEXUS_RESET:
626 #if 0
627 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_I_T_NEXUS_RESET");
628 #endif
629 		io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
630 		break;
631 	case BHSTMR_FUNCTION_QUERY_ASYNC_EVENT:
632 #if 0
633 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_ASYNC_EVENT");
634 #endif
635 		io->taskio.task_action = CTL_TASK_QUERY_ASYNC_EVENT;
636 		break;
637 	default:
638 		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
639 		    bhstmr->bhstmr_function & ~0x80);
640 		ctl_free_io(io);
641 
642 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
643 		if (response == NULL) {
644 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
645 			    "dropping connection");
646 			icl_pdu_free(request);
647 			cfiscsi_session_terminate(cs);
648 			return;
649 		}
650 		bhstmr2 = (struct iscsi_bhs_task_management_response *)
651 		    response->ip_bhs;
652 		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
653 		bhstmr2->bhstmr_flags = 0x80;
654 		bhstmr2->bhstmr_response =
655 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
656 		bhstmr2->bhstmr_initiator_task_tag =
657 		    bhstmr->bhstmr_initiator_task_tag;
658 		icl_pdu_free(request);
659 		cfiscsi_pdu_queue(response);
660 		return;
661 	}
662 
663 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
664 	error = ctl_queue(io);
665 	if (error != CTL_RETVAL_COMPLETE) {
666 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
667 		    "dropping connection", error);
668 		ctl_free_io(io);
669 		refcount_release(&cs->cs_outstanding_ctl_pdus);
670 		icl_pdu_free(request);
671 		cfiscsi_session_terminate(cs);
672 	}
673 }
674 
675 static bool
676 cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
677 {
678 	struct iscsi_bhs_data_out *bhsdo;
679 	struct cfiscsi_session *cs;
680 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
681 	size_t copy_len, len, off, buffer_offset;
682 	int ctl_sg_count;
683 	union ctl_io *io;
684 
685 	cs = PDU_SESSION(request);
686 
687 	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
688 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
689 	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
690 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
691 	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
692 
693 	/*
694 	 * We're only using fields common for Data-Out and SCSI Command PDUs.
695 	 */
696 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
697 
698 	io = cdw->cdw_ctl_io;
699 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
700 	    ("CTL_FLAG_DATA_IN"));
701 
702 #if 0
703 	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
704 	    request->ip_data_len, io->scsiio.kern_total_len);
705 #endif
706 
707 	if (io->scsiio.kern_sg_entries > 0) {
708 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
709 		ctl_sg_count = io->scsiio.kern_sg_entries;
710 	} else {
711 		ctl_sglist = &ctl_sg_entry;
712 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
713 		ctl_sglist->len = io->scsiio.kern_data_len;
714 		ctl_sg_count = 1;
715 	}
716 
717 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
718 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
719 		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
720 	else
721 		buffer_offset = 0;
722 	len = icl_pdu_data_segment_length(request);
723 
724 	/*
725 	 * Make sure the offset, as sent by the initiator, matches the offset
726 	 * we're supposed to be at in the scatter-gather list.
727 	 */
728 	if (buffer_offset >
729 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
730 	    buffer_offset + len <=
731 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
732 		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
733 		    "expected %zd; dropping connection", buffer_offset,
734 		    (size_t)io->scsiio.kern_rel_offset +
735 		    (size_t)io->scsiio.ext_data_filled);
736 		ctl_set_data_phase_error(&io->scsiio);
737 		cfiscsi_session_terminate(cs);
738 		return (true);
739 	}
740 
741 	/*
742 	 * This is the offset within the PDU data segment, as opposed
743 	 * to buffer_offset, which is the offset within the task (SCSI
744 	 * command).
745 	 */
746 	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
747 	    buffer_offset;
748 
749 	/*
750 	 * Iterate over the scatter/gather segments, filling them with data
751 	 * from the PDU data segment.  Note that this can get called multiple
752 	 * times for one SCSI command; the cdw structure holds state for the
753 	 * scatter/gather list.
754 	 */
755 	for (;;) {
756 		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
757 		    ("cdw->cdw_sg_index >= ctl_sg_count"));
758 		if (cdw->cdw_sg_len == 0) {
759 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
760 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
761 		}
762 		KASSERT(off <= len, ("len > off"));
763 		copy_len = len - off;
764 		if (copy_len > cdw->cdw_sg_len)
765 			copy_len = cdw->cdw_sg_len;
766 
767 		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
768 		cdw->cdw_sg_addr += copy_len;
769 		cdw->cdw_sg_len -= copy_len;
770 		off += copy_len;
771 		io->scsiio.ext_data_filled += copy_len;
772 		io->scsiio.kern_data_resid -= copy_len;
773 
774 		if (cdw->cdw_sg_len == 0) {
775 			/*
776 			 * End of current segment.
777 			 */
778 			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
779 				/*
780 				 * Last segment in scatter/gather list.
781 				 */
782 				break;
783 			}
784 			cdw->cdw_sg_index++;
785 		}
786 
787 		if (off == len) {
788 			/*
789 			 * End of PDU payload.
790 			 */
791 			break;
792 		}
793 	}
794 
795 	if (len > off) {
796 		/*
797 		 * In case of unsolicited data, it's possible that the buffer
798 		 * provided by CTL is smaller than negotiated FirstBurstLength.
799 		 * Just ignore the superfluous data; will ask for them with R2T
800 		 * on next call to cfiscsi_datamove().
801 		 *
802 		 * This obviously can only happen with SCSI Command PDU.
803 		 */
804 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
805 		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
806 			return (true);
807 
808 		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
809 		    "expected %zd; dropping connection",
810 		    icl_pdu_data_segment_length(request), off);
811 		ctl_set_data_phase_error(&io->scsiio);
812 		cfiscsi_session_terminate(cs);
813 		return (true);
814 	}
815 
816 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
817 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
818 		CFISCSI_SESSION_WARN(cs, "got the final packet without "
819 		    "the F flag; flags = 0x%x; dropping connection",
820 		    bhsdo->bhsdo_flags);
821 		ctl_set_data_phase_error(&io->scsiio);
822 		cfiscsi_session_terminate(cs);
823 		return (true);
824 	}
825 
826 	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
827 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
828 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
829 		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
830 			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
831 			    "transmitted size was %zd bytes instead of %d; "
832 			    "dropping connection",
833 			    (size_t)io->scsiio.ext_data_filled,
834 			    cdw->cdw_r2t_end);
835 			ctl_set_data_phase_error(&io->scsiio);
836 			cfiscsi_session_terminate(cs);
837 			return (true);
838 		} else {
839 			/*
840 			 * For SCSI Command PDU, this just means we need to
841 			 * solicit more data by sending R2T.
842 			 */
843 			return (false);
844 		}
845 	}
846 
847 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
848 #if 0
849 		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
850 		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
851 #endif
852 
853 		return (true);
854 	}
855 
856 	return (false);
857 }
858 
859 static void
860 cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
861 {
862 	struct iscsi_bhs_data_out *bhsdo;
863 	struct cfiscsi_session *cs;
864 	struct cfiscsi_data_wait *cdw = NULL;
865 	union ctl_io *io;
866 	bool done;
867 
868 	cs = PDU_SESSION(request);
869 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
870 
871 	CFISCSI_SESSION_LOCK(cs);
872 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
873 #if 0
874 		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
875 		    "ttt 0x%x, itt 0x%x",
876 		    bhsdo->bhsdo_target_transfer_tag,
877 		    bhsdo->bhsdo_initiator_task_tag,
878 		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
879 #endif
880 		if (bhsdo->bhsdo_target_transfer_tag ==
881 		    cdw->cdw_target_transfer_tag)
882 			break;
883 	}
884 	CFISCSI_SESSION_UNLOCK(cs);
885 	if (cdw == NULL) {
886 		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
887 		    "0x%x, not found; dropping connection",
888 		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
889 		icl_pdu_free(request);
890 		cfiscsi_session_terminate(cs);
891 		return;
892 	}
893 
894 	if (cdw->cdw_datasn != ntohl(bhsdo->bhsdo_datasn)) {
895 		CFISCSI_SESSION_WARN(cs, "received Data-Out PDU with "
896 		    "DataSN %u, while expected %u; dropping connection",
897 		    ntohl(bhsdo->bhsdo_datasn), cdw->cdw_datasn);
898 		icl_pdu_free(request);
899 		cfiscsi_session_terminate(cs);
900 		return;
901 	}
902 	cdw->cdw_datasn++;
903 
904 	io = cdw->cdw_ctl_io;
905 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
906 	    ("CTL_FLAG_DATA_IN"));
907 
908 	done = cfiscsi_handle_data_segment(request, cdw);
909 	if (done) {
910 		CFISCSI_SESSION_LOCK(cs);
911 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
912 		CFISCSI_SESSION_UNLOCK(cs);
913 		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
914 		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
915 		cfiscsi_data_wait_free(cs, cdw);
916 		io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
917 		if (done)
918 			io->scsiio.be_move_done(io);
919 		else
920 			cfiscsi_datamove_out(io);
921 	}
922 
923 	icl_pdu_free(request);
924 }
925 
926 static void
927 cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
928 {
929 	struct iscsi_bhs_logout_request *bhslr;
930 	struct iscsi_bhs_logout_response *bhslr2;
931 	struct icl_pdu *response;
932 	struct cfiscsi_session *cs;
933 
934 	cs = PDU_SESSION(request);
935 	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
936 	switch (bhslr->bhslr_reason & 0x7f) {
937 	case BHSLR_REASON_CLOSE_SESSION:
938 	case BHSLR_REASON_CLOSE_CONNECTION:
939 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
940 		if (response == NULL) {
941 			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
942 			icl_pdu_free(request);
943 			cfiscsi_session_terminate(cs);
944 			return;
945 		}
946 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
947 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
948 		bhslr2->bhslr_flags = 0x80;
949 		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
950 		bhslr2->bhslr_initiator_task_tag =
951 		    bhslr->bhslr_initiator_task_tag;
952 		icl_pdu_free(request);
953 		cfiscsi_pdu_queue(response);
954 		cfiscsi_session_terminate(cs);
955 		break;
956 	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
957 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
958 		if (response == NULL) {
959 			CFISCSI_SESSION_WARN(cs,
960 			    "failed to allocate memory; dropping connection");
961 			icl_pdu_free(request);
962 			cfiscsi_session_terminate(cs);
963 			return;
964 		}
965 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
966 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
967 		bhslr2->bhslr_flags = 0x80;
968 		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
969 		bhslr2->bhslr_initiator_task_tag =
970 		    bhslr->bhslr_initiator_task_tag;
971 		icl_pdu_free(request);
972 		cfiscsi_pdu_queue(response);
973 		break;
974 	default:
975 		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
976 		    bhslr->bhslr_reason);
977 		icl_pdu_free(request);
978 		cfiscsi_session_terminate(cs);
979 		break;
980 	}
981 }
982 
983 static void
984 cfiscsi_callout(void *context)
985 {
986 	struct icl_pdu *cp;
987 	struct iscsi_bhs_nop_in *bhsni;
988 	struct cfiscsi_session *cs;
989 
990 	cs = context;
991 
992 	if (cs->cs_terminating)
993 		return;
994 
995 	callout_schedule(&cs->cs_callout, 1 * hz);
996 
997 	atomic_add_int(&cs->cs_timeout, 1);
998 
999 #ifdef ICL_KERNEL_PROXY
1000 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1001 		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1002 			CFISCSI_SESSION_WARN(cs, "login timed out after "
1003 			    "%d seconds; dropping connection", cs->cs_timeout);
1004 			cfiscsi_session_terminate(cs);
1005 		}
1006 		return;
1007 	}
1008 #endif
1009 
1010 	if (ping_timeout <= 0) {
1011 		/*
1012 		 * Pings are disabled.  Don't send NOP-In in this case;
1013 		 * user might have disabled pings to work around problems
1014 		 * with certain initiators that can't properly handle
1015 		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1016 		 * triggering reconnection, should the user decide to
1017 		 * reenable them.
1018 		 */
1019 		cs->cs_timeout = 0;
1020 		return;
1021 	}
1022 
1023 	if (cs->cs_timeout >= ping_timeout) {
1024 		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1025 		    "dropping connection",  ping_timeout);
1026 		cfiscsi_session_terminate(cs);
1027 		return;
1028 	}
1029 
1030 	/*
1031 	 * If the ping was reset less than one second ago - which means
1032 	 * that we've received some PDU during the last second - assume
1033 	 * the traffic flows correctly and don't bother sending a NOP-Out.
1034 	 *
1035 	 * (It's 2 - one for one second, and one for incrementing is_timeout
1036 	 * earlier in this routine.)
1037 	 */
1038 	if (cs->cs_timeout < 2)
1039 		return;
1040 
1041 	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1042 	if (cp == NULL) {
1043 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1044 		return;
1045 	}
1046 	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1047 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1048 	bhsni->bhsni_flags = 0x80;
1049 	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1050 
1051 	cfiscsi_pdu_queue(cp);
1052 }
1053 
1054 static struct cfiscsi_data_wait *
1055 cfiscsi_data_wait_new(struct cfiscsi_session *cs, union ctl_io *io,
1056     uint32_t initiator_task_tag, uint32_t *target_transfer_tagp)
1057 {
1058 	struct cfiscsi_data_wait *cdw;
1059 	int error;
1060 
1061 	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
1062 	if (cdw == NULL) {
1063 		CFISCSI_SESSION_WARN(cs,
1064 		    "failed to allocate %zd bytes", sizeof(*cdw));
1065 		return (NULL);
1066 	}
1067 
1068 	error = icl_conn_transfer_setup(cs->cs_conn, io, target_transfer_tagp,
1069 	    &cdw->cdw_icl_prv);
1070 	if (error != 0) {
1071 		CFISCSI_SESSION_WARN(cs,
1072 		    "icl_conn_transfer_setup() failed with error %d", error);
1073 		uma_zfree(cfiscsi_data_wait_zone, cdw);
1074 		return (NULL);
1075 	}
1076 
1077 	cdw->cdw_ctl_io = io;
1078 	cdw->cdw_target_transfer_tag = *target_transfer_tagp;
1079 	cdw->cdw_initiator_task_tag = initiator_task_tag;
1080 
1081 	return (cdw);
1082 }
1083 
1084 static void
1085 cfiscsi_data_wait_free(struct cfiscsi_session *cs,
1086     struct cfiscsi_data_wait *cdw)
1087 {
1088 
1089 	icl_conn_transfer_done(cs->cs_conn, cdw->cdw_icl_prv);
1090 	uma_zfree(cfiscsi_data_wait_zone, cdw);
1091 }
1092 
1093 static void
1094 cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1095 {
1096 	struct cfiscsi_data_wait *cdw;
1097 	union ctl_io *io;
1098 	int error, last, wait;
1099 
1100 	if (cs->cs_target == NULL)
1101 		return;		/* No target yet, so nothing to do. */
1102 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1103 	ctl_zero_io(io);
1104 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = cs;
1105 	io->io_hdr.io_type = CTL_IO_TASK;
1106 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
1107 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1108 	io->io_hdr.nexus.targ_lun = 0;
1109 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1110 	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1111 	wait = cs->cs_outstanding_ctl_pdus;
1112 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1113 	error = ctl_queue(io);
1114 	if (error != CTL_RETVAL_COMPLETE) {
1115 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1116 		refcount_release(&cs->cs_outstanding_ctl_pdus);
1117 		ctl_free_io(io);
1118 	}
1119 
1120 	CFISCSI_SESSION_LOCK(cs);
1121 	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1122 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1123 		CFISCSI_SESSION_UNLOCK(cs);
1124 		/*
1125 		 * Set nonzero port status; this prevents backends from
1126 		 * assuming that the data transfer actually succeeded
1127 		 * and writing uninitialized data to disk.
1128 		 */
1129 		cdw->cdw_ctl_io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
1130 		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1131 		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1132 		cfiscsi_data_wait_free(cs, cdw);
1133 		CFISCSI_SESSION_LOCK(cs);
1134 	}
1135 	CFISCSI_SESSION_UNLOCK(cs);
1136 
1137 	/*
1138 	 * Wait for CTL to terminate all the tasks.
1139 	 */
1140 	if (wait > 0)
1141 		CFISCSI_SESSION_WARN(cs,
1142 		    "waiting for CTL to terminate %d tasks", wait);
1143 	for (;;) {
1144 		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1145 		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1146 		if (last != 0)
1147 			break;
1148 		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1149 		    0, "cfiscsi_terminate", hz / 100);
1150 	}
1151 	if (wait > 0)
1152 		CFISCSI_SESSION_WARN(cs, "tasks terminated");
1153 }
1154 
1155 static void
1156 cfiscsi_maintenance_thread(void *arg)
1157 {
1158 	struct cfiscsi_session *cs;
1159 
1160 	cs = arg;
1161 
1162 	for (;;) {
1163 		CFISCSI_SESSION_LOCK(cs);
1164 		if (cs->cs_terminating == false)
1165 			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1166 		CFISCSI_SESSION_UNLOCK(cs);
1167 
1168 		if (cs->cs_terminating) {
1169 
1170 			/*
1171 			 * We used to wait up to 30 seconds to deliver queued
1172 			 * PDUs to the initiator.  We also tried hard to deliver
1173 			 * SCSI Responses for the aborted PDUs.  We don't do
1174 			 * that anymore.  We might need to revisit that.
1175 			 */
1176 			callout_drain(&cs->cs_callout);
1177 			icl_conn_close(cs->cs_conn);
1178 
1179 			/*
1180 			 * At this point ICL receive thread is no longer
1181 			 * running; no new tasks can be queued.
1182 			 */
1183 			cfiscsi_session_terminate_tasks(cs);
1184 			cfiscsi_session_delete(cs);
1185 			kthread_exit();
1186 			return;
1187 		}
1188 		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1189 	}
1190 }
1191 
1192 static void
1193 cfiscsi_session_terminate(struct cfiscsi_session *cs)
1194 {
1195 
1196 	if (cs->cs_terminating)
1197 		return;
1198 	cs->cs_terminating = true;
1199 	cv_signal(&cs->cs_maintenance_cv);
1200 #ifdef ICL_KERNEL_PROXY
1201 	cv_signal(&cs->cs_login_cv);
1202 #endif
1203 }
1204 
1205 static int
1206 cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1207 {
1208 	struct cfiscsi_target *ct;
1209 	char *name;
1210 	int i;
1211 
1212 	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1213 
1214 	ct = cs->cs_target;
1215 	name = strdup(cs->cs_initiator_id, M_CTL);
1216 	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1217 	if (i < 0) {
1218 		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1219 		    i);
1220 		cs->cs_ctl_initid = -1;
1221 		return (1);
1222 	}
1223 	cs->cs_ctl_initid = i;
1224 #if 0
1225 	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1226 #endif
1227 
1228 	return (0);
1229 }
1230 
1231 static void
1232 cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1233 {
1234 	int error;
1235 
1236 	if (cs->cs_ctl_initid == -1)
1237 		return;
1238 
1239 	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1240 	if (error != 0) {
1241 		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1242 		    error);
1243 	}
1244 	cs->cs_ctl_initid = -1;
1245 }
1246 
1247 static struct cfiscsi_session *
1248 cfiscsi_session_new(struct cfiscsi_softc *softc, const char *offload)
1249 {
1250 	struct cfiscsi_session *cs;
1251 	int error;
1252 
1253 	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1254 	if (cs == NULL) {
1255 		CFISCSI_WARN("malloc failed");
1256 		return (NULL);
1257 	}
1258 	cs->cs_ctl_initid = -1;
1259 
1260 	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1261 	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1262 	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1263 	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1264 #ifdef ICL_KERNEL_PROXY
1265 	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1266 #endif
1267 
1268 	cs->cs_conn = icl_new_conn(offload, false, "cfiscsi", &cs->cs_lock);
1269 	if (cs->cs_conn == NULL) {
1270 		free(cs, M_CFISCSI);
1271 		return (NULL);
1272 	}
1273 	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1274 	cs->cs_conn->ic_error = cfiscsi_error_callback;
1275 	cs->cs_conn->ic_prv0 = cs;
1276 
1277 	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1278 	if (error != 0) {
1279 		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1280 		free(cs, M_CFISCSI);
1281 		return (NULL);
1282 	}
1283 
1284 	mtx_lock(&softc->lock);
1285 	cs->cs_id = ++softc->last_session_id;
1286 	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1287 	mtx_unlock(&softc->lock);
1288 
1289 	/*
1290 	 * Start pinging the initiator.
1291 	 */
1292 	callout_init(&cs->cs_callout, 1);
1293 	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1294 
1295 	return (cs);
1296 }
1297 
1298 static void
1299 cfiscsi_session_delete(struct cfiscsi_session *cs)
1300 {
1301 	struct cfiscsi_softc *softc;
1302 
1303 	softc = &cfiscsi_softc;
1304 
1305 	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1306 	    ("destroying session with outstanding CTL pdus"));
1307 	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1308 	    ("destroying session with non-empty queue"));
1309 
1310 	cfiscsi_session_unregister_initiator(cs);
1311 	if (cs->cs_target != NULL)
1312 		cfiscsi_target_release(cs->cs_target);
1313 	icl_conn_close(cs->cs_conn);
1314 	icl_conn_free(cs->cs_conn);
1315 
1316 	mtx_lock(&softc->lock);
1317 	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1318 	cv_signal(&softc->sessions_cv);
1319 	mtx_unlock(&softc->lock);
1320 
1321 	free(cs, M_CFISCSI);
1322 }
1323 
1324 int
1325 cfiscsi_init(void)
1326 {
1327 	struct cfiscsi_softc *softc;
1328 
1329 	softc = &cfiscsi_softc;
1330 	bzero(softc, sizeof(*softc));
1331 	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1332 
1333 	cv_init(&softc->sessions_cv, "cfiscsi_sessions");
1334 #ifdef ICL_KERNEL_PROXY
1335 	cv_init(&softc->accept_cv, "cfiscsi_accept");
1336 #endif
1337 	TAILQ_INIT(&softc->sessions);
1338 	TAILQ_INIT(&softc->targets);
1339 
1340 	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1341 	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1342 	    UMA_ALIGN_PTR, 0);
1343 
1344 	return (0);
1345 }
1346 
1347 #ifdef ICL_KERNEL_PROXY
1348 static void
1349 cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1350 {
1351 	struct cfiscsi_session *cs;
1352 
1353 	cs = cfiscsi_session_new(&cfiscsi_softc, NULL);
1354 	if (cs == NULL) {
1355 		CFISCSI_WARN("failed to create session");
1356 		return;
1357 	}
1358 
1359 	icl_conn_handoff_sock(cs->cs_conn, so);
1360 	cs->cs_initiator_sa = sa;
1361 	cs->cs_portal_id = portal_id;
1362 	cs->cs_waiting_for_ctld = true;
1363 	cv_signal(&cfiscsi_softc.accept_cv);
1364 }
1365 #endif
1366 
1367 static void
1368 cfiscsi_online(void *arg)
1369 {
1370 	struct cfiscsi_softc *softc;
1371 	struct cfiscsi_target *ct;
1372 	int online;
1373 
1374 	ct = (struct cfiscsi_target *)arg;
1375 	softc = ct->ct_softc;
1376 
1377 	mtx_lock(&softc->lock);
1378 	if (ct->ct_online) {
1379 		mtx_unlock(&softc->lock);
1380 		return;
1381 	}
1382 	ct->ct_online = 1;
1383 	online = softc->online++;
1384 	mtx_unlock(&softc->lock);
1385 	if (online > 0)
1386 		return;
1387 
1388 #ifdef ICL_KERNEL_PROXY
1389 	if (softc->listener != NULL)
1390 		icl_listen_free(softc->listener);
1391 	softc->listener = icl_listen_new(cfiscsi_accept);
1392 #endif
1393 }
1394 
1395 static void
1396 cfiscsi_offline(void *arg)
1397 {
1398 	struct cfiscsi_softc *softc;
1399 	struct cfiscsi_target *ct;
1400 	struct cfiscsi_session *cs;
1401 	int online;
1402 
1403 	ct = (struct cfiscsi_target *)arg;
1404 	softc = ct->ct_softc;
1405 
1406 	mtx_lock(&softc->lock);
1407 	if (!ct->ct_online) {
1408 		mtx_unlock(&softc->lock);
1409 		return;
1410 	}
1411 	ct->ct_online = 0;
1412 	online = --softc->online;
1413 
1414 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1415 		if (cs->cs_target == ct)
1416 			cfiscsi_session_terminate(cs);
1417 	}
1418 	do {
1419 		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1420 			if (cs->cs_target == ct)
1421 				break;
1422 		}
1423 		if (cs != NULL)
1424 			cv_wait(&softc->sessions_cv, &softc->lock);
1425 	} while (cs != NULL && ct->ct_online == 0);
1426 	mtx_unlock(&softc->lock);
1427 	if (online > 0)
1428 		return;
1429 
1430 #ifdef ICL_KERNEL_PROXY
1431 	icl_listen_free(softc->listener);
1432 	softc->listener = NULL;
1433 #endif
1434 }
1435 
1436 static int
1437 cfiscsi_info(void *arg, struct sbuf *sb)
1438 {
1439 	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1440 	int retval;
1441 
1442 	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1443 	    ct->ct_state);
1444 	return (retval);
1445 }
1446 
1447 static void
1448 cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1449 {
1450 	struct cfiscsi_softc *softc;
1451 	struct cfiscsi_session *cs, *cs2;
1452 	struct cfiscsi_target *ct;
1453 	struct ctl_iscsi_handoff_params *cihp;
1454 	int error;
1455 
1456 	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1457 	softc = &cfiscsi_softc;
1458 
1459 	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1460 	    cihp->initiator_name, cihp->initiator_addr,
1461 	    cihp->target_name);
1462 
1463 	ct = cfiscsi_target_find(softc, cihp->target_name,
1464 	    cihp->portal_group_tag);
1465 	if (ct == NULL) {
1466 		ci->status = CTL_ISCSI_ERROR;
1467 		snprintf(ci->error_str, sizeof(ci->error_str),
1468 		    "%s: target not found", __func__);
1469 		return;
1470 	}
1471 
1472 #ifdef ICL_KERNEL_PROXY
1473 	if (cihp->socket > 0 && cihp->connection_id > 0) {
1474 		snprintf(ci->error_str, sizeof(ci->error_str),
1475 		    "both socket and connection_id set");
1476 		ci->status = CTL_ISCSI_ERROR;
1477 		cfiscsi_target_release(ct);
1478 		return;
1479 	}
1480 	if (cihp->socket == 0) {
1481 		mtx_lock(&cfiscsi_softc.lock);
1482 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1483 			if (cs->cs_id == cihp->connection_id)
1484 				break;
1485 		}
1486 		if (cs == NULL) {
1487 			mtx_unlock(&cfiscsi_softc.lock);
1488 			snprintf(ci->error_str, sizeof(ci->error_str),
1489 			    "connection not found");
1490 			ci->status = CTL_ISCSI_ERROR;
1491 			cfiscsi_target_release(ct);
1492 			return;
1493 		}
1494 		mtx_unlock(&cfiscsi_softc.lock);
1495 	} else {
1496 #endif
1497 		cs = cfiscsi_session_new(softc, cihp->offload);
1498 		if (cs == NULL) {
1499 			ci->status = CTL_ISCSI_ERROR;
1500 			snprintf(ci->error_str, sizeof(ci->error_str),
1501 			    "%s: cfiscsi_session_new failed", __func__);
1502 			cfiscsi_target_release(ct);
1503 			return;
1504 		}
1505 #ifdef ICL_KERNEL_PROXY
1506 	}
1507 #endif
1508 
1509 	/*
1510 	 * First PDU of Full Feature phase has the same CmdSN as the last
1511 	 * PDU from the Login Phase received from the initiator.  Thus,
1512 	 * the -1 below.
1513 	 */
1514 	cs->cs_cmdsn = cihp->cmdsn;
1515 	cs->cs_statsn = cihp->statsn;
1516 	cs->cs_max_recv_data_segment_length = cihp->max_recv_data_segment_length;
1517 	cs->cs_max_send_data_segment_length = cihp->max_send_data_segment_length;
1518 	cs->cs_max_burst_length = cihp->max_burst_length;
1519 	cs->cs_first_burst_length = cihp->first_burst_length;
1520 	cs->cs_immediate_data = !!cihp->immediate_data;
1521 	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1522 		cs->cs_conn->ic_header_crc32c = true;
1523 	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1524 		cs->cs_conn->ic_data_crc32c = true;
1525 
1526 	strlcpy(cs->cs_initiator_name,
1527 	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1528 	strlcpy(cs->cs_initiator_addr,
1529 	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1530 	strlcpy(cs->cs_initiator_alias,
1531 	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1532 	memcpy(cs->cs_initiator_isid,
1533 	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1534 	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1535 	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1536 	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1537 	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1538 	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1539 
1540 	mtx_lock(&softc->lock);
1541 	if (ct->ct_online == 0) {
1542 		mtx_unlock(&softc->lock);
1543 		cfiscsi_session_terminate(cs);
1544 		cfiscsi_target_release(ct);
1545 		ci->status = CTL_ISCSI_ERROR;
1546 		snprintf(ci->error_str, sizeof(ci->error_str),
1547 		    "%s: port offline", __func__);
1548 		return;
1549 	}
1550 	cs->cs_target = ct;
1551 	mtx_unlock(&softc->lock);
1552 
1553 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1554 restart:
1555 	if (!cs->cs_terminating) {
1556 		mtx_lock(&softc->lock);
1557 		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1558 			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1559 			    cs->cs_target == cs2->cs_target &&
1560 			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1561 				if (strcmp(cs->cs_initiator_addr,
1562 				    cs2->cs_initiator_addr) != 0) {
1563 					CFISCSI_SESSION_WARN(cs2,
1564 					    "session reinstatement from "
1565 					    "different address %s",
1566 					    cs->cs_initiator_addr);
1567 				} else {
1568 					CFISCSI_SESSION_DEBUG(cs2,
1569 					    "session reinstatement");
1570 				}
1571 				cfiscsi_session_terminate(cs2);
1572 				mtx_unlock(&softc->lock);
1573 				pause("cfiscsi_reinstate", 1);
1574 				goto restart;
1575 			}
1576 		}
1577 		mtx_unlock(&softc->lock);
1578 	}
1579 
1580 	/*
1581 	 * Register initiator with CTL.
1582 	 */
1583 	cfiscsi_session_register_initiator(cs);
1584 
1585 #ifdef ICL_KERNEL_PROXY
1586 	if (cihp->socket > 0) {
1587 #endif
1588 		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1589 		if (error != 0) {
1590 			cfiscsi_session_terminate(cs);
1591 			refcount_release(&cs->cs_outstanding_ctl_pdus);
1592 			ci->status = CTL_ISCSI_ERROR;
1593 			snprintf(ci->error_str, sizeof(ci->error_str),
1594 			    "%s: icl_conn_handoff failed with error %d",
1595 			    __func__, error);
1596 			return;
1597 		}
1598 #ifdef ICL_KERNEL_PROXY
1599 	}
1600 #endif
1601 
1602 #ifdef ICL_KERNEL_PROXY
1603 	cs->cs_login_phase = false;
1604 
1605 	/*
1606 	 * First PDU of the Full Feature phase has likely already arrived.
1607 	 * We have to pick it up and execute properly.
1608 	 */
1609 	if (cs->cs_login_pdu != NULL) {
1610 		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1611 		cfiscsi_pdu_handle(cs->cs_login_pdu);
1612 		cs->cs_login_pdu = NULL;
1613 	}
1614 #endif
1615 
1616 	refcount_release(&cs->cs_outstanding_ctl_pdus);
1617 	ci->status = CTL_ISCSI_OK;
1618 }
1619 
1620 static void
1621 cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1622 {
1623 	struct ctl_iscsi_list_params *cilp;
1624 	struct cfiscsi_session *cs;
1625 	struct cfiscsi_softc *softc;
1626 	struct sbuf *sb;
1627 	int error;
1628 
1629 	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1630 	softc = &cfiscsi_softc;
1631 
1632 	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1633 	if (sb == NULL) {
1634 		ci->status = CTL_ISCSI_ERROR;
1635 		snprintf(ci->error_str, sizeof(ci->error_str),
1636 		    "Unable to allocate %d bytes for iSCSI session list",
1637 		    cilp->alloc_len);
1638 		return;
1639 	}
1640 
1641 	sbuf_printf(sb, "<ctlislist>\n");
1642 	mtx_lock(&softc->lock);
1643 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1644 #ifdef ICL_KERNEL_PROXY
1645 		if (cs->cs_target == NULL)
1646 			continue;
1647 #endif
1648 		error = sbuf_printf(sb, "<connection id=\"%d\">"
1649 		    "<initiator>%s</initiator>"
1650 		    "<initiator_addr>%s</initiator_addr>"
1651 		    "<initiator_alias>%s</initiator_alias>"
1652 		    "<target>%s</target>"
1653 		    "<target_alias>%s</target_alias>"
1654 		    "<target_portal_group_tag>%u</target_portal_group_tag>"
1655 		    "<header_digest>%s</header_digest>"
1656 		    "<data_digest>%s</data_digest>"
1657 		    "<max_recv_data_segment_length>%d</max_recv_data_segment_length>"
1658 		    "<max_send_data_segment_length>%d</max_send_data_segment_length>"
1659 		    "<max_burst_length>%d</max_burst_length>"
1660 		    "<first_burst_length>%d</first_burst_length>"
1661 		    "<immediate_data>%d</immediate_data>"
1662 		    "<iser>%d</iser>"
1663 		    "<offload>%s</offload>"
1664 		    "</connection>\n",
1665 		    cs->cs_id,
1666 		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1667 		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1668 		    cs->cs_target->ct_tag,
1669 		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1670 		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1671 		    cs->cs_max_recv_data_segment_length,
1672 		    cs->cs_max_send_data_segment_length,
1673 		    cs->cs_max_burst_length,
1674 		    cs->cs_first_burst_length,
1675 		    cs->cs_immediate_data,
1676 		    cs->cs_conn->ic_iser,
1677 		    cs->cs_conn->ic_offload);
1678 		if (error != 0)
1679 			break;
1680 	}
1681 	mtx_unlock(&softc->lock);
1682 	error = sbuf_printf(sb, "</ctlislist>\n");
1683 	if (error != 0) {
1684 		sbuf_delete(sb);
1685 		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1686 		snprintf(ci->error_str, sizeof(ci->error_str),
1687 		    "Out of space, %d bytes is too small", cilp->alloc_len);
1688 		return;
1689 	}
1690 	sbuf_finish(sb);
1691 
1692 	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1693 	cilp->fill_len = sbuf_len(sb) + 1;
1694 	ci->status = CTL_ISCSI_OK;
1695 	sbuf_delete(sb);
1696 }
1697 
1698 static void
1699 cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1700 {
1701 	struct icl_pdu *response;
1702 	struct iscsi_bhs_asynchronous_message *bhsam;
1703 	struct ctl_iscsi_logout_params *cilp;
1704 	struct cfiscsi_session *cs;
1705 	struct cfiscsi_softc *softc;
1706 	int found = 0;
1707 
1708 	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1709 	softc = &cfiscsi_softc;
1710 
1711 	mtx_lock(&softc->lock);
1712 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1713 		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1714 		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1715 		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1716 			continue;
1717 
1718 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1719 		if (response == NULL) {
1720 			ci->status = CTL_ISCSI_ERROR;
1721 			snprintf(ci->error_str, sizeof(ci->error_str),
1722 			    "Unable to allocate memory");
1723 			mtx_unlock(&softc->lock);
1724 			return;
1725 		}
1726 		bhsam =
1727 		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1728 		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1729 		bhsam->bhsam_flags = 0x80;
1730 		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1731 		bhsam->bhsam_parameter3 = htons(10);
1732 		cfiscsi_pdu_queue(response);
1733 		found++;
1734 	}
1735 	mtx_unlock(&softc->lock);
1736 
1737 	if (found == 0) {
1738 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1739 		snprintf(ci->error_str, sizeof(ci->error_str),
1740 		    "No matching connections found");
1741 		return;
1742 	}
1743 
1744 	ci->status = CTL_ISCSI_OK;
1745 }
1746 
1747 static void
1748 cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1749 {
1750 	struct icl_pdu *response;
1751 	struct iscsi_bhs_asynchronous_message *bhsam;
1752 	struct ctl_iscsi_terminate_params *citp;
1753 	struct cfiscsi_session *cs;
1754 	struct cfiscsi_softc *softc;
1755 	int found = 0;
1756 
1757 	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1758 	softc = &cfiscsi_softc;
1759 
1760 	mtx_lock(&softc->lock);
1761 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1762 		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1763 		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1764 		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1765 			continue;
1766 
1767 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1768 		if (response == NULL) {
1769 			/*
1770 			 * Oh well.  Just terminate the connection.
1771 			 */
1772 		} else {
1773 			bhsam = (struct iscsi_bhs_asynchronous_message *)
1774 			    response->ip_bhs;
1775 			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1776 			bhsam->bhsam_flags = 0x80;
1777 			bhsam->bhsam_0xffffffff = 0xffffffff;
1778 			bhsam->bhsam_async_event =
1779 			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1780 			cfiscsi_pdu_queue(response);
1781 		}
1782 		cfiscsi_session_terminate(cs);
1783 		found++;
1784 	}
1785 	mtx_unlock(&softc->lock);
1786 
1787 	if (found == 0) {
1788 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1789 		snprintf(ci->error_str, sizeof(ci->error_str),
1790 		    "No matching connections found");
1791 		return;
1792 	}
1793 
1794 	ci->status = CTL_ISCSI_OK;
1795 }
1796 
1797 static void
1798 cfiscsi_ioctl_limits(struct ctl_iscsi *ci)
1799 {
1800 	struct ctl_iscsi_limits_params *cilp;
1801 	struct icl_drv_limits idl;
1802 	int error;
1803 
1804 	cilp = (struct ctl_iscsi_limits_params *)&(ci->data);
1805 
1806 	error = icl_limits(cilp->offload, false, &idl);
1807 	if (error != 0) {
1808 		ci->status = CTL_ISCSI_ERROR;
1809 		snprintf(ci->error_str, sizeof(ci->error_str),
1810 			"%s: icl_limits failed with error %d",
1811 			__func__, error);
1812 		return;
1813 	}
1814 
1815 	cilp->max_recv_data_segment_length =
1816 	    idl.idl_max_recv_data_segment_length;
1817 	cilp->max_send_data_segment_length =
1818 	    idl.idl_max_send_data_segment_length;
1819 	cilp->max_burst_length = idl.idl_max_burst_length;
1820 	cilp->first_burst_length = idl.idl_first_burst_length;
1821 
1822 	ci->status = CTL_ISCSI_OK;
1823 }
1824 
1825 #ifdef ICL_KERNEL_PROXY
1826 static void
1827 cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1828 {
1829 	struct ctl_iscsi_listen_params *cilp;
1830 	struct sockaddr *sa;
1831 	int error;
1832 
1833 	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1834 
1835 	if (cfiscsi_softc.listener == NULL) {
1836 		CFISCSI_DEBUG("no listener");
1837 		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1838 		ci->status = CTL_ISCSI_ERROR;
1839 		return;
1840 	}
1841 
1842 	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1843 	if (error != 0) {
1844 		CFISCSI_DEBUG("getsockaddr, error %d", error);
1845 		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1846 		ci->status = CTL_ISCSI_ERROR;
1847 		return;
1848 	}
1849 
1850 	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1851 	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1852 	if (error != 0) {
1853 		free(sa, M_SONAME);
1854 		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1855 		snprintf(ci->error_str, sizeof(ci->error_str),
1856 		    "icl_listen_add failed, error %d", error);
1857 		ci->status = CTL_ISCSI_ERROR;
1858 		return;
1859 	}
1860 
1861 	ci->status = CTL_ISCSI_OK;
1862 }
1863 
1864 static void
1865 cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1866 {
1867 	struct ctl_iscsi_accept_params *ciap;
1868 	struct cfiscsi_session *cs;
1869 	int error;
1870 
1871 	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1872 
1873 	mtx_lock(&cfiscsi_softc.lock);
1874 	for (;;) {
1875 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1876 			if (cs->cs_waiting_for_ctld)
1877 				break;
1878 		}
1879 		if (cs != NULL)
1880 			break;
1881 		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1882 		if (error != 0) {
1883 			mtx_unlock(&cfiscsi_softc.lock);
1884 			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1885 			ci->status = CTL_ISCSI_ERROR;
1886 			return;
1887 		}
1888 	}
1889 	mtx_unlock(&cfiscsi_softc.lock);
1890 
1891 	cs->cs_waiting_for_ctld = false;
1892 	cs->cs_login_phase = true;
1893 
1894 	ciap->connection_id = cs->cs_id;
1895 	ciap->portal_id = cs->cs_portal_id;
1896 	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1897 	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1898 	    cs->cs_initiator_sa->sa_len);
1899 	if (error != 0) {
1900 		snprintf(ci->error_str, sizeof(ci->error_str),
1901 		    "copyout failed with error %d", error);
1902 		ci->status = CTL_ISCSI_ERROR;
1903 		return;
1904 	}
1905 
1906 	ci->status = CTL_ISCSI_OK;
1907 }
1908 
1909 static void
1910 cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1911 {
1912 	struct ctl_iscsi_send_params *cisp;
1913 	struct cfiscsi_session *cs;
1914 	struct icl_pdu *ip;
1915 	size_t datalen;
1916 	void *data;
1917 	int error;
1918 
1919 	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1920 
1921 	mtx_lock(&cfiscsi_softc.lock);
1922 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1923 		if (cs->cs_id == cisp->connection_id)
1924 			break;
1925 	}
1926 	if (cs == NULL) {
1927 		mtx_unlock(&cfiscsi_softc.lock);
1928 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1929 		ci->status = CTL_ISCSI_ERROR;
1930 		return;
1931 	}
1932 	mtx_unlock(&cfiscsi_softc.lock);
1933 
1934 #if 0
1935 	if (cs->cs_login_phase == false)
1936 		return (EBUSY);
1937 #endif
1938 
1939 	if (cs->cs_terminating) {
1940 		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1941 		ci->status = CTL_ISCSI_ERROR;
1942 		return;
1943 	}
1944 
1945 	datalen = cisp->data_segment_len;
1946 	/*
1947 	 * XXX
1948 	 */
1949 	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1950 	if (datalen > 65535) {
1951 		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1952 		ci->status = CTL_ISCSI_ERROR;
1953 		return;
1954 	}
1955 	if (datalen > 0) {
1956 		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1957 		error = copyin(cisp->data_segment, data, datalen);
1958 		if (error != 0) {
1959 			free(data, M_CFISCSI);
1960 			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1961 			ci->status = CTL_ISCSI_ERROR;
1962 			return;
1963 		}
1964 	}
1965 
1966 	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
1967 	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1968 	if (datalen > 0) {
1969 		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1970 		free(data, M_CFISCSI);
1971 	}
1972 	CFISCSI_SESSION_LOCK(cs);
1973 	icl_pdu_queue(ip);
1974 	CFISCSI_SESSION_UNLOCK(cs);
1975 	ci->status = CTL_ISCSI_OK;
1976 }
1977 
1978 static void
1979 cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1980 {
1981 	struct ctl_iscsi_receive_params *cirp;
1982 	struct cfiscsi_session *cs;
1983 	struct icl_pdu *ip;
1984 	void *data;
1985 	int error;
1986 
1987 	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1988 
1989 	mtx_lock(&cfiscsi_softc.lock);
1990 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1991 		if (cs->cs_id == cirp->connection_id)
1992 			break;
1993 	}
1994 	if (cs == NULL) {
1995 		mtx_unlock(&cfiscsi_softc.lock);
1996 		snprintf(ci->error_str, sizeof(ci->error_str),
1997 		    "connection not found");
1998 		ci->status = CTL_ISCSI_ERROR;
1999 		return;
2000 	}
2001 	mtx_unlock(&cfiscsi_softc.lock);
2002 
2003 #if 0
2004 	if (is->is_login_phase == false)
2005 		return (EBUSY);
2006 #endif
2007 
2008 	CFISCSI_SESSION_LOCK(cs);
2009 	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
2010 		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
2011 		if (error != 0) {
2012 			CFISCSI_SESSION_UNLOCK(cs);
2013 			snprintf(ci->error_str, sizeof(ci->error_str),
2014 			    "interrupted by signal");
2015 			ci->status = CTL_ISCSI_ERROR;
2016 			return;
2017 		}
2018 	}
2019 
2020 	if (cs->cs_terminating) {
2021 		CFISCSI_SESSION_UNLOCK(cs);
2022 		snprintf(ci->error_str, sizeof(ci->error_str),
2023 		    "connection terminating");
2024 		ci->status = CTL_ISCSI_ERROR;
2025 		return;
2026 	}
2027 	ip = cs->cs_login_pdu;
2028 	cs->cs_login_pdu = NULL;
2029 	CFISCSI_SESSION_UNLOCK(cs);
2030 
2031 	if (ip->ip_data_len > cirp->data_segment_len) {
2032 		icl_pdu_free(ip);
2033 		snprintf(ci->error_str, sizeof(ci->error_str),
2034 		    "data segment too big");
2035 		ci->status = CTL_ISCSI_ERROR;
2036 		return;
2037 	}
2038 
2039 	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
2040 	if (ip->ip_data_len > 0) {
2041 		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
2042 		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
2043 		copyout(data, cirp->data_segment, ip->ip_data_len);
2044 		free(data, M_CFISCSI);
2045 	}
2046 
2047 	icl_pdu_free(ip);
2048 	ci->status = CTL_ISCSI_OK;
2049 }
2050 
2051 #endif /* !ICL_KERNEL_PROXY */
2052 
2053 static void
2054 cfiscsi_ioctl_port_create(struct ctl_req *req)
2055 {
2056 	struct cfiscsi_target *ct;
2057 	struct ctl_port *port;
2058 	const char *target, *alias, *tags;
2059 	struct scsi_vpd_id_descriptor *desc;
2060 	ctl_options_t opts;
2061 	int retval, len, idlen;
2062 	uint16_t tag;
2063 
2064 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2065 	target = ctl_get_opt(&opts, "cfiscsi_target");
2066 	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
2067 	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2068 	if (target == NULL || tags == NULL) {
2069 		req->status = CTL_LUN_ERROR;
2070 		snprintf(req->error_str, sizeof(req->error_str),
2071 		    "Missing required argument");
2072 		ctl_free_opts(&opts);
2073 		return;
2074 	}
2075 	tag = strtol(tags, (char **)NULL, 10);
2076 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias, tag);
2077 	if (ct == NULL) {
2078 		req->status = CTL_LUN_ERROR;
2079 		snprintf(req->error_str, sizeof(req->error_str),
2080 		    "failed to create target \"%s\"", target);
2081 		ctl_free_opts(&opts);
2082 		return;
2083 	}
2084 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
2085 		req->status = CTL_LUN_ERROR;
2086 		snprintf(req->error_str, sizeof(req->error_str),
2087 		    "target \"%s\" for portal group tag %u already exists",
2088 		    target, tag);
2089 		cfiscsi_target_release(ct);
2090 		ctl_free_opts(&opts);
2091 		return;
2092 	}
2093 	port = &ct->ct_port;
2094 	// WAT
2095 	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
2096 		goto done;
2097 
2098 	port->frontend = &cfiscsi_frontend;
2099 	port->port_type = CTL_PORT_ISCSI;
2100 	/* XXX KDM what should the real number be here? */
2101 	port->num_requested_ctl_io = 4096;
2102 	port->port_name = "iscsi";
2103 	port->physical_port = tag;
2104 	port->virtual_port = ct->ct_target_id;
2105 	port->port_online = cfiscsi_online;
2106 	port->port_offline = cfiscsi_offline;
2107 	port->port_info = cfiscsi_info;
2108 	port->onoff_arg = ct;
2109 	port->fe_datamove = cfiscsi_datamove;
2110 	port->fe_done = cfiscsi_done;
2111 
2112 	/* XXX KDM what should we report here? */
2113 	/* XXX These should probably be fetched from CTL. */
2114 	port->max_targets = 1;
2115 	port->max_target_id = 15;
2116 	port->targ_port = -1;
2117 
2118 	port->options = opts;
2119 	STAILQ_INIT(&opts);
2120 
2121 	/* Generate Port ID. */
2122 	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2123 	idlen = roundup2(idlen, 4);
2124 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2125 	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2126 	    M_CTL, M_WAITOK | M_ZERO);
2127 	port->port_devid->len = len;
2128 	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2129 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2130 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2131 	    SVPD_ID_TYPE_SCSI_NAME;
2132 	desc->length = idlen;
2133 	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x", target, tag);
2134 
2135 	/* Generate Target ID. */
2136 	idlen = strlen(target) + 1;
2137 	idlen = roundup2(idlen, 4);
2138 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2139 	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2140 	    M_CTL, M_WAITOK | M_ZERO);
2141 	port->target_devid->len = len;
2142 	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2143 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2144 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2145 	    SVPD_ID_TYPE_SCSI_NAME;
2146 	desc->length = idlen;
2147 	strlcpy(desc->identifier, target, idlen);
2148 
2149 	retval = ctl_port_register(port);
2150 	if (retval != 0) {
2151 		ctl_free_opts(&port->options);
2152 		cfiscsi_target_release(ct);
2153 		free(port->port_devid, M_CFISCSI);
2154 		free(port->target_devid, M_CFISCSI);
2155 		req->status = CTL_LUN_ERROR;
2156 		snprintf(req->error_str, sizeof(req->error_str),
2157 		    "ctl_port_register() failed with error %d", retval);
2158 		return;
2159 	}
2160 done:
2161 	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2162 	req->status = CTL_LUN_OK;
2163 	memcpy(req->kern_args[0].kvalue, &port->targ_port,
2164 	    sizeof(port->targ_port)); //XXX
2165 }
2166 
2167 static void
2168 cfiscsi_ioctl_port_remove(struct ctl_req *req)
2169 {
2170 	struct cfiscsi_target *ct;
2171 	const char *target, *tags;
2172 	ctl_options_t opts;
2173 	uint16_t tag;
2174 
2175 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2176 	target = ctl_get_opt(&opts, "cfiscsi_target");
2177 	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2178 	if (target == NULL || tags == NULL) {
2179 		ctl_free_opts(&opts);
2180 		req->status = CTL_LUN_ERROR;
2181 		snprintf(req->error_str, sizeof(req->error_str),
2182 		    "Missing required argument");
2183 		return;
2184 	}
2185 	tag = strtol(tags, (char **)NULL, 10);
2186 	ct = cfiscsi_target_find(&cfiscsi_softc, target, tag);
2187 	if (ct == NULL) {
2188 		ctl_free_opts(&opts);
2189 		req->status = CTL_LUN_ERROR;
2190 		snprintf(req->error_str, sizeof(req->error_str),
2191 		    "can't find target \"%s\"", target);
2192 		return;
2193 	}
2194 	if (ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE) {
2195 		ctl_free_opts(&opts);
2196 		req->status = CTL_LUN_ERROR;
2197 		snprintf(req->error_str, sizeof(req->error_str),
2198 		    "target \"%s\" is already dying", target);
2199 		return;
2200 	}
2201 	ctl_free_opts(&opts);
2202 
2203 	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2204 	ctl_port_offline(&ct->ct_port);
2205 	cfiscsi_target_release(ct);
2206 	cfiscsi_target_release(ct);
2207 	req->status = CTL_LUN_OK;
2208 }
2209 
2210 static int
2211 cfiscsi_ioctl(struct cdev *dev,
2212     u_long cmd, caddr_t addr, int flag, struct thread *td)
2213 {
2214 	struct ctl_iscsi *ci;
2215 	struct ctl_req *req;
2216 
2217 	if (cmd == CTL_PORT_REQ) {
2218 		req = (struct ctl_req *)addr;
2219 		switch (req->reqtype) {
2220 		case CTL_REQ_CREATE:
2221 			cfiscsi_ioctl_port_create(req);
2222 			break;
2223 		case CTL_REQ_REMOVE:
2224 			cfiscsi_ioctl_port_remove(req);
2225 			break;
2226 		default:
2227 			req->status = CTL_LUN_ERROR;
2228 			snprintf(req->error_str, sizeof(req->error_str),
2229 			    "Unsupported request type %d", req->reqtype);
2230 		}
2231 		return (0);
2232 	}
2233 
2234 	if (cmd != CTL_ISCSI)
2235 		return (ENOTTY);
2236 
2237 	ci = (struct ctl_iscsi *)addr;
2238 	switch (ci->type) {
2239 	case CTL_ISCSI_HANDOFF:
2240 		cfiscsi_ioctl_handoff(ci);
2241 		break;
2242 	case CTL_ISCSI_LIST:
2243 		cfiscsi_ioctl_list(ci);
2244 		break;
2245 	case CTL_ISCSI_LOGOUT:
2246 		cfiscsi_ioctl_logout(ci);
2247 		break;
2248 	case CTL_ISCSI_TERMINATE:
2249 		cfiscsi_ioctl_terminate(ci);
2250 		break;
2251 	case CTL_ISCSI_LIMITS:
2252 		cfiscsi_ioctl_limits(ci);
2253 		break;
2254 #ifdef ICL_KERNEL_PROXY
2255 	case CTL_ISCSI_LISTEN:
2256 		cfiscsi_ioctl_listen(ci);
2257 		break;
2258 	case CTL_ISCSI_ACCEPT:
2259 		cfiscsi_ioctl_accept(ci);
2260 		break;
2261 	case CTL_ISCSI_SEND:
2262 		cfiscsi_ioctl_send(ci);
2263 		break;
2264 	case CTL_ISCSI_RECEIVE:
2265 		cfiscsi_ioctl_receive(ci);
2266 		break;
2267 #else
2268 	case CTL_ISCSI_LISTEN:
2269 	case CTL_ISCSI_ACCEPT:
2270 	case CTL_ISCSI_SEND:
2271 	case CTL_ISCSI_RECEIVE:
2272 		ci->status = CTL_ISCSI_ERROR;
2273 		snprintf(ci->error_str, sizeof(ci->error_str),
2274 		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2275 		    __func__);
2276 		break;
2277 #endif /* !ICL_KERNEL_PROXY */
2278 	default:
2279 		ci->status = CTL_ISCSI_ERROR;
2280 		snprintf(ci->error_str, sizeof(ci->error_str),
2281 		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2282 		break;
2283 	}
2284 
2285 	return (0);
2286 }
2287 
2288 static void
2289 cfiscsi_target_hold(struct cfiscsi_target *ct)
2290 {
2291 
2292 	refcount_acquire(&ct->ct_refcount);
2293 }
2294 
2295 static void
2296 cfiscsi_target_release(struct cfiscsi_target *ct)
2297 {
2298 	struct cfiscsi_softc *softc;
2299 
2300 	softc = ct->ct_softc;
2301 	mtx_lock(&softc->lock);
2302 	if (refcount_release(&ct->ct_refcount)) {
2303 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2304 		mtx_unlock(&softc->lock);
2305 		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2306 			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2307 			if (ctl_port_deregister(&ct->ct_port) != 0)
2308 				printf("%s: ctl_port_deregister() failed\n",
2309 				    __func__);
2310 		}
2311 		free(ct, M_CFISCSI);
2312 
2313 		return;
2314 	}
2315 	mtx_unlock(&softc->lock);
2316 }
2317 
2318 static struct cfiscsi_target *
2319 cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name, uint16_t tag)
2320 {
2321 	struct cfiscsi_target *ct;
2322 
2323 	mtx_lock(&softc->lock);
2324 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2325 		if (ct->ct_tag != tag ||
2326 		    strcmp(name, ct->ct_name) != 0 ||
2327 		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2328 			continue;
2329 		cfiscsi_target_hold(ct);
2330 		mtx_unlock(&softc->lock);
2331 		return (ct);
2332 	}
2333 	mtx_unlock(&softc->lock);
2334 
2335 	return (NULL);
2336 }
2337 
2338 static struct cfiscsi_target *
2339 cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2340     const char *alias, uint16_t tag)
2341 {
2342 	struct cfiscsi_target *ct, *newct;
2343 
2344 	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2345 		return (NULL);
2346 
2347 	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2348 
2349 	mtx_lock(&softc->lock);
2350 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2351 		if (ct->ct_tag != tag ||
2352 		    strcmp(name, ct->ct_name) != 0 ||
2353 		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2354 			continue;
2355 		cfiscsi_target_hold(ct);
2356 		mtx_unlock(&softc->lock);
2357 		free(newct, M_CFISCSI);
2358 		return (ct);
2359 	}
2360 
2361 	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2362 	if (alias != NULL)
2363 		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2364 	newct->ct_tag = tag;
2365 	refcount_init(&newct->ct_refcount, 1);
2366 	newct->ct_softc = softc;
2367 	if (TAILQ_EMPTY(&softc->targets))
2368 		softc->last_target_id = 0;
2369 	newct->ct_target_id = ++softc->last_target_id;
2370 	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2371 	mtx_unlock(&softc->lock);
2372 
2373 	return (newct);
2374 }
2375 
2376 static void
2377 cfiscsi_datamove_in(union ctl_io *io)
2378 {
2379 	struct cfiscsi_session *cs;
2380 	struct icl_pdu *request, *response;
2381 	const struct iscsi_bhs_scsi_command *bhssc;
2382 	struct iscsi_bhs_data_in *bhsdi;
2383 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2384 	size_t len, expected_len, sg_len, buffer_offset;
2385 	const char *sg_addr;
2386 	int ctl_sg_count, error, i;
2387 
2388 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2389 	cs = PDU_SESSION(request);
2390 
2391 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2392 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2393 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2394 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2395 
2396 	if (io->scsiio.kern_sg_entries > 0) {
2397 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2398 		ctl_sg_count = io->scsiio.kern_sg_entries;
2399 	} else {
2400 		ctl_sglist = &ctl_sg_entry;
2401 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2402 		ctl_sglist->len = io->scsiio.kern_data_len;
2403 		ctl_sg_count = 1;
2404 	}
2405 
2406 	/*
2407 	 * This is the total amount of data to be transferred within the current
2408 	 * SCSI command.  We need to record it so that we can properly report
2409 	 * underflow/underflow.
2410 	 */
2411 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2412 
2413 	/*
2414 	 * This is the offset within the current SCSI command; for the first
2415 	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2416 	 * it will be the sum of lengths of previous ones.
2417 	 */
2418 	buffer_offset = io->scsiio.kern_rel_offset;
2419 
2420 	/*
2421 	 * This is the transfer length expected by the initiator.  In theory,
2422 	 * it could be different from the correct amount of data from the SCSI
2423 	 * point of view, even if that doesn't make any sense.
2424 	 */
2425 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2426 #if 0
2427 	if (expected_len != io->scsiio.kern_total_len) {
2428 		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2429 		    "actual length %zd", expected_len,
2430 		    (size_t)io->scsiio.kern_total_len);
2431 	}
2432 #endif
2433 
2434 	if (buffer_offset >= expected_len) {
2435 #if 0
2436 		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2437 		    "already sent the expected len", buffer_offset);
2438 #endif
2439 		io->scsiio.be_move_done(io);
2440 		return;
2441 	}
2442 
2443 	i = 0;
2444 	sg_addr = NULL;
2445 	sg_len = 0;
2446 	response = NULL;
2447 	bhsdi = NULL;
2448 	for (;;) {
2449 		if (response == NULL) {
2450 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2451 			if (response == NULL) {
2452 				CFISCSI_SESSION_WARN(cs, "failed to "
2453 				    "allocate memory; dropping connection");
2454 				ctl_set_busy(&io->scsiio);
2455 				io->scsiio.be_move_done(io);
2456 				cfiscsi_session_terminate(cs);
2457 				return;
2458 			}
2459 			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2460 			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2461 			bhsdi->bhsdi_initiator_task_tag =
2462 			    bhssc->bhssc_initiator_task_tag;
2463 			bhsdi->bhsdi_target_transfer_tag = 0xffffffff;
2464 			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2465 			PDU_EXPDATASN(request)++;
2466 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2467 		}
2468 
2469 		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2470 		if (sg_len == 0) {
2471 			sg_addr = ctl_sglist[i].addr;
2472 			sg_len = ctl_sglist[i].len;
2473 			KASSERT(sg_len > 0, ("sg_len <= 0"));
2474 		}
2475 
2476 		len = sg_len;
2477 
2478 		/*
2479 		 * Truncate to maximum data segment length.
2480 		 */
2481 		KASSERT(response->ip_data_len < cs->cs_max_send_data_segment_length,
2482 		    ("ip_data_len %zd >= max_send_data_segment_length %d",
2483 		    response->ip_data_len, cs->cs_max_send_data_segment_length));
2484 		if (response->ip_data_len + len >
2485 		    cs->cs_max_send_data_segment_length) {
2486 			len = cs->cs_max_send_data_segment_length -
2487 			    response->ip_data_len;
2488 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2489 			    len, sg_len));
2490 		}
2491 
2492 		/*
2493 		 * Truncate to expected data transfer length.
2494 		 */
2495 		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2496 		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2497 		    buffer_offset, response->ip_data_len, expected_len));
2498 		if (buffer_offset + response->ip_data_len + len > expected_len) {
2499 			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2500 			    "to expected data transfer length %zd",
2501 			    buffer_offset + response->ip_data_len + len, expected_len);
2502 			len = expected_len - (buffer_offset + response->ip_data_len);
2503 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2504 			    len, sg_len));
2505 		}
2506 
2507 		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2508 		if (error != 0) {
2509 			CFISCSI_SESSION_WARN(cs, "failed to "
2510 			    "allocate memory; dropping connection");
2511 			icl_pdu_free(response);
2512 			ctl_set_busy(&io->scsiio);
2513 			io->scsiio.be_move_done(io);
2514 			cfiscsi_session_terminate(cs);
2515 			return;
2516 		}
2517 		sg_addr += len;
2518 		sg_len -= len;
2519 		io->scsiio.kern_data_resid -= len;
2520 
2521 		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2522 		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2523 		    buffer_offset, response->ip_data_len, expected_len));
2524 		if (buffer_offset + response->ip_data_len == expected_len) {
2525 			/*
2526 			 * Already have the amount of data the initiator wanted.
2527 			 */
2528 			break;
2529 		}
2530 
2531 		if (sg_len == 0) {
2532 			/*
2533 			 * End of scatter-gather segment;
2534 			 * proceed to the next one...
2535 			 */
2536 			if (i == ctl_sg_count - 1) {
2537 				/*
2538 				 * ... unless this was the last one.
2539 				 */
2540 				break;
2541 			}
2542 			i++;
2543 		}
2544 
2545 		if (response->ip_data_len == cs->cs_max_send_data_segment_length) {
2546 			/*
2547 			 * Can't stuff more data into the current PDU;
2548 			 * queue it.  Note that's not enough to check
2549 			 * for kern_data_resid == 0 instead; there
2550 			 * may be several Data-In PDUs for the final
2551 			 * call to cfiscsi_datamove(), and we want
2552 			 * to set the F flag only on the last of them.
2553 			 */
2554 			buffer_offset += response->ip_data_len;
2555 			if (buffer_offset == io->scsiio.kern_total_len ||
2556 			    buffer_offset == expected_len) {
2557 				buffer_offset -= response->ip_data_len;
2558 				break;
2559 			}
2560 			cfiscsi_pdu_queue(response);
2561 			response = NULL;
2562 			bhsdi = NULL;
2563 		}
2564 	}
2565 	if (response != NULL) {
2566 		buffer_offset += response->ip_data_len;
2567 		if (buffer_offset == io->scsiio.kern_total_len ||
2568 		    buffer_offset == expected_len) {
2569 			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2570 			if (io->io_hdr.status == CTL_SUCCESS) {
2571 				bhsdi->bhsdi_flags |= BHSDI_FLAGS_S;
2572 				if (PDU_TOTAL_TRANSFER_LEN(request) <
2573 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2574 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2575 					bhsdi->bhsdi_residual_count =
2576 					    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2577 					    PDU_TOTAL_TRANSFER_LEN(request));
2578 				} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2579 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2580 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2581 					bhsdi->bhsdi_residual_count =
2582 					    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2583 					    ntohl(bhssc->bhssc_expected_data_transfer_length));
2584 				}
2585 				bhsdi->bhsdi_status = io->scsiio.scsi_status;
2586 				io->io_hdr.flags |= CTL_FLAG_STATUS_SENT;
2587 			}
2588 		}
2589 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2590 		cfiscsi_pdu_queue(response);
2591 	}
2592 
2593 	io->scsiio.be_move_done(io);
2594 }
2595 
2596 static void
2597 cfiscsi_datamove_out(union ctl_io *io)
2598 {
2599 	struct cfiscsi_session *cs;
2600 	struct icl_pdu *request, *response;
2601 	const struct iscsi_bhs_scsi_command *bhssc;
2602 	struct iscsi_bhs_r2t *bhsr2t;
2603 	struct cfiscsi_data_wait *cdw;
2604 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2605 	uint32_t expected_len, datamove_len, r2t_off, r2t_len;
2606 	uint32_t target_transfer_tag;
2607 	bool done;
2608 
2609 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2610 	cs = PDU_SESSION(request);
2611 
2612 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2613 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2614 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2615 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2616 
2617 	/*
2618 	 * We need to record it so that we can properly report
2619 	 * underflow/underflow.
2620 	 */
2621 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2622 
2623 	/*
2624 	 * Complete write underflow.  Not a single byte to read.  Return.
2625 	 */
2626 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2627 	if (io->scsiio.kern_rel_offset > expected_len) {
2628 		io->scsiio.be_move_done(io);
2629 		return;
2630 	}
2631 	datamove_len = MIN(io->scsiio.kern_data_len,
2632 	    expected_len - io->scsiio.kern_rel_offset);
2633 
2634 	target_transfer_tag =
2635 	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2636 	cdw = cfiscsi_data_wait_new(cs, io, bhssc->bhssc_initiator_task_tag,
2637 	    &target_transfer_tag);
2638 	if (cdw == NULL) {
2639 		CFISCSI_SESSION_WARN(cs, "failed to "
2640 		    "allocate memory; dropping connection");
2641 		ctl_set_busy(&io->scsiio);
2642 		io->scsiio.be_move_done(io);
2643 		cfiscsi_session_terminate(cs);
2644 		return;
2645 	}
2646 #if 0
2647 	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2648 	    "task tag 0x%x, target transfer tag 0x%x",
2649 	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2650 #endif
2651 
2652 	cdw->cdw_ctl_io = io;
2653 	cdw->cdw_target_transfer_tag = target_transfer_tag;
2654 	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2655 	cdw->cdw_r2t_end = datamove_len;
2656 	cdw->cdw_datasn = 0;
2657 
2658 	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2659 	if (io->scsiio.kern_sg_entries > 0) {
2660 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2661 	} else {
2662 		ctl_sglist = &ctl_sg_entry;
2663 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2664 		ctl_sglist->len = datamove_len;
2665 	}
2666 	cdw->cdw_sg_index = 0;
2667 	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2668 	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2669 	r2t_off = io->scsiio.ext_data_filled;
2670 	while (r2t_off > 0) {
2671 		if (r2t_off >= cdw->cdw_sg_len) {
2672 			r2t_off -= cdw->cdw_sg_len;
2673 			cdw->cdw_sg_index++;
2674 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2675 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2676 			continue;
2677 		}
2678 		cdw->cdw_sg_addr += r2t_off;
2679 		cdw->cdw_sg_len -= r2t_off;
2680 		r2t_off = 0;
2681 	}
2682 
2683 	if (cs->cs_immediate_data &&
2684 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2685 	    icl_pdu_data_segment_length(request)) {
2686 		done = cfiscsi_handle_data_segment(request, cdw);
2687 		if (done) {
2688 			cfiscsi_data_wait_free(cs, cdw);
2689 			io->scsiio.be_move_done(io);
2690 			return;
2691 		}
2692 	}
2693 
2694 	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2695 	r2t_len = MIN(datamove_len - io->scsiio.ext_data_filled,
2696 	    cs->cs_max_burst_length);
2697 	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2698 
2699 	CFISCSI_SESSION_LOCK(cs);
2700 	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2701 	CFISCSI_SESSION_UNLOCK(cs);
2702 
2703 	/*
2704 	 * XXX: We should limit the number of outstanding R2T PDUs
2705 	 * 	per task to MaxOutstandingR2T.
2706 	 */
2707 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2708 	if (response == NULL) {
2709 		CFISCSI_SESSION_WARN(cs, "failed to "
2710 		    "allocate memory; dropping connection");
2711 		ctl_set_busy(&io->scsiio);
2712 		io->scsiio.be_move_done(io);
2713 		cfiscsi_session_terminate(cs);
2714 		return;
2715 	}
2716 	io->io_hdr.flags |= CTL_FLAG_DMA_INPROG;
2717 	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2718 	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2719 	bhsr2t->bhsr2t_flags = 0x80;
2720 	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2721 	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2722 	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2723 	/*
2724 	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2725 	 *	be running concurrently on several CPUs for a given
2726 	 *	command.
2727 	 */
2728 	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2729 	PDU_R2TSN(request)++;
2730 	/*
2731 	 * This is the offset within the current SCSI command;
2732 	 * i.e. for the first call of datamove(), it will be 0,
2733 	 * and for subsequent ones it will be the sum of lengths
2734 	 * of previous ones.
2735 	 *
2736 	 * The ext_data_filled is to account for unsolicited
2737 	 * (immediate) data that might have already arrived.
2738 	 */
2739 	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2740 	/*
2741 	 * This is the total length (sum of S/G lengths) this call
2742 	 * to cfiscsi_datamove() is supposed to handle, limited by
2743 	 * MaxBurstLength.
2744 	 */
2745 	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2746 	cfiscsi_pdu_queue(response);
2747 }
2748 
2749 static void
2750 cfiscsi_datamove(union ctl_io *io)
2751 {
2752 
2753 	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2754 		cfiscsi_datamove_in(io);
2755 	else {
2756 		/* We hadn't received anything during this datamove yet. */
2757 		io->scsiio.ext_data_filled = 0;
2758 		cfiscsi_datamove_out(io);
2759 	}
2760 }
2761 
2762 static void
2763 cfiscsi_scsi_command_done(union ctl_io *io)
2764 {
2765 	struct icl_pdu *request, *response;
2766 	struct iscsi_bhs_scsi_command *bhssc;
2767 	struct iscsi_bhs_scsi_response *bhssr;
2768 #ifdef DIAGNOSTIC
2769 	struct cfiscsi_data_wait *cdw;
2770 #endif
2771 	struct cfiscsi_session *cs;
2772 	uint16_t sense_length;
2773 
2774 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2775 	cs = PDU_SESSION(request);
2776 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2777 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2778 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2779 	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2780 
2781 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2782 	//    bhssc->bhssc_initiator_task_tag);
2783 
2784 #ifdef DIAGNOSTIC
2785 	CFISCSI_SESSION_LOCK(cs);
2786 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2787 		KASSERT(bhssc->bhssc_initiator_task_tag !=
2788 		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2789 	CFISCSI_SESSION_UNLOCK(cs);
2790 #endif
2791 
2792 	/*
2793 	 * Do not return status for aborted commands.
2794 	 * There are exceptions, but none supported by CTL yet.
2795 	 */
2796 	if (((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2797 	     (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) ||
2798 	    (io->io_hdr.flags & CTL_FLAG_STATUS_SENT)) {
2799 		ctl_free_io(io);
2800 		icl_pdu_free(request);
2801 		return;
2802 	}
2803 
2804 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2805 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2806 	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2807 	bhssr->bhssr_flags = 0x80;
2808 	/*
2809 	 * XXX: We don't deal with bidirectional under/overflows;
2810 	 *	does anything actually support those?
2811 	 */
2812 	if (PDU_TOTAL_TRANSFER_LEN(request) <
2813 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2814 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2815 		bhssr->bhssr_residual_count =
2816 		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2817 		    PDU_TOTAL_TRANSFER_LEN(request));
2818 		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2819 		//    ntohl(bhssr->bhssr_residual_count));
2820 	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2821 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2822 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2823 		bhssr->bhssr_residual_count =
2824 		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2825 		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2826 		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2827 		//    ntohl(bhssr->bhssr_residual_count));
2828 	}
2829 	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2830 	bhssr->bhssr_status = io->scsiio.scsi_status;
2831 	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2832 	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2833 
2834 	if (io->scsiio.sense_len > 0) {
2835 #if 0
2836 		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2837 		    io->scsiio.sense_len);
2838 #endif
2839 		sense_length = htons(io->scsiio.sense_len);
2840 		icl_pdu_append_data(response,
2841 		    &sense_length, sizeof(sense_length), M_WAITOK);
2842 		icl_pdu_append_data(response,
2843 		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2844 	}
2845 
2846 	ctl_free_io(io);
2847 	icl_pdu_free(request);
2848 	cfiscsi_pdu_queue(response);
2849 }
2850 
2851 static void
2852 cfiscsi_task_management_done(union ctl_io *io)
2853 {
2854 	struct icl_pdu *request, *response;
2855 	struct iscsi_bhs_task_management_request *bhstmr;
2856 	struct iscsi_bhs_task_management_response *bhstmr2;
2857 	struct cfiscsi_data_wait *cdw, *tmpcdw;
2858 	struct cfiscsi_session *cs, *tcs;
2859 	struct cfiscsi_softc *softc;
2860 	int cold_reset = 0;
2861 
2862 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2863 	cs = PDU_SESSION(request);
2864 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2865 	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2866 	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2867 	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2868 
2869 #if 0
2870 	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2871 	    bhstmr->bhstmr_initiator_task_tag,
2872 	    bhstmr->bhstmr_referenced_task_tag);
2873 #endif
2874 
2875 	if ((bhstmr->bhstmr_function & ~0x80) ==
2876 	    BHSTMR_FUNCTION_ABORT_TASK) {
2877 		/*
2878 		 * Make sure we no longer wait for Data-Out for this command.
2879 		 */
2880 		CFISCSI_SESSION_LOCK(cs);
2881 		TAILQ_FOREACH_SAFE(cdw,
2882 		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2883 			if (bhstmr->bhstmr_referenced_task_tag !=
2884 			    cdw->cdw_initiator_task_tag)
2885 				continue;
2886 
2887 #if 0
2888 			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2889 			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2890 #endif
2891 			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2892 			    cdw, cdw_next);
2893 			io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
2894 			cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 43;
2895 			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2896 			cfiscsi_data_wait_free(cs, cdw);
2897 		}
2898 		CFISCSI_SESSION_UNLOCK(cs);
2899 	}
2900 	if ((bhstmr->bhstmr_function & ~0x80) ==
2901 	    BHSTMR_FUNCTION_TARGET_COLD_RESET &&
2902 	    io->io_hdr.status == CTL_SUCCESS)
2903 		cold_reset = 1;
2904 
2905 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2906 	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2907 	    response->ip_bhs;
2908 	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2909 	bhstmr2->bhstmr_flags = 0x80;
2910 	switch (io->taskio.task_status) {
2911 	case CTL_TASK_FUNCTION_COMPLETE:
2912 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2913 		break;
2914 	case CTL_TASK_FUNCTION_SUCCEEDED:
2915 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_SUCCEEDED;
2916 		break;
2917 	case CTL_TASK_LUN_DOES_NOT_EXIST:
2918 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_LUN_DOES_NOT_EXIST;
2919 		break;
2920 	case CTL_TASK_FUNCTION_NOT_SUPPORTED:
2921 	default:
2922 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2923 		break;
2924 	}
2925 	memcpy(bhstmr2->bhstmr_additional_reponse_information,
2926 	    io->taskio.task_resp, sizeof(io->taskio.task_resp));
2927 	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2928 
2929 	ctl_free_io(io);
2930 	icl_pdu_free(request);
2931 	cfiscsi_pdu_queue(response);
2932 
2933 	if (cold_reset) {
2934 		softc = cs->cs_target->ct_softc;
2935 		mtx_lock(&softc->lock);
2936 		TAILQ_FOREACH(tcs, &softc->sessions, cs_next) {
2937 			if (tcs->cs_target == cs->cs_target)
2938 				cfiscsi_session_terminate(tcs);
2939 		}
2940 		mtx_unlock(&softc->lock);
2941 	}
2942 }
2943 
2944 static void
2945 cfiscsi_done(union ctl_io *io)
2946 {
2947 	struct icl_pdu *request;
2948 	struct cfiscsi_session *cs;
2949 
2950 	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2951 		("invalid CTL status %#x", io->io_hdr.status));
2952 
2953 	if (io->io_hdr.io_type == CTL_IO_TASK &&
2954 	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
2955 		/*
2956 		 * Implicit task termination has just completed; nothing to do.
2957 		 */
2958 		cs = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2959 		cs->cs_tasks_aborted = true;
2960 		refcount_release(&cs->cs_outstanding_ctl_pdus);
2961 		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
2962 		ctl_free_io(io);
2963 		return;
2964 	}
2965 
2966 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2967 	cs = PDU_SESSION(request);
2968 
2969 	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2970 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2971 		cfiscsi_scsi_command_done(io);
2972 		break;
2973 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2974 		cfiscsi_task_management_done(io);
2975 		break;
2976 	default:
2977 		panic("cfiscsi_done called with wrong opcode 0x%x",
2978 		    request->ip_bhs->bhs_opcode);
2979 	}
2980 
2981 	refcount_release(&cs->cs_outstanding_ctl_pdus);
2982 }
2983