xref: /freebsd/sys/cam/ctl/ctl_frontend_iscsi.c (revision 6186fd1857626de0f7cb1a9e4dff19082f9ebb11)
1 /*-
2  * Copyright (c) 2012 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Edward Tomasz Napierala under sponsorship
6  * from the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * CTL frontend for the iSCSI protocol.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/capsicum.h>
41 #include <sys/condvar.h>
42 #include <sys/file.h>
43 #include <sys/kernel.h>
44 #include <sys/kthread.h>
45 #include <sys/lock.h>
46 #include <sys/malloc.h>
47 #include <sys/module.h>
48 #include <sys/mutex.h>
49 #include <sys/queue.h>
50 #include <sys/sbuf.h>
51 #include <sys/sysctl.h>
52 #include <sys/systm.h>
53 #include <sys/uio.h>
54 #include <sys/unistd.h>
55 #include <vm/uma.h>
56 
57 #include <cam/scsi/scsi_all.h>
58 #include <cam/scsi/scsi_da.h>
59 #include <cam/ctl/ctl_io.h>
60 #include <cam/ctl/ctl.h>
61 #include <cam/ctl/ctl_backend.h>
62 #include <cam/ctl/ctl_error.h>
63 #include <cam/ctl/ctl_frontend.h>
64 #include <cam/ctl/ctl_frontend_internal.h>
65 #include <cam/ctl/ctl_debug.h>
66 #include <cam/ctl/ctl_ha.h>
67 #include <cam/ctl/ctl_ioctl.h>
68 #include <cam/ctl/ctl_private.h>
69 
70 #include <dev/iscsi/icl.h>
71 #include <dev/iscsi/iscsi_proto.h>
72 #include <cam/ctl/ctl_frontend_iscsi.h>
73 
74 #ifdef ICL_KERNEL_PROXY
75 #include <sys/socketvar.h>
76 #endif
77 
78 #ifdef ICL_KERNEL_PROXY
79 FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
80 #endif
81 
82 static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
83 static uma_zone_t cfiscsi_data_wait_zone;
84 
85 SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
86     "CAM Target Layer iSCSI Frontend");
87 static int debug = 3;
88 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
89     &debug, 1, "Enable debug messages");
90 static int ping_timeout = 5;
91 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
92     &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
93 static int login_timeout = 60;
94 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
95     &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
96 static int maxcmdsn_delta = 256;
97 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
98     &maxcmdsn_delta, 256, "Number of commands the initiator can send "
99     "without confirmation");
100 
101 #define	CFISCSI_DEBUG(X, ...)						\
102 	do {								\
103 		if (debug > 1) {					\
104 			printf("%s: " X "\n",				\
105 			    __func__, ## __VA_ARGS__);			\
106 		}							\
107 	} while (0)
108 
109 #define	CFISCSI_WARN(X, ...)						\
110 	do {								\
111 		if (debug > 0) {					\
112 			printf("WARNING: %s: " X "\n",			\
113 			    __func__, ## __VA_ARGS__);			\
114 		}							\
115 	} while (0)
116 
117 #define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
118 	do {								\
119 		if (debug > 1) {					\
120 			printf("%s: %s (%s): " X "\n",			\
121 			    __func__, S->cs_initiator_addr,		\
122 			    S->cs_initiator_name, ## __VA_ARGS__);	\
123 		}							\
124 	} while (0)
125 
126 #define	CFISCSI_SESSION_WARN(S, X, ...)					\
127 	do  {								\
128 		if (debug > 0) {					\
129 			printf("WARNING: %s (%s): " X "\n",		\
130 			    S->cs_initiator_addr,			\
131 			    S->cs_initiator_name, ## __VA_ARGS__);	\
132 		}							\
133 	} while (0)
134 
135 #define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
136 #define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
137 #define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
138 
139 #define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
140 #define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
141 #define	PDU_EXPDATASN(X)		(X)->ip_prv0
142 #define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
143 #define	PDU_R2TSN(X)			(X)->ip_prv2
144 
145 int		cfiscsi_init(void);
146 static void	cfiscsi_online(void *arg);
147 static void	cfiscsi_offline(void *arg);
148 static int	cfiscsi_info(void *arg, struct sbuf *sb);
149 static int	cfiscsi_lun_enable(void *arg,
150 		    struct ctl_id target_id, int lun_id);
151 static int	cfiscsi_lun_disable(void *arg,
152 		    struct ctl_id target_id, int lun_id);
153 static uint32_t	cfiscsi_lun_map(void *arg, uint32_t lun);
154 static int	cfiscsi_ioctl(struct cdev *dev,
155 		    u_long cmd, caddr_t addr, int flag, struct thread *td);
156 static void	cfiscsi_datamove(union ctl_io *io);
157 static void	cfiscsi_datamove_in(union ctl_io *io);
158 static void	cfiscsi_datamove_out(union ctl_io *io);
159 static void	cfiscsi_done(union ctl_io *io);
160 static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
161 static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
162 static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
163 static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
164 static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
165 static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
166 static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
167 static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
168 		    *softc, const char *name);
169 static struct cfiscsi_target	*cfiscsi_target_find_or_create(
170     struct cfiscsi_softc *softc, const char *name, const char *alias);
171 static void	cfiscsi_target_release(struct cfiscsi_target *ct);
172 static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
173 
174 static struct cfiscsi_softc cfiscsi_softc;
175 extern struct ctl_softc *control_softc;
176 
177 static struct ctl_frontend cfiscsi_frontend =
178 {
179 	.name = "iscsi",
180 	.init = cfiscsi_init,
181 	.ioctl = cfiscsi_ioctl,
182 };
183 CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
184 MODULE_DEPEND(ctlcfiscsi, icl, 1, 1, 1);
185 
186 static struct icl_pdu *
187 cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
188 {
189 
190 	return (icl_pdu_new_bhs(request->ip_conn, flags));
191 }
192 
193 static bool
194 cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
195 {
196 	const struct iscsi_bhs_scsi_command *bhssc;
197 	struct cfiscsi_session *cs;
198 	uint32_t cmdsn, expstatsn;
199 
200 	cs = PDU_SESSION(request);
201 
202 	/*
203 	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
204 	 * The purpose of the timeout is to reset the connection when it stalls;
205 	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
206 	 * in some queue.
207 	 *
208 	 * XXX: Locking?
209 	 */
210 	cs->cs_timeout = 0;
211 
212 	/*
213 	 * Data-Out PDUs don't contain CmdSN.
214 	 */
215 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
216 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
217 		return (false);
218 
219 	/*
220 	 * We're only using fields common for all the request
221 	 * (initiator -> target) PDUs.
222 	 */
223 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
224 	cmdsn = ntohl(bhssc->bhssc_cmdsn);
225 	expstatsn = ntohl(bhssc->bhssc_expstatsn);
226 
227 	CFISCSI_SESSION_LOCK(cs);
228 #if 0
229 	if (expstatsn != cs->cs_statsn) {
230 		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
231 		    "while current StatSN is %d", expstatsn,
232 		    cs->cs_statsn);
233 	}
234 #endif
235 
236 	/*
237 	 * The target MUST silently ignore any non-immediate command outside
238 	 * of this range.
239 	 */
240 	if (cmdsn < cs->cs_cmdsn || cmdsn > cs->cs_cmdsn + maxcmdsn_delta) {
241 		CFISCSI_SESSION_UNLOCK(cs);
242 		CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %d, "
243 		    "while expected CmdSN was %d", cmdsn, cs->cs_cmdsn);
244 		return (true);
245 	}
246 
247 	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0)
248 		cs->cs_cmdsn++;
249 
250 	CFISCSI_SESSION_UNLOCK(cs);
251 
252 	return (false);
253 }
254 
255 static void
256 cfiscsi_pdu_handle(struct icl_pdu *request)
257 {
258 	struct cfiscsi_session *cs;
259 	bool ignore;
260 
261 	cs = PDU_SESSION(request);
262 
263 	ignore = cfiscsi_pdu_update_cmdsn(request);
264 	if (ignore) {
265 		icl_pdu_free(request);
266 		return;
267 	}
268 
269 	/*
270 	 * Handle the PDU; this includes e.g. receiving the remaining
271 	 * part of PDU and submitting the SCSI command to CTL
272 	 * or queueing a reply.  The handling routine is responsible
273 	 * for freeing the PDU when it's no longer needed.
274 	 */
275 	switch (request->ip_bhs->bhs_opcode &
276 	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
277 	case ISCSI_BHS_OPCODE_NOP_OUT:
278 		cfiscsi_pdu_handle_nop_out(request);
279 		break;
280 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
281 		cfiscsi_pdu_handle_scsi_command(request);
282 		break;
283 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
284 		cfiscsi_pdu_handle_task_request(request);
285 		break;
286 	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
287 		cfiscsi_pdu_handle_data_out(request);
288 		break;
289 	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
290 		cfiscsi_pdu_handle_logout_request(request);
291 		break;
292 	default:
293 		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
294 		    "opcode 0x%x; dropping connection",
295 		    request->ip_bhs->bhs_opcode);
296 		icl_pdu_free(request);
297 		cfiscsi_session_terminate(cs);
298 	}
299 
300 }
301 
302 static void
303 cfiscsi_receive_callback(struct icl_pdu *request)
304 {
305 	struct cfiscsi_session *cs;
306 
307 	cs = PDU_SESSION(request);
308 
309 #ifdef ICL_KERNEL_PROXY
310 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
311 		if (cs->cs_login_pdu == NULL)
312 			cs->cs_login_pdu = request;
313 		else
314 			icl_pdu_free(request);
315 		cv_signal(&cs->cs_login_cv);
316 		return;
317 	}
318 #endif
319 
320 	cfiscsi_pdu_handle(request);
321 }
322 
323 static void
324 cfiscsi_error_callback(struct icl_conn *ic)
325 {
326 	struct cfiscsi_session *cs;
327 
328 	cs = CONN_SESSION(ic);
329 
330 	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
331 	cfiscsi_session_terminate(cs);
332 }
333 
334 static int
335 cfiscsi_pdu_prepare(struct icl_pdu *response)
336 {
337 	struct cfiscsi_session *cs;
338 	struct iscsi_bhs_scsi_response *bhssr;
339 	bool advance_statsn = true;
340 
341 	cs = PDU_SESSION(response);
342 
343 	CFISCSI_SESSION_LOCK_ASSERT(cs);
344 
345 	/*
346 	 * We're only using fields common for all the response
347 	 * (target -> initiator) PDUs.
348 	 */
349 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
350 
351 	/*
352 	 * 10.8.3: "The StatSN for this connection is not advanced
353 	 * after this PDU is sent."
354 	 */
355 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
356 		advance_statsn = false;
357 
358 	/*
359 	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
360 	 * StatSN for the connection is not advanced after this PDU is sent."
361 	 */
362 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
363 	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
364 		advance_statsn = false;
365 
366 	/*
367 	 * See the comment below - StatSN is not meaningful and must
368 	 * not be advanced.
369 	 */
370 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN)
371 		advance_statsn = false;
372 
373 	/*
374 	 * 10.7.3: "The fields StatSN, Status, and Residual Count
375 	 * only have meaningful content if the S bit is set to 1."
376 	 */
377 	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN)
378 		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
379 	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
380 	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
381 
382 	if (advance_statsn)
383 		cs->cs_statsn++;
384 
385 	return (0);
386 }
387 
388 static void
389 cfiscsi_pdu_queue(struct icl_pdu *response)
390 {
391 	struct cfiscsi_session *cs;
392 
393 	cs = PDU_SESSION(response);
394 
395 	CFISCSI_SESSION_LOCK(cs);
396 	cfiscsi_pdu_prepare(response);
397 	icl_pdu_queue(response);
398 	CFISCSI_SESSION_UNLOCK(cs);
399 }
400 
401 static uint32_t
402 cfiscsi_decode_lun(uint64_t encoded)
403 {
404 	uint8_t lun[8];
405 	uint32_t result;
406 
407 	/*
408 	 * The LUN field in iSCSI PDUs may look like an ordinary 64 bit number,
409 	 * but is in fact an evil, multidimensional structure defined
410 	 * in SCSI Architecture Model 5 (SAM-5), section 4.6.
411 	 */
412 	memcpy(lun, &encoded, sizeof(lun));
413 	switch (lun[0] & 0xC0) {
414 	case 0x00:
415 		if ((lun[0] & 0x3f) != 0 || lun[2] != 0 || lun[3] != 0 ||
416 		    lun[4] != 0 || lun[5] != 0 || lun[6] != 0 || lun[7] != 0) {
417 			CFISCSI_WARN("malformed LUN "
418 			    "(peripheral device addressing method): 0x%jx",
419 			    (uintmax_t)encoded);
420 			result = 0xffffffff;
421 			break;
422 		}
423 		result = lun[1];
424 		break;
425 	case 0x40:
426 		if (lun[2] != 0 || lun[3] != 0 || lun[4] != 0 || lun[5] != 0 ||
427 		    lun[6] != 0 || lun[7] != 0) {
428 			CFISCSI_WARN("malformed LUN "
429 			    "(flat address space addressing method): 0x%jx",
430 			    (uintmax_t)encoded);
431 			result = 0xffffffff;
432 			break;
433 		}
434 		result = ((lun[0] & 0x3f) << 8) + lun[1];
435 		break;
436 	case 0xC0:
437 		if (lun[0] != 0xD2 || lun[4] != 0 || lun[5] != 0 ||
438 		    lun[6] != 0 || lun[7] != 0) {
439 			CFISCSI_WARN("malformed LUN (extended flat "
440 			    "address space addressing method): 0x%jx",
441 			    (uintmax_t)encoded);
442 			result = 0xffffffff;
443 			break;
444 		}
445 		result = (lun[1] << 16) + (lun[2] << 8) + lun[3];
446 	default:
447 		CFISCSI_WARN("unsupported LUN format 0x%jx",
448 		    (uintmax_t)encoded);
449 		result = 0xffffffff;
450 		break;
451 	}
452 
453 	return (result);
454 }
455 
456 static void
457 cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
458 {
459 	struct cfiscsi_session *cs;
460 	struct iscsi_bhs_nop_out *bhsno;
461 	struct iscsi_bhs_nop_in *bhsni;
462 	struct icl_pdu *response;
463 	void *data = NULL;
464 	size_t datasize;
465 	int error;
466 
467 	cs = PDU_SESSION(request);
468 	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
469 
470 	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
471 		/*
472 		 * Nothing to do, iscsi_pdu_update_statsn() already
473 		 * zeroed the timeout.
474 		 */
475 		icl_pdu_free(request);
476 		return;
477 	}
478 
479 	datasize = icl_pdu_data_segment_length(request);
480 	if (datasize > 0) {
481 		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
482 		if (data == NULL) {
483 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
484 			    "dropping connection");
485 			icl_pdu_free(request);
486 			cfiscsi_session_terminate(cs);
487 			return;
488 		}
489 		icl_pdu_get_data(request, 0, data, datasize);
490 	}
491 
492 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
493 	if (response == NULL) {
494 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
495 		    "droppping connection");
496 		free(data, M_CFISCSI);
497 		icl_pdu_free(request);
498 		cfiscsi_session_terminate(cs);
499 		return;
500 	}
501 	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
502 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
503 	bhsni->bhsni_flags = 0x80;
504 	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
505 	bhsni->bhsni_target_transfer_tag = 0xffffffff;
506 	if (datasize > 0) {
507 		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
508 		if (error != 0) {
509 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
510 			    "dropping connection");
511 			free(data, M_CFISCSI);
512 			icl_pdu_free(request);
513 			icl_pdu_free(response);
514 			cfiscsi_session_terminate(cs);
515 			return;
516 		}
517 		free(data, M_CFISCSI);
518 	}
519 
520 	icl_pdu_free(request);
521 	cfiscsi_pdu_queue(response);
522 }
523 
524 static void
525 cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
526 {
527 	struct iscsi_bhs_scsi_command *bhssc;
528 	struct cfiscsi_session *cs;
529 	union ctl_io *io;
530 	int error;
531 
532 	cs = PDU_SESSION(request);
533 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
534 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
535 	//    bhssc->bhssc_initiator_task_tag);
536 
537 	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
538 		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
539 		    "ImmediateData=No; dropping connection");
540 		icl_pdu_free(request);
541 		cfiscsi_session_terminate(cs);
542 		return;
543 	}
544 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
545 	if (io == NULL) {
546 		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io; "
547 		    "dropping connection");
548 		icl_pdu_free(request);
549 		cfiscsi_session_terminate(cs);
550 		return;
551 	}
552 	ctl_zero_io(io);
553 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
554 	io->io_hdr.io_type = CTL_IO_SCSI;
555 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
556 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
557 	io->io_hdr.nexus.targ_target.id = 0;
558 	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhssc->bhssc_lun);
559 	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
560 	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
561 	case BHSSC_FLAGS_ATTR_UNTAGGED:
562 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
563 		break;
564 	case BHSSC_FLAGS_ATTR_SIMPLE:
565 		io->scsiio.tag_type = CTL_TAG_SIMPLE;
566 		break;
567 	case BHSSC_FLAGS_ATTR_ORDERED:
568         	io->scsiio.tag_type = CTL_TAG_ORDERED;
569 		break;
570 	case BHSSC_FLAGS_ATTR_HOQ:
571         	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
572 		break;
573 	case BHSSC_FLAGS_ATTR_ACA:
574 		io->scsiio.tag_type = CTL_TAG_ACA;
575 		break;
576 	default:
577 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
578 		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
579 		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
580 		break;
581 	}
582 	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
583 	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
584 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
585 	error = ctl_queue(io);
586 	if (error != CTL_RETVAL_COMPLETE) {
587 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
588 		    "dropping connection", error);
589 		ctl_free_io(io);
590 		refcount_release(&cs->cs_outstanding_ctl_pdus);
591 		icl_pdu_free(request);
592 		cfiscsi_session_terminate(cs);
593 	}
594 }
595 
596 static void
597 cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
598 {
599 	struct iscsi_bhs_task_management_request *bhstmr;
600 	struct iscsi_bhs_task_management_response *bhstmr2;
601 	struct icl_pdu *response;
602 	struct cfiscsi_session *cs;
603 	union ctl_io *io;
604 	int error;
605 
606 	cs = PDU_SESSION(request);
607 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
608 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
609 	if (io == NULL) {
610 		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io;"
611 		    "dropping connection");
612 		icl_pdu_free(request);
613 		cfiscsi_session_terminate(cs);
614 		return;
615 	}
616 	ctl_zero_io(io);
617 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
618 	io->io_hdr.io_type = CTL_IO_TASK;
619 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
620 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
621 	io->io_hdr.nexus.targ_target.id = 0;
622 	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhstmr->bhstmr_lun);
623 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
624 
625 	switch (bhstmr->bhstmr_function & ~0x80) {
626 	case BHSTMR_FUNCTION_ABORT_TASK:
627 #if 0
628 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
629 #endif
630 		io->taskio.task_action = CTL_TASK_ABORT_TASK;
631 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
632 		break;
633 	case BHSTMR_FUNCTION_ABORT_TASK_SET:
634 #if 0
635 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
636 #endif
637 		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
638 		break;
639 	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
640 #if 0
641 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
642 #endif
643 		io->taskio.task_action = CTL_TASK_LUN_RESET;
644 		break;
645 	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
646 #if 0
647 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
648 #endif
649 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
650 		break;
651 	default:
652 		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
653 		    bhstmr->bhstmr_function & ~0x80);
654 		ctl_free_io(io);
655 
656 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
657 		if (response == NULL) {
658 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
659 			    "dropping connection");
660 			icl_pdu_free(request);
661 			cfiscsi_session_terminate(cs);
662 			return;
663 		}
664 		bhstmr2 = (struct iscsi_bhs_task_management_response *)
665 		    response->ip_bhs;
666 		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
667 		bhstmr2->bhstmr_flags = 0x80;
668 		bhstmr2->bhstmr_response =
669 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
670 		bhstmr2->bhstmr_initiator_task_tag =
671 		    bhstmr->bhstmr_initiator_task_tag;
672 		icl_pdu_free(request);
673 		cfiscsi_pdu_queue(response);
674 		return;
675 	}
676 
677 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
678 	error = ctl_queue(io);
679 	if (error != CTL_RETVAL_COMPLETE) {
680 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
681 		    "dropping connection", error);
682 		ctl_free_io(io);
683 		refcount_release(&cs->cs_outstanding_ctl_pdus);
684 		icl_pdu_free(request);
685 		cfiscsi_session_terminate(cs);
686 	}
687 }
688 
689 static bool
690 cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
691 {
692 	struct iscsi_bhs_data_out *bhsdo;
693 	struct cfiscsi_session *cs;
694 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
695 	size_t copy_len, len, off, buffer_offset;
696 	int ctl_sg_count;
697 	union ctl_io *io;
698 
699 	cs = PDU_SESSION(request);
700 
701 	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
702 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
703 	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
704 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
705 	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
706 
707 	/*
708 	 * We're only using fields common for Data-Out and SCSI Command PDUs.
709 	 */
710 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
711 
712 	io = cdw->cdw_ctl_io;
713 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
714 	    ("CTL_FLAG_DATA_IN"));
715 
716 #if 0
717 	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
718 	    request->ip_data_len, io->scsiio.kern_total_len);
719 #endif
720 
721 	if (io->scsiio.kern_sg_entries > 0) {
722 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
723 		ctl_sg_count = io->scsiio.kern_sg_entries;
724 	} else {
725 		ctl_sglist = &ctl_sg_entry;
726 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
727 		ctl_sglist->len = io->scsiio.kern_data_len;
728 		ctl_sg_count = 1;
729 	}
730 
731 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
732 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
733 		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
734 	else
735 		buffer_offset = 0;
736 	len = icl_pdu_data_segment_length(request);
737 
738 	/*
739 	 * Make sure the offset, as sent by the initiator, matches the offset
740 	 * we're supposed to be at in the scatter-gather list.
741 	 */
742 	if (buffer_offset >
743 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
744 	    buffer_offset + len <=
745 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
746 		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
747 		    "expected %zd; dropping connection", buffer_offset,
748 		    (size_t)io->scsiio.kern_rel_offset +
749 		    (size_t)io->scsiio.ext_data_filled);
750 		ctl_set_data_phase_error(&io->scsiio);
751 		cfiscsi_session_terminate(cs);
752 		return (true);
753 	}
754 
755 	/*
756 	 * This is the offset within the PDU data segment, as opposed
757 	 * to buffer_offset, which is the offset within the task (SCSI
758 	 * command).
759 	 */
760 	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
761 	    buffer_offset;
762 
763 	/*
764 	 * Iterate over the scatter/gather segments, filling them with data
765 	 * from the PDU data segment.  Note that this can get called multiple
766 	 * times for one SCSI command; the cdw structure holds state for the
767 	 * scatter/gather list.
768 	 */
769 	for (;;) {
770 		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
771 		    ("cdw->cdw_sg_index >= ctl_sg_count"));
772 		if (cdw->cdw_sg_len == 0) {
773 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
774 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
775 		}
776 		KASSERT(off <= len, ("len > off"));
777 		copy_len = len - off;
778 		if (copy_len > cdw->cdw_sg_len)
779 			copy_len = cdw->cdw_sg_len;
780 
781 		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
782 		cdw->cdw_sg_addr += copy_len;
783 		cdw->cdw_sg_len -= copy_len;
784 		off += copy_len;
785 		io->scsiio.ext_data_filled += copy_len;
786 
787 		if (cdw->cdw_sg_len == 0) {
788 			/*
789 			 * End of current segment.
790 			 */
791 			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
792 				/*
793 				 * Last segment in scatter/gather list.
794 				 */
795 				break;
796 			}
797 			cdw->cdw_sg_index++;
798 		}
799 
800 		if (off == len) {
801 			/*
802 			 * End of PDU payload.
803 			 */
804 			break;
805 		}
806 	}
807 
808 	if (len > off) {
809 		/*
810 		 * In case of unsolicited data, it's possible that the buffer
811 		 * provided by CTL is smaller than negotiated FirstBurstLength.
812 		 * Just ignore the superfluous data; will ask for them with R2T
813 		 * on next call to cfiscsi_datamove().
814 		 *
815 		 * This obviously can only happen with SCSI Command PDU.
816 		 */
817 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
818 		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
819 			return (true);
820 
821 		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
822 		    "expected %zd; dropping connection",
823 		    icl_pdu_data_segment_length(request), off);
824 		ctl_set_data_phase_error(&io->scsiio);
825 		cfiscsi_session_terminate(cs);
826 		return (true);
827 	}
828 
829 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
830 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
831 		CFISCSI_SESSION_WARN(cs, "got the final packet without "
832 		    "the F flag; flags = 0x%x; dropping connection",
833 		    bhsdo->bhsdo_flags);
834 		ctl_set_data_phase_error(&io->scsiio);
835 		cfiscsi_session_terminate(cs);
836 		return (true);
837 	}
838 
839 	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
840 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
841 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
842 		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
843 			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
844 			    "transmitted size was %zd bytes instead of %d; "
845 			    "dropping connection",
846 			    (size_t)io->scsiio.ext_data_filled,
847 			    cdw->cdw_r2t_end);
848 			ctl_set_data_phase_error(&io->scsiio);
849 			cfiscsi_session_terminate(cs);
850 			return (true);
851 		} else {
852 			/*
853 			 * For SCSI Command PDU, this just means we need to
854 			 * solicit more data by sending R2T.
855 			 */
856 			return (false);
857 		}
858 	}
859 
860 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
861 #if 0
862 		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
863 		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
864 #endif
865 
866 		return (true);
867 	}
868 
869 	return (false);
870 }
871 
872 static void
873 cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
874 {
875 	struct iscsi_bhs_data_out *bhsdo;
876 	struct cfiscsi_session *cs;
877 	struct cfiscsi_data_wait *cdw = NULL;
878 	union ctl_io *io;
879 	bool done;
880 
881 	cs = PDU_SESSION(request);
882 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
883 
884 	CFISCSI_SESSION_LOCK(cs);
885 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
886 #if 0
887 		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
888 		    "ttt 0x%x, itt 0x%x",
889 		    bhsdo->bhsdo_target_transfer_tag,
890 		    bhsdo->bhsdo_initiator_task_tag,
891 		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
892 #endif
893 		if (bhsdo->bhsdo_target_transfer_tag ==
894 		    cdw->cdw_target_transfer_tag)
895 			break;
896 	}
897 	CFISCSI_SESSION_UNLOCK(cs);
898 	if (cdw == NULL) {
899 		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
900 		    "0x%x, not found; dropping connection",
901 		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
902 		icl_pdu_free(request);
903 		cfiscsi_session_terminate(cs);
904 		return;
905 	}
906 
907 	io = cdw->cdw_ctl_io;
908 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
909 	    ("CTL_FLAG_DATA_IN"));
910 
911 	done = cfiscsi_handle_data_segment(request, cdw);
912 	if (done) {
913 		CFISCSI_SESSION_LOCK(cs);
914 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
915 		CFISCSI_SESSION_UNLOCK(cs);
916 		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
917 		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
918 		uma_zfree(cfiscsi_data_wait_zone, cdw);
919 		if (done)
920 			io->scsiio.be_move_done(io);
921 		else
922 			cfiscsi_datamove_out(io);
923 	}
924 
925 	icl_pdu_free(request);
926 }
927 
928 static void
929 cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
930 {
931 	struct iscsi_bhs_logout_request *bhslr;
932 	struct iscsi_bhs_logout_response *bhslr2;
933 	struct icl_pdu *response;
934 	struct cfiscsi_session *cs;
935 
936 	cs = PDU_SESSION(request);
937 	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
938 	switch (bhslr->bhslr_reason & 0x7f) {
939 	case BHSLR_REASON_CLOSE_SESSION:
940 	case BHSLR_REASON_CLOSE_CONNECTION:
941 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
942 		if (response == NULL) {
943 			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
944 			icl_pdu_free(request);
945 			cfiscsi_session_terminate(cs);
946 			return;
947 		}
948 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
949 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
950 		bhslr2->bhslr_flags = 0x80;
951 		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
952 		bhslr2->bhslr_initiator_task_tag =
953 		    bhslr->bhslr_initiator_task_tag;
954 		icl_pdu_free(request);
955 		cfiscsi_pdu_queue(response);
956 		cfiscsi_session_terminate(cs);
957 		break;
958 	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
959 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
960 		if (response == NULL) {
961 			CFISCSI_SESSION_WARN(cs,
962 			    "failed to allocate memory; dropping connection");
963 			icl_pdu_free(request);
964 			cfiscsi_session_terminate(cs);
965 			return;
966 		}
967 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
968 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
969 		bhslr2->bhslr_flags = 0x80;
970 		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
971 		bhslr2->bhslr_initiator_task_tag =
972 		    bhslr->bhslr_initiator_task_tag;
973 		icl_pdu_free(request);
974 		cfiscsi_pdu_queue(response);
975 		break;
976 	default:
977 		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
978 		    bhslr->bhslr_reason);
979 		icl_pdu_free(request);
980 		cfiscsi_session_terminate(cs);
981 		break;
982 	}
983 }
984 
985 static void
986 cfiscsi_callout(void *context)
987 {
988 	struct icl_pdu *cp;
989 	struct iscsi_bhs_nop_in *bhsni;
990 	struct cfiscsi_session *cs;
991 
992 	cs = context;
993 
994 	if (cs->cs_terminating)
995 		return;
996 
997 	callout_schedule(&cs->cs_callout, 1 * hz);
998 
999 	atomic_add_int(&cs->cs_timeout, 1);
1000 
1001 #ifdef ICL_KERNEL_PROXY
1002 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1003 		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1004 			CFISCSI_SESSION_WARN(cs, "login timed out after "
1005 			    "%d seconds; dropping connection", cs->cs_timeout);
1006 			cfiscsi_session_terminate(cs);
1007 		}
1008 		return;
1009 	}
1010 #endif
1011 
1012 	if (ping_timeout <= 0) {
1013 		/*
1014 		 * Pings are disabled.  Don't send NOP-In in this case;
1015 		 * user might have disabled pings to work around problems
1016 		 * with certain initiators that can't properly handle
1017 		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1018 		 * triggering reconnection, should the user decide to
1019 		 * reenable them.
1020 		 */
1021 		cs->cs_timeout = 0;
1022 		return;
1023 	}
1024 
1025 	if (cs->cs_timeout >= ping_timeout) {
1026 		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1027 		    "dropping connection",  ping_timeout);
1028 		cfiscsi_session_terminate(cs);
1029 		return;
1030 	}
1031 
1032 	/*
1033 	 * If the ping was reset less than one second ago - which means
1034 	 * that we've received some PDU during the last second - assume
1035 	 * the traffic flows correctly and don't bother sending a NOP-Out.
1036 	 *
1037 	 * (It's 2 - one for one second, and one for incrementing is_timeout
1038 	 * earlier in this routine.)
1039 	 */
1040 	if (cs->cs_timeout < 2)
1041 		return;
1042 
1043 	cp = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1044 	if (cp == NULL) {
1045 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1046 		return;
1047 	}
1048 	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1049 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1050 	bhsni->bhsni_flags = 0x80;
1051 	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1052 
1053 	cfiscsi_pdu_queue(cp);
1054 }
1055 
1056 static void
1057 cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1058 {
1059 	struct cfiscsi_data_wait *cdw;
1060 	union ctl_io *io;
1061 	int error, last;
1062 
1063 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1064 	if (io == NULL) {
1065 		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io");
1066 		return;
1067 	}
1068 	ctl_zero_io(io);
1069 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = cs;
1070 	io->io_hdr.io_type = CTL_IO_TASK;
1071 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1072 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1073 	io->io_hdr.nexus.targ_target.id = 0;
1074 	io->io_hdr.nexus.targ_lun = 0;
1075 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1076 	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1077 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1078 	error = ctl_queue(io);
1079 	if (error != CTL_RETVAL_COMPLETE) {
1080 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1081 		refcount_release(&cs->cs_outstanding_ctl_pdus);
1082 		ctl_free_io(io);
1083 	}
1084 
1085 	CFISCSI_SESSION_LOCK(cs);
1086 	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1087 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1088 		CFISCSI_SESSION_UNLOCK(cs);
1089 		/*
1090 		 * Set nonzero port status; this prevents backends from
1091 		 * assuming that the data transfer actually succeeded
1092 		 * and writing uninitialized data to disk.
1093 		 */
1094 		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1095 		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1096 		uma_zfree(cfiscsi_data_wait_zone, cdw);
1097 		CFISCSI_SESSION_LOCK(cs);
1098 	}
1099 	CFISCSI_SESSION_UNLOCK(cs);
1100 
1101 	/*
1102 	 * Wait for CTL to terminate all the tasks.
1103 	 */
1104 	for (;;) {
1105 		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1106 		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1107 		if (last != 0)
1108 			break;
1109 		CFISCSI_SESSION_WARN(cs, "waiting for CTL to terminate tasks, "
1110 		    "%d remaining", cs->cs_outstanding_ctl_pdus);
1111 		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1112 		    0, "cfiscsi_terminate", hz / 100);
1113 	}
1114 }
1115 
1116 static void
1117 cfiscsi_maintenance_thread(void *arg)
1118 {
1119 	struct cfiscsi_session *cs;
1120 
1121 	cs = arg;
1122 
1123 	for (;;) {
1124 		CFISCSI_SESSION_LOCK(cs);
1125 		if (cs->cs_terminating == false)
1126 			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1127 		CFISCSI_SESSION_UNLOCK(cs);
1128 
1129 		if (cs->cs_terminating) {
1130 
1131 			/*
1132 			 * We used to wait up to 30 seconds to deliver queued
1133 			 * PDUs to the initiator.  We also tried hard to deliver
1134 			 * SCSI Responses for the aborted PDUs.  We don't do
1135 			 * that anymore.  We might need to revisit that.
1136 			 */
1137 			callout_drain(&cs->cs_callout);
1138 			icl_conn_shutdown(cs->cs_conn);
1139 			icl_conn_close(cs->cs_conn);
1140 
1141 			/*
1142 			 * At this point ICL receive thread is no longer
1143 			 * running; no new tasks can be queued.
1144 			 */
1145 			cfiscsi_session_terminate_tasks(cs);
1146 			cfiscsi_session_delete(cs);
1147 			kthread_exit();
1148 			return;
1149 		}
1150 		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1151 	}
1152 }
1153 
1154 static void
1155 cfiscsi_session_terminate(struct cfiscsi_session *cs)
1156 {
1157 
1158 	if (cs->cs_terminating)
1159 		return;
1160 	cs->cs_terminating = true;
1161 	cv_signal(&cs->cs_maintenance_cv);
1162 #ifdef ICL_KERNEL_PROXY
1163 	cv_signal(&cs->cs_login_cv);
1164 #endif
1165 }
1166 
1167 static int
1168 cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1169 {
1170 	struct cfiscsi_target *ct;
1171 	char *name;
1172 	int i;
1173 
1174 	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1175 
1176 	ct = cs->cs_target;
1177 	name = strdup(cs->cs_initiator_id, M_CTL);
1178 	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1179 	if (i < 0) {
1180 		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1181 		    i);
1182 		cs->cs_ctl_initid = -1;
1183 		return (1);
1184 	}
1185 	cs->cs_ctl_initid = i;
1186 #if 0
1187 	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1188 #endif
1189 
1190 	return (0);
1191 }
1192 
1193 static void
1194 cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1195 {
1196 	int error;
1197 
1198 	if (cs->cs_ctl_initid == -1)
1199 		return;
1200 
1201 	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1202 	if (error != 0) {
1203 		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1204 		    error);
1205 	}
1206 	cs->cs_ctl_initid = -1;
1207 }
1208 
1209 static struct cfiscsi_session *
1210 cfiscsi_session_new(struct cfiscsi_softc *softc)
1211 {
1212 	struct cfiscsi_session *cs;
1213 	int error;
1214 
1215 	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1216 	if (cs == NULL) {
1217 		CFISCSI_WARN("malloc failed");
1218 		return (NULL);
1219 	}
1220 	cs->cs_ctl_initid = -1;
1221 
1222 	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1223 	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1224 	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1225 	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1226 #ifdef ICL_KERNEL_PROXY
1227 	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1228 #endif
1229 
1230 	cs->cs_conn = icl_conn_new("cfiscsi", &cs->cs_lock);
1231 	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1232 	cs->cs_conn->ic_error = cfiscsi_error_callback;
1233 	cs->cs_conn->ic_prv0 = cs;
1234 
1235 	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1236 	if (error != 0) {
1237 		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1238 		free(cs, M_CFISCSI);
1239 		return (NULL);
1240 	}
1241 
1242 	mtx_lock(&softc->lock);
1243 	cs->cs_id = softc->last_session_id + 1;
1244 	softc->last_session_id++;
1245 	mtx_unlock(&softc->lock);
1246 
1247 	mtx_lock(&softc->lock);
1248 	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1249 	mtx_unlock(&softc->lock);
1250 
1251 	/*
1252 	 * Start pinging the initiator.
1253 	 */
1254 	callout_init(&cs->cs_callout, 1);
1255 	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1256 
1257 	return (cs);
1258 }
1259 
1260 static void
1261 cfiscsi_session_delete(struct cfiscsi_session *cs)
1262 {
1263 	struct cfiscsi_softc *softc;
1264 
1265 	softc = &cfiscsi_softc;
1266 
1267 	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1268 	    ("destroying session with outstanding CTL pdus"));
1269 	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1270 	    ("destroying session with non-empty queue"));
1271 
1272 	cfiscsi_session_unregister_initiator(cs);
1273 	if (cs->cs_target != NULL)
1274 		cfiscsi_target_release(cs->cs_target);
1275 	icl_conn_close(cs->cs_conn);
1276 	icl_conn_free(cs->cs_conn);
1277 
1278 	mtx_lock(&softc->lock);
1279 	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1280 	mtx_unlock(&softc->lock);
1281 
1282 	free(cs, M_CFISCSI);
1283 }
1284 
1285 int
1286 cfiscsi_init(void)
1287 {
1288 	struct cfiscsi_softc *softc;
1289 	int retval;
1290 
1291 	softc = &cfiscsi_softc;
1292 	retval = 0;
1293 	bzero(softc, sizeof(*softc));
1294 	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1295 
1296 #ifdef ICL_KERNEL_PROXY
1297 	cv_init(&softc->accept_cv, "cfiscsi_accept");
1298 #endif
1299 	TAILQ_INIT(&softc->sessions);
1300 	TAILQ_INIT(&softc->targets);
1301 
1302 	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1303 	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1304 	    UMA_ALIGN_PTR, 0);
1305 
1306 	return (0);
1307 }
1308 
1309 #ifdef ICL_KERNEL_PROXY
1310 static void
1311 cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1312 {
1313 	struct cfiscsi_session *cs;
1314 
1315 	cs = cfiscsi_session_new(&cfiscsi_softc);
1316 	if (cs == NULL) {
1317 		CFISCSI_WARN("failed to create session");
1318 		return;
1319 	}
1320 
1321 	icl_conn_handoff_sock(cs->cs_conn, so);
1322 	cs->cs_initiator_sa = sa;
1323 	cs->cs_portal_id = portal_id;
1324 	cs->cs_waiting_for_ctld = true;
1325 	cv_signal(&cfiscsi_softc.accept_cv);
1326 }
1327 #endif
1328 
1329 static void
1330 cfiscsi_online(void *arg)
1331 {
1332 	struct cfiscsi_softc *softc;
1333 	struct cfiscsi_target *ct;
1334 	int online;
1335 
1336 	ct = (struct cfiscsi_target *)arg;
1337 	softc = ct->ct_softc;
1338 
1339 	mtx_lock(&softc->lock);
1340 	if (ct->ct_online) {
1341 		mtx_unlock(&softc->lock);
1342 		return;
1343 	}
1344 	ct->ct_online = 1;
1345 	online = softc->online++;
1346 	mtx_unlock(&softc->lock);
1347 	if (online > 0)
1348 		return;
1349 
1350 #ifdef ICL_KERNEL_PROXY
1351 	if (softc->listener != NULL)
1352 		icl_listen_free(softc->listener);
1353 	softc->listener = icl_listen_new(cfiscsi_accept);
1354 #endif
1355 }
1356 
1357 static void
1358 cfiscsi_offline(void *arg)
1359 {
1360 	struct cfiscsi_softc *softc;
1361 	struct cfiscsi_target *ct;
1362 	struct cfiscsi_session *cs;
1363 	int online;
1364 
1365 	ct = (struct cfiscsi_target *)arg;
1366 	softc = ct->ct_softc;
1367 
1368 	mtx_lock(&softc->lock);
1369 	if (!ct->ct_online) {
1370 		mtx_unlock(&softc->lock);
1371 		return;
1372 	}
1373 	ct->ct_online = 0;
1374 	online = --softc->online;
1375 
1376 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1377 		if (cs->cs_target == ct)
1378 			cfiscsi_session_terminate(cs);
1379 	}
1380 	mtx_unlock(&softc->lock);
1381 	if (online > 0)
1382 		return;
1383 
1384 #ifdef ICL_KERNEL_PROXY
1385 	icl_listen_free(softc->listener);
1386 	softc->listener = NULL;
1387 #endif
1388 }
1389 
1390 static int
1391 cfiscsi_info(void *arg, struct sbuf *sb)
1392 {
1393 	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1394 	int retval;
1395 
1396 	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1397 	    ct->ct_state);
1398 	return (retval);
1399 }
1400 
1401 static void
1402 cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1403 {
1404 	struct cfiscsi_softc *softc;
1405 	struct cfiscsi_session *cs, *cs2;
1406 	struct cfiscsi_target *ct;
1407 	struct ctl_iscsi_handoff_params *cihp;
1408 	int error;
1409 
1410 	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1411 	softc = &cfiscsi_softc;
1412 
1413 	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1414 	    cihp->initiator_name, cihp->initiator_addr,
1415 	    cihp->target_name);
1416 
1417 	ct = cfiscsi_target_find(softc, cihp->target_name);
1418 	if (ct == NULL) {
1419 		ci->status = CTL_ISCSI_ERROR;
1420 		snprintf(ci->error_str, sizeof(ci->error_str),
1421 		    "%s: target not found", __func__);
1422 		return;
1423 	}
1424 
1425 	if (ct->ct_online == 0) {
1426 		ci->status = CTL_ISCSI_ERROR;
1427 		snprintf(ci->error_str, sizeof(ci->error_str),
1428 		    "%s: port offline", __func__);
1429 		cfiscsi_target_release(ct);
1430 		return;
1431 	}
1432 
1433 #ifdef ICL_KERNEL_PROXY
1434 	if (cihp->socket > 0 && cihp->connection_id > 0) {
1435 		snprintf(ci->error_str, sizeof(ci->error_str),
1436 		    "both socket and connection_id set");
1437 		ci->status = CTL_ISCSI_ERROR;
1438 		cfiscsi_target_release(ct);
1439 		return;
1440 	}
1441 	if (cihp->socket == 0) {
1442 		mtx_lock(&cfiscsi_softc.lock);
1443 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1444 			if (cs->cs_id == cihp->socket)
1445 				break;
1446 		}
1447 		if (cs == NULL) {
1448 			mtx_unlock(&cfiscsi_softc.lock);
1449 			snprintf(ci->error_str, sizeof(ci->error_str),
1450 			    "connection not found");
1451 			ci->status = CTL_ISCSI_ERROR;
1452 			cfiscsi_target_release(ct);
1453 			return;
1454 		}
1455 		mtx_unlock(&cfiscsi_softc.lock);
1456 	} else {
1457 #endif
1458 		cs = cfiscsi_session_new(softc);
1459 		if (cs == NULL) {
1460 			ci->status = CTL_ISCSI_ERROR;
1461 			snprintf(ci->error_str, sizeof(ci->error_str),
1462 			    "%s: cfiscsi_session_new failed", __func__);
1463 			cfiscsi_target_release(ct);
1464 			return;
1465 		}
1466 #ifdef ICL_KERNEL_PROXY
1467 	}
1468 #endif
1469 	cs->cs_target = ct;
1470 
1471 	/*
1472 	 * First PDU of Full Feature phase has the same CmdSN as the last
1473 	 * PDU from the Login Phase received from the initiator.  Thus,
1474 	 * the -1 below.
1475 	 */
1476 	cs->cs_portal_group_tag = cihp->portal_group_tag;
1477 	cs->cs_cmdsn = cihp->cmdsn;
1478 	cs->cs_statsn = cihp->statsn;
1479 	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1480 	cs->cs_max_burst_length = cihp->max_burst_length;
1481 	cs->cs_immediate_data = !!cihp->immediate_data;
1482 	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1483 		cs->cs_conn->ic_header_crc32c = true;
1484 	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1485 		cs->cs_conn->ic_data_crc32c = true;
1486 
1487 	strlcpy(cs->cs_initiator_name,
1488 	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1489 	strlcpy(cs->cs_initiator_addr,
1490 	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1491 	strlcpy(cs->cs_initiator_alias,
1492 	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1493 	memcpy(cs->cs_initiator_isid,
1494 	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1495 	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1496 	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1497 	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1498 	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1499 	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1500 
1501 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1502 restart:
1503 	if (!cs->cs_terminating) {
1504 		mtx_lock(&softc->lock);
1505 		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1506 			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1507 			    cs->cs_target == cs2->cs_target &&
1508 			    cs->cs_portal_group_tag == cs2->cs_portal_group_tag &&
1509 			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1510 				cfiscsi_session_terminate(cs2);
1511 				mtx_unlock(&softc->lock);
1512 				pause("cfiscsi_reinstate", 1);
1513 				goto restart;
1514 			}
1515 		}
1516 		mtx_unlock(&softc->lock);
1517 	}
1518 
1519 	/*
1520 	 * Register initiator with CTL.
1521 	 */
1522 	cfiscsi_session_register_initiator(cs);
1523 
1524 #ifdef ICL_KERNEL_PROXY
1525 	if (cihp->socket > 0) {
1526 #endif
1527 		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1528 		if (error != 0) {
1529 			cfiscsi_session_terminate(cs);
1530 			refcount_release(&cs->cs_outstanding_ctl_pdus);
1531 			ci->status = CTL_ISCSI_ERROR;
1532 			snprintf(ci->error_str, sizeof(ci->error_str),
1533 			    "%s: icl_conn_handoff failed with error %d",
1534 			    __func__, error);
1535 			return;
1536 		}
1537 #ifdef ICL_KERNEL_PROXY
1538 	}
1539 #endif
1540 
1541 #ifdef ICL_KERNEL_PROXY
1542 	cs->cs_login_phase = false;
1543 
1544 	/*
1545 	 * First PDU of the Full Feature phase has likely already arrived.
1546 	 * We have to pick it up and execute properly.
1547 	 */
1548 	if (cs->cs_login_pdu != NULL) {
1549 		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1550 		cfiscsi_pdu_handle(cs->cs_login_pdu);
1551 		cs->cs_login_pdu = NULL;
1552 	}
1553 #endif
1554 
1555 	refcount_release(&cs->cs_outstanding_ctl_pdus);
1556 	ci->status = CTL_ISCSI_OK;
1557 }
1558 
1559 static void
1560 cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1561 {
1562 	struct ctl_iscsi_list_params *cilp;
1563 	struct cfiscsi_session *cs;
1564 	struct cfiscsi_softc *softc;
1565 	struct sbuf *sb;
1566 	int error;
1567 
1568 	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1569 	softc = &cfiscsi_softc;
1570 
1571 	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1572 	if (sb == NULL) {
1573 		ci->status = CTL_ISCSI_ERROR;
1574 		snprintf(ci->error_str, sizeof(ci->error_str),
1575 		    "Unable to allocate %d bytes for iSCSI session list",
1576 		    cilp->alloc_len);
1577 		return;
1578 	}
1579 
1580 	sbuf_printf(sb, "<ctlislist>\n");
1581 	mtx_lock(&softc->lock);
1582 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1583 #ifdef ICL_KERNEL_PROXY
1584 		if (cs->cs_target == NULL)
1585 			continue;
1586 #endif
1587 		error = sbuf_printf(sb, "<connection id=\"%d\">"
1588 		    "<initiator>%s</initiator>"
1589 		    "<initiator_addr>%s</initiator_addr>"
1590 		    "<initiator_alias>%s</initiator_alias>"
1591 		    "<target>%s</target>"
1592 		    "<target_alias>%s</target_alias>"
1593 		    "<header_digest>%s</header_digest>"
1594 		    "<data_digest>%s</data_digest>"
1595 		    "<max_data_segment_length>%zd</max_data_segment_length>"
1596 		    "<immediate_data>%d</immediate_data>"
1597 		    "<iser>%d</iser>"
1598 		    "</connection>\n",
1599 		    cs->cs_id,
1600 		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1601 		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1602 		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1603 		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1604 		    cs->cs_max_data_segment_length,
1605 		    cs->cs_immediate_data,
1606 		    cs->cs_conn->ic_iser);
1607 		if (error != 0)
1608 			break;
1609 	}
1610 	mtx_unlock(&softc->lock);
1611 	error = sbuf_printf(sb, "</ctlislist>\n");
1612 	if (error != 0) {
1613 		sbuf_delete(sb);
1614 		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1615 		snprintf(ci->error_str, sizeof(ci->error_str),
1616 		    "Out of space, %d bytes is too small", cilp->alloc_len);
1617 		return;
1618 	}
1619 	sbuf_finish(sb);
1620 
1621 	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1622 	cilp->fill_len = sbuf_len(sb) + 1;
1623 	ci->status = CTL_ISCSI_OK;
1624 	sbuf_delete(sb);
1625 }
1626 
1627 static void
1628 cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1629 {
1630 	struct icl_pdu *response;
1631 	struct iscsi_bhs_asynchronous_message *bhsam;
1632 	struct ctl_iscsi_terminate_params *citp;
1633 	struct cfiscsi_session *cs;
1634 	struct cfiscsi_softc *softc;
1635 	int found = 0;
1636 
1637 	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1638 	softc = &cfiscsi_softc;
1639 
1640 	mtx_lock(&softc->lock);
1641 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1642 		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1643 		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1644 		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1645 			continue;
1646 
1647 		response = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1648 		if (response == NULL) {
1649 			/*
1650 			 * Oh well.  Just terminate the connection.
1651 			 */
1652 		} else {
1653 			bhsam = (struct iscsi_bhs_asynchronous_message *)
1654 			    response->ip_bhs;
1655 			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1656 			bhsam->bhsam_flags = 0x80;
1657 			bhsam->bhsam_0xffffffff = 0xffffffff;
1658 			bhsam->bhsam_async_event =
1659 			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1660 			cfiscsi_pdu_queue(response);
1661 		}
1662 		cfiscsi_session_terminate(cs);
1663 		found++;
1664 	}
1665 	mtx_unlock(&softc->lock);
1666 
1667 	if (found == 0) {
1668 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1669 		snprintf(ci->error_str, sizeof(ci->error_str),
1670 		    "No matching connections found");
1671 		return;
1672 	}
1673 
1674 	ci->status = CTL_ISCSI_OK;
1675 }
1676 
1677 static void
1678 cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1679 {
1680 	struct icl_pdu *response;
1681 	struct iscsi_bhs_asynchronous_message *bhsam;
1682 	struct ctl_iscsi_logout_params *cilp;
1683 	struct cfiscsi_session *cs;
1684 	struct cfiscsi_softc *softc;
1685 	int found = 0;
1686 
1687 	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1688 	softc = &cfiscsi_softc;
1689 
1690 	mtx_lock(&softc->lock);
1691 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1692 		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1693 		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1694 		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1695 			continue;
1696 
1697 		response = icl_pdu_new_bhs(cs->cs_conn, M_NOWAIT);
1698 		if (response == NULL) {
1699 			ci->status = CTL_ISCSI_ERROR;
1700 			snprintf(ci->error_str, sizeof(ci->error_str),
1701 			    "Unable to allocate memory");
1702 			mtx_unlock(&softc->lock);
1703 			return;
1704 		}
1705 		bhsam =
1706 		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1707 		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1708 		bhsam->bhsam_flags = 0x80;
1709 		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1710 		bhsam->bhsam_parameter3 = htons(10);
1711 		cfiscsi_pdu_queue(response);
1712 		found++;
1713 	}
1714 	mtx_unlock(&softc->lock);
1715 
1716 	if (found == 0) {
1717 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1718 		snprintf(ci->error_str, sizeof(ci->error_str),
1719 		    "No matching connections found");
1720 		return;
1721 	}
1722 
1723 	ci->status = CTL_ISCSI_OK;
1724 }
1725 
1726 #ifdef ICL_KERNEL_PROXY
1727 static void
1728 cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1729 {
1730 	struct ctl_iscsi_listen_params *cilp;
1731 	struct sockaddr *sa;
1732 	int error;
1733 
1734 	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1735 
1736 	if (cfiscsi_softc.listener == NULL) {
1737 		CFISCSI_DEBUG("no listener");
1738 		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1739 		ci->status = CTL_ISCSI_ERROR;
1740 		return;
1741 	}
1742 
1743 	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1744 	if (error != 0) {
1745 		CFISCSI_DEBUG("getsockaddr, error %d", error);
1746 		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1747 		ci->status = CTL_ISCSI_ERROR;
1748 		return;
1749 	}
1750 
1751 	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1752 	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1753 	if (error != 0) {
1754 		free(sa, M_SONAME);
1755 		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1756 		snprintf(ci->error_str, sizeof(ci->error_str),
1757 		    "icl_listen_add failed, error %d", error);
1758 		ci->status = CTL_ISCSI_ERROR;
1759 		return;
1760 	}
1761 
1762 	ci->status = CTL_ISCSI_OK;
1763 }
1764 
1765 static void
1766 cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1767 {
1768 	struct ctl_iscsi_accept_params *ciap;
1769 	struct cfiscsi_session *cs;
1770 	int error;
1771 
1772 	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1773 
1774 	mtx_lock(&cfiscsi_softc.lock);
1775 	for (;;) {
1776 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1777 			if (cs->cs_waiting_for_ctld)
1778 				break;
1779 		}
1780 		if (cs != NULL)
1781 			break;
1782 		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1783 		if (error != 0) {
1784 			mtx_unlock(&cfiscsi_softc.lock);
1785 			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1786 			ci->status = CTL_ISCSI_ERROR;
1787 			return;
1788 		}
1789 	}
1790 	mtx_unlock(&cfiscsi_softc.lock);
1791 
1792 	cs->cs_waiting_for_ctld = false;
1793 	cs->cs_login_phase = true;
1794 
1795 	ciap->connection_id = cs->cs_id;
1796 	ciap->portal_id = cs->cs_portal_id;
1797 	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1798 	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1799 	    cs->cs_initiator_sa->sa_len);
1800 	if (error != 0) {
1801 		snprintf(ci->error_str, sizeof(ci->error_str),
1802 		    "copyout failed with error %d", error);
1803 		ci->status = CTL_ISCSI_ERROR;
1804 		return;
1805 	}
1806 
1807 	ci->status = CTL_ISCSI_OK;
1808 }
1809 
1810 static void
1811 cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1812 {
1813 	struct ctl_iscsi_send_params *cisp;
1814 	struct cfiscsi_session *cs;
1815 	struct icl_pdu *ip;
1816 	size_t datalen;
1817 	void *data;
1818 	int error;
1819 
1820 	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1821 
1822 	mtx_lock(&cfiscsi_softc.lock);
1823 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1824 		if (cs->cs_id == cisp->connection_id)
1825 			break;
1826 	}
1827 	if (cs == NULL) {
1828 		mtx_unlock(&cfiscsi_softc.lock);
1829 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1830 		ci->status = CTL_ISCSI_ERROR;
1831 		return;
1832 	}
1833 	mtx_unlock(&cfiscsi_softc.lock);
1834 
1835 #if 0
1836 	if (cs->cs_login_phase == false)
1837 		return (EBUSY);
1838 #endif
1839 
1840 	if (cs->cs_terminating) {
1841 		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1842 		ci->status = CTL_ISCSI_ERROR;
1843 		return;
1844 	}
1845 
1846 	datalen = cisp->data_segment_len;
1847 	/*
1848 	 * XXX
1849 	 */
1850 	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1851 	if (datalen > 65535) {
1852 		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1853 		ci->status = CTL_ISCSI_ERROR;
1854 		return;
1855 	}
1856 	if (datalen > 0) {
1857 		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1858 		error = copyin(cisp->data_segment, data, datalen);
1859 		if (error != 0) {
1860 			free(data, M_CFISCSI);
1861 			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1862 			ci->status = CTL_ISCSI_ERROR;
1863 			return;
1864 		}
1865 	}
1866 
1867 	ip = icl_pdu_new_bhs(cs->cs_conn, M_WAITOK);
1868 	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1869 	if (datalen > 0) {
1870 		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1871 		free(data, M_CFISCSI);
1872 	}
1873 	CFISCSI_SESSION_LOCK(cs);
1874 	icl_pdu_queue(ip);
1875 	CFISCSI_SESSION_UNLOCK(cs);
1876 	ci->status = CTL_ISCSI_OK;
1877 }
1878 
1879 static void
1880 cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1881 {
1882 	struct ctl_iscsi_receive_params *cirp;
1883 	struct cfiscsi_session *cs;
1884 	struct icl_pdu *ip;
1885 	void *data;
1886 	int error;
1887 
1888 	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1889 
1890 	mtx_lock(&cfiscsi_softc.lock);
1891 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1892 		if (cs->cs_id == cirp->connection_id)
1893 			break;
1894 	}
1895 	if (cs == NULL) {
1896 		mtx_unlock(&cfiscsi_softc.lock);
1897 		snprintf(ci->error_str, sizeof(ci->error_str),
1898 		    "connection not found");
1899 		ci->status = CTL_ISCSI_ERROR;
1900 		return;
1901 	}
1902 	mtx_unlock(&cfiscsi_softc.lock);
1903 
1904 #if 0
1905 	if (is->is_login_phase == false)
1906 		return (EBUSY);
1907 #endif
1908 
1909 	CFISCSI_SESSION_LOCK(cs);
1910 	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
1911 		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
1912 		if (error != 0) {
1913 			CFISCSI_SESSION_UNLOCK(cs);
1914 			snprintf(ci->error_str, sizeof(ci->error_str),
1915 			    "interrupted by signal");
1916 			ci->status = CTL_ISCSI_ERROR;
1917 			return;
1918 		}
1919 	}
1920 
1921 	if (cs->cs_terminating) {
1922 		CFISCSI_SESSION_UNLOCK(cs);
1923 		snprintf(ci->error_str, sizeof(ci->error_str),
1924 		    "connection terminating");
1925 		ci->status = CTL_ISCSI_ERROR;
1926 		return;
1927 	}
1928 	ip = cs->cs_login_pdu;
1929 	cs->cs_login_pdu = NULL;
1930 	CFISCSI_SESSION_UNLOCK(cs);
1931 
1932 	if (ip->ip_data_len > cirp->data_segment_len) {
1933 		icl_pdu_free(ip);
1934 		snprintf(ci->error_str, sizeof(ci->error_str),
1935 		    "data segment too big");
1936 		ci->status = CTL_ISCSI_ERROR;
1937 		return;
1938 	}
1939 
1940 	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
1941 	if (ip->ip_data_len > 0) {
1942 		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
1943 		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
1944 		copyout(data, cirp->data_segment, ip->ip_data_len);
1945 		free(data, M_CFISCSI);
1946 	}
1947 
1948 	icl_pdu_free(ip);
1949 	ci->status = CTL_ISCSI_OK;
1950 }
1951 
1952 #endif /* !ICL_KERNEL_PROXY */
1953 
1954 static void
1955 cfiscsi_ioctl_port_create(struct ctl_req *req)
1956 {
1957 	struct cfiscsi_target *ct;
1958 	struct ctl_port *port;
1959 	const char *target, *alias, *tag;
1960 	struct scsi_vpd_id_descriptor *desc;
1961 	ctl_options_t opts;
1962 	int retval, len, idlen;
1963 
1964 	ctl_init_opts(&opts, req->num_args, req->kern_args);
1965 	target = ctl_get_opt(&opts, "cfiscsi_target");
1966 	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
1967 	tag = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
1968 	if (target == NULL || tag == NULL) {
1969 		req->status = CTL_LUN_ERROR;
1970 		snprintf(req->error_str, sizeof(req->error_str),
1971 		    "Missing required argument");
1972 		ctl_free_opts(&opts);
1973 		return;
1974 	}
1975 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias);
1976 	if (ct == NULL) {
1977 		req->status = CTL_LUN_ERROR;
1978 		snprintf(req->error_str, sizeof(req->error_str),
1979 		    "failed to create target \"%s\"", target);
1980 		ctl_free_opts(&opts);
1981 		return;
1982 	}
1983 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
1984 		req->status = CTL_LUN_ERROR;
1985 		snprintf(req->error_str, sizeof(req->error_str),
1986 		    "target \"%s\" already exist", target);
1987 		cfiscsi_target_release(ct);
1988 		ctl_free_opts(&opts);
1989 		return;
1990 	}
1991 	port = &ct->ct_port;
1992 	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
1993 		goto done;
1994 
1995 	port->frontend = &cfiscsi_frontend;
1996 	port->port_type = CTL_PORT_ISCSI;
1997 	/* XXX KDM what should the real number be here? */
1998 	port->num_requested_ctl_io = 4096;
1999 	port->port_name = "iscsi";
2000 	port->virtual_port = strtoul(tag, NULL, 0);
2001 	port->port_online = cfiscsi_online;
2002 	port->port_offline = cfiscsi_offline;
2003 	port->port_info = cfiscsi_info;
2004 	port->onoff_arg = ct;
2005 	port->lun_enable = cfiscsi_lun_enable;
2006 	port->lun_disable = cfiscsi_lun_disable;
2007 	port->lun_map = cfiscsi_lun_map;
2008 	port->targ_lun_arg = ct;
2009 	port->fe_datamove = cfiscsi_datamove;
2010 	port->fe_done = cfiscsi_done;
2011 
2012 	/* XXX KDM what should we report here? */
2013 	/* XXX These should probably be fetched from CTL. */
2014 	port->max_targets = 1;
2015 	port->max_target_id = 15;
2016 
2017 	port->options = opts;
2018 	STAILQ_INIT(&opts);
2019 
2020 	/* Generate Port ID. */
2021 	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2022 	idlen = roundup2(idlen, 4);
2023 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2024 	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2025 	    M_CTL, M_WAITOK | M_ZERO);
2026 	port->port_devid->len = len;
2027 	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2028 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2029 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2030 	    SVPD_ID_TYPE_SCSI_NAME;
2031 	desc->length = idlen;
2032 	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x",
2033 	    target, port->virtual_port);
2034 
2035 	/* Generate Target ID. */
2036 	idlen = strlen(target) + 1;
2037 	idlen = roundup2(idlen, 4);
2038 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2039 	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2040 	    M_CTL, M_WAITOK | M_ZERO);
2041 	port->target_devid->len = len;
2042 	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2043 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2044 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2045 	    SVPD_ID_TYPE_SCSI_NAME;
2046 	desc->length = idlen;
2047 	strlcpy(desc->identifier, target, idlen);
2048 
2049 	retval = ctl_port_register(port, /*master_SC*/ 1);
2050 	if (retval != 0) {
2051 		ctl_free_opts(&port->options);
2052 		cfiscsi_target_release(ct);
2053 		free(port->port_devid, M_CFISCSI);
2054 		free(port->target_devid, M_CFISCSI);
2055 		req->status = CTL_LUN_ERROR;
2056 		snprintf(req->error_str, sizeof(req->error_str),
2057 		    "ctl_frontend_register() failed with error %d", retval);
2058 		return;
2059 	}
2060 done:
2061 	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2062 	req->status = CTL_LUN_OK;
2063 	memcpy(req->kern_args[0].kvalue, &port->targ_port,
2064 	    sizeof(port->targ_port)); //XXX
2065 }
2066 
2067 static void
2068 cfiscsi_ioctl_port_remove(struct ctl_req *req)
2069 {
2070 	struct cfiscsi_target *ct;
2071 	const char *target;
2072 	ctl_options_t opts;
2073 
2074 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2075 	target = ctl_get_opt(&opts, "cfiscsi_target");
2076 	if (target == NULL) {
2077 		ctl_free_opts(&opts);
2078 		req->status = CTL_LUN_ERROR;
2079 		snprintf(req->error_str, sizeof(req->error_str),
2080 		    "Missing required argument");
2081 		return;
2082 	}
2083 	ct = cfiscsi_target_find(&cfiscsi_softc, target);
2084 	if (ct == NULL) {
2085 		ctl_free_opts(&opts);
2086 		req->status = CTL_LUN_ERROR;
2087 		snprintf(req->error_str, sizeof(req->error_str),
2088 		    "can't find target \"%s\"", target);
2089 		return;
2090 	}
2091 	if (ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE) {
2092 		ctl_free_opts(&opts);
2093 		req->status = CTL_LUN_ERROR;
2094 		snprintf(req->error_str, sizeof(req->error_str),
2095 		    "target \"%s\" is already dying", target);
2096 		return;
2097 	}
2098 	ctl_free_opts(&opts);
2099 
2100 	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2101 	ctl_port_offline(&ct->ct_port);
2102 	cfiscsi_target_release(ct);
2103 	cfiscsi_target_release(ct);
2104 }
2105 
2106 static int
2107 cfiscsi_ioctl(struct cdev *dev,
2108     u_long cmd, caddr_t addr, int flag, struct thread *td)
2109 {
2110 	struct ctl_iscsi *ci;
2111 	struct ctl_req *req;
2112 
2113 	if (cmd == CTL_PORT_REQ) {
2114 		req = (struct ctl_req *)addr;
2115 		switch (req->reqtype) {
2116 		case CTL_REQ_CREATE:
2117 			cfiscsi_ioctl_port_create(req);
2118 			break;
2119 		case CTL_REQ_REMOVE:
2120 			cfiscsi_ioctl_port_remove(req);
2121 			break;
2122 		default:
2123 			req->status = CTL_LUN_ERROR;
2124 			snprintf(req->error_str, sizeof(req->error_str),
2125 			    "Unsupported request type %d", req->reqtype);
2126 		}
2127 		return (0);
2128 	}
2129 
2130 	if (cmd != CTL_ISCSI)
2131 		return (ENOTTY);
2132 
2133 	ci = (struct ctl_iscsi *)addr;
2134 	switch (ci->type) {
2135 	case CTL_ISCSI_HANDOFF:
2136 		cfiscsi_ioctl_handoff(ci);
2137 		break;
2138 	case CTL_ISCSI_LIST:
2139 		cfiscsi_ioctl_list(ci);
2140 		break;
2141 	case CTL_ISCSI_TERMINATE:
2142 		cfiscsi_ioctl_terminate(ci);
2143 		break;
2144 	case CTL_ISCSI_LOGOUT:
2145 		cfiscsi_ioctl_logout(ci);
2146 		break;
2147 #ifdef ICL_KERNEL_PROXY
2148 	case CTL_ISCSI_LISTEN:
2149 		cfiscsi_ioctl_listen(ci);
2150 		break;
2151 	case CTL_ISCSI_ACCEPT:
2152 		cfiscsi_ioctl_accept(ci);
2153 		break;
2154 	case CTL_ISCSI_SEND:
2155 		cfiscsi_ioctl_send(ci);
2156 		break;
2157 	case CTL_ISCSI_RECEIVE:
2158 		cfiscsi_ioctl_receive(ci);
2159 		break;
2160 #else
2161 	case CTL_ISCSI_LISTEN:
2162 	case CTL_ISCSI_ACCEPT:
2163 	case CTL_ISCSI_SEND:
2164 	case CTL_ISCSI_RECEIVE:
2165 		ci->status = CTL_ISCSI_ERROR;
2166 		snprintf(ci->error_str, sizeof(ci->error_str),
2167 		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2168 		    __func__);
2169 		break;
2170 #endif /* !ICL_KERNEL_PROXY */
2171 	default:
2172 		ci->status = CTL_ISCSI_ERROR;
2173 		snprintf(ci->error_str, sizeof(ci->error_str),
2174 		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2175 		break;
2176 	}
2177 
2178 	return (0);
2179 }
2180 
2181 static void
2182 cfiscsi_target_hold(struct cfiscsi_target *ct)
2183 {
2184 
2185 	refcount_acquire(&ct->ct_refcount);
2186 }
2187 
2188 static void
2189 cfiscsi_target_release(struct cfiscsi_target *ct)
2190 {
2191 	struct cfiscsi_softc *softc;
2192 
2193 	softc = ct->ct_softc;
2194 	mtx_lock(&softc->lock);
2195 	if (refcount_release(&ct->ct_refcount)) {
2196 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2197 		mtx_unlock(&softc->lock);
2198 		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2199 			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2200 			if (ctl_port_deregister(&ct->ct_port) != 0)
2201 				printf("%s: ctl_port_deregister() failed\n",
2202 				    __func__);
2203 		}
2204 		free(ct, M_CFISCSI);
2205 
2206 		return;
2207 	}
2208 	mtx_unlock(&softc->lock);
2209 }
2210 
2211 static struct cfiscsi_target *
2212 cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name)
2213 {
2214 	struct cfiscsi_target *ct;
2215 
2216 	mtx_lock(&softc->lock);
2217 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2218 		if (strcmp(name, ct->ct_name) != 0 ||
2219 		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2220 			continue;
2221 		cfiscsi_target_hold(ct);
2222 		mtx_unlock(&softc->lock);
2223 		return (ct);
2224 	}
2225 	mtx_unlock(&softc->lock);
2226 
2227 	return (NULL);
2228 }
2229 
2230 static struct cfiscsi_target *
2231 cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2232     const char *alias)
2233 {
2234 	struct cfiscsi_target *ct, *newct;
2235 	int i;
2236 
2237 	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2238 		return (NULL);
2239 
2240 	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2241 
2242 	mtx_lock(&softc->lock);
2243 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2244 		if (strcmp(name, ct->ct_name) != 0 ||
2245 		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2246 			continue;
2247 		cfiscsi_target_hold(ct);
2248 		mtx_unlock(&softc->lock);
2249 		free(newct, M_CFISCSI);
2250 		return (ct);
2251 	}
2252 
2253 	for (i = 0; i < CTL_MAX_LUNS; i++)
2254 		newct->ct_luns[i] = UINT32_MAX;
2255 
2256 	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2257 	if (alias != NULL)
2258 		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2259 	refcount_init(&newct->ct_refcount, 1);
2260 	newct->ct_softc = softc;
2261 	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2262 	mtx_unlock(&softc->lock);
2263 
2264 	return (newct);
2265 }
2266 
2267 /*
2268  * Takes LUN from the target space and returns LUN from the CTL space.
2269  */
2270 static uint32_t
2271 cfiscsi_lun_map(void *arg, uint32_t lun)
2272 {
2273 	struct cfiscsi_target *ct = arg;
2274 
2275 	if (lun >= CTL_MAX_LUNS) {
2276 		CFISCSI_DEBUG("requested lun number %d is higher "
2277 		    "than maximum %d", lun, CTL_MAX_LUNS - 1);
2278 		return (UINT32_MAX);
2279 	}
2280 	return (ct->ct_luns[lun]);
2281 }
2282 
2283 static int
2284 cfiscsi_target_set_lun(struct cfiscsi_target *ct,
2285     unsigned long lun_id, unsigned long ctl_lun_id)
2286 {
2287 
2288 	if (lun_id >= CTL_MAX_LUNS) {
2289 		CFISCSI_WARN("requested lun number %ld is higher "
2290 		    "than maximum %d", lun_id, CTL_MAX_LUNS - 1);
2291 		return (-1);
2292 	}
2293 
2294 	if (ct->ct_luns[lun_id] < CTL_MAX_LUNS) {
2295 		/*
2296 		 * CTL calls cfiscsi_lun_enable() twice for each LUN - once
2297 		 * when the LUN is created, and a second time just before
2298 		 * the port is brought online; don't emit warnings
2299 		 * for that case.
2300 		 */
2301 		if (ct->ct_luns[lun_id] == ctl_lun_id)
2302 			return (0);
2303 		CFISCSI_WARN("lun %ld already allocated", lun_id);
2304 		return (-1);
2305 	}
2306 
2307 #if 0
2308 	CFISCSI_DEBUG("adding mapping for lun %ld, target %s "
2309 	    "to ctl lun %ld", lun_id, ct->ct_name, ctl_lun_id);
2310 #endif
2311 
2312 	ct->ct_luns[lun_id] = ctl_lun_id;
2313 
2314 	return (0);
2315 }
2316 
2317 static int
2318 cfiscsi_lun_enable(void *arg, struct ctl_id target_id, int lun_id)
2319 {
2320 	struct cfiscsi_softc *softc;
2321 	struct cfiscsi_target *ct;
2322 	const char *target = NULL;
2323 	const char *lun = NULL;
2324 	unsigned long tmp;
2325 
2326 	ct = (struct cfiscsi_target *)arg;
2327 	softc = ct->ct_softc;
2328 
2329 	target = ctl_get_opt(&control_softc->ctl_luns[lun_id]->be_lun->options,
2330 	    "cfiscsi_target");
2331 	lun = ctl_get_opt(&control_softc->ctl_luns[lun_id]->be_lun->options,
2332 	    "cfiscsi_lun");
2333 
2334 	if (target == NULL && lun == NULL)
2335 		return (0);
2336 
2337 	if (target == NULL || lun == NULL) {
2338 		CFISCSI_WARN("lun added with cfiscsi_target, but without "
2339 		    "cfiscsi_lun, or the other way around; ignoring");
2340 		return (0);
2341 	}
2342 
2343 	if (strcmp(target, ct->ct_name) != 0)
2344 		return (0);
2345 
2346 	tmp = strtoul(lun, NULL, 10);
2347 	cfiscsi_target_set_lun(ct, tmp, lun_id);
2348 	return (0);
2349 }
2350 
2351 static int
2352 cfiscsi_lun_disable(void *arg, struct ctl_id target_id, int lun_id)
2353 {
2354 	struct cfiscsi_softc *softc;
2355 	struct cfiscsi_target *ct;
2356 	int i;
2357 
2358 	ct = (struct cfiscsi_target *)arg;
2359 	softc = ct->ct_softc;
2360 
2361 	mtx_lock(&softc->lock);
2362 	for (i = 0; i < CTL_MAX_LUNS; i++) {
2363 		if (ct->ct_luns[i] != lun_id)
2364 			continue;
2365 		ct->ct_luns[i] = UINT32_MAX;
2366 		break;
2367 	}
2368 	mtx_unlock(&softc->lock);
2369 	return (0);
2370 }
2371 
2372 static void
2373 cfiscsi_datamove_in(union ctl_io *io)
2374 {
2375 	struct cfiscsi_session *cs;
2376 	struct icl_pdu *request, *response;
2377 	const struct iscsi_bhs_scsi_command *bhssc;
2378 	struct iscsi_bhs_data_in *bhsdi;
2379 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2380 	size_t len, expected_len, sg_len, buffer_offset;
2381 	const char *sg_addr;
2382 	int ctl_sg_count, error, i;
2383 
2384 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2385 	cs = PDU_SESSION(request);
2386 
2387 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2388 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2389 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2390 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2391 
2392 	if (io->scsiio.kern_sg_entries > 0) {
2393 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2394 		ctl_sg_count = io->scsiio.kern_sg_entries;
2395 	} else {
2396 		ctl_sglist = &ctl_sg_entry;
2397 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2398 		ctl_sglist->len = io->scsiio.kern_data_len;
2399 		ctl_sg_count = 1;
2400 	}
2401 
2402 	/*
2403 	 * This is the total amount of data to be transferred within the current
2404 	 * SCSI command.  We need to record it so that we can properly report
2405 	 * underflow/underflow.
2406 	 */
2407 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2408 
2409 	/*
2410 	 * This is the offset within the current SCSI command; for the first
2411 	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2412 	 * it will be the sum of lengths of previous ones.
2413 	 */
2414 	buffer_offset = io->scsiio.kern_rel_offset;
2415 
2416 	/*
2417 	 * This is the transfer length expected by the initiator.  In theory,
2418 	 * it could be different from the correct amount of data from the SCSI
2419 	 * point of view, even if that doesn't make any sense.
2420 	 */
2421 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2422 #if 0
2423 	if (expected_len != io->scsiio.kern_total_len) {
2424 		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2425 		    "actual length %zd", expected_len,
2426 		    (size_t)io->scsiio.kern_total_len);
2427 	}
2428 #endif
2429 
2430 	if (buffer_offset >= expected_len) {
2431 #if 0
2432 		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2433 		    "already sent the expected len", buffer_offset);
2434 #endif
2435 		io->scsiio.be_move_done(io);
2436 		return;
2437 	}
2438 
2439 	i = 0;
2440 	sg_addr = NULL;
2441 	sg_len = 0;
2442 	response = NULL;
2443 	bhsdi = NULL;
2444 	for (;;) {
2445 		if (response == NULL) {
2446 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2447 			if (response == NULL) {
2448 				CFISCSI_SESSION_WARN(cs, "failed to "
2449 				    "allocate memory; dropping connection");
2450 				ctl_set_busy(&io->scsiio);
2451 				io->scsiio.be_move_done(io);
2452 				cfiscsi_session_terminate(cs);
2453 				return;
2454 			}
2455 			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2456 			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2457 			bhsdi->bhsdi_initiator_task_tag =
2458 			    bhssc->bhssc_initiator_task_tag;
2459 			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2460 			PDU_EXPDATASN(request)++;
2461 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2462 		}
2463 
2464 		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2465 		if (sg_len == 0) {
2466 			sg_addr = ctl_sglist[i].addr;
2467 			sg_len = ctl_sglist[i].len;
2468 			KASSERT(sg_len > 0, ("sg_len <= 0"));
2469 		}
2470 
2471 		len = sg_len;
2472 
2473 		/*
2474 		 * Truncate to maximum data segment length.
2475 		 */
2476 		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2477 		    ("ip_data_len %zd >= max_data_segment_length %zd",
2478 		    response->ip_data_len, cs->cs_max_data_segment_length));
2479 		if (response->ip_data_len + len >
2480 		    cs->cs_max_data_segment_length) {
2481 			len = cs->cs_max_data_segment_length -
2482 			    response->ip_data_len;
2483 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2484 			    len, sg_len));
2485 		}
2486 
2487 		/*
2488 		 * Truncate to expected data transfer length.
2489 		 */
2490 		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2491 		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2492 		    buffer_offset, response->ip_data_len, expected_len));
2493 		if (buffer_offset + response->ip_data_len + len > expected_len) {
2494 			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2495 			    "to expected data transfer length %zd",
2496 			    buffer_offset + response->ip_data_len + len, expected_len);
2497 			len = expected_len - (buffer_offset + response->ip_data_len);
2498 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2499 			    len, sg_len));
2500 		}
2501 
2502 		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2503 		if (error != 0) {
2504 			CFISCSI_SESSION_WARN(cs, "failed to "
2505 			    "allocate memory; dropping connection");
2506 			icl_pdu_free(response);
2507 			ctl_set_busy(&io->scsiio);
2508 			io->scsiio.be_move_done(io);
2509 			cfiscsi_session_terminate(cs);
2510 			return;
2511 		}
2512 		sg_addr += len;
2513 		sg_len -= len;
2514 
2515 		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2516 		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2517 		    buffer_offset, response->ip_data_len, expected_len));
2518 		if (buffer_offset + response->ip_data_len == expected_len) {
2519 			/*
2520 			 * Already have the amount of data the initiator wanted.
2521 			 */
2522 			break;
2523 		}
2524 
2525 		if (sg_len == 0) {
2526 			/*
2527 			 * End of scatter-gather segment;
2528 			 * proceed to the next one...
2529 			 */
2530 			if (i == ctl_sg_count - 1) {
2531 				/*
2532 				 * ... unless this was the last one.
2533 				 */
2534 				break;
2535 			}
2536 			i++;
2537 		}
2538 
2539 		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2540 			/*
2541 			 * Can't stuff more data into the current PDU;
2542 			 * queue it.  Note that's not enough to check
2543 			 * for kern_data_resid == 0 instead; there
2544 			 * may be several Data-In PDUs for the final
2545 			 * call to cfiscsi_datamove(), and we want
2546 			 * to set the F flag only on the last of them.
2547 			 */
2548 			buffer_offset += response->ip_data_len;
2549 			if (buffer_offset == io->scsiio.kern_total_len ||
2550 			    buffer_offset == expected_len)
2551 				bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2552 			cfiscsi_pdu_queue(response);
2553 			response = NULL;
2554 			bhsdi = NULL;
2555 		}
2556 	}
2557 	if (response != NULL) {
2558 		buffer_offset += response->ip_data_len;
2559 		if (buffer_offset == io->scsiio.kern_total_len ||
2560 		    buffer_offset == expected_len)
2561 			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2562 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2563 		cfiscsi_pdu_queue(response);
2564 	}
2565 
2566 	io->scsiio.be_move_done(io);
2567 }
2568 
2569 static void
2570 cfiscsi_datamove_out(union ctl_io *io)
2571 {
2572 	struct cfiscsi_session *cs;
2573 	struct icl_pdu *request, *response;
2574 	const struct iscsi_bhs_scsi_command *bhssc;
2575 	struct iscsi_bhs_r2t *bhsr2t;
2576 	struct cfiscsi_data_wait *cdw;
2577 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2578 	uint32_t expected_len, r2t_off, r2t_len;
2579 	uint32_t target_transfer_tag;
2580 	bool done;
2581 
2582 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2583 	cs = PDU_SESSION(request);
2584 
2585 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2586 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2587 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2588 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2589 
2590 	/*
2591 	 * We need to record it so that we can properly report
2592 	 * underflow/underflow.
2593 	 */
2594 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2595 
2596 	/*
2597 	 * Report write underflow as error since CTL and backends don't
2598 	 * really support it, and SCSI does not tell how to do it right.
2599 	 */
2600 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2601 	if (io->scsiio.kern_rel_offset + io->scsiio.kern_data_len >
2602 	    expected_len) {
2603 		io->scsiio.io_hdr.port_status = 43;
2604 		io->scsiio.be_move_done(io);
2605 		return;
2606 	}
2607 
2608 	target_transfer_tag =
2609 	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2610 
2611 #if 0
2612 	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2613 	    "task tag 0x%x, target transfer tag 0x%x",
2614 	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2615 #endif
2616 	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
2617 	if (cdw == NULL) {
2618 		CFISCSI_SESSION_WARN(cs, "failed to "
2619 		    "allocate memory; dropping connection");
2620 		ctl_set_busy(&io->scsiio);
2621 		io->scsiio.be_move_done(io);
2622 		cfiscsi_session_terminate(cs);
2623 		return;
2624 	}
2625 	cdw->cdw_ctl_io = io;
2626 	cdw->cdw_target_transfer_tag = target_transfer_tag;
2627 	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2628 	cdw->cdw_r2t_end = io->scsiio.kern_data_len;
2629 
2630 	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2631 	if (io->scsiio.kern_sg_entries > 0) {
2632 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2633 	} else {
2634 		ctl_sglist = &ctl_sg_entry;
2635 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2636 		ctl_sglist->len = io->scsiio.kern_data_len;
2637 	}
2638 	cdw->cdw_sg_index = 0;
2639 	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2640 	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2641 	r2t_off = io->scsiio.ext_data_filled;
2642 	while (r2t_off > 0) {
2643 		if (r2t_off >= cdw->cdw_sg_len) {
2644 			r2t_off -= cdw->cdw_sg_len;
2645 			cdw->cdw_sg_index++;
2646 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2647 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2648 			continue;
2649 		}
2650 		cdw->cdw_sg_addr += r2t_off;
2651 		cdw->cdw_sg_len -= r2t_off;
2652 		r2t_off = 0;
2653 	}
2654 
2655 	if (cs->cs_immediate_data &&
2656 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2657 	    icl_pdu_data_segment_length(request)) {
2658 		done = cfiscsi_handle_data_segment(request, cdw);
2659 		if (done) {
2660 			uma_zfree(cfiscsi_data_wait_zone, cdw);
2661 			io->scsiio.be_move_done(io);
2662 			return;
2663 		}
2664 	}
2665 
2666 	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2667 	r2t_len = MIN(io->scsiio.kern_data_len - io->scsiio.ext_data_filled,
2668 	    cs->cs_max_burst_length);
2669 	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2670 
2671 	CFISCSI_SESSION_LOCK(cs);
2672 	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2673 	CFISCSI_SESSION_UNLOCK(cs);
2674 
2675 	/*
2676 	 * XXX: We should limit the number of outstanding R2T PDUs
2677 	 * 	per task to MaxOutstandingR2T.
2678 	 */
2679 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2680 	if (response == NULL) {
2681 		CFISCSI_SESSION_WARN(cs, "failed to "
2682 		    "allocate memory; dropping connection");
2683 		ctl_set_busy(&io->scsiio);
2684 		io->scsiio.be_move_done(io);
2685 		cfiscsi_session_terminate(cs);
2686 		return;
2687 	}
2688 	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2689 	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2690 	bhsr2t->bhsr2t_flags = 0x80;
2691 	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2692 	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2693 	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2694 	/*
2695 	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2696 	 *	be running concurrently on several CPUs for a given
2697 	 *	command.
2698 	 */
2699 	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2700 	PDU_R2TSN(request)++;
2701 	/*
2702 	 * This is the offset within the current SCSI command;
2703 	 * i.e. for the first call of datamove(), it will be 0,
2704 	 * and for subsequent ones it will be the sum of lengths
2705 	 * of previous ones.
2706 	 *
2707 	 * The ext_data_filled is to account for unsolicited
2708 	 * (immediate) data that might have already arrived.
2709 	 */
2710 	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2711 	/*
2712 	 * This is the total length (sum of S/G lengths) this call
2713 	 * to cfiscsi_datamove() is supposed to handle, limited by
2714 	 * MaxBurstLength.
2715 	 */
2716 	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2717 	cfiscsi_pdu_queue(response);
2718 }
2719 
2720 static void
2721 cfiscsi_datamove(union ctl_io *io)
2722 {
2723 
2724 	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2725 		cfiscsi_datamove_in(io);
2726 	else {
2727 		/* We hadn't received anything during this datamove yet. */
2728 		io->scsiio.ext_data_filled = 0;
2729 		cfiscsi_datamove_out(io);
2730 	}
2731 }
2732 
2733 static void
2734 cfiscsi_scsi_command_done(union ctl_io *io)
2735 {
2736 	struct icl_pdu *request, *response;
2737 	struct iscsi_bhs_scsi_command *bhssc;
2738 	struct iscsi_bhs_scsi_response *bhssr;
2739 #ifdef DIAGNOSTIC
2740 	struct cfiscsi_data_wait *cdw;
2741 #endif
2742 	struct cfiscsi_session *cs;
2743 	uint16_t sense_length;
2744 
2745 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2746 	cs = PDU_SESSION(request);
2747 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2748 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2749 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2750 	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2751 
2752 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2753 	//    bhssc->bhssc_initiator_task_tag);
2754 
2755 #ifdef DIAGNOSTIC
2756 	CFISCSI_SESSION_LOCK(cs);
2757 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2758 		KASSERT(bhssc->bhssc_initiator_task_tag !=
2759 		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2760 	CFISCSI_SESSION_UNLOCK(cs);
2761 #endif
2762 
2763 	/*
2764 	 * Do not return status for aborted commands.
2765 	 * There are exceptions, but none supported by CTL yet.
2766 	 */
2767 	if ((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2768 	    (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) {
2769 		ctl_free_io(io);
2770 		icl_pdu_free(request);
2771 		return;
2772 	}
2773 
2774 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2775 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2776 	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2777 	bhssr->bhssr_flags = 0x80;
2778 	/*
2779 	 * XXX: We don't deal with bidirectional under/overflows;
2780 	 *	does anything actually support those?
2781 	 */
2782 	if (PDU_TOTAL_TRANSFER_LEN(request) <
2783 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2784 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2785 		bhssr->bhssr_residual_count =
2786 		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2787 		    PDU_TOTAL_TRANSFER_LEN(request));
2788 		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2789 		//    ntohl(bhssr->bhssr_residual_count));
2790 	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2791 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2792 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2793 		bhssr->bhssr_residual_count =
2794 		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2795 		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2796 		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2797 		//    ntohl(bhssr->bhssr_residual_count));
2798 	}
2799 	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2800 	bhssr->bhssr_status = io->scsiio.scsi_status;
2801 	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2802 	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2803 
2804 	if (io->scsiio.sense_len > 0) {
2805 #if 0
2806 		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2807 		    io->scsiio.sense_len);
2808 #endif
2809 		sense_length = htons(io->scsiio.sense_len);
2810 		icl_pdu_append_data(response,
2811 		    &sense_length, sizeof(sense_length), M_WAITOK);
2812 		icl_pdu_append_data(response,
2813 		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2814 	}
2815 
2816 	ctl_free_io(io);
2817 	icl_pdu_free(request);
2818 	cfiscsi_pdu_queue(response);
2819 }
2820 
2821 static void
2822 cfiscsi_task_management_done(union ctl_io *io)
2823 {
2824 	struct icl_pdu *request, *response;
2825 	struct iscsi_bhs_task_management_request *bhstmr;
2826 	struct iscsi_bhs_task_management_response *bhstmr2;
2827 	struct cfiscsi_data_wait *cdw, *tmpcdw;
2828 	struct cfiscsi_session *cs;
2829 
2830 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2831 	cs = PDU_SESSION(request);
2832 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2833 	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2834 	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2835 	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2836 
2837 #if 0
2838 	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2839 	    bhstmr->bhstmr_initiator_task_tag,
2840 	    bhstmr->bhstmr_referenced_task_tag);
2841 #endif
2842 
2843 	if ((bhstmr->bhstmr_function & ~0x80) ==
2844 	    BHSTMR_FUNCTION_ABORT_TASK) {
2845 		/*
2846 		 * Make sure we no longer wait for Data-Out for this command.
2847 		 */
2848 		CFISCSI_SESSION_LOCK(cs);
2849 		TAILQ_FOREACH_SAFE(cdw,
2850 		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2851 			if (bhstmr->bhstmr_referenced_task_tag !=
2852 			    cdw->cdw_initiator_task_tag)
2853 				continue;
2854 
2855 #if 0
2856 			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2857 			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2858 #endif
2859 			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2860 			    cdw, cdw_next);
2861 			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2862 			uma_zfree(cfiscsi_data_wait_zone, cdw);
2863 		}
2864 		CFISCSI_SESSION_UNLOCK(cs);
2865 	}
2866 
2867 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2868 	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2869 	    response->ip_bhs;
2870 	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2871 	bhstmr2->bhstmr_flags = 0x80;
2872 	if (io->io_hdr.status == CTL_SUCCESS) {
2873 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2874 	} else {
2875 		/*
2876 		 * XXX: How to figure out what exactly went wrong?  iSCSI spec
2877 		 * 	expects us to provide detailed error, e.g. "Task does
2878 		 * 	not exist" or "LUN does not exist".
2879 		 */
2880 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED");
2881 		bhstmr2->bhstmr_response =
2882 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2883 	}
2884 	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2885 
2886 	ctl_free_io(io);
2887 	icl_pdu_free(request);
2888 	cfiscsi_pdu_queue(response);
2889 }
2890 
2891 static void
2892 cfiscsi_done(union ctl_io *io)
2893 {
2894 	struct icl_pdu *request;
2895 	struct cfiscsi_session *cs;
2896 
2897 	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2898 		("invalid CTL status %#x", io->io_hdr.status));
2899 
2900 	if (io->io_hdr.io_type == CTL_IO_TASK &&
2901 	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
2902 		/*
2903 		 * Implicit task termination has just completed; nothing to do.
2904 		 */
2905 		cs = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2906 		cs->cs_tasks_aborted = true;
2907 		refcount_release(&cs->cs_outstanding_ctl_pdus);
2908 		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
2909 		ctl_free_io(io);
2910 		return;
2911 	}
2912 
2913 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2914 	cs = PDU_SESSION(request);
2915 	refcount_release(&cs->cs_outstanding_ctl_pdus);
2916 
2917 	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2918 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2919 		cfiscsi_scsi_command_done(io);
2920 		break;
2921 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2922 		cfiscsi_task_management_done(io);
2923 		break;
2924 	default:
2925 		panic("cfiscsi_done called with wrong opcode 0x%x",
2926 		    request->ip_bhs->bhs_opcode);
2927 	}
2928 }
2929