xref: /freebsd/sys/cam/ctl/ctl_frontend_iscsi.c (revision b3e7694832e81d7a904a10f525f8797b753bf0d3)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2012 The FreeBSD Foundation
5  *
6  * This software was developed by Edward Tomasz Napierala under sponsorship
7  * from the FreeBSD Foundation.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  */
30 
31 /*
32  * CTL frontend for the iSCSI protocol.
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37 
38 #include <sys/param.h>
39 #include <sys/capsicum.h>
40 #include <sys/condvar.h>
41 #include <sys/endian.h>
42 #include <sys/file.h>
43 #include <sys/kernel.h>
44 #include <sys/kthread.h>
45 #include <sys/lock.h>
46 #include <sys/malloc.h>
47 #include <sys/module.h>
48 #include <sys/mutex.h>
49 #include <sys/queue.h>
50 #include <sys/sbuf.h>
51 #include <sys/socket.h>
52 #include <sys/sysctl.h>
53 #include <sys/systm.h>
54 #include <sys/uio.h>
55 #include <sys/unistd.h>
56 #include <sys/nv.h>
57 #include <sys/dnv.h>
58 #include <vm/uma.h>
59 
60 #include <cam/scsi/scsi_all.h>
61 #include <cam/scsi/scsi_da.h>
62 #include <cam/ctl/ctl_io.h>
63 #include <cam/ctl/ctl.h>
64 #include <cam/ctl/ctl_backend.h>
65 #include <cam/ctl/ctl_error.h>
66 #include <cam/ctl/ctl_frontend.h>
67 #include <cam/ctl/ctl_debug.h>
68 #include <cam/ctl/ctl_ha.h>
69 #include <cam/ctl/ctl_ioctl.h>
70 #include <cam/ctl/ctl_private.h>
71 
72 #include <dev/iscsi/icl.h>
73 #include <dev/iscsi/icl_wrappers.h>
74 #include <dev/iscsi/iscsi_proto.h>
75 #include <cam/ctl/ctl_frontend_iscsi.h>
76 
77 #ifdef ICL_KERNEL_PROXY
78 #include <sys/socketvar.h>
79 #endif
80 
81 #ifdef ICL_KERNEL_PROXY
82 FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
83 #endif
84 
85 /* Used for internal nexus reset task. */
86 #define ISCSI_BHS_OPCODE_INTERNAL	0x3e
87 
88 static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
89 static uma_zone_t cfiscsi_data_wait_zone;
90 
91 SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
92     "CAM Target Layer iSCSI Frontend");
93 static int debug = 1;
94 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
95     &debug, 1, "Enable debug messages");
96 static int ping_timeout = 5;
97 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
98     &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
99 static int login_timeout = 60;
100 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
101     &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
102 static int maxtags = 256;
103 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxtags, CTLFLAG_RWTUN,
104     &maxtags, 0, "Max number of requests queued by initiator");
105 
106 #define	CFISCSI_DEBUG(X, ...)						\
107 	do {								\
108 		if (debug > 1) {					\
109 			printf("%s: " X "\n",				\
110 			    __func__, ## __VA_ARGS__);			\
111 		}							\
112 	} while (0)
113 
114 #define	CFISCSI_WARN(X, ...)						\
115 	do {								\
116 		if (debug > 0) {					\
117 			printf("WARNING: %s: " X "\n",			\
118 			    __func__, ## __VA_ARGS__);			\
119 		}							\
120 	} while (0)
121 
122 #define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
123 	do {								\
124 		if (debug > 1) {					\
125 			printf("%s: %s (%s): " X "\n",			\
126 			    __func__, S->cs_initiator_addr,		\
127 			    S->cs_initiator_name, ## __VA_ARGS__);	\
128 		}							\
129 	} while (0)
130 
131 #define	CFISCSI_SESSION_WARN(S, X, ...)					\
132 	do  {								\
133 		if (debug > 0) {					\
134 			printf("WARNING: %s (%s): " X "\n",		\
135 			    S->cs_initiator_addr,			\
136 			    S->cs_initiator_name, ## __VA_ARGS__);	\
137 		}							\
138 	} while (0)
139 
140 #define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
141 #define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
142 #define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
143 
144 #define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
145 #define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
146 
147 struct cfiscsi_priv {
148 	void		*request;
149 	uint32_t	 expdatasn;
150 	uint32_t	 r2tsn;
151 };
152 #define	PRIV(io)	\
153     ((struct cfiscsi_priv *)&(io)->io_hdr.ctl_private[CTL_PRIV_FRONTEND])
154 #define	PRIV_REQUEST(io)		PRIV(io)->request
155 #define	PRIV_EXPDATASN(io)		PRIV(io)->expdatasn
156 #define	PRIV_R2TSN(io)			PRIV(io)->r2tsn
157 
158 static int	cfiscsi_init(void);
159 static int	cfiscsi_shutdown(void);
160 static void	cfiscsi_online(void *arg);
161 static void	cfiscsi_offline(void *arg);
162 static int	cfiscsi_info(void *arg, struct sbuf *sb);
163 static int	cfiscsi_ioctl(struct cdev *dev,
164 		    u_long cmd, caddr_t addr, int flag, struct thread *td);
165 static void	cfiscsi_datamove(union ctl_io *io);
166 static void	cfiscsi_datamove_in(union ctl_io *io);
167 static void	cfiscsi_datamove_out(union ctl_io *io);
168 static void	cfiscsi_done(union ctl_io *io);
169 static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
170 static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
171 static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
172 static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
173 static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
174 static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
175 static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
176 static struct cfiscsi_data_wait	*cfiscsi_data_wait_new(
177 		    struct cfiscsi_session *cs, union ctl_io *io,
178 		    uint32_t initiator_task_tag,
179 		    uint32_t *target_transfer_tagp);
180 static void	cfiscsi_data_wait_free(struct cfiscsi_session *cs,
181 		    struct cfiscsi_data_wait *cdw);
182 static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
183 		    *softc, const char *name, uint16_t tag);
184 static struct cfiscsi_target	*cfiscsi_target_find_or_create(
185     struct cfiscsi_softc *softc, const char *name, const char *alias,
186     uint16_t tag);
187 static void	cfiscsi_target_release(struct cfiscsi_target *ct);
188 static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
189 
190 static struct cfiscsi_softc cfiscsi_softc;
191 
192 static struct ctl_frontend cfiscsi_frontend =
193 {
194 	.name = "iscsi",
195 	.init = cfiscsi_init,
196 	.ioctl = cfiscsi_ioctl,
197 	.shutdown = cfiscsi_shutdown,
198 };
199 CTL_FRONTEND_DECLARE(cfiscsi, cfiscsi_frontend);
200 MODULE_DEPEND(cfiscsi, icl, 1, 1, 1);
201 
202 static struct icl_pdu *
203 cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
204 {
205 
206 	return (icl_pdu_new(request->ip_conn, flags));
207 }
208 
209 static bool
210 cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
211 {
212 	const struct iscsi_bhs_scsi_command *bhssc;
213 	struct cfiscsi_session *cs;
214 	uint32_t cmdsn, curcmdsn;
215 
216 	cs = PDU_SESSION(request);
217 
218 	/*
219 	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
220 	 * The purpose of the timeout is to reset the connection when it stalls;
221 	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
222 	 * in some queue.
223 	 */
224 	cs->cs_timeout = 0;
225 
226 	/*
227 	 * Immediate commands carry cmdsn, but it is neither incremented nor
228 	 * verified.
229 	 */
230 	if (request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE)
231 		return (false);
232 
233 	/*
234 	 * Data-Out PDUs don't contain CmdSN.
235 	 */
236 	if (request->ip_bhs->bhs_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
237 		return (false);
238 
239 	/*
240 	 * We're only using fields common for all the request
241 	 * (initiator -> target) PDUs.
242 	 */
243 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
244 	curcmdsn = cmdsn = ntohl(bhssc->bhssc_cmdsn);
245 
246 	/*
247 	 * Increment session cmdsn and exit if we received the expected value.
248 	 */
249 	do {
250 		if (atomic_fcmpset_32(&cs->cs_cmdsn, &curcmdsn, cmdsn + 1))
251 			return (false);
252 	} while (curcmdsn == cmdsn);
253 
254 	/*
255 	 * The target MUST silently ignore any non-immediate command outside
256 	 * of this range.
257 	 */
258 	if (ISCSI_SNLT(cmdsn, curcmdsn) ||
259 	    ISCSI_SNGT(cmdsn, curcmdsn - 1 + maxtags)) {
260 		CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
261 		    "while expected %u", cmdsn, curcmdsn);
262 		return (true);
263 	}
264 
265 	/*
266 	 * We don't support multiple connections now, so any discontinuity in
267 	 * CmdSN means lost PDUs.  Since we don't support PDU retransmission --
268 	 * terminate the connection.
269 	 */
270 	CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
271 	    "while expected %u; dropping connection",
272 	    cmdsn, curcmdsn);
273 	cfiscsi_session_terminate(cs);
274 	return (true);
275 }
276 
277 static void
278 cfiscsi_pdu_handle(struct icl_pdu *request)
279 {
280 	struct cfiscsi_session *cs;
281 	bool ignore;
282 
283 	cs = PDU_SESSION(request);
284 
285 	ignore = cfiscsi_pdu_update_cmdsn(request);
286 	if (ignore) {
287 		icl_pdu_free(request);
288 		return;
289 	}
290 
291 	/*
292 	 * Handle the PDU; this includes e.g. receiving the remaining
293 	 * part of PDU and submitting the SCSI command to CTL
294 	 * or queueing a reply.  The handling routine is responsible
295 	 * for freeing the PDU when it's no longer needed.
296 	 */
297 	switch (request->ip_bhs->bhs_opcode &
298 	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
299 	case ISCSI_BHS_OPCODE_NOP_OUT:
300 		cfiscsi_pdu_handle_nop_out(request);
301 		break;
302 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
303 		cfiscsi_pdu_handle_scsi_command(request);
304 		break;
305 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
306 		cfiscsi_pdu_handle_task_request(request);
307 		break;
308 	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
309 		cfiscsi_pdu_handle_data_out(request);
310 		break;
311 	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
312 		cfiscsi_pdu_handle_logout_request(request);
313 		break;
314 	default:
315 		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
316 		    "opcode 0x%x; dropping connection",
317 		    request->ip_bhs->bhs_opcode);
318 		icl_pdu_free(request);
319 		cfiscsi_session_terminate(cs);
320 	}
321 
322 }
323 
324 static void
325 cfiscsi_receive_callback(struct icl_pdu *request)
326 {
327 #ifdef ICL_KERNEL_PROXY
328 	struct cfiscsi_session *cs;
329 
330 	cs = PDU_SESSION(request);
331 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
332 		if (cs->cs_login_pdu == NULL)
333 			cs->cs_login_pdu = request;
334 		else
335 			icl_pdu_free(request);
336 		cv_signal(&cs->cs_login_cv);
337 		return;
338 	}
339 #endif
340 
341 	cfiscsi_pdu_handle(request);
342 }
343 
344 static void
345 cfiscsi_error_callback(struct icl_conn *ic)
346 {
347 	struct cfiscsi_session *cs;
348 
349 	cs = CONN_SESSION(ic);
350 
351 	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
352 	cfiscsi_session_terminate(cs);
353 }
354 
355 static int
356 cfiscsi_pdu_prepare(struct icl_pdu *response)
357 {
358 	struct cfiscsi_session *cs;
359 	struct iscsi_bhs_scsi_response *bhssr;
360 	bool advance_statsn = true;
361 	uint32_t cmdsn;
362 
363 	cs = PDU_SESSION(response);
364 
365 	CFISCSI_SESSION_LOCK_ASSERT(cs);
366 
367 	/*
368 	 * We're only using fields common for all the response
369 	 * (target -> initiator) PDUs.
370 	 */
371 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
372 
373 	/*
374 	 * 10.8.3: "The StatSN for this connection is not advanced
375 	 * after this PDU is sent."
376 	 */
377 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
378 		advance_statsn = false;
379 
380 	/*
381 	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
382 	 * StatSN for the connection is not advanced after this PDU is sent."
383 	 */
384 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
385 	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
386 		advance_statsn = false;
387 
388 	/*
389 	 * See the comment below - StatSN is not meaningful and must
390 	 * not be advanced.
391 	 */
392 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN &&
393 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S) == 0)
394 		advance_statsn = false;
395 
396 	/*
397 	 * 10.7.3: "The fields StatSN, Status, and Residual Count
398 	 * only have meaningful content if the S bit is set to 1."
399 	 */
400 	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
401 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S))
402 		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
403 	cmdsn = cs->cs_cmdsn;
404 	bhssr->bhssr_expcmdsn = htonl(cmdsn);
405 	bhssr->bhssr_maxcmdsn = htonl(cmdsn - 1 +
406 	    imax(0, maxtags - cs->cs_outstanding_ctl_pdus));
407 
408 	if (advance_statsn)
409 		cs->cs_statsn++;
410 
411 	return (0);
412 }
413 
414 static void
415 cfiscsi_pdu_queue(struct icl_pdu *response)
416 {
417 	struct cfiscsi_session *cs;
418 
419 	cs = PDU_SESSION(response);
420 
421 	CFISCSI_SESSION_LOCK(cs);
422 	cfiscsi_pdu_prepare(response);
423 	icl_pdu_queue(response);
424 	CFISCSI_SESSION_UNLOCK(cs);
425 }
426 
427  static void
428 cfiscsi_pdu_queue_cb(struct icl_pdu *response, icl_pdu_cb cb)
429 {
430 	struct cfiscsi_session *cs = PDU_SESSION(response);
431 
432 	CFISCSI_SESSION_LOCK(cs);
433 	cfiscsi_pdu_prepare(response);
434 	icl_pdu_queue_cb(response, cb);
435 	CFISCSI_SESSION_UNLOCK(cs);
436 }
437 
438 static void
439 cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
440 {
441 	struct cfiscsi_session *cs;
442 	struct iscsi_bhs_nop_out *bhsno;
443 	struct iscsi_bhs_nop_in *bhsni;
444 	struct icl_pdu *response;
445 	void *data = NULL;
446 	size_t datasize;
447 	int error;
448 
449 	cs = PDU_SESSION(request);
450 	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
451 
452 	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
453 		/*
454 		 * Nothing to do, iscsi_pdu_update_statsn() already
455 		 * zeroed the timeout.
456 		 */
457 		icl_pdu_free(request);
458 		return;
459 	}
460 
461 	datasize = icl_pdu_data_segment_length(request);
462 	if (datasize > 0) {
463 		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
464 		if (data == NULL) {
465 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
466 			    "dropping connection");
467 			icl_pdu_free(request);
468 			cfiscsi_session_terminate(cs);
469 			return;
470 		}
471 		icl_pdu_get_data(request, 0, data, datasize);
472 	}
473 
474 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
475 	if (response == NULL) {
476 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
477 		    "droppping connection");
478 		free(data, M_CFISCSI);
479 		icl_pdu_free(request);
480 		cfiscsi_session_terminate(cs);
481 		return;
482 	}
483 	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
484 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
485 	bhsni->bhsni_flags = 0x80;
486 	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
487 	bhsni->bhsni_target_transfer_tag = 0xffffffff;
488 	if (datasize > 0) {
489 		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
490 		if (error != 0) {
491 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
492 			    "dropping connection");
493 			free(data, M_CFISCSI);
494 			icl_pdu_free(request);
495 			icl_pdu_free(response);
496 			cfiscsi_session_terminate(cs);
497 			return;
498 		}
499 		free(data, M_CFISCSI);
500 	}
501 
502 	icl_pdu_free(request);
503 	cfiscsi_pdu_queue(response);
504 }
505 
506 static void
507 cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
508 {
509 	struct iscsi_bhs_scsi_command *bhssc;
510 	struct cfiscsi_session *cs;
511 	union ctl_io *io;
512 	int error;
513 
514 	cs = PDU_SESSION(request);
515 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
516 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
517 	//    bhssc->bhssc_initiator_task_tag);
518 
519 	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
520 		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
521 		    "ImmediateData=No; dropping connection");
522 		icl_pdu_free(request);
523 		cfiscsi_session_terminate(cs);
524 		return;
525 	}
526 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
527 	ctl_zero_io(io);
528 	PRIV_REQUEST(io) = request;
529 	io->io_hdr.io_type = CTL_IO_SCSI;
530 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
531 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
532 	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhssc->bhssc_lun));
533 	io->scsiio.priority = (bhssc->bhssc_pri & BHSSC_PRI_MASK) >>
534 	    BHSSC_PRI_SHIFT;
535 	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
536 	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
537 	case BHSSC_FLAGS_ATTR_UNTAGGED:
538 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
539 		break;
540 	case BHSSC_FLAGS_ATTR_SIMPLE:
541 		io->scsiio.tag_type = CTL_TAG_SIMPLE;
542 		break;
543 	case BHSSC_FLAGS_ATTR_ORDERED:
544         	io->scsiio.tag_type = CTL_TAG_ORDERED;
545 		break;
546 	case BHSSC_FLAGS_ATTR_HOQ:
547         	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
548 		break;
549 	case BHSSC_FLAGS_ATTR_ACA:
550 		io->scsiio.tag_type = CTL_TAG_ACA;
551 		break;
552 	default:
553 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
554 		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
555 		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
556 		break;
557 	}
558 	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
559 	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
560 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
561 	error = ctl_run(io);
562 	if (error != CTL_RETVAL_COMPLETE) {
563 		CFISCSI_SESSION_WARN(cs, "ctl_run() failed; error %d; "
564 		    "dropping connection", error);
565 		ctl_free_io(io);
566 		refcount_release(&cs->cs_outstanding_ctl_pdus);
567 		icl_pdu_free(request);
568 		cfiscsi_session_terminate(cs);
569 	}
570 }
571 
572 static void
573 cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
574 {
575 	struct iscsi_bhs_task_management_request *bhstmr;
576 	struct iscsi_bhs_task_management_response *bhstmr2;
577 	struct icl_pdu *response;
578 	struct cfiscsi_session *cs;
579 	union ctl_io *io;
580 	int error;
581 
582 	cs = PDU_SESSION(request);
583 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
584 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
585 	ctl_zero_io(io);
586 	PRIV_REQUEST(io) = request;
587 	io->io_hdr.io_type = CTL_IO_TASK;
588 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
589 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
590 	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhstmr->bhstmr_lun));
591 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
592 
593 	switch (bhstmr->bhstmr_function & ~0x80) {
594 	case BHSTMR_FUNCTION_ABORT_TASK:
595 #if 0
596 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
597 #endif
598 		io->taskio.task_action = CTL_TASK_ABORT_TASK;
599 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
600 		break;
601 	case BHSTMR_FUNCTION_ABORT_TASK_SET:
602 #if 0
603 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
604 #endif
605 		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
606 		break;
607 	case BHSTMR_FUNCTION_CLEAR_TASK_SET:
608 #if 0
609 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_CLEAR_TASK_SET");
610 #endif
611 		io->taskio.task_action = CTL_TASK_CLEAR_TASK_SET;
612 		break;
613 	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
614 #if 0
615 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
616 #endif
617 		io->taskio.task_action = CTL_TASK_LUN_RESET;
618 		break;
619 	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
620 #if 0
621 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
622 #endif
623 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
624 		break;
625 	case BHSTMR_FUNCTION_TARGET_COLD_RESET:
626 #if 0
627 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_COLD_RESET");
628 #endif
629 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
630 		break;
631 	case BHSTMR_FUNCTION_QUERY_TASK:
632 #if 0
633 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK");
634 #endif
635 		io->taskio.task_action = CTL_TASK_QUERY_TASK;
636 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
637 		break;
638 	case BHSTMR_FUNCTION_QUERY_TASK_SET:
639 #if 0
640 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK_SET");
641 #endif
642 		io->taskio.task_action = CTL_TASK_QUERY_TASK_SET;
643 		break;
644 	case BHSTMR_FUNCTION_I_T_NEXUS_RESET:
645 #if 0
646 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_I_T_NEXUS_RESET");
647 #endif
648 		io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
649 		break;
650 	case BHSTMR_FUNCTION_QUERY_ASYNC_EVENT:
651 #if 0
652 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_ASYNC_EVENT");
653 #endif
654 		io->taskio.task_action = CTL_TASK_QUERY_ASYNC_EVENT;
655 		break;
656 	default:
657 		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
658 		    bhstmr->bhstmr_function & ~0x80);
659 		ctl_free_io(io);
660 
661 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
662 		if (response == NULL) {
663 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
664 			    "dropping connection");
665 			icl_pdu_free(request);
666 			cfiscsi_session_terminate(cs);
667 			return;
668 		}
669 		bhstmr2 = (struct iscsi_bhs_task_management_response *)
670 		    response->ip_bhs;
671 		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
672 		bhstmr2->bhstmr_flags = 0x80;
673 		bhstmr2->bhstmr_response =
674 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
675 		bhstmr2->bhstmr_initiator_task_tag =
676 		    bhstmr->bhstmr_initiator_task_tag;
677 		icl_pdu_free(request);
678 		cfiscsi_pdu_queue(response);
679 		return;
680 	}
681 
682 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
683 	error = ctl_run(io);
684 	if (error != CTL_RETVAL_COMPLETE) {
685 		CFISCSI_SESSION_WARN(cs, "ctl_run() failed; error %d; "
686 		    "dropping connection", error);
687 		ctl_free_io(io);
688 		refcount_release(&cs->cs_outstanding_ctl_pdus);
689 		icl_pdu_free(request);
690 		cfiscsi_session_terminate(cs);
691 	}
692 }
693 
694 static bool
695 cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
696 {
697 	struct iscsi_bhs_data_out *bhsdo;
698 	struct cfiscsi_session *cs;
699 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
700 	size_t copy_len, len, off, buffer_offset;
701 	int ctl_sg_count;
702 	union ctl_io *io;
703 
704 	cs = PDU_SESSION(request);
705 
706 	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
707 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
708 	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
709 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
710 	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
711 
712 	/*
713 	 * We're only using fields common for Data-Out and SCSI Command PDUs.
714 	 */
715 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
716 
717 	io = cdw->cdw_ctl_io;
718 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
719 	    ("CTL_FLAG_DATA_IN"));
720 
721 #if 0
722 	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
723 	    request->ip_data_len, io->scsiio.kern_total_len);
724 #endif
725 
726 	if (io->scsiio.kern_sg_entries > 0) {
727 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
728 		ctl_sg_count = io->scsiio.kern_sg_entries;
729 	} else {
730 		ctl_sglist = &ctl_sg_entry;
731 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
732 		ctl_sglist->len = io->scsiio.kern_data_len;
733 		ctl_sg_count = 1;
734 	}
735 
736 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
737 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
738 		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
739 	else
740 		buffer_offset = 0;
741 	len = icl_pdu_data_segment_length(request);
742 
743 	/*
744 	 * Make sure the offset, as sent by the initiator, matches the offset
745 	 * we're supposed to be at in the scatter-gather list.
746 	 */
747 	if (buffer_offset >
748 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
749 	    buffer_offset + len <=
750 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
751 		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
752 		    "expected %zd; dropping connection", buffer_offset,
753 		    (size_t)io->scsiio.kern_rel_offset +
754 		    (size_t)io->scsiio.ext_data_filled);
755 		ctl_set_data_phase_error(&io->scsiio);
756 		cfiscsi_session_terminate(cs);
757 		return (true);
758 	}
759 
760 	/*
761 	 * This is the offset within the PDU data segment, as opposed
762 	 * to buffer_offset, which is the offset within the task (SCSI
763 	 * command).
764 	 */
765 	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
766 	    buffer_offset;
767 
768 	/*
769 	 * Iterate over the scatter/gather segments, filling them with data
770 	 * from the PDU data segment.  Note that this can get called multiple
771 	 * times for one SCSI command; the cdw structure holds state for the
772 	 * scatter/gather list.
773 	 */
774 	for (;;) {
775 		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
776 		    ("cdw->cdw_sg_index >= ctl_sg_count"));
777 		if (cdw->cdw_sg_len == 0) {
778 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
779 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
780 		}
781 		KASSERT(off <= len, ("len > off"));
782 		copy_len = len - off;
783 		if (copy_len > cdw->cdw_sg_len)
784 			copy_len = cdw->cdw_sg_len;
785 
786 		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
787 		cdw->cdw_sg_addr += copy_len;
788 		cdw->cdw_sg_len -= copy_len;
789 		off += copy_len;
790 		io->scsiio.ext_data_filled += copy_len;
791 		io->scsiio.kern_data_resid -= copy_len;
792 
793 		if (cdw->cdw_sg_len == 0) {
794 			/*
795 			 * End of current segment.
796 			 */
797 			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
798 				/*
799 				 * Last segment in scatter/gather list.
800 				 */
801 				break;
802 			}
803 			cdw->cdw_sg_index++;
804 		}
805 
806 		if (off == len) {
807 			/*
808 			 * End of PDU payload.
809 			 */
810 			break;
811 		}
812 	}
813 
814 	if (len > off) {
815 		/*
816 		 * In case of unsolicited data, it's possible that the buffer
817 		 * provided by CTL is smaller than negotiated FirstBurstLength.
818 		 * Just ignore the superfluous data; will ask for them with R2T
819 		 * on next call to cfiscsi_datamove().
820 		 *
821 		 * This obviously can only happen with SCSI Command PDU.
822 		 */
823 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
824 		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
825 			return (true);
826 
827 		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
828 		    "expected %zd; dropping connection",
829 		    icl_pdu_data_segment_length(request), off);
830 		ctl_set_data_phase_error(&io->scsiio);
831 		cfiscsi_session_terminate(cs);
832 		return (true);
833 	}
834 
835 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
836 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
837 		CFISCSI_SESSION_WARN(cs, "got the final packet without "
838 		    "the F flag; flags = 0x%x; dropping connection",
839 		    bhsdo->bhsdo_flags);
840 		ctl_set_data_phase_error(&io->scsiio);
841 		cfiscsi_session_terminate(cs);
842 		return (true);
843 	}
844 
845 	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
846 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
847 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
848 		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
849 			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
850 			    "transmitted size was %zd bytes instead of %d; "
851 			    "dropping connection",
852 			    (size_t)io->scsiio.ext_data_filled,
853 			    cdw->cdw_r2t_end);
854 			ctl_set_data_phase_error(&io->scsiio);
855 			cfiscsi_session_terminate(cs);
856 			return (true);
857 		} else {
858 			/*
859 			 * For SCSI Command PDU, this just means we need to
860 			 * solicit more data by sending R2T.
861 			 */
862 			return (false);
863 		}
864 	}
865 
866 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
867 #if 0
868 		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
869 		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
870 #endif
871 
872 		return (true);
873 	}
874 
875 	return (false);
876 }
877 
878 static void
879 cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
880 {
881 	struct iscsi_bhs_data_out *bhsdo;
882 	struct cfiscsi_session *cs;
883 	struct cfiscsi_data_wait *cdw = NULL;
884 	union ctl_io *io;
885 	bool done;
886 
887 	cs = PDU_SESSION(request);
888 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
889 
890 	CFISCSI_SESSION_LOCK(cs);
891 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
892 #if 0
893 		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
894 		    "ttt 0x%x, itt 0x%x",
895 		    bhsdo->bhsdo_target_transfer_tag,
896 		    bhsdo->bhsdo_initiator_task_tag,
897 		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
898 #endif
899 		if (bhsdo->bhsdo_target_transfer_tag ==
900 		    cdw->cdw_target_transfer_tag)
901 			break;
902 	}
903 	CFISCSI_SESSION_UNLOCK(cs);
904 	if (cdw == NULL) {
905 		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
906 		    "0x%x, not found; dropping connection",
907 		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
908 		icl_pdu_free(request);
909 		cfiscsi_session_terminate(cs);
910 		return;
911 	}
912 
913 	if (cdw->cdw_datasn != ntohl(bhsdo->bhsdo_datasn)) {
914 		CFISCSI_SESSION_WARN(cs, "received Data-Out PDU with "
915 		    "DataSN %u, while expected %u; dropping connection",
916 		    ntohl(bhsdo->bhsdo_datasn), cdw->cdw_datasn);
917 		icl_pdu_free(request);
918 		cfiscsi_session_terminate(cs);
919 		return;
920 	}
921 	cdw->cdw_datasn += request->ip_additional_pdus + 1;
922 
923 	io = cdw->cdw_ctl_io;
924 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
925 	    ("CTL_FLAG_DATA_IN"));
926 
927 	done = cfiscsi_handle_data_segment(request, cdw);
928 	if (done) {
929 		CFISCSI_SESSION_LOCK(cs);
930 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
931 		CFISCSI_SESSION_UNLOCK(cs);
932 		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
933 		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
934 		cfiscsi_data_wait_free(cs, cdw);
935 		io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
936 		if (done)
937 			ctl_datamove_done(io, false);
938 		else
939 			cfiscsi_datamove_out(io);
940 	}
941 
942 	icl_pdu_free(request);
943 }
944 
945 static void
946 cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
947 {
948 	struct iscsi_bhs_logout_request *bhslr;
949 	struct iscsi_bhs_logout_response *bhslr2;
950 	struct icl_pdu *response;
951 	struct cfiscsi_session *cs;
952 
953 	cs = PDU_SESSION(request);
954 	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
955 	switch (bhslr->bhslr_reason & 0x7f) {
956 	case BHSLR_REASON_CLOSE_SESSION:
957 	case BHSLR_REASON_CLOSE_CONNECTION:
958 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
959 		if (response == NULL) {
960 			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
961 			icl_pdu_free(request);
962 			cfiscsi_session_terminate(cs);
963 			return;
964 		}
965 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
966 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
967 		bhslr2->bhslr_flags = 0x80;
968 		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
969 		bhslr2->bhslr_initiator_task_tag =
970 		    bhslr->bhslr_initiator_task_tag;
971 		icl_pdu_free(request);
972 		cfiscsi_pdu_queue(response);
973 		cfiscsi_session_terminate(cs);
974 		break;
975 	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
976 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
977 		if (response == NULL) {
978 			CFISCSI_SESSION_WARN(cs,
979 			    "failed to allocate memory; dropping connection");
980 			icl_pdu_free(request);
981 			cfiscsi_session_terminate(cs);
982 			return;
983 		}
984 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
985 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
986 		bhslr2->bhslr_flags = 0x80;
987 		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
988 		bhslr2->bhslr_initiator_task_tag =
989 		    bhslr->bhslr_initiator_task_tag;
990 		icl_pdu_free(request);
991 		cfiscsi_pdu_queue(response);
992 		break;
993 	default:
994 		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
995 		    bhslr->bhslr_reason);
996 		icl_pdu_free(request);
997 		cfiscsi_session_terminate(cs);
998 		break;
999 	}
1000 }
1001 
1002 static void
1003 cfiscsi_callout(void *context)
1004 {
1005 	struct icl_pdu *cp;
1006 	struct iscsi_bhs_nop_in *bhsni;
1007 	struct cfiscsi_session *cs;
1008 
1009 	cs = context;
1010 
1011 	if (cs->cs_terminating)
1012 		return;
1013 
1014 	callout_schedule(&cs->cs_callout, 1 * hz);
1015 
1016 	atomic_add_int(&cs->cs_timeout, 1);
1017 
1018 #ifdef ICL_KERNEL_PROXY
1019 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1020 		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1021 			CFISCSI_SESSION_WARN(cs, "login timed out after "
1022 			    "%d seconds; dropping connection", cs->cs_timeout);
1023 			cfiscsi_session_terminate(cs);
1024 		}
1025 		return;
1026 	}
1027 #endif
1028 
1029 	if (ping_timeout <= 0) {
1030 		/*
1031 		 * Pings are disabled.  Don't send NOP-In in this case;
1032 		 * user might have disabled pings to work around problems
1033 		 * with certain initiators that can't properly handle
1034 		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1035 		 * triggering reconnection, should the user decide to
1036 		 * reenable them.
1037 		 */
1038 		cs->cs_timeout = 0;
1039 		return;
1040 	}
1041 
1042 	if (cs->cs_timeout >= ping_timeout) {
1043 		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1044 		    "dropping connection",  ping_timeout);
1045 		cfiscsi_session_terminate(cs);
1046 		return;
1047 	}
1048 
1049 	/*
1050 	 * If the ping was reset less than one second ago - which means
1051 	 * that we've received some PDU during the last second - assume
1052 	 * the traffic flows correctly and don't bother sending a NOP-Out.
1053 	 *
1054 	 * (It's 2 - one for one second, and one for incrementing is_timeout
1055 	 * earlier in this routine.)
1056 	 */
1057 	if (cs->cs_timeout < 2)
1058 		return;
1059 
1060 	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1061 	if (cp == NULL) {
1062 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1063 		return;
1064 	}
1065 	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1066 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1067 	bhsni->bhsni_flags = 0x80;
1068 	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1069 
1070 	cfiscsi_pdu_queue(cp);
1071 }
1072 
1073 static struct cfiscsi_data_wait *
1074 cfiscsi_data_wait_new(struct cfiscsi_session *cs, union ctl_io *io,
1075     uint32_t initiator_task_tag, uint32_t *target_transfer_tagp)
1076 {
1077 	struct cfiscsi_data_wait *cdw;
1078 	int error;
1079 
1080 	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
1081 	if (cdw == NULL) {
1082 		CFISCSI_SESSION_WARN(cs,
1083 		    "failed to allocate %zd bytes", sizeof(*cdw));
1084 		return (NULL);
1085 	}
1086 
1087 	error = icl_conn_transfer_setup(cs->cs_conn, PRIV_REQUEST(io), io,
1088 	    target_transfer_tagp, &cdw->cdw_icl_prv);
1089 	if (error != 0) {
1090 		CFISCSI_SESSION_WARN(cs,
1091 		    "icl_conn_transfer_setup() failed with error %d", error);
1092 		uma_zfree(cfiscsi_data_wait_zone, cdw);
1093 		return (NULL);
1094 	}
1095 
1096 	cdw->cdw_ctl_io = io;
1097 	cdw->cdw_target_transfer_tag = *target_transfer_tagp;
1098 	cdw->cdw_initiator_task_tag = initiator_task_tag;
1099 
1100 	return (cdw);
1101 }
1102 
1103 static void
1104 cfiscsi_data_wait_free(struct cfiscsi_session *cs,
1105     struct cfiscsi_data_wait *cdw)
1106 {
1107 
1108 	icl_conn_transfer_done(cs->cs_conn, cdw->cdw_icl_prv);
1109 	uma_zfree(cfiscsi_data_wait_zone, cdw);
1110 }
1111 
1112 static void
1113 cfiscsi_data_wait_abort(struct cfiscsi_session *cs,
1114     struct cfiscsi_data_wait *cdw, int status)
1115 {
1116 	union ctl_io *cdw_io;
1117 
1118 	/*
1119 	 * Set nonzero port status; this prevents backends from
1120 	 * assuming that the data transfer actually succeeded
1121 	 * and writing uninitialized data to disk.
1122 	 */
1123 	MPASS(status != 0);
1124 	cdw_io = cdw->cdw_ctl_io;
1125 	cdw_io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
1126 	cdw_io->scsiio.io_hdr.port_status = status;
1127 	cfiscsi_data_wait_free(cs, cdw);
1128 	ctl_datamove_done(cdw_io, false);
1129 }
1130 
1131 static void
1132 cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1133 {
1134 	struct cfiscsi_data_wait *cdw;
1135 	struct icl_pdu *ip;
1136 	union ctl_io *io;
1137 	int error, last, wait;
1138 
1139 	if (cs->cs_target == NULL)
1140 		return;		/* No target yet, so nothing to do. */
1141 	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
1142 	ip->ip_bhs->bhs_opcode = ISCSI_BHS_OPCODE_INTERNAL;
1143 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1144 	ctl_zero_io(io);
1145 	PRIV_REQUEST(io) = ip;
1146 	io->io_hdr.io_type = CTL_IO_TASK;
1147 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
1148 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1149 	io->io_hdr.nexus.targ_lun = 0;
1150 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1151 	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1152 	wait = cs->cs_outstanding_ctl_pdus;
1153 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1154 	error = ctl_run(io);
1155 	if (error != CTL_RETVAL_COMPLETE) {
1156 		CFISCSI_SESSION_WARN(cs, "ctl_run() failed; error %d", error);
1157 		refcount_release(&cs->cs_outstanding_ctl_pdus);
1158 		ctl_free_io(io);
1159 		icl_pdu_free(ip);
1160 	}
1161 
1162 	CFISCSI_SESSION_LOCK(cs);
1163 	cs->cs_terminating_tasks = true;
1164 	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1165 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1166 		CFISCSI_SESSION_UNLOCK(cs);
1167 		cfiscsi_data_wait_abort(cs, cdw, 42);
1168 		CFISCSI_SESSION_LOCK(cs);
1169 	}
1170 	CFISCSI_SESSION_UNLOCK(cs);
1171 
1172 	/*
1173 	 * Wait for CTL to terminate all the tasks.
1174 	 */
1175 	if (wait > 0)
1176 		CFISCSI_SESSION_WARN(cs,
1177 		    "waiting for CTL to terminate %d tasks", wait);
1178 	for (;;) {
1179 		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1180 		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1181 		if (last != 0)
1182 			break;
1183 		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1184 		    0, "cfiscsi_terminate", hz / 100);
1185 	}
1186 	if (wait > 0)
1187 		CFISCSI_SESSION_WARN(cs, "tasks terminated");
1188 }
1189 
1190 static void
1191 cfiscsi_maintenance_thread(void *arg)
1192 {
1193 	struct cfiscsi_session *cs;
1194 
1195 	cs = arg;
1196 
1197 	for (;;) {
1198 		CFISCSI_SESSION_LOCK(cs);
1199 		if (cs->cs_terminating == false || cs->cs_handoff_in_progress)
1200 			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1201 		CFISCSI_SESSION_UNLOCK(cs);
1202 
1203 		if (cs->cs_terminating && cs->cs_handoff_in_progress == false) {
1204 			/*
1205 			 * We used to wait up to 30 seconds to deliver queued
1206 			 * PDUs to the initiator.  We also tried hard to deliver
1207 			 * SCSI Responses for the aborted PDUs.  We don't do
1208 			 * that anymore.  We might need to revisit that.
1209 			 */
1210 			callout_drain(&cs->cs_callout);
1211 			icl_conn_close(cs->cs_conn);
1212 
1213 			/*
1214 			 * At this point ICL receive thread is no longer
1215 			 * running; no new tasks can be queued.
1216 			 */
1217 			cfiscsi_session_terminate_tasks(cs);
1218 			cfiscsi_session_delete(cs);
1219 			kthread_exit();
1220 			return;
1221 		}
1222 		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1223 	}
1224 }
1225 
1226 static void
1227 cfiscsi_session_terminate(struct cfiscsi_session *cs)
1228 {
1229 
1230 	cs->cs_terminating = true;
1231 	cv_signal(&cs->cs_maintenance_cv);
1232 #ifdef ICL_KERNEL_PROXY
1233 	cv_signal(&cs->cs_login_cv);
1234 #endif
1235 }
1236 
1237 static int
1238 cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1239 {
1240 	struct cfiscsi_target *ct;
1241 	char *name;
1242 	int i;
1243 
1244 	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1245 
1246 	ct = cs->cs_target;
1247 	name = strdup(cs->cs_initiator_id, M_CTL);
1248 	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1249 	if (i < 0) {
1250 		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1251 		    i);
1252 		cs->cs_ctl_initid = -1;
1253 		return (1);
1254 	}
1255 	cs->cs_ctl_initid = i;
1256 #if 0
1257 	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1258 #endif
1259 
1260 	return (0);
1261 }
1262 
1263 static void
1264 cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1265 {
1266 	int error;
1267 
1268 	if (cs->cs_ctl_initid == -1)
1269 		return;
1270 
1271 	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1272 	if (error != 0) {
1273 		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1274 		    error);
1275 	}
1276 	cs->cs_ctl_initid = -1;
1277 }
1278 
1279 static struct cfiscsi_session *
1280 cfiscsi_session_new(struct cfiscsi_softc *softc, const char *offload)
1281 {
1282 	struct cfiscsi_session *cs;
1283 	int error;
1284 
1285 	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1286 	if (cs == NULL) {
1287 		CFISCSI_WARN("malloc failed");
1288 		return (NULL);
1289 	}
1290 	cs->cs_ctl_initid = -1;
1291 
1292 	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1293 	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1294 	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1295 	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1296 #ifdef ICL_KERNEL_PROXY
1297 	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1298 #endif
1299 
1300 	/*
1301 	 * The purpose of this is to avoid racing with session shutdown.
1302 	 * Otherwise we could have the maintenance thread call icl_conn_close()
1303 	 * before we call icl_conn_handoff().
1304 	 */
1305 	cs->cs_handoff_in_progress = true;
1306 
1307 	cs->cs_conn = icl_new_conn(offload, false, "cfiscsi", &cs->cs_lock);
1308 	if (cs->cs_conn == NULL) {
1309 		free(cs, M_CFISCSI);
1310 		return (NULL);
1311 	}
1312 	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1313 	cs->cs_conn->ic_error = cfiscsi_error_callback;
1314 	cs->cs_conn->ic_prv0 = cs;
1315 
1316 	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1317 	if (error != 0) {
1318 		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1319 		free(cs, M_CFISCSI);
1320 		return (NULL);
1321 	}
1322 
1323 	mtx_lock(&softc->lock);
1324 	cs->cs_id = ++softc->last_session_id;
1325 	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1326 	mtx_unlock(&softc->lock);
1327 
1328 	/*
1329 	 * Start pinging the initiator.
1330 	 */
1331 	callout_init(&cs->cs_callout, 1);
1332 	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1333 
1334 	return (cs);
1335 }
1336 
1337 static void
1338 cfiscsi_session_delete(struct cfiscsi_session *cs)
1339 {
1340 	struct cfiscsi_softc *softc;
1341 
1342 	softc = &cfiscsi_softc;
1343 
1344 	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1345 	    ("destroying session with outstanding CTL pdus"));
1346 	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1347 	    ("destroying session with non-empty queue"));
1348 
1349 	mtx_lock(&softc->lock);
1350 	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1351 	mtx_unlock(&softc->lock);
1352 
1353 	cfiscsi_session_unregister_initiator(cs);
1354 	if (cs->cs_target != NULL)
1355 		cfiscsi_target_release(cs->cs_target);
1356 	icl_conn_close(cs->cs_conn);
1357 	icl_conn_free(cs->cs_conn);
1358 	free(cs, M_CFISCSI);
1359 	cv_signal(&softc->sessions_cv);
1360 }
1361 
1362 static int
1363 cfiscsi_init(void)
1364 {
1365 	struct cfiscsi_softc *softc;
1366 
1367 	softc = &cfiscsi_softc;
1368 	bzero(softc, sizeof(*softc));
1369 	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1370 
1371 	cv_init(&softc->sessions_cv, "cfiscsi_sessions");
1372 #ifdef ICL_KERNEL_PROXY
1373 	cv_init(&softc->accept_cv, "cfiscsi_accept");
1374 #endif
1375 	TAILQ_INIT(&softc->sessions);
1376 	TAILQ_INIT(&softc->targets);
1377 
1378 	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1379 	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1380 	    UMA_ALIGN_PTR, 0);
1381 
1382 	return (0);
1383 }
1384 
1385 static int
1386 cfiscsi_shutdown(void)
1387 {
1388 	struct cfiscsi_softc *softc = &cfiscsi_softc;
1389 
1390 	if (!TAILQ_EMPTY(&softc->sessions) || !TAILQ_EMPTY(&softc->targets))
1391 		return (EBUSY);
1392 
1393 	uma_zdestroy(cfiscsi_data_wait_zone);
1394 #ifdef ICL_KERNEL_PROXY
1395 	cv_destroy(&softc->accept_cv);
1396 #endif
1397 	cv_destroy(&softc->sessions_cv);
1398 	mtx_destroy(&softc->lock);
1399 	return (0);
1400 }
1401 
1402 #ifdef ICL_KERNEL_PROXY
1403 static void
1404 cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1405 {
1406 	struct cfiscsi_session *cs;
1407 
1408 	cs = cfiscsi_session_new(&cfiscsi_softc, NULL);
1409 	if (cs == NULL) {
1410 		CFISCSI_WARN("failed to create session");
1411 		return;
1412 	}
1413 
1414 	icl_conn_handoff_sock(cs->cs_conn, so);
1415 	cs->cs_initiator_sa = sa;
1416 	cs->cs_portal_id = portal_id;
1417 	cs->cs_handoff_in_progress = false;
1418 	cs->cs_waiting_for_ctld = true;
1419 	cv_signal(&cfiscsi_softc.accept_cv);
1420 
1421 	CFISCSI_SESSION_LOCK(cs);
1422 	/*
1423 	 * Wake up the maintenance thread if we got scheduled for termination
1424 	 * somewhere between cfiscsi_session_new() and icl_conn_handoff_sock().
1425 	 */
1426 	if (cs->cs_terminating)
1427 		cfiscsi_session_terminate(cs);
1428 	CFISCSI_SESSION_UNLOCK(cs);
1429 }
1430 #endif
1431 
1432 static void
1433 cfiscsi_online(void *arg)
1434 {
1435 	struct cfiscsi_softc *softc;
1436 	struct cfiscsi_target *ct;
1437 	int online;
1438 
1439 	ct = (struct cfiscsi_target *)arg;
1440 	softc = ct->ct_softc;
1441 
1442 	mtx_lock(&softc->lock);
1443 	if (ct->ct_online) {
1444 		mtx_unlock(&softc->lock);
1445 		return;
1446 	}
1447 	ct->ct_online = 1;
1448 	online = softc->online++;
1449 	mtx_unlock(&softc->lock);
1450 	if (online > 0)
1451 		return;
1452 
1453 #ifdef ICL_KERNEL_PROXY
1454 	if (softc->listener != NULL)
1455 		icl_listen_free(softc->listener);
1456 	softc->listener = icl_listen_new(cfiscsi_accept);
1457 #endif
1458 }
1459 
1460 static void
1461 cfiscsi_offline(void *arg)
1462 {
1463 	struct cfiscsi_softc *softc;
1464 	struct cfiscsi_target *ct;
1465 	struct cfiscsi_session *cs;
1466 	int error, online;
1467 
1468 	ct = (struct cfiscsi_target *)arg;
1469 	softc = ct->ct_softc;
1470 
1471 	mtx_lock(&softc->lock);
1472 	if (!ct->ct_online) {
1473 		mtx_unlock(&softc->lock);
1474 		return;
1475 	}
1476 	ct->ct_online = 0;
1477 	online = --softc->online;
1478 
1479 	do {
1480 		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1481 			if (cs->cs_target == ct)
1482 				cfiscsi_session_terminate(cs);
1483 		}
1484 		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1485 			if (cs->cs_target == ct)
1486 				break;
1487 		}
1488 		if (cs != NULL) {
1489 			error = cv_wait_sig(&softc->sessions_cv, &softc->lock);
1490 			if (error != 0) {
1491 				CFISCSI_SESSION_DEBUG(cs,
1492 				    "cv_wait failed with error %d\n", error);
1493 				break;
1494 			}
1495 		}
1496 	} while (cs != NULL && ct->ct_online == 0);
1497 	mtx_unlock(&softc->lock);
1498 	if (online > 0)
1499 		return;
1500 
1501 #ifdef ICL_KERNEL_PROXY
1502 	icl_listen_free(softc->listener);
1503 	softc->listener = NULL;
1504 #endif
1505 }
1506 
1507 static int
1508 cfiscsi_info(void *arg, struct sbuf *sb)
1509 {
1510 	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1511 	int retval;
1512 
1513 	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1514 	    ct->ct_state);
1515 	return (retval);
1516 }
1517 
1518 static void
1519 cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1520 {
1521 	struct cfiscsi_softc *softc;
1522 	struct cfiscsi_session *cs, *cs2;
1523 	struct cfiscsi_target *ct;
1524 	struct ctl_iscsi_handoff_params *cihp;
1525 	int error;
1526 
1527 	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1528 	softc = &cfiscsi_softc;
1529 
1530 	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1531 	    cihp->initiator_name, cihp->initiator_addr,
1532 	    cihp->target_name);
1533 
1534 	ct = cfiscsi_target_find(softc, cihp->target_name,
1535 	    cihp->portal_group_tag);
1536 	if (ct == NULL) {
1537 		ci->status = CTL_ISCSI_ERROR;
1538 		snprintf(ci->error_str, sizeof(ci->error_str),
1539 		    "%s: target not found", __func__);
1540 		return;
1541 	}
1542 
1543 #ifdef ICL_KERNEL_PROXY
1544 	if (cihp->socket > 0 && cihp->connection_id > 0) {
1545 		snprintf(ci->error_str, sizeof(ci->error_str),
1546 		    "both socket and connection_id set");
1547 		ci->status = CTL_ISCSI_ERROR;
1548 		cfiscsi_target_release(ct);
1549 		return;
1550 	}
1551 	if (cihp->socket == 0) {
1552 		mtx_lock(&cfiscsi_softc.lock);
1553 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1554 			if (cs->cs_id == cihp->connection_id)
1555 				break;
1556 		}
1557 		if (cs == NULL) {
1558 			mtx_unlock(&cfiscsi_softc.lock);
1559 			snprintf(ci->error_str, sizeof(ci->error_str),
1560 			    "connection not found");
1561 			ci->status = CTL_ISCSI_ERROR;
1562 			cfiscsi_target_release(ct);
1563 			return;
1564 		}
1565 		mtx_unlock(&cfiscsi_softc.lock);
1566 	} else {
1567 #endif
1568 		cs = cfiscsi_session_new(softc, cihp->offload);
1569 		if (cs == NULL) {
1570 			ci->status = CTL_ISCSI_ERROR;
1571 			snprintf(ci->error_str, sizeof(ci->error_str),
1572 			    "%s: cfiscsi_session_new failed", __func__);
1573 			cfiscsi_target_release(ct);
1574 			return;
1575 		}
1576 #ifdef ICL_KERNEL_PROXY
1577 	}
1578 #endif
1579 
1580 	/*
1581 	 * First PDU of Full Feature phase has the same CmdSN as the last
1582 	 * PDU from the Login Phase received from the initiator.  Thus,
1583 	 * the -1 below.
1584 	 */
1585 	cs->cs_cmdsn = cihp->cmdsn;
1586 	cs->cs_statsn = cihp->statsn;
1587 	cs->cs_conn->ic_max_recv_data_segment_length =
1588 	    cihp->max_recv_data_segment_length;
1589 	cs->cs_conn->ic_max_send_data_segment_length =
1590 	    cihp->max_send_data_segment_length;
1591 	cs->cs_max_burst_length = cihp->max_burst_length;
1592 	cs->cs_first_burst_length = cihp->first_burst_length;
1593 	cs->cs_immediate_data = !!cihp->immediate_data;
1594 	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1595 		cs->cs_conn->ic_header_crc32c = true;
1596 	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1597 		cs->cs_conn->ic_data_crc32c = true;
1598 
1599 	strlcpy(cs->cs_initiator_name,
1600 	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1601 	strlcpy(cs->cs_initiator_addr,
1602 	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1603 	strlcpy(cs->cs_initiator_alias,
1604 	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1605 	memcpy(cs->cs_initiator_isid,
1606 	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1607 	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1608 	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1609 	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1610 	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1611 	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1612 
1613 	mtx_lock(&softc->lock);
1614 	if (ct->ct_online == 0) {
1615 		mtx_unlock(&softc->lock);
1616 		CFISCSI_SESSION_LOCK(cs);
1617 		cs->cs_handoff_in_progress = false;
1618 		cfiscsi_session_terminate(cs);
1619 		CFISCSI_SESSION_UNLOCK(cs);
1620 		cfiscsi_target_release(ct);
1621 		ci->status = CTL_ISCSI_ERROR;
1622 		snprintf(ci->error_str, sizeof(ci->error_str),
1623 		    "%s: port offline", __func__);
1624 		return;
1625 	}
1626 	cs->cs_target = ct;
1627 	mtx_unlock(&softc->lock);
1628 
1629 restart:
1630 	if (!cs->cs_terminating) {
1631 		mtx_lock(&softc->lock);
1632 		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1633 			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1634 			    cs->cs_target == cs2->cs_target &&
1635 			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1636 				if (strcmp(cs->cs_initiator_addr,
1637 				    cs2->cs_initiator_addr) != 0) {
1638 					CFISCSI_SESSION_WARN(cs2,
1639 					    "session reinstatement from "
1640 					    "different address %s",
1641 					    cs->cs_initiator_addr);
1642 				} else {
1643 					CFISCSI_SESSION_DEBUG(cs2,
1644 					    "session reinstatement");
1645 				}
1646 				cfiscsi_session_terminate(cs2);
1647 				mtx_unlock(&softc->lock);
1648 				pause("cfiscsi_reinstate", 1);
1649 				goto restart;
1650 			}
1651 		}
1652 		mtx_unlock(&softc->lock);
1653 	}
1654 
1655 	/*
1656 	 * Register initiator with CTL.
1657 	 */
1658 	cfiscsi_session_register_initiator(cs);
1659 
1660 #ifdef ICL_KERNEL_PROXY
1661 	if (cihp->socket > 0) {
1662 #endif
1663 		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1664 		if (error != 0) {
1665 			CFISCSI_SESSION_LOCK(cs);
1666 			cs->cs_handoff_in_progress = false;
1667 			cfiscsi_session_terminate(cs);
1668 			CFISCSI_SESSION_UNLOCK(cs);
1669 			ci->status = CTL_ISCSI_ERROR;
1670 			snprintf(ci->error_str, sizeof(ci->error_str),
1671 			    "%s: icl_conn_handoff failed with error %d",
1672 			    __func__, error);
1673 			return;
1674 		}
1675 #ifdef ICL_KERNEL_PROXY
1676 	}
1677 #endif
1678 
1679 #ifdef ICL_KERNEL_PROXY
1680 	cs->cs_login_phase = false;
1681 
1682 	/*
1683 	 * First PDU of the Full Feature phase has likely already arrived.
1684 	 * We have to pick it up and execute properly.
1685 	 */
1686 	if (cs->cs_login_pdu != NULL) {
1687 		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1688 		cfiscsi_pdu_handle(cs->cs_login_pdu);
1689 		cs->cs_login_pdu = NULL;
1690 	}
1691 #endif
1692 
1693 	CFISCSI_SESSION_LOCK(cs);
1694 	cs->cs_handoff_in_progress = false;
1695 
1696 	/*
1697 	 * Wake up the maintenance thread if we got scheduled for termination.
1698 	 */
1699 	if (cs->cs_terminating)
1700 		cfiscsi_session_terminate(cs);
1701 	CFISCSI_SESSION_UNLOCK(cs);
1702 
1703 	ci->status = CTL_ISCSI_OK;
1704 }
1705 
1706 static void
1707 cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1708 {
1709 	struct ctl_iscsi_list_params *cilp;
1710 	struct cfiscsi_session *cs;
1711 	struct cfiscsi_softc *softc;
1712 	struct sbuf *sb;
1713 	int error;
1714 
1715 	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1716 	softc = &cfiscsi_softc;
1717 
1718 	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1719 	if (sb == NULL) {
1720 		ci->status = CTL_ISCSI_ERROR;
1721 		snprintf(ci->error_str, sizeof(ci->error_str),
1722 		    "Unable to allocate %d bytes for iSCSI session list",
1723 		    cilp->alloc_len);
1724 		return;
1725 	}
1726 
1727 	sbuf_printf(sb, "<ctlislist>\n");
1728 	mtx_lock(&softc->lock);
1729 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1730 		if (cs->cs_target == NULL)
1731 			continue;
1732 		error = sbuf_printf(sb, "<connection id=\"%d\">"
1733 		    "<initiator>%s</initiator>"
1734 		    "<initiator_addr>%s</initiator_addr>"
1735 		    "<initiator_alias>%s</initiator_alias>"
1736 		    "<target>%s</target>"
1737 		    "<target_alias>%s</target_alias>"
1738 		    "<target_portal_group_tag>%u</target_portal_group_tag>"
1739 		    "<header_digest>%s</header_digest>"
1740 		    "<data_digest>%s</data_digest>"
1741 		    "<max_recv_data_segment_length>%d</max_recv_data_segment_length>"
1742 		    "<max_send_data_segment_length>%d</max_send_data_segment_length>"
1743 		    "<max_burst_length>%d</max_burst_length>"
1744 		    "<first_burst_length>%d</first_burst_length>"
1745 		    "<immediate_data>%d</immediate_data>"
1746 		    "<iser>%d</iser>"
1747 		    "<offload>%s</offload>"
1748 		    "</connection>\n",
1749 		    cs->cs_id,
1750 		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1751 		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1752 		    cs->cs_target->ct_tag,
1753 		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1754 		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1755 		    cs->cs_conn->ic_max_recv_data_segment_length,
1756 		    cs->cs_conn->ic_max_send_data_segment_length,
1757 		    cs->cs_max_burst_length,
1758 		    cs->cs_first_burst_length,
1759 		    cs->cs_immediate_data,
1760 		    cs->cs_conn->ic_iser,
1761 		    cs->cs_conn->ic_offload);
1762 		if (error != 0)
1763 			break;
1764 	}
1765 	mtx_unlock(&softc->lock);
1766 	error = sbuf_printf(sb, "</ctlislist>\n");
1767 	if (error != 0) {
1768 		sbuf_delete(sb);
1769 		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1770 		snprintf(ci->error_str, sizeof(ci->error_str),
1771 		    "Out of space, %d bytes is too small", cilp->alloc_len);
1772 		return;
1773 	}
1774 	sbuf_finish(sb);
1775 
1776 	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1777 	if (error != 0) {
1778 		sbuf_delete(sb);
1779 		snprintf(ci->error_str, sizeof(ci->error_str),
1780 		    "copyout failed with error %d", error);
1781 		ci->status = CTL_ISCSI_ERROR;
1782 		return;
1783 	}
1784 	cilp->fill_len = sbuf_len(sb) + 1;
1785 	ci->status = CTL_ISCSI_OK;
1786 	sbuf_delete(sb);
1787 }
1788 
1789 static void
1790 cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1791 {
1792 	struct icl_pdu *response;
1793 	struct iscsi_bhs_asynchronous_message *bhsam;
1794 	struct ctl_iscsi_logout_params *cilp;
1795 	struct cfiscsi_session *cs;
1796 	struct cfiscsi_softc *softc;
1797 	int found = 0;
1798 
1799 	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1800 	softc = &cfiscsi_softc;
1801 
1802 	mtx_lock(&softc->lock);
1803 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1804 		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1805 		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1806 		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1807 			continue;
1808 
1809 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1810 		if (response == NULL) {
1811 			ci->status = CTL_ISCSI_ERROR;
1812 			snprintf(ci->error_str, sizeof(ci->error_str),
1813 			    "Unable to allocate memory");
1814 			mtx_unlock(&softc->lock);
1815 			return;
1816 		}
1817 		bhsam =
1818 		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1819 		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1820 		bhsam->bhsam_flags = 0x80;
1821 		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1822 		bhsam->bhsam_parameter3 = htons(10);
1823 		cfiscsi_pdu_queue(response);
1824 		found++;
1825 	}
1826 	mtx_unlock(&softc->lock);
1827 
1828 	if (found == 0) {
1829 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1830 		snprintf(ci->error_str, sizeof(ci->error_str),
1831 		    "No matching connections found");
1832 		return;
1833 	}
1834 
1835 	ci->status = CTL_ISCSI_OK;
1836 }
1837 
1838 static void
1839 cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1840 {
1841 	struct icl_pdu *response;
1842 	struct iscsi_bhs_asynchronous_message *bhsam;
1843 	struct ctl_iscsi_terminate_params *citp;
1844 	struct cfiscsi_session *cs;
1845 	struct cfiscsi_softc *softc;
1846 	int found = 0;
1847 
1848 	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1849 	softc = &cfiscsi_softc;
1850 
1851 	mtx_lock(&softc->lock);
1852 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1853 		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1854 		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1855 		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1856 			continue;
1857 
1858 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1859 		if (response == NULL) {
1860 			/*
1861 			 * Oh well.  Just terminate the connection.
1862 			 */
1863 		} else {
1864 			bhsam = (struct iscsi_bhs_asynchronous_message *)
1865 			    response->ip_bhs;
1866 			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1867 			bhsam->bhsam_flags = 0x80;
1868 			bhsam->bhsam_0xffffffff = 0xffffffff;
1869 			bhsam->bhsam_async_event =
1870 			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1871 			cfiscsi_pdu_queue(response);
1872 		}
1873 		cfiscsi_session_terminate(cs);
1874 		found++;
1875 	}
1876 	mtx_unlock(&softc->lock);
1877 
1878 	if (found == 0) {
1879 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1880 		snprintf(ci->error_str, sizeof(ci->error_str),
1881 		    "No matching connections found");
1882 		return;
1883 	}
1884 
1885 	ci->status = CTL_ISCSI_OK;
1886 }
1887 
1888 static void
1889 cfiscsi_ioctl_limits(struct ctl_iscsi *ci)
1890 {
1891 	struct ctl_iscsi_limits_params *cilp;
1892 	struct icl_drv_limits idl;
1893 	int error;
1894 
1895 	cilp = (struct ctl_iscsi_limits_params *)&(ci->data);
1896 
1897 	error = icl_limits(cilp->offload, false, cilp->socket, &idl);
1898 	if (error != 0) {
1899 		ci->status = CTL_ISCSI_ERROR;
1900 		snprintf(ci->error_str, sizeof(ci->error_str),
1901 			"%s: icl_limits failed with error %d",
1902 			__func__, error);
1903 		return;
1904 	}
1905 
1906 	cilp->max_recv_data_segment_length =
1907 	    idl.idl_max_recv_data_segment_length;
1908 	cilp->max_send_data_segment_length =
1909 	    idl.idl_max_send_data_segment_length;
1910 	cilp->max_burst_length = idl.idl_max_burst_length;
1911 	cilp->first_burst_length = idl.idl_first_burst_length;
1912 
1913 	ci->status = CTL_ISCSI_OK;
1914 }
1915 
1916 #ifdef ICL_KERNEL_PROXY
1917 static void
1918 cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1919 {
1920 	struct ctl_iscsi_listen_params *cilp;
1921 	struct sockaddr *sa;
1922 	int error;
1923 
1924 	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1925 
1926 	if (cfiscsi_softc.listener == NULL) {
1927 		CFISCSI_DEBUG("no listener");
1928 		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1929 		ci->status = CTL_ISCSI_ERROR;
1930 		return;
1931 	}
1932 
1933 	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1934 	if (error != 0) {
1935 		CFISCSI_DEBUG("getsockaddr, error %d", error);
1936 		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1937 		ci->status = CTL_ISCSI_ERROR;
1938 		return;
1939 	}
1940 
1941 	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1942 	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1943 	if (error != 0) {
1944 		free(sa, M_SONAME);
1945 		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1946 		snprintf(ci->error_str, sizeof(ci->error_str),
1947 		    "icl_listen_add failed, error %d", error);
1948 		ci->status = CTL_ISCSI_ERROR;
1949 		return;
1950 	}
1951 
1952 	ci->status = CTL_ISCSI_OK;
1953 }
1954 
1955 static void
1956 cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1957 {
1958 	struct ctl_iscsi_accept_params *ciap;
1959 	struct cfiscsi_session *cs;
1960 	int error;
1961 
1962 	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1963 
1964 	mtx_lock(&cfiscsi_softc.lock);
1965 	for (;;) {
1966 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1967 			if (cs->cs_waiting_for_ctld)
1968 				break;
1969 		}
1970 		if (cs != NULL)
1971 			break;
1972 		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1973 		if (error != 0) {
1974 			mtx_unlock(&cfiscsi_softc.lock);
1975 			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1976 			ci->status = CTL_ISCSI_ERROR;
1977 			return;
1978 		}
1979 	}
1980 	mtx_unlock(&cfiscsi_softc.lock);
1981 
1982 	cs->cs_waiting_for_ctld = false;
1983 	cs->cs_login_phase = true;
1984 
1985 	ciap->connection_id = cs->cs_id;
1986 	ciap->portal_id = cs->cs_portal_id;
1987 	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1988 	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1989 	    cs->cs_initiator_sa->sa_len);
1990 	if (error != 0) {
1991 		snprintf(ci->error_str, sizeof(ci->error_str),
1992 		    "copyout failed with error %d", error);
1993 		ci->status = CTL_ISCSI_ERROR;
1994 		return;
1995 	}
1996 
1997 	ci->status = CTL_ISCSI_OK;
1998 }
1999 
2000 static void
2001 cfiscsi_ioctl_send(struct ctl_iscsi *ci)
2002 {
2003 	struct ctl_iscsi_send_params *cisp;
2004 	struct cfiscsi_session *cs;
2005 	struct icl_pdu *ip;
2006 	size_t datalen;
2007 	void *data;
2008 	int error;
2009 
2010 	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
2011 
2012 	mtx_lock(&cfiscsi_softc.lock);
2013 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
2014 		if (cs->cs_id == cisp->connection_id)
2015 			break;
2016 	}
2017 	if (cs == NULL) {
2018 		mtx_unlock(&cfiscsi_softc.lock);
2019 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
2020 		ci->status = CTL_ISCSI_ERROR;
2021 		return;
2022 	}
2023 	mtx_unlock(&cfiscsi_softc.lock);
2024 
2025 #if 0
2026 	if (cs->cs_login_phase == false)
2027 		return (EBUSY);
2028 #endif
2029 
2030 	if (cs->cs_terminating) {
2031 		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
2032 		ci->status = CTL_ISCSI_ERROR;
2033 		return;
2034 	}
2035 
2036 	datalen = cisp->data_segment_len;
2037 	/*
2038 	 * XXX
2039 	 */
2040 	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
2041 	if (datalen > 65535) {
2042 		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
2043 		ci->status = CTL_ISCSI_ERROR;
2044 		return;
2045 	}
2046 	if (datalen > 0) {
2047 		data = malloc(datalen, M_CFISCSI, M_WAITOK);
2048 		error = copyin(cisp->data_segment, data, datalen);
2049 		if (error != 0) {
2050 			free(data, M_CFISCSI);
2051 			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
2052 			ci->status = CTL_ISCSI_ERROR;
2053 			return;
2054 		}
2055 	}
2056 
2057 	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
2058 	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
2059 	if (datalen > 0) {
2060 		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
2061 		free(data, M_CFISCSI);
2062 	}
2063 	CFISCSI_SESSION_LOCK(cs);
2064 	icl_pdu_queue(ip);
2065 	CFISCSI_SESSION_UNLOCK(cs);
2066 	ci->status = CTL_ISCSI_OK;
2067 }
2068 
2069 static void
2070 cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
2071 {
2072 	struct ctl_iscsi_receive_params *cirp;
2073 	struct cfiscsi_session *cs;
2074 	struct icl_pdu *ip;
2075 	void *data;
2076 	int error;
2077 
2078 	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
2079 
2080 	mtx_lock(&cfiscsi_softc.lock);
2081 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
2082 		if (cs->cs_id == cirp->connection_id)
2083 			break;
2084 	}
2085 	if (cs == NULL) {
2086 		mtx_unlock(&cfiscsi_softc.lock);
2087 		snprintf(ci->error_str, sizeof(ci->error_str),
2088 		    "connection not found");
2089 		ci->status = CTL_ISCSI_ERROR;
2090 		return;
2091 	}
2092 	mtx_unlock(&cfiscsi_softc.lock);
2093 
2094 #if 0
2095 	if (is->is_login_phase == false)
2096 		return (EBUSY);
2097 #endif
2098 
2099 	CFISCSI_SESSION_LOCK(cs);
2100 	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
2101 		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
2102 		if (error != 0) {
2103 			CFISCSI_SESSION_UNLOCK(cs);
2104 			snprintf(ci->error_str, sizeof(ci->error_str),
2105 			    "interrupted by signal");
2106 			ci->status = CTL_ISCSI_ERROR;
2107 			return;
2108 		}
2109 	}
2110 
2111 	if (cs->cs_terminating) {
2112 		CFISCSI_SESSION_UNLOCK(cs);
2113 		snprintf(ci->error_str, sizeof(ci->error_str),
2114 		    "connection terminating");
2115 		ci->status = CTL_ISCSI_ERROR;
2116 		return;
2117 	}
2118 	ip = cs->cs_login_pdu;
2119 	cs->cs_login_pdu = NULL;
2120 	CFISCSI_SESSION_UNLOCK(cs);
2121 
2122 	if (ip->ip_data_len > cirp->data_segment_len) {
2123 		icl_pdu_free(ip);
2124 		snprintf(ci->error_str, sizeof(ci->error_str),
2125 		    "data segment too big");
2126 		ci->status = CTL_ISCSI_ERROR;
2127 		return;
2128 	}
2129 
2130 	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
2131 	if (ip->ip_data_len > 0) {
2132 		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
2133 		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
2134 		copyout(data, cirp->data_segment, ip->ip_data_len);
2135 		free(data, M_CFISCSI);
2136 	}
2137 
2138 	icl_pdu_free(ip);
2139 	ci->status = CTL_ISCSI_OK;
2140 }
2141 
2142 #endif /* !ICL_KERNEL_PROXY */
2143 
2144 static void
2145 cfiscsi_ioctl_port_create(struct ctl_req *req)
2146 {
2147 	struct cfiscsi_target *ct;
2148 	struct ctl_port *port;
2149 	const char *target, *alias, *val;
2150 	struct scsi_vpd_id_descriptor *desc;
2151 	int retval, len, idlen;
2152 	uint16_t tag;
2153 
2154 	target = dnvlist_get_string(req->args_nvl, "cfiscsi_target", NULL);
2155 	alias = dnvlist_get_string(req->args_nvl, "cfiscsi_target_alias", NULL);
2156 	val = dnvlist_get_string(req->args_nvl, "cfiscsi_portal_group_tag",
2157 	    NULL);
2158 
2159 	if (target == NULL || val == NULL) {
2160 		req->status = CTL_LUN_ERROR;
2161 		snprintf(req->error_str, sizeof(req->error_str),
2162 		    "Missing required argument");
2163 		return;
2164 	}
2165 
2166 	tag = strtoul(val, NULL, 0);
2167 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias, tag);
2168 	if (ct == NULL) {
2169 		req->status = CTL_LUN_ERROR;
2170 		snprintf(req->error_str, sizeof(req->error_str),
2171 		    "failed to create target \"%s\"", target);
2172 		return;
2173 	}
2174 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
2175 		req->status = CTL_LUN_ERROR;
2176 		snprintf(req->error_str, sizeof(req->error_str),
2177 		    "target \"%s\" for portal group tag %u already exists",
2178 		    target, tag);
2179 		cfiscsi_target_release(ct);
2180 		return;
2181 	}
2182 	port = &ct->ct_port;
2183 	// WAT
2184 	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
2185 		goto done;
2186 
2187 	port->frontend = &cfiscsi_frontend;
2188 	port->port_type = CTL_PORT_ISCSI;
2189 	/* XXX KDM what should the real number be here? */
2190 	port->num_requested_ctl_io = 4096;
2191 	port->port_name = "iscsi";
2192 	port->physical_port = (int)tag;
2193 	port->virtual_port = ct->ct_target_id;
2194 	port->port_online = cfiscsi_online;
2195 	port->port_offline = cfiscsi_offline;
2196 	port->port_info = cfiscsi_info;
2197 	port->onoff_arg = ct;
2198 	port->fe_datamove = cfiscsi_datamove;
2199 	port->fe_done = cfiscsi_done;
2200 	port->targ_port = -1;
2201 	port->options = nvlist_clone(req->args_nvl);
2202 
2203 	/* Generate Port ID. */
2204 	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2205 	idlen = roundup2(idlen, 4);
2206 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2207 	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2208 	    M_CTL, M_WAITOK | M_ZERO);
2209 	port->port_devid->len = len;
2210 	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2211 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2212 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2213 	    SVPD_ID_TYPE_SCSI_NAME;
2214 	desc->length = idlen;
2215 	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x", target, tag);
2216 
2217 	/* Generate Target ID. */
2218 	idlen = strlen(target) + 1;
2219 	idlen = roundup2(idlen, 4);
2220 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2221 	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2222 	    M_CTL, M_WAITOK | M_ZERO);
2223 	port->target_devid->len = len;
2224 	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2225 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2226 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2227 	    SVPD_ID_TYPE_SCSI_NAME;
2228 	desc->length = idlen;
2229 	strlcpy(desc->identifier, target, idlen);
2230 
2231 	retval = ctl_port_register(port);
2232 	if (retval != 0) {
2233 		free(port->port_devid, M_CFISCSI);
2234 		free(port->target_devid, M_CFISCSI);
2235 		cfiscsi_target_release(ct);
2236 		req->status = CTL_LUN_ERROR;
2237 		snprintf(req->error_str, sizeof(req->error_str),
2238 		    "ctl_port_register() failed with error %d", retval);
2239 		return;
2240 	}
2241 done:
2242 	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2243 	req->status = CTL_LUN_OK;
2244 	req->result_nvl = nvlist_create(0);
2245 	nvlist_add_number(req->result_nvl, "port_id", port->targ_port);
2246 }
2247 
2248 static void
2249 cfiscsi_ioctl_port_remove(struct ctl_req *req)
2250 {
2251 	struct cfiscsi_target *ct;
2252 	const char *target, *val;
2253 	uint16_t tag;
2254 
2255 	target = dnvlist_get_string(req->args_nvl, "cfiscsi_target", NULL);
2256 	val = dnvlist_get_string(req->args_nvl, "cfiscsi_portal_group_tag",
2257 	    NULL);
2258 
2259 	if (target == NULL || val == NULL) {
2260 		req->status = CTL_LUN_ERROR;
2261 		snprintf(req->error_str, sizeof(req->error_str),
2262 		    "Missing required argument");
2263 		return;
2264 	}
2265 
2266 	tag = strtoul(val, NULL, 0);
2267 	ct = cfiscsi_target_find(&cfiscsi_softc, target, tag);
2268 	if (ct == NULL) {
2269 		req->status = CTL_LUN_ERROR;
2270 		snprintf(req->error_str, sizeof(req->error_str),
2271 		    "can't find target \"%s\"", target);
2272 		return;
2273 	}
2274 
2275 	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2276 	ctl_port_offline(&ct->ct_port);
2277 	cfiscsi_target_release(ct);
2278 	cfiscsi_target_release(ct);
2279 	req->status = CTL_LUN_OK;
2280 }
2281 
2282 static int
2283 cfiscsi_ioctl(struct cdev *dev,
2284     u_long cmd, caddr_t addr, int flag, struct thread *td)
2285 {
2286 	struct ctl_iscsi *ci;
2287 	struct ctl_req *req;
2288 
2289 	if (cmd == CTL_PORT_REQ) {
2290 		req = (struct ctl_req *)addr;
2291 		switch (req->reqtype) {
2292 		case CTL_REQ_CREATE:
2293 			cfiscsi_ioctl_port_create(req);
2294 			break;
2295 		case CTL_REQ_REMOVE:
2296 			cfiscsi_ioctl_port_remove(req);
2297 			break;
2298 		default:
2299 			req->status = CTL_LUN_ERROR;
2300 			snprintf(req->error_str, sizeof(req->error_str),
2301 			    "Unsupported request type %d", req->reqtype);
2302 		}
2303 		return (0);
2304 	}
2305 
2306 	if (cmd != CTL_ISCSI)
2307 		return (ENOTTY);
2308 
2309 	ci = (struct ctl_iscsi *)addr;
2310 	switch (ci->type) {
2311 	case CTL_ISCSI_HANDOFF:
2312 		cfiscsi_ioctl_handoff(ci);
2313 		break;
2314 	case CTL_ISCSI_LIST:
2315 		cfiscsi_ioctl_list(ci);
2316 		break;
2317 	case CTL_ISCSI_LOGOUT:
2318 		cfiscsi_ioctl_logout(ci);
2319 		break;
2320 	case CTL_ISCSI_TERMINATE:
2321 		cfiscsi_ioctl_terminate(ci);
2322 		break;
2323 	case CTL_ISCSI_LIMITS:
2324 		cfiscsi_ioctl_limits(ci);
2325 		break;
2326 #ifdef ICL_KERNEL_PROXY
2327 	case CTL_ISCSI_LISTEN:
2328 		cfiscsi_ioctl_listen(ci);
2329 		break;
2330 	case CTL_ISCSI_ACCEPT:
2331 		cfiscsi_ioctl_accept(ci);
2332 		break;
2333 	case CTL_ISCSI_SEND:
2334 		cfiscsi_ioctl_send(ci);
2335 		break;
2336 	case CTL_ISCSI_RECEIVE:
2337 		cfiscsi_ioctl_receive(ci);
2338 		break;
2339 #else
2340 	case CTL_ISCSI_LISTEN:
2341 	case CTL_ISCSI_ACCEPT:
2342 	case CTL_ISCSI_SEND:
2343 	case CTL_ISCSI_RECEIVE:
2344 		ci->status = CTL_ISCSI_ERROR;
2345 		snprintf(ci->error_str, sizeof(ci->error_str),
2346 		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2347 		    __func__);
2348 		break;
2349 #endif /* !ICL_KERNEL_PROXY */
2350 	default:
2351 		ci->status = CTL_ISCSI_ERROR;
2352 		snprintf(ci->error_str, sizeof(ci->error_str),
2353 		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2354 		break;
2355 	}
2356 
2357 	return (0);
2358 }
2359 
2360 static void
2361 cfiscsi_target_hold(struct cfiscsi_target *ct)
2362 {
2363 
2364 	refcount_acquire(&ct->ct_refcount);
2365 }
2366 
2367 static void
2368 cfiscsi_target_release(struct cfiscsi_target *ct)
2369 {
2370 	struct cfiscsi_softc *softc;
2371 
2372 	softc = ct->ct_softc;
2373 	mtx_lock(&softc->lock);
2374 	if (refcount_release(&ct->ct_refcount)) {
2375 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2376 		mtx_unlock(&softc->lock);
2377 		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2378 			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2379 			if (ctl_port_deregister(&ct->ct_port) != 0)
2380 				printf("%s: ctl_port_deregister() failed\n",
2381 				    __func__);
2382 		}
2383 		free(ct, M_CFISCSI);
2384 
2385 		return;
2386 	}
2387 	mtx_unlock(&softc->lock);
2388 }
2389 
2390 static struct cfiscsi_target *
2391 cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name, uint16_t tag)
2392 {
2393 	struct cfiscsi_target *ct;
2394 
2395 	mtx_lock(&softc->lock);
2396 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2397 		if (ct->ct_tag != tag ||
2398 		    strcmp(name, ct->ct_name) != 0 ||
2399 		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2400 			continue;
2401 		cfiscsi_target_hold(ct);
2402 		mtx_unlock(&softc->lock);
2403 		return (ct);
2404 	}
2405 	mtx_unlock(&softc->lock);
2406 
2407 	return (NULL);
2408 }
2409 
2410 static struct cfiscsi_target *
2411 cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2412     const char *alias, uint16_t tag)
2413 {
2414 	struct cfiscsi_target *ct, *newct;
2415 
2416 	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2417 		return (NULL);
2418 
2419 	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2420 
2421 	mtx_lock(&softc->lock);
2422 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2423 		if (ct->ct_tag != tag ||
2424 		    strcmp(name, ct->ct_name) != 0 ||
2425 		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2426 			continue;
2427 		cfiscsi_target_hold(ct);
2428 		mtx_unlock(&softc->lock);
2429 		free(newct, M_CFISCSI);
2430 		return (ct);
2431 	}
2432 
2433 	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2434 	if (alias != NULL)
2435 		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2436 	newct->ct_tag = tag;
2437 	refcount_init(&newct->ct_refcount, 1);
2438 	newct->ct_softc = softc;
2439 	if (TAILQ_EMPTY(&softc->targets))
2440 		softc->last_target_id = 0;
2441 	newct->ct_target_id = ++softc->last_target_id;
2442 	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2443 	mtx_unlock(&softc->lock);
2444 
2445 	return (newct);
2446 }
2447 
2448 static void
2449 cfiscsi_pdu_done(struct icl_pdu *ip, int error)
2450 {
2451 
2452 	if (error != 0)
2453 		; // XXX: Do something on error?
2454 	((ctl_ref)ip->ip_prv0)(ip->ip_prv1, -1);
2455 }
2456 
2457 static void
2458 cfiscsi_datamove_in(union ctl_io *io)
2459 {
2460 	struct cfiscsi_session *cs;
2461 	struct icl_pdu *request, *response;
2462 	const struct iscsi_bhs_scsi_command *bhssc;
2463 	struct iscsi_bhs_data_in *bhsdi;
2464 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2465 	size_t len, expected_len, sg_len, buffer_offset;
2466 	size_t max_send_data_segment_length;
2467 	const char *sg_addr;
2468 	icl_pdu_cb cb;
2469 	int ctl_sg_count, error, i;
2470 
2471 	request = PRIV_REQUEST(io);
2472 	cs = PDU_SESSION(request);
2473 
2474 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2475 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2476 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2477 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2478 
2479 	if (io->scsiio.kern_sg_entries > 0) {
2480 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2481 		ctl_sg_count = io->scsiio.kern_sg_entries;
2482 	} else {
2483 		ctl_sglist = &ctl_sg_entry;
2484 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2485 		ctl_sglist->len = io->scsiio.kern_data_len;
2486 		ctl_sg_count = 1;
2487 	}
2488 
2489 	/*
2490 	 * This is the offset within the current SCSI command; for the first
2491 	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2492 	 * it will be the sum of lengths of previous ones.
2493 	 */
2494 	buffer_offset = io->scsiio.kern_rel_offset;
2495 
2496 	/*
2497 	 * This is the transfer length expected by the initiator.  It can be
2498 	 * different from the amount of data from the SCSI point of view.
2499 	 */
2500 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2501 
2502 	/*
2503 	 * If the transfer is outside of expected length -- we are done.
2504 	 */
2505 	if (buffer_offset >= expected_len) {
2506 #if 0
2507 		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2508 		    "already sent the expected len", buffer_offset);
2509 #endif
2510 		ctl_datamove_done(io, true);
2511 		return;
2512 	}
2513 
2514 	if (io->scsiio.kern_data_ref != NULL)
2515 		cb = cfiscsi_pdu_done;
2516 	else
2517 		cb = NULL;
2518 
2519 	i = 0;
2520 	sg_addr = NULL;
2521 	sg_len = 0;
2522 	response = NULL;
2523 	bhsdi = NULL;
2524 	if (cs->cs_conn->ic_hw_isomax != 0)
2525 		max_send_data_segment_length = cs->cs_conn->ic_hw_isomax;
2526 	else
2527 		max_send_data_segment_length =
2528 		    cs->cs_conn->ic_max_send_data_segment_length;
2529 	for (;;) {
2530 		if (response == NULL) {
2531 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2532 			if (response == NULL) {
2533 				CFISCSI_SESSION_WARN(cs, "failed to "
2534 				    "allocate memory; dropping connection");
2535 				ctl_set_busy(&io->scsiio);
2536 				ctl_datamove_done(io, true);
2537 				cfiscsi_session_terminate(cs);
2538 				return;
2539 			}
2540 			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2541 			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2542 			bhsdi->bhsdi_initiator_task_tag =
2543 			    bhssc->bhssc_initiator_task_tag;
2544 			bhsdi->bhsdi_target_transfer_tag = 0xffffffff;
2545 			bhsdi->bhsdi_datasn = htonl(PRIV_EXPDATASN(io));
2546 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2547 		}
2548 
2549 		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2550 		if (sg_len == 0) {
2551 			sg_addr = ctl_sglist[i].addr;
2552 			sg_len = ctl_sglist[i].len;
2553 			KASSERT(sg_len > 0, ("sg_len <= 0"));
2554 		}
2555 
2556 		len = sg_len;
2557 
2558 		/*
2559 		 * Truncate to maximum data segment length.
2560 		 */
2561 		KASSERT(response->ip_data_len < max_send_data_segment_length,
2562 		    ("ip_data_len %zd >= max_send_data_segment_length %zd",
2563 		    response->ip_data_len, max_send_data_segment_length));
2564 		if (response->ip_data_len + len > max_send_data_segment_length) {
2565 			len = max_send_data_segment_length - response->ip_data_len;
2566 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2567 			    len, sg_len));
2568 		}
2569 
2570 		/*
2571 		 * Truncate to expected data transfer length.
2572 		 */
2573 		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2574 		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2575 		    buffer_offset, response->ip_data_len, expected_len));
2576 		if (buffer_offset + response->ip_data_len + len > expected_len) {
2577 			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2578 			    "to expected data transfer length %zd",
2579 			    buffer_offset + response->ip_data_len + len, expected_len);
2580 			len = expected_len - (buffer_offset + response->ip_data_len);
2581 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2582 			    len, sg_len));
2583 		}
2584 
2585 		error = icl_pdu_append_data(response, sg_addr, len,
2586 		    M_NOWAIT | (cb ? ICL_NOCOPY : 0));
2587 		if (error != 0) {
2588 			CFISCSI_SESSION_WARN(cs, "failed to "
2589 			    "allocate memory; dropping connection");
2590 			icl_pdu_free(response);
2591 			ctl_set_busy(&io->scsiio);
2592 			ctl_datamove_done(io, true);
2593 			cfiscsi_session_terminate(cs);
2594 			return;
2595 		}
2596 		sg_addr += len;
2597 		sg_len -= len;
2598 		io->scsiio.kern_data_resid -= len;
2599 
2600 		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2601 		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2602 		    buffer_offset, response->ip_data_len, expected_len));
2603 		if (buffer_offset + response->ip_data_len == expected_len) {
2604 			/*
2605 			 * Already have the amount of data the initiator wanted.
2606 			 */
2607 			break;
2608 		}
2609 
2610 		if (sg_len == 0) {
2611 			/*
2612 			 * End of scatter-gather segment;
2613 			 * proceed to the next one...
2614 			 */
2615 			if (i == ctl_sg_count - 1) {
2616 				/*
2617 				 * ... unless this was the last one.
2618 				 */
2619 				break;
2620 			}
2621 			i++;
2622 		}
2623 
2624 		if (response->ip_data_len == max_send_data_segment_length) {
2625 			/*
2626 			 * Can't stuff more data into the current PDU;
2627 			 * queue it.  Note that's not enough to check
2628 			 * for kern_data_resid == 0 instead; there
2629 			 * may be several Data-In PDUs for the final
2630 			 * call to cfiscsi_datamove(), and we want
2631 			 * to set the F flag only on the last of them.
2632 			 */
2633 			buffer_offset += response->ip_data_len;
2634 			if (buffer_offset == io->scsiio.kern_total_len ||
2635 			    buffer_offset == expected_len) {
2636 				buffer_offset -= response->ip_data_len;
2637 				break;
2638 			}
2639 			PRIV_EXPDATASN(io) += howmany(response->ip_data_len,
2640 			    cs->cs_conn->ic_max_send_data_segment_length);
2641 			if (cb != NULL) {
2642 				response->ip_prv0 = io->scsiio.kern_data_ref;
2643 				response->ip_prv1 = io->scsiio.kern_data_arg;
2644 				io->scsiio.kern_data_ref(io->scsiio.kern_data_arg, 1);
2645 			}
2646 			cfiscsi_pdu_queue_cb(response, cb);
2647 			response = NULL;
2648 			bhsdi = NULL;
2649 		}
2650 	}
2651 	if (response != NULL) {
2652 		buffer_offset += response->ip_data_len;
2653 		if (buffer_offset == io->scsiio.kern_total_len ||
2654 		    buffer_offset == expected_len) {
2655 			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2656 			if (io->io_hdr.status == CTL_SUCCESS) {
2657 				bhsdi->bhsdi_flags |= BHSDI_FLAGS_S;
2658 				if (io->scsiio.kern_total_len <
2659 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2660 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2661 					bhsdi->bhsdi_residual_count =
2662 					    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2663 					    io->scsiio.kern_total_len);
2664 				} else if (io->scsiio.kern_total_len >
2665 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2666 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2667 					bhsdi->bhsdi_residual_count =
2668 					    htonl(io->scsiio.kern_total_len -
2669 					    ntohl(bhssc->bhssc_expected_data_transfer_length));
2670 				}
2671 				bhsdi->bhsdi_status = io->scsiio.scsi_status;
2672 				io->io_hdr.flags |= CTL_FLAG_STATUS_SENT;
2673 			}
2674 		}
2675 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2676 		PRIV_EXPDATASN(io) += howmany(response->ip_data_len,
2677 		    cs->cs_conn->ic_max_send_data_segment_length);
2678 		if (cb != NULL) {
2679 			response->ip_prv0 = io->scsiio.kern_data_ref;
2680 			response->ip_prv1 = io->scsiio.kern_data_arg;
2681 			io->scsiio.kern_data_ref(io->scsiio.kern_data_arg, 1);
2682 		}
2683 		cfiscsi_pdu_queue_cb(response, cb);
2684 	}
2685 
2686 	ctl_datamove_done(io, true);
2687 }
2688 
2689 static void
2690 cfiscsi_datamove_out(union ctl_io *io)
2691 {
2692 	struct cfiscsi_session *cs;
2693 	struct icl_pdu *request, *response;
2694 	const struct iscsi_bhs_scsi_command *bhssc;
2695 	struct iscsi_bhs_r2t *bhsr2t;
2696 	struct cfiscsi_data_wait *cdw;
2697 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2698 	uint32_t expected_len, datamove_len, r2t_off, r2t_len;
2699 	uint32_t target_transfer_tag;
2700 	bool done;
2701 
2702 	request = PRIV_REQUEST(io);
2703 	cs = PDU_SESSION(request);
2704 
2705 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2706 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2707 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2708 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2709 
2710 	/*
2711 	 * Complete write underflow.  Not a single byte to read.  Return.
2712 	 */
2713 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2714 	if (io->scsiio.kern_rel_offset >= expected_len) {
2715 		ctl_datamove_done(io, true);
2716 		return;
2717 	}
2718 
2719 	datamove_len = MIN(io->scsiio.kern_data_len,
2720 	    expected_len - io->scsiio.kern_rel_offset);
2721 
2722 	target_transfer_tag =
2723 	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2724 	if (target_transfer_tag == 0xffffffff) {
2725 		target_transfer_tag =
2726 		    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2727 	}
2728 	cdw = cfiscsi_data_wait_new(cs, io, bhssc->bhssc_initiator_task_tag,
2729 	    &target_transfer_tag);
2730 	if (cdw == NULL) {
2731 		CFISCSI_SESSION_WARN(cs, "failed to "
2732 		    "allocate memory; dropping connection");
2733 		ctl_set_busy(&io->scsiio);
2734 		ctl_datamove_done(io, true);
2735 		cfiscsi_session_terminate(cs);
2736 		return;
2737 	}
2738 #if 0
2739 	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2740 	    "task tag 0x%x, target transfer tag 0x%x",
2741 	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2742 #endif
2743 
2744 	cdw->cdw_ctl_io = io;
2745 	cdw->cdw_target_transfer_tag = target_transfer_tag;
2746 	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2747 	cdw->cdw_r2t_end = datamove_len;
2748 	cdw->cdw_datasn = 0;
2749 
2750 	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2751 	if (io->scsiio.kern_sg_entries > 0) {
2752 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2753 	} else {
2754 		ctl_sglist = &ctl_sg_entry;
2755 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2756 		ctl_sglist->len = datamove_len;
2757 	}
2758 	cdw->cdw_sg_index = 0;
2759 	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2760 	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2761 	r2t_off = io->scsiio.ext_data_filled;
2762 	while (r2t_off > 0) {
2763 		if (r2t_off >= cdw->cdw_sg_len) {
2764 			r2t_off -= cdw->cdw_sg_len;
2765 			cdw->cdw_sg_index++;
2766 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2767 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2768 			continue;
2769 		}
2770 		cdw->cdw_sg_addr += r2t_off;
2771 		cdw->cdw_sg_len -= r2t_off;
2772 		r2t_off = 0;
2773 	}
2774 
2775 	if (cs->cs_immediate_data &&
2776 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2777 	    icl_pdu_data_segment_length(request)) {
2778 		done = cfiscsi_handle_data_segment(request, cdw);
2779 		if (done) {
2780 			cfiscsi_data_wait_free(cs, cdw);
2781 			ctl_datamove_done(io, true);
2782 			return;
2783 		}
2784 	}
2785 
2786 	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2787 	r2t_len = MIN(datamove_len - io->scsiio.ext_data_filled,
2788 	    cs->cs_max_burst_length);
2789 	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2790 
2791 	CFISCSI_SESSION_LOCK(cs);
2792 	if (cs->cs_terminating_tasks) {
2793 		CFISCSI_SESSION_UNLOCK(cs);
2794 		KASSERT((io->io_hdr.flags & CTL_FLAG_ABORT) != 0,
2795 		    ("%s: I/O request %p on termating session %p not aborted",
2796 		    __func__, io, cs));
2797 		CFISCSI_SESSION_WARN(cs, "aborting data_wait for aborted I/O");
2798 		cfiscsi_data_wait_abort(cs, cdw, 44);
2799 		return;
2800 	}
2801 	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2802 	CFISCSI_SESSION_UNLOCK(cs);
2803 
2804 	/*
2805 	 * XXX: We should limit the number of outstanding R2T PDUs
2806 	 * 	per task to MaxOutstandingR2T.
2807 	 */
2808 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2809 	if (response == NULL) {
2810 		CFISCSI_SESSION_WARN(cs, "failed to "
2811 		    "allocate memory; dropping connection");
2812 		ctl_set_busy(&io->scsiio);
2813 		ctl_datamove_done(io, true);
2814 		cfiscsi_session_terminate(cs);
2815 		return;
2816 	}
2817 	io->io_hdr.flags |= CTL_FLAG_DMA_INPROG;
2818 	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2819 	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2820 	bhsr2t->bhsr2t_flags = 0x80;
2821 	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2822 	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2823 	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2824 	/*
2825 	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2826 	 *	be running concurrently on several CPUs for a given
2827 	 *	command.
2828 	 */
2829 	bhsr2t->bhsr2t_r2tsn = htonl(PRIV_R2TSN(io)++);
2830 	/*
2831 	 * This is the offset within the current SCSI command;
2832 	 * i.e. for the first call of datamove(), it will be 0,
2833 	 * and for subsequent ones it will be the sum of lengths
2834 	 * of previous ones.
2835 	 *
2836 	 * The ext_data_filled is to account for unsolicited
2837 	 * (immediate) data that might have already arrived.
2838 	 */
2839 	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2840 	/*
2841 	 * This is the total length (sum of S/G lengths) this call
2842 	 * to cfiscsi_datamove() is supposed to handle, limited by
2843 	 * MaxBurstLength.
2844 	 */
2845 	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2846 	cfiscsi_pdu_queue(response);
2847 }
2848 
2849 static void
2850 cfiscsi_datamove(union ctl_io *io)
2851 {
2852 
2853 	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2854 		cfiscsi_datamove_in(io);
2855 	else {
2856 		/* We hadn't received anything during this datamove yet. */
2857 		io->scsiio.ext_data_filled = 0;
2858 		cfiscsi_datamove_out(io);
2859 	}
2860 }
2861 
2862 static void
2863 cfiscsi_scsi_command_done(union ctl_io *io)
2864 {
2865 	struct icl_pdu *request, *response;
2866 	struct iscsi_bhs_scsi_command *bhssc;
2867 	struct iscsi_bhs_scsi_response *bhssr;
2868 #ifdef DIAGNOSTIC
2869 	struct cfiscsi_data_wait *cdw;
2870 	struct cfiscsi_session *cs;
2871 #endif
2872 	uint16_t sense_length;
2873 
2874 	request = PRIV_REQUEST(io);
2875 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2876 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2877 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2878 	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2879 
2880 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2881 	//    bhssc->bhssc_initiator_task_tag);
2882 
2883 #ifdef DIAGNOSTIC
2884 	cs = PDU_SESSION(request);
2885 	CFISCSI_SESSION_LOCK(cs);
2886 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2887 		KASSERT(bhssc->bhssc_initiator_task_tag !=
2888 		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2889 	CFISCSI_SESSION_UNLOCK(cs);
2890 #endif
2891 
2892 	/*
2893 	 * Do not return status for aborted commands.
2894 	 * There are exceptions, but none supported by CTL yet.
2895 	 */
2896 	if (((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2897 	     (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) ||
2898 	    (io->io_hdr.flags & CTL_FLAG_STATUS_SENT)) {
2899 		ctl_free_io(io);
2900 		icl_pdu_free(request);
2901 		return;
2902 	}
2903 
2904 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2905 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2906 	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2907 	bhssr->bhssr_flags = 0x80;
2908 	/*
2909 	 * XXX: We don't deal with bidirectional under/overflows;
2910 	 *	does anything actually support those?
2911 	 */
2912 	if (io->scsiio.kern_total_len <
2913 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2914 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2915 		bhssr->bhssr_residual_count =
2916 		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2917 		    io->scsiio.kern_total_len);
2918 		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2919 		//    ntohl(bhssr->bhssr_residual_count));
2920 	} else if (io->scsiio.kern_total_len >
2921 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2922 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2923 		bhssr->bhssr_residual_count = htonl(io->scsiio.kern_total_len -
2924 		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2925 		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2926 		//    ntohl(bhssr->bhssr_residual_count));
2927 	}
2928 	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2929 	bhssr->bhssr_status = io->scsiio.scsi_status;
2930 	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2931 	bhssr->bhssr_expdatasn = htonl(PRIV_EXPDATASN(io));
2932 
2933 	if (io->scsiio.sense_len > 0) {
2934 #if 0
2935 		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2936 		    io->scsiio.sense_len);
2937 #endif
2938 		sense_length = htons(io->scsiio.sense_len);
2939 		icl_pdu_append_data(response,
2940 		    &sense_length, sizeof(sense_length), M_WAITOK);
2941 		icl_pdu_append_data(response,
2942 		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2943 	}
2944 
2945 	ctl_free_io(io);
2946 	icl_pdu_free(request);
2947 	cfiscsi_pdu_queue(response);
2948 }
2949 
2950 static void
2951 cfiscsi_task_management_done(union ctl_io *io)
2952 {
2953 	struct icl_pdu *request, *response;
2954 	struct iscsi_bhs_task_management_request *bhstmr;
2955 	struct iscsi_bhs_task_management_response *bhstmr2;
2956 	struct cfiscsi_data_wait *cdw, *tmpcdw;
2957 	struct cfiscsi_session *cs, *tcs;
2958 	struct cfiscsi_softc *softc;
2959 	int cold_reset = 0;
2960 
2961 	request = PRIV_REQUEST(io);
2962 	cs = PDU_SESSION(request);
2963 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2964 	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2965 	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2966 	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2967 
2968 #if 0
2969 	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2970 	    bhstmr->bhstmr_initiator_task_tag,
2971 	    bhstmr->bhstmr_referenced_task_tag);
2972 #endif
2973 
2974 	if ((bhstmr->bhstmr_function & ~0x80) ==
2975 	    BHSTMR_FUNCTION_ABORT_TASK) {
2976 		/*
2977 		 * Make sure we no longer wait for Data-Out for this command.
2978 		 */
2979 		CFISCSI_SESSION_LOCK(cs);
2980 		TAILQ_FOREACH_SAFE(cdw,
2981 		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2982 			if (bhstmr->bhstmr_referenced_task_tag !=
2983 			    cdw->cdw_initiator_task_tag)
2984 				continue;
2985 
2986 #if 0
2987 			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2988 			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2989 #endif
2990 			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2991 			    cdw, cdw_next);
2992 			cfiscsi_data_wait_abort(cs, cdw, 43);
2993 		}
2994 		CFISCSI_SESSION_UNLOCK(cs);
2995 	}
2996 	if ((bhstmr->bhstmr_function & ~0x80) ==
2997 	    BHSTMR_FUNCTION_TARGET_COLD_RESET &&
2998 	    io->io_hdr.status == CTL_SUCCESS)
2999 		cold_reset = 1;
3000 
3001 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
3002 	bhstmr2 = (struct iscsi_bhs_task_management_response *)
3003 	    response->ip_bhs;
3004 	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
3005 	bhstmr2->bhstmr_flags = 0x80;
3006 	switch (io->taskio.task_status) {
3007 	case CTL_TASK_FUNCTION_COMPLETE:
3008 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
3009 		break;
3010 	case CTL_TASK_FUNCTION_SUCCEEDED:
3011 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_SUCCEEDED;
3012 		break;
3013 	case CTL_TASK_LUN_DOES_NOT_EXIST:
3014 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_LUN_DOES_NOT_EXIST;
3015 		break;
3016 	case CTL_TASK_FUNCTION_NOT_SUPPORTED:
3017 	default:
3018 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
3019 		break;
3020 	}
3021 	memcpy(bhstmr2->bhstmr_additional_reponse_information,
3022 	    io->taskio.task_resp, sizeof(io->taskio.task_resp));
3023 	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
3024 
3025 	ctl_free_io(io);
3026 	icl_pdu_free(request);
3027 	cfiscsi_pdu_queue(response);
3028 
3029 	if (cold_reset) {
3030 		softc = cs->cs_target->ct_softc;
3031 		mtx_lock(&softc->lock);
3032 		TAILQ_FOREACH(tcs, &softc->sessions, cs_next) {
3033 			if (tcs->cs_target == cs->cs_target)
3034 				cfiscsi_session_terminate(tcs);
3035 		}
3036 		mtx_unlock(&softc->lock);
3037 	}
3038 }
3039 
3040 static void
3041 cfiscsi_done(union ctl_io *io)
3042 {
3043 	struct icl_pdu *request;
3044 	struct cfiscsi_session *cs;
3045 
3046 	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
3047 		("invalid CTL status %#x", io->io_hdr.status));
3048 
3049 	request = PRIV_REQUEST(io);
3050 	cs = PDU_SESSION(request);
3051 
3052 	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
3053 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
3054 		cfiscsi_scsi_command_done(io);
3055 		break;
3056 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
3057 		cfiscsi_task_management_done(io);
3058 		break;
3059 	case ISCSI_BHS_OPCODE_INTERNAL:
3060 		/*
3061 		 * Implicit task termination has just completed; nothing to do.
3062 		 */
3063 		icl_pdu_free(request);
3064 		cs->cs_tasks_aborted = true;
3065 		refcount_release(&cs->cs_outstanding_ctl_pdus);
3066 		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
3067 		ctl_free_io(io);
3068 		return;
3069 	default:
3070 		panic("cfiscsi_done called with wrong opcode 0x%x",
3071 		    request->ip_bhs->bhs_opcode);
3072 	}
3073 
3074 	refcount_release(&cs->cs_outstanding_ctl_pdus);
3075 }
3076