xref: /freebsd/sys/cam/ctl/ctl_frontend_iscsi.c (revision b78ee15e9f04ae15c3e1200df974473167524d17)
1 /*-
2  * Copyright (c) 2012 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Edward Tomasz Napierala under sponsorship
6  * from the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * CTL frontend for the iSCSI protocol.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/capsicum.h>
41 #include <sys/condvar.h>
42 #include <sys/file.h>
43 #include <sys/kernel.h>
44 #include <sys/kthread.h>
45 #include <sys/lock.h>
46 #include <sys/malloc.h>
47 #include <sys/module.h>
48 #include <sys/mutex.h>
49 #include <sys/queue.h>
50 #include <sys/sbuf.h>
51 #include <sys/sysctl.h>
52 #include <sys/systm.h>
53 #include <sys/uio.h>
54 #include <sys/unistd.h>
55 #include <vm/uma.h>
56 
57 #include <cam/scsi/scsi_all.h>
58 #include <cam/scsi/scsi_da.h>
59 #include <cam/ctl/ctl_io.h>
60 #include <cam/ctl/ctl.h>
61 #include <cam/ctl/ctl_backend.h>
62 #include <cam/ctl/ctl_error.h>
63 #include <cam/ctl/ctl_frontend.h>
64 #include <cam/ctl/ctl_frontend_internal.h>
65 #include <cam/ctl/ctl_debug.h>
66 #include <cam/ctl/ctl_ha.h>
67 #include <cam/ctl/ctl_ioctl.h>
68 #include <cam/ctl/ctl_private.h>
69 
70 #include <dev/iscsi/icl.h>
71 #include <dev/iscsi/icl_wrappers.h>
72 #include <dev/iscsi/iscsi_proto.h>
73 #include <cam/ctl/ctl_frontend_iscsi.h>
74 
75 #ifdef ICL_KERNEL_PROXY
76 #include <sys/socketvar.h>
77 #endif
78 
79 #ifdef ICL_KERNEL_PROXY
80 FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
81 #endif
82 
83 static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
84 static uma_zone_t cfiscsi_data_wait_zone;
85 
86 SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
87     "CAM Target Layer iSCSI Frontend");
88 static int debug = 1;
89 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
90     &debug, 1, "Enable debug messages");
91 static int ping_timeout = 5;
92 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
93     &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
94 static int login_timeout = 60;
95 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
96     &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
97 static int maxcmdsn_delta = 256;
98 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
99     &maxcmdsn_delta, 256, "Number of commands the initiator can send "
100     "without confirmation");
101 
102 #define	CFISCSI_DEBUG(X, ...)						\
103 	do {								\
104 		if (debug > 1) {					\
105 			printf("%s: " X "\n",				\
106 			    __func__, ## __VA_ARGS__);			\
107 		}							\
108 	} while (0)
109 
110 #define	CFISCSI_WARN(X, ...)						\
111 	do {								\
112 		if (debug > 0) {					\
113 			printf("WARNING: %s: " X "\n",			\
114 			    __func__, ## __VA_ARGS__);			\
115 		}							\
116 	} while (0)
117 
118 #define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
119 	do {								\
120 		if (debug > 1) {					\
121 			printf("%s: %s (%s): " X "\n",			\
122 			    __func__, S->cs_initiator_addr,		\
123 			    S->cs_initiator_name, ## __VA_ARGS__);	\
124 		}							\
125 	} while (0)
126 
127 #define	CFISCSI_SESSION_WARN(S, X, ...)					\
128 	do  {								\
129 		if (debug > 0) {					\
130 			printf("WARNING: %s (%s): " X "\n",		\
131 			    S->cs_initiator_addr,			\
132 			    S->cs_initiator_name, ## __VA_ARGS__);	\
133 		}							\
134 	} while (0)
135 
136 #define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
137 #define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
138 #define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
139 
140 #define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
141 #define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
142 #define	PDU_EXPDATASN(X)		(X)->ip_prv0
143 #define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
144 #define	PDU_R2TSN(X)			(X)->ip_prv2
145 
146 int		cfiscsi_init(void);
147 static void	cfiscsi_online(void *arg);
148 static void	cfiscsi_offline(void *arg);
149 static int	cfiscsi_info(void *arg, struct sbuf *sb);
150 static int	cfiscsi_lun_enable(void *arg, int lun_id);
151 static int	cfiscsi_lun_disable(void *arg, int lun_id);
152 static int	cfiscsi_ioctl(struct cdev *dev,
153 		    u_long cmd, caddr_t addr, int flag, struct thread *td);
154 static void	cfiscsi_datamove(union ctl_io *io);
155 static void	cfiscsi_datamove_in(union ctl_io *io);
156 static void	cfiscsi_datamove_out(union ctl_io *io);
157 static void	cfiscsi_done(union ctl_io *io);
158 static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
159 static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
160 static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
161 static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
162 static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
163 static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
164 static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
165 static struct cfiscsi_data_wait	*cfiscsi_data_wait_new(
166 		    struct cfiscsi_session *cs, union ctl_io *io,
167 		    uint32_t initiator_task_tag,
168 		    uint32_t *target_transfer_tagp);
169 static void	cfiscsi_data_wait_free(struct cfiscsi_session *cs,
170 		    struct cfiscsi_data_wait *cdw);
171 static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
172 		    *softc, const char *name, uint16_t tag);
173 static struct cfiscsi_target	*cfiscsi_target_find_or_create(
174     struct cfiscsi_softc *softc, const char *name, const char *alias,
175     uint16_t tag);
176 static void	cfiscsi_target_release(struct cfiscsi_target *ct);
177 static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
178 
179 static struct cfiscsi_softc cfiscsi_softc;
180 extern struct ctl_softc *control_softc;
181 
182 static struct ctl_frontend cfiscsi_frontend =
183 {
184 	.name = "iscsi",
185 	.init = cfiscsi_init,
186 	.ioctl = cfiscsi_ioctl,
187 };
188 CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
189 MODULE_DEPEND(ctlcfiscsi, icl, 1, 1, 1);
190 
191 static struct icl_pdu *
192 cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
193 {
194 
195 	return (icl_pdu_new(request->ip_conn, flags));
196 }
197 
198 static bool
199 cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
200 {
201 	const struct iscsi_bhs_scsi_command *bhssc;
202 	struct cfiscsi_session *cs;
203 	uint32_t cmdsn, expstatsn;
204 
205 	cs = PDU_SESSION(request);
206 
207 	/*
208 	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
209 	 * The purpose of the timeout is to reset the connection when it stalls;
210 	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
211 	 * in some queue.
212 	 *
213 	 * XXX: Locking?
214 	 */
215 	cs->cs_timeout = 0;
216 
217 	/*
218 	 * Data-Out PDUs don't contain CmdSN.
219 	 */
220 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
221 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
222 		return (false);
223 
224 	/*
225 	 * We're only using fields common for all the request
226 	 * (initiator -> target) PDUs.
227 	 */
228 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
229 	cmdsn = ntohl(bhssc->bhssc_cmdsn);
230 	expstatsn = ntohl(bhssc->bhssc_expstatsn);
231 
232 	CFISCSI_SESSION_LOCK(cs);
233 #if 0
234 	if (expstatsn != cs->cs_statsn) {
235 		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
236 		    "while current StatSN is %d", expstatsn,
237 		    cs->cs_statsn);
238 	}
239 #endif
240 
241 	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0) {
242 		/*
243 		 * The target MUST silently ignore any non-immediate command
244 		 * outside of this range.
245 		 */
246 		if (ISCSI_SNLT(cmdsn, cs->cs_cmdsn) ||
247 		    ISCSI_SNGT(cmdsn, cs->cs_cmdsn + maxcmdsn_delta)) {
248 			CFISCSI_SESSION_UNLOCK(cs);
249 			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
250 			    "while expected %u", cmdsn, cs->cs_cmdsn);
251 			return (true);
252 		}
253 
254 		/*
255 		 * We don't support multiple connections now, so any
256 		 * discontinuity in CmdSN means lost PDUs.  Since we don't
257 		 * support PDU retransmission -- terminate the connection.
258 		 */
259 		if (cmdsn != cs->cs_cmdsn) {
260 			CFISCSI_SESSION_UNLOCK(cs);
261 			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
262 			    "while expected %u; dropping connection",
263 			    cmdsn, cs->cs_cmdsn);
264 			cfiscsi_session_terminate(cs);
265 			return (true);
266 		}
267 		cs->cs_cmdsn++;
268 	}
269 
270 	CFISCSI_SESSION_UNLOCK(cs);
271 
272 	return (false);
273 }
274 
275 static void
276 cfiscsi_pdu_handle(struct icl_pdu *request)
277 {
278 	struct cfiscsi_session *cs;
279 	bool ignore;
280 
281 	cs = PDU_SESSION(request);
282 
283 	ignore = cfiscsi_pdu_update_cmdsn(request);
284 	if (ignore) {
285 		icl_pdu_free(request);
286 		return;
287 	}
288 
289 	/*
290 	 * Handle the PDU; this includes e.g. receiving the remaining
291 	 * part of PDU and submitting the SCSI command to CTL
292 	 * or queueing a reply.  The handling routine is responsible
293 	 * for freeing the PDU when it's no longer needed.
294 	 */
295 	switch (request->ip_bhs->bhs_opcode &
296 	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
297 	case ISCSI_BHS_OPCODE_NOP_OUT:
298 		cfiscsi_pdu_handle_nop_out(request);
299 		break;
300 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
301 		cfiscsi_pdu_handle_scsi_command(request);
302 		break;
303 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
304 		cfiscsi_pdu_handle_task_request(request);
305 		break;
306 	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
307 		cfiscsi_pdu_handle_data_out(request);
308 		break;
309 	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
310 		cfiscsi_pdu_handle_logout_request(request);
311 		break;
312 	default:
313 		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
314 		    "opcode 0x%x; dropping connection",
315 		    request->ip_bhs->bhs_opcode);
316 		icl_pdu_free(request);
317 		cfiscsi_session_terminate(cs);
318 	}
319 
320 }
321 
322 static void
323 cfiscsi_receive_callback(struct icl_pdu *request)
324 {
325 	struct cfiscsi_session *cs;
326 
327 	cs = PDU_SESSION(request);
328 
329 #ifdef ICL_KERNEL_PROXY
330 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
331 		if (cs->cs_login_pdu == NULL)
332 			cs->cs_login_pdu = request;
333 		else
334 			icl_pdu_free(request);
335 		cv_signal(&cs->cs_login_cv);
336 		return;
337 	}
338 #endif
339 
340 	cfiscsi_pdu_handle(request);
341 }
342 
343 static void
344 cfiscsi_error_callback(struct icl_conn *ic)
345 {
346 	struct cfiscsi_session *cs;
347 
348 	cs = CONN_SESSION(ic);
349 
350 	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
351 	cfiscsi_session_terminate(cs);
352 }
353 
354 static int
355 cfiscsi_pdu_prepare(struct icl_pdu *response)
356 {
357 	struct cfiscsi_session *cs;
358 	struct iscsi_bhs_scsi_response *bhssr;
359 	bool advance_statsn = true;
360 
361 	cs = PDU_SESSION(response);
362 
363 	CFISCSI_SESSION_LOCK_ASSERT(cs);
364 
365 	/*
366 	 * We're only using fields common for all the response
367 	 * (target -> initiator) PDUs.
368 	 */
369 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
370 
371 	/*
372 	 * 10.8.3: "The StatSN for this connection is not advanced
373 	 * after this PDU is sent."
374 	 */
375 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
376 		advance_statsn = false;
377 
378 	/*
379 	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
380 	 * StatSN for the connection is not advanced after this PDU is sent."
381 	 */
382 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
383 	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
384 		advance_statsn = false;
385 
386 	/*
387 	 * See the comment below - StatSN is not meaningful and must
388 	 * not be advanced.
389 	 */
390 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN &&
391 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S) == 0)
392 		advance_statsn = false;
393 
394 	/*
395 	 * 10.7.3: "The fields StatSN, Status, and Residual Count
396 	 * only have meaningful content if the S bit is set to 1."
397 	 */
398 	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
399 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S))
400 		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
401 	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
402 	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
403 
404 	if (advance_statsn)
405 		cs->cs_statsn++;
406 
407 	return (0);
408 }
409 
410 static void
411 cfiscsi_pdu_queue(struct icl_pdu *response)
412 {
413 	struct cfiscsi_session *cs;
414 
415 	cs = PDU_SESSION(response);
416 
417 	CFISCSI_SESSION_LOCK(cs);
418 	cfiscsi_pdu_prepare(response);
419 	icl_pdu_queue(response);
420 	CFISCSI_SESSION_UNLOCK(cs);
421 }
422 
423 static uint32_t
424 cfiscsi_decode_lun(uint64_t encoded)
425 {
426 	uint8_t lun[8];
427 	uint32_t result;
428 
429 	/*
430 	 * The LUN field in iSCSI PDUs may look like an ordinary 64 bit number,
431 	 * but is in fact an evil, multidimensional structure defined
432 	 * in SCSI Architecture Model 5 (SAM-5), section 4.6.
433 	 */
434 	memcpy(lun, &encoded, sizeof(lun));
435 	switch (lun[0] & 0xC0) {
436 	case 0x00:
437 		if ((lun[0] & 0x3f) != 0 || lun[2] != 0 || lun[3] != 0 ||
438 		    lun[4] != 0 || lun[5] != 0 || lun[6] != 0 || lun[7] != 0) {
439 			CFISCSI_WARN("malformed LUN "
440 			    "(peripheral device addressing method): 0x%jx",
441 			    (uintmax_t)encoded);
442 			result = 0xffffffff;
443 			break;
444 		}
445 		result = lun[1];
446 		break;
447 	case 0x40:
448 		if (lun[2] != 0 || lun[3] != 0 || lun[4] != 0 || lun[5] != 0 ||
449 		    lun[6] != 0 || lun[7] != 0) {
450 			CFISCSI_WARN("malformed LUN "
451 			    "(flat address space addressing method): 0x%jx",
452 			    (uintmax_t)encoded);
453 			result = 0xffffffff;
454 			break;
455 		}
456 		result = ((lun[0] & 0x3f) << 8) + lun[1];
457 		break;
458 	case 0xC0:
459 		if (lun[0] != 0xD2 || lun[4] != 0 || lun[5] != 0 ||
460 		    lun[6] != 0 || lun[7] != 0) {
461 			CFISCSI_WARN("malformed LUN (extended flat "
462 			    "address space addressing method): 0x%jx",
463 			    (uintmax_t)encoded);
464 			result = 0xffffffff;
465 			break;
466 		}
467 		result = (lun[1] << 16) + (lun[2] << 8) + lun[3];
468 	default:
469 		CFISCSI_WARN("unsupported LUN format 0x%jx",
470 		    (uintmax_t)encoded);
471 		result = 0xffffffff;
472 		break;
473 	}
474 
475 	return (result);
476 }
477 
478 static void
479 cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
480 {
481 	struct cfiscsi_session *cs;
482 	struct iscsi_bhs_nop_out *bhsno;
483 	struct iscsi_bhs_nop_in *bhsni;
484 	struct icl_pdu *response;
485 	void *data = NULL;
486 	size_t datasize;
487 	int error;
488 
489 	cs = PDU_SESSION(request);
490 	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
491 
492 	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
493 		/*
494 		 * Nothing to do, iscsi_pdu_update_statsn() already
495 		 * zeroed the timeout.
496 		 */
497 		icl_pdu_free(request);
498 		return;
499 	}
500 
501 	datasize = icl_pdu_data_segment_length(request);
502 	if (datasize > 0) {
503 		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
504 		if (data == NULL) {
505 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
506 			    "dropping connection");
507 			icl_pdu_free(request);
508 			cfiscsi_session_terminate(cs);
509 			return;
510 		}
511 		icl_pdu_get_data(request, 0, data, datasize);
512 	}
513 
514 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
515 	if (response == NULL) {
516 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
517 		    "droppping connection");
518 		free(data, M_CFISCSI);
519 		icl_pdu_free(request);
520 		cfiscsi_session_terminate(cs);
521 		return;
522 	}
523 	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
524 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
525 	bhsni->bhsni_flags = 0x80;
526 	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
527 	bhsni->bhsni_target_transfer_tag = 0xffffffff;
528 	if (datasize > 0) {
529 		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
530 		if (error != 0) {
531 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
532 			    "dropping connection");
533 			free(data, M_CFISCSI);
534 			icl_pdu_free(request);
535 			icl_pdu_free(response);
536 			cfiscsi_session_terminate(cs);
537 			return;
538 		}
539 		free(data, M_CFISCSI);
540 	}
541 
542 	icl_pdu_free(request);
543 	cfiscsi_pdu_queue(response);
544 }
545 
546 static void
547 cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
548 {
549 	struct iscsi_bhs_scsi_command *bhssc;
550 	struct cfiscsi_session *cs;
551 	union ctl_io *io;
552 	int error;
553 
554 	cs = PDU_SESSION(request);
555 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
556 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
557 	//    bhssc->bhssc_initiator_task_tag);
558 
559 	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
560 		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
561 		    "ImmediateData=No; dropping connection");
562 		icl_pdu_free(request);
563 		cfiscsi_session_terminate(cs);
564 		return;
565 	}
566 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
567 	ctl_zero_io(io);
568 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
569 	io->io_hdr.io_type = CTL_IO_SCSI;
570 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
571 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
572 	io->io_hdr.nexus.targ_target.id = 0;
573 	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhssc->bhssc_lun);
574 	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
575 	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
576 	case BHSSC_FLAGS_ATTR_UNTAGGED:
577 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
578 		break;
579 	case BHSSC_FLAGS_ATTR_SIMPLE:
580 		io->scsiio.tag_type = CTL_TAG_SIMPLE;
581 		break;
582 	case BHSSC_FLAGS_ATTR_ORDERED:
583         	io->scsiio.tag_type = CTL_TAG_ORDERED;
584 		break;
585 	case BHSSC_FLAGS_ATTR_HOQ:
586         	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
587 		break;
588 	case BHSSC_FLAGS_ATTR_ACA:
589 		io->scsiio.tag_type = CTL_TAG_ACA;
590 		break;
591 	default:
592 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
593 		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
594 		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
595 		break;
596 	}
597 	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
598 	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
599 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
600 	error = ctl_queue(io);
601 	if (error != CTL_RETVAL_COMPLETE) {
602 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
603 		    "dropping connection", error);
604 		ctl_free_io(io);
605 		refcount_release(&cs->cs_outstanding_ctl_pdus);
606 		icl_pdu_free(request);
607 		cfiscsi_session_terminate(cs);
608 	}
609 }
610 
611 static void
612 cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
613 {
614 	struct iscsi_bhs_task_management_request *bhstmr;
615 	struct iscsi_bhs_task_management_response *bhstmr2;
616 	struct icl_pdu *response;
617 	struct cfiscsi_session *cs;
618 	union ctl_io *io;
619 	int error;
620 
621 	cs = PDU_SESSION(request);
622 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
623 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
624 	ctl_zero_io(io);
625 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
626 	io->io_hdr.io_type = CTL_IO_TASK;
627 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
628 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
629 	io->io_hdr.nexus.targ_target.id = 0;
630 	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhstmr->bhstmr_lun);
631 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
632 
633 	switch (bhstmr->bhstmr_function & ~0x80) {
634 	case BHSTMR_FUNCTION_ABORT_TASK:
635 #if 0
636 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
637 #endif
638 		io->taskio.task_action = CTL_TASK_ABORT_TASK;
639 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
640 		break;
641 	case BHSTMR_FUNCTION_ABORT_TASK_SET:
642 #if 0
643 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
644 #endif
645 		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
646 		break;
647 	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
648 #if 0
649 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
650 #endif
651 		io->taskio.task_action = CTL_TASK_LUN_RESET;
652 		break;
653 	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
654 #if 0
655 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
656 #endif
657 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
658 		break;
659 	default:
660 		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
661 		    bhstmr->bhstmr_function & ~0x80);
662 		ctl_free_io(io);
663 
664 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
665 		if (response == NULL) {
666 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
667 			    "dropping connection");
668 			icl_pdu_free(request);
669 			cfiscsi_session_terminate(cs);
670 			return;
671 		}
672 		bhstmr2 = (struct iscsi_bhs_task_management_response *)
673 		    response->ip_bhs;
674 		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
675 		bhstmr2->bhstmr_flags = 0x80;
676 		bhstmr2->bhstmr_response =
677 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
678 		bhstmr2->bhstmr_initiator_task_tag =
679 		    bhstmr->bhstmr_initiator_task_tag;
680 		icl_pdu_free(request);
681 		cfiscsi_pdu_queue(response);
682 		return;
683 	}
684 
685 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
686 	error = ctl_queue(io);
687 	if (error != CTL_RETVAL_COMPLETE) {
688 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
689 		    "dropping connection", error);
690 		ctl_free_io(io);
691 		refcount_release(&cs->cs_outstanding_ctl_pdus);
692 		icl_pdu_free(request);
693 		cfiscsi_session_terminate(cs);
694 	}
695 }
696 
697 static bool
698 cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
699 {
700 	struct iscsi_bhs_data_out *bhsdo;
701 	struct cfiscsi_session *cs;
702 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
703 	size_t copy_len, len, off, buffer_offset;
704 	int ctl_sg_count;
705 	union ctl_io *io;
706 
707 	cs = PDU_SESSION(request);
708 
709 	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
710 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
711 	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
712 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
713 	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
714 
715 	/*
716 	 * We're only using fields common for Data-Out and SCSI Command PDUs.
717 	 */
718 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
719 
720 	io = cdw->cdw_ctl_io;
721 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
722 	    ("CTL_FLAG_DATA_IN"));
723 
724 #if 0
725 	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
726 	    request->ip_data_len, io->scsiio.kern_total_len);
727 #endif
728 
729 	if (io->scsiio.kern_sg_entries > 0) {
730 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
731 		ctl_sg_count = io->scsiio.kern_sg_entries;
732 	} else {
733 		ctl_sglist = &ctl_sg_entry;
734 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
735 		ctl_sglist->len = io->scsiio.kern_data_len;
736 		ctl_sg_count = 1;
737 	}
738 
739 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
740 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
741 		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
742 	else
743 		buffer_offset = 0;
744 	len = icl_pdu_data_segment_length(request);
745 
746 	/*
747 	 * Make sure the offset, as sent by the initiator, matches the offset
748 	 * we're supposed to be at in the scatter-gather list.
749 	 */
750 	if (buffer_offset >
751 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
752 	    buffer_offset + len <=
753 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
754 		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
755 		    "expected %zd; dropping connection", buffer_offset,
756 		    (size_t)io->scsiio.kern_rel_offset +
757 		    (size_t)io->scsiio.ext_data_filled);
758 		ctl_set_data_phase_error(&io->scsiio);
759 		cfiscsi_session_terminate(cs);
760 		return (true);
761 	}
762 
763 	/*
764 	 * This is the offset within the PDU data segment, as opposed
765 	 * to buffer_offset, which is the offset within the task (SCSI
766 	 * command).
767 	 */
768 	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
769 	    buffer_offset;
770 
771 	/*
772 	 * Iterate over the scatter/gather segments, filling them with data
773 	 * from the PDU data segment.  Note that this can get called multiple
774 	 * times for one SCSI command; the cdw structure holds state for the
775 	 * scatter/gather list.
776 	 */
777 	for (;;) {
778 		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
779 		    ("cdw->cdw_sg_index >= ctl_sg_count"));
780 		if (cdw->cdw_sg_len == 0) {
781 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
782 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
783 		}
784 		KASSERT(off <= len, ("len > off"));
785 		copy_len = len - off;
786 		if (copy_len > cdw->cdw_sg_len)
787 			copy_len = cdw->cdw_sg_len;
788 
789 		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
790 		cdw->cdw_sg_addr += copy_len;
791 		cdw->cdw_sg_len -= copy_len;
792 		off += copy_len;
793 		io->scsiio.ext_data_filled += copy_len;
794 
795 		if (cdw->cdw_sg_len == 0) {
796 			/*
797 			 * End of current segment.
798 			 */
799 			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
800 				/*
801 				 * Last segment in scatter/gather list.
802 				 */
803 				break;
804 			}
805 			cdw->cdw_sg_index++;
806 		}
807 
808 		if (off == len) {
809 			/*
810 			 * End of PDU payload.
811 			 */
812 			break;
813 		}
814 	}
815 
816 	if (len > off) {
817 		/*
818 		 * In case of unsolicited data, it's possible that the buffer
819 		 * provided by CTL is smaller than negotiated FirstBurstLength.
820 		 * Just ignore the superfluous data; will ask for them with R2T
821 		 * on next call to cfiscsi_datamove().
822 		 *
823 		 * This obviously can only happen with SCSI Command PDU.
824 		 */
825 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
826 		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
827 			return (true);
828 
829 		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
830 		    "expected %zd; dropping connection",
831 		    icl_pdu_data_segment_length(request), off);
832 		ctl_set_data_phase_error(&io->scsiio);
833 		cfiscsi_session_terminate(cs);
834 		return (true);
835 	}
836 
837 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
838 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
839 		CFISCSI_SESSION_WARN(cs, "got the final packet without "
840 		    "the F flag; flags = 0x%x; dropping connection",
841 		    bhsdo->bhsdo_flags);
842 		ctl_set_data_phase_error(&io->scsiio);
843 		cfiscsi_session_terminate(cs);
844 		return (true);
845 	}
846 
847 	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
848 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
849 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
850 		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
851 			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
852 			    "transmitted size was %zd bytes instead of %d; "
853 			    "dropping connection",
854 			    (size_t)io->scsiio.ext_data_filled,
855 			    cdw->cdw_r2t_end);
856 			ctl_set_data_phase_error(&io->scsiio);
857 			cfiscsi_session_terminate(cs);
858 			return (true);
859 		} else {
860 			/*
861 			 * For SCSI Command PDU, this just means we need to
862 			 * solicit more data by sending R2T.
863 			 */
864 			return (false);
865 		}
866 	}
867 
868 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
869 #if 0
870 		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
871 		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
872 #endif
873 
874 		return (true);
875 	}
876 
877 	return (false);
878 }
879 
880 static void
881 cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
882 {
883 	struct iscsi_bhs_data_out *bhsdo;
884 	struct cfiscsi_session *cs;
885 	struct cfiscsi_data_wait *cdw = NULL;
886 	union ctl_io *io;
887 	bool done;
888 
889 	cs = PDU_SESSION(request);
890 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
891 
892 	CFISCSI_SESSION_LOCK(cs);
893 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
894 #if 0
895 		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
896 		    "ttt 0x%x, itt 0x%x",
897 		    bhsdo->bhsdo_target_transfer_tag,
898 		    bhsdo->bhsdo_initiator_task_tag,
899 		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
900 #endif
901 		if (bhsdo->bhsdo_target_transfer_tag ==
902 		    cdw->cdw_target_transfer_tag)
903 			break;
904 	}
905 	CFISCSI_SESSION_UNLOCK(cs);
906 	if (cdw == NULL) {
907 		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
908 		    "0x%x, not found; dropping connection",
909 		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
910 		icl_pdu_free(request);
911 		cfiscsi_session_terminate(cs);
912 		return;
913 	}
914 
915 	if (cdw->cdw_datasn != ntohl(bhsdo->bhsdo_datasn)) {
916 		CFISCSI_SESSION_WARN(cs, "received Data-Out PDU with "
917 		    "DataSN %u, while expected %u; dropping connection",
918 		    ntohl(bhsdo->bhsdo_datasn), cdw->cdw_datasn);
919 		icl_pdu_free(request);
920 		cfiscsi_session_terminate(cs);
921 		return;
922 	}
923 	cdw->cdw_datasn++;
924 
925 	io = cdw->cdw_ctl_io;
926 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
927 	    ("CTL_FLAG_DATA_IN"));
928 
929 	done = cfiscsi_handle_data_segment(request, cdw);
930 	if (done) {
931 		CFISCSI_SESSION_LOCK(cs);
932 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
933 		CFISCSI_SESSION_UNLOCK(cs);
934 		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
935 		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
936 		cfiscsi_data_wait_free(cs, cdw);
937 		if (done)
938 			io->scsiio.be_move_done(io);
939 		else
940 			cfiscsi_datamove_out(io);
941 	}
942 
943 	icl_pdu_free(request);
944 }
945 
946 static void
947 cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
948 {
949 	struct iscsi_bhs_logout_request *bhslr;
950 	struct iscsi_bhs_logout_response *bhslr2;
951 	struct icl_pdu *response;
952 	struct cfiscsi_session *cs;
953 
954 	cs = PDU_SESSION(request);
955 	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
956 	switch (bhslr->bhslr_reason & 0x7f) {
957 	case BHSLR_REASON_CLOSE_SESSION:
958 	case BHSLR_REASON_CLOSE_CONNECTION:
959 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
960 		if (response == NULL) {
961 			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
962 			icl_pdu_free(request);
963 			cfiscsi_session_terminate(cs);
964 			return;
965 		}
966 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
967 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
968 		bhslr2->bhslr_flags = 0x80;
969 		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
970 		bhslr2->bhslr_initiator_task_tag =
971 		    bhslr->bhslr_initiator_task_tag;
972 		icl_pdu_free(request);
973 		cfiscsi_pdu_queue(response);
974 		cfiscsi_session_terminate(cs);
975 		break;
976 	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
977 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
978 		if (response == NULL) {
979 			CFISCSI_SESSION_WARN(cs,
980 			    "failed to allocate memory; dropping connection");
981 			icl_pdu_free(request);
982 			cfiscsi_session_terminate(cs);
983 			return;
984 		}
985 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
986 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
987 		bhslr2->bhslr_flags = 0x80;
988 		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
989 		bhslr2->bhslr_initiator_task_tag =
990 		    bhslr->bhslr_initiator_task_tag;
991 		icl_pdu_free(request);
992 		cfiscsi_pdu_queue(response);
993 		break;
994 	default:
995 		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
996 		    bhslr->bhslr_reason);
997 		icl_pdu_free(request);
998 		cfiscsi_session_terminate(cs);
999 		break;
1000 	}
1001 }
1002 
1003 static void
1004 cfiscsi_callout(void *context)
1005 {
1006 	struct icl_pdu *cp;
1007 	struct iscsi_bhs_nop_in *bhsni;
1008 	struct cfiscsi_session *cs;
1009 
1010 	cs = context;
1011 
1012 	if (cs->cs_terminating)
1013 		return;
1014 
1015 	callout_schedule(&cs->cs_callout, 1 * hz);
1016 
1017 	atomic_add_int(&cs->cs_timeout, 1);
1018 
1019 #ifdef ICL_KERNEL_PROXY
1020 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1021 		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1022 			CFISCSI_SESSION_WARN(cs, "login timed out after "
1023 			    "%d seconds; dropping connection", cs->cs_timeout);
1024 			cfiscsi_session_terminate(cs);
1025 		}
1026 		return;
1027 	}
1028 #endif
1029 
1030 	if (ping_timeout <= 0) {
1031 		/*
1032 		 * Pings are disabled.  Don't send NOP-In in this case;
1033 		 * user might have disabled pings to work around problems
1034 		 * with certain initiators that can't properly handle
1035 		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1036 		 * triggering reconnection, should the user decide to
1037 		 * reenable them.
1038 		 */
1039 		cs->cs_timeout = 0;
1040 		return;
1041 	}
1042 
1043 	if (cs->cs_timeout >= ping_timeout) {
1044 		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1045 		    "dropping connection",  ping_timeout);
1046 		cfiscsi_session_terminate(cs);
1047 		return;
1048 	}
1049 
1050 	/*
1051 	 * If the ping was reset less than one second ago - which means
1052 	 * that we've received some PDU during the last second - assume
1053 	 * the traffic flows correctly and don't bother sending a NOP-Out.
1054 	 *
1055 	 * (It's 2 - one for one second, and one for incrementing is_timeout
1056 	 * earlier in this routine.)
1057 	 */
1058 	if (cs->cs_timeout < 2)
1059 		return;
1060 
1061 	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1062 	if (cp == NULL) {
1063 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1064 		return;
1065 	}
1066 	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1067 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1068 	bhsni->bhsni_flags = 0x80;
1069 	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1070 
1071 	cfiscsi_pdu_queue(cp);
1072 }
1073 
1074 static struct cfiscsi_data_wait *
1075 cfiscsi_data_wait_new(struct cfiscsi_session *cs, union ctl_io *io,
1076     uint32_t initiator_task_tag, uint32_t *target_transfer_tagp)
1077 {
1078 	struct cfiscsi_data_wait *cdw;
1079 	int error;
1080 
1081 	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
1082 	if (cdw == NULL) {
1083 		CFISCSI_SESSION_WARN(cs,
1084 		    "failed to allocate %zd bytes", sizeof(*cdw));
1085 		return (NULL);
1086 	}
1087 
1088 	error = icl_conn_transfer_setup(cs->cs_conn, io, target_transfer_tagp,
1089 	    &cdw->cdw_icl_prv);
1090 	if (error != 0) {
1091 		CFISCSI_SESSION_WARN(cs,
1092 		    "icl_conn_transfer_setup() failed with error %d", error);
1093 		uma_zfree(cfiscsi_data_wait_zone, cdw);
1094 		return (NULL);
1095 	}
1096 
1097 	cdw->cdw_ctl_io = io;
1098 	cdw->cdw_target_transfer_tag = *target_transfer_tagp;
1099 	cdw->cdw_initiator_task_tag = initiator_task_tag;
1100 
1101 	return (cdw);
1102 }
1103 
1104 static void
1105 cfiscsi_data_wait_free(struct cfiscsi_session *cs,
1106     struct cfiscsi_data_wait *cdw)
1107 {
1108 
1109 	icl_conn_transfer_done(cs->cs_conn, cdw->cdw_icl_prv);
1110 	uma_zfree(cfiscsi_data_wait_zone, cdw);
1111 }
1112 
1113 static void
1114 cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1115 {
1116 	struct cfiscsi_data_wait *cdw;
1117 	union ctl_io *io;
1118 	int error, last, wait;
1119 
1120 	if (cs->cs_target == NULL)
1121 		return;		/* No target yet, so nothing to do. */
1122 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1123 	ctl_zero_io(io);
1124 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = cs;
1125 	io->io_hdr.io_type = CTL_IO_TASK;
1126 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1127 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1128 	io->io_hdr.nexus.targ_target.id = 0;
1129 	io->io_hdr.nexus.targ_lun = 0;
1130 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1131 	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1132 	wait = cs->cs_outstanding_ctl_pdus;
1133 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1134 	error = ctl_queue(io);
1135 	if (error != CTL_RETVAL_COMPLETE) {
1136 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1137 		refcount_release(&cs->cs_outstanding_ctl_pdus);
1138 		ctl_free_io(io);
1139 	}
1140 
1141 	CFISCSI_SESSION_LOCK(cs);
1142 	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1143 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1144 		CFISCSI_SESSION_UNLOCK(cs);
1145 		/*
1146 		 * Set nonzero port status; this prevents backends from
1147 		 * assuming that the data transfer actually succeeded
1148 		 * and writing uninitialized data to disk.
1149 		 */
1150 		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1151 		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1152 		cfiscsi_data_wait_free(cs, cdw);
1153 		CFISCSI_SESSION_LOCK(cs);
1154 	}
1155 	CFISCSI_SESSION_UNLOCK(cs);
1156 
1157 	/*
1158 	 * Wait for CTL to terminate all the tasks.
1159 	 */
1160 	if (wait > 0)
1161 		CFISCSI_SESSION_WARN(cs,
1162 		    "waiting for CTL to terminate %d tasks", wait);
1163 	for (;;) {
1164 		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1165 		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1166 		if (last != 0)
1167 			break;
1168 		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1169 		    0, "cfiscsi_terminate", hz / 100);
1170 	}
1171 	if (wait > 0)
1172 		CFISCSI_SESSION_WARN(cs, "tasks terminated");
1173 }
1174 
1175 static void
1176 cfiscsi_maintenance_thread(void *arg)
1177 {
1178 	struct cfiscsi_session *cs;
1179 
1180 	cs = arg;
1181 
1182 	for (;;) {
1183 		CFISCSI_SESSION_LOCK(cs);
1184 		if (cs->cs_terminating == false)
1185 			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1186 		CFISCSI_SESSION_UNLOCK(cs);
1187 
1188 		if (cs->cs_terminating) {
1189 
1190 			/*
1191 			 * We used to wait up to 30 seconds to deliver queued
1192 			 * PDUs to the initiator.  We also tried hard to deliver
1193 			 * SCSI Responses for the aborted PDUs.  We don't do
1194 			 * that anymore.  We might need to revisit that.
1195 			 */
1196 			callout_drain(&cs->cs_callout);
1197 			icl_conn_close(cs->cs_conn);
1198 
1199 			/*
1200 			 * At this point ICL receive thread is no longer
1201 			 * running; no new tasks can be queued.
1202 			 */
1203 			cfiscsi_session_terminate_tasks(cs);
1204 			cfiscsi_session_delete(cs);
1205 			kthread_exit();
1206 			return;
1207 		}
1208 		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1209 	}
1210 }
1211 
1212 static void
1213 cfiscsi_session_terminate(struct cfiscsi_session *cs)
1214 {
1215 
1216 	if (cs->cs_terminating)
1217 		return;
1218 	cs->cs_terminating = true;
1219 	cv_signal(&cs->cs_maintenance_cv);
1220 #ifdef ICL_KERNEL_PROXY
1221 	cv_signal(&cs->cs_login_cv);
1222 #endif
1223 }
1224 
1225 static int
1226 cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1227 {
1228 	struct cfiscsi_target *ct;
1229 	char *name;
1230 	int i;
1231 
1232 	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1233 
1234 	ct = cs->cs_target;
1235 	name = strdup(cs->cs_initiator_id, M_CTL);
1236 	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1237 	if (i < 0) {
1238 		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1239 		    i);
1240 		cs->cs_ctl_initid = -1;
1241 		return (1);
1242 	}
1243 	cs->cs_ctl_initid = i;
1244 #if 0
1245 	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1246 #endif
1247 
1248 	return (0);
1249 }
1250 
1251 static void
1252 cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1253 {
1254 	int error;
1255 
1256 	if (cs->cs_ctl_initid == -1)
1257 		return;
1258 
1259 	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1260 	if (error != 0) {
1261 		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1262 		    error);
1263 	}
1264 	cs->cs_ctl_initid = -1;
1265 }
1266 
1267 static struct cfiscsi_session *
1268 cfiscsi_session_new(struct cfiscsi_softc *softc, const char *offload)
1269 {
1270 	struct cfiscsi_session *cs;
1271 	int error;
1272 
1273 	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1274 	if (cs == NULL) {
1275 		CFISCSI_WARN("malloc failed");
1276 		return (NULL);
1277 	}
1278 	cs->cs_ctl_initid = -1;
1279 
1280 	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1281 	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1282 	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1283 	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1284 #ifdef ICL_KERNEL_PROXY
1285 	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1286 #endif
1287 
1288 	cs->cs_conn = icl_new_conn(offload, "cfiscsi", &cs->cs_lock);
1289 	if (cs->cs_conn == NULL) {
1290 		free(cs, M_CFISCSI);
1291 		return (NULL);
1292 	}
1293 	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1294 	cs->cs_conn->ic_error = cfiscsi_error_callback;
1295 	cs->cs_conn->ic_prv0 = cs;
1296 
1297 	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1298 	if (error != 0) {
1299 		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1300 		free(cs, M_CFISCSI);
1301 		return (NULL);
1302 	}
1303 
1304 	mtx_lock(&softc->lock);
1305 	cs->cs_id = ++softc->last_session_id;
1306 	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1307 	mtx_unlock(&softc->lock);
1308 
1309 	/*
1310 	 * Start pinging the initiator.
1311 	 */
1312 	callout_init(&cs->cs_callout, 1);
1313 	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1314 
1315 	return (cs);
1316 }
1317 
1318 static void
1319 cfiscsi_session_delete(struct cfiscsi_session *cs)
1320 {
1321 	struct cfiscsi_softc *softc;
1322 
1323 	softc = &cfiscsi_softc;
1324 
1325 	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1326 	    ("destroying session with outstanding CTL pdus"));
1327 	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1328 	    ("destroying session with non-empty queue"));
1329 
1330 	cfiscsi_session_unregister_initiator(cs);
1331 	if (cs->cs_target != NULL)
1332 		cfiscsi_target_release(cs->cs_target);
1333 	icl_conn_close(cs->cs_conn);
1334 	icl_conn_free(cs->cs_conn);
1335 
1336 	mtx_lock(&softc->lock);
1337 	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1338 	cv_signal(&softc->sessions_cv);
1339 	mtx_unlock(&softc->lock);
1340 
1341 	free(cs, M_CFISCSI);
1342 }
1343 
1344 int
1345 cfiscsi_init(void)
1346 {
1347 	struct cfiscsi_softc *softc;
1348 	int retval;
1349 
1350 	softc = &cfiscsi_softc;
1351 	retval = 0;
1352 	bzero(softc, sizeof(*softc));
1353 	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1354 
1355 	cv_init(&softc->sessions_cv, "cfiscsi_sessions");
1356 #ifdef ICL_KERNEL_PROXY
1357 	cv_init(&softc->accept_cv, "cfiscsi_accept");
1358 #endif
1359 	TAILQ_INIT(&softc->sessions);
1360 	TAILQ_INIT(&softc->targets);
1361 
1362 	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1363 	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1364 	    UMA_ALIGN_PTR, 0);
1365 
1366 	return (0);
1367 }
1368 
1369 #ifdef ICL_KERNEL_PROXY
1370 static void
1371 cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1372 {
1373 	struct cfiscsi_session *cs;
1374 
1375 	cs = cfiscsi_session_new(&cfiscsi_softc, NULL);
1376 	if (cs == NULL) {
1377 		CFISCSI_WARN("failed to create session");
1378 		return;
1379 	}
1380 
1381 	icl_conn_handoff_sock(cs->cs_conn, so);
1382 	cs->cs_initiator_sa = sa;
1383 	cs->cs_portal_id = portal_id;
1384 	cs->cs_waiting_for_ctld = true;
1385 	cv_signal(&cfiscsi_softc.accept_cv);
1386 }
1387 #endif
1388 
1389 static void
1390 cfiscsi_online(void *arg)
1391 {
1392 	struct cfiscsi_softc *softc;
1393 	struct cfiscsi_target *ct;
1394 	int online;
1395 
1396 	ct = (struct cfiscsi_target *)arg;
1397 	softc = ct->ct_softc;
1398 
1399 	mtx_lock(&softc->lock);
1400 	if (ct->ct_online) {
1401 		mtx_unlock(&softc->lock);
1402 		return;
1403 	}
1404 	ct->ct_online = 1;
1405 	online = softc->online++;
1406 	mtx_unlock(&softc->lock);
1407 	if (online > 0)
1408 		return;
1409 
1410 #ifdef ICL_KERNEL_PROXY
1411 	if (softc->listener != NULL)
1412 		icl_listen_free(softc->listener);
1413 	softc->listener = icl_listen_new(cfiscsi_accept);
1414 #endif
1415 }
1416 
1417 static void
1418 cfiscsi_offline(void *arg)
1419 {
1420 	struct cfiscsi_softc *softc;
1421 	struct cfiscsi_target *ct;
1422 	struct cfiscsi_session *cs;
1423 	int online;
1424 
1425 	ct = (struct cfiscsi_target *)arg;
1426 	softc = ct->ct_softc;
1427 
1428 	mtx_lock(&softc->lock);
1429 	if (!ct->ct_online) {
1430 		mtx_unlock(&softc->lock);
1431 		return;
1432 	}
1433 	ct->ct_online = 0;
1434 	online = --softc->online;
1435 
1436 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1437 		if (cs->cs_target == ct)
1438 			cfiscsi_session_terminate(cs);
1439 	}
1440 	do {
1441 		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1442 			if (cs->cs_target == ct)
1443 				break;
1444 		}
1445 		if (cs != NULL)
1446 			cv_wait(&softc->sessions_cv, &softc->lock);
1447 	} while (cs != NULL && ct->ct_online == 0);
1448 	mtx_unlock(&softc->lock);
1449 	if (online > 0)
1450 		return;
1451 
1452 #ifdef ICL_KERNEL_PROXY
1453 	icl_listen_free(softc->listener);
1454 	softc->listener = NULL;
1455 #endif
1456 }
1457 
1458 static int
1459 cfiscsi_info(void *arg, struct sbuf *sb)
1460 {
1461 	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1462 	int retval;
1463 
1464 	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1465 	    ct->ct_state);
1466 	return (retval);
1467 }
1468 
1469 static void
1470 cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1471 {
1472 	struct cfiscsi_softc *softc;
1473 	struct cfiscsi_session *cs, *cs2;
1474 	struct cfiscsi_target *ct;
1475 	struct ctl_iscsi_handoff_params *cihp;
1476 	int error;
1477 
1478 	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1479 	softc = &cfiscsi_softc;
1480 
1481 	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1482 	    cihp->initiator_name, cihp->initiator_addr,
1483 	    cihp->target_name);
1484 
1485 	ct = cfiscsi_target_find(softc, cihp->target_name,
1486 	    cihp->portal_group_tag);
1487 	if (ct == NULL) {
1488 		ci->status = CTL_ISCSI_ERROR;
1489 		snprintf(ci->error_str, sizeof(ci->error_str),
1490 		    "%s: target not found", __func__);
1491 		return;
1492 	}
1493 
1494 #ifdef ICL_KERNEL_PROXY
1495 	if (cihp->socket > 0 && cihp->connection_id > 0) {
1496 		snprintf(ci->error_str, sizeof(ci->error_str),
1497 		    "both socket and connection_id set");
1498 		ci->status = CTL_ISCSI_ERROR;
1499 		cfiscsi_target_release(ct);
1500 		return;
1501 	}
1502 	if (cihp->socket == 0) {
1503 		mtx_lock(&cfiscsi_softc.lock);
1504 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1505 			if (cs->cs_id == cihp->connection_id)
1506 				break;
1507 		}
1508 		if (cs == NULL) {
1509 			mtx_unlock(&cfiscsi_softc.lock);
1510 			snprintf(ci->error_str, sizeof(ci->error_str),
1511 			    "connection not found");
1512 			ci->status = CTL_ISCSI_ERROR;
1513 			cfiscsi_target_release(ct);
1514 			return;
1515 		}
1516 		mtx_unlock(&cfiscsi_softc.lock);
1517 	} else {
1518 #endif
1519 		cs = cfiscsi_session_new(softc, cihp->offload);
1520 		if (cs == NULL) {
1521 			ci->status = CTL_ISCSI_ERROR;
1522 			snprintf(ci->error_str, sizeof(ci->error_str),
1523 			    "%s: cfiscsi_session_new failed", __func__);
1524 			cfiscsi_target_release(ct);
1525 			return;
1526 		}
1527 #ifdef ICL_KERNEL_PROXY
1528 	}
1529 #endif
1530 
1531 	/*
1532 	 * First PDU of Full Feature phase has the same CmdSN as the last
1533 	 * PDU from the Login Phase received from the initiator.  Thus,
1534 	 * the -1 below.
1535 	 */
1536 	cs->cs_cmdsn = cihp->cmdsn;
1537 	cs->cs_statsn = cihp->statsn;
1538 	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1539 	cs->cs_max_burst_length = cihp->max_burst_length;
1540 	cs->cs_immediate_data = !!cihp->immediate_data;
1541 	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1542 		cs->cs_conn->ic_header_crc32c = true;
1543 	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1544 		cs->cs_conn->ic_data_crc32c = true;
1545 
1546 	strlcpy(cs->cs_initiator_name,
1547 	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1548 	strlcpy(cs->cs_initiator_addr,
1549 	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1550 	strlcpy(cs->cs_initiator_alias,
1551 	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1552 	memcpy(cs->cs_initiator_isid,
1553 	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1554 	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1555 	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1556 	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1557 	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1558 	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1559 
1560 	mtx_lock(&softc->lock);
1561 	if (ct->ct_online == 0) {
1562 		mtx_unlock(&softc->lock);
1563 		cfiscsi_session_terminate(cs);
1564 		cfiscsi_target_release(ct);
1565 		ci->status = CTL_ISCSI_ERROR;
1566 		snprintf(ci->error_str, sizeof(ci->error_str),
1567 		    "%s: port offline", __func__);
1568 		return;
1569 	}
1570 	cs->cs_target = ct;
1571 	mtx_unlock(&softc->lock);
1572 
1573 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1574 restart:
1575 	if (!cs->cs_terminating) {
1576 		mtx_lock(&softc->lock);
1577 		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1578 			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1579 			    cs->cs_target == cs2->cs_target &&
1580 			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1581 				cfiscsi_session_terminate(cs2);
1582 				mtx_unlock(&softc->lock);
1583 				pause("cfiscsi_reinstate", 1);
1584 				goto restart;
1585 			}
1586 		}
1587 		mtx_unlock(&softc->lock);
1588 	}
1589 
1590 	/*
1591 	 * Register initiator with CTL.
1592 	 */
1593 	cfiscsi_session_register_initiator(cs);
1594 
1595 #ifdef ICL_KERNEL_PROXY
1596 	if (cihp->socket > 0) {
1597 #endif
1598 		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1599 		if (error != 0) {
1600 			cfiscsi_session_terminate(cs);
1601 			refcount_release(&cs->cs_outstanding_ctl_pdus);
1602 			ci->status = CTL_ISCSI_ERROR;
1603 			snprintf(ci->error_str, sizeof(ci->error_str),
1604 			    "%s: icl_conn_handoff failed with error %d",
1605 			    __func__, error);
1606 			return;
1607 		}
1608 #ifdef ICL_KERNEL_PROXY
1609 	}
1610 #endif
1611 
1612 #ifdef ICL_KERNEL_PROXY
1613 	cs->cs_login_phase = false;
1614 
1615 	/*
1616 	 * First PDU of the Full Feature phase has likely already arrived.
1617 	 * We have to pick it up and execute properly.
1618 	 */
1619 	if (cs->cs_login_pdu != NULL) {
1620 		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1621 		cfiscsi_pdu_handle(cs->cs_login_pdu);
1622 		cs->cs_login_pdu = NULL;
1623 	}
1624 #endif
1625 
1626 	refcount_release(&cs->cs_outstanding_ctl_pdus);
1627 	ci->status = CTL_ISCSI_OK;
1628 }
1629 
1630 static void
1631 cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1632 {
1633 	struct ctl_iscsi_list_params *cilp;
1634 	struct cfiscsi_session *cs;
1635 	struct cfiscsi_softc *softc;
1636 	struct sbuf *sb;
1637 	int error;
1638 
1639 	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1640 	softc = &cfiscsi_softc;
1641 
1642 	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1643 	if (sb == NULL) {
1644 		ci->status = CTL_ISCSI_ERROR;
1645 		snprintf(ci->error_str, sizeof(ci->error_str),
1646 		    "Unable to allocate %d bytes for iSCSI session list",
1647 		    cilp->alloc_len);
1648 		return;
1649 	}
1650 
1651 	sbuf_printf(sb, "<ctlislist>\n");
1652 	mtx_lock(&softc->lock);
1653 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1654 #ifdef ICL_KERNEL_PROXY
1655 		if (cs->cs_target == NULL)
1656 			continue;
1657 #endif
1658 		error = sbuf_printf(sb, "<connection id=\"%d\">"
1659 		    "<initiator>%s</initiator>"
1660 		    "<initiator_addr>%s</initiator_addr>"
1661 		    "<initiator_alias>%s</initiator_alias>"
1662 		    "<target>%s</target>"
1663 		    "<target_alias>%s</target_alias>"
1664 		    "<target_portal_group_tag>%u</target_portal_group_tag>"
1665 		    "<header_digest>%s</header_digest>"
1666 		    "<data_digest>%s</data_digest>"
1667 		    "<max_data_segment_length>%zd</max_data_segment_length>"
1668 		    "<immediate_data>%d</immediate_data>"
1669 		    "<iser>%d</iser>"
1670 		    "<offload>%s</offload>"
1671 		    "</connection>\n",
1672 		    cs->cs_id,
1673 		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1674 		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1675 		    cs->cs_target->ct_tag,
1676 		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1677 		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1678 		    cs->cs_max_data_segment_length,
1679 		    cs->cs_immediate_data,
1680 		    cs->cs_conn->ic_iser,
1681 		    cs->cs_conn->ic_offload);
1682 		if (error != 0)
1683 			break;
1684 	}
1685 	mtx_unlock(&softc->lock);
1686 	error = sbuf_printf(sb, "</ctlislist>\n");
1687 	if (error != 0) {
1688 		sbuf_delete(sb);
1689 		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1690 		snprintf(ci->error_str, sizeof(ci->error_str),
1691 		    "Out of space, %d bytes is too small", cilp->alloc_len);
1692 		return;
1693 	}
1694 	sbuf_finish(sb);
1695 
1696 	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1697 	cilp->fill_len = sbuf_len(sb) + 1;
1698 	ci->status = CTL_ISCSI_OK;
1699 	sbuf_delete(sb);
1700 }
1701 
1702 static void
1703 cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1704 {
1705 	struct icl_pdu *response;
1706 	struct iscsi_bhs_asynchronous_message *bhsam;
1707 	struct ctl_iscsi_logout_params *cilp;
1708 	struct cfiscsi_session *cs;
1709 	struct cfiscsi_softc *softc;
1710 	int found = 0;
1711 
1712 	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1713 	softc = &cfiscsi_softc;
1714 
1715 	mtx_lock(&softc->lock);
1716 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1717 		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1718 		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1719 		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1720 			continue;
1721 
1722 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1723 		if (response == NULL) {
1724 			ci->status = CTL_ISCSI_ERROR;
1725 			snprintf(ci->error_str, sizeof(ci->error_str),
1726 			    "Unable to allocate memory");
1727 			mtx_unlock(&softc->lock);
1728 			return;
1729 		}
1730 		bhsam =
1731 		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1732 		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1733 		bhsam->bhsam_flags = 0x80;
1734 		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1735 		bhsam->bhsam_parameter3 = htons(10);
1736 		cfiscsi_pdu_queue(response);
1737 		found++;
1738 	}
1739 	mtx_unlock(&softc->lock);
1740 
1741 	if (found == 0) {
1742 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1743 		snprintf(ci->error_str, sizeof(ci->error_str),
1744 		    "No matching connections found");
1745 		return;
1746 	}
1747 
1748 	ci->status = CTL_ISCSI_OK;
1749 }
1750 
1751 static void
1752 cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1753 {
1754 	struct icl_pdu *response;
1755 	struct iscsi_bhs_asynchronous_message *bhsam;
1756 	struct ctl_iscsi_terminate_params *citp;
1757 	struct cfiscsi_session *cs;
1758 	struct cfiscsi_softc *softc;
1759 	int found = 0;
1760 
1761 	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1762 	softc = &cfiscsi_softc;
1763 
1764 	mtx_lock(&softc->lock);
1765 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1766 		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1767 		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1768 		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1769 			continue;
1770 
1771 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1772 		if (response == NULL) {
1773 			/*
1774 			 * Oh well.  Just terminate the connection.
1775 			 */
1776 		} else {
1777 			bhsam = (struct iscsi_bhs_asynchronous_message *)
1778 			    response->ip_bhs;
1779 			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1780 			bhsam->bhsam_flags = 0x80;
1781 			bhsam->bhsam_0xffffffff = 0xffffffff;
1782 			bhsam->bhsam_async_event =
1783 			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1784 			cfiscsi_pdu_queue(response);
1785 		}
1786 		cfiscsi_session_terminate(cs);
1787 		found++;
1788 	}
1789 	mtx_unlock(&softc->lock);
1790 
1791 	if (found == 0) {
1792 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1793 		snprintf(ci->error_str, sizeof(ci->error_str),
1794 		    "No matching connections found");
1795 		return;
1796 	}
1797 
1798 	ci->status = CTL_ISCSI_OK;
1799 }
1800 
1801 static void
1802 cfiscsi_ioctl_limits(struct ctl_iscsi *ci)
1803 {
1804 	struct ctl_iscsi_limits_params *cilp;
1805 	int error;
1806 
1807 	cilp = (struct ctl_iscsi_limits_params *)&(ci->data);
1808 
1809 	error = icl_limits(cilp->offload, &cilp->data_segment_limit);
1810 	if (error != 0) {
1811 		ci->status = CTL_ISCSI_ERROR;
1812 		snprintf(ci->error_str, sizeof(ci->error_str),
1813 			"%s: icl_limits failed with error %d",
1814 			__func__, error);
1815 		return;
1816 	}
1817 
1818 	ci->status = CTL_ISCSI_OK;
1819 }
1820 
1821 #ifdef ICL_KERNEL_PROXY
1822 static void
1823 cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1824 {
1825 	struct ctl_iscsi_listen_params *cilp;
1826 	struct sockaddr *sa;
1827 	int error;
1828 
1829 	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1830 
1831 	if (cfiscsi_softc.listener == NULL) {
1832 		CFISCSI_DEBUG("no listener");
1833 		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1834 		ci->status = CTL_ISCSI_ERROR;
1835 		return;
1836 	}
1837 
1838 	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1839 	if (error != 0) {
1840 		CFISCSI_DEBUG("getsockaddr, error %d", error);
1841 		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1842 		ci->status = CTL_ISCSI_ERROR;
1843 		return;
1844 	}
1845 
1846 	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1847 	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1848 	if (error != 0) {
1849 		free(sa, M_SONAME);
1850 		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1851 		snprintf(ci->error_str, sizeof(ci->error_str),
1852 		    "icl_listen_add failed, error %d", error);
1853 		ci->status = CTL_ISCSI_ERROR;
1854 		return;
1855 	}
1856 
1857 	ci->status = CTL_ISCSI_OK;
1858 }
1859 
1860 static void
1861 cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1862 {
1863 	struct ctl_iscsi_accept_params *ciap;
1864 	struct cfiscsi_session *cs;
1865 	int error;
1866 
1867 	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1868 
1869 	mtx_lock(&cfiscsi_softc.lock);
1870 	for (;;) {
1871 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1872 			if (cs->cs_waiting_for_ctld)
1873 				break;
1874 		}
1875 		if (cs != NULL)
1876 			break;
1877 		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1878 		if (error != 0) {
1879 			mtx_unlock(&cfiscsi_softc.lock);
1880 			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1881 			ci->status = CTL_ISCSI_ERROR;
1882 			return;
1883 		}
1884 	}
1885 	mtx_unlock(&cfiscsi_softc.lock);
1886 
1887 	cs->cs_waiting_for_ctld = false;
1888 	cs->cs_login_phase = true;
1889 
1890 	ciap->connection_id = cs->cs_id;
1891 	ciap->portal_id = cs->cs_portal_id;
1892 	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1893 	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1894 	    cs->cs_initiator_sa->sa_len);
1895 	if (error != 0) {
1896 		snprintf(ci->error_str, sizeof(ci->error_str),
1897 		    "copyout failed with error %d", error);
1898 		ci->status = CTL_ISCSI_ERROR;
1899 		return;
1900 	}
1901 
1902 	ci->status = CTL_ISCSI_OK;
1903 }
1904 
1905 static void
1906 cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1907 {
1908 	struct ctl_iscsi_send_params *cisp;
1909 	struct cfiscsi_session *cs;
1910 	struct icl_pdu *ip;
1911 	size_t datalen;
1912 	void *data;
1913 	int error;
1914 
1915 	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1916 
1917 	mtx_lock(&cfiscsi_softc.lock);
1918 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1919 		if (cs->cs_id == cisp->connection_id)
1920 			break;
1921 	}
1922 	if (cs == NULL) {
1923 		mtx_unlock(&cfiscsi_softc.lock);
1924 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1925 		ci->status = CTL_ISCSI_ERROR;
1926 		return;
1927 	}
1928 	mtx_unlock(&cfiscsi_softc.lock);
1929 
1930 #if 0
1931 	if (cs->cs_login_phase == false)
1932 		return (EBUSY);
1933 #endif
1934 
1935 	if (cs->cs_terminating) {
1936 		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1937 		ci->status = CTL_ISCSI_ERROR;
1938 		return;
1939 	}
1940 
1941 	datalen = cisp->data_segment_len;
1942 	/*
1943 	 * XXX
1944 	 */
1945 	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1946 	if (datalen > 65535) {
1947 		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1948 		ci->status = CTL_ISCSI_ERROR;
1949 		return;
1950 	}
1951 	if (datalen > 0) {
1952 		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1953 		error = copyin(cisp->data_segment, data, datalen);
1954 		if (error != 0) {
1955 			free(data, M_CFISCSI);
1956 			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1957 			ci->status = CTL_ISCSI_ERROR;
1958 			return;
1959 		}
1960 	}
1961 
1962 	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
1963 	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1964 	if (datalen > 0) {
1965 		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1966 		free(data, M_CFISCSI);
1967 	}
1968 	CFISCSI_SESSION_LOCK(cs);
1969 	icl_pdu_queue(ip);
1970 	CFISCSI_SESSION_UNLOCK(cs);
1971 	ci->status = CTL_ISCSI_OK;
1972 }
1973 
1974 static void
1975 cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1976 {
1977 	struct ctl_iscsi_receive_params *cirp;
1978 	struct cfiscsi_session *cs;
1979 	struct icl_pdu *ip;
1980 	void *data;
1981 	int error;
1982 
1983 	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1984 
1985 	mtx_lock(&cfiscsi_softc.lock);
1986 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1987 		if (cs->cs_id == cirp->connection_id)
1988 			break;
1989 	}
1990 	if (cs == NULL) {
1991 		mtx_unlock(&cfiscsi_softc.lock);
1992 		snprintf(ci->error_str, sizeof(ci->error_str),
1993 		    "connection not found");
1994 		ci->status = CTL_ISCSI_ERROR;
1995 		return;
1996 	}
1997 	mtx_unlock(&cfiscsi_softc.lock);
1998 
1999 #if 0
2000 	if (is->is_login_phase == false)
2001 		return (EBUSY);
2002 #endif
2003 
2004 	CFISCSI_SESSION_LOCK(cs);
2005 	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
2006 		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
2007 		if (error != 0) {
2008 			CFISCSI_SESSION_UNLOCK(cs);
2009 			snprintf(ci->error_str, sizeof(ci->error_str),
2010 			    "interrupted by signal");
2011 			ci->status = CTL_ISCSI_ERROR;
2012 			return;
2013 		}
2014 	}
2015 
2016 	if (cs->cs_terminating) {
2017 		CFISCSI_SESSION_UNLOCK(cs);
2018 		snprintf(ci->error_str, sizeof(ci->error_str),
2019 		    "connection terminating");
2020 		ci->status = CTL_ISCSI_ERROR;
2021 		return;
2022 	}
2023 	ip = cs->cs_login_pdu;
2024 	cs->cs_login_pdu = NULL;
2025 	CFISCSI_SESSION_UNLOCK(cs);
2026 
2027 	if (ip->ip_data_len > cirp->data_segment_len) {
2028 		icl_pdu_free(ip);
2029 		snprintf(ci->error_str, sizeof(ci->error_str),
2030 		    "data segment too big");
2031 		ci->status = CTL_ISCSI_ERROR;
2032 		return;
2033 	}
2034 
2035 	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
2036 	if (ip->ip_data_len > 0) {
2037 		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
2038 		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
2039 		copyout(data, cirp->data_segment, ip->ip_data_len);
2040 		free(data, M_CFISCSI);
2041 	}
2042 
2043 	icl_pdu_free(ip);
2044 	ci->status = CTL_ISCSI_OK;
2045 }
2046 
2047 #endif /* !ICL_KERNEL_PROXY */
2048 
2049 static void
2050 cfiscsi_ioctl_port_create(struct ctl_req *req)
2051 {
2052 	struct cfiscsi_target *ct;
2053 	struct ctl_port *port;
2054 	const char *target, *alias, *tags;
2055 	struct scsi_vpd_id_descriptor *desc;
2056 	ctl_options_t opts;
2057 	int retval, len, idlen;
2058 	uint16_t tag;
2059 
2060 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2061 	target = ctl_get_opt(&opts, "cfiscsi_target");
2062 	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
2063 	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2064 	if (target == NULL || tags == NULL) {
2065 		req->status = CTL_LUN_ERROR;
2066 		snprintf(req->error_str, sizeof(req->error_str),
2067 		    "Missing required argument");
2068 		ctl_free_opts(&opts);
2069 		return;
2070 	}
2071 	tag = strtol(tags, (char **)NULL, 10);
2072 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias, tag);
2073 	if (ct == NULL) {
2074 		req->status = CTL_LUN_ERROR;
2075 		snprintf(req->error_str, sizeof(req->error_str),
2076 		    "failed to create target \"%s\"", target);
2077 		ctl_free_opts(&opts);
2078 		return;
2079 	}
2080 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
2081 		req->status = CTL_LUN_ERROR;
2082 		snprintf(req->error_str, sizeof(req->error_str),
2083 		    "target \"%s\" already exists", target);
2084 		cfiscsi_target_release(ct);
2085 		ctl_free_opts(&opts);
2086 		return;
2087 	}
2088 	port = &ct->ct_port;
2089 	// WAT
2090 	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
2091 		goto done;
2092 
2093 	port->frontend = &cfiscsi_frontend;
2094 	port->port_type = CTL_PORT_ISCSI;
2095 	/* XXX KDM what should the real number be here? */
2096 	port->num_requested_ctl_io = 4096;
2097 	port->port_name = "iscsi";
2098 	port->physical_port = tag;
2099 	port->virtual_port = ct->ct_target_id;
2100 	port->port_online = cfiscsi_online;
2101 	port->port_offline = cfiscsi_offline;
2102 	port->port_info = cfiscsi_info;
2103 	port->onoff_arg = ct;
2104 	port->lun_enable = cfiscsi_lun_enable;
2105 	port->lun_disable = cfiscsi_lun_disable;
2106 	port->targ_lun_arg = ct;
2107 	port->fe_datamove = cfiscsi_datamove;
2108 	port->fe_done = cfiscsi_done;
2109 
2110 	/* XXX KDM what should we report here? */
2111 	/* XXX These should probably be fetched from CTL. */
2112 	port->max_targets = 1;
2113 	port->max_target_id = 15;
2114 
2115 	port->options = opts;
2116 	STAILQ_INIT(&opts);
2117 
2118 	/* Generate Port ID. */
2119 	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2120 	idlen = roundup2(idlen, 4);
2121 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2122 	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2123 	    M_CTL, M_WAITOK | M_ZERO);
2124 	port->port_devid->len = len;
2125 	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2126 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2127 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2128 	    SVPD_ID_TYPE_SCSI_NAME;
2129 	desc->length = idlen;
2130 	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x", target, tag);
2131 
2132 	/* Generate Target ID. */
2133 	idlen = strlen(target) + 1;
2134 	idlen = roundup2(idlen, 4);
2135 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2136 	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2137 	    M_CTL, M_WAITOK | M_ZERO);
2138 	port->target_devid->len = len;
2139 	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2140 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2141 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2142 	    SVPD_ID_TYPE_SCSI_NAME;
2143 	desc->length = idlen;
2144 	strlcpy(desc->identifier, target, idlen);
2145 
2146 	retval = ctl_port_register(port);
2147 	if (retval != 0) {
2148 		ctl_free_opts(&port->options);
2149 		cfiscsi_target_release(ct);
2150 		free(port->port_devid, M_CFISCSI);
2151 		free(port->target_devid, M_CFISCSI);
2152 		req->status = CTL_LUN_ERROR;
2153 		snprintf(req->error_str, sizeof(req->error_str),
2154 		    "ctl_port_register() failed with error %d", retval);
2155 		return;
2156 	}
2157 done:
2158 	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2159 	req->status = CTL_LUN_OK;
2160 	memcpy(req->kern_args[0].kvalue, &port->targ_port,
2161 	    sizeof(port->targ_port)); //XXX
2162 }
2163 
2164 static void
2165 cfiscsi_ioctl_port_remove(struct ctl_req *req)
2166 {
2167 	struct cfiscsi_target *ct;
2168 	const char *target, *tags;
2169 	ctl_options_t opts;
2170 	uint16_t tag;
2171 
2172 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2173 	target = ctl_get_opt(&opts, "cfiscsi_target");
2174 	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2175 	if (target == NULL || tags == NULL) {
2176 		ctl_free_opts(&opts);
2177 		req->status = CTL_LUN_ERROR;
2178 		snprintf(req->error_str, sizeof(req->error_str),
2179 		    "Missing required argument");
2180 		return;
2181 	}
2182 	tag = strtol(tags, (char **)NULL, 10);
2183 	ct = cfiscsi_target_find(&cfiscsi_softc, target, tag);
2184 	if (ct == NULL) {
2185 		ctl_free_opts(&opts);
2186 		req->status = CTL_LUN_ERROR;
2187 		snprintf(req->error_str, sizeof(req->error_str),
2188 		    "can't find target \"%s\"", target);
2189 		return;
2190 	}
2191 	if (ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE) {
2192 		ctl_free_opts(&opts);
2193 		req->status = CTL_LUN_ERROR;
2194 		snprintf(req->error_str, sizeof(req->error_str),
2195 		    "target \"%s\" is already dying", target);
2196 		return;
2197 	}
2198 	ctl_free_opts(&opts);
2199 
2200 	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2201 	ctl_port_offline(&ct->ct_port);
2202 	cfiscsi_target_release(ct);
2203 	cfiscsi_target_release(ct);
2204 	req->status = CTL_LUN_OK;
2205 }
2206 
2207 static int
2208 cfiscsi_ioctl(struct cdev *dev,
2209     u_long cmd, caddr_t addr, int flag, struct thread *td)
2210 {
2211 	struct ctl_iscsi *ci;
2212 	struct ctl_req *req;
2213 
2214 	if (cmd == CTL_PORT_REQ) {
2215 		req = (struct ctl_req *)addr;
2216 		switch (req->reqtype) {
2217 		case CTL_REQ_CREATE:
2218 			cfiscsi_ioctl_port_create(req);
2219 			break;
2220 		case CTL_REQ_REMOVE:
2221 			cfiscsi_ioctl_port_remove(req);
2222 			break;
2223 		default:
2224 			req->status = CTL_LUN_ERROR;
2225 			snprintf(req->error_str, sizeof(req->error_str),
2226 			    "Unsupported request type %d", req->reqtype);
2227 		}
2228 		return (0);
2229 	}
2230 
2231 	if (cmd != CTL_ISCSI)
2232 		return (ENOTTY);
2233 
2234 	ci = (struct ctl_iscsi *)addr;
2235 	switch (ci->type) {
2236 	case CTL_ISCSI_HANDOFF:
2237 		cfiscsi_ioctl_handoff(ci);
2238 		break;
2239 	case CTL_ISCSI_LIST:
2240 		cfiscsi_ioctl_list(ci);
2241 		break;
2242 	case CTL_ISCSI_LOGOUT:
2243 		cfiscsi_ioctl_logout(ci);
2244 		break;
2245 	case CTL_ISCSI_TERMINATE:
2246 		cfiscsi_ioctl_terminate(ci);
2247 		break;
2248 	case CTL_ISCSI_LIMITS:
2249 		cfiscsi_ioctl_limits(ci);
2250 		break;
2251 #ifdef ICL_KERNEL_PROXY
2252 	case CTL_ISCSI_LISTEN:
2253 		cfiscsi_ioctl_listen(ci);
2254 		break;
2255 	case CTL_ISCSI_ACCEPT:
2256 		cfiscsi_ioctl_accept(ci);
2257 		break;
2258 	case CTL_ISCSI_SEND:
2259 		cfiscsi_ioctl_send(ci);
2260 		break;
2261 	case CTL_ISCSI_RECEIVE:
2262 		cfiscsi_ioctl_receive(ci);
2263 		break;
2264 #else
2265 	case CTL_ISCSI_LISTEN:
2266 	case CTL_ISCSI_ACCEPT:
2267 	case CTL_ISCSI_SEND:
2268 	case CTL_ISCSI_RECEIVE:
2269 		ci->status = CTL_ISCSI_ERROR;
2270 		snprintf(ci->error_str, sizeof(ci->error_str),
2271 		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2272 		    __func__);
2273 		break;
2274 #endif /* !ICL_KERNEL_PROXY */
2275 	default:
2276 		ci->status = CTL_ISCSI_ERROR;
2277 		snprintf(ci->error_str, sizeof(ci->error_str),
2278 		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2279 		break;
2280 	}
2281 
2282 	return (0);
2283 }
2284 
2285 static void
2286 cfiscsi_target_hold(struct cfiscsi_target *ct)
2287 {
2288 
2289 	refcount_acquire(&ct->ct_refcount);
2290 }
2291 
2292 static void
2293 cfiscsi_target_release(struct cfiscsi_target *ct)
2294 {
2295 	struct cfiscsi_softc *softc;
2296 
2297 	softc = ct->ct_softc;
2298 	mtx_lock(&softc->lock);
2299 	if (refcount_release(&ct->ct_refcount)) {
2300 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2301 		mtx_unlock(&softc->lock);
2302 		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2303 			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2304 			if (ctl_port_deregister(&ct->ct_port) != 0)
2305 				printf("%s: ctl_port_deregister() failed\n",
2306 				    __func__);
2307 		}
2308 		free(ct, M_CFISCSI);
2309 
2310 		return;
2311 	}
2312 	mtx_unlock(&softc->lock);
2313 }
2314 
2315 static struct cfiscsi_target *
2316 cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name, uint16_t tag)
2317 {
2318 	struct cfiscsi_target *ct;
2319 
2320 	mtx_lock(&softc->lock);
2321 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2322 		if (ct->ct_tag != tag ||
2323 		    strcmp(name, ct->ct_name) != 0 ||
2324 		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2325 			continue;
2326 		cfiscsi_target_hold(ct);
2327 		mtx_unlock(&softc->lock);
2328 		return (ct);
2329 	}
2330 	mtx_unlock(&softc->lock);
2331 
2332 	return (NULL);
2333 }
2334 
2335 static struct cfiscsi_target *
2336 cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2337     const char *alias, uint16_t tag)
2338 {
2339 	struct cfiscsi_target *ct, *newct;
2340 
2341 	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2342 		return (NULL);
2343 
2344 	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2345 
2346 	mtx_lock(&softc->lock);
2347 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2348 		if (ct->ct_tag != tag ||
2349 		    strcmp(name, ct->ct_name) != 0 ||
2350 		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2351 			continue;
2352 		cfiscsi_target_hold(ct);
2353 		mtx_unlock(&softc->lock);
2354 		free(newct, M_CFISCSI);
2355 		return (ct);
2356 	}
2357 
2358 	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2359 	if (alias != NULL)
2360 		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2361 	newct->ct_tag = tag;
2362 	refcount_init(&newct->ct_refcount, 1);
2363 	newct->ct_softc = softc;
2364 	if (TAILQ_EMPTY(&softc->targets))
2365 		softc->last_target_id = 0;
2366 	newct->ct_target_id = ++softc->last_target_id;
2367 	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2368 	mtx_unlock(&softc->lock);
2369 
2370 	return (newct);
2371 }
2372 
2373 static int
2374 cfiscsi_lun_enable(void *arg, int lun_id)
2375 {
2376 
2377 	return (0);
2378 }
2379 
2380 static int
2381 cfiscsi_lun_disable(void *arg, int lun_id)
2382 {
2383 
2384 	return (0);
2385 }
2386 
2387 static void
2388 cfiscsi_datamove_in(union ctl_io *io)
2389 {
2390 	struct cfiscsi_session *cs;
2391 	struct icl_pdu *request, *response;
2392 	const struct iscsi_bhs_scsi_command *bhssc;
2393 	struct iscsi_bhs_data_in *bhsdi;
2394 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2395 	size_t len, expected_len, sg_len, buffer_offset;
2396 	const char *sg_addr;
2397 	int ctl_sg_count, error, i;
2398 
2399 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2400 	cs = PDU_SESSION(request);
2401 
2402 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2403 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2404 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2405 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2406 
2407 	if (io->scsiio.kern_sg_entries > 0) {
2408 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2409 		ctl_sg_count = io->scsiio.kern_sg_entries;
2410 	} else {
2411 		ctl_sglist = &ctl_sg_entry;
2412 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2413 		ctl_sglist->len = io->scsiio.kern_data_len;
2414 		ctl_sg_count = 1;
2415 	}
2416 
2417 	/*
2418 	 * This is the total amount of data to be transferred within the current
2419 	 * SCSI command.  We need to record it so that we can properly report
2420 	 * underflow/underflow.
2421 	 */
2422 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2423 
2424 	/*
2425 	 * This is the offset within the current SCSI command; for the first
2426 	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2427 	 * it will be the sum of lengths of previous ones.
2428 	 */
2429 	buffer_offset = io->scsiio.kern_rel_offset;
2430 
2431 	/*
2432 	 * This is the transfer length expected by the initiator.  In theory,
2433 	 * it could be different from the correct amount of data from the SCSI
2434 	 * point of view, even if that doesn't make any sense.
2435 	 */
2436 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2437 #if 0
2438 	if (expected_len != io->scsiio.kern_total_len) {
2439 		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2440 		    "actual length %zd", expected_len,
2441 		    (size_t)io->scsiio.kern_total_len);
2442 	}
2443 #endif
2444 
2445 	if (buffer_offset >= expected_len) {
2446 #if 0
2447 		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2448 		    "already sent the expected len", buffer_offset);
2449 #endif
2450 		io->scsiio.be_move_done(io);
2451 		return;
2452 	}
2453 
2454 	i = 0;
2455 	sg_addr = NULL;
2456 	sg_len = 0;
2457 	response = NULL;
2458 	bhsdi = NULL;
2459 	for (;;) {
2460 		if (response == NULL) {
2461 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2462 			if (response == NULL) {
2463 				CFISCSI_SESSION_WARN(cs, "failed to "
2464 				    "allocate memory; dropping connection");
2465 				ctl_set_busy(&io->scsiio);
2466 				io->scsiio.be_move_done(io);
2467 				cfiscsi_session_terminate(cs);
2468 				return;
2469 			}
2470 			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2471 			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2472 			bhsdi->bhsdi_initiator_task_tag =
2473 			    bhssc->bhssc_initiator_task_tag;
2474 			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2475 			PDU_EXPDATASN(request)++;
2476 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2477 		}
2478 
2479 		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2480 		if (sg_len == 0) {
2481 			sg_addr = ctl_sglist[i].addr;
2482 			sg_len = ctl_sglist[i].len;
2483 			KASSERT(sg_len > 0, ("sg_len <= 0"));
2484 		}
2485 
2486 		len = sg_len;
2487 
2488 		/*
2489 		 * Truncate to maximum data segment length.
2490 		 */
2491 		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2492 		    ("ip_data_len %zd >= max_data_segment_length %zd",
2493 		    response->ip_data_len, cs->cs_max_data_segment_length));
2494 		if (response->ip_data_len + len >
2495 		    cs->cs_max_data_segment_length) {
2496 			len = cs->cs_max_data_segment_length -
2497 			    response->ip_data_len;
2498 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2499 			    len, sg_len));
2500 		}
2501 
2502 		/*
2503 		 * Truncate to expected data transfer length.
2504 		 */
2505 		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2506 		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2507 		    buffer_offset, response->ip_data_len, expected_len));
2508 		if (buffer_offset + response->ip_data_len + len > expected_len) {
2509 			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2510 			    "to expected data transfer length %zd",
2511 			    buffer_offset + response->ip_data_len + len, expected_len);
2512 			len = expected_len - (buffer_offset + response->ip_data_len);
2513 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2514 			    len, sg_len));
2515 		}
2516 
2517 		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2518 		if (error != 0) {
2519 			CFISCSI_SESSION_WARN(cs, "failed to "
2520 			    "allocate memory; dropping connection");
2521 			icl_pdu_free(response);
2522 			ctl_set_busy(&io->scsiio);
2523 			io->scsiio.be_move_done(io);
2524 			cfiscsi_session_terminate(cs);
2525 			return;
2526 		}
2527 		sg_addr += len;
2528 		sg_len -= len;
2529 
2530 		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2531 		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2532 		    buffer_offset, response->ip_data_len, expected_len));
2533 		if (buffer_offset + response->ip_data_len == expected_len) {
2534 			/*
2535 			 * Already have the amount of data the initiator wanted.
2536 			 */
2537 			break;
2538 		}
2539 
2540 		if (sg_len == 0) {
2541 			/*
2542 			 * End of scatter-gather segment;
2543 			 * proceed to the next one...
2544 			 */
2545 			if (i == ctl_sg_count - 1) {
2546 				/*
2547 				 * ... unless this was the last one.
2548 				 */
2549 				break;
2550 			}
2551 			i++;
2552 		}
2553 
2554 		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2555 			/*
2556 			 * Can't stuff more data into the current PDU;
2557 			 * queue it.  Note that's not enough to check
2558 			 * for kern_data_resid == 0 instead; there
2559 			 * may be several Data-In PDUs for the final
2560 			 * call to cfiscsi_datamove(), and we want
2561 			 * to set the F flag only on the last of them.
2562 			 */
2563 			buffer_offset += response->ip_data_len;
2564 			if (buffer_offset == io->scsiio.kern_total_len ||
2565 			    buffer_offset == expected_len) {
2566 				buffer_offset -= response->ip_data_len;
2567 				break;
2568 			}
2569 			cfiscsi_pdu_queue(response);
2570 			response = NULL;
2571 			bhsdi = NULL;
2572 		}
2573 	}
2574 	if (response != NULL) {
2575 		buffer_offset += response->ip_data_len;
2576 		if (buffer_offset == io->scsiio.kern_total_len ||
2577 		    buffer_offset == expected_len) {
2578 			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2579 			if (io->io_hdr.status == CTL_SUCCESS) {
2580 				bhsdi->bhsdi_flags |= BHSDI_FLAGS_S;
2581 				if (PDU_TOTAL_TRANSFER_LEN(request) <
2582 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2583 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2584 					bhsdi->bhsdi_residual_count =
2585 					    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2586 					    PDU_TOTAL_TRANSFER_LEN(request));
2587 				} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2588 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2589 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2590 					bhsdi->bhsdi_residual_count =
2591 					    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2592 					    ntohl(bhssc->bhssc_expected_data_transfer_length));
2593 				}
2594 				bhsdi->bhsdi_status = io->scsiio.scsi_status;
2595 				io->io_hdr.flags |= CTL_FLAG_STATUS_SENT;
2596 			}
2597 		}
2598 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2599 		cfiscsi_pdu_queue(response);
2600 	}
2601 
2602 	io->scsiio.be_move_done(io);
2603 }
2604 
2605 static void
2606 cfiscsi_datamove_out(union ctl_io *io)
2607 {
2608 	struct cfiscsi_session *cs;
2609 	struct icl_pdu *request, *response;
2610 	const struct iscsi_bhs_scsi_command *bhssc;
2611 	struct iscsi_bhs_r2t *bhsr2t;
2612 	struct cfiscsi_data_wait *cdw;
2613 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2614 	uint32_t expected_len, r2t_off, r2t_len;
2615 	uint32_t target_transfer_tag;
2616 	bool done;
2617 
2618 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2619 	cs = PDU_SESSION(request);
2620 
2621 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2622 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2623 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2624 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2625 
2626 	/*
2627 	 * We need to record it so that we can properly report
2628 	 * underflow/underflow.
2629 	 */
2630 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2631 
2632 	/*
2633 	 * Report write underflow as error since CTL and backends don't
2634 	 * really support it, and SCSI does not tell how to do it right.
2635 	 */
2636 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2637 	if (io->scsiio.kern_rel_offset + io->scsiio.kern_data_len >
2638 	    expected_len) {
2639 		io->scsiio.io_hdr.port_status = 43;
2640 		io->scsiio.be_move_done(io);
2641 		return;
2642 	}
2643 
2644 	target_transfer_tag =
2645 	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2646 	cdw = cfiscsi_data_wait_new(cs, io, bhssc->bhssc_initiator_task_tag,
2647 	    &target_transfer_tag);
2648 	if (cdw == NULL) {
2649 		CFISCSI_SESSION_WARN(cs, "failed to "
2650 		    "allocate memory; dropping connection");
2651 		ctl_set_busy(&io->scsiio);
2652 		io->scsiio.be_move_done(io);
2653 		cfiscsi_session_terminate(cs);
2654 		return;
2655 	}
2656 #if 0
2657 	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2658 	    "task tag 0x%x, target transfer tag 0x%x",
2659 	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2660 #endif
2661 
2662 	cdw->cdw_ctl_io = io;
2663 	cdw->cdw_target_transfer_tag = target_transfer_tag;
2664 	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2665 	cdw->cdw_r2t_end = io->scsiio.kern_data_len;
2666 	cdw->cdw_datasn = 0;
2667 
2668 	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2669 	if (io->scsiio.kern_sg_entries > 0) {
2670 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2671 	} else {
2672 		ctl_sglist = &ctl_sg_entry;
2673 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2674 		ctl_sglist->len = io->scsiio.kern_data_len;
2675 	}
2676 	cdw->cdw_sg_index = 0;
2677 	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2678 	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2679 	r2t_off = io->scsiio.ext_data_filled;
2680 	while (r2t_off > 0) {
2681 		if (r2t_off >= cdw->cdw_sg_len) {
2682 			r2t_off -= cdw->cdw_sg_len;
2683 			cdw->cdw_sg_index++;
2684 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2685 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2686 			continue;
2687 		}
2688 		cdw->cdw_sg_addr += r2t_off;
2689 		cdw->cdw_sg_len -= r2t_off;
2690 		r2t_off = 0;
2691 	}
2692 
2693 	if (cs->cs_immediate_data &&
2694 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2695 	    icl_pdu_data_segment_length(request)) {
2696 		done = cfiscsi_handle_data_segment(request, cdw);
2697 		if (done) {
2698 			cfiscsi_data_wait_free(cs, cdw);
2699 			io->scsiio.be_move_done(io);
2700 			return;
2701 		}
2702 	}
2703 
2704 	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2705 	r2t_len = MIN(io->scsiio.kern_data_len - io->scsiio.ext_data_filled,
2706 	    cs->cs_max_burst_length);
2707 	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2708 
2709 	CFISCSI_SESSION_LOCK(cs);
2710 	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2711 	CFISCSI_SESSION_UNLOCK(cs);
2712 
2713 	/*
2714 	 * XXX: We should limit the number of outstanding R2T PDUs
2715 	 * 	per task to MaxOutstandingR2T.
2716 	 */
2717 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2718 	if (response == NULL) {
2719 		CFISCSI_SESSION_WARN(cs, "failed to "
2720 		    "allocate memory; dropping connection");
2721 		ctl_set_busy(&io->scsiio);
2722 		io->scsiio.be_move_done(io);
2723 		cfiscsi_session_terminate(cs);
2724 		return;
2725 	}
2726 	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2727 	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2728 	bhsr2t->bhsr2t_flags = 0x80;
2729 	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2730 	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2731 	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2732 	/*
2733 	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2734 	 *	be running concurrently on several CPUs for a given
2735 	 *	command.
2736 	 */
2737 	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2738 	PDU_R2TSN(request)++;
2739 	/*
2740 	 * This is the offset within the current SCSI command;
2741 	 * i.e. for the first call of datamove(), it will be 0,
2742 	 * and for subsequent ones it will be the sum of lengths
2743 	 * of previous ones.
2744 	 *
2745 	 * The ext_data_filled is to account for unsolicited
2746 	 * (immediate) data that might have already arrived.
2747 	 */
2748 	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2749 	/*
2750 	 * This is the total length (sum of S/G lengths) this call
2751 	 * to cfiscsi_datamove() is supposed to handle, limited by
2752 	 * MaxBurstLength.
2753 	 */
2754 	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2755 	cfiscsi_pdu_queue(response);
2756 }
2757 
2758 static void
2759 cfiscsi_datamove(union ctl_io *io)
2760 {
2761 
2762 	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2763 		cfiscsi_datamove_in(io);
2764 	else {
2765 		/* We hadn't received anything during this datamove yet. */
2766 		io->scsiio.ext_data_filled = 0;
2767 		cfiscsi_datamove_out(io);
2768 	}
2769 }
2770 
2771 static void
2772 cfiscsi_scsi_command_done(union ctl_io *io)
2773 {
2774 	struct icl_pdu *request, *response;
2775 	struct iscsi_bhs_scsi_command *bhssc;
2776 	struct iscsi_bhs_scsi_response *bhssr;
2777 #ifdef DIAGNOSTIC
2778 	struct cfiscsi_data_wait *cdw;
2779 #endif
2780 	struct cfiscsi_session *cs;
2781 	uint16_t sense_length;
2782 
2783 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2784 	cs = PDU_SESSION(request);
2785 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2786 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2787 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2788 	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2789 
2790 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2791 	//    bhssc->bhssc_initiator_task_tag);
2792 
2793 #ifdef DIAGNOSTIC
2794 	CFISCSI_SESSION_LOCK(cs);
2795 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2796 		KASSERT(bhssc->bhssc_initiator_task_tag !=
2797 		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2798 	CFISCSI_SESSION_UNLOCK(cs);
2799 #endif
2800 
2801 	/*
2802 	 * Do not return status for aborted commands.
2803 	 * There are exceptions, but none supported by CTL yet.
2804 	 */
2805 	if (((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2806 	     (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) ||
2807 	    (io->io_hdr.flags & CTL_FLAG_STATUS_SENT)) {
2808 		ctl_free_io(io);
2809 		icl_pdu_free(request);
2810 		return;
2811 	}
2812 
2813 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2814 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2815 	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2816 	bhssr->bhssr_flags = 0x80;
2817 	/*
2818 	 * XXX: We don't deal with bidirectional under/overflows;
2819 	 *	does anything actually support those?
2820 	 */
2821 	if (PDU_TOTAL_TRANSFER_LEN(request) <
2822 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2823 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2824 		bhssr->bhssr_residual_count =
2825 		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2826 		    PDU_TOTAL_TRANSFER_LEN(request));
2827 		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2828 		//    ntohl(bhssr->bhssr_residual_count));
2829 	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2830 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2831 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2832 		bhssr->bhssr_residual_count =
2833 		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2834 		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2835 		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2836 		//    ntohl(bhssr->bhssr_residual_count));
2837 	}
2838 	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2839 	bhssr->bhssr_status = io->scsiio.scsi_status;
2840 	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2841 	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2842 
2843 	if (io->scsiio.sense_len > 0) {
2844 #if 0
2845 		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2846 		    io->scsiio.sense_len);
2847 #endif
2848 		sense_length = htons(io->scsiio.sense_len);
2849 		icl_pdu_append_data(response,
2850 		    &sense_length, sizeof(sense_length), M_WAITOK);
2851 		icl_pdu_append_data(response,
2852 		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2853 	}
2854 
2855 	ctl_free_io(io);
2856 	icl_pdu_free(request);
2857 	cfiscsi_pdu_queue(response);
2858 }
2859 
2860 static void
2861 cfiscsi_task_management_done(union ctl_io *io)
2862 {
2863 	struct icl_pdu *request, *response;
2864 	struct iscsi_bhs_task_management_request *bhstmr;
2865 	struct iscsi_bhs_task_management_response *bhstmr2;
2866 	struct cfiscsi_data_wait *cdw, *tmpcdw;
2867 	struct cfiscsi_session *cs;
2868 
2869 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2870 	cs = PDU_SESSION(request);
2871 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2872 	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2873 	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2874 	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2875 
2876 #if 0
2877 	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2878 	    bhstmr->bhstmr_initiator_task_tag,
2879 	    bhstmr->bhstmr_referenced_task_tag);
2880 #endif
2881 
2882 	if ((bhstmr->bhstmr_function & ~0x80) ==
2883 	    BHSTMR_FUNCTION_ABORT_TASK) {
2884 		/*
2885 		 * Make sure we no longer wait for Data-Out for this command.
2886 		 */
2887 		CFISCSI_SESSION_LOCK(cs);
2888 		TAILQ_FOREACH_SAFE(cdw,
2889 		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2890 			if (bhstmr->bhstmr_referenced_task_tag !=
2891 			    cdw->cdw_initiator_task_tag)
2892 				continue;
2893 
2894 #if 0
2895 			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2896 			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2897 #endif
2898 			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2899 			    cdw, cdw_next);
2900 			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2901 			cfiscsi_data_wait_free(cs, cdw);
2902 		}
2903 		CFISCSI_SESSION_UNLOCK(cs);
2904 	}
2905 
2906 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2907 	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2908 	    response->ip_bhs;
2909 	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2910 	bhstmr2->bhstmr_flags = 0x80;
2911 	if (io->io_hdr.status == CTL_SUCCESS) {
2912 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2913 	} else {
2914 		/*
2915 		 * XXX: How to figure out what exactly went wrong?  iSCSI spec
2916 		 * 	expects us to provide detailed error, e.g. "Task does
2917 		 * 	not exist" or "LUN does not exist".
2918 		 */
2919 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED");
2920 		bhstmr2->bhstmr_response =
2921 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2922 	}
2923 	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2924 
2925 	ctl_free_io(io);
2926 	icl_pdu_free(request);
2927 	cfiscsi_pdu_queue(response);
2928 }
2929 
2930 static void
2931 cfiscsi_done(union ctl_io *io)
2932 {
2933 	struct icl_pdu *request;
2934 	struct cfiscsi_session *cs;
2935 
2936 	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2937 		("invalid CTL status %#x", io->io_hdr.status));
2938 
2939 	if (io->io_hdr.io_type == CTL_IO_TASK &&
2940 	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
2941 		/*
2942 		 * Implicit task termination has just completed; nothing to do.
2943 		 */
2944 		cs = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2945 		cs->cs_tasks_aborted = true;
2946 		refcount_release(&cs->cs_outstanding_ctl_pdus);
2947 		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
2948 		ctl_free_io(io);
2949 		return;
2950 	}
2951 
2952 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2953 	cs = PDU_SESSION(request);
2954 	refcount_release(&cs->cs_outstanding_ctl_pdus);
2955 
2956 	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2957 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2958 		cfiscsi_scsi_command_done(io);
2959 		break;
2960 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2961 		cfiscsi_task_management_done(io);
2962 		break;
2963 	default:
2964 		panic("cfiscsi_done called with wrong opcode 0x%x",
2965 		    request->ip_bhs->bhs_opcode);
2966 	}
2967 }
2968