xref: /freebsd/sys/cam/ctl/ctl_frontend_iscsi.c (revision bd81e07d2761cf1c13063eb49a5c0cb4a6951318)
1 /*-
2  * Copyright (c) 2012 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Edward Tomasz Napierala under sponsorship
6  * from the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * CTL frontend for the iSCSI protocol.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/capsicum.h>
41 #include <sys/condvar.h>
42 #include <sys/file.h>
43 #include <sys/kernel.h>
44 #include <sys/kthread.h>
45 #include <sys/lock.h>
46 #include <sys/malloc.h>
47 #include <sys/module.h>
48 #include <sys/mutex.h>
49 #include <sys/queue.h>
50 #include <sys/sbuf.h>
51 #include <sys/sysctl.h>
52 #include <sys/systm.h>
53 #include <sys/uio.h>
54 #include <sys/unistd.h>
55 #include <vm/uma.h>
56 
57 #include <cam/scsi/scsi_all.h>
58 #include <cam/scsi/scsi_da.h>
59 #include <cam/ctl/ctl_io.h>
60 #include <cam/ctl/ctl.h>
61 #include <cam/ctl/ctl_backend.h>
62 #include <cam/ctl/ctl_error.h>
63 #include <cam/ctl/ctl_frontend.h>
64 #include <cam/ctl/ctl_debug.h>
65 #include <cam/ctl/ctl_ha.h>
66 #include <cam/ctl/ctl_ioctl.h>
67 #include <cam/ctl/ctl_private.h>
68 
69 #include <dev/iscsi/icl.h>
70 #include <dev/iscsi/icl_wrappers.h>
71 #include <dev/iscsi/iscsi_proto.h>
72 #include <cam/ctl/ctl_frontend_iscsi.h>
73 
74 #ifdef ICL_KERNEL_PROXY
75 #include <sys/socketvar.h>
76 #endif
77 
78 #ifdef ICL_KERNEL_PROXY
79 FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
80 #endif
81 
82 static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
83 static uma_zone_t cfiscsi_data_wait_zone;
84 
85 SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
86     "CAM Target Layer iSCSI Frontend");
87 static int debug = 1;
88 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
89     &debug, 1, "Enable debug messages");
90 static int ping_timeout = 5;
91 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
92     &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
93 static int login_timeout = 60;
94 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
95     &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
96 static int maxcmdsn_delta = 256;
97 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
98     &maxcmdsn_delta, 256, "Number of commands the initiator can send "
99     "without confirmation");
100 
101 #define	CFISCSI_DEBUG(X, ...)						\
102 	do {								\
103 		if (debug > 1) {					\
104 			printf("%s: " X "\n",				\
105 			    __func__, ## __VA_ARGS__);			\
106 		}							\
107 	} while (0)
108 
109 #define	CFISCSI_WARN(X, ...)						\
110 	do {								\
111 		if (debug > 0) {					\
112 			printf("WARNING: %s: " X "\n",			\
113 			    __func__, ## __VA_ARGS__);			\
114 		}							\
115 	} while (0)
116 
117 #define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
118 	do {								\
119 		if (debug > 1) {					\
120 			printf("%s: %s (%s): " X "\n",			\
121 			    __func__, S->cs_initiator_addr,		\
122 			    S->cs_initiator_name, ## __VA_ARGS__);	\
123 		}							\
124 	} while (0)
125 
126 #define	CFISCSI_SESSION_WARN(S, X, ...)					\
127 	do  {								\
128 		if (debug > 0) {					\
129 			printf("WARNING: %s (%s): " X "\n",		\
130 			    S->cs_initiator_addr,			\
131 			    S->cs_initiator_name, ## __VA_ARGS__);	\
132 		}							\
133 	} while (0)
134 
135 #define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
136 #define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
137 #define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
138 
139 #define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
140 #define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
141 #define	PDU_EXPDATASN(X)		(X)->ip_prv0
142 #define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
143 #define	PDU_R2TSN(X)			(X)->ip_prv2
144 
145 int		cfiscsi_init(void);
146 static void	cfiscsi_online(void *arg);
147 static void	cfiscsi_offline(void *arg);
148 static int	cfiscsi_info(void *arg, struct sbuf *sb);
149 static int	cfiscsi_lun_enable(void *arg, int lun_id);
150 static int	cfiscsi_lun_disable(void *arg, int lun_id);
151 static int	cfiscsi_ioctl(struct cdev *dev,
152 		    u_long cmd, caddr_t addr, int flag, struct thread *td);
153 static void	cfiscsi_datamove(union ctl_io *io);
154 static void	cfiscsi_datamove_in(union ctl_io *io);
155 static void	cfiscsi_datamove_out(union ctl_io *io);
156 static void	cfiscsi_done(union ctl_io *io);
157 static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
158 static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
159 static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
160 static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
161 static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
162 static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
163 static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
164 static struct cfiscsi_data_wait	*cfiscsi_data_wait_new(
165 		    struct cfiscsi_session *cs, union ctl_io *io,
166 		    uint32_t initiator_task_tag,
167 		    uint32_t *target_transfer_tagp);
168 static void	cfiscsi_data_wait_free(struct cfiscsi_session *cs,
169 		    struct cfiscsi_data_wait *cdw);
170 static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
171 		    *softc, const char *name, uint16_t tag);
172 static struct cfiscsi_target	*cfiscsi_target_find_or_create(
173     struct cfiscsi_softc *softc, const char *name, const char *alias,
174     uint16_t tag);
175 static void	cfiscsi_target_release(struct cfiscsi_target *ct);
176 static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
177 
178 static struct cfiscsi_softc cfiscsi_softc;
179 extern struct ctl_softc *control_softc;
180 
181 static struct ctl_frontend cfiscsi_frontend =
182 {
183 	.name = "iscsi",
184 	.init = cfiscsi_init,
185 	.ioctl = cfiscsi_ioctl,
186 };
187 CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
188 MODULE_DEPEND(ctlcfiscsi, icl, 1, 1, 1);
189 
190 static struct icl_pdu *
191 cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
192 {
193 
194 	return (icl_pdu_new(request->ip_conn, flags));
195 }
196 
197 static bool
198 cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
199 {
200 	const struct iscsi_bhs_scsi_command *bhssc;
201 	struct cfiscsi_session *cs;
202 	uint32_t cmdsn, expstatsn;
203 
204 	cs = PDU_SESSION(request);
205 
206 	/*
207 	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
208 	 * The purpose of the timeout is to reset the connection when it stalls;
209 	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
210 	 * in some queue.
211 	 *
212 	 * XXX: Locking?
213 	 */
214 	cs->cs_timeout = 0;
215 
216 	/*
217 	 * Data-Out PDUs don't contain CmdSN.
218 	 */
219 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
220 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
221 		return (false);
222 
223 	/*
224 	 * We're only using fields common for all the request
225 	 * (initiator -> target) PDUs.
226 	 */
227 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
228 	cmdsn = ntohl(bhssc->bhssc_cmdsn);
229 	expstatsn = ntohl(bhssc->bhssc_expstatsn);
230 
231 	CFISCSI_SESSION_LOCK(cs);
232 #if 0
233 	if (expstatsn != cs->cs_statsn) {
234 		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
235 		    "while current StatSN is %d", expstatsn,
236 		    cs->cs_statsn);
237 	}
238 #endif
239 
240 	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0) {
241 		/*
242 		 * The target MUST silently ignore any non-immediate command
243 		 * outside of this range.
244 		 */
245 		if (ISCSI_SNLT(cmdsn, cs->cs_cmdsn) ||
246 		    ISCSI_SNGT(cmdsn, cs->cs_cmdsn + maxcmdsn_delta)) {
247 			CFISCSI_SESSION_UNLOCK(cs);
248 			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
249 			    "while expected %u", cmdsn, cs->cs_cmdsn);
250 			return (true);
251 		}
252 
253 		/*
254 		 * We don't support multiple connections now, so any
255 		 * discontinuity in CmdSN means lost PDUs.  Since we don't
256 		 * support PDU retransmission -- terminate the connection.
257 		 */
258 		if (cmdsn != cs->cs_cmdsn) {
259 			CFISCSI_SESSION_UNLOCK(cs);
260 			CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
261 			    "while expected %u; dropping connection",
262 			    cmdsn, cs->cs_cmdsn);
263 			cfiscsi_session_terminate(cs);
264 			return (true);
265 		}
266 		cs->cs_cmdsn++;
267 	}
268 
269 	CFISCSI_SESSION_UNLOCK(cs);
270 
271 	return (false);
272 }
273 
274 static void
275 cfiscsi_pdu_handle(struct icl_pdu *request)
276 {
277 	struct cfiscsi_session *cs;
278 	bool ignore;
279 
280 	cs = PDU_SESSION(request);
281 
282 	ignore = cfiscsi_pdu_update_cmdsn(request);
283 	if (ignore) {
284 		icl_pdu_free(request);
285 		return;
286 	}
287 
288 	/*
289 	 * Handle the PDU; this includes e.g. receiving the remaining
290 	 * part of PDU and submitting the SCSI command to CTL
291 	 * or queueing a reply.  The handling routine is responsible
292 	 * for freeing the PDU when it's no longer needed.
293 	 */
294 	switch (request->ip_bhs->bhs_opcode &
295 	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
296 	case ISCSI_BHS_OPCODE_NOP_OUT:
297 		cfiscsi_pdu_handle_nop_out(request);
298 		break;
299 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
300 		cfiscsi_pdu_handle_scsi_command(request);
301 		break;
302 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
303 		cfiscsi_pdu_handle_task_request(request);
304 		break;
305 	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
306 		cfiscsi_pdu_handle_data_out(request);
307 		break;
308 	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
309 		cfiscsi_pdu_handle_logout_request(request);
310 		break;
311 	default:
312 		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
313 		    "opcode 0x%x; dropping connection",
314 		    request->ip_bhs->bhs_opcode);
315 		icl_pdu_free(request);
316 		cfiscsi_session_terminate(cs);
317 	}
318 
319 }
320 
321 static void
322 cfiscsi_receive_callback(struct icl_pdu *request)
323 {
324 	struct cfiscsi_session *cs;
325 
326 	cs = PDU_SESSION(request);
327 
328 #ifdef ICL_KERNEL_PROXY
329 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
330 		if (cs->cs_login_pdu == NULL)
331 			cs->cs_login_pdu = request;
332 		else
333 			icl_pdu_free(request);
334 		cv_signal(&cs->cs_login_cv);
335 		return;
336 	}
337 #endif
338 
339 	cfiscsi_pdu_handle(request);
340 }
341 
342 static void
343 cfiscsi_error_callback(struct icl_conn *ic)
344 {
345 	struct cfiscsi_session *cs;
346 
347 	cs = CONN_SESSION(ic);
348 
349 	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
350 	cfiscsi_session_terminate(cs);
351 }
352 
353 static int
354 cfiscsi_pdu_prepare(struct icl_pdu *response)
355 {
356 	struct cfiscsi_session *cs;
357 	struct iscsi_bhs_scsi_response *bhssr;
358 	bool advance_statsn = true;
359 
360 	cs = PDU_SESSION(response);
361 
362 	CFISCSI_SESSION_LOCK_ASSERT(cs);
363 
364 	/*
365 	 * We're only using fields common for all the response
366 	 * (target -> initiator) PDUs.
367 	 */
368 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
369 
370 	/*
371 	 * 10.8.3: "The StatSN for this connection is not advanced
372 	 * after this PDU is sent."
373 	 */
374 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
375 		advance_statsn = false;
376 
377 	/*
378 	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
379 	 * StatSN for the connection is not advanced after this PDU is sent."
380 	 */
381 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
382 	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
383 		advance_statsn = false;
384 
385 	/*
386 	 * See the comment below - StatSN is not meaningful and must
387 	 * not be advanced.
388 	 */
389 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN &&
390 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S) == 0)
391 		advance_statsn = false;
392 
393 	/*
394 	 * 10.7.3: "The fields StatSN, Status, and Residual Count
395 	 * only have meaningful content if the S bit is set to 1."
396 	 */
397 	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
398 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S))
399 		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
400 	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
401 	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
402 
403 	if (advance_statsn)
404 		cs->cs_statsn++;
405 
406 	return (0);
407 }
408 
409 static void
410 cfiscsi_pdu_queue(struct icl_pdu *response)
411 {
412 	struct cfiscsi_session *cs;
413 
414 	cs = PDU_SESSION(response);
415 
416 	CFISCSI_SESSION_LOCK(cs);
417 	cfiscsi_pdu_prepare(response);
418 	icl_pdu_queue(response);
419 	CFISCSI_SESSION_UNLOCK(cs);
420 }
421 
422 static uint32_t
423 cfiscsi_decode_lun(uint64_t encoded)
424 {
425 	uint8_t lun[8];
426 	uint32_t result;
427 
428 	/*
429 	 * The LUN field in iSCSI PDUs may look like an ordinary 64 bit number,
430 	 * but is in fact an evil, multidimensional structure defined
431 	 * in SCSI Architecture Model 5 (SAM-5), section 4.6.
432 	 */
433 	memcpy(lun, &encoded, sizeof(lun));
434 	switch (lun[0] & 0xC0) {
435 	case 0x00:
436 		if ((lun[0] & 0x3f) != 0 || lun[2] != 0 || lun[3] != 0 ||
437 		    lun[4] != 0 || lun[5] != 0 || lun[6] != 0 || lun[7] != 0) {
438 			CFISCSI_WARN("malformed LUN "
439 			    "(peripheral device addressing method): 0x%jx",
440 			    (uintmax_t)encoded);
441 			result = 0xffffffff;
442 			break;
443 		}
444 		result = lun[1];
445 		break;
446 	case 0x40:
447 		if (lun[2] != 0 || lun[3] != 0 || lun[4] != 0 || lun[5] != 0 ||
448 		    lun[6] != 0 || lun[7] != 0) {
449 			CFISCSI_WARN("malformed LUN "
450 			    "(flat address space addressing method): 0x%jx",
451 			    (uintmax_t)encoded);
452 			result = 0xffffffff;
453 			break;
454 		}
455 		result = ((lun[0] & 0x3f) << 8) + lun[1];
456 		break;
457 	case 0xC0:
458 		if (lun[0] != 0xD2 || lun[4] != 0 || lun[5] != 0 ||
459 		    lun[6] != 0 || lun[7] != 0) {
460 			CFISCSI_WARN("malformed LUN (extended flat "
461 			    "address space addressing method): 0x%jx",
462 			    (uintmax_t)encoded);
463 			result = 0xffffffff;
464 			break;
465 		}
466 		result = (lun[1] << 16) + (lun[2] << 8) + lun[3];
467 	default:
468 		CFISCSI_WARN("unsupported LUN format 0x%jx",
469 		    (uintmax_t)encoded);
470 		result = 0xffffffff;
471 		break;
472 	}
473 
474 	return (result);
475 }
476 
477 static void
478 cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
479 {
480 	struct cfiscsi_session *cs;
481 	struct iscsi_bhs_nop_out *bhsno;
482 	struct iscsi_bhs_nop_in *bhsni;
483 	struct icl_pdu *response;
484 	void *data = NULL;
485 	size_t datasize;
486 	int error;
487 
488 	cs = PDU_SESSION(request);
489 	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
490 
491 	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
492 		/*
493 		 * Nothing to do, iscsi_pdu_update_statsn() already
494 		 * zeroed the timeout.
495 		 */
496 		icl_pdu_free(request);
497 		return;
498 	}
499 
500 	datasize = icl_pdu_data_segment_length(request);
501 	if (datasize > 0) {
502 		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
503 		if (data == NULL) {
504 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
505 			    "dropping connection");
506 			icl_pdu_free(request);
507 			cfiscsi_session_terminate(cs);
508 			return;
509 		}
510 		icl_pdu_get_data(request, 0, data, datasize);
511 	}
512 
513 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
514 	if (response == NULL) {
515 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
516 		    "droppping connection");
517 		free(data, M_CFISCSI);
518 		icl_pdu_free(request);
519 		cfiscsi_session_terminate(cs);
520 		return;
521 	}
522 	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
523 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
524 	bhsni->bhsni_flags = 0x80;
525 	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
526 	bhsni->bhsni_target_transfer_tag = 0xffffffff;
527 	if (datasize > 0) {
528 		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
529 		if (error != 0) {
530 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
531 			    "dropping connection");
532 			free(data, M_CFISCSI);
533 			icl_pdu_free(request);
534 			icl_pdu_free(response);
535 			cfiscsi_session_terminate(cs);
536 			return;
537 		}
538 		free(data, M_CFISCSI);
539 	}
540 
541 	icl_pdu_free(request);
542 	cfiscsi_pdu_queue(response);
543 }
544 
545 static void
546 cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
547 {
548 	struct iscsi_bhs_scsi_command *bhssc;
549 	struct cfiscsi_session *cs;
550 	union ctl_io *io;
551 	int error;
552 
553 	cs = PDU_SESSION(request);
554 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
555 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
556 	//    bhssc->bhssc_initiator_task_tag);
557 
558 	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
559 		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
560 		    "ImmediateData=No; dropping connection");
561 		icl_pdu_free(request);
562 		cfiscsi_session_terminate(cs);
563 		return;
564 	}
565 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
566 	ctl_zero_io(io);
567 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
568 	io->io_hdr.io_type = CTL_IO_SCSI;
569 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
570 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
571 	io->io_hdr.nexus.targ_target.id = 0;
572 	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhssc->bhssc_lun);
573 	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
574 	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
575 	case BHSSC_FLAGS_ATTR_UNTAGGED:
576 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
577 		break;
578 	case BHSSC_FLAGS_ATTR_SIMPLE:
579 		io->scsiio.tag_type = CTL_TAG_SIMPLE;
580 		break;
581 	case BHSSC_FLAGS_ATTR_ORDERED:
582         	io->scsiio.tag_type = CTL_TAG_ORDERED;
583 		break;
584 	case BHSSC_FLAGS_ATTR_HOQ:
585         	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
586 		break;
587 	case BHSSC_FLAGS_ATTR_ACA:
588 		io->scsiio.tag_type = CTL_TAG_ACA;
589 		break;
590 	default:
591 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
592 		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
593 		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
594 		break;
595 	}
596 	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
597 	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
598 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
599 	error = ctl_queue(io);
600 	if (error != CTL_RETVAL_COMPLETE) {
601 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
602 		    "dropping connection", error);
603 		ctl_free_io(io);
604 		refcount_release(&cs->cs_outstanding_ctl_pdus);
605 		icl_pdu_free(request);
606 		cfiscsi_session_terminate(cs);
607 	}
608 }
609 
610 static void
611 cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
612 {
613 	struct iscsi_bhs_task_management_request *bhstmr;
614 	struct iscsi_bhs_task_management_response *bhstmr2;
615 	struct icl_pdu *response;
616 	struct cfiscsi_session *cs;
617 	union ctl_io *io;
618 	int error;
619 
620 	cs = PDU_SESSION(request);
621 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
622 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
623 	ctl_zero_io(io);
624 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
625 	io->io_hdr.io_type = CTL_IO_TASK;
626 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
627 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
628 	io->io_hdr.nexus.targ_target.id = 0;
629 	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhstmr->bhstmr_lun);
630 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
631 
632 	switch (bhstmr->bhstmr_function & ~0x80) {
633 	case BHSTMR_FUNCTION_ABORT_TASK:
634 #if 0
635 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
636 #endif
637 		io->taskio.task_action = CTL_TASK_ABORT_TASK;
638 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
639 		break;
640 	case BHSTMR_FUNCTION_ABORT_TASK_SET:
641 #if 0
642 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
643 #endif
644 		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
645 		break;
646 	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
647 #if 0
648 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
649 #endif
650 		io->taskio.task_action = CTL_TASK_LUN_RESET;
651 		break;
652 	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
653 #if 0
654 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
655 #endif
656 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
657 		break;
658 	default:
659 		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
660 		    bhstmr->bhstmr_function & ~0x80);
661 		ctl_free_io(io);
662 
663 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
664 		if (response == NULL) {
665 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
666 			    "dropping connection");
667 			icl_pdu_free(request);
668 			cfiscsi_session_terminate(cs);
669 			return;
670 		}
671 		bhstmr2 = (struct iscsi_bhs_task_management_response *)
672 		    response->ip_bhs;
673 		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
674 		bhstmr2->bhstmr_flags = 0x80;
675 		bhstmr2->bhstmr_response =
676 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
677 		bhstmr2->bhstmr_initiator_task_tag =
678 		    bhstmr->bhstmr_initiator_task_tag;
679 		icl_pdu_free(request);
680 		cfiscsi_pdu_queue(response);
681 		return;
682 	}
683 
684 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
685 	error = ctl_queue(io);
686 	if (error != CTL_RETVAL_COMPLETE) {
687 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
688 		    "dropping connection", error);
689 		ctl_free_io(io);
690 		refcount_release(&cs->cs_outstanding_ctl_pdus);
691 		icl_pdu_free(request);
692 		cfiscsi_session_terminate(cs);
693 	}
694 }
695 
696 static bool
697 cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
698 {
699 	struct iscsi_bhs_data_out *bhsdo;
700 	struct cfiscsi_session *cs;
701 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
702 	size_t copy_len, len, off, buffer_offset;
703 	int ctl_sg_count;
704 	union ctl_io *io;
705 
706 	cs = PDU_SESSION(request);
707 
708 	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
709 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
710 	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
711 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
712 	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
713 
714 	/*
715 	 * We're only using fields common for Data-Out and SCSI Command PDUs.
716 	 */
717 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
718 
719 	io = cdw->cdw_ctl_io;
720 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
721 	    ("CTL_FLAG_DATA_IN"));
722 
723 #if 0
724 	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
725 	    request->ip_data_len, io->scsiio.kern_total_len);
726 #endif
727 
728 	if (io->scsiio.kern_sg_entries > 0) {
729 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
730 		ctl_sg_count = io->scsiio.kern_sg_entries;
731 	} else {
732 		ctl_sglist = &ctl_sg_entry;
733 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
734 		ctl_sglist->len = io->scsiio.kern_data_len;
735 		ctl_sg_count = 1;
736 	}
737 
738 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
739 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
740 		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
741 	else
742 		buffer_offset = 0;
743 	len = icl_pdu_data_segment_length(request);
744 
745 	/*
746 	 * Make sure the offset, as sent by the initiator, matches the offset
747 	 * we're supposed to be at in the scatter-gather list.
748 	 */
749 	if (buffer_offset >
750 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
751 	    buffer_offset + len <=
752 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
753 		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
754 		    "expected %zd; dropping connection", buffer_offset,
755 		    (size_t)io->scsiio.kern_rel_offset +
756 		    (size_t)io->scsiio.ext_data_filled);
757 		ctl_set_data_phase_error(&io->scsiio);
758 		cfiscsi_session_terminate(cs);
759 		return (true);
760 	}
761 
762 	/*
763 	 * This is the offset within the PDU data segment, as opposed
764 	 * to buffer_offset, which is the offset within the task (SCSI
765 	 * command).
766 	 */
767 	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
768 	    buffer_offset;
769 
770 	/*
771 	 * Iterate over the scatter/gather segments, filling them with data
772 	 * from the PDU data segment.  Note that this can get called multiple
773 	 * times for one SCSI command; the cdw structure holds state for the
774 	 * scatter/gather list.
775 	 */
776 	for (;;) {
777 		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
778 		    ("cdw->cdw_sg_index >= ctl_sg_count"));
779 		if (cdw->cdw_sg_len == 0) {
780 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
781 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
782 		}
783 		KASSERT(off <= len, ("len > off"));
784 		copy_len = len - off;
785 		if (copy_len > cdw->cdw_sg_len)
786 			copy_len = cdw->cdw_sg_len;
787 
788 		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
789 		cdw->cdw_sg_addr += copy_len;
790 		cdw->cdw_sg_len -= copy_len;
791 		off += copy_len;
792 		io->scsiio.ext_data_filled += copy_len;
793 
794 		if (cdw->cdw_sg_len == 0) {
795 			/*
796 			 * End of current segment.
797 			 */
798 			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
799 				/*
800 				 * Last segment in scatter/gather list.
801 				 */
802 				break;
803 			}
804 			cdw->cdw_sg_index++;
805 		}
806 
807 		if (off == len) {
808 			/*
809 			 * End of PDU payload.
810 			 */
811 			break;
812 		}
813 	}
814 
815 	if (len > off) {
816 		/*
817 		 * In case of unsolicited data, it's possible that the buffer
818 		 * provided by CTL is smaller than negotiated FirstBurstLength.
819 		 * Just ignore the superfluous data; will ask for them with R2T
820 		 * on next call to cfiscsi_datamove().
821 		 *
822 		 * This obviously can only happen with SCSI Command PDU.
823 		 */
824 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
825 		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
826 			return (true);
827 
828 		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
829 		    "expected %zd; dropping connection",
830 		    icl_pdu_data_segment_length(request), off);
831 		ctl_set_data_phase_error(&io->scsiio);
832 		cfiscsi_session_terminate(cs);
833 		return (true);
834 	}
835 
836 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
837 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
838 		CFISCSI_SESSION_WARN(cs, "got the final packet without "
839 		    "the F flag; flags = 0x%x; dropping connection",
840 		    bhsdo->bhsdo_flags);
841 		ctl_set_data_phase_error(&io->scsiio);
842 		cfiscsi_session_terminate(cs);
843 		return (true);
844 	}
845 
846 	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
847 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
848 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
849 		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
850 			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
851 			    "transmitted size was %zd bytes instead of %d; "
852 			    "dropping connection",
853 			    (size_t)io->scsiio.ext_data_filled,
854 			    cdw->cdw_r2t_end);
855 			ctl_set_data_phase_error(&io->scsiio);
856 			cfiscsi_session_terminate(cs);
857 			return (true);
858 		} else {
859 			/*
860 			 * For SCSI Command PDU, this just means we need to
861 			 * solicit more data by sending R2T.
862 			 */
863 			return (false);
864 		}
865 	}
866 
867 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
868 #if 0
869 		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
870 		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
871 #endif
872 
873 		return (true);
874 	}
875 
876 	return (false);
877 }
878 
879 static void
880 cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
881 {
882 	struct iscsi_bhs_data_out *bhsdo;
883 	struct cfiscsi_session *cs;
884 	struct cfiscsi_data_wait *cdw = NULL;
885 	union ctl_io *io;
886 	bool done;
887 
888 	cs = PDU_SESSION(request);
889 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
890 
891 	CFISCSI_SESSION_LOCK(cs);
892 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
893 #if 0
894 		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
895 		    "ttt 0x%x, itt 0x%x",
896 		    bhsdo->bhsdo_target_transfer_tag,
897 		    bhsdo->bhsdo_initiator_task_tag,
898 		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
899 #endif
900 		if (bhsdo->bhsdo_target_transfer_tag ==
901 		    cdw->cdw_target_transfer_tag)
902 			break;
903 	}
904 	CFISCSI_SESSION_UNLOCK(cs);
905 	if (cdw == NULL) {
906 		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
907 		    "0x%x, not found; dropping connection",
908 		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
909 		icl_pdu_free(request);
910 		cfiscsi_session_terminate(cs);
911 		return;
912 	}
913 
914 	if (cdw->cdw_datasn != ntohl(bhsdo->bhsdo_datasn)) {
915 		CFISCSI_SESSION_WARN(cs, "received Data-Out PDU with "
916 		    "DataSN %u, while expected %u; dropping connection",
917 		    ntohl(bhsdo->bhsdo_datasn), cdw->cdw_datasn);
918 		icl_pdu_free(request);
919 		cfiscsi_session_terminate(cs);
920 		return;
921 	}
922 	cdw->cdw_datasn++;
923 
924 	io = cdw->cdw_ctl_io;
925 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
926 	    ("CTL_FLAG_DATA_IN"));
927 
928 	done = cfiscsi_handle_data_segment(request, cdw);
929 	if (done) {
930 		CFISCSI_SESSION_LOCK(cs);
931 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
932 		CFISCSI_SESSION_UNLOCK(cs);
933 		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
934 		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
935 		cfiscsi_data_wait_free(cs, cdw);
936 		if (done)
937 			io->scsiio.be_move_done(io);
938 		else
939 			cfiscsi_datamove_out(io);
940 	}
941 
942 	icl_pdu_free(request);
943 }
944 
945 static void
946 cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
947 {
948 	struct iscsi_bhs_logout_request *bhslr;
949 	struct iscsi_bhs_logout_response *bhslr2;
950 	struct icl_pdu *response;
951 	struct cfiscsi_session *cs;
952 
953 	cs = PDU_SESSION(request);
954 	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
955 	switch (bhslr->bhslr_reason & 0x7f) {
956 	case BHSLR_REASON_CLOSE_SESSION:
957 	case BHSLR_REASON_CLOSE_CONNECTION:
958 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
959 		if (response == NULL) {
960 			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
961 			icl_pdu_free(request);
962 			cfiscsi_session_terminate(cs);
963 			return;
964 		}
965 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
966 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
967 		bhslr2->bhslr_flags = 0x80;
968 		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
969 		bhslr2->bhslr_initiator_task_tag =
970 		    bhslr->bhslr_initiator_task_tag;
971 		icl_pdu_free(request);
972 		cfiscsi_pdu_queue(response);
973 		cfiscsi_session_terminate(cs);
974 		break;
975 	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
976 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
977 		if (response == NULL) {
978 			CFISCSI_SESSION_WARN(cs,
979 			    "failed to allocate memory; dropping connection");
980 			icl_pdu_free(request);
981 			cfiscsi_session_terminate(cs);
982 			return;
983 		}
984 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
985 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
986 		bhslr2->bhslr_flags = 0x80;
987 		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
988 		bhslr2->bhslr_initiator_task_tag =
989 		    bhslr->bhslr_initiator_task_tag;
990 		icl_pdu_free(request);
991 		cfiscsi_pdu_queue(response);
992 		break;
993 	default:
994 		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
995 		    bhslr->bhslr_reason);
996 		icl_pdu_free(request);
997 		cfiscsi_session_terminate(cs);
998 		break;
999 	}
1000 }
1001 
1002 static void
1003 cfiscsi_callout(void *context)
1004 {
1005 	struct icl_pdu *cp;
1006 	struct iscsi_bhs_nop_in *bhsni;
1007 	struct cfiscsi_session *cs;
1008 
1009 	cs = context;
1010 
1011 	if (cs->cs_terminating)
1012 		return;
1013 
1014 	callout_schedule(&cs->cs_callout, 1 * hz);
1015 
1016 	atomic_add_int(&cs->cs_timeout, 1);
1017 
1018 #ifdef ICL_KERNEL_PROXY
1019 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1020 		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1021 			CFISCSI_SESSION_WARN(cs, "login timed out after "
1022 			    "%d seconds; dropping connection", cs->cs_timeout);
1023 			cfiscsi_session_terminate(cs);
1024 		}
1025 		return;
1026 	}
1027 #endif
1028 
1029 	if (ping_timeout <= 0) {
1030 		/*
1031 		 * Pings are disabled.  Don't send NOP-In in this case;
1032 		 * user might have disabled pings to work around problems
1033 		 * with certain initiators that can't properly handle
1034 		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1035 		 * triggering reconnection, should the user decide to
1036 		 * reenable them.
1037 		 */
1038 		cs->cs_timeout = 0;
1039 		return;
1040 	}
1041 
1042 	if (cs->cs_timeout >= ping_timeout) {
1043 		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1044 		    "dropping connection",  ping_timeout);
1045 		cfiscsi_session_terminate(cs);
1046 		return;
1047 	}
1048 
1049 	/*
1050 	 * If the ping was reset less than one second ago - which means
1051 	 * that we've received some PDU during the last second - assume
1052 	 * the traffic flows correctly and don't bother sending a NOP-Out.
1053 	 *
1054 	 * (It's 2 - one for one second, and one for incrementing is_timeout
1055 	 * earlier in this routine.)
1056 	 */
1057 	if (cs->cs_timeout < 2)
1058 		return;
1059 
1060 	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1061 	if (cp == NULL) {
1062 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1063 		return;
1064 	}
1065 	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1066 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1067 	bhsni->bhsni_flags = 0x80;
1068 	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1069 
1070 	cfiscsi_pdu_queue(cp);
1071 }
1072 
1073 static struct cfiscsi_data_wait *
1074 cfiscsi_data_wait_new(struct cfiscsi_session *cs, union ctl_io *io,
1075     uint32_t initiator_task_tag, uint32_t *target_transfer_tagp)
1076 {
1077 	struct cfiscsi_data_wait *cdw;
1078 	int error;
1079 
1080 	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
1081 	if (cdw == NULL) {
1082 		CFISCSI_SESSION_WARN(cs,
1083 		    "failed to allocate %zd bytes", sizeof(*cdw));
1084 		return (NULL);
1085 	}
1086 
1087 	error = icl_conn_transfer_setup(cs->cs_conn, io, target_transfer_tagp,
1088 	    &cdw->cdw_icl_prv);
1089 	if (error != 0) {
1090 		CFISCSI_SESSION_WARN(cs,
1091 		    "icl_conn_transfer_setup() failed with error %d", error);
1092 		uma_zfree(cfiscsi_data_wait_zone, cdw);
1093 		return (NULL);
1094 	}
1095 
1096 	cdw->cdw_ctl_io = io;
1097 	cdw->cdw_target_transfer_tag = *target_transfer_tagp;
1098 	cdw->cdw_initiator_task_tag = initiator_task_tag;
1099 
1100 	return (cdw);
1101 }
1102 
1103 static void
1104 cfiscsi_data_wait_free(struct cfiscsi_session *cs,
1105     struct cfiscsi_data_wait *cdw)
1106 {
1107 
1108 	icl_conn_transfer_done(cs->cs_conn, cdw->cdw_icl_prv);
1109 	uma_zfree(cfiscsi_data_wait_zone, cdw);
1110 }
1111 
1112 static void
1113 cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1114 {
1115 	struct cfiscsi_data_wait *cdw;
1116 	union ctl_io *io;
1117 	int error, last, wait;
1118 
1119 	if (cs->cs_target == NULL)
1120 		return;		/* No target yet, so nothing to do. */
1121 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1122 	ctl_zero_io(io);
1123 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = cs;
1124 	io->io_hdr.io_type = CTL_IO_TASK;
1125 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1126 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1127 	io->io_hdr.nexus.targ_target.id = 0;
1128 	io->io_hdr.nexus.targ_lun = 0;
1129 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1130 	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1131 	wait = cs->cs_outstanding_ctl_pdus;
1132 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1133 	error = ctl_queue(io);
1134 	if (error != CTL_RETVAL_COMPLETE) {
1135 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1136 		refcount_release(&cs->cs_outstanding_ctl_pdus);
1137 		ctl_free_io(io);
1138 	}
1139 
1140 	CFISCSI_SESSION_LOCK(cs);
1141 	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1142 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1143 		CFISCSI_SESSION_UNLOCK(cs);
1144 		/*
1145 		 * Set nonzero port status; this prevents backends from
1146 		 * assuming that the data transfer actually succeeded
1147 		 * and writing uninitialized data to disk.
1148 		 */
1149 		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1150 		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1151 		cfiscsi_data_wait_free(cs, cdw);
1152 		CFISCSI_SESSION_LOCK(cs);
1153 	}
1154 	CFISCSI_SESSION_UNLOCK(cs);
1155 
1156 	/*
1157 	 * Wait for CTL to terminate all the tasks.
1158 	 */
1159 	if (wait > 0)
1160 		CFISCSI_SESSION_WARN(cs,
1161 		    "waiting for CTL to terminate %d tasks", wait);
1162 	for (;;) {
1163 		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1164 		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1165 		if (last != 0)
1166 			break;
1167 		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1168 		    0, "cfiscsi_terminate", hz / 100);
1169 	}
1170 	if (wait > 0)
1171 		CFISCSI_SESSION_WARN(cs, "tasks terminated");
1172 }
1173 
1174 static void
1175 cfiscsi_maintenance_thread(void *arg)
1176 {
1177 	struct cfiscsi_session *cs;
1178 
1179 	cs = arg;
1180 
1181 	for (;;) {
1182 		CFISCSI_SESSION_LOCK(cs);
1183 		if (cs->cs_terminating == false)
1184 			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1185 		CFISCSI_SESSION_UNLOCK(cs);
1186 
1187 		if (cs->cs_terminating) {
1188 
1189 			/*
1190 			 * We used to wait up to 30 seconds to deliver queued
1191 			 * PDUs to the initiator.  We also tried hard to deliver
1192 			 * SCSI Responses for the aborted PDUs.  We don't do
1193 			 * that anymore.  We might need to revisit that.
1194 			 */
1195 			callout_drain(&cs->cs_callout);
1196 			icl_conn_close(cs->cs_conn);
1197 
1198 			/*
1199 			 * At this point ICL receive thread is no longer
1200 			 * running; no new tasks can be queued.
1201 			 */
1202 			cfiscsi_session_terminate_tasks(cs);
1203 			cfiscsi_session_delete(cs);
1204 			kthread_exit();
1205 			return;
1206 		}
1207 		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1208 	}
1209 }
1210 
1211 static void
1212 cfiscsi_session_terminate(struct cfiscsi_session *cs)
1213 {
1214 
1215 	if (cs->cs_terminating)
1216 		return;
1217 	cs->cs_terminating = true;
1218 	cv_signal(&cs->cs_maintenance_cv);
1219 #ifdef ICL_KERNEL_PROXY
1220 	cv_signal(&cs->cs_login_cv);
1221 #endif
1222 }
1223 
1224 static int
1225 cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1226 {
1227 	struct cfiscsi_target *ct;
1228 	char *name;
1229 	int i;
1230 
1231 	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1232 
1233 	ct = cs->cs_target;
1234 	name = strdup(cs->cs_initiator_id, M_CTL);
1235 	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1236 	if (i < 0) {
1237 		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1238 		    i);
1239 		cs->cs_ctl_initid = -1;
1240 		return (1);
1241 	}
1242 	cs->cs_ctl_initid = i;
1243 #if 0
1244 	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1245 #endif
1246 
1247 	return (0);
1248 }
1249 
1250 static void
1251 cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1252 {
1253 	int error;
1254 
1255 	if (cs->cs_ctl_initid == -1)
1256 		return;
1257 
1258 	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1259 	if (error != 0) {
1260 		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1261 		    error);
1262 	}
1263 	cs->cs_ctl_initid = -1;
1264 }
1265 
1266 static struct cfiscsi_session *
1267 cfiscsi_session_new(struct cfiscsi_softc *softc, const char *offload)
1268 {
1269 	struct cfiscsi_session *cs;
1270 	int error;
1271 
1272 	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1273 	if (cs == NULL) {
1274 		CFISCSI_WARN("malloc failed");
1275 		return (NULL);
1276 	}
1277 	cs->cs_ctl_initid = -1;
1278 
1279 	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1280 	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1281 	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1282 	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1283 #ifdef ICL_KERNEL_PROXY
1284 	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1285 #endif
1286 
1287 	cs->cs_conn = icl_new_conn(offload, "cfiscsi", &cs->cs_lock);
1288 	if (cs->cs_conn == NULL) {
1289 		free(cs, M_CFISCSI);
1290 		return (NULL);
1291 	}
1292 	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1293 	cs->cs_conn->ic_error = cfiscsi_error_callback;
1294 	cs->cs_conn->ic_prv0 = cs;
1295 
1296 	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1297 	if (error != 0) {
1298 		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1299 		free(cs, M_CFISCSI);
1300 		return (NULL);
1301 	}
1302 
1303 	mtx_lock(&softc->lock);
1304 	cs->cs_id = ++softc->last_session_id;
1305 	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1306 	mtx_unlock(&softc->lock);
1307 
1308 	/*
1309 	 * Start pinging the initiator.
1310 	 */
1311 	callout_init(&cs->cs_callout, 1);
1312 	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1313 
1314 	return (cs);
1315 }
1316 
1317 static void
1318 cfiscsi_session_delete(struct cfiscsi_session *cs)
1319 {
1320 	struct cfiscsi_softc *softc;
1321 
1322 	softc = &cfiscsi_softc;
1323 
1324 	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1325 	    ("destroying session with outstanding CTL pdus"));
1326 	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1327 	    ("destroying session with non-empty queue"));
1328 
1329 	cfiscsi_session_unregister_initiator(cs);
1330 	if (cs->cs_target != NULL)
1331 		cfiscsi_target_release(cs->cs_target);
1332 	icl_conn_close(cs->cs_conn);
1333 	icl_conn_free(cs->cs_conn);
1334 
1335 	mtx_lock(&softc->lock);
1336 	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1337 	cv_signal(&softc->sessions_cv);
1338 	mtx_unlock(&softc->lock);
1339 
1340 	free(cs, M_CFISCSI);
1341 }
1342 
1343 int
1344 cfiscsi_init(void)
1345 {
1346 	struct cfiscsi_softc *softc;
1347 	int retval;
1348 
1349 	softc = &cfiscsi_softc;
1350 	retval = 0;
1351 	bzero(softc, sizeof(*softc));
1352 	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1353 
1354 	cv_init(&softc->sessions_cv, "cfiscsi_sessions");
1355 #ifdef ICL_KERNEL_PROXY
1356 	cv_init(&softc->accept_cv, "cfiscsi_accept");
1357 #endif
1358 	TAILQ_INIT(&softc->sessions);
1359 	TAILQ_INIT(&softc->targets);
1360 
1361 	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1362 	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1363 	    UMA_ALIGN_PTR, 0);
1364 
1365 	return (0);
1366 }
1367 
1368 #ifdef ICL_KERNEL_PROXY
1369 static void
1370 cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1371 {
1372 	struct cfiscsi_session *cs;
1373 
1374 	cs = cfiscsi_session_new(&cfiscsi_softc, NULL);
1375 	if (cs == NULL) {
1376 		CFISCSI_WARN("failed to create session");
1377 		return;
1378 	}
1379 
1380 	icl_conn_handoff_sock(cs->cs_conn, so);
1381 	cs->cs_initiator_sa = sa;
1382 	cs->cs_portal_id = portal_id;
1383 	cs->cs_waiting_for_ctld = true;
1384 	cv_signal(&cfiscsi_softc.accept_cv);
1385 }
1386 #endif
1387 
1388 static void
1389 cfiscsi_online(void *arg)
1390 {
1391 	struct cfiscsi_softc *softc;
1392 	struct cfiscsi_target *ct;
1393 	int online;
1394 
1395 	ct = (struct cfiscsi_target *)arg;
1396 	softc = ct->ct_softc;
1397 
1398 	mtx_lock(&softc->lock);
1399 	if (ct->ct_online) {
1400 		mtx_unlock(&softc->lock);
1401 		return;
1402 	}
1403 	ct->ct_online = 1;
1404 	online = softc->online++;
1405 	mtx_unlock(&softc->lock);
1406 	if (online > 0)
1407 		return;
1408 
1409 #ifdef ICL_KERNEL_PROXY
1410 	if (softc->listener != NULL)
1411 		icl_listen_free(softc->listener);
1412 	softc->listener = icl_listen_new(cfiscsi_accept);
1413 #endif
1414 }
1415 
1416 static void
1417 cfiscsi_offline(void *arg)
1418 {
1419 	struct cfiscsi_softc *softc;
1420 	struct cfiscsi_target *ct;
1421 	struct cfiscsi_session *cs;
1422 	int online;
1423 
1424 	ct = (struct cfiscsi_target *)arg;
1425 	softc = ct->ct_softc;
1426 
1427 	mtx_lock(&softc->lock);
1428 	if (!ct->ct_online) {
1429 		mtx_unlock(&softc->lock);
1430 		return;
1431 	}
1432 	ct->ct_online = 0;
1433 	online = --softc->online;
1434 
1435 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1436 		if (cs->cs_target == ct)
1437 			cfiscsi_session_terminate(cs);
1438 	}
1439 	do {
1440 		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1441 			if (cs->cs_target == ct)
1442 				break;
1443 		}
1444 		if (cs != NULL)
1445 			cv_wait(&softc->sessions_cv, &softc->lock);
1446 	} while (cs != NULL && ct->ct_online == 0);
1447 	mtx_unlock(&softc->lock);
1448 	if (online > 0)
1449 		return;
1450 
1451 #ifdef ICL_KERNEL_PROXY
1452 	icl_listen_free(softc->listener);
1453 	softc->listener = NULL;
1454 #endif
1455 }
1456 
1457 static int
1458 cfiscsi_info(void *arg, struct sbuf *sb)
1459 {
1460 	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1461 	int retval;
1462 
1463 	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1464 	    ct->ct_state);
1465 	return (retval);
1466 }
1467 
1468 static void
1469 cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1470 {
1471 	struct cfiscsi_softc *softc;
1472 	struct cfiscsi_session *cs, *cs2;
1473 	struct cfiscsi_target *ct;
1474 	struct ctl_iscsi_handoff_params *cihp;
1475 	int error;
1476 
1477 	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1478 	softc = &cfiscsi_softc;
1479 
1480 	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1481 	    cihp->initiator_name, cihp->initiator_addr,
1482 	    cihp->target_name);
1483 
1484 	ct = cfiscsi_target_find(softc, cihp->target_name,
1485 	    cihp->portal_group_tag);
1486 	if (ct == NULL) {
1487 		ci->status = CTL_ISCSI_ERROR;
1488 		snprintf(ci->error_str, sizeof(ci->error_str),
1489 		    "%s: target not found", __func__);
1490 		return;
1491 	}
1492 
1493 #ifdef ICL_KERNEL_PROXY
1494 	if (cihp->socket > 0 && cihp->connection_id > 0) {
1495 		snprintf(ci->error_str, sizeof(ci->error_str),
1496 		    "both socket and connection_id set");
1497 		ci->status = CTL_ISCSI_ERROR;
1498 		cfiscsi_target_release(ct);
1499 		return;
1500 	}
1501 	if (cihp->socket == 0) {
1502 		mtx_lock(&cfiscsi_softc.lock);
1503 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1504 			if (cs->cs_id == cihp->connection_id)
1505 				break;
1506 		}
1507 		if (cs == NULL) {
1508 			mtx_unlock(&cfiscsi_softc.lock);
1509 			snprintf(ci->error_str, sizeof(ci->error_str),
1510 			    "connection not found");
1511 			ci->status = CTL_ISCSI_ERROR;
1512 			cfiscsi_target_release(ct);
1513 			return;
1514 		}
1515 		mtx_unlock(&cfiscsi_softc.lock);
1516 	} else {
1517 #endif
1518 		cs = cfiscsi_session_new(softc, cihp->offload);
1519 		if (cs == NULL) {
1520 			ci->status = CTL_ISCSI_ERROR;
1521 			snprintf(ci->error_str, sizeof(ci->error_str),
1522 			    "%s: cfiscsi_session_new failed", __func__);
1523 			cfiscsi_target_release(ct);
1524 			return;
1525 		}
1526 #ifdef ICL_KERNEL_PROXY
1527 	}
1528 #endif
1529 
1530 	/*
1531 	 * First PDU of Full Feature phase has the same CmdSN as the last
1532 	 * PDU from the Login Phase received from the initiator.  Thus,
1533 	 * the -1 below.
1534 	 */
1535 	cs->cs_cmdsn = cihp->cmdsn;
1536 	cs->cs_statsn = cihp->statsn;
1537 	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1538 	cs->cs_max_burst_length = cihp->max_burst_length;
1539 	cs->cs_immediate_data = !!cihp->immediate_data;
1540 	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1541 		cs->cs_conn->ic_header_crc32c = true;
1542 	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1543 		cs->cs_conn->ic_data_crc32c = true;
1544 
1545 	strlcpy(cs->cs_initiator_name,
1546 	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1547 	strlcpy(cs->cs_initiator_addr,
1548 	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1549 	strlcpy(cs->cs_initiator_alias,
1550 	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1551 	memcpy(cs->cs_initiator_isid,
1552 	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1553 	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1554 	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1555 	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1556 	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1557 	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1558 
1559 	mtx_lock(&softc->lock);
1560 	if (ct->ct_online == 0) {
1561 		mtx_unlock(&softc->lock);
1562 		cfiscsi_session_terminate(cs);
1563 		cfiscsi_target_release(ct);
1564 		ci->status = CTL_ISCSI_ERROR;
1565 		snprintf(ci->error_str, sizeof(ci->error_str),
1566 		    "%s: port offline", __func__);
1567 		return;
1568 	}
1569 	cs->cs_target = ct;
1570 	mtx_unlock(&softc->lock);
1571 
1572 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1573 restart:
1574 	if (!cs->cs_terminating) {
1575 		mtx_lock(&softc->lock);
1576 		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1577 			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1578 			    cs->cs_target == cs2->cs_target &&
1579 			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1580 				cfiscsi_session_terminate(cs2);
1581 				mtx_unlock(&softc->lock);
1582 				pause("cfiscsi_reinstate", 1);
1583 				goto restart;
1584 			}
1585 		}
1586 		mtx_unlock(&softc->lock);
1587 	}
1588 
1589 	/*
1590 	 * Register initiator with CTL.
1591 	 */
1592 	cfiscsi_session_register_initiator(cs);
1593 
1594 #ifdef ICL_KERNEL_PROXY
1595 	if (cihp->socket > 0) {
1596 #endif
1597 		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1598 		if (error != 0) {
1599 			cfiscsi_session_terminate(cs);
1600 			refcount_release(&cs->cs_outstanding_ctl_pdus);
1601 			ci->status = CTL_ISCSI_ERROR;
1602 			snprintf(ci->error_str, sizeof(ci->error_str),
1603 			    "%s: icl_conn_handoff failed with error %d",
1604 			    __func__, error);
1605 			return;
1606 		}
1607 #ifdef ICL_KERNEL_PROXY
1608 	}
1609 #endif
1610 
1611 #ifdef ICL_KERNEL_PROXY
1612 	cs->cs_login_phase = false;
1613 
1614 	/*
1615 	 * First PDU of the Full Feature phase has likely already arrived.
1616 	 * We have to pick it up and execute properly.
1617 	 */
1618 	if (cs->cs_login_pdu != NULL) {
1619 		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1620 		cfiscsi_pdu_handle(cs->cs_login_pdu);
1621 		cs->cs_login_pdu = NULL;
1622 	}
1623 #endif
1624 
1625 	refcount_release(&cs->cs_outstanding_ctl_pdus);
1626 	ci->status = CTL_ISCSI_OK;
1627 }
1628 
1629 static void
1630 cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1631 {
1632 	struct ctl_iscsi_list_params *cilp;
1633 	struct cfiscsi_session *cs;
1634 	struct cfiscsi_softc *softc;
1635 	struct sbuf *sb;
1636 	int error;
1637 
1638 	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1639 	softc = &cfiscsi_softc;
1640 
1641 	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1642 	if (sb == NULL) {
1643 		ci->status = CTL_ISCSI_ERROR;
1644 		snprintf(ci->error_str, sizeof(ci->error_str),
1645 		    "Unable to allocate %d bytes for iSCSI session list",
1646 		    cilp->alloc_len);
1647 		return;
1648 	}
1649 
1650 	sbuf_printf(sb, "<ctlislist>\n");
1651 	mtx_lock(&softc->lock);
1652 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1653 #ifdef ICL_KERNEL_PROXY
1654 		if (cs->cs_target == NULL)
1655 			continue;
1656 #endif
1657 		error = sbuf_printf(sb, "<connection id=\"%d\">"
1658 		    "<initiator>%s</initiator>"
1659 		    "<initiator_addr>%s</initiator_addr>"
1660 		    "<initiator_alias>%s</initiator_alias>"
1661 		    "<target>%s</target>"
1662 		    "<target_alias>%s</target_alias>"
1663 		    "<target_portal_group_tag>%u</target_portal_group_tag>"
1664 		    "<header_digest>%s</header_digest>"
1665 		    "<data_digest>%s</data_digest>"
1666 		    "<max_data_segment_length>%zd</max_data_segment_length>"
1667 		    "<immediate_data>%d</immediate_data>"
1668 		    "<iser>%d</iser>"
1669 		    "<offload>%s</offload>"
1670 		    "</connection>\n",
1671 		    cs->cs_id,
1672 		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1673 		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1674 		    cs->cs_target->ct_tag,
1675 		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1676 		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1677 		    cs->cs_max_data_segment_length,
1678 		    cs->cs_immediate_data,
1679 		    cs->cs_conn->ic_iser,
1680 		    cs->cs_conn->ic_offload);
1681 		if (error != 0)
1682 			break;
1683 	}
1684 	mtx_unlock(&softc->lock);
1685 	error = sbuf_printf(sb, "</ctlislist>\n");
1686 	if (error != 0) {
1687 		sbuf_delete(sb);
1688 		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1689 		snprintf(ci->error_str, sizeof(ci->error_str),
1690 		    "Out of space, %d bytes is too small", cilp->alloc_len);
1691 		return;
1692 	}
1693 	sbuf_finish(sb);
1694 
1695 	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1696 	cilp->fill_len = sbuf_len(sb) + 1;
1697 	ci->status = CTL_ISCSI_OK;
1698 	sbuf_delete(sb);
1699 }
1700 
1701 static void
1702 cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1703 {
1704 	struct icl_pdu *response;
1705 	struct iscsi_bhs_asynchronous_message *bhsam;
1706 	struct ctl_iscsi_logout_params *cilp;
1707 	struct cfiscsi_session *cs;
1708 	struct cfiscsi_softc *softc;
1709 	int found = 0;
1710 
1711 	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1712 	softc = &cfiscsi_softc;
1713 
1714 	mtx_lock(&softc->lock);
1715 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1716 		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1717 		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1718 		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1719 			continue;
1720 
1721 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1722 		if (response == NULL) {
1723 			ci->status = CTL_ISCSI_ERROR;
1724 			snprintf(ci->error_str, sizeof(ci->error_str),
1725 			    "Unable to allocate memory");
1726 			mtx_unlock(&softc->lock);
1727 			return;
1728 		}
1729 		bhsam =
1730 		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1731 		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1732 		bhsam->bhsam_flags = 0x80;
1733 		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1734 		bhsam->bhsam_parameter3 = htons(10);
1735 		cfiscsi_pdu_queue(response);
1736 		found++;
1737 	}
1738 	mtx_unlock(&softc->lock);
1739 
1740 	if (found == 0) {
1741 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1742 		snprintf(ci->error_str, sizeof(ci->error_str),
1743 		    "No matching connections found");
1744 		return;
1745 	}
1746 
1747 	ci->status = CTL_ISCSI_OK;
1748 }
1749 
1750 static void
1751 cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1752 {
1753 	struct icl_pdu *response;
1754 	struct iscsi_bhs_asynchronous_message *bhsam;
1755 	struct ctl_iscsi_terminate_params *citp;
1756 	struct cfiscsi_session *cs;
1757 	struct cfiscsi_softc *softc;
1758 	int found = 0;
1759 
1760 	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1761 	softc = &cfiscsi_softc;
1762 
1763 	mtx_lock(&softc->lock);
1764 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1765 		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1766 		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1767 		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1768 			continue;
1769 
1770 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1771 		if (response == NULL) {
1772 			/*
1773 			 * Oh well.  Just terminate the connection.
1774 			 */
1775 		} else {
1776 			bhsam = (struct iscsi_bhs_asynchronous_message *)
1777 			    response->ip_bhs;
1778 			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1779 			bhsam->bhsam_flags = 0x80;
1780 			bhsam->bhsam_0xffffffff = 0xffffffff;
1781 			bhsam->bhsam_async_event =
1782 			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1783 			cfiscsi_pdu_queue(response);
1784 		}
1785 		cfiscsi_session_terminate(cs);
1786 		found++;
1787 	}
1788 	mtx_unlock(&softc->lock);
1789 
1790 	if (found == 0) {
1791 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1792 		snprintf(ci->error_str, sizeof(ci->error_str),
1793 		    "No matching connections found");
1794 		return;
1795 	}
1796 
1797 	ci->status = CTL_ISCSI_OK;
1798 }
1799 
1800 static void
1801 cfiscsi_ioctl_limits(struct ctl_iscsi *ci)
1802 {
1803 	struct ctl_iscsi_limits_params *cilp;
1804 	int error;
1805 
1806 	cilp = (struct ctl_iscsi_limits_params *)&(ci->data);
1807 
1808 	error = icl_limits(cilp->offload, &cilp->data_segment_limit);
1809 	if (error != 0) {
1810 		ci->status = CTL_ISCSI_ERROR;
1811 		snprintf(ci->error_str, sizeof(ci->error_str),
1812 			"%s: icl_limits failed with error %d",
1813 			__func__, error);
1814 		return;
1815 	}
1816 
1817 	ci->status = CTL_ISCSI_OK;
1818 }
1819 
1820 #ifdef ICL_KERNEL_PROXY
1821 static void
1822 cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1823 {
1824 	struct ctl_iscsi_listen_params *cilp;
1825 	struct sockaddr *sa;
1826 	int error;
1827 
1828 	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1829 
1830 	if (cfiscsi_softc.listener == NULL) {
1831 		CFISCSI_DEBUG("no listener");
1832 		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1833 		ci->status = CTL_ISCSI_ERROR;
1834 		return;
1835 	}
1836 
1837 	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1838 	if (error != 0) {
1839 		CFISCSI_DEBUG("getsockaddr, error %d", error);
1840 		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1841 		ci->status = CTL_ISCSI_ERROR;
1842 		return;
1843 	}
1844 
1845 	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1846 	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1847 	if (error != 0) {
1848 		free(sa, M_SONAME);
1849 		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1850 		snprintf(ci->error_str, sizeof(ci->error_str),
1851 		    "icl_listen_add failed, error %d", error);
1852 		ci->status = CTL_ISCSI_ERROR;
1853 		return;
1854 	}
1855 
1856 	ci->status = CTL_ISCSI_OK;
1857 }
1858 
1859 static void
1860 cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1861 {
1862 	struct ctl_iscsi_accept_params *ciap;
1863 	struct cfiscsi_session *cs;
1864 	int error;
1865 
1866 	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1867 
1868 	mtx_lock(&cfiscsi_softc.lock);
1869 	for (;;) {
1870 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1871 			if (cs->cs_waiting_for_ctld)
1872 				break;
1873 		}
1874 		if (cs != NULL)
1875 			break;
1876 		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1877 		if (error != 0) {
1878 			mtx_unlock(&cfiscsi_softc.lock);
1879 			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1880 			ci->status = CTL_ISCSI_ERROR;
1881 			return;
1882 		}
1883 	}
1884 	mtx_unlock(&cfiscsi_softc.lock);
1885 
1886 	cs->cs_waiting_for_ctld = false;
1887 	cs->cs_login_phase = true;
1888 
1889 	ciap->connection_id = cs->cs_id;
1890 	ciap->portal_id = cs->cs_portal_id;
1891 	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1892 	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1893 	    cs->cs_initiator_sa->sa_len);
1894 	if (error != 0) {
1895 		snprintf(ci->error_str, sizeof(ci->error_str),
1896 		    "copyout failed with error %d", error);
1897 		ci->status = CTL_ISCSI_ERROR;
1898 		return;
1899 	}
1900 
1901 	ci->status = CTL_ISCSI_OK;
1902 }
1903 
1904 static void
1905 cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1906 {
1907 	struct ctl_iscsi_send_params *cisp;
1908 	struct cfiscsi_session *cs;
1909 	struct icl_pdu *ip;
1910 	size_t datalen;
1911 	void *data;
1912 	int error;
1913 
1914 	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1915 
1916 	mtx_lock(&cfiscsi_softc.lock);
1917 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1918 		if (cs->cs_id == cisp->connection_id)
1919 			break;
1920 	}
1921 	if (cs == NULL) {
1922 		mtx_unlock(&cfiscsi_softc.lock);
1923 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1924 		ci->status = CTL_ISCSI_ERROR;
1925 		return;
1926 	}
1927 	mtx_unlock(&cfiscsi_softc.lock);
1928 
1929 #if 0
1930 	if (cs->cs_login_phase == false)
1931 		return (EBUSY);
1932 #endif
1933 
1934 	if (cs->cs_terminating) {
1935 		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1936 		ci->status = CTL_ISCSI_ERROR;
1937 		return;
1938 	}
1939 
1940 	datalen = cisp->data_segment_len;
1941 	/*
1942 	 * XXX
1943 	 */
1944 	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1945 	if (datalen > 65535) {
1946 		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1947 		ci->status = CTL_ISCSI_ERROR;
1948 		return;
1949 	}
1950 	if (datalen > 0) {
1951 		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1952 		error = copyin(cisp->data_segment, data, datalen);
1953 		if (error != 0) {
1954 			free(data, M_CFISCSI);
1955 			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1956 			ci->status = CTL_ISCSI_ERROR;
1957 			return;
1958 		}
1959 	}
1960 
1961 	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
1962 	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1963 	if (datalen > 0) {
1964 		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1965 		free(data, M_CFISCSI);
1966 	}
1967 	CFISCSI_SESSION_LOCK(cs);
1968 	icl_pdu_queue(ip);
1969 	CFISCSI_SESSION_UNLOCK(cs);
1970 	ci->status = CTL_ISCSI_OK;
1971 }
1972 
1973 static void
1974 cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1975 {
1976 	struct ctl_iscsi_receive_params *cirp;
1977 	struct cfiscsi_session *cs;
1978 	struct icl_pdu *ip;
1979 	void *data;
1980 	int error;
1981 
1982 	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1983 
1984 	mtx_lock(&cfiscsi_softc.lock);
1985 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1986 		if (cs->cs_id == cirp->connection_id)
1987 			break;
1988 	}
1989 	if (cs == NULL) {
1990 		mtx_unlock(&cfiscsi_softc.lock);
1991 		snprintf(ci->error_str, sizeof(ci->error_str),
1992 		    "connection not found");
1993 		ci->status = CTL_ISCSI_ERROR;
1994 		return;
1995 	}
1996 	mtx_unlock(&cfiscsi_softc.lock);
1997 
1998 #if 0
1999 	if (is->is_login_phase == false)
2000 		return (EBUSY);
2001 #endif
2002 
2003 	CFISCSI_SESSION_LOCK(cs);
2004 	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
2005 		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
2006 		if (error != 0) {
2007 			CFISCSI_SESSION_UNLOCK(cs);
2008 			snprintf(ci->error_str, sizeof(ci->error_str),
2009 			    "interrupted by signal");
2010 			ci->status = CTL_ISCSI_ERROR;
2011 			return;
2012 		}
2013 	}
2014 
2015 	if (cs->cs_terminating) {
2016 		CFISCSI_SESSION_UNLOCK(cs);
2017 		snprintf(ci->error_str, sizeof(ci->error_str),
2018 		    "connection terminating");
2019 		ci->status = CTL_ISCSI_ERROR;
2020 		return;
2021 	}
2022 	ip = cs->cs_login_pdu;
2023 	cs->cs_login_pdu = NULL;
2024 	CFISCSI_SESSION_UNLOCK(cs);
2025 
2026 	if (ip->ip_data_len > cirp->data_segment_len) {
2027 		icl_pdu_free(ip);
2028 		snprintf(ci->error_str, sizeof(ci->error_str),
2029 		    "data segment too big");
2030 		ci->status = CTL_ISCSI_ERROR;
2031 		return;
2032 	}
2033 
2034 	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
2035 	if (ip->ip_data_len > 0) {
2036 		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
2037 		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
2038 		copyout(data, cirp->data_segment, ip->ip_data_len);
2039 		free(data, M_CFISCSI);
2040 	}
2041 
2042 	icl_pdu_free(ip);
2043 	ci->status = CTL_ISCSI_OK;
2044 }
2045 
2046 #endif /* !ICL_KERNEL_PROXY */
2047 
2048 static void
2049 cfiscsi_ioctl_port_create(struct ctl_req *req)
2050 {
2051 	struct cfiscsi_target *ct;
2052 	struct ctl_port *port;
2053 	const char *target, *alias, *tags;
2054 	struct scsi_vpd_id_descriptor *desc;
2055 	ctl_options_t opts;
2056 	int retval, len, idlen;
2057 	uint16_t tag;
2058 
2059 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2060 	target = ctl_get_opt(&opts, "cfiscsi_target");
2061 	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
2062 	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2063 	if (target == NULL || tags == NULL) {
2064 		req->status = CTL_LUN_ERROR;
2065 		snprintf(req->error_str, sizeof(req->error_str),
2066 		    "Missing required argument");
2067 		ctl_free_opts(&opts);
2068 		return;
2069 	}
2070 	tag = strtol(tags, (char **)NULL, 10);
2071 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias, tag);
2072 	if (ct == NULL) {
2073 		req->status = CTL_LUN_ERROR;
2074 		snprintf(req->error_str, sizeof(req->error_str),
2075 		    "failed to create target \"%s\"", target);
2076 		ctl_free_opts(&opts);
2077 		return;
2078 	}
2079 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
2080 		req->status = CTL_LUN_ERROR;
2081 		snprintf(req->error_str, sizeof(req->error_str),
2082 		    "target \"%s\" already exists", target);
2083 		cfiscsi_target_release(ct);
2084 		ctl_free_opts(&opts);
2085 		return;
2086 	}
2087 	port = &ct->ct_port;
2088 	// WAT
2089 	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
2090 		goto done;
2091 
2092 	port->frontend = &cfiscsi_frontend;
2093 	port->port_type = CTL_PORT_ISCSI;
2094 	/* XXX KDM what should the real number be here? */
2095 	port->num_requested_ctl_io = 4096;
2096 	port->port_name = "iscsi";
2097 	port->physical_port = tag;
2098 	port->virtual_port = ct->ct_target_id;
2099 	port->port_online = cfiscsi_online;
2100 	port->port_offline = cfiscsi_offline;
2101 	port->port_info = cfiscsi_info;
2102 	port->onoff_arg = ct;
2103 	port->lun_enable = cfiscsi_lun_enable;
2104 	port->lun_disable = cfiscsi_lun_disable;
2105 	port->targ_lun_arg = ct;
2106 	port->fe_datamove = cfiscsi_datamove;
2107 	port->fe_done = cfiscsi_done;
2108 
2109 	/* XXX KDM what should we report here? */
2110 	/* XXX These should probably be fetched from CTL. */
2111 	port->max_targets = 1;
2112 	port->max_target_id = 15;
2113 
2114 	port->options = opts;
2115 	STAILQ_INIT(&opts);
2116 
2117 	/* Generate Port ID. */
2118 	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2119 	idlen = roundup2(idlen, 4);
2120 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2121 	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2122 	    M_CTL, M_WAITOK | M_ZERO);
2123 	port->port_devid->len = len;
2124 	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2125 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2126 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2127 	    SVPD_ID_TYPE_SCSI_NAME;
2128 	desc->length = idlen;
2129 	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x", target, tag);
2130 
2131 	/* Generate Target ID. */
2132 	idlen = strlen(target) + 1;
2133 	idlen = roundup2(idlen, 4);
2134 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2135 	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2136 	    M_CTL, M_WAITOK | M_ZERO);
2137 	port->target_devid->len = len;
2138 	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2139 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2140 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2141 	    SVPD_ID_TYPE_SCSI_NAME;
2142 	desc->length = idlen;
2143 	strlcpy(desc->identifier, target, idlen);
2144 
2145 	retval = ctl_port_register(port);
2146 	if (retval != 0) {
2147 		ctl_free_opts(&port->options);
2148 		cfiscsi_target_release(ct);
2149 		free(port->port_devid, M_CFISCSI);
2150 		free(port->target_devid, M_CFISCSI);
2151 		req->status = CTL_LUN_ERROR;
2152 		snprintf(req->error_str, sizeof(req->error_str),
2153 		    "ctl_port_register() failed with error %d", retval);
2154 		return;
2155 	}
2156 done:
2157 	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2158 	req->status = CTL_LUN_OK;
2159 	memcpy(req->kern_args[0].kvalue, &port->targ_port,
2160 	    sizeof(port->targ_port)); //XXX
2161 }
2162 
2163 static void
2164 cfiscsi_ioctl_port_remove(struct ctl_req *req)
2165 {
2166 	struct cfiscsi_target *ct;
2167 	const char *target, *tags;
2168 	ctl_options_t opts;
2169 	uint16_t tag;
2170 
2171 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2172 	target = ctl_get_opt(&opts, "cfiscsi_target");
2173 	tags = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
2174 	if (target == NULL || tags == NULL) {
2175 		ctl_free_opts(&opts);
2176 		req->status = CTL_LUN_ERROR;
2177 		snprintf(req->error_str, sizeof(req->error_str),
2178 		    "Missing required argument");
2179 		return;
2180 	}
2181 	tag = strtol(tags, (char **)NULL, 10);
2182 	ct = cfiscsi_target_find(&cfiscsi_softc, target, tag);
2183 	if (ct == NULL) {
2184 		ctl_free_opts(&opts);
2185 		req->status = CTL_LUN_ERROR;
2186 		snprintf(req->error_str, sizeof(req->error_str),
2187 		    "can't find target \"%s\"", target);
2188 		return;
2189 	}
2190 	if (ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE) {
2191 		ctl_free_opts(&opts);
2192 		req->status = CTL_LUN_ERROR;
2193 		snprintf(req->error_str, sizeof(req->error_str),
2194 		    "target \"%s\" is already dying", target);
2195 		return;
2196 	}
2197 	ctl_free_opts(&opts);
2198 
2199 	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2200 	ctl_port_offline(&ct->ct_port);
2201 	cfiscsi_target_release(ct);
2202 	cfiscsi_target_release(ct);
2203 	req->status = CTL_LUN_OK;
2204 }
2205 
2206 static int
2207 cfiscsi_ioctl(struct cdev *dev,
2208     u_long cmd, caddr_t addr, int flag, struct thread *td)
2209 {
2210 	struct ctl_iscsi *ci;
2211 	struct ctl_req *req;
2212 
2213 	if (cmd == CTL_PORT_REQ) {
2214 		req = (struct ctl_req *)addr;
2215 		switch (req->reqtype) {
2216 		case CTL_REQ_CREATE:
2217 			cfiscsi_ioctl_port_create(req);
2218 			break;
2219 		case CTL_REQ_REMOVE:
2220 			cfiscsi_ioctl_port_remove(req);
2221 			break;
2222 		default:
2223 			req->status = CTL_LUN_ERROR;
2224 			snprintf(req->error_str, sizeof(req->error_str),
2225 			    "Unsupported request type %d", req->reqtype);
2226 		}
2227 		return (0);
2228 	}
2229 
2230 	if (cmd != CTL_ISCSI)
2231 		return (ENOTTY);
2232 
2233 	ci = (struct ctl_iscsi *)addr;
2234 	switch (ci->type) {
2235 	case CTL_ISCSI_HANDOFF:
2236 		cfiscsi_ioctl_handoff(ci);
2237 		break;
2238 	case CTL_ISCSI_LIST:
2239 		cfiscsi_ioctl_list(ci);
2240 		break;
2241 	case CTL_ISCSI_LOGOUT:
2242 		cfiscsi_ioctl_logout(ci);
2243 		break;
2244 	case CTL_ISCSI_TERMINATE:
2245 		cfiscsi_ioctl_terminate(ci);
2246 		break;
2247 	case CTL_ISCSI_LIMITS:
2248 		cfiscsi_ioctl_limits(ci);
2249 		break;
2250 #ifdef ICL_KERNEL_PROXY
2251 	case CTL_ISCSI_LISTEN:
2252 		cfiscsi_ioctl_listen(ci);
2253 		break;
2254 	case CTL_ISCSI_ACCEPT:
2255 		cfiscsi_ioctl_accept(ci);
2256 		break;
2257 	case CTL_ISCSI_SEND:
2258 		cfiscsi_ioctl_send(ci);
2259 		break;
2260 	case CTL_ISCSI_RECEIVE:
2261 		cfiscsi_ioctl_receive(ci);
2262 		break;
2263 #else
2264 	case CTL_ISCSI_LISTEN:
2265 	case CTL_ISCSI_ACCEPT:
2266 	case CTL_ISCSI_SEND:
2267 	case CTL_ISCSI_RECEIVE:
2268 		ci->status = CTL_ISCSI_ERROR;
2269 		snprintf(ci->error_str, sizeof(ci->error_str),
2270 		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2271 		    __func__);
2272 		break;
2273 #endif /* !ICL_KERNEL_PROXY */
2274 	default:
2275 		ci->status = CTL_ISCSI_ERROR;
2276 		snprintf(ci->error_str, sizeof(ci->error_str),
2277 		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2278 		break;
2279 	}
2280 
2281 	return (0);
2282 }
2283 
2284 static void
2285 cfiscsi_target_hold(struct cfiscsi_target *ct)
2286 {
2287 
2288 	refcount_acquire(&ct->ct_refcount);
2289 }
2290 
2291 static void
2292 cfiscsi_target_release(struct cfiscsi_target *ct)
2293 {
2294 	struct cfiscsi_softc *softc;
2295 
2296 	softc = ct->ct_softc;
2297 	mtx_lock(&softc->lock);
2298 	if (refcount_release(&ct->ct_refcount)) {
2299 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2300 		mtx_unlock(&softc->lock);
2301 		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2302 			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2303 			if (ctl_port_deregister(&ct->ct_port) != 0)
2304 				printf("%s: ctl_port_deregister() failed\n",
2305 				    __func__);
2306 		}
2307 		free(ct, M_CFISCSI);
2308 
2309 		return;
2310 	}
2311 	mtx_unlock(&softc->lock);
2312 }
2313 
2314 static struct cfiscsi_target *
2315 cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name, uint16_t tag)
2316 {
2317 	struct cfiscsi_target *ct;
2318 
2319 	mtx_lock(&softc->lock);
2320 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2321 		if (ct->ct_tag != tag ||
2322 		    strcmp(name, ct->ct_name) != 0 ||
2323 		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2324 			continue;
2325 		cfiscsi_target_hold(ct);
2326 		mtx_unlock(&softc->lock);
2327 		return (ct);
2328 	}
2329 	mtx_unlock(&softc->lock);
2330 
2331 	return (NULL);
2332 }
2333 
2334 static struct cfiscsi_target *
2335 cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2336     const char *alias, uint16_t tag)
2337 {
2338 	struct cfiscsi_target *ct, *newct;
2339 
2340 	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2341 		return (NULL);
2342 
2343 	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2344 
2345 	mtx_lock(&softc->lock);
2346 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2347 		if (ct->ct_tag != tag ||
2348 		    strcmp(name, ct->ct_name) != 0 ||
2349 		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2350 			continue;
2351 		cfiscsi_target_hold(ct);
2352 		mtx_unlock(&softc->lock);
2353 		free(newct, M_CFISCSI);
2354 		return (ct);
2355 	}
2356 
2357 	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2358 	if (alias != NULL)
2359 		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2360 	newct->ct_tag = tag;
2361 	refcount_init(&newct->ct_refcount, 1);
2362 	newct->ct_softc = softc;
2363 	if (TAILQ_EMPTY(&softc->targets))
2364 		softc->last_target_id = 0;
2365 	newct->ct_target_id = ++softc->last_target_id;
2366 	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2367 	mtx_unlock(&softc->lock);
2368 
2369 	return (newct);
2370 }
2371 
2372 static int
2373 cfiscsi_lun_enable(void *arg, int lun_id)
2374 {
2375 
2376 	return (0);
2377 }
2378 
2379 static int
2380 cfiscsi_lun_disable(void *arg, int lun_id)
2381 {
2382 
2383 	return (0);
2384 }
2385 
2386 static void
2387 cfiscsi_datamove_in(union ctl_io *io)
2388 {
2389 	struct cfiscsi_session *cs;
2390 	struct icl_pdu *request, *response;
2391 	const struct iscsi_bhs_scsi_command *bhssc;
2392 	struct iscsi_bhs_data_in *bhsdi;
2393 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2394 	size_t len, expected_len, sg_len, buffer_offset;
2395 	const char *sg_addr;
2396 	int ctl_sg_count, error, i;
2397 
2398 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2399 	cs = PDU_SESSION(request);
2400 
2401 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2402 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2403 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2404 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2405 
2406 	if (io->scsiio.kern_sg_entries > 0) {
2407 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2408 		ctl_sg_count = io->scsiio.kern_sg_entries;
2409 	} else {
2410 		ctl_sglist = &ctl_sg_entry;
2411 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2412 		ctl_sglist->len = io->scsiio.kern_data_len;
2413 		ctl_sg_count = 1;
2414 	}
2415 
2416 	/*
2417 	 * This is the total amount of data to be transferred within the current
2418 	 * SCSI command.  We need to record it so that we can properly report
2419 	 * underflow/underflow.
2420 	 */
2421 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2422 
2423 	/*
2424 	 * This is the offset within the current SCSI command; for the first
2425 	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2426 	 * it will be the sum of lengths of previous ones.
2427 	 */
2428 	buffer_offset = io->scsiio.kern_rel_offset;
2429 
2430 	/*
2431 	 * This is the transfer length expected by the initiator.  In theory,
2432 	 * it could be different from the correct amount of data from the SCSI
2433 	 * point of view, even if that doesn't make any sense.
2434 	 */
2435 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2436 #if 0
2437 	if (expected_len != io->scsiio.kern_total_len) {
2438 		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2439 		    "actual length %zd", expected_len,
2440 		    (size_t)io->scsiio.kern_total_len);
2441 	}
2442 #endif
2443 
2444 	if (buffer_offset >= expected_len) {
2445 #if 0
2446 		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2447 		    "already sent the expected len", buffer_offset);
2448 #endif
2449 		io->scsiio.be_move_done(io);
2450 		return;
2451 	}
2452 
2453 	i = 0;
2454 	sg_addr = NULL;
2455 	sg_len = 0;
2456 	response = NULL;
2457 	bhsdi = NULL;
2458 	for (;;) {
2459 		if (response == NULL) {
2460 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2461 			if (response == NULL) {
2462 				CFISCSI_SESSION_WARN(cs, "failed to "
2463 				    "allocate memory; dropping connection");
2464 				ctl_set_busy(&io->scsiio);
2465 				io->scsiio.be_move_done(io);
2466 				cfiscsi_session_terminate(cs);
2467 				return;
2468 			}
2469 			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2470 			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2471 			bhsdi->bhsdi_initiator_task_tag =
2472 			    bhssc->bhssc_initiator_task_tag;
2473 			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2474 			PDU_EXPDATASN(request)++;
2475 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2476 		}
2477 
2478 		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2479 		if (sg_len == 0) {
2480 			sg_addr = ctl_sglist[i].addr;
2481 			sg_len = ctl_sglist[i].len;
2482 			KASSERT(sg_len > 0, ("sg_len <= 0"));
2483 		}
2484 
2485 		len = sg_len;
2486 
2487 		/*
2488 		 * Truncate to maximum data segment length.
2489 		 */
2490 		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2491 		    ("ip_data_len %zd >= max_data_segment_length %zd",
2492 		    response->ip_data_len, cs->cs_max_data_segment_length));
2493 		if (response->ip_data_len + len >
2494 		    cs->cs_max_data_segment_length) {
2495 			len = cs->cs_max_data_segment_length -
2496 			    response->ip_data_len;
2497 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2498 			    len, sg_len));
2499 		}
2500 
2501 		/*
2502 		 * Truncate to expected data transfer length.
2503 		 */
2504 		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2505 		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2506 		    buffer_offset, response->ip_data_len, expected_len));
2507 		if (buffer_offset + response->ip_data_len + len > expected_len) {
2508 			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2509 			    "to expected data transfer length %zd",
2510 			    buffer_offset + response->ip_data_len + len, expected_len);
2511 			len = expected_len - (buffer_offset + response->ip_data_len);
2512 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2513 			    len, sg_len));
2514 		}
2515 
2516 		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2517 		if (error != 0) {
2518 			CFISCSI_SESSION_WARN(cs, "failed to "
2519 			    "allocate memory; dropping connection");
2520 			icl_pdu_free(response);
2521 			ctl_set_busy(&io->scsiio);
2522 			io->scsiio.be_move_done(io);
2523 			cfiscsi_session_terminate(cs);
2524 			return;
2525 		}
2526 		sg_addr += len;
2527 		sg_len -= len;
2528 
2529 		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2530 		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2531 		    buffer_offset, response->ip_data_len, expected_len));
2532 		if (buffer_offset + response->ip_data_len == expected_len) {
2533 			/*
2534 			 * Already have the amount of data the initiator wanted.
2535 			 */
2536 			break;
2537 		}
2538 
2539 		if (sg_len == 0) {
2540 			/*
2541 			 * End of scatter-gather segment;
2542 			 * proceed to the next one...
2543 			 */
2544 			if (i == ctl_sg_count - 1) {
2545 				/*
2546 				 * ... unless this was the last one.
2547 				 */
2548 				break;
2549 			}
2550 			i++;
2551 		}
2552 
2553 		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2554 			/*
2555 			 * Can't stuff more data into the current PDU;
2556 			 * queue it.  Note that's not enough to check
2557 			 * for kern_data_resid == 0 instead; there
2558 			 * may be several Data-In PDUs for the final
2559 			 * call to cfiscsi_datamove(), and we want
2560 			 * to set the F flag only on the last of them.
2561 			 */
2562 			buffer_offset += response->ip_data_len;
2563 			if (buffer_offset == io->scsiio.kern_total_len ||
2564 			    buffer_offset == expected_len) {
2565 				buffer_offset -= response->ip_data_len;
2566 				break;
2567 			}
2568 			cfiscsi_pdu_queue(response);
2569 			response = NULL;
2570 			bhsdi = NULL;
2571 		}
2572 	}
2573 	if (response != NULL) {
2574 		buffer_offset += response->ip_data_len;
2575 		if (buffer_offset == io->scsiio.kern_total_len ||
2576 		    buffer_offset == expected_len) {
2577 			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2578 			if (io->io_hdr.status == CTL_SUCCESS) {
2579 				bhsdi->bhsdi_flags |= BHSDI_FLAGS_S;
2580 				if (PDU_TOTAL_TRANSFER_LEN(request) <
2581 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2582 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2583 					bhsdi->bhsdi_residual_count =
2584 					    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2585 					    PDU_TOTAL_TRANSFER_LEN(request));
2586 				} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2587 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2588 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2589 					bhsdi->bhsdi_residual_count =
2590 					    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2591 					    ntohl(bhssc->bhssc_expected_data_transfer_length));
2592 				}
2593 				bhsdi->bhsdi_status = io->scsiio.scsi_status;
2594 				io->io_hdr.flags |= CTL_FLAG_STATUS_SENT;
2595 			}
2596 		}
2597 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2598 		cfiscsi_pdu_queue(response);
2599 	}
2600 
2601 	io->scsiio.be_move_done(io);
2602 }
2603 
2604 static void
2605 cfiscsi_datamove_out(union ctl_io *io)
2606 {
2607 	struct cfiscsi_session *cs;
2608 	struct icl_pdu *request, *response;
2609 	const struct iscsi_bhs_scsi_command *bhssc;
2610 	struct iscsi_bhs_r2t *bhsr2t;
2611 	struct cfiscsi_data_wait *cdw;
2612 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2613 	uint32_t expected_len, r2t_off, r2t_len;
2614 	uint32_t target_transfer_tag;
2615 	bool done;
2616 
2617 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2618 	cs = PDU_SESSION(request);
2619 
2620 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2621 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2622 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2623 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2624 
2625 	/*
2626 	 * We need to record it so that we can properly report
2627 	 * underflow/underflow.
2628 	 */
2629 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2630 
2631 	/*
2632 	 * Report write underflow as error since CTL and backends don't
2633 	 * really support it, and SCSI does not tell how to do it right.
2634 	 */
2635 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2636 	if (io->scsiio.kern_rel_offset + io->scsiio.kern_data_len >
2637 	    expected_len) {
2638 		io->scsiio.io_hdr.port_status = 43;
2639 		io->scsiio.be_move_done(io);
2640 		return;
2641 	}
2642 
2643 	target_transfer_tag =
2644 	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2645 	cdw = cfiscsi_data_wait_new(cs, io, bhssc->bhssc_initiator_task_tag,
2646 	    &target_transfer_tag);
2647 	if (cdw == NULL) {
2648 		CFISCSI_SESSION_WARN(cs, "failed to "
2649 		    "allocate memory; dropping connection");
2650 		ctl_set_busy(&io->scsiio);
2651 		io->scsiio.be_move_done(io);
2652 		cfiscsi_session_terminate(cs);
2653 		return;
2654 	}
2655 #if 0
2656 	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2657 	    "task tag 0x%x, target transfer tag 0x%x",
2658 	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2659 #endif
2660 
2661 	cdw->cdw_ctl_io = io;
2662 	cdw->cdw_target_transfer_tag = target_transfer_tag;
2663 	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2664 	cdw->cdw_r2t_end = io->scsiio.kern_data_len;
2665 	cdw->cdw_datasn = 0;
2666 
2667 	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2668 	if (io->scsiio.kern_sg_entries > 0) {
2669 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2670 	} else {
2671 		ctl_sglist = &ctl_sg_entry;
2672 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2673 		ctl_sglist->len = io->scsiio.kern_data_len;
2674 	}
2675 	cdw->cdw_sg_index = 0;
2676 	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2677 	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2678 	r2t_off = io->scsiio.ext_data_filled;
2679 	while (r2t_off > 0) {
2680 		if (r2t_off >= cdw->cdw_sg_len) {
2681 			r2t_off -= cdw->cdw_sg_len;
2682 			cdw->cdw_sg_index++;
2683 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2684 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2685 			continue;
2686 		}
2687 		cdw->cdw_sg_addr += r2t_off;
2688 		cdw->cdw_sg_len -= r2t_off;
2689 		r2t_off = 0;
2690 	}
2691 
2692 	if (cs->cs_immediate_data &&
2693 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2694 	    icl_pdu_data_segment_length(request)) {
2695 		done = cfiscsi_handle_data_segment(request, cdw);
2696 		if (done) {
2697 			cfiscsi_data_wait_free(cs, cdw);
2698 			io->scsiio.be_move_done(io);
2699 			return;
2700 		}
2701 	}
2702 
2703 	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2704 	r2t_len = MIN(io->scsiio.kern_data_len - io->scsiio.ext_data_filled,
2705 	    cs->cs_max_burst_length);
2706 	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2707 
2708 	CFISCSI_SESSION_LOCK(cs);
2709 	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2710 	CFISCSI_SESSION_UNLOCK(cs);
2711 
2712 	/*
2713 	 * XXX: We should limit the number of outstanding R2T PDUs
2714 	 * 	per task to MaxOutstandingR2T.
2715 	 */
2716 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2717 	if (response == NULL) {
2718 		CFISCSI_SESSION_WARN(cs, "failed to "
2719 		    "allocate memory; dropping connection");
2720 		ctl_set_busy(&io->scsiio);
2721 		io->scsiio.be_move_done(io);
2722 		cfiscsi_session_terminate(cs);
2723 		return;
2724 	}
2725 	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2726 	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2727 	bhsr2t->bhsr2t_flags = 0x80;
2728 	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2729 	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2730 	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2731 	/*
2732 	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2733 	 *	be running concurrently on several CPUs for a given
2734 	 *	command.
2735 	 */
2736 	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2737 	PDU_R2TSN(request)++;
2738 	/*
2739 	 * This is the offset within the current SCSI command;
2740 	 * i.e. for the first call of datamove(), it will be 0,
2741 	 * and for subsequent ones it will be the sum of lengths
2742 	 * of previous ones.
2743 	 *
2744 	 * The ext_data_filled is to account for unsolicited
2745 	 * (immediate) data that might have already arrived.
2746 	 */
2747 	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2748 	/*
2749 	 * This is the total length (sum of S/G lengths) this call
2750 	 * to cfiscsi_datamove() is supposed to handle, limited by
2751 	 * MaxBurstLength.
2752 	 */
2753 	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2754 	cfiscsi_pdu_queue(response);
2755 }
2756 
2757 static void
2758 cfiscsi_datamove(union ctl_io *io)
2759 {
2760 
2761 	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2762 		cfiscsi_datamove_in(io);
2763 	else {
2764 		/* We hadn't received anything during this datamove yet. */
2765 		io->scsiio.ext_data_filled = 0;
2766 		cfiscsi_datamove_out(io);
2767 	}
2768 }
2769 
2770 static void
2771 cfiscsi_scsi_command_done(union ctl_io *io)
2772 {
2773 	struct icl_pdu *request, *response;
2774 	struct iscsi_bhs_scsi_command *bhssc;
2775 	struct iscsi_bhs_scsi_response *bhssr;
2776 #ifdef DIAGNOSTIC
2777 	struct cfiscsi_data_wait *cdw;
2778 #endif
2779 	struct cfiscsi_session *cs;
2780 	uint16_t sense_length;
2781 
2782 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2783 	cs = PDU_SESSION(request);
2784 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2785 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2786 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2787 	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2788 
2789 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2790 	//    bhssc->bhssc_initiator_task_tag);
2791 
2792 #ifdef DIAGNOSTIC
2793 	CFISCSI_SESSION_LOCK(cs);
2794 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2795 		KASSERT(bhssc->bhssc_initiator_task_tag !=
2796 		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2797 	CFISCSI_SESSION_UNLOCK(cs);
2798 #endif
2799 
2800 	/*
2801 	 * Do not return status for aborted commands.
2802 	 * There are exceptions, but none supported by CTL yet.
2803 	 */
2804 	if (((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2805 	     (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) ||
2806 	    (io->io_hdr.flags & CTL_FLAG_STATUS_SENT)) {
2807 		ctl_free_io(io);
2808 		icl_pdu_free(request);
2809 		return;
2810 	}
2811 
2812 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2813 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2814 	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2815 	bhssr->bhssr_flags = 0x80;
2816 	/*
2817 	 * XXX: We don't deal with bidirectional under/overflows;
2818 	 *	does anything actually support those?
2819 	 */
2820 	if (PDU_TOTAL_TRANSFER_LEN(request) <
2821 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2822 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2823 		bhssr->bhssr_residual_count =
2824 		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2825 		    PDU_TOTAL_TRANSFER_LEN(request));
2826 		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2827 		//    ntohl(bhssr->bhssr_residual_count));
2828 	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2829 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2830 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2831 		bhssr->bhssr_residual_count =
2832 		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2833 		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2834 		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2835 		//    ntohl(bhssr->bhssr_residual_count));
2836 	}
2837 	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2838 	bhssr->bhssr_status = io->scsiio.scsi_status;
2839 	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2840 	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2841 
2842 	if (io->scsiio.sense_len > 0) {
2843 #if 0
2844 		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2845 		    io->scsiio.sense_len);
2846 #endif
2847 		sense_length = htons(io->scsiio.sense_len);
2848 		icl_pdu_append_data(response,
2849 		    &sense_length, sizeof(sense_length), M_WAITOK);
2850 		icl_pdu_append_data(response,
2851 		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2852 	}
2853 
2854 	ctl_free_io(io);
2855 	icl_pdu_free(request);
2856 	cfiscsi_pdu_queue(response);
2857 }
2858 
2859 static void
2860 cfiscsi_task_management_done(union ctl_io *io)
2861 {
2862 	struct icl_pdu *request, *response;
2863 	struct iscsi_bhs_task_management_request *bhstmr;
2864 	struct iscsi_bhs_task_management_response *bhstmr2;
2865 	struct cfiscsi_data_wait *cdw, *tmpcdw;
2866 	struct cfiscsi_session *cs;
2867 
2868 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2869 	cs = PDU_SESSION(request);
2870 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2871 	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2872 	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2873 	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2874 
2875 #if 0
2876 	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2877 	    bhstmr->bhstmr_initiator_task_tag,
2878 	    bhstmr->bhstmr_referenced_task_tag);
2879 #endif
2880 
2881 	if ((bhstmr->bhstmr_function & ~0x80) ==
2882 	    BHSTMR_FUNCTION_ABORT_TASK) {
2883 		/*
2884 		 * Make sure we no longer wait for Data-Out for this command.
2885 		 */
2886 		CFISCSI_SESSION_LOCK(cs);
2887 		TAILQ_FOREACH_SAFE(cdw,
2888 		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2889 			if (bhstmr->bhstmr_referenced_task_tag !=
2890 			    cdw->cdw_initiator_task_tag)
2891 				continue;
2892 
2893 #if 0
2894 			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2895 			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2896 #endif
2897 			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2898 			    cdw, cdw_next);
2899 			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2900 			cfiscsi_data_wait_free(cs, cdw);
2901 		}
2902 		CFISCSI_SESSION_UNLOCK(cs);
2903 	}
2904 
2905 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2906 	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2907 	    response->ip_bhs;
2908 	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2909 	bhstmr2->bhstmr_flags = 0x80;
2910 	if (io->io_hdr.status == CTL_SUCCESS) {
2911 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2912 	} else {
2913 		/*
2914 		 * XXX: How to figure out what exactly went wrong?  iSCSI spec
2915 		 * 	expects us to provide detailed error, e.g. "Task does
2916 		 * 	not exist" or "LUN does not exist".
2917 		 */
2918 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED");
2919 		bhstmr2->bhstmr_response =
2920 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2921 	}
2922 	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2923 
2924 	ctl_free_io(io);
2925 	icl_pdu_free(request);
2926 	cfiscsi_pdu_queue(response);
2927 }
2928 
2929 static void
2930 cfiscsi_done(union ctl_io *io)
2931 {
2932 	struct icl_pdu *request;
2933 	struct cfiscsi_session *cs;
2934 
2935 	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2936 		("invalid CTL status %#x", io->io_hdr.status));
2937 
2938 	if (io->io_hdr.io_type == CTL_IO_TASK &&
2939 	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
2940 		/*
2941 		 * Implicit task termination has just completed; nothing to do.
2942 		 */
2943 		cs = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2944 		cs->cs_tasks_aborted = true;
2945 		refcount_release(&cs->cs_outstanding_ctl_pdus);
2946 		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
2947 		ctl_free_io(io);
2948 		return;
2949 	}
2950 
2951 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2952 	cs = PDU_SESSION(request);
2953 	refcount_release(&cs->cs_outstanding_ctl_pdus);
2954 
2955 	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2956 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2957 		cfiscsi_scsi_command_done(io);
2958 		break;
2959 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2960 		cfiscsi_task_management_done(io);
2961 		break;
2962 	default:
2963 		panic("cfiscsi_done called with wrong opcode 0x%x",
2964 		    request->ip_bhs->bhs_opcode);
2965 	}
2966 }
2967