xref: /freebsd/sys/cam/ctl/ctl_frontend_iscsi.c (revision e92ffd9b626833ebdbf2742c8ffddc6cd94b963e)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2012 The FreeBSD Foundation
5  *
6  * This software was developed by Edward Tomasz Napierala under sponsorship
7  * from the FreeBSD Foundation.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * $FreeBSD$
31  */
32 
33 /*
34  * CTL frontend for the iSCSI protocol.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include <sys/param.h>
41 #include <sys/capsicum.h>
42 #include <sys/condvar.h>
43 #include <sys/endian.h>
44 #include <sys/file.h>
45 #include <sys/kernel.h>
46 #include <sys/kthread.h>
47 #include <sys/lock.h>
48 #include <sys/malloc.h>
49 #include <sys/module.h>
50 #include <sys/mutex.h>
51 #include <sys/queue.h>
52 #include <sys/sbuf.h>
53 #include <sys/socket.h>
54 #include <sys/sysctl.h>
55 #include <sys/systm.h>
56 #include <sys/uio.h>
57 #include <sys/unistd.h>
58 #include <sys/nv.h>
59 #include <sys/dnv.h>
60 #include <vm/uma.h>
61 
62 #include <cam/scsi/scsi_all.h>
63 #include <cam/scsi/scsi_da.h>
64 #include <cam/ctl/ctl_io.h>
65 #include <cam/ctl/ctl.h>
66 #include <cam/ctl/ctl_backend.h>
67 #include <cam/ctl/ctl_error.h>
68 #include <cam/ctl/ctl_frontend.h>
69 #include <cam/ctl/ctl_debug.h>
70 #include <cam/ctl/ctl_ha.h>
71 #include <cam/ctl/ctl_ioctl.h>
72 #include <cam/ctl/ctl_private.h>
73 
74 #include <dev/iscsi/icl.h>
75 #include <dev/iscsi/icl_wrappers.h>
76 #include <dev/iscsi/iscsi_proto.h>
77 #include <cam/ctl/ctl_frontend_iscsi.h>
78 
79 #ifdef ICL_KERNEL_PROXY
80 #include <sys/socketvar.h>
81 #endif
82 
83 #ifdef ICL_KERNEL_PROXY
84 FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
85 #endif
86 
87 static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
88 static uma_zone_t cfiscsi_data_wait_zone;
89 
90 SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
91     "CAM Target Layer iSCSI Frontend");
92 static int debug = 1;
93 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
94     &debug, 1, "Enable debug messages");
95 static int ping_timeout = 5;
96 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
97     &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
98 static int login_timeout = 60;
99 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
100     &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
101 static int maxtags = 256;
102 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxtags, CTLFLAG_RWTUN,
103     &maxtags, 0, "Max number of requests queued by initiator");
104 
105 #define	CFISCSI_DEBUG(X, ...)						\
106 	do {								\
107 		if (debug > 1) {					\
108 			printf("%s: " X "\n",				\
109 			    __func__, ## __VA_ARGS__);			\
110 		}							\
111 	} while (0)
112 
113 #define	CFISCSI_WARN(X, ...)						\
114 	do {								\
115 		if (debug > 0) {					\
116 			printf("WARNING: %s: " X "\n",			\
117 			    __func__, ## __VA_ARGS__);			\
118 		}							\
119 	} while (0)
120 
121 #define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
122 	do {								\
123 		if (debug > 1) {					\
124 			printf("%s: %s (%s): " X "\n",			\
125 			    __func__, S->cs_initiator_addr,		\
126 			    S->cs_initiator_name, ## __VA_ARGS__);	\
127 		}							\
128 	} while (0)
129 
130 #define	CFISCSI_SESSION_WARN(S, X, ...)					\
131 	do  {								\
132 		if (debug > 0) {					\
133 			printf("WARNING: %s (%s): " X "\n",		\
134 			    S->cs_initiator_addr,			\
135 			    S->cs_initiator_name, ## __VA_ARGS__);	\
136 		}							\
137 	} while (0)
138 
139 #define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
140 #define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
141 #define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
142 
143 #define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
144 #define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
145 
146 struct cfiscsi_priv {
147 	void		*request;
148 	uint32_t	 expdatasn;
149 	uint32_t	 r2tsn;
150 };
151 #define	PRIV(io)	\
152     ((struct cfiscsi_priv *)&(io)->io_hdr.ctl_private[CTL_PRIV_FRONTEND])
153 #define	PRIV_REQUEST(io)		PRIV(io)->request
154 #define	PRIV_EXPDATASN(io)		PRIV(io)->expdatasn
155 #define	PRIV_R2TSN(io)			PRIV(io)->r2tsn
156 
157 static int	cfiscsi_init(void);
158 static int	cfiscsi_shutdown(void);
159 static void	cfiscsi_online(void *arg);
160 static void	cfiscsi_offline(void *arg);
161 static int	cfiscsi_info(void *arg, struct sbuf *sb);
162 static int	cfiscsi_ioctl(struct cdev *dev,
163 		    u_long cmd, caddr_t addr, int flag, struct thread *td);
164 static void	cfiscsi_datamove(union ctl_io *io);
165 static void	cfiscsi_datamove_in(union ctl_io *io);
166 static void	cfiscsi_datamove_out(union ctl_io *io);
167 static void	cfiscsi_done(union ctl_io *io);
168 static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
169 static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
170 static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
171 static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
172 static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
173 static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
174 static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
175 static struct cfiscsi_data_wait	*cfiscsi_data_wait_new(
176 		    struct cfiscsi_session *cs, union ctl_io *io,
177 		    uint32_t initiator_task_tag,
178 		    uint32_t *target_transfer_tagp);
179 static void	cfiscsi_data_wait_free(struct cfiscsi_session *cs,
180 		    struct cfiscsi_data_wait *cdw);
181 static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
182 		    *softc, const char *name, uint16_t tag);
183 static struct cfiscsi_target	*cfiscsi_target_find_or_create(
184     struct cfiscsi_softc *softc, const char *name, const char *alias,
185     uint16_t tag);
186 static void	cfiscsi_target_release(struct cfiscsi_target *ct);
187 static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
188 
189 static struct cfiscsi_softc cfiscsi_softc;
190 
191 static struct ctl_frontend cfiscsi_frontend =
192 {
193 	.name = "iscsi",
194 	.init = cfiscsi_init,
195 	.ioctl = cfiscsi_ioctl,
196 	.shutdown = cfiscsi_shutdown,
197 };
198 CTL_FRONTEND_DECLARE(cfiscsi, cfiscsi_frontend);
199 MODULE_DEPEND(cfiscsi, icl, 1, 1, 1);
200 
201 static struct icl_pdu *
202 cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
203 {
204 
205 	return (icl_pdu_new(request->ip_conn, flags));
206 }
207 
208 static bool
209 cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
210 {
211 	const struct iscsi_bhs_scsi_command *bhssc;
212 	struct cfiscsi_session *cs;
213 	uint32_t cmdsn, curcmdsn;
214 
215 	cs = PDU_SESSION(request);
216 
217 	/*
218 	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
219 	 * The purpose of the timeout is to reset the connection when it stalls;
220 	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
221 	 * in some queue.
222 	 */
223 	cs->cs_timeout = 0;
224 
225 	/*
226 	 * Immediate commands carry cmdsn, but it is neither incremented nor
227 	 * verified.
228 	 */
229 	if (request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE)
230 		return (false);
231 
232 	/*
233 	 * Data-Out PDUs don't contain CmdSN.
234 	 */
235 	if (request->ip_bhs->bhs_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
236 		return (false);
237 
238 	/*
239 	 * We're only using fields common for all the request
240 	 * (initiator -> target) PDUs.
241 	 */
242 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
243 	curcmdsn = cmdsn = ntohl(bhssc->bhssc_cmdsn);
244 
245 	/*
246 	 * Increment session cmdsn and exit if we received the expected value.
247 	 */
248 	do {
249 		if (atomic_fcmpset_32(&cs->cs_cmdsn, &curcmdsn, cmdsn + 1))
250 			return (false);
251 	} while (curcmdsn == cmdsn);
252 
253 	/*
254 	 * The target MUST silently ignore any non-immediate command outside
255 	 * of this range.
256 	 */
257 	if (ISCSI_SNLT(cmdsn, curcmdsn) ||
258 	    ISCSI_SNGT(cmdsn, curcmdsn - 1 + maxtags)) {
259 		CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
260 		    "while expected %u", cmdsn, curcmdsn);
261 		return (true);
262 	}
263 
264 	/*
265 	 * We don't support multiple connections now, so any discontinuity in
266 	 * CmdSN means lost PDUs.  Since we don't support PDU retransmission --
267 	 * terminate the connection.
268 	 */
269 	CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %u, "
270 	    "while expected %u; dropping connection",
271 	    cmdsn, curcmdsn);
272 	cfiscsi_session_terminate(cs);
273 	return (true);
274 }
275 
276 static void
277 cfiscsi_pdu_handle(struct icl_pdu *request)
278 {
279 	struct cfiscsi_session *cs;
280 	bool ignore;
281 
282 	cs = PDU_SESSION(request);
283 
284 	ignore = cfiscsi_pdu_update_cmdsn(request);
285 	if (ignore) {
286 		icl_pdu_free(request);
287 		return;
288 	}
289 
290 	/*
291 	 * Handle the PDU; this includes e.g. receiving the remaining
292 	 * part of PDU and submitting the SCSI command to CTL
293 	 * or queueing a reply.  The handling routine is responsible
294 	 * for freeing the PDU when it's no longer needed.
295 	 */
296 	switch (request->ip_bhs->bhs_opcode &
297 	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
298 	case ISCSI_BHS_OPCODE_NOP_OUT:
299 		cfiscsi_pdu_handle_nop_out(request);
300 		break;
301 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
302 		cfiscsi_pdu_handle_scsi_command(request);
303 		break;
304 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
305 		cfiscsi_pdu_handle_task_request(request);
306 		break;
307 	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
308 		cfiscsi_pdu_handle_data_out(request);
309 		break;
310 	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
311 		cfiscsi_pdu_handle_logout_request(request);
312 		break;
313 	default:
314 		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
315 		    "opcode 0x%x; dropping connection",
316 		    request->ip_bhs->bhs_opcode);
317 		icl_pdu_free(request);
318 		cfiscsi_session_terminate(cs);
319 	}
320 
321 }
322 
323 static void
324 cfiscsi_receive_callback(struct icl_pdu *request)
325 {
326 #ifdef ICL_KERNEL_PROXY
327 	struct cfiscsi_session *cs;
328 
329 	cs = PDU_SESSION(request);
330 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
331 		if (cs->cs_login_pdu == NULL)
332 			cs->cs_login_pdu = request;
333 		else
334 			icl_pdu_free(request);
335 		cv_signal(&cs->cs_login_cv);
336 		return;
337 	}
338 #endif
339 
340 	cfiscsi_pdu_handle(request);
341 }
342 
343 static void
344 cfiscsi_error_callback(struct icl_conn *ic)
345 {
346 	struct cfiscsi_session *cs;
347 
348 	cs = CONN_SESSION(ic);
349 
350 	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
351 	cfiscsi_session_terminate(cs);
352 }
353 
354 static int
355 cfiscsi_pdu_prepare(struct icl_pdu *response)
356 {
357 	struct cfiscsi_session *cs;
358 	struct iscsi_bhs_scsi_response *bhssr;
359 	bool advance_statsn = true;
360 	uint32_t cmdsn;
361 
362 	cs = PDU_SESSION(response);
363 
364 	CFISCSI_SESSION_LOCK_ASSERT(cs);
365 
366 	/*
367 	 * We're only using fields common for all the response
368 	 * (target -> initiator) PDUs.
369 	 */
370 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
371 
372 	/*
373 	 * 10.8.3: "The StatSN for this connection is not advanced
374 	 * after this PDU is sent."
375 	 */
376 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
377 		advance_statsn = false;
378 
379 	/*
380 	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
381 	 * StatSN for the connection is not advanced after this PDU is sent."
382 	 */
383 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
384 	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
385 		advance_statsn = false;
386 
387 	/*
388 	 * See the comment below - StatSN is not meaningful and must
389 	 * not be advanced.
390 	 */
391 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN &&
392 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S) == 0)
393 		advance_statsn = false;
394 
395 	/*
396 	 * 10.7.3: "The fields StatSN, Status, and Residual Count
397 	 * only have meaningful content if the S bit is set to 1."
398 	 */
399 	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
400 	    (bhssr->bhssr_flags & BHSDI_FLAGS_S))
401 		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
402 	cmdsn = cs->cs_cmdsn;
403 	bhssr->bhssr_expcmdsn = htonl(cmdsn);
404 	bhssr->bhssr_maxcmdsn = htonl(cmdsn - 1 +
405 	    imax(0, maxtags - cs->cs_outstanding_ctl_pdus));
406 
407 	if (advance_statsn)
408 		cs->cs_statsn++;
409 
410 	return (0);
411 }
412 
413 static void
414 cfiscsi_pdu_queue(struct icl_pdu *response)
415 {
416 	struct cfiscsi_session *cs;
417 
418 	cs = PDU_SESSION(response);
419 
420 	CFISCSI_SESSION_LOCK(cs);
421 	cfiscsi_pdu_prepare(response);
422 	icl_pdu_queue(response);
423 	CFISCSI_SESSION_UNLOCK(cs);
424 }
425 
426  static void
427 cfiscsi_pdu_queue_cb(struct icl_pdu *response, icl_pdu_cb cb)
428 {
429 	struct cfiscsi_session *cs = PDU_SESSION(response);
430 
431 	CFISCSI_SESSION_LOCK(cs);
432 	cfiscsi_pdu_prepare(response);
433 	icl_pdu_queue_cb(response, cb);
434 	CFISCSI_SESSION_UNLOCK(cs);
435 }
436 
437 static void
438 cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
439 {
440 	struct cfiscsi_session *cs;
441 	struct iscsi_bhs_nop_out *bhsno;
442 	struct iscsi_bhs_nop_in *bhsni;
443 	struct icl_pdu *response;
444 	void *data = NULL;
445 	size_t datasize;
446 	int error;
447 
448 	cs = PDU_SESSION(request);
449 	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
450 
451 	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
452 		/*
453 		 * Nothing to do, iscsi_pdu_update_statsn() already
454 		 * zeroed the timeout.
455 		 */
456 		icl_pdu_free(request);
457 		return;
458 	}
459 
460 	datasize = icl_pdu_data_segment_length(request);
461 	if (datasize > 0) {
462 		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
463 		if (data == NULL) {
464 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
465 			    "dropping connection");
466 			icl_pdu_free(request);
467 			cfiscsi_session_terminate(cs);
468 			return;
469 		}
470 		icl_pdu_get_data(request, 0, data, datasize);
471 	}
472 
473 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
474 	if (response == NULL) {
475 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
476 		    "droppping connection");
477 		free(data, M_CFISCSI);
478 		icl_pdu_free(request);
479 		cfiscsi_session_terminate(cs);
480 		return;
481 	}
482 	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
483 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
484 	bhsni->bhsni_flags = 0x80;
485 	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
486 	bhsni->bhsni_target_transfer_tag = 0xffffffff;
487 	if (datasize > 0) {
488 		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
489 		if (error != 0) {
490 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
491 			    "dropping connection");
492 			free(data, M_CFISCSI);
493 			icl_pdu_free(request);
494 			icl_pdu_free(response);
495 			cfiscsi_session_terminate(cs);
496 			return;
497 		}
498 		free(data, M_CFISCSI);
499 	}
500 
501 	icl_pdu_free(request);
502 	cfiscsi_pdu_queue(response);
503 }
504 
505 static void
506 cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
507 {
508 	struct iscsi_bhs_scsi_command *bhssc;
509 	struct cfiscsi_session *cs;
510 	union ctl_io *io;
511 	int error;
512 
513 	cs = PDU_SESSION(request);
514 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
515 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
516 	//    bhssc->bhssc_initiator_task_tag);
517 
518 	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
519 		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
520 		    "ImmediateData=No; dropping connection");
521 		icl_pdu_free(request);
522 		cfiscsi_session_terminate(cs);
523 		return;
524 	}
525 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
526 	ctl_zero_io(io);
527 	PRIV_REQUEST(io) = request;
528 	io->io_hdr.io_type = CTL_IO_SCSI;
529 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
530 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
531 	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhssc->bhssc_lun));
532 	io->scsiio.priority = (bhssc->bhssc_pri & BHSSC_PRI_MASK) >>
533 	    BHSSC_PRI_SHIFT;
534 	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
535 	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
536 	case BHSSC_FLAGS_ATTR_UNTAGGED:
537 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
538 		break;
539 	case BHSSC_FLAGS_ATTR_SIMPLE:
540 		io->scsiio.tag_type = CTL_TAG_SIMPLE;
541 		break;
542 	case BHSSC_FLAGS_ATTR_ORDERED:
543         	io->scsiio.tag_type = CTL_TAG_ORDERED;
544 		break;
545 	case BHSSC_FLAGS_ATTR_HOQ:
546         	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
547 		break;
548 	case BHSSC_FLAGS_ATTR_ACA:
549 		io->scsiio.tag_type = CTL_TAG_ACA;
550 		break;
551 	default:
552 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
553 		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
554 		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
555 		break;
556 	}
557 	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
558 	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
559 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
560 	error = ctl_run(io);
561 	if (error != CTL_RETVAL_COMPLETE) {
562 		CFISCSI_SESSION_WARN(cs, "ctl_run() failed; error %d; "
563 		    "dropping connection", error);
564 		ctl_free_io(io);
565 		refcount_release(&cs->cs_outstanding_ctl_pdus);
566 		icl_pdu_free(request);
567 		cfiscsi_session_terminate(cs);
568 	}
569 }
570 
571 static void
572 cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
573 {
574 	struct iscsi_bhs_task_management_request *bhstmr;
575 	struct iscsi_bhs_task_management_response *bhstmr2;
576 	struct icl_pdu *response;
577 	struct cfiscsi_session *cs;
578 	union ctl_io *io;
579 	int error;
580 
581 	cs = PDU_SESSION(request);
582 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
583 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
584 	ctl_zero_io(io);
585 	PRIV_REQUEST(io) = request;
586 	io->io_hdr.io_type = CTL_IO_TASK;
587 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
588 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
589 	io->io_hdr.nexus.targ_lun = ctl_decode_lun(be64toh(bhstmr->bhstmr_lun));
590 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
591 
592 	switch (bhstmr->bhstmr_function & ~0x80) {
593 	case BHSTMR_FUNCTION_ABORT_TASK:
594 #if 0
595 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
596 #endif
597 		io->taskio.task_action = CTL_TASK_ABORT_TASK;
598 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
599 		break;
600 	case BHSTMR_FUNCTION_ABORT_TASK_SET:
601 #if 0
602 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
603 #endif
604 		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
605 		break;
606 	case BHSTMR_FUNCTION_CLEAR_TASK_SET:
607 #if 0
608 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_CLEAR_TASK_SET");
609 #endif
610 		io->taskio.task_action = CTL_TASK_CLEAR_TASK_SET;
611 		break;
612 	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
613 #if 0
614 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
615 #endif
616 		io->taskio.task_action = CTL_TASK_LUN_RESET;
617 		break;
618 	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
619 #if 0
620 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
621 #endif
622 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
623 		break;
624 	case BHSTMR_FUNCTION_TARGET_COLD_RESET:
625 #if 0
626 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_COLD_RESET");
627 #endif
628 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
629 		break;
630 	case BHSTMR_FUNCTION_QUERY_TASK:
631 #if 0
632 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK");
633 #endif
634 		io->taskio.task_action = CTL_TASK_QUERY_TASK;
635 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
636 		break;
637 	case BHSTMR_FUNCTION_QUERY_TASK_SET:
638 #if 0
639 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_TASK_SET");
640 #endif
641 		io->taskio.task_action = CTL_TASK_QUERY_TASK_SET;
642 		break;
643 	case BHSTMR_FUNCTION_I_T_NEXUS_RESET:
644 #if 0
645 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_I_T_NEXUS_RESET");
646 #endif
647 		io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
648 		break;
649 	case BHSTMR_FUNCTION_QUERY_ASYNC_EVENT:
650 #if 0
651 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_QUERY_ASYNC_EVENT");
652 #endif
653 		io->taskio.task_action = CTL_TASK_QUERY_ASYNC_EVENT;
654 		break;
655 	default:
656 		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
657 		    bhstmr->bhstmr_function & ~0x80);
658 		ctl_free_io(io);
659 
660 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
661 		if (response == NULL) {
662 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
663 			    "dropping connection");
664 			icl_pdu_free(request);
665 			cfiscsi_session_terminate(cs);
666 			return;
667 		}
668 		bhstmr2 = (struct iscsi_bhs_task_management_response *)
669 		    response->ip_bhs;
670 		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
671 		bhstmr2->bhstmr_flags = 0x80;
672 		bhstmr2->bhstmr_response =
673 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
674 		bhstmr2->bhstmr_initiator_task_tag =
675 		    bhstmr->bhstmr_initiator_task_tag;
676 		icl_pdu_free(request);
677 		cfiscsi_pdu_queue(response);
678 		return;
679 	}
680 
681 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
682 	error = ctl_run(io);
683 	if (error != CTL_RETVAL_COMPLETE) {
684 		CFISCSI_SESSION_WARN(cs, "ctl_run() failed; error %d; "
685 		    "dropping connection", error);
686 		ctl_free_io(io);
687 		refcount_release(&cs->cs_outstanding_ctl_pdus);
688 		icl_pdu_free(request);
689 		cfiscsi_session_terminate(cs);
690 	}
691 }
692 
693 static bool
694 cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
695 {
696 	struct iscsi_bhs_data_out *bhsdo;
697 	struct cfiscsi_session *cs;
698 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
699 	size_t copy_len, len, off, buffer_offset;
700 	int ctl_sg_count;
701 	union ctl_io *io;
702 
703 	cs = PDU_SESSION(request);
704 
705 	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
706 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
707 	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
708 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
709 	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
710 
711 	/*
712 	 * We're only using fields common for Data-Out and SCSI Command PDUs.
713 	 */
714 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
715 
716 	io = cdw->cdw_ctl_io;
717 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
718 	    ("CTL_FLAG_DATA_IN"));
719 
720 #if 0
721 	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
722 	    request->ip_data_len, io->scsiio.kern_total_len);
723 #endif
724 
725 	if (io->scsiio.kern_sg_entries > 0) {
726 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
727 		ctl_sg_count = io->scsiio.kern_sg_entries;
728 	} else {
729 		ctl_sglist = &ctl_sg_entry;
730 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
731 		ctl_sglist->len = io->scsiio.kern_data_len;
732 		ctl_sg_count = 1;
733 	}
734 
735 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
736 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
737 		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
738 	else
739 		buffer_offset = 0;
740 	len = icl_pdu_data_segment_length(request);
741 
742 	/*
743 	 * Make sure the offset, as sent by the initiator, matches the offset
744 	 * we're supposed to be at in the scatter-gather list.
745 	 */
746 	if (buffer_offset >
747 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
748 	    buffer_offset + len <=
749 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
750 		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
751 		    "expected %zd; dropping connection", buffer_offset,
752 		    (size_t)io->scsiio.kern_rel_offset +
753 		    (size_t)io->scsiio.ext_data_filled);
754 		ctl_set_data_phase_error(&io->scsiio);
755 		cfiscsi_session_terminate(cs);
756 		return (true);
757 	}
758 
759 	/*
760 	 * This is the offset within the PDU data segment, as opposed
761 	 * to buffer_offset, which is the offset within the task (SCSI
762 	 * command).
763 	 */
764 	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
765 	    buffer_offset;
766 
767 	/*
768 	 * Iterate over the scatter/gather segments, filling them with data
769 	 * from the PDU data segment.  Note that this can get called multiple
770 	 * times for one SCSI command; the cdw structure holds state for the
771 	 * scatter/gather list.
772 	 */
773 	for (;;) {
774 		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
775 		    ("cdw->cdw_sg_index >= ctl_sg_count"));
776 		if (cdw->cdw_sg_len == 0) {
777 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
778 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
779 		}
780 		KASSERT(off <= len, ("len > off"));
781 		copy_len = len - off;
782 		if (copy_len > cdw->cdw_sg_len)
783 			copy_len = cdw->cdw_sg_len;
784 
785 		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
786 		cdw->cdw_sg_addr += copy_len;
787 		cdw->cdw_sg_len -= copy_len;
788 		off += copy_len;
789 		io->scsiio.ext_data_filled += copy_len;
790 		io->scsiio.kern_data_resid -= copy_len;
791 
792 		if (cdw->cdw_sg_len == 0) {
793 			/*
794 			 * End of current segment.
795 			 */
796 			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
797 				/*
798 				 * Last segment in scatter/gather list.
799 				 */
800 				break;
801 			}
802 			cdw->cdw_sg_index++;
803 		}
804 
805 		if (off == len) {
806 			/*
807 			 * End of PDU payload.
808 			 */
809 			break;
810 		}
811 	}
812 
813 	if (len > off) {
814 		/*
815 		 * In case of unsolicited data, it's possible that the buffer
816 		 * provided by CTL is smaller than negotiated FirstBurstLength.
817 		 * Just ignore the superfluous data; will ask for them with R2T
818 		 * on next call to cfiscsi_datamove().
819 		 *
820 		 * This obviously can only happen with SCSI Command PDU.
821 		 */
822 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
823 		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
824 			return (true);
825 
826 		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
827 		    "expected %zd; dropping connection",
828 		    icl_pdu_data_segment_length(request), off);
829 		ctl_set_data_phase_error(&io->scsiio);
830 		cfiscsi_session_terminate(cs);
831 		return (true);
832 	}
833 
834 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
835 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
836 		CFISCSI_SESSION_WARN(cs, "got the final packet without "
837 		    "the F flag; flags = 0x%x; dropping connection",
838 		    bhsdo->bhsdo_flags);
839 		ctl_set_data_phase_error(&io->scsiio);
840 		cfiscsi_session_terminate(cs);
841 		return (true);
842 	}
843 
844 	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
845 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
846 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
847 		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
848 			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
849 			    "transmitted size was %zd bytes instead of %d; "
850 			    "dropping connection",
851 			    (size_t)io->scsiio.ext_data_filled,
852 			    cdw->cdw_r2t_end);
853 			ctl_set_data_phase_error(&io->scsiio);
854 			cfiscsi_session_terminate(cs);
855 			return (true);
856 		} else {
857 			/*
858 			 * For SCSI Command PDU, this just means we need to
859 			 * solicit more data by sending R2T.
860 			 */
861 			return (false);
862 		}
863 	}
864 
865 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
866 #if 0
867 		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
868 		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
869 #endif
870 
871 		return (true);
872 	}
873 
874 	return (false);
875 }
876 
877 static void
878 cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
879 {
880 	struct iscsi_bhs_data_out *bhsdo;
881 	struct cfiscsi_session *cs;
882 	struct cfiscsi_data_wait *cdw = NULL;
883 	union ctl_io *io;
884 	bool done;
885 
886 	cs = PDU_SESSION(request);
887 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
888 
889 	CFISCSI_SESSION_LOCK(cs);
890 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
891 #if 0
892 		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
893 		    "ttt 0x%x, itt 0x%x",
894 		    bhsdo->bhsdo_target_transfer_tag,
895 		    bhsdo->bhsdo_initiator_task_tag,
896 		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
897 #endif
898 		if (bhsdo->bhsdo_target_transfer_tag ==
899 		    cdw->cdw_target_transfer_tag)
900 			break;
901 	}
902 	CFISCSI_SESSION_UNLOCK(cs);
903 	if (cdw == NULL) {
904 		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
905 		    "0x%x, not found; dropping connection",
906 		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
907 		icl_pdu_free(request);
908 		cfiscsi_session_terminate(cs);
909 		return;
910 	}
911 
912 	if (cdw->cdw_datasn != ntohl(bhsdo->bhsdo_datasn)) {
913 		CFISCSI_SESSION_WARN(cs, "received Data-Out PDU with "
914 		    "DataSN %u, while expected %u; dropping connection",
915 		    ntohl(bhsdo->bhsdo_datasn), cdw->cdw_datasn);
916 		icl_pdu_free(request);
917 		cfiscsi_session_terminate(cs);
918 		return;
919 	}
920 	cdw->cdw_datasn += request->ip_additional_pdus + 1;
921 
922 	io = cdw->cdw_ctl_io;
923 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
924 	    ("CTL_FLAG_DATA_IN"));
925 
926 	done = cfiscsi_handle_data_segment(request, cdw);
927 	if (done) {
928 		CFISCSI_SESSION_LOCK(cs);
929 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
930 		CFISCSI_SESSION_UNLOCK(cs);
931 		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
932 		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
933 		cfiscsi_data_wait_free(cs, cdw);
934 		io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
935 		if (done)
936 			ctl_datamove_done(io, false);
937 		else
938 			cfiscsi_datamove_out(io);
939 	}
940 
941 	icl_pdu_free(request);
942 }
943 
944 static void
945 cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
946 {
947 	struct iscsi_bhs_logout_request *bhslr;
948 	struct iscsi_bhs_logout_response *bhslr2;
949 	struct icl_pdu *response;
950 	struct cfiscsi_session *cs;
951 
952 	cs = PDU_SESSION(request);
953 	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
954 	switch (bhslr->bhslr_reason & 0x7f) {
955 	case BHSLR_REASON_CLOSE_SESSION:
956 	case BHSLR_REASON_CLOSE_CONNECTION:
957 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
958 		if (response == NULL) {
959 			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
960 			icl_pdu_free(request);
961 			cfiscsi_session_terminate(cs);
962 			return;
963 		}
964 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
965 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
966 		bhslr2->bhslr_flags = 0x80;
967 		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
968 		bhslr2->bhslr_initiator_task_tag =
969 		    bhslr->bhslr_initiator_task_tag;
970 		icl_pdu_free(request);
971 		cfiscsi_pdu_queue(response);
972 		cfiscsi_session_terminate(cs);
973 		break;
974 	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
975 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
976 		if (response == NULL) {
977 			CFISCSI_SESSION_WARN(cs,
978 			    "failed to allocate memory; dropping connection");
979 			icl_pdu_free(request);
980 			cfiscsi_session_terminate(cs);
981 			return;
982 		}
983 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
984 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
985 		bhslr2->bhslr_flags = 0x80;
986 		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
987 		bhslr2->bhslr_initiator_task_tag =
988 		    bhslr->bhslr_initiator_task_tag;
989 		icl_pdu_free(request);
990 		cfiscsi_pdu_queue(response);
991 		break;
992 	default:
993 		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
994 		    bhslr->bhslr_reason);
995 		icl_pdu_free(request);
996 		cfiscsi_session_terminate(cs);
997 		break;
998 	}
999 }
1000 
1001 static void
1002 cfiscsi_callout(void *context)
1003 {
1004 	struct icl_pdu *cp;
1005 	struct iscsi_bhs_nop_in *bhsni;
1006 	struct cfiscsi_session *cs;
1007 
1008 	cs = context;
1009 
1010 	if (cs->cs_terminating)
1011 		return;
1012 
1013 	callout_schedule(&cs->cs_callout, 1 * hz);
1014 
1015 	atomic_add_int(&cs->cs_timeout, 1);
1016 
1017 #ifdef ICL_KERNEL_PROXY
1018 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1019 		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1020 			CFISCSI_SESSION_WARN(cs, "login timed out after "
1021 			    "%d seconds; dropping connection", cs->cs_timeout);
1022 			cfiscsi_session_terminate(cs);
1023 		}
1024 		return;
1025 	}
1026 #endif
1027 
1028 	if (ping_timeout <= 0) {
1029 		/*
1030 		 * Pings are disabled.  Don't send NOP-In in this case;
1031 		 * user might have disabled pings to work around problems
1032 		 * with certain initiators that can't properly handle
1033 		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1034 		 * triggering reconnection, should the user decide to
1035 		 * reenable them.
1036 		 */
1037 		cs->cs_timeout = 0;
1038 		return;
1039 	}
1040 
1041 	if (cs->cs_timeout >= ping_timeout) {
1042 		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1043 		    "dropping connection",  ping_timeout);
1044 		cfiscsi_session_terminate(cs);
1045 		return;
1046 	}
1047 
1048 	/*
1049 	 * If the ping was reset less than one second ago - which means
1050 	 * that we've received some PDU during the last second - assume
1051 	 * the traffic flows correctly and don't bother sending a NOP-Out.
1052 	 *
1053 	 * (It's 2 - one for one second, and one for incrementing is_timeout
1054 	 * earlier in this routine.)
1055 	 */
1056 	if (cs->cs_timeout < 2)
1057 		return;
1058 
1059 	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1060 	if (cp == NULL) {
1061 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1062 		return;
1063 	}
1064 	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1065 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1066 	bhsni->bhsni_flags = 0x80;
1067 	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1068 
1069 	cfiscsi_pdu_queue(cp);
1070 }
1071 
1072 static struct cfiscsi_data_wait *
1073 cfiscsi_data_wait_new(struct cfiscsi_session *cs, union ctl_io *io,
1074     uint32_t initiator_task_tag, uint32_t *target_transfer_tagp)
1075 {
1076 	struct cfiscsi_data_wait *cdw;
1077 	int error;
1078 
1079 	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
1080 	if (cdw == NULL) {
1081 		CFISCSI_SESSION_WARN(cs,
1082 		    "failed to allocate %zd bytes", sizeof(*cdw));
1083 		return (NULL);
1084 	}
1085 
1086 	error = icl_conn_transfer_setup(cs->cs_conn, PRIV_REQUEST(io), io,
1087 	    target_transfer_tagp, &cdw->cdw_icl_prv);
1088 	if (error != 0) {
1089 		CFISCSI_SESSION_WARN(cs,
1090 		    "icl_conn_transfer_setup() failed with error %d", error);
1091 		uma_zfree(cfiscsi_data_wait_zone, cdw);
1092 		return (NULL);
1093 	}
1094 
1095 	cdw->cdw_ctl_io = io;
1096 	cdw->cdw_target_transfer_tag = *target_transfer_tagp;
1097 	cdw->cdw_initiator_task_tag = initiator_task_tag;
1098 
1099 	return (cdw);
1100 }
1101 
1102 static void
1103 cfiscsi_data_wait_free(struct cfiscsi_session *cs,
1104     struct cfiscsi_data_wait *cdw)
1105 {
1106 
1107 	icl_conn_transfer_done(cs->cs_conn, cdw->cdw_icl_prv);
1108 	uma_zfree(cfiscsi_data_wait_zone, cdw);
1109 }
1110 
1111 static void
1112 cfiscsi_data_wait_abort(struct cfiscsi_session *cs,
1113     struct cfiscsi_data_wait *cdw, int status)
1114 {
1115 	union ctl_io *cdw_io;
1116 
1117 	/*
1118 	 * Set nonzero port status; this prevents backends from
1119 	 * assuming that the data transfer actually succeeded
1120 	 * and writing uninitialized data to disk.
1121 	 */
1122 	MPASS(status != 0);
1123 	cdw_io = cdw->cdw_ctl_io;
1124 	cdw_io->io_hdr.flags &= ~CTL_FLAG_DMA_INPROG;
1125 	cdw_io->scsiio.io_hdr.port_status = status;
1126 	cfiscsi_data_wait_free(cs, cdw);
1127 	ctl_datamove_done(cdw_io, false);
1128 }
1129 
1130 static void
1131 cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1132 {
1133 	struct cfiscsi_data_wait *cdw;
1134 	union ctl_io *io;
1135 	int error, last, wait;
1136 
1137 	if (cs->cs_target == NULL)
1138 		return;		/* No target yet, so nothing to do. */
1139 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1140 	ctl_zero_io(io);
1141 	PRIV_REQUEST(io) = cs;
1142 	io->io_hdr.io_type = CTL_IO_TASK;
1143 	io->io_hdr.nexus.initid = cs->cs_ctl_initid;
1144 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1145 	io->io_hdr.nexus.targ_lun = 0;
1146 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1147 	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1148 	wait = cs->cs_outstanding_ctl_pdus;
1149 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1150 	error = ctl_run(io);
1151 	if (error != CTL_RETVAL_COMPLETE) {
1152 		CFISCSI_SESSION_WARN(cs, "ctl_run() failed; error %d", error);
1153 		refcount_release(&cs->cs_outstanding_ctl_pdus);
1154 		ctl_free_io(io);
1155 	}
1156 
1157 	CFISCSI_SESSION_LOCK(cs);
1158 	cs->cs_terminating_tasks = true;
1159 	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1160 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1161 		CFISCSI_SESSION_UNLOCK(cs);
1162 		cfiscsi_data_wait_abort(cs, cdw, 42);
1163 		CFISCSI_SESSION_LOCK(cs);
1164 	}
1165 	CFISCSI_SESSION_UNLOCK(cs);
1166 
1167 	/*
1168 	 * Wait for CTL to terminate all the tasks.
1169 	 */
1170 	if (wait > 0)
1171 		CFISCSI_SESSION_WARN(cs,
1172 		    "waiting for CTL to terminate %d tasks", wait);
1173 	for (;;) {
1174 		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1175 		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1176 		if (last != 0)
1177 			break;
1178 		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1179 		    0, "cfiscsi_terminate", hz / 100);
1180 	}
1181 	if (wait > 0)
1182 		CFISCSI_SESSION_WARN(cs, "tasks terminated");
1183 }
1184 
1185 static void
1186 cfiscsi_maintenance_thread(void *arg)
1187 {
1188 	struct cfiscsi_session *cs;
1189 
1190 	cs = arg;
1191 
1192 	for (;;) {
1193 		CFISCSI_SESSION_LOCK(cs);
1194 		if (cs->cs_terminating == false || cs->cs_handoff_in_progress)
1195 			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1196 		CFISCSI_SESSION_UNLOCK(cs);
1197 
1198 		if (cs->cs_terminating && cs->cs_handoff_in_progress == false) {
1199 			/*
1200 			 * We used to wait up to 30 seconds to deliver queued
1201 			 * PDUs to the initiator.  We also tried hard to deliver
1202 			 * SCSI Responses for the aborted PDUs.  We don't do
1203 			 * that anymore.  We might need to revisit that.
1204 			 */
1205 			callout_drain(&cs->cs_callout);
1206 			icl_conn_close(cs->cs_conn);
1207 
1208 			/*
1209 			 * At this point ICL receive thread is no longer
1210 			 * running; no new tasks can be queued.
1211 			 */
1212 			cfiscsi_session_terminate_tasks(cs);
1213 			cfiscsi_session_delete(cs);
1214 			kthread_exit();
1215 			return;
1216 		}
1217 		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1218 	}
1219 }
1220 
1221 static void
1222 cfiscsi_session_terminate(struct cfiscsi_session *cs)
1223 {
1224 
1225 	cs->cs_terminating = true;
1226 	cv_signal(&cs->cs_maintenance_cv);
1227 #ifdef ICL_KERNEL_PROXY
1228 	cv_signal(&cs->cs_login_cv);
1229 #endif
1230 }
1231 
1232 static int
1233 cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1234 {
1235 	struct cfiscsi_target *ct;
1236 	char *name;
1237 	int i;
1238 
1239 	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1240 
1241 	ct = cs->cs_target;
1242 	name = strdup(cs->cs_initiator_id, M_CTL);
1243 	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1244 	if (i < 0) {
1245 		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1246 		    i);
1247 		cs->cs_ctl_initid = -1;
1248 		return (1);
1249 	}
1250 	cs->cs_ctl_initid = i;
1251 #if 0
1252 	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1253 #endif
1254 
1255 	return (0);
1256 }
1257 
1258 static void
1259 cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1260 {
1261 	int error;
1262 
1263 	if (cs->cs_ctl_initid == -1)
1264 		return;
1265 
1266 	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1267 	if (error != 0) {
1268 		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1269 		    error);
1270 	}
1271 	cs->cs_ctl_initid = -1;
1272 }
1273 
1274 static struct cfiscsi_session *
1275 cfiscsi_session_new(struct cfiscsi_softc *softc, const char *offload)
1276 {
1277 	struct cfiscsi_session *cs;
1278 	int error;
1279 
1280 	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1281 	if (cs == NULL) {
1282 		CFISCSI_WARN("malloc failed");
1283 		return (NULL);
1284 	}
1285 	cs->cs_ctl_initid = -1;
1286 
1287 	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1288 	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1289 	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1290 	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1291 #ifdef ICL_KERNEL_PROXY
1292 	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1293 #endif
1294 
1295 	/*
1296 	 * The purpose of this is to avoid racing with session shutdown.
1297 	 * Otherwise we could have the maintenance thread call icl_conn_close()
1298 	 * before we call icl_conn_handoff().
1299 	 */
1300 	cs->cs_handoff_in_progress = true;
1301 
1302 	cs->cs_conn = icl_new_conn(offload, false, "cfiscsi", &cs->cs_lock);
1303 	if (cs->cs_conn == NULL) {
1304 		free(cs, M_CFISCSI);
1305 		return (NULL);
1306 	}
1307 	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1308 	cs->cs_conn->ic_error = cfiscsi_error_callback;
1309 	cs->cs_conn->ic_prv0 = cs;
1310 
1311 	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1312 	if (error != 0) {
1313 		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1314 		free(cs, M_CFISCSI);
1315 		return (NULL);
1316 	}
1317 
1318 	mtx_lock(&softc->lock);
1319 	cs->cs_id = ++softc->last_session_id;
1320 	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1321 	mtx_unlock(&softc->lock);
1322 
1323 	/*
1324 	 * Start pinging the initiator.
1325 	 */
1326 	callout_init(&cs->cs_callout, 1);
1327 	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1328 
1329 	return (cs);
1330 }
1331 
1332 static void
1333 cfiscsi_session_delete(struct cfiscsi_session *cs)
1334 {
1335 	struct cfiscsi_softc *softc;
1336 
1337 	softc = &cfiscsi_softc;
1338 
1339 	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1340 	    ("destroying session with outstanding CTL pdus"));
1341 	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1342 	    ("destroying session with non-empty queue"));
1343 
1344 	mtx_lock(&softc->lock);
1345 	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1346 	mtx_unlock(&softc->lock);
1347 
1348 	cfiscsi_session_unregister_initiator(cs);
1349 	if (cs->cs_target != NULL)
1350 		cfiscsi_target_release(cs->cs_target);
1351 	icl_conn_close(cs->cs_conn);
1352 	icl_conn_free(cs->cs_conn);
1353 	free(cs, M_CFISCSI);
1354 	cv_signal(&softc->sessions_cv);
1355 }
1356 
1357 static int
1358 cfiscsi_init(void)
1359 {
1360 	struct cfiscsi_softc *softc;
1361 
1362 	softc = &cfiscsi_softc;
1363 	bzero(softc, sizeof(*softc));
1364 	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1365 
1366 	cv_init(&softc->sessions_cv, "cfiscsi_sessions");
1367 #ifdef ICL_KERNEL_PROXY
1368 	cv_init(&softc->accept_cv, "cfiscsi_accept");
1369 #endif
1370 	TAILQ_INIT(&softc->sessions);
1371 	TAILQ_INIT(&softc->targets);
1372 
1373 	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1374 	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1375 	    UMA_ALIGN_PTR, 0);
1376 
1377 	return (0);
1378 }
1379 
1380 static int
1381 cfiscsi_shutdown(void)
1382 {
1383 	struct cfiscsi_softc *softc = &cfiscsi_softc;
1384 
1385 	if (!TAILQ_EMPTY(&softc->sessions) || !TAILQ_EMPTY(&softc->targets))
1386 		return (EBUSY);
1387 
1388 	uma_zdestroy(cfiscsi_data_wait_zone);
1389 #ifdef ICL_KERNEL_PROXY
1390 	cv_destroy(&softc->accept_cv);
1391 #endif
1392 	cv_destroy(&softc->sessions_cv);
1393 	mtx_destroy(&softc->lock);
1394 	return (0);
1395 }
1396 
1397 #ifdef ICL_KERNEL_PROXY
1398 static void
1399 cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1400 {
1401 	struct cfiscsi_session *cs;
1402 
1403 	cs = cfiscsi_session_new(&cfiscsi_softc, NULL);
1404 	if (cs == NULL) {
1405 		CFISCSI_WARN("failed to create session");
1406 		return;
1407 	}
1408 
1409 	icl_conn_handoff_sock(cs->cs_conn, so);
1410 	cs->cs_initiator_sa = sa;
1411 	cs->cs_portal_id = portal_id;
1412 	cs->cs_handoff_in_progress = false;
1413 	cs->cs_waiting_for_ctld = true;
1414 	cv_signal(&cfiscsi_softc.accept_cv);
1415 
1416 	CFISCSI_SESSION_LOCK(cs);
1417 	/*
1418 	 * Wake up the maintenance thread if we got scheduled for termination
1419 	 * somewhere between cfiscsi_session_new() and icl_conn_handoff_sock().
1420 	 */
1421 	if (cs->cs_terminating)
1422 		cfiscsi_session_terminate(cs);
1423 	CFISCSI_SESSION_UNLOCK(cs);
1424 }
1425 #endif
1426 
1427 static void
1428 cfiscsi_online(void *arg)
1429 {
1430 	struct cfiscsi_softc *softc;
1431 	struct cfiscsi_target *ct;
1432 	int online;
1433 
1434 	ct = (struct cfiscsi_target *)arg;
1435 	softc = ct->ct_softc;
1436 
1437 	mtx_lock(&softc->lock);
1438 	if (ct->ct_online) {
1439 		mtx_unlock(&softc->lock);
1440 		return;
1441 	}
1442 	ct->ct_online = 1;
1443 	online = softc->online++;
1444 	mtx_unlock(&softc->lock);
1445 	if (online > 0)
1446 		return;
1447 
1448 #ifdef ICL_KERNEL_PROXY
1449 	if (softc->listener != NULL)
1450 		icl_listen_free(softc->listener);
1451 	softc->listener = icl_listen_new(cfiscsi_accept);
1452 #endif
1453 }
1454 
1455 static void
1456 cfiscsi_offline(void *arg)
1457 {
1458 	struct cfiscsi_softc *softc;
1459 	struct cfiscsi_target *ct;
1460 	struct cfiscsi_session *cs;
1461 	int error, online;
1462 
1463 	ct = (struct cfiscsi_target *)arg;
1464 	softc = ct->ct_softc;
1465 
1466 	mtx_lock(&softc->lock);
1467 	if (!ct->ct_online) {
1468 		mtx_unlock(&softc->lock);
1469 		return;
1470 	}
1471 	ct->ct_online = 0;
1472 	online = --softc->online;
1473 
1474 	do {
1475 		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1476 			if (cs->cs_target == ct)
1477 				cfiscsi_session_terminate(cs);
1478 		}
1479 		TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1480 			if (cs->cs_target == ct)
1481 				break;
1482 		}
1483 		if (cs != NULL) {
1484 			error = cv_wait_sig(&softc->sessions_cv, &softc->lock);
1485 			if (error != 0) {
1486 				CFISCSI_SESSION_DEBUG(cs,
1487 				    "cv_wait failed with error %d\n", error);
1488 				break;
1489 			}
1490 		}
1491 	} while (cs != NULL && ct->ct_online == 0);
1492 	mtx_unlock(&softc->lock);
1493 	if (online > 0)
1494 		return;
1495 
1496 #ifdef ICL_KERNEL_PROXY
1497 	icl_listen_free(softc->listener);
1498 	softc->listener = NULL;
1499 #endif
1500 }
1501 
1502 static int
1503 cfiscsi_info(void *arg, struct sbuf *sb)
1504 {
1505 	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1506 	int retval;
1507 
1508 	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1509 	    ct->ct_state);
1510 	return (retval);
1511 }
1512 
1513 static void
1514 cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1515 {
1516 	struct cfiscsi_softc *softc;
1517 	struct cfiscsi_session *cs, *cs2;
1518 	struct cfiscsi_target *ct;
1519 	struct ctl_iscsi_handoff_params *cihp;
1520 	int error;
1521 
1522 	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1523 	softc = &cfiscsi_softc;
1524 
1525 	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1526 	    cihp->initiator_name, cihp->initiator_addr,
1527 	    cihp->target_name);
1528 
1529 	ct = cfiscsi_target_find(softc, cihp->target_name,
1530 	    cihp->portal_group_tag);
1531 	if (ct == NULL) {
1532 		ci->status = CTL_ISCSI_ERROR;
1533 		snprintf(ci->error_str, sizeof(ci->error_str),
1534 		    "%s: target not found", __func__);
1535 		return;
1536 	}
1537 
1538 #ifdef ICL_KERNEL_PROXY
1539 	if (cihp->socket > 0 && cihp->connection_id > 0) {
1540 		snprintf(ci->error_str, sizeof(ci->error_str),
1541 		    "both socket and connection_id set");
1542 		ci->status = CTL_ISCSI_ERROR;
1543 		cfiscsi_target_release(ct);
1544 		return;
1545 	}
1546 	if (cihp->socket == 0) {
1547 		mtx_lock(&cfiscsi_softc.lock);
1548 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1549 			if (cs->cs_id == cihp->connection_id)
1550 				break;
1551 		}
1552 		if (cs == NULL) {
1553 			mtx_unlock(&cfiscsi_softc.lock);
1554 			snprintf(ci->error_str, sizeof(ci->error_str),
1555 			    "connection not found");
1556 			ci->status = CTL_ISCSI_ERROR;
1557 			cfiscsi_target_release(ct);
1558 			return;
1559 		}
1560 		mtx_unlock(&cfiscsi_softc.lock);
1561 	} else {
1562 #endif
1563 		cs = cfiscsi_session_new(softc, cihp->offload);
1564 		if (cs == NULL) {
1565 			ci->status = CTL_ISCSI_ERROR;
1566 			snprintf(ci->error_str, sizeof(ci->error_str),
1567 			    "%s: cfiscsi_session_new failed", __func__);
1568 			cfiscsi_target_release(ct);
1569 			return;
1570 		}
1571 #ifdef ICL_KERNEL_PROXY
1572 	}
1573 #endif
1574 
1575 	/*
1576 	 * First PDU of Full Feature phase has the same CmdSN as the last
1577 	 * PDU from the Login Phase received from the initiator.  Thus,
1578 	 * the -1 below.
1579 	 */
1580 	cs->cs_cmdsn = cihp->cmdsn;
1581 	cs->cs_statsn = cihp->statsn;
1582 	cs->cs_conn->ic_max_recv_data_segment_length =
1583 	    cihp->max_recv_data_segment_length;
1584 	cs->cs_conn->ic_max_send_data_segment_length =
1585 	    cihp->max_send_data_segment_length;
1586 	cs->cs_max_burst_length = cihp->max_burst_length;
1587 	cs->cs_first_burst_length = cihp->first_burst_length;
1588 	cs->cs_immediate_data = !!cihp->immediate_data;
1589 	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1590 		cs->cs_conn->ic_header_crc32c = true;
1591 	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1592 		cs->cs_conn->ic_data_crc32c = true;
1593 
1594 	strlcpy(cs->cs_initiator_name,
1595 	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1596 	strlcpy(cs->cs_initiator_addr,
1597 	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1598 	strlcpy(cs->cs_initiator_alias,
1599 	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1600 	memcpy(cs->cs_initiator_isid,
1601 	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1602 	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1603 	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1604 	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1605 	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1606 	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1607 
1608 	mtx_lock(&softc->lock);
1609 	if (ct->ct_online == 0) {
1610 		mtx_unlock(&softc->lock);
1611 		CFISCSI_SESSION_LOCK(cs);
1612 		cs->cs_handoff_in_progress = false;
1613 		cfiscsi_session_terminate(cs);
1614 		CFISCSI_SESSION_UNLOCK(cs);
1615 		cfiscsi_target_release(ct);
1616 		ci->status = CTL_ISCSI_ERROR;
1617 		snprintf(ci->error_str, sizeof(ci->error_str),
1618 		    "%s: port offline", __func__);
1619 		return;
1620 	}
1621 	cs->cs_target = ct;
1622 	mtx_unlock(&softc->lock);
1623 
1624 restart:
1625 	if (!cs->cs_terminating) {
1626 		mtx_lock(&softc->lock);
1627 		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1628 			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1629 			    cs->cs_target == cs2->cs_target &&
1630 			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1631 				if (strcmp(cs->cs_initiator_addr,
1632 				    cs2->cs_initiator_addr) != 0) {
1633 					CFISCSI_SESSION_WARN(cs2,
1634 					    "session reinstatement from "
1635 					    "different address %s",
1636 					    cs->cs_initiator_addr);
1637 				} else {
1638 					CFISCSI_SESSION_DEBUG(cs2,
1639 					    "session reinstatement");
1640 				}
1641 				cfiscsi_session_terminate(cs2);
1642 				mtx_unlock(&softc->lock);
1643 				pause("cfiscsi_reinstate", 1);
1644 				goto restart;
1645 			}
1646 		}
1647 		mtx_unlock(&softc->lock);
1648 	}
1649 
1650 	/*
1651 	 * Register initiator with CTL.
1652 	 */
1653 	cfiscsi_session_register_initiator(cs);
1654 
1655 #ifdef ICL_KERNEL_PROXY
1656 	if (cihp->socket > 0) {
1657 #endif
1658 		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1659 		if (error != 0) {
1660 			CFISCSI_SESSION_LOCK(cs);
1661 			cs->cs_handoff_in_progress = false;
1662 			cfiscsi_session_terminate(cs);
1663 			CFISCSI_SESSION_UNLOCK(cs);
1664 			ci->status = CTL_ISCSI_ERROR;
1665 			snprintf(ci->error_str, sizeof(ci->error_str),
1666 			    "%s: icl_conn_handoff failed with error %d",
1667 			    __func__, error);
1668 			return;
1669 		}
1670 #ifdef ICL_KERNEL_PROXY
1671 	}
1672 #endif
1673 
1674 #ifdef ICL_KERNEL_PROXY
1675 	cs->cs_login_phase = false;
1676 
1677 	/*
1678 	 * First PDU of the Full Feature phase has likely already arrived.
1679 	 * We have to pick it up and execute properly.
1680 	 */
1681 	if (cs->cs_login_pdu != NULL) {
1682 		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1683 		cfiscsi_pdu_handle(cs->cs_login_pdu);
1684 		cs->cs_login_pdu = NULL;
1685 	}
1686 #endif
1687 
1688 	CFISCSI_SESSION_LOCK(cs);
1689 	cs->cs_handoff_in_progress = false;
1690 
1691 	/*
1692 	 * Wake up the maintenance thread if we got scheduled for termination.
1693 	 */
1694 	if (cs->cs_terminating)
1695 		cfiscsi_session_terminate(cs);
1696 	CFISCSI_SESSION_UNLOCK(cs);
1697 
1698 	ci->status = CTL_ISCSI_OK;
1699 }
1700 
1701 static void
1702 cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1703 {
1704 	struct ctl_iscsi_list_params *cilp;
1705 	struct cfiscsi_session *cs;
1706 	struct cfiscsi_softc *softc;
1707 	struct sbuf *sb;
1708 	int error;
1709 
1710 	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1711 	softc = &cfiscsi_softc;
1712 
1713 	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1714 	if (sb == NULL) {
1715 		ci->status = CTL_ISCSI_ERROR;
1716 		snprintf(ci->error_str, sizeof(ci->error_str),
1717 		    "Unable to allocate %d bytes for iSCSI session list",
1718 		    cilp->alloc_len);
1719 		return;
1720 	}
1721 
1722 	sbuf_printf(sb, "<ctlislist>\n");
1723 	mtx_lock(&softc->lock);
1724 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1725 		if (cs->cs_target == NULL)
1726 			continue;
1727 		error = sbuf_printf(sb, "<connection id=\"%d\">"
1728 		    "<initiator>%s</initiator>"
1729 		    "<initiator_addr>%s</initiator_addr>"
1730 		    "<initiator_alias>%s</initiator_alias>"
1731 		    "<target>%s</target>"
1732 		    "<target_alias>%s</target_alias>"
1733 		    "<target_portal_group_tag>%u</target_portal_group_tag>"
1734 		    "<header_digest>%s</header_digest>"
1735 		    "<data_digest>%s</data_digest>"
1736 		    "<max_recv_data_segment_length>%d</max_recv_data_segment_length>"
1737 		    "<max_send_data_segment_length>%d</max_send_data_segment_length>"
1738 		    "<max_burst_length>%d</max_burst_length>"
1739 		    "<first_burst_length>%d</first_burst_length>"
1740 		    "<immediate_data>%d</immediate_data>"
1741 		    "<iser>%d</iser>"
1742 		    "<offload>%s</offload>"
1743 		    "</connection>\n",
1744 		    cs->cs_id,
1745 		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1746 		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1747 		    cs->cs_target->ct_tag,
1748 		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1749 		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1750 		    cs->cs_conn->ic_max_recv_data_segment_length,
1751 		    cs->cs_conn->ic_max_send_data_segment_length,
1752 		    cs->cs_max_burst_length,
1753 		    cs->cs_first_burst_length,
1754 		    cs->cs_immediate_data,
1755 		    cs->cs_conn->ic_iser,
1756 		    cs->cs_conn->ic_offload);
1757 		if (error != 0)
1758 			break;
1759 	}
1760 	mtx_unlock(&softc->lock);
1761 	error = sbuf_printf(sb, "</ctlislist>\n");
1762 	if (error != 0) {
1763 		sbuf_delete(sb);
1764 		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1765 		snprintf(ci->error_str, sizeof(ci->error_str),
1766 		    "Out of space, %d bytes is too small", cilp->alloc_len);
1767 		return;
1768 	}
1769 	sbuf_finish(sb);
1770 
1771 	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1772 	if (error != 0) {
1773 		sbuf_delete(sb);
1774 		snprintf(ci->error_str, sizeof(ci->error_str),
1775 		    "copyout failed with error %d", error);
1776 		ci->status = CTL_ISCSI_ERROR;
1777 		return;
1778 	}
1779 	cilp->fill_len = sbuf_len(sb) + 1;
1780 	ci->status = CTL_ISCSI_OK;
1781 	sbuf_delete(sb);
1782 }
1783 
1784 static void
1785 cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1786 {
1787 	struct icl_pdu *response;
1788 	struct iscsi_bhs_asynchronous_message *bhsam;
1789 	struct ctl_iscsi_logout_params *cilp;
1790 	struct cfiscsi_session *cs;
1791 	struct cfiscsi_softc *softc;
1792 	int found = 0;
1793 
1794 	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1795 	softc = &cfiscsi_softc;
1796 
1797 	mtx_lock(&softc->lock);
1798 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1799 		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1800 		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1801 		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1802 			continue;
1803 
1804 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1805 		if (response == NULL) {
1806 			ci->status = CTL_ISCSI_ERROR;
1807 			snprintf(ci->error_str, sizeof(ci->error_str),
1808 			    "Unable to allocate memory");
1809 			mtx_unlock(&softc->lock);
1810 			return;
1811 		}
1812 		bhsam =
1813 		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1814 		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1815 		bhsam->bhsam_flags = 0x80;
1816 		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1817 		bhsam->bhsam_parameter3 = htons(10);
1818 		cfiscsi_pdu_queue(response);
1819 		found++;
1820 	}
1821 	mtx_unlock(&softc->lock);
1822 
1823 	if (found == 0) {
1824 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1825 		snprintf(ci->error_str, sizeof(ci->error_str),
1826 		    "No matching connections found");
1827 		return;
1828 	}
1829 
1830 	ci->status = CTL_ISCSI_OK;
1831 }
1832 
1833 static void
1834 cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1835 {
1836 	struct icl_pdu *response;
1837 	struct iscsi_bhs_asynchronous_message *bhsam;
1838 	struct ctl_iscsi_terminate_params *citp;
1839 	struct cfiscsi_session *cs;
1840 	struct cfiscsi_softc *softc;
1841 	int found = 0;
1842 
1843 	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1844 	softc = &cfiscsi_softc;
1845 
1846 	mtx_lock(&softc->lock);
1847 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1848 		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1849 		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1850 		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1851 			continue;
1852 
1853 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1854 		if (response == NULL) {
1855 			/*
1856 			 * Oh well.  Just terminate the connection.
1857 			 */
1858 		} else {
1859 			bhsam = (struct iscsi_bhs_asynchronous_message *)
1860 			    response->ip_bhs;
1861 			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1862 			bhsam->bhsam_flags = 0x80;
1863 			bhsam->bhsam_0xffffffff = 0xffffffff;
1864 			bhsam->bhsam_async_event =
1865 			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1866 			cfiscsi_pdu_queue(response);
1867 		}
1868 		cfiscsi_session_terminate(cs);
1869 		found++;
1870 	}
1871 	mtx_unlock(&softc->lock);
1872 
1873 	if (found == 0) {
1874 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1875 		snprintf(ci->error_str, sizeof(ci->error_str),
1876 		    "No matching connections found");
1877 		return;
1878 	}
1879 
1880 	ci->status = CTL_ISCSI_OK;
1881 }
1882 
1883 static void
1884 cfiscsi_ioctl_limits(struct ctl_iscsi *ci)
1885 {
1886 	struct ctl_iscsi_limits_params *cilp;
1887 	struct icl_drv_limits idl;
1888 	int error;
1889 
1890 	cilp = (struct ctl_iscsi_limits_params *)&(ci->data);
1891 
1892 	error = icl_limits(cilp->offload, false, &idl);
1893 	if (error != 0) {
1894 		ci->status = CTL_ISCSI_ERROR;
1895 		snprintf(ci->error_str, sizeof(ci->error_str),
1896 			"%s: icl_limits failed with error %d",
1897 			__func__, error);
1898 		return;
1899 	}
1900 
1901 	cilp->max_recv_data_segment_length =
1902 	    idl.idl_max_recv_data_segment_length;
1903 	cilp->max_send_data_segment_length =
1904 	    idl.idl_max_send_data_segment_length;
1905 	cilp->max_burst_length = idl.idl_max_burst_length;
1906 	cilp->first_burst_length = idl.idl_first_burst_length;
1907 
1908 	ci->status = CTL_ISCSI_OK;
1909 }
1910 
1911 #ifdef ICL_KERNEL_PROXY
1912 static void
1913 cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1914 {
1915 	struct ctl_iscsi_listen_params *cilp;
1916 	struct sockaddr *sa;
1917 	int error;
1918 
1919 	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1920 
1921 	if (cfiscsi_softc.listener == NULL) {
1922 		CFISCSI_DEBUG("no listener");
1923 		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1924 		ci->status = CTL_ISCSI_ERROR;
1925 		return;
1926 	}
1927 
1928 	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1929 	if (error != 0) {
1930 		CFISCSI_DEBUG("getsockaddr, error %d", error);
1931 		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1932 		ci->status = CTL_ISCSI_ERROR;
1933 		return;
1934 	}
1935 
1936 	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1937 	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1938 	if (error != 0) {
1939 		free(sa, M_SONAME);
1940 		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1941 		snprintf(ci->error_str, sizeof(ci->error_str),
1942 		    "icl_listen_add failed, error %d", error);
1943 		ci->status = CTL_ISCSI_ERROR;
1944 		return;
1945 	}
1946 
1947 	ci->status = CTL_ISCSI_OK;
1948 }
1949 
1950 static void
1951 cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1952 {
1953 	struct ctl_iscsi_accept_params *ciap;
1954 	struct cfiscsi_session *cs;
1955 	int error;
1956 
1957 	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1958 
1959 	mtx_lock(&cfiscsi_softc.lock);
1960 	for (;;) {
1961 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1962 			if (cs->cs_waiting_for_ctld)
1963 				break;
1964 		}
1965 		if (cs != NULL)
1966 			break;
1967 		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1968 		if (error != 0) {
1969 			mtx_unlock(&cfiscsi_softc.lock);
1970 			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1971 			ci->status = CTL_ISCSI_ERROR;
1972 			return;
1973 		}
1974 	}
1975 	mtx_unlock(&cfiscsi_softc.lock);
1976 
1977 	cs->cs_waiting_for_ctld = false;
1978 	cs->cs_login_phase = true;
1979 
1980 	ciap->connection_id = cs->cs_id;
1981 	ciap->portal_id = cs->cs_portal_id;
1982 	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1983 	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1984 	    cs->cs_initiator_sa->sa_len);
1985 	if (error != 0) {
1986 		snprintf(ci->error_str, sizeof(ci->error_str),
1987 		    "copyout failed with error %d", error);
1988 		ci->status = CTL_ISCSI_ERROR;
1989 		return;
1990 	}
1991 
1992 	ci->status = CTL_ISCSI_OK;
1993 }
1994 
1995 static void
1996 cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1997 {
1998 	struct ctl_iscsi_send_params *cisp;
1999 	struct cfiscsi_session *cs;
2000 	struct icl_pdu *ip;
2001 	size_t datalen;
2002 	void *data;
2003 	int error;
2004 
2005 	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
2006 
2007 	mtx_lock(&cfiscsi_softc.lock);
2008 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
2009 		if (cs->cs_id == cisp->connection_id)
2010 			break;
2011 	}
2012 	if (cs == NULL) {
2013 		mtx_unlock(&cfiscsi_softc.lock);
2014 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
2015 		ci->status = CTL_ISCSI_ERROR;
2016 		return;
2017 	}
2018 	mtx_unlock(&cfiscsi_softc.lock);
2019 
2020 #if 0
2021 	if (cs->cs_login_phase == false)
2022 		return (EBUSY);
2023 #endif
2024 
2025 	if (cs->cs_terminating) {
2026 		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
2027 		ci->status = CTL_ISCSI_ERROR;
2028 		return;
2029 	}
2030 
2031 	datalen = cisp->data_segment_len;
2032 	/*
2033 	 * XXX
2034 	 */
2035 	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
2036 	if (datalen > 65535) {
2037 		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
2038 		ci->status = CTL_ISCSI_ERROR;
2039 		return;
2040 	}
2041 	if (datalen > 0) {
2042 		data = malloc(datalen, M_CFISCSI, M_WAITOK);
2043 		error = copyin(cisp->data_segment, data, datalen);
2044 		if (error != 0) {
2045 			free(data, M_CFISCSI);
2046 			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
2047 			ci->status = CTL_ISCSI_ERROR;
2048 			return;
2049 		}
2050 	}
2051 
2052 	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
2053 	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
2054 	if (datalen > 0) {
2055 		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
2056 		free(data, M_CFISCSI);
2057 	}
2058 	CFISCSI_SESSION_LOCK(cs);
2059 	icl_pdu_queue(ip);
2060 	CFISCSI_SESSION_UNLOCK(cs);
2061 	ci->status = CTL_ISCSI_OK;
2062 }
2063 
2064 static void
2065 cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
2066 {
2067 	struct ctl_iscsi_receive_params *cirp;
2068 	struct cfiscsi_session *cs;
2069 	struct icl_pdu *ip;
2070 	void *data;
2071 	int error;
2072 
2073 	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
2074 
2075 	mtx_lock(&cfiscsi_softc.lock);
2076 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
2077 		if (cs->cs_id == cirp->connection_id)
2078 			break;
2079 	}
2080 	if (cs == NULL) {
2081 		mtx_unlock(&cfiscsi_softc.lock);
2082 		snprintf(ci->error_str, sizeof(ci->error_str),
2083 		    "connection not found");
2084 		ci->status = CTL_ISCSI_ERROR;
2085 		return;
2086 	}
2087 	mtx_unlock(&cfiscsi_softc.lock);
2088 
2089 #if 0
2090 	if (is->is_login_phase == false)
2091 		return (EBUSY);
2092 #endif
2093 
2094 	CFISCSI_SESSION_LOCK(cs);
2095 	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
2096 		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
2097 		if (error != 0) {
2098 			CFISCSI_SESSION_UNLOCK(cs);
2099 			snprintf(ci->error_str, sizeof(ci->error_str),
2100 			    "interrupted by signal");
2101 			ci->status = CTL_ISCSI_ERROR;
2102 			return;
2103 		}
2104 	}
2105 
2106 	if (cs->cs_terminating) {
2107 		CFISCSI_SESSION_UNLOCK(cs);
2108 		snprintf(ci->error_str, sizeof(ci->error_str),
2109 		    "connection terminating");
2110 		ci->status = CTL_ISCSI_ERROR;
2111 		return;
2112 	}
2113 	ip = cs->cs_login_pdu;
2114 	cs->cs_login_pdu = NULL;
2115 	CFISCSI_SESSION_UNLOCK(cs);
2116 
2117 	if (ip->ip_data_len > cirp->data_segment_len) {
2118 		icl_pdu_free(ip);
2119 		snprintf(ci->error_str, sizeof(ci->error_str),
2120 		    "data segment too big");
2121 		ci->status = CTL_ISCSI_ERROR;
2122 		return;
2123 	}
2124 
2125 	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
2126 	if (ip->ip_data_len > 0) {
2127 		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
2128 		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
2129 		copyout(data, cirp->data_segment, ip->ip_data_len);
2130 		free(data, M_CFISCSI);
2131 	}
2132 
2133 	icl_pdu_free(ip);
2134 	ci->status = CTL_ISCSI_OK;
2135 }
2136 
2137 #endif /* !ICL_KERNEL_PROXY */
2138 
2139 static void
2140 cfiscsi_ioctl_port_create(struct ctl_req *req)
2141 {
2142 	struct cfiscsi_target *ct;
2143 	struct ctl_port *port;
2144 	const char *target, *alias, *val;
2145 	struct scsi_vpd_id_descriptor *desc;
2146 	int retval, len, idlen;
2147 	uint16_t tag;
2148 
2149 	target = dnvlist_get_string(req->args_nvl, "cfiscsi_target", NULL);
2150 	alias = dnvlist_get_string(req->args_nvl, "cfiscsi_target_alias", NULL);
2151 	val = dnvlist_get_string(req->args_nvl, "cfiscsi_portal_group_tag",
2152 	    NULL);
2153 
2154 	if (target == NULL || val == NULL) {
2155 		req->status = CTL_LUN_ERROR;
2156 		snprintf(req->error_str, sizeof(req->error_str),
2157 		    "Missing required argument");
2158 		return;
2159 	}
2160 
2161 	tag = strtoul(val, NULL, 0);
2162 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias, tag);
2163 	if (ct == NULL) {
2164 		req->status = CTL_LUN_ERROR;
2165 		snprintf(req->error_str, sizeof(req->error_str),
2166 		    "failed to create target \"%s\"", target);
2167 		return;
2168 	}
2169 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
2170 		req->status = CTL_LUN_ERROR;
2171 		snprintf(req->error_str, sizeof(req->error_str),
2172 		    "target \"%s\" for portal group tag %u already exists",
2173 		    target, tag);
2174 		cfiscsi_target_release(ct);
2175 		return;
2176 	}
2177 	port = &ct->ct_port;
2178 	// WAT
2179 	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
2180 		goto done;
2181 
2182 	port->frontend = &cfiscsi_frontend;
2183 	port->port_type = CTL_PORT_ISCSI;
2184 	/* XXX KDM what should the real number be here? */
2185 	port->num_requested_ctl_io = 4096;
2186 	port->port_name = "iscsi";
2187 	port->physical_port = (int)tag;
2188 	port->virtual_port = ct->ct_target_id;
2189 	port->port_online = cfiscsi_online;
2190 	port->port_offline = cfiscsi_offline;
2191 	port->port_info = cfiscsi_info;
2192 	port->onoff_arg = ct;
2193 	port->fe_datamove = cfiscsi_datamove;
2194 	port->fe_done = cfiscsi_done;
2195 	port->targ_port = -1;
2196 	port->options = nvlist_clone(req->args_nvl);
2197 
2198 	/* Generate Port ID. */
2199 	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2200 	idlen = roundup2(idlen, 4);
2201 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2202 	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2203 	    M_CTL, M_WAITOK | M_ZERO);
2204 	port->port_devid->len = len;
2205 	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2206 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2207 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2208 	    SVPD_ID_TYPE_SCSI_NAME;
2209 	desc->length = idlen;
2210 	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x", target, tag);
2211 
2212 	/* Generate Target ID. */
2213 	idlen = strlen(target) + 1;
2214 	idlen = roundup2(idlen, 4);
2215 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2216 	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2217 	    M_CTL, M_WAITOK | M_ZERO);
2218 	port->target_devid->len = len;
2219 	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2220 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2221 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2222 	    SVPD_ID_TYPE_SCSI_NAME;
2223 	desc->length = idlen;
2224 	strlcpy(desc->identifier, target, idlen);
2225 
2226 	retval = ctl_port_register(port);
2227 	if (retval != 0) {
2228 		free(port->port_devid, M_CFISCSI);
2229 		free(port->target_devid, M_CFISCSI);
2230 		cfiscsi_target_release(ct);
2231 		req->status = CTL_LUN_ERROR;
2232 		snprintf(req->error_str, sizeof(req->error_str),
2233 		    "ctl_port_register() failed with error %d", retval);
2234 		return;
2235 	}
2236 done:
2237 	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2238 	req->status = CTL_LUN_OK;
2239 	req->result_nvl = nvlist_create(0);
2240 	nvlist_add_number(req->result_nvl, "port_id", port->targ_port);
2241 }
2242 
2243 static void
2244 cfiscsi_ioctl_port_remove(struct ctl_req *req)
2245 {
2246 	struct cfiscsi_target *ct;
2247 	const char *target, *val;
2248 	uint16_t tag;
2249 
2250 	target = dnvlist_get_string(req->args_nvl, "cfiscsi_target", NULL);
2251 	val = dnvlist_get_string(req->args_nvl, "cfiscsi_portal_group_tag",
2252 	    NULL);
2253 
2254 	if (target == NULL || val == NULL) {
2255 		req->status = CTL_LUN_ERROR;
2256 		snprintf(req->error_str, sizeof(req->error_str),
2257 		    "Missing required argument");
2258 		return;
2259 	}
2260 
2261 	tag = strtoul(val, NULL, 0);
2262 	ct = cfiscsi_target_find(&cfiscsi_softc, target, tag);
2263 	if (ct == NULL) {
2264 		req->status = CTL_LUN_ERROR;
2265 		snprintf(req->error_str, sizeof(req->error_str),
2266 		    "can't find target \"%s\"", target);
2267 		return;
2268 	}
2269 
2270 	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2271 	ctl_port_offline(&ct->ct_port);
2272 	cfiscsi_target_release(ct);
2273 	cfiscsi_target_release(ct);
2274 	req->status = CTL_LUN_OK;
2275 }
2276 
2277 static int
2278 cfiscsi_ioctl(struct cdev *dev,
2279     u_long cmd, caddr_t addr, int flag, struct thread *td)
2280 {
2281 	struct ctl_iscsi *ci;
2282 	struct ctl_req *req;
2283 
2284 	if (cmd == CTL_PORT_REQ) {
2285 		req = (struct ctl_req *)addr;
2286 		switch (req->reqtype) {
2287 		case CTL_REQ_CREATE:
2288 			cfiscsi_ioctl_port_create(req);
2289 			break;
2290 		case CTL_REQ_REMOVE:
2291 			cfiscsi_ioctl_port_remove(req);
2292 			break;
2293 		default:
2294 			req->status = CTL_LUN_ERROR;
2295 			snprintf(req->error_str, sizeof(req->error_str),
2296 			    "Unsupported request type %d", req->reqtype);
2297 		}
2298 		return (0);
2299 	}
2300 
2301 	if (cmd != CTL_ISCSI)
2302 		return (ENOTTY);
2303 
2304 	ci = (struct ctl_iscsi *)addr;
2305 	switch (ci->type) {
2306 	case CTL_ISCSI_HANDOFF:
2307 		cfiscsi_ioctl_handoff(ci);
2308 		break;
2309 	case CTL_ISCSI_LIST:
2310 		cfiscsi_ioctl_list(ci);
2311 		break;
2312 	case CTL_ISCSI_LOGOUT:
2313 		cfiscsi_ioctl_logout(ci);
2314 		break;
2315 	case CTL_ISCSI_TERMINATE:
2316 		cfiscsi_ioctl_terminate(ci);
2317 		break;
2318 	case CTL_ISCSI_LIMITS:
2319 		cfiscsi_ioctl_limits(ci);
2320 		break;
2321 #ifdef ICL_KERNEL_PROXY
2322 	case CTL_ISCSI_LISTEN:
2323 		cfiscsi_ioctl_listen(ci);
2324 		break;
2325 	case CTL_ISCSI_ACCEPT:
2326 		cfiscsi_ioctl_accept(ci);
2327 		break;
2328 	case CTL_ISCSI_SEND:
2329 		cfiscsi_ioctl_send(ci);
2330 		break;
2331 	case CTL_ISCSI_RECEIVE:
2332 		cfiscsi_ioctl_receive(ci);
2333 		break;
2334 #else
2335 	case CTL_ISCSI_LISTEN:
2336 	case CTL_ISCSI_ACCEPT:
2337 	case CTL_ISCSI_SEND:
2338 	case CTL_ISCSI_RECEIVE:
2339 		ci->status = CTL_ISCSI_ERROR;
2340 		snprintf(ci->error_str, sizeof(ci->error_str),
2341 		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2342 		    __func__);
2343 		break;
2344 #endif /* !ICL_KERNEL_PROXY */
2345 	default:
2346 		ci->status = CTL_ISCSI_ERROR;
2347 		snprintf(ci->error_str, sizeof(ci->error_str),
2348 		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2349 		break;
2350 	}
2351 
2352 	return (0);
2353 }
2354 
2355 static void
2356 cfiscsi_target_hold(struct cfiscsi_target *ct)
2357 {
2358 
2359 	refcount_acquire(&ct->ct_refcount);
2360 }
2361 
2362 static void
2363 cfiscsi_target_release(struct cfiscsi_target *ct)
2364 {
2365 	struct cfiscsi_softc *softc;
2366 
2367 	softc = ct->ct_softc;
2368 	mtx_lock(&softc->lock);
2369 	if (refcount_release(&ct->ct_refcount)) {
2370 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2371 		mtx_unlock(&softc->lock);
2372 		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2373 			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2374 			if (ctl_port_deregister(&ct->ct_port) != 0)
2375 				printf("%s: ctl_port_deregister() failed\n",
2376 				    __func__);
2377 		}
2378 		free(ct, M_CFISCSI);
2379 
2380 		return;
2381 	}
2382 	mtx_unlock(&softc->lock);
2383 }
2384 
2385 static struct cfiscsi_target *
2386 cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name, uint16_t tag)
2387 {
2388 	struct cfiscsi_target *ct;
2389 
2390 	mtx_lock(&softc->lock);
2391 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2392 		if (ct->ct_tag != tag ||
2393 		    strcmp(name, ct->ct_name) != 0 ||
2394 		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2395 			continue;
2396 		cfiscsi_target_hold(ct);
2397 		mtx_unlock(&softc->lock);
2398 		return (ct);
2399 	}
2400 	mtx_unlock(&softc->lock);
2401 
2402 	return (NULL);
2403 }
2404 
2405 static struct cfiscsi_target *
2406 cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2407     const char *alias, uint16_t tag)
2408 {
2409 	struct cfiscsi_target *ct, *newct;
2410 
2411 	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2412 		return (NULL);
2413 
2414 	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2415 
2416 	mtx_lock(&softc->lock);
2417 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2418 		if (ct->ct_tag != tag ||
2419 		    strcmp(name, ct->ct_name) != 0 ||
2420 		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2421 			continue;
2422 		cfiscsi_target_hold(ct);
2423 		mtx_unlock(&softc->lock);
2424 		free(newct, M_CFISCSI);
2425 		return (ct);
2426 	}
2427 
2428 	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2429 	if (alias != NULL)
2430 		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2431 	newct->ct_tag = tag;
2432 	refcount_init(&newct->ct_refcount, 1);
2433 	newct->ct_softc = softc;
2434 	if (TAILQ_EMPTY(&softc->targets))
2435 		softc->last_target_id = 0;
2436 	newct->ct_target_id = ++softc->last_target_id;
2437 	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2438 	mtx_unlock(&softc->lock);
2439 
2440 	return (newct);
2441 }
2442 
2443 static void
2444 cfiscsi_pdu_done(struct icl_pdu *ip, int error)
2445 {
2446 
2447 	if (error != 0)
2448 		; // XXX: Do something on error?
2449 	((ctl_ref)ip->ip_prv0)(ip->ip_prv1, -1);
2450 }
2451 
2452 static void
2453 cfiscsi_datamove_in(union ctl_io *io)
2454 {
2455 	struct cfiscsi_session *cs;
2456 	struct icl_pdu *request, *response;
2457 	const struct iscsi_bhs_scsi_command *bhssc;
2458 	struct iscsi_bhs_data_in *bhsdi;
2459 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2460 	size_t len, expected_len, sg_len, buffer_offset;
2461 	size_t max_send_data_segment_length;
2462 	const char *sg_addr;
2463 	icl_pdu_cb cb;
2464 	int ctl_sg_count, error, i;
2465 
2466 	request = PRIV_REQUEST(io);
2467 	cs = PDU_SESSION(request);
2468 
2469 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2470 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2471 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2472 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2473 
2474 	if (io->scsiio.kern_sg_entries > 0) {
2475 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2476 		ctl_sg_count = io->scsiio.kern_sg_entries;
2477 	} else {
2478 		ctl_sglist = &ctl_sg_entry;
2479 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2480 		ctl_sglist->len = io->scsiio.kern_data_len;
2481 		ctl_sg_count = 1;
2482 	}
2483 
2484 	/*
2485 	 * This is the offset within the current SCSI command; for the first
2486 	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2487 	 * it will be the sum of lengths of previous ones.
2488 	 */
2489 	buffer_offset = io->scsiio.kern_rel_offset;
2490 
2491 	/*
2492 	 * This is the transfer length expected by the initiator.  It can be
2493 	 * different from the amount of data from the SCSI point of view.
2494 	 */
2495 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2496 
2497 	/*
2498 	 * If the transfer is outside of expected length -- we are done.
2499 	 */
2500 	if (buffer_offset >= expected_len) {
2501 #if 0
2502 		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2503 		    "already sent the expected len", buffer_offset);
2504 #endif
2505 		ctl_datamove_done(io, true);
2506 		return;
2507 	}
2508 
2509 	if (io->scsiio.kern_data_ref != NULL)
2510 		cb = cfiscsi_pdu_done;
2511 	else
2512 		cb = NULL;
2513 
2514 	i = 0;
2515 	sg_addr = NULL;
2516 	sg_len = 0;
2517 	response = NULL;
2518 	bhsdi = NULL;
2519 	if (cs->cs_conn->ic_hw_isomax != 0)
2520 		max_send_data_segment_length = cs->cs_conn->ic_hw_isomax;
2521 	else
2522 		max_send_data_segment_length =
2523 		    cs->cs_conn->ic_max_send_data_segment_length;
2524 	for (;;) {
2525 		if (response == NULL) {
2526 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2527 			if (response == NULL) {
2528 				CFISCSI_SESSION_WARN(cs, "failed to "
2529 				    "allocate memory; dropping connection");
2530 				ctl_set_busy(&io->scsiio);
2531 				ctl_datamove_done(io, true);
2532 				cfiscsi_session_terminate(cs);
2533 				return;
2534 			}
2535 			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2536 			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2537 			bhsdi->bhsdi_initiator_task_tag =
2538 			    bhssc->bhssc_initiator_task_tag;
2539 			bhsdi->bhsdi_target_transfer_tag = 0xffffffff;
2540 			bhsdi->bhsdi_datasn = htonl(PRIV_EXPDATASN(io));
2541 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2542 		}
2543 
2544 		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2545 		if (sg_len == 0) {
2546 			sg_addr = ctl_sglist[i].addr;
2547 			sg_len = ctl_sglist[i].len;
2548 			KASSERT(sg_len > 0, ("sg_len <= 0"));
2549 		}
2550 
2551 		len = sg_len;
2552 
2553 		/*
2554 		 * Truncate to maximum data segment length.
2555 		 */
2556 		KASSERT(response->ip_data_len < max_send_data_segment_length,
2557 		    ("ip_data_len %zd >= max_send_data_segment_length %zd",
2558 		    response->ip_data_len, max_send_data_segment_length));
2559 		if (response->ip_data_len + len > max_send_data_segment_length) {
2560 			len = max_send_data_segment_length - response->ip_data_len;
2561 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2562 			    len, sg_len));
2563 		}
2564 
2565 		/*
2566 		 * Truncate to expected data transfer length.
2567 		 */
2568 		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2569 		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2570 		    buffer_offset, response->ip_data_len, expected_len));
2571 		if (buffer_offset + response->ip_data_len + len > expected_len) {
2572 			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2573 			    "to expected data transfer length %zd",
2574 			    buffer_offset + response->ip_data_len + len, expected_len);
2575 			len = expected_len - (buffer_offset + response->ip_data_len);
2576 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2577 			    len, sg_len));
2578 		}
2579 
2580 		error = icl_pdu_append_data(response, sg_addr, len,
2581 		    M_NOWAIT | (cb ? ICL_NOCOPY : 0));
2582 		if (error != 0) {
2583 			CFISCSI_SESSION_WARN(cs, "failed to "
2584 			    "allocate memory; dropping connection");
2585 			icl_pdu_free(response);
2586 			ctl_set_busy(&io->scsiio);
2587 			ctl_datamove_done(io, true);
2588 			cfiscsi_session_terminate(cs);
2589 			return;
2590 		}
2591 		sg_addr += len;
2592 		sg_len -= len;
2593 		io->scsiio.kern_data_resid -= len;
2594 
2595 		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2596 		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2597 		    buffer_offset, response->ip_data_len, expected_len));
2598 		if (buffer_offset + response->ip_data_len == expected_len) {
2599 			/*
2600 			 * Already have the amount of data the initiator wanted.
2601 			 */
2602 			break;
2603 		}
2604 
2605 		if (sg_len == 0) {
2606 			/*
2607 			 * End of scatter-gather segment;
2608 			 * proceed to the next one...
2609 			 */
2610 			if (i == ctl_sg_count - 1) {
2611 				/*
2612 				 * ... unless this was the last one.
2613 				 */
2614 				break;
2615 			}
2616 			i++;
2617 		}
2618 
2619 		if (response->ip_data_len == max_send_data_segment_length) {
2620 			/*
2621 			 * Can't stuff more data into the current PDU;
2622 			 * queue it.  Note that's not enough to check
2623 			 * for kern_data_resid == 0 instead; there
2624 			 * may be several Data-In PDUs for the final
2625 			 * call to cfiscsi_datamove(), and we want
2626 			 * to set the F flag only on the last of them.
2627 			 */
2628 			buffer_offset += response->ip_data_len;
2629 			if (buffer_offset == io->scsiio.kern_total_len ||
2630 			    buffer_offset == expected_len) {
2631 				buffer_offset -= response->ip_data_len;
2632 				break;
2633 			}
2634 			PRIV_EXPDATASN(io) += howmany(response->ip_data_len,
2635 			    cs->cs_conn->ic_max_send_data_segment_length);
2636 			if (cb != NULL) {
2637 				response->ip_prv0 = io->scsiio.kern_data_ref;
2638 				response->ip_prv1 = io->scsiio.kern_data_arg;
2639 				io->scsiio.kern_data_ref(io->scsiio.kern_data_arg, 1);
2640 			}
2641 			cfiscsi_pdu_queue_cb(response, cb);
2642 			response = NULL;
2643 			bhsdi = NULL;
2644 		}
2645 	}
2646 	if (response != NULL) {
2647 		buffer_offset += response->ip_data_len;
2648 		if (buffer_offset == io->scsiio.kern_total_len ||
2649 		    buffer_offset == expected_len) {
2650 			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2651 			if (io->io_hdr.status == CTL_SUCCESS) {
2652 				bhsdi->bhsdi_flags |= BHSDI_FLAGS_S;
2653 				if (io->scsiio.kern_total_len <
2654 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2655 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2656 					bhsdi->bhsdi_residual_count =
2657 					    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2658 					    io->scsiio.kern_total_len);
2659 				} else if (io->scsiio.kern_total_len >
2660 				    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2661 					bhsdi->bhsdi_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2662 					bhsdi->bhsdi_residual_count =
2663 					    htonl(io->scsiio.kern_total_len -
2664 					    ntohl(bhssc->bhssc_expected_data_transfer_length));
2665 				}
2666 				bhsdi->bhsdi_status = io->scsiio.scsi_status;
2667 				io->io_hdr.flags |= CTL_FLAG_STATUS_SENT;
2668 			}
2669 		}
2670 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2671 		PRIV_EXPDATASN(io) += howmany(response->ip_data_len,
2672 		    cs->cs_conn->ic_max_send_data_segment_length);
2673 		if (cb != NULL) {
2674 			response->ip_prv0 = io->scsiio.kern_data_ref;
2675 			response->ip_prv1 = io->scsiio.kern_data_arg;
2676 			io->scsiio.kern_data_ref(io->scsiio.kern_data_arg, 1);
2677 		}
2678 		cfiscsi_pdu_queue_cb(response, cb);
2679 	}
2680 
2681 	ctl_datamove_done(io, true);
2682 }
2683 
2684 static void
2685 cfiscsi_datamove_out(union ctl_io *io)
2686 {
2687 	struct cfiscsi_session *cs;
2688 	struct icl_pdu *request, *response;
2689 	const struct iscsi_bhs_scsi_command *bhssc;
2690 	struct iscsi_bhs_r2t *bhsr2t;
2691 	struct cfiscsi_data_wait *cdw;
2692 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2693 	uint32_t expected_len, datamove_len, r2t_off, r2t_len;
2694 	uint32_t target_transfer_tag;
2695 	bool done;
2696 
2697 	request = PRIV_REQUEST(io);
2698 	cs = PDU_SESSION(request);
2699 
2700 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2701 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2702 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2703 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2704 
2705 	/*
2706 	 * Complete write underflow.  Not a single byte to read.  Return.
2707 	 */
2708 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2709 	if (io->scsiio.kern_rel_offset >= expected_len) {
2710 		ctl_datamove_done(io, true);
2711 		return;
2712 	}
2713 
2714 	datamove_len = MIN(io->scsiio.kern_data_len,
2715 	    expected_len - io->scsiio.kern_rel_offset);
2716 
2717 	target_transfer_tag =
2718 	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2719 	if (target_transfer_tag == 0xffffffff) {
2720 		target_transfer_tag =
2721 		    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2722 	}
2723 	cdw = cfiscsi_data_wait_new(cs, io, bhssc->bhssc_initiator_task_tag,
2724 	    &target_transfer_tag);
2725 	if (cdw == NULL) {
2726 		CFISCSI_SESSION_WARN(cs, "failed to "
2727 		    "allocate memory; dropping connection");
2728 		ctl_set_busy(&io->scsiio);
2729 		ctl_datamove_done(io, true);
2730 		cfiscsi_session_terminate(cs);
2731 		return;
2732 	}
2733 #if 0
2734 	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2735 	    "task tag 0x%x, target transfer tag 0x%x",
2736 	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2737 #endif
2738 
2739 	cdw->cdw_ctl_io = io;
2740 	cdw->cdw_target_transfer_tag = target_transfer_tag;
2741 	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2742 	cdw->cdw_r2t_end = datamove_len;
2743 	cdw->cdw_datasn = 0;
2744 
2745 	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2746 	if (io->scsiio.kern_sg_entries > 0) {
2747 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2748 	} else {
2749 		ctl_sglist = &ctl_sg_entry;
2750 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2751 		ctl_sglist->len = datamove_len;
2752 	}
2753 	cdw->cdw_sg_index = 0;
2754 	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2755 	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2756 	r2t_off = io->scsiio.ext_data_filled;
2757 	while (r2t_off > 0) {
2758 		if (r2t_off >= cdw->cdw_sg_len) {
2759 			r2t_off -= cdw->cdw_sg_len;
2760 			cdw->cdw_sg_index++;
2761 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2762 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2763 			continue;
2764 		}
2765 		cdw->cdw_sg_addr += r2t_off;
2766 		cdw->cdw_sg_len -= r2t_off;
2767 		r2t_off = 0;
2768 	}
2769 
2770 	if (cs->cs_immediate_data &&
2771 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2772 	    icl_pdu_data_segment_length(request)) {
2773 		done = cfiscsi_handle_data_segment(request, cdw);
2774 		if (done) {
2775 			cfiscsi_data_wait_free(cs, cdw);
2776 			ctl_datamove_done(io, true);
2777 			return;
2778 		}
2779 	}
2780 
2781 	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2782 	r2t_len = MIN(datamove_len - io->scsiio.ext_data_filled,
2783 	    cs->cs_max_burst_length);
2784 	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2785 
2786 	CFISCSI_SESSION_LOCK(cs);
2787 	if (cs->cs_terminating_tasks) {
2788 		CFISCSI_SESSION_UNLOCK(cs);
2789 		KASSERT((io->io_hdr.flags & CTL_FLAG_ABORT) != 0,
2790 		    ("%s: I/O request %p on termating session %p not aborted",
2791 		    __func__, io, cs));
2792 		CFISCSI_SESSION_WARN(cs, "aborting data_wait for aborted I/O");
2793 		cfiscsi_data_wait_abort(cs, cdw, 44);
2794 		return;
2795 	}
2796 	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2797 	CFISCSI_SESSION_UNLOCK(cs);
2798 
2799 	/*
2800 	 * XXX: We should limit the number of outstanding R2T PDUs
2801 	 * 	per task to MaxOutstandingR2T.
2802 	 */
2803 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2804 	if (response == NULL) {
2805 		CFISCSI_SESSION_WARN(cs, "failed to "
2806 		    "allocate memory; dropping connection");
2807 		ctl_set_busy(&io->scsiio);
2808 		ctl_datamove_done(io, true);
2809 		cfiscsi_session_terminate(cs);
2810 		return;
2811 	}
2812 	io->io_hdr.flags |= CTL_FLAG_DMA_INPROG;
2813 	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2814 	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2815 	bhsr2t->bhsr2t_flags = 0x80;
2816 	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2817 	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2818 	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2819 	/*
2820 	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2821 	 *	be running concurrently on several CPUs for a given
2822 	 *	command.
2823 	 */
2824 	bhsr2t->bhsr2t_r2tsn = htonl(PRIV_R2TSN(io)++);
2825 	/*
2826 	 * This is the offset within the current SCSI command;
2827 	 * i.e. for the first call of datamove(), it will be 0,
2828 	 * and for subsequent ones it will be the sum of lengths
2829 	 * of previous ones.
2830 	 *
2831 	 * The ext_data_filled is to account for unsolicited
2832 	 * (immediate) data that might have already arrived.
2833 	 */
2834 	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2835 	/*
2836 	 * This is the total length (sum of S/G lengths) this call
2837 	 * to cfiscsi_datamove() is supposed to handle, limited by
2838 	 * MaxBurstLength.
2839 	 */
2840 	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2841 	cfiscsi_pdu_queue(response);
2842 }
2843 
2844 static void
2845 cfiscsi_datamove(union ctl_io *io)
2846 {
2847 
2848 	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2849 		cfiscsi_datamove_in(io);
2850 	else {
2851 		/* We hadn't received anything during this datamove yet. */
2852 		io->scsiio.ext_data_filled = 0;
2853 		cfiscsi_datamove_out(io);
2854 	}
2855 }
2856 
2857 static void
2858 cfiscsi_scsi_command_done(union ctl_io *io)
2859 {
2860 	struct icl_pdu *request, *response;
2861 	struct iscsi_bhs_scsi_command *bhssc;
2862 	struct iscsi_bhs_scsi_response *bhssr;
2863 #ifdef DIAGNOSTIC
2864 	struct cfiscsi_data_wait *cdw;
2865 	struct cfiscsi_session *cs;
2866 #endif
2867 	uint16_t sense_length;
2868 
2869 	request = PRIV_REQUEST(io);
2870 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2871 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2872 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2873 	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2874 
2875 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2876 	//    bhssc->bhssc_initiator_task_tag);
2877 
2878 #ifdef DIAGNOSTIC
2879 	cs = PDU_SESSION(request);
2880 	CFISCSI_SESSION_LOCK(cs);
2881 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2882 		KASSERT(bhssc->bhssc_initiator_task_tag !=
2883 		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2884 	CFISCSI_SESSION_UNLOCK(cs);
2885 #endif
2886 
2887 	/*
2888 	 * Do not return status for aborted commands.
2889 	 * There are exceptions, but none supported by CTL yet.
2890 	 */
2891 	if (((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2892 	     (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) ||
2893 	    (io->io_hdr.flags & CTL_FLAG_STATUS_SENT)) {
2894 		ctl_free_io(io);
2895 		icl_pdu_free(request);
2896 		return;
2897 	}
2898 
2899 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2900 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2901 	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2902 	bhssr->bhssr_flags = 0x80;
2903 	/*
2904 	 * XXX: We don't deal with bidirectional under/overflows;
2905 	 *	does anything actually support those?
2906 	 */
2907 	if (io->scsiio.kern_total_len <
2908 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2909 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2910 		bhssr->bhssr_residual_count =
2911 		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2912 		    io->scsiio.kern_total_len);
2913 		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2914 		//    ntohl(bhssr->bhssr_residual_count));
2915 	} else if (io->scsiio.kern_total_len >
2916 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2917 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2918 		bhssr->bhssr_residual_count = htonl(io->scsiio.kern_total_len -
2919 		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2920 		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2921 		//    ntohl(bhssr->bhssr_residual_count));
2922 	}
2923 	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2924 	bhssr->bhssr_status = io->scsiio.scsi_status;
2925 	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2926 	bhssr->bhssr_expdatasn = htonl(PRIV_EXPDATASN(io));
2927 
2928 	if (io->scsiio.sense_len > 0) {
2929 #if 0
2930 		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2931 		    io->scsiio.sense_len);
2932 #endif
2933 		sense_length = htons(io->scsiio.sense_len);
2934 		icl_pdu_append_data(response,
2935 		    &sense_length, sizeof(sense_length), M_WAITOK);
2936 		icl_pdu_append_data(response,
2937 		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2938 	}
2939 
2940 	ctl_free_io(io);
2941 	icl_pdu_free(request);
2942 	cfiscsi_pdu_queue(response);
2943 }
2944 
2945 static void
2946 cfiscsi_task_management_done(union ctl_io *io)
2947 {
2948 	struct icl_pdu *request, *response;
2949 	struct iscsi_bhs_task_management_request *bhstmr;
2950 	struct iscsi_bhs_task_management_response *bhstmr2;
2951 	struct cfiscsi_data_wait *cdw, *tmpcdw;
2952 	struct cfiscsi_session *cs, *tcs;
2953 	struct cfiscsi_softc *softc;
2954 	int cold_reset = 0;
2955 
2956 	request = PRIV_REQUEST(io);
2957 	cs = PDU_SESSION(request);
2958 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2959 	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2960 	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2961 	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2962 
2963 #if 0
2964 	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2965 	    bhstmr->bhstmr_initiator_task_tag,
2966 	    bhstmr->bhstmr_referenced_task_tag);
2967 #endif
2968 
2969 	if ((bhstmr->bhstmr_function & ~0x80) ==
2970 	    BHSTMR_FUNCTION_ABORT_TASK) {
2971 		/*
2972 		 * Make sure we no longer wait for Data-Out for this command.
2973 		 */
2974 		CFISCSI_SESSION_LOCK(cs);
2975 		TAILQ_FOREACH_SAFE(cdw,
2976 		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2977 			if (bhstmr->bhstmr_referenced_task_tag !=
2978 			    cdw->cdw_initiator_task_tag)
2979 				continue;
2980 
2981 #if 0
2982 			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2983 			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2984 #endif
2985 			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2986 			    cdw, cdw_next);
2987 			cfiscsi_data_wait_abort(cs, cdw, 43);
2988 		}
2989 		CFISCSI_SESSION_UNLOCK(cs);
2990 	}
2991 	if ((bhstmr->bhstmr_function & ~0x80) ==
2992 	    BHSTMR_FUNCTION_TARGET_COLD_RESET &&
2993 	    io->io_hdr.status == CTL_SUCCESS)
2994 		cold_reset = 1;
2995 
2996 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2997 	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2998 	    response->ip_bhs;
2999 	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
3000 	bhstmr2->bhstmr_flags = 0x80;
3001 	switch (io->taskio.task_status) {
3002 	case CTL_TASK_FUNCTION_COMPLETE:
3003 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
3004 		break;
3005 	case CTL_TASK_FUNCTION_SUCCEEDED:
3006 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_SUCCEEDED;
3007 		break;
3008 	case CTL_TASK_LUN_DOES_NOT_EXIST:
3009 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_LUN_DOES_NOT_EXIST;
3010 		break;
3011 	case CTL_TASK_FUNCTION_NOT_SUPPORTED:
3012 	default:
3013 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
3014 		break;
3015 	}
3016 	memcpy(bhstmr2->bhstmr_additional_reponse_information,
3017 	    io->taskio.task_resp, sizeof(io->taskio.task_resp));
3018 	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
3019 
3020 	ctl_free_io(io);
3021 	icl_pdu_free(request);
3022 	cfiscsi_pdu_queue(response);
3023 
3024 	if (cold_reset) {
3025 		softc = cs->cs_target->ct_softc;
3026 		mtx_lock(&softc->lock);
3027 		TAILQ_FOREACH(tcs, &softc->sessions, cs_next) {
3028 			if (tcs->cs_target == cs->cs_target)
3029 				cfiscsi_session_terminate(tcs);
3030 		}
3031 		mtx_unlock(&softc->lock);
3032 	}
3033 }
3034 
3035 static void
3036 cfiscsi_done(union ctl_io *io)
3037 {
3038 	struct icl_pdu *request;
3039 	struct cfiscsi_session *cs;
3040 
3041 	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
3042 		("invalid CTL status %#x", io->io_hdr.status));
3043 
3044 	if (io->io_hdr.io_type == CTL_IO_TASK &&
3045 	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
3046 		/*
3047 		 * Implicit task termination has just completed; nothing to do.
3048 		 */
3049 		cs = PRIV_REQUEST(io);
3050 		cs->cs_tasks_aborted = true;
3051 		refcount_release(&cs->cs_outstanding_ctl_pdus);
3052 		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
3053 		ctl_free_io(io);
3054 		return;
3055 	}
3056 
3057 	request = PRIV_REQUEST(io);
3058 	cs = PDU_SESSION(request);
3059 
3060 	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
3061 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
3062 		cfiscsi_scsi_command_done(io);
3063 		break;
3064 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
3065 		cfiscsi_task_management_done(io);
3066 		break;
3067 	default:
3068 		panic("cfiscsi_done called with wrong opcode 0x%x",
3069 		    request->ip_bhs->bhs_opcode);
3070 	}
3071 
3072 	refcount_release(&cs->cs_outstanding_ctl_pdus);
3073 }
3074