xref: /freebsd/sys/cam/ctl/ctl_frontend_iscsi.c (revision ff0ba87247820afbdfdc1b307c803f7923d0e4d3)
1 /*-
2  * Copyright (c) 2012 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Edward Tomasz Napierala under sponsorship
6  * from the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * CTL frontend for the iSCSI protocol.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/capsicum.h>
41 #include <sys/condvar.h>
42 #include <sys/file.h>
43 #include <sys/kernel.h>
44 #include <sys/kthread.h>
45 #include <sys/lock.h>
46 #include <sys/malloc.h>
47 #include <sys/module.h>
48 #include <sys/mutex.h>
49 #include <sys/queue.h>
50 #include <sys/sbuf.h>
51 #include <sys/sysctl.h>
52 #include <sys/systm.h>
53 #include <sys/uio.h>
54 #include <sys/unistd.h>
55 #include <vm/uma.h>
56 
57 #include <cam/scsi/scsi_all.h>
58 #include <cam/scsi/scsi_da.h>
59 #include <cam/ctl/ctl_io.h>
60 #include <cam/ctl/ctl.h>
61 #include <cam/ctl/ctl_backend.h>
62 #include <cam/ctl/ctl_error.h>
63 #include <cam/ctl/ctl_frontend.h>
64 #include <cam/ctl/ctl_frontend_internal.h>
65 #include <cam/ctl/ctl_debug.h>
66 #include <cam/ctl/ctl_ha.h>
67 #include <cam/ctl/ctl_ioctl.h>
68 #include <cam/ctl/ctl_private.h>
69 
70 #include <dev/iscsi/icl.h>
71 #include <dev/iscsi/iscsi_proto.h>
72 #include <cam/ctl/ctl_frontend_iscsi.h>
73 
74 #ifdef ICL_KERNEL_PROXY
75 #include <sys/socketvar.h>
76 #endif
77 
78 #ifdef ICL_KERNEL_PROXY
79 FEATURE(cfiscsi_kernel_proxy, "iSCSI target built with ICL_KERNEL_PROXY");
80 #endif
81 
82 static MALLOC_DEFINE(M_CFISCSI, "cfiscsi", "Memory used for CTL iSCSI frontend");
83 static uma_zone_t cfiscsi_data_wait_zone;
84 
85 SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, iscsi, CTLFLAG_RD, 0,
86     "CAM Target Layer iSCSI Frontend");
87 static int debug = 1;
88 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
89     &debug, 1, "Enable debug messages");
90 static int ping_timeout = 5;
91 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN,
92     &ping_timeout, 5, "Interval between ping (NOP-Out) requests, in seconds");
93 static int login_timeout = 60;
94 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN,
95     &login_timeout, 60, "Time to wait for ctld(8) to finish Login Phase, in seconds");
96 static int maxcmdsn_delta = 256;
97 SYSCTL_INT(_kern_cam_ctl_iscsi, OID_AUTO, maxcmdsn_delta, CTLFLAG_RWTUN,
98     &maxcmdsn_delta, 256, "Number of commands the initiator can send "
99     "without confirmation");
100 
101 #define	CFISCSI_DEBUG(X, ...)						\
102 	do {								\
103 		if (debug > 1) {					\
104 			printf("%s: " X "\n",				\
105 			    __func__, ## __VA_ARGS__);			\
106 		}							\
107 	} while (0)
108 
109 #define	CFISCSI_WARN(X, ...)						\
110 	do {								\
111 		if (debug > 0) {					\
112 			printf("WARNING: %s: " X "\n",			\
113 			    __func__, ## __VA_ARGS__);			\
114 		}							\
115 	} while (0)
116 
117 #define	CFISCSI_SESSION_DEBUG(S, X, ...)				\
118 	do {								\
119 		if (debug > 1) {					\
120 			printf("%s: %s (%s): " X "\n",			\
121 			    __func__, S->cs_initiator_addr,		\
122 			    S->cs_initiator_name, ## __VA_ARGS__);	\
123 		}							\
124 	} while (0)
125 
126 #define	CFISCSI_SESSION_WARN(S, X, ...)					\
127 	do  {								\
128 		if (debug > 0) {					\
129 			printf("WARNING: %s (%s): " X "\n",		\
130 			    S->cs_initiator_addr,			\
131 			    S->cs_initiator_name, ## __VA_ARGS__);	\
132 		}							\
133 	} while (0)
134 
135 #define CFISCSI_SESSION_LOCK(X)		mtx_lock(&X->cs_lock)
136 #define CFISCSI_SESSION_UNLOCK(X)	mtx_unlock(&X->cs_lock)
137 #define CFISCSI_SESSION_LOCK_ASSERT(X)	mtx_assert(&X->cs_lock, MA_OWNED)
138 
139 #define	CONN_SESSION(X)			((struct cfiscsi_session *)(X)->ic_prv0)
140 #define	PDU_SESSION(X)			CONN_SESSION((X)->ip_conn)
141 #define	PDU_EXPDATASN(X)		(X)->ip_prv0
142 #define	PDU_TOTAL_TRANSFER_LEN(X)	(X)->ip_prv1
143 #define	PDU_R2TSN(X)			(X)->ip_prv2
144 
145 int		cfiscsi_init(void);
146 static void	cfiscsi_online(void *arg);
147 static void	cfiscsi_offline(void *arg);
148 static int	cfiscsi_info(void *arg, struct sbuf *sb);
149 static int	cfiscsi_lun_enable(void *arg,
150 		    struct ctl_id target_id, int lun_id);
151 static int	cfiscsi_lun_disable(void *arg,
152 		    struct ctl_id target_id, int lun_id);
153 static uint32_t	cfiscsi_lun_map(void *arg, uint32_t lun);
154 static int	cfiscsi_ioctl(struct cdev *dev,
155 		    u_long cmd, caddr_t addr, int flag, struct thread *td);
156 static void	cfiscsi_datamove(union ctl_io *io);
157 static void	cfiscsi_datamove_in(union ctl_io *io);
158 static void	cfiscsi_datamove_out(union ctl_io *io);
159 static void	cfiscsi_done(union ctl_io *io);
160 static bool	cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request);
161 static void	cfiscsi_pdu_handle_nop_out(struct icl_pdu *request);
162 static void	cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request);
163 static void	cfiscsi_pdu_handle_task_request(struct icl_pdu *request);
164 static void	cfiscsi_pdu_handle_data_out(struct icl_pdu *request);
165 static void	cfiscsi_pdu_handle_logout_request(struct icl_pdu *request);
166 static void	cfiscsi_session_terminate(struct cfiscsi_session *cs);
167 static struct cfiscsi_target	*cfiscsi_target_find(struct cfiscsi_softc
168 		    *softc, const char *name);
169 static struct cfiscsi_target	*cfiscsi_target_find_or_create(
170     struct cfiscsi_softc *softc, const char *name, const char *alias);
171 static void	cfiscsi_target_release(struct cfiscsi_target *ct);
172 static void	cfiscsi_session_delete(struct cfiscsi_session *cs);
173 
174 static struct cfiscsi_softc cfiscsi_softc;
175 extern struct ctl_softc *control_softc;
176 
177 static struct ctl_frontend cfiscsi_frontend =
178 {
179 	.name = "iscsi",
180 	.init = cfiscsi_init,
181 	.ioctl = cfiscsi_ioctl,
182 };
183 CTL_FRONTEND_DECLARE(ctlcfiscsi, cfiscsi_frontend);
184 MODULE_DEPEND(ctlcfiscsi, icl, 1, 1, 1);
185 
186 static struct icl_pdu *
187 cfiscsi_pdu_new_response(struct icl_pdu *request, int flags)
188 {
189 
190 	return (icl_pdu_new(request->ip_conn, flags));
191 }
192 
193 static bool
194 cfiscsi_pdu_update_cmdsn(const struct icl_pdu *request)
195 {
196 	const struct iscsi_bhs_scsi_command *bhssc;
197 	struct cfiscsi_session *cs;
198 	uint32_t cmdsn, expstatsn;
199 
200 	cs = PDU_SESSION(request);
201 
202 	/*
203 	 * Every incoming PDU - not just NOP-Out - resets the ping timer.
204 	 * The purpose of the timeout is to reset the connection when it stalls;
205 	 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
206 	 * in some queue.
207 	 *
208 	 * XXX: Locking?
209 	 */
210 	cs->cs_timeout = 0;
211 
212 	/*
213 	 * Data-Out PDUs don't contain CmdSN.
214 	 */
215 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
216 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
217 		return (false);
218 
219 	/*
220 	 * We're only using fields common for all the request
221 	 * (initiator -> target) PDUs.
222 	 */
223 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
224 	cmdsn = ntohl(bhssc->bhssc_cmdsn);
225 	expstatsn = ntohl(bhssc->bhssc_expstatsn);
226 
227 	CFISCSI_SESSION_LOCK(cs);
228 #if 0
229 	if (expstatsn != cs->cs_statsn) {
230 		CFISCSI_SESSION_DEBUG(cs, "received PDU with ExpStatSN %d, "
231 		    "while current StatSN is %d", expstatsn,
232 		    cs->cs_statsn);
233 	}
234 #endif
235 
236 	/*
237 	 * The target MUST silently ignore any non-immediate command outside
238 	 * of this range.
239 	 */
240 	if (cmdsn < cs->cs_cmdsn || cmdsn > cs->cs_cmdsn + maxcmdsn_delta) {
241 		CFISCSI_SESSION_UNLOCK(cs);
242 		CFISCSI_SESSION_WARN(cs, "received PDU with CmdSN %d, "
243 		    "while expected CmdSN was %d", cmdsn, cs->cs_cmdsn);
244 		return (true);
245 	}
246 
247 	if ((request->ip_bhs->bhs_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0)
248 		cs->cs_cmdsn++;
249 
250 	CFISCSI_SESSION_UNLOCK(cs);
251 
252 	return (false);
253 }
254 
255 static void
256 cfiscsi_pdu_handle(struct icl_pdu *request)
257 {
258 	struct cfiscsi_session *cs;
259 	bool ignore;
260 
261 	cs = PDU_SESSION(request);
262 
263 	ignore = cfiscsi_pdu_update_cmdsn(request);
264 	if (ignore) {
265 		icl_pdu_free(request);
266 		return;
267 	}
268 
269 	/*
270 	 * Handle the PDU; this includes e.g. receiving the remaining
271 	 * part of PDU and submitting the SCSI command to CTL
272 	 * or queueing a reply.  The handling routine is responsible
273 	 * for freeing the PDU when it's no longer needed.
274 	 */
275 	switch (request->ip_bhs->bhs_opcode &
276 	    ~ISCSI_BHS_OPCODE_IMMEDIATE) {
277 	case ISCSI_BHS_OPCODE_NOP_OUT:
278 		cfiscsi_pdu_handle_nop_out(request);
279 		break;
280 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
281 		cfiscsi_pdu_handle_scsi_command(request);
282 		break;
283 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
284 		cfiscsi_pdu_handle_task_request(request);
285 		break;
286 	case ISCSI_BHS_OPCODE_SCSI_DATA_OUT:
287 		cfiscsi_pdu_handle_data_out(request);
288 		break;
289 	case ISCSI_BHS_OPCODE_LOGOUT_REQUEST:
290 		cfiscsi_pdu_handle_logout_request(request);
291 		break;
292 	default:
293 		CFISCSI_SESSION_WARN(cs, "received PDU with unsupported "
294 		    "opcode 0x%x; dropping connection",
295 		    request->ip_bhs->bhs_opcode);
296 		icl_pdu_free(request);
297 		cfiscsi_session_terminate(cs);
298 	}
299 
300 }
301 
302 static void
303 cfiscsi_receive_callback(struct icl_pdu *request)
304 {
305 	struct cfiscsi_session *cs;
306 
307 	cs = PDU_SESSION(request);
308 
309 #ifdef ICL_KERNEL_PROXY
310 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
311 		if (cs->cs_login_pdu == NULL)
312 			cs->cs_login_pdu = request;
313 		else
314 			icl_pdu_free(request);
315 		cv_signal(&cs->cs_login_cv);
316 		return;
317 	}
318 #endif
319 
320 	cfiscsi_pdu_handle(request);
321 }
322 
323 static void
324 cfiscsi_error_callback(struct icl_conn *ic)
325 {
326 	struct cfiscsi_session *cs;
327 
328 	cs = CONN_SESSION(ic);
329 
330 	CFISCSI_SESSION_WARN(cs, "connection error; dropping connection");
331 	cfiscsi_session_terminate(cs);
332 }
333 
334 static int
335 cfiscsi_pdu_prepare(struct icl_pdu *response)
336 {
337 	struct cfiscsi_session *cs;
338 	struct iscsi_bhs_scsi_response *bhssr;
339 	bool advance_statsn = true;
340 
341 	cs = PDU_SESSION(response);
342 
343 	CFISCSI_SESSION_LOCK_ASSERT(cs);
344 
345 	/*
346 	 * We're only using fields common for all the response
347 	 * (target -> initiator) PDUs.
348 	 */
349 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
350 
351 	/*
352 	 * 10.8.3: "The StatSN for this connection is not advanced
353 	 * after this PDU is sent."
354 	 */
355 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_R2T)
356 		advance_statsn = false;
357 
358 	/*
359 	 * 10.19.2: "However, when the Initiator Task Tag is set to 0xffffffff,
360 	 * StatSN for the connection is not advanced after this PDU is sent."
361 	 */
362 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_NOP_IN &&
363 	    bhssr->bhssr_initiator_task_tag == 0xffffffff)
364 		advance_statsn = false;
365 
366 	/*
367 	 * See the comment below - StatSN is not meaningful and must
368 	 * not be advanced.
369 	 */
370 	if (bhssr->bhssr_opcode == ISCSI_BHS_OPCODE_SCSI_DATA_IN)
371 		advance_statsn = false;
372 
373 	/*
374 	 * 10.7.3: "The fields StatSN, Status, and Residual Count
375 	 * only have meaningful content if the S bit is set to 1."
376 	 */
377 	if (bhssr->bhssr_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN)
378 		bhssr->bhssr_statsn = htonl(cs->cs_statsn);
379 	bhssr->bhssr_expcmdsn = htonl(cs->cs_cmdsn);
380 	bhssr->bhssr_maxcmdsn = htonl(cs->cs_cmdsn + maxcmdsn_delta);
381 
382 	if (advance_statsn)
383 		cs->cs_statsn++;
384 
385 	return (0);
386 }
387 
388 static void
389 cfiscsi_pdu_queue(struct icl_pdu *response)
390 {
391 	struct cfiscsi_session *cs;
392 
393 	cs = PDU_SESSION(response);
394 
395 	CFISCSI_SESSION_LOCK(cs);
396 	cfiscsi_pdu_prepare(response);
397 	icl_pdu_queue(response);
398 	CFISCSI_SESSION_UNLOCK(cs);
399 }
400 
401 static uint32_t
402 cfiscsi_decode_lun(uint64_t encoded)
403 {
404 	uint8_t lun[8];
405 	uint32_t result;
406 
407 	/*
408 	 * The LUN field in iSCSI PDUs may look like an ordinary 64 bit number,
409 	 * but is in fact an evil, multidimensional structure defined
410 	 * in SCSI Architecture Model 5 (SAM-5), section 4.6.
411 	 */
412 	memcpy(lun, &encoded, sizeof(lun));
413 	switch (lun[0] & 0xC0) {
414 	case 0x00:
415 		if ((lun[0] & 0x3f) != 0 || lun[2] != 0 || lun[3] != 0 ||
416 		    lun[4] != 0 || lun[5] != 0 || lun[6] != 0 || lun[7] != 0) {
417 			CFISCSI_WARN("malformed LUN "
418 			    "(peripheral device addressing method): 0x%jx",
419 			    (uintmax_t)encoded);
420 			result = 0xffffffff;
421 			break;
422 		}
423 		result = lun[1];
424 		break;
425 	case 0x40:
426 		if (lun[2] != 0 || lun[3] != 0 || lun[4] != 0 || lun[5] != 0 ||
427 		    lun[6] != 0 || lun[7] != 0) {
428 			CFISCSI_WARN("malformed LUN "
429 			    "(flat address space addressing method): 0x%jx",
430 			    (uintmax_t)encoded);
431 			result = 0xffffffff;
432 			break;
433 		}
434 		result = ((lun[0] & 0x3f) << 8) + lun[1];
435 		break;
436 	case 0xC0:
437 		if (lun[0] != 0xD2 || lun[4] != 0 || lun[5] != 0 ||
438 		    lun[6] != 0 || lun[7] != 0) {
439 			CFISCSI_WARN("malformed LUN (extended flat "
440 			    "address space addressing method): 0x%jx",
441 			    (uintmax_t)encoded);
442 			result = 0xffffffff;
443 			break;
444 		}
445 		result = (lun[1] << 16) + (lun[2] << 8) + lun[3];
446 	default:
447 		CFISCSI_WARN("unsupported LUN format 0x%jx",
448 		    (uintmax_t)encoded);
449 		result = 0xffffffff;
450 		break;
451 	}
452 
453 	return (result);
454 }
455 
456 static void
457 cfiscsi_pdu_handle_nop_out(struct icl_pdu *request)
458 {
459 	struct cfiscsi_session *cs;
460 	struct iscsi_bhs_nop_out *bhsno;
461 	struct iscsi_bhs_nop_in *bhsni;
462 	struct icl_pdu *response;
463 	void *data = NULL;
464 	size_t datasize;
465 	int error;
466 
467 	cs = PDU_SESSION(request);
468 	bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
469 
470 	if (bhsno->bhsno_initiator_task_tag == 0xffffffff) {
471 		/*
472 		 * Nothing to do, iscsi_pdu_update_statsn() already
473 		 * zeroed the timeout.
474 		 */
475 		icl_pdu_free(request);
476 		return;
477 	}
478 
479 	datasize = icl_pdu_data_segment_length(request);
480 	if (datasize > 0) {
481 		data = malloc(datasize, M_CFISCSI, M_NOWAIT | M_ZERO);
482 		if (data == NULL) {
483 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
484 			    "dropping connection");
485 			icl_pdu_free(request);
486 			cfiscsi_session_terminate(cs);
487 			return;
488 		}
489 		icl_pdu_get_data(request, 0, data, datasize);
490 	}
491 
492 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
493 	if (response == NULL) {
494 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
495 		    "droppping connection");
496 		free(data, M_CFISCSI);
497 		icl_pdu_free(request);
498 		cfiscsi_session_terminate(cs);
499 		return;
500 	}
501 	bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
502 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
503 	bhsni->bhsni_flags = 0x80;
504 	bhsni->bhsni_initiator_task_tag = bhsno->bhsno_initiator_task_tag;
505 	bhsni->bhsni_target_transfer_tag = 0xffffffff;
506 	if (datasize > 0) {
507 		error = icl_pdu_append_data(response, data, datasize, M_NOWAIT);
508 		if (error != 0) {
509 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
510 			    "dropping connection");
511 			free(data, M_CFISCSI);
512 			icl_pdu_free(request);
513 			icl_pdu_free(response);
514 			cfiscsi_session_terminate(cs);
515 			return;
516 		}
517 		free(data, M_CFISCSI);
518 	}
519 
520 	icl_pdu_free(request);
521 	cfiscsi_pdu_queue(response);
522 }
523 
524 static void
525 cfiscsi_pdu_handle_scsi_command(struct icl_pdu *request)
526 {
527 	struct iscsi_bhs_scsi_command *bhssc;
528 	struct cfiscsi_session *cs;
529 	union ctl_io *io;
530 	int error;
531 
532 	cs = PDU_SESSION(request);
533 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
534 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
535 	//    bhssc->bhssc_initiator_task_tag);
536 
537 	if (request->ip_data_len > 0 && cs->cs_immediate_data == false) {
538 		CFISCSI_SESSION_WARN(cs, "unsolicited data with "
539 		    "ImmediateData=No; dropping connection");
540 		icl_pdu_free(request);
541 		cfiscsi_session_terminate(cs);
542 		return;
543 	}
544 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
545 	if (io == NULL) {
546 		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io; "
547 		    "dropping connection");
548 		icl_pdu_free(request);
549 		cfiscsi_session_terminate(cs);
550 		return;
551 	}
552 	ctl_zero_io(io);
553 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
554 	io->io_hdr.io_type = CTL_IO_SCSI;
555 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
556 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
557 	io->io_hdr.nexus.targ_target.id = 0;
558 	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhssc->bhssc_lun);
559 	io->scsiio.tag_num = bhssc->bhssc_initiator_task_tag;
560 	switch ((bhssc->bhssc_flags & BHSSC_FLAGS_ATTR)) {
561 	case BHSSC_FLAGS_ATTR_UNTAGGED:
562 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
563 		break;
564 	case BHSSC_FLAGS_ATTR_SIMPLE:
565 		io->scsiio.tag_type = CTL_TAG_SIMPLE;
566 		break;
567 	case BHSSC_FLAGS_ATTR_ORDERED:
568         	io->scsiio.tag_type = CTL_TAG_ORDERED;
569 		break;
570 	case BHSSC_FLAGS_ATTR_HOQ:
571         	io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
572 		break;
573 	case BHSSC_FLAGS_ATTR_ACA:
574 		io->scsiio.tag_type = CTL_TAG_ACA;
575 		break;
576 	default:
577 		io->scsiio.tag_type = CTL_TAG_UNTAGGED;
578 		CFISCSI_SESSION_WARN(cs, "unhandled tag type %d",
579 		    bhssc->bhssc_flags & BHSSC_FLAGS_ATTR);
580 		break;
581 	}
582 	io->scsiio.cdb_len = sizeof(bhssc->bhssc_cdb); /* Which is 16. */
583 	memcpy(io->scsiio.cdb, bhssc->bhssc_cdb, sizeof(bhssc->bhssc_cdb));
584 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
585 	error = ctl_queue(io);
586 	if (error != CTL_RETVAL_COMPLETE) {
587 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
588 		    "dropping connection", error);
589 		ctl_free_io(io);
590 		refcount_release(&cs->cs_outstanding_ctl_pdus);
591 		icl_pdu_free(request);
592 		cfiscsi_session_terminate(cs);
593 	}
594 }
595 
596 static void
597 cfiscsi_pdu_handle_task_request(struct icl_pdu *request)
598 {
599 	struct iscsi_bhs_task_management_request *bhstmr;
600 	struct iscsi_bhs_task_management_response *bhstmr2;
601 	struct icl_pdu *response;
602 	struct cfiscsi_session *cs;
603 	union ctl_io *io;
604 	int error;
605 
606 	cs = PDU_SESSION(request);
607 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
608 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
609 	if (io == NULL) {
610 		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io;"
611 		    "dropping connection");
612 		icl_pdu_free(request);
613 		cfiscsi_session_terminate(cs);
614 		return;
615 	}
616 	ctl_zero_io(io);
617 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = request;
618 	io->io_hdr.io_type = CTL_IO_TASK;
619 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
620 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
621 	io->io_hdr.nexus.targ_target.id = 0;
622 	io->io_hdr.nexus.targ_lun = cfiscsi_decode_lun(bhstmr->bhstmr_lun);
623 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
624 
625 	switch (bhstmr->bhstmr_function & ~0x80) {
626 	case BHSTMR_FUNCTION_ABORT_TASK:
627 #if 0
628 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK");
629 #endif
630 		io->taskio.task_action = CTL_TASK_ABORT_TASK;
631 		io->taskio.tag_num = bhstmr->bhstmr_referenced_task_tag;
632 		break;
633 	case BHSTMR_FUNCTION_ABORT_TASK_SET:
634 #if 0
635 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_ABORT_TASK_SET");
636 #endif
637 		io->taskio.task_action = CTL_TASK_ABORT_TASK_SET;
638 		break;
639 	case BHSTMR_FUNCTION_LOGICAL_UNIT_RESET:
640 #if 0
641 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_LOGICAL_UNIT_RESET");
642 #endif
643 		io->taskio.task_action = CTL_TASK_LUN_RESET;
644 		break;
645 	case BHSTMR_FUNCTION_TARGET_WARM_RESET:
646 #if 0
647 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_FUNCTION_TARGET_WARM_RESET");
648 #endif
649 		io->taskio.task_action = CTL_TASK_TARGET_RESET;
650 		break;
651 	default:
652 		CFISCSI_SESSION_DEBUG(cs, "unsupported function 0x%x",
653 		    bhstmr->bhstmr_function & ~0x80);
654 		ctl_free_io(io);
655 
656 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
657 		if (response == NULL) {
658 			CFISCSI_SESSION_WARN(cs, "failed to allocate memory; "
659 			    "dropping connection");
660 			icl_pdu_free(request);
661 			cfiscsi_session_terminate(cs);
662 			return;
663 		}
664 		bhstmr2 = (struct iscsi_bhs_task_management_response *)
665 		    response->ip_bhs;
666 		bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
667 		bhstmr2->bhstmr_flags = 0x80;
668 		bhstmr2->bhstmr_response =
669 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
670 		bhstmr2->bhstmr_initiator_task_tag =
671 		    bhstmr->bhstmr_initiator_task_tag;
672 		icl_pdu_free(request);
673 		cfiscsi_pdu_queue(response);
674 		return;
675 	}
676 
677 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
678 	error = ctl_queue(io);
679 	if (error != CTL_RETVAL_COMPLETE) {
680 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d; "
681 		    "dropping connection", error);
682 		ctl_free_io(io);
683 		refcount_release(&cs->cs_outstanding_ctl_pdus);
684 		icl_pdu_free(request);
685 		cfiscsi_session_terminate(cs);
686 	}
687 }
688 
689 static bool
690 cfiscsi_handle_data_segment(struct icl_pdu *request, struct cfiscsi_data_wait *cdw)
691 {
692 	struct iscsi_bhs_data_out *bhsdo;
693 	struct cfiscsi_session *cs;
694 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
695 	size_t copy_len, len, off, buffer_offset;
696 	int ctl_sg_count;
697 	union ctl_io *io;
698 
699 	cs = PDU_SESSION(request);
700 
701 	KASSERT((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
702 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT ||
703 	    (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
704 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
705 	    ("bad opcode 0x%x", request->ip_bhs->bhs_opcode));
706 
707 	/*
708 	 * We're only using fields common for Data-Out and SCSI Command PDUs.
709 	 */
710 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
711 
712 	io = cdw->cdw_ctl_io;
713 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
714 	    ("CTL_FLAG_DATA_IN"));
715 
716 #if 0
717 	CFISCSI_SESSION_DEBUG(cs, "received %zd bytes out of %d",
718 	    request->ip_data_len, io->scsiio.kern_total_len);
719 #endif
720 
721 	if (io->scsiio.kern_sg_entries > 0) {
722 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
723 		ctl_sg_count = io->scsiio.kern_sg_entries;
724 	} else {
725 		ctl_sglist = &ctl_sg_entry;
726 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
727 		ctl_sglist->len = io->scsiio.kern_data_len;
728 		ctl_sg_count = 1;
729 	}
730 
731 	if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
732 	    ISCSI_BHS_OPCODE_SCSI_DATA_OUT)
733 		buffer_offset = ntohl(bhsdo->bhsdo_buffer_offset);
734 	else
735 		buffer_offset = 0;
736 	len = icl_pdu_data_segment_length(request);
737 
738 	/*
739 	 * Make sure the offset, as sent by the initiator, matches the offset
740 	 * we're supposed to be at in the scatter-gather list.
741 	 */
742 	if (buffer_offset >
743 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled ||
744 	    buffer_offset + len <=
745 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled) {
746 		CFISCSI_SESSION_WARN(cs, "received bad buffer offset %zd, "
747 		    "expected %zd; dropping connection", buffer_offset,
748 		    (size_t)io->scsiio.kern_rel_offset +
749 		    (size_t)io->scsiio.ext_data_filled);
750 		ctl_set_data_phase_error(&io->scsiio);
751 		cfiscsi_session_terminate(cs);
752 		return (true);
753 	}
754 
755 	/*
756 	 * This is the offset within the PDU data segment, as opposed
757 	 * to buffer_offset, which is the offset within the task (SCSI
758 	 * command).
759 	 */
760 	off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled -
761 	    buffer_offset;
762 
763 	/*
764 	 * Iterate over the scatter/gather segments, filling them with data
765 	 * from the PDU data segment.  Note that this can get called multiple
766 	 * times for one SCSI command; the cdw structure holds state for the
767 	 * scatter/gather list.
768 	 */
769 	for (;;) {
770 		KASSERT(cdw->cdw_sg_index < ctl_sg_count,
771 		    ("cdw->cdw_sg_index >= ctl_sg_count"));
772 		if (cdw->cdw_sg_len == 0) {
773 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
774 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
775 		}
776 		KASSERT(off <= len, ("len > off"));
777 		copy_len = len - off;
778 		if (copy_len > cdw->cdw_sg_len)
779 			copy_len = cdw->cdw_sg_len;
780 
781 		icl_pdu_get_data(request, off, cdw->cdw_sg_addr, copy_len);
782 		cdw->cdw_sg_addr += copy_len;
783 		cdw->cdw_sg_len -= copy_len;
784 		off += copy_len;
785 		io->scsiio.ext_data_filled += copy_len;
786 
787 		if (cdw->cdw_sg_len == 0) {
788 			/*
789 			 * End of current segment.
790 			 */
791 			if (cdw->cdw_sg_index == ctl_sg_count - 1) {
792 				/*
793 				 * Last segment in scatter/gather list.
794 				 */
795 				break;
796 			}
797 			cdw->cdw_sg_index++;
798 		}
799 
800 		if (off == len) {
801 			/*
802 			 * End of PDU payload.
803 			 */
804 			break;
805 		}
806 	}
807 
808 	if (len > off) {
809 		/*
810 		 * In case of unsolicited data, it's possible that the buffer
811 		 * provided by CTL is smaller than negotiated FirstBurstLength.
812 		 * Just ignore the superfluous data; will ask for them with R2T
813 		 * on next call to cfiscsi_datamove().
814 		 *
815 		 * This obviously can only happen with SCSI Command PDU.
816 		 */
817 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
818 		    ISCSI_BHS_OPCODE_SCSI_COMMAND)
819 			return (true);
820 
821 		CFISCSI_SESSION_WARN(cs, "received too much data: got %zd bytes, "
822 		    "expected %zd; dropping connection",
823 		    icl_pdu_data_segment_length(request), off);
824 		ctl_set_data_phase_error(&io->scsiio);
825 		cfiscsi_session_terminate(cs);
826 		return (true);
827 	}
828 
829 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end &&
830 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) == 0) {
831 		CFISCSI_SESSION_WARN(cs, "got the final packet without "
832 		    "the F flag; flags = 0x%x; dropping connection",
833 		    bhsdo->bhsdo_flags);
834 		ctl_set_data_phase_error(&io->scsiio);
835 		cfiscsi_session_terminate(cs);
836 		return (true);
837 	}
838 
839 	if (io->scsiio.ext_data_filled != cdw->cdw_r2t_end &&
840 	    (bhsdo->bhsdo_flags & BHSDO_FLAGS_F) != 0) {
841 		if ((request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
842 		    ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
843 			CFISCSI_SESSION_WARN(cs, "got the final packet, but the "
844 			    "transmitted size was %zd bytes instead of %d; "
845 			    "dropping connection",
846 			    (size_t)io->scsiio.ext_data_filled,
847 			    cdw->cdw_r2t_end);
848 			ctl_set_data_phase_error(&io->scsiio);
849 			cfiscsi_session_terminate(cs);
850 			return (true);
851 		} else {
852 			/*
853 			 * For SCSI Command PDU, this just means we need to
854 			 * solicit more data by sending R2T.
855 			 */
856 			return (false);
857 		}
858 	}
859 
860 	if (io->scsiio.ext_data_filled == cdw->cdw_r2t_end) {
861 #if 0
862 		CFISCSI_SESSION_DEBUG(cs, "no longer expecting Data-Out with target "
863 		    "transfer tag 0x%x", cdw->cdw_target_transfer_tag);
864 #endif
865 
866 		return (true);
867 	}
868 
869 	return (false);
870 }
871 
872 static void
873 cfiscsi_pdu_handle_data_out(struct icl_pdu *request)
874 {
875 	struct iscsi_bhs_data_out *bhsdo;
876 	struct cfiscsi_session *cs;
877 	struct cfiscsi_data_wait *cdw = NULL;
878 	union ctl_io *io;
879 	bool done;
880 
881 	cs = PDU_SESSION(request);
882 	bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
883 
884 	CFISCSI_SESSION_LOCK(cs);
885 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next) {
886 #if 0
887 		CFISCSI_SESSION_DEBUG(cs, "have ttt 0x%x, itt 0x%x; looking for "
888 		    "ttt 0x%x, itt 0x%x",
889 		    bhsdo->bhsdo_target_transfer_tag,
890 		    bhsdo->bhsdo_initiator_task_tag,
891 		    cdw->cdw_target_transfer_tag, cdw->cdw_initiator_task_tag));
892 #endif
893 		if (bhsdo->bhsdo_target_transfer_tag ==
894 		    cdw->cdw_target_transfer_tag)
895 			break;
896 	}
897 	CFISCSI_SESSION_UNLOCK(cs);
898 	if (cdw == NULL) {
899 		CFISCSI_SESSION_WARN(cs, "data transfer tag 0x%x, initiator task tag "
900 		    "0x%x, not found; dropping connection",
901 		    bhsdo->bhsdo_target_transfer_tag, bhsdo->bhsdo_initiator_task_tag);
902 		icl_pdu_free(request);
903 		cfiscsi_session_terminate(cs);
904 		return;
905 	}
906 
907 	io = cdw->cdw_ctl_io;
908 	KASSERT((io->io_hdr.flags & CTL_FLAG_DATA_MASK) != CTL_FLAG_DATA_IN,
909 	    ("CTL_FLAG_DATA_IN"));
910 
911 	done = cfiscsi_handle_data_segment(request, cdw);
912 	if (done) {
913 		CFISCSI_SESSION_LOCK(cs);
914 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
915 		CFISCSI_SESSION_UNLOCK(cs);
916 		done = (io->scsiio.ext_data_filled != cdw->cdw_r2t_end ||
917 		    io->scsiio.ext_data_filled == io->scsiio.kern_data_len);
918 		uma_zfree(cfiscsi_data_wait_zone, cdw);
919 		if (done)
920 			io->scsiio.be_move_done(io);
921 		else
922 			cfiscsi_datamove_out(io);
923 	}
924 
925 	icl_pdu_free(request);
926 }
927 
928 static void
929 cfiscsi_pdu_handle_logout_request(struct icl_pdu *request)
930 {
931 	struct iscsi_bhs_logout_request *bhslr;
932 	struct iscsi_bhs_logout_response *bhslr2;
933 	struct icl_pdu *response;
934 	struct cfiscsi_session *cs;
935 
936 	cs = PDU_SESSION(request);
937 	bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
938 	switch (bhslr->bhslr_reason & 0x7f) {
939 	case BHSLR_REASON_CLOSE_SESSION:
940 	case BHSLR_REASON_CLOSE_CONNECTION:
941 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
942 		if (response == NULL) {
943 			CFISCSI_SESSION_DEBUG(cs, "failed to allocate memory");
944 			icl_pdu_free(request);
945 			cfiscsi_session_terminate(cs);
946 			return;
947 		}
948 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
949 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
950 		bhslr2->bhslr_flags = 0x80;
951 		bhslr2->bhslr_response = BHSLR_RESPONSE_CLOSED_SUCCESSFULLY;
952 		bhslr2->bhslr_initiator_task_tag =
953 		    bhslr->bhslr_initiator_task_tag;
954 		icl_pdu_free(request);
955 		cfiscsi_pdu_queue(response);
956 		cfiscsi_session_terminate(cs);
957 		break;
958 	case BHSLR_REASON_REMOVE_FOR_RECOVERY:
959 		response = cfiscsi_pdu_new_response(request, M_NOWAIT);
960 		if (response == NULL) {
961 			CFISCSI_SESSION_WARN(cs,
962 			    "failed to allocate memory; dropping connection");
963 			icl_pdu_free(request);
964 			cfiscsi_session_terminate(cs);
965 			return;
966 		}
967 		bhslr2 = (struct iscsi_bhs_logout_response *)response->ip_bhs;
968 		bhslr2->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_RESPONSE;
969 		bhslr2->bhslr_flags = 0x80;
970 		bhslr2->bhslr_response = BHSLR_RESPONSE_RECOVERY_NOT_SUPPORTED;
971 		bhslr2->bhslr_initiator_task_tag =
972 		    bhslr->bhslr_initiator_task_tag;
973 		icl_pdu_free(request);
974 		cfiscsi_pdu_queue(response);
975 		break;
976 	default:
977 		CFISCSI_SESSION_WARN(cs, "invalid reason 0%x; dropping connection",
978 		    bhslr->bhslr_reason);
979 		icl_pdu_free(request);
980 		cfiscsi_session_terminate(cs);
981 		break;
982 	}
983 }
984 
985 static void
986 cfiscsi_callout(void *context)
987 {
988 	struct icl_pdu *cp;
989 	struct iscsi_bhs_nop_in *bhsni;
990 	struct cfiscsi_session *cs;
991 
992 	cs = context;
993 
994 	if (cs->cs_terminating)
995 		return;
996 
997 	callout_schedule(&cs->cs_callout, 1 * hz);
998 
999 	atomic_add_int(&cs->cs_timeout, 1);
1000 
1001 #ifdef ICL_KERNEL_PROXY
1002 	if (cs->cs_waiting_for_ctld || cs->cs_login_phase) {
1003 		if (login_timeout > 0 && cs->cs_timeout > login_timeout) {
1004 			CFISCSI_SESSION_WARN(cs, "login timed out after "
1005 			    "%d seconds; dropping connection", cs->cs_timeout);
1006 			cfiscsi_session_terminate(cs);
1007 		}
1008 		return;
1009 	}
1010 #endif
1011 
1012 	if (ping_timeout <= 0) {
1013 		/*
1014 		 * Pings are disabled.  Don't send NOP-In in this case;
1015 		 * user might have disabled pings to work around problems
1016 		 * with certain initiators that can't properly handle
1017 		 * NOP-In, such as iPXE.  Reset the timeout, to avoid
1018 		 * triggering reconnection, should the user decide to
1019 		 * reenable them.
1020 		 */
1021 		cs->cs_timeout = 0;
1022 		return;
1023 	}
1024 
1025 	if (cs->cs_timeout >= ping_timeout) {
1026 		CFISCSI_SESSION_WARN(cs, "no ping reply (NOP-Out) after %d seconds; "
1027 		    "dropping connection",  ping_timeout);
1028 		cfiscsi_session_terminate(cs);
1029 		return;
1030 	}
1031 
1032 	/*
1033 	 * If the ping was reset less than one second ago - which means
1034 	 * that we've received some PDU during the last second - assume
1035 	 * the traffic flows correctly and don't bother sending a NOP-Out.
1036 	 *
1037 	 * (It's 2 - one for one second, and one for incrementing is_timeout
1038 	 * earlier in this routine.)
1039 	 */
1040 	if (cs->cs_timeout < 2)
1041 		return;
1042 
1043 	cp = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1044 	if (cp == NULL) {
1045 		CFISCSI_SESSION_WARN(cs, "failed to allocate memory");
1046 		return;
1047 	}
1048 	bhsni = (struct iscsi_bhs_nop_in *)cp->ip_bhs;
1049 	bhsni->bhsni_opcode = ISCSI_BHS_OPCODE_NOP_IN;
1050 	bhsni->bhsni_flags = 0x80;
1051 	bhsni->bhsni_initiator_task_tag = 0xffffffff;
1052 
1053 	cfiscsi_pdu_queue(cp);
1054 }
1055 
1056 static void
1057 cfiscsi_session_terminate_tasks(struct cfiscsi_session *cs)
1058 {
1059 	struct cfiscsi_data_wait *cdw;
1060 	union ctl_io *io;
1061 	int error, last;
1062 
1063 	io = ctl_alloc_io(cs->cs_target->ct_port.ctl_pool_ref);
1064 	if (io == NULL) {
1065 		CFISCSI_SESSION_WARN(cs, "can't allocate ctl_io");
1066 		return;
1067 	}
1068 	ctl_zero_io(io);
1069 	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = cs;
1070 	io->io_hdr.io_type = CTL_IO_TASK;
1071 	io->io_hdr.nexus.initid.id = cs->cs_ctl_initid;
1072 	io->io_hdr.nexus.targ_port = cs->cs_target->ct_port.targ_port;
1073 	io->io_hdr.nexus.targ_target.id = 0;
1074 	io->io_hdr.nexus.targ_lun = 0;
1075 	io->taskio.tag_type = CTL_TAG_SIMPLE; /* XXX */
1076 	io->taskio.task_action = CTL_TASK_I_T_NEXUS_RESET;
1077 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1078 	error = ctl_queue(io);
1079 	if (error != CTL_RETVAL_COMPLETE) {
1080 		CFISCSI_SESSION_WARN(cs, "ctl_queue() failed; error %d", error);
1081 		refcount_release(&cs->cs_outstanding_ctl_pdus);
1082 		ctl_free_io(io);
1083 	}
1084 
1085 	CFISCSI_SESSION_LOCK(cs);
1086 	while ((cdw = TAILQ_FIRST(&cs->cs_waiting_for_data_out)) != NULL) {
1087 		TAILQ_REMOVE(&cs->cs_waiting_for_data_out, cdw, cdw_next);
1088 		CFISCSI_SESSION_UNLOCK(cs);
1089 		/*
1090 		 * Set nonzero port status; this prevents backends from
1091 		 * assuming that the data transfer actually succeeded
1092 		 * and writing uninitialized data to disk.
1093 		 */
1094 		cdw->cdw_ctl_io->scsiio.io_hdr.port_status = 42;
1095 		cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
1096 		uma_zfree(cfiscsi_data_wait_zone, cdw);
1097 		CFISCSI_SESSION_LOCK(cs);
1098 	}
1099 	CFISCSI_SESSION_UNLOCK(cs);
1100 
1101 	/*
1102 	 * Wait for CTL to terminate all the tasks.
1103 	 */
1104 	for (;;) {
1105 		refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1106 		last = refcount_release(&cs->cs_outstanding_ctl_pdus);
1107 		if (last != 0)
1108 			break;
1109 		CFISCSI_SESSION_WARN(cs, "waiting for CTL to terminate tasks, "
1110 		    "%d remaining", cs->cs_outstanding_ctl_pdus);
1111 		tsleep(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus),
1112 		    0, "cfiscsi_terminate", hz / 100);
1113 	}
1114 }
1115 
1116 static void
1117 cfiscsi_maintenance_thread(void *arg)
1118 {
1119 	struct cfiscsi_session *cs;
1120 
1121 	cs = arg;
1122 
1123 	for (;;) {
1124 		CFISCSI_SESSION_LOCK(cs);
1125 		if (cs->cs_terminating == false)
1126 			cv_wait(&cs->cs_maintenance_cv, &cs->cs_lock);
1127 		CFISCSI_SESSION_UNLOCK(cs);
1128 
1129 		if (cs->cs_terminating) {
1130 
1131 			/*
1132 			 * We used to wait up to 30 seconds to deliver queued
1133 			 * PDUs to the initiator.  We also tried hard to deliver
1134 			 * SCSI Responses for the aborted PDUs.  We don't do
1135 			 * that anymore.  We might need to revisit that.
1136 			 */
1137 			callout_drain(&cs->cs_callout);
1138 			icl_conn_close(cs->cs_conn);
1139 
1140 			/*
1141 			 * At this point ICL receive thread is no longer
1142 			 * running; no new tasks can be queued.
1143 			 */
1144 			cfiscsi_session_terminate_tasks(cs);
1145 			cfiscsi_session_delete(cs);
1146 			kthread_exit();
1147 			return;
1148 		}
1149 		CFISCSI_SESSION_DEBUG(cs, "nothing to do");
1150 	}
1151 }
1152 
1153 static void
1154 cfiscsi_session_terminate(struct cfiscsi_session *cs)
1155 {
1156 
1157 	if (cs->cs_terminating)
1158 		return;
1159 	cs->cs_terminating = true;
1160 	cv_signal(&cs->cs_maintenance_cv);
1161 #ifdef ICL_KERNEL_PROXY
1162 	cv_signal(&cs->cs_login_cv);
1163 #endif
1164 }
1165 
1166 static int
1167 cfiscsi_session_register_initiator(struct cfiscsi_session *cs)
1168 {
1169 	struct cfiscsi_target *ct;
1170 	char *name;
1171 	int i;
1172 
1173 	KASSERT(cs->cs_ctl_initid == -1, ("already registered"));
1174 
1175 	ct = cs->cs_target;
1176 	name = strdup(cs->cs_initiator_id, M_CTL);
1177 	i = ctl_add_initiator(&ct->ct_port, -1, 0, name);
1178 	if (i < 0) {
1179 		CFISCSI_SESSION_WARN(cs, "ctl_add_initiator failed with error %d",
1180 		    i);
1181 		cs->cs_ctl_initid = -1;
1182 		return (1);
1183 	}
1184 	cs->cs_ctl_initid = i;
1185 #if 0
1186 	CFISCSI_SESSION_DEBUG(cs, "added initiator id %d", i);
1187 #endif
1188 
1189 	return (0);
1190 }
1191 
1192 static void
1193 cfiscsi_session_unregister_initiator(struct cfiscsi_session *cs)
1194 {
1195 	int error;
1196 
1197 	if (cs->cs_ctl_initid == -1)
1198 		return;
1199 
1200 	error = ctl_remove_initiator(&cs->cs_target->ct_port, cs->cs_ctl_initid);
1201 	if (error != 0) {
1202 		CFISCSI_SESSION_WARN(cs, "ctl_remove_initiator failed with error %d",
1203 		    error);
1204 	}
1205 	cs->cs_ctl_initid = -1;
1206 }
1207 
1208 static struct cfiscsi_session *
1209 cfiscsi_session_new(struct cfiscsi_softc *softc)
1210 {
1211 	struct cfiscsi_session *cs;
1212 	int error;
1213 
1214 	cs = malloc(sizeof(*cs), M_CFISCSI, M_NOWAIT | M_ZERO);
1215 	if (cs == NULL) {
1216 		CFISCSI_WARN("malloc failed");
1217 		return (NULL);
1218 	}
1219 	cs->cs_ctl_initid = -1;
1220 
1221 	refcount_init(&cs->cs_outstanding_ctl_pdus, 0);
1222 	TAILQ_INIT(&cs->cs_waiting_for_data_out);
1223 	mtx_init(&cs->cs_lock, "cfiscsi_lock", NULL, MTX_DEF);
1224 	cv_init(&cs->cs_maintenance_cv, "cfiscsi_mt");
1225 #ifdef ICL_KERNEL_PROXY
1226 	cv_init(&cs->cs_login_cv, "cfiscsi_login");
1227 #endif
1228 
1229 	cs->cs_conn = icl_conn_new("cfiscsi", &cs->cs_lock);
1230 	cs->cs_conn->ic_receive = cfiscsi_receive_callback;
1231 	cs->cs_conn->ic_error = cfiscsi_error_callback;
1232 	cs->cs_conn->ic_prv0 = cs;
1233 
1234 	error = kthread_add(cfiscsi_maintenance_thread, cs, NULL, NULL, 0, 0, "cfiscsimt");
1235 	if (error != 0) {
1236 		CFISCSI_SESSION_WARN(cs, "kthread_add(9) failed with error %d", error);
1237 		free(cs, M_CFISCSI);
1238 		return (NULL);
1239 	}
1240 
1241 	mtx_lock(&softc->lock);
1242 	cs->cs_id = softc->last_session_id + 1;
1243 	softc->last_session_id++;
1244 	mtx_unlock(&softc->lock);
1245 
1246 	mtx_lock(&softc->lock);
1247 	TAILQ_INSERT_TAIL(&softc->sessions, cs, cs_next);
1248 	mtx_unlock(&softc->lock);
1249 
1250 	/*
1251 	 * Start pinging the initiator.
1252 	 */
1253 	callout_init(&cs->cs_callout, 1);
1254 	callout_reset(&cs->cs_callout, 1 * hz, cfiscsi_callout, cs);
1255 
1256 	return (cs);
1257 }
1258 
1259 static void
1260 cfiscsi_session_delete(struct cfiscsi_session *cs)
1261 {
1262 	struct cfiscsi_softc *softc;
1263 
1264 	softc = &cfiscsi_softc;
1265 
1266 	KASSERT(cs->cs_outstanding_ctl_pdus == 0,
1267 	    ("destroying session with outstanding CTL pdus"));
1268 	KASSERT(TAILQ_EMPTY(&cs->cs_waiting_for_data_out),
1269 	    ("destroying session with non-empty queue"));
1270 
1271 	cfiscsi_session_unregister_initiator(cs);
1272 	if (cs->cs_target != NULL)
1273 		cfiscsi_target_release(cs->cs_target);
1274 	icl_conn_close(cs->cs_conn);
1275 	icl_conn_free(cs->cs_conn);
1276 
1277 	mtx_lock(&softc->lock);
1278 	TAILQ_REMOVE(&softc->sessions, cs, cs_next);
1279 	mtx_unlock(&softc->lock);
1280 
1281 	free(cs, M_CFISCSI);
1282 }
1283 
1284 int
1285 cfiscsi_init(void)
1286 {
1287 	struct cfiscsi_softc *softc;
1288 	int retval;
1289 
1290 	softc = &cfiscsi_softc;
1291 	retval = 0;
1292 	bzero(softc, sizeof(*softc));
1293 	mtx_init(&softc->lock, "cfiscsi", NULL, MTX_DEF);
1294 
1295 #ifdef ICL_KERNEL_PROXY
1296 	cv_init(&softc->accept_cv, "cfiscsi_accept");
1297 #endif
1298 	TAILQ_INIT(&softc->sessions);
1299 	TAILQ_INIT(&softc->targets);
1300 
1301 	cfiscsi_data_wait_zone = uma_zcreate("cfiscsi_data_wait",
1302 	    sizeof(struct cfiscsi_data_wait), NULL, NULL, NULL, NULL,
1303 	    UMA_ALIGN_PTR, 0);
1304 
1305 	return (0);
1306 }
1307 
1308 #ifdef ICL_KERNEL_PROXY
1309 static void
1310 cfiscsi_accept(struct socket *so, struct sockaddr *sa, int portal_id)
1311 {
1312 	struct cfiscsi_session *cs;
1313 
1314 	cs = cfiscsi_session_new(&cfiscsi_softc);
1315 	if (cs == NULL) {
1316 		CFISCSI_WARN("failed to create session");
1317 		return;
1318 	}
1319 
1320 	icl_conn_handoff_sock(cs->cs_conn, so);
1321 	cs->cs_initiator_sa = sa;
1322 	cs->cs_portal_id = portal_id;
1323 	cs->cs_waiting_for_ctld = true;
1324 	cv_signal(&cfiscsi_softc.accept_cv);
1325 }
1326 #endif
1327 
1328 static void
1329 cfiscsi_online(void *arg)
1330 {
1331 	struct cfiscsi_softc *softc;
1332 	struct cfiscsi_target *ct;
1333 	int online;
1334 
1335 	ct = (struct cfiscsi_target *)arg;
1336 	softc = ct->ct_softc;
1337 
1338 	mtx_lock(&softc->lock);
1339 	if (ct->ct_online) {
1340 		mtx_unlock(&softc->lock);
1341 		return;
1342 	}
1343 	ct->ct_online = 1;
1344 	online = softc->online++;
1345 	mtx_unlock(&softc->lock);
1346 	if (online > 0)
1347 		return;
1348 
1349 #ifdef ICL_KERNEL_PROXY
1350 	if (softc->listener != NULL)
1351 		icl_listen_free(softc->listener);
1352 	softc->listener = icl_listen_new(cfiscsi_accept);
1353 #endif
1354 }
1355 
1356 static void
1357 cfiscsi_offline(void *arg)
1358 {
1359 	struct cfiscsi_softc *softc;
1360 	struct cfiscsi_target *ct;
1361 	struct cfiscsi_session *cs;
1362 	int online;
1363 
1364 	ct = (struct cfiscsi_target *)arg;
1365 	softc = ct->ct_softc;
1366 
1367 	mtx_lock(&softc->lock);
1368 	if (!ct->ct_online) {
1369 		mtx_unlock(&softc->lock);
1370 		return;
1371 	}
1372 	ct->ct_online = 0;
1373 	online = --softc->online;
1374 
1375 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1376 		if (cs->cs_target == ct)
1377 			cfiscsi_session_terminate(cs);
1378 	}
1379 	mtx_unlock(&softc->lock);
1380 	if (online > 0)
1381 		return;
1382 
1383 #ifdef ICL_KERNEL_PROXY
1384 	icl_listen_free(softc->listener);
1385 	softc->listener = NULL;
1386 #endif
1387 }
1388 
1389 static int
1390 cfiscsi_info(void *arg, struct sbuf *sb)
1391 {
1392 	struct cfiscsi_target *ct = (struct cfiscsi_target *)arg;
1393 	int retval;
1394 
1395 	retval = sbuf_printf(sb, "\t<cfiscsi_state>%d</cfiscsi_state>\n",
1396 	    ct->ct_state);
1397 	return (retval);
1398 }
1399 
1400 static void
1401 cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
1402 {
1403 	struct cfiscsi_softc *softc;
1404 	struct cfiscsi_session *cs, *cs2;
1405 	struct cfiscsi_target *ct;
1406 	struct ctl_iscsi_handoff_params *cihp;
1407 	int error;
1408 
1409 	cihp = (struct ctl_iscsi_handoff_params *)&(ci->data);
1410 	softc = &cfiscsi_softc;
1411 
1412 	CFISCSI_DEBUG("new connection from %s (%s) to %s",
1413 	    cihp->initiator_name, cihp->initiator_addr,
1414 	    cihp->target_name);
1415 
1416 	ct = cfiscsi_target_find(softc, cihp->target_name);
1417 	if (ct == NULL) {
1418 		ci->status = CTL_ISCSI_ERROR;
1419 		snprintf(ci->error_str, sizeof(ci->error_str),
1420 		    "%s: target not found", __func__);
1421 		return;
1422 	}
1423 
1424 	if (ct->ct_online == 0) {
1425 		ci->status = CTL_ISCSI_ERROR;
1426 		snprintf(ci->error_str, sizeof(ci->error_str),
1427 		    "%s: port offline", __func__);
1428 		cfiscsi_target_release(ct);
1429 		return;
1430 	}
1431 
1432 #ifdef ICL_KERNEL_PROXY
1433 	if (cihp->socket > 0 && cihp->connection_id > 0) {
1434 		snprintf(ci->error_str, sizeof(ci->error_str),
1435 		    "both socket and connection_id set");
1436 		ci->status = CTL_ISCSI_ERROR;
1437 		cfiscsi_target_release(ct);
1438 		return;
1439 	}
1440 	if (cihp->socket == 0) {
1441 		mtx_lock(&cfiscsi_softc.lock);
1442 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1443 			if (cs->cs_id == cihp->socket)
1444 				break;
1445 		}
1446 		if (cs == NULL) {
1447 			mtx_unlock(&cfiscsi_softc.lock);
1448 			snprintf(ci->error_str, sizeof(ci->error_str),
1449 			    "connection not found");
1450 			ci->status = CTL_ISCSI_ERROR;
1451 			cfiscsi_target_release(ct);
1452 			return;
1453 		}
1454 		mtx_unlock(&cfiscsi_softc.lock);
1455 	} else {
1456 #endif
1457 		cs = cfiscsi_session_new(softc);
1458 		if (cs == NULL) {
1459 			ci->status = CTL_ISCSI_ERROR;
1460 			snprintf(ci->error_str, sizeof(ci->error_str),
1461 			    "%s: cfiscsi_session_new failed", __func__);
1462 			cfiscsi_target_release(ct);
1463 			return;
1464 		}
1465 #ifdef ICL_KERNEL_PROXY
1466 	}
1467 #endif
1468 	cs->cs_target = ct;
1469 
1470 	/*
1471 	 * First PDU of Full Feature phase has the same CmdSN as the last
1472 	 * PDU from the Login Phase received from the initiator.  Thus,
1473 	 * the -1 below.
1474 	 */
1475 	cs->cs_portal_group_tag = cihp->portal_group_tag;
1476 	cs->cs_cmdsn = cihp->cmdsn;
1477 	cs->cs_statsn = cihp->statsn;
1478 	cs->cs_max_data_segment_length = cihp->max_recv_data_segment_length;
1479 	cs->cs_max_burst_length = cihp->max_burst_length;
1480 	cs->cs_immediate_data = !!cihp->immediate_data;
1481 	if (cihp->header_digest == CTL_ISCSI_DIGEST_CRC32C)
1482 		cs->cs_conn->ic_header_crc32c = true;
1483 	if (cihp->data_digest == CTL_ISCSI_DIGEST_CRC32C)
1484 		cs->cs_conn->ic_data_crc32c = true;
1485 
1486 	strlcpy(cs->cs_initiator_name,
1487 	    cihp->initiator_name, sizeof(cs->cs_initiator_name));
1488 	strlcpy(cs->cs_initiator_addr,
1489 	    cihp->initiator_addr, sizeof(cs->cs_initiator_addr));
1490 	strlcpy(cs->cs_initiator_alias,
1491 	    cihp->initiator_alias, sizeof(cs->cs_initiator_alias));
1492 	memcpy(cs->cs_initiator_isid,
1493 	    cihp->initiator_isid, sizeof(cs->cs_initiator_isid));
1494 	snprintf(cs->cs_initiator_id, sizeof(cs->cs_initiator_id),
1495 	    "%s,i,0x%02x%02x%02x%02x%02x%02x", cs->cs_initiator_name,
1496 	    cihp->initiator_isid[0], cihp->initiator_isid[1],
1497 	    cihp->initiator_isid[2], cihp->initiator_isid[3],
1498 	    cihp->initiator_isid[4], cihp->initiator_isid[5]);
1499 
1500 	refcount_acquire(&cs->cs_outstanding_ctl_pdus);
1501 restart:
1502 	if (!cs->cs_terminating) {
1503 		mtx_lock(&softc->lock);
1504 		TAILQ_FOREACH(cs2, &softc->sessions, cs_next) {
1505 			if (cs2 != cs && cs2->cs_tasks_aborted == false &&
1506 			    cs->cs_target == cs2->cs_target &&
1507 			    cs->cs_portal_group_tag == cs2->cs_portal_group_tag &&
1508 			    strcmp(cs->cs_initiator_id, cs2->cs_initiator_id) == 0) {
1509 				cfiscsi_session_terminate(cs2);
1510 				mtx_unlock(&softc->lock);
1511 				pause("cfiscsi_reinstate", 1);
1512 				goto restart;
1513 			}
1514 		}
1515 		mtx_unlock(&softc->lock);
1516 	}
1517 
1518 	/*
1519 	 * Register initiator with CTL.
1520 	 */
1521 	cfiscsi_session_register_initiator(cs);
1522 
1523 #ifdef ICL_KERNEL_PROXY
1524 	if (cihp->socket > 0) {
1525 #endif
1526 		error = icl_conn_handoff(cs->cs_conn, cihp->socket);
1527 		if (error != 0) {
1528 			cfiscsi_session_terminate(cs);
1529 			refcount_release(&cs->cs_outstanding_ctl_pdus);
1530 			ci->status = CTL_ISCSI_ERROR;
1531 			snprintf(ci->error_str, sizeof(ci->error_str),
1532 			    "%s: icl_conn_handoff failed with error %d",
1533 			    __func__, error);
1534 			return;
1535 		}
1536 #ifdef ICL_KERNEL_PROXY
1537 	}
1538 #endif
1539 
1540 #ifdef ICL_KERNEL_PROXY
1541 	cs->cs_login_phase = false;
1542 
1543 	/*
1544 	 * First PDU of the Full Feature phase has likely already arrived.
1545 	 * We have to pick it up and execute properly.
1546 	 */
1547 	if (cs->cs_login_pdu != NULL) {
1548 		CFISCSI_SESSION_DEBUG(cs, "picking up first PDU");
1549 		cfiscsi_pdu_handle(cs->cs_login_pdu);
1550 		cs->cs_login_pdu = NULL;
1551 	}
1552 #endif
1553 
1554 	refcount_release(&cs->cs_outstanding_ctl_pdus);
1555 	ci->status = CTL_ISCSI_OK;
1556 }
1557 
1558 static void
1559 cfiscsi_ioctl_list(struct ctl_iscsi *ci)
1560 {
1561 	struct ctl_iscsi_list_params *cilp;
1562 	struct cfiscsi_session *cs;
1563 	struct cfiscsi_softc *softc;
1564 	struct sbuf *sb;
1565 	int error;
1566 
1567 	cilp = (struct ctl_iscsi_list_params *)&(ci->data);
1568 	softc = &cfiscsi_softc;
1569 
1570 	sb = sbuf_new(NULL, NULL, cilp->alloc_len, SBUF_FIXEDLEN);
1571 	if (sb == NULL) {
1572 		ci->status = CTL_ISCSI_ERROR;
1573 		snprintf(ci->error_str, sizeof(ci->error_str),
1574 		    "Unable to allocate %d bytes for iSCSI session list",
1575 		    cilp->alloc_len);
1576 		return;
1577 	}
1578 
1579 	sbuf_printf(sb, "<ctlislist>\n");
1580 	mtx_lock(&softc->lock);
1581 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1582 #ifdef ICL_KERNEL_PROXY
1583 		if (cs->cs_target == NULL)
1584 			continue;
1585 #endif
1586 		error = sbuf_printf(sb, "<connection id=\"%d\">"
1587 		    "<initiator>%s</initiator>"
1588 		    "<initiator_addr>%s</initiator_addr>"
1589 		    "<initiator_alias>%s</initiator_alias>"
1590 		    "<target>%s</target>"
1591 		    "<target_alias>%s</target_alias>"
1592 		    "<header_digest>%s</header_digest>"
1593 		    "<data_digest>%s</data_digest>"
1594 		    "<max_data_segment_length>%zd</max_data_segment_length>"
1595 		    "<immediate_data>%d</immediate_data>"
1596 		    "<iser>%d</iser>"
1597 		    "</connection>\n",
1598 		    cs->cs_id,
1599 		    cs->cs_initiator_name, cs->cs_initiator_addr, cs->cs_initiator_alias,
1600 		    cs->cs_target->ct_name, cs->cs_target->ct_alias,
1601 		    cs->cs_conn->ic_header_crc32c ? "CRC32C" : "None",
1602 		    cs->cs_conn->ic_data_crc32c ? "CRC32C" : "None",
1603 		    cs->cs_max_data_segment_length,
1604 		    cs->cs_immediate_data,
1605 		    cs->cs_conn->ic_iser);
1606 		if (error != 0)
1607 			break;
1608 	}
1609 	mtx_unlock(&softc->lock);
1610 	error = sbuf_printf(sb, "</ctlislist>\n");
1611 	if (error != 0) {
1612 		sbuf_delete(sb);
1613 		ci->status = CTL_ISCSI_LIST_NEED_MORE_SPACE;
1614 		snprintf(ci->error_str, sizeof(ci->error_str),
1615 		    "Out of space, %d bytes is too small", cilp->alloc_len);
1616 		return;
1617 	}
1618 	sbuf_finish(sb);
1619 
1620 	error = copyout(sbuf_data(sb), cilp->conn_xml, sbuf_len(sb) + 1);
1621 	cilp->fill_len = sbuf_len(sb) + 1;
1622 	ci->status = CTL_ISCSI_OK;
1623 	sbuf_delete(sb);
1624 }
1625 
1626 static void
1627 cfiscsi_ioctl_terminate(struct ctl_iscsi *ci)
1628 {
1629 	struct icl_pdu *response;
1630 	struct iscsi_bhs_asynchronous_message *bhsam;
1631 	struct ctl_iscsi_terminate_params *citp;
1632 	struct cfiscsi_session *cs;
1633 	struct cfiscsi_softc *softc;
1634 	int found = 0;
1635 
1636 	citp = (struct ctl_iscsi_terminate_params *)&(ci->data);
1637 	softc = &cfiscsi_softc;
1638 
1639 	mtx_lock(&softc->lock);
1640 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1641 		if (citp->all == 0 && cs->cs_id != citp->connection_id &&
1642 		    strcmp(cs->cs_initiator_name, citp->initiator_name) != 0 &&
1643 		    strcmp(cs->cs_initiator_addr, citp->initiator_addr) != 0)
1644 			continue;
1645 
1646 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1647 		if (response == NULL) {
1648 			/*
1649 			 * Oh well.  Just terminate the connection.
1650 			 */
1651 		} else {
1652 			bhsam = (struct iscsi_bhs_asynchronous_message *)
1653 			    response->ip_bhs;
1654 			bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1655 			bhsam->bhsam_flags = 0x80;
1656 			bhsam->bhsam_0xffffffff = 0xffffffff;
1657 			bhsam->bhsam_async_event =
1658 			    BHSAM_EVENT_TARGET_TERMINATES_SESSION;
1659 			cfiscsi_pdu_queue(response);
1660 		}
1661 		cfiscsi_session_terminate(cs);
1662 		found++;
1663 	}
1664 	mtx_unlock(&softc->lock);
1665 
1666 	if (found == 0) {
1667 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1668 		snprintf(ci->error_str, sizeof(ci->error_str),
1669 		    "No matching connections found");
1670 		return;
1671 	}
1672 
1673 	ci->status = CTL_ISCSI_OK;
1674 }
1675 
1676 static void
1677 cfiscsi_ioctl_logout(struct ctl_iscsi *ci)
1678 {
1679 	struct icl_pdu *response;
1680 	struct iscsi_bhs_asynchronous_message *bhsam;
1681 	struct ctl_iscsi_logout_params *cilp;
1682 	struct cfiscsi_session *cs;
1683 	struct cfiscsi_softc *softc;
1684 	int found = 0;
1685 
1686 	cilp = (struct ctl_iscsi_logout_params *)&(ci->data);
1687 	softc = &cfiscsi_softc;
1688 
1689 	mtx_lock(&softc->lock);
1690 	TAILQ_FOREACH(cs, &softc->sessions, cs_next) {
1691 		if (cilp->all == 0 && cs->cs_id != cilp->connection_id &&
1692 		    strcmp(cs->cs_initiator_name, cilp->initiator_name) != 0 &&
1693 		    strcmp(cs->cs_initiator_addr, cilp->initiator_addr) != 0)
1694 			continue;
1695 
1696 		response = icl_pdu_new(cs->cs_conn, M_NOWAIT);
1697 		if (response == NULL) {
1698 			ci->status = CTL_ISCSI_ERROR;
1699 			snprintf(ci->error_str, sizeof(ci->error_str),
1700 			    "Unable to allocate memory");
1701 			mtx_unlock(&softc->lock);
1702 			return;
1703 		}
1704 		bhsam =
1705 		    (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1706 		bhsam->bhsam_opcode = ISCSI_BHS_OPCODE_ASYNC_MESSAGE;
1707 		bhsam->bhsam_flags = 0x80;
1708 		bhsam->bhsam_async_event = BHSAM_EVENT_TARGET_REQUESTS_LOGOUT;
1709 		bhsam->bhsam_parameter3 = htons(10);
1710 		cfiscsi_pdu_queue(response);
1711 		found++;
1712 	}
1713 	mtx_unlock(&softc->lock);
1714 
1715 	if (found == 0) {
1716 		ci->status = CTL_ISCSI_SESSION_NOT_FOUND;
1717 		snprintf(ci->error_str, sizeof(ci->error_str),
1718 		    "No matching connections found");
1719 		return;
1720 	}
1721 
1722 	ci->status = CTL_ISCSI_OK;
1723 }
1724 
1725 #ifdef ICL_KERNEL_PROXY
1726 static void
1727 cfiscsi_ioctl_listen(struct ctl_iscsi *ci)
1728 {
1729 	struct ctl_iscsi_listen_params *cilp;
1730 	struct sockaddr *sa;
1731 	int error;
1732 
1733 	cilp = (struct ctl_iscsi_listen_params *)&(ci->data);
1734 
1735 	if (cfiscsi_softc.listener == NULL) {
1736 		CFISCSI_DEBUG("no listener");
1737 		snprintf(ci->error_str, sizeof(ci->error_str), "no listener");
1738 		ci->status = CTL_ISCSI_ERROR;
1739 		return;
1740 	}
1741 
1742 	error = getsockaddr(&sa, (void *)cilp->addr, cilp->addrlen);
1743 	if (error != 0) {
1744 		CFISCSI_DEBUG("getsockaddr, error %d", error);
1745 		snprintf(ci->error_str, sizeof(ci->error_str), "getsockaddr failed");
1746 		ci->status = CTL_ISCSI_ERROR;
1747 		return;
1748 	}
1749 
1750 	error = icl_listen_add(cfiscsi_softc.listener, cilp->iser, cilp->domain,
1751 	    cilp->socktype, cilp->protocol, sa, cilp->portal_id);
1752 	if (error != 0) {
1753 		free(sa, M_SONAME);
1754 		CFISCSI_DEBUG("icl_listen_add, error %d", error);
1755 		snprintf(ci->error_str, sizeof(ci->error_str),
1756 		    "icl_listen_add failed, error %d", error);
1757 		ci->status = CTL_ISCSI_ERROR;
1758 		return;
1759 	}
1760 
1761 	ci->status = CTL_ISCSI_OK;
1762 }
1763 
1764 static void
1765 cfiscsi_ioctl_accept(struct ctl_iscsi *ci)
1766 {
1767 	struct ctl_iscsi_accept_params *ciap;
1768 	struct cfiscsi_session *cs;
1769 	int error;
1770 
1771 	ciap = (struct ctl_iscsi_accept_params *)&(ci->data);
1772 
1773 	mtx_lock(&cfiscsi_softc.lock);
1774 	for (;;) {
1775 		TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1776 			if (cs->cs_waiting_for_ctld)
1777 				break;
1778 		}
1779 		if (cs != NULL)
1780 			break;
1781 		error = cv_wait_sig(&cfiscsi_softc.accept_cv, &cfiscsi_softc.lock);
1782 		if (error != 0) {
1783 			mtx_unlock(&cfiscsi_softc.lock);
1784 			snprintf(ci->error_str, sizeof(ci->error_str), "interrupted");
1785 			ci->status = CTL_ISCSI_ERROR;
1786 			return;
1787 		}
1788 	}
1789 	mtx_unlock(&cfiscsi_softc.lock);
1790 
1791 	cs->cs_waiting_for_ctld = false;
1792 	cs->cs_login_phase = true;
1793 
1794 	ciap->connection_id = cs->cs_id;
1795 	ciap->portal_id = cs->cs_portal_id;
1796 	ciap->initiator_addrlen = cs->cs_initiator_sa->sa_len;
1797 	error = copyout(cs->cs_initiator_sa, ciap->initiator_addr,
1798 	    cs->cs_initiator_sa->sa_len);
1799 	if (error != 0) {
1800 		snprintf(ci->error_str, sizeof(ci->error_str),
1801 		    "copyout failed with error %d", error);
1802 		ci->status = CTL_ISCSI_ERROR;
1803 		return;
1804 	}
1805 
1806 	ci->status = CTL_ISCSI_OK;
1807 }
1808 
1809 static void
1810 cfiscsi_ioctl_send(struct ctl_iscsi *ci)
1811 {
1812 	struct ctl_iscsi_send_params *cisp;
1813 	struct cfiscsi_session *cs;
1814 	struct icl_pdu *ip;
1815 	size_t datalen;
1816 	void *data;
1817 	int error;
1818 
1819 	cisp = (struct ctl_iscsi_send_params *)&(ci->data);
1820 
1821 	mtx_lock(&cfiscsi_softc.lock);
1822 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1823 		if (cs->cs_id == cisp->connection_id)
1824 			break;
1825 	}
1826 	if (cs == NULL) {
1827 		mtx_unlock(&cfiscsi_softc.lock);
1828 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
1829 		ci->status = CTL_ISCSI_ERROR;
1830 		return;
1831 	}
1832 	mtx_unlock(&cfiscsi_softc.lock);
1833 
1834 #if 0
1835 	if (cs->cs_login_phase == false)
1836 		return (EBUSY);
1837 #endif
1838 
1839 	if (cs->cs_terminating) {
1840 		snprintf(ci->error_str, sizeof(ci->error_str), "connection is terminating");
1841 		ci->status = CTL_ISCSI_ERROR;
1842 		return;
1843 	}
1844 
1845 	datalen = cisp->data_segment_len;
1846 	/*
1847 	 * XXX
1848 	 */
1849 	//if (datalen > CFISCSI_MAX_DATA_SEGMENT_LENGTH) {
1850 	if (datalen > 65535) {
1851 		snprintf(ci->error_str, sizeof(ci->error_str), "data segment too big");
1852 		ci->status = CTL_ISCSI_ERROR;
1853 		return;
1854 	}
1855 	if (datalen > 0) {
1856 		data = malloc(datalen, M_CFISCSI, M_WAITOK);
1857 		error = copyin(cisp->data_segment, data, datalen);
1858 		if (error != 0) {
1859 			free(data, M_CFISCSI);
1860 			snprintf(ci->error_str, sizeof(ci->error_str), "copyin error %d", error);
1861 			ci->status = CTL_ISCSI_ERROR;
1862 			return;
1863 		}
1864 	}
1865 
1866 	ip = icl_pdu_new(cs->cs_conn, M_WAITOK);
1867 	memcpy(ip->ip_bhs, cisp->bhs, sizeof(*ip->ip_bhs));
1868 	if (datalen > 0) {
1869 		icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1870 		free(data, M_CFISCSI);
1871 	}
1872 	CFISCSI_SESSION_LOCK(cs);
1873 	icl_pdu_queue(ip);
1874 	CFISCSI_SESSION_UNLOCK(cs);
1875 	ci->status = CTL_ISCSI_OK;
1876 }
1877 
1878 static void
1879 cfiscsi_ioctl_receive(struct ctl_iscsi *ci)
1880 {
1881 	struct ctl_iscsi_receive_params *cirp;
1882 	struct cfiscsi_session *cs;
1883 	struct icl_pdu *ip;
1884 	void *data;
1885 	int error;
1886 
1887 	cirp = (struct ctl_iscsi_receive_params *)&(ci->data);
1888 
1889 	mtx_lock(&cfiscsi_softc.lock);
1890 	TAILQ_FOREACH(cs, &cfiscsi_softc.sessions, cs_next) {
1891 		if (cs->cs_id == cirp->connection_id)
1892 			break;
1893 	}
1894 	if (cs == NULL) {
1895 		mtx_unlock(&cfiscsi_softc.lock);
1896 		snprintf(ci->error_str, sizeof(ci->error_str),
1897 		    "connection not found");
1898 		ci->status = CTL_ISCSI_ERROR;
1899 		return;
1900 	}
1901 	mtx_unlock(&cfiscsi_softc.lock);
1902 
1903 #if 0
1904 	if (is->is_login_phase == false)
1905 		return (EBUSY);
1906 #endif
1907 
1908 	CFISCSI_SESSION_LOCK(cs);
1909 	while (cs->cs_login_pdu == NULL && cs->cs_terminating == false) {
1910 		error = cv_wait_sig(&cs->cs_login_cv, &cs->cs_lock);
1911 		if (error != 0) {
1912 			CFISCSI_SESSION_UNLOCK(cs);
1913 			snprintf(ci->error_str, sizeof(ci->error_str),
1914 			    "interrupted by signal");
1915 			ci->status = CTL_ISCSI_ERROR;
1916 			return;
1917 		}
1918 	}
1919 
1920 	if (cs->cs_terminating) {
1921 		CFISCSI_SESSION_UNLOCK(cs);
1922 		snprintf(ci->error_str, sizeof(ci->error_str),
1923 		    "connection terminating");
1924 		ci->status = CTL_ISCSI_ERROR;
1925 		return;
1926 	}
1927 	ip = cs->cs_login_pdu;
1928 	cs->cs_login_pdu = NULL;
1929 	CFISCSI_SESSION_UNLOCK(cs);
1930 
1931 	if (ip->ip_data_len > cirp->data_segment_len) {
1932 		icl_pdu_free(ip);
1933 		snprintf(ci->error_str, sizeof(ci->error_str),
1934 		    "data segment too big");
1935 		ci->status = CTL_ISCSI_ERROR;
1936 		return;
1937 	}
1938 
1939 	copyout(ip->ip_bhs, cirp->bhs, sizeof(*ip->ip_bhs));
1940 	if (ip->ip_data_len > 0) {
1941 		data = malloc(ip->ip_data_len, M_CFISCSI, M_WAITOK);
1942 		icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
1943 		copyout(data, cirp->data_segment, ip->ip_data_len);
1944 		free(data, M_CFISCSI);
1945 	}
1946 
1947 	icl_pdu_free(ip);
1948 	ci->status = CTL_ISCSI_OK;
1949 }
1950 
1951 #endif /* !ICL_KERNEL_PROXY */
1952 
1953 static void
1954 cfiscsi_ioctl_port_create(struct ctl_req *req)
1955 {
1956 	struct cfiscsi_target *ct;
1957 	struct ctl_port *port;
1958 	const char *target, *alias, *tag;
1959 	struct scsi_vpd_id_descriptor *desc;
1960 	ctl_options_t opts;
1961 	int retval, len, idlen;
1962 
1963 	ctl_init_opts(&opts, req->num_args, req->kern_args);
1964 	target = ctl_get_opt(&opts, "cfiscsi_target");
1965 	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
1966 	tag = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
1967 	if (target == NULL || tag == NULL) {
1968 		req->status = CTL_LUN_ERROR;
1969 		snprintf(req->error_str, sizeof(req->error_str),
1970 		    "Missing required argument");
1971 		ctl_free_opts(&opts);
1972 		return;
1973 	}
1974 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias);
1975 	if (ct == NULL) {
1976 		req->status = CTL_LUN_ERROR;
1977 		snprintf(req->error_str, sizeof(req->error_str),
1978 		    "failed to create target \"%s\"", target);
1979 		ctl_free_opts(&opts);
1980 		return;
1981 	}
1982 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
1983 		req->status = CTL_LUN_ERROR;
1984 		snprintf(req->error_str, sizeof(req->error_str),
1985 		    "target \"%s\" already exist", target);
1986 		cfiscsi_target_release(ct);
1987 		ctl_free_opts(&opts);
1988 		return;
1989 	}
1990 	port = &ct->ct_port;
1991 	if (ct->ct_state == CFISCSI_TARGET_STATE_DYING)
1992 		goto done;
1993 
1994 	port->frontend = &cfiscsi_frontend;
1995 	port->port_type = CTL_PORT_ISCSI;
1996 	/* XXX KDM what should the real number be here? */
1997 	port->num_requested_ctl_io = 4096;
1998 	port->port_name = "iscsi";
1999 	port->physical_port = strtoul(tag, NULL, 0);
2000 	port->virtual_port = ct->ct_target_id;
2001 	port->port_online = cfiscsi_online;
2002 	port->port_offline = cfiscsi_offline;
2003 	port->port_info = cfiscsi_info;
2004 	port->onoff_arg = ct;
2005 	port->lun_enable = cfiscsi_lun_enable;
2006 	port->lun_disable = cfiscsi_lun_disable;
2007 	port->lun_map = cfiscsi_lun_map;
2008 	port->targ_lun_arg = ct;
2009 	port->fe_datamove = cfiscsi_datamove;
2010 	port->fe_done = cfiscsi_done;
2011 
2012 	/* XXX KDM what should we report here? */
2013 	/* XXX These should probably be fetched from CTL. */
2014 	port->max_targets = 1;
2015 	port->max_target_id = 15;
2016 
2017 	port->options = opts;
2018 	STAILQ_INIT(&opts);
2019 
2020 	/* Generate Port ID. */
2021 	idlen = strlen(target) + strlen(",t,0x0001") + 1;
2022 	idlen = roundup2(idlen, 4);
2023 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2024 	port->port_devid = malloc(sizeof(struct ctl_devid) + len,
2025 	    M_CTL, M_WAITOK | M_ZERO);
2026 	port->port_devid->len = len;
2027 	desc = (struct scsi_vpd_id_descriptor *)port->port_devid->data;
2028 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2029 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT |
2030 	    SVPD_ID_TYPE_SCSI_NAME;
2031 	desc->length = idlen;
2032 	snprintf(desc->identifier, idlen, "%s,t,0x%4.4x",
2033 	    target, port->physical_port);
2034 
2035 	/* Generate Target ID. */
2036 	idlen = strlen(target) + 1;
2037 	idlen = roundup2(idlen, 4);
2038 	len = sizeof(struct scsi_vpd_device_id) + idlen;
2039 	port->target_devid = malloc(sizeof(struct ctl_devid) + len,
2040 	    M_CTL, M_WAITOK | M_ZERO);
2041 	port->target_devid->len = len;
2042 	desc = (struct scsi_vpd_id_descriptor *)port->target_devid->data;
2043 	desc->proto_codeset = (SCSI_PROTO_ISCSI << 4) | SVPD_ID_CODESET_UTF8;
2044 	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_TARGET |
2045 	    SVPD_ID_TYPE_SCSI_NAME;
2046 	desc->length = idlen;
2047 	strlcpy(desc->identifier, target, idlen);
2048 
2049 	retval = ctl_port_register(port, /*master_SC*/ 1);
2050 	if (retval != 0) {
2051 		ctl_free_opts(&port->options);
2052 		cfiscsi_target_release(ct);
2053 		free(port->port_devid, M_CFISCSI);
2054 		free(port->target_devid, M_CFISCSI);
2055 		req->status = CTL_LUN_ERROR;
2056 		snprintf(req->error_str, sizeof(req->error_str),
2057 		    "ctl_frontend_register() failed with error %d", retval);
2058 		return;
2059 	}
2060 done:
2061 	ct->ct_state = CFISCSI_TARGET_STATE_ACTIVE;
2062 	req->status = CTL_LUN_OK;
2063 	memcpy(req->kern_args[0].kvalue, &port->targ_port,
2064 	    sizeof(port->targ_port)); //XXX
2065 }
2066 
2067 static void
2068 cfiscsi_ioctl_port_remove(struct ctl_req *req)
2069 {
2070 	struct cfiscsi_target *ct;
2071 	const char *target;
2072 	ctl_options_t opts;
2073 
2074 	ctl_init_opts(&opts, req->num_args, req->kern_args);
2075 	target = ctl_get_opt(&opts, "cfiscsi_target");
2076 	if (target == NULL) {
2077 		ctl_free_opts(&opts);
2078 		req->status = CTL_LUN_ERROR;
2079 		snprintf(req->error_str, sizeof(req->error_str),
2080 		    "Missing required argument");
2081 		return;
2082 	}
2083 	ct = cfiscsi_target_find(&cfiscsi_softc, target);
2084 	if (ct == NULL) {
2085 		ctl_free_opts(&opts);
2086 		req->status = CTL_LUN_ERROR;
2087 		snprintf(req->error_str, sizeof(req->error_str),
2088 		    "can't find target \"%s\"", target);
2089 		return;
2090 	}
2091 	if (ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE) {
2092 		ctl_free_opts(&opts);
2093 		req->status = CTL_LUN_ERROR;
2094 		snprintf(req->error_str, sizeof(req->error_str),
2095 		    "target \"%s\" is already dying", target);
2096 		return;
2097 	}
2098 	ctl_free_opts(&opts);
2099 
2100 	ct->ct_state = CFISCSI_TARGET_STATE_DYING;
2101 	ctl_port_offline(&ct->ct_port);
2102 	cfiscsi_target_release(ct);
2103 	cfiscsi_target_release(ct);
2104 }
2105 
2106 static int
2107 cfiscsi_ioctl(struct cdev *dev,
2108     u_long cmd, caddr_t addr, int flag, struct thread *td)
2109 {
2110 	struct ctl_iscsi *ci;
2111 	struct ctl_req *req;
2112 
2113 	if (cmd == CTL_PORT_REQ) {
2114 		req = (struct ctl_req *)addr;
2115 		switch (req->reqtype) {
2116 		case CTL_REQ_CREATE:
2117 			cfiscsi_ioctl_port_create(req);
2118 			break;
2119 		case CTL_REQ_REMOVE:
2120 			cfiscsi_ioctl_port_remove(req);
2121 			break;
2122 		default:
2123 			req->status = CTL_LUN_ERROR;
2124 			snprintf(req->error_str, sizeof(req->error_str),
2125 			    "Unsupported request type %d", req->reqtype);
2126 		}
2127 		return (0);
2128 	}
2129 
2130 	if (cmd != CTL_ISCSI)
2131 		return (ENOTTY);
2132 
2133 	ci = (struct ctl_iscsi *)addr;
2134 	switch (ci->type) {
2135 	case CTL_ISCSI_HANDOFF:
2136 		cfiscsi_ioctl_handoff(ci);
2137 		break;
2138 	case CTL_ISCSI_LIST:
2139 		cfiscsi_ioctl_list(ci);
2140 		break;
2141 	case CTL_ISCSI_TERMINATE:
2142 		cfiscsi_ioctl_terminate(ci);
2143 		break;
2144 	case CTL_ISCSI_LOGOUT:
2145 		cfiscsi_ioctl_logout(ci);
2146 		break;
2147 #ifdef ICL_KERNEL_PROXY
2148 	case CTL_ISCSI_LISTEN:
2149 		cfiscsi_ioctl_listen(ci);
2150 		break;
2151 	case CTL_ISCSI_ACCEPT:
2152 		cfiscsi_ioctl_accept(ci);
2153 		break;
2154 	case CTL_ISCSI_SEND:
2155 		cfiscsi_ioctl_send(ci);
2156 		break;
2157 	case CTL_ISCSI_RECEIVE:
2158 		cfiscsi_ioctl_receive(ci);
2159 		break;
2160 #else
2161 	case CTL_ISCSI_LISTEN:
2162 	case CTL_ISCSI_ACCEPT:
2163 	case CTL_ISCSI_SEND:
2164 	case CTL_ISCSI_RECEIVE:
2165 		ci->status = CTL_ISCSI_ERROR;
2166 		snprintf(ci->error_str, sizeof(ci->error_str),
2167 		    "%s: CTL compiled without ICL_KERNEL_PROXY",
2168 		    __func__);
2169 		break;
2170 #endif /* !ICL_KERNEL_PROXY */
2171 	default:
2172 		ci->status = CTL_ISCSI_ERROR;
2173 		snprintf(ci->error_str, sizeof(ci->error_str),
2174 		    "%s: invalid iSCSI request type %d", __func__, ci->type);
2175 		break;
2176 	}
2177 
2178 	return (0);
2179 }
2180 
2181 static void
2182 cfiscsi_target_hold(struct cfiscsi_target *ct)
2183 {
2184 
2185 	refcount_acquire(&ct->ct_refcount);
2186 }
2187 
2188 static void
2189 cfiscsi_target_release(struct cfiscsi_target *ct)
2190 {
2191 	struct cfiscsi_softc *softc;
2192 
2193 	softc = ct->ct_softc;
2194 	mtx_lock(&softc->lock);
2195 	if (refcount_release(&ct->ct_refcount)) {
2196 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
2197 		mtx_unlock(&softc->lock);
2198 		if (ct->ct_state != CFISCSI_TARGET_STATE_INVALID) {
2199 			ct->ct_state = CFISCSI_TARGET_STATE_INVALID;
2200 			if (ctl_port_deregister(&ct->ct_port) != 0)
2201 				printf("%s: ctl_port_deregister() failed\n",
2202 				    __func__);
2203 		}
2204 		free(ct, M_CFISCSI);
2205 
2206 		return;
2207 	}
2208 	mtx_unlock(&softc->lock);
2209 }
2210 
2211 static struct cfiscsi_target *
2212 cfiscsi_target_find(struct cfiscsi_softc *softc, const char *name)
2213 {
2214 	struct cfiscsi_target *ct;
2215 
2216 	mtx_lock(&softc->lock);
2217 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2218 		if (strcmp(name, ct->ct_name) != 0 ||
2219 		    ct->ct_state != CFISCSI_TARGET_STATE_ACTIVE)
2220 			continue;
2221 		cfiscsi_target_hold(ct);
2222 		mtx_unlock(&softc->lock);
2223 		return (ct);
2224 	}
2225 	mtx_unlock(&softc->lock);
2226 
2227 	return (NULL);
2228 }
2229 
2230 static struct cfiscsi_target *
2231 cfiscsi_target_find_or_create(struct cfiscsi_softc *softc, const char *name,
2232     const char *alias)
2233 {
2234 	struct cfiscsi_target *ct, *newct;
2235 	int i;
2236 
2237 	if (name[0] == '\0' || strlen(name) >= CTL_ISCSI_NAME_LEN)
2238 		return (NULL);
2239 
2240 	newct = malloc(sizeof(*newct), M_CFISCSI, M_WAITOK | M_ZERO);
2241 
2242 	mtx_lock(&softc->lock);
2243 	TAILQ_FOREACH(ct, &softc->targets, ct_next) {
2244 		if (strcmp(name, ct->ct_name) != 0 ||
2245 		    ct->ct_state == CFISCSI_TARGET_STATE_INVALID)
2246 			continue;
2247 		cfiscsi_target_hold(ct);
2248 		mtx_unlock(&softc->lock);
2249 		free(newct, M_CFISCSI);
2250 		return (ct);
2251 	}
2252 
2253 	for (i = 0; i < CTL_MAX_LUNS; i++)
2254 		newct->ct_luns[i] = UINT32_MAX;
2255 
2256 	strlcpy(newct->ct_name, name, sizeof(newct->ct_name));
2257 	if (alias != NULL)
2258 		strlcpy(newct->ct_alias, alias, sizeof(newct->ct_alias));
2259 	refcount_init(&newct->ct_refcount, 1);
2260 	newct->ct_softc = softc;
2261 	if (TAILQ_EMPTY(&softc->targets))
2262 		softc->last_target_id = 0;
2263 	newct->ct_target_id = ++softc->last_target_id;
2264 	TAILQ_INSERT_TAIL(&softc->targets, newct, ct_next);
2265 	mtx_unlock(&softc->lock);
2266 
2267 	return (newct);
2268 }
2269 
2270 /*
2271  * Takes LUN from the target space and returns LUN from the CTL space.
2272  */
2273 static uint32_t
2274 cfiscsi_lun_map(void *arg, uint32_t lun)
2275 {
2276 	struct cfiscsi_target *ct = arg;
2277 
2278 	if (lun >= CTL_MAX_LUNS) {
2279 		CFISCSI_DEBUG("requested lun number %d is higher "
2280 		    "than maximum %d", lun, CTL_MAX_LUNS - 1);
2281 		return (UINT32_MAX);
2282 	}
2283 	return (ct->ct_luns[lun]);
2284 }
2285 
2286 static int
2287 cfiscsi_target_set_lun(struct cfiscsi_target *ct,
2288     unsigned long lun_id, unsigned long ctl_lun_id)
2289 {
2290 
2291 	if (lun_id >= CTL_MAX_LUNS) {
2292 		CFISCSI_WARN("requested lun number %ld is higher "
2293 		    "than maximum %d", lun_id, CTL_MAX_LUNS - 1);
2294 		return (-1);
2295 	}
2296 
2297 	if (ct->ct_luns[lun_id] < CTL_MAX_LUNS) {
2298 		/*
2299 		 * CTL calls cfiscsi_lun_enable() twice for each LUN - once
2300 		 * when the LUN is created, and a second time just before
2301 		 * the port is brought online; don't emit warnings
2302 		 * for that case.
2303 		 */
2304 		if (ct->ct_luns[lun_id] == ctl_lun_id)
2305 			return (0);
2306 		CFISCSI_WARN("lun %ld already allocated", lun_id);
2307 		return (-1);
2308 	}
2309 
2310 #if 0
2311 	CFISCSI_DEBUG("adding mapping for lun %ld, target %s "
2312 	    "to ctl lun %ld", lun_id, ct->ct_name, ctl_lun_id);
2313 #endif
2314 
2315 	ct->ct_luns[lun_id] = ctl_lun_id;
2316 
2317 	return (0);
2318 }
2319 
2320 static int
2321 cfiscsi_lun_enable(void *arg, struct ctl_id target_id, int lun_id)
2322 {
2323 	struct cfiscsi_softc *softc;
2324 	struct cfiscsi_target *ct;
2325 	const char *target = NULL;
2326 	const char *lun = NULL;
2327 	unsigned long tmp;
2328 
2329 	ct = (struct cfiscsi_target *)arg;
2330 	softc = ct->ct_softc;
2331 
2332 	target = ctl_get_opt(&control_softc->ctl_luns[lun_id]->be_lun->options,
2333 	    "cfiscsi_target");
2334 	lun = ctl_get_opt(&control_softc->ctl_luns[lun_id]->be_lun->options,
2335 	    "cfiscsi_lun");
2336 
2337 	if (target == NULL && lun == NULL)
2338 		return (0);
2339 
2340 	if (target == NULL || lun == NULL) {
2341 		CFISCSI_WARN("lun added with cfiscsi_target, but without "
2342 		    "cfiscsi_lun, or the other way around; ignoring");
2343 		return (0);
2344 	}
2345 
2346 	if (strcmp(target, ct->ct_name) != 0)
2347 		return (0);
2348 
2349 	tmp = strtoul(lun, NULL, 10);
2350 	cfiscsi_target_set_lun(ct, tmp, lun_id);
2351 	return (0);
2352 }
2353 
2354 static int
2355 cfiscsi_lun_disable(void *arg, struct ctl_id target_id, int lun_id)
2356 {
2357 	struct cfiscsi_softc *softc;
2358 	struct cfiscsi_target *ct;
2359 	int i;
2360 
2361 	ct = (struct cfiscsi_target *)arg;
2362 	softc = ct->ct_softc;
2363 
2364 	mtx_lock(&softc->lock);
2365 	for (i = 0; i < CTL_MAX_LUNS; i++) {
2366 		if (ct->ct_luns[i] != lun_id)
2367 			continue;
2368 		ct->ct_luns[i] = UINT32_MAX;
2369 		break;
2370 	}
2371 	mtx_unlock(&softc->lock);
2372 	return (0);
2373 }
2374 
2375 static void
2376 cfiscsi_datamove_in(union ctl_io *io)
2377 {
2378 	struct cfiscsi_session *cs;
2379 	struct icl_pdu *request, *response;
2380 	const struct iscsi_bhs_scsi_command *bhssc;
2381 	struct iscsi_bhs_data_in *bhsdi;
2382 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2383 	size_t len, expected_len, sg_len, buffer_offset;
2384 	const char *sg_addr;
2385 	int ctl_sg_count, error, i;
2386 
2387 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2388 	cs = PDU_SESSION(request);
2389 
2390 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2391 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2392 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2393 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2394 
2395 	if (io->scsiio.kern_sg_entries > 0) {
2396 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2397 		ctl_sg_count = io->scsiio.kern_sg_entries;
2398 	} else {
2399 		ctl_sglist = &ctl_sg_entry;
2400 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2401 		ctl_sglist->len = io->scsiio.kern_data_len;
2402 		ctl_sg_count = 1;
2403 	}
2404 
2405 	/*
2406 	 * This is the total amount of data to be transferred within the current
2407 	 * SCSI command.  We need to record it so that we can properly report
2408 	 * underflow/underflow.
2409 	 */
2410 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2411 
2412 	/*
2413 	 * This is the offset within the current SCSI command; for the first
2414 	 * call to cfiscsi_datamove() it will be 0, and for subsequent ones
2415 	 * it will be the sum of lengths of previous ones.
2416 	 */
2417 	buffer_offset = io->scsiio.kern_rel_offset;
2418 
2419 	/*
2420 	 * This is the transfer length expected by the initiator.  In theory,
2421 	 * it could be different from the correct amount of data from the SCSI
2422 	 * point of view, even if that doesn't make any sense.
2423 	 */
2424 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2425 #if 0
2426 	if (expected_len != io->scsiio.kern_total_len) {
2427 		CFISCSI_SESSION_DEBUG(cs, "expected transfer length %zd, "
2428 		    "actual length %zd", expected_len,
2429 		    (size_t)io->scsiio.kern_total_len);
2430 	}
2431 #endif
2432 
2433 	if (buffer_offset >= expected_len) {
2434 #if 0
2435 		CFISCSI_SESSION_DEBUG(cs, "buffer_offset = %zd, "
2436 		    "already sent the expected len", buffer_offset);
2437 #endif
2438 		io->scsiio.be_move_done(io);
2439 		return;
2440 	}
2441 
2442 	i = 0;
2443 	sg_addr = NULL;
2444 	sg_len = 0;
2445 	response = NULL;
2446 	bhsdi = NULL;
2447 	for (;;) {
2448 		if (response == NULL) {
2449 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2450 			if (response == NULL) {
2451 				CFISCSI_SESSION_WARN(cs, "failed to "
2452 				    "allocate memory; dropping connection");
2453 				ctl_set_busy(&io->scsiio);
2454 				io->scsiio.be_move_done(io);
2455 				cfiscsi_session_terminate(cs);
2456 				return;
2457 			}
2458 			bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
2459 			bhsdi->bhsdi_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_IN;
2460 			bhsdi->bhsdi_initiator_task_tag =
2461 			    bhssc->bhssc_initiator_task_tag;
2462 			bhsdi->bhsdi_datasn = htonl(PDU_EXPDATASN(request));
2463 			PDU_EXPDATASN(request)++;
2464 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
2465 		}
2466 
2467 		KASSERT(i < ctl_sg_count, ("i >= ctl_sg_count"));
2468 		if (sg_len == 0) {
2469 			sg_addr = ctl_sglist[i].addr;
2470 			sg_len = ctl_sglist[i].len;
2471 			KASSERT(sg_len > 0, ("sg_len <= 0"));
2472 		}
2473 
2474 		len = sg_len;
2475 
2476 		/*
2477 		 * Truncate to maximum data segment length.
2478 		 */
2479 		KASSERT(response->ip_data_len < cs->cs_max_data_segment_length,
2480 		    ("ip_data_len %zd >= max_data_segment_length %zd",
2481 		    response->ip_data_len, cs->cs_max_data_segment_length));
2482 		if (response->ip_data_len + len >
2483 		    cs->cs_max_data_segment_length) {
2484 			len = cs->cs_max_data_segment_length -
2485 			    response->ip_data_len;
2486 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2487 			    len, sg_len));
2488 		}
2489 
2490 		/*
2491 		 * Truncate to expected data transfer length.
2492 		 */
2493 		KASSERT(buffer_offset + response->ip_data_len < expected_len,
2494 		    ("buffer_offset %zd + ip_data_len %zd >= expected_len %zd",
2495 		    buffer_offset, response->ip_data_len, expected_len));
2496 		if (buffer_offset + response->ip_data_len + len > expected_len) {
2497 			CFISCSI_SESSION_DEBUG(cs, "truncating from %zd "
2498 			    "to expected data transfer length %zd",
2499 			    buffer_offset + response->ip_data_len + len, expected_len);
2500 			len = expected_len - (buffer_offset + response->ip_data_len);
2501 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
2502 			    len, sg_len));
2503 		}
2504 
2505 		error = icl_pdu_append_data(response, sg_addr, len, M_NOWAIT);
2506 		if (error != 0) {
2507 			CFISCSI_SESSION_WARN(cs, "failed to "
2508 			    "allocate memory; dropping connection");
2509 			icl_pdu_free(response);
2510 			ctl_set_busy(&io->scsiio);
2511 			io->scsiio.be_move_done(io);
2512 			cfiscsi_session_terminate(cs);
2513 			return;
2514 		}
2515 		sg_addr += len;
2516 		sg_len -= len;
2517 
2518 		KASSERT(buffer_offset + response->ip_data_len <= expected_len,
2519 		    ("buffer_offset %zd + ip_data_len %zd > expected_len %zd",
2520 		    buffer_offset, response->ip_data_len, expected_len));
2521 		if (buffer_offset + response->ip_data_len == expected_len) {
2522 			/*
2523 			 * Already have the amount of data the initiator wanted.
2524 			 */
2525 			break;
2526 		}
2527 
2528 		if (sg_len == 0) {
2529 			/*
2530 			 * End of scatter-gather segment;
2531 			 * proceed to the next one...
2532 			 */
2533 			if (i == ctl_sg_count - 1) {
2534 				/*
2535 				 * ... unless this was the last one.
2536 				 */
2537 				break;
2538 			}
2539 			i++;
2540 		}
2541 
2542 		if (response->ip_data_len == cs->cs_max_data_segment_length) {
2543 			/*
2544 			 * Can't stuff more data into the current PDU;
2545 			 * queue it.  Note that's not enough to check
2546 			 * for kern_data_resid == 0 instead; there
2547 			 * may be several Data-In PDUs for the final
2548 			 * call to cfiscsi_datamove(), and we want
2549 			 * to set the F flag only on the last of them.
2550 			 */
2551 			buffer_offset += response->ip_data_len;
2552 			if (buffer_offset == io->scsiio.kern_total_len ||
2553 			    buffer_offset == expected_len)
2554 				bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2555 			cfiscsi_pdu_queue(response);
2556 			response = NULL;
2557 			bhsdi = NULL;
2558 		}
2559 	}
2560 	if (response != NULL) {
2561 		buffer_offset += response->ip_data_len;
2562 		if (buffer_offset == io->scsiio.kern_total_len ||
2563 		    buffer_offset == expected_len)
2564 			bhsdi->bhsdi_flags |= BHSDI_FLAGS_F;
2565 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
2566 		cfiscsi_pdu_queue(response);
2567 	}
2568 
2569 	io->scsiio.be_move_done(io);
2570 }
2571 
2572 static void
2573 cfiscsi_datamove_out(union ctl_io *io)
2574 {
2575 	struct cfiscsi_session *cs;
2576 	struct icl_pdu *request, *response;
2577 	const struct iscsi_bhs_scsi_command *bhssc;
2578 	struct iscsi_bhs_r2t *bhsr2t;
2579 	struct cfiscsi_data_wait *cdw;
2580 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
2581 	uint32_t expected_len, r2t_off, r2t_len;
2582 	uint32_t target_transfer_tag;
2583 	bool done;
2584 
2585 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2586 	cs = PDU_SESSION(request);
2587 
2588 	bhssc = (const struct iscsi_bhs_scsi_command *)request->ip_bhs;
2589 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2590 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2591 	    ("bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_COMMAND"));
2592 
2593 	/*
2594 	 * We need to record it so that we can properly report
2595 	 * underflow/underflow.
2596 	 */
2597 	PDU_TOTAL_TRANSFER_LEN(request) = io->scsiio.kern_total_len;
2598 
2599 	/*
2600 	 * Report write underflow as error since CTL and backends don't
2601 	 * really support it, and SCSI does not tell how to do it right.
2602 	 */
2603 	expected_len = ntohl(bhssc->bhssc_expected_data_transfer_length);
2604 	if (io->scsiio.kern_rel_offset + io->scsiio.kern_data_len >
2605 	    expected_len) {
2606 		io->scsiio.io_hdr.port_status = 43;
2607 		io->scsiio.be_move_done(io);
2608 		return;
2609 	}
2610 
2611 	target_transfer_tag =
2612 	    atomic_fetchadd_32(&cs->cs_target_transfer_tag, 1);
2613 
2614 #if 0
2615 	CFISCSI_SESSION_DEBUG(cs, "expecting Data-Out with initiator "
2616 	    "task tag 0x%x, target transfer tag 0x%x",
2617 	    bhssc->bhssc_initiator_task_tag, target_transfer_tag);
2618 #endif
2619 	cdw = uma_zalloc(cfiscsi_data_wait_zone, M_NOWAIT | M_ZERO);
2620 	if (cdw == NULL) {
2621 		CFISCSI_SESSION_WARN(cs, "failed to "
2622 		    "allocate memory; dropping connection");
2623 		ctl_set_busy(&io->scsiio);
2624 		io->scsiio.be_move_done(io);
2625 		cfiscsi_session_terminate(cs);
2626 		return;
2627 	}
2628 	cdw->cdw_ctl_io = io;
2629 	cdw->cdw_target_transfer_tag = target_transfer_tag;
2630 	cdw->cdw_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2631 	cdw->cdw_r2t_end = io->scsiio.kern_data_len;
2632 
2633 	/* Set initial data pointer for the CDW respecting ext_data_filled. */
2634 	if (io->scsiio.kern_sg_entries > 0) {
2635 		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
2636 	} else {
2637 		ctl_sglist = &ctl_sg_entry;
2638 		ctl_sglist->addr = io->scsiio.kern_data_ptr;
2639 		ctl_sglist->len = io->scsiio.kern_data_len;
2640 	}
2641 	cdw->cdw_sg_index = 0;
2642 	cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2643 	cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2644 	r2t_off = io->scsiio.ext_data_filled;
2645 	while (r2t_off > 0) {
2646 		if (r2t_off >= cdw->cdw_sg_len) {
2647 			r2t_off -= cdw->cdw_sg_len;
2648 			cdw->cdw_sg_index++;
2649 			cdw->cdw_sg_addr = ctl_sglist[cdw->cdw_sg_index].addr;
2650 			cdw->cdw_sg_len = ctl_sglist[cdw->cdw_sg_index].len;
2651 			continue;
2652 		}
2653 		cdw->cdw_sg_addr += r2t_off;
2654 		cdw->cdw_sg_len -= r2t_off;
2655 		r2t_off = 0;
2656 	}
2657 
2658 	if (cs->cs_immediate_data &&
2659 	    io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled <
2660 	    icl_pdu_data_segment_length(request)) {
2661 		done = cfiscsi_handle_data_segment(request, cdw);
2662 		if (done) {
2663 			uma_zfree(cfiscsi_data_wait_zone, cdw);
2664 			io->scsiio.be_move_done(io);
2665 			return;
2666 		}
2667 	}
2668 
2669 	r2t_off = io->scsiio.kern_rel_offset + io->scsiio.ext_data_filled;
2670 	r2t_len = MIN(io->scsiio.kern_data_len - io->scsiio.ext_data_filled,
2671 	    cs->cs_max_burst_length);
2672 	cdw->cdw_r2t_end = io->scsiio.ext_data_filled + r2t_len;
2673 
2674 	CFISCSI_SESSION_LOCK(cs);
2675 	TAILQ_INSERT_TAIL(&cs->cs_waiting_for_data_out, cdw, cdw_next);
2676 	CFISCSI_SESSION_UNLOCK(cs);
2677 
2678 	/*
2679 	 * XXX: We should limit the number of outstanding R2T PDUs
2680 	 * 	per task to MaxOutstandingR2T.
2681 	 */
2682 	response = cfiscsi_pdu_new_response(request, M_NOWAIT);
2683 	if (response == NULL) {
2684 		CFISCSI_SESSION_WARN(cs, "failed to "
2685 		    "allocate memory; dropping connection");
2686 		ctl_set_busy(&io->scsiio);
2687 		io->scsiio.be_move_done(io);
2688 		cfiscsi_session_terminate(cs);
2689 		return;
2690 	}
2691 	bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
2692 	bhsr2t->bhsr2t_opcode = ISCSI_BHS_OPCODE_R2T;
2693 	bhsr2t->bhsr2t_flags = 0x80;
2694 	bhsr2t->bhsr2t_lun = bhssc->bhssc_lun;
2695 	bhsr2t->bhsr2t_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2696 	bhsr2t->bhsr2t_target_transfer_tag = target_transfer_tag;
2697 	/*
2698 	 * XXX: Here we assume that cfiscsi_datamove() won't ever
2699 	 *	be running concurrently on several CPUs for a given
2700 	 *	command.
2701 	 */
2702 	bhsr2t->bhsr2t_r2tsn = htonl(PDU_R2TSN(request));
2703 	PDU_R2TSN(request)++;
2704 	/*
2705 	 * This is the offset within the current SCSI command;
2706 	 * i.e. for the first call of datamove(), it will be 0,
2707 	 * and for subsequent ones it will be the sum of lengths
2708 	 * of previous ones.
2709 	 *
2710 	 * The ext_data_filled is to account for unsolicited
2711 	 * (immediate) data that might have already arrived.
2712 	 */
2713 	bhsr2t->bhsr2t_buffer_offset = htonl(r2t_off);
2714 	/*
2715 	 * This is the total length (sum of S/G lengths) this call
2716 	 * to cfiscsi_datamove() is supposed to handle, limited by
2717 	 * MaxBurstLength.
2718 	 */
2719 	bhsr2t->bhsr2t_desired_data_transfer_length = htonl(r2t_len);
2720 	cfiscsi_pdu_queue(response);
2721 }
2722 
2723 static void
2724 cfiscsi_datamove(union ctl_io *io)
2725 {
2726 
2727 	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
2728 		cfiscsi_datamove_in(io);
2729 	else {
2730 		/* We hadn't received anything during this datamove yet. */
2731 		io->scsiio.ext_data_filled = 0;
2732 		cfiscsi_datamove_out(io);
2733 	}
2734 }
2735 
2736 static void
2737 cfiscsi_scsi_command_done(union ctl_io *io)
2738 {
2739 	struct icl_pdu *request, *response;
2740 	struct iscsi_bhs_scsi_command *bhssc;
2741 	struct iscsi_bhs_scsi_response *bhssr;
2742 #ifdef DIAGNOSTIC
2743 	struct cfiscsi_data_wait *cdw;
2744 #endif
2745 	struct cfiscsi_session *cs;
2746 	uint16_t sense_length;
2747 
2748 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2749 	cs = PDU_SESSION(request);
2750 	bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2751 	KASSERT((bhssc->bhssc_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2752 	    ISCSI_BHS_OPCODE_SCSI_COMMAND,
2753 	    ("replying to wrong opcode 0x%x", bhssc->bhssc_opcode));
2754 
2755 	//CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x",
2756 	//    bhssc->bhssc_initiator_task_tag);
2757 
2758 #ifdef DIAGNOSTIC
2759 	CFISCSI_SESSION_LOCK(cs);
2760 	TAILQ_FOREACH(cdw, &cs->cs_waiting_for_data_out, cdw_next)
2761 		KASSERT(bhssc->bhssc_initiator_task_tag !=
2762 		    cdw->cdw_initiator_task_tag, ("dangling cdw"));
2763 	CFISCSI_SESSION_UNLOCK(cs);
2764 #endif
2765 
2766 	/*
2767 	 * Do not return status for aborted commands.
2768 	 * There are exceptions, but none supported by CTL yet.
2769 	 */
2770 	if ((io->io_hdr.flags & CTL_FLAG_ABORT) &&
2771 	    (io->io_hdr.flags & CTL_FLAG_ABORT_STATUS) == 0) {
2772 		ctl_free_io(io);
2773 		icl_pdu_free(request);
2774 		return;
2775 	}
2776 
2777 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2778 	bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
2779 	bhssr->bhssr_opcode = ISCSI_BHS_OPCODE_SCSI_RESPONSE;
2780 	bhssr->bhssr_flags = 0x80;
2781 	/*
2782 	 * XXX: We don't deal with bidirectional under/overflows;
2783 	 *	does anything actually support those?
2784 	 */
2785 	if (PDU_TOTAL_TRANSFER_LEN(request) <
2786 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2787 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_UNDERFLOW;
2788 		bhssr->bhssr_residual_count =
2789 		    htonl(ntohl(bhssc->bhssc_expected_data_transfer_length) -
2790 		    PDU_TOTAL_TRANSFER_LEN(request));
2791 		//CFISCSI_SESSION_DEBUG(cs, "underflow; residual count %d",
2792 		//    ntohl(bhssr->bhssr_residual_count));
2793 	} else if (PDU_TOTAL_TRANSFER_LEN(request) >
2794 	    ntohl(bhssc->bhssc_expected_data_transfer_length)) {
2795 		bhssr->bhssr_flags |= BHSSR_FLAGS_RESIDUAL_OVERFLOW;
2796 		bhssr->bhssr_residual_count =
2797 		    htonl(PDU_TOTAL_TRANSFER_LEN(request) -
2798 		    ntohl(bhssc->bhssc_expected_data_transfer_length));
2799 		//CFISCSI_SESSION_DEBUG(cs, "overflow; residual count %d",
2800 		//    ntohl(bhssr->bhssr_residual_count));
2801 	}
2802 	bhssr->bhssr_response = BHSSR_RESPONSE_COMMAND_COMPLETED;
2803 	bhssr->bhssr_status = io->scsiio.scsi_status;
2804 	bhssr->bhssr_initiator_task_tag = bhssc->bhssc_initiator_task_tag;
2805 	bhssr->bhssr_expdatasn = htonl(PDU_EXPDATASN(request));
2806 
2807 	if (io->scsiio.sense_len > 0) {
2808 #if 0
2809 		CFISCSI_SESSION_DEBUG(cs, "returning %d bytes of sense data",
2810 		    io->scsiio.sense_len);
2811 #endif
2812 		sense_length = htons(io->scsiio.sense_len);
2813 		icl_pdu_append_data(response,
2814 		    &sense_length, sizeof(sense_length), M_WAITOK);
2815 		icl_pdu_append_data(response,
2816 		    &io->scsiio.sense_data, io->scsiio.sense_len, M_WAITOK);
2817 	}
2818 
2819 	ctl_free_io(io);
2820 	icl_pdu_free(request);
2821 	cfiscsi_pdu_queue(response);
2822 }
2823 
2824 static void
2825 cfiscsi_task_management_done(union ctl_io *io)
2826 {
2827 	struct icl_pdu *request, *response;
2828 	struct iscsi_bhs_task_management_request *bhstmr;
2829 	struct iscsi_bhs_task_management_response *bhstmr2;
2830 	struct cfiscsi_data_wait *cdw, *tmpcdw;
2831 	struct cfiscsi_session *cs;
2832 
2833 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2834 	cs = PDU_SESSION(request);
2835 	bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2836 	KASSERT((bhstmr->bhstmr_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) ==
2837 	    ISCSI_BHS_OPCODE_TASK_REQUEST,
2838 	    ("replying to wrong opcode 0x%x", bhstmr->bhstmr_opcode));
2839 
2840 #if 0
2841 	CFISCSI_SESSION_DEBUG(cs, "initiator task tag 0x%x; referenced task tag 0x%x",
2842 	    bhstmr->bhstmr_initiator_task_tag,
2843 	    bhstmr->bhstmr_referenced_task_tag);
2844 #endif
2845 
2846 	if ((bhstmr->bhstmr_function & ~0x80) ==
2847 	    BHSTMR_FUNCTION_ABORT_TASK) {
2848 		/*
2849 		 * Make sure we no longer wait for Data-Out for this command.
2850 		 */
2851 		CFISCSI_SESSION_LOCK(cs);
2852 		TAILQ_FOREACH_SAFE(cdw,
2853 		    &cs->cs_waiting_for_data_out, cdw_next, tmpcdw) {
2854 			if (bhstmr->bhstmr_referenced_task_tag !=
2855 			    cdw->cdw_initiator_task_tag)
2856 				continue;
2857 
2858 #if 0
2859 			CFISCSI_SESSION_DEBUG(cs, "removing csw for initiator task "
2860 			    "tag 0x%x", bhstmr->bhstmr_initiator_task_tag);
2861 #endif
2862 			TAILQ_REMOVE(&cs->cs_waiting_for_data_out,
2863 			    cdw, cdw_next);
2864 			cdw->cdw_ctl_io->scsiio.be_move_done(cdw->cdw_ctl_io);
2865 			uma_zfree(cfiscsi_data_wait_zone, cdw);
2866 		}
2867 		CFISCSI_SESSION_UNLOCK(cs);
2868 	}
2869 
2870 	response = cfiscsi_pdu_new_response(request, M_WAITOK);
2871 	bhstmr2 = (struct iscsi_bhs_task_management_response *)
2872 	    response->ip_bhs;
2873 	bhstmr2->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_RESPONSE;
2874 	bhstmr2->bhstmr_flags = 0x80;
2875 	if (io->io_hdr.status == CTL_SUCCESS) {
2876 		bhstmr2->bhstmr_response = BHSTMR_RESPONSE_FUNCTION_COMPLETE;
2877 	} else {
2878 		/*
2879 		 * XXX: How to figure out what exactly went wrong?  iSCSI spec
2880 		 * 	expects us to provide detailed error, e.g. "Task does
2881 		 * 	not exist" or "LUN does not exist".
2882 		 */
2883 		CFISCSI_SESSION_DEBUG(cs, "BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED");
2884 		bhstmr2->bhstmr_response =
2885 		    BHSTMR_RESPONSE_FUNCTION_NOT_SUPPORTED;
2886 	}
2887 	bhstmr2->bhstmr_initiator_task_tag = bhstmr->bhstmr_initiator_task_tag;
2888 
2889 	ctl_free_io(io);
2890 	icl_pdu_free(request);
2891 	cfiscsi_pdu_queue(response);
2892 }
2893 
2894 static void
2895 cfiscsi_done(union ctl_io *io)
2896 {
2897 	struct icl_pdu *request;
2898 	struct cfiscsi_session *cs;
2899 
2900 	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
2901 		("invalid CTL status %#x", io->io_hdr.status));
2902 
2903 	if (io->io_hdr.io_type == CTL_IO_TASK &&
2904 	    io->taskio.task_action == CTL_TASK_I_T_NEXUS_RESET) {
2905 		/*
2906 		 * Implicit task termination has just completed; nothing to do.
2907 		 */
2908 		cs = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2909 		cs->cs_tasks_aborted = true;
2910 		refcount_release(&cs->cs_outstanding_ctl_pdus);
2911 		wakeup(__DEVOLATILE(void *, &cs->cs_outstanding_ctl_pdus));
2912 		ctl_free_io(io);
2913 		return;
2914 	}
2915 
2916 	request = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
2917 	cs = PDU_SESSION(request);
2918 	refcount_release(&cs->cs_outstanding_ctl_pdus);
2919 
2920 	switch (request->ip_bhs->bhs_opcode & ~ISCSI_BHS_OPCODE_IMMEDIATE) {
2921 	case ISCSI_BHS_OPCODE_SCSI_COMMAND:
2922 		cfiscsi_scsi_command_done(io);
2923 		break;
2924 	case ISCSI_BHS_OPCODE_TASK_REQUEST:
2925 		cfiscsi_task_management_done(io);
2926 		break;
2927 	default:
2928 		panic("cfiscsi_done called with wrong opcode 0x%x",
2929 		    request->ip_bhs->bhs_opcode);
2930 	}
2931 }
2932