xref: /netbsd-src/sys/dev/iscsi/iscsi_ioctl.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /*	$NetBSD: iscsi_ioctl.c,v 1.29 2017/12/06 04:29:58 ozaki-r Exp $	*/
2 
3 /*-
4  * Copyright (c) 2004,2005,2006,2011 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Wasabi Systems, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 #include "iscsi_globals.h"
33 
34 #include <sys/file.h>
35 #include <sys/filedesc.h>
36 #include <sys/proc.h>
37 
38 #ifndef ISCSI_MINIMAL
39 #include <uvm/uvm.h>
40 #include <uvm/uvm_pmap.h>
41 #endif
42 
43 static kmutex_t iscsi_cleanup_mtx;
44 static kcondvar_t iscsi_cleanup_cv;
45 static kcondvar_t iscsi_event_cv;
46 static struct lwp *iscsi_cleanproc = NULL;
47 
48 static uint16_t current_id = 0;	/* Global session ID counter */
49 
50 /* list of event handlers */
51 static event_handler_list_t event_handlers =
52 	TAILQ_HEAD_INITIALIZER(event_handlers);
53 
54 static connection_list_t iscsi_timeout_conn_list =
55 	TAILQ_HEAD_INITIALIZER(iscsi_timeout_conn_list);
56 
57 static ccb_list_t iscsi_timeout_ccb_list =
58 	TAILQ_HEAD_INITIALIZER(iscsi_timeout_ccb_list);
59 
60 static session_list_t iscsi_cleanups_list =
61 	TAILQ_HEAD_INITIALIZER(iscsi_cleanups_list);
62 
63 static connection_list_t iscsi_cleanupc_list =
64 	TAILQ_HEAD_INITIALIZER(iscsi_cleanupc_list);
65 
66 static uint32_t handler_id = 0;	/* Handler ID counter */
67 
68 /* -------------------------------------------------------------------------- */
69 
70 /* Event management functions */
71 
72 /*
73  * find_handler:
74  *    Search the event handler list for the given ID.
75  *
76  *    Parameter:
77  *          id    The handler ID.
78  *
79  *    Returns:
80  *          Pointer to handler if found, else NULL.
81  */
82 
83 
84 static event_handler_t *
85 find_handler(uint32_t id)
86 {
87 	event_handler_t *curr;
88 
89 	KASSERT(mutex_owned(&iscsi_cleanup_mtx));
90 
91 	TAILQ_FOREACH(curr, &event_handlers, evh_link)
92 		if (curr->evh_id == id)
93 			break;
94 
95 	return curr;
96 }
97 
98 
99 /*
100  * register_event:
101  *    Create event handler entry, return ID.
102  *
103  *    Parameter:
104  *          par   The parameter.
105  */
106 
107 static void
108 register_event(iscsi_register_event_parameters_t *par)
109 {
110 	event_handler_t *handler;
111 	int was_empty;
112 
113 	handler = malloc(sizeof(event_handler_t), M_DEVBUF, M_WAITOK | M_ZERO);
114 	if (handler == NULL) {
115 		DEBOUT(("No mem for event handler\n"));
116 		par->status = ISCSI_STATUS_NO_RESOURCES;
117 		return;
118 	}
119 
120 	TAILQ_INIT(&handler->evh_events);
121 
122 	mutex_enter(&iscsi_cleanup_mtx);
123 	/* create a unique ID */
124 	do {
125 		++handler_id;
126 	} while (!handler_id || find_handler(handler_id) != NULL);
127 	par->event_id = handler->evh_id = handler_id;
128 
129 	was_empty = TAILQ_FIRST(&event_handlers) == NULL;
130 	TAILQ_INSERT_TAIL(&event_handlers, handler, evh_link);
131 	if (was_empty)
132 		iscsi_notify_cleanup();
133 	mutex_exit(&iscsi_cleanup_mtx);
134 
135 	par->status = ISCSI_STATUS_SUCCESS;
136 	DEB(5, ("Register Event OK, ID %d\n", par->event_id));
137 }
138 
139 
140 /*
141  * deregister_event:
142  *    Destroy handler entry and any waiting events, wake up waiter.
143  *
144  *    Parameter:
145  *          par   The parameter.
146  */
147 
148 static void
149 deregister_event(iscsi_register_event_parameters_t *par)
150 {
151 	event_handler_t *handler;
152 	event_t *evt;
153 
154 	mutex_enter(&iscsi_cleanup_mtx);
155 	handler = find_handler(par->event_id);
156 	if (handler == NULL) {
157 		mutex_exit(&iscsi_cleanup_mtx);
158 		DEB(1, ("Deregister Event ID %d not found\n", par->event_id));
159 		par->status = ISCSI_STATUS_INVALID_EVENT_ID;
160 		return;
161 	}
162 
163 	TAILQ_REMOVE(&event_handlers, handler, evh_link);
164 	if (handler->evh_waiter != NULL) {
165 		handler->evh_waiter->status = ISCSI_STATUS_EVENT_DEREGISTERED;
166 		cv_broadcast(&iscsi_event_cv);
167 	}
168 
169 	while ((evt = TAILQ_FIRST(&handler->evh_events)) != NULL) {
170 		TAILQ_REMOVE(&handler->evh_events, evt, ev_link);
171 		free(evt, M_TEMP);
172 	}
173 	mutex_exit(&iscsi_cleanup_mtx);
174 
175 	free(handler, M_DEVBUF);
176 	par->status = ISCSI_STATUS_SUCCESS;
177 	DEB(5, ("Deregister Event ID %d complete\n", par->event_id));
178 }
179 
180 
181 /*
182  * check_event:
183  *    Return first queued event. Optionally wait for arrival of event.
184  *
185  *    Parameter:
186  *          par   The parameter.
187  *          wait  Wait for event if true
188  */
189 
190 static void
191 check_event(iscsi_wait_event_parameters_t *par, bool wait)
192 {
193 	event_handler_t *handler;
194 	event_t *evt;
195 	int rc;
196 
197 	mutex_enter(&iscsi_cleanup_mtx);
198 	handler = find_handler(par->event_id);
199 	if (handler == NULL) {
200 		mutex_exit(&iscsi_cleanup_mtx);
201 		DEBOUT(("Wait Event ID %d not found\n", par->event_id));
202 		par->status = ISCSI_STATUS_INVALID_EVENT_ID;
203 		return;
204 	}
205 	if (handler->evh_waiter != NULL) {
206 		mutex_exit(&iscsi_cleanup_mtx);
207 		DEBOUT(("Wait Event ID %d already waiting\n", par->event_id));
208 		par->status = ISCSI_STATUS_EVENT_WAITING;
209 		return;
210 	}
211 	par->status = ISCSI_STATUS_SUCCESS;
212 	DEB(99, ("Wait Event ID %d\n", par->event_id));
213 
214 	do {
215 		evt = TAILQ_FIRST(&handler->evh_events);
216 		if (evt != NULL) {
217 			TAILQ_REMOVE(&handler->evh_events, evt, ev_link);
218 		} else {
219 			if (!wait) {
220 				par->status = ISCSI_STATUS_LIST_EMPTY;
221 				return;
222 			}
223 			if (par->status != ISCSI_STATUS_SUCCESS) {
224 				return;
225 			}
226 			handler->evh_waiter = par;
227 			rc = cv_wait_sig(&iscsi_event_cv, &iscsi_cleanup_mtx);
228 			if (rc) {
229 				mutex_exit(&iscsi_cleanup_mtx);
230 				par->status = ISCSI_STATUS_LIST_EMPTY;
231 				return;
232 			}
233 		}
234 	} while (evt == NULL);
235 	mutex_exit(&iscsi_cleanup_mtx);
236 
237 	par->connection_id = evt->ev_connection_id;
238 	par->session_id = evt->ev_session_id;
239 	par->event_kind = evt->ev_event_kind;
240 	par->reason = evt->ev_reason;
241 
242 	free(evt, M_TEMP);
243 }
244 
245 /*
246  * add_event
247  *    Adds an event entry to each registered handler queue.
248  *    Note that events are simply duplicated because we expect the number of
249  *    handlers to be very small, usually 1 (the daemon).
250  *
251  *    Parameters:
252  *       kind     The event kind
253  *       sid      The ID of the affected session
254  *       cid      The ID of the affected connection
255  *       reason   The reason code
256  */
257 
258 void
259 add_event(iscsi_event_t kind, uint32_t sid, uint32_t cid, uint32_t reason)
260 {
261 	event_handler_t *curr;
262 	event_t *evt;
263 
264 	DEB(9, ("Add_event kind %d, sid %d, cid %d, reason %d\n",
265 		kind, sid, cid, reason));
266 
267 	mutex_enter(&iscsi_cleanup_mtx);
268 	TAILQ_FOREACH(curr, &event_handlers, evh_link) {
269 		evt = malloc(sizeof(*evt), M_TEMP, M_NOWAIT);
270 		if (evt == NULL) {
271 			DEBOUT(("Cannot allocate event\n"));
272 			break;
273 		}
274 		evt->ev_event_kind = kind;
275 		evt->ev_session_id = sid;
276 		evt->ev_connection_id = cid;
277 		evt->ev_reason = reason;
278 
279 		TAILQ_INSERT_TAIL(&curr->evh_events, evt, ev_link);
280 		if (curr->evh_waiter != NULL) {
281 			curr->evh_waiter = NULL;
282 			cv_broadcast(&iscsi_event_cv);
283 		}
284 	}
285 	mutex_exit(&iscsi_cleanup_mtx);
286 }
287 
288 
289 /*
290  * check_event_handlers
291  *    Checks for dead event handlers. A dead event handler would deplete
292  *    memory over time, so we have to make sure someone at the other
293  *    end is actively monitoring events.
294  *    This function is called every 30 seconds or so (less frequent if there
295  *    is other activity for the cleanup thread to deal with) to go through
296  *    the list of handlers and check whether the first element in the event
297  *    list has changed at all. If not, the event is deregistered.
298  *    Note that this will not detect dead handlers if no events are pending,
299  *    but we don't care as long as events don't accumulate in the list.
300  *
301  */
302 
303 static void
304 check_event_handlers(void)
305 {
306 	event_handler_t *curr, *next;
307 	event_t *evt;
308 
309 	KASSERT(mutex_owned(&iscsi_cleanup_mtx));
310 
311 	for (curr = TAILQ_FIRST(&event_handlers); curr != NULL; curr = next) {
312 		next = TAILQ_NEXT(curr, evh_link);
313 		evt = TAILQ_FIRST(&curr->evh_events);
314 
315 		if (evt != NULL && evt == curr->evh_first_in_list) {
316 			DEBOUT(("Found Dead Event Handler %d, removing\n", curr->evh_id));
317 
318 			TAILQ_REMOVE(&event_handlers, curr, evh_link);
319 			while ((evt = TAILQ_FIRST(&curr->evh_events)) != NULL) {
320 				TAILQ_REMOVE(&curr->evh_events, evt, ev_link);
321 				free(evt, M_TEMP);
322 			}
323 			free(curr, M_DEVBUF);
324 		} else
325 			curr->evh_first_in_list = evt;
326 	}
327 }
328 
329 
330 /* -------------------------------------------------------------------------- */
331 
332 /*
333  * get_socket:
334  *    Get the file pointer from the socket handle passed into login.
335  *
336  *    Parameter:
337  *          fdes     IN: The socket handle
338  *          fpp      OUT: The pointer to the resulting file pointer
339  *
340  *    Returns:    0 on success, else an error code.
341  *
342  */
343 
344 static int
345 get_socket(int fdes, struct file **fpp)
346 {
347 	struct file *fp;
348 
349 	if ((fp = fd_getfile(fdes)) == NULL) {
350 		return EBADF;
351 	}
352 	if (fp->f_type != DTYPE_SOCKET) {
353 		return ENOTSOCK;
354 	}
355 
356 	/* Add the reference */
357 	mutex_enter(&fp->f_lock);
358 	fp->f_count++;
359 	mutex_exit(&fp->f_lock);
360 
361 	*fpp = fp;
362 	return 0;
363 }
364 
365 /*
366  * release_socket:
367  *    Release the file pointer from the socket handle passed into login.
368  *
369  *    Parameter:
370  *          fp       IN: The pointer to the resulting file pointer
371  *
372  */
373 
374 static void
375 release_socket(struct file *fp)
376 {
377 	/* Add the reference */
378 	mutex_enter(&fp->f_lock);
379 	fp->f_count--;
380 	mutex_exit(&fp->f_lock);
381 }
382 
383 
384 /*
385  * find_session:
386  *    Find a session by ID.
387  *
388  *    Parameter:  the session ID
389  *
390  *    Returns:    The pointer to the session (or NULL if not found)
391  */
392 
393 session_t *
394 find_session(uint32_t id)
395 {
396 	session_t *sess;
397 
398 	KASSERT(mutex_owned(&iscsi_cleanup_mtx));
399 
400 	TAILQ_FOREACH(sess, &iscsi_sessions, s_sessions)
401 		if (sess->s_id == id) {
402 			break;
403 		}
404 	return sess;
405 }
406 
407 
408 /*
409  * find_connection:
410  *    Find a connection by ID.
411  *
412  *    Parameter:  the session pointer and the connection ID
413  *
414  *    Returns:    The pointer to the connection (or NULL if not found)
415  */
416 
417 connection_t *
418 find_connection(session_t *sess, uint32_t id)
419 {
420 	connection_t *conn;
421 
422 	KASSERT(mutex_owned(&iscsi_cleanup_mtx));
423 
424 	TAILQ_FOREACH(conn, &sess->s_conn_list, c_connections)
425 		if (conn->c_id == id) {
426 			break;
427 		}
428 	return conn;
429 }
430 
431 /*
432  * ref_session:
433  *    Reference a session
434  *
435  *    Session cannot be release until reference count reaches zero
436  *
437  *    Returns: 1 if reference counter would overflow
438  */
439 
440 int
441 ref_session(session_t *sess)
442 {
443 	int rc = 1;
444 
445 	mutex_enter(&iscsi_cleanup_mtx);
446 	KASSERT(sess != NULL);
447 	if (sess->s_refcount <= CCBS_PER_SESSION) {
448 		sess->s_refcount++;
449 		rc = 0;
450 	}
451 	mutex_exit(&iscsi_cleanup_mtx);
452 
453 	return rc;
454 }
455 
456 /*
457  * unref_session:
458  *    Unreference a session
459  *
460  *    Release session reference, trigger cleanup
461  */
462 
463 void
464 unref_session(session_t *session)
465 {
466 
467 	mutex_enter(&iscsi_cleanup_mtx);
468 	KASSERT(session != NULL);
469 	KASSERT(session->s_refcount > 0);
470 	if (--session->s_refcount == 0)
471 		cv_broadcast(&session->s_sess_cv);
472 	mutex_exit(&iscsi_cleanup_mtx);
473 }
474 
475 
476 /*
477  * kill_connection:
478  *    Terminate the connection as gracefully as possible.
479  *
480  *    Parameter:
481  *		conn		The connection to terminate
482  *		status		The status code for the connection's "terminating" field
483  *		logout		The logout reason code
484  *		recover	Attempt to recover connection
485  */
486 
487 void
488 kill_connection(connection_t *conn, uint32_t status, int logout, bool recover)
489 {
490 	session_t *sess = conn->c_session;
491 	int terminating;
492 
493 	DEBC(conn, 1, ("Kill_connection: terminating=%d, status=%d, logout=%d, "
494 			   "state=%d\n",
495 			   conn->c_terminating, status, logout, conn->c_state));
496 
497 	mutex_enter(&iscsi_cleanup_mtx);
498 	if (recover &&
499 	    !conn->c_destroy &&
500 	    conn->c_recover > MAX_RECOVERY_ATTEMPTS) {
501 		DEBC(conn, 1,
502 			  ("Kill_connection: Too many recovery attempts, destroying\n"));
503 		conn->c_destroy = TRUE;
504 	}
505 
506 	if (!recover || conn->c_destroy) {
507 
508 		if (conn->c_in_session) {
509 			conn->c_in_session = FALSE;
510 			TAILQ_REMOVE(&sess->s_conn_list, conn, c_connections);
511 			sess->s_mru_connection = TAILQ_FIRST(&sess->s_conn_list);
512 		}
513 
514 		if (!conn->c_destroy) {
515 			DEBC(conn, 1, ("Kill_connection setting destroy flag\n"));
516 			conn->c_destroy = TRUE;
517 		}
518 	}
519 
520 	terminating = conn->c_terminating;
521 	if (!terminating)
522 		conn->c_terminating = status;
523 
524 	/* Don't recurse */
525 	if (terminating) {
526 		mutex_exit(&iscsi_cleanup_mtx);
527 
528 		KASSERT(conn->c_state != ST_FULL_FEATURE);
529 		DEBC(conn, 1, ("Kill_connection exiting (already terminating)\n"));
530 		goto done;
531 	}
532 
533 	if (conn->c_state == ST_FULL_FEATURE) {
534 		sess->s_active_connections--;
535 		conn->c_state = ST_WINDING_DOWN;
536 
537 		/* If this is the last connection and ERL < 2, reset TSIH */
538 		if (!sess->s_active_connections && sess->s_ErrorRecoveryLevel < 2)
539 			sess->s_TSIH = 0;
540 
541 		/* Don't try to log out if the socket is broken or we're in the middle */
542 		/* of logging in */
543 		if (logout >= 0) {
544 			if (sess->s_ErrorRecoveryLevel < 2 &&
545 			    logout == RECOVER_CONNECTION) {
546 				logout = LOGOUT_CONNECTION;
547 			}
548 			if (!sess->s_active_connections &&
549 			    logout == LOGOUT_CONNECTION) {
550 				logout = LOGOUT_SESSION;
551 			}
552 			mutex_exit(&iscsi_cleanup_mtx);
553 
554 			connection_timeout_start(conn, CONNECTION_TIMEOUT);
555 
556 			if (!send_logout(conn, conn, logout, FALSE)) {
557 				conn->c_terminating = ISCSI_STATUS_SUCCESS;
558 				return;
559 			}
560 			/*
561 			 * if the logout request was successfully sent,
562 			 * the logout response handler will do the rest
563 			 * of the termination processing. If the logout
564 			 * doesn't get a response, we'll get back in here
565 			 * once the timeout hits.
566 			 */
567 
568 			mutex_enter(&iscsi_cleanup_mtx);
569 		}
570 
571 	}
572 
573 	conn->c_state = ST_SETTLING;
574 	mutex_exit(&iscsi_cleanup_mtx);
575 
576 done:
577 	/* let send thread take over next step of cleanup */
578 	mutex_enter(&conn->c_lock);
579 	cv_broadcast(&conn->c_conn_cv);
580 	mutex_exit(&conn->c_lock);
581 
582 	DEBC(conn, 5, ("kill_connection returns\n"));
583 }
584 
585 
586 /*
587  * kill_session:
588  *    Terminate the session as gracefully as possible.
589  *
590  *    Parameter:
591  *		session		Session to terminate
592  *		status		The status code for the termination
593  *		logout		The logout reason code
594 
595  */
596 
597 void
598 kill_session(session_t *sess, uint32_t status, int logout, bool recover)
599 {
600 	connection_t *conn;
601 
602 	DEB(1, ("ISCSI: kill_session %d, status %d, logout %d, recover %d\n",
603 			sess->s_id, status, logout, recover));
604 
605 	mutex_enter(&iscsi_cleanup_mtx);
606 	if (sess->s_terminating) {
607 		mutex_exit(&iscsi_cleanup_mtx);
608 
609 		DEB(5, ("Session is being killed with status %d\n",sess->s_terminating));
610 		return;
611 	}
612 
613 	/*
614 	 * don't do anything if session isn't established yet, termination will be
615 	 * handled elsewhere
616 	 */
617 	if (sess->s_sessions.tqe_next == NULL && sess->s_sessions.tqe_prev == NULL) {
618 		mutex_exit(&iscsi_cleanup_mtx);
619 
620 		DEB(5, ("Session is being killed which is not yet established\n"));
621 		return;
622 	}
623 
624 	if (recover) {
625 		mutex_exit(&iscsi_cleanup_mtx);
626 
627 		/*
628 		 * Only recover when there's just one active connection left.
629 		 * Otherwise we get in all sorts of timing problems, and it doesn't
630 		 * make much sense anyway to recover when the other side has
631 		 * requested that we kill a multipathed session.
632 		 */
633 		if (sess->s_active_connections == 1) {
634 			conn = assign_connection(sess, FALSE);
635 			if (conn != NULL)
636 				kill_connection(conn, status, logout, TRUE);
637 		}
638 		return;
639 	}
640 
641 	if (sess->s_refcount > 0) {
642 		mutex_exit(&iscsi_cleanup_mtx);
643 
644 		DEB(5, ("Session is being killed while in use (refcnt = %d)\n",
645 			sess->s_refcount));
646 		return;
647 	}
648 
649 	/* Remove session from global list */
650 	sess->s_terminating = status;
651 	TAILQ_REMOVE(&iscsi_sessions, sess, s_sessions);
652 	sess->s_sessions.tqe_next = NULL;
653 	sess->s_sessions.tqe_prev = NULL;
654 
655 	mutex_exit(&iscsi_cleanup_mtx);
656 
657 	/* kill all connections */
658 	while ((conn = TAILQ_FIRST(&sess->s_conn_list)) != NULL) {
659 		kill_connection(conn, status, logout, FALSE);
660 		logout = NO_LOGOUT;
661 	}
662 }
663 
664 
665 /*
666  * create_connection:
667  *    Create and init the necessary framework for a connection:
668  *       Alloc the connection structure itself
669  *       Copy connection parameters
670  *       Create the send and receive threads
671  *       And finally, log in.
672  *
673  *    Parameter:
674  *          par      IN/OUT: The login parameters
675  *          session  IN: The owning session
676  *          l        IN: The lwp pointer of the caller
677  *
678  *    Returns:    0 on success
679  *                >0 on failure, connection structure deleted
680  *                <0 on failure, connection is still terminating
681  */
682 
683 static int
684 create_connection(iscsi_login_parameters_t *par, session_t *sess,
685 				  struct lwp *l)
686 {
687 	connection_t *conn;
688 	int rc;
689 
690 	DEB(1, ("Create Connection for Session %d\n", sess->s_id));
691 
692 	if (sess->s_MaxConnections &&
693 	    sess->s_active_connections >= sess->s_MaxConnections) {
694 		DEBOUT(("Too many connections (max = %d, curr = %d)\n",
695 				sess->s_MaxConnections, sess->s_active_connections));
696 		par->status = ISCSI_STATUS_MAXED_CONNECTIONS;
697 		return EIO;
698 	}
699 
700 	conn = malloc(sizeof(*conn), M_DEVBUF, M_WAITOK | M_ZERO);
701 	if (conn == NULL) {
702 		DEBOUT(("No mem for connection\n"));
703 		par->status = ISCSI_STATUS_NO_RESOURCES;
704 		return EIO;
705 	}
706 
707 	mutex_enter(&iscsi_cleanup_mtx);
708 	/* create a unique ID */
709 	do {
710 		++sess->s_conn_id;
711 	} while (!sess->s_conn_id ||
712 		 find_connection(sess, sess->s_conn_id) != NULL);
713 	par->connection_id = conn->c_id = sess->s_conn_id;
714 	mutex_exit(&iscsi_cleanup_mtx);
715 	DEB(99, ("Connection ID = %d\n", conn->c_id));
716 
717 	conn->c_session = sess;
718 
719 	TAILQ_INIT(&conn->c_ccbs_waiting);
720 	TAILQ_INIT(&conn->c_pdus_to_send);
721 	TAILQ_INIT(&conn->c_pdu_pool);
722 
723 	mutex_init(&conn->c_lock, MUTEX_DEFAULT, IPL_BIO);
724 	cv_init(&conn->c_conn_cv, "conn");
725 	cv_init(&conn->c_pdu_cv, "pdupool");
726 	cv_init(&conn->c_ccb_cv, "ccbwait");
727 	cv_init(&conn->c_idle_cv, "idle");
728 
729 	callout_init(&conn->c_timeout, CALLOUT_MPSAFE);
730 	callout_setfunc(&conn->c_timeout, connection_timeout_co, conn);
731 	conn->c_idle_timeout_val = CONNECTION_IDLE_TIMEOUT;
732 
733 	init_sernum(&conn->c_StatSN_buf);
734 	create_pdus(conn);
735 
736 	if ((rc = get_socket(par->socket, &conn->c_sock)) != 0) {
737 		DEBOUT(("Invalid socket %d\n", par->socket));
738 
739 		callout_destroy(&conn->c_timeout);
740 		cv_destroy(&conn->c_idle_cv);
741 		cv_destroy(&conn->c_ccb_cv);
742 		cv_destroy(&conn->c_pdu_cv);
743 		cv_destroy(&conn->c_conn_cv);
744 		mutex_destroy(&conn->c_lock);
745 		free(conn, M_DEVBUF);
746 		par->status = ISCSI_STATUS_INVALID_SOCKET;
747 		return rc;
748 	}
749 	DEBC(conn, 1, ("get_socket: par_sock=%d, fdesc=%p\n",
750 			par->socket, conn->c_sock));
751 
752 	/* close the file descriptor */
753 	fd_close(par->socket);
754 
755 	conn->c_threadobj = l;
756 	conn->c_login_par = par;
757 
758 	DEB(5, ("Creating receive thread\n"));
759 	if ((rc = kthread_create(PRI_BIO, KTHREAD_MPSAFE, NULL, iscsi_rcv_thread,
760 				conn, &conn->c_rcvproc,
761 				"ConnRcv")) != 0) {
762 		DEBOUT(("Can't create rcv thread (rc %d)\n", rc));
763 
764 		release_socket(conn->c_sock);
765 		callout_destroy(&conn->c_timeout);
766 		cv_destroy(&conn->c_idle_cv);
767 		cv_destroy(&conn->c_ccb_cv);
768 		cv_destroy(&conn->c_pdu_cv);
769 		cv_destroy(&conn->c_conn_cv);
770 		mutex_destroy(&conn->c_lock);
771 		free(conn, M_DEVBUF);
772 		par->status = ISCSI_STATUS_NO_RESOURCES;
773 		return rc;
774 	}
775 	DEB(5, ("Creating send thread\n"));
776 	if ((rc = kthread_create(PRI_BIO, KTHREAD_MPSAFE, NULL, iscsi_send_thread,
777 				conn, &conn->c_sendproc,
778 				"ConnSend")) != 0) {
779 		DEBOUT(("Can't create send thread (rc %d)\n", rc));
780 
781 		conn->c_terminating = ISCSI_STATUS_NO_RESOURCES;
782 
783 		/*
784 		 * We must close the socket here to force the receive
785 		 * thread to wake up
786 		 */
787 		DEBC(conn, 1, ("Closing Socket %p\n", conn->c_sock));
788 		mutex_enter(&conn->c_sock->f_lock);
789 		conn->c_sock->f_count += 1;
790 		mutex_exit(&conn->c_sock->f_lock);
791 		closef(conn->c_sock);
792 
793 		/* give receive thread time to exit */
794 		kpause("settle", false, 2 * hz, NULL);
795 
796 		release_socket(conn->c_sock);
797 		callout_destroy(&conn->c_timeout);
798 		cv_destroy(&conn->c_idle_cv);
799 		cv_destroy(&conn->c_ccb_cv);
800 		cv_destroy(&conn->c_pdu_cv);
801 		cv_destroy(&conn->c_conn_cv);
802 		mutex_destroy(&conn->c_lock);
803 		free(conn, M_DEVBUF);
804 		par->status = ISCSI_STATUS_NO_RESOURCES;
805 		return rc;
806 	}
807 
808 	/*
809 	 * At this point, each thread will tie 'sock' into its own file descriptor
810 	 * tables w/o increasing the use count - they will inherit the use
811 	 * increments performed in get_socket().
812 	 */
813 
814 	if ((rc = send_login(conn)) != 0) {
815 		DEBC(conn, 0, ("Login failed (rc %d)\n", rc));
816 		/* Don't attempt to recover, there seems to be something amiss */
817 		kill_connection(conn, rc, NO_LOGOUT, FALSE);
818 		par->status = rc;
819 		return -1;
820 	}
821 
822 	mutex_enter(&iscsi_cleanup_mtx);
823 	if (sess->s_terminating) {
824 		mutex_exit(&iscsi_cleanup_mtx);
825 		DEBC(conn, 0, ("Session terminating\n"));
826 		kill_connection(conn, rc, NO_LOGOUT, FALSE);
827 		par->status = sess->s_terminating;
828 		return -1;
829 	}
830 	conn->c_state = ST_FULL_FEATURE;
831 	TAILQ_INSERT_TAIL(&sess->s_conn_list, conn, c_connections);
832 	conn->c_in_session = TRUE;
833 	sess->s_total_connections++;
834 	sess->s_active_connections++;
835 	sess->s_mru_connection = conn;
836 	mutex_exit(&iscsi_cleanup_mtx);
837 
838 	DEBC(conn, 5, ("Connection created successfully!\n"));
839 	return 0;
840 }
841 
842 
843 /*
844  * recreate_connection:
845  *    Revive dead connection
846  *
847  *    Parameter:
848  *          par      IN/OUT: The login parameters
849  *          conn     IN: The connection
850  *          l        IN: The lwp pointer of the caller
851  *
852  *    Returns:    0 on success
853  *                >0 on failure, connection structure deleted
854  *                <0 on failure, connection is still terminating
855  */
856 
857 static int
858 recreate_connection(iscsi_login_parameters_t *par, session_t *sess,
859 					connection_t *conn, struct lwp *l)
860 {
861 	int rc;
862 	ccb_t *ccb;
863 	ccb_list_t old_waiting;
864 	pdu_t *pdu;
865 	uint32_t sn;
866 
867 	DEB(1, ("ReCreate Connection %d for Session %d, ERL=%d\n",
868 		conn->c_id, conn->c_session->s_id,
869 		conn->c_session->s_ErrorRecoveryLevel));
870 
871 	if (sess->s_MaxConnections &&
872 	    sess->s_active_connections >= sess->s_MaxConnections) {
873 		DEBOUT(("Too many connections (max = %d, curr = %d)\n",
874 			sess->s_MaxConnections, sess->s_active_connections));
875 		par->status = ISCSI_STATUS_MAXED_CONNECTIONS;
876 		return EIO;
877 	}
878 
879 	/* close old socket */
880 	if (conn->c_sock != NULL) {
881 		closef(conn->c_sock);
882 		conn->c_sock = NULL;
883 	}
884 
885 	if ((rc = get_socket(par->socket, &conn->c_sock)) != 0) {
886 		DEBOUT(("Invalid socket %d\n", par->socket));
887 		par->status = ISCSI_STATUS_INVALID_SOCKET;
888 		return rc;
889 	}
890 	DEBC(conn, 1, ("get_socket: par_sock=%d, fdesc=%p\n",
891 			par->socket, conn->c_sock));
892 
893 	/* close the file descriptor */
894 	fd_close(par->socket);
895 
896 	conn->c_threadobj = l;
897 	conn->c_login_par = par;
898 	conn->c_terminating = ISCSI_STATUS_SUCCESS;
899 	conn->c_recover++;
900 	conn->c_num_timeouts = 0;
901 	conn->c_state = ST_SEC_NEG;
902 	conn->c_HeaderDigest = 0;
903 	conn->c_DataDigest = 0;
904 
905 	sess->s_active_connections++;
906 
907 	TAILQ_INIT(&old_waiting);
908 
909 	mutex_enter(&conn->c_lock);
910 	while ((ccb = TAILQ_FIRST(&conn->c_ccbs_waiting)) != NULL) {
911 		suspend_ccb(ccb, FALSE);
912 		TAILQ_INSERT_TAIL(&old_waiting, ccb, ccb_chain);
913 	}
914 	init_sernum(&conn->c_StatSN_buf);
915 	cv_broadcast(&conn->c_idle_cv);
916 	mutex_exit(&conn->c_lock);
917 
918 	if ((rc = send_login(conn)) != 0) {
919 		DEBOUT(("Login failed (rc %d)\n", rc));
920 		while ((ccb = TAILQ_FIRST(&old_waiting)) != NULL) {
921 			TAILQ_REMOVE(&old_waiting, ccb, ccb_chain);
922 			wake_ccb(ccb, rc);
923 		}
924 		/* Don't attempt to recover, there seems to be something amiss */
925 		kill_connection(conn, rc, NO_LOGOUT, FALSE);
926 		par->status = rc;
927 		return -1;
928 	}
929 
930 	DEBC(conn, 9, ("Re-Login successful\n"));
931 	par->status = ISCSI_STATUS_SUCCESS;
932 
933 	conn->c_state = ST_FULL_FEATURE;
934 	sess->s_mru_connection = conn;
935 
936 	while ((ccb = TAILQ_FIRST(&old_waiting)) != NULL) {
937 		TAILQ_REMOVE(&old_waiting, ccb, ccb_chain);
938 		mutex_enter(&conn->c_lock);
939 		suspend_ccb(ccb, TRUE);
940 		mutex_exit(&conn->c_lock);
941 
942 		rc = send_task_management(conn, ccb, NULL, TASK_REASSIGN);
943 		/* if we get an error on reassign, restart the original request */
944 		if (rc && ccb->ccb_pdu_waiting != NULL) {
945 			mutex_enter(&sess->s_lock);
946 			if (sn_a_lt_b(ccb->ccb_CmdSN, sess->s_ExpCmdSN)) {
947 				pdu = ccb->ccb_pdu_waiting;
948 				sn = get_sernum(sess, pdu);
949 
950 				/* update CmdSN */
951 				DEBC(conn, 0, ("Resend ccb %p (%d) - updating CmdSN old %u, new %u\n",
952 					   ccb, rc, ccb->ccb_CmdSN, sn));
953 				ccb->ccb_CmdSN = sn;
954 				pdu->pdu_hdr.pduh_p.command.CmdSN = htonl(ccb->ccb_CmdSN);
955 			} else {
956 				DEBC(conn, 0, ("Resend ccb %p (%d) - CmdSN %u\n",
957 					   ccb, rc, ccb->ccb_CmdSN));
958 			}
959 			mutex_exit(&sess->s_lock);
960 			resend_pdu(ccb);
961 		} else {
962 			DEBC(conn, 0, ("Resend ccb %p (%d) CmdSN %u - reassigned\n",
963 				ccb, rc, ccb->ccb_CmdSN));
964 			ccb_timeout_start(ccb, COMMAND_TIMEOUT);
965 		}
966 	}
967 
968 	mutex_enter(&sess->s_lock);
969 	cv_broadcast(&sess->s_sess_cv);
970 	mutex_exit(&sess->s_lock);
971 
972 	DEBC(conn, 0, ("Connection ReCreated successfully - status %d\n",
973 						 par->status));
974 
975 	return 0;
976 }
977 
978 /* -------------------------------------------------------------------------- */
979 
980 /*
981  * check_login_pars:
982  *    Check the parameters passed into login/add_connection
983  *    for validity and consistency.
984  *
985  *    Parameter:
986  *          par      The login parameters
987  *
988  *    Returns:    0 on success, else an error code.
989  */
990 
991 static int
992 check_login_pars(iscsi_login_parameters_t *par)
993 {
994 	int i, n;
995 
996 	if (par->is_present.auth_info) {
997 		/* check consistency of authentication parameters */
998 
999 		if (par->auth_info.auth_number > ISCSI_AUTH_OPTIONS) {
1000 			DEBOUT(("Auth number invalid: %d\n", par->auth_info.auth_number));
1001 			return ISCSI_STATUS_PARAMETER_INVALID;
1002 		}
1003 
1004 		if (par->auth_info.auth_number > 2) {
1005 			DEBOUT(("Auth number invalid: %d\n", par->auth_info.auth_number));
1006 			return ISCSI_STATUS_NOTIMPL;
1007 		}
1008 
1009 		for (i = 0, n = 0; i < par->auth_info.auth_number; i++) {
1010 #if 0
1011 			if (par->auth_info.auth_type[i] < ISCSI_AUTH_None) {
1012 				DEBOUT(("Auth type invalid: %d\n",
1013 						par->auth_info.auth_type[i]));
1014 				return ISCSI_STATUS_PARAMETER_INVALID;
1015 			}
1016 #endif
1017 			if (par->auth_info.auth_type[i] > ISCSI_AUTH_CHAP) {
1018 				DEBOUT(("Auth type invalid: %d\n",
1019 						par->auth_info.auth_type[i]));
1020 				return ISCSI_STATUS_NOTIMPL;
1021 			}
1022 			n = max(n, par->auth_info.auth_type[i]);
1023 		}
1024 		if (n) {
1025 			if (!par->is_present.password ||
1026 				(par->auth_info.mutual_auth &&
1027 				 !par->is_present.target_password)) {
1028 				DEBOUT(("Password missing\n"));
1029 				return ISCSI_STATUS_PARAMETER_MISSING;
1030 			}
1031 			/* Note: Default for user-name is initiator name */
1032 		}
1033 	}
1034 	if (par->login_type != ISCSI_LOGINTYPE_DISCOVERY &&
1035 	    !par->is_present.TargetName) {
1036 		DEBOUT(("Target name missing, login type %d\n", par->login_type));
1037 		return ISCSI_STATUS_PARAMETER_MISSING;
1038 	}
1039 	if (par->is_present.MaxRecvDataSegmentLength) {
1040 		if (par->MaxRecvDataSegmentLength < 512 ||
1041 			par->MaxRecvDataSegmentLength > 0xffffff) {
1042 			DEBOUT(("MaxRecvDataSegmentLength invalid: %d\n",
1043 					par->MaxRecvDataSegmentLength));
1044 			return ISCSI_STATUS_PARAMETER_INVALID;
1045 		}
1046 	}
1047 	return 0;
1048 }
1049 
1050 
1051 /*
1052  * login:
1053  *    Handle the login ioctl - Create a session:
1054  *       Alloc the session structure
1055  *       Copy session parameters
1056  *       And call create_connection to establish the connection.
1057  *
1058  *    Parameter:
1059  *          par      IN/OUT: The login parameters
1060  *          l        IN: The lwp pointer of the caller
1061  */
1062 
1063 static void
1064 login(iscsi_login_parameters_t *par, struct lwp *l, device_t dev)
1065 {
1066 	session_t *sess;
1067 	int rc;
1068 
1069 	DEB(99, ("ISCSI: login\n"));
1070 
1071 	if (!iscsi_InitiatorName[0]) {
1072 		DEB(1, ("No Initiator Name\n"));
1073 		par->status = ISCSI_STATUS_NO_INITIATOR_NAME;
1074 		return;
1075 	}
1076 
1077 	if ((par->status = check_login_pars(par)) != 0)
1078 		return;
1079 
1080 	/* alloc the session */
1081 	sess = malloc(sizeof(*sess), M_DEVBUF, M_WAITOK | M_ZERO);
1082 	if (sess == NULL) {
1083 		DEBOUT(("No mem for session\n"));
1084 		par->status = ISCSI_STATUS_NO_RESOURCES;
1085 		return;
1086 	}
1087 	TAILQ_INIT(&sess->s_conn_list);
1088 	TAILQ_INIT(&sess->s_ccb_pool);
1089 
1090 	mutex_init(&sess->s_lock, MUTEX_DEFAULT, IPL_BIO);
1091 	cv_init(&sess->s_sess_cv, "session");
1092 	cv_init(&sess->s_ccb_cv, "ccb");
1093 
1094 	mutex_enter(&iscsi_cleanup_mtx);
1095 	/* create a unique ID */
1096 	do {
1097 		++current_id;
1098 	} while (!current_id || find_session(current_id) != NULL);
1099 	par->session_id = sess->s_id = current_id;
1100 	mutex_exit(&iscsi_cleanup_mtx);
1101 
1102 	create_ccbs(sess);
1103 	sess->s_login_type = par->login_type;
1104 	sess->s_CmdSN = 1;
1105 
1106 	if ((rc = create_connection(par, sess, l)) != 0) {
1107 		if (rc > 0) {
1108 			destroy_ccbs(sess);
1109 			cv_destroy(&sess->s_ccb_cv);
1110 			cv_destroy(&sess->s_sess_cv);
1111 			mutex_destroy(&sess->s_lock);
1112 			free(sess, M_DEVBUF);
1113 		}
1114 		return;
1115 	}
1116 
1117 	mutex_enter(&iscsi_cleanup_mtx);
1118 	TAILQ_INSERT_HEAD(&iscsi_sessions, sess, s_sessions);
1119 	mutex_exit(&iscsi_cleanup_mtx);
1120 
1121 	/* Session established, map LUNs? */
1122 	if (par->login_type == ISCSI_LOGINTYPE_MAP) {
1123 		copyinstr(par->TargetName, sess->s_tgtname,
1124 		    sizeof(sess->s_tgtname), NULL);
1125 		DEB(1, ("Login: map session %d\n", sess->s_id));
1126 		if (!map_session(sess, dev)) {
1127 			DEB(1, ("Login: map session %d failed\n", sess->s_id));
1128 			kill_session(sess, ISCSI_STATUS_MAP_FAILED,
1129 					LOGOUT_SESSION, FALSE);
1130 			par->status = ISCSI_STATUS_MAP_FAILED;
1131 			return;
1132 		}
1133 	}
1134 }
1135 
1136 
1137 /*
1138  * logout:
1139  *    Handle the logout ioctl - Kill a session.
1140  *
1141  *    Parameter:
1142  *          par      IN/OUT: The login parameters
1143  */
1144 
1145 static void
1146 logout(iscsi_logout_parameters_t *par)
1147 {
1148 	session_t *session;
1149 
1150 	DEB(5, ("ISCSI: logout session %d\n", par->session_id));
1151 
1152 	mutex_enter(&iscsi_cleanup_mtx);
1153 	if ((session = find_session(par->session_id)) == NULL) {
1154 		mutex_exit(&iscsi_cleanup_mtx);
1155 		DEBOUT(("Session %d not found\n", par->session_id));
1156 		par->status = ISCSI_STATUS_INVALID_SESSION_ID;
1157 		return;
1158 	}
1159 	mutex_exit(&iscsi_cleanup_mtx);
1160 	/* If the session exists, this always succeeds */
1161 	par->status = ISCSI_STATUS_SUCCESS;
1162 
1163 	kill_session(session, ISCSI_STATUS_LOGOUT, LOGOUT_SESSION, FALSE);
1164 }
1165 
1166 
1167 /*
1168  * add_connection:
1169  *    Handle the add_connection ioctl.
1170  *
1171  *    Parameter:
1172  *          par      IN/OUT: The login parameters
1173  *          l        IN: The lwp pointer of the caller
1174  */
1175 
1176 static void
1177 add_connection(iscsi_login_parameters_t *par, struct lwp *l)
1178 {
1179 	session_t *session;
1180 
1181 	DEB(5, ("ISCSI: add_connection to session %d\n", par->session_id));
1182 
1183 	mutex_enter(&iscsi_cleanup_mtx);
1184 	if ((session = find_session(par->session_id)) == NULL) {
1185 		mutex_exit(&iscsi_cleanup_mtx);
1186 		DEBOUT(("Session %d not found\n", par->session_id));
1187 		par->status = ISCSI_STATUS_INVALID_SESSION_ID;
1188 		return;
1189 	}
1190 	mutex_exit(&iscsi_cleanup_mtx);
1191 	if ((par->status = check_login_pars(par)) == 0) {
1192 		create_connection(par, session, l);
1193 	}
1194 }
1195 
1196 
1197 /*
1198  * remove_connection:
1199  *    Handle the remove_connection ioctl.
1200  *
1201  *    Parameter:
1202  *          par      IN/OUT: The remove parameters
1203  */
1204 
1205 static void
1206 remove_connection(iscsi_remove_parameters_t *par)
1207 {
1208 	connection_t *conn;
1209 	session_t *session;
1210 
1211 	DEB(5, ("ISCSI: remove_connection %d from session %d\n",
1212 			par->connection_id, par->session_id));
1213 
1214 	mutex_enter(&iscsi_cleanup_mtx);
1215 	if ((session = find_session(par->session_id)) == NULL) {
1216 		mutex_exit(&iscsi_cleanup_mtx);
1217 		DEBOUT(("Session %d not found\n", par->session_id));
1218 		par->status = ISCSI_STATUS_INVALID_SESSION_ID;
1219 		return;
1220 	}
1221 
1222 	if ((conn = find_connection(session, par->connection_id)) == NULL) {
1223 		mutex_exit(&iscsi_cleanup_mtx);
1224 		DEBOUT(("Connection %d not found in session %d\n",
1225 				par->connection_id, par->session_id));
1226 
1227 		par->status = ISCSI_STATUS_INVALID_CONNECTION_ID;
1228 	} else {
1229 		mutex_exit(&iscsi_cleanup_mtx);
1230 		kill_connection(conn, ISCSI_STATUS_LOGOUT, LOGOUT_CONNECTION,
1231 					FALSE);
1232 		par->status = ISCSI_STATUS_SUCCESS;
1233 	}
1234 }
1235 
1236 
1237 /*
1238  * restore_connection:
1239  *    Handle the restore_connection ioctl.
1240  *
1241  *    Parameter:
1242  *          par      IN/OUT: The login parameters
1243  *          l        IN: The lwp pointer of the caller
1244  */
1245 
1246 static void
1247 restore_connection(iscsi_login_parameters_t *par, struct lwp *l)
1248 {
1249 	session_t *sess;
1250 	connection_t *conn;
1251 
1252 	DEB(1, ("ISCSI: restore_connection %d of session %d\n",
1253 			par->connection_id, par->session_id));
1254 
1255 	mutex_enter(&iscsi_cleanup_mtx);
1256 	if ((sess = find_session(par->session_id)) == NULL) {
1257 		mutex_exit(&iscsi_cleanup_mtx);
1258 		DEBOUT(("Session %d not found\n", par->session_id));
1259 		par->status = ISCSI_STATUS_INVALID_SESSION_ID;
1260 		return;
1261 	}
1262 
1263 	if ((conn = find_connection(sess, par->connection_id)) == NULL) {
1264 		mutex_exit(&iscsi_cleanup_mtx);
1265 		DEBOUT(("Connection %d not found in session %d\n",
1266 				par->connection_id, par->session_id));
1267 		par->status = ISCSI_STATUS_INVALID_CONNECTION_ID;
1268 		return;
1269 	}
1270 	mutex_exit(&iscsi_cleanup_mtx);
1271 
1272 	if ((par->status = check_login_pars(par)) == 0) {
1273 		recreate_connection(par, sess, conn, l);
1274 	}
1275 }
1276 
1277 
1278 #ifndef ISCSI_MINIMAL
1279 
1280 /*
1281  * map_databuf:
1282  *    Map user-supplied data buffer into kernel space.
1283  *
1284  *    Parameter:
1285  *          p        IN: The proc pointer of the caller
1286  *          buf      IN/OUT: The virtual address of the buffer, modified
1287  *                   on exit to reflect kernel VA.
1288  *          datalen  IN: The size of the data buffer
1289  *
1290  *    Returns:
1291  *          An ISCSI status code on error, else 0.
1292  */
1293 
1294 uint32_t
1295 map_databuf(struct proc *p, void **buf, uint32_t datalen)
1296 {
1297 	vaddr_t kva, databuf, offs;
1298 	int error;
1299 
1300 	/* page align address */
1301 	databuf = (vaddr_t) * buf & ~PAGE_MASK;
1302 	/* offset of VA into page */
1303 	offs = (vaddr_t) * buf & PAGE_MASK;
1304 	/* round to full page including offset */
1305 	datalen = (datalen + offs + PAGE_MASK) & ~PAGE_MASK;
1306 
1307 	/* Do some magic to the vm space reference count (copied from "copyin_proc") */
1308 	if ((p->p_sflag & PS_WEXIT) || (p->p_vmspace->vm_refcnt < 1)) {
1309 		return ISCSI_STATUS_NO_RESOURCES;
1310 	}
1311 	p->p_vmspace->vm_refcnt++;
1312 
1313 	/* this is lifted from uvm_io */
1314 	error = uvm_map_extract(&p->p_vmspace->vm_map, databuf, datalen,
1315 			kernel_map, &kva,
1316 			UVM_EXTRACT_QREF | UVM_EXTRACT_CONTIG |
1317 				UVM_EXTRACT_FIXPROT);
1318 	if (error) {
1319 		DEBOUT(("uvm_map_extract failed, error = %d\n", error));
1320 		return ISCSI_STATUS_NO_RESOURCES;
1321 	}
1322 	/* add offset back into kernel VA */
1323 	*buf = (void *) (kva + offs);
1324 
1325 	return 0;
1326 }
1327 
1328 
1329 /*
1330  * unmap_databuf:
1331  *    Remove kernel space mapping of data buffer.
1332  *
1333  *    Parameter:
1334  *          p        IN: The proc pointer of the caller
1335  *          buf      IN: The kernel virtual address of the buffer
1336  *          datalen  IN: The size of the data buffer
1337  *
1338  *    Returns:
1339  *          An ISCSI status code on error, else 0.
1340  */
1341 
1342 void
1343 unmap_databuf(struct proc *p, void *buf, uint32_t datalen)
1344 {
1345 	struct vm_map_entry *dead_entries;
1346 	vaddr_t databuf;
1347 
1348 	/* round to full page */
1349 	datalen = (datalen + ((uintptr_t) buf & PAGE_MASK) + PAGE_MASK) & ~PAGE_MASK;
1350 	/* page align address */
1351 	databuf = (vaddr_t) buf & ~PAGE_MASK;
1352 
1353 	/* following code lifted almost verbatim from uvm_io.c */
1354 	vm_map_lock(kernel_map);
1355 	uvm_unmap_remove(kernel_map, databuf, databuf + datalen, &dead_entries,
1356 	    0);
1357 	vm_map_unlock(kernel_map);
1358 	if (dead_entries != NULL) {
1359 		uvm_unmap_detach(dead_entries, AMAP_REFALL);
1360 	}
1361 	/* this apparently reverses the magic to the vm ref count, from copyin_proc */
1362 	uvmspace_free(p->p_vmspace);
1363 }
1364 
1365 
1366 /*
1367  * io_command:
1368  *    Handle the io_command ioctl.
1369  *
1370  *    Parameter:
1371  *          par      IN/OUT: The iocommand parameters
1372  *          l        IN: The lwp pointer of the caller
1373  */
1374 
1375 static void
1376 io_command(iscsi_iocommand_parameters_t *par, struct lwp *l)
1377 {
1378 	uint32_t datalen = par->req.datalen;
1379 	void *databuf = par->req.databuf;
1380 	session_t *session;
1381 
1382 	DEB(9, ("ISCSI: io_command, SID=%d, lun=%" PRIu64 "\n", par->session_id, par->lun));
1383 	mutex_enter(&iscsi_cleanup_mtx);
1384 	if ((session = find_session(par->session_id)) == NULL) {
1385 		mutex_exit(&iscsi_cleanup_mtx);
1386 		DEBOUT(("Session %d not found\n", par->session_id));
1387 		par->status = ISCSI_STATUS_INVALID_SESSION_ID;
1388 		return;
1389 	}
1390 	mutex_exit(&iscsi_cleanup_mtx);
1391 
1392 	par->req.senselen_used = 0;
1393 	par->req.datalen_used = 0;
1394 	par->req.error = 0;
1395 	par->req.status = 0;
1396 	par->req.retsts = SCCMD_UNKNOWN;	/* init to failure code */
1397 
1398 	if (par->req.cmdlen > 16 || par->req.senselen > sizeof(par->req.sense)) {
1399 		par->status = ISCSI_STATUS_PARAMETER_INVALID;
1400 		return;
1401 	}
1402 
1403 	if (datalen && (par->status = map_databuf(l->l_proc,
1404 			&par->req.databuf, datalen)) != 0) {
1405 		return;
1406 	}
1407 	par->status = send_io_command(session, par->lun, &par->req,
1408 								  par->options.immediate, par->connection_id);
1409 
1410 	if (datalen) {
1411 		unmap_databuf(l->l_proc, par->req.databuf, datalen);
1412 		par->req.databuf = databuf;	/* restore original addr */
1413 	}
1414 
1415 	switch (par->status) {
1416 	case ISCSI_STATUS_SUCCESS:
1417 		par->req.retsts = SCCMD_OK;
1418 		break;
1419 
1420 	case ISCSI_STATUS_TARGET_BUSY:
1421 		par->req.retsts = SCCMD_BUSY;
1422 		break;
1423 
1424 	case ISCSI_STATUS_TIMEOUT:
1425 	case ISCSI_STATUS_SOCKET_ERROR:
1426 		par->req.retsts = SCCMD_TIMEOUT;
1427 		break;
1428 
1429 	default:
1430 		par->req.retsts = (par->req.senselen_used) ? SCCMD_SENSE
1431 												   : SCCMD_UNKNOWN;
1432 		break;
1433 	}
1434 }
1435 #endif
1436 
1437 /*
1438  * send_targets:
1439  *    Handle the send_targets ioctl.
1440  *    Note: If the passed buffer is too small to hold the complete response,
1441  *    the response is kept in the session structure so it can be
1442  *    retrieved with the next call to this function without having to go to
1443  *    the target again. Once the complete response has been retrieved, it
1444  *    is discarded.
1445  *
1446  *    Parameter:
1447  *          par      IN/OUT: The send_targets parameters
1448  */
1449 
1450 static void
1451 send_targets(iscsi_send_targets_parameters_t *par)
1452 {
1453 	int rc;
1454 	uint32_t rlen, cplen;
1455 	session_t *sess;
1456 
1457 	mutex_enter(&iscsi_cleanup_mtx);
1458 	if ((sess = find_session(par->session_id)) == NULL) {
1459 		mutex_exit(&iscsi_cleanup_mtx);
1460 		DEBOUT(("Session %d not found\n", par->session_id));
1461 		par->status = ISCSI_STATUS_INVALID_SESSION_ID;
1462 		return;
1463 	}
1464 	mutex_exit(&iscsi_cleanup_mtx);
1465 
1466 	DEB(9, ("ISCSI: send_targets, rsp_size=%d; Saved list: %p\n",
1467 			par->response_size, sess->s_target_list));
1468 
1469 	if (sess->s_target_list == NULL) {
1470 		rc = send_send_targets(sess, par->key);
1471 		if (rc) {
1472 			par->status = rc;
1473 			return;
1474 		}
1475 	}
1476 	rlen = sess->s_target_list_len;
1477 	par->response_total = rlen;
1478 	cplen = min(par->response_size, rlen);
1479 	if (cplen) {
1480 		copyout(sess->s_target_list, par->response_buffer, cplen);
1481 	}
1482 	par->response_used = cplen;
1483 
1484 	/* If all of the response was copied, don't keep it around */
1485 	if (rlen && par->response_used == rlen) {
1486 		free(sess->s_target_list, M_TEMP);
1487 		sess->s_target_list = NULL;
1488 	}
1489 
1490 	par->status = ISCSI_STATUS_SUCCESS;
1491 }
1492 
1493 
1494 /*
1495  * set_node_name:
1496  *    Handle the set_node_name ioctl.
1497  *
1498  *    Parameter:
1499  *          par      IN/OUT: The set_node_name parameters
1500  */
1501 
1502 static void
1503 set_node_name(iscsi_set_node_name_parameters_t *par)
1504 {
1505 
1506 	if (strlen(par->InitiatorName) >= ISCSI_STRING_LENGTH ||
1507 		strlen(par->InitiatorAlias) >= ISCSI_STRING_LENGTH) {
1508 		DEBOUT(("*** set_node_name string too long!\n"));
1509 		par->status = ISCSI_STATUS_PARAMETER_INVALID;
1510 		return;
1511 	}
1512 	strlcpy(iscsi_InitiatorName, par->InitiatorName, sizeof(iscsi_InitiatorName));
1513 	strlcpy(iscsi_InitiatorAlias, par->InitiatorAlias, sizeof(iscsi_InitiatorAlias));
1514 	memcpy(&iscsi_InitiatorISID, par->ISID, 6);
1515 	DEB(5, ("ISCSI: set_node_name, ISID A=%x, B=%x, C=%x, D=%x\n",
1516 			iscsi_InitiatorISID.ISID_A, iscsi_InitiatorISID.ISID_B,
1517 			iscsi_InitiatorISID.ISID_C, iscsi_InitiatorISID.ISID_D));
1518 
1519 	if (!iscsi_InitiatorISID.ISID_A && !iscsi_InitiatorISID.ISID_B &&
1520 		!iscsi_InitiatorISID.ISID_C && !iscsi_InitiatorISID.ISID_D) {
1521 		iscsi_InitiatorISID.ISID_A = T_FORMAT_EN;
1522 		iscsi_InitiatorISID.ISID_B = htons(0x1);
1523 		iscsi_InitiatorISID.ISID_C = 0x37;
1524 		iscsi_InitiatorISID.ISID_D = 0;
1525 	}
1526 
1527 	par->status = ISCSI_STATUS_SUCCESS;
1528 }
1529 
1530 
1531 /*
1532  * connection_status:
1533  *    Handle the connection_status ioctl.
1534  *
1535  *    Parameter:
1536  *          par      IN/OUT: The status parameters
1537  */
1538 
1539 static void
1540 connection_status(iscsi_conn_status_parameters_t *par)
1541 {
1542 	connection_t *conn;
1543 	session_t *sess;
1544 
1545 	mutex_enter(&iscsi_cleanup_mtx);
1546 	if ((sess = find_session(par->session_id)) == NULL) {
1547 		mutex_exit(&iscsi_cleanup_mtx);
1548 		par->status = ISCSI_STATUS_INVALID_SESSION_ID;
1549 		return;
1550 	}
1551 
1552 	if (par->connection_id) {
1553 		conn = find_connection(sess, par->connection_id);
1554 	} else {
1555 		conn = TAILQ_FIRST(&sess->s_conn_list);
1556 	}
1557 	par->status = (conn == NULL) ? ISCSI_STATUS_INVALID_CONNECTION_ID :
1558 					ISCSI_STATUS_SUCCESS;
1559 	mutex_exit(&iscsi_cleanup_mtx);
1560 	DEB(9, ("ISCSI: connection_status, session %d connection %d --> %d\n",
1561 			par->session_id, par->connection_id, par->status));
1562 }
1563 
1564 
1565 /*
1566  * get_version:
1567  *    Handle the get_version ioctl.
1568  *
1569  *    Parameter:
1570  *          par      IN/OUT: The version parameters
1571  */
1572 
1573 static void
1574 get_version(iscsi_get_version_parameters_t *par)
1575 {
1576 	par->status = ISCSI_STATUS_SUCCESS;
1577 	par->interface_version = INTERFACE_VERSION;
1578 	par->major = VERSION_MAJOR;
1579 	par->minor = VERSION_MINOR;
1580 	strlcpy(par->version_string, VERSION_STRING,
1581 		sizeof(par->version_string));
1582 }
1583 
1584 
1585 /* -------------------------------------------------------------------- */
1586 
1587 /*
1588  * kill_all_sessions:
1589  *    Terminate all sessions (called when the driver unloads).
1590  */
1591 
1592 int
1593 kill_all_sessions(void)
1594 {
1595 	session_t *sess;
1596 	int rc = 0;
1597 
1598 	mutex_enter(&iscsi_cleanup_mtx);
1599 	while ((sess = TAILQ_FIRST(&iscsi_sessions)) != NULL) {
1600 		mutex_exit(&iscsi_cleanup_mtx);
1601 		kill_session(sess, ISCSI_STATUS_DRIVER_UNLOAD, LOGOUT_SESSION,
1602 				FALSE);
1603 		mutex_enter(&iscsi_cleanup_mtx);
1604 	}
1605 	if (TAILQ_FIRST(&iscsi_sessions) != NULL) {
1606 		DEBOUT(("Failed to kill all sessions\n"));
1607 		rc = EBUSY;
1608 	}
1609 	mutex_exit(&iscsi_cleanup_mtx);
1610 
1611 	return rc;
1612 }
1613 
1614 /*
1615  * handle_connection_error:
1616  *    Deal with a problem during send or receive.
1617  *
1618  *    Parameter:
1619  *       conn        The connection the problem is associated with
1620  *       status      The status code to insert into any unfinished CCBs
1621  *       dologout    Whether Logout should be attempted
1622  */
1623 
1624 void
1625 handle_connection_error(connection_t *conn, uint32_t status, int dologout)
1626 {
1627 
1628 	DEBC(conn, 0, ("*** Connection Error, status=%d, logout=%d, state=%d\n",
1629 				   status, dologout, conn->c_state));
1630 
1631 	if (!conn->c_terminating && conn->c_state <= ST_LOGOUT_SENT) {
1632 		/* if we get an error while winding down, escalate it */
1633 		if (dologout >= 0 && conn->c_state >= ST_WINDING_DOWN) {
1634 			dologout = NO_LOGOUT;
1635 		}
1636 		kill_connection(conn, status, dologout, TRUE);
1637 	}
1638 }
1639 
1640 /*
1641  * remove a connection from session and add to the cleanup list
1642  */
1643 void
1644 add_connection_cleanup(connection_t *conn)
1645 {
1646 	session_t *sess;
1647 
1648 	mutex_enter(&iscsi_cleanup_mtx);
1649 	if (conn->c_in_session) {
1650 		sess = conn->c_session;
1651 		conn->c_in_session = FALSE;
1652 		conn->c_session = NULL;
1653 		TAILQ_REMOVE(&sess->s_conn_list, conn, c_connections);
1654 		sess->s_mru_connection = TAILQ_FIRST(&sess->s_conn_list);
1655 	}
1656 	TAILQ_INSERT_TAIL(&iscsi_cleanupc_list, conn, c_connections);
1657 	iscsi_notify_cleanup();
1658 	mutex_exit(&iscsi_cleanup_mtx);
1659 }
1660 
1661 /*
1662  * callout wrappers for timeouts, the work is done by the cleanup thread
1663  */
1664 void
1665 connection_timeout_co(void *par)
1666 {
1667 	connection_t *conn = par;
1668 
1669 	mutex_enter(&iscsi_cleanup_mtx);
1670 	conn->c_timedout = TOUT_QUEUED;
1671 	TAILQ_INSERT_TAIL(&iscsi_timeout_conn_list, conn, c_tchain);
1672 	iscsi_notify_cleanup();
1673 	mutex_exit(&iscsi_cleanup_mtx);
1674 }
1675 
1676 void
1677 connection_timeout_start(connection_t *conn, int ticks)
1678 {
1679 	mutex_enter(&iscsi_cleanup_mtx);
1680 	if (conn->c_timedout != TOUT_QUEUED) {
1681 		conn->c_timedout = TOUT_ARMED;
1682 		callout_schedule(&conn->c_timeout, ticks);
1683 	}
1684 	mutex_exit(&iscsi_cleanup_mtx);
1685 }
1686 
1687 void
1688 connection_timeout_stop(connection_t *conn)
1689 {
1690 	callout_stop(&conn->c_timeout);
1691 	mutex_enter(&iscsi_cleanup_mtx);
1692 	if (conn->c_timedout == TOUT_QUEUED) {
1693 		TAILQ_REMOVE(&iscsi_timeout_conn_list, conn, c_tchain);
1694 		conn->c_timedout = TOUT_NONE;
1695 	}
1696 	if (curlwp != iscsi_cleanproc) {
1697 		while (conn->c_timedout == TOUT_BUSY)
1698 			kpause("connbusy", false, 1, &iscsi_cleanup_mtx);
1699 	}
1700 	mutex_exit(&iscsi_cleanup_mtx);
1701 }
1702 
1703 void
1704 ccb_timeout_co(void *par)
1705 {
1706 	ccb_t *ccb = par;
1707 
1708 	mutex_enter(&iscsi_cleanup_mtx);
1709 	ccb->ccb_timedout = TOUT_QUEUED;
1710 	TAILQ_INSERT_TAIL(&iscsi_timeout_ccb_list, ccb, ccb_tchain);
1711 	iscsi_notify_cleanup();
1712 	mutex_exit(&iscsi_cleanup_mtx);
1713 }
1714 
1715 void
1716 ccb_timeout_start(ccb_t *ccb, int ticks)
1717 {
1718 	mutex_enter(&iscsi_cleanup_mtx);
1719 	if (ccb->ccb_timedout != TOUT_QUEUED) {
1720 		ccb->ccb_timedout = TOUT_ARMED;
1721 		callout_schedule(&ccb->ccb_timeout, ticks);
1722 	}
1723 	mutex_exit(&iscsi_cleanup_mtx);
1724 }
1725 
1726 void
1727 ccb_timeout_stop(ccb_t *ccb)
1728 {
1729 	callout_stop(&ccb->ccb_timeout);
1730 	mutex_enter(&iscsi_cleanup_mtx);
1731 	if (ccb->ccb_timedout == TOUT_QUEUED) {
1732 		TAILQ_REMOVE(&iscsi_timeout_ccb_list, ccb, ccb_tchain);
1733 		ccb->ccb_timedout = TOUT_NONE;
1734 	}
1735 	if (curlwp != iscsi_cleanproc) {
1736 		while (ccb->ccb_timedout == TOUT_BUSY)
1737 			kpause("ccbbusy", false, 1, &iscsi_cleanup_mtx);
1738 	}
1739 	mutex_exit(&iscsi_cleanup_mtx);
1740 }
1741 
1742 /*
1743  * iscsi_cleanup_thread
1744  *    Global thread to handle connection and session cleanup after termination.
1745  */
1746 
1747 static void
1748 iscsi_cleanup_thread(void *par)
1749 {
1750 	int s, rc;
1751 	session_t *sess, *nxts;
1752 	connection_t *conn, *nxtc;
1753 	ccb_t *ccb;
1754 
1755 	mutex_enter(&iscsi_cleanup_mtx);
1756 	while (iscsi_num_send_threads || !iscsi_detaching ||
1757 	       !TAILQ_EMPTY(&iscsi_cleanupc_list) || !TAILQ_EMPTY(&iscsi_cleanups_list)) {
1758 		TAILQ_FOREACH_SAFE(conn, &iscsi_cleanupc_list, c_connections, nxtc) {
1759 
1760 			TAILQ_REMOVE(&iscsi_cleanupc_list, conn, c_connections);
1761 			mutex_exit(&iscsi_cleanup_mtx);
1762 
1763 			sess = conn->c_session;
1764 
1765 			/*
1766 			 * This implies that connection cleanup only runs when
1767 			 * the send/recv threads have been killed
1768 			 */
1769 			DEBC(conn, 5, ("Cleanup: Waiting for threads to exit\n"));
1770 			while (conn->c_sendproc || conn->c_rcvproc)
1771 				kpause("threads", false, hz, NULL);
1772 
1773 			for (s=1; conn->c_usecount > 0 && s < 3; ++s)
1774 				kpause("usecount", false, hz, NULL);
1775 
1776 			if (conn->c_usecount > 0) {
1777 				DEBC(conn, 5, ("Cleanup: %d CCBs busy\n", conn->c_usecount));
1778 				/* retry later */
1779 				mutex_enter(&iscsi_cleanup_mtx);
1780 				TAILQ_INSERT_HEAD(&iscsi_cleanupc_list, conn, c_connections);
1781 				continue;
1782 			}
1783 
1784 			KASSERT(!conn->c_in_session);
1785 
1786 			callout_halt(&conn->c_timeout, &iscsi_cleanup_mtx);
1787 			closef(conn->c_sock);
1788 			callout_destroy(&conn->c_timeout);
1789 			cv_destroy(&conn->c_idle_cv);
1790 			cv_destroy(&conn->c_ccb_cv);
1791 			cv_destroy(&conn->c_pdu_cv);
1792 			cv_destroy(&conn->c_conn_cv);
1793 			mutex_destroy(&conn->c_lock);
1794 			free(conn, M_DEVBUF);
1795 
1796 			mutex_enter(&iscsi_cleanup_mtx);
1797 
1798 			if (--sess->s_total_connections == 0) {
1799 				DEB(1, ("Cleanup: session %d\n", sess->s_id));
1800 				if (!sess->s_terminating) {
1801 					sess->s_terminating = ISCSI_CONNECTION_TERMINATED;
1802 					KASSERT(sess->s_sessions.tqe_prev != NULL);
1803 					TAILQ_REMOVE(&iscsi_sessions, sess, s_sessions);
1804 					sess->s_sessions.tqe_next = NULL;
1805 					sess->s_sessions.tqe_prev = NULL;
1806 				}
1807 				KASSERT(sess->s_sessions.tqe_prev == NULL);
1808 				TAILQ_INSERT_HEAD(&iscsi_cleanups_list, sess, s_sessions);
1809 			}
1810 		}
1811 
1812 		TAILQ_FOREACH_SAFE(sess, &iscsi_cleanups_list, s_sessions, nxts) {
1813 			if (sess->s_refcount > 0)
1814 				continue;
1815 			TAILQ_REMOVE(&iscsi_cleanups_list, sess, s_sessions);
1816 			sess->s_sessions.tqe_next = NULL;
1817 			sess->s_sessions.tqe_prev = NULL;
1818 			mutex_exit(&iscsi_cleanup_mtx);
1819 
1820 			DEB(1, ("Cleanup: Unmap session %d\n", sess->s_id));
1821 			if (unmap_session(sess) == 0) {
1822 				DEB(1, ("Cleanup: Unmap session %d failed\n", sess->s_id));
1823 				mutex_enter(&iscsi_cleanup_mtx);
1824 				TAILQ_INSERT_HEAD(&iscsi_cleanups_list, sess, s_sessions);
1825 				continue;
1826 			}
1827 
1828 			if (sess->s_target_list != NULL)
1829 				free(sess->s_target_list, M_TEMP);
1830 
1831 			/* notify event handlers of session shutdown */
1832 			add_event(ISCSI_SESSION_TERMINATED, sess->s_id, 0, sess->s_terminating);
1833 			DEB(1, ("Cleanup: session ended %d\n", sess->s_id));
1834 
1835 			destroy_ccbs(sess);
1836 			cv_destroy(&sess->s_ccb_cv);
1837 			cv_destroy(&sess->s_sess_cv);
1838 			mutex_destroy(&sess->s_lock);
1839 			free(sess, M_DEVBUF);
1840 
1841 			mutex_enter(&iscsi_cleanup_mtx);
1842 		}
1843 
1844 		/* handle ccb timeouts */
1845 		while ((ccb = TAILQ_FIRST(&iscsi_timeout_ccb_list)) != NULL) {
1846 			TAILQ_REMOVE(&iscsi_timeout_ccb_list, ccb, ccb_tchain);
1847 			KASSERT(ccb->ccb_timedout == TOUT_QUEUED);
1848 			ccb->ccb_timedout = TOUT_BUSY;
1849 			mutex_exit(&iscsi_cleanup_mtx);
1850 			ccb_timeout(ccb);
1851 			mutex_enter(&iscsi_cleanup_mtx);
1852 			if (ccb->ccb_timedout == TOUT_BUSY)
1853 				ccb->ccb_timedout = TOUT_NONE;
1854 		}
1855 
1856 		/* handle connection timeouts */
1857 		while ((conn = TAILQ_FIRST(&iscsi_timeout_conn_list)) != NULL) {
1858 			TAILQ_REMOVE(&iscsi_timeout_conn_list, conn, c_tchain);
1859 			KASSERT(conn->c_timedout == TOUT_QUEUED);
1860 			conn->c_timedout = TOUT_BUSY;
1861 			mutex_exit(&iscsi_cleanup_mtx);
1862 			connection_timeout(conn);
1863 			mutex_enter(&iscsi_cleanup_mtx);
1864 			if (conn->c_timedout == TOUT_BUSY)
1865 				conn->c_timedout = TOUT_NONE;
1866 		}
1867 
1868 		/* Go to sleep, but wake up every 30 seconds to
1869 		 * check for dead event handlers */
1870 		rc = cv_timedwait(&iscsi_cleanup_cv, &iscsi_cleanup_mtx,
1871 			(TAILQ_FIRST(&event_handlers)) ? 120 * hz : 0);
1872 
1873 		/* if timed out, not woken up */
1874 		if (rc == EWOULDBLOCK)
1875 			check_event_handlers();
1876 	}
1877 	mutex_exit(&iscsi_cleanup_mtx);
1878 
1879 	add_event(ISCSI_DRIVER_TERMINATING, 0, 0, ISCSI_STATUS_DRIVER_UNLOAD);
1880 
1881 	/*
1882 	 * Wait for all event handlers to deregister, but don't wait more
1883 	 * than 1 minute (assume registering app has died if it takes longer).
1884 	 */
1885 	mutex_enter(&iscsi_cleanup_mtx);
1886 	for (s = 0; TAILQ_FIRST(&event_handlers) != NULL && s < 60; s++)
1887 		kpause("waiteventclr", true, hz, &iscsi_cleanup_mtx);
1888 	mutex_exit(&iscsi_cleanup_mtx);
1889 
1890 	iscsi_cleanproc = NULL;
1891 	DEB(5, ("Cleanup thread exits\n"));
1892 	kthread_exit(0);
1893 }
1894 
1895 void
1896 iscsi_init_cleanup(void)
1897 {
1898 
1899 	mutex_init(&iscsi_cleanup_mtx, MUTEX_DEFAULT, IPL_BIO);
1900 	cv_init(&iscsi_cleanup_cv, "cleanup");
1901 	cv_init(&iscsi_event_cv, "iscsievtwait");
1902 
1903 	if (kthread_create(PRI_NONE, KTHREAD_MPSAFE, NULL, iscsi_cleanup_thread,
1904 	    NULL, &iscsi_cleanproc, "iscsi_cleanup") != 0) {
1905 		panic("Can't create cleanup thread!");
1906 	}
1907 }
1908 
1909 int
1910 iscsi_destroy_cleanup(void)
1911 {
1912 
1913 	iscsi_detaching = true;
1914 	mutex_enter(&iscsi_cleanup_mtx);
1915 	while (iscsi_cleanproc != NULL) {
1916 		iscsi_notify_cleanup();
1917 		kpause("detach_wait", false, hz, &iscsi_cleanup_mtx);
1918 	}
1919 	mutex_exit(&iscsi_cleanup_mtx);
1920 
1921 	cv_destroy(&iscsi_event_cv);
1922 	cv_destroy(&iscsi_cleanup_cv);
1923 	mutex_destroy(&iscsi_cleanup_mtx);
1924 
1925 	return 0;
1926 }
1927 
1928 void
1929 iscsi_notify_cleanup(void)
1930 {
1931 	KASSERT(mutex_owned(&iscsi_cleanup_mtx));
1932 
1933 	cv_signal(&iscsi_cleanup_cv);
1934 }
1935 
1936 
1937 /* -------------------------------------------------------------------- */
1938 
1939 /*
1940  * iscsi_ioctl:
1941  *    Driver ioctl entry.
1942  *
1943  *    Parameter:
1944  *       file     File structure
1945  *       cmd      The ioctl Command
1946  *       addr     IN/OUT: The command parameter
1947  *       flag     Flags (ignored)
1948  *       l        IN: The lwp object of the caller
1949  */
1950 
1951 int
1952 iscsiioctl(struct file *fp, u_long cmd, void *addr)
1953 {
1954 	struct lwp *l = curlwp;
1955 	struct iscsifd *d = fp->f_iscsi;
1956 
1957 	DEB(1, ("ISCSI Ioctl cmd = %x\n", (int) cmd));
1958 
1959 	switch (cmd) {
1960 	case ISCSI_GET_VERSION:
1961 		get_version((iscsi_get_version_parameters_t *) addr);
1962 		break;
1963 
1964 	case ISCSI_LOGIN:
1965 		login((iscsi_login_parameters_t *) addr, l, d->fd_dev);
1966 		break;
1967 
1968 	case ISCSI_ADD_CONNECTION:
1969 		add_connection((iscsi_login_parameters_t *) addr, l);
1970 		break;
1971 
1972 	case ISCSI_RESTORE_CONNECTION:
1973 		restore_connection((iscsi_login_parameters_t *) addr, l);
1974 		break;
1975 
1976 	case ISCSI_LOGOUT:
1977 		logout((iscsi_logout_parameters_t *) addr);
1978 		break;
1979 
1980 	case ISCSI_REMOVE_CONNECTION:
1981 		remove_connection((iscsi_remove_parameters_t *) addr);
1982 		break;
1983 
1984 #ifndef ISCSI_MINIMAL
1985 	case ISCSI_IO_COMMAND:
1986 		io_command((iscsi_iocommand_parameters_t *) addr, l);
1987 		break;
1988 #endif
1989 
1990 	case ISCSI_SEND_TARGETS:
1991 		send_targets((iscsi_send_targets_parameters_t *) addr);
1992 		break;
1993 
1994 	case ISCSI_SET_NODE_NAME:
1995 		set_node_name((iscsi_set_node_name_parameters_t *) addr);
1996 		break;
1997 
1998 	case ISCSI_CONNECTION_STATUS:
1999 		connection_status((iscsi_conn_status_parameters_t *) addr);
2000 		break;
2001 
2002 	case ISCSI_REGISTER_EVENT:
2003 		register_event((iscsi_register_event_parameters_t *) addr);
2004 		break;
2005 
2006 	case ISCSI_DEREGISTER_EVENT:
2007 		deregister_event((iscsi_register_event_parameters_t *) addr);
2008 		break;
2009 
2010 	case ISCSI_WAIT_EVENT:
2011 		check_event((iscsi_wait_event_parameters_t *) addr, TRUE);
2012 		break;
2013 
2014 	case ISCSI_POLL_EVENT:
2015 		check_event((iscsi_wait_event_parameters_t *) addr, FALSE);
2016 		break;
2017 
2018 	default:
2019 		DEBOUT(("Invalid IO-Control Code\n"));
2020 		return ENOTTY;
2021 	}
2022 
2023     /*
2024      * NOTE: We return 0 even if the function fails as long as the ioctl code
2025      * is good, so the status code is copied back to the caller.
2026 	 */
2027 	return 0;
2028 }
2029