xref: /spdk/lib/iscsi/iscsi.c (revision 1a00f5c09488e7466a331b8c75cde4969740357f)
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright (C) 2008-2012 Daisuke Aoyama <aoyama@peach.ne.jp>.
5  *   Copyright (c) Intel Corporation.
6  *   All rights reserved.
7  *
8  *   Redistribution and use in source and binary forms, with or without
9  *   modification, are permitted provided that the following conditions
10  *   are met:
11  *
12  *     * Redistributions of source code must retain the above copyright
13  *       notice, this list of conditions and the following disclaimer.
14  *     * Redistributions in binary form must reproduce the above copyright
15  *       notice, this list of conditions and the following disclaimer in
16  *       the documentation and/or other materials provided with the
17  *       distribution.
18  *     * Neither the name of Intel Corporation nor the names of its
19  *       contributors may be used to endorse or promote products derived
20  *       from this software without specific prior written permission.
21  *
22  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include "spdk/stdinc.h"
36 
37 #include "spdk/base64.h"
38 #include "spdk/crc32.h"
39 #include "spdk/endian.h"
40 #include "spdk/env.h"
41 #include "spdk/likely.h"
42 #include "spdk/trace.h"
43 #include "spdk/sock.h"
44 #include "spdk/string.h"
45 #include "spdk/queue.h"
46 
47 #include "iscsi/md5.h"
48 #include "iscsi/iscsi.h"
49 #include "iscsi/param.h"
50 #include "iscsi/tgt_node.h"
51 #include "iscsi/task.h"
52 #include "iscsi/conn.h"
53 #include "spdk/scsi.h"
54 #include "spdk/bdev.h"
55 #include "iscsi/portal_grp.h"
56 
57 #include "spdk/log.h"
58 
59 #include "spdk_internal/sgl.h"
60 
61 #define MAX_TMPBUF 1024
62 
63 #ifdef __FreeBSD__
64 #define HAVE_SRANDOMDEV 1
65 #define HAVE_ARC4RANDOM 1
66 #endif
67 
68 struct spdk_iscsi_globals g_iscsi = {
69 	.mutex = PTHREAD_MUTEX_INITIALIZER,
70 	.portal_head = TAILQ_HEAD_INITIALIZER(g_iscsi.portal_head),
71 	.pg_head = TAILQ_HEAD_INITIALIZER(g_iscsi.pg_head),
72 	.ig_head = TAILQ_HEAD_INITIALIZER(g_iscsi.ig_head),
73 	.target_head = TAILQ_HEAD_INITIALIZER(g_iscsi.target_head),
74 	.auth_group_head = TAILQ_HEAD_INITIALIZER(g_iscsi.auth_group_head),
75 	.poll_group_head = TAILQ_HEAD_INITIALIZER(g_iscsi.poll_group_head),
76 };
77 
78 #define MATCH_DIGEST_WORD(BUF, CRC32C) \
79 	(    ((((uint32_t) *((uint8_t *)(BUF)+0)) << 0)		\
80 	    | (((uint32_t) *((uint8_t *)(BUF)+1)) << 8)		\
81 	    | (((uint32_t) *((uint8_t *)(BUF)+2)) << 16)	\
82 	    | (((uint32_t) *((uint8_t *)(BUF)+3)) << 24))	\
83 	    == (CRC32C))
84 
85 #ifndef HAVE_SRANDOMDEV
86 static void
87 srandomdev(void)
88 {
89 	unsigned long seed;
90 	time_t now;
91 	pid_t pid;
92 
93 	pid = getpid();
94 	now = time(NULL);
95 	seed = pid ^ now;
96 	srandom(seed);
97 }
98 #endif /* HAVE_SRANDOMDEV */
99 
100 #ifndef HAVE_ARC4RANDOM
101 static int g_arc4random_initialized = 0;
102 
103 static uint32_t
104 arc4random(void)
105 {
106 	uint32_t r;
107 	uint32_t r1, r2;
108 
109 	if (!g_arc4random_initialized) {
110 		srandomdev();
111 		g_arc4random_initialized = 1;
112 	}
113 	r1 = (uint32_t)(random() & 0xffff);
114 	r2 = (uint32_t)(random() & 0xffff);
115 	r = (r1 << 16) | r2;
116 	return r;
117 }
118 #endif /* HAVE_ARC4RANDOM */
119 
120 static void
121 gen_random(uint8_t *buf, size_t len)
122 {
123 	uint32_t r;
124 	size_t idx;
125 
126 	for (idx = 0; idx < len; idx++) {
127 		r = arc4random();
128 		buf[idx] = (uint8_t) r;
129 	}
130 }
131 
132 static uint64_t
133 iscsi_get_isid(const uint8_t isid[6])
134 {
135 	return (uint64_t)isid[0] << 40 |
136 	       (uint64_t)isid[1] << 32 |
137 	       (uint64_t)isid[2] << 24 |
138 	       (uint64_t)isid[3] << 16 |
139 	       (uint64_t)isid[4] << 8 |
140 	       (uint64_t)isid[5];
141 }
142 
143 static int
144 bin2hex(char *buf, size_t len, const uint8_t *data, size_t data_len)
145 {
146 	const char *digits = "0123456789ABCDEF";
147 	size_t total = 0;
148 	size_t idx;
149 
150 	if (len < 3) {
151 		return -1;
152 	}
153 	buf[total] = '0';
154 	total++;
155 	buf[total] = 'x';
156 	total++;
157 	buf[total] = '\0';
158 
159 	for (idx = 0; idx < data_len; idx++) {
160 		if (total + 3 > len) {
161 			buf[total] = '\0';
162 			return - 1;
163 		}
164 		buf[total] = digits[(data[idx] >> 4) & 0x0fU];
165 		total++;
166 		buf[total] = digits[data[idx] & 0x0fU];
167 		total++;
168 	}
169 	buf[total] = '\0';
170 	return total;
171 }
172 
173 static int
174 hex2bin(uint8_t *data, size_t data_len, const char *str)
175 {
176 	const char *digits = "0123456789ABCDEF";
177 	const char *dp;
178 	const char *p;
179 	size_t total = 0;
180 	int n0, n1;
181 
182 	p = str;
183 	if (p[0] != '0' && (p[1] != 'x' && p[1] != 'X')) {
184 		return -1;
185 	}
186 	p += 2;
187 
188 	while (p[0] != '\0' && p[1] != '\0') {
189 		if (total >= data_len) {
190 			return -1;
191 		}
192 		dp = strchr(digits, toupper((int) p[0]));
193 		if (dp == NULL) {
194 			return -1;
195 		}
196 		n0 = (int)(dp - digits);
197 		dp = strchr(digits, toupper((int) p[1]));
198 		if (dp == NULL) {
199 			return -1;
200 		}
201 		n1 = (int)(dp - digits);
202 
203 		data[total] = (uint8_t)(((n0 & 0x0fU) << 4) | (n1 & 0x0fU));
204 		total++;
205 		p += 2;
206 	}
207 	return total;
208 }
209 
210 static int
211 iscsi_reject(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu,
212 	     int reason)
213 {
214 	struct spdk_iscsi_pdu *rsp_pdu;
215 	struct iscsi_bhs_reject *rsph;
216 	uint8_t *data;
217 	int total_ahs_len;
218 	int data_len;
219 	int alloc_len;
220 
221 	pdu->is_rejected = true;
222 
223 	total_ahs_len = pdu->bhs.total_ahs_len;
224 	data_len = 0;
225 	alloc_len = ISCSI_BHS_LEN + (4 * total_ahs_len);
226 
227 	if (conn->header_digest) {
228 		alloc_len += ISCSI_DIGEST_LEN;
229 	}
230 
231 	data = calloc(1, alloc_len);
232 	if (!data) {
233 		SPDK_ERRLOG("calloc() failed for data segment\n");
234 		return -ENOMEM;
235 	}
236 
237 	SPDK_DEBUGLOG(iscsi, "Reject PDU reason=%d\n", reason);
238 
239 	if (conn->sess != NULL) {
240 		SPDK_DEBUGLOG(iscsi,
241 			      "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
242 			      conn->StatSN, conn->sess->ExpCmdSN,
243 			      conn->sess->MaxCmdSN);
244 	} else {
245 		SPDK_DEBUGLOG(iscsi, "StatSN=%u\n", conn->StatSN);
246 	}
247 
248 	memcpy(data, &pdu->bhs, ISCSI_BHS_LEN);
249 	data_len += ISCSI_BHS_LEN;
250 
251 	if (total_ahs_len != 0) {
252 		total_ahs_len = spdk_min((4 * total_ahs_len), ISCSI_AHS_LEN);
253 		memcpy(data + data_len, pdu->ahs, total_ahs_len);
254 		data_len += total_ahs_len;
255 	}
256 
257 	if (conn->header_digest) {
258 		memcpy(data + data_len, pdu->header_digest, ISCSI_DIGEST_LEN);
259 		data_len += ISCSI_DIGEST_LEN;
260 	}
261 
262 	rsp_pdu = iscsi_get_pdu(conn);
263 	if (rsp_pdu == NULL) {
264 		free(data);
265 		return -ENOMEM;
266 	}
267 
268 	rsph = (struct iscsi_bhs_reject *)&rsp_pdu->bhs;
269 	rsp_pdu->data = data;
270 	rsph->opcode = ISCSI_OP_REJECT;
271 	rsph->flags |= 0x80;	/* bit 0 is default to 1 */
272 	rsph->reason = reason;
273 	DSET24(rsph->data_segment_len, data_len);
274 
275 	rsph->ffffffff = 0xffffffffU;
276 	to_be32(&rsph->stat_sn, conn->StatSN);
277 	conn->StatSN++;
278 
279 	if (conn->sess != NULL) {
280 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
281 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
282 	} else {
283 		to_be32(&rsph->exp_cmd_sn, 1);
284 		to_be32(&rsph->max_cmd_sn, 1);
285 	}
286 
287 	SPDK_LOGDUMP(iscsi, "PDU", (void *)&rsp_pdu->bhs, ISCSI_BHS_LEN);
288 
289 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
290 
291 	return 0;
292 }
293 
294 uint32_t
295 iscsi_pdu_calc_header_digest(struct spdk_iscsi_pdu *pdu)
296 {
297 	uint32_t crc32c;
298 	uint32_t ahs_len_bytes = pdu->bhs.total_ahs_len * 4;
299 
300 	crc32c = SPDK_CRC32C_INITIAL;
301 	crc32c = spdk_crc32c_update(&pdu->bhs, ISCSI_BHS_LEN, crc32c);
302 
303 	if (ahs_len_bytes) {
304 		crc32c = spdk_crc32c_update(pdu->ahs, ahs_len_bytes, crc32c);
305 	}
306 
307 	/* BHS and AHS are always 4-byte multiples in length, so no padding is necessary. */
308 
309 	/* Finalize CRC by inverting all bits. */
310 	return crc32c ^ SPDK_CRC32C_XOR;
311 }
312 
313 /* Calculate CRC for each partial data segment. */
314 static void
315 iscsi_pdu_calc_partial_data_digest(struct spdk_iscsi_pdu *pdu)
316 {
317 	struct iovec iov;
318 	uint32_t num_blocks;
319 
320 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
321 		pdu->crc32c = spdk_crc32c_update(pdu->data,
322 						 pdu->data_valid_bytes - pdu->data_offset,
323 						 pdu->crc32c);
324 	} else {
325 		iov.iov_base = pdu->data;
326 		iov.iov_len = pdu->data_buf_len;
327 		num_blocks = pdu->data_buf_len / pdu->dif_ctx.block_size;
328 
329 		spdk_dif_update_crc32c(&iov, 1, num_blocks, &pdu->crc32c, &pdu->dif_ctx);
330 	}
331 }
332 
333 static uint32_t
334 iscsi_pdu_calc_partial_data_digest_done(struct spdk_iscsi_pdu *pdu)
335 {
336 	uint32_t crc32c = pdu->crc32c;
337 	uint32_t mod;
338 
339 	/* Include padding bytes into CRC if any. */
340 	mod = pdu->data_valid_bytes % ISCSI_ALIGNMENT;
341 	if (mod != 0) {
342 		uint32_t pad_length = ISCSI_ALIGNMENT - mod;
343 		uint8_t pad[3] = {0, 0, 0};
344 
345 		assert(pad_length > 0);
346 		assert(pad_length <= sizeof(pad));
347 		crc32c = spdk_crc32c_update(pad, pad_length, crc32c);
348 	}
349 
350 	/* Finalize CRC by inverting all bits. */
351 	return crc32c ^ SPDK_CRC32C_XOR;
352 }
353 
354 uint32_t
355 iscsi_pdu_calc_data_digest(struct spdk_iscsi_pdu *pdu)
356 {
357 	uint32_t data_len = DGET24(pdu->bhs.data_segment_len);
358 	uint32_t crc32c;
359 	uint32_t mod;
360 	struct iovec iov;
361 	uint32_t num_blocks;
362 
363 	/* Initialize CRC. */
364 	crc32c = SPDK_CRC32C_INITIAL;
365 
366 	/* Calculate CRC for the whole data segment. */
367 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
368 		crc32c = spdk_crc32c_update(pdu->data, data_len, crc32c);
369 	} else {
370 		iov.iov_base = pdu->data;
371 		iov.iov_len = pdu->data_buf_len;
372 		num_blocks = pdu->data_buf_len / pdu->dif_ctx.block_size;
373 
374 		spdk_dif_update_crc32c(&iov, 1, num_blocks, &crc32c, &pdu->dif_ctx);
375 	}
376 
377 	/* Include padding bytes into CRC if any. */
378 	mod = data_len % ISCSI_ALIGNMENT;
379 	if (mod != 0) {
380 		uint32_t pad_length = ISCSI_ALIGNMENT - mod;
381 		uint8_t pad[3] = {0, 0, 0};
382 		assert(pad_length > 0);
383 		assert(pad_length <= sizeof(pad));
384 		crc32c = spdk_crc32c_update(pad, pad_length, crc32c);
385 	}
386 
387 	/* Finalize CRC by inverting all bits. */
388 	return crc32c ^ SPDK_CRC32C_XOR;
389 }
390 
391 static int
392 iscsi_conn_read_data_segment(struct spdk_iscsi_conn *conn,
393 			     struct spdk_iscsi_pdu *pdu,
394 			     uint32_t data_offset, uint32_t data_len)
395 {
396 	struct iovec buf_iov, iovs[32];
397 	int rc, _rc;
398 
399 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
400 		return iscsi_conn_read_data(conn, data_len, pdu->data + data_offset);
401 	} else {
402 		buf_iov.iov_base = pdu->data;
403 		buf_iov.iov_len = pdu->data_buf_len;
404 		rc = spdk_dif_set_md_interleave_iovs(iovs, 32, &buf_iov, 1,
405 						     data_offset, data_len, NULL,
406 						     &pdu->dif_ctx);
407 		if (rc > 0) {
408 			rc = iscsi_conn_readv_data(conn, iovs, rc);
409 			if (rc > 0) {
410 				_rc = spdk_dif_generate_stream(&buf_iov, 1, data_offset, rc,
411 							       &pdu->dif_ctx);
412 				if (_rc != 0) {
413 					SPDK_ERRLOG("DIF generate failed\n");
414 					rc = _rc;
415 				}
416 			}
417 		} else {
418 			SPDK_ERRLOG("Setup iovs for interleaved metadata failed\n");
419 		}
420 		return rc;
421 	}
422 }
423 
424 /* Build iovec array to leave metadata space for every data block
425  * when reading data segment from socket.
426  */
427 static inline bool
428 _iscsi_sgl_append_with_md(struct spdk_iov_sgl *s,
429 			  void *buf, uint32_t buf_len, uint32_t data_len,
430 			  struct spdk_dif_ctx *dif_ctx)
431 {
432 	int rc;
433 	uint32_t total_size = 0;
434 	struct iovec buf_iov;
435 
436 	if (s->iov_offset >= data_len) {
437 		s->iov_offset -= data_len;
438 	} else {
439 		buf_iov.iov_base = buf;
440 		buf_iov.iov_len = buf_len;
441 		rc = spdk_dif_set_md_interleave_iovs(s->iov, s->iovcnt, &buf_iov, 1,
442 						     s->iov_offset, data_len - s->iov_offset,
443 						     &total_size, dif_ctx);
444 		if (rc < 0) {
445 			SPDK_ERRLOG("Failed to setup iovs for DIF strip\n");
446 			return false;
447 		}
448 
449 		s->total_size += total_size;
450 		s->iov_offset = 0;
451 		assert(s->iovcnt >= rc);
452 		s->iovcnt -= rc;
453 		s->iov += rc;
454 
455 		if (s->iovcnt == 0) {
456 			return false;
457 		}
458 	}
459 
460 	return true;
461 }
462 
463 int
464 iscsi_build_iovs(struct spdk_iscsi_conn *conn, struct iovec *iovs, int iovcnt,
465 		 struct spdk_iscsi_pdu *pdu, uint32_t *_mapped_length)
466 {
467 	struct spdk_iov_sgl sgl;
468 	int enable_digest;
469 	uint32_t total_ahs_len;
470 	uint32_t data_len;
471 
472 	if (iovcnt == 0) {
473 		return 0;
474 	}
475 
476 	total_ahs_len = pdu->bhs.total_ahs_len;
477 	data_len = DGET24(pdu->bhs.data_segment_len);
478 	data_len = ISCSI_ALIGN(data_len);
479 
480 	enable_digest = 1;
481 	if (pdu->bhs.opcode == ISCSI_OP_LOGIN_RSP) {
482 		/* this PDU should be sent without digest */
483 		enable_digest = 0;
484 	}
485 
486 	spdk_iov_sgl_init(&sgl, iovs, iovcnt, pdu->writev_offset);
487 
488 	/* BHS */
489 	if (!spdk_iov_sgl_append(&sgl, (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN)) {
490 		goto end;
491 	}
492 	/* AHS */
493 	if (total_ahs_len > 0) {
494 		if (!spdk_iov_sgl_append(&sgl, pdu->ahs, 4 * total_ahs_len)) {
495 			goto end;
496 		}
497 	}
498 
499 	/* Header Digest */
500 	if (enable_digest && conn->header_digest) {
501 		if (!spdk_iov_sgl_append(&sgl, pdu->header_digest, ISCSI_DIGEST_LEN)) {
502 			goto end;
503 		}
504 	}
505 
506 	/* Data Segment */
507 	if (data_len > 0) {
508 		if (!pdu->dif_insert_or_strip) {
509 			if (!spdk_iov_sgl_append(&sgl, pdu->data, data_len)) {
510 				goto end;
511 			}
512 		} else {
513 			if (!_iscsi_sgl_append_with_md(&sgl, pdu->data, pdu->data_buf_len,
514 						       data_len, &pdu->dif_ctx)) {
515 				goto end;
516 			}
517 		}
518 	}
519 
520 	/* Data Digest */
521 	if (enable_digest && conn->data_digest && data_len != 0) {
522 		spdk_iov_sgl_append(&sgl, pdu->data_digest, ISCSI_DIGEST_LEN);
523 	}
524 
525 end:
526 	if (_mapped_length != NULL) {
527 		*_mapped_length = sgl.total_size;
528 	}
529 
530 	return iovcnt - sgl.iovcnt;
531 }
532 
533 void iscsi_free_sess(struct spdk_iscsi_sess *sess)
534 {
535 	if (sess == NULL) {
536 		return;
537 	}
538 
539 	sess->tag = 0;
540 	sess->target = NULL;
541 	sess->session_type = SESSION_TYPE_INVALID;
542 	iscsi_param_free(sess->params);
543 	free(sess->conns);
544 	spdk_scsi_port_free(&sess->initiator_port);
545 	spdk_mempool_put(g_iscsi.session_pool, (void *)sess);
546 }
547 
548 static int
549 create_iscsi_sess(struct spdk_iscsi_conn *conn,
550 		  struct spdk_iscsi_tgt_node *target,
551 		  enum session_type session_type)
552 {
553 	struct spdk_iscsi_sess *sess;
554 	int rc;
555 
556 	sess = spdk_mempool_get(g_iscsi.session_pool);
557 	if (!sess) {
558 		SPDK_ERRLOG("Unable to get session object\n");
559 		SPDK_ERRLOG("MaxSessions set to %d\n", g_iscsi.MaxSessions);
560 		return -ENOMEM;
561 	}
562 
563 	/* configuration values */
564 	pthread_mutex_lock(&g_iscsi.mutex);
565 
566 	sess->MaxConnections = g_iscsi.MaxConnectionsPerSession;
567 	sess->MaxOutstandingR2T = DEFAULT_MAXOUTSTANDINGR2T;
568 
569 	sess->DefaultTime2Wait = g_iscsi.DefaultTime2Wait;
570 	sess->DefaultTime2Retain = g_iscsi.DefaultTime2Retain;
571 	sess->FirstBurstLength = g_iscsi.FirstBurstLength;
572 	sess->MaxBurstLength = SPDK_ISCSI_MAX_BURST_LENGTH;
573 	sess->InitialR2T = DEFAULT_INITIALR2T;
574 	sess->ImmediateData = g_iscsi.ImmediateData;
575 	sess->DataPDUInOrder = DEFAULT_DATAPDUINORDER;
576 	sess->DataSequenceInOrder = DEFAULT_DATASEQUENCEINORDER;
577 	sess->ErrorRecoveryLevel = g_iscsi.ErrorRecoveryLevel;
578 
579 	pthread_mutex_unlock(&g_iscsi.mutex);
580 
581 	sess->tag = conn->pg_tag;
582 
583 	sess->conns = calloc(sess->MaxConnections, sizeof(*sess->conns));
584 	if (!sess->conns) {
585 		spdk_mempool_put(g_iscsi.session_pool, (void *)sess);
586 		SPDK_ERRLOG("calloc() failed for connection array\n");
587 		return -ENOMEM;
588 	}
589 
590 	sess->connections = 0;
591 
592 	sess->conns[sess->connections] = conn;
593 	sess->connections++;
594 
595 	sess->params = NULL;
596 	sess->target = target;
597 	sess->isid = 0;
598 	sess->session_type = session_type;
599 	sess->current_text_itt = 0xffffffffU;
600 
601 	/* set default params */
602 	rc = iscsi_sess_params_init(&sess->params);
603 	if (rc < 0) {
604 		SPDK_ERRLOG("iscsi_sess_params_init() failed\n");
605 		goto error_return;
606 	}
607 	/* replace with config value */
608 	rc = iscsi_param_set_int(sess->params, "MaxConnections",
609 				 sess->MaxConnections);
610 	if (rc < 0) {
611 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
612 		goto error_return;
613 	}
614 
615 	rc = iscsi_param_set_int(sess->params, "MaxOutstandingR2T",
616 				 sess->MaxOutstandingR2T);
617 	if (rc < 0) {
618 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
619 		goto error_return;
620 	}
621 
622 	rc = iscsi_param_set_int(sess->params, "DefaultTime2Wait",
623 				 sess->DefaultTime2Wait);
624 	if (rc < 0) {
625 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
626 		goto error_return;
627 	}
628 
629 	rc = iscsi_param_set_int(sess->params, "DefaultTime2Retain",
630 				 sess->DefaultTime2Retain);
631 	if (rc < 0) {
632 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
633 		goto error_return;
634 	}
635 
636 	rc = iscsi_param_set_int(sess->params, "FirstBurstLength",
637 				 sess->FirstBurstLength);
638 	if (rc < 0) {
639 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
640 		goto error_return;
641 	}
642 
643 	rc = iscsi_param_set_int(sess->params, "MaxBurstLength",
644 				 sess->MaxBurstLength);
645 	if (rc < 0) {
646 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
647 		goto error_return;
648 	}
649 
650 	rc = iscsi_param_set(sess->params, "InitialR2T",
651 			     sess->InitialR2T ? "Yes" : "No");
652 	if (rc < 0) {
653 		SPDK_ERRLOG("iscsi_param_set() failed\n");
654 		goto error_return;
655 	}
656 
657 	rc = iscsi_param_set(sess->params, "ImmediateData",
658 			     sess->ImmediateData ? "Yes" : "No");
659 	if (rc < 0) {
660 		SPDK_ERRLOG("iscsi_param_set() failed\n");
661 		goto error_return;
662 	}
663 
664 	rc = iscsi_param_set(sess->params, "DataPDUInOrder",
665 			     sess->DataPDUInOrder ? "Yes" : "No");
666 	if (rc < 0) {
667 		SPDK_ERRLOG("iscsi_param_set() failed\n");
668 		goto error_return;
669 	}
670 
671 	rc = iscsi_param_set(sess->params, "DataSequenceInOrder",
672 			     sess->DataSequenceInOrder ? "Yes" : "No");
673 	if (rc < 0) {
674 		SPDK_ERRLOG("iscsi_param_set() failed\n");
675 		goto error_return;
676 	}
677 
678 	rc = iscsi_param_set_int(sess->params, "ErrorRecoveryLevel",
679 				 sess->ErrorRecoveryLevel);
680 	if (rc < 0) {
681 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
682 		goto error_return;
683 	}
684 
685 	/* realloc buffer */
686 	rc = iscsi_param_set_int(conn->params, "MaxRecvDataSegmentLength",
687 				 conn->MaxRecvDataSegmentLength);
688 	if (rc < 0) {
689 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
690 		goto error_return;
691 	}
692 
693 	/* sess for first connection of session */
694 	conn->sess = sess;
695 	return 0;
696 
697 error_return:
698 	iscsi_free_sess(sess);
699 	conn->sess = NULL;
700 	return -1;
701 }
702 
703 static struct spdk_iscsi_sess *
704 get_iscsi_sess_by_tsih(uint16_t tsih)
705 {
706 	struct spdk_iscsi_sess *session;
707 
708 	if (tsih == 0 || tsih > g_iscsi.MaxSessions) {
709 		return NULL;
710 	}
711 
712 	session = g_iscsi.session[tsih - 1];
713 	assert(tsih == session->tsih);
714 
715 	return session;
716 }
717 
718 static uint8_t
719 append_iscsi_sess(struct spdk_iscsi_conn *conn,
720 		  const char *initiator_port_name, uint16_t tsih, uint16_t cid)
721 {
722 	struct spdk_iscsi_sess *sess;
723 
724 	SPDK_DEBUGLOG(iscsi, "append session: init port name=%s, tsih=%u, cid=%u\n",
725 		      initiator_port_name, tsih, cid);
726 
727 	sess = get_iscsi_sess_by_tsih(tsih);
728 	if (sess == NULL) {
729 		SPDK_ERRLOG("spdk_get_iscsi_sess_by_tsih failed\n");
730 		return ISCSI_LOGIN_CONN_ADD_FAIL;
731 	}
732 	if ((conn->pg_tag != sess->tag) ||
733 	    (strcasecmp(initiator_port_name, spdk_scsi_port_get_name(sess->initiator_port)) != 0) ||
734 	    (conn->target != sess->target)) {
735 		/* no match */
736 		SPDK_ERRLOG("no MCS session for init port name=%s, tsih=%d, cid=%d\n",
737 			    initiator_port_name, tsih, cid);
738 		return ISCSI_LOGIN_CONN_ADD_FAIL;
739 	}
740 
741 	if (sess->connections >= sess->MaxConnections) {
742 		/* no slot for connection */
743 		SPDK_ERRLOG("too many connections for init port name=%s, tsih=%d, cid=%d\n",
744 			    initiator_port_name, tsih, cid);
745 		return ISCSI_LOGIN_TOO_MANY_CONNECTIONS;
746 	}
747 
748 	SPDK_DEBUGLOG(iscsi, "Connections (tsih %d): %d\n", sess->tsih, sess->connections);
749 	conn->sess = sess;
750 
751 	/*
752 	 * TODO: need a mutex or other sync mechanism to protect the session's
753 	 *  connection list.
754 	 */
755 	sess->conns[sess->connections] = conn;
756 	sess->connections++;
757 
758 	return 0;
759 }
760 
761 static int
762 iscsi_append_text(const char *key, const char *val, uint8_t *data,
763 		  int alloc_len, int data_len)
764 {
765 	int total;
766 	int len;
767 
768 	total = data_len;
769 	if (alloc_len < 1) {
770 		return 0;
771 	}
772 	if (total > alloc_len) {
773 		total = alloc_len;
774 		data[total - 1] = '\0';
775 		return total;
776 	}
777 
778 	if (alloc_len - total < 1) {
779 		SPDK_ERRLOG("data space small %d\n", alloc_len);
780 		return total;
781 	}
782 	len = snprintf((char *) data + total, alloc_len - total, "%s=%s", key, val);
783 	total += len + 1;
784 
785 	return total;
786 }
787 
788 static int
789 iscsi_append_param(struct spdk_iscsi_conn *conn, const char *key,
790 		   uint8_t *data, int alloc_len, int data_len)
791 {
792 	struct iscsi_param *param;
793 
794 	param = iscsi_param_find(conn->params, key);
795 	if (param == NULL) {
796 		param = iscsi_param_find(conn->sess->params, key);
797 		if (param == NULL) {
798 			SPDK_DEBUGLOG(iscsi, "no key %.64s\n", key);
799 			return data_len;
800 		}
801 	}
802 	return iscsi_append_text(param->key, param->val, data,
803 				 alloc_len, data_len);
804 }
805 
806 static int
807 iscsi_auth_params(struct spdk_iscsi_conn *conn,
808 		  struct iscsi_param *params, const char *method, uint8_t *data,
809 		  int alloc_len, int data_len)
810 {
811 	char *in_val;
812 	char *in_next;
813 	char *new_val;
814 	const char *algorithm;
815 	const char *name;
816 	const char *response;
817 	const char *identifier;
818 	const char *challenge;
819 	int total;
820 	int rc;
821 
822 	if (conn == NULL || params == NULL || method == NULL) {
823 		return -1;
824 	}
825 	if (strcasecmp(method, "CHAP") == 0) {
826 		/* method OK */
827 	} else {
828 		SPDK_ERRLOG("unsupported AuthMethod %.64s\n", method);
829 		return -1;
830 	}
831 
832 	total = data_len;
833 	if (alloc_len < 1) {
834 		return 0;
835 	}
836 	if (total > alloc_len) {
837 		total = alloc_len;
838 		data[total - 1] = '\0';
839 		return total;
840 	}
841 
842 	/* for temporary store */
843 	in_val = malloc(ISCSI_TEXT_MAX_VAL_LEN + 1);
844 	if (!in_val) {
845 		SPDK_ERRLOG("malloc() failed for temporary store\n");
846 		return -ENOMEM;
847 	}
848 
849 	/* CHAP method (RFC1994) */
850 	if ((algorithm = iscsi_param_get_val(params, "CHAP_A")) != NULL) {
851 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_A) {
852 			SPDK_ERRLOG("CHAP sequence error\n");
853 			goto error_return;
854 		}
855 
856 		/* CHAP_A is LIST type */
857 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", algorithm);
858 		in_next = in_val;
859 		while ((new_val = spdk_strsepq(&in_next, ",")) != NULL) {
860 			if (strcasecmp(new_val, "5") == 0) {
861 				/* CHAP with MD5 */
862 				break;
863 			}
864 		}
865 		if (new_val == NULL) {
866 			snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", "Reject");
867 			new_val = in_val;
868 			iscsi_append_text("CHAP_A", new_val, data, alloc_len, total);
869 			goto error_return;
870 		}
871 		/* selected algorithm is 5 (MD5) */
872 		SPDK_DEBUGLOG(iscsi, "got CHAP_A=%s\n", new_val);
873 		total = iscsi_append_text("CHAP_A", new_val, data, alloc_len, total);
874 
875 		/* Identifier is one octet */
876 		gen_random(conn->auth.chap_id, 1);
877 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN, "%d",
878 			 (int) conn->auth.chap_id[0]);
879 		total = iscsi_append_text("CHAP_I", in_val, data, alloc_len, total);
880 
881 		/* Challenge Value is a variable stream of octets */
882 		/* (binary length MUST not exceed 1024 bytes) */
883 		conn->auth.chap_challenge_len = ISCSI_CHAP_CHALLENGE_LEN;
884 		gen_random(conn->auth.chap_challenge, conn->auth.chap_challenge_len);
885 		bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN,
886 			conn->auth.chap_challenge, conn->auth.chap_challenge_len);
887 		total = iscsi_append_text("CHAP_C", in_val, data, alloc_len, total);
888 
889 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_NR;
890 	} else if ((name = iscsi_param_get_val(params, "CHAP_N")) != NULL) {
891 		uint8_t resmd5[SPDK_MD5DIGEST_LEN];
892 		uint8_t tgtmd5[SPDK_MD5DIGEST_LEN];
893 		struct spdk_md5ctx md5ctx;
894 		size_t decoded_len = 0;
895 
896 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_NR) {
897 			SPDK_ERRLOG("CHAP sequence error\n");
898 			goto error_return;
899 		}
900 
901 		response = iscsi_param_get_val(params, "CHAP_R");
902 		if (response == NULL) {
903 			SPDK_ERRLOG("no response\n");
904 			goto error_return;
905 		}
906 		if (response[0] == '0' &&
907 		    (response[1] == 'x' || response[1] == 'X')) {
908 			rc = hex2bin(resmd5, SPDK_MD5DIGEST_LEN, response);
909 			if (rc < 0 || rc != SPDK_MD5DIGEST_LEN) {
910 				SPDK_ERRLOG("response format error\n");
911 				goto error_return;
912 			}
913 		} else if (response[0] == '0' &&
914 			   (response[1] == 'b' || response[1] == 'B')) {
915 			response += 2;
916 			rc = spdk_base64_decode(resmd5, &decoded_len, response);
917 			if (rc < 0 || decoded_len != SPDK_MD5DIGEST_LEN) {
918 				SPDK_ERRLOG("response format error\n");
919 				goto error_return;
920 			}
921 		} else {
922 			SPDK_ERRLOG("response format error\n");
923 			goto error_return;
924 		}
925 		SPDK_DEBUGLOG(iscsi, "got CHAP_N/CHAP_R\n");
926 
927 		SPDK_DEBUGLOG(iscsi, "ag_tag=%d\n", conn->chap_group);
928 
929 		rc = iscsi_chap_get_authinfo(&conn->auth, name, conn->chap_group);
930 		if (rc < 0) {
931 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
932 			SPDK_ERRLOG("iscsi_chap_get_authinfo() failed\n");
933 			goto error_return;
934 		}
935 		if (conn->auth.user[0] == '\0' || conn->auth.secret[0] == '\0') {
936 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
937 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
938 			goto error_return;
939 		}
940 
941 		md5init(&md5ctx);
942 		/* Identifier */
943 		md5update(&md5ctx, conn->auth.chap_id, 1);
944 		/* followed by secret */
945 		md5update(&md5ctx, conn->auth.secret,
946 			  strlen(conn->auth.secret));
947 		/* followed by Challenge Value */
948 		md5update(&md5ctx, conn->auth.chap_challenge,
949 			  conn->auth.chap_challenge_len);
950 		/* tgtmd5 is expecting Response Value */
951 		md5final(tgtmd5, &md5ctx);
952 
953 		bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN, tgtmd5, SPDK_MD5DIGEST_LEN);
954 
955 #if 0
956 		SPDK_DEBUGLOG(iscsi, "tgtmd5=%s, resmd5=%s\n", in_val, response);
957 		spdk_dump("tgtmd5", tgtmd5, SPDK_MD5DIGEST_LEN);
958 		spdk_dump("resmd5", resmd5, SPDK_MD5DIGEST_LEN);
959 #endif
960 
961 		/* compare MD5 digest */
962 		if (memcmp(tgtmd5, resmd5, SPDK_MD5DIGEST_LEN) != 0) {
963 			/* not match */
964 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
965 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
966 			goto error_return;
967 		}
968 		/* OK initiator's secret */
969 		conn->authenticated = true;
970 
971 		/* mutual CHAP? */
972 		identifier = iscsi_param_get_val(params, "CHAP_I");
973 		if (identifier != NULL) {
974 			conn->auth.chap_mid[0] = (uint8_t) strtol(identifier, NULL, 10);
975 			challenge = iscsi_param_get_val(params, "CHAP_C");
976 			if (challenge == NULL) {
977 				SPDK_ERRLOG("CHAP sequence error\n");
978 				goto error_return;
979 			}
980 			if (challenge[0] == '0' &&
981 			    (challenge[1] == 'x' || challenge[1] == 'X')) {
982 				rc = hex2bin(conn->auth.chap_mchallenge,
983 					     ISCSI_CHAP_CHALLENGE_LEN, challenge);
984 				if (rc < 0) {
985 					SPDK_ERRLOG("challenge format error\n");
986 					goto error_return;
987 				}
988 				conn->auth.chap_mchallenge_len = rc;
989 			} else if (challenge[0] == '0' &&
990 				   (challenge[1] == 'b' || challenge[1] == 'B')) {
991 				challenge += 2;
992 				rc = spdk_base64_decode(conn->auth.chap_mchallenge,
993 							&decoded_len, challenge);
994 				if (rc < 0) {
995 					SPDK_ERRLOG("challenge format error\n");
996 					goto error_return;
997 				}
998 				conn->auth.chap_mchallenge_len = decoded_len;
999 			} else {
1000 				SPDK_ERRLOG("challenge format error\n");
1001 				goto error_return;
1002 			}
1003 #if 0
1004 			spdk_dump("MChallenge", conn->auth.chap_mchallenge,
1005 				  conn->auth.chap_mchallenge_len);
1006 #endif
1007 			SPDK_DEBUGLOG(iscsi, "got CHAP_I/CHAP_C\n");
1008 
1009 			if (conn->auth.muser[0] == '\0' || conn->auth.msecret[0] == '\0') {
1010 				/* SPDK_ERRLOG("mutual auth user or secret is missing\n"); */
1011 				SPDK_ERRLOG("auth failed (name %.64s)\n", name);
1012 				goto error_return;
1013 			}
1014 
1015 			md5init(&md5ctx);
1016 			/* Identifier */
1017 			md5update(&md5ctx, conn->auth.chap_mid, 1);
1018 			/* followed by secret */
1019 			md5update(&md5ctx, conn->auth.msecret,
1020 				  strlen(conn->auth.msecret));
1021 			/* followed by Challenge Value */
1022 			md5update(&md5ctx, conn->auth.chap_mchallenge,
1023 				  conn->auth.chap_mchallenge_len);
1024 			/* tgtmd5 is Response Value */
1025 			md5final(tgtmd5, &md5ctx);
1026 
1027 			bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN, tgtmd5, SPDK_MD5DIGEST_LEN);
1028 
1029 			total = iscsi_append_text("CHAP_N", conn->auth.muser, data,
1030 						  alloc_len, total);
1031 			total = iscsi_append_text("CHAP_R", in_val, data, alloc_len, total);
1032 		} else {
1033 			/* not mutual */
1034 			if (conn->mutual_chap) {
1035 				SPDK_ERRLOG("required mutual CHAP\n");
1036 				goto error_return;
1037 			}
1038 		}
1039 
1040 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_END;
1041 	} else {
1042 		/* not found CHAP keys */
1043 		SPDK_DEBUGLOG(iscsi, "start CHAP\n");
1044 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1045 	}
1046 
1047 	free(in_val);
1048 	return total;
1049 
1050 error_return:
1051 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1052 	free(in_val);
1053 	return -1;
1054 }
1055 
1056 static int
1057 iscsi_check_values(struct spdk_iscsi_conn *conn)
1058 {
1059 	if (conn->sess->FirstBurstLength > conn->sess->MaxBurstLength) {
1060 		SPDK_ERRLOG("FirstBurstLength(%d) > MaxBurstLength(%d)\n",
1061 			    conn->sess->FirstBurstLength,
1062 			    conn->sess->MaxBurstLength);
1063 		return -1;
1064 	}
1065 	if (conn->sess->FirstBurstLength > g_iscsi.FirstBurstLength) {
1066 		SPDK_ERRLOG("FirstBurstLength(%d) > iSCSI target restriction(%d)\n",
1067 			    conn->sess->FirstBurstLength, g_iscsi.FirstBurstLength);
1068 		return -1;
1069 	}
1070 	if (conn->sess->MaxBurstLength > 0x00ffffff) {
1071 		SPDK_ERRLOG("MaxBurstLength(%d) > 0x00ffffff\n",
1072 			    conn->sess->MaxBurstLength);
1073 		return -1;
1074 	}
1075 
1076 	if (conn->MaxRecvDataSegmentLength < 512) {
1077 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) < 512\n",
1078 			    conn->MaxRecvDataSegmentLength);
1079 		return -1;
1080 	}
1081 	if (conn->MaxRecvDataSegmentLength > 0x00ffffff) {
1082 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) > 0x00ffffff\n",
1083 			    conn->MaxRecvDataSegmentLength);
1084 		return -1;
1085 	}
1086 	return 0;
1087 }
1088 
1089 static int
1090 iscsi_conn_params_update(struct spdk_iscsi_conn *conn)
1091 {
1092 	int rc;
1093 	uint32_t recv_buf_size;
1094 
1095 	/* update internal variables */
1096 	rc = iscsi_copy_param2var(conn);
1097 	if (rc < 0) {
1098 		SPDK_ERRLOG("iscsi_copy_param2var() failed\n");
1099 		if (conn->state < ISCSI_CONN_STATE_EXITING) {
1100 			conn->state = ISCSI_CONN_STATE_EXITING;
1101 		}
1102 		return rc;
1103 	}
1104 
1105 	/* check value */
1106 	rc = iscsi_check_values(conn);
1107 	if (rc < 0) {
1108 		SPDK_ERRLOG("iscsi_check_values() failed\n");
1109 		if (conn->state < ISCSI_CONN_STATE_EXITING) {
1110 			conn->state = ISCSI_CONN_STATE_EXITING;
1111 		}
1112 	}
1113 
1114 	/* The socket receive buffer may need to be adjusted based on the new parameters */
1115 
1116 	/* Don't allow the recv buffer to be 0 or very large. */
1117 	recv_buf_size = spdk_max(0x1000, spdk_min(0x2000, conn->sess->FirstBurstLength));
1118 
1119 	/* Add in extra space for the PDU */
1120 	recv_buf_size += ISCSI_BHS_LEN + ISCSI_AHS_LEN;
1121 
1122 	if (conn->header_digest) {
1123 		recv_buf_size += ISCSI_DIGEST_LEN;
1124 	}
1125 
1126 	if (conn->data_digest) {
1127 		recv_buf_size += ISCSI_DIGEST_LEN;
1128 	}
1129 
1130 	/* Set up to buffer up to 4 commands with immediate data at once */
1131 	if (spdk_sock_set_recvbuf(conn->sock, recv_buf_size * 4) < 0) {
1132 		/* Not fatal. */
1133 	}
1134 
1135 	return rc;
1136 }
1137 
1138 static void
1139 iscsi_conn_login_pdu_err_complete(void *arg)
1140 {
1141 	struct spdk_iscsi_conn *conn = arg;
1142 
1143 	if (conn->full_feature) {
1144 		iscsi_conn_params_update(conn);
1145 	}
1146 }
1147 
1148 static void
1149 iscsi_conn_login_pdu_success_complete(void *arg)
1150 {
1151 	struct spdk_iscsi_conn *conn = arg;
1152 
1153 
1154 	if (conn->state >= ISCSI_CONN_STATE_EXITING) {
1155 		/* Connection is being exited before this callback is executed. */
1156 		SPDK_DEBUGLOG(iscsi, "Connection is already exited.\n");
1157 		return;
1158 	}
1159 	if (conn->full_feature) {
1160 		if (iscsi_conn_params_update(conn) != 0) {
1161 			return;
1162 		}
1163 	}
1164 	conn->state = ISCSI_CONN_STATE_RUNNING;
1165 	if (conn->full_feature != 0) {
1166 		iscsi_conn_schedule(conn);
1167 	}
1168 }
1169 
1170 /*
1171  * The response function of spdk_iscsi_op_login
1172  */
1173 static void
1174 iscsi_op_login_response(struct spdk_iscsi_conn *conn,
1175 			struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param *params,
1176 			iscsi_conn_xfer_complete_cb cb_fn)
1177 {
1178 	struct iscsi_bhs_login_rsp *rsph;
1179 
1180 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1181 	rsph->version_max = ISCSI_VERSION;
1182 	rsph->version_act = ISCSI_VERSION;
1183 	DSET24(rsph->data_segment_len, rsp_pdu->data_segment_len);
1184 
1185 	to_be32(&rsph->stat_sn, conn->StatSN);
1186 	conn->StatSN++;
1187 
1188 	if (conn->sess != NULL) {
1189 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
1190 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
1191 	} else {
1192 		to_be32(&rsph->exp_cmd_sn, rsp_pdu->cmd_sn);
1193 		to_be32(&rsph->max_cmd_sn, rsp_pdu->cmd_sn);
1194 	}
1195 
1196 	SPDK_LOGDUMP(iscsi, "PDU", (uint8_t *)rsph, ISCSI_BHS_LEN);
1197 	SPDK_LOGDUMP(iscsi, "DATA", rsp_pdu->data, rsp_pdu->data_segment_len);
1198 
1199 	/* Set T/CSG/NSG to reserved if login error. */
1200 	if (rsph->status_class != 0) {
1201 		rsph->flags &= ~(ISCSI_LOGIN_TRANSIT | ISCSI_LOGIN_CURRENT_STAGE_MASK |
1202 				 ISCSI_LOGIN_NEXT_STAGE_MASK);
1203 	}
1204 	iscsi_param_free(params);
1205 	iscsi_conn_write_pdu(conn, rsp_pdu, cb_fn, conn);
1206 }
1207 
1208 /*
1209  * The function which is used to initialize the internal response data
1210  * structure of iscsi login function.
1211  * return:
1212  * 0, success;
1213  * otherwise, error;
1214  */
1215 static int
1216 iscsi_op_login_rsp_init(struct spdk_iscsi_conn *conn,
1217 			struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
1218 {
1219 	struct iscsi_bhs_login_req *reqh;
1220 	struct iscsi_bhs_login_rsp *rsph;
1221 
1222 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1223 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
1224 	rsph->status_class = ISCSI_CLASS_SUCCESS;
1225 	rsph->status_detail = ISCSI_LOGIN_ACCEPT;
1226 	rsp_pdu->data_segment_len = 0;
1227 
1228 	/* The default MaxRecvDataSegmentLength 8192 is used during login. - RFC3720 */
1229 	rsp_pdu->data = calloc(1, 8192);
1230 	if (!rsp_pdu->data) {
1231 		SPDK_ERRLOG("calloc() failed for data segment\n");
1232 		rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1233 		rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1234 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1235 	}
1236 	rsp_pdu->data_buf_len = 8192;
1237 
1238 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1239 	rsph->flags |= (reqh->flags & (ISCSI_LOGIN_TRANSIT | ISCSI_LOGIN_CONTINUE |
1240 				       ISCSI_LOGIN_CURRENT_STAGE_MASK));
1241 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1242 		rsph->flags |= (reqh->flags & ISCSI_LOGIN_NEXT_STAGE_MASK);
1243 	}
1244 
1245 	/* We don't need to convert from network byte order. Just store it */
1246 	memcpy(&rsph->isid, reqh->isid, 6);
1247 	rsph->tsih = reqh->tsih;
1248 	rsph->itt = reqh->itt;
1249 	rsp_pdu->cmd_sn = from_be32(&reqh->cmd_sn);
1250 
1251 	if (rsph->tsih) {
1252 		rsph->stat_sn = reqh->exp_stat_sn;
1253 	}
1254 
1255 	SPDK_LOGDUMP(iscsi, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
1256 
1257 	SPDK_DEBUGLOG(iscsi,
1258 		      "T=%d, C=%d, CSG=%d, NSG=%d, Min=%d, Max=%d, ITT=%x\n",
1259 		      ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags),
1260 		      ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags),
1261 		      ISCSI_BHS_LOGIN_GET_CSG(rsph->flags),
1262 		      ISCSI_BHS_LOGIN_GET_NSG(rsph->flags),
1263 		      reqh->version_min, reqh->version_max, from_be32(&rsph->itt));
1264 
1265 	if (conn->sess != NULL) {
1266 		SPDK_DEBUGLOG(iscsi,
1267 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u,"
1268 			      "MaxCmdSN=%u\n", rsp_pdu->cmd_sn,
1269 			      from_be32(&rsph->stat_sn), conn->StatSN,
1270 			      conn->sess->ExpCmdSN,
1271 			      conn->sess->MaxCmdSN);
1272 	} else {
1273 		SPDK_DEBUGLOG(iscsi,
1274 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
1275 			      rsp_pdu->cmd_sn, from_be32(&rsph->stat_sn),
1276 			      conn->StatSN);
1277 	}
1278 
1279 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags) &&
1280 	    ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags)) {
1281 		SPDK_ERRLOG("transit error\n");
1282 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1283 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1284 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1285 	}
1286 	/* make sure reqh->version_max < ISCSI_VERSION */
1287 	if (reqh->version_min > ISCSI_VERSION) {
1288 		SPDK_ERRLOG("unsupported version min %d/max %d, expecting %d\n", reqh->version_min,
1289 			    reqh->version_max, ISCSI_VERSION);
1290 		/* Unsupported version */
1291 		/* set all reserved flag to zero */
1292 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1293 		rsph->status_detail = ISCSI_LOGIN_UNSUPPORTED_VERSION;
1294 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1295 	}
1296 
1297 	if ((ISCSI_BHS_LOGIN_GET_NSG(rsph->flags) == ISCSI_NSG_RESERVED_CODE) &&
1298 	    ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1299 		/* set NSG and other bits to zero */
1300 		rsph->flags &= ~(ISCSI_LOGIN_NEXT_STAGE_MASK | ISCSI_LOGIN_TRANSIT |
1301 				 ISCSI_LOGIN_CURRENT_STAGE_MASK);
1302 		SPDK_ERRLOG("Received reserved NSG code: %d\n", ISCSI_NSG_RESERVED_CODE);
1303 		/* Initiator error */
1304 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1305 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1306 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1307 	}
1308 
1309 	return 0;
1310 }
1311 
1312 static int
1313 iscsi_op_login_store_incoming_params(struct spdk_iscsi_conn *conn,
1314 				     struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu,
1315 				     struct iscsi_param **params)
1316 {
1317 	struct iscsi_bhs_login_req *reqh;
1318 	struct iscsi_bhs_login_rsp *rsph;
1319 	int rc;
1320 
1321 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1322 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1323 
1324 	rc = iscsi_parse_params(params, pdu->data,
1325 				pdu->data_segment_len, ISCSI_BHS_LOGIN_GET_CBIT(reqh->flags),
1326 				&conn->partial_text_parameter);
1327 	if (rc < 0) {
1328 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
1329 		iscsi_param_free(*params);
1330 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1331 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1332 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1333 	}
1334 
1335 	return 0;
1336 }
1337 
1338 /*
1339  * This function is used to initialize the port info
1340  * return
1341  * 0: success
1342  * otherwise: error
1343  */
1344 static int
1345 iscsi_op_login_initialize_port(struct spdk_iscsi_conn *conn,
1346 			       struct spdk_iscsi_pdu *rsp_pdu,
1347 			       char *initiator_port_name,
1348 			       uint32_t name_length,
1349 			       struct iscsi_param *params)
1350 {
1351 	const char *val;
1352 	struct iscsi_bhs_login_rsp *rsph;
1353 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1354 
1355 	/* Initiator Name and Port */
1356 	val = iscsi_param_get_val(params, "InitiatorName");
1357 	if (val == NULL) {
1358 		SPDK_ERRLOG("InitiatorName is empty\n");
1359 		/* Missing parameter */
1360 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1361 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1362 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1363 	}
1364 	snprintf(conn->initiator_name, sizeof(conn->initiator_name), "%s", val);
1365 	snprintf(initiator_port_name, name_length,
1366 		 "%s,i,0x%12.12" PRIx64, val, iscsi_get_isid(rsph->isid));
1367 	spdk_strlwr(conn->initiator_name);
1368 	spdk_strlwr(initiator_port_name);
1369 	SPDK_DEBUGLOG(iscsi, "Initiator name: %s\n", conn->initiator_name);
1370 	SPDK_DEBUGLOG(iscsi, "Initiator port: %s\n", initiator_port_name);
1371 
1372 	return 0;
1373 }
1374 
1375 /*
1376  * This function is used to judge the session type
1377  * return
1378  * 0: success
1379  * Other value: error
1380  */
1381 static int
1382 iscsi_op_login_session_type(struct spdk_iscsi_conn *conn,
1383 			    struct spdk_iscsi_pdu *rsp_pdu,
1384 			    enum session_type *session_type,
1385 			    struct iscsi_param *params)
1386 {
1387 	const char *session_type_str;
1388 	struct iscsi_bhs_login_rsp *rsph;
1389 
1390 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1391 	session_type_str = iscsi_param_get_val(params, "SessionType");
1392 	if (session_type_str == NULL) {
1393 		if (rsph->tsih != 0) {
1394 			*session_type = SESSION_TYPE_NORMAL;
1395 		} else {
1396 			SPDK_ERRLOG("SessionType is empty\n");
1397 			/* Missing parameter */
1398 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1399 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1400 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1401 		}
1402 	} else {
1403 		if (strcasecmp(session_type_str, "Discovery") == 0) {
1404 			*session_type = SESSION_TYPE_DISCOVERY;
1405 		} else if (strcasecmp(session_type_str, "Normal") == 0) {
1406 			*session_type = SESSION_TYPE_NORMAL;
1407 		} else {
1408 			*session_type = SESSION_TYPE_INVALID;
1409 			SPDK_ERRLOG("SessionType is invalid\n");
1410 			/* Missing parameter */
1411 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1412 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1413 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1414 		}
1415 	}
1416 	SPDK_DEBUGLOG(iscsi, "Session Type: %s\n", session_type_str);
1417 
1418 	return 0;
1419 }
1420 
1421 /*
1422  * This function is used to check the target info
1423  * return:
1424  * 0: success
1425  * otherwise: error
1426  */
1427 static int
1428 iscsi_op_login_check_target(struct spdk_iscsi_conn *conn,
1429 			    struct spdk_iscsi_pdu *rsp_pdu,
1430 			    const char *target_name,
1431 			    struct spdk_iscsi_tgt_node **target)
1432 {
1433 	struct iscsi_bhs_login_rsp *rsph;
1434 	char buf[MAX_TMPBUF] = {};
1435 
1436 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1437 	*target = iscsi_find_tgt_node(target_name);
1438 	if (*target == NULL) {
1439 		SPDK_WARNLOG("target %s not found\n", target_name);
1440 		/* Not found */
1441 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1442 		rsph->status_detail = ISCSI_LOGIN_TARGET_NOT_FOUND;
1443 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1444 	}
1445 	if (iscsi_tgt_node_is_destructed(*target)) {
1446 		SPDK_ERRLOG("target %s is removed\n", target_name);
1447 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1448 		rsph->status_detail = ISCSI_LOGIN_TARGET_REMOVED;
1449 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1450 	}
1451 	if (iscsi_tgt_node_is_redirected(conn, *target, buf, MAX_TMPBUF)) {
1452 		SPDK_INFOLOG(iscsi, "target %s is redirected\n", target_name);
1453 		rsp_pdu->data_segment_len = iscsi_append_text("TargetAddress",
1454 					    buf,
1455 					    rsp_pdu->data,
1456 					    rsp_pdu->data_buf_len,
1457 					    rsp_pdu->data_segment_len);
1458 		rsph->status_class = ISCSI_CLASS_REDIRECT;
1459 		rsph->status_detail = ISCSI_LOGIN_TARGET_TEMPORARILY_MOVED;
1460 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1461 	}
1462 	if (!iscsi_tgt_node_access(conn, *target, conn->initiator_name,
1463 				   conn->initiator_addr)) {
1464 		SPDK_ERRLOG("access denied\n");
1465 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1466 		rsph->status_detail = ISCSI_LOGIN_AUTHORIZATION_FAIL;
1467 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1468 	}
1469 
1470 	return 0;
1471 }
1472 
1473 /*
1474  * This function use to check the session
1475  * return:
1476  * 0, success
1477  * otherwise: error
1478  */
1479 static int
1480 iscsi_op_login_check_session(struct spdk_iscsi_conn *conn,
1481 			     struct spdk_iscsi_pdu *rsp_pdu,
1482 			     char *initiator_port_name, int cid)
1483 
1484 {
1485 	int rc = 0;
1486 	struct iscsi_bhs_login_rsp *rsph;
1487 
1488 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1489 	/* check existing session */
1490 	SPDK_DEBUGLOG(iscsi, "isid=%"PRIx64", tsih=%u, cid=%u\n",
1491 		      iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih), cid);
1492 	if (rsph->tsih != 0) {
1493 		/* multiple connections */
1494 		rc = append_iscsi_sess(conn, initiator_port_name,
1495 				       from_be16(&rsph->tsih), cid);
1496 		if (rc != 0) {
1497 			SPDK_ERRLOG("isid=%"PRIx64", tsih=%u, cid=%u:"
1498 				    "spdk_append_iscsi_sess() failed\n",
1499 				    iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih),
1500 				    cid);
1501 			/* Can't include in session */
1502 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1503 			rsph->status_detail = rc;
1504 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1505 		}
1506 	} else if (!g_iscsi.AllowDuplicateIsid) {
1507 		/* new session, drop old sess by the initiator */
1508 		iscsi_drop_conns(conn, initiator_port_name, 0 /* drop old */);
1509 	}
1510 
1511 	return rc;
1512 }
1513 
1514 /*
1515  * This function is used to del the original param and update it with new
1516  * value
1517  * return:
1518  * 0: success
1519  * otherwise: error
1520  */
1521 static int
1522 iscsi_op_login_update_param(struct spdk_iscsi_conn *conn,
1523 			    const char *key, const char *value,
1524 			    const char *list)
1525 {
1526 	int rc = 0;
1527 	struct iscsi_param *new_param, *orig_param;
1528 	int index;
1529 
1530 	orig_param = iscsi_param_find(conn->params, key);
1531 	if (orig_param == NULL) {
1532 		SPDK_ERRLOG("orig_param %s not found\n", key);
1533 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1534 	}
1535 
1536 	index = orig_param->state_index;
1537 	rc = iscsi_param_del(&conn->params, key);
1538 	if (rc < 0) {
1539 		SPDK_ERRLOG("iscsi_param_del(%s) failed\n", key);
1540 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1541 	}
1542 	rc = iscsi_param_add(&conn->params, key, value, list, ISPT_LIST);
1543 	if (rc < 0) {
1544 		SPDK_ERRLOG("iscsi_param_add() failed\n");
1545 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1546 	}
1547 	new_param = iscsi_param_find(conn->params, key);
1548 	if (new_param == NULL) {
1549 		SPDK_ERRLOG("iscsi_param_find() failed\n");
1550 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1551 	}
1552 	new_param->state_index = index;
1553 	return rc;
1554 }
1555 
1556 static int
1557 iscsi_negotiate_chap_param(struct spdk_iscsi_conn *conn)
1558 {
1559 	int rc = 0;
1560 
1561 	if (conn->disable_chap) {
1562 		rc = iscsi_op_login_update_param(conn, "AuthMethod", "None", "None");
1563 	} else if (conn->require_chap) {
1564 		rc = iscsi_op_login_update_param(conn, "AuthMethod", "CHAP", "CHAP");
1565 	}
1566 
1567 	return rc;
1568 }
1569 
1570 /*
1571  * The function which is used to handle the part of session discovery
1572  * return:
1573  * 0, success;
1574  * otherwise: error;
1575  */
1576 static int
1577 iscsi_op_login_session_discovery_chap(struct spdk_iscsi_conn *conn)
1578 {
1579 	return iscsi_negotiate_chap_param(conn);
1580 }
1581 
1582 /*
1583  * This function is used to update the param related with chap
1584  * return:
1585  * 0: success
1586  * otherwise: error
1587  */
1588 static int
1589 iscsi_op_login_negotiate_chap_param(struct spdk_iscsi_conn *conn,
1590 				    struct spdk_iscsi_tgt_node *target)
1591 {
1592 	conn->disable_chap = target->disable_chap;
1593 	conn->require_chap = target->require_chap;
1594 	conn->mutual_chap = target->mutual_chap;
1595 	conn->chap_group = target->chap_group;
1596 
1597 	return iscsi_negotiate_chap_param(conn);
1598 }
1599 
1600 static int
1601 iscsi_op_login_negotiate_digest_param(struct spdk_iscsi_conn *conn,
1602 				      struct spdk_iscsi_tgt_node *target)
1603 {
1604 	int rc;
1605 
1606 	if (target->header_digest) {
1607 		/*
1608 		 * User specified header digests, so update the list of
1609 		 *  HeaderDigest values to remove "None" so that only
1610 		 *  initiators who support CRC32C can connect.
1611 		 */
1612 		rc = iscsi_op_login_update_param(conn, "HeaderDigest", "CRC32C", "CRC32C");
1613 		if (rc < 0) {
1614 			return rc;
1615 		}
1616 	}
1617 
1618 	if (target->data_digest) {
1619 		/*
1620 		 * User specified data digests, so update the list of
1621 		 *  DataDigest values to remove "None" so that only
1622 		 *  initiators who support CRC32C can connect.
1623 		 */
1624 		rc = iscsi_op_login_update_param(conn, "DataDigest", "CRC32C", "CRC32C");
1625 		if (rc < 0) {
1626 			return rc;
1627 		}
1628 	}
1629 
1630 	return 0;
1631 }
1632 
1633 /*
1634  * The function which is used to handle the part of normal login session
1635  * return:
1636  * 0, success;
1637  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1638  */
1639 static int
1640 iscsi_op_login_session_normal(struct spdk_iscsi_conn *conn,
1641 			      struct spdk_iscsi_pdu *rsp_pdu,
1642 			      char *initiator_port_name,
1643 			      struct iscsi_param *params,
1644 			      int cid)
1645 {
1646 	struct spdk_iscsi_tgt_node *target = NULL;
1647 	const char *target_name;
1648 	const char *target_short_name;
1649 	struct iscsi_bhs_login_rsp *rsph;
1650 	int rc = 0;
1651 
1652 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1653 	target_name = iscsi_param_get_val(params, "TargetName");
1654 
1655 	if (target_name == NULL) {
1656 		SPDK_ERRLOG("TargetName is empty\n");
1657 		/* Missing parameter */
1658 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1659 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1660 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1661 	}
1662 
1663 	memset(conn->target_short_name, 0, MAX_TARGET_NAME);
1664 	target_short_name = strstr(target_name, ":");
1665 	if (target_short_name != NULL) {
1666 		target_short_name++; /* Advance past the ':' */
1667 		if (strlen(target_short_name) >= MAX_TARGET_NAME) {
1668 			SPDK_ERRLOG("Target Short Name (%s) is more than %u characters\n",
1669 				    target_short_name, MAX_TARGET_NAME);
1670 			/* Invalid request */
1671 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1672 			rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
1673 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1674 		}
1675 		snprintf(conn->target_short_name, MAX_TARGET_NAME, "%s",
1676 			 target_short_name);
1677 	}
1678 
1679 	pthread_mutex_lock(&g_iscsi.mutex);
1680 	rc = iscsi_op_login_check_target(conn, rsp_pdu, target_name, &target);
1681 	pthread_mutex_unlock(&g_iscsi.mutex);
1682 
1683 	if (rc < 0) {
1684 		return rc;
1685 	}
1686 
1687 	conn->target = target;
1688 	conn->dev = target->dev;
1689 	conn->target_port = spdk_scsi_dev_find_port_by_id(target->dev,
1690 			    conn->pg_tag);
1691 
1692 	rc = iscsi_op_login_check_session(conn, rsp_pdu,
1693 					  initiator_port_name, cid);
1694 	if (rc < 0) {
1695 		return rc;
1696 	}
1697 
1698 	/* force target flags */
1699 	pthread_mutex_lock(&target->mutex);
1700 	rc = iscsi_op_login_negotiate_chap_param(conn, target);
1701 	pthread_mutex_unlock(&target->mutex);
1702 
1703 	if (rc == 0) {
1704 		rc = iscsi_op_login_negotiate_digest_param(conn, target);
1705 	}
1706 
1707 	if (rc != 0) {
1708 		/* Invalid request */
1709 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1710 		rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
1711 	}
1712 
1713 	return rc;
1714 }
1715 
1716 /*
1717  * This function is used to set the info in the connection data structure
1718  * return
1719  * 0: success
1720  * otherwise: error
1721  */
1722 static int
1723 iscsi_op_login_set_conn_info(struct spdk_iscsi_conn *conn,
1724 			     struct spdk_iscsi_pdu *rsp_pdu,
1725 			     char *initiator_port_name,
1726 			     enum session_type session_type, int cid)
1727 {
1728 	int rc = 0;
1729 	struct spdk_iscsi_tgt_node *target;
1730 	struct iscsi_bhs_login_rsp *rsph;
1731 	struct spdk_scsi_port *initiator_port;
1732 
1733 	target = conn->target;
1734 
1735 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1736 	conn->authenticated = false;
1737 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1738 	conn->cid = cid;
1739 
1740 	if (conn->sess == NULL) {
1741 		/* create initiator port */
1742 		initiator_port = spdk_scsi_port_create(iscsi_get_isid(rsph->isid), 0, initiator_port_name);
1743 		if (initiator_port == NULL) {
1744 			SPDK_ERRLOG("create_port() failed\n");
1745 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1746 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1747 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1748 		}
1749 
1750 		/* new session */
1751 		rc = create_iscsi_sess(conn, target, session_type);
1752 		if (rc < 0) {
1753 			spdk_scsi_port_free(&initiator_port);
1754 			SPDK_ERRLOG("create_sess() failed\n");
1755 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1756 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1757 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1758 		}
1759 		/* initialize parameters */
1760 		conn->sess->initiator_port = initiator_port;
1761 		conn->StatSN = from_be32(&rsph->stat_sn);
1762 		conn->sess->isid = iscsi_get_isid(rsph->isid);
1763 
1764 		/* Initiator port TransportID */
1765 		spdk_scsi_port_set_iscsi_transport_id(conn->sess->initiator_port,
1766 						      conn->initiator_name,
1767 						      conn->sess->isid);
1768 
1769 		/* Discovery sessions will not have a target. */
1770 		if (target != NULL) {
1771 			conn->sess->queue_depth = target->queue_depth;
1772 		} else {
1773 			/*
1774 			 * Assume discovery sessions have an effective command
1775 			 *  windows size of 1.
1776 			 */
1777 			conn->sess->queue_depth = 1;
1778 		}
1779 		conn->sess->ExpCmdSN = rsp_pdu->cmd_sn;
1780 		conn->sess->MaxCmdSN = rsp_pdu->cmd_sn + conn->sess->queue_depth - 1;
1781 	}
1782 
1783 	conn->initiator_port = conn->sess->initiator_port;
1784 
1785 	return 0;
1786 }
1787 
1788 /*
1789  * This function is used to set the target info
1790  * return
1791  * 0: success
1792  * otherwise: error
1793  */
1794 static int
1795 iscsi_op_login_set_target_info(struct spdk_iscsi_conn *conn,
1796 			       struct spdk_iscsi_pdu *rsp_pdu,
1797 			       enum session_type session_type)
1798 {
1799 	char buf[MAX_TMPBUF];
1800 	const char *val;
1801 	int rc = 0;
1802 	struct spdk_iscsi_tgt_node *target = conn->target;
1803 
1804 	/* declarative parameters */
1805 	if (target != NULL) {
1806 		pthread_mutex_lock(&target->mutex);
1807 		if (target->alias[0] != '\0') {
1808 			snprintf(buf, sizeof buf, "%s", target->alias);
1809 		} else {
1810 			snprintf(buf, sizeof buf, "%s", "");
1811 		}
1812 		pthread_mutex_unlock(&target->mutex);
1813 		rc = iscsi_param_set(conn->sess->params, "TargetAlias", buf);
1814 		if (rc < 0) {
1815 			SPDK_ERRLOG("iscsi_param_set() failed\n");
1816 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1817 		}
1818 	}
1819 	snprintf(buf, sizeof buf, "%s:%s,%d", conn->portal_host, conn->portal_port,
1820 		 conn->pg_tag);
1821 	rc = iscsi_param_set(conn->sess->params, "TargetAddress", buf);
1822 	if (rc < 0) {
1823 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1824 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1825 	}
1826 	snprintf(buf, sizeof buf, "%d", conn->pg_tag);
1827 	rc = iscsi_param_set(conn->sess->params, "TargetPortalGroupTag", buf);
1828 	if (rc < 0) {
1829 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1830 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1831 	}
1832 
1833 	/* write in response */
1834 	if (target != NULL) {
1835 		val = iscsi_param_get_val(conn->sess->params, "TargetAlias");
1836 		if (val != NULL && strlen(val) != 0) {
1837 			rsp_pdu->data_segment_len = iscsi_append_param(conn,
1838 						    "TargetAlias",
1839 						    rsp_pdu->data,
1840 						    rsp_pdu->data_buf_len,
1841 						    rsp_pdu->data_segment_len);
1842 		}
1843 		if (session_type == SESSION_TYPE_DISCOVERY) {
1844 			rsp_pdu->data_segment_len = iscsi_append_param(conn,
1845 						    "TargetAddress",
1846 						    rsp_pdu->data,
1847 						    rsp_pdu->data_buf_len,
1848 						    rsp_pdu->data_segment_len);
1849 		}
1850 		rsp_pdu->data_segment_len = iscsi_append_param(conn,
1851 					    "TargetPortalGroupTag",
1852 					    rsp_pdu->data,
1853 					    rsp_pdu->data_buf_len,
1854 					    rsp_pdu->data_segment_len);
1855 	}
1856 
1857 	return rc;
1858 }
1859 
1860 /*
1861  * This function is used to handle the login of iscsi initiator when there is
1862  * no session
1863  * return:
1864  * 0, success;
1865  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1866  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify the login fail.
1867  */
1868 static int
1869 iscsi_op_login_phase_none(struct spdk_iscsi_conn *conn,
1870 			  struct spdk_iscsi_pdu *rsp_pdu,
1871 			  struct iscsi_param *params, int cid)
1872 {
1873 	enum session_type session_type;
1874 	char initiator_port_name[MAX_INITIATOR_PORT_NAME];
1875 	struct iscsi_bhs_login_rsp *rsph;
1876 	int rc = 0;
1877 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1878 
1879 	conn->target = NULL;
1880 	conn->dev = NULL;
1881 
1882 	rc = iscsi_op_login_initialize_port(conn, rsp_pdu, initiator_port_name,
1883 					    MAX_INITIATOR_PORT_NAME, params);
1884 	if (rc < 0) {
1885 		return rc;
1886 	}
1887 
1888 	rc = iscsi_op_login_session_type(conn, rsp_pdu, &session_type, params);
1889 	if (rc < 0) {
1890 		return rc;
1891 	}
1892 
1893 	/* Target Name and Port */
1894 	if (session_type == SESSION_TYPE_NORMAL) {
1895 		rc = iscsi_op_login_session_normal(conn, rsp_pdu,
1896 						   initiator_port_name,
1897 						   params, cid);
1898 		if (rc < 0) {
1899 			return rc;
1900 		}
1901 
1902 	} else if (session_type == SESSION_TYPE_DISCOVERY) {
1903 		rsph->tsih = 0;
1904 
1905 		/* force target flags */
1906 		pthread_mutex_lock(&g_iscsi.mutex);
1907 		rc = iscsi_op_login_session_discovery_chap(conn);
1908 		pthread_mutex_unlock(&g_iscsi.mutex);
1909 		if (rc < 0) {
1910 			return rc;
1911 		}
1912 	} else {
1913 		SPDK_ERRLOG("unknown session type\n");
1914 		/* Missing parameter */
1915 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1916 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1917 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1918 	}
1919 
1920 	rc = iscsi_op_login_set_conn_info(conn, rsp_pdu, initiator_port_name,
1921 					  session_type, cid);
1922 	if (rc < 0) {
1923 		return rc;
1924 	}
1925 
1926 	/* limit conns on discovery session */
1927 	if (session_type == SESSION_TYPE_DISCOVERY) {
1928 		conn->sess->MaxConnections = 1;
1929 		rc = iscsi_param_set_int(conn->sess->params,
1930 					 "MaxConnections",
1931 					 conn->sess->MaxConnections);
1932 		if (rc < 0) {
1933 			SPDK_ERRLOG("iscsi_param_set_int() failed\n");
1934 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1935 		}
1936 	}
1937 
1938 	return iscsi_op_login_set_target_info(conn, rsp_pdu, session_type);
1939 }
1940 
1941 /*
1942  * This function is used to set the csg bit case in rsp
1943  * return:
1944  * 0, success
1945  * otherwise: error
1946  */
1947 static int
1948 iscsi_op_login_rsp_handle_csg_bit(struct spdk_iscsi_conn *conn,
1949 				  struct spdk_iscsi_pdu *rsp_pdu,
1950 				  struct iscsi_param *params)
1951 {
1952 	const char *auth_method;
1953 	int rc;
1954 	struct iscsi_bhs_login_rsp *rsph;
1955 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1956 
1957 	switch (ISCSI_BHS_LOGIN_GET_CSG(rsph->flags)) {
1958 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
1959 		/* SecurityNegotiation */
1960 		auth_method = iscsi_param_get_val(conn->params, "AuthMethod");
1961 		if (auth_method == NULL) {
1962 			SPDK_ERRLOG("AuthMethod is empty\n");
1963 			/* Missing parameter */
1964 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1965 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1966 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1967 		}
1968 		if (strcasecmp(auth_method, "None") == 0) {
1969 			conn->authenticated = true;
1970 		} else {
1971 			rc = iscsi_auth_params(conn, params, auth_method,
1972 					       rsp_pdu->data, rsp_pdu->data_buf_len,
1973 					       rsp_pdu->data_segment_len);
1974 			if (rc < 0) {
1975 				SPDK_ERRLOG("iscsi_auth_params() failed\n");
1976 				/* Authentication failure */
1977 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1978 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1979 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1980 			}
1981 			rsp_pdu->data_segment_len = rc;
1982 			if (!conn->authenticated) {
1983 				/* not complete */
1984 				rsph->flags &= ~ISCSI_LOGIN_TRANSIT;
1985 			} else {
1986 				if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_END) {
1987 					SPDK_DEBUGLOG(iscsi, "CHAP phase not complete");
1988 				}
1989 			}
1990 
1991 			SPDK_LOGDUMP(iscsi, "Negotiated Auth Params",
1992 				     rsp_pdu->data, rsp_pdu->data_segment_len);
1993 		}
1994 		break;
1995 
1996 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
1997 		/* LoginOperationalNegotiation */
1998 		if (conn->state == ISCSI_CONN_STATE_INVALID) {
1999 			if (conn->require_chap) {
2000 				/* Authentication failure */
2001 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2002 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
2003 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2004 			} else {
2005 				/* AuthMethod=None */
2006 				conn->authenticated = true;
2007 			}
2008 		}
2009 		if (!conn->authenticated) {
2010 			SPDK_ERRLOG("authentication error\n");
2011 			/* Authentication failure */
2012 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2013 			rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
2014 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2015 		}
2016 		break;
2017 
2018 	case ISCSI_FULL_FEATURE_PHASE:
2019 		/* FullFeaturePhase */
2020 		SPDK_ERRLOG("XXX Login in FullFeaturePhase\n");
2021 		/* Initiator error */
2022 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2023 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2024 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2025 
2026 	default:
2027 		SPDK_ERRLOG("unknown stage\n");
2028 		/* Initiator error */
2029 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2030 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2031 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2032 	}
2033 
2034 	return 0;
2035 }
2036 
2037 /* This function is used to notify the session info
2038  * return
2039  * 0: success
2040  * otherwise: error
2041  */
2042 static int
2043 iscsi_op_login_notify_session_info(struct spdk_iscsi_conn *conn,
2044 				   struct spdk_iscsi_pdu *rsp_pdu)
2045 {
2046 	struct iscsi_bhs_login_rsp *rsph;
2047 
2048 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2049 	if (conn->sess->session_type == SESSION_TYPE_NORMAL) {
2050 		/* normal session */
2051 		SPDK_DEBUGLOG(iscsi, "Login from %s (%s) on %s tgt_node%d"
2052 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2053 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2054 			      conn->initiator_name, conn->initiator_addr,
2055 			      conn->target->name, conn->target->num,
2056 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2057 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2058 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2059 			       ? "on" : "off"),
2060 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2061 			       ? "on" : "off"));
2062 	} else if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2063 		/* discovery session */
2064 		SPDK_DEBUGLOG(iscsi, "Login(discovery) from %s (%s) on"
2065 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2066 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2067 			      conn->initiator_name, conn->initiator_addr,
2068 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2069 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2070 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2071 			       ? "on" : "off"),
2072 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2073 			       ? "on" : "off"));
2074 	} else {
2075 		SPDK_ERRLOG("unknown session type\n");
2076 		/* Initiator error */
2077 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2078 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2079 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2080 	}
2081 
2082 	return 0;
2083 }
2084 
2085 /*
2086  * This function is to handle the tbit cases
2087  * return
2088  * 0: success
2089  * otherwise error
2090  */
2091 static int
2092 iscsi_op_login_rsp_handle_t_bit(struct spdk_iscsi_conn *conn,
2093 				struct spdk_iscsi_pdu *rsp_pdu)
2094 {
2095 	int rc;
2096 	struct iscsi_bhs_login_rsp *rsph;
2097 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2098 
2099 	switch (ISCSI_BHS_LOGIN_GET_NSG(rsph->flags)) {
2100 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
2101 		/* SecurityNegotiation */
2102 		conn->login_phase = ISCSI_SECURITY_NEGOTIATION_PHASE;
2103 		break;
2104 
2105 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
2106 		/* LoginOperationalNegotiation */
2107 		conn->login_phase = ISCSI_OPERATIONAL_NEGOTIATION_PHASE;
2108 		break;
2109 
2110 	case ISCSI_FULL_FEATURE_PHASE:
2111 		/* FullFeaturePhase */
2112 		conn->login_phase = ISCSI_FULL_FEATURE_PHASE;
2113 		to_be16(&rsph->tsih, conn->sess->tsih);
2114 
2115 		rc = iscsi_op_login_notify_session_info(conn, rsp_pdu);
2116 		if (rc < 0) {
2117 			return rc;
2118 		}
2119 
2120 		conn->full_feature = 1;
2121 		break;
2122 
2123 	default:
2124 		SPDK_ERRLOG("unknown stage\n");
2125 		/* Initiator error */
2126 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2127 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2128 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2129 	}
2130 
2131 	return 0;
2132 }
2133 
2134 /*
2135  * This function is used to set the values of the internal data structure used
2136  * by spdk_iscsi_op_login function
2137  * return:
2138  * 0, used to notify the a successful login
2139  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify a failure login.
2140  */
2141 static int
2142 iscsi_op_login_rsp_handle(struct spdk_iscsi_conn *conn,
2143 			  struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param **params)
2144 {
2145 	int rc;
2146 	struct iscsi_bhs_login_rsp *rsph;
2147 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2148 
2149 	/* negotiate parameters */
2150 	rc = iscsi_negotiate_params(conn, params, rsp_pdu->data,
2151 				    rsp_pdu->data_buf_len,
2152 				    rsp_pdu->data_segment_len);
2153 	if (rc < 0) {
2154 		/*
2155 		 * iscsi_negotiate_params just returns -1 on failure,
2156 		 *  so translate this into meaningful response codes and
2157 		 *  return values.
2158 		 */
2159 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2160 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2161 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2162 	}
2163 
2164 	rsp_pdu->data_segment_len = rc;
2165 	SPDK_LOGDUMP(iscsi, "Negotiated Params", rsp_pdu->data, rc);
2166 
2167 	/* handle the CSG bit case */
2168 	rc = iscsi_op_login_rsp_handle_csg_bit(conn, rsp_pdu, *params);
2169 	if (rc < 0) {
2170 		return rc;
2171 	}
2172 
2173 	/* handle the T bit case */
2174 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
2175 		rc = iscsi_op_login_rsp_handle_t_bit(conn, rsp_pdu);
2176 	}
2177 
2178 	return rc;
2179 }
2180 
2181 static int
2182 iscsi_pdu_hdr_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2183 {
2184 	int rc;
2185 	struct iscsi_bhs_login_req *reqh;
2186 	struct spdk_iscsi_pdu *rsp_pdu;
2187 
2188 	if (conn->full_feature && conn->sess != NULL &&
2189 	    conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2190 		return SPDK_ISCSI_CONNECTION_FATAL;
2191 	}
2192 
2193 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
2194 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
2195 
2196 	/* During login processing, use the 8KB default FirstBurstLength as
2197 	 *  our maximum data segment length value.
2198 	 */
2199 	if (pdu->data_segment_len > SPDK_ISCSI_FIRST_BURST_LENGTH) {
2200 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2201 	}
2202 
2203 	rsp_pdu = iscsi_get_pdu(conn);
2204 	if (rsp_pdu == NULL) {
2205 		return SPDK_ISCSI_CONNECTION_FATAL;
2206 	}
2207 	rc = iscsi_op_login_rsp_init(conn, pdu, rsp_pdu);
2208 	if (rc < 0) {
2209 		iscsi_op_login_response(conn, rsp_pdu, NULL, iscsi_conn_login_pdu_err_complete);
2210 		return 0;
2211 	}
2212 
2213 	conn->login_rsp_pdu = rsp_pdu;
2214 	return 0;
2215 }
2216 
2217 static int
2218 iscsi_pdu_payload_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2219 {
2220 	int rc;
2221 	struct iscsi_bhs_login_req *reqh;
2222 	struct spdk_iscsi_pdu *rsp_pdu;
2223 	struct iscsi_param *params = NULL;
2224 	int cid;
2225 
2226 	if (conn->login_rsp_pdu == NULL) {
2227 		return 0;
2228 	}
2229 
2230 	spdk_poller_unregister(&conn->login_timer);
2231 	rsp_pdu = conn->login_rsp_pdu;
2232 
2233 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
2234 	cid = from_be16(&reqh->cid);
2235 
2236 	rc = iscsi_op_login_store_incoming_params(conn, pdu, rsp_pdu, &params);
2237 	if (rc < 0) {
2238 		iscsi_op_login_response(conn, rsp_pdu, NULL, iscsi_conn_login_pdu_err_complete);
2239 		return 0;
2240 	}
2241 
2242 	if (conn->state == ISCSI_CONN_STATE_INVALID) {
2243 		rc = iscsi_op_login_phase_none(conn, rsp_pdu, params, cid);
2244 		if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE || rc == SPDK_ISCSI_LOGIN_ERROR_PARAMETER) {
2245 			iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_err_complete);
2246 			return 0;
2247 		}
2248 	}
2249 
2250 	rc = iscsi_op_login_rsp_handle(conn, rsp_pdu, &params);
2251 	if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE) {
2252 		iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_err_complete);
2253 		return 0;
2254 	}
2255 
2256 	iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_success_complete);
2257 	return 0;
2258 }
2259 
2260 static int
2261 iscsi_pdu_hdr_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2262 {
2263 	uint32_t task_tag;
2264 	uint32_t ExpStatSN;
2265 	int F_bit, C_bit;
2266 	struct iscsi_bhs_text_req *reqh;
2267 
2268 	if (pdu->data_segment_len > iscsi_get_max_immediate_data_size()) {
2269 		SPDK_ERRLOG("data segment len(=%zu) > immediate data len(=%"PRIu32")\n",
2270 			    pdu->data_segment_len, iscsi_get_max_immediate_data_size());
2271 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2272 	}
2273 
2274 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2275 
2276 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2277 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2278 	task_tag = from_be32(&reqh->itt);
2279 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2280 
2281 	SPDK_DEBUGLOG(iscsi, "I=%d, F=%d, C=%d, ITT=%x, TTT=%x\n",
2282 		      reqh->immediate, F_bit, C_bit, task_tag, from_be32(&reqh->ttt));
2283 
2284 	SPDK_DEBUGLOG(iscsi,
2285 		      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2286 		      pdu->cmd_sn, ExpStatSN, conn->StatSN, conn->sess->ExpCmdSN,
2287 		      conn->sess->MaxCmdSN);
2288 
2289 	if (ExpStatSN != conn->StatSN) {
2290 #if 0
2291 		SPDK_ERRLOG("StatSN(%u) error\n", ExpStatSN);
2292 		return -1;
2293 #else
2294 		/* StarPort have a bug */
2295 		SPDK_DEBUGLOG(iscsi, "StatSN(%u) rewound\n", ExpStatSN);
2296 		conn->StatSN = ExpStatSN;
2297 #endif
2298 	}
2299 
2300 	if (F_bit && C_bit) {
2301 		SPDK_ERRLOG("final and continue\n");
2302 		return -1;
2303 	}
2304 
2305 	/*
2306 	 * If this is the first text op in a sequence, save the ITT so we can
2307 	 * compare it against the ITT for subsequent ops in the same sequence.
2308 	 * If a subsequent text op in same sequence has a different ITT, reject
2309 	 * that PDU.
2310 	 */
2311 	if (conn->sess->current_text_itt == 0xffffffffU) {
2312 		conn->sess->current_text_itt = task_tag;
2313 	} else if (conn->sess->current_text_itt != task_tag) {
2314 		SPDK_ERRLOG("The correct itt is %u, and the current itt is %u...\n",
2315 			    conn->sess->current_text_itt, task_tag);
2316 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2317 	}
2318 
2319 	return 0;
2320 }
2321 
2322 static void
2323 iscsi_conn_text_pdu_complete(void *arg)
2324 {
2325 	struct spdk_iscsi_conn *conn = arg;
2326 
2327 	iscsi_conn_params_update(conn);
2328 }
2329 
2330 static int
2331 iscsi_pdu_payload_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2332 {
2333 	struct iscsi_param *params = NULL;
2334 	struct spdk_iscsi_pdu *rsp_pdu;
2335 	uint8_t *data;
2336 	uint64_t lun;
2337 	uint32_t task_tag;
2338 	const char *val;
2339 	int F_bit, C_bit;
2340 	int data_len;
2341 	int alloc_len;
2342 	int rc;
2343 	struct iscsi_bhs_text_req *reqh;
2344 	struct iscsi_bhs_text_resp *rsph;
2345 
2346 	data_len = 0;
2347 	alloc_len = conn->MaxRecvDataSegmentLength;
2348 
2349 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2350 
2351 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2352 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2353 	lun = from_be64(&reqh->lun);
2354 	task_tag = from_be32(&reqh->itt);
2355 
2356 	/* store incoming parameters */
2357 	rc = iscsi_parse_params(&params, pdu->data, pdu->data_segment_len,
2358 				C_bit, &conn->partial_text_parameter);
2359 	if (rc < 0) {
2360 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
2361 		iscsi_param_free(params);
2362 		return -1;
2363 	}
2364 
2365 	if (pdu->data_segment_len == 0 && params == NULL) {
2366 		params = conn->params_text;
2367 		conn->params_text = NULL;
2368 	}
2369 
2370 	data = calloc(1, alloc_len);
2371 	if (!data) {
2372 		SPDK_ERRLOG("calloc() failed for data segment\n");
2373 		iscsi_param_free(params);
2374 		return -ENOMEM;
2375 	}
2376 
2377 	/* negotiate parameters */
2378 	data_len = iscsi_negotiate_params(conn, &params,
2379 					  data, alloc_len, data_len);
2380 	if (data_len < 0) {
2381 		SPDK_ERRLOG("iscsi_negotiate_params() failed\n");
2382 		iscsi_param_free(params);
2383 		free(data);
2384 		return -1;
2385 	}
2386 
2387 	/* sendtargets is special case */
2388 	val = iscsi_param_get_val(params, "SendTargets");
2389 	if (val != NULL) {
2390 		if (iscsi_param_eq_val(conn->sess->params,
2391 				       "SessionType", "Discovery")) {
2392 			if (strcasecmp(val, "") == 0) {
2393 				val = "ALL";
2394 			}
2395 
2396 			data_len = iscsi_send_tgts(conn,
2397 						   conn->initiator_name,
2398 						   val, data, alloc_len,
2399 						   data_len);
2400 		} else {
2401 			if (strcasecmp(val, "") == 0) {
2402 				val = conn->target->name;
2403 			}
2404 
2405 			if (strcasecmp(val, "ALL") == 0) {
2406 				/* not in discovery session */
2407 				data_len = iscsi_append_text("SendTargets", "Reject",
2408 							     data, alloc_len, data_len);
2409 			} else {
2410 				data_len = iscsi_send_tgts(conn,
2411 							   conn->initiator_name,
2412 							   val, data, alloc_len,
2413 							   data_len);
2414 			}
2415 		}
2416 
2417 		if (conn->send_tgt_completed_size != 0) {
2418 			F_bit = 0;
2419 			C_bit = 1;
2420 		}
2421 	} else {
2422 		if (iscsi_param_eq_val(conn->sess->params, "SessionType", "Discovery")) {
2423 			iscsi_param_free(params);
2424 			free(data);
2425 			return SPDK_ISCSI_CONNECTION_FATAL;
2426 		}
2427 	}
2428 
2429 	if (spdk_likely(conn->send_tgt_completed_size == 0)) {
2430 		iscsi_param_free(params);
2431 	} else {
2432 		conn->params_text = params;
2433 	}
2434 	SPDK_LOGDUMP(iscsi, "Negotiated Params", data, data_len);
2435 
2436 	/* response PDU */
2437 	rsp_pdu = iscsi_get_pdu(conn);
2438 	if (rsp_pdu == NULL) {
2439 		free(data);
2440 		return SPDK_ISCSI_CONNECTION_FATAL;
2441 	}
2442 	rsph = (struct iscsi_bhs_text_resp *)&rsp_pdu->bhs;
2443 
2444 	rsp_pdu->data = data;
2445 	rsph->opcode = ISCSI_OP_TEXT_RSP;
2446 
2447 	if (F_bit) {
2448 		rsph->flags |= ISCSI_FLAG_FINAL;
2449 	}
2450 
2451 	if (C_bit) {
2452 		rsph->flags |= ISCSI_TEXT_CONTINUE;
2453 	}
2454 
2455 	DSET24(rsph->data_segment_len, data_len);
2456 	to_be64(&rsph->lun, lun);
2457 	to_be32(&rsph->itt, task_tag);
2458 
2459 	if (F_bit) {
2460 		rsph->ttt = 0xffffffffU;
2461 		conn->sess->current_text_itt = 0xffffffffU;
2462 	} else {
2463 		to_be32(&rsph->ttt, 1 + conn->id);
2464 	}
2465 
2466 	to_be32(&rsph->stat_sn, conn->StatSN);
2467 	conn->StatSN++;
2468 
2469 	if (reqh->immediate == 0) {
2470 		conn->sess->MaxCmdSN++;
2471 	}
2472 
2473 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2474 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2475 
2476 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_text_pdu_complete, conn);
2477 	return 0;
2478 }
2479 
2480 static void iscsi_conn_logout_pdu_complete(void *arg)
2481 {
2482 	struct spdk_iscsi_conn *conn = arg;
2483 
2484 	if (conn->sess == NULL) {
2485 		/*
2486 		 * login failed but initiator still sent a logout rather than
2487 		 *  just closing the TCP connection.
2488 		 */
2489 		SPDK_DEBUGLOG(iscsi, "Logout(login failed) from %s (%s) on"
2490 			      " (%s:%s,%d)\n",
2491 			      conn->initiator_name, conn->initiator_addr,
2492 			      conn->portal_host, conn->portal_port, conn->pg_tag);
2493 	} else if (iscsi_param_eq_val(conn->sess->params, "SessionType", "Normal")) {
2494 		SPDK_DEBUGLOG(iscsi, "Logout from %s (%s) on %s tgt_node%d"
2495 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2496 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2497 			      conn->initiator_name, conn->initiator_addr,
2498 			      conn->target->name, conn->target->num,
2499 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2500 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2501 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2502 			       ? "on" : "off"),
2503 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2504 			       ? "on" : "off"));
2505 	} else {
2506 		/* discovery session */
2507 		SPDK_DEBUGLOG(iscsi, "Logout(discovery) from %s (%s) on"
2508 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2509 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2510 			      conn->initiator_name, conn->initiator_addr,
2511 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2512 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2513 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2514 			       ? "on" : "off"),
2515 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2516 			       ? "on" : "off"));
2517 	}
2518 }
2519 
2520 static int
2521 iscsi_pdu_hdr_op_logout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2522 {
2523 	struct spdk_iscsi_pdu *rsp_pdu;
2524 	uint32_t task_tag;
2525 	uint32_t ExpStatSN;
2526 	int response;
2527 	struct iscsi_bhs_logout_req *reqh;
2528 	struct iscsi_bhs_logout_resp *rsph;
2529 	uint16_t cid;
2530 
2531 	reqh = (struct iscsi_bhs_logout_req *)&pdu->bhs;
2532 
2533 	cid = from_be16(&reqh->cid);
2534 	task_tag = from_be32(&reqh->itt);
2535 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2536 
2537 	SPDK_DEBUGLOG(iscsi, "reason=%d, ITT=%x, cid=%d\n",
2538 		      reqh->reason, task_tag, cid);
2539 
2540 	if (conn->sess != NULL) {
2541 		if (conn->sess->session_type == SESSION_TYPE_DISCOVERY &&
2542 		    reqh->reason != ISCSI_LOGOUT_REASON_CLOSE_SESSION) {
2543 			SPDK_ERRLOG("Target can accept logout only with reason \"close the session\" "
2544 				    "on discovery session. %d is not acceptable reason.\n",
2545 				    reqh->reason);
2546 			return SPDK_ISCSI_CONNECTION_FATAL;
2547 		}
2548 
2549 		SPDK_DEBUGLOG(iscsi,
2550 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2551 			      pdu->cmd_sn, ExpStatSN, conn->StatSN,
2552 			      conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
2553 
2554 		if (pdu->cmd_sn != conn->sess->ExpCmdSN) {
2555 			SPDK_DEBUGLOG(iscsi, "CmdSN(%u) might have dropped\n", pdu->cmd_sn);
2556 			/* ignore error */
2557 		}
2558 	} else {
2559 		SPDK_DEBUGLOG(iscsi, "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
2560 			      pdu->cmd_sn, ExpStatSN, conn->StatSN);
2561 	}
2562 
2563 	if (ExpStatSN != conn->StatSN) {
2564 		SPDK_DEBUGLOG(iscsi, "StatSN(%u/%u) might have dropped\n",
2565 			      ExpStatSN, conn->StatSN);
2566 		/* ignore error */
2567 	}
2568 
2569 	if (conn->cid == cid) {
2570 		/* connection or session closed successfully */
2571 		response = 0;
2572 		iscsi_conn_logout(conn);
2573 	} else {
2574 		response = 1;
2575 	}
2576 
2577 	/* response PDU */
2578 	rsp_pdu = iscsi_get_pdu(conn);
2579 	if (rsp_pdu == NULL) {
2580 		return SPDK_ISCSI_CONNECTION_FATAL;
2581 	}
2582 	rsph = (struct iscsi_bhs_logout_resp *)&rsp_pdu->bhs;
2583 	rsp_pdu->data = NULL;
2584 	rsph->opcode = ISCSI_OP_LOGOUT_RSP;
2585 	rsph->flags |= 0x80; /* bit 0 must be 1 */
2586 	rsph->response = response;
2587 	DSET24(rsph->data_segment_len, 0);
2588 	to_be32(&rsph->itt, task_tag);
2589 
2590 	if (conn->sess != NULL) {
2591 		to_be32(&rsph->stat_sn, conn->StatSN);
2592 		conn->StatSN++;
2593 
2594 		if (conn->sess->connections == 1) {
2595 			conn->sess->MaxCmdSN++;
2596 		}
2597 
2598 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2599 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2600 	} else {
2601 		to_be32(&rsph->stat_sn, conn->StatSN);
2602 		conn->StatSN++;
2603 		to_be32(&rsph->exp_cmd_sn, pdu->cmd_sn);
2604 		to_be32(&rsph->max_cmd_sn, pdu->cmd_sn);
2605 	}
2606 
2607 	rsph->time_2_wait = 0;
2608 	rsph->time_2_retain = 0;
2609 
2610 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_logout_pdu_complete, conn);
2611 
2612 	return 0;
2613 }
2614 
2615 static int
2616 iscsi_send_r2t(struct spdk_iscsi_conn *conn,
2617 	       struct spdk_iscsi_task *task, int offset,
2618 	       int len, uint32_t transfer_tag, uint32_t *R2TSN)
2619 {
2620 	struct spdk_iscsi_pdu *rsp_pdu;
2621 	struct iscsi_bhs_r2t *rsph;
2622 	uint64_t fmt_lun;
2623 
2624 	/* R2T PDU */
2625 	rsp_pdu = iscsi_get_pdu(conn);
2626 	if (rsp_pdu == NULL) {
2627 		return SPDK_ISCSI_CONNECTION_FATAL;
2628 	}
2629 	rsph = (struct iscsi_bhs_r2t *)&rsp_pdu->bhs;
2630 	rsp_pdu->data = NULL;
2631 	rsph->opcode = ISCSI_OP_R2T;
2632 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
2633 	fmt_lun = spdk_scsi_lun_id_int_to_fmt(task->lun_id);
2634 	to_be64(&rsph->lun, fmt_lun);
2635 	to_be32(&rsph->itt, task->tag);
2636 	to_be32(&rsph->ttt, transfer_tag);
2637 
2638 	to_be32(&rsph->stat_sn, conn->StatSN);
2639 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2640 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2641 
2642 	to_be32(&rsph->r2t_sn, *R2TSN);
2643 	*R2TSN += 1;
2644 
2645 	task->r2t_datasn = 0; /* next expected datasn to ack */
2646 
2647 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2648 	to_be32(&rsph->desired_xfer_len, (uint32_t)len);
2649 	task->desired_data_transfer_length = (size_t)len;
2650 
2651 	/* we need to hold onto this task/cmd because until the PDU has been
2652 	 * written out */
2653 	rsp_pdu->task = task;
2654 	task->scsi.ref++;
2655 
2656 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
2657 
2658 	return 0;
2659 }
2660 
2661 /* This function is used to remove the r2t pdu from snack_pdu_list by < task, r2t_sn> info */
2662 static struct spdk_iscsi_pdu *
2663 iscsi_remove_r2t_pdu_from_snack_list(struct spdk_iscsi_conn *conn,
2664 				     struct spdk_iscsi_task *task,
2665 				     uint32_t r2t_sn)
2666 {
2667 	struct spdk_iscsi_pdu *pdu;
2668 	struct iscsi_bhs_r2t *r2t_header;
2669 
2670 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
2671 		if (pdu->bhs.opcode == ISCSI_OP_R2T) {
2672 			r2t_header = (struct iscsi_bhs_r2t *)&pdu->bhs;
2673 			if (pdu->task == task &&
2674 			    from_be32(&r2t_header->r2t_sn) == r2t_sn) {
2675 				TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
2676 				return pdu;
2677 			}
2678 		}
2679 	}
2680 
2681 	return NULL;
2682 }
2683 
2684 /* This function is used re-send the r2t packet */
2685 static int
2686 iscsi_send_r2t_recovery(struct spdk_iscsi_conn *conn,
2687 			struct spdk_iscsi_task *task, uint32_t r2t_sn,
2688 			bool send_new_r2tsn)
2689 {
2690 	struct spdk_iscsi_pdu *pdu;
2691 	struct iscsi_bhs_r2t *rsph;
2692 	uint32_t transfer_len;
2693 	uint32_t len;
2694 	int rc;
2695 
2696 	/* remove the r2t pdu from the snack_list */
2697 	pdu = iscsi_remove_r2t_pdu_from_snack_list(conn, task, r2t_sn);
2698 	if (!pdu) {
2699 		SPDK_DEBUGLOG(iscsi, "No pdu is found\n");
2700 		return -1;
2701 	}
2702 
2703 	/* flag
2704 	 * false: only need to re-send the old r2t with changing statsn
2705 	 * true: we send a r2t with new r2tsn
2706 	 */
2707 	if (!send_new_r2tsn) {
2708 		to_be32(&pdu->bhs.stat_sn, conn->StatSN);
2709 		iscsi_conn_write_pdu(conn, pdu, iscsi_conn_pdu_generic_complete, NULL);
2710 	} else {
2711 		rsph = (struct iscsi_bhs_r2t *)&pdu->bhs;
2712 		transfer_len = from_be32(&rsph->desired_xfer_len);
2713 
2714 		/* still need to increase the acked r2tsn */
2715 		task->acked_r2tsn++;
2716 		len = spdk_min(conn->sess->MaxBurstLength,
2717 			       (transfer_len - task->next_expected_r2t_offset));
2718 
2719 		/* remove the old_r2t_pdu */
2720 		iscsi_conn_free_pdu(conn, pdu);
2721 
2722 		/* re-send a new r2t pdu */
2723 		rc = iscsi_send_r2t(conn, task, task->next_expected_r2t_offset,
2724 				    len, task->ttt, &task->R2TSN);
2725 		if (rc < 0) {
2726 			return SPDK_ISCSI_CONNECTION_FATAL;
2727 		}
2728 	}
2729 
2730 	return 0;
2731 }
2732 
2733 static int
2734 add_transfer_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
2735 {
2736 	uint32_t transfer_len;
2737 	size_t max_burst_len;
2738 	size_t segment_len;
2739 	size_t data_len;
2740 	int len;
2741 	int rc;
2742 	int data_out_req;
2743 
2744 	transfer_len = task->scsi.transfer_len;
2745 	data_len = iscsi_task_get_pdu(task)->data_segment_len;
2746 	max_burst_len = conn->sess->MaxBurstLength;
2747 	segment_len = SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH;
2748 	data_out_req = 1 + (transfer_len - data_len - 1) / segment_len;
2749 	task->data_out_cnt = data_out_req;
2750 
2751 	/*
2752 	 * If we already have too many tasks using R2T, then queue this task
2753 	 *  and start sending R2T for it after some of the tasks using R2T/data
2754 	 *  out buffers complete.
2755 	 */
2756 	if (conn->pending_r2t >= g_iscsi.MaxR2TPerConnection) {
2757 		TAILQ_INSERT_TAIL(&conn->queued_r2t_tasks, task, link);
2758 		return 0;
2759 	}
2760 
2761 	conn->data_out_cnt += data_out_req;
2762 	conn->pending_r2t++;
2763 
2764 	task->next_expected_r2t_offset = data_len;
2765 	task->current_r2t_length = 0;
2766 	task->R2TSN = 0;
2767 	/* According to RFC3720 10.8.5, 0xffffffff is
2768 	 * reserved for TTT in R2T.
2769 	 */
2770 	if (++conn->ttt == 0xffffffffu) {
2771 		conn->ttt = 0;
2772 	}
2773 	task->ttt = conn->ttt;
2774 
2775 	while (data_len != transfer_len) {
2776 		len = spdk_min(max_burst_len, (transfer_len - data_len));
2777 		rc = iscsi_send_r2t(conn, task, data_len, len,
2778 				    task->ttt, &task->R2TSN);
2779 		if (rc < 0) {
2780 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
2781 			return rc;
2782 		}
2783 		data_len += len;
2784 		task->next_r2t_offset = data_len;
2785 		task->outstanding_r2t++;
2786 		if (conn->sess->MaxOutstandingR2T == task->outstanding_r2t) {
2787 			break;
2788 		}
2789 	}
2790 
2791 	TAILQ_INSERT_TAIL(&conn->active_r2t_tasks, task, link);
2792 	task->is_r2t_active = true;
2793 	return 0;
2794 }
2795 
2796 /* If there are additional large writes queued for R2Ts, start them now.
2797  *  This is called when a large write is just completed or when multiple LUNs
2798  *  are attached and large write tasks for the specific LUN are cleared.
2799  */
2800 static void
2801 start_queued_transfer_tasks(struct spdk_iscsi_conn *conn)
2802 {
2803 	struct spdk_iscsi_task *task, *tmp;
2804 
2805 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, tmp) {
2806 		if (conn->pending_r2t < g_iscsi.MaxR2TPerConnection) {
2807 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
2808 			add_transfer_task(conn, task);
2809 		} else {
2810 			break;
2811 		}
2812 	}
2813 }
2814 
2815 bool
2816 iscsi_del_transfer_task(struct spdk_iscsi_conn *conn, uint32_t task_tag)
2817 {
2818 	struct spdk_iscsi_task *task, *tmp;
2819 
2820 	TAILQ_FOREACH_SAFE(task, &conn->active_r2t_tasks, link, tmp) {
2821 		if (task->tag == task_tag) {
2822 			assert(conn->data_out_cnt >= task->data_out_cnt);
2823 			conn->data_out_cnt -= task->data_out_cnt;
2824 
2825 			assert(conn->pending_r2t > 0);
2826 			conn->pending_r2t--;
2827 
2828 			assert(task->is_r2t_active == true);
2829 			TAILQ_REMOVE(&conn->active_r2t_tasks, task, link);
2830 			task->is_r2t_active = false;
2831 			iscsi_task_put(task);
2832 
2833 			start_queued_transfer_tasks(conn);
2834 			return true;
2835 		}
2836 	}
2837 	return false;
2838 }
2839 
2840 void iscsi_clear_all_transfer_task(struct spdk_iscsi_conn *conn,
2841 				   struct spdk_scsi_lun *lun,
2842 				   struct spdk_iscsi_pdu *pdu)
2843 {
2844 	struct spdk_iscsi_task *task, *task_tmp;
2845 	struct spdk_iscsi_pdu *pdu_tmp;
2846 
2847 	TAILQ_FOREACH_SAFE(task, &conn->active_r2t_tasks, link, task_tmp) {
2848 		pdu_tmp = iscsi_task_get_pdu(task);
2849 		if ((lun == NULL || lun == task->scsi.lun) &&
2850 		    (pdu == NULL || spdk_sn32_lt(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
2851 			task->outstanding_r2t = 0;
2852 			task->next_r2t_offset = 0;
2853 			task->next_expected_r2t_offset = 0;
2854 			task->current_data_offset = 0;
2855 			assert(conn->data_out_cnt >= task->data_out_cnt);
2856 			conn->data_out_cnt -= task->data_out_cnt;
2857 			assert(conn->pending_r2t > 0);
2858 			conn->pending_r2t--;
2859 
2860 			TAILQ_REMOVE(&conn->active_r2t_tasks, task, link);
2861 			task->is_r2t_active = false;
2862 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
2863 				spdk_scsi_task_process_null_lun(&task->scsi);
2864 				iscsi_task_response(conn, task);
2865 			}
2866 			iscsi_task_put(task);
2867 		}
2868 	}
2869 
2870 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, task_tmp) {
2871 		pdu_tmp = iscsi_task_get_pdu(task);
2872 		if ((lun == NULL || lun == task->scsi.lun) &&
2873 		    (pdu == NULL || spdk_sn32_lt(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
2874 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
2875 			task->is_r2t_active = false;
2876 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
2877 				spdk_scsi_task_process_null_lun(&task->scsi);
2878 				iscsi_task_response(conn, task);
2879 			}
2880 			iscsi_task_put(task);
2881 		}
2882 	}
2883 
2884 	start_queued_transfer_tasks(conn);
2885 }
2886 
2887 static struct spdk_iscsi_task *
2888 get_transfer_task(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
2889 {
2890 	struct spdk_iscsi_task *task;
2891 
2892 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
2893 		if (task->ttt == transfer_tag) {
2894 			return task;
2895 		}
2896 	}
2897 
2898 	return NULL;
2899 }
2900 
2901 static void
2902 iscsi_conn_datain_pdu_complete(void *arg)
2903 {
2904 	struct spdk_iscsi_conn *conn = arg;
2905 
2906 	iscsi_conn_handle_queued_datain_tasks(conn);
2907 }
2908 
2909 static int
2910 iscsi_send_datain(struct spdk_iscsi_conn *conn,
2911 		  struct spdk_iscsi_task *task, int datain_flag,
2912 		  int residual_len, int offset, int DataSN, int len)
2913 {
2914 	struct spdk_iscsi_pdu *rsp_pdu;
2915 	struct iscsi_bhs_data_in *rsph;
2916 	uint32_t task_tag;
2917 	uint32_t transfer_tag;
2918 	int F_bit, U_bit, O_bit, S_bit;
2919 	struct spdk_iscsi_task *primary;
2920 	struct spdk_scsi_lun *lun_dev;
2921 
2922 	primary = iscsi_task_get_primary(task);
2923 
2924 	/* DATA PDU */
2925 	rsp_pdu = iscsi_get_pdu(conn);
2926 	rsph = (struct iscsi_bhs_data_in *)&rsp_pdu->bhs;
2927 	rsp_pdu->data = task->scsi.iovs[0].iov_base + offset;
2928 	rsp_pdu->data_buf_len = task->scsi.iovs[0].iov_len - offset;
2929 	rsp_pdu->data_valid_bytes = len;
2930 	rsp_pdu->data_from_mempool = true;
2931 
2932 	task_tag = task->tag;
2933 	transfer_tag = 0xffffffffU;
2934 
2935 	F_bit = datain_flag & ISCSI_FLAG_FINAL;
2936 	O_bit = datain_flag & ISCSI_DATAIN_OVERFLOW;
2937 	U_bit = datain_flag & ISCSI_DATAIN_UNDERFLOW;
2938 	S_bit = datain_flag & ISCSI_DATAIN_STATUS;
2939 
2940 	/*
2941 	 * we need to hold onto this task/cmd because until the
2942 	 * PDU has been written out
2943 	 */
2944 	rsp_pdu->task = task;
2945 	task->scsi.ref++;
2946 
2947 	rsph->opcode = ISCSI_OP_SCSI_DATAIN;
2948 
2949 	if (F_bit) {
2950 		rsph->flags |= ISCSI_FLAG_FINAL;
2951 	}
2952 
2953 	/* we leave the A_bit clear */
2954 
2955 	if (F_bit && S_bit)  {
2956 		if (O_bit) {
2957 			rsph->flags |= ISCSI_DATAIN_OVERFLOW;
2958 		}
2959 
2960 		if (U_bit) {
2961 			rsph->flags |= ISCSI_DATAIN_UNDERFLOW;
2962 		}
2963 	}
2964 
2965 	if (S_bit) {
2966 		rsph->flags |= ISCSI_DATAIN_STATUS;
2967 		rsph->status = task->scsi.status;
2968 	}
2969 
2970 	DSET24(rsph->data_segment_len, len);
2971 
2972 	to_be32(&rsph->itt, task_tag);
2973 	to_be32(&rsph->ttt, transfer_tag);
2974 
2975 	if (S_bit) {
2976 		to_be32(&rsph->stat_sn, conn->StatSN);
2977 		conn->StatSN++;
2978 	}
2979 
2980 	if (F_bit && S_bit && !iscsi_task_is_immediate(primary)) {
2981 		conn->sess->MaxCmdSN++;
2982 	}
2983 
2984 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2985 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2986 
2987 	to_be32(&rsph->data_sn, DataSN);
2988 
2989 	if (conn->sess->ErrorRecoveryLevel >= 1) {
2990 		primary->datain_datasn = DataSN;
2991 	}
2992 	DataSN++;
2993 
2994 	offset += task->scsi.offset;
2995 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2996 
2997 	if (F_bit && S_bit) {
2998 		to_be32(&rsph->res_cnt, residual_len);
2999 	}
3000 
3001 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
3002 	if (spdk_likely(lun_dev != NULL)) {
3003 		if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(lun_dev, &task->scsi,
3004 				  &rsp_pdu->dif_ctx))) {
3005 			rsp_pdu->dif_insert_or_strip = true;
3006 		}
3007 	}
3008 
3009 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_datain_pdu_complete, conn);
3010 
3011 	return DataSN;
3012 }
3013 
3014 static int
3015 iscsi_transfer_in(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3016 {
3017 	uint32_t DataSN;
3018 	uint32_t transfer_len;
3019 	uint32_t data_len;
3020 	uint32_t segment_len;
3021 	uint32_t offset;
3022 	uint32_t residual_len = 0;
3023 	int sent_status;
3024 	uint32_t len;
3025 	int datain_flag = 0;
3026 	int datain_seq_cnt;
3027 	int i;
3028 	uint32_t sequence_end;
3029 	struct spdk_iscsi_task *primary;
3030 
3031 	primary = iscsi_task_get_primary(task);
3032 	segment_len = conn->MaxRecvDataSegmentLength;
3033 	data_len = task->scsi.data_transferred;
3034 	transfer_len = task->scsi.length;
3035 
3036 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
3037 		return 0;
3038 	}
3039 
3040 	if (data_len < transfer_len) {
3041 		/* underflow */
3042 		SPDK_DEBUGLOG(iscsi, "Underflow %u/%u\n", data_len, transfer_len);
3043 		residual_len = transfer_len - data_len;
3044 		transfer_len = data_len;
3045 		datain_flag |= ISCSI_DATAIN_UNDERFLOW;
3046 	} else if (data_len > transfer_len) {
3047 		/* overflow */
3048 		SPDK_DEBUGLOG(iscsi, "Overflow %u/%u\n", data_len, transfer_len);
3049 		residual_len = data_len - transfer_len;
3050 		datain_flag |= ISCSI_DATAIN_OVERFLOW;
3051 	} else {
3052 		SPDK_DEBUGLOG(iscsi, "Transfer %u\n", transfer_len);
3053 		residual_len = 0;
3054 	}
3055 
3056 	DataSN = primary->datain_datasn;
3057 	sent_status = 0;
3058 
3059 	/* calculate the number of sequences for all data-in pdus */
3060 	datain_seq_cnt = 1 + ((transfer_len - 1) / (int)conn->sess->MaxBurstLength);
3061 	for (i = 0; i < datain_seq_cnt; i++) {
3062 		offset = i * conn->sess->MaxBurstLength;
3063 		sequence_end = spdk_min(((i + 1) * conn->sess->MaxBurstLength),
3064 					transfer_len);
3065 
3066 		/* send data splitted by segment_len */
3067 		for (; offset < sequence_end; offset += segment_len) {
3068 			len = spdk_min(segment_len, (sequence_end - offset));
3069 
3070 			datain_flag &= ~(ISCSI_FLAG_FINAL | ISCSI_DATAIN_STATUS);
3071 
3072 			if (offset + len == sequence_end) {
3073 				/* last PDU in a sequence */
3074 				datain_flag |= ISCSI_FLAG_FINAL;
3075 				if (task->scsi.sense_data_len == 0) {
3076 					/* The last pdu in all data-in pdus */
3077 					if ((offset + len) == transfer_len &&
3078 					    (primary->bytes_completed == primary->scsi.transfer_len)) {
3079 						datain_flag |= ISCSI_DATAIN_STATUS;
3080 						sent_status = 1;
3081 					}
3082 				}
3083 			}
3084 
3085 			SPDK_DEBUGLOG(iscsi, "Transfer=%d, Offset=%d, Len=%d\n",
3086 				      sequence_end, offset, len);
3087 			SPDK_DEBUGLOG(iscsi, "StatSN=%u, DataSN=%u, Offset=%u, Len=%d\n",
3088 				      conn->StatSN, DataSN, offset, len);
3089 
3090 			DataSN = iscsi_send_datain(conn, task, datain_flag, residual_len,
3091 						   offset, DataSN, len);
3092 		}
3093 	}
3094 
3095 	if (task != primary) {
3096 		primary->scsi.data_transferred += task->scsi.data_transferred;
3097 	}
3098 	primary->datain_datasn = DataSN;
3099 
3100 	return sent_status;
3101 }
3102 
3103 void iscsi_task_response(struct spdk_iscsi_conn *conn,
3104 			 struct spdk_iscsi_task *task)
3105 {
3106 	struct spdk_iscsi_pdu *rsp_pdu;
3107 	struct iscsi_bhs_scsi_resp *rsph;
3108 	uint32_t task_tag;
3109 	uint32_t transfer_len;
3110 	size_t residual_len;
3111 	size_t data_len;
3112 	int O_bit, U_bit;
3113 	int rc;
3114 	struct spdk_iscsi_task *primary;
3115 
3116 	primary = iscsi_task_get_primary(task);
3117 
3118 	transfer_len = primary->scsi.transfer_len;
3119 	task_tag = task->tag;
3120 
3121 	/* transfer data from logical unit */
3122 	/* (direction is view of initiator side) */
3123 	if (iscsi_task_is_read(primary)) {
3124 		rc = iscsi_transfer_in(conn, task);
3125 		if (rc > 0) {
3126 			/* sent status by last DATAIN PDU */
3127 			return;
3128 		}
3129 
3130 		if (primary->bytes_completed != primary->scsi.transfer_len) {
3131 			return;
3132 		}
3133 	}
3134 
3135 	O_bit = U_bit = 0;
3136 	residual_len = 0;
3137 	data_len = primary->scsi.data_transferred;
3138 
3139 	if ((transfer_len != 0) &&
3140 	    (task->scsi.status == SPDK_SCSI_STATUS_GOOD)) {
3141 		if (data_len < transfer_len) {
3142 			/* underflow */
3143 			SPDK_DEBUGLOG(iscsi, "Underflow %zu/%u\n", data_len, transfer_len);
3144 			residual_len = transfer_len - data_len;
3145 			U_bit = 1;
3146 		} else if (data_len > transfer_len) {
3147 			/* overflow */
3148 			SPDK_DEBUGLOG(iscsi, "Overflow %zu/%u\n", data_len, transfer_len);
3149 			residual_len = data_len - transfer_len;
3150 			O_bit = 1;
3151 		} else {
3152 			SPDK_DEBUGLOG(iscsi, "Transfer %u\n", transfer_len);
3153 		}
3154 	}
3155 
3156 	/* response PDU */
3157 	rsp_pdu = iscsi_get_pdu(conn);
3158 	assert(rsp_pdu != NULL);
3159 	rsph = (struct iscsi_bhs_scsi_resp *)&rsp_pdu->bhs;
3160 	assert(task->scsi.sense_data_len <= sizeof(rsp_pdu->sense.data));
3161 	memcpy(rsp_pdu->sense.data, task->scsi.sense_data, task->scsi.sense_data_len);
3162 	to_be16(&rsp_pdu->sense.length, task->scsi.sense_data_len);
3163 	rsp_pdu->data = (uint8_t *)&rsp_pdu->sense;
3164 	rsp_pdu->data_from_mempool = true;
3165 
3166 	/*
3167 	 * we need to hold onto this task/cmd because until the
3168 	 * PDU has been written out
3169 	 */
3170 	rsp_pdu->task = task;
3171 	task->scsi.ref++;
3172 
3173 	rsph->opcode = ISCSI_OP_SCSI_RSP;
3174 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
3175 
3176 	if (O_bit) {
3177 		rsph->flags |= ISCSI_SCSI_OVERFLOW;
3178 	}
3179 
3180 	if (U_bit) {
3181 		rsph->flags |= ISCSI_SCSI_UNDERFLOW;
3182 	}
3183 
3184 	rsph->status = task->scsi.status;
3185 	if (task->scsi.sense_data_len) {
3186 		/* SenseLength (2 bytes) + SenseData  */
3187 		DSET24(rsph->data_segment_len, 2 + task->scsi.sense_data_len);
3188 	}
3189 	to_be32(&rsph->itt, task_tag);
3190 
3191 	to_be32(&rsph->stat_sn, conn->StatSN);
3192 	conn->StatSN++;
3193 
3194 	if (!iscsi_task_is_immediate(primary)) {
3195 		conn->sess->MaxCmdSN++;
3196 	}
3197 
3198 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3199 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3200 
3201 	to_be32(&rsph->bi_read_res_cnt, 0);
3202 	to_be32(&rsph->res_cnt, residual_len);
3203 
3204 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3205 }
3206 
3207 /*
3208  *  This function compare the input pdu's bhs with the pdu's bhs associated by
3209  *  active_r2t_tasks and queued_r2t_tasks in a connection
3210  */
3211 static bool
3212 iscsi_compare_pdu_bhs_within_existed_r2t_tasks(struct spdk_iscsi_conn *conn,
3213 		struct spdk_iscsi_pdu *pdu)
3214 {
3215 	struct spdk_iscsi_task	*task;
3216 
3217 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
3218 		if (!memcmp(&pdu->bhs, iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
3219 			return true;
3220 		}
3221 	}
3222 
3223 	TAILQ_FOREACH(task, &conn->queued_r2t_tasks, link) {
3224 		if (!memcmp(&pdu->bhs, iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
3225 			return true;
3226 		}
3227 	}
3228 
3229 	return false;
3230 }
3231 
3232 void
3233 iscsi_queue_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3234 {
3235 	spdk_trace_record(TRACE_ISCSI_TASK_QUEUE, conn->id, task->scsi.length,
3236 			  (uintptr_t)task, (uintptr_t)task->pdu);
3237 	task->is_queued = true;
3238 	spdk_scsi_dev_queue_task(conn->dev, &task->scsi);
3239 }
3240 
3241 static int
3242 iscsi_pdu_payload_op_scsi_read(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3243 {
3244 	if (task->scsi.transfer_len <= SPDK_BDEV_LARGE_BUF_MAX_SIZE) {
3245 		task->parent = NULL;
3246 		task->scsi.offset = 0;
3247 		task->scsi.length = task->scsi.transfer_len;
3248 		spdk_scsi_task_set_data(&task->scsi, NULL, 0);
3249 
3250 		iscsi_queue_task(conn, task);
3251 		return 0;
3252 	} else {
3253 		TAILQ_INIT(&task->subtask_list);
3254 		task->current_data_offset = 0;
3255 		TAILQ_INSERT_TAIL(&conn->queued_datain_tasks, task, link);
3256 
3257 		return iscsi_conn_handle_queued_datain_tasks(conn);
3258 	}
3259 }
3260 
3261 static int
3262 iscsi_submit_write_subtask(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task,
3263 			   struct spdk_iscsi_pdu *pdu, struct spdk_mobj *mobj)
3264 {
3265 	struct spdk_iscsi_task *subtask;
3266 
3267 	subtask = iscsi_task_get(conn, task, iscsi_task_cpl);
3268 	if (subtask == NULL) {
3269 		SPDK_ERRLOG("Unable to acquire subtask\n");
3270 		return SPDK_ISCSI_CONNECTION_FATAL;
3271 	}
3272 	subtask->scsi.offset = task->current_data_offset;
3273 	subtask->scsi.length = mobj->data_len;
3274 	iscsi_task_associate_pdu(subtask, pdu);
3275 
3276 	task->current_data_offset += mobj->data_len;
3277 
3278 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
3279 		spdk_scsi_task_set_data(&subtask->scsi, mobj->buf, mobj->data_len);
3280 	} else {
3281 		spdk_scsi_task_set_data(&subtask->scsi, mobj->buf, pdu->data_buf_len);
3282 	}
3283 
3284 	iscsi_queue_task(conn, subtask);
3285 	return 0;
3286 }
3287 
3288 static int
3289 iscsi_pdu_payload_op_scsi_write(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3290 {
3291 	struct spdk_iscsi_pdu *pdu;
3292 	struct iscsi_bhs_scsi_req *reqh;
3293 	uint32_t transfer_len;
3294 	struct spdk_mobj *mobj;
3295 	int rc;
3296 
3297 	pdu = iscsi_task_get_pdu(task);
3298 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
3299 
3300 	transfer_len = task->scsi.transfer_len;
3301 
3302 	if (reqh->final_bit &&
3303 	    pdu->data_segment_len < transfer_len) {
3304 		/* needs R2T */
3305 		rc = add_transfer_task(conn, task);
3306 		if (rc < 0) {
3307 			SPDK_ERRLOG("add_transfer_task() failed\n");
3308 			iscsi_task_put(task);
3309 			return SPDK_ISCSI_CONNECTION_FATAL;
3310 		}
3311 
3312 		/* immediate writes */
3313 		if (pdu->data_segment_len != 0) {
3314 			mobj = pdu->mobj[0];
3315 			assert(mobj != NULL);
3316 
3317 			if (!pdu->dif_insert_or_strip &&
3318 			    mobj->data_len < SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
3319 				/* continue aggregation until the first data buffer is full. */
3320 				iscsi_task_set_mobj(task, mobj);
3321 				pdu->mobj[0] = NULL;
3322 			} else {
3323 				/* we are doing the first partial write task */
3324 				rc = iscsi_submit_write_subtask(conn, task, pdu, mobj);
3325 				if (rc < 0) {
3326 					iscsi_task_put(task);
3327 					return SPDK_ISCSI_CONNECTION_FATAL;
3328 				}
3329 			}
3330 		}
3331 		return 0;
3332 	}
3333 
3334 	if (pdu->data_segment_len == transfer_len) {
3335 		/* we are doing small writes with no R2T */
3336 		if (spdk_likely(!pdu->dif_insert_or_strip)) {
3337 			spdk_scsi_task_set_data(&task->scsi, pdu->data, pdu->data_segment_len);
3338 		} else {
3339 			spdk_scsi_task_set_data(&task->scsi, pdu->data, pdu->data_buf_len);
3340 		}
3341 		task->scsi.length = transfer_len;
3342 	}
3343 
3344 	iscsi_queue_task(conn, task);
3345 	return 0;
3346 }
3347 
3348 static int
3349 iscsi_pdu_hdr_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3350 {
3351 	struct spdk_iscsi_task	*task;
3352 	struct spdk_scsi_dev	*dev;
3353 	uint8_t *cdb;
3354 	uint64_t lun;
3355 	uint32_t task_tag;
3356 	uint32_t transfer_len;
3357 	int R_bit, W_bit;
3358 	int lun_i;
3359 	struct iscsi_bhs_scsi_req *reqh;
3360 
3361 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3362 		SPDK_ERRLOG("ISCSI_OP_SCSI not allowed in discovery and invalid session\n");
3363 		return SPDK_ISCSI_CONNECTION_FATAL;
3364 	}
3365 
3366 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
3367 
3368 	R_bit = reqh->read_bit;
3369 	W_bit = reqh->write_bit;
3370 	lun = from_be64(&reqh->lun);
3371 	task_tag = from_be32(&reqh->itt);
3372 	transfer_len = from_be32(&reqh->expected_data_xfer_len);
3373 	cdb = reqh->cdb;
3374 
3375 	SPDK_LOGDUMP(iscsi, "CDB", cdb, 16);
3376 
3377 	task = iscsi_task_get(conn, NULL, iscsi_task_cpl);
3378 	if (!task) {
3379 		SPDK_ERRLOG("Unable to acquire task\n");
3380 		return SPDK_ISCSI_CONNECTION_FATAL;
3381 	}
3382 
3383 	iscsi_task_associate_pdu(task, pdu);
3384 	lun_i = spdk_scsi_lun_id_fmt_to_int(lun);
3385 	task->lun_id = lun_i;
3386 	dev = conn->dev;
3387 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3388 
3389 	if ((R_bit != 0) && (W_bit != 0)) {
3390 		SPDK_ERRLOG("Bidirectional CDB is not supported\n");
3391 		iscsi_task_put(task);
3392 		return SPDK_ISCSI_CONNECTION_FATAL;
3393 	}
3394 
3395 	task->scsi.cdb = cdb;
3396 	task->tag = task_tag;
3397 	task->scsi.transfer_len = transfer_len;
3398 	task->scsi.target_port = conn->target_port;
3399 	task->scsi.initiator_port = conn->initiator_port;
3400 	task->parent = NULL;
3401 	task->scsi.status = SPDK_SCSI_STATUS_GOOD;
3402 
3403 	if (task->scsi.lun == NULL) {
3404 		spdk_scsi_task_process_null_lun(&task->scsi);
3405 		iscsi_task_cpl(&task->scsi);
3406 		return 0;
3407 	}
3408 
3409 	/* no bi-directional support */
3410 	if (R_bit) {
3411 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_FROM_DEV;
3412 	} else if (W_bit) {
3413 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_TO_DEV;
3414 
3415 		if ((conn->sess->ErrorRecoveryLevel >= 1) &&
3416 		    (iscsi_compare_pdu_bhs_within_existed_r2t_tasks(conn, pdu))) {
3417 			iscsi_task_response(conn, task);
3418 			iscsi_task_put(task);
3419 			return 0;
3420 		}
3421 
3422 		if (pdu->data_segment_len > iscsi_get_max_immediate_data_size()) {
3423 			SPDK_ERRLOG("data segment len(=%zu) > immediate data len(=%"PRIu32")\n",
3424 				    pdu->data_segment_len, iscsi_get_max_immediate_data_size());
3425 			iscsi_task_put(task);
3426 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3427 		}
3428 
3429 		if (pdu->data_segment_len > transfer_len) {
3430 			SPDK_ERRLOG("data segment len(=%zu) > task transfer len(=%d)\n",
3431 				    pdu->data_segment_len, transfer_len);
3432 			iscsi_task_put(task);
3433 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3434 		}
3435 
3436 		/* check the ImmediateData and also pdu->data_segment_len */
3437 		if ((!conn->sess->ImmediateData && (pdu->data_segment_len > 0)) ||
3438 		    (pdu->data_segment_len > conn->sess->FirstBurstLength)) {
3439 			iscsi_task_put(task);
3440 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3441 		}
3442 
3443 		if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(task->scsi.lun, &task->scsi, &pdu->dif_ctx))) {
3444 			pdu->dif_insert_or_strip = true;
3445 		} else if (reqh->final_bit && pdu->data_segment_len < transfer_len) {
3446 			pdu->data_buf_len = spdk_min(transfer_len,
3447 						     SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
3448 		}
3449 	} else {
3450 		/* neither R nor W bit set */
3451 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_NONE;
3452 		if (transfer_len > 0) {
3453 			iscsi_task_put(task);
3454 			SPDK_ERRLOG("Reject scsi cmd with EDTL > 0 but (R | W) == 0\n");
3455 			return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3456 		}
3457 	}
3458 
3459 	pdu->task = task;
3460 	return 0;
3461 }
3462 
3463 static int
3464 iscsi_pdu_payload_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3465 {
3466 	struct spdk_iscsi_task *task;
3467 
3468 	if (pdu->task == NULL) {
3469 		return 0;
3470 	}
3471 
3472 	task = pdu->task;
3473 
3474 	if (spdk_scsi_dev_get_lun(conn->dev, task->lun_id) == NULL) {
3475 		spdk_scsi_task_process_null_lun(&task->scsi);
3476 		iscsi_task_cpl(&task->scsi);
3477 		return 0;
3478 	}
3479 
3480 	switch (task->scsi.dxfer_dir) {
3481 	case SPDK_SCSI_DIR_FROM_DEV:
3482 		return iscsi_pdu_payload_op_scsi_read(conn, task);
3483 	case SPDK_SCSI_DIR_TO_DEV:
3484 		return iscsi_pdu_payload_op_scsi_write(conn, task);
3485 	case SPDK_SCSI_DIR_NONE:
3486 		iscsi_queue_task(conn, task);
3487 		return 0;
3488 	default:
3489 		assert(false);
3490 		iscsi_task_put(task);
3491 		break;
3492 	}
3493 
3494 	return SPDK_ISCSI_CONNECTION_FATAL;
3495 }
3496 
3497 void
3498 iscsi_task_mgmt_response(struct spdk_iscsi_conn *conn,
3499 			 struct spdk_iscsi_task *task)
3500 {
3501 	struct spdk_iscsi_pdu *rsp_pdu;
3502 	struct iscsi_bhs_task_req *reqh;
3503 	struct iscsi_bhs_task_resp *rsph;
3504 
3505 	if (task->pdu == NULL) {
3506 		/*
3507 		 * This was an internally generated task management command,
3508 		 *  usually from LUN cleanup when a connection closes.
3509 		 */
3510 		return;
3511 	}
3512 
3513 	reqh = (struct iscsi_bhs_task_req *)&task->pdu->bhs;
3514 	/* response PDU */
3515 	rsp_pdu = iscsi_get_pdu(conn);
3516 	rsph = (struct iscsi_bhs_task_resp *)&rsp_pdu->bhs;
3517 	rsph->opcode = ISCSI_OP_TASK_RSP;
3518 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3519 	switch (task->scsi.response) {
3520 	case SPDK_SCSI_TASK_MGMT_RESP_COMPLETE:
3521 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3522 		break;
3523 	case SPDK_SCSI_TASK_MGMT_RESP_SUCCESS:
3524 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3525 		break;
3526 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT:
3527 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3528 		break;
3529 	case SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN:
3530 		rsph->response = ISCSI_TASK_FUNC_RESP_LUN_NOT_EXIST;
3531 		break;
3532 	case SPDK_SCSI_TASK_MGMT_RESP_TARGET_FAILURE:
3533 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3534 		break;
3535 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED:
3536 		rsph->response = ISCSI_TASK_FUNC_RESP_FUNC_NOT_SUPPORTED;
3537 		break;
3538 	}
3539 	rsph->itt = reqh->itt;
3540 
3541 	to_be32(&rsph->stat_sn, conn->StatSN);
3542 	conn->StatSN++;
3543 
3544 	if (reqh->immediate == 0) {
3545 		conn->sess->MaxCmdSN++;
3546 	}
3547 
3548 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3549 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3550 
3551 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3552 }
3553 
3554 static void
3555 iscsi_queue_mgmt_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3556 {
3557 	struct spdk_scsi_lun *lun;
3558 
3559 	lun = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
3560 	if (lun == NULL) {
3561 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3562 		iscsi_task_mgmt_response(conn, task);
3563 		iscsi_task_put(task);
3564 		return;
3565 	}
3566 
3567 	spdk_scsi_dev_queue_mgmt_task(conn->dev, &task->scsi);
3568 }
3569 
3570 static int
3571 _iscsi_op_abort_task(void *arg)
3572 {
3573 	struct spdk_iscsi_task *task = arg;
3574 	int rc;
3575 
3576 	rc = iscsi_conn_abort_queued_datain_task(task->conn, task->scsi.abort_id);
3577 	if (rc != 0) {
3578 		return SPDK_POLLER_BUSY;
3579 	}
3580 
3581 	spdk_poller_unregister(&task->mgmt_poller);
3582 	iscsi_queue_mgmt_task(task->conn, task);
3583 	return SPDK_POLLER_BUSY;
3584 }
3585 
3586 static void
3587 iscsi_op_abort_task(struct spdk_iscsi_task *task, uint32_t ref_task_tag)
3588 {
3589 	task->scsi.abort_id = ref_task_tag;
3590 	task->scsi.function = SPDK_SCSI_TASK_FUNC_ABORT_TASK;
3591 	task->mgmt_poller = SPDK_POLLER_REGISTER(_iscsi_op_abort_task, task, 10);
3592 }
3593 
3594 static int
3595 _iscsi_op_abort_task_set(void *arg)
3596 {
3597 	struct spdk_iscsi_task *task = arg;
3598 	int rc;
3599 
3600 	rc = iscsi_conn_abort_queued_datain_tasks(task->conn, task->scsi.lun,
3601 			task->pdu);
3602 	if (rc != 0) {
3603 		return SPDK_POLLER_BUSY;
3604 	}
3605 
3606 	spdk_poller_unregister(&task->mgmt_poller);
3607 	iscsi_queue_mgmt_task(task->conn, task);
3608 	return SPDK_POLLER_BUSY;
3609 }
3610 
3611 void
3612 iscsi_op_abort_task_set(struct spdk_iscsi_task *task, uint8_t function)
3613 {
3614 	task->scsi.function = function;
3615 	task->mgmt_poller = SPDK_POLLER_REGISTER(_iscsi_op_abort_task_set, task, 10);
3616 }
3617 
3618 static int
3619 iscsi_pdu_hdr_op_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3620 {
3621 	struct iscsi_bhs_task_req *reqh;
3622 	uint64_t lun;
3623 	uint32_t task_tag;
3624 	uint32_t ref_task_tag;
3625 	uint8_t function;
3626 	int lun_i;
3627 	struct spdk_iscsi_task *task;
3628 	struct spdk_scsi_dev *dev;
3629 
3630 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3631 		SPDK_ERRLOG("ISCSI_OP_TASK not allowed in discovery and invalid session\n");
3632 		return SPDK_ISCSI_CONNECTION_FATAL;
3633 	}
3634 
3635 	reqh = (struct iscsi_bhs_task_req *)&pdu->bhs;
3636 	function = reqh->flags & ISCSI_TASK_FUNCTION_MASK;
3637 	lun = from_be64(&reqh->lun);
3638 	task_tag = from_be32(&reqh->itt);
3639 	ref_task_tag = from_be32(&reqh->ref_task_tag);
3640 
3641 	SPDK_DEBUGLOG(iscsi, "I=%d, func=%d, ITT=%x, ref TT=%x, LUN=0x%16.16"PRIx64"\n",
3642 		      reqh->immediate, function, task_tag, ref_task_tag, lun);
3643 
3644 	SPDK_DEBUGLOG(iscsi, "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3645 		      conn->StatSN, conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
3646 
3647 	lun_i = spdk_scsi_lun_id_fmt_to_int(lun);
3648 	dev = conn->dev;
3649 
3650 	task = iscsi_task_get(conn, NULL, iscsi_task_mgmt_cpl);
3651 	if (!task) {
3652 		SPDK_ERRLOG("Unable to acquire task\n");
3653 		return SPDK_ISCSI_CONNECTION_FATAL;
3654 	}
3655 
3656 	iscsi_task_associate_pdu(task, pdu);
3657 	task->scsi.target_port = conn->target_port;
3658 	task->scsi.initiator_port = conn->initiator_port;
3659 	task->tag = task_tag;
3660 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3661 	task->lun_id = lun_i;
3662 
3663 	if (task->scsi.lun == NULL) {
3664 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3665 		iscsi_task_mgmt_response(conn, task);
3666 		iscsi_task_put(task);
3667 		return 0;
3668 	}
3669 
3670 	switch (function) {
3671 	/* abort task identified by Referenced Task Tag field */
3672 	case ISCSI_TASK_FUNC_ABORT_TASK:
3673 		SPDK_NOTICELOG("ABORT_TASK\n");
3674 
3675 		iscsi_del_transfer_task(conn, ref_task_tag);
3676 		iscsi_op_abort_task(task, ref_task_tag);
3677 		return 0;
3678 
3679 	/* abort all tasks issued via this session on the LUN */
3680 	case ISCSI_TASK_FUNC_ABORT_TASK_SET:
3681 		SPDK_NOTICELOG("ABORT_TASK_SET\n");
3682 
3683 		iscsi_clear_all_transfer_task(conn, task->scsi.lun, pdu);
3684 		iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_ABORT_TASK_SET);
3685 		return 0;
3686 
3687 	case ISCSI_TASK_FUNC_CLEAR_TASK_SET:
3688 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3689 		SPDK_NOTICELOG("CLEAR_TASK_SET (Unsupported)\n");
3690 		break;
3691 
3692 	case ISCSI_TASK_FUNC_CLEAR_ACA:
3693 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3694 		SPDK_NOTICELOG("CLEAR_ACA (Unsupported)\n");
3695 		break;
3696 
3697 	case ISCSI_TASK_FUNC_LOGICAL_UNIT_RESET:
3698 		SPDK_NOTICELOG("LOGICAL_UNIT_RESET\n");
3699 
3700 		iscsi_clear_all_transfer_task(conn, task->scsi.lun, pdu);
3701 		iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
3702 		return 0;
3703 
3704 	case ISCSI_TASK_FUNC_TARGET_WARM_RESET:
3705 		SPDK_NOTICELOG("TARGET_WARM_RESET (Unsupported)\n");
3706 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3707 		break;
3708 
3709 	case ISCSI_TASK_FUNC_TARGET_COLD_RESET:
3710 		SPDK_NOTICELOG("TARGET_COLD_RESET (Unsupported)\n");
3711 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3712 		break;
3713 
3714 	case ISCSI_TASK_FUNC_TASK_REASSIGN:
3715 		SPDK_NOTICELOG("TASK_REASSIGN (Unsupported)\n");
3716 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3717 		break;
3718 
3719 	default:
3720 		SPDK_ERRLOG("unsupported function %d\n", function);
3721 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT;
3722 		break;
3723 	}
3724 
3725 	iscsi_task_mgmt_response(conn, task);
3726 	iscsi_task_put(task);
3727 	return 0;
3728 }
3729 
3730 static int
3731 iscsi_pdu_hdr_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3732 {
3733 	struct iscsi_bhs_nop_out *reqh;
3734 	uint32_t task_tag;
3735 	uint32_t transfer_tag;
3736 	int I_bit;
3737 
3738 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
3739 		SPDK_ERRLOG("ISCSI_OP_NOPOUT not allowed in discovery session\n");
3740 		return SPDK_ISCSI_CONNECTION_FATAL;
3741 	}
3742 
3743 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3744 	I_bit = reqh->immediate;
3745 
3746 	if (pdu->data_segment_len > SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
3747 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3748 	}
3749 
3750 	task_tag = from_be32(&reqh->itt);
3751 	transfer_tag = from_be32(&reqh->ttt);
3752 
3753 	SPDK_DEBUGLOG(iscsi, "I=%d, ITT=%x, TTT=%x\n",
3754 		      I_bit, task_tag, transfer_tag);
3755 
3756 	SPDK_DEBUGLOG(iscsi, "CmdSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3757 		      pdu->cmd_sn, conn->StatSN, conn->sess->ExpCmdSN,
3758 		      conn->sess->MaxCmdSN);
3759 
3760 	if (transfer_tag != 0xFFFFFFFF && transfer_tag != (uint32_t)conn->id) {
3761 		SPDK_ERRLOG("invalid transfer tag 0x%x\n", transfer_tag);
3762 		/*
3763 		 * Technically we should probably fail the connection here, but for now
3764 		 *  just print the error message and continue.
3765 		 */
3766 	}
3767 
3768 	if (task_tag == 0xffffffffU && I_bit == 0) {
3769 		SPDK_ERRLOG("got NOPOUT ITT=0xffffffff, I=0\n");
3770 		return SPDK_ISCSI_CONNECTION_FATAL;
3771 	}
3772 
3773 	return 0;
3774 }
3775 
3776 static int
3777 iscsi_pdu_payload_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3778 {
3779 	struct spdk_iscsi_pdu *rsp_pdu;
3780 	struct iscsi_bhs_nop_out *reqh;
3781 	struct iscsi_bhs_nop_in *rsph;
3782 	uint8_t *data;
3783 	uint64_t lun;
3784 	uint32_t task_tag;
3785 	int I_bit;
3786 	int data_len;
3787 
3788 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3789 	I_bit = reqh->immediate;
3790 
3791 	data_len = pdu->data_segment_len;
3792 	if (data_len > conn->MaxRecvDataSegmentLength) {
3793 		data_len = conn->MaxRecvDataSegmentLength;
3794 	}
3795 
3796 	lun = from_be64(&reqh->lun);
3797 	task_tag = from_be32(&reqh->itt);
3798 
3799 	/*
3800 	 * We don't actually check to see if this is a response to the NOP-In
3801 	 * that we sent.  Our goal is to just verify that the initiator is
3802 	 * alive and responding to commands, not to verify that it tags
3803 	 * NOP-Outs correctly
3804 	 */
3805 	conn->nop_outstanding = false;
3806 
3807 	if (task_tag == 0xffffffffU) {
3808 		assert(I_bit == 1);
3809 		SPDK_DEBUGLOG(iscsi, "got NOPOUT ITT=0xffffffff\n");
3810 		return 0;
3811 	}
3812 
3813 	data = calloc(1, data_len);
3814 	if (!data) {
3815 		SPDK_ERRLOG("calloc() failed for ping data\n");
3816 		return SPDK_ISCSI_CONNECTION_FATAL;
3817 	}
3818 
3819 	/* response of NOPOUT */
3820 	if (data_len > 0) {
3821 		/* copy ping data */
3822 		memcpy(data, pdu->data, data_len);
3823 	}
3824 
3825 	/* response PDU */
3826 	rsp_pdu = iscsi_get_pdu(conn);
3827 	assert(rsp_pdu != NULL);
3828 
3829 	rsph = (struct iscsi_bhs_nop_in *)&rsp_pdu->bhs;
3830 	rsp_pdu->data = data;
3831 	rsph->opcode = ISCSI_OP_NOPIN;
3832 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3833 	DSET24(rsph->data_segment_len, data_len);
3834 	to_be64(&rsph->lun, lun);
3835 	to_be32(&rsph->itt, task_tag);
3836 	to_be32(&rsph->ttt, 0xffffffffU);
3837 
3838 	to_be32(&rsph->stat_sn, conn->StatSN);
3839 	conn->StatSN++;
3840 
3841 	if (I_bit == 0) {
3842 		conn->sess->MaxCmdSN++;
3843 	}
3844 
3845 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3846 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3847 
3848 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3849 	conn->last_nopin = spdk_get_ticks();
3850 
3851 	return 0;
3852 }
3853 
3854 /* This function returns the spdk_scsi_task by searching the snack list via
3855  * task transfertag and the pdu's opcode
3856  */
3857 static struct spdk_iscsi_task *
3858 get_scsi_task_from_ttt(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
3859 {
3860 	struct spdk_iscsi_pdu *pdu;
3861 	struct iscsi_bhs_data_in *datain_bhs;
3862 
3863 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3864 		if (pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3865 			datain_bhs = (struct iscsi_bhs_data_in *)&pdu->bhs;
3866 			if (from_be32(&datain_bhs->ttt) == transfer_tag) {
3867 				return pdu->task;
3868 			}
3869 		}
3870 	}
3871 
3872 	return NULL;
3873 }
3874 
3875 /* This function returns the spdk_scsi_task by searching the snack list via
3876  * initiator task tag and the pdu's opcode
3877  */
3878 static struct spdk_iscsi_task *
3879 get_scsi_task_from_itt(struct spdk_iscsi_conn *conn,
3880 		       uint32_t task_tag, enum iscsi_op opcode)
3881 {
3882 	struct spdk_iscsi_pdu *pdu;
3883 
3884 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3885 		if (pdu->bhs.opcode == opcode &&
3886 		    pdu->task != NULL &&
3887 		    pdu->task->tag == task_tag) {
3888 			return pdu->task;
3889 		}
3890 	}
3891 
3892 	return NULL;
3893 }
3894 
3895 /* This function is used to handle the r2t snack */
3896 static int
3897 iscsi_handle_r2t_snack(struct spdk_iscsi_conn *conn,
3898 		       struct spdk_iscsi_task *task,
3899 		       struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3900 		       uint32_t run_length, int32_t task_tag)
3901 {
3902 	int32_t last_r2tsn;
3903 	int i;
3904 
3905 	if (beg_run < task->acked_r2tsn) {
3906 		SPDK_ERRLOG("ITT: 0x%08x, R2T SNACK requests retransmission of"
3907 			    "R2TSN: from 0x%08x to 0x%08x. But it has already"
3908 			    "ack to R2TSN:0x%08x, protocol error.\n",
3909 			    task_tag, beg_run, (beg_run + run_length),
3910 			    (task->acked_r2tsn - 1));
3911 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3912 	}
3913 
3914 	if (run_length) {
3915 		if ((beg_run + run_length) > task->R2TSN) {
3916 			SPDK_ERRLOG("ITT: 0x%08x, received R2T SNACK with"
3917 				    "BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
3918 				    "current R2TSN: 0x%08x, protocol error.\n",
3919 				    task_tag, beg_run, run_length,
3920 				    task->R2TSN);
3921 
3922 			return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3923 		}
3924 		last_r2tsn = (beg_run + run_length);
3925 	} else {
3926 		last_r2tsn = task->R2TSN;
3927 	}
3928 
3929 	for (i = beg_run; i < last_r2tsn; i++) {
3930 		if (iscsi_send_r2t_recovery(conn, task, i, false) < 0) {
3931 			SPDK_ERRLOG("The r2t_sn=%d of r2t_task=%p is not sent\n", i, task);
3932 		}
3933 	}
3934 	return 0;
3935 }
3936 
3937 /* This function is used to recover the data in packet */
3938 static int
3939 iscsi_handle_recovery_datain(struct spdk_iscsi_conn *conn,
3940 			     struct spdk_iscsi_task *task,
3941 			     struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3942 			     uint32_t run_length, uint32_t task_tag)
3943 {
3944 	struct spdk_iscsi_pdu *old_pdu, *pdu_temp;
3945 	uint32_t i;
3946 	struct iscsi_bhs_data_in *datain_header;
3947 	uint32_t last_statsn;
3948 
3949 	task = iscsi_task_get_primary(task);
3950 
3951 	SPDK_DEBUGLOG(iscsi, "iscsi_handle_recovery_datain\n");
3952 
3953 	if (beg_run < task->acked_data_sn) {
3954 		SPDK_ERRLOG("ITT: 0x%08x, DATA IN SNACK requests retransmission of"
3955 			    "DATASN: from 0x%08x to 0x%08x but already acked to "
3956 			    "DATASN: 0x%08x protocol error\n",
3957 			    task_tag, beg_run,
3958 			    (beg_run + run_length), (task->acked_data_sn - 1));
3959 
3960 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3961 	}
3962 
3963 	if (run_length == 0) {
3964 		/* as the DataSN begins at 0 */
3965 		run_length = task->datain_datasn + 1;
3966 	}
3967 
3968 	if ((beg_run + run_length - 1) > task->datain_datasn) {
3969 		SPDK_ERRLOG("Initiator requests BegRun: 0x%08x, RunLength:"
3970 			    "0x%08x greater than maximum DataSN: 0x%08x.\n",
3971 			    beg_run, run_length, task->datain_datasn);
3972 
3973 		return -1;
3974 	} else {
3975 		last_statsn = beg_run + run_length - 1;
3976 	}
3977 
3978 	for (i = beg_run; i <= last_statsn; i++) {
3979 		TAILQ_FOREACH_SAFE(old_pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
3980 			if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3981 				datain_header = (struct iscsi_bhs_data_in *)&old_pdu->bhs;
3982 				if (from_be32(&datain_header->itt) == task_tag &&
3983 				    from_be32(&datain_header->data_sn) == i) {
3984 					TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
3985 					iscsi_conn_write_pdu(conn, old_pdu, old_pdu->cb_fn, old_pdu->cb_arg);
3986 					break;
3987 				}
3988 			}
3989 		}
3990 	}
3991 	return 0;
3992 }
3993 
3994 /* This function is used to handle the status snack */
3995 static int
3996 iscsi_handle_status_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3997 {
3998 	uint32_t beg_run;
3999 	uint32_t run_length;
4000 	struct iscsi_bhs_snack_req *reqh;
4001 	uint32_t i;
4002 	uint32_t last_statsn;
4003 	bool found_pdu;
4004 	struct spdk_iscsi_pdu *old_pdu;
4005 
4006 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4007 	beg_run = from_be32(&reqh->beg_run);
4008 	run_length = from_be32(&reqh->run_len);
4009 
4010 	SPDK_DEBUGLOG(iscsi, "beg_run=%d, run_length=%d, conn->StatSN="
4011 		      "%d, conn->exp_statsn=%d\n", beg_run, run_length,
4012 		      conn->StatSN, conn->exp_statsn);
4013 
4014 	if (!beg_run) {
4015 		beg_run = conn->exp_statsn;
4016 	} else if (beg_run < conn->exp_statsn) {
4017 		SPDK_ERRLOG("Got Status SNACK Begrun: 0x%08x, RunLength: 0x%08x "
4018 			    "but already got ExpStatSN: 0x%08x on CID:%hu.\n",
4019 			    beg_run, run_length, conn->StatSN, conn->cid);
4020 
4021 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4022 	}
4023 
4024 	last_statsn = (!run_length) ? conn->StatSN : (beg_run + run_length);
4025 
4026 	for (i = beg_run; i < last_statsn; i++) {
4027 		found_pdu = false;
4028 		TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
4029 			if (from_be32(&old_pdu->bhs.stat_sn) == i) {
4030 				found_pdu = true;
4031 				break;
4032 			}
4033 		}
4034 
4035 		if (!found_pdu) {
4036 			SPDK_ERRLOG("Unable to find StatSN: 0x%08x. For a Status"
4037 				    "SNACK, assuming this is a proactive SNACK "
4038 				    "for an untransmitted StatSN, ignoring.\n",
4039 				    beg_run);
4040 		} else {
4041 			TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
4042 			iscsi_conn_write_pdu(conn, old_pdu, old_pdu->cb_fn, old_pdu->cb_arg);
4043 		}
4044 	}
4045 
4046 	return 0;
4047 }
4048 
4049 /* This function is used to handle the data ack snack */
4050 static int
4051 iscsi_handle_data_ack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4052 {
4053 	uint32_t transfer_tag;
4054 	uint32_t beg_run;
4055 	uint32_t run_length;
4056 	struct spdk_iscsi_pdu *old_pdu;
4057 	uint32_t old_datasn;
4058 	struct iscsi_bhs_snack_req *reqh;
4059 	struct spdk_iscsi_task *task;
4060 	struct iscsi_bhs_data_in *datain_header;
4061 	struct spdk_iscsi_task *primary;
4062 
4063 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4064 	transfer_tag = from_be32(&reqh->ttt);
4065 	beg_run = from_be32(&reqh->beg_run);
4066 	run_length = from_be32(&reqh->run_len);
4067 	task = NULL;
4068 	datain_header = NULL;
4069 
4070 	SPDK_DEBUGLOG(iscsi, "beg_run=%d,transfer_tag=%d,run_len=%d\n",
4071 		      beg_run, transfer_tag, run_length);
4072 
4073 	task = get_scsi_task_from_ttt(conn, transfer_tag);
4074 	if (!task) {
4075 		SPDK_ERRLOG("Data ACK SNACK for TTT: 0x%08x is invalid.\n",
4076 			    transfer_tag);
4077 		goto reject_return;
4078 	}
4079 
4080 	primary = iscsi_task_get_primary(task);
4081 	if ((run_length != 0) || (beg_run < primary->acked_data_sn)) {
4082 		SPDK_ERRLOG("TTT: 0x%08x Data ACK SNACK BegRUN: %d is less than "
4083 			    "the next expected acked DataSN: %d\n",
4084 			    transfer_tag, beg_run, primary->acked_data_sn);
4085 		goto reject_return;
4086 	}
4087 
4088 	primary->acked_data_sn = beg_run;
4089 
4090 	/* To free the pdu */
4091 	TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
4092 		if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
4093 			datain_header = (struct iscsi_bhs_data_in *) &old_pdu->bhs;
4094 			old_datasn = from_be32(&datain_header->data_sn);
4095 			if ((from_be32(&datain_header->ttt) == transfer_tag) &&
4096 			    (old_datasn == beg_run - 1)) {
4097 				TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
4098 				iscsi_conn_free_pdu(conn, old_pdu);
4099 				break;
4100 			}
4101 		}
4102 	}
4103 
4104 	SPDK_DEBUGLOG(iscsi, "Received Data ACK SNACK for TTT: 0x%08x,"
4105 		      " updated acked DataSN to 0x%08x.\n", transfer_tag,
4106 		      (task->acked_data_sn - 1));
4107 
4108 	return 0;
4109 
4110 reject_return:
4111 	return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_SNACK);
4112 }
4113 
4114 /* This function is used to handle the snack request from the initiator */
4115 static int
4116 iscsi_pdu_hdr_op_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4117 {
4118 	struct iscsi_bhs_snack_req *reqh;
4119 	struct spdk_iscsi_task *task;
4120 	int type;
4121 	uint32_t task_tag;
4122 	uint32_t beg_run;
4123 	uint32_t run_length;
4124 	int rc;
4125 
4126 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4127 		SPDK_ERRLOG("ISCSI_OP_SNACK not allowed in  discovery session\n");
4128 		return SPDK_ISCSI_CONNECTION_FATAL;
4129 	}
4130 
4131 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4132 	if (!conn->sess->ErrorRecoveryLevel) {
4133 		SPDK_ERRLOG("Got a SNACK request in ErrorRecoveryLevel=0\n");
4134 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4135 	}
4136 
4137 	type = reqh->flags & ISCSI_FLAG_SNACK_TYPE_MASK;
4138 	SPDK_DEBUGLOG(iscsi, "The value of type is %d\n", type);
4139 
4140 	switch (type) {
4141 	case 0:
4142 		reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4143 		task_tag = from_be32(&reqh->itt);
4144 		beg_run = from_be32(&reqh->beg_run);
4145 		run_length = from_be32(&reqh->run_len);
4146 
4147 		SPDK_DEBUGLOG(iscsi, "beg_run=%d, run_length=%d, "
4148 			      "task_tag=%x, transfer_tag=%u\n", beg_run,
4149 			      run_length, task_tag, from_be32(&reqh->ttt));
4150 
4151 		task = get_scsi_task_from_itt(conn, task_tag,
4152 					      ISCSI_OP_SCSI_DATAIN);
4153 		if (task) {
4154 			return iscsi_handle_recovery_datain(conn, task, pdu,
4155 							    beg_run, run_length, task_tag);
4156 		}
4157 		task = get_scsi_task_from_itt(conn, task_tag, ISCSI_OP_R2T);
4158 		if (task) {
4159 			return iscsi_handle_r2t_snack(conn, task, pdu, beg_run,
4160 						      run_length, task_tag);
4161 		}
4162 		SPDK_ERRLOG("It is Neither datain nor r2t recovery request\n");
4163 		rc = -1;
4164 		break;
4165 	case ISCSI_FLAG_SNACK_TYPE_STATUS:
4166 		rc = iscsi_handle_status_snack(conn, pdu);
4167 		break;
4168 	case ISCSI_FLAG_SNACK_TYPE_DATA_ACK:
4169 		rc = iscsi_handle_data_ack(conn, pdu);
4170 		break;
4171 	case ISCSI_FLAG_SNACK_TYPE_RDATA:
4172 		SPDK_ERRLOG("R-Data SNACK is Not Supported int spdk\n");
4173 		rc = iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4174 		break;
4175 	default:
4176 		SPDK_ERRLOG("Unknown SNACK type %d, protocol error\n", type);
4177 		rc = iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4178 		break;
4179 	}
4180 
4181 	return rc;
4182 }
4183 
4184 static int
4185 iscsi_pdu_hdr_op_data(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4186 {
4187 	struct spdk_iscsi_task	*task;
4188 	struct iscsi_bhs_data_out *reqh;
4189 	struct spdk_scsi_lun	*lun_dev;
4190 	struct spdk_mobj	*mobj;
4191 	uint32_t transfer_tag;
4192 	uint32_t task_tag;
4193 	uint32_t transfer_len;
4194 	uint32_t DataSN;
4195 	uint32_t buffer_offset;
4196 	uint32_t len;
4197 	int F_bit;
4198 	int rc;
4199 
4200 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4201 		SPDK_ERRLOG("ISCSI_OP_SCSI_DATAOUT not allowed in discovery session\n");
4202 		return SPDK_ISCSI_CONNECTION_FATAL;
4203 	}
4204 
4205 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4206 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
4207 	transfer_tag = from_be32(&reqh->ttt);
4208 	task_tag = from_be32(&reqh->itt);
4209 	DataSN = from_be32(&reqh->data_sn);
4210 	buffer_offset = from_be32(&reqh->buffer_offset);
4211 
4212 	if (pdu->data_segment_len > SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
4213 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4214 	}
4215 
4216 	task = get_transfer_task(conn, transfer_tag);
4217 	if (task == NULL) {
4218 		SPDK_ERRLOG("Not found task for transfer_tag=%x\n", transfer_tag);
4219 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4220 	}
4221 
4222 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
4223 
4224 	if (pdu->data_segment_len > task->desired_data_transfer_length) {
4225 		SPDK_ERRLOG("the dataout pdu data length is larger than the value sent by R2T PDU\n");
4226 		return SPDK_ISCSI_CONNECTION_FATAL;
4227 	}
4228 
4229 	if (task->tag != task_tag) {
4230 		SPDK_ERRLOG("The r2t task tag is %u, and the dataout task tag is %u\n",
4231 			    task->tag, task_tag);
4232 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4233 	}
4234 
4235 	if (DataSN != task->r2t_datasn) {
4236 		SPDK_ERRLOG("DataSN(%u) exp=%d error\n", DataSN, task->r2t_datasn);
4237 		if (conn->sess->ErrorRecoveryLevel >= 1) {
4238 			rc = iscsi_send_r2t_recovery(conn, task, task->acked_r2tsn, true);
4239 			if (rc == 0) {
4240 				return 0;
4241 			}
4242 		}
4243 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4244 	}
4245 
4246 	if (buffer_offset != task->next_expected_r2t_offset) {
4247 		SPDK_ERRLOG("offset(%u) error\n", buffer_offset);
4248 		return SPDK_ISCSI_CONNECTION_FATAL;
4249 	}
4250 
4251 	transfer_len = task->scsi.transfer_len;
4252 	task->current_r2t_length += pdu->data_segment_len;
4253 	task->next_expected_r2t_offset += pdu->data_segment_len;
4254 	task->r2t_datasn++;
4255 
4256 	if (task->current_r2t_length > conn->sess->MaxBurstLength) {
4257 		SPDK_ERRLOG("R2T burst(%u) > MaxBurstLength(%u)\n",
4258 			    task->current_r2t_length,
4259 			    conn->sess->MaxBurstLength);
4260 		return SPDK_ISCSI_CONNECTION_FATAL;
4261 	}
4262 
4263 	if (F_bit) {
4264 		/*
4265 		 * This R2T burst is done. Clear the length before we
4266 		 *  receive a PDU for the next R2t burst.
4267 		 */
4268 		task->current_r2t_length = 0;
4269 	}
4270 
4271 	if (task->next_expected_r2t_offset == transfer_len) {
4272 		task->acked_r2tsn++;
4273 	} else if (F_bit && (task->next_r2t_offset < transfer_len)) {
4274 		task->acked_r2tsn++;
4275 		len = spdk_min(conn->sess->MaxBurstLength,
4276 			       (transfer_len - task->next_r2t_offset));
4277 		rc = iscsi_send_r2t(conn, task, task->next_r2t_offset, len,
4278 				    task->ttt, &task->R2TSN);
4279 		if (rc < 0) {
4280 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
4281 		}
4282 		task->next_r2t_offset += len;
4283 	}
4284 
4285 	if (lun_dev == NULL) {
4286 		SPDK_DEBUGLOG(iscsi, "LUN %d is removed, reject this PDU.\n",
4287 			      task->lun_id);
4288 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4289 	} else if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(lun_dev, &task->scsi, &pdu->dif_ctx))) {
4290 		pdu->dif_insert_or_strip = true;
4291 	}
4292 
4293 	mobj = iscsi_task_get_mobj(task);
4294 	if (mobj == NULL) {
4295 		if (!pdu->dif_insert_or_strip) {
4296 			/* More Data-OUT PDUs may follow. Increase the buffer size up to
4297 			 * SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH to merge them into a
4298 			 * single subtask.
4299 			 */
4300 			pdu->data_buf_len = spdk_min(task->desired_data_transfer_length,
4301 						     SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4302 		}
4303 	} else {
4304 		/* Set up the data buffer from the one saved by the primary task. */
4305 		pdu->mobj[0] = mobj;
4306 		pdu->data = (void *)((uint64_t)mobj->buf + mobj->data_len);
4307 		pdu->data_from_mempool = true;
4308 		pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4309 
4310 		iscsi_task_set_mobj(task, NULL);
4311 	}
4312 
4313 	return 0;
4314 }
4315 
4316 static int
4317 iscsi_pdu_payload_op_data(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4318 {
4319 	struct spdk_iscsi_task *task;
4320 	struct iscsi_bhs_data_out *reqh;
4321 	struct spdk_mobj *mobj;
4322 	uint32_t transfer_tag;
4323 	int F_bit;
4324 	int rc;
4325 
4326 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4327 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
4328 	transfer_tag = from_be32(&reqh->ttt);
4329 
4330 	task = get_transfer_task(conn, transfer_tag);
4331 	if (spdk_unlikely(task == NULL)) {
4332 		SPDK_ERRLOG("Not found for transfer_tag=%x\n", transfer_tag);
4333 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4334 	}
4335 
4336 	if (spdk_scsi_dev_get_lun(conn->dev, task->lun_id) == NULL) {
4337 		SPDK_DEBUGLOG(iscsi, "LUN %d is removed, reject this PDU.\n",
4338 			      task->lun_id);
4339 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4340 	}
4341 
4342 	/* If current PDU is final in a sequence, submit all received data,
4343 	 * otherwise, continue aggregation until the first data buffer is full.
4344 	 * We do not use SGL and instead create a subtask per data buffer. Hence further
4345 	 * aggregation does not improve any performance.
4346 	 */
4347 	mobj = pdu->mobj[0];
4348 	assert(mobj != NULL);
4349 
4350 	if (F_bit || mobj->data_len >= SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH ||
4351 	    pdu->dif_insert_or_strip) {
4352 		rc = iscsi_submit_write_subtask(conn, task, pdu, mobj);
4353 		if (rc != 0) {
4354 			return rc;
4355 		}
4356 	} else {
4357 		assert(pdu->mobj[1] == NULL);
4358 		iscsi_task_set_mobj(task, mobj);
4359 		pdu->mobj[0] = NULL;
4360 		return 0;
4361 	}
4362 
4363 	mobj = pdu->mobj[1];
4364 	if (mobj == NULL) {
4365 		return 0;
4366 	}
4367 
4368 	assert(pdu->dif_insert_or_strip == false);
4369 	assert(mobj->data_len < SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4370 
4371 	if (F_bit) {
4372 		return iscsi_submit_write_subtask(conn, task, pdu, mobj);
4373 	} else {
4374 		iscsi_task_set_mobj(task, mobj);
4375 		pdu->mobj[1] = NULL;
4376 		return 0;
4377 	}
4378 }
4379 
4380 static void
4381 init_login_reject_response(struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
4382 {
4383 	struct iscsi_bhs_login_rsp *rsph;
4384 
4385 	memset(rsp_pdu, 0, sizeof(struct spdk_iscsi_pdu));
4386 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
4387 	rsph->version_max = ISCSI_VERSION;
4388 	rsph->version_act = ISCSI_VERSION;
4389 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
4390 	rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
4391 	rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
4392 	rsph->itt = pdu->bhs.itt;
4393 }
4394 
4395 static void
4396 iscsi_pdu_dump(struct spdk_iscsi_pdu *pdu)
4397 {
4398 	spdk_log_dump(stderr, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
4399 }
4400 
4401 /* This function is used to refree the pdu when it is acknowledged */
4402 static void
4403 remove_acked_pdu(struct spdk_iscsi_conn *conn, uint32_t ExpStatSN)
4404 {
4405 	struct spdk_iscsi_pdu *pdu, *pdu_temp;
4406 	uint32_t stat_sn;
4407 
4408 	conn->exp_statsn = spdk_min(ExpStatSN, conn->StatSN);
4409 	TAILQ_FOREACH_SAFE(pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
4410 		stat_sn = from_be32(&pdu->bhs.stat_sn);
4411 		if (spdk_sn32_lt(stat_sn, conn->exp_statsn)) {
4412 			TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
4413 			iscsi_conn_free_pdu(conn, pdu);
4414 		}
4415 	}
4416 }
4417 
4418 static int
4419 iscsi_update_cmdsn(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4420 {
4421 	int opcode;
4422 	uint32_t ExpStatSN;
4423 	int I_bit;
4424 	struct spdk_iscsi_sess *sess;
4425 	struct iscsi_bhs_scsi_req *reqh;
4426 
4427 	sess = conn->sess;
4428 	if (!sess) {
4429 		SPDK_ERRLOG("Connection has no associated session!\n");
4430 		return SPDK_ISCSI_CONNECTION_FATAL;
4431 	}
4432 
4433 	opcode = pdu->bhs.opcode;
4434 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
4435 
4436 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
4437 
4438 	I_bit = reqh->immediate;
4439 	if (I_bit == 0) {
4440 		if (spdk_sn32_lt(pdu->cmd_sn, sess->ExpCmdSN) ||
4441 		    spdk_sn32_gt(pdu->cmd_sn, sess->MaxCmdSN)) {
4442 			if (sess->session_type == SESSION_TYPE_NORMAL &&
4443 			    opcode != ISCSI_OP_SCSI_DATAOUT) {
4444 				SPDK_ERRLOG("CmdSN(%u) ignore (ExpCmdSN=%u, MaxCmdSN=%u)\n",
4445 					    pdu->cmd_sn, sess->ExpCmdSN, sess->MaxCmdSN);
4446 
4447 				if (sess->ErrorRecoveryLevel >= 1) {
4448 					SPDK_DEBUGLOG(iscsi, "Skip the error in ERL 1 and 2\n");
4449 				} else {
4450 					return SPDK_PDU_FATAL;
4451 				}
4452 			}
4453 		}
4454 	} else if (pdu->cmd_sn != sess->ExpCmdSN) {
4455 		SPDK_ERRLOG("CmdSN(%u) error ExpCmdSN=%u\n", pdu->cmd_sn, sess->ExpCmdSN);
4456 
4457 		if (sess->ErrorRecoveryLevel >= 1) {
4458 			SPDK_DEBUGLOG(iscsi, "Skip the error in ERL 1 and 2\n");
4459 		} else if (opcode != ISCSI_OP_NOPOUT) {
4460 			/*
4461 			 * The Linux initiator does not send valid CmdSNs for
4462 			 *  nopout under heavy load, so do not close the
4463 			 *  connection in that case.
4464 			 */
4465 			return SPDK_ISCSI_CONNECTION_FATAL;
4466 		}
4467 	}
4468 
4469 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
4470 	if (spdk_sn32_gt(ExpStatSN, conn->StatSN)) {
4471 		SPDK_DEBUGLOG(iscsi, "StatSN(%u) advanced\n", ExpStatSN);
4472 		ExpStatSN = conn->StatSN;
4473 	}
4474 
4475 	if (sess->ErrorRecoveryLevel >= 1) {
4476 		remove_acked_pdu(conn, ExpStatSN);
4477 	}
4478 
4479 	if (!I_bit && opcode != ISCSI_OP_SCSI_DATAOUT) {
4480 		sess->ExpCmdSN++;
4481 	}
4482 
4483 	return 0;
4484 }
4485 
4486 static int
4487 iscsi_pdu_hdr_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4488 {
4489 	int opcode;
4490 	int rc;
4491 	struct spdk_iscsi_pdu *rsp_pdu = NULL;
4492 
4493 	if (pdu == NULL) {
4494 		return -1;
4495 	}
4496 
4497 	opcode = pdu->bhs.opcode;
4498 
4499 	SPDK_DEBUGLOG(iscsi, "opcode %x\n", opcode);
4500 
4501 	if (opcode == ISCSI_OP_LOGIN) {
4502 		return iscsi_pdu_hdr_op_login(conn, pdu);
4503 	}
4504 
4505 	/* connection in login phase but receive non-login opcode
4506 	 * return response code 0x020b to initiator.
4507 	 * */
4508 	if (!conn->full_feature && conn->state == ISCSI_CONN_STATE_RUNNING) {
4509 		rsp_pdu = iscsi_get_pdu(conn);
4510 		if (rsp_pdu == NULL) {
4511 			return SPDK_ISCSI_CONNECTION_FATAL;
4512 		}
4513 		init_login_reject_response(pdu, rsp_pdu);
4514 		iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
4515 		SPDK_ERRLOG("Received opcode %d in login phase\n", opcode);
4516 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
4517 	} else if (conn->state == ISCSI_CONN_STATE_INVALID) {
4518 		SPDK_ERRLOG("before Full Feature\n");
4519 		iscsi_pdu_dump(pdu);
4520 		return SPDK_ISCSI_CONNECTION_FATAL;
4521 	}
4522 
4523 	rc = iscsi_update_cmdsn(conn, pdu);
4524 	if (rc != 0) {
4525 		return rc;
4526 	}
4527 
4528 	switch (opcode) {
4529 	case ISCSI_OP_NOPOUT:
4530 		rc = iscsi_pdu_hdr_op_nopout(conn, pdu);
4531 		break;
4532 
4533 	case ISCSI_OP_SCSI:
4534 		rc = iscsi_pdu_hdr_op_scsi(conn, pdu);
4535 		break;
4536 	case ISCSI_OP_TASK:
4537 		rc = iscsi_pdu_hdr_op_task(conn, pdu);
4538 		break;
4539 
4540 	case ISCSI_OP_TEXT:
4541 		rc = iscsi_pdu_hdr_op_text(conn, pdu);
4542 		break;
4543 
4544 	case ISCSI_OP_LOGOUT:
4545 		rc = iscsi_pdu_hdr_op_logout(conn, pdu);
4546 		break;
4547 
4548 	case ISCSI_OP_SCSI_DATAOUT:
4549 		rc = iscsi_pdu_hdr_op_data(conn, pdu);
4550 		break;
4551 
4552 	case ISCSI_OP_SNACK:
4553 		rc = iscsi_pdu_hdr_op_snack(conn, pdu);
4554 		break;
4555 
4556 	default:
4557 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4558 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4559 	}
4560 
4561 	if (rc < 0) {
4562 		SPDK_ERRLOG("processing PDU header (opcode=%x) failed on %s(%s)\n",
4563 			    opcode,
4564 			    conn->target_port != NULL ? spdk_scsi_port_get_name(conn->target_port) : "NULL",
4565 			    conn->initiator_port != NULL ? spdk_scsi_port_get_name(conn->initiator_port) : "NULL");
4566 	}
4567 
4568 	return rc;
4569 }
4570 
4571 static int
4572 iscsi_pdu_payload_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4573 {
4574 	int opcode;
4575 	int rc = 0;
4576 
4577 	opcode = pdu->bhs.opcode;
4578 
4579 	SPDK_DEBUGLOG(iscsi, "opcode %x\n", opcode);
4580 
4581 	switch (opcode) {
4582 	case ISCSI_OP_LOGIN:
4583 		rc = iscsi_pdu_payload_op_login(conn, pdu);
4584 		break;
4585 	case ISCSI_OP_NOPOUT:
4586 		rc = iscsi_pdu_payload_op_nopout(conn, pdu);
4587 		break;
4588 	case ISCSI_OP_SCSI:
4589 		rc = iscsi_pdu_payload_op_scsi(conn, pdu);
4590 		break;
4591 	case ISCSI_OP_TASK:
4592 		break;
4593 	case ISCSI_OP_TEXT:
4594 		rc = iscsi_pdu_payload_op_text(conn, pdu);
4595 		break;
4596 	case ISCSI_OP_LOGOUT:
4597 		break;
4598 	case ISCSI_OP_SCSI_DATAOUT:
4599 		rc = iscsi_pdu_payload_op_data(conn, pdu);
4600 		break;
4601 	case ISCSI_OP_SNACK:
4602 		break;
4603 	default:
4604 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4605 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4606 	}
4607 
4608 	if (rc < 0) {
4609 		SPDK_ERRLOG("processing PDU payload (opcode=%x) failed on %s(%s)\n",
4610 			    opcode,
4611 			    conn->target_port != NULL ? spdk_scsi_port_get_name(conn->target_port) : "NULL",
4612 			    conn->initiator_port != NULL ? spdk_scsi_port_get_name(conn->initiator_port) : "NULL");
4613 	}
4614 
4615 	return rc;
4616 }
4617 
4618 /* Return zero if completed to read payload, positive number if still in progress,
4619  * or negative number if any error.
4620  */
4621 static int
4622 iscsi_pdu_payload_read(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4623 {
4624 	struct spdk_mempool *pool;
4625 	struct spdk_mobj *mobj;
4626 	uint32_t data_len;
4627 	uint32_t read_len;
4628 	uint32_t crc32c;
4629 	int rc;
4630 
4631 	data_len = pdu->data_segment_len;
4632 	read_len = data_len - pdu->data_valid_bytes;
4633 
4634 	mobj = pdu->mobj[0];
4635 	if (mobj == NULL) {
4636 		if (pdu->data_buf_len <= iscsi_get_max_immediate_data_size()) {
4637 			pool = g_iscsi.pdu_immediate_data_pool;
4638 			pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(iscsi_get_max_immediate_data_size());
4639 		} else if (pdu->data_buf_len <= SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
4640 			pool = g_iscsi.pdu_data_out_pool;
4641 			pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4642 		} else {
4643 			SPDK_ERRLOG("Data(%d) > MaxSegment(%d)\n",
4644 				    data_len, SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4645 			return -1;
4646 		}
4647 		mobj = iscsi_datapool_get(pool);
4648 		if (mobj == NULL) {
4649 			return 1;
4650 		}
4651 		pdu->mobj[0] = mobj;
4652 		pdu->data = mobj->buf;
4653 		pdu->data_from_mempool = true;
4654 	} else if (mobj->data_len == SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH && read_len > 0) {
4655 		mobj = pdu->mobj[1];
4656 		if (mobj == NULL) {
4657 			/* The first data buffer just ran out. Allocate the second data buffer and
4658 			 * continue reading the data segment.
4659 			 */
4660 			assert(pdu->data_from_mempool == true);
4661 			assert(!pdu->dif_insert_or_strip);
4662 
4663 			if (conn->data_digest) {
4664 				iscsi_pdu_calc_partial_data_digest(pdu);
4665 			}
4666 			mobj = iscsi_datapool_get(g_iscsi.pdu_data_out_pool);
4667 			if (mobj == NULL) {
4668 				return 1;
4669 			}
4670 			pdu->mobj[1] = mobj;
4671 			pdu->data = mobj->buf;
4672 			pdu->data_offset = pdu->data_valid_bytes;
4673 			pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4674 		}
4675 	}
4676 
4677 	/* copy the actual data into local buffer */
4678 	read_len = spdk_min(read_len, SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH - mobj->data_len);
4679 
4680 	if (read_len > 0) {
4681 		rc = iscsi_conn_read_data_segment(conn,
4682 						  pdu,
4683 						  pdu->data_valid_bytes - pdu->data_offset,
4684 						  read_len);
4685 		if (rc < 0) {
4686 			return rc;
4687 		}
4688 
4689 		mobj->data_len += rc;
4690 		pdu->data_valid_bytes += rc;
4691 		if (pdu->data_valid_bytes < data_len) {
4692 			return 1;
4693 		}
4694 	}
4695 
4696 	/* copy out the data digest */
4697 	if (conn->data_digest &&
4698 	    pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
4699 		rc = iscsi_conn_read_data(conn,
4700 					  ISCSI_DIGEST_LEN - pdu->ddigest_valid_bytes,
4701 					  pdu->data_digest + pdu->ddigest_valid_bytes);
4702 		if (rc < 0) {
4703 			return rc;
4704 		}
4705 
4706 		pdu->ddigest_valid_bytes += rc;
4707 		if (pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
4708 			return 1;
4709 		}
4710 	}
4711 
4712 	/* check data digest */
4713 	if (conn->data_digest) {
4714 		iscsi_pdu_calc_partial_data_digest(pdu);
4715 		crc32c = iscsi_pdu_calc_partial_data_digest_done(pdu);
4716 
4717 		rc = MATCH_DIGEST_WORD(pdu->data_digest, crc32c);
4718 		if (rc == 0) {
4719 			SPDK_ERRLOG("data digest error (%s)\n", conn->initiator_name);
4720 			return -1;
4721 		}
4722 	}
4723 
4724 	return 0;
4725 }
4726 
4727 static int
4728 iscsi_read_pdu(struct spdk_iscsi_conn *conn)
4729 {
4730 	enum iscsi_pdu_recv_state prev_state;
4731 	struct spdk_iscsi_pdu *pdu;
4732 	uint32_t crc32c;
4733 	int ahs_len;
4734 	int rc;
4735 
4736 	do {
4737 		prev_state = conn->pdu_recv_state;
4738 		pdu = conn->pdu_in_progress;
4739 
4740 		switch (conn->pdu_recv_state) {
4741 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY:
4742 			assert(conn->pdu_in_progress == NULL);
4743 
4744 			conn->pdu_in_progress = iscsi_get_pdu(conn);
4745 			if (conn->pdu_in_progress == NULL) {
4746 				return SPDK_ISCSI_CONNECTION_FATAL;
4747 			}
4748 			conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR;
4749 			break;
4750 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR:
4751 			if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
4752 				rc = iscsi_conn_read_data(conn,
4753 							  ISCSI_BHS_LEN - pdu->bhs_valid_bytes,
4754 							  (uint8_t *)&pdu->bhs + pdu->bhs_valid_bytes);
4755 				if (rc < 0) {
4756 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4757 					break;
4758 				}
4759 				pdu->bhs_valid_bytes += rc;
4760 				if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
4761 					return 0;
4762 				}
4763 			}
4764 
4765 			/* conn->is_logged_out must be checked after completing to process
4766 			 * logout request, i.e., before processing PDU header in this state
4767 			 * machine, otherwise logout response may not be sent to initiator
4768 			 * and initiator may get logout timeout.
4769 			 */
4770 			if (spdk_unlikely(conn->is_logged_out)) {
4771 				SPDK_DEBUGLOG(iscsi, "pdu received after logout\n");
4772 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4773 				break;
4774 			}
4775 
4776 			pdu->data_segment_len = ISCSI_ALIGN(DGET24(pdu->bhs.data_segment_len));
4777 			pdu->data_buf_len = pdu->data_segment_len;
4778 
4779 			/* AHS */
4780 			ahs_len = pdu->bhs.total_ahs_len * 4;
4781 			if (ahs_len > ISCSI_AHS_LEN) {
4782 				SPDK_DEBUGLOG(iscsi, "pdu ahs length %d is invalid\n", ahs_len);
4783 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4784 				break;
4785 			}
4786 
4787 			if (pdu->ahs_valid_bytes < ahs_len) {
4788 				rc = iscsi_conn_read_data(conn,
4789 							  ahs_len - pdu->ahs_valid_bytes,
4790 							  pdu->ahs + pdu->ahs_valid_bytes);
4791 				if (rc < 0) {
4792 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4793 					break;
4794 				}
4795 
4796 				pdu->ahs_valid_bytes += rc;
4797 				if (pdu->ahs_valid_bytes < ahs_len) {
4798 					return 0;
4799 				}
4800 			}
4801 
4802 			/* Header Digest */
4803 			if (conn->header_digest &&
4804 			    pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
4805 				rc = iscsi_conn_read_data(conn,
4806 							  ISCSI_DIGEST_LEN - pdu->hdigest_valid_bytes,
4807 							  pdu->header_digest + pdu->hdigest_valid_bytes);
4808 				if (rc < 0) {
4809 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4810 					break;
4811 				}
4812 
4813 				pdu->hdigest_valid_bytes += rc;
4814 				if (pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
4815 					return 0;
4816 				}
4817 			}
4818 
4819 			if (conn->header_digest) {
4820 				crc32c = iscsi_pdu_calc_header_digest(pdu);
4821 				rc = MATCH_DIGEST_WORD(pdu->header_digest, crc32c);
4822 				if (rc == 0) {
4823 					SPDK_ERRLOG("header digest error (%s)\n", conn->initiator_name);
4824 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4825 					break;
4826 				}
4827 			}
4828 
4829 			rc = iscsi_pdu_hdr_handle(conn, pdu);
4830 			if (rc < 0) {
4831 				SPDK_ERRLOG("Critical error is detected. Close the connection\n");
4832 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4833 				break;
4834 			}
4835 
4836 			conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD;
4837 			break;
4838 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD:
4839 			if (pdu->data_segment_len != 0) {
4840 				rc = iscsi_pdu_payload_read(conn, pdu);
4841 				if (rc > 0) {
4842 					return 0;
4843 				} else if (rc < 0) {
4844 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4845 					break;
4846 				}
4847 			}
4848 
4849 			/* All data for this PDU has now been read from the socket. */
4850 			spdk_trace_record(TRACE_ISCSI_READ_PDU, conn->id, pdu->data_valid_bytes,
4851 					  (uintptr_t)pdu, pdu->bhs.opcode);
4852 
4853 			if (!pdu->is_rejected) {
4854 				rc = iscsi_pdu_payload_handle(conn, pdu);
4855 			} else {
4856 				rc = 0;
4857 			}
4858 			if (rc == 0) {
4859 				spdk_trace_record(TRACE_ISCSI_TASK_EXECUTED, 0, 0, (uintptr_t)pdu);
4860 				iscsi_put_pdu(pdu);
4861 				conn->pdu_in_progress = NULL;
4862 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY;
4863 				return 1;
4864 			} else {
4865 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4866 			}
4867 			break;
4868 		case ISCSI_PDU_RECV_STATE_ERROR:
4869 			return SPDK_ISCSI_CONNECTION_FATAL;
4870 		default:
4871 			assert(false);
4872 			SPDK_ERRLOG("code should not come here\n");
4873 			break;
4874 		}
4875 	} while (prev_state != conn->pdu_recv_state);
4876 
4877 	return 0;
4878 }
4879 
4880 #define GET_PDU_LOOP_COUNT	16
4881 
4882 int
4883 iscsi_handle_incoming_pdus(struct spdk_iscsi_conn *conn)
4884 {
4885 	int i, rc;
4886 
4887 	/* Read new PDUs from network */
4888 	for (i = 0; i < GET_PDU_LOOP_COUNT; i++) {
4889 		rc = iscsi_read_pdu(conn);
4890 		if (rc == 0) {
4891 			break;
4892 		} else if (rc < 0) {
4893 			return rc;
4894 		}
4895 
4896 		if (conn->is_stopped) {
4897 			break;
4898 		}
4899 	}
4900 
4901 	return i;
4902 }
4903