xref: /spdk/lib/iscsi/iscsi.c (revision 4c59c6ac533bb65954118dd493d9b7347657b0e5)
1 /*   SPDX-License-Identifier: BSD-3-Clause
2  *   Copyright (C) 2008-2012 Daisuke Aoyama <aoyama@peach.ne.jp>.
3  *   Copyright (c) Intel Corporation.
4  *   All rights reserved.
5  */
6 
7 #include "spdk/stdinc.h"
8 
9 #include "spdk/base64.h"
10 #include "spdk/crc32.h"
11 #include "spdk/endian.h"
12 #include "spdk/env.h"
13 #include "spdk/likely.h"
14 #include "spdk/trace.h"
15 #include "spdk/sock.h"
16 #include "spdk/string.h"
17 #include "spdk/queue.h"
18 
19 #include "iscsi/md5.h"
20 #include "iscsi/iscsi.h"
21 #include "iscsi/param.h"
22 #include "iscsi/tgt_node.h"
23 #include "iscsi/task.h"
24 #include "iscsi/conn.h"
25 #include "spdk/scsi.h"
26 #include "spdk/bdev.h"
27 #include "iscsi/portal_grp.h"
28 
29 #include "spdk/log.h"
30 
31 #include "spdk_internal/sgl.h"
32 
33 #define MAX_TMPBUF 1024
34 
35 #ifdef __FreeBSD__
36 #define HAVE_SRANDOMDEV 1
37 #define HAVE_ARC4RANDOM 1
38 #endif
39 
40 struct spdk_iscsi_globals g_iscsi = {
41 	.mutex = PTHREAD_MUTEX_INITIALIZER,
42 	.portal_head = TAILQ_HEAD_INITIALIZER(g_iscsi.portal_head),
43 	.pg_head = TAILQ_HEAD_INITIALIZER(g_iscsi.pg_head),
44 	.ig_head = TAILQ_HEAD_INITIALIZER(g_iscsi.ig_head),
45 	.target_head = TAILQ_HEAD_INITIALIZER(g_iscsi.target_head),
46 	.auth_group_head = TAILQ_HEAD_INITIALIZER(g_iscsi.auth_group_head),
47 	.poll_group_head = TAILQ_HEAD_INITIALIZER(g_iscsi.poll_group_head),
48 };
49 
50 #define MATCH_DIGEST_WORD(BUF, CRC32C) \
51 	(    ((((uint32_t) *((uint8_t *)(BUF)+0)) << 0)		\
52 	    | (((uint32_t) *((uint8_t *)(BUF)+1)) << 8)		\
53 	    | (((uint32_t) *((uint8_t *)(BUF)+2)) << 16)	\
54 	    | (((uint32_t) *((uint8_t *)(BUF)+3)) << 24))	\
55 	    == (CRC32C))
56 
57 #ifndef HAVE_SRANDOMDEV
58 static void
59 srandomdev(void)
60 {
61 	unsigned long seed;
62 	time_t now;
63 	pid_t pid;
64 
65 	pid = getpid();
66 	now = time(NULL);
67 	seed = pid ^ now;
68 	srandom(seed);
69 }
70 #endif /* HAVE_SRANDOMDEV */
71 
72 #ifndef HAVE_ARC4RANDOM
73 static int g_arc4random_initialized = 0;
74 
75 static uint32_t
76 arc4random(void)
77 {
78 	uint32_t r;
79 	uint32_t r1, r2;
80 
81 	if (!g_arc4random_initialized) {
82 		srandomdev();
83 		g_arc4random_initialized = 1;
84 	}
85 	r1 = (uint32_t)(random() & 0xffff);
86 	r2 = (uint32_t)(random() & 0xffff);
87 	r = (r1 << 16) | r2;
88 	return r;
89 }
90 #endif /* HAVE_ARC4RANDOM */
91 
92 static void
93 gen_random(uint8_t *buf, size_t len)
94 {
95 	uint32_t r;
96 	size_t idx;
97 
98 	for (idx = 0; idx < len; idx++) {
99 		r = arc4random();
100 		buf[idx] = (uint8_t) r;
101 	}
102 }
103 
104 static uint64_t
105 iscsi_get_isid(const uint8_t isid[6])
106 {
107 	return (uint64_t)isid[0] << 40 |
108 	       (uint64_t)isid[1] << 32 |
109 	       (uint64_t)isid[2] << 24 |
110 	       (uint64_t)isid[3] << 16 |
111 	       (uint64_t)isid[4] << 8 |
112 	       (uint64_t)isid[5];
113 }
114 
115 static int
116 bin2hex(char *buf, size_t len, const uint8_t *data, size_t data_len)
117 {
118 	const char *digits = "0123456789ABCDEF";
119 	size_t total = 0;
120 	size_t idx;
121 
122 	if (len < 3) {
123 		return -1;
124 	}
125 	buf[total] = '0';
126 	total++;
127 	buf[total] = 'x';
128 	total++;
129 	buf[total] = '\0';
130 
131 	for (idx = 0; idx < data_len; idx++) {
132 		if (total + 3 > len) {
133 			buf[total] = '\0';
134 			return - 1;
135 		}
136 		buf[total] = digits[(data[idx] >> 4) & 0x0fU];
137 		total++;
138 		buf[total] = digits[data[idx] & 0x0fU];
139 		total++;
140 	}
141 	buf[total] = '\0';
142 	return total;
143 }
144 
145 static int
146 hex2bin(uint8_t *data, size_t data_len, const char *str)
147 {
148 	const char *digits = "0123456789ABCDEF";
149 	const char *dp;
150 	const char *p;
151 	size_t total = 0;
152 	int n0, n1;
153 
154 	p = str;
155 	if (p[0] != '0' && (p[1] != 'x' && p[1] != 'X')) {
156 		return -1;
157 	}
158 	p += 2;
159 
160 	while (p[0] != '\0' && p[1] != '\0') {
161 		if (total >= data_len) {
162 			return -1;
163 		}
164 		dp = strchr(digits, toupper((int) p[0]));
165 		if (dp == NULL) {
166 			return -1;
167 		}
168 		n0 = (int)(dp - digits);
169 		dp = strchr(digits, toupper((int) p[1]));
170 		if (dp == NULL) {
171 			return -1;
172 		}
173 		n1 = (int)(dp - digits);
174 
175 		data[total] = (uint8_t)(((n0 & 0x0fU) << 4) | (n1 & 0x0fU));
176 		total++;
177 		p += 2;
178 	}
179 	return total;
180 }
181 
182 static int
183 iscsi_reject(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu,
184 	     int reason)
185 {
186 	struct spdk_iscsi_pdu *rsp_pdu;
187 	struct iscsi_bhs_reject *rsph;
188 	uint8_t *data;
189 	int total_ahs_len;
190 	int data_len;
191 	int alloc_len;
192 
193 	pdu->is_rejected = true;
194 
195 	total_ahs_len = pdu->bhs.total_ahs_len;
196 	data_len = 0;
197 	alloc_len = ISCSI_BHS_LEN + (4 * total_ahs_len);
198 
199 	if (conn->header_digest) {
200 		alloc_len += ISCSI_DIGEST_LEN;
201 	}
202 
203 	data = calloc(1, alloc_len);
204 	if (!data) {
205 		SPDK_ERRLOG("calloc() failed for data segment\n");
206 		return -ENOMEM;
207 	}
208 
209 	SPDK_DEBUGLOG(iscsi, "Reject PDU reason=%d\n", reason);
210 
211 	if (conn->sess != NULL) {
212 		SPDK_DEBUGLOG(iscsi,
213 			      "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
214 			      conn->StatSN, conn->sess->ExpCmdSN,
215 			      conn->sess->MaxCmdSN);
216 	} else {
217 		SPDK_DEBUGLOG(iscsi, "StatSN=%u\n", conn->StatSN);
218 	}
219 
220 	memcpy(data, &pdu->bhs, ISCSI_BHS_LEN);
221 	data_len += ISCSI_BHS_LEN;
222 
223 	if (total_ahs_len != 0) {
224 		total_ahs_len = spdk_min((4 * total_ahs_len), ISCSI_AHS_LEN);
225 		memcpy(data + data_len, pdu->ahs, total_ahs_len);
226 		data_len += total_ahs_len;
227 	}
228 
229 	if (conn->header_digest) {
230 		memcpy(data + data_len, pdu->header_digest, ISCSI_DIGEST_LEN);
231 		data_len += ISCSI_DIGEST_LEN;
232 	}
233 
234 	rsp_pdu = iscsi_get_pdu(conn);
235 	if (rsp_pdu == NULL) {
236 		free(data);
237 		return -ENOMEM;
238 	}
239 
240 	rsph = (struct iscsi_bhs_reject *)&rsp_pdu->bhs;
241 	rsp_pdu->data = data;
242 	rsph->opcode = ISCSI_OP_REJECT;
243 	rsph->flags |= 0x80;	/* bit 0 is default to 1 */
244 	rsph->reason = reason;
245 	DSET24(rsph->data_segment_len, data_len);
246 
247 	rsph->ffffffff = 0xffffffffU;
248 	to_be32(&rsph->stat_sn, conn->StatSN);
249 	conn->StatSN++;
250 
251 	if (conn->sess != NULL) {
252 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
253 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
254 	} else {
255 		to_be32(&rsph->exp_cmd_sn, 1);
256 		to_be32(&rsph->max_cmd_sn, 1);
257 	}
258 
259 	SPDK_LOGDUMP(iscsi, "PDU", (void *)&rsp_pdu->bhs, ISCSI_BHS_LEN);
260 
261 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
262 
263 	return 0;
264 }
265 
266 uint32_t
267 iscsi_pdu_calc_header_digest(struct spdk_iscsi_pdu *pdu)
268 {
269 	uint32_t crc32c;
270 	uint32_t ahs_len_bytes = pdu->bhs.total_ahs_len * 4;
271 
272 	crc32c = SPDK_CRC32C_INITIAL;
273 	crc32c = spdk_crc32c_update(&pdu->bhs, ISCSI_BHS_LEN, crc32c);
274 
275 	if (ahs_len_bytes) {
276 		crc32c = spdk_crc32c_update(pdu->ahs, ahs_len_bytes, crc32c);
277 	}
278 
279 	/* BHS and AHS are always 4-byte multiples in length, so no padding is necessary. */
280 
281 	/* Finalize CRC by inverting all bits. */
282 	return crc32c ^ SPDK_CRC32C_XOR;
283 }
284 
285 /* Calculate CRC for each partial data segment. */
286 static void
287 iscsi_pdu_calc_partial_data_digest(struct spdk_iscsi_pdu *pdu)
288 {
289 	struct iovec iov;
290 	uint32_t num_blocks;
291 
292 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
293 		pdu->crc32c = spdk_crc32c_update(pdu->data,
294 						 pdu->data_valid_bytes - pdu->data_offset,
295 						 pdu->crc32c);
296 	} else {
297 		iov.iov_base = pdu->data;
298 		iov.iov_len = pdu->data_buf_len;
299 		num_blocks = pdu->data_buf_len / pdu->dif_ctx.block_size;
300 
301 		spdk_dif_update_crc32c(&iov, 1, num_blocks, &pdu->crc32c, &pdu->dif_ctx);
302 	}
303 }
304 
305 static uint32_t
306 iscsi_pdu_calc_partial_data_digest_done(struct spdk_iscsi_pdu *pdu)
307 {
308 	uint32_t crc32c = pdu->crc32c;
309 	uint32_t mod;
310 
311 	/* Include padding bytes into CRC if any. */
312 	mod = pdu->data_valid_bytes % ISCSI_ALIGNMENT;
313 	if (mod != 0) {
314 		uint32_t pad_length = ISCSI_ALIGNMENT - mod;
315 		uint8_t pad[3] = {0, 0, 0};
316 
317 		assert(pad_length > 0);
318 		assert(pad_length <= sizeof(pad));
319 		crc32c = spdk_crc32c_update(pad, pad_length, crc32c);
320 	}
321 
322 	/* Finalize CRC by inverting all bits. */
323 	return crc32c ^ SPDK_CRC32C_XOR;
324 }
325 
326 uint32_t
327 iscsi_pdu_calc_data_digest(struct spdk_iscsi_pdu *pdu)
328 {
329 	uint32_t data_len = DGET24(pdu->bhs.data_segment_len);
330 	uint32_t crc32c;
331 	uint32_t mod;
332 	struct iovec iov;
333 	uint32_t num_blocks;
334 
335 	/* Initialize CRC. */
336 	crc32c = SPDK_CRC32C_INITIAL;
337 
338 	/* Calculate CRC for the whole data segment. */
339 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
340 		crc32c = spdk_crc32c_update(pdu->data, data_len, crc32c);
341 	} else {
342 		iov.iov_base = pdu->data;
343 		iov.iov_len = pdu->data_buf_len;
344 		num_blocks = pdu->data_buf_len / pdu->dif_ctx.block_size;
345 
346 		spdk_dif_update_crc32c(&iov, 1, num_blocks, &crc32c, &pdu->dif_ctx);
347 	}
348 
349 	/* Include padding bytes into CRC if any. */
350 	mod = data_len % ISCSI_ALIGNMENT;
351 	if (mod != 0) {
352 		uint32_t pad_length = ISCSI_ALIGNMENT - mod;
353 		uint8_t pad[3] = {0, 0, 0};
354 		assert(pad_length > 0);
355 		assert(pad_length <= sizeof(pad));
356 		crc32c = spdk_crc32c_update(pad, pad_length, crc32c);
357 	}
358 
359 	/* Finalize CRC by inverting all bits. */
360 	return crc32c ^ SPDK_CRC32C_XOR;
361 }
362 
363 static int
364 iscsi_conn_read_data_segment(struct spdk_iscsi_conn *conn,
365 			     struct spdk_iscsi_pdu *pdu,
366 			     uint32_t data_offset, uint32_t data_len)
367 {
368 	struct iovec buf_iov, iovs[32];
369 	int rc, _rc;
370 
371 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
372 		return iscsi_conn_read_data(conn, data_len, pdu->data + data_offset);
373 	} else {
374 		buf_iov.iov_base = pdu->data;
375 		buf_iov.iov_len = pdu->data_buf_len;
376 		rc = spdk_dif_set_md_interleave_iovs(iovs, 32, &buf_iov, 1,
377 						     data_offset, data_len, NULL,
378 						     &pdu->dif_ctx);
379 		if (rc > 0) {
380 			rc = iscsi_conn_readv_data(conn, iovs, rc);
381 			if (rc > 0) {
382 				_rc = spdk_dif_generate_stream(&buf_iov, 1, data_offset, rc,
383 							       &pdu->dif_ctx);
384 				if (_rc != 0) {
385 					SPDK_ERRLOG("DIF generate failed\n");
386 					rc = _rc;
387 				}
388 			}
389 		} else {
390 			SPDK_ERRLOG("Setup iovs for interleaved metadata failed\n");
391 		}
392 		return rc;
393 	}
394 }
395 
396 /* Build iovec array to leave metadata space for every data block
397  * when reading data segment from socket.
398  */
399 static inline bool
400 _iscsi_sgl_append_with_md(struct spdk_iov_sgl *s,
401 			  void *buf, uint32_t buf_len, uint32_t data_len,
402 			  struct spdk_dif_ctx *dif_ctx)
403 {
404 	int rc;
405 	uint32_t total_size = 0;
406 	struct iovec buf_iov;
407 
408 	if (s->iov_offset >= data_len) {
409 		s->iov_offset -= data_len;
410 	} else {
411 		buf_iov.iov_base = buf;
412 		buf_iov.iov_len = buf_len;
413 		rc = spdk_dif_set_md_interleave_iovs(s->iov, s->iovcnt, &buf_iov, 1,
414 						     s->iov_offset, data_len - s->iov_offset,
415 						     &total_size, dif_ctx);
416 		if (rc < 0) {
417 			SPDK_ERRLOG("Failed to setup iovs for DIF strip\n");
418 			return false;
419 		}
420 
421 		s->total_size += total_size;
422 		s->iov_offset = 0;
423 		assert(s->iovcnt >= rc);
424 		s->iovcnt -= rc;
425 		s->iov += rc;
426 
427 		if (s->iovcnt == 0) {
428 			return false;
429 		}
430 	}
431 
432 	return true;
433 }
434 
435 int
436 iscsi_build_iovs(struct spdk_iscsi_conn *conn, struct iovec *iovs, int iovcnt,
437 		 struct spdk_iscsi_pdu *pdu, uint32_t *_mapped_length)
438 {
439 	struct spdk_iov_sgl sgl;
440 	int enable_digest;
441 	uint32_t total_ahs_len;
442 	uint32_t data_len;
443 
444 	if (iovcnt == 0) {
445 		return 0;
446 	}
447 
448 	total_ahs_len = pdu->bhs.total_ahs_len;
449 	data_len = DGET24(pdu->bhs.data_segment_len);
450 	data_len = ISCSI_ALIGN(data_len);
451 
452 	enable_digest = 1;
453 	if (pdu->bhs.opcode == ISCSI_OP_LOGIN_RSP) {
454 		/* this PDU should be sent without digest */
455 		enable_digest = 0;
456 	}
457 
458 	spdk_iov_sgl_init(&sgl, iovs, iovcnt, pdu->writev_offset);
459 
460 	/* BHS */
461 	if (!spdk_iov_sgl_append(&sgl, (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN)) {
462 		goto end;
463 	}
464 	/* AHS */
465 	if (total_ahs_len > 0) {
466 		if (!spdk_iov_sgl_append(&sgl, pdu->ahs, 4 * total_ahs_len)) {
467 			goto end;
468 		}
469 	}
470 
471 	/* Header Digest */
472 	if (enable_digest && conn->header_digest) {
473 		if (!spdk_iov_sgl_append(&sgl, pdu->header_digest, ISCSI_DIGEST_LEN)) {
474 			goto end;
475 		}
476 	}
477 
478 	/* Data Segment */
479 	if (data_len > 0) {
480 		if (!pdu->dif_insert_or_strip) {
481 			if (!spdk_iov_sgl_append(&sgl, pdu->data, data_len)) {
482 				goto end;
483 			}
484 		} else {
485 			if (!_iscsi_sgl_append_with_md(&sgl, pdu->data, pdu->data_buf_len,
486 						       data_len, &pdu->dif_ctx)) {
487 				goto end;
488 			}
489 		}
490 	}
491 
492 	/* Data Digest */
493 	if (enable_digest && conn->data_digest && data_len != 0) {
494 		spdk_iov_sgl_append(&sgl, pdu->data_digest, ISCSI_DIGEST_LEN);
495 	}
496 
497 end:
498 	if (_mapped_length != NULL) {
499 		*_mapped_length = sgl.total_size;
500 	}
501 
502 	return iovcnt - sgl.iovcnt;
503 }
504 
505 void
506 iscsi_free_sess(struct spdk_iscsi_sess *sess)
507 {
508 	if (sess == NULL) {
509 		return;
510 	}
511 
512 	sess->tag = 0;
513 	sess->target = NULL;
514 	sess->session_type = SESSION_TYPE_INVALID;
515 	iscsi_param_free(sess->params);
516 	free(sess->conns);
517 	spdk_scsi_port_free(&sess->initiator_port);
518 	spdk_mempool_put(g_iscsi.session_pool, (void *)sess);
519 }
520 
521 static int
522 create_iscsi_sess(struct spdk_iscsi_conn *conn,
523 		  struct spdk_iscsi_tgt_node *target,
524 		  enum session_type session_type)
525 {
526 	struct spdk_iscsi_sess *sess;
527 	int rc;
528 
529 	sess = spdk_mempool_get(g_iscsi.session_pool);
530 	if (!sess) {
531 		SPDK_ERRLOG("Unable to get session object\n");
532 		SPDK_ERRLOG("MaxSessions set to %d\n", g_iscsi.MaxSessions);
533 		return -ENOMEM;
534 	}
535 
536 	/* configuration values */
537 	pthread_mutex_lock(&g_iscsi.mutex);
538 
539 	sess->MaxConnections = g_iscsi.MaxConnectionsPerSession;
540 	sess->MaxOutstandingR2T = DEFAULT_MAXOUTSTANDINGR2T;
541 
542 	sess->DefaultTime2Wait = g_iscsi.DefaultTime2Wait;
543 	sess->DefaultTime2Retain = g_iscsi.DefaultTime2Retain;
544 	sess->FirstBurstLength = g_iscsi.FirstBurstLength;
545 	sess->MaxBurstLength = SPDK_ISCSI_MAX_BURST_LENGTH;
546 	sess->InitialR2T = DEFAULT_INITIALR2T;
547 	sess->ImmediateData = g_iscsi.ImmediateData;
548 	sess->DataPDUInOrder = DEFAULT_DATAPDUINORDER;
549 	sess->DataSequenceInOrder = DEFAULT_DATASEQUENCEINORDER;
550 	sess->ErrorRecoveryLevel = g_iscsi.ErrorRecoveryLevel;
551 
552 	pthread_mutex_unlock(&g_iscsi.mutex);
553 
554 	sess->tag = conn->pg_tag;
555 
556 	sess->conns = calloc(sess->MaxConnections, sizeof(*sess->conns));
557 	if (!sess->conns) {
558 		spdk_mempool_put(g_iscsi.session_pool, (void *)sess);
559 		SPDK_ERRLOG("calloc() failed for connection array\n");
560 		return -ENOMEM;
561 	}
562 
563 	sess->connections = 0;
564 
565 	sess->conns[sess->connections] = conn;
566 	sess->connections++;
567 
568 	sess->params = NULL;
569 	sess->target = target;
570 	sess->isid = 0;
571 	sess->session_type = session_type;
572 	sess->current_text_itt = 0xffffffffU;
573 
574 	/* set default params */
575 	rc = iscsi_sess_params_init(&sess->params);
576 	if (rc < 0) {
577 		SPDK_ERRLOG("iscsi_sess_params_init() failed\n");
578 		goto error_return;
579 	}
580 	/* replace with config value */
581 	rc = iscsi_param_set_int(sess->params, "MaxConnections",
582 				 sess->MaxConnections);
583 	if (rc < 0) {
584 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
585 		goto error_return;
586 	}
587 
588 	rc = iscsi_param_set_int(sess->params, "MaxOutstandingR2T",
589 				 sess->MaxOutstandingR2T);
590 	if (rc < 0) {
591 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
592 		goto error_return;
593 	}
594 
595 	rc = iscsi_param_set_int(sess->params, "DefaultTime2Wait",
596 				 sess->DefaultTime2Wait);
597 	if (rc < 0) {
598 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
599 		goto error_return;
600 	}
601 
602 	rc = iscsi_param_set_int(sess->params, "DefaultTime2Retain",
603 				 sess->DefaultTime2Retain);
604 	if (rc < 0) {
605 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
606 		goto error_return;
607 	}
608 
609 	rc = iscsi_param_set_int(sess->params, "FirstBurstLength",
610 				 sess->FirstBurstLength);
611 	if (rc < 0) {
612 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
613 		goto error_return;
614 	}
615 
616 	rc = iscsi_param_set_int(sess->params, "MaxBurstLength",
617 				 sess->MaxBurstLength);
618 	if (rc < 0) {
619 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
620 		goto error_return;
621 	}
622 
623 	rc = iscsi_param_set(sess->params, "InitialR2T",
624 			     sess->InitialR2T ? "Yes" : "No");
625 	if (rc < 0) {
626 		SPDK_ERRLOG("iscsi_param_set() failed\n");
627 		goto error_return;
628 	}
629 
630 	rc = iscsi_param_set(sess->params, "ImmediateData",
631 			     sess->ImmediateData ? "Yes" : "No");
632 	if (rc < 0) {
633 		SPDK_ERRLOG("iscsi_param_set() failed\n");
634 		goto error_return;
635 	}
636 
637 	rc = iscsi_param_set(sess->params, "DataPDUInOrder",
638 			     sess->DataPDUInOrder ? "Yes" : "No");
639 	if (rc < 0) {
640 		SPDK_ERRLOG("iscsi_param_set() failed\n");
641 		goto error_return;
642 	}
643 
644 	rc = iscsi_param_set(sess->params, "DataSequenceInOrder",
645 			     sess->DataSequenceInOrder ? "Yes" : "No");
646 	if (rc < 0) {
647 		SPDK_ERRLOG("iscsi_param_set() failed\n");
648 		goto error_return;
649 	}
650 
651 	rc = iscsi_param_set_int(sess->params, "ErrorRecoveryLevel",
652 				 sess->ErrorRecoveryLevel);
653 	if (rc < 0) {
654 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
655 		goto error_return;
656 	}
657 
658 	/* realloc buffer */
659 	rc = iscsi_param_set_int(conn->params, "MaxRecvDataSegmentLength",
660 				 conn->MaxRecvDataSegmentLength);
661 	if (rc < 0) {
662 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
663 		goto error_return;
664 	}
665 
666 	/* sess for first connection of session */
667 	conn->sess = sess;
668 	return 0;
669 
670 error_return:
671 	iscsi_free_sess(sess);
672 	conn->sess = NULL;
673 	return -1;
674 }
675 
676 static struct spdk_iscsi_sess *
677 get_iscsi_sess_by_tsih(uint16_t tsih)
678 {
679 	struct spdk_iscsi_sess *session;
680 
681 	if (tsih == 0 || tsih > g_iscsi.MaxSessions) {
682 		return NULL;
683 	}
684 
685 	session = g_iscsi.session[tsih - 1];
686 	assert(tsih == session->tsih);
687 
688 	return session;
689 }
690 
691 static uint8_t
692 append_iscsi_sess(struct spdk_iscsi_conn *conn,
693 		  const char *initiator_port_name, uint16_t tsih, uint16_t cid)
694 {
695 	struct spdk_iscsi_sess *sess;
696 
697 	SPDK_DEBUGLOG(iscsi, "append session: init port name=%s, tsih=%u, cid=%u\n",
698 		      initiator_port_name, tsih, cid);
699 
700 	sess = get_iscsi_sess_by_tsih(tsih);
701 	if (sess == NULL) {
702 		SPDK_ERRLOG("spdk_get_iscsi_sess_by_tsih failed\n");
703 		return ISCSI_LOGIN_CONN_ADD_FAIL;
704 	}
705 	if ((conn->pg_tag != sess->tag) ||
706 	    (strcasecmp(initiator_port_name, spdk_scsi_port_get_name(sess->initiator_port)) != 0) ||
707 	    (conn->target != sess->target)) {
708 		/* no match */
709 		SPDK_ERRLOG("no MCS session for init port name=%s, tsih=%d, cid=%d\n",
710 			    initiator_port_name, tsih, cid);
711 		return ISCSI_LOGIN_CONN_ADD_FAIL;
712 	}
713 
714 	if (sess->connections >= sess->MaxConnections) {
715 		/* no slot for connection */
716 		SPDK_ERRLOG("too many connections for init port name=%s, tsih=%d, cid=%d\n",
717 			    initiator_port_name, tsih, cid);
718 		return ISCSI_LOGIN_TOO_MANY_CONNECTIONS;
719 	}
720 
721 	SPDK_DEBUGLOG(iscsi, "Connections (tsih %d): %d\n", sess->tsih, sess->connections);
722 	conn->sess = sess;
723 
724 	/*
725 	 * TODO: need a mutex or other sync mechanism to protect the session's
726 	 *  connection list.
727 	 */
728 	sess->conns[sess->connections] = conn;
729 	sess->connections++;
730 
731 	return 0;
732 }
733 
734 static int
735 iscsi_append_text(const char *key, const char *val, uint8_t *data,
736 		  int alloc_len, int data_len)
737 {
738 	int total;
739 	int len;
740 
741 	total = data_len;
742 	if (alloc_len < 1) {
743 		return 0;
744 	}
745 	if (total > alloc_len) {
746 		total = alloc_len;
747 		data[total - 1] = '\0';
748 		return total;
749 	}
750 
751 	if (alloc_len - total < 1) {
752 		SPDK_ERRLOG("data space small %d\n", alloc_len);
753 		return total;
754 	}
755 	len = snprintf((char *) data + total, alloc_len - total, "%s=%s", key, val);
756 	total += len + 1;
757 
758 	return total;
759 }
760 
761 static int
762 iscsi_append_param(struct spdk_iscsi_conn *conn, const char *key,
763 		   uint8_t *data, int alloc_len, int data_len)
764 {
765 	struct iscsi_param *param;
766 
767 	param = iscsi_param_find(conn->params, key);
768 	if (param == NULL) {
769 		param = iscsi_param_find(conn->sess->params, key);
770 		if (param == NULL) {
771 			SPDK_DEBUGLOG(iscsi, "no key %.64s\n", key);
772 			return data_len;
773 		}
774 	}
775 	return iscsi_append_text(param->key, param->val, data,
776 				 alloc_len, data_len);
777 }
778 
779 static int
780 iscsi_auth_params(struct spdk_iscsi_conn *conn,
781 		  struct iscsi_param *params, const char *method, uint8_t *data,
782 		  int alloc_len, int data_len)
783 {
784 	char *in_val;
785 	char *in_next;
786 	char *new_val;
787 	const char *algorithm;
788 	const char *name;
789 	const char *response;
790 	const char *identifier;
791 	const char *challenge;
792 	int total;
793 	int rc;
794 
795 	if (conn == NULL || params == NULL || method == NULL) {
796 		return -1;
797 	}
798 	if (strcasecmp(method, "CHAP") == 0) {
799 		/* method OK */
800 	} else {
801 		SPDK_ERRLOG("unsupported AuthMethod %.64s\n", method);
802 		return -1;
803 	}
804 
805 	total = data_len;
806 	if (alloc_len < 1) {
807 		return 0;
808 	}
809 	if (total > alloc_len) {
810 		total = alloc_len;
811 		data[total - 1] = '\0';
812 		return total;
813 	}
814 
815 	/* for temporary store */
816 	in_val = malloc(ISCSI_TEXT_MAX_VAL_LEN + 1);
817 	if (!in_val) {
818 		SPDK_ERRLOG("malloc() failed for temporary store\n");
819 		return -ENOMEM;
820 	}
821 
822 	/* CHAP method (RFC1994) */
823 	if ((algorithm = iscsi_param_get_val(params, "CHAP_A")) != NULL) {
824 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_A) {
825 			SPDK_ERRLOG("CHAP sequence error\n");
826 			goto error_return;
827 		}
828 
829 		/* CHAP_A is LIST type */
830 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", algorithm);
831 		in_next = in_val;
832 		while ((new_val = spdk_strsepq(&in_next, ",")) != NULL) {
833 			if (strcasecmp(new_val, "5") == 0) {
834 				/* CHAP with MD5 */
835 				break;
836 			}
837 		}
838 		if (new_val == NULL) {
839 			snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", "Reject");
840 			new_val = in_val;
841 			iscsi_append_text("CHAP_A", new_val, data, alloc_len, total);
842 			goto error_return;
843 		}
844 		/* selected algorithm is 5 (MD5) */
845 		SPDK_DEBUGLOG(iscsi, "got CHAP_A=%s\n", new_val);
846 		total = iscsi_append_text("CHAP_A", new_val, data, alloc_len, total);
847 
848 		/* Identifier is one octet */
849 		gen_random(conn->auth.chap_id, 1);
850 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN, "%d",
851 			 (int) conn->auth.chap_id[0]);
852 		total = iscsi_append_text("CHAP_I", in_val, data, alloc_len, total);
853 
854 		/* Challenge Value is a variable stream of octets */
855 		/* (binary length MUST not exceed 1024 bytes) */
856 		conn->auth.chap_challenge_len = ISCSI_CHAP_CHALLENGE_LEN;
857 		gen_random(conn->auth.chap_challenge, conn->auth.chap_challenge_len);
858 		bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN,
859 			conn->auth.chap_challenge, conn->auth.chap_challenge_len);
860 		total = iscsi_append_text("CHAP_C", in_val, data, alloc_len, total);
861 
862 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_NR;
863 	} else if ((name = iscsi_param_get_val(params, "CHAP_N")) != NULL) {
864 		uint8_t resmd5[SPDK_MD5DIGEST_LEN];
865 		uint8_t tgtmd5[SPDK_MD5DIGEST_LEN];
866 		struct spdk_md5ctx md5ctx;
867 		size_t decoded_len = 0;
868 
869 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_NR) {
870 			SPDK_ERRLOG("CHAP sequence error\n");
871 			goto error_return;
872 		}
873 
874 		response = iscsi_param_get_val(params, "CHAP_R");
875 		if (response == NULL) {
876 			SPDK_ERRLOG("no response\n");
877 			goto error_return;
878 		}
879 		if (response[0] == '0' &&
880 		    (response[1] == 'x' || response[1] == 'X')) {
881 			rc = hex2bin(resmd5, SPDK_MD5DIGEST_LEN, response);
882 			if (rc < 0 || rc != SPDK_MD5DIGEST_LEN) {
883 				SPDK_ERRLOG("response format error\n");
884 				goto error_return;
885 			}
886 		} else if (response[0] == '0' &&
887 			   (response[1] == 'b' || response[1] == 'B')) {
888 			response += 2;
889 			rc = spdk_base64_decode(resmd5, &decoded_len, response);
890 			if (rc < 0 || decoded_len != SPDK_MD5DIGEST_LEN) {
891 				SPDK_ERRLOG("response format error\n");
892 				goto error_return;
893 			}
894 		} else {
895 			SPDK_ERRLOG("response format error\n");
896 			goto error_return;
897 		}
898 		SPDK_DEBUGLOG(iscsi, "got CHAP_N/CHAP_R\n");
899 
900 		SPDK_DEBUGLOG(iscsi, "ag_tag=%d\n", conn->chap_group);
901 
902 		rc = iscsi_chap_get_authinfo(&conn->auth, name, conn->chap_group);
903 		if (rc < 0) {
904 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
905 			SPDK_ERRLOG("iscsi_chap_get_authinfo() failed\n");
906 			goto error_return;
907 		}
908 		if (conn->auth.user[0] == '\0' || conn->auth.secret[0] == '\0') {
909 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
910 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
911 			goto error_return;
912 		}
913 
914 		md5init(&md5ctx);
915 		/* Identifier */
916 		md5update(&md5ctx, conn->auth.chap_id, 1);
917 		/* followed by secret */
918 		md5update(&md5ctx, conn->auth.secret,
919 			  strlen(conn->auth.secret));
920 		/* followed by Challenge Value */
921 		md5update(&md5ctx, conn->auth.chap_challenge,
922 			  conn->auth.chap_challenge_len);
923 		/* tgtmd5 is expecting Response Value */
924 		md5final(tgtmd5, &md5ctx);
925 
926 		bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN, tgtmd5, SPDK_MD5DIGEST_LEN);
927 
928 #if 0
929 		SPDK_DEBUGLOG(iscsi, "tgtmd5=%s, resmd5=%s\n", in_val, response);
930 		spdk_dump("tgtmd5", tgtmd5, SPDK_MD5DIGEST_LEN);
931 		spdk_dump("resmd5", resmd5, SPDK_MD5DIGEST_LEN);
932 #endif
933 
934 		/* compare MD5 digest */
935 		if (memcmp(tgtmd5, resmd5, SPDK_MD5DIGEST_LEN) != 0) {
936 			/* not match */
937 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
938 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
939 			goto error_return;
940 		}
941 		/* OK initiator's secret */
942 		conn->authenticated = true;
943 
944 		/* mutual CHAP? */
945 		identifier = iscsi_param_get_val(params, "CHAP_I");
946 		if (identifier != NULL) {
947 			conn->auth.chap_mid[0] = (uint8_t) strtol(identifier, NULL, 10);
948 			challenge = iscsi_param_get_val(params, "CHAP_C");
949 			if (challenge == NULL) {
950 				SPDK_ERRLOG("CHAP sequence error\n");
951 				goto error_return;
952 			}
953 			if (challenge[0] == '0' &&
954 			    (challenge[1] == 'x' || challenge[1] == 'X')) {
955 				rc = hex2bin(conn->auth.chap_mchallenge,
956 					     ISCSI_CHAP_CHALLENGE_LEN, challenge);
957 				if (rc < 0) {
958 					SPDK_ERRLOG("challenge format error\n");
959 					goto error_return;
960 				}
961 				conn->auth.chap_mchallenge_len = rc;
962 			} else if (challenge[0] == '0' &&
963 				   (challenge[1] == 'b' || challenge[1] == 'B')) {
964 				challenge += 2;
965 				rc = spdk_base64_decode(conn->auth.chap_mchallenge,
966 							&decoded_len, challenge);
967 				if (rc < 0) {
968 					SPDK_ERRLOG("challenge format error\n");
969 					goto error_return;
970 				}
971 				conn->auth.chap_mchallenge_len = decoded_len;
972 			} else {
973 				SPDK_ERRLOG("challenge format error\n");
974 				goto error_return;
975 			}
976 #if 0
977 			spdk_dump("MChallenge", conn->auth.chap_mchallenge,
978 				  conn->auth.chap_mchallenge_len);
979 #endif
980 			SPDK_DEBUGLOG(iscsi, "got CHAP_I/CHAP_C\n");
981 
982 			if (conn->auth.muser[0] == '\0' || conn->auth.msecret[0] == '\0') {
983 				/* SPDK_ERRLOG("mutual auth user or secret is missing\n"); */
984 				SPDK_ERRLOG("auth failed (name %.64s)\n", name);
985 				goto error_return;
986 			}
987 
988 			md5init(&md5ctx);
989 			/* Identifier */
990 			md5update(&md5ctx, conn->auth.chap_mid, 1);
991 			/* followed by secret */
992 			md5update(&md5ctx, conn->auth.msecret,
993 				  strlen(conn->auth.msecret));
994 			/* followed by Challenge Value */
995 			md5update(&md5ctx, conn->auth.chap_mchallenge,
996 				  conn->auth.chap_mchallenge_len);
997 			/* tgtmd5 is Response Value */
998 			md5final(tgtmd5, &md5ctx);
999 
1000 			bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN, tgtmd5, SPDK_MD5DIGEST_LEN);
1001 
1002 			total = iscsi_append_text("CHAP_N", conn->auth.muser, data,
1003 						  alloc_len, total);
1004 			total = iscsi_append_text("CHAP_R", in_val, data, alloc_len, total);
1005 		} else {
1006 			/* not mutual */
1007 			if (conn->mutual_chap) {
1008 				SPDK_ERRLOG("required mutual CHAP\n");
1009 				goto error_return;
1010 			}
1011 		}
1012 
1013 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_END;
1014 	} else {
1015 		/* not found CHAP keys */
1016 		SPDK_DEBUGLOG(iscsi, "start CHAP\n");
1017 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1018 	}
1019 
1020 	free(in_val);
1021 	return total;
1022 
1023 error_return:
1024 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1025 	free(in_val);
1026 	return -1;
1027 }
1028 
1029 static int
1030 iscsi_check_values(struct spdk_iscsi_conn *conn)
1031 {
1032 	if (conn->sess->FirstBurstLength > conn->sess->MaxBurstLength) {
1033 		SPDK_ERRLOG("FirstBurstLength(%d) > MaxBurstLength(%d)\n",
1034 			    conn->sess->FirstBurstLength,
1035 			    conn->sess->MaxBurstLength);
1036 		return -1;
1037 	}
1038 	if (conn->sess->FirstBurstLength > g_iscsi.FirstBurstLength) {
1039 		SPDK_ERRLOG("FirstBurstLength(%d) > iSCSI target restriction(%d)\n",
1040 			    conn->sess->FirstBurstLength, g_iscsi.FirstBurstLength);
1041 		return -1;
1042 	}
1043 	if (conn->sess->MaxBurstLength > 0x00ffffff) {
1044 		SPDK_ERRLOG("MaxBurstLength(%d) > 0x00ffffff\n",
1045 			    conn->sess->MaxBurstLength);
1046 		return -1;
1047 	}
1048 
1049 	if (conn->MaxRecvDataSegmentLength < 512) {
1050 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) < 512\n",
1051 			    conn->MaxRecvDataSegmentLength);
1052 		return -1;
1053 	}
1054 	if (conn->MaxRecvDataSegmentLength > 0x00ffffff) {
1055 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) > 0x00ffffff\n",
1056 			    conn->MaxRecvDataSegmentLength);
1057 		return -1;
1058 	}
1059 	return 0;
1060 }
1061 
1062 static int
1063 iscsi_conn_params_update(struct spdk_iscsi_conn *conn)
1064 {
1065 	int rc;
1066 	uint32_t recv_buf_size;
1067 
1068 	/* update internal variables */
1069 	rc = iscsi_copy_param2var(conn);
1070 	if (rc < 0) {
1071 		SPDK_ERRLOG("iscsi_copy_param2var() failed\n");
1072 		if (conn->state < ISCSI_CONN_STATE_EXITING) {
1073 			conn->state = ISCSI_CONN_STATE_EXITING;
1074 		}
1075 		return rc;
1076 	}
1077 
1078 	/* check value */
1079 	rc = iscsi_check_values(conn);
1080 	if (rc < 0) {
1081 		SPDK_ERRLOG("iscsi_check_values() failed\n");
1082 		if (conn->state < ISCSI_CONN_STATE_EXITING) {
1083 			conn->state = ISCSI_CONN_STATE_EXITING;
1084 		}
1085 	}
1086 
1087 	/* The socket receive buffer may need to be adjusted based on the new parameters */
1088 
1089 	/* Don't allow the recv buffer to be 0 or very large. */
1090 	recv_buf_size = spdk_max(0x1000, spdk_min(0x2000, conn->sess->FirstBurstLength));
1091 
1092 	/* Add in extra space for the PDU */
1093 	recv_buf_size += ISCSI_BHS_LEN + ISCSI_AHS_LEN;
1094 
1095 	if (conn->header_digest) {
1096 		recv_buf_size += ISCSI_DIGEST_LEN;
1097 	}
1098 
1099 	if (conn->data_digest) {
1100 		recv_buf_size += ISCSI_DIGEST_LEN;
1101 	}
1102 
1103 	/* Set up to buffer up to 4 commands with immediate data at once */
1104 	if (spdk_sock_set_recvbuf(conn->sock, recv_buf_size * 4) < 0) {
1105 		/* Not fatal. */
1106 	}
1107 
1108 	return rc;
1109 }
1110 
1111 static void
1112 iscsi_conn_login_pdu_err_complete(void *arg)
1113 {
1114 	struct spdk_iscsi_conn *conn = arg;
1115 
1116 	if (conn->full_feature) {
1117 		iscsi_conn_params_update(conn);
1118 	}
1119 }
1120 
1121 static void
1122 iscsi_conn_login_pdu_success_complete(void *arg)
1123 {
1124 	struct spdk_iscsi_conn *conn = arg;
1125 
1126 
1127 	if (conn->state >= ISCSI_CONN_STATE_EXITING) {
1128 		/* Connection is being exited before this callback is executed. */
1129 		SPDK_DEBUGLOG(iscsi, "Connection is already exited.\n");
1130 		return;
1131 	}
1132 	if (conn->full_feature) {
1133 		if (iscsi_conn_params_update(conn) != 0) {
1134 			return;
1135 		}
1136 	}
1137 	conn->state = ISCSI_CONN_STATE_RUNNING;
1138 	if (conn->full_feature != 0) {
1139 		iscsi_conn_schedule(conn);
1140 	}
1141 }
1142 
1143 /*
1144  * The response function of spdk_iscsi_op_login
1145  */
1146 static void
1147 iscsi_op_login_response(struct spdk_iscsi_conn *conn,
1148 			struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param *params,
1149 			iscsi_conn_xfer_complete_cb cb_fn)
1150 {
1151 	struct iscsi_bhs_login_rsp *rsph;
1152 
1153 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1154 	rsph->version_max = ISCSI_VERSION;
1155 	rsph->version_act = ISCSI_VERSION;
1156 	DSET24(rsph->data_segment_len, rsp_pdu->data_segment_len);
1157 
1158 	to_be32(&rsph->stat_sn, conn->StatSN);
1159 	conn->StatSN++;
1160 
1161 	if (conn->sess != NULL) {
1162 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
1163 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
1164 	} else {
1165 		to_be32(&rsph->exp_cmd_sn, rsp_pdu->cmd_sn);
1166 		to_be32(&rsph->max_cmd_sn, rsp_pdu->cmd_sn);
1167 	}
1168 
1169 	SPDK_LOGDUMP(iscsi, "PDU", (uint8_t *)rsph, ISCSI_BHS_LEN);
1170 	SPDK_LOGDUMP(iscsi, "DATA", rsp_pdu->data, rsp_pdu->data_segment_len);
1171 
1172 	/* Set T/CSG/NSG to reserved if login error. */
1173 	if (rsph->status_class != 0) {
1174 		rsph->flags &= ~(ISCSI_LOGIN_TRANSIT | ISCSI_LOGIN_CURRENT_STAGE_MASK |
1175 				 ISCSI_LOGIN_NEXT_STAGE_MASK);
1176 	}
1177 	iscsi_param_free(params);
1178 	iscsi_conn_write_pdu(conn, rsp_pdu, cb_fn, conn);
1179 }
1180 
1181 /*
1182  * The function which is used to initialize the internal response data
1183  * structure of iscsi login function.
1184  * return:
1185  * 0, success;
1186  * otherwise, error;
1187  */
1188 static int
1189 iscsi_op_login_rsp_init(struct spdk_iscsi_conn *conn,
1190 			struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
1191 {
1192 	struct iscsi_bhs_login_req *reqh;
1193 	struct iscsi_bhs_login_rsp *rsph;
1194 
1195 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1196 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
1197 	rsph->status_class = ISCSI_CLASS_SUCCESS;
1198 	rsph->status_detail = ISCSI_LOGIN_ACCEPT;
1199 	rsp_pdu->data_segment_len = 0;
1200 
1201 	/* The default MaxRecvDataSegmentLength 8192 is used during login. - RFC3720 */
1202 	rsp_pdu->data = calloc(1, 8192);
1203 	if (!rsp_pdu->data) {
1204 		SPDK_ERRLOG("calloc() failed for data segment\n");
1205 		rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1206 		rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1207 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1208 	}
1209 	rsp_pdu->data_buf_len = 8192;
1210 
1211 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1212 	rsph->flags |= (reqh->flags & (ISCSI_LOGIN_TRANSIT | ISCSI_LOGIN_CONTINUE |
1213 				       ISCSI_LOGIN_CURRENT_STAGE_MASK));
1214 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1215 		rsph->flags |= (reqh->flags & ISCSI_LOGIN_NEXT_STAGE_MASK);
1216 	}
1217 
1218 	/* We don't need to convert from network byte order. Just store it */
1219 	memcpy(&rsph->isid, reqh->isid, 6);
1220 	rsph->tsih = reqh->tsih;
1221 	rsph->itt = reqh->itt;
1222 	rsp_pdu->cmd_sn = from_be32(&reqh->cmd_sn);
1223 
1224 	if (rsph->tsih) {
1225 		rsph->stat_sn = reqh->exp_stat_sn;
1226 	}
1227 
1228 	SPDK_LOGDUMP(iscsi, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
1229 
1230 	SPDK_DEBUGLOG(iscsi,
1231 		      "T=%d, C=%d, CSG=%d, NSG=%d, Min=%d, Max=%d, ITT=%x\n",
1232 		      ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags),
1233 		      ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags),
1234 		      ISCSI_BHS_LOGIN_GET_CSG(rsph->flags),
1235 		      ISCSI_BHS_LOGIN_GET_NSG(rsph->flags),
1236 		      reqh->version_min, reqh->version_max, from_be32(&rsph->itt));
1237 
1238 	if (conn->sess != NULL) {
1239 		SPDK_DEBUGLOG(iscsi,
1240 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u,"
1241 			      "MaxCmdSN=%u\n", rsp_pdu->cmd_sn,
1242 			      from_be32(&rsph->stat_sn), conn->StatSN,
1243 			      conn->sess->ExpCmdSN,
1244 			      conn->sess->MaxCmdSN);
1245 	} else {
1246 		SPDK_DEBUGLOG(iscsi,
1247 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
1248 			      rsp_pdu->cmd_sn, from_be32(&rsph->stat_sn),
1249 			      conn->StatSN);
1250 	}
1251 
1252 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags) &&
1253 	    ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags)) {
1254 		SPDK_ERRLOG("transit error\n");
1255 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1256 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1257 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1258 	}
1259 	/* make sure reqh->version_max < ISCSI_VERSION */
1260 	if (reqh->version_min > ISCSI_VERSION) {
1261 		SPDK_ERRLOG("unsupported version min %d/max %d, expecting %d\n", reqh->version_min,
1262 			    reqh->version_max, ISCSI_VERSION);
1263 		/* Unsupported version */
1264 		/* set all reserved flag to zero */
1265 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1266 		rsph->status_detail = ISCSI_LOGIN_UNSUPPORTED_VERSION;
1267 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1268 	}
1269 
1270 	if ((ISCSI_BHS_LOGIN_GET_NSG(rsph->flags) == ISCSI_NSG_RESERVED_CODE) &&
1271 	    ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1272 		/* set NSG and other bits to zero */
1273 		rsph->flags &= ~(ISCSI_LOGIN_NEXT_STAGE_MASK | ISCSI_LOGIN_TRANSIT |
1274 				 ISCSI_LOGIN_CURRENT_STAGE_MASK);
1275 		SPDK_ERRLOG("Received reserved NSG code: %d\n", ISCSI_NSG_RESERVED_CODE);
1276 		/* Initiator error */
1277 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1278 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1279 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1280 	}
1281 
1282 	return 0;
1283 }
1284 
1285 static int
1286 iscsi_op_login_store_incoming_params(struct spdk_iscsi_conn *conn,
1287 				     struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu,
1288 				     struct iscsi_param **params)
1289 {
1290 	struct iscsi_bhs_login_req *reqh;
1291 	struct iscsi_bhs_login_rsp *rsph;
1292 	int rc;
1293 
1294 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1295 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1296 
1297 	rc = iscsi_parse_params(params, pdu->data,
1298 				pdu->data_segment_len, ISCSI_BHS_LOGIN_GET_CBIT(reqh->flags),
1299 				&conn->partial_text_parameter);
1300 	if (rc < 0) {
1301 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
1302 		iscsi_param_free(*params);
1303 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1304 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1305 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1306 	}
1307 
1308 	return 0;
1309 }
1310 
1311 /*
1312  * This function is used to initialize the port info
1313  * return
1314  * 0: success
1315  * otherwise: error
1316  */
1317 static int
1318 iscsi_op_login_initialize_port(struct spdk_iscsi_conn *conn,
1319 			       struct spdk_iscsi_pdu *rsp_pdu,
1320 			       char *initiator_port_name,
1321 			       uint32_t name_length,
1322 			       struct iscsi_param *params)
1323 {
1324 	const char *val;
1325 	struct iscsi_bhs_login_rsp *rsph;
1326 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1327 
1328 	/* Initiator Name and Port */
1329 	val = iscsi_param_get_val(params, "InitiatorName");
1330 	if (val == NULL) {
1331 		SPDK_ERRLOG("InitiatorName is empty\n");
1332 		/* Missing parameter */
1333 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1334 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1335 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1336 	}
1337 	snprintf(conn->initiator_name, sizeof(conn->initiator_name), "%s", val);
1338 	snprintf(initiator_port_name, name_length,
1339 		 "%s,i,0x%12.12" PRIx64, val, iscsi_get_isid(rsph->isid));
1340 	spdk_strlwr(conn->initiator_name);
1341 	spdk_strlwr(initiator_port_name);
1342 	SPDK_DEBUGLOG(iscsi, "Initiator name: %s\n", conn->initiator_name);
1343 	SPDK_DEBUGLOG(iscsi, "Initiator port: %s\n", initiator_port_name);
1344 
1345 	return 0;
1346 }
1347 
1348 /*
1349  * This function is used to judge the session type
1350  * return
1351  * 0: success
1352  * Other value: error
1353  */
1354 static int
1355 iscsi_op_login_session_type(struct spdk_iscsi_conn *conn,
1356 			    struct spdk_iscsi_pdu *rsp_pdu,
1357 			    enum session_type *session_type,
1358 			    struct iscsi_param *params)
1359 {
1360 	const char *session_type_str;
1361 	struct iscsi_bhs_login_rsp *rsph;
1362 
1363 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1364 	session_type_str = iscsi_param_get_val(params, "SessionType");
1365 	if (session_type_str == NULL) {
1366 		if (rsph->tsih != 0) {
1367 			*session_type = SESSION_TYPE_NORMAL;
1368 		} else {
1369 			SPDK_ERRLOG("SessionType is empty\n");
1370 			/* Missing parameter */
1371 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1372 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1373 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1374 		}
1375 	} else {
1376 		if (strcasecmp(session_type_str, "Discovery") == 0) {
1377 			*session_type = SESSION_TYPE_DISCOVERY;
1378 		} else if (strcasecmp(session_type_str, "Normal") == 0) {
1379 			*session_type = SESSION_TYPE_NORMAL;
1380 		} else {
1381 			*session_type = SESSION_TYPE_INVALID;
1382 			SPDK_ERRLOG("SessionType is invalid\n");
1383 			/* Missing parameter */
1384 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1385 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1386 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1387 		}
1388 	}
1389 	SPDK_DEBUGLOG(iscsi, "Session Type: %s\n", session_type_str);
1390 
1391 	return 0;
1392 }
1393 
1394 /*
1395  * This function is used to check the target info
1396  * return:
1397  * 0: success
1398  * otherwise: error
1399  */
1400 static int
1401 iscsi_op_login_check_target(struct spdk_iscsi_conn *conn,
1402 			    struct spdk_iscsi_pdu *rsp_pdu,
1403 			    const char *target_name,
1404 			    struct spdk_iscsi_tgt_node **target)
1405 {
1406 	struct iscsi_bhs_login_rsp *rsph;
1407 	char buf[MAX_TMPBUF] = {};
1408 
1409 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1410 	*target = iscsi_find_tgt_node(target_name);
1411 	if (*target == NULL) {
1412 		SPDK_WARNLOG("target %s not found\n", target_name);
1413 		/* Not found */
1414 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1415 		rsph->status_detail = ISCSI_LOGIN_TARGET_NOT_FOUND;
1416 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1417 	}
1418 	if (iscsi_tgt_node_is_destructed(*target)) {
1419 		SPDK_ERRLOG("target %s is removed\n", target_name);
1420 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1421 		rsph->status_detail = ISCSI_LOGIN_TARGET_REMOVED;
1422 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1423 	}
1424 	if (iscsi_tgt_node_is_redirected(conn, *target, buf, MAX_TMPBUF)) {
1425 		SPDK_INFOLOG(iscsi, "target %s is redirected\n", target_name);
1426 		rsp_pdu->data_segment_len = iscsi_append_text("TargetAddress",
1427 					    buf,
1428 					    rsp_pdu->data,
1429 					    rsp_pdu->data_buf_len,
1430 					    rsp_pdu->data_segment_len);
1431 		rsph->status_class = ISCSI_CLASS_REDIRECT;
1432 		rsph->status_detail = ISCSI_LOGIN_TARGET_TEMPORARILY_MOVED;
1433 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1434 	}
1435 	if (!iscsi_tgt_node_access(conn, *target, conn->initiator_name,
1436 				   conn->initiator_addr)) {
1437 		SPDK_ERRLOG("access denied\n");
1438 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1439 		rsph->status_detail = ISCSI_LOGIN_AUTHORIZATION_FAIL;
1440 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1441 	}
1442 
1443 	return 0;
1444 }
1445 
1446 /*
1447  * This function use to check the session
1448  * return:
1449  * 0, success
1450  * otherwise: error
1451  */
1452 static int
1453 iscsi_op_login_check_session(struct spdk_iscsi_conn *conn,
1454 			     struct spdk_iscsi_pdu *rsp_pdu,
1455 			     char *initiator_port_name, int cid)
1456 
1457 {
1458 	int rc = 0;
1459 	struct iscsi_bhs_login_rsp *rsph;
1460 
1461 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1462 	/* check existing session */
1463 	SPDK_DEBUGLOG(iscsi, "isid=%"PRIx64", tsih=%u, cid=%u\n",
1464 		      iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih), cid);
1465 	if (rsph->tsih != 0) {
1466 		/* multiple connections */
1467 		rc = append_iscsi_sess(conn, initiator_port_name,
1468 				       from_be16(&rsph->tsih), cid);
1469 		if (rc != 0) {
1470 			SPDK_ERRLOG("isid=%"PRIx64", tsih=%u, cid=%u:"
1471 				    "spdk_append_iscsi_sess() failed\n",
1472 				    iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih),
1473 				    cid);
1474 			/* Can't include in session */
1475 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1476 			rsph->status_detail = rc;
1477 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1478 		}
1479 	} else if (!g_iscsi.AllowDuplicateIsid) {
1480 		/* new session, drop old sess by the initiator */
1481 		iscsi_drop_conns(conn, initiator_port_name, 0 /* drop old */);
1482 	}
1483 
1484 	return rc;
1485 }
1486 
1487 /*
1488  * This function is used to del the original param and update it with new
1489  * value
1490  * return:
1491  * 0: success
1492  * otherwise: error
1493  */
1494 static int
1495 iscsi_op_login_update_param(struct spdk_iscsi_conn *conn,
1496 			    const char *key, const char *value,
1497 			    const char *list)
1498 {
1499 	int rc = 0;
1500 	struct iscsi_param *new_param, *orig_param;
1501 	int index;
1502 
1503 	orig_param = iscsi_param_find(conn->params, key);
1504 	if (orig_param == NULL) {
1505 		SPDK_ERRLOG("orig_param %s not found\n", key);
1506 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1507 	}
1508 
1509 	index = orig_param->state_index;
1510 	rc = iscsi_param_del(&conn->params, key);
1511 	if (rc < 0) {
1512 		SPDK_ERRLOG("iscsi_param_del(%s) failed\n", key);
1513 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1514 	}
1515 	rc = iscsi_param_add(&conn->params, key, value, list, ISPT_LIST);
1516 	if (rc < 0) {
1517 		SPDK_ERRLOG("iscsi_param_add() failed\n");
1518 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1519 	}
1520 	new_param = iscsi_param_find(conn->params, key);
1521 	if (new_param == NULL) {
1522 		SPDK_ERRLOG("iscsi_param_find() failed\n");
1523 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1524 	}
1525 	new_param->state_index = index;
1526 	return rc;
1527 }
1528 
1529 static int
1530 iscsi_negotiate_chap_param(struct spdk_iscsi_conn *conn)
1531 {
1532 	int rc = 0;
1533 
1534 	if (conn->disable_chap) {
1535 		rc = iscsi_op_login_update_param(conn, "AuthMethod", "None", "None");
1536 	} else if (conn->require_chap) {
1537 		rc = iscsi_op_login_update_param(conn, "AuthMethod", "CHAP", "CHAP");
1538 	}
1539 
1540 	return rc;
1541 }
1542 
1543 /*
1544  * The function which is used to handle the part of session discovery
1545  * return:
1546  * 0, success;
1547  * otherwise: error;
1548  */
1549 static int
1550 iscsi_op_login_session_discovery_chap(struct spdk_iscsi_conn *conn)
1551 {
1552 	return iscsi_negotiate_chap_param(conn);
1553 }
1554 
1555 /*
1556  * This function is used to update the param related with chap
1557  * return:
1558  * 0: success
1559  * otherwise: error
1560  */
1561 static int
1562 iscsi_op_login_negotiate_chap_param(struct spdk_iscsi_conn *conn,
1563 				    struct spdk_iscsi_tgt_node *target)
1564 {
1565 	conn->disable_chap = target->disable_chap;
1566 	conn->require_chap = target->require_chap;
1567 	conn->mutual_chap = target->mutual_chap;
1568 	conn->chap_group = target->chap_group;
1569 
1570 	return iscsi_negotiate_chap_param(conn);
1571 }
1572 
1573 static int
1574 iscsi_op_login_negotiate_digest_param(struct spdk_iscsi_conn *conn,
1575 				      struct spdk_iscsi_tgt_node *target)
1576 {
1577 	int rc;
1578 
1579 	if (target->header_digest) {
1580 		/*
1581 		 * User specified header digests, so update the list of
1582 		 *  HeaderDigest values to remove "None" so that only
1583 		 *  initiators who support CRC32C can connect.
1584 		 */
1585 		rc = iscsi_op_login_update_param(conn, "HeaderDigest", "CRC32C", "CRC32C");
1586 		if (rc < 0) {
1587 			return rc;
1588 		}
1589 	}
1590 
1591 	if (target->data_digest) {
1592 		/*
1593 		 * User specified data digests, so update the list of
1594 		 *  DataDigest values to remove "None" so that only
1595 		 *  initiators who support CRC32C can connect.
1596 		 */
1597 		rc = iscsi_op_login_update_param(conn, "DataDigest", "CRC32C", "CRC32C");
1598 		if (rc < 0) {
1599 			return rc;
1600 		}
1601 	}
1602 
1603 	return 0;
1604 }
1605 
1606 /*
1607  * The function which is used to handle the part of normal login session
1608  * return:
1609  * 0, success;
1610  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1611  */
1612 static int
1613 iscsi_op_login_session_normal(struct spdk_iscsi_conn *conn,
1614 			      struct spdk_iscsi_pdu *rsp_pdu,
1615 			      char *initiator_port_name,
1616 			      struct iscsi_param *params,
1617 			      int cid)
1618 {
1619 	struct spdk_iscsi_tgt_node *target = NULL;
1620 	const char *target_name;
1621 	const char *target_short_name;
1622 	struct iscsi_bhs_login_rsp *rsph;
1623 	int rc = 0;
1624 
1625 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1626 	target_name = iscsi_param_get_val(params, "TargetName");
1627 
1628 	if (target_name == NULL) {
1629 		SPDK_ERRLOG("TargetName is empty\n");
1630 		/* Missing parameter */
1631 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1632 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1633 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1634 	}
1635 
1636 	memset(conn->target_short_name, 0, MAX_TARGET_NAME);
1637 	target_short_name = strstr(target_name, ":");
1638 	if (target_short_name != NULL) {
1639 		target_short_name++; /* Advance past the ':' */
1640 		if (strlen(target_short_name) >= MAX_TARGET_NAME) {
1641 			SPDK_ERRLOG("Target Short Name (%s) is more than %u characters\n",
1642 				    target_short_name, MAX_TARGET_NAME);
1643 			/* Invalid request */
1644 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1645 			rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
1646 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1647 		}
1648 		snprintf(conn->target_short_name, MAX_TARGET_NAME, "%s",
1649 			 target_short_name);
1650 	}
1651 
1652 	pthread_mutex_lock(&g_iscsi.mutex);
1653 	rc = iscsi_op_login_check_target(conn, rsp_pdu, target_name, &target);
1654 	pthread_mutex_unlock(&g_iscsi.mutex);
1655 
1656 	if (rc < 0) {
1657 		return rc;
1658 	}
1659 
1660 	conn->target = target;
1661 	conn->dev = target->dev;
1662 	conn->target_port = spdk_scsi_dev_find_port_by_id(target->dev,
1663 			    conn->pg_tag);
1664 
1665 	rc = iscsi_op_login_check_session(conn, rsp_pdu,
1666 					  initiator_port_name, cid);
1667 	if (rc < 0) {
1668 		return rc;
1669 	}
1670 
1671 	/* force target flags */
1672 	pthread_mutex_lock(&target->mutex);
1673 	rc = iscsi_op_login_negotiate_chap_param(conn, target);
1674 	pthread_mutex_unlock(&target->mutex);
1675 
1676 	if (rc == 0) {
1677 		rc = iscsi_op_login_negotiate_digest_param(conn, target);
1678 	}
1679 
1680 	if (rc != 0) {
1681 		/* Invalid request */
1682 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1683 		rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
1684 	}
1685 
1686 	return rc;
1687 }
1688 
1689 /*
1690  * This function is used to set the info in the connection data structure
1691  * return
1692  * 0: success
1693  * otherwise: error
1694  */
1695 static int
1696 iscsi_op_login_set_conn_info(struct spdk_iscsi_conn *conn,
1697 			     struct spdk_iscsi_pdu *rsp_pdu,
1698 			     char *initiator_port_name,
1699 			     enum session_type session_type, int cid)
1700 {
1701 	int rc = 0;
1702 	struct spdk_iscsi_tgt_node *target;
1703 	struct iscsi_bhs_login_rsp *rsph;
1704 	struct spdk_scsi_port *initiator_port;
1705 
1706 	target = conn->target;
1707 
1708 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1709 	conn->authenticated = false;
1710 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1711 	conn->cid = cid;
1712 
1713 	if (conn->sess == NULL) {
1714 		/* create initiator port */
1715 		initiator_port = spdk_scsi_port_create(iscsi_get_isid(rsph->isid), 0, initiator_port_name);
1716 		if (initiator_port == NULL) {
1717 			SPDK_ERRLOG("create_port() failed\n");
1718 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1719 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1720 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1721 		}
1722 
1723 		/* new session */
1724 		rc = create_iscsi_sess(conn, target, session_type);
1725 		if (rc < 0) {
1726 			spdk_scsi_port_free(&initiator_port);
1727 			SPDK_ERRLOG("create_sess() failed\n");
1728 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1729 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1730 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1731 		}
1732 		/* initialize parameters */
1733 		conn->sess->initiator_port = initiator_port;
1734 		conn->StatSN = from_be32(&rsph->stat_sn);
1735 		conn->sess->isid = iscsi_get_isid(rsph->isid);
1736 
1737 		/* Initiator port TransportID */
1738 		spdk_scsi_port_set_iscsi_transport_id(conn->sess->initiator_port,
1739 						      conn->initiator_name,
1740 						      conn->sess->isid);
1741 
1742 		/* Discovery sessions will not have a target. */
1743 		if (target != NULL) {
1744 			conn->sess->queue_depth = target->queue_depth;
1745 		} else {
1746 			/*
1747 			 * Assume discovery sessions have an effective command
1748 			 *  windows size of 1.
1749 			 */
1750 			conn->sess->queue_depth = 1;
1751 		}
1752 		conn->sess->ExpCmdSN = rsp_pdu->cmd_sn;
1753 		conn->sess->MaxCmdSN = rsp_pdu->cmd_sn + conn->sess->queue_depth - 1;
1754 	}
1755 
1756 	conn->initiator_port = conn->sess->initiator_port;
1757 
1758 	return 0;
1759 }
1760 
1761 /*
1762  * This function is used to set the target info
1763  * return
1764  * 0: success
1765  * otherwise: error
1766  */
1767 static int
1768 iscsi_op_login_set_target_info(struct spdk_iscsi_conn *conn,
1769 			       struct spdk_iscsi_pdu *rsp_pdu,
1770 			       enum session_type session_type)
1771 {
1772 	char buf[MAX_TMPBUF];
1773 	const char *val;
1774 	int rc = 0;
1775 	struct spdk_iscsi_tgt_node *target = conn->target;
1776 
1777 	/* declarative parameters */
1778 	if (target != NULL) {
1779 		pthread_mutex_lock(&target->mutex);
1780 		if (target->alias[0] != '\0') {
1781 			snprintf(buf, sizeof buf, "%s", target->alias);
1782 		} else {
1783 			snprintf(buf, sizeof buf, "%s", "");
1784 		}
1785 		pthread_mutex_unlock(&target->mutex);
1786 		rc = iscsi_param_set(conn->sess->params, "TargetAlias", buf);
1787 		if (rc < 0) {
1788 			SPDK_ERRLOG("iscsi_param_set() failed\n");
1789 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1790 		}
1791 	}
1792 	snprintf(buf, sizeof buf, "%s:%s,%d", conn->portal_host, conn->portal_port,
1793 		 conn->pg_tag);
1794 	rc = iscsi_param_set(conn->sess->params, "TargetAddress", buf);
1795 	if (rc < 0) {
1796 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1797 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1798 	}
1799 	snprintf(buf, sizeof buf, "%d", conn->pg_tag);
1800 	rc = iscsi_param_set(conn->sess->params, "TargetPortalGroupTag", buf);
1801 	if (rc < 0) {
1802 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1803 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1804 	}
1805 
1806 	/* write in response */
1807 	if (target != NULL) {
1808 		val = iscsi_param_get_val(conn->sess->params, "TargetAlias");
1809 		if (val != NULL && strlen(val) != 0) {
1810 			rsp_pdu->data_segment_len = iscsi_append_param(conn,
1811 						    "TargetAlias",
1812 						    rsp_pdu->data,
1813 						    rsp_pdu->data_buf_len,
1814 						    rsp_pdu->data_segment_len);
1815 		}
1816 		if (session_type == SESSION_TYPE_DISCOVERY) {
1817 			rsp_pdu->data_segment_len = iscsi_append_param(conn,
1818 						    "TargetAddress",
1819 						    rsp_pdu->data,
1820 						    rsp_pdu->data_buf_len,
1821 						    rsp_pdu->data_segment_len);
1822 		}
1823 		rsp_pdu->data_segment_len = iscsi_append_param(conn,
1824 					    "TargetPortalGroupTag",
1825 					    rsp_pdu->data,
1826 					    rsp_pdu->data_buf_len,
1827 					    rsp_pdu->data_segment_len);
1828 	}
1829 
1830 	return rc;
1831 }
1832 
1833 /*
1834  * This function is used to handle the login of iscsi initiator when there is
1835  * no session
1836  * return:
1837  * 0, success;
1838  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1839  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify the login fail.
1840  */
1841 static int
1842 iscsi_op_login_phase_none(struct spdk_iscsi_conn *conn,
1843 			  struct spdk_iscsi_pdu *rsp_pdu,
1844 			  struct iscsi_param *params, int cid)
1845 {
1846 	enum session_type session_type;
1847 	char initiator_port_name[MAX_INITIATOR_PORT_NAME];
1848 	struct iscsi_bhs_login_rsp *rsph;
1849 	int rc = 0;
1850 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1851 
1852 	conn->target = NULL;
1853 	conn->dev = NULL;
1854 
1855 	rc = iscsi_op_login_initialize_port(conn, rsp_pdu, initiator_port_name,
1856 					    MAX_INITIATOR_PORT_NAME, params);
1857 	if (rc < 0) {
1858 		return rc;
1859 	}
1860 
1861 	rc = iscsi_op_login_session_type(conn, rsp_pdu, &session_type, params);
1862 	if (rc < 0) {
1863 		return rc;
1864 	}
1865 
1866 	/* Target Name and Port */
1867 	if (session_type == SESSION_TYPE_NORMAL) {
1868 		rc = iscsi_op_login_session_normal(conn, rsp_pdu,
1869 						   initiator_port_name,
1870 						   params, cid);
1871 		if (rc < 0) {
1872 			return rc;
1873 		}
1874 
1875 	} else if (session_type == SESSION_TYPE_DISCOVERY) {
1876 		rsph->tsih = 0;
1877 
1878 		/* force target flags */
1879 		pthread_mutex_lock(&g_iscsi.mutex);
1880 		rc = iscsi_op_login_session_discovery_chap(conn);
1881 		pthread_mutex_unlock(&g_iscsi.mutex);
1882 		if (rc < 0) {
1883 			return rc;
1884 		}
1885 	} else {
1886 		SPDK_ERRLOG("unknown session type\n");
1887 		/* Missing parameter */
1888 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1889 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1890 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1891 	}
1892 
1893 	rc = iscsi_op_login_set_conn_info(conn, rsp_pdu, initiator_port_name,
1894 					  session_type, cid);
1895 	if (rc < 0) {
1896 		return rc;
1897 	}
1898 
1899 	/* limit conns on discovery session */
1900 	if (session_type == SESSION_TYPE_DISCOVERY) {
1901 		conn->sess->MaxConnections = 1;
1902 		rc = iscsi_param_set_int(conn->sess->params,
1903 					 "MaxConnections",
1904 					 conn->sess->MaxConnections);
1905 		if (rc < 0) {
1906 			SPDK_ERRLOG("iscsi_param_set_int() failed\n");
1907 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1908 		}
1909 	}
1910 
1911 	return iscsi_op_login_set_target_info(conn, rsp_pdu, session_type);
1912 }
1913 
1914 /*
1915  * This function is used to set the csg bit case in rsp
1916  * return:
1917  * 0, success
1918  * otherwise: error
1919  */
1920 static int
1921 iscsi_op_login_rsp_handle_csg_bit(struct spdk_iscsi_conn *conn,
1922 				  struct spdk_iscsi_pdu *rsp_pdu,
1923 				  struct iscsi_param *params)
1924 {
1925 	const char *auth_method;
1926 	int rc;
1927 	struct iscsi_bhs_login_rsp *rsph;
1928 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1929 
1930 	switch (ISCSI_BHS_LOGIN_GET_CSG(rsph->flags)) {
1931 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
1932 		/* SecurityNegotiation */
1933 		auth_method = iscsi_param_get_val(conn->params, "AuthMethod");
1934 		if (auth_method == NULL) {
1935 			SPDK_ERRLOG("AuthMethod is empty\n");
1936 			/* Missing parameter */
1937 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1938 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1939 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1940 		}
1941 		if (strcasecmp(auth_method, "None") == 0) {
1942 			conn->authenticated = true;
1943 		} else {
1944 			rc = iscsi_auth_params(conn, params, auth_method,
1945 					       rsp_pdu->data, rsp_pdu->data_buf_len,
1946 					       rsp_pdu->data_segment_len);
1947 			if (rc < 0) {
1948 				SPDK_ERRLOG("iscsi_auth_params() failed\n");
1949 				/* Authentication failure */
1950 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1951 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1952 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1953 			}
1954 			rsp_pdu->data_segment_len = rc;
1955 			if (!conn->authenticated) {
1956 				/* not complete */
1957 				rsph->flags &= ~ISCSI_LOGIN_TRANSIT;
1958 			} else {
1959 				if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_END) {
1960 					SPDK_DEBUGLOG(iscsi, "CHAP phase not complete");
1961 				}
1962 			}
1963 
1964 			SPDK_LOGDUMP(iscsi, "Negotiated Auth Params",
1965 				     rsp_pdu->data, rsp_pdu->data_segment_len);
1966 		}
1967 		break;
1968 
1969 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
1970 		/* LoginOperationalNegotiation */
1971 		if (conn->state == ISCSI_CONN_STATE_INVALID) {
1972 			if (conn->require_chap) {
1973 				/* Authentication failure */
1974 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1975 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1976 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1977 			} else {
1978 				/* AuthMethod=None */
1979 				conn->authenticated = true;
1980 			}
1981 		}
1982 		if (!conn->authenticated) {
1983 			SPDK_ERRLOG("authentication error\n");
1984 			/* Authentication failure */
1985 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1986 			rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1987 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1988 		}
1989 		break;
1990 
1991 	case ISCSI_FULL_FEATURE_PHASE:
1992 		/* FullFeaturePhase */
1993 		SPDK_ERRLOG("XXX Login in FullFeaturePhase\n");
1994 		/* Initiator error */
1995 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1996 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1997 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1998 
1999 	default:
2000 		SPDK_ERRLOG("unknown stage\n");
2001 		/* Initiator error */
2002 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2003 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2004 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2005 	}
2006 
2007 	return 0;
2008 }
2009 
2010 /* This function is used to notify the session info
2011  * return
2012  * 0: success
2013  * otherwise: error
2014  */
2015 static int
2016 iscsi_op_login_notify_session_info(struct spdk_iscsi_conn *conn,
2017 				   struct spdk_iscsi_pdu *rsp_pdu)
2018 {
2019 	struct iscsi_bhs_login_rsp *rsph;
2020 
2021 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2022 	if (conn->sess->session_type == SESSION_TYPE_NORMAL) {
2023 		/* normal session */
2024 		SPDK_DEBUGLOG(iscsi, "Login from %s (%s) on %s tgt_node%d"
2025 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2026 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2027 			      conn->initiator_name, conn->initiator_addr,
2028 			      conn->target->name, conn->target->num,
2029 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2030 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2031 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2032 			       ? "on" : "off"),
2033 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2034 			       ? "on" : "off"));
2035 	} else if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2036 		/* discovery session */
2037 		SPDK_DEBUGLOG(iscsi, "Login(discovery) from %s (%s) on"
2038 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2039 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2040 			      conn->initiator_name, conn->initiator_addr,
2041 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2042 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2043 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2044 			       ? "on" : "off"),
2045 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2046 			       ? "on" : "off"));
2047 	} else {
2048 		SPDK_ERRLOG("unknown session type\n");
2049 		/* Initiator error */
2050 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2051 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2052 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2053 	}
2054 
2055 	return 0;
2056 }
2057 
2058 /*
2059  * This function is to handle the tbit cases
2060  * return
2061  * 0: success
2062  * otherwise error
2063  */
2064 static int
2065 iscsi_op_login_rsp_handle_t_bit(struct spdk_iscsi_conn *conn,
2066 				struct spdk_iscsi_pdu *rsp_pdu)
2067 {
2068 	int rc;
2069 	struct iscsi_bhs_login_rsp *rsph;
2070 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2071 
2072 	switch (ISCSI_BHS_LOGIN_GET_NSG(rsph->flags)) {
2073 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
2074 		/* SecurityNegotiation */
2075 		conn->login_phase = ISCSI_SECURITY_NEGOTIATION_PHASE;
2076 		break;
2077 
2078 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
2079 		/* LoginOperationalNegotiation */
2080 		conn->login_phase = ISCSI_OPERATIONAL_NEGOTIATION_PHASE;
2081 		break;
2082 
2083 	case ISCSI_FULL_FEATURE_PHASE:
2084 		/* FullFeaturePhase */
2085 		conn->login_phase = ISCSI_FULL_FEATURE_PHASE;
2086 		to_be16(&rsph->tsih, conn->sess->tsih);
2087 
2088 		rc = iscsi_op_login_notify_session_info(conn, rsp_pdu);
2089 		if (rc < 0) {
2090 			return rc;
2091 		}
2092 
2093 		conn->full_feature = 1;
2094 		break;
2095 
2096 	default:
2097 		SPDK_ERRLOG("unknown stage\n");
2098 		/* Initiator error */
2099 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2100 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2101 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2102 	}
2103 
2104 	return 0;
2105 }
2106 
2107 /*
2108  * This function is used to set the values of the internal data structure used
2109  * by spdk_iscsi_op_login function
2110  * return:
2111  * 0, used to notify the a successful login
2112  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify a failure login.
2113  */
2114 static int
2115 iscsi_op_login_rsp_handle(struct spdk_iscsi_conn *conn,
2116 			  struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param **params)
2117 {
2118 	int rc;
2119 	struct iscsi_bhs_login_rsp *rsph;
2120 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2121 
2122 	/* negotiate parameters */
2123 	rc = iscsi_negotiate_params(conn, params, rsp_pdu->data,
2124 				    rsp_pdu->data_buf_len,
2125 				    rsp_pdu->data_segment_len);
2126 	if (rc < 0) {
2127 		/*
2128 		 * iscsi_negotiate_params just returns -1 on failure,
2129 		 *  so translate this into meaningful response codes and
2130 		 *  return values.
2131 		 */
2132 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2133 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2134 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2135 	}
2136 
2137 	rsp_pdu->data_segment_len = rc;
2138 	SPDK_LOGDUMP(iscsi, "Negotiated Params", rsp_pdu->data, rc);
2139 
2140 	/* handle the CSG bit case */
2141 	rc = iscsi_op_login_rsp_handle_csg_bit(conn, rsp_pdu, *params);
2142 	if (rc < 0) {
2143 		return rc;
2144 	}
2145 
2146 	/* handle the T bit case */
2147 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
2148 		rc = iscsi_op_login_rsp_handle_t_bit(conn, rsp_pdu);
2149 	}
2150 
2151 	return rc;
2152 }
2153 
2154 static int
2155 iscsi_pdu_hdr_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2156 {
2157 	int rc;
2158 	struct iscsi_bhs_login_req *reqh;
2159 	struct spdk_iscsi_pdu *rsp_pdu;
2160 
2161 	if (conn->full_feature && conn->sess != NULL &&
2162 	    conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2163 		return SPDK_ISCSI_CONNECTION_FATAL;
2164 	}
2165 
2166 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
2167 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
2168 
2169 	/* During login processing, use the 8KB default FirstBurstLength as
2170 	 *  our maximum data segment length value.
2171 	 */
2172 	if (pdu->data_segment_len > SPDK_ISCSI_FIRST_BURST_LENGTH) {
2173 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2174 	}
2175 
2176 	rsp_pdu = iscsi_get_pdu(conn);
2177 	if (rsp_pdu == NULL) {
2178 		return SPDK_ISCSI_CONNECTION_FATAL;
2179 	}
2180 	rc = iscsi_op_login_rsp_init(conn, pdu, rsp_pdu);
2181 	if (rc < 0) {
2182 		iscsi_op_login_response(conn, rsp_pdu, NULL, iscsi_conn_login_pdu_err_complete);
2183 		return 0;
2184 	}
2185 
2186 	conn->login_rsp_pdu = rsp_pdu;
2187 	return 0;
2188 }
2189 
2190 static int
2191 iscsi_pdu_payload_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2192 {
2193 	int rc;
2194 	struct iscsi_bhs_login_req *reqh;
2195 	struct spdk_iscsi_pdu *rsp_pdu;
2196 	struct iscsi_param *params = NULL;
2197 	int cid;
2198 
2199 	if (conn->login_rsp_pdu == NULL) {
2200 		return 0;
2201 	}
2202 
2203 	spdk_poller_unregister(&conn->login_timer);
2204 	rsp_pdu = conn->login_rsp_pdu;
2205 
2206 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
2207 	cid = from_be16(&reqh->cid);
2208 
2209 	rc = iscsi_op_login_store_incoming_params(conn, pdu, rsp_pdu, &params);
2210 	if (rc < 0) {
2211 		iscsi_op_login_response(conn, rsp_pdu, NULL, iscsi_conn_login_pdu_err_complete);
2212 		return 0;
2213 	}
2214 
2215 	if (conn->state == ISCSI_CONN_STATE_INVALID) {
2216 		rc = iscsi_op_login_phase_none(conn, rsp_pdu, params, cid);
2217 		if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE || rc == SPDK_ISCSI_LOGIN_ERROR_PARAMETER) {
2218 			iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_err_complete);
2219 			return 0;
2220 		}
2221 	}
2222 
2223 	rc = iscsi_op_login_rsp_handle(conn, rsp_pdu, &params);
2224 	if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE) {
2225 		iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_err_complete);
2226 		return 0;
2227 	}
2228 
2229 	iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_success_complete);
2230 	return 0;
2231 }
2232 
2233 static int
2234 iscsi_pdu_hdr_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2235 {
2236 	uint32_t task_tag;
2237 	uint32_t ExpStatSN;
2238 	int F_bit, C_bit;
2239 	struct iscsi_bhs_text_req *reqh;
2240 
2241 	if (pdu->data_segment_len > iscsi_get_max_immediate_data_size()) {
2242 		SPDK_ERRLOG("data segment len(=%zu) > immediate data len(=%"PRIu32")\n",
2243 			    pdu->data_segment_len, iscsi_get_max_immediate_data_size());
2244 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2245 	}
2246 
2247 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2248 
2249 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2250 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2251 	task_tag = from_be32(&reqh->itt);
2252 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2253 
2254 	SPDK_DEBUGLOG(iscsi, "I=%d, F=%d, C=%d, ITT=%x, TTT=%x\n",
2255 		      reqh->immediate, F_bit, C_bit, task_tag, from_be32(&reqh->ttt));
2256 
2257 	SPDK_DEBUGLOG(iscsi,
2258 		      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2259 		      pdu->cmd_sn, ExpStatSN, conn->StatSN, conn->sess->ExpCmdSN,
2260 		      conn->sess->MaxCmdSN);
2261 
2262 	if (ExpStatSN != conn->StatSN) {
2263 #if 0
2264 		SPDK_ERRLOG("StatSN(%u) error\n", ExpStatSN);
2265 		return -1;
2266 #else
2267 		/* StarPort have a bug */
2268 		SPDK_DEBUGLOG(iscsi, "StatSN(%u) rewound\n", ExpStatSN);
2269 		conn->StatSN = ExpStatSN;
2270 #endif
2271 	}
2272 
2273 	if (F_bit && C_bit) {
2274 		SPDK_ERRLOG("final and continue\n");
2275 		return -1;
2276 	}
2277 
2278 	/*
2279 	 * If this is the first text op in a sequence, save the ITT so we can
2280 	 * compare it against the ITT for subsequent ops in the same sequence.
2281 	 * If a subsequent text op in same sequence has a different ITT, reject
2282 	 * that PDU.
2283 	 */
2284 	if (conn->sess->current_text_itt == 0xffffffffU) {
2285 		conn->sess->current_text_itt = task_tag;
2286 	} else if (conn->sess->current_text_itt != task_tag) {
2287 		SPDK_ERRLOG("The correct itt is %u, and the current itt is %u...\n",
2288 			    conn->sess->current_text_itt, task_tag);
2289 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2290 	}
2291 
2292 	return 0;
2293 }
2294 
2295 static void
2296 iscsi_conn_text_pdu_complete(void *arg)
2297 {
2298 	struct spdk_iscsi_conn *conn = arg;
2299 
2300 	iscsi_conn_params_update(conn);
2301 }
2302 
2303 static int
2304 iscsi_pdu_payload_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2305 {
2306 	struct iscsi_param *params = NULL;
2307 	struct spdk_iscsi_pdu *rsp_pdu;
2308 	uint8_t *data;
2309 	uint64_t lun;
2310 	uint32_t task_tag;
2311 	const char *val;
2312 	int F_bit, C_bit;
2313 	int data_len;
2314 	int alloc_len;
2315 	int rc;
2316 	struct iscsi_bhs_text_req *reqh;
2317 	struct iscsi_bhs_text_resp *rsph;
2318 
2319 	data_len = 0;
2320 	alloc_len = conn->MaxRecvDataSegmentLength;
2321 
2322 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2323 
2324 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2325 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2326 	lun = from_be64(&reqh->lun);
2327 	task_tag = from_be32(&reqh->itt);
2328 
2329 	/* store incoming parameters */
2330 	rc = iscsi_parse_params(&params, pdu->data, pdu->data_segment_len,
2331 				C_bit, &conn->partial_text_parameter);
2332 	if (rc < 0) {
2333 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
2334 		iscsi_param_free(params);
2335 		return -1;
2336 	}
2337 
2338 	if (pdu->data_segment_len == 0 && params == NULL) {
2339 		params = conn->params_text;
2340 		conn->params_text = NULL;
2341 	}
2342 
2343 	data = calloc(1, alloc_len);
2344 	if (!data) {
2345 		SPDK_ERRLOG("calloc() failed for data segment\n");
2346 		iscsi_param_free(params);
2347 		return -ENOMEM;
2348 	}
2349 
2350 	/* negotiate parameters */
2351 	data_len = iscsi_negotiate_params(conn, &params,
2352 					  data, alloc_len, data_len);
2353 	if (data_len < 0) {
2354 		SPDK_ERRLOG("iscsi_negotiate_params() failed\n");
2355 		iscsi_param_free(params);
2356 		free(data);
2357 		return -1;
2358 	}
2359 
2360 	/* sendtargets is special case */
2361 	val = iscsi_param_get_val(params, "SendTargets");
2362 	if (val != NULL) {
2363 		if (iscsi_param_eq_val(conn->sess->params,
2364 				       "SessionType", "Discovery")) {
2365 			if (strcasecmp(val, "") == 0) {
2366 				val = "ALL";
2367 			}
2368 
2369 			data_len = iscsi_send_tgts(conn,
2370 						   conn->initiator_name,
2371 						   val, data, alloc_len,
2372 						   data_len);
2373 		} else {
2374 			if (strcasecmp(val, "") == 0) {
2375 				val = conn->target->name;
2376 			}
2377 
2378 			if (strcasecmp(val, "ALL") == 0) {
2379 				/* not in discovery session */
2380 				data_len = iscsi_append_text("SendTargets", "Reject",
2381 							     data, alloc_len, data_len);
2382 			} else {
2383 				data_len = iscsi_send_tgts(conn,
2384 							   conn->initiator_name,
2385 							   val, data, alloc_len,
2386 							   data_len);
2387 			}
2388 		}
2389 
2390 		if (conn->send_tgt_completed_size != 0) {
2391 			F_bit = 0;
2392 			C_bit = 1;
2393 		}
2394 	} else {
2395 		if (iscsi_param_eq_val(conn->sess->params, "SessionType", "Discovery")) {
2396 			iscsi_param_free(params);
2397 			free(data);
2398 			return SPDK_ISCSI_CONNECTION_FATAL;
2399 		}
2400 	}
2401 
2402 	if (spdk_likely(conn->send_tgt_completed_size == 0)) {
2403 		iscsi_param_free(params);
2404 	} else {
2405 		conn->params_text = params;
2406 	}
2407 	SPDK_LOGDUMP(iscsi, "Negotiated Params", data, data_len);
2408 
2409 	/* response PDU */
2410 	rsp_pdu = iscsi_get_pdu(conn);
2411 	if (rsp_pdu == NULL) {
2412 		free(data);
2413 		return SPDK_ISCSI_CONNECTION_FATAL;
2414 	}
2415 	rsph = (struct iscsi_bhs_text_resp *)&rsp_pdu->bhs;
2416 
2417 	rsp_pdu->data = data;
2418 	rsph->opcode = ISCSI_OP_TEXT_RSP;
2419 
2420 	if (F_bit) {
2421 		rsph->flags |= ISCSI_FLAG_FINAL;
2422 	}
2423 
2424 	if (C_bit) {
2425 		rsph->flags |= ISCSI_TEXT_CONTINUE;
2426 	}
2427 
2428 	DSET24(rsph->data_segment_len, data_len);
2429 	to_be64(&rsph->lun, lun);
2430 	to_be32(&rsph->itt, task_tag);
2431 
2432 	if (F_bit) {
2433 		rsph->ttt = 0xffffffffU;
2434 		conn->sess->current_text_itt = 0xffffffffU;
2435 	} else {
2436 		to_be32(&rsph->ttt, 1 + conn->id);
2437 	}
2438 
2439 	to_be32(&rsph->stat_sn, conn->StatSN);
2440 	conn->StatSN++;
2441 
2442 	if (reqh->immediate == 0) {
2443 		conn->sess->MaxCmdSN++;
2444 	}
2445 
2446 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2447 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2448 
2449 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_text_pdu_complete, conn);
2450 	return 0;
2451 }
2452 
2453 static void
2454 iscsi_conn_logout_pdu_complete(void *arg)
2455 {
2456 	struct spdk_iscsi_conn *conn = arg;
2457 
2458 	if (conn->sess == NULL) {
2459 		/*
2460 		 * login failed but initiator still sent a logout rather than
2461 		 *  just closing the TCP connection.
2462 		 */
2463 		SPDK_DEBUGLOG(iscsi, "Logout(login failed) from %s (%s) on"
2464 			      " (%s:%s,%d)\n",
2465 			      conn->initiator_name, conn->initiator_addr,
2466 			      conn->portal_host, conn->portal_port, conn->pg_tag);
2467 	} else if (iscsi_param_eq_val(conn->sess->params, "SessionType", "Normal")) {
2468 		SPDK_DEBUGLOG(iscsi, "Logout from %s (%s) on %s tgt_node%d"
2469 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2470 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2471 			      conn->initiator_name, conn->initiator_addr,
2472 			      conn->target->name, conn->target->num,
2473 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2474 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2475 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2476 			       ? "on" : "off"),
2477 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2478 			       ? "on" : "off"));
2479 	} else {
2480 		/* discovery session */
2481 		SPDK_DEBUGLOG(iscsi, "Logout(discovery) from %s (%s) on"
2482 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2483 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2484 			      conn->initiator_name, conn->initiator_addr,
2485 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2486 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2487 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2488 			       ? "on" : "off"),
2489 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2490 			       ? "on" : "off"));
2491 	}
2492 }
2493 
2494 static int
2495 iscsi_pdu_hdr_op_logout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2496 {
2497 	struct spdk_iscsi_pdu *rsp_pdu;
2498 	uint32_t task_tag;
2499 	uint32_t ExpStatSN;
2500 	int response;
2501 	struct iscsi_bhs_logout_req *reqh;
2502 	struct iscsi_bhs_logout_resp *rsph;
2503 	uint16_t cid;
2504 
2505 	reqh = (struct iscsi_bhs_logout_req *)&pdu->bhs;
2506 
2507 	cid = from_be16(&reqh->cid);
2508 	task_tag = from_be32(&reqh->itt);
2509 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2510 
2511 	SPDK_DEBUGLOG(iscsi, "reason=%d, ITT=%x, cid=%d\n",
2512 		      reqh->reason, task_tag, cid);
2513 
2514 	if (conn->sess != NULL) {
2515 		if (conn->sess->session_type == SESSION_TYPE_DISCOVERY &&
2516 		    reqh->reason != ISCSI_LOGOUT_REASON_CLOSE_SESSION) {
2517 			SPDK_ERRLOG("Target can accept logout only with reason \"close the session\" "
2518 				    "on discovery session. %d is not acceptable reason.\n",
2519 				    reqh->reason);
2520 			return SPDK_ISCSI_CONNECTION_FATAL;
2521 		}
2522 
2523 		SPDK_DEBUGLOG(iscsi,
2524 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2525 			      pdu->cmd_sn, ExpStatSN, conn->StatSN,
2526 			      conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
2527 
2528 		if (pdu->cmd_sn != conn->sess->ExpCmdSN) {
2529 			SPDK_DEBUGLOG(iscsi, "CmdSN(%u) might have dropped\n", pdu->cmd_sn);
2530 			/* ignore error */
2531 		}
2532 	} else {
2533 		SPDK_DEBUGLOG(iscsi, "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
2534 			      pdu->cmd_sn, ExpStatSN, conn->StatSN);
2535 	}
2536 
2537 	if (ExpStatSN != conn->StatSN) {
2538 		SPDK_DEBUGLOG(iscsi, "StatSN(%u/%u) might have dropped\n",
2539 			      ExpStatSN, conn->StatSN);
2540 		/* ignore error */
2541 	}
2542 
2543 	if (conn->cid == cid) {
2544 		/* connection or session closed successfully */
2545 		response = 0;
2546 		iscsi_conn_logout(conn);
2547 	} else {
2548 		response = 1;
2549 	}
2550 
2551 	/* response PDU */
2552 	rsp_pdu = iscsi_get_pdu(conn);
2553 	if (rsp_pdu == NULL) {
2554 		return SPDK_ISCSI_CONNECTION_FATAL;
2555 	}
2556 	rsph = (struct iscsi_bhs_logout_resp *)&rsp_pdu->bhs;
2557 	rsp_pdu->data = NULL;
2558 	rsph->opcode = ISCSI_OP_LOGOUT_RSP;
2559 	rsph->flags |= 0x80; /* bit 0 must be 1 */
2560 	rsph->response = response;
2561 	DSET24(rsph->data_segment_len, 0);
2562 	to_be32(&rsph->itt, task_tag);
2563 
2564 	if (conn->sess != NULL) {
2565 		to_be32(&rsph->stat_sn, conn->StatSN);
2566 		conn->StatSN++;
2567 
2568 		if (conn->sess->connections == 1) {
2569 			conn->sess->MaxCmdSN++;
2570 		}
2571 
2572 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2573 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2574 	} else {
2575 		to_be32(&rsph->stat_sn, conn->StatSN);
2576 		conn->StatSN++;
2577 		to_be32(&rsph->exp_cmd_sn, pdu->cmd_sn);
2578 		to_be32(&rsph->max_cmd_sn, pdu->cmd_sn);
2579 	}
2580 
2581 	rsph->time_2_wait = 0;
2582 	rsph->time_2_retain = 0;
2583 
2584 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_logout_pdu_complete, conn);
2585 
2586 	return 0;
2587 }
2588 
2589 static int
2590 iscsi_send_r2t(struct spdk_iscsi_conn *conn,
2591 	       struct spdk_iscsi_task *task, int offset,
2592 	       int len, uint32_t transfer_tag, uint32_t *R2TSN)
2593 {
2594 	struct spdk_iscsi_pdu *rsp_pdu;
2595 	struct iscsi_bhs_r2t *rsph;
2596 	uint64_t fmt_lun;
2597 
2598 	/* R2T PDU */
2599 	rsp_pdu = iscsi_get_pdu(conn);
2600 	if (rsp_pdu == NULL) {
2601 		return SPDK_ISCSI_CONNECTION_FATAL;
2602 	}
2603 	rsph = (struct iscsi_bhs_r2t *)&rsp_pdu->bhs;
2604 	rsp_pdu->data = NULL;
2605 	rsph->opcode = ISCSI_OP_R2T;
2606 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
2607 	fmt_lun = spdk_scsi_lun_id_int_to_fmt(task->lun_id);
2608 	to_be64(&rsph->lun, fmt_lun);
2609 	to_be32(&rsph->itt, task->tag);
2610 	to_be32(&rsph->ttt, transfer_tag);
2611 
2612 	to_be32(&rsph->stat_sn, conn->StatSN);
2613 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2614 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2615 
2616 	to_be32(&rsph->r2t_sn, *R2TSN);
2617 	*R2TSN += 1;
2618 
2619 	task->r2t_datasn = 0; /* next expected datasn to ack */
2620 
2621 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2622 	to_be32(&rsph->desired_xfer_len, (uint32_t)len);
2623 	task->desired_data_transfer_length = (size_t)len;
2624 
2625 	/* we need to hold onto this task/cmd because until the PDU has been
2626 	 * written out */
2627 	rsp_pdu->task = task;
2628 	task->scsi.ref++;
2629 
2630 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
2631 
2632 	return 0;
2633 }
2634 
2635 /* This function is used to remove the r2t pdu from snack_pdu_list by < task, r2t_sn> info */
2636 static struct spdk_iscsi_pdu *
2637 iscsi_remove_r2t_pdu_from_snack_list(struct spdk_iscsi_conn *conn,
2638 				     struct spdk_iscsi_task *task,
2639 				     uint32_t r2t_sn)
2640 {
2641 	struct spdk_iscsi_pdu *pdu;
2642 	struct iscsi_bhs_r2t *r2t_header;
2643 
2644 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
2645 		if (pdu->bhs.opcode == ISCSI_OP_R2T) {
2646 			r2t_header = (struct iscsi_bhs_r2t *)&pdu->bhs;
2647 			if (pdu->task == task &&
2648 			    from_be32(&r2t_header->r2t_sn) == r2t_sn) {
2649 				TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
2650 				return pdu;
2651 			}
2652 		}
2653 	}
2654 
2655 	return NULL;
2656 }
2657 
2658 /* This function is used re-send the r2t packet */
2659 static int
2660 iscsi_send_r2t_recovery(struct spdk_iscsi_conn *conn,
2661 			struct spdk_iscsi_task *task, uint32_t r2t_sn,
2662 			bool send_new_r2tsn)
2663 {
2664 	struct spdk_iscsi_pdu *pdu;
2665 	struct iscsi_bhs_r2t *rsph;
2666 	uint32_t transfer_len;
2667 	uint32_t len;
2668 	int rc;
2669 
2670 	/* remove the r2t pdu from the snack_list */
2671 	pdu = iscsi_remove_r2t_pdu_from_snack_list(conn, task, r2t_sn);
2672 	if (!pdu) {
2673 		SPDK_DEBUGLOG(iscsi, "No pdu is found\n");
2674 		return -1;
2675 	}
2676 
2677 	/* flag
2678 	 * false: only need to re-send the old r2t with changing statsn
2679 	 * true: we send a r2t with new r2tsn
2680 	 */
2681 	if (!send_new_r2tsn) {
2682 		to_be32(&pdu->bhs.stat_sn, conn->StatSN);
2683 		iscsi_conn_write_pdu(conn, pdu, iscsi_conn_pdu_generic_complete, NULL);
2684 	} else {
2685 		rsph = (struct iscsi_bhs_r2t *)&pdu->bhs;
2686 		transfer_len = from_be32(&rsph->desired_xfer_len);
2687 
2688 		/* still need to increase the acked r2tsn */
2689 		task->acked_r2tsn++;
2690 		len = spdk_min(conn->sess->MaxBurstLength,
2691 			       (transfer_len - task->next_expected_r2t_offset));
2692 
2693 		/* remove the old_r2t_pdu */
2694 		iscsi_conn_free_pdu(conn, pdu);
2695 
2696 		/* re-send a new r2t pdu */
2697 		rc = iscsi_send_r2t(conn, task, task->next_expected_r2t_offset,
2698 				    len, task->ttt, &task->R2TSN);
2699 		if (rc < 0) {
2700 			return SPDK_ISCSI_CONNECTION_FATAL;
2701 		}
2702 	}
2703 
2704 	return 0;
2705 }
2706 
2707 static int
2708 add_transfer_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
2709 {
2710 	uint32_t transfer_len;
2711 	size_t max_burst_len;
2712 	size_t segment_len;
2713 	size_t data_len;
2714 	int len;
2715 	int rc;
2716 	int data_out_req;
2717 
2718 	transfer_len = task->scsi.transfer_len;
2719 	data_len = iscsi_task_get_pdu(task)->data_segment_len;
2720 	max_burst_len = conn->sess->MaxBurstLength;
2721 	segment_len = SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH;
2722 	data_out_req = 1 + (transfer_len - data_len - 1) / segment_len;
2723 	task->data_out_cnt = data_out_req;
2724 
2725 	/*
2726 	 * If we already have too many tasks using R2T, then queue this task
2727 	 *  and start sending R2T for it after some of the tasks using R2T/data
2728 	 *  out buffers complete.
2729 	 */
2730 	if (conn->pending_r2t >= g_iscsi.MaxR2TPerConnection) {
2731 		TAILQ_INSERT_TAIL(&conn->queued_r2t_tasks, task, link);
2732 		return 0;
2733 	}
2734 
2735 	conn->data_out_cnt += data_out_req;
2736 	conn->pending_r2t++;
2737 
2738 	task->next_expected_r2t_offset = data_len;
2739 	task->current_r2t_length = 0;
2740 	task->R2TSN = 0;
2741 	/* According to RFC3720 10.8.5, 0xffffffff is
2742 	 * reserved for TTT in R2T.
2743 	 */
2744 	if (++conn->ttt == 0xffffffffu) {
2745 		conn->ttt = 0;
2746 	}
2747 	task->ttt = conn->ttt;
2748 
2749 	while (data_len != transfer_len) {
2750 		len = spdk_min(max_burst_len, (transfer_len - data_len));
2751 		rc = iscsi_send_r2t(conn, task, data_len, len,
2752 				    task->ttt, &task->R2TSN);
2753 		if (rc < 0) {
2754 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
2755 			return rc;
2756 		}
2757 		data_len += len;
2758 		task->next_r2t_offset = data_len;
2759 		task->outstanding_r2t++;
2760 		if (conn->sess->MaxOutstandingR2T == task->outstanding_r2t) {
2761 			break;
2762 		}
2763 	}
2764 
2765 	TAILQ_INSERT_TAIL(&conn->active_r2t_tasks, task, link);
2766 	task->is_r2t_active = true;
2767 	return 0;
2768 }
2769 
2770 /* If there are additional large writes queued for R2Ts, start them now.
2771  *  This is called when a large write is just completed or when multiple LUNs
2772  *  are attached and large write tasks for the specific LUN are cleared.
2773  */
2774 static void
2775 start_queued_transfer_tasks(struct spdk_iscsi_conn *conn)
2776 {
2777 	struct spdk_iscsi_task *task, *tmp;
2778 
2779 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, tmp) {
2780 		if (conn->pending_r2t < g_iscsi.MaxR2TPerConnection) {
2781 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
2782 			add_transfer_task(conn, task);
2783 		} else {
2784 			break;
2785 		}
2786 	}
2787 }
2788 
2789 bool
2790 iscsi_del_transfer_task(struct spdk_iscsi_conn *conn, uint32_t task_tag)
2791 {
2792 	struct spdk_iscsi_task *task, *tmp;
2793 
2794 	TAILQ_FOREACH_SAFE(task, &conn->active_r2t_tasks, link, tmp) {
2795 		if (task->tag == task_tag) {
2796 			assert(conn->data_out_cnt >= task->data_out_cnt);
2797 			conn->data_out_cnt -= task->data_out_cnt;
2798 
2799 			assert(conn->pending_r2t > 0);
2800 			conn->pending_r2t--;
2801 
2802 			assert(task->is_r2t_active == true);
2803 			TAILQ_REMOVE(&conn->active_r2t_tasks, task, link);
2804 			task->is_r2t_active = false;
2805 			iscsi_task_put(task);
2806 
2807 			start_queued_transfer_tasks(conn);
2808 			return true;
2809 		}
2810 	}
2811 	return false;
2812 }
2813 
2814 void
2815 iscsi_clear_all_transfer_task(struct spdk_iscsi_conn *conn,
2816 			      struct spdk_scsi_lun *lun,
2817 			      struct spdk_iscsi_pdu *pdu)
2818 {
2819 	struct spdk_iscsi_task *task, *task_tmp;
2820 	struct spdk_iscsi_pdu *pdu_tmp;
2821 
2822 	TAILQ_FOREACH_SAFE(task, &conn->active_r2t_tasks, link, task_tmp) {
2823 		pdu_tmp = iscsi_task_get_pdu(task);
2824 		if ((lun == NULL || lun == task->scsi.lun) &&
2825 		    (pdu == NULL || spdk_sn32_lt(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
2826 			task->outstanding_r2t = 0;
2827 			task->next_r2t_offset = 0;
2828 			task->next_expected_r2t_offset = 0;
2829 			task->current_data_offset = 0;
2830 			assert(conn->data_out_cnt >= task->data_out_cnt);
2831 			conn->data_out_cnt -= task->data_out_cnt;
2832 			assert(conn->pending_r2t > 0);
2833 			conn->pending_r2t--;
2834 
2835 			TAILQ_REMOVE(&conn->active_r2t_tasks, task, link);
2836 			task->is_r2t_active = false;
2837 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
2838 				spdk_scsi_task_process_null_lun(&task->scsi);
2839 				iscsi_task_response(conn, task);
2840 			}
2841 			iscsi_task_put(task);
2842 		}
2843 	}
2844 
2845 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, task_tmp) {
2846 		pdu_tmp = iscsi_task_get_pdu(task);
2847 		if ((lun == NULL || lun == task->scsi.lun) &&
2848 		    (pdu == NULL || spdk_sn32_lt(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
2849 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
2850 			task->is_r2t_active = false;
2851 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
2852 				spdk_scsi_task_process_null_lun(&task->scsi);
2853 				iscsi_task_response(conn, task);
2854 			}
2855 			iscsi_task_put(task);
2856 		}
2857 	}
2858 
2859 	start_queued_transfer_tasks(conn);
2860 }
2861 
2862 static struct spdk_iscsi_task *
2863 get_transfer_task(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
2864 {
2865 	struct spdk_iscsi_task *task;
2866 
2867 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
2868 		if (task->ttt == transfer_tag) {
2869 			return task;
2870 		}
2871 	}
2872 
2873 	return NULL;
2874 }
2875 
2876 static void
2877 iscsi_conn_datain_pdu_complete(void *arg)
2878 {
2879 	struct spdk_iscsi_conn *conn = arg;
2880 
2881 	iscsi_conn_handle_queued_datain_tasks(conn);
2882 }
2883 
2884 static int
2885 iscsi_send_datain(struct spdk_iscsi_conn *conn,
2886 		  struct spdk_iscsi_task *task, int datain_flag,
2887 		  int residual_len, int offset, int DataSN, int len)
2888 {
2889 	struct spdk_iscsi_pdu *rsp_pdu;
2890 	struct iscsi_bhs_data_in *rsph;
2891 	uint32_t task_tag;
2892 	uint32_t transfer_tag;
2893 	int F_bit, U_bit, O_bit, S_bit;
2894 	struct spdk_iscsi_task *primary;
2895 	struct spdk_scsi_lun *lun_dev;
2896 
2897 	primary = iscsi_task_get_primary(task);
2898 
2899 	/* DATA PDU */
2900 	rsp_pdu = iscsi_get_pdu(conn);
2901 	rsph = (struct iscsi_bhs_data_in *)&rsp_pdu->bhs;
2902 	rsp_pdu->data = task->scsi.iovs[0].iov_base + offset;
2903 	rsp_pdu->data_buf_len = task->scsi.iovs[0].iov_len - offset;
2904 	rsp_pdu->data_valid_bytes = len;
2905 	rsp_pdu->data_from_mempool = true;
2906 
2907 	task_tag = task->tag;
2908 	transfer_tag = 0xffffffffU;
2909 
2910 	F_bit = datain_flag & ISCSI_FLAG_FINAL;
2911 	O_bit = datain_flag & ISCSI_DATAIN_OVERFLOW;
2912 	U_bit = datain_flag & ISCSI_DATAIN_UNDERFLOW;
2913 	S_bit = datain_flag & ISCSI_DATAIN_STATUS;
2914 
2915 	/*
2916 	 * we need to hold onto this task/cmd because until the
2917 	 * PDU has been written out
2918 	 */
2919 	rsp_pdu->task = task;
2920 	task->scsi.ref++;
2921 
2922 	rsph->opcode = ISCSI_OP_SCSI_DATAIN;
2923 
2924 	if (F_bit) {
2925 		rsph->flags |= ISCSI_FLAG_FINAL;
2926 	}
2927 
2928 	/* we leave the A_bit clear */
2929 
2930 	if (F_bit && S_bit)  {
2931 		if (O_bit) {
2932 			rsph->flags |= ISCSI_DATAIN_OVERFLOW;
2933 		}
2934 
2935 		if (U_bit) {
2936 			rsph->flags |= ISCSI_DATAIN_UNDERFLOW;
2937 		}
2938 	}
2939 
2940 	if (S_bit) {
2941 		rsph->flags |= ISCSI_DATAIN_STATUS;
2942 		rsph->status = task->scsi.status;
2943 	}
2944 
2945 	DSET24(rsph->data_segment_len, len);
2946 
2947 	to_be32(&rsph->itt, task_tag);
2948 	to_be32(&rsph->ttt, transfer_tag);
2949 
2950 	if (S_bit) {
2951 		to_be32(&rsph->stat_sn, conn->StatSN);
2952 		conn->StatSN++;
2953 	}
2954 
2955 	if (F_bit && S_bit && !iscsi_task_is_immediate(primary)) {
2956 		conn->sess->MaxCmdSN++;
2957 	}
2958 
2959 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2960 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2961 
2962 	to_be32(&rsph->data_sn, DataSN);
2963 
2964 	if (conn->sess->ErrorRecoveryLevel >= 1) {
2965 		primary->datain_datasn = DataSN;
2966 	}
2967 	DataSN++;
2968 
2969 	offset += task->scsi.offset;
2970 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2971 
2972 	if (F_bit && S_bit) {
2973 		to_be32(&rsph->res_cnt, residual_len);
2974 	}
2975 
2976 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
2977 	if (spdk_likely(lun_dev != NULL)) {
2978 		if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(lun_dev, &task->scsi,
2979 				  &rsp_pdu->dif_ctx))) {
2980 			rsp_pdu->dif_insert_or_strip = true;
2981 		}
2982 	}
2983 
2984 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_datain_pdu_complete, conn);
2985 
2986 	return DataSN;
2987 }
2988 
2989 static int
2990 iscsi_transfer_in(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
2991 {
2992 	uint32_t DataSN;
2993 	uint32_t transfer_len;
2994 	uint32_t data_len;
2995 	uint32_t segment_len;
2996 	uint32_t offset;
2997 	uint32_t residual_len = 0;
2998 	int sent_status;
2999 	uint32_t len;
3000 	int datain_flag = 0;
3001 	int datain_seq_cnt;
3002 	int i;
3003 	uint32_t sequence_end;
3004 	struct spdk_iscsi_task *primary;
3005 
3006 	primary = iscsi_task_get_primary(task);
3007 	segment_len = conn->MaxRecvDataSegmentLength;
3008 	data_len = task->scsi.data_transferred;
3009 	transfer_len = task->scsi.length;
3010 
3011 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
3012 		return 0;
3013 	}
3014 
3015 	if (data_len < transfer_len) {
3016 		/* underflow */
3017 		SPDK_DEBUGLOG(iscsi, "Underflow %u/%u\n", data_len, transfer_len);
3018 		residual_len = transfer_len - data_len;
3019 		transfer_len = data_len;
3020 		datain_flag |= ISCSI_DATAIN_UNDERFLOW;
3021 	} else if (data_len > transfer_len) {
3022 		/* overflow */
3023 		SPDK_DEBUGLOG(iscsi, "Overflow %u/%u\n", data_len, transfer_len);
3024 		residual_len = data_len - transfer_len;
3025 		datain_flag |= ISCSI_DATAIN_OVERFLOW;
3026 	} else {
3027 		SPDK_DEBUGLOG(iscsi, "Transfer %u\n", transfer_len);
3028 		residual_len = 0;
3029 	}
3030 
3031 	DataSN = primary->datain_datasn;
3032 	sent_status = 0;
3033 
3034 	/* calculate the number of sequences for all data-in pdus */
3035 	datain_seq_cnt = 1 + ((transfer_len - 1) / (int)conn->sess->MaxBurstLength);
3036 	for (i = 0; i < datain_seq_cnt; i++) {
3037 		offset = i * conn->sess->MaxBurstLength;
3038 		sequence_end = spdk_min(((i + 1) * conn->sess->MaxBurstLength),
3039 					transfer_len);
3040 
3041 		/* send data splitted by segment_len */
3042 		for (; offset < sequence_end; offset += segment_len) {
3043 			len = spdk_min(segment_len, (sequence_end - offset));
3044 
3045 			datain_flag &= ~(ISCSI_FLAG_FINAL | ISCSI_DATAIN_STATUS);
3046 
3047 			if (offset + len == sequence_end) {
3048 				/* last PDU in a sequence */
3049 				datain_flag |= ISCSI_FLAG_FINAL;
3050 				if (task->scsi.sense_data_len == 0) {
3051 					/* The last pdu in all data-in pdus */
3052 					if ((offset + len) == transfer_len &&
3053 					    (primary->bytes_completed == primary->scsi.transfer_len)) {
3054 						datain_flag |= ISCSI_DATAIN_STATUS;
3055 						sent_status = 1;
3056 					}
3057 				}
3058 			}
3059 
3060 			SPDK_DEBUGLOG(iscsi, "Transfer=%d, Offset=%d, Len=%d\n",
3061 				      sequence_end, offset, len);
3062 			SPDK_DEBUGLOG(iscsi, "StatSN=%u, DataSN=%u, Offset=%u, Len=%d\n",
3063 				      conn->StatSN, DataSN, offset, len);
3064 
3065 			DataSN = iscsi_send_datain(conn, task, datain_flag, residual_len,
3066 						   offset, DataSN, len);
3067 		}
3068 	}
3069 
3070 	if (task != primary) {
3071 		primary->scsi.data_transferred += task->scsi.data_transferred;
3072 	}
3073 	primary->datain_datasn = DataSN;
3074 
3075 	return sent_status;
3076 }
3077 
3078 void
3079 iscsi_task_response(struct spdk_iscsi_conn *conn,
3080 		    struct spdk_iscsi_task *task)
3081 {
3082 	struct spdk_iscsi_pdu *rsp_pdu;
3083 	struct iscsi_bhs_scsi_resp *rsph;
3084 	uint32_t task_tag;
3085 	uint32_t transfer_len;
3086 	size_t residual_len;
3087 	size_t data_len;
3088 	int O_bit, U_bit;
3089 	int rc;
3090 	struct spdk_iscsi_task *primary;
3091 
3092 	primary = iscsi_task_get_primary(task);
3093 
3094 	transfer_len = primary->scsi.transfer_len;
3095 	task_tag = task->tag;
3096 
3097 	/* transfer data from logical unit */
3098 	/* (direction is view of initiator side) */
3099 	if (iscsi_task_is_read(primary)) {
3100 		rc = iscsi_transfer_in(conn, task);
3101 		if (rc > 0) {
3102 			/* sent status by last DATAIN PDU */
3103 			return;
3104 		}
3105 
3106 		if (primary->bytes_completed != primary->scsi.transfer_len) {
3107 			return;
3108 		}
3109 	}
3110 
3111 	O_bit = U_bit = 0;
3112 	residual_len = 0;
3113 	data_len = primary->scsi.data_transferred;
3114 
3115 	if ((transfer_len != 0) &&
3116 	    (task->scsi.status == SPDK_SCSI_STATUS_GOOD)) {
3117 		if (data_len < transfer_len) {
3118 			/* underflow */
3119 			SPDK_DEBUGLOG(iscsi, "Underflow %zu/%u\n", data_len, transfer_len);
3120 			residual_len = transfer_len - data_len;
3121 			U_bit = 1;
3122 		} else if (data_len > transfer_len) {
3123 			/* overflow */
3124 			SPDK_DEBUGLOG(iscsi, "Overflow %zu/%u\n", data_len, transfer_len);
3125 			residual_len = data_len - transfer_len;
3126 			O_bit = 1;
3127 		} else {
3128 			SPDK_DEBUGLOG(iscsi, "Transfer %u\n", transfer_len);
3129 		}
3130 	}
3131 
3132 	/* response PDU */
3133 	rsp_pdu = iscsi_get_pdu(conn);
3134 	assert(rsp_pdu != NULL);
3135 	rsph = (struct iscsi_bhs_scsi_resp *)&rsp_pdu->bhs;
3136 	assert(task->scsi.sense_data_len <= sizeof(rsp_pdu->sense.data));
3137 	memcpy(rsp_pdu->sense.data, task->scsi.sense_data, task->scsi.sense_data_len);
3138 	to_be16(&rsp_pdu->sense.length, task->scsi.sense_data_len);
3139 	rsp_pdu->data = (uint8_t *)&rsp_pdu->sense;
3140 	rsp_pdu->data_from_mempool = true;
3141 
3142 	/*
3143 	 * we need to hold onto this task/cmd because until the
3144 	 * PDU has been written out
3145 	 */
3146 	rsp_pdu->task = task;
3147 	task->scsi.ref++;
3148 
3149 	rsph->opcode = ISCSI_OP_SCSI_RSP;
3150 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
3151 
3152 	if (O_bit) {
3153 		rsph->flags |= ISCSI_SCSI_OVERFLOW;
3154 	}
3155 
3156 	if (U_bit) {
3157 		rsph->flags |= ISCSI_SCSI_UNDERFLOW;
3158 	}
3159 
3160 	rsph->status = task->scsi.status;
3161 	if (task->scsi.sense_data_len) {
3162 		/* SenseLength (2 bytes) + SenseData  */
3163 		DSET24(rsph->data_segment_len, 2 + task->scsi.sense_data_len);
3164 	}
3165 	to_be32(&rsph->itt, task_tag);
3166 
3167 	to_be32(&rsph->stat_sn, conn->StatSN);
3168 	conn->StatSN++;
3169 
3170 	if (!iscsi_task_is_immediate(primary)) {
3171 		conn->sess->MaxCmdSN++;
3172 	}
3173 
3174 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3175 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3176 
3177 	to_be32(&rsph->bi_read_res_cnt, 0);
3178 	to_be32(&rsph->res_cnt, residual_len);
3179 
3180 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3181 }
3182 
3183 /*
3184  *  This function compare the input pdu's bhs with the pdu's bhs associated by
3185  *  active_r2t_tasks and queued_r2t_tasks in a connection
3186  */
3187 static bool
3188 iscsi_compare_pdu_bhs_within_existed_r2t_tasks(struct spdk_iscsi_conn *conn,
3189 		struct spdk_iscsi_pdu *pdu)
3190 {
3191 	struct spdk_iscsi_task	*task;
3192 
3193 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
3194 		if (!memcmp(&pdu->bhs, iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
3195 			return true;
3196 		}
3197 	}
3198 
3199 	TAILQ_FOREACH(task, &conn->queued_r2t_tasks, link) {
3200 		if (!memcmp(&pdu->bhs, iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
3201 			return true;
3202 		}
3203 	}
3204 
3205 	return false;
3206 }
3207 
3208 void
3209 iscsi_queue_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3210 {
3211 	spdk_trace_record(TRACE_ISCSI_TASK_QUEUE, conn->id, task->scsi.length,
3212 			  (uintptr_t)task, (uintptr_t)task->pdu);
3213 	task->is_queued = true;
3214 	spdk_scsi_dev_queue_task(conn->dev, &task->scsi);
3215 }
3216 
3217 static int
3218 iscsi_pdu_payload_op_scsi_read(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3219 {
3220 	if (task->scsi.transfer_len <= SPDK_BDEV_LARGE_BUF_MAX_SIZE) {
3221 		task->parent = NULL;
3222 		task->scsi.offset = 0;
3223 		task->scsi.length = task->scsi.transfer_len;
3224 		spdk_scsi_task_set_data(&task->scsi, NULL, 0);
3225 
3226 		iscsi_queue_task(conn, task);
3227 		return 0;
3228 	} else {
3229 		TAILQ_INIT(&task->subtask_list);
3230 		task->current_data_offset = 0;
3231 		TAILQ_INSERT_TAIL(&conn->queued_datain_tasks, task, link);
3232 
3233 		return iscsi_conn_handle_queued_datain_tasks(conn);
3234 	}
3235 }
3236 
3237 static int
3238 iscsi_submit_write_subtask(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task,
3239 			   struct spdk_iscsi_pdu *pdu, struct spdk_mobj *mobj)
3240 {
3241 	struct spdk_iscsi_task *subtask;
3242 
3243 	subtask = iscsi_task_get(conn, task, iscsi_task_cpl);
3244 	if (subtask == NULL) {
3245 		SPDK_ERRLOG("Unable to acquire subtask\n");
3246 		return SPDK_ISCSI_CONNECTION_FATAL;
3247 	}
3248 	subtask->scsi.offset = task->current_data_offset;
3249 	subtask->scsi.length = mobj->data_len;
3250 	iscsi_task_associate_pdu(subtask, pdu);
3251 
3252 	task->current_data_offset += mobj->data_len;
3253 
3254 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
3255 		spdk_scsi_task_set_data(&subtask->scsi, mobj->buf, mobj->data_len);
3256 	} else {
3257 		spdk_scsi_task_set_data(&subtask->scsi, mobj->buf, pdu->data_buf_len);
3258 	}
3259 
3260 	iscsi_queue_task(conn, subtask);
3261 	return 0;
3262 }
3263 
3264 static int
3265 iscsi_pdu_payload_op_scsi_write(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3266 {
3267 	struct spdk_iscsi_pdu *pdu;
3268 	struct iscsi_bhs_scsi_req *reqh;
3269 	uint32_t transfer_len;
3270 	struct spdk_mobj *mobj;
3271 	int rc;
3272 
3273 	pdu = iscsi_task_get_pdu(task);
3274 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
3275 
3276 	transfer_len = task->scsi.transfer_len;
3277 
3278 	if (reqh->final_bit &&
3279 	    pdu->data_segment_len < transfer_len) {
3280 		/* needs R2T */
3281 		rc = add_transfer_task(conn, task);
3282 		if (rc < 0) {
3283 			SPDK_ERRLOG("add_transfer_task() failed\n");
3284 			iscsi_task_put(task);
3285 			return SPDK_ISCSI_CONNECTION_FATAL;
3286 		}
3287 
3288 		/* immediate writes */
3289 		if (pdu->data_segment_len != 0) {
3290 			mobj = pdu->mobj[0];
3291 			assert(mobj != NULL);
3292 
3293 			if (!pdu->dif_insert_or_strip &&
3294 			    mobj->data_len < SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
3295 				/* continue aggregation until the first data buffer is full. */
3296 				iscsi_task_set_mobj(task, mobj);
3297 				pdu->mobj[0] = NULL;
3298 			} else {
3299 				/* we are doing the first partial write task */
3300 				rc = iscsi_submit_write_subtask(conn, task, pdu, mobj);
3301 				if (rc < 0) {
3302 					iscsi_task_put(task);
3303 					return SPDK_ISCSI_CONNECTION_FATAL;
3304 				}
3305 			}
3306 		}
3307 		return 0;
3308 	}
3309 
3310 	if (pdu->data_segment_len == transfer_len) {
3311 		/* we are doing small writes with no R2T */
3312 		if (spdk_likely(!pdu->dif_insert_or_strip)) {
3313 			spdk_scsi_task_set_data(&task->scsi, pdu->data, pdu->data_segment_len);
3314 		} else {
3315 			spdk_scsi_task_set_data(&task->scsi, pdu->data, pdu->data_buf_len);
3316 		}
3317 		task->scsi.length = transfer_len;
3318 	}
3319 
3320 	iscsi_queue_task(conn, task);
3321 	return 0;
3322 }
3323 
3324 static int
3325 iscsi_pdu_hdr_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3326 {
3327 	struct spdk_iscsi_task	*task;
3328 	struct spdk_scsi_dev	*dev;
3329 	uint8_t *cdb;
3330 	uint64_t lun;
3331 	uint32_t task_tag;
3332 	uint32_t transfer_len;
3333 	int R_bit, W_bit;
3334 	int lun_i;
3335 	struct iscsi_bhs_scsi_req *reqh;
3336 
3337 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3338 		SPDK_ERRLOG("ISCSI_OP_SCSI not allowed in discovery and invalid session\n");
3339 		return SPDK_ISCSI_CONNECTION_FATAL;
3340 	}
3341 
3342 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
3343 
3344 	R_bit = reqh->read_bit;
3345 	W_bit = reqh->write_bit;
3346 	lun = from_be64(&reqh->lun);
3347 	task_tag = from_be32(&reqh->itt);
3348 	transfer_len = from_be32(&reqh->expected_data_xfer_len);
3349 	cdb = reqh->cdb;
3350 
3351 	SPDK_LOGDUMP(iscsi, "CDB", cdb, 16);
3352 
3353 	task = iscsi_task_get(conn, NULL, iscsi_task_cpl);
3354 	if (!task) {
3355 		SPDK_ERRLOG("Unable to acquire task\n");
3356 		return SPDK_ISCSI_CONNECTION_FATAL;
3357 	}
3358 
3359 	iscsi_task_associate_pdu(task, pdu);
3360 	lun_i = spdk_scsi_lun_id_fmt_to_int(lun);
3361 	task->lun_id = lun_i;
3362 	dev = conn->dev;
3363 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3364 
3365 	if ((R_bit != 0) && (W_bit != 0)) {
3366 		SPDK_ERRLOG("Bidirectional CDB is not supported\n");
3367 		iscsi_task_put(task);
3368 		return SPDK_ISCSI_CONNECTION_FATAL;
3369 	}
3370 
3371 	task->scsi.cdb = cdb;
3372 	task->tag = task_tag;
3373 	task->scsi.transfer_len = transfer_len;
3374 	task->scsi.target_port = conn->target_port;
3375 	task->scsi.initiator_port = conn->initiator_port;
3376 	task->parent = NULL;
3377 	task->scsi.status = SPDK_SCSI_STATUS_GOOD;
3378 
3379 	if (task->scsi.lun == NULL) {
3380 		spdk_scsi_task_process_null_lun(&task->scsi);
3381 		iscsi_task_cpl(&task->scsi);
3382 		return 0;
3383 	}
3384 
3385 	/* no bi-directional support */
3386 	if (R_bit) {
3387 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_FROM_DEV;
3388 	} else if (W_bit) {
3389 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_TO_DEV;
3390 
3391 		if ((conn->sess->ErrorRecoveryLevel >= 1) &&
3392 		    (iscsi_compare_pdu_bhs_within_existed_r2t_tasks(conn, pdu))) {
3393 			iscsi_task_response(conn, task);
3394 			iscsi_task_put(task);
3395 			return 0;
3396 		}
3397 
3398 		if (pdu->data_segment_len > iscsi_get_max_immediate_data_size()) {
3399 			SPDK_ERRLOG("data segment len(=%zu) > immediate data len(=%"PRIu32")\n",
3400 				    pdu->data_segment_len, iscsi_get_max_immediate_data_size());
3401 			iscsi_task_put(task);
3402 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3403 		}
3404 
3405 		if (pdu->data_segment_len > transfer_len) {
3406 			SPDK_ERRLOG("data segment len(=%zu) > task transfer len(=%d)\n",
3407 				    pdu->data_segment_len, transfer_len);
3408 			iscsi_task_put(task);
3409 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3410 		}
3411 
3412 		/* check the ImmediateData and also pdu->data_segment_len */
3413 		if ((!conn->sess->ImmediateData && (pdu->data_segment_len > 0)) ||
3414 		    (pdu->data_segment_len > conn->sess->FirstBurstLength)) {
3415 			iscsi_task_put(task);
3416 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3417 		}
3418 
3419 		if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(task->scsi.lun, &task->scsi, &pdu->dif_ctx))) {
3420 			pdu->dif_insert_or_strip = true;
3421 		} else if (reqh->final_bit && pdu->data_segment_len < transfer_len) {
3422 			pdu->data_buf_len = spdk_min(transfer_len,
3423 						     SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
3424 		}
3425 	} else {
3426 		/* neither R nor W bit set */
3427 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_NONE;
3428 		if (transfer_len > 0) {
3429 			iscsi_task_put(task);
3430 			SPDK_ERRLOG("Reject scsi cmd with EDTL > 0 but (R | W) == 0\n");
3431 			return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3432 		}
3433 	}
3434 
3435 	pdu->task = task;
3436 	return 0;
3437 }
3438 
3439 static int
3440 iscsi_pdu_payload_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3441 {
3442 	struct spdk_iscsi_task *task;
3443 
3444 	if (pdu->task == NULL) {
3445 		return 0;
3446 	}
3447 
3448 	task = pdu->task;
3449 
3450 	if (spdk_scsi_dev_get_lun(conn->dev, task->lun_id) == NULL) {
3451 		spdk_scsi_task_process_null_lun(&task->scsi);
3452 		iscsi_task_cpl(&task->scsi);
3453 		return 0;
3454 	}
3455 
3456 	switch (task->scsi.dxfer_dir) {
3457 	case SPDK_SCSI_DIR_FROM_DEV:
3458 		return iscsi_pdu_payload_op_scsi_read(conn, task);
3459 	case SPDK_SCSI_DIR_TO_DEV:
3460 		return iscsi_pdu_payload_op_scsi_write(conn, task);
3461 	case SPDK_SCSI_DIR_NONE:
3462 		iscsi_queue_task(conn, task);
3463 		return 0;
3464 	default:
3465 		assert(false);
3466 		iscsi_task_put(task);
3467 		break;
3468 	}
3469 
3470 	return SPDK_ISCSI_CONNECTION_FATAL;
3471 }
3472 
3473 void
3474 iscsi_task_mgmt_response(struct spdk_iscsi_conn *conn,
3475 			 struct spdk_iscsi_task *task)
3476 {
3477 	struct spdk_iscsi_pdu *rsp_pdu;
3478 	struct iscsi_bhs_task_req *reqh;
3479 	struct iscsi_bhs_task_resp *rsph;
3480 
3481 	if (task->pdu == NULL) {
3482 		/*
3483 		 * This was an internally generated task management command,
3484 		 *  usually from LUN cleanup when a connection closes.
3485 		 */
3486 		return;
3487 	}
3488 
3489 	reqh = (struct iscsi_bhs_task_req *)&task->pdu->bhs;
3490 	/* response PDU */
3491 	rsp_pdu = iscsi_get_pdu(conn);
3492 	rsph = (struct iscsi_bhs_task_resp *)&rsp_pdu->bhs;
3493 	rsph->opcode = ISCSI_OP_TASK_RSP;
3494 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3495 	switch (task->scsi.response) {
3496 	case SPDK_SCSI_TASK_MGMT_RESP_COMPLETE:
3497 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3498 		break;
3499 	case SPDK_SCSI_TASK_MGMT_RESP_SUCCESS:
3500 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3501 		break;
3502 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT:
3503 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3504 		break;
3505 	case SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN:
3506 		rsph->response = ISCSI_TASK_FUNC_RESP_LUN_NOT_EXIST;
3507 		break;
3508 	case SPDK_SCSI_TASK_MGMT_RESP_TARGET_FAILURE:
3509 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3510 		break;
3511 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED:
3512 		rsph->response = ISCSI_TASK_FUNC_RESP_FUNC_NOT_SUPPORTED;
3513 		break;
3514 	}
3515 	rsph->itt = reqh->itt;
3516 
3517 	to_be32(&rsph->stat_sn, conn->StatSN);
3518 	conn->StatSN++;
3519 
3520 	if (reqh->immediate == 0) {
3521 		conn->sess->MaxCmdSN++;
3522 	}
3523 
3524 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3525 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3526 
3527 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3528 }
3529 
3530 static void
3531 iscsi_queue_mgmt_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3532 {
3533 	struct spdk_scsi_lun *lun;
3534 
3535 	lun = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
3536 	if (lun == NULL) {
3537 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3538 		iscsi_task_mgmt_response(conn, task);
3539 		iscsi_task_put(task);
3540 		return;
3541 	}
3542 
3543 	spdk_scsi_dev_queue_mgmt_task(conn->dev, &task->scsi);
3544 }
3545 
3546 static int
3547 _iscsi_op_abort_task(void *arg)
3548 {
3549 	struct spdk_iscsi_task *task = arg;
3550 	int rc;
3551 
3552 	rc = iscsi_conn_abort_queued_datain_task(task->conn, task->scsi.abort_id);
3553 	if (rc != 0) {
3554 		return SPDK_POLLER_BUSY;
3555 	}
3556 
3557 	spdk_poller_unregister(&task->mgmt_poller);
3558 	iscsi_queue_mgmt_task(task->conn, task);
3559 	return SPDK_POLLER_BUSY;
3560 }
3561 
3562 static void
3563 iscsi_op_abort_task(struct spdk_iscsi_task *task, uint32_t ref_task_tag)
3564 {
3565 	task->scsi.abort_id = ref_task_tag;
3566 	task->scsi.function = SPDK_SCSI_TASK_FUNC_ABORT_TASK;
3567 	task->mgmt_poller = SPDK_POLLER_REGISTER(_iscsi_op_abort_task, task, 10);
3568 }
3569 
3570 static int
3571 _iscsi_op_abort_task_set(void *arg)
3572 {
3573 	struct spdk_iscsi_task *task = arg;
3574 	int rc;
3575 
3576 	rc = iscsi_conn_abort_queued_datain_tasks(task->conn, task->scsi.lun,
3577 			task->pdu);
3578 	if (rc != 0) {
3579 		return SPDK_POLLER_BUSY;
3580 	}
3581 
3582 	spdk_poller_unregister(&task->mgmt_poller);
3583 	iscsi_queue_mgmt_task(task->conn, task);
3584 	return SPDK_POLLER_BUSY;
3585 }
3586 
3587 void
3588 iscsi_op_abort_task_set(struct spdk_iscsi_task *task, uint8_t function)
3589 {
3590 	task->scsi.function = function;
3591 	task->mgmt_poller = SPDK_POLLER_REGISTER(_iscsi_op_abort_task_set, task, 10);
3592 }
3593 
3594 static int
3595 iscsi_pdu_hdr_op_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3596 {
3597 	struct iscsi_bhs_task_req *reqh;
3598 	uint64_t lun;
3599 	uint32_t task_tag;
3600 	uint32_t ref_task_tag;
3601 	uint8_t function;
3602 	int lun_i;
3603 	struct spdk_iscsi_task *task;
3604 	struct spdk_scsi_dev *dev;
3605 
3606 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3607 		SPDK_ERRLOG("ISCSI_OP_TASK not allowed in discovery and invalid session\n");
3608 		return SPDK_ISCSI_CONNECTION_FATAL;
3609 	}
3610 
3611 	reqh = (struct iscsi_bhs_task_req *)&pdu->bhs;
3612 	function = reqh->flags & ISCSI_TASK_FUNCTION_MASK;
3613 	lun = from_be64(&reqh->lun);
3614 	task_tag = from_be32(&reqh->itt);
3615 	ref_task_tag = from_be32(&reqh->ref_task_tag);
3616 
3617 	SPDK_DEBUGLOG(iscsi, "I=%d, func=%d, ITT=%x, ref TT=%x, LUN=0x%16.16"PRIx64"\n",
3618 		      reqh->immediate, function, task_tag, ref_task_tag, lun);
3619 
3620 	SPDK_DEBUGLOG(iscsi, "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3621 		      conn->StatSN, conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
3622 
3623 	lun_i = spdk_scsi_lun_id_fmt_to_int(lun);
3624 	dev = conn->dev;
3625 
3626 	task = iscsi_task_get(conn, NULL, iscsi_task_mgmt_cpl);
3627 	if (!task) {
3628 		SPDK_ERRLOG("Unable to acquire task\n");
3629 		return SPDK_ISCSI_CONNECTION_FATAL;
3630 	}
3631 
3632 	iscsi_task_associate_pdu(task, pdu);
3633 	task->scsi.target_port = conn->target_port;
3634 	task->scsi.initiator_port = conn->initiator_port;
3635 	task->tag = task_tag;
3636 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3637 	task->lun_id = lun_i;
3638 
3639 	if (task->scsi.lun == NULL) {
3640 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3641 		iscsi_task_mgmt_response(conn, task);
3642 		iscsi_task_put(task);
3643 		return 0;
3644 	}
3645 
3646 	switch (function) {
3647 	/* abort task identified by Referenced Task Tag field */
3648 	case ISCSI_TASK_FUNC_ABORT_TASK:
3649 		SPDK_NOTICELOG("ABORT_TASK\n");
3650 
3651 		iscsi_del_transfer_task(conn, ref_task_tag);
3652 		iscsi_op_abort_task(task, ref_task_tag);
3653 		return 0;
3654 
3655 	/* abort all tasks issued via this session on the LUN */
3656 	case ISCSI_TASK_FUNC_ABORT_TASK_SET:
3657 		SPDK_NOTICELOG("ABORT_TASK_SET\n");
3658 
3659 		iscsi_clear_all_transfer_task(conn, task->scsi.lun, pdu);
3660 		iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_ABORT_TASK_SET);
3661 		return 0;
3662 
3663 	case ISCSI_TASK_FUNC_CLEAR_TASK_SET:
3664 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3665 		SPDK_NOTICELOG("CLEAR_TASK_SET (Unsupported)\n");
3666 		break;
3667 
3668 	case ISCSI_TASK_FUNC_CLEAR_ACA:
3669 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3670 		SPDK_NOTICELOG("CLEAR_ACA (Unsupported)\n");
3671 		break;
3672 
3673 	case ISCSI_TASK_FUNC_LOGICAL_UNIT_RESET:
3674 		SPDK_NOTICELOG("LOGICAL_UNIT_RESET\n");
3675 
3676 		iscsi_clear_all_transfer_task(conn, task->scsi.lun, pdu);
3677 		iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
3678 		return 0;
3679 
3680 	case ISCSI_TASK_FUNC_TARGET_WARM_RESET:
3681 		SPDK_NOTICELOG("TARGET_WARM_RESET (Unsupported)\n");
3682 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3683 		break;
3684 
3685 	case ISCSI_TASK_FUNC_TARGET_COLD_RESET:
3686 		SPDK_NOTICELOG("TARGET_COLD_RESET (Unsupported)\n");
3687 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3688 		break;
3689 
3690 	case ISCSI_TASK_FUNC_TASK_REASSIGN:
3691 		SPDK_NOTICELOG("TASK_REASSIGN (Unsupported)\n");
3692 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3693 		break;
3694 
3695 	default:
3696 		SPDK_ERRLOG("unsupported function %d\n", function);
3697 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT;
3698 		break;
3699 	}
3700 
3701 	iscsi_task_mgmt_response(conn, task);
3702 	iscsi_task_put(task);
3703 	return 0;
3704 }
3705 
3706 static int
3707 iscsi_pdu_hdr_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3708 {
3709 	struct iscsi_bhs_nop_out *reqh;
3710 	uint32_t task_tag;
3711 	uint32_t transfer_tag;
3712 	int I_bit;
3713 
3714 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
3715 		SPDK_ERRLOG("ISCSI_OP_NOPOUT not allowed in discovery session\n");
3716 		return SPDK_ISCSI_CONNECTION_FATAL;
3717 	}
3718 
3719 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3720 	I_bit = reqh->immediate;
3721 
3722 	if (pdu->data_segment_len > SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
3723 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3724 	}
3725 
3726 	task_tag = from_be32(&reqh->itt);
3727 	transfer_tag = from_be32(&reqh->ttt);
3728 
3729 	SPDK_DEBUGLOG(iscsi, "I=%d, ITT=%x, TTT=%x\n",
3730 		      I_bit, task_tag, transfer_tag);
3731 
3732 	SPDK_DEBUGLOG(iscsi, "CmdSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3733 		      pdu->cmd_sn, conn->StatSN, conn->sess->ExpCmdSN,
3734 		      conn->sess->MaxCmdSN);
3735 
3736 	if (transfer_tag != 0xFFFFFFFF && transfer_tag != (uint32_t)conn->id) {
3737 		SPDK_ERRLOG("invalid transfer tag 0x%x\n", transfer_tag);
3738 		/*
3739 		 * Technically we should probably fail the connection here, but for now
3740 		 *  just print the error message and continue.
3741 		 */
3742 	}
3743 
3744 	if (task_tag == 0xffffffffU && I_bit == 0) {
3745 		SPDK_ERRLOG("got NOPOUT ITT=0xffffffff, I=0\n");
3746 		return SPDK_ISCSI_CONNECTION_FATAL;
3747 	}
3748 
3749 	return 0;
3750 }
3751 
3752 static int
3753 iscsi_pdu_payload_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3754 {
3755 	struct spdk_iscsi_pdu *rsp_pdu;
3756 	struct iscsi_bhs_nop_out *reqh;
3757 	struct iscsi_bhs_nop_in *rsph;
3758 	uint8_t *data;
3759 	uint64_t lun;
3760 	uint32_t task_tag;
3761 	int I_bit;
3762 	int data_len;
3763 
3764 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3765 	I_bit = reqh->immediate;
3766 
3767 	data_len = pdu->data_segment_len;
3768 	if (data_len > conn->MaxRecvDataSegmentLength) {
3769 		data_len = conn->MaxRecvDataSegmentLength;
3770 	}
3771 
3772 	lun = from_be64(&reqh->lun);
3773 	task_tag = from_be32(&reqh->itt);
3774 
3775 	/*
3776 	 * We don't actually check to see if this is a response to the NOP-In
3777 	 * that we sent.  Our goal is to just verify that the initiator is
3778 	 * alive and responding to commands, not to verify that it tags
3779 	 * NOP-Outs correctly
3780 	 */
3781 	conn->nop_outstanding = false;
3782 
3783 	if (task_tag == 0xffffffffU) {
3784 		assert(I_bit == 1);
3785 		SPDK_DEBUGLOG(iscsi, "got NOPOUT ITT=0xffffffff\n");
3786 		return 0;
3787 	}
3788 
3789 	data = calloc(1, data_len);
3790 	if (!data) {
3791 		SPDK_ERRLOG("calloc() failed for ping data\n");
3792 		return SPDK_ISCSI_CONNECTION_FATAL;
3793 	}
3794 
3795 	/* response of NOPOUT */
3796 	if (data_len > 0) {
3797 		/* copy ping data */
3798 		memcpy(data, pdu->data, data_len);
3799 	}
3800 
3801 	/* response PDU */
3802 	rsp_pdu = iscsi_get_pdu(conn);
3803 	assert(rsp_pdu != NULL);
3804 
3805 	rsph = (struct iscsi_bhs_nop_in *)&rsp_pdu->bhs;
3806 	rsp_pdu->data = data;
3807 	rsph->opcode = ISCSI_OP_NOPIN;
3808 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3809 	DSET24(rsph->data_segment_len, data_len);
3810 	to_be64(&rsph->lun, lun);
3811 	to_be32(&rsph->itt, task_tag);
3812 	to_be32(&rsph->ttt, 0xffffffffU);
3813 
3814 	to_be32(&rsph->stat_sn, conn->StatSN);
3815 	conn->StatSN++;
3816 
3817 	if (I_bit == 0) {
3818 		conn->sess->MaxCmdSN++;
3819 	}
3820 
3821 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3822 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3823 
3824 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3825 	conn->last_nopin = spdk_get_ticks();
3826 
3827 	return 0;
3828 }
3829 
3830 /* This function returns the spdk_scsi_task by searching the snack list via
3831  * task transfertag and the pdu's opcode
3832  */
3833 static struct spdk_iscsi_task *
3834 get_scsi_task_from_ttt(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
3835 {
3836 	struct spdk_iscsi_pdu *pdu;
3837 	struct iscsi_bhs_data_in *datain_bhs;
3838 
3839 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3840 		if (pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3841 			datain_bhs = (struct iscsi_bhs_data_in *)&pdu->bhs;
3842 			if (from_be32(&datain_bhs->ttt) == transfer_tag) {
3843 				return pdu->task;
3844 			}
3845 		}
3846 	}
3847 
3848 	return NULL;
3849 }
3850 
3851 /* This function returns the spdk_scsi_task by searching the snack list via
3852  * initiator task tag and the pdu's opcode
3853  */
3854 static struct spdk_iscsi_task *
3855 get_scsi_task_from_itt(struct spdk_iscsi_conn *conn,
3856 		       uint32_t task_tag, enum iscsi_op opcode)
3857 {
3858 	struct spdk_iscsi_pdu *pdu;
3859 
3860 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3861 		if (pdu->bhs.opcode == opcode &&
3862 		    pdu->task != NULL &&
3863 		    pdu->task->tag == task_tag) {
3864 			return pdu->task;
3865 		}
3866 	}
3867 
3868 	return NULL;
3869 }
3870 
3871 /* This function is used to handle the r2t snack */
3872 static int
3873 iscsi_handle_r2t_snack(struct spdk_iscsi_conn *conn,
3874 		       struct spdk_iscsi_task *task,
3875 		       struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3876 		       uint32_t run_length, int32_t task_tag)
3877 {
3878 	int32_t last_r2tsn;
3879 	int i;
3880 
3881 	if (beg_run < task->acked_r2tsn) {
3882 		SPDK_ERRLOG("ITT: 0x%08x, R2T SNACK requests retransmission of"
3883 			    "R2TSN: from 0x%08x to 0x%08x. But it has already"
3884 			    "ack to R2TSN:0x%08x, protocol error.\n",
3885 			    task_tag, beg_run, (beg_run + run_length),
3886 			    (task->acked_r2tsn - 1));
3887 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3888 	}
3889 
3890 	if (run_length) {
3891 		if ((beg_run + run_length) > task->R2TSN) {
3892 			SPDK_ERRLOG("ITT: 0x%08x, received R2T SNACK with"
3893 				    "BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
3894 				    "current R2TSN: 0x%08x, protocol error.\n",
3895 				    task_tag, beg_run, run_length,
3896 				    task->R2TSN);
3897 
3898 			return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3899 		}
3900 		last_r2tsn = (beg_run + run_length);
3901 	} else {
3902 		last_r2tsn = task->R2TSN;
3903 	}
3904 
3905 	for (i = beg_run; i < last_r2tsn; i++) {
3906 		if (iscsi_send_r2t_recovery(conn, task, i, false) < 0) {
3907 			SPDK_ERRLOG("The r2t_sn=%d of r2t_task=%p is not sent\n", i, task);
3908 		}
3909 	}
3910 	return 0;
3911 }
3912 
3913 /* This function is used to recover the data in packet */
3914 static int
3915 iscsi_handle_recovery_datain(struct spdk_iscsi_conn *conn,
3916 			     struct spdk_iscsi_task *task,
3917 			     struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3918 			     uint32_t run_length, uint32_t task_tag)
3919 {
3920 	struct spdk_iscsi_pdu *old_pdu, *pdu_temp;
3921 	uint32_t i;
3922 	struct iscsi_bhs_data_in *datain_header;
3923 	uint32_t last_statsn;
3924 
3925 	task = iscsi_task_get_primary(task);
3926 
3927 	SPDK_DEBUGLOG(iscsi, "iscsi_handle_recovery_datain\n");
3928 
3929 	if (beg_run < task->acked_data_sn) {
3930 		SPDK_ERRLOG("ITT: 0x%08x, DATA IN SNACK requests retransmission of"
3931 			    "DATASN: from 0x%08x to 0x%08x but already acked to "
3932 			    "DATASN: 0x%08x protocol error\n",
3933 			    task_tag, beg_run,
3934 			    (beg_run + run_length), (task->acked_data_sn - 1));
3935 
3936 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3937 	}
3938 
3939 	if (run_length == 0) {
3940 		/* as the DataSN begins at 0 */
3941 		run_length = task->datain_datasn + 1;
3942 	}
3943 
3944 	if ((beg_run + run_length - 1) > task->datain_datasn) {
3945 		SPDK_ERRLOG("Initiator requests BegRun: 0x%08x, RunLength:"
3946 			    "0x%08x greater than maximum DataSN: 0x%08x.\n",
3947 			    beg_run, run_length, task->datain_datasn);
3948 
3949 		return -1;
3950 	} else {
3951 		last_statsn = beg_run + run_length - 1;
3952 	}
3953 
3954 	for (i = beg_run; i <= last_statsn; i++) {
3955 		TAILQ_FOREACH_SAFE(old_pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
3956 			if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3957 				datain_header = (struct iscsi_bhs_data_in *)&old_pdu->bhs;
3958 				if (from_be32(&datain_header->itt) == task_tag &&
3959 				    from_be32(&datain_header->data_sn) == i) {
3960 					TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
3961 					iscsi_conn_write_pdu(conn, old_pdu, old_pdu->cb_fn, old_pdu->cb_arg);
3962 					break;
3963 				}
3964 			}
3965 		}
3966 	}
3967 	return 0;
3968 }
3969 
3970 /* This function is used to handle the status snack */
3971 static int
3972 iscsi_handle_status_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3973 {
3974 	uint32_t beg_run;
3975 	uint32_t run_length;
3976 	struct iscsi_bhs_snack_req *reqh;
3977 	uint32_t i;
3978 	uint32_t last_statsn;
3979 	bool found_pdu;
3980 	struct spdk_iscsi_pdu *old_pdu;
3981 
3982 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
3983 	beg_run = from_be32(&reqh->beg_run);
3984 	run_length = from_be32(&reqh->run_len);
3985 
3986 	SPDK_DEBUGLOG(iscsi, "beg_run=%d, run_length=%d, conn->StatSN="
3987 		      "%d, conn->exp_statsn=%d\n", beg_run, run_length,
3988 		      conn->StatSN, conn->exp_statsn);
3989 
3990 	if (!beg_run) {
3991 		beg_run = conn->exp_statsn;
3992 	} else if (beg_run < conn->exp_statsn) {
3993 		SPDK_ERRLOG("Got Status SNACK Begrun: 0x%08x, RunLength: 0x%08x "
3994 			    "but already got ExpStatSN: 0x%08x on CID:%hu.\n",
3995 			    beg_run, run_length, conn->StatSN, conn->cid);
3996 
3997 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3998 	}
3999 
4000 	last_statsn = (!run_length) ? conn->StatSN : (beg_run + run_length);
4001 
4002 	for (i = beg_run; i < last_statsn; i++) {
4003 		found_pdu = false;
4004 		TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
4005 			if (from_be32(&old_pdu->bhs.stat_sn) == i) {
4006 				found_pdu = true;
4007 				break;
4008 			}
4009 		}
4010 
4011 		if (!found_pdu) {
4012 			SPDK_ERRLOG("Unable to find StatSN: 0x%08x. For a Status"
4013 				    "SNACK, assuming this is a proactive SNACK "
4014 				    "for an untransmitted StatSN, ignoring.\n",
4015 				    beg_run);
4016 		} else {
4017 			TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
4018 			iscsi_conn_write_pdu(conn, old_pdu, old_pdu->cb_fn, old_pdu->cb_arg);
4019 		}
4020 	}
4021 
4022 	return 0;
4023 }
4024 
4025 /* This function is used to handle the data ack snack */
4026 static int
4027 iscsi_handle_data_ack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4028 {
4029 	uint32_t transfer_tag;
4030 	uint32_t beg_run;
4031 	uint32_t run_length;
4032 	struct spdk_iscsi_pdu *old_pdu;
4033 	uint32_t old_datasn;
4034 	struct iscsi_bhs_snack_req *reqh;
4035 	struct spdk_iscsi_task *task;
4036 	struct iscsi_bhs_data_in *datain_header;
4037 	struct spdk_iscsi_task *primary;
4038 
4039 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4040 	transfer_tag = from_be32(&reqh->ttt);
4041 	beg_run = from_be32(&reqh->beg_run);
4042 	run_length = from_be32(&reqh->run_len);
4043 	task = NULL;
4044 	datain_header = NULL;
4045 
4046 	SPDK_DEBUGLOG(iscsi, "beg_run=%d,transfer_tag=%d,run_len=%d\n",
4047 		      beg_run, transfer_tag, run_length);
4048 
4049 	task = get_scsi_task_from_ttt(conn, transfer_tag);
4050 	if (!task) {
4051 		SPDK_ERRLOG("Data ACK SNACK for TTT: 0x%08x is invalid.\n",
4052 			    transfer_tag);
4053 		goto reject_return;
4054 	}
4055 
4056 	primary = iscsi_task_get_primary(task);
4057 	if ((run_length != 0) || (beg_run < primary->acked_data_sn)) {
4058 		SPDK_ERRLOG("TTT: 0x%08x Data ACK SNACK BegRUN: %d is less than "
4059 			    "the next expected acked DataSN: %d\n",
4060 			    transfer_tag, beg_run, primary->acked_data_sn);
4061 		goto reject_return;
4062 	}
4063 
4064 	primary->acked_data_sn = beg_run;
4065 
4066 	/* To free the pdu */
4067 	TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
4068 		if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
4069 			datain_header = (struct iscsi_bhs_data_in *) &old_pdu->bhs;
4070 			old_datasn = from_be32(&datain_header->data_sn);
4071 			if ((from_be32(&datain_header->ttt) == transfer_tag) &&
4072 			    (old_datasn == beg_run - 1)) {
4073 				TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
4074 				iscsi_conn_free_pdu(conn, old_pdu);
4075 				break;
4076 			}
4077 		}
4078 	}
4079 
4080 	SPDK_DEBUGLOG(iscsi, "Received Data ACK SNACK for TTT: 0x%08x,"
4081 		      " updated acked DataSN to 0x%08x.\n", transfer_tag,
4082 		      (task->acked_data_sn - 1));
4083 
4084 	return 0;
4085 
4086 reject_return:
4087 	return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_SNACK);
4088 }
4089 
4090 /* This function is used to handle the snack request from the initiator */
4091 static int
4092 iscsi_pdu_hdr_op_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4093 {
4094 	struct iscsi_bhs_snack_req *reqh;
4095 	struct spdk_iscsi_task *task;
4096 	int type;
4097 	uint32_t task_tag;
4098 	uint32_t beg_run;
4099 	uint32_t run_length;
4100 	int rc;
4101 
4102 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4103 		SPDK_ERRLOG("ISCSI_OP_SNACK not allowed in  discovery session\n");
4104 		return SPDK_ISCSI_CONNECTION_FATAL;
4105 	}
4106 
4107 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4108 	if (!conn->sess->ErrorRecoveryLevel) {
4109 		SPDK_ERRLOG("Got a SNACK request in ErrorRecoveryLevel=0\n");
4110 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4111 	}
4112 
4113 	type = reqh->flags & ISCSI_FLAG_SNACK_TYPE_MASK;
4114 	SPDK_DEBUGLOG(iscsi, "The value of type is %d\n", type);
4115 
4116 	switch (type) {
4117 	case 0:
4118 		reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4119 		task_tag = from_be32(&reqh->itt);
4120 		beg_run = from_be32(&reqh->beg_run);
4121 		run_length = from_be32(&reqh->run_len);
4122 
4123 		SPDK_DEBUGLOG(iscsi, "beg_run=%d, run_length=%d, "
4124 			      "task_tag=%x, transfer_tag=%u\n", beg_run,
4125 			      run_length, task_tag, from_be32(&reqh->ttt));
4126 
4127 		task = get_scsi_task_from_itt(conn, task_tag,
4128 					      ISCSI_OP_SCSI_DATAIN);
4129 		if (task) {
4130 			return iscsi_handle_recovery_datain(conn, task, pdu,
4131 							    beg_run, run_length, task_tag);
4132 		}
4133 		task = get_scsi_task_from_itt(conn, task_tag, ISCSI_OP_R2T);
4134 		if (task) {
4135 			return iscsi_handle_r2t_snack(conn, task, pdu, beg_run,
4136 						      run_length, task_tag);
4137 		}
4138 		SPDK_ERRLOG("It is Neither datain nor r2t recovery request\n");
4139 		rc = -1;
4140 		break;
4141 	case ISCSI_FLAG_SNACK_TYPE_STATUS:
4142 		rc = iscsi_handle_status_snack(conn, pdu);
4143 		break;
4144 	case ISCSI_FLAG_SNACK_TYPE_DATA_ACK:
4145 		rc = iscsi_handle_data_ack(conn, pdu);
4146 		break;
4147 	case ISCSI_FLAG_SNACK_TYPE_RDATA:
4148 		SPDK_ERRLOG("R-Data SNACK is Not Supported int spdk\n");
4149 		rc = iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4150 		break;
4151 	default:
4152 		SPDK_ERRLOG("Unknown SNACK type %d, protocol error\n", type);
4153 		rc = iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4154 		break;
4155 	}
4156 
4157 	return rc;
4158 }
4159 
4160 static int
4161 iscsi_pdu_hdr_op_data(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4162 {
4163 	struct spdk_iscsi_task	*task;
4164 	struct iscsi_bhs_data_out *reqh;
4165 	struct spdk_scsi_lun	*lun_dev;
4166 	struct spdk_mobj	*mobj;
4167 	uint32_t transfer_tag;
4168 	uint32_t task_tag;
4169 	uint32_t transfer_len;
4170 	uint32_t DataSN;
4171 	uint32_t buffer_offset;
4172 	uint32_t len;
4173 	int F_bit;
4174 	int rc;
4175 
4176 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4177 		SPDK_ERRLOG("ISCSI_OP_SCSI_DATAOUT not allowed in discovery session\n");
4178 		return SPDK_ISCSI_CONNECTION_FATAL;
4179 	}
4180 
4181 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4182 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
4183 	transfer_tag = from_be32(&reqh->ttt);
4184 	task_tag = from_be32(&reqh->itt);
4185 	DataSN = from_be32(&reqh->data_sn);
4186 	buffer_offset = from_be32(&reqh->buffer_offset);
4187 
4188 	if (pdu->data_segment_len > SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
4189 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4190 	}
4191 
4192 	task = get_transfer_task(conn, transfer_tag);
4193 	if (task == NULL) {
4194 		SPDK_ERRLOG("Not found task for transfer_tag=%x\n", transfer_tag);
4195 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4196 	}
4197 
4198 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
4199 
4200 	if (pdu->data_segment_len > task->desired_data_transfer_length) {
4201 		SPDK_ERRLOG("the dataout pdu data length is larger than the value sent by R2T PDU\n");
4202 		return SPDK_ISCSI_CONNECTION_FATAL;
4203 	}
4204 
4205 	if (task->tag != task_tag) {
4206 		SPDK_ERRLOG("The r2t task tag is %u, and the dataout task tag is %u\n",
4207 			    task->tag, task_tag);
4208 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4209 	}
4210 
4211 	if (DataSN != task->r2t_datasn) {
4212 		SPDK_ERRLOG("DataSN(%u) exp=%d error\n", DataSN, task->r2t_datasn);
4213 		if (conn->sess->ErrorRecoveryLevel >= 1) {
4214 			rc = iscsi_send_r2t_recovery(conn, task, task->acked_r2tsn, true);
4215 			if (rc == 0) {
4216 				return 0;
4217 			}
4218 		}
4219 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4220 	}
4221 
4222 	if (buffer_offset != task->next_expected_r2t_offset) {
4223 		SPDK_ERRLOG("offset(%u) error\n", buffer_offset);
4224 		return SPDK_ISCSI_CONNECTION_FATAL;
4225 	}
4226 
4227 	transfer_len = task->scsi.transfer_len;
4228 	task->current_r2t_length += pdu->data_segment_len;
4229 	task->next_expected_r2t_offset += pdu->data_segment_len;
4230 	task->r2t_datasn++;
4231 
4232 	if (task->current_r2t_length > conn->sess->MaxBurstLength) {
4233 		SPDK_ERRLOG("R2T burst(%u) > MaxBurstLength(%u)\n",
4234 			    task->current_r2t_length,
4235 			    conn->sess->MaxBurstLength);
4236 		return SPDK_ISCSI_CONNECTION_FATAL;
4237 	}
4238 
4239 	if (F_bit) {
4240 		/*
4241 		 * This R2T burst is done. Clear the length before we
4242 		 *  receive a PDU for the next R2t burst.
4243 		 */
4244 		task->current_r2t_length = 0;
4245 	}
4246 
4247 	if (task->next_expected_r2t_offset == transfer_len) {
4248 		task->acked_r2tsn++;
4249 	} else if (F_bit && (task->next_r2t_offset < transfer_len)) {
4250 		task->acked_r2tsn++;
4251 		len = spdk_min(conn->sess->MaxBurstLength,
4252 			       (transfer_len - task->next_r2t_offset));
4253 		rc = iscsi_send_r2t(conn, task, task->next_r2t_offset, len,
4254 				    task->ttt, &task->R2TSN);
4255 		if (rc < 0) {
4256 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
4257 		}
4258 		task->next_r2t_offset += len;
4259 	}
4260 
4261 	if (lun_dev == NULL) {
4262 		SPDK_DEBUGLOG(iscsi, "LUN %d is removed, reject this PDU.\n",
4263 			      task->lun_id);
4264 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4265 	} else if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(lun_dev, &task->scsi, &pdu->dif_ctx))) {
4266 		pdu->dif_insert_or_strip = true;
4267 	}
4268 
4269 	mobj = iscsi_task_get_mobj(task);
4270 	if (mobj == NULL) {
4271 		if (!pdu->dif_insert_or_strip) {
4272 			/* More Data-OUT PDUs may follow. Increase the buffer size up to
4273 			 * SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH to merge them into a
4274 			 * single subtask.
4275 			 */
4276 			pdu->data_buf_len = spdk_min(task->desired_data_transfer_length,
4277 						     SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4278 		}
4279 	} else {
4280 		/* Set up the data buffer from the one saved by the primary task. */
4281 		pdu->mobj[0] = mobj;
4282 		pdu->data = (void *)((uint64_t)mobj->buf + mobj->data_len);
4283 		pdu->data_from_mempool = true;
4284 		pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4285 
4286 		iscsi_task_set_mobj(task, NULL);
4287 	}
4288 
4289 	return 0;
4290 }
4291 
4292 static int
4293 iscsi_pdu_payload_op_data(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4294 {
4295 	struct spdk_iscsi_task *task;
4296 	struct iscsi_bhs_data_out *reqh;
4297 	struct spdk_mobj *mobj;
4298 	uint32_t transfer_tag;
4299 	int F_bit;
4300 	int rc;
4301 
4302 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4303 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
4304 	transfer_tag = from_be32(&reqh->ttt);
4305 
4306 	task = get_transfer_task(conn, transfer_tag);
4307 	if (spdk_unlikely(task == NULL)) {
4308 		SPDK_ERRLOG("Not found for transfer_tag=%x\n", transfer_tag);
4309 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4310 	}
4311 
4312 	if (spdk_scsi_dev_get_lun(conn->dev, task->lun_id) == NULL) {
4313 		SPDK_DEBUGLOG(iscsi, "LUN %d is removed, reject this PDU.\n",
4314 			      task->lun_id);
4315 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4316 	}
4317 
4318 	/* If current PDU is final in a sequence, submit all received data,
4319 	 * otherwise, continue aggregation until the first data buffer is full.
4320 	 * We do not use SGL and instead create a subtask per data buffer. Hence further
4321 	 * aggregation does not improve any performance.
4322 	 */
4323 	mobj = pdu->mobj[0];
4324 	assert(mobj != NULL);
4325 
4326 	if (F_bit || mobj->data_len >= SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH ||
4327 	    pdu->dif_insert_or_strip) {
4328 		rc = iscsi_submit_write_subtask(conn, task, pdu, mobj);
4329 		if (rc != 0) {
4330 			return rc;
4331 		}
4332 	} else {
4333 		assert(pdu->mobj[1] == NULL);
4334 		iscsi_task_set_mobj(task, mobj);
4335 		pdu->mobj[0] = NULL;
4336 		return 0;
4337 	}
4338 
4339 	mobj = pdu->mobj[1];
4340 	if (mobj == NULL) {
4341 		return 0;
4342 	}
4343 
4344 	assert(pdu->dif_insert_or_strip == false);
4345 	assert(mobj->data_len < SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4346 
4347 	if (F_bit) {
4348 		return iscsi_submit_write_subtask(conn, task, pdu, mobj);
4349 	} else {
4350 		iscsi_task_set_mobj(task, mobj);
4351 		pdu->mobj[1] = NULL;
4352 		return 0;
4353 	}
4354 }
4355 
4356 static void
4357 init_login_reject_response(struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
4358 {
4359 	struct iscsi_bhs_login_rsp *rsph;
4360 
4361 	memset(rsp_pdu, 0, sizeof(struct spdk_iscsi_pdu));
4362 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
4363 	rsph->version_max = ISCSI_VERSION;
4364 	rsph->version_act = ISCSI_VERSION;
4365 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
4366 	rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
4367 	rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
4368 	rsph->itt = pdu->bhs.itt;
4369 }
4370 
4371 static void
4372 iscsi_pdu_dump(struct spdk_iscsi_pdu *pdu)
4373 {
4374 	spdk_log_dump(stderr, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
4375 }
4376 
4377 /* This function is used to refree the pdu when it is acknowledged */
4378 static void
4379 remove_acked_pdu(struct spdk_iscsi_conn *conn, uint32_t ExpStatSN)
4380 {
4381 	struct spdk_iscsi_pdu *pdu, *pdu_temp;
4382 	uint32_t stat_sn;
4383 
4384 	conn->exp_statsn = spdk_min(ExpStatSN, conn->StatSN);
4385 	TAILQ_FOREACH_SAFE(pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
4386 		stat_sn = from_be32(&pdu->bhs.stat_sn);
4387 		if (spdk_sn32_lt(stat_sn, conn->exp_statsn)) {
4388 			TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
4389 			iscsi_conn_free_pdu(conn, pdu);
4390 		}
4391 	}
4392 }
4393 
4394 static int
4395 iscsi_update_cmdsn(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4396 {
4397 	int opcode;
4398 	uint32_t ExpStatSN;
4399 	int I_bit;
4400 	struct spdk_iscsi_sess *sess;
4401 	struct iscsi_bhs_scsi_req *reqh;
4402 
4403 	sess = conn->sess;
4404 	if (!sess) {
4405 		SPDK_ERRLOG("Connection has no associated session!\n");
4406 		return SPDK_ISCSI_CONNECTION_FATAL;
4407 	}
4408 
4409 	opcode = pdu->bhs.opcode;
4410 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
4411 
4412 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
4413 
4414 	I_bit = reqh->immediate;
4415 	if (I_bit == 0) {
4416 		if (spdk_sn32_lt(pdu->cmd_sn, sess->ExpCmdSN) ||
4417 		    spdk_sn32_gt(pdu->cmd_sn, sess->MaxCmdSN)) {
4418 			if (sess->session_type == SESSION_TYPE_NORMAL &&
4419 			    opcode != ISCSI_OP_SCSI_DATAOUT) {
4420 				SPDK_ERRLOG("CmdSN(%u) ignore (ExpCmdSN=%u, MaxCmdSN=%u)\n",
4421 					    pdu->cmd_sn, sess->ExpCmdSN, sess->MaxCmdSN);
4422 
4423 				if (sess->ErrorRecoveryLevel >= 1) {
4424 					SPDK_DEBUGLOG(iscsi, "Skip the error in ERL 1 and 2\n");
4425 				} else {
4426 					return SPDK_PDU_FATAL;
4427 				}
4428 			}
4429 		}
4430 	} else if (pdu->cmd_sn != sess->ExpCmdSN) {
4431 		SPDK_ERRLOG("CmdSN(%u) error ExpCmdSN=%u\n", pdu->cmd_sn, sess->ExpCmdSN);
4432 
4433 		if (sess->ErrorRecoveryLevel >= 1) {
4434 			SPDK_DEBUGLOG(iscsi, "Skip the error in ERL 1 and 2\n");
4435 		} else if (opcode != ISCSI_OP_NOPOUT) {
4436 			/*
4437 			 * The Linux initiator does not send valid CmdSNs for
4438 			 *  nopout under heavy load, so do not close the
4439 			 *  connection in that case.
4440 			 */
4441 			return SPDK_ISCSI_CONNECTION_FATAL;
4442 		}
4443 	}
4444 
4445 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
4446 	if (spdk_sn32_gt(ExpStatSN, conn->StatSN)) {
4447 		SPDK_DEBUGLOG(iscsi, "StatSN(%u) advanced\n", ExpStatSN);
4448 		ExpStatSN = conn->StatSN;
4449 	}
4450 
4451 	if (sess->ErrorRecoveryLevel >= 1) {
4452 		remove_acked_pdu(conn, ExpStatSN);
4453 	}
4454 
4455 	if (!I_bit && opcode != ISCSI_OP_SCSI_DATAOUT) {
4456 		sess->ExpCmdSN++;
4457 	}
4458 
4459 	return 0;
4460 }
4461 
4462 static int
4463 iscsi_pdu_hdr_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4464 {
4465 	int opcode;
4466 	int rc;
4467 	struct spdk_iscsi_pdu *rsp_pdu = NULL;
4468 
4469 	if (pdu == NULL) {
4470 		return -1;
4471 	}
4472 
4473 	opcode = pdu->bhs.opcode;
4474 
4475 	SPDK_DEBUGLOG(iscsi, "opcode %x\n", opcode);
4476 
4477 	if (opcode == ISCSI_OP_LOGIN) {
4478 		return iscsi_pdu_hdr_op_login(conn, pdu);
4479 	}
4480 
4481 	/* connection in login phase but receive non-login opcode
4482 	 * return response code 0x020b to initiator.
4483 	 * */
4484 	if (!conn->full_feature && conn->state == ISCSI_CONN_STATE_RUNNING) {
4485 		rsp_pdu = iscsi_get_pdu(conn);
4486 		if (rsp_pdu == NULL) {
4487 			return SPDK_ISCSI_CONNECTION_FATAL;
4488 		}
4489 		init_login_reject_response(pdu, rsp_pdu);
4490 		iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
4491 		SPDK_ERRLOG("Received opcode %d in login phase\n", opcode);
4492 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
4493 	} else if (conn->state == ISCSI_CONN_STATE_INVALID) {
4494 		SPDK_ERRLOG("before Full Feature\n");
4495 		iscsi_pdu_dump(pdu);
4496 		return SPDK_ISCSI_CONNECTION_FATAL;
4497 	}
4498 
4499 	rc = iscsi_update_cmdsn(conn, pdu);
4500 	if (rc != 0) {
4501 		return rc;
4502 	}
4503 
4504 	switch (opcode) {
4505 	case ISCSI_OP_NOPOUT:
4506 		rc = iscsi_pdu_hdr_op_nopout(conn, pdu);
4507 		break;
4508 
4509 	case ISCSI_OP_SCSI:
4510 		rc = iscsi_pdu_hdr_op_scsi(conn, pdu);
4511 		break;
4512 	case ISCSI_OP_TASK:
4513 		rc = iscsi_pdu_hdr_op_task(conn, pdu);
4514 		break;
4515 
4516 	case ISCSI_OP_TEXT:
4517 		rc = iscsi_pdu_hdr_op_text(conn, pdu);
4518 		break;
4519 
4520 	case ISCSI_OP_LOGOUT:
4521 		rc = iscsi_pdu_hdr_op_logout(conn, pdu);
4522 		break;
4523 
4524 	case ISCSI_OP_SCSI_DATAOUT:
4525 		rc = iscsi_pdu_hdr_op_data(conn, pdu);
4526 		break;
4527 
4528 	case ISCSI_OP_SNACK:
4529 		rc = iscsi_pdu_hdr_op_snack(conn, pdu);
4530 		break;
4531 
4532 	default:
4533 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4534 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4535 	}
4536 
4537 	if (rc < 0) {
4538 		SPDK_ERRLOG("processing PDU header (opcode=%x) failed on %s(%s)\n",
4539 			    opcode,
4540 			    conn->target_port != NULL ? spdk_scsi_port_get_name(conn->target_port) : "NULL",
4541 			    conn->initiator_port != NULL ? spdk_scsi_port_get_name(conn->initiator_port) : "NULL");
4542 	}
4543 
4544 	return rc;
4545 }
4546 
4547 static int
4548 iscsi_pdu_payload_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4549 {
4550 	int opcode;
4551 	int rc = 0;
4552 
4553 	opcode = pdu->bhs.opcode;
4554 
4555 	SPDK_DEBUGLOG(iscsi, "opcode %x\n", opcode);
4556 
4557 	switch (opcode) {
4558 	case ISCSI_OP_LOGIN:
4559 		rc = iscsi_pdu_payload_op_login(conn, pdu);
4560 		break;
4561 	case ISCSI_OP_NOPOUT:
4562 		rc = iscsi_pdu_payload_op_nopout(conn, pdu);
4563 		break;
4564 	case ISCSI_OP_SCSI:
4565 		rc = iscsi_pdu_payload_op_scsi(conn, pdu);
4566 		break;
4567 	case ISCSI_OP_TASK:
4568 		break;
4569 	case ISCSI_OP_TEXT:
4570 		rc = iscsi_pdu_payload_op_text(conn, pdu);
4571 		break;
4572 	case ISCSI_OP_LOGOUT:
4573 		break;
4574 	case ISCSI_OP_SCSI_DATAOUT:
4575 		rc = iscsi_pdu_payload_op_data(conn, pdu);
4576 		break;
4577 	case ISCSI_OP_SNACK:
4578 		break;
4579 	default:
4580 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4581 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4582 	}
4583 
4584 	if (rc < 0) {
4585 		SPDK_ERRLOG("processing PDU payload (opcode=%x) failed on %s(%s)\n",
4586 			    opcode,
4587 			    conn->target_port != NULL ? spdk_scsi_port_get_name(conn->target_port) : "NULL",
4588 			    conn->initiator_port != NULL ? spdk_scsi_port_get_name(conn->initiator_port) : "NULL");
4589 	}
4590 
4591 	return rc;
4592 }
4593 
4594 /* Return zero if completed to read payload, positive number if still in progress,
4595  * or negative number if any error.
4596  */
4597 static int
4598 iscsi_pdu_payload_read(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4599 {
4600 	struct spdk_mempool *pool;
4601 	struct spdk_mobj *mobj;
4602 	uint32_t data_len;
4603 	uint32_t read_len;
4604 	uint32_t crc32c;
4605 	int rc;
4606 
4607 	data_len = pdu->data_segment_len;
4608 	read_len = data_len - pdu->data_valid_bytes;
4609 
4610 	mobj = pdu->mobj[0];
4611 	if (mobj == NULL) {
4612 		if (pdu->data_buf_len <= iscsi_get_max_immediate_data_size()) {
4613 			pool = g_iscsi.pdu_immediate_data_pool;
4614 			pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(iscsi_get_max_immediate_data_size());
4615 		} else if (pdu->data_buf_len <= SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
4616 			pool = g_iscsi.pdu_data_out_pool;
4617 			pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4618 		} else {
4619 			SPDK_ERRLOG("Data(%d) > MaxSegment(%d)\n",
4620 				    data_len, SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4621 			return -1;
4622 		}
4623 		mobj = iscsi_datapool_get(pool);
4624 		if (mobj == NULL) {
4625 			return 1;
4626 		}
4627 		pdu->mobj[0] = mobj;
4628 		pdu->data = mobj->buf;
4629 		pdu->data_from_mempool = true;
4630 	} else if (mobj->data_len == SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH && read_len > 0) {
4631 		mobj = pdu->mobj[1];
4632 		if (mobj == NULL) {
4633 			/* The first data buffer just ran out. Allocate the second data buffer and
4634 			 * continue reading the data segment.
4635 			 */
4636 			assert(pdu->data_from_mempool == true);
4637 			assert(!pdu->dif_insert_or_strip);
4638 
4639 			if (conn->data_digest) {
4640 				iscsi_pdu_calc_partial_data_digest(pdu);
4641 			}
4642 			mobj = iscsi_datapool_get(g_iscsi.pdu_data_out_pool);
4643 			if (mobj == NULL) {
4644 				return 1;
4645 			}
4646 			pdu->mobj[1] = mobj;
4647 			pdu->data = mobj->buf;
4648 			pdu->data_offset = pdu->data_valid_bytes;
4649 			pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4650 		}
4651 	}
4652 
4653 	/* copy the actual data into local buffer */
4654 	read_len = spdk_min(read_len, SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH - mobj->data_len);
4655 
4656 	if (read_len > 0) {
4657 		rc = iscsi_conn_read_data_segment(conn,
4658 						  pdu,
4659 						  pdu->data_valid_bytes - pdu->data_offset,
4660 						  read_len);
4661 		if (rc < 0) {
4662 			return rc;
4663 		}
4664 
4665 		mobj->data_len += rc;
4666 		pdu->data_valid_bytes += rc;
4667 		if (pdu->data_valid_bytes < data_len) {
4668 			return 1;
4669 		}
4670 	}
4671 
4672 	/* copy out the data digest */
4673 	if (conn->data_digest &&
4674 	    pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
4675 		rc = iscsi_conn_read_data(conn,
4676 					  ISCSI_DIGEST_LEN - pdu->ddigest_valid_bytes,
4677 					  pdu->data_digest + pdu->ddigest_valid_bytes);
4678 		if (rc < 0) {
4679 			return rc;
4680 		}
4681 
4682 		pdu->ddigest_valid_bytes += rc;
4683 		if (pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
4684 			return 1;
4685 		}
4686 	}
4687 
4688 	/* check data digest */
4689 	if (conn->data_digest) {
4690 		iscsi_pdu_calc_partial_data_digest(pdu);
4691 		crc32c = iscsi_pdu_calc_partial_data_digest_done(pdu);
4692 
4693 		rc = MATCH_DIGEST_WORD(pdu->data_digest, crc32c);
4694 		if (rc == 0) {
4695 			SPDK_ERRLOG("data digest error (%s)\n", conn->initiator_name);
4696 			return -1;
4697 		}
4698 	}
4699 
4700 	return 0;
4701 }
4702 
4703 static int
4704 iscsi_read_pdu(struct spdk_iscsi_conn *conn)
4705 {
4706 	enum iscsi_pdu_recv_state prev_state;
4707 	struct spdk_iscsi_pdu *pdu;
4708 	uint32_t crc32c;
4709 	int ahs_len;
4710 	int rc;
4711 
4712 	do {
4713 		prev_state = conn->pdu_recv_state;
4714 		pdu = conn->pdu_in_progress;
4715 
4716 		switch (conn->pdu_recv_state) {
4717 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY:
4718 			assert(conn->pdu_in_progress == NULL);
4719 
4720 			conn->pdu_in_progress = iscsi_get_pdu(conn);
4721 			if (conn->pdu_in_progress == NULL) {
4722 				return SPDK_ISCSI_CONNECTION_FATAL;
4723 			}
4724 			conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR;
4725 			break;
4726 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR:
4727 			if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
4728 				rc = iscsi_conn_read_data(conn,
4729 							  ISCSI_BHS_LEN - pdu->bhs_valid_bytes,
4730 							  (uint8_t *)&pdu->bhs + pdu->bhs_valid_bytes);
4731 				if (rc < 0) {
4732 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4733 					break;
4734 				}
4735 				pdu->bhs_valid_bytes += rc;
4736 				if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
4737 					return 0;
4738 				}
4739 			}
4740 
4741 			/* conn->is_logged_out must be checked after completing to process
4742 			 * logout request, i.e., before processing PDU header in this state
4743 			 * machine, otherwise logout response may not be sent to initiator
4744 			 * and initiator may get logout timeout.
4745 			 */
4746 			if (spdk_unlikely(conn->is_logged_out)) {
4747 				SPDK_DEBUGLOG(iscsi, "pdu received after logout\n");
4748 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4749 				break;
4750 			}
4751 
4752 			pdu->data_segment_len = ISCSI_ALIGN(DGET24(pdu->bhs.data_segment_len));
4753 			pdu->data_buf_len = pdu->data_segment_len;
4754 
4755 			/* AHS */
4756 			ahs_len = pdu->bhs.total_ahs_len * 4;
4757 			if (ahs_len > ISCSI_AHS_LEN) {
4758 				SPDK_DEBUGLOG(iscsi, "pdu ahs length %d is invalid\n", ahs_len);
4759 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4760 				break;
4761 			}
4762 
4763 			if (pdu->ahs_valid_bytes < ahs_len) {
4764 				rc = iscsi_conn_read_data(conn,
4765 							  ahs_len - pdu->ahs_valid_bytes,
4766 							  pdu->ahs + pdu->ahs_valid_bytes);
4767 				if (rc < 0) {
4768 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4769 					break;
4770 				}
4771 
4772 				pdu->ahs_valid_bytes += rc;
4773 				if (pdu->ahs_valid_bytes < ahs_len) {
4774 					return 0;
4775 				}
4776 			}
4777 
4778 			/* Header Digest */
4779 			if (conn->header_digest &&
4780 			    pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
4781 				rc = iscsi_conn_read_data(conn,
4782 							  ISCSI_DIGEST_LEN - pdu->hdigest_valid_bytes,
4783 							  pdu->header_digest + pdu->hdigest_valid_bytes);
4784 				if (rc < 0) {
4785 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4786 					break;
4787 				}
4788 
4789 				pdu->hdigest_valid_bytes += rc;
4790 				if (pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
4791 					return 0;
4792 				}
4793 			}
4794 
4795 			if (conn->header_digest) {
4796 				crc32c = iscsi_pdu_calc_header_digest(pdu);
4797 				rc = MATCH_DIGEST_WORD(pdu->header_digest, crc32c);
4798 				if (rc == 0) {
4799 					SPDK_ERRLOG("header digest error (%s)\n", conn->initiator_name);
4800 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4801 					break;
4802 				}
4803 			}
4804 
4805 			rc = iscsi_pdu_hdr_handle(conn, pdu);
4806 			if (rc < 0) {
4807 				SPDK_ERRLOG("Critical error is detected. Close the connection\n");
4808 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4809 				break;
4810 			}
4811 
4812 			conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD;
4813 			break;
4814 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD:
4815 			if (pdu->data_segment_len != 0) {
4816 				rc = iscsi_pdu_payload_read(conn, pdu);
4817 				if (rc > 0) {
4818 					return 0;
4819 				} else if (rc < 0) {
4820 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4821 					break;
4822 				}
4823 			}
4824 
4825 			/* All data for this PDU has now been read from the socket. */
4826 			spdk_trace_record(TRACE_ISCSI_READ_PDU, conn->id, pdu->data_valid_bytes,
4827 					  (uintptr_t)pdu, pdu->bhs.opcode);
4828 
4829 			if (!pdu->is_rejected) {
4830 				rc = iscsi_pdu_payload_handle(conn, pdu);
4831 			} else {
4832 				rc = 0;
4833 			}
4834 			if (rc == 0) {
4835 				spdk_trace_record(TRACE_ISCSI_TASK_EXECUTED, 0, 0, (uintptr_t)pdu);
4836 				iscsi_put_pdu(pdu);
4837 				conn->pdu_in_progress = NULL;
4838 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY;
4839 				return 1;
4840 			} else {
4841 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4842 			}
4843 			break;
4844 		case ISCSI_PDU_RECV_STATE_ERROR:
4845 			return SPDK_ISCSI_CONNECTION_FATAL;
4846 		default:
4847 			assert(false);
4848 			SPDK_ERRLOG("code should not come here\n");
4849 			break;
4850 		}
4851 	} while (prev_state != conn->pdu_recv_state);
4852 
4853 	return 0;
4854 }
4855 
4856 #define GET_PDU_LOOP_COUNT	16
4857 
4858 int
4859 iscsi_handle_incoming_pdus(struct spdk_iscsi_conn *conn)
4860 {
4861 	int i, rc;
4862 
4863 	/* Read new PDUs from network */
4864 	for (i = 0; i < GET_PDU_LOOP_COUNT; i++) {
4865 		rc = iscsi_read_pdu(conn);
4866 		if (rc == 0) {
4867 			break;
4868 		} else if (rc < 0) {
4869 			return rc;
4870 		}
4871 
4872 		if (conn->is_stopped) {
4873 			break;
4874 		}
4875 	}
4876 
4877 	return i;
4878 }
4879