xref: /spdk/lib/iscsi/iscsi.c (revision 5977aad8f7486552c94c5cc93ea9bb110e1cb5d0)
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright (C) 2008-2012 Daisuke Aoyama <aoyama@peach.ne.jp>.
5  *   Copyright (c) Intel Corporation.
6  *   All rights reserved.
7  *
8  *   Redistribution and use in source and binary forms, with or without
9  *   modification, are permitted provided that the following conditions
10  *   are met:
11  *
12  *     * Redistributions of source code must retain the above copyright
13  *       notice, this list of conditions and the following disclaimer.
14  *     * Redistributions in binary form must reproduce the above copyright
15  *       notice, this list of conditions and the following disclaimer in
16  *       the documentation and/or other materials provided with the
17  *       distribution.
18  *     * Neither the name of Intel Corporation nor the names of its
19  *       contributors may be used to endorse or promote products derived
20  *       from this software without specific prior written permission.
21  *
22  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include "spdk/stdinc.h"
36 
37 #include "spdk/base64.h"
38 #include "spdk/crc32.h"
39 #include "spdk/endian.h"
40 #include "spdk/env.h"
41 #include "spdk/trace.h"
42 #include "spdk/string.h"
43 #include "spdk/queue.h"
44 #include "spdk/net.h"
45 
46 #include "iscsi/md5.h"
47 #include "iscsi/iscsi.h"
48 #include "iscsi/param.h"
49 #include "iscsi/tgt_node.h"
50 #include "iscsi/task.h"
51 #include "iscsi/conn.h"
52 #include "spdk/scsi.h"
53 #include "spdk/bdev.h"
54 #include "iscsi/portal_grp.h"
55 #include "iscsi/acceptor.h"
56 
57 #include "spdk_internal/log.h"
58 
59 #define MAX_TMPBUF 1024
60 
61 #define SPDK_CRC32C_INITIAL    0xffffffffUL
62 #define SPDK_CRC32C_XOR        0xffffffffUL
63 
64 #ifdef __FreeBSD__
65 #define HAVE_SRANDOMDEV 1
66 #define HAVE_ARC4RANDOM 1
67 #endif
68 
69 struct spdk_iscsi_globals g_spdk_iscsi = {
70 	.mutex = PTHREAD_MUTEX_INITIALIZER,
71 	.portal_head = TAILQ_HEAD_INITIALIZER(g_spdk_iscsi.portal_head),
72 	.pg_head = TAILQ_HEAD_INITIALIZER(g_spdk_iscsi.pg_head),
73 	.ig_head = TAILQ_HEAD_INITIALIZER(g_spdk_iscsi.ig_head),
74 	.target_head = TAILQ_HEAD_INITIALIZER(g_spdk_iscsi.target_head),
75 	.auth_group_head = TAILQ_HEAD_INITIALIZER(g_spdk_iscsi.auth_group_head),
76 };
77 
78 /* random value generation */
79 static void spdk_gen_random(uint8_t *buf, size_t len);
80 #ifndef HAVE_SRANDOMDEV
81 static void srandomdev(void);
82 #endif /* HAVE_SRANDOMDEV */
83 #ifndef HAVE_ARC4RANDOM
84 /* static uint32_t arc4random(void); */
85 #endif /* HAVE_ARC4RANDOM */
86 
87 /* convert from/to bin/hex */
88 static int spdk_bin2hex(char *buf, size_t len, const uint8_t *data, size_t data_len);
89 static int spdk_hex2bin(uint8_t *data, size_t data_len, const char *str);
90 
91 static int spdk_add_transfer_task(struct spdk_iscsi_conn *conn,
92 				  struct spdk_iscsi_task *task);
93 
94 static int spdk_iscsi_send_r2t(struct spdk_iscsi_conn *conn,
95 			       struct spdk_iscsi_task *task, int offset,
96 			       int len, uint32_t transfer_tag, uint32_t *R2TSN);
97 static int spdk_iscsi_send_r2t_recovery(struct spdk_iscsi_conn *conn,
98 					struct spdk_iscsi_task *r2t_task, uint32_t r2t_sn,
99 					bool send_new_r2tsn);
100 
101 static int spdk_create_iscsi_sess(struct spdk_iscsi_conn *conn,
102 				  struct spdk_iscsi_tgt_node *target, enum session_type session_type);
103 static int spdk_append_iscsi_sess(struct spdk_iscsi_conn *conn,
104 				  const char *initiator_port_name, uint16_t tsih, uint16_t cid);
105 
106 static void spdk_remove_acked_pdu(struct spdk_iscsi_conn *conn, uint32_t ExpStatSN);
107 
108 static int spdk_iscsi_reject(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu,
109 			     int reason);
110 
111 #define DMIN32(A,B) ((uint32_t) ((uint32_t)(A) > (uint32_t)(B) ? (uint32_t)(B) : (uint32_t)(A)))
112 #define DMIN64(A,B) ((uint64_t) ((A) > (B) ? (B) : (A)))
113 
114 #define MATCH_DIGEST_WORD(BUF, CRC32C) \
115 	(    ((((uint32_t) *((uint8_t *)(BUF)+0)) << 0)		\
116 	    | (((uint32_t) *((uint8_t *)(BUF)+1)) << 8)		\
117 	    | (((uint32_t) *((uint8_t *)(BUF)+2)) << 16)	\
118 	    | (((uint32_t) *((uint8_t *)(BUF)+3)) << 24))	\
119 	    == (CRC32C))
120 
121 #if 0
122 static int
123 spdk_match_digest_word(const uint8_t *buf, uint32_t crc32c)
124 {
125 	uint32_t l;
126 
127 	l = (buf[0] & 0xffU) << 0;
128 	l |= (buf[1] & 0xffU) << 8;
129 	l |= (buf[2] & 0xffU) << 16;
130 	l |= (buf[3] & 0xffU) << 24;
131 	return (l == crc32c);
132 }
133 
134 static uint8_t *
135 spdk_make_digest_word(uint8_t *buf, size_t len, uint32_t crc32c)
136 {
137 	if (len < ISCSI_DIGEST_LEN) {
138 		return NULL;
139 	}
140 
141 	buf[0] = (crc32c >> 0) & 0xffU;
142 	buf[1] = (crc32c >> 8) & 0xffU;
143 	buf[2] = (crc32c >> 16) & 0xffU;
144 	buf[3] = (crc32c >> 24) & 0xffU;
145 	return buf;
146 }
147 #endif
148 
149 #ifndef HAVE_SRANDOMDEV
150 static void
151 srandomdev(void)
152 {
153 	unsigned long seed;
154 	time_t now;
155 	pid_t pid;
156 
157 	pid = getpid();
158 	now = time(NULL);
159 	seed = pid ^ now;
160 	srandom(seed);
161 }
162 #endif /* HAVE_SRANDOMDEV */
163 
164 #ifndef HAVE_ARC4RANDOM
165 static int spdk_arc4random_initialized = 0;
166 
167 static uint32_t
168 arc4random(void)
169 {
170 	uint32_t r;
171 	uint32_t r1, r2;
172 
173 	if (!spdk_arc4random_initialized) {
174 		srandomdev();
175 		spdk_arc4random_initialized = 1;
176 	}
177 	r1 = (uint32_t)(random() & 0xffff);
178 	r2 = (uint32_t)(random() & 0xffff);
179 	r = (r1 << 16) | r2;
180 	return r;
181 }
182 #endif /* HAVE_ARC4RANDOM */
183 
184 static void
185 spdk_gen_random(uint8_t *buf, size_t len)
186 {
187 #ifdef USE_RANDOM
188 	long l;
189 	size_t idx;
190 
191 	srandomdev();
192 	for (idx = 0; idx < len; idx++) {
193 		l = random();
194 		buf[idx] = (uint8_t) l;
195 	}
196 #else
197 	uint32_t r;
198 	size_t idx;
199 
200 	for (idx = 0; idx < len; idx++) {
201 		r = arc4random();
202 		buf[idx] = (uint8_t) r;
203 	}
204 #endif /* USE_RANDOM */
205 }
206 
207 static uint64_t
208 spdk_iscsi_get_isid(const uint8_t isid[6])
209 {
210 	return (uint64_t)isid[0] << 40 |
211 	       (uint64_t)isid[1] << 32 |
212 	       (uint64_t)isid[2] << 24 |
213 	       (uint64_t)isid[3] << 16 |
214 	       (uint64_t)isid[4] << 8 |
215 	       (uint64_t)isid[5];
216 }
217 
218 static int
219 spdk_bin2hex(char *buf, size_t len, const uint8_t *data, size_t data_len)
220 {
221 	const char *digits = "0123456789ABCDEF";
222 	size_t total = 0;
223 	size_t idx;
224 
225 	if (len < 3) {
226 		return -1;
227 	}
228 	buf[total] = '0';
229 	total++;
230 	buf[total] = 'x';
231 	total++;
232 	buf[total] = '\0';
233 
234 	for (idx = 0; idx < data_len; idx++) {
235 		if (total + 3 > len) {
236 			buf[total] = '\0';
237 			return - 1;
238 		}
239 		buf[total] = digits[(data[idx] >> 4) & 0x0fU];
240 		total++;
241 		buf[total] = digits[data[idx] & 0x0fU];
242 		total++;
243 	}
244 	buf[total] = '\0';
245 	return total;
246 }
247 
248 static int
249 spdk_hex2bin(uint8_t *data, size_t data_len, const char *str)
250 {
251 	const char *digits = "0123456789ABCDEF";
252 	const char *dp;
253 	const char *p;
254 	size_t total = 0;
255 	int n0, n1;
256 
257 	p = str;
258 	if (p[0] != '0' && (p[1] != 'x' && p[1] != 'X')) {
259 		return -1;
260 	}
261 	p += 2;
262 
263 	while (p[0] != '\0' && p[1] != '\0') {
264 		if (total >= data_len) {
265 			return -1;
266 		}
267 		dp = strchr(digits, toupper((int) p[0]));
268 		if (dp == NULL) {
269 			return -1;
270 		}
271 		n0 = (int)(dp - digits);
272 		dp = strchr(digits, toupper((int) p[1]));
273 		if (dp == NULL) {
274 			return -1;
275 		}
276 		n1 = (int)(dp - digits);
277 
278 		data[total] = (uint8_t)(((n0 & 0x0fU) << 4) | (n1 & 0x0fU));
279 		total++;
280 		p += 2;
281 	}
282 	return total;
283 }
284 
285 static int
286 spdk_islun2lun(uint64_t islun)
287 {
288 	uint64_t fmt_lun;
289 	uint64_t method;
290 	int lun_i;
291 
292 	fmt_lun = islun;
293 	method = (fmt_lun >> 62) & 0x03U;
294 	fmt_lun = fmt_lun >> 48;
295 	if (method == 0x00U) {
296 		lun_i = (int)(fmt_lun & 0x00ffU);
297 	} else if (method == 0x01U) {
298 		lun_i = (int)(fmt_lun & 0x3fffU);
299 	} else {
300 		lun_i = 0xffffU;
301 	}
302 	return lun_i;
303 }
304 
305 uint32_t
306 spdk_iscsi_pdu_calc_header_digest(struct spdk_iscsi_pdu *pdu)
307 {
308 	uint32_t crc32c;
309 	uint32_t ahs_len_bytes = pdu->bhs.total_ahs_len * 4;
310 
311 	crc32c = SPDK_CRC32C_INITIAL;
312 	crc32c = spdk_crc32c_update(&pdu->bhs, ISCSI_BHS_LEN, crc32c);
313 
314 	if (ahs_len_bytes) {
315 		crc32c = spdk_crc32c_update(pdu->ahs, ahs_len_bytes, crc32c);
316 	}
317 
318 	/* BHS and AHS are always 4-byte multiples in length, so no padding is necessary. */
319 	crc32c = crc32c ^ SPDK_CRC32C_XOR;
320 	return crc32c;
321 }
322 
323 uint32_t
324 spdk_iscsi_pdu_calc_data_digest(struct spdk_iscsi_pdu *pdu)
325 {
326 	uint32_t data_len = DGET24(pdu->bhs.data_segment_len);
327 	uint32_t crc32c;
328 	uint32_t mod;
329 
330 	crc32c = SPDK_CRC32C_INITIAL;
331 	crc32c = spdk_crc32c_update(pdu->data, data_len, crc32c);
332 
333 	mod = data_len % ISCSI_ALIGNMENT;
334 	if (mod != 0) {
335 		uint32_t pad_length = ISCSI_ALIGNMENT - mod;
336 		uint8_t pad[3] = {0, 0, 0};
337 
338 		assert(pad_length > 0);
339 		assert(pad_length <= sizeof(pad));
340 		crc32c = spdk_crc32c_update(pad, pad_length, crc32c);
341 	}
342 
343 	crc32c = crc32c ^ SPDK_CRC32C_XOR;
344 	return crc32c;
345 }
346 
347 int
348 spdk_iscsi_read_pdu(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu **_pdu)
349 {
350 	struct spdk_iscsi_pdu *pdu;
351 	struct spdk_mempool *pool;
352 	uint32_t crc32c;
353 	int ahs_len;
354 	int data_len;
355 	int max_segment_len;
356 	int rc;
357 
358 	if (conn->pdu_in_progress == NULL) {
359 		conn->pdu_in_progress = spdk_get_pdu();
360 		if (conn->pdu_in_progress == NULL) {
361 			return SPDK_ISCSI_CONNECTION_FATAL;
362 		}
363 	}
364 
365 	pdu = conn->pdu_in_progress;
366 
367 	if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
368 		rc = spdk_iscsi_conn_read_data(conn,
369 					       ISCSI_BHS_LEN - pdu->bhs_valid_bytes,
370 					       (uint8_t *)&pdu->bhs + pdu->bhs_valid_bytes);
371 		if (rc < 0) {
372 			*_pdu = NULL;
373 			spdk_put_pdu(pdu);
374 			conn->pdu_in_progress = NULL;
375 			return rc;
376 		}
377 		pdu->bhs_valid_bytes += rc;
378 		if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
379 			*_pdu = NULL;
380 			return SPDK_SUCCESS;
381 		}
382 	}
383 
384 	data_len = ISCSI_ALIGN(DGET24(pdu->bhs.data_segment_len));
385 
386 	/* AHS */
387 	ahs_len = pdu->bhs.total_ahs_len * 4;
388 	assert(ahs_len <= ISCSI_AHS_LEN);
389 	if (pdu->ahs_valid_bytes < ahs_len) {
390 		rc = spdk_iscsi_conn_read_data(conn,
391 					       ahs_len - pdu->ahs_valid_bytes,
392 					       pdu->ahs + pdu->ahs_valid_bytes);
393 		if (rc < 0) {
394 			*_pdu = NULL;
395 			spdk_put_pdu(pdu);
396 			conn->pdu_in_progress = NULL;
397 			return rc;
398 		}
399 
400 		pdu->ahs_valid_bytes += rc;
401 		if (pdu->ahs_valid_bytes < ahs_len) {
402 			*_pdu = NULL;
403 			return SPDK_SUCCESS;
404 		}
405 	}
406 
407 	/* Header Digest */
408 	if (conn->header_digest &&
409 	    pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
410 		rc = spdk_iscsi_conn_read_data(conn,
411 					       ISCSI_DIGEST_LEN - pdu->hdigest_valid_bytes,
412 					       pdu->header_digest + pdu->hdigest_valid_bytes);
413 		if (rc < 0) {
414 			*_pdu = NULL;
415 			spdk_put_pdu(pdu);
416 			conn->pdu_in_progress = NULL;
417 			return rc;
418 		}
419 
420 		pdu->hdigest_valid_bytes += rc;
421 		if (pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
422 			*_pdu = NULL;
423 			return SPDK_SUCCESS;
424 		}
425 	}
426 
427 	/* copy the actual data into local buffer */
428 	if (pdu->data_valid_bytes < data_len) {
429 		if (pdu->data_buf == NULL) {
430 			if (data_len <= spdk_get_immediate_data_buffer_size()) {
431 				pool = g_spdk_iscsi.pdu_immediate_data_pool;
432 			} else if (data_len <= spdk_get_data_out_buffer_size()) {
433 				pool = g_spdk_iscsi.pdu_data_out_pool;
434 			} else {
435 				SPDK_ERRLOG("Data(%d) > MaxSegment(%d)\n",
436 					    data_len, spdk_get_data_out_buffer_size());
437 				*_pdu = NULL;
438 				spdk_put_pdu(pdu);
439 				conn->pdu_in_progress = NULL;
440 				return SPDK_ISCSI_CONNECTION_FATAL;
441 			}
442 			pdu->mobj = spdk_mempool_get(pool);
443 			if (pdu->mobj == NULL) {
444 				*_pdu = NULL;
445 				return SPDK_SUCCESS;
446 			}
447 			pdu->data_buf = pdu->mobj->buf;
448 		}
449 
450 		rc = spdk_iscsi_conn_read_data(conn,
451 					       data_len - pdu->data_valid_bytes,
452 					       pdu->data_buf + pdu->data_valid_bytes);
453 		if (rc < 0) {
454 			*_pdu = NULL;
455 			spdk_put_pdu(pdu);
456 			conn->pdu_in_progress = NULL;
457 			return rc;
458 		}
459 
460 		pdu->data_valid_bytes += rc;
461 		if (pdu->data_valid_bytes < data_len) {
462 			*_pdu = NULL;
463 			return SPDK_SUCCESS;
464 		}
465 	}
466 
467 	/* copy out the data digest */
468 	if (conn->data_digest && data_len != 0 &&
469 	    pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
470 		rc = spdk_iscsi_conn_read_data(conn,
471 					       ISCSI_DIGEST_LEN - pdu->ddigest_valid_bytes,
472 					       pdu->data_digest + pdu->ddigest_valid_bytes);
473 		if (rc < 0) {
474 			*_pdu = NULL;
475 			spdk_put_pdu(pdu);
476 			conn->pdu_in_progress = NULL;
477 			return rc;
478 		}
479 
480 		pdu->ddigest_valid_bytes += rc;
481 		if (pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
482 			*_pdu = NULL;
483 			return SPDK_SUCCESS;
484 		}
485 	}
486 
487 	/* All data for this PDU has now been read from the socket. */
488 	conn->pdu_in_progress = NULL;
489 
490 	spdk_trace_record(TRACE_ISCSI_READ_PDU, conn->id, pdu->data_valid_bytes,
491 			  (uintptr_t)pdu, pdu->bhs.opcode);
492 
493 	/* Data Segment */
494 	if (data_len != 0) {
495 		/*
496 		 * Determine the maximum segment length expected for this PDU.
497 		 *  This will be used to make sure the initiator did not send
498 		 *  us too much immediate data.
499 		 *
500 		 * This value is specified separately by the initiator and target,
501 		 *  and not negotiated.  So we can use the #define safely here,
502 		 *  since the value is not dependent on the initiator's maximum
503 		 *  segment lengths (FirstBurstLength/MaxRecvDataSegmentLength),
504 		 *  and SPDK currently does not allow configuration of these values
505 		 *  at runtime.
506 		 */
507 		if (conn->sess == NULL) {
508 			/*
509 			 * If the connection does not yet have a session, then
510 			 *  login is not complete and we use the 8KB default
511 			 *  FirstBurstLength as our maximum data segment length
512 			 *  value.
513 			 */
514 			max_segment_len = DEFAULT_FIRSTBURSTLENGTH;
515 		} else if (pdu->bhs.opcode == ISCSI_OP_SCSI_DATAOUT) {
516 			max_segment_len = spdk_get_data_out_buffer_size();
517 		} else if (pdu->bhs.opcode == ISCSI_OP_NOPOUT) {
518 			max_segment_len = SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH;
519 		} else {
520 			max_segment_len = spdk_get_immediate_data_buffer_size();
521 		}
522 		if (data_len > max_segment_len) {
523 			SPDK_ERRLOG("Data(%d) > MaxSegment(%d)\n", data_len, max_segment_len);
524 			rc = spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
525 			spdk_put_pdu(pdu);
526 
527 			/*
528 			 * If spdk_iscsi_reject() was not able to reject the PDU,
529 			 * treat it as a fatal connection error.  Otherwise,
530 			 * return SUCCESS here so that the caller will continue
531 			 * to attempt to read PDUs.
532 			 */
533 			rc = (rc < 0) ? SPDK_ISCSI_CONNECTION_FATAL : SPDK_SUCCESS;
534 			return rc;
535 		}
536 
537 		pdu->data = pdu->data_buf;
538 		pdu->data_from_mempool = true;
539 		pdu->data_segment_len = data_len;
540 	}
541 
542 	/* check digest */
543 	if (conn->header_digest) {
544 		crc32c = spdk_iscsi_pdu_calc_header_digest(pdu);
545 		rc = MATCH_DIGEST_WORD(pdu->header_digest, crc32c);
546 		if (rc == 0) {
547 			SPDK_ERRLOG("header digest error (%s)\n", conn->initiator_name);
548 			spdk_put_pdu(pdu);
549 			return SPDK_ISCSI_CONNECTION_FATAL;
550 		}
551 	}
552 	if (conn->data_digest && data_len != 0) {
553 		crc32c = spdk_iscsi_pdu_calc_data_digest(pdu);
554 		rc = MATCH_DIGEST_WORD(pdu->data_digest, crc32c);
555 		if (rc == 0) {
556 			SPDK_ERRLOG("data digest error (%s)\n", conn->initiator_name);
557 			spdk_put_pdu(pdu);
558 			return SPDK_ISCSI_CONNECTION_FATAL;
559 		}
560 	}
561 
562 	*_pdu = pdu;
563 	return 1;
564 }
565 
566 int
567 spdk_iscsi_build_iovecs(struct spdk_iscsi_conn *conn, struct iovec *iovec,
568 			struct spdk_iscsi_pdu *pdu)
569 {
570 	int iovec_cnt = 0;
571 	int enable_digest;
572 	int total_ahs_len;
573 	int data_len;
574 
575 	total_ahs_len = pdu->bhs.total_ahs_len;
576 	data_len = DGET24(pdu->bhs.data_segment_len);
577 
578 	enable_digest = 1;
579 	if (pdu->bhs.opcode == ISCSI_OP_LOGIN_RSP) {
580 		/* this PDU should be sent without digest */
581 		enable_digest = 0;
582 	}
583 
584 	/* BHS */
585 	iovec[iovec_cnt].iov_base = &pdu->bhs;
586 	iovec[iovec_cnt].iov_len = ISCSI_BHS_LEN;
587 	iovec_cnt++;
588 
589 	/* AHS */
590 	if (total_ahs_len > 0) {
591 		iovec[iovec_cnt].iov_base = pdu->ahs;
592 		iovec[iovec_cnt].iov_len = 4 * total_ahs_len;
593 		iovec_cnt++;
594 	}
595 
596 	/* Header Digest */
597 	if (enable_digest && conn->header_digest) {
598 		iovec[iovec_cnt].iov_base = pdu->header_digest;
599 		iovec[iovec_cnt].iov_len = ISCSI_DIGEST_LEN;
600 		iovec_cnt++;
601 	}
602 
603 	/* Data Segment */
604 	if (data_len > 0) {
605 		iovec[iovec_cnt].iov_base = pdu->data;
606 		iovec[iovec_cnt].iov_len = ISCSI_ALIGN(data_len);
607 		iovec_cnt++;
608 	}
609 
610 	/* Data Digest */
611 	if (enable_digest && conn->data_digest && data_len != 0) {
612 		iovec[iovec_cnt].iov_base = pdu->data_digest;
613 		iovec[iovec_cnt].iov_len = ISCSI_DIGEST_LEN;
614 		iovec_cnt++;
615 	}
616 
617 	return iovec_cnt;
618 }
619 
620 static int
621 spdk_iscsi_append_text(struct spdk_iscsi_conn *conn __attribute__((__unused__)),
622 		       const char *key, const char *val, uint8_t *data,
623 		       int alloc_len, int data_len)
624 {
625 	int total;
626 	int len;
627 
628 	total = data_len;
629 	if (alloc_len < 1) {
630 		return 0;
631 	}
632 	if (total > alloc_len) {
633 		total = alloc_len;
634 		data[total - 1] = '\0';
635 		return total;
636 	}
637 
638 	if (alloc_len - total < 1) {
639 		SPDK_ERRLOG("data space small %d\n", alloc_len);
640 		return total;
641 	}
642 	len = snprintf((char *) data + total, alloc_len - total, "%s=%s", key, val);
643 	total += len + 1;
644 
645 	return total;
646 }
647 
648 static int
649 spdk_iscsi_append_param(struct spdk_iscsi_conn *conn, const char *key,
650 			uint8_t *data, int alloc_len, int data_len)
651 {
652 	struct iscsi_param *param;
653 	int rc;
654 
655 	param = spdk_iscsi_param_find(conn->params, key);
656 	if (param == NULL) {
657 		param = spdk_iscsi_param_find(conn->sess->params, key);
658 		if (param == NULL) {
659 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "no key %.64s\n", key);
660 			return data_len;
661 		}
662 	}
663 	rc = spdk_iscsi_append_text(conn, param->key, param->val, data,
664 				    alloc_len, data_len);
665 	return rc;
666 }
667 
668 static int
669 spdk_iscsi_get_authinfo(struct spdk_iscsi_conn *conn, const char *authuser)
670 {
671 	int ag_tag;
672 	int rc;
673 
674 	if (conn->sess->target != NULL) {
675 		ag_tag = conn->sess->target->chap_group;
676 	} else {
677 		ag_tag = -1;
678 	}
679 	if (ag_tag < 0) {
680 		ag_tag = g_spdk_iscsi.chap_group;
681 	}
682 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "ag_tag=%d\n", ag_tag);
683 
684 	rc = spdk_iscsi_chap_get_authinfo(&conn->auth, authuser, ag_tag);
685 	if (rc < 0) {
686 		SPDK_ERRLOG("chap_get_authinfo() failed\n");
687 		return -1;
688 	}
689 	return 0;
690 }
691 
692 static int
693 spdk_iscsi_auth_params(struct spdk_iscsi_conn *conn,
694 		       struct iscsi_param *params, const char *method, uint8_t *data,
695 		       int alloc_len, int data_len)
696 {
697 	char *in_val;
698 	char *in_next;
699 	char *new_val;
700 	const char *algorithm;
701 	const char *name;
702 	const char *response;
703 	const char *identifier;
704 	const char *challenge;
705 	int total;
706 	int rc;
707 
708 	if (conn == NULL || params == NULL || method == NULL) {
709 		return -1;
710 	}
711 	if (strcasecmp(method, "CHAP") == 0) {
712 		/* method OK */
713 	} else {
714 		SPDK_ERRLOG("unsupported AuthMethod %.64s\n", method);
715 		return -1;
716 	}
717 
718 	total = data_len;
719 	if (alloc_len < 1) {
720 		return 0;
721 	}
722 	if (total > alloc_len) {
723 		total = alloc_len;
724 		data[total - 1] = '\0';
725 		return total;
726 	}
727 
728 	/* for temporary store */
729 	in_val = malloc(ISCSI_TEXT_MAX_VAL_LEN + 1);
730 	if (!in_val) {
731 		SPDK_ERRLOG("malloc() failed for temporary store\n");
732 		return -ENOMEM;
733 	}
734 
735 	/* CHAP method (RFC1994) */
736 	if ((algorithm = spdk_iscsi_param_get_val(params, "CHAP_A")) != NULL) {
737 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_A) {
738 			SPDK_ERRLOG("CHAP sequence error\n");
739 			goto error_return;
740 		}
741 
742 		/* CHAP_A is LIST type */
743 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", algorithm);
744 		in_next = in_val;
745 		while ((new_val = spdk_strsepq(&in_next, ",")) != NULL) {
746 			if (strcasecmp(new_val, "5") == 0) {
747 				/* CHAP with MD5 */
748 				break;
749 			}
750 		}
751 		if (new_val == NULL) {
752 			snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", "Reject");
753 			new_val = in_val;
754 			spdk_iscsi_append_text(conn, "CHAP_A", new_val,
755 					       data, alloc_len, total);
756 			goto error_return;
757 		}
758 		/* selected algorithm is 5 (MD5) */
759 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "got CHAP_A=%s\n", new_val);
760 		total = spdk_iscsi_append_text(conn, "CHAP_A", new_val,
761 					       data, alloc_len, total);
762 
763 		/* Identifier is one octet */
764 		spdk_gen_random(conn->auth.chap_id, 1);
765 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN, "%d",
766 			 (int) conn->auth.chap_id[0]);
767 		total = spdk_iscsi_append_text(conn, "CHAP_I", in_val,
768 					       data, alloc_len, total);
769 
770 		/* Challenge Value is a variable stream of octets */
771 		/* (binary length MUST not exceed 1024 bytes) */
772 		conn->auth.chap_challenge_len = ISCSI_CHAP_CHALLENGE_LEN;
773 		spdk_gen_random(conn->auth.chap_challenge,
774 				conn->auth.chap_challenge_len);
775 		spdk_bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN,
776 			     conn->auth.chap_challenge,
777 			     conn->auth.chap_challenge_len);
778 		total = spdk_iscsi_append_text(conn, "CHAP_C", in_val,
779 					       data, alloc_len, total);
780 
781 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_NR;
782 	} else if ((name = spdk_iscsi_param_get_val(params, "CHAP_N")) != NULL) {
783 		uint8_t resmd5[SPDK_MD5DIGEST_LEN];
784 		uint8_t tgtmd5[SPDK_MD5DIGEST_LEN];
785 		struct spdk_md5ctx md5ctx;
786 		size_t decoded_len = 0;
787 
788 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_NR) {
789 			SPDK_ERRLOG("CHAP sequence error\n");
790 			goto error_return;
791 		}
792 
793 		response = spdk_iscsi_param_get_val(params, "CHAP_R");
794 		if (response == NULL) {
795 			SPDK_ERRLOG("no response\n");
796 			goto error_return;
797 		}
798 		if (response[0] == '0' &&
799 		    (response[1] == 'x' || response[1] == 'X')) {
800 			rc = spdk_hex2bin(resmd5, SPDK_MD5DIGEST_LEN, response);
801 			if (rc < 0 || rc != SPDK_MD5DIGEST_LEN) {
802 				SPDK_ERRLOG("response format error\n");
803 				goto error_return;
804 			}
805 		} else if (response[0] == '0' &&
806 			   (response[1] == 'b' || response[1] == 'B')) {
807 			response += 2;
808 			rc = spdk_base64_decode(resmd5, &decoded_len, response);
809 			if (rc < 0 || decoded_len != SPDK_MD5DIGEST_LEN) {
810 				SPDK_ERRLOG("response format error\n");
811 				goto error_return;
812 			}
813 		} else {
814 			SPDK_ERRLOG("response format error\n");
815 			goto error_return;
816 		}
817 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "got CHAP_N/CHAP_R\n");
818 
819 		rc = spdk_iscsi_get_authinfo(conn, name);
820 		if (rc < 0) {
821 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
822 			SPDK_ERRLOG("iscsi_get_authinfo() failed\n");
823 			goto error_return;
824 		}
825 		if (conn->auth.user[0] == '\0' || conn->auth.secret[0] == '\0') {
826 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
827 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
828 			goto error_return;
829 		}
830 
831 		spdk_md5init(&md5ctx);
832 		/* Identifier */
833 		spdk_md5update(&md5ctx, conn->auth.chap_id, 1);
834 		/* followed by secret */
835 		spdk_md5update(&md5ctx, conn->auth.secret,
836 			       strlen(conn->auth.secret));
837 		/* followed by Challenge Value */
838 		spdk_md5update(&md5ctx, conn->auth.chap_challenge,
839 			       conn->auth.chap_challenge_len);
840 		/* tgtmd5 is expecting Response Value */
841 		spdk_md5final(tgtmd5, &md5ctx);
842 
843 		spdk_bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN,
844 			     tgtmd5, SPDK_MD5DIGEST_LEN);
845 
846 #if 0
847 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "tgtmd5=%s, resmd5=%s\n", in_val, response);
848 		spdk_dump("tgtmd5", tgtmd5, SPDK_MD5DIGEST_LEN);
849 		spdk_dump("resmd5", resmd5, SPDK_MD5DIGEST_LEN);
850 #endif
851 
852 		/* compare MD5 digest */
853 		if (memcmp(tgtmd5, resmd5, SPDK_MD5DIGEST_LEN) != 0) {
854 			/* not match */
855 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
856 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
857 			goto error_return;
858 		}
859 		/* OK initiator's secret */
860 		conn->authenticated = true;
861 
862 		/* mutual CHAP? */
863 		identifier = spdk_iscsi_param_get_val(params, "CHAP_I");
864 		if (identifier != NULL) {
865 			conn->auth.chap_mid[0] = (uint8_t) strtol(identifier, NULL, 10);
866 			challenge = spdk_iscsi_param_get_val(params, "CHAP_C");
867 			if (challenge == NULL) {
868 				SPDK_ERRLOG("CHAP sequence error\n");
869 				goto error_return;
870 			}
871 			if (challenge[0] == '0' &&
872 			    (challenge[1] == 'x' || challenge[1] == 'X')) {
873 				rc = spdk_hex2bin(conn->auth.chap_mchallenge,
874 						  ISCSI_CHAP_CHALLENGE_LEN,
875 						  challenge);
876 				if (rc < 0) {
877 					SPDK_ERRLOG("challenge format error\n");
878 					goto error_return;
879 				}
880 				conn->auth.chap_mchallenge_len = rc;
881 			} else if (challenge[0] == '0' &&
882 				   (challenge[1] == 'b' || challenge[1] == 'B')) {
883 				challenge += 2;
884 				rc = spdk_base64_decode(conn->auth.chap_mchallenge,
885 							&decoded_len, challenge);
886 				if (rc < 0) {
887 					SPDK_ERRLOG("challenge format error\n");
888 					goto error_return;
889 				}
890 				conn->auth.chap_mchallenge_len = decoded_len;
891 			} else {
892 				SPDK_ERRLOG("challenge format error\n");
893 				goto error_return;
894 			}
895 #if 0
896 			spdk_dump("MChallenge", conn->auth.chap_mchallenge,
897 				  conn->auth.chap_mchallenge_len);
898 #endif
899 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "got CHAP_I/CHAP_C\n");
900 
901 			if (conn->auth.muser[0] == '\0' || conn->auth.msecret[0] == '\0') {
902 				/* SPDK_ERRLOG("mutual auth user or secret is missing\n"); */
903 				SPDK_ERRLOG("auth failed (name %.64s)\n", name);
904 				goto error_return;
905 			}
906 
907 			spdk_md5init(&md5ctx);
908 			/* Identifier */
909 			spdk_md5update(&md5ctx, conn->auth.chap_mid, 1);
910 			/* followed by secret */
911 			spdk_md5update(&md5ctx, conn->auth.msecret,
912 				       strlen(conn->auth.msecret));
913 			/* followed by Challenge Value */
914 			spdk_md5update(&md5ctx, conn->auth.chap_mchallenge,
915 				       conn->auth.chap_mchallenge_len);
916 			/* tgtmd5 is Response Value */
917 			spdk_md5final(tgtmd5, &md5ctx);
918 
919 			spdk_bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN,
920 				     tgtmd5, SPDK_MD5DIGEST_LEN);
921 
922 			total = spdk_iscsi_append_text(conn, "CHAP_N",
923 						       conn->auth.muser, data, alloc_len, total);
924 			total = spdk_iscsi_append_text(conn, "CHAP_R",
925 						       in_val, data, alloc_len, total);
926 		} else {
927 			/* not mutual */
928 			if (conn->mutual_chap) {
929 				SPDK_ERRLOG("required mutual CHAP\n");
930 				goto error_return;
931 			}
932 		}
933 
934 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_END;
935 	} else {
936 		/* not found CHAP keys */
937 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "start CHAP\n");
938 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
939 	}
940 
941 	free(in_val);
942 	return total;
943 
944 error_return:
945 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
946 	free(in_val);
947 	return -1;
948 }
949 
950 static int
951 spdk_iscsi_reject(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu,
952 		  int reason)
953 {
954 	struct spdk_iscsi_pdu *rsp_pdu;
955 	struct iscsi_bhs_reject *rsph;
956 	uint8_t *data;
957 	int total_ahs_len;
958 	int data_len;
959 	int alloc_len;
960 
961 	total_ahs_len = pdu->bhs.total_ahs_len;
962 	data_len = 0;
963 	alloc_len = ISCSI_BHS_LEN + (4 * total_ahs_len);
964 
965 	if (conn->header_digest) {
966 		alloc_len += ISCSI_DIGEST_LEN;
967 	}
968 
969 	data = calloc(1, alloc_len);
970 	if (!data) {
971 		SPDK_ERRLOG("calloc() failed for data segment\n");
972 		return -ENOMEM;
973 	}
974 
975 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Reject PDU reason=%d\n", reason);
976 
977 	if (conn->sess != NULL) {
978 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI,
979 			      "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
980 			      conn->StatSN, conn->sess->ExpCmdSN,
981 			      conn->sess->MaxCmdSN);
982 	} else {
983 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "StatSN=%u\n", conn->StatSN);
984 	}
985 
986 	memcpy(data, &pdu->bhs, ISCSI_BHS_LEN);
987 	data_len += ISCSI_BHS_LEN;
988 
989 	if (total_ahs_len != 0) {
990 		memcpy(data + data_len, pdu->ahs, (4 * total_ahs_len));
991 		data_len += (4 * total_ahs_len);
992 	}
993 
994 	if (conn->header_digest) {
995 		memcpy(data + data_len, pdu->header_digest, ISCSI_DIGEST_LEN);
996 		data_len += ISCSI_DIGEST_LEN;
997 	}
998 
999 	rsp_pdu = spdk_get_pdu();
1000 	if (rsp_pdu == NULL) {
1001 		free(data);
1002 		return -ENOMEM;
1003 	}
1004 
1005 	rsph = (struct iscsi_bhs_reject *)&rsp_pdu->bhs;
1006 	rsp_pdu->data = data;
1007 	rsph->opcode = ISCSI_OP_REJECT;
1008 	rsph->flags |= 0x80;	/* bit 0 is default to 1 */
1009 	rsph->reason = reason;
1010 	DSET24(rsph->data_segment_len, data_len);
1011 
1012 	rsph->ffffffff = 0xffffffffU;
1013 	to_be32(&rsph->stat_sn, conn->StatSN);
1014 	conn->StatSN++;
1015 
1016 	if (conn->sess != NULL) {
1017 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
1018 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
1019 	} else {
1020 		to_be32(&rsph->exp_cmd_sn, 1);
1021 		to_be32(&rsph->max_cmd_sn, 1);
1022 	}
1023 
1024 	SPDK_LOGDUMP(SPDK_LOG_ISCSI, "PDU", (void *)&rsp_pdu->bhs, ISCSI_BHS_LEN);
1025 
1026 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
1027 
1028 	return 0;
1029 }
1030 
1031 static int
1032 spdk_iscsi_check_values(struct spdk_iscsi_conn *conn)
1033 {
1034 	if (conn->sess->FirstBurstLength > conn->sess->MaxBurstLength) {
1035 		SPDK_ERRLOG("FirstBurstLength(%d) > MaxBurstLength(%d)\n",
1036 			    conn->sess->FirstBurstLength,
1037 			    conn->sess->MaxBurstLength);
1038 		return -1;
1039 	}
1040 	if (conn->sess->FirstBurstLength > g_spdk_iscsi.FirstBurstLength) {
1041 		SPDK_ERRLOG("FirstBurstLength(%d) > iSCSI target restriction(%d)\n",
1042 			    conn->sess->FirstBurstLength, g_spdk_iscsi.FirstBurstLength);
1043 		return -1;
1044 	}
1045 	if (conn->sess->MaxBurstLength > 0x00ffffff) {
1046 		SPDK_ERRLOG("MaxBurstLength(%d) > 0x00ffffff\n",
1047 			    conn->sess->MaxBurstLength);
1048 		return -1;
1049 	}
1050 
1051 	if (conn->MaxRecvDataSegmentLength < 512) {
1052 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) < 512\n",
1053 			    conn->MaxRecvDataSegmentLength);
1054 		return -1;
1055 	}
1056 	if (conn->MaxRecvDataSegmentLength > 0x00ffffff) {
1057 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) > 0x00ffffff\n",
1058 			    conn->MaxRecvDataSegmentLength);
1059 		return -1;
1060 	}
1061 	return 0;
1062 }
1063 
1064 /*
1065  * The response function of spdk_iscsi_op_login
1066  * return:
1067  * 0:success;
1068  * -1:error;
1069  */
1070 static int
1071 spdk_iscsi_op_login_response(struct spdk_iscsi_conn *conn,
1072 			     struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param *params)
1073 {
1074 	struct iscsi_bhs_login_rsp *rsph;
1075 	int rc;
1076 
1077 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1078 	rsph->version_max = ISCSI_VERSION;
1079 	rsph->version_act = ISCSI_VERSION;
1080 	DSET24(rsph->data_segment_len, rsp_pdu->data_segment_len);
1081 
1082 	to_be32(&rsph->stat_sn, conn->StatSN);
1083 	conn->StatSN++;
1084 
1085 	if (conn->sess != NULL) {
1086 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
1087 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
1088 	} else {
1089 		to_be32(&rsph->exp_cmd_sn, rsp_pdu->cmd_sn);
1090 		to_be32(&rsph->max_cmd_sn, rsp_pdu->cmd_sn);
1091 	}
1092 
1093 	SPDK_LOGDUMP(SPDK_LOG_ISCSI, "PDU", (uint8_t *)rsph, ISCSI_BHS_LEN);
1094 	SPDK_LOGDUMP(SPDK_LOG_ISCSI, "DATA", rsp_pdu->data, rsp_pdu->data_segment_len);
1095 
1096 	/* Set T/CSG/NSG to reserved if login error. */
1097 	if (rsph->status_class != 0) {
1098 		rsph->flags &= ~ISCSI_LOGIN_TRANSIT;
1099 		rsph->flags &= ~ISCSI_LOGIN_CURRENT_STAGE_MASK;
1100 		rsph->flags &= ~ISCSI_LOGIN_NEXT_STAGE_MASK;
1101 	}
1102 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
1103 
1104 	/* after send PDU digest on/off */
1105 	if (conn->full_feature) {
1106 		/* update internal variables */
1107 		rc = spdk_iscsi_copy_param2var(conn);
1108 		if (rc < 0) {
1109 			SPDK_ERRLOG("spdk_iscsi_copy_param2var() failed\n");
1110 			spdk_iscsi_param_free(params);
1111 			return -1;
1112 		}
1113 		/* check value */
1114 		rc = spdk_iscsi_check_values(conn);
1115 		if (rc < 0) {
1116 			SPDK_ERRLOG("iscsi_check_values() failed\n");
1117 			spdk_iscsi_param_free(params);
1118 			return -1;
1119 		}
1120 	}
1121 
1122 	spdk_iscsi_param_free(params);
1123 	return 0;
1124 }
1125 
1126 /*
1127  * This function is used to del the original param and update it with new
1128  * value
1129  * return:
1130  * 0: success
1131  * otherwise: error
1132  */
1133 static int
1134 spdk_iscsi_op_login_update_param(struct spdk_iscsi_conn *conn,
1135 				 const char *key, const char *value,
1136 				 const char *list)
1137 {
1138 	int rc = 0;
1139 	struct iscsi_param *new_param, *orig_param;
1140 	int index;
1141 
1142 	orig_param = spdk_iscsi_param_find(conn->params, key);
1143 	if (orig_param == NULL) {
1144 		SPDK_ERRLOG("orig_param %s not found\n", key);
1145 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1146 	}
1147 
1148 	index = orig_param->state_index;
1149 	rc = spdk_iscsi_param_del(&conn->params, key);
1150 	if (rc < 0) {
1151 		SPDK_ERRLOG("iscsi_param_del(%s) failed\n", key);
1152 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1153 	}
1154 	rc = spdk_iscsi_param_add(&conn->params, key, value, list, ISPT_LIST);
1155 	if (rc < 0) {
1156 		SPDK_ERRLOG("iscsi_param_add() failed\n");
1157 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1158 	}
1159 	new_param = spdk_iscsi_param_find(conn->params, key);
1160 	if (new_param == NULL) {
1161 		SPDK_ERRLOG("spdk_iscsi_param_find() failed\n");
1162 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1163 	}
1164 	new_param->state_index = index;
1165 	return rc;
1166 }
1167 
1168 static int
1169 spdk_iscsi_negotiate_chap_param(struct spdk_iscsi_conn *conn, bool disable_chap,
1170 				bool require_chap, bool mutual_chap)
1171 {
1172 	int rc = 0;
1173 
1174 	if (disable_chap) {
1175 		conn->require_chap = false;
1176 		rc = spdk_iscsi_op_login_update_param(conn, "AuthMethod", "None", "None");
1177 		if (rc < 0) {
1178 			return rc;
1179 		}
1180 	} else if (require_chap) {
1181 		conn->require_chap = true;
1182 		rc = spdk_iscsi_op_login_update_param(conn, "AuthMethod", "CHAP", "CHAP");
1183 		if (rc < 0) {
1184 			return rc;
1185 		}
1186 	}
1187 	if (mutual_chap) {
1188 		conn->mutual_chap = true;
1189 	}
1190 
1191 	return rc;
1192 }
1193 
1194 /*
1195  * The function which is used to handle the part of session discovery
1196  * return:
1197  * 0, success;
1198  * otherwise: error;
1199  */
1200 static int
1201 spdk_iscsi_op_login_session_discovery_chap(struct spdk_iscsi_conn *conn)
1202 {
1203 	return spdk_iscsi_negotiate_chap_param(conn, g_spdk_iscsi.disable_chap,
1204 					       g_spdk_iscsi.require_chap,
1205 					       g_spdk_iscsi.mutual_chap);
1206 }
1207 
1208 /*
1209  * This function is used to update the param related with chap
1210  * return:
1211  * 0: success
1212  * otherwise: error
1213  */
1214 static int
1215 spdk_iscsi_op_login_negotiate_chap_param(struct spdk_iscsi_conn *conn,
1216 		struct spdk_iscsi_tgt_node *target)
1217 {
1218 	return spdk_iscsi_negotiate_chap_param(conn, target->disable_chap,
1219 					       target->require_chap,
1220 					       target->mutual_chap);
1221 }
1222 
1223 static int
1224 spdk_iscsi_op_login_negotiate_digest_param(struct spdk_iscsi_conn *conn,
1225 		struct spdk_iscsi_tgt_node *target)
1226 {
1227 	int rc;
1228 
1229 	if (target->header_digest) {
1230 		/*
1231 		 * User specified header digests, so update the list of
1232 		 *  HeaderDigest values to remove "None" so that only
1233 		 *  initiators who support CRC32C can connect.
1234 		 */
1235 		rc = spdk_iscsi_op_login_update_param(conn, "HeaderDigest", "CRC32C", "CRC32C");
1236 		if (rc < 0) {
1237 			return rc;
1238 		}
1239 	}
1240 
1241 	if (target->data_digest) {
1242 		/*
1243 		 * User specified data digests, so update the list of
1244 		 *  DataDigest values to remove "None" so that only
1245 		 *  initiators who support CRC32C can connect.
1246 		 */
1247 		rc = spdk_iscsi_op_login_update_param(conn, "DataDigest", "CRC32C", "CRC32C");
1248 		if (rc < 0) {
1249 			return rc;
1250 		}
1251 	}
1252 
1253 	return 0;
1254 }
1255 
1256 /*
1257  * This function use to check the session
1258  * return:
1259  * 0, success
1260  * otherwise: error
1261  */
1262 static int
1263 spdk_iscsi_op_login_check_session(struct spdk_iscsi_conn *conn,
1264 				  struct spdk_iscsi_pdu *rsp_pdu,
1265 				  char *initiator_port_name, int cid)
1266 
1267 {
1268 	int rc = 0;
1269 	struct iscsi_bhs_login_rsp *rsph;
1270 
1271 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1272 	/* check existing session */
1273 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "isid=%"PRIx64", tsih=%u, cid=%u\n",
1274 		      spdk_iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih), cid);
1275 	if (rsph->tsih != 0) {
1276 		/* multiple connections */
1277 		rc = spdk_append_iscsi_sess(conn, initiator_port_name,
1278 					    from_be16(&rsph->tsih), cid);
1279 		if (rc < 0) {
1280 			SPDK_ERRLOG("isid=%"PRIx64", tsih=%u, cid=%u:"
1281 				    "spdk_append_iscsi_sess() failed\n",
1282 				    spdk_iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih),
1283 				    cid);
1284 			/* Can't include in session */
1285 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1286 			rsph->status_detail = ISCSI_LOGIN_CONN_ADD_FAIL;
1287 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1288 		}
1289 	} else if (!g_spdk_iscsi.AllowDuplicateIsid) {
1290 		/* new session, drop old sess by the initiator */
1291 		spdk_iscsi_drop_conns(conn, initiator_port_name, 0 /* drop old */);
1292 	}
1293 
1294 	return rc;
1295 }
1296 
1297 /*
1298  * This function is used to check the target info
1299  * return:
1300  * 0: success
1301  * otherwise: error
1302  */
1303 static int
1304 spdk_iscsi_op_login_check_target(struct spdk_iscsi_conn *conn,
1305 				 struct spdk_iscsi_pdu *rsp_pdu,
1306 				 const char *target_name,
1307 				 struct spdk_iscsi_tgt_node **target)
1308 {
1309 	bool result;
1310 	struct iscsi_bhs_login_rsp *rsph;
1311 
1312 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1313 	*target = spdk_iscsi_find_tgt_node(target_name);
1314 	if (*target == NULL) {
1315 		SPDK_WARNLOG("target %s not found\n", target_name);
1316 		/* Not found */
1317 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1318 		rsph->status_detail = ISCSI_LOGIN_TARGET_NOT_FOUND;
1319 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1320 	}
1321 	result = spdk_iscsi_tgt_node_access(conn, *target,
1322 					    conn->initiator_name,
1323 					    conn->initiator_addr);
1324 	if (!result) {
1325 		SPDK_ERRLOG("access denied\n");
1326 		/* Not found */
1327 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1328 		rsph->status_detail = ISCSI_LOGIN_TARGET_NOT_FOUND;
1329 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1330 	}
1331 
1332 	return 0;
1333 }
1334 
1335 /*
1336  * The function which is used to handle the part of normal login session
1337  * return:
1338  * 0, success;
1339  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1340  */
1341 static int
1342 spdk_iscsi_op_login_session_normal(struct spdk_iscsi_conn *conn,
1343 				   struct spdk_iscsi_pdu *rsp_pdu,
1344 				   char *initiator_port_name,
1345 				   struct iscsi_param *params,
1346 				   struct spdk_iscsi_tgt_node **target,
1347 				   int cid)
1348 {
1349 	const char *target_name;
1350 	const char *target_short_name;
1351 	struct iscsi_bhs_login_rsp *rsph;
1352 	int rc = 0;
1353 
1354 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1355 	target_name = spdk_iscsi_param_get_val(params, "TargetName");
1356 
1357 	if (target_name == NULL) {
1358 		SPDK_ERRLOG("TargetName is empty\n");
1359 		/* Missing parameter */
1360 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1361 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1362 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1363 	}
1364 
1365 	memset(conn->target_short_name, 0, MAX_TARGET_NAME);
1366 	target_short_name = strstr(target_name, ":");
1367 	if (target_short_name != NULL) {
1368 		target_short_name++; /* Advance past the ':' */
1369 		if (strlen(target_short_name) >= MAX_TARGET_NAME) {
1370 			SPDK_ERRLOG("Target Short Name (%s) is more than %u characters\n",
1371 				    target_short_name, MAX_TARGET_NAME);
1372 			return rc;
1373 		}
1374 		snprintf(conn->target_short_name, MAX_TARGET_NAME, "%s",
1375 			 target_short_name);
1376 	}
1377 
1378 	pthread_mutex_lock(&g_spdk_iscsi.mutex);
1379 	rc = spdk_iscsi_op_login_check_target(conn, rsp_pdu, target_name, target);
1380 	pthread_mutex_unlock(&g_spdk_iscsi.mutex);
1381 
1382 	if (rc < 0) {
1383 		return rc;
1384 	}
1385 
1386 	conn->target = *target;
1387 	conn->dev = (*target)->dev;
1388 	conn->target_port = spdk_scsi_dev_find_port_by_id((*target)->dev,
1389 			    conn->portal->group->tag);
1390 
1391 	rc = spdk_iscsi_op_login_check_session(conn, rsp_pdu,
1392 					       initiator_port_name, cid);
1393 	if (rc < 0) {
1394 		return rc;
1395 	}
1396 
1397 	/* force target flags */
1398 	pthread_mutex_lock(&((*target)->mutex));
1399 	rc = spdk_iscsi_op_login_negotiate_chap_param(conn, *target);
1400 	pthread_mutex_unlock(&((*target)->mutex));
1401 
1402 	if (rc != 0) {
1403 		return rc;
1404 	}
1405 
1406 	return spdk_iscsi_op_login_negotiate_digest_param(conn, *target);
1407 }
1408 
1409 /*
1410  * This function is used to judge the session type
1411  * return
1412  * 0: success
1413  * otherwise, error
1414  */
1415 static int
1416 spdk_iscsi_op_login_session_type(struct spdk_iscsi_conn *conn,
1417 				 struct spdk_iscsi_pdu *rsp_pdu,
1418 				 enum session_type *session_type,
1419 				 struct iscsi_param *params)
1420 {
1421 	const char *session_type_str;
1422 	struct iscsi_bhs_login_rsp *rsph;
1423 
1424 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1425 	session_type_str = spdk_iscsi_param_get_val(params, "SessionType");
1426 	if (session_type_str == NULL) {
1427 		if (rsph->tsih != 0) {
1428 			*session_type = SESSION_TYPE_NORMAL;
1429 		} else {
1430 			SPDK_ERRLOG("SessionType is empty\n");
1431 			/* Missing parameter */
1432 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1433 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1434 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1435 		}
1436 	} else {
1437 		if (strcasecmp(session_type_str, "Discovery") == 0) {
1438 			*session_type = SESSION_TYPE_DISCOVERY;
1439 		} else if (strcasecmp(session_type_str, "Normal") == 0) {
1440 			*session_type = SESSION_TYPE_NORMAL;
1441 		} else {
1442 			*session_type = SESSION_TYPE_INVALID;
1443 			SPDK_ERRLOG("SessionType is invalid\n");
1444 			/* Missing parameter */
1445 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1446 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1447 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1448 		}
1449 	}
1450 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Session Type: %s\n", session_type_str);
1451 
1452 	return 0;
1453 }
1454 /*
1455  * This function is used to initialize the port info
1456  * return
1457  * 0: success
1458  * otherwise: error
1459  */
1460 static int
1461 spdk_iscsi_op_login_initialize_port(struct spdk_iscsi_conn *conn,
1462 				    struct spdk_iscsi_pdu *rsp_pdu,
1463 				    char *initiator_port_name,
1464 				    uint32_t name_length,
1465 				    struct iscsi_param *params)
1466 {
1467 	const char *val;
1468 	struct iscsi_bhs_login_rsp *rsph;
1469 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1470 
1471 	/* Initiator Name and Port */
1472 	val = spdk_iscsi_param_get_val(params, "InitiatorName");
1473 	if (val == NULL) {
1474 		SPDK_ERRLOG("InitiatorName is empty\n");
1475 		/* Missing parameter */
1476 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1477 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1478 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1479 	}
1480 	snprintf(conn->initiator_name, sizeof(conn->initiator_name), "%s", val);
1481 	snprintf(initiator_port_name, name_length,
1482 		 "%s,i,0x%12.12" PRIx64, val, spdk_iscsi_get_isid(rsph->isid));
1483 	spdk_strlwr(conn->initiator_name);
1484 	spdk_strlwr(initiator_port_name);
1485 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Initiator name: %s\n", conn->initiator_name);
1486 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Initiator port: %s\n", initiator_port_name);
1487 
1488 	return 0;
1489 }
1490 
1491 /*
1492  * This function is used to set the info in the connection data structure
1493  * return
1494  * 0: success
1495  * otherwise: error
1496  */
1497 static int
1498 spdk_iscsi_op_login_set_conn_info(struct spdk_iscsi_conn *conn,
1499 				  struct spdk_iscsi_pdu *rsp_pdu,
1500 				  char *initiator_port_name,
1501 				  enum session_type session_type,
1502 				  struct spdk_iscsi_tgt_node *target, int cid)
1503 {
1504 	int rc = 0;
1505 	struct iscsi_bhs_login_rsp *rsph;
1506 
1507 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1508 	conn->authenticated = false;
1509 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1510 	conn->cid = cid;
1511 
1512 	if (conn->sess == NULL) {
1513 		/* new session */
1514 		rc = spdk_create_iscsi_sess(conn, target, session_type);
1515 		if (rc < 0) {
1516 			SPDK_ERRLOG("create_sess() failed\n");
1517 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1518 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1519 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1520 		}
1521 
1522 		/* initialize parameters */
1523 		conn->StatSN = from_be32(&rsph->stat_sn);
1524 		conn->sess->initiator_port = spdk_scsi_port_create(spdk_iscsi_get_isid(rsph->isid),
1525 					     0, initiator_port_name);
1526 		conn->sess->isid = spdk_iscsi_get_isid(rsph->isid);
1527 		conn->sess->target = target;
1528 		/* Initiator port TransportID */
1529 		spdk_scsi_port_set_iscsi_transport_id(conn->sess->initiator_port,
1530 						      conn->initiator_name,
1531 						      conn->sess->isid);
1532 
1533 		/* Discovery sessions will not have a target. */
1534 		if (target != NULL) {
1535 			conn->sess->queue_depth = target->queue_depth;
1536 		} else {
1537 			/*
1538 			 * Assume discovery sessions have an effective command
1539 			 *  windows size of 1.
1540 			 */
1541 			conn->sess->queue_depth = 1;
1542 		}
1543 		conn->sess->ExpCmdSN = rsp_pdu->cmd_sn;
1544 		conn->sess->MaxCmdSN = rsp_pdu->cmd_sn + conn->sess->queue_depth - 1;
1545 	}
1546 
1547 	conn->initiator_port = conn->sess->initiator_port;
1548 
1549 	return 0;
1550 }
1551 
1552 /*
1553  * This function is used to set the target info
1554  * return
1555  * 0: success
1556  * otherwise: error
1557  */
1558 static int
1559 spdk_iscsi_op_login_set_target_info(struct spdk_iscsi_conn *conn,
1560 				    struct spdk_iscsi_pdu *rsp_pdu,
1561 				    enum session_type session_type,
1562 				    int alloc_len,
1563 				    struct spdk_iscsi_tgt_node *target)
1564 {
1565 	char buf[MAX_TMPBUF];
1566 	const char *val;
1567 	int rc = 0;
1568 	struct spdk_iscsi_portal *portal = conn->portal;
1569 
1570 	/* declarative parameters */
1571 	if (target != NULL) {
1572 		pthread_mutex_lock(&target->mutex);
1573 		if (target->alias != NULL) {
1574 			snprintf(buf, sizeof buf, "%s", target->alias);
1575 		} else {
1576 			snprintf(buf, sizeof buf, "%s", "");
1577 		}
1578 		pthread_mutex_unlock(&target->mutex);
1579 		rc = spdk_iscsi_param_set(conn->sess->params, "TargetAlias", buf);
1580 		if (rc < 0) {
1581 			SPDK_ERRLOG("iscsi_param_set() failed\n");
1582 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1583 		}
1584 	}
1585 	snprintf(buf, sizeof buf, "%s:%s,%d", portal->host, portal->port,
1586 		 portal->group->tag);
1587 	rc = spdk_iscsi_param_set(conn->sess->params, "TargetAddress", buf);
1588 	if (rc < 0) {
1589 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1590 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1591 	}
1592 	snprintf(buf, sizeof buf, "%d", portal->group->tag);
1593 	rc = spdk_iscsi_param_set(conn->sess->params, "TargetPortalGroupTag", buf);
1594 	if (rc < 0) {
1595 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1596 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1597 	}
1598 
1599 	/* write in response */
1600 	if (target != NULL) {
1601 		val = spdk_iscsi_param_get_val(conn->sess->params, "TargetAlias");
1602 		if (val != NULL && strlen(val) != 0) {
1603 			rsp_pdu->data_segment_len = spdk_iscsi_append_param(conn,
1604 						    "TargetAlias",
1605 						    rsp_pdu->data,
1606 						    alloc_len,
1607 						    rsp_pdu->data_segment_len);
1608 		}
1609 		if (session_type == SESSION_TYPE_DISCOVERY) {
1610 			rsp_pdu->data_segment_len = spdk_iscsi_append_param(conn,
1611 						    "TargetAddress",
1612 						    rsp_pdu->data,
1613 						    alloc_len,
1614 						    rsp_pdu->data_segment_len);
1615 		}
1616 		rsp_pdu->data_segment_len = spdk_iscsi_append_param(conn,
1617 					    "TargetPortalGroupTag",
1618 					    rsp_pdu->data,
1619 					    alloc_len,
1620 					    rsp_pdu->data_segment_len);
1621 	}
1622 
1623 	return rc;
1624 }
1625 
1626 /*
1627  * This function is used to handle the login of iscsi initiator when there is
1628  * no session
1629  * return:
1630  * 0, success;
1631  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1632  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify the login fail.
1633  */
1634 static int
1635 spdk_iscsi_op_login_phase_none(struct spdk_iscsi_conn *conn,
1636 			       struct spdk_iscsi_pdu *rsp_pdu,
1637 			       struct iscsi_param *params,
1638 			       int alloc_len, int cid)
1639 {
1640 	enum session_type session_type;
1641 	char initiator_port_name[MAX_INITIATOR_PORT_NAME];
1642 	struct iscsi_bhs_login_rsp *rsph;
1643 	struct spdk_iscsi_tgt_node *target = NULL;
1644 	int rc = 0;
1645 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1646 
1647 	conn->target = NULL;
1648 	conn->dev = NULL;
1649 
1650 	rc = spdk_iscsi_op_login_initialize_port(conn, rsp_pdu,
1651 			initiator_port_name, MAX_INITIATOR_PORT_NAME, params);
1652 	if (rc < 0) {
1653 		return rc;
1654 	}
1655 
1656 	rc = spdk_iscsi_op_login_session_type(conn, rsp_pdu, &session_type,
1657 					      params);
1658 	if (rc < 0) {
1659 		return rc;
1660 	}
1661 
1662 	/* Target Name and Port */
1663 	if (session_type == SESSION_TYPE_NORMAL) {
1664 		rc = spdk_iscsi_op_login_session_normal(conn, rsp_pdu,
1665 							initiator_port_name,
1666 							params, &target, cid);
1667 		if (rc < 0) {
1668 			return rc;
1669 		}
1670 
1671 	} else if (session_type == SESSION_TYPE_DISCOVERY) {
1672 		target = NULL;
1673 		rsph->tsih = 0;
1674 
1675 		/* force target flags */
1676 		pthread_mutex_lock(&g_spdk_iscsi.mutex);
1677 		rc = spdk_iscsi_op_login_session_discovery_chap(conn);
1678 		pthread_mutex_unlock(&g_spdk_iscsi.mutex);
1679 		if (rc < 0) {
1680 			return rc;
1681 		}
1682 	} else {
1683 		SPDK_ERRLOG("unknown session type\n");
1684 		/* Missing parameter */
1685 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1686 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1687 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1688 	}
1689 
1690 	rc = spdk_iscsi_op_login_set_conn_info(conn, rsp_pdu, initiator_port_name,
1691 					       session_type, target, cid);
1692 	if (rc < 0) {
1693 		return rc;
1694 	}
1695 
1696 	/* limit conns on discovery session */
1697 	if (session_type == SESSION_TYPE_DISCOVERY) {
1698 		conn->sess->MaxConnections = 1;
1699 		rc = spdk_iscsi_param_set_int(conn->sess->params,
1700 					      "MaxConnections",
1701 					      conn->sess->MaxConnections);
1702 		if (rc < 0) {
1703 			SPDK_ERRLOG("iscsi_param_set_int() failed\n");
1704 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1705 		}
1706 	}
1707 
1708 	return spdk_iscsi_op_login_set_target_info(conn, rsp_pdu, session_type,
1709 			alloc_len, target);
1710 }
1711 
1712 /*
1713  * The function which is used to initialize the internal response data
1714  * structure of iscsi login function.
1715  * return:
1716  * 0, success;
1717  * otherwise, error;
1718  */
1719 static int
1720 spdk_iscsi_op_login_rsp_init(struct spdk_iscsi_conn *conn,
1721 			     struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu,
1722 			     struct iscsi_param **params, int *alloc_len, int *cid)
1723 {
1724 
1725 	struct iscsi_bhs_login_req *reqh;
1726 	struct iscsi_bhs_login_rsp *rsph;
1727 	int rc;
1728 
1729 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1730 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
1731 	rsph->status_class = ISCSI_CLASS_SUCCESS;
1732 	rsph->status_detail = ISCSI_LOGIN_ACCEPT;
1733 	rsp_pdu->data_segment_len = 0;
1734 
1735 	/* Default MaxRecvDataSegmentLength - RFC3720(12.12) */
1736 	if (conn->MaxRecvDataSegmentLength < 8192) {
1737 		*alloc_len = 8192;
1738 	} else {
1739 		*alloc_len = conn->MaxRecvDataSegmentLength;
1740 	}
1741 
1742 	rsp_pdu->data = calloc(1, *alloc_len);
1743 	if (!rsp_pdu->data) {
1744 		SPDK_ERRLOG("calloc() failed for data segment\n");
1745 		return -ENOMEM;
1746 	}
1747 
1748 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1749 	rsph->flags |= (reqh->flags & ISCSI_LOGIN_TRANSIT);
1750 	rsph->flags |= (reqh->flags & ISCSI_LOGIN_CONTINUE);
1751 	rsph->flags |= (reqh->flags & ISCSI_LOGIN_CURRENT_STAGE_MASK);
1752 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1753 		rsph->flags |= (reqh->flags & ISCSI_LOGIN_NEXT_STAGE_MASK);
1754 	}
1755 
1756 	/* We don't need to convert from network byte order. Just store it */
1757 	memcpy(&rsph->isid, reqh->isid, 6);
1758 	rsph->tsih = reqh->tsih;
1759 	rsph->itt = reqh->itt;
1760 	rsp_pdu->cmd_sn = from_be32(&reqh->cmd_sn);
1761 	*cid = from_be16(&reqh->cid);
1762 
1763 	if (rsph->tsih) {
1764 		rsph->stat_sn = reqh->exp_stat_sn;
1765 	}
1766 
1767 	SPDK_LOGDUMP(SPDK_LOG_ISCSI, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
1768 
1769 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI,
1770 		      "T=%d, C=%d, CSG=%d, NSG=%d, Min=%d, Max=%d, ITT=%x\n",
1771 		      ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags),
1772 		      ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags),
1773 		      ISCSI_BHS_LOGIN_GET_CSG(rsph->flags),
1774 		      ISCSI_BHS_LOGIN_GET_NSG(rsph->flags),
1775 		      reqh->version_min, reqh->version_max, from_be32(&rsph->itt));
1776 
1777 	if (conn->sess != NULL) {
1778 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI,
1779 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u,"
1780 			      "MaxCmdSN=%u\n", rsp_pdu->cmd_sn,
1781 			      from_be32(&rsph->stat_sn), conn->StatSN,
1782 			      conn->sess->ExpCmdSN,
1783 			      conn->sess->MaxCmdSN);
1784 	} else {
1785 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI,
1786 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
1787 			      rsp_pdu->cmd_sn, from_be32(&rsph->stat_sn),
1788 			      conn->StatSN);
1789 	}
1790 
1791 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags) &&
1792 	    ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags)) {
1793 		SPDK_ERRLOG("transit error\n");
1794 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1795 	}
1796 	/* make sure reqh->version_max < ISCSI_VERSION */
1797 	if (reqh->version_min > ISCSI_VERSION) {
1798 		SPDK_ERRLOG("unsupported version %d/%d\n", reqh->version_min,
1799 			    reqh->version_max);
1800 		/* Unsupported version */
1801 		/* set all reserved flag to zero */
1802 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1803 		rsph->status_detail = ISCSI_LOGIN_UNSUPPORTED_VERSION;
1804 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1805 	}
1806 
1807 	if ((ISCSI_BHS_LOGIN_GET_NSG(rsph->flags) == ISCSI_NSG_RESERVED_CODE) &&
1808 	    ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1809 		/* set NSG to zero */
1810 		rsph->flags &= ~ISCSI_LOGIN_NEXT_STAGE_MASK;
1811 		/* also set other bits to zero */
1812 		rsph->flags &= ~ISCSI_LOGIN_TRANSIT;
1813 		rsph->flags &= ~ISCSI_LOGIN_CURRENT_STAGE_MASK;
1814 		SPDK_ERRLOG("Received reserved NSG code: %d\n", ISCSI_NSG_RESERVED_CODE);
1815 		/* Initiator error */
1816 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1817 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1818 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1819 	}
1820 
1821 	/* store incoming parameters */
1822 	rc = spdk_iscsi_parse_params(params, pdu->data,
1823 				     pdu->data_segment_len, ISCSI_BHS_LOGIN_GET_CBIT(reqh->flags),
1824 				     &conn->partial_text_parameter);
1825 	if (rc < 0) {
1826 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
1827 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1828 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1829 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1830 	}
1831 	return 0;
1832 }
1833 
1834 /*
1835  * This function is used to set the csg bit case in rsp
1836  * return:
1837  * 0, success
1838  * otherwise: error
1839  */
1840 static int
1841 spdk_iscsi_op_login_rsp_handle_csg_bit(struct spdk_iscsi_conn *conn,
1842 				       struct spdk_iscsi_pdu *rsp_pdu,
1843 				       struct iscsi_param *params, int alloc_len)
1844 {
1845 	const char *auth_method;
1846 	int rc;
1847 	struct iscsi_bhs_login_rsp *rsph;
1848 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1849 
1850 	switch (ISCSI_BHS_LOGIN_GET_CSG(rsph->flags)) {
1851 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
1852 		/* SecurityNegotiation */
1853 		auth_method = spdk_iscsi_param_get_val(conn->params, "AuthMethod");
1854 		if (auth_method == NULL) {
1855 			SPDK_ERRLOG("AuthMethod is empty\n");
1856 			/* Missing parameter */
1857 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1858 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1859 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1860 		}
1861 		if (strcasecmp(auth_method, "None") == 0) {
1862 			conn->authenticated = true;
1863 		} else {
1864 			rc = spdk_iscsi_auth_params(conn, params, auth_method,
1865 						    rsp_pdu->data, alloc_len,
1866 						    rsp_pdu->data_segment_len);
1867 			if (rc < 0) {
1868 				SPDK_ERRLOG("iscsi_auth_params() failed\n");
1869 				/* Authentication failure */
1870 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1871 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1872 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1873 			}
1874 			rsp_pdu->data_segment_len = rc;
1875 			if (!conn->authenticated) {
1876 				/* not complete */
1877 				rsph->flags &= ~ISCSI_LOGIN_TRANSIT;
1878 			} else {
1879 				if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_END) {
1880 					SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "CHAP phase not complete");
1881 				}
1882 			}
1883 
1884 			SPDK_LOGDUMP(SPDK_LOG_ISCSI, "Negotiated Auth Params",
1885 				     rsp_pdu->data, rsp_pdu->data_segment_len);
1886 		}
1887 		break;
1888 
1889 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
1890 		/* LoginOperationalNegotiation */
1891 		if (conn->state == ISCSI_CONN_STATE_INVALID) {
1892 			if (conn->require_chap) {
1893 				/* Authentication failure */
1894 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1895 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1896 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1897 			} else {
1898 				/* AuthMethod=None */
1899 				conn->authenticated = true;
1900 			}
1901 		}
1902 		if (!conn->authenticated) {
1903 			SPDK_ERRLOG("authentication error\n");
1904 			/* Authentication failure */
1905 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1906 			rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1907 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1908 		}
1909 		break;
1910 
1911 	case ISCSI_FULL_FEATURE_PHASE:
1912 		/* FullFeaturePhase */
1913 		SPDK_ERRLOG("XXX Login in FullFeaturePhase\n");
1914 		/* Initiator error */
1915 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1916 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1917 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1918 
1919 	default:
1920 		SPDK_ERRLOG("unknown stage\n");
1921 		/* Initiator error */
1922 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1923 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1924 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1925 	}
1926 
1927 	return 0;
1928 }
1929 
1930 /* This function is used to notify the session info
1931  * return
1932  * 0: success
1933  * otherwise: error
1934  */
1935 static int
1936 spdk_iscsi_op_login_notify_session_info(struct spdk_iscsi_conn *conn,
1937 					struct spdk_iscsi_pdu *rsp_pdu)
1938 {
1939 	struct iscsi_bhs_login_rsp *rsph;
1940 
1941 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1942 	if (conn->sess->session_type == SESSION_TYPE_NORMAL) {
1943 		/* normal session */
1944 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Login from %s (%s) on %s tgt_node%d"
1945 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
1946 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
1947 			      conn->initiator_name, conn->initiator_addr,
1948 			      conn->target->name, conn->target->num,
1949 			      conn->portal->host, conn->portal->port, conn->portal->group->tag,
1950 			      conn->sess->isid, conn->sess->tsih, conn->cid,
1951 			      (spdk_iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
1952 			       ? "on" : "off"),
1953 			      (spdk_iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
1954 			       ? "on" : "off"));
1955 	} else if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
1956 		/* discovery session */
1957 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Login(discovery) from %s (%s) on"
1958 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
1959 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
1960 			      conn->initiator_name, conn->initiator_addr,
1961 			      conn->portal->host, conn->portal->port, conn->portal->group->tag,
1962 			      conn->sess->isid, conn->sess->tsih, conn->cid,
1963 			      (spdk_iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
1964 			       ? "on" : "off"),
1965 			      (spdk_iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
1966 			       ? "on" : "off"));
1967 	} else {
1968 		SPDK_ERRLOG("unknown session type\n");
1969 		/* Initiator error */
1970 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1971 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1972 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1973 	}
1974 
1975 	return 0;
1976 }
1977 
1978 /*
1979  * This function is to handle the tbit cases
1980  * return
1981  * 0: success
1982  * otherwise error
1983  */
1984 static int
1985 spdk_iscsi_op_login_rsp_handle_t_bit(struct spdk_iscsi_conn *conn,
1986 				     struct spdk_iscsi_pdu *rsp_pdu)
1987 {
1988 	int rc;
1989 	struct iscsi_bhs_login_rsp *rsph;
1990 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1991 
1992 	switch (ISCSI_BHS_LOGIN_GET_NSG(rsph->flags)) {
1993 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
1994 		/* SecurityNegotiation */
1995 		conn->login_phase = ISCSI_SECURITY_NEGOTIATION_PHASE;
1996 		break;
1997 
1998 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
1999 		/* LoginOperationalNegotiation */
2000 		conn->login_phase = ISCSI_OPERATIONAL_NEGOTIATION_PHASE;
2001 		break;
2002 
2003 	case ISCSI_FULL_FEATURE_PHASE:
2004 		/* FullFeaturePhase */
2005 		conn->login_phase = ISCSI_FULL_FEATURE_PHASE;
2006 		to_be16(&rsph->tsih, conn->sess->tsih);
2007 
2008 		rc = spdk_iscsi_op_login_notify_session_info(conn, rsp_pdu);
2009 		if (rc < 0) {
2010 			return rc;
2011 		}
2012 
2013 		conn->full_feature = 1;
2014 		spdk_iscsi_conn_migration(conn);
2015 		break;
2016 
2017 	default:
2018 		SPDK_ERRLOG("unknown stage\n");
2019 		/* Initiator error */
2020 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2021 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2022 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2023 	}
2024 
2025 	return 0;
2026 }
2027 
2028 /*
2029  * This function is used to set the values of the internal data structure used
2030  * by spdk_iscsi_op_login function
2031  * return:
2032  * 0, used to notify the a successful login
2033  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify a failure login.
2034  */
2035 static int
2036 spdk_iscsi_op_login_rsp_handle(struct spdk_iscsi_conn *conn,
2037 			       struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param **params,
2038 			       int alloc_len)
2039 {
2040 	int rc;
2041 	struct iscsi_bhs_login_rsp *rsph;
2042 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2043 
2044 	/* negotiate parameters */
2045 	rc = spdk_iscsi_negotiate_params(conn, params, rsp_pdu->data, alloc_len,
2046 					 rsp_pdu->data_segment_len);
2047 	if (rc < 0) {
2048 		/*
2049 		 * spdk_iscsi_negotiate_params just returns -1 on failure,
2050 		 *  so translate this into meaningful response codes and
2051 		 *  return values.
2052 		 */
2053 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2054 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2055 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2056 	}
2057 
2058 	rsp_pdu->data_segment_len = rc;
2059 	SPDK_LOGDUMP(SPDK_LOG_ISCSI, "Negotiated Params", rsp_pdu->data, rc);
2060 
2061 	/* handle the CSG bit case */
2062 	rc = spdk_iscsi_op_login_rsp_handle_csg_bit(conn, rsp_pdu, *params,
2063 			alloc_len);
2064 	if (rc < 0) {
2065 		return rc;
2066 	}
2067 
2068 	/* handle the T bit case */
2069 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
2070 		rc = spdk_iscsi_op_login_rsp_handle_t_bit(conn, rsp_pdu);
2071 	}
2072 
2073 	return rc;
2074 }
2075 
2076 static int
2077 spdk_iscsi_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2078 {
2079 	int rc;
2080 	struct spdk_iscsi_pdu *rsp_pdu;
2081 	struct iscsi_param *params = NULL;
2082 	struct iscsi_param **params_p = &params;
2083 	int alloc_len;
2084 	int cid;
2085 
2086 	if (conn->full_feature && conn->sess != NULL &&
2087 	    conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2088 		return SPDK_ISCSI_CONNECTION_FATAL;
2089 	}
2090 
2091 	rsp_pdu = spdk_get_pdu();
2092 	if (rsp_pdu == NULL) {
2093 		return SPDK_ISCSI_CONNECTION_FATAL;
2094 	}
2095 	rc = spdk_iscsi_op_login_rsp_init(conn, pdu, rsp_pdu, params_p,
2096 					  &alloc_len, &cid);
2097 	if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE || rc == SPDK_ISCSI_LOGIN_ERROR_PARAMETER) {
2098 		spdk_iscsi_op_login_response(conn, rsp_pdu, *params_p);
2099 		return rc;
2100 	}
2101 
2102 	/* For other values, we need to directly return */
2103 	if (rc < 0) {
2104 		spdk_put_pdu(rsp_pdu);
2105 		return rc;
2106 	}
2107 
2108 	if (conn->state == ISCSI_CONN_STATE_INVALID) {
2109 		rc = spdk_iscsi_op_login_phase_none(conn, rsp_pdu, *params_p,
2110 						    alloc_len, cid);
2111 		if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE || rc == SPDK_ISCSI_LOGIN_ERROR_PARAMETER) {
2112 			spdk_iscsi_op_login_response(conn, rsp_pdu, *params_p);
2113 			return rc;
2114 		}
2115 	}
2116 
2117 	rc = spdk_iscsi_op_login_rsp_handle(conn, rsp_pdu, params_p, alloc_len);
2118 	if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE) {
2119 		spdk_iscsi_op_login_response(conn, rsp_pdu, *params_p);
2120 		return rc;
2121 	}
2122 
2123 	rc = spdk_iscsi_op_login_response(conn, rsp_pdu, *params_p);
2124 	if (rc == 0) {
2125 		conn->state = ISCSI_CONN_STATE_RUNNING;
2126 	} else {
2127 		SPDK_ERRLOG("login error - connection will be destroyed\n");
2128 	}
2129 
2130 	return rc;
2131 }
2132 
2133 static int
2134 spdk_iscsi_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2135 {
2136 	struct iscsi_param *params = NULL;
2137 	struct iscsi_param **params_p = &params;
2138 	struct spdk_iscsi_pdu *rsp_pdu;
2139 	uint8_t *data;
2140 	uint64_t lun;
2141 	uint32_t task_tag;
2142 	uint32_t CmdSN;
2143 	uint32_t ExpStatSN;
2144 	const char *val;
2145 	int F_bit, C_bit;
2146 	int data_len;
2147 	int alloc_len;
2148 	int rc;
2149 	struct iscsi_bhs_text_req *reqh;
2150 	struct iscsi_bhs_text_resp *rsph;
2151 
2152 	data_len = 0;
2153 	alloc_len = conn->MaxRecvDataSegmentLength;
2154 
2155 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2156 
2157 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2158 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2159 	lun = from_be64(&reqh->lun);
2160 	task_tag = from_be32(&reqh->itt);
2161 	CmdSN = from_be32(&reqh->cmd_sn);
2162 	pdu->cmd_sn = CmdSN;
2163 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2164 
2165 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "I=%d, F=%d, C=%d, ITT=%x, TTT=%x\n",
2166 		      reqh->immediate, F_bit, C_bit, task_tag, from_be32(&reqh->ttt));
2167 
2168 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI,
2169 		      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2170 		      CmdSN, ExpStatSN, conn->StatSN, conn->sess->ExpCmdSN,
2171 		      conn->sess->MaxCmdSN);
2172 
2173 	if (ExpStatSN != conn->StatSN) {
2174 #if 0
2175 		SPDK_ERRLOG("StatSN(%u) error\n", ExpStatSN);
2176 		return -1;
2177 #else
2178 		/* StarPort have a bug */
2179 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "StatSN(%u) rewound\n", ExpStatSN);
2180 		conn->StatSN = ExpStatSN;
2181 #endif
2182 	}
2183 
2184 	if (F_bit && C_bit) {
2185 		SPDK_ERRLOG("final and continue\n");
2186 		return -1;
2187 	}
2188 
2189 	/*
2190 	 * If this is the first text op in a sequence, save the ITT so we can
2191 	 * compare it against the ITT for subsequent ops in the same sequence.
2192 	 * If a subsequent text op in same sequence has a different ITT, reject
2193 	 * that PDU.
2194 	 */
2195 	if (conn->sess->current_text_itt == 0xffffffffU) {
2196 		conn->sess->current_text_itt = task_tag;
2197 	} else if (conn->sess->current_text_itt != task_tag) {
2198 		SPDK_ERRLOG("The correct itt is %u, and the current itt is %u...\n",
2199 			    conn->sess->current_text_itt, task_tag);
2200 		return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2201 	}
2202 
2203 	/* store incoming parameters */
2204 	rc = spdk_iscsi_parse_params(&params, pdu->data, pdu->data_segment_len,
2205 				     C_bit, &conn->partial_text_parameter);
2206 	if (rc < 0) {
2207 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
2208 		spdk_iscsi_param_free(params);
2209 		return -1;
2210 	}
2211 
2212 	data = calloc(1, alloc_len);
2213 	if (!data) {
2214 		SPDK_ERRLOG("calloc() failed for data segment\n");
2215 		spdk_iscsi_param_free(params);
2216 		return -ENOMEM;
2217 	}
2218 
2219 	/* negotiate parameters */
2220 	data_len = spdk_iscsi_negotiate_params(conn, params_p,
2221 					       data, alloc_len, data_len);
2222 	if (data_len < 0) {
2223 		SPDK_ERRLOG("spdk_iscsi_negotiate_params() failed\n");
2224 		spdk_iscsi_param_free(*params_p);
2225 		free(data);
2226 		return -1;
2227 	}
2228 
2229 	/* sendtargets is special case */
2230 	val = spdk_iscsi_param_get_val(*params_p, "SendTargets");
2231 	if (val != NULL) {
2232 		if (spdk_iscsi_param_eq_val(conn->sess->params,
2233 					    "SessionType", "Discovery")) {
2234 			if (strcasecmp(val, "") == 0) {
2235 				val = "ALL";
2236 			}
2237 
2238 			data_len = spdk_iscsi_send_tgts(conn,
2239 							conn->initiator_name,
2240 							conn->initiator_addr,
2241 							val, data, alloc_len,
2242 							data_len);
2243 		} else {
2244 			if (strcasecmp(val, "") == 0) {
2245 				val = conn->target->name;
2246 			}
2247 
2248 			if (strcasecmp(val, "ALL") == 0) {
2249 				/* not in discovery session */
2250 				data_len = spdk_iscsi_append_text(conn,
2251 								  "SendTargets",
2252 								  "Reject", data,
2253 								  alloc_len,
2254 								  data_len);
2255 			} else {
2256 				data_len = spdk_iscsi_send_tgts(conn,
2257 								conn->initiator_name,
2258 								conn->initiator_addr,
2259 								val, data, alloc_len,
2260 								data_len);
2261 			}
2262 		}
2263 	} else {
2264 		if (spdk_iscsi_param_eq_val(conn->sess->params, "SessionType", "Discovery")) {
2265 			spdk_iscsi_param_free(*params_p);
2266 			free(data);
2267 			return SPDK_ISCSI_CONNECTION_FATAL;
2268 		}
2269 	}
2270 
2271 	SPDK_LOGDUMP(SPDK_LOG_ISCSI, "Negotiated Params", data, data_len);
2272 
2273 	/* response PDU */
2274 	rsp_pdu = spdk_get_pdu();
2275 	if (rsp_pdu == NULL) {
2276 		spdk_iscsi_param_free(*params_p);
2277 		free(data);
2278 		return SPDK_ISCSI_CONNECTION_FATAL;
2279 	}
2280 	rsph = (struct iscsi_bhs_text_resp *)&rsp_pdu->bhs;
2281 
2282 	rsp_pdu->data = data;
2283 	rsph->opcode = ISCSI_OP_TEXT_RSP;
2284 
2285 	if (F_bit) {
2286 		rsph->flags |= ISCSI_FLAG_FINAL;
2287 	}
2288 
2289 	if (C_bit) {
2290 		rsph->flags |= ISCSI_TEXT_CONTINUE;
2291 	}
2292 
2293 	DSET24(rsph->data_segment_len, data_len);
2294 	to_be64(&rsph->lun, lun);
2295 	to_be32(&rsph->itt, task_tag);
2296 
2297 	if (F_bit) {
2298 		rsph->ttt = 0xffffffffU;
2299 		conn->sess->current_text_itt = 0xffffffffU;
2300 	} else {
2301 		to_be32(&rsph->ttt, 1 + conn->id);
2302 	}
2303 
2304 	to_be32(&rsph->stat_sn, conn->StatSN);
2305 	conn->StatSN++;
2306 
2307 	if (reqh->immediate == 0) {
2308 		conn->sess->MaxCmdSN++;
2309 	}
2310 
2311 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2312 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2313 
2314 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
2315 
2316 	/* update internal variables */
2317 	rc = spdk_iscsi_copy_param2var(conn);
2318 	if (rc < 0) {
2319 		SPDK_ERRLOG("spdk_iscsi_copy_param2var() failed\n");
2320 		spdk_iscsi_param_free(*params_p);
2321 		return -1;
2322 	}
2323 
2324 	/* check value */
2325 	rc = spdk_iscsi_check_values(conn);
2326 	if (rc < 0) {
2327 		SPDK_ERRLOG("iscsi_check_values() failed\n");
2328 		spdk_iscsi_param_free(*params_p);
2329 		return -1;
2330 	}
2331 
2332 	spdk_iscsi_param_free(*params_p);
2333 	return 0;
2334 }
2335 
2336 static int
2337 spdk_iscsi_op_logout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2338 {
2339 	char buf[MAX_TMPBUF];
2340 	struct spdk_iscsi_pdu *rsp_pdu;
2341 	uint32_t task_tag;
2342 	uint32_t CmdSN;
2343 	uint32_t ExpStatSN;
2344 	int response;
2345 	struct iscsi_bhs_logout_req *reqh;
2346 	struct iscsi_bhs_logout_resp *rsph;
2347 	uint16_t cid;
2348 
2349 	reqh = (struct iscsi_bhs_logout_req *)&pdu->bhs;
2350 
2351 	cid = from_be16(&reqh->cid);
2352 	task_tag = from_be32(&reqh->itt);
2353 	CmdSN = from_be32(&reqh->cmd_sn);
2354 	pdu->cmd_sn = CmdSN;
2355 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2356 
2357 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "reason=%d, ITT=%x, cid=%d\n",
2358 		      reqh->reason, task_tag, cid);
2359 
2360 	if (reqh->reason != 0 && conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2361 		SPDK_ERRLOG("only logout with close the session reason can be in discovery session");
2362 		return SPDK_ISCSI_CONNECTION_FATAL;
2363 	}
2364 
2365 	if (conn->sess != NULL) {
2366 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI,
2367 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2368 			      CmdSN, ExpStatSN, conn->StatSN,
2369 			      conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
2370 
2371 		if (CmdSN != conn->sess->ExpCmdSN) {
2372 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "CmdSN(%u) might have dropped\n", CmdSN);
2373 			/* ignore error */
2374 		}
2375 	} else {
2376 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
2377 			      CmdSN, ExpStatSN, conn->StatSN);
2378 	}
2379 
2380 	if (ExpStatSN != conn->StatSN) {
2381 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "StatSN(%u/%u) might have dropped\n",
2382 			      ExpStatSN, conn->StatSN);
2383 		/* ignore error */
2384 	}
2385 
2386 	if (conn->id == cid) {
2387 		/* connection or session closed successfully */
2388 		response = 0;
2389 		spdk_iscsi_conn_logout(conn);
2390 	} else {
2391 		response = 1;
2392 	}
2393 
2394 	/* response PDU */
2395 	rsp_pdu = spdk_get_pdu();
2396 	if (rsp_pdu == NULL) {
2397 		return SPDK_ISCSI_CONNECTION_FATAL;
2398 	}
2399 	rsph = (struct iscsi_bhs_logout_resp *)&rsp_pdu->bhs;
2400 	rsp_pdu->data = NULL;
2401 	rsph->opcode = ISCSI_OP_LOGOUT_RSP;
2402 	rsph->flags |= 0x80; /* bit 0 must be 1 */
2403 	rsph->response = response;
2404 	DSET24(rsph->data_segment_len, 0);
2405 	to_be32(&rsph->itt, task_tag);
2406 
2407 	if (conn->sess != NULL) {
2408 		to_be32(&rsph->stat_sn, conn->StatSN);
2409 		conn->StatSN++;
2410 
2411 		if (conn->sess->connections == 1) {
2412 			conn->sess->MaxCmdSN++;
2413 		}
2414 
2415 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2416 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2417 	} else {
2418 		to_be32(&rsph->stat_sn, conn->StatSN);
2419 		conn->StatSN++;
2420 		to_be32(&rsph->exp_cmd_sn, CmdSN);
2421 		to_be32(&rsph->max_cmd_sn, CmdSN);
2422 	}
2423 
2424 	rsph->time_2_wait = 0;
2425 	rsph->time_2_retain = 0;
2426 
2427 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
2428 
2429 	if (conn->sess == NULL) {
2430 		/*
2431 		 * login failed but initiator still sent a logout rather than
2432 		 *  just closing the TCP connection.
2433 		 */
2434 		snprintf(buf, sizeof buf, "Logout(login failed) from %s (%s) on"
2435 			 " (%s:%s,%d)\n",
2436 			 conn->initiator_name, conn->initiator_addr,
2437 			 conn->portal_host, conn->portal_port, conn->pg_tag);
2438 	} else if (spdk_iscsi_param_eq_val(conn->sess->params, "SessionType", "Normal")) {
2439 		snprintf(buf, sizeof buf, "Logout from %s (%s) on %s tgt_node%d"
2440 			 " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2441 			 " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2442 			 conn->initiator_name, conn->initiator_addr,
2443 			 conn->target->name, conn->target->num,
2444 			 conn->portal_host, conn->portal_port, conn->pg_tag,
2445 			 conn->sess->isid, conn->sess->tsih, conn->cid,
2446 			 (spdk_iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2447 			  ? "on" : "off"),
2448 			 (spdk_iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2449 			  ? "on" : "off"));
2450 	} else {
2451 		/* discovery session */
2452 		snprintf(buf, sizeof buf, "Logout(discovery) from %s (%s) on"
2453 			 " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2454 			 " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2455 			 conn->initiator_name, conn->initiator_addr,
2456 			 conn->portal_host, conn->portal_port, conn->pg_tag,
2457 			 conn->sess->isid, conn->sess->tsih, conn->cid,
2458 			 (spdk_iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2459 			  ? "on" : "off"),
2460 			 (spdk_iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2461 			  ? "on" : "off"));
2462 	}
2463 
2464 	SPDK_NOTICELOG("%s", buf);
2465 
2466 	return 0;
2467 }
2468 
2469 /* This function returns the spdk_scsi_task by searching the snack list via
2470  * task transfertag and the pdu's opcode
2471  */
2472 static struct spdk_iscsi_task *
2473 spdk_get_scsi_task_from_ttt(struct spdk_iscsi_conn *conn,
2474 			    uint32_t transfer_tag)
2475 {
2476 	struct spdk_iscsi_pdu *pdu;
2477 	struct iscsi_bhs_data_in *datain_bhs;
2478 
2479 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
2480 		if (pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
2481 			datain_bhs = (struct iscsi_bhs_data_in *)&pdu->bhs;
2482 			if (from_be32(&datain_bhs->ttt) == transfer_tag) {
2483 				return pdu->task;
2484 			}
2485 		}
2486 	}
2487 
2488 	return NULL;
2489 }
2490 
2491 /* This function returns the spdk_scsi_task by searching the snack list via
2492  * initiator task tag and the pdu's opcode
2493  */
2494 static struct spdk_iscsi_task *
2495 spdk_get_scsi_task_from_itt(struct spdk_iscsi_conn *conn,
2496 			    uint32_t task_tag, enum iscsi_op opcode)
2497 {
2498 	struct spdk_iscsi_pdu *pdu;
2499 
2500 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
2501 		if (pdu->bhs.opcode == opcode &&
2502 		    pdu->task != NULL &&
2503 		    pdu->task->tag == task_tag) {
2504 			return pdu->task;
2505 		}
2506 	}
2507 
2508 	return NULL;
2509 }
2510 
2511 static int
2512 spdk_iscsi_send_datain(struct spdk_iscsi_conn *conn,
2513 		       struct spdk_iscsi_task *task, int datain_flag,
2514 		       int residual_len, int offset, int DataSN, int len)
2515 {
2516 	struct spdk_iscsi_pdu *rsp_pdu;
2517 	struct iscsi_bhs_data_in *rsph;
2518 	uint32_t task_tag;
2519 	uint32_t transfer_tag;
2520 	int F_bit, U_bit, O_bit, S_bit;
2521 	struct spdk_iscsi_task *primary;
2522 
2523 	primary = spdk_iscsi_task_get_primary(task);
2524 
2525 	/* DATA PDU */
2526 	rsp_pdu = spdk_get_pdu();
2527 	rsph = (struct iscsi_bhs_data_in *)&rsp_pdu->bhs;
2528 	rsp_pdu->data = task->scsi.iovs[0].iov_base + offset;
2529 	rsp_pdu->data_from_mempool = true;
2530 
2531 	task_tag = task->tag;
2532 	transfer_tag = 0xffffffffU;
2533 
2534 	F_bit = datain_flag & ISCSI_FLAG_FINAL;
2535 	O_bit = datain_flag & ISCSI_DATAIN_OVERFLOW;
2536 	U_bit = datain_flag & ISCSI_DATAIN_UNDERFLOW;
2537 	S_bit = datain_flag & ISCSI_DATAIN_STATUS;
2538 
2539 	/*
2540 	 * we need to hold onto this task/cmd because until the
2541 	 * PDU has been written out
2542 	 */
2543 	rsp_pdu->task = task;
2544 	task->scsi.ref++;
2545 
2546 	rsph->opcode = ISCSI_OP_SCSI_DATAIN;
2547 
2548 	if (F_bit) {
2549 		rsph->flags |= ISCSI_FLAG_FINAL;
2550 	}
2551 
2552 	/* we leave the A_bit clear */
2553 
2554 	if (F_bit && S_bit)  {
2555 		if (O_bit) {
2556 			rsph->flags |= ISCSI_DATAIN_OVERFLOW;
2557 		}
2558 
2559 		if (U_bit) {
2560 			rsph->flags |= ISCSI_DATAIN_UNDERFLOW;
2561 		}
2562 	}
2563 
2564 	if (S_bit) {
2565 		rsph->flags |= ISCSI_DATAIN_STATUS;
2566 		rsph->status = task->scsi.status;
2567 	}
2568 
2569 	DSET24(rsph->data_segment_len, len);
2570 
2571 	to_be32(&rsph->itt, task_tag);
2572 	to_be32(&rsph->ttt, transfer_tag);
2573 
2574 	if (S_bit) {
2575 		to_be32(&rsph->stat_sn, conn->StatSN);
2576 		conn->StatSN++;
2577 	}
2578 
2579 	if (F_bit && S_bit && !spdk_iscsi_task_is_immediate(primary)) {
2580 		conn->sess->MaxCmdSN++;
2581 	}
2582 
2583 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2584 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2585 
2586 	to_be32(&rsph->data_sn, DataSN);
2587 
2588 	if (conn->sess->ErrorRecoveryLevel >= 1) {
2589 		primary->datain_datasn = DataSN;
2590 	}
2591 	DataSN++;
2592 
2593 	if (task->parent) {
2594 		offset += primary->scsi.data_transferred;
2595 	}
2596 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2597 
2598 	if (F_bit && S_bit) {
2599 		to_be32(&rsph->res_cnt, residual_len);
2600 	}
2601 
2602 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
2603 
2604 	return DataSN;
2605 }
2606 
2607 static int
2608 spdk_iscsi_transfer_in(struct spdk_iscsi_conn *conn,
2609 		       struct spdk_iscsi_task *task)
2610 {
2611 	uint32_t DataSN;
2612 	int transfer_len;
2613 	int data_len;
2614 	int segment_len;
2615 	int offset;
2616 	int residual_len = 0;
2617 	int sent_status;
2618 	int len;
2619 	int datain_flag = 0;
2620 	int datain_seq_cnt;
2621 	int i;
2622 	int sequence_end;
2623 	struct spdk_iscsi_task *primary;
2624 
2625 	primary = spdk_iscsi_task_get_primary(task);
2626 	segment_len = conn->MaxRecvDataSegmentLength;
2627 	data_len = task->scsi.data_transferred;
2628 	transfer_len = task->scsi.length;
2629 
2630 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
2631 		if (task != primary) {
2632 			conn->data_in_cnt--;
2633 			/* Handle the case when primary task return success but the subtask failed */
2634 			if (primary->bytes_completed == primary->scsi.transfer_len &&
2635 			    primary->scsi.status == SPDK_SCSI_STATUS_GOOD) {
2636 				conn->data_in_cnt--;
2637 			}
2638 		} else {
2639 			/* handle the case that it is a primary task which has subtasks */
2640 			if (primary->scsi.transfer_len != primary->scsi.length) {
2641 				conn->data_in_cnt--;
2642 			}
2643 		}
2644 
2645 		return 0;
2646 	}
2647 
2648 	if (data_len < transfer_len) {
2649 		/* underflow */
2650 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Underflow %u/%u\n", data_len, transfer_len);
2651 		residual_len = transfer_len - data_len;
2652 		transfer_len = data_len;
2653 		datain_flag |= ISCSI_DATAIN_UNDERFLOW;
2654 	} else if (data_len > transfer_len) {
2655 		/* overflow */
2656 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Overflow %u/%u\n", data_len, transfer_len);
2657 		residual_len = data_len - transfer_len;
2658 		datain_flag |= ISCSI_DATAIN_OVERFLOW;
2659 	} else {
2660 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Transfer %u\n", transfer_len);
2661 		residual_len = 0;
2662 	}
2663 
2664 	DataSN = primary->datain_datasn;
2665 	sent_status = 0;
2666 
2667 	/* calculate the number of sequences for all data-in pdus */
2668 	datain_seq_cnt = 1 + ((transfer_len - 1) / (int)conn->sess->MaxBurstLength);
2669 	for (i = 0; i < datain_seq_cnt; i++) {
2670 		offset = i * conn->sess->MaxBurstLength;
2671 		sequence_end = DMIN32(((i + 1) * conn->sess->MaxBurstLength),
2672 				      transfer_len);
2673 
2674 		/* send data splitted by segment_len */
2675 		for (; offset < sequence_end; offset += segment_len) {
2676 			len = DMIN32(segment_len, (sequence_end - offset));
2677 
2678 			datain_flag &= ~ISCSI_FLAG_FINAL;
2679 			datain_flag &= ~ISCSI_DATAIN_STATUS;
2680 
2681 			if (offset + len == sequence_end) {
2682 				/* last PDU in a sequence */
2683 				datain_flag |= ISCSI_FLAG_FINAL;
2684 				if (task->scsi.sense_data_len == 0) {
2685 					/* The last pdu in all data-in pdus */
2686 					if ((offset + len) == transfer_len &&
2687 					    (primary->bytes_completed == primary->scsi.transfer_len)) {
2688 						datain_flag |= ISCSI_DATAIN_STATUS;
2689 						sent_status = 1;
2690 					}
2691 				}
2692 			}
2693 
2694 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Transfer=%d, Offset=%d, Len=%d\n",
2695 				      sequence_end, offset, len);
2696 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "StatSN=%u, DataSN=%u, Offset=%u, Len=%d\n",
2697 				      conn->StatSN, DataSN, offset, len);
2698 
2699 			DataSN = spdk_iscsi_send_datain(conn, task, datain_flag, residual_len,
2700 							offset, DataSN, len);
2701 		}
2702 	}
2703 
2704 	if (task != primary) {
2705 		primary->scsi.data_transferred += task->scsi.data_transferred;
2706 	}
2707 	primary->datain_datasn = DataSN;
2708 
2709 	return sent_status;
2710 }
2711 
2712 /*
2713  *  This function compare the input pdu's bhs with the pdu's bhs associated by
2714  *  active_r2t_tasks and queued_r2t_tasks in a connection
2715  */
2716 static bool
2717 spdk_iscsi_compare_pdu_bhs_within_existed_r2t_tasks(struct spdk_iscsi_conn *conn,
2718 		struct spdk_iscsi_pdu *pdu)
2719 {
2720 	struct spdk_iscsi_task	*task;
2721 
2722 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
2723 		if (!memcmp(&pdu->bhs, spdk_iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
2724 			return true;
2725 		}
2726 	}
2727 
2728 	TAILQ_FOREACH(task, &conn->queued_r2t_tasks, link) {
2729 		if (!memcmp(&pdu->bhs, spdk_iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
2730 			return true;
2731 		}
2732 	}
2733 
2734 	return false;
2735 }
2736 
2737 static void spdk_iscsi_queue_task(struct spdk_iscsi_conn *conn,
2738 				  struct spdk_iscsi_task *task)
2739 {
2740 	spdk_trace_record(TRACE_ISCSI_TASK_QUEUE, conn->id, task->scsi.length,
2741 			  (uintptr_t)task, (uintptr_t)task->pdu);
2742 	task->is_queued = true;
2743 	spdk_scsi_dev_queue_task(conn->dev, &task->scsi);
2744 }
2745 
2746 static void spdk_iscsi_queue_mgmt_task(struct spdk_iscsi_conn *conn,
2747 				       struct spdk_iscsi_task *task)
2748 {
2749 	spdk_scsi_dev_queue_mgmt_task(conn->dev, &task->scsi);
2750 }
2751 
2752 int spdk_iscsi_conn_handle_queued_datain_tasks(struct spdk_iscsi_conn *conn)
2753 {
2754 	struct spdk_iscsi_task *task;
2755 
2756 	while (!TAILQ_EMPTY(&conn->queued_datain_tasks) &&
2757 	       conn->data_in_cnt < MAX_LARGE_DATAIN_PER_CONNECTION) {
2758 		task = TAILQ_FIRST(&conn->queued_datain_tasks);
2759 		assert(task->current_datain_offset <= task->scsi.transfer_len);
2760 
2761 		if (task->current_datain_offset == 0) {
2762 			task->scsi.lun = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
2763 			if (task->scsi.lun == NULL) {
2764 				TAILQ_REMOVE(&conn->queued_datain_tasks, task, link);
2765 				spdk_scsi_task_process_null_lun(&task->scsi);
2766 				spdk_iscsi_task_cpl(&task->scsi);
2767 				return 0;
2768 			}
2769 			task->current_datain_offset = task->scsi.length;
2770 			conn->data_in_cnt++;
2771 			spdk_iscsi_queue_task(conn, task);
2772 			continue;
2773 		}
2774 		if (task->current_datain_offset < task->scsi.transfer_len) {
2775 			struct spdk_iscsi_task *subtask;
2776 			uint32_t remaining_size = 0;
2777 
2778 			remaining_size = task->scsi.transfer_len - task->current_datain_offset;
2779 			subtask = spdk_iscsi_task_get(conn, task, spdk_iscsi_task_cpl);
2780 			assert(subtask != NULL);
2781 			subtask->scsi.offset = task->current_datain_offset;
2782 			subtask->scsi.length = DMIN32(SPDK_BDEV_LARGE_BUF_MAX_SIZE, remaining_size);
2783 			spdk_scsi_task_set_data(&subtask->scsi, NULL, 0);
2784 			task->current_datain_offset += subtask->scsi.length;
2785 			conn->data_in_cnt++;
2786 
2787 			task->scsi.lun = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
2788 			if (task->scsi.lun == NULL) {
2789 				/* Remove the primary task from the list if this is the last subtask */
2790 				if (task->current_datain_offset == task->scsi.transfer_len) {
2791 					TAILQ_REMOVE(&conn->queued_datain_tasks, task, link);
2792 				}
2793 				subtask->scsi.transfer_len = subtask->scsi.length;
2794 				spdk_scsi_task_process_null_lun(&subtask->scsi);
2795 				spdk_iscsi_task_cpl(&subtask->scsi);
2796 				return 0;
2797 			}
2798 
2799 			spdk_iscsi_queue_task(conn, subtask);
2800 		}
2801 		if (task->current_datain_offset == task->scsi.transfer_len) {
2802 			TAILQ_REMOVE(&conn->queued_datain_tasks, task, link);
2803 		}
2804 	}
2805 	return 0;
2806 }
2807 
2808 static int spdk_iscsi_op_scsi_read(struct spdk_iscsi_conn *conn,
2809 				   struct spdk_iscsi_task *task)
2810 {
2811 	int32_t remaining_size;
2812 
2813 	TAILQ_INIT(&task->subtask_list);
2814 	task->scsi.dxfer_dir = SPDK_SCSI_DIR_FROM_DEV;
2815 	task->parent = NULL;
2816 	task->scsi.offset = 0;
2817 	task->scsi.length = DMIN32(SPDK_BDEV_LARGE_BUF_MAX_SIZE, task->scsi.transfer_len);
2818 	spdk_scsi_task_set_data(&task->scsi, NULL, 0);
2819 
2820 	remaining_size = task->scsi.transfer_len - task->scsi.length;
2821 	task->current_datain_offset = 0;
2822 
2823 	if (remaining_size == 0) {
2824 		spdk_iscsi_queue_task(conn, task);
2825 		return 0;
2826 	}
2827 
2828 	TAILQ_INSERT_TAIL(&conn->queued_datain_tasks, task, link);
2829 
2830 	return spdk_iscsi_conn_handle_queued_datain_tasks(conn);
2831 }
2832 
2833 static int
2834 spdk_iscsi_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2835 {
2836 	struct spdk_iscsi_task	*task;
2837 	struct spdk_scsi_dev	*dev;
2838 	uint8_t *cdb;
2839 	uint64_t lun;
2840 	uint32_t task_tag;
2841 	uint32_t transfer_len;
2842 	int F_bit, R_bit, W_bit;
2843 	int lun_i, rc;
2844 	struct iscsi_bhs_scsi_req *reqh;
2845 
2846 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
2847 		SPDK_ERRLOG("ISCSI_OP_SCSI not allowed in discovery and invalid session\n");
2848 		return SPDK_ISCSI_CONNECTION_FATAL;
2849 	}
2850 
2851 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
2852 
2853 	F_bit = reqh->final_bit;
2854 	R_bit = reqh->read_bit;
2855 	W_bit = reqh->write_bit;
2856 	lun = from_be64(&reqh->lun);
2857 	task_tag = from_be32(&reqh->itt);
2858 	transfer_len = from_be32(&reqh->expected_data_xfer_len);
2859 	cdb = reqh->cdb;
2860 
2861 	SPDK_LOGDUMP(SPDK_LOG_ISCSI, "CDB", cdb, 16);
2862 
2863 	task = spdk_iscsi_task_get(conn, NULL, spdk_iscsi_task_cpl);
2864 	if (!task) {
2865 		SPDK_ERRLOG("Unable to acquire task\n");
2866 		return SPDK_ISCSI_CONNECTION_FATAL;
2867 	}
2868 
2869 	spdk_iscsi_task_associate_pdu(task, pdu);
2870 	lun_i = spdk_islun2lun(lun);
2871 	task->lun_id = lun_i;
2872 	dev = conn->dev;
2873 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
2874 
2875 	if ((R_bit != 0) && (W_bit != 0)) {
2876 		SPDK_ERRLOG("Bidirectional CDB is not supported\n");
2877 		spdk_iscsi_task_put(task);
2878 		return SPDK_ISCSI_CONNECTION_FATAL;
2879 	}
2880 
2881 	task->scsi.cdb = cdb;
2882 	task->tag = task_tag;
2883 	task->scsi.transfer_len = transfer_len;
2884 	task->scsi.target_port = conn->target_port;
2885 	task->scsi.initiator_port = conn->initiator_port;
2886 	task->parent = NULL;
2887 	task->rsp_scsi_status = SPDK_SCSI_STATUS_GOOD;
2888 
2889 	if (task->scsi.lun == NULL) {
2890 		spdk_scsi_task_process_null_lun(&task->scsi);
2891 		spdk_iscsi_task_cpl(&task->scsi);
2892 		return 0;
2893 	}
2894 
2895 	/* no bi-directional support */
2896 	if (R_bit) {
2897 		return spdk_iscsi_op_scsi_read(conn, task);
2898 	} else if (W_bit) {
2899 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_TO_DEV;
2900 
2901 		if ((conn->sess->ErrorRecoveryLevel >= 1) &&
2902 		    (spdk_iscsi_compare_pdu_bhs_within_existed_r2t_tasks(conn, pdu))) {
2903 			spdk_iscsi_task_response(conn, task);
2904 			spdk_iscsi_task_put(task);
2905 			return 0;
2906 		}
2907 
2908 		if (pdu->data_segment_len > transfer_len) {
2909 			SPDK_ERRLOG("data segment len(=%d) > task transfer len(=%d)\n",
2910 				    (int)pdu->data_segment_len, transfer_len);
2911 			spdk_iscsi_task_put(task);
2912 			return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2913 		}
2914 
2915 		/* check the ImmediateData and also pdu->data_segment_len */
2916 		if ((!conn->sess->ImmediateData && (pdu->data_segment_len > 0)) ||
2917 		    (pdu->data_segment_len > conn->sess->FirstBurstLength)) {
2918 			spdk_iscsi_task_put(task);
2919 			return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2920 		}
2921 
2922 		if (F_bit && pdu->data_segment_len < transfer_len) {
2923 			/* needs R2T */
2924 			rc = spdk_add_transfer_task(conn, task);
2925 			if (rc < 0) {
2926 				SPDK_ERRLOG("add_transfer_task() failed\n");
2927 				spdk_iscsi_task_put(task);
2928 				return SPDK_ISCSI_CONNECTION_FATAL;
2929 			}
2930 
2931 			/* Non-immediate writes */
2932 			if (pdu->data_segment_len == 0) {
2933 				return 0;
2934 			} else {
2935 				/* we are doing the first partial write task */
2936 				task->scsi.ref++;
2937 				spdk_scsi_task_set_data(&task->scsi, pdu->data, pdu->data_segment_len);
2938 				task->scsi.length = pdu->data_segment_len;
2939 			}
2940 		}
2941 
2942 		if (pdu->data_segment_len == transfer_len) {
2943 			/* we are doing small writes with no R2T */
2944 			spdk_scsi_task_set_data(&task->scsi, pdu->data, transfer_len);
2945 			task->scsi.length = transfer_len;
2946 		}
2947 	} else {
2948 		/* neither R nor W bit set */
2949 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_NONE;
2950 		if (transfer_len > 0) {
2951 			spdk_iscsi_task_put(task);
2952 			SPDK_ERRLOG("Reject scsi cmd with EDTL > 0 but (R | W) == 0\n");
2953 			return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
2954 		}
2955 	}
2956 
2957 	spdk_iscsi_queue_task(conn, task);
2958 	return 0;
2959 }
2960 
2961 static void
2962 spdk_abort_transfer_task_in_task_mgmt_resp(struct spdk_iscsi_conn *conn,
2963 		struct spdk_iscsi_task *task)
2964 {
2965 	struct spdk_iscsi_pdu *pdu;
2966 
2967 	pdu = spdk_iscsi_task_get_pdu(task);
2968 
2969 	switch (task->scsi.function) {
2970 	/* abort task identified by Reference Task Tag field */
2971 	case ISCSI_TASK_FUNC_ABORT_TASK:
2972 		spdk_del_transfer_task(conn, task->scsi.abort_id);
2973 		break;
2974 
2975 	/* abort all tasks issued via this session on the LUN */
2976 	case ISCSI_TASK_FUNC_ABORT_TASK_SET:
2977 		spdk_clear_all_transfer_task(conn, task->scsi.lun, pdu);
2978 		break;
2979 
2980 	case ISCSI_TASK_FUNC_LOGICAL_UNIT_RESET:
2981 		spdk_clear_all_transfer_task(conn, task->scsi.lun, pdu);
2982 		break;
2983 	}
2984 }
2985 
2986 void
2987 spdk_iscsi_task_mgmt_response(struct spdk_iscsi_conn *conn,
2988 			      struct spdk_iscsi_task *task)
2989 {
2990 	struct spdk_iscsi_pdu *rsp_pdu;
2991 	struct iscsi_bhs_task_req *reqh;
2992 	struct iscsi_bhs_task_resp *rsph;
2993 
2994 	if (task->pdu == NULL) {
2995 		/*
2996 		 * This was an internally generated task management command,
2997 		 *  usually from LUN cleanup when a connection closes.
2998 		 */
2999 		return;
3000 	}
3001 
3002 	reqh = (struct iscsi_bhs_task_req *)&task->pdu->bhs;
3003 	/* response PDU */
3004 	rsp_pdu = spdk_get_pdu();
3005 	rsph = (struct iscsi_bhs_task_resp *)&rsp_pdu->bhs;
3006 	rsph->opcode = ISCSI_OP_TASK_RSP;
3007 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3008 	switch (task->scsi.response) {
3009 	case SPDK_SCSI_TASK_MGMT_RESP_COMPLETE:
3010 		spdk_abort_transfer_task_in_task_mgmt_resp(conn, task);
3011 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3012 		break;
3013 	case SPDK_SCSI_TASK_MGMT_RESP_SUCCESS:
3014 		spdk_abort_transfer_task_in_task_mgmt_resp(conn, task);
3015 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3016 		break;
3017 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT:
3018 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3019 		break;
3020 	case SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN:
3021 		rsph->response = ISCSI_TASK_FUNC_RESP_LUN_NOT_EXIST;
3022 		break;
3023 	case SPDK_SCSI_TASK_MGMT_RESP_TARGET_FAILURE:
3024 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3025 		break;
3026 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED:
3027 		rsph->response = ISCSI_TASK_FUNC_RESP_FUNC_NOT_SUPPORTED;
3028 		break;
3029 	}
3030 	rsph->itt = reqh->itt;
3031 
3032 	to_be32(&rsph->stat_sn, conn->StatSN);
3033 	conn->StatSN++;
3034 
3035 	if (reqh->immediate == 0) {
3036 		conn->sess->MaxCmdSN++;
3037 	}
3038 
3039 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3040 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3041 
3042 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
3043 }
3044 
3045 void spdk_iscsi_task_response(struct spdk_iscsi_conn *conn,
3046 			      struct spdk_iscsi_task *task)
3047 {
3048 	struct spdk_iscsi_pdu *rsp_pdu;
3049 	struct iscsi_bhs_scsi_resp *rsph;
3050 	uint32_t task_tag;
3051 	uint32_t transfer_len;
3052 	size_t residual_len;
3053 	size_t data_len;
3054 	int O_bit, U_bit;
3055 	int rc;
3056 	struct spdk_iscsi_task *primary;
3057 
3058 	primary = spdk_iscsi_task_get_primary(task);
3059 
3060 	transfer_len = primary->scsi.transfer_len;
3061 	task_tag = task->tag;
3062 
3063 	/* transfer data from logical unit */
3064 	/* (direction is view of initiator side) */
3065 	if (spdk_iscsi_task_is_read(primary)) {
3066 		rc = spdk_iscsi_transfer_in(conn, task);
3067 		if (rc > 0) {
3068 			/* sent status by last DATAIN PDU */
3069 			return;
3070 		}
3071 
3072 		if (primary->bytes_completed != primary->scsi.transfer_len) {
3073 			return;
3074 		}
3075 	}
3076 
3077 	O_bit = U_bit = 0;
3078 	residual_len = 0;
3079 	data_len = primary->scsi.data_transferred;
3080 
3081 	if ((transfer_len != 0) &&
3082 	    (task->scsi.status == SPDK_SCSI_STATUS_GOOD)) {
3083 		if (data_len < transfer_len) {
3084 			/* underflow */
3085 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Underflow %zu/%u\n", data_len, transfer_len);
3086 			residual_len = transfer_len - data_len;
3087 			U_bit = 1;
3088 		} else if (data_len > transfer_len) {
3089 			/* overflow */
3090 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Overflow %zu/%u\n", data_len, transfer_len);
3091 			residual_len = data_len - transfer_len;
3092 			O_bit = 1;
3093 		} else {
3094 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Transfer %u\n", transfer_len);
3095 		}
3096 	}
3097 
3098 	/* response PDU */
3099 	rsp_pdu = spdk_get_pdu();
3100 	assert(rsp_pdu != NULL);
3101 	rsph = (struct iscsi_bhs_scsi_resp *)&rsp_pdu->bhs;
3102 	assert(task->scsi.sense_data_len <= sizeof(rsp_pdu->sense.data));
3103 	memcpy(rsp_pdu->sense.data, task->scsi.sense_data, task->scsi.sense_data_len);
3104 	to_be16(&rsp_pdu->sense.length, task->scsi.sense_data_len);
3105 	rsp_pdu->data = (uint8_t *)&rsp_pdu->sense;
3106 	rsp_pdu->data_from_mempool = true;
3107 
3108 	/*
3109 	 * we need to hold onto this task/cmd because until the
3110 	 * PDU has been written out
3111 	 */
3112 	rsp_pdu->task = task;
3113 	task->scsi.ref++;
3114 
3115 	rsph->opcode = ISCSI_OP_SCSI_RSP;
3116 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
3117 
3118 	if (O_bit) {
3119 		rsph->flags |= ISCSI_SCSI_OVERFLOW;
3120 	}
3121 
3122 	if (U_bit) {
3123 		rsph->flags |= ISCSI_SCSI_UNDERFLOW;
3124 	}
3125 
3126 	rsph->status = task->scsi.status;
3127 	if (task->scsi.sense_data_len) {
3128 		/* SenseLength (2 bytes) + SenseData  */
3129 		DSET24(rsph->data_segment_len, 2 + task->scsi.sense_data_len);
3130 	}
3131 	to_be32(&rsph->itt, task_tag);
3132 
3133 	to_be32(&rsph->stat_sn, conn->StatSN);
3134 	conn->StatSN++;
3135 
3136 	if (!spdk_iscsi_task_is_immediate(primary)) {
3137 		conn->sess->MaxCmdSN++;
3138 	}
3139 
3140 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3141 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3142 
3143 	to_be32(&rsph->bi_read_res_cnt, 0);
3144 	to_be32(&rsph->res_cnt, residual_len);
3145 
3146 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
3147 }
3148 
3149 static struct spdk_iscsi_task *
3150 spdk_get_transfer_task(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
3151 {
3152 	int i;
3153 
3154 	for (i = 0; i < conn->pending_r2t; i++) {
3155 		if (conn->outstanding_r2t_tasks[i]->ttt == transfer_tag) {
3156 			return (conn->outstanding_r2t_tasks[i]);
3157 		}
3158 	}
3159 
3160 	return NULL;
3161 }
3162 
3163 static int
3164 _spdk_iscsi_conn_abort_queued_datain_task(struct spdk_iscsi_conn *conn,
3165 		struct spdk_iscsi_task *task)
3166 {
3167 	struct spdk_iscsi_task *subtask;
3168 	uint32_t remaining_size;
3169 
3170 	while (conn->data_in_cnt < MAX_LARGE_DATAIN_PER_CONNECTION) {
3171 		assert(task->current_datain_offset <= task->scsi.transfer_len);
3172 
3173 		/* If no IO is submitted yet, just abort the primary task. */
3174 		if (task->current_datain_offset == 0) {
3175 			TAILQ_REMOVE(&conn->queued_datain_tasks, task, link);
3176 			spdk_scsi_task_process_abort(&task->scsi);
3177 			spdk_iscsi_task_cpl(&task->scsi);
3178 			return 0;
3179 		}
3180 
3181 		/* If any IO is submitted already, abort all subtasks by repetition. */
3182 		if (task->current_datain_offset < task->scsi.transfer_len) {
3183 			remaining_size = task->scsi.transfer_len - task->current_datain_offset;
3184 			subtask = spdk_iscsi_task_get(conn, task, spdk_iscsi_task_cpl);
3185 			assert(subtask != NULL);
3186 			subtask->scsi.offset = task->current_datain_offset;
3187 			subtask->scsi.length = DMIN32(SPDK_BDEV_LARGE_BUF_MAX_SIZE, remaining_size);
3188 			spdk_scsi_task_set_data(&subtask->scsi, NULL, 0);
3189 			task->current_datain_offset += subtask->scsi.length;
3190 			conn->data_in_cnt++;
3191 
3192 			subtask->scsi.transfer_len = subtask->scsi.length;
3193 			spdk_scsi_task_process_abort(&subtask->scsi);
3194 			spdk_iscsi_task_cpl(&subtask->scsi);
3195 
3196 			/* Remove the primary task from the list if this is the last subtask */
3197 			if (task->current_datain_offset == task->scsi.transfer_len) {
3198 				TAILQ_REMOVE(&conn->queued_datain_tasks, task, link);
3199 				return 0;
3200 			}
3201 		}
3202 	}
3203 
3204 	return -1;
3205 }
3206 
3207 static int
3208 spdk_iscsi_conn_abort_queued_datain_task(struct spdk_iscsi_conn *conn,
3209 		uint32_t ref_task_tag)
3210 {
3211 	struct spdk_iscsi_task *task;
3212 
3213 	TAILQ_FOREACH(task, &conn->queued_datain_tasks, link) {
3214 		if (task->tag == ref_task_tag) {
3215 			return _spdk_iscsi_conn_abort_queued_datain_task(conn, task);
3216 		}
3217 	}
3218 
3219 	return 0;
3220 }
3221 
3222 static int
3223 spdk_iscsi_conn_abort_queued_datain_tasks(struct spdk_iscsi_conn *conn,
3224 		struct spdk_scsi_lun *lun,
3225 		struct spdk_iscsi_pdu *pdu)
3226 {
3227 	struct spdk_iscsi_task *task, *task_tmp;
3228 	struct spdk_iscsi_pdu *pdu_tmp;
3229 	int rc;
3230 
3231 	TAILQ_FOREACH_SAFE(task, &conn->queued_datain_tasks, link, task_tmp) {
3232 		pdu_tmp = spdk_iscsi_task_get_pdu(task);
3233 		if ((lun == NULL || lun == task->scsi.lun) &&
3234 		    (pdu == NULL || (SN32_LT(pdu_tmp->cmd_sn, pdu->cmd_sn)))) {
3235 			rc = _spdk_iscsi_conn_abort_queued_datain_task(conn, task);
3236 			if (rc != 0) {
3237 				return rc;
3238 			}
3239 		}
3240 	}
3241 
3242 	return 0;
3243 }
3244 
3245 static int
3246 _spdk_iscsi_op_abort_task(void *arg)
3247 {
3248 	struct spdk_iscsi_task *task = arg;
3249 	int rc;
3250 
3251 	rc = spdk_iscsi_conn_abort_queued_datain_task(task->conn,
3252 			task->scsi.abort_id);
3253 	if (rc != 0) {
3254 		return 1;
3255 	}
3256 
3257 	spdk_poller_unregister(&task->mgmt_poller);
3258 	spdk_iscsi_queue_mgmt_task(task->conn, task);
3259 	return 1;
3260 }
3261 
3262 static void
3263 spdk_iscsi_op_abort_task(struct spdk_iscsi_task *task, uint32_t ref_task_tag)
3264 {
3265 	task->scsi.abort_id = ref_task_tag;
3266 	task->scsi.function = SPDK_SCSI_TASK_FUNC_ABORT_TASK;
3267 	task->mgmt_poller = spdk_poller_register(_spdk_iscsi_op_abort_task, task, 10);
3268 }
3269 
3270 static int
3271 _spdk_iscsi_op_abort_task_set(void *arg)
3272 {
3273 	struct spdk_iscsi_task *task = arg;
3274 	int rc;
3275 
3276 	rc = spdk_iscsi_conn_abort_queued_datain_tasks(task->conn, task->scsi.lun,
3277 			task->pdu);
3278 	if (rc != 0) {
3279 		return 1;
3280 	}
3281 
3282 	spdk_poller_unregister(&task->mgmt_poller);
3283 	spdk_iscsi_queue_mgmt_task(task->conn, task);
3284 	return 1;
3285 }
3286 
3287 void
3288 spdk_iscsi_op_abort_task_set(struct spdk_iscsi_task *task, uint8_t function)
3289 {
3290 	task->scsi.function = function;
3291 	task->mgmt_poller = spdk_poller_register(_spdk_iscsi_op_abort_task_set, task, 10);
3292 }
3293 
3294 static int
3295 spdk_iscsi_op_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3296 {
3297 	struct iscsi_bhs_task_req *reqh;
3298 	uint64_t lun;
3299 	uint32_t task_tag;
3300 	uint32_t ref_task_tag;
3301 	uint8_t function;
3302 	int lun_i;
3303 	struct spdk_iscsi_task *task;
3304 	struct spdk_scsi_dev *dev;
3305 
3306 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3307 		SPDK_ERRLOG("ISCSI_OP_TASK not allowed in discovery and invalid session\n");
3308 		return SPDK_ISCSI_CONNECTION_FATAL;
3309 	}
3310 
3311 	reqh = (struct iscsi_bhs_task_req *)&pdu->bhs;
3312 	function = reqh->flags & ISCSI_TASK_FUNCTION_MASK;
3313 	lun = from_be64(&reqh->lun);
3314 	task_tag = from_be32(&reqh->itt);
3315 	ref_task_tag = from_be32(&reqh->ref_task_tag);
3316 
3317 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "I=%d, func=%d, ITT=%x, ref TT=%x, LUN=0x%16.16"PRIx64"\n",
3318 		      reqh->immediate, function, task_tag, ref_task_tag, lun);
3319 
3320 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3321 		      conn->StatSN, conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
3322 
3323 	lun_i = spdk_islun2lun(lun);
3324 	dev = conn->dev;
3325 
3326 	task = spdk_iscsi_task_get(conn, NULL, spdk_iscsi_task_mgmt_cpl);
3327 	if (!task) {
3328 		SPDK_ERRLOG("Unable to acquire task\n");
3329 		return SPDK_ISCSI_CONNECTION_FATAL;
3330 	}
3331 
3332 	spdk_iscsi_task_associate_pdu(task, pdu);
3333 	task->scsi.target_port = conn->target_port;
3334 	task->scsi.initiator_port = conn->initiator_port;
3335 	task->tag = task_tag;
3336 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3337 
3338 	if (task->scsi.lun == NULL) {
3339 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3340 		spdk_iscsi_task_mgmt_response(conn, task);
3341 		spdk_iscsi_task_put(task);
3342 		return 0;
3343 	}
3344 
3345 	switch (function) {
3346 	/* abort task identified by Referenced Task Tag field */
3347 	case ISCSI_TASK_FUNC_ABORT_TASK:
3348 		SPDK_NOTICELOG("ABORT_TASK\n");
3349 
3350 		spdk_iscsi_op_abort_task(task, ref_task_tag);
3351 
3352 		return SPDK_SUCCESS;
3353 
3354 	/* abort all tasks issued via this session on the LUN */
3355 	case ISCSI_TASK_FUNC_ABORT_TASK_SET:
3356 		SPDK_NOTICELOG("ABORT_TASK_SET\n");
3357 
3358 		spdk_iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_ABORT_TASK_SET);
3359 		return SPDK_SUCCESS;
3360 
3361 	case ISCSI_TASK_FUNC_CLEAR_TASK_SET:
3362 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3363 		SPDK_NOTICELOG("CLEAR_TASK_SET (Unsupported)\n");
3364 		break;
3365 
3366 	case ISCSI_TASK_FUNC_CLEAR_ACA:
3367 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3368 		SPDK_NOTICELOG("CLEAR_ACA (Unsupported)\n");
3369 		break;
3370 
3371 	case ISCSI_TASK_FUNC_LOGICAL_UNIT_RESET:
3372 		SPDK_NOTICELOG("LOGICAL_UNIT_RESET\n");
3373 
3374 		spdk_iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
3375 		return SPDK_SUCCESS;
3376 
3377 	case ISCSI_TASK_FUNC_TARGET_WARM_RESET:
3378 		SPDK_NOTICELOG("TARGET_WARM_RESET (Unsupported)\n");
3379 
3380 #if 0
3381 		spdk_iscsi_drop_conns(conn, conn->initiator_name, 1 /* drop all */);
3382 		rc = spdk_iscsi_tgt_node_reset(conn->sess->target, lun);
3383 		if (rc < 0) {
3384 			SPDK_ERRLOG("tgt_node reset failed\n");
3385 		}
3386 #else
3387 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3388 #endif
3389 		break;
3390 
3391 	case ISCSI_TASK_FUNC_TARGET_COLD_RESET:
3392 		SPDK_NOTICELOG("TARGET_COLD_RESET\n");
3393 
3394 #if 0
3395 		spdk_iscsi_drop_conns(conn, conn->initiator_name, 1 /* drop all */);
3396 
3397 		rc = spdk_iscsi_tgt_node_reset(conn->sess->target, lun);
3398 		if (rc < 0) {
3399 			SPDK_ERRLOG("tgt_node reset failed\n");
3400 		}
3401 
3402 		conn->state = ISCSI_CONN_STATE_EXITING;
3403 #else
3404 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3405 #endif
3406 		break;
3407 
3408 	case ISCSI_TASK_FUNC_TASK_REASSIGN:
3409 		SPDK_NOTICELOG("TASK_REASSIGN (Unsupported)\n");
3410 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3411 		break;
3412 
3413 	default:
3414 		SPDK_ERRLOG("unsupported function %d\n", function);
3415 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT;
3416 		break;
3417 	}
3418 
3419 	spdk_iscsi_task_mgmt_response(conn, task);
3420 	spdk_iscsi_task_put(task);
3421 	return 0;
3422 }
3423 
3424 static int
3425 spdk_iscsi_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3426 {
3427 	struct spdk_iscsi_pdu *rsp_pdu;
3428 	struct iscsi_bhs_nop_out *reqh;
3429 	struct iscsi_bhs_nop_in *rsph;
3430 	uint8_t *data;
3431 	uint64_t lun;
3432 	uint32_t task_tag;
3433 	uint32_t transfer_tag;
3434 	uint32_t CmdSN;
3435 	int I_bit;
3436 	int data_len;
3437 
3438 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
3439 		SPDK_ERRLOG("ISCSI_OP_NOPOUT not allowed in discovery session\n");
3440 		return SPDK_ISCSI_CONNECTION_FATAL;
3441 	}
3442 
3443 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3444 	I_bit = reqh->immediate;
3445 
3446 	data_len = DGET24(reqh->data_segment_len);
3447 	if (data_len > conn->MaxRecvDataSegmentLength) {
3448 		data_len = conn->MaxRecvDataSegmentLength;
3449 	}
3450 
3451 	lun = from_be64(&reqh->lun);
3452 	task_tag = from_be32(&reqh->itt);
3453 	transfer_tag = from_be32(&reqh->ttt);
3454 	CmdSN = from_be32(&reqh->cmd_sn);
3455 	pdu->cmd_sn = CmdSN;
3456 
3457 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "I=%d, ITT=%x, TTT=%x\n",
3458 		      I_bit, task_tag, transfer_tag);
3459 
3460 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "CmdSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3461 		      CmdSN, conn->StatSN, conn->sess->ExpCmdSN,
3462 		      conn->sess->MaxCmdSN);
3463 
3464 	if (transfer_tag != 0xFFFFFFFF && transfer_tag != (uint32_t)conn->id) {
3465 		SPDK_ERRLOG("invalid transfer tag 0x%x\n", transfer_tag);
3466 		/*
3467 		 * Technically we should probably fail the connection here, but for now
3468 		 *  just print the error message and continue.
3469 		 */
3470 	}
3471 
3472 	/*
3473 	 * We don't actually check to see if this is a response to the NOP-In
3474 	 * that we sent.  Our goal is to just verify that the initiator is
3475 	 * alive and responding to commands, not to verify that it tags
3476 	 * NOP-Outs correctly
3477 	 */
3478 	conn->nop_outstanding = false;
3479 
3480 	if (task_tag == 0xffffffffU) {
3481 		if (I_bit == 1) {
3482 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "got NOPOUT ITT=0xffffffff\n");
3483 			return SPDK_SUCCESS;
3484 		} else {
3485 			SPDK_ERRLOG("got NOPOUT ITT=0xffffffff, I=0\n");
3486 			return SPDK_ISCSI_CONNECTION_FATAL;
3487 		}
3488 	}
3489 
3490 	data = calloc(1, data_len);
3491 	if (!data) {
3492 		SPDK_ERRLOG("calloc() failed for ping data\n");
3493 		return SPDK_ISCSI_CONNECTION_FATAL;
3494 	}
3495 
3496 	/* response of NOPOUT */
3497 	if (data_len > 0) {
3498 		/* copy ping data */
3499 		memcpy(data, pdu->data, data_len);
3500 	}
3501 
3502 	transfer_tag = 0xffffffffU;
3503 
3504 	/* response PDU */
3505 	rsp_pdu = spdk_get_pdu();
3506 	if (rsp_pdu == NULL) {
3507 		free(data);
3508 		return SPDK_ISCSI_CONNECTION_FATAL;
3509 	}
3510 	rsph = (struct iscsi_bhs_nop_in *)&rsp_pdu->bhs;
3511 	rsp_pdu->data = data;
3512 	rsph->opcode = ISCSI_OP_NOPIN;
3513 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3514 	DSET24(rsph->data_segment_len, data_len);
3515 	to_be64(&rsph->lun, lun);
3516 	to_be32(&rsph->itt, task_tag);
3517 	to_be32(&rsph->ttt, transfer_tag);
3518 
3519 	to_be32(&rsph->stat_sn, conn->StatSN);
3520 	conn->StatSN++;
3521 
3522 	if (I_bit == 0) {
3523 		conn->sess->MaxCmdSN++;
3524 	}
3525 
3526 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3527 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3528 
3529 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
3530 	conn->last_nopin = spdk_get_ticks();
3531 
3532 	return SPDK_SUCCESS;
3533 }
3534 
3535 static int
3536 spdk_add_transfer_task(struct spdk_iscsi_conn *conn,
3537 		       struct spdk_iscsi_task *task)
3538 {
3539 	uint32_t transfer_len;
3540 	size_t max_burst_len;
3541 	size_t segment_len;
3542 	size_t data_len;
3543 	int len;
3544 	int idx;
3545 	int rc;
3546 	int data_out_req;
3547 
3548 	transfer_len = task->scsi.transfer_len;
3549 	data_len = spdk_iscsi_task_get_pdu(task)->data_segment_len;
3550 	max_burst_len = conn->sess->MaxBurstLength;
3551 	segment_len = SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH;
3552 	data_out_req = 1 + (transfer_len - data_len - 1) / segment_len;
3553 	task->data_out_cnt = data_out_req;
3554 
3555 	/*
3556 	 * If we already have too many tasks using R2T, then queue this task
3557 	 *  and start sending R2T for it after some of the tasks using R2T/data
3558 	 *  out buffers complete.
3559 	 */
3560 	if (conn->pending_r2t >= DEFAULT_MAXR2T) {
3561 		TAILQ_INSERT_TAIL(&conn->queued_r2t_tasks, task, link);
3562 		return SPDK_SUCCESS;
3563 	}
3564 
3565 	conn->data_out_cnt += data_out_req;
3566 	idx = conn->pending_r2t++;
3567 
3568 	conn->outstanding_r2t_tasks[idx] = task;
3569 	task->next_expected_r2t_offset = data_len;
3570 	task->current_r2t_length = 0;
3571 	task->R2TSN = 0;
3572 	/* According to RFC3720 10.8.5, 0xffffffff is
3573 	 * reserved for TTT in R2T.
3574 	 */
3575 	if (++conn->ttt == 0xffffffffu) {
3576 		conn->ttt = 0;
3577 	}
3578 	task->ttt = conn->ttt;
3579 
3580 	while (data_len != transfer_len) {
3581 		len = DMIN32(max_burst_len, (transfer_len - data_len));
3582 		rc = spdk_iscsi_send_r2t(conn, task, data_len, len,
3583 					 task->ttt, &task->R2TSN);
3584 		if (rc < 0) {
3585 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
3586 			return rc;
3587 		}
3588 		data_len += len;
3589 		task->next_r2t_offset = data_len;
3590 		task->outstanding_r2t++;
3591 		if (conn->sess->MaxOutstandingR2T == task->outstanding_r2t) {
3592 			break;
3593 		}
3594 	}
3595 
3596 	TAILQ_INSERT_TAIL(&conn->active_r2t_tasks, task, link);
3597 	return SPDK_SUCCESS;
3598 }
3599 
3600 /* If there are additional large writes queued for R2Ts, start them now.
3601  *  This is called when a large write is just completed or when multiple LUNs
3602  *  are attached and large write tasks for the specific LUN are cleared.
3603  */
3604 static void
3605 spdk_start_queued_transfer_tasks(struct spdk_iscsi_conn *conn)
3606 {
3607 	struct spdk_iscsi_task *task, *tmp;
3608 
3609 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, tmp) {
3610 		if (conn->pending_r2t < DEFAULT_MAXR2T) {
3611 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
3612 			spdk_add_transfer_task(conn, task);
3613 		} else {
3614 			break;
3615 		}
3616 	}
3617 }
3618 
3619 void spdk_del_transfer_task(struct spdk_iscsi_conn *conn, uint32_t task_tag)
3620 {
3621 	struct spdk_iscsi_task *task;
3622 	int i;
3623 
3624 	for (i = 0; i < conn->pending_r2t; i++) {
3625 		if (conn->outstanding_r2t_tasks[i]->tag == task_tag) {
3626 			task = conn->outstanding_r2t_tasks[i];
3627 			conn->data_out_cnt -= task->data_out_cnt;
3628 
3629 			conn->pending_r2t--;
3630 			for (; i < conn->pending_r2t; i++) {
3631 				conn->outstanding_r2t_tasks[i] = conn->outstanding_r2t_tasks[i + 1];
3632 			}
3633 			conn->outstanding_r2t_tasks[conn->pending_r2t] = NULL;
3634 			break;
3635 		}
3636 	}
3637 
3638 	spdk_start_queued_transfer_tasks(conn);
3639 }
3640 
3641 static void
3642 spdk_del_connection_queued_task(struct spdk_iscsi_conn *conn, void *tailq,
3643 				struct spdk_scsi_lun *lun,
3644 				struct spdk_iscsi_pdu *pdu)
3645 {
3646 	struct spdk_iscsi_task *task, *task_tmp;
3647 	struct spdk_iscsi_pdu *pdu_tmp;
3648 
3649 	/*
3650 	 * Temporary used to index spdk_scsi_task related
3651 	 *  queues of the connection.
3652 	 */
3653 	TAILQ_HEAD(queued_tasks, spdk_iscsi_task) *head;
3654 	head = (struct queued_tasks *)tailq;
3655 
3656 	TAILQ_FOREACH_SAFE(task, head, link, task_tmp) {
3657 		pdu_tmp = spdk_iscsi_task_get_pdu(task);
3658 		if ((lun == NULL || lun == task->scsi.lun) &&
3659 		    (pdu == NULL || SN32_LT(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
3660 			TAILQ_REMOVE(head, task, link);
3661 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
3662 				spdk_scsi_task_process_null_lun(&task->scsi);
3663 				spdk_iscsi_task_response(conn, task);
3664 			}
3665 			spdk_iscsi_task_put(task);
3666 		}
3667 	}
3668 }
3669 
3670 void spdk_clear_all_transfer_task(struct spdk_iscsi_conn *conn,
3671 				  struct spdk_scsi_lun *lun,
3672 				  struct spdk_iscsi_pdu *pdu)
3673 {
3674 	int i, j, pending_r2t;
3675 	struct spdk_iscsi_task *task;
3676 	struct spdk_iscsi_pdu *pdu_tmp;
3677 
3678 	pending_r2t = conn->pending_r2t;
3679 	for (i = 0; i < pending_r2t; i++) {
3680 		task = conn->outstanding_r2t_tasks[i];
3681 		pdu_tmp = spdk_iscsi_task_get_pdu(task);
3682 		if ((lun == NULL || lun == task->scsi.lun) &&
3683 		    (pdu == NULL || SN32_LT(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
3684 			conn->outstanding_r2t_tasks[i] = NULL;
3685 			task->outstanding_r2t = 0;
3686 			task->next_r2t_offset = 0;
3687 			task->next_expected_r2t_offset = 0;
3688 			conn->data_out_cnt -= task->data_out_cnt;
3689 			conn->pending_r2t--;
3690 		}
3691 	}
3692 
3693 	for (i = 0; i < pending_r2t; i++) {
3694 		if (conn->outstanding_r2t_tasks[i] != NULL) {
3695 			continue;
3696 		}
3697 		for (j = i + 1; j < pending_r2t; j++) {
3698 			if (conn->outstanding_r2t_tasks[j] != NULL) {
3699 				conn->outstanding_r2t_tasks[i] = conn->outstanding_r2t_tasks[j];
3700 				conn->outstanding_r2t_tasks[j] = NULL;
3701 				break;
3702 			}
3703 		}
3704 	}
3705 
3706 	spdk_del_connection_queued_task(conn, &conn->active_r2t_tasks, lun, pdu);
3707 	spdk_del_connection_queued_task(conn, &conn->queued_r2t_tasks, lun, pdu);
3708 
3709 	spdk_start_queued_transfer_tasks(conn);
3710 }
3711 
3712 /* This function is used to handle the r2t snack */
3713 static int
3714 spdk_iscsi_handle_r2t_snack(struct spdk_iscsi_conn *conn,
3715 			    struct spdk_iscsi_task *task,
3716 			    struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3717 			    uint32_t run_length, int32_t task_tag)
3718 {
3719 	int32_t last_r2tsn;
3720 	int i;
3721 
3722 	if (beg_run < task->acked_r2tsn) {
3723 		SPDK_ERRLOG("ITT: 0x%08x, R2T SNACK requests retransmission of"
3724 			    "R2TSN: from 0x%08x to 0x%08x. But it has already"
3725 			    "ack to R2TSN:0x%08x, protocol error.\n",
3726 			    task_tag, beg_run, (beg_run + run_length),
3727 			    (task->acked_r2tsn - 1));
3728 		return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3729 	}
3730 
3731 	if (run_length) {
3732 		if ((beg_run + run_length) > task->R2TSN) {
3733 			SPDK_ERRLOG("ITT: 0x%08x, received R2T SNACK with"
3734 				    "BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
3735 				    "current R2TSN: 0x%08x, protocol error.\n",
3736 				    task_tag, beg_run, run_length,
3737 				    task->R2TSN);
3738 
3739 			return spdk_iscsi_reject(conn, pdu,
3740 						 ISCSI_REASON_INVALID_PDU_FIELD);
3741 		}
3742 		last_r2tsn = (beg_run + run_length);
3743 	} else {
3744 		last_r2tsn = task->R2TSN;
3745 	}
3746 
3747 	for (i = beg_run; i < last_r2tsn; i++) {
3748 		if (spdk_iscsi_send_r2t_recovery(conn, task, i, false) < 0) {
3749 			SPDK_ERRLOG("The r2t_sn=%d of r2t_task=%p is not sent\n", i, task);
3750 		}
3751 	}
3752 	return 0;
3753 }
3754 
3755 /* This function is used to recover the data in packet */
3756 static int
3757 spdk_iscsi_handle_recovery_datain(struct spdk_iscsi_conn *conn,
3758 				  struct spdk_iscsi_task *task,
3759 				  struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3760 				  uint32_t run_length, uint32_t task_tag)
3761 {
3762 	struct spdk_iscsi_pdu *old_pdu, *pdu_temp;
3763 	uint32_t i;
3764 	struct iscsi_bhs_data_in *datain_header;
3765 	uint32_t last_statsn;
3766 
3767 	task = spdk_iscsi_task_get_primary(task);
3768 
3769 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "spdk_iscsi_handle_recovery_datain\n");
3770 
3771 	if (beg_run < task->acked_data_sn) {
3772 		SPDK_ERRLOG("ITT: 0x%08x, DATA IN SNACK requests retransmission of"
3773 			    "DATASN: from 0x%08x to 0x%08x but already acked to "
3774 			    "DATASN: 0x%08x protocol error\n",
3775 			    task_tag, beg_run,
3776 			    (beg_run + run_length), (task->acked_data_sn - 1));
3777 
3778 		return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3779 	}
3780 
3781 	if (run_length == 0) {
3782 		/* as the DataSN begins at 0 */
3783 		run_length = task->datain_datasn + 1;
3784 	}
3785 
3786 	if ((beg_run + run_length - 1) > task->datain_datasn) {
3787 		SPDK_ERRLOG("Initiator requests BegRun: 0x%08x, RunLength:"
3788 			    "0x%08x greater than maximum DataSN: 0x%08x.\n",
3789 			    beg_run, run_length, task->datain_datasn);
3790 
3791 		return -1;
3792 	} else {
3793 		last_statsn = beg_run + run_length - 1;
3794 	}
3795 
3796 	for (i = beg_run; i <= last_statsn; i++) {
3797 		TAILQ_FOREACH_SAFE(old_pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
3798 			if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3799 				datain_header = (struct iscsi_bhs_data_in *)&old_pdu->bhs;
3800 				if (from_be32(&datain_header->itt) == task_tag &&
3801 				    from_be32(&datain_header->data_sn) == i) {
3802 					TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
3803 					spdk_iscsi_conn_write_pdu(conn, old_pdu);
3804 					break;
3805 				}
3806 			}
3807 		}
3808 	}
3809 	return 0;
3810 }
3811 
3812 /* This function is used to handle the status snack */
3813 static int
3814 spdk_iscsi_handle_status_snack(struct spdk_iscsi_conn *conn,
3815 			       struct spdk_iscsi_pdu *pdu)
3816 {
3817 	uint32_t beg_run;
3818 	uint32_t run_length;
3819 	struct iscsi_bhs_snack_req *reqh;
3820 	uint32_t i;
3821 	uint32_t last_statsn;
3822 	bool found_pdu;
3823 	struct spdk_iscsi_pdu *old_pdu;
3824 
3825 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
3826 	beg_run = from_be32(&reqh->beg_run);
3827 	run_length = from_be32(&reqh->run_len);
3828 
3829 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "beg_run=%d, run_length=%d, conn->StatSN="
3830 		      "%d, conn->exp_statsn=%d\n", beg_run, run_length,
3831 		      conn->StatSN, conn->exp_statsn);
3832 
3833 	if (!beg_run) {
3834 		beg_run = conn->exp_statsn;
3835 	} else if (beg_run < conn->exp_statsn) {
3836 		SPDK_ERRLOG("Got Status SNACK Begrun: 0x%08x, RunLength: 0x%08x "
3837 			    "but already got ExpStatSN: 0x%08x on CID:%hu.\n",
3838 			    beg_run, run_length, conn->StatSN, conn->cid);
3839 
3840 		return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3841 	}
3842 
3843 	last_statsn = (!run_length) ? conn->StatSN : (beg_run + run_length);
3844 
3845 	for (i = beg_run; i < last_statsn; i++) {
3846 		found_pdu = false;
3847 		TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
3848 			if (from_be32(&old_pdu->bhs.stat_sn) == i) {
3849 				found_pdu = true;
3850 				break;
3851 			}
3852 		}
3853 
3854 		if (!found_pdu) {
3855 			SPDK_ERRLOG("Unable to find StatSN: 0x%08x. For a Status"
3856 				    "SNACK, assuming this is a proactive SNACK "
3857 				    "for an untransmitted StatSN, ignoring.\n",
3858 				    beg_run);
3859 		} else {
3860 			TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
3861 			spdk_iscsi_conn_write_pdu(conn, old_pdu);
3862 		}
3863 	}
3864 
3865 	return 0;
3866 }
3867 
3868 /* This function is used to handle the data ack snack */
3869 static int
3870 spdk_iscsi_handle_data_ack(struct spdk_iscsi_conn *conn,
3871 			   struct spdk_iscsi_pdu *pdu)
3872 {
3873 	uint32_t transfer_tag;
3874 	uint32_t beg_run;
3875 	uint32_t run_length;
3876 	struct spdk_iscsi_pdu *old_pdu;
3877 	uint32_t old_datasn;
3878 	struct iscsi_bhs_snack_req *reqh;
3879 	struct spdk_iscsi_task *task;
3880 	struct iscsi_bhs_data_in *datain_header;
3881 	struct spdk_iscsi_task *primary;
3882 
3883 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
3884 	transfer_tag = from_be32(&reqh->ttt);
3885 	beg_run = from_be32(&reqh->beg_run);
3886 	run_length = from_be32(&reqh->run_len);
3887 	task = NULL;
3888 	datain_header = NULL;
3889 
3890 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "beg_run=%d,transfer_tag=%d,run_len=%d\n",
3891 		      beg_run, transfer_tag, run_length);
3892 
3893 	task = spdk_get_scsi_task_from_ttt(conn, transfer_tag);
3894 	if (!task) {
3895 		SPDK_ERRLOG("Data ACK SNACK for TTT: 0x%08x is invalid.\n",
3896 			    transfer_tag);
3897 		goto reject_return;
3898 	}
3899 
3900 	primary = spdk_iscsi_task_get_primary(task);
3901 	if ((run_length != 0) || (beg_run < primary->acked_data_sn)) {
3902 		SPDK_ERRLOG("TTT: 0x%08x Data ACK SNACK BegRUN: %d is less than "
3903 			    "the next expected acked DataSN: %d\n",
3904 			    transfer_tag, beg_run, primary->acked_data_sn);
3905 		goto reject_return;
3906 	}
3907 
3908 	primary->acked_data_sn = beg_run;
3909 
3910 	/* To free the pdu */
3911 	TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
3912 		if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3913 			datain_header = (struct iscsi_bhs_data_in *) &old_pdu->bhs;
3914 			old_datasn = from_be32(&datain_header->data_sn);
3915 			if ((from_be32(&datain_header->ttt) == transfer_tag) &&
3916 			    (old_datasn == beg_run - 1)) {
3917 				TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
3918 				if (old_pdu->task) {
3919 					spdk_iscsi_task_put(old_pdu->task);
3920 				}
3921 				spdk_put_pdu(old_pdu);
3922 				break;
3923 			}
3924 		}
3925 	}
3926 
3927 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Received Data ACK SNACK for TTT: 0x%08x,"
3928 		      " updated acked DataSN to 0x%08x.\n", transfer_tag,
3929 		      (task->acked_data_sn - 1));
3930 
3931 	return 0;
3932 
3933 reject_return:
3934 	return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_SNACK);
3935 }
3936 
3937 /* This function is used to remove the r2t pdu from snack_pdu_list by < task, r2t_sn> info */
3938 static struct spdk_iscsi_pdu *
3939 spdk_iscsi_remove_r2t_pdu_from_snack_list(struct spdk_iscsi_conn *conn,
3940 		struct spdk_iscsi_task *task,
3941 		uint32_t r2t_sn)
3942 {
3943 	struct spdk_iscsi_pdu *pdu;
3944 	struct iscsi_bhs_r2t *r2t_header;
3945 
3946 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3947 		if (pdu->bhs.opcode == ISCSI_OP_R2T) {
3948 			r2t_header = (struct iscsi_bhs_r2t *)&pdu->bhs;
3949 			if (pdu->task == task &&
3950 			    from_be32(&r2t_header->r2t_sn) == r2t_sn) {
3951 				TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
3952 				return pdu;
3953 			}
3954 		}
3955 	}
3956 
3957 	return NULL;
3958 }
3959 
3960 /* This function is used re-send the r2t packet */
3961 static int
3962 spdk_iscsi_send_r2t_recovery(struct spdk_iscsi_conn *conn,
3963 			     struct spdk_iscsi_task *task, uint32_t r2t_sn,
3964 			     bool send_new_r2tsn)
3965 {
3966 	struct spdk_iscsi_pdu *pdu;
3967 	struct iscsi_bhs_r2t *rsph;
3968 	uint32_t transfer_len;
3969 	uint32_t len;
3970 	int rc;
3971 
3972 	/* remove the r2t pdu from the snack_list */
3973 	pdu = spdk_iscsi_remove_r2t_pdu_from_snack_list(conn, task, r2t_sn);
3974 	if (!pdu) {
3975 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "No pdu is found\n");
3976 		return -1;
3977 	}
3978 
3979 	/* flag
3980 	 * false: only need to re-send the old r2t with changing statsn
3981 	 * true: we send a r2t with new r2tsn
3982 	 */
3983 	if (!send_new_r2tsn) {
3984 		to_be32(&pdu->bhs.stat_sn, conn->StatSN);
3985 		spdk_iscsi_conn_write_pdu(conn, pdu);
3986 	} else {
3987 		rsph = (struct iscsi_bhs_r2t *)&pdu->bhs;
3988 		transfer_len = from_be32(&rsph->desired_xfer_len);
3989 
3990 		/* still need to increase the acked r2tsn */
3991 		task->acked_r2tsn++;
3992 		len = DMIN32(conn->sess->MaxBurstLength, (transfer_len -
3993 				task->next_expected_r2t_offset));
3994 
3995 		/* remove the old_r2t_pdu */
3996 		if (pdu->task) {
3997 			spdk_iscsi_task_put(pdu->task);
3998 		}
3999 		spdk_put_pdu(pdu);
4000 
4001 		/* re-send a new r2t pdu */
4002 		rc = spdk_iscsi_send_r2t(conn, task, task->next_expected_r2t_offset,
4003 					 len, task->ttt, &task->R2TSN);
4004 		if (rc < 0) {
4005 			return SPDK_ISCSI_CONNECTION_FATAL;
4006 		}
4007 	}
4008 
4009 	return 0;
4010 }
4011 
4012 /* This function is used to handle the snack request from the initiator */
4013 static int
4014 spdk_iscsi_op_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4015 {
4016 	struct iscsi_bhs_snack_req *reqh;
4017 	struct spdk_iscsi_task *task;
4018 	int type;
4019 	uint32_t task_tag;
4020 	uint32_t beg_run;
4021 	uint32_t run_length;
4022 	int rc;
4023 
4024 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4025 		SPDK_ERRLOG("ISCSI_OP_SNACK not allowed in  discovery session\n");
4026 		return SPDK_ISCSI_CONNECTION_FATAL;
4027 	}
4028 
4029 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4030 	if (!conn->sess->ErrorRecoveryLevel) {
4031 		SPDK_ERRLOG("Got a SNACK request in ErrorRecoveryLevel=0\n");
4032 		return spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4033 	}
4034 
4035 	type = reqh->flags & ISCSI_FLAG_SNACK_TYPE_MASK;
4036 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "The value of type is %d\n", type);
4037 
4038 	switch (type) {
4039 	case 0:
4040 		reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4041 		task_tag = from_be32(&reqh->itt);
4042 		beg_run = from_be32(&reqh->beg_run);
4043 		run_length = from_be32(&reqh->run_len);
4044 
4045 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "beg_run=%d, run_length=%d, "
4046 			      "task_tag=%x, transfer_tag=%u\n", beg_run,
4047 			      run_length, task_tag, from_be32(&reqh->ttt));
4048 
4049 		task = spdk_get_scsi_task_from_itt(conn, task_tag,
4050 						   ISCSI_OP_SCSI_DATAIN);
4051 		if (task) {
4052 			return spdk_iscsi_handle_recovery_datain(conn, task, pdu,
4053 					beg_run, run_length, task_tag);
4054 		}
4055 		task = spdk_get_scsi_task_from_itt(conn, task_tag, ISCSI_OP_R2T);
4056 		if (task) {
4057 			return spdk_iscsi_handle_r2t_snack(conn, task, pdu, beg_run,
4058 							   run_length, task_tag);
4059 		}
4060 		SPDK_ERRLOG("It is Neither datain nor r2t recovery request\n");
4061 		rc = -1;
4062 		break;
4063 	case ISCSI_FLAG_SNACK_TYPE_STATUS:
4064 		rc = spdk_iscsi_handle_status_snack(conn, pdu);
4065 		break;
4066 	case ISCSI_FLAG_SNACK_TYPE_DATA_ACK:
4067 		rc = spdk_iscsi_handle_data_ack(conn, pdu);
4068 		break;
4069 	case ISCSI_FLAG_SNACK_TYPE_RDATA:
4070 		SPDK_ERRLOG("R-Data SNACK is Not Supported int spdk\n");
4071 		rc = spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4072 		break;
4073 	default:
4074 		SPDK_ERRLOG("Unknown SNACK type %d, protocol error\n", type);
4075 		rc = spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4076 		break;
4077 	}
4078 
4079 	return rc;
4080 }
4081 
4082 /* This function is used to refree the pdu when it is acknowledged */
4083 static void
4084 spdk_remove_acked_pdu(struct spdk_iscsi_conn *conn,
4085 		      uint32_t ExpStatSN)
4086 {
4087 	struct spdk_iscsi_pdu *pdu, *pdu_temp;
4088 	uint32_t stat_sn;
4089 
4090 	conn->exp_statsn = DMIN32(ExpStatSN, conn->StatSN);
4091 	TAILQ_FOREACH_SAFE(pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
4092 		stat_sn = from_be32(&pdu->bhs.stat_sn);
4093 		if (SN32_LT(stat_sn, conn->exp_statsn)) {
4094 			TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
4095 			spdk_iscsi_conn_free_pdu(conn, pdu);
4096 		}
4097 	}
4098 }
4099 
4100 static int spdk_iscsi_op_data(struct spdk_iscsi_conn *conn,
4101 			      struct spdk_iscsi_pdu *pdu)
4102 {
4103 	struct spdk_iscsi_task	*task, *subtask;
4104 	struct iscsi_bhs_data_out *reqh;
4105 	struct spdk_scsi_lun	*lun_dev;
4106 	uint32_t transfer_tag;
4107 	uint32_t task_tag;
4108 	uint32_t transfer_len;
4109 	uint32_t DataSN;
4110 	uint32_t buffer_offset;
4111 	uint32_t len;
4112 	int F_bit;
4113 	int rc;
4114 	int reject_reason = ISCSI_REASON_INVALID_PDU_FIELD;
4115 
4116 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4117 		SPDK_ERRLOG("ISCSI_OP_SCSI_DATAOUT not allowed in discovery session\n");
4118 		return SPDK_ISCSI_CONNECTION_FATAL;
4119 	}
4120 
4121 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4122 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
4123 	transfer_tag = from_be32(&reqh->ttt);
4124 	task_tag = from_be32(&reqh->itt);
4125 	DataSN = from_be32(&reqh->data_sn);
4126 	buffer_offset = from_be32(&reqh->buffer_offset);
4127 
4128 	task = spdk_get_transfer_task(conn, transfer_tag);
4129 	if (task == NULL) {
4130 		SPDK_ERRLOG("Not found task for transfer_tag=%x\n", transfer_tag);
4131 		goto reject_return;
4132 	}
4133 
4134 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
4135 
4136 	if (pdu->data_segment_len > task->desired_data_transfer_length) {
4137 		SPDK_ERRLOG("the dataout pdu data length is larger than the value sent by R2T PDU\n");
4138 		return SPDK_ISCSI_CONNECTION_FATAL;
4139 	}
4140 
4141 	if (task->tag != task_tag) {
4142 		SPDK_ERRLOG("The r2t task tag is %u, and the dataout task tag is %u\n",
4143 			    task->tag, task_tag);
4144 		goto reject_return;
4145 	}
4146 
4147 	if (DataSN != task->r2t_datasn) {
4148 		SPDK_ERRLOG("DataSN(%u) exp=%d error\n", DataSN, task->r2t_datasn);
4149 		if (conn->sess->ErrorRecoveryLevel >= 1) {
4150 			goto send_r2t_recovery_return;
4151 		} else {
4152 			reject_reason = ISCSI_REASON_PROTOCOL_ERROR;
4153 			goto reject_return;
4154 		}
4155 	}
4156 
4157 	if (buffer_offset != task->next_expected_r2t_offset) {
4158 		SPDK_ERRLOG("offset(%u) error\n", buffer_offset);
4159 		return SPDK_ISCSI_CONNECTION_FATAL;
4160 	}
4161 
4162 	transfer_len = task->scsi.transfer_len;
4163 	task->current_r2t_length += pdu->data_segment_len;
4164 	task->next_expected_r2t_offset += pdu->data_segment_len;
4165 	task->r2t_datasn++;
4166 
4167 	if (task->current_r2t_length > conn->sess->MaxBurstLength) {
4168 		SPDK_ERRLOG("R2T burst(%u) > MaxBurstLength(%u)\n",
4169 			    task->current_r2t_length,
4170 			    conn->sess->MaxBurstLength);
4171 		return SPDK_ISCSI_CONNECTION_FATAL;
4172 	}
4173 
4174 	if (F_bit) {
4175 		/*
4176 		 * This R2T burst is done.  Clear the length before we
4177 		 *  receive a PDU for the next R2T burst.
4178 		 */
4179 		task->current_r2t_length = 0;
4180 	}
4181 
4182 	subtask = spdk_iscsi_task_get(conn, task, spdk_iscsi_task_cpl);
4183 	if (subtask == NULL) {
4184 		SPDK_ERRLOG("Unable to acquire subtask\n");
4185 		return SPDK_ISCSI_CONNECTION_FATAL;
4186 	}
4187 	subtask->scsi.offset = buffer_offset;
4188 	subtask->scsi.length = pdu->data_segment_len;
4189 	spdk_scsi_task_set_data(&subtask->scsi, pdu->data, pdu->data_segment_len);
4190 	spdk_iscsi_task_associate_pdu(subtask, pdu);
4191 
4192 	if (task->next_expected_r2t_offset == transfer_len) {
4193 		task->acked_r2tsn++;
4194 	} else if (F_bit && (task->next_r2t_offset < transfer_len)) {
4195 		task->acked_r2tsn++;
4196 		len = DMIN32(conn->sess->MaxBurstLength, (transfer_len -
4197 				task->next_r2t_offset));
4198 		rc = spdk_iscsi_send_r2t(conn, task, task->next_r2t_offset, len,
4199 					 task->ttt, &task->R2TSN);
4200 		if (rc < 0) {
4201 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
4202 		}
4203 		task->next_r2t_offset += len;
4204 	}
4205 
4206 	if (lun_dev == NULL) {
4207 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "LUN %d is removed, complete the task immediately\n",
4208 			      task->lun_id);
4209 		subtask->scsi.transfer_len = subtask->scsi.length;
4210 		spdk_scsi_task_process_null_lun(&subtask->scsi);
4211 		spdk_iscsi_task_cpl(&subtask->scsi);
4212 		return 0;
4213 	}
4214 
4215 	spdk_iscsi_queue_task(conn, subtask);
4216 	return 0;
4217 
4218 send_r2t_recovery_return:
4219 	rc = spdk_iscsi_send_r2t_recovery(conn, task, task->acked_r2tsn, true);
4220 	if (rc == 0) {
4221 		return 0;
4222 	}
4223 
4224 reject_return:
4225 	return spdk_iscsi_reject(conn, pdu, reject_reason);
4226 }
4227 
4228 static int
4229 spdk_iscsi_send_r2t(struct spdk_iscsi_conn *conn,
4230 		    struct spdk_iscsi_task *task, int offset,
4231 		    int len, uint32_t transfer_tag, uint32_t *R2TSN)
4232 {
4233 	struct spdk_iscsi_pdu *rsp_pdu;
4234 	struct iscsi_bhs_r2t *rsph;
4235 
4236 	/* R2T PDU */
4237 	rsp_pdu = spdk_get_pdu();
4238 	if (rsp_pdu == NULL) {
4239 		return SPDK_ISCSI_CONNECTION_FATAL;
4240 	}
4241 	rsph = (struct iscsi_bhs_r2t *)&rsp_pdu->bhs;
4242 	rsp_pdu->data = NULL;
4243 	rsph->opcode = ISCSI_OP_R2T;
4244 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
4245 	to_be64(&rsph->lun, task->lun_id);
4246 	to_be32(&rsph->itt, task->tag);
4247 	to_be32(&rsph->ttt, transfer_tag);
4248 
4249 	to_be32(&rsph->stat_sn, conn->StatSN);
4250 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
4251 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
4252 
4253 	to_be32(&rsph->r2t_sn, *R2TSN);
4254 	*R2TSN += 1;
4255 
4256 	task->r2t_datasn = 0; /* next expected datasn to ack */
4257 
4258 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
4259 	to_be32(&rsph->desired_xfer_len, (uint32_t)len);
4260 	task->desired_data_transfer_length = (size_t)len;
4261 
4262 	/* we need to hold onto this task/cmd because until the PDU has been
4263 	 * written out */
4264 	rsp_pdu->task = task;
4265 	task->scsi.ref++;
4266 
4267 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
4268 
4269 	return SPDK_SUCCESS;
4270 }
4271 
4272 void spdk_iscsi_send_nopin(struct spdk_iscsi_conn *conn)
4273 {
4274 	struct spdk_iscsi_pdu *rsp_pdu;
4275 	struct iscsi_bhs_nop_in	*rsp;
4276 
4277 	/* Only send nopin if we have logged in and are in a normal session. */
4278 	if (conn->sess == NULL ||
4279 	    !conn->full_feature ||
4280 	    !spdk_iscsi_param_eq_val(conn->sess->params, "SessionType", "Normal")) {
4281 		return;
4282 	}
4283 
4284 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "send NOPIN isid=%"PRIx64", tsih=%u, cid=%u\n",
4285 		      conn->sess->isid, conn->sess->tsih, conn->cid);
4286 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
4287 		      conn->StatSN, conn->sess->ExpCmdSN,
4288 		      conn->sess->MaxCmdSN);
4289 
4290 	rsp_pdu = spdk_get_pdu();
4291 	rsp = (struct iscsi_bhs_nop_in *) &rsp_pdu->bhs;
4292 	rsp_pdu->data = NULL;
4293 
4294 	/*
4295 	 * spdk_get_pdu() memset's the PDU for us, so only fill out the needed
4296 	 *  fields.
4297 	 */
4298 	rsp->opcode = ISCSI_OP_NOPIN;
4299 	rsp->flags = 0x80;
4300 	/*
4301 	 * Technically the to_be32() is not needed here, since
4302 	 *  to_be32(0xFFFFFFFU) returns 0xFFFFFFFFU.
4303 	 */
4304 	to_be32(&rsp->itt, 0xFFFFFFFFU);
4305 	to_be32(&rsp->ttt, conn->id);
4306 	to_be32(&rsp->stat_sn, conn->StatSN);
4307 	to_be32(&rsp->exp_cmd_sn, conn->sess->ExpCmdSN);
4308 	to_be32(&rsp->max_cmd_sn, conn->sess->MaxCmdSN);
4309 
4310 	spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
4311 	conn->last_nopin = spdk_get_ticks();
4312 	conn->nop_outstanding = true;
4313 }
4314 
4315 static void
4316 spdk_init_login_reject_response(struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
4317 {
4318 	struct iscsi_bhs_login_rsp *rsph;
4319 
4320 	memset(rsp_pdu, 0, sizeof(struct spdk_iscsi_pdu));
4321 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
4322 	rsph->version_max = ISCSI_VERSION;
4323 	rsph->version_act = ISCSI_VERSION;
4324 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
4325 	rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
4326 	rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
4327 	rsph->itt = pdu->bhs.itt;
4328 }
4329 
4330 int
4331 spdk_iscsi_execute(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4332 {
4333 	int opcode;
4334 	int rc;
4335 	struct spdk_iscsi_pdu *rsp_pdu = NULL;
4336 	uint32_t ExpStatSN;
4337 	uint32_t QCmdSN;
4338 	int I_bit;
4339 	struct spdk_iscsi_sess *sess;
4340 	struct iscsi_bhs_scsi_req *reqh;
4341 
4342 	if (pdu == NULL) {
4343 		return -1;
4344 	}
4345 
4346 	opcode = pdu->bhs.opcode;
4347 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
4348 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
4349 
4350 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "opcode %x\n", opcode);
4351 
4352 	if (opcode == ISCSI_OP_LOGIN) {
4353 		rc = spdk_iscsi_op_login(conn, pdu);
4354 		if (rc < 0) {
4355 			SPDK_ERRLOG("iscsi_op_login() failed\n");
4356 		}
4357 		return rc;
4358 	}
4359 
4360 	/* connection in login phase but receive non-login opcode
4361 	 * return response code 0x020b to initiator.
4362 	 * */
4363 	if (!conn->full_feature && conn->state == ISCSI_CONN_STATE_RUNNING) {
4364 		rsp_pdu = spdk_get_pdu();
4365 		if (rsp_pdu == NULL) {
4366 			return SPDK_ISCSI_CONNECTION_FATAL;
4367 		}
4368 		spdk_init_login_reject_response(pdu, rsp_pdu);
4369 		spdk_iscsi_conn_write_pdu(conn, rsp_pdu);
4370 		SPDK_ERRLOG("Received opcode %d in login phase\n", opcode);
4371 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
4372 	} else if (conn->state == ISCSI_CONN_STATE_INVALID) {
4373 		SPDK_ERRLOG("before Full Feature\n");
4374 		return SPDK_ISCSI_CONNECTION_FATAL;
4375 	}
4376 
4377 	sess = conn->sess;
4378 	if (!sess) {
4379 		SPDK_ERRLOG("Connection has no associated session!\n");
4380 		return SPDK_ISCSI_CONNECTION_FATAL;
4381 	}
4382 	I_bit = reqh->immediate;
4383 	if (I_bit == 0) {
4384 		if (SN32_LT(pdu->cmd_sn, sess->ExpCmdSN) ||
4385 		    SN32_GT(pdu->cmd_sn, sess->MaxCmdSN)) {
4386 			if (sess->session_type == SESSION_TYPE_NORMAL &&
4387 			    opcode != ISCSI_OP_SCSI_DATAOUT) {
4388 				SPDK_ERRLOG("CmdSN(%u) ignore (ExpCmdSN=%u, MaxCmdSN=%u)\n",
4389 					    pdu->cmd_sn, sess->ExpCmdSN, sess->MaxCmdSN);
4390 
4391 				if (sess->ErrorRecoveryLevel >= 1) {
4392 					SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Skip the error in ERL 1 and 2\n");
4393 				} else {
4394 					return SPDK_PDU_FATAL;
4395 				}
4396 			}
4397 		}
4398 	} else if (pdu->cmd_sn != sess->ExpCmdSN) {
4399 		SPDK_ERRLOG("CmdSN(%u) error ExpCmdSN=%u\n", pdu->cmd_sn, sess->ExpCmdSN);
4400 
4401 		if (sess->ErrorRecoveryLevel >= 1) {
4402 			SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Skip the error in ERL 1 and 2\n");
4403 		} else if (opcode != ISCSI_OP_NOPOUT) {
4404 			/*
4405 			 * The Linux initiator does not send valid CmdSNs for
4406 			 *  nopout under heavy load, so do not close the
4407 			 *  connection in that case.
4408 			 */
4409 			return SPDK_ISCSI_CONNECTION_FATAL;
4410 		}
4411 	}
4412 
4413 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
4414 	if (SN32_GT(ExpStatSN, conn->StatSN)) {
4415 		SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "StatSN(%u) advanced\n", ExpStatSN);
4416 		ExpStatSN = conn->StatSN;
4417 	}
4418 
4419 	if (sess->ErrorRecoveryLevel >= 1) {
4420 		spdk_remove_acked_pdu(conn, ExpStatSN);
4421 	}
4422 
4423 	if (opcode == ISCSI_OP_NOPOUT || opcode == ISCSI_OP_SCSI) {
4424 		QCmdSN = sess->MaxCmdSN - sess->ExpCmdSN + 1;
4425 		QCmdSN += sess->queue_depth;
4426 		if (SN32_LT(ExpStatSN + QCmdSN, conn->StatSN)) {
4427 			SPDK_ERRLOG("StatSN(%u/%u) QCmdSN(%u) error\n",
4428 				    ExpStatSN, conn->StatSN, QCmdSN);
4429 			return SPDK_ISCSI_CONNECTION_FATAL;
4430 		}
4431 	}
4432 
4433 	if (!I_bit && opcode != ISCSI_OP_SCSI_DATAOUT) {
4434 		sess->ExpCmdSN++;
4435 	}
4436 
4437 	switch (opcode) {
4438 	case ISCSI_OP_NOPOUT:
4439 		rc = spdk_iscsi_op_nopout(conn, pdu);
4440 		if (rc < 0) {
4441 			SPDK_ERRLOG("spdk_iscsi_op_nopout() failed\n");
4442 			return rc;
4443 		}
4444 		break;
4445 
4446 	case ISCSI_OP_SCSI:
4447 		rc = spdk_iscsi_op_scsi(conn, pdu);
4448 		if (rc < 0) {
4449 			SPDK_ERRLOG("spdk_iscsi_op_scsi() failed\n");
4450 			return rc;
4451 		}
4452 		break;
4453 	case ISCSI_OP_TASK:
4454 		rc = spdk_iscsi_op_task(conn, pdu);
4455 		if (rc < 0) {
4456 			SPDK_ERRLOG("spdk_iscsi_op_task() failed\n");
4457 			return rc;
4458 		}
4459 		break;
4460 
4461 	case ISCSI_OP_TEXT:
4462 		rc = spdk_iscsi_op_text(conn, pdu);
4463 		if (rc < 0) {
4464 			SPDK_ERRLOG("spdk_iscsi_op_text() failed\n");
4465 			return rc;
4466 		}
4467 		break;
4468 
4469 	case ISCSI_OP_LOGOUT:
4470 		rc = spdk_iscsi_op_logout(conn, pdu);
4471 		if (rc < 0) {
4472 			SPDK_ERRLOG("spdk_iscsi_op_logout() failed\n");
4473 			return rc;
4474 		}
4475 		break;
4476 
4477 	case ISCSI_OP_SCSI_DATAOUT:
4478 		rc = spdk_iscsi_op_data(conn, pdu);
4479 		if (rc < 0) {
4480 			SPDK_ERRLOG("spdk_iscsi_op_data() failed\n");
4481 			return rc;
4482 		}
4483 		break;
4484 
4485 	case ISCSI_OP_SNACK:
4486 		rc = spdk_iscsi_op_snack(conn, pdu);
4487 		if (rc < 0) {
4488 			SPDK_ERRLOG("spdk_iscsi_op_snack() failed\n");
4489 			return rc;
4490 		}
4491 		break;
4492 
4493 	default:
4494 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4495 		return  spdk_iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4496 	}
4497 
4498 	return 0;
4499 }
4500 
4501 void spdk_free_sess(struct spdk_iscsi_sess *sess)
4502 {
4503 	if (sess == NULL) {
4504 		return;
4505 	}
4506 
4507 	sess->tag = 0;
4508 	sess->target = NULL;
4509 	sess->session_type = SESSION_TYPE_INVALID;
4510 	spdk_iscsi_param_free(sess->params);
4511 	free(sess->conns);
4512 	spdk_scsi_port_free(&sess->initiator_port);
4513 	spdk_mempool_put(g_spdk_iscsi.session_pool, (void *)sess);
4514 }
4515 
4516 static int
4517 spdk_create_iscsi_sess(struct spdk_iscsi_conn *conn,
4518 		       struct spdk_iscsi_tgt_node *target,
4519 		       enum session_type session_type)
4520 {
4521 	struct spdk_iscsi_sess *sess;
4522 	int rc;
4523 
4524 	sess = spdk_mempool_get(g_spdk_iscsi.session_pool);
4525 	if (!sess) {
4526 		SPDK_ERRLOG("Unable to get session object\n");
4527 		SPDK_ERRLOG("MaxSessions set to %d\n", g_spdk_iscsi.MaxSessions);
4528 		return -ENOMEM;
4529 	}
4530 
4531 	/* configuration values */
4532 	pthread_mutex_lock(&g_spdk_iscsi.mutex);
4533 
4534 	sess->MaxConnections = g_spdk_iscsi.MaxConnectionsPerSession;
4535 	sess->MaxOutstandingR2T = DEFAULT_MAXOUTSTANDINGR2T;
4536 
4537 	sess->DefaultTime2Wait = g_spdk_iscsi.DefaultTime2Wait;
4538 	sess->DefaultTime2Retain = g_spdk_iscsi.DefaultTime2Retain;
4539 	sess->FirstBurstLength = g_spdk_iscsi.FirstBurstLength;
4540 	sess->MaxBurstLength = SPDK_ISCSI_MAX_BURST_LENGTH;
4541 	sess->InitialR2T = DEFAULT_INITIALR2T;
4542 	sess->ImmediateData = g_spdk_iscsi.ImmediateData;
4543 	sess->DataPDUInOrder = DEFAULT_DATAPDUINORDER;
4544 	sess->DataSequenceInOrder = DEFAULT_DATASEQUENCEINORDER;
4545 	sess->ErrorRecoveryLevel = g_spdk_iscsi.ErrorRecoveryLevel;
4546 
4547 	pthread_mutex_unlock(&g_spdk_iscsi.mutex);
4548 
4549 	sess->tag = conn->portal->group->tag;
4550 
4551 	sess->conns = calloc(sess->MaxConnections, sizeof(*sess->conns));
4552 	if (!sess->conns) {
4553 		SPDK_ERRLOG("calloc() failed for connection array\n");
4554 		return -ENOMEM;
4555 	}
4556 
4557 	sess->connections = 0;
4558 
4559 	sess->conns[sess->connections] = conn;
4560 	sess->connections++;
4561 
4562 	sess->params = NULL;
4563 	sess->target = NULL;
4564 	sess->isid = 0;
4565 	sess->session_type = session_type;
4566 	sess->current_text_itt = 0xffffffffU;
4567 
4568 	/* set default params */
4569 	rc = spdk_iscsi_sess_params_init(&sess->params);
4570 	if (rc < 0) {
4571 		SPDK_ERRLOG("iscsi_sess_params_init() failed\n");
4572 		goto error_return;
4573 	}
4574 	/* replace with config value */
4575 	rc = spdk_iscsi_param_set_int(sess->params, "MaxConnections",
4576 				      sess->MaxConnections);
4577 	if (rc < 0) {
4578 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
4579 		goto error_return;
4580 	}
4581 
4582 	rc = spdk_iscsi_param_set_int(sess->params, "MaxOutstandingR2T",
4583 				      sess->MaxOutstandingR2T);
4584 	if (rc < 0) {
4585 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
4586 		goto error_return;
4587 	}
4588 
4589 	rc = spdk_iscsi_param_set_int(sess->params, "DefaultTime2Wait",
4590 				      sess->DefaultTime2Wait);
4591 	if (rc < 0) {
4592 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
4593 		goto error_return;
4594 	}
4595 
4596 	rc = spdk_iscsi_param_set_int(sess->params, "DefaultTime2Retain",
4597 				      sess->DefaultTime2Retain);
4598 	if (rc < 0) {
4599 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
4600 		goto error_return;
4601 	}
4602 
4603 	rc = spdk_iscsi_param_set_int(sess->params, "FirstBurstLength",
4604 				      sess->FirstBurstLength);
4605 	if (rc < 0) {
4606 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
4607 		goto error_return;
4608 	}
4609 
4610 	rc = spdk_iscsi_param_set_int(sess->params, "MaxBurstLength",
4611 				      sess->MaxBurstLength);
4612 	if (rc < 0) {
4613 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
4614 		goto error_return;
4615 	}
4616 
4617 	rc = spdk_iscsi_param_set(sess->params, "InitialR2T",
4618 				  sess->InitialR2T ? "Yes" : "No");
4619 	if (rc < 0) {
4620 		SPDK_ERRLOG("iscsi_param_set() failed\n");
4621 		goto error_return;
4622 	}
4623 
4624 	rc = spdk_iscsi_param_set(sess->params, "ImmediateData",
4625 				  sess->ImmediateData ? "Yes" : "No");
4626 	if (rc < 0) {
4627 		SPDK_ERRLOG("iscsi_param_set() failed\n");
4628 		goto error_return;
4629 	}
4630 
4631 	rc = spdk_iscsi_param_set(sess->params, "DataPDUInOrder",
4632 				  sess->DataPDUInOrder ? "Yes" : "No");
4633 	if (rc < 0) {
4634 		SPDK_ERRLOG("iscsi_param_set() failed\n");
4635 		goto error_return;
4636 	}
4637 
4638 	rc = spdk_iscsi_param_set(sess->params, "DataSequenceInOrder",
4639 				  sess->DataSequenceInOrder ? "Yes" : "No");
4640 	if (rc < 0) {
4641 		SPDK_ERRLOG("iscsi_param_set() failed\n");
4642 		goto error_return;
4643 	}
4644 
4645 	rc = spdk_iscsi_param_set_int(sess->params, "ErrorRecoveryLevel",
4646 				      sess->ErrorRecoveryLevel);
4647 	if (rc < 0) {
4648 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
4649 		goto error_return;
4650 	}
4651 
4652 	/* realloc buffer */
4653 	rc = spdk_iscsi_param_set_int(conn->params, "MaxRecvDataSegmentLength",
4654 				      conn->MaxRecvDataSegmentLength);
4655 	if (rc < 0) {
4656 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
4657 		goto error_return;
4658 	}
4659 
4660 	/* sess for first connection of session */
4661 	conn->sess = sess;
4662 	return 0;
4663 
4664 error_return:
4665 	spdk_free_sess(sess);
4666 	conn->sess = NULL;
4667 	return -1;
4668 }
4669 
4670 static struct spdk_iscsi_sess *
4671 spdk_get_iscsi_sess_by_tsih(uint16_t tsih)
4672 {
4673 	struct spdk_iscsi_sess *session;
4674 
4675 	if (tsih == 0 || tsih > g_spdk_iscsi.MaxSessions) {
4676 		return NULL;
4677 	}
4678 
4679 	session = g_spdk_iscsi.session[tsih - 1];
4680 	assert(tsih == session->tsih);
4681 
4682 	return session;
4683 }
4684 
4685 static int
4686 spdk_append_iscsi_sess(struct spdk_iscsi_conn *conn,
4687 		       const char *initiator_port_name, uint16_t tsih, uint16_t cid)
4688 {
4689 	struct spdk_iscsi_sess *sess;
4690 
4691 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "append session: init port name=%s, tsih=%u, cid=%u\n",
4692 		      initiator_port_name, tsih, cid);
4693 
4694 	sess = spdk_get_iscsi_sess_by_tsih(tsih);
4695 	if (sess == NULL) {
4696 		SPDK_ERRLOG("spdk_get_iscsi_sess_by_tsih failed\n");
4697 		return -1;
4698 	}
4699 	if ((conn->portal->group->tag != sess->tag) ||
4700 	    (strcasecmp(initiator_port_name, spdk_scsi_port_get_name(sess->initiator_port)) != 0) ||
4701 	    (conn->target != sess->target)) {
4702 		/* no match */
4703 		SPDK_ERRLOG("no MCS session for init port name=%s, tsih=%d, cid=%d\n",
4704 			    initiator_port_name, tsih, cid);
4705 		return -1;
4706 	}
4707 
4708 	if (sess->connections >= sess->MaxConnections) {
4709 		/* no slot for connection */
4710 		SPDK_ERRLOG("too many connections for init port name=%s, tsih=%d, cid=%d\n",
4711 			    initiator_port_name, tsih, cid);
4712 		return -1;
4713 	}
4714 
4715 	SPDK_DEBUGLOG(SPDK_LOG_ISCSI, "Connections (tsih %d): %d\n", sess->tsih, sess->connections);
4716 	conn->sess = sess;
4717 
4718 	/*
4719 	 * TODO: need a mutex or other sync mechanism to protect the session's
4720 	 *  connection list.
4721 	 */
4722 	sess->conns[sess->connections] = conn;
4723 	sess->connections++;
4724 
4725 	return 0;
4726 }
4727 
4728 bool spdk_iscsi_is_deferred_free_pdu(struct spdk_iscsi_pdu *pdu)
4729 {
4730 	if (pdu == NULL) {
4731 		return false;
4732 	}
4733 
4734 	if (pdu->bhs.opcode == ISCSI_OP_R2T ||
4735 	    pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
4736 		return true;
4737 	}
4738 
4739 	return false;
4740 }
4741