xref: /spdk/lib/iscsi/iscsi.c (revision 877573897ad52be4fa8989f7617bd655b87e05c4)
1 /*   SPDX-License-Identifier: BSD-3-Clause
2  *   Copyright (C) 2008-2012 Daisuke Aoyama <aoyama@peach.ne.jp>.
3  *   Copyright (C) 2016 Intel Corporation.
4  *   All rights reserved.
5  */
6 
7 #include "spdk/stdinc.h"
8 
9 #include "spdk/base64.h"
10 #include "spdk/crc32.h"
11 #include "spdk/endian.h"
12 #include "spdk/env.h"
13 #include "spdk/likely.h"
14 #include "spdk/trace.h"
15 #include "spdk/sock.h"
16 #include "spdk/string.h"
17 #include "spdk/queue.h"
18 
19 #include "iscsi/md5.h"
20 #include "iscsi/iscsi.h"
21 #include "iscsi/param.h"
22 #include "iscsi/tgt_node.h"
23 #include "iscsi/task.h"
24 #include "iscsi/conn.h"
25 #include "spdk/scsi.h"
26 #include "spdk/bdev.h"
27 #include "iscsi/portal_grp.h"
28 
29 #include "spdk/log.h"
30 
31 #include "spdk_internal/sgl.h"
32 
33 #define MAX_TMPBUF 1024
34 
35 struct spdk_iscsi_globals g_iscsi = {
36 	.mutex = PTHREAD_MUTEX_INITIALIZER,
37 	.portal_head = TAILQ_HEAD_INITIALIZER(g_iscsi.portal_head),
38 	.pg_head = TAILQ_HEAD_INITIALIZER(g_iscsi.pg_head),
39 	.ig_head = TAILQ_HEAD_INITIALIZER(g_iscsi.ig_head),
40 	.target_head = TAILQ_HEAD_INITIALIZER(g_iscsi.target_head),
41 	.auth_group_head = TAILQ_HEAD_INITIALIZER(g_iscsi.auth_group_head),
42 	.poll_group_head = TAILQ_HEAD_INITIALIZER(g_iscsi.poll_group_head),
43 };
44 
45 #define MATCH_DIGEST_WORD(BUF, CRC32C) \
46 	(    ((((uint32_t) *((uint8_t *)(BUF)+0)) << 0)		\
47 	    | (((uint32_t) *((uint8_t *)(BUF)+1)) << 8)		\
48 	    | (((uint32_t) *((uint8_t *)(BUF)+2)) << 16)	\
49 	    | (((uint32_t) *((uint8_t *)(BUF)+3)) << 24))	\
50 	    == (CRC32C))
51 
52 #ifndef SPDK_CONFIG_HAVE_ARC4RANDOM
53 static void
54 srandomdev(void)
55 {
56 	unsigned long seed;
57 	time_t now;
58 	pid_t pid;
59 
60 	pid = getpid();
61 	now = time(NULL);
62 	seed = pid ^ now;
63 	srandom(seed);
64 }
65 
66 static int g_arc4random_initialized = 0;
67 
68 static uint32_t
69 arc4random(void)
70 {
71 	uint32_t r;
72 	uint32_t r1, r2;
73 
74 	if (!g_arc4random_initialized) {
75 		srandomdev();
76 		g_arc4random_initialized = 1;
77 	}
78 	r1 = (uint32_t)(random() & 0xffff);
79 	r2 = (uint32_t)(random() & 0xffff);
80 	r = (r1 << 16) | r2;
81 	return r;
82 }
83 #endif /* SPDK_CONFIG_HAVE_ARC4RANDOM */
84 
85 static void
86 gen_random(uint8_t *buf, size_t len)
87 {
88 	uint32_t r;
89 	size_t idx;
90 
91 	for (idx = 0; idx < len; idx++) {
92 		r = arc4random();
93 		buf[idx] = (uint8_t) r;
94 	}
95 }
96 
97 static uint64_t
98 iscsi_get_isid(const uint8_t isid[6])
99 {
100 	return (uint64_t)isid[0] << 40 |
101 	       (uint64_t)isid[1] << 32 |
102 	       (uint64_t)isid[2] << 24 |
103 	       (uint64_t)isid[3] << 16 |
104 	       (uint64_t)isid[4] << 8 |
105 	       (uint64_t)isid[5];
106 }
107 
108 static int
109 bin2hex(char *buf, size_t len, const uint8_t *data, size_t data_len)
110 {
111 	const char *digits = "0123456789ABCDEF";
112 	size_t total = 0;
113 	size_t idx;
114 
115 	if (len < 3) {
116 		return -1;
117 	}
118 	buf[total] = '0';
119 	total++;
120 	buf[total] = 'x';
121 	total++;
122 	buf[total] = '\0';
123 
124 	for (idx = 0; idx < data_len; idx++) {
125 		if (total + 3 > len) {
126 			buf[total] = '\0';
127 			return - 1;
128 		}
129 		buf[total] = digits[(data[idx] >> 4) & 0x0fU];
130 		total++;
131 		buf[total] = digits[data[idx] & 0x0fU];
132 		total++;
133 	}
134 	buf[total] = '\0';
135 	return total;
136 }
137 
138 static int
139 hex2bin(uint8_t *data, size_t data_len, const char *str)
140 {
141 	const char *digits = "0123456789ABCDEF";
142 	const char *dp;
143 	const char *p;
144 	size_t total = 0;
145 	int n0, n1;
146 
147 	p = str;
148 	if (p[0] != '0' && (p[1] != 'x' && p[1] != 'X')) {
149 		return -1;
150 	}
151 	p += 2;
152 
153 	while (p[0] != '\0' && p[1] != '\0') {
154 		if (total >= data_len) {
155 			return -1;
156 		}
157 		dp = strchr(digits, toupper((int) p[0]));
158 		if (dp == NULL) {
159 			return -1;
160 		}
161 		n0 = (int)(dp - digits);
162 		dp = strchr(digits, toupper((int) p[1]));
163 		if (dp == NULL) {
164 			return -1;
165 		}
166 		n1 = (int)(dp - digits);
167 
168 		data[total] = (uint8_t)(((n0 & 0x0fU) << 4) | (n1 & 0x0fU));
169 		total++;
170 		p += 2;
171 	}
172 	return total;
173 }
174 
175 static int
176 iscsi_reject(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu,
177 	     int reason)
178 {
179 	struct spdk_iscsi_pdu *rsp_pdu;
180 	struct iscsi_bhs_reject *rsph;
181 	uint8_t *data;
182 	int total_ahs_len;
183 	int data_len;
184 	int alloc_len;
185 
186 	pdu->is_rejected = true;
187 
188 	total_ahs_len = pdu->bhs.total_ahs_len;
189 	data_len = 0;
190 	alloc_len = ISCSI_BHS_LEN + (4 * total_ahs_len);
191 
192 	if (conn->header_digest) {
193 		alloc_len += ISCSI_DIGEST_LEN;
194 	}
195 
196 	data = calloc(1, alloc_len);
197 	if (!data) {
198 		SPDK_ERRLOG("calloc() failed for data segment\n");
199 		return -ENOMEM;
200 	}
201 
202 	SPDK_DEBUGLOG(iscsi, "Reject PDU reason=%d\n", reason);
203 
204 	if (conn->sess != NULL) {
205 		SPDK_DEBUGLOG(iscsi,
206 			      "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
207 			      conn->StatSN, conn->sess->ExpCmdSN,
208 			      conn->sess->MaxCmdSN);
209 	} else {
210 		SPDK_DEBUGLOG(iscsi, "StatSN=%u\n", conn->StatSN);
211 	}
212 
213 	memcpy(data, &pdu->bhs, ISCSI_BHS_LEN);
214 	data_len += ISCSI_BHS_LEN;
215 
216 	if (total_ahs_len != 0) {
217 		total_ahs_len = spdk_min((4 * total_ahs_len), ISCSI_AHS_LEN);
218 		memcpy(data + data_len, pdu->ahs, total_ahs_len);
219 		data_len += total_ahs_len;
220 	}
221 
222 	if (conn->header_digest) {
223 		memcpy(data + data_len, pdu->header_digest, ISCSI_DIGEST_LEN);
224 		data_len += ISCSI_DIGEST_LEN;
225 	}
226 
227 	rsp_pdu = iscsi_get_pdu(conn);
228 	if (rsp_pdu == NULL) {
229 		free(data);
230 		return -ENOMEM;
231 	}
232 
233 	rsph = (struct iscsi_bhs_reject *)&rsp_pdu->bhs;
234 	rsp_pdu->data = data;
235 	rsph->opcode = ISCSI_OP_REJECT;
236 	rsph->flags |= 0x80;	/* bit 0 is default to 1 */
237 	rsph->reason = reason;
238 	DSET24(rsph->data_segment_len, data_len);
239 
240 	rsph->ffffffff = 0xffffffffU;
241 	to_be32(&rsph->stat_sn, conn->StatSN);
242 	conn->StatSN++;
243 
244 	if (conn->sess != NULL) {
245 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
246 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
247 	} else {
248 		to_be32(&rsph->exp_cmd_sn, 1);
249 		to_be32(&rsph->max_cmd_sn, 1);
250 	}
251 
252 	SPDK_LOGDUMP(iscsi, "PDU", (void *)&rsp_pdu->bhs, ISCSI_BHS_LEN);
253 
254 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
255 
256 	return 0;
257 }
258 
259 uint32_t
260 iscsi_pdu_calc_header_digest(struct spdk_iscsi_pdu *pdu)
261 {
262 	uint32_t crc32c;
263 	uint32_t ahs_len_bytes = pdu->bhs.total_ahs_len * 4;
264 
265 	crc32c = SPDK_CRC32C_INITIAL;
266 	crc32c = spdk_crc32c_update(&pdu->bhs, ISCSI_BHS_LEN, crc32c);
267 
268 	if (ahs_len_bytes) {
269 		crc32c = spdk_crc32c_update(pdu->ahs, ahs_len_bytes, crc32c);
270 	}
271 
272 	/* BHS and AHS are always 4-byte multiples in length, so no padding is necessary. */
273 
274 	/* Finalize CRC by inverting all bits. */
275 	return crc32c ^ SPDK_CRC32C_XOR;
276 }
277 
278 /* Calculate CRC for each partial data segment. */
279 static void
280 iscsi_pdu_calc_partial_data_digest(struct spdk_iscsi_pdu *pdu)
281 {
282 	struct iovec iov;
283 	uint32_t num_blocks;
284 
285 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
286 		pdu->crc32c = spdk_crc32c_update(pdu->data,
287 						 pdu->data_valid_bytes - pdu->data_offset,
288 						 pdu->crc32c);
289 	} else {
290 		iov.iov_base = pdu->data;
291 		iov.iov_len = pdu->data_buf_len;
292 		num_blocks = pdu->data_buf_len / pdu->dif_ctx.block_size;
293 
294 		spdk_dif_update_crc32c(&iov, 1, num_blocks, &pdu->crc32c, &pdu->dif_ctx);
295 	}
296 }
297 
298 static uint32_t
299 iscsi_pdu_calc_partial_data_digest_done(struct spdk_iscsi_pdu *pdu)
300 {
301 	uint32_t crc32c = pdu->crc32c;
302 	uint32_t mod;
303 
304 	/* Include padding bytes into CRC if any. */
305 	mod = pdu->data_valid_bytes % ISCSI_ALIGNMENT;
306 	if (mod != 0) {
307 		uint32_t pad_length = ISCSI_ALIGNMENT - mod;
308 		uint8_t pad[3] = {0, 0, 0};
309 
310 		assert(pad_length > 0);
311 		assert(pad_length <= sizeof(pad));
312 		crc32c = spdk_crc32c_update(pad, pad_length, crc32c);
313 	}
314 
315 	/* Finalize CRC by inverting all bits. */
316 	return crc32c ^ SPDK_CRC32C_XOR;
317 }
318 
319 uint32_t
320 iscsi_pdu_calc_data_digest(struct spdk_iscsi_pdu *pdu)
321 {
322 	uint32_t data_len = DGET24(pdu->bhs.data_segment_len);
323 	uint32_t crc32c;
324 	uint32_t mod;
325 	struct iovec iov;
326 	uint32_t num_blocks;
327 
328 	/* Initialize CRC. */
329 	crc32c = SPDK_CRC32C_INITIAL;
330 
331 	/* Calculate CRC for the whole data segment. */
332 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
333 		crc32c = spdk_crc32c_update(pdu->data, data_len, crc32c);
334 	} else {
335 		iov.iov_base = pdu->data;
336 		iov.iov_len = pdu->data_buf_len;
337 		num_blocks = pdu->data_buf_len / pdu->dif_ctx.block_size;
338 
339 		spdk_dif_update_crc32c(&iov, 1, num_blocks, &crc32c, &pdu->dif_ctx);
340 	}
341 
342 	/* Include padding bytes into CRC if any. */
343 	mod = data_len % ISCSI_ALIGNMENT;
344 	if (mod != 0) {
345 		uint32_t pad_length = ISCSI_ALIGNMENT - mod;
346 		uint8_t pad[3] = {0, 0, 0};
347 		assert(pad_length > 0);
348 		assert(pad_length <= sizeof(pad));
349 		crc32c = spdk_crc32c_update(pad, pad_length, crc32c);
350 	}
351 
352 	/* Finalize CRC by inverting all bits. */
353 	return crc32c ^ SPDK_CRC32C_XOR;
354 }
355 
356 static int
357 iscsi_conn_read_data_segment(struct spdk_iscsi_conn *conn,
358 			     struct spdk_iscsi_pdu *pdu,
359 			     uint32_t data_offset, uint32_t data_len)
360 {
361 	struct iovec buf_iov, iovs[32];
362 	int rc, _rc;
363 
364 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
365 		return iscsi_conn_read_data(conn, data_len, pdu->data + data_offset);
366 	} else {
367 		buf_iov.iov_base = pdu->data;
368 		buf_iov.iov_len = pdu->data_buf_len;
369 		rc = spdk_dif_set_md_interleave_iovs(iovs, 32, &buf_iov, 1,
370 						     data_offset, data_len, NULL,
371 						     &pdu->dif_ctx);
372 		if (rc > 0) {
373 			rc = iscsi_conn_readv_data(conn, iovs, rc);
374 			if (rc > 0) {
375 				_rc = spdk_dif_generate_stream(&buf_iov, 1, data_offset, rc,
376 							       &pdu->dif_ctx);
377 				if (_rc != 0) {
378 					SPDK_ERRLOG("DIF generate failed\n");
379 					rc = _rc;
380 				}
381 			}
382 		} else {
383 			SPDK_ERRLOG("Setup iovs for interleaved metadata failed\n");
384 		}
385 		return rc;
386 	}
387 }
388 
389 /* Build iovec array to leave metadata space for every data block
390  * when reading data segment from socket.
391  */
392 static inline bool
393 _iscsi_sgl_append_with_md(struct spdk_iov_sgl *s,
394 			  void *buf, uint32_t buf_len, uint32_t data_len,
395 			  struct spdk_dif_ctx *dif_ctx)
396 {
397 	int rc;
398 	uint32_t total_size = 0;
399 	struct iovec buf_iov;
400 
401 	if (s->iov_offset >= data_len) {
402 		s->iov_offset -= data_len;
403 	} else {
404 		buf_iov.iov_base = buf;
405 		buf_iov.iov_len = buf_len;
406 		rc = spdk_dif_set_md_interleave_iovs(s->iov, s->iovcnt, &buf_iov, 1,
407 						     s->iov_offset, data_len - s->iov_offset,
408 						     &total_size, dif_ctx);
409 		if (rc < 0) {
410 			SPDK_ERRLOG("Failed to setup iovs for DIF strip\n");
411 			return false;
412 		}
413 
414 		s->total_size += total_size;
415 		s->iov_offset = 0;
416 		assert(s->iovcnt >= rc);
417 		s->iovcnt -= rc;
418 		s->iov += rc;
419 
420 		if (s->iovcnt == 0) {
421 			return false;
422 		}
423 	}
424 
425 	return true;
426 }
427 
428 int
429 iscsi_build_iovs(struct spdk_iscsi_conn *conn, struct iovec *iovs, int iovcnt,
430 		 struct spdk_iscsi_pdu *pdu, uint32_t *_mapped_length)
431 {
432 	struct spdk_iov_sgl sgl;
433 	int enable_digest;
434 	uint32_t total_ahs_len;
435 	uint32_t data_len;
436 
437 	if (iovcnt == 0) {
438 		return 0;
439 	}
440 
441 	total_ahs_len = pdu->bhs.total_ahs_len;
442 	data_len = DGET24(pdu->bhs.data_segment_len);
443 	data_len = ISCSI_ALIGN(data_len);
444 
445 	enable_digest = 1;
446 	if (pdu->bhs.opcode == ISCSI_OP_LOGIN_RSP) {
447 		/* this PDU should be sent without digest */
448 		enable_digest = 0;
449 	}
450 
451 	spdk_iov_sgl_init(&sgl, iovs, iovcnt, pdu->writev_offset);
452 
453 	/* BHS */
454 	if (!spdk_iov_sgl_append(&sgl, (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN)) {
455 		goto end;
456 	}
457 	/* AHS */
458 	if (total_ahs_len > 0) {
459 		if (!spdk_iov_sgl_append(&sgl, pdu->ahs, 4 * total_ahs_len)) {
460 			goto end;
461 		}
462 	}
463 
464 	/* Header Digest */
465 	if (enable_digest && conn->header_digest) {
466 		if (!spdk_iov_sgl_append(&sgl, pdu->header_digest, ISCSI_DIGEST_LEN)) {
467 			goto end;
468 		}
469 	}
470 
471 	/* Data Segment */
472 	if (data_len > 0) {
473 		if (!pdu->dif_insert_or_strip) {
474 			if (!spdk_iov_sgl_append(&sgl, pdu->data, data_len)) {
475 				goto end;
476 			}
477 		} else {
478 			if (!_iscsi_sgl_append_with_md(&sgl, pdu->data, pdu->data_buf_len,
479 						       data_len, &pdu->dif_ctx)) {
480 				goto end;
481 			}
482 		}
483 	}
484 
485 	/* Data Digest */
486 	if (enable_digest && conn->data_digest && data_len != 0) {
487 		spdk_iov_sgl_append(&sgl, pdu->data_digest, ISCSI_DIGEST_LEN);
488 	}
489 
490 end:
491 	if (_mapped_length != NULL) {
492 		*_mapped_length = sgl.total_size;
493 	}
494 
495 	return iovcnt - sgl.iovcnt;
496 }
497 
498 void
499 iscsi_free_sess(struct spdk_iscsi_sess *sess)
500 {
501 	if (sess == NULL) {
502 		return;
503 	}
504 
505 	sess->tag = 0;
506 	sess->target = NULL;
507 	sess->session_type = SESSION_TYPE_INVALID;
508 	iscsi_param_free(sess->params);
509 	free(sess->conns);
510 	spdk_scsi_port_free(&sess->initiator_port);
511 	spdk_mempool_put(g_iscsi.session_pool, (void *)sess);
512 }
513 
514 static int
515 create_iscsi_sess(struct spdk_iscsi_conn *conn,
516 		  struct spdk_iscsi_tgt_node *target,
517 		  enum session_type session_type)
518 {
519 	struct spdk_iscsi_sess *sess;
520 	int rc;
521 
522 	sess = spdk_mempool_get(g_iscsi.session_pool);
523 	if (!sess) {
524 		SPDK_ERRLOG("Unable to get session object\n");
525 		SPDK_ERRLOG("MaxSessions set to %d\n", g_iscsi.MaxSessions);
526 		return -ENOMEM;
527 	}
528 
529 	/* configuration values */
530 	pthread_mutex_lock(&g_iscsi.mutex);
531 
532 	sess->MaxConnections = g_iscsi.MaxConnectionsPerSession;
533 	sess->MaxOutstandingR2T = DEFAULT_MAXOUTSTANDINGR2T;
534 
535 	sess->DefaultTime2Wait = g_iscsi.DefaultTime2Wait;
536 	sess->DefaultTime2Retain = g_iscsi.DefaultTime2Retain;
537 	sess->FirstBurstLength = g_iscsi.FirstBurstLength;
538 	sess->MaxBurstLength = SPDK_ISCSI_MAX_BURST_LENGTH;
539 	sess->InitialR2T = DEFAULT_INITIALR2T;
540 	sess->ImmediateData = g_iscsi.ImmediateData;
541 	sess->DataPDUInOrder = DEFAULT_DATAPDUINORDER;
542 	sess->DataSequenceInOrder = DEFAULT_DATASEQUENCEINORDER;
543 	sess->ErrorRecoveryLevel = g_iscsi.ErrorRecoveryLevel;
544 
545 	pthread_mutex_unlock(&g_iscsi.mutex);
546 
547 	sess->tag = conn->pg_tag;
548 
549 	sess->conns = calloc(sess->MaxConnections, sizeof(*sess->conns));
550 	if (!sess->conns) {
551 		spdk_mempool_put(g_iscsi.session_pool, (void *)sess);
552 		SPDK_ERRLOG("calloc() failed for connection array\n");
553 		return -ENOMEM;
554 	}
555 
556 	sess->connections = 0;
557 
558 	sess->conns[sess->connections] = conn;
559 	sess->connections++;
560 
561 	sess->params = NULL;
562 	sess->target = target;
563 	sess->isid = 0;
564 	sess->session_type = session_type;
565 	sess->current_text_itt = 0xffffffffU;
566 
567 	/* set default params */
568 	rc = iscsi_sess_params_init(&sess->params);
569 	if (rc < 0) {
570 		SPDK_ERRLOG("iscsi_sess_params_init() failed\n");
571 		goto error_return;
572 	}
573 	/* replace with config value */
574 	rc = iscsi_param_set_int(sess->params, "MaxConnections",
575 				 sess->MaxConnections);
576 	if (rc < 0) {
577 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
578 		goto error_return;
579 	}
580 
581 	rc = iscsi_param_set_int(sess->params, "MaxOutstandingR2T",
582 				 sess->MaxOutstandingR2T);
583 	if (rc < 0) {
584 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
585 		goto error_return;
586 	}
587 
588 	rc = iscsi_param_set_int(sess->params, "DefaultTime2Wait",
589 				 sess->DefaultTime2Wait);
590 	if (rc < 0) {
591 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
592 		goto error_return;
593 	}
594 
595 	rc = iscsi_param_set_int(sess->params, "DefaultTime2Retain",
596 				 sess->DefaultTime2Retain);
597 	if (rc < 0) {
598 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
599 		goto error_return;
600 	}
601 
602 	rc = iscsi_param_set_int(sess->params, "FirstBurstLength",
603 				 sess->FirstBurstLength);
604 	if (rc < 0) {
605 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
606 		goto error_return;
607 	}
608 
609 	rc = iscsi_param_set_int(sess->params, "MaxBurstLength",
610 				 sess->MaxBurstLength);
611 	if (rc < 0) {
612 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
613 		goto error_return;
614 	}
615 
616 	rc = iscsi_param_set(sess->params, "InitialR2T",
617 			     sess->InitialR2T ? "Yes" : "No");
618 	if (rc < 0) {
619 		SPDK_ERRLOG("iscsi_param_set() failed\n");
620 		goto error_return;
621 	}
622 
623 	rc = iscsi_param_set(sess->params, "ImmediateData",
624 			     sess->ImmediateData ? "Yes" : "No");
625 	if (rc < 0) {
626 		SPDK_ERRLOG("iscsi_param_set() failed\n");
627 		goto error_return;
628 	}
629 
630 	rc = iscsi_param_set(sess->params, "DataPDUInOrder",
631 			     sess->DataPDUInOrder ? "Yes" : "No");
632 	if (rc < 0) {
633 		SPDK_ERRLOG("iscsi_param_set() failed\n");
634 		goto error_return;
635 	}
636 
637 	rc = iscsi_param_set(sess->params, "DataSequenceInOrder",
638 			     sess->DataSequenceInOrder ? "Yes" : "No");
639 	if (rc < 0) {
640 		SPDK_ERRLOG("iscsi_param_set() failed\n");
641 		goto error_return;
642 	}
643 
644 	rc = iscsi_param_set_int(sess->params, "ErrorRecoveryLevel",
645 				 sess->ErrorRecoveryLevel);
646 	if (rc < 0) {
647 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
648 		goto error_return;
649 	}
650 
651 	/* realloc buffer */
652 	rc = iscsi_param_set_int(conn->params, "MaxRecvDataSegmentLength",
653 				 conn->MaxRecvDataSegmentLength);
654 	if (rc < 0) {
655 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
656 		goto error_return;
657 	}
658 
659 	/* sess for first connection of session */
660 	conn->sess = sess;
661 	return 0;
662 
663 error_return:
664 	iscsi_free_sess(sess);
665 	conn->sess = NULL;
666 	return -1;
667 }
668 
669 static struct spdk_iscsi_sess *
670 get_iscsi_sess_by_tsih(uint16_t tsih)
671 {
672 	struct spdk_iscsi_sess *session;
673 
674 	if (tsih == 0 || tsih > g_iscsi.MaxSessions) {
675 		return NULL;
676 	}
677 
678 	session = g_iscsi.session[tsih - 1];
679 	assert(tsih == session->tsih);
680 
681 	return session;
682 }
683 
684 static uint8_t
685 append_iscsi_sess(struct spdk_iscsi_conn *conn,
686 		  const char *initiator_port_name, uint16_t tsih, uint16_t cid)
687 {
688 	struct spdk_iscsi_sess *sess;
689 
690 	SPDK_DEBUGLOG(iscsi, "append session: init port name=%s, tsih=%u, cid=%u\n",
691 		      initiator_port_name, tsih, cid);
692 
693 	sess = get_iscsi_sess_by_tsih(tsih);
694 	if (sess == NULL) {
695 		SPDK_ERRLOG("spdk_get_iscsi_sess_by_tsih failed\n");
696 		return ISCSI_LOGIN_CONN_ADD_FAIL;
697 	}
698 	if ((conn->pg_tag != sess->tag) ||
699 	    (strcasecmp(initiator_port_name, spdk_scsi_port_get_name(sess->initiator_port)) != 0) ||
700 	    (conn->target != sess->target)) {
701 		/* no match */
702 		SPDK_ERRLOG("no MCS session for init port name=%s, tsih=%d, cid=%d\n",
703 			    initiator_port_name, tsih, cid);
704 		return ISCSI_LOGIN_CONN_ADD_FAIL;
705 	}
706 
707 	if (sess->connections >= sess->MaxConnections) {
708 		/* no slot for connection */
709 		SPDK_ERRLOG("too many connections for init port name=%s, tsih=%d, cid=%d\n",
710 			    initiator_port_name, tsih, cid);
711 		return ISCSI_LOGIN_TOO_MANY_CONNECTIONS;
712 	}
713 
714 	SPDK_DEBUGLOG(iscsi, "Connections (tsih %d): %d\n", sess->tsih, sess->connections);
715 	conn->sess = sess;
716 
717 	/*
718 	 * TODO: need a mutex or other sync mechanism to protect the session's
719 	 *  connection list.
720 	 */
721 	sess->conns[sess->connections] = conn;
722 	sess->connections++;
723 
724 	return 0;
725 }
726 
727 static int
728 iscsi_append_text(const char *key, const char *val, uint8_t *data,
729 		  int alloc_len, int data_len)
730 {
731 	int total;
732 	int len;
733 
734 	total = data_len;
735 	if (alloc_len < 1) {
736 		return 0;
737 	}
738 	if (total > alloc_len) {
739 		total = alloc_len;
740 		data[total - 1] = '\0';
741 		return total;
742 	}
743 
744 	if (alloc_len - total < 1) {
745 		SPDK_ERRLOG("data space small %d\n", alloc_len);
746 		return total;
747 	}
748 	len = snprintf((char *) data + total, alloc_len - total, "%s=%s", key, val);
749 	total += len + 1;
750 
751 	return total;
752 }
753 
754 static int
755 iscsi_append_param(struct spdk_iscsi_conn *conn, const char *key,
756 		   uint8_t *data, int alloc_len, int data_len)
757 {
758 	struct iscsi_param *param;
759 
760 	param = iscsi_param_find(conn->params, key);
761 	if (param == NULL) {
762 		param = iscsi_param_find(conn->sess->params, key);
763 		if (param == NULL) {
764 			SPDK_DEBUGLOG(iscsi, "no key %.64s\n", key);
765 			return data_len;
766 		}
767 	}
768 	return iscsi_append_text(param->key, param->val, data,
769 				 alloc_len, data_len);
770 }
771 
772 static int
773 iscsi_auth_params(struct spdk_iscsi_conn *conn,
774 		  struct iscsi_param *params, const char *method, uint8_t *data,
775 		  int alloc_len, int data_len)
776 {
777 	char *in_val;
778 	char *in_next;
779 	char *new_val;
780 	const char *algorithm;
781 	const char *name;
782 	const char *response;
783 	const char *identifier;
784 	const char *challenge;
785 	int total;
786 	int rc;
787 
788 	if (conn == NULL || params == NULL || method == NULL) {
789 		return -1;
790 	}
791 	if (strcasecmp(method, "CHAP") == 0) {
792 		/* method OK */
793 	} else {
794 		SPDK_ERRLOG("unsupported AuthMethod %.64s\n", method);
795 		return -1;
796 	}
797 
798 	total = data_len;
799 	if (alloc_len < 1) {
800 		return 0;
801 	}
802 	if (total > alloc_len) {
803 		total = alloc_len;
804 		data[total - 1] = '\0';
805 		return total;
806 	}
807 
808 	/* for temporary store */
809 	in_val = malloc(ISCSI_TEXT_MAX_VAL_LEN + 1);
810 	if (!in_val) {
811 		SPDK_ERRLOG("malloc() failed for temporary store\n");
812 		return -ENOMEM;
813 	}
814 
815 	/* CHAP method (RFC1994) */
816 	if ((algorithm = iscsi_param_get_val(params, "CHAP_A")) != NULL) {
817 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_A) {
818 			SPDK_ERRLOG("CHAP sequence error\n");
819 			goto error_return;
820 		}
821 
822 		/* CHAP_A is LIST type */
823 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", algorithm);
824 		in_next = in_val;
825 		while ((new_val = spdk_strsepq(&in_next, ",")) != NULL) {
826 			if (strcasecmp(new_val, "5") == 0) {
827 				/* CHAP with MD5 */
828 				break;
829 			}
830 		}
831 		if (new_val == NULL) {
832 			snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", "Reject");
833 			new_val = in_val;
834 			iscsi_append_text("CHAP_A", new_val, data, alloc_len, total);
835 			goto error_return;
836 		}
837 		/* selected algorithm is 5 (MD5) */
838 		SPDK_DEBUGLOG(iscsi, "got CHAP_A=%s\n", new_val);
839 		total = iscsi_append_text("CHAP_A", new_val, data, alloc_len, total);
840 
841 		/* Identifier is one octet */
842 		gen_random(conn->auth.chap_id, 1);
843 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN, "%d",
844 			 (int) conn->auth.chap_id[0]);
845 		total = iscsi_append_text("CHAP_I", in_val, data, alloc_len, total);
846 
847 		/* Challenge Value is a variable stream of octets */
848 		/* (binary length MUST not exceed 1024 bytes) */
849 		conn->auth.chap_challenge_len = ISCSI_CHAP_CHALLENGE_LEN;
850 		gen_random(conn->auth.chap_challenge, conn->auth.chap_challenge_len);
851 		bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN,
852 			conn->auth.chap_challenge, conn->auth.chap_challenge_len);
853 		total = iscsi_append_text("CHAP_C", in_val, data, alloc_len, total);
854 
855 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_NR;
856 	} else if ((name = iscsi_param_get_val(params, "CHAP_N")) != NULL) {
857 		uint8_t resmd5[SPDK_MD5DIGEST_LEN];
858 		uint8_t tgtmd5[SPDK_MD5DIGEST_LEN];
859 		struct spdk_md5ctx md5ctx;
860 		size_t decoded_len = 0;
861 
862 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_NR) {
863 			SPDK_ERRLOG("CHAP sequence error\n");
864 			goto error_return;
865 		}
866 
867 		response = iscsi_param_get_val(params, "CHAP_R");
868 		if (response == NULL) {
869 			SPDK_ERRLOG("no response\n");
870 			goto error_return;
871 		}
872 		if (response[0] == '0' &&
873 		    (response[1] == 'x' || response[1] == 'X')) {
874 			rc = hex2bin(resmd5, SPDK_MD5DIGEST_LEN, response);
875 			if (rc < 0 || rc != SPDK_MD5DIGEST_LEN) {
876 				SPDK_ERRLOG("response format error\n");
877 				goto error_return;
878 			}
879 		} else if (response[0] == '0' &&
880 			   (response[1] == 'b' || response[1] == 'B')) {
881 			response += 2;
882 			rc = spdk_base64_decode(resmd5, &decoded_len, response);
883 			if (rc < 0 || decoded_len != SPDK_MD5DIGEST_LEN) {
884 				SPDK_ERRLOG("response format error\n");
885 				goto error_return;
886 			}
887 		} else {
888 			SPDK_ERRLOG("response format error\n");
889 			goto error_return;
890 		}
891 		SPDK_DEBUGLOG(iscsi, "got CHAP_N/CHAP_R\n");
892 
893 		SPDK_DEBUGLOG(iscsi, "ag_tag=%d\n", conn->chap_group);
894 
895 		rc = iscsi_chap_get_authinfo(&conn->auth, name, conn->chap_group);
896 		if (rc < 0) {
897 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
898 			SPDK_ERRLOG("iscsi_chap_get_authinfo() failed\n");
899 			goto error_return;
900 		}
901 		if (conn->auth.user[0] == '\0' || conn->auth.secret[0] == '\0') {
902 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
903 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
904 			goto error_return;
905 		}
906 
907 		md5init(&md5ctx);
908 		/* Identifier */
909 		md5update(&md5ctx, conn->auth.chap_id, 1);
910 		/* followed by secret */
911 		md5update(&md5ctx, conn->auth.secret,
912 			  strlen(conn->auth.secret));
913 		/* followed by Challenge Value */
914 		md5update(&md5ctx, conn->auth.chap_challenge,
915 			  conn->auth.chap_challenge_len);
916 		/* tgtmd5 is expecting Response Value */
917 		md5final(tgtmd5, &md5ctx);
918 
919 		bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN, tgtmd5, SPDK_MD5DIGEST_LEN);
920 
921 #if 0
922 		SPDK_DEBUGLOG(iscsi, "tgtmd5=%s, resmd5=%s\n", in_val, response);
923 		spdk_dump("tgtmd5", tgtmd5, SPDK_MD5DIGEST_LEN);
924 		spdk_dump("resmd5", resmd5, SPDK_MD5DIGEST_LEN);
925 #endif
926 
927 		/* compare MD5 digest */
928 		if (memcmp(tgtmd5, resmd5, SPDK_MD5DIGEST_LEN) != 0) {
929 			/* not match */
930 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
931 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
932 			goto error_return;
933 		}
934 		/* OK initiator's secret */
935 		conn->authenticated = true;
936 
937 		/* mutual CHAP? */
938 		identifier = iscsi_param_get_val(params, "CHAP_I");
939 		if (identifier != NULL) {
940 			conn->auth.chap_mid[0] = (uint8_t) strtol(identifier, NULL, 10);
941 			challenge = iscsi_param_get_val(params, "CHAP_C");
942 			if (challenge == NULL) {
943 				SPDK_ERRLOG("CHAP sequence error\n");
944 				goto error_return;
945 			}
946 			if (challenge[0] == '0' &&
947 			    (challenge[1] == 'x' || challenge[1] == 'X')) {
948 				rc = hex2bin(conn->auth.chap_mchallenge,
949 					     ISCSI_CHAP_CHALLENGE_LEN, challenge);
950 				if (rc < 0) {
951 					SPDK_ERRLOG("challenge format error\n");
952 					goto error_return;
953 				}
954 				conn->auth.chap_mchallenge_len = rc;
955 			} else if (challenge[0] == '0' &&
956 				   (challenge[1] == 'b' || challenge[1] == 'B')) {
957 				challenge += 2;
958 				rc = spdk_base64_decode(conn->auth.chap_mchallenge,
959 							&decoded_len, challenge);
960 				if (rc < 0) {
961 					SPDK_ERRLOG("challenge format error\n");
962 					goto error_return;
963 				}
964 				conn->auth.chap_mchallenge_len = decoded_len;
965 			} else {
966 				SPDK_ERRLOG("challenge format error\n");
967 				goto error_return;
968 			}
969 #if 0
970 			spdk_dump("MChallenge", conn->auth.chap_mchallenge,
971 				  conn->auth.chap_mchallenge_len);
972 #endif
973 			SPDK_DEBUGLOG(iscsi, "got CHAP_I/CHAP_C\n");
974 
975 			if (conn->auth.muser[0] == '\0' || conn->auth.msecret[0] == '\0') {
976 				/* SPDK_ERRLOG("mutual auth user or secret is missing\n"); */
977 				SPDK_ERRLOG("auth failed (name %.64s)\n", name);
978 				goto error_return;
979 			}
980 
981 			md5init(&md5ctx);
982 			/* Identifier */
983 			md5update(&md5ctx, conn->auth.chap_mid, 1);
984 			/* followed by secret */
985 			md5update(&md5ctx, conn->auth.msecret,
986 				  strlen(conn->auth.msecret));
987 			/* followed by Challenge Value */
988 			md5update(&md5ctx, conn->auth.chap_mchallenge,
989 				  conn->auth.chap_mchallenge_len);
990 			/* tgtmd5 is Response Value */
991 			md5final(tgtmd5, &md5ctx);
992 
993 			bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN, tgtmd5, SPDK_MD5DIGEST_LEN);
994 
995 			total = iscsi_append_text("CHAP_N", conn->auth.muser, data,
996 						  alloc_len, total);
997 			total = iscsi_append_text("CHAP_R", in_val, data, alloc_len, total);
998 		} else {
999 			/* not mutual */
1000 			if (conn->mutual_chap) {
1001 				SPDK_ERRLOG("required mutual CHAP\n");
1002 				goto error_return;
1003 			}
1004 		}
1005 
1006 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_END;
1007 	} else {
1008 		/* not found CHAP keys */
1009 		SPDK_DEBUGLOG(iscsi, "start CHAP\n");
1010 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1011 	}
1012 
1013 	free(in_val);
1014 	return total;
1015 
1016 error_return:
1017 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1018 	free(in_val);
1019 	return -1;
1020 }
1021 
1022 static int
1023 iscsi_check_values(struct spdk_iscsi_conn *conn)
1024 {
1025 	if (conn->sess->FirstBurstLength > conn->sess->MaxBurstLength) {
1026 		SPDK_ERRLOG("FirstBurstLength(%d) > MaxBurstLength(%d)\n",
1027 			    conn->sess->FirstBurstLength,
1028 			    conn->sess->MaxBurstLength);
1029 		return -1;
1030 	}
1031 	if (conn->sess->FirstBurstLength > g_iscsi.FirstBurstLength) {
1032 		SPDK_ERRLOG("FirstBurstLength(%d) > iSCSI target restriction(%d)\n",
1033 			    conn->sess->FirstBurstLength, g_iscsi.FirstBurstLength);
1034 		return -1;
1035 	}
1036 	if (conn->sess->MaxBurstLength > 0x00ffffff) {
1037 		SPDK_ERRLOG("MaxBurstLength(%d) > 0x00ffffff\n",
1038 			    conn->sess->MaxBurstLength);
1039 		return -1;
1040 	}
1041 
1042 	if (conn->MaxRecvDataSegmentLength < 512) {
1043 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) < 512\n",
1044 			    conn->MaxRecvDataSegmentLength);
1045 		return -1;
1046 	}
1047 	if (conn->MaxRecvDataSegmentLength > 0x00ffffff) {
1048 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) > 0x00ffffff\n",
1049 			    conn->MaxRecvDataSegmentLength);
1050 		return -1;
1051 	}
1052 	return 0;
1053 }
1054 
1055 static int
1056 iscsi_conn_params_update(struct spdk_iscsi_conn *conn)
1057 {
1058 	int rc;
1059 	uint32_t recv_buf_size;
1060 
1061 	/* update internal variables */
1062 	rc = iscsi_copy_param2var(conn);
1063 	if (rc < 0) {
1064 		SPDK_ERRLOG("iscsi_copy_param2var() failed\n");
1065 		if (conn->state < ISCSI_CONN_STATE_EXITING) {
1066 			conn->state = ISCSI_CONN_STATE_EXITING;
1067 		}
1068 		return rc;
1069 	}
1070 
1071 	/* check value */
1072 	rc = iscsi_check_values(conn);
1073 	if (rc < 0) {
1074 		SPDK_ERRLOG("iscsi_check_values() failed\n");
1075 		if (conn->state < ISCSI_CONN_STATE_EXITING) {
1076 			conn->state = ISCSI_CONN_STATE_EXITING;
1077 		}
1078 	}
1079 
1080 	/* The socket receive buffer may need to be adjusted based on the new parameters */
1081 
1082 	/* Don't allow the recv buffer to be 0 or very large. */
1083 	recv_buf_size = spdk_max(0x1000, spdk_min(0x2000, conn->sess->FirstBurstLength));
1084 
1085 	/* Add in extra space for the PDU */
1086 	recv_buf_size += ISCSI_BHS_LEN + ISCSI_AHS_LEN;
1087 
1088 	if (conn->header_digest) {
1089 		recv_buf_size += ISCSI_DIGEST_LEN;
1090 	}
1091 
1092 	if (conn->data_digest) {
1093 		recv_buf_size += ISCSI_DIGEST_LEN;
1094 	}
1095 
1096 	/* Set up to buffer up to 4 commands with immediate data at once */
1097 	if (spdk_sock_set_recvbuf(conn->sock, recv_buf_size * 4) < 0) {
1098 		/* Not fatal. */
1099 	}
1100 
1101 	return rc;
1102 }
1103 
1104 static void
1105 iscsi_conn_login_pdu_err_complete(void *arg)
1106 {
1107 	struct spdk_iscsi_conn *conn = arg;
1108 
1109 	if (conn->full_feature) {
1110 		iscsi_conn_params_update(conn);
1111 	}
1112 }
1113 
1114 static void
1115 iscsi_conn_login_pdu_success_complete(void *arg)
1116 {
1117 	struct spdk_iscsi_conn *conn = arg;
1118 
1119 
1120 	if (conn->state >= ISCSI_CONN_STATE_EXITING) {
1121 		/* Connection is being exited before this callback is executed. */
1122 		SPDK_DEBUGLOG(iscsi, "Connection is already exited.\n");
1123 		return;
1124 	}
1125 	if (conn->full_feature) {
1126 		if (iscsi_conn_params_update(conn) != 0) {
1127 			return;
1128 		}
1129 	}
1130 	conn->state = ISCSI_CONN_STATE_RUNNING;
1131 	if (conn->full_feature != 0) {
1132 		iscsi_conn_schedule(conn);
1133 	}
1134 }
1135 
1136 /*
1137  * The response function of spdk_iscsi_op_login
1138  */
1139 static void
1140 iscsi_op_login_response(struct spdk_iscsi_conn *conn,
1141 			struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param *params,
1142 			iscsi_conn_xfer_complete_cb cb_fn)
1143 {
1144 	struct iscsi_bhs_login_rsp *rsph;
1145 
1146 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1147 	rsph->version_max = ISCSI_VERSION;
1148 	rsph->version_act = ISCSI_VERSION;
1149 	DSET24(rsph->data_segment_len, rsp_pdu->data_segment_len);
1150 
1151 	to_be32(&rsph->stat_sn, conn->StatSN);
1152 	conn->StatSN++;
1153 
1154 	if (conn->sess != NULL) {
1155 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
1156 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
1157 	} else {
1158 		to_be32(&rsph->exp_cmd_sn, rsp_pdu->cmd_sn);
1159 		to_be32(&rsph->max_cmd_sn, rsp_pdu->cmd_sn);
1160 	}
1161 
1162 	SPDK_LOGDUMP(iscsi, "PDU", (uint8_t *)rsph, ISCSI_BHS_LEN);
1163 	SPDK_LOGDUMP(iscsi, "DATA", rsp_pdu->data, rsp_pdu->data_segment_len);
1164 
1165 	/* Set T/CSG/NSG to reserved if login error. */
1166 	if (rsph->status_class != 0) {
1167 		rsph->flags &= ~(ISCSI_LOGIN_TRANSIT | ISCSI_LOGIN_CURRENT_STAGE_MASK |
1168 				 ISCSI_LOGIN_NEXT_STAGE_MASK);
1169 	}
1170 	iscsi_param_free(params);
1171 	iscsi_conn_write_pdu(conn, rsp_pdu, cb_fn, conn);
1172 }
1173 
1174 /*
1175  * The function which is used to initialize the internal response data
1176  * structure of iscsi login function.
1177  * return:
1178  * 0, success;
1179  * otherwise, error;
1180  */
1181 static int
1182 iscsi_op_login_rsp_init(struct spdk_iscsi_conn *conn,
1183 			struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
1184 {
1185 	struct iscsi_bhs_login_req *reqh;
1186 	struct iscsi_bhs_login_rsp *rsph;
1187 
1188 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1189 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
1190 	rsph->status_class = ISCSI_CLASS_SUCCESS;
1191 	rsph->status_detail = ISCSI_LOGIN_ACCEPT;
1192 	rsp_pdu->data_segment_len = 0;
1193 
1194 	/* The default MaxRecvDataSegmentLength 8192 is used during login. - RFC3720 */
1195 	rsp_pdu->data = calloc(1, 8192);
1196 	if (!rsp_pdu->data) {
1197 		SPDK_ERRLOG("calloc() failed for data segment\n");
1198 		rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1199 		rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1200 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1201 	}
1202 	rsp_pdu->data_buf_len = 8192;
1203 
1204 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1205 	rsph->flags |= (reqh->flags & (ISCSI_LOGIN_TRANSIT | ISCSI_LOGIN_CONTINUE |
1206 				       ISCSI_LOGIN_CURRENT_STAGE_MASK));
1207 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1208 		rsph->flags |= (reqh->flags & ISCSI_LOGIN_NEXT_STAGE_MASK);
1209 	}
1210 
1211 	/* We don't need to convert from network byte order. Just store it */
1212 	memcpy(&rsph->isid, reqh->isid, 6);
1213 	rsph->tsih = reqh->tsih;
1214 	rsph->itt = reqh->itt;
1215 	rsp_pdu->cmd_sn = from_be32(&reqh->cmd_sn);
1216 
1217 	if (rsph->tsih) {
1218 		rsph->stat_sn = reqh->exp_stat_sn;
1219 	}
1220 
1221 	SPDK_LOGDUMP(iscsi, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
1222 
1223 	SPDK_DEBUGLOG(iscsi,
1224 		      "T=%d, C=%d, CSG=%d, NSG=%d, Min=%d, Max=%d, ITT=%x\n",
1225 		      ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags),
1226 		      ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags),
1227 		      ISCSI_BHS_LOGIN_GET_CSG(rsph->flags),
1228 		      ISCSI_BHS_LOGIN_GET_NSG(rsph->flags),
1229 		      reqh->version_min, reqh->version_max, from_be32(&rsph->itt));
1230 
1231 	if (conn->sess != NULL) {
1232 		SPDK_DEBUGLOG(iscsi,
1233 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u,"
1234 			      "MaxCmdSN=%u\n", rsp_pdu->cmd_sn,
1235 			      from_be32(&rsph->stat_sn), conn->StatSN,
1236 			      conn->sess->ExpCmdSN,
1237 			      conn->sess->MaxCmdSN);
1238 	} else {
1239 		SPDK_DEBUGLOG(iscsi,
1240 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
1241 			      rsp_pdu->cmd_sn, from_be32(&rsph->stat_sn),
1242 			      conn->StatSN);
1243 	}
1244 
1245 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags) &&
1246 	    ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags)) {
1247 		SPDK_ERRLOG("transit error\n");
1248 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1249 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1250 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1251 	}
1252 	/* make sure reqh->version_max < ISCSI_VERSION */
1253 	if (reqh->version_min > ISCSI_VERSION) {
1254 		SPDK_ERRLOG("unsupported version min %d/max %d, expecting %d\n", reqh->version_min,
1255 			    reqh->version_max, ISCSI_VERSION);
1256 		/* Unsupported version */
1257 		/* set all reserved flag to zero */
1258 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1259 		rsph->status_detail = ISCSI_LOGIN_UNSUPPORTED_VERSION;
1260 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1261 	}
1262 
1263 	if ((ISCSI_BHS_LOGIN_GET_NSG(rsph->flags) == ISCSI_NSG_RESERVED_CODE) &&
1264 	    ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1265 		/* set NSG and other bits to zero */
1266 		rsph->flags &= ~(ISCSI_LOGIN_NEXT_STAGE_MASK | ISCSI_LOGIN_TRANSIT |
1267 				 ISCSI_LOGIN_CURRENT_STAGE_MASK);
1268 		SPDK_ERRLOG("Received reserved NSG code: %d\n", ISCSI_NSG_RESERVED_CODE);
1269 		/* Initiator error */
1270 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1271 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1272 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1273 	}
1274 
1275 	return 0;
1276 }
1277 
1278 static int
1279 iscsi_op_login_store_incoming_params(struct spdk_iscsi_conn *conn,
1280 				     struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu,
1281 				     struct iscsi_param **params)
1282 {
1283 	struct iscsi_bhs_login_req *reqh;
1284 	struct iscsi_bhs_login_rsp *rsph;
1285 	int rc;
1286 
1287 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1288 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1289 
1290 	rc = iscsi_parse_params(params, pdu->data,
1291 				pdu->data_segment_len, ISCSI_BHS_LOGIN_GET_CBIT(reqh->flags),
1292 				&conn->partial_text_parameter);
1293 	if (rc < 0) {
1294 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
1295 		iscsi_param_free(*params);
1296 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1297 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1298 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1299 	}
1300 
1301 	return 0;
1302 }
1303 
1304 /*
1305  * This function is used to initialize the port info
1306  * return
1307  * 0: success
1308  * otherwise: error
1309  */
1310 static int
1311 iscsi_op_login_initialize_port(struct spdk_iscsi_conn *conn,
1312 			       struct spdk_iscsi_pdu *rsp_pdu,
1313 			       char *initiator_port_name,
1314 			       uint32_t name_length,
1315 			       struct iscsi_param *params)
1316 {
1317 	const char *val;
1318 	struct iscsi_bhs_login_rsp *rsph;
1319 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1320 
1321 	/* Initiator Name and Port */
1322 	val = iscsi_param_get_val(params, "InitiatorName");
1323 	if (val == NULL) {
1324 		SPDK_ERRLOG("InitiatorName is empty\n");
1325 		/* Missing parameter */
1326 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1327 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1328 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1329 	}
1330 	snprintf(conn->initiator_name, sizeof(conn->initiator_name), "%s", val);
1331 	snprintf(initiator_port_name, name_length,
1332 		 "%s,i,0x%12.12" PRIx64, val, iscsi_get_isid(rsph->isid));
1333 	spdk_strlwr(conn->initiator_name);
1334 	spdk_strlwr(initiator_port_name);
1335 	SPDK_DEBUGLOG(iscsi, "Initiator name: %s\n", conn->initiator_name);
1336 	SPDK_DEBUGLOG(iscsi, "Initiator port: %s\n", initiator_port_name);
1337 
1338 	return 0;
1339 }
1340 
1341 /*
1342  * This function is used to judge the session type
1343  * return
1344  * 0: success
1345  * Other value: error
1346  */
1347 static int
1348 iscsi_op_login_session_type(struct spdk_iscsi_conn *conn,
1349 			    struct spdk_iscsi_pdu *rsp_pdu,
1350 			    enum session_type *session_type,
1351 			    struct iscsi_param *params)
1352 {
1353 	const char *session_type_str;
1354 	struct iscsi_bhs_login_rsp *rsph;
1355 
1356 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1357 	session_type_str = iscsi_param_get_val(params, "SessionType");
1358 	if (session_type_str == NULL) {
1359 		if (rsph->tsih != 0) {
1360 			*session_type = SESSION_TYPE_NORMAL;
1361 		} else {
1362 			SPDK_ERRLOG("SessionType is empty\n");
1363 			/* Missing parameter */
1364 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1365 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1366 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1367 		}
1368 	} else {
1369 		if (strcasecmp(session_type_str, "Discovery") == 0) {
1370 			*session_type = SESSION_TYPE_DISCOVERY;
1371 		} else if (strcasecmp(session_type_str, "Normal") == 0) {
1372 			*session_type = SESSION_TYPE_NORMAL;
1373 		} else {
1374 			*session_type = SESSION_TYPE_INVALID;
1375 			SPDK_ERRLOG("SessionType is invalid\n");
1376 			/* Missing parameter */
1377 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1378 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1379 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1380 		}
1381 	}
1382 	SPDK_DEBUGLOG(iscsi, "Session Type: %s\n", session_type_str);
1383 
1384 	return 0;
1385 }
1386 
1387 /*
1388  * This function is used to check the target info
1389  * return:
1390  * 0: success
1391  * otherwise: error
1392  */
1393 static int
1394 iscsi_op_login_check_target(struct spdk_iscsi_conn *conn,
1395 			    struct spdk_iscsi_pdu *rsp_pdu,
1396 			    const char *target_name,
1397 			    struct spdk_iscsi_tgt_node **target)
1398 {
1399 	struct iscsi_bhs_login_rsp *rsph;
1400 	char buf[MAX_TMPBUF] = {};
1401 
1402 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1403 	*target = iscsi_find_tgt_node(target_name);
1404 	if (*target == NULL) {
1405 		SPDK_WARNLOG("target %s not found\n", target_name);
1406 		/* Not found */
1407 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1408 		rsph->status_detail = ISCSI_LOGIN_TARGET_NOT_FOUND;
1409 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1410 	}
1411 	if (iscsi_tgt_node_is_destructed(*target)) {
1412 		SPDK_ERRLOG("target %s is removed\n", target_name);
1413 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1414 		rsph->status_detail = ISCSI_LOGIN_TARGET_REMOVED;
1415 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1416 	}
1417 	if (iscsi_tgt_node_is_redirected(conn, *target, buf, MAX_TMPBUF)) {
1418 		SPDK_INFOLOG(iscsi, "target %s is redirected\n", target_name);
1419 		rsp_pdu->data_segment_len = iscsi_append_text("TargetAddress",
1420 					    buf,
1421 					    rsp_pdu->data,
1422 					    rsp_pdu->data_buf_len,
1423 					    rsp_pdu->data_segment_len);
1424 		rsph->status_class = ISCSI_CLASS_REDIRECT;
1425 		rsph->status_detail = ISCSI_LOGIN_TARGET_TEMPORARILY_MOVED;
1426 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1427 	}
1428 	if (!iscsi_tgt_node_access(conn, *target, conn->initiator_name,
1429 				   conn->initiator_addr)) {
1430 		SPDK_ERRLOG("access denied\n");
1431 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1432 		rsph->status_detail = ISCSI_LOGIN_AUTHORIZATION_FAIL;
1433 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1434 	}
1435 
1436 	return 0;
1437 }
1438 
1439 /*
1440  * This function use to check the session
1441  * return:
1442  * 0, success
1443  * otherwise: error
1444  */
1445 static int
1446 iscsi_op_login_check_session(struct spdk_iscsi_conn *conn,
1447 			     struct spdk_iscsi_pdu *rsp_pdu,
1448 			     char *initiator_port_name, int cid)
1449 
1450 {
1451 	int rc = 0;
1452 	struct iscsi_bhs_login_rsp *rsph;
1453 
1454 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1455 	/* check existing session */
1456 	SPDK_DEBUGLOG(iscsi, "isid=%"PRIx64", tsih=%u, cid=%u\n",
1457 		      iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih), cid);
1458 	if (rsph->tsih != 0) {
1459 		/* multiple connections */
1460 		rc = append_iscsi_sess(conn, initiator_port_name,
1461 				       from_be16(&rsph->tsih), cid);
1462 		if (rc != 0) {
1463 			SPDK_ERRLOG("isid=%"PRIx64", tsih=%u, cid=%u:"
1464 				    "spdk_append_iscsi_sess() failed\n",
1465 				    iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih),
1466 				    cid);
1467 			/* Can't include in session */
1468 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1469 			rsph->status_detail = rc;
1470 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1471 		}
1472 	} else if (!g_iscsi.AllowDuplicateIsid) {
1473 		/* new session, drop old sess by the initiator */
1474 		iscsi_drop_conns(conn, initiator_port_name, 0 /* drop old */);
1475 	}
1476 
1477 	return rc;
1478 }
1479 
1480 /*
1481  * This function is used to del the original param and update it with new
1482  * value
1483  * return:
1484  * 0: success
1485  * otherwise: error
1486  */
1487 static int
1488 iscsi_op_login_update_param(struct spdk_iscsi_conn *conn,
1489 			    const char *key, const char *value,
1490 			    const char *list)
1491 {
1492 	int rc = 0;
1493 	struct iscsi_param *new_param, *orig_param;
1494 	int index;
1495 
1496 	orig_param = iscsi_param_find(conn->params, key);
1497 	if (orig_param == NULL) {
1498 		SPDK_ERRLOG("orig_param %s not found\n", key);
1499 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1500 	}
1501 
1502 	index = orig_param->state_index;
1503 	rc = iscsi_param_del(&conn->params, key);
1504 	if (rc < 0) {
1505 		SPDK_ERRLOG("iscsi_param_del(%s) failed\n", key);
1506 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1507 	}
1508 	rc = iscsi_param_add(&conn->params, key, value, list, ISPT_LIST);
1509 	if (rc < 0) {
1510 		SPDK_ERRLOG("iscsi_param_add() failed\n");
1511 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1512 	}
1513 	new_param = iscsi_param_find(conn->params, key);
1514 	if (new_param == NULL) {
1515 		SPDK_ERRLOG("iscsi_param_find() failed\n");
1516 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1517 	}
1518 	new_param->state_index = index;
1519 	return rc;
1520 }
1521 
1522 static int
1523 iscsi_negotiate_chap_param(struct spdk_iscsi_conn *conn)
1524 {
1525 	int rc = 0;
1526 
1527 	if (conn->disable_chap) {
1528 		rc = iscsi_op_login_update_param(conn, "AuthMethod", "None", "None");
1529 	} else if (conn->require_chap) {
1530 		rc = iscsi_op_login_update_param(conn, "AuthMethod", "CHAP", "CHAP");
1531 	}
1532 
1533 	return rc;
1534 }
1535 
1536 /*
1537  * The function which is used to handle the part of session discovery
1538  * return:
1539  * 0, success;
1540  * otherwise: error;
1541  */
1542 static int
1543 iscsi_op_login_session_discovery_chap(struct spdk_iscsi_conn *conn)
1544 {
1545 	return iscsi_negotiate_chap_param(conn);
1546 }
1547 
1548 /*
1549  * This function is used to update the param related with chap
1550  * return:
1551  * 0: success
1552  * otherwise: error
1553  */
1554 static int
1555 iscsi_op_login_negotiate_chap_param(struct spdk_iscsi_conn *conn,
1556 				    struct spdk_iscsi_tgt_node *target)
1557 {
1558 	conn->disable_chap = target->disable_chap;
1559 	conn->require_chap = target->require_chap;
1560 	conn->mutual_chap = target->mutual_chap;
1561 	conn->chap_group = target->chap_group;
1562 
1563 	return iscsi_negotiate_chap_param(conn);
1564 }
1565 
1566 static int
1567 iscsi_op_login_negotiate_digest_param(struct spdk_iscsi_conn *conn,
1568 				      struct spdk_iscsi_tgt_node *target)
1569 {
1570 	int rc;
1571 
1572 	if (target->header_digest) {
1573 		/*
1574 		 * User specified header digests, so update the list of
1575 		 *  HeaderDigest values to remove "None" so that only
1576 		 *  initiators who support CRC32C can connect.
1577 		 */
1578 		rc = iscsi_op_login_update_param(conn, "HeaderDigest", "CRC32C", "CRC32C");
1579 		if (rc < 0) {
1580 			return rc;
1581 		}
1582 	}
1583 
1584 	if (target->data_digest) {
1585 		/*
1586 		 * User specified data digests, so update the list of
1587 		 *  DataDigest values to remove "None" so that only
1588 		 *  initiators who support CRC32C can connect.
1589 		 */
1590 		rc = iscsi_op_login_update_param(conn, "DataDigest", "CRC32C", "CRC32C");
1591 		if (rc < 0) {
1592 			return rc;
1593 		}
1594 	}
1595 
1596 	return 0;
1597 }
1598 
1599 /*
1600  * The function which is used to handle the part of normal login session
1601  * return:
1602  * 0, success;
1603  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1604  */
1605 static int
1606 iscsi_op_login_session_normal(struct spdk_iscsi_conn *conn,
1607 			      struct spdk_iscsi_pdu *rsp_pdu,
1608 			      char *initiator_port_name,
1609 			      struct iscsi_param *params,
1610 			      int cid)
1611 {
1612 	struct spdk_iscsi_tgt_node *target = NULL;
1613 	const char *target_name;
1614 	const char *target_short_name;
1615 	struct iscsi_bhs_login_rsp *rsph;
1616 	int rc = 0;
1617 
1618 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1619 	target_name = iscsi_param_get_val(params, "TargetName");
1620 
1621 	if (target_name == NULL) {
1622 		SPDK_ERRLOG("TargetName is empty\n");
1623 		/* Missing parameter */
1624 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1625 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1626 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1627 	}
1628 
1629 	memset(conn->target_short_name, 0, MAX_TARGET_NAME);
1630 	target_short_name = strstr(target_name, ":");
1631 	if (target_short_name != NULL) {
1632 		target_short_name++; /* Advance past the ':' */
1633 		if (strlen(target_short_name) >= MAX_TARGET_NAME) {
1634 			SPDK_ERRLOG("Target Short Name (%s) is more than %u characters\n",
1635 				    target_short_name, MAX_TARGET_NAME);
1636 			/* Invalid request */
1637 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1638 			rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
1639 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1640 		}
1641 		snprintf(conn->target_short_name, MAX_TARGET_NAME, "%s",
1642 			 target_short_name);
1643 	}
1644 
1645 	pthread_mutex_lock(&g_iscsi.mutex);
1646 	rc = iscsi_op_login_check_target(conn, rsp_pdu, target_name, &target);
1647 	pthread_mutex_unlock(&g_iscsi.mutex);
1648 
1649 	if (rc < 0) {
1650 		return rc;
1651 	}
1652 
1653 	conn->target = target;
1654 	conn->dev = target->dev;
1655 	conn->target_port = spdk_scsi_dev_find_port_by_id(target->dev,
1656 			    conn->pg_tag);
1657 
1658 	rc = iscsi_op_login_check_session(conn, rsp_pdu,
1659 					  initiator_port_name, cid);
1660 	if (rc < 0) {
1661 		return rc;
1662 	}
1663 
1664 	/* force target flags */
1665 	pthread_mutex_lock(&target->mutex);
1666 	rc = iscsi_op_login_negotiate_chap_param(conn, target);
1667 	pthread_mutex_unlock(&target->mutex);
1668 
1669 	if (rc == 0) {
1670 		rc = iscsi_op_login_negotiate_digest_param(conn, target);
1671 	}
1672 
1673 	if (rc != 0) {
1674 		/* Invalid request */
1675 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1676 		rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
1677 	}
1678 
1679 	return rc;
1680 }
1681 
1682 /*
1683  * This function is used to set the info in the connection data structure
1684  * return
1685  * 0: success
1686  * otherwise: error
1687  */
1688 static int
1689 iscsi_op_login_set_conn_info(struct spdk_iscsi_conn *conn,
1690 			     struct spdk_iscsi_pdu *rsp_pdu,
1691 			     char *initiator_port_name,
1692 			     enum session_type session_type, int cid)
1693 {
1694 	int rc = 0;
1695 	struct spdk_iscsi_tgt_node *target;
1696 	struct iscsi_bhs_login_rsp *rsph;
1697 	struct spdk_scsi_port *initiator_port;
1698 
1699 	target = conn->target;
1700 
1701 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1702 	conn->authenticated = false;
1703 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1704 	conn->cid = cid;
1705 
1706 	if (conn->sess == NULL) {
1707 		/* create initiator port */
1708 		initiator_port = spdk_scsi_port_create(iscsi_get_isid(rsph->isid), 0, initiator_port_name);
1709 		if (initiator_port == NULL) {
1710 			SPDK_ERRLOG("create_port() failed\n");
1711 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1712 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1713 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1714 		}
1715 
1716 		/* new session */
1717 		rc = create_iscsi_sess(conn, target, session_type);
1718 		if (rc < 0) {
1719 			spdk_scsi_port_free(&initiator_port);
1720 			SPDK_ERRLOG("create_sess() failed\n");
1721 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1722 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1723 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1724 		}
1725 		/* initialize parameters */
1726 		conn->sess->initiator_port = initiator_port;
1727 		conn->StatSN = from_be32(&rsph->stat_sn);
1728 		conn->sess->isid = iscsi_get_isid(rsph->isid);
1729 
1730 		/* Initiator port TransportID */
1731 		spdk_scsi_port_set_iscsi_transport_id(conn->sess->initiator_port,
1732 						      conn->initiator_name,
1733 						      conn->sess->isid);
1734 
1735 		/* Discovery sessions will not have a target. */
1736 		if (target != NULL) {
1737 			conn->sess->queue_depth = target->queue_depth;
1738 		} else {
1739 			/*
1740 			 * Assume discovery sessions have an effective command
1741 			 *  windows size of 1.
1742 			 */
1743 			conn->sess->queue_depth = 1;
1744 		}
1745 		conn->sess->ExpCmdSN = rsp_pdu->cmd_sn;
1746 		conn->sess->MaxCmdSN = rsp_pdu->cmd_sn + conn->sess->queue_depth - 1;
1747 	}
1748 
1749 	conn->initiator_port = conn->sess->initiator_port;
1750 
1751 	return 0;
1752 }
1753 
1754 /*
1755  * This function is used to set the target info
1756  * return
1757  * 0: success
1758  * otherwise: error
1759  */
1760 static int
1761 iscsi_op_login_set_target_info(struct spdk_iscsi_conn *conn,
1762 			       struct spdk_iscsi_pdu *rsp_pdu,
1763 			       enum session_type session_type)
1764 {
1765 	char buf[MAX_TMPBUF];
1766 	const char *val;
1767 	int rc = 0;
1768 	struct spdk_iscsi_tgt_node *target = conn->target;
1769 
1770 	/* declarative parameters */
1771 	if (target != NULL) {
1772 		pthread_mutex_lock(&target->mutex);
1773 		if (target->alias[0] != '\0') {
1774 			snprintf(buf, sizeof buf, "%s", target->alias);
1775 		} else {
1776 			snprintf(buf, sizeof buf, "%s", "");
1777 		}
1778 		pthread_mutex_unlock(&target->mutex);
1779 		rc = iscsi_param_set(conn->sess->params, "TargetAlias", buf);
1780 		if (rc < 0) {
1781 			SPDK_ERRLOG("iscsi_param_set() failed\n");
1782 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1783 		}
1784 	}
1785 	snprintf(buf, sizeof buf, "%s:%s,%d", conn->portal_host, conn->portal_port,
1786 		 conn->pg_tag);
1787 	rc = iscsi_param_set(conn->sess->params, "TargetAddress", buf);
1788 	if (rc < 0) {
1789 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1790 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1791 	}
1792 	snprintf(buf, sizeof buf, "%d", conn->pg_tag);
1793 	rc = iscsi_param_set(conn->sess->params, "TargetPortalGroupTag", buf);
1794 	if (rc < 0) {
1795 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1796 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1797 	}
1798 
1799 	/* write in response */
1800 	if (target != NULL) {
1801 		val = iscsi_param_get_val(conn->sess->params, "TargetAlias");
1802 		if (val != NULL && strlen(val) != 0) {
1803 			rsp_pdu->data_segment_len = iscsi_append_param(conn,
1804 						    "TargetAlias",
1805 						    rsp_pdu->data,
1806 						    rsp_pdu->data_buf_len,
1807 						    rsp_pdu->data_segment_len);
1808 		}
1809 		if (session_type == SESSION_TYPE_DISCOVERY) {
1810 			rsp_pdu->data_segment_len = iscsi_append_param(conn,
1811 						    "TargetAddress",
1812 						    rsp_pdu->data,
1813 						    rsp_pdu->data_buf_len,
1814 						    rsp_pdu->data_segment_len);
1815 		}
1816 		rsp_pdu->data_segment_len = iscsi_append_param(conn,
1817 					    "TargetPortalGroupTag",
1818 					    rsp_pdu->data,
1819 					    rsp_pdu->data_buf_len,
1820 					    rsp_pdu->data_segment_len);
1821 	}
1822 
1823 	return rc;
1824 }
1825 
1826 /*
1827  * This function is used to handle the login of iscsi initiator when there is
1828  * no session
1829  * return:
1830  * 0, success;
1831  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1832  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify the login fail.
1833  */
1834 static int
1835 iscsi_op_login_phase_none(struct spdk_iscsi_conn *conn,
1836 			  struct spdk_iscsi_pdu *rsp_pdu,
1837 			  struct iscsi_param *params, int cid)
1838 {
1839 	enum session_type session_type;
1840 	char initiator_port_name[MAX_INITIATOR_PORT_NAME];
1841 	struct iscsi_bhs_login_rsp *rsph;
1842 	int rc = 0;
1843 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1844 
1845 	conn->target = NULL;
1846 	conn->dev = NULL;
1847 
1848 	rc = iscsi_op_login_initialize_port(conn, rsp_pdu, initiator_port_name,
1849 					    MAX_INITIATOR_PORT_NAME, params);
1850 	if (rc < 0) {
1851 		return rc;
1852 	}
1853 
1854 	rc = iscsi_op_login_session_type(conn, rsp_pdu, &session_type, params);
1855 	if (rc < 0) {
1856 		return rc;
1857 	}
1858 
1859 	/* Target Name and Port */
1860 	if (session_type == SESSION_TYPE_NORMAL) {
1861 		rc = iscsi_op_login_session_normal(conn, rsp_pdu,
1862 						   initiator_port_name,
1863 						   params, cid);
1864 		if (rc < 0) {
1865 			return rc;
1866 		}
1867 
1868 	} else if (session_type == SESSION_TYPE_DISCOVERY) {
1869 		rsph->tsih = 0;
1870 
1871 		/* force target flags */
1872 		pthread_mutex_lock(&g_iscsi.mutex);
1873 		rc = iscsi_op_login_session_discovery_chap(conn);
1874 		pthread_mutex_unlock(&g_iscsi.mutex);
1875 		if (rc < 0) {
1876 			return rc;
1877 		}
1878 	} else {
1879 		SPDK_ERRLOG("unknown session type\n");
1880 		/* Missing parameter */
1881 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1882 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1883 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1884 	}
1885 
1886 	rc = iscsi_op_login_set_conn_info(conn, rsp_pdu, initiator_port_name,
1887 					  session_type, cid);
1888 	if (rc < 0) {
1889 		return rc;
1890 	}
1891 
1892 	/* limit conns on discovery session */
1893 	if (session_type == SESSION_TYPE_DISCOVERY) {
1894 		conn->sess->MaxConnections = 1;
1895 		rc = iscsi_param_set_int(conn->sess->params,
1896 					 "MaxConnections",
1897 					 conn->sess->MaxConnections);
1898 		if (rc < 0) {
1899 			SPDK_ERRLOG("iscsi_param_set_int() failed\n");
1900 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1901 		}
1902 	}
1903 
1904 	return iscsi_op_login_set_target_info(conn, rsp_pdu, session_type);
1905 }
1906 
1907 /*
1908  * This function is used to set the csg bit case in rsp
1909  * return:
1910  * 0, success
1911  * otherwise: error
1912  */
1913 static int
1914 iscsi_op_login_rsp_handle_csg_bit(struct spdk_iscsi_conn *conn,
1915 				  struct spdk_iscsi_pdu *rsp_pdu,
1916 				  struct iscsi_param *params)
1917 {
1918 	const char *auth_method;
1919 	int rc;
1920 	struct iscsi_bhs_login_rsp *rsph;
1921 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1922 
1923 	switch (ISCSI_BHS_LOGIN_GET_CSG(rsph->flags)) {
1924 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
1925 		/* SecurityNegotiation */
1926 		auth_method = iscsi_param_get_val(conn->params, "AuthMethod");
1927 		if (auth_method == NULL) {
1928 			SPDK_ERRLOG("AuthMethod is empty\n");
1929 			/* Missing parameter */
1930 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1931 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1932 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1933 		}
1934 		if (strcasecmp(auth_method, "None") == 0) {
1935 			conn->authenticated = true;
1936 		} else {
1937 			rc = iscsi_auth_params(conn, params, auth_method,
1938 					       rsp_pdu->data, rsp_pdu->data_buf_len,
1939 					       rsp_pdu->data_segment_len);
1940 			if (rc < 0) {
1941 				SPDK_ERRLOG("iscsi_auth_params() failed\n");
1942 				/* Authentication failure */
1943 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1944 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1945 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1946 			}
1947 			rsp_pdu->data_segment_len = rc;
1948 			if (!conn->authenticated) {
1949 				/* not complete */
1950 				rsph->flags &= ~ISCSI_LOGIN_TRANSIT;
1951 			} else {
1952 				if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_END) {
1953 					SPDK_DEBUGLOG(iscsi, "CHAP phase not complete");
1954 				}
1955 			}
1956 
1957 			SPDK_LOGDUMP(iscsi, "Negotiated Auth Params",
1958 				     rsp_pdu->data, rsp_pdu->data_segment_len);
1959 		}
1960 		break;
1961 
1962 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
1963 		/* LoginOperationalNegotiation */
1964 		if (conn->state == ISCSI_CONN_STATE_INVALID) {
1965 			if (conn->require_chap) {
1966 				/* Authentication failure */
1967 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1968 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1969 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1970 			} else {
1971 				/* AuthMethod=None */
1972 				conn->authenticated = true;
1973 			}
1974 		}
1975 		if (!conn->authenticated) {
1976 			SPDK_ERRLOG("authentication error\n");
1977 			/* Authentication failure */
1978 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1979 			rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1980 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1981 		}
1982 		break;
1983 
1984 	case ISCSI_FULL_FEATURE_PHASE:
1985 		/* FullFeaturePhase */
1986 		SPDK_ERRLOG("XXX Login in FullFeaturePhase\n");
1987 		/* Initiator error */
1988 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1989 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1990 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1991 
1992 	default:
1993 		SPDK_ERRLOG("unknown stage\n");
1994 		/* Initiator error */
1995 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1996 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1997 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1998 	}
1999 
2000 	return 0;
2001 }
2002 
2003 /* This function is used to notify the session info
2004  * return
2005  * 0: success
2006  * otherwise: error
2007  */
2008 static int
2009 iscsi_op_login_notify_session_info(struct spdk_iscsi_conn *conn,
2010 				   struct spdk_iscsi_pdu *rsp_pdu)
2011 {
2012 	struct iscsi_bhs_login_rsp *rsph;
2013 
2014 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2015 	if (conn->sess->session_type == SESSION_TYPE_NORMAL) {
2016 		/* normal session */
2017 		SPDK_DEBUGLOG(iscsi, "Login from %s (%s) on %s tgt_node%d"
2018 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2019 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2020 			      conn->initiator_name, conn->initiator_addr,
2021 			      conn->target->name, conn->target->num,
2022 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2023 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2024 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2025 			       ? "on" : "off"),
2026 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2027 			       ? "on" : "off"));
2028 	} else if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2029 		/* discovery session */
2030 		SPDK_DEBUGLOG(iscsi, "Login(discovery) from %s (%s) on"
2031 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2032 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2033 			      conn->initiator_name, conn->initiator_addr,
2034 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2035 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2036 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2037 			       ? "on" : "off"),
2038 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2039 			       ? "on" : "off"));
2040 	} else {
2041 		SPDK_ERRLOG("unknown session type\n");
2042 		/* Initiator error */
2043 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2044 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2045 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2046 	}
2047 
2048 	return 0;
2049 }
2050 
2051 /*
2052  * This function is to handle the tbit cases
2053  * return
2054  * 0: success
2055  * otherwise error
2056  */
2057 static int
2058 iscsi_op_login_rsp_handle_t_bit(struct spdk_iscsi_conn *conn,
2059 				struct spdk_iscsi_pdu *rsp_pdu)
2060 {
2061 	int rc;
2062 	struct iscsi_bhs_login_rsp *rsph;
2063 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2064 
2065 	switch (ISCSI_BHS_LOGIN_GET_NSG(rsph->flags)) {
2066 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
2067 		/* SecurityNegotiation */
2068 		conn->login_phase = ISCSI_SECURITY_NEGOTIATION_PHASE;
2069 		break;
2070 
2071 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
2072 		/* LoginOperationalNegotiation */
2073 		conn->login_phase = ISCSI_OPERATIONAL_NEGOTIATION_PHASE;
2074 		break;
2075 
2076 	case ISCSI_FULL_FEATURE_PHASE:
2077 		/* FullFeaturePhase */
2078 		conn->login_phase = ISCSI_FULL_FEATURE_PHASE;
2079 		to_be16(&rsph->tsih, conn->sess->tsih);
2080 
2081 		rc = iscsi_op_login_notify_session_info(conn, rsp_pdu);
2082 		if (rc < 0) {
2083 			return rc;
2084 		}
2085 
2086 		conn->full_feature = 1;
2087 		break;
2088 
2089 	default:
2090 		SPDK_ERRLOG("unknown stage\n");
2091 		/* Initiator error */
2092 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2093 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2094 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2095 	}
2096 
2097 	return 0;
2098 }
2099 
2100 /*
2101  * This function is used to set the values of the internal data structure used
2102  * by spdk_iscsi_op_login function
2103  * return:
2104  * 0, used to notify the a successful login
2105  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify a failure login.
2106  */
2107 static int
2108 iscsi_op_login_rsp_handle(struct spdk_iscsi_conn *conn,
2109 			  struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param **params)
2110 {
2111 	int rc;
2112 	struct iscsi_bhs_login_rsp *rsph;
2113 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2114 
2115 	/* negotiate parameters */
2116 	rc = iscsi_negotiate_params(conn, params, rsp_pdu->data,
2117 				    rsp_pdu->data_buf_len,
2118 				    rsp_pdu->data_segment_len);
2119 	if (rc < 0) {
2120 		/*
2121 		 * iscsi_negotiate_params just returns -1 on failure,
2122 		 *  so translate this into meaningful response codes and
2123 		 *  return values.
2124 		 */
2125 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2126 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2127 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2128 	}
2129 
2130 	rsp_pdu->data_segment_len = rc;
2131 	SPDK_LOGDUMP(iscsi, "Negotiated Params", rsp_pdu->data, rc);
2132 
2133 	/* handle the CSG bit case */
2134 	rc = iscsi_op_login_rsp_handle_csg_bit(conn, rsp_pdu, *params);
2135 	if (rc < 0) {
2136 		return rc;
2137 	}
2138 
2139 	/* handle the T bit case */
2140 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
2141 		rc = iscsi_op_login_rsp_handle_t_bit(conn, rsp_pdu);
2142 	}
2143 
2144 	return rc;
2145 }
2146 
2147 static int
2148 iscsi_pdu_hdr_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2149 {
2150 	int rc;
2151 	struct iscsi_bhs_login_req *reqh;
2152 	struct spdk_iscsi_pdu *rsp_pdu;
2153 
2154 	if (conn->full_feature && conn->sess != NULL &&
2155 	    conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2156 		return SPDK_ISCSI_CONNECTION_FATAL;
2157 	}
2158 
2159 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
2160 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
2161 
2162 	/* During login processing, use the 8KB default FirstBurstLength as
2163 	 *  our maximum data segment length value.
2164 	 */
2165 	if (pdu->data_segment_len > SPDK_ISCSI_FIRST_BURST_LENGTH) {
2166 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2167 	}
2168 
2169 	rsp_pdu = iscsi_get_pdu(conn);
2170 	if (rsp_pdu == NULL) {
2171 		return SPDK_ISCSI_CONNECTION_FATAL;
2172 	}
2173 	rc = iscsi_op_login_rsp_init(conn, pdu, rsp_pdu);
2174 	if (rc < 0) {
2175 		iscsi_op_login_response(conn, rsp_pdu, NULL, iscsi_conn_login_pdu_err_complete);
2176 		return 0;
2177 	}
2178 
2179 	conn->login_rsp_pdu = rsp_pdu;
2180 	return 0;
2181 }
2182 
2183 static int
2184 iscsi_pdu_payload_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2185 {
2186 	int rc;
2187 	struct iscsi_bhs_login_req *reqh;
2188 	struct spdk_iscsi_pdu *rsp_pdu;
2189 	struct iscsi_param *params = NULL;
2190 	int cid;
2191 
2192 	if (conn->login_rsp_pdu == NULL) {
2193 		return 0;
2194 	}
2195 
2196 	spdk_poller_unregister(&conn->login_timer);
2197 	rsp_pdu = conn->login_rsp_pdu;
2198 
2199 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
2200 	cid = from_be16(&reqh->cid);
2201 
2202 	rc = iscsi_op_login_store_incoming_params(conn, pdu, rsp_pdu, &params);
2203 	if (rc < 0) {
2204 		iscsi_op_login_response(conn, rsp_pdu, NULL, iscsi_conn_login_pdu_err_complete);
2205 		return 0;
2206 	}
2207 
2208 	if (conn->state == ISCSI_CONN_STATE_INVALID) {
2209 		rc = iscsi_op_login_phase_none(conn, rsp_pdu, params, cid);
2210 		if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE || rc == SPDK_ISCSI_LOGIN_ERROR_PARAMETER) {
2211 			iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_err_complete);
2212 			return 0;
2213 		}
2214 	}
2215 
2216 	rc = iscsi_op_login_rsp_handle(conn, rsp_pdu, &params);
2217 	if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE) {
2218 		iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_err_complete);
2219 		return 0;
2220 	}
2221 
2222 	iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_success_complete);
2223 	return 0;
2224 }
2225 
2226 static int
2227 iscsi_pdu_hdr_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2228 {
2229 	uint32_t task_tag;
2230 	uint32_t ExpStatSN;
2231 	int F_bit, C_bit;
2232 	struct iscsi_bhs_text_req *reqh;
2233 
2234 	if (pdu->data_segment_len > iscsi_get_max_immediate_data_size()) {
2235 		SPDK_ERRLOG("data segment len(=%zu) > immediate data len(=%"PRIu32")\n",
2236 			    pdu->data_segment_len, iscsi_get_max_immediate_data_size());
2237 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2238 	}
2239 
2240 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2241 
2242 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2243 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2244 	task_tag = from_be32(&reqh->itt);
2245 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2246 
2247 	SPDK_DEBUGLOG(iscsi, "I=%d, F=%d, C=%d, ITT=%x, TTT=%x\n",
2248 		      reqh->immediate, F_bit, C_bit, task_tag, from_be32(&reqh->ttt));
2249 
2250 	SPDK_DEBUGLOG(iscsi,
2251 		      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2252 		      pdu->cmd_sn, ExpStatSN, conn->StatSN, conn->sess->ExpCmdSN,
2253 		      conn->sess->MaxCmdSN);
2254 
2255 	if (ExpStatSN != conn->StatSN) {
2256 #if 0
2257 		SPDK_ERRLOG("StatSN(%u) error\n", ExpStatSN);
2258 		return -1;
2259 #else
2260 		/* StarPort have a bug */
2261 		SPDK_DEBUGLOG(iscsi, "StatSN(%u) rewound\n", ExpStatSN);
2262 		conn->StatSN = ExpStatSN;
2263 #endif
2264 	}
2265 
2266 	if (F_bit && C_bit) {
2267 		SPDK_ERRLOG("final and continue\n");
2268 		return -1;
2269 	}
2270 
2271 	/*
2272 	 * If this is the first text op in a sequence, save the ITT so we can
2273 	 * compare it against the ITT for subsequent ops in the same sequence.
2274 	 * If a subsequent text op in same sequence has a different ITT, reject
2275 	 * that PDU.
2276 	 */
2277 	if (conn->sess->current_text_itt == 0xffffffffU) {
2278 		conn->sess->current_text_itt = task_tag;
2279 	} else if (conn->sess->current_text_itt != task_tag) {
2280 		SPDK_ERRLOG("The correct itt is %u, and the current itt is %u...\n",
2281 			    conn->sess->current_text_itt, task_tag);
2282 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2283 	}
2284 
2285 	return 0;
2286 }
2287 
2288 static void
2289 iscsi_conn_text_pdu_complete(void *arg)
2290 {
2291 	struct spdk_iscsi_conn *conn = arg;
2292 
2293 	iscsi_conn_params_update(conn);
2294 }
2295 
2296 static int
2297 iscsi_pdu_payload_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2298 {
2299 	struct iscsi_param *params = NULL;
2300 	struct spdk_iscsi_pdu *rsp_pdu;
2301 	uint8_t *data;
2302 	uint64_t lun;
2303 	uint32_t task_tag;
2304 	const char *val;
2305 	int F_bit, C_bit;
2306 	int data_len;
2307 	int alloc_len;
2308 	int rc;
2309 	struct iscsi_bhs_text_req *reqh;
2310 	struct iscsi_bhs_text_resp *rsph;
2311 
2312 	data_len = 0;
2313 	alloc_len = conn->MaxRecvDataSegmentLength;
2314 
2315 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2316 
2317 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2318 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2319 	lun = from_be64(&reqh->lun);
2320 	task_tag = from_be32(&reqh->itt);
2321 
2322 	/* store incoming parameters */
2323 	rc = iscsi_parse_params(&params, pdu->data, pdu->data_segment_len,
2324 				C_bit, &conn->partial_text_parameter);
2325 	if (rc < 0) {
2326 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
2327 		iscsi_param_free(params);
2328 		return -1;
2329 	}
2330 
2331 	if (pdu->data_segment_len == 0 && params == NULL) {
2332 		params = conn->params_text;
2333 		conn->params_text = NULL;
2334 	}
2335 
2336 	data = calloc(1, alloc_len);
2337 	if (!data) {
2338 		SPDK_ERRLOG("calloc() failed for data segment\n");
2339 		iscsi_param_free(params);
2340 		return -ENOMEM;
2341 	}
2342 
2343 	/* negotiate parameters */
2344 	data_len = iscsi_negotiate_params(conn, &params,
2345 					  data, alloc_len, data_len);
2346 	if (data_len < 0) {
2347 		SPDK_ERRLOG("iscsi_negotiate_params() failed\n");
2348 		iscsi_param_free(params);
2349 		free(data);
2350 		return -1;
2351 	}
2352 
2353 	/* sendtargets is special case */
2354 	val = iscsi_param_get_val(params, "SendTargets");
2355 	if (val != NULL) {
2356 		if (iscsi_param_eq_val(conn->sess->params,
2357 				       "SessionType", "Discovery")) {
2358 			if (strcasecmp(val, "") == 0) {
2359 				val = "ALL";
2360 			}
2361 
2362 			data_len = iscsi_send_tgts(conn,
2363 						   conn->initiator_name,
2364 						   val, data, alloc_len,
2365 						   data_len);
2366 		} else {
2367 			if (strcasecmp(val, "") == 0) {
2368 				val = conn->target->name;
2369 			}
2370 
2371 			if (strcasecmp(val, "ALL") == 0) {
2372 				/* not in discovery session */
2373 				data_len = iscsi_append_text("SendTargets", "Reject",
2374 							     data, alloc_len, data_len);
2375 			} else {
2376 				data_len = iscsi_send_tgts(conn,
2377 							   conn->initiator_name,
2378 							   val, data, alloc_len,
2379 							   data_len);
2380 			}
2381 		}
2382 
2383 		if (conn->send_tgt_completed_size != 0) {
2384 			F_bit = 0;
2385 			C_bit = 1;
2386 		}
2387 	} else {
2388 		if (iscsi_param_eq_val(conn->sess->params, "SessionType", "Discovery")) {
2389 			iscsi_param_free(params);
2390 			free(data);
2391 			return SPDK_ISCSI_CONNECTION_FATAL;
2392 		}
2393 	}
2394 
2395 	if (spdk_likely(conn->send_tgt_completed_size == 0)) {
2396 		iscsi_param_free(params);
2397 	} else {
2398 		conn->params_text = params;
2399 	}
2400 	SPDK_LOGDUMP(iscsi, "Negotiated Params", data, data_len);
2401 
2402 	/* response PDU */
2403 	rsp_pdu = iscsi_get_pdu(conn);
2404 	if (rsp_pdu == NULL) {
2405 		free(data);
2406 		return SPDK_ISCSI_CONNECTION_FATAL;
2407 	}
2408 	rsph = (struct iscsi_bhs_text_resp *)&rsp_pdu->bhs;
2409 
2410 	rsp_pdu->data = data;
2411 	rsph->opcode = ISCSI_OP_TEXT_RSP;
2412 
2413 	if (F_bit) {
2414 		rsph->flags |= ISCSI_FLAG_FINAL;
2415 	}
2416 
2417 	if (C_bit) {
2418 		rsph->flags |= ISCSI_TEXT_CONTINUE;
2419 	}
2420 
2421 	DSET24(rsph->data_segment_len, data_len);
2422 	to_be64(&rsph->lun, lun);
2423 	to_be32(&rsph->itt, task_tag);
2424 
2425 	if (F_bit) {
2426 		rsph->ttt = 0xffffffffU;
2427 		conn->sess->current_text_itt = 0xffffffffU;
2428 	} else {
2429 		to_be32(&rsph->ttt, 1 + conn->id);
2430 	}
2431 
2432 	to_be32(&rsph->stat_sn, conn->StatSN);
2433 	conn->StatSN++;
2434 
2435 	if (reqh->immediate == 0) {
2436 		conn->sess->MaxCmdSN++;
2437 	}
2438 
2439 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2440 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2441 
2442 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_text_pdu_complete, conn);
2443 	return 0;
2444 }
2445 
2446 static void
2447 iscsi_conn_logout_pdu_complete(void *arg)
2448 {
2449 	struct spdk_iscsi_conn *conn = arg;
2450 
2451 	if (conn->sess == NULL) {
2452 		/*
2453 		 * login failed but initiator still sent a logout rather than
2454 		 *  just closing the TCP connection.
2455 		 */
2456 		SPDK_DEBUGLOG(iscsi, "Logout(login failed) from %s (%s) on"
2457 			      " (%s:%s,%d)\n",
2458 			      conn->initiator_name, conn->initiator_addr,
2459 			      conn->portal_host, conn->portal_port, conn->pg_tag);
2460 	} else if (iscsi_param_eq_val(conn->sess->params, "SessionType", "Normal")) {
2461 		SPDK_DEBUGLOG(iscsi, "Logout from %s (%s) on %s tgt_node%d"
2462 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2463 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2464 			      conn->initiator_name, conn->initiator_addr,
2465 			      conn->target->name, conn->target->num,
2466 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2467 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2468 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2469 			       ? "on" : "off"),
2470 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2471 			       ? "on" : "off"));
2472 	} else {
2473 		/* discovery session */
2474 		SPDK_DEBUGLOG(iscsi, "Logout(discovery) from %s (%s) on"
2475 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2476 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2477 			      conn->initiator_name, conn->initiator_addr,
2478 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2479 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2480 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2481 			       ? "on" : "off"),
2482 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2483 			       ? "on" : "off"));
2484 	}
2485 }
2486 
2487 static int
2488 iscsi_pdu_hdr_op_logout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2489 {
2490 	struct spdk_iscsi_pdu *rsp_pdu;
2491 	uint32_t task_tag;
2492 	uint32_t ExpStatSN;
2493 	int response;
2494 	struct iscsi_bhs_logout_req *reqh;
2495 	struct iscsi_bhs_logout_resp *rsph;
2496 	uint16_t cid;
2497 
2498 	reqh = (struct iscsi_bhs_logout_req *)&pdu->bhs;
2499 
2500 	cid = from_be16(&reqh->cid);
2501 	task_tag = from_be32(&reqh->itt);
2502 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2503 
2504 	SPDK_DEBUGLOG(iscsi, "reason=%d, ITT=%x, cid=%d\n",
2505 		      reqh->reason, task_tag, cid);
2506 
2507 	if (conn->sess != NULL) {
2508 		if (conn->sess->session_type == SESSION_TYPE_DISCOVERY &&
2509 		    reqh->reason != ISCSI_LOGOUT_REASON_CLOSE_SESSION) {
2510 			SPDK_ERRLOG("Target can accept logout only with reason \"close the session\" "
2511 				    "on discovery session. %d is not acceptable reason.\n",
2512 				    reqh->reason);
2513 			return SPDK_ISCSI_CONNECTION_FATAL;
2514 		}
2515 
2516 		SPDK_DEBUGLOG(iscsi,
2517 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2518 			      pdu->cmd_sn, ExpStatSN, conn->StatSN,
2519 			      conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
2520 
2521 		if (pdu->cmd_sn != conn->sess->ExpCmdSN) {
2522 			SPDK_DEBUGLOG(iscsi, "CmdSN(%u) might have dropped\n", pdu->cmd_sn);
2523 			/* ignore error */
2524 		}
2525 	} else {
2526 		SPDK_DEBUGLOG(iscsi, "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
2527 			      pdu->cmd_sn, ExpStatSN, conn->StatSN);
2528 	}
2529 
2530 	if (ExpStatSN != conn->StatSN) {
2531 		SPDK_DEBUGLOG(iscsi, "StatSN(%u/%u) might have dropped\n",
2532 			      ExpStatSN, conn->StatSN);
2533 		/* ignore error */
2534 	}
2535 
2536 	if (conn->cid == cid) {
2537 		/* connection or session closed successfully */
2538 		response = 0;
2539 		iscsi_conn_logout(conn);
2540 	} else {
2541 		response = 1;
2542 	}
2543 
2544 	/* response PDU */
2545 	rsp_pdu = iscsi_get_pdu(conn);
2546 	if (rsp_pdu == NULL) {
2547 		return SPDK_ISCSI_CONNECTION_FATAL;
2548 	}
2549 	rsph = (struct iscsi_bhs_logout_resp *)&rsp_pdu->bhs;
2550 	rsp_pdu->data = NULL;
2551 	rsph->opcode = ISCSI_OP_LOGOUT_RSP;
2552 	rsph->flags |= 0x80; /* bit 0 must be 1 */
2553 	rsph->response = response;
2554 	DSET24(rsph->data_segment_len, 0);
2555 	to_be32(&rsph->itt, task_tag);
2556 
2557 	if (conn->sess != NULL) {
2558 		to_be32(&rsph->stat_sn, conn->StatSN);
2559 		conn->StatSN++;
2560 
2561 		if (conn->sess->connections == 1) {
2562 			conn->sess->MaxCmdSN++;
2563 		}
2564 
2565 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2566 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2567 	} else {
2568 		to_be32(&rsph->stat_sn, conn->StatSN);
2569 		conn->StatSN++;
2570 		to_be32(&rsph->exp_cmd_sn, pdu->cmd_sn);
2571 		to_be32(&rsph->max_cmd_sn, pdu->cmd_sn);
2572 	}
2573 
2574 	rsph->time_2_wait = 0;
2575 	rsph->time_2_retain = 0;
2576 
2577 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_logout_pdu_complete, conn);
2578 
2579 	return 0;
2580 }
2581 
2582 static int
2583 iscsi_send_r2t(struct spdk_iscsi_conn *conn,
2584 	       struct spdk_iscsi_task *task, int offset,
2585 	       int len, uint32_t transfer_tag, uint32_t *R2TSN)
2586 {
2587 	struct spdk_iscsi_pdu *rsp_pdu;
2588 	struct iscsi_bhs_r2t *rsph;
2589 	uint64_t fmt_lun;
2590 
2591 	/* R2T PDU */
2592 	rsp_pdu = iscsi_get_pdu(conn);
2593 	if (rsp_pdu == NULL) {
2594 		return SPDK_ISCSI_CONNECTION_FATAL;
2595 	}
2596 	rsph = (struct iscsi_bhs_r2t *)&rsp_pdu->bhs;
2597 	rsp_pdu->data = NULL;
2598 	rsph->opcode = ISCSI_OP_R2T;
2599 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
2600 	fmt_lun = spdk_scsi_lun_id_int_to_fmt(task->lun_id);
2601 	to_be64(&rsph->lun, fmt_lun);
2602 	to_be32(&rsph->itt, task->tag);
2603 	to_be32(&rsph->ttt, transfer_tag);
2604 
2605 	to_be32(&rsph->stat_sn, conn->StatSN);
2606 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2607 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2608 
2609 	to_be32(&rsph->r2t_sn, *R2TSN);
2610 	*R2TSN += 1;
2611 
2612 	task->r2t_datasn = 0; /* next expected datasn to ack */
2613 
2614 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2615 	to_be32(&rsph->desired_xfer_len, (uint32_t)len);
2616 	task->desired_data_transfer_length = (size_t)len;
2617 
2618 	/* we need to hold onto this task/cmd because until the PDU has been
2619 	 * written out */
2620 	rsp_pdu->task = task;
2621 	task->scsi.ref++;
2622 
2623 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
2624 
2625 	return 0;
2626 }
2627 
2628 /* This function is used to remove the r2t pdu from snack_pdu_list by < task, r2t_sn> info */
2629 static struct spdk_iscsi_pdu *
2630 iscsi_remove_r2t_pdu_from_snack_list(struct spdk_iscsi_conn *conn,
2631 				     struct spdk_iscsi_task *task,
2632 				     uint32_t r2t_sn)
2633 {
2634 	struct spdk_iscsi_pdu *pdu;
2635 	struct iscsi_bhs_r2t *r2t_header;
2636 
2637 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
2638 		if (pdu->bhs.opcode == ISCSI_OP_R2T) {
2639 			r2t_header = (struct iscsi_bhs_r2t *)&pdu->bhs;
2640 			if (pdu->task == task &&
2641 			    from_be32(&r2t_header->r2t_sn) == r2t_sn) {
2642 				TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
2643 				return pdu;
2644 			}
2645 		}
2646 	}
2647 
2648 	return NULL;
2649 }
2650 
2651 /* This function is used re-send the r2t packet */
2652 static int
2653 iscsi_send_r2t_recovery(struct spdk_iscsi_conn *conn,
2654 			struct spdk_iscsi_task *task, uint32_t r2t_sn,
2655 			bool send_new_r2tsn)
2656 {
2657 	struct spdk_iscsi_pdu *pdu;
2658 	struct iscsi_bhs_r2t *rsph;
2659 	uint32_t transfer_len;
2660 	uint32_t len;
2661 	int rc;
2662 
2663 	/* remove the r2t pdu from the snack_list */
2664 	pdu = iscsi_remove_r2t_pdu_from_snack_list(conn, task, r2t_sn);
2665 	if (!pdu) {
2666 		SPDK_DEBUGLOG(iscsi, "No pdu is found\n");
2667 		return -1;
2668 	}
2669 
2670 	/* flag
2671 	 * false: only need to re-send the old r2t with changing statsn
2672 	 * true: we send a r2t with new r2tsn
2673 	 */
2674 	if (!send_new_r2tsn) {
2675 		to_be32(&pdu->bhs.stat_sn, conn->StatSN);
2676 		iscsi_conn_write_pdu(conn, pdu, iscsi_conn_pdu_generic_complete, NULL);
2677 	} else {
2678 		rsph = (struct iscsi_bhs_r2t *)&pdu->bhs;
2679 		transfer_len = from_be32(&rsph->desired_xfer_len);
2680 
2681 		/* still need to increase the acked r2tsn */
2682 		task->acked_r2tsn++;
2683 		len = spdk_min(conn->sess->MaxBurstLength,
2684 			       (transfer_len - task->next_expected_r2t_offset));
2685 
2686 		/* remove the old_r2t_pdu */
2687 		iscsi_conn_free_pdu(conn, pdu);
2688 
2689 		/* re-send a new r2t pdu */
2690 		rc = iscsi_send_r2t(conn, task, task->next_expected_r2t_offset,
2691 				    len, task->ttt, &task->R2TSN);
2692 		if (rc < 0) {
2693 			return SPDK_ISCSI_CONNECTION_FATAL;
2694 		}
2695 	}
2696 
2697 	return 0;
2698 }
2699 
2700 static int
2701 add_transfer_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
2702 {
2703 	uint32_t transfer_len;
2704 	size_t max_burst_len;
2705 	size_t segment_len;
2706 	size_t data_len;
2707 	int len;
2708 	int rc;
2709 	int data_out_req;
2710 
2711 	transfer_len = task->scsi.transfer_len;
2712 	data_len = iscsi_task_get_pdu(task)->data_segment_len;
2713 	max_burst_len = conn->sess->MaxBurstLength;
2714 	segment_len = SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH;
2715 	data_out_req = 1 + (transfer_len - data_len - 1) / segment_len;
2716 	task->data_out_cnt = data_out_req;
2717 
2718 	/*
2719 	 * If we already have too many tasks using R2T, then queue this task
2720 	 *  and start sending R2T for it after some of the tasks using R2T/data
2721 	 *  out buffers complete.
2722 	 */
2723 	if (conn->pending_r2t >= g_iscsi.MaxR2TPerConnection) {
2724 		TAILQ_INSERT_TAIL(&conn->queued_r2t_tasks, task, link);
2725 		return 0;
2726 	}
2727 
2728 	conn->data_out_cnt += data_out_req;
2729 	conn->pending_r2t++;
2730 
2731 	task->next_expected_r2t_offset = data_len;
2732 	task->current_r2t_length = 0;
2733 	task->R2TSN = 0;
2734 	/* According to RFC3720 10.8.5, 0xffffffff is
2735 	 * reserved for TTT in R2T.
2736 	 */
2737 	if (++conn->ttt == 0xffffffffu) {
2738 		conn->ttt = 0;
2739 	}
2740 	task->ttt = conn->ttt;
2741 
2742 	while (data_len != transfer_len) {
2743 		len = spdk_min(max_burst_len, (transfer_len - data_len));
2744 		rc = iscsi_send_r2t(conn, task, data_len, len,
2745 				    task->ttt, &task->R2TSN);
2746 		if (rc < 0) {
2747 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
2748 			return rc;
2749 		}
2750 		data_len += len;
2751 		task->next_r2t_offset = data_len;
2752 		task->outstanding_r2t++;
2753 		if (conn->sess->MaxOutstandingR2T == task->outstanding_r2t) {
2754 			break;
2755 		}
2756 	}
2757 
2758 	TAILQ_INSERT_TAIL(&conn->active_r2t_tasks, task, link);
2759 	task->is_r2t_active = true;
2760 	return 0;
2761 }
2762 
2763 /* If there are additional large writes queued for R2Ts, start them now.
2764  *  This is called when a large write is just completed or when multiple LUNs
2765  *  are attached and large write tasks for the specific LUN are cleared.
2766  */
2767 static void
2768 start_queued_transfer_tasks(struct spdk_iscsi_conn *conn)
2769 {
2770 	struct spdk_iscsi_task *task, *tmp;
2771 
2772 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, tmp) {
2773 		if (conn->pending_r2t < g_iscsi.MaxR2TPerConnection) {
2774 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
2775 			add_transfer_task(conn, task);
2776 		} else {
2777 			break;
2778 		}
2779 	}
2780 }
2781 
2782 bool
2783 iscsi_del_transfer_task(struct spdk_iscsi_conn *conn, uint32_t task_tag)
2784 {
2785 	struct spdk_iscsi_task *task, *tmp;
2786 
2787 	TAILQ_FOREACH_SAFE(task, &conn->active_r2t_tasks, link, tmp) {
2788 		if (task->tag == task_tag) {
2789 			assert(conn->data_out_cnt >= task->data_out_cnt);
2790 			conn->data_out_cnt -= task->data_out_cnt;
2791 
2792 			assert(conn->pending_r2t > 0);
2793 			conn->pending_r2t--;
2794 
2795 			assert(task->is_r2t_active == true);
2796 			TAILQ_REMOVE(&conn->active_r2t_tasks, task, link);
2797 			task->is_r2t_active = false;
2798 			iscsi_task_put(task);
2799 
2800 			start_queued_transfer_tasks(conn);
2801 			return true;
2802 		}
2803 	}
2804 	return false;
2805 }
2806 
2807 void
2808 iscsi_clear_all_transfer_task(struct spdk_iscsi_conn *conn,
2809 			      struct spdk_scsi_lun *lun,
2810 			      struct spdk_iscsi_pdu *pdu)
2811 {
2812 	struct spdk_iscsi_task *task, *task_tmp;
2813 	struct spdk_iscsi_pdu *pdu_tmp;
2814 
2815 	TAILQ_FOREACH_SAFE(task, &conn->active_r2t_tasks, link, task_tmp) {
2816 		pdu_tmp = iscsi_task_get_pdu(task);
2817 		if ((lun == NULL || lun == task->scsi.lun) &&
2818 		    (pdu == NULL || spdk_sn32_lt(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
2819 			task->outstanding_r2t = 0;
2820 			task->next_r2t_offset = 0;
2821 			task->next_expected_r2t_offset = 0;
2822 			task->current_data_offset = 0;
2823 			assert(conn->data_out_cnt >= task->data_out_cnt);
2824 			conn->data_out_cnt -= task->data_out_cnt;
2825 			assert(conn->pending_r2t > 0);
2826 			conn->pending_r2t--;
2827 
2828 			TAILQ_REMOVE(&conn->active_r2t_tasks, task, link);
2829 			task->is_r2t_active = false;
2830 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
2831 				spdk_scsi_task_process_null_lun(&task->scsi);
2832 				iscsi_task_response(conn, task);
2833 			}
2834 			iscsi_task_put(task);
2835 		}
2836 	}
2837 
2838 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, task_tmp) {
2839 		pdu_tmp = iscsi_task_get_pdu(task);
2840 		if ((lun == NULL || lun == task->scsi.lun) &&
2841 		    (pdu == NULL || spdk_sn32_lt(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
2842 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
2843 			task->is_r2t_active = false;
2844 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
2845 				spdk_scsi_task_process_null_lun(&task->scsi);
2846 				iscsi_task_response(conn, task);
2847 			}
2848 			iscsi_task_put(task);
2849 		}
2850 	}
2851 
2852 	start_queued_transfer_tasks(conn);
2853 }
2854 
2855 static struct spdk_iscsi_task *
2856 get_transfer_task(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
2857 {
2858 	struct spdk_iscsi_task *task;
2859 
2860 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
2861 		if (task->ttt == transfer_tag) {
2862 			return task;
2863 		}
2864 	}
2865 
2866 	return NULL;
2867 }
2868 
2869 static void
2870 iscsi_conn_datain_pdu_complete(void *arg)
2871 {
2872 	struct spdk_iscsi_conn *conn = arg;
2873 
2874 	iscsi_conn_handle_queued_datain_tasks(conn);
2875 }
2876 
2877 static int
2878 iscsi_send_datain(struct spdk_iscsi_conn *conn,
2879 		  struct spdk_iscsi_task *task, int datain_flag,
2880 		  int residual_len, int offset, int DataSN, int len)
2881 {
2882 	struct spdk_iscsi_pdu *rsp_pdu;
2883 	struct iscsi_bhs_data_in *rsph;
2884 	uint32_t task_tag;
2885 	uint32_t transfer_tag;
2886 	int F_bit, U_bit, O_bit, S_bit;
2887 	struct spdk_iscsi_task *primary;
2888 	struct spdk_scsi_lun *lun_dev;
2889 
2890 	primary = iscsi_task_get_primary(task);
2891 
2892 	/* DATA PDU */
2893 	rsp_pdu = iscsi_get_pdu(conn);
2894 	rsph = (struct iscsi_bhs_data_in *)&rsp_pdu->bhs;
2895 	rsp_pdu->data = task->scsi.iovs[0].iov_base + offset;
2896 	rsp_pdu->data_buf_len = task->scsi.iovs[0].iov_len - offset;
2897 	rsp_pdu->data_valid_bytes = len;
2898 	rsp_pdu->data_from_mempool = true;
2899 
2900 	task_tag = task->tag;
2901 	transfer_tag = 0xffffffffU;
2902 
2903 	F_bit = datain_flag & ISCSI_FLAG_FINAL;
2904 	O_bit = datain_flag & ISCSI_DATAIN_OVERFLOW;
2905 	U_bit = datain_flag & ISCSI_DATAIN_UNDERFLOW;
2906 	S_bit = datain_flag & ISCSI_DATAIN_STATUS;
2907 
2908 	/*
2909 	 * we need to hold onto this task/cmd because until the
2910 	 * PDU has been written out
2911 	 */
2912 	rsp_pdu->task = task;
2913 	task->scsi.ref++;
2914 
2915 	rsph->opcode = ISCSI_OP_SCSI_DATAIN;
2916 
2917 	if (F_bit) {
2918 		rsph->flags |= ISCSI_FLAG_FINAL;
2919 	}
2920 
2921 	/* we leave the A_bit clear */
2922 
2923 	if (F_bit && S_bit)  {
2924 		if (O_bit) {
2925 			rsph->flags |= ISCSI_DATAIN_OVERFLOW;
2926 		}
2927 
2928 		if (U_bit) {
2929 			rsph->flags |= ISCSI_DATAIN_UNDERFLOW;
2930 		}
2931 	}
2932 
2933 	if (S_bit) {
2934 		rsph->flags |= ISCSI_DATAIN_STATUS;
2935 		rsph->status = task->scsi.status;
2936 	}
2937 
2938 	DSET24(rsph->data_segment_len, len);
2939 
2940 	to_be32(&rsph->itt, task_tag);
2941 	to_be32(&rsph->ttt, transfer_tag);
2942 
2943 	if (S_bit) {
2944 		to_be32(&rsph->stat_sn, conn->StatSN);
2945 		conn->StatSN++;
2946 	}
2947 
2948 	if (F_bit && S_bit && !iscsi_task_is_immediate(primary)) {
2949 		conn->sess->MaxCmdSN++;
2950 	}
2951 
2952 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2953 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2954 
2955 	to_be32(&rsph->data_sn, DataSN);
2956 
2957 	if (conn->sess->ErrorRecoveryLevel >= 1) {
2958 		primary->datain_datasn = DataSN;
2959 	}
2960 	DataSN++;
2961 
2962 	offset += task->scsi.offset;
2963 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2964 
2965 	if (F_bit && S_bit) {
2966 		to_be32(&rsph->res_cnt, residual_len);
2967 	}
2968 
2969 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
2970 	if (spdk_likely(lun_dev != NULL)) {
2971 		if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(lun_dev, &task->scsi,
2972 				  &rsp_pdu->dif_ctx))) {
2973 			rsp_pdu->dif_insert_or_strip = true;
2974 		}
2975 	}
2976 
2977 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_datain_pdu_complete, conn);
2978 
2979 	return DataSN;
2980 }
2981 
2982 static int
2983 iscsi_transfer_in(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
2984 {
2985 	uint32_t DataSN;
2986 	uint32_t transfer_len;
2987 	uint32_t data_len;
2988 	uint32_t segment_len;
2989 	uint32_t offset;
2990 	uint32_t residual_len = 0;
2991 	int sent_status;
2992 	uint32_t len;
2993 	int datain_flag = 0;
2994 	int datain_seq_cnt;
2995 	int i;
2996 	uint32_t sequence_end;
2997 	struct spdk_iscsi_task *primary;
2998 
2999 	primary = iscsi_task_get_primary(task);
3000 	segment_len = conn->MaxRecvDataSegmentLength;
3001 	data_len = task->scsi.data_transferred;
3002 	transfer_len = task->scsi.length;
3003 
3004 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
3005 		return 0;
3006 	}
3007 
3008 	if (data_len < transfer_len) {
3009 		/* underflow */
3010 		SPDK_DEBUGLOG(iscsi, "Underflow %u/%u\n", data_len, transfer_len);
3011 		residual_len = transfer_len - data_len;
3012 		transfer_len = data_len;
3013 		datain_flag |= ISCSI_DATAIN_UNDERFLOW;
3014 	} else if (data_len > transfer_len) {
3015 		/* overflow */
3016 		SPDK_DEBUGLOG(iscsi, "Overflow %u/%u\n", data_len, transfer_len);
3017 		residual_len = data_len - transfer_len;
3018 		datain_flag |= ISCSI_DATAIN_OVERFLOW;
3019 	} else {
3020 		SPDK_DEBUGLOG(iscsi, "Transfer %u\n", transfer_len);
3021 		residual_len = 0;
3022 	}
3023 
3024 	DataSN = primary->datain_datasn;
3025 	sent_status = 0;
3026 
3027 	/* calculate the number of sequences for all data-in pdus */
3028 	datain_seq_cnt = 1 + ((transfer_len - 1) / (int)conn->sess->MaxBurstLength);
3029 	for (i = 0; i < datain_seq_cnt; i++) {
3030 		offset = i * conn->sess->MaxBurstLength;
3031 		sequence_end = spdk_min(((i + 1) * conn->sess->MaxBurstLength),
3032 					transfer_len);
3033 
3034 		/* send data split by segment_len */
3035 		for (; offset < sequence_end; offset += segment_len) {
3036 			len = spdk_min(segment_len, (sequence_end - offset));
3037 
3038 			datain_flag &= ~(ISCSI_FLAG_FINAL | ISCSI_DATAIN_STATUS);
3039 
3040 			if (offset + len == sequence_end) {
3041 				/* last PDU in a sequence */
3042 				datain_flag |= ISCSI_FLAG_FINAL;
3043 				if (task->scsi.sense_data_len == 0) {
3044 					/* The last pdu in all data-in pdus */
3045 					if ((offset + len) == transfer_len &&
3046 					    (primary->bytes_completed == primary->scsi.transfer_len)) {
3047 						datain_flag |= ISCSI_DATAIN_STATUS;
3048 						sent_status = 1;
3049 					}
3050 				}
3051 			}
3052 
3053 			SPDK_DEBUGLOG(iscsi, "Transfer=%d, Offset=%d, Len=%d\n",
3054 				      sequence_end, offset, len);
3055 			SPDK_DEBUGLOG(iscsi, "StatSN=%u, DataSN=%u, Offset=%u, Len=%d\n",
3056 				      conn->StatSN, DataSN, offset, len);
3057 
3058 			DataSN = iscsi_send_datain(conn, task, datain_flag, residual_len,
3059 						   offset, DataSN, len);
3060 		}
3061 	}
3062 
3063 	if (task != primary) {
3064 		primary->scsi.data_transferred += task->scsi.data_transferred;
3065 	}
3066 	primary->datain_datasn = DataSN;
3067 
3068 	return sent_status;
3069 }
3070 
3071 void
3072 iscsi_task_response(struct spdk_iscsi_conn *conn,
3073 		    struct spdk_iscsi_task *task)
3074 {
3075 	struct spdk_iscsi_pdu *rsp_pdu;
3076 	struct iscsi_bhs_scsi_resp *rsph;
3077 	uint32_t task_tag;
3078 	uint32_t transfer_len;
3079 	size_t residual_len;
3080 	size_t data_len;
3081 	int O_bit, U_bit;
3082 	int rc;
3083 	struct spdk_iscsi_task *primary;
3084 
3085 	primary = iscsi_task_get_primary(task);
3086 
3087 	transfer_len = primary->scsi.transfer_len;
3088 	task_tag = task->tag;
3089 
3090 	/* transfer data from logical unit */
3091 	/* (direction is view of initiator side) */
3092 	if (iscsi_task_is_read(primary)) {
3093 		rc = iscsi_transfer_in(conn, task);
3094 		if (rc > 0) {
3095 			/* sent status by last DATAIN PDU */
3096 			return;
3097 		}
3098 
3099 		if (primary->bytes_completed != primary->scsi.transfer_len) {
3100 			return;
3101 		}
3102 	}
3103 
3104 	O_bit = U_bit = 0;
3105 	residual_len = 0;
3106 	data_len = primary->scsi.data_transferred;
3107 
3108 	if ((transfer_len != 0) &&
3109 	    (task->scsi.status == SPDK_SCSI_STATUS_GOOD)) {
3110 		if (data_len < transfer_len) {
3111 			/* underflow */
3112 			SPDK_DEBUGLOG(iscsi, "Underflow %zu/%u\n", data_len, transfer_len);
3113 			residual_len = transfer_len - data_len;
3114 			U_bit = 1;
3115 		} else if (data_len > transfer_len) {
3116 			/* overflow */
3117 			SPDK_DEBUGLOG(iscsi, "Overflow %zu/%u\n", data_len, transfer_len);
3118 			residual_len = data_len - transfer_len;
3119 			O_bit = 1;
3120 		} else {
3121 			SPDK_DEBUGLOG(iscsi, "Transfer %u\n", transfer_len);
3122 		}
3123 	}
3124 
3125 	/* response PDU */
3126 	rsp_pdu = iscsi_get_pdu(conn);
3127 	assert(rsp_pdu != NULL);
3128 	rsph = (struct iscsi_bhs_scsi_resp *)&rsp_pdu->bhs;
3129 	assert(task->scsi.sense_data_len <= sizeof(rsp_pdu->sense.data));
3130 	memcpy(rsp_pdu->sense.data, task->scsi.sense_data, task->scsi.sense_data_len);
3131 	to_be16(&rsp_pdu->sense.length, task->scsi.sense_data_len);
3132 	rsp_pdu->data = (uint8_t *)&rsp_pdu->sense;
3133 	rsp_pdu->data_from_mempool = true;
3134 
3135 	/*
3136 	 * we need to hold onto this task/cmd because until the
3137 	 * PDU has been written out
3138 	 */
3139 	rsp_pdu->task = task;
3140 	task->scsi.ref++;
3141 
3142 	rsph->opcode = ISCSI_OP_SCSI_RSP;
3143 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
3144 
3145 	if (O_bit) {
3146 		rsph->flags |= ISCSI_SCSI_OVERFLOW;
3147 	}
3148 
3149 	if (U_bit) {
3150 		rsph->flags |= ISCSI_SCSI_UNDERFLOW;
3151 	}
3152 
3153 	rsph->status = task->scsi.status;
3154 	if (task->scsi.sense_data_len) {
3155 		/* SenseLength (2 bytes) + SenseData  */
3156 		DSET24(rsph->data_segment_len, 2 + task->scsi.sense_data_len);
3157 	}
3158 	to_be32(&rsph->itt, task_tag);
3159 
3160 	to_be32(&rsph->stat_sn, conn->StatSN);
3161 	conn->StatSN++;
3162 
3163 	if (!iscsi_task_is_immediate(primary)) {
3164 		conn->sess->MaxCmdSN++;
3165 	}
3166 
3167 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3168 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3169 
3170 	to_be32(&rsph->bi_read_res_cnt, 0);
3171 	to_be32(&rsph->res_cnt, residual_len);
3172 
3173 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3174 }
3175 
3176 /*
3177  *  This function compare the input pdu's bhs with the pdu's bhs associated by
3178  *  active_r2t_tasks and queued_r2t_tasks in a connection
3179  */
3180 static bool
3181 iscsi_compare_pdu_bhs_within_existed_r2t_tasks(struct spdk_iscsi_conn *conn,
3182 		struct spdk_iscsi_pdu *pdu)
3183 {
3184 	struct spdk_iscsi_task	*task;
3185 
3186 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
3187 		if (!memcmp(&pdu->bhs, iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
3188 			return true;
3189 		}
3190 	}
3191 
3192 	TAILQ_FOREACH(task, &conn->queued_r2t_tasks, link) {
3193 		if (!memcmp(&pdu->bhs, iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
3194 			return true;
3195 		}
3196 	}
3197 
3198 	return false;
3199 }
3200 
3201 void
3202 iscsi_queue_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3203 {
3204 	spdk_trace_record(TRACE_ISCSI_TASK_QUEUE, conn->id, task->scsi.length,
3205 			  (uintptr_t)task, (uintptr_t)task->pdu);
3206 	task->is_queued = true;
3207 	spdk_scsi_dev_queue_task(conn->dev, &task->scsi);
3208 }
3209 
3210 static int
3211 iscsi_pdu_payload_op_scsi_read(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3212 {
3213 	if (task->scsi.transfer_len <= SPDK_BDEV_LARGE_BUF_MAX_SIZE) {
3214 		task->parent = NULL;
3215 		task->scsi.offset = 0;
3216 		task->scsi.length = task->scsi.transfer_len;
3217 		spdk_scsi_task_set_data(&task->scsi, NULL, 0);
3218 
3219 		iscsi_queue_task(conn, task);
3220 		return 0;
3221 	} else {
3222 		TAILQ_INIT(&task->subtask_list);
3223 		task->current_data_offset = 0;
3224 		TAILQ_INSERT_TAIL(&conn->queued_datain_tasks, task, link);
3225 
3226 		return iscsi_conn_handle_queued_datain_tasks(conn);
3227 	}
3228 }
3229 
3230 static int
3231 iscsi_submit_write_subtask(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task,
3232 			   struct spdk_iscsi_pdu *pdu, struct spdk_mobj *mobj)
3233 {
3234 	struct spdk_iscsi_task *subtask;
3235 
3236 	subtask = iscsi_task_get(conn, task, iscsi_task_cpl);
3237 	if (subtask == NULL) {
3238 		SPDK_ERRLOG("Unable to acquire subtask\n");
3239 		return SPDK_ISCSI_CONNECTION_FATAL;
3240 	}
3241 	subtask->scsi.offset = task->current_data_offset;
3242 	subtask->scsi.length = mobj->data_len;
3243 	iscsi_task_associate_pdu(subtask, pdu);
3244 
3245 	task->current_data_offset += mobj->data_len;
3246 
3247 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
3248 		spdk_scsi_task_set_data(&subtask->scsi, mobj->buf, mobj->data_len);
3249 	} else {
3250 		spdk_scsi_task_set_data(&subtask->scsi, mobj->buf, pdu->data_buf_len);
3251 	}
3252 
3253 	iscsi_queue_task(conn, subtask);
3254 	return 0;
3255 }
3256 
3257 static int
3258 iscsi_pdu_payload_op_scsi_write(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3259 {
3260 	struct spdk_iscsi_pdu *pdu;
3261 	struct iscsi_bhs_scsi_req *reqh;
3262 	uint32_t transfer_len;
3263 	struct spdk_mobj *mobj;
3264 	int rc;
3265 
3266 	pdu = iscsi_task_get_pdu(task);
3267 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
3268 
3269 	transfer_len = task->scsi.transfer_len;
3270 
3271 	if (reqh->final_bit &&
3272 	    pdu->data_segment_len < transfer_len) {
3273 		/* needs R2T */
3274 		rc = add_transfer_task(conn, task);
3275 		if (rc < 0) {
3276 			SPDK_ERRLOG("add_transfer_task() failed\n");
3277 			iscsi_task_put(task);
3278 			return SPDK_ISCSI_CONNECTION_FATAL;
3279 		}
3280 
3281 		/* immediate writes */
3282 		if (pdu->data_segment_len != 0) {
3283 			mobj = pdu->mobj[0];
3284 			assert(mobj != NULL);
3285 
3286 			if (!pdu->dif_insert_or_strip &&
3287 			    mobj->data_len < SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
3288 				/* continue aggregation until the first data buffer is full. */
3289 				iscsi_task_set_mobj(task, mobj);
3290 				pdu->mobj[0] = NULL;
3291 			} else {
3292 				/* we are doing the first partial write task */
3293 				rc = iscsi_submit_write_subtask(conn, task, pdu, mobj);
3294 				if (rc < 0) {
3295 					iscsi_task_put(task);
3296 					return SPDK_ISCSI_CONNECTION_FATAL;
3297 				}
3298 			}
3299 		}
3300 		return 0;
3301 	}
3302 
3303 	if (pdu->data_segment_len == transfer_len) {
3304 		/* we are doing small writes with no R2T */
3305 		if (spdk_likely(!pdu->dif_insert_or_strip)) {
3306 			spdk_scsi_task_set_data(&task->scsi, pdu->data, pdu->data_segment_len);
3307 		} else {
3308 			spdk_scsi_task_set_data(&task->scsi, pdu->data, pdu->data_buf_len);
3309 		}
3310 		task->scsi.length = transfer_len;
3311 	}
3312 
3313 	iscsi_queue_task(conn, task);
3314 	return 0;
3315 }
3316 
3317 static int
3318 iscsi_pdu_hdr_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3319 {
3320 	struct spdk_iscsi_task	*task;
3321 	struct spdk_scsi_dev	*dev;
3322 	uint8_t *cdb;
3323 	uint64_t lun;
3324 	uint32_t task_tag;
3325 	uint32_t transfer_len;
3326 	int R_bit, W_bit;
3327 	int lun_i;
3328 	struct iscsi_bhs_scsi_req *reqh;
3329 
3330 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3331 		SPDK_ERRLOG("ISCSI_OP_SCSI not allowed in discovery and invalid session\n");
3332 		return SPDK_ISCSI_CONNECTION_FATAL;
3333 	}
3334 
3335 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
3336 
3337 	R_bit = reqh->read_bit;
3338 	W_bit = reqh->write_bit;
3339 	lun = from_be64(&reqh->lun);
3340 	task_tag = from_be32(&reqh->itt);
3341 	transfer_len = from_be32(&reqh->expected_data_xfer_len);
3342 	cdb = reqh->cdb;
3343 
3344 	SPDK_LOGDUMP(iscsi, "CDB", cdb, 16);
3345 
3346 	task = iscsi_task_get(conn, NULL, iscsi_task_cpl);
3347 	if (!task) {
3348 		SPDK_ERRLOG("Unable to acquire task\n");
3349 		return SPDK_ISCSI_CONNECTION_FATAL;
3350 	}
3351 
3352 	iscsi_task_associate_pdu(task, pdu);
3353 	lun_i = spdk_scsi_lun_id_fmt_to_int(lun);
3354 	task->lun_id = lun_i;
3355 	dev = conn->dev;
3356 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3357 
3358 	if ((R_bit != 0) && (W_bit != 0)) {
3359 		SPDK_ERRLOG("Bidirectional CDB is not supported\n");
3360 		iscsi_task_put(task);
3361 		return SPDK_ISCSI_CONNECTION_FATAL;
3362 	}
3363 
3364 	task->scsi.cdb = cdb;
3365 	task->tag = task_tag;
3366 	task->scsi.transfer_len = transfer_len;
3367 	task->scsi.target_port = conn->target_port;
3368 	task->scsi.initiator_port = conn->initiator_port;
3369 	task->parent = NULL;
3370 	task->scsi.status = SPDK_SCSI_STATUS_GOOD;
3371 
3372 	if (task->scsi.lun == NULL) {
3373 		spdk_scsi_task_process_null_lun(&task->scsi);
3374 		iscsi_task_cpl(&task->scsi);
3375 		return 0;
3376 	}
3377 
3378 	/* no bi-directional support */
3379 	if (R_bit) {
3380 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_FROM_DEV;
3381 	} else if (W_bit) {
3382 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_TO_DEV;
3383 
3384 		if ((conn->sess->ErrorRecoveryLevel >= 1) &&
3385 		    (iscsi_compare_pdu_bhs_within_existed_r2t_tasks(conn, pdu))) {
3386 			iscsi_task_response(conn, task);
3387 			iscsi_task_put(task);
3388 			return 0;
3389 		}
3390 
3391 		if (pdu->data_segment_len > iscsi_get_max_immediate_data_size()) {
3392 			SPDK_ERRLOG("data segment len(=%zu) > immediate data len(=%"PRIu32")\n",
3393 				    pdu->data_segment_len, iscsi_get_max_immediate_data_size());
3394 			iscsi_task_put(task);
3395 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3396 		}
3397 
3398 		if (pdu->data_segment_len > transfer_len) {
3399 			SPDK_ERRLOG("data segment len(=%zu) > task transfer len(=%d)\n",
3400 				    pdu->data_segment_len, transfer_len);
3401 			iscsi_task_put(task);
3402 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3403 		}
3404 
3405 		/* check the ImmediateData and also pdu->data_segment_len */
3406 		if ((!conn->sess->ImmediateData && (pdu->data_segment_len > 0)) ||
3407 		    (pdu->data_segment_len > conn->sess->FirstBurstLength)) {
3408 			iscsi_task_put(task);
3409 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3410 		}
3411 
3412 		if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(task->scsi.lun, &task->scsi, &pdu->dif_ctx))) {
3413 			pdu->dif_insert_or_strip = true;
3414 		} else if (reqh->final_bit && pdu->data_segment_len < transfer_len) {
3415 			pdu->data_buf_len = spdk_min(transfer_len,
3416 						     SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
3417 		}
3418 	} else {
3419 		/* neither R nor W bit set */
3420 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_NONE;
3421 		if (transfer_len > 0) {
3422 			iscsi_task_put(task);
3423 			SPDK_ERRLOG("Reject scsi cmd with EDTL > 0 but (R | W) == 0\n");
3424 			return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3425 		}
3426 	}
3427 
3428 	pdu->task = task;
3429 	return 0;
3430 }
3431 
3432 static int
3433 iscsi_pdu_payload_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3434 {
3435 	struct spdk_iscsi_task *task;
3436 
3437 	if (pdu->task == NULL) {
3438 		return 0;
3439 	}
3440 
3441 	task = pdu->task;
3442 
3443 	if (spdk_scsi_dev_get_lun(conn->dev, task->lun_id) == NULL) {
3444 		spdk_scsi_task_process_null_lun(&task->scsi);
3445 		iscsi_task_cpl(&task->scsi);
3446 		return 0;
3447 	}
3448 
3449 	switch (task->scsi.dxfer_dir) {
3450 	case SPDK_SCSI_DIR_FROM_DEV:
3451 		return iscsi_pdu_payload_op_scsi_read(conn, task);
3452 	case SPDK_SCSI_DIR_TO_DEV:
3453 		return iscsi_pdu_payload_op_scsi_write(conn, task);
3454 	case SPDK_SCSI_DIR_NONE:
3455 		iscsi_queue_task(conn, task);
3456 		return 0;
3457 	default:
3458 		assert(false);
3459 		iscsi_task_put(task);
3460 		break;
3461 	}
3462 
3463 	return SPDK_ISCSI_CONNECTION_FATAL;
3464 }
3465 
3466 void
3467 iscsi_task_mgmt_response(struct spdk_iscsi_conn *conn,
3468 			 struct spdk_iscsi_task *task)
3469 {
3470 	struct spdk_iscsi_pdu *rsp_pdu;
3471 	struct iscsi_bhs_task_req *reqh;
3472 	struct iscsi_bhs_task_resp *rsph;
3473 
3474 	if (task->pdu == NULL) {
3475 		/*
3476 		 * This was an internally generated task management command,
3477 		 *  usually from LUN cleanup when a connection closes.
3478 		 */
3479 		return;
3480 	}
3481 
3482 	reqh = (struct iscsi_bhs_task_req *)&task->pdu->bhs;
3483 	/* response PDU */
3484 	rsp_pdu = iscsi_get_pdu(conn);
3485 	rsph = (struct iscsi_bhs_task_resp *)&rsp_pdu->bhs;
3486 	rsph->opcode = ISCSI_OP_TASK_RSP;
3487 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3488 	switch (task->scsi.response) {
3489 	case SPDK_SCSI_TASK_MGMT_RESP_COMPLETE:
3490 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3491 		break;
3492 	case SPDK_SCSI_TASK_MGMT_RESP_SUCCESS:
3493 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3494 		break;
3495 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT:
3496 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3497 		break;
3498 	case SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN:
3499 		rsph->response = ISCSI_TASK_FUNC_RESP_LUN_NOT_EXIST;
3500 		break;
3501 	case SPDK_SCSI_TASK_MGMT_RESP_TARGET_FAILURE:
3502 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3503 		break;
3504 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED:
3505 		rsph->response = ISCSI_TASK_FUNC_RESP_FUNC_NOT_SUPPORTED;
3506 		break;
3507 	}
3508 	rsph->itt = reqh->itt;
3509 
3510 	to_be32(&rsph->stat_sn, conn->StatSN);
3511 	conn->StatSN++;
3512 
3513 	if (reqh->immediate == 0) {
3514 		conn->sess->MaxCmdSN++;
3515 	}
3516 
3517 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3518 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3519 
3520 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3521 }
3522 
3523 static void
3524 iscsi_queue_mgmt_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3525 {
3526 	struct spdk_scsi_lun *lun;
3527 
3528 	lun = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
3529 	if (lun == NULL) {
3530 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3531 		iscsi_task_mgmt_response(conn, task);
3532 		iscsi_task_put(task);
3533 		return;
3534 	}
3535 
3536 	spdk_scsi_dev_queue_mgmt_task(conn->dev, &task->scsi);
3537 }
3538 
3539 static int
3540 _iscsi_op_abort_task(void *arg)
3541 {
3542 	struct spdk_iscsi_task *task = arg;
3543 	int rc;
3544 
3545 	rc = iscsi_conn_abort_queued_datain_task(task->conn, task->scsi.abort_id);
3546 	if (rc != 0) {
3547 		return SPDK_POLLER_BUSY;
3548 	}
3549 
3550 	spdk_poller_unregister(&task->mgmt_poller);
3551 	iscsi_queue_mgmt_task(task->conn, task);
3552 	return SPDK_POLLER_BUSY;
3553 }
3554 
3555 static void
3556 iscsi_op_abort_task(struct spdk_iscsi_task *task, uint32_t ref_task_tag)
3557 {
3558 	task->scsi.abort_id = ref_task_tag;
3559 	task->scsi.function = SPDK_SCSI_TASK_FUNC_ABORT_TASK;
3560 	task->mgmt_poller = SPDK_POLLER_REGISTER(_iscsi_op_abort_task, task, 10);
3561 }
3562 
3563 static int
3564 _iscsi_op_abort_task_set(void *arg)
3565 {
3566 	struct spdk_iscsi_task *task = arg;
3567 	int rc;
3568 
3569 	rc = iscsi_conn_abort_queued_datain_tasks(task->conn, task->scsi.lun,
3570 			task->pdu);
3571 	if (rc != 0) {
3572 		return SPDK_POLLER_BUSY;
3573 	}
3574 
3575 	spdk_poller_unregister(&task->mgmt_poller);
3576 	iscsi_queue_mgmt_task(task->conn, task);
3577 	return SPDK_POLLER_BUSY;
3578 }
3579 
3580 void
3581 iscsi_op_abort_task_set(struct spdk_iscsi_task *task, uint8_t function)
3582 {
3583 	task->scsi.function = function;
3584 	task->mgmt_poller = SPDK_POLLER_REGISTER(_iscsi_op_abort_task_set, task, 10);
3585 }
3586 
3587 static int
3588 iscsi_pdu_hdr_op_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3589 {
3590 	struct iscsi_bhs_task_req *reqh;
3591 	uint64_t lun;
3592 	uint32_t task_tag;
3593 	uint32_t ref_task_tag;
3594 	uint8_t function;
3595 	int lun_i;
3596 	struct spdk_iscsi_task *task;
3597 	struct spdk_scsi_dev *dev;
3598 
3599 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3600 		SPDK_ERRLOG("ISCSI_OP_TASK not allowed in discovery and invalid session\n");
3601 		return SPDK_ISCSI_CONNECTION_FATAL;
3602 	}
3603 
3604 	reqh = (struct iscsi_bhs_task_req *)&pdu->bhs;
3605 	function = reqh->flags & ISCSI_TASK_FUNCTION_MASK;
3606 	lun = from_be64(&reqh->lun);
3607 	task_tag = from_be32(&reqh->itt);
3608 	ref_task_tag = from_be32(&reqh->ref_task_tag);
3609 
3610 	SPDK_DEBUGLOG(iscsi, "I=%d, func=%d, ITT=%x, ref TT=%x, LUN=0x%16.16"PRIx64"\n",
3611 		      reqh->immediate, function, task_tag, ref_task_tag, lun);
3612 
3613 	SPDK_DEBUGLOG(iscsi, "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3614 		      conn->StatSN, conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
3615 
3616 	lun_i = spdk_scsi_lun_id_fmt_to_int(lun);
3617 	dev = conn->dev;
3618 
3619 	task = iscsi_task_get(conn, NULL, iscsi_task_mgmt_cpl);
3620 	if (!task) {
3621 		SPDK_ERRLOG("Unable to acquire task\n");
3622 		return SPDK_ISCSI_CONNECTION_FATAL;
3623 	}
3624 
3625 	iscsi_task_associate_pdu(task, pdu);
3626 	task->scsi.target_port = conn->target_port;
3627 	task->scsi.initiator_port = conn->initiator_port;
3628 	task->tag = task_tag;
3629 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3630 	task->lun_id = lun_i;
3631 
3632 	if (task->scsi.lun == NULL) {
3633 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3634 		iscsi_task_mgmt_response(conn, task);
3635 		iscsi_task_put(task);
3636 		return 0;
3637 	}
3638 
3639 	switch (function) {
3640 	/* abort task identified by Referenced Task Tag field */
3641 	case ISCSI_TASK_FUNC_ABORT_TASK:
3642 		SPDK_NOTICELOG("ABORT_TASK\n");
3643 
3644 		iscsi_del_transfer_task(conn, ref_task_tag);
3645 		iscsi_op_abort_task(task, ref_task_tag);
3646 		return 0;
3647 
3648 	/* abort all tasks issued via this session on the LUN */
3649 	case ISCSI_TASK_FUNC_ABORT_TASK_SET:
3650 		SPDK_NOTICELOG("ABORT_TASK_SET\n");
3651 
3652 		iscsi_clear_all_transfer_task(conn, task->scsi.lun, pdu);
3653 		iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_ABORT_TASK_SET);
3654 		return 0;
3655 
3656 	case ISCSI_TASK_FUNC_CLEAR_TASK_SET:
3657 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3658 		SPDK_NOTICELOG("CLEAR_TASK_SET (Unsupported)\n");
3659 		break;
3660 
3661 	case ISCSI_TASK_FUNC_CLEAR_ACA:
3662 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3663 		SPDK_NOTICELOG("CLEAR_ACA (Unsupported)\n");
3664 		break;
3665 
3666 	case ISCSI_TASK_FUNC_LOGICAL_UNIT_RESET:
3667 		SPDK_NOTICELOG("LOGICAL_UNIT_RESET\n");
3668 
3669 		iscsi_clear_all_transfer_task(conn, task->scsi.lun, pdu);
3670 		iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
3671 		return 0;
3672 
3673 	case ISCSI_TASK_FUNC_TARGET_WARM_RESET:
3674 		SPDK_NOTICELOG("TARGET_WARM_RESET (Unsupported)\n");
3675 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3676 		break;
3677 
3678 	case ISCSI_TASK_FUNC_TARGET_COLD_RESET:
3679 		SPDK_NOTICELOG("TARGET_COLD_RESET (Unsupported)\n");
3680 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3681 		break;
3682 
3683 	case ISCSI_TASK_FUNC_TASK_REASSIGN:
3684 		SPDK_NOTICELOG("TASK_REASSIGN (Unsupported)\n");
3685 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3686 		break;
3687 
3688 	default:
3689 		SPDK_ERRLOG("unsupported function %d\n", function);
3690 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT;
3691 		break;
3692 	}
3693 
3694 	iscsi_task_mgmt_response(conn, task);
3695 	iscsi_task_put(task);
3696 	return 0;
3697 }
3698 
3699 static int
3700 iscsi_pdu_hdr_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3701 {
3702 	struct iscsi_bhs_nop_out *reqh;
3703 	uint32_t task_tag;
3704 	uint32_t transfer_tag;
3705 	int I_bit;
3706 
3707 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
3708 		SPDK_ERRLOG("ISCSI_OP_NOPOUT not allowed in discovery session\n");
3709 		return SPDK_ISCSI_CONNECTION_FATAL;
3710 	}
3711 
3712 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3713 	I_bit = reqh->immediate;
3714 
3715 	if (pdu->data_segment_len > SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
3716 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3717 	}
3718 
3719 	task_tag = from_be32(&reqh->itt);
3720 	transfer_tag = from_be32(&reqh->ttt);
3721 
3722 	SPDK_DEBUGLOG(iscsi, "I=%d, ITT=%x, TTT=%x\n",
3723 		      I_bit, task_tag, transfer_tag);
3724 
3725 	SPDK_DEBUGLOG(iscsi, "CmdSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3726 		      pdu->cmd_sn, conn->StatSN, conn->sess->ExpCmdSN,
3727 		      conn->sess->MaxCmdSN);
3728 
3729 	if (transfer_tag != 0xFFFFFFFF && transfer_tag != (uint32_t)conn->id) {
3730 		SPDK_ERRLOG("invalid transfer tag 0x%x\n", transfer_tag);
3731 		/*
3732 		 * Technically we should probably fail the connection here, but for now
3733 		 *  just print the error message and continue.
3734 		 */
3735 	}
3736 
3737 	if (task_tag == 0xffffffffU && I_bit == 0) {
3738 		SPDK_ERRLOG("got NOPOUT ITT=0xffffffff, I=0\n");
3739 		return SPDK_ISCSI_CONNECTION_FATAL;
3740 	}
3741 
3742 	return 0;
3743 }
3744 
3745 static int
3746 iscsi_pdu_payload_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3747 {
3748 	struct spdk_iscsi_pdu *rsp_pdu;
3749 	struct iscsi_bhs_nop_out *reqh;
3750 	struct iscsi_bhs_nop_in *rsph;
3751 	uint8_t *data;
3752 	uint64_t lun;
3753 	uint32_t task_tag;
3754 	int I_bit;
3755 	int data_len;
3756 
3757 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3758 	I_bit = reqh->immediate;
3759 
3760 	data_len = pdu->data_segment_len;
3761 	if (data_len > conn->MaxRecvDataSegmentLength) {
3762 		data_len = conn->MaxRecvDataSegmentLength;
3763 	}
3764 
3765 	lun = from_be64(&reqh->lun);
3766 	task_tag = from_be32(&reqh->itt);
3767 
3768 	/*
3769 	 * We don't actually check to see if this is a response to the NOP-In
3770 	 * that we sent.  Our goal is to just verify that the initiator is
3771 	 * alive and responding to commands, not to verify that it tags
3772 	 * NOP-Outs correctly
3773 	 */
3774 	conn->nop_outstanding = false;
3775 
3776 	if (task_tag == 0xffffffffU) {
3777 		assert(I_bit == 1);
3778 		SPDK_DEBUGLOG(iscsi, "got NOPOUT ITT=0xffffffff\n");
3779 		return 0;
3780 	}
3781 
3782 	data = calloc(1, data_len);
3783 	if (!data) {
3784 		SPDK_ERRLOG("calloc() failed for ping data\n");
3785 		return SPDK_ISCSI_CONNECTION_FATAL;
3786 	}
3787 
3788 	/* response of NOPOUT */
3789 	if (data_len > 0) {
3790 		/* copy ping data */
3791 		memcpy(data, pdu->data, data_len);
3792 	}
3793 
3794 	/* response PDU */
3795 	rsp_pdu = iscsi_get_pdu(conn);
3796 	assert(rsp_pdu != NULL);
3797 
3798 	rsph = (struct iscsi_bhs_nop_in *)&rsp_pdu->bhs;
3799 	rsp_pdu->data = data;
3800 	rsph->opcode = ISCSI_OP_NOPIN;
3801 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3802 	DSET24(rsph->data_segment_len, data_len);
3803 	to_be64(&rsph->lun, lun);
3804 	to_be32(&rsph->itt, task_tag);
3805 	to_be32(&rsph->ttt, 0xffffffffU);
3806 
3807 	to_be32(&rsph->stat_sn, conn->StatSN);
3808 	conn->StatSN++;
3809 
3810 	if (I_bit == 0) {
3811 		conn->sess->MaxCmdSN++;
3812 	}
3813 
3814 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3815 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3816 
3817 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3818 	conn->last_nopin = spdk_get_ticks();
3819 
3820 	return 0;
3821 }
3822 
3823 /* This function returns the spdk_scsi_task by searching the snack list via
3824  * task transfertag and the pdu's opcode
3825  */
3826 static struct spdk_iscsi_task *
3827 get_scsi_task_from_ttt(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
3828 {
3829 	struct spdk_iscsi_pdu *pdu;
3830 	struct iscsi_bhs_data_in *datain_bhs;
3831 
3832 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3833 		if (pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3834 			datain_bhs = (struct iscsi_bhs_data_in *)&pdu->bhs;
3835 			if (from_be32(&datain_bhs->ttt) == transfer_tag) {
3836 				return pdu->task;
3837 			}
3838 		}
3839 	}
3840 
3841 	return NULL;
3842 }
3843 
3844 /* This function returns the spdk_scsi_task by searching the snack list via
3845  * initiator task tag and the pdu's opcode
3846  */
3847 static struct spdk_iscsi_task *
3848 get_scsi_task_from_itt(struct spdk_iscsi_conn *conn,
3849 		       uint32_t task_tag, enum iscsi_op opcode)
3850 {
3851 	struct spdk_iscsi_pdu *pdu;
3852 
3853 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3854 		if (pdu->bhs.opcode == opcode &&
3855 		    pdu->task != NULL &&
3856 		    pdu->task->tag == task_tag) {
3857 			return pdu->task;
3858 		}
3859 	}
3860 
3861 	return NULL;
3862 }
3863 
3864 /* This function is used to handle the r2t snack */
3865 static int
3866 iscsi_handle_r2t_snack(struct spdk_iscsi_conn *conn,
3867 		       struct spdk_iscsi_task *task,
3868 		       struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3869 		       uint32_t run_length, int32_t task_tag)
3870 {
3871 	int32_t last_r2tsn;
3872 	int i;
3873 
3874 	if (beg_run < task->acked_r2tsn) {
3875 		SPDK_ERRLOG("ITT: 0x%08x, R2T SNACK requests retransmission of"
3876 			    "R2TSN: from 0x%08x to 0x%08x. But it has already"
3877 			    "ack to R2TSN:0x%08x, protocol error.\n",
3878 			    task_tag, beg_run, (beg_run + run_length),
3879 			    (task->acked_r2tsn - 1));
3880 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3881 	}
3882 
3883 	if (run_length) {
3884 		if ((beg_run + run_length) > task->R2TSN) {
3885 			SPDK_ERRLOG("ITT: 0x%08x, received R2T SNACK with"
3886 				    "BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
3887 				    "current R2TSN: 0x%08x, protocol error.\n",
3888 				    task_tag, beg_run, run_length,
3889 				    task->R2TSN);
3890 
3891 			return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3892 		}
3893 		last_r2tsn = (beg_run + run_length);
3894 	} else {
3895 		last_r2tsn = task->R2TSN;
3896 	}
3897 
3898 	for (i = beg_run; i < last_r2tsn; i++) {
3899 		if (iscsi_send_r2t_recovery(conn, task, i, false) < 0) {
3900 			SPDK_ERRLOG("The r2t_sn=%d of r2t_task=%p is not sent\n", i, task);
3901 		}
3902 	}
3903 	return 0;
3904 }
3905 
3906 /* This function is used to recover the data in packet */
3907 static int
3908 iscsi_handle_recovery_datain(struct spdk_iscsi_conn *conn,
3909 			     struct spdk_iscsi_task *task,
3910 			     struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3911 			     uint32_t run_length, uint32_t task_tag)
3912 {
3913 	struct spdk_iscsi_pdu *old_pdu, *pdu_temp;
3914 	uint32_t i;
3915 	struct iscsi_bhs_data_in *datain_header;
3916 	uint32_t last_statsn;
3917 
3918 	task = iscsi_task_get_primary(task);
3919 
3920 	SPDK_DEBUGLOG(iscsi, "iscsi_handle_recovery_datain\n");
3921 
3922 	if (beg_run < task->acked_data_sn) {
3923 		SPDK_ERRLOG("ITT: 0x%08x, DATA IN SNACK requests retransmission of"
3924 			    "DATASN: from 0x%08x to 0x%08x but already acked to "
3925 			    "DATASN: 0x%08x protocol error\n",
3926 			    task_tag, beg_run,
3927 			    (beg_run + run_length), (task->acked_data_sn - 1));
3928 
3929 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3930 	}
3931 
3932 	if (run_length == 0) {
3933 		/* as the DataSN begins at 0 */
3934 		run_length = task->datain_datasn + 1;
3935 	}
3936 
3937 	if ((beg_run + run_length - 1) > task->datain_datasn) {
3938 		SPDK_ERRLOG("Initiator requests BegRun: 0x%08x, RunLength:"
3939 			    "0x%08x greater than maximum DataSN: 0x%08x.\n",
3940 			    beg_run, run_length, task->datain_datasn);
3941 
3942 		return -1;
3943 	} else {
3944 		last_statsn = beg_run + run_length - 1;
3945 	}
3946 
3947 	for (i = beg_run; i <= last_statsn; i++) {
3948 		TAILQ_FOREACH_SAFE(old_pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
3949 			if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3950 				datain_header = (struct iscsi_bhs_data_in *)&old_pdu->bhs;
3951 				if (from_be32(&datain_header->itt) == task_tag &&
3952 				    from_be32(&datain_header->data_sn) == i) {
3953 					TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
3954 					iscsi_conn_write_pdu(conn, old_pdu, old_pdu->cb_fn, old_pdu->cb_arg);
3955 					break;
3956 				}
3957 			}
3958 		}
3959 	}
3960 	return 0;
3961 }
3962 
3963 /* This function is used to handle the status snack */
3964 static int
3965 iscsi_handle_status_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3966 {
3967 	uint32_t beg_run;
3968 	uint32_t run_length;
3969 	struct iscsi_bhs_snack_req *reqh;
3970 	uint32_t i;
3971 	uint32_t last_statsn;
3972 	bool found_pdu;
3973 	struct spdk_iscsi_pdu *old_pdu;
3974 
3975 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
3976 	beg_run = from_be32(&reqh->beg_run);
3977 	run_length = from_be32(&reqh->run_len);
3978 
3979 	SPDK_DEBUGLOG(iscsi, "beg_run=%d, run_length=%d, conn->StatSN="
3980 		      "%d, conn->exp_statsn=%d\n", beg_run, run_length,
3981 		      conn->StatSN, conn->exp_statsn);
3982 
3983 	if (!beg_run) {
3984 		beg_run = conn->exp_statsn;
3985 	} else if (beg_run < conn->exp_statsn) {
3986 		SPDK_ERRLOG("Got Status SNACK Begrun: 0x%08x, RunLength: 0x%08x "
3987 			    "but already got ExpStatSN: 0x%08x on CID:%hu.\n",
3988 			    beg_run, run_length, conn->StatSN, conn->cid);
3989 
3990 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3991 	}
3992 
3993 	last_statsn = (!run_length) ? conn->StatSN : (beg_run + run_length);
3994 
3995 	for (i = beg_run; i < last_statsn; i++) {
3996 		found_pdu = false;
3997 		TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
3998 			if (from_be32(&old_pdu->bhs.stat_sn) == i) {
3999 				found_pdu = true;
4000 				break;
4001 			}
4002 		}
4003 
4004 		if (!found_pdu) {
4005 			SPDK_ERRLOG("Unable to find StatSN: 0x%08x. For a Status"
4006 				    "SNACK, assuming this is a proactive SNACK "
4007 				    "for an untransmitted StatSN, ignoring.\n",
4008 				    beg_run);
4009 		} else {
4010 			TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
4011 			iscsi_conn_write_pdu(conn, old_pdu, old_pdu->cb_fn, old_pdu->cb_arg);
4012 		}
4013 	}
4014 
4015 	return 0;
4016 }
4017 
4018 /* This function is used to handle the data ack snack */
4019 static int
4020 iscsi_handle_data_ack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4021 {
4022 	uint32_t transfer_tag;
4023 	uint32_t beg_run;
4024 	uint32_t run_length;
4025 	struct spdk_iscsi_pdu *old_pdu;
4026 	uint32_t old_datasn;
4027 	struct iscsi_bhs_snack_req *reqh;
4028 	struct spdk_iscsi_task *task;
4029 	struct iscsi_bhs_data_in *datain_header;
4030 	struct spdk_iscsi_task *primary;
4031 
4032 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4033 	transfer_tag = from_be32(&reqh->ttt);
4034 	beg_run = from_be32(&reqh->beg_run);
4035 	run_length = from_be32(&reqh->run_len);
4036 	task = NULL;
4037 	datain_header = NULL;
4038 
4039 	SPDK_DEBUGLOG(iscsi, "beg_run=%d,transfer_tag=%d,run_len=%d\n",
4040 		      beg_run, transfer_tag, run_length);
4041 
4042 	task = get_scsi_task_from_ttt(conn, transfer_tag);
4043 	if (!task) {
4044 		SPDK_ERRLOG("Data ACK SNACK for TTT: 0x%08x is invalid.\n",
4045 			    transfer_tag);
4046 		goto reject_return;
4047 	}
4048 
4049 	primary = iscsi_task_get_primary(task);
4050 	if ((run_length != 0) || (beg_run < primary->acked_data_sn)) {
4051 		SPDK_ERRLOG("TTT: 0x%08x Data ACK SNACK BegRUN: %d is less than "
4052 			    "the next expected acked DataSN: %d\n",
4053 			    transfer_tag, beg_run, primary->acked_data_sn);
4054 		goto reject_return;
4055 	}
4056 
4057 	primary->acked_data_sn = beg_run;
4058 
4059 	/* To free the pdu */
4060 	TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
4061 		if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
4062 			datain_header = (struct iscsi_bhs_data_in *) &old_pdu->bhs;
4063 			old_datasn = from_be32(&datain_header->data_sn);
4064 			if ((from_be32(&datain_header->ttt) == transfer_tag) &&
4065 			    (old_datasn == beg_run - 1)) {
4066 				TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
4067 				iscsi_conn_free_pdu(conn, old_pdu);
4068 				break;
4069 			}
4070 		}
4071 	}
4072 
4073 	SPDK_DEBUGLOG(iscsi, "Received Data ACK SNACK for TTT: 0x%08x,"
4074 		      " updated acked DataSN to 0x%08x.\n", transfer_tag,
4075 		      (task->acked_data_sn - 1));
4076 
4077 	return 0;
4078 
4079 reject_return:
4080 	return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_SNACK);
4081 }
4082 
4083 /* This function is used to handle the snack request from the initiator */
4084 static int
4085 iscsi_pdu_hdr_op_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4086 {
4087 	struct iscsi_bhs_snack_req *reqh;
4088 	struct spdk_iscsi_task *task;
4089 	int type;
4090 	uint32_t task_tag;
4091 	uint32_t beg_run;
4092 	uint32_t run_length;
4093 	int rc;
4094 
4095 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4096 		SPDK_ERRLOG("ISCSI_OP_SNACK not allowed in  discovery session\n");
4097 		return SPDK_ISCSI_CONNECTION_FATAL;
4098 	}
4099 
4100 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4101 	if (!conn->sess->ErrorRecoveryLevel) {
4102 		SPDK_ERRLOG("Got a SNACK request in ErrorRecoveryLevel=0\n");
4103 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4104 	}
4105 
4106 	type = reqh->flags & ISCSI_FLAG_SNACK_TYPE_MASK;
4107 	SPDK_DEBUGLOG(iscsi, "The value of type is %d\n", type);
4108 
4109 	switch (type) {
4110 	case 0:
4111 		reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4112 		task_tag = from_be32(&reqh->itt);
4113 		beg_run = from_be32(&reqh->beg_run);
4114 		run_length = from_be32(&reqh->run_len);
4115 
4116 		SPDK_DEBUGLOG(iscsi, "beg_run=%d, run_length=%d, "
4117 			      "task_tag=%x, transfer_tag=%u\n", beg_run,
4118 			      run_length, task_tag, from_be32(&reqh->ttt));
4119 
4120 		task = get_scsi_task_from_itt(conn, task_tag,
4121 					      ISCSI_OP_SCSI_DATAIN);
4122 		if (task) {
4123 			return iscsi_handle_recovery_datain(conn, task, pdu,
4124 							    beg_run, run_length, task_tag);
4125 		}
4126 		task = get_scsi_task_from_itt(conn, task_tag, ISCSI_OP_R2T);
4127 		if (task) {
4128 			return iscsi_handle_r2t_snack(conn, task, pdu, beg_run,
4129 						      run_length, task_tag);
4130 		}
4131 		SPDK_ERRLOG("It is Neither datain nor r2t recovery request\n");
4132 		rc = -1;
4133 		break;
4134 	case ISCSI_FLAG_SNACK_TYPE_STATUS:
4135 		rc = iscsi_handle_status_snack(conn, pdu);
4136 		break;
4137 	case ISCSI_FLAG_SNACK_TYPE_DATA_ACK:
4138 		rc = iscsi_handle_data_ack(conn, pdu);
4139 		break;
4140 	case ISCSI_FLAG_SNACK_TYPE_RDATA:
4141 		SPDK_ERRLOG("R-Data SNACK is Not Supported int spdk\n");
4142 		rc = iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4143 		break;
4144 	default:
4145 		SPDK_ERRLOG("Unknown SNACK type %d, protocol error\n", type);
4146 		rc = iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4147 		break;
4148 	}
4149 
4150 	return rc;
4151 }
4152 
4153 static inline uint32_t
4154 iscsi_get_mobj_max_data_len(struct spdk_mobj *mobj)
4155 {
4156 	if (mobj->mp == g_iscsi.pdu_immediate_data_pool) {
4157 		return iscsi_get_max_immediate_data_size();
4158 	} else {
4159 		return SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH;
4160 	}
4161 }
4162 
4163 static int
4164 iscsi_pdu_hdr_op_data(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4165 {
4166 	struct spdk_iscsi_task	*task;
4167 	struct iscsi_bhs_data_out *reqh;
4168 	struct spdk_scsi_lun	*lun_dev;
4169 	struct spdk_mobj	*mobj;
4170 	uint32_t transfer_tag;
4171 	uint32_t task_tag;
4172 	uint32_t transfer_len;
4173 	uint32_t DataSN;
4174 	uint32_t buffer_offset;
4175 	uint32_t len;
4176 	uint32_t current_desired_data_transfer_length;
4177 	int F_bit;
4178 	int rc;
4179 
4180 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4181 		SPDK_ERRLOG("ISCSI_OP_SCSI_DATAOUT not allowed in discovery session\n");
4182 		return SPDK_ISCSI_CONNECTION_FATAL;
4183 	}
4184 
4185 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4186 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
4187 	transfer_tag = from_be32(&reqh->ttt);
4188 	task_tag = from_be32(&reqh->itt);
4189 	DataSN = from_be32(&reqh->data_sn);
4190 	buffer_offset = from_be32(&reqh->buffer_offset);
4191 
4192 	if (pdu->data_segment_len > SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
4193 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4194 	}
4195 
4196 	task = get_transfer_task(conn, transfer_tag);
4197 	if (task == NULL) {
4198 		SPDK_ERRLOG("Not found task for transfer_tag=%x\n", transfer_tag);
4199 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4200 	}
4201 
4202 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
4203 	current_desired_data_transfer_length = task->desired_data_transfer_length;
4204 
4205 	if (pdu->data_segment_len > task->desired_data_transfer_length) {
4206 		SPDK_ERRLOG("the dataout pdu data length is larger than the value sent by R2T PDU\n");
4207 		return SPDK_ISCSI_CONNECTION_FATAL;
4208 	}
4209 
4210 	if (task->tag != task_tag) {
4211 		SPDK_ERRLOG("The r2t task tag is %u, and the dataout task tag is %u\n",
4212 			    task->tag, task_tag);
4213 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4214 	}
4215 
4216 	if (DataSN != task->r2t_datasn) {
4217 		SPDK_ERRLOG("DataSN(%u) exp=%d error\n", DataSN, task->r2t_datasn);
4218 		if (conn->sess->ErrorRecoveryLevel >= 1) {
4219 			rc = iscsi_send_r2t_recovery(conn, task, task->acked_r2tsn, true);
4220 			if (rc == 0) {
4221 				return 0;
4222 			}
4223 		}
4224 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4225 	}
4226 
4227 	if (buffer_offset != task->next_expected_r2t_offset) {
4228 		SPDK_ERRLOG("offset(%u) error\n", buffer_offset);
4229 		return SPDK_ISCSI_CONNECTION_FATAL;
4230 	}
4231 
4232 	transfer_len = task->scsi.transfer_len;
4233 	task->current_r2t_length += pdu->data_segment_len;
4234 	task->next_expected_r2t_offset += pdu->data_segment_len;
4235 	task->r2t_datasn++;
4236 
4237 	if (task->current_r2t_length > conn->sess->MaxBurstLength) {
4238 		SPDK_ERRLOG("R2T burst(%u) > MaxBurstLength(%u)\n",
4239 			    task->current_r2t_length,
4240 			    conn->sess->MaxBurstLength);
4241 		return SPDK_ISCSI_CONNECTION_FATAL;
4242 	}
4243 
4244 	if (F_bit) {
4245 		/*
4246 		 * This R2T burst is done. Clear the length before we
4247 		 *  receive a PDU for the next R2t burst.
4248 		 */
4249 		task->current_r2t_length = 0;
4250 	}
4251 
4252 	if (task->next_expected_r2t_offset == transfer_len) {
4253 		task->acked_r2tsn++;
4254 	} else if (F_bit && (task->next_r2t_offset < transfer_len)) {
4255 		task->acked_r2tsn++;
4256 		len = spdk_min(conn->sess->MaxBurstLength,
4257 			       (transfer_len - task->next_r2t_offset));
4258 		rc = iscsi_send_r2t(conn, task, task->next_r2t_offset, len,
4259 				    task->ttt, &task->R2TSN);
4260 		if (rc < 0) {
4261 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
4262 		}
4263 		task->next_r2t_offset += len;
4264 	}
4265 
4266 	if (lun_dev == NULL) {
4267 		SPDK_DEBUGLOG(iscsi, "LUN %d is removed, reject this PDU.\n",
4268 			      task->lun_id);
4269 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4270 	} else if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(lun_dev, &task->scsi, &pdu->dif_ctx))) {
4271 		pdu->dif_insert_or_strip = true;
4272 	}
4273 
4274 	mobj = iscsi_task_get_mobj(task);
4275 	if (mobj == NULL) {
4276 		if (!pdu->dif_insert_or_strip) {
4277 			/* More Data-OUT PDUs may follow. Increase the buffer size up to
4278 			 * SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH to merge them into a
4279 			 * single subtask.
4280 			 */
4281 			pdu->data_buf_len = spdk_min(current_desired_data_transfer_length,
4282 						     SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4283 		}
4284 	} else {
4285 		/* Set up the data buffer from the one saved by the primary task. */
4286 		pdu->mobj[0] = mobj;
4287 		pdu->data = (void *)((uint64_t)mobj->buf + mobj->data_len);
4288 		pdu->data_from_mempool = true;
4289 		pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(iscsi_get_mobj_max_data_len(mobj));
4290 
4291 		iscsi_task_set_mobj(task, NULL);
4292 	}
4293 
4294 	return 0;
4295 }
4296 
4297 static int
4298 iscsi_pdu_payload_op_data(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4299 {
4300 	struct spdk_iscsi_task *task;
4301 	struct iscsi_bhs_data_out *reqh;
4302 	struct spdk_mobj *mobj;
4303 	uint32_t transfer_tag;
4304 	int F_bit;
4305 	int rc;
4306 
4307 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4308 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
4309 	transfer_tag = from_be32(&reqh->ttt);
4310 
4311 	task = get_transfer_task(conn, transfer_tag);
4312 	if (spdk_unlikely(task == NULL)) {
4313 		SPDK_ERRLOG("Not found for transfer_tag=%x\n", transfer_tag);
4314 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
4315 	}
4316 
4317 	if (spdk_scsi_dev_get_lun(conn->dev, task->lun_id) == NULL) {
4318 		SPDK_DEBUGLOG(iscsi, "LUN %d is removed, reject this PDU.\n",
4319 			      task->lun_id);
4320 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4321 	}
4322 
4323 	/* If current PDU is final in a sequence, submit all received data,
4324 	 * otherwise, continue aggregation until the first data buffer is full.
4325 	 * We do not use SGL and instead create a subtask per data buffer. Hence further
4326 	 * aggregation does not improve any performance.
4327 	 */
4328 	mobj = pdu->mobj[0];
4329 	assert(mobj != NULL);
4330 
4331 	if (F_bit || mobj->data_len >= SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH ||
4332 	    pdu->dif_insert_or_strip) {
4333 		rc = iscsi_submit_write_subtask(conn, task, pdu, mobj);
4334 		if (rc != 0) {
4335 			return rc;
4336 		}
4337 	} else {
4338 		assert(pdu->mobj[1] == NULL);
4339 		iscsi_task_set_mobj(task, mobj);
4340 		pdu->mobj[0] = NULL;
4341 		return 0;
4342 	}
4343 
4344 	mobj = pdu->mobj[1];
4345 	if (mobj == NULL) {
4346 		return 0;
4347 	}
4348 
4349 	assert(pdu->dif_insert_or_strip == false);
4350 	assert(mobj->data_len < SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4351 
4352 	if (F_bit) {
4353 		return iscsi_submit_write_subtask(conn, task, pdu, mobj);
4354 	} else {
4355 		iscsi_task_set_mobj(task, mobj);
4356 		pdu->mobj[1] = NULL;
4357 		return 0;
4358 	}
4359 }
4360 
4361 static void
4362 init_login_reject_response(struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
4363 {
4364 	struct iscsi_bhs_login_rsp *rsph;
4365 
4366 	memset(rsp_pdu, 0, sizeof(struct spdk_iscsi_pdu));
4367 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
4368 	rsph->version_max = ISCSI_VERSION;
4369 	rsph->version_act = ISCSI_VERSION;
4370 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
4371 	rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
4372 	rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
4373 	rsph->itt = pdu->bhs.itt;
4374 }
4375 
4376 static void
4377 iscsi_pdu_dump(struct spdk_iscsi_pdu *pdu)
4378 {
4379 	spdk_log_dump(stderr, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
4380 }
4381 
4382 /* This function is used to refree the pdu when it is acknowledged */
4383 static void
4384 remove_acked_pdu(struct spdk_iscsi_conn *conn, uint32_t ExpStatSN)
4385 {
4386 	struct spdk_iscsi_pdu *pdu, *pdu_temp;
4387 	uint32_t stat_sn;
4388 
4389 	conn->exp_statsn = spdk_min(ExpStatSN, conn->StatSN);
4390 	TAILQ_FOREACH_SAFE(pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
4391 		stat_sn = from_be32(&pdu->bhs.stat_sn);
4392 		if (spdk_sn32_lt(stat_sn, conn->exp_statsn)) {
4393 			TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
4394 			iscsi_conn_free_pdu(conn, pdu);
4395 		}
4396 	}
4397 }
4398 
4399 static int
4400 iscsi_update_cmdsn(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4401 {
4402 	int opcode;
4403 	uint32_t ExpStatSN;
4404 	int I_bit;
4405 	struct spdk_iscsi_sess *sess;
4406 	struct iscsi_bhs_scsi_req *reqh;
4407 
4408 	sess = conn->sess;
4409 	if (!sess) {
4410 		SPDK_ERRLOG("Connection has no associated session!\n");
4411 		return SPDK_ISCSI_CONNECTION_FATAL;
4412 	}
4413 
4414 	opcode = pdu->bhs.opcode;
4415 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
4416 
4417 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
4418 
4419 	I_bit = reqh->immediate;
4420 	if (I_bit == 0) {
4421 		if (spdk_sn32_lt(pdu->cmd_sn, sess->ExpCmdSN) ||
4422 		    spdk_sn32_gt(pdu->cmd_sn, sess->MaxCmdSN)) {
4423 			if (sess->session_type == SESSION_TYPE_NORMAL &&
4424 			    opcode != ISCSI_OP_SCSI_DATAOUT) {
4425 				SPDK_ERRLOG("CmdSN(%u) ignore (ExpCmdSN=%u, MaxCmdSN=%u)\n",
4426 					    pdu->cmd_sn, sess->ExpCmdSN, sess->MaxCmdSN);
4427 
4428 				if (sess->ErrorRecoveryLevel >= 1) {
4429 					SPDK_DEBUGLOG(iscsi, "Skip the error in ERL 1 and 2\n");
4430 				} else {
4431 					return SPDK_PDU_FATAL;
4432 				}
4433 			}
4434 		}
4435 	} else if (pdu->cmd_sn != sess->ExpCmdSN) {
4436 		SPDK_ERRLOG("CmdSN(%u) error ExpCmdSN=%u\n", pdu->cmd_sn, sess->ExpCmdSN);
4437 
4438 		if (sess->ErrorRecoveryLevel >= 1) {
4439 			SPDK_DEBUGLOG(iscsi, "Skip the error in ERL 1 and 2\n");
4440 		} else if (opcode != ISCSI_OP_NOPOUT) {
4441 			/*
4442 			 * The Linux initiator does not send valid CmdSNs for
4443 			 *  nopout under heavy load, so do not close the
4444 			 *  connection in that case.
4445 			 */
4446 			return SPDK_ISCSI_CONNECTION_FATAL;
4447 		}
4448 	}
4449 
4450 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
4451 	if (spdk_sn32_gt(ExpStatSN, conn->StatSN)) {
4452 		SPDK_DEBUGLOG(iscsi, "StatSN(%u) advanced\n", ExpStatSN);
4453 		ExpStatSN = conn->StatSN;
4454 	}
4455 
4456 	if (sess->ErrorRecoveryLevel >= 1) {
4457 		remove_acked_pdu(conn, ExpStatSN);
4458 	}
4459 
4460 	if (!I_bit && opcode != ISCSI_OP_SCSI_DATAOUT) {
4461 		sess->ExpCmdSN++;
4462 	}
4463 
4464 	return 0;
4465 }
4466 
4467 static int
4468 iscsi_pdu_hdr_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4469 {
4470 	int opcode;
4471 	int rc;
4472 	struct spdk_iscsi_pdu *rsp_pdu = NULL;
4473 
4474 	if (pdu == NULL) {
4475 		return -1;
4476 	}
4477 
4478 	opcode = pdu->bhs.opcode;
4479 
4480 	SPDK_DEBUGLOG(iscsi, "opcode %x\n", opcode);
4481 
4482 	if (opcode == ISCSI_OP_LOGIN) {
4483 		return iscsi_pdu_hdr_op_login(conn, pdu);
4484 	}
4485 
4486 	/* connection in login phase but receive non-login opcode
4487 	 * return response code 0x020b to initiator.
4488 	 * */
4489 	if (!conn->full_feature && conn->state == ISCSI_CONN_STATE_RUNNING) {
4490 		rsp_pdu = iscsi_get_pdu(conn);
4491 		if (rsp_pdu == NULL) {
4492 			return SPDK_ISCSI_CONNECTION_FATAL;
4493 		}
4494 		init_login_reject_response(pdu, rsp_pdu);
4495 		iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
4496 		SPDK_ERRLOG("Received opcode %d in login phase\n", opcode);
4497 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
4498 	} else if (conn->state == ISCSI_CONN_STATE_INVALID) {
4499 		SPDK_ERRLOG("before Full Feature\n");
4500 		iscsi_pdu_dump(pdu);
4501 		return SPDK_ISCSI_CONNECTION_FATAL;
4502 	}
4503 
4504 	rc = iscsi_update_cmdsn(conn, pdu);
4505 	if (rc != 0) {
4506 		return rc;
4507 	}
4508 
4509 	switch (opcode) {
4510 	case ISCSI_OP_NOPOUT:
4511 		rc = iscsi_pdu_hdr_op_nopout(conn, pdu);
4512 		break;
4513 
4514 	case ISCSI_OP_SCSI:
4515 		rc = iscsi_pdu_hdr_op_scsi(conn, pdu);
4516 		break;
4517 	case ISCSI_OP_TASK:
4518 		rc = iscsi_pdu_hdr_op_task(conn, pdu);
4519 		break;
4520 
4521 	case ISCSI_OP_TEXT:
4522 		rc = iscsi_pdu_hdr_op_text(conn, pdu);
4523 		break;
4524 
4525 	case ISCSI_OP_LOGOUT:
4526 		rc = iscsi_pdu_hdr_op_logout(conn, pdu);
4527 		break;
4528 
4529 	case ISCSI_OP_SCSI_DATAOUT:
4530 		rc = iscsi_pdu_hdr_op_data(conn, pdu);
4531 		break;
4532 
4533 	case ISCSI_OP_SNACK:
4534 		rc = iscsi_pdu_hdr_op_snack(conn, pdu);
4535 		break;
4536 
4537 	default:
4538 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4539 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4540 	}
4541 
4542 	if (rc < 0) {
4543 		SPDK_ERRLOG("processing PDU header (opcode=%x) failed on %s(%s)\n",
4544 			    opcode,
4545 			    conn->target_port != NULL ? spdk_scsi_port_get_name(conn->target_port) : "NULL",
4546 			    conn->initiator_port != NULL ? spdk_scsi_port_get_name(conn->initiator_port) : "NULL");
4547 	}
4548 
4549 	return rc;
4550 }
4551 
4552 static int
4553 iscsi_pdu_payload_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4554 {
4555 	int opcode;
4556 	int rc = 0;
4557 
4558 	opcode = pdu->bhs.opcode;
4559 
4560 	SPDK_DEBUGLOG(iscsi, "opcode %x\n", opcode);
4561 
4562 	switch (opcode) {
4563 	case ISCSI_OP_LOGIN:
4564 		rc = iscsi_pdu_payload_op_login(conn, pdu);
4565 		break;
4566 	case ISCSI_OP_NOPOUT:
4567 		rc = iscsi_pdu_payload_op_nopout(conn, pdu);
4568 		break;
4569 	case ISCSI_OP_SCSI:
4570 		rc = iscsi_pdu_payload_op_scsi(conn, pdu);
4571 		break;
4572 	case ISCSI_OP_TASK:
4573 		break;
4574 	case ISCSI_OP_TEXT:
4575 		rc = iscsi_pdu_payload_op_text(conn, pdu);
4576 		break;
4577 	case ISCSI_OP_LOGOUT:
4578 		break;
4579 	case ISCSI_OP_SCSI_DATAOUT:
4580 		rc = iscsi_pdu_payload_op_data(conn, pdu);
4581 		break;
4582 	case ISCSI_OP_SNACK:
4583 		break;
4584 	default:
4585 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4586 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4587 	}
4588 
4589 	if (rc < 0) {
4590 		SPDK_ERRLOG("processing PDU payload (opcode=%x) failed on %s(%s)\n",
4591 			    opcode,
4592 			    conn->target_port != NULL ? spdk_scsi_port_get_name(conn->target_port) : "NULL",
4593 			    conn->initiator_port != NULL ? spdk_scsi_port_get_name(conn->initiator_port) : "NULL");
4594 	}
4595 
4596 	return rc;
4597 }
4598 
4599 /* Return zero if completed to read payload, positive number if still in progress,
4600  * or negative number if any error.
4601  */
4602 static int
4603 iscsi_pdu_payload_read(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4604 {
4605 	struct spdk_mempool *pool;
4606 	struct spdk_mobj *mobj;
4607 	uint32_t data_len;
4608 	uint32_t read_len;
4609 	uint32_t crc32c;
4610 	int rc;
4611 	uint32_t data_buf_len;
4612 
4613 	data_len = pdu->data_segment_len;
4614 	read_len = data_len - pdu->data_valid_bytes;
4615 	data_buf_len = pdu->data_buf_len;
4616 
4617 	mobj = pdu->mobj[0];
4618 	if (mobj == NULL) {
4619 		if (data_buf_len <= iscsi_get_max_immediate_data_size()) {
4620 			pool = g_iscsi.pdu_immediate_data_pool;
4621 			data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(iscsi_get_max_immediate_data_size());
4622 		} else if (data_buf_len <= SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
4623 			pool = g_iscsi.pdu_data_out_pool;
4624 			data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4625 		} else {
4626 			SPDK_ERRLOG("Data(%d) > MaxSegment(%d)\n",
4627 				    data_len, SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4628 			return -1;
4629 		}
4630 		mobj = iscsi_datapool_get(pool);
4631 		if (mobj == NULL) {
4632 			return 1;
4633 		}
4634 
4635 		pdu->data_buf_len = data_buf_len;
4636 
4637 		pdu->mobj[0] = mobj;
4638 		pdu->data = mobj->buf;
4639 		pdu->data_from_mempool = true;
4640 	} else if (mobj->data_len == iscsi_get_mobj_max_data_len(mobj) && read_len > 0) {
4641 		mobj = pdu->mobj[1];
4642 		if (mobj == NULL) {
4643 			/* The first data buffer just ran out. Allocate the second data buffer and
4644 			 * continue reading the data segment.
4645 			 */
4646 			assert(pdu->data_from_mempool == true);
4647 			assert(!pdu->dif_insert_or_strip);
4648 
4649 			if (conn->data_digest) {
4650 				iscsi_pdu_calc_partial_data_digest(pdu);
4651 			}
4652 			mobj = iscsi_datapool_get(g_iscsi.pdu_data_out_pool);
4653 			if (mobj == NULL) {
4654 				return 1;
4655 			}
4656 			pdu->mobj[1] = mobj;
4657 			pdu->data = mobj->buf;
4658 			pdu->data_offset = pdu->data_valid_bytes;
4659 			pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4660 		}
4661 	}
4662 
4663 	/* copy the actual data into local buffer */
4664 	read_len = spdk_min(read_len, iscsi_get_mobj_max_data_len(mobj) - mobj->data_len);
4665 
4666 	if (read_len > 0) {
4667 		rc = iscsi_conn_read_data_segment(conn,
4668 						  pdu,
4669 						  pdu->data_valid_bytes - pdu->data_offset,
4670 						  read_len);
4671 		if (rc < 0) {
4672 			return rc;
4673 		}
4674 
4675 		mobj->data_len += rc;
4676 		pdu->data_valid_bytes += rc;
4677 		if (pdu->data_valid_bytes < data_len) {
4678 			return 1;
4679 		}
4680 	}
4681 
4682 	/* copy out the data digest */
4683 	if (conn->data_digest &&
4684 	    pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
4685 		rc = iscsi_conn_read_data(conn,
4686 					  ISCSI_DIGEST_LEN - pdu->ddigest_valid_bytes,
4687 					  pdu->data_digest + pdu->ddigest_valid_bytes);
4688 		if (rc < 0) {
4689 			return rc;
4690 		}
4691 
4692 		pdu->ddigest_valid_bytes += rc;
4693 		if (pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
4694 			return 1;
4695 		}
4696 	}
4697 
4698 	/* check data digest */
4699 	if (conn->data_digest) {
4700 		iscsi_pdu_calc_partial_data_digest(pdu);
4701 		crc32c = iscsi_pdu_calc_partial_data_digest_done(pdu);
4702 
4703 		rc = MATCH_DIGEST_WORD(pdu->data_digest, crc32c);
4704 		if (rc == 0) {
4705 			SPDK_ERRLOG("data digest error (%s)\n", conn->initiator_name);
4706 			return -1;
4707 		}
4708 	}
4709 
4710 	return 0;
4711 }
4712 
4713 static int
4714 iscsi_read_pdu(struct spdk_iscsi_conn *conn)
4715 {
4716 	enum iscsi_pdu_recv_state prev_state;
4717 	struct spdk_iscsi_pdu *pdu;
4718 	uint32_t crc32c;
4719 	int ahs_len;
4720 	int rc;
4721 
4722 	do {
4723 		prev_state = conn->pdu_recv_state;
4724 		pdu = conn->pdu_in_progress;
4725 
4726 		switch (conn->pdu_recv_state) {
4727 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY:
4728 			assert(conn->pdu_in_progress == NULL);
4729 
4730 			conn->pdu_in_progress = iscsi_get_pdu(conn);
4731 			if (conn->pdu_in_progress == NULL) {
4732 				return SPDK_ISCSI_CONNECTION_FATAL;
4733 			}
4734 			conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR;
4735 			break;
4736 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR:
4737 			if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
4738 				rc = iscsi_conn_read_data(conn,
4739 							  ISCSI_BHS_LEN - pdu->bhs_valid_bytes,
4740 							  (uint8_t *)&pdu->bhs + pdu->bhs_valid_bytes);
4741 				if (rc < 0) {
4742 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4743 					break;
4744 				}
4745 				pdu->bhs_valid_bytes += rc;
4746 				if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
4747 					return 0;
4748 				}
4749 			}
4750 
4751 			/* conn->is_logged_out must be checked after completing to process
4752 			 * logout request, i.e., before processing PDU header in this state
4753 			 * machine, otherwise logout response may not be sent to initiator
4754 			 * and initiator may get logout timeout.
4755 			 */
4756 			if (spdk_unlikely(conn->is_logged_out)) {
4757 				SPDK_DEBUGLOG(iscsi, "pdu received after logout\n");
4758 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4759 				break;
4760 			}
4761 
4762 			pdu->data_segment_len = ISCSI_ALIGN(DGET24(pdu->bhs.data_segment_len));
4763 			pdu->data_buf_len = pdu->data_segment_len;
4764 
4765 			/* AHS */
4766 			ahs_len = pdu->bhs.total_ahs_len * 4;
4767 			if (ahs_len > ISCSI_AHS_LEN) {
4768 				SPDK_DEBUGLOG(iscsi, "pdu ahs length %d is invalid\n", ahs_len);
4769 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4770 				break;
4771 			}
4772 
4773 			if (pdu->ahs_valid_bytes < ahs_len) {
4774 				rc = iscsi_conn_read_data(conn,
4775 							  ahs_len - pdu->ahs_valid_bytes,
4776 							  pdu->ahs + pdu->ahs_valid_bytes);
4777 				if (rc < 0) {
4778 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4779 					break;
4780 				}
4781 
4782 				pdu->ahs_valid_bytes += rc;
4783 				if (pdu->ahs_valid_bytes < ahs_len) {
4784 					return 0;
4785 				}
4786 			}
4787 
4788 			/* Header Digest */
4789 			if (conn->header_digest &&
4790 			    pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
4791 				rc = iscsi_conn_read_data(conn,
4792 							  ISCSI_DIGEST_LEN - pdu->hdigest_valid_bytes,
4793 							  pdu->header_digest + pdu->hdigest_valid_bytes);
4794 				if (rc < 0) {
4795 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4796 					break;
4797 				}
4798 
4799 				pdu->hdigest_valid_bytes += rc;
4800 				if (pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
4801 					return 0;
4802 				}
4803 			}
4804 
4805 			if (conn->header_digest) {
4806 				crc32c = iscsi_pdu_calc_header_digest(pdu);
4807 				rc = MATCH_DIGEST_WORD(pdu->header_digest, crc32c);
4808 				if (rc == 0) {
4809 					SPDK_ERRLOG("header digest error (%s)\n", conn->initiator_name);
4810 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4811 					break;
4812 				}
4813 			}
4814 
4815 			rc = iscsi_pdu_hdr_handle(conn, pdu);
4816 			if (rc < 0) {
4817 				SPDK_ERRLOG("Critical error is detected. Close the connection\n");
4818 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4819 				break;
4820 			}
4821 
4822 			conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD;
4823 			break;
4824 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD:
4825 			if (pdu->data_segment_len != 0) {
4826 				rc = iscsi_pdu_payload_read(conn, pdu);
4827 				if (rc > 0) {
4828 					return 0;
4829 				} else if (rc < 0) {
4830 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4831 					break;
4832 				}
4833 			}
4834 
4835 			/* All data for this PDU has now been read from the socket. */
4836 			spdk_trace_record(TRACE_ISCSI_READ_PDU, conn->id, pdu->data_valid_bytes,
4837 					  (uintptr_t)pdu, pdu->bhs.opcode);
4838 
4839 			if (!pdu->is_rejected) {
4840 				rc = iscsi_pdu_payload_handle(conn, pdu);
4841 			} else {
4842 				rc = 0;
4843 			}
4844 			if (rc == 0) {
4845 				spdk_trace_record(TRACE_ISCSI_TASK_EXECUTED, 0, 0, (uintptr_t)pdu);
4846 				iscsi_put_pdu(pdu);
4847 				conn->pdu_in_progress = NULL;
4848 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY;
4849 				return 1;
4850 			} else {
4851 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4852 			}
4853 			break;
4854 		case ISCSI_PDU_RECV_STATE_ERROR:
4855 			return SPDK_ISCSI_CONNECTION_FATAL;
4856 		default:
4857 			assert(false);
4858 			SPDK_ERRLOG("code should not come here\n");
4859 			break;
4860 		}
4861 	} while (prev_state != conn->pdu_recv_state);
4862 
4863 	return 0;
4864 }
4865 
4866 #define GET_PDU_LOOP_COUNT	16
4867 
4868 int
4869 iscsi_handle_incoming_pdus(struct spdk_iscsi_conn *conn)
4870 {
4871 	int i, rc;
4872 
4873 	/* Read new PDUs from network */
4874 	for (i = 0; i < GET_PDU_LOOP_COUNT; i++) {
4875 		rc = iscsi_read_pdu(conn);
4876 		if (rc == 0) {
4877 			break;
4878 		} else if (rc < 0) {
4879 			return rc;
4880 		}
4881 
4882 		if (conn->is_stopped) {
4883 			break;
4884 		}
4885 	}
4886 
4887 	return i;
4888 }
4889