xref: /spdk/lib/iscsi/iscsi.c (revision d73077b84a71985da1db1c9847ea7c042189bae2)
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright (C) 2008-2012 Daisuke Aoyama <aoyama@peach.ne.jp>.
5  *   Copyright (c) Intel Corporation.
6  *   All rights reserved.
7  *
8  *   Redistribution and use in source and binary forms, with or without
9  *   modification, are permitted provided that the following conditions
10  *   are met:
11  *
12  *     * Redistributions of source code must retain the above copyright
13  *       notice, this list of conditions and the following disclaimer.
14  *     * Redistributions in binary form must reproduce the above copyright
15  *       notice, this list of conditions and the following disclaimer in
16  *       the documentation and/or other materials provided with the
17  *       distribution.
18  *     * Neither the name of Intel Corporation nor the names of its
19  *       contributors may be used to endorse or promote products derived
20  *       from this software without specific prior written permission.
21  *
22  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include "spdk/stdinc.h"
36 
37 #include "spdk/base64.h"
38 #include "spdk/crc32.h"
39 #include "spdk/endian.h"
40 #include "spdk/env.h"
41 #include "spdk/likely.h"
42 #include "spdk/trace.h"
43 #include "spdk/sock.h"
44 #include "spdk/string.h"
45 #include "spdk/queue.h"
46 #include "spdk/net.h"
47 
48 #include "iscsi/md5.h"
49 #include "iscsi/iscsi.h"
50 #include "iscsi/param.h"
51 #include "iscsi/tgt_node.h"
52 #include "iscsi/task.h"
53 #include "iscsi/conn.h"
54 #include "spdk/scsi.h"
55 #include "spdk/bdev.h"
56 #include "iscsi/portal_grp.h"
57 
58 #include "spdk/log.h"
59 
60 #define MAX_TMPBUF 1024
61 
62 #define SPDK_CRC32C_INITIAL    0xffffffffUL
63 #define SPDK_CRC32C_XOR        0xffffffffUL
64 
65 #ifdef __FreeBSD__
66 #define HAVE_SRANDOMDEV 1
67 #define HAVE_ARC4RANDOM 1
68 #endif
69 
70 struct spdk_iscsi_globals g_iscsi = {
71 	.mutex = PTHREAD_MUTEX_INITIALIZER,
72 	.portal_head = TAILQ_HEAD_INITIALIZER(g_iscsi.portal_head),
73 	.pg_head = TAILQ_HEAD_INITIALIZER(g_iscsi.pg_head),
74 	.ig_head = TAILQ_HEAD_INITIALIZER(g_iscsi.ig_head),
75 	.target_head = TAILQ_HEAD_INITIALIZER(g_iscsi.target_head),
76 	.auth_group_head = TAILQ_HEAD_INITIALIZER(g_iscsi.auth_group_head),
77 	.poll_group_head = TAILQ_HEAD_INITIALIZER(g_iscsi.poll_group_head),
78 };
79 
80 #define MATCH_DIGEST_WORD(BUF, CRC32C) \
81 	(    ((((uint32_t) *((uint8_t *)(BUF)+0)) << 0)		\
82 	    | (((uint32_t) *((uint8_t *)(BUF)+1)) << 8)		\
83 	    | (((uint32_t) *((uint8_t *)(BUF)+2)) << 16)	\
84 	    | (((uint32_t) *((uint8_t *)(BUF)+3)) << 24))	\
85 	    == (CRC32C))
86 
87 #ifndef HAVE_SRANDOMDEV
88 static void
89 srandomdev(void)
90 {
91 	unsigned long seed;
92 	time_t now;
93 	pid_t pid;
94 
95 	pid = getpid();
96 	now = time(NULL);
97 	seed = pid ^ now;
98 	srandom(seed);
99 }
100 #endif /* HAVE_SRANDOMDEV */
101 
102 #ifndef HAVE_ARC4RANDOM
103 static int g_arc4random_initialized = 0;
104 
105 static uint32_t
106 arc4random(void)
107 {
108 	uint32_t r;
109 	uint32_t r1, r2;
110 
111 	if (!g_arc4random_initialized) {
112 		srandomdev();
113 		g_arc4random_initialized = 1;
114 	}
115 	r1 = (uint32_t)(random() & 0xffff);
116 	r2 = (uint32_t)(random() & 0xffff);
117 	r = (r1 << 16) | r2;
118 	return r;
119 }
120 #endif /* HAVE_ARC4RANDOM */
121 
122 static void
123 gen_random(uint8_t *buf, size_t len)
124 {
125 	uint32_t r;
126 	size_t idx;
127 
128 	for (idx = 0; idx < len; idx++) {
129 		r = arc4random();
130 		buf[idx] = (uint8_t) r;
131 	}
132 }
133 
134 static uint64_t
135 iscsi_get_isid(const uint8_t isid[6])
136 {
137 	return (uint64_t)isid[0] << 40 |
138 	       (uint64_t)isid[1] << 32 |
139 	       (uint64_t)isid[2] << 24 |
140 	       (uint64_t)isid[3] << 16 |
141 	       (uint64_t)isid[4] << 8 |
142 	       (uint64_t)isid[5];
143 }
144 
145 static int
146 bin2hex(char *buf, size_t len, const uint8_t *data, size_t data_len)
147 {
148 	const char *digits = "0123456789ABCDEF";
149 	size_t total = 0;
150 	size_t idx;
151 
152 	if (len < 3) {
153 		return -1;
154 	}
155 	buf[total] = '0';
156 	total++;
157 	buf[total] = 'x';
158 	total++;
159 	buf[total] = '\0';
160 
161 	for (idx = 0; idx < data_len; idx++) {
162 		if (total + 3 > len) {
163 			buf[total] = '\0';
164 			return - 1;
165 		}
166 		buf[total] = digits[(data[idx] >> 4) & 0x0fU];
167 		total++;
168 		buf[total] = digits[data[idx] & 0x0fU];
169 		total++;
170 	}
171 	buf[total] = '\0';
172 	return total;
173 }
174 
175 static int
176 hex2bin(uint8_t *data, size_t data_len, const char *str)
177 {
178 	const char *digits = "0123456789ABCDEF";
179 	const char *dp;
180 	const char *p;
181 	size_t total = 0;
182 	int n0, n1;
183 
184 	p = str;
185 	if (p[0] != '0' && (p[1] != 'x' && p[1] != 'X')) {
186 		return -1;
187 	}
188 	p += 2;
189 
190 	while (p[0] != '\0' && p[1] != '\0') {
191 		if (total >= data_len) {
192 			return -1;
193 		}
194 		dp = strchr(digits, toupper((int) p[0]));
195 		if (dp == NULL) {
196 			return -1;
197 		}
198 		n0 = (int)(dp - digits);
199 		dp = strchr(digits, toupper((int) p[1]));
200 		if (dp == NULL) {
201 			return -1;
202 		}
203 		n1 = (int)(dp - digits);
204 
205 		data[total] = (uint8_t)(((n0 & 0x0fU) << 4) | (n1 & 0x0fU));
206 		total++;
207 		p += 2;
208 	}
209 	return total;
210 }
211 
212 static int
213 iscsi_reject(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu,
214 	     int reason)
215 {
216 	struct spdk_iscsi_pdu *rsp_pdu;
217 	struct iscsi_bhs_reject *rsph;
218 	uint8_t *data;
219 	int total_ahs_len;
220 	int data_len;
221 	int alloc_len;
222 
223 	pdu->is_rejected = true;
224 
225 	total_ahs_len = pdu->bhs.total_ahs_len;
226 	data_len = 0;
227 	alloc_len = ISCSI_BHS_LEN + (4 * total_ahs_len);
228 
229 	if (conn->header_digest) {
230 		alloc_len += ISCSI_DIGEST_LEN;
231 	}
232 
233 	data = calloc(1, alloc_len);
234 	if (!data) {
235 		SPDK_ERRLOG("calloc() failed for data segment\n");
236 		return -ENOMEM;
237 	}
238 
239 	SPDK_DEBUGLOG(iscsi, "Reject PDU reason=%d\n", reason);
240 
241 	if (conn->sess != NULL) {
242 		SPDK_DEBUGLOG(iscsi,
243 			      "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
244 			      conn->StatSN, conn->sess->ExpCmdSN,
245 			      conn->sess->MaxCmdSN);
246 	} else {
247 		SPDK_DEBUGLOG(iscsi, "StatSN=%u\n", conn->StatSN);
248 	}
249 
250 	memcpy(data, &pdu->bhs, ISCSI_BHS_LEN);
251 	data_len += ISCSI_BHS_LEN;
252 
253 	if (total_ahs_len != 0) {
254 		total_ahs_len = spdk_min((4 * total_ahs_len), ISCSI_AHS_LEN);
255 		memcpy(data + data_len, pdu->ahs, total_ahs_len);
256 		data_len += total_ahs_len;
257 	}
258 
259 	if (conn->header_digest) {
260 		memcpy(data + data_len, pdu->header_digest, ISCSI_DIGEST_LEN);
261 		data_len += ISCSI_DIGEST_LEN;
262 	}
263 
264 	rsp_pdu = iscsi_get_pdu(conn);
265 	if (rsp_pdu == NULL) {
266 		free(data);
267 		return -ENOMEM;
268 	}
269 
270 	rsph = (struct iscsi_bhs_reject *)&rsp_pdu->bhs;
271 	rsp_pdu->data = data;
272 	rsph->opcode = ISCSI_OP_REJECT;
273 	rsph->flags |= 0x80;	/* bit 0 is default to 1 */
274 	rsph->reason = reason;
275 	DSET24(rsph->data_segment_len, data_len);
276 
277 	rsph->ffffffff = 0xffffffffU;
278 	to_be32(&rsph->stat_sn, conn->StatSN);
279 	conn->StatSN++;
280 
281 	if (conn->sess != NULL) {
282 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
283 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
284 	} else {
285 		to_be32(&rsph->exp_cmd_sn, 1);
286 		to_be32(&rsph->max_cmd_sn, 1);
287 	}
288 
289 	SPDK_LOGDUMP(iscsi, "PDU", (void *)&rsp_pdu->bhs, ISCSI_BHS_LEN);
290 
291 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
292 
293 	return 0;
294 }
295 
296 uint32_t
297 iscsi_pdu_calc_header_digest(struct spdk_iscsi_pdu *pdu)
298 {
299 	uint32_t crc32c;
300 	uint32_t ahs_len_bytes = pdu->bhs.total_ahs_len * 4;
301 
302 	crc32c = SPDK_CRC32C_INITIAL;
303 	crc32c = spdk_crc32c_update(&pdu->bhs, ISCSI_BHS_LEN, crc32c);
304 
305 	if (ahs_len_bytes) {
306 		crc32c = spdk_crc32c_update(pdu->ahs, ahs_len_bytes, crc32c);
307 	}
308 
309 	/* BHS and AHS are always 4-byte multiples in length, so no padding is necessary. */
310 	crc32c = crc32c ^ SPDK_CRC32C_XOR;
311 	return crc32c;
312 }
313 
314 uint32_t
315 iscsi_pdu_calc_data_digest(struct spdk_iscsi_pdu *pdu)
316 {
317 	uint32_t data_len = DGET24(pdu->bhs.data_segment_len);
318 	uint32_t crc32c;
319 	uint32_t mod;
320 	struct iovec iov;
321 	uint32_t num_blocks;
322 
323 	crc32c = SPDK_CRC32C_INITIAL;
324 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
325 		crc32c = spdk_crc32c_update(pdu->data, data_len, crc32c);
326 	} else {
327 		iov.iov_base = pdu->data_buf;
328 		iov.iov_len = pdu->data_buf_len;
329 		num_blocks = pdu->data_buf_len / pdu->dif_ctx.block_size;
330 
331 		spdk_dif_update_crc32c(&iov, 1, num_blocks, &crc32c, &pdu->dif_ctx);
332 	}
333 
334 	mod = data_len % ISCSI_ALIGNMENT;
335 	if (mod != 0) {
336 		uint32_t pad_length = ISCSI_ALIGNMENT - mod;
337 		uint8_t pad[3] = {0, 0, 0};
338 
339 		assert(pad_length > 0);
340 		assert(pad_length <= sizeof(pad));
341 		crc32c = spdk_crc32c_update(pad, pad_length, crc32c);
342 	}
343 
344 	crc32c = crc32c ^ SPDK_CRC32C_XOR;
345 	return crc32c;
346 }
347 
348 static int
349 iscsi_conn_read_data_segment(struct spdk_iscsi_conn *conn,
350 			     struct spdk_iscsi_pdu *pdu,
351 			     uint32_t segment_len)
352 {
353 	struct iovec buf_iov, iovs[32];
354 	int rc, _rc;
355 
356 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
357 		return iscsi_conn_read_data(conn,
358 					    segment_len - pdu->data_valid_bytes,
359 					    pdu->data_buf + pdu->data_valid_bytes);
360 	} else {
361 		buf_iov.iov_base = pdu->data_buf;
362 		buf_iov.iov_len = pdu->data_buf_len;
363 		rc = spdk_dif_set_md_interleave_iovs(iovs, 32, &buf_iov, 1,
364 						     pdu->data_valid_bytes,
365 						     segment_len - pdu->data_valid_bytes, NULL,
366 						     &pdu->dif_ctx);
367 		if (rc > 0) {
368 			rc = iscsi_conn_readv_data(conn, iovs, rc);
369 			if (rc > 0) {
370 				_rc = spdk_dif_generate_stream(&buf_iov, 1,
371 							       pdu->data_valid_bytes, rc,
372 							       &pdu->dif_ctx);
373 				if (_rc != 0) {
374 					SPDK_ERRLOG("DIF generate failed\n");
375 					rc = _rc;
376 				}
377 			}
378 		} else {
379 			SPDK_ERRLOG("Setup iovs for interleaved metadata failed\n");
380 		}
381 		return rc;
382 	}
383 }
384 
385 struct _iscsi_sgl {
386 	struct iovec	*iov;
387 	int		iovcnt;
388 	uint32_t	iov_offset;
389 	uint32_t	total_size;
390 };
391 
392 static inline void
393 _iscsi_sgl_init(struct _iscsi_sgl *s, struct iovec *iovs, int iovcnt,
394 		uint32_t iov_offset)
395 {
396 	s->iov = iovs;
397 	s->iovcnt = iovcnt;
398 	s->iov_offset = iov_offset;
399 	s->total_size = 0;
400 }
401 
402 static inline bool
403 _iscsi_sgl_append(struct _iscsi_sgl *s, uint8_t *data, uint32_t data_len)
404 {
405 	if (s->iov_offset >= data_len) {
406 		s->iov_offset -= data_len;
407 	} else {
408 		assert(s->iovcnt > 0);
409 		s->iov->iov_base = data + s->iov_offset;
410 		s->iov->iov_len = data_len - s->iov_offset;
411 		s->total_size += data_len - s->iov_offset;
412 		s->iov_offset = 0;
413 		s->iov++;
414 		s->iovcnt--;
415 		if (s->iovcnt == 0) {
416 			return false;
417 		}
418 	}
419 
420 	return true;
421 }
422 
423 /* Build iovec array to leave metadata space for every data block
424  * when reading data segment from socket.
425  */
426 static inline bool
427 _iscsi_sgl_append_with_md(struct _iscsi_sgl *s,
428 			  void *buf, uint32_t buf_len, uint32_t data_len,
429 			  struct spdk_dif_ctx *dif_ctx)
430 {
431 	int rc;
432 	uint32_t total_size = 0;
433 	struct iovec buf_iov;
434 
435 	if (s->iov_offset >= data_len) {
436 		s->iov_offset -= data_len;
437 	} else {
438 		buf_iov.iov_base = buf;
439 		buf_iov.iov_len = buf_len;
440 		rc = spdk_dif_set_md_interleave_iovs(s->iov, s->iovcnt, &buf_iov, 1,
441 						     s->iov_offset, data_len - s->iov_offset,
442 						     &total_size, dif_ctx);
443 		if (rc < 0) {
444 			SPDK_ERRLOG("Failed to setup iovs for DIF strip\n");
445 			return false;
446 		}
447 
448 		s->total_size += total_size;
449 		s->iov_offset = 0;
450 		assert(s->iovcnt >= rc);
451 		s->iovcnt -= rc;
452 		s->iov += rc;
453 
454 		if (s->iovcnt == 0) {
455 			return false;
456 		}
457 	}
458 
459 	return true;
460 }
461 
462 int
463 iscsi_build_iovs(struct spdk_iscsi_conn *conn, struct iovec *iovs, int iovcnt,
464 		 struct spdk_iscsi_pdu *pdu, uint32_t *_mapped_length)
465 {
466 	struct _iscsi_sgl sgl;
467 	int enable_digest;
468 	uint32_t total_ahs_len;
469 	uint32_t data_len;
470 
471 	if (iovcnt == 0) {
472 		return 0;
473 	}
474 
475 	total_ahs_len = pdu->bhs.total_ahs_len;
476 	data_len = DGET24(pdu->bhs.data_segment_len);
477 	data_len = ISCSI_ALIGN(data_len);
478 
479 	enable_digest = 1;
480 	if (pdu->bhs.opcode == ISCSI_OP_LOGIN_RSP) {
481 		/* this PDU should be sent without digest */
482 		enable_digest = 0;
483 	}
484 
485 	_iscsi_sgl_init(&sgl, iovs, iovcnt, pdu->writev_offset);
486 
487 	/* BHS */
488 	if (!_iscsi_sgl_append(&sgl, (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN)) {
489 		goto end;
490 	}
491 	/* AHS */
492 	if (total_ahs_len > 0) {
493 		if (!_iscsi_sgl_append(&sgl, pdu->ahs, 4 * total_ahs_len)) {
494 			goto end;
495 		}
496 	}
497 
498 	/* Header Digest */
499 	if (enable_digest && conn->header_digest) {
500 		if (!_iscsi_sgl_append(&sgl, pdu->header_digest, ISCSI_DIGEST_LEN)) {
501 			goto end;
502 		}
503 	}
504 
505 	/* Data Segment */
506 	if (data_len > 0) {
507 		if (!pdu->dif_insert_or_strip) {
508 			if (!_iscsi_sgl_append(&sgl, pdu->data, data_len)) {
509 				goto end;
510 			}
511 		} else {
512 			if (!_iscsi_sgl_append_with_md(&sgl, pdu->data, pdu->data_buf_len,
513 						       data_len, &pdu->dif_ctx)) {
514 				goto end;
515 			}
516 		}
517 	}
518 
519 	/* Data Digest */
520 	if (enable_digest && conn->data_digest && data_len != 0) {
521 		_iscsi_sgl_append(&sgl, pdu->data_digest, ISCSI_DIGEST_LEN);
522 	}
523 
524 end:
525 	if (_mapped_length != NULL) {
526 		*_mapped_length = sgl.total_size;
527 	}
528 
529 	return iovcnt - sgl.iovcnt;
530 }
531 
532 void iscsi_free_sess(struct spdk_iscsi_sess *sess)
533 {
534 	if (sess == NULL) {
535 		return;
536 	}
537 
538 	sess->tag = 0;
539 	sess->target = NULL;
540 	sess->session_type = SESSION_TYPE_INVALID;
541 	iscsi_param_free(sess->params);
542 	free(sess->conns);
543 	spdk_scsi_port_free(&sess->initiator_port);
544 	spdk_mempool_put(g_iscsi.session_pool, (void *)sess);
545 }
546 
547 static int
548 create_iscsi_sess(struct spdk_iscsi_conn *conn,
549 		  struct spdk_iscsi_tgt_node *target,
550 		  enum session_type session_type)
551 {
552 	struct spdk_iscsi_sess *sess;
553 	int rc;
554 
555 	sess = spdk_mempool_get(g_iscsi.session_pool);
556 	if (!sess) {
557 		SPDK_ERRLOG("Unable to get session object\n");
558 		SPDK_ERRLOG("MaxSessions set to %d\n", g_iscsi.MaxSessions);
559 		return -ENOMEM;
560 	}
561 
562 	/* configuration values */
563 	pthread_mutex_lock(&g_iscsi.mutex);
564 
565 	sess->MaxConnections = g_iscsi.MaxConnectionsPerSession;
566 	sess->MaxOutstandingR2T = DEFAULT_MAXOUTSTANDINGR2T;
567 
568 	sess->DefaultTime2Wait = g_iscsi.DefaultTime2Wait;
569 	sess->DefaultTime2Retain = g_iscsi.DefaultTime2Retain;
570 	sess->FirstBurstLength = g_iscsi.FirstBurstLength;
571 	sess->MaxBurstLength = SPDK_ISCSI_MAX_BURST_LENGTH;
572 	sess->InitialR2T = DEFAULT_INITIALR2T;
573 	sess->ImmediateData = g_iscsi.ImmediateData;
574 	sess->DataPDUInOrder = DEFAULT_DATAPDUINORDER;
575 	sess->DataSequenceInOrder = DEFAULT_DATASEQUENCEINORDER;
576 	sess->ErrorRecoveryLevel = g_iscsi.ErrorRecoveryLevel;
577 
578 	pthread_mutex_unlock(&g_iscsi.mutex);
579 
580 	sess->tag = conn->pg_tag;
581 
582 	sess->conns = calloc(sess->MaxConnections, sizeof(*sess->conns));
583 	if (!sess->conns) {
584 		SPDK_ERRLOG("calloc() failed for connection array\n");
585 		return -ENOMEM;
586 	}
587 
588 	sess->connections = 0;
589 
590 	sess->conns[sess->connections] = conn;
591 	sess->connections++;
592 
593 	sess->params = NULL;
594 	sess->target = target;
595 	sess->isid = 0;
596 	sess->session_type = session_type;
597 	sess->current_text_itt = 0xffffffffU;
598 
599 	/* set default params */
600 	rc = iscsi_sess_params_init(&sess->params);
601 	if (rc < 0) {
602 		SPDK_ERRLOG("iscsi_sess_params_init() failed\n");
603 		goto error_return;
604 	}
605 	/* replace with config value */
606 	rc = iscsi_param_set_int(sess->params, "MaxConnections",
607 				 sess->MaxConnections);
608 	if (rc < 0) {
609 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
610 		goto error_return;
611 	}
612 
613 	rc = iscsi_param_set_int(sess->params, "MaxOutstandingR2T",
614 				 sess->MaxOutstandingR2T);
615 	if (rc < 0) {
616 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
617 		goto error_return;
618 	}
619 
620 	rc = iscsi_param_set_int(sess->params, "DefaultTime2Wait",
621 				 sess->DefaultTime2Wait);
622 	if (rc < 0) {
623 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
624 		goto error_return;
625 	}
626 
627 	rc = iscsi_param_set_int(sess->params, "DefaultTime2Retain",
628 				 sess->DefaultTime2Retain);
629 	if (rc < 0) {
630 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
631 		goto error_return;
632 	}
633 
634 	rc = iscsi_param_set_int(sess->params, "FirstBurstLength",
635 				 sess->FirstBurstLength);
636 	if (rc < 0) {
637 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
638 		goto error_return;
639 	}
640 
641 	rc = iscsi_param_set_int(sess->params, "MaxBurstLength",
642 				 sess->MaxBurstLength);
643 	if (rc < 0) {
644 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
645 		goto error_return;
646 	}
647 
648 	rc = iscsi_param_set(sess->params, "InitialR2T",
649 			     sess->InitialR2T ? "Yes" : "No");
650 	if (rc < 0) {
651 		SPDK_ERRLOG("iscsi_param_set() failed\n");
652 		goto error_return;
653 	}
654 
655 	rc = iscsi_param_set(sess->params, "ImmediateData",
656 			     sess->ImmediateData ? "Yes" : "No");
657 	if (rc < 0) {
658 		SPDK_ERRLOG("iscsi_param_set() failed\n");
659 		goto error_return;
660 	}
661 
662 	rc = iscsi_param_set(sess->params, "DataPDUInOrder",
663 			     sess->DataPDUInOrder ? "Yes" : "No");
664 	if (rc < 0) {
665 		SPDK_ERRLOG("iscsi_param_set() failed\n");
666 		goto error_return;
667 	}
668 
669 	rc = iscsi_param_set(sess->params, "DataSequenceInOrder",
670 			     sess->DataSequenceInOrder ? "Yes" : "No");
671 	if (rc < 0) {
672 		SPDK_ERRLOG("iscsi_param_set() failed\n");
673 		goto error_return;
674 	}
675 
676 	rc = iscsi_param_set_int(sess->params, "ErrorRecoveryLevel",
677 				 sess->ErrorRecoveryLevel);
678 	if (rc < 0) {
679 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
680 		goto error_return;
681 	}
682 
683 	/* realloc buffer */
684 	rc = iscsi_param_set_int(conn->params, "MaxRecvDataSegmentLength",
685 				 conn->MaxRecvDataSegmentLength);
686 	if (rc < 0) {
687 		SPDK_ERRLOG("iscsi_param_set_int() failed\n");
688 		goto error_return;
689 	}
690 
691 	/* sess for first connection of session */
692 	conn->sess = sess;
693 	return 0;
694 
695 error_return:
696 	iscsi_free_sess(sess);
697 	conn->sess = NULL;
698 	return -1;
699 }
700 
701 static struct spdk_iscsi_sess *
702 get_iscsi_sess_by_tsih(uint16_t tsih)
703 {
704 	struct spdk_iscsi_sess *session;
705 
706 	if (tsih == 0 || tsih > g_iscsi.MaxSessions) {
707 		return NULL;
708 	}
709 
710 	session = g_iscsi.session[tsih - 1];
711 	assert(tsih == session->tsih);
712 
713 	return session;
714 }
715 
716 static uint8_t
717 append_iscsi_sess(struct spdk_iscsi_conn *conn,
718 		  const char *initiator_port_name, uint16_t tsih, uint16_t cid)
719 {
720 	struct spdk_iscsi_sess *sess;
721 
722 	SPDK_DEBUGLOG(iscsi, "append session: init port name=%s, tsih=%u, cid=%u\n",
723 		      initiator_port_name, tsih, cid);
724 
725 	sess = get_iscsi_sess_by_tsih(tsih);
726 	if (sess == NULL) {
727 		SPDK_ERRLOG("spdk_get_iscsi_sess_by_tsih failed\n");
728 		return ISCSI_LOGIN_CONN_ADD_FAIL;
729 	}
730 	if ((conn->pg_tag != sess->tag) ||
731 	    (strcasecmp(initiator_port_name, spdk_scsi_port_get_name(sess->initiator_port)) != 0) ||
732 	    (conn->target != sess->target)) {
733 		/* no match */
734 		SPDK_ERRLOG("no MCS session for init port name=%s, tsih=%d, cid=%d\n",
735 			    initiator_port_name, tsih, cid);
736 		return ISCSI_LOGIN_CONN_ADD_FAIL;
737 	}
738 
739 	if (sess->connections >= sess->MaxConnections) {
740 		/* no slot for connection */
741 		SPDK_ERRLOG("too many connections for init port name=%s, tsih=%d, cid=%d\n",
742 			    initiator_port_name, tsih, cid);
743 		return ISCSI_LOGIN_TOO_MANY_CONNECTIONS;
744 	}
745 
746 	SPDK_DEBUGLOG(iscsi, "Connections (tsih %d): %d\n", sess->tsih, sess->connections);
747 	conn->sess = sess;
748 
749 	/*
750 	 * TODO: need a mutex or other sync mechanism to protect the session's
751 	 *  connection list.
752 	 */
753 	sess->conns[sess->connections] = conn;
754 	sess->connections++;
755 
756 	return 0;
757 }
758 
759 static int
760 iscsi_append_text(const char *key, const char *val, uint8_t *data,
761 		  int alloc_len, int data_len)
762 {
763 	int total;
764 	int len;
765 
766 	total = data_len;
767 	if (alloc_len < 1) {
768 		return 0;
769 	}
770 	if (total > alloc_len) {
771 		total = alloc_len;
772 		data[total - 1] = '\0';
773 		return total;
774 	}
775 
776 	if (alloc_len - total < 1) {
777 		SPDK_ERRLOG("data space small %d\n", alloc_len);
778 		return total;
779 	}
780 	len = snprintf((char *) data + total, alloc_len - total, "%s=%s", key, val);
781 	total += len + 1;
782 
783 	return total;
784 }
785 
786 static int
787 iscsi_append_param(struct spdk_iscsi_conn *conn, const char *key,
788 		   uint8_t *data, int alloc_len, int data_len)
789 {
790 	struct iscsi_param *param;
791 
792 	param = iscsi_param_find(conn->params, key);
793 	if (param == NULL) {
794 		param = iscsi_param_find(conn->sess->params, key);
795 		if (param == NULL) {
796 			SPDK_DEBUGLOG(iscsi, "no key %.64s\n", key);
797 			return data_len;
798 		}
799 	}
800 	return iscsi_append_text(param->key, param->val, data,
801 				 alloc_len, data_len);
802 }
803 
804 static int
805 iscsi_auth_params(struct spdk_iscsi_conn *conn,
806 		  struct iscsi_param *params, const char *method, uint8_t *data,
807 		  int alloc_len, int data_len)
808 {
809 	char *in_val;
810 	char *in_next;
811 	char *new_val;
812 	const char *algorithm;
813 	const char *name;
814 	const char *response;
815 	const char *identifier;
816 	const char *challenge;
817 	int total;
818 	int rc;
819 
820 	if (conn == NULL || params == NULL || method == NULL) {
821 		return -1;
822 	}
823 	if (strcasecmp(method, "CHAP") == 0) {
824 		/* method OK */
825 	} else {
826 		SPDK_ERRLOG("unsupported AuthMethod %.64s\n", method);
827 		return -1;
828 	}
829 
830 	total = data_len;
831 	if (alloc_len < 1) {
832 		return 0;
833 	}
834 	if (total > alloc_len) {
835 		total = alloc_len;
836 		data[total - 1] = '\0';
837 		return total;
838 	}
839 
840 	/* for temporary store */
841 	in_val = malloc(ISCSI_TEXT_MAX_VAL_LEN + 1);
842 	if (!in_val) {
843 		SPDK_ERRLOG("malloc() failed for temporary store\n");
844 		return -ENOMEM;
845 	}
846 
847 	/* CHAP method (RFC1994) */
848 	if ((algorithm = iscsi_param_get_val(params, "CHAP_A")) != NULL) {
849 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_A) {
850 			SPDK_ERRLOG("CHAP sequence error\n");
851 			goto error_return;
852 		}
853 
854 		/* CHAP_A is LIST type */
855 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", algorithm);
856 		in_next = in_val;
857 		while ((new_val = spdk_strsepq(&in_next, ",")) != NULL) {
858 			if (strcasecmp(new_val, "5") == 0) {
859 				/* CHAP with MD5 */
860 				break;
861 			}
862 		}
863 		if (new_val == NULL) {
864 			snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN + 1, "%s", "Reject");
865 			new_val = in_val;
866 			iscsi_append_text("CHAP_A", new_val, data, alloc_len, total);
867 			goto error_return;
868 		}
869 		/* selected algorithm is 5 (MD5) */
870 		SPDK_DEBUGLOG(iscsi, "got CHAP_A=%s\n", new_val);
871 		total = iscsi_append_text("CHAP_A", new_val, data, alloc_len, total);
872 
873 		/* Identifier is one octet */
874 		gen_random(conn->auth.chap_id, 1);
875 		snprintf(in_val, ISCSI_TEXT_MAX_VAL_LEN, "%d",
876 			 (int) conn->auth.chap_id[0]);
877 		total = iscsi_append_text("CHAP_I", in_val, data, alloc_len, total);
878 
879 		/* Challenge Value is a variable stream of octets */
880 		/* (binary length MUST not exceed 1024 bytes) */
881 		conn->auth.chap_challenge_len = ISCSI_CHAP_CHALLENGE_LEN;
882 		gen_random(conn->auth.chap_challenge, conn->auth.chap_challenge_len);
883 		bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN,
884 			conn->auth.chap_challenge, conn->auth.chap_challenge_len);
885 		total = iscsi_append_text("CHAP_C", in_val, data, alloc_len, total);
886 
887 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_NR;
888 	} else if ((name = iscsi_param_get_val(params, "CHAP_N")) != NULL) {
889 		uint8_t resmd5[SPDK_MD5DIGEST_LEN];
890 		uint8_t tgtmd5[SPDK_MD5DIGEST_LEN];
891 		struct spdk_md5ctx md5ctx;
892 		size_t decoded_len = 0;
893 
894 		if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_WAIT_NR) {
895 			SPDK_ERRLOG("CHAP sequence error\n");
896 			goto error_return;
897 		}
898 
899 		response = iscsi_param_get_val(params, "CHAP_R");
900 		if (response == NULL) {
901 			SPDK_ERRLOG("no response\n");
902 			goto error_return;
903 		}
904 		if (response[0] == '0' &&
905 		    (response[1] == 'x' || response[1] == 'X')) {
906 			rc = hex2bin(resmd5, SPDK_MD5DIGEST_LEN, response);
907 			if (rc < 0 || rc != SPDK_MD5DIGEST_LEN) {
908 				SPDK_ERRLOG("response format error\n");
909 				goto error_return;
910 			}
911 		} else if (response[0] == '0' &&
912 			   (response[1] == 'b' || response[1] == 'B')) {
913 			response += 2;
914 			rc = spdk_base64_decode(resmd5, &decoded_len, response);
915 			if (rc < 0 || decoded_len != SPDK_MD5DIGEST_LEN) {
916 				SPDK_ERRLOG("response format error\n");
917 				goto error_return;
918 			}
919 		} else {
920 			SPDK_ERRLOG("response format error\n");
921 			goto error_return;
922 		}
923 		SPDK_DEBUGLOG(iscsi, "got CHAP_N/CHAP_R\n");
924 
925 		SPDK_DEBUGLOG(iscsi, "ag_tag=%d\n", conn->chap_group);
926 
927 		rc = iscsi_chap_get_authinfo(&conn->auth, name, conn->chap_group);
928 		if (rc < 0) {
929 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
930 			SPDK_ERRLOG("iscsi_chap_get_authinfo() failed\n");
931 			goto error_return;
932 		}
933 		if (conn->auth.user[0] == '\0' || conn->auth.secret[0] == '\0') {
934 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
935 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
936 			goto error_return;
937 		}
938 
939 		md5init(&md5ctx);
940 		/* Identifier */
941 		md5update(&md5ctx, conn->auth.chap_id, 1);
942 		/* followed by secret */
943 		md5update(&md5ctx, conn->auth.secret,
944 			  strlen(conn->auth.secret));
945 		/* followed by Challenge Value */
946 		md5update(&md5ctx, conn->auth.chap_challenge,
947 			  conn->auth.chap_challenge_len);
948 		/* tgtmd5 is expecting Response Value */
949 		md5final(tgtmd5, &md5ctx);
950 
951 		bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN, tgtmd5, SPDK_MD5DIGEST_LEN);
952 
953 #if 0
954 		SPDK_DEBUGLOG(iscsi, "tgtmd5=%s, resmd5=%s\n", in_val, response);
955 		spdk_dump("tgtmd5", tgtmd5, SPDK_MD5DIGEST_LEN);
956 		spdk_dump("resmd5", resmd5, SPDK_MD5DIGEST_LEN);
957 #endif
958 
959 		/* compare MD5 digest */
960 		if (memcmp(tgtmd5, resmd5, SPDK_MD5DIGEST_LEN) != 0) {
961 			/* not match */
962 			/* SPDK_ERRLOG("auth user or secret is missing\n"); */
963 			SPDK_ERRLOG("auth failed (name %.64s)\n", name);
964 			goto error_return;
965 		}
966 		/* OK initiator's secret */
967 		conn->authenticated = true;
968 
969 		/* mutual CHAP? */
970 		identifier = iscsi_param_get_val(params, "CHAP_I");
971 		if (identifier != NULL) {
972 			conn->auth.chap_mid[0] = (uint8_t) strtol(identifier, NULL, 10);
973 			challenge = iscsi_param_get_val(params, "CHAP_C");
974 			if (challenge == NULL) {
975 				SPDK_ERRLOG("CHAP sequence error\n");
976 				goto error_return;
977 			}
978 			if (challenge[0] == '0' &&
979 			    (challenge[1] == 'x' || challenge[1] == 'X')) {
980 				rc = hex2bin(conn->auth.chap_mchallenge,
981 					     ISCSI_CHAP_CHALLENGE_LEN, challenge);
982 				if (rc < 0) {
983 					SPDK_ERRLOG("challenge format error\n");
984 					goto error_return;
985 				}
986 				conn->auth.chap_mchallenge_len = rc;
987 			} else if (challenge[0] == '0' &&
988 				   (challenge[1] == 'b' || challenge[1] == 'B')) {
989 				challenge += 2;
990 				rc = spdk_base64_decode(conn->auth.chap_mchallenge,
991 							&decoded_len, challenge);
992 				if (rc < 0) {
993 					SPDK_ERRLOG("challenge format error\n");
994 					goto error_return;
995 				}
996 				conn->auth.chap_mchallenge_len = decoded_len;
997 			} else {
998 				SPDK_ERRLOG("challenge format error\n");
999 				goto error_return;
1000 			}
1001 #if 0
1002 			spdk_dump("MChallenge", conn->auth.chap_mchallenge,
1003 				  conn->auth.chap_mchallenge_len);
1004 #endif
1005 			SPDK_DEBUGLOG(iscsi, "got CHAP_I/CHAP_C\n");
1006 
1007 			if (conn->auth.muser[0] == '\0' || conn->auth.msecret[0] == '\0') {
1008 				/* SPDK_ERRLOG("mutual auth user or secret is missing\n"); */
1009 				SPDK_ERRLOG("auth failed (name %.64s)\n", name);
1010 				goto error_return;
1011 			}
1012 
1013 			md5init(&md5ctx);
1014 			/* Identifier */
1015 			md5update(&md5ctx, conn->auth.chap_mid, 1);
1016 			/* followed by secret */
1017 			md5update(&md5ctx, conn->auth.msecret,
1018 				  strlen(conn->auth.msecret));
1019 			/* followed by Challenge Value */
1020 			md5update(&md5ctx, conn->auth.chap_mchallenge,
1021 				  conn->auth.chap_mchallenge_len);
1022 			/* tgtmd5 is Response Value */
1023 			md5final(tgtmd5, &md5ctx);
1024 
1025 			bin2hex(in_val, ISCSI_TEXT_MAX_VAL_LEN, tgtmd5, SPDK_MD5DIGEST_LEN);
1026 
1027 			total = iscsi_append_text("CHAP_N", conn->auth.muser, data,
1028 						  alloc_len, total);
1029 			total = iscsi_append_text("CHAP_R", in_val, data, alloc_len, total);
1030 		} else {
1031 			/* not mutual */
1032 			if (conn->mutual_chap) {
1033 				SPDK_ERRLOG("required mutual CHAP\n");
1034 				goto error_return;
1035 			}
1036 		}
1037 
1038 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_END;
1039 	} else {
1040 		/* not found CHAP keys */
1041 		SPDK_DEBUGLOG(iscsi, "start CHAP\n");
1042 		conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1043 	}
1044 
1045 	free(in_val);
1046 	return total;
1047 
1048 error_return:
1049 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1050 	free(in_val);
1051 	return -1;
1052 }
1053 
1054 static int
1055 iscsi_check_values(struct spdk_iscsi_conn *conn)
1056 {
1057 	if (conn->sess->FirstBurstLength > conn->sess->MaxBurstLength) {
1058 		SPDK_ERRLOG("FirstBurstLength(%d) > MaxBurstLength(%d)\n",
1059 			    conn->sess->FirstBurstLength,
1060 			    conn->sess->MaxBurstLength);
1061 		return -1;
1062 	}
1063 	if (conn->sess->FirstBurstLength > g_iscsi.FirstBurstLength) {
1064 		SPDK_ERRLOG("FirstBurstLength(%d) > iSCSI target restriction(%d)\n",
1065 			    conn->sess->FirstBurstLength, g_iscsi.FirstBurstLength);
1066 		return -1;
1067 	}
1068 	if (conn->sess->MaxBurstLength > 0x00ffffff) {
1069 		SPDK_ERRLOG("MaxBurstLength(%d) > 0x00ffffff\n",
1070 			    conn->sess->MaxBurstLength);
1071 		return -1;
1072 	}
1073 
1074 	if (conn->MaxRecvDataSegmentLength < 512) {
1075 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) < 512\n",
1076 			    conn->MaxRecvDataSegmentLength);
1077 		return -1;
1078 	}
1079 	if (conn->MaxRecvDataSegmentLength > 0x00ffffff) {
1080 		SPDK_ERRLOG("MaxRecvDataSegmentLength(%d) > 0x00ffffff\n",
1081 			    conn->MaxRecvDataSegmentLength);
1082 		return -1;
1083 	}
1084 	return 0;
1085 }
1086 
1087 static int
1088 iscsi_conn_params_update(struct spdk_iscsi_conn *conn)
1089 {
1090 	int rc;
1091 	uint32_t recv_buf_size;
1092 
1093 	/* update internal variables */
1094 	rc = iscsi_copy_param2var(conn);
1095 	if (rc < 0) {
1096 		SPDK_ERRLOG("iscsi_copy_param2var() failed\n");
1097 		if (conn->state < ISCSI_CONN_STATE_EXITING) {
1098 			conn->state = ISCSI_CONN_STATE_EXITING;
1099 		}
1100 		return rc;
1101 	}
1102 
1103 	/* check value */
1104 	rc = iscsi_check_values(conn);
1105 	if (rc < 0) {
1106 		SPDK_ERRLOG("iscsi_check_values() failed\n");
1107 		if (conn->state < ISCSI_CONN_STATE_EXITING) {
1108 			conn->state = ISCSI_CONN_STATE_EXITING;
1109 		}
1110 	}
1111 
1112 	/* The socket receive buffer may need to be adjusted based on the new parameters */
1113 
1114 	/* Don't allow the recv buffer to be 0 or very large. */
1115 	recv_buf_size = spdk_max(0x1000, spdk_min(0x2000, conn->sess->FirstBurstLength));
1116 
1117 	/* Add in extra space for the PDU */
1118 	recv_buf_size += ISCSI_BHS_LEN + ISCSI_AHS_LEN;
1119 
1120 	if (conn->header_digest) {
1121 		recv_buf_size += ISCSI_DIGEST_LEN;
1122 	}
1123 
1124 	if (conn->data_digest) {
1125 		recv_buf_size += ISCSI_DIGEST_LEN;
1126 	}
1127 
1128 	/* Set up to buffer up to 4 commands with immediate data at once */
1129 	if (spdk_sock_set_recvbuf(conn->sock, recv_buf_size * 4) < 0) {
1130 		/* Not fatal. */
1131 	}
1132 
1133 	return rc;
1134 }
1135 
1136 static void
1137 iscsi_conn_login_pdu_err_complete(void *arg)
1138 {
1139 	struct spdk_iscsi_conn *conn = arg;
1140 
1141 	if (conn->full_feature) {
1142 		iscsi_conn_params_update(conn);
1143 	}
1144 }
1145 
1146 static void
1147 iscsi_conn_login_pdu_success_complete(void *arg)
1148 {
1149 	struct spdk_iscsi_conn *conn = arg;
1150 
1151 	spdk_poller_unregister(&conn->login_timer);
1152 
1153 	if (conn->state >= ISCSI_CONN_STATE_EXITING) {
1154 		/* Connection is being exited before this callback is executed. */
1155 		SPDK_DEBUGLOG(iscsi, "Connection is already exited.\n");
1156 		return;
1157 	}
1158 	if (conn->full_feature) {
1159 		if (iscsi_conn_params_update(conn) != 0) {
1160 			return;
1161 		}
1162 	}
1163 	conn->state = ISCSI_CONN_STATE_RUNNING;
1164 	if (conn->full_feature != 0) {
1165 		iscsi_conn_schedule(conn);
1166 	}
1167 }
1168 
1169 /*
1170  * The response function of spdk_iscsi_op_login
1171  */
1172 static void
1173 iscsi_op_login_response(struct spdk_iscsi_conn *conn,
1174 			struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param *params,
1175 			iscsi_conn_xfer_complete_cb cb_fn)
1176 {
1177 	struct iscsi_bhs_login_rsp *rsph;
1178 
1179 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1180 	rsph->version_max = ISCSI_VERSION;
1181 	rsph->version_act = ISCSI_VERSION;
1182 	DSET24(rsph->data_segment_len, rsp_pdu->data_segment_len);
1183 
1184 	to_be32(&rsph->stat_sn, conn->StatSN);
1185 	conn->StatSN++;
1186 
1187 	if (conn->sess != NULL) {
1188 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
1189 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
1190 	} else {
1191 		to_be32(&rsph->exp_cmd_sn, rsp_pdu->cmd_sn);
1192 		to_be32(&rsph->max_cmd_sn, rsp_pdu->cmd_sn);
1193 	}
1194 
1195 	SPDK_LOGDUMP(iscsi, "PDU", (uint8_t *)rsph, ISCSI_BHS_LEN);
1196 	SPDK_LOGDUMP(iscsi, "DATA", rsp_pdu->data, rsp_pdu->data_segment_len);
1197 
1198 	/* Set T/CSG/NSG to reserved if login error. */
1199 	if (rsph->status_class != 0) {
1200 		rsph->flags &= ~(ISCSI_LOGIN_TRANSIT | ISCSI_LOGIN_CURRENT_STAGE_MASK |
1201 				 ISCSI_LOGIN_NEXT_STAGE_MASK);
1202 	}
1203 	iscsi_param_free(params);
1204 	iscsi_conn_write_pdu(conn, rsp_pdu, cb_fn, conn);
1205 }
1206 
1207 /*
1208  * The function which is used to initialize the internal response data
1209  * structure of iscsi login function.
1210  * return:
1211  * 0, success;
1212  * otherwise, error;
1213  */
1214 static int
1215 iscsi_op_login_rsp_init(struct spdk_iscsi_conn *conn,
1216 			struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
1217 {
1218 	struct iscsi_bhs_login_req *reqh;
1219 	struct iscsi_bhs_login_rsp *rsph;
1220 
1221 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1222 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
1223 	rsph->status_class = ISCSI_CLASS_SUCCESS;
1224 	rsph->status_detail = ISCSI_LOGIN_ACCEPT;
1225 	rsp_pdu->data_segment_len = 0;
1226 
1227 	/* The default MaxRecvDataSegmentLength 8192 is used during login. - RFC3720 */
1228 	rsp_pdu->data = calloc(1, 8192);
1229 	if (!rsp_pdu->data) {
1230 		SPDK_ERRLOG("calloc() failed for data segment\n");
1231 		rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1232 		rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1233 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1234 	}
1235 	rsp_pdu->data_buf_len = 8192;
1236 
1237 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1238 	rsph->flags |= (reqh->flags & (ISCSI_LOGIN_TRANSIT | ISCSI_LOGIN_CONTINUE |
1239 				       ISCSI_LOGIN_CURRENT_STAGE_MASK));
1240 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1241 		rsph->flags |= (reqh->flags & ISCSI_LOGIN_NEXT_STAGE_MASK);
1242 	}
1243 
1244 	/* We don't need to convert from network byte order. Just store it */
1245 	memcpy(&rsph->isid, reqh->isid, 6);
1246 	rsph->tsih = reqh->tsih;
1247 	rsph->itt = reqh->itt;
1248 	rsp_pdu->cmd_sn = from_be32(&reqh->cmd_sn);
1249 
1250 	if (rsph->tsih) {
1251 		rsph->stat_sn = reqh->exp_stat_sn;
1252 	}
1253 
1254 	SPDK_LOGDUMP(iscsi, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
1255 
1256 	SPDK_DEBUGLOG(iscsi,
1257 		      "T=%d, C=%d, CSG=%d, NSG=%d, Min=%d, Max=%d, ITT=%x\n",
1258 		      ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags),
1259 		      ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags),
1260 		      ISCSI_BHS_LOGIN_GET_CSG(rsph->flags),
1261 		      ISCSI_BHS_LOGIN_GET_NSG(rsph->flags),
1262 		      reqh->version_min, reqh->version_max, from_be32(&rsph->itt));
1263 
1264 	if (conn->sess != NULL) {
1265 		SPDK_DEBUGLOG(iscsi,
1266 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u,"
1267 			      "MaxCmdSN=%u\n", rsp_pdu->cmd_sn,
1268 			      from_be32(&rsph->stat_sn), conn->StatSN,
1269 			      conn->sess->ExpCmdSN,
1270 			      conn->sess->MaxCmdSN);
1271 	} else {
1272 		SPDK_DEBUGLOG(iscsi,
1273 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
1274 			      rsp_pdu->cmd_sn, from_be32(&rsph->stat_sn),
1275 			      conn->StatSN);
1276 	}
1277 
1278 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags) &&
1279 	    ISCSI_BHS_LOGIN_GET_CBIT(rsph->flags)) {
1280 		SPDK_ERRLOG("transit error\n");
1281 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1282 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1283 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1284 	}
1285 	/* make sure reqh->version_max < ISCSI_VERSION */
1286 	if (reqh->version_min > ISCSI_VERSION) {
1287 		SPDK_ERRLOG("unsupported version min %d/max %d, expecting %d\n", reqh->version_min,
1288 			    reqh->version_max, ISCSI_VERSION);
1289 		/* Unsupported version */
1290 		/* set all reserved flag to zero */
1291 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1292 		rsph->status_detail = ISCSI_LOGIN_UNSUPPORTED_VERSION;
1293 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1294 	}
1295 
1296 	if ((ISCSI_BHS_LOGIN_GET_NSG(rsph->flags) == ISCSI_NSG_RESERVED_CODE) &&
1297 	    ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
1298 		/* set NSG and other bits to zero */
1299 		rsph->flags &= ~(ISCSI_LOGIN_NEXT_STAGE_MASK | ISCSI_LOGIN_TRANSIT |
1300 				 ISCSI_LOGIN_CURRENT_STAGE_MASK);
1301 		SPDK_ERRLOG("Received reserved NSG code: %d\n", ISCSI_NSG_RESERVED_CODE);
1302 		/* Initiator error */
1303 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1304 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1305 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1306 	}
1307 
1308 	return 0;
1309 }
1310 
1311 static int
1312 iscsi_op_login_store_incoming_params(struct spdk_iscsi_conn *conn,
1313 				     struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu,
1314 				     struct iscsi_param **params)
1315 {
1316 	struct iscsi_bhs_login_req *reqh;
1317 	struct iscsi_bhs_login_rsp *rsph;
1318 	int rc;
1319 
1320 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
1321 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1322 
1323 	rc = iscsi_parse_params(params, pdu->data,
1324 				pdu->data_segment_len, ISCSI_BHS_LOGIN_GET_CBIT(reqh->flags),
1325 				&conn->partial_text_parameter);
1326 	if (rc < 0) {
1327 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
1328 		iscsi_param_free(*params);
1329 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1330 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
1331 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1332 	}
1333 
1334 	return 0;
1335 }
1336 
1337 /*
1338  * This function is used to initialize the port info
1339  * return
1340  * 0: success
1341  * otherwise: error
1342  */
1343 static int
1344 iscsi_op_login_initialize_port(struct spdk_iscsi_conn *conn,
1345 			       struct spdk_iscsi_pdu *rsp_pdu,
1346 			       char *initiator_port_name,
1347 			       uint32_t name_length,
1348 			       struct iscsi_param *params)
1349 {
1350 	const char *val;
1351 	struct iscsi_bhs_login_rsp *rsph;
1352 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1353 
1354 	/* Initiator Name and Port */
1355 	val = iscsi_param_get_val(params, "InitiatorName");
1356 	if (val == NULL) {
1357 		SPDK_ERRLOG("InitiatorName is empty\n");
1358 		/* Missing parameter */
1359 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1360 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1361 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1362 	}
1363 	snprintf(conn->initiator_name, sizeof(conn->initiator_name), "%s", val);
1364 	snprintf(initiator_port_name, name_length,
1365 		 "%s,i,0x%12.12" PRIx64, val, iscsi_get_isid(rsph->isid));
1366 	spdk_strlwr(conn->initiator_name);
1367 	spdk_strlwr(initiator_port_name);
1368 	SPDK_DEBUGLOG(iscsi, "Initiator name: %s\n", conn->initiator_name);
1369 	SPDK_DEBUGLOG(iscsi, "Initiator port: %s\n", initiator_port_name);
1370 
1371 	return 0;
1372 }
1373 
1374 /*
1375  * This function is used to judge the session type
1376  * return
1377  * 0: success
1378  * Other value: error
1379  */
1380 static int
1381 iscsi_op_login_session_type(struct spdk_iscsi_conn *conn,
1382 			    struct spdk_iscsi_pdu *rsp_pdu,
1383 			    enum session_type *session_type,
1384 			    struct iscsi_param *params)
1385 {
1386 	const char *session_type_str;
1387 	struct iscsi_bhs_login_rsp *rsph;
1388 
1389 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1390 	session_type_str = iscsi_param_get_val(params, "SessionType");
1391 	if (session_type_str == NULL) {
1392 		if (rsph->tsih != 0) {
1393 			*session_type = SESSION_TYPE_NORMAL;
1394 		} else {
1395 			SPDK_ERRLOG("SessionType is empty\n");
1396 			/* Missing parameter */
1397 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1398 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1399 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1400 		}
1401 	} else {
1402 		if (strcasecmp(session_type_str, "Discovery") == 0) {
1403 			*session_type = SESSION_TYPE_DISCOVERY;
1404 		} else if (strcasecmp(session_type_str, "Normal") == 0) {
1405 			*session_type = SESSION_TYPE_NORMAL;
1406 		} else {
1407 			*session_type = SESSION_TYPE_INVALID;
1408 			SPDK_ERRLOG("SessionType is invalid\n");
1409 			/* Missing parameter */
1410 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1411 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1412 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1413 		}
1414 	}
1415 	SPDK_DEBUGLOG(iscsi, "Session Type: %s\n", session_type_str);
1416 
1417 	return 0;
1418 }
1419 
1420 /*
1421  * This function is used to check the target info
1422  * return:
1423  * 0: success
1424  * otherwise: error
1425  */
1426 static int
1427 iscsi_op_login_check_target(struct spdk_iscsi_conn *conn,
1428 			    struct spdk_iscsi_pdu *rsp_pdu,
1429 			    const char *target_name,
1430 			    struct spdk_iscsi_tgt_node **target)
1431 {
1432 	struct iscsi_bhs_login_rsp *rsph;
1433 	char buf[MAX_TMPBUF] = {};
1434 
1435 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1436 	*target = iscsi_find_tgt_node(target_name);
1437 	if (*target == NULL) {
1438 		SPDK_WARNLOG("target %s not found\n", target_name);
1439 		/* Not found */
1440 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1441 		rsph->status_detail = ISCSI_LOGIN_TARGET_NOT_FOUND;
1442 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1443 	}
1444 	if (iscsi_tgt_node_is_destructed(*target)) {
1445 		SPDK_ERRLOG("target %s is removed\n", target_name);
1446 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1447 		rsph->status_detail = ISCSI_LOGIN_TARGET_REMOVED;
1448 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1449 	}
1450 	if (iscsi_tgt_node_is_redirected(conn, *target, buf, MAX_TMPBUF)) {
1451 		SPDK_INFOLOG(iscsi, "target %s is redirectd\n", target_name);
1452 		rsp_pdu->data_segment_len = iscsi_append_text("TargetAddress",
1453 					    buf,
1454 					    rsp_pdu->data,
1455 					    rsp_pdu->data_buf_len,
1456 					    rsp_pdu->data_segment_len);
1457 		rsph->status_class = ISCSI_CLASS_REDIRECT;
1458 		rsph->status_detail = ISCSI_LOGIN_TARGET_TEMPORARILY_MOVED;
1459 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1460 	}
1461 	if (!iscsi_tgt_node_access(conn, *target, conn->initiator_name,
1462 				   conn->initiator_addr)) {
1463 		SPDK_ERRLOG("access denied\n");
1464 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1465 		rsph->status_detail = ISCSI_LOGIN_AUTHORIZATION_FAIL;
1466 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1467 	}
1468 
1469 	return 0;
1470 }
1471 
1472 /*
1473  * This function use to check the session
1474  * return:
1475  * 0, success
1476  * otherwise: error
1477  */
1478 static int
1479 iscsi_op_login_check_session(struct spdk_iscsi_conn *conn,
1480 			     struct spdk_iscsi_pdu *rsp_pdu,
1481 			     char *initiator_port_name, int cid)
1482 
1483 {
1484 	int rc = 0;
1485 	struct iscsi_bhs_login_rsp *rsph;
1486 
1487 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1488 	/* check existing session */
1489 	SPDK_DEBUGLOG(iscsi, "isid=%"PRIx64", tsih=%u, cid=%u\n",
1490 		      iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih), cid);
1491 	if (rsph->tsih != 0) {
1492 		/* multiple connections */
1493 		rc = append_iscsi_sess(conn, initiator_port_name,
1494 				       from_be16(&rsph->tsih), cid);
1495 		if (rc != 0) {
1496 			SPDK_ERRLOG("isid=%"PRIx64", tsih=%u, cid=%u:"
1497 				    "spdk_append_iscsi_sess() failed\n",
1498 				    iscsi_get_isid(rsph->isid), from_be16(&rsph->tsih),
1499 				    cid);
1500 			/* Can't include in session */
1501 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1502 			rsph->status_detail = rc;
1503 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1504 		}
1505 	} else if (!g_iscsi.AllowDuplicateIsid) {
1506 		/* new session, drop old sess by the initiator */
1507 		iscsi_drop_conns(conn, initiator_port_name, 0 /* drop old */);
1508 	}
1509 
1510 	return rc;
1511 }
1512 
1513 /*
1514  * This function is used to del the original param and update it with new
1515  * value
1516  * return:
1517  * 0: success
1518  * otherwise: error
1519  */
1520 static int
1521 iscsi_op_login_update_param(struct spdk_iscsi_conn *conn,
1522 			    const char *key, const char *value,
1523 			    const char *list)
1524 {
1525 	int rc = 0;
1526 	struct iscsi_param *new_param, *orig_param;
1527 	int index;
1528 
1529 	orig_param = iscsi_param_find(conn->params, key);
1530 	if (orig_param == NULL) {
1531 		SPDK_ERRLOG("orig_param %s not found\n", key);
1532 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1533 	}
1534 
1535 	index = orig_param->state_index;
1536 	rc = iscsi_param_del(&conn->params, key);
1537 	if (rc < 0) {
1538 		SPDK_ERRLOG("iscsi_param_del(%s) failed\n", key);
1539 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1540 	}
1541 	rc = iscsi_param_add(&conn->params, key, value, list, ISPT_LIST);
1542 	if (rc < 0) {
1543 		SPDK_ERRLOG("iscsi_param_add() failed\n");
1544 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1545 	}
1546 	new_param = iscsi_param_find(conn->params, key);
1547 	if (new_param == NULL) {
1548 		SPDK_ERRLOG("iscsi_param_find() failed\n");
1549 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1550 	}
1551 	new_param->state_index = index;
1552 	return rc;
1553 }
1554 
1555 static int
1556 iscsi_negotiate_chap_param(struct spdk_iscsi_conn *conn)
1557 {
1558 	int rc = 0;
1559 
1560 	if (conn->disable_chap) {
1561 		rc = iscsi_op_login_update_param(conn, "AuthMethod", "None", "None");
1562 	} else if (conn->require_chap) {
1563 		rc = iscsi_op_login_update_param(conn, "AuthMethod", "CHAP", "CHAP");
1564 	}
1565 
1566 	return rc;
1567 }
1568 
1569 /*
1570  * The function which is used to handle the part of session discovery
1571  * return:
1572  * 0, success;
1573  * otherwise: error;
1574  */
1575 static int
1576 iscsi_op_login_session_discovery_chap(struct spdk_iscsi_conn *conn)
1577 {
1578 	return iscsi_negotiate_chap_param(conn);
1579 }
1580 
1581 /*
1582  * This function is used to update the param related with chap
1583  * return:
1584  * 0: success
1585  * otherwise: error
1586  */
1587 static int
1588 iscsi_op_login_negotiate_chap_param(struct spdk_iscsi_conn *conn,
1589 				    struct spdk_iscsi_tgt_node *target)
1590 {
1591 	conn->disable_chap = target->disable_chap;
1592 	conn->require_chap = target->require_chap;
1593 	conn->mutual_chap = target->mutual_chap;
1594 	conn->chap_group = target->chap_group;
1595 
1596 	return iscsi_negotiate_chap_param(conn);
1597 }
1598 
1599 static int
1600 iscsi_op_login_negotiate_digest_param(struct spdk_iscsi_conn *conn,
1601 				      struct spdk_iscsi_tgt_node *target)
1602 {
1603 	int rc;
1604 
1605 	if (target->header_digest) {
1606 		/*
1607 		 * User specified header digests, so update the list of
1608 		 *  HeaderDigest values to remove "None" so that only
1609 		 *  initiators who support CRC32C can connect.
1610 		 */
1611 		rc = iscsi_op_login_update_param(conn, "HeaderDigest", "CRC32C", "CRC32C");
1612 		if (rc < 0) {
1613 			return rc;
1614 		}
1615 	}
1616 
1617 	if (target->data_digest) {
1618 		/*
1619 		 * User specified data digests, so update the list of
1620 		 *  DataDigest values to remove "None" so that only
1621 		 *  initiators who support CRC32C can connect.
1622 		 */
1623 		rc = iscsi_op_login_update_param(conn, "DataDigest", "CRC32C", "CRC32C");
1624 		if (rc < 0) {
1625 			return rc;
1626 		}
1627 	}
1628 
1629 	return 0;
1630 }
1631 
1632 /*
1633  * The function which is used to handle the part of normal login session
1634  * return:
1635  * 0, success;
1636  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1637  */
1638 static int
1639 iscsi_op_login_session_normal(struct spdk_iscsi_conn *conn,
1640 			      struct spdk_iscsi_pdu *rsp_pdu,
1641 			      char *initiator_port_name,
1642 			      struct iscsi_param *params,
1643 			      int cid)
1644 {
1645 	struct spdk_iscsi_tgt_node *target = NULL;
1646 	const char *target_name;
1647 	const char *target_short_name;
1648 	struct iscsi_bhs_login_rsp *rsph;
1649 	int rc = 0;
1650 
1651 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1652 	target_name = iscsi_param_get_val(params, "TargetName");
1653 
1654 	if (target_name == NULL) {
1655 		SPDK_ERRLOG("TargetName is empty\n");
1656 		/* Missing parameter */
1657 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1658 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1659 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1660 	}
1661 
1662 	memset(conn->target_short_name, 0, MAX_TARGET_NAME);
1663 	target_short_name = strstr(target_name, ":");
1664 	if (target_short_name != NULL) {
1665 		target_short_name++; /* Advance past the ':' */
1666 		if (strlen(target_short_name) >= MAX_TARGET_NAME) {
1667 			SPDK_ERRLOG("Target Short Name (%s) is more than %u characters\n",
1668 				    target_short_name, MAX_TARGET_NAME);
1669 			/* Invalid request */
1670 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1671 			rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
1672 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1673 		}
1674 		snprintf(conn->target_short_name, MAX_TARGET_NAME, "%s",
1675 			 target_short_name);
1676 	}
1677 
1678 	pthread_mutex_lock(&g_iscsi.mutex);
1679 	rc = iscsi_op_login_check_target(conn, rsp_pdu, target_name, &target);
1680 	pthread_mutex_unlock(&g_iscsi.mutex);
1681 
1682 	if (rc < 0) {
1683 		return rc;
1684 	}
1685 
1686 	conn->target = target;
1687 	conn->dev = target->dev;
1688 	conn->target_port = spdk_scsi_dev_find_port_by_id(target->dev,
1689 			    conn->pg_tag);
1690 
1691 	rc = iscsi_op_login_check_session(conn, rsp_pdu,
1692 					  initiator_port_name, cid);
1693 	if (rc < 0) {
1694 		return rc;
1695 	}
1696 
1697 	/* force target flags */
1698 	pthread_mutex_lock(&target->mutex);
1699 	rc = iscsi_op_login_negotiate_chap_param(conn, target);
1700 	pthread_mutex_unlock(&target->mutex);
1701 
1702 	if (rc == 0) {
1703 		rc = iscsi_op_login_negotiate_digest_param(conn, target);
1704 	}
1705 
1706 	if (rc != 0) {
1707 		/* Invalid request */
1708 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1709 		rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
1710 	}
1711 
1712 	return rc;
1713 }
1714 
1715 /*
1716  * This function is used to set the info in the connection data structure
1717  * return
1718  * 0: success
1719  * otherwise: error
1720  */
1721 static int
1722 iscsi_op_login_set_conn_info(struct spdk_iscsi_conn *conn,
1723 			     struct spdk_iscsi_pdu *rsp_pdu,
1724 			     char *initiator_port_name,
1725 			     enum session_type session_type, int cid)
1726 {
1727 	int rc = 0;
1728 	struct spdk_iscsi_tgt_node *target;
1729 	struct iscsi_bhs_login_rsp *rsph;
1730 	struct spdk_scsi_port *initiator_port;
1731 
1732 	target = conn->target;
1733 
1734 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1735 	conn->authenticated = false;
1736 	conn->auth.chap_phase = ISCSI_CHAP_PHASE_WAIT_A;
1737 	conn->cid = cid;
1738 
1739 	if (conn->sess == NULL) {
1740 		/* create initiator port */
1741 		initiator_port = spdk_scsi_port_create(iscsi_get_isid(rsph->isid), 0, initiator_port_name);
1742 		if (initiator_port == NULL) {
1743 			SPDK_ERRLOG("create_port() failed\n");
1744 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1745 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1746 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1747 		}
1748 
1749 		/* new session */
1750 		rc = create_iscsi_sess(conn, target, session_type);
1751 		if (rc < 0) {
1752 			spdk_scsi_port_free(&initiator_port);
1753 			SPDK_ERRLOG("create_sess() failed\n");
1754 			rsph->status_class = ISCSI_CLASS_TARGET_ERROR;
1755 			rsph->status_detail = ISCSI_LOGIN_STATUS_NO_RESOURCES;
1756 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1757 		}
1758 		/* initialize parameters */
1759 		conn->sess->initiator_port = initiator_port;
1760 		conn->StatSN = from_be32(&rsph->stat_sn);
1761 		conn->sess->isid = iscsi_get_isid(rsph->isid);
1762 
1763 		/* Initiator port TransportID */
1764 		spdk_scsi_port_set_iscsi_transport_id(conn->sess->initiator_port,
1765 						      conn->initiator_name,
1766 						      conn->sess->isid);
1767 
1768 		/* Discovery sessions will not have a target. */
1769 		if (target != NULL) {
1770 			conn->sess->queue_depth = target->queue_depth;
1771 		} else {
1772 			/*
1773 			 * Assume discovery sessions have an effective command
1774 			 *  windows size of 1.
1775 			 */
1776 			conn->sess->queue_depth = 1;
1777 		}
1778 		conn->sess->ExpCmdSN = rsp_pdu->cmd_sn;
1779 		conn->sess->MaxCmdSN = rsp_pdu->cmd_sn + conn->sess->queue_depth - 1;
1780 	}
1781 
1782 	conn->initiator_port = conn->sess->initiator_port;
1783 
1784 	return 0;
1785 }
1786 
1787 /*
1788  * This function is used to set the target info
1789  * return
1790  * 0: success
1791  * otherwise: error
1792  */
1793 static int
1794 iscsi_op_login_set_target_info(struct spdk_iscsi_conn *conn,
1795 			       struct spdk_iscsi_pdu *rsp_pdu,
1796 			       enum session_type session_type)
1797 {
1798 	char buf[MAX_TMPBUF];
1799 	const char *val;
1800 	int rc = 0;
1801 	struct spdk_iscsi_tgt_node *target = conn->target;
1802 
1803 	/* declarative parameters */
1804 	if (target != NULL) {
1805 		pthread_mutex_lock(&target->mutex);
1806 		if (target->alias[0] != '\0') {
1807 			snprintf(buf, sizeof buf, "%s", target->alias);
1808 		} else {
1809 			snprintf(buf, sizeof buf, "%s", "");
1810 		}
1811 		pthread_mutex_unlock(&target->mutex);
1812 		rc = iscsi_param_set(conn->sess->params, "TargetAlias", buf);
1813 		if (rc < 0) {
1814 			SPDK_ERRLOG("iscsi_param_set() failed\n");
1815 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1816 		}
1817 	}
1818 	snprintf(buf, sizeof buf, "%s:%s,%d", conn->portal_host, conn->portal_port,
1819 		 conn->pg_tag);
1820 	rc = iscsi_param_set(conn->sess->params, "TargetAddress", buf);
1821 	if (rc < 0) {
1822 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1823 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1824 	}
1825 	snprintf(buf, sizeof buf, "%d", conn->pg_tag);
1826 	rc = iscsi_param_set(conn->sess->params, "TargetPortalGroupTag", buf);
1827 	if (rc < 0) {
1828 		SPDK_ERRLOG("iscsi_param_set() failed\n");
1829 		return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1830 	}
1831 
1832 	/* write in response */
1833 	if (target != NULL) {
1834 		val = iscsi_param_get_val(conn->sess->params, "TargetAlias");
1835 		if (val != NULL && strlen(val) != 0) {
1836 			rsp_pdu->data_segment_len = iscsi_append_param(conn,
1837 						    "TargetAlias",
1838 						    rsp_pdu->data,
1839 						    rsp_pdu->data_buf_len,
1840 						    rsp_pdu->data_segment_len);
1841 		}
1842 		if (session_type == SESSION_TYPE_DISCOVERY) {
1843 			rsp_pdu->data_segment_len = iscsi_append_param(conn,
1844 						    "TargetAddress",
1845 						    rsp_pdu->data,
1846 						    rsp_pdu->data_buf_len,
1847 						    rsp_pdu->data_segment_len);
1848 		}
1849 		rsp_pdu->data_segment_len = iscsi_append_param(conn,
1850 					    "TargetPortalGroupTag",
1851 					    rsp_pdu->data,
1852 					    rsp_pdu->data_buf_len,
1853 					    rsp_pdu->data_segment_len);
1854 	}
1855 
1856 	return rc;
1857 }
1858 
1859 /*
1860  * This function is used to handle the login of iscsi initiator when there is
1861  * no session
1862  * return:
1863  * 0, success;
1864  * SPDK_ISCSI_LOGIN_ERROR_PARAMETER, parameter error;
1865  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify the login fail.
1866  */
1867 static int
1868 iscsi_op_login_phase_none(struct spdk_iscsi_conn *conn,
1869 			  struct spdk_iscsi_pdu *rsp_pdu,
1870 			  struct iscsi_param *params, int cid)
1871 {
1872 	enum session_type session_type;
1873 	char initiator_port_name[MAX_INITIATOR_PORT_NAME];
1874 	struct iscsi_bhs_login_rsp *rsph;
1875 	int rc = 0;
1876 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1877 
1878 	conn->target = NULL;
1879 	conn->dev = NULL;
1880 
1881 	rc = iscsi_op_login_initialize_port(conn, rsp_pdu, initiator_port_name,
1882 					    MAX_INITIATOR_PORT_NAME, params);
1883 	if (rc < 0) {
1884 		return rc;
1885 	}
1886 
1887 	rc = iscsi_op_login_session_type(conn, rsp_pdu, &session_type, params);
1888 	if (rc < 0) {
1889 		return rc;
1890 	}
1891 
1892 	/* Target Name and Port */
1893 	if (session_type == SESSION_TYPE_NORMAL) {
1894 		rc = iscsi_op_login_session_normal(conn, rsp_pdu,
1895 						   initiator_port_name,
1896 						   params, cid);
1897 		if (rc < 0) {
1898 			return rc;
1899 		}
1900 
1901 	} else if (session_type == SESSION_TYPE_DISCOVERY) {
1902 		rsph->tsih = 0;
1903 
1904 		/* force target flags */
1905 		pthread_mutex_lock(&g_iscsi.mutex);
1906 		rc = iscsi_op_login_session_discovery_chap(conn);
1907 		pthread_mutex_unlock(&g_iscsi.mutex);
1908 		if (rc < 0) {
1909 			return rc;
1910 		}
1911 	} else {
1912 		SPDK_ERRLOG("unknown session type\n");
1913 		/* Missing parameter */
1914 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1915 		rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1916 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1917 	}
1918 
1919 	rc = iscsi_op_login_set_conn_info(conn, rsp_pdu, initiator_port_name,
1920 					  session_type, cid);
1921 	if (rc < 0) {
1922 		return rc;
1923 	}
1924 
1925 	/* limit conns on discovery session */
1926 	if (session_type == SESSION_TYPE_DISCOVERY) {
1927 		conn->sess->MaxConnections = 1;
1928 		rc = iscsi_param_set_int(conn->sess->params,
1929 					 "MaxConnections",
1930 					 conn->sess->MaxConnections);
1931 		if (rc < 0) {
1932 			SPDK_ERRLOG("iscsi_param_set_int() failed\n");
1933 			return SPDK_ISCSI_LOGIN_ERROR_PARAMETER;
1934 		}
1935 	}
1936 
1937 	return iscsi_op_login_set_target_info(conn, rsp_pdu, session_type);
1938 }
1939 
1940 /*
1941  * This function is used to set the csg bit case in rsp
1942  * return:
1943  * 0, success
1944  * otherwise: error
1945  */
1946 static int
1947 iscsi_op_login_rsp_handle_csg_bit(struct spdk_iscsi_conn *conn,
1948 				  struct spdk_iscsi_pdu *rsp_pdu,
1949 				  struct iscsi_param *params)
1950 {
1951 	const char *auth_method;
1952 	int rc;
1953 	struct iscsi_bhs_login_rsp *rsph;
1954 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
1955 
1956 	switch (ISCSI_BHS_LOGIN_GET_CSG(rsph->flags)) {
1957 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
1958 		/* SecurityNegotiation */
1959 		auth_method = iscsi_param_get_val(conn->params, "AuthMethod");
1960 		if (auth_method == NULL) {
1961 			SPDK_ERRLOG("AuthMethod is empty\n");
1962 			/* Missing parameter */
1963 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1964 			rsph->status_detail = ISCSI_LOGIN_MISSING_PARMS;
1965 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1966 		}
1967 		if (strcasecmp(auth_method, "None") == 0) {
1968 			conn->authenticated = true;
1969 		} else {
1970 			rc = iscsi_auth_params(conn, params, auth_method,
1971 					       rsp_pdu->data, rsp_pdu->data_buf_len,
1972 					       rsp_pdu->data_segment_len);
1973 			if (rc < 0) {
1974 				SPDK_ERRLOG("iscsi_auth_params() failed\n");
1975 				/* Authentication failure */
1976 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
1977 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
1978 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
1979 			}
1980 			rsp_pdu->data_segment_len = rc;
1981 			if (!conn->authenticated) {
1982 				/* not complete */
1983 				rsph->flags &= ~ISCSI_LOGIN_TRANSIT;
1984 			} else {
1985 				if (conn->auth.chap_phase != ISCSI_CHAP_PHASE_END) {
1986 					SPDK_DEBUGLOG(iscsi, "CHAP phase not complete");
1987 				}
1988 			}
1989 
1990 			SPDK_LOGDUMP(iscsi, "Negotiated Auth Params",
1991 				     rsp_pdu->data, rsp_pdu->data_segment_len);
1992 		}
1993 		break;
1994 
1995 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
1996 		/* LoginOperationalNegotiation */
1997 		if (conn->state == ISCSI_CONN_STATE_INVALID) {
1998 			if (conn->require_chap) {
1999 				/* Authentication failure */
2000 				rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2001 				rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
2002 				return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2003 			} else {
2004 				/* AuthMethod=None */
2005 				conn->authenticated = true;
2006 			}
2007 		}
2008 		if (!conn->authenticated) {
2009 			SPDK_ERRLOG("authentication error\n");
2010 			/* Authentication failure */
2011 			rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2012 			rsph->status_detail = ISCSI_LOGIN_AUTHENT_FAIL;
2013 			return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2014 		}
2015 		break;
2016 
2017 	case ISCSI_FULL_FEATURE_PHASE:
2018 		/* FullFeaturePhase */
2019 		SPDK_ERRLOG("XXX Login in FullFeaturePhase\n");
2020 		/* Initiator error */
2021 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2022 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2023 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2024 
2025 	default:
2026 		SPDK_ERRLOG("unknown stage\n");
2027 		/* Initiator error */
2028 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2029 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2030 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2031 	}
2032 
2033 	return 0;
2034 }
2035 
2036 /* This function is used to notify the session info
2037  * return
2038  * 0: success
2039  * otherwise: error
2040  */
2041 static int
2042 iscsi_op_login_notify_session_info(struct spdk_iscsi_conn *conn,
2043 				   struct spdk_iscsi_pdu *rsp_pdu)
2044 {
2045 	struct iscsi_bhs_login_rsp *rsph;
2046 
2047 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2048 	if (conn->sess->session_type == SESSION_TYPE_NORMAL) {
2049 		/* normal session */
2050 		SPDK_DEBUGLOG(iscsi, "Login from %s (%s) on %s tgt_node%d"
2051 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2052 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2053 			      conn->initiator_name, conn->initiator_addr,
2054 			      conn->target->name, conn->target->num,
2055 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2056 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2057 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2058 			       ? "on" : "off"),
2059 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2060 			       ? "on" : "off"));
2061 	} else if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2062 		/* discovery session */
2063 		SPDK_DEBUGLOG(iscsi, "Login(discovery) from %s (%s) on"
2064 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2065 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2066 			      conn->initiator_name, conn->initiator_addr,
2067 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2068 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2069 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2070 			       ? "on" : "off"),
2071 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2072 			       ? "on" : "off"));
2073 	} else {
2074 		SPDK_ERRLOG("unknown session type\n");
2075 		/* Initiator error */
2076 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2077 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2078 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2079 	}
2080 
2081 	return 0;
2082 }
2083 
2084 /*
2085  * This function is to handle the tbit cases
2086  * return
2087  * 0: success
2088  * otherwise error
2089  */
2090 static int
2091 iscsi_op_login_rsp_handle_t_bit(struct spdk_iscsi_conn *conn,
2092 				struct spdk_iscsi_pdu *rsp_pdu)
2093 {
2094 	int rc;
2095 	struct iscsi_bhs_login_rsp *rsph;
2096 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2097 
2098 	switch (ISCSI_BHS_LOGIN_GET_NSG(rsph->flags)) {
2099 	case ISCSI_SECURITY_NEGOTIATION_PHASE:
2100 		/* SecurityNegotiation */
2101 		conn->login_phase = ISCSI_SECURITY_NEGOTIATION_PHASE;
2102 		break;
2103 
2104 	case ISCSI_OPERATIONAL_NEGOTIATION_PHASE:
2105 		/* LoginOperationalNegotiation */
2106 		conn->login_phase = ISCSI_OPERATIONAL_NEGOTIATION_PHASE;
2107 		break;
2108 
2109 	case ISCSI_FULL_FEATURE_PHASE:
2110 		/* FullFeaturePhase */
2111 		conn->login_phase = ISCSI_FULL_FEATURE_PHASE;
2112 		to_be16(&rsph->tsih, conn->sess->tsih);
2113 
2114 		rc = iscsi_op_login_notify_session_info(conn, rsp_pdu);
2115 		if (rc < 0) {
2116 			return rc;
2117 		}
2118 
2119 		conn->full_feature = 1;
2120 		break;
2121 
2122 	default:
2123 		SPDK_ERRLOG("unknown stage\n");
2124 		/* Initiator error */
2125 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2126 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2127 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2128 	}
2129 
2130 	return 0;
2131 }
2132 
2133 /*
2134  * This function is used to set the values of the internal data structure used
2135  * by spdk_iscsi_op_login function
2136  * return:
2137  * 0, used to notify the a successful login
2138  * SPDK_ISCSI_LOGIN_ERROR_RESPONSE,  used to notify a failure login.
2139  */
2140 static int
2141 iscsi_op_login_rsp_handle(struct spdk_iscsi_conn *conn,
2142 			  struct spdk_iscsi_pdu *rsp_pdu, struct iscsi_param **params)
2143 {
2144 	int rc;
2145 	struct iscsi_bhs_login_rsp *rsph;
2146 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
2147 
2148 	/* negotiate parameters */
2149 	rc = iscsi_negotiate_params(conn, params, rsp_pdu->data,
2150 				    rsp_pdu->data_buf_len,
2151 				    rsp_pdu->data_segment_len);
2152 	if (rc < 0) {
2153 		/*
2154 		 * iscsi_negotiate_params just returns -1 on failure,
2155 		 *  so translate this into meaningful response codes and
2156 		 *  return values.
2157 		 */
2158 		rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
2159 		rsph->status_detail = ISCSI_LOGIN_INITIATOR_ERROR;
2160 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
2161 	}
2162 
2163 	rsp_pdu->data_segment_len = rc;
2164 	SPDK_LOGDUMP(iscsi, "Negotiated Params", rsp_pdu->data, rc);
2165 
2166 	/* handle the CSG bit case */
2167 	rc = iscsi_op_login_rsp_handle_csg_bit(conn, rsp_pdu, *params);
2168 	if (rc < 0) {
2169 		return rc;
2170 	}
2171 
2172 	/* handle the T bit case */
2173 	if (ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags)) {
2174 		rc = iscsi_op_login_rsp_handle_t_bit(conn, rsp_pdu);
2175 	}
2176 
2177 	return rc;
2178 }
2179 
2180 static int
2181 iscsi_pdu_hdr_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2182 {
2183 	int rc;
2184 	struct iscsi_bhs_login_req *reqh;
2185 	struct spdk_iscsi_pdu *rsp_pdu;
2186 
2187 	if (conn->full_feature && conn->sess != NULL &&
2188 	    conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
2189 		return SPDK_ISCSI_CONNECTION_FATAL;
2190 	}
2191 
2192 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
2193 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
2194 
2195 	/* During login processing, use the 8KB default FirstBurstLength as
2196 	 *  our maximum data segment length value.
2197 	 */
2198 	if (pdu->data_segment_len > SPDK_ISCSI_FIRST_BURST_LENGTH) {
2199 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2200 	}
2201 
2202 	rsp_pdu = iscsi_get_pdu(conn);
2203 	if (rsp_pdu == NULL) {
2204 		return SPDK_ISCSI_CONNECTION_FATAL;
2205 	}
2206 	rc = iscsi_op_login_rsp_init(conn, pdu, rsp_pdu);
2207 	if (rc < 0) {
2208 		iscsi_op_login_response(conn, rsp_pdu, NULL, iscsi_conn_login_pdu_err_complete);
2209 		return 0;
2210 	}
2211 
2212 	conn->login_rsp_pdu = rsp_pdu;
2213 	return 0;
2214 }
2215 
2216 static int
2217 iscsi_pdu_payload_op_login(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2218 {
2219 	int rc;
2220 	struct iscsi_bhs_login_req *reqh;
2221 	struct spdk_iscsi_pdu *rsp_pdu;
2222 	struct iscsi_param *params = NULL;
2223 	int cid;
2224 
2225 	if (conn->login_rsp_pdu == NULL) {
2226 		return 0;
2227 	}
2228 
2229 	rsp_pdu = conn->login_rsp_pdu;
2230 
2231 	reqh = (struct iscsi_bhs_login_req *)&pdu->bhs;
2232 	cid = from_be16(&reqh->cid);
2233 
2234 	rc = iscsi_op_login_store_incoming_params(conn, pdu, rsp_pdu, &params);
2235 	if (rc < 0) {
2236 		iscsi_op_login_response(conn, rsp_pdu, NULL, iscsi_conn_login_pdu_err_complete);
2237 		return 0;
2238 	}
2239 
2240 	if (conn->state == ISCSI_CONN_STATE_INVALID) {
2241 		rc = iscsi_op_login_phase_none(conn, rsp_pdu, params, cid);
2242 		if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE || rc == SPDK_ISCSI_LOGIN_ERROR_PARAMETER) {
2243 			iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_err_complete);
2244 			return 0;
2245 		}
2246 	}
2247 
2248 	rc = iscsi_op_login_rsp_handle(conn, rsp_pdu, &params);
2249 	if (rc == SPDK_ISCSI_LOGIN_ERROR_RESPONSE) {
2250 		iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_err_complete);
2251 		return 0;
2252 	}
2253 
2254 	iscsi_op_login_response(conn, rsp_pdu, params, iscsi_conn_login_pdu_success_complete);
2255 	return 0;
2256 }
2257 
2258 static int
2259 iscsi_pdu_hdr_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2260 {
2261 	uint32_t task_tag;
2262 	uint32_t ExpStatSN;
2263 	int F_bit, C_bit;
2264 	struct iscsi_bhs_text_req *reqh;
2265 
2266 	if (pdu->data_segment_len > iscsi_get_max_immediate_data_size()) {
2267 		SPDK_ERRLOG("data segment len(=%zu) > immediate data len(=%"PRIu32")\n",
2268 			    pdu->data_segment_len, iscsi_get_max_immediate_data_size());
2269 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2270 	}
2271 
2272 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2273 
2274 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2275 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2276 	task_tag = from_be32(&reqh->itt);
2277 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2278 
2279 	SPDK_DEBUGLOG(iscsi, "I=%d, F=%d, C=%d, ITT=%x, TTT=%x\n",
2280 		      reqh->immediate, F_bit, C_bit, task_tag, from_be32(&reqh->ttt));
2281 
2282 	SPDK_DEBUGLOG(iscsi,
2283 		      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2284 		      pdu->cmd_sn, ExpStatSN, conn->StatSN, conn->sess->ExpCmdSN,
2285 		      conn->sess->MaxCmdSN);
2286 
2287 	if (ExpStatSN != conn->StatSN) {
2288 #if 0
2289 		SPDK_ERRLOG("StatSN(%u) error\n", ExpStatSN);
2290 		return -1;
2291 #else
2292 		/* StarPort have a bug */
2293 		SPDK_DEBUGLOG(iscsi, "StatSN(%u) rewound\n", ExpStatSN);
2294 		conn->StatSN = ExpStatSN;
2295 #endif
2296 	}
2297 
2298 	if (F_bit && C_bit) {
2299 		SPDK_ERRLOG("final and continue\n");
2300 		return -1;
2301 	}
2302 
2303 	/*
2304 	 * If this is the first text op in a sequence, save the ITT so we can
2305 	 * compare it against the ITT for subsequent ops in the same sequence.
2306 	 * If a subsequent text op in same sequence has a different ITT, reject
2307 	 * that PDU.
2308 	 */
2309 	if (conn->sess->current_text_itt == 0xffffffffU) {
2310 		conn->sess->current_text_itt = task_tag;
2311 	} else if (conn->sess->current_text_itt != task_tag) {
2312 		SPDK_ERRLOG("The correct itt is %u, and the current itt is %u...\n",
2313 			    conn->sess->current_text_itt, task_tag);
2314 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
2315 	}
2316 
2317 	return 0;
2318 }
2319 
2320 static void
2321 iscsi_conn_text_pdu_complete(void *arg)
2322 {
2323 	struct spdk_iscsi_conn *conn = arg;
2324 
2325 	iscsi_conn_params_update(conn);
2326 }
2327 
2328 static int
2329 iscsi_pdu_payload_op_text(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2330 {
2331 	struct iscsi_param *params = NULL;
2332 	struct spdk_iscsi_pdu *rsp_pdu;
2333 	uint8_t *data;
2334 	uint64_t lun;
2335 	uint32_t task_tag;
2336 	const char *val;
2337 	int F_bit, C_bit;
2338 	int data_len;
2339 	int alloc_len;
2340 	int rc;
2341 	struct iscsi_bhs_text_req *reqh;
2342 	struct iscsi_bhs_text_resp *rsph;
2343 
2344 	data_len = 0;
2345 	alloc_len = conn->MaxRecvDataSegmentLength;
2346 
2347 	reqh = (struct iscsi_bhs_text_req *)&pdu->bhs;
2348 
2349 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
2350 	C_bit = !!(reqh->flags & ISCSI_TEXT_CONTINUE);
2351 	lun = from_be64(&reqh->lun);
2352 	task_tag = from_be32(&reqh->itt);
2353 
2354 	/* store incoming parameters */
2355 	rc = iscsi_parse_params(&params, pdu->data, pdu->data_segment_len,
2356 				C_bit, &conn->partial_text_parameter);
2357 	if (rc < 0) {
2358 		SPDK_ERRLOG("iscsi_parse_params() failed\n");
2359 		iscsi_param_free(params);
2360 		return -1;
2361 	}
2362 
2363 	if (pdu->data_segment_len == 0 && params == NULL) {
2364 		params = conn->params_text;
2365 		conn->params_text = NULL;
2366 	}
2367 
2368 	data = calloc(1, alloc_len);
2369 	if (!data) {
2370 		SPDK_ERRLOG("calloc() failed for data segment\n");
2371 		iscsi_param_free(params);
2372 		return -ENOMEM;
2373 	}
2374 
2375 	/* negotiate parameters */
2376 	data_len = iscsi_negotiate_params(conn, &params,
2377 					  data, alloc_len, data_len);
2378 	if (data_len < 0) {
2379 		SPDK_ERRLOG("iscsi_negotiate_params() failed\n");
2380 		iscsi_param_free(params);
2381 		free(data);
2382 		return -1;
2383 	}
2384 
2385 	/* sendtargets is special case */
2386 	val = iscsi_param_get_val(params, "SendTargets");
2387 	if (val != NULL) {
2388 		if (iscsi_param_eq_val(conn->sess->params,
2389 				       "SessionType", "Discovery")) {
2390 			if (strcasecmp(val, "") == 0) {
2391 				val = "ALL";
2392 			}
2393 
2394 			data_len = iscsi_send_tgts(conn,
2395 						   conn->initiator_name,
2396 						   val, data, alloc_len,
2397 						   data_len);
2398 		} else {
2399 			if (strcasecmp(val, "") == 0) {
2400 				val = conn->target->name;
2401 			}
2402 
2403 			if (strcasecmp(val, "ALL") == 0) {
2404 				/* not in discovery session */
2405 				data_len = iscsi_append_text("SendTargets", "Reject",
2406 							     data, alloc_len, data_len);
2407 			} else {
2408 				data_len = iscsi_send_tgts(conn,
2409 							   conn->initiator_name,
2410 							   val, data, alloc_len,
2411 							   data_len);
2412 			}
2413 		}
2414 
2415 		if (conn->send_tgt_completed_size != 0) {
2416 			F_bit = 0;
2417 			C_bit = 1;
2418 		}
2419 	} else {
2420 		if (iscsi_param_eq_val(conn->sess->params, "SessionType", "Discovery")) {
2421 			iscsi_param_free(params);
2422 			free(data);
2423 			return SPDK_ISCSI_CONNECTION_FATAL;
2424 		}
2425 	}
2426 
2427 	if (spdk_likely(conn->send_tgt_completed_size == 0)) {
2428 		iscsi_param_free(params);
2429 	} else {
2430 		conn->params_text = params;
2431 	}
2432 	SPDK_LOGDUMP(iscsi, "Negotiated Params", data, data_len);
2433 
2434 	/* response PDU */
2435 	rsp_pdu = iscsi_get_pdu(conn);
2436 	if (rsp_pdu == NULL) {
2437 		free(data);
2438 		return SPDK_ISCSI_CONNECTION_FATAL;
2439 	}
2440 	rsph = (struct iscsi_bhs_text_resp *)&rsp_pdu->bhs;
2441 
2442 	rsp_pdu->data = data;
2443 	rsph->opcode = ISCSI_OP_TEXT_RSP;
2444 
2445 	if (F_bit) {
2446 		rsph->flags |= ISCSI_FLAG_FINAL;
2447 	}
2448 
2449 	if (C_bit) {
2450 		rsph->flags |= ISCSI_TEXT_CONTINUE;
2451 	}
2452 
2453 	DSET24(rsph->data_segment_len, data_len);
2454 	to_be64(&rsph->lun, lun);
2455 	to_be32(&rsph->itt, task_tag);
2456 
2457 	if (F_bit) {
2458 		rsph->ttt = 0xffffffffU;
2459 		conn->sess->current_text_itt = 0xffffffffU;
2460 	} else {
2461 		to_be32(&rsph->ttt, 1 + conn->id);
2462 	}
2463 
2464 	to_be32(&rsph->stat_sn, conn->StatSN);
2465 	conn->StatSN++;
2466 
2467 	if (reqh->immediate == 0) {
2468 		conn->sess->MaxCmdSN++;
2469 	}
2470 
2471 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2472 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2473 
2474 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_text_pdu_complete, conn);
2475 	return 0;
2476 }
2477 
2478 static void iscsi_conn_logout_pdu_complete(void *arg)
2479 {
2480 	struct spdk_iscsi_conn *conn = arg;
2481 
2482 	if (conn->sess == NULL) {
2483 		/*
2484 		 * login failed but initiator still sent a logout rather than
2485 		 *  just closing the TCP connection.
2486 		 */
2487 		SPDK_DEBUGLOG(iscsi, "Logout(login failed) from %s (%s) on"
2488 			      " (%s:%s,%d)\n",
2489 			      conn->initiator_name, conn->initiator_addr,
2490 			      conn->portal_host, conn->portal_port, conn->pg_tag);
2491 	} else if (iscsi_param_eq_val(conn->sess->params, "SessionType", "Normal")) {
2492 		SPDK_DEBUGLOG(iscsi, "Logout from %s (%s) on %s tgt_node%d"
2493 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2494 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2495 			      conn->initiator_name, conn->initiator_addr,
2496 			      conn->target->name, conn->target->num,
2497 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2498 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2499 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2500 			       ? "on" : "off"),
2501 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2502 			       ? "on" : "off"));
2503 	} else {
2504 		/* discovery session */
2505 		SPDK_DEBUGLOG(iscsi, "Logout(discovery) from %s (%s) on"
2506 			      " (%s:%s,%d), ISID=%"PRIx64", TSIH=%u,"
2507 			      " CID=%u, HeaderDigest=%s, DataDigest=%s\n",
2508 			      conn->initiator_name, conn->initiator_addr,
2509 			      conn->portal_host, conn->portal_port, conn->pg_tag,
2510 			      conn->sess->isid, conn->sess->tsih, conn->cid,
2511 			      (iscsi_param_eq_val(conn->params, "HeaderDigest", "CRC32C")
2512 			       ? "on" : "off"),
2513 			      (iscsi_param_eq_val(conn->params, "DataDigest", "CRC32C")
2514 			       ? "on" : "off"));
2515 	}
2516 }
2517 
2518 static int
2519 iscsi_pdu_hdr_op_logout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
2520 {
2521 	struct spdk_iscsi_pdu *rsp_pdu;
2522 	uint32_t task_tag;
2523 	uint32_t ExpStatSN;
2524 	int response;
2525 	struct iscsi_bhs_logout_req *reqh;
2526 	struct iscsi_bhs_logout_resp *rsph;
2527 	uint16_t cid;
2528 
2529 	reqh = (struct iscsi_bhs_logout_req *)&pdu->bhs;
2530 
2531 	cid = from_be16(&reqh->cid);
2532 	task_tag = from_be32(&reqh->itt);
2533 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
2534 
2535 	SPDK_DEBUGLOG(iscsi, "reason=%d, ITT=%x, cid=%d\n",
2536 		      reqh->reason, task_tag, cid);
2537 
2538 	if (conn->sess != NULL) {
2539 		if (conn->sess->session_type == SESSION_TYPE_DISCOVERY &&
2540 		    reqh->reason != ISCSI_LOGOUT_REASON_CLOSE_SESSION) {
2541 			SPDK_ERRLOG("Target can accept logout only with reason \"close the session\" "
2542 				    "on discovery session. %d is not acceptable reason.\n",
2543 				    reqh->reason);
2544 			return SPDK_ISCSI_CONNECTION_FATAL;
2545 		}
2546 
2547 		SPDK_DEBUGLOG(iscsi,
2548 			      "CmdSN=%u, ExpStatSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
2549 			      pdu->cmd_sn, ExpStatSN, conn->StatSN,
2550 			      conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
2551 
2552 		if (pdu->cmd_sn != conn->sess->ExpCmdSN) {
2553 			SPDK_DEBUGLOG(iscsi, "CmdSN(%u) might have dropped\n", pdu->cmd_sn);
2554 			/* ignore error */
2555 		}
2556 	} else {
2557 		SPDK_DEBUGLOG(iscsi, "CmdSN=%u, ExpStatSN=%u, StatSN=%u\n",
2558 			      pdu->cmd_sn, ExpStatSN, conn->StatSN);
2559 	}
2560 
2561 	if (ExpStatSN != conn->StatSN) {
2562 		SPDK_DEBUGLOG(iscsi, "StatSN(%u/%u) might have dropped\n",
2563 			      ExpStatSN, conn->StatSN);
2564 		/* ignore error */
2565 	}
2566 
2567 	if (conn->id == cid) {
2568 		/* connection or session closed successfully */
2569 		response = 0;
2570 		iscsi_conn_logout(conn);
2571 	} else {
2572 		response = 1;
2573 	}
2574 
2575 	/* response PDU */
2576 	rsp_pdu = iscsi_get_pdu(conn);
2577 	if (rsp_pdu == NULL) {
2578 		return SPDK_ISCSI_CONNECTION_FATAL;
2579 	}
2580 	rsph = (struct iscsi_bhs_logout_resp *)&rsp_pdu->bhs;
2581 	rsp_pdu->data = NULL;
2582 	rsph->opcode = ISCSI_OP_LOGOUT_RSP;
2583 	rsph->flags |= 0x80; /* bit 0 must be 1 */
2584 	rsph->response = response;
2585 	DSET24(rsph->data_segment_len, 0);
2586 	to_be32(&rsph->itt, task_tag);
2587 
2588 	if (conn->sess != NULL) {
2589 		to_be32(&rsph->stat_sn, conn->StatSN);
2590 		conn->StatSN++;
2591 
2592 		if (conn->sess->connections == 1) {
2593 			conn->sess->MaxCmdSN++;
2594 		}
2595 
2596 		to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2597 		to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2598 	} else {
2599 		to_be32(&rsph->stat_sn, conn->StatSN);
2600 		conn->StatSN++;
2601 		to_be32(&rsph->exp_cmd_sn, pdu->cmd_sn);
2602 		to_be32(&rsph->max_cmd_sn, pdu->cmd_sn);
2603 	}
2604 
2605 	rsph->time_2_wait = 0;
2606 	rsph->time_2_retain = 0;
2607 
2608 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_logout_pdu_complete, conn);
2609 
2610 	return 0;
2611 }
2612 
2613 static int
2614 iscsi_send_r2t(struct spdk_iscsi_conn *conn,
2615 	       struct spdk_iscsi_task *task, int offset,
2616 	       int len, uint32_t transfer_tag, uint32_t *R2TSN)
2617 {
2618 	struct spdk_iscsi_pdu *rsp_pdu;
2619 	struct iscsi_bhs_r2t *rsph;
2620 	uint64_t fmt_lun;
2621 
2622 	/* R2T PDU */
2623 	rsp_pdu = iscsi_get_pdu(conn);
2624 	if (rsp_pdu == NULL) {
2625 		return SPDK_ISCSI_CONNECTION_FATAL;
2626 	}
2627 	rsph = (struct iscsi_bhs_r2t *)&rsp_pdu->bhs;
2628 	rsp_pdu->data = NULL;
2629 	rsph->opcode = ISCSI_OP_R2T;
2630 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
2631 	fmt_lun = spdk_scsi_lun_id_int_to_fmt(task->lun_id);
2632 	to_be64(&rsph->lun, fmt_lun);
2633 	to_be32(&rsph->itt, task->tag);
2634 	to_be32(&rsph->ttt, transfer_tag);
2635 
2636 	to_be32(&rsph->stat_sn, conn->StatSN);
2637 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2638 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2639 
2640 	to_be32(&rsph->r2t_sn, *R2TSN);
2641 	*R2TSN += 1;
2642 
2643 	task->r2t_datasn = 0; /* next expected datasn to ack */
2644 
2645 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2646 	to_be32(&rsph->desired_xfer_len, (uint32_t)len);
2647 	task->desired_data_transfer_length = (size_t)len;
2648 
2649 	/* we need to hold onto this task/cmd because until the PDU has been
2650 	 * written out */
2651 	rsp_pdu->task = task;
2652 	task->scsi.ref++;
2653 
2654 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
2655 
2656 	return 0;
2657 }
2658 
2659 /* This function is used to remove the r2t pdu from snack_pdu_list by < task, r2t_sn> info */
2660 static struct spdk_iscsi_pdu *
2661 iscsi_remove_r2t_pdu_from_snack_list(struct spdk_iscsi_conn *conn,
2662 				     struct spdk_iscsi_task *task,
2663 				     uint32_t r2t_sn)
2664 {
2665 	struct spdk_iscsi_pdu *pdu;
2666 	struct iscsi_bhs_r2t *r2t_header;
2667 
2668 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
2669 		if (pdu->bhs.opcode == ISCSI_OP_R2T) {
2670 			r2t_header = (struct iscsi_bhs_r2t *)&pdu->bhs;
2671 			if (pdu->task == task &&
2672 			    from_be32(&r2t_header->r2t_sn) == r2t_sn) {
2673 				TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
2674 				return pdu;
2675 			}
2676 		}
2677 	}
2678 
2679 	return NULL;
2680 }
2681 
2682 /* This function is used re-send the r2t packet */
2683 static int
2684 iscsi_send_r2t_recovery(struct spdk_iscsi_conn *conn,
2685 			struct spdk_iscsi_task *task, uint32_t r2t_sn,
2686 			bool send_new_r2tsn)
2687 {
2688 	struct spdk_iscsi_pdu *pdu;
2689 	struct iscsi_bhs_r2t *rsph;
2690 	uint32_t transfer_len;
2691 	uint32_t len;
2692 	int rc;
2693 
2694 	/* remove the r2t pdu from the snack_list */
2695 	pdu = iscsi_remove_r2t_pdu_from_snack_list(conn, task, r2t_sn);
2696 	if (!pdu) {
2697 		SPDK_DEBUGLOG(iscsi, "No pdu is found\n");
2698 		return -1;
2699 	}
2700 
2701 	/* flag
2702 	 * false: only need to re-send the old r2t with changing statsn
2703 	 * true: we send a r2t with new r2tsn
2704 	 */
2705 	if (!send_new_r2tsn) {
2706 		to_be32(&pdu->bhs.stat_sn, conn->StatSN);
2707 		iscsi_conn_write_pdu(conn, pdu, iscsi_conn_pdu_generic_complete, NULL);
2708 	} else {
2709 		rsph = (struct iscsi_bhs_r2t *)&pdu->bhs;
2710 		transfer_len = from_be32(&rsph->desired_xfer_len);
2711 
2712 		/* still need to increase the acked r2tsn */
2713 		task->acked_r2tsn++;
2714 		len = spdk_min(conn->sess->MaxBurstLength,
2715 			       (transfer_len - task->next_expected_r2t_offset));
2716 
2717 		/* remove the old_r2t_pdu */
2718 		iscsi_conn_free_pdu(conn, pdu);
2719 
2720 		/* re-send a new r2t pdu */
2721 		rc = iscsi_send_r2t(conn, task, task->next_expected_r2t_offset,
2722 				    len, task->ttt, &task->R2TSN);
2723 		if (rc < 0) {
2724 			return SPDK_ISCSI_CONNECTION_FATAL;
2725 		}
2726 	}
2727 
2728 	return 0;
2729 }
2730 
2731 static int
2732 add_transfer_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
2733 {
2734 	uint32_t transfer_len;
2735 	size_t max_burst_len;
2736 	size_t segment_len;
2737 	size_t data_len;
2738 	int len;
2739 	int rc;
2740 	int data_out_req;
2741 
2742 	transfer_len = task->scsi.transfer_len;
2743 	data_len = iscsi_task_get_pdu(task)->data_segment_len;
2744 	max_burst_len = conn->sess->MaxBurstLength;
2745 	segment_len = SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH;
2746 	data_out_req = 1 + (transfer_len - data_len - 1) / segment_len;
2747 	task->data_out_cnt = data_out_req;
2748 
2749 	/*
2750 	 * If we already have too many tasks using R2T, then queue this task
2751 	 *  and start sending R2T for it after some of the tasks using R2T/data
2752 	 *  out buffers complete.
2753 	 */
2754 	if (conn->pending_r2t >= g_iscsi.MaxR2TPerConnection) {
2755 		TAILQ_INSERT_TAIL(&conn->queued_r2t_tasks, task, link);
2756 		return 0;
2757 	}
2758 
2759 	conn->data_out_cnt += data_out_req;
2760 	conn->pending_r2t++;
2761 
2762 	task->next_expected_r2t_offset = data_len;
2763 	task->current_r2t_length = 0;
2764 	task->R2TSN = 0;
2765 	/* According to RFC3720 10.8.5, 0xffffffff is
2766 	 * reserved for TTT in R2T.
2767 	 */
2768 	if (++conn->ttt == 0xffffffffu) {
2769 		conn->ttt = 0;
2770 	}
2771 	task->ttt = conn->ttt;
2772 
2773 	while (data_len != transfer_len) {
2774 		len = spdk_min(max_burst_len, (transfer_len - data_len));
2775 		rc = iscsi_send_r2t(conn, task, data_len, len,
2776 				    task->ttt, &task->R2TSN);
2777 		if (rc < 0) {
2778 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
2779 			return rc;
2780 		}
2781 		data_len += len;
2782 		task->next_r2t_offset = data_len;
2783 		task->outstanding_r2t++;
2784 		if (conn->sess->MaxOutstandingR2T == task->outstanding_r2t) {
2785 			break;
2786 		}
2787 	}
2788 
2789 	TAILQ_INSERT_TAIL(&conn->active_r2t_tasks, task, link);
2790 	task->is_r2t_active = true;
2791 	return 0;
2792 }
2793 
2794 /* If there are additional large writes queued for R2Ts, start them now.
2795  *  This is called when a large write is just completed or when multiple LUNs
2796  *  are attached and large write tasks for the specific LUN are cleared.
2797  */
2798 static void
2799 start_queued_transfer_tasks(struct spdk_iscsi_conn *conn)
2800 {
2801 	struct spdk_iscsi_task *task, *tmp;
2802 
2803 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, tmp) {
2804 		if (conn->pending_r2t < g_iscsi.MaxR2TPerConnection) {
2805 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
2806 			add_transfer_task(conn, task);
2807 		} else {
2808 			break;
2809 		}
2810 	}
2811 }
2812 
2813 bool
2814 iscsi_del_transfer_task(struct spdk_iscsi_conn *conn, uint32_t task_tag)
2815 {
2816 	struct spdk_iscsi_task *task, *tmp;
2817 
2818 	TAILQ_FOREACH_SAFE(task, &conn->active_r2t_tasks, link, tmp) {
2819 		if (task->tag == task_tag) {
2820 			assert(conn->data_out_cnt >= task->data_out_cnt);
2821 			conn->data_out_cnt -= task->data_out_cnt;
2822 
2823 			assert(conn->pending_r2t > 0);
2824 			conn->pending_r2t--;
2825 
2826 			assert(task->is_r2t_active == true);
2827 			TAILQ_REMOVE(&conn->active_r2t_tasks, task, link);
2828 			task->is_r2t_active = false;
2829 			iscsi_task_put(task);
2830 
2831 			start_queued_transfer_tasks(conn);
2832 			return true;
2833 		}
2834 	}
2835 	return false;
2836 }
2837 
2838 void iscsi_clear_all_transfer_task(struct spdk_iscsi_conn *conn,
2839 				   struct spdk_scsi_lun *lun,
2840 				   struct spdk_iscsi_pdu *pdu)
2841 {
2842 	struct spdk_iscsi_task *task, *task_tmp;
2843 	struct spdk_iscsi_pdu *pdu_tmp;
2844 
2845 	TAILQ_FOREACH_SAFE(task, &conn->active_r2t_tasks, link, task_tmp) {
2846 		pdu_tmp = iscsi_task_get_pdu(task);
2847 		if ((lun == NULL || lun == task->scsi.lun) &&
2848 		    (pdu == NULL || spdk_sn32_lt(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
2849 			task->outstanding_r2t = 0;
2850 			task->next_r2t_offset = 0;
2851 			task->next_expected_r2t_offset = 0;
2852 			assert(conn->data_out_cnt >= task->data_out_cnt);
2853 			conn->data_out_cnt -= task->data_out_cnt;
2854 			assert(conn->pending_r2t > 0);
2855 			conn->pending_r2t--;
2856 
2857 			TAILQ_REMOVE(&conn->active_r2t_tasks, task, link);
2858 			task->is_r2t_active = false;
2859 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
2860 				spdk_scsi_task_process_null_lun(&task->scsi);
2861 				iscsi_task_response(conn, task);
2862 			}
2863 			iscsi_task_put(task);
2864 		}
2865 	}
2866 
2867 	TAILQ_FOREACH_SAFE(task, &conn->queued_r2t_tasks, link, task_tmp) {
2868 		pdu_tmp = iscsi_task_get_pdu(task);
2869 		if ((lun == NULL || lun == task->scsi.lun) &&
2870 		    (pdu == NULL || spdk_sn32_lt(pdu_tmp->cmd_sn, pdu->cmd_sn))) {
2871 			TAILQ_REMOVE(&conn->queued_r2t_tasks, task, link);
2872 			task->is_r2t_active = false;
2873 			if (lun != NULL && spdk_scsi_lun_is_removing(lun)) {
2874 				spdk_scsi_task_process_null_lun(&task->scsi);
2875 				iscsi_task_response(conn, task);
2876 			}
2877 			iscsi_task_put(task);
2878 		}
2879 	}
2880 
2881 	start_queued_transfer_tasks(conn);
2882 }
2883 
2884 static struct spdk_iscsi_task *
2885 get_transfer_task(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
2886 {
2887 	struct spdk_iscsi_task *task;
2888 
2889 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
2890 		if (task->ttt == transfer_tag) {
2891 			return task;
2892 		}
2893 	}
2894 
2895 	return NULL;
2896 }
2897 
2898 static void
2899 iscsi_conn_datain_pdu_complete(void *arg)
2900 {
2901 	struct spdk_iscsi_conn *conn = arg;
2902 
2903 	iscsi_conn_handle_queued_datain_tasks(conn);
2904 }
2905 
2906 static int
2907 iscsi_send_datain(struct spdk_iscsi_conn *conn,
2908 		  struct spdk_iscsi_task *task, int datain_flag,
2909 		  int residual_len, int offset, int DataSN, int len)
2910 {
2911 	struct spdk_iscsi_pdu *rsp_pdu;
2912 	struct iscsi_bhs_data_in *rsph;
2913 	uint32_t task_tag;
2914 	uint32_t transfer_tag;
2915 	int F_bit, U_bit, O_bit, S_bit;
2916 	struct spdk_iscsi_task *primary;
2917 	struct spdk_scsi_lun *lun_dev;
2918 
2919 	primary = iscsi_task_get_primary(task);
2920 
2921 	/* DATA PDU */
2922 	rsp_pdu = iscsi_get_pdu(conn);
2923 	rsph = (struct iscsi_bhs_data_in *)&rsp_pdu->bhs;
2924 	rsp_pdu->data = task->scsi.iovs[0].iov_base + offset;
2925 	rsp_pdu->data_buf_len = task->scsi.iovs[0].iov_len - offset;
2926 	rsp_pdu->data_from_mempool = true;
2927 
2928 	task_tag = task->tag;
2929 	transfer_tag = 0xffffffffU;
2930 
2931 	F_bit = datain_flag & ISCSI_FLAG_FINAL;
2932 	O_bit = datain_flag & ISCSI_DATAIN_OVERFLOW;
2933 	U_bit = datain_flag & ISCSI_DATAIN_UNDERFLOW;
2934 	S_bit = datain_flag & ISCSI_DATAIN_STATUS;
2935 
2936 	/*
2937 	 * we need to hold onto this task/cmd because until the
2938 	 * PDU has been written out
2939 	 */
2940 	rsp_pdu->task = task;
2941 	task->scsi.ref++;
2942 
2943 	rsph->opcode = ISCSI_OP_SCSI_DATAIN;
2944 
2945 	if (F_bit) {
2946 		rsph->flags |= ISCSI_FLAG_FINAL;
2947 	}
2948 
2949 	/* we leave the A_bit clear */
2950 
2951 	if (F_bit && S_bit)  {
2952 		if (O_bit) {
2953 			rsph->flags |= ISCSI_DATAIN_OVERFLOW;
2954 		}
2955 
2956 		if (U_bit) {
2957 			rsph->flags |= ISCSI_DATAIN_UNDERFLOW;
2958 		}
2959 	}
2960 
2961 	if (S_bit) {
2962 		rsph->flags |= ISCSI_DATAIN_STATUS;
2963 		rsph->status = task->scsi.status;
2964 	}
2965 
2966 	DSET24(rsph->data_segment_len, len);
2967 
2968 	to_be32(&rsph->itt, task_tag);
2969 	to_be32(&rsph->ttt, transfer_tag);
2970 
2971 	if (S_bit) {
2972 		to_be32(&rsph->stat_sn, conn->StatSN);
2973 		conn->StatSN++;
2974 	}
2975 
2976 	if (F_bit && S_bit && !iscsi_task_is_immediate(primary)) {
2977 		conn->sess->MaxCmdSN++;
2978 	}
2979 
2980 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
2981 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
2982 
2983 	to_be32(&rsph->data_sn, DataSN);
2984 
2985 	if (conn->sess->ErrorRecoveryLevel >= 1) {
2986 		primary->datain_datasn = DataSN;
2987 	}
2988 	DataSN++;
2989 
2990 	if (task->parent) {
2991 		offset += primary->scsi.data_transferred;
2992 	}
2993 	to_be32(&rsph->buffer_offset, (uint32_t)offset);
2994 	task->scsi.offset = offset;
2995 
2996 	if (F_bit && S_bit) {
2997 		to_be32(&rsph->res_cnt, residual_len);
2998 	}
2999 
3000 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
3001 	if (spdk_likely(lun_dev != NULL)) {
3002 		if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(lun_dev, &task->scsi,
3003 				  &rsp_pdu->dif_ctx))) {
3004 			rsp_pdu->dif_insert_or_strip = true;
3005 		}
3006 	}
3007 
3008 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_datain_pdu_complete, conn);
3009 
3010 	return DataSN;
3011 }
3012 
3013 static int
3014 iscsi_transfer_in(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3015 {
3016 	uint32_t DataSN;
3017 	uint32_t transfer_len;
3018 	uint32_t data_len;
3019 	uint32_t segment_len;
3020 	uint32_t offset;
3021 	uint32_t residual_len = 0;
3022 	int sent_status;
3023 	uint32_t len;
3024 	int datain_flag = 0;
3025 	int datain_seq_cnt;
3026 	int i;
3027 	uint32_t sequence_end;
3028 	struct spdk_iscsi_task *primary;
3029 
3030 	primary = iscsi_task_get_primary(task);
3031 	segment_len = conn->MaxRecvDataSegmentLength;
3032 	data_len = task->scsi.data_transferred;
3033 	transfer_len = task->scsi.length;
3034 
3035 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
3036 		return 0;
3037 	}
3038 
3039 	if (data_len < transfer_len) {
3040 		/* underflow */
3041 		SPDK_DEBUGLOG(iscsi, "Underflow %u/%u\n", data_len, transfer_len);
3042 		residual_len = transfer_len - data_len;
3043 		transfer_len = data_len;
3044 		datain_flag |= ISCSI_DATAIN_UNDERFLOW;
3045 	} else if (data_len > transfer_len) {
3046 		/* overflow */
3047 		SPDK_DEBUGLOG(iscsi, "Overflow %u/%u\n", data_len, transfer_len);
3048 		residual_len = data_len - transfer_len;
3049 		datain_flag |= ISCSI_DATAIN_OVERFLOW;
3050 	} else {
3051 		SPDK_DEBUGLOG(iscsi, "Transfer %u\n", transfer_len);
3052 		residual_len = 0;
3053 	}
3054 
3055 	DataSN = primary->datain_datasn;
3056 	sent_status = 0;
3057 
3058 	/* calculate the number of sequences for all data-in pdus */
3059 	datain_seq_cnt = 1 + ((transfer_len - 1) / (int)conn->sess->MaxBurstLength);
3060 	for (i = 0; i < datain_seq_cnt; i++) {
3061 		offset = i * conn->sess->MaxBurstLength;
3062 		sequence_end = spdk_min(((i + 1) * conn->sess->MaxBurstLength),
3063 					transfer_len);
3064 
3065 		/* send data splitted by segment_len */
3066 		for (; offset < sequence_end; offset += segment_len) {
3067 			len = spdk_min(segment_len, (sequence_end - offset));
3068 
3069 			datain_flag &= ~(ISCSI_FLAG_FINAL | ISCSI_DATAIN_STATUS);
3070 
3071 			if (offset + len == sequence_end) {
3072 				/* last PDU in a sequence */
3073 				datain_flag |= ISCSI_FLAG_FINAL;
3074 				if (task->scsi.sense_data_len == 0) {
3075 					/* The last pdu in all data-in pdus */
3076 					if ((offset + len) == transfer_len &&
3077 					    (primary->bytes_completed == primary->scsi.transfer_len)) {
3078 						datain_flag |= ISCSI_DATAIN_STATUS;
3079 						sent_status = 1;
3080 					}
3081 				}
3082 			}
3083 
3084 			SPDK_DEBUGLOG(iscsi, "Transfer=%d, Offset=%d, Len=%d\n",
3085 				      sequence_end, offset, len);
3086 			SPDK_DEBUGLOG(iscsi, "StatSN=%u, DataSN=%u, Offset=%u, Len=%d\n",
3087 				      conn->StatSN, DataSN, offset, len);
3088 
3089 			DataSN = iscsi_send_datain(conn, task, datain_flag, residual_len,
3090 						   offset, DataSN, len);
3091 		}
3092 	}
3093 
3094 	if (task != primary) {
3095 		primary->scsi.data_transferred += task->scsi.data_transferred;
3096 	}
3097 	primary->datain_datasn = DataSN;
3098 
3099 	return sent_status;
3100 }
3101 
3102 void iscsi_task_response(struct spdk_iscsi_conn *conn,
3103 			 struct spdk_iscsi_task *task)
3104 {
3105 	struct spdk_iscsi_pdu *rsp_pdu;
3106 	struct iscsi_bhs_scsi_resp *rsph;
3107 	uint32_t task_tag;
3108 	uint32_t transfer_len;
3109 	size_t residual_len;
3110 	size_t data_len;
3111 	int O_bit, U_bit;
3112 	int rc;
3113 	struct spdk_iscsi_task *primary;
3114 
3115 	primary = iscsi_task_get_primary(task);
3116 
3117 	transfer_len = primary->scsi.transfer_len;
3118 	task_tag = task->tag;
3119 
3120 	/* transfer data from logical unit */
3121 	/* (direction is view of initiator side) */
3122 	if (iscsi_task_is_read(primary)) {
3123 		rc = iscsi_transfer_in(conn, task);
3124 		if (rc > 0) {
3125 			/* sent status by last DATAIN PDU */
3126 			return;
3127 		}
3128 
3129 		if (primary->bytes_completed != primary->scsi.transfer_len) {
3130 			return;
3131 		}
3132 	}
3133 
3134 	O_bit = U_bit = 0;
3135 	residual_len = 0;
3136 	data_len = primary->scsi.data_transferred;
3137 
3138 	if ((transfer_len != 0) &&
3139 	    (task->scsi.status == SPDK_SCSI_STATUS_GOOD)) {
3140 		if (data_len < transfer_len) {
3141 			/* underflow */
3142 			SPDK_DEBUGLOG(iscsi, "Underflow %zu/%u\n", data_len, transfer_len);
3143 			residual_len = transfer_len - data_len;
3144 			U_bit = 1;
3145 		} else if (data_len > transfer_len) {
3146 			/* overflow */
3147 			SPDK_DEBUGLOG(iscsi, "Overflow %zu/%u\n", data_len, transfer_len);
3148 			residual_len = data_len - transfer_len;
3149 			O_bit = 1;
3150 		} else {
3151 			SPDK_DEBUGLOG(iscsi, "Transfer %u\n", transfer_len);
3152 		}
3153 	}
3154 
3155 	/* response PDU */
3156 	rsp_pdu = iscsi_get_pdu(conn);
3157 	assert(rsp_pdu != NULL);
3158 	rsph = (struct iscsi_bhs_scsi_resp *)&rsp_pdu->bhs;
3159 	assert(task->scsi.sense_data_len <= sizeof(rsp_pdu->sense.data));
3160 	memcpy(rsp_pdu->sense.data, task->scsi.sense_data, task->scsi.sense_data_len);
3161 	to_be16(&rsp_pdu->sense.length, task->scsi.sense_data_len);
3162 	rsp_pdu->data = (uint8_t *)&rsp_pdu->sense;
3163 	rsp_pdu->data_from_mempool = true;
3164 
3165 	/*
3166 	 * we need to hold onto this task/cmd because until the
3167 	 * PDU has been written out
3168 	 */
3169 	rsp_pdu->task = task;
3170 	task->scsi.ref++;
3171 
3172 	rsph->opcode = ISCSI_OP_SCSI_RSP;
3173 	rsph->flags |= 0x80; /* bit 0 is default to 1 */
3174 
3175 	if (O_bit) {
3176 		rsph->flags |= ISCSI_SCSI_OVERFLOW;
3177 	}
3178 
3179 	if (U_bit) {
3180 		rsph->flags |= ISCSI_SCSI_UNDERFLOW;
3181 	}
3182 
3183 	rsph->status = task->scsi.status;
3184 	if (task->scsi.sense_data_len) {
3185 		/* SenseLength (2 bytes) + SenseData  */
3186 		DSET24(rsph->data_segment_len, 2 + task->scsi.sense_data_len);
3187 	}
3188 	to_be32(&rsph->itt, task_tag);
3189 
3190 	to_be32(&rsph->stat_sn, conn->StatSN);
3191 	conn->StatSN++;
3192 
3193 	if (!iscsi_task_is_immediate(primary)) {
3194 		conn->sess->MaxCmdSN++;
3195 	}
3196 
3197 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3198 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3199 
3200 	to_be32(&rsph->bi_read_res_cnt, 0);
3201 	to_be32(&rsph->res_cnt, residual_len);
3202 
3203 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3204 }
3205 
3206 /*
3207  *  This function compare the input pdu's bhs with the pdu's bhs associated by
3208  *  active_r2t_tasks and queued_r2t_tasks in a connection
3209  */
3210 static bool
3211 iscsi_compare_pdu_bhs_within_existed_r2t_tasks(struct spdk_iscsi_conn *conn,
3212 		struct spdk_iscsi_pdu *pdu)
3213 {
3214 	struct spdk_iscsi_task	*task;
3215 
3216 	TAILQ_FOREACH(task, &conn->active_r2t_tasks, link) {
3217 		if (!memcmp(&pdu->bhs, iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
3218 			return true;
3219 		}
3220 	}
3221 
3222 	TAILQ_FOREACH(task, &conn->queued_r2t_tasks, link) {
3223 		if (!memcmp(&pdu->bhs, iscsi_task_get_bhs(task), ISCSI_BHS_LEN)) {
3224 			return true;
3225 		}
3226 	}
3227 
3228 	return false;
3229 }
3230 
3231 void
3232 iscsi_queue_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3233 {
3234 	spdk_trace_record(TRACE_ISCSI_TASK_QUEUE, conn->id, task->scsi.length,
3235 			  (uintptr_t)task, (uintptr_t)task->pdu);
3236 	task->is_queued = true;
3237 	spdk_scsi_dev_queue_task(conn->dev, &task->scsi);
3238 }
3239 
3240 static int
3241 iscsi_pdu_payload_op_scsi_read(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3242 {
3243 	if (task->scsi.transfer_len <= SPDK_BDEV_LARGE_BUF_MAX_SIZE) {
3244 		task->parent = NULL;
3245 		task->scsi.offset = 0;
3246 		task->scsi.length = task->scsi.transfer_len;
3247 		spdk_scsi_task_set_data(&task->scsi, NULL, 0);
3248 
3249 		iscsi_queue_task(conn, task);
3250 		return 0;
3251 	} else {
3252 		TAILQ_INIT(&task->subtask_list);
3253 		task->current_datain_offset = 0;
3254 		TAILQ_INSERT_TAIL(&conn->queued_datain_tasks, task, link);
3255 
3256 		return iscsi_conn_handle_queued_datain_tasks(conn);
3257 	}
3258 }
3259 
3260 static int
3261 iscsi_pdu_payload_op_scsi_write(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3262 {
3263 	struct spdk_iscsi_pdu *pdu;
3264 	struct iscsi_bhs_scsi_req *reqh;
3265 	uint32_t transfer_len;
3266 	uint32_t scsi_data_len;
3267 	int rc;
3268 
3269 	pdu = iscsi_task_get_pdu(task);
3270 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
3271 
3272 	transfer_len = task->scsi.transfer_len;
3273 
3274 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
3275 		scsi_data_len = pdu->data_segment_len;
3276 	} else {
3277 		scsi_data_len = pdu->data_buf_len;
3278 	}
3279 
3280 	if (reqh->final_bit &&
3281 	    pdu->data_segment_len < transfer_len) {
3282 		/* needs R2T */
3283 		rc = add_transfer_task(conn, task);
3284 		if (rc < 0) {
3285 			SPDK_ERRLOG("add_transfer_task() failed\n");
3286 			iscsi_task_put(task);
3287 			return SPDK_ISCSI_CONNECTION_FATAL;
3288 		}
3289 
3290 		/* Non-immediate writes */
3291 		if (pdu->data_segment_len == 0) {
3292 			return 0;
3293 		} else {
3294 			/* we are doing the first partial write task */
3295 			task->scsi.ref++;
3296 			spdk_scsi_task_set_data(&task->scsi, pdu->data, scsi_data_len);
3297 			task->scsi.length = pdu->data_segment_len;
3298 		}
3299 	}
3300 
3301 	if (pdu->data_segment_len == transfer_len) {
3302 		/* we are doing small writes with no R2T */
3303 		spdk_scsi_task_set_data(&task->scsi, pdu->data, scsi_data_len);
3304 		task->scsi.length = transfer_len;
3305 	}
3306 
3307 	iscsi_queue_task(conn, task);
3308 	return 0;
3309 }
3310 
3311 static int
3312 iscsi_pdu_hdr_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3313 {
3314 	struct spdk_iscsi_task	*task;
3315 	struct spdk_scsi_dev	*dev;
3316 	uint8_t *cdb;
3317 	uint64_t lun;
3318 	uint32_t task_tag;
3319 	uint32_t transfer_len;
3320 	int R_bit, W_bit;
3321 	int lun_i;
3322 	struct iscsi_bhs_scsi_req *reqh;
3323 
3324 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3325 		SPDK_ERRLOG("ISCSI_OP_SCSI not allowed in discovery and invalid session\n");
3326 		return SPDK_ISCSI_CONNECTION_FATAL;
3327 	}
3328 
3329 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
3330 
3331 	R_bit = reqh->read_bit;
3332 	W_bit = reqh->write_bit;
3333 	lun = from_be64(&reqh->lun);
3334 	task_tag = from_be32(&reqh->itt);
3335 	transfer_len = from_be32(&reqh->expected_data_xfer_len);
3336 	cdb = reqh->cdb;
3337 
3338 	SPDK_LOGDUMP(iscsi, "CDB", cdb, 16);
3339 
3340 	task = iscsi_task_get(conn, NULL, iscsi_task_cpl);
3341 	if (!task) {
3342 		SPDK_ERRLOG("Unable to acquire task\n");
3343 		return SPDK_ISCSI_CONNECTION_FATAL;
3344 	}
3345 
3346 	iscsi_task_associate_pdu(task, pdu);
3347 	lun_i = spdk_scsi_lun_id_fmt_to_int(lun);
3348 	task->lun_id = lun_i;
3349 	dev = conn->dev;
3350 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3351 
3352 	if ((R_bit != 0) && (W_bit != 0)) {
3353 		SPDK_ERRLOG("Bidirectional CDB is not supported\n");
3354 		iscsi_task_put(task);
3355 		return SPDK_ISCSI_CONNECTION_FATAL;
3356 	}
3357 
3358 	task->scsi.cdb = cdb;
3359 	task->tag = task_tag;
3360 	task->scsi.transfer_len = transfer_len;
3361 	task->scsi.target_port = conn->target_port;
3362 	task->scsi.initiator_port = conn->initiator_port;
3363 	task->parent = NULL;
3364 	task->rsp_scsi_status = SPDK_SCSI_STATUS_GOOD;
3365 
3366 	if (task->scsi.lun == NULL) {
3367 		spdk_scsi_task_process_null_lun(&task->scsi);
3368 		iscsi_task_cpl(&task->scsi);
3369 		return 0;
3370 	}
3371 
3372 	/* no bi-directional support */
3373 	if (R_bit) {
3374 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_FROM_DEV;
3375 	} else if (W_bit) {
3376 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_TO_DEV;
3377 
3378 		if ((conn->sess->ErrorRecoveryLevel >= 1) &&
3379 		    (iscsi_compare_pdu_bhs_within_existed_r2t_tasks(conn, pdu))) {
3380 			iscsi_task_response(conn, task);
3381 			iscsi_task_put(task);
3382 			return 0;
3383 		}
3384 
3385 		if (pdu->data_segment_len > iscsi_get_max_immediate_data_size()) {
3386 			SPDK_ERRLOG("data segment len(=%zu) > immediate data len(=%"PRIu32")\n",
3387 				    pdu->data_segment_len, iscsi_get_max_immediate_data_size());
3388 			iscsi_task_put(task);
3389 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3390 		}
3391 
3392 		if (pdu->data_segment_len > transfer_len) {
3393 			SPDK_ERRLOG("data segment len(=%zu) > task transfer len(=%d)\n",
3394 				    pdu->data_segment_len, transfer_len);
3395 			iscsi_task_put(task);
3396 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3397 		}
3398 
3399 		/* check the ImmediateData and also pdu->data_segment_len */
3400 		if ((!conn->sess->ImmediateData && (pdu->data_segment_len > 0)) ||
3401 		    (pdu->data_segment_len > conn->sess->FirstBurstLength)) {
3402 			iscsi_task_put(task);
3403 			return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3404 		}
3405 
3406 		if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(task->scsi.lun, &task->scsi, &pdu->dif_ctx))) {
3407 			pdu->dif_insert_or_strip = true;
3408 		}
3409 	} else {
3410 		/* neither R nor W bit set */
3411 		task->scsi.dxfer_dir = SPDK_SCSI_DIR_NONE;
3412 		if (transfer_len > 0) {
3413 			iscsi_task_put(task);
3414 			SPDK_ERRLOG("Reject scsi cmd with EDTL > 0 but (R | W) == 0\n");
3415 			return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3416 		}
3417 	}
3418 
3419 	pdu->task = task;
3420 	return 0;
3421 }
3422 
3423 static int
3424 iscsi_pdu_payload_op_scsi(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3425 {
3426 	struct spdk_iscsi_task *task;
3427 
3428 	if (pdu->task == NULL) {
3429 		return 0;
3430 	}
3431 
3432 	task = pdu->task;
3433 
3434 	if (spdk_scsi_dev_get_lun(conn->dev, task->lun_id) == NULL) {
3435 		spdk_scsi_task_process_null_lun(&task->scsi);
3436 		iscsi_task_cpl(&task->scsi);
3437 		return 0;
3438 	}
3439 
3440 	switch (task->scsi.dxfer_dir) {
3441 	case SPDK_SCSI_DIR_FROM_DEV:
3442 		return iscsi_pdu_payload_op_scsi_read(conn, task);
3443 	case SPDK_SCSI_DIR_TO_DEV:
3444 		return iscsi_pdu_payload_op_scsi_write(conn, task);
3445 	case SPDK_SCSI_DIR_NONE:
3446 		iscsi_queue_task(conn, task);
3447 		return 0;
3448 	default:
3449 		assert(false);
3450 		iscsi_task_put(task);
3451 		break;
3452 	}
3453 
3454 	return SPDK_ISCSI_CONNECTION_FATAL;
3455 }
3456 
3457 void
3458 iscsi_task_mgmt_response(struct spdk_iscsi_conn *conn,
3459 			 struct spdk_iscsi_task *task)
3460 {
3461 	struct spdk_iscsi_pdu *rsp_pdu;
3462 	struct iscsi_bhs_task_req *reqh;
3463 	struct iscsi_bhs_task_resp *rsph;
3464 
3465 	if (task->pdu == NULL) {
3466 		/*
3467 		 * This was an internally generated task management command,
3468 		 *  usually from LUN cleanup when a connection closes.
3469 		 */
3470 		return;
3471 	}
3472 
3473 	reqh = (struct iscsi_bhs_task_req *)&task->pdu->bhs;
3474 	/* response PDU */
3475 	rsp_pdu = iscsi_get_pdu(conn);
3476 	rsph = (struct iscsi_bhs_task_resp *)&rsp_pdu->bhs;
3477 	rsph->opcode = ISCSI_OP_TASK_RSP;
3478 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3479 	switch (task->scsi.response) {
3480 	case SPDK_SCSI_TASK_MGMT_RESP_COMPLETE:
3481 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3482 		break;
3483 	case SPDK_SCSI_TASK_MGMT_RESP_SUCCESS:
3484 		rsph->response = ISCSI_TASK_FUNC_RESP_COMPLETE;
3485 		break;
3486 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT:
3487 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3488 		break;
3489 	case SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN:
3490 		rsph->response = ISCSI_TASK_FUNC_RESP_LUN_NOT_EXIST;
3491 		break;
3492 	case SPDK_SCSI_TASK_MGMT_RESP_TARGET_FAILURE:
3493 		rsph->response = ISCSI_TASK_FUNC_REJECTED;
3494 		break;
3495 	case SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED:
3496 		rsph->response = ISCSI_TASK_FUNC_RESP_FUNC_NOT_SUPPORTED;
3497 		break;
3498 	}
3499 	rsph->itt = reqh->itt;
3500 
3501 	to_be32(&rsph->stat_sn, conn->StatSN);
3502 	conn->StatSN++;
3503 
3504 	if (reqh->immediate == 0) {
3505 		conn->sess->MaxCmdSN++;
3506 	}
3507 
3508 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3509 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3510 
3511 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3512 }
3513 
3514 static void
3515 iscsi_queue_mgmt_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *task)
3516 {
3517 	struct spdk_scsi_lun *lun;
3518 
3519 	lun = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
3520 	if (lun == NULL) {
3521 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3522 		iscsi_task_mgmt_response(conn, task);
3523 		iscsi_task_put(task);
3524 		return;
3525 	}
3526 
3527 	spdk_scsi_dev_queue_mgmt_task(conn->dev, &task->scsi);
3528 }
3529 
3530 static int
3531 _iscsi_op_abort_task(void *arg)
3532 {
3533 	struct spdk_iscsi_task *task = arg;
3534 	int rc;
3535 
3536 	rc = iscsi_conn_abort_queued_datain_task(task->conn, task->scsi.abort_id);
3537 	if (rc != 0) {
3538 		return SPDK_POLLER_BUSY;
3539 	}
3540 
3541 	spdk_poller_unregister(&task->mgmt_poller);
3542 	iscsi_queue_mgmt_task(task->conn, task);
3543 	return SPDK_POLLER_BUSY;
3544 }
3545 
3546 static void
3547 iscsi_op_abort_task(struct spdk_iscsi_task *task, uint32_t ref_task_tag)
3548 {
3549 	task->scsi.abort_id = ref_task_tag;
3550 	task->scsi.function = SPDK_SCSI_TASK_FUNC_ABORT_TASK;
3551 	task->mgmt_poller = SPDK_POLLER_REGISTER(_iscsi_op_abort_task, task, 10);
3552 }
3553 
3554 static int
3555 _iscsi_op_abort_task_set(void *arg)
3556 {
3557 	struct spdk_iscsi_task *task = arg;
3558 	int rc;
3559 
3560 	rc = iscsi_conn_abort_queued_datain_tasks(task->conn, task->scsi.lun,
3561 			task->pdu);
3562 	if (rc != 0) {
3563 		return SPDK_POLLER_BUSY;
3564 	}
3565 
3566 	spdk_poller_unregister(&task->mgmt_poller);
3567 	iscsi_queue_mgmt_task(task->conn, task);
3568 	return SPDK_POLLER_BUSY;
3569 }
3570 
3571 void
3572 iscsi_op_abort_task_set(struct spdk_iscsi_task *task, uint8_t function)
3573 {
3574 	task->scsi.function = function;
3575 	task->mgmt_poller = SPDK_POLLER_REGISTER(_iscsi_op_abort_task_set, task, 10);
3576 }
3577 
3578 static int
3579 iscsi_pdu_hdr_op_task(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3580 {
3581 	struct iscsi_bhs_task_req *reqh;
3582 	uint64_t lun;
3583 	uint32_t task_tag;
3584 	uint32_t ref_task_tag;
3585 	uint8_t function;
3586 	int lun_i;
3587 	struct spdk_iscsi_task *task;
3588 	struct spdk_scsi_dev *dev;
3589 
3590 	if (conn->sess->session_type != SESSION_TYPE_NORMAL) {
3591 		SPDK_ERRLOG("ISCSI_OP_TASK not allowed in discovery and invalid session\n");
3592 		return SPDK_ISCSI_CONNECTION_FATAL;
3593 	}
3594 
3595 	reqh = (struct iscsi_bhs_task_req *)&pdu->bhs;
3596 	function = reqh->flags & ISCSI_TASK_FUNCTION_MASK;
3597 	lun = from_be64(&reqh->lun);
3598 	task_tag = from_be32(&reqh->itt);
3599 	ref_task_tag = from_be32(&reqh->ref_task_tag);
3600 
3601 	SPDK_DEBUGLOG(iscsi, "I=%d, func=%d, ITT=%x, ref TT=%x, LUN=0x%16.16"PRIx64"\n",
3602 		      reqh->immediate, function, task_tag, ref_task_tag, lun);
3603 
3604 	SPDK_DEBUGLOG(iscsi, "StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3605 		      conn->StatSN, conn->sess->ExpCmdSN, conn->sess->MaxCmdSN);
3606 
3607 	lun_i = spdk_scsi_lun_id_fmt_to_int(lun);
3608 	dev = conn->dev;
3609 
3610 	task = iscsi_task_get(conn, NULL, iscsi_task_mgmt_cpl);
3611 	if (!task) {
3612 		SPDK_ERRLOG("Unable to acquire task\n");
3613 		return SPDK_ISCSI_CONNECTION_FATAL;
3614 	}
3615 
3616 	iscsi_task_associate_pdu(task, pdu);
3617 	task->scsi.target_port = conn->target_port;
3618 	task->scsi.initiator_port = conn->initiator_port;
3619 	task->tag = task_tag;
3620 	task->scsi.lun = spdk_scsi_dev_get_lun(dev, lun_i);
3621 	task->lun_id = lun_i;
3622 
3623 	if (task->scsi.lun == NULL) {
3624 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_INVALID_LUN;
3625 		iscsi_task_mgmt_response(conn, task);
3626 		iscsi_task_put(task);
3627 		return 0;
3628 	}
3629 
3630 	switch (function) {
3631 	/* abort task identified by Referenced Task Tag field */
3632 	case ISCSI_TASK_FUNC_ABORT_TASK:
3633 		SPDK_NOTICELOG("ABORT_TASK\n");
3634 
3635 		iscsi_del_transfer_task(conn, ref_task_tag);
3636 		iscsi_op_abort_task(task, ref_task_tag);
3637 		return 0;
3638 
3639 	/* abort all tasks issued via this session on the LUN */
3640 	case ISCSI_TASK_FUNC_ABORT_TASK_SET:
3641 		SPDK_NOTICELOG("ABORT_TASK_SET\n");
3642 
3643 		iscsi_clear_all_transfer_task(conn, task->scsi.lun, pdu);
3644 		iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_ABORT_TASK_SET);
3645 		return 0;
3646 
3647 	case ISCSI_TASK_FUNC_CLEAR_TASK_SET:
3648 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3649 		SPDK_NOTICELOG("CLEAR_TASK_SET (Unsupported)\n");
3650 		break;
3651 
3652 	case ISCSI_TASK_FUNC_CLEAR_ACA:
3653 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3654 		SPDK_NOTICELOG("CLEAR_ACA (Unsupported)\n");
3655 		break;
3656 
3657 	case ISCSI_TASK_FUNC_LOGICAL_UNIT_RESET:
3658 		SPDK_NOTICELOG("LOGICAL_UNIT_RESET\n");
3659 
3660 		iscsi_clear_all_transfer_task(conn, task->scsi.lun, pdu);
3661 		iscsi_op_abort_task_set(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
3662 		return 0;
3663 
3664 	case ISCSI_TASK_FUNC_TARGET_WARM_RESET:
3665 		SPDK_NOTICELOG("TARGET_WARM_RESET (Unsupported)\n");
3666 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3667 		break;
3668 
3669 	case ISCSI_TASK_FUNC_TARGET_COLD_RESET:
3670 		SPDK_NOTICELOG("TARGET_COLD_RESET (Unsupported)\n");
3671 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3672 		break;
3673 
3674 	case ISCSI_TASK_FUNC_TASK_REASSIGN:
3675 		SPDK_NOTICELOG("TASK_REASSIGN (Unsupported)\n");
3676 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT_FUNC_NOT_SUPPORTED;
3677 		break;
3678 
3679 	default:
3680 		SPDK_ERRLOG("unsupported function %d\n", function);
3681 		task->scsi.response = SPDK_SCSI_TASK_MGMT_RESP_REJECT;
3682 		break;
3683 	}
3684 
3685 	iscsi_task_mgmt_response(conn, task);
3686 	iscsi_task_put(task);
3687 	return 0;
3688 }
3689 
3690 static int
3691 iscsi_pdu_hdr_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3692 {
3693 	struct iscsi_bhs_nop_out *reqh;
3694 	uint32_t task_tag;
3695 	uint32_t transfer_tag;
3696 	int I_bit;
3697 
3698 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
3699 		SPDK_ERRLOG("ISCSI_OP_NOPOUT not allowed in discovery session\n");
3700 		return SPDK_ISCSI_CONNECTION_FATAL;
3701 	}
3702 
3703 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3704 	I_bit = reqh->immediate;
3705 
3706 	if (pdu->data_segment_len > SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
3707 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3708 	}
3709 
3710 	task_tag = from_be32(&reqh->itt);
3711 	transfer_tag = from_be32(&reqh->ttt);
3712 
3713 	SPDK_DEBUGLOG(iscsi, "I=%d, ITT=%x, TTT=%x\n",
3714 		      I_bit, task_tag, transfer_tag);
3715 
3716 	SPDK_DEBUGLOG(iscsi, "CmdSN=%u, StatSN=%u, ExpCmdSN=%u, MaxCmdSN=%u\n",
3717 		      pdu->cmd_sn, conn->StatSN, conn->sess->ExpCmdSN,
3718 		      conn->sess->MaxCmdSN);
3719 
3720 	if (transfer_tag != 0xFFFFFFFF && transfer_tag != (uint32_t)conn->id) {
3721 		SPDK_ERRLOG("invalid transfer tag 0x%x\n", transfer_tag);
3722 		/*
3723 		 * Technically we should probably fail the connection here, but for now
3724 		 *  just print the error message and continue.
3725 		 */
3726 	}
3727 
3728 	if (task_tag == 0xffffffffU && I_bit == 0) {
3729 		SPDK_ERRLOG("got NOPOUT ITT=0xffffffff, I=0\n");
3730 		return SPDK_ISCSI_CONNECTION_FATAL;
3731 	}
3732 
3733 	return 0;
3734 }
3735 
3736 static int
3737 iscsi_pdu_payload_op_nopout(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3738 {
3739 	struct spdk_iscsi_pdu *rsp_pdu;
3740 	struct iscsi_bhs_nop_out *reqh;
3741 	struct iscsi_bhs_nop_in *rsph;
3742 	uint8_t *data;
3743 	uint64_t lun;
3744 	uint32_t task_tag;
3745 	int I_bit;
3746 	int data_len;
3747 
3748 	reqh = (struct iscsi_bhs_nop_out *)&pdu->bhs;
3749 	I_bit = reqh->immediate;
3750 
3751 	data_len = pdu->data_segment_len;
3752 	if (data_len > conn->MaxRecvDataSegmentLength) {
3753 		data_len = conn->MaxRecvDataSegmentLength;
3754 	}
3755 
3756 	lun = from_be64(&reqh->lun);
3757 	task_tag = from_be32(&reqh->itt);
3758 
3759 	/*
3760 	 * We don't actually check to see if this is a response to the NOP-In
3761 	 * that we sent.  Our goal is to just verify that the initiator is
3762 	 * alive and responding to commands, not to verify that it tags
3763 	 * NOP-Outs correctly
3764 	 */
3765 	conn->nop_outstanding = false;
3766 
3767 	if (task_tag == 0xffffffffU) {
3768 		assert(I_bit == 1);
3769 		SPDK_DEBUGLOG(iscsi, "got NOPOUT ITT=0xffffffff\n");
3770 		return 0;
3771 	}
3772 
3773 	data = calloc(1, data_len);
3774 	if (!data) {
3775 		SPDK_ERRLOG("calloc() failed for ping data\n");
3776 		return SPDK_ISCSI_CONNECTION_FATAL;
3777 	}
3778 
3779 	/* response of NOPOUT */
3780 	if (data_len > 0) {
3781 		/* copy ping data */
3782 		memcpy(data, pdu->data, data_len);
3783 	}
3784 
3785 	/* response PDU */
3786 	rsp_pdu = iscsi_get_pdu(conn);
3787 	assert(rsp_pdu != NULL);
3788 
3789 	rsph = (struct iscsi_bhs_nop_in *)&rsp_pdu->bhs;
3790 	rsp_pdu->data = data;
3791 	rsph->opcode = ISCSI_OP_NOPIN;
3792 	rsph->flags |= 0x80; /* bit 0 default to 1 */
3793 	DSET24(rsph->data_segment_len, data_len);
3794 	to_be64(&rsph->lun, lun);
3795 	to_be32(&rsph->itt, task_tag);
3796 	to_be32(&rsph->ttt, 0xffffffffU);
3797 
3798 	to_be32(&rsph->stat_sn, conn->StatSN);
3799 	conn->StatSN++;
3800 
3801 	if (I_bit == 0) {
3802 		conn->sess->MaxCmdSN++;
3803 	}
3804 
3805 	to_be32(&rsph->exp_cmd_sn, conn->sess->ExpCmdSN);
3806 	to_be32(&rsph->max_cmd_sn, conn->sess->MaxCmdSN);
3807 
3808 	iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
3809 	conn->last_nopin = spdk_get_ticks();
3810 
3811 	return 0;
3812 }
3813 
3814 /* This function returns the spdk_scsi_task by searching the snack list via
3815  * task transfertag and the pdu's opcode
3816  */
3817 static struct spdk_iscsi_task *
3818 get_scsi_task_from_ttt(struct spdk_iscsi_conn *conn, uint32_t transfer_tag)
3819 {
3820 	struct spdk_iscsi_pdu *pdu;
3821 	struct iscsi_bhs_data_in *datain_bhs;
3822 
3823 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3824 		if (pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3825 			datain_bhs = (struct iscsi_bhs_data_in *)&pdu->bhs;
3826 			if (from_be32(&datain_bhs->ttt) == transfer_tag) {
3827 				return pdu->task;
3828 			}
3829 		}
3830 	}
3831 
3832 	return NULL;
3833 }
3834 
3835 /* This function returns the spdk_scsi_task by searching the snack list via
3836  * initiator task tag and the pdu's opcode
3837  */
3838 static struct spdk_iscsi_task *
3839 get_scsi_task_from_itt(struct spdk_iscsi_conn *conn,
3840 		       uint32_t task_tag, enum iscsi_op opcode)
3841 {
3842 	struct spdk_iscsi_pdu *pdu;
3843 
3844 	TAILQ_FOREACH(pdu, &conn->snack_pdu_list, tailq) {
3845 		if (pdu->bhs.opcode == opcode &&
3846 		    pdu->task != NULL &&
3847 		    pdu->task->tag == task_tag) {
3848 			return pdu->task;
3849 		}
3850 	}
3851 
3852 	return NULL;
3853 }
3854 
3855 /* This function is used to handle the r2t snack */
3856 static int
3857 iscsi_handle_r2t_snack(struct spdk_iscsi_conn *conn,
3858 		       struct spdk_iscsi_task *task,
3859 		       struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3860 		       uint32_t run_length, int32_t task_tag)
3861 {
3862 	int32_t last_r2tsn;
3863 	int i;
3864 
3865 	if (beg_run < task->acked_r2tsn) {
3866 		SPDK_ERRLOG("ITT: 0x%08x, R2T SNACK requests retransmission of"
3867 			    "R2TSN: from 0x%08x to 0x%08x. But it has already"
3868 			    "ack to R2TSN:0x%08x, protocol error.\n",
3869 			    task_tag, beg_run, (beg_run + run_length),
3870 			    (task->acked_r2tsn - 1));
3871 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3872 	}
3873 
3874 	if (run_length) {
3875 		if ((beg_run + run_length) > task->R2TSN) {
3876 			SPDK_ERRLOG("ITT: 0x%08x, received R2T SNACK with"
3877 				    "BegRun: 0x%08x, RunLength: 0x%08x, exceeds"
3878 				    "current R2TSN: 0x%08x, protocol error.\n",
3879 				    task_tag, beg_run, run_length,
3880 				    task->R2TSN);
3881 
3882 			return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3883 		}
3884 		last_r2tsn = (beg_run + run_length);
3885 	} else {
3886 		last_r2tsn = task->R2TSN;
3887 	}
3888 
3889 	for (i = beg_run; i < last_r2tsn; i++) {
3890 		if (iscsi_send_r2t_recovery(conn, task, i, false) < 0) {
3891 			SPDK_ERRLOG("The r2t_sn=%d of r2t_task=%p is not sent\n", i, task);
3892 		}
3893 	}
3894 	return 0;
3895 }
3896 
3897 /* This function is used to recover the data in packet */
3898 static int
3899 iscsi_handle_recovery_datain(struct spdk_iscsi_conn *conn,
3900 			     struct spdk_iscsi_task *task,
3901 			     struct spdk_iscsi_pdu *pdu, uint32_t beg_run,
3902 			     uint32_t run_length, uint32_t task_tag)
3903 {
3904 	struct spdk_iscsi_pdu *old_pdu, *pdu_temp;
3905 	uint32_t i;
3906 	struct iscsi_bhs_data_in *datain_header;
3907 	uint32_t last_statsn;
3908 
3909 	task = iscsi_task_get_primary(task);
3910 
3911 	SPDK_DEBUGLOG(iscsi, "iscsi_handle_recovery_datain\n");
3912 
3913 	if (beg_run < task->acked_data_sn) {
3914 		SPDK_ERRLOG("ITT: 0x%08x, DATA IN SNACK requests retransmission of"
3915 			    "DATASN: from 0x%08x to 0x%08x but already acked to "
3916 			    "DATASN: 0x%08x protocol error\n",
3917 			    task_tag, beg_run,
3918 			    (beg_run + run_length), (task->acked_data_sn - 1));
3919 
3920 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
3921 	}
3922 
3923 	if (run_length == 0) {
3924 		/* as the DataSN begins at 0 */
3925 		run_length = task->datain_datasn + 1;
3926 	}
3927 
3928 	if ((beg_run + run_length - 1) > task->datain_datasn) {
3929 		SPDK_ERRLOG("Initiator requests BegRun: 0x%08x, RunLength:"
3930 			    "0x%08x greater than maximum DataSN: 0x%08x.\n",
3931 			    beg_run, run_length, task->datain_datasn);
3932 
3933 		return -1;
3934 	} else {
3935 		last_statsn = beg_run + run_length - 1;
3936 	}
3937 
3938 	for (i = beg_run; i <= last_statsn; i++) {
3939 		TAILQ_FOREACH_SAFE(old_pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
3940 			if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
3941 				datain_header = (struct iscsi_bhs_data_in *)&old_pdu->bhs;
3942 				if (from_be32(&datain_header->itt) == task_tag &&
3943 				    from_be32(&datain_header->data_sn) == i) {
3944 					TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
3945 					iscsi_conn_write_pdu(conn, old_pdu, old_pdu->cb_fn, old_pdu->cb_arg);
3946 					break;
3947 				}
3948 			}
3949 		}
3950 	}
3951 	return 0;
3952 }
3953 
3954 /* This function is used to handle the status snack */
3955 static int
3956 iscsi_handle_status_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
3957 {
3958 	uint32_t beg_run;
3959 	uint32_t run_length;
3960 	struct iscsi_bhs_snack_req *reqh;
3961 	uint32_t i;
3962 	uint32_t last_statsn;
3963 	bool found_pdu;
3964 	struct spdk_iscsi_pdu *old_pdu;
3965 
3966 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
3967 	beg_run = from_be32(&reqh->beg_run);
3968 	run_length = from_be32(&reqh->run_len);
3969 
3970 	SPDK_DEBUGLOG(iscsi, "beg_run=%d, run_length=%d, conn->StatSN="
3971 		      "%d, conn->exp_statsn=%d\n", beg_run, run_length,
3972 		      conn->StatSN, conn->exp_statsn);
3973 
3974 	if (!beg_run) {
3975 		beg_run = conn->exp_statsn;
3976 	} else if (beg_run < conn->exp_statsn) {
3977 		SPDK_ERRLOG("Got Status SNACK Begrun: 0x%08x, RunLength: 0x%08x "
3978 			    "but already got ExpStatSN: 0x%08x on CID:%hu.\n",
3979 			    beg_run, run_length, conn->StatSN, conn->cid);
3980 
3981 		return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_PDU_FIELD);
3982 	}
3983 
3984 	last_statsn = (!run_length) ? conn->StatSN : (beg_run + run_length);
3985 
3986 	for (i = beg_run; i < last_statsn; i++) {
3987 		found_pdu = false;
3988 		TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
3989 			if (from_be32(&old_pdu->bhs.stat_sn) == i) {
3990 				found_pdu = true;
3991 				break;
3992 			}
3993 		}
3994 
3995 		if (!found_pdu) {
3996 			SPDK_ERRLOG("Unable to find StatSN: 0x%08x. For a Status"
3997 				    "SNACK, assuming this is a proactive SNACK "
3998 				    "for an untransmitted StatSN, ignoring.\n",
3999 				    beg_run);
4000 		} else {
4001 			TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
4002 			iscsi_conn_write_pdu(conn, old_pdu, old_pdu->cb_fn, old_pdu->cb_arg);
4003 		}
4004 	}
4005 
4006 	return 0;
4007 }
4008 
4009 /* This function is used to handle the data ack snack */
4010 static int
4011 iscsi_handle_data_ack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4012 {
4013 	uint32_t transfer_tag;
4014 	uint32_t beg_run;
4015 	uint32_t run_length;
4016 	struct spdk_iscsi_pdu *old_pdu;
4017 	uint32_t old_datasn;
4018 	struct iscsi_bhs_snack_req *reqh;
4019 	struct spdk_iscsi_task *task;
4020 	struct iscsi_bhs_data_in *datain_header;
4021 	struct spdk_iscsi_task *primary;
4022 
4023 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4024 	transfer_tag = from_be32(&reqh->ttt);
4025 	beg_run = from_be32(&reqh->beg_run);
4026 	run_length = from_be32(&reqh->run_len);
4027 	task = NULL;
4028 	datain_header = NULL;
4029 
4030 	SPDK_DEBUGLOG(iscsi, "beg_run=%d,transfer_tag=%d,run_len=%d\n",
4031 		      beg_run, transfer_tag, run_length);
4032 
4033 	task = get_scsi_task_from_ttt(conn, transfer_tag);
4034 	if (!task) {
4035 		SPDK_ERRLOG("Data ACK SNACK for TTT: 0x%08x is invalid.\n",
4036 			    transfer_tag);
4037 		goto reject_return;
4038 	}
4039 
4040 	primary = iscsi_task_get_primary(task);
4041 	if ((run_length != 0) || (beg_run < primary->acked_data_sn)) {
4042 		SPDK_ERRLOG("TTT: 0x%08x Data ACK SNACK BegRUN: %d is less than "
4043 			    "the next expected acked DataSN: %d\n",
4044 			    transfer_tag, beg_run, primary->acked_data_sn);
4045 		goto reject_return;
4046 	}
4047 
4048 	primary->acked_data_sn = beg_run;
4049 
4050 	/* To free the pdu */
4051 	TAILQ_FOREACH(old_pdu, &conn->snack_pdu_list, tailq) {
4052 		if (old_pdu->bhs.opcode == ISCSI_OP_SCSI_DATAIN) {
4053 			datain_header = (struct iscsi_bhs_data_in *) &old_pdu->bhs;
4054 			old_datasn = from_be32(&datain_header->data_sn);
4055 			if ((from_be32(&datain_header->ttt) == transfer_tag) &&
4056 			    (old_datasn == beg_run - 1)) {
4057 				TAILQ_REMOVE(&conn->snack_pdu_list, old_pdu, tailq);
4058 				iscsi_conn_free_pdu(conn, old_pdu);
4059 				break;
4060 			}
4061 		}
4062 	}
4063 
4064 	SPDK_DEBUGLOG(iscsi, "Received Data ACK SNACK for TTT: 0x%08x,"
4065 		      " updated acked DataSN to 0x%08x.\n", transfer_tag,
4066 		      (task->acked_data_sn - 1));
4067 
4068 	return 0;
4069 
4070 reject_return:
4071 	return iscsi_reject(conn, pdu, ISCSI_REASON_INVALID_SNACK);
4072 }
4073 
4074 /* This function is used to handle the snack request from the initiator */
4075 static int
4076 iscsi_pdu_hdr_op_snack(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4077 {
4078 	struct iscsi_bhs_snack_req *reqh;
4079 	struct spdk_iscsi_task *task;
4080 	int type;
4081 	uint32_t task_tag;
4082 	uint32_t beg_run;
4083 	uint32_t run_length;
4084 	int rc;
4085 
4086 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4087 		SPDK_ERRLOG("ISCSI_OP_SNACK not allowed in  discovery session\n");
4088 		return SPDK_ISCSI_CONNECTION_FATAL;
4089 	}
4090 
4091 	reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4092 	if (!conn->sess->ErrorRecoveryLevel) {
4093 		SPDK_ERRLOG("Got a SNACK request in ErrorRecoveryLevel=0\n");
4094 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4095 	}
4096 
4097 	type = reqh->flags & ISCSI_FLAG_SNACK_TYPE_MASK;
4098 	SPDK_DEBUGLOG(iscsi, "The value of type is %d\n", type);
4099 
4100 	switch (type) {
4101 	case 0:
4102 		reqh = (struct iscsi_bhs_snack_req *)&pdu->bhs;
4103 		task_tag = from_be32(&reqh->itt);
4104 		beg_run = from_be32(&reqh->beg_run);
4105 		run_length = from_be32(&reqh->run_len);
4106 
4107 		SPDK_DEBUGLOG(iscsi, "beg_run=%d, run_length=%d, "
4108 			      "task_tag=%x, transfer_tag=%u\n", beg_run,
4109 			      run_length, task_tag, from_be32(&reqh->ttt));
4110 
4111 		task = get_scsi_task_from_itt(conn, task_tag,
4112 					      ISCSI_OP_SCSI_DATAIN);
4113 		if (task) {
4114 			return iscsi_handle_recovery_datain(conn, task, pdu,
4115 							    beg_run, run_length, task_tag);
4116 		}
4117 		task = get_scsi_task_from_itt(conn, task_tag, ISCSI_OP_R2T);
4118 		if (task) {
4119 			return iscsi_handle_r2t_snack(conn, task, pdu, beg_run,
4120 						      run_length, task_tag);
4121 		}
4122 		SPDK_ERRLOG("It is Neither datain nor r2t recovery request\n");
4123 		rc = -1;
4124 		break;
4125 	case ISCSI_FLAG_SNACK_TYPE_STATUS:
4126 		rc = iscsi_handle_status_snack(conn, pdu);
4127 		break;
4128 	case ISCSI_FLAG_SNACK_TYPE_DATA_ACK:
4129 		rc = iscsi_handle_data_ack(conn, pdu);
4130 		break;
4131 	case ISCSI_FLAG_SNACK_TYPE_RDATA:
4132 		SPDK_ERRLOG("R-Data SNACK is Not Supported int spdk\n");
4133 		rc = iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4134 		break;
4135 	default:
4136 		SPDK_ERRLOG("Unknown SNACK type %d, protocol error\n", type);
4137 		rc = iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4138 		break;
4139 	}
4140 
4141 	return rc;
4142 }
4143 
4144 static int
4145 iscsi_pdu_hdr_op_data(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4146 {
4147 	struct spdk_iscsi_task	*task, *subtask;
4148 	struct iscsi_bhs_data_out *reqh;
4149 	struct spdk_scsi_lun	*lun_dev;
4150 	uint32_t transfer_tag;
4151 	uint32_t task_tag;
4152 	uint32_t transfer_len;
4153 	uint32_t DataSN;
4154 	uint32_t buffer_offset;
4155 	uint32_t len;
4156 	int F_bit;
4157 	int rc;
4158 	int reject_reason = ISCSI_REASON_INVALID_PDU_FIELD;
4159 
4160 	if (conn->sess->session_type == SESSION_TYPE_DISCOVERY) {
4161 		SPDK_ERRLOG("ISCSI_OP_SCSI_DATAOUT not allowed in discovery session\n");
4162 		return SPDK_ISCSI_CONNECTION_FATAL;
4163 	}
4164 
4165 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4166 	F_bit = !!(reqh->flags & ISCSI_FLAG_FINAL);
4167 	transfer_tag = from_be32(&reqh->ttt);
4168 	task_tag = from_be32(&reqh->itt);
4169 	DataSN = from_be32(&reqh->data_sn);
4170 	buffer_offset = from_be32(&reqh->buffer_offset);
4171 
4172 	if (pdu->data_segment_len > SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
4173 		reject_reason = ISCSI_REASON_PROTOCOL_ERROR;
4174 		goto reject_return;
4175 	}
4176 
4177 	task = get_transfer_task(conn, transfer_tag);
4178 	if (task == NULL) {
4179 		SPDK_ERRLOG("Not found task for transfer_tag=%x\n", transfer_tag);
4180 		goto reject_return;
4181 	}
4182 
4183 	lun_dev = spdk_scsi_dev_get_lun(conn->dev, task->lun_id);
4184 
4185 	if (pdu->data_segment_len > task->desired_data_transfer_length) {
4186 		SPDK_ERRLOG("the dataout pdu data length is larger than the value sent by R2T PDU\n");
4187 		return SPDK_ISCSI_CONNECTION_FATAL;
4188 	}
4189 
4190 	if (task->tag != task_tag) {
4191 		SPDK_ERRLOG("The r2t task tag is %u, and the dataout task tag is %u\n",
4192 			    task->tag, task_tag);
4193 		goto reject_return;
4194 	}
4195 
4196 	if (DataSN != task->r2t_datasn) {
4197 		SPDK_ERRLOG("DataSN(%u) exp=%d error\n", DataSN, task->r2t_datasn);
4198 		if (conn->sess->ErrorRecoveryLevel >= 1) {
4199 			goto send_r2t_recovery_return;
4200 		} else {
4201 			reject_reason = ISCSI_REASON_PROTOCOL_ERROR;
4202 			goto reject_return;
4203 		}
4204 	}
4205 
4206 	if (buffer_offset != task->next_expected_r2t_offset) {
4207 		SPDK_ERRLOG("offset(%u) error\n", buffer_offset);
4208 		return SPDK_ISCSI_CONNECTION_FATAL;
4209 	}
4210 
4211 	transfer_len = task->scsi.transfer_len;
4212 	task->current_r2t_length += pdu->data_segment_len;
4213 	task->next_expected_r2t_offset += pdu->data_segment_len;
4214 	task->r2t_datasn++;
4215 
4216 	if (task->current_r2t_length > conn->sess->MaxBurstLength) {
4217 		SPDK_ERRLOG("R2T burst(%u) > MaxBurstLength(%u)\n",
4218 			    task->current_r2t_length,
4219 			    conn->sess->MaxBurstLength);
4220 		return SPDK_ISCSI_CONNECTION_FATAL;
4221 	}
4222 
4223 	if (F_bit) {
4224 		/*
4225 		 * This R2T burst is done. Clear the length before we
4226 		 *  receive a PDU for the next R2t burst.
4227 		 */
4228 		task->current_r2t_length = 0;
4229 	}
4230 
4231 	subtask = iscsi_task_get(conn, task, iscsi_task_cpl);
4232 	if (subtask == NULL) {
4233 		SPDK_ERRLOG("Unable to acquire subtask\n");
4234 		return SPDK_ISCSI_CONNECTION_FATAL;
4235 	}
4236 	subtask->scsi.offset = buffer_offset;
4237 	subtask->scsi.length = pdu->data_segment_len;
4238 	iscsi_task_associate_pdu(subtask, pdu);
4239 
4240 	if (task->next_expected_r2t_offset == transfer_len) {
4241 		task->acked_r2tsn++;
4242 	} else if (F_bit && (task->next_r2t_offset < transfer_len)) {
4243 		task->acked_r2tsn++;
4244 		len = spdk_min(conn->sess->MaxBurstLength,
4245 			       (transfer_len - task->next_r2t_offset));
4246 		rc = iscsi_send_r2t(conn, task, task->next_r2t_offset, len,
4247 				    task->ttt, &task->R2TSN);
4248 		if (rc < 0) {
4249 			SPDK_ERRLOG("iscsi_send_r2t() failed\n");
4250 		}
4251 		task->next_r2t_offset += len;
4252 	}
4253 
4254 	if (lun_dev == NULL) {
4255 		SPDK_DEBUGLOG(iscsi, "LUN %d is removed, complete the task immediately\n",
4256 			      task->lun_id);
4257 		subtask->scsi.transfer_len = subtask->scsi.length;
4258 		spdk_scsi_task_process_null_lun(&subtask->scsi);
4259 		iscsi_task_cpl(&subtask->scsi);
4260 		return 0;
4261 	}
4262 
4263 	if (spdk_unlikely(spdk_scsi_lun_get_dif_ctx(lun_dev, &subtask->scsi, &pdu->dif_ctx))) {
4264 		pdu->dif_insert_or_strip = true;
4265 	}
4266 
4267 	pdu->task = subtask;
4268 	return 0;
4269 
4270 send_r2t_recovery_return:
4271 	rc = iscsi_send_r2t_recovery(conn, task, task->acked_r2tsn, true);
4272 	if (rc == 0) {
4273 		return 0;
4274 	}
4275 
4276 reject_return:
4277 	return iscsi_reject(conn, pdu, reject_reason);
4278 }
4279 
4280 static int
4281 iscsi_pdu_payload_op_data(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4282 {
4283 	struct spdk_iscsi_task *subtask;
4284 	struct iscsi_bhs_data_out *reqh;
4285 	uint32_t transfer_tag;
4286 
4287 	if (pdu->task == NULL) {
4288 		return 0;
4289 	}
4290 
4291 	subtask = pdu->task;
4292 
4293 	reqh = (struct iscsi_bhs_data_out *)&pdu->bhs;
4294 	transfer_tag = from_be32(&reqh->ttt);
4295 
4296 	if (get_transfer_task(conn, transfer_tag) == NULL) {
4297 		SPDK_ERRLOG("Not found for transfer_tag=%x\n", transfer_tag);
4298 		subtask->scsi.transfer_len = subtask->scsi.length;
4299 		spdk_scsi_task_process_abort(&subtask->scsi);
4300 		iscsi_task_cpl(&subtask->scsi);
4301 		return 0;
4302 	}
4303 
4304 	if (spdk_likely(!pdu->dif_insert_or_strip)) {
4305 		spdk_scsi_task_set_data(&subtask->scsi, pdu->data, pdu->data_segment_len);
4306 	} else {
4307 		spdk_scsi_task_set_data(&subtask->scsi, pdu->data, pdu->data_buf_len);
4308 	}
4309 
4310 	if (spdk_scsi_dev_get_lun(conn->dev, subtask->lun_id) == NULL) {
4311 		SPDK_DEBUGLOG(iscsi, "LUN %d is removed, complete the task immediately\n",
4312 			      subtask->lun_id);
4313 		subtask->scsi.transfer_len = subtask->scsi.length;
4314 		spdk_scsi_task_process_null_lun(&subtask->scsi);
4315 		iscsi_task_cpl(&subtask->scsi);
4316 		return 0;
4317 	}
4318 
4319 	iscsi_queue_task(conn, subtask);
4320 	return 0;
4321 }
4322 
4323 static void
4324 init_login_reject_response(struct spdk_iscsi_pdu *pdu, struct spdk_iscsi_pdu *rsp_pdu)
4325 {
4326 	struct iscsi_bhs_login_rsp *rsph;
4327 
4328 	memset(rsp_pdu, 0, sizeof(struct spdk_iscsi_pdu));
4329 	rsph = (struct iscsi_bhs_login_rsp *)&rsp_pdu->bhs;
4330 	rsph->version_max = ISCSI_VERSION;
4331 	rsph->version_act = ISCSI_VERSION;
4332 	rsph->opcode = ISCSI_OP_LOGIN_RSP;
4333 	rsph->status_class = ISCSI_CLASS_INITIATOR_ERROR;
4334 	rsph->status_detail = ISCSI_LOGIN_INVALID_LOGIN_REQUEST;
4335 	rsph->itt = pdu->bhs.itt;
4336 }
4337 
4338 static void
4339 iscsi_pdu_dump(struct spdk_iscsi_pdu *pdu)
4340 {
4341 	spdk_log_dump(stderr, "PDU", (uint8_t *)&pdu->bhs, ISCSI_BHS_LEN);
4342 }
4343 
4344 /* This function is used to refree the pdu when it is acknowledged */
4345 static void
4346 remove_acked_pdu(struct spdk_iscsi_conn *conn, uint32_t ExpStatSN)
4347 {
4348 	struct spdk_iscsi_pdu *pdu, *pdu_temp;
4349 	uint32_t stat_sn;
4350 
4351 	conn->exp_statsn = spdk_min(ExpStatSN, conn->StatSN);
4352 	TAILQ_FOREACH_SAFE(pdu, &conn->snack_pdu_list, tailq, pdu_temp) {
4353 		stat_sn = from_be32(&pdu->bhs.stat_sn);
4354 		if (spdk_sn32_lt(stat_sn, conn->exp_statsn)) {
4355 			TAILQ_REMOVE(&conn->snack_pdu_list, pdu, tailq);
4356 			iscsi_conn_free_pdu(conn, pdu);
4357 		}
4358 	}
4359 }
4360 
4361 static int
4362 iscsi_update_cmdsn(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4363 {
4364 	int opcode;
4365 	uint32_t ExpStatSN;
4366 	int I_bit;
4367 	struct spdk_iscsi_sess *sess;
4368 	struct iscsi_bhs_scsi_req *reqh;
4369 
4370 	sess = conn->sess;
4371 	if (!sess) {
4372 		SPDK_ERRLOG("Connection has no associated session!\n");
4373 		return SPDK_ISCSI_CONNECTION_FATAL;
4374 	}
4375 
4376 	opcode = pdu->bhs.opcode;
4377 	reqh = (struct iscsi_bhs_scsi_req *)&pdu->bhs;
4378 
4379 	pdu->cmd_sn = from_be32(&reqh->cmd_sn);
4380 
4381 	I_bit = reqh->immediate;
4382 	if (I_bit == 0) {
4383 		if (spdk_sn32_lt(pdu->cmd_sn, sess->ExpCmdSN) ||
4384 		    spdk_sn32_gt(pdu->cmd_sn, sess->MaxCmdSN)) {
4385 			if (sess->session_type == SESSION_TYPE_NORMAL &&
4386 			    opcode != ISCSI_OP_SCSI_DATAOUT) {
4387 				SPDK_ERRLOG("CmdSN(%u) ignore (ExpCmdSN=%u, MaxCmdSN=%u)\n",
4388 					    pdu->cmd_sn, sess->ExpCmdSN, sess->MaxCmdSN);
4389 
4390 				if (sess->ErrorRecoveryLevel >= 1) {
4391 					SPDK_DEBUGLOG(iscsi, "Skip the error in ERL 1 and 2\n");
4392 				} else {
4393 					return SPDK_PDU_FATAL;
4394 				}
4395 			}
4396 		}
4397 	} else if (pdu->cmd_sn != sess->ExpCmdSN) {
4398 		SPDK_ERRLOG("CmdSN(%u) error ExpCmdSN=%u\n", pdu->cmd_sn, sess->ExpCmdSN);
4399 
4400 		if (sess->ErrorRecoveryLevel >= 1) {
4401 			SPDK_DEBUGLOG(iscsi, "Skip the error in ERL 1 and 2\n");
4402 		} else if (opcode != ISCSI_OP_NOPOUT) {
4403 			/*
4404 			 * The Linux initiator does not send valid CmdSNs for
4405 			 *  nopout under heavy load, so do not close the
4406 			 *  connection in that case.
4407 			 */
4408 			return SPDK_ISCSI_CONNECTION_FATAL;
4409 		}
4410 	}
4411 
4412 	ExpStatSN = from_be32(&reqh->exp_stat_sn);
4413 	if (spdk_sn32_gt(ExpStatSN, conn->StatSN)) {
4414 		SPDK_DEBUGLOG(iscsi, "StatSN(%u) advanced\n", ExpStatSN);
4415 		ExpStatSN = conn->StatSN;
4416 	}
4417 
4418 	if (sess->ErrorRecoveryLevel >= 1) {
4419 		remove_acked_pdu(conn, ExpStatSN);
4420 	}
4421 
4422 	if (!I_bit && opcode != ISCSI_OP_SCSI_DATAOUT) {
4423 		sess->ExpCmdSN++;
4424 	}
4425 
4426 	return 0;
4427 }
4428 
4429 static int
4430 iscsi_pdu_hdr_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4431 {
4432 	int opcode;
4433 	int rc;
4434 	struct spdk_iscsi_pdu *rsp_pdu = NULL;
4435 
4436 	if (pdu == NULL) {
4437 		return -1;
4438 	}
4439 
4440 	opcode = pdu->bhs.opcode;
4441 
4442 	SPDK_DEBUGLOG(iscsi, "opcode %x\n", opcode);
4443 
4444 	if (opcode == ISCSI_OP_LOGIN) {
4445 		return iscsi_pdu_hdr_op_login(conn, pdu);
4446 	}
4447 
4448 	/* connection in login phase but receive non-login opcode
4449 	 * return response code 0x020b to initiator.
4450 	 * */
4451 	if (!conn->full_feature && conn->state == ISCSI_CONN_STATE_RUNNING) {
4452 		rsp_pdu = iscsi_get_pdu(conn);
4453 		if (rsp_pdu == NULL) {
4454 			return SPDK_ISCSI_CONNECTION_FATAL;
4455 		}
4456 		init_login_reject_response(pdu, rsp_pdu);
4457 		iscsi_conn_write_pdu(conn, rsp_pdu, iscsi_conn_pdu_generic_complete, NULL);
4458 		SPDK_ERRLOG("Received opcode %d in login phase\n", opcode);
4459 		return SPDK_ISCSI_LOGIN_ERROR_RESPONSE;
4460 	} else if (conn->state == ISCSI_CONN_STATE_INVALID) {
4461 		SPDK_ERRLOG("before Full Feature\n");
4462 		iscsi_pdu_dump(pdu);
4463 		return SPDK_ISCSI_CONNECTION_FATAL;
4464 	}
4465 
4466 	rc = iscsi_update_cmdsn(conn, pdu);
4467 	if (rc != 0) {
4468 		return rc;
4469 	}
4470 
4471 	switch (opcode) {
4472 	case ISCSI_OP_NOPOUT:
4473 		rc = iscsi_pdu_hdr_op_nopout(conn, pdu);
4474 		break;
4475 
4476 	case ISCSI_OP_SCSI:
4477 		rc = iscsi_pdu_hdr_op_scsi(conn, pdu);
4478 		break;
4479 	case ISCSI_OP_TASK:
4480 		rc = iscsi_pdu_hdr_op_task(conn, pdu);
4481 		break;
4482 
4483 	case ISCSI_OP_TEXT:
4484 		rc = iscsi_pdu_hdr_op_text(conn, pdu);
4485 		break;
4486 
4487 	case ISCSI_OP_LOGOUT:
4488 		rc = iscsi_pdu_hdr_op_logout(conn, pdu);
4489 		break;
4490 
4491 	case ISCSI_OP_SCSI_DATAOUT:
4492 		rc = iscsi_pdu_hdr_op_data(conn, pdu);
4493 		break;
4494 
4495 	case ISCSI_OP_SNACK:
4496 		rc = iscsi_pdu_hdr_op_snack(conn, pdu);
4497 		break;
4498 
4499 	default:
4500 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4501 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4502 	}
4503 
4504 	if (rc < 0) {
4505 		SPDK_ERRLOG("processing PDU header (opcode=%x) failed on %s(%s)\n",
4506 			    opcode,
4507 			    conn->target_port != NULL ? spdk_scsi_port_get_name(conn->target_port) : "NULL",
4508 			    conn->initiator_port != NULL ? spdk_scsi_port_get_name(conn->initiator_port) : "NULL");
4509 	}
4510 
4511 	return rc;
4512 }
4513 
4514 static int
4515 iscsi_pdu_payload_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
4516 {
4517 	int opcode;
4518 	int rc = 0;
4519 
4520 	opcode = pdu->bhs.opcode;
4521 
4522 	SPDK_DEBUGLOG(iscsi, "opcode %x\n", opcode);
4523 
4524 	switch (opcode) {
4525 	case ISCSI_OP_LOGIN:
4526 		rc = iscsi_pdu_payload_op_login(conn, pdu);
4527 		break;
4528 	case ISCSI_OP_NOPOUT:
4529 		rc = iscsi_pdu_payload_op_nopout(conn, pdu);
4530 		break;
4531 	case ISCSI_OP_SCSI:
4532 		rc = iscsi_pdu_payload_op_scsi(conn, pdu);
4533 		break;
4534 	case ISCSI_OP_TASK:
4535 		break;
4536 	case ISCSI_OP_TEXT:
4537 		rc = iscsi_pdu_payload_op_text(conn, pdu);
4538 		break;
4539 	case ISCSI_OP_LOGOUT:
4540 		break;
4541 	case ISCSI_OP_SCSI_DATAOUT:
4542 		rc = iscsi_pdu_payload_op_data(conn, pdu);
4543 		break;
4544 	case ISCSI_OP_SNACK:
4545 		break;
4546 	default:
4547 		SPDK_ERRLOG("unsupported opcode %x\n", opcode);
4548 		return iscsi_reject(conn, pdu, ISCSI_REASON_PROTOCOL_ERROR);
4549 	}
4550 
4551 	if (rc < 0) {
4552 		SPDK_ERRLOG("processing PDU payload (opcode=%x) failed on %s(%s)\n",
4553 			    opcode,
4554 			    conn->target_port != NULL ? spdk_scsi_port_get_name(conn->target_port) : "NULL",
4555 			    conn->initiator_port != NULL ? spdk_scsi_port_get_name(conn->initiator_port) : "NULL");
4556 	}
4557 
4558 	return rc;
4559 }
4560 
4561 static int
4562 iscsi_read_pdu(struct spdk_iscsi_conn *conn)
4563 {
4564 	enum iscsi_pdu_recv_state prev_state;
4565 	struct spdk_iscsi_pdu *pdu;
4566 	struct spdk_mempool *pool;
4567 	uint32_t crc32c;
4568 	int ahs_len;
4569 	uint32_t data_len;
4570 	int rc;
4571 
4572 	do {
4573 		prev_state = conn->pdu_recv_state;
4574 		pdu = conn->pdu_in_progress;
4575 
4576 		switch (conn->pdu_recv_state) {
4577 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY:
4578 			assert(conn->pdu_in_progress == NULL);
4579 
4580 			conn->pdu_in_progress = iscsi_get_pdu(conn);
4581 			if (conn->pdu_in_progress == NULL) {
4582 				return SPDK_ISCSI_CONNECTION_FATAL;
4583 			}
4584 			conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR;
4585 			break;
4586 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR:
4587 			if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
4588 				rc = iscsi_conn_read_data(conn,
4589 							  ISCSI_BHS_LEN - pdu->bhs_valid_bytes,
4590 							  (uint8_t *)&pdu->bhs + pdu->bhs_valid_bytes);
4591 				if (rc < 0) {
4592 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4593 					break;
4594 				}
4595 				pdu->bhs_valid_bytes += rc;
4596 				if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
4597 					return 0;
4598 				}
4599 			}
4600 
4601 			/* conn->is_logged_out must be checked after completing to process
4602 			 * logout request, i.e., before processing PDU header in this state
4603 			 * machine, otherwise logout response may not be sent to initiator
4604 			 * and initiator may get logout timeout.
4605 			 */
4606 			if (spdk_unlikely(conn->is_logged_out)) {
4607 				SPDK_DEBUGLOG(iscsi, "pdu received after logout\n");
4608 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4609 				break;
4610 			}
4611 
4612 			pdu->data_segment_len = ISCSI_ALIGN(DGET24(pdu->bhs.data_segment_len));
4613 
4614 			/* AHS */
4615 			ahs_len = pdu->bhs.total_ahs_len * 4;
4616 			if (ahs_len > ISCSI_AHS_LEN) {
4617 				SPDK_DEBUGLOG(iscsi, "pdu ahs length %d is invalid\n", ahs_len);
4618 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4619 				break;
4620 			}
4621 
4622 			if (pdu->ahs_valid_bytes < ahs_len) {
4623 				rc = iscsi_conn_read_data(conn,
4624 							  ahs_len - pdu->ahs_valid_bytes,
4625 							  pdu->ahs + pdu->ahs_valid_bytes);
4626 				if (rc < 0) {
4627 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4628 					break;
4629 				}
4630 
4631 				pdu->ahs_valid_bytes += rc;
4632 				if (pdu->ahs_valid_bytes < ahs_len) {
4633 					return 0;
4634 				}
4635 			}
4636 
4637 			/* Header Digest */
4638 			if (conn->header_digest &&
4639 			    pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
4640 				rc = iscsi_conn_read_data(conn,
4641 							  ISCSI_DIGEST_LEN - pdu->hdigest_valid_bytes,
4642 							  pdu->header_digest + pdu->hdigest_valid_bytes);
4643 				if (rc < 0) {
4644 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4645 					break;
4646 				}
4647 
4648 				pdu->hdigest_valid_bytes += rc;
4649 				if (pdu->hdigest_valid_bytes < ISCSI_DIGEST_LEN) {
4650 					return 0;
4651 				}
4652 			}
4653 
4654 			if (conn->header_digest) {
4655 				crc32c = iscsi_pdu_calc_header_digest(pdu);
4656 				rc = MATCH_DIGEST_WORD(pdu->header_digest, crc32c);
4657 				if (rc == 0) {
4658 					SPDK_ERRLOG("header digest error (%s)\n", conn->initiator_name);
4659 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4660 					break;
4661 				}
4662 			}
4663 
4664 			rc = iscsi_pdu_hdr_handle(conn, pdu);
4665 			if (rc < 0) {
4666 				SPDK_ERRLOG("Critical error is detected. Close the connection\n");
4667 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4668 				break;
4669 			}
4670 
4671 			conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD;
4672 			break;
4673 		case ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD:
4674 			data_len = pdu->data_segment_len;
4675 
4676 			if (data_len != 0 && pdu->data_buf == NULL) {
4677 				if (data_len <= iscsi_get_max_immediate_data_size()) {
4678 					pool = g_iscsi.pdu_immediate_data_pool;
4679 					pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(iscsi_get_max_immediate_data_size());
4680 				} else if (data_len <= SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH) {
4681 					pool = g_iscsi.pdu_data_out_pool;
4682 					pdu->data_buf_len = SPDK_BDEV_BUF_SIZE_WITH_MD(SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4683 				} else {
4684 					SPDK_ERRLOG("Data(%d) > MaxSegment(%d)\n",
4685 						    data_len, SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH);
4686 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4687 					break;
4688 				}
4689 				pdu->mobj = spdk_mempool_get(pool);
4690 				if (pdu->mobj == NULL) {
4691 					return 0;
4692 				}
4693 				pdu->data_buf = pdu->mobj->buf;
4694 				pdu->data = pdu->mobj->buf;
4695 				pdu->data_from_mempool = true;
4696 			}
4697 
4698 			/* copy the actual data into local buffer */
4699 			if (pdu->data_valid_bytes < data_len) {
4700 				rc = iscsi_conn_read_data_segment(conn, pdu, data_len);
4701 				if (rc < 0) {
4702 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4703 					break;
4704 				}
4705 
4706 				pdu->data_valid_bytes += rc;
4707 				if (pdu->data_valid_bytes < data_len) {
4708 					return 0;
4709 				}
4710 			}
4711 
4712 			/* copy out the data digest */
4713 			if (conn->data_digest && data_len != 0 &&
4714 			    pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
4715 				rc = iscsi_conn_read_data(conn,
4716 							  ISCSI_DIGEST_LEN - pdu->ddigest_valid_bytes,
4717 							  pdu->data_digest + pdu->ddigest_valid_bytes);
4718 				if (rc < 0) {
4719 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4720 					break;
4721 				}
4722 
4723 				pdu->ddigest_valid_bytes += rc;
4724 				if (pdu->ddigest_valid_bytes < ISCSI_DIGEST_LEN) {
4725 					return 0;
4726 				}
4727 			}
4728 
4729 			/* All data for this PDU has now been read from the socket. */
4730 			spdk_trace_record(TRACE_ISCSI_READ_PDU, conn->id, pdu->data_valid_bytes,
4731 					  (uintptr_t)pdu, pdu->bhs.opcode);
4732 
4733 			/* check data digest */
4734 			if (conn->data_digest && data_len != 0) {
4735 				crc32c = iscsi_pdu_calc_data_digest(pdu);
4736 				rc = MATCH_DIGEST_WORD(pdu->data_digest, crc32c);
4737 				if (rc == 0) {
4738 					SPDK_ERRLOG("data digest error (%s)\n", conn->initiator_name);
4739 					conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4740 					break;
4741 				}
4742 			}
4743 
4744 			if (!pdu->is_rejected) {
4745 				rc = iscsi_pdu_payload_handle(conn, pdu);
4746 			} else {
4747 				rc = 0;
4748 			}
4749 			if (rc == 0) {
4750 				spdk_trace_record(TRACE_ISCSI_TASK_EXECUTED, 0, 0, (uintptr_t)pdu, 0);
4751 				iscsi_put_pdu(pdu);
4752 				conn->pdu_in_progress = NULL;
4753 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY;
4754 				return 1;
4755 			} else {
4756 				conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
4757 			}
4758 			break;
4759 		case ISCSI_PDU_RECV_STATE_ERROR:
4760 			return SPDK_ISCSI_CONNECTION_FATAL;
4761 		default:
4762 			assert(false);
4763 			SPDK_ERRLOG("code should not come here\n");
4764 			break;
4765 		}
4766 	} while (prev_state != conn->pdu_recv_state);
4767 
4768 	return 0;
4769 }
4770 
4771 #define GET_PDU_LOOP_COUNT	16
4772 
4773 int
4774 iscsi_handle_incoming_pdus(struct spdk_iscsi_conn *conn)
4775 {
4776 	int i, rc;
4777 
4778 	/* Read new PDUs from network */
4779 	for (i = 0; i < GET_PDU_LOOP_COUNT; i++) {
4780 		rc = iscsi_read_pdu(conn);
4781 		if (rc == 0) {
4782 			break;
4783 		} else if (rc < 0) {
4784 			return rc;
4785 		}
4786 
4787 		if (conn->is_stopped) {
4788 			break;
4789 		}
4790 	}
4791 
4792 	return i;
4793 }
4794