Home | History | Annotate | Line # | Download | only in iscsi
iscsi_rcv.c revision 1.12
      1 /*	$NetBSD: iscsi_rcv.c,v 1.12 2016/06/01 05:13:07 mlelstv Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2004,2005,2006,2011 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Wasabi Systems, Inc.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 #include "iscsi_globals.h"
     32 
     33 #include <sys/file.h>
     34 #include <sys/socket.h>
     35 #include <sys/socketvar.h>
     36 
     37 /*****************************************************************************/
     38 
     39 /*
     40  * my_soo_read:
     41  *    Replacement for soo_read with flag handling.
     42  *
     43  *    Parameter:
     44  *          conn     The connection
     45  *          u        The uio descriptor
     46  *          flags    Read flags
     47  *
     48  *    Returns:    0 on success, else 1
     49  */
     50 
     51 STATIC int
     52 my_soo_read(connection_t *conn, struct uio *u, int flags)
     53 {
     54 	struct socket *so = conn->sock->f_socket;
     55 	int ret;
     56 #ifdef ISCSI_DEBUG
     57 	size_t resid = u->uio_resid;
     58 #endif
     59 
     60 	DEBC(conn, 99, ("soo_read req: %zu\n", resid));
     61 
     62 	KERNEL_LOCK(1, curlwp);
     63 	ret = soreceive(so, NULL, u, NULL, NULL, &flags);
     64 	KERNEL_UNLOCK_ONE(curlwp);
     65 
     66 	if (ret || (flags != MSG_DONTWAIT && u->uio_resid)) {
     67 		DEBC(conn, 1, ("Read failed (ret: %d, req: %zu, out: %zu)\n", ret, resid,
     68 				u->uio_resid));
     69 		handle_connection_error(conn, ISCSI_STATUS_SOCKET_ERROR,
     70 								RECOVER_CONNECTION);
     71 		return 1;
     72 	}
     73 	return 0;
     74 }
     75 
     76 
     77 /*
     78  * try_resynch_receive:
     79  *    Skip over everything in the socket's receive buffer, in the hope of
     80  *    ending up at the start of a new PDU.
     81  *
     82  *    Parameter:
     83  *          conn     The connection
     84  */
     85 
     86 STATIC void
     87 try_resynch_receive(connection_t *conn)
     88 {
     89 	uint8_t buffer[64];
     90 	struct uio uio;
     91 	struct iovec io_vec;
     92 	int rc;
     93 
     94 	uio.uio_rw = UIO_READ;
     95 	UIO_SETUP_SYSSPACE(&uio);
     96 
     97 	do {
     98 		io_vec.iov_base = buffer;
     99 		uio.uio_iov = &io_vec;
    100 		uio.uio_iovcnt = 1;
    101 		uio.uio_resid = io_vec.iov_len = sizeof(buffer);
    102 
    103 		rc = my_soo_read(conn, &uio, MSG_DONTWAIT);
    104 		DEBC(conn, 9, ("try_resynch_receive: rc = %d, resid = %zu\n",
    105 				rc, uio.uio_resid));
    106 	} while (!rc && !uio.uio_resid);
    107 }
    108 
    109 
    110 /*
    111  * ccb_from_itt
    112  *    Translate ITT into CCB pointer.
    113  *
    114  *    Parameter:
    115  *          conn     The connection
    116  *          itt      The Initiator Task Tag
    117  *
    118  *    Returns:
    119  *          Pointer to CCB, or NULL if ITT is not a valid CCB index.
    120  */
    121 
    122 STATIC ccb_t *
    123 ccb_from_itt(connection_t *conn, uint32_t itt)
    124 {
    125 	ccb_t *ccb;
    126 	int cidx;
    127 
    128 	cidx = itt & 0xff;
    129 	if (cidx >= CCBS_PER_SESSION) {
    130 		return NULL;
    131 	}
    132 	ccb = &conn->session->ccb[cidx];
    133 	if (ccb->ITT != itt || ccb->disp <= CCBDISP_BUSY) {
    134 		return NULL;
    135 	}
    136 	return ccb;
    137 }
    138 
    139 
    140 /*
    141  * read_pdu_data:
    142  *    Initialize the uio structure for receiving everything after the
    143  *    header, including data (if present), and padding. Read the data.
    144  *
    145  *    Parameter:
    146  *          pdu      The PDU
    147  *          data     Pointer to data (may be NULL for auto-allocation)
    148  *          offset   The offset into the data pointer
    149  *
    150  *    Returns:     0 on success
    151  *                 1 if an error occurs during read
    152  *                -1 if the data digest was incorrect (PDU must be ignored)
    153  */
    154 
    155 STATIC int
    156 read_pdu_data(pdu_t *pdu, uint8_t *data, uint32_t offset)
    157 {
    158 	static uint8_t pad_bytes[4];
    159 	uint32_t len, digest;
    160 	struct uio *uio;
    161 	int i, pad;
    162 	connection_t *conn = pdu->connection;
    163 
    164 	DEB(1, ("read_pdu_data: data segment length = %d\n",
    165 		ntoh3(pdu->pdu.DataSegmentLength)));
    166 	if (!(len = ntoh3(pdu->pdu.DataSegmentLength))) {
    167 		return 0;
    168 	}
    169 	pad = len & 0x03;
    170 	if (pad) {
    171 		pad = 4 - pad;
    172 	}
    173 
    174 	KASSERT(data != NULL || offset == 0);
    175 
    176 	if (data == NULL) {
    177 		/*
    178 		 * NOTE: Always allocate 2 extra bytes when reading temp data,
    179 		 * since temp data is mostly used for received text, and we can
    180 		 * make sure there's a double zero at the end of the data to mark EOF.
    181 		 */
    182 		if ((data = (uint8_t *) malloc(len + 2, M_TEMP, M_WAITOK)) == NULL) {
    183 			DEBOUT(("ran out of mem on receive\n"));
    184 			handle_connection_error(pdu->connection,
    185 				ISCSI_STATUS_NO_RESOURCES, LOGOUT_SESSION);
    186 			return 1;
    187 		}
    188 		pdu->temp_data = data;
    189 		pdu->temp_data_len = len;
    190 	}
    191 
    192 	pdu->io_vec[0].iov_base = data + offset;
    193 	pdu->io_vec[0].iov_len = len;
    194 
    195 	uio = &pdu->uio;
    196 
    197 	uio->uio_iov = pdu->io_vec;
    198 	uio->uio_iovcnt = 1;
    199 	uio->uio_rw = UIO_READ;
    200 	uio->uio_resid = len;
    201 	UIO_SETUP_SYSSPACE(uio);
    202 
    203 	if (pad) {
    204 		uio->uio_iovcnt++;
    205 		uio->uio_iov[1].iov_base = pad_bytes;
    206 		uio->uio_iov[1].iov_len = pad;
    207 		uio->uio_resid += pad;
    208 	}
    209 
    210 	if (conn->DataDigest) {
    211 		i = uio->uio_iovcnt++;
    212 		pdu->io_vec[i].iov_base = &pdu->data_digest;
    213 		pdu->io_vec[i].iov_len = 4;
    214 		uio->uio_resid += 4;
    215 	}
    216 
    217 	/* get the data */
    218 	if (my_soo_read(conn, &pdu->uio, MSG_WAITALL) != 0) {
    219 		return 1;
    220 	}
    221 	if (conn->DataDigest) {
    222 		digest = gen_digest_2(data, len, pad_bytes, pad);
    223 
    224 		if (digest != pdu->data_digest) {
    225 			DEBOUT(("Data Digest Error: comp = %08x, rx = %08x\n",
    226 					digest, pdu->data_digest));
    227 			switch (pdu->pdu.Opcode & OPCODE_MASK) {
    228 			case TOP_SCSI_Response:
    229 			case TOP_Text_Response:
    230 				send_snack(pdu->connection, pdu, NULL, SNACK_STATUS_NAK);
    231 				break;
    232 
    233 			case TOP_SCSI_Data_in:
    234 				send_snack(pdu->connection, pdu, NULL, SNACK_DATA_NAK);
    235 				break;
    236 
    237 			default:
    238 				/* ignore all others */
    239 				break;
    240 			}
    241 			return -1;
    242 		}
    243 	}
    244 	return 0;
    245 }
    246 
    247 
    248 /*
    249  * collect_text_data
    250  *    Handle text continuation in login and text response PDUs
    251  *
    252  *    Parameter:
    253  *          pdu      The received PDU
    254  *          req_CCB  The CCB associated with the original request
    255  *
    256  *    Returns:    -1    if continue flag is set
    257  *                0     if text is complete
    258  *                +1    if an error occurred (out of resources)
    259  */
    260 STATIC int
    261 collect_text_data(pdu_t *pdu, ccb_t *req_ccb)
    262 {
    263 
    264 	if (req_ccb->text_data) {
    265 		int nlen;
    266 		uint8_t *newp;
    267 
    268 		nlen = req_ccb->text_len + pdu->temp_data_len;
    269 		/* Note: allocate extra 2 bytes for text terminator */
    270 		if ((newp = malloc(nlen + 2, M_TEMP, M_WAITOK)) == NULL) {
    271 			DEBOUT(("Collect Text Data: Out of Memory, ccb = %p\n", req_ccb));
    272 			req_ccb->status = ISCSI_STATUS_NO_RESOURCES;
    273 			/* XXX where is CCB freed? */
    274 			return 1;
    275 		}
    276 		memcpy(newp, req_ccb->text_data, req_ccb->text_len);
    277 		memcpy(&newp[req_ccb->text_len], pdu->temp_data, pdu->temp_data_len);
    278 
    279 		free(req_ccb->text_data, M_TEMP);
    280 		free(pdu->temp_data, M_TEMP);
    281 
    282 		req_ccb->text_data = NULL;
    283 		pdu->temp_data = newp;
    284 		pdu->temp_data_len = nlen;
    285 	}
    286 
    287 	if (pdu->pdu.Flags & FLAG_CONTINUE) {
    288 		req_ccb->text_data = pdu->temp_data;
    289 		req_ccb->text_len = pdu->temp_data_len;
    290 		pdu->temp_data = NULL;
    291 
    292 		acknowledge_text(req_ccb->connection, pdu, req_ccb);
    293 		return -1;
    294 	}
    295 	return 0;
    296 }
    297 
    298 
    299 /*
    300  * check_StatSN
    301  *    Check received vs. expected StatSN
    302  *
    303  *    Parameter:
    304  *          conn     The connection
    305  *          nw_sn    The received StatSN in network byte order
    306  *          ack      Acknowledge this SN if TRUE
    307  */
    308 
    309 STATIC int
    310 check_StatSN(connection_t *conn, uint32_t nw_sn, bool ack)
    311 {
    312 	int rc;
    313 	uint32_t sn = ntohl(nw_sn);
    314 
    315 	rc = add_sernum(&conn->StatSN_buf, sn);
    316 
    317 	if (ack)
    318 		ack_sernum(&conn->StatSN_buf, sn);
    319 
    320 	if (rc != 1) {
    321 		if (rc == 0) {
    322 			DEBOUT(("Duplicate PDU, ExpSN %d, Recvd: %d\n",
    323 				conn->StatSN_buf.ExpSN, sn));
    324 			return -1;
    325 		}
    326 
    327 		if (rc < 0) {
    328 			DEBOUT(("Excessive outstanding Status PDUs, ExpSN %d, Recvd: %d\n",
    329 					conn->StatSN_buf.ExpSN, sn));
    330 			handle_connection_error(conn, ISCSI_STATUS_PDUS_LOST,
    331 									RECOVER_CONNECTION);
    332 			return rc;
    333 		}
    334 
    335 		DEBOUT(("Missing Status PDUs: First %d, num: %d\n",
    336 				conn->StatSN_buf.ExpSN, rc - 1));
    337 		if (conn->state == ST_FULL_FEATURE &&
    338 			conn->session->ErrorRecoveryLevel) {
    339 			snack_missing(conn, NULL, SNACK_STATUS_NAK,
    340 						  conn->StatSN_buf.ExpSN, rc - 1);
    341 		} else {
    342 			DEBOUT(("StatSN killing connection (State = %d, "
    343 					"ErrorRecoveryLevel = %d)\n",
    344 					conn->state, conn->session->ErrorRecoveryLevel));
    345 			handle_connection_error(conn, ISCSI_STATUS_PDUS_LOST,
    346 									RECOVER_CONNECTION);
    347 			return -1;
    348 		}
    349 	}
    350 	return 0;
    351 }
    352 
    353 
    354 /*
    355  * check_CmdSN
    356  *    Check received vs. expected CmdSN
    357  *
    358  *    Parameter:
    359  *          conn     The connection
    360  *          nw_sn    The received ExpCmdSN in network byte order
    361  */
    362 
    363 STATIC void
    364 check_CmdSN(connection_t *conn, uint32_t nw_sn)
    365 {
    366 	uint32_t sn = ntohl(nw_sn);
    367 	ccb_t *ccb, *nxt;
    368 
    369 	TAILQ_FOREACH_SAFE(ccb, &conn->ccbs_waiting, chain, nxt) {
    370 		DEBC(conn, 10,
    371 			("CheckCmdSN - CmdSN=%d, ExpCmdSn=%d, waiting=%p, flags=%x\n",
    372 			ccb->CmdSN, sn, ccb->pdu_waiting, ccb->flags));
    373 		if (ccb->pdu_waiting != NULL && ccb->CmdSN > sn &&
    374 			!(ccb->flags & CCBF_GOT_RSP)) {
    375 			DEBC(conn, 1, ("CheckCmdSN resending - CmdSN=%d, ExpCmdSn=%d\n",
    376 						   ccb->CmdSN, sn));
    377 
    378 			ccb->total_tries++;
    379 
    380 			if (++ccb->num_timeouts > MAX_CCB_TIMEOUTS ||
    381 				ccb->total_tries > MAX_CCB_TRIES) {
    382 				handle_connection_error(conn, ISCSI_STATUS_TIMEOUT,
    383 					(ccb->total_tries <= MAX_CCB_TRIES) ? RECOVER_CONNECTION
    384 														: LOGOUT_CONNECTION);
    385 				break;
    386 			} else {
    387 				resend_pdu(ccb);
    388 			}
    389 		}
    390 	}
    391 }
    392 
    393 
    394 /*
    395  * receive_login_pdu
    396  *    Handle receipt of a login response PDU.
    397  *
    398  *    Parameter:
    399  *          conn     The connection
    400  *          pdu      The PDU
    401  *          req_CCB  The CCB associated with the original request (if any)
    402  */
    403 
    404 STATIC int
    405 receive_login_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    406 {
    407 	int rc;
    408 
    409 	DEBC(conn, 9, ("Received Login Response PDU, op=%x, flags=%x, sn=%u\n",
    410 			pdu->pdu.Opcode, pdu->pdu.Flags,
    411 			ntohl(pdu->pdu.p.login_rsp.StatSN)));
    412 
    413 	if (req_ccb == NULL) {
    414 		/* Duplicate?? */
    415 		DEBOUT(("Received duplicate login response (no associated CCB)\n"));
    416 		return -1;
    417 	}
    418 
    419 	if (pdu->pdu.p.login_rsp.StatusClass) {
    420 		DEBC(conn, 1, ("Login problem - Class = %x, Detail = %x\n",
    421 				pdu->pdu.p.login_rsp.StatusClass,
    422 				pdu->pdu.p.login_rsp.StatusDetail));
    423 		wake_ccb(req_ccb, ISCSI_STATUS_LOGIN_FAILED);
    424 		return 0;
    425 	}
    426 
    427 	if (!conn->StatSN_buf.next_sn) {
    428 		conn->StatSN_buf.next_sn = conn->StatSN_buf.ExpSN =
    429 			ntohl(pdu->pdu.p.login_rsp.StatSN) + 1;
    430 	} else if (check_StatSN(conn, pdu->pdu.p.login_rsp.StatSN, TRUE))
    431 		return -1;
    432 
    433 	if (pdu->temp_data_len) {
    434 		if ((rc = collect_text_data(pdu, req_ccb)) != 0)
    435 			return max(rc, 0);
    436 	}
    437 
    438 	negotiate_login(conn, pdu, req_ccb);
    439 
    440 	/* negotiate_login will decide whether login is complete or not */
    441 	return 0;
    442 }
    443 
    444 
    445 /*
    446  * receive_text_response_pdu
    447  *    Handle receipt of a text response PDU.
    448  *
    449  *    Parameter:
    450  *          conn     The connection
    451  *          pdu      The PDU
    452  *          req_CCB  The CCB associated with the original request (if any)
    453  */
    454 
    455 STATIC int
    456 receive_text_response_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    457 {
    458 	int rc;
    459 
    460 	DEBC(conn, 9, ("Received Text Response PDU, op=%x, flags=%x\n",
    461 			pdu->pdu.Opcode, pdu->pdu.Flags));
    462 
    463 	if (check_StatSN(conn, pdu->pdu.p.text_rsp.StatSN, TRUE)) {
    464 		return -1;
    465 	}
    466 	if (req_ccb == NULL) {
    467 		DEBOUT(("Received unsolicited text response\n"));
    468 		handle_connection_error(conn, ISCSI_STATUS_TARGET_ERROR,
    469 							LOGOUT_CONNECTION);
    470 		return -1;
    471 	}
    472 
    473 	if (req_ccb->pdu_waiting != NULL) {
    474 		ccb_timeout_start(req_ccb, COMMAND_TIMEOUT);
    475 		req_ccb->num_timeouts = 0;
    476 	}
    477 
    478 	if ((rc = collect_text_data(pdu, req_ccb)) != 0) {
    479 		return max(0, rc);
    480 	}
    481 	negotiate_text(conn, pdu, req_ccb);
    482 
    483 	return 0;
    484 }
    485 
    486 
    487 /*
    488  * receive_logout_pdu
    489  *    Handle receipt of a logout response PDU.
    490  *
    491  *    Parameter:
    492  *          conn     The connection
    493  *          pdu      The PDU
    494  *          req_CCB  The CCB associated with the original request (if any)
    495  */
    496 
    497 STATIC int
    498 receive_logout_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    499 {
    500 	bool otherconn;
    501 	uint8_t response;
    502 	uint32_t status;
    503 
    504 	otherconn = (req_ccb != NULL) ? (req_ccb->flags & CCBF_OTHERCONN) != 0 : 1;
    505 	response = pdu->pdu.OpcodeSpecific [0];
    506 	DEBC(conn, 1,
    507 		("Received Logout PDU - CCB = %p, otherconn=%d, response=%d\n",
    508 		req_ccb, otherconn, response));
    509 
    510 	if (req_ccb == NULL)
    511 		return 0;
    512 
    513 	if (otherconn && check_StatSN(conn, pdu->pdu.p.logout_rsp.StatSN, TRUE))
    514 		return -1;
    515 
    516 	switch (response) {
    517 	case 0:
    518 		status = ISCSI_STATUS_SUCCESS;
    519 		break;
    520 	case 1:
    521 		status = ISCSI_STATUS_LOGOUT_CID_NOT_FOUND;
    522 		break;
    523 	case 2:
    524 		status = ISCSI_STATUS_LOGOUT_RECOVERY_NS;
    525 		break;
    526 	default:
    527 		status = ISCSI_STATUS_LOGOUT_ERROR;
    528 		break;
    529 	}
    530 
    531 	if (conn->session->ErrorRecoveryLevel >= 2 && response != 1) {
    532 		connection_t *refconn = (otherconn) ? req_ccb->par : conn;
    533 
    534 		refconn->Time2Wait = ntohs(pdu->pdu.p.logout_rsp.Time2Wait);
    535 		refconn->Time2Retain = ntohs(pdu->pdu.p.logout_rsp.Time2Retain);
    536 	}
    537 
    538 	wake_ccb(req_ccb, status);
    539 
    540 	if (!otherconn && conn->state == ST_LOGOUT_SENT) {
    541 		conn->terminating = ISCSI_STATUS_LOGOUT;
    542 		conn->state = ST_SETTLING;
    543 		conn->loggedout = (response) ? LOGOUT_FAILED : LOGOUT_SUCCESS;
    544 
    545 		connection_timeout_stop(conn);
    546 
    547 		/* let send thread take over next step of cleanup */
    548 		cv_broadcast(&conn->conn_cv);
    549 	}
    550 
    551 	return !otherconn;
    552 }
    553 
    554 
    555 /*
    556  * receive_data_in_pdu
    557  *    Handle receipt of a data in PDU.
    558  *
    559  *    Parameter:
    560  *          conn     The connection
    561  *          pdu      The PDU
    562  *          req_CCB  The CCB associated with the original request (if any)
    563  */
    564 
    565 STATIC int
    566 receive_data_in_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    567 {
    568 	uint32_t dsl, sn;
    569 	bool done;
    570 	int rc;
    571 
    572 	dsl = ntoh3(pdu->pdu.DataSegmentLength);
    573 
    574 	if (req_ccb == NULL || !req_ccb->data_in || !req_ccb->data_len) {
    575 		DEBOUT(("Received Data In, but req_ccb not waiting for it, ignored\n"));
    576 		return 0;
    577 	}
    578 	req_ccb->flags |= CCBF_GOT_RSP;
    579 
    580 	if (req_ccb->pdu_waiting != NULL) {
    581 		ccb_timeout_start(req_ccb, COMMAND_TIMEOUT);
    582 		req_ccb->num_timeouts = 0;
    583 	}
    584 
    585 	sn = ntohl(pdu->pdu.p.data_in.DataSN);
    586 
    587 	if ((rc = add_sernum(&req_ccb->DataSN_buf, sn)) != 1) {
    588 		if (!rc) {
    589 			return -1;
    590 		}
    591 		if (rc < 0) {
    592 			DEBOUT(("Excessive outstanding Data PDUs\n"));
    593 			handle_connection_error(req_ccb->connection,
    594 				ISCSI_STATUS_PDUS_LOST, LOGOUT_CONNECTION);
    595 			return -1;
    596 		}
    597 		DEBOUT(("Missing Data PDUs: First %d, num: %d\n",
    598 				req_ccb->DataSN_buf.ExpSN, rc - 1));
    599 
    600 		if (conn->state == ST_FULL_FEATURE &&
    601 			conn->session->ErrorRecoveryLevel) {
    602 			snack_missing(req_ccb->connection, req_ccb,
    603 				SNACK_DATA_NAK, req_ccb->DataSN_buf.ExpSN,
    604 				rc - 1);
    605 		} else {
    606 			DEBOUT(("Killing connection (State=%d, ErrorRecoveryLevel=%d)\n",
    607 					conn->state, conn->session->ErrorRecoveryLevel));
    608 			handle_connection_error(conn, ISCSI_STATUS_PDUS_LOST,
    609 						LOGOUT_CONNECTION);
    610 			return -1;
    611 		}
    612 	}
    613 
    614 	ack_sernum(&req_ccb->DataSN_buf, sn);
    615 
    616 	req_ccb->xfer_len += dsl;
    617 
    618 	if ((pdu->pdu.Flags & FLAG_ACK) && conn->session->ErrorRecoveryLevel)
    619 		send_snack(conn, pdu, req_ccb, SNACK_DATA_ACK);
    620 
    621 	done = sn_empty(&req_ccb->DataSN_buf);
    622 
    623 	if (pdu->pdu.Flags & FLAG_STATUS) {
    624 		DEBC(conn, 10, ("Rx Data In Complete, done = %d\n", done));
    625 
    626 		req_ccb->flags |= CCBF_COMPLETE;
    627 		/* successful transfer, reset recover count */
    628 		conn->recover = 0;
    629 
    630 		if (done)
    631 			wake_ccb(req_ccb, ISCSI_STATUS_SUCCESS);
    632 		if (check_StatSN(conn, pdu->pdu.p.data_in.StatSN, done))
    633 			return -1;
    634 
    635 	} else if (done && (req_ccb->flags & CCBF_COMPLETE)) {
    636 		wake_ccb(req_ccb, ISCSI_STATUS_SUCCESS);
    637 	}
    638 	/* else wait for command response */
    639 
    640 	return 0;
    641 }
    642 
    643 
    644 /*
    645  * receive_r2t_pdu
    646  *    Handle receipt of a R2T PDU.
    647  *
    648  *    Parameter:
    649  *          conn     The connection
    650  *          pdu      The PDU
    651  *          req_CCB  The CCB associated with the original request (if any)
    652  */
    653 
    654 STATIC int
    655 receive_r2t_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    656 {
    657 
    658 	DEBC(conn, 10, ("Received R2T PDU - CCB = %p\n", req_ccb));
    659 
    660 	if (req_ccb != NULL) {
    661 		if (req_ccb->pdu_waiting != NULL) {
    662 			ccb_timeout_start(req_ccb, COMMAND_TIMEOUT);
    663 			req_ccb->num_timeouts = 0;
    664 		}
    665 		send_data_out(conn, pdu, req_ccb, CCBDISP_NOWAIT, TRUE);
    666 	}
    667 
    668 	return 0;
    669 }
    670 
    671 
    672 /*
    673  * receive_command_response_pdu
    674  *    Handle receipt of a command response PDU.
    675  *
    676  *    Parameter:
    677  *          conn     The connection
    678  *          pdu      The PDU
    679  *          req_CCB  The CCB associated with the original request (if any)
    680  */
    681 
    682 STATIC int
    683 receive_command_response_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    684 {
    685 	int len, rc;
    686 	bool done;
    687 	uint32_t status;
    688 
    689 	/* Read any provided data */
    690 	if (pdu->temp_data_len && req_ccb != NULL && req_ccb->sense_len_req) {
    691 		len = min(req_ccb->sense_len_req,
    692 				  ntohs(*((uint16_t *) pdu->temp_data)));
    693 		memcpy(req_ccb->sense_ptr, ((uint16_t *) pdu->temp_data) + 1,
    694 					len);
    695 		req_ccb->sense_len_got = len;
    696 	}
    697 
    698 	if (req_ccb == NULL) {
    699 		/* Assume duplicate... */
    700 		DEBOUT(("Possibly duplicate command response (no associated CCB)\n"));
    701 		return -1;
    702 	}
    703 
    704 	if (req_ccb->pdu_waiting != NULL) {
    705 		ccb_timeout_start(req_ccb, COMMAND_TIMEOUT);
    706 		req_ccb->num_timeouts = 0;
    707 	}
    708 
    709 	req_ccb->flags |= CCBF_COMPLETE;
    710 	conn->recover = 0;	/* successful transfer, reset recover count */
    711 
    712 	if (pdu->pdu.OpcodeSpecific[0]) {	/* Response */
    713 		status = ISCSI_STATUS_TARGET_FAILURE;
    714 	} else {
    715 		switch (pdu->pdu.OpcodeSpecific[1]) {	/* Status */
    716 		case 0x00:
    717 			status = ISCSI_STATUS_SUCCESS;
    718 			break;
    719 
    720 		case 0x02:
    721 			status = ISCSI_STATUS_CHECK_CONDITION;
    722 			break;
    723 
    724 		case 0x08:
    725 			status = ISCSI_STATUS_TARGET_BUSY;
    726 			break;
    727 
    728 		default:
    729 			status = ISCSI_STATUS_TARGET_ERROR;
    730 			break;
    731 		}
    732 	}
    733 
    734 	if (pdu->pdu.Flags & (FLAG_OVERFLOW | FLAG_UNDERFLOW))
    735 		req_ccb->residual = ntohl(pdu->pdu.p.response.ResidualCount);
    736 
    737 	done = status || sn_empty(&req_ccb->DataSN_buf);
    738 
    739 	DEBC(conn, 10, ("Rx Command Response rsp = %x, status = %x\n",
    740 			pdu->pdu.OpcodeSpecific[0], pdu->pdu.OpcodeSpecific[1]));
    741 
    742 	rc = check_StatSN(conn, pdu->pdu.p.response.StatSN, done);
    743 
    744 	if (done)
    745 		wake_ccb(req_ccb, status);
    746 
    747 	return rc;
    748 }
    749 
    750 
    751 /*
    752  * receive_asynch_pdu
    753  *    Handle receipt of an asynchronous message PDU.
    754  *
    755  *    Parameter:
    756  *          conn     The connection
    757  *          pdu      The PDU
    758  */
    759 
    760 STATIC int
    761 receive_asynch_pdu(connection_t *conn, pdu_t *pdu)
    762 {
    763 
    764 	DEBOUT(("Received Asynch PDU, Event %d\n", pdu->pdu.p.asynch.AsyncEvent));
    765 
    766 	switch (pdu->pdu.p.asynch.AsyncEvent) {
    767 	case 0:		   		/* SCSI Asynch event. Don't know what to do with it... */
    768 		break;
    769 
    770 	case 1:		   		/* Target requests logout. */
    771 		if (conn->session->active_connections > 1) {
    772 			kill_connection(conn, ISCSI_STATUS_TARGET_LOGOUT,
    773 						LOGOUT_CONNECTION, FALSE);
    774 		} else {
    775 			kill_session(conn->session, ISCSI_STATUS_TARGET_LOGOUT,
    776 						 LOGOUT_SESSION, FALSE);
    777 		}
    778 		break;
    779 
    780 	case 2:				/* Target is dropping connection */
    781 		conn = find_connection(conn->session,
    782 					ntohs(pdu->pdu.p.asynch.Parameter1));
    783 		if (conn != NULL) {
    784 			conn->Time2Wait = ntohs(pdu->pdu.p.asynch.Parameter2);
    785 			conn->Time2Retain = ntohs(pdu->pdu.p.asynch.Parameter3);
    786 			kill_connection(conn, ISCSI_STATUS_TARGET_DROP,
    787 					NO_LOGOUT, TRUE);
    788 		}
    789 		break;
    790 
    791 	case 3:				/* Target is dropping all connections of session */
    792 		conn->session->DefaultTime2Wait = ntohs(pdu->pdu.p.asynch.Parameter2);
    793 		conn->session->DefaultTime2Retain = ntohs(pdu->pdu.p.asynch.Parameter3);
    794 		kill_session(conn->session, ISCSI_STATUS_TARGET_DROP, NO_LOGOUT, TRUE);
    795 		break;
    796 
    797 	case 4:				/* Target requests parameter negotiation */
    798 		start_text_negotiation(conn);
    799 		break;
    800 
    801 	default:
    802 		/* ignore */
    803 		break;
    804 	}
    805 	return 0;
    806 }
    807 
    808 
    809 /*
    810  * receive_reject_pdu
    811  *    Handle receipt of a reject PDU.
    812  *
    813  *    Parameter:
    814  *          conn     The connection
    815  *          pdu      The PDU
    816  */
    817 
    818 STATIC int
    819 receive_reject_pdu(connection_t *conn, pdu_t *pdu)
    820 {
    821 	pdu_header_t *hpdu;
    822 	ccb_t *req_ccb;
    823 	uint32_t status;
    824 
    825 	DEBOUT(("Received Reject PDU, reason = %x, data_len = %d\n",
    826 			pdu->pdu.OpcodeSpecific[0], pdu->temp_data_len));
    827 
    828 	if (pdu->temp_data_len >= BHS_SIZE) {
    829 		hpdu = (pdu_header_t *) pdu->temp_data;
    830 		req_ccb = ccb_from_itt(conn, hpdu->InitiatorTaskTag);
    831 
    832 		DEBC(conn, 9, ("Reject PDU ITT (ccb)= %x (%p)\n",
    833 				hpdu->InitiatorTaskTag, req_ccb));
    834 		if (!req_ccb) {
    835 			return 0;
    836 		}
    837 		switch (pdu->pdu.OpcodeSpecific[0]) {
    838 		case REJECT_DIGEST_ERROR:
    839 			/* don't retransmit data out */
    840 			if ((hpdu->Opcode & OPCODE_MASK) == IOP_SCSI_Data_out)
    841 				return 0;
    842 			resend_pdu(req_ccb);
    843 			return 0;
    844 
    845 		case REJECT_IMMED_COMMAND:
    846 		case REJECT_LONG_OPERATION:
    847 			resend_pdu(req_ccb);
    848 			return 0;
    849 
    850 		case REJECT_SNACK:
    851 		case REJECT_PROTOCOL_ERROR:
    852 			status = ISCSI_STATUS_PROTOCOL_ERROR;
    853 			break;
    854 
    855 		case REJECT_CMD_NOT_SUPPORTED:
    856 			status = ISCSI_STATUS_CMD_NOT_SUPPORTED;
    857 			break;
    858 
    859 		case REJECT_INVALID_PDU_FIELD:
    860 			status = ISCSI_STATUS_PDU_ERROR;
    861 			break;
    862 
    863 		default:
    864 			status = ISCSI_STATUS_GENERAL_ERROR;
    865 			break;
    866 		}
    867 
    868 		wake_ccb(req_ccb, status);
    869 		handle_connection_error(conn, ISCSI_STATUS_PROTOCOL_ERROR,
    870 							LOGOUT_CONNECTION);
    871 	}
    872 	return 0;
    873 }
    874 
    875 
    876 /*
    877  * receive_task_management_pdu
    878  *    Handle receipt of a task management PDU.
    879  *
    880  *    Parameter:
    881  *          conn     The connection
    882  *          pdu      The PDU
    883  *          req_CCB  The CCB associated with the original request (if any)
    884  */
    885 
    886 STATIC int
    887 receive_task_management_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    888 {
    889 	uint32_t status;
    890 
    891 	DEBC(conn, 2, ("Received Task Management PDU, response %d, req_ccb %p\n",
    892 			pdu->pdu.OpcodeSpecific[0], req_ccb));
    893 
    894 	if (req_ccb != NULL) {
    895 		switch (pdu->pdu.OpcodeSpecific[0]) {	/* Response */
    896 		case 0:
    897 			status = ISCSI_STATUS_SUCCESS;
    898 			break;
    899 		case 1:
    900 			status = ISCSI_STATUS_TASK_NOT_FOUND;
    901 			break;
    902 		case 2:
    903 			status = ISCSI_STATUS_LUN_NOT_FOUND;
    904 			break;
    905 		case 3:
    906 			status = ISCSI_STATUS_TASK_ALLEGIANT;
    907 			break;
    908 		case 4:
    909 			status = ISCSI_STATUS_CANT_REASSIGN;
    910 			break;
    911 		case 5:
    912 			status = ISCSI_STATUS_FUNCTION_UNSUPPORTED;
    913 			break;
    914 		case 6:
    915 			status = ISCSI_STATUS_FUNCTION_NOT_AUTHORIZED;
    916 			break;
    917 		case 255:
    918 			status = ISCSI_STATUS_FUNCTION_REJECTED;
    919 			break;
    920 		default:
    921 			status = ISCSI_STATUS_UNKNOWN_REASON;
    922 			break;
    923 		}
    924 		wake_ccb(req_ccb, status);
    925 	}
    926 
    927 	check_StatSN(conn, pdu->pdu.p.task_rsp.StatSN, TRUE);
    928 
    929 	return 0;
    930 }
    931 
    932 
    933 /*
    934  * receive_nop_in_pdu
    935  *    Handle receipt of a Nop-In PDU.
    936  *
    937  *    Parameter:
    938  *          conn     The connection
    939  *          pdu      The PDU
    940  *          req_CCB  The CCB associated with the original request (if any)
    941  */
    942 
    943 STATIC int
    944 receive_nop_in_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    945 {
    946 	DEBC(conn, 10,
    947 		("Received NOP-In PDU, req_ccb=%p, ITT=%x, TTT=%x, StatSN=%x\n",
    948 		req_ccb, pdu->pdu.InitiatorTaskTag,
    949 		pdu->pdu.p.nop_in.TargetTransferTag,
    950 		ntohl(pdu->pdu.p.nop_in.StatSN)));
    951 
    952 	if (pdu->pdu.InitiatorTaskTag == 0xffffffff) {
    953 		/* this is a target ping - respond with a pong */
    954 		if (pdu->pdu.p.nop_in.TargetTransferTag != 0xffffffff)
    955 			send_nop_out(conn, pdu);
    956 
    957 		/*
    958 		   Any receive resets the connection timeout, but we got a ping, which
    959 		   means that it's likely the other side was waiting for something to
    960 		   happen on the connection. If we aren't idle, send a ping right
    961 		   away to synch counters (don't synch on this ping because other
    962 		   PDUs may be on the way).
    963 		 */
    964 		if (TAILQ_FIRST(&conn->ccbs_waiting) != NULL)
    965 			send_nop_out(conn, NULL);
    966 	} else if (req_ccb != NULL) {
    967 		/* this is a solicited ping, check CmdSN for lost commands */
    968 		/* and advance StatSN */
    969 		check_CmdSN(conn, pdu->pdu.p.nop_in.ExpCmdSN);
    970 
    971 		wake_ccb(req_ccb, ISCSI_STATUS_SUCCESS);
    972 
    973 		check_StatSN(conn, pdu->pdu.p.nop_in.StatSN, TRUE);
    974 	}
    975 
    976 	return 0;
    977 }
    978 
    979 
    980 /*
    981  * receive_pdu
    982  *    Get parameters, call the appropriate handler for a received PDU.
    983  *
    984  *    Parameter:
    985  *          conn     The connection
    986  *          pdu      The PDU
    987  *
    988  *    Returns:    0 on success, nonzero if the connection is broken.
    989  */
    990 
    991 STATIC int
    992 receive_pdu(connection_t *conn, pdu_t *pdu)
    993 {
    994 	ccb_t *req_ccb;
    995 	ccb_list_t waiting;
    996 	int rc;
    997 	uint32_t MaxCmdSN, digest;
    998 	session_t *sess = conn->session;
    999 
   1000 	if (conn->HeaderDigest) {
   1001 		digest = gen_digest(&pdu->pdu, BHS_SIZE);
   1002 		if (digest != pdu->pdu.HeaderDigest) {
   1003 			DEBOUT(("Header Digest Error: comp = %08x, rx = %08x\n",
   1004 					digest, pdu->pdu.HeaderDigest));
   1005 			/* try to skip to next PDU */
   1006 			try_resynch_receive(conn);
   1007 			free_pdu(pdu);
   1008 			return 0;
   1009 		}
   1010 	}
   1011 
   1012 	req_ccb = ccb_from_itt(conn, pdu->pdu.InitiatorTaskTag);
   1013 
   1014 	if (req_ccb != NULL && req_ccb->data_in && req_ccb->data_len &&
   1015 		(pdu->pdu.Opcode & OPCODE_MASK) == TOP_SCSI_Data_in) {
   1016 		uint32_t dsl, offset;
   1017 
   1018 		dsl = ntoh3(pdu->pdu.DataSegmentLength);
   1019 		offset = ntohl(pdu->pdu.p.data_in.BufferOffset);
   1020 
   1021 		if ((offset + dsl) > req_ccb->data_len) {
   1022 			DEBOUT(("Received more data than requested (len %d, offset %d)\n",
   1023 					dsl, offset));
   1024 			handle_connection_error(conn, ISCSI_STATUS_TARGET_ERROR, NO_LOGOUT);
   1025 			return 1;
   1026 		}
   1027 		DEBC(conn, 10,
   1028 			("Received Data in PDU - CCB = %p, Datalen = %d, Offset = %d\n",
   1029 			req_ccb, dsl, offset));
   1030 
   1031 		rc = read_pdu_data(pdu, req_ccb->data_ptr, offset);
   1032 	} else {
   1033 		rc = read_pdu_data(pdu, NULL, 0);
   1034 	}
   1035 	if (!rc && (conn->state <= ST_WINDING_DOWN ||
   1036 		(pdu->pdu.Opcode & OPCODE_MASK) == TOP_Logout_Response)) {
   1037 
   1038 		switch (pdu->pdu.Opcode & OPCODE_MASK) {
   1039 		case TOP_NOP_In:
   1040 			rc = receive_nop_in_pdu(conn, pdu, req_ccb);
   1041 			break;
   1042 
   1043 		case TOP_SCSI_Response:
   1044 			rc = receive_command_response_pdu(conn, pdu, req_ccb);
   1045 			break;
   1046 
   1047 		case TOP_SCSI_Task_Management:
   1048 			rc = receive_task_management_pdu(conn, pdu, req_ccb);
   1049 			break;
   1050 
   1051 		case TOP_Login_Response:
   1052 			rc = receive_login_pdu(conn, pdu, req_ccb);
   1053 			break;
   1054 
   1055 		case TOP_Text_Response:
   1056 			rc = receive_text_response_pdu(conn, pdu, req_ccb);
   1057 			break;
   1058 
   1059 		case TOP_SCSI_Data_in:
   1060 			rc = receive_data_in_pdu(conn, pdu, req_ccb);
   1061 			break;
   1062 
   1063 		case TOP_Logout_Response:
   1064 			rc = receive_logout_pdu(conn, pdu, req_ccb);
   1065 			break;
   1066 
   1067 		case TOP_R2T:
   1068 			rc = receive_r2t_pdu(conn, pdu, req_ccb);
   1069 			break;
   1070 
   1071 		case TOP_Asynchronous_Message:
   1072 			rc = receive_asynch_pdu(conn, pdu);
   1073 			break;
   1074 
   1075 		case TOP_Reject:
   1076 			rc = receive_reject_pdu(conn, pdu);
   1077 			break;
   1078 
   1079 		default:
   1080 			DEBOUT(("Received Invalid Opcode %x\n", pdu->pdu.Opcode));
   1081 			try_resynch_receive(conn);
   1082 			rc = -1;
   1083 			break;
   1084 		}
   1085 	}
   1086 
   1087 	free_pdu(pdu);
   1088 	if (rc)
   1089 		return rc;
   1090 
   1091 	/* MaxCmdSN and ExpCmdSN are in the same place in all received PDUs */
   1092 	sess->ExpCmdSN = max(sess->ExpCmdSN, ntohl(pdu->pdu.p.nop_in.ExpCmdSN));
   1093 	MaxCmdSN = ntohl(pdu->pdu.p.nop_in.MaxCmdSN);
   1094 
   1095 	/* received a valid frame, reset timeout */
   1096 	if ((pdu->pdu.Opcode & OPCODE_MASK) == TOP_NOP_In &&
   1097 	    TAILQ_EMPTY(&conn->ccbs_waiting))
   1098 		connection_timeout_start(conn, conn->idle_timeout_val);
   1099 	else
   1100 		connection_timeout_start(conn, CONNECTION_TIMEOUT);
   1101 	conn->num_timeouts = 0;
   1102 
   1103 	/*
   1104 	 * Un-throttle - wakeup all CCBs waiting for MaxCmdSN to increase.
   1105 	 * We have to handle wait/nowait CCBs a bit differently.
   1106 	 */
   1107 	mutex_enter(&sess->lock);
   1108 	if (MaxCmdSN != sess->MaxCmdSN) {
   1109 		sess->MaxCmdSN = MaxCmdSN;
   1110 		if (TAILQ_FIRST(&sess->ccbs_throttled) == NULL) {
   1111 			mutex_exit(&sess->lock);
   1112 			return 0;
   1113 		}
   1114 
   1115 		DEBC(conn, 1, ("Unthrottling - MaxCmdSN = %d\n", MaxCmdSN));
   1116 
   1117 		TAILQ_INIT(&waiting);
   1118 		while ((req_ccb = TAILQ_FIRST(&sess->ccbs_throttled)) != NULL) {
   1119 			throttle_ccb(req_ccb, FALSE);
   1120 			TAILQ_INSERT_TAIL(&waiting, req_ccb, chain);
   1121 		}
   1122 		mutex_exit(&sess->lock);
   1123 
   1124 		while ((req_ccb = TAILQ_FIRST(&waiting)) != NULL) {
   1125 			TAILQ_REMOVE(&waiting, req_ccb, chain);
   1126 
   1127 			DEBC(conn, 1, ("Unthrottling - ccb = %p, disp = %d\n",
   1128 					req_ccb, req_ccb->disp));
   1129 
   1130 			if (req_ccb->flags & CCBF_WAITING) {
   1131 				cv_broadcast(&conn->ccb_cv);
   1132 			} else
   1133 				send_command(req_ccb, req_ccb->disp, FALSE, FALSE);
   1134 		}
   1135 	} else
   1136 		mutex_exit(&sess->lock);
   1137 
   1138 	return 0;
   1139 }
   1140 
   1141 /*****************************************************************************/
   1142 
   1143 /*
   1144  * iscsi_receive_thread
   1145  *    Per connection thread handling receive data.
   1146  *
   1147  *    Parameter:
   1148  *          conn     The connection
   1149  */
   1150 
   1151 void
   1152 iscsi_rcv_thread(void *par)
   1153 {
   1154 	connection_t *conn = (connection_t *) par;
   1155 	pdu_t *pdu;
   1156 	size_t hlen;
   1157 
   1158 	do {
   1159 		while (!conn->terminating) {
   1160 			pdu = get_pdu(conn, TRUE);
   1161 			pdu->uio.uio_iov = pdu->io_vec;
   1162 			UIO_SETUP_SYSSPACE(&pdu->uio);
   1163 			pdu->uio.uio_iovcnt = 1;
   1164 			pdu->uio.uio_rw = UIO_READ;
   1165 
   1166 			pdu->io_vec[0].iov_base = &pdu->pdu;
   1167 			hlen = (conn->HeaderDigest) ? BHS_SIZE + 4 : BHS_SIZE;
   1168 			pdu->io_vec[0].iov_len = hlen;
   1169 			pdu->uio.uio_resid = hlen;
   1170 
   1171 			DEBC(conn, 99, ("Receive thread waiting for data\n"));
   1172 			if (my_soo_read(conn, &pdu->uio, MSG_WAITALL)) {
   1173 				free_pdu(pdu);
   1174 				break;
   1175 			}
   1176 			/* Check again for header digest */
   1177 			/* (it may have changed during the wait) */
   1178 			if (hlen == BHS_SIZE && conn->HeaderDigest) {
   1179 				pdu->uio.uio_iov = pdu->io_vec;
   1180 				pdu->uio.uio_iovcnt = 1;
   1181 				pdu->io_vec[0].iov_base = &pdu->pdu.HeaderDigest;
   1182 				pdu->io_vec[0].iov_len = 4;
   1183 				pdu->uio.uio_resid = 4;
   1184 				if (my_soo_read(conn, &pdu->uio, MSG_WAITALL)) {
   1185 					free_pdu(pdu);
   1186 					break;
   1187 				}
   1188 			}
   1189 
   1190 			if (receive_pdu(conn, pdu) > 0) {
   1191 				break;
   1192 			}
   1193 		}
   1194 		mutex_enter(&conn->lock);
   1195 		if (!conn->destroy) {
   1196 			cv_timedwait(&conn->idle_cv, &conn->lock, CONNECTION_IDLE_TIMEOUT);
   1197 		}
   1198 		mutex_exit(&conn->lock);
   1199 	} while (!conn->destroy);
   1200 
   1201 	conn->rcvproc = NULL;
   1202 	DEBC(conn, 5, ("Receive thread exits\n"));
   1203 	kthread_exit(0);
   1204 }
   1205