Home | History | Annotate | Line # | Download | only in iscsi
iscsi_rcv.c revision 1.14
      1 /*	$NetBSD: iscsi_rcv.c,v 1.14 2016/06/05 04:51:57 mlelstv Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2004,2005,2006,2011 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Wasabi Systems, Inc.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 #include "iscsi_globals.h"
     32 
     33 #include <sys/file.h>
     34 #include <sys/socket.h>
     35 #include <sys/socketvar.h>
     36 
     37 /*****************************************************************************/
     38 
     39 /*
     40  * my_soo_read:
     41  *    Replacement for soo_read with flag handling.
     42  *
     43  *    Parameter:
     44  *          conn     The connection
     45  *          u        The uio descriptor
     46  *          flags    Read flags
     47  *
     48  *    Returns:    0 on success, else 1
     49  */
     50 
     51 STATIC int
     52 my_soo_read(connection_t *conn, struct uio *u, int flags)
     53 {
     54 	struct socket *so = conn->sock->f_socket;
     55 	int ret;
     56 #ifdef ISCSI_DEBUG
     57 	size_t resid = u->uio_resid;
     58 #endif
     59 
     60 	DEBC(conn, 99, ("soo_read req: %zu\n", resid));
     61 
     62 	KERNEL_LOCK(1, curlwp);
     63 	ret = soreceive(so, NULL, u, NULL, NULL, &flags);
     64 	KERNEL_UNLOCK_ONE(curlwp);
     65 
     66 	if (ret || (flags != MSG_DONTWAIT && u->uio_resid)) {
     67 		DEBC(conn, 1, ("Read failed (ret: %d, req: %zu, out: %zu)\n",
     68 		               ret, resid, u->uio_resid));
     69 		handle_connection_error(conn, ISCSI_STATUS_SOCKET_ERROR,
     70 		                        RECOVER_CONNECTION);
     71 		return 1;
     72 	}
     73 	return 0;
     74 }
     75 
     76 
     77 /*
     78  * try_resynch_receive:
     79  *    Skip over everything in the socket's receive buffer, in the hope of
     80  *    ending up at the start of a new PDU.
     81  *
     82  *    Parameter:
     83  *          conn     The connection
     84  */
     85 
     86 STATIC void
     87 try_resynch_receive(connection_t *conn)
     88 {
     89 	uint8_t buffer[64];
     90 	struct uio uio;
     91 	struct iovec io_vec;
     92 	int rc;
     93 
     94 	uio.uio_rw = UIO_READ;
     95 	UIO_SETUP_SYSSPACE(&uio);
     96 
     97 	do {
     98 		io_vec.iov_base = buffer;
     99 		uio.uio_iov = &io_vec;
    100 		uio.uio_iovcnt = 1;
    101 		uio.uio_resid = io_vec.iov_len = sizeof(buffer);
    102 
    103 		rc = my_soo_read(conn, &uio, MSG_DONTWAIT);
    104 		DEBC(conn, 9, ("try_resynch_receive: rc = %d, resid = %zu\n",
    105 				rc, uio.uio_resid));
    106 	} while (!rc && !uio.uio_resid);
    107 }
    108 
    109 
    110 /*
    111  * ccb_from_itt
    112  *    Translate ITT into CCB pointer.
    113  *
    114  *    Parameter:
    115  *          conn     The connection
    116  *          itt      The Initiator Task Tag
    117  *
    118  *    Returns:
    119  *          Pointer to CCB, or NULL if ITT is not a valid CCB index.
    120  */
    121 
    122 STATIC ccb_t *
    123 ccb_from_itt(connection_t *conn, uint32_t itt)
    124 {
    125 	ccb_t *ccb;
    126 	int cidx;
    127 
    128 	if (itt == 0xffffffff)
    129 		return NULL;
    130 
    131 	cidx = itt & 0xff;
    132 	if (cidx >= CCBS_PER_SESSION) {
    133 		return NULL;
    134 	}
    135 	ccb = &conn->session->ccb[cidx];
    136 	if (ccb->ITT != itt || ccb->disp <= CCBDISP_BUSY) {
    137 		DEBC(conn, 0,
    138 		     ("ccb_from_itt: received invalid CCB itt %08x != %08x\n",
    139 		      itt, ccb->ITT));
    140 		return NULL;
    141 	}
    142 	return ccb;
    143 }
    144 
    145 
    146 /*
    147  * read_pdu_data:
    148  *    Initialize the uio structure for receiving everything after the
    149  *    header, including data (if present), and padding. Read the data.
    150  *
    151  *    Parameter:
    152  *          pdu      The PDU
    153  *          data     Pointer to data (may be NULL for auto-allocation)
    154  *          offset   The offset into the data pointer
    155  *
    156  *    Returns:     0 on success
    157  *                 1 if an error occurs during read
    158  *                -1 if the data digest was incorrect (PDU must be ignored)
    159  */
    160 
    161 STATIC int
    162 read_pdu_data(pdu_t *pdu, uint8_t *data, uint32_t offset)
    163 {
    164 	static uint8_t pad_bytes[4];
    165 	uint32_t len, digest;
    166 	struct uio *uio;
    167 	int i, pad;
    168 	connection_t *conn = pdu->connection;
    169 
    170 	DEB(15, ("read_pdu_data: data segment length = %d\n",
    171 		ntoh3(pdu->pdu.DataSegmentLength)));
    172 	if (!(len = ntoh3(pdu->pdu.DataSegmentLength))) {
    173 		return 0;
    174 	}
    175 	pad = len & 0x03;
    176 	if (pad) {
    177 		pad = 4 - pad;
    178 	}
    179 
    180 	KASSERT(data != NULL || offset == 0);
    181 
    182 	if (data == NULL) {
    183 		/*
    184 		 * NOTE: Always allocate 2 extra bytes when reading temp data,
    185 		 * since temp data is mostly used for received text, and we can
    186 		 * make sure there's a double zero at the end of the data to mark EOF.
    187 		 */
    188 		if ((data = (uint8_t *) malloc(len + 2, M_TEMP, M_WAITOK)) == NULL) {
    189 			DEBOUT(("ran out of mem on receive\n"));
    190 			handle_connection_error(pdu->connection,
    191 				ISCSI_STATUS_NO_RESOURCES, LOGOUT_SESSION);
    192 			return 1;
    193 		}
    194 		pdu->temp_data = data;
    195 		pdu->temp_data_len = len;
    196 	}
    197 
    198 	pdu->io_vec[0].iov_base = data + offset;
    199 	pdu->io_vec[0].iov_len = len;
    200 
    201 	uio = &pdu->uio;
    202 
    203 	uio->uio_iov = pdu->io_vec;
    204 	uio->uio_iovcnt = 1;
    205 	uio->uio_rw = UIO_READ;
    206 	uio->uio_resid = len;
    207 	UIO_SETUP_SYSSPACE(uio);
    208 
    209 	if (pad) {
    210 		uio->uio_iovcnt++;
    211 		uio->uio_iov[1].iov_base = pad_bytes;
    212 		uio->uio_iov[1].iov_len = pad;
    213 		uio->uio_resid += pad;
    214 	}
    215 
    216 	if (conn->DataDigest) {
    217 		i = uio->uio_iovcnt++;
    218 		pdu->io_vec[i].iov_base = &pdu->data_digest;
    219 		pdu->io_vec[i].iov_len = 4;
    220 		uio->uio_resid += 4;
    221 	}
    222 
    223 	/* get the data */
    224 	if (my_soo_read(conn, &pdu->uio, MSG_WAITALL) != 0) {
    225 		return 1;
    226 	}
    227 	if (conn->DataDigest) {
    228 		digest = gen_digest_2(data, len, pad_bytes, pad);
    229 
    230 		if (digest != pdu->data_digest) {
    231 			DEBOUT(("Data Digest Error: comp = %08x, rx = %08x\n",
    232 					digest, pdu->data_digest));
    233 			switch (pdu->pdu.Opcode & OPCODE_MASK) {
    234 			case TOP_SCSI_Response:
    235 			case TOP_Text_Response:
    236 				send_snack(pdu->connection, pdu, NULL, SNACK_STATUS_NAK);
    237 				break;
    238 
    239 			case TOP_SCSI_Data_in:
    240 				send_snack(pdu->connection, pdu, NULL, SNACK_DATA_NAK);
    241 				break;
    242 
    243 			default:
    244 				/* ignore all others */
    245 				break;
    246 			}
    247 			return -1;
    248 		}
    249 	}
    250 	return 0;
    251 }
    252 
    253 
    254 /*
    255  * collect_text_data
    256  *    Handle text continuation in login and text response PDUs
    257  *
    258  *    Parameter:
    259  *          pdu      The received PDU
    260  *          req_CCB  The CCB associated with the original request
    261  *
    262  *    Returns:    -1    if continue flag is set
    263  *                0     if text is complete
    264  *                +1    if an error occurred (out of resources)
    265  */
    266 STATIC int
    267 collect_text_data(pdu_t *pdu, ccb_t *req_ccb)
    268 {
    269 
    270 	if (req_ccb->text_data) {
    271 		int nlen;
    272 		uint8_t *newp;
    273 
    274 		nlen = req_ccb->text_len + pdu->temp_data_len;
    275 		/* Note: allocate extra 2 bytes for text terminator */
    276 		if ((newp = malloc(nlen + 2, M_TEMP, M_WAITOK)) == NULL) {
    277 			DEBOUT(("Collect Text Data: Out of Memory, ccb = %p\n", req_ccb));
    278 			req_ccb->status = ISCSI_STATUS_NO_RESOURCES;
    279 			/* XXX where is CCB freed? */
    280 			return 1;
    281 		}
    282 		memcpy(newp, req_ccb->text_data, req_ccb->text_len);
    283 		memcpy(&newp[req_ccb->text_len], pdu->temp_data, pdu->temp_data_len);
    284 
    285 		free(req_ccb->text_data, M_TEMP);
    286 		free(pdu->temp_data, M_TEMP);
    287 
    288 		req_ccb->text_data = NULL;
    289 		pdu->temp_data = newp;
    290 		pdu->temp_data_len = nlen;
    291 	}
    292 
    293 	if (pdu->pdu.Flags & FLAG_CONTINUE) {
    294 		req_ccb->text_data = pdu->temp_data;
    295 		req_ccb->text_len = pdu->temp_data_len;
    296 		pdu->temp_data = NULL;
    297 
    298 		acknowledge_text(req_ccb->connection, pdu, req_ccb);
    299 		return -1;
    300 	}
    301 	return 0;
    302 }
    303 
    304 
    305 /*
    306  * check_StatSN
    307  *    Check received vs. expected StatSN
    308  *
    309  *    Parameter:
    310  *          conn     The connection
    311  *          nw_sn    The received StatSN in network byte order
    312  *          ack      Acknowledge this SN if TRUE
    313  */
    314 
    315 STATIC int
    316 check_StatSN(connection_t *conn, uint32_t nw_sn, bool ack)
    317 {
    318 	int rc;
    319 	uint32_t sn = ntohl(nw_sn);
    320 
    321 	rc = add_sernum(&conn->StatSN_buf, sn);
    322 
    323 	if (ack)
    324 		ack_sernum(&conn->StatSN_buf, sn);
    325 
    326 	if (rc != 1) {
    327 		if (rc == 0) {
    328 			DEBOUT(("Duplicate PDU, ExpSN %d, Recvd: %d\n",
    329 				conn->StatSN_buf.ExpSN, sn));
    330 			return -1;
    331 		}
    332 
    333 		if (rc < 0) {
    334 			DEBOUT(("Excessive outstanding Status PDUs, ExpSN %d, Recvd: %d\n",
    335 					conn->StatSN_buf.ExpSN, sn));
    336 			handle_connection_error(conn, ISCSI_STATUS_PDUS_LOST,
    337 									RECOVER_CONNECTION);
    338 			return rc;
    339 		}
    340 
    341 		DEBOUT(("Missing Status PDUs: First %d, num: %d\n",
    342 				conn->StatSN_buf.ExpSN, rc - 1));
    343 		if (conn->state == ST_FULL_FEATURE &&
    344 			conn->session->ErrorRecoveryLevel) {
    345 			snack_missing(conn, NULL, SNACK_STATUS_NAK,
    346 						  conn->StatSN_buf.ExpSN, rc - 1);
    347 		} else {
    348 			DEBOUT(("StatSN killing connection (State = %d, "
    349 					"ErrorRecoveryLevel = %d)\n",
    350 					conn->state, conn->session->ErrorRecoveryLevel));
    351 			handle_connection_error(conn, ISCSI_STATUS_PDUS_LOST,
    352 									RECOVER_CONNECTION);
    353 			return -1;
    354 		}
    355 	}
    356 	return 0;
    357 }
    358 
    359 
    360 /*
    361  * check_CmdSN
    362  *    Check received vs. expected CmdSN
    363  *
    364  *    Parameter:
    365  *          conn     The connection
    366  *          nw_sn    The received ExpCmdSN in network byte order
    367  */
    368 
    369 STATIC void
    370 check_CmdSN(connection_t *conn, uint32_t nw_sn)
    371 {
    372 	uint32_t sn = ntohl(nw_sn);
    373 	ccb_t *ccb, *nxt;
    374 
    375 	TAILQ_FOREACH_SAFE(ccb, &conn->ccbs_waiting, chain, nxt) {
    376 		DEBC(conn, 10,
    377 			("CheckCmdSN - CmdSN=%d, ExpCmdSn=%d, waiting=%p, flags=%x\n",
    378 			ccb->CmdSN, sn, ccb->pdu_waiting, ccb->flags));
    379 		if (ccb->pdu_waiting != NULL && ccb->CmdSN > sn &&
    380 			!(ccb->flags & CCBF_GOT_RSP)) {
    381 			DEBC(conn, 1, ("CheckCmdSN resending - CmdSN=%d, ExpCmdSn=%d\n",
    382 			               ccb->CmdSN, sn));
    383 
    384 			ccb->total_tries++;
    385 
    386 			if (++ccb->num_timeouts > MAX_CCB_TIMEOUTS ||
    387 				ccb->total_tries > MAX_CCB_TRIES) {
    388 				handle_connection_error(conn, ISCSI_STATUS_TIMEOUT,
    389 					(ccb->total_tries <= MAX_CCB_TRIES) ? RECOVER_CONNECTION
    390 														: LOGOUT_CONNECTION);
    391 				break;
    392 			} else {
    393 				resend_pdu(ccb);
    394 			}
    395 		}
    396 	}
    397 }
    398 
    399 
    400 /*
    401  * receive_login_pdu
    402  *    Handle receipt of a login response PDU.
    403  *
    404  *    Parameter:
    405  *          conn     The connection
    406  *          pdu      The PDU
    407  *          req_CCB  The CCB associated with the original request (if any)
    408  */
    409 
    410 STATIC int
    411 receive_login_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    412 {
    413 	int rc;
    414 
    415 	DEBC(conn, 9, ("Received Login Response PDU, op=%x, flags=%x, sn=%u\n",
    416 			pdu->pdu.Opcode, pdu->pdu.Flags,
    417 			ntohl(pdu->pdu.p.login_rsp.StatSN)));
    418 
    419 	if (req_ccb == NULL) {
    420 		/* Duplicate?? */
    421 		DEBOUT(("Received duplicate login response (no associated CCB)\n"));
    422 		return -1;
    423 	}
    424 
    425 	if (pdu->pdu.p.login_rsp.StatusClass) {
    426 		DEBC(conn, 1, ("Login problem - Class = %x, Detail = %x\n",
    427 				pdu->pdu.p.login_rsp.StatusClass,
    428 				pdu->pdu.p.login_rsp.StatusDetail));
    429 		wake_ccb(req_ccb, ISCSI_STATUS_LOGIN_FAILED);
    430 		return 0;
    431 	}
    432 
    433 	if (!conn->StatSN_buf.next_sn) {
    434 		conn->StatSN_buf.next_sn = conn->StatSN_buf.ExpSN =
    435 			ntohl(pdu->pdu.p.login_rsp.StatSN) + 1;
    436 	} else if (check_StatSN(conn, pdu->pdu.p.login_rsp.StatSN, TRUE))
    437 		return -1;
    438 
    439 	if (pdu->temp_data_len) {
    440 		if ((rc = collect_text_data(pdu, req_ccb)) != 0)
    441 			return max(rc, 0);
    442 	}
    443 
    444 	negotiate_login(conn, pdu, req_ccb);
    445 
    446 	/* negotiate_login will decide whether login is complete or not */
    447 	return 0;
    448 }
    449 
    450 
    451 /*
    452  * receive_text_response_pdu
    453  *    Handle receipt of a text response PDU.
    454  *
    455  *    Parameter:
    456  *          conn     The connection
    457  *          pdu      The PDU
    458  *          req_CCB  The CCB associated with the original request (if any)
    459  */
    460 
    461 STATIC int
    462 receive_text_response_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    463 {
    464 	int rc;
    465 
    466 	DEBC(conn, 9, ("Received Text Response PDU, op=%x, flags=%x\n",
    467 			pdu->pdu.Opcode, pdu->pdu.Flags));
    468 
    469 	if (check_StatSN(conn, pdu->pdu.p.text_rsp.StatSN, TRUE)) {
    470 		return -1;
    471 	}
    472 	if (req_ccb == NULL) {
    473 		DEBOUT(("Received unsolicited text response\n"));
    474 		handle_connection_error(conn, ISCSI_STATUS_TARGET_ERROR,
    475 							LOGOUT_CONNECTION);
    476 		return -1;
    477 	}
    478 
    479 	if (req_ccb->pdu_waiting != NULL) {
    480 		ccb_timeout_start(req_ccb, COMMAND_TIMEOUT);
    481 		req_ccb->num_timeouts = 0;
    482 	}
    483 
    484 	if ((rc = collect_text_data(pdu, req_ccb)) != 0) {
    485 		return max(0, rc);
    486 	}
    487 	negotiate_text(conn, pdu, req_ccb);
    488 
    489 	return 0;
    490 }
    491 
    492 
    493 /*
    494  * receive_logout_pdu
    495  *    Handle receipt of a logout response PDU.
    496  *
    497  *    Parameter:
    498  *          conn     The connection
    499  *          pdu      The PDU
    500  *          req_CCB  The CCB associated with the original request (if any)
    501  */
    502 
    503 STATIC int
    504 receive_logout_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    505 {
    506 	bool otherconn;
    507 	uint8_t response;
    508 	uint32_t status;
    509 
    510 	otherconn = (req_ccb != NULL) ? (req_ccb->flags & CCBF_OTHERCONN) != 0 : 1;
    511 	response = pdu->pdu.OpcodeSpecific [0];
    512 	DEBC(conn, 1,
    513 		("Received Logout PDU - CCB = %p, otherconn=%d, response=%d\n",
    514 		req_ccb, otherconn, response));
    515 
    516 	if (req_ccb == NULL)
    517 		return 0;
    518 
    519 	if (otherconn && check_StatSN(conn, pdu->pdu.p.logout_rsp.StatSN, TRUE))
    520 		return -1;
    521 
    522 	switch (response) {
    523 	case 0:
    524 		status = ISCSI_STATUS_SUCCESS;
    525 		break;
    526 	case 1:
    527 		status = ISCSI_STATUS_LOGOUT_CID_NOT_FOUND;
    528 		break;
    529 	case 2:
    530 		status = ISCSI_STATUS_LOGOUT_RECOVERY_NS;
    531 		break;
    532 	default:
    533 		status = ISCSI_STATUS_LOGOUT_ERROR;
    534 		break;
    535 	}
    536 
    537 	if (conn->session->ErrorRecoveryLevel >= 2 && response != 1) {
    538 		connection_t *refconn = (otherconn) ? req_ccb->par : conn;
    539 
    540 		refconn->Time2Wait = ntohs(pdu->pdu.p.logout_rsp.Time2Wait);
    541 		refconn->Time2Retain = ntohs(pdu->pdu.p.logout_rsp.Time2Retain);
    542 	}
    543 
    544 	wake_ccb(req_ccb, status);
    545 
    546 	if (!otherconn && conn->state == ST_LOGOUT_SENT) {
    547 		conn->terminating = ISCSI_STATUS_LOGOUT;
    548 		conn->state = ST_SETTLING;
    549 		conn->loggedout = (response) ? LOGOUT_FAILED : LOGOUT_SUCCESS;
    550 
    551 		connection_timeout_stop(conn);
    552 
    553 		/* let send thread take over next step of cleanup */
    554 		cv_broadcast(&conn->conn_cv);
    555 	}
    556 
    557 	return !otherconn;
    558 }
    559 
    560 
    561 /*
    562  * receive_data_in_pdu
    563  *    Handle receipt of a data in PDU.
    564  *
    565  *    Parameter:
    566  *          conn     The connection
    567  *          pdu      The PDU
    568  *          req_CCB  The CCB associated with the original request (if any)
    569  */
    570 
    571 STATIC int
    572 receive_data_in_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    573 {
    574 	uint32_t dsl, sn;
    575 	bool done;
    576 	int rc;
    577 
    578 	dsl = ntoh3(pdu->pdu.DataSegmentLength);
    579 
    580 	if (req_ccb == NULL || !req_ccb->data_in || !req_ccb->data_len) {
    581 		DEBOUT(("Received Data In, but req_ccb not waiting for it, ignored\n"));
    582 		return 0;
    583 	}
    584 	req_ccb->flags |= CCBF_GOT_RSP;
    585 
    586 	if (req_ccb->pdu_waiting != NULL) {
    587 		ccb_timeout_start(req_ccb, COMMAND_TIMEOUT);
    588 		req_ccb->num_timeouts = 0;
    589 	}
    590 
    591 	sn = ntohl(pdu->pdu.p.data_in.DataSN);
    592 
    593 	if ((rc = add_sernum(&req_ccb->DataSN_buf, sn)) != 1) {
    594 		if (!rc) {
    595 			return -1;
    596 		}
    597 		if (rc < 0) {
    598 			DEBOUT(("Excessive outstanding Data PDUs\n"));
    599 			handle_connection_error(req_ccb->connection,
    600 				ISCSI_STATUS_PDUS_LOST, LOGOUT_CONNECTION);
    601 			return -1;
    602 		}
    603 		DEBOUT(("Missing Data PDUs: First %d, num: %d\n",
    604 				req_ccb->DataSN_buf.ExpSN, rc - 1));
    605 
    606 		if (conn->state == ST_FULL_FEATURE &&
    607 			conn->session->ErrorRecoveryLevel) {
    608 			snack_missing(req_ccb->connection, req_ccb,
    609 				SNACK_DATA_NAK, req_ccb->DataSN_buf.ExpSN,
    610 				rc - 1);
    611 		} else {
    612 			DEBOUT(("Killing connection (State=%d, ErrorRecoveryLevel=%d)\n",
    613 					conn->state, conn->session->ErrorRecoveryLevel));
    614 			handle_connection_error(conn, ISCSI_STATUS_PDUS_LOST,
    615 						LOGOUT_CONNECTION);
    616 			return -1;
    617 		}
    618 	}
    619 
    620 	ack_sernum(&req_ccb->DataSN_buf, sn);
    621 
    622 	req_ccb->xfer_len += dsl;
    623 
    624 	if ((pdu->pdu.Flags & FLAG_ACK) && conn->session->ErrorRecoveryLevel)
    625 		send_snack(conn, pdu, req_ccb, SNACK_DATA_ACK);
    626 
    627 	done = sn_empty(&req_ccb->DataSN_buf);
    628 
    629 	if (pdu->pdu.Flags & FLAG_STATUS) {
    630 		DEBC(conn, 10, ("Rx Data In Complete, done = %d\n", done));
    631 
    632 		req_ccb->flags |= CCBF_COMPLETE;
    633 		/* successful transfer, reset recover count */
    634 		conn->recover = 0;
    635 
    636 		if (done)
    637 			wake_ccb(req_ccb, ISCSI_STATUS_SUCCESS);
    638 		if (check_StatSN(conn, pdu->pdu.p.data_in.StatSN, done))
    639 			return -1;
    640 
    641 	} else if (done && (req_ccb->flags & CCBF_COMPLETE)) {
    642 		wake_ccb(req_ccb, ISCSI_STATUS_SUCCESS);
    643 	}
    644 	/* else wait for command response */
    645 
    646 	return 0;
    647 }
    648 
    649 
    650 /*
    651  * receive_r2t_pdu
    652  *    Handle receipt of a R2T PDU.
    653  *
    654  *    Parameter:
    655  *          conn     The connection
    656  *          pdu      The PDU
    657  *          req_CCB  The CCB associated with the original request (if any)
    658  */
    659 
    660 STATIC int
    661 receive_r2t_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    662 {
    663 
    664 	DEBC(conn, 10, ("Received R2T PDU - CCB = %p\n", req_ccb));
    665 
    666 	if (req_ccb != NULL) {
    667 		if (req_ccb->pdu_waiting != NULL) {
    668 			ccb_timeout_start(req_ccb, COMMAND_TIMEOUT);
    669 			req_ccb->num_timeouts = 0;
    670 		}
    671 		send_data_out(conn, pdu, req_ccb, CCBDISP_NOWAIT, TRUE);
    672 	}
    673 
    674 	return 0;
    675 }
    676 
    677 
    678 /*
    679  * receive_command_response_pdu
    680  *    Handle receipt of a command response PDU.
    681  *
    682  *    Parameter:
    683  *          conn     The connection
    684  *          pdu      The PDU
    685  *          req_CCB  The CCB associated with the original request (if any)
    686  */
    687 
    688 STATIC int
    689 receive_command_response_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    690 {
    691 	int len, rc;
    692 	bool done;
    693 	uint32_t status;
    694 
    695 	/* Read any provided data */
    696 	if (pdu->temp_data_len && req_ccb != NULL && req_ccb->sense_len_req) {
    697 		len = min(req_ccb->sense_len_req,
    698 				  ntohs(*((uint16_t *) pdu->temp_data)));
    699 		memcpy(req_ccb->sense_ptr, ((uint16_t *) pdu->temp_data) + 1,
    700 					len);
    701 		req_ccb->sense_len_got = len;
    702 	}
    703 
    704 	if (req_ccb == NULL) {
    705 		/* Assume duplicate... */
    706 		DEBOUT(("Possibly duplicate command response (no associated CCB)\n"));
    707 		return -1;
    708 	}
    709 
    710 	if (req_ccb->pdu_waiting != NULL) {
    711 		ccb_timeout_start(req_ccb, COMMAND_TIMEOUT);
    712 		req_ccb->num_timeouts = 0;
    713 	}
    714 
    715 	req_ccb->flags |= CCBF_COMPLETE;
    716 	conn->recover = 0;	/* successful transfer, reset recover count */
    717 
    718 	if (pdu->pdu.OpcodeSpecific[0]) {	/* Response */
    719 		status = ISCSI_STATUS_TARGET_FAILURE;
    720 	} else {
    721 		switch (pdu->pdu.OpcodeSpecific[1]) {	/* Status */
    722 		case 0x00:
    723 			status = ISCSI_STATUS_SUCCESS;
    724 			break;
    725 
    726 		case 0x02:
    727 			status = ISCSI_STATUS_CHECK_CONDITION;
    728 			break;
    729 
    730 		case 0x08:
    731 			status = ISCSI_STATUS_TARGET_BUSY;
    732 			break;
    733 
    734 		default:
    735 			status = ISCSI_STATUS_TARGET_ERROR;
    736 			break;
    737 		}
    738 	}
    739 
    740 	if (pdu->pdu.Flags & (FLAG_OVERFLOW | FLAG_UNDERFLOW))
    741 		req_ccb->residual = ntohl(pdu->pdu.p.response.ResidualCount);
    742 
    743 	done = status || sn_empty(&req_ccb->DataSN_buf);
    744 
    745 	DEBC(conn, 10, ("Rx Command Response rsp = %x, status = %x\n",
    746 			pdu->pdu.OpcodeSpecific[0], pdu->pdu.OpcodeSpecific[1]));
    747 
    748 	rc = check_StatSN(conn, pdu->pdu.p.response.StatSN, done);
    749 
    750 	if (done)
    751 		wake_ccb(req_ccb, status);
    752 
    753 	return rc;
    754 }
    755 
    756 
    757 /*
    758  * receive_asynch_pdu
    759  *    Handle receipt of an asynchronous message PDU.
    760  *
    761  *    Parameter:
    762  *          conn     The connection
    763  *          pdu      The PDU
    764  */
    765 
    766 STATIC int
    767 receive_asynch_pdu(connection_t *conn, pdu_t *pdu)
    768 {
    769 
    770 	DEBOUT(("Received Asynch PDU, Event %d\n", pdu->pdu.p.asynch.AsyncEvent));
    771 
    772 	switch (pdu->pdu.p.asynch.AsyncEvent) {
    773 	case 0:		   		/* SCSI Asynch event. Don't know what to do with it... */
    774 		break;
    775 
    776 	case 1:		   		/* Target requests logout. */
    777 		if (conn->session->active_connections > 1) {
    778 			kill_connection(conn, ISCSI_STATUS_TARGET_LOGOUT,
    779 						LOGOUT_CONNECTION, FALSE);
    780 		} else {
    781 			kill_session(conn->session, ISCSI_STATUS_TARGET_LOGOUT,
    782 						 LOGOUT_SESSION, FALSE);
    783 		}
    784 		break;
    785 
    786 	case 2:				/* Target is dropping connection */
    787 		conn = find_connection(conn->session,
    788 					ntohs(pdu->pdu.p.asynch.Parameter1));
    789 		if (conn != NULL) {
    790 			conn->Time2Wait = ntohs(pdu->pdu.p.asynch.Parameter2);
    791 			conn->Time2Retain = ntohs(pdu->pdu.p.asynch.Parameter3);
    792 			kill_connection(conn, ISCSI_STATUS_TARGET_DROP,
    793 					NO_LOGOUT, TRUE);
    794 		}
    795 		break;
    796 
    797 	case 3:				/* Target is dropping all connections of session */
    798 		conn->session->DefaultTime2Wait = ntohs(pdu->pdu.p.asynch.Parameter2);
    799 		conn->session->DefaultTime2Retain = ntohs(pdu->pdu.p.asynch.Parameter3);
    800 		kill_session(conn->session, ISCSI_STATUS_TARGET_DROP, NO_LOGOUT, TRUE);
    801 		break;
    802 
    803 	case 4:				/* Target requests parameter negotiation */
    804 		start_text_negotiation(conn);
    805 		break;
    806 
    807 	default:
    808 		/* ignore */
    809 		break;
    810 	}
    811 	return 0;
    812 }
    813 
    814 
    815 /*
    816  * receive_reject_pdu
    817  *    Handle receipt of a reject PDU.
    818  *
    819  *    Parameter:
    820  *          conn     The connection
    821  *          pdu      The PDU
    822  */
    823 
    824 STATIC int
    825 receive_reject_pdu(connection_t *conn, pdu_t *pdu)
    826 {
    827 	pdu_header_t *hpdu;
    828 	ccb_t *req_ccb;
    829 	uint32_t status;
    830 
    831 	DEBOUT(("Received Reject PDU, reason = %x, data_len = %d\n",
    832 			pdu->pdu.OpcodeSpecific[0], pdu->temp_data_len));
    833 
    834 	if (pdu->temp_data_len >= BHS_SIZE) {
    835 		hpdu = (pdu_header_t *) pdu->temp_data;
    836 		req_ccb = ccb_from_itt(conn, hpdu->InitiatorTaskTag);
    837 
    838 		DEBC(conn, 9, ("Reject PDU ITT (ccb)= %x (%p)\n",
    839 				hpdu->InitiatorTaskTag, req_ccb));
    840 		if (!req_ccb) {
    841 			return 0;
    842 		}
    843 		switch (pdu->pdu.OpcodeSpecific[0]) {
    844 		case REJECT_DIGEST_ERROR:
    845 			/* don't retransmit data out */
    846 			if ((hpdu->Opcode & OPCODE_MASK) == IOP_SCSI_Data_out)
    847 				return 0;
    848 			resend_pdu(req_ccb);
    849 			return 0;
    850 
    851 		case REJECT_IMMED_COMMAND:
    852 		case REJECT_LONG_OPERATION:
    853 			resend_pdu(req_ccb);
    854 			return 0;
    855 
    856 		case REJECT_SNACK:
    857 		case REJECT_PROTOCOL_ERROR:
    858 			status = ISCSI_STATUS_PROTOCOL_ERROR;
    859 			break;
    860 
    861 		case REJECT_CMD_NOT_SUPPORTED:
    862 			status = ISCSI_STATUS_CMD_NOT_SUPPORTED;
    863 			break;
    864 
    865 		case REJECT_INVALID_PDU_FIELD:
    866 			status = ISCSI_STATUS_PDU_ERROR;
    867 			break;
    868 
    869 		default:
    870 			status = ISCSI_STATUS_GENERAL_ERROR;
    871 			break;
    872 		}
    873 
    874 		wake_ccb(req_ccb, status);
    875 		handle_connection_error(conn, ISCSI_STATUS_PROTOCOL_ERROR,
    876 							LOGOUT_CONNECTION);
    877 	}
    878 	return 0;
    879 }
    880 
    881 
    882 /*
    883  * receive_task_management_pdu
    884  *    Handle receipt of a task management PDU.
    885  *
    886  *    Parameter:
    887  *          conn     The connection
    888  *          pdu      The PDU
    889  *          req_CCB  The CCB associated with the original request (if any)
    890  */
    891 
    892 STATIC int
    893 receive_task_management_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    894 {
    895 	uint32_t status;
    896 
    897 	DEBC(conn, 2, ("Received Task Management PDU, response %d, req_ccb %p\n",
    898 			pdu->pdu.OpcodeSpecific[0], req_ccb));
    899 
    900 	if (req_ccb != NULL) {
    901 		switch (pdu->pdu.OpcodeSpecific[0]) {	/* Response */
    902 		case 0:
    903 			status = ISCSI_STATUS_SUCCESS;
    904 			break;
    905 		case 1:
    906 			status = ISCSI_STATUS_TASK_NOT_FOUND;
    907 			break;
    908 		case 2:
    909 			status = ISCSI_STATUS_LUN_NOT_FOUND;
    910 			break;
    911 		case 3:
    912 			status = ISCSI_STATUS_TASK_ALLEGIANT;
    913 			break;
    914 		case 4:
    915 			status = ISCSI_STATUS_CANT_REASSIGN;
    916 			break;
    917 		case 5:
    918 			status = ISCSI_STATUS_FUNCTION_UNSUPPORTED;
    919 			break;
    920 		case 6:
    921 			status = ISCSI_STATUS_FUNCTION_NOT_AUTHORIZED;
    922 			break;
    923 		case 255:
    924 			status = ISCSI_STATUS_FUNCTION_REJECTED;
    925 			break;
    926 		default:
    927 			status = ISCSI_STATUS_UNKNOWN_REASON;
    928 			break;
    929 		}
    930 		wake_ccb(req_ccb, status);
    931 	}
    932 
    933 	check_StatSN(conn, pdu->pdu.p.task_rsp.StatSN, TRUE);
    934 
    935 	return 0;
    936 }
    937 
    938 
    939 /*
    940  * receive_nop_in_pdu
    941  *    Handle receipt of a Nop-In PDU.
    942  *
    943  *    Parameter:
    944  *          conn     The connection
    945  *          pdu      The PDU
    946  *          req_CCB  The CCB associated with the original request (if any)
    947  */
    948 
    949 STATIC int
    950 receive_nop_in_pdu(connection_t *conn, pdu_t *pdu, ccb_t *req_ccb)
    951 {
    952 	DEBC(conn, 10,
    953 		("Received NOP_In PDU, req_ccb=%p, ITT=%x, TTT=%x, StatSN=%x\n",
    954 		req_ccb, pdu->pdu.InitiatorTaskTag,
    955 		pdu->pdu.p.nop_in.TargetTransferTag,
    956 		ntohl(pdu->pdu.p.nop_in.StatSN)));
    957 
    958 	if (pdu->pdu.InitiatorTaskTag == 0xffffffff) {
    959 		/* this is a target ping - respond with a pong */
    960 		if (pdu->pdu.p.nop_in.TargetTransferTag != 0xffffffff)
    961 			send_nop_out(conn, pdu);
    962 
    963 		/*
    964 		   Any receive resets the connection timeout, but we got a ping, which
    965 		   means that it's likely the other side was waiting for something to
    966 		   happen on the connection. If we aren't idle, send a ping right
    967 		   away to synch counters (don't synch on this ping because other
    968 		   PDUs may be on the way).
    969 		 */
    970 		if (TAILQ_FIRST(&conn->ccbs_waiting) != NULL)
    971 			send_nop_out(conn, NULL);
    972 	} else if (req_ccb != NULL) {
    973 		/* this is a solicited ping, check CmdSN for lost commands */
    974 		/* and advance StatSN */
    975 		check_CmdSN(conn, pdu->pdu.p.nop_in.ExpCmdSN);
    976 
    977 		wake_ccb(req_ccb, ISCSI_STATUS_SUCCESS);
    978 
    979 		check_StatSN(conn, pdu->pdu.p.nop_in.StatSN, TRUE);
    980 	} else {
    981 		DEBC(conn, 0, ("Received unsolicted NOP_In, itt=%08x\n",
    982 		               pdu->pdu.InitiatorTaskTag));
    983 	}
    984 
    985 	return 0;
    986 }
    987 
    988 
    989 /*
    990  * receive_pdu
    991  *    Get parameters, call the appropriate handler for a received PDU.
    992  *
    993  *    Parameter:
    994  *          conn     The connection
    995  *          pdu      The PDU
    996  *
    997  *    Returns:    0 on success, nonzero if the connection is broken.
    998  */
    999 
   1000 STATIC int
   1001 receive_pdu(connection_t *conn, pdu_t *pdu)
   1002 {
   1003 	ccb_t *req_ccb;
   1004 	ccb_list_t waiting;
   1005 	int rc;
   1006 	uint32_t MaxCmdSN, digest;
   1007 	session_t *sess = conn->session;
   1008 
   1009 	if (conn->HeaderDigest) {
   1010 		digest = gen_digest(&pdu->pdu, BHS_SIZE);
   1011 		if (digest != pdu->pdu.HeaderDigest) {
   1012 			DEBOUT(("Header Digest Error: comp = %08x, rx = %08x\n",
   1013 					digest, pdu->pdu.HeaderDigest));
   1014 			/* try to skip to next PDU */
   1015 			try_resynch_receive(conn);
   1016 			free_pdu(pdu);
   1017 			return 0;
   1018 		}
   1019 	}
   1020 
   1021 	DEBC(conn, 99, ("Received PDU ExpCmdSN = %u\n",
   1022 	     ntohl(pdu->pdu.p.response.ExpCmdSN)));
   1023 
   1024 	req_ccb = ccb_from_itt(conn, pdu->pdu.InitiatorTaskTag);
   1025 
   1026 	if (req_ccb != NULL && req_ccb->data_in && req_ccb->data_len &&
   1027 		(pdu->pdu.Opcode & OPCODE_MASK) == TOP_SCSI_Data_in) {
   1028 		uint32_t dsl, offset;
   1029 
   1030 		dsl = ntoh3(pdu->pdu.DataSegmentLength);
   1031 		offset = ntohl(pdu->pdu.p.data_in.BufferOffset);
   1032 
   1033 		if ((offset + dsl) > req_ccb->data_len) {
   1034 			DEBOUT(("Received more data than requested (len %d, offset %d)\n",
   1035 					dsl, offset));
   1036 			handle_connection_error(conn, ISCSI_STATUS_TARGET_ERROR, NO_LOGOUT);
   1037 			return 1;
   1038 		}
   1039 		DEBC(conn, 10,
   1040 			("Received Data in PDU - CCB = %p, Datalen = %d, Offset = %d\n",
   1041 			req_ccb, dsl, offset));
   1042 
   1043 		rc = read_pdu_data(pdu, req_ccb->data_ptr, offset);
   1044 	} else {
   1045 		rc = read_pdu_data(pdu, NULL, 0);
   1046 	}
   1047 	if (!rc && (conn->state <= ST_WINDING_DOWN ||
   1048 		(pdu->pdu.Opcode & OPCODE_MASK) == TOP_Logout_Response)) {
   1049 
   1050 		switch (pdu->pdu.Opcode & OPCODE_MASK) {
   1051 		case TOP_NOP_In:
   1052 			rc = receive_nop_in_pdu(conn, pdu, req_ccb);
   1053 			break;
   1054 
   1055 		case TOP_SCSI_Response:
   1056 			rc = receive_command_response_pdu(conn, pdu, req_ccb);
   1057 			break;
   1058 
   1059 		case TOP_SCSI_Task_Management:
   1060 			rc = receive_task_management_pdu(conn, pdu, req_ccb);
   1061 			break;
   1062 
   1063 		case TOP_Login_Response:
   1064 			rc = receive_login_pdu(conn, pdu, req_ccb);
   1065 			break;
   1066 
   1067 		case TOP_Text_Response:
   1068 			rc = receive_text_response_pdu(conn, pdu, req_ccb);
   1069 			break;
   1070 
   1071 		case TOP_SCSI_Data_in:
   1072 			rc = receive_data_in_pdu(conn, pdu, req_ccb);
   1073 			break;
   1074 
   1075 		case TOP_Logout_Response:
   1076 			rc = receive_logout_pdu(conn, pdu, req_ccb);
   1077 			break;
   1078 
   1079 		case TOP_R2T:
   1080 			rc = receive_r2t_pdu(conn, pdu, req_ccb);
   1081 			break;
   1082 
   1083 		case TOP_Asynchronous_Message:
   1084 			rc = receive_asynch_pdu(conn, pdu);
   1085 			break;
   1086 
   1087 		case TOP_Reject:
   1088 			rc = receive_reject_pdu(conn, pdu);
   1089 			break;
   1090 
   1091 		default:
   1092 			DEBOUT(("Received Invalid Opcode %x\n", pdu->pdu.Opcode));
   1093 			try_resynch_receive(conn);
   1094 			rc = -1;
   1095 			break;
   1096 		}
   1097 	}
   1098 
   1099 	free_pdu(pdu);
   1100 	if (rc)
   1101 		return rc;
   1102 
   1103 	/* MaxCmdSN and ExpCmdSN are in the same place in all received PDUs */
   1104 	sess->ExpCmdSN = max(sess->ExpCmdSN, ntohl(pdu->pdu.p.nop_in.ExpCmdSN));
   1105 	MaxCmdSN = ntohl(pdu->pdu.p.nop_in.MaxCmdSN);
   1106 
   1107 	/* received a valid frame, reset timeout */
   1108 	if ((pdu->pdu.Opcode & OPCODE_MASK) == TOP_NOP_In &&
   1109 	    TAILQ_EMPTY(&conn->ccbs_waiting))
   1110 		connection_timeout_start(conn, conn->idle_timeout_val);
   1111 	else
   1112 		connection_timeout_start(conn, CONNECTION_TIMEOUT);
   1113 	conn->num_timeouts = 0;
   1114 
   1115 	/*
   1116 	 * Un-throttle - wakeup all CCBs waiting for MaxCmdSN to increase.
   1117 	 * We have to handle wait/nowait CCBs a bit differently.
   1118 	 */
   1119 	mutex_enter(&sess->lock);
   1120 	if (MaxCmdSN != sess->MaxCmdSN) {
   1121 		sess->MaxCmdSN = MaxCmdSN;
   1122 		if (TAILQ_FIRST(&sess->ccbs_throttled) == NULL) {
   1123 			mutex_exit(&sess->lock);
   1124 			return 0;
   1125 		}
   1126 
   1127 		DEBC(conn, 5, ("Unthrottling - MaxCmdSN = %d\n", MaxCmdSN));
   1128 
   1129 		TAILQ_INIT(&waiting);
   1130 		while ((req_ccb = TAILQ_FIRST(&sess->ccbs_throttled)) != NULL) {
   1131 			throttle_ccb(req_ccb, FALSE);
   1132 			TAILQ_INSERT_TAIL(&waiting, req_ccb, chain);
   1133 		}
   1134 		mutex_exit(&sess->lock);
   1135 
   1136 		while ((req_ccb = TAILQ_FIRST(&waiting)) != NULL) {
   1137 			TAILQ_REMOVE(&waiting, req_ccb, chain);
   1138 
   1139 			DEBC(conn, 10, ("Unthrottling - ccb = %p, disp = %d\n",
   1140 					req_ccb, req_ccb->disp));
   1141 
   1142 			if (req_ccb->flags & CCBF_WAITING) {
   1143 				cv_broadcast(&conn->ccb_cv);
   1144 			} else
   1145 				send_command(req_ccb, req_ccb->disp, FALSE, FALSE);
   1146 		}
   1147 	} else
   1148 		mutex_exit(&sess->lock);
   1149 
   1150 	return 0;
   1151 }
   1152 
   1153 /*****************************************************************************/
   1154 
   1155 /*
   1156  * iscsi_receive_thread
   1157  *    Per connection thread handling receive data.
   1158  *
   1159  *    Parameter:
   1160  *          conn     The connection
   1161  */
   1162 
   1163 void
   1164 iscsi_rcv_thread(void *par)
   1165 {
   1166 	connection_t *conn = (connection_t *) par;
   1167 	pdu_t *pdu;
   1168 	size_t hlen;
   1169 
   1170 	do {
   1171 		while (!conn->terminating) {
   1172 			pdu = get_pdu(conn, TRUE);
   1173 			pdu->uio.uio_iov = pdu->io_vec;
   1174 			UIO_SETUP_SYSSPACE(&pdu->uio);
   1175 			pdu->uio.uio_iovcnt = 1;
   1176 			pdu->uio.uio_rw = UIO_READ;
   1177 
   1178 			pdu->io_vec[0].iov_base = &pdu->pdu;
   1179 			hlen = (conn->HeaderDigest) ? BHS_SIZE + 4 : BHS_SIZE;
   1180 			pdu->io_vec[0].iov_len = hlen;
   1181 			pdu->uio.uio_resid = hlen;
   1182 
   1183 			DEBC(conn, 99, ("Receive thread waiting for data\n"));
   1184 			if (my_soo_read(conn, &pdu->uio, MSG_WAITALL)) {
   1185 				free_pdu(pdu);
   1186 				break;
   1187 			}
   1188 			/* Check again for header digest */
   1189 			/* (it may have changed during the wait) */
   1190 			if (hlen == BHS_SIZE && conn->HeaderDigest) {
   1191 				pdu->uio.uio_iov = pdu->io_vec;
   1192 				pdu->uio.uio_iovcnt = 1;
   1193 				pdu->io_vec[0].iov_base = &pdu->pdu.HeaderDigest;
   1194 				pdu->io_vec[0].iov_len = 4;
   1195 				pdu->uio.uio_resid = 4;
   1196 				if (my_soo_read(conn, &pdu->uio, MSG_WAITALL)) {
   1197 					free_pdu(pdu);
   1198 					break;
   1199 				}
   1200 			}
   1201 
   1202 			if (receive_pdu(conn, pdu) > 0) {
   1203 				break;
   1204 			}
   1205 		}
   1206 		mutex_enter(&conn->lock);
   1207 		if (!conn->destroy) {
   1208 			cv_timedwait(&conn->idle_cv, &conn->lock, CONNECTION_IDLE_TIMEOUT);
   1209 		}
   1210 		mutex_exit(&conn->lock);
   1211 	} while (!conn->destroy);
   1212 
   1213 	conn->rcvproc = NULL;
   1214 	DEBC(conn, 5, ("Receive thread exits\n"));
   1215 	kthread_exit(0);
   1216 }
   1217