1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2012 The FreeBSD Foundation
5 *
6 * This software was developed by Edward Tomasz Napierala under sponsorship
7 * from the FreeBSD Foundation.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 */
31
32 #include <sys/cdefs.h>
33 #include <sys/param.h>
34 #include <sys/bio.h>
35 #include <sys/condvar.h>
36 #include <sys/conf.h>
37 #include <sys/endian.h>
38 #include <sys/eventhandler.h>
39 #include <sys/file.h>
40 #include <sys/kernel.h>
41 #include <sys/kthread.h>
42 #include <sys/lock.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/mutex.h>
46 #include <sys/module.h>
47 #include <sys/proc.h>
48 #include <sys/reboot.h>
49 #include <sys/socket.h>
50 #include <sys/sockopt.h>
51 #include <sys/sysctl.h>
52 #include <sys/systm.h>
53 #include <sys/sx.h>
54
55 #include <vm/uma.h>
56
57 #include <cam/cam.h>
58 #include <cam/cam_ccb.h>
59 #include <cam/cam_xpt.h>
60 #include <cam/cam_debug.h>
61 #include <cam/cam_sim.h>
62 #include <cam/cam_xpt_sim.h>
63 #include <cam/cam_xpt_periph.h>
64 #include <cam/cam_periph.h>
65 #include <cam/scsi/scsi_all.h>
66 #include <cam/scsi/scsi_message.h>
67
68 #include <dev/iscsi/icl.h>
69 #include <dev/iscsi/icl_wrappers.h>
70 #include <dev/iscsi/iscsi_ioctl.h>
71 #include <dev/iscsi/iscsi_proto.h>
72 #include <dev/iscsi/iscsi.h>
73
74 #ifdef ICL_KERNEL_PROXY
75 #include <sys/socketvar.h>
76 #endif
77
78 #ifdef ICL_KERNEL_PROXY
79 FEATURE(iscsi_kernel_proxy, "iSCSI initiator built with ICL_KERNEL_PROXY");
80 #endif
81
82 #ifdef COMPAT_FREEBSD13
83 struct iscsi_daemon_request13 {
84 unsigned int idr_session_id;
85 struct iscsi_session_conf idr_conf;
86 uint8_t idr_isid[6];
87 uint16_t idr_tsih;
88 uint16_t idr_spare_cid;
89 struct iscsi_session_limits idr_limits;
90 int idr_spare[4];
91 };
92
93 #define ISCSIDWAIT13 _IOR('I', 0x01, struct iscsi_daemon_request13)
94 #endif
95
96 /*
97 * XXX: This is global so the iscsi_unload() can access it.
98 * Think about how to do this properly.
99 */
100 static struct iscsi_softc *sc;
101
102 SYSCTL_NODE(_kern, OID_AUTO, iscsi, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
103 "iSCSI initiator");
104 static int debug = 1;
105 SYSCTL_INT(_kern_iscsi, OID_AUTO, debug, CTLFLAG_RWTUN,
106 &debug, 0, "Enable debug messages");
107
108 static int ping_timeout = 5;
109 SYSCTL_INT(_kern_iscsi, OID_AUTO, ping_timeout, CTLFLAG_RWTUN, &ping_timeout,
110 0, "Timeout for ping (NOP-Out) requests, in seconds");
111 static int iscsid_timeout = 60;
112 SYSCTL_INT(_kern_iscsi, OID_AUTO, iscsid_timeout, CTLFLAG_RWTUN, &iscsid_timeout,
113 0, "Time to wait for iscsid(8) to handle reconnection, in seconds");
114 static int login_timeout = 60;
115 SYSCTL_INT(_kern_iscsi, OID_AUTO, login_timeout, CTLFLAG_RWTUN, &login_timeout,
116 0, "Time to wait for iscsid(8) to finish Login Phase, in seconds");
117 static int maxtags = 255;
118 SYSCTL_INT(_kern_iscsi, OID_AUTO, maxtags, CTLFLAG_RWTUN, &maxtags,
119 0, "Max number of IO requests queued");
120 static int fail_on_disconnection = 0;
121 SYSCTL_INT(_kern_iscsi, OID_AUTO, fail_on_disconnection, CTLFLAG_RWTUN,
122 &fail_on_disconnection, 0, "Destroy CAM SIM on connection failure");
123 static int fail_on_shutdown = 1;
124 SYSCTL_INT(_kern_iscsi, OID_AUTO, fail_on_shutdown, CTLFLAG_RWTUN,
125 &fail_on_shutdown, 0, "Fail disconnected sessions on shutdown");
126
127 static MALLOC_DEFINE(M_ISCSI, "iSCSI", "iSCSI initiator");
128 static uma_zone_t iscsi_outstanding_zone;
129
130 #define CONN_SESSION(X) ((struct iscsi_session *)X->ic_prv0)
131 #define PDU_SESSION(X) (CONN_SESSION(X->ip_conn))
132
133 #define ISCSI_DEBUG(X, ...) \
134 do { \
135 if (debug > 1) \
136 printf("%s: " X "\n", __func__, ## __VA_ARGS__);\
137 } while (0)
138
139 #define ISCSI_WARN(X, ...) \
140 do { \
141 if (debug > 0) { \
142 printf("WARNING: %s: " X "\n", \
143 __func__, ## __VA_ARGS__); \
144 } \
145 } while (0)
146
147 #define ISCSI_SESSION_DEBUG(S, X, ...) \
148 do { \
149 if (debug > 1) { \
150 printf("%s: %s (%s): " X "\n", \
151 __func__, S->is_conf.isc_target_addr, \
152 S->is_conf.isc_target, ## __VA_ARGS__); \
153 } \
154 } while (0)
155
156 #define ISCSI_SESSION_WARN(S, X, ...) \
157 do { \
158 if (debug > 0) { \
159 printf("WARNING: %s (%s): " X "\n", \
160 S->is_conf.isc_target_addr, \
161 S->is_conf.isc_target, ## __VA_ARGS__); \
162 } \
163 } while (0)
164
165 #define ISCSI_SESSION_LOCK(X) mtx_lock(&X->is_lock)
166 #define ISCSI_SESSION_UNLOCK(X) mtx_unlock(&X->is_lock)
167 #define ISCSI_SESSION_LOCK_ASSERT(X) mtx_assert(&X->is_lock, MA_OWNED)
168 #define ISCSI_SESSION_LOCK_ASSERT_NOT(X) mtx_assert(&X->is_lock, MA_NOTOWNED)
169
170 static int iscsi_ioctl(struct cdev *dev, u_long cmd, caddr_t arg,
171 int mode, struct thread *td);
172
173 static struct cdevsw iscsi_cdevsw = {
174 .d_version = D_VERSION,
175 .d_ioctl = iscsi_ioctl,
176 .d_name = "iscsi",
177 };
178
179 static void iscsi_pdu_queue_locked(struct icl_pdu *request);
180 static void iscsi_pdu_queue(struct icl_pdu *request);
181 static void iscsi_pdu_update_statsn(const struct icl_pdu *response);
182 static void iscsi_pdu_handle_nop_in(struct icl_pdu *response);
183 static void iscsi_pdu_handle_scsi_response(struct icl_pdu *response);
184 static void iscsi_pdu_handle_task_response(struct icl_pdu *response);
185 static void iscsi_pdu_handle_data_in(struct icl_pdu *response);
186 static void iscsi_pdu_handle_logout_response(struct icl_pdu *response);
187 static void iscsi_pdu_handle_r2t(struct icl_pdu *response);
188 static void iscsi_pdu_handle_async_message(struct icl_pdu *response);
189 static void iscsi_pdu_handle_reject(struct icl_pdu *response);
190 static void iscsi_session_reconnect(struct iscsi_session *is);
191 static void iscsi_session_terminate(struct iscsi_session *is);
192 static void iscsi_action(struct cam_sim *sim, union ccb *ccb);
193 static struct iscsi_outstanding *iscsi_outstanding_find(struct iscsi_session *is,
194 uint32_t initiator_task_tag);
195 static struct iscsi_outstanding *iscsi_outstanding_add(struct iscsi_session *is,
196 struct icl_pdu *request, union ccb *ccb,
197 uint32_t *initiator_task_tagp);
198 static void iscsi_outstanding_remove(struct iscsi_session *is,
199 struct iscsi_outstanding *io);
200
201 static bool
iscsi_pdu_prepare(struct icl_pdu * request)202 iscsi_pdu_prepare(struct icl_pdu *request)
203 {
204 struct iscsi_session *is;
205 struct iscsi_bhs_scsi_command *bhssc;
206
207 is = PDU_SESSION(request);
208
209 ISCSI_SESSION_LOCK_ASSERT(is);
210
211 /*
212 * We're only using fields common for all the request
213 * (initiator -> target) PDUs.
214 */
215 bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
216
217 /*
218 * Data-Out PDU does not contain CmdSN.
219 */
220 if (bhssc->bhssc_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_OUT) {
221 if (ISCSI_SNGT(is->is_cmdsn, is->is_maxcmdsn) &&
222 (bhssc->bhssc_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0) {
223 /*
224 * Current MaxCmdSN prevents us from sending any more
225 * SCSI Command PDUs to the target; postpone the PDU.
226 * It will get resent by either iscsi_pdu_queue(),
227 * or by maintenance thread.
228 */
229 #if 0
230 ISCSI_SESSION_DEBUG(is, "postponing send, CmdSN %u, "
231 "ExpCmdSN %u, MaxCmdSN %u, opcode 0x%x",
232 is->is_cmdsn, is->is_expcmdsn, is->is_maxcmdsn,
233 bhssc->bhssc_opcode);
234 #endif
235 return (true);
236 }
237 bhssc->bhssc_cmdsn = htonl(is->is_cmdsn);
238 if ((bhssc->bhssc_opcode & ISCSI_BHS_OPCODE_IMMEDIATE) == 0)
239 is->is_cmdsn++;
240 }
241 bhssc->bhssc_expstatsn = htonl(is->is_statsn + 1);
242
243 return (false);
244 }
245
246 static void
iscsi_session_send_postponed(struct iscsi_session * is)247 iscsi_session_send_postponed(struct iscsi_session *is)
248 {
249 struct icl_pdu *request;
250 bool postpone;
251
252 ISCSI_SESSION_LOCK_ASSERT(is);
253
254 if (STAILQ_EMPTY(&is->is_postponed))
255 return;
256 while ((request = STAILQ_FIRST(&is->is_postponed)) != NULL) {
257 postpone = iscsi_pdu_prepare(request);
258 if (postpone)
259 return;
260 STAILQ_REMOVE_HEAD(&is->is_postponed, ip_next);
261 icl_pdu_queue(request);
262 }
263 xpt_release_simq(is->is_sim, 1);
264 }
265
266 static void
iscsi_pdu_queue_locked(struct icl_pdu * request)267 iscsi_pdu_queue_locked(struct icl_pdu *request)
268 {
269 struct iscsi_session *is;
270 bool postpone;
271
272 is = PDU_SESSION(request);
273 ISCSI_SESSION_LOCK_ASSERT(is);
274 iscsi_session_send_postponed(is);
275 postpone = iscsi_pdu_prepare(request);
276 if (postpone) {
277 if (STAILQ_EMPTY(&is->is_postponed))
278 xpt_freeze_simq(is->is_sim, 1);
279 STAILQ_INSERT_TAIL(&is->is_postponed, request, ip_next);
280 return;
281 }
282 icl_pdu_queue(request);
283 }
284
285 static void
iscsi_pdu_queue(struct icl_pdu * request)286 iscsi_pdu_queue(struct icl_pdu *request)
287 {
288 struct iscsi_session *is;
289
290 is = PDU_SESSION(request);
291 ISCSI_SESSION_LOCK(is);
292 iscsi_pdu_queue_locked(request);
293 ISCSI_SESSION_UNLOCK(is);
294 }
295
296 static void
iscsi_session_logout(struct iscsi_session * is)297 iscsi_session_logout(struct iscsi_session *is)
298 {
299 struct icl_pdu *request;
300 struct iscsi_bhs_logout_request *bhslr;
301
302 request = icl_pdu_new(is->is_conn, M_NOWAIT);
303 if (request == NULL)
304 return;
305
306 bhslr = (struct iscsi_bhs_logout_request *)request->ip_bhs;
307 bhslr->bhslr_opcode = ISCSI_BHS_OPCODE_LOGOUT_REQUEST;
308 bhslr->bhslr_reason = BHSLR_REASON_CLOSE_SESSION;
309 iscsi_pdu_queue_locked(request);
310 }
311
312 static void
iscsi_session_terminate_task(struct iscsi_session * is,struct iscsi_outstanding * io,cam_status status)313 iscsi_session_terminate_task(struct iscsi_session *is,
314 struct iscsi_outstanding *io, cam_status status)
315 {
316
317 ISCSI_SESSION_LOCK_ASSERT(is);
318
319 if (io->io_ccb != NULL) {
320 io->io_ccb->ccb_h.status &= ~(CAM_SIM_QUEUED | CAM_STATUS_MASK);
321 io->io_ccb->ccb_h.status |= status;
322 if ((io->io_ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
323 io->io_ccb->ccb_h.status |= CAM_DEV_QFRZN;
324 xpt_freeze_devq(io->io_ccb->ccb_h.path, 1);
325 ISCSI_SESSION_DEBUG(is, "freezing devq");
326 }
327 xpt_done(io->io_ccb);
328 }
329 iscsi_outstanding_remove(is, io);
330 }
331
332 static void
iscsi_session_terminate_tasks(struct iscsi_session * is,cam_status status)333 iscsi_session_terminate_tasks(struct iscsi_session *is, cam_status status)
334 {
335 struct iscsi_outstanding *io, *tmp;
336
337 ISCSI_SESSION_LOCK_ASSERT(is);
338
339 TAILQ_FOREACH_SAFE(io, &is->is_outstanding, io_next, tmp) {
340 iscsi_session_terminate_task(is, io, status);
341 }
342 }
343
344 static void
iscsi_session_cleanup(struct iscsi_session * is,bool destroy_sim)345 iscsi_session_cleanup(struct iscsi_session *is, bool destroy_sim)
346 {
347 struct icl_pdu *pdu;
348
349 ISCSI_SESSION_LOCK_ASSERT(is);
350
351 /*
352 * Don't queue any new PDUs.
353 */
354 if (is->is_sim != NULL && is->is_simq_frozen == false) {
355 ISCSI_SESSION_DEBUG(is, "freezing");
356 xpt_freeze_simq(is->is_sim, 1);
357 is->is_simq_frozen = true;
358 }
359
360 /*
361 * Remove postponed PDUs.
362 */
363 if (!STAILQ_EMPTY(&is->is_postponed))
364 xpt_release_simq(is->is_sim, 1);
365 while ((pdu = STAILQ_FIRST(&is->is_postponed)) != NULL) {
366 STAILQ_REMOVE_HEAD(&is->is_postponed, ip_next);
367 icl_pdu_free(pdu);
368 }
369
370 if (destroy_sim == false) {
371 /*
372 * Terminate SCSI tasks, asking CAM to requeue them.
373 */
374 iscsi_session_terminate_tasks(is, CAM_REQUEUE_REQ);
375 return;
376 }
377
378 iscsi_session_terminate_tasks(is, CAM_DEV_NOT_THERE);
379
380 if (is->is_sim == NULL)
381 return;
382
383 ISCSI_SESSION_DEBUG(is, "deregistering SIM");
384 xpt_async(AC_LOST_DEVICE, is->is_path, NULL);
385
386 if (is->is_simq_frozen) {
387 is->is_simq_frozen = false;
388 xpt_release_simq(is->is_sim, 1);
389 }
390
391 xpt_free_path(is->is_path);
392 is->is_path = NULL;
393 xpt_bus_deregister(cam_sim_path(is->is_sim));
394 cam_sim_free(is->is_sim, TRUE /*free_devq*/);
395 is->is_sim = NULL;
396 is->is_devq = NULL;
397 }
398
399 static void
iscsi_maintenance_thread_reconnect(struct iscsi_session * is)400 iscsi_maintenance_thread_reconnect(struct iscsi_session *is)
401 {
402 /*
403 * As we will be reconnecting shortly,
404 * discard outstanding data immediately on
405 * close(), also notify peer via RST if
406 * any packets come in.
407 */
408 struct socket *so;
409 so = is->is_conn->ic_socket;
410 if (so != NULL) {
411 struct sockopt sopt;
412 struct linger sl;
413 sopt.sopt_dir = SOPT_SET;
414 sopt.sopt_level = SOL_SOCKET;
415 sopt.sopt_name = SO_LINGER;
416 sopt.sopt_val = &sl;
417 sopt.sopt_valsize = sizeof(sl);
418 sl.l_onoff = 1; /* non-zero value enables linger option in kernel */
419 sl.l_linger = 0; /* timeout interval in seconds */
420 sosetopt(is->is_conn->ic_socket, &sopt);
421 }
422
423 icl_conn_close(is->is_conn);
424
425 ISCSI_SESSION_LOCK(is);
426
427 is->is_connected = false;
428 is->is_reconnecting = false;
429 is->is_login_phase = false;
430
431 #ifdef ICL_KERNEL_PROXY
432 if (is->is_login_pdu != NULL) {
433 icl_pdu_free(is->is_login_pdu);
434 is->is_login_pdu = NULL;
435 }
436 cv_signal(&is->is_login_cv);
437 #endif
438
439 if (fail_on_disconnection) {
440 ISCSI_SESSION_DEBUG(is, "connection failed, destroying devices");
441 iscsi_session_cleanup(is, true);
442 } else {
443 iscsi_session_cleanup(is, false);
444 }
445
446 KASSERT(TAILQ_EMPTY(&is->is_outstanding),
447 ("destroying session with active tasks"));
448 KASSERT(STAILQ_EMPTY(&is->is_postponed),
449 ("destroying session with postponed PDUs"));
450
451 if (is->is_conf.isc_enable == 0 && is->is_conf.isc_discovery == 0) {
452 ISCSI_SESSION_UNLOCK(is);
453 return;
454 }
455
456 /*
457 * Request immediate reconnection from iscsid(8).
458 */
459 //ISCSI_SESSION_DEBUG(is, "waking up iscsid(8)");
460 is->is_waiting_for_iscsid = true;
461 strlcpy(is->is_reason, "Waiting for iscsid(8)", sizeof(is->is_reason));
462 is->is_timeout = 0;
463 ISCSI_SESSION_UNLOCK(is);
464 cv_signal(&is->is_softc->sc_cv);
465 }
466
467 static void
iscsi_maintenance_thread_terminate(struct iscsi_session * is)468 iscsi_maintenance_thread_terminate(struct iscsi_session *is)
469 {
470 struct iscsi_softc *sc;
471
472 sc = is->is_softc;
473 sx_xlock(&sc->sc_lock);
474 TAILQ_REMOVE(&sc->sc_sessions, is, is_next);
475 sx_xunlock(&sc->sc_lock);
476
477 icl_conn_close(is->is_conn);
478 callout_drain(&is->is_callout);
479
480 ISCSI_SESSION_LOCK(is);
481
482 KASSERT(is->is_terminating, ("is_terminating == false"));
483
484 #ifdef ICL_KERNEL_PROXY
485 if (is->is_login_pdu != NULL) {
486 icl_pdu_free(is->is_login_pdu);
487 is->is_login_pdu = NULL;
488 }
489 cv_signal(&is->is_login_cv);
490 #endif
491
492 iscsi_session_cleanup(is, true);
493
494 KASSERT(TAILQ_EMPTY(&is->is_outstanding),
495 ("destroying session with active tasks"));
496 KASSERT(STAILQ_EMPTY(&is->is_postponed),
497 ("destroying session with postponed PDUs"));
498
499 ISCSI_SESSION_UNLOCK(is);
500
501 icl_conn_free(is->is_conn);
502 mtx_destroy(&is->is_lock);
503 cv_destroy(&is->is_maintenance_cv);
504 #ifdef ICL_KERNEL_PROXY
505 cv_destroy(&is->is_login_cv);
506 #endif
507
508 ISCSI_SESSION_DEBUG(is, "terminated");
509 free(is, M_ISCSI);
510
511 /*
512 * The iscsi_unload() routine might be waiting.
513 */
514 cv_signal(&sc->sc_cv);
515 }
516
517 static void
iscsi_maintenance_thread(void * arg)518 iscsi_maintenance_thread(void *arg)
519 {
520 struct iscsi_session *is = arg;
521
522 ISCSI_SESSION_LOCK(is);
523 for (;;) {
524 if (is->is_reconnecting == false &&
525 is->is_terminating == false &&
526 (STAILQ_EMPTY(&is->is_postponed) ||
527 ISCSI_SNGT(is->is_cmdsn, is->is_maxcmdsn)))
528 cv_wait(&is->is_maintenance_cv, &is->is_lock);
529
530 /* Terminate supersedes reconnect. */
531 if (is->is_terminating) {
532 ISCSI_SESSION_UNLOCK(is);
533 iscsi_maintenance_thread_terminate(is);
534 kthread_exit();
535 return;
536 }
537
538 if (is->is_reconnecting) {
539 ISCSI_SESSION_UNLOCK(is);
540 iscsi_maintenance_thread_reconnect(is);
541 ISCSI_SESSION_LOCK(is);
542 continue;
543 }
544
545 iscsi_session_send_postponed(is);
546 }
547 ISCSI_SESSION_UNLOCK(is);
548 }
549
550 static void
iscsi_session_reconnect(struct iscsi_session * is)551 iscsi_session_reconnect(struct iscsi_session *is)
552 {
553
554 /*
555 * XXX: We can't use locking here, because
556 * it's being called from various contexts.
557 * Hope it doesn't break anything.
558 */
559 if (is->is_reconnecting)
560 return;
561
562 is->is_reconnecting = true;
563 cv_signal(&is->is_maintenance_cv);
564 }
565
566 static void
iscsi_session_terminate(struct iscsi_session * is)567 iscsi_session_terminate(struct iscsi_session *is)
568 {
569
570 if (is->is_terminating)
571 return;
572
573 is->is_terminating = true;
574
575 #if 0
576 iscsi_session_logout(is);
577 #endif
578 cv_signal(&is->is_maintenance_cv);
579 }
580
581 static void
iscsi_callout(void * context)582 iscsi_callout(void *context)
583 {
584 struct icl_pdu *request;
585 struct iscsi_bhs_nop_out *bhsno;
586 struct iscsi_session *is;
587 bool reconnect_needed = false;
588 sbintime_t sbt, pr;
589
590 is = context;
591
592 ISCSI_SESSION_LOCK(is);
593 if (is->is_terminating) {
594 ISCSI_SESSION_UNLOCK(is);
595 return;
596 }
597
598 sbt = mstosbt(995);
599 pr = mstosbt(10);
600 callout_schedule_sbt(&is->is_callout, sbt, pr, 0);
601
602 if (is->is_conf.isc_enable == 0)
603 goto out;
604
605 is->is_timeout++;
606
607 if (is->is_waiting_for_iscsid) {
608 if (iscsid_timeout > 0 && is->is_timeout > iscsid_timeout) {
609 ISCSI_SESSION_WARN(is, "timed out waiting for iscsid(8) "
610 "for %d seconds; reconnecting",
611 is->is_timeout);
612 reconnect_needed = true;
613 }
614 goto out;
615 }
616
617 if (is->is_login_phase) {
618 if (is->is_login_timeout > 0 && is->is_timeout > is->is_login_timeout) {
619 ISCSI_SESSION_WARN(is, "login timed out after %d seconds; "
620 "reconnecting", is->is_timeout);
621 reconnect_needed = true;
622 }
623 goto out;
624 }
625
626 if (is->is_ping_timeout <= 0) {
627 /*
628 * Pings are disabled. Don't send NOP-Out in this case.
629 * Reset the timeout, to avoid triggering reconnection,
630 * should the user decide to reenable them.
631 */
632 is->is_timeout = 0;
633 goto out;
634 }
635
636 if (is->is_timeout >= is->is_ping_timeout) {
637 ISCSI_SESSION_WARN(is, "no ping reply (NOP-In) after %d seconds; "
638 "reconnecting", is->is_ping_timeout);
639 reconnect_needed = true;
640 goto out;
641 }
642
643 ISCSI_SESSION_UNLOCK(is);
644
645 /*
646 * If the ping was reset less than one second ago - which means
647 * that we've received some PDU during the last second - assume
648 * the traffic flows correctly and don't bother sending a NOP-Out.
649 *
650 * (It's 2 - one for one second, and one for incrementing is_timeout
651 * earlier in this routine.)
652 */
653 if (is->is_timeout < 2)
654 return;
655
656 request = icl_pdu_new(is->is_conn, M_NOWAIT);
657 if (request == NULL) {
658 ISCSI_SESSION_WARN(is, "failed to allocate PDU");
659 return;
660 }
661 bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
662 bhsno->bhsno_opcode = ISCSI_BHS_OPCODE_NOP_OUT |
663 ISCSI_BHS_OPCODE_IMMEDIATE;
664 bhsno->bhsno_flags = 0x80;
665 bhsno->bhsno_target_transfer_tag = 0xffffffff;
666 iscsi_pdu_queue(request);
667 return;
668
669 out:
670 if (is->is_terminating) {
671 ISCSI_SESSION_UNLOCK(is);
672 return;
673 }
674
675 ISCSI_SESSION_UNLOCK(is);
676
677 if (reconnect_needed)
678 iscsi_session_reconnect(is);
679 }
680
681 static void
iscsi_pdu_update_statsn(const struct icl_pdu * response)682 iscsi_pdu_update_statsn(const struct icl_pdu *response)
683 {
684 const struct iscsi_bhs_data_in *bhsdi;
685 struct iscsi_session *is;
686 uint32_t expcmdsn, maxcmdsn, statsn;
687
688 is = PDU_SESSION(response);
689
690 ISCSI_SESSION_LOCK_ASSERT(is);
691
692 /*
693 * We're only using fields common for all the response
694 * (target -> initiator) PDUs.
695 */
696 bhsdi = (const struct iscsi_bhs_data_in *)response->ip_bhs;
697 /*
698 * Ok, I lied. In case of Data-In, "The fields StatSN, Status,
699 * and Residual Count only have meaningful content if the S bit
700 * is set to 1", so we also need to check the bit specific for
701 * Data-In PDU.
702 */
703 if (bhsdi->bhsdi_opcode != ISCSI_BHS_OPCODE_SCSI_DATA_IN ||
704 (bhsdi->bhsdi_flags & BHSDI_FLAGS_S) != 0) {
705 statsn = ntohl(bhsdi->bhsdi_statsn);
706 if (statsn != is->is_statsn && statsn != (is->is_statsn + 1)) {
707 /* XXX: This is normal situation for MCS */
708 ISCSI_SESSION_WARN(is, "PDU 0x%x StatSN %u != "
709 "session ExpStatSN %u (or + 1); reconnecting",
710 bhsdi->bhsdi_opcode, statsn, is->is_statsn);
711 iscsi_session_reconnect(is);
712 }
713 if (ISCSI_SNGT(statsn, is->is_statsn))
714 is->is_statsn = statsn;
715 }
716
717 expcmdsn = ntohl(bhsdi->bhsdi_expcmdsn);
718 maxcmdsn = ntohl(bhsdi->bhsdi_maxcmdsn);
719
720 if (ISCSI_SNLT(maxcmdsn + 1, expcmdsn)) {
721 ISCSI_SESSION_DEBUG(is,
722 "PDU MaxCmdSN %u + 1 < PDU ExpCmdSN %u; ignoring",
723 maxcmdsn, expcmdsn);
724 } else {
725 if (ISCSI_SNGT(maxcmdsn, is->is_maxcmdsn)) {
726 is->is_maxcmdsn = maxcmdsn;
727
728 /*
729 * Command window increased; kick the maintanance thread
730 * to send out postponed commands.
731 */
732 if (!STAILQ_EMPTY(&is->is_postponed))
733 cv_signal(&is->is_maintenance_cv);
734 } else if (ISCSI_SNLT(maxcmdsn, is->is_maxcmdsn)) {
735 /* XXX: This is normal situation for MCS */
736 ISCSI_SESSION_DEBUG(is,
737 "PDU MaxCmdSN %u < session MaxCmdSN %u; ignoring",
738 maxcmdsn, is->is_maxcmdsn);
739 }
740
741 if (ISCSI_SNGT(expcmdsn, is->is_expcmdsn)) {
742 is->is_expcmdsn = expcmdsn;
743 } else if (ISCSI_SNLT(expcmdsn, is->is_expcmdsn)) {
744 /* XXX: This is normal situation for MCS */
745 ISCSI_SESSION_DEBUG(is,
746 "PDU ExpCmdSN %u < session ExpCmdSN %u; ignoring",
747 expcmdsn, is->is_expcmdsn);
748 }
749 }
750
751 /*
752 * Every incoming PDU - not just NOP-In - resets the ping timer.
753 * The purpose of the timeout is to reset the connection when it stalls;
754 * we don't want this to happen when NOP-In or NOP-Out ends up delayed
755 * in some queue.
756 */
757 is->is_timeout = 0;
758 }
759
760 static void
iscsi_receive_callback(struct icl_pdu * response)761 iscsi_receive_callback(struct icl_pdu *response)
762 {
763 struct iscsi_session *is;
764
765 is = PDU_SESSION(response);
766
767 ISCSI_SESSION_LOCK(is);
768
769 iscsi_pdu_update_statsn(response);
770
771 #ifdef ICL_KERNEL_PROXY
772 if (is->is_login_phase) {
773 if (is->is_login_pdu == NULL)
774 is->is_login_pdu = response;
775 else
776 icl_pdu_free(response);
777 ISCSI_SESSION_UNLOCK(is);
778 cv_signal(&is->is_login_cv);
779 return;
780 }
781 #endif
782
783 /*
784 * The handling routine is responsible for freeing the PDU
785 * when it's no longer needed.
786 */
787 switch (response->ip_bhs->bhs_opcode) {
788 case ISCSI_BHS_OPCODE_NOP_IN:
789 iscsi_pdu_handle_nop_in(response);
790 ISCSI_SESSION_UNLOCK(is);
791 break;
792 case ISCSI_BHS_OPCODE_SCSI_RESPONSE:
793 iscsi_pdu_handle_scsi_response(response);
794 /* Session lock dropped inside. */
795 ISCSI_SESSION_LOCK_ASSERT_NOT(is);
796 break;
797 case ISCSI_BHS_OPCODE_TASK_RESPONSE:
798 iscsi_pdu_handle_task_response(response);
799 ISCSI_SESSION_UNLOCK(is);
800 break;
801 case ISCSI_BHS_OPCODE_SCSI_DATA_IN:
802 iscsi_pdu_handle_data_in(response);
803 /* Session lock dropped inside. */
804 ISCSI_SESSION_LOCK_ASSERT_NOT(is);
805 break;
806 case ISCSI_BHS_OPCODE_LOGOUT_RESPONSE:
807 iscsi_pdu_handle_logout_response(response);
808 ISCSI_SESSION_UNLOCK(is);
809 break;
810 case ISCSI_BHS_OPCODE_R2T:
811 iscsi_pdu_handle_r2t(response);
812 ISCSI_SESSION_UNLOCK(is);
813 break;
814 case ISCSI_BHS_OPCODE_ASYNC_MESSAGE:
815 iscsi_pdu_handle_async_message(response);
816 ISCSI_SESSION_UNLOCK(is);
817 break;
818 case ISCSI_BHS_OPCODE_REJECT:
819 iscsi_pdu_handle_reject(response);
820 ISCSI_SESSION_UNLOCK(is);
821 break;
822 default:
823 ISCSI_SESSION_WARN(is, "received PDU with unsupported "
824 "opcode 0x%x; reconnecting",
825 response->ip_bhs->bhs_opcode);
826 iscsi_session_reconnect(is);
827 ISCSI_SESSION_UNLOCK(is);
828 icl_pdu_free(response);
829 }
830 }
831
832 static void
iscsi_error_callback(struct icl_conn * ic)833 iscsi_error_callback(struct icl_conn *ic)
834 {
835 struct iscsi_session *is;
836
837 is = CONN_SESSION(ic);
838
839 ISCSI_SESSION_WARN(is, "connection error; reconnecting");
840 iscsi_session_reconnect(is);
841 }
842
843 static void
iscsi_pdu_handle_nop_in(struct icl_pdu * response)844 iscsi_pdu_handle_nop_in(struct icl_pdu *response)
845 {
846 struct iscsi_session *is;
847 struct iscsi_bhs_nop_out *bhsno;
848 struct iscsi_bhs_nop_in *bhsni;
849 struct icl_pdu *request;
850 void *data = NULL;
851 size_t datasize;
852 int error;
853
854 is = PDU_SESSION(response);
855 bhsni = (struct iscsi_bhs_nop_in *)response->ip_bhs;
856
857 if (bhsni->bhsni_target_transfer_tag == 0xffffffff) {
858 /*
859 * Nothing to do; iscsi_pdu_update_statsn() already
860 * zeroed the timeout.
861 */
862 icl_pdu_free(response);
863 return;
864 }
865
866 datasize = icl_pdu_data_segment_length(response);
867 if (datasize > 0) {
868 data = malloc(datasize, M_ISCSI, M_NOWAIT | M_ZERO);
869 if (data == NULL) {
870 ISCSI_SESSION_WARN(is, "failed to allocate memory; "
871 "reconnecting");
872 icl_pdu_free(response);
873 iscsi_session_reconnect(is);
874 return;
875 }
876 icl_pdu_get_data(response, 0, data, datasize);
877 }
878
879 request = icl_pdu_new(response->ip_conn, M_NOWAIT);
880 if (request == NULL) {
881 ISCSI_SESSION_WARN(is, "failed to allocate memory; "
882 "reconnecting");
883 free(data, M_ISCSI);
884 icl_pdu_free(response);
885 iscsi_session_reconnect(is);
886 return;
887 }
888 bhsno = (struct iscsi_bhs_nop_out *)request->ip_bhs;
889 bhsno->bhsno_opcode = ISCSI_BHS_OPCODE_NOP_OUT |
890 ISCSI_BHS_OPCODE_IMMEDIATE;
891 bhsno->bhsno_flags = 0x80;
892 bhsno->bhsno_initiator_task_tag = 0xffffffff;
893 bhsno->bhsno_target_transfer_tag = bhsni->bhsni_target_transfer_tag;
894 if (datasize > 0) {
895 error = icl_pdu_append_data(request, data, datasize, M_NOWAIT);
896 if (error != 0) {
897 ISCSI_SESSION_WARN(is, "failed to allocate memory; "
898 "reconnecting");
899 free(data, M_ISCSI);
900 icl_pdu_free(request);
901 icl_pdu_free(response);
902 iscsi_session_reconnect(is);
903 return;
904 }
905 free(data, M_ISCSI);
906 }
907
908 icl_pdu_free(response);
909 iscsi_pdu_queue_locked(request);
910 }
911
912 static void
iscsi_pdu_handle_scsi_response(struct icl_pdu * response)913 iscsi_pdu_handle_scsi_response(struct icl_pdu *response)
914 {
915 struct iscsi_bhs_scsi_response *bhssr;
916 struct iscsi_outstanding *io;
917 struct iscsi_session *is;
918 union ccb *ccb;
919 struct ccb_scsiio *csio;
920 size_t data_segment_len, received;
921 uint16_t sense_len;
922 uint32_t resid;
923
924 is = PDU_SESSION(response);
925
926 bhssr = (struct iscsi_bhs_scsi_response *)response->ip_bhs;
927 io = iscsi_outstanding_find(is, bhssr->bhssr_initiator_task_tag);
928 if (io == NULL || io->io_ccb == NULL) {
929 ISCSI_SESSION_WARN(is, "bad itt 0x%x", bhssr->bhssr_initiator_task_tag);
930 icl_pdu_free(response);
931 iscsi_session_reconnect(is);
932 ISCSI_SESSION_UNLOCK(is);
933 return;
934 }
935
936 ccb = io->io_ccb;
937 if (bhssr->bhssr_response == BHSSR_RESPONSE_COMMAND_COMPLETED) {
938 if (ntohl(bhssr->bhssr_expdatasn) != io->io_datasn) {
939 ISCSI_SESSION_WARN(is,
940 "ExpDataSN mismatch in SCSI Response (%u vs %u)",
941 ntohl(bhssr->bhssr_expdatasn), io->io_datasn);
942
943 /*
944 * XXX: Permit an ExpDataSN of zero for errors.
945 *
946 * This doesn't conform to RFC 7143, but some
947 * targets seem to do this.
948 */
949 if (bhssr->bhssr_status != 0 &&
950 bhssr->bhssr_expdatasn == htonl(0))
951 goto skip_expdatasn;
952
953 icl_pdu_free(response);
954 iscsi_session_reconnect(is);
955 ISCSI_SESSION_UNLOCK(is);
956 return;
957 }
958 } else {
959 if (bhssr->bhssr_expdatasn != htonl(0)) {
960 ISCSI_SESSION_WARN(is,
961 "ExpDataSN mismatch in SCSI Response (%u vs 0)",
962 ntohl(bhssr->bhssr_expdatasn));
963 icl_pdu_free(response);
964 iscsi_session_reconnect(is);
965 ISCSI_SESSION_UNLOCK(is);
966 return;
967 }
968 }
969 skip_expdatasn:
970
971 /*
972 * With iSER, after getting good response we can be sure
973 * that all the data has been successfully transferred.
974 */
975 if (is->is_conn->ic_iser) {
976 resid = ntohl(bhssr->bhssr_residual_count);
977 if (bhssr->bhssr_flags & BHSSR_FLAGS_RESIDUAL_UNDERFLOW) {
978 io->io_received = ccb->csio.dxfer_len - resid;
979 } else if (bhssr->bhssr_flags & BHSSR_FLAGS_RESIDUAL_OVERFLOW) {
980 ISCSI_SESSION_WARN(is, "overflow: target indicates %d", resid);
981 } else {
982 io->io_received = ccb->csio.dxfer_len;
983 }
984 }
985
986 received = io->io_received;
987 iscsi_outstanding_remove(is, io);
988 ISCSI_SESSION_UNLOCK(is);
989
990 if (bhssr->bhssr_response != BHSSR_RESPONSE_COMMAND_COMPLETED) {
991 ISCSI_SESSION_WARN(is, "service response 0x%x", bhssr->bhssr_response);
992 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
993 xpt_freeze_devq(ccb->ccb_h.path, 1);
994 ISCSI_SESSION_DEBUG(is, "freezing devq");
995 }
996 ccb->ccb_h.status = CAM_REQ_CMP_ERR | CAM_DEV_QFRZN;
997 } else if (bhssr->bhssr_status == 0) {
998 ccb->ccb_h.status = CAM_REQ_CMP;
999 } else {
1000 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
1001 xpt_freeze_devq(ccb->ccb_h.path, 1);
1002 ISCSI_SESSION_DEBUG(is, "freezing devq");
1003 }
1004 ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR | CAM_DEV_QFRZN;
1005 ccb->csio.scsi_status = bhssr->bhssr_status;
1006 }
1007
1008 csio = &ccb->csio;
1009 data_segment_len = icl_pdu_data_segment_length(response);
1010 if (data_segment_len > 0) {
1011 if (data_segment_len < sizeof(sense_len)) {
1012 ISCSI_SESSION_WARN(is, "truncated data segment (%zd bytes)",
1013 data_segment_len);
1014 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
1015 xpt_freeze_devq(ccb->ccb_h.path, 1);
1016 ISCSI_SESSION_DEBUG(is, "freezing devq");
1017 }
1018 ccb->ccb_h.status = CAM_REQ_CMP_ERR | CAM_DEV_QFRZN;
1019 goto out;
1020 }
1021 icl_pdu_get_data(response, 0, &sense_len, sizeof(sense_len));
1022 sense_len = ntohs(sense_len);
1023 #if 0
1024 ISCSI_SESSION_DEBUG(is, "sense_len %d, data len %zd",
1025 sense_len, data_segment_len);
1026 #endif
1027 if (sizeof(sense_len) + sense_len > data_segment_len) {
1028 ISCSI_SESSION_WARN(is, "truncated data segment "
1029 "(%zd bytes, should be %zd)",
1030 data_segment_len, sizeof(sense_len) + sense_len);
1031 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
1032 xpt_freeze_devq(ccb->ccb_h.path, 1);
1033 ISCSI_SESSION_DEBUG(is, "freezing devq");
1034 }
1035 ccb->ccb_h.status = CAM_REQ_CMP_ERR | CAM_DEV_QFRZN;
1036 goto out;
1037 } else if (sizeof(sense_len) + sense_len < data_segment_len)
1038 ISCSI_SESSION_WARN(is, "oversize data segment "
1039 "(%zd bytes, should be %zd)",
1040 data_segment_len, sizeof(sense_len) + sense_len);
1041 if (sense_len > csio->sense_len) {
1042 ISCSI_SESSION_DEBUG(is, "truncating sense from %d to %d",
1043 sense_len, csio->sense_len);
1044 sense_len = csio->sense_len;
1045 }
1046 icl_pdu_get_data(response, sizeof(sense_len), &csio->sense_data, sense_len);
1047 csio->sense_resid = csio->sense_len - sense_len;
1048 ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
1049 }
1050
1051 out:
1052 if (bhssr->bhssr_flags & BHSSR_FLAGS_RESIDUAL_UNDERFLOW)
1053 csio->resid = ntohl(bhssr->bhssr_residual_count);
1054
1055 if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1056 KASSERT(received <= csio->dxfer_len,
1057 ("received > csio->dxfer_len"));
1058 if (received < csio->dxfer_len) {
1059 if (csio->resid != csio->dxfer_len - received) {
1060 ISCSI_SESSION_WARN(is, "underflow mismatch: "
1061 "target indicates %d, we calculated %zd",
1062 csio->resid, csio->dxfer_len - received);
1063 }
1064 csio->resid = csio->dxfer_len - received;
1065 }
1066 }
1067
1068 xpt_done(ccb);
1069 icl_pdu_free(response);
1070 }
1071
1072 static void
iscsi_pdu_handle_task_response(struct icl_pdu * response)1073 iscsi_pdu_handle_task_response(struct icl_pdu *response)
1074 {
1075 struct iscsi_bhs_task_management_response *bhstmr;
1076 struct iscsi_outstanding *io, *aio;
1077 struct iscsi_session *is;
1078
1079 is = PDU_SESSION(response);
1080
1081 bhstmr = (struct iscsi_bhs_task_management_response *)response->ip_bhs;
1082 io = iscsi_outstanding_find(is, bhstmr->bhstmr_initiator_task_tag);
1083 if (io == NULL || io->io_ccb != NULL) {
1084 ISCSI_SESSION_WARN(is, "bad itt 0x%x",
1085 bhstmr->bhstmr_initiator_task_tag);
1086 icl_pdu_free(response);
1087 iscsi_session_reconnect(is);
1088 return;
1089 }
1090
1091 if (bhstmr->bhstmr_response != BHSTMR_RESPONSE_FUNCTION_COMPLETE) {
1092 ISCSI_SESSION_WARN(is, "task response 0x%x",
1093 bhstmr->bhstmr_response);
1094 } else {
1095 aio = iscsi_outstanding_find(is, io->io_referenced_task_tag);
1096 if (aio != NULL && aio->io_ccb != NULL)
1097 iscsi_session_terminate_task(is, aio, CAM_REQ_ABORTED);
1098 }
1099
1100 iscsi_outstanding_remove(is, io);
1101 icl_pdu_free(response);
1102 }
1103
1104 static void
iscsi_pdu_get_data_csio(struct icl_pdu * response,size_t pdu_offset,struct ccb_scsiio * csio,size_t oreceived,size_t data_segment_len)1105 iscsi_pdu_get_data_csio(struct icl_pdu *response, size_t pdu_offset,
1106 struct ccb_scsiio *csio, size_t oreceived, size_t data_segment_len)
1107 {
1108 switch (csio->ccb_h.flags & CAM_DATA_MASK) {
1109 case CAM_DATA_BIO:
1110 icl_pdu_get_bio(response, pdu_offset,
1111 (struct bio *)csio->data_ptr, oreceived, data_segment_len);
1112 break;
1113 case CAM_DATA_VADDR:
1114 icl_pdu_get_data(response, pdu_offset,
1115 csio->data_ptr + oreceived, data_segment_len);
1116 break;
1117 default:
1118 __assert_unreachable();
1119 }
1120 }
1121
1122 static void
iscsi_pdu_handle_data_in(struct icl_pdu * response)1123 iscsi_pdu_handle_data_in(struct icl_pdu *response)
1124 {
1125 struct iscsi_bhs_data_in *bhsdi;
1126 struct iscsi_outstanding *io;
1127 struct iscsi_session *is;
1128 union ccb *ccb;
1129 struct ccb_scsiio *csio;
1130 size_t data_segment_len, received, oreceived;
1131
1132 is = PDU_SESSION(response);
1133 bhsdi = (struct iscsi_bhs_data_in *)response->ip_bhs;
1134 io = iscsi_outstanding_find(is, bhsdi->bhsdi_initiator_task_tag);
1135 if (io == NULL || io->io_ccb == NULL) {
1136 ISCSI_SESSION_WARN(is, "bad itt 0x%x", bhsdi->bhsdi_initiator_task_tag);
1137 icl_pdu_free(response);
1138 iscsi_session_reconnect(is);
1139 ISCSI_SESSION_UNLOCK(is);
1140 return;
1141 }
1142
1143 if (io->io_datasn != ntohl(bhsdi->bhsdi_datasn)) {
1144 ISCSI_SESSION_WARN(is, "received Data-In PDU with "
1145 "DataSN %u, while expected %u; dropping connection",
1146 ntohl(bhsdi->bhsdi_datasn), io->io_datasn);
1147 icl_pdu_free(response);
1148 iscsi_session_reconnect(is);
1149 ISCSI_SESSION_UNLOCK(is);
1150 return;
1151 }
1152 io->io_datasn += response->ip_additional_pdus + 1;
1153
1154 data_segment_len = icl_pdu_data_segment_length(response);
1155 if (data_segment_len == 0) {
1156 /*
1157 * "The sending of 0 length data segments should be avoided,
1158 * but initiators and targets MUST be able to properly receive
1159 * 0 length data segments."
1160 */
1161 ISCSI_SESSION_UNLOCK(is);
1162 icl_pdu_free(response);
1163 return;
1164 }
1165
1166 /*
1167 * We need to track this for security reasons - without it, malicious target
1168 * could respond to SCSI READ without sending Data-In PDUs, which would result
1169 * in read operation on the initiator side returning random kernel data.
1170 */
1171 if (ntohl(bhsdi->bhsdi_buffer_offset) != io->io_received) {
1172 ISCSI_SESSION_WARN(is, "data out of order; expected offset %zd, got %zd",
1173 io->io_received, (size_t)ntohl(bhsdi->bhsdi_buffer_offset));
1174 icl_pdu_free(response);
1175 iscsi_session_reconnect(is);
1176 ISCSI_SESSION_UNLOCK(is);
1177 return;
1178 }
1179
1180 ccb = io->io_ccb;
1181 csio = &ccb->csio;
1182
1183 if (io->io_received + data_segment_len > csio->dxfer_len) {
1184 ISCSI_SESSION_WARN(is, "oversize data segment (%zd bytes "
1185 "at offset %zd, buffer is %d)",
1186 data_segment_len, io->io_received, csio->dxfer_len);
1187 icl_pdu_free(response);
1188 iscsi_session_reconnect(is);
1189 ISCSI_SESSION_UNLOCK(is);
1190 return;
1191 }
1192
1193 oreceived = io->io_received;
1194 io->io_received += data_segment_len;
1195 received = io->io_received;
1196 if ((bhsdi->bhsdi_flags & BHSDI_FLAGS_S) != 0)
1197 iscsi_outstanding_remove(is, io);
1198 ISCSI_SESSION_UNLOCK(is);
1199
1200 iscsi_pdu_get_data_csio(response, 0, csio, oreceived, data_segment_len);
1201
1202 /*
1203 * XXX: Check F.
1204 */
1205 if ((bhsdi->bhsdi_flags & BHSDI_FLAGS_S) == 0) {
1206 /*
1207 * Nothing more to do.
1208 */
1209 icl_pdu_free(response);
1210 return;
1211 }
1212
1213 //ISCSI_SESSION_DEBUG(is, "got S flag; status 0x%x", bhsdi->bhsdi_status);
1214 if (bhsdi->bhsdi_status == 0) {
1215 ccb->ccb_h.status = CAM_REQ_CMP;
1216 } else {
1217 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
1218 xpt_freeze_devq(ccb->ccb_h.path, 1);
1219 ISCSI_SESSION_DEBUG(is, "freezing devq");
1220 }
1221 ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR | CAM_DEV_QFRZN;
1222 csio->scsi_status = bhsdi->bhsdi_status;
1223 }
1224
1225 if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1226 KASSERT(received <= csio->dxfer_len,
1227 ("received > csio->dxfer_len"));
1228 if (received < csio->dxfer_len) {
1229 csio->resid = ntohl(bhsdi->bhsdi_residual_count);
1230 if (csio->resid != csio->dxfer_len - received) {
1231 ISCSI_SESSION_WARN(is, "underflow mismatch: "
1232 "target indicates %d, we calculated %zd",
1233 csio->resid, csio->dxfer_len - received);
1234 }
1235 csio->resid = csio->dxfer_len - received;
1236 }
1237 }
1238
1239 xpt_done(ccb);
1240 icl_pdu_free(response);
1241 }
1242
1243 static void
iscsi_pdu_handle_logout_response(struct icl_pdu * response)1244 iscsi_pdu_handle_logout_response(struct icl_pdu *response)
1245 {
1246
1247 ISCSI_SESSION_DEBUG(PDU_SESSION(response), "logout response");
1248 icl_pdu_free(response);
1249 }
1250
1251 static int
iscsi_pdu_append_data_csio(struct icl_pdu * request,struct ccb_scsiio * csio,size_t off,size_t len,int how)1252 iscsi_pdu_append_data_csio(struct icl_pdu *request, struct ccb_scsiio *csio,
1253 size_t off, size_t len, int how)
1254 {
1255 switch (csio->ccb_h.flags & CAM_DATA_MASK) {
1256 case CAM_DATA_BIO:
1257 return (icl_pdu_append_bio(request,
1258 (struct bio *)csio->data_ptr, off, len, how));
1259 case CAM_DATA_VADDR:
1260 return (icl_pdu_append_data(request, csio->data_ptr + off, len,
1261 how));
1262 default:
1263 __assert_unreachable();
1264 }
1265 }
1266
1267 static void
iscsi_pdu_handle_r2t(struct icl_pdu * response)1268 iscsi_pdu_handle_r2t(struct icl_pdu *response)
1269 {
1270 struct icl_pdu *request;
1271 struct iscsi_session *is;
1272 struct iscsi_bhs_r2t *bhsr2t;
1273 struct iscsi_bhs_data_out *bhsdo;
1274 struct iscsi_outstanding *io;
1275 struct ccb_scsiio *csio;
1276 size_t off, len, max_send_data_segment_length, total_len;
1277 int error;
1278 uint32_t datasn = 0;
1279
1280 is = PDU_SESSION(response);
1281
1282 bhsr2t = (struct iscsi_bhs_r2t *)response->ip_bhs;
1283 io = iscsi_outstanding_find(is, bhsr2t->bhsr2t_initiator_task_tag);
1284 if (io == NULL || io->io_ccb == NULL) {
1285 ISCSI_SESSION_WARN(is, "bad itt 0x%x; reconnecting",
1286 bhsr2t->bhsr2t_initiator_task_tag);
1287 icl_pdu_free(response);
1288 iscsi_session_reconnect(is);
1289 return;
1290 }
1291
1292 csio = &io->io_ccb->csio;
1293
1294 if ((csio->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_OUT) {
1295 ISCSI_SESSION_WARN(is, "received R2T for read command; reconnecting");
1296 icl_pdu_free(response);
1297 iscsi_session_reconnect(is);
1298 return;
1299 }
1300
1301 /*
1302 * XXX: Verify R2TSN.
1303 */
1304
1305 off = ntohl(bhsr2t->bhsr2t_buffer_offset);
1306 if (off > csio->dxfer_len) {
1307 ISCSI_SESSION_WARN(is, "target requested invalid offset "
1308 "%zd, buffer is %d; reconnecting", off, csio->dxfer_len);
1309 icl_pdu_free(response);
1310 iscsi_session_reconnect(is);
1311 return;
1312 }
1313
1314 total_len = ntohl(bhsr2t->bhsr2t_desired_data_transfer_length);
1315 if (total_len == 0 || total_len > csio->dxfer_len) {
1316 ISCSI_SESSION_WARN(is, "target requested invalid length "
1317 "%zd, buffer is %d; reconnecting", total_len, csio->dxfer_len);
1318 icl_pdu_free(response);
1319 iscsi_session_reconnect(is);
1320 return;
1321 }
1322
1323 //ISCSI_SESSION_DEBUG(is, "r2t; off %zd, len %zd", off, total_len);
1324
1325 if (is->is_conn->ic_hw_isomax != 0)
1326 max_send_data_segment_length = is->is_conn->ic_hw_isomax;
1327 else
1328 max_send_data_segment_length =
1329 is->is_conn->ic_max_send_data_segment_length;
1330 for (;;) {
1331 len = total_len;
1332
1333 if (len > max_send_data_segment_length)
1334 len = max_send_data_segment_length;
1335
1336 if (off + len > csio->dxfer_len) {
1337 ISCSI_SESSION_WARN(is, "target requested invalid "
1338 "length/offset %zd, buffer is %d; reconnecting",
1339 off + len, csio->dxfer_len);
1340 icl_pdu_free(response);
1341 iscsi_session_reconnect(is);
1342 return;
1343 }
1344
1345 request = icl_pdu_new(response->ip_conn, M_NOWAIT);
1346 if (request == NULL) {
1347 icl_pdu_free(response);
1348 iscsi_session_reconnect(is);
1349 return;
1350 }
1351
1352 bhsdo = (struct iscsi_bhs_data_out *)request->ip_bhs;
1353 bhsdo->bhsdo_opcode = ISCSI_BHS_OPCODE_SCSI_DATA_OUT;
1354 bhsdo->bhsdo_lun = bhsr2t->bhsr2t_lun;
1355 bhsdo->bhsdo_initiator_task_tag =
1356 bhsr2t->bhsr2t_initiator_task_tag;
1357 bhsdo->bhsdo_target_transfer_tag =
1358 bhsr2t->bhsr2t_target_transfer_tag;
1359 bhsdo->bhsdo_datasn = htonl(datasn);
1360 bhsdo->bhsdo_buffer_offset = htonl(off);
1361 error = iscsi_pdu_append_data_csio(request, csio, off, len,
1362 M_NOWAIT | ICL_NOCOPY);
1363 if (error != 0) {
1364 ISCSI_SESSION_WARN(is, "failed to allocate memory; "
1365 "reconnecting");
1366 icl_pdu_free(request);
1367 icl_pdu_free(response);
1368 iscsi_session_reconnect(is);
1369 return;
1370 }
1371
1372 datasn += howmany(len,
1373 is->is_conn->ic_max_send_data_segment_length);
1374 off += len;
1375 total_len -= len;
1376
1377 if (total_len == 0) {
1378 bhsdo->bhsdo_flags |= BHSDO_FLAGS_F;
1379 //ISCSI_SESSION_DEBUG(is, "setting F, off %zd", off);
1380 } else {
1381 //ISCSI_SESSION_DEBUG(is, "not finished, off %zd", off);
1382 }
1383
1384 iscsi_pdu_queue_locked(request);
1385
1386 if (total_len == 0)
1387 break;
1388 }
1389
1390 icl_pdu_free(response);
1391 }
1392
1393 static void
iscsi_pdu_handle_async_message(struct icl_pdu * response)1394 iscsi_pdu_handle_async_message(struct icl_pdu *response)
1395 {
1396 struct iscsi_bhs_asynchronous_message *bhsam;
1397 struct iscsi_session *is;
1398
1399 is = PDU_SESSION(response);
1400 bhsam = (struct iscsi_bhs_asynchronous_message *)response->ip_bhs;
1401 switch (bhsam->bhsam_async_event) {
1402 case BHSAM_EVENT_TARGET_REQUESTS_LOGOUT:
1403 ISCSI_SESSION_WARN(is, "target requests logout; removing session");
1404 iscsi_session_logout(is);
1405 iscsi_session_terminate(is);
1406 break;
1407 case BHSAM_EVENT_TARGET_TERMINATES_CONNECTION:
1408 ISCSI_SESSION_WARN(is, "target indicates it will drop the connection");
1409 break;
1410 case BHSAM_EVENT_TARGET_TERMINATES_SESSION:
1411 ISCSI_SESSION_WARN(is, "target indicates it will drop the session");
1412 break;
1413 default:
1414 /*
1415 * XXX: Technically, we're obligated to also handle
1416 * parameter renegotiation.
1417 */
1418 ISCSI_SESSION_WARN(is, "ignoring AsyncEvent %d", bhsam->bhsam_async_event);
1419 break;
1420 }
1421
1422 icl_pdu_free(response);
1423 }
1424
1425 static void
iscsi_pdu_handle_reject(struct icl_pdu * response)1426 iscsi_pdu_handle_reject(struct icl_pdu *response)
1427 {
1428 struct iscsi_bhs_reject *bhsr;
1429 struct iscsi_session *is;
1430
1431 is = PDU_SESSION(response);
1432 bhsr = (struct iscsi_bhs_reject *)response->ip_bhs;
1433 ISCSI_SESSION_WARN(is, "received Reject PDU, reason 0x%x; protocol error?",
1434 bhsr->bhsr_reason);
1435
1436 icl_pdu_free(response);
1437 }
1438
1439 static int
iscsi_ioctl_daemon_wait(struct iscsi_softc * sc,struct iscsi_daemon_request * request,bool freebsd13)1440 iscsi_ioctl_daemon_wait(struct iscsi_softc *sc,
1441 struct iscsi_daemon_request *request, bool freebsd13)
1442 {
1443 struct iscsi_session *is;
1444 int error;
1445
1446 sx_slock(&sc->sc_lock);
1447 for (;;) {
1448 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
1449 ISCSI_SESSION_LOCK(is);
1450 if (is->is_conf.isc_enable == 0 &&
1451 is->is_conf.isc_discovery == 0) {
1452 ISCSI_SESSION_UNLOCK(is);
1453 continue;
1454 }
1455 if (is->is_waiting_for_iscsid)
1456 break;
1457 ISCSI_SESSION_UNLOCK(is);
1458 }
1459
1460 if (is == NULL) {
1461 if (sc->sc_unloading) {
1462 sx_sunlock(&sc->sc_lock);
1463 return (ENXIO);
1464 }
1465
1466 /*
1467 * No session requires attention from iscsid(8); wait.
1468 */
1469 error = cv_wait_sig(&sc->sc_cv, &sc->sc_lock);
1470 if (error != 0) {
1471 sx_sunlock(&sc->sc_lock);
1472 return (error);
1473 }
1474 continue;
1475 }
1476
1477 is->is_waiting_for_iscsid = false;
1478 is->is_login_phase = true;
1479 is->is_reason[0] = '\0';
1480 ISCSI_SESSION_UNLOCK(is);
1481
1482 request->idr_session_id = is->is_id;
1483 memcpy(&request->idr_isid, &is->is_isid,
1484 sizeof(request->idr_isid));
1485 request->idr_tsih = 0; /* New or reinstated session. */
1486 memcpy(&request->idr_conf, &is->is_conf,
1487 sizeof(request->idr_conf));
1488
1489 #ifdef COMPAT_FREEBSD13
1490 if (freebsd13) {
1491 struct icl_drv_limits idl;
1492 struct iscsi_daemon_request13 *request13;
1493
1494 error = icl_limits(is->is_conf.isc_offload,
1495 is->is_conf.isc_iser, 0, &idl);
1496 if (error != 0) {
1497 ISCSI_SESSION_WARN(is, "icl_limits for "
1498 "offload \"%s\" failed with error %d",
1499 is->is_conf.isc_offload, error);
1500 sx_sunlock(&sc->sc_lock);
1501 return (error);
1502 }
1503 request13 = (struct iscsi_daemon_request13 *)request;
1504 request13->idr_limits.isl_max_recv_data_segment_length =
1505 idl.idl_max_recv_data_segment_length;
1506 request13->idr_limits.isl_max_send_data_segment_length =
1507 idl.idl_max_send_data_segment_length;
1508 request13->idr_limits.isl_max_burst_length =
1509 idl.idl_max_burst_length;
1510 request13->idr_limits.isl_first_burst_length =
1511 idl.idl_first_burst_length;
1512 }
1513 #endif
1514 sx_sunlock(&sc->sc_lock);
1515 return (0);
1516 }
1517 }
1518
1519 static int
iscsi_ioctl_daemon_limits(struct iscsi_softc * sc,struct iscsi_daemon_limits * limits)1520 iscsi_ioctl_daemon_limits(struct iscsi_softc *sc,
1521 struct iscsi_daemon_limits *limits)
1522 {
1523 struct icl_drv_limits idl;
1524 struct iscsi_session *is;
1525 int error;
1526
1527 sx_slock(&sc->sc_lock);
1528
1529 /*
1530 * Find the session to fetch limits for.
1531 */
1532 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
1533 if (is->is_id == limits->idl_session_id)
1534 break;
1535 }
1536 if (is == NULL) {
1537 sx_sunlock(&sc->sc_lock);
1538 return (ESRCH);
1539 }
1540
1541 error = icl_limits(is->is_conf.isc_offload, is->is_conf.isc_iser,
1542 limits->idl_socket, &idl);
1543 sx_sunlock(&sc->sc_lock);
1544 if (error != 0) {
1545 ISCSI_SESSION_WARN(is, "icl_limits for offload \"%s\" "
1546 "failed with error %d", is->is_conf.isc_offload, error);
1547 return (error);
1548 }
1549 limits->idl_limits.isl_max_recv_data_segment_length =
1550 idl.idl_max_recv_data_segment_length;
1551 limits->idl_limits.isl_max_send_data_segment_length =
1552 idl.idl_max_send_data_segment_length;
1553 limits->idl_limits.isl_max_burst_length =
1554 idl.idl_max_burst_length;
1555 limits->idl_limits.isl_first_burst_length =
1556 idl.idl_first_burst_length;
1557
1558 return (0);
1559 }
1560
1561 static int
iscsi_ioctl_daemon_handoff(struct iscsi_softc * sc,struct iscsi_daemon_handoff * handoff)1562 iscsi_ioctl_daemon_handoff(struct iscsi_softc *sc,
1563 struct iscsi_daemon_handoff *handoff)
1564 {
1565 struct iscsi_session *is;
1566 struct icl_conn *ic;
1567 int error;
1568
1569 sx_slock(&sc->sc_lock);
1570
1571 /*
1572 * Find the session to hand off socket to.
1573 */
1574 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
1575 if (is->is_id == handoff->idh_session_id)
1576 break;
1577 }
1578 if (is == NULL) {
1579 sx_sunlock(&sc->sc_lock);
1580 return (ESRCH);
1581 }
1582 ISCSI_SESSION_LOCK(is);
1583 ic = is->is_conn;
1584 if (is->is_conf.isc_discovery || is->is_terminating) {
1585 ISCSI_SESSION_UNLOCK(is);
1586 sx_sunlock(&sc->sc_lock);
1587 return (EINVAL);
1588 }
1589 if (is->is_connected) {
1590 /*
1591 * This might have happened because another iscsid(8)
1592 * instance handed off the connection in the meantime.
1593 * Just return.
1594 */
1595 ISCSI_SESSION_WARN(is, "handoff on already connected "
1596 "session");
1597 ISCSI_SESSION_UNLOCK(is);
1598 sx_sunlock(&sc->sc_lock);
1599 return (EBUSY);
1600 }
1601
1602 strlcpy(is->is_target_alias, handoff->idh_target_alias,
1603 sizeof(is->is_target_alias));
1604 is->is_tsih = handoff->idh_tsih;
1605 is->is_statsn = handoff->idh_statsn;
1606 is->is_protocol_level = handoff->idh_protocol_level;
1607 is->is_initial_r2t = handoff->idh_initial_r2t;
1608 is->is_immediate_data = handoff->idh_immediate_data;
1609
1610 ic->ic_max_recv_data_segment_length =
1611 handoff->idh_max_recv_data_segment_length;
1612 ic->ic_max_send_data_segment_length =
1613 handoff->idh_max_send_data_segment_length;
1614 is->is_max_burst_length = handoff->idh_max_burst_length;
1615 is->is_first_burst_length = handoff->idh_first_burst_length;
1616
1617 if (handoff->idh_header_digest == ISCSI_DIGEST_CRC32C)
1618 ic->ic_header_crc32c = true;
1619 else
1620 ic->ic_header_crc32c = false;
1621 if (handoff->idh_data_digest == ISCSI_DIGEST_CRC32C)
1622 ic->ic_data_crc32c = true;
1623 else
1624 ic->ic_data_crc32c = false;
1625 ic->ic_maxtags = maxtags;
1626
1627 is->is_cmdsn = 0;
1628 is->is_expcmdsn = 0;
1629 is->is_maxcmdsn = 0;
1630 is->is_waiting_for_iscsid = false;
1631 is->is_login_phase = false;
1632 is->is_timeout = 0;
1633 is->is_ping_timeout = is->is_conf.isc_ping_timeout;
1634 if (is->is_ping_timeout < 0)
1635 is->is_ping_timeout = ping_timeout;
1636 is->is_login_timeout = is->is_conf.isc_login_timeout;
1637 if (is->is_login_timeout < 0)
1638 is->is_login_timeout = login_timeout;
1639 is->is_connected = true;
1640 is->is_reason[0] = '\0';
1641
1642 ISCSI_SESSION_UNLOCK(is);
1643
1644 /*
1645 * If we're going through the proxy, the idh_socket will be 0,
1646 * and the ICL module can simply ignore this call. It can also
1647 * use it to determine it's no longer in the Login phase.
1648 */
1649 error = icl_conn_handoff(ic, handoff->idh_socket);
1650 if (error != 0) {
1651 sx_sunlock(&sc->sc_lock);
1652 iscsi_session_terminate(is);
1653 return (error);
1654 }
1655
1656 sx_sunlock(&sc->sc_lock);
1657
1658 if (is->is_sim != NULL) {
1659 /*
1660 * When reconnecting, there already is SIM allocated for the session.
1661 */
1662 KASSERT(is->is_simq_frozen, ("reconnect without frozen simq"));
1663 ISCSI_SESSION_LOCK(is);
1664 ISCSI_SESSION_DEBUG(is, "releasing");
1665 is->is_simq_frozen = false;
1666 xpt_release_simq(is->is_sim, 1);
1667 ISCSI_SESSION_UNLOCK(is);
1668
1669 } else {
1670 ISCSI_SESSION_LOCK(is);
1671 is->is_devq = cam_simq_alloc(ic->ic_maxtags);
1672 if (is->is_devq == NULL) {
1673 ISCSI_SESSION_UNLOCK(is);
1674 ISCSI_SESSION_WARN(is, "failed to allocate simq");
1675 iscsi_session_terminate(is);
1676 return (ENOMEM);
1677 }
1678
1679 is->is_sim = cam_sim_alloc(iscsi_action, NULL, "iscsi",
1680 is, is->is_id /* unit */, &is->is_lock,
1681 1, ic->ic_maxtags, is->is_devq);
1682 if (is->is_sim == NULL) {
1683 ISCSI_SESSION_UNLOCK(is);
1684 ISCSI_SESSION_WARN(is, "failed to allocate SIM");
1685 cam_simq_free(is->is_devq);
1686 iscsi_session_terminate(is);
1687 return (ENOMEM);
1688 }
1689
1690 if (xpt_bus_register(is->is_sim, NULL, 0) != 0) {
1691 ISCSI_SESSION_UNLOCK(is);
1692 ISCSI_SESSION_WARN(is, "failed to register bus");
1693 iscsi_session_terminate(is);
1694 return (ENOMEM);
1695 }
1696
1697 error = xpt_create_path(&is->is_path, /*periph*/NULL,
1698 cam_sim_path(is->is_sim), CAM_TARGET_WILDCARD,
1699 CAM_LUN_WILDCARD);
1700 if (error != CAM_REQ_CMP) {
1701 ISCSI_SESSION_UNLOCK(is);
1702 ISCSI_SESSION_WARN(is, "failed to create path");
1703 iscsi_session_terminate(is);
1704 return (ENOMEM);
1705 }
1706 ISCSI_SESSION_UNLOCK(is);
1707 }
1708
1709 return (0);
1710 }
1711
1712 static int
iscsi_ioctl_daemon_fail(struct iscsi_softc * sc,struct iscsi_daemon_fail * fail)1713 iscsi_ioctl_daemon_fail(struct iscsi_softc *sc,
1714 struct iscsi_daemon_fail *fail)
1715 {
1716 struct iscsi_session *is;
1717
1718 sx_slock(&sc->sc_lock);
1719
1720 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
1721 if (is->is_id == fail->idf_session_id)
1722 break;
1723 }
1724 if (is == NULL) {
1725 sx_sunlock(&sc->sc_lock);
1726 return (ESRCH);
1727 }
1728 ISCSI_SESSION_LOCK(is);
1729 ISCSI_SESSION_DEBUG(is, "iscsid(8) failed: %s",
1730 fail->idf_reason);
1731 strlcpy(is->is_reason, fail->idf_reason, sizeof(is->is_reason));
1732 //is->is_waiting_for_iscsid = false;
1733 //is->is_login_phase = true;
1734 //iscsi_session_reconnect(is);
1735 ISCSI_SESSION_UNLOCK(is);
1736 sx_sunlock(&sc->sc_lock);
1737
1738 return (0);
1739 }
1740
1741 #ifdef ICL_KERNEL_PROXY
1742 static int
iscsi_ioctl_daemon_connect(struct iscsi_softc * sc,struct iscsi_daemon_connect * idc)1743 iscsi_ioctl_daemon_connect(struct iscsi_softc *sc,
1744 struct iscsi_daemon_connect *idc)
1745 {
1746 struct iscsi_session *is;
1747 struct sockaddr *from_sa, *to_sa;
1748 int error;
1749
1750 sx_slock(&sc->sc_lock);
1751 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
1752 if (is->is_id == idc->idc_session_id)
1753 break;
1754 }
1755 if (is == NULL) {
1756 sx_sunlock(&sc->sc_lock);
1757 return (ESRCH);
1758 }
1759 sx_sunlock(&sc->sc_lock);
1760
1761 if (idc->idc_from_addrlen > 0) {
1762 error = getsockaddr(&from_sa, (void *)idc->idc_from_addr, idc->idc_from_addrlen);
1763 if (error != 0) {
1764 ISCSI_SESSION_WARN(is,
1765 "getsockaddr failed with error %d", error);
1766 return (error);
1767 }
1768 } else {
1769 from_sa = NULL;
1770 }
1771 error = getsockaddr(&to_sa, (void *)idc->idc_to_addr, idc->idc_to_addrlen);
1772 if (error != 0) {
1773 ISCSI_SESSION_WARN(is, "getsockaddr failed with error %d",
1774 error);
1775 free(from_sa, M_SONAME);
1776 return (error);
1777 }
1778
1779 ISCSI_SESSION_LOCK(is);
1780 is->is_statsn = 0;
1781 is->is_cmdsn = 0;
1782 is->is_expcmdsn = 0;
1783 is->is_maxcmdsn = 0;
1784 is->is_waiting_for_iscsid = false;
1785 is->is_login_phase = true;
1786 is->is_timeout = 0;
1787 ISCSI_SESSION_UNLOCK(is);
1788
1789 error = icl_conn_connect(is->is_conn, idc->idc_domain,
1790 idc->idc_socktype, idc->idc_protocol, from_sa, to_sa);
1791 free(from_sa, M_SONAME);
1792 free(to_sa, M_SONAME);
1793
1794 /*
1795 * Digests are always disabled during login phase.
1796 */
1797 is->is_conn->ic_header_crc32c = false;
1798 is->is_conn->ic_data_crc32c = false;
1799
1800 return (error);
1801 }
1802
1803 static int
iscsi_ioctl_daemon_send(struct iscsi_softc * sc,struct iscsi_daemon_send * ids)1804 iscsi_ioctl_daemon_send(struct iscsi_softc *sc,
1805 struct iscsi_daemon_send *ids)
1806 {
1807 struct iscsi_session *is;
1808 struct icl_pdu *ip;
1809 size_t datalen;
1810 void *data;
1811 int error;
1812
1813 sx_slock(&sc->sc_lock);
1814 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
1815 if (is->is_id == ids->ids_session_id)
1816 break;
1817 }
1818 if (is == NULL) {
1819 sx_sunlock(&sc->sc_lock);
1820 return (ESRCH);
1821 }
1822 sx_sunlock(&sc->sc_lock);
1823
1824 if (is->is_login_phase == false)
1825 return (EBUSY);
1826
1827 if (is->is_terminating || is->is_reconnecting)
1828 return (EIO);
1829
1830 datalen = ids->ids_data_segment_len;
1831 if (datalen > is->is_conn->ic_max_send_data_segment_length)
1832 return (EINVAL);
1833 if (datalen > 0) {
1834 data = malloc(datalen, M_ISCSI, M_WAITOK);
1835 error = copyin(ids->ids_data_segment, data, datalen);
1836 if (error != 0) {
1837 free(data, M_ISCSI);
1838 return (error);
1839 }
1840 }
1841
1842 ip = icl_pdu_new(is->is_conn, M_WAITOK);
1843 memcpy(ip->ip_bhs, ids->ids_bhs, sizeof(*ip->ip_bhs));
1844 if (datalen > 0) {
1845 error = icl_pdu_append_data(ip, data, datalen, M_WAITOK);
1846 KASSERT(error == 0, ("icl_pdu_append_data(..., M_WAITOK) failed"));
1847 free(data, M_ISCSI);
1848 }
1849 iscsi_pdu_queue(ip);
1850
1851 return (0);
1852 }
1853
1854 static int
iscsi_ioctl_daemon_receive(struct iscsi_softc * sc,struct iscsi_daemon_receive * idr)1855 iscsi_ioctl_daemon_receive(struct iscsi_softc *sc,
1856 struct iscsi_daemon_receive *idr)
1857 {
1858 struct iscsi_session *is;
1859 struct icl_pdu *ip;
1860 void *data;
1861 int error;
1862
1863 sx_slock(&sc->sc_lock);
1864 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
1865 if (is->is_id == idr->idr_session_id)
1866 break;
1867 }
1868 if (is == NULL) {
1869 sx_sunlock(&sc->sc_lock);
1870 return (ESRCH);
1871 }
1872 sx_sunlock(&sc->sc_lock);
1873
1874 if (is->is_login_phase == false)
1875 return (EBUSY);
1876
1877 ISCSI_SESSION_LOCK(is);
1878 while (is->is_login_pdu == NULL &&
1879 is->is_terminating == false &&
1880 is->is_reconnecting == false) {
1881 error = cv_wait_sig(&is->is_login_cv, &is->is_lock);
1882 if (error != 0) {
1883 ISCSI_SESSION_UNLOCK(is);
1884 return (error);
1885 }
1886 }
1887 if (is->is_terminating || is->is_reconnecting) {
1888 ISCSI_SESSION_UNLOCK(is);
1889 return (EIO);
1890 }
1891 ip = is->is_login_pdu;
1892 is->is_login_pdu = NULL;
1893 ISCSI_SESSION_UNLOCK(is);
1894
1895 if (ip->ip_data_len > idr->idr_data_segment_len) {
1896 icl_pdu_free(ip);
1897 return (EMSGSIZE);
1898 }
1899
1900 error = copyout(ip->ip_bhs, idr->idr_bhs, sizeof(*ip->ip_bhs));
1901 if (error == 0 && ip->ip_data_len > 0) {
1902 data = malloc(ip->ip_data_len, M_ISCSI, M_WAITOK);
1903 icl_pdu_get_data(ip, 0, data, ip->ip_data_len);
1904 error = copyout(data, idr->idr_data_segment, ip->ip_data_len);
1905 free(data, M_ISCSI);
1906 }
1907
1908 icl_pdu_free(ip);
1909
1910 return (error);
1911 }
1912 #endif /* ICL_KERNEL_PROXY */
1913
1914 static void
iscsi_sanitize_session_conf(struct iscsi_session_conf * isc)1915 iscsi_sanitize_session_conf(struct iscsi_session_conf *isc)
1916 {
1917 /*
1918 * Just make sure all the fields are null-terminated.
1919 *
1920 * XXX: This is not particularly secure. We should
1921 * create our own conf and then copy in relevant
1922 * fields.
1923 */
1924 isc->isc_initiator[ISCSI_NAME_LEN - 1] = '\0';
1925 isc->isc_initiator_addr[ISCSI_ADDR_LEN - 1] = '\0';
1926 isc->isc_initiator_alias[ISCSI_ALIAS_LEN - 1] = '\0';
1927 isc->isc_target[ISCSI_NAME_LEN - 1] = '\0';
1928 isc->isc_target_addr[ISCSI_ADDR_LEN - 1] = '\0';
1929 isc->isc_user[ISCSI_NAME_LEN - 1] = '\0';
1930 isc->isc_secret[ISCSI_SECRET_LEN - 1] = '\0';
1931 isc->isc_mutual_user[ISCSI_NAME_LEN - 1] = '\0';
1932 isc->isc_mutual_secret[ISCSI_SECRET_LEN - 1] = '\0';
1933 }
1934
1935 static bool
iscsi_valid_session_conf(const struct iscsi_session_conf * isc)1936 iscsi_valid_session_conf(const struct iscsi_session_conf *isc)
1937 {
1938
1939 if (isc->isc_initiator[0] == '\0') {
1940 ISCSI_DEBUG("empty isc_initiator");
1941 return (false);
1942 }
1943
1944 if (isc->isc_target_addr[0] == '\0') {
1945 ISCSI_DEBUG("empty isc_target_addr");
1946 return (false);
1947 }
1948
1949 if (isc->isc_discovery != 0 && isc->isc_target[0] != 0) {
1950 ISCSI_DEBUG("non-empty isc_target for discovery session");
1951 return (false);
1952 }
1953
1954 if (isc->isc_discovery == 0 && isc->isc_target[0] == 0) {
1955 ISCSI_DEBUG("empty isc_target for non-discovery session");
1956 return (false);
1957 }
1958
1959 return (true);
1960 }
1961
1962 static int
iscsi_ioctl_session_add(struct iscsi_softc * sc,struct iscsi_session_add * isa)1963 iscsi_ioctl_session_add(struct iscsi_softc *sc, struct iscsi_session_add *isa)
1964 {
1965 struct iscsi_session *is;
1966 const struct iscsi_session *is2;
1967 int error;
1968 sbintime_t sbt, pr;
1969
1970 iscsi_sanitize_session_conf(&isa->isa_conf);
1971 if (iscsi_valid_session_conf(&isa->isa_conf) == false)
1972 return (EINVAL);
1973
1974 is = malloc(sizeof(*is), M_ISCSI, M_ZERO | M_WAITOK);
1975 memcpy(&is->is_conf, &isa->isa_conf, sizeof(is->is_conf));
1976
1977 sx_xlock(&sc->sc_lock);
1978
1979 /*
1980 * Prevent duplicates.
1981 */
1982 TAILQ_FOREACH(is2, &sc->sc_sessions, is_next) {
1983 if (!!is->is_conf.isc_discovery !=
1984 !!is2->is_conf.isc_discovery)
1985 continue;
1986
1987 if (strcmp(is->is_conf.isc_target_addr,
1988 is2->is_conf.isc_target_addr) != 0)
1989 continue;
1990
1991 if (is->is_conf.isc_discovery == 0 &&
1992 strcmp(is->is_conf.isc_target,
1993 is2->is_conf.isc_target) != 0)
1994 continue;
1995
1996 sx_xunlock(&sc->sc_lock);
1997 free(is, M_ISCSI);
1998 return (EBUSY);
1999 }
2000
2001 is->is_conn = icl_new_conn(is->is_conf.isc_offload,
2002 is->is_conf.isc_iser, "iscsi", &is->is_lock);
2003 if (is->is_conn == NULL) {
2004 sx_xunlock(&sc->sc_lock);
2005 free(is, M_ISCSI);
2006 return (EINVAL);
2007 }
2008 is->is_conn->ic_receive = iscsi_receive_callback;
2009 is->is_conn->ic_error = iscsi_error_callback;
2010 is->is_conn->ic_prv0 = is;
2011 TAILQ_INIT(&is->is_outstanding);
2012 STAILQ_INIT(&is->is_postponed);
2013 mtx_init(&is->is_lock, "iscsi_lock", NULL, MTX_DEF);
2014 cv_init(&is->is_maintenance_cv, "iscsi_mt");
2015 #ifdef ICL_KERNEL_PROXY
2016 cv_init(&is->is_login_cv, "iscsi_login");
2017 #endif
2018
2019 /*
2020 * Set some default values, from RFC 3720, section 12.
2021 *
2022 * These values are updated by the handoff IOCTL, but are
2023 * needed prior to the handoff to support sending the ISER
2024 * login PDU.
2025 */
2026 is->is_conn->ic_max_recv_data_segment_length = 8192;
2027 is->is_conn->ic_max_send_data_segment_length = 8192;
2028 is->is_max_burst_length = 262144;
2029 is->is_first_burst_length = 65536;
2030
2031 is->is_softc = sc;
2032 sc->sc_last_session_id++;
2033 is->is_id = sc->sc_last_session_id;
2034 is->is_isid[0] = 0x80; /* RFC 3720, 10.12.5: 10b, "Random" ISID. */
2035 arc4rand(&is->is_isid[1], 5, 0);
2036 is->is_tsih = 0;
2037 callout_init(&is->is_callout, 1);
2038
2039 error = kthread_add(iscsi_maintenance_thread, is, NULL, NULL, 0, 0, "iscsimt");
2040 if (error != 0) {
2041 ISCSI_SESSION_WARN(is, "kthread_add(9) failed with error %d", error);
2042 sx_xunlock(&sc->sc_lock);
2043 return (error);
2044 }
2045 is->is_ping_timeout = is->is_conf.isc_ping_timeout;
2046 if (is->is_ping_timeout < 0)
2047 is->is_ping_timeout = ping_timeout;
2048 is->is_login_timeout = is->is_conf.isc_login_timeout;
2049 if (is->is_login_timeout < 0)
2050 is->is_login_timeout = login_timeout;
2051
2052 sbt = mstosbt(995);
2053 pr = mstosbt(10);
2054 callout_reset_sbt(&is->is_callout, sbt, pr, iscsi_callout, is, 0);
2055 TAILQ_INSERT_TAIL(&sc->sc_sessions, is, is_next);
2056
2057 ISCSI_SESSION_LOCK(is);
2058 /*
2059 * Don't notify iscsid(8) if the session is disabled and it's not
2060 * a discovery session,
2061 */
2062 if (is->is_conf.isc_enable == 0 && is->is_conf.isc_discovery == 0) {
2063 ISCSI_SESSION_UNLOCK(is);
2064 sx_xunlock(&sc->sc_lock);
2065 return (0);
2066 }
2067
2068 is->is_waiting_for_iscsid = true;
2069 strlcpy(is->is_reason, "Waiting for iscsid(8)", sizeof(is->is_reason));
2070 ISCSI_SESSION_UNLOCK(is);
2071 cv_signal(&sc->sc_cv);
2072 sx_xunlock(&sc->sc_lock);
2073 return (0);
2074 }
2075
2076 static bool
iscsi_session_conf_matches(unsigned int id1,const struct iscsi_session_conf * c1,unsigned int id2,const struct iscsi_session_conf * c2)2077 iscsi_session_conf_matches(unsigned int id1, const struct iscsi_session_conf *c1,
2078 unsigned int id2, const struct iscsi_session_conf *c2)
2079 {
2080
2081 if (id2 != 0 && id2 != id1)
2082 return (false);
2083 if (c2->isc_target[0] != '\0' &&
2084 strcmp(c1->isc_target, c2->isc_target) != 0)
2085 return (false);
2086 if (c2->isc_target_addr[0] != '\0' &&
2087 strcmp(c1->isc_target_addr, c2->isc_target_addr) != 0)
2088 return (false);
2089 return (true);
2090 }
2091
2092 static int
iscsi_ioctl_session_remove(struct iscsi_softc * sc,struct iscsi_session_remove * isr)2093 iscsi_ioctl_session_remove(struct iscsi_softc *sc,
2094 struct iscsi_session_remove *isr)
2095 {
2096 struct iscsi_session *is, *tmp;
2097 bool found = false;
2098
2099 iscsi_sanitize_session_conf(&isr->isr_conf);
2100
2101 sx_xlock(&sc->sc_lock);
2102 TAILQ_FOREACH_SAFE(is, &sc->sc_sessions, is_next, tmp) {
2103 ISCSI_SESSION_LOCK(is);
2104 if (iscsi_session_conf_matches(is->is_id, &is->is_conf,
2105 isr->isr_session_id, &isr->isr_conf)) {
2106 found = true;
2107 iscsi_session_logout(is);
2108 iscsi_session_terminate(is);
2109 }
2110 ISCSI_SESSION_UNLOCK(is);
2111 }
2112 sx_xunlock(&sc->sc_lock);
2113
2114 if (!found)
2115 return (ESRCH);
2116
2117 return (0);
2118 }
2119
2120 static int
iscsi_ioctl_session_list(struct iscsi_softc * sc,struct iscsi_session_list * isl)2121 iscsi_ioctl_session_list(struct iscsi_softc *sc, struct iscsi_session_list *isl)
2122 {
2123 int error;
2124 unsigned int i = 0;
2125 struct iscsi_session *is;
2126 struct iscsi_session_state iss;
2127
2128 sx_slock(&sc->sc_lock);
2129 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
2130 if (i >= isl->isl_nentries) {
2131 sx_sunlock(&sc->sc_lock);
2132 return (EMSGSIZE);
2133 }
2134 memset(&iss, 0, sizeof(iss));
2135 memcpy(&iss.iss_conf, &is->is_conf, sizeof(iss.iss_conf));
2136 iss.iss_id = is->is_id;
2137 strlcpy(iss.iss_target_alias, is->is_target_alias, sizeof(iss.iss_target_alias));
2138 strlcpy(iss.iss_reason, is->is_reason, sizeof(iss.iss_reason));
2139 strlcpy(iss.iss_offload, is->is_conn->ic_offload, sizeof(iss.iss_offload));
2140
2141 if (is->is_conn->ic_header_crc32c)
2142 iss.iss_header_digest = ISCSI_DIGEST_CRC32C;
2143 else
2144 iss.iss_header_digest = ISCSI_DIGEST_NONE;
2145
2146 if (is->is_conn->ic_data_crc32c)
2147 iss.iss_data_digest = ISCSI_DIGEST_CRC32C;
2148 else
2149 iss.iss_data_digest = ISCSI_DIGEST_NONE;
2150
2151 iss.iss_max_send_data_segment_length =
2152 is->is_conn->ic_max_send_data_segment_length;
2153 iss.iss_max_recv_data_segment_length =
2154 is->is_conn->ic_max_recv_data_segment_length;
2155 iss.iss_max_burst_length = is->is_max_burst_length;
2156 iss.iss_first_burst_length = is->is_first_burst_length;
2157 iss.iss_immediate_data = is->is_immediate_data;
2158 iss.iss_connected = is->is_connected;
2159
2160 error = copyout(&iss, isl->isl_pstates + i, sizeof(iss));
2161 if (error != 0) {
2162 sx_sunlock(&sc->sc_lock);
2163 return (error);
2164 }
2165 i++;
2166 }
2167 sx_sunlock(&sc->sc_lock);
2168
2169 isl->isl_nentries = i;
2170
2171 return (0);
2172 }
2173
2174 static int
iscsi_ioctl_session_modify(struct iscsi_softc * sc,struct iscsi_session_modify * ism)2175 iscsi_ioctl_session_modify(struct iscsi_softc *sc,
2176 struct iscsi_session_modify *ism)
2177 {
2178 struct iscsi_session *is;
2179 const struct iscsi_session *is2;
2180
2181 iscsi_sanitize_session_conf(&ism->ism_conf);
2182 if (iscsi_valid_session_conf(&ism->ism_conf) == false)
2183 return (EINVAL);
2184
2185 sx_xlock(&sc->sc_lock);
2186 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
2187 ISCSI_SESSION_LOCK(is);
2188 if (is->is_id == ism->ism_session_id) {
2189 /* Note that the session remains locked. */
2190 break;
2191 }
2192 ISCSI_SESSION_UNLOCK(is);
2193 }
2194 if (is == NULL) {
2195 sx_xunlock(&sc->sc_lock);
2196 return (ESRCH);
2197 }
2198
2199 /*
2200 * Prevent duplicates.
2201 */
2202 TAILQ_FOREACH(is2, &sc->sc_sessions, is_next) {
2203 if (is == is2)
2204 continue;
2205
2206 if (!!ism->ism_conf.isc_discovery !=
2207 !!is2->is_conf.isc_discovery)
2208 continue;
2209
2210 if (strcmp(ism->ism_conf.isc_target_addr,
2211 is2->is_conf.isc_target_addr) != 0)
2212 continue;
2213
2214 if (ism->ism_conf.isc_discovery == 0 &&
2215 strcmp(ism->ism_conf.isc_target,
2216 is2->is_conf.isc_target) != 0)
2217 continue;
2218
2219 ISCSI_SESSION_UNLOCK(is);
2220 sx_xunlock(&sc->sc_lock);
2221 return (EBUSY);
2222 }
2223
2224 sx_xunlock(&sc->sc_lock);
2225
2226 memcpy(&is->is_conf, &ism->ism_conf, sizeof(is->is_conf));
2227 ISCSI_SESSION_UNLOCK(is);
2228
2229 iscsi_session_reconnect(is);
2230
2231 return (0);
2232 }
2233
2234 static int
iscsi_ioctl(struct cdev * dev,u_long cmd,caddr_t arg,int mode,struct thread * td)2235 iscsi_ioctl(struct cdev *dev, u_long cmd, caddr_t arg, int mode,
2236 struct thread *td)
2237 {
2238 struct iscsi_softc *sc;
2239
2240 sc = dev->si_drv1;
2241
2242 switch (cmd) {
2243 case ISCSIDWAIT:
2244 return (iscsi_ioctl_daemon_wait(sc,
2245 (struct iscsi_daemon_request *)arg, false));
2246 #ifdef COMPAT_FREEBSD13
2247 case ISCSIDWAIT13:
2248 return (iscsi_ioctl_daemon_wait(sc,
2249 (struct iscsi_daemon_request *)arg, true));
2250 #endif
2251 case ISCSIDLIMITS:
2252 return (iscsi_ioctl_daemon_limits(sc,
2253 (struct iscsi_daemon_limits *)arg));
2254 case ISCSIDHANDOFF:
2255 return (iscsi_ioctl_daemon_handoff(sc,
2256 (struct iscsi_daemon_handoff *)arg));
2257 case ISCSIDFAIL:
2258 return (iscsi_ioctl_daemon_fail(sc,
2259 (struct iscsi_daemon_fail *)arg));
2260 #ifdef ICL_KERNEL_PROXY
2261 case ISCSIDCONNECT:
2262 return (iscsi_ioctl_daemon_connect(sc,
2263 (struct iscsi_daemon_connect *)arg));
2264 case ISCSIDSEND:
2265 return (iscsi_ioctl_daemon_send(sc,
2266 (struct iscsi_daemon_send *)arg));
2267 case ISCSIDRECEIVE:
2268 return (iscsi_ioctl_daemon_receive(sc,
2269 (struct iscsi_daemon_receive *)arg));
2270 #endif /* ICL_KERNEL_PROXY */
2271 case ISCSISADD:
2272 return (iscsi_ioctl_session_add(sc,
2273 (struct iscsi_session_add *)arg));
2274 case ISCSISREMOVE:
2275 return (iscsi_ioctl_session_remove(sc,
2276 (struct iscsi_session_remove *)arg));
2277 case ISCSISLIST:
2278 return (iscsi_ioctl_session_list(sc,
2279 (struct iscsi_session_list *)arg));
2280 case ISCSISMODIFY:
2281 return (iscsi_ioctl_session_modify(sc,
2282 (struct iscsi_session_modify *)arg));
2283 default:
2284 return (EINVAL);
2285 }
2286 }
2287
2288 static struct iscsi_outstanding *
iscsi_outstanding_find(struct iscsi_session * is,uint32_t initiator_task_tag)2289 iscsi_outstanding_find(struct iscsi_session *is, uint32_t initiator_task_tag)
2290 {
2291 struct iscsi_outstanding *io;
2292
2293 ISCSI_SESSION_LOCK_ASSERT(is);
2294
2295 TAILQ_FOREACH(io, &is->is_outstanding, io_next) {
2296 if (io->io_initiator_task_tag == initiator_task_tag)
2297 return (io);
2298 }
2299 return (NULL);
2300 }
2301
2302 static struct iscsi_outstanding *
iscsi_outstanding_find_ccb(struct iscsi_session * is,union ccb * ccb)2303 iscsi_outstanding_find_ccb(struct iscsi_session *is, union ccb *ccb)
2304 {
2305 struct iscsi_outstanding *io;
2306
2307 ISCSI_SESSION_LOCK_ASSERT(is);
2308
2309 TAILQ_FOREACH(io, &is->is_outstanding, io_next) {
2310 if (io->io_ccb == ccb)
2311 return (io);
2312 }
2313 return (NULL);
2314 }
2315
2316 static struct iscsi_outstanding *
iscsi_outstanding_add(struct iscsi_session * is,struct icl_pdu * request,union ccb * ccb,uint32_t * initiator_task_tagp)2317 iscsi_outstanding_add(struct iscsi_session *is, struct icl_pdu *request,
2318 union ccb *ccb, uint32_t *initiator_task_tagp)
2319 {
2320 struct iscsi_outstanding *io;
2321 int error;
2322
2323 ISCSI_SESSION_LOCK_ASSERT(is);
2324
2325 io = uma_zalloc(iscsi_outstanding_zone, M_NOWAIT | M_ZERO);
2326 if (io == NULL) {
2327 ISCSI_SESSION_WARN(is, "failed to allocate %zd bytes",
2328 sizeof(*io));
2329 return (NULL);
2330 }
2331
2332 error = icl_conn_task_setup(is->is_conn, request, &ccb->csio,
2333 initiator_task_tagp, &io->io_icl_prv);
2334 if (error != 0) {
2335 ISCSI_SESSION_WARN(is,
2336 "icl_conn_task_setup() failed with error %d", error);
2337 uma_zfree(iscsi_outstanding_zone, io);
2338 return (NULL);
2339 }
2340
2341 KASSERT(iscsi_outstanding_find(is, *initiator_task_tagp) == NULL,
2342 ("initiator_task_tag 0x%x already added", *initiator_task_tagp));
2343
2344 io->io_initiator_task_tag = *initiator_task_tagp;
2345 io->io_ccb = ccb;
2346 TAILQ_INSERT_TAIL(&is->is_outstanding, io, io_next);
2347 return (io);
2348 }
2349
2350 static void
iscsi_outstanding_remove(struct iscsi_session * is,struct iscsi_outstanding * io)2351 iscsi_outstanding_remove(struct iscsi_session *is, struct iscsi_outstanding *io)
2352 {
2353
2354 ISCSI_SESSION_LOCK_ASSERT(is);
2355
2356 icl_conn_task_done(is->is_conn, io->io_icl_prv);
2357 TAILQ_REMOVE(&is->is_outstanding, io, io_next);
2358 uma_zfree(iscsi_outstanding_zone, io);
2359 }
2360
2361 static void
iscsi_action_abort(struct iscsi_session * is,union ccb * ccb)2362 iscsi_action_abort(struct iscsi_session *is, union ccb *ccb)
2363 {
2364 struct icl_pdu *request;
2365 struct iscsi_bhs_task_management_request *bhstmr;
2366 struct ccb_abort *cab = &ccb->cab;
2367 struct iscsi_outstanding *io, *aio;
2368 uint32_t initiator_task_tag;
2369
2370 ISCSI_SESSION_LOCK_ASSERT(is);
2371
2372 #if 0
2373 KASSERT(is->is_login_phase == false, ("%s called during Login Phase", __func__));
2374 #else
2375 if (is->is_login_phase) {
2376 ccb->ccb_h.status = CAM_REQ_ABORTED;
2377 xpt_done(ccb);
2378 return;
2379 }
2380 #endif
2381
2382 aio = iscsi_outstanding_find_ccb(is, cab->abort_ccb);
2383 if (aio == NULL) {
2384 ccb->ccb_h.status = CAM_REQ_CMP;
2385 xpt_done(ccb);
2386 return;
2387 }
2388
2389 request = icl_pdu_new(is->is_conn, M_NOWAIT);
2390 if (request == NULL) {
2391 ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
2392 xpt_done(ccb);
2393 return;
2394 }
2395
2396 initiator_task_tag = is->is_initiator_task_tag++;
2397 if (initiator_task_tag == 0xffffffff)
2398 initiator_task_tag = is->is_initiator_task_tag++;
2399
2400 io = iscsi_outstanding_add(is, request, NULL, &initiator_task_tag);
2401 if (io == NULL) {
2402 icl_pdu_free(request);
2403 ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
2404 xpt_done(ccb);
2405 return;
2406 }
2407 io->io_referenced_task_tag = aio->io_initiator_task_tag;
2408
2409 bhstmr = (struct iscsi_bhs_task_management_request *)request->ip_bhs;
2410 bhstmr->bhstmr_opcode = ISCSI_BHS_OPCODE_TASK_REQUEST;
2411 bhstmr->bhstmr_function = 0x80 | BHSTMR_FUNCTION_ABORT_TASK;
2412 bhstmr->bhstmr_lun = htobe64(CAM_EXTLUN_BYTE_SWIZZLE(ccb->ccb_h.target_lun));
2413 bhstmr->bhstmr_initiator_task_tag = initiator_task_tag;
2414 bhstmr->bhstmr_referenced_task_tag = aio->io_initiator_task_tag;
2415
2416 iscsi_pdu_queue_locked(request);
2417 }
2418
2419 static void
iscsi_action_scsiio(struct iscsi_session * is,union ccb * ccb)2420 iscsi_action_scsiio(struct iscsi_session *is, union ccb *ccb)
2421 {
2422 struct icl_pdu *request;
2423 struct iscsi_bhs_scsi_command *bhssc;
2424 struct ccb_scsiio *csio;
2425 struct iscsi_outstanding *io;
2426 size_t len;
2427 uint32_t initiator_task_tag;
2428 int error;
2429
2430 ISCSI_SESSION_LOCK_ASSERT(is);
2431
2432 #if 0
2433 KASSERT(is->is_login_phase == false, ("%s called during Login Phase", __func__));
2434 #else
2435 if (is->is_login_phase) {
2436 ISCSI_SESSION_DEBUG(is, "called during login phase");
2437 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
2438 xpt_freeze_devq(ccb->ccb_h.path, 1);
2439 ISCSI_SESSION_DEBUG(is, "freezing devq");
2440 }
2441 ccb->ccb_h.status = CAM_REQ_ABORTED | CAM_DEV_QFRZN;
2442 xpt_done(ccb);
2443 return;
2444 }
2445 #endif
2446
2447 request = icl_pdu_new(is->is_conn, M_NOWAIT);
2448 if (request == NULL) {
2449 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
2450 xpt_freeze_devq(ccb->ccb_h.path, 1);
2451 ISCSI_SESSION_DEBUG(is, "freezing devq");
2452 }
2453 ccb->ccb_h.status = CAM_RESRC_UNAVAIL | CAM_DEV_QFRZN;
2454 xpt_done(ccb);
2455 return;
2456 }
2457
2458 initiator_task_tag = is->is_initiator_task_tag++;
2459 if (initiator_task_tag == 0xffffffff)
2460 initiator_task_tag = is->is_initiator_task_tag++;
2461
2462 io = iscsi_outstanding_add(is, request, ccb, &initiator_task_tag);
2463 if (io == NULL) {
2464 icl_pdu_free(request);
2465 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
2466 xpt_freeze_devq(ccb->ccb_h.path, 1);
2467 ISCSI_SESSION_DEBUG(is, "freezing devq");
2468 }
2469 ccb->ccb_h.status = CAM_RESRC_UNAVAIL | CAM_DEV_QFRZN;
2470 xpt_done(ccb);
2471 return;
2472 }
2473
2474 csio = &ccb->csio;
2475 bhssc = (struct iscsi_bhs_scsi_command *)request->ip_bhs;
2476 bhssc->bhssc_opcode = ISCSI_BHS_OPCODE_SCSI_COMMAND;
2477 bhssc->bhssc_flags |= BHSSC_FLAGS_F;
2478 switch (csio->ccb_h.flags & CAM_DIR_MASK) {
2479 case CAM_DIR_IN:
2480 bhssc->bhssc_flags |= BHSSC_FLAGS_R;
2481 break;
2482 case CAM_DIR_OUT:
2483 bhssc->bhssc_flags |= BHSSC_FLAGS_W;
2484 break;
2485 }
2486
2487 if ((ccb->ccb_h.flags & CAM_TAG_ACTION_VALID) != 0) {
2488 switch (csio->tag_action) {
2489 case MSG_HEAD_OF_Q_TAG:
2490 bhssc->bhssc_flags |= BHSSC_FLAGS_ATTR_HOQ;
2491 break;
2492 case MSG_ORDERED_Q_TAG:
2493 bhssc->bhssc_flags |= BHSSC_FLAGS_ATTR_ORDERED;
2494 break;
2495 case MSG_ACA_TASK:
2496 bhssc->bhssc_flags |= BHSSC_FLAGS_ATTR_ACA;
2497 break;
2498 case MSG_SIMPLE_Q_TAG:
2499 default:
2500 bhssc->bhssc_flags |= BHSSC_FLAGS_ATTR_SIMPLE;
2501 break;
2502 }
2503 } else
2504 bhssc->bhssc_flags |= BHSSC_FLAGS_ATTR_UNTAGGED;
2505
2506 if (is->is_protocol_level >= 2) {
2507 bhssc->bhssc_pri = (csio->priority << BHSSC_PRI_SHIFT) &
2508 BHSSC_PRI_MASK;
2509 }
2510
2511 bhssc->bhssc_lun = htobe64(CAM_EXTLUN_BYTE_SWIZZLE(ccb->ccb_h.target_lun));
2512 bhssc->bhssc_initiator_task_tag = initiator_task_tag;
2513 bhssc->bhssc_expected_data_transfer_length = htonl(csio->dxfer_len);
2514 KASSERT(csio->cdb_len <= sizeof(bhssc->bhssc_cdb),
2515 ("unsupported CDB size %zd", (size_t)csio->cdb_len));
2516
2517 if (csio->ccb_h.flags & CAM_CDB_POINTER)
2518 memcpy(&bhssc->bhssc_cdb, csio->cdb_io.cdb_ptr, csio->cdb_len);
2519 else
2520 memcpy(&bhssc->bhssc_cdb, csio->cdb_io.cdb_bytes, csio->cdb_len);
2521
2522 if (is->is_immediate_data &&
2523 (csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_OUT) {
2524 len = csio->dxfer_len;
2525 //ISCSI_SESSION_DEBUG(is, "adding %zd of immediate data", len);
2526 if (len > is->is_first_burst_length) {
2527 ISCSI_SESSION_DEBUG(is, "len %zd -> %d", len, is->is_first_burst_length);
2528 len = is->is_first_burst_length;
2529 }
2530 if (len > is->is_conn->ic_max_send_data_segment_length) {
2531 ISCSI_SESSION_DEBUG(is, "len %zd -> %d", len,
2532 is->is_conn->ic_max_send_data_segment_length);
2533 len = is->is_conn->ic_max_send_data_segment_length;
2534 }
2535
2536 error = iscsi_pdu_append_data_csio(request, csio, 0, len,
2537 M_NOWAIT | ICL_NOCOPY);
2538 if (error != 0) {
2539 iscsi_outstanding_remove(is, io);
2540 icl_pdu_free(request);
2541 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
2542 xpt_freeze_devq(ccb->ccb_h.path, 1);
2543 ISCSI_SESSION_DEBUG(is, "freezing devq");
2544 }
2545 ccb->ccb_h.status = CAM_RESRC_UNAVAIL | CAM_DEV_QFRZN;
2546 xpt_done(ccb);
2547 return;
2548 }
2549 }
2550 iscsi_pdu_queue_locked(request);
2551 }
2552
2553 static void
iscsi_action(struct cam_sim * sim,union ccb * ccb)2554 iscsi_action(struct cam_sim *sim, union ccb *ccb)
2555 {
2556 struct iscsi_session *is;
2557
2558 is = cam_sim_softc(sim);
2559
2560 ISCSI_SESSION_LOCK_ASSERT(is);
2561
2562 if (is->is_terminating ||
2563 (is->is_connected == false && fail_on_disconnection)) {
2564 ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2565 xpt_done(ccb);
2566 return;
2567 }
2568
2569 /*
2570 * Make sure CAM doesn't sneak in a CCB just after freezing the queue.
2571 */
2572 if (is->is_simq_frozen == true) {
2573 ccb->ccb_h.status &= ~(CAM_SIM_QUEUED | CAM_STATUS_MASK);
2574 ccb->ccb_h.status |= CAM_REQUEUE_REQ;
2575 /* Don't freeze the devq - the SIM queue is already frozen. */
2576 xpt_done(ccb);
2577 return;
2578 }
2579
2580 switch (ccb->ccb_h.func_code) {
2581 case XPT_PATH_INQ:
2582 {
2583 struct ccb_pathinq *cpi = &ccb->cpi;
2584
2585 cpi->version_num = 1;
2586 cpi->hba_inquiry = PI_TAG_ABLE;
2587 cpi->target_sprt = 0;
2588 cpi->hba_misc = PIM_EXTLUNS;
2589 /*
2590 * XXX: It shouldn't ever be NULL; this could be turned
2591 * into a KASSERT eventually.
2592 */
2593 if (is->is_conn == NULL)
2594 ISCSI_WARN("NULL conn");
2595 else if (is->is_conn->ic_unmapped)
2596 cpi->hba_misc |= PIM_UNMAPPED;
2597 cpi->hba_eng_cnt = 0;
2598 cpi->max_target = 0;
2599 /*
2600 * Note that the variable below is only relevant for targets
2601 * that don't claim compliance with anything above SPC2, which
2602 * means they don't support REPORT_LUNS.
2603 */
2604 cpi->max_lun = 255;
2605 cpi->initiator_id = ~0;
2606 strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2607 strlcpy(cpi->hba_vid, "iSCSI", HBA_IDLEN);
2608 strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2609 cpi->unit_number = cam_sim_unit(sim);
2610 cpi->bus_id = cam_sim_bus(sim);
2611 cpi->base_transfer_speed = 150000; /* XXX */
2612 cpi->transport = XPORT_ISCSI;
2613 cpi->transport_version = 0;
2614 cpi->protocol = PROTO_SCSI;
2615 cpi->protocol_version = SCSI_REV_SPC3;
2616 cpi->maxio = maxphys;
2617 cpi->ccb_h.status = CAM_REQ_CMP;
2618 break;
2619 }
2620 case XPT_GET_TRAN_SETTINGS:
2621 {
2622 struct ccb_trans_settings *cts;
2623 struct ccb_trans_settings_scsi *scsi;
2624
2625 cts = &ccb->cts;
2626 scsi = &cts->proto_specific.scsi;
2627
2628 cts->protocol = PROTO_SCSI;
2629 cts->protocol_version = SCSI_REV_SPC3;
2630 cts->transport = XPORT_ISCSI;
2631 cts->transport_version = 0;
2632 scsi->valid = CTS_SCSI_VALID_TQ;
2633 scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
2634 cts->ccb_h.status = CAM_REQ_CMP;
2635 break;
2636 }
2637 case XPT_CALC_GEOMETRY:
2638 cam_calc_geometry(&ccb->ccg, /*extended*/1);
2639 ccb->ccb_h.status = CAM_REQ_CMP;
2640 break;
2641 #if 0
2642 /*
2643 * XXX: What's the point?
2644 */
2645 case XPT_RESET_BUS:
2646 case XPT_TERM_IO:
2647 ISCSI_SESSION_DEBUG(is, "faking success for reset, abort, or term_io");
2648 ccb->ccb_h.status = CAM_REQ_CMP;
2649 break;
2650 #endif
2651 case XPT_ABORT:
2652 iscsi_action_abort(is, ccb);
2653 return;
2654 case XPT_SCSI_IO:
2655 iscsi_action_scsiio(is, ccb);
2656 return;
2657 default:
2658 #if 0
2659 ISCSI_SESSION_DEBUG(is, "got unsupported code 0x%x", ccb->ccb_h.func_code);
2660 #endif
2661 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2662 break;
2663 }
2664 xpt_done(ccb);
2665 }
2666
2667 static void
iscsi_terminate_sessions(struct iscsi_softc * sc)2668 iscsi_terminate_sessions(struct iscsi_softc *sc)
2669 {
2670 struct iscsi_session *is;
2671
2672 sx_slock(&sc->sc_lock);
2673 TAILQ_FOREACH(is, &sc->sc_sessions, is_next)
2674 iscsi_session_terminate(is);
2675 while(!TAILQ_EMPTY(&sc->sc_sessions)) {
2676 ISCSI_DEBUG("waiting for sessions to terminate");
2677 cv_wait(&sc->sc_cv, &sc->sc_lock);
2678 }
2679 ISCSI_DEBUG("all sessions terminated");
2680 sx_sunlock(&sc->sc_lock);
2681 }
2682
2683 static void
iscsi_shutdown_pre(struct iscsi_softc * sc,int howto)2684 iscsi_shutdown_pre(struct iscsi_softc *sc, int howto)
2685 {
2686 struct iscsi_session *is;
2687
2688 if (!fail_on_shutdown || (howto & RB_NOSYNC) != 0 ||
2689 SCHEDULER_STOPPED())
2690 return;
2691
2692 /*
2693 * If we have any sessions waiting for reconnection, request
2694 * maintenance thread to fail them immediately instead of waiting
2695 * for reconnect timeout.
2696 *
2697 * This prevents LUNs with mounted filesystems that are supported
2698 * by disconnected iSCSI sessions from hanging, however it will
2699 * fail all queued BIOs.
2700 */
2701 ISCSI_DEBUG("forcing failing all disconnected sessions due to shutdown");
2702
2703 fail_on_disconnection = 1;
2704
2705 sx_slock(&sc->sc_lock);
2706 TAILQ_FOREACH(is, &sc->sc_sessions, is_next) {
2707 ISCSI_SESSION_LOCK(is);
2708 if (!is->is_connected) {
2709 ISCSI_SESSION_DEBUG(is, "force failing disconnected session early");
2710 iscsi_session_reconnect(is);
2711 }
2712 ISCSI_SESSION_UNLOCK(is);
2713 }
2714 sx_sunlock(&sc->sc_lock);
2715 }
2716
2717 static void
iscsi_shutdown_post_sync(struct iscsi_softc * sc,int howto)2718 iscsi_shutdown_post_sync(struct iscsi_softc *sc, int howto)
2719 {
2720
2721 if ((howto & RB_NOSYNC) == 0) {
2722 ISCSI_DEBUG("removing all sessions due to shutdown");
2723 iscsi_terminate_sessions(sc);
2724 }
2725 }
2726
2727 static int
iscsi_load(void)2728 iscsi_load(void)
2729 {
2730 int error;
2731
2732 sc = malloc(sizeof(*sc), M_ISCSI, M_ZERO | M_WAITOK);
2733 sx_init(&sc->sc_lock, "iscsi");
2734 TAILQ_INIT(&sc->sc_sessions);
2735 cv_init(&sc->sc_cv, "iscsi_cv");
2736
2737 iscsi_outstanding_zone = uma_zcreate("iscsi_outstanding",
2738 sizeof(struct iscsi_outstanding), NULL, NULL, NULL, NULL,
2739 UMA_ALIGN_PTR, 0);
2740
2741 error = make_dev_p(MAKEDEV_CHECKNAME, &sc->sc_cdev, &iscsi_cdevsw,
2742 NULL, UID_ROOT, GID_WHEEL, 0600, "iscsi");
2743 if (error != 0) {
2744 ISCSI_WARN("failed to create device node, error %d", error);
2745 return (error);
2746 }
2747 sc->sc_cdev->si_drv1 = sc;
2748
2749 sc->sc_shutdown_pre_eh = EVENTHANDLER_REGISTER(shutdown_pre_sync,
2750 iscsi_shutdown_pre, sc, SHUTDOWN_PRI_FIRST);
2751 /*
2752 * shutdown_post_sync needs to run after filesystem shutdown and before
2753 * CAM shutdown - otherwise when rebooting with an iSCSI session that is
2754 * disconnected but has outstanding requests, dashutdown() will hang on
2755 * cam_periph_runccb().
2756 */
2757 sc->sc_shutdown_post_eh = EVENTHANDLER_REGISTER(shutdown_post_sync,
2758 iscsi_shutdown_post_sync, sc, SHUTDOWN_PRI_DEFAULT - 1);
2759
2760 return (0);
2761 }
2762
2763 static int
iscsi_unload(void)2764 iscsi_unload(void)
2765 {
2766
2767 /* Awaken any threads asleep in iscsi_ioctl(). */
2768 sx_xlock(&sc->sc_lock);
2769 sc->sc_unloading = true;
2770 cv_signal(&sc->sc_cv);
2771 sx_xunlock(&sc->sc_lock);
2772
2773 if (sc->sc_cdev != NULL) {
2774 ISCSI_DEBUG("removing device node");
2775 destroy_dev(sc->sc_cdev);
2776 ISCSI_DEBUG("device node removed");
2777 }
2778
2779 if (sc->sc_shutdown_pre_eh != NULL)
2780 EVENTHANDLER_DEREGISTER(shutdown_pre_sync, sc->sc_shutdown_pre_eh);
2781 if (sc->sc_shutdown_post_eh != NULL)
2782 EVENTHANDLER_DEREGISTER(shutdown_post_sync, sc->sc_shutdown_post_eh);
2783
2784 iscsi_terminate_sessions(sc);
2785
2786 uma_zdestroy(iscsi_outstanding_zone);
2787 sx_destroy(&sc->sc_lock);
2788 cv_destroy(&sc->sc_cv);
2789 free(sc, M_ISCSI);
2790 return (0);
2791 }
2792
2793 static int
iscsi_quiesce(void)2794 iscsi_quiesce(void)
2795 {
2796 sx_slock(&sc->sc_lock);
2797 if (!TAILQ_EMPTY(&sc->sc_sessions)) {
2798 sx_sunlock(&sc->sc_lock);
2799 return (EBUSY);
2800 }
2801 sx_sunlock(&sc->sc_lock);
2802 return (0);
2803 }
2804
2805 static int
iscsi_modevent(module_t mod,int what,void * arg)2806 iscsi_modevent(module_t mod, int what, void *arg)
2807 {
2808 int error;
2809
2810 switch (what) {
2811 case MOD_LOAD:
2812 error = iscsi_load();
2813 break;
2814 case MOD_UNLOAD:
2815 error = iscsi_unload();
2816 break;
2817 case MOD_QUIESCE:
2818 error = iscsi_quiesce();
2819 break;
2820 default:
2821 error = EINVAL;
2822 break;
2823 }
2824 return (error);
2825 }
2826
2827 moduledata_t iscsi_data = {
2828 "iscsi",
2829 iscsi_modevent,
2830 0
2831 };
2832
2833 DECLARE_MODULE(iscsi, iscsi_data, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);
2834 MODULE_DEPEND(iscsi, cam, 1, 1, 1);
2835 MODULE_DEPEND(iscsi, icl, 1, 1, 1);
2836