1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 
  26 #include <sys/conf.h>
  27 #include <sys/stat.h>
  28 #include <sys/file.h>
  29 #include <sys/ddi.h>
  30 #include <sys/sunddi.h>
  31 #include <sys/modctl.h>
  32 #include <sys/priv.h>
  33 #include <sys/cpuvar.h>
  34 #include <sys/socket.h>
  35 #include <sys/strsubr.h>
  36 #include <sys/sysmacros.h>
  37 #include <sys/sdt.h>
  38 #include <netinet/tcp.h>
  39 #include <inet/tcp.h>
  40 #include <sys/socketvar.h>
  41 #include <sys/pathname.h>
  42 #include <sys/fs/snode.h>
  43 #include <sys/fs/dv_node.h>
  44 #include <sys/vnode.h>
  45 #include <netinet/in.h>
  46 #include <net/if.h>
  47 #include <sys/sockio.h>
  48 #include <sys/ksocket.h>
  49 #include <sys/filio.h>            /* FIONBIO */
  50 #include <sys/iscsi_protocol.h>
  51 #include <sys/idm/idm.h>
  52 #include <sys/idm/idm_so.h>
  53 #include <sys/idm/idm_text.h>
  54 
  55 #define IN_PROGRESS_DELAY       1
  56 
  57 /*
  58  * in6addr_any is currently all zeroes, but use the macro in case this
  59  * ever changes.
  60  */
  61 static const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
  62 
  63 static void idm_sorx_cache_pdu_cb(idm_pdu_t *pdu, idm_status_t status);
  64 static void idm_sorx_addl_pdu_cb(idm_pdu_t *pdu, idm_status_t status);
  65 static void idm_sotx_cache_pdu_cb(idm_pdu_t *pdu, idm_status_t status);
  66 
  67 static idm_status_t idm_so_conn_create_common(idm_conn_t *ic, ksocket_t new_so);
  68 static void idm_so_conn_destroy_common(idm_conn_t *ic);
  69 static void idm_so_conn_connect_common(idm_conn_t *ic);
  70 
  71 static void idm_set_ini_preconnect_options(idm_so_conn_t *sc,
  72     boolean_t boot_conn);
  73 static void idm_set_ini_postconnect_options(idm_so_conn_t *sc);
  74 static void idm_set_tgt_connect_options(ksocket_t so);
  75 static idm_status_t idm_i_so_tx(idm_pdu_t *pdu);
  76 
  77 static idm_status_t idm_sorecvdata(idm_conn_t *ic, idm_pdu_t *pdu);
  78 static void idm_so_send_rtt_data(idm_conn_t *ic, idm_task_t *idt,
  79     idm_buf_t *idb, uint32_t offset, uint32_t length);
  80 static void idm_so_send_rtt_data_done(idm_task_t *idt, idm_buf_t *idb);
  81 static idm_status_t idm_so_send_buf_region(idm_task_t *idt,
  82     idm_buf_t *idb, uint32_t buf_region_offset, uint32_t buf_region_length);
  83 
  84 static uint32_t idm_fill_iov(idm_pdu_t *pdu, idm_buf_t *idb,
  85     uint32_t ro, uint32_t dlength);
  86 
  87 static idm_status_t idm_so_handle_digest(idm_conn_t *it,
  88     nvpair_t *digest_choice, const idm_kv_xlate_t *ikvx);
  89 
  90 static void idm_so_socket_set_nonblock(struct sonode *node);
  91 static void idm_so_socket_set_block(struct sonode *node);
  92 
  93 /*
  94  * Transport ops prototypes
  95  */
  96 static void idm_so_tx(idm_conn_t *ic, idm_pdu_t *pdu);
  97 static idm_status_t idm_so_buf_tx_to_ini(idm_task_t *idt, idm_buf_t *idb);
  98 static idm_status_t idm_so_buf_rx_from_ini(idm_task_t *idt, idm_buf_t *idb);
  99 static void idm_so_rx_datain(idm_conn_t *ic, idm_pdu_t *pdu);
 100 static void idm_so_rx_rtt(idm_conn_t *ic, idm_pdu_t *pdu);
 101 static void idm_so_rx_dataout(idm_conn_t *ic, idm_pdu_t *pdu);
 102 static idm_status_t idm_so_free_task_rsrc(idm_task_t *idt);
 103 static kv_status_t idm_so_negotiate_key_values(idm_conn_t *it,
 104     nvlist_t *request_nvl, nvlist_t *response_nvl, nvlist_t *negotiated_nvl);
 105 static void idm_so_notice_key_values(idm_conn_t *it,
 106     nvlist_t *negotiated_nvl);
 107 static kv_status_t idm_so_declare_key_values(idm_conn_t *it,
 108     nvlist_t *config_nvl, nvlist_t *outgoing_nvl);
 109 static boolean_t idm_so_conn_is_capable(idm_conn_req_t *ic,
 110     idm_transport_caps_t *caps);
 111 static idm_status_t idm_so_buf_alloc(idm_buf_t *idb, uint64_t buflen);
 112 static void idm_so_buf_free(idm_buf_t *idb);
 113 static idm_status_t idm_so_buf_setup(idm_buf_t *idb);
 114 static void idm_so_buf_teardown(idm_buf_t *idb);
 115 static idm_status_t idm_so_tgt_svc_create(idm_svc_req_t *sr, idm_svc_t *is);
 116 static void idm_so_tgt_svc_destroy(idm_svc_t *is);
 117 static idm_status_t idm_so_tgt_svc_online(idm_svc_t *is);
 118 static void idm_so_tgt_svc_offline(idm_svc_t *is);
 119 static void idm_so_tgt_conn_destroy(idm_conn_t *ic);
 120 static idm_status_t idm_so_tgt_conn_connect(idm_conn_t *ic);
 121 static void idm_so_conn_disconnect(idm_conn_t *ic);
 122 static idm_status_t idm_so_ini_conn_create(idm_conn_req_t *cr, idm_conn_t *ic);
 123 static void idm_so_ini_conn_destroy(idm_conn_t *ic);
 124 static idm_status_t idm_so_ini_conn_connect(idm_conn_t *ic);
 125 
 126 /*
 127  * IDM Native Sockets transport operations
 128  */
 129 static
 130 idm_transport_ops_t idm_so_transport_ops = {
 131         idm_so_tx,                      /* it_tx_pdu */
 132         idm_so_buf_tx_to_ini,           /* it_buf_tx_to_ini */
 133         idm_so_buf_rx_from_ini,         /* it_buf_rx_from_ini */
 134         idm_so_rx_datain,               /* it_rx_datain */
 135         idm_so_rx_rtt,                  /* it_rx_rtt */
 136         idm_so_rx_dataout,              /* it_rx_dataout */
 137         NULL,                           /* it_alloc_conn_rsrc */
 138         NULL,                           /* it_free_conn_rsrc */
 139         NULL,                           /* it_tgt_enable_datamover */
 140         NULL,                           /* it_ini_enable_datamover */
 141         NULL,                           /* it_conn_terminate */
 142         idm_so_free_task_rsrc,          /* it_free_task_rsrc */
 143         idm_so_negotiate_key_values,    /* it_negotiate_key_values */
 144         idm_so_notice_key_values,       /* it_notice_key_values */
 145         idm_so_conn_is_capable,         /* it_conn_is_capable */
 146         idm_so_buf_alloc,               /* it_buf_alloc */
 147         idm_so_buf_free,                /* it_buf_free */
 148         idm_so_buf_setup,               /* it_buf_setup */
 149         idm_so_buf_teardown,            /* it_buf_teardown */
 150         idm_so_tgt_svc_create,          /* it_tgt_svc_create */
 151         idm_so_tgt_svc_destroy,         /* it_tgt_svc_destroy */
 152         idm_so_tgt_svc_online,          /* it_tgt_svc_online */
 153         idm_so_tgt_svc_offline,         /* it_tgt_svc_offline */
 154         idm_so_tgt_conn_destroy,        /* it_tgt_conn_destroy */
 155         idm_so_tgt_conn_connect,        /* it_tgt_conn_connect */
 156         idm_so_conn_disconnect,         /* it_tgt_conn_disconnect */
 157         idm_so_ini_conn_create,         /* it_ini_conn_create */
 158         idm_so_ini_conn_destroy,        /* it_ini_conn_destroy */
 159         idm_so_ini_conn_connect,        /* it_ini_conn_connect */
 160         idm_so_conn_disconnect,         /* it_ini_conn_disconnect */
 161         idm_so_declare_key_values       /* it_declare_key_values */
 162 };
 163 
 164 kmutex_t        idm_so_timed_socket_mutex;
 165 /*
 166  * idm_so_init()
 167  * Sockets transport initialization
 168  */
 169 void
 170 idm_so_init(idm_transport_t *it)
 171 {
 172         /* Cache for IDM Data and R2T Transmit PDU's */
 173         idm.idm_sotx_pdu_cache = kmem_cache_create("idm_tx_pdu_cache",
 174             sizeof (idm_pdu_t) + sizeof (iscsi_hdr_t), 8,
 175             &idm_sotx_pdu_constructor, NULL, NULL, NULL, NULL, KM_SLEEP);
 176 
 177         /* Cache for IDM Receive PDU's */
 178         idm.idm_sorx_pdu_cache = kmem_cache_create("idm_rx_pdu_cache",
 179             sizeof (idm_pdu_t) + IDM_SORX_CACHE_HDRLEN, 8,
 180             &idm_sorx_pdu_constructor, NULL, NULL, NULL, NULL, KM_SLEEP);
 181 
 182         /* 128k buffer cache */
 183         idm.idm_so_128k_buf_cache = kmem_cache_create("idm_128k_buf_cache",
 184             IDM_SO_BUF_CACHE_UB, 8, NULL, NULL, NULL, NULL, NULL, KM_SLEEP);
 185 
 186         /* Set the sockets transport ops */
 187         it->it_ops = &idm_so_transport_ops;
 188 
 189         mutex_init(&idm_so_timed_socket_mutex, NULL, MUTEX_DEFAULT, NULL);
 190 
 191 }
 192 
 193 /*
 194  * idm_so_fini()
 195  * Sockets transport teardown
 196  */
 197 void
 198 idm_so_fini(void)
 199 {
 200         kmem_cache_destroy(idm.idm_so_128k_buf_cache);
 201         kmem_cache_destroy(idm.idm_sotx_pdu_cache);
 202         kmem_cache_destroy(idm.idm_sorx_pdu_cache);
 203         mutex_destroy(&idm_so_timed_socket_mutex);
 204 }
 205 
 206 ksocket_t
 207 idm_socreate(int domain, int type, int protocol)
 208 {
 209         ksocket_t ks;
 210 
 211         if (!ksocket_socket(&ks, domain, type, protocol, KSOCKET_NOSLEEP,
 212             CRED())) {
 213                 return (ks);
 214         } else {
 215                 return (NULL);
 216         }
 217 }
 218 
 219 /*
 220  * idm_soshutdown will disconnect the socket and prevent subsequent PDU
 221  * reception and transmission.  The sonode still exists but its state
 222  * gets modified to indicate it is no longer connected.  Calls to
 223  * idm_sorecv/idm_iov_sorecv will return so idm_soshutdown can be used
 224  * regain control of a thread stuck in idm_sorecv.
 225  */
 226 void
 227 idm_soshutdown(ksocket_t so)
 228 {
 229         (void) ksocket_shutdown(so, SHUT_RDWR, CRED());
 230 }
 231 
 232 /*
 233  * idm_sodestroy releases all resources associated with a socket previously
 234  * created with idm_socreate.  The socket must be shutdown using
 235  * idm_soshutdown before the socket is destroyed with idm_sodestroy,
 236  * otherwise undefined behavior will result.
 237  */
 238 void
 239 idm_sodestroy(ksocket_t ks)
 240 {
 241         (void) ksocket_close(ks, CRED());
 242 }
 243 
 244 /*
 245  * Function to compare two addresses in sockaddr_storage format
 246  */
 247 
 248 int
 249 idm_ss_compare(const struct sockaddr_storage *cmp_ss1,
 250     const struct sockaddr_storage *cmp_ss2,
 251     boolean_t v4_mapped_as_v4,
 252     boolean_t compare_ports)
 253 {
 254         struct sockaddr_storage                 mapped_v4_ss1, mapped_v4_ss2;
 255         const struct sockaddr_storage           *ss1, *ss2;
 256         struct in_addr                          *in1, *in2;
 257         struct in6_addr                         *in61, *in62;
 258         int i;
 259 
 260         /*
 261          * Normalize V4-mapped IPv6 addresses into V4 format if
 262          * v4_mapped_as_v4 is B_TRUE.
 263          */
 264         ss1 = cmp_ss1;
 265         ss2 = cmp_ss2;
 266         if (v4_mapped_as_v4 && (ss1->ss_family == AF_INET6)) {
 267                 in61 = &((struct sockaddr_in6 *)ss1)->sin6_addr;
 268                 if (IN6_IS_ADDR_V4MAPPED(in61)) {
 269                         bzero(&mapped_v4_ss1, sizeof (mapped_v4_ss1));
 270                         mapped_v4_ss1.ss_family = AF_INET;
 271                         ((struct sockaddr_in *)&mapped_v4_ss1)->sin_port =
 272                             ((struct sockaddr_in *)ss1)->sin_port;
 273                         IN6_V4MAPPED_TO_INADDR(in61,
 274                             &((struct sockaddr_in *)&mapped_v4_ss1)->sin_addr);
 275                         ss1 = &mapped_v4_ss1;
 276                 }
 277         }
 278         ss2 = cmp_ss2;
 279         if (v4_mapped_as_v4 && (ss2->ss_family == AF_INET6)) {
 280                 in62 = &((struct sockaddr_in6 *)ss2)->sin6_addr;
 281                 if (IN6_IS_ADDR_V4MAPPED(in62)) {
 282                         bzero(&mapped_v4_ss2, sizeof (mapped_v4_ss2));
 283                         mapped_v4_ss2.ss_family = AF_INET;
 284                         ((struct sockaddr_in *)&mapped_v4_ss2)->sin_port =
 285                             ((struct sockaddr_in *)ss2)->sin_port;
 286                         IN6_V4MAPPED_TO_INADDR(in62,
 287                             &((struct sockaddr_in *)&mapped_v4_ss2)->sin_addr);
 288                         ss2 = &mapped_v4_ss2;
 289                 }
 290         }
 291 
 292         /*
 293          * Compare ports, then address family, then ip address
 294          */
 295         if (compare_ports &&
 296             (((struct sockaddr_in *)ss1)->sin_port !=
 297             ((struct sockaddr_in *)ss2)->sin_port)) {
 298                 if (((struct sockaddr_in *)ss1)->sin_port >
 299                     ((struct sockaddr_in *)ss2)->sin_port)
 300                         return (1);
 301                 else
 302                         return (-1);
 303         }
 304 
 305         /*
 306          * ports are the same
 307          */
 308         if (ss1->ss_family != ss2->ss_family) {
 309                 if (ss1->ss_family == AF_INET)
 310                         return (1);
 311                 else
 312                         return (-1);
 313         }
 314 
 315         /*
 316          * address families are the same
 317          */
 318         if (ss1->ss_family == AF_INET) {
 319                 in1 = &((struct sockaddr_in *)ss1)->sin_addr;
 320                 in2 = &((struct sockaddr_in *)ss2)->sin_addr;
 321 
 322                 if (in1->s_addr > in2->s_addr)
 323                         return (1);
 324                 else if (in1->s_addr < in2->s_addr)
 325                         return (-1);
 326                 else
 327                         return (0);
 328         } else if (ss1->ss_family == AF_INET6) {
 329                 in61 = &((struct sockaddr_in6 *)ss1)->sin6_addr;
 330                 in62 = &((struct sockaddr_in6 *)ss2)->sin6_addr;
 331 
 332                 for (i = 0; i < 4; i++) {
 333                         if (in61->s6_addr32[i] > in62->s6_addr32[i])
 334                                 return (1);
 335                         else if (in61->s6_addr32[i] < in62->s6_addr32[i])
 336                                 return (-1);
 337                 }
 338                 return (0);
 339         }
 340 
 341         return (1);
 342 }
 343 
 344 /*
 345  * IP address filter functions to flag addresses that should not
 346  * go out to initiators through discovery.
 347  */
 348 static boolean_t
 349 idm_v4_addr_okay(struct in_addr *in_addr)
 350 {
 351         in_addr_t addr = ntohl(in_addr->s_addr);
 352 
 353         if ((INADDR_NONE == addr) ||
 354             (IN_MULTICAST(addr)) ||
 355             ((addr >> IN_CLASSA_NSHIFT) == 0) ||
 356             ((addr >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)) {
 357                 return (B_FALSE);
 358         }
 359         return (B_TRUE);
 360 }
 361 
 362 static boolean_t
 363 idm_v6_addr_okay(struct in6_addr *addr6)
 364 {
 365 
 366         if ((IN6_IS_ADDR_UNSPECIFIED(addr6)) ||
 367             (IN6_IS_ADDR_LOOPBACK(addr6)) ||
 368             (IN6_IS_ADDR_MULTICAST(addr6)) ||
 369             (IN6_IS_ADDR_V4MAPPED(addr6)) ||
 370             (IN6_IS_ADDR_V4COMPAT(addr6)) ||
 371             (IN6_IS_ADDR_LINKLOCAL(addr6))) {
 372                 return (B_FALSE);
 373         }
 374         return (B_TRUE);
 375 }
 376 
 377 /*
 378  * idm_get_ipaddr will retrieve a list of IP Addresses which the host is
 379  * configured with by sending down a sequence of kernel ioctl to IP STREAMS.
 380  */
 381 int
 382 idm_get_ipaddr(idm_addr_list_t **ipaddr_p)
 383 {
 384         ksocket_t               so4, so6;
 385         struct lifnum           lifn;
 386         struct lifconf          lifc;
 387         struct lifreq           *lp;
 388         int                     rval;
 389         int                     numifs;
 390         int                     bufsize;
 391         void                    *buf;
 392         int                     i, j, n, rc;
 393         struct sockaddr_storage ss;
 394         struct sockaddr_in      *sin;
 395         struct sockaddr_in6     *sin6;
 396         idm_addr_t              *ip;
 397         idm_addr_list_t         *ipaddr = NULL;
 398         int                     size_ipaddr;
 399 
 400         *ipaddr_p = NULL;
 401         size_ipaddr = 0;
 402         buf = NULL;
 403 
 404         /* create an ipv4 and ipv6 UDP socket */
 405         if ((so6 = idm_socreate(PF_INET6, SOCK_DGRAM, 0)) == NULL)
 406                 return (0);
 407         if ((so4 = idm_socreate(PF_INET, SOCK_DGRAM, 0)) == NULL) {
 408                 idm_sodestroy(so6);
 409                 return (0);
 410         }
 411 
 412 
 413 retry_count:
 414         /* snapshot the current number of interfaces */
 415         lifn.lifn_family = PF_UNSPEC;
 416         lifn.lifn_flags = LIFC_NOXMIT | LIFC_TEMPORARY | LIFC_ALLZONES;
 417         lifn.lifn_count = 0;
 418         /* use vp6 for ioctls with unspecified families by default */
 419         if (ksocket_ioctl(so6, SIOCGLIFNUM, (intptr_t)&lifn, &rval, CRED())
 420             != 0) {
 421                 goto cleanup;
 422         }
 423 
 424         numifs = lifn.lifn_count;
 425         if (numifs <= 0) {
 426                 goto cleanup;
 427         }
 428 
 429         /* allocate extra room in case more interfaces appear */
 430         numifs += 10;
 431 
 432         /* get the interface names and ip addresses */
 433         bufsize = numifs * sizeof (struct lifreq);
 434         buf = kmem_alloc(bufsize, KM_SLEEP);
 435 
 436         lifc.lifc_family = AF_UNSPEC;
 437         lifc.lifc_flags = LIFC_NOXMIT | LIFC_TEMPORARY | LIFC_ALLZONES;
 438         lifc.lifc_len = bufsize;
 439         lifc.lifc_buf = buf;
 440         rc = ksocket_ioctl(so6, SIOCGLIFCONF, (intptr_t)&lifc, &rval, CRED());
 441         if (rc != 0) {
 442                 goto cleanup;
 443         }
 444         /* if our extra room is used up, try again */
 445         if (bufsize <= lifc.lifc_len) {
 446                 kmem_free(buf, bufsize);
 447                 buf = NULL;
 448                 goto retry_count;
 449         }
 450         /* calc actual number of ifconfs */
 451         n = lifc.lifc_len / sizeof (struct lifreq);
 452 
 453         /* get ip address */
 454         if (n > 0) {
 455                 size_ipaddr = sizeof (idm_addr_list_t) +
 456                     (n - 1) * sizeof (idm_addr_t);
 457                 ipaddr = kmem_zalloc(size_ipaddr, KM_SLEEP);
 458         } else {
 459                 goto cleanup;
 460         }
 461 
 462         /*
 463          * Examine the array of interfaces and filter uninteresting ones
 464          */
 465         for (i = 0, j = 0, lp = lifc.lifc_req; i < n; i++, lp++) {
 466 
 467                 /*
 468                  * Copy the address as the SIOCGLIFFLAGS ioctl is destructive
 469                  */
 470                 ss = lp->lifr_addr;
 471                 /*
 472                  * fetch the flags using the socket of the correct family
 473                  */
 474                 switch (ss.ss_family) {
 475                 case AF_INET:
 476                         rc = ksocket_ioctl(so4, SIOCGLIFFLAGS, (intptr_t)lp,
 477                             &rval, CRED());
 478                         break;
 479                 case AF_INET6:
 480                         rc = ksocket_ioctl(so6, SIOCGLIFFLAGS, (intptr_t)lp,
 481                             &rval, CRED());
 482                         break;
 483                 default:
 484                         continue;
 485                 }
 486                 if (rc == 0) {
 487                         /*
 488                          * If we got the flags, skip uninteresting
 489                          * interfaces based on flags
 490                          */
 491                         if ((lp->lifr_flags & IFF_UP) != IFF_UP)
 492                                 continue;
 493                         if (lp->lifr_flags &
 494                             (IFF_ANYCAST|IFF_NOLOCAL|IFF_DEPRECATED))
 495                                 continue;
 496                 }
 497 
 498                 /* save ip address */
 499                 ip = &ipaddr->al_addrs[j];
 500                 switch (ss.ss_family) {
 501                 case AF_INET:
 502                         sin = (struct sockaddr_in *)&ss;
 503                         if (!idm_v4_addr_okay(&sin->sin_addr))
 504                                 continue;
 505                         ip->a_addr.i_addr.in4 = sin->sin_addr;
 506                         ip->a_addr.i_insize = sizeof (struct in_addr);
 507                         break;
 508                 case AF_INET6:
 509                         sin6 = (struct sockaddr_in6 *)&ss;
 510                         if (!idm_v6_addr_okay(&sin6->sin6_addr))
 511                                 continue;
 512                         ip->a_addr.i_addr.in6 = sin6->sin6_addr;
 513                         ip->a_addr.i_insize = sizeof (struct in6_addr);
 514                         break;
 515                 default:
 516                         continue;
 517                 }
 518                 j++;
 519         }
 520 
 521         if (j == 0) {
 522                 /* no valid ifaddr */
 523                 kmem_free(ipaddr, size_ipaddr);
 524                 size_ipaddr = 0;
 525                 ipaddr = NULL;
 526         } else {
 527                 ipaddr->al_out_cnt = j;
 528         }
 529 
 530 
 531 cleanup:
 532         idm_sodestroy(so6);
 533         idm_sodestroy(so4);
 534 
 535         if (buf != NULL)
 536                 kmem_free(buf, bufsize);
 537 
 538         *ipaddr_p = ipaddr;
 539         return (size_ipaddr);
 540 }
 541 
 542 int
 543 idm_sorecv(ksocket_t so, void *msg, size_t len)
 544 {
 545         iovec_t iov;
 546 
 547         ASSERT(so != NULL);
 548         ASSERT(len != 0);
 549 
 550         /*
 551          * Fill in iovec and receive data
 552          */
 553         iov.iov_base = msg;
 554         iov.iov_len = len;
 555 
 556         return (idm_iov_sorecv(so, &iov, 1, len));
 557 }
 558 
 559 /*
 560  * idm_sosendto - Sends a buffered data on a non-connected socket.
 561  *
 562  * This function puts the data provided on the wire by calling sosendmsg.
 563  * It will return only when all the data has been sent or if an error
 564  * occurs.
 565  *
 566  * Returns 0 for success, the socket errno value if sosendmsg fails, and
 567  * -1 if sosendmsg returns success but uio_resid != 0
 568  */
 569 int
 570 idm_sosendto(ksocket_t so, void *buff, size_t len,
 571     struct sockaddr *name, socklen_t namelen)
 572 {
 573         struct msghdr           msg;
 574         struct iovec            iov[1];
 575         int                     error;
 576         size_t                  sent = 0;
 577 
 578         iov[0].iov_base = buff;
 579         iov[0].iov_len  = len;
 580 
 581         /* Initialization of the message header. */
 582         bzero(&msg, sizeof (msg));
 583         msg.msg_iov     = iov;
 584         msg.msg_iovlen  = 1;
 585         msg.msg_name    = name;
 586         msg.msg_namelen = namelen;
 587 
 588         if ((error = ksocket_sendmsg(so, &msg, 0, &sent, CRED())) == 0) {
 589                 /* Data sent */
 590                 if (sent == len) {
 591                         /* All data sent.  Success. */
 592                         return (0);
 593                 } else {
 594                         /* Not all data was sent.  Failure */
 595                         return (-1);
 596                 }
 597         }
 598 
 599         /* Send failed */
 600         return (error);
 601 }
 602 
 603 /*
 604  * idm_iov_sosend - Sends an iovec on a connection.
 605  *
 606  * This function puts the data provided on the wire by calling sosendmsg.
 607  * It will return only when all the data has been sent or if an error
 608  * occurs.
 609  *
 610  * Returns 0 for success, the socket errno value if sosendmsg fails, and
 611  * -1 if sosendmsg returns success but uio_resid != 0
 612  */
 613 int
 614 idm_iov_sosend(ksocket_t so, iovec_t *iop, int iovlen, size_t total_len)
 615 {
 616         struct msghdr           msg;
 617         int                     error;
 618         size_t                  sent = 0;
 619 
 620         ASSERT(iop != NULL);
 621 
 622         /* Initialization of the message header. */
 623         bzero(&msg, sizeof (msg));
 624         msg.msg_iov     = iop;
 625         msg.msg_iovlen  = iovlen;
 626 
 627         if ((error = ksocket_sendmsg(so, &msg, 0, &sent, CRED()))
 628             == 0) {
 629                 /* Data sent */
 630                 if (sent == total_len) {
 631                         /* All data sent.  Success. */
 632                         return (0);
 633                 } else {
 634                         /* Not all data was sent.  Failure */
 635                         return (-1);
 636                 }
 637         }
 638 
 639         /* Send failed */
 640         return (error);
 641 }
 642 
 643 /*
 644  * idm_iov_sorecv - Receives an iovec from a connection
 645  *
 646  * This function gets the data asked for from the socket.  It will return
 647  * only when all the requested data has been retrieved or if an error
 648  * occurs.
 649  *
 650  * Returns 0 for success, the socket errno value if sorecvmsg fails, and
 651  * -1 if sorecvmsg returns success but uio_resid != 0
 652  */
 653 int
 654 idm_iov_sorecv(ksocket_t so, iovec_t *iop, int iovlen, size_t total_len)
 655 {
 656         struct msghdr           msg;
 657         int                     error;
 658         size_t                  recv;
 659         int                     flags;
 660 
 661         ASSERT(iop != NULL);
 662 
 663         /* Initialization of the message header. */
 664         bzero(&msg, sizeof (msg));
 665         msg.msg_iov     = iop;
 666         msg.msg_iovlen  = iovlen;
 667         flags           = MSG_WAITALL;
 668 
 669         if ((error = ksocket_recvmsg(so, &msg, flags, &recv, CRED()))
 670             == 0) {
 671                 /* Received data */
 672                 if (recv == total_len) {
 673                         /* All requested data received.  Success */
 674                         return (0);
 675                 } else {
 676                         /*
 677                          * Not all data was received.  The connection has
 678                          * probably failed.
 679                          */
 680                         return (-1);
 681                 }
 682         }
 683 
 684         /* Receive failed */
 685         return (error);
 686 }
 687 
 688 static void
 689 idm_set_ini_preconnect_options(idm_so_conn_t *sc, boolean_t boot_conn)
 690 {
 691         int     conn_abort = 10000;
 692         int     conn_notify = 2000;
 693         int     abort = 30000;
 694 
 695         /* Pre-connect socket options */
 696         (void) ksocket_setsockopt(sc->ic_so, IPPROTO_TCP,
 697             TCP_CONN_NOTIFY_THRESHOLD, (char *)&conn_notify, sizeof (int),
 698             CRED());
 699         if (boot_conn == B_FALSE) {
 700                 (void) ksocket_setsockopt(sc->ic_so, IPPROTO_TCP,
 701                     TCP_CONN_ABORT_THRESHOLD, (char *)&conn_abort, sizeof (int),
 702                     CRED());
 703                 (void) ksocket_setsockopt(sc->ic_so, IPPROTO_TCP,
 704                     TCP_ABORT_THRESHOLD,
 705                     (char *)&abort, sizeof (int), CRED());
 706         }
 707 }
 708 
 709 static void
 710 idm_set_ini_postconnect_options(idm_so_conn_t *sc)
 711 {
 712         int32_t         rcvbuf = IDM_RCVBUF_SIZE;
 713         int32_t         sndbuf = IDM_SNDBUF_SIZE;
 714         const int       on = 1;
 715 
 716         /* Set postconnect options */
 717         (void) ksocket_setsockopt(sc->ic_so, IPPROTO_TCP, TCP_NODELAY,
 718             (char *)&on, sizeof (int), CRED());
 719         (void) ksocket_setsockopt(sc->ic_so, SOL_SOCKET, SO_RCVBUF,
 720             (char *)&rcvbuf, sizeof (int), CRED());
 721         (void) ksocket_setsockopt(sc->ic_so, SOL_SOCKET, SO_SNDBUF,
 722             (char *)&sndbuf, sizeof (int), CRED());
 723 }
 724 
 725 static void
 726 idm_set_tgt_connect_options(ksocket_t ks)
 727 {
 728         int32_t         rcvbuf = IDM_RCVBUF_SIZE;
 729         int32_t         sndbuf = IDM_SNDBUF_SIZE;
 730         const int       on = 1;
 731 
 732         /* Set connect options */
 733         (void) ksocket_setsockopt(ks, SOL_SOCKET, SO_RCVBUF,
 734             (char *)&rcvbuf, sizeof (int), CRED());
 735         (void) ksocket_setsockopt(ks, SOL_SOCKET, SO_SNDBUF,
 736             (char *)&sndbuf, sizeof (int), CRED());
 737         (void) ksocket_setsockopt(ks, IPPROTO_TCP, TCP_NODELAY,
 738             (char *)&on, sizeof (on), CRED());
 739 }
 740 
 741 static uint32_t
 742 n2h24(const uchar_t *ptr)
 743 {
 744         return ((ptr[0] << 16) | (ptr[1] << 8) | ptr[2]);
 745 }
 746 
 747 
 748 static idm_status_t
 749 idm_sorecvhdr(idm_conn_t *ic, idm_pdu_t *pdu)
 750 {
 751         iscsi_hdr_t     *bhs;
 752         uint32_t        hdr_digest_crc;
 753         uint32_t        crc_calculated;
 754         void            *new_hdr;
 755         int             ahslen = 0;
 756         int             total_len = 0;
 757         int             iovlen = 0;
 758         struct iovec    iov[2];
 759         idm_so_conn_t   *so_conn;
 760         int             rc;
 761 
 762         so_conn = ic->ic_transport_private;
 763 
 764         /*
 765          * Read BHS
 766          */
 767         bhs = pdu->isp_hdr;
 768         rc = idm_sorecv(so_conn->ic_so, pdu->isp_hdr, sizeof (iscsi_hdr_t));
 769         if (rc != IDM_STATUS_SUCCESS) {
 770                 return (IDM_STATUS_FAIL);
 771         }
 772 
 773         /*
 774          * Check actual AHS length against the amount available in the buffer
 775          */
 776         pdu->isp_hdrlen = sizeof (iscsi_hdr_t) +
 777             (bhs->hlength * sizeof (uint32_t));
 778         pdu->isp_datalen = n2h24(bhs->dlength);
 779         if (ic->ic_conn_type == CONN_TYPE_TGT &&
 780             pdu->isp_datalen > ic->ic_conn_params.max_recv_dataseglen) {
 781                 IDM_CONN_LOG(CE_WARN,
 782                     "idm_sorecvhdr: exceeded the max data segment length");
 783                 return (IDM_STATUS_FAIL);
 784         }
 785         if (bhs->hlength > IDM_SORX_CACHE_AHSLEN) {
 786                 /* Allocate a new header segment and change the callback */
 787                 new_hdr = kmem_alloc(pdu->isp_hdrlen, KM_SLEEP);
 788                 bcopy(pdu->isp_hdr, new_hdr, sizeof (iscsi_hdr_t));
 789                 pdu->isp_hdr = new_hdr;
 790                 pdu->isp_flags |= IDM_PDU_ADDL_HDR;
 791 
 792                 /*
 793                  * This callback will restore the expected values after
 794                  * the RX PDU has been processed.
 795                  */
 796                 pdu->isp_callback = idm_sorx_addl_pdu_cb;
 797         }
 798 
 799         /*
 800          * Setup receipt of additional header and header digest (if enabled).
 801          */
 802         if (bhs->hlength > 0) {
 803                 iov[iovlen].iov_base = (caddr_t)(pdu->isp_hdr + 1);
 804                 ahslen = pdu->isp_hdrlen - sizeof (iscsi_hdr_t);
 805                 iov[iovlen].iov_len = ahslen;
 806                 total_len += iov[iovlen].iov_len;
 807                 iovlen++;
 808         }
 809 
 810         if (ic->ic_conn_flags & IDM_CONN_HEADER_DIGEST) {
 811                 iov[iovlen].iov_base = (caddr_t)&hdr_digest_crc;
 812                 iov[iovlen].iov_len = sizeof (hdr_digest_crc);
 813                 total_len += iov[iovlen].iov_len;
 814                 iovlen++;
 815         }
 816 
 817         if ((iovlen != 0) &&
 818             (idm_iov_sorecv(so_conn->ic_so, &iov[0], iovlen,
 819             total_len) != 0)) {
 820                 return (IDM_STATUS_FAIL);
 821         }
 822 
 823         /*
 824          * Validate header digest if enabled
 825          */
 826         if (ic->ic_conn_flags & IDM_CONN_HEADER_DIGEST) {
 827                 crc_calculated = idm_crc32c(pdu->isp_hdr,
 828                     sizeof (iscsi_hdr_t) + ahslen);
 829                 if (crc_calculated != hdr_digest_crc) {
 830                         /* Invalid Header Digest */
 831                         return (IDM_STATUS_HEADER_DIGEST);
 832                 }
 833         }
 834 
 835         return (0);
 836 }
 837 
 838 /*
 839  * idm_so_ini_conn_create()
 840  * Allocate the sockets transport connection resources.
 841  */
 842 static idm_status_t
 843 idm_so_ini_conn_create(idm_conn_req_t *cr, idm_conn_t *ic)
 844 {
 845         ksocket_t       so;
 846         idm_so_conn_t   *so_conn;
 847         idm_status_t    idmrc;
 848 
 849         so = idm_socreate(cr->cr_domain, cr->cr_type,
 850             cr->cr_protocol);
 851         if (so == NULL) {
 852                 return (IDM_STATUS_FAIL);
 853         }
 854 
 855         /* Bind the socket if configured to do so */
 856         if (cr->cr_bound) {
 857                 if (ksocket_bind(so, &cr->cr_bound_addr.sin,
 858                     SIZEOF_SOCKADDR(&cr->cr_bound_addr.sin), CRED()) != 0) {
 859                         idm_sodestroy(so);
 860                         return (IDM_STATUS_FAIL);
 861                 }
 862         }
 863 
 864         idmrc = idm_so_conn_create_common(ic, so);
 865         if (idmrc != IDM_STATUS_SUCCESS) {
 866                 idm_soshutdown(so);
 867                 idm_sodestroy(so);
 868                 return (IDM_STATUS_FAIL);
 869         }
 870 
 871         so_conn = ic->ic_transport_private;
 872         /* Set up socket options */
 873         idm_set_ini_preconnect_options(so_conn, cr->cr_boot_conn);
 874 
 875         return (IDM_STATUS_SUCCESS);
 876 }
 877 
 878 /*
 879  * idm_so_ini_conn_destroy()
 880  * Tear down the sockets transport connection resources.
 881  */
 882 static void
 883 idm_so_ini_conn_destroy(idm_conn_t *ic)
 884 {
 885         idm_so_conn_destroy_common(ic);
 886 }
 887 
 888 /*
 889  * idm_so_ini_conn_connect()
 890  * Establish the connection referred to by the handle previously allocated via
 891  * idm_so_ini_conn_create().
 892  */
 893 static idm_status_t
 894 idm_so_ini_conn_connect(idm_conn_t *ic)
 895 {
 896         idm_so_conn_t   *so_conn;
 897         struct sonode   *node = NULL;
 898         int             rc;
 899         clock_t         lbolt, conn_login_max, conn_login_interval;
 900         boolean_t       nonblock;
 901 
 902         so_conn = ic->ic_transport_private;
 903         nonblock = ic->ic_conn_params.nonblock_socket;
 904         conn_login_max = ic->ic_conn_params.conn_login_max;
 905         conn_login_interval = ddi_get_lbolt() +
 906             SEC_TO_TICK(ic->ic_conn_params.conn_login_interval);
 907 
 908         if (nonblock == B_TRUE) {
 909                 node = ((struct sonode *)(so_conn->ic_so));
 910                 /* Set to none block socket mode */
 911                 idm_so_socket_set_nonblock(node);
 912                 do {
 913                         rc = ksocket_connect(so_conn->ic_so,
 914                             &ic->ic_ini_dst_addr.sin,
 915                             (SIZEOF_SOCKADDR(&ic->ic_ini_dst_addr.sin)),
 916                             CRED());
 917                         if (rc == 0 || rc == EISCONN) {
 918                                 /* socket success or already success */
 919                                 rc = IDM_STATUS_SUCCESS;
 920                                 break;
 921                         }
 922                         if ((rc == ETIMEDOUT) || (rc == ECONNREFUSED) ||
 923                             (rc == ECONNRESET)) {
 924                                 /* socket connection timeout or refuse */
 925                                 break;
 926                         }
 927                         lbolt = ddi_get_lbolt();
 928                         if (lbolt > conn_login_max) {
 929                                 /*
 930                                  * Connection retry timeout,
 931                                  * failed connect to target.
 932                                  */
 933                                 break;
 934                         }
 935                         if (lbolt < conn_login_interval) {
 936                                 if ((rc == EINPROGRESS) || (rc == EALREADY)) {
 937                                         /* TCP connect still in progress */
 938                                         delay(SEC_TO_TICK(IN_PROGRESS_DELAY));
 939                                         continue;
 940                                 } else {
 941                                         delay(conn_login_interval - lbolt);
 942                                 }
 943                         }
 944                         conn_login_interval = ddi_get_lbolt() +
 945                             SEC_TO_TICK(ic->ic_conn_params.conn_login_interval);
 946                 } while (rc != 0);
 947                 /* resume to nonblock mode */
 948                 if (rc == IDM_STATUS_SUCCESS) {
 949                         idm_so_socket_set_block(node);
 950                 }
 951         } else {
 952                 rc = ksocket_connect(so_conn->ic_so, &ic->ic_ini_dst_addr.sin,
 953                     (SIZEOF_SOCKADDR(&ic->ic_ini_dst_addr.sin)), CRED());
 954         }
 955 
 956         if (rc != 0) {
 957                 idm_soshutdown(so_conn->ic_so);
 958                 return (IDM_STATUS_FAIL);
 959         }
 960 
 961         idm_so_conn_connect_common(ic);
 962 
 963         idm_set_ini_postconnect_options(so_conn);
 964 
 965         return (IDM_STATUS_SUCCESS);
 966 }
 967 
 968 idm_status_t
 969 idm_so_tgt_conn_create(idm_conn_t *ic, ksocket_t new_so)
 970 {
 971         idm_status_t    idmrc;
 972 
 973         idmrc = idm_so_conn_create_common(ic, new_so);
 974 
 975         return (idmrc);
 976 }
 977 
 978 static void
 979 idm_so_tgt_conn_destroy(idm_conn_t *ic)
 980 {
 981         idm_so_conn_destroy_common(ic);
 982 }
 983 
 984 /*
 985  * idm_so_tgt_conn_connect()
 986  * Establish the connection in ic, passed from idm_tgt_conn_finish(), which
 987  * is invoked from the SM as a result of an inbound connection request.
 988  */
 989 static idm_status_t
 990 idm_so_tgt_conn_connect(idm_conn_t *ic)
 991 {
 992         idm_so_conn_connect_common(ic);
 993 
 994         return (IDM_STATUS_SUCCESS);
 995 }
 996 
 997 static idm_status_t
 998 idm_so_conn_create_common(idm_conn_t *ic, ksocket_t new_so)
 999 {
1000         idm_so_conn_t   *so_conn;
1001 
1002         so_conn = kmem_zalloc(sizeof (idm_so_conn_t), KM_SLEEP);
1003         so_conn->ic_so = new_so;
1004 
1005         ic->ic_transport_private = so_conn;
1006         ic->ic_transport_hdrlen = 0;
1007 
1008         /* Set the scoreboarding flag on this connection */
1009         ic->ic_conn_flags |= IDM_CONN_USE_SCOREBOARD;
1010         ic->ic_conn_params.max_recv_dataseglen =
1011             ISCSI_DEFAULT_MAX_RECV_SEG_LEN;
1012         ic->ic_conn_params.max_xmit_dataseglen =
1013             ISCSI_DEFAULT_MAX_XMIT_SEG_LEN;
1014 
1015         /*
1016          * Initialize tx thread mutex and list
1017          */
1018         mutex_init(&so_conn->ic_tx_mutex, NULL, MUTEX_DEFAULT, NULL);
1019         cv_init(&so_conn->ic_tx_cv, NULL, CV_DEFAULT, NULL);
1020         list_create(&so_conn->ic_tx_list, sizeof (idm_pdu_t),
1021             offsetof(idm_pdu_t, idm_tx_link));
1022 
1023         return (IDM_STATUS_SUCCESS);
1024 }
1025 
1026 static void
1027 idm_so_conn_destroy_common(idm_conn_t *ic)
1028 {
1029         idm_so_conn_t   *so_conn = ic->ic_transport_private;
1030 
1031         ic->ic_transport_private = NULL;
1032         idm_sodestroy(so_conn->ic_so);
1033         list_destroy(&so_conn->ic_tx_list);
1034         mutex_destroy(&so_conn->ic_tx_mutex);
1035         cv_destroy(&so_conn->ic_tx_cv);
1036 
1037         kmem_free(so_conn, sizeof (idm_so_conn_t));
1038 }
1039 
1040 static void
1041 idm_so_conn_connect_common(idm_conn_t *ic)
1042 {
1043         idm_so_conn_t   *so_conn;
1044         struct sockaddr_in6     t_addr;
1045         socklen_t       t_addrlen = 0;
1046 
1047         so_conn = ic->ic_transport_private;
1048         bzero(&t_addr, sizeof (struct sockaddr_in6));
1049         t_addrlen = sizeof (struct sockaddr_in6);
1050 
1051         /* Set the local and remote addresses in the idm conn handle */
1052         (void) ksocket_getsockname(so_conn->ic_so, (struct sockaddr *)&t_addr,
1053             &t_addrlen, CRED());
1054         bcopy(&t_addr, &ic->ic_laddr, t_addrlen);
1055         (void) ksocket_getpeername(so_conn->ic_so, (struct sockaddr *)&t_addr,
1056             &t_addrlen, CRED());
1057         bcopy(&t_addr, &ic->ic_raddr, t_addrlen);
1058 
1059         mutex_enter(&ic->ic_mutex);
1060         so_conn->ic_tx_thread = thread_create(NULL, 0, idm_sotx_thread, ic, 0,
1061             &p0, TS_RUN, minclsyspri);
1062         so_conn->ic_rx_thread = thread_create(NULL, 0, idm_sorx_thread, ic, 0,
1063             &p0, TS_RUN, minclsyspri);
1064 
1065         while (so_conn->ic_rx_thread_did == 0 ||
1066             so_conn->ic_tx_thread_did == 0)
1067                 cv_wait(&ic->ic_cv, &ic->ic_mutex);
1068         mutex_exit(&ic->ic_mutex);
1069 }
1070 
1071 /*
1072  * idm_so_conn_disconnect()
1073  * Shutdown the socket connection and stop the thread
1074  */
1075 static void
1076 idm_so_conn_disconnect(idm_conn_t *ic)
1077 {
1078         idm_so_conn_t   *so_conn;
1079 
1080         so_conn = ic->ic_transport_private;
1081 
1082         mutex_enter(&ic->ic_mutex);
1083         so_conn->ic_rx_thread_running = B_FALSE;
1084         so_conn->ic_tx_thread_running = B_FALSE;
1085         /* We need to wakeup the TX thread */
1086         mutex_enter(&so_conn->ic_tx_mutex);
1087         cv_signal(&so_conn->ic_tx_cv);
1088         mutex_exit(&so_conn->ic_tx_mutex);
1089         mutex_exit(&ic->ic_mutex);
1090 
1091         /* This should wakeup the RX thread if it is sleeping */
1092         idm_soshutdown(so_conn->ic_so);
1093 
1094         thread_join(so_conn->ic_tx_thread_did);
1095         thread_join(so_conn->ic_rx_thread_did);
1096 }
1097 
1098 /*
1099  * idm_so_tgt_svc_create()
1100  * Establish a service on an IP address and port.  idm_svc_req_t contains
1101  * the service parameters.
1102  */
1103 /*ARGSUSED*/
1104 static idm_status_t
1105 idm_so_tgt_svc_create(idm_svc_req_t *sr, idm_svc_t *is)
1106 {
1107         idm_so_svc_t            *so_svc;
1108 
1109         so_svc = kmem_zalloc(sizeof (idm_so_svc_t), KM_SLEEP);
1110 
1111         /* Set the new sockets service in svc handle */
1112         is->is_so_svc = (void *)so_svc;
1113 
1114         return (IDM_STATUS_SUCCESS);
1115 }
1116 
1117 /*
1118  * idm_so_tgt_svc_destroy()
1119  * Teardown sockets resources allocated in idm_so_tgt_svc_create()
1120  */
1121 static void
1122 idm_so_tgt_svc_destroy(idm_svc_t *is)
1123 {
1124         /* the socket will have been torn down; free the service */
1125         kmem_free(is->is_so_svc, sizeof (idm_so_svc_t));
1126 }
1127 
1128 /*
1129  * idm_so_tgt_svc_online()
1130  * Launch a watch thread on the svc allocated in idm_so_tgt_svc_create()
1131  */
1132 
1133 static idm_status_t
1134 idm_so_tgt_svc_online(idm_svc_t *is)
1135 {
1136         idm_so_svc_t            *so_svc;
1137         idm_svc_req_t           *sr = &is->is_svc_req;
1138         struct sockaddr_in6     sin6_ip;
1139         const uint32_t          on = 1;
1140         const uint32_t          off = 0;
1141 
1142         mutex_enter(&is->is_mutex);
1143         so_svc = (idm_so_svc_t *)is->is_so_svc;
1144 
1145         /*
1146          * Try creating an IPv6 socket first
1147          */
1148         if ((so_svc->is_so = idm_socreate(PF_INET6, SOCK_STREAM, 0)) == NULL) {
1149                 mutex_exit(&is->is_mutex);
1150                 return (IDM_STATUS_FAIL);
1151         } else {
1152                 bzero(&sin6_ip, sizeof (sin6_ip));
1153                 sin6_ip.sin6_family = AF_INET6;
1154                 sin6_ip.sin6_port = htons(sr->sr_port);
1155                 sin6_ip.sin6_addr = in6addr_any;
1156 
1157                 (void) ksocket_setsockopt(so_svc->is_so, SOL_SOCKET,
1158                     SO_REUSEADDR, (char *)&on, sizeof (on), CRED());
1159                 /*
1160                  * Turn off SO_MAC_EXEMPT so future sobinds succeed
1161                  */
1162                 (void) ksocket_setsockopt(so_svc->is_so, SOL_SOCKET,
1163                     SO_MAC_EXEMPT, (char *)&off, sizeof (off), CRED());
1164 
1165                 if (ksocket_bind(so_svc->is_so, (struct sockaddr *)&sin6_ip,
1166                     sizeof (sin6_ip), CRED()) != 0) {
1167                         mutex_exit(&is->is_mutex);
1168                         idm_sodestroy(so_svc->is_so);
1169                         return (IDM_STATUS_FAIL);
1170                 }
1171         }
1172 
1173         idm_set_tgt_connect_options(so_svc->is_so);
1174 
1175         if (ksocket_listen(so_svc->is_so, 5, CRED()) != 0) {
1176                 mutex_exit(&is->is_mutex);
1177                 idm_soshutdown(so_svc->is_so);
1178                 idm_sodestroy(so_svc->is_so);
1179                 return (IDM_STATUS_FAIL);
1180         }
1181 
1182         /* Launch a watch thread */
1183         so_svc->is_thread = thread_create(NULL, 0, idm_so_svc_port_watcher,
1184             is, 0, &p0, TS_RUN, minclsyspri);
1185 
1186         if (so_svc->is_thread == NULL) {
1187                 /* Failure to launch; teardown the socket */
1188                 mutex_exit(&is->is_mutex);
1189                 idm_soshutdown(so_svc->is_so);
1190                 idm_sodestroy(so_svc->is_so);
1191                 return (IDM_STATUS_FAIL);
1192         }
1193         ksocket_hold(so_svc->is_so);
1194         /* Wait for the port watcher thread to start */
1195         while (!so_svc->is_thread_running)
1196                 cv_wait(&is->is_cv, &is->is_mutex);
1197         mutex_exit(&is->is_mutex);
1198 
1199         return (IDM_STATUS_SUCCESS);
1200 }
1201 
1202 /*
1203  * idm_so_tgt_svc_offline
1204  *
1205  * Stop listening on the IP address and port identified by idm_svc_t.
1206  */
1207 static void
1208 idm_so_tgt_svc_offline(idm_svc_t *is)
1209 {
1210         idm_so_svc_t            *so_svc;
1211         mutex_enter(&is->is_mutex);
1212         so_svc = (idm_so_svc_t *)is->is_so_svc;
1213         so_svc->is_thread_running = B_FALSE;
1214         mutex_exit(&is->is_mutex);
1215 
1216         /*
1217          * Teardown socket
1218          */
1219         idm_sodestroy(so_svc->is_so);
1220 
1221         /*
1222          * Now we expect the port watcher thread to terminate
1223          */
1224         thread_join(so_svc->is_thread_did);
1225 }
1226 
1227 /*
1228  * Watch thread for target service connection establishment.
1229  */
1230 void
1231 idm_so_svc_port_watcher(void *arg)
1232 {
1233         idm_svc_t               *svc = arg;
1234         ksocket_t               new_so;
1235         idm_conn_t              *ic;
1236         idm_status_t            idmrc;
1237         idm_so_svc_t            *so_svc;
1238         int                     rc;
1239         const uint32_t          off = 0;
1240         struct sockaddr_in6     t_addr;
1241         socklen_t               t_addrlen;
1242 
1243         bzero(&t_addr, sizeof (struct sockaddr_in6));
1244         t_addrlen = sizeof (struct sockaddr_in6);
1245         mutex_enter(&svc->is_mutex);
1246 
1247         so_svc = svc->is_so_svc;
1248         so_svc->is_thread_running = B_TRUE;
1249         so_svc->is_thread_did = so_svc->is_thread->t_did;
1250 
1251         cv_signal(&svc->is_cv);
1252 
1253         IDM_SVC_LOG(CE_NOTE, "iSCSI service (%p/%d) online", (void *)svc,
1254             svc->is_svc_req.sr_port);
1255 
1256         while (so_svc->is_thread_running) {
1257                 mutex_exit(&svc->is_mutex);
1258 
1259                 if ((rc = ksocket_accept(so_svc->is_so,
1260                     (struct sockaddr *)&t_addr, &t_addrlen,
1261                     &new_so, CRED())) != 0) {
1262                         mutex_enter(&svc->is_mutex);
1263                         if (rc == ECONNABORTED)
1264                                 continue;
1265                         /* Connection problem */
1266                         break;
1267                 }
1268                 /*
1269                  * Turn off SO_MAC_EXEMPT so future sobinds succeed
1270                  */
1271                 (void) ksocket_setsockopt(new_so, SOL_SOCKET, SO_MAC_EXEMPT,
1272                     (char *)&off, sizeof (off), CRED());
1273 
1274                 idmrc = idm_svc_conn_create(svc, IDM_TRANSPORT_TYPE_SOCKETS,
1275                     &ic);
1276                 if (idmrc != IDM_STATUS_SUCCESS) {
1277                         /* Drop connection */
1278                         idm_soshutdown(new_so);
1279                         idm_sodestroy(new_so);
1280                         mutex_enter(&svc->is_mutex);
1281                         continue;
1282                 }
1283 
1284                 idmrc = idm_so_tgt_conn_create(ic, new_so);
1285                 if (idmrc != IDM_STATUS_SUCCESS) {
1286                         idm_svc_conn_destroy(ic);
1287                         idm_soshutdown(new_so);
1288                         idm_sodestroy(new_so);
1289                         mutex_enter(&svc->is_mutex);
1290                         continue;
1291                 }
1292 
1293                 /*
1294                  * Kick the state machine.  At CS_S3_XPT_UP the state machine
1295                  * will notify the client (target) about the new connection.
1296                  */
1297                 idm_conn_event(ic, CE_CONNECT_ACCEPT, NULL);
1298 
1299                 mutex_enter(&svc->is_mutex);
1300         }
1301         ksocket_rele(so_svc->is_so);
1302         so_svc->is_thread_running = B_FALSE;
1303         mutex_exit(&svc->is_mutex);
1304 
1305         IDM_SVC_LOG(CE_NOTE, "iSCSI service (%p/%d) offline", (void *)svc,
1306             svc->is_svc_req.sr_port);
1307 
1308         thread_exit();
1309 }
1310 
1311 /*
1312  * idm_so_free_task_rsrc() stops any ongoing processing of the task and
1313  * frees resources associated with the task.
1314  *
1315  * It's not clear that this should return idm_status_t.  What do we do
1316  * if it fails?
1317  */
1318 static idm_status_t
1319 idm_so_free_task_rsrc(idm_task_t *idt)
1320 {
1321         idm_buf_t       *idb, *next_idb;
1322 
1323         /*
1324          * There is nothing to cleanup on initiator connections
1325          */
1326         if (IDM_CONN_ISINI(idt->idt_ic))
1327                 return (IDM_STATUS_SUCCESS);
1328 
1329         /*
1330          * If this is a target connection, call idm_buf_rx_from_ini_done for
1331          * any buffer on the "outbufv" list with idb->idb_in_transport==B_TRUE.
1332          *
1333          * In addition, remove any buffers associated with this task from
1334          * the ic_tx_list.  We'll do this by walking the idt_inbufv list, but
1335          * items don't actually get removed from that list (and completion
1336          * routines called) until idm_task_cleanup.
1337          */
1338         mutex_enter(&idt->idt_mutex);
1339 
1340         for (idb = list_head(&idt->idt_outbufv); idb != NULL; idb = next_idb) {
1341                 next_idb = list_next(&idt->idt_outbufv, idb);
1342                 if (idb->idb_in_transport) {
1343                         /*
1344                          * idm_buf_rx_from_ini_done releases idt->idt_mutex
1345                          */
1346                         DTRACE_ISCSI_8(xfer__done, idm_conn_t *, idt->idt_ic,
1347                             uintptr_t, idb->idb_buf,
1348                             uint32_t, idb->idb_bufoffset,
1349                             uint64_t, 0, uint32_t, 0, uint32_t, 0,
1350                             uint32_t, idb->idb_xfer_len,
1351                             int, XFER_BUF_RX_FROM_INI);
1352                         idm_buf_rx_from_ini_done(idt, idb, IDM_STATUS_ABORTED);
1353                         mutex_enter(&idt->idt_mutex);
1354                 }
1355         }
1356 
1357         for (idb = list_head(&idt->idt_inbufv); idb != NULL; idb = next_idb) {
1358                 next_idb = list_next(&idt->idt_inbufv, idb);
1359                 /*
1360                  * We want to remove these items from the tx_list as well,
1361                  * but knowing it's in the idt_inbufv list is not a guarantee
1362                  * that it's in the tx_list.  If it's on the tx list then
1363                  * let idm_sotx_thread() clean it up.
1364                  */
1365                 if (idb->idb_in_transport && !idb->idb_tx_thread) {
1366                         /*
1367                          * idm_buf_tx_to_ini_done releases idt->idt_mutex
1368                          */
1369                         DTRACE_ISCSI_8(xfer__done, idm_conn_t *, idt->idt_ic,
1370                             uintptr_t, idb->idb_buf,
1371                             uint32_t, idb->idb_bufoffset,
1372                             uint64_t, 0, uint32_t, 0, uint32_t, 0,
1373                             uint32_t, idb->idb_xfer_len,
1374                             int, XFER_BUF_TX_TO_INI);
1375                         idm_buf_tx_to_ini_done(idt, idb, IDM_STATUS_ABORTED);
1376                         mutex_enter(&idt->idt_mutex);
1377                 }
1378         }
1379 
1380         mutex_exit(&idt->idt_mutex);
1381 
1382         return (IDM_STATUS_SUCCESS);
1383 }
1384 
1385 /*
1386  * idm_so_negotiate_key_values() validates the key values for this connection
1387  */
1388 /* ARGSUSED */
1389 static kv_status_t
1390 idm_so_negotiate_key_values(idm_conn_t *it, nvlist_t *request_nvl,
1391     nvlist_t *response_nvl, nvlist_t *negotiated_nvl)
1392 {
1393         /* All parameters are negotiated at the iscsit level */
1394         return (KV_HANDLED);
1395 }
1396 
1397 /*
1398  * idm_so_notice_key_values() activates the negotiated key values for
1399  * this connection.
1400  */
1401 static void
1402 idm_so_notice_key_values(idm_conn_t *it, nvlist_t *negotiated_nvl)
1403 {
1404         char                    *nvp_name;
1405         nvpair_t                *nvp;
1406         nvpair_t                *next_nvp;
1407         int                     nvrc;
1408         idm_status_t            idm_status;
1409         const idm_kv_xlate_t    *ikvx;
1410         uint64_t                num_val;
1411 
1412         for (nvp = nvlist_next_nvpair(negotiated_nvl, NULL);
1413             nvp != NULL; nvp = next_nvp) {
1414                 next_nvp = nvlist_next_nvpair(negotiated_nvl, nvp);
1415                 nvp_name = nvpair_name(nvp);
1416 
1417                 ikvx = idm_lookup_kv_xlate(nvp_name, strlen(nvp_name));
1418                 switch (ikvx->ik_key_id) {
1419                 case KI_HEADER_DIGEST:
1420                 case KI_DATA_DIGEST:
1421                         idm_status = idm_so_handle_digest(it, nvp, ikvx);
1422                         ASSERT(idm_status == 0);
1423 
1424                         /* Remove processed item from negotiated_nvl list */
1425                         nvrc = nvlist_remove_all(
1426                             negotiated_nvl, ikvx->ik_key_name);
1427                         ASSERT(nvrc == 0);
1428                         break;
1429                 case KI_MAX_RECV_DATA_SEGMENT_LENGTH:
1430                         /*
1431                          * Just pass the value down to idm layer.
1432                          * No need to remove it from negotiated_nvl list here.
1433                          */
1434                         nvrc = nvpair_value_uint64(nvp, &num_val);
1435                         ASSERT(nvrc == 0);
1436                         it->ic_conn_params.max_xmit_dataseglen =
1437                             (uint32_t)num_val;
1438                         break;
1439                 default:
1440                         break;
1441                 }
1442         }
1443 }
1444 
1445 /*
1446  * idm_so_declare_key_values() declares the key values for this connection
1447  */
1448 /* ARGSUSED */
1449 static kv_status_t
1450 idm_so_declare_key_values(idm_conn_t *it, nvlist_t *config_nvl,
1451     nvlist_t *outgoing_nvl)
1452 {
1453         char                    *nvp_name;
1454         nvpair_t                *nvp;
1455         nvpair_t                *next_nvp;
1456         kv_status_t             kvrc;
1457         int                     nvrc = 0;
1458         const idm_kv_xlate_t    *ikvx;
1459         uint64_t                num_val;
1460 
1461         for (nvp = nvlist_next_nvpair(config_nvl, NULL);
1462             nvp != NULL && nvrc == 0; nvp = next_nvp) {
1463                 next_nvp = nvlist_next_nvpair(config_nvl, nvp);
1464                 nvp_name = nvpair_name(nvp);
1465 
1466                 ikvx = idm_lookup_kv_xlate(nvp_name, strlen(nvp_name));
1467                 switch (ikvx->ik_key_id) {
1468                 case KI_MAX_RECV_DATA_SEGMENT_LENGTH:
1469                         if ((nvrc = nvpair_value_uint64(nvp, &num_val)) != 0) {
1470                                 break;
1471                         }
1472                         if (outgoing_nvl &&
1473                             (nvrc = nvlist_add_uint64(outgoing_nvl,
1474                             nvp_name, num_val)) != 0) {
1475                                 break;
1476                         }
1477                         it->ic_conn_params.max_recv_dataseglen =
1478                             (uint32_t)num_val;
1479                         break;
1480                 default:
1481                         break;
1482                 }
1483         }
1484         kvrc = idm_nvstat_to_kvstat(nvrc);
1485         return (kvrc);
1486 }
1487 
1488 static idm_status_t
1489 idm_so_handle_digest(idm_conn_t *it, nvpair_t *digest_choice,
1490     const idm_kv_xlate_t *ikvx)
1491 {
1492         int                     nvrc;
1493         char                    *digest_choice_string;
1494 
1495         nvrc = nvpair_value_string(digest_choice,
1496             &digest_choice_string);
1497         ASSERT(nvrc == 0);
1498         if (strcasecmp(digest_choice_string, "crc32c") == 0) {
1499                 switch (ikvx->ik_key_id) {
1500                 case KI_HEADER_DIGEST:
1501                         it->ic_conn_flags |= IDM_CONN_HEADER_DIGEST;
1502                         break;
1503                 case KI_DATA_DIGEST:
1504                         it->ic_conn_flags |= IDM_CONN_DATA_DIGEST;
1505                         break;
1506                 default:
1507                         ASSERT(0);
1508                         break;
1509                 }
1510         } else if (strcasecmp(digest_choice_string, "none") == 0) {
1511                 switch (ikvx->ik_key_id) {
1512                 case KI_HEADER_DIGEST:
1513                         it->ic_conn_flags &= ~IDM_CONN_HEADER_DIGEST;
1514                         break;
1515                 case KI_DATA_DIGEST:
1516                         it->ic_conn_flags &= ~IDM_CONN_DATA_DIGEST;
1517                         break;
1518                 default:
1519                         ASSERT(0);
1520                         break;
1521                 }
1522         } else {
1523                 ASSERT(0);
1524         }
1525 
1526         return (IDM_STATUS_SUCCESS);
1527 }
1528 
1529 
1530 /*
1531  * idm_so_conn_is_capable() verifies that the passed connection is provided
1532  * for by the sockets interface.
1533  */
1534 /* ARGSUSED */
1535 static boolean_t
1536 idm_so_conn_is_capable(idm_conn_req_t *ic, idm_transport_caps_t *caps)
1537 {
1538         return (B_TRUE);
1539 }
1540 
1541 /*
1542  * idm_so_rx_datain() validates the Data Sequence number of the PDU. The
1543  * idm_sorecv_scsidata() function invoked earlier actually reads the data
1544  * off the socket into the appropriate buffers.
1545  */
1546 static void
1547 idm_so_rx_datain(idm_conn_t *ic, idm_pdu_t *pdu)
1548 {
1549         iscsi_data_hdr_t        *bhs;
1550         idm_task_t              *idt;
1551         idm_buf_t               *idb;
1552         uint32_t                datasn;
1553         size_t                  offset;
1554         iscsi_hdr_t             *ihp = (iscsi_hdr_t *)pdu->isp_hdr;
1555         iscsi_data_rsp_hdr_t    *idrhp = (iscsi_data_rsp_hdr_t *)ihp;
1556 
1557         ASSERT(ic != NULL);
1558         ASSERT(pdu != NULL);
1559 
1560         bhs     = (iscsi_data_hdr_t *)pdu->isp_hdr;
1561         datasn  = ntohl(bhs->datasn);
1562         offset  = ntohl(bhs->offset);
1563 
1564         ASSERT(bhs->opcode == ISCSI_OP_SCSI_DATA_RSP);
1565 
1566         /*
1567          * Look up the task corresponding to the initiator task tag
1568          * to get the buffers affiliated with the task.
1569          */
1570         idt = idm_task_find(ic, bhs->itt, bhs->ttt);
1571         if (idt == NULL) {
1572                 IDM_CONN_LOG(CE_WARN, "idm_so_rx_datain: failed to find task");
1573                 idm_pdu_rx_protocol_error(ic, pdu);
1574                 return;
1575         }
1576 
1577         idb = pdu->isp_sorx_buf;
1578         if (idb == NULL) {
1579                 IDM_CONN_LOG(CE_WARN,
1580                     "idm_so_rx_datain: failed to find buffer");
1581                 idm_task_rele(idt);
1582                 idm_pdu_rx_protocol_error(ic, pdu);
1583                 return;
1584         }
1585 
1586         /*
1587          * DataSN values should be sequential and should not have any gaps or
1588          * repetitions. Check the DataSN with the one stored in the task.
1589          */
1590         if (datasn == idt->idt_exp_datasn) {
1591                 idt->idt_exp_datasn++; /* keep track of DataSN received */
1592         } else {
1593                 IDM_CONN_LOG(CE_WARN, "idm_so_rx_datain: datasn out of order");
1594                 idm_task_rele(idt);
1595                 idm_pdu_rx_protocol_error(ic, pdu);
1596                 return;
1597         }
1598 
1599         /*
1600          * PDUs in a sequence should be in continuously increasing
1601          * address offset
1602          */
1603         if (offset != idb->idb_exp_offset) {
1604                 IDM_CONN_LOG(CE_WARN, "idm_so_rx_datain: unexpected offset");
1605                 idm_task_rele(idt);
1606                 idm_pdu_rx_protocol_error(ic, pdu);
1607                 return;
1608         }
1609         /* Expected next relative buffer offset */
1610         idb->idb_exp_offset += n2h24(bhs->dlength);
1611         idt->idt_rx_bytes += n2h24(bhs->dlength);
1612 
1613         idm_task_rele(idt);
1614 
1615         /*
1616          * For now call scsi_rsp which will process the data rsp
1617          * Revisit, need to provide an explicit client entry point for
1618          * phase collapse completions.
1619          */
1620         if (((ihp->opcode & ISCSI_OPCODE_MASK) == ISCSI_OP_SCSI_DATA_RSP) &&
1621             (idrhp->flags & ISCSI_FLAG_DATA_STATUS)) {
1622                 (*ic->ic_conn_ops.icb_rx_scsi_rsp)(ic, pdu);
1623         }
1624 
1625         idm_pdu_complete(pdu, IDM_STATUS_SUCCESS);
1626 }
1627 
1628 /*
1629  * The idm_so_rx_dataout() function is used by the iSCSI target to read
1630  * data from the Data-Out PDU sent by the iSCSI initiator.
1631  *
1632  * This function gets the Initiator Task Tag from the PDU BHS and looks up the
1633  * task to get the buffers associated with the PDU. A PDU might span buffers.
1634  * The data is then read into the respective buffer.
1635  */
1636 static void
1637 idm_so_rx_dataout(idm_conn_t *ic, idm_pdu_t *pdu)
1638 {
1639 
1640         iscsi_data_hdr_t        *bhs;
1641         idm_task_t              *idt;
1642         idm_buf_t               *idb;
1643         size_t                  offset;
1644 
1645         ASSERT(ic != NULL);
1646         ASSERT(pdu != NULL);
1647 
1648         bhs = (iscsi_data_hdr_t *)pdu->isp_hdr;
1649         offset = ntohl(bhs->offset);
1650         ASSERT(bhs->opcode == ISCSI_OP_SCSI_DATA);
1651 
1652         /*
1653          * Look up the task corresponding to the initiator task tag
1654          * to get the buffers affiliated with the task.
1655          */
1656         idt = idm_task_find(ic, bhs->itt, bhs->ttt);
1657         if (idt == NULL) {
1658                 IDM_CONN_LOG(CE_WARN,
1659                     "idm_so_rx_dataout: failed to find task");
1660                 idm_pdu_rx_protocol_error(ic, pdu);
1661                 return;
1662         }
1663 
1664         idb = pdu->isp_sorx_buf;
1665         if (idb == NULL) {
1666                 IDM_CONN_LOG(CE_WARN,
1667                     "idm_so_rx_dataout: failed to find buffer");
1668                 idm_task_rele(idt);
1669                 idm_pdu_rx_protocol_error(ic, pdu);
1670                 return;
1671         }
1672 
1673         /* Keep track of data transferred - check data offsets */
1674         if (offset != idb->idb_exp_offset) {
1675                 IDM_CONN_LOG(CE_NOTE, "idm_so_rx_dataout: offset out of seq: "
1676                     "%ld, %d", offset, idb->idb_exp_offset);
1677                 idm_task_rele(idt);
1678                 idm_pdu_rx_protocol_error(ic, pdu);
1679                 return;
1680         }
1681         /* Expected next relative offset */
1682         idb->idb_exp_offset += ntoh24(bhs->dlength);
1683         idt->idt_rx_bytes += n2h24(bhs->dlength);
1684 
1685         /*
1686          * Call the buffer callback when the transfer is complete
1687          *
1688          * The connection state machine should only abort tasks after
1689          * shutting down the connection so we are assured that there
1690          * won't be a simultaneous attempt to abort this task at the
1691          * same time as we are processing this PDU (due to a connection
1692          * state change).
1693          */
1694         if (bhs->flags & ISCSI_FLAG_FINAL) {
1695                 /*
1696                  * We only want to call idm_buf_rx_from_ini_done once
1697                  * per transfer.  It's possible that this task has
1698                  * already been aborted in which case
1699                  * idm_so_free_task_rsrc will call idm_buf_rx_from_ini_done
1700                  * for each buffer with idb_in_transport==B_TRUE.  To
1701                  * close this window and ensure that this doesn't happen,
1702                  * we'll clear idb->idb_in_transport now while holding
1703                  * the task mutex.   This is only really an issue for
1704                  * SCSI task abort -- if tasks were being aborted because
1705                  * of a connection state change the state machine would
1706                  * have already stopped the receive thread.
1707                  */
1708                 mutex_enter(&idt->idt_mutex);
1709 
1710                 /*
1711                  * Release the task hold here (obtained in idm_task_find)
1712                  * because the task may complete synchronously during
1713                  * idm_buf_rx_from_ini_done.  Since we still have an active
1714                  * buffer we know there is at least one additional hold on idt.
1715                  */
1716                 idm_task_rele(idt);
1717 
1718                 /*
1719                  * idm_buf_rx_from_ini_done releases idt->idt_mutex
1720                  */
1721                 DTRACE_ISCSI_8(xfer__done, idm_conn_t *, idt->idt_ic,
1722                     uintptr_t, idb->idb_buf, uint32_t, idb->idb_bufoffset,
1723                     uint64_t, 0, uint32_t, 0, uint32_t, 0,
1724                     uint32_t, idb->idb_xfer_len,
1725                     int, XFER_BUF_RX_FROM_INI);
1726                 idm_buf_rx_from_ini_done(idt, idb, IDM_STATUS_SUCCESS);
1727                 idm_pdu_complete(pdu, IDM_STATUS_SUCCESS);
1728                 return;
1729         }
1730 
1731         idm_task_rele(idt);
1732         idm_pdu_complete(pdu, IDM_STATUS_SUCCESS);
1733 }
1734 
1735 /*
1736  * The idm_so_rx_rtt() function is used by the iSCSI initiator to handle
1737  * the R2T PDU sent by the iSCSI target indicating that it is ready to
1738  * accept data. This gets the Initiator Task Tag (itt) from the PDU BHS
1739  * and looks up the task in the task tree using the itt to get the output
1740  * buffers associated the task. The R2T PDU contains the offset of the
1741  * requested data and the data length. This function then constructs a
1742  * sequence of iSCSI PDUs and outputs the requested data. Each Data-Out
1743  * PDU is associated with the R2T by the Target Transfer Tag  (ttt).
1744  */
1745 
1746 static void
1747 idm_so_rx_rtt(idm_conn_t *ic, idm_pdu_t *pdu)
1748 {
1749         idm_task_t              *idt;
1750         idm_buf_t               *idb;
1751         iscsi_rtt_hdr_t         *rtt_hdr;
1752         uint32_t                data_offset;
1753         uint32_t                data_length;
1754 
1755         ASSERT(ic != NULL);
1756         ASSERT(pdu != NULL);
1757 
1758         rtt_hdr = (iscsi_rtt_hdr_t *)pdu->isp_hdr;
1759         data_offset = ntohl(rtt_hdr->data_offset);
1760         data_length = ntohl(rtt_hdr->data_length);
1761         idt     = idm_task_find(ic, rtt_hdr->itt, rtt_hdr->ttt);
1762 
1763         if (idt == NULL) {
1764                 IDM_CONN_LOG(CE_WARN, "idm_so_rx_rtt: could not find task");
1765                 idm_pdu_rx_protocol_error(ic, pdu);
1766                 return;
1767         }
1768 
1769         /* Find the buffer bound to the task by the iSCSI initiator */
1770         mutex_enter(&idt->idt_mutex);
1771         idb = idm_buf_find(&idt->idt_outbufv, data_offset);
1772         if (idb == NULL) {
1773                 mutex_exit(&idt->idt_mutex);
1774                 idm_task_rele(idt);
1775                 IDM_CONN_LOG(CE_WARN, "idm_so_rx_rtt: could not find buffer");
1776                 idm_pdu_rx_protocol_error(ic, pdu);
1777                 return;
1778         }
1779 
1780         /* return buffer contains this data */
1781         if (data_offset + data_length > idb->idb_buflen) {
1782                 /* Overflow */
1783                 mutex_exit(&idt->idt_mutex);
1784                 idm_task_rele(idt);
1785                 IDM_CONN_LOG(CE_WARN, "idm_so_rx_rtt: read from outside "
1786                     "buffer");
1787                 idm_pdu_rx_protocol_error(ic, pdu);
1788                 return;
1789         }
1790 
1791         idt->idt_r2t_ttt = rtt_hdr->ttt;
1792         idt->idt_exp_datasn = 0;
1793 
1794         idm_so_send_rtt_data(ic, idt, idb, data_offset,
1795             ntohl(rtt_hdr->data_length));
1796         /*
1797          * the idt_mutex is released in idm_so_send_rtt_data
1798          */
1799 
1800         idm_pdu_complete(pdu, IDM_STATUS_SUCCESS);
1801         idm_task_rele(idt);
1802 
1803 }
1804 
1805 idm_status_t
1806 idm_sorecvdata(idm_conn_t *ic, idm_pdu_t *pdu)
1807 {
1808         uint8_t         pad[ISCSI_PAD_WORD_LEN];
1809         int             pad_len;
1810         uint32_t        data_digest_crc;
1811         uint32_t        crc_calculated;
1812         int             total_len;
1813         idm_so_conn_t   *so_conn;
1814 
1815         so_conn = ic->ic_transport_private;
1816 
1817         pad_len = ((ISCSI_PAD_WORD_LEN -
1818             (pdu->isp_datalen & (ISCSI_PAD_WORD_LEN - 1))) &
1819             (ISCSI_PAD_WORD_LEN - 1));
1820 
1821         ASSERT(pdu->isp_iovlen < (PDU_MAX_IOVLEN - 2)); /* pad + data digest */
1822 
1823         total_len = pdu->isp_datalen;
1824 
1825         if (pad_len) {
1826                 pdu->isp_iov[pdu->isp_iovlen].iov_base    = (char *)&pad;
1827                 pdu->isp_iov[pdu->isp_iovlen].iov_len     = pad_len;
1828                 total_len               += pad_len;
1829                 pdu->isp_iovlen++;
1830         }
1831 
1832         /* setup data digest */
1833         if ((ic->ic_conn_flags & IDM_CONN_DATA_DIGEST) != 0) {
1834                 pdu->isp_iov[pdu->isp_iovlen].iov_base =
1835                     (char *)&data_digest_crc;
1836                 pdu->isp_iov[pdu->isp_iovlen].iov_len =
1837                     sizeof (data_digest_crc);
1838                 total_len               += sizeof (data_digest_crc);
1839                 pdu->isp_iovlen++;
1840         }
1841 
1842         pdu->isp_data = (uint8_t *)(uintptr_t)pdu->isp_iov[0].iov_base;
1843 
1844         if (idm_iov_sorecv(so_conn->ic_so, &pdu->isp_iov[0],
1845             pdu->isp_iovlen, total_len) != 0) {
1846                 return (IDM_STATUS_IO);
1847         }
1848 
1849         if ((ic->ic_conn_flags & IDM_CONN_DATA_DIGEST) != 0) {
1850                 crc_calculated = idm_crc32c(pdu->isp_data,
1851                     pdu->isp_datalen);
1852                 if (pad_len) {
1853                         crc_calculated = idm_crc32c_continued((char *)&pad,
1854                             pad_len, crc_calculated);
1855                 }
1856                 if (crc_calculated != data_digest_crc) {
1857                         IDM_CONN_LOG(CE_WARN,
1858                             "idm_sorecvdata: "
1859                             "CRC error: actual 0x%x, calc 0x%x",
1860                             data_digest_crc, crc_calculated);
1861 
1862                         /* Invalid Data Digest */
1863                         return (IDM_STATUS_DATA_DIGEST);
1864                 }
1865         }
1866 
1867         return (IDM_STATUS_SUCCESS);
1868 }
1869 
1870 /*
1871  * idm_sorecv_scsidata() is used to receive scsi data from the socket. The
1872  * Data-type PDU header must be read into the idm_pdu_t structure prior to
1873  * calling this function.
1874  */
1875 idm_status_t
1876 idm_sorecv_scsidata(idm_conn_t *ic, idm_pdu_t *pdu)
1877 {
1878         iscsi_data_hdr_t        *bhs;
1879         idm_task_t              *task;
1880         uint32_t                offset;
1881         uint8_t                 opcode;
1882         uint32_t                dlength;
1883         list_t                  *buflst;
1884         uint32_t                xfer_bytes;
1885         idm_status_t            status;
1886 
1887         ASSERT(ic != NULL);
1888         ASSERT(pdu != NULL);
1889 
1890         bhs     = (iscsi_data_hdr_t *)pdu->isp_hdr;
1891 
1892         offset  = ntohl(bhs->offset);
1893         opcode  = bhs->opcode;
1894         dlength = n2h24(bhs->dlength);
1895 
1896         ASSERT((opcode == ISCSI_OP_SCSI_DATA_RSP) ||
1897             (opcode == ISCSI_OP_SCSI_DATA));
1898 
1899         /*
1900          * Successful lookup implicitly gets a "hold" on the task.  This
1901          * hold must be released before leaving this function.  At one
1902          * point we were caching this task context and retaining the hold
1903          * but it turned out to be very difficult to release the hold properly.
1904          * The task can be aborted and the connection shutdown between this
1905          * call and the subsequent expected call to idm_so_rx_datain/
1906          * idm_so_rx_dataout (in which case those functions are not called).
1907          * Releasing the hold in the PDU callback doesn't work well either
1908          * because the whole task may be completed by then at which point
1909          * it is too late to release the hold -- for better or worse this
1910          * code doesn't wait on the refcnts during normal operation.
1911          * idm_task_find() is very fast and it is not a huge burden if we
1912          * have to do it twice.
1913          */
1914         task = idm_task_find(ic, bhs->itt, bhs->ttt);
1915         if (task == NULL) {
1916                 IDM_CONN_LOG(CE_WARN,
1917                     "idm_sorecv_scsidata: could not find task");
1918                 return (IDM_STATUS_FAIL);
1919         }
1920 
1921         mutex_enter(&task->idt_mutex);
1922         buflst  = (opcode == ISCSI_OP_SCSI_DATA_RSP) ?
1923             &task->idt_inbufv : &task->idt_outbufv;
1924         pdu->isp_sorx_buf = idm_buf_find(buflst, offset);
1925         mutex_exit(&task->idt_mutex);
1926 
1927         if (pdu->isp_sorx_buf == NULL) {
1928                 idm_task_rele(task);
1929                 IDM_CONN_LOG(CE_WARN, "idm_sorecv_scsidata: could not find "
1930                     "buffer for offset %x opcode=%x",
1931                     offset, opcode);
1932                 return (IDM_STATUS_FAIL);
1933         }
1934 
1935         xfer_bytes = idm_fill_iov(pdu, pdu->isp_sorx_buf, offset, dlength);
1936         ASSERT(xfer_bytes != 0);
1937         if (xfer_bytes != dlength) {
1938                 idm_task_rele(task);
1939                 /*
1940                  * Buffer overflow, connection error.  The PDU data is still
1941                  * sitting in the socket so we can't use the connection
1942                  * again until that data is drained.
1943                  */
1944                 return (IDM_STATUS_FAIL);
1945         }
1946 
1947         status = idm_sorecvdata(ic, pdu);
1948 
1949         idm_task_rele(task);
1950 
1951         return (status);
1952 }
1953 
1954 static uint32_t
1955 idm_fill_iov(idm_pdu_t *pdu, idm_buf_t *idb, uint32_t ro, uint32_t dlength)
1956 {
1957         uint32_t        buf_ro = ro - idb->idb_bufoffset;
1958         uint32_t        xfer_len = min(dlength, idb->idb_buflen - buf_ro);
1959 
1960         ASSERT(ro >= idb->idb_bufoffset);
1961 
1962         pdu->isp_iov[pdu->isp_iovlen].iov_base    =
1963             (caddr_t)idb->idb_buf + buf_ro;
1964         pdu->isp_iov[pdu->isp_iovlen].iov_len     = xfer_len;
1965         pdu->isp_iovlen++;
1966 
1967         return (xfer_len);
1968 }
1969 
1970 int
1971 idm_sorecv_nonscsidata(idm_conn_t *ic, idm_pdu_t *pdu)
1972 {
1973         pdu->isp_data = kmem_alloc(pdu->isp_datalen, KM_SLEEP);
1974         ASSERT(pdu->isp_data != NULL);
1975 
1976         pdu->isp_databuflen = pdu->isp_datalen;
1977         pdu->isp_iov[0].iov_base = (caddr_t)pdu->isp_data;
1978         pdu->isp_iov[0].iov_len = pdu->isp_datalen;
1979         pdu->isp_iovlen = 1;
1980         /*
1981          * Since we are associating a new data buffer with this received
1982          * PDU we need to set a specific callback to free the data
1983          * after the PDU is processed.
1984          */
1985         pdu->isp_flags |= IDM_PDU_ADDL_DATA;
1986         pdu->isp_callback = idm_sorx_addl_pdu_cb;
1987 
1988         return (idm_sorecvdata(ic, pdu));
1989 }
1990 
1991 void
1992 idm_sorx_thread(void *arg)
1993 {
1994         boolean_t       conn_failure = B_FALSE;
1995         idm_conn_t      *ic = (idm_conn_t *)arg;
1996         idm_so_conn_t   *so_conn;
1997         idm_pdu_t       *pdu;
1998         idm_status_t    rc;
1999 
2000         idm_conn_hold(ic);
2001 
2002         mutex_enter(&ic->ic_mutex);
2003 
2004         so_conn = ic->ic_transport_private;
2005         so_conn->ic_rx_thread_running = B_TRUE;
2006         so_conn->ic_rx_thread_did = so_conn->ic_rx_thread->t_did;
2007         cv_signal(&ic->ic_cv);
2008 
2009         while (so_conn->ic_rx_thread_running) {
2010                 mutex_exit(&ic->ic_mutex);
2011 
2012                 /*
2013                  * Get PDU with default header size (large enough for
2014                  * BHS plus any anticipated AHS).  PDU from
2015                  * the cache will have all values set correctly
2016                  * for sockets RX including callback.
2017                  */
2018                 pdu = kmem_cache_alloc(idm.idm_sorx_pdu_cache, KM_SLEEP);
2019                 pdu->isp_ic = ic;
2020                 pdu->isp_flags = 0;
2021                 pdu->isp_transport_hdrlen = 0;
2022 
2023                 if ((rc = idm_sorecvhdr(ic, pdu)) != 0) {
2024                         /*
2025                          * Call idm_pdu_complete so that we call the callback
2026                          * and ensure any memory allocated in idm_sorecvhdr
2027                          * gets freed up.
2028                          */
2029                         idm_pdu_complete(pdu, IDM_STATUS_FAIL);
2030 
2031                         /*
2032                          * If ic_rx_thread_running is still set then
2033                          * this is some kind of connection problem
2034                          * on the socket.  In this case we want to
2035                          * generate an event.  Otherwise some other
2036                          * thread closed the socket due to another
2037                          * issue in which case we don't need to
2038                          * generate an event.
2039                          */
2040                         mutex_enter(&ic->ic_mutex);
2041                         if (so_conn->ic_rx_thread_running) {
2042                                 conn_failure = B_TRUE;
2043                                 so_conn->ic_rx_thread_running = B_FALSE;
2044                         }
2045 
2046                         continue;
2047                 }
2048 
2049                 /*
2050                  * Header has been read and validated.  Now we need
2051                  * to read the PDU data payload (if present).  SCSI data
2052                  * need to be transferred from the socket directly into
2053                  * the associated transfer buffer for the SCSI task.
2054                  */
2055                 if (pdu->isp_datalen != 0) {
2056                         if ((IDM_PDU_OPCODE(pdu) == ISCSI_OP_SCSI_DATA) ||
2057                             (IDM_PDU_OPCODE(pdu) == ISCSI_OP_SCSI_DATA_RSP)) {
2058                                 rc = idm_sorecv_scsidata(ic, pdu);
2059                                 /*
2060                                  * All SCSI errors are fatal to the
2061                                  * connection right now since we have no
2062                                  * place to put the data.  What we need
2063                                  * is some kind of sink to dispose of unwanted
2064                                  * SCSI data.  For example an invalid task tag
2065                                  * should not kill the connection (although
2066                                  * we may want to drop the connection).
2067                                  */
2068                         } else {
2069                                 /*
2070                                  * Not data PDUs so allocate a buffer for the
2071                                  * data segment and read the remaining data.
2072                                  */
2073                                 rc = idm_sorecv_nonscsidata(ic, pdu);
2074                         }
2075                         if (rc != 0) {
2076                                 /*
2077                                  * Call idm_pdu_complete so that we call the
2078                                  * callback and ensure any memory allocated
2079                                  * in idm_sorecvhdr gets freed up.
2080                                  */
2081                                 idm_pdu_complete(pdu, IDM_STATUS_FAIL);
2082 
2083                                 /*
2084                                  * If ic_rx_thread_running is still set then
2085                                  * this is some kind of connection problem
2086                                  * on the socket.  In this case we want to
2087                                  * generate an event.  Otherwise some other
2088                                  * thread closed the socket due to another
2089                                  * issue in which case we don't need to
2090                                  * generate an event.
2091                                  */
2092                                 mutex_enter(&ic->ic_mutex);
2093                                 if (so_conn->ic_rx_thread_running) {
2094                                         conn_failure = B_TRUE;
2095                                         so_conn->ic_rx_thread_running = B_FALSE;
2096                                 }
2097                                 continue;
2098                         }
2099                 }
2100 
2101                 /*
2102                  * Process RX PDU
2103                  */
2104                 idm_pdu_rx(ic, pdu);
2105 
2106                 mutex_enter(&ic->ic_mutex);
2107         }
2108 
2109         mutex_exit(&ic->ic_mutex);
2110 
2111         /*
2112          * If we dropped out of the RX processing loop because of
2113          * a socket problem or other connection failure (including
2114          * digest errors) then we need to generate a state machine
2115          * event to shut the connection down.
2116          * If the state machine is already in, for example, INIT_ERROR, this
2117          * event will get dropped, and the TX thread will never be notified
2118          * to shut down.  To be safe, we'll just notify it here.
2119          */
2120         if (conn_failure) {
2121                 if (so_conn->ic_tx_thread_running) {
2122                         so_conn->ic_tx_thread_running = B_FALSE;
2123                         mutex_enter(&so_conn->ic_tx_mutex);
2124                         cv_signal(&so_conn->ic_tx_cv);
2125                         mutex_exit(&so_conn->ic_tx_mutex);
2126                 }
2127 
2128                 idm_conn_event(ic, CE_TRANSPORT_FAIL, rc);
2129         }
2130 
2131         idm_conn_rele(ic);
2132 
2133         thread_exit();
2134 }
2135 
2136 /*
2137  * idm_so_tx
2138  *
2139  * This is the implementation of idm_transport_ops_t's it_tx_pdu entry
2140  * point.  By definition, it is supposed to be fast.  So, simply queue
2141  * the entry and return.  The real work is done by idm_i_so_tx() via
2142  * idm_sotx_thread().
2143  */
2144 
2145 static void
2146 idm_so_tx(idm_conn_t *ic, idm_pdu_t *pdu)
2147 {
2148         idm_so_conn_t *so_conn = ic->ic_transport_private;
2149 
2150         ASSERT(pdu->isp_ic == ic);
2151         mutex_enter(&so_conn->ic_tx_mutex);
2152 
2153         if (!so_conn->ic_tx_thread_running) {
2154                 mutex_exit(&so_conn->ic_tx_mutex);
2155                 idm_pdu_complete(pdu, IDM_STATUS_ABORTED);
2156                 return;
2157         }
2158 
2159         list_insert_tail(&so_conn->ic_tx_list, (void *)pdu);
2160         cv_signal(&so_conn->ic_tx_cv);
2161         mutex_exit(&so_conn->ic_tx_mutex);
2162 }
2163 
2164 static idm_status_t
2165 idm_i_so_tx(idm_pdu_t *pdu)
2166 {
2167         idm_conn_t      *ic = pdu->isp_ic;
2168         idm_status_t    status = IDM_STATUS_SUCCESS;
2169         uint8_t         pad[ISCSI_PAD_WORD_LEN];
2170         int             pad_len;
2171         uint32_t        hdr_digest_crc;
2172         uint32_t        data_digest_crc = 0;
2173         int             total_len = 0;
2174         int             iovlen = 0;
2175         struct iovec    iov[6];
2176         idm_so_conn_t   *so_conn;
2177 
2178         so_conn = ic->ic_transport_private;
2179 
2180         /* Setup BHS */
2181         iov[iovlen].iov_base    = (caddr_t)pdu->isp_hdr;
2182         iov[iovlen].iov_len     = pdu->isp_hdrlen;
2183         total_len               += iov[iovlen].iov_len;
2184         iovlen++;
2185 
2186         /* Setup header digest */
2187         if (((pdu->isp_flags & IDM_PDU_LOGIN_TX) == 0) &&
2188             (ic->ic_conn_flags & IDM_CONN_HEADER_DIGEST)) {
2189                 hdr_digest_crc = idm_crc32c(pdu->isp_hdr, pdu->isp_hdrlen);
2190 
2191                 iov[iovlen].iov_base    = (caddr_t)&hdr_digest_crc;
2192                 iov[iovlen].iov_len     = sizeof (hdr_digest_crc);
2193                 total_len               += iov[iovlen].iov_len;
2194                 iovlen++;
2195         }
2196 
2197         /* Setup the data */
2198         if (pdu->isp_datalen) {
2199                 idm_task_t              *idt;
2200                 idm_buf_t               *idb;
2201                 iscsi_data_hdr_t        *ihp;
2202                 ihp = (iscsi_data_hdr_t *)pdu->isp_hdr;
2203                 /* Write of immediate data */
2204                 if (ic->ic_ffp &&
2205                     (ihp->opcode == ISCSI_OP_SCSI_CMD ||
2206                     ihp->opcode == ISCSI_OP_SCSI_DATA)) {
2207                         idt = idm_task_find(ic, ihp->itt, ihp->ttt);
2208                         if (idt) {
2209                                 mutex_enter(&idt->idt_mutex);
2210                                 idb = idm_buf_find(&idt->idt_outbufv, 0);
2211                                 mutex_exit(&idt->idt_mutex);
2212                                 /*
2213                                  * If the initiator call to idm_buf_alloc
2214                                  * failed then we can get to this point
2215                                  * without a bound buffer.  The associated
2216                                  * connection failure will clean things up
2217                                  * later.  It would be nice to come up with
2218                                  * a cleaner way to handle this.  In
2219                                  * particular it seems absurd to look up
2220                                  * the task and the buffer just to update
2221                                  * this counter.
2222                                  */
2223                                 if (idb)
2224                                         idb->idb_xfer_len += pdu->isp_datalen;
2225                                 idm_task_rele(idt);
2226                         }
2227                 }
2228 
2229                 iov[iovlen].iov_base = (caddr_t)pdu->isp_data;
2230                 iov[iovlen].iov_len  = pdu->isp_datalen;
2231                 total_len += iov[iovlen].iov_len;
2232                 iovlen++;
2233         }
2234 
2235         /* Setup the data pad if necessary */
2236         pad_len = ((ISCSI_PAD_WORD_LEN -
2237             (pdu->isp_datalen & (ISCSI_PAD_WORD_LEN - 1))) &
2238             (ISCSI_PAD_WORD_LEN - 1));
2239 
2240         if (pad_len) {
2241                 bzero(pad, sizeof (pad));
2242                 iov[iovlen].iov_base = (void *)&pad;
2243                 iov[iovlen].iov_len  = pad_len;
2244                 total_len               += iov[iovlen].iov_len;
2245                 iovlen++;
2246         }
2247 
2248         /*
2249          * Setup the data digest if enabled.  Data-digest is not sent
2250          * for login-phase PDUs.
2251          */
2252         if ((ic->ic_conn_flags & IDM_CONN_DATA_DIGEST) &&
2253             ((pdu->isp_flags & IDM_PDU_LOGIN_TX) == 0) &&
2254             (pdu->isp_datalen || pad_len)) {
2255                 /*
2256                  * RFC3720/10.2.3: A zero-length Data Segment also
2257                  * implies a zero-length data digest.
2258                  */
2259                 if (pdu->isp_datalen) {
2260                         data_digest_crc = idm_crc32c(pdu->isp_data,
2261                             pdu->isp_datalen);
2262                 }
2263                 if (pad_len) {
2264                         data_digest_crc = idm_crc32c_continued(&pad,
2265                             pad_len, data_digest_crc);
2266                 }
2267 
2268                 iov[iovlen].iov_base    = (caddr_t)&data_digest_crc;
2269                 iov[iovlen].iov_len     = sizeof (data_digest_crc);
2270                 total_len               += iov[iovlen].iov_len;
2271                 iovlen++;
2272         }
2273 
2274         /* Transmit the PDU */
2275         if (idm_iov_sosend(so_conn->ic_so, &iov[0], iovlen,
2276             total_len) != 0) {
2277                 /* Set error status */
2278                 IDM_CONN_LOG(CE_WARN,
2279                     "idm_so_tx: failed to transmit the PDU, so: %p ic: %p "
2280                     "data: %p", (void *) so_conn->ic_so, (void *) ic,
2281                     (void *) pdu->isp_data);
2282                 status = IDM_STATUS_IO;
2283         }
2284 
2285         /*
2286          * Success does not mean that the PDU actually reached the
2287          * remote node since it could get dropped along the way.
2288          */
2289         idm_pdu_complete(pdu, status);
2290 
2291         return (status);
2292 }
2293 
2294 /*
2295  * The idm_so_buf_tx_to_ini() is used by the target iSCSI layer to transmit the
2296  * Data-In PDUs using sockets. Based on the negotiated MaxRecvDataSegmentLength,
2297  * the buffer is segmented into a sequence of Data-In PDUs, ordered by DataSN.
2298  * A target can invoke this function multiple times for a single read command
2299  * (identified by the same ITT) to split the input into several sequences.
2300  *
2301  * DataSN starts with 0 for the first data PDU of an input command and advances
2302  * by 1 for each subsequent data PDU. Each sequence will have its own F bit,
2303  * which is set to 1 for the last data PDU of a sequence.
2304  * If the initiator supports phase collapse, the status bit must be set along
2305  * with the F bit to indicate that the status is shipped together with the last
2306  * Data-In PDU.
2307  *
2308  * The data PDUs within a sequence will be sent in order with the buffer offset
2309  * in increasing order. i.e. initiator and target must have negotiated the
2310  * "DataPDUInOrder" to "Yes". The order between sequences is not enforced.
2311  *
2312  * Caller holds idt->idt_mutex
2313  */
2314 static idm_status_t
2315 idm_so_buf_tx_to_ini(idm_task_t *idt, idm_buf_t *idb)
2316 {
2317         idm_so_conn_t   *so_conn = idb->idb_ic->ic_transport_private;
2318         idm_pdu_t       tmppdu;
2319 
2320         ASSERT(mutex_owned(&idt->idt_mutex));
2321 
2322         /*
2323          * Put the idm_buf_t on the tx queue.  It will be transmitted by
2324          * idm_sotx_thread.
2325          */
2326         mutex_enter(&so_conn->ic_tx_mutex);
2327 
2328         DTRACE_ISCSI_8(xfer__start, idm_conn_t *, idt->idt_ic,
2329             uintptr_t, idb->idb_buf, uint32_t, idb->idb_bufoffset,
2330             uint64_t, 0, uint32_t, 0, uint32_t, 0,
2331             uint32_t, idb->idb_xfer_len, int, XFER_BUF_TX_TO_INI);
2332 
2333         if (!so_conn->ic_tx_thread_running) {
2334                 mutex_exit(&so_conn->ic_tx_mutex);
2335                 /*
2336                  * Don't release idt->idt_mutex since we're supposed to hold
2337                  * in when calling idm_buf_tx_to_ini_done
2338                  */
2339                 DTRACE_ISCSI_8(xfer__done, idm_conn_t *, idt->idt_ic,
2340                     uintptr_t, idb->idb_buf, uint32_t, idb->idb_bufoffset,
2341                     uint64_t, 0, uint32_t, 0, uint32_t, 0,
2342                     uint32_t, idb->idb_xfer_len,
2343                     int, XFER_BUF_TX_TO_INI);
2344                 idm_buf_tx_to_ini_done(idt, idb, IDM_STATUS_ABORTED);
2345                 return (IDM_STATUS_FAIL);
2346         }
2347 
2348         /*
2349          * Build a template for the data PDU headers we will use so that
2350          * the SN values will stay consistent with other PDU's we are
2351          * transmitting like R2T and SCSI status.
2352          */
2353         bzero(&idb->idb_data_hdr_tmpl, sizeof (iscsi_hdr_t));
2354         tmppdu.isp_hdr = &idb->idb_data_hdr_tmpl;
2355         (*idt->idt_ic->ic_conn_ops.icb_build_hdr)(idt, &tmppdu,
2356             ISCSI_OP_SCSI_DATA_RSP);
2357         idb->idb_tx_thread = B_TRUE;
2358         list_insert_tail(&so_conn->ic_tx_list, (void *)idb);
2359         cv_signal(&so_conn->ic_tx_cv);
2360         mutex_exit(&so_conn->ic_tx_mutex);
2361         mutex_exit(&idt->idt_mutex);
2362 
2363         /*
2364          * Returning success here indicates the transfer was successfully
2365          * dispatched -- it does not mean that the transfer completed
2366          * successfully.
2367          */
2368         return (IDM_STATUS_SUCCESS);
2369 }
2370 
2371 /*
2372  * The idm_so_buf_rx_from_ini() is used by the target iSCSI layer to specify the
2373  * data blocks it is ready to receive from the initiator in response to a WRITE
2374  * SCSI command. The target iSCSI layer passes the information about the desired
2375  * data blocks to the initiator in one R2T PDU. The receiving buffer, the buffer
2376  * offset and datalen are passed via the 'idb' argument.
2377  *
2378  * Scope for Prototype build:
2379  * R2Ts are required for any Data-Out PDU, i.e. initiator and target must have
2380  * negotiated the "InitialR2T" to "Yes".
2381  *
2382  * Caller holds idt->idt_mutex
2383  */
2384 static idm_status_t
2385 idm_so_buf_rx_from_ini(idm_task_t *idt, idm_buf_t *idb)
2386 {
2387         idm_pdu_t               *pdu;
2388         iscsi_rtt_hdr_t         *rtt;
2389 
2390         ASSERT(mutex_owned(&idt->idt_mutex));
2391 
2392         DTRACE_ISCSI_8(xfer__start, idm_conn_t *, idt->idt_ic,
2393             uintptr_t, idb->idb_buf, uint32_t, idb->idb_bufoffset,
2394             uint64_t, 0, uint32_t, 0, uint32_t, 0,
2395             uint32_t, idb->idb_xfer_len, int, XFER_BUF_RX_FROM_INI);
2396 
2397         pdu = kmem_cache_alloc(idm.idm_sotx_pdu_cache, KM_SLEEP);
2398         pdu->isp_ic = idt->idt_ic;
2399         pdu->isp_flags = IDM_PDU_SET_STATSN;
2400         bzero(pdu->isp_hdr, sizeof (iscsi_rtt_hdr_t));
2401 
2402         /* iSCSI layer fills the TTT, ITT, ExpCmdSN, MaxCmdSN */
2403         (*idt->idt_ic->ic_conn_ops.icb_build_hdr)(idt, pdu, ISCSI_OP_RTT_RSP);
2404 
2405         /* set the rttsn, rtt.flags, rtt.data_offset and rtt.data_length */
2406         rtt = (iscsi_rtt_hdr_t *)(pdu->isp_hdr);
2407 
2408         rtt->opcode          = ISCSI_OP_RTT_RSP;
2409         rtt->flags           = ISCSI_FLAG_FINAL;
2410         rtt->data_offset     = htonl(idb->idb_bufoffset);
2411         rtt->data_length     = htonl(idb->idb_xfer_len);
2412         rtt->rttsn           = htonl(idt->idt_exp_rttsn++);
2413 
2414         /* Keep track of buffer offsets */
2415         idb->idb_exp_offset  = idb->idb_bufoffset;
2416         mutex_exit(&idt->idt_mutex);
2417 
2418         /*
2419          * Transmit the PDU.
2420          */
2421         idm_pdu_tx(pdu);
2422 
2423         return (IDM_STATUS_SUCCESS);
2424 }
2425 
2426 static idm_status_t
2427 idm_so_buf_alloc(idm_buf_t *idb, uint64_t buflen)
2428 {
2429         if ((buflen > IDM_SO_BUF_CACHE_LB) && (buflen <= IDM_SO_BUF_CACHE_UB)) {
2430                 idb->idb_buf = kmem_cache_alloc(idm.idm_so_128k_buf_cache,
2431                     KM_NOSLEEP);
2432                 idb->idb_buf_private = idm.idm_so_128k_buf_cache;
2433         } else {
2434                 idb->idb_buf = kmem_alloc(buflen, KM_NOSLEEP);
2435                 idb->idb_buf_private = NULL;
2436         }
2437 
2438         if (idb->idb_buf == NULL) {
2439                 IDM_CONN_LOG(CE_NOTE,
2440                     "idm_so_buf_alloc: failed buffer allocation");
2441                 return (IDM_STATUS_FAIL);
2442         }
2443 
2444         return (IDM_STATUS_SUCCESS);
2445 }
2446 
2447 /* ARGSUSED */
2448 static idm_status_t
2449 idm_so_buf_setup(idm_buf_t *idb)
2450 {
2451         /* Ensure bufalloc'd flag is unset */
2452         idb->idb_bufalloc = B_FALSE;
2453 
2454         return (IDM_STATUS_SUCCESS);
2455 }
2456 
2457 /* ARGSUSED */
2458 static void
2459 idm_so_buf_teardown(idm_buf_t *idb)
2460 {
2461         /* nothing to do here */
2462 }
2463 
2464 static void
2465 idm_so_buf_free(idm_buf_t *idb)
2466 {
2467         if (idb->idb_buf_private == NULL) {
2468                 kmem_free(idb->idb_buf, idb->idb_buflen);
2469         } else {
2470                 kmem_cache_free(idb->idb_buf_private, idb->idb_buf);
2471         }
2472 }
2473 
2474 static void
2475 idm_so_send_rtt_data(idm_conn_t *ic, idm_task_t *idt, idm_buf_t *idb,
2476     uint32_t offset, uint32_t length)
2477 {
2478         idm_so_conn_t   *so_conn = ic->ic_transport_private;
2479         idm_pdu_t       tmppdu;
2480         idm_buf_t       *rtt_buf;
2481 
2482         ASSERT(mutex_owned(&idt->idt_mutex));
2483 
2484         /*
2485          * Allocate a buffer to represent the RTT transfer.  We could further
2486          * optimize this by allocating the buffers internally from an rtt
2487          * specific buffer cache since this is socket-specific code but for
2488          * now we will keep it simple.
2489          */
2490         rtt_buf = idm_buf_alloc(ic, (uint8_t *)idb->idb_buf + offset, length);
2491         if (rtt_buf == NULL) {
2492                 /*
2493                  * If we're in FFP then the failure was likely a resource
2494                  * allocation issue and we should close the connection by
2495                  * sending a CE_TRANSPORT_FAIL event.
2496                  *
2497                  * If we're not in FFP then idm_buf_alloc will always
2498                  * fail and the state is transitioning to "complete" anyway
2499                  * so we won't bother to send an event.
2500                  */
2501                 mutex_enter(&ic->ic_state_mutex);
2502                 if (ic->ic_ffp)
2503                         idm_conn_event_locked(ic, CE_TRANSPORT_FAIL,
2504                             NULL, CT_NONE);
2505                 mutex_exit(&ic->ic_state_mutex);
2506                 mutex_exit(&idt->idt_mutex);
2507                 return;
2508         }
2509 
2510         rtt_buf->idb_buf_cb = NULL;
2511         rtt_buf->idb_cb_arg = NULL;
2512         rtt_buf->idb_bufoffset = offset;
2513         rtt_buf->idb_xfer_len = length;
2514         rtt_buf->idb_ic = idt->idt_ic;
2515         rtt_buf->idb_task_binding = idt;
2516 
2517         /*
2518          * The new buffer (if any) represents an additional
2519          * reference on the task
2520          */
2521         idm_task_hold(idt);
2522         mutex_exit(&idt->idt_mutex);
2523 
2524         /*
2525          * Put the idm_buf_t on the tx queue.  It will be transmitted by
2526          * idm_sotx_thread.
2527          */
2528         mutex_enter(&so_conn->ic_tx_mutex);
2529 
2530         if (!so_conn->ic_tx_thread_running) {
2531                 idm_buf_free(rtt_buf);
2532                 mutex_exit(&so_conn->ic_tx_mutex);
2533                 idm_task_rele(idt);
2534                 return;
2535         }
2536 
2537         /*
2538          * Build a template for the data PDU headers we will use so that
2539          * the SN values will stay consistent with other PDU's we are
2540          * transmitting like R2T and SCSI status.
2541          */
2542         bzero(&rtt_buf->idb_data_hdr_tmpl, sizeof (iscsi_hdr_t));
2543         tmppdu.isp_hdr = &rtt_buf->idb_data_hdr_tmpl;
2544         (*idt->idt_ic->ic_conn_ops.icb_build_hdr)(idt, &tmppdu,
2545             ISCSI_OP_SCSI_DATA);
2546         rtt_buf->idb_tx_thread = B_TRUE;
2547         rtt_buf->idb_in_transport = B_TRUE;
2548         list_insert_tail(&so_conn->ic_tx_list, (void *)rtt_buf);
2549         cv_signal(&so_conn->ic_tx_cv);
2550         mutex_exit(&so_conn->ic_tx_mutex);
2551 }
2552 
2553 static void
2554 idm_so_send_rtt_data_done(idm_task_t *idt, idm_buf_t *idb)
2555 {
2556         /*
2557          * Don't worry about status -- we assume any error handling
2558          * is performed by the caller (idm_sotx_thread).
2559          */
2560         idb->idb_in_transport = B_FALSE;
2561         idm_task_rele(idt);
2562         idm_buf_free(idb);
2563 }
2564 
2565 static idm_status_t
2566 idm_so_send_buf_region(idm_task_t *idt, idm_buf_t *idb,
2567     uint32_t buf_region_offset, uint32_t buf_region_length)
2568 {
2569         idm_conn_t              *ic;
2570         uint32_t                max_dataseglen;
2571         size_t                  remainder, chunk;
2572         uint32_t                data_offset = buf_region_offset;
2573         iscsi_data_hdr_t        *bhs;
2574         idm_pdu_t               *pdu;
2575         idm_status_t            tx_status;
2576 
2577         ASSERT(mutex_owned(&idt->idt_mutex));
2578 
2579         ic = idt->idt_ic;
2580 
2581         max_dataseglen = ic->ic_conn_params.max_xmit_dataseglen;
2582         remainder = buf_region_length;
2583 
2584         while (remainder) {
2585                 if (idt->idt_state != TASK_ACTIVE) {
2586                         ASSERT((idt->idt_state != TASK_IDLE) &&
2587                             (idt->idt_state != TASK_COMPLETE));
2588                         return (IDM_STATUS_ABORTED);
2589                 }
2590 
2591                 /* check to see if we need to chunk the data */
2592                 if (remainder > max_dataseglen) {
2593                         chunk = max_dataseglen;
2594                 } else {
2595                         chunk = remainder;
2596                 }
2597 
2598                 /* Data PDU headers will always be sizeof (iscsi_hdr_t) */
2599                 pdu = kmem_cache_alloc(idm.idm_sotx_pdu_cache, KM_SLEEP);
2600                 pdu->isp_ic = ic;
2601                 pdu->isp_flags = 0;  /* initialize isp_flags */
2602 
2603                 /*
2604                  * We've already built a build a header template
2605                  * to use during the transfer.  Use this template so that
2606                  * the SN values stay consistent with any unrelated PDU's
2607                  * being transmitted.
2608                  */
2609                 bcopy(&idb->idb_data_hdr_tmpl, pdu->isp_hdr,
2610                     sizeof (iscsi_hdr_t));
2611 
2612                 /*
2613                  * Set DataSN, data offset, and flags in BHS
2614                  * For the prototype build, A = 0, S = 0, U = 0
2615                  */
2616                 bhs = (iscsi_data_hdr_t *)(pdu->isp_hdr);
2617 
2618                 bhs->datasn          = htonl(idt->idt_exp_datasn++);
2619 
2620                 hton24(bhs->dlength, chunk);
2621                 bhs->offset = htonl(idb->idb_bufoffset + data_offset);
2622 
2623                 /* setup data */
2624                 pdu->isp_data        =  (uint8_t *)idb->idb_buf + data_offset;
2625                 pdu->isp_datalen = (uint_t)chunk;
2626 
2627                 if (chunk == remainder) {
2628                         bhs->flags = ISCSI_FLAG_FINAL; /* F bit set to 1 */
2629                         /* Piggyback the status with the last data PDU */
2630                         if (idt->idt_flags & IDM_TASK_PHASECOLLAPSE_REQ) {
2631                                 pdu->isp_flags |= IDM_PDU_SET_STATSN |
2632                                     IDM_PDU_ADVANCE_STATSN;
2633                                 (*idt->idt_ic->ic_conn_ops.icb_update_statsn)
2634                                     (idt, pdu);
2635                                 idt->idt_flags |=
2636                                     IDM_TASK_PHASECOLLAPSE_SUCCESS;
2637 
2638                         }
2639                 }
2640 
2641                 remainder       -= chunk;
2642                 data_offset     += chunk;
2643 
2644                 /* Instrument the data-send DTrace probe. */
2645                 if (IDM_PDU_OPCODE(pdu) == ISCSI_OP_SCSI_DATA_RSP) {
2646                         DTRACE_ISCSI_2(data__send,
2647                             idm_conn_t *, idt->idt_ic,
2648                             iscsi_data_rsp_hdr_t *,
2649                             (iscsi_data_rsp_hdr_t *)pdu->isp_hdr);
2650                 }
2651 
2652                 /*
2653                  * Now that we're done working with idt_exp_datasn,
2654                  * idt->idt_state and idb->idb_bufoffset we can release
2655                  * the task lock -- don't want to hold it across the
2656                  * call to idm_i_so_tx since we could block.
2657                  */
2658                 mutex_exit(&idt->idt_mutex);
2659 
2660                 /*
2661                  * Transmit the PDU.  Call the internal routine directly
2662                  * as there is already implicit ordering.
2663                  */
2664                 if ((tx_status = idm_i_so_tx(pdu)) != IDM_STATUS_SUCCESS) {
2665                         mutex_enter(&idt->idt_mutex);
2666                         return (tx_status);
2667                 }
2668 
2669                 mutex_enter(&idt->idt_mutex);
2670                 idt->idt_tx_bytes += chunk;
2671         }
2672 
2673         return (IDM_STATUS_SUCCESS);
2674 }
2675 
2676 /*
2677  * TX PDU cache
2678  */
2679 /* ARGSUSED */
2680 int
2681 idm_sotx_pdu_constructor(void *hdl, void *arg, int flags)
2682 {
2683         idm_pdu_t       *pdu = hdl;
2684 
2685         bzero(pdu, sizeof (idm_pdu_t));
2686         pdu->isp_hdr = (iscsi_hdr_t *)(pdu + 1); /* Ptr arithmetic */
2687         pdu->isp_hdrlen = sizeof (iscsi_hdr_t);
2688         pdu->isp_callback = idm_sotx_cache_pdu_cb;
2689         pdu->isp_magic = IDM_PDU_MAGIC;
2690         bzero(pdu->isp_hdr, sizeof (iscsi_hdr_t));
2691 
2692         return (0);
2693 }
2694 
2695 /* ARGSUSED */
2696 void
2697 idm_sotx_cache_pdu_cb(idm_pdu_t *pdu, idm_status_t status)
2698 {
2699         /* reset values between use */
2700         pdu->isp_datalen = 0;
2701 
2702         kmem_cache_free(idm.idm_sotx_pdu_cache, pdu);
2703 }
2704 
2705 /*
2706  * RX PDU cache
2707  */
2708 /* ARGSUSED */
2709 int
2710 idm_sorx_pdu_constructor(void *hdl, void *arg, int flags)
2711 {
2712         idm_pdu_t       *pdu = hdl;
2713 
2714         bzero(pdu, sizeof (idm_pdu_t));
2715         pdu->isp_magic = IDM_PDU_MAGIC;
2716         pdu->isp_hdr = (iscsi_hdr_t *)(pdu + 1); /* Ptr arithmetic */
2717         pdu->isp_callback = idm_sorx_cache_pdu_cb;
2718 
2719         return (0);
2720 }
2721 
2722 /* ARGSUSED */
2723 static void
2724 idm_sorx_cache_pdu_cb(idm_pdu_t *pdu, idm_status_t status)
2725 {
2726         pdu->isp_iovlen = 0;
2727         pdu->isp_sorx_buf = 0;
2728         kmem_cache_free(idm.idm_sorx_pdu_cache, pdu);
2729 }
2730 
2731 static void
2732 idm_sorx_addl_pdu_cb(idm_pdu_t *pdu, idm_status_t status)
2733 {
2734         /*
2735          * We had to modify our cached RX PDU with a longer header buffer
2736          * and/or a longer data buffer.  Release the new buffers and fix
2737          * the fields back to what we would expect for a cached RX PDU.
2738          */
2739         if (pdu->isp_flags & IDM_PDU_ADDL_HDR) {
2740                 kmem_free(pdu->isp_hdr, pdu->isp_hdrlen);
2741         }
2742         if (pdu->isp_flags & IDM_PDU_ADDL_DATA) {
2743                 kmem_free(pdu->isp_data, pdu->isp_datalen);
2744         }
2745         pdu->isp_hdr = (iscsi_hdr_t *)(pdu + 1);
2746         pdu->isp_hdrlen = sizeof (iscsi_hdr_t);
2747         pdu->isp_data = NULL;
2748         pdu->isp_datalen = 0;
2749         pdu->isp_sorx_buf = 0;
2750         pdu->isp_callback = idm_sorx_cache_pdu_cb;
2751         idm_sorx_cache_pdu_cb(pdu, status);
2752 }
2753 
2754 /*
2755  * This thread is only active when I/O is queued for transmit
2756  * because the socket is busy.
2757  */
2758 void
2759 idm_sotx_thread(void *arg)
2760 {
2761         idm_conn_t      *ic = arg;
2762         idm_tx_obj_t    *object, *next;
2763         idm_so_conn_t   *so_conn;
2764         idm_status_t    status = IDM_STATUS_SUCCESS;
2765 
2766         idm_conn_hold(ic);
2767 
2768         mutex_enter(&ic->ic_mutex);
2769         so_conn = ic->ic_transport_private;
2770         so_conn->ic_tx_thread_running = B_TRUE;
2771         so_conn->ic_tx_thread_did = so_conn->ic_tx_thread->t_did;
2772         cv_signal(&ic->ic_cv);
2773         mutex_exit(&ic->ic_mutex);
2774 
2775         mutex_enter(&so_conn->ic_tx_mutex);
2776 
2777         while (so_conn->ic_tx_thread_running) {
2778                 while (list_is_empty(&so_conn->ic_tx_list)) {
2779                         DTRACE_PROBE1(soconn__tx__sleep, idm_conn_t *, ic);
2780                         cv_wait(&so_conn->ic_tx_cv, &so_conn->ic_tx_mutex);
2781                         DTRACE_PROBE1(soconn__tx__wakeup, idm_conn_t *, ic);
2782 
2783                         if (!so_conn->ic_tx_thread_running) {
2784                                 goto tx_bail;
2785                         }
2786                 }
2787 
2788                 object = (idm_tx_obj_t *)list_head(&so_conn->ic_tx_list);
2789                 list_remove(&so_conn->ic_tx_list, object);
2790                 mutex_exit(&so_conn->ic_tx_mutex);
2791 
2792                 switch (object->idm_tx_obj_magic) {
2793                 case IDM_PDU_MAGIC: {
2794                         idm_pdu_t *pdu = (idm_pdu_t *)object;
2795                         DTRACE_PROBE2(soconn__tx__pdu, idm_conn_t *, ic,
2796                             idm_pdu_t *, (idm_pdu_t *)object);
2797 
2798                         if (pdu->isp_flags & IDM_PDU_SET_STATSN) {
2799                                 /* No IDM task */
2800                                 (ic->ic_conn_ops.icb_update_statsn)(NULL, pdu);
2801                         }
2802                         status = idm_i_so_tx((idm_pdu_t *)object);
2803                         break;
2804                 }
2805                 case IDM_BUF_MAGIC: {
2806                         idm_buf_t *idb = (idm_buf_t *)object;
2807                         idm_task_t *idt = idb->idb_task_binding;
2808 
2809                         DTRACE_PROBE2(soconn__tx__buf, idm_conn_t *, ic,
2810                             idm_buf_t *, idb);
2811 
2812                         mutex_enter(&idt->idt_mutex);
2813                         status = idm_so_send_buf_region(idt,
2814                             idb, 0, idb->idb_xfer_len);
2815 
2816                         /*
2817                          * TX thread owns the buffer so we expect it to
2818                          * be "in transport"
2819                          */
2820                         ASSERT(idb->idb_in_transport);
2821                         if (IDM_CONN_ISTGT(ic)) {
2822                                 /*
2823                                  * idm_buf_tx_to_ini_done releases
2824                                  * idt->idt_mutex
2825                                  */
2826                                 DTRACE_ISCSI_8(xfer__done,
2827                                     idm_conn_t *, idt->idt_ic,
2828                                     uintptr_t, idb->idb_buf,
2829                                     uint32_t, idb->idb_bufoffset,
2830                                     uint64_t, 0, uint32_t, 0, uint32_t, 0,
2831                                     uint32_t, idb->idb_xfer_len,
2832                                     int, XFER_BUF_TX_TO_INI);
2833                                 idm_buf_tx_to_ini_done(idt, idb, status);
2834                         } else {
2835                                 idm_so_send_rtt_data_done(idt, idb);
2836                                 mutex_exit(&idt->idt_mutex);
2837                         }
2838                         break;
2839                 }
2840 
2841                 default:
2842                         IDM_CONN_LOG(CE_WARN, "idm_sotx_thread: Unknown magic "
2843                             "(0x%08x)", object->idm_tx_obj_magic);
2844                         status = IDM_STATUS_FAIL;
2845                 }
2846 
2847                 mutex_enter(&so_conn->ic_tx_mutex);
2848 
2849                 if (status != IDM_STATUS_SUCCESS) {
2850                         so_conn->ic_tx_thread_running = B_FALSE;
2851                         idm_conn_event(ic, CE_TRANSPORT_FAIL, status);
2852                 }
2853         }
2854 
2855         /*
2856          * Before we leave, we need to abort every item remaining in the
2857          * TX list.
2858          */
2859 
2860 tx_bail:
2861         object = (idm_tx_obj_t *)list_head(&so_conn->ic_tx_list);
2862 
2863         while (object != NULL) {
2864                 next = list_next(&so_conn->ic_tx_list, object);
2865 
2866                 list_remove(&so_conn->ic_tx_list, object);
2867                 switch (object->idm_tx_obj_magic) {
2868                 case IDM_PDU_MAGIC:
2869                         idm_pdu_complete((idm_pdu_t *)object,
2870                             IDM_STATUS_ABORTED);
2871                         break;
2872 
2873                 case IDM_BUF_MAGIC: {
2874                         idm_buf_t *idb = (idm_buf_t *)object;
2875                         idm_task_t *idt = idb->idb_task_binding;
2876                         mutex_exit(&so_conn->ic_tx_mutex);
2877                         mutex_enter(&idt->idt_mutex);
2878                         /*
2879                          * TX thread owns the buffer so we expect it to
2880                          * be "in transport"
2881                          */
2882                         ASSERT(idb->idb_in_transport);
2883                         if (IDM_CONN_ISTGT(ic)) {
2884                                 /*
2885                                  * idm_buf_tx_to_ini_done releases
2886                                  * idt->idt_mutex
2887                                  */
2888                                 DTRACE_ISCSI_8(xfer__done,
2889                                     idm_conn_t *, idt->idt_ic,
2890                                     uintptr_t, idb->idb_buf,
2891                                     uint32_t, idb->idb_bufoffset,
2892                                     uint64_t, 0, uint32_t, 0, uint32_t, 0,
2893                                     uint32_t, idb->idb_xfer_len,
2894                                     int, XFER_BUF_TX_TO_INI);
2895                                 idm_buf_tx_to_ini_done(idt, idb,
2896                                     IDM_STATUS_ABORTED);
2897                         } else {
2898                                 idm_so_send_rtt_data_done(idt, idb);
2899                                 mutex_exit(&idt->idt_mutex);
2900                         }
2901                         mutex_enter(&so_conn->ic_tx_mutex);
2902                         break;
2903                 }
2904                 default:
2905                         IDM_CONN_LOG(CE_WARN,
2906                             "idm_sotx_thread: Unexpected magic "
2907                             "(0x%08x)", object->idm_tx_obj_magic);
2908                 }
2909 
2910                 object = next;
2911         }
2912 
2913         mutex_exit(&so_conn->ic_tx_mutex);
2914         idm_conn_rele(ic);
2915         thread_exit();
2916         /*NOTREACHED*/
2917 }
2918 
2919 static void
2920 idm_so_socket_set_nonblock(struct sonode *node)
2921 {
2922         (void) VOP_SETFL(node->so_vnode, node->so_flag,
2923             (node->so_state | FNONBLOCK), CRED(), NULL);
2924 }
2925 
2926 static void
2927 idm_so_socket_set_block(struct sonode *node)
2928 {
2929         (void) VOP_SETFL(node->so_vnode, node->so_flag,
2930             (node->so_state & (~FNONBLOCK)), CRED(), NULL);
2931 }
2932 
2933 
2934 /*
2935  * Called by kernel sockets when the connection has been accepted or
2936  * rejected. In early volo, a "disconnect" callback was sent instead of
2937  * "connectfailed", so we check for both.
2938  */
2939 /* ARGSUSED */
2940 void
2941 idm_so_timed_socket_connect_cb(ksocket_t ks,
2942     ksocket_callback_event_t ev, void *arg, uintptr_t info)
2943 {
2944         idm_so_timed_socket_t   *itp = arg;
2945         ASSERT(itp != NULL);
2946         ASSERT(ev == KSOCKET_EV_CONNECTED ||
2947             ev == KSOCKET_EV_CONNECTFAILED ||
2948             ev == KSOCKET_EV_DISCONNECTED);
2949 
2950         mutex_enter(&idm_so_timed_socket_mutex);
2951         itp->it_callback_called = B_TRUE;
2952         if (ev == KSOCKET_EV_CONNECTED) {
2953                 itp->it_socket_error_code = 0;
2954         } else {
2955                 /* Make sure the error code is non-zero on error */
2956                 if (info == 0)
2957                         info = ECONNRESET;
2958                 itp->it_socket_error_code = (int)info;
2959         }
2960         cv_signal(&itp->it_cv);
2961         mutex_exit(&idm_so_timed_socket_mutex);
2962 }
2963 
2964 int
2965 idm_so_timed_socket_connect(ksocket_t ks,
2966     struct sockaddr_storage *sa, int sa_sz, int login_max_usec)
2967 {
2968         clock_t                 conn_login_max;
2969         int                     rc, nonblocking, rval;
2970         idm_so_timed_socket_t   it;
2971         ksocket_callbacks_t     ks_cb;
2972 
2973         conn_login_max = ddi_get_lbolt() + drv_usectohz(login_max_usec);
2974 
2975         /*
2976          * Set to non-block socket mode, with callback on connect
2977          * Early volo used "disconnected" instead of "connectfailed",
2978          * so set callback to look for both.
2979          */
2980         bzero(&it, sizeof (it));
2981         ks_cb.ksock_cb_flags = KSOCKET_CB_CONNECTED |
2982             KSOCKET_CB_CONNECTFAILED | KSOCKET_CB_DISCONNECTED;
2983         ks_cb.ksock_cb_connected = idm_so_timed_socket_connect_cb;
2984         ks_cb.ksock_cb_connectfailed = idm_so_timed_socket_connect_cb;
2985         ks_cb.ksock_cb_disconnected = idm_so_timed_socket_connect_cb;
2986         cv_init(&it.it_cv, NULL, CV_DEFAULT, NULL);
2987         rc = ksocket_setcallbacks(ks, &ks_cb, &it, CRED());
2988         if (rc != 0)
2989                 return (rc);
2990 
2991         /* Set to non-blocking mode */
2992         nonblocking = 1;
2993         rc = ksocket_ioctl(ks, FIONBIO, (intptr_t)&nonblocking, &rval,
2994             CRED());
2995         if (rc != 0)
2996                 goto cleanup;
2997 
2998         bzero(&it, sizeof (it));
2999         for (;;) {
3000                 /*
3001                  * Warning -- in a loopback scenario, the call to
3002                  * the connect_cb can occur inside the call to
3003                  * ksocket_connect. Do not hold the mutex around the
3004                  * call to ksocket_connect.
3005                  */
3006                 rc = ksocket_connect(ks, (struct sockaddr *)sa, sa_sz, CRED());
3007                 if (rc == 0 || rc == EISCONN) {
3008                         /* socket success or already success */
3009                         rc = 0;
3010                         break;
3011                 }
3012                 if ((rc != EINPROGRESS) && (rc != EALREADY)) {
3013                         break;
3014                 }
3015 
3016                 /* TCP connect still in progress. See if out of time. */
3017                 if (ddi_get_lbolt() > conn_login_max) {
3018                         /*
3019                          * Connection retry timeout,
3020                          * failed connect to target.
3021                          */
3022                         rc = ETIMEDOUT;
3023                         break;
3024                 }
3025 
3026                 /*
3027                  * TCP connect still in progress.  Sleep until callback.
3028                  * Do NOT go to sleep if the callback already occurred!
3029                  */
3030                 mutex_enter(&idm_so_timed_socket_mutex);
3031                 if (!it.it_callback_called) {
3032                         (void) cv_timedwait(&it.it_cv,
3033                             &idm_so_timed_socket_mutex, conn_login_max);
3034                 }
3035                 if (it.it_callback_called) {
3036                         rc = it.it_socket_error_code;
3037                         mutex_exit(&idm_so_timed_socket_mutex);
3038                         break;
3039                 }
3040                 /* If timer expires, go call ksocket_connect one last time. */
3041                 mutex_exit(&idm_so_timed_socket_mutex);
3042         }
3043 
3044         /* resume blocking mode */
3045         nonblocking = 0;
3046         (void) ksocket_ioctl(ks, FIONBIO, (intptr_t)&nonblocking, &rval,
3047             CRED());
3048 cleanup:
3049         (void) ksocket_setcallbacks(ks, NULL, NULL, CRED());
3050         cv_destroy(&it.it_cv);
3051         if (rc != 0) {
3052                 idm_soshutdown(ks);
3053         }
3054         return (rc);
3055 }
3056 
3057 
3058 void
3059 idm_addr_to_sa(idm_addr_t *dportal, struct sockaddr_storage *sa)
3060 {
3061         int                     dp_addr_size;
3062         struct sockaddr_in      *sin;
3063         struct sockaddr_in6     *sin6;
3064 
3065         /* Build sockaddr_storage for this portal (idm_addr_t) */
3066         bzero(sa, sizeof (*sa));
3067         dp_addr_size = dportal->a_addr.i_insize;
3068         if (dp_addr_size == sizeof (struct in_addr)) {
3069                 /* IPv4 */
3070                 sa->ss_family = AF_INET;
3071                 sin = (struct sockaddr_in *)sa;
3072                 sin->sin_port = htons(dportal->a_port);
3073                 bcopy(&dportal->a_addr.i_addr.in4,
3074                     &sin->sin_addr, sizeof (struct in_addr));
3075         } else if (dp_addr_size == sizeof (struct in6_addr)) {
3076                 /* IPv6 */
3077                 sa->ss_family = AF_INET6;
3078                 sin6 = (struct sockaddr_in6 *)sa;
3079                 sin6->sin6_port = htons(dportal->a_port);
3080                 bcopy(&dportal->a_addr.i_addr.in6,
3081                     &sin6->sin6_addr, sizeof (struct in6_addr));
3082         } else {
3083                 ASSERT(0);
3084         }
3085 }
3086 
3087 
3088 /*
3089  * return a human-readable form of a sockaddr_storage, in the form
3090  * [ip-address]:port.  This is used in calls to logging functions.
3091  * If several calls to idm_sa_ntop are made within the same invocation
3092  * of a logging function, then each one needs its own buf.
3093  */
3094 const char *
3095 idm_sa_ntop(const struct sockaddr_storage *sa,
3096     char *buf, size_t size)
3097 {
3098         static const char bogus_ip[] = "[0].-1";
3099         char tmp[INET6_ADDRSTRLEN];
3100 
3101         switch (sa->ss_family) {
3102         case AF_INET6:
3103                 {
3104                         const struct sockaddr_in6 *in6 =
3105                             (const struct sockaddr_in6 *) sa;
3106 
3107                         if (inet_ntop(in6->sin6_family,
3108                             &in6->sin6_addr, tmp, sizeof (tmp)) == NULL) {
3109                                 goto err;
3110                         }
3111                         if (strlen(tmp) + sizeof ("[].65535") > size) {
3112                                 goto err;
3113                         }
3114                         /* struct sockaddr_storage gets port info from v4 loc */
3115                         (void) snprintf(buf, size, "[%s].%u", tmp,
3116                             ntohs(in6->sin6_port));
3117                         return (buf);
3118                 }
3119         case AF_INET:
3120                 {
3121                         const struct sockaddr_in *in =
3122                             (const struct sockaddr_in *) sa;
3123 
3124                         if (inet_ntop(in->sin_family, &in->sin_addr,
3125                             tmp, sizeof (tmp)) == NULL) {
3126                                 goto err;
3127                         }
3128                         if (strlen(tmp) + sizeof ("[].65535") > size) {
3129                                 goto err;
3130                         }
3131                         (void) snprintf(buf, size,  "[%s].%u", tmp,
3132                             ntohs(in->sin_port));
3133                         return (buf);
3134                 }
3135         default:
3136                 break;
3137         }
3138 err:
3139         (void) snprintf(buf, size, "%s", bogus_ip);
3140         return (buf);
3141 }