X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=MdeModulePkg%2FUniversal%2FNetwork%2FIScsiDxe%2FIScsiProto.c;h=9fb848080af37cd24a291829b4cab1f5d1f8d6bc;hb=131818ba5a83d1e8f3f1b4c041200755fff64abb;hp=7db57506b9ba28f89f4610c673c21bf4d1e44462;hpb=fe1e36e550c6ffcd2561903d434683d3939e1942;p=mirror_edk2.git

diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiProto.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiProto.c
index 7db57506b9..9fb848080a 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiProto.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiProto.c
@@ -1,8 +1,8 @@
 /** @file
-  The implementation of IScsi protocol based on RFC3720
+  The implementation of iSCSI protocol based on RFC3720.
 
-Copyright (c) 2004 - 2008, Intel Corporation
-All rights reserved. This program and the accompanying materials
+Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
+This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
 http://opensource.org/licenses/bsd-license.php
@@ -10,13 +10,6 @@ http://opensource.org/licenses/bsd-license.php
 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 
-Module Name:
-
-  IScsiProto.c
-
-Abstract:
-  The implementation of IScsi protocol based on RFC3720
-
 **/
 
 #include "IScsiImpl.h"
@@ -24,19 +17,15 @@ Abstract:
 UINT32 mDataSegPad = 0;
 
 /**
-  Attach the iSCSI connection to the iSCSI session. 
-
-  @param  Session[in] The iSCSI session.
-
-  @param  Conn[in]    The iSCSI connection.
-
-  @retval None.
+  Attach the iSCSI connection to the iSCSI session.
 
+  @param[in, out]  Session The iSCSI session.
+  @param[in, out]  Conn    The iSCSI connection.
 **/
 VOID
 IScsiAttatchConnection (
-  IN ISCSI_SESSION     *Session,
-  IN ISCSI_CONNECTION  *Conn
+  IN OUT ISCSI_SESSION     *Session,
+  IN OUT ISCSI_CONNECTION  *Conn
   )
 {
   InsertTailList (&Session->Conns, &Conn->Link);
@@ -45,16 +34,13 @@ IScsiAttatchConnection (
 }
 
 /**
-  Detach the iSCSI connection from the session it belongs to. 
-
-  @param  Conn[in] The iSCSI connection.
-
-  @retval None.
+  Detach the iSCSI connection from the session it belongs to.
 
+  @param[in, out]  Conn The iSCSI connection.
 **/
 VOID
 IScsiDetatchConnection (
-  IN ISCSI_CONNECTION  *Conn
+  IN OUT ISCSI_CONNECTION  *Conn
   )
 {
   RemoveEntryList (&Conn->Link);
@@ -63,19 +49,19 @@ IScsiDetatchConnection (
 }
 
 /**
-  Check the sequence number according to RFC3720. 
-
-  @param  ExpSN[in]   The currently expected sequence number.
-
-  @param  NewSN[in]   The sequence number to check.
+  Check the sequence number according to RFC3720.
 
-  @retval EFI_SUCCESS The check passed and the ExpSN is increased.
+  @param[in, out]  ExpSN   The currently expected sequence number.
+  @param[in]       NewSN   The sequence number to check.
 
+  @retval EFI_SUCCESS         The check passed and the ExpSN is increased.
+  @retval EFI_NOT_READY       Response was sent due to a retransmission request.
+  @retval EFI_PROTOCOL_ERROR  Some kind of iSCSI protocol error happened.
 **/
 EFI_STATUS
 IScsiCheckSN (
-  IN UINT32  *ExpSN,
-  IN UINT32  NewSN
+  IN OUT UINT32  *ExpSN,
+  IN UINT32      NewSN
   )
 {
   if (!ISCSI_SEQ_EQ (NewSN, *ExpSN)) {
@@ -99,20 +85,15 @@ IScsiCheckSN (
 /**
   Update the sequence numbers for the iSCSI command.
 
-  @param  Session[in]  The iSCSI session.
-
-  @param  MaxCmdSN[in] Maximum CmdSN from the target.
-
-  @param  ExpCmdSN[in] Next expected CmdSN from the target.
-
-  @retval None.
-
+  @param[in, out]  Session  The iSCSI session.
+  @param[in]       MaxCmdSN Maximum CmdSN from the target.
+  @param[in]       ExpCmdSN Next expected CmdSN from the target.
 **/
 VOID
 IScsiUpdateCmdSN (
-  IN ISCSI_SESSION  *Session,
-  IN UINT32         MaxCmdSN,
-  IN UINT32         ExpCmdSN
+  IN OUT ISCSI_SESSION  *Session,
+  IN UINT32             MaxCmdSN,
+  IN UINT32             ExpCmdSN
   )
 {
   if (ISCSI_SEQ_LT (MaxCmdSN, ExpCmdSN - 1)) {
@@ -131,18 +112,15 @@ IScsiUpdateCmdSN (
 /**
   This function does the iSCSI connection login.
 
-  @param  Conn[in]           The iSCSI connection to login.
+  @param[in, out]  Conn      The iSCSI connection to login.
 
   @retval EFI_SUCCESS        The iSCSI connection is logged into the iSCSI target.
-
   @retval EFI_TIMEOUT        Timeout happened during the login procedure.
-
-  @retval EFI_PROTOCOL_ERROR Some kind of iSCSI protocol error happened.
-
+  @retval Others             Other errors as indicated.
 **/
 EFI_STATUS
 IScsiConnLogin (
-  IN ISCSI_CONNECTION  *Conn
+  IN OUT ISCSI_CONNECTION  *Conn
   )
 {
   EFI_STATUS  Status;
@@ -186,14 +164,11 @@ IScsiConnLogin (
 /**
   Reset the iSCSI connection.
 
-  @param  Conn[in] The iSCSI connection to reset.
-
-  @retval None.
-
+  @param[in, out]  Conn The iSCSI connection to reset.
 **/
 VOID
 IScsiConnReset (
-  IN ISCSI_CONNECTION  *Conn
+  IN OUT ISCSI_CONNECTION  *Conn
   )
 {
   Tcp4IoReset (&Conn->Tcp4Io);
@@ -202,12 +177,10 @@ IScsiConnReset (
 /**
   Create a TCP connection for the iSCSI session.
 
-  @param  Private[in] The iSCSI driver data.
-
-  @param  Session[in] Maximum CmdSN from the target.
-
-  @retval The newly created iSCSI connection.
+  @param[in]  Private The iSCSI driver data.
+  @param[in]  Session Maximum CmdSN from the target.
 
+  @return The newly created iSCSI connection.
 **/
 ISCSI_CONNECTION *
 IScsiCreateConnection (
@@ -232,7 +205,7 @@ IScsiCreateConnection (
   Conn->ExpStatSN       = 0;
   Conn->PartialReqSent  = FALSE;
   Conn->PartialRspRcvd  = FALSE;
-  Conn->CID             = Session->NextCID++;
+  Conn->Cid             = Session->NextCid++;
 
   Status = gBS->CreateEvent (
                   EVT_TIMER,
@@ -242,7 +215,7 @@ IScsiCreateConnection (
                   &Conn->TimeoutEvent
                   );
   if (EFI_ERROR (Status)) {
-    gBS->FreePool (Conn);
+    FreePool (Conn);
     return NULL;
   }
 
@@ -251,9 +224,9 @@ IScsiCreateConnection (
   //
   // set the default connection-only parameters
   //
-  Conn->MaxRecvDataSegmentLength  = MAX_RECV_DATA_SEG_LEN_IN_FFP;
-  Conn->HeaderDigest              = ISCSI_DIGEST_NONE;
-  Conn->DataDigest                = ISCSI_DIGEST_NONE;
+  Conn->MaxRecvDataSegmentLength  = DEFAULT_MAX_RECV_DATA_SEG_LEN;
+  Conn->HeaderDigest              = IScsiDigestNone;
+  Conn->DataDigest                = IScsiDigestNone;
 
   CopyMem (&Tcp4IoConfig.LocalIp, &Session->ConfigData.NvData.LocalIp, sizeof (EFI_IPv4_ADDRESS));
   CopyMem (&Tcp4IoConfig.SubnetMask, &Session->ConfigData.NvData.SubnetMask, sizeof (EFI_IPv4_ADDRESS));
@@ -273,7 +246,7 @@ IScsiCreateConnection (
             );
   if (EFI_ERROR (Status)) {
     gBS->CloseEvent (Conn->TimeoutEvent);
-    gBS->FreePool (Conn);
+    FreePool (Conn);
     Conn = NULL;
   }
 
@@ -283,10 +256,7 @@ IScsiCreateConnection (
 /**
   Destroy an iSCSI connection.
 
-  @param  Conn[in] The connection to destroy.
-
-  @retval None.
-
+  @param[in]  Conn The connection to destroy.
 **/
 VOID
 IScsiDestroyConnection (
@@ -296,19 +266,18 @@ IScsiDestroyConnection (
   Tcp4IoDestroySocket (&Conn->Tcp4Io);
   NetbufQueFlush (&Conn->RspQue);
   gBS->CloseEvent (Conn->TimeoutEvent);
-  gBS->FreePool (Conn);
+  FreePool (Conn);
 }
 
 /**
   Login the iSCSI session.
 
-  @param  Private[in]          The iSCSI driver data.
+  @param[in]  Private          The iSCSI driver data.
 
   @retval EFI_SUCCESS          The iSCSI session login procedure finished.
-
   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
-
-  @retval EFI_PROTOCOL_ERROR   Some kind of iSCSI protocol error happened.
+  @retval EFI_NO_MEDIA         There was a media error.
+  @retval Others               Other errors as indicated.
 
 **/
 EFI_STATUS
@@ -320,9 +289,24 @@ IScsiSessionLogin (
   ISCSI_SESSION     *Session;
   ISCSI_CONNECTION  *Conn;
   EFI_TCP4_PROTOCOL *Tcp4;
+  EFI_STATUS        MediaStatus;
 
   Session = &Private->Session;
 
+  //
+  // Check media status before session login
+  //
+  MediaStatus = EFI_SUCCESS;
+  NetLibDetectMediaWaitTimeout (Private->Controller, ISCSI_CHECK_MEDIA_LOGIN_WAITING_TIME, &MediaStatus);
+  if (MediaStatus != EFI_SUCCESS) {
+    return EFI_NO_MEDIA;
+  }
+
+  //
+  // Set session identifier
+  //
+  CopyMem (Session->Isid, Session->ConfigData.NvData.IsId, 6);
+
   //
   // Create a connection for the session.
   //
@@ -361,15 +345,12 @@ IScsiSessionLogin (
   Build and send the iSCSI login request to the iSCSI target according to
   the current login stage.
 
-  @param  Conn[in]             The connection in the iSCSI login phase.
+  @param[in]  Conn             The connection in the iSCSI login phase.
 
   @retval EFI_SUCCESS          The iSCSI login request PDU is built and sent on this
                                connection.
-
   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
-
-  @retval EFI_PROTOCOL_ERROR   Some kind of iSCSI protocol error happened.
-
+  @retval EFI_DEVICE_ERROR     Some kind of device error happened.
 **/
 EFI_STATUS
 IScsiSendLoginReq (
@@ -399,14 +380,10 @@ IScsiSendLoginReq (
 /**
   Receive and process the iSCSI login response.
 
-  @param  Conn[in]             The connection in the iSCSI login phase.
+  @param[in]  Conn             The connection in the iSCSI login phase.
 
   @retval EFI_SUCCESS          The iSCSI login response PDU is received and processed.
-
-  @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
-
-  @retval EFI_PROTOCOL_ERROR   Some kind of iSCSI protocol error happened.
-
+  @retval Others               Other errors as indicated.
 **/
 EFI_STATUS
 IScsiReceiveLoginRsp (
@@ -416,6 +393,8 @@ IScsiReceiveLoginRsp (
   EFI_STATUS  Status;
   NET_BUF     *Pdu;
 
+  Pdu = NULL;
+
   //
   // Receive the iSCSI login response.
   //
@@ -426,6 +405,7 @@ IScsiReceiveLoginRsp (
   //
   // A Login Response is received, process it.
   //
+  ASSERT (Pdu != NULL);
   Status = IScsiProcessLoginRsp (Conn, Pdu);
 
   NetbufFree (Pdu);
@@ -438,23 +418,19 @@ IScsiReceiveLoginRsp (
   The DataSegmentLength and the actual size of the net buffer containing this PDU will be
   updated.
 
-  @param  Pdu[in]              The iSCSI PDU whose data segment the key-value pair will
+  @param[in, out]  Pdu         The iSCSI PDU whose data segment the key-value pair will
                                be added to.
-
-  @param  Key[in]              The key name string.
-
-  @param  Value[in]            The value string.
+  @param[in]       Key         The key name string.
+  @param[in]       Value       The value string.
 
   @retval EFI_SUCCESS          The key-valu pair is added to the PDU's datasegment and
                                the correspondence length fields are updated.
-
   @retval EFI_OUT_OF_RESOURCES There is not enough space in the PDU to add the key-value
                                pair.
-
 **/
 EFI_STATUS
 IScsiAddKeyValuePair (
-  IN NET_BUF          *Pdu,
+  IN OUT NET_BUF      *Pdu,
   IN CHAR8            *Key,
   IN CHAR8            *Value
   )
@@ -467,6 +443,9 @@ IScsiAddKeyValuePair (
   CHAR8               *Data;
 
   LoginReq    = (ISCSI_LOGIN_REQUEST *) NetbufGetByte (Pdu, 0, NULL);
+  if (LoginReq == NULL) {
+    return EFI_PROTOCOL_ERROR;
+  }
   DataSegLen  = NTOH24 (LoginReq->DataSegmentLength);
 
   KeyLen      = (UINT32) AsciiStrLen (Key);
@@ -513,14 +492,14 @@ IScsiAddKeyValuePair (
 /**
   Prepare the iSCSI login request to be sent according to the current login status.
 
-  @param  Conn[in] The connection in the iSCSI login phase.
-
-  @retval The pointer to the net buffer containing the iSCSI login request built.
+  @param[in, out]  Conn The connection in the iSCSI login phase.
 
+  @return The pointer to the net buffer containing the iSCSI login request built.
+  @retval Others    Other errors as indicated.
 **/
 NET_BUF *
 IScsiPrepareLoginReq (
-  IN ISCSI_CONNECTION  *Conn
+  IN OUT ISCSI_CONNECTION  *Conn
   )
 {
   ISCSI_SESSION       *Session;
@@ -536,6 +515,7 @@ IScsiPrepareLoginReq (
   }
 
   LoginReq = (ISCSI_LOGIN_REQUEST *) NetbufAllocSpace (Nbuf, sizeof (ISCSI_LOGIN_REQUEST), NET_BUF_TAIL);
+  ASSERT (LoginReq != NULL);
   ZeroMem (LoginReq, sizeof (ISCSI_LOGIN_REQUEST));
 
   //
@@ -545,9 +525,9 @@ IScsiPrepareLoginReq (
   ISCSI_SET_STAGES (LoginReq, Conn->CurrentStage, Conn->NextStage);
   LoginReq->VersionMax        = ISCSI_VERSION_MAX;
   LoginReq->VersionMin        = ISCSI_VERSION_MIN;
-  LoginReq->TSIH              = HTONS (Session->TSIH);
+  LoginReq->Tsih              = HTONS (Session->Tsih);
   LoginReq->InitiatorTaskTag  = HTONL (Session->InitiatorTaskTag);
-  LoginReq->CID               = HTONS (Conn->CID);
+  LoginReq->Cid               = HTONS (Conn->Cid);
   LoginReq->CmdSN             = HTONL (Session->CmdSN);
 
   //
@@ -558,7 +538,7 @@ IScsiPrepareLoginReq (
   // with their increasing StatSN values.
   //
   LoginReq->ExpStatSN = HTONL (Conn->ExpStatSN);
-  CopyMem (LoginReq->ISID, Session->ISID, sizeof (LoginReq->ISID));
+  CopyMem (LoginReq->Isid, Session->Isid, sizeof (LoginReq->Isid));
 
   if (Conn->PartialRspRcvd) {
     //
@@ -605,19 +585,18 @@ IScsiPrepareLoginReq (
 /**
   Process the iSCSI Login Response.
 
-  @param  Conn[in] The connection on which the iSCSI login response is received.
-
-  @param  Pdu[in]  The iSCSI login response PDU.
+  @param[in, out]  Conn The connection on which the iSCSI login response is received.
+  @param[in, out]  Pdu  The iSCSI login response PDU.
 
   @retval EFI_SUCCESS        The iSCSI login response PDU is processed and all check are passed.
-
   @retval EFI_PROTOCOL_ERROR Some kind of iSCSI protocol error happened.
-
+  @retval EFI_MEDIA_CHANGED  Target is redirected.
+  @retval Others             Other errors as indicated.
 **/
 EFI_STATUS
 IScsiProcessLoginRsp (
-  IN ISCSI_CONNECTION  *Conn,
-  IN NET_BUF           *Pdu
+  IN OUT ISCSI_CONNECTION  *Conn,
+  IN OUT NET_BUF           *Pdu
   )
 {
   EFI_STATUS            Status;
@@ -633,6 +612,9 @@ IScsiProcessLoginRsp (
   Session   = Conn->Session;
 
   LoginRsp  = (ISCSI_LOGIN_RESPONSE *) NetbufGetByte (Pdu, 0, NULL);
+  if (LoginRsp == NULL) {
+    return EFI_PROTOCOL_ERROR;
+  }
   if (!ISCSI_CHECK_OPCODE (LoginRsp, ISCSI_OPCODE_LOGIN_RSP)) {
     //
     // It's not a Login Response
@@ -700,7 +682,7 @@ IScsiProcessLoginRsp (
       (CurrentStage != Conn->CurrentStage) ||
       (!Conn->TransitInitiated && Transit) ||
       (Transit && (NextStage != Conn->NextStage)) ||
-      (CompareMem (Session->ISID, LoginRsp->ISID, sizeof (LoginRsp->ISID)) != 0) ||
+      (CompareMem (Session->Isid, LoginRsp->Isid, sizeof (LoginRsp->Isid)) != 0) ||
       (LoginRsp->InitiatorTaskTag != Session->InitiatorTaskTag)
       ) {
     //
@@ -719,6 +701,14 @@ IScsiProcessLoginRsp (
   LoginRsp->MaxCmdSN  = NTOHL (LoginRsp->MaxCmdSN);
 
   if ((Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION) && (Conn->CHAPStep == ISCSI_CHAP_INITIAL)) {
+    //
+    // If the Login Request is a leading Login Request, the target MUST use
+    // the value presented in CmdSN as the target value for ExpCmdSN.
+    //
+    if ((Session->State == SESSION_STATE_FREE) && (Session->CmdSN != LoginRsp->ExpCmdSN)) {
+      return EFI_PROTOCOL_ERROR;
+    }
+
     //
     // It's the initial Login Response, initialize the local ExpStatSN, MaxCmdSN
     // and ExpCmdSN.
@@ -767,14 +757,14 @@ IScsiProcessLoginRsp (
     //
     // In security negotiation stage, let CHAP module handle it.
     //
-    Status = IScsiCHAPOnRspReceived (Conn, Transit);
+    Status = IScsiCHAPOnRspReceived (Conn);
     break;
 
   case ISCSI_LOGIN_OPERATIONAL_NEGOTIATION:
     //
     // Response received with negotiation resonse on iSCSI parameters, check them.
     //
-    Status = IScsiCheckOpParams (Conn, Transit);
+    Status = IScsiCheckOpParams (Conn);
     break;
 
   default:
@@ -798,7 +788,7 @@ IScsiProcessLoginRsp (
       // CurrentStage is iSCSI Full Feature, it's the Login-Final Response,
       // get the TSIH from the Login Response.
       //
-      Session->TSIH = NTOHS (LoginRsp->TSIH);
+      Session->Tsih = NTOHS (LoginRsp->Tsih);
     }
   }
   //
@@ -813,25 +803,21 @@ IScsiProcessLoginRsp (
   Updated the target information according the data received in the iSCSI
   login response with an target redirection status.
 
-  @param  Session[in]          The iSCSI session.
-
-  @param  Data[in]             The data segment which should contain the
+  @param[in, out] Session      The iSCSI session.
+  @param[in]      Data         The data segment which should contain the
                                TargetAddress key-value list.
-
-  @param  Len[in]              Length of the data.
+  @param[in]      Len          Length of the data.
 
   @retval EFI_SUCCESS          The target address is updated.
-
   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
-
   @retval EFI_NOT_FOUND        The TargetAddress key is not found.
-
+  @retval Others               Other errors as indicated.
 **/
 EFI_STATUS
 IScsiUpdateTargetAddress (
-  IN ISCSI_SESSION  *Session,
-  IN CHAR8          *Data,
-  IN UINT32         Len
+  IN OUT ISCSI_SESSION  *Session,
+  IN CHAR8              *Data,
+  IN UINT32             Len
   )
 {
   LIST_ENTRY      *KeyValueList;
@@ -864,7 +850,7 @@ IScsiUpdateTargetAddress (
 
     IpStr = TargetAddress;
 
-    while (*TargetAddress && (*TargetAddress != ':') && (*TargetAddress != ',')) {
+    while ((*TargetAddress != 0) && (*TargetAddress != ':') && (*TargetAddress != ',')) {
       //
       // NULL, ':' or ',' ends the IPv4 string.
       //
@@ -913,12 +899,10 @@ IScsiUpdateTargetAddress (
 /**
   The callback function to free the net buffer list.
 
-  @param  Arg[in] The opaque parameter.
-
-  @retval None.
-
+  @param[in]  Arg The opaque parameter.
 **/
 VOID
+EFIAPI
 IScsiFreeNbufList (
   VOID *Arg
   )
@@ -926,18 +910,16 @@ IScsiFreeNbufList (
   ASSERT (Arg != NULL);
 
   NetbufFreeList ((LIST_ENTRY     *) Arg);
-  gBS->FreePool (Arg);
+  FreePool (Arg);
 }
 
 /**
   The callback function called in NetBufFree, it does nothing.
 
-  @param  Arg[in] The opaque parameter.
-
-  @retval None.
-
+  @param[in]   Arg  The opaque parameter.
 **/
 VOID
+EFIAPI
 IScsiNbufExtFree (
   VOID *Arg
   )
@@ -950,23 +932,18 @@ IScsiNbufExtFree (
   net buffer. The digest check will be conducted in this function if needed and the digests
   will be trimmed from the PDU buffer.
 
-  @param  Conn[in]         The iSCSI connection to receive data from.
-
-  @param  Pdu[out]         The received iSCSI pdu.
-
-  @param  Context[in]      The context used to describe information on the caller provided
+  @param[in]   Conn        The iSCSI connection to receive data from.
+  @param[out]  Pdu         The received iSCSI pdu.
+  @param[in]   Context     The context used to describe information on the caller provided
                            buffer to receive data segment of the iSCSI pdu, it's optional.
+  @param[in]  HeaderDigest Whether there will be header digest received.
+  @param[in]  DataDigest   Whether there will be data digest.
+  @param[in]  TimeoutEvent The timeout event, it's optional.
 
-  @param  HeaderDigest[in] Whether there will be header digest received.
-
-  @param  DataDigest[in]   Whether there will be data digest.
-
-  @param  TimeoutEvent[in] The timeout event, it's optional.
-
-  @retval EFI_SUCCESS      An iSCSI pdu is received.
-
-  @retval EFI_TIMEOUT      Timeout happenend.
-
+  @retval EFI_SUCCESS          An iSCSI pdu is received.
+  @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
+  @retval EFI_PROTOCOL_ERROR   Some kind of iSCSI protocol error happened.
+  @retval Others               Other errors as indicated.
 **/
 EFI_STATUS
 IScsiReceivePdu (
@@ -990,7 +967,7 @@ IScsiReceivePdu (
   NET_BUF         *DataSeg;
   UINT32          PadAndCRC32[2];
 
-  NbufList = AllocatePool (sizeof (LIST_ENTRY    ));
+  NbufList = AllocatePool (sizeof (LIST_ENTRY));
   if (NbufList == NULL) {
     return EFI_OUT_OF_RESOURCES;
   }
@@ -1003,11 +980,12 @@ IScsiReceivePdu (
   Len     = sizeof (ISCSI_BASIC_HEADER) + (HeaderDigest ? sizeof (UINT32) : 0);
   PduHdr  = NetbufAlloc (Len);
   if (PduHdr == NULL) {
-    Status = EFI_OUT_OF_RESOURCES;
-    goto ON_EXIT;
+    FreePool (NbufList);
+    return EFI_OUT_OF_RESOURCES;
   }
 
   Header = NetbufAllocSpace (PduHdr, Len, NET_BUF_TAIL);
+  ASSERT (Header != NULL);
   InsertTailList (NbufList, &PduHdr->List);
 
   //
@@ -1031,9 +1009,14 @@ IScsiReceivePdu (
   Len = ISCSI_GET_DATASEG_LEN (Header);
   if (Len == 0) {
     //
-    // No data segment.
+    // No data segment.Form the pdu from a list of pdu segments.
     //
-    goto FORM_PDU;
+    *Pdu = NetbufFromBufList (NbufList, 0, 0, IScsiFreeNbufList, NbufList);
+    if (*Pdu == NULL) {
+      Status = EFI_OUT_OF_RESOURCES;
+      goto ON_EXIT;
+    }
+    return Status;
   }
   //
   // Get the length of the padding bytes of the data segment.
@@ -1061,8 +1044,7 @@ IScsiReceivePdu (
       // The first to receive the useful data. The second to receive the padding.
       //
       Fragment[1].Len   = PadLen + (DataDigest ? sizeof (UINT32) : 0);
-      Fragment[1].Bulk  = (UINT8 *) ((UINTN) &PadAndCRC32[1] - PadLen);
-
+      Fragment[1].Bulk  = (UINT8 *)PadAndCRC32 + (4 - PadLen);
       FragmentCount     = 2;
     } else {
       FragmentCount = 1;
@@ -1127,7 +1109,6 @@ IScsiReceivePdu (
     NetbufTrim (DataSeg, PadLen, NET_BUF_TAIL);
   }
 
-FORM_PDU:
   //
   // Form the pdu from a list of pdu segments.
   //
@@ -1151,19 +1132,15 @@ ON_EXIT:
 /**
   Check and get the result of the prameter negotiation.
 
-  @param  Conn[in]           The connection in iSCSI login.
-
-  @param  Pdu[in]            The iSCSI response PDU containing the parameter list.
-
-  @retval EFI_SUCCESS        The parmeter check is passed and negotiation is finished.
-
-  @retval EFI_PROTOCOL_ERROR Some kind of iSCSI protocol error happened.
+  @param[in, out]  Conn          The connection in iSCSI login.
 
+  @retval EFI_SUCCESS          The parmeter check is passed and negotiation is finished.
+  @retval EFI_PROTOCOL_ERROR   Some kind of iSCSI protocol error happened.
+  @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
 **/
 EFI_STATUS
 IScsiCheckOpParams (
-  IN ISCSI_CONNECTION  *Conn,
-  IN BOOLEAN           Transit
+  IN OUT ISCSI_CONNECTION  *Conn
   )
 {
   EFI_STATUS      Status;
@@ -1193,7 +1170,7 @@ IScsiCheckOpParams (
   //
   KeyValueList = IScsiBuildKeyValueList (Data, Len);
   if (KeyValueList == NULL) {
-    gBS->FreePool (Data);
+    FreePool (Data);
     return Status;
   }
   //
@@ -1205,11 +1182,11 @@ IScsiCheckOpParams (
   }
 
   if (AsciiStrCmp (Value, "CRC32") == 0) {
-    if (Conn->HeaderDigest != ISCSI_DIGEST_CRC32) {
+    if (Conn->HeaderDigest != IScsiDigestCRC32) {
       goto ON_ERROR;
     }
   } else if (AsciiStrCmp (Value, ISCSI_KEY_VALUE_NONE) == 0) {
-    Conn->HeaderDigest = ISCSI_DIGEST_NONE;
+    Conn->HeaderDigest = IScsiDigestNone;
   } else {
     goto ON_ERROR;
   }
@@ -1222,11 +1199,11 @@ IScsiCheckOpParams (
   }
 
   if (AsciiStrCmp (Value, "CRC32") == 0) {
-    if (Conn->DataDigest != ISCSI_DIGEST_CRC32) {
+    if (Conn->DataDigest != IScsiDigestCRC32) {
       goto ON_ERROR;
     }
   } else if (AsciiStrCmp (Value, ISCSI_KEY_VALUE_NONE) == 0) {
-    Conn->DataDigest = ISCSI_DIGEST_NONE;
+    Conn->DataDigest = IScsiDigestNone;
   } else {
     goto ON_ERROR;
   }
@@ -1248,12 +1225,14 @@ IScsiCheckOpParams (
   //
   // InitialR2T, result function is OR.
   //
-  Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_INITIAL_R2T);
-  if (Value == NULL) {
-    goto ON_ERROR;
-  }
+  if (!Session->InitialR2T) {
+    Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_INITIAL_R2T);
+    if (Value == NULL) {
+      goto ON_ERROR;
+    }
 
-  Session->InitialR2T = (BOOLEAN) (Session->InitialR2T || (AsciiStrCmp (Value, "Yes") == 0));
+    Session->InitialR2T = (BOOLEAN) (AsciiStrCmp (Value, "Yes") == 0);
+  }
 
   //
   // ImmediateData, result function is AND.
@@ -1263,19 +1242,14 @@ IScsiCheckOpParams (
     goto ON_ERROR;
   }
 
-  Session->ImmediateData = (BOOLEAN) (Session->ImmediateData && (AsciiStrCmp (Value, "Yes") == 0));
+  Session->ImmediateData = (BOOLEAN) (Session->ImmediateData && (BOOLEAN) (AsciiStrCmp (Value, "Yes") == 0));
 
   //
-  // MaxRecvDataSegmentLength, result function is Mininum.
+  // MaxRecvDataSegmentLength is declarative.
   //
   Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_MAX_RECV_DATA_SEGMENT_LENGTH);
   if (Value != NULL) {
-    //
-    // MaxRecvDataSegmentLength is declarative.
-    //
-    NumericValue                    = AsciiStrDecimalToUintn (Value);
-
-    Conn->MaxRecvDataSegmentLength  = (UINT32) MIN (Conn->MaxRecvDataSegmentLength, NumericValue);
+    Conn->MaxRecvDataSegmentLength = (UINT32) AsciiStrDecimalToUintn (Value);
   }
   //
   // MaxBurstLength, result funtion is Mininum.
@@ -1291,14 +1265,17 @@ IScsiCheckOpParams (
   //
   // FirstBurstLength, result function is Minimum. Irrelevant when InitialR2T=Yes and
   // ImmediateData=No.
+  // This Key/Value is negotiation type.
   //
-  Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_FIRST_BURST_LENGTH);
-  if ((Value == NULL) && !(Session->InitialR2T && !Session->ImmediateData)) {
-    goto ON_ERROR;
-  }
+  if (!(Session->InitialR2T && !Session->ImmediateData)) {
+    Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_FIRST_BURST_LENGTH);
+    if (Value == NULL) {
+      goto ON_ERROR;
+    }
 
-  NumericValue              = AsciiStrDecimalToUintn (Value);
-  Session->FirstBurstLength = (UINT32) MIN (Session->FirstBurstLength, NumericValue);
+    NumericValue              = AsciiStrDecimalToUintn (Value);
+    Session->FirstBurstLength = (UINT32) MIN (Session->FirstBurstLength, NumericValue);
+  }
 
   //
   // MaxConnections, result function is Minimum.
@@ -1318,22 +1295,26 @@ IScsiCheckOpParams (
   //
   // DataPDUInOrder, result function is OR.
   //
-  Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_DATA_PDU_IN_ORDER);
-  if (Value == NULL) {
-    goto ON_ERROR;
-  }
+  if (!Session->DataPDUInOrder) {
+    Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_DATA_PDU_IN_ORDER);
+    if (Value == NULL) {
+      goto ON_ERROR;
+    }
 
-  Session->DataPDUInOrder = (BOOLEAN) (Session->DataPDUInOrder || (AsciiStrCmp (Value, "Yes") == 0));
+    Session->DataPDUInOrder = (BOOLEAN) (AsciiStrCmp (Value, "Yes") == 0);
+  }
 
   //
   // DataSequenceInorder, result function is OR.
   //
-  Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_DATA_SEQUENCE_IN_ORDER);
-  if (Value == NULL) {
-    goto ON_ERROR;
-  }
+  if (!Session->DataSequenceInOrder) {
+    Value = IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_DATA_SEQUENCE_IN_ORDER);
+    if (Value == NULL) {
+      goto ON_ERROR;
+    }
 
-  Session->DataSequenceInOrder = (BOOLEAN) (Session->DataSequenceInOrder || (AsciiStrCmp (Value, "Yes") == 0));
+    Session->DataSequenceInOrder = (BOOLEAN) (AsciiStrCmp (Value, "Yes") == 0);
+  }
 
   //
   // DefaultTime2Wait, result function is Maximum.
@@ -1383,11 +1364,24 @@ IScsiCheckOpParams (
   Session->MaxOutstandingR2T = (UINT16) MIN (Session->MaxOutstandingR2T, NumericValue);
 
   //
-  // Remove declarative key-value paris if any.
+  // Remove declarative key-value pairs, if any.
   //
   IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_SESSION_TYPE);
   IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_TARGET_ALIAS);
   IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_TARGET_PORTAL_GROUP_TAG);
+  //
+  // Remove the key-value that may not needed for result function is OR.
+  //
+  IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_INITIAL_R2T);
+  IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_DATA_PDU_IN_ORDER);
+  IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_DATA_SEQUENCE_IN_ORDER);
+
+  //
+  // Remove irrelevant parameter, if any.
+  //
+  if (Session->InitialR2T && !Session->ImmediateData) {
+    IScsiGetValueByKeyFromList (KeyValueList, ISCSI_KEY_FIRST_BURST_LENGTH);
+  }
 
   if (IsListEmpty (KeyValueList)) {
     //
@@ -1400,7 +1394,7 @@ ON_ERROR:
 
   IScsiFreeKeyValueList (KeyValueList);
 
-  gBS->FreePool (Data);
+  FreePool (Data);
 
   return Status;
 }
@@ -1408,19 +1402,15 @@ ON_ERROR:
 /**
   Fill the oprational prameters.
 
-  @param  Conn[in]             The connection in iSCSI login.
-
-  @param  Pdu[in]              The iSCSI login request PDU to fill the parameters.
+  @param[in]       Conn        The connection in iSCSI login.
+  @param[in, out]  Pdu         The iSCSI login request PDU to fill the parameters.
 
   @retval EFI_SUCCESS          The parmeters are filled into the iSCSI login request PDU.
-
-  @retval EFI_OUT_OF_RESOURCES There is not enough space in the PDU to hold the parameters.
-
 **/
 EFI_STATUS
 IScsiFillOpParams (
   IN ISCSI_CONNECTION  *Conn,
-  IN NET_BUF           *Pdu
+  IN OUT NET_BUF       *Pdu
   )
 {
   ISCSI_SESSION *Session;
@@ -1428,10 +1418,10 @@ IScsiFillOpParams (
 
   Session = Conn->Session;
 
-  AsciiSPrint (Value, sizeof (Value), "%a", (Conn->HeaderDigest == ISCSI_DIGEST_CRC32) ? "None,CRC32" : "None");
+  AsciiSPrint (Value, sizeof (Value), "%a", (Conn->HeaderDigest == IScsiDigestCRC32) ? "None,CRC32" : "None");
   IScsiAddKeyValuePair (Pdu, ISCSI_KEY_HEADER_DIGEST, Value);
 
-  AsciiSPrint (Value, sizeof (Value), "%a", (Conn->DataDigest == ISCSI_DIGEST_CRC32) ? "None,CRC32" : "None");
+  AsciiSPrint (Value, sizeof (Value), "%a", (Conn->DataDigest == IScsiDigestCRC32) ? "None,CRC32" : "None");
   IScsiAddKeyValuePair (Pdu, ISCSI_KEY_DATA_DIGEST, Value);
 
   AsciiSPrint (Value, sizeof (Value), "%d", Session->ErrorRecoveryLevel);
@@ -1443,7 +1433,7 @@ IScsiFillOpParams (
   AsciiSPrint (Value, sizeof (Value), "%a", Session->ImmediateData ? "Yes" : "No");
   IScsiAddKeyValuePair (Pdu, ISCSI_KEY_IMMEDIATE_DATA, Value);
 
-  AsciiSPrint (Value, sizeof (Value), "%d", Conn->MaxRecvDataSegmentLength);
+  AsciiSPrint (Value, sizeof (Value), "%d", MAX_RECV_DATA_SEG_LEN_IN_FFP);
   IScsiAddKeyValuePair (Pdu, ISCSI_KEY_MAX_RECV_DATA_SEGMENT_LENGTH, Value);
 
   AsciiSPrint (Value, sizeof (Value), "%d", Session->MaxBurstLength);
@@ -1476,20 +1466,17 @@ IScsiFillOpParams (
 /**
   Pad the iSCSI AHS or data segment to an integer number of 4 byte words.
 
-  @param  Pdu[in]              The iSCSI pdu which contains segments to pad.
-
-  @param  Len[in]              The length of the last semgnet in the PDU.
+  @param[in, out]  Pdu         The iSCSI pdu which contains segments to pad.
+  @param[in]       Len         The length of the last semgnet in the PDU.
 
   @retval EFI_SUCCESS          The segment is padded or no need to pad it.
-
   @retval EFI_OUT_OF_RESOURCES There is not enough remaining free space to add the
                                padding bytes.
-
 **/
 EFI_STATUS
 IScsiPadSegment (
-  IN NET_BUF  *Pdu,
-  IN UINT32   Len
+  IN OUT NET_BUF  *Pdu,
+  IN UINT32       Len
   )
 {
   UINT32  PadLen;
@@ -1512,12 +1499,11 @@ IScsiPadSegment (
 /**
   Build a key-value list from the data segment.
 
-  @param  Data[in] The data segment containing the key-value pairs.
-
-  @param  Len[in]  Length of the data segment.
-
-  @retval The key-value list.
+  @param[in]  Data The data segment containing the key-value pairs.
+  @param[in]  Len  Length of the data segment.
 
+  @return The key-value list.
+  @retval NULL Other errors as indicated.
 **/
 LIST_ENTRY *
 IScsiBuildKeyValueList (
@@ -1528,7 +1514,7 @@ IScsiBuildKeyValueList (
   LIST_ENTRY            *ListHead;
   ISCSI_KEY_VALUE_PAIR  *KeyValuePair;
 
-  ListHead = AllocatePool (sizeof (LIST_ENTRY    ));
+  ListHead = AllocatePool (sizeof (LIST_ENTRY));
   if (ListHead == NULL) {
     return NULL;
   }
@@ -1556,7 +1542,7 @@ IScsiBuildKeyValueList (
       Data++;
       Len--;
     } else {
-      gBS->FreePool (KeyValuePair);
+      FreePool (KeyValuePair);
       goto ON_ERROR;
     }
 
@@ -1581,16 +1567,14 @@ ON_ERROR:
   Get the value string by the key name from the key-value list. If found,
   the key-value entry will be removed from the list.
 
-  @param  KeyValueList[in] The key-value list.
-
-  @param  Key[in]          The key name to find.
-
-  @retval The value string.
+  @param[in, out]  KeyValueList  The key-value list.
+  @param[in]       Key           The key name to find.
 
+  @return The value string.
 **/
 CHAR8 *
 IScsiGetValueByKeyFromList (
-  IN LIST_ENTRY      *KeyValueList,
+  IN OUT LIST_ENTRY  *KeyValueList,
   IN CHAR8           *Key
   )
 {
@@ -1607,7 +1591,7 @@ IScsiGetValueByKeyFromList (
       Value = KeyValuePair->Value;
 
       RemoveEntryList (&KeyValuePair->List);
-      gBS->FreePool (KeyValuePair);
+      FreePool (KeyValuePair);
       break;
     }
   }
@@ -1618,10 +1602,7 @@ IScsiGetValueByKeyFromList (
 /**
   Free the key-value list.
 
-  @param  KeyValueList[in] The key-value list.
-  
-  @retval None.
-
+  @param[in]  KeyValueList The key-value list.
 **/
 VOID
 IScsiFreeKeyValueList (
@@ -1635,28 +1616,25 @@ IScsiFreeKeyValueList (
     Entry         = NetListRemoveHead (KeyValueList);
     KeyValuePair  = NET_LIST_USER_STRUCT (Entry, ISCSI_KEY_VALUE_PAIR, List);
 
-    gBS->FreePool (KeyValuePair);
+    FreePool (KeyValuePair);
   }
 
-  gBS->FreePool (KeyValueList);
+  FreePool (KeyValueList);
 }
 
 /**
   Normalize the iSCSI name according to RFC.
 
-  @param  Name[in]           The iSCSI name.
-
-  @param  Len[in]            length of the iSCSI name.
+  @param[in, out]  Name       The iSCSI name.
+  @param[in]       Len        length of the iSCSI name.
 
   @retval EFI_SUCCESS        The iSCSI name is valid and normalized.
-
   @retval EFI_PROTOCOL_ERROR The iSCSI name is mal-formatted or not in the IQN format.
-
 **/
 EFI_STATUS
 IScsiNormalizeName (
-  IN CHAR8  *Name,
-  IN UINTN  Len
+  IN OUT CHAR8  *Name,
+  IN UINTN      Len
   )
 {
   UINTN Index;
@@ -1696,14 +1674,12 @@ IScsiNormalizeName (
 /**
   Create an iSCSI task control block.
 
-  @param  Conn[in]             The connection on which the task control block will be created.
-
-  @param  Tcb[out]             The newly created task control block.
+  @param[in]   Conn           The connection on which the task control block will be created.
+  @param[out]  Tcb            The newly created task control block.
 
   @retval EFI_SUCCESS          The task control block is created.
-
   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
-
+  @retval EFI_NOT_READY        The target can not accept new commands.
 **/
 EFI_STATUS
 IScsiNewTcb (
@@ -1750,10 +1726,7 @@ IScsiNewTcb (
 /**
   Delete the tcb from the connection and destroy it.
 
-  @param  Tcb The tcb to delete.
-
-  @retval None.
-
+  @param[in]  Tcb The tcb to delete.
 **/
 VOID
 IScsiDelTcb (
@@ -1762,18 +1735,16 @@ IScsiDelTcb (
 {
   RemoveEntryList (&Tcb->Link);
 
-  gBS->FreePool (Tcb);
+  FreePool (Tcb);
 }
 
 /**
   Find the task control block by the initator task tag.
 
-  @param  TcbList[in]          The tcb list.
-
-  @param  InitiatorTaskTag[in] The initiator task tag.
-
-  @retval The task control block found.
+  @param[in]  TcbList         The tcb list.
+  @param[in]  InitiatorTaskTag The initiator task tag.
 
+  @return The task control block found.
 **/
 ISCSI_TCB *
 IScsiFindTcbByITT (
@@ -1802,14 +1773,11 @@ IScsiFindTcbByITT (
 /**
   Create a data segment, pad it and calculate the CRC if needed.
 
-  @param  Data[in]       The data to fill into the data segment.
-
-  @param  Len[in]        Length of the data.
-
-  @param  DataDigest[in] Whether to calculate CRC for this data segment.
-
-  @retval The net buffer wrapping the data segment.
+  @param[in]  Data       The data to fill into the data segment.
+  @param[in]  Len        Length of the data.
+  @param[in]  DataDigest Whether to calculate CRC for this data segment.
 
+  @return The net buffer wrapping the data segment.
 **/
 NET_BUF *
 IScsiNewDataSegment (
@@ -1845,14 +1813,12 @@ IScsiNewDataSegment (
   Create a iSCSI SCSI command PDU to encapsulate the command issued
   by SCSI through the EXT SCSI PASS THRU Protocol.
 
-  @param  Packet[in] The EXT SCSI PASS THRU request packet containing the SCSI command.
-
-  @param  Lun[in]    The LUN.
-
-  @param  Tcb[in]    The tcb assocated with this SCSI command.
-
-  @retval The created iSCSI SCSI command PDU.
+  @param[in]  Packet The EXT SCSI PASS THRU request packet containing the SCSI command.
+  @param[in]  Lun    The LUN.
+  @param[in]  Tcb    The tcb associated with this SCSI command.
 
+  @return The  created iSCSI SCSI command PDU.
+  @retval NULL Other errors as indicated.
 **/
 NET_BUF *
 IScsiNewScsiCmdPdu (
@@ -1897,6 +1863,10 @@ IScsiNewScsiCmdPdu (
   }
 
   ScsiCmd = (SCSI_COMMAND *) NetbufAllocSpace (PduHeader, Length, NET_BUF_TAIL);
+  if (ScsiCmd == NULL) {
+    NetbufFree (PduHeader);
+    return NULL;
+  }
   Header  = (ISCSI_ADDITIONAL_HEADER *) (ScsiCmd + 1);
 
   ZeroMem (ScsiCmd, Length);
@@ -1941,10 +1911,10 @@ IScsiNewScsiCmdPdu (
   ScsiCmd->CmdSN            = NTOHL (Tcb->CmdSN);
   ScsiCmd->ExpStatSN        = NTOHL (Tcb->Conn->ExpStatSN);
 
-  CopyMem (ScsiCmd->CDB, Packet->Cdb, sizeof (ScsiCmd->CDB));
+  CopyMem (ScsiCmd->Cdb, Packet->Cdb, sizeof (ScsiCmd->Cdb));
 
   if (Packet->CdbLength > 16) {
-    Header->Length  = NTOHS (Packet->CdbLength - 15);
+    Header->Length  = NTOHS ((UINT16) (Packet->CdbLength - 15));
     Header->Type    = ISCSI_AHS_TYPE_EXT_CDB;
 
     CopyMem (Header + 1, (UINT8 *) Packet->Cdb + 16, Packet->CdbLength - 16);
@@ -1978,7 +1948,7 @@ IScsiNewScsiCmdPdu (
       goto ON_EXIT;
     }
 
-    NbufList = AllocatePool (sizeof (LIST_ENTRY    ));
+    NbufList = AllocatePool (sizeof (LIST_ENTRY));
     if (NbufList == NULL) {
       NetbufFree (PduHeader);
       NetbufFree (DataSeg);
@@ -2003,7 +1973,7 @@ IScsiNewScsiCmdPdu (
       ) {
     //
     // Unsolicited data out sequence is not allowed,
-    // or FirstBustLength data is already sent out by immediate data
+    // or FirstBurstLength data is already sent out by immediate data
     // or all the OUT data accompany this SCSI packet is sent as
     // immediate data, the final flag should be set on this SCSI Command
     // PDU.
@@ -2019,18 +1989,14 @@ ON_EXIT:
 /**
   Create a new iSCSI SCSI Data Out PDU.
 
-  @param  Data[in]   The data to put into the Data Out PDU.
-
-  @param  Len[in]    Length of the data.
-
-  @param  DataSN[in] The DataSN of the Data Out PDU.
-
-  @param  Tcb[in]    The task control block of this Data Out PDU.
-
-  @param  Lun[in]    The LUN.
-
-  @retval The net buffer wrapping the Data Out PDU.
+  @param[in]  Data   The data to put into the Data Out PDU.
+  @param[in]  Len    Length of the data.
+  @param[in]  DataSN The DataSN of the Data Out PDU.
+  @param[in]  Tcb    The task control block of this Data Out PDU.
+  @param[in]  Lun    The LUN.
 
+  @return The net buffer wrapping the Data Out PDU.
+  @retval NULL Other errors as indicated.
 **/
 NET_BUF *
 IScsiNewDataOutPdu (
@@ -2048,7 +2014,7 @@ IScsiNewDataOutPdu (
   ISCSI_SCSI_DATA_OUT *DataOutHdr;
   ISCSI_XFER_CONTEXT  *XferContext;
 
-  NbufList = AllocatePool (sizeof (LIST_ENTRY    ));
+  NbufList = AllocatePool (sizeof (LIST_ENTRY));
   if (NbufList == NULL) {
     return NULL;
   }
@@ -2060,7 +2026,7 @@ IScsiNewDataOutPdu (
   //
   PduHdr = NetbufAlloc (sizeof (ISCSI_SCSI_DATA_OUT));
   if (PduHdr == NULL) {
-    gBS->FreePool (NbufList);
+    FreePool (NbufList);
     return NULL;
   }
   //
@@ -2069,6 +2035,7 @@ IScsiNewDataOutPdu (
   InsertTailList (NbufList, &PduHdr->List);
 
   DataOutHdr  = (ISCSI_SCSI_DATA_OUT *) NetbufAllocSpace (PduHdr, sizeof (ISCSI_SCSI_DATA_OUT), NET_BUF_TAIL);
+  ASSERT (DataOutHdr != NULL);
   XferContext = &Tcb->XferContext;
 
   ZeroMem (DataOutHdr, sizeof (ISCSI_SCSI_DATA_OUT));
@@ -2112,14 +2079,12 @@ IScsiNewDataOutPdu (
 /**
   Generate a consecutive sequence of iSCSI SCSI Data Out PDUs.
 
-  @param  Data[in] The data  which will be carried by the sequence of iSCSI SCSI Data Out PDUs.
-
-  @param  Tcb[in]  The task control block of the data to send out.
-
-  @param  Lun[in]  The LUN the data will be sent to.
-
-  @retval A list of net buffers with each of them wraps an iSCSI SCSI Data Out PDU.
+  @param[in]  Data The data  which will be carried by the sequence of iSCSI SCSI Data Out PDUs.
+  @param[in]  Tcb  The task control block of the data to send out.
+  @param[in]  Lun  The LUN the data will be sent to.
 
+  @return A list of net buffers with each of them wraps an iSCSI SCSI Data Out PDU.
+  @retval NULL Other errors as indicated.
 **/
 LIST_ENTRY *
 IScsiGenerateDataOutPduSequence (
@@ -2134,8 +2099,9 @@ IScsiGenerateDataOutPduSequence (
   NET_BUF             *DataOutPdu;
   ISCSI_CONNECTION    *Conn;
   ISCSI_XFER_CONTEXT  *XferContext;
+  UINT8               *DataOutPacket;
 
-  PduList = AllocatePool (sizeof (LIST_ENTRY    ));
+  PduList = AllocatePool (sizeof (LIST_ENTRY));
   if (PduList == NULL) {
     return NULL;
   }
@@ -2177,7 +2143,14 @@ IScsiGenerateDataOutPduSequence (
   //
   // Set the F bit for the last data out PDU in this sequence.
   //
-  ISCSI_SET_FLAG (NetbufGetByte (DataOutPdu, 0, NULL), ISCSI_BHS_FLAG_FINAL);
+  DataOutPacket = NetbufGetByte (DataOutPdu, 0, NULL);
+  if (DataOutPacket == NULL) {
+    IScsiFreeNbufList (PduList);
+    PduList = NULL;
+    goto ON_EXIT;
+  }
+
+  ISCSI_SET_FLAG (DataOutPacket, ISCSI_BHS_FLAG_FINAL);
 
 ON_EXIT:
 
@@ -2187,16 +2160,13 @@ ON_EXIT:
 /**
   Send the Data in a sequence of Data Out PDUs one by one.
 
-  @param  Data[in]             The data to carry by Data Out PDUs.
-
-  @param  Lun[in]              The LUN the data will be sent to.
-
-  @param  Tcb[in]              The task control block.
+  @param[in]  Data            The data to carry by Data Out PDUs.
+  @param[in]  Lun             The LUN the data will be sent to.
+  @param[in]  Tcb             The task control block.
 
   @retval EFI_SUCCES           The data is sent out to the LUN.
-
   @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
-
+  @retval Others               Other errors as indicated.
 **/
 EFI_STATUS
 IScsiSendDataOutPduSequence (
@@ -2240,17 +2210,15 @@ IScsiSendDataOutPduSequence (
 /**
   Process the received iSCSI SCSI Data In PDU.
 
-  @param  Pdu[in]            The Data In PDU received.
-
-  @param  Tcb[in]            The task control block.
-
-  @param  Packet[in][out]    The EXT SCSI PASS THRU request packet.
-
-  @retval EFI_SUCCES         The check on the Data IN PDU is passed and some update
-                             actions are taken.
-
-  @retval EFI_PROTOCOL_ERROR Some kind of iSCSI protocol errror happened.
+  @param[in]        Pdu      The Data In PDU received.
+  @param[in]        Tcb      The task control block.
+  @param[in, out]   Packet   The EXT SCSI PASS THRU request packet.
 
+  @retval EFI_SUCCES           The check on the Data IN PDU is passed and some update
+                               actions are taken.
+  @retval EFI_PROTOCOL_ERROR   Some kind of iSCSI protocol errror happened.
+  @retval EFI_BAD_BUFFER_SIZEE The buffer was not the proper size for the request.
+  @retval Others               Other errors as indicated.
 **/
 EFI_STATUS
 IScsiOnDataInRcvd (
@@ -2263,6 +2231,9 @@ IScsiOnDataInRcvd (
   EFI_STATUS          Status;
 
   DataInHdr                   = (ISCSI_SCSI_DATA_IN *) NetbufGetByte (Pdu, 0, NULL);
+  if (DataInHdr == NULL) {
+    return EFI_PROTOCOL_ERROR;
+  }
 
   DataInHdr->InitiatorTaskTag = NTOHL (DataInHdr->InitiatorTaskTag);
   DataInHdr->ExpCmdSN         = NTOHL (DataInHdr->ExpCmdSN);
@@ -2328,18 +2299,14 @@ IScsiOnDataInRcvd (
 /**
   Process the received iSCSI R2T PDU.
 
-  @param  Pdu[in]            The R2T PDU received.
-
-  @param  Tcb[in]            The task control block.
-
-  @param  Lun[in]            The Lun.
-
-  @param  Packet[in][out]    The EXT SCSI PASS THRU request packet.
+  @param[in]       Pdu       The R2T PDU received.
+  @param[in]       Tcb       The task control block.
+  @param[in]       Lun       The Lun.
+  @param[in, out]  Packet    The EXT SCSI PASS THRU request packet.
 
   @retval EFI_SUCCES         The R2T PDU is valid and the solicited data is sent out.
-
   @retval EFI_PROTOCOL_ERROR Some kind of iSCSI protocol errror happened.
-
+  @retval Others             Other errors as indicated.
 **/
 EFI_STATUS
 IScsiOnR2TRcvd (
@@ -2355,11 +2322,14 @@ IScsiOnR2TRcvd (
   UINT8                   *Data;
 
   R2THdr = (ISCSI_READY_TO_TRANSFER *) NetbufGetByte (Pdu, 0, NULL);
+  if (R2THdr == NULL) {
+    return EFI_PROTOCOL_ERROR;
+  }
 
   R2THdr->InitiatorTaskTag = NTOHL (R2THdr->InitiatorTaskTag);
   R2THdr->TargetTransferTag = NTOHL (R2THdr->TargetTransferTag);
   R2THdr->StatSN = NTOHL (R2THdr->StatSN);
-  R2THdr->R2TSN = NTOHL (R2THdr->R2TSN);
+  R2THdr->R2TSeqNum = NTOHL (R2THdr->R2TSeqNum);
   R2THdr->BufferOffset = NTOHL (R2THdr->BufferOffset);
   R2THdr->DesiredDataTransferLength = NTOHL (R2THdr->DesiredDataTransferLength);
 
@@ -2369,7 +2339,7 @@ IScsiOnR2TRcvd (
   //
   // Check the sequence number.
   //
-  Status = IScsiCheckSN (&Tcb->ExpDataSN, R2THdr->R2TSN);
+  Status = IScsiCheckSN (&Tcb->ExpDataSN, R2THdr->R2TSeqNum);
   if (EFI_ERROR (Status)) {
     return Status;
   }
@@ -2396,16 +2366,14 @@ IScsiOnR2TRcvd (
 /**
   Process the received iSCSI SCSI Response PDU.
 
-  @param  Pdu[in]            The Response PDU received.
-
-  @param  Tcb[in]            The task control block.
-
-  @param  Packet[in][out]    The EXT SCSI PASS THRU request packet.
+  @param[in]       Pdu      The Response PDU received.
+  @param[in]       Tcb      The task control block.
+  @param[in, out]  Packet   The EXT SCSI PASS THRU request packet.
 
   @retval EFI_SUCCES         The Response PDU is processed.
-
   @retval EFI_PROTOCOL_ERROR Some kind of iSCSI protocol errror happened.
-
+  @retval EFI_BAD_BUFFER_SIZEE The buffer was not the proper size for the request.
+  @retval Others             Other errors as indicated.
 **/
 EFI_STATUS
 IScsiOnScsiRspRcvd (
@@ -2420,6 +2388,9 @@ IScsiOnScsiRspRcvd (
   UINT32            DataSegLen;
 
   ScsiRspHdr                    = (SCSI_RESPONSE *) NetbufGetByte (Pdu, 0, NULL);
+  if (ScsiRspHdr == NULL) {
+    return EFI_PROTOCOL_ERROR;
+  }
 
   ScsiRspHdr->InitiatorTaskTag  = NTOHL (ScsiRspHdr->InitiatorTaskTag);
   if (ScsiRspHdr->InitiatorTaskTag != Tcb->InitiatorTaskTag) {
@@ -2482,6 +2453,9 @@ IScsiOnScsiRspRcvd (
   DataSegLen = ISCSI_GET_DATASEG_LEN (ScsiRspHdr);
   if (DataSegLen != 0) {
     SenseData               = (ISCSI_SENSE_DATA *) NetbufGetByte (Pdu, sizeof (SCSI_RESPONSE), NULL);
+    if (SenseData == NULL) {
+      return EFI_PROTOCOL_ERROR;
+    }
 
     SenseData->Length       = NTOHS (SenseData->Length);
 
@@ -2499,15 +2473,12 @@ IScsiOnScsiRspRcvd (
 /**
   Process the received NOP In PDU.
 
-  @param  Pdu[in]            The NOP In PDU received.
-
-  @param  Tcb[in]            The task control block.
+  @param[in]  Pdu            The NOP In PDU received.
+  @param[in]  Tcb            The task control block.
 
   @retval EFI_SUCCES         The NOP In PDU is processed and the related sequence
                              numbers are updated.
-
   @retval EFI_PROTOCOL_ERROR Some kind of iSCSI protocol errror happened.
-
 **/
 EFI_STATUS
 IScsiOnNopInRcvd (
@@ -2519,6 +2490,9 @@ IScsiOnNopInRcvd (
   EFI_STATUS    Status;
 
   NopInHdr            = (ISCSI_NOP_IN *) NetbufGetByte (Pdu, 0, NULL);
+  if (NopInHdr == NULL) {
+    return EFI_PROTOCOL_ERROR;
+  }
 
   NopInHdr->StatSN    = NTOHL (NopInHdr->StatSN);
   NopInHdr->ExpCmdSN  = NTOHL (NopInHdr->ExpCmdSN);
@@ -2543,20 +2517,18 @@ IScsiOnNopInRcvd (
 /**
   Execute the SCSI command issued through the EXT SCSI PASS THRU protocol.
 
-  @param  PassThru[in]     The EXT SCSI PASS THRU protocol.
-
-  @param  Target[in]       The target ID.
-
-  @param  Lun[in]          The LUN.
-
-  @param  Packet[in][out]  The request packet containing IO request, SCSI command
-                           buffer and buffers to read/write.
-
-  @retval EFI_SUCCES       The SCSI command is executed and the result is updated to 
-                           the Packet.
-
-  @retval EFI_DEVICE_ERROR Some unexpected error happened.
+  @param[in]       PassThru  The EXT SCSI PASS THRU protocol.
+  @param[in]       Target    The target ID.
+  @param[in]       Lun       The LUN.
+  @param[in, out]  Packet    The request packet containing IO request, SCSI command
+                             buffer and buffers to read/write.
 
+  @retval EFI_SUCCES           The SCSI command is executed and the result is updated to
+                               the Packet.
+  @retval EFI_DEVICE_ERROR     Session state was not as required.
+  @retval EFI_OUT_OF_RESOURCES Failed to allocate memory.
+  @retval EFI_NOT_READY        The target can not accept new commands.
+  @retval Others               Other errors as indicated.
 **/
 EFI_STATUS
 IScsiExecuteScsiCommand (
@@ -2577,7 +2549,7 @@ IScsiExecuteScsiCommand (
   UINT8                   *Data;
   ISCSI_IN_BUFFER_CONTEXT InBufferContext;
   UINT64                  Timeout;
-  UINT8                   *Buffer;
+  UINT8                   *PduHdr;
 
   Private       = ISCSI_DRIVER_DATA_FROM_EXT_SCSI_PASS_THRU (PassThru);
   Session       = &Private->Session;
@@ -2587,7 +2559,8 @@ IScsiExecuteScsiCommand (
   Timeout       = 0;
 
   if (Session->State != SESSION_STATE_LOGGED_IN) {
-    return EFI_DEVICE_ERROR;
+    Status = EFI_DEVICE_ERROR;
+    goto ON_EXIT;
   }
 
   Conn = NET_LIST_USER_STRUCT_S (
@@ -2615,8 +2588,13 @@ IScsiExecuteScsiCommand (
   }
 
   XferContext         = &Tcb->XferContext;
-  Buffer              = NetbufGetByte (Pdu, 0, NULL);
-  XferContext->Offset = ISCSI_GET_DATASEG_LEN (Buffer);
+  PduHdr              = NetbufGetByte (Pdu, 0, NULL);
+  if (PduHdr == NULL) {
+    Status = EFI_PROTOCOL_ERROR;
+    NetbufFree (Pdu);
+    goto ON_EXIT;
+  }
+  XferContext->Offset = ISCSI_GET_DATASEG_LEN (PduHdr);
 
   //
   // Transmit the SCSI Command PDU.
@@ -2657,12 +2635,12 @@ IScsiExecuteScsiCommand (
     //
     // Start the timeout timer.
     //
-    if (Timeout) {
+    if (Timeout != 0) {
       Status = gBS->SetTimer (Conn->TimeoutEvent, TimerRelative, Timeout);
       if (EFI_ERROR (Status)) {
         goto ON_EXIT;
       }
-      TimeoutEvent = Conn->TimeoutEvent; 
+      TimeoutEvent = Conn->TimeoutEvent;
     }
     //
     // try to receive PDU from target.
@@ -2672,7 +2650,13 @@ IScsiExecuteScsiCommand (
       goto ON_EXIT;
     }
 
-    switch (ISCSI_GET_OPCODE (NetbufGetByte (Pdu, 0, NULL))) {
+    PduHdr = NetbufGetByte (Pdu, 0, NULL);
+    if (PduHdr == NULL) {
+      Status = EFI_PROTOCOL_ERROR;
+      NetbufFree (Pdu);
+      goto ON_EXIT;
+    }
+    switch (ISCSI_GET_OPCODE (PduHdr)) {
     case ISCSI_OPCODE_SCSI_DATA_IN:
       Status = IScsiOnDataInRcvd (Pdu, Tcb, Packet);
       break;
@@ -2719,38 +2703,27 @@ ON_EXIT:
     IScsiDelTcb (Tcb);
   }
 
-  if ((Status != EFI_SUCCESS) && (Status != EFI_NOT_READY)) {
-    //
-    // Reinstate the session.
-    //
-    if (EFI_ERROR (IScsiSessionReinstatement (Private))) {
-      Status = EFI_DEVICE_ERROR;
-    }
-  }
-
   return Status;
 }
 
 /**
   Reinstate the session on some error.
 
-  @param  Private[in] The iSCSI driver data.
+  @param[in, out]  Private The iSCSI driver data.
 
   @retval EFI_SUCCES  The session is reinstated from some error.
-
-  @retval other       Reinstatement failed.
-
+  @retval Other       Reinstatement failed.
 **/
 EFI_STATUS
 IScsiSessionReinstatement (
-  IN ISCSI_DRIVER_DATA  *Private
+  IN OUT ISCSI_DRIVER_DATA  *Private
   )
 {
   ISCSI_SESSION *Session;
   EFI_STATUS    Status;
 
   Session = &Private->Session;
-  ASSERT (Session->State == SESSION_STATE_LOGGED_IN);
+  ASSERT (Session->State != SESSION_STATE_FREE);
 
   //
   // Abort the session and re-init it.
@@ -2769,43 +2742,28 @@ IScsiSessionReinstatement (
 /**
   Initialize some session parameters before login.
 
-  @param  Session[in]  The iSCSI session.
-
-  @param  Recovery[in] Whether the request is from a fresh new start or recovery.
-
-  @retval None.
-
+  @param[in, out]  Session  The iSCSI session.
+  @param[in]       Recovery Whether the request is from a fresh new start or recovery.
 **/
 VOID
 IScsiSessionInit (
-  IN ISCSI_SESSION  *Session,
-  IN BOOLEAN        Recovery
+  IN OUT ISCSI_SESSION  *Session,
+  IN BOOLEAN            Recovery
   )
 {
-  UINT32  Random;
-
   if (!Recovery) {
     Session->Signature  = ISCSI_SESSION_SIGNATURE;
     Session->State      = SESSION_STATE_FREE;
 
-    Random              = NET_RANDOM (NetRandomInitSeed ());
-
-    Session->ISID[0]    = ISID_BYTE_0;
-    Session->ISID[1]    = ISID_BYTE_1;
-    Session->ISID[2]    = ISID_BYTE_2;
-    Session->ISID[3]    = ISID_BYTE_3;
-    Session->ISID[4]    = (UINT8) Random;
-    Session->ISID[5]    = (UINT8) (Random >> 8);
-
     InitializeListHead (&Session->Conns);
     InitializeListHead (&Session->TcbList);
   }
 
-  Session->TSIH                 = 0;
+  Session->Tsih                 = 0;
 
   Session->CmdSN                = 1;
   Session->InitiatorTaskTag     = 1;
-  Session->NextCID              = 1;
+  Session->NextCid              = 1;
 
   Session->TargetPortalGroupTag = 0;
   Session->MaxConnections       = ISCSI_MAX_CONNS_PER_SESSION;
@@ -2825,14 +2783,13 @@ IScsiSessionInit (
   Abort the iSCSI session, that is, reset all the connection and free the
   resources.
 
-  @param  Session[in] The iSCSI session.
+  @param[in, out]  Session The iSCSI session.
 
   @retval EFI_SUCCES  The session is aborted.
-
 **/
 EFI_STATUS
 IScsiSessionAbort (
-  IN ISCSI_SESSION  *Session
+  IN OUT ISCSI_SESSION  *Session
   )
 {
   ISCSI_DRIVER_DATA *Private;