xref: /freebsd/sys/cam/ctl/ctl_tpc.c (revision 09606165a0ab82291c6443d5c82b205256c56458)
1 /*-
2  * Copyright (c) 2014 Alexander Motin <mav@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification, immediately at the beginning of the file.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/types.h>
34 #include <sys/lock.h>
35 #include <sys/module.h>
36 #include <sys/mutex.h>
37 #include <sys/condvar.h>
38 #include <sys/malloc.h>
39 #include <sys/conf.h>
40 #include <sys/queue.h>
41 #include <sys/sysctl.h>
42 #include <machine/atomic.h>
43 
44 #include <cam/cam.h>
45 #include <cam/scsi/scsi_all.h>
46 #include <cam/scsi/scsi_da.h>
47 #include <cam/ctl/ctl_io.h>
48 #include <cam/ctl/ctl.h>
49 #include <cam/ctl/ctl_frontend.h>
50 #include <cam/ctl/ctl_util.h>
51 #include <cam/ctl/ctl_backend.h>
52 #include <cam/ctl/ctl_ioctl.h>
53 #include <cam/ctl/ctl_ha.h>
54 #include <cam/ctl/ctl_private.h>
55 #include <cam/ctl/ctl_debug.h>
56 #include <cam/ctl/ctl_scsi_all.h>
57 #include <cam/ctl/ctl_tpc.h>
58 #include <cam/ctl/ctl_error.h>
59 
60 #define	TPC_MAX_CSCDS	64
61 #define	TPC_MAX_SEGS	64
62 #define	TPC_MAX_SEG	0
63 #define	TPC_MAX_LIST	8192
64 #define	TPC_MAX_INLINE	0
65 #define	TPC_MAX_LISTS	255
66 #define	TPC_MAX_IO_SIZE	(1024 * 1024)
67 #define	TPC_MAX_IOCHUNK_SIZE	(TPC_MAX_IO_SIZE * 16)
68 #define	TPC_MIN_TOKEN_TIMEOUT	1
69 #define	TPC_DFL_TOKEN_TIMEOUT	60
70 #define	TPC_MAX_TOKEN_TIMEOUT	600
71 
72 MALLOC_DEFINE(M_CTL_TPC, "ctltpc", "CTL TPC");
73 
74 typedef enum {
75 	TPC_ERR_RETRY		= 0x000,
76 	TPC_ERR_FAIL		= 0x001,
77 	TPC_ERR_MASK		= 0x0ff,
78 	TPC_ERR_NO_DECREMENT	= 0x100
79 } tpc_error_action;
80 
81 struct tpc_list;
82 TAILQ_HEAD(runl, tpc_io);
83 struct tpc_io {
84 	union ctl_io		*io;
85 	uint8_t			 target;
86 	uint32_t		 cscd;
87 	uint64_t		 lun;
88 	struct tpc_list		*list;
89 	struct runl		 run;
90 	TAILQ_ENTRY(tpc_io)	 rlinks;
91 	TAILQ_ENTRY(tpc_io)	 links;
92 };
93 
94 struct tpc_token {
95 	uint8_t			 token[512];
96 	uint64_t		 lun;
97 	uint32_t		 blocksize;
98 	uint8_t			*params;
99 	struct scsi_range_desc	*range;
100 	int			 nrange;
101 	int			 active;
102 	time_t			 last_active;
103 	uint32_t		 timeout;
104 	TAILQ_ENTRY(tpc_token)	 links;
105 };
106 
107 struct tpc_list {
108 	uint8_t			 service_action;
109 	int			 init_port;
110 	uint32_t		 init_idx;
111 	uint32_t		 list_id;
112 	uint8_t			 flags;
113 	uint8_t			*params;
114 	struct scsi_ec_cscd	*cscd;
115 	struct scsi_ec_segment	*seg[TPC_MAX_SEGS];
116 	uint8_t			*inl;
117 	int			 ncscd;
118 	int			 nseg;
119 	int			 leninl;
120 	struct tpc_token	*token;
121 	struct scsi_range_desc	*range;
122 	int			 nrange;
123 	off_t			 offset_into_rod;
124 
125 	int			 curseg;
126 	off_t			 cursectors;
127 	off_t			 curbytes;
128 	int			 curops;
129 	int			 stage;
130 	uint8_t			*buf;
131 	off_t			 segsectors;
132 	off_t			 segbytes;
133 	int			 tbdio;
134 	int			 error;
135 	int			 abort;
136 	int			 completed;
137 	time_t			 last_active;
138 	TAILQ_HEAD(, tpc_io)	 allio;
139 	struct scsi_sense_data	 fwd_sense_data;
140 	uint8_t			 fwd_sense_len;
141 	uint8_t			 fwd_scsi_status;
142 	uint8_t			 fwd_target;
143 	uint16_t		 fwd_cscd;
144 	struct scsi_sense_data	 sense_data;
145 	uint8_t			 sense_len;
146 	uint8_t			 scsi_status;
147 	struct ctl_scsiio	*ctsio;
148 	struct ctl_lun		*lun;
149 	int			 res_token_valid;
150 	uint8_t			 res_token[512];
151 	TAILQ_ENTRY(tpc_list)	 links;
152 };
153 
154 static void
155 tpc_timeout(void *arg)
156 {
157 	struct ctl_softc *softc = arg;
158 	struct ctl_lun *lun;
159 	struct tpc_token *token, *ttoken;
160 	struct tpc_list *list, *tlist;
161 
162 	/* Free completed lists with expired timeout. */
163 	STAILQ_FOREACH(lun, &softc->lun_list, links) {
164 		mtx_lock(&lun->lun_lock);
165 		TAILQ_FOREACH_SAFE(list, &lun->tpc_lists, links, tlist) {
166 			if (!list->completed || time_uptime < list->last_active +
167 			    TPC_DFL_TOKEN_TIMEOUT)
168 				continue;
169 			TAILQ_REMOVE(&lun->tpc_lists, list, links);
170 			free(list, M_CTL);
171 		}
172 		mtx_unlock(&lun->lun_lock);
173 	}
174 
175 	/* Free inactive ROD tokens with expired timeout. */
176 	mtx_lock(&softc->tpc_lock);
177 	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
178 		if (token->active ||
179 		    time_uptime < token->last_active + token->timeout + 1)
180 			continue;
181 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
182 		free(token->params, M_CTL);
183 		free(token, M_CTL);
184 	}
185 	mtx_unlock(&softc->tpc_lock);
186 	callout_schedule(&softc->tpc_timeout, hz);
187 }
188 
189 void
190 ctl_tpc_init(struct ctl_softc *softc)
191 {
192 
193 	mtx_init(&softc->tpc_lock, "CTL TPC mutex", NULL, MTX_DEF);
194 	TAILQ_INIT(&softc->tpc_tokens);
195 	callout_init_mtx(&softc->tpc_timeout, &softc->ctl_lock, 0);
196 	callout_reset(&softc->tpc_timeout, hz, tpc_timeout, softc);
197 }
198 
199 void
200 ctl_tpc_shutdown(struct ctl_softc *softc)
201 {
202 	struct tpc_token *token;
203 
204 	callout_drain(&softc->tpc_timeout);
205 
206 	/* Free ROD tokens. */
207 	mtx_lock(&softc->tpc_lock);
208 	while ((token = TAILQ_FIRST(&softc->tpc_tokens)) != NULL) {
209 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
210 		free(token->params, M_CTL);
211 		free(token, M_CTL);
212 	}
213 	mtx_unlock(&softc->tpc_lock);
214 	mtx_destroy(&softc->tpc_lock);
215 }
216 
217 void
218 ctl_tpc_lun_init(struct ctl_lun *lun)
219 {
220 
221 	TAILQ_INIT(&lun->tpc_lists);
222 }
223 
224 void
225 ctl_tpc_lun_shutdown(struct ctl_lun *lun)
226 {
227 	struct ctl_softc *softc = lun->ctl_softc;
228 	struct tpc_list *list;
229 	struct tpc_token *token, *ttoken;
230 
231 	/* Free lists for this LUN. */
232 	while ((list = TAILQ_FIRST(&lun->tpc_lists)) != NULL) {
233 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
234 		KASSERT(list->completed,
235 		    ("Not completed TPC (%p) on shutdown", list));
236 		free(list, M_CTL);
237 	}
238 
239 	/* Free ROD tokens for this LUN. */
240 	mtx_lock(&softc->tpc_lock);
241 	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
242 		if (token->lun != lun->lun || token->active)
243 			continue;
244 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
245 		free(token->params, M_CTL);
246 		free(token, M_CTL);
247 	}
248 	mtx_unlock(&softc->tpc_lock);
249 }
250 
251 int
252 ctl_inquiry_evpd_tpc(struct ctl_scsiio *ctsio, int alloc_len)
253 {
254 	struct ctl_lun *lun = CTL_LUN(ctsio);
255 	struct scsi_vpd_tpc *tpc_ptr;
256 	struct scsi_vpd_tpc_descriptor *d_ptr;
257 	struct scsi_vpd_tpc_descriptor_bdrl *bdrl_ptr;
258 	struct scsi_vpd_tpc_descriptor_sc *sc_ptr;
259 	struct scsi_vpd_tpc_descriptor_sc_descr *scd_ptr;
260 	struct scsi_vpd_tpc_descriptor_pd *pd_ptr;
261 	struct scsi_vpd_tpc_descriptor_sd *sd_ptr;
262 	struct scsi_vpd_tpc_descriptor_sdid *sdid_ptr;
263 	struct scsi_vpd_tpc_descriptor_rtf *rtf_ptr;
264 	struct scsi_vpd_tpc_descriptor_rtf_block *rtfb_ptr;
265 	struct scsi_vpd_tpc_descriptor_srt *srt_ptr;
266 	struct scsi_vpd_tpc_descriptor_srtd *srtd_ptr;
267 	struct scsi_vpd_tpc_descriptor_gco *gco_ptr;
268 	int data_len;
269 
270 	data_len = sizeof(struct scsi_vpd_tpc) +
271 	    sizeof(struct scsi_vpd_tpc_descriptor_bdrl) +
272 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sc) +
273 	     2 * sizeof(struct scsi_vpd_tpc_descriptor_sc_descr) + 11, 4) +
274 	    sizeof(struct scsi_vpd_tpc_descriptor_pd) +
275 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sd) + 4, 4) +
276 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sdid) + 2, 4) +
277 	    sizeof(struct scsi_vpd_tpc_descriptor_rtf) +
278 	     sizeof(struct scsi_vpd_tpc_descriptor_rtf_block) +
279 	    sizeof(struct scsi_vpd_tpc_descriptor_srt) +
280 	     2*sizeof(struct scsi_vpd_tpc_descriptor_srtd) +
281 	    sizeof(struct scsi_vpd_tpc_descriptor_gco);
282 
283 	ctsio->kern_data_ptr = malloc(data_len, M_CTL, M_WAITOK | M_ZERO);
284 	tpc_ptr = (struct scsi_vpd_tpc *)ctsio->kern_data_ptr;
285 	ctsio->kern_sg_entries = 0;
286 
287 	if (data_len < alloc_len) {
288 		ctsio->residual = alloc_len - data_len;
289 		ctsio->kern_data_len = data_len;
290 		ctsio->kern_total_len = data_len;
291 	} else {
292 		ctsio->residual = 0;
293 		ctsio->kern_data_len = alloc_len;
294 		ctsio->kern_total_len = alloc_len;
295 	}
296 	ctsio->kern_rel_offset = 0;
297 	ctsio->kern_sg_entries = 0;
298 
299 	/*
300 	 * The control device is always connected.  The disk device, on the
301 	 * other hand, may not be online all the time.
302 	 */
303 	if (lun != NULL)
304 		tpc_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
305 				     lun->be_lun->lun_type;
306 	else
307 		tpc_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
308 	tpc_ptr->page_code = SVPD_SCSI_TPC;
309 	scsi_ulto2b(data_len - 4, tpc_ptr->page_length);
310 
311 	/* Block Device ROD Limits */
312 	d_ptr = (struct scsi_vpd_tpc_descriptor *)&tpc_ptr->descr[0];
313 	bdrl_ptr = (struct scsi_vpd_tpc_descriptor_bdrl *)d_ptr;
314 	scsi_ulto2b(SVPD_TPC_BDRL, bdrl_ptr->desc_type);
315 	scsi_ulto2b(sizeof(*bdrl_ptr) - 4, bdrl_ptr->desc_length);
316 	scsi_ulto2b(TPC_MAX_SEGS, bdrl_ptr->maximum_ranges);
317 	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
318 	    bdrl_ptr->maximum_inactivity_timeout);
319 	scsi_ulto4b(TPC_DFL_TOKEN_TIMEOUT,
320 	    bdrl_ptr->default_inactivity_timeout);
321 	scsi_u64to8b(0, bdrl_ptr->maximum_token_transfer_size);
322 	scsi_u64to8b(0, bdrl_ptr->optimal_transfer_count);
323 
324 	/* Supported commands */
325 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
326 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
327 	sc_ptr = (struct scsi_vpd_tpc_descriptor_sc *)d_ptr;
328 	scsi_ulto2b(SVPD_TPC_SC, sc_ptr->desc_type);
329 	sc_ptr->list_length = 2 * sizeof(*scd_ptr) + 11;
330 	scsi_ulto2b(roundup2(1 + sc_ptr->list_length, 4), sc_ptr->desc_length);
331 	scd_ptr = &sc_ptr->descr[0];
332 	scd_ptr->opcode = EXTENDED_COPY;
333 	scd_ptr->sa_length = 5;
334 	scd_ptr->supported_service_actions[0] = EC_EC_LID1;
335 	scd_ptr->supported_service_actions[1] = EC_EC_LID4;
336 	scd_ptr->supported_service_actions[2] = EC_PT;
337 	scd_ptr->supported_service_actions[3] = EC_WUT;
338 	scd_ptr->supported_service_actions[4] = EC_COA;
339 	scd_ptr = (struct scsi_vpd_tpc_descriptor_sc_descr *)
340 	    &scd_ptr->supported_service_actions[scd_ptr->sa_length];
341 	scd_ptr->opcode = RECEIVE_COPY_STATUS;
342 	scd_ptr->sa_length = 6;
343 	scd_ptr->supported_service_actions[0] = RCS_RCS_LID1;
344 	scd_ptr->supported_service_actions[1] = RCS_RCFD;
345 	scd_ptr->supported_service_actions[2] = RCS_RCS_LID4;
346 	scd_ptr->supported_service_actions[3] = RCS_RCOP;
347 	scd_ptr->supported_service_actions[4] = RCS_RRTI;
348 	scd_ptr->supported_service_actions[5] = RCS_RART;
349 
350 	/* Parameter data. */
351 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
352 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
353 	pd_ptr = (struct scsi_vpd_tpc_descriptor_pd *)d_ptr;
354 	scsi_ulto2b(SVPD_TPC_PD, pd_ptr->desc_type);
355 	scsi_ulto2b(sizeof(*pd_ptr) - 4, pd_ptr->desc_length);
356 	scsi_ulto2b(TPC_MAX_CSCDS, pd_ptr->maximum_cscd_descriptor_count);
357 	scsi_ulto2b(TPC_MAX_SEGS, pd_ptr->maximum_segment_descriptor_count);
358 	scsi_ulto4b(TPC_MAX_LIST, pd_ptr->maximum_descriptor_list_length);
359 	scsi_ulto4b(TPC_MAX_INLINE, pd_ptr->maximum_inline_data_length);
360 
361 	/* Supported Descriptors */
362 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
363 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
364 	sd_ptr = (struct scsi_vpd_tpc_descriptor_sd *)d_ptr;
365 	scsi_ulto2b(SVPD_TPC_SD, sd_ptr->desc_type);
366 	scsi_ulto2b(roundup2(sizeof(*sd_ptr) - 4 + 4, 4), sd_ptr->desc_length);
367 	sd_ptr->list_length = 4;
368 	sd_ptr->supported_descriptor_codes[0] = EC_SEG_B2B;
369 	sd_ptr->supported_descriptor_codes[1] = EC_SEG_VERIFY;
370 	sd_ptr->supported_descriptor_codes[2] = EC_SEG_REGISTER_KEY;
371 	sd_ptr->supported_descriptor_codes[3] = EC_CSCD_ID;
372 
373 	/* Supported CSCD Descriptor IDs */
374 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
375 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
376 	sdid_ptr = (struct scsi_vpd_tpc_descriptor_sdid *)d_ptr;
377 	scsi_ulto2b(SVPD_TPC_SDID, sdid_ptr->desc_type);
378 	scsi_ulto2b(roundup2(sizeof(*sdid_ptr) - 4 + 2, 4), sdid_ptr->desc_length);
379 	scsi_ulto2b(2, sdid_ptr->list_length);
380 	scsi_ulto2b(0xffff, &sdid_ptr->supported_descriptor_ids[0]);
381 
382 	/* ROD Token Features */
383 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
384 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
385 	rtf_ptr = (struct scsi_vpd_tpc_descriptor_rtf *)d_ptr;
386 	scsi_ulto2b(SVPD_TPC_RTF, rtf_ptr->desc_type);
387 	scsi_ulto2b(sizeof(*rtf_ptr) - 4 + sizeof(*rtfb_ptr), rtf_ptr->desc_length);
388 	rtf_ptr->remote_tokens = 0;
389 	scsi_ulto4b(TPC_MIN_TOKEN_TIMEOUT, rtf_ptr->minimum_token_lifetime);
390 	scsi_ulto4b(UINT32_MAX, rtf_ptr->maximum_token_lifetime);
391 	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
392 	    rtf_ptr->maximum_token_inactivity_timeout);
393 	scsi_ulto2b(sizeof(*rtfb_ptr), rtf_ptr->type_specific_features_length);
394 	rtfb_ptr = (struct scsi_vpd_tpc_descriptor_rtf_block *)
395 	    &rtf_ptr->type_specific_features;
396 	rtfb_ptr->type_format = SVPD_TPC_RTF_BLOCK;
397 	scsi_ulto2b(sizeof(*rtfb_ptr) - 4, rtfb_ptr->desc_length);
398 	scsi_ulto2b(0, rtfb_ptr->optimal_length_granularity);
399 	scsi_u64to8b(0, rtfb_ptr->maximum_bytes);
400 	scsi_u64to8b(0, rtfb_ptr->optimal_bytes);
401 	scsi_u64to8b(UINT64_MAX, rtfb_ptr->optimal_bytes_to_token_per_segment);
402 	scsi_u64to8b(TPC_MAX_IOCHUNK_SIZE,
403 	    rtfb_ptr->optimal_bytes_from_token_per_segment);
404 
405 	/* Supported ROD Tokens */
406 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
407 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
408 	srt_ptr = (struct scsi_vpd_tpc_descriptor_srt *)d_ptr;
409 	scsi_ulto2b(SVPD_TPC_SRT, srt_ptr->desc_type);
410 	scsi_ulto2b(sizeof(*srt_ptr) - 4 + 2*sizeof(*srtd_ptr), srt_ptr->desc_length);
411 	scsi_ulto2b(2*sizeof(*srtd_ptr), srt_ptr->rod_type_descriptors_length);
412 	srtd_ptr = (struct scsi_vpd_tpc_descriptor_srtd *)
413 	    &srt_ptr->rod_type_descriptors;
414 	scsi_ulto4b(ROD_TYPE_AUR, srtd_ptr->rod_type);
415 	srtd_ptr->flags = SVPD_TPC_SRTD_TIN | SVPD_TPC_SRTD_TOUT;
416 	scsi_ulto2b(0, srtd_ptr->preference_indicator);
417 	srtd_ptr++;
418 	scsi_ulto4b(ROD_TYPE_BLOCK_ZERO, srtd_ptr->rod_type);
419 	srtd_ptr->flags = SVPD_TPC_SRTD_TIN;
420 	scsi_ulto2b(0, srtd_ptr->preference_indicator);
421 
422 	/* General Copy Operations */
423 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
424 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
425 	gco_ptr = (struct scsi_vpd_tpc_descriptor_gco *)d_ptr;
426 	scsi_ulto2b(SVPD_TPC_GCO, gco_ptr->desc_type);
427 	scsi_ulto2b(sizeof(*gco_ptr) - 4, gco_ptr->desc_length);
428 	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->total_concurrent_copies);
429 	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->maximum_identified_concurrent_copies);
430 	scsi_ulto4b(TPC_MAX_SEG, gco_ptr->maximum_segment_length);
431 	gco_ptr->data_segment_granularity = 0;
432 	gco_ptr->inline_data_granularity = 0;
433 
434 	ctl_set_success(ctsio);
435 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
436 	ctsio->be_move_done = ctl_config_move_done;
437 	ctl_datamove((union ctl_io *)ctsio);
438 
439 	return (CTL_RETVAL_COMPLETE);
440 }
441 
442 int
443 ctl_receive_copy_operating_parameters(struct ctl_scsiio *ctsio)
444 {
445 	struct scsi_receive_copy_operating_parameters *cdb;
446 	struct scsi_receive_copy_operating_parameters_data *data;
447 	int retval;
448 	int alloc_len, total_len;
449 
450 	CTL_DEBUG_PRINT(("ctl_report_supported_tmf\n"));
451 
452 	cdb = (struct scsi_receive_copy_operating_parameters *)ctsio->cdb;
453 
454 	retval = CTL_RETVAL_COMPLETE;
455 
456 	total_len = sizeof(*data) + 4;
457 	alloc_len = scsi_4btoul(cdb->length);
458 
459 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
460 
461 	ctsio->kern_sg_entries = 0;
462 
463 	if (total_len < alloc_len) {
464 		ctsio->residual = alloc_len - total_len;
465 		ctsio->kern_data_len = total_len;
466 		ctsio->kern_total_len = total_len;
467 	} else {
468 		ctsio->residual = 0;
469 		ctsio->kern_data_len = alloc_len;
470 		ctsio->kern_total_len = alloc_len;
471 	}
472 	ctsio->kern_rel_offset = 0;
473 
474 	data = (struct scsi_receive_copy_operating_parameters_data *)ctsio->kern_data_ptr;
475 	scsi_ulto4b(sizeof(*data) - 4 + 4, data->length);
476 	data->snlid = RCOP_SNLID;
477 	scsi_ulto2b(TPC_MAX_CSCDS, data->maximum_cscd_descriptor_count);
478 	scsi_ulto2b(TPC_MAX_SEGS, data->maximum_segment_descriptor_count);
479 	scsi_ulto4b(TPC_MAX_LIST, data->maximum_descriptor_list_length);
480 	scsi_ulto4b(TPC_MAX_SEG, data->maximum_segment_length);
481 	scsi_ulto4b(TPC_MAX_INLINE, data->maximum_inline_data_length);
482 	scsi_ulto4b(0, data->held_data_limit);
483 	scsi_ulto4b(0, data->maximum_stream_device_transfer_size);
484 	scsi_ulto2b(TPC_MAX_LISTS, data->total_concurrent_copies);
485 	data->maximum_concurrent_copies = TPC_MAX_LISTS;
486 	data->data_segment_granularity = 0;
487 	data->inline_data_granularity = 0;
488 	data->held_data_granularity = 0;
489 	data->implemented_descriptor_list_length = 4;
490 	data->list_of_implemented_descriptor_type_codes[0] = EC_SEG_B2B;
491 	data->list_of_implemented_descriptor_type_codes[1] = EC_SEG_VERIFY;
492 	data->list_of_implemented_descriptor_type_codes[2] = EC_SEG_REGISTER_KEY;
493 	data->list_of_implemented_descriptor_type_codes[3] = EC_CSCD_ID;
494 
495 	ctl_set_success(ctsio);
496 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
497 	ctsio->be_move_done = ctl_config_move_done;
498 	ctl_datamove((union ctl_io *)ctsio);
499 	return (retval);
500 }
501 
502 static struct tpc_list *
503 tpc_find_list(struct ctl_lun *lun, uint32_t list_id, uint32_t init_idx)
504 {
505 	struct tpc_list *list;
506 
507 	mtx_assert(&lun->lun_lock, MA_OWNED);
508 	TAILQ_FOREACH(list, &lun->tpc_lists, links) {
509 		if ((list->flags & EC_LIST_ID_USAGE_MASK) !=
510 		     EC_LIST_ID_USAGE_NONE && list->list_id == list_id &&
511 		    list->init_idx == init_idx)
512 			break;
513 	}
514 	return (list);
515 }
516 
517 int
518 ctl_receive_copy_status_lid1(struct ctl_scsiio *ctsio)
519 {
520 	struct ctl_lun *lun = CTL_LUN(ctsio);
521 	struct scsi_receive_copy_status_lid1 *cdb;
522 	struct scsi_receive_copy_status_lid1_data *data;
523 	struct tpc_list *list;
524 	struct tpc_list list_copy;
525 	int retval;
526 	int alloc_len, total_len;
527 	uint32_t list_id;
528 
529 	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid1\n"));
530 
531 	cdb = (struct scsi_receive_copy_status_lid1 *)ctsio->cdb;
532 	retval = CTL_RETVAL_COMPLETE;
533 
534 	list_id = cdb->list_identifier;
535 	mtx_lock(&lun->lun_lock);
536 	list = tpc_find_list(lun, list_id,
537 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
538 	if (list == NULL) {
539 		mtx_unlock(&lun->lun_lock);
540 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
541 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
542 		    /*bit*/ 0);
543 		ctl_done((union ctl_io *)ctsio);
544 		return (retval);
545 	}
546 	list_copy = *list;
547 	if (list->completed) {
548 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
549 		free(list, M_CTL);
550 	}
551 	mtx_unlock(&lun->lun_lock);
552 
553 	total_len = sizeof(*data);
554 	alloc_len = scsi_4btoul(cdb->length);
555 
556 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
557 
558 	ctsio->kern_sg_entries = 0;
559 
560 	if (total_len < alloc_len) {
561 		ctsio->residual = alloc_len - total_len;
562 		ctsio->kern_data_len = total_len;
563 		ctsio->kern_total_len = total_len;
564 	} else {
565 		ctsio->residual = 0;
566 		ctsio->kern_data_len = alloc_len;
567 		ctsio->kern_total_len = alloc_len;
568 	}
569 	ctsio->kern_rel_offset = 0;
570 
571 	data = (struct scsi_receive_copy_status_lid1_data *)ctsio->kern_data_ptr;
572 	scsi_ulto4b(sizeof(*data) - 4, data->available_data);
573 	if (list_copy.completed) {
574 		if (list_copy.error || list_copy.abort)
575 			data->copy_command_status = RCS_CCS_ERROR;
576 		else
577 			data->copy_command_status = RCS_CCS_COMPLETED;
578 	} else
579 		data->copy_command_status = RCS_CCS_INPROG;
580 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
581 	if (list_copy.curbytes <= UINT32_MAX) {
582 		data->transfer_count_units = RCS_TC_BYTES;
583 		scsi_ulto4b(list_copy.curbytes, data->transfer_count);
584 	} else {
585 		data->transfer_count_units = RCS_TC_MBYTES;
586 		scsi_ulto4b(list_copy.curbytes >> 20, data->transfer_count);
587 	}
588 
589 	ctl_set_success(ctsio);
590 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
591 	ctsio->be_move_done = ctl_config_move_done;
592 	ctl_datamove((union ctl_io *)ctsio);
593 	return (retval);
594 }
595 
596 int
597 ctl_receive_copy_failure_details(struct ctl_scsiio *ctsio)
598 {
599 	struct ctl_lun *lun = CTL_LUN(ctsio);
600 	struct scsi_receive_copy_failure_details *cdb;
601 	struct scsi_receive_copy_failure_details_data *data;
602 	struct tpc_list *list;
603 	struct tpc_list list_copy;
604 	int retval;
605 	int alloc_len, total_len;
606 	uint32_t list_id;
607 
608 	CTL_DEBUG_PRINT(("ctl_receive_copy_failure_details\n"));
609 
610 	cdb = (struct scsi_receive_copy_failure_details *)ctsio->cdb;
611 	retval = CTL_RETVAL_COMPLETE;
612 
613 	list_id = cdb->list_identifier;
614 	mtx_lock(&lun->lun_lock);
615 	list = tpc_find_list(lun, list_id,
616 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
617 	if (list == NULL || !list->completed) {
618 		mtx_unlock(&lun->lun_lock);
619 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
620 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
621 		    /*bit*/ 0);
622 		ctl_done((union ctl_io *)ctsio);
623 		return (retval);
624 	}
625 	list_copy = *list;
626 	TAILQ_REMOVE(&lun->tpc_lists, list, links);
627 	free(list, M_CTL);
628 	mtx_unlock(&lun->lun_lock);
629 
630 	total_len = sizeof(*data) + list_copy.sense_len;
631 	alloc_len = scsi_4btoul(cdb->length);
632 
633 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
634 
635 	ctsio->kern_sg_entries = 0;
636 
637 	if (total_len < alloc_len) {
638 		ctsio->residual = alloc_len - total_len;
639 		ctsio->kern_data_len = total_len;
640 		ctsio->kern_total_len = total_len;
641 	} else {
642 		ctsio->residual = 0;
643 		ctsio->kern_data_len = alloc_len;
644 		ctsio->kern_total_len = alloc_len;
645 	}
646 	ctsio->kern_rel_offset = 0;
647 
648 	data = (struct scsi_receive_copy_failure_details_data *)ctsio->kern_data_ptr;
649 	if (list_copy.completed && (list_copy.error || list_copy.abort)) {
650 		scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
651 		    data->available_data);
652 		data->copy_command_status = RCS_CCS_ERROR;
653 	} else
654 		scsi_ulto4b(0, data->available_data);
655 	scsi_ulto2b(list_copy.sense_len, data->sense_data_length);
656 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
657 
658 	ctl_set_success(ctsio);
659 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
660 	ctsio->be_move_done = ctl_config_move_done;
661 	ctl_datamove((union ctl_io *)ctsio);
662 	return (retval);
663 }
664 
665 int
666 ctl_receive_copy_status_lid4(struct ctl_scsiio *ctsio)
667 {
668 	struct ctl_lun *lun = CTL_LUN(ctsio);
669 	struct scsi_receive_copy_status_lid4 *cdb;
670 	struct scsi_receive_copy_status_lid4_data *data;
671 	struct tpc_list *list;
672 	struct tpc_list list_copy;
673 	int retval;
674 	int alloc_len, total_len;
675 	uint32_t list_id;
676 
677 	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid4\n"));
678 
679 	cdb = (struct scsi_receive_copy_status_lid4 *)ctsio->cdb;
680 	retval = CTL_RETVAL_COMPLETE;
681 
682 	list_id = scsi_4btoul(cdb->list_identifier);
683 	mtx_lock(&lun->lun_lock);
684 	list = tpc_find_list(lun, list_id,
685 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
686 	if (list == NULL) {
687 		mtx_unlock(&lun->lun_lock);
688 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
689 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
690 		    /*bit*/ 0);
691 		ctl_done((union ctl_io *)ctsio);
692 		return (retval);
693 	}
694 	list_copy = *list;
695 	if (list->completed) {
696 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
697 		free(list, M_CTL);
698 	}
699 	mtx_unlock(&lun->lun_lock);
700 
701 	total_len = sizeof(*data) + list_copy.sense_len;
702 	alloc_len = scsi_4btoul(cdb->length);
703 
704 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
705 
706 	ctsio->kern_sg_entries = 0;
707 
708 	if (total_len < alloc_len) {
709 		ctsio->residual = alloc_len - total_len;
710 		ctsio->kern_data_len = total_len;
711 		ctsio->kern_total_len = total_len;
712 	} else {
713 		ctsio->residual = 0;
714 		ctsio->kern_data_len = alloc_len;
715 		ctsio->kern_total_len = alloc_len;
716 	}
717 	ctsio->kern_rel_offset = 0;
718 
719 	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
720 	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
721 	    data->available_data);
722 	data->response_to_service_action = list_copy.service_action;
723 	if (list_copy.completed) {
724 		if (list_copy.error)
725 			data->copy_command_status = RCS_CCS_ERROR;
726 		else if (list_copy.abort)
727 			data->copy_command_status = RCS_CCS_ABORTED;
728 		else
729 			data->copy_command_status = RCS_CCS_COMPLETED;
730 	} else
731 		data->copy_command_status = RCS_CCS_INPROG_FG;
732 	scsi_ulto2b(list_copy.curops, data->operation_counter);
733 	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
734 	data->transfer_count_units = RCS_TC_BYTES;
735 	scsi_u64to8b(list_copy.curbytes, data->transfer_count);
736 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
737 	data->length_of_the_sense_data_field = list_copy.sense_len;
738 	data->sense_data_length = list_copy.sense_len;
739 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
740 
741 	ctl_set_success(ctsio);
742 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
743 	ctsio->be_move_done = ctl_config_move_done;
744 	ctl_datamove((union ctl_io *)ctsio);
745 	return (retval);
746 }
747 
748 int
749 ctl_copy_operation_abort(struct ctl_scsiio *ctsio)
750 {
751 	struct ctl_lun *lun = CTL_LUN(ctsio);
752 	struct scsi_copy_operation_abort *cdb;
753 	struct tpc_list *list;
754 	int retval;
755 	uint32_t list_id;
756 
757 	CTL_DEBUG_PRINT(("ctl_copy_operation_abort\n"));
758 
759 	cdb = (struct scsi_copy_operation_abort *)ctsio->cdb;
760 	retval = CTL_RETVAL_COMPLETE;
761 
762 	list_id = scsi_4btoul(cdb->list_identifier);
763 	mtx_lock(&lun->lun_lock);
764 	list = tpc_find_list(lun, list_id,
765 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
766 	if (list == NULL) {
767 		mtx_unlock(&lun->lun_lock);
768 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
769 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
770 		    /*bit*/ 0);
771 		ctl_done((union ctl_io *)ctsio);
772 		return (retval);
773 	}
774 	list->abort = 1;
775 	mtx_unlock(&lun->lun_lock);
776 
777 	ctl_set_success(ctsio);
778 	ctl_done((union ctl_io *)ctsio);
779 	return (retval);
780 }
781 
782 static uint64_t
783 tpc_resolve(struct tpc_list *list, uint16_t idx, uint32_t *ss,
784     uint32_t *pb, uint32_t *pbo)
785 {
786 
787 	if (idx == 0xffff) {
788 		if (ss && list->lun->be_lun)
789 			*ss = list->lun->be_lun->blocksize;
790 		if (pb && list->lun->be_lun)
791 			*pb = list->lun->be_lun->blocksize <<
792 			    list->lun->be_lun->pblockexp;
793 		if (pbo && list->lun->be_lun)
794 			*pbo = list->lun->be_lun->blocksize *
795 			    list->lun->be_lun->pblockoff;
796 		return (list->lun->lun);
797 	}
798 	if (idx >= list->ncscd)
799 		return (UINT64_MAX);
800 	return (tpcl_resolve(list->lun->ctl_softc,
801 	    list->init_port, &list->cscd[idx], ss, pb, pbo));
802 }
803 
804 static void
805 tpc_set_io_error_sense(struct tpc_list *list)
806 {
807 	int flen;
808 	uint8_t csi[4];
809 	uint8_t sks[3];
810 	uint8_t fbuf[4 + 64];
811 
812 	scsi_ulto4b(list->curseg, csi);
813 	if (list->fwd_cscd <= 0x07ff) {
814 		sks[0] = SSD_SKS_SEGMENT_VALID;
815 		scsi_ulto2b((uint8_t *)&list->cscd[list->fwd_cscd] -
816 		    list->params, &sks[1]);
817 	} else
818 		sks[0] = 0;
819 	if (list->fwd_scsi_status) {
820 		fbuf[0] = 0x0c;
821 		fbuf[2] = list->fwd_target;
822 		flen = list->fwd_sense_len;
823 		if (flen > 64) {
824 			flen = 64;
825 			fbuf[2] |= SSD_FORWARDED_FSDT;
826 		}
827 		fbuf[1] = 2 + flen;
828 		fbuf[3] = list->fwd_scsi_status;
829 		bcopy(&list->fwd_sense_data, &fbuf[4], flen);
830 		flen += 4;
831 	} else
832 		flen = 0;
833 	ctl_set_sense(list->ctsio, /*current_error*/ 1,
834 	    /*sense_key*/ SSD_KEY_COPY_ABORTED,
835 	    /*asc*/ 0x0d, /*ascq*/ 0x01,
836 	    SSD_ELEM_COMMAND, sizeof(csi), csi,
837 	    sks[0] ? SSD_ELEM_SKS : SSD_ELEM_SKIP, sizeof(sks), sks,
838 	    flen ? SSD_ELEM_DESC : SSD_ELEM_SKIP, flen, fbuf,
839 	    SSD_ELEM_NONE);
840 }
841 
842 static int
843 tpc_process_b2b(struct tpc_list *list)
844 {
845 	struct scsi_ec_segment_b2b *seg;
846 	struct scsi_ec_cscd_dtsp *sdstp, *ddstp;
847 	struct tpc_io *tior, *tiow;
848 	struct runl run;
849 	uint64_t sl, dl;
850 	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
851 	int numlba;
852 	uint32_t srcblock, dstblock, pb, pbo, adj;
853 	uint16_t scscd, dcscd;
854 	uint8_t csi[4];
855 
856 	scsi_ulto4b(list->curseg, csi);
857 	if (list->stage == 1) {
858 		while ((tior = TAILQ_FIRST(&list->allio)) != NULL) {
859 			TAILQ_REMOVE(&list->allio, tior, links);
860 			ctl_free_io(tior->io);
861 			free(tior, M_CTL);
862 		}
863 		free(list->buf, M_CTL);
864 		if (list->abort) {
865 			ctl_set_task_aborted(list->ctsio);
866 			return (CTL_RETVAL_ERROR);
867 		} else if (list->error) {
868 			tpc_set_io_error_sense(list);
869 			return (CTL_RETVAL_ERROR);
870 		}
871 		list->cursectors += list->segsectors;
872 		list->curbytes += list->segbytes;
873 		return (CTL_RETVAL_COMPLETE);
874 	}
875 
876 	TAILQ_INIT(&list->allio);
877 	seg = (struct scsi_ec_segment_b2b *)list->seg[list->curseg];
878 	scscd = scsi_2btoul(seg->src_cscd);
879 	dcscd = scsi_2btoul(seg->dst_cscd);
880 	sl = tpc_resolve(list, scscd, &srcblock, NULL, NULL);
881 	dl = tpc_resolve(list, dcscd, &dstblock, &pb, &pbo);
882 	if (sl == UINT64_MAX || dl == UINT64_MAX) {
883 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
884 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
885 		    /*asc*/ 0x08, /*ascq*/ 0x04,
886 		    SSD_ELEM_COMMAND, sizeof(csi), csi,
887 		    SSD_ELEM_NONE);
888 		return (CTL_RETVAL_ERROR);
889 	}
890 	if (pbo > 0)
891 		pbo = pb - pbo;
892 	sdstp = &list->cscd[scscd].dtsp;
893 	if (scsi_3btoul(sdstp->block_length) != 0)
894 		srcblock = scsi_3btoul(sdstp->block_length);
895 	ddstp = &list->cscd[dcscd].dtsp;
896 	if (scsi_3btoul(ddstp->block_length) != 0)
897 		dstblock = scsi_3btoul(ddstp->block_length);
898 	numlba = scsi_2btoul(seg->number_of_blocks);
899 	if (seg->flags & EC_SEG_DC)
900 		numbytes = (off_t)numlba * dstblock;
901 	else
902 		numbytes = (off_t)numlba * srcblock;
903 	srclba = scsi_8btou64(seg->src_lba);
904 	dstlba = scsi_8btou64(seg->dst_lba);
905 
906 //	printf("Copy %ju bytes from %ju @ %ju to %ju @ %ju\n",
907 //	    (uintmax_t)numbytes, sl, scsi_8btou64(seg->src_lba),
908 //	    dl, scsi_8btou64(seg->dst_lba));
909 
910 	if (numbytes == 0)
911 		return (CTL_RETVAL_COMPLETE);
912 
913 	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
914 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
915 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
916 		    /*asc*/ 0x26, /*ascq*/ 0x0A,
917 		    SSD_ELEM_COMMAND, sizeof(csi), csi,
918 		    SSD_ELEM_NONE);
919 		return (CTL_RETVAL_ERROR);
920 	}
921 
922 	list->buf = malloc(numbytes, M_CTL, M_WAITOK);
923 	list->segbytes = numbytes;
924 	list->segsectors = numbytes / dstblock;
925 	donebytes = 0;
926 	TAILQ_INIT(&run);
927 	list->tbdio = 0;
928 	while (donebytes < numbytes) {
929 		roundbytes = numbytes - donebytes;
930 		if (roundbytes > TPC_MAX_IO_SIZE) {
931 			roundbytes = TPC_MAX_IO_SIZE;
932 			roundbytes -= roundbytes % dstblock;
933 			if (pb > dstblock) {
934 				adj = (dstlba * dstblock + roundbytes - pbo) % pb;
935 				if (roundbytes > adj)
936 					roundbytes -= adj;
937 			}
938 		}
939 
940 		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
941 		TAILQ_INIT(&tior->run);
942 		tior->list = list;
943 		TAILQ_INSERT_TAIL(&list->allio, tior, links);
944 		tior->io = tpcl_alloc_io();
945 		ctl_scsi_read_write(tior->io,
946 				    /*data_ptr*/ &list->buf[donebytes],
947 				    /*data_len*/ roundbytes,
948 				    /*read_op*/ 1,
949 				    /*byte2*/ 0,
950 				    /*minimum_cdb_size*/ 0,
951 				    /*lba*/ srclba,
952 				    /*num_blocks*/ roundbytes / srcblock,
953 				    /*tag_type*/ CTL_TAG_SIMPLE,
954 				    /*control*/ 0);
955 		tior->io->io_hdr.retries = 3;
956 		tior->target = SSD_FORWARDED_SDS_EXSRC;
957 		tior->cscd = scscd;
958 		tior->lun = sl;
959 		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
960 
961 		tiow = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
962 		TAILQ_INIT(&tiow->run);
963 		tiow->list = list;
964 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
965 		tiow->io = tpcl_alloc_io();
966 		ctl_scsi_read_write(tiow->io,
967 				    /*data_ptr*/ &list->buf[donebytes],
968 				    /*data_len*/ roundbytes,
969 				    /*read_op*/ 0,
970 				    /*byte2*/ 0,
971 				    /*minimum_cdb_size*/ 0,
972 				    /*lba*/ dstlba,
973 				    /*num_blocks*/ roundbytes / dstblock,
974 				    /*tag_type*/ CTL_TAG_SIMPLE,
975 				    /*control*/ 0);
976 		tiow->io->io_hdr.retries = 3;
977 		tiow->target = SSD_FORWARDED_SDS_EXDST;
978 		tiow->cscd = dcscd;
979 		tiow->lun = dl;
980 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
981 
982 		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
983 		TAILQ_INSERT_TAIL(&run, tior, rlinks);
984 		list->tbdio++;
985 		donebytes += roundbytes;
986 		srclba += roundbytes / srcblock;
987 		dstlba += roundbytes / dstblock;
988 	}
989 
990 	while ((tior = TAILQ_FIRST(&run)) != NULL) {
991 		TAILQ_REMOVE(&run, tior, rlinks);
992 		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
993 			panic("tpcl_queue() error");
994 	}
995 
996 	list->stage++;
997 	return (CTL_RETVAL_QUEUED);
998 }
999 
1000 static int
1001 tpc_process_verify(struct tpc_list *list)
1002 {
1003 	struct scsi_ec_segment_verify *seg;
1004 	struct tpc_io *tio;
1005 	uint64_t sl;
1006 	uint16_t cscd;
1007 	uint8_t csi[4];
1008 
1009 	scsi_ulto4b(list->curseg, csi);
1010 	if (list->stage == 1) {
1011 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1012 			TAILQ_REMOVE(&list->allio, tio, links);
1013 			ctl_free_io(tio->io);
1014 			free(tio, M_CTL);
1015 		}
1016 		if (list->abort) {
1017 			ctl_set_task_aborted(list->ctsio);
1018 			return (CTL_RETVAL_ERROR);
1019 		} else if (list->error) {
1020 			tpc_set_io_error_sense(list);
1021 			return (CTL_RETVAL_ERROR);
1022 		} else
1023 			return (CTL_RETVAL_COMPLETE);
1024 	}
1025 
1026 	TAILQ_INIT(&list->allio);
1027 	seg = (struct scsi_ec_segment_verify *)list->seg[list->curseg];
1028 	cscd = scsi_2btoul(seg->src_cscd);
1029 	sl = tpc_resolve(list, cscd, NULL, NULL, NULL);
1030 	if (sl == UINT64_MAX) {
1031 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1032 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1033 		    /*asc*/ 0x08, /*ascq*/ 0x04,
1034 		    SSD_ELEM_COMMAND, sizeof(csi), csi,
1035 		    SSD_ELEM_NONE);
1036 		return (CTL_RETVAL_ERROR);
1037 	}
1038 
1039 //	printf("Verify %ju\n", sl);
1040 
1041 	if ((seg->tur & 0x01) == 0)
1042 		return (CTL_RETVAL_COMPLETE);
1043 
1044 	list->tbdio = 1;
1045 	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1046 	TAILQ_INIT(&tio->run);
1047 	tio->list = list;
1048 	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1049 	tio->io = tpcl_alloc_io();
1050 	ctl_scsi_tur(tio->io, /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1051 	tio->io->io_hdr.retries = 3;
1052 	tio->target = SSD_FORWARDED_SDS_EXSRC;
1053 	tio->cscd = cscd;
1054 	tio->lun = sl;
1055 	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1056 	list->stage++;
1057 	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1058 		panic("tpcl_queue() error");
1059 	return (CTL_RETVAL_QUEUED);
1060 }
1061 
1062 static int
1063 tpc_process_register_key(struct tpc_list *list)
1064 {
1065 	struct scsi_ec_segment_register_key *seg;
1066 	struct tpc_io *tio;
1067 	uint64_t dl;
1068 	int datalen;
1069 	uint16_t cscd;
1070 	uint8_t csi[4];
1071 
1072 	scsi_ulto4b(list->curseg, csi);
1073 	if (list->stage == 1) {
1074 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1075 			TAILQ_REMOVE(&list->allio, tio, links);
1076 			ctl_free_io(tio->io);
1077 			free(tio, M_CTL);
1078 		}
1079 		free(list->buf, M_CTL);
1080 		if (list->abort) {
1081 			ctl_set_task_aborted(list->ctsio);
1082 			return (CTL_RETVAL_ERROR);
1083 		} else if (list->error) {
1084 			tpc_set_io_error_sense(list);
1085 			return (CTL_RETVAL_ERROR);
1086 		} else
1087 			return (CTL_RETVAL_COMPLETE);
1088 	}
1089 
1090 	TAILQ_INIT(&list->allio);
1091 	seg = (struct scsi_ec_segment_register_key *)list->seg[list->curseg];
1092 	cscd = scsi_2btoul(seg->dst_cscd);
1093 	dl = tpc_resolve(list, cscd, NULL, NULL, NULL);
1094 	if (dl == UINT64_MAX) {
1095 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1096 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1097 		    /*asc*/ 0x08, /*ascq*/ 0x04,
1098 		    SSD_ELEM_COMMAND, sizeof(csi), csi,
1099 		    SSD_ELEM_NONE);
1100 		return (CTL_RETVAL_ERROR);
1101 	}
1102 
1103 //	printf("Register Key %ju\n", dl);
1104 
1105 	list->tbdio = 1;
1106 	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1107 	TAILQ_INIT(&tio->run);
1108 	tio->list = list;
1109 	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1110 	tio->io = tpcl_alloc_io();
1111 	datalen = sizeof(struct scsi_per_res_out_parms);
1112 	list->buf = malloc(datalen, M_CTL, M_WAITOK);
1113 	ctl_scsi_persistent_res_out(tio->io,
1114 	    list->buf, datalen, SPRO_REGISTER, -1,
1115 	    scsi_8btou64(seg->res_key), scsi_8btou64(seg->sa_res_key),
1116 	    /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1117 	tio->io->io_hdr.retries = 3;
1118 	tio->target = SSD_FORWARDED_SDS_EXDST;
1119 	tio->cscd = cscd;
1120 	tio->lun = dl;
1121 	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1122 	list->stage++;
1123 	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1124 		panic("tpcl_queue() error");
1125 	return (CTL_RETVAL_QUEUED);
1126 }
1127 
1128 static off_t
1129 tpc_ranges_length(struct scsi_range_desc *range, int nrange)
1130 {
1131 	off_t length = 0;
1132 	int r;
1133 
1134 	for (r = 0; r < nrange; r++)
1135 		length += scsi_4btoul(range[r].length);
1136 	return (length);
1137 }
1138 
1139 static int
1140 tpc_check_ranges_l(struct scsi_range_desc *range, int nrange, uint64_t maxlba,
1141     uint64_t *lba)
1142 {
1143 	uint64_t b1;
1144 	uint32_t l1;
1145 	int i;
1146 
1147 	for (i = 0; i < nrange; i++) {
1148 		b1 = scsi_8btou64(range[i].lba);
1149 		l1 = scsi_4btoul(range[i].length);
1150 		if (b1 + l1 < b1 || b1 + l1 > maxlba + 1) {
1151 			*lba = MAX(b1, maxlba + 1);
1152 			return (-1);
1153 		}
1154 	}
1155 	return (0);
1156 }
1157 
1158 static int
1159 tpc_check_ranges_x(struct scsi_range_desc *range, int nrange)
1160 {
1161 	uint64_t b1, b2;
1162 	uint32_t l1, l2;
1163 	int i, j;
1164 
1165 	for (i = 0; i < nrange - 1; i++) {
1166 		b1 = scsi_8btou64(range[i].lba);
1167 		l1 = scsi_4btoul(range[i].length);
1168 		for (j = i + 1; j < nrange; j++) {
1169 			b2 = scsi_8btou64(range[j].lba);
1170 			l2 = scsi_4btoul(range[j].length);
1171 			if (b1 + l1 > b2 && b2 + l2 > b1)
1172 				return (-1);
1173 		}
1174 	}
1175 	return (0);
1176 }
1177 
1178 static int
1179 tpc_skip_ranges(struct scsi_range_desc *range, int nrange, off_t skip,
1180     int *srange, off_t *soffset)
1181 {
1182 	off_t off;
1183 	int r;
1184 
1185 	r = 0;
1186 	off = 0;
1187 	while (r < nrange) {
1188 		if (skip - off < scsi_4btoul(range[r].length)) {
1189 			*srange = r;
1190 			*soffset = skip - off;
1191 			return (0);
1192 		}
1193 		off += scsi_4btoul(range[r].length);
1194 		r++;
1195 	}
1196 	return (-1);
1197 }
1198 
1199 static int
1200 tpc_process_wut(struct tpc_list *list)
1201 {
1202 	struct tpc_io *tio, *tior, *tiow;
1203 	struct runl run;
1204 	int drange, srange;
1205 	off_t doffset, soffset;
1206 	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
1207 	uint32_t srcblock, dstblock, pb, pbo, adj;
1208 
1209 	if (list->stage > 0) {
1210 		/* Cleanup after previous rounds. */
1211 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1212 			TAILQ_REMOVE(&list->allio, tio, links);
1213 			ctl_free_io(tio->io);
1214 			free(tio, M_CTL);
1215 		}
1216 		free(list->buf, M_CTL);
1217 		if (list->abort) {
1218 			ctl_set_task_aborted(list->ctsio);
1219 			return (CTL_RETVAL_ERROR);
1220 		} else if (list->error) {
1221 			if (list->fwd_scsi_status) {
1222 				list->ctsio->io_hdr.status =
1223 				    CTL_SCSI_ERROR | CTL_AUTOSENSE;
1224 				list->ctsio->scsi_status = list->fwd_scsi_status;
1225 				list->ctsio->sense_data = list->fwd_sense_data;
1226 				list->ctsio->sense_len = list->fwd_sense_len;
1227 			} else {
1228 				ctl_set_invalid_field(list->ctsio,
1229 				    /*sks_valid*/ 0, /*command*/ 0,
1230 				    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1231 			}
1232 			return (CTL_RETVAL_ERROR);
1233 		}
1234 		list->cursectors += list->segsectors;
1235 		list->curbytes += list->segbytes;
1236 	}
1237 
1238 	/* Check where we are on destination ranges list. */
1239 	if (tpc_skip_ranges(list->range, list->nrange, list->cursectors,
1240 	    &drange, &doffset) != 0)
1241 		return (CTL_RETVAL_COMPLETE);
1242 	dstblock = list->lun->be_lun->blocksize;
1243 	pb = dstblock << list->lun->be_lun->pblockexp;
1244 	if (list->lun->be_lun->pblockoff > 0)
1245 		pbo = pb - dstblock * list->lun->be_lun->pblockoff;
1246 	else
1247 		pbo = 0;
1248 
1249 	/* Check where we are on source ranges list. */
1250 	srcblock = list->token->blocksize;
1251 	if (tpc_skip_ranges(list->token->range, list->token->nrange,
1252 	    list->offset_into_rod + list->cursectors * dstblock / srcblock,
1253 	    &srange, &soffset) != 0) {
1254 		ctl_set_invalid_field(list->ctsio, /*sks_valid*/ 0,
1255 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1256 		return (CTL_RETVAL_ERROR);
1257 	}
1258 
1259 	srclba = scsi_8btou64(list->token->range[srange].lba) + soffset;
1260 	dstlba = scsi_8btou64(list->range[drange].lba) + doffset;
1261 	numbytes = srcblock *
1262 	    (scsi_4btoul(list->token->range[srange].length) - soffset);
1263 	numbytes = omin(numbytes, dstblock *
1264 	    (scsi_4btoul(list->range[drange].length) - doffset));
1265 	if (numbytes > TPC_MAX_IOCHUNK_SIZE) {
1266 		numbytes = TPC_MAX_IOCHUNK_SIZE;
1267 		numbytes -= numbytes % dstblock;
1268 		if (pb > dstblock) {
1269 			adj = (dstlba * dstblock + numbytes - pbo) % pb;
1270 			if (numbytes > adj)
1271 				numbytes -= adj;
1272 		}
1273 	}
1274 
1275 	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
1276 		ctl_set_invalid_field(list->ctsio, /*sks_valid*/ 0,
1277 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1278 		return (CTL_RETVAL_ERROR);
1279 	}
1280 
1281 	list->buf = malloc(numbytes, M_CTL, M_WAITOK |
1282 	    (list->token == NULL ? M_ZERO : 0));
1283 	list->segbytes = numbytes;
1284 	list->segsectors = numbytes / dstblock;
1285 //printf("Copy chunk of %ju sectors from %ju to %ju\n", list->segsectors,
1286 //    srclba, dstlba);
1287 	donebytes = 0;
1288 	TAILQ_INIT(&run);
1289 	list->tbdio = 0;
1290 	TAILQ_INIT(&list->allio);
1291 	while (donebytes < numbytes) {
1292 		roundbytes = numbytes - donebytes;
1293 		if (roundbytes > TPC_MAX_IO_SIZE) {
1294 			roundbytes = TPC_MAX_IO_SIZE;
1295 			roundbytes -= roundbytes % dstblock;
1296 			if (pb > dstblock) {
1297 				adj = (dstlba * dstblock + roundbytes - pbo) % pb;
1298 				if (roundbytes > adj)
1299 					roundbytes -= adj;
1300 			}
1301 		}
1302 
1303 		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
1304 		TAILQ_INIT(&tior->run);
1305 		tior->list = list;
1306 		TAILQ_INSERT_TAIL(&list->allio, tior, links);
1307 		tior->io = tpcl_alloc_io();
1308 		ctl_scsi_read_write(tior->io,
1309 				    /*data_ptr*/ &list->buf[donebytes],
1310 				    /*data_len*/ roundbytes,
1311 				    /*read_op*/ 1,
1312 				    /*byte2*/ 0,
1313 				    /*minimum_cdb_size*/ 0,
1314 				    /*lba*/ srclba,
1315 				    /*num_blocks*/ roundbytes / srcblock,
1316 				    /*tag_type*/ CTL_TAG_SIMPLE,
1317 				    /*control*/ 0);
1318 		tior->io->io_hdr.retries = 3;
1319 		tior->lun = list->token->lun;
1320 		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
1321 
1322 		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1323 		TAILQ_INIT(&tiow->run);
1324 		tiow->list = list;
1325 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1326 		tiow->io = tpcl_alloc_io();
1327 		ctl_scsi_read_write(tiow->io,
1328 				    /*data_ptr*/ &list->buf[donebytes],
1329 				    /*data_len*/ roundbytes,
1330 				    /*read_op*/ 0,
1331 				    /*byte2*/ 0,
1332 				    /*minimum_cdb_size*/ 0,
1333 				    /*lba*/ dstlba,
1334 				    /*num_blocks*/ roundbytes / dstblock,
1335 				    /*tag_type*/ CTL_TAG_SIMPLE,
1336 				    /*control*/ 0);
1337 		tiow->io->io_hdr.retries = 3;
1338 		tiow->lun = list->lun->lun;
1339 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1340 
1341 		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
1342 		TAILQ_INSERT_TAIL(&run, tior, rlinks);
1343 		list->tbdio++;
1344 		donebytes += roundbytes;
1345 		srclba += roundbytes / srcblock;
1346 		dstlba += roundbytes / dstblock;
1347 	}
1348 
1349 	while ((tior = TAILQ_FIRST(&run)) != NULL) {
1350 		TAILQ_REMOVE(&run, tior, rlinks);
1351 		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1352 			panic("tpcl_queue() error");
1353 	}
1354 
1355 	list->stage++;
1356 	return (CTL_RETVAL_QUEUED);
1357 }
1358 
1359 static int
1360 tpc_process_zero_wut(struct tpc_list *list)
1361 {
1362 	struct tpc_io *tio, *tiow;
1363 	struct runl run, *prun;
1364 	int r;
1365 	uint32_t dstblock, len;
1366 
1367 	if (list->stage > 0) {
1368 complete:
1369 		/* Cleanup after previous rounds. */
1370 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1371 			TAILQ_REMOVE(&list->allio, tio, links);
1372 			ctl_free_io(tio->io);
1373 			free(tio, M_CTL);
1374 		}
1375 		if (list->abort) {
1376 			ctl_set_task_aborted(list->ctsio);
1377 			return (CTL_RETVAL_ERROR);
1378 		} else if (list->error) {
1379 			if (list->fwd_scsi_status) {
1380 				list->ctsio->io_hdr.status =
1381 				    CTL_SCSI_ERROR | CTL_AUTOSENSE;
1382 				list->ctsio->scsi_status = list->fwd_scsi_status;
1383 				list->ctsio->sense_data = list->fwd_sense_data;
1384 				list->ctsio->sense_len = list->fwd_sense_len;
1385 			} else {
1386 				ctl_set_invalid_field(list->ctsio,
1387 				    /*sks_valid*/ 0, /*command*/ 0,
1388 				    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1389 			}
1390 			return (CTL_RETVAL_ERROR);
1391 		}
1392 		list->cursectors += list->segsectors;
1393 		list->curbytes += list->segbytes;
1394 		return (CTL_RETVAL_COMPLETE);
1395 	}
1396 
1397 	dstblock = list->lun->be_lun->blocksize;
1398 	TAILQ_INIT(&run);
1399 	prun = &run;
1400 	list->tbdio = 1;
1401 	TAILQ_INIT(&list->allio);
1402 	list->segsectors = 0;
1403 	for (r = 0; r < list->nrange; r++) {
1404 		len = scsi_4btoul(list->range[r].length);
1405 		if (len == 0)
1406 			continue;
1407 
1408 		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1409 		TAILQ_INIT(&tiow->run);
1410 		tiow->list = list;
1411 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1412 		tiow->io = tpcl_alloc_io();
1413 		ctl_scsi_write_same(tiow->io,
1414 				    /*data_ptr*/ NULL,
1415 				    /*data_len*/ 0,
1416 				    /*byte2*/ SWS_NDOB,
1417 				    /*lba*/ scsi_8btou64(list->range[r].lba),
1418 				    /*num_blocks*/ len,
1419 				    /*tag_type*/ CTL_TAG_SIMPLE,
1420 				    /*control*/ 0);
1421 		tiow->io->io_hdr.retries = 3;
1422 		tiow->lun = list->lun->lun;
1423 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1424 
1425 		TAILQ_INSERT_TAIL(prun, tiow, rlinks);
1426 		prun = &tiow->run;
1427 		list->segsectors += len;
1428 	}
1429 	list->segbytes = list->segsectors * dstblock;
1430 
1431 	if (TAILQ_EMPTY(&run))
1432 		goto complete;
1433 
1434 	while ((tiow = TAILQ_FIRST(&run)) != NULL) {
1435 		TAILQ_REMOVE(&run, tiow, rlinks);
1436 		if (tpcl_queue(tiow->io, tiow->lun) != CTL_RETVAL_COMPLETE)
1437 			panic("tpcl_queue() error");
1438 	}
1439 
1440 	list->stage++;
1441 	return (CTL_RETVAL_QUEUED);
1442 }
1443 
1444 static void
1445 tpc_process(struct tpc_list *list)
1446 {
1447 	struct ctl_lun *lun = list->lun;
1448 	struct ctl_softc *softc = lun->ctl_softc;
1449 	struct scsi_ec_segment *seg;
1450 	struct ctl_scsiio *ctsio = list->ctsio;
1451 	int retval = CTL_RETVAL_COMPLETE;
1452 	uint8_t csi[4];
1453 
1454 	if (list->service_action == EC_WUT) {
1455 		if (list->token != NULL)
1456 			retval = tpc_process_wut(list);
1457 		else
1458 			retval = tpc_process_zero_wut(list);
1459 		if (retval == CTL_RETVAL_QUEUED)
1460 			return;
1461 		if (retval == CTL_RETVAL_ERROR) {
1462 			list->error = 1;
1463 			goto done;
1464 		}
1465 	} else {
1466 //printf("ZZZ %d cscd, %d segs\n", list->ncscd, list->nseg);
1467 		while (list->curseg < list->nseg) {
1468 			seg = list->seg[list->curseg];
1469 			switch (seg->type_code) {
1470 			case EC_SEG_B2B:
1471 				retval = tpc_process_b2b(list);
1472 				break;
1473 			case EC_SEG_VERIFY:
1474 				retval = tpc_process_verify(list);
1475 				break;
1476 			case EC_SEG_REGISTER_KEY:
1477 				retval = tpc_process_register_key(list);
1478 				break;
1479 			default:
1480 				scsi_ulto4b(list->curseg, csi);
1481 				ctl_set_sense(ctsio, /*current_error*/ 1,
1482 				    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1483 				    /*asc*/ 0x26, /*ascq*/ 0x09,
1484 				    SSD_ELEM_COMMAND, sizeof(csi), csi,
1485 				    SSD_ELEM_NONE);
1486 				goto done;
1487 			}
1488 			if (retval == CTL_RETVAL_QUEUED)
1489 				return;
1490 			if (retval == CTL_RETVAL_ERROR) {
1491 				list->error = 1;
1492 				goto done;
1493 			}
1494 			list->curseg++;
1495 			list->stage = 0;
1496 		}
1497 	}
1498 
1499 	ctl_set_success(ctsio);
1500 
1501 done:
1502 //printf("ZZZ done\n");
1503 	free(list->params, M_CTL);
1504 	list->params = NULL;
1505 	if (list->token) {
1506 		mtx_lock(&softc->tpc_lock);
1507 		if (--list->token->active == 0)
1508 			list->token->last_active = time_uptime;
1509 		mtx_unlock(&softc->tpc_lock);
1510 		list->token = NULL;
1511 	}
1512 	mtx_lock(&lun->lun_lock);
1513 	if ((list->flags & EC_LIST_ID_USAGE_MASK) == EC_LIST_ID_USAGE_NONE) {
1514 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
1515 		free(list, M_CTL);
1516 	} else {
1517 		list->completed = 1;
1518 		list->last_active = time_uptime;
1519 		list->sense_data = ctsio->sense_data;
1520 		list->sense_len = ctsio->sense_len;
1521 		list->scsi_status = ctsio->scsi_status;
1522 	}
1523 	mtx_unlock(&lun->lun_lock);
1524 
1525 	ctl_done((union ctl_io *)ctsio);
1526 }
1527 
1528 /*
1529  * For any sort of check condition, busy, etc., we just retry.  We do not
1530  * decrement the retry count for unit attention type errors.  These are
1531  * normal, and we want to save the retry count for "real" errors.  Otherwise,
1532  * we could end up with situations where a command will succeed in some
1533  * situations and fail in others, depending on whether a unit attention is
1534  * pending.  Also, some of our error recovery actions, most notably the
1535  * LUN reset action, will cause a unit attention.
1536  *
1537  * We can add more detail here later if necessary.
1538  */
1539 static tpc_error_action
1540 tpc_checkcond_parse(union ctl_io *io)
1541 {
1542 	tpc_error_action error_action;
1543 	int error_code, sense_key, asc, ascq;
1544 
1545 	/*
1546 	 * Default to retrying the command.
1547 	 */
1548 	error_action = TPC_ERR_RETRY;
1549 
1550 	scsi_extract_sense_len(&io->scsiio.sense_data,
1551 			       io->scsiio.sense_len,
1552 			       &error_code,
1553 			       &sense_key,
1554 			       &asc,
1555 			       &ascq,
1556 			       /*show_errors*/ 1);
1557 
1558 	switch (error_code) {
1559 	case SSD_DEFERRED_ERROR:
1560 	case SSD_DESC_DEFERRED_ERROR:
1561 		error_action |= TPC_ERR_NO_DECREMENT;
1562 		break;
1563 	case SSD_CURRENT_ERROR:
1564 	case SSD_DESC_CURRENT_ERROR:
1565 	default:
1566 		switch (sense_key) {
1567 		case SSD_KEY_UNIT_ATTENTION:
1568 			error_action |= TPC_ERR_NO_DECREMENT;
1569 			break;
1570 		case SSD_KEY_HARDWARE_ERROR:
1571 			/*
1572 			 * This is our generic "something bad happened"
1573 			 * error code.  It often isn't recoverable.
1574 			 */
1575 			if ((asc == 0x44) && (ascq == 0x00))
1576 				error_action = TPC_ERR_FAIL;
1577 			break;
1578 		case SSD_KEY_NOT_READY:
1579 			/*
1580 			 * If the LUN is powered down, there likely isn't
1581 			 * much point in retrying right now.
1582 			 */
1583 			if ((asc == 0x04) && (ascq == 0x02))
1584 				error_action = TPC_ERR_FAIL;
1585 			/*
1586 			 * If the LUN is offline, there probably isn't much
1587 			 * point in retrying, either.
1588 			 */
1589 			if ((asc == 0x04) && (ascq == 0x03))
1590 				error_action = TPC_ERR_FAIL;
1591 			break;
1592 		}
1593 	}
1594 	return (error_action);
1595 }
1596 
1597 static tpc_error_action
1598 tpc_error_parse(union ctl_io *io)
1599 {
1600 	tpc_error_action error_action = TPC_ERR_RETRY;
1601 
1602 	switch (io->io_hdr.io_type) {
1603 	case CTL_IO_SCSI:
1604 		switch (io->io_hdr.status & CTL_STATUS_MASK) {
1605 		case CTL_SCSI_ERROR:
1606 			switch (io->scsiio.scsi_status) {
1607 			case SCSI_STATUS_CHECK_COND:
1608 				error_action = tpc_checkcond_parse(io);
1609 				break;
1610 			default:
1611 				break;
1612 			}
1613 			break;
1614 		default:
1615 			break;
1616 		}
1617 		break;
1618 	case CTL_IO_TASK:
1619 		break;
1620 	default:
1621 		panic("%s: invalid ctl_io type %d\n", __func__,
1622 		      io->io_hdr.io_type);
1623 		break;
1624 	}
1625 	return (error_action);
1626 }
1627 
1628 void
1629 tpc_done(union ctl_io *io)
1630 {
1631 	struct tpc_io *tio, *tior;
1632 
1633 	/*
1634 	 * Very minimal retry logic.  We basically retry if we got an error
1635 	 * back, and the retry count is greater than 0.  If we ever want
1636 	 * more sophisticated initiator type behavior, the CAM error
1637 	 * recovery code in ../common might be helpful.
1638 	 */
1639 	tio = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1640 	if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1641 	 && (io->io_hdr.retries > 0)) {
1642 		ctl_io_status old_status;
1643 		tpc_error_action error_action;
1644 
1645 		error_action = tpc_error_parse(io);
1646 		switch (error_action & TPC_ERR_MASK) {
1647 		case TPC_ERR_FAIL:
1648 			break;
1649 		case TPC_ERR_RETRY:
1650 		default:
1651 			if ((error_action & TPC_ERR_NO_DECREMENT) == 0)
1652 				io->io_hdr.retries--;
1653 			old_status = io->io_hdr.status;
1654 			io->io_hdr.status = CTL_STATUS_NONE;
1655 			io->io_hdr.flags &= ~CTL_FLAG_ABORT;
1656 			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
1657 			if (tpcl_queue(io, tio->lun) != CTL_RETVAL_COMPLETE) {
1658 				printf("%s: error returned from ctl_queue()!\n",
1659 				       __func__);
1660 				io->io_hdr.status = old_status;
1661 			} else
1662 				return;
1663 		}
1664 	}
1665 
1666 	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS) {
1667 		tio->list->error = 1;
1668 		if (io->io_hdr.io_type == CTL_IO_SCSI &&
1669 		    (io->io_hdr.status & CTL_STATUS_MASK) == CTL_SCSI_ERROR) {
1670 			tio->list->fwd_scsi_status = io->scsiio.scsi_status;
1671 			tio->list->fwd_sense_data = io->scsiio.sense_data;
1672 			tio->list->fwd_sense_len = io->scsiio.sense_len;
1673 			tio->list->fwd_target = tio->target;
1674 			tio->list->fwd_cscd = tio->cscd;
1675 		}
1676 	} else
1677 		atomic_add_int(&tio->list->curops, 1);
1678 	if (!tio->list->error && !tio->list->abort) {
1679 		while ((tior = TAILQ_FIRST(&tio->run)) != NULL) {
1680 			TAILQ_REMOVE(&tio->run, tior, rlinks);
1681 			atomic_add_int(&tio->list->tbdio, 1);
1682 			if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1683 				panic("tpcl_queue() error");
1684 		}
1685 	}
1686 	if (atomic_fetchadd_int(&tio->list->tbdio, -1) == 1)
1687 		tpc_process(tio->list);
1688 }
1689 
1690 int
1691 ctl_extended_copy_lid1(struct ctl_scsiio *ctsio)
1692 {
1693 	struct ctl_lun *lun = CTL_LUN(ctsio);
1694 	struct scsi_extended_copy *cdb;
1695 	struct scsi_extended_copy_lid1_data *data;
1696 	struct scsi_ec_cscd *cscd;
1697 	struct scsi_ec_segment *seg;
1698 	struct tpc_list *list, *tlist;
1699 	uint8_t *ptr;
1700 	char *value;
1701 	int len, off, lencscd, lenseg, leninl, nseg;
1702 
1703 	CTL_DEBUG_PRINT(("ctl_extended_copy_lid1\n"));
1704 
1705 	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1706 	len = scsi_4btoul(cdb->length);
1707 
1708 	if (len == 0) {
1709 		ctl_set_success(ctsio);
1710 		goto done;
1711 	}
1712 	if (len < sizeof(struct scsi_extended_copy_lid1_data) ||
1713 	    len > sizeof(struct scsi_extended_copy_lid1_data) +
1714 	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1715 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1716 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1717 		goto done;
1718 	}
1719 
1720 	/*
1721 	 * If we've got a kernel request that hasn't been malloced yet,
1722 	 * malloc it and tell the caller the data buffer is here.
1723 	 */
1724 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1725 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1726 		ctsio->kern_data_len = len;
1727 		ctsio->kern_total_len = len;
1728 		ctsio->kern_rel_offset = 0;
1729 		ctsio->kern_sg_entries = 0;
1730 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1731 		ctsio->be_move_done = ctl_config_move_done;
1732 		ctl_datamove((union ctl_io *)ctsio);
1733 
1734 		return (CTL_RETVAL_COMPLETE);
1735 	}
1736 
1737 	data = (struct scsi_extended_copy_lid1_data *)ctsio->kern_data_ptr;
1738 	lencscd = scsi_2btoul(data->cscd_list_length);
1739 	lenseg = scsi_4btoul(data->segment_list_length);
1740 	leninl = scsi_4btoul(data->inline_data_length);
1741 	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1742 		ctl_set_sense(ctsio, /*current_error*/ 1,
1743 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1744 		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1745 		goto done;
1746 	}
1747 	if (lenseg > TPC_MAX_SEGS * sizeof(struct scsi_ec_segment)) {
1748 		ctl_set_sense(ctsio, /*current_error*/ 1,
1749 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1750 		    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1751 		goto done;
1752 	}
1753 	if (lencscd + lenseg > TPC_MAX_LIST ||
1754 	    leninl > TPC_MAX_INLINE ||
1755 	    len < sizeof(struct scsi_extended_copy_lid1_data) +
1756 	     lencscd + lenseg + leninl) {
1757 		ctl_set_param_len_error(ctsio);
1758 		goto done;
1759 	}
1760 
1761 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1762 	list->service_action = cdb->service_action;
1763 	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1764 	if (value != NULL && strcmp(value, "on") == 0)
1765 		list->init_port = -1;
1766 	else
1767 		list->init_port = ctsio->io_hdr.nexus.targ_port;
1768 	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
1769 	list->list_id = data->list_identifier;
1770 	list->flags = data->flags;
1771 	list->params = ctsio->kern_data_ptr;
1772 	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1773 	ptr = &data->data[0];
1774 	for (off = 0; off < lencscd; off += sizeof(struct scsi_ec_cscd)) {
1775 		cscd = (struct scsi_ec_cscd *)(ptr + off);
1776 		if (cscd->type_code != EC_CSCD_ID) {
1777 			free(list, M_CTL);
1778 			ctl_set_sense(ctsio, /*current_error*/ 1,
1779 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1780 			    /*asc*/ 0x26, /*ascq*/ 0x07, SSD_ELEM_NONE);
1781 			goto done;
1782 		}
1783 	}
1784 	ptr = &data->data[lencscd];
1785 	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1786 		if (nseg >= TPC_MAX_SEGS) {
1787 			free(list, M_CTL);
1788 			ctl_set_sense(ctsio, /*current_error*/ 1,
1789 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1790 			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1791 			goto done;
1792 		}
1793 		seg = (struct scsi_ec_segment *)(ptr + off);
1794 		if (seg->type_code != EC_SEG_B2B &&
1795 		    seg->type_code != EC_SEG_VERIFY &&
1796 		    seg->type_code != EC_SEG_REGISTER_KEY) {
1797 			free(list, M_CTL);
1798 			ctl_set_sense(ctsio, /*current_error*/ 1,
1799 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1800 			    /*asc*/ 0x26, /*ascq*/ 0x09, SSD_ELEM_NONE);
1801 			goto done;
1802 		}
1803 		list->seg[nseg] = seg;
1804 		off += sizeof(struct scsi_ec_segment) +
1805 		    scsi_2btoul(seg->descr_length);
1806 	}
1807 	list->inl = &data->data[lencscd + lenseg];
1808 	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1809 	list->nseg = nseg;
1810 	list->leninl = leninl;
1811 	list->ctsio = ctsio;
1812 	list->lun = lun;
1813 	mtx_lock(&lun->lun_lock);
1814 	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1815 		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1816 		if (tlist != NULL && !tlist->completed) {
1817 			mtx_unlock(&lun->lun_lock);
1818 			free(list, M_CTL);
1819 			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1820 			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1821 			    /*bit*/ 0);
1822 			goto done;
1823 		}
1824 		if (tlist != NULL) {
1825 			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1826 			free(tlist, M_CTL);
1827 		}
1828 	}
1829 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1830 	mtx_unlock(&lun->lun_lock);
1831 
1832 	tpc_process(list);
1833 	return (CTL_RETVAL_COMPLETE);
1834 
1835 done:
1836 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
1837 		free(ctsio->kern_data_ptr, M_CTL);
1838 		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
1839 	}
1840 	ctl_done((union ctl_io *)ctsio);
1841 	return (CTL_RETVAL_COMPLETE);
1842 }
1843 
1844 int
1845 ctl_extended_copy_lid4(struct ctl_scsiio *ctsio)
1846 {
1847 	struct ctl_lun *lun = CTL_LUN(ctsio);
1848 	struct scsi_extended_copy *cdb;
1849 	struct scsi_extended_copy_lid4_data *data;
1850 	struct scsi_ec_cscd *cscd;
1851 	struct scsi_ec_segment *seg;
1852 	struct tpc_list *list, *tlist;
1853 	uint8_t *ptr;
1854 	char *value;
1855 	int len, off, lencscd, lenseg, leninl, nseg;
1856 
1857 	CTL_DEBUG_PRINT(("ctl_extended_copy_lid4\n"));
1858 
1859 	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1860 	len = scsi_4btoul(cdb->length);
1861 
1862 	if (len == 0) {
1863 		ctl_set_success(ctsio);
1864 		goto done;
1865 	}
1866 	if (len < sizeof(struct scsi_extended_copy_lid4_data) ||
1867 	    len > sizeof(struct scsi_extended_copy_lid4_data) +
1868 	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1869 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1870 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1871 		goto done;
1872 	}
1873 
1874 	/*
1875 	 * If we've got a kernel request that hasn't been malloced yet,
1876 	 * malloc it and tell the caller the data buffer is here.
1877 	 */
1878 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1879 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1880 		ctsio->kern_data_len = len;
1881 		ctsio->kern_total_len = len;
1882 		ctsio->kern_rel_offset = 0;
1883 		ctsio->kern_sg_entries = 0;
1884 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1885 		ctsio->be_move_done = ctl_config_move_done;
1886 		ctl_datamove((union ctl_io *)ctsio);
1887 
1888 		return (CTL_RETVAL_COMPLETE);
1889 	}
1890 
1891 	data = (struct scsi_extended_copy_lid4_data *)ctsio->kern_data_ptr;
1892 	lencscd = scsi_2btoul(data->cscd_list_length);
1893 	lenseg = scsi_2btoul(data->segment_list_length);
1894 	leninl = scsi_2btoul(data->inline_data_length);
1895 	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1896 		ctl_set_sense(ctsio, /*current_error*/ 1,
1897 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1898 		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1899 		goto done;
1900 	}
1901 	if (lenseg > TPC_MAX_SEGS * sizeof(struct scsi_ec_segment)) {
1902 		ctl_set_sense(ctsio, /*current_error*/ 1,
1903 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1904 		    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1905 		goto done;
1906 	}
1907 	if (lencscd + lenseg > TPC_MAX_LIST ||
1908 	    leninl > TPC_MAX_INLINE ||
1909 	    len < sizeof(struct scsi_extended_copy_lid1_data) +
1910 	     lencscd + lenseg + leninl) {
1911 		ctl_set_param_len_error(ctsio);
1912 		goto done;
1913 	}
1914 
1915 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1916 	list->service_action = cdb->service_action;
1917 	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1918 	if (value != NULL && strcmp(value, "on") == 0)
1919 		list->init_port = -1;
1920 	else
1921 		list->init_port = ctsio->io_hdr.nexus.targ_port;
1922 	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
1923 	list->list_id = scsi_4btoul(data->list_identifier);
1924 	list->flags = data->flags;
1925 	list->params = ctsio->kern_data_ptr;
1926 	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1927 	ptr = &data->data[0];
1928 	for (off = 0; off < lencscd; off += sizeof(struct scsi_ec_cscd)) {
1929 		cscd = (struct scsi_ec_cscd *)(ptr + off);
1930 		if (cscd->type_code != EC_CSCD_ID) {
1931 			free(list, M_CTL);
1932 			ctl_set_sense(ctsio, /*current_error*/ 1,
1933 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1934 			    /*asc*/ 0x26, /*ascq*/ 0x07, SSD_ELEM_NONE);
1935 			goto done;
1936 		}
1937 	}
1938 	ptr = &data->data[lencscd];
1939 	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1940 		if (nseg >= TPC_MAX_SEGS) {
1941 			free(list, M_CTL);
1942 			ctl_set_sense(ctsio, /*current_error*/ 1,
1943 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1944 			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1945 			goto done;
1946 		}
1947 		seg = (struct scsi_ec_segment *)(ptr + off);
1948 		if (seg->type_code != EC_SEG_B2B &&
1949 		    seg->type_code != EC_SEG_VERIFY &&
1950 		    seg->type_code != EC_SEG_REGISTER_KEY) {
1951 			free(list, M_CTL);
1952 			ctl_set_sense(ctsio, /*current_error*/ 1,
1953 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1954 			    /*asc*/ 0x26, /*ascq*/ 0x09, SSD_ELEM_NONE);
1955 			goto done;
1956 		}
1957 		list->seg[nseg] = seg;
1958 		off += sizeof(struct scsi_ec_segment) +
1959 		    scsi_2btoul(seg->descr_length);
1960 	}
1961 	list->inl = &data->data[lencscd + lenseg];
1962 	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1963 	list->nseg = nseg;
1964 	list->leninl = leninl;
1965 	list->ctsio = ctsio;
1966 	list->lun = lun;
1967 	mtx_lock(&lun->lun_lock);
1968 	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1969 		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1970 		if (tlist != NULL && !tlist->completed) {
1971 			mtx_unlock(&lun->lun_lock);
1972 			free(list, M_CTL);
1973 			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1974 			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1975 			    /*bit*/ 0);
1976 			goto done;
1977 		}
1978 		if (tlist != NULL) {
1979 			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1980 			free(tlist, M_CTL);
1981 		}
1982 	}
1983 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1984 	mtx_unlock(&lun->lun_lock);
1985 
1986 	tpc_process(list);
1987 	return (CTL_RETVAL_COMPLETE);
1988 
1989 done:
1990 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
1991 		free(ctsio->kern_data_ptr, M_CTL);
1992 		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
1993 	}
1994 	ctl_done((union ctl_io *)ctsio);
1995 	return (CTL_RETVAL_COMPLETE);
1996 }
1997 
1998 static void
1999 tpc_create_token(struct ctl_lun *lun, struct ctl_port *port, off_t len,
2000     struct scsi_token *token)
2001 {
2002 	static int id = 0;
2003 	struct scsi_vpd_id_descriptor *idd = NULL;
2004 	struct scsi_ec_cscd_id *cscd;
2005 	struct scsi_read_capacity_data_long *dtsd;
2006 	int targid_len;
2007 
2008 	scsi_ulto4b(ROD_TYPE_AUR, token->type);
2009 	scsi_ulto2b(0x01f8, token->length);
2010 	scsi_u64to8b(atomic_fetchadd_int(&id, 1), &token->body[0]);
2011 	if (lun->lun_devid)
2012 		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
2013 		    lun->lun_devid->data, lun->lun_devid->len,
2014 		    scsi_devid_is_lun_naa);
2015 	if (idd == NULL && lun->lun_devid)
2016 		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
2017 		    lun->lun_devid->data, lun->lun_devid->len,
2018 		    scsi_devid_is_lun_eui64);
2019 	if (idd != NULL) {
2020 		cscd = (struct scsi_ec_cscd_id *)&token->body[8];
2021 		cscd->type_code = EC_CSCD_ID;
2022 		cscd->luidt_pdt = T_DIRECT;
2023 		memcpy(&cscd->codeset, idd, 4 + idd->length);
2024 		scsi_ulto3b(lun->be_lun->blocksize, cscd->dtsp.block_length);
2025 	}
2026 	scsi_u64to8b(0, &token->body[40]); /* XXX: Should be 128bit value. */
2027 	scsi_u64to8b(len, &token->body[48]);
2028 
2029 	/* ROD token device type specific data (RC16 without first field) */
2030 	dtsd = (struct scsi_read_capacity_data_long *)&token->body[88 - 8];
2031 	scsi_ulto4b(lun->be_lun->blocksize, dtsd->length);
2032 	dtsd->prot_lbppbe = lun->be_lun->pblockexp & SRC16_LBPPBE;
2033 	scsi_ulto2b(lun->be_lun->pblockoff & SRC16_LALBA_A, dtsd->lalba_lbp);
2034 	if (lun->be_lun->flags & CTL_LUN_FLAG_UNMAP)
2035 		dtsd->lalba_lbp[0] |= SRC16_LBPME | SRC16_LBPRZ;
2036 
2037 	if (port->target_devid) {
2038 		targid_len = port->target_devid->len;
2039 		memcpy(&token->body[120], port->target_devid->data, targid_len);
2040 	} else
2041 		targid_len = 32;
2042 	arc4rand(&token->body[120 + targid_len], 384 - targid_len, 0);
2043 };
2044 
2045 int
2046 ctl_populate_token(struct ctl_scsiio *ctsio)
2047 {
2048 	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2049 	struct ctl_port *port = CTL_PORT(ctsio);
2050 	struct ctl_lun *lun = CTL_LUN(ctsio);
2051 	struct scsi_populate_token *cdb;
2052 	struct scsi_populate_token_data *data;
2053 	struct tpc_list *list, *tlist;
2054 	struct tpc_token *token;
2055 	uint64_t lba;
2056 	int len, lendata, lendesc;
2057 
2058 	CTL_DEBUG_PRINT(("ctl_populate_token\n"));
2059 
2060 	cdb = (struct scsi_populate_token *)ctsio->cdb;
2061 	len = scsi_4btoul(cdb->length);
2062 
2063 	if (len < sizeof(struct scsi_populate_token_data) ||
2064 	    len > sizeof(struct scsi_populate_token_data) +
2065 	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
2066 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
2067 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
2068 		goto done;
2069 	}
2070 
2071 	/*
2072 	 * If we've got a kernel request that hasn't been malloced yet,
2073 	 * malloc it and tell the caller the data buffer is here.
2074 	 */
2075 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2076 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2077 		ctsio->kern_data_len = len;
2078 		ctsio->kern_total_len = len;
2079 		ctsio->kern_rel_offset = 0;
2080 		ctsio->kern_sg_entries = 0;
2081 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2082 		ctsio->be_move_done = ctl_config_move_done;
2083 		ctl_datamove((union ctl_io *)ctsio);
2084 
2085 		return (CTL_RETVAL_COMPLETE);
2086 	}
2087 
2088 	data = (struct scsi_populate_token_data *)ctsio->kern_data_ptr;
2089 	lendata = scsi_2btoul(data->length);
2090 	if (lendata < sizeof(struct scsi_populate_token_data) - 2 +
2091 	    sizeof(struct scsi_range_desc)) {
2092 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2093 		    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
2094 		goto done;
2095 	}
2096 	lendesc = scsi_2btoul(data->range_descriptor_length);
2097 	if (lendesc < sizeof(struct scsi_range_desc) ||
2098 	    len < sizeof(struct scsi_populate_token_data) + lendesc ||
2099 	    lendata < sizeof(struct scsi_populate_token_data) - 2 + lendesc) {
2100 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2101 		    /*field*/ 14, /*bit_valid*/ 0, /*bit*/ 0);
2102 		goto done;
2103 	}
2104 /*
2105 	printf("PT(list=%u) flags=%x to=%d rt=%x len=%x\n",
2106 	    scsi_4btoul(cdb->list_identifier),
2107 	    data->flags, scsi_4btoul(data->inactivity_timeout),
2108 	    scsi_4btoul(data->rod_type),
2109 	    scsi_2btoul(data->range_descriptor_length));
2110 */
2111 
2112 	/* Validate INACTIVITY TIMEOUT field */
2113 	if (scsi_4btoul(data->inactivity_timeout) > TPC_MAX_TOKEN_TIMEOUT) {
2114 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2115 		    /*command*/ 0, /*field*/ 4, /*bit_valid*/ 0,
2116 		    /*bit*/ 0);
2117 		goto done;
2118 	}
2119 
2120 	/* Validate ROD TYPE field */
2121 	if ((data->flags & EC_PT_RTV) &&
2122 	    scsi_4btoul(data->rod_type) != ROD_TYPE_AUR) {
2123 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2124 		    /*field*/ 8, /*bit_valid*/ 0, /*bit*/ 0);
2125 		goto done;
2126 	}
2127 
2128 	/* Validate list of ranges */
2129 	if (tpc_check_ranges_l(&data->desc[0],
2130 	    scsi_2btoul(data->range_descriptor_length) /
2131 	    sizeof(struct scsi_range_desc),
2132 	    lun->be_lun->maxlba, &lba) != 0) {
2133 		ctl_set_lba_out_of_range(ctsio, lba);
2134 		goto done;
2135 	}
2136 	if (tpc_check_ranges_x(&data->desc[0],
2137 	    scsi_2btoul(data->range_descriptor_length) /
2138 	    sizeof(struct scsi_range_desc)) != 0) {
2139 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
2140 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2141 		    /*bit*/ 0);
2142 		goto done;
2143 	}
2144 
2145 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2146 	list->service_action = cdb->service_action;
2147 	list->init_port = ctsio->io_hdr.nexus.targ_port;
2148 	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
2149 	list->list_id = scsi_4btoul(cdb->list_identifier);
2150 	list->flags = data->flags;
2151 	list->ctsio = ctsio;
2152 	list->lun = lun;
2153 	mtx_lock(&lun->lun_lock);
2154 	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2155 	if (tlist != NULL && !tlist->completed) {
2156 		mtx_unlock(&lun->lun_lock);
2157 		free(list, M_CTL);
2158 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2159 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2160 		    /*bit*/ 0);
2161 		goto done;
2162 	}
2163 	if (tlist != NULL) {
2164 		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2165 		free(tlist, M_CTL);
2166 	}
2167 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2168 	mtx_unlock(&lun->lun_lock);
2169 
2170 	token = malloc(sizeof(*token), M_CTL, M_WAITOK | M_ZERO);
2171 	token->lun = lun->lun;
2172 	token->blocksize = lun->be_lun->blocksize;
2173 	token->params = ctsio->kern_data_ptr;
2174 	token->range = &data->desc[0];
2175 	token->nrange = scsi_2btoul(data->range_descriptor_length) /
2176 	    sizeof(struct scsi_range_desc);
2177 	list->cursectors = tpc_ranges_length(token->range, token->nrange);
2178 	list->curbytes = (off_t)list->cursectors * lun->be_lun->blocksize;
2179 	tpc_create_token(lun, port, list->curbytes,
2180 	    (struct scsi_token *)token->token);
2181 	token->active = 0;
2182 	token->last_active = time_uptime;
2183 	token->timeout = scsi_4btoul(data->inactivity_timeout);
2184 	if (token->timeout == 0)
2185 		token->timeout = TPC_DFL_TOKEN_TIMEOUT;
2186 	else if (token->timeout < TPC_MIN_TOKEN_TIMEOUT)
2187 		token->timeout = TPC_MIN_TOKEN_TIMEOUT;
2188 	memcpy(list->res_token, token->token, sizeof(list->res_token));
2189 	list->res_token_valid = 1;
2190 	list->curseg = 0;
2191 	list->completed = 1;
2192 	list->last_active = time_uptime;
2193 	mtx_lock(&softc->tpc_lock);
2194 	TAILQ_INSERT_TAIL(&softc->tpc_tokens, token, links);
2195 	mtx_unlock(&softc->tpc_lock);
2196 	ctl_set_success(ctsio);
2197 	ctl_done((union ctl_io *)ctsio);
2198 	return (CTL_RETVAL_COMPLETE);
2199 
2200 done:
2201 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
2202 		free(ctsio->kern_data_ptr, M_CTL);
2203 		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2204 	}
2205 	ctl_done((union ctl_io *)ctsio);
2206 	return (CTL_RETVAL_COMPLETE);
2207 }
2208 
2209 int
2210 ctl_write_using_token(struct ctl_scsiio *ctsio)
2211 {
2212 	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2213 	struct ctl_lun *lun = CTL_LUN(ctsio);
2214 	struct scsi_write_using_token *cdb;
2215 	struct scsi_write_using_token_data *data;
2216 	struct tpc_list *list, *tlist;
2217 	struct tpc_token *token;
2218 	uint64_t lba;
2219 	int len, lendata, lendesc;
2220 
2221 	CTL_DEBUG_PRINT(("ctl_write_using_token\n"));
2222 
2223 	cdb = (struct scsi_write_using_token *)ctsio->cdb;
2224 	len = scsi_4btoul(cdb->length);
2225 
2226 	if (len < sizeof(struct scsi_write_using_token_data) ||
2227 	    len > sizeof(struct scsi_write_using_token_data) +
2228 	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
2229 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
2230 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
2231 		goto done;
2232 	}
2233 
2234 	/*
2235 	 * If we've got a kernel request that hasn't been malloced yet,
2236 	 * malloc it and tell the caller the data buffer is here.
2237 	 */
2238 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2239 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2240 		ctsio->kern_data_len = len;
2241 		ctsio->kern_total_len = len;
2242 		ctsio->kern_rel_offset = 0;
2243 		ctsio->kern_sg_entries = 0;
2244 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2245 		ctsio->be_move_done = ctl_config_move_done;
2246 		ctl_datamove((union ctl_io *)ctsio);
2247 
2248 		return (CTL_RETVAL_COMPLETE);
2249 	}
2250 
2251 	data = (struct scsi_write_using_token_data *)ctsio->kern_data_ptr;
2252 	lendata = scsi_2btoul(data->length);
2253 	if (lendata < sizeof(struct scsi_write_using_token_data) - 2 +
2254 	    sizeof(struct scsi_range_desc)) {
2255 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2256 		    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
2257 		goto done;
2258 	}
2259 	lendesc = scsi_2btoul(data->range_descriptor_length);
2260 	if (lendesc < sizeof(struct scsi_range_desc) ||
2261 	    len < sizeof(struct scsi_write_using_token_data) + lendesc ||
2262 	    lendata < sizeof(struct scsi_write_using_token_data) - 2 + lendesc) {
2263 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2264 		    /*field*/ 534, /*bit_valid*/ 0, /*bit*/ 0);
2265 		goto done;
2266 	}
2267 /*
2268 	printf("WUT(list=%u) flags=%x off=%ju len=%x\n",
2269 	    scsi_4btoul(cdb->list_identifier),
2270 	    data->flags, scsi_8btou64(data->offset_into_rod),
2271 	    scsi_2btoul(data->range_descriptor_length));
2272 */
2273 
2274 	/* Validate list of ranges */
2275 	if (tpc_check_ranges_l(&data->desc[0],
2276 	    scsi_2btoul(data->range_descriptor_length) /
2277 	    sizeof(struct scsi_range_desc),
2278 	    lun->be_lun->maxlba, &lba) != 0) {
2279 		ctl_set_lba_out_of_range(ctsio, lba);
2280 		goto done;
2281 	}
2282 	if (tpc_check_ranges_x(&data->desc[0],
2283 	    scsi_2btoul(data->range_descriptor_length) /
2284 	    sizeof(struct scsi_range_desc)) != 0) {
2285 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
2286 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2287 		    /*bit*/ 0);
2288 		goto done;
2289 	}
2290 
2291 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2292 	list->service_action = cdb->service_action;
2293 	list->init_port = ctsio->io_hdr.nexus.targ_port;
2294 	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
2295 	list->list_id = scsi_4btoul(cdb->list_identifier);
2296 	list->flags = data->flags;
2297 	list->params = ctsio->kern_data_ptr;
2298 	list->range = &data->desc[0];
2299 	list->nrange = scsi_2btoul(data->range_descriptor_length) /
2300 	    sizeof(struct scsi_range_desc);
2301 	list->offset_into_rod = scsi_8btou64(data->offset_into_rod);
2302 	list->ctsio = ctsio;
2303 	list->lun = lun;
2304 	mtx_lock(&lun->lun_lock);
2305 	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2306 	if (tlist != NULL && !tlist->completed) {
2307 		mtx_unlock(&lun->lun_lock);
2308 		free(list, M_CTL);
2309 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2310 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2311 		    /*bit*/ 0);
2312 		goto done;
2313 	}
2314 	if (tlist != NULL) {
2315 		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2316 		free(tlist, M_CTL);
2317 	}
2318 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2319 	mtx_unlock(&lun->lun_lock);
2320 
2321 	/* Block device zero ROD token -> no token. */
2322 	if (scsi_4btoul(data->rod_token) == ROD_TYPE_BLOCK_ZERO) {
2323 		tpc_process(list);
2324 		return (CTL_RETVAL_COMPLETE);
2325 	}
2326 
2327 	mtx_lock(&softc->tpc_lock);
2328 	TAILQ_FOREACH(token, &softc->tpc_tokens, links) {
2329 		if (memcmp(token->token, data->rod_token,
2330 		    sizeof(data->rod_token)) == 0)
2331 			break;
2332 	}
2333 	if (token != NULL) {
2334 		token->active++;
2335 		list->token = token;
2336 		if (data->flags & EC_WUT_DEL_TKN)
2337 			token->timeout = 0;
2338 	}
2339 	mtx_unlock(&softc->tpc_lock);
2340 	if (token == NULL) {
2341 		mtx_lock(&lun->lun_lock);
2342 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2343 		mtx_unlock(&lun->lun_lock);
2344 		free(list, M_CTL);
2345 		ctl_set_sense(ctsio, /*current_error*/ 1,
2346 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2347 		    /*asc*/ 0x23, /*ascq*/ 0x04, SSD_ELEM_NONE);
2348 		goto done;
2349 	}
2350 
2351 	tpc_process(list);
2352 	return (CTL_RETVAL_COMPLETE);
2353 
2354 done:
2355 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
2356 		free(ctsio->kern_data_ptr, M_CTL);
2357 		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2358 	}
2359 	ctl_done((union ctl_io *)ctsio);
2360 	return (CTL_RETVAL_COMPLETE);
2361 }
2362 
2363 int
2364 ctl_receive_rod_token_information(struct ctl_scsiio *ctsio)
2365 {
2366 	struct ctl_lun *lun = CTL_LUN(ctsio);
2367 	struct scsi_receive_rod_token_information *cdb;
2368 	struct scsi_receive_copy_status_lid4_data *data;
2369 	struct tpc_list *list;
2370 	struct tpc_list list_copy;
2371 	uint8_t *ptr;
2372 	int retval;
2373 	int alloc_len, total_len, token_len;
2374 	uint32_t list_id;
2375 
2376 	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2377 
2378 	cdb = (struct scsi_receive_rod_token_information *)ctsio->cdb;
2379 	retval = CTL_RETVAL_COMPLETE;
2380 
2381 	list_id = scsi_4btoul(cdb->list_identifier);
2382 	mtx_lock(&lun->lun_lock);
2383 	list = tpc_find_list(lun, list_id,
2384 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
2385 	if (list == NULL) {
2386 		mtx_unlock(&lun->lun_lock);
2387 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2388 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
2389 		    /*bit*/ 0);
2390 		ctl_done((union ctl_io *)ctsio);
2391 		return (retval);
2392 	}
2393 	list_copy = *list;
2394 	if (list->completed) {
2395 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2396 		free(list, M_CTL);
2397 	}
2398 	mtx_unlock(&lun->lun_lock);
2399 
2400 	token_len = list_copy.res_token_valid ? 2 + sizeof(list_copy.res_token) : 0;
2401 	total_len = sizeof(*data) + list_copy.sense_len + 4 + token_len;
2402 	alloc_len = scsi_4btoul(cdb->length);
2403 
2404 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2405 
2406 	ctsio->kern_sg_entries = 0;
2407 
2408 	if (total_len < alloc_len) {
2409 		ctsio->residual = alloc_len - total_len;
2410 		ctsio->kern_data_len = total_len;
2411 		ctsio->kern_total_len = total_len;
2412 	} else {
2413 		ctsio->residual = 0;
2414 		ctsio->kern_data_len = alloc_len;
2415 		ctsio->kern_total_len = alloc_len;
2416 	}
2417 	ctsio->kern_rel_offset = 0;
2418 
2419 	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
2420 	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len +
2421 	    4 + token_len, data->available_data);
2422 	data->response_to_service_action = list_copy.service_action;
2423 	if (list_copy.completed) {
2424 		if (list_copy.error)
2425 			data->copy_command_status = RCS_CCS_ERROR;
2426 		else if (list_copy.abort)
2427 			data->copy_command_status = RCS_CCS_ABORTED;
2428 		else
2429 			data->copy_command_status = RCS_CCS_COMPLETED;
2430 	} else
2431 		data->copy_command_status = RCS_CCS_INPROG_FG;
2432 	scsi_ulto2b(list_copy.curops, data->operation_counter);
2433 	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
2434 	data->transfer_count_units = RCS_TC_LBAS;
2435 	scsi_u64to8b(list_copy.cursectors, data->transfer_count);
2436 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
2437 	data->length_of_the_sense_data_field = list_copy.sense_len;
2438 	data->sense_data_length = list_copy.sense_len;
2439 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
2440 
2441 	ptr = &data->sense_data[data->length_of_the_sense_data_field];
2442 	scsi_ulto4b(token_len, &ptr[0]);
2443 	if (list_copy.res_token_valid) {
2444 		scsi_ulto2b(0, &ptr[4]);
2445 		memcpy(&ptr[6], list_copy.res_token, sizeof(list_copy.res_token));
2446 	}
2447 /*
2448 	printf("RRTI(list=%u) valid=%d\n",
2449 	    scsi_4btoul(cdb->list_identifier), list_copy.res_token_valid);
2450 */
2451 	ctl_set_success(ctsio);
2452 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2453 	ctsio->be_move_done = ctl_config_move_done;
2454 	ctl_datamove((union ctl_io *)ctsio);
2455 	return (retval);
2456 }
2457 
2458 int
2459 ctl_report_all_rod_tokens(struct ctl_scsiio *ctsio)
2460 {
2461 	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2462 	struct scsi_report_all_rod_tokens *cdb;
2463 	struct scsi_report_all_rod_tokens_data *data;
2464 	struct tpc_token *token;
2465 	int retval;
2466 	int alloc_len, total_len, tokens, i;
2467 
2468 	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2469 
2470 	cdb = (struct scsi_report_all_rod_tokens *)ctsio->cdb;
2471 	retval = CTL_RETVAL_COMPLETE;
2472 
2473 	tokens = 0;
2474 	mtx_lock(&softc->tpc_lock);
2475 	TAILQ_FOREACH(token, &softc->tpc_tokens, links)
2476 		tokens++;
2477 	mtx_unlock(&softc->tpc_lock);
2478 	if (tokens > 512)
2479 		tokens = 512;
2480 
2481 	total_len = sizeof(*data) + tokens * 96;
2482 	alloc_len = scsi_4btoul(cdb->length);
2483 
2484 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2485 
2486 	ctsio->kern_sg_entries = 0;
2487 
2488 	if (total_len < alloc_len) {
2489 		ctsio->residual = alloc_len - total_len;
2490 		ctsio->kern_data_len = total_len;
2491 		ctsio->kern_total_len = total_len;
2492 	} else {
2493 		ctsio->residual = 0;
2494 		ctsio->kern_data_len = alloc_len;
2495 		ctsio->kern_total_len = alloc_len;
2496 	}
2497 	ctsio->kern_rel_offset = 0;
2498 
2499 	data = (struct scsi_report_all_rod_tokens_data *)ctsio->kern_data_ptr;
2500 	i = 0;
2501 	mtx_lock(&softc->tpc_lock);
2502 	TAILQ_FOREACH(token, &softc->tpc_tokens, links) {
2503 		if (i >= tokens)
2504 			break;
2505 		memcpy(&data->rod_management_token_list[i * 96],
2506 		    token->token, 96);
2507 		i++;
2508 	}
2509 	mtx_unlock(&softc->tpc_lock);
2510 	scsi_ulto4b(sizeof(*data) - 4 + i * 96, data->available_data);
2511 /*
2512 	printf("RART tokens=%d\n", i);
2513 */
2514 	ctl_set_success(ctsio);
2515 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2516 	ctsio->be_move_done = ctl_config_move_done;
2517 	ctl_datamove((union ctl_io *)ctsio);
2518 	return (retval);
2519 }
2520 
2521