xref: /freebsd/sys/cam/ctl/ctl_tpc.c (revision 3823d5e198425b4f5e5a80267d195769d1063773)
1 /*-
2  * Copyright (c) 2014 Alexander Motin <mav@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification, immediately at the beginning of the file.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/types.h>
34 #include <sys/lock.h>
35 #include <sys/module.h>
36 #include <sys/mutex.h>
37 #include <sys/condvar.h>
38 #include <sys/malloc.h>
39 #include <sys/conf.h>
40 #include <sys/queue.h>
41 #include <sys/sysctl.h>
42 #include <machine/atomic.h>
43 
44 #include <cam/cam.h>
45 #include <cam/scsi/scsi_all.h>
46 #include <cam/scsi/scsi_da.h>
47 #include <cam/ctl/ctl_io.h>
48 #include <cam/ctl/ctl.h>
49 #include <cam/ctl/ctl_frontend.h>
50 #include <cam/ctl/ctl_frontend_internal.h>
51 #include <cam/ctl/ctl_util.h>
52 #include <cam/ctl/ctl_backend.h>
53 #include <cam/ctl/ctl_ioctl.h>
54 #include <cam/ctl/ctl_ha.h>
55 #include <cam/ctl/ctl_private.h>
56 #include <cam/ctl/ctl_debug.h>
57 #include <cam/ctl/ctl_scsi_all.h>
58 #include <cam/ctl/ctl_tpc.h>
59 #include <cam/ctl/ctl_error.h>
60 
61 #define	TPC_MAX_CSCDS	64
62 #define	TPC_MAX_SEGS	64
63 #define	TPC_MAX_SEG	0
64 #define	TPC_MAX_LIST	8192
65 #define	TPC_MAX_INLINE	0
66 #define	TPC_MAX_LISTS	255
67 #define	TPC_MAX_IO_SIZE	(1024 * 1024)
68 #define	TPC_MAX_IOCHUNK_SIZE	(TPC_MAX_IO_SIZE * 16)
69 #define	TPC_MIN_TOKEN_TIMEOUT	1
70 #define	TPC_DFL_TOKEN_TIMEOUT	60
71 #define	TPC_MAX_TOKEN_TIMEOUT	600
72 
73 MALLOC_DEFINE(M_CTL_TPC, "ctltpc", "CTL TPC");
74 
75 typedef enum {
76 	TPC_ERR_RETRY		= 0x000,
77 	TPC_ERR_FAIL		= 0x001,
78 	TPC_ERR_MASK		= 0x0ff,
79 	TPC_ERR_NO_DECREMENT	= 0x100
80 } tpc_error_action;
81 
82 struct tpc_list;
83 TAILQ_HEAD(runl, tpc_io);
84 struct tpc_io {
85 	union ctl_io		*io;
86 	uint64_t		 lun;
87 	struct tpc_list		*list;
88 	struct runl		 run;
89 	TAILQ_ENTRY(tpc_io)	 rlinks;
90 	TAILQ_ENTRY(tpc_io)	 links;
91 };
92 
93 struct tpc_token {
94 	uint8_t			 token[512];
95 	uint64_t		 lun;
96 	uint32_t		 blocksize;
97 	uint8_t			*params;
98 	struct scsi_range_desc	*range;
99 	int			 nrange;
100 	int			 active;
101 	time_t			 last_active;
102 	uint32_t		 timeout;
103 	TAILQ_ENTRY(tpc_token)	 links;
104 };
105 
106 struct tpc_list {
107 	uint8_t			 service_action;
108 	int			 init_port;
109 	uint32_t		 init_idx;
110 	uint32_t		 list_id;
111 	uint8_t			 flags;
112 	uint8_t			*params;
113 	struct scsi_ec_cscd	*cscd;
114 	struct scsi_ec_segment	*seg[TPC_MAX_SEGS];
115 	uint8_t			*inl;
116 	int			 ncscd;
117 	int			 nseg;
118 	int			 leninl;
119 	struct tpc_token	*token;
120 	struct scsi_range_desc	*range;
121 	int			 nrange;
122 	off_t			 offset_into_rod;
123 
124 	int			 curseg;
125 	off_t			 cursectors;
126 	off_t			 curbytes;
127 	int			 curops;
128 	int			 stage;
129 	uint8_t			*buf;
130 	off_t			 segsectors;
131 	off_t			 segbytes;
132 	int			 tbdio;
133 	int			 error;
134 	int			 abort;
135 	int			 completed;
136 	time_t			 last_active;
137 	TAILQ_HEAD(, tpc_io)	 allio;
138 	struct scsi_sense_data	 sense_data;
139 	uint8_t			 sense_len;
140 	uint8_t			 scsi_status;
141 	struct ctl_scsiio	*ctsio;
142 	struct ctl_lun		*lun;
143 	int			 res_token_valid;
144 	uint8_t			 res_token[512];
145 	TAILQ_ENTRY(tpc_list)	 links;
146 };
147 
148 extern struct ctl_softc *control_softc;
149 
150 static void
151 tpc_timeout(void *arg)
152 {
153 	struct ctl_softc *softc = arg;
154 	struct ctl_lun *lun;
155 	struct tpc_token *token, *ttoken;
156 	struct tpc_list *list, *tlist;
157 
158 	/* Free completed lists with expired timeout. */
159 	STAILQ_FOREACH(lun, &softc->lun_list, links) {
160 		mtx_lock(&lun->lun_lock);
161 		TAILQ_FOREACH_SAFE(list, &lun->tpc_lists, links, tlist) {
162 			if (!list->completed || time_uptime < list->last_active +
163 			    TPC_DFL_TOKEN_TIMEOUT)
164 				continue;
165 			TAILQ_REMOVE(&lun->tpc_lists, list, links);
166 			free(list, M_CTL);
167 		}
168 		mtx_unlock(&lun->lun_lock);
169 	}
170 
171 	/* Free inactive ROD tokens with expired timeout. */
172 	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
173 		if (token->active ||
174 		    time_uptime < token->last_active + token->timeout + 1)
175 			continue;
176 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
177 		free(token->params, M_CTL);
178 		free(token, M_CTL);
179 	}
180 	callout_schedule(&softc->tpc_timeout, hz);
181 }
182 
183 void
184 ctl_tpc_init(struct ctl_softc *softc)
185 {
186 
187 	TAILQ_INIT(&softc->tpc_tokens);
188 	callout_init_mtx(&softc->tpc_timeout, &softc->ctl_lock, 0);
189 	callout_reset(&softc->tpc_timeout, hz, tpc_timeout, softc);
190 }
191 
192 void
193 ctl_tpc_shutdown(struct ctl_softc *softc)
194 {
195 	struct tpc_token *token;
196 
197 	callout_drain(&softc->tpc_timeout);
198 
199 	/* Free ROD tokens. */
200 	mtx_lock(&softc->ctl_lock);
201 	while ((token = TAILQ_FIRST(&softc->tpc_tokens)) != NULL) {
202 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
203 		free(token->params, M_CTL);
204 		free(token, M_CTL);
205 	}
206 	mtx_unlock(&softc->ctl_lock);
207 }
208 
209 void
210 ctl_tpc_lun_init(struct ctl_lun *lun)
211 {
212 
213 	TAILQ_INIT(&lun->tpc_lists);
214 }
215 
216 void
217 ctl_tpc_lun_shutdown(struct ctl_lun *lun)
218 {
219 	struct tpc_list *list;
220 	struct tpc_token *token, *ttoken;
221 
222 	/* Free lists for this LUN. */
223 	while ((list = TAILQ_FIRST(&lun->tpc_lists)) != NULL) {
224 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
225 		KASSERT(list->completed,
226 		    ("Not completed TPC (%p) on shutdown", list));
227 		free(list, M_CTL);
228 	}
229 
230 	/* Free ROD tokens for this LUN. */
231 	mtx_assert(&control_softc->ctl_lock, MA_OWNED);
232 	TAILQ_FOREACH_SAFE(token, &control_softc->tpc_tokens, links, ttoken) {
233 		if (token->lun != lun->lun || token->active)
234 			continue;
235 		TAILQ_REMOVE(&control_softc->tpc_tokens, token, links);
236 		free(token->params, M_CTL);
237 		free(token, M_CTL);
238 	}
239 }
240 
241 int
242 ctl_inquiry_evpd_tpc(struct ctl_scsiio *ctsio, int alloc_len)
243 {
244 	struct scsi_vpd_tpc *tpc_ptr;
245 	struct scsi_vpd_tpc_descriptor *d_ptr;
246 	struct scsi_vpd_tpc_descriptor_bdrl *bdrl_ptr;
247 	struct scsi_vpd_tpc_descriptor_sc *sc_ptr;
248 	struct scsi_vpd_tpc_descriptor_sc_descr *scd_ptr;
249 	struct scsi_vpd_tpc_descriptor_pd *pd_ptr;
250 	struct scsi_vpd_tpc_descriptor_sd *sd_ptr;
251 	struct scsi_vpd_tpc_descriptor_sdid *sdid_ptr;
252 	struct scsi_vpd_tpc_descriptor_rtf *rtf_ptr;
253 	struct scsi_vpd_tpc_descriptor_rtf_block *rtfb_ptr;
254 	struct scsi_vpd_tpc_descriptor_srt *srt_ptr;
255 	struct scsi_vpd_tpc_descriptor_srtd *srtd_ptr;
256 	struct scsi_vpd_tpc_descriptor_gco *gco_ptr;
257 	struct ctl_lun *lun;
258 	int data_len;
259 
260 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
261 
262 	data_len = sizeof(struct scsi_vpd_tpc) +
263 	    sizeof(struct scsi_vpd_tpc_descriptor_bdrl) +
264 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sc) +
265 	     2 * sizeof(struct scsi_vpd_tpc_descriptor_sc_descr) + 11, 4) +
266 	    sizeof(struct scsi_vpd_tpc_descriptor_pd) +
267 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sd) + 4, 4) +
268 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sdid) + 2, 4) +
269 	    sizeof(struct scsi_vpd_tpc_descriptor_rtf) +
270 	     sizeof(struct scsi_vpd_tpc_descriptor_rtf_block) +
271 	    sizeof(struct scsi_vpd_tpc_descriptor_srt) +
272 	     2*sizeof(struct scsi_vpd_tpc_descriptor_srtd) +
273 	    sizeof(struct scsi_vpd_tpc_descriptor_gco);
274 
275 	ctsio->kern_data_ptr = malloc(data_len, M_CTL, M_WAITOK | M_ZERO);
276 	tpc_ptr = (struct scsi_vpd_tpc *)ctsio->kern_data_ptr;
277 	ctsio->kern_sg_entries = 0;
278 
279 	if (data_len < alloc_len) {
280 		ctsio->residual = alloc_len - data_len;
281 		ctsio->kern_data_len = data_len;
282 		ctsio->kern_total_len = data_len;
283 	} else {
284 		ctsio->residual = 0;
285 		ctsio->kern_data_len = alloc_len;
286 		ctsio->kern_total_len = alloc_len;
287 	}
288 	ctsio->kern_data_resid = 0;
289 	ctsio->kern_rel_offset = 0;
290 	ctsio->kern_sg_entries = 0;
291 
292 	/*
293 	 * The control device is always connected.  The disk device, on the
294 	 * other hand, may not be online all the time.
295 	 */
296 	if (lun != NULL)
297 		tpc_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
298 				     lun->be_lun->lun_type;
299 	else
300 		tpc_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
301 	tpc_ptr->page_code = SVPD_SCSI_TPC;
302 	scsi_ulto2b(data_len - 4, tpc_ptr->page_length);
303 
304 	/* Block Device ROD Limits */
305 	d_ptr = (struct scsi_vpd_tpc_descriptor *)&tpc_ptr->descr[0];
306 	bdrl_ptr = (struct scsi_vpd_tpc_descriptor_bdrl *)d_ptr;
307 	scsi_ulto2b(SVPD_TPC_BDRL, bdrl_ptr->desc_type);
308 	scsi_ulto2b(sizeof(*bdrl_ptr) - 4, bdrl_ptr->desc_length);
309 	scsi_ulto2b(TPC_MAX_SEGS, bdrl_ptr->maximum_ranges);
310 	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
311 	    bdrl_ptr->maximum_inactivity_timeout);
312 	scsi_ulto4b(TPC_DFL_TOKEN_TIMEOUT,
313 	    bdrl_ptr->default_inactivity_timeout);
314 	scsi_u64to8b(0, bdrl_ptr->maximum_token_transfer_size);
315 	scsi_u64to8b(0, bdrl_ptr->optimal_transfer_count);
316 
317 	/* Supported commands */
318 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
319 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
320 	sc_ptr = (struct scsi_vpd_tpc_descriptor_sc *)d_ptr;
321 	scsi_ulto2b(SVPD_TPC_SC, sc_ptr->desc_type);
322 	sc_ptr->list_length = 2 * sizeof(*scd_ptr) + 11;
323 	scsi_ulto2b(roundup2(1 + sc_ptr->list_length, 4), sc_ptr->desc_length);
324 	scd_ptr = &sc_ptr->descr[0];
325 	scd_ptr->opcode = EXTENDED_COPY;
326 	scd_ptr->sa_length = 5;
327 	scd_ptr->supported_service_actions[0] = EC_EC_LID1;
328 	scd_ptr->supported_service_actions[1] = EC_EC_LID4;
329 	scd_ptr->supported_service_actions[2] = EC_PT;
330 	scd_ptr->supported_service_actions[3] = EC_WUT;
331 	scd_ptr->supported_service_actions[4] = EC_COA;
332 	scd_ptr = (struct scsi_vpd_tpc_descriptor_sc_descr *)
333 	    &scd_ptr->supported_service_actions[scd_ptr->sa_length];
334 	scd_ptr->opcode = RECEIVE_COPY_STATUS;
335 	scd_ptr->sa_length = 6;
336 	scd_ptr->supported_service_actions[0] = RCS_RCS_LID1;
337 	scd_ptr->supported_service_actions[1] = RCS_RCFD;
338 	scd_ptr->supported_service_actions[2] = RCS_RCS_LID4;
339 	scd_ptr->supported_service_actions[3] = RCS_RCOP;
340 	scd_ptr->supported_service_actions[4] = RCS_RRTI;
341 	scd_ptr->supported_service_actions[5] = RCS_RART;
342 
343 	/* Parameter data. */
344 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
345 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
346 	pd_ptr = (struct scsi_vpd_tpc_descriptor_pd *)d_ptr;
347 	scsi_ulto2b(SVPD_TPC_PD, pd_ptr->desc_type);
348 	scsi_ulto2b(sizeof(*pd_ptr) - 4, pd_ptr->desc_length);
349 	scsi_ulto2b(TPC_MAX_CSCDS, pd_ptr->maximum_cscd_descriptor_count);
350 	scsi_ulto2b(TPC_MAX_SEGS, pd_ptr->maximum_segment_descriptor_count);
351 	scsi_ulto4b(TPC_MAX_LIST, pd_ptr->maximum_descriptor_list_length);
352 	scsi_ulto4b(TPC_MAX_INLINE, pd_ptr->maximum_inline_data_length);
353 
354 	/* Supported Descriptors */
355 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
356 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
357 	sd_ptr = (struct scsi_vpd_tpc_descriptor_sd *)d_ptr;
358 	scsi_ulto2b(SVPD_TPC_SD, sd_ptr->desc_type);
359 	scsi_ulto2b(roundup2(sizeof(*sd_ptr) - 4 + 4, 4), sd_ptr->desc_length);
360 	sd_ptr->list_length = 4;
361 	sd_ptr->supported_descriptor_codes[0] = EC_SEG_B2B;
362 	sd_ptr->supported_descriptor_codes[1] = EC_SEG_VERIFY;
363 	sd_ptr->supported_descriptor_codes[2] = EC_SEG_REGISTER_KEY;
364 	sd_ptr->supported_descriptor_codes[3] = EC_CSCD_ID;
365 
366 	/* Supported CSCD Descriptor IDs */
367 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
368 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
369 	sdid_ptr = (struct scsi_vpd_tpc_descriptor_sdid *)d_ptr;
370 	scsi_ulto2b(SVPD_TPC_SDID, sdid_ptr->desc_type);
371 	scsi_ulto2b(roundup2(sizeof(*sdid_ptr) - 4 + 2, 4), sdid_ptr->desc_length);
372 	scsi_ulto2b(2, sdid_ptr->list_length);
373 	scsi_ulto2b(0xffff, &sdid_ptr->supported_descriptor_ids[0]);
374 
375 	/* ROD Token Features */
376 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
377 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
378 	rtf_ptr = (struct scsi_vpd_tpc_descriptor_rtf *)d_ptr;
379 	scsi_ulto2b(SVPD_TPC_RTF, rtf_ptr->desc_type);
380 	scsi_ulto2b(sizeof(*rtf_ptr) - 4 + sizeof(*rtfb_ptr), rtf_ptr->desc_length);
381 	rtf_ptr->remote_tokens = 0;
382 	scsi_ulto4b(TPC_MIN_TOKEN_TIMEOUT, rtf_ptr->minimum_token_lifetime);
383 	scsi_ulto4b(UINT32_MAX, rtf_ptr->maximum_token_lifetime);
384 	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
385 	    rtf_ptr->maximum_token_inactivity_timeout);
386 	scsi_ulto2b(sizeof(*rtfb_ptr), rtf_ptr->type_specific_features_length);
387 	rtfb_ptr = (struct scsi_vpd_tpc_descriptor_rtf_block *)
388 	    &rtf_ptr->type_specific_features;
389 	rtfb_ptr->type_format = SVPD_TPC_RTF_BLOCK;
390 	scsi_ulto2b(sizeof(*rtfb_ptr) - 4, rtfb_ptr->desc_length);
391 	scsi_ulto2b(0, rtfb_ptr->optimal_length_granularity);
392 	scsi_u64to8b(0, rtfb_ptr->maximum_bytes);
393 	scsi_u64to8b(0, rtfb_ptr->optimal_bytes);
394 	scsi_u64to8b(TPC_MAX_IOCHUNK_SIZE,
395 	    rtfb_ptr->optimal_bytes_to_token_per_segment);
396 	scsi_u64to8b(TPC_MAX_IOCHUNK_SIZE,
397 	    rtfb_ptr->optimal_bytes_from_token_per_segment);
398 
399 	/* Supported ROD Tokens */
400 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
401 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
402 	srt_ptr = (struct scsi_vpd_tpc_descriptor_srt *)d_ptr;
403 	scsi_ulto2b(SVPD_TPC_SRT, srt_ptr->desc_type);
404 	scsi_ulto2b(sizeof(*srt_ptr) - 4 + 2*sizeof(*srtd_ptr), srt_ptr->desc_length);
405 	scsi_ulto2b(2*sizeof(*srtd_ptr), srt_ptr->rod_type_descriptors_length);
406 	srtd_ptr = (struct scsi_vpd_tpc_descriptor_srtd *)
407 	    &srt_ptr->rod_type_descriptors;
408 	scsi_ulto4b(ROD_TYPE_AUR, srtd_ptr->rod_type);
409 	srtd_ptr->flags = SVPD_TPC_SRTD_TIN | SVPD_TPC_SRTD_TOUT;
410 	scsi_ulto2b(0, srtd_ptr->preference_indicator);
411 	srtd_ptr++;
412 	scsi_ulto4b(ROD_TYPE_BLOCK_ZERO, srtd_ptr->rod_type);
413 	srtd_ptr->flags = SVPD_TPC_SRTD_TIN;
414 	scsi_ulto2b(0, srtd_ptr->preference_indicator);
415 
416 	/* General Copy Operations */
417 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
418 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
419 	gco_ptr = (struct scsi_vpd_tpc_descriptor_gco *)d_ptr;
420 	scsi_ulto2b(SVPD_TPC_GCO, gco_ptr->desc_type);
421 	scsi_ulto2b(sizeof(*gco_ptr) - 4, gco_ptr->desc_length);
422 	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->total_concurrent_copies);
423 	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->maximum_identified_concurrent_copies);
424 	scsi_ulto4b(TPC_MAX_SEG, gco_ptr->maximum_segment_length);
425 	gco_ptr->data_segment_granularity = 0;
426 	gco_ptr->inline_data_granularity = 0;
427 
428 	ctsio->scsi_status = SCSI_STATUS_OK;
429 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
430 	ctsio->be_move_done = ctl_config_move_done;
431 	ctl_datamove((union ctl_io *)ctsio);
432 
433 	return (CTL_RETVAL_COMPLETE);
434 }
435 
436 int
437 ctl_receive_copy_operating_parameters(struct ctl_scsiio *ctsio)
438 {
439 	struct scsi_receive_copy_operating_parameters *cdb;
440 	struct scsi_receive_copy_operating_parameters_data *data;
441 	int retval;
442 	int alloc_len, total_len;
443 
444 	CTL_DEBUG_PRINT(("ctl_report_supported_tmf\n"));
445 
446 	cdb = (struct scsi_receive_copy_operating_parameters *)ctsio->cdb;
447 
448 	retval = CTL_RETVAL_COMPLETE;
449 
450 	total_len = sizeof(*data) + 4;
451 	alloc_len = scsi_4btoul(cdb->length);
452 
453 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
454 
455 	ctsio->kern_sg_entries = 0;
456 
457 	if (total_len < alloc_len) {
458 		ctsio->residual = alloc_len - total_len;
459 		ctsio->kern_data_len = total_len;
460 		ctsio->kern_total_len = total_len;
461 	} else {
462 		ctsio->residual = 0;
463 		ctsio->kern_data_len = alloc_len;
464 		ctsio->kern_total_len = alloc_len;
465 	}
466 	ctsio->kern_data_resid = 0;
467 	ctsio->kern_rel_offset = 0;
468 
469 	data = (struct scsi_receive_copy_operating_parameters_data *)ctsio->kern_data_ptr;
470 	scsi_ulto4b(sizeof(*data) - 4 + 4, data->length);
471 	data->snlid = RCOP_SNLID;
472 	scsi_ulto2b(TPC_MAX_CSCDS, data->maximum_cscd_descriptor_count);
473 	scsi_ulto2b(TPC_MAX_SEGS, data->maximum_segment_descriptor_count);
474 	scsi_ulto4b(TPC_MAX_LIST, data->maximum_descriptor_list_length);
475 	scsi_ulto4b(TPC_MAX_SEG, data->maximum_segment_length);
476 	scsi_ulto4b(TPC_MAX_INLINE, data->maximum_inline_data_length);
477 	scsi_ulto4b(0, data->held_data_limit);
478 	scsi_ulto4b(0, data->maximum_stream_device_transfer_size);
479 	scsi_ulto2b(TPC_MAX_LISTS, data->total_concurrent_copies);
480 	data->maximum_concurrent_copies = TPC_MAX_LISTS;
481 	data->data_segment_granularity = 0;
482 	data->inline_data_granularity = 0;
483 	data->held_data_granularity = 0;
484 	data->implemented_descriptor_list_length = 4;
485 	data->list_of_implemented_descriptor_type_codes[0] = EC_SEG_B2B;
486 	data->list_of_implemented_descriptor_type_codes[1] = EC_SEG_VERIFY;
487 	data->list_of_implemented_descriptor_type_codes[2] = EC_SEG_REGISTER_KEY;
488 	data->list_of_implemented_descriptor_type_codes[3] = EC_CSCD_ID;
489 
490 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
491 	ctsio->be_move_done = ctl_config_move_done;
492 
493 	ctl_datamove((union ctl_io *)ctsio);
494 	return (retval);
495 }
496 
497 static struct tpc_list *
498 tpc_find_list(struct ctl_lun *lun, uint32_t list_id, uint32_t init_idx)
499 {
500 	struct tpc_list *list;
501 
502 	mtx_assert(&lun->lun_lock, MA_OWNED);
503 	TAILQ_FOREACH(list, &lun->tpc_lists, links) {
504 		if ((list->flags & EC_LIST_ID_USAGE_MASK) !=
505 		     EC_LIST_ID_USAGE_NONE && list->list_id == list_id &&
506 		    list->init_idx == init_idx)
507 			break;
508 	}
509 	return (list);
510 }
511 
512 int
513 ctl_receive_copy_status_lid1(struct ctl_scsiio *ctsio)
514 {
515 	struct ctl_lun *lun;
516 	struct scsi_receive_copy_status_lid1 *cdb;
517 	struct scsi_receive_copy_status_lid1_data *data;
518 	struct tpc_list *list;
519 	struct tpc_list list_copy;
520 	int retval;
521 	int alloc_len, total_len;
522 	uint32_t list_id;
523 
524 	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid1\n"));
525 
526 	cdb = (struct scsi_receive_copy_status_lid1 *)ctsio->cdb;
527 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
528 
529 	retval = CTL_RETVAL_COMPLETE;
530 
531 	list_id = cdb->list_identifier;
532 	mtx_lock(&lun->lun_lock);
533 	list = tpc_find_list(lun, list_id,
534 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
535 	if (list == NULL) {
536 		mtx_unlock(&lun->lun_lock);
537 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
538 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
539 		    /*bit*/ 0);
540 		ctl_done((union ctl_io *)ctsio);
541 		return (retval);
542 	}
543 	list_copy = *list;
544 	if (list->completed) {
545 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
546 		free(list, M_CTL);
547 	}
548 	mtx_unlock(&lun->lun_lock);
549 
550 	total_len = sizeof(*data);
551 	alloc_len = scsi_4btoul(cdb->length);
552 
553 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
554 
555 	ctsio->kern_sg_entries = 0;
556 
557 	if (total_len < alloc_len) {
558 		ctsio->residual = alloc_len - total_len;
559 		ctsio->kern_data_len = total_len;
560 		ctsio->kern_total_len = total_len;
561 	} else {
562 		ctsio->residual = 0;
563 		ctsio->kern_data_len = alloc_len;
564 		ctsio->kern_total_len = alloc_len;
565 	}
566 	ctsio->kern_data_resid = 0;
567 	ctsio->kern_rel_offset = 0;
568 
569 	data = (struct scsi_receive_copy_status_lid1_data *)ctsio->kern_data_ptr;
570 	scsi_ulto4b(sizeof(*data) - 4, data->available_data);
571 	if (list_copy.completed) {
572 		if (list_copy.error || list_copy.abort)
573 			data->copy_command_status = RCS_CCS_ERROR;
574 		else
575 			data->copy_command_status = RCS_CCS_COMPLETED;
576 	} else
577 		data->copy_command_status = RCS_CCS_INPROG;
578 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
579 	if (list_copy.curbytes <= UINT32_MAX) {
580 		data->transfer_count_units = RCS_TC_BYTES;
581 		scsi_ulto4b(list_copy.curbytes, data->transfer_count);
582 	} else {
583 		data->transfer_count_units = RCS_TC_MBYTES;
584 		scsi_ulto4b(list_copy.curbytes >> 20, data->transfer_count);
585 	}
586 
587 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
588 	ctsio->be_move_done = ctl_config_move_done;
589 
590 	ctl_datamove((union ctl_io *)ctsio);
591 	return (retval);
592 }
593 
594 int
595 ctl_receive_copy_failure_details(struct ctl_scsiio *ctsio)
596 {
597 	struct ctl_lun *lun;
598 	struct scsi_receive_copy_failure_details *cdb;
599 	struct scsi_receive_copy_failure_details_data *data;
600 	struct tpc_list *list;
601 	struct tpc_list list_copy;
602 	int retval;
603 	int alloc_len, total_len;
604 	uint32_t list_id;
605 
606 	CTL_DEBUG_PRINT(("ctl_receive_copy_failure_details\n"));
607 
608 	cdb = (struct scsi_receive_copy_failure_details *)ctsio->cdb;
609 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
610 
611 	retval = CTL_RETVAL_COMPLETE;
612 
613 	list_id = cdb->list_identifier;
614 	mtx_lock(&lun->lun_lock);
615 	list = tpc_find_list(lun, list_id,
616 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
617 	if (list == NULL || !list->completed) {
618 		mtx_unlock(&lun->lun_lock);
619 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
620 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
621 		    /*bit*/ 0);
622 		ctl_done((union ctl_io *)ctsio);
623 		return (retval);
624 	}
625 	list_copy = *list;
626 	TAILQ_REMOVE(&lun->tpc_lists, list, links);
627 	free(list, M_CTL);
628 	mtx_unlock(&lun->lun_lock);
629 
630 	total_len = sizeof(*data) + list_copy.sense_len;
631 	alloc_len = scsi_4btoul(cdb->length);
632 
633 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
634 
635 	ctsio->kern_sg_entries = 0;
636 
637 	if (total_len < alloc_len) {
638 		ctsio->residual = alloc_len - total_len;
639 		ctsio->kern_data_len = total_len;
640 		ctsio->kern_total_len = total_len;
641 	} else {
642 		ctsio->residual = 0;
643 		ctsio->kern_data_len = alloc_len;
644 		ctsio->kern_total_len = alloc_len;
645 	}
646 	ctsio->kern_data_resid = 0;
647 	ctsio->kern_rel_offset = 0;
648 
649 	data = (struct scsi_receive_copy_failure_details_data *)ctsio->kern_data_ptr;
650 	if (list_copy.completed && (list_copy.error || list_copy.abort)) {
651 		scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
652 		    data->available_data);
653 		data->copy_command_status = RCS_CCS_ERROR;
654 	} else
655 		scsi_ulto4b(0, data->available_data);
656 	scsi_ulto2b(list_copy.sense_len, data->sense_data_length);
657 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
658 
659 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
660 	ctsio->be_move_done = ctl_config_move_done;
661 
662 	ctl_datamove((union ctl_io *)ctsio);
663 	return (retval);
664 }
665 
666 int
667 ctl_receive_copy_status_lid4(struct ctl_scsiio *ctsio)
668 {
669 	struct ctl_lun *lun;
670 	struct scsi_receive_copy_status_lid4 *cdb;
671 	struct scsi_receive_copy_status_lid4_data *data;
672 	struct tpc_list *list;
673 	struct tpc_list list_copy;
674 	int retval;
675 	int alloc_len, total_len;
676 	uint32_t list_id;
677 
678 	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid4\n"));
679 
680 	cdb = (struct scsi_receive_copy_status_lid4 *)ctsio->cdb;
681 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
682 
683 	retval = CTL_RETVAL_COMPLETE;
684 
685 	list_id = scsi_4btoul(cdb->list_identifier);
686 	mtx_lock(&lun->lun_lock);
687 	list = tpc_find_list(lun, list_id,
688 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
689 	if (list == NULL) {
690 		mtx_unlock(&lun->lun_lock);
691 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
692 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
693 		    /*bit*/ 0);
694 		ctl_done((union ctl_io *)ctsio);
695 		return (retval);
696 	}
697 	list_copy = *list;
698 	if (list->completed) {
699 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
700 		free(list, M_CTL);
701 	}
702 	mtx_unlock(&lun->lun_lock);
703 
704 	total_len = sizeof(*data) + list_copy.sense_len;
705 	alloc_len = scsi_4btoul(cdb->length);
706 
707 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
708 
709 	ctsio->kern_sg_entries = 0;
710 
711 	if (total_len < alloc_len) {
712 		ctsio->residual = alloc_len - total_len;
713 		ctsio->kern_data_len = total_len;
714 		ctsio->kern_total_len = total_len;
715 	} else {
716 		ctsio->residual = 0;
717 		ctsio->kern_data_len = alloc_len;
718 		ctsio->kern_total_len = alloc_len;
719 	}
720 	ctsio->kern_data_resid = 0;
721 	ctsio->kern_rel_offset = 0;
722 
723 	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
724 	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
725 	    data->available_data);
726 	data->response_to_service_action = list_copy.service_action;
727 	if (list_copy.completed) {
728 		if (list_copy.error)
729 			data->copy_command_status = RCS_CCS_ERROR;
730 		else if (list_copy.abort)
731 			data->copy_command_status = RCS_CCS_ABORTED;
732 		else
733 			data->copy_command_status = RCS_CCS_COMPLETED;
734 	} else
735 		data->copy_command_status = RCS_CCS_INPROG_FG;
736 	scsi_ulto2b(list_copy.curops, data->operation_counter);
737 	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
738 	data->transfer_count_units = RCS_TC_BYTES;
739 	scsi_u64to8b(list_copy.curbytes, data->transfer_count);
740 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
741 	data->length_of_the_sense_data_field = list_copy.sense_len;
742 	data->sense_data_length = list_copy.sense_len;
743 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
744 
745 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
746 	ctsio->be_move_done = ctl_config_move_done;
747 
748 	ctl_datamove((union ctl_io *)ctsio);
749 	return (retval);
750 }
751 
752 int
753 ctl_copy_operation_abort(struct ctl_scsiio *ctsio)
754 {
755 	struct ctl_lun *lun;
756 	struct scsi_copy_operation_abort *cdb;
757 	struct tpc_list *list;
758 	int retval;
759 	uint32_t list_id;
760 
761 	CTL_DEBUG_PRINT(("ctl_copy_operation_abort\n"));
762 
763 	cdb = (struct scsi_copy_operation_abort *)ctsio->cdb;
764 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
765 
766 	retval = CTL_RETVAL_COMPLETE;
767 
768 	list_id = scsi_4btoul(cdb->list_identifier);
769 	mtx_lock(&lun->lun_lock);
770 	list = tpc_find_list(lun, list_id,
771 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
772 	if (list == NULL) {
773 		mtx_unlock(&lun->lun_lock);
774 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
775 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
776 		    /*bit*/ 0);
777 		ctl_done((union ctl_io *)ctsio);
778 		return (retval);
779 	}
780 	list->abort = 1;
781 	mtx_unlock(&lun->lun_lock);
782 
783 	ctl_set_success(ctsio);
784 	ctl_done((union ctl_io *)ctsio);
785 	return (retval);
786 }
787 
788 static uint64_t
789 tpc_resolve(struct tpc_list *list, uint16_t idx, uint32_t *ss)
790 {
791 
792 	if (idx == 0xffff) {
793 		if (ss && list->lun->be_lun)
794 			*ss = list->lun->be_lun->blocksize;
795 		return (list->lun->lun);
796 	}
797 	if (idx >= list->ncscd)
798 		return (UINT64_MAX);
799 	return (tpcl_resolve(list->init_port, &list->cscd[idx], ss));
800 }
801 
802 static int
803 tpc_process_b2b(struct tpc_list *list)
804 {
805 	struct scsi_ec_segment_b2b *seg;
806 	struct scsi_ec_cscd_dtsp *sdstp, *ddstp;
807 	struct tpc_io *tior, *tiow;
808 	struct runl run, *prun;
809 	uint64_t sl, dl;
810 	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
811 	int numlba;
812 	uint32_t srcblock, dstblock;
813 
814 	if (list->stage == 1) {
815 complete:
816 		while ((tior = TAILQ_FIRST(&list->allio)) != NULL) {
817 			TAILQ_REMOVE(&list->allio, tior, links);
818 			ctl_free_io(tior->io);
819 			free(tior, M_CTL);
820 		}
821 		free(list->buf, M_CTL);
822 		if (list->abort) {
823 			ctl_set_task_aborted(list->ctsio);
824 			return (CTL_RETVAL_ERROR);
825 		} else if (list->error) {
826 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
827 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
828 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
829 			return (CTL_RETVAL_ERROR);
830 		}
831 		list->cursectors += list->segsectors;
832 		list->curbytes += list->segbytes;
833 		return (CTL_RETVAL_COMPLETE);
834 	}
835 
836 	TAILQ_INIT(&list->allio);
837 	seg = (struct scsi_ec_segment_b2b *)list->seg[list->curseg];
838 	sl = tpc_resolve(list, scsi_2btoul(seg->src_cscd), &srcblock);
839 	dl = tpc_resolve(list, scsi_2btoul(seg->dst_cscd), &dstblock);
840 	if (sl >= CTL_MAX_LUNS || dl >= CTL_MAX_LUNS) {
841 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
842 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
843 		    /*asc*/ 0x08, /*ascq*/ 0x04, SSD_ELEM_NONE);
844 		return (CTL_RETVAL_ERROR);
845 	}
846 	sdstp = &list->cscd[scsi_2btoul(seg->src_cscd)].dtsp;
847 	if (scsi_3btoul(sdstp->block_length) != 0)
848 		srcblock = scsi_3btoul(sdstp->block_length);
849 	ddstp = &list->cscd[scsi_2btoul(seg->dst_cscd)].dtsp;
850 	if (scsi_3btoul(ddstp->block_length) != 0)
851 		dstblock = scsi_3btoul(ddstp->block_length);
852 	numlba = scsi_2btoul(seg->number_of_blocks);
853 	if (seg->flags & EC_SEG_DC)
854 		numbytes = (off_t)numlba * dstblock;
855 	else
856 		numbytes = (off_t)numlba * srcblock;
857 	srclba = scsi_8btou64(seg->src_lba);
858 	dstlba = scsi_8btou64(seg->dst_lba);
859 
860 //	printf("Copy %ju bytes from %ju @ %ju to %ju @ %ju\n",
861 //	    (uintmax_t)numbytes, sl, scsi_8btou64(seg->src_lba),
862 //	    dl, scsi_8btou64(seg->dst_lba));
863 
864 	if (numbytes == 0)
865 		return (CTL_RETVAL_COMPLETE);
866 
867 	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
868 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
869 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
870 		    /*asc*/ 0x26, /*ascq*/ 0x0A, SSD_ELEM_NONE);
871 		return (CTL_RETVAL_ERROR);
872 	}
873 
874 	list->buf = malloc(numbytes, M_CTL, M_WAITOK);
875 	list->segbytes = numbytes;
876 	list->segsectors = numbytes / dstblock;
877 	donebytes = 0;
878 	TAILQ_INIT(&run);
879 	prun = &run;
880 	list->tbdio = 1;
881 	while (donebytes < numbytes) {
882 		roundbytes = MIN(numbytes - donebytes, TPC_MAX_IO_SIZE);
883 
884 		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
885 		TAILQ_INIT(&tior->run);
886 		tior->list = list;
887 		TAILQ_INSERT_TAIL(&list->allio, tior, links);
888 		tior->io = tpcl_alloc_io();
889 		if (tior->io == NULL) {
890 			list->error = 1;
891 			goto complete;
892 		}
893 		ctl_scsi_read_write(tior->io,
894 				    /*data_ptr*/ &list->buf[donebytes],
895 				    /*data_len*/ roundbytes,
896 				    /*read_op*/ 1,
897 				    /*byte2*/ 0,
898 				    /*minimum_cdb_size*/ 0,
899 				    /*lba*/ srclba + donebytes / srcblock,
900 				    /*num_blocks*/ roundbytes / srcblock,
901 				    /*tag_type*/ CTL_TAG_SIMPLE,
902 				    /*control*/ 0);
903 		tior->io->io_hdr.retries = 3;
904 		tior->lun = sl;
905 		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
906 
907 		tiow = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
908 		TAILQ_INIT(&tiow->run);
909 		tiow->list = list;
910 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
911 		tiow->io = tpcl_alloc_io();
912 		if (tiow->io == NULL) {
913 			list->error = 1;
914 			goto complete;
915 		}
916 		ctl_scsi_read_write(tiow->io,
917 				    /*data_ptr*/ &list->buf[donebytes],
918 				    /*data_len*/ roundbytes,
919 				    /*read_op*/ 0,
920 				    /*byte2*/ 0,
921 				    /*minimum_cdb_size*/ 0,
922 				    /*lba*/ dstlba + donebytes / dstblock,
923 				    /*num_blocks*/ roundbytes / dstblock,
924 				    /*tag_type*/ CTL_TAG_SIMPLE,
925 				    /*control*/ 0);
926 		tiow->io->io_hdr.retries = 3;
927 		tiow->lun = dl;
928 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
929 
930 		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
931 		TAILQ_INSERT_TAIL(prun, tior, rlinks);
932 		prun = &tior->run;
933 		donebytes += roundbytes;
934 	}
935 
936 	while ((tior = TAILQ_FIRST(&run)) != NULL) {
937 		TAILQ_REMOVE(&run, tior, rlinks);
938 		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
939 			panic("tpcl_queue() error");
940 	}
941 
942 	list->stage++;
943 	return (CTL_RETVAL_QUEUED);
944 }
945 
946 static int
947 tpc_process_verify(struct tpc_list *list)
948 {
949 	struct scsi_ec_segment_verify *seg;
950 	struct tpc_io *tio;
951 	uint64_t sl;
952 
953 	if (list->stage == 1) {
954 complete:
955 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
956 			TAILQ_REMOVE(&list->allio, tio, links);
957 			ctl_free_io(tio->io);
958 			free(tio, M_CTL);
959 		}
960 		if (list->abort) {
961 			ctl_set_task_aborted(list->ctsio);
962 			return (CTL_RETVAL_ERROR);
963 		} else if (list->error) {
964 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
965 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
966 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
967 			return (CTL_RETVAL_ERROR);
968 		} else
969 			return (CTL_RETVAL_COMPLETE);
970 	}
971 
972 	TAILQ_INIT(&list->allio);
973 	seg = (struct scsi_ec_segment_verify *)list->seg[list->curseg];
974 	sl = tpc_resolve(list, scsi_2btoul(seg->src_cscd), NULL);
975 	if (sl >= CTL_MAX_LUNS) {
976 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
977 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
978 		    /*asc*/ 0x08, /*ascq*/ 0x04, SSD_ELEM_NONE);
979 		return (CTL_RETVAL_ERROR);
980 	}
981 
982 //	printf("Verify %ju\n", sl);
983 
984 	if ((seg->tur & 0x01) == 0)
985 		return (CTL_RETVAL_COMPLETE);
986 
987 	list->tbdio = 1;
988 	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
989 	TAILQ_INIT(&tio->run);
990 	tio->list = list;
991 	TAILQ_INSERT_TAIL(&list->allio, tio, links);
992 	tio->io = tpcl_alloc_io();
993 	if (tio->io == NULL) {
994 		list->error = 1;
995 		goto complete;
996 	}
997 	ctl_scsi_tur(tio->io, /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
998 	tio->io->io_hdr.retries = 3;
999 	tio->lun = sl;
1000 	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1001 	list->stage++;
1002 	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1003 		panic("tpcl_queue() error");
1004 	return (CTL_RETVAL_QUEUED);
1005 }
1006 
1007 static int
1008 tpc_process_register_key(struct tpc_list *list)
1009 {
1010 	struct scsi_ec_segment_register_key *seg;
1011 	struct tpc_io *tio;
1012 	uint64_t dl;
1013 	int datalen;
1014 
1015 	if (list->stage == 1) {
1016 complete:
1017 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1018 			TAILQ_REMOVE(&list->allio, tio, links);
1019 			ctl_free_io(tio->io);
1020 			free(tio, M_CTL);
1021 		}
1022 		free(list->buf, M_CTL);
1023 		if (list->abort) {
1024 			ctl_set_task_aborted(list->ctsio);
1025 			return (CTL_RETVAL_ERROR);
1026 		} else if (list->error) {
1027 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1028 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1029 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
1030 			return (CTL_RETVAL_ERROR);
1031 		} else
1032 			return (CTL_RETVAL_COMPLETE);
1033 	}
1034 
1035 	TAILQ_INIT(&list->allio);
1036 	seg = (struct scsi_ec_segment_register_key *)list->seg[list->curseg];
1037 	dl = tpc_resolve(list, scsi_2btoul(seg->dst_cscd), NULL);
1038 	if (dl >= CTL_MAX_LUNS) {
1039 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1040 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1041 		    /*asc*/ 0x08, /*ascq*/ 0x04, SSD_ELEM_NONE);
1042 		return (CTL_RETVAL_ERROR);
1043 	}
1044 
1045 //	printf("Register Key %ju\n", dl);
1046 
1047 	list->tbdio = 1;
1048 	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1049 	TAILQ_INIT(&tio->run);
1050 	tio->list = list;
1051 	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1052 	tio->io = tpcl_alloc_io();
1053 	if (tio->io == NULL) {
1054 		list->error = 1;
1055 		goto complete;
1056 	}
1057 	datalen = sizeof(struct scsi_per_res_out_parms);
1058 	list->buf = malloc(datalen, M_CTL, M_WAITOK);
1059 	ctl_scsi_persistent_res_out(tio->io,
1060 	    list->buf, datalen, SPRO_REGISTER, -1,
1061 	    scsi_8btou64(seg->res_key), scsi_8btou64(seg->sa_res_key),
1062 	    /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1063 	tio->io->io_hdr.retries = 3;
1064 	tio->lun = dl;
1065 	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1066 	list->stage++;
1067 	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1068 		panic("tpcl_queue() error");
1069 	return (CTL_RETVAL_QUEUED);
1070 }
1071 
1072 static off_t
1073 tpc_ranges_length(struct scsi_range_desc *range, int nrange)
1074 {
1075 	off_t length = 0;
1076 	int r;
1077 
1078 	for (r = 0; r < nrange; r++)
1079 		length += scsi_4btoul(range[r].length);
1080 	return (length);
1081 }
1082 
1083 static int
1084 tpc_skip_ranges(struct scsi_range_desc *range, int nrange, off_t skip,
1085     int *srange, off_t *soffset)
1086 {
1087 	off_t off;
1088 	int r;
1089 
1090 	r = 0;
1091 	off = 0;
1092 	while (r < nrange) {
1093 		if (skip - off < scsi_4btoul(range[r].length)) {
1094 			*srange = r;
1095 			*soffset = skip - off;
1096 			return (0);
1097 		}
1098 		off += scsi_4btoul(range[r].length);
1099 		r++;
1100 	}
1101 	return (-1);
1102 }
1103 
1104 static int
1105 tpc_process_wut(struct tpc_list *list)
1106 {
1107 	struct tpc_io *tio, *tior, *tiow;
1108 	struct runl run, *prun;
1109 	int drange, srange;
1110 	off_t doffset, soffset;
1111 	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
1112 	uint32_t srcblock, dstblock;
1113 
1114 	if (list->stage > 0) {
1115 complete:
1116 		/* Cleanup after previous rounds. */
1117 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1118 			TAILQ_REMOVE(&list->allio, tio, links);
1119 			ctl_free_io(tio->io);
1120 			free(tio, M_CTL);
1121 		}
1122 		free(list->buf, M_CTL);
1123 		if (list->abort) {
1124 			ctl_set_task_aborted(list->ctsio);
1125 			return (CTL_RETVAL_ERROR);
1126 		} else if (list->error) {
1127 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1128 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1129 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
1130 			return (CTL_RETVAL_ERROR);
1131 		}
1132 		list->cursectors += list->segsectors;
1133 		list->curbytes += list->segbytes;
1134 	}
1135 
1136 	/* Check where we are on destination ranges list. */
1137 	if (tpc_skip_ranges(list->range, list->nrange, list->cursectors,
1138 	    &drange, &doffset) != 0)
1139 		return (CTL_RETVAL_COMPLETE);
1140 	dstblock = list->lun->be_lun->blocksize;
1141 
1142 	/* Check where we are on source ranges list. */
1143 	srcblock = list->token->blocksize;
1144 	if (tpc_skip_ranges(list->token->range, list->token->nrange,
1145 	    list->offset_into_rod + list->cursectors * dstblock / srcblock,
1146 	    &srange, &soffset) != 0) {
1147 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1148 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1149 		    /*asc*/ 0x0d, /*ascq*/ 0x04, SSD_ELEM_NONE);
1150 		return (CTL_RETVAL_ERROR);
1151 	}
1152 
1153 	srclba = scsi_8btou64(list->token->range[srange].lba) + soffset;
1154 	numbytes = srcblock * omin(TPC_MAX_IOCHUNK_SIZE / srcblock,
1155 	    (scsi_4btoul(list->token->range[srange].length) - soffset));
1156 	dstlba = scsi_8btou64(list->range[drange].lba) + doffset;
1157 	numbytes = omin(numbytes,
1158 	    dstblock * omin(TPC_MAX_IOCHUNK_SIZE / dstblock,
1159 	    (scsi_4btoul(list->range[drange].length) - doffset)));
1160 
1161 	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
1162 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1163 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1164 		    /*asc*/ 0x26, /*ascq*/ 0x0A, SSD_ELEM_NONE);
1165 		return (CTL_RETVAL_ERROR);
1166 	}
1167 
1168 	list->buf = malloc(numbytes, M_CTL, M_WAITOK |
1169 	    (list->token == NULL ? M_ZERO : 0));
1170 	list->segbytes = numbytes;
1171 	list->segsectors = numbytes / dstblock;
1172 //printf("Copy chunk of %ju sectors from %ju to %ju\n", list->segsectors,
1173 //    srclba, dstlba);
1174 	donebytes = 0;
1175 	TAILQ_INIT(&run);
1176 	prun = &run;
1177 	list->tbdio = 1;
1178 	TAILQ_INIT(&list->allio);
1179 	while (donebytes < numbytes) {
1180 		roundbytes = MIN(numbytes - donebytes, TPC_MAX_IO_SIZE);
1181 
1182 		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
1183 		TAILQ_INIT(&tior->run);
1184 		tior->list = list;
1185 		TAILQ_INSERT_TAIL(&list->allio, tior, links);
1186 		tior->io = tpcl_alloc_io();
1187 		if (tior->io == NULL) {
1188 			list->error = 1;
1189 			goto complete;
1190 		}
1191 		ctl_scsi_read_write(tior->io,
1192 				    /*data_ptr*/ &list->buf[donebytes],
1193 				    /*data_len*/ roundbytes,
1194 				    /*read_op*/ 1,
1195 				    /*byte2*/ 0,
1196 				    /*minimum_cdb_size*/ 0,
1197 				    /*lba*/ srclba + donebytes / srcblock,
1198 				    /*num_blocks*/ roundbytes / srcblock,
1199 				    /*tag_type*/ CTL_TAG_SIMPLE,
1200 				    /*control*/ 0);
1201 		tior->io->io_hdr.retries = 3;
1202 		tior->lun = list->token->lun;
1203 		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
1204 
1205 		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1206 		TAILQ_INIT(&tiow->run);
1207 		tiow->list = list;
1208 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1209 		tiow->io = tpcl_alloc_io();
1210 		if (tiow->io == NULL) {
1211 			list->error = 1;
1212 			goto complete;
1213 		}
1214 		ctl_scsi_read_write(tiow->io,
1215 				    /*data_ptr*/ &list->buf[donebytes],
1216 				    /*data_len*/ roundbytes,
1217 				    /*read_op*/ 0,
1218 				    /*byte2*/ 0,
1219 				    /*minimum_cdb_size*/ 0,
1220 				    /*lba*/ dstlba + donebytes / dstblock,
1221 				    /*num_blocks*/ roundbytes / dstblock,
1222 				    /*tag_type*/ CTL_TAG_SIMPLE,
1223 				    /*control*/ 0);
1224 		tiow->io->io_hdr.retries = 3;
1225 		tiow->lun = list->lun->lun;
1226 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1227 
1228 		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
1229 		TAILQ_INSERT_TAIL(prun, tior, rlinks);
1230 		prun = &tior->run;
1231 		donebytes += roundbytes;
1232 	}
1233 
1234 	while ((tior = TAILQ_FIRST(&run)) != NULL) {
1235 		TAILQ_REMOVE(&run, tior, rlinks);
1236 		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1237 			panic("tpcl_queue() error");
1238 	}
1239 
1240 	list->stage++;
1241 	return (CTL_RETVAL_QUEUED);
1242 }
1243 
1244 static int
1245 tpc_process_zero_wut(struct tpc_list *list)
1246 {
1247 	struct tpc_io *tio, *tiow;
1248 	struct runl run, *prun;
1249 	int r;
1250 	uint32_t dstblock, len;
1251 
1252 	if (list->stage > 0) {
1253 complete:
1254 		/* Cleanup after previous rounds. */
1255 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1256 			TAILQ_REMOVE(&list->allio, tio, links);
1257 			ctl_free_io(tio->io);
1258 			free(tio, M_CTL);
1259 		}
1260 		free(list->buf, M_CTL);
1261 		if (list->abort) {
1262 			ctl_set_task_aborted(list->ctsio);
1263 			return (CTL_RETVAL_ERROR);
1264 		} else if (list->error) {
1265 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1266 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1267 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
1268 			return (CTL_RETVAL_ERROR);
1269 		}
1270 		list->cursectors += list->segsectors;
1271 		list->curbytes += list->segbytes;
1272 		return (CTL_RETVAL_COMPLETE);
1273 	}
1274 
1275 	dstblock = list->lun->be_lun->blocksize;
1276 	list->buf = malloc(dstblock, M_CTL, M_WAITOK | M_ZERO);
1277 	TAILQ_INIT(&run);
1278 	prun = &run;
1279 	list->tbdio = 1;
1280 	TAILQ_INIT(&list->allio);
1281 	list->segsectors = 0;
1282 	for (r = 0; r < list->nrange; r++) {
1283 		len = scsi_4btoul(list->range[r].length);
1284 		if (len == 0)
1285 			continue;
1286 
1287 		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1288 		TAILQ_INIT(&tiow->run);
1289 		tiow->list = list;
1290 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1291 		tiow->io = tpcl_alloc_io();
1292 		if (tiow->io == NULL) {
1293 			list->error = 1;
1294 			goto complete;
1295 		}
1296 		ctl_scsi_write_same(tiow->io,
1297 				    /*data_ptr*/ list->buf,
1298 				    /*data_len*/ dstblock,
1299 				    /*byte2*/ 0,
1300 				    /*lba*/ scsi_8btou64(list->range[r].lba),
1301 				    /*num_blocks*/ len,
1302 				    /*tag_type*/ CTL_TAG_SIMPLE,
1303 				    /*control*/ 0);
1304 		tiow->io->io_hdr.retries = 3;
1305 		tiow->lun = list->lun->lun;
1306 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1307 
1308 		TAILQ_INSERT_TAIL(prun, tiow, rlinks);
1309 		prun = &tiow->run;
1310 		list->segsectors += len;
1311 	}
1312 	list->segbytes = list->segsectors * dstblock;
1313 
1314 	if (TAILQ_EMPTY(&run))
1315 		goto complete;
1316 
1317 	while ((tiow = TAILQ_FIRST(&run)) != NULL) {
1318 		TAILQ_REMOVE(&run, tiow, rlinks);
1319 		if (tpcl_queue(tiow->io, tiow->lun) != CTL_RETVAL_COMPLETE)
1320 			panic("tpcl_queue() error");
1321 	}
1322 
1323 	list->stage++;
1324 	return (CTL_RETVAL_QUEUED);
1325 }
1326 
1327 static void
1328 tpc_process(struct tpc_list *list)
1329 {
1330 	struct ctl_lun *lun = list->lun;
1331 	struct scsi_ec_segment *seg;
1332 	struct ctl_scsiio *ctsio = list->ctsio;
1333 	int retval = CTL_RETVAL_COMPLETE;
1334 
1335 	if (list->service_action == EC_WUT) {
1336 		if (list->token != NULL)
1337 			retval = tpc_process_wut(list);
1338 		else
1339 			retval = tpc_process_zero_wut(list);
1340 		if (retval == CTL_RETVAL_QUEUED)
1341 			return;
1342 		if (retval == CTL_RETVAL_ERROR) {
1343 			list->error = 1;
1344 			goto done;
1345 		}
1346 	} else {
1347 //printf("ZZZ %d cscd, %d segs\n", list->ncscd, list->nseg);
1348 		while (list->curseg < list->nseg) {
1349 			seg = list->seg[list->curseg];
1350 			switch (seg->type_code) {
1351 			case EC_SEG_B2B:
1352 				retval = tpc_process_b2b(list);
1353 				break;
1354 			case EC_SEG_VERIFY:
1355 				retval = tpc_process_verify(list);
1356 				break;
1357 			case EC_SEG_REGISTER_KEY:
1358 				retval = tpc_process_register_key(list);
1359 				break;
1360 			default:
1361 				ctl_set_sense(ctsio, /*current_error*/ 1,
1362 				    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1363 				    /*asc*/ 0x26, /*ascq*/ 0x09, SSD_ELEM_NONE);
1364 				goto done;
1365 			}
1366 			if (retval == CTL_RETVAL_QUEUED)
1367 				return;
1368 			if (retval == CTL_RETVAL_ERROR) {
1369 				list->error = 1;
1370 				goto done;
1371 			}
1372 			list->curseg++;
1373 			list->stage = 0;
1374 		}
1375 	}
1376 
1377 	ctl_set_success(ctsio);
1378 
1379 done:
1380 //printf("ZZZ done\n");
1381 	free(list->params, M_CTL);
1382 	list->params = NULL;
1383 	if (list->token) {
1384 		mtx_lock(&control_softc->ctl_lock);
1385 		if (--list->token->active == 0)
1386 			list->token->last_active = time_uptime;
1387 		mtx_unlock(&control_softc->ctl_lock);
1388 		list->token = NULL;
1389 	}
1390 	mtx_lock(&lun->lun_lock);
1391 	if ((list->flags & EC_LIST_ID_USAGE_MASK) == EC_LIST_ID_USAGE_NONE) {
1392 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
1393 		free(list, M_CTL);
1394 	} else {
1395 		list->completed = 1;
1396 		list->last_active = time_uptime;
1397 		list->sense_data = ctsio->sense_data;
1398 		list->sense_len = ctsio->sense_len;
1399 		list->scsi_status = ctsio->scsi_status;
1400 	}
1401 	mtx_unlock(&lun->lun_lock);
1402 
1403 	ctl_done((union ctl_io *)ctsio);
1404 }
1405 
1406 /*
1407  * For any sort of check condition, busy, etc., we just retry.  We do not
1408  * decrement the retry count for unit attention type errors.  These are
1409  * normal, and we want to save the retry count for "real" errors.  Otherwise,
1410  * we could end up with situations where a command will succeed in some
1411  * situations and fail in others, depending on whether a unit attention is
1412  * pending.  Also, some of our error recovery actions, most notably the
1413  * LUN reset action, will cause a unit attention.
1414  *
1415  * We can add more detail here later if necessary.
1416  */
1417 static tpc_error_action
1418 tpc_checkcond_parse(union ctl_io *io)
1419 {
1420 	tpc_error_action error_action;
1421 	int error_code, sense_key, asc, ascq;
1422 
1423 	/*
1424 	 * Default to retrying the command.
1425 	 */
1426 	error_action = TPC_ERR_RETRY;
1427 
1428 	scsi_extract_sense_len(&io->scsiio.sense_data,
1429 			       io->scsiio.sense_len,
1430 			       &error_code,
1431 			       &sense_key,
1432 			       &asc,
1433 			       &ascq,
1434 			       /*show_errors*/ 1);
1435 
1436 	switch (error_code) {
1437 	case SSD_DEFERRED_ERROR:
1438 	case SSD_DESC_DEFERRED_ERROR:
1439 		error_action |= TPC_ERR_NO_DECREMENT;
1440 		break;
1441 	case SSD_CURRENT_ERROR:
1442 	case SSD_DESC_CURRENT_ERROR:
1443 	default:
1444 		switch (sense_key) {
1445 		case SSD_KEY_UNIT_ATTENTION:
1446 			error_action |= TPC_ERR_NO_DECREMENT;
1447 			break;
1448 		case SSD_KEY_HARDWARE_ERROR:
1449 			/*
1450 			 * This is our generic "something bad happened"
1451 			 * error code.  It often isn't recoverable.
1452 			 */
1453 			if ((asc == 0x44) && (ascq == 0x00))
1454 				error_action = TPC_ERR_FAIL;
1455 			break;
1456 		case SSD_KEY_NOT_READY:
1457 			/*
1458 			 * If the LUN is powered down, there likely isn't
1459 			 * much point in retrying right now.
1460 			 */
1461 			if ((asc == 0x04) && (ascq == 0x02))
1462 				error_action = TPC_ERR_FAIL;
1463 			/*
1464 			 * If the LUN is offline, there probably isn't much
1465 			 * point in retrying, either.
1466 			 */
1467 			if ((asc == 0x04) && (ascq == 0x03))
1468 				error_action = TPC_ERR_FAIL;
1469 			break;
1470 		}
1471 	}
1472 	return (error_action);
1473 }
1474 
1475 static tpc_error_action
1476 tpc_error_parse(union ctl_io *io)
1477 {
1478 	tpc_error_action error_action = TPC_ERR_RETRY;
1479 
1480 	switch (io->io_hdr.io_type) {
1481 	case CTL_IO_SCSI:
1482 		switch (io->io_hdr.status & CTL_STATUS_MASK) {
1483 		case CTL_SCSI_ERROR:
1484 			switch (io->scsiio.scsi_status) {
1485 			case SCSI_STATUS_CHECK_COND:
1486 				error_action = tpc_checkcond_parse(io);
1487 				break;
1488 			default:
1489 				break;
1490 			}
1491 			break;
1492 		default:
1493 			break;
1494 		}
1495 		break;
1496 	case CTL_IO_TASK:
1497 		break;
1498 	default:
1499 		panic("%s: invalid ctl_io type %d\n", __func__,
1500 		      io->io_hdr.io_type);
1501 		break;
1502 	}
1503 	return (error_action);
1504 }
1505 
1506 void
1507 tpc_done(union ctl_io *io)
1508 {
1509 	struct tpc_io *tio, *tior;
1510 
1511 	/*
1512 	 * Very minimal retry logic.  We basically retry if we got an error
1513 	 * back, and the retry count is greater than 0.  If we ever want
1514 	 * more sophisticated initiator type behavior, the CAM error
1515 	 * recovery code in ../common might be helpful.
1516 	 */
1517 //	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1518 //		ctl_io_error_print(io, NULL);
1519 	tio = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1520 	if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1521 	 && (io->io_hdr.retries > 0)) {
1522 		ctl_io_status old_status;
1523 		tpc_error_action error_action;
1524 
1525 		error_action = tpc_error_parse(io);
1526 		switch (error_action & TPC_ERR_MASK) {
1527 		case TPC_ERR_FAIL:
1528 			break;
1529 		case TPC_ERR_RETRY:
1530 		default:
1531 			if ((error_action & TPC_ERR_NO_DECREMENT) == 0)
1532 				io->io_hdr.retries--;
1533 			old_status = io->io_hdr.status;
1534 			io->io_hdr.status = CTL_STATUS_NONE;
1535 			io->io_hdr.flags &= ~CTL_FLAG_ABORT;
1536 			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
1537 			if (tpcl_queue(io, tio->lun) != CTL_RETVAL_COMPLETE) {
1538 				printf("%s: error returned from ctl_queue()!\n",
1539 				       __func__);
1540 				io->io_hdr.status = old_status;
1541 			} else
1542 				return;
1543 		}
1544 	}
1545 
1546 	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1547 		tio->list->error = 1;
1548 	else
1549 		atomic_add_int(&tio->list->curops, 1);
1550 	if (!tio->list->error && !tio->list->abort) {
1551 		while ((tior = TAILQ_FIRST(&tio->run)) != NULL) {
1552 			TAILQ_REMOVE(&tio->run, tior, rlinks);
1553 			atomic_add_int(&tio->list->tbdio, 1);
1554 			if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1555 				panic("tpcl_queue() error");
1556 		}
1557 	}
1558 	if (atomic_fetchadd_int(&tio->list->tbdio, -1) == 1)
1559 		tpc_process(tio->list);
1560 }
1561 
1562 int
1563 ctl_extended_copy_lid1(struct ctl_scsiio *ctsio)
1564 {
1565 	struct scsi_extended_copy *cdb;
1566 	struct scsi_extended_copy_lid1_data *data;
1567 	struct ctl_lun *lun;
1568 	struct tpc_list *list, *tlist;
1569 	uint8_t *ptr;
1570 	char *value;
1571 	int len, off, lencscd, lenseg, leninl, nseg;
1572 
1573 	CTL_DEBUG_PRINT(("ctl_extended_copy_lid1\n"));
1574 
1575 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1576 	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1577 	len = scsi_4btoul(cdb->length);
1578 
1579 	if (len < sizeof(struct scsi_extended_copy_lid1_data) ||
1580 	    len > sizeof(struct scsi_extended_copy_lid1_data) +
1581 	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1582 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1583 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1584 		goto done;
1585 	}
1586 
1587 	/*
1588 	 * If we've got a kernel request that hasn't been malloced yet,
1589 	 * malloc it and tell the caller the data buffer is here.
1590 	 */
1591 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1592 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1593 		ctsio->kern_data_len = len;
1594 		ctsio->kern_total_len = len;
1595 		ctsio->kern_data_resid = 0;
1596 		ctsio->kern_rel_offset = 0;
1597 		ctsio->kern_sg_entries = 0;
1598 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1599 		ctsio->be_move_done = ctl_config_move_done;
1600 		ctl_datamove((union ctl_io *)ctsio);
1601 
1602 		return (CTL_RETVAL_COMPLETE);
1603 	}
1604 
1605 	data = (struct scsi_extended_copy_lid1_data *)ctsio->kern_data_ptr;
1606 	lencscd = scsi_2btoul(data->cscd_list_length);
1607 	lenseg = scsi_4btoul(data->segment_list_length);
1608 	leninl = scsi_4btoul(data->inline_data_length);
1609 	if (len < sizeof(struct scsi_extended_copy_lid1_data) +
1610 	    lencscd + lenseg + leninl ||
1611 	    leninl > TPC_MAX_INLINE) {
1612 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1613 		    /*field*/ 2, /*bit_valid*/ 0, /*bit*/ 0);
1614 		goto done;
1615 	}
1616 	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1617 		ctl_set_sense(ctsio, /*current_error*/ 1,
1618 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1619 		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1620 		goto done;
1621 	}
1622 	if (lencscd + lenseg > TPC_MAX_LIST) {
1623 		ctl_set_param_len_error(ctsio);
1624 		goto done;
1625 	}
1626 
1627 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1628 	list->service_action = cdb->service_action;
1629 	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1630 	if (value != NULL && strcmp(value, "on") == 0)
1631 		list->init_port = -1;
1632 	else
1633 		list->init_port = ctsio->io_hdr.nexus.targ_port;
1634 	list->init_idx = ctl_get_resindex(&ctsio->io_hdr.nexus);
1635 	list->list_id = data->list_identifier;
1636 	list->flags = data->flags;
1637 	list->params = ctsio->kern_data_ptr;
1638 	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1639 	ptr = &data->data[lencscd];
1640 	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1641 		if (nseg >= TPC_MAX_SEGS) {
1642 			free(list, M_CTL);
1643 			ctl_set_sense(ctsio, /*current_error*/ 1,
1644 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1645 			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1646 			goto done;
1647 		}
1648 		list->seg[nseg] = (struct scsi_ec_segment *)(ptr + off);
1649 		off += sizeof(struct scsi_ec_segment) +
1650 		    scsi_2btoul(list->seg[nseg]->descr_length);
1651 	}
1652 	list->inl = &data->data[lencscd + lenseg];
1653 	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1654 	list->nseg = nseg;
1655 	list->leninl = leninl;
1656 	list->ctsio = ctsio;
1657 	list->lun = lun;
1658 	mtx_lock(&lun->lun_lock);
1659 	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1660 		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1661 		if (tlist != NULL && !tlist->completed) {
1662 			mtx_unlock(&lun->lun_lock);
1663 			free(list, M_CTL);
1664 			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1665 			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1666 			    /*bit*/ 0);
1667 			goto done;
1668 		}
1669 		if (tlist != NULL) {
1670 			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1671 			free(tlist, M_CTL);
1672 		}
1673 	}
1674 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1675 	mtx_unlock(&lun->lun_lock);
1676 
1677 	tpc_process(list);
1678 	return (CTL_RETVAL_COMPLETE);
1679 
1680 done:
1681 	ctl_done((union ctl_io *)ctsio);
1682 	return (CTL_RETVAL_COMPLETE);
1683 }
1684 
1685 int
1686 ctl_extended_copy_lid4(struct ctl_scsiio *ctsio)
1687 {
1688 	struct scsi_extended_copy *cdb;
1689 	struct scsi_extended_copy_lid4_data *data;
1690 	struct ctl_lun *lun;
1691 	struct tpc_list *list, *tlist;
1692 	uint8_t *ptr;
1693 	char *value;
1694 	int len, off, lencscd, lenseg, leninl, nseg;
1695 
1696 	CTL_DEBUG_PRINT(("ctl_extended_copy_lid4\n"));
1697 
1698 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1699 	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1700 	len = scsi_4btoul(cdb->length);
1701 
1702 	if (len < sizeof(struct scsi_extended_copy_lid4_data) ||
1703 	    len > sizeof(struct scsi_extended_copy_lid4_data) +
1704 	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1705 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1706 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1707 		goto done;
1708 	}
1709 
1710 	/*
1711 	 * If we've got a kernel request that hasn't been malloced yet,
1712 	 * malloc it and tell the caller the data buffer is here.
1713 	 */
1714 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1715 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1716 		ctsio->kern_data_len = len;
1717 		ctsio->kern_total_len = len;
1718 		ctsio->kern_data_resid = 0;
1719 		ctsio->kern_rel_offset = 0;
1720 		ctsio->kern_sg_entries = 0;
1721 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1722 		ctsio->be_move_done = ctl_config_move_done;
1723 		ctl_datamove((union ctl_io *)ctsio);
1724 
1725 		return (CTL_RETVAL_COMPLETE);
1726 	}
1727 
1728 	data = (struct scsi_extended_copy_lid4_data *)ctsio->kern_data_ptr;
1729 	lencscd = scsi_2btoul(data->cscd_list_length);
1730 	lenseg = scsi_2btoul(data->segment_list_length);
1731 	leninl = scsi_2btoul(data->inline_data_length);
1732 	if (len < sizeof(struct scsi_extended_copy_lid4_data) +
1733 	    lencscd + lenseg + leninl ||
1734 	    leninl > TPC_MAX_INLINE) {
1735 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1736 		    /*field*/ 2, /*bit_valid*/ 0, /*bit*/ 0);
1737 		goto done;
1738 	}
1739 	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1740 		ctl_set_sense(ctsio, /*current_error*/ 1,
1741 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1742 		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1743 		goto done;
1744 	}
1745 	if (lencscd + lenseg > TPC_MAX_LIST) {
1746 		ctl_set_param_len_error(ctsio);
1747 		goto done;
1748 	}
1749 
1750 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1751 	list->service_action = cdb->service_action;
1752 	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1753 	if (value != NULL && strcmp(value, "on") == 0)
1754 		list->init_port = -1;
1755 	else
1756 		list->init_port = ctsio->io_hdr.nexus.targ_port;
1757 	list->init_idx = ctl_get_resindex(&ctsio->io_hdr.nexus);
1758 	list->list_id = scsi_4btoul(data->list_identifier);
1759 	list->flags = data->flags;
1760 	list->params = ctsio->kern_data_ptr;
1761 	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1762 	ptr = &data->data[lencscd];
1763 	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1764 		if (nseg >= TPC_MAX_SEGS) {
1765 			free(list, M_CTL);
1766 			ctl_set_sense(ctsio, /*current_error*/ 1,
1767 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1768 			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1769 			goto done;
1770 		}
1771 		list->seg[nseg] = (struct scsi_ec_segment *)(ptr + off);
1772 		off += sizeof(struct scsi_ec_segment) +
1773 		    scsi_2btoul(list->seg[nseg]->descr_length);
1774 	}
1775 	list->inl = &data->data[lencscd + lenseg];
1776 	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1777 	list->nseg = nseg;
1778 	list->leninl = leninl;
1779 	list->ctsio = ctsio;
1780 	list->lun = lun;
1781 	mtx_lock(&lun->lun_lock);
1782 	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1783 		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1784 		if (tlist != NULL && !tlist->completed) {
1785 			mtx_unlock(&lun->lun_lock);
1786 			free(list, M_CTL);
1787 			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1788 			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1789 			    /*bit*/ 0);
1790 			goto done;
1791 		}
1792 		if (tlist != NULL) {
1793 			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1794 			free(tlist, M_CTL);
1795 		}
1796 	}
1797 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1798 	mtx_unlock(&lun->lun_lock);
1799 
1800 	tpc_process(list);
1801 	return (CTL_RETVAL_COMPLETE);
1802 
1803 done:
1804 	ctl_done((union ctl_io *)ctsio);
1805 	return (CTL_RETVAL_COMPLETE);
1806 }
1807 
1808 static void
1809 tpc_create_token(struct ctl_lun *lun, struct ctl_port *port, off_t len,
1810     struct scsi_token *token)
1811 {
1812 	static int id = 0;
1813 	struct scsi_vpd_id_descriptor *idd = NULL;
1814 	struct scsi_ec_cscd_id *cscd;
1815 	struct scsi_read_capacity_data_long *dtsd;
1816 	int targid_len;
1817 
1818 	scsi_ulto4b(ROD_TYPE_AUR, token->type);
1819 	scsi_ulto2b(0x01f8, token->length);
1820 	scsi_u64to8b(atomic_fetchadd_int(&id, 1), &token->body[0]);
1821 	if (lun->lun_devid)
1822 		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
1823 		    lun->lun_devid->data, lun->lun_devid->len,
1824 		    scsi_devid_is_lun_naa);
1825 	if (idd == NULL && lun->lun_devid)
1826 		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
1827 		    lun->lun_devid->data, lun->lun_devid->len,
1828 		    scsi_devid_is_lun_eui64);
1829 	if (idd != NULL) {
1830 		cscd = (struct scsi_ec_cscd_id *)&token->body[8];
1831 		cscd->type_code = EC_CSCD_ID;
1832 		cscd->luidt_pdt = T_DIRECT;
1833 		memcpy(&cscd->codeset, idd, 4 + idd->length);
1834 		scsi_ulto3b(lun->be_lun->blocksize, cscd->dtsp.block_length);
1835 	}
1836 	scsi_u64to8b(0, &token->body[40]); /* XXX: Should be 128bit value. */
1837 	scsi_u64to8b(len, &token->body[48]);
1838 
1839 	/* ROD token device type specific data (RC16 without first field) */
1840 	dtsd = (struct scsi_read_capacity_data_long *)&token->body[88 - 8];
1841 	scsi_ulto4b(lun->be_lun->blocksize, dtsd->length);
1842 	dtsd->prot_lbppbe = lun->be_lun->pblockexp & SRC16_LBPPBE;
1843 	scsi_ulto2b(lun->be_lun->pblockoff & SRC16_LALBA_A, dtsd->lalba_lbp);
1844 	if (lun->be_lun->flags & CTL_LUN_FLAG_UNMAP)
1845 		dtsd->lalba_lbp[0] |= SRC16_LBPME | SRC16_LBPRZ;
1846 
1847 	if (port->target_devid) {
1848 		targid_len = port->target_devid->len;
1849 		memcpy(&token->body[120], port->target_devid->data, targid_len);
1850 	} else
1851 		targid_len = 32;
1852 	arc4rand(&token->body[120 + targid_len], 384 - targid_len, 0);
1853 };
1854 
1855 int
1856 ctl_populate_token(struct ctl_scsiio *ctsio)
1857 {
1858 	struct scsi_populate_token *cdb;
1859 	struct scsi_populate_token_data *data;
1860 	struct ctl_lun *lun;
1861 	struct ctl_port *port;
1862 	struct tpc_list *list, *tlist;
1863 	struct tpc_token *token;
1864 	int len, lendesc;
1865 
1866 	CTL_DEBUG_PRINT(("ctl_populate_token\n"));
1867 
1868 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1869 	port = control_softc->ctl_ports[ctl_port_idx(ctsio->io_hdr.nexus.targ_port)];
1870 	cdb = (struct scsi_populate_token *)ctsio->cdb;
1871 	len = scsi_4btoul(cdb->length);
1872 
1873 	if (len < sizeof(struct scsi_populate_token_data) ||
1874 	    len > sizeof(struct scsi_populate_token_data) +
1875 	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
1876 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1877 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1878 		goto done;
1879 	}
1880 
1881 	/*
1882 	 * If we've got a kernel request that hasn't been malloced yet,
1883 	 * malloc it and tell the caller the data buffer is here.
1884 	 */
1885 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1886 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1887 		ctsio->kern_data_len = len;
1888 		ctsio->kern_total_len = len;
1889 		ctsio->kern_data_resid = 0;
1890 		ctsio->kern_rel_offset = 0;
1891 		ctsio->kern_sg_entries = 0;
1892 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1893 		ctsio->be_move_done = ctl_config_move_done;
1894 		ctl_datamove((union ctl_io *)ctsio);
1895 
1896 		return (CTL_RETVAL_COMPLETE);
1897 	}
1898 
1899 	data = (struct scsi_populate_token_data *)ctsio->kern_data_ptr;
1900 	lendesc = scsi_2btoul(data->range_descriptor_length);
1901 	if (len < sizeof(struct scsi_populate_token_data) + lendesc) {
1902 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1903 		    /*field*/ 2, /*bit_valid*/ 0, /*bit*/ 0);
1904 		goto done;
1905 	}
1906 /*
1907 	printf("PT(list=%u) flags=%x to=%d rt=%x len=%x\n",
1908 	    scsi_4btoul(cdb->list_identifier),
1909 	    data->flags, scsi_4btoul(data->inactivity_timeout),
1910 	    scsi_4btoul(data->rod_type),
1911 	    scsi_2btoul(data->range_descriptor_length));
1912 */
1913 	if ((data->flags & EC_PT_RTV) &&
1914 	    scsi_4btoul(data->rod_type) != ROD_TYPE_AUR) {
1915 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1916 		    /*field*/ 8, /*bit_valid*/ 0, /*bit*/ 0);
1917 		goto done;
1918 	}
1919 
1920 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1921 	list->service_action = cdb->service_action;
1922 	list->init_port = ctsio->io_hdr.nexus.targ_port;
1923 	list->init_idx = ctl_get_resindex(&ctsio->io_hdr.nexus);
1924 	list->list_id = scsi_4btoul(cdb->list_identifier);
1925 	list->flags = data->flags;
1926 	list->ctsio = ctsio;
1927 	list->lun = lun;
1928 	mtx_lock(&lun->lun_lock);
1929 	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1930 	if (tlist != NULL && !tlist->completed) {
1931 		mtx_unlock(&lun->lun_lock);
1932 		free(list, M_CTL);
1933 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1934 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1935 		    /*bit*/ 0);
1936 		goto done;
1937 	}
1938 	if (tlist != NULL) {
1939 		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1940 		free(tlist, M_CTL);
1941 	}
1942 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1943 	mtx_unlock(&lun->lun_lock);
1944 
1945 	token = malloc(sizeof(*token), M_CTL, M_WAITOK | M_ZERO);
1946 	token->lun = lun->lun;
1947 	token->blocksize = lun->be_lun->blocksize;
1948 	token->params = ctsio->kern_data_ptr;
1949 	token->range = &data->desc[0];
1950 	token->nrange = scsi_2btoul(data->range_descriptor_length) /
1951 	    sizeof(struct scsi_range_desc);
1952 	list->cursectors = tpc_ranges_length(token->range, token->nrange);
1953 	list->curbytes = (off_t)list->cursectors * lun->be_lun->blocksize;
1954 	tpc_create_token(lun, port, list->curbytes,
1955 	    (struct scsi_token *)token->token);
1956 	token->active = 0;
1957 	token->last_active = time_uptime;
1958 	token->timeout = scsi_4btoul(data->inactivity_timeout);
1959 	if (token->timeout == 0)
1960 		token->timeout = TPC_DFL_TOKEN_TIMEOUT;
1961 	else if (token->timeout < TPC_MIN_TOKEN_TIMEOUT)
1962 		token->timeout = TPC_MIN_TOKEN_TIMEOUT;
1963 	else if (token->timeout > TPC_MAX_TOKEN_TIMEOUT) {
1964 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1965 		    /*command*/ 0, /*field*/ 4, /*bit_valid*/ 0,
1966 		    /*bit*/ 0);
1967 	}
1968 	memcpy(list->res_token, token->token, sizeof(list->res_token));
1969 	list->res_token_valid = 1;
1970 	list->curseg = 0;
1971 	list->completed = 1;
1972 	list->last_active = time_uptime;
1973 	mtx_lock(&control_softc->ctl_lock);
1974 	TAILQ_INSERT_TAIL(&control_softc->tpc_tokens, token, links);
1975 	mtx_unlock(&control_softc->ctl_lock);
1976 	ctl_set_success(ctsio);
1977 	ctl_done((union ctl_io *)ctsio);
1978 	return (CTL_RETVAL_COMPLETE);
1979 
1980 done:
1981 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED)
1982 		free(ctsio->kern_data_ptr, M_CTL);
1983 	ctl_done((union ctl_io *)ctsio);
1984 	return (CTL_RETVAL_COMPLETE);
1985 }
1986 
1987 int
1988 ctl_write_using_token(struct ctl_scsiio *ctsio)
1989 {
1990 	struct scsi_write_using_token *cdb;
1991 	struct scsi_write_using_token_data *data;
1992 	struct ctl_lun *lun;
1993 	struct tpc_list *list, *tlist;
1994 	struct tpc_token *token;
1995 	int len, lendesc;
1996 
1997 	CTL_DEBUG_PRINT(("ctl_write_using_token\n"));
1998 
1999 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2000 	cdb = (struct scsi_write_using_token *)ctsio->cdb;
2001 	len = scsi_4btoul(cdb->length);
2002 
2003 	if (len < sizeof(struct scsi_populate_token_data) ||
2004 	    len > sizeof(struct scsi_populate_token_data) +
2005 	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
2006 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
2007 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
2008 		goto done;
2009 	}
2010 
2011 	/*
2012 	 * If we've got a kernel request that hasn't been malloced yet,
2013 	 * malloc it and tell the caller the data buffer is here.
2014 	 */
2015 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2016 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2017 		ctsio->kern_data_len = len;
2018 		ctsio->kern_total_len = len;
2019 		ctsio->kern_data_resid = 0;
2020 		ctsio->kern_rel_offset = 0;
2021 		ctsio->kern_sg_entries = 0;
2022 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2023 		ctsio->be_move_done = ctl_config_move_done;
2024 		ctl_datamove((union ctl_io *)ctsio);
2025 
2026 		return (CTL_RETVAL_COMPLETE);
2027 	}
2028 
2029 	data = (struct scsi_write_using_token_data *)ctsio->kern_data_ptr;
2030 	lendesc = scsi_2btoul(data->range_descriptor_length);
2031 	if (len < sizeof(struct scsi_populate_token_data) + lendesc) {
2032 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2033 		    /*field*/ 2, /*bit_valid*/ 0, /*bit*/ 0);
2034 		goto done;
2035 	}
2036 /*
2037 	printf("WUT(list=%u) flags=%x off=%ju len=%x\n",
2038 	    scsi_4btoul(cdb->list_identifier),
2039 	    data->flags, scsi_8btou64(data->offset_into_rod),
2040 	    scsi_2btoul(data->range_descriptor_length));
2041 */
2042 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2043 	list->service_action = cdb->service_action;
2044 	list->init_port = ctsio->io_hdr.nexus.targ_port;
2045 	list->init_idx = ctl_get_resindex(&ctsio->io_hdr.nexus);
2046 	list->list_id = scsi_4btoul(cdb->list_identifier);
2047 	list->flags = data->flags;
2048 	list->params = ctsio->kern_data_ptr;
2049 	list->range = &data->desc[0];
2050 	list->nrange = scsi_2btoul(data->range_descriptor_length) /
2051 	    sizeof(struct scsi_range_desc);
2052 	list->offset_into_rod = scsi_8btou64(data->offset_into_rod);
2053 	list->ctsio = ctsio;
2054 	list->lun = lun;
2055 	mtx_lock(&lun->lun_lock);
2056 	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2057 	if (tlist != NULL && !tlist->completed) {
2058 		mtx_unlock(&lun->lun_lock);
2059 		free(list, M_CTL);
2060 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2061 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2062 		    /*bit*/ 0);
2063 		goto done;
2064 	}
2065 	if (tlist != NULL) {
2066 		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2067 		free(tlist, M_CTL);
2068 	}
2069 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2070 	mtx_unlock(&lun->lun_lock);
2071 
2072 	/* Block device zero ROD token -> no token. */
2073 	if (scsi_4btoul(data->rod_token) == ROD_TYPE_BLOCK_ZERO) {
2074 		tpc_process(list);
2075 		return (CTL_RETVAL_COMPLETE);
2076 	}
2077 
2078 	mtx_lock(&control_softc->ctl_lock);
2079 	TAILQ_FOREACH(token, &control_softc->tpc_tokens, links) {
2080 		if (memcmp(token->token, data->rod_token,
2081 		    sizeof(data->rod_token)) == 0)
2082 			break;
2083 	}
2084 	if (token != NULL) {
2085 		token->active++;
2086 		list->token = token;
2087 		if (data->flags & EC_WUT_DEL_TKN)
2088 			token->timeout = 0;
2089 	}
2090 	mtx_unlock(&control_softc->ctl_lock);
2091 	if (token == NULL) {
2092 		mtx_lock(&lun->lun_lock);
2093 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2094 		mtx_unlock(&lun->lun_lock);
2095 		free(list, M_CTL);
2096 		ctl_set_sense(ctsio, /*current_error*/ 1,
2097 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2098 		    /*asc*/ 0x23, /*ascq*/ 0x04, SSD_ELEM_NONE);
2099 		goto done;
2100 	}
2101 
2102 	tpc_process(list);
2103 	return (CTL_RETVAL_COMPLETE);
2104 
2105 done:
2106 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED)
2107 		free(ctsio->kern_data_ptr, M_CTL);
2108 	ctl_done((union ctl_io *)ctsio);
2109 	return (CTL_RETVAL_COMPLETE);
2110 }
2111 
2112 int
2113 ctl_receive_rod_token_information(struct ctl_scsiio *ctsio)
2114 {
2115 	struct ctl_lun *lun;
2116 	struct scsi_receive_rod_token_information *cdb;
2117 	struct scsi_receive_copy_status_lid4_data *data;
2118 	struct tpc_list *list;
2119 	struct tpc_list list_copy;
2120 	uint8_t *ptr;
2121 	int retval;
2122 	int alloc_len, total_len, token_len;
2123 	uint32_t list_id;
2124 
2125 	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2126 
2127 	cdb = (struct scsi_receive_rod_token_information *)ctsio->cdb;
2128 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2129 
2130 	retval = CTL_RETVAL_COMPLETE;
2131 
2132 	list_id = scsi_4btoul(cdb->list_identifier);
2133 	mtx_lock(&lun->lun_lock);
2134 	list = tpc_find_list(lun, list_id,
2135 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
2136 	if (list == NULL) {
2137 		mtx_unlock(&lun->lun_lock);
2138 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2139 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
2140 		    /*bit*/ 0);
2141 		ctl_done((union ctl_io *)ctsio);
2142 		return (retval);
2143 	}
2144 	list_copy = *list;
2145 	if (list->completed) {
2146 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2147 		free(list, M_CTL);
2148 	}
2149 	mtx_unlock(&lun->lun_lock);
2150 
2151 	token_len = list_copy.res_token_valid ? 2 + sizeof(list_copy.res_token) : 0;
2152 	total_len = sizeof(*data) + list_copy.sense_len + 4 + token_len;
2153 	alloc_len = scsi_4btoul(cdb->length);
2154 
2155 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2156 
2157 	ctsio->kern_sg_entries = 0;
2158 
2159 	if (total_len < alloc_len) {
2160 		ctsio->residual = alloc_len - total_len;
2161 		ctsio->kern_data_len = total_len;
2162 		ctsio->kern_total_len = total_len;
2163 	} else {
2164 		ctsio->residual = 0;
2165 		ctsio->kern_data_len = alloc_len;
2166 		ctsio->kern_total_len = alloc_len;
2167 	}
2168 	ctsio->kern_data_resid = 0;
2169 	ctsio->kern_rel_offset = 0;
2170 
2171 	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
2172 	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len +
2173 	    4 + token_len, data->available_data);
2174 	data->response_to_service_action = list_copy.service_action;
2175 	if (list_copy.completed) {
2176 		if (list_copy.error)
2177 			data->copy_command_status = RCS_CCS_ERROR;
2178 		else if (list_copy.abort)
2179 			data->copy_command_status = RCS_CCS_ABORTED;
2180 		else
2181 			data->copy_command_status = RCS_CCS_COMPLETED;
2182 	} else
2183 		data->copy_command_status = RCS_CCS_INPROG_FG;
2184 	scsi_ulto2b(list_copy.curops, data->operation_counter);
2185 	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
2186 	data->transfer_count_units = RCS_TC_LBAS;
2187 	scsi_u64to8b(list_copy.cursectors, data->transfer_count);
2188 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
2189 	data->length_of_the_sense_data_field = list_copy.sense_len;
2190 	data->sense_data_length = list_copy.sense_len;
2191 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
2192 
2193 	ptr = &data->sense_data[data->length_of_the_sense_data_field];
2194 	scsi_ulto4b(token_len, &ptr[0]);
2195 	if (list_copy.res_token_valid) {
2196 		scsi_ulto2b(0, &ptr[4]);
2197 		memcpy(&ptr[6], list_copy.res_token, sizeof(list_copy.res_token));
2198 	}
2199 /*
2200 	printf("RRTI(list=%u) valid=%d\n",
2201 	    scsi_4btoul(cdb->list_identifier), list_copy.res_token_valid);
2202 */
2203 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2204 	ctsio->be_move_done = ctl_config_move_done;
2205 
2206 	ctl_datamove((union ctl_io *)ctsio);
2207 	return (retval);
2208 }
2209 
2210 int
2211 ctl_report_all_rod_tokens(struct ctl_scsiio *ctsio)
2212 {
2213 	struct ctl_lun *lun;
2214 	struct scsi_report_all_rod_tokens *cdb;
2215 	struct scsi_report_all_rod_tokens_data *data;
2216 	struct tpc_token *token;
2217 	int retval;
2218 	int alloc_len, total_len, tokens, i;
2219 
2220 	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2221 
2222 	cdb = (struct scsi_report_all_rod_tokens *)ctsio->cdb;
2223 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2224 
2225 	retval = CTL_RETVAL_COMPLETE;
2226 
2227 	tokens = 0;
2228 	mtx_lock(&control_softc->ctl_lock);
2229 	TAILQ_FOREACH(token, &control_softc->tpc_tokens, links)
2230 		tokens++;
2231 	mtx_unlock(&control_softc->ctl_lock);
2232 	if (tokens > 512)
2233 		tokens = 512;
2234 
2235 	total_len = sizeof(*data) + tokens * 96;
2236 	alloc_len = scsi_4btoul(cdb->length);
2237 
2238 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2239 
2240 	ctsio->kern_sg_entries = 0;
2241 
2242 	if (total_len < alloc_len) {
2243 		ctsio->residual = alloc_len - total_len;
2244 		ctsio->kern_data_len = total_len;
2245 		ctsio->kern_total_len = total_len;
2246 	} else {
2247 		ctsio->residual = 0;
2248 		ctsio->kern_data_len = alloc_len;
2249 		ctsio->kern_total_len = alloc_len;
2250 	}
2251 	ctsio->kern_data_resid = 0;
2252 	ctsio->kern_rel_offset = 0;
2253 
2254 	data = (struct scsi_report_all_rod_tokens_data *)ctsio->kern_data_ptr;
2255 	i = 0;
2256 	mtx_lock(&control_softc->ctl_lock);
2257 	TAILQ_FOREACH(token, &control_softc->tpc_tokens, links) {
2258 		if (i >= tokens)
2259 			break;
2260 		memcpy(&data->rod_management_token_list[i * 96],
2261 		    token->token, 96);
2262 		i++;
2263 	}
2264 	mtx_unlock(&control_softc->ctl_lock);
2265 	scsi_ulto4b(sizeof(*data) - 4 + i * 96, data->available_data);
2266 /*
2267 	printf("RART tokens=%d\n", i);
2268 */
2269 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2270 	ctsio->be_move_done = ctl_config_move_done;
2271 
2272 	ctl_datamove((union ctl_io *)ctsio);
2273 	return (retval);
2274 }
2275 
2276