xref: /freebsd/sys/cam/ctl/ctl_tpc.c (revision 63d1fd5970ec814904aa0f4580b10a0d302d08b2)
1 /*-
2  * Copyright (c) 2014 Alexander Motin <mav@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification, immediately at the beginning of the file.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/types.h>
34 #include <sys/lock.h>
35 #include <sys/module.h>
36 #include <sys/mutex.h>
37 #include <sys/condvar.h>
38 #include <sys/malloc.h>
39 #include <sys/conf.h>
40 #include <sys/queue.h>
41 #include <sys/sysctl.h>
42 #include <machine/atomic.h>
43 
44 #include <cam/cam.h>
45 #include <cam/scsi/scsi_all.h>
46 #include <cam/scsi/scsi_da.h>
47 #include <cam/ctl/ctl_io.h>
48 #include <cam/ctl/ctl.h>
49 #include <cam/ctl/ctl_frontend.h>
50 #include <cam/ctl/ctl_util.h>
51 #include <cam/ctl/ctl_backend.h>
52 #include <cam/ctl/ctl_ioctl.h>
53 #include <cam/ctl/ctl_ha.h>
54 #include <cam/ctl/ctl_private.h>
55 #include <cam/ctl/ctl_debug.h>
56 #include <cam/ctl/ctl_scsi_all.h>
57 #include <cam/ctl/ctl_tpc.h>
58 #include <cam/ctl/ctl_error.h>
59 
60 #define	TPC_MAX_CSCDS	64
61 #define	TPC_MAX_SEGS	64
62 #define	TPC_MAX_SEG	0
63 #define	TPC_MAX_LIST	8192
64 #define	TPC_MAX_INLINE	0
65 #define	TPC_MAX_LISTS	255
66 #define	TPC_MAX_IO_SIZE	(1024 * 1024)
67 #define	TPC_MAX_IOCHUNK_SIZE	(TPC_MAX_IO_SIZE * 16)
68 #define	TPC_MIN_TOKEN_TIMEOUT	1
69 #define	TPC_DFL_TOKEN_TIMEOUT	60
70 #define	TPC_MAX_TOKEN_TIMEOUT	600
71 
72 MALLOC_DEFINE(M_CTL_TPC, "ctltpc", "CTL TPC");
73 
74 typedef enum {
75 	TPC_ERR_RETRY		= 0x000,
76 	TPC_ERR_FAIL		= 0x001,
77 	TPC_ERR_MASK		= 0x0ff,
78 	TPC_ERR_NO_DECREMENT	= 0x100
79 } tpc_error_action;
80 
81 struct tpc_list;
82 TAILQ_HEAD(runl, tpc_io);
83 struct tpc_io {
84 	union ctl_io		*io;
85 	uint8_t			 target;
86 	uint32_t		 cscd;
87 	uint64_t		 lun;
88 	struct tpc_list		*list;
89 	struct runl		 run;
90 	TAILQ_ENTRY(tpc_io)	 rlinks;
91 	TAILQ_ENTRY(tpc_io)	 links;
92 };
93 
94 struct tpc_token {
95 	uint8_t			 token[512];
96 	uint64_t		 lun;
97 	uint32_t		 blocksize;
98 	uint8_t			*params;
99 	struct scsi_range_desc	*range;
100 	int			 nrange;
101 	int			 active;
102 	time_t			 last_active;
103 	uint32_t		 timeout;
104 	TAILQ_ENTRY(tpc_token)	 links;
105 };
106 
107 struct tpc_list {
108 	uint8_t			 service_action;
109 	int			 init_port;
110 	uint32_t		 init_idx;
111 	uint32_t		 list_id;
112 	uint8_t			 flags;
113 	uint8_t			*params;
114 	struct scsi_ec_cscd	*cscd;
115 	struct scsi_ec_segment	*seg[TPC_MAX_SEGS];
116 	uint8_t			*inl;
117 	int			 ncscd;
118 	int			 nseg;
119 	int			 leninl;
120 	struct tpc_token	*token;
121 	struct scsi_range_desc	*range;
122 	int			 nrange;
123 	off_t			 offset_into_rod;
124 
125 	int			 curseg;
126 	off_t			 cursectors;
127 	off_t			 curbytes;
128 	int			 curops;
129 	int			 stage;
130 	uint8_t			*buf;
131 	off_t			 segsectors;
132 	off_t			 segbytes;
133 	int			 tbdio;
134 	int			 error;
135 	int			 abort;
136 	int			 completed;
137 	time_t			 last_active;
138 	TAILQ_HEAD(, tpc_io)	 allio;
139 	struct scsi_sense_data	 fwd_sense_data;
140 	uint8_t			 fwd_sense_len;
141 	uint8_t			 fwd_scsi_status;
142 	uint8_t			 fwd_target;
143 	uint16_t		 fwd_cscd;
144 	struct scsi_sense_data	 sense_data;
145 	uint8_t			 sense_len;
146 	uint8_t			 scsi_status;
147 	struct ctl_scsiio	*ctsio;
148 	struct ctl_lun		*lun;
149 	int			 res_token_valid;
150 	uint8_t			 res_token[512];
151 	TAILQ_ENTRY(tpc_list)	 links;
152 };
153 
154 static void
155 tpc_timeout(void *arg)
156 {
157 	struct ctl_softc *softc = arg;
158 	struct ctl_lun *lun;
159 	struct tpc_token *token, *ttoken;
160 	struct tpc_list *list, *tlist;
161 
162 	/* Free completed lists with expired timeout. */
163 	STAILQ_FOREACH(lun, &softc->lun_list, links) {
164 		mtx_lock(&lun->lun_lock);
165 		TAILQ_FOREACH_SAFE(list, &lun->tpc_lists, links, tlist) {
166 			if (!list->completed || time_uptime < list->last_active +
167 			    TPC_DFL_TOKEN_TIMEOUT)
168 				continue;
169 			TAILQ_REMOVE(&lun->tpc_lists, list, links);
170 			free(list, M_CTL);
171 		}
172 		mtx_unlock(&lun->lun_lock);
173 	}
174 
175 	/* Free inactive ROD tokens with expired timeout. */
176 	mtx_lock(&softc->tpc_lock);
177 	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
178 		if (token->active ||
179 		    time_uptime < token->last_active + token->timeout + 1)
180 			continue;
181 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
182 		free(token->params, M_CTL);
183 		free(token, M_CTL);
184 	}
185 	mtx_unlock(&softc->tpc_lock);
186 	callout_schedule(&softc->tpc_timeout, hz);
187 }
188 
189 void
190 ctl_tpc_init(struct ctl_softc *softc)
191 {
192 
193 	mtx_init(&softc->tpc_lock, "CTL TPC mutex", NULL, MTX_DEF);
194 	TAILQ_INIT(&softc->tpc_tokens);
195 	callout_init_mtx(&softc->tpc_timeout, &softc->ctl_lock, 0);
196 	callout_reset(&softc->tpc_timeout, hz, tpc_timeout, softc);
197 }
198 
199 void
200 ctl_tpc_shutdown(struct ctl_softc *softc)
201 {
202 	struct tpc_token *token;
203 
204 	callout_drain(&softc->tpc_timeout);
205 
206 	/* Free ROD tokens. */
207 	mtx_lock(&softc->tpc_lock);
208 	while ((token = TAILQ_FIRST(&softc->tpc_tokens)) != NULL) {
209 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
210 		free(token->params, M_CTL);
211 		free(token, M_CTL);
212 	}
213 	mtx_unlock(&softc->tpc_lock);
214 	mtx_destroy(&softc->tpc_lock);
215 }
216 
217 void
218 ctl_tpc_lun_init(struct ctl_lun *lun)
219 {
220 
221 	TAILQ_INIT(&lun->tpc_lists);
222 }
223 
224 void
225 ctl_tpc_lun_shutdown(struct ctl_lun *lun)
226 {
227 	struct ctl_softc *softc = lun->ctl_softc;
228 	struct tpc_list *list;
229 	struct tpc_token *token, *ttoken;
230 
231 	/* Free lists for this LUN. */
232 	while ((list = TAILQ_FIRST(&lun->tpc_lists)) != NULL) {
233 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
234 		KASSERT(list->completed,
235 		    ("Not completed TPC (%p) on shutdown", list));
236 		free(list, M_CTL);
237 	}
238 
239 	/* Free ROD tokens for this LUN. */
240 	mtx_lock(&softc->tpc_lock);
241 	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
242 		if (token->lun != lun->lun || token->active)
243 			continue;
244 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
245 		free(token->params, M_CTL);
246 		free(token, M_CTL);
247 	}
248 	mtx_unlock(&softc->tpc_lock);
249 }
250 
251 int
252 ctl_inquiry_evpd_tpc(struct ctl_scsiio *ctsio, int alloc_len)
253 {
254 	struct ctl_lun *lun = CTL_LUN(ctsio);
255 	struct scsi_vpd_tpc *tpc_ptr;
256 	struct scsi_vpd_tpc_descriptor *d_ptr;
257 	struct scsi_vpd_tpc_descriptor_bdrl *bdrl_ptr;
258 	struct scsi_vpd_tpc_descriptor_sc *sc_ptr;
259 	struct scsi_vpd_tpc_descriptor_sc_descr *scd_ptr;
260 	struct scsi_vpd_tpc_descriptor_pd *pd_ptr;
261 	struct scsi_vpd_tpc_descriptor_sd *sd_ptr;
262 	struct scsi_vpd_tpc_descriptor_sdid *sdid_ptr;
263 	struct scsi_vpd_tpc_descriptor_rtf *rtf_ptr;
264 	struct scsi_vpd_tpc_descriptor_rtf_block *rtfb_ptr;
265 	struct scsi_vpd_tpc_descriptor_srt *srt_ptr;
266 	struct scsi_vpd_tpc_descriptor_srtd *srtd_ptr;
267 	struct scsi_vpd_tpc_descriptor_gco *gco_ptr;
268 	int data_len;
269 
270 	data_len = sizeof(struct scsi_vpd_tpc) +
271 	    sizeof(struct scsi_vpd_tpc_descriptor_bdrl) +
272 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sc) +
273 	     2 * sizeof(struct scsi_vpd_tpc_descriptor_sc_descr) + 11, 4) +
274 	    sizeof(struct scsi_vpd_tpc_descriptor_pd) +
275 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sd) + 4, 4) +
276 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sdid) + 2, 4) +
277 	    sizeof(struct scsi_vpd_tpc_descriptor_rtf) +
278 	     sizeof(struct scsi_vpd_tpc_descriptor_rtf_block) +
279 	    sizeof(struct scsi_vpd_tpc_descriptor_srt) +
280 	     2*sizeof(struct scsi_vpd_tpc_descriptor_srtd) +
281 	    sizeof(struct scsi_vpd_tpc_descriptor_gco);
282 
283 	ctsio->kern_data_ptr = malloc(data_len, M_CTL, M_WAITOK | M_ZERO);
284 	tpc_ptr = (struct scsi_vpd_tpc *)ctsio->kern_data_ptr;
285 	ctsio->kern_sg_entries = 0;
286 
287 	if (data_len < alloc_len) {
288 		ctsio->residual = alloc_len - data_len;
289 		ctsio->kern_data_len = data_len;
290 		ctsio->kern_total_len = data_len;
291 	} else {
292 		ctsio->residual = 0;
293 		ctsio->kern_data_len = alloc_len;
294 		ctsio->kern_total_len = alloc_len;
295 	}
296 	ctsio->kern_data_resid = 0;
297 	ctsio->kern_rel_offset = 0;
298 	ctsio->kern_sg_entries = 0;
299 
300 	/*
301 	 * The control device is always connected.  The disk device, on the
302 	 * other hand, may not be online all the time.
303 	 */
304 	if (lun != NULL)
305 		tpc_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
306 				     lun->be_lun->lun_type;
307 	else
308 		tpc_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
309 	tpc_ptr->page_code = SVPD_SCSI_TPC;
310 	scsi_ulto2b(data_len - 4, tpc_ptr->page_length);
311 
312 	/* Block Device ROD Limits */
313 	d_ptr = (struct scsi_vpd_tpc_descriptor *)&tpc_ptr->descr[0];
314 	bdrl_ptr = (struct scsi_vpd_tpc_descriptor_bdrl *)d_ptr;
315 	scsi_ulto2b(SVPD_TPC_BDRL, bdrl_ptr->desc_type);
316 	scsi_ulto2b(sizeof(*bdrl_ptr) - 4, bdrl_ptr->desc_length);
317 	scsi_ulto2b(TPC_MAX_SEGS, bdrl_ptr->maximum_ranges);
318 	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
319 	    bdrl_ptr->maximum_inactivity_timeout);
320 	scsi_ulto4b(TPC_DFL_TOKEN_TIMEOUT,
321 	    bdrl_ptr->default_inactivity_timeout);
322 	scsi_u64to8b(0, bdrl_ptr->maximum_token_transfer_size);
323 	scsi_u64to8b(0, bdrl_ptr->optimal_transfer_count);
324 
325 	/* Supported commands */
326 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
327 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
328 	sc_ptr = (struct scsi_vpd_tpc_descriptor_sc *)d_ptr;
329 	scsi_ulto2b(SVPD_TPC_SC, sc_ptr->desc_type);
330 	sc_ptr->list_length = 2 * sizeof(*scd_ptr) + 11;
331 	scsi_ulto2b(roundup2(1 + sc_ptr->list_length, 4), sc_ptr->desc_length);
332 	scd_ptr = &sc_ptr->descr[0];
333 	scd_ptr->opcode = EXTENDED_COPY;
334 	scd_ptr->sa_length = 5;
335 	scd_ptr->supported_service_actions[0] = EC_EC_LID1;
336 	scd_ptr->supported_service_actions[1] = EC_EC_LID4;
337 	scd_ptr->supported_service_actions[2] = EC_PT;
338 	scd_ptr->supported_service_actions[3] = EC_WUT;
339 	scd_ptr->supported_service_actions[4] = EC_COA;
340 	scd_ptr = (struct scsi_vpd_tpc_descriptor_sc_descr *)
341 	    &scd_ptr->supported_service_actions[scd_ptr->sa_length];
342 	scd_ptr->opcode = RECEIVE_COPY_STATUS;
343 	scd_ptr->sa_length = 6;
344 	scd_ptr->supported_service_actions[0] = RCS_RCS_LID1;
345 	scd_ptr->supported_service_actions[1] = RCS_RCFD;
346 	scd_ptr->supported_service_actions[2] = RCS_RCS_LID4;
347 	scd_ptr->supported_service_actions[3] = RCS_RCOP;
348 	scd_ptr->supported_service_actions[4] = RCS_RRTI;
349 	scd_ptr->supported_service_actions[5] = RCS_RART;
350 
351 	/* Parameter data. */
352 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
353 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
354 	pd_ptr = (struct scsi_vpd_tpc_descriptor_pd *)d_ptr;
355 	scsi_ulto2b(SVPD_TPC_PD, pd_ptr->desc_type);
356 	scsi_ulto2b(sizeof(*pd_ptr) - 4, pd_ptr->desc_length);
357 	scsi_ulto2b(TPC_MAX_CSCDS, pd_ptr->maximum_cscd_descriptor_count);
358 	scsi_ulto2b(TPC_MAX_SEGS, pd_ptr->maximum_segment_descriptor_count);
359 	scsi_ulto4b(TPC_MAX_LIST, pd_ptr->maximum_descriptor_list_length);
360 	scsi_ulto4b(TPC_MAX_INLINE, pd_ptr->maximum_inline_data_length);
361 
362 	/* Supported Descriptors */
363 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
364 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
365 	sd_ptr = (struct scsi_vpd_tpc_descriptor_sd *)d_ptr;
366 	scsi_ulto2b(SVPD_TPC_SD, sd_ptr->desc_type);
367 	scsi_ulto2b(roundup2(sizeof(*sd_ptr) - 4 + 4, 4), sd_ptr->desc_length);
368 	sd_ptr->list_length = 4;
369 	sd_ptr->supported_descriptor_codes[0] = EC_SEG_B2B;
370 	sd_ptr->supported_descriptor_codes[1] = EC_SEG_VERIFY;
371 	sd_ptr->supported_descriptor_codes[2] = EC_SEG_REGISTER_KEY;
372 	sd_ptr->supported_descriptor_codes[3] = EC_CSCD_ID;
373 
374 	/* Supported CSCD Descriptor IDs */
375 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
376 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
377 	sdid_ptr = (struct scsi_vpd_tpc_descriptor_sdid *)d_ptr;
378 	scsi_ulto2b(SVPD_TPC_SDID, sdid_ptr->desc_type);
379 	scsi_ulto2b(roundup2(sizeof(*sdid_ptr) - 4 + 2, 4), sdid_ptr->desc_length);
380 	scsi_ulto2b(2, sdid_ptr->list_length);
381 	scsi_ulto2b(0xffff, &sdid_ptr->supported_descriptor_ids[0]);
382 
383 	/* ROD Token Features */
384 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
385 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
386 	rtf_ptr = (struct scsi_vpd_tpc_descriptor_rtf *)d_ptr;
387 	scsi_ulto2b(SVPD_TPC_RTF, rtf_ptr->desc_type);
388 	scsi_ulto2b(sizeof(*rtf_ptr) - 4 + sizeof(*rtfb_ptr), rtf_ptr->desc_length);
389 	rtf_ptr->remote_tokens = 0;
390 	scsi_ulto4b(TPC_MIN_TOKEN_TIMEOUT, rtf_ptr->minimum_token_lifetime);
391 	scsi_ulto4b(UINT32_MAX, rtf_ptr->maximum_token_lifetime);
392 	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
393 	    rtf_ptr->maximum_token_inactivity_timeout);
394 	scsi_ulto2b(sizeof(*rtfb_ptr), rtf_ptr->type_specific_features_length);
395 	rtfb_ptr = (struct scsi_vpd_tpc_descriptor_rtf_block *)
396 	    &rtf_ptr->type_specific_features;
397 	rtfb_ptr->type_format = SVPD_TPC_RTF_BLOCK;
398 	scsi_ulto2b(sizeof(*rtfb_ptr) - 4, rtfb_ptr->desc_length);
399 	scsi_ulto2b(0, rtfb_ptr->optimal_length_granularity);
400 	scsi_u64to8b(0, rtfb_ptr->maximum_bytes);
401 	scsi_u64to8b(0, rtfb_ptr->optimal_bytes);
402 	scsi_u64to8b(UINT64_MAX, rtfb_ptr->optimal_bytes_to_token_per_segment);
403 	scsi_u64to8b(TPC_MAX_IOCHUNK_SIZE,
404 	    rtfb_ptr->optimal_bytes_from_token_per_segment);
405 
406 	/* Supported ROD Tokens */
407 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
408 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
409 	srt_ptr = (struct scsi_vpd_tpc_descriptor_srt *)d_ptr;
410 	scsi_ulto2b(SVPD_TPC_SRT, srt_ptr->desc_type);
411 	scsi_ulto2b(sizeof(*srt_ptr) - 4 + 2*sizeof(*srtd_ptr), srt_ptr->desc_length);
412 	scsi_ulto2b(2*sizeof(*srtd_ptr), srt_ptr->rod_type_descriptors_length);
413 	srtd_ptr = (struct scsi_vpd_tpc_descriptor_srtd *)
414 	    &srt_ptr->rod_type_descriptors;
415 	scsi_ulto4b(ROD_TYPE_AUR, srtd_ptr->rod_type);
416 	srtd_ptr->flags = SVPD_TPC_SRTD_TIN | SVPD_TPC_SRTD_TOUT;
417 	scsi_ulto2b(0, srtd_ptr->preference_indicator);
418 	srtd_ptr++;
419 	scsi_ulto4b(ROD_TYPE_BLOCK_ZERO, srtd_ptr->rod_type);
420 	srtd_ptr->flags = SVPD_TPC_SRTD_TIN;
421 	scsi_ulto2b(0, srtd_ptr->preference_indicator);
422 
423 	/* General Copy Operations */
424 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
425 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
426 	gco_ptr = (struct scsi_vpd_tpc_descriptor_gco *)d_ptr;
427 	scsi_ulto2b(SVPD_TPC_GCO, gco_ptr->desc_type);
428 	scsi_ulto2b(sizeof(*gco_ptr) - 4, gco_ptr->desc_length);
429 	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->total_concurrent_copies);
430 	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->maximum_identified_concurrent_copies);
431 	scsi_ulto4b(TPC_MAX_SEG, gco_ptr->maximum_segment_length);
432 	gco_ptr->data_segment_granularity = 0;
433 	gco_ptr->inline_data_granularity = 0;
434 
435 	ctl_set_success(ctsio);
436 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
437 	ctsio->be_move_done = ctl_config_move_done;
438 	ctl_datamove((union ctl_io *)ctsio);
439 
440 	return (CTL_RETVAL_COMPLETE);
441 }
442 
443 int
444 ctl_receive_copy_operating_parameters(struct ctl_scsiio *ctsio)
445 {
446 	struct scsi_receive_copy_operating_parameters *cdb;
447 	struct scsi_receive_copy_operating_parameters_data *data;
448 	int retval;
449 	int alloc_len, total_len;
450 
451 	CTL_DEBUG_PRINT(("ctl_report_supported_tmf\n"));
452 
453 	cdb = (struct scsi_receive_copy_operating_parameters *)ctsio->cdb;
454 
455 	retval = CTL_RETVAL_COMPLETE;
456 
457 	total_len = sizeof(*data) + 4;
458 	alloc_len = scsi_4btoul(cdb->length);
459 
460 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
461 
462 	ctsio->kern_sg_entries = 0;
463 
464 	if (total_len < alloc_len) {
465 		ctsio->residual = alloc_len - total_len;
466 		ctsio->kern_data_len = total_len;
467 		ctsio->kern_total_len = total_len;
468 	} else {
469 		ctsio->residual = 0;
470 		ctsio->kern_data_len = alloc_len;
471 		ctsio->kern_total_len = alloc_len;
472 	}
473 	ctsio->kern_data_resid = 0;
474 	ctsio->kern_rel_offset = 0;
475 
476 	data = (struct scsi_receive_copy_operating_parameters_data *)ctsio->kern_data_ptr;
477 	scsi_ulto4b(sizeof(*data) - 4 + 4, data->length);
478 	data->snlid = RCOP_SNLID;
479 	scsi_ulto2b(TPC_MAX_CSCDS, data->maximum_cscd_descriptor_count);
480 	scsi_ulto2b(TPC_MAX_SEGS, data->maximum_segment_descriptor_count);
481 	scsi_ulto4b(TPC_MAX_LIST, data->maximum_descriptor_list_length);
482 	scsi_ulto4b(TPC_MAX_SEG, data->maximum_segment_length);
483 	scsi_ulto4b(TPC_MAX_INLINE, data->maximum_inline_data_length);
484 	scsi_ulto4b(0, data->held_data_limit);
485 	scsi_ulto4b(0, data->maximum_stream_device_transfer_size);
486 	scsi_ulto2b(TPC_MAX_LISTS, data->total_concurrent_copies);
487 	data->maximum_concurrent_copies = TPC_MAX_LISTS;
488 	data->data_segment_granularity = 0;
489 	data->inline_data_granularity = 0;
490 	data->held_data_granularity = 0;
491 	data->implemented_descriptor_list_length = 4;
492 	data->list_of_implemented_descriptor_type_codes[0] = EC_SEG_B2B;
493 	data->list_of_implemented_descriptor_type_codes[1] = EC_SEG_VERIFY;
494 	data->list_of_implemented_descriptor_type_codes[2] = EC_SEG_REGISTER_KEY;
495 	data->list_of_implemented_descriptor_type_codes[3] = EC_CSCD_ID;
496 
497 	ctl_set_success(ctsio);
498 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
499 	ctsio->be_move_done = ctl_config_move_done;
500 	ctl_datamove((union ctl_io *)ctsio);
501 	return (retval);
502 }
503 
504 static struct tpc_list *
505 tpc_find_list(struct ctl_lun *lun, uint32_t list_id, uint32_t init_idx)
506 {
507 	struct tpc_list *list;
508 
509 	mtx_assert(&lun->lun_lock, MA_OWNED);
510 	TAILQ_FOREACH(list, &lun->tpc_lists, links) {
511 		if ((list->flags & EC_LIST_ID_USAGE_MASK) !=
512 		     EC_LIST_ID_USAGE_NONE && list->list_id == list_id &&
513 		    list->init_idx == init_idx)
514 			break;
515 	}
516 	return (list);
517 }
518 
519 int
520 ctl_receive_copy_status_lid1(struct ctl_scsiio *ctsio)
521 {
522 	struct ctl_lun *lun = CTL_LUN(ctsio);
523 	struct scsi_receive_copy_status_lid1 *cdb;
524 	struct scsi_receive_copy_status_lid1_data *data;
525 	struct tpc_list *list;
526 	struct tpc_list list_copy;
527 	int retval;
528 	int alloc_len, total_len;
529 	uint32_t list_id;
530 
531 	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid1\n"));
532 
533 	cdb = (struct scsi_receive_copy_status_lid1 *)ctsio->cdb;
534 	retval = CTL_RETVAL_COMPLETE;
535 
536 	list_id = cdb->list_identifier;
537 	mtx_lock(&lun->lun_lock);
538 	list = tpc_find_list(lun, list_id,
539 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
540 	if (list == NULL) {
541 		mtx_unlock(&lun->lun_lock);
542 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
543 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
544 		    /*bit*/ 0);
545 		ctl_done((union ctl_io *)ctsio);
546 		return (retval);
547 	}
548 	list_copy = *list;
549 	if (list->completed) {
550 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
551 		free(list, M_CTL);
552 	}
553 	mtx_unlock(&lun->lun_lock);
554 
555 	total_len = sizeof(*data);
556 	alloc_len = scsi_4btoul(cdb->length);
557 
558 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
559 
560 	ctsio->kern_sg_entries = 0;
561 
562 	if (total_len < alloc_len) {
563 		ctsio->residual = alloc_len - total_len;
564 		ctsio->kern_data_len = total_len;
565 		ctsio->kern_total_len = total_len;
566 	} else {
567 		ctsio->residual = 0;
568 		ctsio->kern_data_len = alloc_len;
569 		ctsio->kern_total_len = alloc_len;
570 	}
571 	ctsio->kern_data_resid = 0;
572 	ctsio->kern_rel_offset = 0;
573 
574 	data = (struct scsi_receive_copy_status_lid1_data *)ctsio->kern_data_ptr;
575 	scsi_ulto4b(sizeof(*data) - 4, data->available_data);
576 	if (list_copy.completed) {
577 		if (list_copy.error || list_copy.abort)
578 			data->copy_command_status = RCS_CCS_ERROR;
579 		else
580 			data->copy_command_status = RCS_CCS_COMPLETED;
581 	} else
582 		data->copy_command_status = RCS_CCS_INPROG;
583 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
584 	if (list_copy.curbytes <= UINT32_MAX) {
585 		data->transfer_count_units = RCS_TC_BYTES;
586 		scsi_ulto4b(list_copy.curbytes, data->transfer_count);
587 	} else {
588 		data->transfer_count_units = RCS_TC_MBYTES;
589 		scsi_ulto4b(list_copy.curbytes >> 20, data->transfer_count);
590 	}
591 
592 	ctl_set_success(ctsio);
593 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
594 	ctsio->be_move_done = ctl_config_move_done;
595 	ctl_datamove((union ctl_io *)ctsio);
596 	return (retval);
597 }
598 
599 int
600 ctl_receive_copy_failure_details(struct ctl_scsiio *ctsio)
601 {
602 	struct ctl_lun *lun = CTL_LUN(ctsio);
603 	struct scsi_receive_copy_failure_details *cdb;
604 	struct scsi_receive_copy_failure_details_data *data;
605 	struct tpc_list *list;
606 	struct tpc_list list_copy;
607 	int retval;
608 	int alloc_len, total_len;
609 	uint32_t list_id;
610 
611 	CTL_DEBUG_PRINT(("ctl_receive_copy_failure_details\n"));
612 
613 	cdb = (struct scsi_receive_copy_failure_details *)ctsio->cdb;
614 	retval = CTL_RETVAL_COMPLETE;
615 
616 	list_id = cdb->list_identifier;
617 	mtx_lock(&lun->lun_lock);
618 	list = tpc_find_list(lun, list_id,
619 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
620 	if (list == NULL || !list->completed) {
621 		mtx_unlock(&lun->lun_lock);
622 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
623 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
624 		    /*bit*/ 0);
625 		ctl_done((union ctl_io *)ctsio);
626 		return (retval);
627 	}
628 	list_copy = *list;
629 	TAILQ_REMOVE(&lun->tpc_lists, list, links);
630 	free(list, M_CTL);
631 	mtx_unlock(&lun->lun_lock);
632 
633 	total_len = sizeof(*data) + list_copy.sense_len;
634 	alloc_len = scsi_4btoul(cdb->length);
635 
636 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
637 
638 	ctsio->kern_sg_entries = 0;
639 
640 	if (total_len < alloc_len) {
641 		ctsio->residual = alloc_len - total_len;
642 		ctsio->kern_data_len = total_len;
643 		ctsio->kern_total_len = total_len;
644 	} else {
645 		ctsio->residual = 0;
646 		ctsio->kern_data_len = alloc_len;
647 		ctsio->kern_total_len = alloc_len;
648 	}
649 	ctsio->kern_data_resid = 0;
650 	ctsio->kern_rel_offset = 0;
651 
652 	data = (struct scsi_receive_copy_failure_details_data *)ctsio->kern_data_ptr;
653 	if (list_copy.completed && (list_copy.error || list_copy.abort)) {
654 		scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
655 		    data->available_data);
656 		data->copy_command_status = RCS_CCS_ERROR;
657 	} else
658 		scsi_ulto4b(0, data->available_data);
659 	scsi_ulto2b(list_copy.sense_len, data->sense_data_length);
660 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
661 
662 	ctl_set_success(ctsio);
663 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
664 	ctsio->be_move_done = ctl_config_move_done;
665 	ctl_datamove((union ctl_io *)ctsio);
666 	return (retval);
667 }
668 
669 int
670 ctl_receive_copy_status_lid4(struct ctl_scsiio *ctsio)
671 {
672 	struct ctl_lun *lun = CTL_LUN(ctsio);
673 	struct scsi_receive_copy_status_lid4 *cdb;
674 	struct scsi_receive_copy_status_lid4_data *data;
675 	struct tpc_list *list;
676 	struct tpc_list list_copy;
677 	int retval;
678 	int alloc_len, total_len;
679 	uint32_t list_id;
680 
681 	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid4\n"));
682 
683 	cdb = (struct scsi_receive_copy_status_lid4 *)ctsio->cdb;
684 	retval = CTL_RETVAL_COMPLETE;
685 
686 	list_id = scsi_4btoul(cdb->list_identifier);
687 	mtx_lock(&lun->lun_lock);
688 	list = tpc_find_list(lun, list_id,
689 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
690 	if (list == NULL) {
691 		mtx_unlock(&lun->lun_lock);
692 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
693 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
694 		    /*bit*/ 0);
695 		ctl_done((union ctl_io *)ctsio);
696 		return (retval);
697 	}
698 	list_copy = *list;
699 	if (list->completed) {
700 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
701 		free(list, M_CTL);
702 	}
703 	mtx_unlock(&lun->lun_lock);
704 
705 	total_len = sizeof(*data) + list_copy.sense_len;
706 	alloc_len = scsi_4btoul(cdb->length);
707 
708 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
709 
710 	ctsio->kern_sg_entries = 0;
711 
712 	if (total_len < alloc_len) {
713 		ctsio->residual = alloc_len - total_len;
714 		ctsio->kern_data_len = total_len;
715 		ctsio->kern_total_len = total_len;
716 	} else {
717 		ctsio->residual = 0;
718 		ctsio->kern_data_len = alloc_len;
719 		ctsio->kern_total_len = alloc_len;
720 	}
721 	ctsio->kern_data_resid = 0;
722 	ctsio->kern_rel_offset = 0;
723 
724 	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
725 	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
726 	    data->available_data);
727 	data->response_to_service_action = list_copy.service_action;
728 	if (list_copy.completed) {
729 		if (list_copy.error)
730 			data->copy_command_status = RCS_CCS_ERROR;
731 		else if (list_copy.abort)
732 			data->copy_command_status = RCS_CCS_ABORTED;
733 		else
734 			data->copy_command_status = RCS_CCS_COMPLETED;
735 	} else
736 		data->copy_command_status = RCS_CCS_INPROG_FG;
737 	scsi_ulto2b(list_copy.curops, data->operation_counter);
738 	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
739 	data->transfer_count_units = RCS_TC_BYTES;
740 	scsi_u64to8b(list_copy.curbytes, data->transfer_count);
741 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
742 	data->length_of_the_sense_data_field = list_copy.sense_len;
743 	data->sense_data_length = list_copy.sense_len;
744 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
745 
746 	ctl_set_success(ctsio);
747 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
748 	ctsio->be_move_done = ctl_config_move_done;
749 	ctl_datamove((union ctl_io *)ctsio);
750 	return (retval);
751 }
752 
753 int
754 ctl_copy_operation_abort(struct ctl_scsiio *ctsio)
755 {
756 	struct ctl_lun *lun = CTL_LUN(ctsio);
757 	struct scsi_copy_operation_abort *cdb;
758 	struct tpc_list *list;
759 	int retval;
760 	uint32_t list_id;
761 
762 	CTL_DEBUG_PRINT(("ctl_copy_operation_abort\n"));
763 
764 	cdb = (struct scsi_copy_operation_abort *)ctsio->cdb;
765 	retval = CTL_RETVAL_COMPLETE;
766 
767 	list_id = scsi_4btoul(cdb->list_identifier);
768 	mtx_lock(&lun->lun_lock);
769 	list = tpc_find_list(lun, list_id,
770 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
771 	if (list == NULL) {
772 		mtx_unlock(&lun->lun_lock);
773 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
774 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
775 		    /*bit*/ 0);
776 		ctl_done((union ctl_io *)ctsio);
777 		return (retval);
778 	}
779 	list->abort = 1;
780 	mtx_unlock(&lun->lun_lock);
781 
782 	ctl_set_success(ctsio);
783 	ctl_done((union ctl_io *)ctsio);
784 	return (retval);
785 }
786 
787 static uint64_t
788 tpc_resolve(struct tpc_list *list, uint16_t idx, uint32_t *ss,
789     uint32_t *pb, uint32_t *pbo)
790 {
791 
792 	if (idx == 0xffff) {
793 		if (ss && list->lun->be_lun)
794 			*ss = list->lun->be_lun->blocksize;
795 		if (pb && list->lun->be_lun)
796 			*pb = list->lun->be_lun->blocksize <<
797 			    list->lun->be_lun->pblockexp;
798 		if (pbo && list->lun->be_lun)
799 			*pbo = list->lun->be_lun->blocksize *
800 			    list->lun->be_lun->pblockoff;
801 		return (list->lun->lun);
802 	}
803 	if (idx >= list->ncscd)
804 		return (UINT64_MAX);
805 	return (tpcl_resolve(list->lun->ctl_softc,
806 	    list->init_port, &list->cscd[idx], ss, pb, pbo));
807 }
808 
809 static void
810 tpc_set_io_error_sense(struct tpc_list *list)
811 {
812 	int flen;
813 	uint8_t csi[4];
814 	uint8_t sks[3];
815 	uint8_t fbuf[4 + 64];
816 
817 	scsi_ulto4b(list->curseg, csi);
818 	if (list->fwd_cscd <= 0x07ff) {
819 		sks[0] = SSD_SKS_SEGMENT_VALID;
820 		scsi_ulto2b((uint8_t *)&list->cscd[list->fwd_cscd] -
821 		    list->params, &sks[1]);
822 	} else
823 		sks[0] = 0;
824 	if (list->fwd_scsi_status) {
825 		fbuf[0] = 0x0c;
826 		fbuf[2] = list->fwd_target;
827 		flen = list->fwd_sense_len;
828 		if (flen > 64) {
829 			flen = 64;
830 			fbuf[2] |= SSD_FORWARDED_FSDT;
831 		}
832 		fbuf[1] = 2 + flen;
833 		fbuf[3] = list->fwd_scsi_status;
834 		bcopy(&list->fwd_sense_data, &fbuf[4], flen);
835 		flen += 4;
836 	} else
837 		flen = 0;
838 	ctl_set_sense(list->ctsio, /*current_error*/ 1,
839 	    /*sense_key*/ SSD_KEY_COPY_ABORTED,
840 	    /*asc*/ 0x0d, /*ascq*/ 0x01,
841 	    SSD_ELEM_COMMAND, sizeof(csi), csi,
842 	    sks[0] ? SSD_ELEM_SKS : SSD_ELEM_SKIP, sizeof(sks), sks,
843 	    flen ? SSD_ELEM_DESC : SSD_ELEM_SKIP, flen, fbuf,
844 	    SSD_ELEM_NONE);
845 }
846 
847 static int
848 tpc_process_b2b(struct tpc_list *list)
849 {
850 	struct scsi_ec_segment_b2b *seg;
851 	struct scsi_ec_cscd_dtsp *sdstp, *ddstp;
852 	struct tpc_io *tior, *tiow;
853 	struct runl run;
854 	uint64_t sl, dl;
855 	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
856 	int numlba;
857 	uint32_t srcblock, dstblock, pb, pbo, adj;
858 	uint16_t scscd, dcscd;
859 	uint8_t csi[4];
860 
861 	scsi_ulto4b(list->curseg, csi);
862 	if (list->stage == 1) {
863 		while ((tior = TAILQ_FIRST(&list->allio)) != NULL) {
864 			TAILQ_REMOVE(&list->allio, tior, links);
865 			ctl_free_io(tior->io);
866 			free(tior, M_CTL);
867 		}
868 		free(list->buf, M_CTL);
869 		if (list->abort) {
870 			ctl_set_task_aborted(list->ctsio);
871 			return (CTL_RETVAL_ERROR);
872 		} else if (list->error) {
873 			tpc_set_io_error_sense(list);
874 			return (CTL_RETVAL_ERROR);
875 		}
876 		list->cursectors += list->segsectors;
877 		list->curbytes += list->segbytes;
878 		return (CTL_RETVAL_COMPLETE);
879 	}
880 
881 	TAILQ_INIT(&list->allio);
882 	seg = (struct scsi_ec_segment_b2b *)list->seg[list->curseg];
883 	scscd = scsi_2btoul(seg->src_cscd);
884 	dcscd = scsi_2btoul(seg->dst_cscd);
885 	sl = tpc_resolve(list, scscd, &srcblock, NULL, NULL);
886 	dl = tpc_resolve(list, dcscd, &dstblock, &pb, &pbo);
887 	if (sl == UINT64_MAX || dl == UINT64_MAX) {
888 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
889 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
890 		    /*asc*/ 0x08, /*ascq*/ 0x04,
891 		    SSD_ELEM_COMMAND, sizeof(csi), csi,
892 		    SSD_ELEM_NONE);
893 		return (CTL_RETVAL_ERROR);
894 	}
895 	if (pbo > 0)
896 		pbo = pb - pbo;
897 	sdstp = &list->cscd[scscd].dtsp;
898 	if (scsi_3btoul(sdstp->block_length) != 0)
899 		srcblock = scsi_3btoul(sdstp->block_length);
900 	ddstp = &list->cscd[dcscd].dtsp;
901 	if (scsi_3btoul(ddstp->block_length) != 0)
902 		dstblock = scsi_3btoul(ddstp->block_length);
903 	numlba = scsi_2btoul(seg->number_of_blocks);
904 	if (seg->flags & EC_SEG_DC)
905 		numbytes = (off_t)numlba * dstblock;
906 	else
907 		numbytes = (off_t)numlba * srcblock;
908 	srclba = scsi_8btou64(seg->src_lba);
909 	dstlba = scsi_8btou64(seg->dst_lba);
910 
911 //	printf("Copy %ju bytes from %ju @ %ju to %ju @ %ju\n",
912 //	    (uintmax_t)numbytes, sl, scsi_8btou64(seg->src_lba),
913 //	    dl, scsi_8btou64(seg->dst_lba));
914 
915 	if (numbytes == 0)
916 		return (CTL_RETVAL_COMPLETE);
917 
918 	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
919 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
920 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
921 		    /*asc*/ 0x26, /*ascq*/ 0x0A,
922 		    SSD_ELEM_COMMAND, sizeof(csi), csi,
923 		    SSD_ELEM_NONE);
924 		return (CTL_RETVAL_ERROR);
925 	}
926 
927 	list->buf = malloc(numbytes, M_CTL, M_WAITOK);
928 	list->segbytes = numbytes;
929 	list->segsectors = numbytes / dstblock;
930 	donebytes = 0;
931 	TAILQ_INIT(&run);
932 	list->tbdio = 0;
933 	while (donebytes < numbytes) {
934 		roundbytes = numbytes - donebytes;
935 		if (roundbytes > TPC_MAX_IO_SIZE) {
936 			roundbytes = TPC_MAX_IO_SIZE;
937 			roundbytes -= roundbytes % dstblock;
938 			if (pb > dstblock) {
939 				adj = (dstlba * dstblock + roundbytes - pbo) % pb;
940 				if (roundbytes > adj)
941 					roundbytes -= adj;
942 			}
943 		}
944 
945 		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
946 		TAILQ_INIT(&tior->run);
947 		tior->list = list;
948 		TAILQ_INSERT_TAIL(&list->allio, tior, links);
949 		tior->io = tpcl_alloc_io();
950 		ctl_scsi_read_write(tior->io,
951 				    /*data_ptr*/ &list->buf[donebytes],
952 				    /*data_len*/ roundbytes,
953 				    /*read_op*/ 1,
954 				    /*byte2*/ 0,
955 				    /*minimum_cdb_size*/ 0,
956 				    /*lba*/ srclba,
957 				    /*num_blocks*/ roundbytes / srcblock,
958 				    /*tag_type*/ CTL_TAG_SIMPLE,
959 				    /*control*/ 0);
960 		tior->io->io_hdr.retries = 3;
961 		tior->target = SSD_FORWARDED_SDS_EXSRC;
962 		tior->cscd = scscd;
963 		tior->lun = sl;
964 		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
965 
966 		tiow = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
967 		TAILQ_INIT(&tiow->run);
968 		tiow->list = list;
969 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
970 		tiow->io = tpcl_alloc_io();
971 		ctl_scsi_read_write(tiow->io,
972 				    /*data_ptr*/ &list->buf[donebytes],
973 				    /*data_len*/ roundbytes,
974 				    /*read_op*/ 0,
975 				    /*byte2*/ 0,
976 				    /*minimum_cdb_size*/ 0,
977 				    /*lba*/ dstlba,
978 				    /*num_blocks*/ roundbytes / dstblock,
979 				    /*tag_type*/ CTL_TAG_SIMPLE,
980 				    /*control*/ 0);
981 		tiow->io->io_hdr.retries = 3;
982 		tiow->target = SSD_FORWARDED_SDS_EXDST;
983 		tiow->cscd = dcscd;
984 		tiow->lun = dl;
985 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
986 
987 		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
988 		TAILQ_INSERT_TAIL(&run, tior, rlinks);
989 		list->tbdio++;
990 		donebytes += roundbytes;
991 		srclba += roundbytes / srcblock;
992 		dstlba += roundbytes / dstblock;
993 	}
994 
995 	while ((tior = TAILQ_FIRST(&run)) != NULL) {
996 		TAILQ_REMOVE(&run, tior, rlinks);
997 		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
998 			panic("tpcl_queue() error");
999 	}
1000 
1001 	list->stage++;
1002 	return (CTL_RETVAL_QUEUED);
1003 }
1004 
1005 static int
1006 tpc_process_verify(struct tpc_list *list)
1007 {
1008 	struct scsi_ec_segment_verify *seg;
1009 	struct tpc_io *tio;
1010 	uint64_t sl;
1011 	uint16_t cscd;
1012 	uint8_t csi[4];
1013 
1014 	scsi_ulto4b(list->curseg, csi);
1015 	if (list->stage == 1) {
1016 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1017 			TAILQ_REMOVE(&list->allio, tio, links);
1018 			ctl_free_io(tio->io);
1019 			free(tio, M_CTL);
1020 		}
1021 		if (list->abort) {
1022 			ctl_set_task_aborted(list->ctsio);
1023 			return (CTL_RETVAL_ERROR);
1024 		} else if (list->error) {
1025 			tpc_set_io_error_sense(list);
1026 			return (CTL_RETVAL_ERROR);
1027 		} else
1028 			return (CTL_RETVAL_COMPLETE);
1029 	}
1030 
1031 	TAILQ_INIT(&list->allio);
1032 	seg = (struct scsi_ec_segment_verify *)list->seg[list->curseg];
1033 	cscd = scsi_2btoul(seg->src_cscd);
1034 	sl = tpc_resolve(list, cscd, NULL, NULL, NULL);
1035 	if (sl == UINT64_MAX) {
1036 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1037 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1038 		    /*asc*/ 0x08, /*ascq*/ 0x04,
1039 		    SSD_ELEM_COMMAND, sizeof(csi), csi,
1040 		    SSD_ELEM_NONE);
1041 		return (CTL_RETVAL_ERROR);
1042 	}
1043 
1044 //	printf("Verify %ju\n", sl);
1045 
1046 	if ((seg->tur & 0x01) == 0)
1047 		return (CTL_RETVAL_COMPLETE);
1048 
1049 	list->tbdio = 1;
1050 	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1051 	TAILQ_INIT(&tio->run);
1052 	tio->list = list;
1053 	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1054 	tio->io = tpcl_alloc_io();
1055 	ctl_scsi_tur(tio->io, /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1056 	tio->io->io_hdr.retries = 3;
1057 	tio->target = SSD_FORWARDED_SDS_EXSRC;
1058 	tio->cscd = cscd;
1059 	tio->lun = sl;
1060 	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1061 	list->stage++;
1062 	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1063 		panic("tpcl_queue() error");
1064 	return (CTL_RETVAL_QUEUED);
1065 }
1066 
1067 static int
1068 tpc_process_register_key(struct tpc_list *list)
1069 {
1070 	struct scsi_ec_segment_register_key *seg;
1071 	struct tpc_io *tio;
1072 	uint64_t dl;
1073 	int datalen;
1074 	uint16_t cscd;
1075 	uint8_t csi[4];
1076 
1077 	scsi_ulto4b(list->curseg, csi);
1078 	if (list->stage == 1) {
1079 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1080 			TAILQ_REMOVE(&list->allio, tio, links);
1081 			ctl_free_io(tio->io);
1082 			free(tio, M_CTL);
1083 		}
1084 		free(list->buf, M_CTL);
1085 		if (list->abort) {
1086 			ctl_set_task_aborted(list->ctsio);
1087 			return (CTL_RETVAL_ERROR);
1088 		} else if (list->error) {
1089 			tpc_set_io_error_sense(list);
1090 			return (CTL_RETVAL_ERROR);
1091 		} else
1092 			return (CTL_RETVAL_COMPLETE);
1093 	}
1094 
1095 	TAILQ_INIT(&list->allio);
1096 	seg = (struct scsi_ec_segment_register_key *)list->seg[list->curseg];
1097 	cscd = scsi_2btoul(seg->dst_cscd);
1098 	dl = tpc_resolve(list, cscd, NULL, NULL, NULL);
1099 	if (dl == UINT64_MAX) {
1100 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1101 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1102 		    /*asc*/ 0x08, /*ascq*/ 0x04,
1103 		    SSD_ELEM_COMMAND, sizeof(csi), csi,
1104 		    SSD_ELEM_NONE);
1105 		return (CTL_RETVAL_ERROR);
1106 	}
1107 
1108 //	printf("Register Key %ju\n", dl);
1109 
1110 	list->tbdio = 1;
1111 	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1112 	TAILQ_INIT(&tio->run);
1113 	tio->list = list;
1114 	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1115 	tio->io = tpcl_alloc_io();
1116 	datalen = sizeof(struct scsi_per_res_out_parms);
1117 	list->buf = malloc(datalen, M_CTL, M_WAITOK);
1118 	ctl_scsi_persistent_res_out(tio->io,
1119 	    list->buf, datalen, SPRO_REGISTER, -1,
1120 	    scsi_8btou64(seg->res_key), scsi_8btou64(seg->sa_res_key),
1121 	    /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1122 	tio->io->io_hdr.retries = 3;
1123 	tio->target = SSD_FORWARDED_SDS_EXDST;
1124 	tio->cscd = cscd;
1125 	tio->lun = dl;
1126 	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1127 	list->stage++;
1128 	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1129 		panic("tpcl_queue() error");
1130 	return (CTL_RETVAL_QUEUED);
1131 }
1132 
1133 static off_t
1134 tpc_ranges_length(struct scsi_range_desc *range, int nrange)
1135 {
1136 	off_t length = 0;
1137 	int r;
1138 
1139 	for (r = 0; r < nrange; r++)
1140 		length += scsi_4btoul(range[r].length);
1141 	return (length);
1142 }
1143 
1144 static int
1145 tpc_check_ranges_l(struct scsi_range_desc *range, int nrange, uint64_t maxlba,
1146     uint64_t *lba)
1147 {
1148 	uint64_t b1;
1149 	uint32_t l1;
1150 	int i;
1151 
1152 	for (i = 0; i < nrange; i++) {
1153 		b1 = scsi_8btou64(range[i].lba);
1154 		l1 = scsi_4btoul(range[i].length);
1155 		if (b1 + l1 < b1 || b1 + l1 > maxlba + 1) {
1156 			*lba = MAX(b1, maxlba + 1);
1157 			return (-1);
1158 		}
1159 	}
1160 	return (0);
1161 }
1162 
1163 static int
1164 tpc_check_ranges_x(struct scsi_range_desc *range, int nrange)
1165 {
1166 	uint64_t b1, b2;
1167 	uint32_t l1, l2;
1168 	int i, j;
1169 
1170 	for (i = 0; i < nrange - 1; i++) {
1171 		b1 = scsi_8btou64(range[i].lba);
1172 		l1 = scsi_4btoul(range[i].length);
1173 		for (j = i + 1; j < nrange; j++) {
1174 			b2 = scsi_8btou64(range[j].lba);
1175 			l2 = scsi_4btoul(range[j].length);
1176 			if (b1 + l1 > b2 && b2 + l2 > b1)
1177 				return (-1);
1178 		}
1179 	}
1180 	return (0);
1181 }
1182 
1183 static int
1184 tpc_skip_ranges(struct scsi_range_desc *range, int nrange, off_t skip,
1185     int *srange, off_t *soffset)
1186 {
1187 	off_t off;
1188 	int r;
1189 
1190 	r = 0;
1191 	off = 0;
1192 	while (r < nrange) {
1193 		if (skip - off < scsi_4btoul(range[r].length)) {
1194 			*srange = r;
1195 			*soffset = skip - off;
1196 			return (0);
1197 		}
1198 		off += scsi_4btoul(range[r].length);
1199 		r++;
1200 	}
1201 	return (-1);
1202 }
1203 
1204 static int
1205 tpc_process_wut(struct tpc_list *list)
1206 {
1207 	struct tpc_io *tio, *tior, *tiow;
1208 	struct runl run;
1209 	int drange, srange;
1210 	off_t doffset, soffset;
1211 	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
1212 	uint32_t srcblock, dstblock, pb, pbo, adj;
1213 
1214 	if (list->stage > 0) {
1215 		/* Cleanup after previous rounds. */
1216 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1217 			TAILQ_REMOVE(&list->allio, tio, links);
1218 			ctl_free_io(tio->io);
1219 			free(tio, M_CTL);
1220 		}
1221 		free(list->buf, M_CTL);
1222 		if (list->abort) {
1223 			ctl_set_task_aborted(list->ctsio);
1224 			return (CTL_RETVAL_ERROR);
1225 		} else if (list->error) {
1226 			if (list->fwd_scsi_status) {
1227 				list->ctsio->io_hdr.status =
1228 				    CTL_SCSI_ERROR | CTL_AUTOSENSE;
1229 				list->ctsio->scsi_status = list->fwd_scsi_status;
1230 				list->ctsio->sense_data = list->fwd_sense_data;
1231 				list->ctsio->sense_len = list->fwd_sense_len;
1232 			} else {
1233 				ctl_set_invalid_field(list->ctsio,
1234 				    /*sks_valid*/ 0, /*command*/ 0,
1235 				    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1236 			}
1237 			return (CTL_RETVAL_ERROR);
1238 		}
1239 		list->cursectors += list->segsectors;
1240 		list->curbytes += list->segbytes;
1241 	}
1242 
1243 	/* Check where we are on destination ranges list. */
1244 	if (tpc_skip_ranges(list->range, list->nrange, list->cursectors,
1245 	    &drange, &doffset) != 0)
1246 		return (CTL_RETVAL_COMPLETE);
1247 	dstblock = list->lun->be_lun->blocksize;
1248 	pb = dstblock << list->lun->be_lun->pblockexp;
1249 	if (list->lun->be_lun->pblockoff > 0)
1250 		pbo = pb - dstblock * list->lun->be_lun->pblockoff;
1251 	else
1252 		pbo = 0;
1253 
1254 	/* Check where we are on source ranges list. */
1255 	srcblock = list->token->blocksize;
1256 	if (tpc_skip_ranges(list->token->range, list->token->nrange,
1257 	    list->offset_into_rod + list->cursectors * dstblock / srcblock,
1258 	    &srange, &soffset) != 0) {
1259 		ctl_set_invalid_field(list->ctsio, /*sks_valid*/ 0,
1260 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1261 		return (CTL_RETVAL_ERROR);
1262 	}
1263 
1264 	srclba = scsi_8btou64(list->token->range[srange].lba) + soffset;
1265 	dstlba = scsi_8btou64(list->range[drange].lba) + doffset;
1266 	numbytes = srcblock *
1267 	    (scsi_4btoul(list->token->range[srange].length) - soffset);
1268 	numbytes = omin(numbytes, dstblock *
1269 	    (scsi_4btoul(list->range[drange].length) - doffset));
1270 	if (numbytes > TPC_MAX_IOCHUNK_SIZE) {
1271 		numbytes = TPC_MAX_IOCHUNK_SIZE;
1272 		numbytes -= numbytes % dstblock;
1273 		if (pb > dstblock) {
1274 			adj = (dstlba * dstblock + numbytes - pbo) % pb;
1275 			if (numbytes > adj)
1276 				numbytes -= adj;
1277 		}
1278 	}
1279 
1280 	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
1281 		ctl_set_invalid_field(list->ctsio, /*sks_valid*/ 0,
1282 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1283 		return (CTL_RETVAL_ERROR);
1284 	}
1285 
1286 	list->buf = malloc(numbytes, M_CTL, M_WAITOK |
1287 	    (list->token == NULL ? M_ZERO : 0));
1288 	list->segbytes = numbytes;
1289 	list->segsectors = numbytes / dstblock;
1290 //printf("Copy chunk of %ju sectors from %ju to %ju\n", list->segsectors,
1291 //    srclba, dstlba);
1292 	donebytes = 0;
1293 	TAILQ_INIT(&run);
1294 	list->tbdio = 0;
1295 	TAILQ_INIT(&list->allio);
1296 	while (donebytes < numbytes) {
1297 		roundbytes = numbytes - donebytes;
1298 		if (roundbytes > TPC_MAX_IO_SIZE) {
1299 			roundbytes = TPC_MAX_IO_SIZE;
1300 			roundbytes -= roundbytes % dstblock;
1301 			if (pb > dstblock) {
1302 				adj = (dstlba * dstblock + roundbytes - pbo) % pb;
1303 				if (roundbytes > adj)
1304 					roundbytes -= adj;
1305 			}
1306 		}
1307 
1308 		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
1309 		TAILQ_INIT(&tior->run);
1310 		tior->list = list;
1311 		TAILQ_INSERT_TAIL(&list->allio, tior, links);
1312 		tior->io = tpcl_alloc_io();
1313 		ctl_scsi_read_write(tior->io,
1314 				    /*data_ptr*/ &list->buf[donebytes],
1315 				    /*data_len*/ roundbytes,
1316 				    /*read_op*/ 1,
1317 				    /*byte2*/ 0,
1318 				    /*minimum_cdb_size*/ 0,
1319 				    /*lba*/ srclba,
1320 				    /*num_blocks*/ roundbytes / srcblock,
1321 				    /*tag_type*/ CTL_TAG_SIMPLE,
1322 				    /*control*/ 0);
1323 		tior->io->io_hdr.retries = 3;
1324 		tior->lun = list->token->lun;
1325 		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
1326 
1327 		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1328 		TAILQ_INIT(&tiow->run);
1329 		tiow->list = list;
1330 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1331 		tiow->io = tpcl_alloc_io();
1332 		ctl_scsi_read_write(tiow->io,
1333 				    /*data_ptr*/ &list->buf[donebytes],
1334 				    /*data_len*/ roundbytes,
1335 				    /*read_op*/ 0,
1336 				    /*byte2*/ 0,
1337 				    /*minimum_cdb_size*/ 0,
1338 				    /*lba*/ dstlba,
1339 				    /*num_blocks*/ roundbytes / dstblock,
1340 				    /*tag_type*/ CTL_TAG_SIMPLE,
1341 				    /*control*/ 0);
1342 		tiow->io->io_hdr.retries = 3;
1343 		tiow->lun = list->lun->lun;
1344 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1345 
1346 		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
1347 		TAILQ_INSERT_TAIL(&run, tior, rlinks);
1348 		list->tbdio++;
1349 		donebytes += roundbytes;
1350 		srclba += roundbytes / srcblock;
1351 		dstlba += roundbytes / dstblock;
1352 	}
1353 
1354 	while ((tior = TAILQ_FIRST(&run)) != NULL) {
1355 		TAILQ_REMOVE(&run, tior, rlinks);
1356 		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1357 			panic("tpcl_queue() error");
1358 	}
1359 
1360 	list->stage++;
1361 	return (CTL_RETVAL_QUEUED);
1362 }
1363 
1364 static int
1365 tpc_process_zero_wut(struct tpc_list *list)
1366 {
1367 	struct tpc_io *tio, *tiow;
1368 	struct runl run, *prun;
1369 	int r;
1370 	uint32_t dstblock, len;
1371 
1372 	if (list->stage > 0) {
1373 complete:
1374 		/* Cleanup after previous rounds. */
1375 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1376 			TAILQ_REMOVE(&list->allio, tio, links);
1377 			ctl_free_io(tio->io);
1378 			free(tio, M_CTL);
1379 		}
1380 		if (list->abort) {
1381 			ctl_set_task_aborted(list->ctsio);
1382 			return (CTL_RETVAL_ERROR);
1383 		} else if (list->error) {
1384 			if (list->fwd_scsi_status) {
1385 				list->ctsio->io_hdr.status =
1386 				    CTL_SCSI_ERROR | CTL_AUTOSENSE;
1387 				list->ctsio->scsi_status = list->fwd_scsi_status;
1388 				list->ctsio->sense_data = list->fwd_sense_data;
1389 				list->ctsio->sense_len = list->fwd_sense_len;
1390 			} else {
1391 				ctl_set_invalid_field(list->ctsio,
1392 				    /*sks_valid*/ 0, /*command*/ 0,
1393 				    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1394 			}
1395 			return (CTL_RETVAL_ERROR);
1396 		}
1397 		list->cursectors += list->segsectors;
1398 		list->curbytes += list->segbytes;
1399 		return (CTL_RETVAL_COMPLETE);
1400 	}
1401 
1402 	dstblock = list->lun->be_lun->blocksize;
1403 	TAILQ_INIT(&run);
1404 	prun = &run;
1405 	list->tbdio = 1;
1406 	TAILQ_INIT(&list->allio);
1407 	list->segsectors = 0;
1408 	for (r = 0; r < list->nrange; r++) {
1409 		len = scsi_4btoul(list->range[r].length);
1410 		if (len == 0)
1411 			continue;
1412 
1413 		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1414 		TAILQ_INIT(&tiow->run);
1415 		tiow->list = list;
1416 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1417 		tiow->io = tpcl_alloc_io();
1418 		ctl_scsi_write_same(tiow->io,
1419 				    /*data_ptr*/ NULL,
1420 				    /*data_len*/ 0,
1421 				    /*byte2*/ SWS_NDOB,
1422 				    /*lba*/ scsi_8btou64(list->range[r].lba),
1423 				    /*num_blocks*/ len,
1424 				    /*tag_type*/ CTL_TAG_SIMPLE,
1425 				    /*control*/ 0);
1426 		tiow->io->io_hdr.retries = 3;
1427 		tiow->lun = list->lun->lun;
1428 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1429 
1430 		TAILQ_INSERT_TAIL(prun, tiow, rlinks);
1431 		prun = &tiow->run;
1432 		list->segsectors += len;
1433 	}
1434 	list->segbytes = list->segsectors * dstblock;
1435 
1436 	if (TAILQ_EMPTY(&run))
1437 		goto complete;
1438 
1439 	while ((tiow = TAILQ_FIRST(&run)) != NULL) {
1440 		TAILQ_REMOVE(&run, tiow, rlinks);
1441 		if (tpcl_queue(tiow->io, tiow->lun) != CTL_RETVAL_COMPLETE)
1442 			panic("tpcl_queue() error");
1443 	}
1444 
1445 	list->stage++;
1446 	return (CTL_RETVAL_QUEUED);
1447 }
1448 
1449 static void
1450 tpc_process(struct tpc_list *list)
1451 {
1452 	struct ctl_lun *lun = list->lun;
1453 	struct ctl_softc *softc = lun->ctl_softc;
1454 	struct scsi_ec_segment *seg;
1455 	struct ctl_scsiio *ctsio = list->ctsio;
1456 	int retval = CTL_RETVAL_COMPLETE;
1457 	uint8_t csi[4];
1458 
1459 	if (list->service_action == EC_WUT) {
1460 		if (list->token != NULL)
1461 			retval = tpc_process_wut(list);
1462 		else
1463 			retval = tpc_process_zero_wut(list);
1464 		if (retval == CTL_RETVAL_QUEUED)
1465 			return;
1466 		if (retval == CTL_RETVAL_ERROR) {
1467 			list->error = 1;
1468 			goto done;
1469 		}
1470 	} else {
1471 //printf("ZZZ %d cscd, %d segs\n", list->ncscd, list->nseg);
1472 		while (list->curseg < list->nseg) {
1473 			seg = list->seg[list->curseg];
1474 			switch (seg->type_code) {
1475 			case EC_SEG_B2B:
1476 				retval = tpc_process_b2b(list);
1477 				break;
1478 			case EC_SEG_VERIFY:
1479 				retval = tpc_process_verify(list);
1480 				break;
1481 			case EC_SEG_REGISTER_KEY:
1482 				retval = tpc_process_register_key(list);
1483 				break;
1484 			default:
1485 				scsi_ulto4b(list->curseg, csi);
1486 				ctl_set_sense(ctsio, /*current_error*/ 1,
1487 				    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1488 				    /*asc*/ 0x26, /*ascq*/ 0x09,
1489 				    SSD_ELEM_COMMAND, sizeof(csi), csi,
1490 				    SSD_ELEM_NONE);
1491 				goto done;
1492 			}
1493 			if (retval == CTL_RETVAL_QUEUED)
1494 				return;
1495 			if (retval == CTL_RETVAL_ERROR) {
1496 				list->error = 1;
1497 				goto done;
1498 			}
1499 			list->curseg++;
1500 			list->stage = 0;
1501 		}
1502 	}
1503 
1504 	ctl_set_success(ctsio);
1505 
1506 done:
1507 //printf("ZZZ done\n");
1508 	free(list->params, M_CTL);
1509 	list->params = NULL;
1510 	if (list->token) {
1511 		mtx_lock(&softc->tpc_lock);
1512 		if (--list->token->active == 0)
1513 			list->token->last_active = time_uptime;
1514 		mtx_unlock(&softc->tpc_lock);
1515 		list->token = NULL;
1516 	}
1517 	mtx_lock(&lun->lun_lock);
1518 	if ((list->flags & EC_LIST_ID_USAGE_MASK) == EC_LIST_ID_USAGE_NONE) {
1519 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
1520 		free(list, M_CTL);
1521 	} else {
1522 		list->completed = 1;
1523 		list->last_active = time_uptime;
1524 		list->sense_data = ctsio->sense_data;
1525 		list->sense_len = ctsio->sense_len;
1526 		list->scsi_status = ctsio->scsi_status;
1527 	}
1528 	mtx_unlock(&lun->lun_lock);
1529 
1530 	ctl_done((union ctl_io *)ctsio);
1531 }
1532 
1533 /*
1534  * For any sort of check condition, busy, etc., we just retry.  We do not
1535  * decrement the retry count for unit attention type errors.  These are
1536  * normal, and we want to save the retry count for "real" errors.  Otherwise,
1537  * we could end up with situations where a command will succeed in some
1538  * situations and fail in others, depending on whether a unit attention is
1539  * pending.  Also, some of our error recovery actions, most notably the
1540  * LUN reset action, will cause a unit attention.
1541  *
1542  * We can add more detail here later if necessary.
1543  */
1544 static tpc_error_action
1545 tpc_checkcond_parse(union ctl_io *io)
1546 {
1547 	tpc_error_action error_action;
1548 	int error_code, sense_key, asc, ascq;
1549 
1550 	/*
1551 	 * Default to retrying the command.
1552 	 */
1553 	error_action = TPC_ERR_RETRY;
1554 
1555 	scsi_extract_sense_len(&io->scsiio.sense_data,
1556 			       io->scsiio.sense_len,
1557 			       &error_code,
1558 			       &sense_key,
1559 			       &asc,
1560 			       &ascq,
1561 			       /*show_errors*/ 1);
1562 
1563 	switch (error_code) {
1564 	case SSD_DEFERRED_ERROR:
1565 	case SSD_DESC_DEFERRED_ERROR:
1566 		error_action |= TPC_ERR_NO_DECREMENT;
1567 		break;
1568 	case SSD_CURRENT_ERROR:
1569 	case SSD_DESC_CURRENT_ERROR:
1570 	default:
1571 		switch (sense_key) {
1572 		case SSD_KEY_UNIT_ATTENTION:
1573 			error_action |= TPC_ERR_NO_DECREMENT;
1574 			break;
1575 		case SSD_KEY_HARDWARE_ERROR:
1576 			/*
1577 			 * This is our generic "something bad happened"
1578 			 * error code.  It often isn't recoverable.
1579 			 */
1580 			if ((asc == 0x44) && (ascq == 0x00))
1581 				error_action = TPC_ERR_FAIL;
1582 			break;
1583 		case SSD_KEY_NOT_READY:
1584 			/*
1585 			 * If the LUN is powered down, there likely isn't
1586 			 * much point in retrying right now.
1587 			 */
1588 			if ((asc == 0x04) && (ascq == 0x02))
1589 				error_action = TPC_ERR_FAIL;
1590 			/*
1591 			 * If the LUN is offline, there probably isn't much
1592 			 * point in retrying, either.
1593 			 */
1594 			if ((asc == 0x04) && (ascq == 0x03))
1595 				error_action = TPC_ERR_FAIL;
1596 			break;
1597 		}
1598 	}
1599 	return (error_action);
1600 }
1601 
1602 static tpc_error_action
1603 tpc_error_parse(union ctl_io *io)
1604 {
1605 	tpc_error_action error_action = TPC_ERR_RETRY;
1606 
1607 	switch (io->io_hdr.io_type) {
1608 	case CTL_IO_SCSI:
1609 		switch (io->io_hdr.status & CTL_STATUS_MASK) {
1610 		case CTL_SCSI_ERROR:
1611 			switch (io->scsiio.scsi_status) {
1612 			case SCSI_STATUS_CHECK_COND:
1613 				error_action = tpc_checkcond_parse(io);
1614 				break;
1615 			default:
1616 				break;
1617 			}
1618 			break;
1619 		default:
1620 			break;
1621 		}
1622 		break;
1623 	case CTL_IO_TASK:
1624 		break;
1625 	default:
1626 		panic("%s: invalid ctl_io type %d\n", __func__,
1627 		      io->io_hdr.io_type);
1628 		break;
1629 	}
1630 	return (error_action);
1631 }
1632 
1633 void
1634 tpc_done(union ctl_io *io)
1635 {
1636 	struct tpc_io *tio, *tior;
1637 
1638 	/*
1639 	 * Very minimal retry logic.  We basically retry if we got an error
1640 	 * back, and the retry count is greater than 0.  If we ever want
1641 	 * more sophisticated initiator type behavior, the CAM error
1642 	 * recovery code in ../common might be helpful.
1643 	 */
1644 	tio = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1645 	if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1646 	 && (io->io_hdr.retries > 0)) {
1647 		ctl_io_status old_status;
1648 		tpc_error_action error_action;
1649 
1650 		error_action = tpc_error_parse(io);
1651 		switch (error_action & TPC_ERR_MASK) {
1652 		case TPC_ERR_FAIL:
1653 			break;
1654 		case TPC_ERR_RETRY:
1655 		default:
1656 			if ((error_action & TPC_ERR_NO_DECREMENT) == 0)
1657 				io->io_hdr.retries--;
1658 			old_status = io->io_hdr.status;
1659 			io->io_hdr.status = CTL_STATUS_NONE;
1660 			io->io_hdr.flags &= ~CTL_FLAG_ABORT;
1661 			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
1662 			if (tpcl_queue(io, tio->lun) != CTL_RETVAL_COMPLETE) {
1663 				printf("%s: error returned from ctl_queue()!\n",
1664 				       __func__);
1665 				io->io_hdr.status = old_status;
1666 			} else
1667 				return;
1668 		}
1669 	}
1670 
1671 	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS) {
1672 		tio->list->error = 1;
1673 		if (io->io_hdr.io_type == CTL_IO_SCSI &&
1674 		    (io->io_hdr.status & CTL_STATUS_MASK) == CTL_SCSI_ERROR) {
1675 			tio->list->fwd_scsi_status = io->scsiio.scsi_status;
1676 			tio->list->fwd_sense_data = io->scsiio.sense_data;
1677 			tio->list->fwd_sense_len = io->scsiio.sense_len;
1678 			tio->list->fwd_target = tio->target;
1679 			tio->list->fwd_cscd = tio->cscd;
1680 		}
1681 	} else
1682 		atomic_add_int(&tio->list->curops, 1);
1683 	if (!tio->list->error && !tio->list->abort) {
1684 		while ((tior = TAILQ_FIRST(&tio->run)) != NULL) {
1685 			TAILQ_REMOVE(&tio->run, tior, rlinks);
1686 			atomic_add_int(&tio->list->tbdio, 1);
1687 			if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1688 				panic("tpcl_queue() error");
1689 		}
1690 	}
1691 	if (atomic_fetchadd_int(&tio->list->tbdio, -1) == 1)
1692 		tpc_process(tio->list);
1693 }
1694 
1695 int
1696 ctl_extended_copy_lid1(struct ctl_scsiio *ctsio)
1697 {
1698 	struct ctl_lun *lun = CTL_LUN(ctsio);
1699 	struct scsi_extended_copy *cdb;
1700 	struct scsi_extended_copy_lid1_data *data;
1701 	struct scsi_ec_cscd *cscd;
1702 	struct scsi_ec_segment *seg;
1703 	struct tpc_list *list, *tlist;
1704 	uint8_t *ptr;
1705 	char *value;
1706 	int len, off, lencscd, lenseg, leninl, nseg;
1707 
1708 	CTL_DEBUG_PRINT(("ctl_extended_copy_lid1\n"));
1709 
1710 	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1711 	len = scsi_4btoul(cdb->length);
1712 
1713 	if (len == 0) {
1714 		ctl_set_success(ctsio);
1715 		goto done;
1716 	}
1717 	if (len < sizeof(struct scsi_extended_copy_lid1_data) ||
1718 	    len > sizeof(struct scsi_extended_copy_lid1_data) +
1719 	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1720 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1721 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1722 		goto done;
1723 	}
1724 
1725 	/*
1726 	 * If we've got a kernel request that hasn't been malloced yet,
1727 	 * malloc it and tell the caller the data buffer is here.
1728 	 */
1729 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1730 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1731 		ctsio->kern_data_len = len;
1732 		ctsio->kern_total_len = len;
1733 		ctsio->kern_data_resid = 0;
1734 		ctsio->kern_rel_offset = 0;
1735 		ctsio->kern_sg_entries = 0;
1736 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1737 		ctsio->be_move_done = ctl_config_move_done;
1738 		ctl_datamove((union ctl_io *)ctsio);
1739 
1740 		return (CTL_RETVAL_COMPLETE);
1741 	}
1742 
1743 	data = (struct scsi_extended_copy_lid1_data *)ctsio->kern_data_ptr;
1744 	lencscd = scsi_2btoul(data->cscd_list_length);
1745 	lenseg = scsi_4btoul(data->segment_list_length);
1746 	leninl = scsi_4btoul(data->inline_data_length);
1747 	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1748 		ctl_set_sense(ctsio, /*current_error*/ 1,
1749 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1750 		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1751 		goto done;
1752 	}
1753 	if (lenseg > TPC_MAX_SEGS * sizeof(struct scsi_ec_segment)) {
1754 		ctl_set_sense(ctsio, /*current_error*/ 1,
1755 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1756 		    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1757 		goto done;
1758 	}
1759 	if (lencscd + lenseg > TPC_MAX_LIST ||
1760 	    leninl > TPC_MAX_INLINE ||
1761 	    len < sizeof(struct scsi_extended_copy_lid1_data) +
1762 	     lencscd + lenseg + leninl) {
1763 		ctl_set_param_len_error(ctsio);
1764 		goto done;
1765 	}
1766 
1767 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1768 	list->service_action = cdb->service_action;
1769 	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1770 	if (value != NULL && strcmp(value, "on") == 0)
1771 		list->init_port = -1;
1772 	else
1773 		list->init_port = ctsio->io_hdr.nexus.targ_port;
1774 	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
1775 	list->list_id = data->list_identifier;
1776 	list->flags = data->flags;
1777 	list->params = ctsio->kern_data_ptr;
1778 	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1779 	ptr = &data->data[0];
1780 	for (off = 0; off < lencscd; off += sizeof(struct scsi_ec_cscd)) {
1781 		cscd = (struct scsi_ec_cscd *)(ptr + off);
1782 		if (cscd->type_code != EC_CSCD_ID) {
1783 			free(list, M_CTL);
1784 			ctl_set_sense(ctsio, /*current_error*/ 1,
1785 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1786 			    /*asc*/ 0x26, /*ascq*/ 0x07, SSD_ELEM_NONE);
1787 			goto done;
1788 		}
1789 	}
1790 	ptr = &data->data[lencscd];
1791 	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1792 		if (nseg >= TPC_MAX_SEGS) {
1793 			free(list, M_CTL);
1794 			ctl_set_sense(ctsio, /*current_error*/ 1,
1795 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1796 			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1797 			goto done;
1798 		}
1799 		seg = (struct scsi_ec_segment *)(ptr + off);
1800 		if (seg->type_code != EC_SEG_B2B &&
1801 		    seg->type_code != EC_SEG_VERIFY &&
1802 		    seg->type_code != EC_SEG_REGISTER_KEY) {
1803 			free(list, M_CTL);
1804 			ctl_set_sense(ctsio, /*current_error*/ 1,
1805 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1806 			    /*asc*/ 0x26, /*ascq*/ 0x09, SSD_ELEM_NONE);
1807 			goto done;
1808 		}
1809 		list->seg[nseg] = seg;
1810 		off += sizeof(struct scsi_ec_segment) +
1811 		    scsi_2btoul(seg->descr_length);
1812 	}
1813 	list->inl = &data->data[lencscd + lenseg];
1814 	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1815 	list->nseg = nseg;
1816 	list->leninl = leninl;
1817 	list->ctsio = ctsio;
1818 	list->lun = lun;
1819 	mtx_lock(&lun->lun_lock);
1820 	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1821 		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1822 		if (tlist != NULL && !tlist->completed) {
1823 			mtx_unlock(&lun->lun_lock);
1824 			free(list, M_CTL);
1825 			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1826 			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1827 			    /*bit*/ 0);
1828 			goto done;
1829 		}
1830 		if (tlist != NULL) {
1831 			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1832 			free(tlist, M_CTL);
1833 		}
1834 	}
1835 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1836 	mtx_unlock(&lun->lun_lock);
1837 
1838 	tpc_process(list);
1839 	return (CTL_RETVAL_COMPLETE);
1840 
1841 done:
1842 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
1843 		free(ctsio->kern_data_ptr, M_CTL);
1844 		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
1845 	}
1846 	ctl_done((union ctl_io *)ctsio);
1847 	return (CTL_RETVAL_COMPLETE);
1848 }
1849 
1850 int
1851 ctl_extended_copy_lid4(struct ctl_scsiio *ctsio)
1852 {
1853 	struct ctl_lun *lun = CTL_LUN(ctsio);
1854 	struct scsi_extended_copy *cdb;
1855 	struct scsi_extended_copy_lid4_data *data;
1856 	struct scsi_ec_cscd *cscd;
1857 	struct scsi_ec_segment *seg;
1858 	struct tpc_list *list, *tlist;
1859 	uint8_t *ptr;
1860 	char *value;
1861 	int len, off, lencscd, lenseg, leninl, nseg;
1862 
1863 	CTL_DEBUG_PRINT(("ctl_extended_copy_lid4\n"));
1864 
1865 	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1866 	len = scsi_4btoul(cdb->length);
1867 
1868 	if (len == 0) {
1869 		ctl_set_success(ctsio);
1870 		goto done;
1871 	}
1872 	if (len < sizeof(struct scsi_extended_copy_lid4_data) ||
1873 	    len > sizeof(struct scsi_extended_copy_lid4_data) +
1874 	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1875 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1876 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1877 		goto done;
1878 	}
1879 
1880 	/*
1881 	 * If we've got a kernel request that hasn't been malloced yet,
1882 	 * malloc it and tell the caller the data buffer is here.
1883 	 */
1884 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1885 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1886 		ctsio->kern_data_len = len;
1887 		ctsio->kern_total_len = len;
1888 		ctsio->kern_data_resid = 0;
1889 		ctsio->kern_rel_offset = 0;
1890 		ctsio->kern_sg_entries = 0;
1891 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1892 		ctsio->be_move_done = ctl_config_move_done;
1893 		ctl_datamove((union ctl_io *)ctsio);
1894 
1895 		return (CTL_RETVAL_COMPLETE);
1896 	}
1897 
1898 	data = (struct scsi_extended_copy_lid4_data *)ctsio->kern_data_ptr;
1899 	lencscd = scsi_2btoul(data->cscd_list_length);
1900 	lenseg = scsi_2btoul(data->segment_list_length);
1901 	leninl = scsi_2btoul(data->inline_data_length);
1902 	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1903 		ctl_set_sense(ctsio, /*current_error*/ 1,
1904 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1905 		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1906 		goto done;
1907 	}
1908 	if (lenseg > TPC_MAX_SEGS * sizeof(struct scsi_ec_segment)) {
1909 		ctl_set_sense(ctsio, /*current_error*/ 1,
1910 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1911 		    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1912 		goto done;
1913 	}
1914 	if (lencscd + lenseg > TPC_MAX_LIST ||
1915 	    leninl > TPC_MAX_INLINE ||
1916 	    len < sizeof(struct scsi_extended_copy_lid1_data) +
1917 	     lencscd + lenseg + leninl) {
1918 		ctl_set_param_len_error(ctsio);
1919 		goto done;
1920 	}
1921 
1922 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1923 	list->service_action = cdb->service_action;
1924 	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1925 	if (value != NULL && strcmp(value, "on") == 0)
1926 		list->init_port = -1;
1927 	else
1928 		list->init_port = ctsio->io_hdr.nexus.targ_port;
1929 	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
1930 	list->list_id = scsi_4btoul(data->list_identifier);
1931 	list->flags = data->flags;
1932 	list->params = ctsio->kern_data_ptr;
1933 	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1934 	ptr = &data->data[0];
1935 	for (off = 0; off < lencscd; off += sizeof(struct scsi_ec_cscd)) {
1936 		cscd = (struct scsi_ec_cscd *)(ptr + off);
1937 		if (cscd->type_code != EC_CSCD_ID) {
1938 			free(list, M_CTL);
1939 			ctl_set_sense(ctsio, /*current_error*/ 1,
1940 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1941 			    /*asc*/ 0x26, /*ascq*/ 0x07, SSD_ELEM_NONE);
1942 			goto done;
1943 		}
1944 	}
1945 	ptr = &data->data[lencscd];
1946 	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1947 		if (nseg >= TPC_MAX_SEGS) {
1948 			free(list, M_CTL);
1949 			ctl_set_sense(ctsio, /*current_error*/ 1,
1950 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1951 			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1952 			goto done;
1953 		}
1954 		seg = (struct scsi_ec_segment *)(ptr + off);
1955 		if (seg->type_code != EC_SEG_B2B &&
1956 		    seg->type_code != EC_SEG_VERIFY &&
1957 		    seg->type_code != EC_SEG_REGISTER_KEY) {
1958 			free(list, M_CTL);
1959 			ctl_set_sense(ctsio, /*current_error*/ 1,
1960 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1961 			    /*asc*/ 0x26, /*ascq*/ 0x09, SSD_ELEM_NONE);
1962 			goto done;
1963 		}
1964 		list->seg[nseg] = seg;
1965 		off += sizeof(struct scsi_ec_segment) +
1966 		    scsi_2btoul(seg->descr_length);
1967 	}
1968 	list->inl = &data->data[lencscd + lenseg];
1969 	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1970 	list->nseg = nseg;
1971 	list->leninl = leninl;
1972 	list->ctsio = ctsio;
1973 	list->lun = lun;
1974 	mtx_lock(&lun->lun_lock);
1975 	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1976 		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1977 		if (tlist != NULL && !tlist->completed) {
1978 			mtx_unlock(&lun->lun_lock);
1979 			free(list, M_CTL);
1980 			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1981 			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1982 			    /*bit*/ 0);
1983 			goto done;
1984 		}
1985 		if (tlist != NULL) {
1986 			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1987 			free(tlist, M_CTL);
1988 		}
1989 	}
1990 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1991 	mtx_unlock(&lun->lun_lock);
1992 
1993 	tpc_process(list);
1994 	return (CTL_RETVAL_COMPLETE);
1995 
1996 done:
1997 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
1998 		free(ctsio->kern_data_ptr, M_CTL);
1999 		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2000 	}
2001 	ctl_done((union ctl_io *)ctsio);
2002 	return (CTL_RETVAL_COMPLETE);
2003 }
2004 
2005 static void
2006 tpc_create_token(struct ctl_lun *lun, struct ctl_port *port, off_t len,
2007     struct scsi_token *token)
2008 {
2009 	static int id = 0;
2010 	struct scsi_vpd_id_descriptor *idd = NULL;
2011 	struct scsi_ec_cscd_id *cscd;
2012 	struct scsi_read_capacity_data_long *dtsd;
2013 	int targid_len;
2014 
2015 	scsi_ulto4b(ROD_TYPE_AUR, token->type);
2016 	scsi_ulto2b(0x01f8, token->length);
2017 	scsi_u64to8b(atomic_fetchadd_int(&id, 1), &token->body[0]);
2018 	if (lun->lun_devid)
2019 		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
2020 		    lun->lun_devid->data, lun->lun_devid->len,
2021 		    scsi_devid_is_lun_naa);
2022 	if (idd == NULL && lun->lun_devid)
2023 		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
2024 		    lun->lun_devid->data, lun->lun_devid->len,
2025 		    scsi_devid_is_lun_eui64);
2026 	if (idd != NULL) {
2027 		cscd = (struct scsi_ec_cscd_id *)&token->body[8];
2028 		cscd->type_code = EC_CSCD_ID;
2029 		cscd->luidt_pdt = T_DIRECT;
2030 		memcpy(&cscd->codeset, idd, 4 + idd->length);
2031 		scsi_ulto3b(lun->be_lun->blocksize, cscd->dtsp.block_length);
2032 	}
2033 	scsi_u64to8b(0, &token->body[40]); /* XXX: Should be 128bit value. */
2034 	scsi_u64to8b(len, &token->body[48]);
2035 
2036 	/* ROD token device type specific data (RC16 without first field) */
2037 	dtsd = (struct scsi_read_capacity_data_long *)&token->body[88 - 8];
2038 	scsi_ulto4b(lun->be_lun->blocksize, dtsd->length);
2039 	dtsd->prot_lbppbe = lun->be_lun->pblockexp & SRC16_LBPPBE;
2040 	scsi_ulto2b(lun->be_lun->pblockoff & SRC16_LALBA_A, dtsd->lalba_lbp);
2041 	if (lun->be_lun->flags & CTL_LUN_FLAG_UNMAP)
2042 		dtsd->lalba_lbp[0] |= SRC16_LBPME | SRC16_LBPRZ;
2043 
2044 	if (port->target_devid) {
2045 		targid_len = port->target_devid->len;
2046 		memcpy(&token->body[120], port->target_devid->data, targid_len);
2047 	} else
2048 		targid_len = 32;
2049 	arc4rand(&token->body[120 + targid_len], 384 - targid_len, 0);
2050 };
2051 
2052 int
2053 ctl_populate_token(struct ctl_scsiio *ctsio)
2054 {
2055 	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2056 	struct ctl_port *port = CTL_PORT(ctsio);
2057 	struct ctl_lun *lun = CTL_LUN(ctsio);
2058 	struct scsi_populate_token *cdb;
2059 	struct scsi_populate_token_data *data;
2060 	struct tpc_list *list, *tlist;
2061 	struct tpc_token *token;
2062 	uint64_t lba;
2063 	int len, lendata, lendesc;
2064 
2065 	CTL_DEBUG_PRINT(("ctl_populate_token\n"));
2066 
2067 	cdb = (struct scsi_populate_token *)ctsio->cdb;
2068 	len = scsi_4btoul(cdb->length);
2069 
2070 	if (len < sizeof(struct scsi_populate_token_data) ||
2071 	    len > sizeof(struct scsi_populate_token_data) +
2072 	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
2073 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
2074 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
2075 		goto done;
2076 	}
2077 
2078 	/*
2079 	 * If we've got a kernel request that hasn't been malloced yet,
2080 	 * malloc it and tell the caller the data buffer is here.
2081 	 */
2082 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2083 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2084 		ctsio->kern_data_len = len;
2085 		ctsio->kern_total_len = len;
2086 		ctsio->kern_data_resid = 0;
2087 		ctsio->kern_rel_offset = 0;
2088 		ctsio->kern_sg_entries = 0;
2089 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2090 		ctsio->be_move_done = ctl_config_move_done;
2091 		ctl_datamove((union ctl_io *)ctsio);
2092 
2093 		return (CTL_RETVAL_COMPLETE);
2094 	}
2095 
2096 	data = (struct scsi_populate_token_data *)ctsio->kern_data_ptr;
2097 	lendata = scsi_2btoul(data->length);
2098 	if (lendata < sizeof(struct scsi_populate_token_data) - 2 +
2099 	    sizeof(struct scsi_range_desc)) {
2100 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2101 		    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
2102 		goto done;
2103 	}
2104 	lendesc = scsi_2btoul(data->range_descriptor_length);
2105 	if (lendesc < sizeof(struct scsi_range_desc) ||
2106 	    len < sizeof(struct scsi_populate_token_data) + lendesc ||
2107 	    lendata < sizeof(struct scsi_populate_token_data) - 2 + lendesc) {
2108 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2109 		    /*field*/ 14, /*bit_valid*/ 0, /*bit*/ 0);
2110 		goto done;
2111 	}
2112 /*
2113 	printf("PT(list=%u) flags=%x to=%d rt=%x len=%x\n",
2114 	    scsi_4btoul(cdb->list_identifier),
2115 	    data->flags, scsi_4btoul(data->inactivity_timeout),
2116 	    scsi_4btoul(data->rod_type),
2117 	    scsi_2btoul(data->range_descriptor_length));
2118 */
2119 
2120 	/* Validate INACTIVITY TIMEOUT field */
2121 	if (scsi_4btoul(data->inactivity_timeout) > TPC_MAX_TOKEN_TIMEOUT) {
2122 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2123 		    /*command*/ 0, /*field*/ 4, /*bit_valid*/ 0,
2124 		    /*bit*/ 0);
2125 		goto done;
2126 	}
2127 
2128 	/* Validate ROD TYPE field */
2129 	if ((data->flags & EC_PT_RTV) &&
2130 	    scsi_4btoul(data->rod_type) != ROD_TYPE_AUR) {
2131 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2132 		    /*field*/ 8, /*bit_valid*/ 0, /*bit*/ 0);
2133 		goto done;
2134 	}
2135 
2136 	/* Validate list of ranges */
2137 	if (tpc_check_ranges_l(&data->desc[0],
2138 	    scsi_2btoul(data->range_descriptor_length) /
2139 	    sizeof(struct scsi_range_desc),
2140 	    lun->be_lun->maxlba, &lba) != 0) {
2141 		ctl_set_lba_out_of_range(ctsio, lba);
2142 		goto done;
2143 	}
2144 	if (tpc_check_ranges_x(&data->desc[0],
2145 	    scsi_2btoul(data->range_descriptor_length) /
2146 	    sizeof(struct scsi_range_desc)) != 0) {
2147 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
2148 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2149 		    /*bit*/ 0);
2150 		goto done;
2151 	}
2152 
2153 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2154 	list->service_action = cdb->service_action;
2155 	list->init_port = ctsio->io_hdr.nexus.targ_port;
2156 	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
2157 	list->list_id = scsi_4btoul(cdb->list_identifier);
2158 	list->flags = data->flags;
2159 	list->ctsio = ctsio;
2160 	list->lun = lun;
2161 	mtx_lock(&lun->lun_lock);
2162 	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2163 	if (tlist != NULL && !tlist->completed) {
2164 		mtx_unlock(&lun->lun_lock);
2165 		free(list, M_CTL);
2166 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2167 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2168 		    /*bit*/ 0);
2169 		goto done;
2170 	}
2171 	if (tlist != NULL) {
2172 		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2173 		free(tlist, M_CTL);
2174 	}
2175 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2176 	mtx_unlock(&lun->lun_lock);
2177 
2178 	token = malloc(sizeof(*token), M_CTL, M_WAITOK | M_ZERO);
2179 	token->lun = lun->lun;
2180 	token->blocksize = lun->be_lun->blocksize;
2181 	token->params = ctsio->kern_data_ptr;
2182 	token->range = &data->desc[0];
2183 	token->nrange = scsi_2btoul(data->range_descriptor_length) /
2184 	    sizeof(struct scsi_range_desc);
2185 	list->cursectors = tpc_ranges_length(token->range, token->nrange);
2186 	list->curbytes = (off_t)list->cursectors * lun->be_lun->blocksize;
2187 	tpc_create_token(lun, port, list->curbytes,
2188 	    (struct scsi_token *)token->token);
2189 	token->active = 0;
2190 	token->last_active = time_uptime;
2191 	token->timeout = scsi_4btoul(data->inactivity_timeout);
2192 	if (token->timeout == 0)
2193 		token->timeout = TPC_DFL_TOKEN_TIMEOUT;
2194 	else if (token->timeout < TPC_MIN_TOKEN_TIMEOUT)
2195 		token->timeout = TPC_MIN_TOKEN_TIMEOUT;
2196 	memcpy(list->res_token, token->token, sizeof(list->res_token));
2197 	list->res_token_valid = 1;
2198 	list->curseg = 0;
2199 	list->completed = 1;
2200 	list->last_active = time_uptime;
2201 	mtx_lock(&softc->tpc_lock);
2202 	TAILQ_INSERT_TAIL(&softc->tpc_tokens, token, links);
2203 	mtx_unlock(&softc->tpc_lock);
2204 	ctl_set_success(ctsio);
2205 	ctl_done((union ctl_io *)ctsio);
2206 	return (CTL_RETVAL_COMPLETE);
2207 
2208 done:
2209 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
2210 		free(ctsio->kern_data_ptr, M_CTL);
2211 		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2212 	}
2213 	ctl_done((union ctl_io *)ctsio);
2214 	return (CTL_RETVAL_COMPLETE);
2215 }
2216 
2217 int
2218 ctl_write_using_token(struct ctl_scsiio *ctsio)
2219 {
2220 	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2221 	struct ctl_lun *lun = CTL_LUN(ctsio);
2222 	struct scsi_write_using_token *cdb;
2223 	struct scsi_write_using_token_data *data;
2224 	struct tpc_list *list, *tlist;
2225 	struct tpc_token *token;
2226 	uint64_t lba;
2227 	int len, lendata, lendesc;
2228 
2229 	CTL_DEBUG_PRINT(("ctl_write_using_token\n"));
2230 
2231 	cdb = (struct scsi_write_using_token *)ctsio->cdb;
2232 	len = scsi_4btoul(cdb->length);
2233 
2234 	if (len < sizeof(struct scsi_write_using_token_data) ||
2235 	    len > sizeof(struct scsi_write_using_token_data) +
2236 	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
2237 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
2238 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
2239 		goto done;
2240 	}
2241 
2242 	/*
2243 	 * If we've got a kernel request that hasn't been malloced yet,
2244 	 * malloc it and tell the caller the data buffer is here.
2245 	 */
2246 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2247 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2248 		ctsio->kern_data_len = len;
2249 		ctsio->kern_total_len = len;
2250 		ctsio->kern_data_resid = 0;
2251 		ctsio->kern_rel_offset = 0;
2252 		ctsio->kern_sg_entries = 0;
2253 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2254 		ctsio->be_move_done = ctl_config_move_done;
2255 		ctl_datamove((union ctl_io *)ctsio);
2256 
2257 		return (CTL_RETVAL_COMPLETE);
2258 	}
2259 
2260 	data = (struct scsi_write_using_token_data *)ctsio->kern_data_ptr;
2261 	lendata = scsi_2btoul(data->length);
2262 	if (lendata < sizeof(struct scsi_write_using_token_data) - 2 +
2263 	    sizeof(struct scsi_range_desc)) {
2264 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2265 		    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
2266 		goto done;
2267 	}
2268 	lendesc = scsi_2btoul(data->range_descriptor_length);
2269 	if (lendesc < sizeof(struct scsi_range_desc) ||
2270 	    len < sizeof(struct scsi_write_using_token_data) + lendesc ||
2271 	    lendata < sizeof(struct scsi_write_using_token_data) - 2 + lendesc) {
2272 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2273 		    /*field*/ 534, /*bit_valid*/ 0, /*bit*/ 0);
2274 		goto done;
2275 	}
2276 /*
2277 	printf("WUT(list=%u) flags=%x off=%ju len=%x\n",
2278 	    scsi_4btoul(cdb->list_identifier),
2279 	    data->flags, scsi_8btou64(data->offset_into_rod),
2280 	    scsi_2btoul(data->range_descriptor_length));
2281 */
2282 
2283 	/* Validate list of ranges */
2284 	if (tpc_check_ranges_l(&data->desc[0],
2285 	    scsi_2btoul(data->range_descriptor_length) /
2286 	    sizeof(struct scsi_range_desc),
2287 	    lun->be_lun->maxlba, &lba) != 0) {
2288 		ctl_set_lba_out_of_range(ctsio, lba);
2289 		goto done;
2290 	}
2291 	if (tpc_check_ranges_x(&data->desc[0],
2292 	    scsi_2btoul(data->range_descriptor_length) /
2293 	    sizeof(struct scsi_range_desc)) != 0) {
2294 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
2295 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2296 		    /*bit*/ 0);
2297 		goto done;
2298 	}
2299 
2300 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2301 	list->service_action = cdb->service_action;
2302 	list->init_port = ctsio->io_hdr.nexus.targ_port;
2303 	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
2304 	list->list_id = scsi_4btoul(cdb->list_identifier);
2305 	list->flags = data->flags;
2306 	list->params = ctsio->kern_data_ptr;
2307 	list->range = &data->desc[0];
2308 	list->nrange = scsi_2btoul(data->range_descriptor_length) /
2309 	    sizeof(struct scsi_range_desc);
2310 	list->offset_into_rod = scsi_8btou64(data->offset_into_rod);
2311 	list->ctsio = ctsio;
2312 	list->lun = lun;
2313 	mtx_lock(&lun->lun_lock);
2314 	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2315 	if (tlist != NULL && !tlist->completed) {
2316 		mtx_unlock(&lun->lun_lock);
2317 		free(list, M_CTL);
2318 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2319 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2320 		    /*bit*/ 0);
2321 		goto done;
2322 	}
2323 	if (tlist != NULL) {
2324 		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2325 		free(tlist, M_CTL);
2326 	}
2327 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2328 	mtx_unlock(&lun->lun_lock);
2329 
2330 	/* Block device zero ROD token -> no token. */
2331 	if (scsi_4btoul(data->rod_token) == ROD_TYPE_BLOCK_ZERO) {
2332 		tpc_process(list);
2333 		return (CTL_RETVAL_COMPLETE);
2334 	}
2335 
2336 	mtx_lock(&softc->tpc_lock);
2337 	TAILQ_FOREACH(token, &softc->tpc_tokens, links) {
2338 		if (memcmp(token->token, data->rod_token,
2339 		    sizeof(data->rod_token)) == 0)
2340 			break;
2341 	}
2342 	if (token != NULL) {
2343 		token->active++;
2344 		list->token = token;
2345 		if (data->flags & EC_WUT_DEL_TKN)
2346 			token->timeout = 0;
2347 	}
2348 	mtx_unlock(&softc->tpc_lock);
2349 	if (token == NULL) {
2350 		mtx_lock(&lun->lun_lock);
2351 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2352 		mtx_unlock(&lun->lun_lock);
2353 		free(list, M_CTL);
2354 		ctl_set_sense(ctsio, /*current_error*/ 1,
2355 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2356 		    /*asc*/ 0x23, /*ascq*/ 0x04, SSD_ELEM_NONE);
2357 		goto done;
2358 	}
2359 
2360 	tpc_process(list);
2361 	return (CTL_RETVAL_COMPLETE);
2362 
2363 done:
2364 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
2365 		free(ctsio->kern_data_ptr, M_CTL);
2366 		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2367 	}
2368 	ctl_done((union ctl_io *)ctsio);
2369 	return (CTL_RETVAL_COMPLETE);
2370 }
2371 
2372 int
2373 ctl_receive_rod_token_information(struct ctl_scsiio *ctsio)
2374 {
2375 	struct ctl_lun *lun = CTL_LUN(ctsio);
2376 	struct scsi_receive_rod_token_information *cdb;
2377 	struct scsi_receive_copy_status_lid4_data *data;
2378 	struct tpc_list *list;
2379 	struct tpc_list list_copy;
2380 	uint8_t *ptr;
2381 	int retval;
2382 	int alloc_len, total_len, token_len;
2383 	uint32_t list_id;
2384 
2385 	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2386 
2387 	cdb = (struct scsi_receive_rod_token_information *)ctsio->cdb;
2388 	retval = CTL_RETVAL_COMPLETE;
2389 
2390 	list_id = scsi_4btoul(cdb->list_identifier);
2391 	mtx_lock(&lun->lun_lock);
2392 	list = tpc_find_list(lun, list_id,
2393 	    ctl_get_initindex(&ctsio->io_hdr.nexus));
2394 	if (list == NULL) {
2395 		mtx_unlock(&lun->lun_lock);
2396 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2397 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
2398 		    /*bit*/ 0);
2399 		ctl_done((union ctl_io *)ctsio);
2400 		return (retval);
2401 	}
2402 	list_copy = *list;
2403 	if (list->completed) {
2404 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2405 		free(list, M_CTL);
2406 	}
2407 	mtx_unlock(&lun->lun_lock);
2408 
2409 	token_len = list_copy.res_token_valid ? 2 + sizeof(list_copy.res_token) : 0;
2410 	total_len = sizeof(*data) + list_copy.sense_len + 4 + token_len;
2411 	alloc_len = scsi_4btoul(cdb->length);
2412 
2413 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2414 
2415 	ctsio->kern_sg_entries = 0;
2416 
2417 	if (total_len < alloc_len) {
2418 		ctsio->residual = alloc_len - total_len;
2419 		ctsio->kern_data_len = total_len;
2420 		ctsio->kern_total_len = total_len;
2421 	} else {
2422 		ctsio->residual = 0;
2423 		ctsio->kern_data_len = alloc_len;
2424 		ctsio->kern_total_len = alloc_len;
2425 	}
2426 	ctsio->kern_data_resid = 0;
2427 	ctsio->kern_rel_offset = 0;
2428 
2429 	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
2430 	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len +
2431 	    4 + token_len, data->available_data);
2432 	data->response_to_service_action = list_copy.service_action;
2433 	if (list_copy.completed) {
2434 		if (list_copy.error)
2435 			data->copy_command_status = RCS_CCS_ERROR;
2436 		else if (list_copy.abort)
2437 			data->copy_command_status = RCS_CCS_ABORTED;
2438 		else
2439 			data->copy_command_status = RCS_CCS_COMPLETED;
2440 	} else
2441 		data->copy_command_status = RCS_CCS_INPROG_FG;
2442 	scsi_ulto2b(list_copy.curops, data->operation_counter);
2443 	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
2444 	data->transfer_count_units = RCS_TC_LBAS;
2445 	scsi_u64to8b(list_copy.cursectors, data->transfer_count);
2446 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
2447 	data->length_of_the_sense_data_field = list_copy.sense_len;
2448 	data->sense_data_length = list_copy.sense_len;
2449 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
2450 
2451 	ptr = &data->sense_data[data->length_of_the_sense_data_field];
2452 	scsi_ulto4b(token_len, &ptr[0]);
2453 	if (list_copy.res_token_valid) {
2454 		scsi_ulto2b(0, &ptr[4]);
2455 		memcpy(&ptr[6], list_copy.res_token, sizeof(list_copy.res_token));
2456 	}
2457 /*
2458 	printf("RRTI(list=%u) valid=%d\n",
2459 	    scsi_4btoul(cdb->list_identifier), list_copy.res_token_valid);
2460 */
2461 	ctl_set_success(ctsio);
2462 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2463 	ctsio->be_move_done = ctl_config_move_done;
2464 	ctl_datamove((union ctl_io *)ctsio);
2465 	return (retval);
2466 }
2467 
2468 int
2469 ctl_report_all_rod_tokens(struct ctl_scsiio *ctsio)
2470 {
2471 	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2472 	struct scsi_report_all_rod_tokens *cdb;
2473 	struct scsi_report_all_rod_tokens_data *data;
2474 	struct tpc_token *token;
2475 	int retval;
2476 	int alloc_len, total_len, tokens, i;
2477 
2478 	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2479 
2480 	cdb = (struct scsi_report_all_rod_tokens *)ctsio->cdb;
2481 	retval = CTL_RETVAL_COMPLETE;
2482 
2483 	tokens = 0;
2484 	mtx_lock(&softc->tpc_lock);
2485 	TAILQ_FOREACH(token, &softc->tpc_tokens, links)
2486 		tokens++;
2487 	mtx_unlock(&softc->tpc_lock);
2488 	if (tokens > 512)
2489 		tokens = 512;
2490 
2491 	total_len = sizeof(*data) + tokens * 96;
2492 	alloc_len = scsi_4btoul(cdb->length);
2493 
2494 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2495 
2496 	ctsio->kern_sg_entries = 0;
2497 
2498 	if (total_len < alloc_len) {
2499 		ctsio->residual = alloc_len - total_len;
2500 		ctsio->kern_data_len = total_len;
2501 		ctsio->kern_total_len = total_len;
2502 	} else {
2503 		ctsio->residual = 0;
2504 		ctsio->kern_data_len = alloc_len;
2505 		ctsio->kern_total_len = alloc_len;
2506 	}
2507 	ctsio->kern_data_resid = 0;
2508 	ctsio->kern_rel_offset = 0;
2509 
2510 	data = (struct scsi_report_all_rod_tokens_data *)ctsio->kern_data_ptr;
2511 	i = 0;
2512 	mtx_lock(&softc->tpc_lock);
2513 	TAILQ_FOREACH(token, &softc->tpc_tokens, links) {
2514 		if (i >= tokens)
2515 			break;
2516 		memcpy(&data->rod_management_token_list[i * 96],
2517 		    token->token, 96);
2518 		i++;
2519 	}
2520 	mtx_unlock(&softc->tpc_lock);
2521 	scsi_ulto4b(sizeof(*data) - 4 + i * 96, data->available_data);
2522 /*
2523 	printf("RART tokens=%d\n", i);
2524 */
2525 	ctl_set_success(ctsio);
2526 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2527 	ctsio->be_move_done = ctl_config_move_done;
2528 	ctl_datamove((union ctl_io *)ctsio);
2529 	return (retval);
2530 }
2531 
2532