xref: /freebsd/sys/cam/ctl/ctl_tpc.c (revision e3e592bb7d250dd9f38ce7fcc370e7c61e316e48)
1 /*-
2  * Copyright (c) 2014 Alexander Motin <mav@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification, immediately at the beginning of the file.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/types.h>
34 #include <sys/lock.h>
35 #include <sys/module.h>
36 #include <sys/mutex.h>
37 #include <sys/condvar.h>
38 #include <sys/malloc.h>
39 #include <sys/conf.h>
40 #include <sys/queue.h>
41 #include <sys/sysctl.h>
42 #include <machine/atomic.h>
43 
44 #include <cam/cam.h>
45 #include <cam/scsi/scsi_all.h>
46 #include <cam/scsi/scsi_da.h>
47 #include <cam/ctl/ctl_io.h>
48 #include <cam/ctl/ctl.h>
49 #include <cam/ctl/ctl_frontend.h>
50 #include <cam/ctl/ctl_frontend_internal.h>
51 #include <cam/ctl/ctl_util.h>
52 #include <cam/ctl/ctl_backend.h>
53 #include <cam/ctl/ctl_ioctl.h>
54 #include <cam/ctl/ctl_ha.h>
55 #include <cam/ctl/ctl_private.h>
56 #include <cam/ctl/ctl_debug.h>
57 #include <cam/ctl/ctl_scsi_all.h>
58 #include <cam/ctl/ctl_tpc.h>
59 #include <cam/ctl/ctl_error.h>
60 
61 #define	TPC_MAX_CSCDS	64
62 #define	TPC_MAX_SEGS	64
63 #define	TPC_MAX_SEG	0
64 #define	TPC_MAX_LIST	8192
65 #define	TPC_MAX_INLINE	0
66 #define	TPC_MAX_LISTS	255
67 #define	TPC_MAX_IO_SIZE	(1024 * 1024)
68 #define	TPC_MAX_IOCHUNK_SIZE	(TPC_MAX_IO_SIZE * 16)
69 #define	TPC_MIN_TOKEN_TIMEOUT	1
70 #define	TPC_DFL_TOKEN_TIMEOUT	60
71 #define	TPC_MAX_TOKEN_TIMEOUT	600
72 
73 MALLOC_DEFINE(M_CTL_TPC, "ctltpc", "CTL TPC");
74 
75 typedef enum {
76 	TPC_ERR_RETRY		= 0x000,
77 	TPC_ERR_FAIL		= 0x001,
78 	TPC_ERR_MASK		= 0x0ff,
79 	TPC_ERR_NO_DECREMENT	= 0x100
80 } tpc_error_action;
81 
82 struct tpc_list;
83 TAILQ_HEAD(runl, tpc_io);
84 struct tpc_io {
85 	union ctl_io		*io;
86 	uint64_t		 lun;
87 	struct tpc_list		*list;
88 	struct runl		 run;
89 	TAILQ_ENTRY(tpc_io)	 rlinks;
90 	TAILQ_ENTRY(tpc_io)	 links;
91 };
92 
93 struct tpc_token {
94 	uint8_t			 token[512];
95 	uint64_t		 lun;
96 	uint32_t		 blocksize;
97 	uint8_t			*params;
98 	struct scsi_range_desc	*range;
99 	int			 nrange;
100 	int			 active;
101 	time_t			 last_active;
102 	uint32_t		 timeout;
103 	TAILQ_ENTRY(tpc_token)	 links;
104 };
105 
106 struct tpc_list {
107 	uint8_t			 service_action;
108 	int			 init_port;
109 	uint32_t		 init_idx;
110 	uint32_t		 list_id;
111 	uint8_t			 flags;
112 	uint8_t			*params;
113 	struct scsi_ec_cscd	*cscd;
114 	struct scsi_ec_segment	*seg[TPC_MAX_SEGS];
115 	uint8_t			*inl;
116 	int			 ncscd;
117 	int			 nseg;
118 	int			 leninl;
119 	struct tpc_token	*token;
120 	struct scsi_range_desc	*range;
121 	int			 nrange;
122 	off_t			 offset_into_rod;
123 
124 	int			 curseg;
125 	off_t			 cursectors;
126 	off_t			 curbytes;
127 	int			 curops;
128 	int			 stage;
129 	uint8_t			*buf;
130 	off_t			 segsectors;
131 	off_t			 segbytes;
132 	int			 tbdio;
133 	int			 error;
134 	int			 abort;
135 	int			 completed;
136 	time_t			 last_active;
137 	TAILQ_HEAD(, tpc_io)	 allio;
138 	struct scsi_sense_data	 sense_data;
139 	uint8_t			 sense_len;
140 	uint8_t			 scsi_status;
141 	struct ctl_scsiio	*ctsio;
142 	struct ctl_lun		*lun;
143 	int			 res_token_valid;
144 	uint8_t			 res_token[512];
145 	TAILQ_ENTRY(tpc_list)	 links;
146 };
147 
148 extern struct ctl_softc *control_softc;
149 
150 static void
151 tpc_timeout(void *arg)
152 {
153 	struct ctl_softc *softc = arg;
154 	struct ctl_lun *lun;
155 	struct tpc_token *token, *ttoken;
156 	struct tpc_list *list, *tlist;
157 
158 	/* Free completed lists with expired timeout. */
159 	STAILQ_FOREACH(lun, &softc->lun_list, links) {
160 		mtx_lock(&lun->lun_lock);
161 		TAILQ_FOREACH_SAFE(list, &lun->tpc_lists, links, tlist) {
162 			if (!list->completed || time_uptime < list->last_active +
163 			    TPC_DFL_TOKEN_TIMEOUT)
164 				continue;
165 			TAILQ_REMOVE(&lun->tpc_lists, list, links);
166 			free(list, M_CTL);
167 		}
168 		mtx_unlock(&lun->lun_lock);
169 	}
170 
171 	/* Free inactive ROD tokens with expired timeout. */
172 	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
173 		if (token->active ||
174 		    time_uptime < token->last_active + token->timeout + 1)
175 			continue;
176 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
177 		free(token->params, M_CTL);
178 		free(token, M_CTL);
179 	}
180 	callout_schedule(&softc->tpc_timeout, hz);
181 }
182 
183 void
184 ctl_tpc_init(struct ctl_softc *softc)
185 {
186 
187 	TAILQ_INIT(&softc->tpc_tokens);
188 	callout_init_mtx(&softc->tpc_timeout, &softc->ctl_lock, 0);
189 	callout_reset(&softc->tpc_timeout, hz, tpc_timeout, softc);
190 }
191 
192 void
193 ctl_tpc_shutdown(struct ctl_softc *softc)
194 {
195 	struct tpc_token *token;
196 
197 	callout_drain(&softc->tpc_timeout);
198 
199 	/* Free ROD tokens. */
200 	mtx_lock(&softc->ctl_lock);
201 	while ((token = TAILQ_FIRST(&softc->tpc_tokens)) != NULL) {
202 		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
203 		free(token->params, M_CTL);
204 		free(token, M_CTL);
205 	}
206 	mtx_unlock(&softc->ctl_lock);
207 }
208 
209 void
210 ctl_tpc_lun_init(struct ctl_lun *lun)
211 {
212 
213 	TAILQ_INIT(&lun->tpc_lists);
214 }
215 
216 void
217 ctl_tpc_lun_shutdown(struct ctl_lun *lun)
218 {
219 	struct tpc_list *list;
220 	struct tpc_token *token, *ttoken;
221 
222 	/* Free lists for this LUN. */
223 	while ((list = TAILQ_FIRST(&lun->tpc_lists)) != NULL) {
224 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
225 		KASSERT(list->completed,
226 		    ("Not completed TPC (%p) on shutdown", list));
227 		free(list, M_CTL);
228 	}
229 
230 	/* Free ROD tokens for this LUN. */
231 	mtx_lock(&control_softc->ctl_lock);
232 	TAILQ_FOREACH_SAFE(token, &control_softc->tpc_tokens, links, ttoken) {
233 		if (token->lun != lun->lun || token->active)
234 			continue;
235 		TAILQ_REMOVE(&control_softc->tpc_tokens, token, links);
236 		free(token->params, M_CTL);
237 		free(token, M_CTL);
238 	}
239 	mtx_unlock(&control_softc->ctl_lock);
240 }
241 
242 int
243 ctl_inquiry_evpd_tpc(struct ctl_scsiio *ctsio, int alloc_len)
244 {
245 	struct scsi_vpd_tpc *tpc_ptr;
246 	struct scsi_vpd_tpc_descriptor *d_ptr;
247 	struct scsi_vpd_tpc_descriptor_bdrl *bdrl_ptr;
248 	struct scsi_vpd_tpc_descriptor_sc *sc_ptr;
249 	struct scsi_vpd_tpc_descriptor_sc_descr *scd_ptr;
250 	struct scsi_vpd_tpc_descriptor_pd *pd_ptr;
251 	struct scsi_vpd_tpc_descriptor_sd *sd_ptr;
252 	struct scsi_vpd_tpc_descriptor_sdid *sdid_ptr;
253 	struct scsi_vpd_tpc_descriptor_rtf *rtf_ptr;
254 	struct scsi_vpd_tpc_descriptor_rtf_block *rtfb_ptr;
255 	struct scsi_vpd_tpc_descriptor_srt *srt_ptr;
256 	struct scsi_vpd_tpc_descriptor_srtd *srtd_ptr;
257 	struct scsi_vpd_tpc_descriptor_gco *gco_ptr;
258 	struct ctl_lun *lun;
259 	int data_len;
260 
261 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
262 
263 	data_len = sizeof(struct scsi_vpd_tpc) +
264 	    sizeof(struct scsi_vpd_tpc_descriptor_bdrl) +
265 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sc) +
266 	     2 * sizeof(struct scsi_vpd_tpc_descriptor_sc_descr) + 11, 4) +
267 	    sizeof(struct scsi_vpd_tpc_descriptor_pd) +
268 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sd) + 4, 4) +
269 	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sdid) + 2, 4) +
270 	    sizeof(struct scsi_vpd_tpc_descriptor_rtf) +
271 	     sizeof(struct scsi_vpd_tpc_descriptor_rtf_block) +
272 	    sizeof(struct scsi_vpd_tpc_descriptor_srt) +
273 	     2*sizeof(struct scsi_vpd_tpc_descriptor_srtd) +
274 	    sizeof(struct scsi_vpd_tpc_descriptor_gco);
275 
276 	ctsio->kern_data_ptr = malloc(data_len, M_CTL, M_WAITOK | M_ZERO);
277 	tpc_ptr = (struct scsi_vpd_tpc *)ctsio->kern_data_ptr;
278 	ctsio->kern_sg_entries = 0;
279 
280 	if (data_len < alloc_len) {
281 		ctsio->residual = alloc_len - data_len;
282 		ctsio->kern_data_len = data_len;
283 		ctsio->kern_total_len = data_len;
284 	} else {
285 		ctsio->residual = 0;
286 		ctsio->kern_data_len = alloc_len;
287 		ctsio->kern_total_len = alloc_len;
288 	}
289 	ctsio->kern_data_resid = 0;
290 	ctsio->kern_rel_offset = 0;
291 	ctsio->kern_sg_entries = 0;
292 
293 	/*
294 	 * The control device is always connected.  The disk device, on the
295 	 * other hand, may not be online all the time.
296 	 */
297 	if (lun != NULL)
298 		tpc_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
299 				     lun->be_lun->lun_type;
300 	else
301 		tpc_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
302 	tpc_ptr->page_code = SVPD_SCSI_TPC;
303 	scsi_ulto2b(data_len - 4, tpc_ptr->page_length);
304 
305 	/* Block Device ROD Limits */
306 	d_ptr = (struct scsi_vpd_tpc_descriptor *)&tpc_ptr->descr[0];
307 	bdrl_ptr = (struct scsi_vpd_tpc_descriptor_bdrl *)d_ptr;
308 	scsi_ulto2b(SVPD_TPC_BDRL, bdrl_ptr->desc_type);
309 	scsi_ulto2b(sizeof(*bdrl_ptr) - 4, bdrl_ptr->desc_length);
310 	scsi_ulto2b(TPC_MAX_SEGS, bdrl_ptr->maximum_ranges);
311 	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
312 	    bdrl_ptr->maximum_inactivity_timeout);
313 	scsi_ulto4b(TPC_DFL_TOKEN_TIMEOUT,
314 	    bdrl_ptr->default_inactivity_timeout);
315 	scsi_u64to8b(0, bdrl_ptr->maximum_token_transfer_size);
316 	scsi_u64to8b(0, bdrl_ptr->optimal_transfer_count);
317 
318 	/* Supported commands */
319 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
320 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
321 	sc_ptr = (struct scsi_vpd_tpc_descriptor_sc *)d_ptr;
322 	scsi_ulto2b(SVPD_TPC_SC, sc_ptr->desc_type);
323 	sc_ptr->list_length = 2 * sizeof(*scd_ptr) + 11;
324 	scsi_ulto2b(roundup2(1 + sc_ptr->list_length, 4), sc_ptr->desc_length);
325 	scd_ptr = &sc_ptr->descr[0];
326 	scd_ptr->opcode = EXTENDED_COPY;
327 	scd_ptr->sa_length = 5;
328 	scd_ptr->supported_service_actions[0] = EC_EC_LID1;
329 	scd_ptr->supported_service_actions[1] = EC_EC_LID4;
330 	scd_ptr->supported_service_actions[2] = EC_PT;
331 	scd_ptr->supported_service_actions[3] = EC_WUT;
332 	scd_ptr->supported_service_actions[4] = EC_COA;
333 	scd_ptr = (struct scsi_vpd_tpc_descriptor_sc_descr *)
334 	    &scd_ptr->supported_service_actions[scd_ptr->sa_length];
335 	scd_ptr->opcode = RECEIVE_COPY_STATUS;
336 	scd_ptr->sa_length = 6;
337 	scd_ptr->supported_service_actions[0] = RCS_RCS_LID1;
338 	scd_ptr->supported_service_actions[1] = RCS_RCFD;
339 	scd_ptr->supported_service_actions[2] = RCS_RCS_LID4;
340 	scd_ptr->supported_service_actions[3] = RCS_RCOP;
341 	scd_ptr->supported_service_actions[4] = RCS_RRTI;
342 	scd_ptr->supported_service_actions[5] = RCS_RART;
343 
344 	/* Parameter data. */
345 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
346 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
347 	pd_ptr = (struct scsi_vpd_tpc_descriptor_pd *)d_ptr;
348 	scsi_ulto2b(SVPD_TPC_PD, pd_ptr->desc_type);
349 	scsi_ulto2b(sizeof(*pd_ptr) - 4, pd_ptr->desc_length);
350 	scsi_ulto2b(TPC_MAX_CSCDS, pd_ptr->maximum_cscd_descriptor_count);
351 	scsi_ulto2b(TPC_MAX_SEGS, pd_ptr->maximum_segment_descriptor_count);
352 	scsi_ulto4b(TPC_MAX_LIST, pd_ptr->maximum_descriptor_list_length);
353 	scsi_ulto4b(TPC_MAX_INLINE, pd_ptr->maximum_inline_data_length);
354 
355 	/* Supported Descriptors */
356 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
357 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
358 	sd_ptr = (struct scsi_vpd_tpc_descriptor_sd *)d_ptr;
359 	scsi_ulto2b(SVPD_TPC_SD, sd_ptr->desc_type);
360 	scsi_ulto2b(roundup2(sizeof(*sd_ptr) - 4 + 4, 4), sd_ptr->desc_length);
361 	sd_ptr->list_length = 4;
362 	sd_ptr->supported_descriptor_codes[0] = EC_SEG_B2B;
363 	sd_ptr->supported_descriptor_codes[1] = EC_SEG_VERIFY;
364 	sd_ptr->supported_descriptor_codes[2] = EC_SEG_REGISTER_KEY;
365 	sd_ptr->supported_descriptor_codes[3] = EC_CSCD_ID;
366 
367 	/* Supported CSCD Descriptor IDs */
368 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
369 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
370 	sdid_ptr = (struct scsi_vpd_tpc_descriptor_sdid *)d_ptr;
371 	scsi_ulto2b(SVPD_TPC_SDID, sdid_ptr->desc_type);
372 	scsi_ulto2b(roundup2(sizeof(*sdid_ptr) - 4 + 2, 4), sdid_ptr->desc_length);
373 	scsi_ulto2b(2, sdid_ptr->list_length);
374 	scsi_ulto2b(0xffff, &sdid_ptr->supported_descriptor_ids[0]);
375 
376 	/* ROD Token Features */
377 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
378 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
379 	rtf_ptr = (struct scsi_vpd_tpc_descriptor_rtf *)d_ptr;
380 	scsi_ulto2b(SVPD_TPC_RTF, rtf_ptr->desc_type);
381 	scsi_ulto2b(sizeof(*rtf_ptr) - 4 + sizeof(*rtfb_ptr), rtf_ptr->desc_length);
382 	rtf_ptr->remote_tokens = 0;
383 	scsi_ulto4b(TPC_MIN_TOKEN_TIMEOUT, rtf_ptr->minimum_token_lifetime);
384 	scsi_ulto4b(UINT32_MAX, rtf_ptr->maximum_token_lifetime);
385 	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
386 	    rtf_ptr->maximum_token_inactivity_timeout);
387 	scsi_ulto2b(sizeof(*rtfb_ptr), rtf_ptr->type_specific_features_length);
388 	rtfb_ptr = (struct scsi_vpd_tpc_descriptor_rtf_block *)
389 	    &rtf_ptr->type_specific_features;
390 	rtfb_ptr->type_format = SVPD_TPC_RTF_BLOCK;
391 	scsi_ulto2b(sizeof(*rtfb_ptr) - 4, rtfb_ptr->desc_length);
392 	scsi_ulto2b(0, rtfb_ptr->optimal_length_granularity);
393 	scsi_u64to8b(0, rtfb_ptr->maximum_bytes);
394 	scsi_u64to8b(0, rtfb_ptr->optimal_bytes);
395 	scsi_u64to8b(TPC_MAX_IOCHUNK_SIZE,
396 	    rtfb_ptr->optimal_bytes_to_token_per_segment);
397 	scsi_u64to8b(TPC_MAX_IOCHUNK_SIZE,
398 	    rtfb_ptr->optimal_bytes_from_token_per_segment);
399 
400 	/* Supported ROD Tokens */
401 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
402 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
403 	srt_ptr = (struct scsi_vpd_tpc_descriptor_srt *)d_ptr;
404 	scsi_ulto2b(SVPD_TPC_SRT, srt_ptr->desc_type);
405 	scsi_ulto2b(sizeof(*srt_ptr) - 4 + 2*sizeof(*srtd_ptr), srt_ptr->desc_length);
406 	scsi_ulto2b(2*sizeof(*srtd_ptr), srt_ptr->rod_type_descriptors_length);
407 	srtd_ptr = (struct scsi_vpd_tpc_descriptor_srtd *)
408 	    &srt_ptr->rod_type_descriptors;
409 	scsi_ulto4b(ROD_TYPE_AUR, srtd_ptr->rod_type);
410 	srtd_ptr->flags = SVPD_TPC_SRTD_TIN | SVPD_TPC_SRTD_TOUT;
411 	scsi_ulto2b(0, srtd_ptr->preference_indicator);
412 	srtd_ptr++;
413 	scsi_ulto4b(ROD_TYPE_BLOCK_ZERO, srtd_ptr->rod_type);
414 	srtd_ptr->flags = SVPD_TPC_SRTD_TIN;
415 	scsi_ulto2b(0, srtd_ptr->preference_indicator);
416 
417 	/* General Copy Operations */
418 	d_ptr = (struct scsi_vpd_tpc_descriptor *)
419 	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
420 	gco_ptr = (struct scsi_vpd_tpc_descriptor_gco *)d_ptr;
421 	scsi_ulto2b(SVPD_TPC_GCO, gco_ptr->desc_type);
422 	scsi_ulto2b(sizeof(*gco_ptr) - 4, gco_ptr->desc_length);
423 	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->total_concurrent_copies);
424 	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->maximum_identified_concurrent_copies);
425 	scsi_ulto4b(TPC_MAX_SEG, gco_ptr->maximum_segment_length);
426 	gco_ptr->data_segment_granularity = 0;
427 	gco_ptr->inline_data_granularity = 0;
428 
429 	ctsio->scsi_status = SCSI_STATUS_OK;
430 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
431 	ctsio->be_move_done = ctl_config_move_done;
432 	ctl_datamove((union ctl_io *)ctsio);
433 
434 	return (CTL_RETVAL_COMPLETE);
435 }
436 
437 int
438 ctl_receive_copy_operating_parameters(struct ctl_scsiio *ctsio)
439 {
440 	struct scsi_receive_copy_operating_parameters *cdb;
441 	struct scsi_receive_copy_operating_parameters_data *data;
442 	int retval;
443 	int alloc_len, total_len;
444 
445 	CTL_DEBUG_PRINT(("ctl_report_supported_tmf\n"));
446 
447 	cdb = (struct scsi_receive_copy_operating_parameters *)ctsio->cdb;
448 
449 	retval = CTL_RETVAL_COMPLETE;
450 
451 	total_len = sizeof(*data) + 4;
452 	alloc_len = scsi_4btoul(cdb->length);
453 
454 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
455 
456 	ctsio->kern_sg_entries = 0;
457 
458 	if (total_len < alloc_len) {
459 		ctsio->residual = alloc_len - total_len;
460 		ctsio->kern_data_len = total_len;
461 		ctsio->kern_total_len = total_len;
462 	} else {
463 		ctsio->residual = 0;
464 		ctsio->kern_data_len = alloc_len;
465 		ctsio->kern_total_len = alloc_len;
466 	}
467 	ctsio->kern_data_resid = 0;
468 	ctsio->kern_rel_offset = 0;
469 
470 	data = (struct scsi_receive_copy_operating_parameters_data *)ctsio->kern_data_ptr;
471 	scsi_ulto4b(sizeof(*data) - 4 + 4, data->length);
472 	data->snlid = RCOP_SNLID;
473 	scsi_ulto2b(TPC_MAX_CSCDS, data->maximum_cscd_descriptor_count);
474 	scsi_ulto2b(TPC_MAX_SEGS, data->maximum_segment_descriptor_count);
475 	scsi_ulto4b(TPC_MAX_LIST, data->maximum_descriptor_list_length);
476 	scsi_ulto4b(TPC_MAX_SEG, data->maximum_segment_length);
477 	scsi_ulto4b(TPC_MAX_INLINE, data->maximum_inline_data_length);
478 	scsi_ulto4b(0, data->held_data_limit);
479 	scsi_ulto4b(0, data->maximum_stream_device_transfer_size);
480 	scsi_ulto2b(TPC_MAX_LISTS, data->total_concurrent_copies);
481 	data->maximum_concurrent_copies = TPC_MAX_LISTS;
482 	data->data_segment_granularity = 0;
483 	data->inline_data_granularity = 0;
484 	data->held_data_granularity = 0;
485 	data->implemented_descriptor_list_length = 4;
486 	data->list_of_implemented_descriptor_type_codes[0] = EC_SEG_B2B;
487 	data->list_of_implemented_descriptor_type_codes[1] = EC_SEG_VERIFY;
488 	data->list_of_implemented_descriptor_type_codes[2] = EC_SEG_REGISTER_KEY;
489 	data->list_of_implemented_descriptor_type_codes[3] = EC_CSCD_ID;
490 
491 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
492 	ctsio->be_move_done = ctl_config_move_done;
493 
494 	ctl_datamove((union ctl_io *)ctsio);
495 	return (retval);
496 }
497 
498 static struct tpc_list *
499 tpc_find_list(struct ctl_lun *lun, uint32_t list_id, uint32_t init_idx)
500 {
501 	struct tpc_list *list;
502 
503 	mtx_assert(&lun->lun_lock, MA_OWNED);
504 	TAILQ_FOREACH(list, &lun->tpc_lists, links) {
505 		if ((list->flags & EC_LIST_ID_USAGE_MASK) !=
506 		     EC_LIST_ID_USAGE_NONE && list->list_id == list_id &&
507 		    list->init_idx == init_idx)
508 			break;
509 	}
510 	return (list);
511 }
512 
513 int
514 ctl_receive_copy_status_lid1(struct ctl_scsiio *ctsio)
515 {
516 	struct ctl_lun *lun;
517 	struct scsi_receive_copy_status_lid1 *cdb;
518 	struct scsi_receive_copy_status_lid1_data *data;
519 	struct tpc_list *list;
520 	struct tpc_list list_copy;
521 	int retval;
522 	int alloc_len, total_len;
523 	uint32_t list_id;
524 
525 	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid1\n"));
526 
527 	cdb = (struct scsi_receive_copy_status_lid1 *)ctsio->cdb;
528 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
529 
530 	retval = CTL_RETVAL_COMPLETE;
531 
532 	list_id = cdb->list_identifier;
533 	mtx_lock(&lun->lun_lock);
534 	list = tpc_find_list(lun, list_id,
535 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
536 	if (list == NULL) {
537 		mtx_unlock(&lun->lun_lock);
538 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
539 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
540 		    /*bit*/ 0);
541 		ctl_done((union ctl_io *)ctsio);
542 		return (retval);
543 	}
544 	list_copy = *list;
545 	if (list->completed) {
546 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
547 		free(list, M_CTL);
548 	}
549 	mtx_unlock(&lun->lun_lock);
550 
551 	total_len = sizeof(*data);
552 	alloc_len = scsi_4btoul(cdb->length);
553 
554 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
555 
556 	ctsio->kern_sg_entries = 0;
557 
558 	if (total_len < alloc_len) {
559 		ctsio->residual = alloc_len - total_len;
560 		ctsio->kern_data_len = total_len;
561 		ctsio->kern_total_len = total_len;
562 	} else {
563 		ctsio->residual = 0;
564 		ctsio->kern_data_len = alloc_len;
565 		ctsio->kern_total_len = alloc_len;
566 	}
567 	ctsio->kern_data_resid = 0;
568 	ctsio->kern_rel_offset = 0;
569 
570 	data = (struct scsi_receive_copy_status_lid1_data *)ctsio->kern_data_ptr;
571 	scsi_ulto4b(sizeof(*data) - 4, data->available_data);
572 	if (list_copy.completed) {
573 		if (list_copy.error || list_copy.abort)
574 			data->copy_command_status = RCS_CCS_ERROR;
575 		else
576 			data->copy_command_status = RCS_CCS_COMPLETED;
577 	} else
578 		data->copy_command_status = RCS_CCS_INPROG;
579 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
580 	if (list_copy.curbytes <= UINT32_MAX) {
581 		data->transfer_count_units = RCS_TC_BYTES;
582 		scsi_ulto4b(list_copy.curbytes, data->transfer_count);
583 	} else {
584 		data->transfer_count_units = RCS_TC_MBYTES;
585 		scsi_ulto4b(list_copy.curbytes >> 20, data->transfer_count);
586 	}
587 
588 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
589 	ctsio->be_move_done = ctl_config_move_done;
590 
591 	ctl_datamove((union ctl_io *)ctsio);
592 	return (retval);
593 }
594 
595 int
596 ctl_receive_copy_failure_details(struct ctl_scsiio *ctsio)
597 {
598 	struct ctl_lun *lun;
599 	struct scsi_receive_copy_failure_details *cdb;
600 	struct scsi_receive_copy_failure_details_data *data;
601 	struct tpc_list *list;
602 	struct tpc_list list_copy;
603 	int retval;
604 	int alloc_len, total_len;
605 	uint32_t list_id;
606 
607 	CTL_DEBUG_PRINT(("ctl_receive_copy_failure_details\n"));
608 
609 	cdb = (struct scsi_receive_copy_failure_details *)ctsio->cdb;
610 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
611 
612 	retval = CTL_RETVAL_COMPLETE;
613 
614 	list_id = cdb->list_identifier;
615 	mtx_lock(&lun->lun_lock);
616 	list = tpc_find_list(lun, list_id,
617 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
618 	if (list == NULL || !list->completed) {
619 		mtx_unlock(&lun->lun_lock);
620 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
621 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
622 		    /*bit*/ 0);
623 		ctl_done((union ctl_io *)ctsio);
624 		return (retval);
625 	}
626 	list_copy = *list;
627 	TAILQ_REMOVE(&lun->tpc_lists, list, links);
628 	free(list, M_CTL);
629 	mtx_unlock(&lun->lun_lock);
630 
631 	total_len = sizeof(*data) + list_copy.sense_len;
632 	alloc_len = scsi_4btoul(cdb->length);
633 
634 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
635 
636 	ctsio->kern_sg_entries = 0;
637 
638 	if (total_len < alloc_len) {
639 		ctsio->residual = alloc_len - total_len;
640 		ctsio->kern_data_len = total_len;
641 		ctsio->kern_total_len = total_len;
642 	} else {
643 		ctsio->residual = 0;
644 		ctsio->kern_data_len = alloc_len;
645 		ctsio->kern_total_len = alloc_len;
646 	}
647 	ctsio->kern_data_resid = 0;
648 	ctsio->kern_rel_offset = 0;
649 
650 	data = (struct scsi_receive_copy_failure_details_data *)ctsio->kern_data_ptr;
651 	if (list_copy.completed && (list_copy.error || list_copy.abort)) {
652 		scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
653 		    data->available_data);
654 		data->copy_command_status = RCS_CCS_ERROR;
655 	} else
656 		scsi_ulto4b(0, data->available_data);
657 	scsi_ulto2b(list_copy.sense_len, data->sense_data_length);
658 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
659 
660 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
661 	ctsio->be_move_done = ctl_config_move_done;
662 
663 	ctl_datamove((union ctl_io *)ctsio);
664 	return (retval);
665 }
666 
667 int
668 ctl_receive_copy_status_lid4(struct ctl_scsiio *ctsio)
669 {
670 	struct ctl_lun *lun;
671 	struct scsi_receive_copy_status_lid4 *cdb;
672 	struct scsi_receive_copy_status_lid4_data *data;
673 	struct tpc_list *list;
674 	struct tpc_list list_copy;
675 	int retval;
676 	int alloc_len, total_len;
677 	uint32_t list_id;
678 
679 	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid4\n"));
680 
681 	cdb = (struct scsi_receive_copy_status_lid4 *)ctsio->cdb;
682 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
683 
684 	retval = CTL_RETVAL_COMPLETE;
685 
686 	list_id = scsi_4btoul(cdb->list_identifier);
687 	mtx_lock(&lun->lun_lock);
688 	list = tpc_find_list(lun, list_id,
689 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
690 	if (list == NULL) {
691 		mtx_unlock(&lun->lun_lock);
692 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
693 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
694 		    /*bit*/ 0);
695 		ctl_done((union ctl_io *)ctsio);
696 		return (retval);
697 	}
698 	list_copy = *list;
699 	if (list->completed) {
700 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
701 		free(list, M_CTL);
702 	}
703 	mtx_unlock(&lun->lun_lock);
704 
705 	total_len = sizeof(*data) + list_copy.sense_len;
706 	alloc_len = scsi_4btoul(cdb->length);
707 
708 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
709 
710 	ctsio->kern_sg_entries = 0;
711 
712 	if (total_len < alloc_len) {
713 		ctsio->residual = alloc_len - total_len;
714 		ctsio->kern_data_len = total_len;
715 		ctsio->kern_total_len = total_len;
716 	} else {
717 		ctsio->residual = 0;
718 		ctsio->kern_data_len = alloc_len;
719 		ctsio->kern_total_len = alloc_len;
720 	}
721 	ctsio->kern_data_resid = 0;
722 	ctsio->kern_rel_offset = 0;
723 
724 	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
725 	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
726 	    data->available_data);
727 	data->response_to_service_action = list_copy.service_action;
728 	if (list_copy.completed) {
729 		if (list_copy.error)
730 			data->copy_command_status = RCS_CCS_ERROR;
731 		else if (list_copy.abort)
732 			data->copy_command_status = RCS_CCS_ABORTED;
733 		else
734 			data->copy_command_status = RCS_CCS_COMPLETED;
735 	} else
736 		data->copy_command_status = RCS_CCS_INPROG_FG;
737 	scsi_ulto2b(list_copy.curops, data->operation_counter);
738 	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
739 	data->transfer_count_units = RCS_TC_BYTES;
740 	scsi_u64to8b(list_copy.curbytes, data->transfer_count);
741 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
742 	data->length_of_the_sense_data_field = list_copy.sense_len;
743 	data->sense_data_length = list_copy.sense_len;
744 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
745 
746 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
747 	ctsio->be_move_done = ctl_config_move_done;
748 
749 	ctl_datamove((union ctl_io *)ctsio);
750 	return (retval);
751 }
752 
753 int
754 ctl_copy_operation_abort(struct ctl_scsiio *ctsio)
755 {
756 	struct ctl_lun *lun;
757 	struct scsi_copy_operation_abort *cdb;
758 	struct tpc_list *list;
759 	int retval;
760 	uint32_t list_id;
761 
762 	CTL_DEBUG_PRINT(("ctl_copy_operation_abort\n"));
763 
764 	cdb = (struct scsi_copy_operation_abort *)ctsio->cdb;
765 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
766 
767 	retval = CTL_RETVAL_COMPLETE;
768 
769 	list_id = scsi_4btoul(cdb->list_identifier);
770 	mtx_lock(&lun->lun_lock);
771 	list = tpc_find_list(lun, list_id,
772 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
773 	if (list == NULL) {
774 		mtx_unlock(&lun->lun_lock);
775 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
776 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
777 		    /*bit*/ 0);
778 		ctl_done((union ctl_io *)ctsio);
779 		return (retval);
780 	}
781 	list->abort = 1;
782 	mtx_unlock(&lun->lun_lock);
783 
784 	ctl_set_success(ctsio);
785 	ctl_done((union ctl_io *)ctsio);
786 	return (retval);
787 }
788 
789 static uint64_t
790 tpc_resolve(struct tpc_list *list, uint16_t idx, uint32_t *ss)
791 {
792 
793 	if (idx == 0xffff) {
794 		if (ss && list->lun->be_lun)
795 			*ss = list->lun->be_lun->blocksize;
796 		return (list->lun->lun);
797 	}
798 	if (idx >= list->ncscd)
799 		return (UINT64_MAX);
800 	return (tpcl_resolve(list->init_port, &list->cscd[idx], ss));
801 }
802 
803 static int
804 tpc_process_b2b(struct tpc_list *list)
805 {
806 	struct scsi_ec_segment_b2b *seg;
807 	struct scsi_ec_cscd_dtsp *sdstp, *ddstp;
808 	struct tpc_io *tior, *tiow;
809 	struct runl run, *prun;
810 	uint64_t sl, dl;
811 	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
812 	int numlba;
813 	uint32_t srcblock, dstblock;
814 
815 	if (list->stage == 1) {
816 complete:
817 		while ((tior = TAILQ_FIRST(&list->allio)) != NULL) {
818 			TAILQ_REMOVE(&list->allio, tior, links);
819 			ctl_free_io(tior->io);
820 			free(tior, M_CTL);
821 		}
822 		free(list->buf, M_CTL);
823 		if (list->abort) {
824 			ctl_set_task_aborted(list->ctsio);
825 			return (CTL_RETVAL_ERROR);
826 		} else if (list->error) {
827 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
828 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
829 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
830 			return (CTL_RETVAL_ERROR);
831 		}
832 		list->cursectors += list->segsectors;
833 		list->curbytes += list->segbytes;
834 		return (CTL_RETVAL_COMPLETE);
835 	}
836 
837 	TAILQ_INIT(&list->allio);
838 	seg = (struct scsi_ec_segment_b2b *)list->seg[list->curseg];
839 	sl = tpc_resolve(list, scsi_2btoul(seg->src_cscd), &srcblock);
840 	dl = tpc_resolve(list, scsi_2btoul(seg->dst_cscd), &dstblock);
841 	if (sl >= CTL_MAX_LUNS || dl >= CTL_MAX_LUNS) {
842 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
843 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
844 		    /*asc*/ 0x08, /*ascq*/ 0x04, SSD_ELEM_NONE);
845 		return (CTL_RETVAL_ERROR);
846 	}
847 	sdstp = &list->cscd[scsi_2btoul(seg->src_cscd)].dtsp;
848 	if (scsi_3btoul(sdstp->block_length) != 0)
849 		srcblock = scsi_3btoul(sdstp->block_length);
850 	ddstp = &list->cscd[scsi_2btoul(seg->dst_cscd)].dtsp;
851 	if (scsi_3btoul(ddstp->block_length) != 0)
852 		dstblock = scsi_3btoul(ddstp->block_length);
853 	numlba = scsi_2btoul(seg->number_of_blocks);
854 	if (seg->flags & EC_SEG_DC)
855 		numbytes = (off_t)numlba * dstblock;
856 	else
857 		numbytes = (off_t)numlba * srcblock;
858 	srclba = scsi_8btou64(seg->src_lba);
859 	dstlba = scsi_8btou64(seg->dst_lba);
860 
861 //	printf("Copy %ju bytes from %ju @ %ju to %ju @ %ju\n",
862 //	    (uintmax_t)numbytes, sl, scsi_8btou64(seg->src_lba),
863 //	    dl, scsi_8btou64(seg->dst_lba));
864 
865 	if (numbytes == 0)
866 		return (CTL_RETVAL_COMPLETE);
867 
868 	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
869 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
870 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
871 		    /*asc*/ 0x26, /*ascq*/ 0x0A, SSD_ELEM_NONE);
872 		return (CTL_RETVAL_ERROR);
873 	}
874 
875 	list->buf = malloc(numbytes, M_CTL, M_WAITOK);
876 	list->segbytes = numbytes;
877 	list->segsectors = numbytes / dstblock;
878 	donebytes = 0;
879 	TAILQ_INIT(&run);
880 	prun = &run;
881 	list->tbdio = 1;
882 	while (donebytes < numbytes) {
883 		roundbytes = MIN(numbytes - donebytes, TPC_MAX_IO_SIZE);
884 
885 		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
886 		TAILQ_INIT(&tior->run);
887 		tior->list = list;
888 		TAILQ_INSERT_TAIL(&list->allio, tior, links);
889 		tior->io = tpcl_alloc_io();
890 		if (tior->io == NULL) {
891 			list->error = 1;
892 			goto complete;
893 		}
894 		ctl_scsi_read_write(tior->io,
895 				    /*data_ptr*/ &list->buf[donebytes],
896 				    /*data_len*/ roundbytes,
897 				    /*read_op*/ 1,
898 				    /*byte2*/ 0,
899 				    /*minimum_cdb_size*/ 0,
900 				    /*lba*/ srclba + donebytes / srcblock,
901 				    /*num_blocks*/ roundbytes / srcblock,
902 				    /*tag_type*/ CTL_TAG_SIMPLE,
903 				    /*control*/ 0);
904 		tior->io->io_hdr.retries = 3;
905 		tior->lun = sl;
906 		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
907 
908 		tiow = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
909 		TAILQ_INIT(&tiow->run);
910 		tiow->list = list;
911 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
912 		tiow->io = tpcl_alloc_io();
913 		if (tiow->io == NULL) {
914 			list->error = 1;
915 			goto complete;
916 		}
917 		ctl_scsi_read_write(tiow->io,
918 				    /*data_ptr*/ &list->buf[donebytes],
919 				    /*data_len*/ roundbytes,
920 				    /*read_op*/ 0,
921 				    /*byte2*/ 0,
922 				    /*minimum_cdb_size*/ 0,
923 				    /*lba*/ dstlba + donebytes / dstblock,
924 				    /*num_blocks*/ roundbytes / dstblock,
925 				    /*tag_type*/ CTL_TAG_SIMPLE,
926 				    /*control*/ 0);
927 		tiow->io->io_hdr.retries = 3;
928 		tiow->lun = dl;
929 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
930 
931 		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
932 		TAILQ_INSERT_TAIL(prun, tior, rlinks);
933 		prun = &tior->run;
934 		donebytes += roundbytes;
935 	}
936 
937 	while ((tior = TAILQ_FIRST(&run)) != NULL) {
938 		TAILQ_REMOVE(&run, tior, rlinks);
939 		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
940 			panic("tpcl_queue() error");
941 	}
942 
943 	list->stage++;
944 	return (CTL_RETVAL_QUEUED);
945 }
946 
947 static int
948 tpc_process_verify(struct tpc_list *list)
949 {
950 	struct scsi_ec_segment_verify *seg;
951 	struct tpc_io *tio;
952 	uint64_t sl;
953 
954 	if (list->stage == 1) {
955 complete:
956 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
957 			TAILQ_REMOVE(&list->allio, tio, links);
958 			ctl_free_io(tio->io);
959 			free(tio, M_CTL);
960 		}
961 		if (list->abort) {
962 			ctl_set_task_aborted(list->ctsio);
963 			return (CTL_RETVAL_ERROR);
964 		} else if (list->error) {
965 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
966 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
967 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
968 			return (CTL_RETVAL_ERROR);
969 		} else
970 			return (CTL_RETVAL_COMPLETE);
971 	}
972 
973 	TAILQ_INIT(&list->allio);
974 	seg = (struct scsi_ec_segment_verify *)list->seg[list->curseg];
975 	sl = tpc_resolve(list, scsi_2btoul(seg->src_cscd), NULL);
976 	if (sl >= CTL_MAX_LUNS) {
977 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
978 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
979 		    /*asc*/ 0x08, /*ascq*/ 0x04, SSD_ELEM_NONE);
980 		return (CTL_RETVAL_ERROR);
981 	}
982 
983 //	printf("Verify %ju\n", sl);
984 
985 	if ((seg->tur & 0x01) == 0)
986 		return (CTL_RETVAL_COMPLETE);
987 
988 	list->tbdio = 1;
989 	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
990 	TAILQ_INIT(&tio->run);
991 	tio->list = list;
992 	TAILQ_INSERT_TAIL(&list->allio, tio, links);
993 	tio->io = tpcl_alloc_io();
994 	if (tio->io == NULL) {
995 		list->error = 1;
996 		goto complete;
997 	}
998 	ctl_scsi_tur(tio->io, /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
999 	tio->io->io_hdr.retries = 3;
1000 	tio->lun = sl;
1001 	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1002 	list->stage++;
1003 	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1004 		panic("tpcl_queue() error");
1005 	return (CTL_RETVAL_QUEUED);
1006 }
1007 
1008 static int
1009 tpc_process_register_key(struct tpc_list *list)
1010 {
1011 	struct scsi_ec_segment_register_key *seg;
1012 	struct tpc_io *tio;
1013 	uint64_t dl;
1014 	int datalen;
1015 
1016 	if (list->stage == 1) {
1017 complete:
1018 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1019 			TAILQ_REMOVE(&list->allio, tio, links);
1020 			ctl_free_io(tio->io);
1021 			free(tio, M_CTL);
1022 		}
1023 		free(list->buf, M_CTL);
1024 		if (list->abort) {
1025 			ctl_set_task_aborted(list->ctsio);
1026 			return (CTL_RETVAL_ERROR);
1027 		} else if (list->error) {
1028 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1029 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1030 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
1031 			return (CTL_RETVAL_ERROR);
1032 		} else
1033 			return (CTL_RETVAL_COMPLETE);
1034 	}
1035 
1036 	TAILQ_INIT(&list->allio);
1037 	seg = (struct scsi_ec_segment_register_key *)list->seg[list->curseg];
1038 	dl = tpc_resolve(list, scsi_2btoul(seg->dst_cscd), NULL);
1039 	if (dl >= CTL_MAX_LUNS) {
1040 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1041 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1042 		    /*asc*/ 0x08, /*ascq*/ 0x04, SSD_ELEM_NONE);
1043 		return (CTL_RETVAL_ERROR);
1044 	}
1045 
1046 //	printf("Register Key %ju\n", dl);
1047 
1048 	list->tbdio = 1;
1049 	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1050 	TAILQ_INIT(&tio->run);
1051 	tio->list = list;
1052 	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1053 	tio->io = tpcl_alloc_io();
1054 	if (tio->io == NULL) {
1055 		list->error = 1;
1056 		goto complete;
1057 	}
1058 	datalen = sizeof(struct scsi_per_res_out_parms);
1059 	list->buf = malloc(datalen, M_CTL, M_WAITOK);
1060 	ctl_scsi_persistent_res_out(tio->io,
1061 	    list->buf, datalen, SPRO_REGISTER, -1,
1062 	    scsi_8btou64(seg->res_key), scsi_8btou64(seg->sa_res_key),
1063 	    /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1064 	tio->io->io_hdr.retries = 3;
1065 	tio->lun = dl;
1066 	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1067 	list->stage++;
1068 	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1069 		panic("tpcl_queue() error");
1070 	return (CTL_RETVAL_QUEUED);
1071 }
1072 
1073 static off_t
1074 tpc_ranges_length(struct scsi_range_desc *range, int nrange)
1075 {
1076 	off_t length = 0;
1077 	int r;
1078 
1079 	for (r = 0; r < nrange; r++)
1080 		length += scsi_4btoul(range[r].length);
1081 	return (length);
1082 }
1083 
1084 static int
1085 tpc_skip_ranges(struct scsi_range_desc *range, int nrange, off_t skip,
1086     int *srange, off_t *soffset)
1087 {
1088 	off_t off;
1089 	int r;
1090 
1091 	r = 0;
1092 	off = 0;
1093 	while (r < nrange) {
1094 		if (skip - off < scsi_4btoul(range[r].length)) {
1095 			*srange = r;
1096 			*soffset = skip - off;
1097 			return (0);
1098 		}
1099 		off += scsi_4btoul(range[r].length);
1100 		r++;
1101 	}
1102 	return (-1);
1103 }
1104 
1105 static int
1106 tpc_process_wut(struct tpc_list *list)
1107 {
1108 	struct tpc_io *tio, *tior, *tiow;
1109 	struct runl run, *prun;
1110 	int drange, srange;
1111 	off_t doffset, soffset;
1112 	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
1113 	uint32_t srcblock, dstblock;
1114 
1115 	if (list->stage > 0) {
1116 complete:
1117 		/* Cleanup after previous rounds. */
1118 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1119 			TAILQ_REMOVE(&list->allio, tio, links);
1120 			ctl_free_io(tio->io);
1121 			free(tio, M_CTL);
1122 		}
1123 		free(list->buf, M_CTL);
1124 		if (list->abort) {
1125 			ctl_set_task_aborted(list->ctsio);
1126 			return (CTL_RETVAL_ERROR);
1127 		} else if (list->error) {
1128 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1129 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1130 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
1131 			return (CTL_RETVAL_ERROR);
1132 		}
1133 		list->cursectors += list->segsectors;
1134 		list->curbytes += list->segbytes;
1135 	}
1136 
1137 	/* Check where we are on destination ranges list. */
1138 	if (tpc_skip_ranges(list->range, list->nrange, list->cursectors,
1139 	    &drange, &doffset) != 0)
1140 		return (CTL_RETVAL_COMPLETE);
1141 	dstblock = list->lun->be_lun->blocksize;
1142 
1143 	/* Check where we are on source ranges list. */
1144 	srcblock = list->token->blocksize;
1145 	if (tpc_skip_ranges(list->token->range, list->token->nrange,
1146 	    list->offset_into_rod + list->cursectors * dstblock / srcblock,
1147 	    &srange, &soffset) != 0) {
1148 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1149 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1150 		    /*asc*/ 0x0d, /*ascq*/ 0x04, SSD_ELEM_NONE);
1151 		return (CTL_RETVAL_ERROR);
1152 	}
1153 
1154 	srclba = scsi_8btou64(list->token->range[srange].lba) + soffset;
1155 	numbytes = srcblock * omin(TPC_MAX_IOCHUNK_SIZE / srcblock,
1156 	    (scsi_4btoul(list->token->range[srange].length) - soffset));
1157 	dstlba = scsi_8btou64(list->range[drange].lba) + doffset;
1158 	numbytes = omin(numbytes,
1159 	    dstblock * omin(TPC_MAX_IOCHUNK_SIZE / dstblock,
1160 	    (scsi_4btoul(list->range[drange].length) - doffset)));
1161 
1162 	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
1163 		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1164 		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1165 		    /*asc*/ 0x26, /*ascq*/ 0x0A, SSD_ELEM_NONE);
1166 		return (CTL_RETVAL_ERROR);
1167 	}
1168 
1169 	list->buf = malloc(numbytes, M_CTL, M_WAITOK |
1170 	    (list->token == NULL ? M_ZERO : 0));
1171 	list->segbytes = numbytes;
1172 	list->segsectors = numbytes / dstblock;
1173 //printf("Copy chunk of %ju sectors from %ju to %ju\n", list->segsectors,
1174 //    srclba, dstlba);
1175 	donebytes = 0;
1176 	TAILQ_INIT(&run);
1177 	prun = &run;
1178 	list->tbdio = 1;
1179 	TAILQ_INIT(&list->allio);
1180 	while (donebytes < numbytes) {
1181 		roundbytes = MIN(numbytes - donebytes, TPC_MAX_IO_SIZE);
1182 
1183 		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
1184 		TAILQ_INIT(&tior->run);
1185 		tior->list = list;
1186 		TAILQ_INSERT_TAIL(&list->allio, tior, links);
1187 		tior->io = tpcl_alloc_io();
1188 		if (tior->io == NULL) {
1189 			list->error = 1;
1190 			goto complete;
1191 		}
1192 		ctl_scsi_read_write(tior->io,
1193 				    /*data_ptr*/ &list->buf[donebytes],
1194 				    /*data_len*/ roundbytes,
1195 				    /*read_op*/ 1,
1196 				    /*byte2*/ 0,
1197 				    /*minimum_cdb_size*/ 0,
1198 				    /*lba*/ srclba + donebytes / srcblock,
1199 				    /*num_blocks*/ roundbytes / srcblock,
1200 				    /*tag_type*/ CTL_TAG_SIMPLE,
1201 				    /*control*/ 0);
1202 		tior->io->io_hdr.retries = 3;
1203 		tior->lun = list->token->lun;
1204 		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
1205 
1206 		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1207 		TAILQ_INIT(&tiow->run);
1208 		tiow->list = list;
1209 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1210 		tiow->io = tpcl_alloc_io();
1211 		if (tiow->io == NULL) {
1212 			list->error = 1;
1213 			goto complete;
1214 		}
1215 		ctl_scsi_read_write(tiow->io,
1216 				    /*data_ptr*/ &list->buf[donebytes],
1217 				    /*data_len*/ roundbytes,
1218 				    /*read_op*/ 0,
1219 				    /*byte2*/ 0,
1220 				    /*minimum_cdb_size*/ 0,
1221 				    /*lba*/ dstlba + donebytes / dstblock,
1222 				    /*num_blocks*/ roundbytes / dstblock,
1223 				    /*tag_type*/ CTL_TAG_SIMPLE,
1224 				    /*control*/ 0);
1225 		tiow->io->io_hdr.retries = 3;
1226 		tiow->lun = list->lun->lun;
1227 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1228 
1229 		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
1230 		TAILQ_INSERT_TAIL(prun, tior, rlinks);
1231 		prun = &tior->run;
1232 		donebytes += roundbytes;
1233 	}
1234 
1235 	while ((tior = TAILQ_FIRST(&run)) != NULL) {
1236 		TAILQ_REMOVE(&run, tior, rlinks);
1237 		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1238 			panic("tpcl_queue() error");
1239 	}
1240 
1241 	list->stage++;
1242 	return (CTL_RETVAL_QUEUED);
1243 }
1244 
1245 static int
1246 tpc_process_zero_wut(struct tpc_list *list)
1247 {
1248 	struct tpc_io *tio, *tiow;
1249 	struct runl run, *prun;
1250 	int r;
1251 	uint32_t dstblock, len;
1252 
1253 	if (list->stage > 0) {
1254 complete:
1255 		/* Cleanup after previous rounds. */
1256 		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1257 			TAILQ_REMOVE(&list->allio, tio, links);
1258 			ctl_free_io(tio->io);
1259 			free(tio, M_CTL);
1260 		}
1261 		free(list->buf, M_CTL);
1262 		if (list->abort) {
1263 			ctl_set_task_aborted(list->ctsio);
1264 			return (CTL_RETVAL_ERROR);
1265 		} else if (list->error) {
1266 			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1267 			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1268 			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
1269 			return (CTL_RETVAL_ERROR);
1270 		}
1271 		list->cursectors += list->segsectors;
1272 		list->curbytes += list->segbytes;
1273 		return (CTL_RETVAL_COMPLETE);
1274 	}
1275 
1276 	dstblock = list->lun->be_lun->blocksize;
1277 	list->buf = malloc(dstblock, M_CTL, M_WAITOK | M_ZERO);
1278 	TAILQ_INIT(&run);
1279 	prun = &run;
1280 	list->tbdio = 1;
1281 	TAILQ_INIT(&list->allio);
1282 	list->segsectors = 0;
1283 	for (r = 0; r < list->nrange; r++) {
1284 		len = scsi_4btoul(list->range[r].length);
1285 		if (len == 0)
1286 			continue;
1287 
1288 		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1289 		TAILQ_INIT(&tiow->run);
1290 		tiow->list = list;
1291 		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1292 		tiow->io = tpcl_alloc_io();
1293 		if (tiow->io == NULL) {
1294 			list->error = 1;
1295 			goto complete;
1296 		}
1297 		ctl_scsi_write_same(tiow->io,
1298 				    /*data_ptr*/ list->buf,
1299 				    /*data_len*/ dstblock,
1300 				    /*byte2*/ 0,
1301 				    /*lba*/ scsi_8btou64(list->range[r].lba),
1302 				    /*num_blocks*/ len,
1303 				    /*tag_type*/ CTL_TAG_SIMPLE,
1304 				    /*control*/ 0);
1305 		tiow->io->io_hdr.retries = 3;
1306 		tiow->lun = list->lun->lun;
1307 		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1308 
1309 		TAILQ_INSERT_TAIL(prun, tiow, rlinks);
1310 		prun = &tiow->run;
1311 		list->segsectors += len;
1312 	}
1313 	list->segbytes = list->segsectors * dstblock;
1314 
1315 	if (TAILQ_EMPTY(&run))
1316 		goto complete;
1317 
1318 	while ((tiow = TAILQ_FIRST(&run)) != NULL) {
1319 		TAILQ_REMOVE(&run, tiow, rlinks);
1320 		if (tpcl_queue(tiow->io, tiow->lun) != CTL_RETVAL_COMPLETE)
1321 			panic("tpcl_queue() error");
1322 	}
1323 
1324 	list->stage++;
1325 	return (CTL_RETVAL_QUEUED);
1326 }
1327 
1328 static void
1329 tpc_process(struct tpc_list *list)
1330 {
1331 	struct ctl_lun *lun = list->lun;
1332 	struct scsi_ec_segment *seg;
1333 	struct ctl_scsiio *ctsio = list->ctsio;
1334 	int retval = CTL_RETVAL_COMPLETE;
1335 
1336 	if (list->service_action == EC_WUT) {
1337 		if (list->token != NULL)
1338 			retval = tpc_process_wut(list);
1339 		else
1340 			retval = tpc_process_zero_wut(list);
1341 		if (retval == CTL_RETVAL_QUEUED)
1342 			return;
1343 		if (retval == CTL_RETVAL_ERROR) {
1344 			list->error = 1;
1345 			goto done;
1346 		}
1347 	} else {
1348 //printf("ZZZ %d cscd, %d segs\n", list->ncscd, list->nseg);
1349 		while (list->curseg < list->nseg) {
1350 			seg = list->seg[list->curseg];
1351 			switch (seg->type_code) {
1352 			case EC_SEG_B2B:
1353 				retval = tpc_process_b2b(list);
1354 				break;
1355 			case EC_SEG_VERIFY:
1356 				retval = tpc_process_verify(list);
1357 				break;
1358 			case EC_SEG_REGISTER_KEY:
1359 				retval = tpc_process_register_key(list);
1360 				break;
1361 			default:
1362 				ctl_set_sense(ctsio, /*current_error*/ 1,
1363 				    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1364 				    /*asc*/ 0x26, /*ascq*/ 0x09, SSD_ELEM_NONE);
1365 				goto done;
1366 			}
1367 			if (retval == CTL_RETVAL_QUEUED)
1368 				return;
1369 			if (retval == CTL_RETVAL_ERROR) {
1370 				list->error = 1;
1371 				goto done;
1372 			}
1373 			list->curseg++;
1374 			list->stage = 0;
1375 		}
1376 	}
1377 
1378 	ctl_set_success(ctsio);
1379 
1380 done:
1381 //printf("ZZZ done\n");
1382 	free(list->params, M_CTL);
1383 	list->params = NULL;
1384 	if (list->token) {
1385 		mtx_lock(&control_softc->ctl_lock);
1386 		if (--list->token->active == 0)
1387 			list->token->last_active = time_uptime;
1388 		mtx_unlock(&control_softc->ctl_lock);
1389 		list->token = NULL;
1390 	}
1391 	mtx_lock(&lun->lun_lock);
1392 	if ((list->flags & EC_LIST_ID_USAGE_MASK) == EC_LIST_ID_USAGE_NONE) {
1393 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
1394 		free(list, M_CTL);
1395 	} else {
1396 		list->completed = 1;
1397 		list->last_active = time_uptime;
1398 		list->sense_data = ctsio->sense_data;
1399 		list->sense_len = ctsio->sense_len;
1400 		list->scsi_status = ctsio->scsi_status;
1401 	}
1402 	mtx_unlock(&lun->lun_lock);
1403 
1404 	ctl_done((union ctl_io *)ctsio);
1405 }
1406 
1407 /*
1408  * For any sort of check condition, busy, etc., we just retry.  We do not
1409  * decrement the retry count for unit attention type errors.  These are
1410  * normal, and we want to save the retry count for "real" errors.  Otherwise,
1411  * we could end up with situations where a command will succeed in some
1412  * situations and fail in others, depending on whether a unit attention is
1413  * pending.  Also, some of our error recovery actions, most notably the
1414  * LUN reset action, will cause a unit attention.
1415  *
1416  * We can add more detail here later if necessary.
1417  */
1418 static tpc_error_action
1419 tpc_checkcond_parse(union ctl_io *io)
1420 {
1421 	tpc_error_action error_action;
1422 	int error_code, sense_key, asc, ascq;
1423 
1424 	/*
1425 	 * Default to retrying the command.
1426 	 */
1427 	error_action = TPC_ERR_RETRY;
1428 
1429 	scsi_extract_sense_len(&io->scsiio.sense_data,
1430 			       io->scsiio.sense_len,
1431 			       &error_code,
1432 			       &sense_key,
1433 			       &asc,
1434 			       &ascq,
1435 			       /*show_errors*/ 1);
1436 
1437 	switch (error_code) {
1438 	case SSD_DEFERRED_ERROR:
1439 	case SSD_DESC_DEFERRED_ERROR:
1440 		error_action |= TPC_ERR_NO_DECREMENT;
1441 		break;
1442 	case SSD_CURRENT_ERROR:
1443 	case SSD_DESC_CURRENT_ERROR:
1444 	default:
1445 		switch (sense_key) {
1446 		case SSD_KEY_UNIT_ATTENTION:
1447 			error_action |= TPC_ERR_NO_DECREMENT;
1448 			break;
1449 		case SSD_KEY_HARDWARE_ERROR:
1450 			/*
1451 			 * This is our generic "something bad happened"
1452 			 * error code.  It often isn't recoverable.
1453 			 */
1454 			if ((asc == 0x44) && (ascq == 0x00))
1455 				error_action = TPC_ERR_FAIL;
1456 			break;
1457 		case SSD_KEY_NOT_READY:
1458 			/*
1459 			 * If the LUN is powered down, there likely isn't
1460 			 * much point in retrying right now.
1461 			 */
1462 			if ((asc == 0x04) && (ascq == 0x02))
1463 				error_action = TPC_ERR_FAIL;
1464 			/*
1465 			 * If the LUN is offline, there probably isn't much
1466 			 * point in retrying, either.
1467 			 */
1468 			if ((asc == 0x04) && (ascq == 0x03))
1469 				error_action = TPC_ERR_FAIL;
1470 			break;
1471 		}
1472 	}
1473 	return (error_action);
1474 }
1475 
1476 static tpc_error_action
1477 tpc_error_parse(union ctl_io *io)
1478 {
1479 	tpc_error_action error_action = TPC_ERR_RETRY;
1480 
1481 	switch (io->io_hdr.io_type) {
1482 	case CTL_IO_SCSI:
1483 		switch (io->io_hdr.status & CTL_STATUS_MASK) {
1484 		case CTL_SCSI_ERROR:
1485 			switch (io->scsiio.scsi_status) {
1486 			case SCSI_STATUS_CHECK_COND:
1487 				error_action = tpc_checkcond_parse(io);
1488 				break;
1489 			default:
1490 				break;
1491 			}
1492 			break;
1493 		default:
1494 			break;
1495 		}
1496 		break;
1497 	case CTL_IO_TASK:
1498 		break;
1499 	default:
1500 		panic("%s: invalid ctl_io type %d\n", __func__,
1501 		      io->io_hdr.io_type);
1502 		break;
1503 	}
1504 	return (error_action);
1505 }
1506 
1507 void
1508 tpc_done(union ctl_io *io)
1509 {
1510 	struct tpc_io *tio, *tior;
1511 
1512 	/*
1513 	 * Very minimal retry logic.  We basically retry if we got an error
1514 	 * back, and the retry count is greater than 0.  If we ever want
1515 	 * more sophisticated initiator type behavior, the CAM error
1516 	 * recovery code in ../common might be helpful.
1517 	 */
1518 //	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1519 //		ctl_io_error_print(io, NULL);
1520 	tio = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1521 	if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1522 	 && (io->io_hdr.retries > 0)) {
1523 		ctl_io_status old_status;
1524 		tpc_error_action error_action;
1525 
1526 		error_action = tpc_error_parse(io);
1527 		switch (error_action & TPC_ERR_MASK) {
1528 		case TPC_ERR_FAIL:
1529 			break;
1530 		case TPC_ERR_RETRY:
1531 		default:
1532 			if ((error_action & TPC_ERR_NO_DECREMENT) == 0)
1533 				io->io_hdr.retries--;
1534 			old_status = io->io_hdr.status;
1535 			io->io_hdr.status = CTL_STATUS_NONE;
1536 			io->io_hdr.flags &= ~CTL_FLAG_ABORT;
1537 			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
1538 			if (tpcl_queue(io, tio->lun) != CTL_RETVAL_COMPLETE) {
1539 				printf("%s: error returned from ctl_queue()!\n",
1540 				       __func__);
1541 				io->io_hdr.status = old_status;
1542 			} else
1543 				return;
1544 		}
1545 	}
1546 
1547 	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1548 		tio->list->error = 1;
1549 	else
1550 		atomic_add_int(&tio->list->curops, 1);
1551 	if (!tio->list->error && !tio->list->abort) {
1552 		while ((tior = TAILQ_FIRST(&tio->run)) != NULL) {
1553 			TAILQ_REMOVE(&tio->run, tior, rlinks);
1554 			atomic_add_int(&tio->list->tbdio, 1);
1555 			if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1556 				panic("tpcl_queue() error");
1557 		}
1558 	}
1559 	if (atomic_fetchadd_int(&tio->list->tbdio, -1) == 1)
1560 		tpc_process(tio->list);
1561 }
1562 
1563 int
1564 ctl_extended_copy_lid1(struct ctl_scsiio *ctsio)
1565 {
1566 	struct scsi_extended_copy *cdb;
1567 	struct scsi_extended_copy_lid1_data *data;
1568 	struct ctl_lun *lun;
1569 	struct tpc_list *list, *tlist;
1570 	uint8_t *ptr;
1571 	char *value;
1572 	int len, off, lencscd, lenseg, leninl, nseg;
1573 
1574 	CTL_DEBUG_PRINT(("ctl_extended_copy_lid1\n"));
1575 
1576 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1577 	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1578 	len = scsi_4btoul(cdb->length);
1579 
1580 	if (len < sizeof(struct scsi_extended_copy_lid1_data) ||
1581 	    len > sizeof(struct scsi_extended_copy_lid1_data) +
1582 	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1583 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1584 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1585 		goto done;
1586 	}
1587 
1588 	/*
1589 	 * If we've got a kernel request that hasn't been malloced yet,
1590 	 * malloc it and tell the caller the data buffer is here.
1591 	 */
1592 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1593 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1594 		ctsio->kern_data_len = len;
1595 		ctsio->kern_total_len = len;
1596 		ctsio->kern_data_resid = 0;
1597 		ctsio->kern_rel_offset = 0;
1598 		ctsio->kern_sg_entries = 0;
1599 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1600 		ctsio->be_move_done = ctl_config_move_done;
1601 		ctl_datamove((union ctl_io *)ctsio);
1602 
1603 		return (CTL_RETVAL_COMPLETE);
1604 	}
1605 
1606 	data = (struct scsi_extended_copy_lid1_data *)ctsio->kern_data_ptr;
1607 	lencscd = scsi_2btoul(data->cscd_list_length);
1608 	lenseg = scsi_4btoul(data->segment_list_length);
1609 	leninl = scsi_4btoul(data->inline_data_length);
1610 	if (len < sizeof(struct scsi_extended_copy_lid1_data) +
1611 	    lencscd + lenseg + leninl ||
1612 	    leninl > TPC_MAX_INLINE) {
1613 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1614 		    /*field*/ 2, /*bit_valid*/ 0, /*bit*/ 0);
1615 		goto done;
1616 	}
1617 	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1618 		ctl_set_sense(ctsio, /*current_error*/ 1,
1619 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1620 		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1621 		goto done;
1622 	}
1623 	if (lencscd + lenseg > TPC_MAX_LIST) {
1624 		ctl_set_param_len_error(ctsio);
1625 		goto done;
1626 	}
1627 
1628 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1629 	list->service_action = cdb->service_action;
1630 	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1631 	if (value != NULL && strcmp(value, "on") == 0)
1632 		list->init_port = -1;
1633 	else
1634 		list->init_port = ctsio->io_hdr.nexus.targ_port;
1635 	list->init_idx = ctl_get_resindex(&ctsio->io_hdr.nexus);
1636 	list->list_id = data->list_identifier;
1637 	list->flags = data->flags;
1638 	list->params = ctsio->kern_data_ptr;
1639 	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1640 	ptr = &data->data[lencscd];
1641 	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1642 		if (nseg >= TPC_MAX_SEGS) {
1643 			free(list, M_CTL);
1644 			ctl_set_sense(ctsio, /*current_error*/ 1,
1645 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1646 			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1647 			goto done;
1648 		}
1649 		list->seg[nseg] = (struct scsi_ec_segment *)(ptr + off);
1650 		off += sizeof(struct scsi_ec_segment) +
1651 		    scsi_2btoul(list->seg[nseg]->descr_length);
1652 	}
1653 	list->inl = &data->data[lencscd + lenseg];
1654 	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1655 	list->nseg = nseg;
1656 	list->leninl = leninl;
1657 	list->ctsio = ctsio;
1658 	list->lun = lun;
1659 	mtx_lock(&lun->lun_lock);
1660 	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1661 		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1662 		if (tlist != NULL && !tlist->completed) {
1663 			mtx_unlock(&lun->lun_lock);
1664 			free(list, M_CTL);
1665 			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1666 			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1667 			    /*bit*/ 0);
1668 			goto done;
1669 		}
1670 		if (tlist != NULL) {
1671 			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1672 			free(tlist, M_CTL);
1673 		}
1674 	}
1675 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1676 	mtx_unlock(&lun->lun_lock);
1677 
1678 	tpc_process(list);
1679 	return (CTL_RETVAL_COMPLETE);
1680 
1681 done:
1682 	ctl_done((union ctl_io *)ctsio);
1683 	return (CTL_RETVAL_COMPLETE);
1684 }
1685 
1686 int
1687 ctl_extended_copy_lid4(struct ctl_scsiio *ctsio)
1688 {
1689 	struct scsi_extended_copy *cdb;
1690 	struct scsi_extended_copy_lid4_data *data;
1691 	struct ctl_lun *lun;
1692 	struct tpc_list *list, *tlist;
1693 	uint8_t *ptr;
1694 	char *value;
1695 	int len, off, lencscd, lenseg, leninl, nseg;
1696 
1697 	CTL_DEBUG_PRINT(("ctl_extended_copy_lid4\n"));
1698 
1699 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1700 	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1701 	len = scsi_4btoul(cdb->length);
1702 
1703 	if (len < sizeof(struct scsi_extended_copy_lid4_data) ||
1704 	    len > sizeof(struct scsi_extended_copy_lid4_data) +
1705 	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1706 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1707 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1708 		goto done;
1709 	}
1710 
1711 	/*
1712 	 * If we've got a kernel request that hasn't been malloced yet,
1713 	 * malloc it and tell the caller the data buffer is here.
1714 	 */
1715 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1716 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1717 		ctsio->kern_data_len = len;
1718 		ctsio->kern_total_len = len;
1719 		ctsio->kern_data_resid = 0;
1720 		ctsio->kern_rel_offset = 0;
1721 		ctsio->kern_sg_entries = 0;
1722 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1723 		ctsio->be_move_done = ctl_config_move_done;
1724 		ctl_datamove((union ctl_io *)ctsio);
1725 
1726 		return (CTL_RETVAL_COMPLETE);
1727 	}
1728 
1729 	data = (struct scsi_extended_copy_lid4_data *)ctsio->kern_data_ptr;
1730 	lencscd = scsi_2btoul(data->cscd_list_length);
1731 	lenseg = scsi_2btoul(data->segment_list_length);
1732 	leninl = scsi_2btoul(data->inline_data_length);
1733 	if (len < sizeof(struct scsi_extended_copy_lid4_data) +
1734 	    lencscd + lenseg + leninl ||
1735 	    leninl > TPC_MAX_INLINE) {
1736 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1737 		    /*field*/ 2, /*bit_valid*/ 0, /*bit*/ 0);
1738 		goto done;
1739 	}
1740 	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1741 		ctl_set_sense(ctsio, /*current_error*/ 1,
1742 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1743 		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1744 		goto done;
1745 	}
1746 	if (lencscd + lenseg > TPC_MAX_LIST) {
1747 		ctl_set_param_len_error(ctsio);
1748 		goto done;
1749 	}
1750 
1751 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1752 	list->service_action = cdb->service_action;
1753 	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1754 	if (value != NULL && strcmp(value, "on") == 0)
1755 		list->init_port = -1;
1756 	else
1757 		list->init_port = ctsio->io_hdr.nexus.targ_port;
1758 	list->init_idx = ctl_get_resindex(&ctsio->io_hdr.nexus);
1759 	list->list_id = scsi_4btoul(data->list_identifier);
1760 	list->flags = data->flags;
1761 	list->params = ctsio->kern_data_ptr;
1762 	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1763 	ptr = &data->data[lencscd];
1764 	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1765 		if (nseg >= TPC_MAX_SEGS) {
1766 			free(list, M_CTL);
1767 			ctl_set_sense(ctsio, /*current_error*/ 1,
1768 			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1769 			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1770 			goto done;
1771 		}
1772 		list->seg[nseg] = (struct scsi_ec_segment *)(ptr + off);
1773 		off += sizeof(struct scsi_ec_segment) +
1774 		    scsi_2btoul(list->seg[nseg]->descr_length);
1775 	}
1776 	list->inl = &data->data[lencscd + lenseg];
1777 	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1778 	list->nseg = nseg;
1779 	list->leninl = leninl;
1780 	list->ctsio = ctsio;
1781 	list->lun = lun;
1782 	mtx_lock(&lun->lun_lock);
1783 	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1784 		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1785 		if (tlist != NULL && !tlist->completed) {
1786 			mtx_unlock(&lun->lun_lock);
1787 			free(list, M_CTL);
1788 			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1789 			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1790 			    /*bit*/ 0);
1791 			goto done;
1792 		}
1793 		if (tlist != NULL) {
1794 			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1795 			free(tlist, M_CTL);
1796 		}
1797 	}
1798 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1799 	mtx_unlock(&lun->lun_lock);
1800 
1801 	tpc_process(list);
1802 	return (CTL_RETVAL_COMPLETE);
1803 
1804 done:
1805 	ctl_done((union ctl_io *)ctsio);
1806 	return (CTL_RETVAL_COMPLETE);
1807 }
1808 
1809 static void
1810 tpc_create_token(struct ctl_lun *lun, struct ctl_port *port, off_t len,
1811     struct scsi_token *token)
1812 {
1813 	static int id = 0;
1814 	struct scsi_vpd_id_descriptor *idd = NULL;
1815 	int targid_len;
1816 
1817 	scsi_ulto4b(ROD_TYPE_AUR, token->type);
1818 	scsi_ulto2b(0x01f8, token->length);
1819 	scsi_u64to8b(atomic_fetchadd_int(&id, 1), &token->body[0]);
1820 	if (lun->lun_devid)
1821 		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
1822 		    lun->lun_devid->data, lun->lun_devid->len,
1823 		    scsi_devid_is_lun_naa);
1824 	if (idd == NULL && lun->lun_devid)
1825 		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
1826 		    lun->lun_devid->data, lun->lun_devid->len,
1827 		    scsi_devid_is_lun_eui64);
1828 	if (idd != NULL)
1829 		memcpy(&token->body[8], idd, 4 + idd->length);
1830 	scsi_u64to8b(0, &token->body[40]);
1831 	scsi_u64to8b(len, &token->body[48]);
1832 	if (port->target_devid) {
1833 		targid_len = port->target_devid->len;
1834 		memcpy(&token->body[120], port->target_devid->data, targid_len);
1835 	} else
1836 		targid_len = 32;
1837 	arc4rand(&token->body[120 + targid_len], 384 - targid_len, 0);
1838 };
1839 
1840 int
1841 ctl_populate_token(struct ctl_scsiio *ctsio)
1842 {
1843 	struct scsi_populate_token *cdb;
1844 	struct scsi_populate_token_data *data;
1845 	struct ctl_lun *lun;
1846 	struct ctl_port *port;
1847 	struct tpc_list *list, *tlist;
1848 	struct tpc_token *token;
1849 	int len, lendesc;
1850 
1851 	CTL_DEBUG_PRINT(("ctl_populate_token\n"));
1852 
1853 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1854 	port = control_softc->ctl_ports[ctl_port_idx(ctsio->io_hdr.nexus.targ_port)];
1855 	cdb = (struct scsi_populate_token *)ctsio->cdb;
1856 	len = scsi_4btoul(cdb->length);
1857 
1858 	if (len < sizeof(struct scsi_populate_token_data) ||
1859 	    len > sizeof(struct scsi_populate_token_data) +
1860 	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
1861 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1862 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1863 		goto done;
1864 	}
1865 
1866 	/*
1867 	 * If we've got a kernel request that hasn't been malloced yet,
1868 	 * malloc it and tell the caller the data buffer is here.
1869 	 */
1870 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1871 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1872 		ctsio->kern_data_len = len;
1873 		ctsio->kern_total_len = len;
1874 		ctsio->kern_data_resid = 0;
1875 		ctsio->kern_rel_offset = 0;
1876 		ctsio->kern_sg_entries = 0;
1877 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1878 		ctsio->be_move_done = ctl_config_move_done;
1879 		ctl_datamove((union ctl_io *)ctsio);
1880 
1881 		return (CTL_RETVAL_COMPLETE);
1882 	}
1883 
1884 	data = (struct scsi_populate_token_data *)ctsio->kern_data_ptr;
1885 	lendesc = scsi_2btoul(data->range_descriptor_length);
1886 	if (len < sizeof(struct scsi_populate_token_data) + lendesc) {
1887 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1888 		    /*field*/ 2, /*bit_valid*/ 0, /*bit*/ 0);
1889 		goto done;
1890 	}
1891 /*
1892 	printf("PT(list=%u) flags=%x to=%d rt=%x len=%x\n",
1893 	    scsi_4btoul(cdb->list_identifier),
1894 	    data->flags, scsi_4btoul(data->inactivity_timeout),
1895 	    scsi_4btoul(data->rod_type),
1896 	    scsi_2btoul(data->range_descriptor_length));
1897 */
1898 	if ((data->flags & EC_PT_RTV) &&
1899 	    scsi_4btoul(data->rod_type) != ROD_TYPE_AUR) {
1900 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1901 		    /*field*/ 8, /*bit_valid*/ 0, /*bit*/ 0);
1902 		goto done;
1903 	}
1904 
1905 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1906 	list->service_action = cdb->service_action;
1907 	list->init_port = ctsio->io_hdr.nexus.targ_port;
1908 	list->init_idx = ctl_get_resindex(&ctsio->io_hdr.nexus);
1909 	list->list_id = scsi_4btoul(cdb->list_identifier);
1910 	list->flags = data->flags;
1911 	list->ctsio = ctsio;
1912 	list->lun = lun;
1913 	mtx_lock(&lun->lun_lock);
1914 	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1915 	if (tlist != NULL && !tlist->completed) {
1916 		mtx_unlock(&lun->lun_lock);
1917 		free(list, M_CTL);
1918 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1919 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1920 		    /*bit*/ 0);
1921 		goto done;
1922 	}
1923 	if (tlist != NULL) {
1924 		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1925 		free(tlist, M_CTL);
1926 	}
1927 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1928 	mtx_unlock(&lun->lun_lock);
1929 
1930 	token = malloc(sizeof(*token), M_CTL, M_WAITOK | M_ZERO);
1931 	token->lun = lun->lun;
1932 	token->blocksize = lun->be_lun->blocksize;
1933 	token->params = ctsio->kern_data_ptr;
1934 	token->range = &data->desc[0];
1935 	token->nrange = scsi_2btoul(data->range_descriptor_length) /
1936 	    sizeof(struct scsi_range_desc);
1937 	tpc_create_token(lun, port, list->curbytes,
1938 	    (struct scsi_token *)token->token);
1939 	token->active = 0;
1940 	token->last_active = time_uptime;
1941 	token->timeout = scsi_4btoul(data->inactivity_timeout);
1942 	if (token->timeout == 0)
1943 		token->timeout = TPC_DFL_TOKEN_TIMEOUT;
1944 	else if (token->timeout < TPC_MIN_TOKEN_TIMEOUT)
1945 		token->timeout = TPC_MIN_TOKEN_TIMEOUT;
1946 	else if (token->timeout > TPC_MAX_TOKEN_TIMEOUT) {
1947 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1948 		    /*command*/ 0, /*field*/ 4, /*bit_valid*/ 0,
1949 		    /*bit*/ 0);
1950 	}
1951 	memcpy(list->res_token, token->token, sizeof(list->res_token));
1952 	list->res_token_valid = 1;
1953 	list->cursectors = tpc_ranges_length(token->range, token->nrange);
1954 	list->curbytes = (off_t)list->cursectors * lun->be_lun->blocksize;
1955 	list->curseg = 0;
1956 	list->completed = 1;
1957 	list->last_active = time_uptime;
1958 	mtx_lock(&control_softc->ctl_lock);
1959 	TAILQ_INSERT_TAIL(&control_softc->tpc_tokens, token, links);
1960 	mtx_unlock(&control_softc->ctl_lock);
1961 	ctl_set_success(ctsio);
1962 	ctl_done((union ctl_io *)ctsio);
1963 	return (CTL_RETVAL_COMPLETE);
1964 
1965 done:
1966 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED)
1967 		free(ctsio->kern_data_ptr, M_CTL);
1968 	ctl_done((union ctl_io *)ctsio);
1969 	return (CTL_RETVAL_COMPLETE);
1970 }
1971 
1972 int
1973 ctl_write_using_token(struct ctl_scsiio *ctsio)
1974 {
1975 	struct scsi_write_using_token *cdb;
1976 	struct scsi_write_using_token_data *data;
1977 	struct ctl_lun *lun;
1978 	struct tpc_list *list, *tlist;
1979 	struct tpc_token *token;
1980 	int len, lendesc;
1981 
1982 	CTL_DEBUG_PRINT(("ctl_write_using_token\n"));
1983 
1984 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1985 	cdb = (struct scsi_write_using_token *)ctsio->cdb;
1986 	len = scsi_4btoul(cdb->length);
1987 
1988 	if (len < sizeof(struct scsi_populate_token_data) ||
1989 	    len > sizeof(struct scsi_populate_token_data) +
1990 	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
1991 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1992 		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1993 		goto done;
1994 	}
1995 
1996 	/*
1997 	 * If we've got a kernel request that hasn't been malloced yet,
1998 	 * malloc it and tell the caller the data buffer is here.
1999 	 */
2000 	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2001 		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2002 		ctsio->kern_data_len = len;
2003 		ctsio->kern_total_len = len;
2004 		ctsio->kern_data_resid = 0;
2005 		ctsio->kern_rel_offset = 0;
2006 		ctsio->kern_sg_entries = 0;
2007 		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2008 		ctsio->be_move_done = ctl_config_move_done;
2009 		ctl_datamove((union ctl_io *)ctsio);
2010 
2011 		return (CTL_RETVAL_COMPLETE);
2012 	}
2013 
2014 	data = (struct scsi_write_using_token_data *)ctsio->kern_data_ptr;
2015 	lendesc = scsi_2btoul(data->range_descriptor_length);
2016 	if (len < sizeof(struct scsi_populate_token_data) + lendesc) {
2017 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2018 		    /*field*/ 2, /*bit_valid*/ 0, /*bit*/ 0);
2019 		goto done;
2020 	}
2021 /*
2022 	printf("WUT(list=%u) flags=%x off=%ju len=%x\n",
2023 	    scsi_4btoul(cdb->list_identifier),
2024 	    data->flags, scsi_8btou64(data->offset_into_rod),
2025 	    scsi_2btoul(data->range_descriptor_length));
2026 */
2027 	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2028 	list->service_action = cdb->service_action;
2029 	list->init_port = ctsio->io_hdr.nexus.targ_port;
2030 	list->init_idx = ctl_get_resindex(&ctsio->io_hdr.nexus);
2031 	list->list_id = scsi_4btoul(cdb->list_identifier);
2032 	list->flags = data->flags;
2033 	list->params = ctsio->kern_data_ptr;
2034 	list->range = &data->desc[0];
2035 	list->nrange = scsi_2btoul(data->range_descriptor_length) /
2036 	    sizeof(struct scsi_range_desc);
2037 	list->offset_into_rod = scsi_8btou64(data->offset_into_rod);
2038 	list->ctsio = ctsio;
2039 	list->lun = lun;
2040 	mtx_lock(&lun->lun_lock);
2041 	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2042 	if (tlist != NULL && !tlist->completed) {
2043 		mtx_unlock(&lun->lun_lock);
2044 		free(list, M_CTL);
2045 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2046 		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2047 		    /*bit*/ 0);
2048 		goto done;
2049 	}
2050 	if (tlist != NULL) {
2051 		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2052 		free(tlist, M_CTL);
2053 	}
2054 	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2055 	mtx_unlock(&lun->lun_lock);
2056 
2057 	/* Block device zero ROD token -> no token. */
2058 	if (scsi_4btoul(data->rod_token) == ROD_TYPE_BLOCK_ZERO) {
2059 		tpc_process(list);
2060 		return (CTL_RETVAL_COMPLETE);
2061 	}
2062 
2063 	mtx_lock(&control_softc->ctl_lock);
2064 	TAILQ_FOREACH(token, &control_softc->tpc_tokens, links) {
2065 		if (memcmp(token->token, data->rod_token,
2066 		    sizeof(data->rod_token)) == 0)
2067 			break;
2068 	}
2069 	if (token != NULL) {
2070 		token->active++;
2071 		list->token = token;
2072 		if (data->flags & EC_WUT_DEL_TKN)
2073 			token->timeout = 0;
2074 	}
2075 	mtx_unlock(&control_softc->ctl_lock);
2076 	if (token == NULL) {
2077 		mtx_lock(&lun->lun_lock);
2078 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2079 		mtx_unlock(&lun->lun_lock);
2080 		free(list, M_CTL);
2081 		ctl_set_sense(ctsio, /*current_error*/ 1,
2082 		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2083 		    /*asc*/ 0x23, /*ascq*/ 0x04, SSD_ELEM_NONE);
2084 		goto done;
2085 	}
2086 
2087 	tpc_process(list);
2088 	return (CTL_RETVAL_COMPLETE);
2089 
2090 done:
2091 	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED)
2092 		free(ctsio->kern_data_ptr, M_CTL);
2093 	ctl_done((union ctl_io *)ctsio);
2094 	return (CTL_RETVAL_COMPLETE);
2095 }
2096 
2097 int
2098 ctl_receive_rod_token_information(struct ctl_scsiio *ctsio)
2099 {
2100 	struct ctl_lun *lun;
2101 	struct scsi_receive_rod_token_information *cdb;
2102 	struct scsi_receive_copy_status_lid4_data *data;
2103 	struct tpc_list *list;
2104 	struct tpc_list list_copy;
2105 	uint8_t *ptr;
2106 	int retval;
2107 	int alloc_len, total_len, token_len;
2108 	uint32_t list_id;
2109 
2110 	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2111 
2112 	cdb = (struct scsi_receive_rod_token_information *)ctsio->cdb;
2113 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2114 
2115 	retval = CTL_RETVAL_COMPLETE;
2116 
2117 	list_id = scsi_4btoul(cdb->list_identifier);
2118 	mtx_lock(&lun->lun_lock);
2119 	list = tpc_find_list(lun, list_id,
2120 	    ctl_get_resindex(&ctsio->io_hdr.nexus));
2121 	if (list == NULL) {
2122 		mtx_unlock(&lun->lun_lock);
2123 		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2124 		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
2125 		    /*bit*/ 0);
2126 		ctl_done((union ctl_io *)ctsio);
2127 		return (retval);
2128 	}
2129 	list_copy = *list;
2130 	if (list->completed) {
2131 		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2132 		free(list, M_CTL);
2133 	}
2134 	mtx_unlock(&lun->lun_lock);
2135 
2136 	token_len = list_copy.res_token_valid ? 2 + sizeof(list_copy.res_token) : 0;
2137 	total_len = sizeof(*data) + list_copy.sense_len + 4 + token_len;
2138 	alloc_len = scsi_4btoul(cdb->length);
2139 
2140 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2141 
2142 	ctsio->kern_sg_entries = 0;
2143 
2144 	if (total_len < alloc_len) {
2145 		ctsio->residual = alloc_len - total_len;
2146 		ctsio->kern_data_len = total_len;
2147 		ctsio->kern_total_len = total_len;
2148 	} else {
2149 		ctsio->residual = 0;
2150 		ctsio->kern_data_len = alloc_len;
2151 		ctsio->kern_total_len = alloc_len;
2152 	}
2153 	ctsio->kern_data_resid = 0;
2154 	ctsio->kern_rel_offset = 0;
2155 
2156 	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
2157 	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len +
2158 	    4 + token_len, data->available_data);
2159 	data->response_to_service_action = list_copy.service_action;
2160 	if (list_copy.completed) {
2161 		if (list_copy.error)
2162 			data->copy_command_status = RCS_CCS_ERROR;
2163 		else if (list_copy.abort)
2164 			data->copy_command_status = RCS_CCS_ABORTED;
2165 		else
2166 			data->copy_command_status = RCS_CCS_COMPLETED;
2167 	} else
2168 		data->copy_command_status = RCS_CCS_INPROG_FG;
2169 	scsi_ulto2b(list_copy.curops, data->operation_counter);
2170 	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
2171 	data->transfer_count_units = RCS_TC_LBAS;
2172 	scsi_u64to8b(list_copy.cursectors, data->transfer_count);
2173 	scsi_ulto2b(list_copy.curseg, data->segments_processed);
2174 	data->length_of_the_sense_data_field = list_copy.sense_len;
2175 	data->sense_data_length = list_copy.sense_len;
2176 	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
2177 
2178 	ptr = &data->sense_data[data->length_of_the_sense_data_field];
2179 	scsi_ulto4b(token_len, &ptr[0]);
2180 	if (list_copy.res_token_valid) {
2181 		scsi_ulto2b(0, &ptr[4]);
2182 		memcpy(&ptr[6], list_copy.res_token, sizeof(list_copy.res_token));
2183 	}
2184 /*
2185 	printf("RRTI(list=%u) valid=%d\n",
2186 	    scsi_4btoul(cdb->list_identifier), list_copy.res_token_valid);
2187 */
2188 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2189 	ctsio->be_move_done = ctl_config_move_done;
2190 
2191 	ctl_datamove((union ctl_io *)ctsio);
2192 	return (retval);
2193 }
2194 
2195 int
2196 ctl_report_all_rod_tokens(struct ctl_scsiio *ctsio)
2197 {
2198 	struct ctl_lun *lun;
2199 	struct scsi_report_all_rod_tokens *cdb;
2200 	struct scsi_report_all_rod_tokens_data *data;
2201 	struct tpc_token *token;
2202 	int retval;
2203 	int alloc_len, total_len, tokens, i;
2204 
2205 	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2206 
2207 	cdb = (struct scsi_report_all_rod_tokens *)ctsio->cdb;
2208 	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2209 
2210 	retval = CTL_RETVAL_COMPLETE;
2211 
2212 	tokens = 0;
2213 	mtx_lock(&control_softc->ctl_lock);
2214 	TAILQ_FOREACH(token, &control_softc->tpc_tokens, links)
2215 		tokens++;
2216 	mtx_unlock(&control_softc->ctl_lock);
2217 	if (tokens > 512)
2218 		tokens = 512;
2219 
2220 	total_len = sizeof(*data) + tokens * 96;
2221 	alloc_len = scsi_4btoul(cdb->length);
2222 
2223 	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2224 
2225 	ctsio->kern_sg_entries = 0;
2226 
2227 	if (total_len < alloc_len) {
2228 		ctsio->residual = alloc_len - total_len;
2229 		ctsio->kern_data_len = total_len;
2230 		ctsio->kern_total_len = total_len;
2231 	} else {
2232 		ctsio->residual = 0;
2233 		ctsio->kern_data_len = alloc_len;
2234 		ctsio->kern_total_len = alloc_len;
2235 	}
2236 	ctsio->kern_data_resid = 0;
2237 	ctsio->kern_rel_offset = 0;
2238 
2239 	data = (struct scsi_report_all_rod_tokens_data *)ctsio->kern_data_ptr;
2240 	i = 0;
2241 	mtx_lock(&control_softc->ctl_lock);
2242 	TAILQ_FOREACH(token, &control_softc->tpc_tokens, links) {
2243 		if (i >= tokens)
2244 			break;
2245 		memcpy(&data->rod_management_token_list[i * 96],
2246 		    token->token, 96);
2247 		i++;
2248 	}
2249 	mtx_unlock(&control_softc->ctl_lock);
2250 	scsi_ulto4b(sizeof(*data) - 4 + i * 96, data->available_data);
2251 /*
2252 	printf("RART tokens=%d\n", i);
2253 */
2254 	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2255 	ctsio->be_move_done = ctl_config_move_done;
2256 
2257 	ctl_datamove((union ctl_io *)ctsio);
2258 	return (retval);
2259 }
2260 
2261