xref: /freebsd/sys/cam/scsi/scsi_ch.c (revision bec9534d1d180ff06c240db7bbd809764a6a8f6f)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD AND BSD-4-Clause
3  *
4  * Copyright (c) 1997 Justin T. Gibbs.
5  * Copyright (c) 1997, 1998, 1999 Kenneth D. Merry.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions, and the following disclaimer,
13  *    without modification, immediately at the beginning of the file.
14  * 2. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 /*
31  * Derived from the NetBSD SCSI changer driver.
32  *
33  *	$NetBSD: ch.c,v 1.32 1998/01/12 09:49:12 thorpej Exp $
34  *
35  */
36 /*-
37  * Copyright (c) 1996, 1997 Jason R. Thorpe <thorpej@and.com>
38  * All rights reserved.
39  *
40  * Partially based on an autochanger driver written by Stefan Grefen
41  * and on an autochanger driver written by the Systems Programming Group
42  * at the University of Utah Computer Science Department.
43  *
44  * Redistribution and use in source and binary forms, with or without
45  * modification, are permitted provided that the following conditions
46  * are met:
47  * 1. Redistributions of source code must retain the above copyright
48  *    notice, this list of conditions and the following disclaimer.
49  * 2. Redistributions in binary form must reproduce the above copyright
50  *    notice, this list of conditions and the following disclaimer in the
51  *    documentation and/or other materials provided with the distribution.
52  * 3. All advertising materials mentioning features or use of this software
53  *    must display the following acknowledgements:
54  *	This product includes software developed by Jason R. Thorpe
55  *	for And Communications, http://www.and.com/
56  * 4. The name of the author may not be used to endorse or promote products
57  *    derived from this software without specific prior written permission.
58  *
59  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
60  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
61  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
62  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
63  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
64  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
65  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
66  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
67  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
68  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
69  * SUCH DAMAGE.
70  */
71 
72 #include <sys/cdefs.h>
73 __FBSDID("$FreeBSD$");
74 
75 #include <sys/param.h>
76 #include <sys/queue.h>
77 #include <sys/systm.h>
78 #include <sys/kernel.h>
79 #include <sys/types.h>
80 #include <sys/malloc.h>
81 #include <sys/fcntl.h>
82 #include <sys/conf.h>
83 #include <sys/chio.h>
84 #include <sys/errno.h>
85 #include <sys/devicestat.h>
86 
87 #include <cam/cam.h>
88 #include <cam/cam_ccb.h>
89 #include <cam/cam_periph.h>
90 #include <cam/cam_xpt_periph.h>
91 #include <cam/cam_debug.h>
92 
93 #include <cam/scsi/scsi_all.h>
94 #include <cam/scsi/scsi_message.h>
95 #include <cam/scsi/scsi_ch.h>
96 
97 /*
98  * Timeout definitions for various changer related commands.  They may
99  * be too short for some devices (especially the timeout for INITIALIZE
100  * ELEMENT STATUS).
101  */
102 
103 static const u_int32_t	CH_TIMEOUT_MODE_SENSE                = 6000;
104 static const u_int32_t	CH_TIMEOUT_MOVE_MEDIUM               = 15 * 60 * 1000;
105 static const u_int32_t	CH_TIMEOUT_EXCHANGE_MEDIUM           = 15 * 60 * 1000;
106 static const u_int32_t	CH_TIMEOUT_POSITION_TO_ELEMENT       = 15 * 60 * 1000;
107 static const u_int32_t	CH_TIMEOUT_READ_ELEMENT_STATUS       = 5 * 60 * 1000;
108 static const u_int32_t	CH_TIMEOUT_SEND_VOLTAG		     = 10000;
109 static const u_int32_t	CH_TIMEOUT_INITIALIZE_ELEMENT_STATUS = 500000;
110 
111 typedef enum {
112 	CH_FLAG_INVALID		= 0x001
113 } ch_flags;
114 
115 typedef enum {
116 	CH_STATE_PROBE,
117 	CH_STATE_NORMAL
118 } ch_state;
119 
120 typedef enum {
121 	CH_CCB_PROBE
122 } ch_ccb_types;
123 
124 typedef enum {
125 	CH_Q_NONE	= 0x00,
126 	CH_Q_NO_DBD	= 0x01,
127 	CH_Q_NO_DVCID	= 0x02
128 } ch_quirks;
129 
130 #define CH_Q_BIT_STRING	\
131 	"\020"		\
132 	"\001NO_DBD"	\
133 	"\002NO_DVCID"
134 
135 #define ccb_state	ppriv_field0
136 #define ccb_bp		ppriv_ptr1
137 
138 struct scsi_mode_sense_data {
139 	struct scsi_mode_header_6 header;
140 	struct scsi_mode_blk_desc blk_desc;
141 	union {
142 		struct page_element_address_assignment ea;
143 		struct page_transport_geometry_parameters tg;
144 		struct page_device_capabilities cap;
145 	} pages;
146 };
147 
148 struct ch_softc {
149 	ch_flags	flags;
150 	ch_state	state;
151 	ch_quirks	quirks;
152 	union ccb	saved_ccb;
153 	struct devstat	*device_stats;
154 	struct cdev     *dev;
155 	int		open_count;
156 
157 	int		sc_picker;	/* current picker */
158 
159 	/*
160 	 * The following information is obtained from the
161 	 * element address assignment page.
162 	 */
163 	int		sc_firsts[CHET_MAX + 1];	/* firsts */
164 	int		sc_counts[CHET_MAX + 1];	/* counts */
165 
166 	/*
167 	 * The following mask defines the legal combinations
168 	 * of elements for the MOVE MEDIUM command.
169 	 */
170 	u_int8_t	sc_movemask[CHET_MAX + 1];
171 
172 	/*
173 	 * As above, but for EXCHANGE MEDIUM.
174 	 */
175 	u_int8_t	sc_exchangemask[CHET_MAX + 1];
176 
177 	/*
178 	 * Quirks; see below.  XXX KDM not implemented yet
179 	 */
180 	int		sc_settledelay;	/* delay for settle */
181 };
182 
183 static	d_open_t	chopen;
184 static	d_close_t	chclose;
185 static	d_ioctl_t	chioctl;
186 static	periph_init_t	chinit;
187 static  periph_ctor_t	chregister;
188 static	periph_oninv_t	choninvalidate;
189 static  periph_dtor_t   chcleanup;
190 static  periph_start_t  chstart;
191 static	void		chasync(void *callback_arg, u_int32_t code,
192 				struct cam_path *path, void *arg);
193 static	void		chdone(struct cam_periph *periph,
194 			       union ccb *done_ccb);
195 static	int		cherror(union ccb *ccb, u_int32_t cam_flags,
196 				u_int32_t sense_flags);
197 static	int		chmove(struct cam_periph *periph,
198 			       struct changer_move *cm);
199 static	int		chexchange(struct cam_periph *periph,
200 				   struct changer_exchange *ce);
201 static	int		chposition(struct cam_periph *periph,
202 				   struct changer_position *cp);
203 static	int		chgetelemstatus(struct cam_periph *periph,
204 				int scsi_version, u_long cmd,
205 				struct changer_element_status_request *csr);
206 static	int		chsetvoltag(struct cam_periph *periph,
207 				    struct changer_set_voltag_request *csvr);
208 static	int		chielem(struct cam_periph *periph,
209 				unsigned int timeout);
210 static	int		chgetparams(struct cam_periph *periph);
211 static	int		chscsiversion(struct cam_periph *periph);
212 
213 static struct periph_driver chdriver =
214 {
215 	chinit, "ch",
216 	TAILQ_HEAD_INITIALIZER(chdriver.units), /* generation */ 0
217 };
218 
219 PERIPHDRIVER_DECLARE(ch, chdriver);
220 
221 static struct cdevsw ch_cdevsw = {
222 	.d_version =	D_VERSION,
223 	.d_flags =	D_TRACKCLOSE,
224 	.d_open =	chopen,
225 	.d_close =	chclose,
226 	.d_ioctl =	chioctl,
227 	.d_name =	"ch",
228 };
229 
230 static MALLOC_DEFINE(M_SCSICH, "scsi_ch", "scsi_ch buffers");
231 
232 static void
233 chinit(void)
234 {
235 	cam_status status;
236 
237 	/*
238 	 * Install a global async callback.  This callback will
239 	 * receive async callbacks like "new device found".
240 	 */
241 	status = xpt_register_async(AC_FOUND_DEVICE, chasync, NULL, NULL);
242 
243 	if (status != CAM_REQ_CMP) {
244 		printf("ch: Failed to attach master async callback "
245 		       "due to status 0x%x!\n", status);
246 	}
247 }
248 
249 static void
250 chdevgonecb(void *arg)
251 {
252 	struct ch_softc   *softc;
253 	struct cam_periph *periph;
254 	struct mtx *mtx;
255 	int i;
256 
257 	periph = (struct cam_periph *)arg;
258 	mtx = cam_periph_mtx(periph);
259 	mtx_lock(mtx);
260 
261 	softc = (struct ch_softc *)periph->softc;
262 	KASSERT(softc->open_count >= 0, ("Negative open count %d",
263 		softc->open_count));
264 
265 	/*
266 	 * When we get this callback, we will get no more close calls from
267 	 * devfs.  So if we have any dangling opens, we need to release the
268 	 * reference held for that particular context.
269 	 */
270 	for (i = 0; i < softc->open_count; i++)
271 		cam_periph_release_locked(periph);
272 
273 	softc->open_count = 0;
274 
275 	/*
276 	 * Release the reference held for the device node, it is gone now.
277 	 */
278 	cam_periph_release_locked(periph);
279 
280 	/*
281 	 * We reference the lock directly here, instead of using
282 	 * cam_periph_unlock().  The reason is that the final call to
283 	 * cam_periph_release_locked() above could result in the periph
284 	 * getting freed.  If that is the case, dereferencing the periph
285 	 * with a cam_periph_unlock() call would cause a page fault.
286 	 */
287 	mtx_unlock(mtx);
288 }
289 
290 static void
291 choninvalidate(struct cam_periph *periph)
292 {
293 	struct ch_softc *softc;
294 
295 	softc = (struct ch_softc *)periph->softc;
296 
297 	/*
298 	 * De-register any async callbacks.
299 	 */
300 	xpt_register_async(0, chasync, periph, periph->path);
301 
302 	softc->flags |= CH_FLAG_INVALID;
303 
304 	/*
305 	 * Tell devfs this device has gone away, and ask for a callback
306 	 * when it has cleaned up its state.
307 	 */
308 	destroy_dev_sched_cb(softc->dev, chdevgonecb, periph);
309 }
310 
311 static void
312 chcleanup(struct cam_periph *periph)
313 {
314 	struct ch_softc *softc;
315 
316 	softc = (struct ch_softc *)periph->softc;
317 
318 	devstat_remove_entry(softc->device_stats);
319 
320 	free(softc, M_DEVBUF);
321 }
322 
323 static void
324 chasync(void *callback_arg, u_int32_t code, struct cam_path *path, void *arg)
325 {
326 	struct cam_periph *periph;
327 
328 	periph = (struct cam_periph *)callback_arg;
329 
330 	switch(code) {
331 	case AC_FOUND_DEVICE:
332 	{
333 		struct ccb_getdev *cgd;
334 		cam_status status;
335 
336 		cgd = (struct ccb_getdev *)arg;
337 		if (cgd == NULL)
338 			break;
339 
340 		if (cgd->protocol != PROTO_SCSI)
341 			break;
342 		if (SID_QUAL(&cgd->inq_data) != SID_QUAL_LU_CONNECTED)
343 			break;
344 		if (SID_TYPE(&cgd->inq_data)!= T_CHANGER)
345 			break;
346 
347 		/*
348 		 * Allocate a peripheral instance for
349 		 * this device and start the probe
350 		 * process.
351 		 */
352 		status = cam_periph_alloc(chregister, choninvalidate,
353 					  chcleanup, chstart, "ch",
354 					  CAM_PERIPH_BIO, path,
355 					  chasync, AC_FOUND_DEVICE, cgd);
356 
357 		if (status != CAM_REQ_CMP
358 		 && status != CAM_REQ_INPROG)
359 			printf("chasync: Unable to probe new device "
360 			       "due to status 0x%x\n", status);
361 
362 		break;
363 
364 	}
365 	default:
366 		cam_periph_async(periph, code, path, arg);
367 		break;
368 	}
369 }
370 
371 static cam_status
372 chregister(struct cam_periph *periph, void *arg)
373 {
374 	struct ch_softc *softc;
375 	struct ccb_getdev *cgd;
376 	struct ccb_pathinq cpi;
377 	struct make_dev_args args;
378 	int error;
379 
380 	cgd = (struct ccb_getdev *)arg;
381 	if (cgd == NULL) {
382 		printf("chregister: no getdev CCB, can't register device\n");
383 		return(CAM_REQ_CMP_ERR);
384 	}
385 
386 	softc = (struct ch_softc *)malloc(sizeof(*softc),M_DEVBUF,M_NOWAIT);
387 
388 	if (softc == NULL) {
389 		printf("chregister: Unable to probe new device. "
390 		       "Unable to allocate softc\n");
391 		return(CAM_REQ_CMP_ERR);
392 	}
393 
394 	bzero(softc, sizeof(*softc));
395 	softc->state = CH_STATE_PROBE;
396 	periph->softc = softc;
397 	softc->quirks = CH_Q_NONE;
398 
399 	/*
400 	 * The DVCID and CURDATA bits were not introduced until the SMC
401 	 * spec.  If this device claims SCSI-2 or earlier support, then it
402 	 * very likely does not support these bits.
403 	 */
404 	if (cgd->inq_data.version <= SCSI_REV_2)
405 		softc->quirks |= CH_Q_NO_DVCID;
406 
407 	bzero(&cpi, sizeof(cpi));
408 	xpt_setup_ccb(&cpi.ccb_h, periph->path, CAM_PRIORITY_NORMAL);
409 	cpi.ccb_h.func_code = XPT_PATH_INQ;
410 	xpt_action((union ccb *)&cpi);
411 
412 	/*
413 	 * Changers don't have a blocksize, and obviously don't support
414 	 * tagged queueing.
415 	 */
416 	cam_periph_unlock(periph);
417 	softc->device_stats = devstat_new_entry("ch",
418 			  periph->unit_number, 0,
419 			  DEVSTAT_NO_BLOCKSIZE | DEVSTAT_NO_ORDERED_TAGS,
420 			  SID_TYPE(&cgd->inq_data) |
421 			  XPORT_DEVSTAT_TYPE(cpi.transport),
422 			  DEVSTAT_PRIORITY_OTHER);
423 
424 	/*
425 	 * Acquire a reference to the periph before we create the devfs
426 	 * instance for it.  We'll release this reference once the devfs
427 	 * instance has been freed.
428 	 */
429 	if (cam_periph_acquire(periph) != CAM_REQ_CMP) {
430 		xpt_print(periph->path, "%s: lost periph during "
431 			  "registration!\n", __func__);
432 		cam_periph_lock(periph);
433 		return (CAM_REQ_CMP_ERR);
434 	}
435 
436 
437 	/* Register the device */
438 	make_dev_args_init(&args);
439 	args.mda_devsw = &ch_cdevsw;
440 	args.mda_unit = periph->unit_number;
441 	args.mda_uid = UID_ROOT;
442 	args.mda_gid = GID_OPERATOR;
443 	args.mda_mode = 0600;
444 	args.mda_si_drv1 = periph;
445 	error = make_dev_s(&args, &softc->dev, "%s%d", periph->periph_name,
446 	    periph->unit_number);
447 	cam_periph_lock(periph);
448 	if (error != 0) {
449 		cam_periph_release_locked(periph);
450 		return (CAM_REQ_CMP_ERR);
451 	}
452 
453 	/*
454 	 * Add an async callback so that we get
455 	 * notified if this device goes away.
456 	 */
457 	xpt_register_async(AC_LOST_DEVICE, chasync, periph, periph->path);
458 
459 	/*
460 	 * Lock this periph until we are setup.
461 	 * This first call can't block
462 	 */
463 	(void)cam_periph_hold(periph, PRIBIO);
464 	xpt_schedule(periph, CAM_PRIORITY_DEV);
465 
466 	return(CAM_REQ_CMP);
467 }
468 
469 static int
470 chopen(struct cdev *dev, int flags, int fmt, struct thread *td)
471 {
472 	struct cam_periph *periph;
473 	struct ch_softc *softc;
474 	int error;
475 
476 	periph = (struct cam_periph *)dev->si_drv1;
477 	if (cam_periph_acquire(periph) != CAM_REQ_CMP)
478 		return (ENXIO);
479 
480 	softc = (struct ch_softc *)periph->softc;
481 
482 	cam_periph_lock(periph);
483 
484 	if (softc->flags & CH_FLAG_INVALID) {
485 		cam_periph_release_locked(periph);
486 		cam_periph_unlock(periph);
487 		return(ENXIO);
488 	}
489 
490 	if ((error = cam_periph_hold(periph, PRIBIO | PCATCH)) != 0) {
491 		cam_periph_unlock(periph);
492 		cam_periph_release(periph);
493 		return (error);
494 	}
495 
496 	/*
497 	 * Load information about this changer device into the softc.
498 	 */
499 	if ((error = chgetparams(periph)) != 0) {
500 		cam_periph_unhold(periph);
501 		cam_periph_release_locked(periph);
502 		cam_periph_unlock(periph);
503 		return(error);
504 	}
505 
506 	cam_periph_unhold(periph);
507 
508 	softc->open_count++;
509 
510 	cam_periph_unlock(periph);
511 
512 	return(error);
513 }
514 
515 static int
516 chclose(struct cdev *dev, int flag, int fmt, struct thread *td)
517 {
518 	struct	cam_periph *periph;
519 	struct  ch_softc *softc;
520 	struct mtx *mtx;
521 
522 	periph = (struct cam_periph *)dev->si_drv1;
523 	mtx = cam_periph_mtx(periph);
524 	mtx_lock(mtx);
525 
526 	softc = (struct ch_softc *)periph->softc;
527 	softc->open_count--;
528 
529 	cam_periph_release_locked(periph);
530 
531 	/*
532 	 * We reference the lock directly here, instead of using
533 	 * cam_periph_unlock().  The reason is that the call to
534 	 * cam_periph_release_locked() above could result in the periph
535 	 * getting freed.  If that is the case, dereferencing the periph
536 	 * with a cam_periph_unlock() call would cause a page fault.
537 	 *
538 	 * cam_periph_release() avoids this problem using the same method,
539 	 * but we're manually acquiring and dropping the lock here to
540 	 * protect the open count and avoid another lock acquisition and
541 	 * release.
542 	 */
543 	mtx_unlock(mtx);
544 
545 	return(0);
546 }
547 
548 static void
549 chstart(struct cam_periph *periph, union ccb *start_ccb)
550 {
551 	struct ch_softc *softc;
552 
553 	softc = (struct ch_softc *)periph->softc;
554 
555 	switch (softc->state) {
556 	case CH_STATE_NORMAL:
557 	{
558 		xpt_release_ccb(start_ccb);
559 		break;
560 	}
561 	case CH_STATE_PROBE:
562 	{
563 		int mode_buffer_len;
564 		void *mode_buffer;
565 
566 		/*
567 		 * Include the block descriptor when calculating the mode
568 		 * buffer length,
569 		 */
570 		mode_buffer_len = sizeof(struct scsi_mode_header_6) +
571 				  sizeof(struct scsi_mode_blk_desc) +
572 				 sizeof(struct page_element_address_assignment);
573 
574 		mode_buffer = malloc(mode_buffer_len, M_SCSICH, M_NOWAIT);
575 
576 		if (mode_buffer == NULL) {
577 			printf("chstart: couldn't malloc mode sense data\n");
578 			break;
579 		}
580 		bzero(mode_buffer, mode_buffer_len);
581 
582 		/*
583 		 * Get the element address assignment page.
584 		 */
585 		scsi_mode_sense(&start_ccb->csio,
586 				/* retries */ 1,
587 				/* cbfcnp */ chdone,
588 				/* tag_action */ MSG_SIMPLE_Q_TAG,
589 				/* dbd */ (softc->quirks & CH_Q_NO_DBD) ?
590 					FALSE : TRUE,
591 				/* pc */ SMS_PAGE_CTRL_CURRENT,
592 				/* page */ CH_ELEMENT_ADDR_ASSIGN_PAGE,
593 				/* param_buf */ (u_int8_t *)mode_buffer,
594 				/* param_len */ mode_buffer_len,
595 				/* sense_len */ SSD_FULL_SIZE,
596 				/* timeout */ CH_TIMEOUT_MODE_SENSE);
597 
598 		start_ccb->ccb_h.ccb_bp = NULL;
599 		start_ccb->ccb_h.ccb_state = CH_CCB_PROBE;
600 		xpt_action(start_ccb);
601 		break;
602 	}
603 	}
604 }
605 
606 static void
607 chdone(struct cam_periph *periph, union ccb *done_ccb)
608 {
609 	struct ch_softc *softc;
610 	struct ccb_scsiio *csio;
611 
612 	softc = (struct ch_softc *)periph->softc;
613 	csio = &done_ccb->csio;
614 
615 	switch(done_ccb->ccb_h.ccb_state) {
616 	case CH_CCB_PROBE:
617 	{
618 		struct scsi_mode_header_6 *mode_header;
619 		struct page_element_address_assignment *ea;
620 		char announce_buf[80];
621 
622 
623 		mode_header = (struct scsi_mode_header_6 *)csio->data_ptr;
624 
625 		ea = (struct page_element_address_assignment *)
626 			find_mode_page_6(mode_header);
627 
628 		if ((done_ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP){
629 
630 			softc->sc_firsts[CHET_MT] = scsi_2btoul(ea->mtea);
631 			softc->sc_counts[CHET_MT] = scsi_2btoul(ea->nmte);
632 			softc->sc_firsts[CHET_ST] = scsi_2btoul(ea->fsea);
633 			softc->sc_counts[CHET_ST] = scsi_2btoul(ea->nse);
634 			softc->sc_firsts[CHET_IE] = scsi_2btoul(ea->fieea);
635 			softc->sc_counts[CHET_IE] = scsi_2btoul(ea->niee);
636 			softc->sc_firsts[CHET_DT] = scsi_2btoul(ea->fdtea);
637 			softc->sc_counts[CHET_DT] = scsi_2btoul(ea->ndte);
638 			softc->sc_picker = softc->sc_firsts[CHET_MT];
639 
640 #define PLURAL(c)	(c) == 1 ? "" : "s"
641 			snprintf(announce_buf, sizeof(announce_buf),
642 				"%d slot%s, %d drive%s, "
643 				"%d picker%s, %d portal%s",
644 		    		softc->sc_counts[CHET_ST],
645 				PLURAL(softc->sc_counts[CHET_ST]),
646 		    		softc->sc_counts[CHET_DT],
647 				PLURAL(softc->sc_counts[CHET_DT]),
648 		    		softc->sc_counts[CHET_MT],
649 				PLURAL(softc->sc_counts[CHET_MT]),
650 		    		softc->sc_counts[CHET_IE],
651 				PLURAL(softc->sc_counts[CHET_IE]));
652 #undef PLURAL
653 			if (announce_buf[0] != '\0') {
654 				xpt_announce_periph(periph, announce_buf);
655 				xpt_announce_quirks(periph, softc->quirks,
656 				    CH_Q_BIT_STRING);
657 			}
658 		} else {
659 			int error;
660 
661 			error = cherror(done_ccb, CAM_RETRY_SELTO,
662 					SF_RETRY_UA | SF_NO_PRINT);
663 			/*
664 			 * Retry any UNIT ATTENTION type errors.  They
665 			 * are expected at boot.
666 			 */
667 			if (error == ERESTART) {
668 				/*
669 				 * A retry was scheduled, so
670 				 * just return.
671 				 */
672 				return;
673 			} else if (error != 0) {
674 				struct scsi_mode_sense_6 *sms;
675 				int frozen, retry_scheduled;
676 
677 				sms = (struct scsi_mode_sense_6 *)
678 					done_ccb->csio.cdb_io.cdb_bytes;
679 				frozen = (done_ccb->ccb_h.status &
680 				    CAM_DEV_QFRZN) != 0;
681 
682 				/*
683 				 * Check to see if block descriptors were
684 				 * disabled.  Some devices don't like that.
685 				 * We're taking advantage of the fact that
686 				 * the first few bytes of the 6 and 10 byte
687 				 * mode sense commands are the same.  If
688 				 * block descriptors were disabled, enable
689 				 * them and re-send the command.
690 				 */
691 				if ((sms->byte2 & SMS_DBD) != 0 &&
692 				    (periph->flags & CAM_PERIPH_INVALID) == 0) {
693 					sms->byte2 &= ~SMS_DBD;
694 					xpt_action(done_ccb);
695 					softc->quirks |= CH_Q_NO_DBD;
696 					retry_scheduled = 1;
697 				} else
698 					retry_scheduled = 0;
699 
700 				/* Don't wedge this device's queue */
701 				if (frozen)
702 					cam_release_devq(done_ccb->ccb_h.path,
703 						 /*relsim_flags*/0,
704 						 /*reduction*/0,
705 						 /*timeout*/0,
706 						 /*getcount_only*/0);
707 
708 				if (retry_scheduled)
709 					return;
710 
711 				if ((done_ccb->ccb_h.status & CAM_STATUS_MASK)
712 				    == CAM_SCSI_STATUS_ERROR)
713 					scsi_sense_print(&done_ccb->csio);
714 				else {
715 					xpt_print(periph->path,
716 					    "got CAM status %#x\n",
717 					    done_ccb->ccb_h.status);
718 				}
719 				xpt_print(periph->path, "fatal error, failed "
720 				    "to attach to device\n");
721 
722 				cam_periph_invalidate(periph);
723 
724 			}
725 		}
726 		softc->state = CH_STATE_NORMAL;
727 		free(mode_header, M_SCSICH);
728 		/*
729 		 * Since our peripheral may be invalidated by an error
730 		 * above or an external event, we must release our CCB
731 		 * before releasing the probe lock on the peripheral.
732 		 * The peripheral will only go away once the last lock
733 		 * is removed, and we need it around for the CCB release
734 		 * operation.
735 		 */
736 		xpt_release_ccb(done_ccb);
737 		cam_periph_unhold(periph);
738 		return;
739 	}
740 	default:
741 		break;
742 	}
743 	xpt_release_ccb(done_ccb);
744 }
745 
746 static int
747 cherror(union ccb *ccb, u_int32_t cam_flags, u_int32_t sense_flags)
748 {
749 	struct ch_softc *softc;
750 	struct cam_periph *periph;
751 
752 	periph = xpt_path_periph(ccb->ccb_h.path);
753 	softc = (struct ch_softc *)periph->softc;
754 
755 	return (cam_periph_error(ccb, cam_flags, sense_flags,
756 				 &softc->saved_ccb));
757 }
758 
759 static int
760 chioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag, struct thread *td)
761 {
762 	struct cam_periph *periph;
763 	struct ch_softc *softc;
764 	int error;
765 
766 	periph = (struct cam_periph *)dev->si_drv1;
767 	cam_periph_lock(periph);
768 	CAM_DEBUG(periph->path, CAM_DEBUG_TRACE, ("entering chioctl\n"));
769 
770 	softc = (struct ch_softc *)periph->softc;
771 
772 	error = 0;
773 
774 	CAM_DEBUG(periph->path, CAM_DEBUG_TRACE,
775 		  ("trying to do ioctl %#lx\n", cmd));
776 
777 	/*
778 	 * If this command can change the device's state, we must
779 	 * have the device open for writing.
780 	 */
781 	switch (cmd) {
782 	case CHIOGPICKER:
783 	case CHIOGPARAMS:
784 	case OCHIOGSTATUS:
785 	case CHIOGSTATUS:
786 		break;
787 
788 	default:
789 		if ((flag & FWRITE) == 0) {
790 			cam_periph_unlock(periph);
791 			return (EBADF);
792 		}
793 	}
794 
795 	switch (cmd) {
796 	case CHIOMOVE:
797 		error = chmove(periph, (struct changer_move *)addr);
798 		break;
799 
800 	case CHIOEXCHANGE:
801 		error = chexchange(periph, (struct changer_exchange *)addr);
802 		break;
803 
804 	case CHIOPOSITION:
805 		error = chposition(periph, (struct changer_position *)addr);
806 		break;
807 
808 	case CHIOGPICKER:
809 		*(int *)addr = softc->sc_picker - softc->sc_firsts[CHET_MT];
810 		break;
811 
812 	case CHIOSPICKER:
813 	{
814 		int new_picker = *(int *)addr;
815 
816 		if (new_picker > (softc->sc_counts[CHET_MT] - 1)) {
817 			error = EINVAL;
818 			break;
819 		}
820 		softc->sc_picker = softc->sc_firsts[CHET_MT] + new_picker;
821 		break;
822 	}
823 	case CHIOGPARAMS:
824 	{
825 		struct changer_params *cp = (struct changer_params *)addr;
826 
827 		cp->cp_npickers = softc->sc_counts[CHET_MT];
828 		cp->cp_nslots = softc->sc_counts[CHET_ST];
829 		cp->cp_nportals = softc->sc_counts[CHET_IE];
830 		cp->cp_ndrives = softc->sc_counts[CHET_DT];
831 		break;
832 	}
833 	case CHIOIELEM:
834 		error = chielem(periph, *(unsigned int *)addr);
835 		break;
836 
837 	case OCHIOGSTATUS:
838 	{
839 		error = chgetelemstatus(periph, SCSI_REV_2, cmd,
840 		    (struct changer_element_status_request *)addr);
841 		break;
842 	}
843 
844 	case CHIOGSTATUS:
845 	{
846 		int scsi_version;
847 
848 		scsi_version = chscsiversion(periph);
849 		if (scsi_version >= SCSI_REV_0) {
850 			error = chgetelemstatus(periph, scsi_version, cmd,
851 			    (struct changer_element_status_request *)addr);
852 	  	}
853 		else { /* unable to determine the SCSI version */
854 			cam_periph_unlock(periph);
855 			return (ENXIO);
856 		}
857 		break;
858 	}
859 
860 	case CHIOSETVOLTAG:
861 	{
862 		error = chsetvoltag(periph,
863 				    (struct changer_set_voltag_request *) addr);
864 		break;
865 	}
866 
867 	/* Implement prevent/allow? */
868 
869 	default:
870 		error = cam_periph_ioctl(periph, cmd, addr, cherror);
871 		break;
872 	}
873 
874 	cam_periph_unlock(periph);
875 	return (error);
876 }
877 
878 static int
879 chmove(struct cam_periph *periph, struct changer_move *cm)
880 {
881 	struct ch_softc *softc;
882 	u_int16_t fromelem, toelem;
883 	union ccb *ccb;
884 	int error;
885 
886 	error = 0;
887 	softc = (struct ch_softc *)periph->softc;
888 
889 	/*
890 	 * Check arguments.
891 	 */
892 	if ((cm->cm_fromtype > CHET_DT) || (cm->cm_totype > CHET_DT))
893 		return (EINVAL);
894 	if ((cm->cm_fromunit > (softc->sc_counts[cm->cm_fromtype] - 1)) ||
895 	    (cm->cm_tounit > (softc->sc_counts[cm->cm_totype] - 1)))
896 		return (ENODEV);
897 
898 	/*
899 	 * Check the request against the changer's capabilities.
900 	 */
901 	if ((softc->sc_movemask[cm->cm_fromtype] & (1 << cm->cm_totype)) == 0)
902 		return (ENODEV);
903 
904 	/*
905 	 * Calculate the source and destination elements.
906 	 */
907 	fromelem = softc->sc_firsts[cm->cm_fromtype] + cm->cm_fromunit;
908 	toelem = softc->sc_firsts[cm->cm_totype] + cm->cm_tounit;
909 
910 	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
911 
912 	scsi_move_medium(&ccb->csio,
913 			 /* retries */ 1,
914 			 /* cbfcnp */ chdone,
915 			 /* tag_action */ MSG_SIMPLE_Q_TAG,
916 			 /* tea */ softc->sc_picker,
917 			 /* src */ fromelem,
918 			 /* dst */ toelem,
919 			 /* invert */ (cm->cm_flags & CM_INVERT) ? TRUE : FALSE,
920 			 /* sense_len */ SSD_FULL_SIZE,
921 			 /* timeout */ CH_TIMEOUT_MOVE_MEDIUM);
922 
923 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/CAM_RETRY_SELTO,
924 				  /*sense_flags*/ SF_RETRY_UA,
925 				  softc->device_stats);
926 
927 	xpt_release_ccb(ccb);
928 
929 	return(error);
930 }
931 
932 static int
933 chexchange(struct cam_periph *periph, struct changer_exchange *ce)
934 {
935 	struct ch_softc *softc;
936 	u_int16_t src, dst1, dst2;
937 	union ccb *ccb;
938 	int error;
939 
940 	error = 0;
941 	softc = (struct ch_softc *)periph->softc;
942 	/*
943 	 * Check arguments.
944 	 */
945 	if ((ce->ce_srctype > CHET_DT) || (ce->ce_fdsttype > CHET_DT) ||
946 	    (ce->ce_sdsttype > CHET_DT))
947 		return (EINVAL);
948 	if ((ce->ce_srcunit > (softc->sc_counts[ce->ce_srctype] - 1)) ||
949 	    (ce->ce_fdstunit > (softc->sc_counts[ce->ce_fdsttype] - 1)) ||
950 	    (ce->ce_sdstunit > (softc->sc_counts[ce->ce_sdsttype] - 1)))
951 		return (ENODEV);
952 
953 	/*
954 	 * Check the request against the changer's capabilities.
955 	 */
956 	if (((softc->sc_exchangemask[ce->ce_srctype] &
957 	     (1 << ce->ce_fdsttype)) == 0) ||
958 	    ((softc->sc_exchangemask[ce->ce_fdsttype] &
959 	     (1 << ce->ce_sdsttype)) == 0))
960 		return (ENODEV);
961 
962 	/*
963 	 * Calculate the source and destination elements.
964 	 */
965 	src = softc->sc_firsts[ce->ce_srctype] + ce->ce_srcunit;
966 	dst1 = softc->sc_firsts[ce->ce_fdsttype] + ce->ce_fdstunit;
967 	dst2 = softc->sc_firsts[ce->ce_sdsttype] + ce->ce_sdstunit;
968 
969 	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
970 
971 	scsi_exchange_medium(&ccb->csio,
972 			     /* retries */ 1,
973 			     /* cbfcnp */ chdone,
974 			     /* tag_action */ MSG_SIMPLE_Q_TAG,
975 			     /* tea */ softc->sc_picker,
976 			     /* src */ src,
977 			     /* dst1 */ dst1,
978 			     /* dst2 */ dst2,
979 			     /* invert1 */ (ce->ce_flags & CE_INVERT1) ?
980 			                   TRUE : FALSE,
981 			     /* invert2 */ (ce->ce_flags & CE_INVERT2) ?
982 			                   TRUE : FALSE,
983 			     /* sense_len */ SSD_FULL_SIZE,
984 			     /* timeout */ CH_TIMEOUT_EXCHANGE_MEDIUM);
985 
986 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/CAM_RETRY_SELTO,
987 				  /*sense_flags*/ SF_RETRY_UA,
988 				  softc->device_stats);
989 
990 	xpt_release_ccb(ccb);
991 
992 	return(error);
993 }
994 
995 static int
996 chposition(struct cam_periph *periph, struct changer_position *cp)
997 {
998 	struct ch_softc *softc;
999 	u_int16_t dst;
1000 	union ccb *ccb;
1001 	int error;
1002 
1003 	error = 0;
1004 	softc = (struct ch_softc *)periph->softc;
1005 
1006 	/*
1007 	 * Check arguments.
1008 	 */
1009 	if (cp->cp_type > CHET_DT)
1010 		return (EINVAL);
1011 	if (cp->cp_unit > (softc->sc_counts[cp->cp_type] - 1))
1012 		return (ENODEV);
1013 
1014 	/*
1015 	 * Calculate the destination element.
1016 	 */
1017 	dst = softc->sc_firsts[cp->cp_type] + cp->cp_unit;
1018 
1019 	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
1020 
1021 	scsi_position_to_element(&ccb->csio,
1022 				 /* retries */ 1,
1023 				 /* cbfcnp */ chdone,
1024 				 /* tag_action */ MSG_SIMPLE_Q_TAG,
1025 				 /* tea */ softc->sc_picker,
1026 				 /* dst */ dst,
1027 				 /* invert */ (cp->cp_flags & CP_INVERT) ?
1028 					      TRUE : FALSE,
1029 				 /* sense_len */ SSD_FULL_SIZE,
1030 				 /* timeout */ CH_TIMEOUT_POSITION_TO_ELEMENT);
1031 
1032 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/ CAM_RETRY_SELTO,
1033 				  /*sense_flags*/ SF_RETRY_UA,
1034 				  softc->device_stats);
1035 
1036 	xpt_release_ccb(ccb);
1037 
1038 	return(error);
1039 }
1040 
1041 /*
1042  * Copy a volume tag to a volume_tag struct, converting SCSI byte order
1043  * to host native byte order in the volume serial number.  The volume
1044  * label as returned by the changer is transferred to user mode as
1045  * nul-terminated string.  Volume labels are truncated at the first
1046  * space, as suggested by SCSI-2.
1047  */
1048 static	void
1049 copy_voltag(struct changer_voltag *uvoltag, struct volume_tag *voltag)
1050 {
1051 	int i;
1052 	for (i=0; i<CH_VOLTAG_MAXLEN; i++) {
1053 		char c = voltag->vif[i];
1054 		if (c && c != ' ')
1055 			uvoltag->cv_volid[i] = c;
1056 	        else
1057 			break;
1058 	}
1059 	uvoltag->cv_serial = scsi_2btoul(voltag->vsn);
1060 }
1061 
1062 /*
1063  * Copy an element status descriptor to a user-mode
1064  * changer_element_status structure.
1065  */
1066 static void
1067 copy_element_status(struct ch_softc *softc,
1068 		    u_int16_t flags,
1069 		    struct read_element_status_descriptor *desc,
1070 		    struct changer_element_status *ces,
1071 		    int scsi_version)
1072 {
1073 	u_int16_t eaddr = scsi_2btoul(desc->eaddr);
1074 	u_int16_t et;
1075 	struct volume_tag *pvol_tag = NULL, *avol_tag = NULL;
1076 	struct read_element_status_device_id *devid = NULL;
1077 
1078 	ces->ces_int_addr = eaddr;
1079 	/* set up logical address in element status */
1080 	for (et = CHET_MT; et <= CHET_DT; et++) {
1081 		if ((softc->sc_firsts[et] <= eaddr)
1082 		    && ((softc->sc_firsts[et] + softc->sc_counts[et])
1083 			> eaddr)) {
1084 			ces->ces_addr = eaddr - softc->sc_firsts[et];
1085 			ces->ces_type = et;
1086 			break;
1087 		}
1088 	}
1089 
1090 	ces->ces_flags = desc->flags1;
1091 
1092 	ces->ces_sensecode = desc->sense_code;
1093 	ces->ces_sensequal = desc->sense_qual;
1094 
1095 	if (desc->flags2 & READ_ELEMENT_STATUS_INVERT)
1096 		ces->ces_flags |= CES_INVERT;
1097 
1098 	if (desc->flags2 & READ_ELEMENT_STATUS_SVALID) {
1099 
1100 		eaddr = scsi_2btoul(desc->ssea);
1101 
1102 		/* convert source address to logical format */
1103 		for (et = CHET_MT; et <= CHET_DT; et++) {
1104 			if ((softc->sc_firsts[et] <= eaddr)
1105 			    && ((softc->sc_firsts[et] + softc->sc_counts[et])
1106 				> eaddr)) {
1107 				ces->ces_source_addr =
1108 					eaddr - softc->sc_firsts[et];
1109 				ces->ces_source_type = et;
1110 				ces->ces_flags |= CES_SOURCE_VALID;
1111 				break;
1112 			}
1113 		}
1114 
1115 		if (!(ces->ces_flags & CES_SOURCE_VALID))
1116 			printf("ch: warning: could not map element source "
1117 			       "address %ud to a valid element type\n",
1118 			       eaddr);
1119 	}
1120 
1121 	/*
1122 	 * pvoltag and avoltag are common between SCSI-2 and later versions
1123 	 */
1124 	if (flags & READ_ELEMENT_STATUS_PVOLTAG)
1125 		pvol_tag = &desc->voltag_devid.pvoltag;
1126 	if (flags & READ_ELEMENT_STATUS_AVOLTAG)
1127 		avol_tag = (flags & READ_ELEMENT_STATUS_PVOLTAG) ?
1128 		    &desc->voltag_devid.voltag[1] :&desc->voltag_devid.pvoltag;
1129 	/*
1130 	 * For SCSI-3 and later, element status can carry designator and
1131 	 * other information.
1132 	 */
1133 	if (scsi_version >= SCSI_REV_SPC) {
1134 		if ((flags & READ_ELEMENT_STATUS_PVOLTAG) ^
1135 		    (flags & READ_ELEMENT_STATUS_AVOLTAG))
1136 			devid = &desc->voltag_devid.pvol_and_devid.devid;
1137 		else if (!(flags & READ_ELEMENT_STATUS_PVOLTAG) &&
1138 			 !(flags & READ_ELEMENT_STATUS_AVOLTAG))
1139 			devid = &desc->voltag_devid.devid;
1140 		else /* Have both PVOLTAG and AVOLTAG */
1141 			devid = &desc->voltag_devid.vol_tags_and_devid.devid;
1142 	}
1143 
1144 	if (pvol_tag)
1145 		copy_voltag(&(ces->ces_pvoltag), pvol_tag);
1146 	if (avol_tag)
1147 		copy_voltag(&(ces->ces_pvoltag), avol_tag);
1148 	if (devid != NULL) {
1149 		if (devid->designator_length > 0) {
1150 			bcopy((void *)devid->designator,
1151 			      (void *)ces->ces_designator,
1152 			      devid->designator_length);
1153 			ces->ces_designator_length = devid->designator_length;
1154 			/*
1155 			 * Make sure we are always NUL terminated.  The
1156 			 * This won't matter for the binary code set,
1157 			 * since the user will only pay attention to the
1158 			 * length field.
1159 			 */
1160 			ces->ces_designator[devid->designator_length]= '\0';
1161 		}
1162 		if (devid->piv_assoc_designator_type &
1163 		    READ_ELEMENT_STATUS_PIV_SET) {
1164 			ces->ces_flags |= CES_PIV;
1165 			ces->ces_protocol_id =
1166 			    READ_ELEMENT_STATUS_PROTOCOL_ID(
1167 			    devid->prot_code_set);
1168 		}
1169 		ces->ces_code_set =
1170 		    READ_ELEMENT_STATUS_CODE_SET(devid->prot_code_set);
1171 		ces->ces_assoc = READ_ELEMENT_STATUS_ASSOCIATION(
1172 		    devid->piv_assoc_designator_type);
1173 		ces->ces_designator_type = READ_ELEMENT_STATUS_DESIGNATOR_TYPE(
1174 		    devid->piv_assoc_designator_type);
1175 	} else if (scsi_version > SCSI_REV_2) {
1176 		/* SCSI-SPC and No devid, no designator */
1177 		ces->ces_designator_length = 0;
1178 		ces->ces_designator[0] = '\0';
1179 		ces->ces_protocol_id = CES_PROTOCOL_ID_FCP_4;
1180 	}
1181 
1182 	if (scsi_version <= SCSI_REV_2) {
1183 		if (desc->dt_or_obsolete.scsi_2.dt_scsi_flags &
1184 		    READ_ELEMENT_STATUS_DT_IDVALID) {
1185 			ces->ces_flags |= CES_SCSIID_VALID;
1186 			ces->ces_scsi_id =
1187 			    desc->dt_or_obsolete.scsi_2.dt_scsi_addr;
1188 		}
1189 
1190 		if (desc->dt_or_obsolete.scsi_2.dt_scsi_addr &
1191 		    READ_ELEMENT_STATUS_DT_LUVALID) {
1192 			ces->ces_flags |= CES_LUN_VALID;
1193 			ces->ces_scsi_lun =
1194 			    desc->dt_or_obsolete.scsi_2.dt_scsi_flags &
1195 			    READ_ELEMENT_STATUS_DT_LUNMASK;
1196 		}
1197 	}
1198 }
1199 
1200 static int
1201 chgetelemstatus(struct cam_periph *periph, int scsi_version, u_long cmd,
1202 		struct changer_element_status_request *cesr)
1203 {
1204 	struct read_element_status_header *st_hdr;
1205 	struct read_element_status_page_header *pg_hdr;
1206 	struct read_element_status_descriptor *desc;
1207 	caddr_t data = NULL;
1208 	size_t size, desclen;
1209 	int avail, i, error = 0;
1210 	int curdata, dvcid, sense_flags;
1211 	int try_no_dvcid = 0;
1212 	struct changer_element_status *user_data = NULL;
1213 	struct ch_softc *softc;
1214 	union ccb *ccb;
1215 	int chet = cesr->cesr_element_type;
1216 	int want_voltags = (cesr->cesr_flags & CESR_VOLTAGS) ? 1 : 0;
1217 
1218 	softc = (struct ch_softc *)periph->softc;
1219 
1220 	/* perform argument checking */
1221 
1222 	/*
1223 	 * Perform a range check on the cesr_element_{base,count}
1224 	 * request argument fields.
1225 	 */
1226 	if ((softc->sc_counts[chet] - cesr->cesr_element_base) <= 0
1227 	    || (cesr->cesr_element_base + cesr->cesr_element_count)
1228 	        > softc->sc_counts[chet])
1229 		return (EINVAL);
1230 
1231 	/*
1232 	 * Request one descriptor for the given element type.  This
1233 	 * is used to determine the size of the descriptor so that
1234 	 * we can allocate enough storage for all of them.  We assume
1235 	 * that the first one can fit into 1k.
1236 	 */
1237 	cam_periph_unlock(periph);
1238 	data = (caddr_t)malloc(1024, M_DEVBUF, M_WAITOK);
1239 
1240 	cam_periph_lock(periph);
1241 	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
1242 
1243 	sense_flags = SF_RETRY_UA;
1244 	if (softc->quirks & CH_Q_NO_DVCID) {
1245 		dvcid = 0;
1246 		curdata = 0;
1247 	} else {
1248 		dvcid = 1;
1249 		curdata = 1;
1250 		/*
1251 		 * Don't print anything for an Illegal Request, because
1252 		 * these flags can cause some changers to complain.  We'll
1253 		 * retry without them if we get an error.
1254 		 */
1255 		sense_flags |= SF_QUIET_IR;
1256 	}
1257 
1258 retry_einval:
1259 
1260 	scsi_read_element_status(&ccb->csio,
1261 				 /* retries */ 1,
1262 				 /* cbfcnp */ chdone,
1263 				 /* tag_action */ MSG_SIMPLE_Q_TAG,
1264 				 /* voltag */ want_voltags,
1265 				 /* sea */ softc->sc_firsts[chet],
1266 				 /* curdata */ curdata,
1267 				 /* dvcid */ dvcid,
1268 				 /* count */ 1,
1269 				 /* data_ptr */ data,
1270 				 /* dxfer_len */ 1024,
1271 				 /* sense_len */ SSD_FULL_SIZE,
1272 				 /* timeout */ CH_TIMEOUT_READ_ELEMENT_STATUS);
1273 
1274 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/ CAM_RETRY_SELTO,
1275 				  /*sense_flags*/ sense_flags,
1276 				  softc->device_stats);
1277 
1278 	/*
1279 	 * An Illegal Request sense key (only used if there is no asc/ascq)
1280 	 * or 0x24,0x00 for an ASC/ASCQ both map to EINVAL.  If dvcid or
1281 	 * curdata are set (we set both or neither), try turning them off
1282 	 * and see if the command is successful.
1283 	 */
1284 	if ((error == EINVAL)
1285 	 && (dvcid || curdata))  {
1286 		dvcid = 0;
1287 		curdata = 0;
1288 		error = 0;
1289 		/* At this point we want to report any Illegal Request */
1290 		sense_flags &= ~SF_QUIET_IR;
1291 		try_no_dvcid = 1;
1292 		goto retry_einval;
1293 	}
1294 
1295 	/*
1296 	 * In this case, we tried a read element status with dvcid and
1297 	 * curdata set, and it failed.  We retried without those bits, and
1298 	 * it succeeded.  Suggest to the user that he set a quirk, so we
1299 	 * don't go through the retry process the first time in the future.
1300 	 * This should only happen on changers that claim SCSI-3 or higher,
1301 	 * but don't support these bits.
1302 	 */
1303 	if ((try_no_dvcid != 0)
1304 	 && (error == 0))
1305 		softc->quirks |= CH_Q_NO_DVCID;
1306 
1307 	if (error)
1308 		goto done;
1309 	cam_periph_unlock(periph);
1310 
1311 	st_hdr = (struct read_element_status_header *)data;
1312 	pg_hdr = (struct read_element_status_page_header *)((uintptr_t)st_hdr +
1313 		  sizeof(struct read_element_status_header));
1314 	desclen = scsi_2btoul(pg_hdr->edl);
1315 
1316 	size = sizeof(struct read_element_status_header) +
1317 	       sizeof(struct read_element_status_page_header) +
1318 	       (desclen * cesr->cesr_element_count);
1319 	/*
1320 	 * Reallocate storage for descriptors and get them from the
1321 	 * device.
1322 	 */
1323 	free(data, M_DEVBUF);
1324 	data = (caddr_t)malloc(size, M_DEVBUF, M_WAITOK);
1325 
1326 	cam_periph_lock(periph);
1327 	scsi_read_element_status(&ccb->csio,
1328 				 /* retries */ 1,
1329 				 /* cbfcnp */ chdone,
1330 				 /* tag_action */ MSG_SIMPLE_Q_TAG,
1331 				 /* voltag */ want_voltags,
1332 				 /* sea */ softc->sc_firsts[chet]
1333 				 + cesr->cesr_element_base,
1334 				 /* curdata */ curdata,
1335 				 /* dvcid */ dvcid,
1336 				 /* count */ cesr->cesr_element_count,
1337 				 /* data_ptr */ data,
1338 				 /* dxfer_len */ size,
1339 				 /* sense_len */ SSD_FULL_SIZE,
1340 				 /* timeout */ CH_TIMEOUT_READ_ELEMENT_STATUS);
1341 
1342 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/ CAM_RETRY_SELTO,
1343 				  /*sense_flags*/ SF_RETRY_UA,
1344 				  softc->device_stats);
1345 
1346 	if (error)
1347 		goto done;
1348 	cam_periph_unlock(periph);
1349 
1350 	/*
1351 	 * Fill in the user status array.
1352 	 */
1353 	st_hdr = (struct read_element_status_header *)data;
1354 	pg_hdr = (struct read_element_status_page_header *)((uintptr_t)st_hdr +
1355 		  sizeof(struct read_element_status_header));
1356 	avail = scsi_2btoul(st_hdr->count);
1357 
1358 	if (avail != cesr->cesr_element_count) {
1359 		xpt_print(periph->path,
1360 		    "warning, READ ELEMENT STATUS avail != count\n");
1361 	}
1362 
1363 	user_data = (struct changer_element_status *)
1364 		malloc(avail * sizeof(struct changer_element_status),
1365 		       M_DEVBUF, M_WAITOK | M_ZERO);
1366 
1367 	desc = (struct read_element_status_descriptor *)((uintptr_t)data +
1368 		sizeof(struct read_element_status_header) +
1369 		sizeof(struct read_element_status_page_header));
1370 	/*
1371 	 * Set up the individual element status structures
1372 	 */
1373 	for (i = 0; i < avail; ++i) {
1374 		struct changer_element_status *ces;
1375 
1376 		/*
1377 		 * In the changer_element_status structure, fields from
1378 		 * the beginning to the field of ces_scsi_lun are common
1379 		 * between SCSI-2 and SCSI-3, while all the rest are new
1380 		 * from SCSI-3. In order to maintain backward compatibility
1381 		 * of the chio command, the ces pointer, below, is computed
1382 		 * such that it lines up with the structure boundary
1383 		 * corresponding to the SCSI version.
1384 		 */
1385 		ces = cmd == OCHIOGSTATUS ?
1386 		    (struct changer_element_status *)
1387 		    ((unsigned char *)user_data + i *
1388 		     (offsetof(struct changer_element_status,ces_scsi_lun)+1)):
1389 		    &user_data[i];
1390 
1391 		copy_element_status(softc, pg_hdr->flags, desc,
1392 				    ces, scsi_version);
1393 
1394 		desc = (struct read_element_status_descriptor *)
1395 		       ((unsigned char *)desc + desclen);
1396 	}
1397 
1398 	/* Copy element status structures out to userspace. */
1399 	if (cmd == OCHIOGSTATUS)
1400 		error = copyout(user_data,
1401 				cesr->cesr_element_status,
1402 				avail* (offsetof(struct changer_element_status,
1403 				ces_scsi_lun) + 1));
1404 	else
1405 		error = copyout(user_data,
1406 				cesr->cesr_element_status,
1407 				avail * sizeof(struct changer_element_status));
1408 
1409 	cam_periph_lock(periph);
1410 
1411  done:
1412 	xpt_release_ccb(ccb);
1413 
1414 	if (data != NULL)
1415 		free(data, M_DEVBUF);
1416 	if (user_data != NULL)
1417 		free(user_data, M_DEVBUF);
1418 
1419 	return (error);
1420 }
1421 
1422 static int
1423 chielem(struct cam_periph *periph,
1424 	unsigned int timeout)
1425 {
1426 	union ccb *ccb;
1427 	struct ch_softc *softc;
1428 	int error;
1429 
1430 	if (!timeout) {
1431 		timeout = CH_TIMEOUT_INITIALIZE_ELEMENT_STATUS;
1432 	} else {
1433 		timeout *= 1000;
1434 	}
1435 
1436 	error = 0;
1437 	softc = (struct ch_softc *)periph->softc;
1438 
1439 	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
1440 
1441 	scsi_initialize_element_status(&ccb->csio,
1442 				      /* retries */ 1,
1443 				      /* cbfcnp */ chdone,
1444 				      /* tag_action */ MSG_SIMPLE_Q_TAG,
1445 				      /* sense_len */ SSD_FULL_SIZE,
1446 				      /* timeout */ timeout);
1447 
1448 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/ CAM_RETRY_SELTO,
1449 				  /*sense_flags*/ SF_RETRY_UA,
1450 				  softc->device_stats);
1451 
1452 	xpt_release_ccb(ccb);
1453 
1454 	return(error);
1455 }
1456 
1457 static int
1458 chsetvoltag(struct cam_periph *periph,
1459 	    struct changer_set_voltag_request *csvr)
1460 {
1461 	union ccb *ccb;
1462 	struct ch_softc *softc;
1463 	u_int16_t ea;
1464 	u_int8_t sac;
1465 	struct scsi_send_volume_tag_parameters ssvtp;
1466 	int error;
1467 	int i;
1468 
1469 	error = 0;
1470 	softc = (struct ch_softc *)periph->softc;
1471 
1472 	bzero(&ssvtp, sizeof(ssvtp));
1473 	for (i=0; i<sizeof(ssvtp.vitf); i++) {
1474 		ssvtp.vitf[i] = ' ';
1475 	}
1476 
1477 	/*
1478 	 * Check arguments.
1479 	 */
1480 	if (csvr->csvr_type > CHET_DT)
1481 		return EINVAL;
1482 	if (csvr->csvr_addr > (softc->sc_counts[csvr->csvr_type] - 1))
1483 		return ENODEV;
1484 
1485 	ea = softc->sc_firsts[csvr->csvr_type] + csvr->csvr_addr;
1486 
1487 	if (csvr->csvr_flags & CSVR_ALTERNATE) {
1488 		switch (csvr->csvr_flags & CSVR_MODE_MASK) {
1489 		case CSVR_MODE_SET:
1490 			sac = SEND_VOLUME_TAG_ASSERT_ALTERNATE;
1491 			break;
1492 		case CSVR_MODE_REPLACE:
1493 			sac = SEND_VOLUME_TAG_REPLACE_ALTERNATE;
1494 			break;
1495 		case CSVR_MODE_CLEAR:
1496 			sac = SEND_VOLUME_TAG_UNDEFINED_ALTERNATE;
1497 			break;
1498 		default:
1499 			error = EINVAL;
1500 			goto out;
1501 		}
1502 	} else {
1503 		switch (csvr->csvr_flags & CSVR_MODE_MASK) {
1504 		case CSVR_MODE_SET:
1505 			sac = SEND_VOLUME_TAG_ASSERT_PRIMARY;
1506 			break;
1507 		case CSVR_MODE_REPLACE:
1508 			sac = SEND_VOLUME_TAG_REPLACE_PRIMARY;
1509 			break;
1510 		case CSVR_MODE_CLEAR:
1511 			sac = SEND_VOLUME_TAG_UNDEFINED_PRIMARY;
1512 			break;
1513 		default:
1514 			error = EINVAL;
1515 			goto out;
1516 		}
1517 	}
1518 
1519 	memcpy(ssvtp.vitf, csvr->csvr_voltag.cv_volid,
1520 	       min(strlen(csvr->csvr_voltag.cv_volid), sizeof(ssvtp.vitf)));
1521 	scsi_ulto2b(csvr->csvr_voltag.cv_serial, ssvtp.minvsn);
1522 
1523 	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
1524 
1525 	scsi_send_volume_tag(&ccb->csio,
1526 			     /* retries */ 1,
1527 			     /* cbfcnp */ chdone,
1528 			     /* tag_action */ MSG_SIMPLE_Q_TAG,
1529 			     /* element_address */ ea,
1530 			     /* send_action_code */ sac,
1531 			     /* parameters */ &ssvtp,
1532 			     /* sense_len */ SSD_FULL_SIZE,
1533 			     /* timeout */ CH_TIMEOUT_SEND_VOLTAG);
1534 
1535 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/ CAM_RETRY_SELTO,
1536 				  /*sense_flags*/ SF_RETRY_UA,
1537 				  softc->device_stats);
1538 
1539 	xpt_release_ccb(ccb);
1540 
1541  out:
1542 	return error;
1543 }
1544 
1545 static int
1546 chgetparams(struct cam_periph *periph)
1547 {
1548 	union ccb *ccb;
1549 	struct ch_softc *softc;
1550 	void *mode_buffer;
1551 	int mode_buffer_len;
1552 	struct page_element_address_assignment *ea;
1553 	struct page_device_capabilities *cap;
1554 	int error, from, dbd;
1555 	u_int8_t *moves, *exchanges;
1556 
1557 	error = 0;
1558 
1559 	softc = (struct ch_softc *)periph->softc;
1560 
1561 	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
1562 
1563 	/*
1564 	 * The scsi_mode_sense_data structure is just a convenience
1565 	 * structure that allows us to easily calculate the worst-case
1566 	 * storage size of the mode sense buffer.
1567 	 */
1568 	mode_buffer_len = sizeof(struct scsi_mode_sense_data);
1569 
1570 	mode_buffer = malloc(mode_buffer_len, M_SCSICH, M_NOWAIT);
1571 
1572 	if (mode_buffer == NULL) {
1573 		printf("chgetparams: couldn't malloc mode sense data\n");
1574 		xpt_release_ccb(ccb);
1575 		return(ENOSPC);
1576 	}
1577 
1578 	bzero(mode_buffer, mode_buffer_len);
1579 
1580 	if (softc->quirks & CH_Q_NO_DBD)
1581 		dbd = FALSE;
1582 	else
1583 		dbd = TRUE;
1584 
1585 	/*
1586 	 * Get the element address assignment page.
1587 	 */
1588 	scsi_mode_sense(&ccb->csio,
1589 			/* retries */ 1,
1590 			/* cbfcnp */ chdone,
1591 			/* tag_action */ MSG_SIMPLE_Q_TAG,
1592 			/* dbd */ dbd,
1593 			/* pc */ SMS_PAGE_CTRL_CURRENT,
1594 			/* page */ CH_ELEMENT_ADDR_ASSIGN_PAGE,
1595 			/* param_buf */ (u_int8_t *)mode_buffer,
1596 			/* param_len */ mode_buffer_len,
1597 			/* sense_len */ SSD_FULL_SIZE,
1598 			/* timeout */ CH_TIMEOUT_MODE_SENSE);
1599 
1600 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/ CAM_RETRY_SELTO,
1601 				  /* sense_flags */ SF_RETRY_UA|SF_NO_PRINT,
1602 				  softc->device_stats);
1603 
1604 	if (error) {
1605 		if (dbd) {
1606 			struct scsi_mode_sense_6 *sms;
1607 
1608 			sms = (struct scsi_mode_sense_6 *)
1609 				ccb->csio.cdb_io.cdb_bytes;
1610 
1611 			sms->byte2 &= ~SMS_DBD;
1612 			error = cam_periph_runccb(ccb, cherror,
1613 						  /*cam_flags*/ CAM_RETRY_SELTO,
1614 				  		  /*sense_flags*/ SF_RETRY_UA,
1615 						  softc->device_stats);
1616 		} else {
1617 			/*
1618 			 * Since we disabled sense printing above, print
1619 			 * out the sense here since we got an error.
1620 			 */
1621 			scsi_sense_print(&ccb->csio);
1622 		}
1623 
1624 		if (error) {
1625 			xpt_print(periph->path,
1626 			    "chgetparams: error getting element "
1627 			    "address page\n");
1628 			xpt_release_ccb(ccb);
1629 			free(mode_buffer, M_SCSICH);
1630 			return(error);
1631 		}
1632 	}
1633 
1634 	ea = (struct page_element_address_assignment *)
1635 		find_mode_page_6((struct scsi_mode_header_6 *)mode_buffer);
1636 
1637 	softc->sc_firsts[CHET_MT] = scsi_2btoul(ea->mtea);
1638 	softc->sc_counts[CHET_MT] = scsi_2btoul(ea->nmte);
1639 	softc->sc_firsts[CHET_ST] = scsi_2btoul(ea->fsea);
1640 	softc->sc_counts[CHET_ST] = scsi_2btoul(ea->nse);
1641 	softc->sc_firsts[CHET_IE] = scsi_2btoul(ea->fieea);
1642 	softc->sc_counts[CHET_IE] = scsi_2btoul(ea->niee);
1643 	softc->sc_firsts[CHET_DT] = scsi_2btoul(ea->fdtea);
1644 	softc->sc_counts[CHET_DT] = scsi_2btoul(ea->ndte);
1645 
1646 	bzero(mode_buffer, mode_buffer_len);
1647 
1648 	/*
1649 	 * Now get the device capabilities page.
1650 	 */
1651 	scsi_mode_sense(&ccb->csio,
1652 			/* retries */ 1,
1653 			/* cbfcnp */ chdone,
1654 			/* tag_action */ MSG_SIMPLE_Q_TAG,
1655 			/* dbd */ dbd,
1656 			/* pc */ SMS_PAGE_CTRL_CURRENT,
1657 			/* page */ CH_DEVICE_CAP_PAGE,
1658 			/* param_buf */ (u_int8_t *)mode_buffer,
1659 			/* param_len */ mode_buffer_len,
1660 			/* sense_len */ SSD_FULL_SIZE,
1661 			/* timeout */ CH_TIMEOUT_MODE_SENSE);
1662 
1663 	error = cam_periph_runccb(ccb, cherror, /*cam_flags*/ CAM_RETRY_SELTO,
1664 				  /* sense_flags */ SF_RETRY_UA | SF_NO_PRINT,
1665 				  softc->device_stats);
1666 
1667 	if (error) {
1668 		if (dbd) {
1669 			struct scsi_mode_sense_6 *sms;
1670 
1671 			sms = (struct scsi_mode_sense_6 *)
1672 				ccb->csio.cdb_io.cdb_bytes;
1673 
1674 			sms->byte2 &= ~SMS_DBD;
1675 			error = cam_periph_runccb(ccb, cherror,
1676 						  /*cam_flags*/ CAM_RETRY_SELTO,
1677 				  		  /*sense_flags*/ SF_RETRY_UA,
1678 						  softc->device_stats);
1679 		} else {
1680 			/*
1681 			 * Since we disabled sense printing above, print
1682 			 * out the sense here since we got an error.
1683 			 */
1684 			scsi_sense_print(&ccb->csio);
1685 		}
1686 
1687 		if (error) {
1688 			xpt_print(periph->path,
1689 			    "chgetparams: error getting device "
1690 			    "capabilities page\n");
1691 			xpt_release_ccb(ccb);
1692 			free(mode_buffer, M_SCSICH);
1693 			return(error);
1694 		}
1695 	}
1696 
1697 	xpt_release_ccb(ccb);
1698 
1699 	cap = (struct page_device_capabilities *)
1700 		find_mode_page_6((struct scsi_mode_header_6 *)mode_buffer);
1701 
1702 	bzero(softc->sc_movemask, sizeof(softc->sc_movemask));
1703 	bzero(softc->sc_exchangemask, sizeof(softc->sc_exchangemask));
1704 	moves = cap->move_from;
1705 	exchanges = cap->exchange_with;
1706 	for (from = CHET_MT; from <= CHET_MAX; ++from) {
1707 		softc->sc_movemask[from] = moves[from];
1708 		softc->sc_exchangemask[from] = exchanges[from];
1709 	}
1710 
1711 	free(mode_buffer, M_SCSICH);
1712 
1713 	return(error);
1714 }
1715 
1716 static int
1717 chscsiversion(struct cam_periph *periph)
1718 {
1719 	struct scsi_inquiry_data *inq_data;
1720 	struct ccb_getdev *cgd;
1721 	int dev_scsi_version;
1722 
1723 	cam_periph_assert(periph, MA_OWNED);
1724 	if ((cgd = (struct ccb_getdev *)xpt_alloc_ccb_nowait()) == NULL)
1725 		return (-1);
1726 	/*
1727 	 * Get the device information.
1728 	 */
1729 	xpt_setup_ccb(&cgd->ccb_h,
1730 		      periph->path,
1731 		      CAM_PRIORITY_NORMAL);
1732 	cgd->ccb_h.func_code = XPT_GDEV_TYPE;
1733 	xpt_action((union ccb *)cgd);
1734 
1735 	if (cgd->ccb_h.status != CAM_REQ_CMP) {
1736 		xpt_free_ccb((union ccb *)cgd);
1737 		return -1;
1738 	}
1739 
1740 	inq_data = &cgd->inq_data;
1741 	dev_scsi_version = inq_data->version;
1742 	xpt_free_ccb((union ccb *)cgd);
1743 
1744 	return dev_scsi_version;
1745 }
1746 
1747 void
1748 scsi_move_medium(struct ccb_scsiio *csio, u_int32_t retries,
1749 		 void (*cbfcnp)(struct cam_periph *, union ccb *),
1750 		 u_int8_t tag_action, u_int32_t tea, u_int32_t src,
1751 		 u_int32_t dst, int invert, u_int8_t sense_len,
1752 		 u_int32_t timeout)
1753 {
1754 	struct scsi_move_medium *scsi_cmd;
1755 
1756 	scsi_cmd = (struct scsi_move_medium *)&csio->cdb_io.cdb_bytes;
1757 	bzero(scsi_cmd, sizeof(*scsi_cmd));
1758 
1759 	scsi_cmd->opcode = MOVE_MEDIUM;
1760 
1761 	scsi_ulto2b(tea, scsi_cmd->tea);
1762 	scsi_ulto2b(src, scsi_cmd->src);
1763 	scsi_ulto2b(dst, scsi_cmd->dst);
1764 
1765 	if (invert)
1766 		scsi_cmd->invert |= MOVE_MEDIUM_INVERT;
1767 
1768 	cam_fill_csio(csio,
1769 		      retries,
1770 		      cbfcnp,
1771 		      /*flags*/ CAM_DIR_NONE,
1772 		      tag_action,
1773 		      /*data_ptr*/ NULL,
1774 		      /*dxfer_len*/ 0,
1775 		      sense_len,
1776 		      sizeof(*scsi_cmd),
1777 		      timeout);
1778 }
1779 
1780 void
1781 scsi_exchange_medium(struct ccb_scsiio *csio, u_int32_t retries,
1782 		     void (*cbfcnp)(struct cam_periph *, union ccb *),
1783 		     u_int8_t tag_action, u_int32_t tea, u_int32_t src,
1784 		     u_int32_t dst1, u_int32_t dst2, int invert1,
1785 		     int invert2, u_int8_t sense_len, u_int32_t timeout)
1786 {
1787 	struct scsi_exchange_medium *scsi_cmd;
1788 
1789 	scsi_cmd = (struct scsi_exchange_medium *)&csio->cdb_io.cdb_bytes;
1790 	bzero(scsi_cmd, sizeof(*scsi_cmd));
1791 
1792 	scsi_cmd->opcode = EXCHANGE_MEDIUM;
1793 
1794 	scsi_ulto2b(tea, scsi_cmd->tea);
1795 	scsi_ulto2b(src, scsi_cmd->src);
1796 	scsi_ulto2b(dst1, scsi_cmd->fdst);
1797 	scsi_ulto2b(dst2, scsi_cmd->sdst);
1798 
1799 	if (invert1)
1800 		scsi_cmd->invert |= EXCHANGE_MEDIUM_INV1;
1801 
1802 	if (invert2)
1803 		scsi_cmd->invert |= EXCHANGE_MEDIUM_INV2;
1804 
1805 	cam_fill_csio(csio,
1806 		      retries,
1807 		      cbfcnp,
1808 		      /*flags*/ CAM_DIR_NONE,
1809 		      tag_action,
1810 		      /*data_ptr*/ NULL,
1811 		      /*dxfer_len*/ 0,
1812 		      sense_len,
1813 		      sizeof(*scsi_cmd),
1814 		      timeout);
1815 }
1816 
1817 void
1818 scsi_position_to_element(struct ccb_scsiio *csio, u_int32_t retries,
1819 			 void (*cbfcnp)(struct cam_periph *, union ccb *),
1820 			 u_int8_t tag_action, u_int32_t tea, u_int32_t dst,
1821 			 int invert, u_int8_t sense_len, u_int32_t timeout)
1822 {
1823 	struct scsi_position_to_element *scsi_cmd;
1824 
1825 	scsi_cmd = (struct scsi_position_to_element *)&csio->cdb_io.cdb_bytes;
1826 	bzero(scsi_cmd, sizeof(*scsi_cmd));
1827 
1828 	scsi_cmd->opcode = POSITION_TO_ELEMENT;
1829 
1830 	scsi_ulto2b(tea, scsi_cmd->tea);
1831 	scsi_ulto2b(dst, scsi_cmd->dst);
1832 
1833 	if (invert)
1834 		scsi_cmd->invert |= POSITION_TO_ELEMENT_INVERT;
1835 
1836 	cam_fill_csio(csio,
1837 		      retries,
1838 		      cbfcnp,
1839 		      /*flags*/ CAM_DIR_NONE,
1840 		      tag_action,
1841 		      /*data_ptr*/ NULL,
1842 		      /*dxfer_len*/ 0,
1843 		      sense_len,
1844 		      sizeof(*scsi_cmd),
1845 		      timeout);
1846 }
1847 
1848 void
1849 scsi_read_element_status(struct ccb_scsiio *csio, u_int32_t retries,
1850 			 void (*cbfcnp)(struct cam_periph *, union ccb *),
1851 			 u_int8_t tag_action, int voltag, u_int32_t sea,
1852 			 int curdata, int dvcid,
1853 			 u_int32_t count, u_int8_t *data_ptr,
1854 			 u_int32_t dxfer_len, u_int8_t sense_len,
1855 			 u_int32_t timeout)
1856 {
1857 	struct scsi_read_element_status *scsi_cmd;
1858 
1859 	scsi_cmd = (struct scsi_read_element_status *)&csio->cdb_io.cdb_bytes;
1860 	bzero(scsi_cmd, sizeof(*scsi_cmd));
1861 
1862 	scsi_cmd->opcode = READ_ELEMENT_STATUS;
1863 
1864 	scsi_ulto2b(sea, scsi_cmd->sea);
1865 	scsi_ulto2b(count, scsi_cmd->count);
1866 	scsi_ulto3b(dxfer_len, scsi_cmd->len);
1867 	if (dvcid)
1868 		scsi_cmd->flags |= READ_ELEMENT_STATUS_DVCID;
1869 	if (curdata)
1870 		scsi_cmd->flags |= READ_ELEMENT_STATUS_CURDATA;
1871 
1872 	if (voltag)
1873 		scsi_cmd->byte2 |= READ_ELEMENT_STATUS_VOLTAG;
1874 
1875 	cam_fill_csio(csio,
1876 		      retries,
1877 		      cbfcnp,
1878 		      /*flags*/ CAM_DIR_IN,
1879 		      tag_action,
1880 		      data_ptr,
1881 		      dxfer_len,
1882 		      sense_len,
1883 		      sizeof(*scsi_cmd),
1884 		      timeout);
1885 }
1886 
1887 void
1888 scsi_initialize_element_status(struct ccb_scsiio *csio, u_int32_t retries,
1889 			       void (*cbfcnp)(struct cam_periph *, union ccb *),
1890 			       u_int8_t tag_action, u_int8_t sense_len,
1891 			       u_int32_t timeout)
1892 {
1893 	struct scsi_initialize_element_status *scsi_cmd;
1894 
1895 	scsi_cmd = (struct scsi_initialize_element_status *)
1896 		    &csio->cdb_io.cdb_bytes;
1897 	bzero(scsi_cmd, sizeof(*scsi_cmd));
1898 
1899 	scsi_cmd->opcode = INITIALIZE_ELEMENT_STATUS;
1900 
1901 	cam_fill_csio(csio,
1902 		      retries,
1903 		      cbfcnp,
1904 		      /*flags*/ CAM_DIR_NONE,
1905 		      tag_action,
1906 		      /* data_ptr */ NULL,
1907 		      /* dxfer_len */ 0,
1908 		      sense_len,
1909 		      sizeof(*scsi_cmd),
1910 		      timeout);
1911 }
1912 
1913 void
1914 scsi_send_volume_tag(struct ccb_scsiio *csio, u_int32_t retries,
1915 		     void (*cbfcnp)(struct cam_periph *, union ccb *),
1916 		     u_int8_t tag_action,
1917 		     u_int16_t element_address,
1918 		     u_int8_t send_action_code,
1919 		     struct scsi_send_volume_tag_parameters *parameters,
1920 		     u_int8_t sense_len, u_int32_t timeout)
1921 {
1922 	struct scsi_send_volume_tag *scsi_cmd;
1923 
1924 	scsi_cmd = (struct scsi_send_volume_tag *) &csio->cdb_io.cdb_bytes;
1925 	bzero(scsi_cmd, sizeof(*scsi_cmd));
1926 
1927 	scsi_cmd->opcode = SEND_VOLUME_TAG;
1928 	scsi_ulto2b(element_address, scsi_cmd->ea);
1929 	scsi_cmd->sac = send_action_code;
1930 	scsi_ulto2b(sizeof(*parameters), scsi_cmd->pll);
1931 
1932 	cam_fill_csio(csio,
1933 		      retries,
1934 		      cbfcnp,
1935 		      /*flags*/ CAM_DIR_OUT,
1936 		      tag_action,
1937 		      /* data_ptr */ (u_int8_t *) parameters,
1938 		      sizeof(*parameters),
1939 		      sense_len,
1940 		      sizeof(*scsi_cmd),
1941 		      timeout);
1942 }
1943