ctl_tpc.c revision 300587
1/*-
2 * Copyright (c) 2014 Alexander Motin <mav@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification, immediately at the beginning of the file.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD: stable/10/sys/cam/ctl/ctl_tpc.c 300587 2016-05-24 07:19:00Z mav $");
29
30#include <sys/param.h>
31#include <sys/systm.h>
32#include <sys/kernel.h>
33#include <sys/types.h>
34#include <sys/lock.h>
35#include <sys/module.h>
36#include <sys/mutex.h>
37#include <sys/condvar.h>
38#include <sys/malloc.h>
39#include <sys/conf.h>
40#include <sys/queue.h>
41#include <sys/sysctl.h>
42#include <machine/atomic.h>
43
44#include <cam/cam.h>
45#include <cam/scsi/scsi_all.h>
46#include <cam/scsi/scsi_da.h>
47#include <cam/ctl/ctl_io.h>
48#include <cam/ctl/ctl.h>
49#include <cam/ctl/ctl_frontend.h>
50#include <cam/ctl/ctl_util.h>
51#include <cam/ctl/ctl_backend.h>
52#include <cam/ctl/ctl_ioctl.h>
53#include <cam/ctl/ctl_ha.h>
54#include <cam/ctl/ctl_private.h>
55#include <cam/ctl/ctl_debug.h>
56#include <cam/ctl/ctl_scsi_all.h>
57#include <cam/ctl/ctl_tpc.h>
58#include <cam/ctl/ctl_error.h>
59
60#define	TPC_MAX_CSCDS	64
61#define	TPC_MAX_SEGS	64
62#define	TPC_MAX_SEG	0
63#define	TPC_MAX_LIST	8192
64#define	TPC_MAX_INLINE	0
65#define	TPC_MAX_LISTS	255
66#define	TPC_MAX_IO_SIZE	(1024 * 1024)
67#define	TPC_MAX_IOCHUNK_SIZE	(TPC_MAX_IO_SIZE * 16)
68#define	TPC_MIN_TOKEN_TIMEOUT	1
69#define	TPC_DFL_TOKEN_TIMEOUT	60
70#define	TPC_MAX_TOKEN_TIMEOUT	600
71
72MALLOC_DEFINE(M_CTL_TPC, "ctltpc", "CTL TPC");
73
74typedef enum {
75	TPC_ERR_RETRY		= 0x000,
76	TPC_ERR_FAIL		= 0x001,
77	TPC_ERR_MASK		= 0x0ff,
78	TPC_ERR_NO_DECREMENT	= 0x100
79} tpc_error_action;
80
81struct tpc_list;
82TAILQ_HEAD(runl, tpc_io);
83struct tpc_io {
84	union ctl_io		*io;
85	uint64_t		 lun;
86	struct tpc_list		*list;
87	struct runl		 run;
88	TAILQ_ENTRY(tpc_io)	 rlinks;
89	TAILQ_ENTRY(tpc_io)	 links;
90};
91
92struct tpc_token {
93	uint8_t			 token[512];
94	uint64_t		 lun;
95	uint32_t		 blocksize;
96	uint8_t			*params;
97	struct scsi_range_desc	*range;
98	int			 nrange;
99	int			 active;
100	time_t			 last_active;
101	uint32_t		 timeout;
102	TAILQ_ENTRY(tpc_token)	 links;
103};
104
105struct tpc_list {
106	uint8_t			 service_action;
107	int			 init_port;
108	uint32_t		 init_idx;
109	uint32_t		 list_id;
110	uint8_t			 flags;
111	uint8_t			*params;
112	struct scsi_ec_cscd	*cscd;
113	struct scsi_ec_segment	*seg[TPC_MAX_SEGS];
114	uint8_t			*inl;
115	int			 ncscd;
116	int			 nseg;
117	int			 leninl;
118	struct tpc_token	*token;
119	struct scsi_range_desc	*range;
120	int			 nrange;
121	off_t			 offset_into_rod;
122
123	int			 curseg;
124	off_t			 cursectors;
125	off_t			 curbytes;
126	int			 curops;
127	int			 stage;
128	uint8_t			*buf;
129	off_t			 segsectors;
130	off_t			 segbytes;
131	int			 tbdio;
132	int			 error;
133	int			 abort;
134	int			 completed;
135	time_t			 last_active;
136	TAILQ_HEAD(, tpc_io)	 allio;
137	struct scsi_sense_data	 sense_data;
138	uint8_t			 sense_len;
139	uint8_t			 scsi_status;
140	struct ctl_scsiio	*ctsio;
141	struct ctl_lun		*lun;
142	int			 res_token_valid;
143	uint8_t			 res_token[512];
144	TAILQ_ENTRY(tpc_list)	 links;
145};
146
147static void
148tpc_timeout(void *arg)
149{
150	struct ctl_softc *softc = arg;
151	struct ctl_lun *lun;
152	struct tpc_token *token, *ttoken;
153	struct tpc_list *list, *tlist;
154
155	/* Free completed lists with expired timeout. */
156	STAILQ_FOREACH(lun, &softc->lun_list, links) {
157		mtx_lock(&lun->lun_lock);
158		TAILQ_FOREACH_SAFE(list, &lun->tpc_lists, links, tlist) {
159			if (!list->completed || time_uptime < list->last_active +
160			    TPC_DFL_TOKEN_TIMEOUT)
161				continue;
162			TAILQ_REMOVE(&lun->tpc_lists, list, links);
163			free(list, M_CTL);
164		}
165		mtx_unlock(&lun->lun_lock);
166	}
167
168	/* Free inactive ROD tokens with expired timeout. */
169	mtx_lock(&softc->tpc_lock);
170	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
171		if (token->active ||
172		    time_uptime < token->last_active + token->timeout + 1)
173			continue;
174		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
175		free(token->params, M_CTL);
176		free(token, M_CTL);
177	}
178	mtx_unlock(&softc->tpc_lock);
179	callout_schedule(&softc->tpc_timeout, hz);
180}
181
182void
183ctl_tpc_init(struct ctl_softc *softc)
184{
185
186	mtx_init(&softc->tpc_lock, "CTL TPC mutex", NULL, MTX_DEF);
187	TAILQ_INIT(&softc->tpc_tokens);
188	callout_init_mtx(&softc->tpc_timeout, &softc->ctl_lock, 0);
189	callout_reset(&softc->tpc_timeout, hz, tpc_timeout, softc);
190}
191
192void
193ctl_tpc_shutdown(struct ctl_softc *softc)
194{
195	struct tpc_token *token;
196
197	callout_drain(&softc->tpc_timeout);
198
199	/* Free ROD tokens. */
200	mtx_lock(&softc->tpc_lock);
201	while ((token = TAILQ_FIRST(&softc->tpc_tokens)) != NULL) {
202		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
203		free(token->params, M_CTL);
204		free(token, M_CTL);
205	}
206	mtx_unlock(&softc->tpc_lock);
207	mtx_destroy(&softc->tpc_lock);
208}
209
210void
211ctl_tpc_lun_init(struct ctl_lun *lun)
212{
213
214	TAILQ_INIT(&lun->tpc_lists);
215}
216
217void
218ctl_tpc_lun_shutdown(struct ctl_lun *lun)
219{
220	struct ctl_softc *softc = lun->ctl_softc;
221	struct tpc_list *list;
222	struct tpc_token *token, *ttoken;
223
224	/* Free lists for this LUN. */
225	while ((list = TAILQ_FIRST(&lun->tpc_lists)) != NULL) {
226		TAILQ_REMOVE(&lun->tpc_lists, list, links);
227		KASSERT(list->completed,
228		    ("Not completed TPC (%p) on shutdown", list));
229		free(list, M_CTL);
230	}
231
232	/* Free ROD tokens for this LUN. */
233	mtx_lock(&softc->tpc_lock);
234	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
235		if (token->lun != lun->lun || token->active)
236			continue;
237		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
238		free(token->params, M_CTL);
239		free(token, M_CTL);
240	}
241	mtx_unlock(&softc->tpc_lock);
242}
243
244int
245ctl_inquiry_evpd_tpc(struct ctl_scsiio *ctsio, int alloc_len)
246{
247	struct scsi_vpd_tpc *tpc_ptr;
248	struct scsi_vpd_tpc_descriptor *d_ptr;
249	struct scsi_vpd_tpc_descriptor_bdrl *bdrl_ptr;
250	struct scsi_vpd_tpc_descriptor_sc *sc_ptr;
251	struct scsi_vpd_tpc_descriptor_sc_descr *scd_ptr;
252	struct scsi_vpd_tpc_descriptor_pd *pd_ptr;
253	struct scsi_vpd_tpc_descriptor_sd *sd_ptr;
254	struct scsi_vpd_tpc_descriptor_sdid *sdid_ptr;
255	struct scsi_vpd_tpc_descriptor_rtf *rtf_ptr;
256	struct scsi_vpd_tpc_descriptor_rtf_block *rtfb_ptr;
257	struct scsi_vpd_tpc_descriptor_srt *srt_ptr;
258	struct scsi_vpd_tpc_descriptor_srtd *srtd_ptr;
259	struct scsi_vpd_tpc_descriptor_gco *gco_ptr;
260	struct ctl_lun *lun;
261	int data_len;
262
263	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
264
265	data_len = sizeof(struct scsi_vpd_tpc) +
266	    sizeof(struct scsi_vpd_tpc_descriptor_bdrl) +
267	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sc) +
268	     2 * sizeof(struct scsi_vpd_tpc_descriptor_sc_descr) + 11, 4) +
269	    sizeof(struct scsi_vpd_tpc_descriptor_pd) +
270	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sd) + 4, 4) +
271	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sdid) + 2, 4) +
272	    sizeof(struct scsi_vpd_tpc_descriptor_rtf) +
273	     sizeof(struct scsi_vpd_tpc_descriptor_rtf_block) +
274	    sizeof(struct scsi_vpd_tpc_descriptor_srt) +
275	     2*sizeof(struct scsi_vpd_tpc_descriptor_srtd) +
276	    sizeof(struct scsi_vpd_tpc_descriptor_gco);
277
278	ctsio->kern_data_ptr = malloc(data_len, M_CTL, M_WAITOK | M_ZERO);
279	tpc_ptr = (struct scsi_vpd_tpc *)ctsio->kern_data_ptr;
280	ctsio->kern_sg_entries = 0;
281
282	if (data_len < alloc_len) {
283		ctsio->residual = alloc_len - data_len;
284		ctsio->kern_data_len = data_len;
285		ctsio->kern_total_len = data_len;
286	} else {
287		ctsio->residual = 0;
288		ctsio->kern_data_len = alloc_len;
289		ctsio->kern_total_len = alloc_len;
290	}
291	ctsio->kern_data_resid = 0;
292	ctsio->kern_rel_offset = 0;
293	ctsio->kern_sg_entries = 0;
294
295	/*
296	 * The control device is always connected.  The disk device, on the
297	 * other hand, may not be online all the time.
298	 */
299	if (lun != NULL)
300		tpc_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
301				     lun->be_lun->lun_type;
302	else
303		tpc_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
304	tpc_ptr->page_code = SVPD_SCSI_TPC;
305	scsi_ulto2b(data_len - 4, tpc_ptr->page_length);
306
307	/* Block Device ROD Limits */
308	d_ptr = (struct scsi_vpd_tpc_descriptor *)&tpc_ptr->descr[0];
309	bdrl_ptr = (struct scsi_vpd_tpc_descriptor_bdrl *)d_ptr;
310	scsi_ulto2b(SVPD_TPC_BDRL, bdrl_ptr->desc_type);
311	scsi_ulto2b(sizeof(*bdrl_ptr) - 4, bdrl_ptr->desc_length);
312	scsi_ulto2b(TPC_MAX_SEGS, bdrl_ptr->maximum_ranges);
313	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
314	    bdrl_ptr->maximum_inactivity_timeout);
315	scsi_ulto4b(TPC_DFL_TOKEN_TIMEOUT,
316	    bdrl_ptr->default_inactivity_timeout);
317	scsi_u64to8b(0, bdrl_ptr->maximum_token_transfer_size);
318	scsi_u64to8b(0, bdrl_ptr->optimal_transfer_count);
319
320	/* Supported commands */
321	d_ptr = (struct scsi_vpd_tpc_descriptor *)
322	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
323	sc_ptr = (struct scsi_vpd_tpc_descriptor_sc *)d_ptr;
324	scsi_ulto2b(SVPD_TPC_SC, sc_ptr->desc_type);
325	sc_ptr->list_length = 2 * sizeof(*scd_ptr) + 11;
326	scsi_ulto2b(roundup2(1 + sc_ptr->list_length, 4), sc_ptr->desc_length);
327	scd_ptr = &sc_ptr->descr[0];
328	scd_ptr->opcode = EXTENDED_COPY;
329	scd_ptr->sa_length = 5;
330	scd_ptr->supported_service_actions[0] = EC_EC_LID1;
331	scd_ptr->supported_service_actions[1] = EC_EC_LID4;
332	scd_ptr->supported_service_actions[2] = EC_PT;
333	scd_ptr->supported_service_actions[3] = EC_WUT;
334	scd_ptr->supported_service_actions[4] = EC_COA;
335	scd_ptr = (struct scsi_vpd_tpc_descriptor_sc_descr *)
336	    &scd_ptr->supported_service_actions[scd_ptr->sa_length];
337	scd_ptr->opcode = RECEIVE_COPY_STATUS;
338	scd_ptr->sa_length = 6;
339	scd_ptr->supported_service_actions[0] = RCS_RCS_LID1;
340	scd_ptr->supported_service_actions[1] = RCS_RCFD;
341	scd_ptr->supported_service_actions[2] = RCS_RCS_LID4;
342	scd_ptr->supported_service_actions[3] = RCS_RCOP;
343	scd_ptr->supported_service_actions[4] = RCS_RRTI;
344	scd_ptr->supported_service_actions[5] = RCS_RART;
345
346	/* Parameter data. */
347	d_ptr = (struct scsi_vpd_tpc_descriptor *)
348	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
349	pd_ptr = (struct scsi_vpd_tpc_descriptor_pd *)d_ptr;
350	scsi_ulto2b(SVPD_TPC_PD, pd_ptr->desc_type);
351	scsi_ulto2b(sizeof(*pd_ptr) - 4, pd_ptr->desc_length);
352	scsi_ulto2b(TPC_MAX_CSCDS, pd_ptr->maximum_cscd_descriptor_count);
353	scsi_ulto2b(TPC_MAX_SEGS, pd_ptr->maximum_segment_descriptor_count);
354	scsi_ulto4b(TPC_MAX_LIST, pd_ptr->maximum_descriptor_list_length);
355	scsi_ulto4b(TPC_MAX_INLINE, pd_ptr->maximum_inline_data_length);
356
357	/* Supported Descriptors */
358	d_ptr = (struct scsi_vpd_tpc_descriptor *)
359	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
360	sd_ptr = (struct scsi_vpd_tpc_descriptor_sd *)d_ptr;
361	scsi_ulto2b(SVPD_TPC_SD, sd_ptr->desc_type);
362	scsi_ulto2b(roundup2(sizeof(*sd_ptr) - 4 + 4, 4), sd_ptr->desc_length);
363	sd_ptr->list_length = 4;
364	sd_ptr->supported_descriptor_codes[0] = EC_SEG_B2B;
365	sd_ptr->supported_descriptor_codes[1] = EC_SEG_VERIFY;
366	sd_ptr->supported_descriptor_codes[2] = EC_SEG_REGISTER_KEY;
367	sd_ptr->supported_descriptor_codes[3] = EC_CSCD_ID;
368
369	/* Supported CSCD Descriptor IDs */
370	d_ptr = (struct scsi_vpd_tpc_descriptor *)
371	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
372	sdid_ptr = (struct scsi_vpd_tpc_descriptor_sdid *)d_ptr;
373	scsi_ulto2b(SVPD_TPC_SDID, sdid_ptr->desc_type);
374	scsi_ulto2b(roundup2(sizeof(*sdid_ptr) - 4 + 2, 4), sdid_ptr->desc_length);
375	scsi_ulto2b(2, sdid_ptr->list_length);
376	scsi_ulto2b(0xffff, &sdid_ptr->supported_descriptor_ids[0]);
377
378	/* ROD Token Features */
379	d_ptr = (struct scsi_vpd_tpc_descriptor *)
380	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
381	rtf_ptr = (struct scsi_vpd_tpc_descriptor_rtf *)d_ptr;
382	scsi_ulto2b(SVPD_TPC_RTF, rtf_ptr->desc_type);
383	scsi_ulto2b(sizeof(*rtf_ptr) - 4 + sizeof(*rtfb_ptr), rtf_ptr->desc_length);
384	rtf_ptr->remote_tokens = 0;
385	scsi_ulto4b(TPC_MIN_TOKEN_TIMEOUT, rtf_ptr->minimum_token_lifetime);
386	scsi_ulto4b(UINT32_MAX, rtf_ptr->maximum_token_lifetime);
387	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
388	    rtf_ptr->maximum_token_inactivity_timeout);
389	scsi_ulto2b(sizeof(*rtfb_ptr), rtf_ptr->type_specific_features_length);
390	rtfb_ptr = (struct scsi_vpd_tpc_descriptor_rtf_block *)
391	    &rtf_ptr->type_specific_features;
392	rtfb_ptr->type_format = SVPD_TPC_RTF_BLOCK;
393	scsi_ulto2b(sizeof(*rtfb_ptr) - 4, rtfb_ptr->desc_length);
394	scsi_ulto2b(0, rtfb_ptr->optimal_length_granularity);
395	scsi_u64to8b(0, rtfb_ptr->maximum_bytes);
396	scsi_u64to8b(0, rtfb_ptr->optimal_bytes);
397	scsi_u64to8b(UINT64_MAX, rtfb_ptr->optimal_bytes_to_token_per_segment);
398	scsi_u64to8b(TPC_MAX_IOCHUNK_SIZE,
399	    rtfb_ptr->optimal_bytes_from_token_per_segment);
400
401	/* Supported ROD Tokens */
402	d_ptr = (struct scsi_vpd_tpc_descriptor *)
403	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
404	srt_ptr = (struct scsi_vpd_tpc_descriptor_srt *)d_ptr;
405	scsi_ulto2b(SVPD_TPC_SRT, srt_ptr->desc_type);
406	scsi_ulto2b(sizeof(*srt_ptr) - 4 + 2*sizeof(*srtd_ptr), srt_ptr->desc_length);
407	scsi_ulto2b(2*sizeof(*srtd_ptr), srt_ptr->rod_type_descriptors_length);
408	srtd_ptr = (struct scsi_vpd_tpc_descriptor_srtd *)
409	    &srt_ptr->rod_type_descriptors;
410	scsi_ulto4b(ROD_TYPE_AUR, srtd_ptr->rod_type);
411	srtd_ptr->flags = SVPD_TPC_SRTD_TIN | SVPD_TPC_SRTD_TOUT;
412	scsi_ulto2b(0, srtd_ptr->preference_indicator);
413	srtd_ptr++;
414	scsi_ulto4b(ROD_TYPE_BLOCK_ZERO, srtd_ptr->rod_type);
415	srtd_ptr->flags = SVPD_TPC_SRTD_TIN;
416	scsi_ulto2b(0, srtd_ptr->preference_indicator);
417
418	/* General Copy Operations */
419	d_ptr = (struct scsi_vpd_tpc_descriptor *)
420	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
421	gco_ptr = (struct scsi_vpd_tpc_descriptor_gco *)d_ptr;
422	scsi_ulto2b(SVPD_TPC_GCO, gco_ptr->desc_type);
423	scsi_ulto2b(sizeof(*gco_ptr) - 4, gco_ptr->desc_length);
424	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->total_concurrent_copies);
425	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->maximum_identified_concurrent_copies);
426	scsi_ulto4b(TPC_MAX_SEG, gco_ptr->maximum_segment_length);
427	gco_ptr->data_segment_granularity = 0;
428	gco_ptr->inline_data_granularity = 0;
429
430	ctl_set_success(ctsio);
431	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
432	ctsio->be_move_done = ctl_config_move_done;
433	ctl_datamove((union ctl_io *)ctsio);
434
435	return (CTL_RETVAL_COMPLETE);
436}
437
438int
439ctl_receive_copy_operating_parameters(struct ctl_scsiio *ctsio)
440{
441	struct scsi_receive_copy_operating_parameters *cdb;
442	struct scsi_receive_copy_operating_parameters_data *data;
443	int retval;
444	int alloc_len, total_len;
445
446	CTL_DEBUG_PRINT(("ctl_report_supported_tmf\n"));
447
448	cdb = (struct scsi_receive_copy_operating_parameters *)ctsio->cdb;
449
450	retval = CTL_RETVAL_COMPLETE;
451
452	total_len = sizeof(*data) + 4;
453	alloc_len = scsi_4btoul(cdb->length);
454
455	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
456
457	ctsio->kern_sg_entries = 0;
458
459	if (total_len < alloc_len) {
460		ctsio->residual = alloc_len - total_len;
461		ctsio->kern_data_len = total_len;
462		ctsio->kern_total_len = total_len;
463	} else {
464		ctsio->residual = 0;
465		ctsio->kern_data_len = alloc_len;
466		ctsio->kern_total_len = alloc_len;
467	}
468	ctsio->kern_data_resid = 0;
469	ctsio->kern_rel_offset = 0;
470
471	data = (struct scsi_receive_copy_operating_parameters_data *)ctsio->kern_data_ptr;
472	scsi_ulto4b(sizeof(*data) - 4 + 4, data->length);
473	data->snlid = RCOP_SNLID;
474	scsi_ulto2b(TPC_MAX_CSCDS, data->maximum_cscd_descriptor_count);
475	scsi_ulto2b(TPC_MAX_SEGS, data->maximum_segment_descriptor_count);
476	scsi_ulto4b(TPC_MAX_LIST, data->maximum_descriptor_list_length);
477	scsi_ulto4b(TPC_MAX_SEG, data->maximum_segment_length);
478	scsi_ulto4b(TPC_MAX_INLINE, data->maximum_inline_data_length);
479	scsi_ulto4b(0, data->held_data_limit);
480	scsi_ulto4b(0, data->maximum_stream_device_transfer_size);
481	scsi_ulto2b(TPC_MAX_LISTS, data->total_concurrent_copies);
482	data->maximum_concurrent_copies = TPC_MAX_LISTS;
483	data->data_segment_granularity = 0;
484	data->inline_data_granularity = 0;
485	data->held_data_granularity = 0;
486	data->implemented_descriptor_list_length = 4;
487	data->list_of_implemented_descriptor_type_codes[0] = EC_SEG_B2B;
488	data->list_of_implemented_descriptor_type_codes[1] = EC_SEG_VERIFY;
489	data->list_of_implemented_descriptor_type_codes[2] = EC_SEG_REGISTER_KEY;
490	data->list_of_implemented_descriptor_type_codes[3] = EC_CSCD_ID;
491
492	ctl_set_success(ctsio);
493	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
494	ctsio->be_move_done = ctl_config_move_done;
495	ctl_datamove((union ctl_io *)ctsio);
496	return (retval);
497}
498
499static struct tpc_list *
500tpc_find_list(struct ctl_lun *lun, uint32_t list_id, uint32_t init_idx)
501{
502	struct tpc_list *list;
503
504	mtx_assert(&lun->lun_lock, MA_OWNED);
505	TAILQ_FOREACH(list, &lun->tpc_lists, links) {
506		if ((list->flags & EC_LIST_ID_USAGE_MASK) !=
507		     EC_LIST_ID_USAGE_NONE && list->list_id == list_id &&
508		    list->init_idx == init_idx)
509			break;
510	}
511	return (list);
512}
513
514int
515ctl_receive_copy_status_lid1(struct ctl_scsiio *ctsio)
516{
517	struct ctl_lun *lun;
518	struct scsi_receive_copy_status_lid1 *cdb;
519	struct scsi_receive_copy_status_lid1_data *data;
520	struct tpc_list *list;
521	struct tpc_list list_copy;
522	int retval;
523	int alloc_len, total_len;
524	uint32_t list_id;
525
526	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid1\n"));
527
528	cdb = (struct scsi_receive_copy_status_lid1 *)ctsio->cdb;
529	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
530
531	retval = CTL_RETVAL_COMPLETE;
532
533	list_id = cdb->list_identifier;
534	mtx_lock(&lun->lun_lock);
535	list = tpc_find_list(lun, list_id,
536	    ctl_get_initindex(&ctsio->io_hdr.nexus));
537	if (list == NULL) {
538		mtx_unlock(&lun->lun_lock);
539		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
540		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
541		    /*bit*/ 0);
542		ctl_done((union ctl_io *)ctsio);
543		return (retval);
544	}
545	list_copy = *list;
546	if (list->completed) {
547		TAILQ_REMOVE(&lun->tpc_lists, list, links);
548		free(list, M_CTL);
549	}
550	mtx_unlock(&lun->lun_lock);
551
552	total_len = sizeof(*data);
553	alloc_len = scsi_4btoul(cdb->length);
554
555	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
556
557	ctsio->kern_sg_entries = 0;
558
559	if (total_len < alloc_len) {
560		ctsio->residual = alloc_len - total_len;
561		ctsio->kern_data_len = total_len;
562		ctsio->kern_total_len = total_len;
563	} else {
564		ctsio->residual = 0;
565		ctsio->kern_data_len = alloc_len;
566		ctsio->kern_total_len = alloc_len;
567	}
568	ctsio->kern_data_resid = 0;
569	ctsio->kern_rel_offset = 0;
570
571	data = (struct scsi_receive_copy_status_lid1_data *)ctsio->kern_data_ptr;
572	scsi_ulto4b(sizeof(*data) - 4, data->available_data);
573	if (list_copy.completed) {
574		if (list_copy.error || list_copy.abort)
575			data->copy_command_status = RCS_CCS_ERROR;
576		else
577			data->copy_command_status = RCS_CCS_COMPLETED;
578	} else
579		data->copy_command_status = RCS_CCS_INPROG;
580	scsi_ulto2b(list_copy.curseg, data->segments_processed);
581	if (list_copy.curbytes <= UINT32_MAX) {
582		data->transfer_count_units = RCS_TC_BYTES;
583		scsi_ulto4b(list_copy.curbytes, data->transfer_count);
584	} else {
585		data->transfer_count_units = RCS_TC_MBYTES;
586		scsi_ulto4b(list_copy.curbytes >> 20, data->transfer_count);
587	}
588
589	ctl_set_success(ctsio);
590	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
591	ctsio->be_move_done = ctl_config_move_done;
592	ctl_datamove((union ctl_io *)ctsio);
593	return (retval);
594}
595
596int
597ctl_receive_copy_failure_details(struct ctl_scsiio *ctsio)
598{
599	struct ctl_lun *lun;
600	struct scsi_receive_copy_failure_details *cdb;
601	struct scsi_receive_copy_failure_details_data *data;
602	struct tpc_list *list;
603	struct tpc_list list_copy;
604	int retval;
605	int alloc_len, total_len;
606	uint32_t list_id;
607
608	CTL_DEBUG_PRINT(("ctl_receive_copy_failure_details\n"));
609
610	cdb = (struct scsi_receive_copy_failure_details *)ctsio->cdb;
611	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
612
613	retval = CTL_RETVAL_COMPLETE;
614
615	list_id = cdb->list_identifier;
616	mtx_lock(&lun->lun_lock);
617	list = tpc_find_list(lun, list_id,
618	    ctl_get_initindex(&ctsio->io_hdr.nexus));
619	if (list == NULL || !list->completed) {
620		mtx_unlock(&lun->lun_lock);
621		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
622		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
623		    /*bit*/ 0);
624		ctl_done((union ctl_io *)ctsio);
625		return (retval);
626	}
627	list_copy = *list;
628	TAILQ_REMOVE(&lun->tpc_lists, list, links);
629	free(list, M_CTL);
630	mtx_unlock(&lun->lun_lock);
631
632	total_len = sizeof(*data) + list_copy.sense_len;
633	alloc_len = scsi_4btoul(cdb->length);
634
635	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
636
637	ctsio->kern_sg_entries = 0;
638
639	if (total_len < alloc_len) {
640		ctsio->residual = alloc_len - total_len;
641		ctsio->kern_data_len = total_len;
642		ctsio->kern_total_len = total_len;
643	} else {
644		ctsio->residual = 0;
645		ctsio->kern_data_len = alloc_len;
646		ctsio->kern_total_len = alloc_len;
647	}
648	ctsio->kern_data_resid = 0;
649	ctsio->kern_rel_offset = 0;
650
651	data = (struct scsi_receive_copy_failure_details_data *)ctsio->kern_data_ptr;
652	if (list_copy.completed && (list_copy.error || list_copy.abort)) {
653		scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
654		    data->available_data);
655		data->copy_command_status = RCS_CCS_ERROR;
656	} else
657		scsi_ulto4b(0, data->available_data);
658	scsi_ulto2b(list_copy.sense_len, data->sense_data_length);
659	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
660
661	ctl_set_success(ctsio);
662	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
663	ctsio->be_move_done = ctl_config_move_done;
664	ctl_datamove((union ctl_io *)ctsio);
665	return (retval);
666}
667
668int
669ctl_receive_copy_status_lid4(struct ctl_scsiio *ctsio)
670{
671	struct ctl_lun *lun;
672	struct scsi_receive_copy_status_lid4 *cdb;
673	struct scsi_receive_copy_status_lid4_data *data;
674	struct tpc_list *list;
675	struct tpc_list list_copy;
676	int retval;
677	int alloc_len, total_len;
678	uint32_t list_id;
679
680	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid4\n"));
681
682	cdb = (struct scsi_receive_copy_status_lid4 *)ctsio->cdb;
683	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
684
685	retval = CTL_RETVAL_COMPLETE;
686
687	list_id = scsi_4btoul(cdb->list_identifier);
688	mtx_lock(&lun->lun_lock);
689	list = tpc_find_list(lun, list_id,
690	    ctl_get_initindex(&ctsio->io_hdr.nexus));
691	if (list == NULL) {
692		mtx_unlock(&lun->lun_lock);
693		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
694		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
695		    /*bit*/ 0);
696		ctl_done((union ctl_io *)ctsio);
697		return (retval);
698	}
699	list_copy = *list;
700	if (list->completed) {
701		TAILQ_REMOVE(&lun->tpc_lists, list, links);
702		free(list, M_CTL);
703	}
704	mtx_unlock(&lun->lun_lock);
705
706	total_len = sizeof(*data) + list_copy.sense_len;
707	alloc_len = scsi_4btoul(cdb->length);
708
709	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
710
711	ctsio->kern_sg_entries = 0;
712
713	if (total_len < alloc_len) {
714		ctsio->residual = alloc_len - total_len;
715		ctsio->kern_data_len = total_len;
716		ctsio->kern_total_len = total_len;
717	} else {
718		ctsio->residual = 0;
719		ctsio->kern_data_len = alloc_len;
720		ctsio->kern_total_len = alloc_len;
721	}
722	ctsio->kern_data_resid = 0;
723	ctsio->kern_rel_offset = 0;
724
725	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
726	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
727	    data->available_data);
728	data->response_to_service_action = list_copy.service_action;
729	if (list_copy.completed) {
730		if (list_copy.error)
731			data->copy_command_status = RCS_CCS_ERROR;
732		else if (list_copy.abort)
733			data->copy_command_status = RCS_CCS_ABORTED;
734		else
735			data->copy_command_status = RCS_CCS_COMPLETED;
736	} else
737		data->copy_command_status = RCS_CCS_INPROG_FG;
738	scsi_ulto2b(list_copy.curops, data->operation_counter);
739	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
740	data->transfer_count_units = RCS_TC_BYTES;
741	scsi_u64to8b(list_copy.curbytes, data->transfer_count);
742	scsi_ulto2b(list_copy.curseg, data->segments_processed);
743	data->length_of_the_sense_data_field = list_copy.sense_len;
744	data->sense_data_length = list_copy.sense_len;
745	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
746
747	ctl_set_success(ctsio);
748	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
749	ctsio->be_move_done = ctl_config_move_done;
750	ctl_datamove((union ctl_io *)ctsio);
751	return (retval);
752}
753
754int
755ctl_copy_operation_abort(struct ctl_scsiio *ctsio)
756{
757	struct ctl_lun *lun;
758	struct scsi_copy_operation_abort *cdb;
759	struct tpc_list *list;
760	int retval;
761	uint32_t list_id;
762
763	CTL_DEBUG_PRINT(("ctl_copy_operation_abort\n"));
764
765	cdb = (struct scsi_copy_operation_abort *)ctsio->cdb;
766	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
767
768	retval = CTL_RETVAL_COMPLETE;
769
770	list_id = scsi_4btoul(cdb->list_identifier);
771	mtx_lock(&lun->lun_lock);
772	list = tpc_find_list(lun, list_id,
773	    ctl_get_initindex(&ctsio->io_hdr.nexus));
774	if (list == NULL) {
775		mtx_unlock(&lun->lun_lock);
776		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
777		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
778		    /*bit*/ 0);
779		ctl_done((union ctl_io *)ctsio);
780		return (retval);
781	}
782	list->abort = 1;
783	mtx_unlock(&lun->lun_lock);
784
785	ctl_set_success(ctsio);
786	ctl_done((union ctl_io *)ctsio);
787	return (retval);
788}
789
790static uint64_t
791tpc_resolve(struct tpc_list *list, uint16_t idx, uint32_t *ss,
792    uint32_t *pb, uint32_t *pbo)
793{
794
795	if (idx == 0xffff) {
796		if (ss && list->lun->be_lun)
797			*ss = list->lun->be_lun->blocksize;
798		if (pb && list->lun->be_lun)
799			*pb = list->lun->be_lun->blocksize <<
800			    list->lun->be_lun->pblockexp;
801		if (pbo && list->lun->be_lun)
802			*pbo = list->lun->be_lun->blocksize *
803			    list->lun->be_lun->pblockoff;
804		return (list->lun->lun);
805	}
806	if (idx >= list->ncscd)
807		return (UINT64_MAX);
808	return (tpcl_resolve(list->lun->ctl_softc,
809	    list->init_port, &list->cscd[idx], ss, pb, pbo));
810}
811
812static int
813tpc_process_b2b(struct tpc_list *list)
814{
815	struct scsi_ec_segment_b2b *seg;
816	struct scsi_ec_cscd_dtsp *sdstp, *ddstp;
817	struct tpc_io *tior, *tiow;
818	struct runl run;
819	uint64_t sl, dl;
820	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
821	int numlba;
822	uint32_t srcblock, dstblock, pb, pbo, adj;
823	uint8_t csi[4];
824
825	scsi_ulto4b(list->curseg, csi);
826	if (list->stage == 1) {
827		while ((tior = TAILQ_FIRST(&list->allio)) != NULL) {
828			TAILQ_REMOVE(&list->allio, tior, links);
829			ctl_free_io(tior->io);
830			free(tior, M_CTL);
831		}
832		free(list->buf, M_CTL);
833		if (list->abort) {
834			ctl_set_task_aborted(list->ctsio);
835			return (CTL_RETVAL_ERROR);
836		} else if (list->error) {
837			ctl_set_sense(list->ctsio, /*current_error*/ 1,
838			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
839			    /*asc*/ 0x0d, /*ascq*/ 0x01,
840			    SSD_ELEM_COMMAND, sizeof(csi), csi,
841			    SSD_ELEM_NONE);
842			return (CTL_RETVAL_ERROR);
843		}
844		list->cursectors += list->segsectors;
845		list->curbytes += list->segbytes;
846		return (CTL_RETVAL_COMPLETE);
847	}
848
849	TAILQ_INIT(&list->allio);
850	seg = (struct scsi_ec_segment_b2b *)list->seg[list->curseg];
851	sl = tpc_resolve(list, scsi_2btoul(seg->src_cscd), &srcblock, NULL, NULL);
852	dl = tpc_resolve(list, scsi_2btoul(seg->dst_cscd), &dstblock, &pb, &pbo);
853	if (sl >= CTL_MAX_LUNS || dl >= CTL_MAX_LUNS) {
854		ctl_set_sense(list->ctsio, /*current_error*/ 1,
855		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
856		    /*asc*/ 0x08, /*ascq*/ 0x04,
857		    SSD_ELEM_COMMAND, sizeof(csi), csi,
858		    SSD_ELEM_NONE);
859		return (CTL_RETVAL_ERROR);
860	}
861	if (pbo > 0)
862		pbo = pb - pbo;
863	sdstp = &list->cscd[scsi_2btoul(seg->src_cscd)].dtsp;
864	if (scsi_3btoul(sdstp->block_length) != 0)
865		srcblock = scsi_3btoul(sdstp->block_length);
866	ddstp = &list->cscd[scsi_2btoul(seg->dst_cscd)].dtsp;
867	if (scsi_3btoul(ddstp->block_length) != 0)
868		dstblock = scsi_3btoul(ddstp->block_length);
869	numlba = scsi_2btoul(seg->number_of_blocks);
870	if (seg->flags & EC_SEG_DC)
871		numbytes = (off_t)numlba * dstblock;
872	else
873		numbytes = (off_t)numlba * srcblock;
874	srclba = scsi_8btou64(seg->src_lba);
875	dstlba = scsi_8btou64(seg->dst_lba);
876
877//	printf("Copy %ju bytes from %ju @ %ju to %ju @ %ju\n",
878//	    (uintmax_t)numbytes, sl, scsi_8btou64(seg->src_lba),
879//	    dl, scsi_8btou64(seg->dst_lba));
880
881	if (numbytes == 0)
882		return (CTL_RETVAL_COMPLETE);
883
884	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
885		ctl_set_sense(list->ctsio, /*current_error*/ 1,
886		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
887		    /*asc*/ 0x26, /*ascq*/ 0x0A,
888		    SSD_ELEM_COMMAND, sizeof(csi), csi,
889		    SSD_ELEM_NONE);
890		return (CTL_RETVAL_ERROR);
891	}
892
893	list->buf = malloc(numbytes, M_CTL, M_WAITOK);
894	list->segbytes = numbytes;
895	list->segsectors = numbytes / dstblock;
896	donebytes = 0;
897	TAILQ_INIT(&run);
898	list->tbdio = 0;
899	while (donebytes < numbytes) {
900		roundbytes = numbytes - donebytes;
901		if (roundbytes > TPC_MAX_IO_SIZE) {
902			roundbytes = TPC_MAX_IO_SIZE;
903			roundbytes -= roundbytes % dstblock;
904			if (pb > dstblock) {
905				adj = (dstlba * dstblock + roundbytes - pbo) % pb;
906				if (roundbytes > adj)
907					roundbytes -= adj;
908			}
909		}
910
911		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
912		TAILQ_INIT(&tior->run);
913		tior->list = list;
914		TAILQ_INSERT_TAIL(&list->allio, tior, links);
915		tior->io = tpcl_alloc_io();
916		ctl_scsi_read_write(tior->io,
917				    /*data_ptr*/ &list->buf[donebytes],
918				    /*data_len*/ roundbytes,
919				    /*read_op*/ 1,
920				    /*byte2*/ 0,
921				    /*minimum_cdb_size*/ 0,
922				    /*lba*/ srclba,
923				    /*num_blocks*/ roundbytes / srcblock,
924				    /*tag_type*/ CTL_TAG_SIMPLE,
925				    /*control*/ 0);
926		tior->io->io_hdr.retries = 3;
927		tior->lun = sl;
928		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
929
930		tiow = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
931		TAILQ_INIT(&tiow->run);
932		tiow->list = list;
933		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
934		tiow->io = tpcl_alloc_io();
935		ctl_scsi_read_write(tiow->io,
936				    /*data_ptr*/ &list->buf[donebytes],
937				    /*data_len*/ roundbytes,
938				    /*read_op*/ 0,
939				    /*byte2*/ 0,
940				    /*minimum_cdb_size*/ 0,
941				    /*lba*/ dstlba,
942				    /*num_blocks*/ roundbytes / dstblock,
943				    /*tag_type*/ CTL_TAG_SIMPLE,
944				    /*control*/ 0);
945		tiow->io->io_hdr.retries = 3;
946		tiow->lun = dl;
947		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
948
949		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
950		TAILQ_INSERT_TAIL(&run, tior, rlinks);
951		list->tbdio++;
952		donebytes += roundbytes;
953		srclba += roundbytes / srcblock;
954		dstlba += roundbytes / dstblock;
955	}
956
957	while ((tior = TAILQ_FIRST(&run)) != NULL) {
958		TAILQ_REMOVE(&run, tior, rlinks);
959		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
960			panic("tpcl_queue() error");
961	}
962
963	list->stage++;
964	return (CTL_RETVAL_QUEUED);
965}
966
967static int
968tpc_process_verify(struct tpc_list *list)
969{
970	struct scsi_ec_segment_verify *seg;
971	struct tpc_io *tio;
972	uint64_t sl;
973	uint8_t csi[4];
974
975	scsi_ulto4b(list->curseg, csi);
976	if (list->stage == 1) {
977		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
978			TAILQ_REMOVE(&list->allio, tio, links);
979			ctl_free_io(tio->io);
980			free(tio, M_CTL);
981		}
982		if (list->abort) {
983			ctl_set_task_aborted(list->ctsio);
984			return (CTL_RETVAL_ERROR);
985		} else if (list->error) {
986			ctl_set_sense(list->ctsio, /*current_error*/ 1,
987			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
988			    /*asc*/ 0x0d, /*ascq*/ 0x01,
989			    SSD_ELEM_COMMAND, sizeof(csi), csi,
990			    SSD_ELEM_NONE);
991			return (CTL_RETVAL_ERROR);
992		} else
993			return (CTL_RETVAL_COMPLETE);
994	}
995
996	TAILQ_INIT(&list->allio);
997	seg = (struct scsi_ec_segment_verify *)list->seg[list->curseg];
998	sl = tpc_resolve(list, scsi_2btoul(seg->src_cscd), NULL, NULL, NULL);
999	if (sl >= CTL_MAX_LUNS) {
1000		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1001		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1002		    /*asc*/ 0x08, /*ascq*/ 0x04,
1003		    SSD_ELEM_COMMAND, sizeof(csi), csi,
1004		    SSD_ELEM_NONE);
1005		return (CTL_RETVAL_ERROR);
1006	}
1007
1008//	printf("Verify %ju\n", sl);
1009
1010	if ((seg->tur & 0x01) == 0)
1011		return (CTL_RETVAL_COMPLETE);
1012
1013	list->tbdio = 1;
1014	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1015	TAILQ_INIT(&tio->run);
1016	tio->list = list;
1017	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1018	tio->io = tpcl_alloc_io();
1019	ctl_scsi_tur(tio->io, /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1020	tio->io->io_hdr.retries = 3;
1021	tio->lun = sl;
1022	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1023	list->stage++;
1024	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1025		panic("tpcl_queue() error");
1026	return (CTL_RETVAL_QUEUED);
1027}
1028
1029static int
1030tpc_process_register_key(struct tpc_list *list)
1031{
1032	struct scsi_ec_segment_register_key *seg;
1033	struct tpc_io *tio;
1034	uint64_t dl;
1035	int datalen;
1036	uint8_t csi[4];
1037
1038	scsi_ulto4b(list->curseg, csi);
1039	if (list->stage == 1) {
1040		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1041			TAILQ_REMOVE(&list->allio, tio, links);
1042			ctl_free_io(tio->io);
1043			free(tio, M_CTL);
1044		}
1045		free(list->buf, M_CTL);
1046		if (list->abort) {
1047			ctl_set_task_aborted(list->ctsio);
1048			return (CTL_RETVAL_ERROR);
1049		} else if (list->error) {
1050			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1051			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1052			    /*asc*/ 0x0d, /*ascq*/ 0x01,
1053			    SSD_ELEM_COMMAND, sizeof(csi), csi,
1054			    SSD_ELEM_NONE);
1055			return (CTL_RETVAL_ERROR);
1056		} else
1057			return (CTL_RETVAL_COMPLETE);
1058	}
1059
1060	TAILQ_INIT(&list->allio);
1061	seg = (struct scsi_ec_segment_register_key *)list->seg[list->curseg];
1062	dl = tpc_resolve(list, scsi_2btoul(seg->dst_cscd), NULL, NULL, NULL);
1063	if (dl >= CTL_MAX_LUNS) {
1064		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1065		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1066		    /*asc*/ 0x08, /*ascq*/ 0x04,
1067		    SSD_ELEM_COMMAND, sizeof(csi), csi,
1068		    SSD_ELEM_NONE);
1069		return (CTL_RETVAL_ERROR);
1070	}
1071
1072//	printf("Register Key %ju\n", dl);
1073
1074	list->tbdio = 1;
1075	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1076	TAILQ_INIT(&tio->run);
1077	tio->list = list;
1078	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1079	tio->io = tpcl_alloc_io();
1080	datalen = sizeof(struct scsi_per_res_out_parms);
1081	list->buf = malloc(datalen, M_CTL, M_WAITOK);
1082	ctl_scsi_persistent_res_out(tio->io,
1083	    list->buf, datalen, SPRO_REGISTER, -1,
1084	    scsi_8btou64(seg->res_key), scsi_8btou64(seg->sa_res_key),
1085	    /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1086	tio->io->io_hdr.retries = 3;
1087	tio->lun = dl;
1088	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1089	list->stage++;
1090	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1091		panic("tpcl_queue() error");
1092	return (CTL_RETVAL_QUEUED);
1093}
1094
1095static off_t
1096tpc_ranges_length(struct scsi_range_desc *range, int nrange)
1097{
1098	off_t length = 0;
1099	int r;
1100
1101	for (r = 0; r < nrange; r++)
1102		length += scsi_4btoul(range[r].length);
1103	return (length);
1104}
1105
1106static int
1107tpc_check_ranges(struct scsi_range_desc *range, int nrange)
1108{
1109	uint64_t b1, b2;
1110	uint32_t l1, l2;
1111	int i, j;
1112
1113	for (i = 0; i < nrange - 1; i++) {
1114		b1 = scsi_8btou64(range[i].lba);
1115		l1 = scsi_4btoul(range[i].length);
1116		for (j = i + 1; j < nrange; j++) {
1117			b2 = scsi_8btou64(range[j].lba);
1118			l2 = scsi_4btoul(range[j].length);
1119			if (b1 + l1 > b2 && b2 + l2 > b1)
1120				return (-1);
1121		}
1122	}
1123	return (0);
1124}
1125
1126static int
1127tpc_skip_ranges(struct scsi_range_desc *range, int nrange, off_t skip,
1128    int *srange, off_t *soffset)
1129{
1130	off_t off;
1131	int r;
1132
1133	r = 0;
1134	off = 0;
1135	while (r < nrange) {
1136		if (skip - off < scsi_4btoul(range[r].length)) {
1137			*srange = r;
1138			*soffset = skip - off;
1139			return (0);
1140		}
1141		off += scsi_4btoul(range[r].length);
1142		r++;
1143	}
1144	return (-1);
1145}
1146
1147static int
1148tpc_process_wut(struct tpc_list *list)
1149{
1150	struct tpc_io *tio, *tior, *tiow;
1151	struct runl run;
1152	int drange, srange;
1153	off_t doffset, soffset;
1154	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
1155	uint32_t srcblock, dstblock, pb, pbo, adj;
1156
1157	if (list->stage > 0) {
1158		/* Cleanup after previous rounds. */
1159		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1160			TAILQ_REMOVE(&list->allio, tio, links);
1161			ctl_free_io(tio->io);
1162			free(tio, M_CTL);
1163		}
1164		free(list->buf, M_CTL);
1165		if (list->abort) {
1166			ctl_set_task_aborted(list->ctsio);
1167			return (CTL_RETVAL_ERROR);
1168		} else if (list->error) {
1169			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1170			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1171			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
1172			return (CTL_RETVAL_ERROR);
1173		}
1174		list->cursectors += list->segsectors;
1175		list->curbytes += list->segbytes;
1176	}
1177
1178	/* Check where we are on destination ranges list. */
1179	if (tpc_skip_ranges(list->range, list->nrange, list->cursectors,
1180	    &drange, &doffset) != 0)
1181		return (CTL_RETVAL_COMPLETE);
1182	dstblock = list->lun->be_lun->blocksize;
1183	pb = dstblock << list->lun->be_lun->pblockexp;
1184	if (list->lun->be_lun->pblockoff > 0)
1185		pbo = pb - dstblock * list->lun->be_lun->pblockoff;
1186	else
1187		pbo = 0;
1188
1189	/* Check where we are on source ranges list. */
1190	srcblock = list->token->blocksize;
1191	if (tpc_skip_ranges(list->token->range, list->token->nrange,
1192	    list->offset_into_rod + list->cursectors * dstblock / srcblock,
1193	    &srange, &soffset) != 0) {
1194		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1195		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1196		    /*asc*/ 0x0d, /*ascq*/ 0x04, SSD_ELEM_NONE);
1197		return (CTL_RETVAL_ERROR);
1198	}
1199
1200	srclba = scsi_8btou64(list->token->range[srange].lba) + soffset;
1201	dstlba = scsi_8btou64(list->range[drange].lba) + doffset;
1202	numbytes = srcblock *
1203	    (scsi_4btoul(list->token->range[srange].length) - soffset);
1204	numbytes = omin(numbytes, dstblock *
1205	    (scsi_4btoul(list->range[drange].length) - doffset));
1206	if (numbytes > TPC_MAX_IOCHUNK_SIZE) {
1207		numbytes = TPC_MAX_IOCHUNK_SIZE;
1208		numbytes -= numbytes % dstblock;
1209		if (pb > dstblock) {
1210			adj = (dstlba * dstblock + numbytes - pbo) % pb;
1211			if (numbytes > adj)
1212				numbytes -= adj;
1213		}
1214	}
1215
1216	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
1217		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1218		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1219		    /*asc*/ 0x26, /*ascq*/ 0x0A, SSD_ELEM_NONE);
1220		return (CTL_RETVAL_ERROR);
1221	}
1222
1223	list->buf = malloc(numbytes, M_CTL, M_WAITOK |
1224	    (list->token == NULL ? M_ZERO : 0));
1225	list->segbytes = numbytes;
1226	list->segsectors = numbytes / dstblock;
1227//printf("Copy chunk of %ju sectors from %ju to %ju\n", list->segsectors,
1228//    srclba, dstlba);
1229	donebytes = 0;
1230	TAILQ_INIT(&run);
1231	list->tbdio = 0;
1232	TAILQ_INIT(&list->allio);
1233	while (donebytes < numbytes) {
1234		roundbytes = numbytes - donebytes;
1235		if (roundbytes > TPC_MAX_IO_SIZE) {
1236			roundbytes = TPC_MAX_IO_SIZE;
1237			roundbytes -= roundbytes % dstblock;
1238			if (pb > dstblock) {
1239				adj = (dstlba * dstblock + roundbytes - pbo) % pb;
1240				if (roundbytes > adj)
1241					roundbytes -= adj;
1242			}
1243		}
1244
1245		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
1246		TAILQ_INIT(&tior->run);
1247		tior->list = list;
1248		TAILQ_INSERT_TAIL(&list->allio, tior, links);
1249		tior->io = tpcl_alloc_io();
1250		ctl_scsi_read_write(tior->io,
1251				    /*data_ptr*/ &list->buf[donebytes],
1252				    /*data_len*/ roundbytes,
1253				    /*read_op*/ 1,
1254				    /*byte2*/ 0,
1255				    /*minimum_cdb_size*/ 0,
1256				    /*lba*/ srclba,
1257				    /*num_blocks*/ roundbytes / srcblock,
1258				    /*tag_type*/ CTL_TAG_SIMPLE,
1259				    /*control*/ 0);
1260		tior->io->io_hdr.retries = 3;
1261		tior->lun = list->token->lun;
1262		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
1263
1264		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1265		TAILQ_INIT(&tiow->run);
1266		tiow->list = list;
1267		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1268		tiow->io = tpcl_alloc_io();
1269		ctl_scsi_read_write(tiow->io,
1270				    /*data_ptr*/ &list->buf[donebytes],
1271				    /*data_len*/ roundbytes,
1272				    /*read_op*/ 0,
1273				    /*byte2*/ 0,
1274				    /*minimum_cdb_size*/ 0,
1275				    /*lba*/ dstlba,
1276				    /*num_blocks*/ roundbytes / dstblock,
1277				    /*tag_type*/ CTL_TAG_SIMPLE,
1278				    /*control*/ 0);
1279		tiow->io->io_hdr.retries = 3;
1280		tiow->lun = list->lun->lun;
1281		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1282
1283		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
1284		TAILQ_INSERT_TAIL(&run, tior, rlinks);
1285		list->tbdio++;
1286		donebytes += roundbytes;
1287		srclba += roundbytes / srcblock;
1288		dstlba += roundbytes / dstblock;
1289	}
1290
1291	while ((tior = TAILQ_FIRST(&run)) != NULL) {
1292		TAILQ_REMOVE(&run, tior, rlinks);
1293		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1294			panic("tpcl_queue() error");
1295	}
1296
1297	list->stage++;
1298	return (CTL_RETVAL_QUEUED);
1299}
1300
1301static int
1302tpc_process_zero_wut(struct tpc_list *list)
1303{
1304	struct tpc_io *tio, *tiow;
1305	struct runl run, *prun;
1306	int r;
1307	uint32_t dstblock, len;
1308
1309	if (list->stage > 0) {
1310complete:
1311		/* Cleanup after previous rounds. */
1312		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1313			TAILQ_REMOVE(&list->allio, tio, links);
1314			ctl_free_io(tio->io);
1315			free(tio, M_CTL);
1316		}
1317		if (list->abort) {
1318			ctl_set_task_aborted(list->ctsio);
1319			return (CTL_RETVAL_ERROR);
1320		} else if (list->error) {
1321			ctl_set_sense(list->ctsio, /*current_error*/ 1,
1322			    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1323			    /*asc*/ 0x0d, /*ascq*/ 0x01, SSD_ELEM_NONE);
1324			return (CTL_RETVAL_ERROR);
1325		}
1326		list->cursectors += list->segsectors;
1327		list->curbytes += list->segbytes;
1328		return (CTL_RETVAL_COMPLETE);
1329	}
1330
1331	dstblock = list->lun->be_lun->blocksize;
1332	TAILQ_INIT(&run);
1333	prun = &run;
1334	list->tbdio = 1;
1335	TAILQ_INIT(&list->allio);
1336	list->segsectors = 0;
1337	for (r = 0; r < list->nrange; r++) {
1338		len = scsi_4btoul(list->range[r].length);
1339		if (len == 0)
1340			continue;
1341
1342		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1343		TAILQ_INIT(&tiow->run);
1344		tiow->list = list;
1345		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1346		tiow->io = tpcl_alloc_io();
1347		ctl_scsi_write_same(tiow->io,
1348				    /*data_ptr*/ NULL,
1349				    /*data_len*/ 0,
1350				    /*byte2*/ SWS_NDOB,
1351				    /*lba*/ scsi_8btou64(list->range[r].lba),
1352				    /*num_blocks*/ len,
1353				    /*tag_type*/ CTL_TAG_SIMPLE,
1354				    /*control*/ 0);
1355		tiow->io->io_hdr.retries = 3;
1356		tiow->lun = list->lun->lun;
1357		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1358
1359		TAILQ_INSERT_TAIL(prun, tiow, rlinks);
1360		prun = &tiow->run;
1361		list->segsectors += len;
1362	}
1363	list->segbytes = list->segsectors * dstblock;
1364
1365	if (TAILQ_EMPTY(&run))
1366		goto complete;
1367
1368	while ((tiow = TAILQ_FIRST(&run)) != NULL) {
1369		TAILQ_REMOVE(&run, tiow, rlinks);
1370		if (tpcl_queue(tiow->io, tiow->lun) != CTL_RETVAL_COMPLETE)
1371			panic("tpcl_queue() error");
1372	}
1373
1374	list->stage++;
1375	return (CTL_RETVAL_QUEUED);
1376}
1377
1378static void
1379tpc_process(struct tpc_list *list)
1380{
1381	struct ctl_lun *lun = list->lun;
1382	struct ctl_softc *softc = lun->ctl_softc;
1383	struct scsi_ec_segment *seg;
1384	struct ctl_scsiio *ctsio = list->ctsio;
1385	int retval = CTL_RETVAL_COMPLETE;
1386	uint8_t csi[4];
1387
1388	if (list->service_action == EC_WUT) {
1389		if (list->token != NULL)
1390			retval = tpc_process_wut(list);
1391		else
1392			retval = tpc_process_zero_wut(list);
1393		if (retval == CTL_RETVAL_QUEUED)
1394			return;
1395		if (retval == CTL_RETVAL_ERROR) {
1396			list->error = 1;
1397			goto done;
1398		}
1399	} else {
1400//printf("ZZZ %d cscd, %d segs\n", list->ncscd, list->nseg);
1401		while (list->curseg < list->nseg) {
1402			seg = list->seg[list->curseg];
1403			switch (seg->type_code) {
1404			case EC_SEG_B2B:
1405				retval = tpc_process_b2b(list);
1406				break;
1407			case EC_SEG_VERIFY:
1408				retval = tpc_process_verify(list);
1409				break;
1410			case EC_SEG_REGISTER_KEY:
1411				retval = tpc_process_register_key(list);
1412				break;
1413			default:
1414				scsi_ulto4b(list->curseg, csi);
1415				ctl_set_sense(ctsio, /*current_error*/ 1,
1416				    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1417				    /*asc*/ 0x26, /*ascq*/ 0x09,
1418				    SSD_ELEM_COMMAND, sizeof(csi), csi,
1419				    SSD_ELEM_NONE);
1420				goto done;
1421			}
1422			if (retval == CTL_RETVAL_QUEUED)
1423				return;
1424			if (retval == CTL_RETVAL_ERROR) {
1425				list->error = 1;
1426				goto done;
1427			}
1428			list->curseg++;
1429			list->stage = 0;
1430		}
1431	}
1432
1433	ctl_set_success(ctsio);
1434
1435done:
1436//printf("ZZZ done\n");
1437	free(list->params, M_CTL);
1438	list->params = NULL;
1439	if (list->token) {
1440		mtx_lock(&softc->tpc_lock);
1441		if (--list->token->active == 0)
1442			list->token->last_active = time_uptime;
1443		mtx_unlock(&softc->tpc_lock);
1444		list->token = NULL;
1445	}
1446	mtx_lock(&lun->lun_lock);
1447	if ((list->flags & EC_LIST_ID_USAGE_MASK) == EC_LIST_ID_USAGE_NONE) {
1448		TAILQ_REMOVE(&lun->tpc_lists, list, links);
1449		free(list, M_CTL);
1450	} else {
1451		list->completed = 1;
1452		list->last_active = time_uptime;
1453		list->sense_data = ctsio->sense_data;
1454		list->sense_len = ctsio->sense_len;
1455		list->scsi_status = ctsio->scsi_status;
1456	}
1457	mtx_unlock(&lun->lun_lock);
1458
1459	ctl_done((union ctl_io *)ctsio);
1460}
1461
1462/*
1463 * For any sort of check condition, busy, etc., we just retry.  We do not
1464 * decrement the retry count for unit attention type errors.  These are
1465 * normal, and we want to save the retry count for "real" errors.  Otherwise,
1466 * we could end up with situations where a command will succeed in some
1467 * situations and fail in others, depending on whether a unit attention is
1468 * pending.  Also, some of our error recovery actions, most notably the
1469 * LUN reset action, will cause a unit attention.
1470 *
1471 * We can add more detail here later if necessary.
1472 */
1473static tpc_error_action
1474tpc_checkcond_parse(union ctl_io *io)
1475{
1476	tpc_error_action error_action;
1477	int error_code, sense_key, asc, ascq;
1478
1479	/*
1480	 * Default to retrying the command.
1481	 */
1482	error_action = TPC_ERR_RETRY;
1483
1484	scsi_extract_sense_len(&io->scsiio.sense_data,
1485			       io->scsiio.sense_len,
1486			       &error_code,
1487			       &sense_key,
1488			       &asc,
1489			       &ascq,
1490			       /*show_errors*/ 1);
1491
1492	switch (error_code) {
1493	case SSD_DEFERRED_ERROR:
1494	case SSD_DESC_DEFERRED_ERROR:
1495		error_action |= TPC_ERR_NO_DECREMENT;
1496		break;
1497	case SSD_CURRENT_ERROR:
1498	case SSD_DESC_CURRENT_ERROR:
1499	default:
1500		switch (sense_key) {
1501		case SSD_KEY_UNIT_ATTENTION:
1502			error_action |= TPC_ERR_NO_DECREMENT;
1503			break;
1504		case SSD_KEY_HARDWARE_ERROR:
1505			/*
1506			 * This is our generic "something bad happened"
1507			 * error code.  It often isn't recoverable.
1508			 */
1509			if ((asc == 0x44) && (ascq == 0x00))
1510				error_action = TPC_ERR_FAIL;
1511			break;
1512		case SSD_KEY_NOT_READY:
1513			/*
1514			 * If the LUN is powered down, there likely isn't
1515			 * much point in retrying right now.
1516			 */
1517			if ((asc == 0x04) && (ascq == 0x02))
1518				error_action = TPC_ERR_FAIL;
1519			/*
1520			 * If the LUN is offline, there probably isn't much
1521			 * point in retrying, either.
1522			 */
1523			if ((asc == 0x04) && (ascq == 0x03))
1524				error_action = TPC_ERR_FAIL;
1525			break;
1526		}
1527	}
1528	return (error_action);
1529}
1530
1531static tpc_error_action
1532tpc_error_parse(union ctl_io *io)
1533{
1534	tpc_error_action error_action = TPC_ERR_RETRY;
1535
1536	switch (io->io_hdr.io_type) {
1537	case CTL_IO_SCSI:
1538		switch (io->io_hdr.status & CTL_STATUS_MASK) {
1539		case CTL_SCSI_ERROR:
1540			switch (io->scsiio.scsi_status) {
1541			case SCSI_STATUS_CHECK_COND:
1542				error_action = tpc_checkcond_parse(io);
1543				break;
1544			default:
1545				break;
1546			}
1547			break;
1548		default:
1549			break;
1550		}
1551		break;
1552	case CTL_IO_TASK:
1553		break;
1554	default:
1555		panic("%s: invalid ctl_io type %d\n", __func__,
1556		      io->io_hdr.io_type);
1557		break;
1558	}
1559	return (error_action);
1560}
1561
1562void
1563tpc_done(union ctl_io *io)
1564{
1565	struct tpc_io *tio, *tior;
1566
1567	/*
1568	 * Very minimal retry logic.  We basically retry if we got an error
1569	 * back, and the retry count is greater than 0.  If we ever want
1570	 * more sophisticated initiator type behavior, the CAM error
1571	 * recovery code in ../common might be helpful.
1572	 */
1573	tio = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1574	if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1575	 && (io->io_hdr.retries > 0)) {
1576		ctl_io_status old_status;
1577		tpc_error_action error_action;
1578
1579		error_action = tpc_error_parse(io);
1580		switch (error_action & TPC_ERR_MASK) {
1581		case TPC_ERR_FAIL:
1582			break;
1583		case TPC_ERR_RETRY:
1584		default:
1585			if ((error_action & TPC_ERR_NO_DECREMENT) == 0)
1586				io->io_hdr.retries--;
1587			old_status = io->io_hdr.status;
1588			io->io_hdr.status = CTL_STATUS_NONE;
1589			io->io_hdr.flags &= ~CTL_FLAG_ABORT;
1590			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
1591			if (tpcl_queue(io, tio->lun) != CTL_RETVAL_COMPLETE) {
1592				printf("%s: error returned from ctl_queue()!\n",
1593				       __func__);
1594				io->io_hdr.status = old_status;
1595			} else
1596				return;
1597		}
1598	}
1599
1600	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1601		tio->list->error = 1;
1602	else
1603		atomic_add_int(&tio->list->curops, 1);
1604	if (!tio->list->error && !tio->list->abort) {
1605		while ((tior = TAILQ_FIRST(&tio->run)) != NULL) {
1606			TAILQ_REMOVE(&tio->run, tior, rlinks);
1607			atomic_add_int(&tio->list->tbdio, 1);
1608			if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1609				panic("tpcl_queue() error");
1610		}
1611	}
1612	if (atomic_fetchadd_int(&tio->list->tbdio, -1) == 1)
1613		tpc_process(tio->list);
1614}
1615
1616int
1617ctl_extended_copy_lid1(struct ctl_scsiio *ctsio)
1618{
1619	struct scsi_extended_copy *cdb;
1620	struct scsi_extended_copy_lid1_data *data;
1621	struct ctl_lun *lun;
1622	struct tpc_list *list, *tlist;
1623	uint8_t *ptr;
1624	char *value;
1625	int len, off, lencscd, lenseg, leninl, nseg;
1626
1627	CTL_DEBUG_PRINT(("ctl_extended_copy_lid1\n"));
1628
1629	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1630	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1631	len = scsi_4btoul(cdb->length);
1632
1633	if (len == 0) {
1634		ctl_set_success(ctsio);
1635		goto done;
1636	}
1637	if (len < sizeof(struct scsi_extended_copy_lid1_data) ||
1638	    len > sizeof(struct scsi_extended_copy_lid1_data) +
1639	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1640		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1641		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1642		goto done;
1643	}
1644
1645	/*
1646	 * If we've got a kernel request that hasn't been malloced yet,
1647	 * malloc it and tell the caller the data buffer is here.
1648	 */
1649	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1650		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1651		ctsio->kern_data_len = len;
1652		ctsio->kern_total_len = len;
1653		ctsio->kern_data_resid = 0;
1654		ctsio->kern_rel_offset = 0;
1655		ctsio->kern_sg_entries = 0;
1656		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1657		ctsio->be_move_done = ctl_config_move_done;
1658		ctl_datamove((union ctl_io *)ctsio);
1659
1660		return (CTL_RETVAL_COMPLETE);
1661	}
1662
1663	data = (struct scsi_extended_copy_lid1_data *)ctsio->kern_data_ptr;
1664	lencscd = scsi_2btoul(data->cscd_list_length);
1665	lenseg = scsi_4btoul(data->segment_list_length);
1666	leninl = scsi_4btoul(data->inline_data_length);
1667	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1668		ctl_set_sense(ctsio, /*current_error*/ 1,
1669		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1670		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1671		goto done;
1672	}
1673	if (lenseg > TPC_MAX_SEGS * sizeof(struct scsi_ec_segment)) {
1674		ctl_set_sense(ctsio, /*current_error*/ 1,
1675		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1676		    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1677		goto done;
1678	}
1679	if (lencscd + lenseg > TPC_MAX_LIST ||
1680	    leninl > TPC_MAX_INLINE ||
1681	    len < sizeof(struct scsi_extended_copy_lid1_data) +
1682	     lencscd + lenseg + leninl) {
1683		ctl_set_param_len_error(ctsio);
1684		goto done;
1685	}
1686
1687	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1688	list->service_action = cdb->service_action;
1689	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1690	if (value != NULL && strcmp(value, "on") == 0)
1691		list->init_port = -1;
1692	else
1693		list->init_port = ctsio->io_hdr.nexus.targ_port;
1694	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
1695	list->list_id = data->list_identifier;
1696	list->flags = data->flags;
1697	list->params = ctsio->kern_data_ptr;
1698	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1699	ptr = &data->data[lencscd];
1700	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1701		if (nseg >= TPC_MAX_SEGS) {
1702			free(list, M_CTL);
1703			ctl_set_sense(ctsio, /*current_error*/ 1,
1704			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1705			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1706			goto done;
1707		}
1708		list->seg[nseg] = (struct scsi_ec_segment *)(ptr + off);
1709		off += sizeof(struct scsi_ec_segment) +
1710		    scsi_2btoul(list->seg[nseg]->descr_length);
1711	}
1712	list->inl = &data->data[lencscd + lenseg];
1713	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1714	list->nseg = nseg;
1715	list->leninl = leninl;
1716	list->ctsio = ctsio;
1717	list->lun = lun;
1718	mtx_lock(&lun->lun_lock);
1719	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1720		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1721		if (tlist != NULL && !tlist->completed) {
1722			mtx_unlock(&lun->lun_lock);
1723			free(list, M_CTL);
1724			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1725			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1726			    /*bit*/ 0);
1727			goto done;
1728		}
1729		if (tlist != NULL) {
1730			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1731			free(tlist, M_CTL);
1732		}
1733	}
1734	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1735	mtx_unlock(&lun->lun_lock);
1736
1737	tpc_process(list);
1738	return (CTL_RETVAL_COMPLETE);
1739
1740done:
1741	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
1742		free(ctsio->kern_data_ptr, M_CTL);
1743		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
1744	}
1745	ctl_done((union ctl_io *)ctsio);
1746	return (CTL_RETVAL_COMPLETE);
1747}
1748
1749int
1750ctl_extended_copy_lid4(struct ctl_scsiio *ctsio)
1751{
1752	struct scsi_extended_copy *cdb;
1753	struct scsi_extended_copy_lid4_data *data;
1754	struct ctl_lun *lun;
1755	struct tpc_list *list, *tlist;
1756	uint8_t *ptr;
1757	char *value;
1758	int len, off, lencscd, lenseg, leninl, nseg;
1759
1760	CTL_DEBUG_PRINT(("ctl_extended_copy_lid4\n"));
1761
1762	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1763	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1764	len = scsi_4btoul(cdb->length);
1765
1766	if (len == 0) {
1767		ctl_set_success(ctsio);
1768		goto done;
1769	}
1770	if (len < sizeof(struct scsi_extended_copy_lid4_data) ||
1771	    len > sizeof(struct scsi_extended_copy_lid4_data) +
1772	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1773		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1774		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1775		goto done;
1776	}
1777
1778	/*
1779	 * If we've got a kernel request that hasn't been malloced yet,
1780	 * malloc it and tell the caller the data buffer is here.
1781	 */
1782	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1783		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1784		ctsio->kern_data_len = len;
1785		ctsio->kern_total_len = len;
1786		ctsio->kern_data_resid = 0;
1787		ctsio->kern_rel_offset = 0;
1788		ctsio->kern_sg_entries = 0;
1789		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1790		ctsio->be_move_done = ctl_config_move_done;
1791		ctl_datamove((union ctl_io *)ctsio);
1792
1793		return (CTL_RETVAL_COMPLETE);
1794	}
1795
1796	data = (struct scsi_extended_copy_lid4_data *)ctsio->kern_data_ptr;
1797	lencscd = scsi_2btoul(data->cscd_list_length);
1798	lenseg = scsi_2btoul(data->segment_list_length);
1799	leninl = scsi_2btoul(data->inline_data_length);
1800	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1801		ctl_set_sense(ctsio, /*current_error*/ 1,
1802		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1803		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1804		goto done;
1805	}
1806	if (lenseg > TPC_MAX_SEGS * sizeof(struct scsi_ec_segment)) {
1807		ctl_set_sense(ctsio, /*current_error*/ 1,
1808		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1809		    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1810		goto done;
1811	}
1812	if (lencscd + lenseg > TPC_MAX_LIST ||
1813	    leninl > TPC_MAX_INLINE ||
1814	    len < sizeof(struct scsi_extended_copy_lid1_data) +
1815	     lencscd + lenseg + leninl) {
1816		ctl_set_param_len_error(ctsio);
1817		goto done;
1818	}
1819
1820	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1821	list->service_action = cdb->service_action;
1822	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1823	if (value != NULL && strcmp(value, "on") == 0)
1824		list->init_port = -1;
1825	else
1826		list->init_port = ctsio->io_hdr.nexus.targ_port;
1827	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
1828	list->list_id = scsi_4btoul(data->list_identifier);
1829	list->flags = data->flags;
1830	list->params = ctsio->kern_data_ptr;
1831	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1832	ptr = &data->data[lencscd];
1833	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1834		if (nseg >= TPC_MAX_SEGS) {
1835			free(list, M_CTL);
1836			ctl_set_sense(ctsio, /*current_error*/ 1,
1837			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1838			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1839			goto done;
1840		}
1841		list->seg[nseg] = (struct scsi_ec_segment *)(ptr + off);
1842		off += sizeof(struct scsi_ec_segment) +
1843		    scsi_2btoul(list->seg[nseg]->descr_length);
1844	}
1845	list->inl = &data->data[lencscd + lenseg];
1846	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1847	list->nseg = nseg;
1848	list->leninl = leninl;
1849	list->ctsio = ctsio;
1850	list->lun = lun;
1851	mtx_lock(&lun->lun_lock);
1852	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1853		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1854		if (tlist != NULL && !tlist->completed) {
1855			mtx_unlock(&lun->lun_lock);
1856			free(list, M_CTL);
1857			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1858			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1859			    /*bit*/ 0);
1860			goto done;
1861		}
1862		if (tlist != NULL) {
1863			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1864			free(tlist, M_CTL);
1865		}
1866	}
1867	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1868	mtx_unlock(&lun->lun_lock);
1869
1870	tpc_process(list);
1871	return (CTL_RETVAL_COMPLETE);
1872
1873done:
1874	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
1875		free(ctsio->kern_data_ptr, M_CTL);
1876		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
1877	}
1878	ctl_done((union ctl_io *)ctsio);
1879	return (CTL_RETVAL_COMPLETE);
1880}
1881
1882static void
1883tpc_create_token(struct ctl_lun *lun, struct ctl_port *port, off_t len,
1884    struct scsi_token *token)
1885{
1886	static int id = 0;
1887	struct scsi_vpd_id_descriptor *idd = NULL;
1888	struct scsi_ec_cscd_id *cscd;
1889	struct scsi_read_capacity_data_long *dtsd;
1890	int targid_len;
1891
1892	scsi_ulto4b(ROD_TYPE_AUR, token->type);
1893	scsi_ulto2b(0x01f8, token->length);
1894	scsi_u64to8b(atomic_fetchadd_int(&id, 1), &token->body[0]);
1895	if (lun->lun_devid)
1896		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
1897		    lun->lun_devid->data, lun->lun_devid->len,
1898		    scsi_devid_is_lun_naa);
1899	if (idd == NULL && lun->lun_devid)
1900		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
1901		    lun->lun_devid->data, lun->lun_devid->len,
1902		    scsi_devid_is_lun_eui64);
1903	if (idd != NULL) {
1904		cscd = (struct scsi_ec_cscd_id *)&token->body[8];
1905		cscd->type_code = EC_CSCD_ID;
1906		cscd->luidt_pdt = T_DIRECT;
1907		memcpy(&cscd->codeset, idd, 4 + idd->length);
1908		scsi_ulto3b(lun->be_lun->blocksize, cscd->dtsp.block_length);
1909	}
1910	scsi_u64to8b(0, &token->body[40]); /* XXX: Should be 128bit value. */
1911	scsi_u64to8b(len, &token->body[48]);
1912
1913	/* ROD token device type specific data (RC16 without first field) */
1914	dtsd = (struct scsi_read_capacity_data_long *)&token->body[88 - 8];
1915	scsi_ulto4b(lun->be_lun->blocksize, dtsd->length);
1916	dtsd->prot_lbppbe = lun->be_lun->pblockexp & SRC16_LBPPBE;
1917	scsi_ulto2b(lun->be_lun->pblockoff & SRC16_LALBA_A, dtsd->lalba_lbp);
1918	if (lun->be_lun->flags & CTL_LUN_FLAG_UNMAP)
1919		dtsd->lalba_lbp[0] |= SRC16_LBPME | SRC16_LBPRZ;
1920
1921	if (port->target_devid) {
1922		targid_len = port->target_devid->len;
1923		memcpy(&token->body[120], port->target_devid->data, targid_len);
1924	} else
1925		targid_len = 32;
1926	arc4rand(&token->body[120 + targid_len], 384 - targid_len, 0);
1927};
1928
1929int
1930ctl_populate_token(struct ctl_scsiio *ctsio)
1931{
1932	struct scsi_populate_token *cdb;
1933	struct scsi_populate_token_data *data;
1934	struct ctl_softc *softc;
1935	struct ctl_lun *lun;
1936	struct ctl_port *port;
1937	struct tpc_list *list, *tlist;
1938	struct tpc_token *token;
1939	int len, lendata, lendesc;
1940
1941	CTL_DEBUG_PRINT(("ctl_populate_token\n"));
1942
1943	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
1944	softc = lun->ctl_softc;
1945	port = softc->ctl_ports[ctsio->io_hdr.nexus.targ_port];
1946	cdb = (struct scsi_populate_token *)ctsio->cdb;
1947	len = scsi_4btoul(cdb->length);
1948
1949	if (len < sizeof(struct scsi_populate_token_data) ||
1950	    len > sizeof(struct scsi_populate_token_data) +
1951	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
1952		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1953		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1954		goto done;
1955	}
1956
1957	/*
1958	 * If we've got a kernel request that hasn't been malloced yet,
1959	 * malloc it and tell the caller the data buffer is here.
1960	 */
1961	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1962		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1963		ctsio->kern_data_len = len;
1964		ctsio->kern_total_len = len;
1965		ctsio->kern_data_resid = 0;
1966		ctsio->kern_rel_offset = 0;
1967		ctsio->kern_sg_entries = 0;
1968		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1969		ctsio->be_move_done = ctl_config_move_done;
1970		ctl_datamove((union ctl_io *)ctsio);
1971
1972		return (CTL_RETVAL_COMPLETE);
1973	}
1974
1975	data = (struct scsi_populate_token_data *)ctsio->kern_data_ptr;
1976	lendata = scsi_2btoul(data->length);
1977	if (lendata < sizeof(struct scsi_populate_token_data) - 2 +
1978	    sizeof(struct scsi_range_desc)) {
1979		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1980		    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1981		goto done;
1982	}
1983	lendesc = scsi_2btoul(data->range_descriptor_length);
1984	if (lendesc < sizeof(struct scsi_range_desc) ||
1985	    len < sizeof(struct scsi_populate_token_data) + lendesc ||
1986	    lendata < sizeof(struct scsi_populate_token_data) - 2 + lendesc) {
1987		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
1988		    /*field*/ 14, /*bit_valid*/ 0, /*bit*/ 0);
1989		goto done;
1990	}
1991/*
1992	printf("PT(list=%u) flags=%x to=%d rt=%x len=%x\n",
1993	    scsi_4btoul(cdb->list_identifier),
1994	    data->flags, scsi_4btoul(data->inactivity_timeout),
1995	    scsi_4btoul(data->rod_type),
1996	    scsi_2btoul(data->range_descriptor_length));
1997*/
1998
1999	/* Validate INACTIVITY TIMEOUT field */
2000	if (scsi_4btoul(data->inactivity_timeout) > TPC_MAX_TOKEN_TIMEOUT) {
2001		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2002		    /*command*/ 0, /*field*/ 4, /*bit_valid*/ 0,
2003		    /*bit*/ 0);
2004		goto done;
2005	}
2006
2007	/* Validate ROD TYPE field */
2008	if ((data->flags & EC_PT_RTV) &&
2009	    scsi_4btoul(data->rod_type) != ROD_TYPE_AUR) {
2010		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2011		    /*field*/ 8, /*bit_valid*/ 0, /*bit*/ 0);
2012		goto done;
2013	}
2014
2015	/* Validate list of ranges */
2016	if (tpc_check_ranges(&data->desc[0],
2017	    scsi_2btoul(data->range_descriptor_length) /
2018	    sizeof(struct scsi_range_desc))) {
2019		ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
2020		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2021		    /*bit*/ 0);
2022		goto done;
2023	}
2024
2025	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2026	list->service_action = cdb->service_action;
2027	list->init_port = ctsio->io_hdr.nexus.targ_port;
2028	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
2029	list->list_id = scsi_4btoul(cdb->list_identifier);
2030	list->flags = data->flags;
2031	list->ctsio = ctsio;
2032	list->lun = lun;
2033	mtx_lock(&lun->lun_lock);
2034	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2035	if (tlist != NULL && !tlist->completed) {
2036		mtx_unlock(&lun->lun_lock);
2037		free(list, M_CTL);
2038		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2039		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2040		    /*bit*/ 0);
2041		goto done;
2042	}
2043	if (tlist != NULL) {
2044		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2045		free(tlist, M_CTL);
2046	}
2047	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2048	mtx_unlock(&lun->lun_lock);
2049
2050	token = malloc(sizeof(*token), M_CTL, M_WAITOK | M_ZERO);
2051	token->lun = lun->lun;
2052	token->blocksize = lun->be_lun->blocksize;
2053	token->params = ctsio->kern_data_ptr;
2054	token->range = &data->desc[0];
2055	token->nrange = scsi_2btoul(data->range_descriptor_length) /
2056	    sizeof(struct scsi_range_desc);
2057	list->cursectors = tpc_ranges_length(token->range, token->nrange);
2058	list->curbytes = (off_t)list->cursectors * lun->be_lun->blocksize;
2059	tpc_create_token(lun, port, list->curbytes,
2060	    (struct scsi_token *)token->token);
2061	token->active = 0;
2062	token->last_active = time_uptime;
2063	token->timeout = scsi_4btoul(data->inactivity_timeout);
2064	if (token->timeout == 0)
2065		token->timeout = TPC_DFL_TOKEN_TIMEOUT;
2066	else if (token->timeout < TPC_MIN_TOKEN_TIMEOUT)
2067		token->timeout = TPC_MIN_TOKEN_TIMEOUT;
2068	memcpy(list->res_token, token->token, sizeof(list->res_token));
2069	list->res_token_valid = 1;
2070	list->curseg = 0;
2071	list->completed = 1;
2072	list->last_active = time_uptime;
2073	mtx_lock(&softc->tpc_lock);
2074	TAILQ_INSERT_TAIL(&softc->tpc_tokens, token, links);
2075	mtx_unlock(&softc->tpc_lock);
2076	ctl_set_success(ctsio);
2077	ctl_done((union ctl_io *)ctsio);
2078	return (CTL_RETVAL_COMPLETE);
2079
2080done:
2081	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
2082		free(ctsio->kern_data_ptr, M_CTL);
2083		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2084	}
2085	ctl_done((union ctl_io *)ctsio);
2086	return (CTL_RETVAL_COMPLETE);
2087}
2088
2089int
2090ctl_write_using_token(struct ctl_scsiio *ctsio)
2091{
2092	struct scsi_write_using_token *cdb;
2093	struct scsi_write_using_token_data *data;
2094	struct ctl_softc *softc;
2095	struct ctl_lun *lun;
2096	struct tpc_list *list, *tlist;
2097	struct tpc_token *token;
2098	int len, lendata, lendesc;
2099
2100	CTL_DEBUG_PRINT(("ctl_write_using_token\n"));
2101
2102	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2103	softc = lun->ctl_softc;
2104	cdb = (struct scsi_write_using_token *)ctsio->cdb;
2105	len = scsi_4btoul(cdb->length);
2106
2107	if (len < sizeof(struct scsi_write_using_token_data) ||
2108	    len > sizeof(struct scsi_write_using_token_data) +
2109	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
2110		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
2111		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
2112		goto done;
2113	}
2114
2115	/*
2116	 * If we've got a kernel request that hasn't been malloced yet,
2117	 * malloc it and tell the caller the data buffer is here.
2118	 */
2119	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2120		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2121		ctsio->kern_data_len = len;
2122		ctsio->kern_total_len = len;
2123		ctsio->kern_data_resid = 0;
2124		ctsio->kern_rel_offset = 0;
2125		ctsio->kern_sg_entries = 0;
2126		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2127		ctsio->be_move_done = ctl_config_move_done;
2128		ctl_datamove((union ctl_io *)ctsio);
2129
2130		return (CTL_RETVAL_COMPLETE);
2131	}
2132
2133	data = (struct scsi_write_using_token_data *)ctsio->kern_data_ptr;
2134	lendata = scsi_2btoul(data->length);
2135	if (lendata < sizeof(struct scsi_write_using_token_data) - 2 +
2136	    sizeof(struct scsi_range_desc)) {
2137		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2138		    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
2139		goto done;
2140	}
2141	lendesc = scsi_2btoul(data->range_descriptor_length);
2142	if (lendesc < sizeof(struct scsi_range_desc) ||
2143	    len < sizeof(struct scsi_write_using_token_data) + lendesc ||
2144	    lendata < sizeof(struct scsi_write_using_token_data) - 2 + lendesc) {
2145		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2146		    /*field*/ 534, /*bit_valid*/ 0, /*bit*/ 0);
2147		goto done;
2148	}
2149/*
2150	printf("WUT(list=%u) flags=%x off=%ju len=%x\n",
2151	    scsi_4btoul(cdb->list_identifier),
2152	    data->flags, scsi_8btou64(data->offset_into_rod),
2153	    scsi_2btoul(data->range_descriptor_length));
2154*/
2155
2156	/* Validate list of ranges */
2157	if (tpc_check_ranges(&data->desc[0],
2158	    scsi_2btoul(data->range_descriptor_length) /
2159	    sizeof(struct scsi_range_desc))) {
2160		ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
2161		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2162		    /*bit*/ 0);
2163		goto done;
2164	}
2165
2166	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2167	list->service_action = cdb->service_action;
2168	list->init_port = ctsio->io_hdr.nexus.targ_port;
2169	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
2170	list->list_id = scsi_4btoul(cdb->list_identifier);
2171	list->flags = data->flags;
2172	list->params = ctsio->kern_data_ptr;
2173	list->range = &data->desc[0];
2174	list->nrange = scsi_2btoul(data->range_descriptor_length) /
2175	    sizeof(struct scsi_range_desc);
2176	list->offset_into_rod = scsi_8btou64(data->offset_into_rod);
2177	list->ctsio = ctsio;
2178	list->lun = lun;
2179	mtx_lock(&lun->lun_lock);
2180	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2181	if (tlist != NULL && !tlist->completed) {
2182		mtx_unlock(&lun->lun_lock);
2183		free(list, M_CTL);
2184		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2185		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2186		    /*bit*/ 0);
2187		goto done;
2188	}
2189	if (tlist != NULL) {
2190		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2191		free(tlist, M_CTL);
2192	}
2193	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2194	mtx_unlock(&lun->lun_lock);
2195
2196	/* Block device zero ROD token -> no token. */
2197	if (scsi_4btoul(data->rod_token) == ROD_TYPE_BLOCK_ZERO) {
2198		tpc_process(list);
2199		return (CTL_RETVAL_COMPLETE);
2200	}
2201
2202	mtx_lock(&softc->tpc_lock);
2203	TAILQ_FOREACH(token, &softc->tpc_tokens, links) {
2204		if (memcmp(token->token, data->rod_token,
2205		    sizeof(data->rod_token)) == 0)
2206			break;
2207	}
2208	if (token != NULL) {
2209		token->active++;
2210		list->token = token;
2211		if (data->flags & EC_WUT_DEL_TKN)
2212			token->timeout = 0;
2213	}
2214	mtx_unlock(&softc->tpc_lock);
2215	if (token == NULL) {
2216		mtx_lock(&lun->lun_lock);
2217		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2218		mtx_unlock(&lun->lun_lock);
2219		free(list, M_CTL);
2220		ctl_set_sense(ctsio, /*current_error*/ 1,
2221		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2222		    /*asc*/ 0x23, /*ascq*/ 0x04, SSD_ELEM_NONE);
2223		goto done;
2224	}
2225
2226	tpc_process(list);
2227	return (CTL_RETVAL_COMPLETE);
2228
2229done:
2230	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
2231		free(ctsio->kern_data_ptr, M_CTL);
2232		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2233	}
2234	ctl_done((union ctl_io *)ctsio);
2235	return (CTL_RETVAL_COMPLETE);
2236}
2237
2238int
2239ctl_receive_rod_token_information(struct ctl_scsiio *ctsio)
2240{
2241	struct ctl_lun *lun;
2242	struct scsi_receive_rod_token_information *cdb;
2243	struct scsi_receive_copy_status_lid4_data *data;
2244	struct tpc_list *list;
2245	struct tpc_list list_copy;
2246	uint8_t *ptr;
2247	int retval;
2248	int alloc_len, total_len, token_len;
2249	uint32_t list_id;
2250
2251	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2252
2253	cdb = (struct scsi_receive_rod_token_information *)ctsio->cdb;
2254	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2255
2256	retval = CTL_RETVAL_COMPLETE;
2257
2258	list_id = scsi_4btoul(cdb->list_identifier);
2259	mtx_lock(&lun->lun_lock);
2260	list = tpc_find_list(lun, list_id,
2261	    ctl_get_initindex(&ctsio->io_hdr.nexus));
2262	if (list == NULL) {
2263		mtx_unlock(&lun->lun_lock);
2264		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2265		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
2266		    /*bit*/ 0);
2267		ctl_done((union ctl_io *)ctsio);
2268		return (retval);
2269	}
2270	list_copy = *list;
2271	if (list->completed) {
2272		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2273		free(list, M_CTL);
2274	}
2275	mtx_unlock(&lun->lun_lock);
2276
2277	token_len = list_copy.res_token_valid ? 2 + sizeof(list_copy.res_token) : 0;
2278	total_len = sizeof(*data) + list_copy.sense_len + 4 + token_len;
2279	alloc_len = scsi_4btoul(cdb->length);
2280
2281	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2282
2283	ctsio->kern_sg_entries = 0;
2284
2285	if (total_len < alloc_len) {
2286		ctsio->residual = alloc_len - total_len;
2287		ctsio->kern_data_len = total_len;
2288		ctsio->kern_total_len = total_len;
2289	} else {
2290		ctsio->residual = 0;
2291		ctsio->kern_data_len = alloc_len;
2292		ctsio->kern_total_len = alloc_len;
2293	}
2294	ctsio->kern_data_resid = 0;
2295	ctsio->kern_rel_offset = 0;
2296
2297	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
2298	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len +
2299	    4 + token_len, data->available_data);
2300	data->response_to_service_action = list_copy.service_action;
2301	if (list_copy.completed) {
2302		if (list_copy.error)
2303			data->copy_command_status = RCS_CCS_ERROR;
2304		else if (list_copy.abort)
2305			data->copy_command_status = RCS_CCS_ABORTED;
2306		else
2307			data->copy_command_status = RCS_CCS_COMPLETED;
2308	} else
2309		data->copy_command_status = RCS_CCS_INPROG_FG;
2310	scsi_ulto2b(list_copy.curops, data->operation_counter);
2311	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
2312	data->transfer_count_units = RCS_TC_LBAS;
2313	scsi_u64to8b(list_copy.cursectors, data->transfer_count);
2314	scsi_ulto2b(list_copy.curseg, data->segments_processed);
2315	data->length_of_the_sense_data_field = list_copy.sense_len;
2316	data->sense_data_length = list_copy.sense_len;
2317	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
2318
2319	ptr = &data->sense_data[data->length_of_the_sense_data_field];
2320	scsi_ulto4b(token_len, &ptr[0]);
2321	if (list_copy.res_token_valid) {
2322		scsi_ulto2b(0, &ptr[4]);
2323		memcpy(&ptr[6], list_copy.res_token, sizeof(list_copy.res_token));
2324	}
2325/*
2326	printf("RRTI(list=%u) valid=%d\n",
2327	    scsi_4btoul(cdb->list_identifier), list_copy.res_token_valid);
2328*/
2329	ctl_set_success(ctsio);
2330	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2331	ctsio->be_move_done = ctl_config_move_done;
2332	ctl_datamove((union ctl_io *)ctsio);
2333	return (retval);
2334}
2335
2336int
2337ctl_report_all_rod_tokens(struct ctl_scsiio *ctsio)
2338{
2339	struct ctl_softc *softc;
2340	struct ctl_lun *lun;
2341	struct scsi_report_all_rod_tokens *cdb;
2342	struct scsi_report_all_rod_tokens_data *data;
2343	struct tpc_token *token;
2344	int retval;
2345	int alloc_len, total_len, tokens, i;
2346
2347	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2348
2349	cdb = (struct scsi_report_all_rod_tokens *)ctsio->cdb;
2350	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
2351	softc = lun->ctl_softc;
2352
2353	retval = CTL_RETVAL_COMPLETE;
2354
2355	tokens = 0;
2356	mtx_lock(&softc->tpc_lock);
2357	TAILQ_FOREACH(token, &softc->tpc_tokens, links)
2358		tokens++;
2359	mtx_unlock(&softc->tpc_lock);
2360	if (tokens > 512)
2361		tokens = 512;
2362
2363	total_len = sizeof(*data) + tokens * 96;
2364	alloc_len = scsi_4btoul(cdb->length);
2365
2366	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2367
2368	ctsio->kern_sg_entries = 0;
2369
2370	if (total_len < alloc_len) {
2371		ctsio->residual = alloc_len - total_len;
2372		ctsio->kern_data_len = total_len;
2373		ctsio->kern_total_len = total_len;
2374	} else {
2375		ctsio->residual = 0;
2376		ctsio->kern_data_len = alloc_len;
2377		ctsio->kern_total_len = alloc_len;
2378	}
2379	ctsio->kern_data_resid = 0;
2380	ctsio->kern_rel_offset = 0;
2381
2382	data = (struct scsi_report_all_rod_tokens_data *)ctsio->kern_data_ptr;
2383	i = 0;
2384	mtx_lock(&softc->tpc_lock);
2385	TAILQ_FOREACH(token, &softc->tpc_tokens, links) {
2386		if (i >= tokens)
2387			break;
2388		memcpy(&data->rod_management_token_list[i * 96],
2389		    token->token, 96);
2390		i++;
2391	}
2392	mtx_unlock(&softc->tpc_lock);
2393	scsi_ulto4b(sizeof(*data) - 4 + i * 96, data->available_data);
2394/*
2395	printf("RART tokens=%d\n", i);
2396*/
2397	ctl_set_success(ctsio);
2398	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2399	ctsio->be_move_done = ctl_config_move_done;
2400	ctl_datamove((union ctl_io *)ctsio);
2401	return (retval);
2402}
2403
2404