ctl_tpc.c revision 313367
1/*-
2 * Copyright (c) 2014 Alexander Motin <mav@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer,
10 *    without modification, immediately at the beginning of the file.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD: stable/10/sys/cam/ctl/ctl_tpc.c 313367 2017-02-07 01:44:18Z mav $");
29
30#include <sys/param.h>
31#include <sys/systm.h>
32#include <sys/kernel.h>
33#include <sys/types.h>
34#include <sys/lock.h>
35#include <sys/module.h>
36#include <sys/mutex.h>
37#include <sys/condvar.h>
38#include <sys/malloc.h>
39#include <sys/conf.h>
40#include <sys/queue.h>
41#include <sys/sysctl.h>
42#include <machine/atomic.h>
43
44#include <cam/cam.h>
45#include <cam/scsi/scsi_all.h>
46#include <cam/scsi/scsi_da.h>
47#include <cam/ctl/ctl_io.h>
48#include <cam/ctl/ctl.h>
49#include <cam/ctl/ctl_frontend.h>
50#include <cam/ctl/ctl_util.h>
51#include <cam/ctl/ctl_backend.h>
52#include <cam/ctl/ctl_ioctl.h>
53#include <cam/ctl/ctl_ha.h>
54#include <cam/ctl/ctl_private.h>
55#include <cam/ctl/ctl_debug.h>
56#include <cam/ctl/ctl_scsi_all.h>
57#include <cam/ctl/ctl_tpc.h>
58#include <cam/ctl/ctl_error.h>
59
60#define	TPC_MAX_CSCDS	64
61#define	TPC_MAX_SEGS	64
62#define	TPC_MAX_SEG	0
63#define	TPC_MAX_LIST	8192
64#define	TPC_MAX_INLINE	0
65#define	TPC_MAX_LISTS	255
66#define	TPC_MAX_IO_SIZE	(1024 * 1024)
67#define	TPC_MAX_IOCHUNK_SIZE	(TPC_MAX_IO_SIZE * 16)
68#define	TPC_MIN_TOKEN_TIMEOUT	1
69#define	TPC_DFL_TOKEN_TIMEOUT	60
70#define	TPC_MAX_TOKEN_TIMEOUT	600
71
72MALLOC_DEFINE(M_CTL_TPC, "ctltpc", "CTL TPC");
73
74typedef enum {
75	TPC_ERR_RETRY		= 0x000,
76	TPC_ERR_FAIL		= 0x001,
77	TPC_ERR_MASK		= 0x0ff,
78	TPC_ERR_NO_DECREMENT	= 0x100
79} tpc_error_action;
80
81struct tpc_list;
82TAILQ_HEAD(runl, tpc_io);
83struct tpc_io {
84	union ctl_io		*io;
85	uint8_t			 target;
86	uint32_t		 cscd;
87	uint64_t		 lun;
88	struct tpc_list		*list;
89	struct runl		 run;
90	TAILQ_ENTRY(tpc_io)	 rlinks;
91	TAILQ_ENTRY(tpc_io)	 links;
92};
93
94struct tpc_token {
95	uint8_t			 token[512];
96	uint64_t		 lun;
97	uint32_t		 blocksize;
98	uint8_t			*params;
99	struct scsi_range_desc	*range;
100	int			 nrange;
101	int			 active;
102	time_t			 last_active;
103	uint32_t		 timeout;
104	TAILQ_ENTRY(tpc_token)	 links;
105};
106
107struct tpc_list {
108	uint8_t			 service_action;
109	int			 init_port;
110	uint32_t		 init_idx;
111	uint32_t		 list_id;
112	uint8_t			 flags;
113	uint8_t			*params;
114	struct scsi_ec_cscd	*cscd;
115	struct scsi_ec_segment	*seg[TPC_MAX_SEGS];
116	uint8_t			*inl;
117	int			 ncscd;
118	int			 nseg;
119	int			 leninl;
120	struct tpc_token	*token;
121	struct scsi_range_desc	*range;
122	int			 nrange;
123	off_t			 offset_into_rod;
124
125	int			 curseg;
126	off_t			 cursectors;
127	off_t			 curbytes;
128	int			 curops;
129	int			 stage;
130	uint8_t			*buf;
131	off_t			 segsectors;
132	off_t			 segbytes;
133	int			 tbdio;
134	int			 error;
135	int			 abort;
136	int			 completed;
137	time_t			 last_active;
138	TAILQ_HEAD(, tpc_io)	 allio;
139	struct scsi_sense_data	 fwd_sense_data;
140	uint8_t			 fwd_sense_len;
141	uint8_t			 fwd_scsi_status;
142	uint8_t			 fwd_target;
143	uint16_t		 fwd_cscd;
144	struct scsi_sense_data	 sense_data;
145	uint8_t			 sense_len;
146	uint8_t			 scsi_status;
147	struct ctl_scsiio	*ctsio;
148	struct ctl_lun		*lun;
149	int			 res_token_valid;
150	uint8_t			 res_token[512];
151	TAILQ_ENTRY(tpc_list)	 links;
152};
153
154static void
155tpc_timeout(void *arg)
156{
157	struct ctl_softc *softc = arg;
158	struct ctl_lun *lun;
159	struct tpc_token *token, *ttoken;
160	struct tpc_list *list, *tlist;
161
162	/* Free completed lists with expired timeout. */
163	STAILQ_FOREACH(lun, &softc->lun_list, links) {
164		mtx_lock(&lun->lun_lock);
165		TAILQ_FOREACH_SAFE(list, &lun->tpc_lists, links, tlist) {
166			if (!list->completed || time_uptime < list->last_active +
167			    TPC_DFL_TOKEN_TIMEOUT)
168				continue;
169			TAILQ_REMOVE(&lun->tpc_lists, list, links);
170			free(list, M_CTL);
171		}
172		mtx_unlock(&lun->lun_lock);
173	}
174
175	/* Free inactive ROD tokens with expired timeout. */
176	mtx_lock(&softc->tpc_lock);
177	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
178		if (token->active ||
179		    time_uptime < token->last_active + token->timeout + 1)
180			continue;
181		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
182		free(token->params, M_CTL);
183		free(token, M_CTL);
184	}
185	mtx_unlock(&softc->tpc_lock);
186	callout_schedule(&softc->tpc_timeout, hz);
187}
188
189void
190ctl_tpc_init(struct ctl_softc *softc)
191{
192
193	mtx_init(&softc->tpc_lock, "CTL TPC mutex", NULL, MTX_DEF);
194	TAILQ_INIT(&softc->tpc_tokens);
195	callout_init_mtx(&softc->tpc_timeout, &softc->ctl_lock, 0);
196	callout_reset(&softc->tpc_timeout, hz, tpc_timeout, softc);
197}
198
199void
200ctl_tpc_shutdown(struct ctl_softc *softc)
201{
202	struct tpc_token *token;
203
204	callout_drain(&softc->tpc_timeout);
205
206	/* Free ROD tokens. */
207	mtx_lock(&softc->tpc_lock);
208	while ((token = TAILQ_FIRST(&softc->tpc_tokens)) != NULL) {
209		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
210		free(token->params, M_CTL);
211		free(token, M_CTL);
212	}
213	mtx_unlock(&softc->tpc_lock);
214	mtx_destroy(&softc->tpc_lock);
215}
216
217void
218ctl_tpc_lun_init(struct ctl_lun *lun)
219{
220
221	TAILQ_INIT(&lun->tpc_lists);
222}
223
224void
225ctl_tpc_lun_shutdown(struct ctl_lun *lun)
226{
227	struct ctl_softc *softc = lun->ctl_softc;
228	struct tpc_list *list;
229	struct tpc_token *token, *ttoken;
230
231	/* Free lists for this LUN. */
232	while ((list = TAILQ_FIRST(&lun->tpc_lists)) != NULL) {
233		TAILQ_REMOVE(&lun->tpc_lists, list, links);
234		KASSERT(list->completed,
235		    ("Not completed TPC (%p) on shutdown", list));
236		free(list, M_CTL);
237	}
238
239	/* Free ROD tokens for this LUN. */
240	mtx_lock(&softc->tpc_lock);
241	TAILQ_FOREACH_SAFE(token, &softc->tpc_tokens, links, ttoken) {
242		if (token->lun != lun->lun || token->active)
243			continue;
244		TAILQ_REMOVE(&softc->tpc_tokens, token, links);
245		free(token->params, M_CTL);
246		free(token, M_CTL);
247	}
248	mtx_unlock(&softc->tpc_lock);
249}
250
251int
252ctl_inquiry_evpd_tpc(struct ctl_scsiio *ctsio, int alloc_len)
253{
254	struct ctl_lun *lun = CTL_LUN(ctsio);
255	struct scsi_vpd_tpc *tpc_ptr;
256	struct scsi_vpd_tpc_descriptor *d_ptr;
257	struct scsi_vpd_tpc_descriptor_bdrl *bdrl_ptr;
258	struct scsi_vpd_tpc_descriptor_sc *sc_ptr;
259	struct scsi_vpd_tpc_descriptor_sc_descr *scd_ptr;
260	struct scsi_vpd_tpc_descriptor_pd *pd_ptr;
261	struct scsi_vpd_tpc_descriptor_sd *sd_ptr;
262	struct scsi_vpd_tpc_descriptor_sdid *sdid_ptr;
263	struct scsi_vpd_tpc_descriptor_rtf *rtf_ptr;
264	struct scsi_vpd_tpc_descriptor_rtf_block *rtfb_ptr;
265	struct scsi_vpd_tpc_descriptor_srt *srt_ptr;
266	struct scsi_vpd_tpc_descriptor_srtd *srtd_ptr;
267	struct scsi_vpd_tpc_descriptor_gco *gco_ptr;
268	int data_len;
269
270	data_len = sizeof(struct scsi_vpd_tpc) +
271	    sizeof(struct scsi_vpd_tpc_descriptor_bdrl) +
272	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sc) +
273	     2 * sizeof(struct scsi_vpd_tpc_descriptor_sc_descr) + 11, 4) +
274	    sizeof(struct scsi_vpd_tpc_descriptor_pd) +
275	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sd) + 4, 4) +
276	    roundup2(sizeof(struct scsi_vpd_tpc_descriptor_sdid) + 2, 4) +
277	    sizeof(struct scsi_vpd_tpc_descriptor_rtf) +
278	     sizeof(struct scsi_vpd_tpc_descriptor_rtf_block) +
279	    sizeof(struct scsi_vpd_tpc_descriptor_srt) +
280	     2*sizeof(struct scsi_vpd_tpc_descriptor_srtd) +
281	    sizeof(struct scsi_vpd_tpc_descriptor_gco);
282
283	ctsio->kern_data_ptr = malloc(data_len, M_CTL, M_WAITOK | M_ZERO);
284	tpc_ptr = (struct scsi_vpd_tpc *)ctsio->kern_data_ptr;
285	ctsio->kern_rel_offset = 0;
286	ctsio->kern_sg_entries = 0;
287	ctsio->kern_data_len = min(data_len, alloc_len);
288	ctsio->kern_total_len = ctsio->kern_data_len;
289
290	/*
291	 * The control device is always connected.  The disk device, on the
292	 * other hand, may not be online all the time.
293	 */
294	if (lun != NULL)
295		tpc_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
296				     lun->be_lun->lun_type;
297	else
298		tpc_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
299	tpc_ptr->page_code = SVPD_SCSI_TPC;
300	scsi_ulto2b(data_len - 4, tpc_ptr->page_length);
301
302	/* Block Device ROD Limits */
303	d_ptr = (struct scsi_vpd_tpc_descriptor *)&tpc_ptr->descr[0];
304	bdrl_ptr = (struct scsi_vpd_tpc_descriptor_bdrl *)d_ptr;
305	scsi_ulto2b(SVPD_TPC_BDRL, bdrl_ptr->desc_type);
306	scsi_ulto2b(sizeof(*bdrl_ptr) - 4, bdrl_ptr->desc_length);
307	scsi_ulto2b(TPC_MAX_SEGS, bdrl_ptr->maximum_ranges);
308	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
309	    bdrl_ptr->maximum_inactivity_timeout);
310	scsi_ulto4b(TPC_DFL_TOKEN_TIMEOUT,
311	    bdrl_ptr->default_inactivity_timeout);
312	scsi_u64to8b(0, bdrl_ptr->maximum_token_transfer_size);
313	scsi_u64to8b(0, bdrl_ptr->optimal_transfer_count);
314
315	/* Supported commands */
316	d_ptr = (struct scsi_vpd_tpc_descriptor *)
317	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
318	sc_ptr = (struct scsi_vpd_tpc_descriptor_sc *)d_ptr;
319	scsi_ulto2b(SVPD_TPC_SC, sc_ptr->desc_type);
320	sc_ptr->list_length = 2 * sizeof(*scd_ptr) + 11;
321	scsi_ulto2b(roundup2(1 + sc_ptr->list_length, 4), sc_ptr->desc_length);
322	scd_ptr = &sc_ptr->descr[0];
323	scd_ptr->opcode = EXTENDED_COPY;
324	scd_ptr->sa_length = 5;
325	scd_ptr->supported_service_actions[0] = EC_EC_LID1;
326	scd_ptr->supported_service_actions[1] = EC_EC_LID4;
327	scd_ptr->supported_service_actions[2] = EC_PT;
328	scd_ptr->supported_service_actions[3] = EC_WUT;
329	scd_ptr->supported_service_actions[4] = EC_COA;
330	scd_ptr = (struct scsi_vpd_tpc_descriptor_sc_descr *)
331	    &scd_ptr->supported_service_actions[scd_ptr->sa_length];
332	scd_ptr->opcode = RECEIVE_COPY_STATUS;
333	scd_ptr->sa_length = 6;
334	scd_ptr->supported_service_actions[0] = RCS_RCS_LID1;
335	scd_ptr->supported_service_actions[1] = RCS_RCFD;
336	scd_ptr->supported_service_actions[2] = RCS_RCS_LID4;
337	scd_ptr->supported_service_actions[3] = RCS_RCOP;
338	scd_ptr->supported_service_actions[4] = RCS_RRTI;
339	scd_ptr->supported_service_actions[5] = RCS_RART;
340
341	/* Parameter data. */
342	d_ptr = (struct scsi_vpd_tpc_descriptor *)
343	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
344	pd_ptr = (struct scsi_vpd_tpc_descriptor_pd *)d_ptr;
345	scsi_ulto2b(SVPD_TPC_PD, pd_ptr->desc_type);
346	scsi_ulto2b(sizeof(*pd_ptr) - 4, pd_ptr->desc_length);
347	scsi_ulto2b(TPC_MAX_CSCDS, pd_ptr->maximum_cscd_descriptor_count);
348	scsi_ulto2b(TPC_MAX_SEGS, pd_ptr->maximum_segment_descriptor_count);
349	scsi_ulto4b(TPC_MAX_LIST, pd_ptr->maximum_descriptor_list_length);
350	scsi_ulto4b(TPC_MAX_INLINE, pd_ptr->maximum_inline_data_length);
351
352	/* Supported Descriptors */
353	d_ptr = (struct scsi_vpd_tpc_descriptor *)
354	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
355	sd_ptr = (struct scsi_vpd_tpc_descriptor_sd *)d_ptr;
356	scsi_ulto2b(SVPD_TPC_SD, sd_ptr->desc_type);
357	scsi_ulto2b(roundup2(sizeof(*sd_ptr) - 4 + 4, 4), sd_ptr->desc_length);
358	sd_ptr->list_length = 4;
359	sd_ptr->supported_descriptor_codes[0] = EC_SEG_B2B;
360	sd_ptr->supported_descriptor_codes[1] = EC_SEG_VERIFY;
361	sd_ptr->supported_descriptor_codes[2] = EC_SEG_REGISTER_KEY;
362	sd_ptr->supported_descriptor_codes[3] = EC_CSCD_ID;
363
364	/* Supported CSCD Descriptor IDs */
365	d_ptr = (struct scsi_vpd_tpc_descriptor *)
366	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
367	sdid_ptr = (struct scsi_vpd_tpc_descriptor_sdid *)d_ptr;
368	scsi_ulto2b(SVPD_TPC_SDID, sdid_ptr->desc_type);
369	scsi_ulto2b(roundup2(sizeof(*sdid_ptr) - 4 + 2, 4), sdid_ptr->desc_length);
370	scsi_ulto2b(2, sdid_ptr->list_length);
371	scsi_ulto2b(0xffff, &sdid_ptr->supported_descriptor_ids[0]);
372
373	/* ROD Token Features */
374	d_ptr = (struct scsi_vpd_tpc_descriptor *)
375	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
376	rtf_ptr = (struct scsi_vpd_tpc_descriptor_rtf *)d_ptr;
377	scsi_ulto2b(SVPD_TPC_RTF, rtf_ptr->desc_type);
378	scsi_ulto2b(sizeof(*rtf_ptr) - 4 + sizeof(*rtfb_ptr), rtf_ptr->desc_length);
379	rtf_ptr->remote_tokens = 0;
380	scsi_ulto4b(TPC_MIN_TOKEN_TIMEOUT, rtf_ptr->minimum_token_lifetime);
381	scsi_ulto4b(UINT32_MAX, rtf_ptr->maximum_token_lifetime);
382	scsi_ulto4b(TPC_MAX_TOKEN_TIMEOUT,
383	    rtf_ptr->maximum_token_inactivity_timeout);
384	scsi_ulto2b(sizeof(*rtfb_ptr), rtf_ptr->type_specific_features_length);
385	rtfb_ptr = (struct scsi_vpd_tpc_descriptor_rtf_block *)
386	    &rtf_ptr->type_specific_features;
387	rtfb_ptr->type_format = SVPD_TPC_RTF_BLOCK;
388	scsi_ulto2b(sizeof(*rtfb_ptr) - 4, rtfb_ptr->desc_length);
389	scsi_ulto2b(0, rtfb_ptr->optimal_length_granularity);
390	scsi_u64to8b(0, rtfb_ptr->maximum_bytes);
391	scsi_u64to8b(0, rtfb_ptr->optimal_bytes);
392	scsi_u64to8b(UINT64_MAX, rtfb_ptr->optimal_bytes_to_token_per_segment);
393	scsi_u64to8b(TPC_MAX_IOCHUNK_SIZE,
394	    rtfb_ptr->optimal_bytes_from_token_per_segment);
395
396	/* Supported ROD Tokens */
397	d_ptr = (struct scsi_vpd_tpc_descriptor *)
398	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
399	srt_ptr = (struct scsi_vpd_tpc_descriptor_srt *)d_ptr;
400	scsi_ulto2b(SVPD_TPC_SRT, srt_ptr->desc_type);
401	scsi_ulto2b(sizeof(*srt_ptr) - 4 + 2*sizeof(*srtd_ptr), srt_ptr->desc_length);
402	scsi_ulto2b(2*sizeof(*srtd_ptr), srt_ptr->rod_type_descriptors_length);
403	srtd_ptr = (struct scsi_vpd_tpc_descriptor_srtd *)
404	    &srt_ptr->rod_type_descriptors;
405	scsi_ulto4b(ROD_TYPE_AUR, srtd_ptr->rod_type);
406	srtd_ptr->flags = SVPD_TPC_SRTD_TIN | SVPD_TPC_SRTD_TOUT;
407	scsi_ulto2b(0, srtd_ptr->preference_indicator);
408	srtd_ptr++;
409	scsi_ulto4b(ROD_TYPE_BLOCK_ZERO, srtd_ptr->rod_type);
410	srtd_ptr->flags = SVPD_TPC_SRTD_TIN;
411	scsi_ulto2b(0, srtd_ptr->preference_indicator);
412
413	/* General Copy Operations */
414	d_ptr = (struct scsi_vpd_tpc_descriptor *)
415	    (&d_ptr->parameters[0] + scsi_2btoul(d_ptr->desc_length));
416	gco_ptr = (struct scsi_vpd_tpc_descriptor_gco *)d_ptr;
417	scsi_ulto2b(SVPD_TPC_GCO, gco_ptr->desc_type);
418	scsi_ulto2b(sizeof(*gco_ptr) - 4, gco_ptr->desc_length);
419	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->total_concurrent_copies);
420	scsi_ulto4b(TPC_MAX_LISTS, gco_ptr->maximum_identified_concurrent_copies);
421	scsi_ulto4b(TPC_MAX_SEG, gco_ptr->maximum_segment_length);
422	gco_ptr->data_segment_granularity = 0;
423	gco_ptr->inline_data_granularity = 0;
424
425	ctl_set_success(ctsio);
426	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
427	ctsio->be_move_done = ctl_config_move_done;
428	ctl_datamove((union ctl_io *)ctsio);
429
430	return (CTL_RETVAL_COMPLETE);
431}
432
433int
434ctl_receive_copy_operating_parameters(struct ctl_scsiio *ctsio)
435{
436	struct scsi_receive_copy_operating_parameters *cdb;
437	struct scsi_receive_copy_operating_parameters_data *data;
438	int retval;
439	int alloc_len, total_len;
440
441	CTL_DEBUG_PRINT(("ctl_report_supported_tmf\n"));
442
443	cdb = (struct scsi_receive_copy_operating_parameters *)ctsio->cdb;
444
445	retval = CTL_RETVAL_COMPLETE;
446
447	total_len = sizeof(*data) + 4;
448	alloc_len = scsi_4btoul(cdb->length);
449
450	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
451	ctsio->kern_sg_entries = 0;
452	ctsio->kern_rel_offset = 0;
453	ctsio->kern_data_len = min(total_len, alloc_len);
454	ctsio->kern_total_len = ctsio->kern_data_len;
455
456	data = (struct scsi_receive_copy_operating_parameters_data *)ctsio->kern_data_ptr;
457	scsi_ulto4b(sizeof(*data) - 4 + 4, data->length);
458	data->snlid = RCOP_SNLID;
459	scsi_ulto2b(TPC_MAX_CSCDS, data->maximum_cscd_descriptor_count);
460	scsi_ulto2b(TPC_MAX_SEGS, data->maximum_segment_descriptor_count);
461	scsi_ulto4b(TPC_MAX_LIST, data->maximum_descriptor_list_length);
462	scsi_ulto4b(TPC_MAX_SEG, data->maximum_segment_length);
463	scsi_ulto4b(TPC_MAX_INLINE, data->maximum_inline_data_length);
464	scsi_ulto4b(0, data->held_data_limit);
465	scsi_ulto4b(0, data->maximum_stream_device_transfer_size);
466	scsi_ulto2b(TPC_MAX_LISTS, data->total_concurrent_copies);
467	data->maximum_concurrent_copies = TPC_MAX_LISTS;
468	data->data_segment_granularity = 0;
469	data->inline_data_granularity = 0;
470	data->held_data_granularity = 0;
471	data->implemented_descriptor_list_length = 4;
472	data->list_of_implemented_descriptor_type_codes[0] = EC_SEG_B2B;
473	data->list_of_implemented_descriptor_type_codes[1] = EC_SEG_VERIFY;
474	data->list_of_implemented_descriptor_type_codes[2] = EC_SEG_REGISTER_KEY;
475	data->list_of_implemented_descriptor_type_codes[3] = EC_CSCD_ID;
476
477	ctl_set_success(ctsio);
478	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
479	ctsio->be_move_done = ctl_config_move_done;
480	ctl_datamove((union ctl_io *)ctsio);
481	return (retval);
482}
483
484static struct tpc_list *
485tpc_find_list(struct ctl_lun *lun, uint32_t list_id, uint32_t init_idx)
486{
487	struct tpc_list *list;
488
489	mtx_assert(&lun->lun_lock, MA_OWNED);
490	TAILQ_FOREACH(list, &lun->tpc_lists, links) {
491		if ((list->flags & EC_LIST_ID_USAGE_MASK) !=
492		     EC_LIST_ID_USAGE_NONE && list->list_id == list_id &&
493		    list->init_idx == init_idx)
494			break;
495	}
496	return (list);
497}
498
499int
500ctl_receive_copy_status_lid1(struct ctl_scsiio *ctsio)
501{
502	struct ctl_lun *lun = CTL_LUN(ctsio);
503	struct scsi_receive_copy_status_lid1 *cdb;
504	struct scsi_receive_copy_status_lid1_data *data;
505	struct tpc_list *list;
506	struct tpc_list list_copy;
507	int retval;
508	int alloc_len, total_len;
509	uint32_t list_id;
510
511	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid1\n"));
512
513	cdb = (struct scsi_receive_copy_status_lid1 *)ctsio->cdb;
514	retval = CTL_RETVAL_COMPLETE;
515
516	list_id = cdb->list_identifier;
517	mtx_lock(&lun->lun_lock);
518	list = tpc_find_list(lun, list_id,
519	    ctl_get_initindex(&ctsio->io_hdr.nexus));
520	if (list == NULL) {
521		mtx_unlock(&lun->lun_lock);
522		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
523		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
524		    /*bit*/ 0);
525		ctl_done((union ctl_io *)ctsio);
526		return (retval);
527	}
528	list_copy = *list;
529	if (list->completed) {
530		TAILQ_REMOVE(&lun->tpc_lists, list, links);
531		free(list, M_CTL);
532	}
533	mtx_unlock(&lun->lun_lock);
534
535	total_len = sizeof(*data);
536	alloc_len = scsi_4btoul(cdb->length);
537
538	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
539	ctsio->kern_sg_entries = 0;
540	ctsio->kern_rel_offset = 0;
541	ctsio->kern_data_len = min(total_len, alloc_len);
542	ctsio->kern_total_len = ctsio->kern_data_len;
543
544	data = (struct scsi_receive_copy_status_lid1_data *)ctsio->kern_data_ptr;
545	scsi_ulto4b(sizeof(*data) - 4, data->available_data);
546	if (list_copy.completed) {
547		if (list_copy.error || list_copy.abort)
548			data->copy_command_status = RCS_CCS_ERROR;
549		else
550			data->copy_command_status = RCS_CCS_COMPLETED;
551	} else
552		data->copy_command_status = RCS_CCS_INPROG;
553	scsi_ulto2b(list_copy.curseg, data->segments_processed);
554	if (list_copy.curbytes <= UINT32_MAX) {
555		data->transfer_count_units = RCS_TC_BYTES;
556		scsi_ulto4b(list_copy.curbytes, data->transfer_count);
557	} else {
558		data->transfer_count_units = RCS_TC_MBYTES;
559		scsi_ulto4b(list_copy.curbytes >> 20, data->transfer_count);
560	}
561
562	ctl_set_success(ctsio);
563	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
564	ctsio->be_move_done = ctl_config_move_done;
565	ctl_datamove((union ctl_io *)ctsio);
566	return (retval);
567}
568
569int
570ctl_receive_copy_failure_details(struct ctl_scsiio *ctsio)
571{
572	struct ctl_lun *lun = CTL_LUN(ctsio);
573	struct scsi_receive_copy_failure_details *cdb;
574	struct scsi_receive_copy_failure_details_data *data;
575	struct tpc_list *list;
576	struct tpc_list list_copy;
577	int retval;
578	int alloc_len, total_len;
579	uint32_t list_id;
580
581	CTL_DEBUG_PRINT(("ctl_receive_copy_failure_details\n"));
582
583	cdb = (struct scsi_receive_copy_failure_details *)ctsio->cdb;
584	retval = CTL_RETVAL_COMPLETE;
585
586	list_id = cdb->list_identifier;
587	mtx_lock(&lun->lun_lock);
588	list = tpc_find_list(lun, list_id,
589	    ctl_get_initindex(&ctsio->io_hdr.nexus));
590	if (list == NULL || !list->completed) {
591		mtx_unlock(&lun->lun_lock);
592		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
593		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
594		    /*bit*/ 0);
595		ctl_done((union ctl_io *)ctsio);
596		return (retval);
597	}
598	list_copy = *list;
599	TAILQ_REMOVE(&lun->tpc_lists, list, links);
600	free(list, M_CTL);
601	mtx_unlock(&lun->lun_lock);
602
603	total_len = sizeof(*data) + list_copy.sense_len;
604	alloc_len = scsi_4btoul(cdb->length);
605
606	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
607	ctsio->kern_sg_entries = 0;
608	ctsio->kern_rel_offset = 0;
609	ctsio->kern_data_len = min(total_len, alloc_len);
610	ctsio->kern_total_len = ctsio->kern_data_len;
611
612	data = (struct scsi_receive_copy_failure_details_data *)ctsio->kern_data_ptr;
613	if (list_copy.completed && (list_copy.error || list_copy.abort)) {
614		scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
615		    data->available_data);
616		data->copy_command_status = RCS_CCS_ERROR;
617	} else
618		scsi_ulto4b(0, data->available_data);
619	scsi_ulto2b(list_copy.sense_len, data->sense_data_length);
620	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
621
622	ctl_set_success(ctsio);
623	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
624	ctsio->be_move_done = ctl_config_move_done;
625	ctl_datamove((union ctl_io *)ctsio);
626	return (retval);
627}
628
629int
630ctl_receive_copy_status_lid4(struct ctl_scsiio *ctsio)
631{
632	struct ctl_lun *lun = CTL_LUN(ctsio);
633	struct scsi_receive_copy_status_lid4 *cdb;
634	struct scsi_receive_copy_status_lid4_data *data;
635	struct tpc_list *list;
636	struct tpc_list list_copy;
637	int retval;
638	int alloc_len, total_len;
639	uint32_t list_id;
640
641	CTL_DEBUG_PRINT(("ctl_receive_copy_status_lid4\n"));
642
643	cdb = (struct scsi_receive_copy_status_lid4 *)ctsio->cdb;
644	retval = CTL_RETVAL_COMPLETE;
645
646	list_id = scsi_4btoul(cdb->list_identifier);
647	mtx_lock(&lun->lun_lock);
648	list = tpc_find_list(lun, list_id,
649	    ctl_get_initindex(&ctsio->io_hdr.nexus));
650	if (list == NULL) {
651		mtx_unlock(&lun->lun_lock);
652		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
653		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
654		    /*bit*/ 0);
655		ctl_done((union ctl_io *)ctsio);
656		return (retval);
657	}
658	list_copy = *list;
659	if (list->completed) {
660		TAILQ_REMOVE(&lun->tpc_lists, list, links);
661		free(list, M_CTL);
662	}
663	mtx_unlock(&lun->lun_lock);
664
665	total_len = sizeof(*data) + list_copy.sense_len;
666	alloc_len = scsi_4btoul(cdb->length);
667
668	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
669	ctsio->kern_sg_entries = 0;
670	ctsio->kern_rel_offset = 0;
671	ctsio->kern_data_len = min(total_len, alloc_len);
672	ctsio->kern_total_len = ctsio->kern_data_len;
673
674	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
675	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len,
676	    data->available_data);
677	data->response_to_service_action = list_copy.service_action;
678	if (list_copy.completed) {
679		if (list_copy.error)
680			data->copy_command_status = RCS_CCS_ERROR;
681		else if (list_copy.abort)
682			data->copy_command_status = RCS_CCS_ABORTED;
683		else
684			data->copy_command_status = RCS_CCS_COMPLETED;
685	} else
686		data->copy_command_status = RCS_CCS_INPROG_FG;
687	scsi_ulto2b(list_copy.curops, data->operation_counter);
688	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
689	data->transfer_count_units = RCS_TC_BYTES;
690	scsi_u64to8b(list_copy.curbytes, data->transfer_count);
691	scsi_ulto2b(list_copy.curseg, data->segments_processed);
692	data->length_of_the_sense_data_field = list_copy.sense_len;
693	data->sense_data_length = list_copy.sense_len;
694	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
695
696	ctl_set_success(ctsio);
697	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
698	ctsio->be_move_done = ctl_config_move_done;
699	ctl_datamove((union ctl_io *)ctsio);
700	return (retval);
701}
702
703int
704ctl_copy_operation_abort(struct ctl_scsiio *ctsio)
705{
706	struct ctl_lun *lun = CTL_LUN(ctsio);
707	struct scsi_copy_operation_abort *cdb;
708	struct tpc_list *list;
709	int retval;
710	uint32_t list_id;
711
712	CTL_DEBUG_PRINT(("ctl_copy_operation_abort\n"));
713
714	cdb = (struct scsi_copy_operation_abort *)ctsio->cdb;
715	retval = CTL_RETVAL_COMPLETE;
716
717	list_id = scsi_4btoul(cdb->list_identifier);
718	mtx_lock(&lun->lun_lock);
719	list = tpc_find_list(lun, list_id,
720	    ctl_get_initindex(&ctsio->io_hdr.nexus));
721	if (list == NULL) {
722		mtx_unlock(&lun->lun_lock);
723		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
724		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
725		    /*bit*/ 0);
726		ctl_done((union ctl_io *)ctsio);
727		return (retval);
728	}
729	list->abort = 1;
730	mtx_unlock(&lun->lun_lock);
731
732	ctl_set_success(ctsio);
733	ctl_done((union ctl_io *)ctsio);
734	return (retval);
735}
736
737static uint64_t
738tpc_resolve(struct tpc_list *list, uint16_t idx, uint32_t *ss,
739    uint32_t *pb, uint32_t *pbo)
740{
741
742	if (idx == 0xffff) {
743		if (ss && list->lun->be_lun)
744			*ss = list->lun->be_lun->blocksize;
745		if (pb && list->lun->be_lun)
746			*pb = list->lun->be_lun->blocksize <<
747			    list->lun->be_lun->pblockexp;
748		if (pbo && list->lun->be_lun)
749			*pbo = list->lun->be_lun->blocksize *
750			    list->lun->be_lun->pblockoff;
751		return (list->lun->lun);
752	}
753	if (idx >= list->ncscd)
754		return (UINT64_MAX);
755	return (tpcl_resolve(list->lun->ctl_softc,
756	    list->init_port, &list->cscd[idx], ss, pb, pbo));
757}
758
759static void
760tpc_set_io_error_sense(struct tpc_list *list)
761{
762	int flen;
763	uint8_t csi[4];
764	uint8_t sks[3];
765	uint8_t fbuf[4 + 64];
766
767	scsi_ulto4b(list->curseg, csi);
768	if (list->fwd_cscd <= 0x07ff) {
769		sks[0] = SSD_SKS_SEGMENT_VALID;
770		scsi_ulto2b((uint8_t *)&list->cscd[list->fwd_cscd] -
771		    list->params, &sks[1]);
772	} else
773		sks[0] = 0;
774	if (list->fwd_scsi_status) {
775		fbuf[0] = 0x0c;
776		fbuf[2] = list->fwd_target;
777		flen = list->fwd_sense_len;
778		if (flen > 64) {
779			flen = 64;
780			fbuf[2] |= SSD_FORWARDED_FSDT;
781		}
782		fbuf[1] = 2 + flen;
783		fbuf[3] = list->fwd_scsi_status;
784		bcopy(&list->fwd_sense_data, &fbuf[4], flen);
785		flen += 4;
786	} else
787		flen = 0;
788	ctl_set_sense(list->ctsio, /*current_error*/ 1,
789	    /*sense_key*/ SSD_KEY_COPY_ABORTED,
790	    /*asc*/ 0x0d, /*ascq*/ 0x01,
791	    SSD_ELEM_COMMAND, sizeof(csi), csi,
792	    sks[0] ? SSD_ELEM_SKS : SSD_ELEM_SKIP, sizeof(sks), sks,
793	    flen ? SSD_ELEM_DESC : SSD_ELEM_SKIP, flen, fbuf,
794	    SSD_ELEM_NONE);
795}
796
797static int
798tpc_process_b2b(struct tpc_list *list)
799{
800	struct scsi_ec_segment_b2b *seg;
801	struct scsi_ec_cscd_dtsp *sdstp, *ddstp;
802	struct tpc_io *tior, *tiow;
803	struct runl run;
804	uint64_t sl, dl;
805	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
806	int numlba;
807	uint32_t srcblock, dstblock, pb, pbo, adj;
808	uint16_t scscd, dcscd;
809	uint8_t csi[4];
810
811	scsi_ulto4b(list->curseg, csi);
812	if (list->stage == 1) {
813		while ((tior = TAILQ_FIRST(&list->allio)) != NULL) {
814			TAILQ_REMOVE(&list->allio, tior, links);
815			ctl_free_io(tior->io);
816			free(tior, M_CTL);
817		}
818		free(list->buf, M_CTL);
819		if (list->abort) {
820			ctl_set_task_aborted(list->ctsio);
821			return (CTL_RETVAL_ERROR);
822		} else if (list->error) {
823			tpc_set_io_error_sense(list);
824			return (CTL_RETVAL_ERROR);
825		}
826		list->cursectors += list->segsectors;
827		list->curbytes += list->segbytes;
828		return (CTL_RETVAL_COMPLETE);
829	}
830
831	TAILQ_INIT(&list->allio);
832	seg = (struct scsi_ec_segment_b2b *)list->seg[list->curseg];
833	scscd = scsi_2btoul(seg->src_cscd);
834	dcscd = scsi_2btoul(seg->dst_cscd);
835	sl = tpc_resolve(list, scscd, &srcblock, NULL, NULL);
836	dl = tpc_resolve(list, dcscd, &dstblock, &pb, &pbo);
837	if (sl == UINT64_MAX || dl == UINT64_MAX) {
838		ctl_set_sense(list->ctsio, /*current_error*/ 1,
839		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
840		    /*asc*/ 0x08, /*ascq*/ 0x04,
841		    SSD_ELEM_COMMAND, sizeof(csi), csi,
842		    SSD_ELEM_NONE);
843		return (CTL_RETVAL_ERROR);
844	}
845	if (pbo > 0)
846		pbo = pb - pbo;
847	sdstp = &list->cscd[scscd].dtsp;
848	if (scsi_3btoul(sdstp->block_length) != 0)
849		srcblock = scsi_3btoul(sdstp->block_length);
850	ddstp = &list->cscd[dcscd].dtsp;
851	if (scsi_3btoul(ddstp->block_length) != 0)
852		dstblock = scsi_3btoul(ddstp->block_length);
853	numlba = scsi_2btoul(seg->number_of_blocks);
854	if (seg->flags & EC_SEG_DC)
855		numbytes = (off_t)numlba * dstblock;
856	else
857		numbytes = (off_t)numlba * srcblock;
858	srclba = scsi_8btou64(seg->src_lba);
859	dstlba = scsi_8btou64(seg->dst_lba);
860
861//	printf("Copy %ju bytes from %ju @ %ju to %ju @ %ju\n",
862//	    (uintmax_t)numbytes, sl, scsi_8btou64(seg->src_lba),
863//	    dl, scsi_8btou64(seg->dst_lba));
864
865	if (numbytes == 0)
866		return (CTL_RETVAL_COMPLETE);
867
868	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
869		ctl_set_sense(list->ctsio, /*current_error*/ 1,
870		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
871		    /*asc*/ 0x26, /*ascq*/ 0x0A,
872		    SSD_ELEM_COMMAND, sizeof(csi), csi,
873		    SSD_ELEM_NONE);
874		return (CTL_RETVAL_ERROR);
875	}
876
877	list->buf = malloc(numbytes, M_CTL, M_WAITOK);
878	list->segbytes = numbytes;
879	list->segsectors = numbytes / dstblock;
880	donebytes = 0;
881	TAILQ_INIT(&run);
882	list->tbdio = 0;
883	while (donebytes < numbytes) {
884		roundbytes = numbytes - donebytes;
885		if (roundbytes > TPC_MAX_IO_SIZE) {
886			roundbytes = TPC_MAX_IO_SIZE;
887			roundbytes -= roundbytes % dstblock;
888			if (pb > dstblock) {
889				adj = (dstlba * dstblock + roundbytes - pbo) % pb;
890				if (roundbytes > adj)
891					roundbytes -= adj;
892			}
893		}
894
895		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
896		TAILQ_INIT(&tior->run);
897		tior->list = list;
898		TAILQ_INSERT_TAIL(&list->allio, tior, links);
899		tior->io = tpcl_alloc_io();
900		ctl_scsi_read_write(tior->io,
901				    /*data_ptr*/ &list->buf[donebytes],
902				    /*data_len*/ roundbytes,
903				    /*read_op*/ 1,
904				    /*byte2*/ 0,
905				    /*minimum_cdb_size*/ 0,
906				    /*lba*/ srclba,
907				    /*num_blocks*/ roundbytes / srcblock,
908				    /*tag_type*/ CTL_TAG_SIMPLE,
909				    /*control*/ 0);
910		tior->io->io_hdr.retries = 3;
911		tior->target = SSD_FORWARDED_SDS_EXSRC;
912		tior->cscd = scscd;
913		tior->lun = sl;
914		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
915
916		tiow = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
917		TAILQ_INIT(&tiow->run);
918		tiow->list = list;
919		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
920		tiow->io = tpcl_alloc_io();
921		ctl_scsi_read_write(tiow->io,
922				    /*data_ptr*/ &list->buf[donebytes],
923				    /*data_len*/ roundbytes,
924				    /*read_op*/ 0,
925				    /*byte2*/ 0,
926				    /*minimum_cdb_size*/ 0,
927				    /*lba*/ dstlba,
928				    /*num_blocks*/ roundbytes / dstblock,
929				    /*tag_type*/ CTL_TAG_SIMPLE,
930				    /*control*/ 0);
931		tiow->io->io_hdr.retries = 3;
932		tiow->target = SSD_FORWARDED_SDS_EXDST;
933		tiow->cscd = dcscd;
934		tiow->lun = dl;
935		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
936
937		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
938		TAILQ_INSERT_TAIL(&run, tior, rlinks);
939		list->tbdio++;
940		donebytes += roundbytes;
941		srclba += roundbytes / srcblock;
942		dstlba += roundbytes / dstblock;
943	}
944
945	while ((tior = TAILQ_FIRST(&run)) != NULL) {
946		TAILQ_REMOVE(&run, tior, rlinks);
947		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
948			panic("tpcl_queue() error");
949	}
950
951	list->stage++;
952	return (CTL_RETVAL_QUEUED);
953}
954
955static int
956tpc_process_verify(struct tpc_list *list)
957{
958	struct scsi_ec_segment_verify *seg;
959	struct tpc_io *tio;
960	uint64_t sl;
961	uint16_t cscd;
962	uint8_t csi[4];
963
964	scsi_ulto4b(list->curseg, csi);
965	if (list->stage == 1) {
966		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
967			TAILQ_REMOVE(&list->allio, tio, links);
968			ctl_free_io(tio->io);
969			free(tio, M_CTL);
970		}
971		if (list->abort) {
972			ctl_set_task_aborted(list->ctsio);
973			return (CTL_RETVAL_ERROR);
974		} else if (list->error) {
975			tpc_set_io_error_sense(list);
976			return (CTL_RETVAL_ERROR);
977		} else
978			return (CTL_RETVAL_COMPLETE);
979	}
980
981	TAILQ_INIT(&list->allio);
982	seg = (struct scsi_ec_segment_verify *)list->seg[list->curseg];
983	cscd = scsi_2btoul(seg->src_cscd);
984	sl = tpc_resolve(list, cscd, NULL, NULL, NULL);
985	if (sl == UINT64_MAX) {
986		ctl_set_sense(list->ctsio, /*current_error*/ 1,
987		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
988		    /*asc*/ 0x08, /*ascq*/ 0x04,
989		    SSD_ELEM_COMMAND, sizeof(csi), csi,
990		    SSD_ELEM_NONE);
991		return (CTL_RETVAL_ERROR);
992	}
993
994//	printf("Verify %ju\n", sl);
995
996	if ((seg->tur & 0x01) == 0)
997		return (CTL_RETVAL_COMPLETE);
998
999	list->tbdio = 1;
1000	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1001	TAILQ_INIT(&tio->run);
1002	tio->list = list;
1003	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1004	tio->io = tpcl_alloc_io();
1005	ctl_scsi_tur(tio->io, /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1006	tio->io->io_hdr.retries = 3;
1007	tio->target = SSD_FORWARDED_SDS_EXSRC;
1008	tio->cscd = cscd;
1009	tio->lun = sl;
1010	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1011	list->stage++;
1012	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1013		panic("tpcl_queue() error");
1014	return (CTL_RETVAL_QUEUED);
1015}
1016
1017static int
1018tpc_process_register_key(struct tpc_list *list)
1019{
1020	struct scsi_ec_segment_register_key *seg;
1021	struct tpc_io *tio;
1022	uint64_t dl;
1023	int datalen;
1024	uint16_t cscd;
1025	uint8_t csi[4];
1026
1027	scsi_ulto4b(list->curseg, csi);
1028	if (list->stage == 1) {
1029		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1030			TAILQ_REMOVE(&list->allio, tio, links);
1031			ctl_free_io(tio->io);
1032			free(tio, M_CTL);
1033		}
1034		free(list->buf, M_CTL);
1035		if (list->abort) {
1036			ctl_set_task_aborted(list->ctsio);
1037			return (CTL_RETVAL_ERROR);
1038		} else if (list->error) {
1039			tpc_set_io_error_sense(list);
1040			return (CTL_RETVAL_ERROR);
1041		} else
1042			return (CTL_RETVAL_COMPLETE);
1043	}
1044
1045	TAILQ_INIT(&list->allio);
1046	seg = (struct scsi_ec_segment_register_key *)list->seg[list->curseg];
1047	cscd = scsi_2btoul(seg->dst_cscd);
1048	dl = tpc_resolve(list, cscd, NULL, NULL, NULL);
1049	if (dl == UINT64_MAX) {
1050		ctl_set_sense(list->ctsio, /*current_error*/ 1,
1051		    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1052		    /*asc*/ 0x08, /*ascq*/ 0x04,
1053		    SSD_ELEM_COMMAND, sizeof(csi), csi,
1054		    SSD_ELEM_NONE);
1055		return (CTL_RETVAL_ERROR);
1056	}
1057
1058//	printf("Register Key %ju\n", dl);
1059
1060	list->tbdio = 1;
1061	tio = malloc(sizeof(*tio), M_CTL, M_WAITOK | M_ZERO);
1062	TAILQ_INIT(&tio->run);
1063	tio->list = list;
1064	TAILQ_INSERT_TAIL(&list->allio, tio, links);
1065	tio->io = tpcl_alloc_io();
1066	datalen = sizeof(struct scsi_per_res_out_parms);
1067	list->buf = malloc(datalen, M_CTL, M_WAITOK);
1068	ctl_scsi_persistent_res_out(tio->io,
1069	    list->buf, datalen, SPRO_REGISTER, -1,
1070	    scsi_8btou64(seg->res_key), scsi_8btou64(seg->sa_res_key),
1071	    /*tag_type*/ CTL_TAG_SIMPLE, /*control*/ 0);
1072	tio->io->io_hdr.retries = 3;
1073	tio->target = SSD_FORWARDED_SDS_EXDST;
1074	tio->cscd = cscd;
1075	tio->lun = dl;
1076	tio->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tio;
1077	list->stage++;
1078	if (tpcl_queue(tio->io, tio->lun) != CTL_RETVAL_COMPLETE)
1079		panic("tpcl_queue() error");
1080	return (CTL_RETVAL_QUEUED);
1081}
1082
1083static off_t
1084tpc_ranges_length(struct scsi_range_desc *range, int nrange)
1085{
1086	off_t length = 0;
1087	int r;
1088
1089	for (r = 0; r < nrange; r++)
1090		length += scsi_4btoul(range[r].length);
1091	return (length);
1092}
1093
1094static int
1095tpc_check_ranges_l(struct scsi_range_desc *range, int nrange, uint64_t maxlba,
1096    uint64_t *lba)
1097{
1098	uint64_t b1;
1099	uint32_t l1;
1100	int i;
1101
1102	for (i = 0; i < nrange; i++) {
1103		b1 = scsi_8btou64(range[i].lba);
1104		l1 = scsi_4btoul(range[i].length);
1105		if (b1 + l1 < b1 || b1 + l1 > maxlba + 1) {
1106			*lba = MAX(b1, maxlba + 1);
1107			return (-1);
1108		}
1109	}
1110	return (0);
1111}
1112
1113static int
1114tpc_check_ranges_x(struct scsi_range_desc *range, int nrange)
1115{
1116	uint64_t b1, b2;
1117	uint32_t l1, l2;
1118	int i, j;
1119
1120	for (i = 0; i < nrange - 1; i++) {
1121		b1 = scsi_8btou64(range[i].lba);
1122		l1 = scsi_4btoul(range[i].length);
1123		for (j = i + 1; j < nrange; j++) {
1124			b2 = scsi_8btou64(range[j].lba);
1125			l2 = scsi_4btoul(range[j].length);
1126			if (b1 + l1 > b2 && b2 + l2 > b1)
1127				return (-1);
1128		}
1129	}
1130	return (0);
1131}
1132
1133static int
1134tpc_skip_ranges(struct scsi_range_desc *range, int nrange, off_t skip,
1135    int *srange, off_t *soffset)
1136{
1137	off_t off;
1138	int r;
1139
1140	r = 0;
1141	off = 0;
1142	while (r < nrange) {
1143		if (skip - off < scsi_4btoul(range[r].length)) {
1144			*srange = r;
1145			*soffset = skip - off;
1146			return (0);
1147		}
1148		off += scsi_4btoul(range[r].length);
1149		r++;
1150	}
1151	return (-1);
1152}
1153
1154static int
1155tpc_process_wut(struct tpc_list *list)
1156{
1157	struct tpc_io *tio, *tior, *tiow;
1158	struct runl run;
1159	int drange, srange;
1160	off_t doffset, soffset;
1161	off_t srclba, dstlba, numbytes, donebytes, roundbytes;
1162	uint32_t srcblock, dstblock, pb, pbo, adj;
1163
1164	if (list->stage > 0) {
1165		/* Cleanup after previous rounds. */
1166		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1167			TAILQ_REMOVE(&list->allio, tio, links);
1168			ctl_free_io(tio->io);
1169			free(tio, M_CTL);
1170		}
1171		free(list->buf, M_CTL);
1172		if (list->abort) {
1173			ctl_set_task_aborted(list->ctsio);
1174			return (CTL_RETVAL_ERROR);
1175		} else if (list->error) {
1176			if (list->fwd_scsi_status) {
1177				list->ctsio->io_hdr.status =
1178				    CTL_SCSI_ERROR | CTL_AUTOSENSE;
1179				list->ctsio->scsi_status = list->fwd_scsi_status;
1180				list->ctsio->sense_data = list->fwd_sense_data;
1181				list->ctsio->sense_len = list->fwd_sense_len;
1182			} else {
1183				ctl_set_invalid_field(list->ctsio,
1184				    /*sks_valid*/ 0, /*command*/ 0,
1185				    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1186			}
1187			return (CTL_RETVAL_ERROR);
1188		}
1189		list->cursectors += list->segsectors;
1190		list->curbytes += list->segbytes;
1191	}
1192
1193	/* Check where we are on destination ranges list. */
1194	if (tpc_skip_ranges(list->range, list->nrange, list->cursectors,
1195	    &drange, &doffset) != 0)
1196		return (CTL_RETVAL_COMPLETE);
1197	dstblock = list->lun->be_lun->blocksize;
1198	pb = dstblock << list->lun->be_lun->pblockexp;
1199	if (list->lun->be_lun->pblockoff > 0)
1200		pbo = pb - dstblock * list->lun->be_lun->pblockoff;
1201	else
1202		pbo = 0;
1203
1204	/* Check where we are on source ranges list. */
1205	srcblock = list->token->blocksize;
1206	if (tpc_skip_ranges(list->token->range, list->token->nrange,
1207	    list->offset_into_rod + list->cursectors * dstblock / srcblock,
1208	    &srange, &soffset) != 0) {
1209		ctl_set_invalid_field(list->ctsio, /*sks_valid*/ 0,
1210		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1211		return (CTL_RETVAL_ERROR);
1212	}
1213
1214	srclba = scsi_8btou64(list->token->range[srange].lba) + soffset;
1215	dstlba = scsi_8btou64(list->range[drange].lba) + doffset;
1216	numbytes = srcblock *
1217	    (scsi_4btoul(list->token->range[srange].length) - soffset);
1218	numbytes = omin(numbytes, dstblock *
1219	    (scsi_4btoul(list->range[drange].length) - doffset));
1220	if (numbytes > TPC_MAX_IOCHUNK_SIZE) {
1221		numbytes = TPC_MAX_IOCHUNK_SIZE;
1222		numbytes -= numbytes % dstblock;
1223		if (pb > dstblock) {
1224			adj = (dstlba * dstblock + numbytes - pbo) % pb;
1225			if (numbytes > adj)
1226				numbytes -= adj;
1227		}
1228	}
1229
1230	if (numbytes % srcblock != 0 || numbytes % dstblock != 0) {
1231		ctl_set_invalid_field(list->ctsio, /*sks_valid*/ 0,
1232		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1233		return (CTL_RETVAL_ERROR);
1234	}
1235
1236	list->buf = malloc(numbytes, M_CTL, M_WAITOK |
1237	    (list->token == NULL ? M_ZERO : 0));
1238	list->segbytes = numbytes;
1239	list->segsectors = numbytes / dstblock;
1240//printf("Copy chunk of %ju sectors from %ju to %ju\n", list->segsectors,
1241//    srclba, dstlba);
1242	donebytes = 0;
1243	TAILQ_INIT(&run);
1244	list->tbdio = 0;
1245	TAILQ_INIT(&list->allio);
1246	while (donebytes < numbytes) {
1247		roundbytes = numbytes - donebytes;
1248		if (roundbytes > TPC_MAX_IO_SIZE) {
1249			roundbytes = TPC_MAX_IO_SIZE;
1250			roundbytes -= roundbytes % dstblock;
1251			if (pb > dstblock) {
1252				adj = (dstlba * dstblock + roundbytes - pbo) % pb;
1253				if (roundbytes > adj)
1254					roundbytes -= adj;
1255			}
1256		}
1257
1258		tior = malloc(sizeof(*tior), M_CTL, M_WAITOK | M_ZERO);
1259		TAILQ_INIT(&tior->run);
1260		tior->list = list;
1261		TAILQ_INSERT_TAIL(&list->allio, tior, links);
1262		tior->io = tpcl_alloc_io();
1263		ctl_scsi_read_write(tior->io,
1264				    /*data_ptr*/ &list->buf[donebytes],
1265				    /*data_len*/ roundbytes,
1266				    /*read_op*/ 1,
1267				    /*byte2*/ 0,
1268				    /*minimum_cdb_size*/ 0,
1269				    /*lba*/ srclba,
1270				    /*num_blocks*/ roundbytes / srcblock,
1271				    /*tag_type*/ CTL_TAG_SIMPLE,
1272				    /*control*/ 0);
1273		tior->io->io_hdr.retries = 3;
1274		tior->lun = list->token->lun;
1275		tior->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tior;
1276
1277		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1278		TAILQ_INIT(&tiow->run);
1279		tiow->list = list;
1280		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1281		tiow->io = tpcl_alloc_io();
1282		ctl_scsi_read_write(tiow->io,
1283				    /*data_ptr*/ &list->buf[donebytes],
1284				    /*data_len*/ roundbytes,
1285				    /*read_op*/ 0,
1286				    /*byte2*/ 0,
1287				    /*minimum_cdb_size*/ 0,
1288				    /*lba*/ dstlba,
1289				    /*num_blocks*/ roundbytes / dstblock,
1290				    /*tag_type*/ CTL_TAG_SIMPLE,
1291				    /*control*/ 0);
1292		tiow->io->io_hdr.retries = 3;
1293		tiow->lun = list->lun->lun;
1294		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1295
1296		TAILQ_INSERT_TAIL(&tior->run, tiow, rlinks);
1297		TAILQ_INSERT_TAIL(&run, tior, rlinks);
1298		list->tbdio++;
1299		donebytes += roundbytes;
1300		srclba += roundbytes / srcblock;
1301		dstlba += roundbytes / dstblock;
1302	}
1303
1304	while ((tior = TAILQ_FIRST(&run)) != NULL) {
1305		TAILQ_REMOVE(&run, tior, rlinks);
1306		if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1307			panic("tpcl_queue() error");
1308	}
1309
1310	list->stage++;
1311	return (CTL_RETVAL_QUEUED);
1312}
1313
1314static int
1315tpc_process_zero_wut(struct tpc_list *list)
1316{
1317	struct tpc_io *tio, *tiow;
1318	struct runl run, *prun;
1319	int r;
1320	uint32_t dstblock, len;
1321
1322	if (list->stage > 0) {
1323complete:
1324		/* Cleanup after previous rounds. */
1325		while ((tio = TAILQ_FIRST(&list->allio)) != NULL) {
1326			TAILQ_REMOVE(&list->allio, tio, links);
1327			ctl_free_io(tio->io);
1328			free(tio, M_CTL);
1329		}
1330		if (list->abort) {
1331			ctl_set_task_aborted(list->ctsio);
1332			return (CTL_RETVAL_ERROR);
1333		} else if (list->error) {
1334			if (list->fwd_scsi_status) {
1335				list->ctsio->io_hdr.status =
1336				    CTL_SCSI_ERROR | CTL_AUTOSENSE;
1337				list->ctsio->scsi_status = list->fwd_scsi_status;
1338				list->ctsio->sense_data = list->fwd_sense_data;
1339				list->ctsio->sense_len = list->fwd_sense_len;
1340			} else {
1341				ctl_set_invalid_field(list->ctsio,
1342				    /*sks_valid*/ 0, /*command*/ 0,
1343				    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
1344			}
1345			return (CTL_RETVAL_ERROR);
1346		}
1347		list->cursectors += list->segsectors;
1348		list->curbytes += list->segbytes;
1349		return (CTL_RETVAL_COMPLETE);
1350	}
1351
1352	dstblock = list->lun->be_lun->blocksize;
1353	TAILQ_INIT(&run);
1354	prun = &run;
1355	list->tbdio = 1;
1356	TAILQ_INIT(&list->allio);
1357	list->segsectors = 0;
1358	for (r = 0; r < list->nrange; r++) {
1359		len = scsi_4btoul(list->range[r].length);
1360		if (len == 0)
1361			continue;
1362
1363		tiow = malloc(sizeof(*tiow), M_CTL, M_WAITOK | M_ZERO);
1364		TAILQ_INIT(&tiow->run);
1365		tiow->list = list;
1366		TAILQ_INSERT_TAIL(&list->allio, tiow, links);
1367		tiow->io = tpcl_alloc_io();
1368		ctl_scsi_write_same(tiow->io,
1369				    /*data_ptr*/ NULL,
1370				    /*data_len*/ 0,
1371				    /*byte2*/ SWS_NDOB,
1372				    /*lba*/ scsi_8btou64(list->range[r].lba),
1373				    /*num_blocks*/ len,
1374				    /*tag_type*/ CTL_TAG_SIMPLE,
1375				    /*control*/ 0);
1376		tiow->io->io_hdr.retries = 3;
1377		tiow->lun = list->lun->lun;
1378		tiow->io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = tiow;
1379
1380		TAILQ_INSERT_TAIL(prun, tiow, rlinks);
1381		prun = &tiow->run;
1382		list->segsectors += len;
1383	}
1384	list->segbytes = list->segsectors * dstblock;
1385
1386	if (TAILQ_EMPTY(&run))
1387		goto complete;
1388
1389	while ((tiow = TAILQ_FIRST(&run)) != NULL) {
1390		TAILQ_REMOVE(&run, tiow, rlinks);
1391		if (tpcl_queue(tiow->io, tiow->lun) != CTL_RETVAL_COMPLETE)
1392			panic("tpcl_queue() error");
1393	}
1394
1395	list->stage++;
1396	return (CTL_RETVAL_QUEUED);
1397}
1398
1399static void
1400tpc_process(struct tpc_list *list)
1401{
1402	struct ctl_lun *lun = list->lun;
1403	struct ctl_softc *softc = lun->ctl_softc;
1404	struct scsi_ec_segment *seg;
1405	struct ctl_scsiio *ctsio = list->ctsio;
1406	int retval = CTL_RETVAL_COMPLETE;
1407	uint8_t csi[4];
1408
1409	if (list->service_action == EC_WUT) {
1410		if (list->token != NULL)
1411			retval = tpc_process_wut(list);
1412		else
1413			retval = tpc_process_zero_wut(list);
1414		if (retval == CTL_RETVAL_QUEUED)
1415			return;
1416		if (retval == CTL_RETVAL_ERROR) {
1417			list->error = 1;
1418			goto done;
1419		}
1420	} else {
1421//printf("ZZZ %d cscd, %d segs\n", list->ncscd, list->nseg);
1422		while (list->curseg < list->nseg) {
1423			seg = list->seg[list->curseg];
1424			switch (seg->type_code) {
1425			case EC_SEG_B2B:
1426				retval = tpc_process_b2b(list);
1427				break;
1428			case EC_SEG_VERIFY:
1429				retval = tpc_process_verify(list);
1430				break;
1431			case EC_SEG_REGISTER_KEY:
1432				retval = tpc_process_register_key(list);
1433				break;
1434			default:
1435				scsi_ulto4b(list->curseg, csi);
1436				ctl_set_sense(ctsio, /*current_error*/ 1,
1437				    /*sense_key*/ SSD_KEY_COPY_ABORTED,
1438				    /*asc*/ 0x26, /*ascq*/ 0x09,
1439				    SSD_ELEM_COMMAND, sizeof(csi), csi,
1440				    SSD_ELEM_NONE);
1441				goto done;
1442			}
1443			if (retval == CTL_RETVAL_QUEUED)
1444				return;
1445			if (retval == CTL_RETVAL_ERROR) {
1446				list->error = 1;
1447				goto done;
1448			}
1449			list->curseg++;
1450			list->stage = 0;
1451		}
1452	}
1453
1454	ctl_set_success(ctsio);
1455
1456done:
1457//printf("ZZZ done\n");
1458	free(list->params, M_CTL);
1459	list->params = NULL;
1460	if (list->token) {
1461		mtx_lock(&softc->tpc_lock);
1462		if (--list->token->active == 0)
1463			list->token->last_active = time_uptime;
1464		mtx_unlock(&softc->tpc_lock);
1465		list->token = NULL;
1466	}
1467	mtx_lock(&lun->lun_lock);
1468	if ((list->flags & EC_LIST_ID_USAGE_MASK) == EC_LIST_ID_USAGE_NONE) {
1469		TAILQ_REMOVE(&lun->tpc_lists, list, links);
1470		free(list, M_CTL);
1471	} else {
1472		list->completed = 1;
1473		list->last_active = time_uptime;
1474		list->sense_data = ctsio->sense_data;
1475		list->sense_len = ctsio->sense_len;
1476		list->scsi_status = ctsio->scsi_status;
1477	}
1478	mtx_unlock(&lun->lun_lock);
1479
1480	ctl_done((union ctl_io *)ctsio);
1481}
1482
1483/*
1484 * For any sort of check condition, busy, etc., we just retry.  We do not
1485 * decrement the retry count for unit attention type errors.  These are
1486 * normal, and we want to save the retry count for "real" errors.  Otherwise,
1487 * we could end up with situations where a command will succeed in some
1488 * situations and fail in others, depending on whether a unit attention is
1489 * pending.  Also, some of our error recovery actions, most notably the
1490 * LUN reset action, will cause a unit attention.
1491 *
1492 * We can add more detail here later if necessary.
1493 */
1494static tpc_error_action
1495tpc_checkcond_parse(union ctl_io *io)
1496{
1497	tpc_error_action error_action;
1498	int error_code, sense_key, asc, ascq;
1499
1500	/*
1501	 * Default to retrying the command.
1502	 */
1503	error_action = TPC_ERR_RETRY;
1504
1505	scsi_extract_sense_len(&io->scsiio.sense_data,
1506			       io->scsiio.sense_len,
1507			       &error_code,
1508			       &sense_key,
1509			       &asc,
1510			       &ascq,
1511			       /*show_errors*/ 1);
1512
1513	switch (error_code) {
1514	case SSD_DEFERRED_ERROR:
1515	case SSD_DESC_DEFERRED_ERROR:
1516		error_action |= TPC_ERR_NO_DECREMENT;
1517		break;
1518	case SSD_CURRENT_ERROR:
1519	case SSD_DESC_CURRENT_ERROR:
1520	default:
1521		switch (sense_key) {
1522		case SSD_KEY_UNIT_ATTENTION:
1523			error_action |= TPC_ERR_NO_DECREMENT;
1524			break;
1525		case SSD_KEY_HARDWARE_ERROR:
1526			/*
1527			 * This is our generic "something bad happened"
1528			 * error code.  It often isn't recoverable.
1529			 */
1530			if ((asc == 0x44) && (ascq == 0x00))
1531				error_action = TPC_ERR_FAIL;
1532			break;
1533		case SSD_KEY_NOT_READY:
1534			/*
1535			 * If the LUN is powered down, there likely isn't
1536			 * much point in retrying right now.
1537			 */
1538			if ((asc == 0x04) && (ascq == 0x02))
1539				error_action = TPC_ERR_FAIL;
1540			/*
1541			 * If the LUN is offline, there probably isn't much
1542			 * point in retrying, either.
1543			 */
1544			if ((asc == 0x04) && (ascq == 0x03))
1545				error_action = TPC_ERR_FAIL;
1546			break;
1547		}
1548	}
1549	return (error_action);
1550}
1551
1552static tpc_error_action
1553tpc_error_parse(union ctl_io *io)
1554{
1555	tpc_error_action error_action = TPC_ERR_RETRY;
1556
1557	switch (io->io_hdr.io_type) {
1558	case CTL_IO_SCSI:
1559		switch (io->io_hdr.status & CTL_STATUS_MASK) {
1560		case CTL_SCSI_ERROR:
1561			switch (io->scsiio.scsi_status) {
1562			case SCSI_STATUS_CHECK_COND:
1563				error_action = tpc_checkcond_parse(io);
1564				break;
1565			default:
1566				break;
1567			}
1568			break;
1569		default:
1570			break;
1571		}
1572		break;
1573	case CTL_IO_TASK:
1574		break;
1575	default:
1576		panic("%s: invalid ctl_io type %d\n", __func__,
1577		      io->io_hdr.io_type);
1578		break;
1579	}
1580	return (error_action);
1581}
1582
1583void
1584tpc_done(union ctl_io *io)
1585{
1586	struct tpc_io *tio, *tior;
1587
1588	/*
1589	 * Very minimal retry logic.  We basically retry if we got an error
1590	 * back, and the retry count is greater than 0.  If we ever want
1591	 * more sophisticated initiator type behavior, the CAM error
1592	 * recovery code in ../common might be helpful.
1593	 */
1594	tio = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1595	if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
1596	 && (io->io_hdr.retries > 0)) {
1597		ctl_io_status old_status;
1598		tpc_error_action error_action;
1599
1600		error_action = tpc_error_parse(io);
1601		switch (error_action & TPC_ERR_MASK) {
1602		case TPC_ERR_FAIL:
1603			break;
1604		case TPC_ERR_RETRY:
1605		default:
1606			if ((error_action & TPC_ERR_NO_DECREMENT) == 0)
1607				io->io_hdr.retries--;
1608			old_status = io->io_hdr.status;
1609			io->io_hdr.status = CTL_STATUS_NONE;
1610			io->io_hdr.flags &= ~CTL_FLAG_ABORT;
1611			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
1612			if (tpcl_queue(io, tio->lun) != CTL_RETVAL_COMPLETE) {
1613				printf("%s: error returned from ctl_queue()!\n",
1614				       __func__);
1615				io->io_hdr.status = old_status;
1616			} else
1617				return;
1618		}
1619	}
1620
1621	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS) {
1622		tio->list->error = 1;
1623		if (io->io_hdr.io_type == CTL_IO_SCSI &&
1624		    (io->io_hdr.status & CTL_STATUS_MASK) == CTL_SCSI_ERROR) {
1625			tio->list->fwd_scsi_status = io->scsiio.scsi_status;
1626			tio->list->fwd_sense_data = io->scsiio.sense_data;
1627			tio->list->fwd_sense_len = io->scsiio.sense_len;
1628			tio->list->fwd_target = tio->target;
1629			tio->list->fwd_cscd = tio->cscd;
1630		}
1631	} else
1632		atomic_add_int(&tio->list->curops, 1);
1633	if (!tio->list->error && !tio->list->abort) {
1634		while ((tior = TAILQ_FIRST(&tio->run)) != NULL) {
1635			TAILQ_REMOVE(&tio->run, tior, rlinks);
1636			atomic_add_int(&tio->list->tbdio, 1);
1637			if (tpcl_queue(tior->io, tior->lun) != CTL_RETVAL_COMPLETE)
1638				panic("tpcl_queue() error");
1639		}
1640	}
1641	if (atomic_fetchadd_int(&tio->list->tbdio, -1) == 1)
1642		tpc_process(tio->list);
1643}
1644
1645int
1646ctl_extended_copy_lid1(struct ctl_scsiio *ctsio)
1647{
1648	struct ctl_lun *lun = CTL_LUN(ctsio);
1649	struct scsi_extended_copy *cdb;
1650	struct scsi_extended_copy_lid1_data *data;
1651	struct scsi_ec_cscd *cscd;
1652	struct scsi_ec_segment *seg;
1653	struct tpc_list *list, *tlist;
1654	uint8_t *ptr;
1655	char *value;
1656	int len, off, lencscd, lenseg, leninl, nseg;
1657
1658	CTL_DEBUG_PRINT(("ctl_extended_copy_lid1\n"));
1659
1660	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1661	len = scsi_4btoul(cdb->length);
1662
1663	if (len == 0) {
1664		ctl_set_success(ctsio);
1665		goto done;
1666	}
1667	if (len < sizeof(struct scsi_extended_copy_lid1_data) ||
1668	    len > sizeof(struct scsi_extended_copy_lid1_data) +
1669	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1670		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1671		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1672		goto done;
1673	}
1674
1675	/*
1676	 * If we've got a kernel request that hasn't been malloced yet,
1677	 * malloc it and tell the caller the data buffer is here.
1678	 */
1679	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1680		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1681		ctsio->kern_data_len = len;
1682		ctsio->kern_total_len = len;
1683		ctsio->kern_rel_offset = 0;
1684		ctsio->kern_sg_entries = 0;
1685		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1686		ctsio->be_move_done = ctl_config_move_done;
1687		ctl_datamove((union ctl_io *)ctsio);
1688
1689		return (CTL_RETVAL_COMPLETE);
1690	}
1691
1692	data = (struct scsi_extended_copy_lid1_data *)ctsio->kern_data_ptr;
1693	lencscd = scsi_2btoul(data->cscd_list_length);
1694	lenseg = scsi_4btoul(data->segment_list_length);
1695	leninl = scsi_4btoul(data->inline_data_length);
1696	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1697		ctl_set_sense(ctsio, /*current_error*/ 1,
1698		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1699		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1700		goto done;
1701	}
1702	if (lenseg > TPC_MAX_SEGS * sizeof(struct scsi_ec_segment)) {
1703		ctl_set_sense(ctsio, /*current_error*/ 1,
1704		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1705		    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1706		goto done;
1707	}
1708	if (lencscd + lenseg > TPC_MAX_LIST ||
1709	    leninl > TPC_MAX_INLINE ||
1710	    len < sizeof(struct scsi_extended_copy_lid1_data) +
1711	     lencscd + lenseg + leninl) {
1712		ctl_set_param_len_error(ctsio);
1713		goto done;
1714	}
1715
1716	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1717	list->service_action = cdb->service_action;
1718	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1719	if (value != NULL && strcmp(value, "on") == 0)
1720		list->init_port = -1;
1721	else
1722		list->init_port = ctsio->io_hdr.nexus.targ_port;
1723	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
1724	list->list_id = data->list_identifier;
1725	list->flags = data->flags;
1726	list->params = ctsio->kern_data_ptr;
1727	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1728	ptr = &data->data[0];
1729	for (off = 0; off < lencscd; off += sizeof(struct scsi_ec_cscd)) {
1730		cscd = (struct scsi_ec_cscd *)(ptr + off);
1731		if (cscd->type_code != EC_CSCD_ID) {
1732			free(list, M_CTL);
1733			ctl_set_sense(ctsio, /*current_error*/ 1,
1734			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1735			    /*asc*/ 0x26, /*ascq*/ 0x07, SSD_ELEM_NONE);
1736			goto done;
1737		}
1738	}
1739	ptr = &data->data[lencscd];
1740	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1741		if (nseg >= TPC_MAX_SEGS) {
1742			free(list, M_CTL);
1743			ctl_set_sense(ctsio, /*current_error*/ 1,
1744			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1745			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1746			goto done;
1747		}
1748		seg = (struct scsi_ec_segment *)(ptr + off);
1749		if (seg->type_code != EC_SEG_B2B &&
1750		    seg->type_code != EC_SEG_VERIFY &&
1751		    seg->type_code != EC_SEG_REGISTER_KEY) {
1752			free(list, M_CTL);
1753			ctl_set_sense(ctsio, /*current_error*/ 1,
1754			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1755			    /*asc*/ 0x26, /*ascq*/ 0x09, SSD_ELEM_NONE);
1756			goto done;
1757		}
1758		list->seg[nseg] = seg;
1759		off += sizeof(struct scsi_ec_segment) +
1760		    scsi_2btoul(seg->descr_length);
1761	}
1762	list->inl = &data->data[lencscd + lenseg];
1763	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1764	list->nseg = nseg;
1765	list->leninl = leninl;
1766	list->ctsio = ctsio;
1767	list->lun = lun;
1768	mtx_lock(&lun->lun_lock);
1769	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1770		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1771		if (tlist != NULL && !tlist->completed) {
1772			mtx_unlock(&lun->lun_lock);
1773			free(list, M_CTL);
1774			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1775			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1776			    /*bit*/ 0);
1777			goto done;
1778		}
1779		if (tlist != NULL) {
1780			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1781			free(tlist, M_CTL);
1782		}
1783	}
1784	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1785	mtx_unlock(&lun->lun_lock);
1786
1787	tpc_process(list);
1788	return (CTL_RETVAL_COMPLETE);
1789
1790done:
1791	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
1792		free(ctsio->kern_data_ptr, M_CTL);
1793		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
1794	}
1795	ctl_done((union ctl_io *)ctsio);
1796	return (CTL_RETVAL_COMPLETE);
1797}
1798
1799int
1800ctl_extended_copy_lid4(struct ctl_scsiio *ctsio)
1801{
1802	struct ctl_lun *lun = CTL_LUN(ctsio);
1803	struct scsi_extended_copy *cdb;
1804	struct scsi_extended_copy_lid4_data *data;
1805	struct scsi_ec_cscd *cscd;
1806	struct scsi_ec_segment *seg;
1807	struct tpc_list *list, *tlist;
1808	uint8_t *ptr;
1809	char *value;
1810	int len, off, lencscd, lenseg, leninl, nseg;
1811
1812	CTL_DEBUG_PRINT(("ctl_extended_copy_lid4\n"));
1813
1814	cdb = (struct scsi_extended_copy *)ctsio->cdb;
1815	len = scsi_4btoul(cdb->length);
1816
1817	if (len == 0) {
1818		ctl_set_success(ctsio);
1819		goto done;
1820	}
1821	if (len < sizeof(struct scsi_extended_copy_lid4_data) ||
1822	    len > sizeof(struct scsi_extended_copy_lid4_data) +
1823	    TPC_MAX_LIST + TPC_MAX_INLINE) {
1824		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
1825		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
1826		goto done;
1827	}
1828
1829	/*
1830	 * If we've got a kernel request that hasn't been malloced yet,
1831	 * malloc it and tell the caller the data buffer is here.
1832	 */
1833	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
1834		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
1835		ctsio->kern_data_len = len;
1836		ctsio->kern_total_len = len;
1837		ctsio->kern_rel_offset = 0;
1838		ctsio->kern_sg_entries = 0;
1839		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
1840		ctsio->be_move_done = ctl_config_move_done;
1841		ctl_datamove((union ctl_io *)ctsio);
1842
1843		return (CTL_RETVAL_COMPLETE);
1844	}
1845
1846	data = (struct scsi_extended_copy_lid4_data *)ctsio->kern_data_ptr;
1847	lencscd = scsi_2btoul(data->cscd_list_length);
1848	lenseg = scsi_2btoul(data->segment_list_length);
1849	leninl = scsi_2btoul(data->inline_data_length);
1850	if (lencscd > TPC_MAX_CSCDS * sizeof(struct scsi_ec_cscd)) {
1851		ctl_set_sense(ctsio, /*current_error*/ 1,
1852		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1853		    /*asc*/ 0x26, /*ascq*/ 0x06, SSD_ELEM_NONE);
1854		goto done;
1855	}
1856	if (lenseg > TPC_MAX_SEGS * sizeof(struct scsi_ec_segment)) {
1857		ctl_set_sense(ctsio, /*current_error*/ 1,
1858		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1859		    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1860		goto done;
1861	}
1862	if (lencscd + lenseg > TPC_MAX_LIST ||
1863	    leninl > TPC_MAX_INLINE ||
1864	    len < sizeof(struct scsi_extended_copy_lid1_data) +
1865	     lencscd + lenseg + leninl) {
1866		ctl_set_param_len_error(ctsio);
1867		goto done;
1868	}
1869
1870	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
1871	list->service_action = cdb->service_action;
1872	value = ctl_get_opt(&lun->be_lun->options, "insecure_tpc");
1873	if (value != NULL && strcmp(value, "on") == 0)
1874		list->init_port = -1;
1875	else
1876		list->init_port = ctsio->io_hdr.nexus.targ_port;
1877	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
1878	list->list_id = scsi_4btoul(data->list_identifier);
1879	list->flags = data->flags;
1880	list->params = ctsio->kern_data_ptr;
1881	list->cscd = (struct scsi_ec_cscd *)&data->data[0];
1882	ptr = &data->data[0];
1883	for (off = 0; off < lencscd; off += sizeof(struct scsi_ec_cscd)) {
1884		cscd = (struct scsi_ec_cscd *)(ptr + off);
1885		if (cscd->type_code != EC_CSCD_ID) {
1886			free(list, M_CTL);
1887			ctl_set_sense(ctsio, /*current_error*/ 1,
1888			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1889			    /*asc*/ 0x26, /*ascq*/ 0x07, SSD_ELEM_NONE);
1890			goto done;
1891		}
1892	}
1893	ptr = &data->data[lencscd];
1894	for (nseg = 0, off = 0; off < lenseg; nseg++) {
1895		if (nseg >= TPC_MAX_SEGS) {
1896			free(list, M_CTL);
1897			ctl_set_sense(ctsio, /*current_error*/ 1,
1898			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1899			    /*asc*/ 0x26, /*ascq*/ 0x08, SSD_ELEM_NONE);
1900			goto done;
1901		}
1902		seg = (struct scsi_ec_segment *)(ptr + off);
1903		if (seg->type_code != EC_SEG_B2B &&
1904		    seg->type_code != EC_SEG_VERIFY &&
1905		    seg->type_code != EC_SEG_REGISTER_KEY) {
1906			free(list, M_CTL);
1907			ctl_set_sense(ctsio, /*current_error*/ 1,
1908			    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1909			    /*asc*/ 0x26, /*ascq*/ 0x09, SSD_ELEM_NONE);
1910			goto done;
1911		}
1912		list->seg[nseg] = seg;
1913		off += sizeof(struct scsi_ec_segment) +
1914		    scsi_2btoul(seg->descr_length);
1915	}
1916	list->inl = &data->data[lencscd + lenseg];
1917	list->ncscd = lencscd / sizeof(struct scsi_ec_cscd);
1918	list->nseg = nseg;
1919	list->leninl = leninl;
1920	list->ctsio = ctsio;
1921	list->lun = lun;
1922	mtx_lock(&lun->lun_lock);
1923	if ((list->flags & EC_LIST_ID_USAGE_MASK) != EC_LIST_ID_USAGE_NONE) {
1924		tlist = tpc_find_list(lun, list->list_id, list->init_idx);
1925		if (tlist != NULL && !tlist->completed) {
1926			mtx_unlock(&lun->lun_lock);
1927			free(list, M_CTL);
1928			ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
1929			    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
1930			    /*bit*/ 0);
1931			goto done;
1932		}
1933		if (tlist != NULL) {
1934			TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
1935			free(tlist, M_CTL);
1936		}
1937	}
1938	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
1939	mtx_unlock(&lun->lun_lock);
1940
1941	tpc_process(list);
1942	return (CTL_RETVAL_COMPLETE);
1943
1944done:
1945	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
1946		free(ctsio->kern_data_ptr, M_CTL);
1947		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
1948	}
1949	ctl_done((union ctl_io *)ctsio);
1950	return (CTL_RETVAL_COMPLETE);
1951}
1952
1953static void
1954tpc_create_token(struct ctl_lun *lun, struct ctl_port *port, off_t len,
1955    struct scsi_token *token)
1956{
1957	static int id = 0;
1958	struct scsi_vpd_id_descriptor *idd = NULL;
1959	struct scsi_ec_cscd_id *cscd;
1960	struct scsi_read_capacity_data_long *dtsd;
1961	int targid_len;
1962
1963	scsi_ulto4b(ROD_TYPE_AUR, token->type);
1964	scsi_ulto2b(0x01f8, token->length);
1965	scsi_u64to8b(atomic_fetchadd_int(&id, 1), &token->body[0]);
1966	if (lun->lun_devid)
1967		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
1968		    lun->lun_devid->data, lun->lun_devid->len,
1969		    scsi_devid_is_lun_naa);
1970	if (idd == NULL && lun->lun_devid)
1971		idd = scsi_get_devid_desc((struct scsi_vpd_id_descriptor *)
1972		    lun->lun_devid->data, lun->lun_devid->len,
1973		    scsi_devid_is_lun_eui64);
1974	if (idd != NULL) {
1975		cscd = (struct scsi_ec_cscd_id *)&token->body[8];
1976		cscd->type_code = EC_CSCD_ID;
1977		cscd->luidt_pdt = T_DIRECT;
1978		memcpy(&cscd->codeset, idd, 4 + idd->length);
1979		scsi_ulto3b(lun->be_lun->blocksize, cscd->dtsp.block_length);
1980	}
1981	scsi_u64to8b(0, &token->body[40]); /* XXX: Should be 128bit value. */
1982	scsi_u64to8b(len, &token->body[48]);
1983
1984	/* ROD token device type specific data (RC16 without first field) */
1985	dtsd = (struct scsi_read_capacity_data_long *)&token->body[88 - 8];
1986	scsi_ulto4b(lun->be_lun->blocksize, dtsd->length);
1987	dtsd->prot_lbppbe = lun->be_lun->pblockexp & SRC16_LBPPBE;
1988	scsi_ulto2b(lun->be_lun->pblockoff & SRC16_LALBA_A, dtsd->lalba_lbp);
1989	if (lun->be_lun->flags & CTL_LUN_FLAG_UNMAP)
1990		dtsd->lalba_lbp[0] |= SRC16_LBPME | SRC16_LBPRZ;
1991
1992	if (port->target_devid) {
1993		targid_len = port->target_devid->len;
1994		memcpy(&token->body[120], port->target_devid->data, targid_len);
1995	} else
1996		targid_len = 32;
1997	arc4rand(&token->body[120 + targid_len], 384 - targid_len, 0);
1998};
1999
2000int
2001ctl_populate_token(struct ctl_scsiio *ctsio)
2002{
2003	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2004	struct ctl_port *port = CTL_PORT(ctsio);
2005	struct ctl_lun *lun = CTL_LUN(ctsio);
2006	struct scsi_populate_token *cdb;
2007	struct scsi_populate_token_data *data;
2008	struct tpc_list *list, *tlist;
2009	struct tpc_token *token;
2010	uint64_t lba;
2011	int len, lendata, lendesc;
2012
2013	CTL_DEBUG_PRINT(("ctl_populate_token\n"));
2014
2015	cdb = (struct scsi_populate_token *)ctsio->cdb;
2016	len = scsi_4btoul(cdb->length);
2017
2018	if (len < sizeof(struct scsi_populate_token_data) ||
2019	    len > sizeof(struct scsi_populate_token_data) +
2020	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
2021		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
2022		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
2023		goto done;
2024	}
2025
2026	/*
2027	 * If we've got a kernel request that hasn't been malloced yet,
2028	 * malloc it and tell the caller the data buffer is here.
2029	 */
2030	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2031		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2032		ctsio->kern_data_len = len;
2033		ctsio->kern_total_len = len;
2034		ctsio->kern_rel_offset = 0;
2035		ctsio->kern_sg_entries = 0;
2036		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2037		ctsio->be_move_done = ctl_config_move_done;
2038		ctl_datamove((union ctl_io *)ctsio);
2039
2040		return (CTL_RETVAL_COMPLETE);
2041	}
2042
2043	data = (struct scsi_populate_token_data *)ctsio->kern_data_ptr;
2044	lendata = scsi_2btoul(data->length);
2045	if (lendata < sizeof(struct scsi_populate_token_data) - 2 +
2046	    sizeof(struct scsi_range_desc)) {
2047		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2048		    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
2049		goto done;
2050	}
2051	lendesc = scsi_2btoul(data->range_descriptor_length);
2052	if (lendesc < sizeof(struct scsi_range_desc) ||
2053	    len < sizeof(struct scsi_populate_token_data) + lendesc ||
2054	    lendata < sizeof(struct scsi_populate_token_data) - 2 + lendesc) {
2055		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2056		    /*field*/ 14, /*bit_valid*/ 0, /*bit*/ 0);
2057		goto done;
2058	}
2059/*
2060	printf("PT(list=%u) flags=%x to=%d rt=%x len=%x\n",
2061	    scsi_4btoul(cdb->list_identifier),
2062	    data->flags, scsi_4btoul(data->inactivity_timeout),
2063	    scsi_4btoul(data->rod_type),
2064	    scsi_2btoul(data->range_descriptor_length));
2065*/
2066
2067	/* Validate INACTIVITY TIMEOUT field */
2068	if (scsi_4btoul(data->inactivity_timeout) > TPC_MAX_TOKEN_TIMEOUT) {
2069		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2070		    /*command*/ 0, /*field*/ 4, /*bit_valid*/ 0,
2071		    /*bit*/ 0);
2072		goto done;
2073	}
2074
2075	/* Validate ROD TYPE field */
2076	if ((data->flags & EC_PT_RTV) &&
2077	    scsi_4btoul(data->rod_type) != ROD_TYPE_AUR) {
2078		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2079		    /*field*/ 8, /*bit_valid*/ 0, /*bit*/ 0);
2080		goto done;
2081	}
2082
2083	/* Validate list of ranges */
2084	if (tpc_check_ranges_l(&data->desc[0],
2085	    scsi_2btoul(data->range_descriptor_length) /
2086	    sizeof(struct scsi_range_desc),
2087	    lun->be_lun->maxlba, &lba) != 0) {
2088		ctl_set_lba_out_of_range(ctsio, lba);
2089		goto done;
2090	}
2091	if (tpc_check_ranges_x(&data->desc[0],
2092	    scsi_2btoul(data->range_descriptor_length) /
2093	    sizeof(struct scsi_range_desc)) != 0) {
2094		ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
2095		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2096		    /*bit*/ 0);
2097		goto done;
2098	}
2099
2100	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2101	list->service_action = cdb->service_action;
2102	list->init_port = ctsio->io_hdr.nexus.targ_port;
2103	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
2104	list->list_id = scsi_4btoul(cdb->list_identifier);
2105	list->flags = data->flags;
2106	list->ctsio = ctsio;
2107	list->lun = lun;
2108	mtx_lock(&lun->lun_lock);
2109	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2110	if (tlist != NULL && !tlist->completed) {
2111		mtx_unlock(&lun->lun_lock);
2112		free(list, M_CTL);
2113		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2114		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2115		    /*bit*/ 0);
2116		goto done;
2117	}
2118	if (tlist != NULL) {
2119		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2120		free(tlist, M_CTL);
2121	}
2122	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2123	mtx_unlock(&lun->lun_lock);
2124
2125	token = malloc(sizeof(*token), M_CTL, M_WAITOK | M_ZERO);
2126	token->lun = lun->lun;
2127	token->blocksize = lun->be_lun->blocksize;
2128	token->params = ctsio->kern_data_ptr;
2129	token->range = &data->desc[0];
2130	token->nrange = scsi_2btoul(data->range_descriptor_length) /
2131	    sizeof(struct scsi_range_desc);
2132	list->cursectors = tpc_ranges_length(token->range, token->nrange);
2133	list->curbytes = (off_t)list->cursectors * lun->be_lun->blocksize;
2134	tpc_create_token(lun, port, list->curbytes,
2135	    (struct scsi_token *)token->token);
2136	token->active = 0;
2137	token->last_active = time_uptime;
2138	token->timeout = scsi_4btoul(data->inactivity_timeout);
2139	if (token->timeout == 0)
2140		token->timeout = TPC_DFL_TOKEN_TIMEOUT;
2141	else if (token->timeout < TPC_MIN_TOKEN_TIMEOUT)
2142		token->timeout = TPC_MIN_TOKEN_TIMEOUT;
2143	memcpy(list->res_token, token->token, sizeof(list->res_token));
2144	list->res_token_valid = 1;
2145	list->curseg = 0;
2146	list->completed = 1;
2147	list->last_active = time_uptime;
2148	mtx_lock(&softc->tpc_lock);
2149	TAILQ_INSERT_TAIL(&softc->tpc_tokens, token, links);
2150	mtx_unlock(&softc->tpc_lock);
2151	ctl_set_success(ctsio);
2152	ctl_done((union ctl_io *)ctsio);
2153	return (CTL_RETVAL_COMPLETE);
2154
2155done:
2156	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
2157		free(ctsio->kern_data_ptr, M_CTL);
2158		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2159	}
2160	ctl_done((union ctl_io *)ctsio);
2161	return (CTL_RETVAL_COMPLETE);
2162}
2163
2164int
2165ctl_write_using_token(struct ctl_scsiio *ctsio)
2166{
2167	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2168	struct ctl_lun *lun = CTL_LUN(ctsio);
2169	struct scsi_write_using_token *cdb;
2170	struct scsi_write_using_token_data *data;
2171	struct tpc_list *list, *tlist;
2172	struct tpc_token *token;
2173	uint64_t lba;
2174	int len, lendata, lendesc;
2175
2176	CTL_DEBUG_PRINT(("ctl_write_using_token\n"));
2177
2178	cdb = (struct scsi_write_using_token *)ctsio->cdb;
2179	len = scsi_4btoul(cdb->length);
2180
2181	if (len < sizeof(struct scsi_write_using_token_data) ||
2182	    len > sizeof(struct scsi_write_using_token_data) +
2183	     TPC_MAX_SEGS * sizeof(struct scsi_range_desc)) {
2184		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 1,
2185		    /*field*/ 9, /*bit_valid*/ 0, /*bit*/ 0);
2186		goto done;
2187	}
2188
2189	/*
2190	 * If we've got a kernel request that hasn't been malloced yet,
2191	 * malloc it and tell the caller the data buffer is here.
2192	 */
2193	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
2194		ctsio->kern_data_ptr = malloc(len, M_CTL, M_WAITOK);
2195		ctsio->kern_data_len = len;
2196		ctsio->kern_total_len = len;
2197		ctsio->kern_rel_offset = 0;
2198		ctsio->kern_sg_entries = 0;
2199		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2200		ctsio->be_move_done = ctl_config_move_done;
2201		ctl_datamove((union ctl_io *)ctsio);
2202
2203		return (CTL_RETVAL_COMPLETE);
2204	}
2205
2206	data = (struct scsi_write_using_token_data *)ctsio->kern_data_ptr;
2207	lendata = scsi_2btoul(data->length);
2208	if (lendata < sizeof(struct scsi_write_using_token_data) - 2 +
2209	    sizeof(struct scsi_range_desc)) {
2210		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2211		    /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0);
2212		goto done;
2213	}
2214	lendesc = scsi_2btoul(data->range_descriptor_length);
2215	if (lendesc < sizeof(struct scsi_range_desc) ||
2216	    len < sizeof(struct scsi_write_using_token_data) + lendesc ||
2217	    lendata < sizeof(struct scsi_write_using_token_data) - 2 + lendesc) {
2218		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1, /*command*/ 0,
2219		    /*field*/ 534, /*bit_valid*/ 0, /*bit*/ 0);
2220		goto done;
2221	}
2222/*
2223	printf("WUT(list=%u) flags=%x off=%ju len=%x\n",
2224	    scsi_4btoul(cdb->list_identifier),
2225	    data->flags, scsi_8btou64(data->offset_into_rod),
2226	    scsi_2btoul(data->range_descriptor_length));
2227*/
2228
2229	/* Validate list of ranges */
2230	if (tpc_check_ranges_l(&data->desc[0],
2231	    scsi_2btoul(data->range_descriptor_length) /
2232	    sizeof(struct scsi_range_desc),
2233	    lun->be_lun->maxlba, &lba) != 0) {
2234		ctl_set_lba_out_of_range(ctsio, lba);
2235		goto done;
2236	}
2237	if (tpc_check_ranges_x(&data->desc[0],
2238	    scsi_2btoul(data->range_descriptor_length) /
2239	    sizeof(struct scsi_range_desc)) != 0) {
2240		ctl_set_invalid_field(ctsio, /*sks_valid*/ 0,
2241		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2242		    /*bit*/ 0);
2243		goto done;
2244	}
2245
2246	list = malloc(sizeof(struct tpc_list), M_CTL, M_WAITOK | M_ZERO);
2247	list->service_action = cdb->service_action;
2248	list->init_port = ctsio->io_hdr.nexus.targ_port;
2249	list->init_idx = ctl_get_initindex(&ctsio->io_hdr.nexus);
2250	list->list_id = scsi_4btoul(cdb->list_identifier);
2251	list->flags = data->flags;
2252	list->params = ctsio->kern_data_ptr;
2253	list->range = &data->desc[0];
2254	list->nrange = scsi_2btoul(data->range_descriptor_length) /
2255	    sizeof(struct scsi_range_desc);
2256	list->offset_into_rod = scsi_8btou64(data->offset_into_rod);
2257	list->ctsio = ctsio;
2258	list->lun = lun;
2259	mtx_lock(&lun->lun_lock);
2260	tlist = tpc_find_list(lun, list->list_id, list->init_idx);
2261	if (tlist != NULL && !tlist->completed) {
2262		mtx_unlock(&lun->lun_lock);
2263		free(list, M_CTL);
2264		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2265		    /*command*/ 0, /*field*/ 0, /*bit_valid*/ 0,
2266		    /*bit*/ 0);
2267		goto done;
2268	}
2269	if (tlist != NULL) {
2270		TAILQ_REMOVE(&lun->tpc_lists, tlist, links);
2271		free(tlist, M_CTL);
2272	}
2273	TAILQ_INSERT_TAIL(&lun->tpc_lists, list, links);
2274	mtx_unlock(&lun->lun_lock);
2275
2276	/* Block device zero ROD token -> no token. */
2277	if (scsi_4btoul(data->rod_token) == ROD_TYPE_BLOCK_ZERO) {
2278		tpc_process(list);
2279		return (CTL_RETVAL_COMPLETE);
2280	}
2281
2282	mtx_lock(&softc->tpc_lock);
2283	TAILQ_FOREACH(token, &softc->tpc_tokens, links) {
2284		if (memcmp(token->token, data->rod_token,
2285		    sizeof(data->rod_token)) == 0)
2286			break;
2287	}
2288	if (token != NULL) {
2289		token->active++;
2290		list->token = token;
2291		if (data->flags & EC_WUT_DEL_TKN)
2292			token->timeout = 0;
2293	}
2294	mtx_unlock(&softc->tpc_lock);
2295	if (token == NULL) {
2296		mtx_lock(&lun->lun_lock);
2297		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2298		mtx_unlock(&lun->lun_lock);
2299		free(list, M_CTL);
2300		ctl_set_sense(ctsio, /*current_error*/ 1,
2301		    /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2302		    /*asc*/ 0x23, /*ascq*/ 0x04, SSD_ELEM_NONE);
2303		goto done;
2304	}
2305
2306	tpc_process(list);
2307	return (CTL_RETVAL_COMPLETE);
2308
2309done:
2310	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
2311		free(ctsio->kern_data_ptr, M_CTL);
2312		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
2313	}
2314	ctl_done((union ctl_io *)ctsio);
2315	return (CTL_RETVAL_COMPLETE);
2316}
2317
2318int
2319ctl_receive_rod_token_information(struct ctl_scsiio *ctsio)
2320{
2321	struct ctl_lun *lun = CTL_LUN(ctsio);
2322	struct scsi_receive_rod_token_information *cdb;
2323	struct scsi_receive_copy_status_lid4_data *data;
2324	struct tpc_list *list;
2325	struct tpc_list list_copy;
2326	uint8_t *ptr;
2327	int retval;
2328	int alloc_len, total_len, token_len;
2329	uint32_t list_id;
2330
2331	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2332
2333	cdb = (struct scsi_receive_rod_token_information *)ctsio->cdb;
2334	retval = CTL_RETVAL_COMPLETE;
2335
2336	list_id = scsi_4btoul(cdb->list_identifier);
2337	mtx_lock(&lun->lun_lock);
2338	list = tpc_find_list(lun, list_id,
2339	    ctl_get_initindex(&ctsio->io_hdr.nexus));
2340	if (list == NULL) {
2341		mtx_unlock(&lun->lun_lock);
2342		ctl_set_invalid_field(ctsio, /*sks_valid*/ 1,
2343		    /*command*/ 1, /*field*/ 2, /*bit_valid*/ 0,
2344		    /*bit*/ 0);
2345		ctl_done((union ctl_io *)ctsio);
2346		return (retval);
2347	}
2348	list_copy = *list;
2349	if (list->completed) {
2350		TAILQ_REMOVE(&lun->tpc_lists, list, links);
2351		free(list, M_CTL);
2352	}
2353	mtx_unlock(&lun->lun_lock);
2354
2355	token_len = list_copy.res_token_valid ? 2 + sizeof(list_copy.res_token) : 0;
2356	total_len = sizeof(*data) + list_copy.sense_len + 4 + token_len;
2357	alloc_len = scsi_4btoul(cdb->length);
2358
2359	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2360	ctsio->kern_sg_entries = 0;
2361	ctsio->kern_rel_offset = 0;
2362	ctsio->kern_data_len = min(total_len, alloc_len);
2363	ctsio->kern_total_len = ctsio->kern_data_len;
2364
2365	data = (struct scsi_receive_copy_status_lid4_data *)ctsio->kern_data_ptr;
2366	scsi_ulto4b(sizeof(*data) - 4 + list_copy.sense_len +
2367	    4 + token_len, data->available_data);
2368	data->response_to_service_action = list_copy.service_action;
2369	if (list_copy.completed) {
2370		if (list_copy.error)
2371			data->copy_command_status = RCS_CCS_ERROR;
2372		else if (list_copy.abort)
2373			data->copy_command_status = RCS_CCS_ABORTED;
2374		else
2375			data->copy_command_status = RCS_CCS_COMPLETED;
2376	} else
2377		data->copy_command_status = RCS_CCS_INPROG_FG;
2378	scsi_ulto2b(list_copy.curops, data->operation_counter);
2379	scsi_ulto4b(UINT32_MAX, data->estimated_status_update_delay);
2380	data->transfer_count_units = RCS_TC_LBAS;
2381	scsi_u64to8b(list_copy.cursectors, data->transfer_count);
2382	scsi_ulto2b(list_copy.curseg, data->segments_processed);
2383	data->length_of_the_sense_data_field = list_copy.sense_len;
2384	data->sense_data_length = list_copy.sense_len;
2385	memcpy(data->sense_data, &list_copy.sense_data, list_copy.sense_len);
2386
2387	ptr = &data->sense_data[data->length_of_the_sense_data_field];
2388	scsi_ulto4b(token_len, &ptr[0]);
2389	if (list_copy.res_token_valid) {
2390		scsi_ulto2b(0, &ptr[4]);
2391		memcpy(&ptr[6], list_copy.res_token, sizeof(list_copy.res_token));
2392	}
2393/*
2394	printf("RRTI(list=%u) valid=%d\n",
2395	    scsi_4btoul(cdb->list_identifier), list_copy.res_token_valid);
2396*/
2397	ctl_set_success(ctsio);
2398	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2399	ctsio->be_move_done = ctl_config_move_done;
2400	ctl_datamove((union ctl_io *)ctsio);
2401	return (retval);
2402}
2403
2404int
2405ctl_report_all_rod_tokens(struct ctl_scsiio *ctsio)
2406{
2407	struct ctl_softc *softc = CTL_SOFTC(ctsio);
2408	struct scsi_report_all_rod_tokens *cdb;
2409	struct scsi_report_all_rod_tokens_data *data;
2410	struct tpc_token *token;
2411	int retval;
2412	int alloc_len, total_len, tokens, i;
2413
2414	CTL_DEBUG_PRINT(("ctl_receive_rod_token_information\n"));
2415
2416	cdb = (struct scsi_report_all_rod_tokens *)ctsio->cdb;
2417	retval = CTL_RETVAL_COMPLETE;
2418
2419	tokens = 0;
2420	mtx_lock(&softc->tpc_lock);
2421	TAILQ_FOREACH(token, &softc->tpc_tokens, links)
2422		tokens++;
2423	mtx_unlock(&softc->tpc_lock);
2424	if (tokens > 512)
2425		tokens = 512;
2426
2427	total_len = sizeof(*data) + tokens * 96;
2428	alloc_len = scsi_4btoul(cdb->length);
2429
2430	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
2431	ctsio->kern_sg_entries = 0;
2432	ctsio->kern_rel_offset = 0;
2433	ctsio->kern_data_len = min(total_len, alloc_len);
2434	ctsio->kern_total_len = ctsio->kern_data_len;
2435
2436	data = (struct scsi_report_all_rod_tokens_data *)ctsio->kern_data_ptr;
2437	i = 0;
2438	mtx_lock(&softc->tpc_lock);
2439	TAILQ_FOREACH(token, &softc->tpc_tokens, links) {
2440		if (i >= tokens)
2441			break;
2442		memcpy(&data->rod_management_token_list[i * 96],
2443		    token->token, 96);
2444		i++;
2445	}
2446	mtx_unlock(&softc->tpc_lock);
2447	scsi_ulto4b(sizeof(*data) - 4 + i * 96, data->available_data);
2448/*
2449	printf("RART tokens=%d\n", i);
2450*/
2451	ctl_set_success(ctsio);
2452	ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
2453	ctsio->be_move_done = ctl_config_move_done;
2454	ctl_datamove((union ctl_io *)ctsio);
2455	return (retval);
2456}
2457
2458