ctl.c revision 229997
1/*-
2 * Copyright (c) 2003-2009 Silicon Graphics International Corp.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions, and the following disclaimer,
10 *    without modification.
11 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12 *    substantially similar to the "NO WARRANTY" disclaimer below
13 *    ("Disclaimer") and any redistribution must be conditioned upon
14 *    including a substantially similar Disclaimer requirement for further
15 *    binary redistribution.
16 *
17 * NO WARRANTY
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22 * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGES.
29 *
30 * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl.c#8 $
31 */
32/*
33 * CAM Target Layer, a SCSI device emulation subsystem.
34 *
35 * Author: Ken Merry <ken@FreeBSD.org>
36 */
37
38#define _CTL_C
39
40#include <sys/cdefs.h>
41__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl.c 229997 2012-01-12 00:34:33Z ken $");
42
43#include <sys/param.h>
44#include <sys/systm.h>
45#include <sys/kernel.h>
46#include <sys/types.h>
47#include <sys/kthread.h>
48#include <sys/bio.h>
49#include <sys/fcntl.h>
50#include <sys/lock.h>
51#include <sys/mutex.h>
52#include <sys/condvar.h>
53#include <sys/malloc.h>
54#include <sys/conf.h>
55#include <sys/ioccom.h>
56#include <sys/queue.h>
57#include <sys/sbuf.h>
58#include <sys/endian.h>
59#include <sys/sysctl.h>
60
61#include <cam/cam.h>
62#include <cam/scsi/scsi_all.h>
63#include <cam/scsi/scsi_da.h>
64#include <cam/ctl/ctl_io.h>
65#include <cam/ctl/ctl.h>
66#include <cam/ctl/ctl_frontend.h>
67#include <cam/ctl/ctl_frontend_internal.h>
68#include <cam/ctl/ctl_util.h>
69#include <cam/ctl/ctl_backend.h>
70#include <cam/ctl/ctl_ioctl.h>
71#include <cam/ctl/ctl_ha.h>
72#include <cam/ctl/ctl_private.h>
73#include <cam/ctl/ctl_debug.h>
74#include <cam/ctl/ctl_scsi_all.h>
75#include <cam/ctl/ctl_error.h>
76
77struct ctl_softc *control_softc = NULL;
78
79/*
80 * The default is to run with CTL_DONE_THREAD turned on.  Completed
81 * transactions are queued for processing by the CTL work thread.  When
82 * CTL_DONE_THREAD is not defined, completed transactions are processed in
83 * the caller's context.
84 */
85#define CTL_DONE_THREAD
86
87/*
88 *  * Use the serial number and device ID provided by the backend, rather than
89 *   * making up our own.
90 *    */
91#define CTL_USE_BACKEND_SN
92
93/*
94 * Size and alignment macros needed for Copan-specific HA hardware.  These
95 * can go away when the HA code is re-written, and uses busdma for any
96 * hardware.
97 */
98#define	CTL_ALIGN_8B(target, source, type)				\
99	if (((uint32_t)source & 0x7) != 0)				\
100		target = (type)(source + (0x8 - ((uint32_t)source & 0x7)));\
101	else								\
102		target = (type)source;
103
104#define	CTL_SIZE_8B(target, size)					\
105	if ((size & 0x7) != 0)						\
106		target = size + (0x8 - (size & 0x7));			\
107	else								\
108		target = size;
109
110#define CTL_ALIGN_8B_MARGIN	16
111
112/*
113 * Template mode pages.
114 */
115
116/*
117 * Note that these are default values only.  The actual values will be
118 * filled in when the user does a mode sense.
119 */
120static struct copan_power_subpage power_page_default = {
121	/*page_code*/ PWR_PAGE_CODE | SMPH_SPF,
122	/*subpage*/ PWR_SUBPAGE_CODE,
123	/*page_length*/ {(sizeof(struct copan_power_subpage) - 4) & 0xff00,
124			 (sizeof(struct copan_power_subpage) - 4) & 0x00ff},
125	/*page_version*/ PWR_VERSION,
126	/* total_luns */ 26,
127	/* max_active_luns*/ PWR_DFLT_MAX_LUNS,
128	/*reserved*/ {0, 0, 0, 0, 0, 0, 0, 0, 0,
129		      0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
130		      0, 0, 0, 0, 0, 0}
131};
132
133static struct copan_power_subpage power_page_changeable = {
134	/*page_code*/ PWR_PAGE_CODE | SMPH_SPF,
135	/*subpage*/ PWR_SUBPAGE_CODE,
136	/*page_length*/ {(sizeof(struct copan_power_subpage) - 4) & 0xff00,
137			 (sizeof(struct copan_power_subpage) - 4) & 0x00ff},
138	/*page_version*/ 0,
139	/* total_luns */ 0,
140	/* max_active_luns*/ 0,
141	/*reserved*/ {0, 0, 0, 0, 0, 0, 0, 0, 0,
142		      0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
143		      0, 0, 0, 0, 0, 0}
144};
145
146static struct copan_aps_subpage aps_page_default = {
147	APS_PAGE_CODE | SMPH_SPF, //page_code
148	APS_SUBPAGE_CODE, //subpage
149	{(sizeof(struct copan_aps_subpage) - 4) & 0xff00,
150	 (sizeof(struct copan_aps_subpage) - 4) & 0x00ff}, //page_length
151	APS_VERSION, //page_version
152	0, //lock_active
153	{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
154	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
155	0, 0, 0, 0, 0} //reserved
156};
157
158static struct copan_aps_subpage aps_page_changeable = {
159	APS_PAGE_CODE | SMPH_SPF, //page_code
160	APS_SUBPAGE_CODE, //subpage
161	{(sizeof(struct copan_aps_subpage) - 4) & 0xff00,
162	 (sizeof(struct copan_aps_subpage) - 4) & 0x00ff}, //page_length
163	0, //page_version
164	0, //lock_active
165	{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
166	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
167	0, 0, 0, 0, 0} //reserved
168};
169
170static struct copan_debugconf_subpage debugconf_page_default = {
171	DBGCNF_PAGE_CODE | SMPH_SPF,	/* page_code */
172	DBGCNF_SUBPAGE_CODE,		/* subpage */
173	{(sizeof(struct copan_debugconf_subpage) - 4) >> 8,
174	 (sizeof(struct copan_debugconf_subpage) - 4) >> 0}, /* page_length */
175	DBGCNF_VERSION,			/* page_version */
176	{CTL_TIME_IO_DEFAULT_SECS>>8,
177	 CTL_TIME_IO_DEFAULT_SECS>>0},	/* ctl_time_io_secs */
178};
179
180static struct copan_debugconf_subpage debugconf_page_changeable = {
181	DBGCNF_PAGE_CODE | SMPH_SPF,	/* page_code */
182	DBGCNF_SUBPAGE_CODE,		/* subpage */
183	{(sizeof(struct copan_debugconf_subpage) - 4) >> 8,
184	 (sizeof(struct copan_debugconf_subpage) - 4) >> 0}, /* page_length */
185	0,				/* page_version */
186	{0xff,0xff},			/* ctl_time_io_secs */
187};
188
189static struct scsi_format_page format_page_default = {
190	/*page_code*/SMS_FORMAT_DEVICE_PAGE,
191	/*page_length*/sizeof(struct scsi_format_page) - 2,
192	/*tracks_per_zone*/ {0, 0},
193	/*alt_sectors_per_zone*/ {0, 0},
194	/*alt_tracks_per_zone*/ {0, 0},
195	/*alt_tracks_per_lun*/ {0, 0},
196	/*sectors_per_track*/ {(CTL_DEFAULT_SECTORS_PER_TRACK >> 8) & 0xff,
197			        CTL_DEFAULT_SECTORS_PER_TRACK & 0xff},
198	/*bytes_per_sector*/ {0, 0},
199	/*interleave*/ {0, 0},
200	/*track_skew*/ {0, 0},
201	/*cylinder_skew*/ {0, 0},
202	/*flags*/ SFP_HSEC,
203	/*reserved*/ {0, 0, 0}
204};
205
206static struct scsi_format_page format_page_changeable = {
207	/*page_code*/SMS_FORMAT_DEVICE_PAGE,
208	/*page_length*/sizeof(struct scsi_format_page) - 2,
209	/*tracks_per_zone*/ {0, 0},
210	/*alt_sectors_per_zone*/ {0, 0},
211	/*alt_tracks_per_zone*/ {0, 0},
212	/*alt_tracks_per_lun*/ {0, 0},
213	/*sectors_per_track*/ {0, 0},
214	/*bytes_per_sector*/ {0, 0},
215	/*interleave*/ {0, 0},
216	/*track_skew*/ {0, 0},
217	/*cylinder_skew*/ {0, 0},
218	/*flags*/ 0,
219	/*reserved*/ {0, 0, 0}
220};
221
222static struct scsi_rigid_disk_page rigid_disk_page_default = {
223	/*page_code*/SMS_RIGID_DISK_PAGE,
224	/*page_length*/sizeof(struct scsi_rigid_disk_page) - 2,
225	/*cylinders*/ {0, 0, 0},
226	/*heads*/ CTL_DEFAULT_HEADS,
227	/*start_write_precomp*/ {0, 0, 0},
228	/*start_reduced_current*/ {0, 0, 0},
229	/*step_rate*/ {0, 0},
230	/*landing_zone_cylinder*/ {0, 0, 0},
231	/*rpl*/ SRDP_RPL_DISABLED,
232	/*rotational_offset*/ 0,
233	/*reserved1*/ 0,
234	/*rotation_rate*/ {(CTL_DEFAULT_ROTATION_RATE >> 8) & 0xff,
235			   CTL_DEFAULT_ROTATION_RATE & 0xff},
236	/*reserved2*/ {0, 0}
237};
238
239static struct scsi_rigid_disk_page rigid_disk_page_changeable = {
240	/*page_code*/SMS_RIGID_DISK_PAGE,
241	/*page_length*/sizeof(struct scsi_rigid_disk_page) - 2,
242	/*cylinders*/ {0, 0, 0},
243	/*heads*/ 0,
244	/*start_write_precomp*/ {0, 0, 0},
245	/*start_reduced_current*/ {0, 0, 0},
246	/*step_rate*/ {0, 0},
247	/*landing_zone_cylinder*/ {0, 0, 0},
248	/*rpl*/ 0,
249	/*rotational_offset*/ 0,
250	/*reserved1*/ 0,
251	/*rotation_rate*/ {0, 0},
252	/*reserved2*/ {0, 0}
253};
254
255static struct scsi_caching_page caching_page_default = {
256	/*page_code*/SMS_CACHING_PAGE,
257	/*page_length*/sizeof(struct scsi_caching_page) - 2,
258	/*flags1*/ SCP_DISC | SCP_WCE,
259	/*ret_priority*/ 0,
260	/*disable_pf_transfer_len*/ {0xff, 0xff},
261	/*min_prefetch*/ {0, 0},
262	/*max_prefetch*/ {0xff, 0xff},
263	/*max_pf_ceiling*/ {0xff, 0xff},
264	/*flags2*/ 0,
265	/*cache_segments*/ 0,
266	/*cache_seg_size*/ {0, 0},
267	/*reserved*/ 0,
268	/*non_cache_seg_size*/ {0, 0, 0}
269};
270
271static struct scsi_caching_page caching_page_changeable = {
272	/*page_code*/SMS_CACHING_PAGE,
273	/*page_length*/sizeof(struct scsi_caching_page) - 2,
274	/*flags1*/ 0,
275	/*ret_priority*/ 0,
276	/*disable_pf_transfer_len*/ {0, 0},
277	/*min_prefetch*/ {0, 0},
278	/*max_prefetch*/ {0, 0},
279	/*max_pf_ceiling*/ {0, 0},
280	/*flags2*/ 0,
281	/*cache_segments*/ 0,
282	/*cache_seg_size*/ {0, 0},
283	/*reserved*/ 0,
284	/*non_cache_seg_size*/ {0, 0, 0}
285};
286
287static struct scsi_control_page control_page_default = {
288	/*page_code*/SMS_CONTROL_MODE_PAGE,
289	/*page_length*/sizeof(struct scsi_control_page) - 2,
290	/*rlec*/0,
291	/*queue_flags*/0,
292	/*eca_and_aen*/0,
293	/*reserved*/0,
294	/*aen_holdoff_period*/{0, 0}
295};
296
297static struct scsi_control_page control_page_changeable = {
298	/*page_code*/SMS_CONTROL_MODE_PAGE,
299	/*page_length*/sizeof(struct scsi_control_page) - 2,
300	/*rlec*/SCP_DSENSE,
301	/*queue_flags*/0,
302	/*eca_and_aen*/0,
303	/*reserved*/0,
304	/*aen_holdoff_period*/{0, 0}
305};
306
307SYSCTL_NODE(_kern_cam, OID_AUTO, ctl, CTLFLAG_RD, 0, "CAM Target Layer");
308
309/*
310 * XXX KDM move these into the softc.
311 */
312static int rcv_sync_msg;
313static int persis_offset;
314static uint8_t ctl_pause_rtr;
315static int     ctl_is_single;
316static int     index_to_aps_page;
317
318
319/*
320 * Serial number (0x80), device id (0x83), and supported pages (0x00)
321 */
322#define SCSI_EVPD_NUM_SUPPORTED_PAGES	3
323
324static void ctl_isc_event_handler(ctl_ha_channel chanel, ctl_ha_event event,
325				  int param);
326static void ctl_copy_sense_data(union ctl_ha_msg *src, union ctl_io *dest);
327static void ctl_init(void);
328void ctl_shutdown(void);
329static int ctl_open(struct cdev *dev, int flags, int fmt, struct thread *td);
330static int ctl_close(struct cdev *dev, int flags, int fmt, struct thread *td);
331static void ctl_ioctl_online(void *arg);
332static void ctl_ioctl_offline(void *arg);
333static int ctl_ioctl_targ_enable(void *arg, struct ctl_id targ_id);
334static int ctl_ioctl_targ_disable(void *arg, struct ctl_id targ_id);
335static int ctl_ioctl_lun_enable(void *arg, struct ctl_id targ_id, int lun_id);
336static int ctl_ioctl_lun_disable(void *arg, struct ctl_id targ_id, int lun_id);
337static int ctl_ioctl_do_datamove(struct ctl_scsiio *ctsio);
338static int ctl_serialize_other_sc_cmd(struct ctl_scsiio *ctsio, int have_lock);
339static int ctl_ioctl_submit_wait(union ctl_io *io);
340static void ctl_ioctl_datamove(union ctl_io *io);
341static void ctl_ioctl_done(union ctl_io *io);
342static void ctl_ioctl_hard_startstop_callback(void *arg,
343					      struct cfi_metatask *metatask);
344static void ctl_ioctl_bbrread_callback(void *arg,struct cfi_metatask *metatask);
345static int ctl_ioctl_fill_ooa(struct ctl_lun *lun, uint32_t *cur_fill_num,
346			      struct ctl_ooa *ooa_hdr);
347static int ctl_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
348		     struct thread *td);
349uint32_t ctl_get_resindex(struct ctl_nexus *nexus);
350uint32_t ctl_port_idx(int port_num);
351#ifdef unused
352static union ctl_io *ctl_malloc_io(ctl_io_type io_type, uint32_t targ_port,
353				   uint32_t targ_target, uint32_t targ_lun,
354				   int can_wait);
355static void ctl_kfree_io(union ctl_io *io);
356#endif /* unused */
357static void ctl_free_io_internal(union ctl_io *io, int have_lock);
358static int ctl_alloc_lun(struct ctl_softc *ctl_softc, struct ctl_lun *lun,
359			 struct ctl_be_lun *be_lun, struct ctl_id target_id);
360static int ctl_free_lun(struct ctl_lun *lun);
361static void ctl_create_lun(struct ctl_be_lun *be_lun);
362/**
363static void ctl_failover_change_pages(struct ctl_softc *softc,
364				      struct ctl_scsiio *ctsio, int master);
365**/
366
367static int ctl_do_mode_select(union ctl_io *io);
368static int ctl_pro_preempt(struct ctl_softc *softc, struct ctl_lun *lun,
369			   uint64_t res_key, uint64_t sa_res_key,
370			   uint8_t type, uint32_t residx,
371			   struct ctl_scsiio *ctsio,
372			   struct scsi_per_res_out *cdb,
373			   struct scsi_per_res_out_parms* param);
374static void ctl_pro_preempt_other(struct ctl_lun *lun,
375				  union ctl_ha_msg *msg);
376static void ctl_hndl_per_res_out_on_other_sc(union ctl_ha_msg *msg);
377static int ctl_inquiry_evpd_supported(struct ctl_scsiio *ctsio, int alloc_len);
378static int ctl_inquiry_evpd_serial(struct ctl_scsiio *ctsio, int alloc_len);
379static int ctl_inquiry_evpd_devid(struct ctl_scsiio *ctsio, int alloc_len);
380static int ctl_inquiry_evpd(struct ctl_scsiio *ctsio);
381static int ctl_inquiry_std(struct ctl_scsiio *ctsio);
382static int ctl_get_lba_len(union ctl_io *io, uint64_t *lba, uint32_t *len);
383static ctl_action ctl_extent_check(union ctl_io *io1, union ctl_io *io2);
384static ctl_action ctl_check_for_blockage(union ctl_io *pending_io,
385					 union ctl_io *ooa_io);
386static ctl_action ctl_check_ooa(struct ctl_lun *lun, union ctl_io *pending_io,
387				union ctl_io *starting_io);
388static int ctl_check_blocked(struct ctl_lun *lun);
389static int ctl_scsiio_lun_check(struct ctl_softc *ctl_softc,
390				struct ctl_lun *lun,
391				struct ctl_cmd_entry *entry,
392				struct ctl_scsiio *ctsio);
393//static int ctl_check_rtr(union ctl_io *pending_io, struct ctl_softc *softc);
394static void ctl_failover(void);
395static int ctl_scsiio_precheck(struct ctl_softc *ctl_softc,
396			       struct ctl_scsiio *ctsio);
397static int ctl_scsiio(struct ctl_scsiio *ctsio);
398
399static int ctl_bus_reset(struct ctl_softc *ctl_softc, union ctl_io *io);
400static int ctl_target_reset(struct ctl_softc *ctl_softc, union ctl_io *io,
401			    ctl_ua_type ua_type);
402static int ctl_lun_reset(struct ctl_lun *lun, union ctl_io *io,
403			 ctl_ua_type ua_type);
404static int ctl_abort_task(union ctl_io *io);
405static void ctl_run_task_queue(struct ctl_softc *ctl_softc);
406#ifdef CTL_IO_DELAY
407static void ctl_datamove_timer_wakeup(void *arg);
408static void ctl_done_timer_wakeup(void *arg);
409#endif /* CTL_IO_DELAY */
410
411static void ctl_send_datamove_done(union ctl_io *io, int have_lock);
412static void ctl_datamove_remote_write_cb(struct ctl_ha_dt_req *rq);
413static int ctl_datamove_remote_dm_write_cb(union ctl_io *io);
414static void ctl_datamove_remote_write(union ctl_io *io);
415static int ctl_datamove_remote_dm_read_cb(union ctl_io *io);
416static void ctl_datamove_remote_read_cb(struct ctl_ha_dt_req *rq);
417static int ctl_datamove_remote_sgl_setup(union ctl_io *io);
418static int ctl_datamove_remote_xfer(union ctl_io *io, unsigned command,
419				    ctl_ha_dt_cb callback);
420static void ctl_datamove_remote_read(union ctl_io *io);
421static void ctl_datamove_remote(union ctl_io *io);
422static int ctl_process_done(union ctl_io *io, int have_lock);
423static void ctl_work_thread(void *arg);
424
425/*
426 * Load the serialization table.  This isn't very pretty, but is probably
427 * the easiest way to do it.
428 */
429#include "ctl_ser_table.c"
430
431/*
432 * We only need to define open, close and ioctl routines for this driver.
433 */
434static struct cdevsw ctl_cdevsw = {
435	.d_version =	D_VERSION,
436	.d_flags =	0,
437	.d_open =	ctl_open,
438	.d_close =	ctl_close,
439	.d_ioctl =	ctl_ioctl,
440	.d_name =	"ctl",
441};
442
443
444MALLOC_DEFINE(M_CTL, "ctlmem", "Memory used for CTL");
445
446/*
447 * If we have the CAM SIM, we may or may not have another SIM that will
448 * cause CTL to get initialized.  If not, we need to initialize it.
449 */
450SYSINIT(ctl_init, SI_SUB_CONFIGURE, SI_ORDER_THIRD, ctl_init, NULL);
451
452static void
453ctl_isc_handler_finish_xfer(struct ctl_softc *ctl_softc,
454			    union ctl_ha_msg *msg_info)
455{
456	struct ctl_scsiio *ctsio;
457
458	if (msg_info->hdr.original_sc == NULL) {
459		printf("%s: original_sc == NULL!\n", __func__);
460		/* XXX KDM now what? */
461		return;
462	}
463
464	ctsio = &msg_info->hdr.original_sc->scsiio;
465	ctsio->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
466	ctsio->io_hdr.msg_type = CTL_MSG_FINISH_IO;
467	ctsio->io_hdr.status = msg_info->hdr.status;
468	ctsio->scsi_status = msg_info->scsi.scsi_status;
469	ctsio->sense_len = msg_info->scsi.sense_len;
470	ctsio->sense_residual = msg_info->scsi.sense_residual;
471	ctsio->residual = msg_info->scsi.residual;
472	memcpy(&ctsio->sense_data, &msg_info->scsi.sense_data,
473	       sizeof(ctsio->sense_data));
474	memcpy(&ctsio->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes,
475	       &msg_info->scsi.lbalen, sizeof(msg_info->scsi.lbalen));;
476	STAILQ_INSERT_TAIL(&ctl_softc->isc_queue, &ctsio->io_hdr, links);
477	ctl_wakeup_thread();
478}
479
480static void
481ctl_isc_handler_finish_ser_only(struct ctl_softc *ctl_softc,
482				union ctl_ha_msg *msg_info)
483{
484	struct ctl_scsiio *ctsio;
485
486	if (msg_info->hdr.serializing_sc == NULL) {
487		printf("%s: serializing_sc == NULL!\n", __func__);
488		/* XXX KDM now what? */
489		return;
490	}
491
492	ctsio = &msg_info->hdr.serializing_sc->scsiio;
493#if 0
494	/*
495	 * Attempt to catch the situation where an I/O has
496	 * been freed, and we're using it again.
497	 */
498	if (ctsio->io_hdr.io_type == 0xff) {
499		union ctl_io *tmp_io;
500		tmp_io = (union ctl_io *)ctsio;
501		printf("%s: %p use after free!\n", __func__,
502		       ctsio);
503		printf("%s: type %d msg %d cdb %x iptl: "
504		       "%d:%d:%d:%d tag 0x%04x "
505		       "flag %#x status %x\n",
506			__func__,
507			tmp_io->io_hdr.io_type,
508			tmp_io->io_hdr.msg_type,
509			tmp_io->scsiio.cdb[0],
510			tmp_io->io_hdr.nexus.initid.id,
511			tmp_io->io_hdr.nexus.targ_port,
512			tmp_io->io_hdr.nexus.targ_target.id,
513			tmp_io->io_hdr.nexus.targ_lun,
514			(tmp_io->io_hdr.io_type ==
515			CTL_IO_TASK) ?
516			tmp_io->taskio.tag_num :
517			tmp_io->scsiio.tag_num,
518		        tmp_io->io_hdr.flags,
519			tmp_io->io_hdr.status);
520	}
521#endif
522	ctsio->io_hdr.msg_type = CTL_MSG_FINISH_IO;
523	STAILQ_INSERT_TAIL(&ctl_softc->isc_queue, &ctsio->io_hdr, links);
524	ctl_wakeup_thread();
525}
526
527/*
528 * ISC (Inter Shelf Communication) event handler.  Events from the HA
529 * subsystem come in here.
530 */
531static void
532ctl_isc_event_handler(ctl_ha_channel channel, ctl_ha_event event, int param)
533{
534	struct ctl_softc *ctl_softc;
535	union ctl_io *io;
536	struct ctl_prio *presio;
537	ctl_ha_status isc_status;
538
539	ctl_softc = control_softc;
540	io = NULL;
541
542
543#if 0
544	printf("CTL: Isc Msg event %d\n", event);
545#endif
546	if (event == CTL_HA_EVT_MSG_RECV) {
547		union ctl_ha_msg msg_info;
548
549		isc_status = ctl_ha_msg_recv(CTL_HA_CHAN_CTL, &msg_info,
550					     sizeof(msg_info), /*wait*/ 0);
551#if 0
552		printf("CTL: msg_type %d\n", msg_info.msg_type);
553#endif
554		if (isc_status != 0) {
555			printf("Error receiving message, status = %d\n",
556			       isc_status);
557			return;
558		}
559		mtx_lock(&ctl_softc->ctl_lock);
560
561		switch (msg_info.hdr.msg_type) {
562		case CTL_MSG_SERIALIZE:
563#if 0
564			printf("Serialize\n");
565#endif
566			io = ctl_alloc_io((void *)ctl_softc->othersc_pool);
567			if (io == NULL) {
568				printf("ctl_isc_event_handler: can't allocate "
569				       "ctl_io!\n");
570				/* Bad Juju */
571				/* Need to set busy and send msg back */
572				mtx_unlock(&ctl_softc->ctl_lock);
573				msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
574				msg_info.hdr.status = CTL_SCSI_ERROR;
575				msg_info.scsi.scsi_status = SCSI_STATUS_BUSY;
576				msg_info.scsi.sense_len = 0;
577			        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
578				    sizeof(msg_info), 0) > CTL_HA_STATUS_SUCCESS){
579				}
580				goto bailout;
581			}
582			ctl_zero_io(io);
583			// populate ctsio from msg_info
584			io->io_hdr.io_type = CTL_IO_SCSI;
585			io->io_hdr.msg_type = CTL_MSG_SERIALIZE;
586			io->io_hdr.original_sc = msg_info.hdr.original_sc;
587#if 0
588			printf("pOrig %x\n", (int)msg_info.original_sc);
589#endif
590			io->io_hdr.flags |= CTL_FLAG_FROM_OTHER_SC |
591					    CTL_FLAG_IO_ACTIVE;
592			/*
593			 * If we're in serialization-only mode, we don't
594			 * want to go through full done processing.  Thus
595			 * the COPY flag.
596			 *
597			 * XXX KDM add another flag that is more specific.
598			 */
599			if (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)
600				io->io_hdr.flags |= CTL_FLAG_INT_COPY;
601			io->io_hdr.nexus = msg_info.hdr.nexus;
602#if 0
603			printf("targ %d, port %d, iid %d, lun %d\n",
604			       io->io_hdr.nexus.targ_target.id,
605			       io->io_hdr.nexus.targ_port,
606			       io->io_hdr.nexus.initid.id,
607			       io->io_hdr.nexus.targ_lun);
608#endif
609			io->scsiio.tag_num = msg_info.scsi.tag_num;
610			io->scsiio.tag_type = msg_info.scsi.tag_type;
611			memcpy(io->scsiio.cdb, msg_info.scsi.cdb,
612			       CTL_MAX_CDBLEN);
613			if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
614				struct ctl_cmd_entry *entry;
615				uint8_t opcode;
616
617				opcode = io->scsiio.cdb[0];
618				entry = &ctl_cmd_table[opcode];
619				io->io_hdr.flags &= ~CTL_FLAG_DATA_MASK;
620				io->io_hdr.flags |=
621					entry->flags & CTL_FLAG_DATA_MASK;
622			}
623			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
624					   &io->io_hdr, links);
625			ctl_wakeup_thread();
626			break;
627
628		/* Performed on the Originating SC, XFER mode only */
629		case CTL_MSG_DATAMOVE: {
630			struct ctl_sg_entry *sgl;
631			int i, j;
632
633			io = msg_info.hdr.original_sc;
634			if (io == NULL) {
635				printf("%s: original_sc == NULL!\n", __func__);
636				/* XXX KDM do something here */
637				break;
638			}
639			io->io_hdr.msg_type = CTL_MSG_DATAMOVE;
640			io->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
641			/*
642			 * Keep track of this, we need to send it back over
643			 * when the datamove is complete.
644			 */
645			io->io_hdr.serializing_sc = msg_info.hdr.serializing_sc;
646
647			if (msg_info.dt.sg_sequence == 0) {
648				/*
649				 * XXX KDM we use the preallocated S/G list
650				 * here, but we'll need to change this to
651				 * dynamic allocation if we need larger S/G
652				 * lists.
653				 */
654				if (msg_info.dt.kern_sg_entries >
655				    sizeof(io->io_hdr.remote_sglist) /
656				    sizeof(io->io_hdr.remote_sglist[0])) {
657					printf("%s: number of S/G entries "
658					    "needed %u > allocated num %zd\n",
659					    __func__,
660					    msg_info.dt.kern_sg_entries,
661					    sizeof(io->io_hdr.remote_sglist)/
662					    sizeof(io->io_hdr.remote_sglist[0]));
663
664					/*
665					 * XXX KDM send a message back to
666					 * the other side to shut down the
667					 * DMA.  The error will come back
668					 * through via the normal channel.
669					 */
670					break;
671				}
672				sgl = io->io_hdr.remote_sglist;
673				memset(sgl, 0,
674				       sizeof(io->io_hdr.remote_sglist));
675
676				io->scsiio.kern_data_ptr = (uint8_t *)sgl;
677
678				io->scsiio.kern_sg_entries =
679					msg_info.dt.kern_sg_entries;
680				io->scsiio.rem_sg_entries =
681					msg_info.dt.kern_sg_entries;
682				io->scsiio.kern_data_len =
683					msg_info.dt.kern_data_len;
684				io->scsiio.kern_total_len =
685					msg_info.dt.kern_total_len;
686				io->scsiio.kern_data_resid =
687					msg_info.dt.kern_data_resid;
688				io->scsiio.kern_rel_offset =
689					msg_info.dt.kern_rel_offset;
690				/*
691				 * Clear out per-DMA flags.
692				 */
693				io->io_hdr.flags &= ~CTL_FLAG_RDMA_MASK;
694				/*
695				 * Add per-DMA flags that are set for this
696				 * particular DMA request.
697				 */
698				io->io_hdr.flags |= msg_info.dt.flags &
699						    CTL_FLAG_RDMA_MASK;
700			} else
701				sgl = (struct ctl_sg_entry *)
702					io->scsiio.kern_data_ptr;
703
704			for (i = msg_info.dt.sent_sg_entries, j = 0;
705			     i < (msg_info.dt.sent_sg_entries +
706			     msg_info.dt.cur_sg_entries); i++, j++) {
707				sgl[i].addr = msg_info.dt.sg_list[j].addr;
708				sgl[i].len = msg_info.dt.sg_list[j].len;
709
710#if 0
711				printf("%s: L: %p,%d -> %p,%d j=%d, i=%d\n",
712				       __func__,
713				       msg_info.dt.sg_list[j].addr,
714				       msg_info.dt.sg_list[j].len,
715				       sgl[i].addr, sgl[i].len, j, i);
716#endif
717			}
718#if 0
719			memcpy(&sgl[msg_info.dt.sent_sg_entries],
720			       msg_info.dt.sg_list,
721			       sizeof(*sgl) * msg_info.dt.cur_sg_entries);
722#endif
723
724			/*
725			 * If this is the last piece of the I/O, we've got
726			 * the full S/G list.  Queue processing in the thread.
727			 * Otherwise wait for the next piece.
728			 */
729			if (msg_info.dt.sg_last != 0) {
730				STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
731						   &io->io_hdr, links);
732				ctl_wakeup_thread();
733			}
734			break;
735		}
736		/* Performed on the Serializing (primary) SC, XFER mode only */
737		case CTL_MSG_DATAMOVE_DONE: {
738			if (msg_info.hdr.serializing_sc == NULL) {
739				printf("%s: serializing_sc == NULL!\n",
740				       __func__);
741				/* XXX KDM now what? */
742				break;
743			}
744			/*
745			 * We grab the sense information here in case
746			 * there was a failure, so we can return status
747			 * back to the initiator.
748			 */
749			io = msg_info.hdr.serializing_sc;
750			io->io_hdr.msg_type = CTL_MSG_DATAMOVE_DONE;
751			io->io_hdr.status = msg_info.hdr.status;
752			io->scsiio.scsi_status = msg_info.scsi.scsi_status;
753			io->scsiio.sense_len = msg_info.scsi.sense_len;
754			io->scsiio.sense_residual =msg_info.scsi.sense_residual;
755			io->io_hdr.port_status = msg_info.scsi.fetd_status;
756			io->scsiio.residual = msg_info.scsi.residual;
757			memcpy(&io->scsiio.sense_data,&msg_info.scsi.sense_data,
758			       sizeof(io->scsiio.sense_data));
759
760			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
761					   &io->io_hdr, links);
762			ctl_wakeup_thread();
763			break;
764		}
765
766		/* Preformed on Originating SC, SER_ONLY mode */
767		case CTL_MSG_R2R:
768			io = msg_info.hdr.original_sc;
769			if (io == NULL) {
770				printf("%s: Major Bummer\n", __func__);
771				mtx_unlock(&ctl_softc->ctl_lock);
772				return;
773			} else {
774#if 0
775				printf("pOrig %x\n",(int) ctsio);
776#endif
777			}
778			io->io_hdr.msg_type = CTL_MSG_R2R;
779			io->io_hdr.serializing_sc = msg_info.hdr.serializing_sc;
780			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
781					   &io->io_hdr, links);
782			ctl_wakeup_thread();
783			break;
784
785		/*
786		 * Performed on Serializing(i.e. primary SC) SC in SER_ONLY
787		 * mode.
788		 * Performed on the Originating (i.e. secondary) SC in XFER
789		 * mode
790		 */
791		case CTL_MSG_FINISH_IO:
792			if (ctl_softc->ha_mode == CTL_HA_MODE_XFER)
793				ctl_isc_handler_finish_xfer(ctl_softc,
794							    &msg_info);
795			else
796				ctl_isc_handler_finish_ser_only(ctl_softc,
797								&msg_info);
798			break;
799
800		/* Preformed on Originating SC */
801		case CTL_MSG_BAD_JUJU:
802			io = msg_info.hdr.original_sc;
803			if (io == NULL) {
804				printf("%s: Bad JUJU!, original_sc is NULL!\n",
805				       __func__);
806				break;
807			}
808			ctl_copy_sense_data(&msg_info, io);
809			/*
810			 * IO should have already been cleaned up on other
811			 * SC so clear this flag so we won't send a message
812			 * back to finish the IO there.
813			 */
814			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
815			io->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
816
817			/* io = msg_info.hdr.serializing_sc; */
818			io->io_hdr.msg_type = CTL_MSG_BAD_JUJU;
819		        STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
820					   &io->io_hdr, links);
821			ctl_wakeup_thread();
822			break;
823
824		/* Handle resets sent from the other side */
825		case CTL_MSG_MANAGE_TASKS: {
826			struct ctl_taskio *taskio;
827			taskio = (struct ctl_taskio *)ctl_alloc_io(
828				(void *)ctl_softc->othersc_pool);
829			if (taskio == NULL) {
830				printf("ctl_isc_event_handler: can't allocate "
831				       "ctl_io!\n");
832				/* Bad Juju */
833				/* should I just call the proper reset func
834				   here??? */
835				mtx_unlock(&ctl_softc->ctl_lock);
836				goto bailout;
837			}
838			ctl_zero_io((union ctl_io *)taskio);
839			taskio->io_hdr.io_type = CTL_IO_TASK;
840			taskio->io_hdr.flags |= CTL_FLAG_FROM_OTHER_SC;
841			taskio->io_hdr.nexus = msg_info.hdr.nexus;
842			taskio->task_action = msg_info.task.task_action;
843			taskio->tag_num = msg_info.task.tag_num;
844			taskio->tag_type = msg_info.task.tag_type;
845#ifdef CTL_TIME_IO
846			taskio->io_hdr.start_time = time_uptime;
847			getbintime(&taskio->io_hdr.start_bt);
848#if 0
849			cs_prof_gettime(&taskio->io_hdr.start_ticks);
850#endif
851#endif /* CTL_TIME_IO */
852		        STAILQ_INSERT_TAIL(&ctl_softc->task_queue,
853					   &taskio->io_hdr, links);
854			ctl_softc->flags |= CTL_FLAG_TASK_PENDING;
855			ctl_wakeup_thread();
856			break;
857		}
858		/* Persistent Reserve action which needs attention */
859		case CTL_MSG_PERS_ACTION:
860			presio = (struct ctl_prio *)ctl_alloc_io(
861				(void *)ctl_softc->othersc_pool);
862			if (presio == NULL) {
863				printf("ctl_isc_event_handler: can't allocate "
864				       "ctl_io!\n");
865				/* Bad Juju */
866				/* Need to set busy and send msg back */
867				mtx_unlock(&ctl_softc->ctl_lock);
868				goto bailout;
869			}
870			ctl_zero_io((union ctl_io *)presio);
871			presio->io_hdr.msg_type = CTL_MSG_PERS_ACTION;
872			presio->pr_msg = msg_info.pr;
873		        STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
874					   &presio->io_hdr, links);
875			ctl_wakeup_thread();
876			break;
877		case CTL_MSG_SYNC_FE:
878			rcv_sync_msg = 1;
879			break;
880		case CTL_MSG_APS_LOCK: {
881			// It's quicker to execute this then to
882			// queue it.
883			struct ctl_lun *lun;
884			struct ctl_page_index *page_index;
885			struct copan_aps_subpage *current_sp;
886
887			lun = ctl_softc->ctl_luns[msg_info.hdr.nexus.targ_lun];
888			page_index = &lun->mode_pages.index[index_to_aps_page];
889			current_sp = (struct copan_aps_subpage *)
890				     (page_index->page_data +
891				     (page_index->page_len * CTL_PAGE_CURRENT));
892
893			current_sp->lock_active = msg_info.aps.lock_flag;
894		        break;
895		}
896		default:
897		        printf("How did I get here?\n");
898		}
899		mtx_unlock(&ctl_softc->ctl_lock);
900	} else if (event == CTL_HA_EVT_MSG_SENT) {
901		if (param != CTL_HA_STATUS_SUCCESS) {
902			printf("Bad status from ctl_ha_msg_send status %d\n",
903			       param);
904		}
905		return;
906	} else if (event == CTL_HA_EVT_DISCONNECT) {
907		printf("CTL: Got a disconnect from Isc\n");
908		return;
909	} else {
910		printf("ctl_isc_event_handler: Unknown event %d\n", event);
911		return;
912	}
913
914bailout:
915	return;
916}
917
918static void
919ctl_copy_sense_data(union ctl_ha_msg *src, union ctl_io *dest)
920{
921	struct scsi_sense_data *sense;
922
923	sense = &dest->scsiio.sense_data;
924	bcopy(&src->scsi.sense_data, sense, sizeof(*sense));
925	dest->scsiio.scsi_status = src->scsi.scsi_status;
926	dest->scsiio.sense_len = src->scsi.sense_len;
927	dest->io_hdr.status = src->hdr.status;
928}
929
930static void
931ctl_init(void)
932{
933	struct ctl_softc *softc;
934	struct ctl_io_pool *internal_pool, *emergency_pool, *other_pool;
935	struct ctl_frontend *fe;
936	struct ctl_lun *lun;
937        uint8_t sc_id =0;
938#if 0
939	int i;
940#endif
941	int retval;
942	//int isc_retval;
943
944	retval = 0;
945	ctl_pause_rtr = 0;
946        rcv_sync_msg = 0;
947
948	control_softc = malloc(sizeof(*control_softc), M_DEVBUF, M_WAITOK);
949	softc = control_softc;
950
951	memset(softc, 0, sizeof(*softc));
952
953	softc->dev = make_dev(&ctl_cdevsw, 0, UID_ROOT, GID_OPERATOR, 0600,
954			      "cam/ctl");
955
956	softc->dev->si_drv1 = softc;
957
958	mtx_init(&softc->ctl_lock, "CTL mutex", NULL, MTX_DEF);
959	softc->open_count = 0;
960
961	/*
962	 * Default to actually sending a SYNCHRONIZE CACHE command down to
963	 * the drive.
964	 */
965	softc->flags = CTL_FLAG_REAL_SYNC;
966
967	/*
968	 * In Copan's HA scheme, the "master" and "slave" roles are
969	 * figured out through the slot the controller is in.  Although it
970	 * is an active/active system, someone has to be in charge.
971 	 */
972#ifdef NEEDTOPORT
973        scmicro_rw(SCMICRO_GET_SHELF_ID, &sc_id);
974#endif
975
976        if (sc_id == 0) {
977		softc->flags |= CTL_FLAG_MASTER_SHELF;
978		persis_offset = 0;
979	} else
980		persis_offset = CTL_MAX_INITIATORS;
981
982	/*
983	 * XXX KDM need to figure out where we want to get our target ID
984	 * and WWID.  Is it different on each port?
985	 */
986	softc->target.id = 0;
987	softc->target.wwid[0] = 0x12345678;
988	softc->target.wwid[1] = 0x87654321;
989	STAILQ_INIT(&softc->lun_list);
990	STAILQ_INIT(&softc->pending_lun_queue);
991	STAILQ_INIT(&softc->task_queue);
992	STAILQ_INIT(&softc->incoming_queue);
993	STAILQ_INIT(&softc->rtr_queue);
994	STAILQ_INIT(&softc->done_queue);
995	STAILQ_INIT(&softc->isc_queue);
996	STAILQ_INIT(&softc->fe_list);
997	STAILQ_INIT(&softc->be_list);
998	STAILQ_INIT(&softc->io_pools);
999
1000	lun = &softc->lun;
1001
1002	/*
1003	 * We don't bother calling these with ctl_lock held here, because,
1004	 * in theory, no one else can try to do anything while we're in our
1005	 * module init routine.
1006	 */
1007	if (ctl_pool_create(softc, CTL_POOL_INTERNAL, CTL_POOL_ENTRIES_INTERNAL,
1008			    &internal_pool)!= 0){
1009		printf("ctl: can't allocate %d entry internal pool, "
1010		       "exiting\n", CTL_POOL_ENTRIES_INTERNAL);
1011		return;
1012	}
1013
1014	if (ctl_pool_create(softc, CTL_POOL_EMERGENCY,
1015			    CTL_POOL_ENTRIES_EMERGENCY, &emergency_pool) != 0) {
1016		printf("ctl: can't allocate %d entry emergency pool, "
1017		       "exiting\n", CTL_POOL_ENTRIES_EMERGENCY);
1018		ctl_pool_free(softc, internal_pool);
1019		return;
1020	}
1021
1022	if (ctl_pool_create(softc, CTL_POOL_4OTHERSC, CTL_POOL_ENTRIES_OTHER_SC,
1023	                    &other_pool) != 0)
1024	{
1025		printf("ctl: can't allocate %d entry other SC pool, "
1026		       "exiting\n", CTL_POOL_ENTRIES_OTHER_SC);
1027		ctl_pool_free(softc, internal_pool);
1028		ctl_pool_free(softc, emergency_pool);
1029		return;
1030	}
1031
1032	softc->internal_pool = internal_pool;
1033	softc->emergency_pool = emergency_pool;
1034	softc->othersc_pool = other_pool;
1035
1036	ctl_pool_acquire(internal_pool);
1037	ctl_pool_acquire(emergency_pool);
1038	ctl_pool_acquire(other_pool);
1039
1040	/*
1041	 * We used to allocate a processor LUN here.  The new scheme is to
1042	 * just let the user allocate LUNs as he sees fit.
1043	 */
1044#if 0
1045	mtx_lock(&softc->ctl_lock);
1046	ctl_alloc_lun(softc, lun, /*be_lun*/NULL, /*target*/softc->target);
1047	mtx_unlock(&softc->ctl_lock);
1048#endif
1049
1050	if (kproc_create(ctl_work_thread, softc, &softc->work_thread, 0, 0,
1051			 "ctl_thrd") != 0) {
1052		printf("error creating CTL work thread!\n");
1053		ctl_free_lun(lun);
1054		ctl_pool_free(softc, internal_pool);
1055		ctl_pool_free(softc, emergency_pool);
1056		ctl_pool_free(softc, other_pool);
1057		return;
1058	}
1059	printf("ctl: CAM Target Layer loaded\n");
1060
1061	/*
1062	 * Initialize the initiator and portname mappings
1063	 */
1064	memset(softc->wwpn_iid, 0, sizeof(softc->wwpn_iid));
1065
1066	/*
1067	 * Initialize the ioctl front end.
1068	 */
1069	fe = &softc->ioctl_info.fe;
1070	sprintf(softc->ioctl_info.port_name, "CTL ioctl");
1071	fe->port_type = CTL_PORT_IOCTL;
1072	fe->num_requested_ctl_io = 100;
1073	fe->port_name = softc->ioctl_info.port_name;
1074	fe->port_online = ctl_ioctl_online;
1075	fe->port_offline = ctl_ioctl_offline;
1076	fe->onoff_arg = &softc->ioctl_info;
1077	fe->targ_enable = ctl_ioctl_targ_enable;
1078	fe->targ_disable = ctl_ioctl_targ_disable;
1079	fe->lun_enable = ctl_ioctl_lun_enable;
1080	fe->lun_disable = ctl_ioctl_lun_disable;
1081	fe->targ_lun_arg = &softc->ioctl_info;
1082	fe->fe_datamove = ctl_ioctl_datamove;
1083	fe->fe_done = ctl_ioctl_done;
1084	fe->max_targets = 15;
1085	fe->max_target_id = 15;
1086
1087	if (ctl_frontend_register(&softc->ioctl_info.fe,
1088	                  (softc->flags & CTL_FLAG_MASTER_SHELF)) != 0) {
1089		printf("ctl: ioctl front end registration failed, will "
1090		       "continue anyway\n");
1091	}
1092
1093#ifdef CTL_IO_DELAY
1094	if (sizeof(struct callout) > CTL_TIMER_BYTES) {
1095		printf("sizeof(struct callout) %zd > CTL_TIMER_BYTES %zd\n",
1096		       sizeof(struct callout), CTL_TIMER_BYTES);
1097		return;
1098	}
1099#endif /* CTL_IO_DELAY */
1100
1101}
1102
1103void
1104ctl_shutdown(void)
1105{
1106	struct ctl_softc *softc;
1107	struct ctl_lun *lun, *next_lun;
1108	struct ctl_io_pool *pool, *next_pool;
1109
1110	softc = (struct ctl_softc *)control_softc;
1111
1112	if (ctl_frontend_deregister(&softc->ioctl_info.fe) != 0)
1113		printf("ctl: ioctl front end deregistration failed\n");
1114
1115	mtx_lock(&softc->ctl_lock);
1116
1117	/*
1118	 * Free up each LUN.
1119	 */
1120	for (lun = STAILQ_FIRST(&softc->lun_list); lun != NULL; lun = next_lun){
1121		next_lun = STAILQ_NEXT(lun, links);
1122		ctl_free_lun(lun);
1123	}
1124
1125	/*
1126	 * This will rip the rug out from under any FETDs or anyone else
1127	 * that has a pool allocated.  Since we increment our module
1128	 * refcount any time someone outside the main CTL module allocates
1129	 * a pool, we shouldn't have any problems here.  The user won't be
1130	 * able to unload the CTL module until client modules have
1131	 * successfully unloaded.
1132	 */
1133	for (pool = STAILQ_FIRST(&softc->io_pools); pool != NULL;
1134	     pool = next_pool) {
1135		next_pool = STAILQ_NEXT(pool, links);
1136		ctl_pool_free(softc, pool);
1137	}
1138
1139	mtx_unlock(&softc->ctl_lock);
1140
1141#if 0
1142	ctl_shutdown_thread(softc->work_thread);
1143#endif
1144
1145	mtx_destroy(&softc->ctl_lock);
1146
1147	destroy_dev(softc->dev);
1148
1149	printf("ctl: CAM Target Layer unloaded\n");
1150}
1151
1152/*
1153 * XXX KDM should we do some access checks here?  Bump a reference count to
1154 * prevent a CTL module from being unloaded while someone has it open?
1155 */
1156static int
1157ctl_open(struct cdev *dev, int flags, int fmt, struct thread *td)
1158{
1159	return (0);
1160}
1161
1162static int
1163ctl_close(struct cdev *dev, int flags, int fmt, struct thread *td)
1164{
1165	return (0);
1166}
1167
1168int
1169ctl_port_enable(ctl_port_type port_type)
1170{
1171	struct ctl_softc *softc;
1172	struct ctl_frontend *fe;
1173
1174	if (ctl_is_single == 0) {
1175		union ctl_ha_msg msg_info;
1176		int isc_retval;
1177
1178#if 0
1179		printf("%s: HA mode, synchronizing frontend enable\n",
1180		        __func__);
1181#endif
1182		msg_info.hdr.msg_type = CTL_MSG_SYNC_FE;
1183	        if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1184		        sizeof(msg_info), 1 )) > CTL_HA_STATUS_SUCCESS) {
1185			printf("Sync msg send error retval %d\n", isc_retval);
1186		}
1187		if (!rcv_sync_msg) {
1188			isc_retval=ctl_ha_msg_recv(CTL_HA_CHAN_CTL, &msg_info,
1189			        sizeof(msg_info), 1);
1190		}
1191#if 0
1192        	printf("CTL:Frontend Enable\n");
1193	} else {
1194		printf("%s: single mode, skipping frontend synchronization\n",
1195		        __func__);
1196#endif
1197	}
1198
1199	softc = control_softc;
1200
1201	STAILQ_FOREACH(fe, &softc->fe_list, links) {
1202		if (port_type & fe->port_type)
1203		{
1204#if 0
1205			printf("port %d\n", fe->targ_port);
1206#endif
1207			ctl_frontend_online(fe);
1208		}
1209	}
1210
1211	return (0);
1212}
1213
1214int
1215ctl_port_disable(ctl_port_type port_type)
1216{
1217	struct ctl_softc *softc;
1218	struct ctl_frontend *fe;
1219
1220	softc = control_softc;
1221
1222	STAILQ_FOREACH(fe, &softc->fe_list, links) {
1223		if (port_type & fe->port_type)
1224			ctl_frontend_offline(fe);
1225	}
1226
1227	return (0);
1228}
1229
1230/*
1231 * Returns 0 for success, 1 for failure.
1232 * Currently the only failure mode is if there aren't enough entries
1233 * allocated.  So, in case of a failure, look at num_entries_dropped,
1234 * reallocate and try again.
1235 */
1236int
1237ctl_port_list(struct ctl_port_entry *entries, int num_entries_alloced,
1238	      int *num_entries_filled, int *num_entries_dropped,
1239	      ctl_port_type port_type, int no_virtual)
1240{
1241	struct ctl_softc *softc;
1242	struct ctl_frontend *fe;
1243	int entries_dropped, entries_filled;
1244	int retval;
1245	int i;
1246
1247	softc = control_softc;
1248
1249	retval = 0;
1250	entries_filled = 0;
1251	entries_dropped = 0;
1252
1253	i = 0;
1254	mtx_lock(&softc->ctl_lock);
1255	STAILQ_FOREACH(fe, &softc->fe_list, links) {
1256		struct ctl_port_entry *entry;
1257
1258		if ((fe->port_type & port_type) == 0)
1259			continue;
1260
1261		if ((no_virtual != 0)
1262		 && (fe->virtual_port != 0))
1263			continue;
1264
1265		if (entries_filled >= num_entries_alloced) {
1266			entries_dropped++;
1267			continue;
1268		}
1269		entry = &entries[i];
1270
1271		entry->port_type = fe->port_type;
1272		strlcpy(entry->port_name, fe->port_name,
1273			sizeof(entry->port_name));
1274		entry->physical_port = fe->physical_port;
1275		entry->virtual_port = fe->virtual_port;
1276		entry->wwnn = fe->wwnn;
1277		entry->wwpn = fe->wwpn;
1278
1279		i++;
1280		entries_filled++;
1281	}
1282
1283	mtx_unlock(&softc->ctl_lock);
1284
1285	if (entries_dropped > 0)
1286		retval = 1;
1287
1288	*num_entries_dropped = entries_dropped;
1289	*num_entries_filled = entries_filled;
1290
1291	return (retval);
1292}
1293
1294static void
1295ctl_ioctl_online(void *arg)
1296{
1297	struct ctl_ioctl_info *ioctl_info;
1298
1299	ioctl_info = (struct ctl_ioctl_info *)arg;
1300
1301	ioctl_info->flags |= CTL_IOCTL_FLAG_ENABLED;
1302}
1303
1304static void
1305ctl_ioctl_offline(void *arg)
1306{
1307	struct ctl_ioctl_info *ioctl_info;
1308
1309	ioctl_info = (struct ctl_ioctl_info *)arg;
1310
1311	ioctl_info->flags &= ~CTL_IOCTL_FLAG_ENABLED;
1312}
1313
1314/*
1315 * Remove an initiator by port number and initiator ID.
1316 * Returns 0 for success, 1 for failure.
1317 * Assumes the caller does NOT hold the CTL lock.
1318 */
1319int
1320ctl_remove_initiator(int32_t targ_port, uint32_t iid)
1321{
1322	struct ctl_softc *softc;
1323
1324	softc = control_softc;
1325
1326	if ((targ_port < 0)
1327	 || (targ_port > CTL_MAX_PORTS)) {
1328		printf("%s: invalid port number %d\n", __func__, targ_port);
1329		return (1);
1330	}
1331	if (iid > CTL_MAX_INIT_PER_PORT) {
1332		printf("%s: initiator ID %u > maximun %u!\n",
1333		       __func__, iid, CTL_MAX_INIT_PER_PORT);
1334		return (1);
1335	}
1336
1337	mtx_lock(&softc->ctl_lock);
1338
1339	softc->wwpn_iid[targ_port][iid].in_use = 0;
1340
1341	mtx_unlock(&softc->ctl_lock);
1342
1343	return (0);
1344}
1345
1346/*
1347 * Add an initiator to the initiator map.
1348 * Returns 0 for success, 1 for failure.
1349 * Assumes the caller does NOT hold the CTL lock.
1350 */
1351int
1352ctl_add_initiator(uint64_t wwpn, int32_t targ_port, uint32_t iid)
1353{
1354	struct ctl_softc *softc;
1355	int retval;
1356
1357	softc = control_softc;
1358
1359	retval = 0;
1360
1361	if ((targ_port < 0)
1362	 || (targ_port > CTL_MAX_PORTS)) {
1363		printf("%s: invalid port number %d\n", __func__, targ_port);
1364		return (1);
1365	}
1366	if (iid > CTL_MAX_INIT_PER_PORT) {
1367		printf("%s: WWPN %#jx initiator ID %u > maximun %u!\n",
1368		       __func__, wwpn, iid, CTL_MAX_INIT_PER_PORT);
1369		return (1);
1370	}
1371
1372	mtx_lock(&softc->ctl_lock);
1373
1374	if (softc->wwpn_iid[targ_port][iid].in_use != 0) {
1375		/*
1376		 * We don't treat this as an error.
1377		 */
1378		if (softc->wwpn_iid[targ_port][iid].wwpn == wwpn) {
1379			printf("%s: port %d iid %u WWPN %#jx arrived again?\n",
1380			       __func__, targ_port, iid, (uintmax_t)wwpn);
1381			goto bailout;
1382		}
1383
1384		/*
1385		 * This is an error, but what do we do about it?  The
1386		 * driver is telling us we have a new WWPN for this
1387		 * initiator ID, so we pretty much need to use it.
1388		 */
1389		printf("%s: port %d iid %u WWPN %#jx arrived, WWPN %#jx is "
1390		       "still at that address\n", __func__, targ_port, iid,
1391		       (uintmax_t)wwpn,
1392		       (uintmax_t)softc->wwpn_iid[targ_port][iid].wwpn);
1393
1394		/*
1395		 * XXX KDM clear have_ca and ua_pending on each LUN for
1396		 * this initiator.
1397		 */
1398	}
1399	softc->wwpn_iid[targ_port][iid].in_use = 1;
1400	softc->wwpn_iid[targ_port][iid].iid = iid;
1401	softc->wwpn_iid[targ_port][iid].wwpn = wwpn;
1402	softc->wwpn_iid[targ_port][iid].port = targ_port;
1403
1404bailout:
1405
1406	mtx_unlock(&softc->ctl_lock);
1407
1408	return (retval);
1409}
1410
1411/*
1412 * XXX KDM should we pretend to do something in the target/lun
1413 * enable/disable functions?
1414 */
1415static int
1416ctl_ioctl_targ_enable(void *arg, struct ctl_id targ_id)
1417{
1418	return (0);
1419}
1420
1421static int
1422ctl_ioctl_targ_disable(void *arg, struct ctl_id targ_id)
1423{
1424	return (0);
1425}
1426
1427static int
1428ctl_ioctl_lun_enable(void *arg, struct ctl_id targ_id, int lun_id)
1429{
1430	return (0);
1431}
1432
1433static int
1434ctl_ioctl_lun_disable(void *arg, struct ctl_id targ_id, int lun_id)
1435{
1436	return (0);
1437}
1438
1439/*
1440 * Data movement routine for the CTL ioctl frontend port.
1441 */
1442static int
1443ctl_ioctl_do_datamove(struct ctl_scsiio *ctsio)
1444{
1445	struct ctl_sg_entry *ext_sglist, *kern_sglist;
1446	struct ctl_sg_entry ext_entry, kern_entry;
1447	int ext_sglen, ext_sg_entries, kern_sg_entries;
1448	int ext_sg_start, ext_offset;
1449	int len_to_copy, len_copied;
1450	int kern_watermark, ext_watermark;
1451	int ext_sglist_malloced;
1452	int i, j;
1453
1454	ext_sglist_malloced = 0;
1455	ext_sg_start = 0;
1456	ext_offset = 0;
1457
1458	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove\n"));
1459
1460	/*
1461	 * If this flag is set, fake the data transfer.
1462	 */
1463	if (ctsio->io_hdr.flags & CTL_FLAG_NO_DATAMOVE) {
1464		ctsio->ext_data_filled = ctsio->ext_data_len;
1465		goto bailout;
1466	}
1467
1468	/*
1469	 * To simplify things here, if we have a single buffer, stick it in
1470	 * a S/G entry and just make it a single entry S/G list.
1471	 */
1472	if (ctsio->io_hdr.flags & CTL_FLAG_EDPTR_SGLIST) {
1473		int len_seen;
1474
1475		ext_sglen = ctsio->ext_sg_entries * sizeof(*ext_sglist);
1476
1477		ext_sglist = (struct ctl_sg_entry *)malloc(ext_sglen, M_CTL,
1478							   M_WAITOK);
1479		if (ext_sglist == NULL) {
1480			ctl_set_internal_failure(ctsio,
1481						 /*sks_valid*/ 0,
1482						 /*retry_count*/ 0);
1483			return (CTL_RETVAL_COMPLETE);
1484		}
1485		ext_sglist_malloced = 1;
1486		if (copyin(ctsio->ext_data_ptr, ext_sglist,
1487				   ext_sglen) != 0) {
1488			ctl_set_internal_failure(ctsio,
1489						 /*sks_valid*/ 0,
1490						 /*retry_count*/ 0);
1491			goto bailout;
1492		}
1493		ext_sg_entries = ctsio->ext_sg_entries;
1494		len_seen = 0;
1495		for (i = 0; i < ext_sg_entries; i++) {
1496			if ((len_seen + ext_sglist[i].len) >=
1497			     ctsio->ext_data_filled) {
1498				ext_sg_start = i;
1499				ext_offset = ctsio->ext_data_filled - len_seen;
1500				break;
1501			}
1502			len_seen += ext_sglist[i].len;
1503		}
1504	} else {
1505		ext_sglist = &ext_entry;
1506		ext_sglist->addr = ctsio->ext_data_ptr;
1507		ext_sglist->len = ctsio->ext_data_len;
1508		ext_sg_entries = 1;
1509		ext_sg_start = 0;
1510		ext_offset = ctsio->ext_data_filled;
1511	}
1512
1513	if (ctsio->kern_sg_entries > 0) {
1514		kern_sglist = (struct ctl_sg_entry *)ctsio->kern_data_ptr;
1515		kern_sg_entries = ctsio->kern_sg_entries;
1516	} else {
1517		kern_sglist = &kern_entry;
1518		kern_sglist->addr = ctsio->kern_data_ptr;
1519		kern_sglist->len = ctsio->kern_data_len;
1520		kern_sg_entries = 1;
1521	}
1522
1523
1524	kern_watermark = 0;
1525	ext_watermark = ext_offset;
1526	len_copied = 0;
1527	for (i = ext_sg_start, j = 0;
1528	     i < ext_sg_entries && j < kern_sg_entries;) {
1529		uint8_t *ext_ptr, *kern_ptr;
1530
1531		len_to_copy = ctl_min(ext_sglist[i].len - ext_watermark,
1532				      kern_sglist[j].len - kern_watermark);
1533
1534		ext_ptr = (uint8_t *)ext_sglist[i].addr;
1535		ext_ptr = ext_ptr + ext_watermark;
1536		if (ctsio->io_hdr.flags & CTL_FLAG_BUS_ADDR) {
1537			/*
1538			 * XXX KDM fix this!
1539			 */
1540			panic("need to implement bus address support");
1541#if 0
1542			kern_ptr = bus_to_virt(kern_sglist[j].addr);
1543#endif
1544		} else
1545			kern_ptr = (uint8_t *)kern_sglist[j].addr;
1546		kern_ptr = kern_ptr + kern_watermark;
1547
1548		kern_watermark += len_to_copy;
1549		ext_watermark += len_to_copy;
1550
1551		if ((ctsio->io_hdr.flags & CTL_FLAG_DATA_MASK) ==
1552		     CTL_FLAG_DATA_IN) {
1553			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: copying %d "
1554					 "bytes to user\n", len_to_copy));
1555			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: from %p "
1556					 "to %p\n", kern_ptr, ext_ptr));
1557			if (copyout(kern_ptr, ext_ptr, len_to_copy) != 0) {
1558				ctl_set_internal_failure(ctsio,
1559							 /*sks_valid*/ 0,
1560							 /*retry_count*/ 0);
1561				goto bailout;
1562			}
1563		} else {
1564			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: copying %d "
1565					 "bytes from user\n", len_to_copy));
1566			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: from %p "
1567					 "to %p\n", ext_ptr, kern_ptr));
1568			if (copyin(ext_ptr, kern_ptr, len_to_copy)!= 0){
1569				ctl_set_internal_failure(ctsio,
1570							 /*sks_valid*/ 0,
1571							 /*retry_count*/0);
1572				goto bailout;
1573			}
1574		}
1575
1576		len_copied += len_to_copy;
1577
1578		if (ext_sglist[i].len == ext_watermark) {
1579			i++;
1580			ext_watermark = 0;
1581		}
1582
1583		if (kern_sglist[j].len == kern_watermark) {
1584			j++;
1585			kern_watermark = 0;
1586		}
1587	}
1588
1589	ctsio->ext_data_filled += len_copied;
1590
1591	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: ext_sg_entries: %d, "
1592			 "kern_sg_entries: %d\n", ext_sg_entries,
1593			 kern_sg_entries));
1594	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: ext_data_len = %d, "
1595			 "kern_data_len = %d\n", ctsio->ext_data_len,
1596			 ctsio->kern_data_len));
1597
1598
1599	/* XXX KDM set residual?? */
1600bailout:
1601
1602	if (ext_sglist_malloced != 0)
1603		free(ext_sglist, M_CTL);
1604
1605	return (CTL_RETVAL_COMPLETE);
1606}
1607
1608/*
1609 * Serialize a command that went down the "wrong" side, and so was sent to
1610 * this controller for execution.  The logic is a little different than the
1611 * standard case in ctl_scsiio_precheck().  Errors in this case need to get
1612 * sent back to the other side, but in the success case, we execute the
1613 * command on this side (XFER mode) or tell the other side to execute it
1614 * (SER_ONLY mode).
1615 */
1616static int
1617ctl_serialize_other_sc_cmd(struct ctl_scsiio *ctsio, int have_lock)
1618{
1619	struct ctl_softc *ctl_softc;
1620	union ctl_ha_msg msg_info;
1621	struct ctl_lun *lun;
1622	int retval = 0;
1623
1624	ctl_softc = control_softc;
1625	if (have_lock == 0)
1626		mtx_lock(&ctl_softc->ctl_lock);
1627
1628	lun = ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun];
1629	if (lun==NULL)
1630	{
1631		/*
1632		 * Why isn't LUN defined? The other side wouldn't
1633		 * send a cmd if the LUN is undefined.
1634		 */
1635		printf("%s: Bad JUJU!, LUN is NULL!\n", __func__);
1636
1637		/* "Logical unit not supported" */
1638		ctl_set_sense_data(&msg_info.scsi.sense_data,
1639				   lun,
1640				   /*sense_format*/SSD_TYPE_NONE,
1641				   /*current_error*/ 1,
1642				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1643				   /*asc*/ 0x25,
1644				   /*ascq*/ 0x00,
1645				   SSD_ELEM_NONE);
1646
1647		msg_info.scsi.sense_len = SSD_FULL_SIZE;
1648		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
1649		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
1650		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1651		msg_info.hdr.serializing_sc = NULL;
1652		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
1653	        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1654				sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1655		}
1656		if (have_lock == 0)
1657			mtx_unlock(&ctl_softc->ctl_lock);
1658		return(1);
1659
1660	}
1661
1662    	TAILQ_INSERT_TAIL(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
1663
1664	switch (ctl_check_ooa(lun, (union ctl_io *)ctsio,
1665		(union ctl_io *)TAILQ_PREV(&ctsio->io_hdr, ctl_ooaq,
1666		 ooa_links))) {
1667	case CTL_ACTION_BLOCK:
1668		ctsio->io_hdr.flags |= CTL_FLAG_BLOCKED;
1669		TAILQ_INSERT_TAIL(&lun->blocked_queue, &ctsio->io_hdr,
1670				  blocked_links);
1671		break;
1672	case CTL_ACTION_PASS:
1673	case CTL_ACTION_SKIP:
1674		if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
1675			ctsio->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
1676			STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
1677					   &ctsio->io_hdr, links);
1678		} else {
1679
1680			/* send msg back to other side */
1681			msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1682			msg_info.hdr.serializing_sc = (union ctl_io *)ctsio;
1683			msg_info.hdr.msg_type = CTL_MSG_R2R;
1684#if 0
1685			printf("2. pOrig %x\n", (int)msg_info.hdr.original_sc);
1686#endif
1687		        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1688			    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1689			}
1690		}
1691		break;
1692	case CTL_ACTION_OVERLAP:
1693		/* OVERLAPPED COMMANDS ATTEMPTED */
1694		ctl_set_sense_data(&msg_info.scsi.sense_data,
1695				   lun,
1696				   /*sense_format*/SSD_TYPE_NONE,
1697				   /*current_error*/ 1,
1698				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1699				   /*asc*/ 0x4E,
1700				   /*ascq*/ 0x00,
1701				   SSD_ELEM_NONE);
1702
1703		msg_info.scsi.sense_len = SSD_FULL_SIZE;
1704		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
1705		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
1706		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1707		msg_info.hdr.serializing_sc = NULL;
1708		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
1709#if 0
1710		printf("BAD JUJU:Major Bummer Overlap\n");
1711#endif
1712		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
1713		retval = 1;
1714		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1715		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1716		}
1717		break;
1718	case CTL_ACTION_OVERLAP_TAG:
1719		/* TAGGED OVERLAPPED COMMANDS (NN = QUEUE TAG) */
1720		ctl_set_sense_data(&msg_info.scsi.sense_data,
1721				   lun,
1722				   /*sense_format*/SSD_TYPE_NONE,
1723				   /*current_error*/ 1,
1724				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1725				   /*asc*/ 0x4D,
1726				   /*ascq*/ ctsio->tag_num & 0xff,
1727				   SSD_ELEM_NONE);
1728
1729		msg_info.scsi.sense_len = SSD_FULL_SIZE;
1730		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
1731		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
1732		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1733		msg_info.hdr.serializing_sc = NULL;
1734		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
1735#if 0
1736		printf("BAD JUJU:Major Bummer Overlap Tag\n");
1737#endif
1738		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
1739		retval = 1;
1740		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1741		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1742		}
1743		break;
1744	case CTL_ACTION_ERROR:
1745	default:
1746		/* "Internal target failure" */
1747		ctl_set_sense_data(&msg_info.scsi.sense_data,
1748				   lun,
1749				   /*sense_format*/SSD_TYPE_NONE,
1750				   /*current_error*/ 1,
1751				   /*sense_key*/ SSD_KEY_HARDWARE_ERROR,
1752				   /*asc*/ 0x44,
1753				   /*ascq*/ 0x00,
1754				   SSD_ELEM_NONE);
1755
1756		msg_info.scsi.sense_len = SSD_FULL_SIZE;
1757		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
1758		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
1759		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1760		msg_info.hdr.serializing_sc = NULL;
1761		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
1762#if 0
1763		printf("BAD JUJU:Major Bummer HW Error\n");
1764#endif
1765		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
1766		retval = 1;
1767		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1768		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1769		}
1770		break;
1771	}
1772	if (have_lock == 0)
1773		mtx_unlock(&ctl_softc->ctl_lock);
1774	return (retval);
1775}
1776
1777static int
1778ctl_ioctl_submit_wait(union ctl_io *io)
1779{
1780	struct ctl_fe_ioctl_params params;
1781	ctl_fe_ioctl_state last_state;
1782	int done, retval;
1783
1784	retval = 0;
1785
1786	bzero(&params, sizeof(params));
1787
1788	mtx_init(&params.ioctl_mtx, "ctliocmtx", NULL, MTX_DEF);
1789	cv_init(&params.sem, "ctlioccv");
1790	params.state = CTL_IOCTL_INPROG;
1791	last_state = params.state;
1792
1793	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = &params;
1794
1795	CTL_DEBUG_PRINT(("ctl_ioctl_submit_wait\n"));
1796
1797	/* This shouldn't happen */
1798	if ((retval = ctl_queue(io)) != CTL_RETVAL_COMPLETE)
1799		return (retval);
1800
1801	done = 0;
1802
1803	do {
1804		mtx_lock(&params.ioctl_mtx);
1805		/*
1806		 * Check the state here, and don't sleep if the state has
1807		 * already changed (i.e. wakeup has already occured, but we
1808		 * weren't waiting yet).
1809		 */
1810		if (params.state == last_state) {
1811			/* XXX KDM cv_wait_sig instead? */
1812			cv_wait(&params.sem, &params.ioctl_mtx);
1813		}
1814		last_state = params.state;
1815
1816		switch (params.state) {
1817		case CTL_IOCTL_INPROG:
1818			/* Why did we wake up? */
1819			/* XXX KDM error here? */
1820			mtx_unlock(&params.ioctl_mtx);
1821			break;
1822		case CTL_IOCTL_DATAMOVE:
1823			CTL_DEBUG_PRINT(("got CTL_IOCTL_DATAMOVE\n"));
1824
1825			/*
1826			 * change last_state back to INPROG to avoid
1827			 * deadlock on subsequent data moves.
1828			 */
1829			params.state = last_state = CTL_IOCTL_INPROG;
1830
1831			mtx_unlock(&params.ioctl_mtx);
1832			ctl_ioctl_do_datamove(&io->scsiio);
1833			/*
1834			 * Note that in some cases, most notably writes,
1835			 * this will queue the I/O and call us back later.
1836			 * In other cases, generally reads, this routine
1837			 * will immediately call back and wake us up,
1838			 * probably using our own context.
1839			 */
1840			io->scsiio.be_move_done(io);
1841			break;
1842		case CTL_IOCTL_DONE:
1843			mtx_unlock(&params.ioctl_mtx);
1844			CTL_DEBUG_PRINT(("got CTL_IOCTL_DONE\n"));
1845			done = 1;
1846			break;
1847		default:
1848			mtx_unlock(&params.ioctl_mtx);
1849			/* XXX KDM error here? */
1850			break;
1851		}
1852	} while (done == 0);
1853
1854	mtx_destroy(&params.ioctl_mtx);
1855	cv_destroy(&params.sem);
1856
1857	return (CTL_RETVAL_COMPLETE);
1858}
1859
1860static void
1861ctl_ioctl_datamove(union ctl_io *io)
1862{
1863	struct ctl_fe_ioctl_params *params;
1864
1865	params = (struct ctl_fe_ioctl_params *)
1866		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1867
1868	mtx_lock(&params->ioctl_mtx);
1869	params->state = CTL_IOCTL_DATAMOVE;
1870	cv_broadcast(&params->sem);
1871	mtx_unlock(&params->ioctl_mtx);
1872}
1873
1874static void
1875ctl_ioctl_done(union ctl_io *io)
1876{
1877	struct ctl_fe_ioctl_params *params;
1878
1879	params = (struct ctl_fe_ioctl_params *)
1880		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1881
1882	mtx_lock(&params->ioctl_mtx);
1883	params->state = CTL_IOCTL_DONE;
1884	cv_broadcast(&params->sem);
1885	mtx_unlock(&params->ioctl_mtx);
1886}
1887
1888static void
1889ctl_ioctl_hard_startstop_callback(void *arg, struct cfi_metatask *metatask)
1890{
1891	struct ctl_fe_ioctl_startstop_info *sd_info;
1892
1893	sd_info = (struct ctl_fe_ioctl_startstop_info *)arg;
1894
1895	sd_info->hs_info.status = metatask->status;
1896	sd_info->hs_info.total_luns = metatask->taskinfo.startstop.total_luns;
1897	sd_info->hs_info.luns_complete =
1898		metatask->taskinfo.startstop.luns_complete;
1899	sd_info->hs_info.luns_failed = metatask->taskinfo.startstop.luns_failed;
1900
1901	cv_broadcast(&sd_info->sem);
1902}
1903
1904static void
1905ctl_ioctl_bbrread_callback(void *arg, struct cfi_metatask *metatask)
1906{
1907	struct ctl_fe_ioctl_bbrread_info *fe_bbr_info;
1908
1909	fe_bbr_info = (struct ctl_fe_ioctl_bbrread_info *)arg;
1910
1911	mtx_lock(fe_bbr_info->lock);
1912	fe_bbr_info->bbr_info->status = metatask->status;
1913	fe_bbr_info->bbr_info->bbr_status = metatask->taskinfo.bbrread.status;
1914	fe_bbr_info->wakeup_done = 1;
1915	mtx_unlock(fe_bbr_info->lock);
1916
1917	cv_broadcast(&fe_bbr_info->sem);
1918}
1919
1920/*
1921 * Must be called with the ctl_lock held.
1922 * Returns 0 for success, errno for failure.
1923 */
1924static int
1925ctl_ioctl_fill_ooa(struct ctl_lun *lun, uint32_t *cur_fill_num,
1926		   struct ctl_ooa *ooa_hdr)
1927{
1928	union ctl_io *io;
1929	int retval;
1930
1931	retval = 0;
1932
1933	for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); (io != NULL);
1934	     (*cur_fill_num)++, io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,
1935	     ooa_links)) {
1936		struct ctl_ooa_entry *cur_entry, entry;
1937
1938		/*
1939		 * If we've got more than we can fit, just count the
1940		 * remaining entries.
1941		 */
1942		if (*cur_fill_num >= ooa_hdr->alloc_num)
1943			continue;
1944
1945		cur_entry = &ooa_hdr->entries[*cur_fill_num];
1946
1947		bzero(&entry, sizeof(entry));
1948
1949		entry.tag_num = io->scsiio.tag_num;
1950		entry.lun_num = lun->lun;
1951#ifdef CTL_TIME_IO
1952		entry.start_bt = io->io_hdr.start_bt;
1953#endif
1954		bcopy(io->scsiio.cdb, entry.cdb, io->scsiio.cdb_len);
1955		entry.cdb_len = io->scsiio.cdb_len;
1956		if (io->io_hdr.flags & CTL_FLAG_BLOCKED)
1957			entry.cmd_flags |= CTL_OOACMD_FLAG_BLOCKED;
1958
1959		if (io->io_hdr.flags & CTL_FLAG_DMA_INPROG)
1960			entry.cmd_flags |= CTL_OOACMD_FLAG_DMA;
1961
1962		if (io->io_hdr.flags & CTL_FLAG_ABORT)
1963			entry.cmd_flags |= CTL_OOACMD_FLAG_ABORT;
1964
1965		if (io->io_hdr.flags & CTL_FLAG_IS_WAS_ON_RTR)
1966			entry.cmd_flags |= CTL_OOACMD_FLAG_RTR;
1967
1968		if (io->io_hdr.flags & CTL_FLAG_DMA_QUEUED)
1969			entry.cmd_flags |= CTL_OOACMD_FLAG_DMA_QUEUED;
1970
1971		retval = copyout(&entry, cur_entry, sizeof(entry));
1972
1973		if (retval != 0)
1974			break;
1975	}
1976
1977	return (retval);
1978}
1979
1980static void *
1981ctl_copyin_alloc(void *user_addr, int len, char *error_str,
1982		 size_t error_str_len)
1983{
1984	void *kptr;
1985
1986	kptr = malloc(len, M_CTL, M_WAITOK | M_ZERO);
1987	if (kptr == NULL) {
1988		snprintf(error_str, error_str_len, "Cannot allocate %d bytes",
1989			 len);
1990		return (NULL);
1991	}
1992
1993	if (copyin(user_addr, kptr, len) != 0) {
1994		snprintf(error_str, error_str_len, "Error copying %d bytes "
1995			 "from user address %p to kernel address %p", len,
1996			 user_addr, kptr);
1997		free(kptr, M_CTL);
1998		return (NULL);
1999	}
2000
2001	return (kptr);
2002}
2003
2004static void
2005ctl_free_args(int num_be_args, struct ctl_be_arg *be_args)
2006{
2007	int i;
2008
2009	if (be_args == NULL)
2010		return;
2011
2012	for (i = 0; i < num_be_args; i++) {
2013		free(be_args[i].kname, M_CTL);
2014		free(be_args[i].kvalue, M_CTL);
2015	}
2016
2017	free(be_args, M_CTL);
2018}
2019
2020static struct ctl_be_arg *
2021ctl_copyin_args(int num_be_args, struct ctl_be_arg *be_args,
2022		char *error_str, size_t error_str_len)
2023{
2024	struct ctl_be_arg *args;
2025	int i;
2026
2027	args = ctl_copyin_alloc(be_args, num_be_args * sizeof(*be_args),
2028				error_str, error_str_len);
2029
2030	if (args == NULL)
2031		goto bailout;
2032
2033	for (i = 0; i < num_be_args; i++) {
2034		uint8_t *tmpptr;
2035
2036		args[i].kname = ctl_copyin_alloc(args[i].name,
2037			args[i].namelen, error_str, error_str_len);
2038		if (args[i].kname == NULL)
2039			goto bailout;
2040
2041		if (args[i].kname[args[i].namelen - 1] != '\0') {
2042			snprintf(error_str, error_str_len, "Argument %d "
2043				 "name is not NUL-terminated", i);
2044			goto bailout;
2045		}
2046
2047		args[i].kvalue = NULL;
2048
2049		tmpptr = ctl_copyin_alloc(args[i].value,
2050			args[i].vallen, error_str, error_str_len);
2051		if (tmpptr == NULL)
2052			goto bailout;
2053
2054		args[i].kvalue = tmpptr;
2055
2056		if ((args[i].flags & CTL_BEARG_ASCII)
2057		 && (tmpptr[args[i].vallen - 1] != '\0')) {
2058			snprintf(error_str, error_str_len, "Argument %d "
2059				 "value is not NUL-terminated", i);
2060			goto bailout;
2061		}
2062	}
2063
2064	return (args);
2065bailout:
2066
2067	ctl_free_args(num_be_args, args);
2068
2069	return (NULL);
2070}
2071
2072/*
2073 * Escape characters that are illegal or not recommended in XML.
2074 */
2075int
2076ctl_sbuf_printf_esc(struct sbuf *sb, char *str)
2077{
2078	int retval;
2079
2080	retval = 0;
2081
2082	for (; *str; str++) {
2083		switch (*str) {
2084		case '&':
2085			retval = sbuf_printf(sb, "&amp;");
2086			break;
2087		case '>':
2088			retval = sbuf_printf(sb, "&gt;");
2089			break;
2090		case '<':
2091			retval = sbuf_printf(sb, "&lt;");
2092			break;
2093		default:
2094			retval = sbuf_putc(sb, *str);
2095			break;
2096		}
2097
2098		if (retval != 0)
2099			break;
2100
2101	}
2102
2103	return (retval);
2104}
2105
2106static int
2107ctl_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
2108	  struct thread *td)
2109{
2110	struct ctl_softc *softc;
2111	int retval;
2112
2113	softc = control_softc;
2114
2115	retval = 0;
2116
2117	switch (cmd) {
2118	case CTL_IO: {
2119		union ctl_io *io;
2120		void *pool_tmp;
2121
2122		/*
2123		 * If we haven't been "enabled", don't allow any SCSI I/O
2124		 * to this FETD.
2125		 */
2126		if ((softc->ioctl_info.flags & CTL_IOCTL_FLAG_ENABLED) == 0) {
2127			retval = -EPERM;
2128			break;
2129		}
2130
2131		io = ctl_alloc_io(softc->ioctl_info.fe.ctl_pool_ref);
2132		if (io == NULL) {
2133			printf("ctl_ioctl: can't allocate ctl_io!\n");
2134			retval = -ENOSPC;
2135			break;
2136		}
2137
2138		/*
2139		 * Need to save the pool reference so it doesn't get
2140		 * spammed by the user's ctl_io.
2141		 */
2142		pool_tmp = io->io_hdr.pool;
2143
2144		memcpy(io, (void *)addr, sizeof(*io));
2145
2146		io->io_hdr.pool = pool_tmp;
2147		/*
2148		 * No status yet, so make sure the status is set properly.
2149		 */
2150		io->io_hdr.status = CTL_STATUS_NONE;
2151
2152		/*
2153		 * The user sets the initiator ID, target and LUN IDs.
2154		 */
2155		io->io_hdr.nexus.targ_port = softc->ioctl_info.fe.targ_port;
2156		io->io_hdr.flags |= CTL_FLAG_USER_REQ;
2157		if ((io->io_hdr.io_type == CTL_IO_SCSI)
2158		 && (io->scsiio.tag_type != CTL_TAG_UNTAGGED))
2159			io->scsiio.tag_num = softc->ioctl_info.cur_tag_num++;
2160
2161		retval = ctl_ioctl_submit_wait(io);
2162
2163		if (retval != 0) {
2164			ctl_free_io(io);
2165			break;
2166		}
2167
2168		memcpy((void *)addr, io, sizeof(*io));
2169
2170		/* return this to our pool */
2171		ctl_free_io(io);
2172
2173		break;
2174	}
2175	case CTL_ENABLE_PORT:
2176	case CTL_DISABLE_PORT:
2177	case CTL_SET_PORT_WWNS: {
2178		struct ctl_frontend *fe;
2179		struct ctl_port_entry *entry;
2180
2181		entry = (struct ctl_port_entry *)addr;
2182
2183		mtx_lock(&softc->ctl_lock);
2184		STAILQ_FOREACH(fe, &softc->fe_list, links) {
2185			int action, done;
2186
2187			action = 0;
2188			done = 0;
2189
2190			if ((entry->port_type == CTL_PORT_NONE)
2191			 && (entry->targ_port == fe->targ_port)) {
2192				/*
2193				 * If the user only wants to enable or
2194				 * disable or set WWNs on a specific port,
2195				 * do the operation and we're done.
2196				 */
2197				action = 1;
2198				done = 1;
2199			} else if (entry->port_type & fe->port_type) {
2200				/*
2201				 * Compare the user's type mask with the
2202				 * particular frontend type to see if we
2203				 * have a match.
2204				 */
2205				action = 1;
2206				done = 0;
2207
2208				/*
2209				 * Make sure the user isn't trying to set
2210				 * WWNs on multiple ports at the same time.
2211				 */
2212				if (cmd == CTL_SET_PORT_WWNS) {
2213					printf("%s: Can't set WWNs on "
2214					       "multiple ports\n", __func__);
2215					retval = EINVAL;
2216					break;
2217				}
2218			}
2219			if (action != 0) {
2220				/*
2221				 * XXX KDM we have to drop the lock here,
2222				 * because the online/offline operations
2223				 * can potentially block.  We need to
2224				 * reference count the frontends so they
2225				 * can't go away,
2226				 */
2227				mtx_unlock(&softc->ctl_lock);
2228
2229				if (cmd == CTL_ENABLE_PORT)
2230					ctl_frontend_online(fe);
2231				else if (cmd == CTL_DISABLE_PORT)
2232					ctl_frontend_offline(fe);
2233
2234				mtx_lock(&softc->ctl_lock);
2235
2236				if (cmd == CTL_SET_PORT_WWNS)
2237					ctl_frontend_set_wwns(fe,
2238					    (entry->flags & CTL_PORT_WWNN_VALID) ?
2239					    1 : 0, entry->wwnn,
2240					    (entry->flags & CTL_PORT_WWPN_VALID) ?
2241					    1 : 0, entry->wwpn);
2242			}
2243			if (done != 0)
2244				break;
2245		}
2246		mtx_unlock(&softc->ctl_lock);
2247		break;
2248	}
2249	case CTL_GET_PORT_LIST: {
2250		struct ctl_frontend *fe;
2251		struct ctl_port_list *list;
2252		int i;
2253
2254		list = (struct ctl_port_list *)addr;
2255
2256		if (list->alloc_len != (list->alloc_num *
2257		    sizeof(struct ctl_port_entry))) {
2258			printf("%s: CTL_GET_PORT_LIST: alloc_len %u != "
2259			       "alloc_num %u * sizeof(struct ctl_port_entry) "
2260			       "%zu\n", __func__, list->alloc_len,
2261			       list->alloc_num, sizeof(struct ctl_port_entry));
2262			retval = EINVAL;
2263			break;
2264		}
2265		list->fill_len = 0;
2266		list->fill_num = 0;
2267		list->dropped_num = 0;
2268		i = 0;
2269		mtx_lock(&softc->ctl_lock);
2270		STAILQ_FOREACH(fe, &softc->fe_list, links) {
2271			struct ctl_port_entry entry, *list_entry;
2272
2273			if (list->fill_num >= list->alloc_num) {
2274				list->dropped_num++;
2275				continue;
2276			}
2277
2278			entry.port_type = fe->port_type;
2279			strlcpy(entry.port_name, fe->port_name,
2280				sizeof(entry.port_name));
2281			entry.targ_port = fe->targ_port;
2282			entry.physical_port = fe->physical_port;
2283			entry.virtual_port = fe->virtual_port;
2284			entry.wwnn = fe->wwnn;
2285			entry.wwpn = fe->wwpn;
2286			if (fe->status & CTL_PORT_STATUS_ONLINE)
2287				entry.online = 1;
2288			else
2289				entry.online = 0;
2290
2291			list_entry = &list->entries[i];
2292
2293			retval = copyout(&entry, list_entry, sizeof(entry));
2294			if (retval != 0) {
2295				printf("%s: CTL_GET_PORT_LIST: copyout "
2296				       "returned %d\n", __func__, retval);
2297				break;
2298			}
2299			i++;
2300			list->fill_num++;
2301			list->fill_len += sizeof(entry);
2302		}
2303		mtx_unlock(&softc->ctl_lock);
2304
2305		/*
2306		 * If this is non-zero, we had a copyout fault, so there's
2307		 * probably no point in attempting to set the status inside
2308		 * the structure.
2309		 */
2310		if (retval != 0)
2311			break;
2312
2313		if (list->dropped_num > 0)
2314			list->status = CTL_PORT_LIST_NEED_MORE_SPACE;
2315		else
2316			list->status = CTL_PORT_LIST_OK;
2317		break;
2318	}
2319	case CTL_DUMP_OOA: {
2320		struct ctl_lun *lun;
2321		union ctl_io *io;
2322		char printbuf[128];
2323		struct sbuf sb;
2324
2325		mtx_lock(&softc->ctl_lock);
2326		printf("Dumping OOA queues:\n");
2327		STAILQ_FOREACH(lun, &softc->lun_list, links) {
2328			for (io = (union ctl_io *)TAILQ_FIRST(
2329			     &lun->ooa_queue); io != NULL;
2330			     io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,
2331			     ooa_links)) {
2332				sbuf_new(&sb, printbuf, sizeof(printbuf),
2333					 SBUF_FIXEDLEN);
2334				sbuf_printf(&sb, "LUN %jd tag 0x%04x%s%s%s%s: ",
2335					    (intmax_t)lun->lun,
2336					    io->scsiio.tag_num,
2337					    (io->io_hdr.flags &
2338					    CTL_FLAG_BLOCKED) ? "" : " BLOCKED",
2339					    (io->io_hdr.flags &
2340					    CTL_FLAG_DMA_INPROG) ? " DMA" : "",
2341					    (io->io_hdr.flags &
2342					    CTL_FLAG_ABORT) ? " ABORT" : "",
2343			                    (io->io_hdr.flags &
2344		                        CTL_FLAG_IS_WAS_ON_RTR) ? " RTR" : "");
2345				ctl_scsi_command_string(&io->scsiio, NULL, &sb);
2346				sbuf_finish(&sb);
2347				printf("%s\n", sbuf_data(&sb));
2348			}
2349		}
2350		printf("OOA queues dump done\n");
2351		mtx_unlock(&softc->ctl_lock);
2352		break;
2353	}
2354	case CTL_GET_OOA: {
2355		struct ctl_lun *lun;
2356		struct ctl_ooa *ooa_hdr;
2357		uint32_t cur_fill_num;
2358
2359		ooa_hdr = (struct ctl_ooa *)addr;
2360
2361		if ((ooa_hdr->alloc_len == 0)
2362		 || (ooa_hdr->alloc_num == 0)) {
2363			printf("%s: CTL_GET_OOA: alloc len %u and alloc num %u "
2364			       "must be non-zero\n", __func__,
2365			       ooa_hdr->alloc_len, ooa_hdr->alloc_num);
2366			retval = EINVAL;
2367			break;
2368		}
2369
2370		if (ooa_hdr->alloc_len != (ooa_hdr->alloc_num *
2371		    sizeof(struct ctl_ooa_entry))) {
2372			printf("%s: CTL_GET_OOA: alloc len %u must be alloc "
2373			       "num %d * sizeof(struct ctl_ooa_entry) %zd\n",
2374			       __func__, ooa_hdr->alloc_len,
2375			       ooa_hdr->alloc_num,sizeof(struct ctl_ooa_entry));
2376			retval = EINVAL;
2377			break;
2378		}
2379
2380		mtx_lock(&softc->ctl_lock);
2381		if (((ooa_hdr->flags & CTL_OOA_FLAG_ALL_LUNS) == 0)
2382		 && ((ooa_hdr->lun_num > CTL_MAX_LUNS)
2383		  || (softc->ctl_luns[ooa_hdr->lun_num] == NULL))) {
2384			mtx_unlock(&softc->ctl_lock);
2385			printf("%s: CTL_GET_OOA: invalid LUN %ju\n",
2386			       __func__, (uintmax_t)ooa_hdr->lun_num);
2387			retval = EINVAL;
2388			break;
2389		}
2390
2391		cur_fill_num = 0;
2392
2393		if (ooa_hdr->flags & CTL_OOA_FLAG_ALL_LUNS) {
2394			STAILQ_FOREACH(lun, &softc->lun_list, links) {
2395				retval = ctl_ioctl_fill_ooa(lun, &cur_fill_num,
2396					ooa_hdr);
2397				if (retval != 0)
2398					break;
2399			}
2400			if (retval != 0) {
2401				mtx_unlock(&softc->ctl_lock);
2402				break;
2403			}
2404		} else {
2405			lun = softc->ctl_luns[ooa_hdr->lun_num];
2406
2407			retval = ctl_ioctl_fill_ooa(lun, &cur_fill_num,ooa_hdr);
2408		}
2409		mtx_unlock(&softc->ctl_lock);
2410
2411		ooa_hdr->fill_num = min(cur_fill_num, ooa_hdr->alloc_num);
2412		ooa_hdr->fill_len = ooa_hdr->fill_num *
2413			sizeof(struct ctl_ooa_entry);
2414
2415		getbintime(&ooa_hdr->cur_bt);
2416
2417		if (cur_fill_num > ooa_hdr->alloc_num) {
2418			ooa_hdr->dropped_num = cur_fill_num -ooa_hdr->alloc_num;
2419			ooa_hdr->status = CTL_OOA_NEED_MORE_SPACE;
2420		} else {
2421			ooa_hdr->dropped_num = 0;
2422			ooa_hdr->status = CTL_OOA_OK;
2423		}
2424		break;
2425	}
2426	case CTL_CHECK_OOA: {
2427		union ctl_io *io;
2428		struct ctl_lun *lun;
2429		struct ctl_ooa_info *ooa_info;
2430
2431
2432		ooa_info = (struct ctl_ooa_info *)addr;
2433
2434		if (ooa_info->lun_id >= CTL_MAX_LUNS) {
2435			ooa_info->status = CTL_OOA_INVALID_LUN;
2436			break;
2437		}
2438		mtx_lock(&softc->ctl_lock);
2439		lun = softc->ctl_luns[ooa_info->lun_id];
2440		if (lun == NULL) {
2441			mtx_unlock(&softc->ctl_lock);
2442			ooa_info->status = CTL_OOA_INVALID_LUN;
2443			break;
2444		}
2445
2446		ooa_info->num_entries = 0;
2447		for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
2448		     io != NULL; io = (union ctl_io *)TAILQ_NEXT(
2449		     &io->io_hdr, ooa_links)) {
2450			ooa_info->num_entries++;
2451		}
2452
2453		mtx_unlock(&softc->ctl_lock);
2454		ooa_info->status = CTL_OOA_SUCCESS;
2455
2456		break;
2457	}
2458	case CTL_HARD_START:
2459	case CTL_HARD_STOP: {
2460		struct ctl_fe_ioctl_startstop_info ss_info;
2461		struct cfi_metatask *metatask;
2462		struct mtx hs_mtx;
2463
2464		mtx_init(&hs_mtx, "HS Mutex", NULL, MTX_DEF);
2465
2466		cv_init(&ss_info.sem, "hard start/stop cv" );
2467
2468		metatask = cfi_alloc_metatask(/*can_wait*/ 1);
2469		if (metatask == NULL) {
2470			retval = ENOMEM;
2471			mtx_destroy(&hs_mtx);
2472			break;
2473		}
2474
2475		if (cmd == CTL_HARD_START)
2476			metatask->tasktype = CFI_TASK_STARTUP;
2477		else
2478			metatask->tasktype = CFI_TASK_SHUTDOWN;
2479
2480		metatask->callback = ctl_ioctl_hard_startstop_callback;
2481		metatask->callback_arg = &ss_info;
2482
2483		cfi_action(metatask);
2484
2485		/* Wait for the callback */
2486		mtx_lock(&hs_mtx);
2487		cv_wait_sig(&ss_info.sem, &hs_mtx);
2488		mtx_unlock(&hs_mtx);
2489
2490		/*
2491		 * All information has been copied from the metatask by the
2492		 * time cv_broadcast() is called, so we free the metatask here.
2493		 */
2494		cfi_free_metatask(metatask);
2495
2496		memcpy((void *)addr, &ss_info.hs_info, sizeof(ss_info.hs_info));
2497
2498		mtx_destroy(&hs_mtx);
2499		break;
2500	}
2501	case CTL_BBRREAD: {
2502		struct ctl_bbrread_info *bbr_info;
2503		struct ctl_fe_ioctl_bbrread_info fe_bbr_info;
2504		struct mtx bbr_mtx;
2505		struct cfi_metatask *metatask;
2506
2507		bbr_info = (struct ctl_bbrread_info *)addr;
2508
2509		bzero(&fe_bbr_info, sizeof(fe_bbr_info));
2510
2511		bzero(&bbr_mtx, sizeof(bbr_mtx));
2512		mtx_init(&bbr_mtx, "BBR Mutex", NULL, MTX_DEF);
2513
2514		fe_bbr_info.bbr_info = bbr_info;
2515		fe_bbr_info.lock = &bbr_mtx;
2516
2517		cv_init(&fe_bbr_info.sem, "BBR read cv");
2518		metatask = cfi_alloc_metatask(/*can_wait*/ 1);
2519
2520		if (metatask == NULL) {
2521			mtx_destroy(&bbr_mtx);
2522			cv_destroy(&fe_bbr_info.sem);
2523			retval = ENOMEM;
2524			break;
2525		}
2526		metatask->tasktype = CFI_TASK_BBRREAD;
2527		metatask->callback = ctl_ioctl_bbrread_callback;
2528		metatask->callback_arg = &fe_bbr_info;
2529		metatask->taskinfo.bbrread.lun_num = bbr_info->lun_num;
2530		metatask->taskinfo.bbrread.lba = bbr_info->lba;
2531		metatask->taskinfo.bbrread.len = bbr_info->len;
2532
2533		cfi_action(metatask);
2534
2535		mtx_lock(&bbr_mtx);
2536		while (fe_bbr_info.wakeup_done == 0)
2537			cv_wait_sig(&fe_bbr_info.sem, &bbr_mtx);
2538		mtx_unlock(&bbr_mtx);
2539
2540		bbr_info->status = metatask->status;
2541		bbr_info->bbr_status = metatask->taskinfo.bbrread.status;
2542		bbr_info->scsi_status = metatask->taskinfo.bbrread.scsi_status;
2543		memcpy(&bbr_info->sense_data,
2544		       &metatask->taskinfo.bbrread.sense_data,
2545		       ctl_min(sizeof(bbr_info->sense_data),
2546			       sizeof(metatask->taskinfo.bbrread.sense_data)));
2547
2548		cfi_free_metatask(metatask);
2549
2550		mtx_destroy(&bbr_mtx);
2551		cv_destroy(&fe_bbr_info.sem);
2552
2553		break;
2554	}
2555	case CTL_DELAY_IO: {
2556		struct ctl_io_delay_info *delay_info;
2557#ifdef CTL_IO_DELAY
2558		struct ctl_lun *lun;
2559#endif /* CTL_IO_DELAY */
2560
2561		delay_info = (struct ctl_io_delay_info *)addr;
2562
2563#ifdef CTL_IO_DELAY
2564		mtx_lock(&softc->ctl_lock);
2565
2566		if ((delay_info->lun_id > CTL_MAX_LUNS)
2567		 || (softc->ctl_luns[delay_info->lun_id] == NULL)) {
2568			delay_info->status = CTL_DELAY_STATUS_INVALID_LUN;
2569		} else {
2570			lun = softc->ctl_luns[delay_info->lun_id];
2571
2572			delay_info->status = CTL_DELAY_STATUS_OK;
2573
2574			switch (delay_info->delay_type) {
2575			case CTL_DELAY_TYPE_CONT:
2576				break;
2577			case CTL_DELAY_TYPE_ONESHOT:
2578				break;
2579			default:
2580				delay_info->status =
2581					CTL_DELAY_STATUS_INVALID_TYPE;
2582				break;
2583			}
2584
2585			switch (delay_info->delay_loc) {
2586			case CTL_DELAY_LOC_DATAMOVE:
2587				lun->delay_info.datamove_type =
2588					delay_info->delay_type;
2589				lun->delay_info.datamove_delay =
2590					delay_info->delay_secs;
2591				break;
2592			case CTL_DELAY_LOC_DONE:
2593				lun->delay_info.done_type =
2594					delay_info->delay_type;
2595				lun->delay_info.done_delay =
2596					delay_info->delay_secs;
2597				break;
2598			default:
2599				delay_info->status =
2600					CTL_DELAY_STATUS_INVALID_LOC;
2601				break;
2602			}
2603		}
2604
2605		mtx_unlock(&softc->ctl_lock);
2606#else
2607		delay_info->status = CTL_DELAY_STATUS_NOT_IMPLEMENTED;
2608#endif /* CTL_IO_DELAY */
2609		break;
2610	}
2611	case CTL_REALSYNC_SET: {
2612		int *syncstate;
2613
2614		syncstate = (int *)addr;
2615
2616		mtx_lock(&softc->ctl_lock);
2617		switch (*syncstate) {
2618		case 0:
2619			softc->flags &= ~CTL_FLAG_REAL_SYNC;
2620			break;
2621		case 1:
2622			softc->flags |= CTL_FLAG_REAL_SYNC;
2623			break;
2624		default:
2625			retval = -EINVAL;
2626			break;
2627		}
2628		mtx_unlock(&softc->ctl_lock);
2629		break;
2630	}
2631	case CTL_REALSYNC_GET: {
2632		int *syncstate;
2633
2634		syncstate = (int*)addr;
2635
2636		mtx_lock(&softc->ctl_lock);
2637		if (softc->flags & CTL_FLAG_REAL_SYNC)
2638			*syncstate = 1;
2639		else
2640			*syncstate = 0;
2641		mtx_unlock(&softc->ctl_lock);
2642
2643		break;
2644	}
2645	case CTL_SETSYNC:
2646	case CTL_GETSYNC: {
2647		struct ctl_sync_info *sync_info;
2648		struct ctl_lun *lun;
2649
2650		sync_info = (struct ctl_sync_info *)addr;
2651
2652		mtx_lock(&softc->ctl_lock);
2653		lun = softc->ctl_luns[sync_info->lun_id];
2654		if (lun == NULL) {
2655			mtx_unlock(&softc->ctl_lock);
2656			sync_info->status = CTL_GS_SYNC_NO_LUN;
2657		}
2658		/*
2659		 * Get or set the sync interval.  We're not bounds checking
2660		 * in the set case, hopefully the user won't do something
2661		 * silly.
2662		 */
2663		if (cmd == CTL_GETSYNC)
2664			sync_info->sync_interval = lun->sync_interval;
2665		else
2666			lun->sync_interval = sync_info->sync_interval;
2667
2668		mtx_unlock(&softc->ctl_lock);
2669
2670		sync_info->status = CTL_GS_SYNC_OK;
2671
2672		break;
2673	}
2674	case CTL_GETSTATS: {
2675		struct ctl_stats *stats;
2676		struct ctl_lun *lun;
2677		int i;
2678
2679		stats = (struct ctl_stats *)addr;
2680
2681		if ((sizeof(struct ctl_lun_io_stats) * softc->num_luns) >
2682		     stats->alloc_len) {
2683			stats->status = CTL_SS_NEED_MORE_SPACE;
2684			stats->num_luns = softc->num_luns;
2685			break;
2686		}
2687		/*
2688		 * XXX KDM no locking here.  If the LUN list changes,
2689		 * things can blow up.
2690		 */
2691		for (i = 0, lun = STAILQ_FIRST(&softc->lun_list); lun != NULL;
2692		     i++, lun = STAILQ_NEXT(lun, links)) {
2693			retval = copyout(&lun->stats, &stats->lun_stats[i],
2694					 sizeof(lun->stats));
2695			if (retval != 0)
2696				break;
2697		}
2698		stats->num_luns = softc->num_luns;
2699		stats->fill_len = sizeof(struct ctl_lun_io_stats) *
2700				 softc->num_luns;
2701		stats->status = CTL_SS_OK;
2702#ifdef CTL_TIME_IO
2703		stats->flags = CTL_STATS_FLAG_TIME_VALID;
2704#else
2705		stats->flags = CTL_STATS_FLAG_NONE;
2706#endif
2707		getnanouptime(&stats->timestamp);
2708		break;
2709	}
2710	case CTL_ERROR_INJECT: {
2711		struct ctl_error_desc *err_desc, *new_err_desc;
2712		struct ctl_lun *lun;
2713
2714		err_desc = (struct ctl_error_desc *)addr;
2715
2716		new_err_desc = malloc(sizeof(*new_err_desc), M_CTL,
2717				      M_WAITOK | M_ZERO);
2718		if (new_err_desc == NULL) {
2719			printf("%s: CTL_ERROR_INJECT: error allocating %zu "
2720			       "bytes\n", __func__, sizeof(*new_err_desc));
2721			retval = ENOMEM;
2722			break;
2723		}
2724		bcopy(err_desc, new_err_desc, sizeof(*new_err_desc));
2725
2726		mtx_lock(&softc->ctl_lock);
2727		lun = softc->ctl_luns[err_desc->lun_id];
2728		if (lun == NULL) {
2729			mtx_unlock(&softc->ctl_lock);
2730			printf("%s: CTL_ERROR_INJECT: invalid LUN %ju\n",
2731			       __func__, (uintmax_t)err_desc->lun_id);
2732			retval = EINVAL;
2733			break;
2734		}
2735
2736		/*
2737		 * We could do some checking here to verify the validity
2738		 * of the request, but given the complexity of error
2739		 * injection requests, the checking logic would be fairly
2740		 * complex.
2741		 *
2742		 * For now, if the request is invalid, it just won't get
2743		 * executed and might get deleted.
2744		 */
2745		STAILQ_INSERT_TAIL(&lun->error_list, new_err_desc, links);
2746
2747		/*
2748		 * XXX KDM check to make sure the serial number is unique,
2749		 * in case we somehow manage to wrap.  That shouldn't
2750		 * happen for a very long time, but it's the right thing to
2751		 * do.
2752		 */
2753		new_err_desc->serial = lun->error_serial;
2754		err_desc->serial = lun->error_serial;
2755		lun->error_serial++;
2756
2757		mtx_unlock(&softc->ctl_lock);
2758		break;
2759	}
2760	case CTL_ERROR_INJECT_DELETE: {
2761		struct ctl_error_desc *delete_desc, *desc, *desc2;
2762		struct ctl_lun *lun;
2763		int delete_done;
2764
2765		delete_desc = (struct ctl_error_desc *)addr;
2766		delete_done = 0;
2767
2768		mtx_lock(&softc->ctl_lock);
2769		lun = softc->ctl_luns[delete_desc->lun_id];
2770		if (lun == NULL) {
2771			mtx_unlock(&softc->ctl_lock);
2772			printf("%s: CTL_ERROR_INJECT_DELETE: invalid LUN %ju\n",
2773			       __func__, (uintmax_t)delete_desc->lun_id);
2774			retval = EINVAL;
2775			break;
2776		}
2777		STAILQ_FOREACH_SAFE(desc, &lun->error_list, links, desc2) {
2778			if (desc->serial != delete_desc->serial)
2779				continue;
2780
2781			STAILQ_REMOVE(&lun->error_list, desc, ctl_error_desc,
2782				      links);
2783			free(desc, M_CTL);
2784			delete_done = 1;
2785		}
2786		mtx_unlock(&softc->ctl_lock);
2787		if (delete_done == 0) {
2788			printf("%s: CTL_ERROR_INJECT_DELETE: can't find "
2789			       "error serial %ju on LUN %u\n", __func__,
2790			       delete_desc->serial, delete_desc->lun_id);
2791			retval = EINVAL;
2792			break;
2793		}
2794		break;
2795	}
2796	case CTL_DUMP_STRUCTS: {
2797		int i, j, k;
2798		struct ctl_frontend *fe;
2799
2800		printf("CTL IID to WWPN map start:\n");
2801		for (i = 0; i < CTL_MAX_PORTS; i++) {
2802			for (j = 0; j < CTL_MAX_INIT_PER_PORT; j++) {
2803				if (softc->wwpn_iid[i][j].in_use == 0)
2804					continue;
2805
2806				printf("port %d iid %u WWPN %#jx\n",
2807				       softc->wwpn_iid[i][j].port,
2808				       softc->wwpn_iid[i][j].iid,
2809				       (uintmax_t)softc->wwpn_iid[i][j].wwpn);
2810			}
2811		}
2812		printf("CTL IID to WWPN map end\n");
2813		printf("CTL Persistent Reservation information start:\n");
2814		for (i = 0; i < CTL_MAX_LUNS; i++) {
2815			struct ctl_lun *lun;
2816
2817			lun = softc->ctl_luns[i];
2818
2819			if ((lun == NULL)
2820			 || ((lun->flags & CTL_LUN_DISABLED) != 0))
2821				continue;
2822
2823			for (j = 0; j < (CTL_MAX_PORTS * 2); j++) {
2824				for (k = 0; k < CTL_MAX_INIT_PER_PORT; k++){
2825					if (lun->per_res[j+k].registered == 0)
2826						continue;
2827					printf("LUN %d port %d iid %d key "
2828					       "%#jx\n", i, j, k,
2829					       (uintmax_t)scsi_8btou64(
2830					       lun->per_res[j+k].res_key.key));
2831				}
2832			}
2833		}
2834		printf("CTL Persistent Reservation information end\n");
2835		printf("CTL Frontends:\n");
2836		/*
2837		 * XXX KDM calling this without a lock.  We'd likely want
2838		 * to drop the lock before calling the frontend's dump
2839		 * routine anyway.
2840		 */
2841		STAILQ_FOREACH(fe, &softc->fe_list, links) {
2842			printf("Frontend %s Type %u pport %d vport %d WWNN "
2843			       "%#jx WWPN %#jx\n", fe->port_name, fe->port_type,
2844			       fe->physical_port, fe->virtual_port,
2845			       (uintmax_t)fe->wwnn, (uintmax_t)fe->wwpn);
2846
2847			/*
2848			 * Frontends are not required to support the dump
2849			 * routine.
2850			 */
2851			if (fe->fe_dump == NULL)
2852				continue;
2853
2854			fe->fe_dump();
2855		}
2856		printf("CTL Frontend information end\n");
2857		break;
2858	}
2859	case CTL_LUN_REQ: {
2860		struct ctl_lun_req *lun_req;
2861		struct ctl_backend_driver *backend;
2862
2863		lun_req = (struct ctl_lun_req *)addr;
2864
2865		backend = ctl_backend_find(lun_req->backend);
2866		if (backend == NULL) {
2867			lun_req->status = CTL_LUN_ERROR;
2868			snprintf(lun_req->error_str,
2869				 sizeof(lun_req->error_str),
2870				 "Backend \"%s\" not found.",
2871				 lun_req->backend);
2872			break;
2873		}
2874		if (lun_req->num_be_args > 0) {
2875			lun_req->kern_be_args = ctl_copyin_args(
2876				lun_req->num_be_args,
2877				lun_req->be_args,
2878				lun_req->error_str,
2879				sizeof(lun_req->error_str));
2880			if (lun_req->kern_be_args == NULL) {
2881				lun_req->status = CTL_LUN_ERROR;
2882				break;
2883			}
2884		}
2885
2886		retval = backend->ioctl(dev, cmd, addr, flag, td);
2887
2888		if (lun_req->num_be_args > 0) {
2889			ctl_free_args(lun_req->num_be_args,
2890				      lun_req->kern_be_args);
2891		}
2892		break;
2893	}
2894	case CTL_LUN_LIST: {
2895		struct sbuf *sb;
2896		struct ctl_lun *lun;
2897		struct ctl_lun_list *list;
2898
2899		list = (struct ctl_lun_list *)addr;
2900
2901		/*
2902		 * Allocate a fixed length sbuf here, based on the length
2903		 * of the user's buffer.  We could allocate an auto-extending
2904		 * buffer, and then tell the user how much larger our
2905		 * amount of data is than his buffer, but that presents
2906		 * some problems:
2907		 *
2908		 * 1.  The sbuf(9) routines use a blocking malloc, and so
2909		 *     we can't hold a lock while calling them with an
2910		 *     auto-extending buffer.
2911 		 *
2912		 * 2.  There is not currently a LUN reference counting
2913		 *     mechanism, outside of outstanding transactions on
2914		 *     the LUN's OOA queue.  So a LUN could go away on us
2915		 *     while we're getting the LUN number, backend-specific
2916		 *     information, etc.  Thus, given the way things
2917		 *     currently work, we need to hold the CTL lock while
2918		 *     grabbing LUN information.
2919		 *
2920		 * So, from the user's standpoint, the best thing to do is
2921		 * allocate what he thinks is a reasonable buffer length,
2922		 * and then if he gets a CTL_LUN_LIST_NEED_MORE_SPACE error,
2923		 * double the buffer length and try again.  (And repeat
2924		 * that until he succeeds.)
2925		 */
2926		sb = sbuf_new(NULL, NULL, list->alloc_len, SBUF_FIXEDLEN);
2927		if (sb == NULL) {
2928			list->status = CTL_LUN_LIST_ERROR;
2929			snprintf(list->error_str, sizeof(list->error_str),
2930				 "Unable to allocate %d bytes for LUN list",
2931				 list->alloc_len);
2932			break;
2933		}
2934
2935		sbuf_printf(sb, "<ctllunlist>\n");
2936
2937		mtx_lock(&softc->ctl_lock);
2938
2939		STAILQ_FOREACH(lun, &softc->lun_list, links) {
2940			retval = sbuf_printf(sb, "<lun id=\"%ju\">\n",
2941					     (uintmax_t)lun->lun);
2942
2943			/*
2944			 * Bail out as soon as we see that we've overfilled
2945			 * the buffer.
2946			 */
2947			if (retval != 0)
2948				break;
2949
2950			retval = sbuf_printf(sb, "<backend_type>%s"
2951					     "</backend_type>\n",
2952					     (lun->backend == NULL) ?  "none" :
2953					     lun->backend->name);
2954
2955			if (retval != 0)
2956				break;
2957
2958			retval = sbuf_printf(sb, "<lun_type>%d</lun_type>\n",
2959					     lun->be_lun->lun_type);
2960
2961			if (retval != 0)
2962				break;
2963
2964			if (lun->backend == NULL) {
2965				retval = sbuf_printf(sb, "</lun>\n");
2966				if (retval != 0)
2967					break;
2968				continue;
2969			}
2970
2971			retval = sbuf_printf(sb, "<size>%ju</size>\n",
2972					     (lun->be_lun->maxlba > 0) ?
2973					     lun->be_lun->maxlba + 1 : 0);
2974
2975			if (retval != 0)
2976				break;
2977
2978			retval = sbuf_printf(sb, "<blocksize>%u</blocksize>\n",
2979					     lun->be_lun->blocksize);
2980
2981			if (retval != 0)
2982				break;
2983
2984			retval = sbuf_printf(sb, "<serial_number>");
2985
2986			if (retval != 0)
2987				break;
2988
2989			retval = ctl_sbuf_printf_esc(sb,
2990						     lun->be_lun->serial_num);
2991
2992			if (retval != 0)
2993				break;
2994
2995			retval = sbuf_printf(sb, "</serial_number>\n");
2996
2997			if (retval != 0)
2998				break;
2999
3000			retval = sbuf_printf(sb, "<device_id>");
3001
3002			if (retval != 0)
3003				break;
3004
3005			retval = ctl_sbuf_printf_esc(sb,lun->be_lun->device_id);
3006
3007			if (retval != 0)
3008				break;
3009
3010			retval = sbuf_printf(sb, "</device_id>\n");
3011
3012			if (retval != 0)
3013				break;
3014
3015			if (lun->backend->lun_info == NULL) {
3016				retval = sbuf_printf(sb, "</lun>\n");
3017				if (retval != 0)
3018					break;
3019				continue;
3020			}
3021
3022			retval =lun->backend->lun_info(lun->be_lun->be_lun, sb);
3023
3024			if (retval != 0)
3025				break;
3026
3027			retval = sbuf_printf(sb, "</lun>\n");
3028
3029			if (retval != 0)
3030				break;
3031		}
3032		mtx_unlock(&softc->ctl_lock);
3033
3034		if ((retval != 0)
3035		 || ((retval = sbuf_printf(sb, "</ctllunlist>\n")) != 0)) {
3036			retval = 0;
3037			sbuf_delete(sb);
3038			list->status = CTL_LUN_LIST_NEED_MORE_SPACE;
3039			snprintf(list->error_str, sizeof(list->error_str),
3040				 "Out of space, %d bytes is too small",
3041				 list->alloc_len);
3042			break;
3043		}
3044
3045		sbuf_finish(sb);
3046
3047		retval = copyout(sbuf_data(sb), list->lun_xml,
3048				 sbuf_len(sb) + 1);
3049
3050		list->fill_len = sbuf_len(sb) + 1;
3051		list->status = CTL_LUN_LIST_OK;
3052		sbuf_delete(sb);
3053		break;
3054	}
3055	default: {
3056		/* XXX KDM should we fix this? */
3057#if 0
3058		struct ctl_backend_driver *backend;
3059		unsigned int type;
3060		int found;
3061
3062		found = 0;
3063
3064		/*
3065		 * We encode the backend type as the ioctl type for backend
3066		 * ioctls.  So parse it out here, and then search for a
3067		 * backend of this type.
3068		 */
3069		type = _IOC_TYPE(cmd);
3070
3071		STAILQ_FOREACH(backend, &softc->be_list, links) {
3072			if (backend->type == type) {
3073				found = 1;
3074				break;
3075			}
3076		}
3077		if (found == 0) {
3078			printf("ctl: unknown ioctl command %#lx or backend "
3079			       "%d\n", cmd, type);
3080			retval = -EINVAL;
3081			break;
3082		}
3083		retval = backend->ioctl(dev, cmd, addr, flag, td);
3084#endif
3085		retval = ENOTTY;
3086		break;
3087	}
3088	}
3089	return (retval);
3090}
3091
3092uint32_t
3093ctl_get_initindex(struct ctl_nexus *nexus)
3094{
3095	if (nexus->targ_port < CTL_MAX_PORTS)
3096		return (nexus->initid.id +
3097			(nexus->targ_port * CTL_MAX_INIT_PER_PORT));
3098	else
3099		return (nexus->initid.id +
3100		       ((nexus->targ_port - CTL_MAX_PORTS) *
3101			CTL_MAX_INIT_PER_PORT));
3102}
3103
3104uint32_t
3105ctl_get_resindex(struct ctl_nexus *nexus)
3106{
3107	return (nexus->initid.id + (nexus->targ_port * CTL_MAX_INIT_PER_PORT));
3108}
3109
3110uint32_t
3111ctl_port_idx(int port_num)
3112{
3113	if (port_num < CTL_MAX_PORTS)
3114		return(port_num);
3115	else
3116		return(port_num - CTL_MAX_PORTS);
3117}
3118
3119/*
3120 * Note:  This only works for bitmask sizes that are at least 32 bits, and
3121 * that are a power of 2.
3122 */
3123int
3124ctl_ffz(uint32_t *mask, uint32_t size)
3125{
3126	uint32_t num_chunks, num_pieces;
3127	int i, j;
3128
3129	num_chunks = (size >> 5);
3130	if (num_chunks == 0)
3131		num_chunks++;
3132	num_pieces = ctl_min((sizeof(uint32_t) * 8), size);
3133
3134	for (i = 0; i < num_chunks; i++) {
3135		for (j = 0; j < num_pieces; j++) {
3136			if ((mask[i] & (1 << j)) == 0)
3137				return ((i << 5) + j);
3138		}
3139	}
3140
3141	return (-1);
3142}
3143
3144int
3145ctl_set_mask(uint32_t *mask, uint32_t bit)
3146{
3147	uint32_t chunk, piece;
3148
3149	chunk = bit >> 5;
3150	piece = bit % (sizeof(uint32_t) * 8);
3151
3152	if ((mask[chunk] & (1 << piece)) != 0)
3153		return (-1);
3154	else
3155		mask[chunk] |= (1 << piece);
3156
3157	return (0);
3158}
3159
3160int
3161ctl_clear_mask(uint32_t *mask, uint32_t bit)
3162{
3163	uint32_t chunk, piece;
3164
3165	chunk = bit >> 5;
3166	piece = bit % (sizeof(uint32_t) * 8);
3167
3168	if ((mask[chunk] & (1 << piece)) == 0)
3169		return (-1);
3170	else
3171		mask[chunk] &= ~(1 << piece);
3172
3173	return (0);
3174}
3175
3176int
3177ctl_is_set(uint32_t *mask, uint32_t bit)
3178{
3179	uint32_t chunk, piece;
3180
3181	chunk = bit >> 5;
3182	piece = bit % (sizeof(uint32_t) * 8);
3183
3184	if ((mask[chunk] & (1 << piece)) == 0)
3185		return (0);
3186	else
3187		return (1);
3188}
3189
3190#ifdef unused
3191/*
3192 * The bus, target and lun are optional, they can be filled in later.
3193 * can_wait is used to determine whether we can wait on the malloc or not.
3194 */
3195union ctl_io*
3196ctl_malloc_io(ctl_io_type io_type, uint32_t targ_port, uint32_t targ_target,
3197	      uint32_t targ_lun, int can_wait)
3198{
3199	union ctl_io *io;
3200
3201	if (can_wait)
3202		io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_WAITOK);
3203	else
3204		io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_NOWAIT);
3205
3206	if (io != NULL) {
3207		io->io_hdr.io_type = io_type;
3208		io->io_hdr.targ_port = targ_port;
3209		/*
3210		 * XXX KDM this needs to change/go away.  We need to move
3211		 * to a preallocated pool of ctl_scsiio structures.
3212		 */
3213		io->io_hdr.nexus.targ_target.id = targ_target;
3214		io->io_hdr.nexus.targ_lun = targ_lun;
3215	}
3216
3217	return (io);
3218}
3219
3220void
3221ctl_kfree_io(union ctl_io *io)
3222{
3223	free(io, M_CTL);
3224}
3225#endif /* unused */
3226
3227/*
3228 * ctl_softc, pool_type, total_ctl_io are passed in.
3229 * npool is passed out.
3230 */
3231int
3232ctl_pool_create(struct ctl_softc *ctl_softc, ctl_pool_type pool_type,
3233		uint32_t total_ctl_io, struct ctl_io_pool **npool)
3234{
3235	uint32_t i;
3236	union ctl_io *cur_io, *next_io;
3237	struct ctl_io_pool *pool;
3238	int retval;
3239
3240	retval = 0;
3241
3242	pool = (struct ctl_io_pool *)malloc(sizeof(*pool), M_CTL, M_NOWAIT);
3243	if (pool == NULL) {
3244		retval = -ENOMEM;
3245		goto bailout;
3246	}
3247
3248	memset(pool, 0, sizeof(*pool));
3249
3250	pool->type = pool_type;
3251	pool->ctl_softc = ctl_softc;
3252
3253	mtx_lock(&ctl_softc->ctl_lock);
3254	pool->id = ctl_softc->cur_pool_id++;
3255	mtx_unlock(&ctl_softc->ctl_lock);
3256
3257	pool->flags = CTL_POOL_FLAG_NONE;
3258	STAILQ_INIT(&pool->free_queue);
3259
3260	/*
3261	 * XXX KDM other options here:
3262	 * - allocate a page at a time
3263	 * - allocate one big chunk of memory.
3264	 * Page allocation might work well, but would take a little more
3265	 * tracking.
3266	 */
3267	for (i = 0; i < total_ctl_io; i++) {
3268		cur_io = (union ctl_io *)malloc(sizeof(*cur_io), M_CTL,
3269						M_NOWAIT);
3270		if (cur_io == NULL) {
3271			retval = ENOMEM;
3272			break;
3273		}
3274		cur_io->io_hdr.pool = pool;
3275		STAILQ_INSERT_TAIL(&pool->free_queue, &cur_io->io_hdr, links);
3276		pool->total_ctl_io++;
3277		pool->free_ctl_io++;
3278	}
3279
3280	if (retval != 0) {
3281		for (cur_io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue);
3282		     cur_io != NULL; cur_io = next_io) {
3283			next_io = (union ctl_io *)STAILQ_NEXT(&cur_io->io_hdr,
3284							      links);
3285			STAILQ_REMOVE(&pool->free_queue, &cur_io->io_hdr,
3286				      ctl_io_hdr, links);
3287			free(cur_io, M_CTL);
3288		}
3289
3290		free(pool, M_CTL);
3291		goto bailout;
3292	}
3293	mtx_lock(&ctl_softc->ctl_lock);
3294	ctl_softc->num_pools++;
3295	STAILQ_INSERT_TAIL(&ctl_softc->io_pools, pool, links);
3296	/*
3297	 * Increment our usage count if this is an external consumer, so we
3298	 * can't get unloaded until the external consumer (most likely a
3299	 * FETD) unloads and frees his pool.
3300	 *
3301	 * XXX KDM will this increment the caller's module use count, or
3302	 * mine?
3303	 */
3304#if 0
3305	if ((pool_type != CTL_POOL_EMERGENCY)
3306	 && (pool_type != CTL_POOL_INTERNAL)
3307	 && (pool_type != CTL_POOL_IOCTL)
3308	 && (pool_type != CTL_POOL_4OTHERSC))
3309		MOD_INC_USE_COUNT;
3310#endif
3311
3312	mtx_unlock(&ctl_softc->ctl_lock);
3313
3314	*npool = pool;
3315
3316bailout:
3317
3318	return (retval);
3319}
3320
3321/*
3322 * Caller must hold ctl_softc->ctl_lock.
3323 */
3324int
3325ctl_pool_acquire(struct ctl_io_pool *pool)
3326{
3327	if (pool == NULL)
3328		return (-EINVAL);
3329
3330	if (pool->flags & CTL_POOL_FLAG_INVALID)
3331		return (-EINVAL);
3332
3333	pool->refcount++;
3334
3335	return (0);
3336}
3337
3338/*
3339 * Caller must hold ctl_softc->ctl_lock.
3340 */
3341int
3342ctl_pool_invalidate(struct ctl_io_pool *pool)
3343{
3344	if (pool == NULL)
3345		return (-EINVAL);
3346
3347	pool->flags |= CTL_POOL_FLAG_INVALID;
3348
3349	return (0);
3350}
3351
3352/*
3353 * Caller must hold ctl_softc->ctl_lock.
3354 */
3355int
3356ctl_pool_release(struct ctl_io_pool *pool)
3357{
3358	if (pool == NULL)
3359		return (-EINVAL);
3360
3361	if ((--pool->refcount == 0)
3362	 && (pool->flags & CTL_POOL_FLAG_INVALID)) {
3363		ctl_pool_free(pool->ctl_softc, pool);
3364	}
3365
3366	return (0);
3367}
3368
3369/*
3370 * Must be called with ctl_softc->ctl_lock held.
3371 */
3372void
3373ctl_pool_free(struct ctl_softc *ctl_softc, struct ctl_io_pool *pool)
3374{
3375	union ctl_io *cur_io, *next_io;
3376
3377	for (cur_io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue);
3378	     cur_io != NULL; cur_io = next_io) {
3379		next_io = (union ctl_io *)STAILQ_NEXT(&cur_io->io_hdr,
3380						      links);
3381		STAILQ_REMOVE(&pool->free_queue, &cur_io->io_hdr, ctl_io_hdr,
3382			      links);
3383		free(cur_io, M_CTL);
3384	}
3385
3386	STAILQ_REMOVE(&ctl_softc->io_pools, pool, ctl_io_pool, links);
3387	ctl_softc->num_pools--;
3388
3389	/*
3390	 * XXX KDM will this decrement the caller's usage count or mine?
3391	 */
3392#if 0
3393	if ((pool->type != CTL_POOL_EMERGENCY)
3394	 && (pool->type != CTL_POOL_INTERNAL)
3395	 && (pool->type != CTL_POOL_IOCTL))
3396		MOD_DEC_USE_COUNT;
3397#endif
3398
3399	free(pool, M_CTL);
3400}
3401
3402/*
3403 * This routine does not block (except for spinlocks of course).
3404 * It tries to allocate a ctl_io union from the caller's pool as quickly as
3405 * possible.
3406 */
3407union ctl_io *
3408ctl_alloc_io(void *pool_ref)
3409{
3410	union ctl_io *io;
3411	struct ctl_softc *ctl_softc;
3412	struct ctl_io_pool *pool, *npool;
3413	struct ctl_io_pool *emergency_pool;
3414
3415	pool = (struct ctl_io_pool *)pool_ref;
3416
3417	if (pool == NULL) {
3418		printf("%s: pool is NULL\n", __func__);
3419		return (NULL);
3420	}
3421
3422	emergency_pool = NULL;
3423
3424	ctl_softc = pool->ctl_softc;
3425
3426	mtx_lock(&ctl_softc->ctl_lock);
3427	/*
3428	 * First, try to get the io structure from the user's pool.
3429	 */
3430	if (ctl_pool_acquire(pool) == 0) {
3431		io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue);
3432		if (io != NULL) {
3433			STAILQ_REMOVE_HEAD(&pool->free_queue, links);
3434			pool->total_allocated++;
3435			pool->free_ctl_io--;
3436			mtx_unlock(&ctl_softc->ctl_lock);
3437			return (io);
3438		} else
3439			ctl_pool_release(pool);
3440	}
3441	/*
3442	 * If he doesn't have any io structures left, search for an
3443	 * emergency pool and grab one from there.
3444	 */
3445	STAILQ_FOREACH(npool, &ctl_softc->io_pools, links) {
3446		if (npool->type != CTL_POOL_EMERGENCY)
3447			continue;
3448
3449		if (ctl_pool_acquire(npool) != 0)
3450			continue;
3451
3452		emergency_pool = npool;
3453
3454		io = (union ctl_io *)STAILQ_FIRST(&npool->free_queue);
3455		if (io != NULL) {
3456			STAILQ_REMOVE_HEAD(&npool->free_queue, links);
3457			npool->total_allocated++;
3458			npool->free_ctl_io--;
3459			mtx_unlock(&ctl_softc->ctl_lock);
3460			return (io);
3461		} else
3462			ctl_pool_release(npool);
3463	}
3464
3465	/* Drop the spinlock before we malloc */
3466	mtx_unlock(&ctl_softc->ctl_lock);
3467
3468	/*
3469	 * The emergency pool (if it exists) didn't have one, so try an
3470	 * atomic (i.e. nonblocking) malloc and see if we get lucky.
3471	 */
3472	io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_NOWAIT);
3473	if (io != NULL) {
3474		/*
3475		 * If the emergency pool exists but is empty, add this
3476		 * ctl_io to its list when it gets freed.
3477		 */
3478		if (emergency_pool != NULL) {
3479			mtx_lock(&ctl_softc->ctl_lock);
3480			if (ctl_pool_acquire(emergency_pool) == 0) {
3481				io->io_hdr.pool = emergency_pool;
3482				emergency_pool->total_ctl_io++;
3483				/*
3484				 * Need to bump this, otherwise
3485				 * total_allocated and total_freed won't
3486				 * match when we no longer have anything
3487				 * outstanding.
3488				 */
3489				emergency_pool->total_allocated++;
3490			}
3491			mtx_unlock(&ctl_softc->ctl_lock);
3492		} else
3493			io->io_hdr.pool = NULL;
3494	}
3495
3496	return (io);
3497}
3498
3499static void
3500ctl_free_io_internal(union ctl_io *io, int have_lock)
3501{
3502	if (io == NULL)
3503		return;
3504
3505	/*
3506	 * If this ctl_io has a pool, return it to that pool.
3507	 */
3508	if (io->io_hdr.pool != NULL) {
3509		struct ctl_io_pool *pool;
3510#if 0
3511		struct ctl_softc *ctl_softc;
3512		union ctl_io *tmp_io;
3513		unsigned long xflags;
3514		int i;
3515
3516		ctl_softc = control_softc;
3517#endif
3518
3519		pool = (struct ctl_io_pool *)io->io_hdr.pool;
3520
3521		if (have_lock == 0)
3522			mtx_lock(&pool->ctl_softc->ctl_lock);
3523#if 0
3524		save_flags(xflags);
3525
3526		for (i = 0, tmp_io = (union ctl_io *)STAILQ_FIRST(
3527		     &ctl_softc->task_queue); tmp_io != NULL; i++,
3528		     tmp_io = (union ctl_io *)STAILQ_NEXT(&tmp_io->io_hdr,
3529		     links)) {
3530			if (tmp_io == io) {
3531				printf("%s: %p is still on the task queue!\n",
3532				       __func__, tmp_io);
3533				printf("%s: (%d): type %d "
3534				       "msg %d cdb %x iptl: "
3535				       "%d:%d:%d:%d tag 0x%04x "
3536				       "flg %#lx\n",
3537					__func__, i,
3538					tmp_io->io_hdr.io_type,
3539					tmp_io->io_hdr.msg_type,
3540					tmp_io->scsiio.cdb[0],
3541					tmp_io->io_hdr.nexus.initid.id,
3542					tmp_io->io_hdr.nexus.targ_port,
3543					tmp_io->io_hdr.nexus.targ_target.id,
3544					tmp_io->io_hdr.nexus.targ_lun,
3545					(tmp_io->io_hdr.io_type ==
3546					CTL_IO_TASK) ?
3547					tmp_io->taskio.tag_num :
3548					tmp_io->scsiio.tag_num,
3549					xflags);
3550				panic("I/O still on the task queue!");
3551			}
3552		}
3553#endif
3554		io->io_hdr.io_type = 0xff;
3555		STAILQ_INSERT_TAIL(&pool->free_queue, &io->io_hdr, links);
3556		pool->total_freed++;
3557		pool->free_ctl_io++;
3558		ctl_pool_release(pool);
3559		if (have_lock == 0)
3560			mtx_unlock(&pool->ctl_softc->ctl_lock);
3561	} else {
3562		/*
3563		 * Otherwise, just free it.  We probably malloced it and
3564		 * the emergency pool wasn't available.
3565		 */
3566		free(io, M_CTL);
3567	}
3568
3569}
3570
3571void
3572ctl_free_io(union ctl_io *io)
3573{
3574	ctl_free_io_internal(io, /*have_lock*/ 0);
3575}
3576
3577void
3578ctl_zero_io(union ctl_io *io)
3579{
3580	void *pool_ref;
3581
3582	if (io == NULL)
3583		return;
3584
3585	/*
3586	 * May need to preserve linked list pointers at some point too.
3587	 */
3588	pool_ref = io->io_hdr.pool;
3589
3590	memset(io, 0, sizeof(*io));
3591
3592	io->io_hdr.pool = pool_ref;
3593}
3594
3595/*
3596 * This routine is currently used for internal copies of ctl_ios that need
3597 * to persist for some reason after we've already returned status to the
3598 * FETD.  (Thus the flag set.)
3599 *
3600 * XXX XXX
3601 * Note that this makes a blind copy of all fields in the ctl_io, except
3602 * for the pool reference.  This includes any memory that has been
3603 * allocated!  That memory will no longer be valid after done has been
3604 * called, so this would be VERY DANGEROUS for command that actually does
3605 * any reads or writes.  Right now (11/7/2005), this is only used for immediate
3606 * start and stop commands, which don't transfer any data, so this is not a
3607 * problem.  If it is used for anything else, the caller would also need to
3608 * allocate data buffer space and this routine would need to be modified to
3609 * copy the data buffer(s) as well.
3610 */
3611void
3612ctl_copy_io(union ctl_io *src, union ctl_io *dest)
3613{
3614	void *pool_ref;
3615
3616	if ((src == NULL)
3617	 || (dest == NULL))
3618		return;
3619
3620	/*
3621	 * May need to preserve linked list pointers at some point too.
3622	 */
3623	pool_ref = dest->io_hdr.pool;
3624
3625	memcpy(dest, src, ctl_min(sizeof(*src), sizeof(*dest)));
3626
3627	dest->io_hdr.pool = pool_ref;
3628	/*
3629	 * We need to know that this is an internal copy, and doesn't need
3630	 * to get passed back to the FETD that allocated it.
3631	 */
3632	dest->io_hdr.flags |= CTL_FLAG_INT_COPY;
3633}
3634
3635#ifdef NEEDTOPORT
3636static void
3637ctl_update_power_subpage(struct copan_power_subpage *page)
3638{
3639	int num_luns, num_partitions, config_type;
3640	struct ctl_softc *softc;
3641	cs_BOOL_t aor_present, shelf_50pct_power;
3642	cs_raidset_personality_t rs_type;
3643	int max_active_luns;
3644
3645	softc = control_softc;
3646
3647	/* subtract out the processor LUN */
3648	num_luns = softc->num_luns - 1;
3649	/*
3650	 * Default to 7 LUNs active, which was the only number we allowed
3651	 * in the past.
3652	 */
3653	max_active_luns = 7;
3654
3655	num_partitions = config_GetRsPartitionInfo();
3656	config_type = config_GetConfigType();
3657	shelf_50pct_power = config_GetShelfPowerMode();
3658	aor_present = config_IsAorRsPresent();
3659
3660	rs_type = ddb_GetRsRaidType(1);
3661	if ((rs_type != CS_RAIDSET_PERSONALITY_RAID5)
3662	 && (rs_type != CS_RAIDSET_PERSONALITY_RAID1)) {
3663		EPRINT(0, "Unsupported RS type %d!", rs_type);
3664	}
3665
3666
3667	page->total_luns = num_luns;
3668
3669	switch (config_type) {
3670	case 40:
3671		/*
3672		 * In a 40 drive configuration, it doesn't matter what DC
3673		 * cards we have, whether we have AOR enabled or not,
3674		 * partitioning or not, or what type of RAIDset we have.
3675		 * In that scenario, we can power up every LUN we present
3676		 * to the user.
3677		 */
3678		max_active_luns = num_luns;
3679
3680		break;
3681	case 64:
3682		if (shelf_50pct_power == CS_FALSE) {
3683			/* 25% power */
3684			if (aor_present == CS_TRUE) {
3685				if (rs_type ==
3686				     CS_RAIDSET_PERSONALITY_RAID5) {
3687					max_active_luns = 7;
3688				} else if (rs_type ==
3689					 CS_RAIDSET_PERSONALITY_RAID1){
3690					max_active_luns = 14;
3691				} else {
3692					/* XXX KDM now what?? */
3693				}
3694			} else {
3695				if (rs_type ==
3696				     CS_RAIDSET_PERSONALITY_RAID5) {
3697					max_active_luns = 8;
3698				} else if (rs_type ==
3699					 CS_RAIDSET_PERSONALITY_RAID1){
3700					max_active_luns = 16;
3701				} else {
3702					/* XXX KDM now what?? */
3703				}
3704			}
3705		} else {
3706			/* 50% power */
3707			/*
3708			 * With 50% power in a 64 drive configuration, we
3709			 * can power all LUNs we present.
3710			 */
3711			max_active_luns = num_luns;
3712		}
3713		break;
3714	case 112:
3715		if (shelf_50pct_power == CS_FALSE) {
3716			/* 25% power */
3717			if (aor_present == CS_TRUE) {
3718				if (rs_type ==
3719				     CS_RAIDSET_PERSONALITY_RAID5) {
3720					max_active_luns = 7;
3721				} else if (rs_type ==
3722					 CS_RAIDSET_PERSONALITY_RAID1){
3723					max_active_luns = 14;
3724				} else {
3725					/* XXX KDM now what?? */
3726				}
3727			} else {
3728				if (rs_type ==
3729				     CS_RAIDSET_PERSONALITY_RAID5) {
3730					max_active_luns = 8;
3731				} else if (rs_type ==
3732					 CS_RAIDSET_PERSONALITY_RAID1){
3733					max_active_luns = 16;
3734				} else {
3735					/* XXX KDM now what?? */
3736				}
3737			}
3738		} else {
3739			/* 50% power */
3740			if (aor_present == CS_TRUE) {
3741				if (rs_type ==
3742				     CS_RAIDSET_PERSONALITY_RAID5) {
3743					max_active_luns = 14;
3744				} else if (rs_type ==
3745					 CS_RAIDSET_PERSONALITY_RAID1){
3746					/*
3747					 * We're assuming here that disk
3748					 * caching is enabled, and so we're
3749					 * able to power up half of each
3750					 * LUN, and cache all writes.
3751					 */
3752					max_active_luns = num_luns;
3753				} else {
3754					/* XXX KDM now what?? */
3755				}
3756			} else {
3757				if (rs_type ==
3758				     CS_RAIDSET_PERSONALITY_RAID5) {
3759					max_active_luns = 15;
3760				} else if (rs_type ==
3761					 CS_RAIDSET_PERSONALITY_RAID1){
3762					max_active_luns = 30;
3763				} else {
3764					/* XXX KDM now what?? */
3765				}
3766			}
3767		}
3768		break;
3769	default:
3770		/*
3771		 * In this case, we have an unknown configuration, so we
3772		 * just use the default from above.
3773		 */
3774		break;
3775	}
3776
3777	page->max_active_luns = max_active_luns;
3778#if 0
3779	printk("%s: total_luns = %d, max_active_luns = %d\n", __func__,
3780	       page->total_luns, page->max_active_luns);
3781#endif
3782}
3783#endif /* NEEDTOPORT */
3784
3785/*
3786 * This routine could be used in the future to load default and/or saved
3787 * mode page parameters for a particuar lun.
3788 */
3789static int
3790ctl_init_page_index(struct ctl_lun *lun)
3791{
3792	int i;
3793	struct ctl_page_index *page_index;
3794	struct ctl_softc *softc;
3795
3796	memcpy(&lun->mode_pages.index, page_index_template,
3797	       sizeof(page_index_template));
3798
3799	softc = lun->ctl_softc;
3800
3801	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
3802
3803		page_index = &lun->mode_pages.index[i];
3804		/*
3805		 * If this is a disk-only mode page, there's no point in
3806		 * setting it up.  For some pages, we have to have some
3807		 * basic information about the disk in order to calculate the
3808		 * mode page data.
3809		 */
3810		if ((lun->be_lun->lun_type != T_DIRECT)
3811		 && (page_index->page_flags & CTL_PAGE_FLAG_DISK_ONLY))
3812			continue;
3813
3814		switch (page_index->page_code & SMPH_PC_MASK) {
3815		case SMS_FORMAT_DEVICE_PAGE: {
3816			struct scsi_format_page *format_page;
3817
3818			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
3819				panic("subpage is incorrect!");
3820
3821			/*
3822			 * Sectors per track are set above.  Bytes per
3823			 * sector need to be set here on a per-LUN basis.
3824			 */
3825			memcpy(&lun->mode_pages.format_page[CTL_PAGE_CURRENT],
3826			       &format_page_default,
3827			       sizeof(format_page_default));
3828			memcpy(&lun->mode_pages.format_page[
3829			       CTL_PAGE_CHANGEABLE], &format_page_changeable,
3830			       sizeof(format_page_changeable));
3831			memcpy(&lun->mode_pages.format_page[CTL_PAGE_DEFAULT],
3832			       &format_page_default,
3833			       sizeof(format_page_default));
3834			memcpy(&lun->mode_pages.format_page[CTL_PAGE_SAVED],
3835			       &format_page_default,
3836			       sizeof(format_page_default));
3837
3838			format_page = &lun->mode_pages.format_page[
3839				CTL_PAGE_CURRENT];
3840			scsi_ulto2b(lun->be_lun->blocksize,
3841				    format_page->bytes_per_sector);
3842
3843			format_page = &lun->mode_pages.format_page[
3844				CTL_PAGE_DEFAULT];
3845			scsi_ulto2b(lun->be_lun->blocksize,
3846				    format_page->bytes_per_sector);
3847
3848			format_page = &lun->mode_pages.format_page[
3849				CTL_PAGE_SAVED];
3850			scsi_ulto2b(lun->be_lun->blocksize,
3851				    format_page->bytes_per_sector);
3852
3853			page_index->page_data =
3854				(uint8_t *)lun->mode_pages.format_page;
3855			break;
3856		}
3857		case SMS_RIGID_DISK_PAGE: {
3858			struct scsi_rigid_disk_page *rigid_disk_page;
3859			uint32_t sectors_per_cylinder;
3860			uint64_t cylinders;
3861#ifndef	__XSCALE__
3862			int shift;
3863#endif /* !__XSCALE__ */
3864
3865			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
3866				panic("invalid subpage value %d",
3867				      page_index->subpage);
3868
3869			/*
3870			 * Rotation rate and sectors per track are set
3871			 * above.  We calculate the cylinders here based on
3872			 * capacity.  Due to the number of heads and
3873			 * sectors per track we're using, smaller arrays
3874			 * may turn out to have 0 cylinders.  Linux and
3875			 * FreeBSD don't pay attention to these mode pages
3876			 * to figure out capacity, but Solaris does.  It
3877			 * seems to deal with 0 cylinders just fine, and
3878			 * works out a fake geometry based on the capacity.
3879			 */
3880			memcpy(&lun->mode_pages.rigid_disk_page[
3881			       CTL_PAGE_CURRENT], &rigid_disk_page_default,
3882			       sizeof(rigid_disk_page_default));
3883			memcpy(&lun->mode_pages.rigid_disk_page[
3884			       CTL_PAGE_CHANGEABLE],&rigid_disk_page_changeable,
3885			       sizeof(rigid_disk_page_changeable));
3886			memcpy(&lun->mode_pages.rigid_disk_page[
3887			       CTL_PAGE_DEFAULT], &rigid_disk_page_default,
3888			       sizeof(rigid_disk_page_default));
3889			memcpy(&lun->mode_pages.rigid_disk_page[
3890			       CTL_PAGE_SAVED], &rigid_disk_page_default,
3891			       sizeof(rigid_disk_page_default));
3892
3893			sectors_per_cylinder = CTL_DEFAULT_SECTORS_PER_TRACK *
3894				CTL_DEFAULT_HEADS;
3895
3896			/*
3897			 * The divide method here will be more accurate,
3898			 * probably, but results in floating point being
3899			 * used in the kernel on i386 (__udivdi3()).  On the
3900			 * XScale, though, __udivdi3() is implemented in
3901			 * software.
3902			 *
3903			 * The shift method for cylinder calculation is
3904			 * accurate if sectors_per_cylinder is a power of
3905			 * 2.  Otherwise it might be slightly off -- you
3906			 * might have a bit of a truncation problem.
3907			 */
3908#ifdef	__XSCALE__
3909			cylinders = (lun->be_lun->maxlba + 1) /
3910				sectors_per_cylinder;
3911#else
3912			for (shift = 31; shift > 0; shift--) {
3913				if (sectors_per_cylinder & (1 << shift))
3914					break;
3915			}
3916			cylinders = (lun->be_lun->maxlba + 1) >> shift;
3917#endif
3918
3919			/*
3920			 * We've basically got 3 bytes, or 24 bits for the
3921			 * cylinder size in the mode page.  If we're over,
3922			 * just round down to 2^24.
3923			 */
3924			if (cylinders > 0xffffff)
3925				cylinders = 0xffffff;
3926
3927			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
3928				CTL_PAGE_CURRENT];
3929			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
3930
3931			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
3932				CTL_PAGE_DEFAULT];
3933			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
3934
3935			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
3936				CTL_PAGE_SAVED];
3937			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
3938
3939			page_index->page_data =
3940				(uint8_t *)lun->mode_pages.rigid_disk_page;
3941			break;
3942		}
3943		case SMS_CACHING_PAGE: {
3944
3945			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
3946				panic("invalid subpage value %d",
3947				      page_index->subpage);
3948			/*
3949			 * Defaults should be okay here, no calculations
3950			 * needed.
3951			 */
3952			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_CURRENT],
3953			       &caching_page_default,
3954			       sizeof(caching_page_default));
3955			memcpy(&lun->mode_pages.caching_page[
3956			       CTL_PAGE_CHANGEABLE], &caching_page_changeable,
3957			       sizeof(caching_page_changeable));
3958			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_DEFAULT],
3959			       &caching_page_default,
3960			       sizeof(caching_page_default));
3961			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_SAVED],
3962			       &caching_page_default,
3963			       sizeof(caching_page_default));
3964			page_index->page_data =
3965				(uint8_t *)lun->mode_pages.caching_page;
3966			break;
3967		}
3968		case SMS_CONTROL_MODE_PAGE: {
3969
3970			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
3971				panic("invalid subpage value %d",
3972				      page_index->subpage);
3973
3974			/*
3975			 * Defaults should be okay here, no calculations
3976			 * needed.
3977			 */
3978			memcpy(&lun->mode_pages.control_page[CTL_PAGE_CURRENT],
3979			       &control_page_default,
3980			       sizeof(control_page_default));
3981			memcpy(&lun->mode_pages.control_page[
3982			       CTL_PAGE_CHANGEABLE], &control_page_changeable,
3983			       sizeof(control_page_changeable));
3984			memcpy(&lun->mode_pages.control_page[CTL_PAGE_DEFAULT],
3985			       &control_page_default,
3986			       sizeof(control_page_default));
3987			memcpy(&lun->mode_pages.control_page[CTL_PAGE_SAVED],
3988			       &control_page_default,
3989			       sizeof(control_page_default));
3990			page_index->page_data =
3991				(uint8_t *)lun->mode_pages.control_page;
3992			break;
3993
3994		}
3995		case SMS_VENDOR_SPECIFIC_PAGE:{
3996			switch (page_index->subpage) {
3997			case PWR_SUBPAGE_CODE: {
3998				struct copan_power_subpage *current_page,
3999							   *saved_page;
4000
4001				memcpy(&lun->mode_pages.power_subpage[
4002				       CTL_PAGE_CURRENT],
4003				       &power_page_default,
4004				       sizeof(power_page_default));
4005				memcpy(&lun->mode_pages.power_subpage[
4006				       CTL_PAGE_CHANGEABLE],
4007				       &power_page_changeable,
4008				       sizeof(power_page_changeable));
4009				memcpy(&lun->mode_pages.power_subpage[
4010				       CTL_PAGE_DEFAULT],
4011				       &power_page_default,
4012				       sizeof(power_page_default));
4013				memcpy(&lun->mode_pages.power_subpage[
4014				       CTL_PAGE_SAVED],
4015				       &power_page_default,
4016				       sizeof(power_page_default));
4017				page_index->page_data =
4018				    (uint8_t *)lun->mode_pages.power_subpage;
4019
4020				current_page = (struct copan_power_subpage *)
4021					(page_index->page_data +
4022					 (page_index->page_len *
4023					  CTL_PAGE_CURRENT));
4024			        saved_page = (struct copan_power_subpage *)
4025				        (page_index->page_data +
4026					 (page_index->page_len *
4027					  CTL_PAGE_SAVED));
4028				break;
4029			}
4030			case APS_SUBPAGE_CODE: {
4031				struct copan_aps_subpage *current_page,
4032							 *saved_page;
4033
4034				// This gets set multiple times but
4035				// it should always be the same. It's
4036				// only done during init so who cares.
4037				index_to_aps_page = i;
4038
4039				memcpy(&lun->mode_pages.aps_subpage[
4040				       CTL_PAGE_CURRENT],
4041				       &aps_page_default,
4042				       sizeof(aps_page_default));
4043				memcpy(&lun->mode_pages.aps_subpage[
4044				       CTL_PAGE_CHANGEABLE],
4045				       &aps_page_changeable,
4046				       sizeof(aps_page_changeable));
4047				memcpy(&lun->mode_pages.aps_subpage[
4048				       CTL_PAGE_DEFAULT],
4049				       &aps_page_default,
4050				       sizeof(aps_page_default));
4051				memcpy(&lun->mode_pages.aps_subpage[
4052				       CTL_PAGE_SAVED],
4053				       &aps_page_default,
4054				       sizeof(aps_page_default));
4055				page_index->page_data =
4056					(uint8_t *)lun->mode_pages.aps_subpage;
4057
4058				current_page = (struct copan_aps_subpage *)
4059					(page_index->page_data +
4060					 (page_index->page_len *
4061					  CTL_PAGE_CURRENT));
4062				saved_page = (struct copan_aps_subpage *)
4063					(page_index->page_data +
4064					 (page_index->page_len *
4065					  CTL_PAGE_SAVED));
4066				break;
4067			}
4068			case DBGCNF_SUBPAGE_CODE: {
4069				struct copan_debugconf_subpage *current_page,
4070							       *saved_page;
4071
4072				memcpy(&lun->mode_pages.debugconf_subpage[
4073				       CTL_PAGE_CURRENT],
4074				       &debugconf_page_default,
4075				       sizeof(debugconf_page_default));
4076				memcpy(&lun->mode_pages.debugconf_subpage[
4077				       CTL_PAGE_CHANGEABLE],
4078				       &debugconf_page_changeable,
4079				       sizeof(debugconf_page_changeable));
4080				memcpy(&lun->mode_pages.debugconf_subpage[
4081				       CTL_PAGE_DEFAULT],
4082				       &debugconf_page_default,
4083				       sizeof(debugconf_page_default));
4084				memcpy(&lun->mode_pages.debugconf_subpage[
4085				       CTL_PAGE_SAVED],
4086				       &debugconf_page_default,
4087				       sizeof(debugconf_page_default));
4088				page_index->page_data =
4089					(uint8_t *)lun->mode_pages.debugconf_subpage;
4090
4091				current_page = (struct copan_debugconf_subpage *)
4092					(page_index->page_data +
4093					 (page_index->page_len *
4094					  CTL_PAGE_CURRENT));
4095				saved_page = (struct copan_debugconf_subpage *)
4096					(page_index->page_data +
4097					 (page_index->page_len *
4098					  CTL_PAGE_SAVED));
4099				break;
4100			}
4101			default:
4102				panic("invalid subpage value %d",
4103				      page_index->subpage);
4104				break;
4105			}
4106   			break;
4107		}
4108		default:
4109			panic("invalid page value %d",
4110			      page_index->page_code & SMPH_PC_MASK);
4111			break;
4112    	}
4113	}
4114
4115	return (CTL_RETVAL_COMPLETE);
4116}
4117
4118/*
4119 * LUN allocation.
4120 *
4121 * Requirements:
4122 * - caller allocates and zeros LUN storage, or passes in a NULL LUN if he
4123 *   wants us to allocate the LUN and he can block.
4124 * - ctl_softc is always set
4125 * - be_lun is set if the LUN has a backend (needed for disk LUNs)
4126 *
4127 * Returns 0 for success, non-zero (errno) for failure.
4128 */
4129static int
4130ctl_alloc_lun(struct ctl_softc *ctl_softc, struct ctl_lun *ctl_lun,
4131	      struct ctl_be_lun *const be_lun, struct ctl_id target_id)
4132{
4133	struct ctl_lun *nlun, *lun;
4134	struct ctl_frontend *fe;
4135	int lun_number, i;
4136
4137	if (be_lun == NULL)
4138		return (EINVAL);
4139
4140	/*
4141	 * We currently only support Direct Access or Processor LUN types.
4142	 */
4143	switch (be_lun->lun_type) {
4144	case T_DIRECT:
4145		break;
4146	case T_PROCESSOR:
4147		break;
4148	case T_SEQUENTIAL:
4149	case T_CHANGER:
4150	default:
4151		be_lun->lun_config_status(be_lun->be_lun,
4152					  CTL_LUN_CONFIG_FAILURE);
4153		break;
4154	}
4155	if (ctl_lun == NULL) {
4156		lun = malloc(sizeof(*lun), M_CTL, M_WAITOK);
4157		if (lun == NULL) {
4158			be_lun->lun_config_status(lun->be_lun->be_lun,
4159						  CTL_LUN_CONFIG_FAILURE);
4160			return (-ENOMEM);
4161		}
4162		lun->flags = CTL_LUN_MALLOCED;
4163	} else
4164		lun = ctl_lun;
4165
4166	memset(lun, 0, sizeof(*lun));
4167
4168	mtx_lock(&ctl_softc->ctl_lock);
4169	/*
4170	 * See if the caller requested a particular LUN number.  If so, see
4171	 * if it is available.  Otherwise, allocate the first available LUN.
4172	 */
4173	if (be_lun->flags & CTL_LUN_FLAG_ID_REQ) {
4174		if ((be_lun->req_lun_id > (CTL_MAX_LUNS - 1))
4175		 || (ctl_is_set(ctl_softc->ctl_lun_mask, be_lun->req_lun_id))) {
4176			mtx_unlock(&ctl_softc->ctl_lock);
4177			if (be_lun->req_lun_id > (CTL_MAX_LUNS - 1)) {
4178				printf("ctl: requested LUN ID %d is higher "
4179				       "than CTL_MAX_LUNS - 1 (%d)\n",
4180				       be_lun->req_lun_id, CTL_MAX_LUNS - 1);
4181			} else {
4182				/*
4183				 * XXX KDM return an error, or just assign
4184				 * another LUN ID in this case??
4185				 */
4186				printf("ctl: requested LUN ID %d is already "
4187				       "in use\n", be_lun->req_lun_id);
4188			}
4189			if (lun->flags & CTL_LUN_MALLOCED)
4190				free(lun, M_CTL);
4191			be_lun->lun_config_status(be_lun->be_lun,
4192						  CTL_LUN_CONFIG_FAILURE);
4193			return (ENOSPC);
4194		}
4195		lun_number = be_lun->req_lun_id;
4196	} else {
4197		lun_number = ctl_ffz(ctl_softc->ctl_lun_mask, CTL_MAX_LUNS);
4198		if (lun_number == -1) {
4199			mtx_unlock(&ctl_softc->ctl_lock);
4200			printf("ctl: can't allocate LUN on target %ju, out of "
4201			       "LUNs\n", (uintmax_t)target_id.id);
4202			if (lun->flags & CTL_LUN_MALLOCED)
4203				free(lun, M_CTL);
4204			be_lun->lun_config_status(be_lun->be_lun,
4205						  CTL_LUN_CONFIG_FAILURE);
4206			return (ENOSPC);
4207		}
4208	}
4209	ctl_set_mask(ctl_softc->ctl_lun_mask, lun_number);
4210
4211	lun->target = target_id;
4212	lun->lun = lun_number;
4213	lun->be_lun = be_lun;
4214	/*
4215	 * The processor LUN is always enabled.  Disk LUNs come on line
4216	 * disabled, and must be enabled by the backend.
4217	 */
4218	lun->flags = CTL_LUN_DISABLED;
4219	lun->backend = be_lun->be;
4220	be_lun->ctl_lun = lun;
4221	be_lun->lun_id = lun_number;
4222	atomic_add_int(&be_lun->be->num_luns, 1);
4223	if (be_lun->flags & CTL_LUN_FLAG_POWERED_OFF)
4224		lun->flags |= CTL_LUN_STOPPED;
4225
4226	if (be_lun->flags & CTL_LUN_FLAG_INOPERABLE)
4227		lun->flags |= CTL_LUN_INOPERABLE;
4228
4229	if (be_lun->flags & CTL_LUN_FLAG_PRIMARY)
4230		lun->flags |= CTL_LUN_PRIMARY_SC;
4231
4232	lun->ctl_softc = ctl_softc;
4233	TAILQ_INIT(&lun->ooa_queue);
4234	TAILQ_INIT(&lun->blocked_queue);
4235	STAILQ_INIT(&lun->error_list);
4236
4237	/*
4238	 * Initialize the mode page index.
4239	 */
4240	ctl_init_page_index(lun);
4241
4242	/*
4243	 * Set the poweron UA for all initiators on this LUN only.
4244	 */
4245	for (i = 0; i < CTL_MAX_INITIATORS; i++)
4246		lun->pending_sense[i].ua_pending = CTL_UA_POWERON;
4247
4248	/*
4249	 * Now, before we insert this lun on the lun list, set the lun
4250	 * inventory changed UA for all other luns.
4251	 */
4252	STAILQ_FOREACH(nlun, &ctl_softc->lun_list, links) {
4253		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
4254			nlun->pending_sense[i].ua_pending |= CTL_UA_LUN_CHANGE;
4255		}
4256	}
4257
4258	STAILQ_INSERT_TAIL(&ctl_softc->lun_list, lun, links);
4259
4260	ctl_softc->ctl_luns[lun_number] = lun;
4261
4262	ctl_softc->num_luns++;
4263
4264	/* Setup statistics gathering */
4265	lun->stats.device_type = be_lun->lun_type;
4266	lun->stats.lun_number = lun_number;
4267	if (lun->stats.device_type == T_DIRECT)
4268		lun->stats.blocksize = be_lun->blocksize;
4269	else
4270		lun->stats.flags = CTL_LUN_STATS_NO_BLOCKSIZE;
4271	for (i = 0;i < CTL_MAX_PORTS;i++)
4272		lun->stats.ports[i].targ_port = i;
4273
4274	mtx_unlock(&ctl_softc->ctl_lock);
4275
4276	lun->be_lun->lun_config_status(lun->be_lun->be_lun, CTL_LUN_CONFIG_OK);
4277
4278	/*
4279	 * Run through each registered FETD and bring it online if it isn't
4280	 * already.  Enable the target ID if it hasn't been enabled, and
4281	 * enable this particular LUN.
4282	 */
4283	STAILQ_FOREACH(fe, &ctl_softc->fe_list, links) {
4284		int retval;
4285
4286		/*
4287		 * XXX KDM this only works for ONE TARGET ID.  We'll need
4288		 * to do things differently if we go to a multiple target
4289		 * ID scheme.
4290		 */
4291		if ((fe->status & CTL_PORT_STATUS_TARG_ONLINE) == 0) {
4292
4293			retval = fe->targ_enable(fe->targ_lun_arg, target_id);
4294			if (retval != 0) {
4295				printf("ctl_alloc_lun: FETD %s port %d "
4296				       "returned error %d for targ_enable on "
4297				       "target %ju\n", fe->port_name,
4298				       fe->targ_port, retval,
4299				       (uintmax_t)target_id.id);
4300			} else
4301				fe->status |= CTL_PORT_STATUS_TARG_ONLINE;
4302		}
4303
4304		retval = fe->lun_enable(fe->targ_lun_arg, target_id,lun_number);
4305		if (retval != 0) {
4306			printf("ctl_alloc_lun: FETD %s port %d returned error "
4307			       "%d for lun_enable on target %ju lun %d\n",
4308			       fe->port_name, fe->targ_port, retval,
4309			       (uintmax_t)target_id.id, lun_number);
4310		} else
4311			fe->status |= CTL_PORT_STATUS_LUN_ONLINE;
4312	}
4313	return (0);
4314}
4315
4316/*
4317 * Delete a LUN.
4318 * Assumptions:
4319 * - caller holds ctl_softc->ctl_lock.
4320 * - LUN has already been marked invalid and any pending I/O has been taken
4321 *   care of.
4322 */
4323static int
4324ctl_free_lun(struct ctl_lun *lun)
4325{
4326	struct ctl_softc *softc;
4327#if 0
4328	struct ctl_frontend *fe;
4329#endif
4330	struct ctl_lun *nlun;
4331	union ctl_io *io, *next_io;
4332	int i;
4333
4334	softc = lun->ctl_softc;
4335
4336	STAILQ_REMOVE(&softc->lun_list, lun, ctl_lun, links);
4337
4338	ctl_clear_mask(softc->ctl_lun_mask, lun->lun);
4339
4340	softc->ctl_luns[lun->lun] = NULL;
4341
4342	if (TAILQ_FIRST(&lun->ooa_queue) != NULL) {
4343		printf("ctl_free_lun: aieee!! freeing a LUN with "
4344		       "outstanding I/O!!\n");
4345	}
4346
4347	/*
4348	 * If we have anything pending on the RtR queue, remove it.
4349	 */
4350	for (io = (union ctl_io *)STAILQ_FIRST(&softc->rtr_queue); io != NULL;
4351	     io = next_io) {
4352		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
4353		if ((io->io_hdr.nexus.targ_target.id == lun->target.id)
4354		 && (io->io_hdr.nexus.targ_lun == lun->lun))
4355			STAILQ_REMOVE(&softc->rtr_queue, &io->io_hdr,
4356				      ctl_io_hdr, links);
4357	}
4358
4359	/*
4360	 * Then remove everything from the blocked queue.
4361	 */
4362	for (io = (union ctl_io *)TAILQ_FIRST(&lun->blocked_queue); io != NULL;
4363	     io = next_io) {
4364		next_io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,blocked_links);
4365		TAILQ_REMOVE(&lun->blocked_queue, &io->io_hdr, blocked_links);
4366		io->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
4367	}
4368
4369	/*
4370	 * Now clear out the OOA queue, and free all the I/O.
4371	 * XXX KDM should we notify the FETD here?  We probably need to
4372	 * quiesce the LUN before deleting it.
4373	 */
4374	for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); io != NULL;
4375	     io = next_io) {
4376		next_io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr, ooa_links);
4377		TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr, ooa_links);
4378		ctl_free_io_internal(io, /*have_lock*/ 1);
4379	}
4380
4381	softc->num_luns--;
4382
4383	/*
4384	 * XXX KDM this scheme only works for a single target/multiple LUN
4385	 * setup.  It needs to be revamped for a multiple target scheme.
4386	 *
4387	 * XXX KDM this results in fe->lun_disable() getting called twice,
4388	 * once when ctl_disable_lun() is called, and a second time here.
4389	 * We really need to re-think the LUN disable semantics.  There
4390	 * should probably be several steps/levels to LUN removal:
4391	 *  - disable
4392	 *  - invalidate
4393	 *  - free
4394 	 *
4395	 * Right now we only have a disable method when communicating to
4396	 * the front end ports, at least for individual LUNs.
4397	 */
4398#if 0
4399	STAILQ_FOREACH(fe, &softc->fe_list, links) {
4400		int retval;
4401
4402		retval = fe->lun_disable(fe->targ_lun_arg, lun->target,
4403					 lun->lun);
4404		if (retval != 0) {
4405			printf("ctl_free_lun: FETD %s port %d returned error "
4406			       "%d for lun_disable on target %ju lun %jd\n",
4407			       fe->port_name, fe->targ_port, retval,
4408			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
4409		}
4410
4411		if (STAILQ_FIRST(&softc->lun_list) == NULL) {
4412			fe->status &= ~CTL_PORT_STATUS_LUN_ONLINE;
4413
4414			retval = fe->targ_disable(fe->targ_lun_arg,lun->target);
4415			if (retval != 0) {
4416				printf("ctl_free_lun: FETD %s port %d "
4417				       "returned error %d for targ_disable on "
4418				       "target %ju\n", fe->port_name,
4419				       fe->targ_port, retval,
4420				       (uintmax_t)lun->target.id);
4421			} else
4422				fe->status &= ~CTL_PORT_STATUS_TARG_ONLINE;
4423
4424			if ((fe->status & CTL_PORT_STATUS_TARG_ONLINE) != 0)
4425				continue;
4426
4427#if 0
4428			fe->port_offline(fe->onoff_arg);
4429			fe->status &= ~CTL_PORT_STATUS_ONLINE;
4430#endif
4431		}
4432	}
4433#endif
4434
4435	/*
4436	 * Tell the backend to free resources, if this LUN has a backend.
4437	 */
4438	atomic_subtract_int(&lun->be_lun->be->num_luns, 1);
4439	lun->be_lun->lun_shutdown(lun->be_lun->be_lun);
4440
4441	if (lun->flags & CTL_LUN_MALLOCED)
4442		free(lun, M_CTL);
4443
4444	STAILQ_FOREACH(nlun, &softc->lun_list, links) {
4445		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
4446			nlun->pending_sense[i].ua_pending |= CTL_UA_LUN_CHANGE;
4447		}
4448	}
4449
4450	return (0);
4451}
4452
4453static void
4454ctl_create_lun(struct ctl_be_lun *be_lun)
4455{
4456	struct ctl_softc *ctl_softc;
4457
4458	ctl_softc = control_softc;
4459
4460	/*
4461	 * ctl_alloc_lun() should handle all potential failure cases.
4462	 */
4463	ctl_alloc_lun(ctl_softc, NULL, be_lun, ctl_softc->target);
4464}
4465
4466int
4467ctl_add_lun(struct ctl_be_lun *be_lun)
4468{
4469	struct ctl_softc *ctl_softc;
4470
4471	ctl_softc = control_softc;
4472
4473	mtx_lock(&ctl_softc->ctl_lock);
4474	STAILQ_INSERT_TAIL(&ctl_softc->pending_lun_queue, be_lun, links);
4475	mtx_unlock(&ctl_softc->ctl_lock);
4476
4477	ctl_wakeup_thread();
4478
4479	return (0);
4480}
4481
4482int
4483ctl_enable_lun(struct ctl_be_lun *be_lun)
4484{
4485	struct ctl_softc *ctl_softc;
4486	struct ctl_frontend *fe, *nfe;
4487	struct ctl_lun *lun;
4488	int retval;
4489
4490	ctl_softc = control_softc;
4491
4492	lun = (struct ctl_lun *)be_lun->ctl_lun;
4493
4494	mtx_lock(&ctl_softc->ctl_lock);
4495	if ((lun->flags & CTL_LUN_DISABLED) == 0) {
4496		/*
4497		 * eh?  Why did we get called if the LUN is already
4498		 * enabled?
4499		 */
4500		mtx_unlock(&ctl_softc->ctl_lock);
4501		return (0);
4502	}
4503	lun->flags &= ~CTL_LUN_DISABLED;
4504
4505	for (fe = STAILQ_FIRST(&ctl_softc->fe_list); fe != NULL; fe = nfe) {
4506		nfe = STAILQ_NEXT(fe, links);
4507
4508		/*
4509		 * Drop the lock while we call the FETD's enable routine.
4510		 * This can lead to a callback into CTL (at least in the
4511		 * case of the internal initiator frontend.
4512		 */
4513		mtx_unlock(&ctl_softc->ctl_lock);
4514		retval = fe->lun_enable(fe->targ_lun_arg, lun->target,lun->lun);
4515		mtx_lock(&ctl_softc->ctl_lock);
4516		if (retval != 0) {
4517			printf("%s: FETD %s port %d returned error "
4518			       "%d for lun_enable on target %ju lun %jd\n",
4519			       __func__, fe->port_name, fe->targ_port, retval,
4520			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
4521		}
4522#if 0
4523		 else {
4524            /* NOTE:  TODO:  why does lun enable affect port status? */
4525			fe->status |= CTL_PORT_STATUS_LUN_ONLINE;
4526		}
4527#endif
4528	}
4529
4530	mtx_unlock(&ctl_softc->ctl_lock);
4531
4532	return (0);
4533}
4534
4535int
4536ctl_disable_lun(struct ctl_be_lun *be_lun)
4537{
4538	struct ctl_softc *ctl_softc;
4539	struct ctl_frontend *fe;
4540	struct ctl_lun *lun;
4541	int retval;
4542
4543	ctl_softc = control_softc;
4544
4545	lun = (struct ctl_lun *)be_lun->ctl_lun;
4546
4547	mtx_lock(&ctl_softc->ctl_lock);
4548
4549	if (lun->flags & CTL_LUN_DISABLED) {
4550		mtx_unlock(&ctl_softc->ctl_lock);
4551		return (0);
4552	}
4553	lun->flags |= CTL_LUN_DISABLED;
4554
4555	STAILQ_FOREACH(fe, &ctl_softc->fe_list, links) {
4556		mtx_unlock(&ctl_softc->ctl_lock);
4557		/*
4558		 * Drop the lock before we call the frontend's disable
4559		 * routine, to avoid lock order reversals.
4560		 *
4561		 * XXX KDM what happens if the frontend list changes while
4562		 * we're traversing it?  It's unlikely, but should be handled.
4563		 */
4564		retval = fe->lun_disable(fe->targ_lun_arg, lun->target,
4565					 lun->lun);
4566		mtx_lock(&ctl_softc->ctl_lock);
4567		if (retval != 0) {
4568			printf("ctl_alloc_lun: FETD %s port %d returned error "
4569			       "%d for lun_disable on target %ju lun %jd\n",
4570			       fe->port_name, fe->targ_port, retval,
4571			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
4572		}
4573	}
4574
4575	mtx_unlock(&ctl_softc->ctl_lock);
4576
4577	return (0);
4578}
4579
4580int
4581ctl_start_lun(struct ctl_be_lun *be_lun)
4582{
4583	struct ctl_softc *ctl_softc;
4584	struct ctl_lun *lun;
4585
4586	ctl_softc = control_softc;
4587
4588	lun = (struct ctl_lun *)be_lun->ctl_lun;
4589
4590	mtx_lock(&ctl_softc->ctl_lock);
4591	lun->flags &= ~CTL_LUN_STOPPED;
4592	mtx_unlock(&ctl_softc->ctl_lock);
4593
4594	return (0);
4595}
4596
4597int
4598ctl_stop_lun(struct ctl_be_lun *be_lun)
4599{
4600	struct ctl_softc *ctl_softc;
4601	struct ctl_lun *lun;
4602
4603	ctl_softc = control_softc;
4604
4605	lun = (struct ctl_lun *)be_lun->ctl_lun;
4606
4607	mtx_lock(&ctl_softc->ctl_lock);
4608	lun->flags |= CTL_LUN_STOPPED;
4609	mtx_unlock(&ctl_softc->ctl_lock);
4610
4611	return (0);
4612}
4613
4614int
4615ctl_lun_offline(struct ctl_be_lun *be_lun)
4616{
4617	struct ctl_softc *ctl_softc;
4618	struct ctl_lun *lun;
4619
4620	ctl_softc = control_softc;
4621
4622	lun = (struct ctl_lun *)be_lun->ctl_lun;
4623
4624	mtx_lock(&ctl_softc->ctl_lock);
4625	lun->flags |= CTL_LUN_OFFLINE;
4626	mtx_unlock(&ctl_softc->ctl_lock);
4627
4628	return (0);
4629}
4630
4631int
4632ctl_lun_online(struct ctl_be_lun *be_lun)
4633{
4634	struct ctl_softc *ctl_softc;
4635	struct ctl_lun *lun;
4636
4637	ctl_softc = control_softc;
4638
4639	lun = (struct ctl_lun *)be_lun->ctl_lun;
4640
4641	mtx_lock(&ctl_softc->ctl_lock);
4642	lun->flags &= ~CTL_LUN_OFFLINE;
4643	mtx_unlock(&ctl_softc->ctl_lock);
4644
4645	return (0);
4646}
4647
4648int
4649ctl_invalidate_lun(struct ctl_be_lun *be_lun)
4650{
4651	struct ctl_softc *ctl_softc;
4652	struct ctl_lun *lun;
4653
4654	ctl_softc = control_softc;
4655
4656	lun = (struct ctl_lun *)be_lun->ctl_lun;
4657
4658	mtx_lock(&ctl_softc->ctl_lock);
4659
4660	/*
4661	 * The LUN needs to be disabled before it can be marked invalid.
4662	 */
4663	if ((lun->flags & CTL_LUN_DISABLED) == 0) {
4664		mtx_unlock(&ctl_softc->ctl_lock);
4665		return (-1);
4666	}
4667	/*
4668	 * Mark the LUN invalid.
4669	 */
4670	lun->flags |= CTL_LUN_INVALID;
4671
4672	/*
4673	 * If there is nothing in the OOA queue, go ahead and free the LUN.
4674	 * If we have something in the OOA queue, we'll free it when the
4675	 * last I/O completes.
4676	 */
4677	if (TAILQ_FIRST(&lun->ooa_queue) == NULL)
4678		ctl_free_lun(lun);
4679	mtx_unlock(&ctl_softc->ctl_lock);
4680
4681	return (0);
4682}
4683
4684int
4685ctl_lun_inoperable(struct ctl_be_lun *be_lun)
4686{
4687	struct ctl_softc *ctl_softc;
4688	struct ctl_lun *lun;
4689
4690	ctl_softc = control_softc;
4691	lun = (struct ctl_lun *)be_lun->ctl_lun;
4692
4693	mtx_lock(&ctl_softc->ctl_lock);
4694	lun->flags |= CTL_LUN_INOPERABLE;
4695	mtx_unlock(&ctl_softc->ctl_lock);
4696
4697	return (0);
4698}
4699
4700int
4701ctl_lun_operable(struct ctl_be_lun *be_lun)
4702{
4703	struct ctl_softc *ctl_softc;
4704	struct ctl_lun *lun;
4705
4706	ctl_softc = control_softc;
4707	lun = (struct ctl_lun *)be_lun->ctl_lun;
4708
4709	mtx_lock(&ctl_softc->ctl_lock);
4710	lun->flags &= ~CTL_LUN_INOPERABLE;
4711	mtx_unlock(&ctl_softc->ctl_lock);
4712
4713	return (0);
4714}
4715
4716int
4717ctl_lun_power_lock(struct ctl_be_lun *be_lun, struct ctl_nexus *nexus,
4718		   int lock)
4719{
4720	struct ctl_softc *softc;
4721	struct ctl_lun *lun;
4722	struct copan_aps_subpage *current_sp;
4723	struct ctl_page_index *page_index;
4724	int i;
4725
4726	softc = control_softc;
4727
4728	mtx_lock(&softc->ctl_lock);
4729
4730	lun = (struct ctl_lun *)be_lun->ctl_lun;
4731
4732	page_index = NULL;
4733	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
4734		if ((lun->mode_pages.index[i].page_code & SMPH_PC_MASK) !=
4735		     APS_PAGE_CODE)
4736			continue;
4737
4738		if (lun->mode_pages.index[i].subpage != APS_SUBPAGE_CODE)
4739			continue;
4740		page_index = &lun->mode_pages.index[i];
4741	}
4742
4743	if (page_index == NULL) {
4744		mtx_unlock(&softc->ctl_lock);
4745		printf("%s: APS subpage not found for lun %ju!\n", __func__,
4746		       (uintmax_t)lun->lun);
4747		return (1);
4748	}
4749#if 0
4750	if ((softc->aps_locked_lun != 0)
4751	 && (softc->aps_locked_lun != lun->lun)) {
4752		printf("%s: attempt to lock LUN %llu when %llu is already "
4753		       "locked\n");
4754		mtx_unlock(&softc->ctl_lock);
4755		return (1);
4756	}
4757#endif
4758
4759	current_sp = (struct copan_aps_subpage *)(page_index->page_data +
4760		(page_index->page_len * CTL_PAGE_CURRENT));
4761
4762	if (lock != 0) {
4763		current_sp->lock_active = APS_LOCK_ACTIVE;
4764		softc->aps_locked_lun = lun->lun;
4765	} else {
4766		current_sp->lock_active = 0;
4767		softc->aps_locked_lun = 0;
4768	}
4769
4770
4771	/*
4772	 * If we're in HA mode, try to send the lock message to the other
4773	 * side.
4774	 */
4775	if (ctl_is_single == 0) {
4776		int isc_retval;
4777		union ctl_ha_msg lock_msg;
4778
4779		lock_msg.hdr.nexus = *nexus;
4780		lock_msg.hdr.msg_type = CTL_MSG_APS_LOCK;
4781		if (lock != 0)
4782			lock_msg.aps.lock_flag = 1;
4783		else
4784			lock_msg.aps.lock_flag = 0;
4785		isc_retval = ctl_ha_msg_send(CTL_HA_CHAN_CTL, &lock_msg,
4786					 sizeof(lock_msg), 0);
4787		if (isc_retval > CTL_HA_STATUS_SUCCESS) {
4788			printf("%s: APS (lock=%d) error returned from "
4789			       "ctl_ha_msg_send: %d\n", __func__, lock, isc_retval);
4790			mtx_unlock(&softc->ctl_lock);
4791			return (1);
4792		}
4793	}
4794
4795	mtx_unlock(&softc->ctl_lock);
4796
4797	return (0);
4798}
4799
4800/*
4801 * Backend "memory move is complete" callback for requests that never
4802 * make it down to say RAIDCore's configuration code.
4803 */
4804int
4805ctl_config_move_done(union ctl_io *io)
4806{
4807	int retval;
4808
4809	retval = CTL_RETVAL_COMPLETE;
4810
4811
4812	CTL_DEBUG_PRINT(("ctl_config_move_done\n"));
4813	/*
4814	 * XXX KDM this shouldn't happen, but what if it does?
4815	 */
4816	if (io->io_hdr.io_type != CTL_IO_SCSI)
4817		panic("I/O type isn't CTL_IO_SCSI!");
4818
4819	if ((io->io_hdr.port_status == 0)
4820	 && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
4821	 && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE))
4822		io->io_hdr.status = CTL_SUCCESS;
4823	else if ((io->io_hdr.port_status != 0)
4824	      && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
4825	      && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE)){
4826		/*
4827		 * For hardware error sense keys, the sense key
4828		 * specific value is defined to be a retry count,
4829		 * but we use it to pass back an internal FETD
4830		 * error code.  XXX KDM  Hopefully the FETD is only
4831		 * using 16 bits for an error code, since that's
4832		 * all the space we have in the sks field.
4833		 */
4834		ctl_set_internal_failure(&io->scsiio,
4835					 /*sks_valid*/ 1,
4836					 /*retry_count*/
4837					 io->io_hdr.port_status);
4838		free(io->scsiio.kern_data_ptr, M_CTL);
4839		ctl_done(io);
4840		goto bailout;
4841	}
4842
4843	if (((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
4844	 || ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
4845	 || ((io->io_hdr.flags & CTL_FLAG_ABORT) != 0)) {
4846		/*
4847		 * XXX KDM just assuming a single pointer here, and not a
4848		 * S/G list.  If we start using S/G lists for config data,
4849		 * we'll need to know how to clean them up here as well.
4850		 */
4851		free(io->scsiio.kern_data_ptr, M_CTL);
4852		/* Hopefully the user has already set the status... */
4853		ctl_done(io);
4854	} else {
4855		/*
4856		 * XXX KDM now we need to continue data movement.  Some
4857		 * options:
4858		 * - call ctl_scsiio() again?  We don't do this for data
4859		 *   writes, because for those at least we know ahead of
4860		 *   time where the write will go and how long it is.  For
4861		 *   config writes, though, that information is largely
4862		 *   contained within the write itself, thus we need to
4863		 *   parse out the data again.
4864		 *
4865		 * - Call some other function once the data is in?
4866		 */
4867
4868		/*
4869		 * XXX KDM call ctl_scsiio() again for now, and check flag
4870		 * bits to see whether we're allocated or not.
4871		 */
4872		retval = ctl_scsiio(&io->scsiio);
4873	}
4874bailout:
4875	return (retval);
4876}
4877
4878/*
4879 * This gets called by a backend driver when it is done with a
4880 * configuration write.
4881 */
4882void
4883ctl_config_write_done(union ctl_io *io)
4884{
4885	/*
4886	 * If the IO_CONT flag is set, we need to call the supplied
4887	 * function to continue processing the I/O, instead of completing
4888	 * the I/O just yet.
4889	 *
4890	 * If there is an error, though, we don't want to keep processing.
4891	 * Instead, just send status back to the initiator.
4892	 */
4893	if ((io->io_hdr.flags & CTL_FLAG_IO_CONT)
4894	 && (((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE)
4895	  || ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS))) {
4896		io->scsiio.io_cont(io);
4897		return;
4898	}
4899	/*
4900	 * Since a configuration write can be done for commands that actually
4901	 * have data allocated, like write buffer, and commands that have
4902	 * no data, like start/stop unit, we need to check here.
4903	 */
4904	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_OUT)
4905		free(io->scsiio.kern_data_ptr, M_CTL);
4906	ctl_done(io);
4907}
4908
4909/*
4910 * SCSI release command.
4911 */
4912int
4913ctl_scsi_release(struct ctl_scsiio *ctsio)
4914{
4915	int length, longid, thirdparty_id, resv_id;
4916	struct ctl_softc *ctl_softc;
4917	struct ctl_lun *lun;
4918
4919	length = 0;
4920	resv_id = 0;
4921
4922	CTL_DEBUG_PRINT(("ctl_scsi_release\n"));
4923
4924	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
4925	ctl_softc = control_softc;
4926
4927	switch (ctsio->cdb[0]) {
4928	case RELEASE: {
4929		struct scsi_release *cdb;
4930
4931		cdb = (struct scsi_release *)ctsio->cdb;
4932		if ((cdb->byte2 & 0x1f) != 0) {
4933			ctl_set_invalid_field(ctsio,
4934					      /*sks_valid*/ 1,
4935					      /*command*/ 1,
4936					      /*field*/ 1,
4937					      /*bit_valid*/ 0,
4938					      /*bit*/ 0);
4939			ctl_done((union ctl_io *)ctsio);
4940			return (CTL_RETVAL_COMPLETE);
4941		}
4942		break;
4943	}
4944	case RELEASE_10: {
4945		struct scsi_release_10 *cdb;
4946
4947		cdb = (struct scsi_release_10 *)ctsio->cdb;
4948
4949		if ((cdb->byte2 & SR10_EXTENT) != 0) {
4950			ctl_set_invalid_field(ctsio,
4951					      /*sks_valid*/ 1,
4952					      /*command*/ 1,
4953					      /*field*/ 1,
4954					      /*bit_valid*/ 1,
4955					      /*bit*/ 0);
4956			ctl_done((union ctl_io *)ctsio);
4957			return (CTL_RETVAL_COMPLETE);
4958
4959		}
4960
4961		if ((cdb->byte2 & SR10_3RDPTY) != 0) {
4962			ctl_set_invalid_field(ctsio,
4963					      /*sks_valid*/ 1,
4964					      /*command*/ 1,
4965					      /*field*/ 1,
4966					      /*bit_valid*/ 1,
4967					      /*bit*/ 4);
4968			ctl_done((union ctl_io *)ctsio);
4969			return (CTL_RETVAL_COMPLETE);
4970		}
4971
4972		if (cdb->byte2 & SR10_LONGID)
4973			longid = 1;
4974		else
4975			thirdparty_id = cdb->thirdparty_id;
4976
4977		resv_id = cdb->resv_id;
4978		length = scsi_2btoul(cdb->length);
4979		break;
4980	}
4981	}
4982
4983
4984	/*
4985	 * XXX KDM right now, we only support LUN reservation.  We don't
4986	 * support 3rd party reservations, or extent reservations, which
4987	 * might actually need the parameter list.  If we've gotten this
4988	 * far, we've got a LUN reservation.  Anything else got kicked out
4989	 * above.  So, according to SPC, ignore the length.
4990	 */
4991	length = 0;
4992
4993	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
4994	 && (length > 0)) {
4995		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
4996		if (ctsio->kern_data_ptr == NULL) {
4997			ctsio->io_hdr.status = CTL_SCSI_ERROR;
4998			ctsio->io_hdr.status = SCSI_STATUS_BUSY;
4999			ctl_done((union ctl_io *)ctsio);
5000			return (CTL_RETVAL_COMPLETE);
5001		}
5002		ctsio->kern_data_len = length;
5003		ctsio->kern_total_len = length;
5004		ctsio->kern_data_resid = 0;
5005		ctsio->kern_rel_offset = 0;
5006		ctsio->kern_sg_entries = 0;
5007		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
5008		ctsio->be_move_done = ctl_config_move_done;
5009		ctl_datamove((union ctl_io *)ctsio);
5010
5011		return (CTL_RETVAL_COMPLETE);
5012	}
5013
5014	if (length > 0)
5015		thirdparty_id = scsi_8btou64(ctsio->kern_data_ptr);
5016
5017	mtx_lock(&ctl_softc->ctl_lock);
5018
5019	/*
5020	 * According to SPC, it is not an error for an intiator to attempt
5021	 * to release a reservation on a LUN that isn't reserved, or that
5022	 * is reserved by another initiator.  The reservation can only be
5023	 * released, though, by the initiator who made it or by one of
5024	 * several reset type events.
5025	 */
5026	if (lun->flags & CTL_LUN_RESERVED) {
5027		if ((ctsio->io_hdr.nexus.initid.id == lun->rsv_nexus.initid.id)
5028		 && (ctsio->io_hdr.nexus.targ_port == lun->rsv_nexus.targ_port)
5029		 && (ctsio->io_hdr.nexus.targ_target.id ==
5030		     lun->rsv_nexus.targ_target.id)) {
5031			lun->flags &= ~CTL_LUN_RESERVED;
5032		}
5033	}
5034
5035	ctsio->scsi_status = SCSI_STATUS_OK;
5036	ctsio->io_hdr.status = CTL_SUCCESS;
5037
5038	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
5039		free(ctsio->kern_data_ptr, M_CTL);
5040		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
5041	}
5042
5043	mtx_unlock(&ctl_softc->ctl_lock);
5044
5045	ctl_done((union ctl_io *)ctsio);
5046	return (CTL_RETVAL_COMPLETE);
5047}
5048
5049int
5050ctl_scsi_reserve(struct ctl_scsiio *ctsio)
5051{
5052	int extent, thirdparty, longid;
5053	int resv_id, length;
5054	uint64_t thirdparty_id;
5055	struct ctl_softc *ctl_softc;
5056	struct ctl_lun *lun;
5057
5058	extent = 0;
5059	thirdparty = 0;
5060	longid = 0;
5061	resv_id = 0;
5062	length = 0;
5063	thirdparty_id = 0;
5064
5065	CTL_DEBUG_PRINT(("ctl_reserve\n"));
5066
5067	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5068	ctl_softc = control_softc;
5069
5070	switch (ctsio->cdb[0]) {
5071	case RESERVE: {
5072		struct scsi_reserve *cdb;
5073
5074		cdb = (struct scsi_reserve *)ctsio->cdb;
5075		if ((cdb->byte2 & 0x1f) != 0) {
5076			ctl_set_invalid_field(ctsio,
5077					      /*sks_valid*/ 1,
5078					      /*command*/ 1,
5079					      /*field*/ 1,
5080					      /*bit_valid*/ 0,
5081					      /*bit*/ 0);
5082			ctl_done((union ctl_io *)ctsio);
5083			return (CTL_RETVAL_COMPLETE);
5084		}
5085		resv_id = cdb->resv_id;
5086		length = scsi_2btoul(cdb->length);
5087		break;
5088	}
5089	case RESERVE_10: {
5090		struct scsi_reserve_10 *cdb;
5091
5092		cdb = (struct scsi_reserve_10 *)ctsio->cdb;
5093
5094		if ((cdb->byte2 & SR10_EXTENT) != 0) {
5095			ctl_set_invalid_field(ctsio,
5096					      /*sks_valid*/ 1,
5097					      /*command*/ 1,
5098					      /*field*/ 1,
5099					      /*bit_valid*/ 1,
5100					      /*bit*/ 0);
5101			ctl_done((union ctl_io *)ctsio);
5102			return (CTL_RETVAL_COMPLETE);
5103		}
5104		if ((cdb->byte2 & SR10_3RDPTY) != 0) {
5105			ctl_set_invalid_field(ctsio,
5106					      /*sks_valid*/ 1,
5107					      /*command*/ 1,
5108					      /*field*/ 1,
5109					      /*bit_valid*/ 1,
5110					      /*bit*/ 4);
5111			ctl_done((union ctl_io *)ctsio);
5112			return (CTL_RETVAL_COMPLETE);
5113		}
5114		if (cdb->byte2 & SR10_LONGID)
5115			longid = 1;
5116		else
5117			thirdparty_id = cdb->thirdparty_id;
5118
5119		resv_id = cdb->resv_id;
5120		length = scsi_2btoul(cdb->length);
5121		break;
5122	}
5123	}
5124
5125	/*
5126	 * XXX KDM right now, we only support LUN reservation.  We don't
5127	 * support 3rd party reservations, or extent reservations, which
5128	 * might actually need the parameter list.  If we've gotten this
5129	 * far, we've got a LUN reservation.  Anything else got kicked out
5130	 * above.  So, according to SPC, ignore the length.
5131	 */
5132	length = 0;
5133
5134	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
5135	 && (length > 0)) {
5136		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
5137		if (ctsio->kern_data_ptr == NULL) {
5138			ctsio->io_hdr.status = CTL_SCSI_ERROR;
5139			ctsio->io_hdr.status = SCSI_STATUS_BUSY;
5140			ctl_done((union ctl_io *)ctsio);
5141			return (CTL_RETVAL_COMPLETE);
5142		}
5143		ctsio->kern_data_len = length;
5144		ctsio->kern_total_len = length;
5145		ctsio->kern_data_resid = 0;
5146		ctsio->kern_rel_offset = 0;
5147		ctsio->kern_sg_entries = 0;
5148		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
5149		ctsio->be_move_done = ctl_config_move_done;
5150		ctl_datamove((union ctl_io *)ctsio);
5151
5152		return (CTL_RETVAL_COMPLETE);
5153	}
5154
5155	if (length > 0)
5156		thirdparty_id = scsi_8btou64(ctsio->kern_data_ptr);
5157
5158	mtx_lock(&ctl_softc->ctl_lock);
5159	if (lun->flags & CTL_LUN_RESERVED) {
5160		if ((ctsio->io_hdr.nexus.initid.id != lun->rsv_nexus.initid.id)
5161		 || (ctsio->io_hdr.nexus.targ_port != lun->rsv_nexus.targ_port)
5162		 || (ctsio->io_hdr.nexus.targ_target.id !=
5163		     lun->rsv_nexus.targ_target.id)) {
5164			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
5165			ctsio->io_hdr.status = CTL_SCSI_ERROR;
5166			goto bailout;
5167		}
5168	}
5169
5170	lun->flags |= CTL_LUN_RESERVED;
5171	lun->rsv_nexus = ctsio->io_hdr.nexus;
5172
5173	ctsio->scsi_status = SCSI_STATUS_OK;
5174	ctsio->io_hdr.status = CTL_SUCCESS;
5175
5176bailout:
5177	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
5178		free(ctsio->kern_data_ptr, M_CTL);
5179		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
5180	}
5181
5182	mtx_unlock(&ctl_softc->ctl_lock);
5183
5184	ctl_done((union ctl_io *)ctsio);
5185	return (CTL_RETVAL_COMPLETE);
5186}
5187
5188int
5189ctl_start_stop(struct ctl_scsiio *ctsio)
5190{
5191	struct scsi_start_stop_unit *cdb;
5192	struct ctl_lun *lun;
5193	struct ctl_softc *ctl_softc;
5194	int retval;
5195
5196	CTL_DEBUG_PRINT(("ctl_start_stop\n"));
5197
5198	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5199	ctl_softc = control_softc;
5200	retval = 0;
5201
5202	cdb = (struct scsi_start_stop_unit *)ctsio->cdb;
5203
5204	/*
5205	 * XXX KDM
5206	 * We don't support the immediate bit on a stop unit.  In order to
5207	 * do that, we would need to code up a way to know that a stop is
5208	 * pending, and hold off any new commands until it completes, one
5209	 * way or another.  Then we could accept or reject those commands
5210	 * depending on its status.  We would almost need to do the reverse
5211	 * of what we do below for an immediate start -- return the copy of
5212	 * the ctl_io to the FETD with status to send to the host (and to
5213	 * free the copy!) and then free the original I/O once the stop
5214	 * actually completes.  That way, the OOA queue mechanism can work
5215	 * to block commands that shouldn't proceed.  Another alternative
5216	 * would be to put the copy in the queue in place of the original,
5217	 * and return the original back to the caller.  That could be
5218	 * slightly safer..
5219	 */
5220	if ((cdb->byte2 & SSS_IMMED)
5221	 && ((cdb->how & SSS_START) == 0)) {
5222		ctl_set_invalid_field(ctsio,
5223				      /*sks_valid*/ 1,
5224				      /*command*/ 1,
5225				      /*field*/ 1,
5226				      /*bit_valid*/ 1,
5227				      /*bit*/ 0);
5228		ctl_done((union ctl_io *)ctsio);
5229		return (CTL_RETVAL_COMPLETE);
5230	}
5231
5232	/*
5233	 * We don't support the power conditions field.  We need to check
5234	 * this prior to checking the load/eject and start/stop bits.
5235	 */
5236	if ((cdb->how & SSS_PC_MASK) != SSS_PC_START_VALID) {
5237		ctl_set_invalid_field(ctsio,
5238				      /*sks_valid*/ 1,
5239				      /*command*/ 1,
5240				      /*field*/ 4,
5241				      /*bit_valid*/ 1,
5242				      /*bit*/ 4);
5243		ctl_done((union ctl_io *)ctsio);
5244		return (CTL_RETVAL_COMPLETE);
5245	}
5246
5247	/*
5248	 * Media isn't removable, so we can't load or eject it.
5249	 */
5250	if ((cdb->how & SSS_LOEJ) != 0) {
5251		ctl_set_invalid_field(ctsio,
5252				      /*sks_valid*/ 1,
5253				      /*command*/ 1,
5254				      /*field*/ 4,
5255				      /*bit_valid*/ 1,
5256				      /*bit*/ 1);
5257		ctl_done((union ctl_io *)ctsio);
5258		return (CTL_RETVAL_COMPLETE);
5259	}
5260
5261	if ((lun->flags & CTL_LUN_PR_RESERVED)
5262	 && ((cdb->how & SSS_START)==0)) {
5263		uint32_t residx;
5264
5265		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
5266		if (!lun->per_res[residx].registered
5267		 || (lun->pr_res_idx!=residx && lun->res_type < 4)) {
5268
5269			ctl_set_reservation_conflict(ctsio);
5270			ctl_done((union ctl_io *)ctsio);
5271			return (CTL_RETVAL_COMPLETE);
5272		}
5273	}
5274
5275	/*
5276	 * If there is no backend on this device, we can't start or stop
5277	 * it.  In theory we shouldn't get any start/stop commands in the
5278	 * first place at this level if the LUN doesn't have a backend.
5279	 * That should get stopped by the command decode code.
5280	 */
5281	if (lun->backend == NULL) {
5282		ctl_set_invalid_opcode(ctsio);
5283		ctl_done((union ctl_io *)ctsio);
5284		return (CTL_RETVAL_COMPLETE);
5285	}
5286
5287	/*
5288	 * XXX KDM Copan-specific offline behavior.
5289	 * Figure out a reasonable way to port this?
5290	 */
5291#ifdef NEEDTOPORT
5292	mtx_lock(&ctl_softc->ctl_lock);
5293
5294	if (((cdb->byte2 & SSS_ONOFFLINE) == 0)
5295	 && (lun->flags & CTL_LUN_OFFLINE)) {
5296		/*
5297		 * If the LUN is offline, and the on/offline bit isn't set,
5298		 * reject the start or stop.  Otherwise, let it through.
5299		 */
5300		mtx_unlock(&ctl_softc->ctl_lock);
5301		ctl_set_lun_not_ready(ctsio);
5302		ctl_done((union ctl_io *)ctsio);
5303	} else {
5304		mtx_unlock(&ctl_softc->ctl_lock);
5305#endif /* NEEDTOPORT */
5306		/*
5307		 * This could be a start or a stop when we're online,
5308		 * or a stop/offline or start/online.  A start or stop when
5309		 * we're offline is covered in the case above.
5310		 */
5311		/*
5312		 * In the non-immediate case, we send the request to
5313		 * the backend and return status to the user when
5314		 * it is done.
5315		 *
5316		 * In the immediate case, we allocate a new ctl_io
5317		 * to hold a copy of the request, and send that to
5318		 * the backend.  We then set good status on the
5319		 * user's request and return it immediately.
5320		 */
5321		if (cdb->byte2 & SSS_IMMED) {
5322			union ctl_io *new_io;
5323
5324			new_io = ctl_alloc_io(ctsio->io_hdr.pool);
5325			if (new_io == NULL) {
5326				ctl_set_busy(ctsio);
5327				ctl_done((union ctl_io *)ctsio);
5328			} else {
5329				ctl_copy_io((union ctl_io *)ctsio,
5330					    new_io);
5331				retval = lun->backend->config_write(new_io);
5332				ctl_set_success(ctsio);
5333				ctl_done((union ctl_io *)ctsio);
5334			}
5335		} else {
5336			retval = lun->backend->config_write(
5337				(union ctl_io *)ctsio);
5338		}
5339#ifdef NEEDTOPORT
5340	}
5341#endif
5342	return (retval);
5343}
5344
5345/*
5346 * We support the SYNCHRONIZE CACHE command (10 and 16 byte versions), but
5347 * we don't really do anything with the LBA and length fields if the user
5348 * passes them in.  Instead we'll just flush out the cache for the entire
5349 * LUN.
5350 */
5351int
5352ctl_sync_cache(struct ctl_scsiio *ctsio)
5353{
5354	struct ctl_lun *lun;
5355	struct ctl_softc *ctl_softc;
5356	uint64_t starting_lba;
5357	uint32_t block_count;
5358	int reladr, immed;
5359	int retval;
5360
5361	CTL_DEBUG_PRINT(("ctl_sync_cache\n"));
5362
5363	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5364	ctl_softc = control_softc;
5365	retval = 0;
5366	reladr = 0;
5367	immed = 0;
5368
5369	switch (ctsio->cdb[0]) {
5370	case SYNCHRONIZE_CACHE: {
5371		struct scsi_sync_cache *cdb;
5372		cdb = (struct scsi_sync_cache *)ctsio->cdb;
5373
5374		if (cdb->byte2 & SSC_RELADR)
5375			reladr = 1;
5376
5377		if (cdb->byte2 & SSC_IMMED)
5378			immed = 1;
5379
5380		starting_lba = scsi_4btoul(cdb->begin_lba);
5381		block_count = scsi_2btoul(cdb->lb_count);
5382		break;
5383	}
5384	case SYNCHRONIZE_CACHE_16: {
5385		struct scsi_sync_cache_16 *cdb;
5386		cdb = (struct scsi_sync_cache_16 *)ctsio->cdb;
5387
5388		if (cdb->byte2 & SSC_RELADR)
5389			reladr = 1;
5390
5391		if (cdb->byte2 & SSC_IMMED)
5392			immed = 1;
5393
5394		starting_lba = scsi_8btou64(cdb->begin_lba);
5395		block_count = scsi_4btoul(cdb->lb_count);
5396		break;
5397	}
5398	default:
5399		ctl_set_invalid_opcode(ctsio);
5400		ctl_done((union ctl_io *)ctsio);
5401		goto bailout;
5402		break; /* NOTREACHED */
5403	}
5404
5405	if (immed) {
5406		/*
5407		 * We don't support the immediate bit.  Since it's in the
5408		 * same place for the 10 and 16 byte SYNCHRONIZE CACHE
5409		 * commands, we can just return the same error in either
5410		 * case.
5411		 */
5412		ctl_set_invalid_field(ctsio,
5413				      /*sks_valid*/ 1,
5414				      /*command*/ 1,
5415				      /*field*/ 1,
5416				      /*bit_valid*/ 1,
5417				      /*bit*/ 1);
5418		ctl_done((union ctl_io *)ctsio);
5419		goto bailout;
5420	}
5421
5422	if (reladr) {
5423		/*
5424		 * We don't support the reladr bit either.  It can only be
5425		 * used with linked commands, and we don't support linked
5426		 * commands.  Since the bit is in the same place for the
5427		 * 10 and 16 byte SYNCHRONIZE CACHE * commands, we can
5428		 * just return the same error in either case.
5429		 */
5430		ctl_set_invalid_field(ctsio,
5431				      /*sks_valid*/ 1,
5432				      /*command*/ 1,
5433				      /*field*/ 1,
5434				      /*bit_valid*/ 1,
5435				      /*bit*/ 0);
5436		ctl_done((union ctl_io *)ctsio);
5437		goto bailout;
5438	}
5439
5440	/*
5441	 * We check the LBA and length, but don't do anything with them.
5442	 * A SYNCHRONIZE CACHE will cause the entire cache for this lun to
5443	 * get flushed.  This check will just help satisfy anyone who wants
5444	 * to see an error for an out of range LBA.
5445	 */
5446	if ((starting_lba + block_count) > (lun->be_lun->maxlba + 1)) {
5447		ctl_set_lba_out_of_range(ctsio);
5448		ctl_done((union ctl_io *)ctsio);
5449		goto bailout;
5450	}
5451
5452	/*
5453	 * If this LUN has no backend, we can't flush the cache anyway.
5454	 */
5455	if (lun->backend == NULL) {
5456		ctl_set_invalid_opcode(ctsio);
5457		ctl_done((union ctl_io *)ctsio);
5458		goto bailout;
5459	}
5460
5461	/*
5462	 * Check to see whether we're configured to send the SYNCHRONIZE
5463	 * CACHE command directly to the back end.
5464	 */
5465	mtx_lock(&ctl_softc->ctl_lock);
5466	if ((ctl_softc->flags & CTL_FLAG_REAL_SYNC)
5467	 && (++(lun->sync_count) >= lun->sync_interval)) {
5468		lun->sync_count = 0;
5469		mtx_unlock(&ctl_softc->ctl_lock);
5470		retval = lun->backend->config_write((union ctl_io *)ctsio);
5471	} else {
5472		mtx_unlock(&ctl_softc->ctl_lock);
5473		ctl_set_success(ctsio);
5474		ctl_done((union ctl_io *)ctsio);
5475	}
5476
5477bailout:
5478
5479	return (retval);
5480}
5481
5482int
5483ctl_format(struct ctl_scsiio *ctsio)
5484{
5485	struct scsi_format *cdb;
5486	struct ctl_lun *lun;
5487	struct ctl_softc *ctl_softc;
5488	int length, defect_list_len;
5489
5490	CTL_DEBUG_PRINT(("ctl_format\n"));
5491
5492	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5493	ctl_softc = control_softc;
5494
5495	cdb = (struct scsi_format *)ctsio->cdb;
5496
5497	length = 0;
5498	if (cdb->byte2 & SF_FMTDATA) {
5499		if (cdb->byte2 & SF_LONGLIST)
5500			length = sizeof(struct scsi_format_header_long);
5501		else
5502			length = sizeof(struct scsi_format_header_short);
5503	}
5504
5505	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
5506	 && (length > 0)) {
5507		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
5508		if (ctsio->kern_data_ptr == NULL) {
5509			ctsio->io_hdr.status = CTL_SCSI_ERROR;
5510			ctsio->io_hdr.status = SCSI_STATUS_BUSY;
5511			ctl_done((union ctl_io *)ctsio);
5512			return (CTL_RETVAL_COMPLETE);
5513		}
5514		ctsio->kern_data_len = length;
5515		ctsio->kern_total_len = length;
5516		ctsio->kern_data_resid = 0;
5517		ctsio->kern_rel_offset = 0;
5518		ctsio->kern_sg_entries = 0;
5519		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
5520		ctsio->be_move_done = ctl_config_move_done;
5521		ctl_datamove((union ctl_io *)ctsio);
5522
5523		return (CTL_RETVAL_COMPLETE);
5524	}
5525
5526	defect_list_len = 0;
5527
5528	if (cdb->byte2 & SF_FMTDATA) {
5529		if (cdb->byte2 & SF_LONGLIST) {
5530			struct scsi_format_header_long *header;
5531
5532			header = (struct scsi_format_header_long *)
5533				ctsio->kern_data_ptr;
5534
5535			defect_list_len = scsi_4btoul(header->defect_list_len);
5536			if (defect_list_len != 0) {
5537				ctl_set_invalid_field(ctsio,
5538						      /*sks_valid*/ 1,
5539						      /*command*/ 0,
5540						      /*field*/ 2,
5541						      /*bit_valid*/ 0,
5542						      /*bit*/ 0);
5543				goto bailout;
5544			}
5545		} else {
5546			struct scsi_format_header_short *header;
5547
5548			header = (struct scsi_format_header_short *)
5549				ctsio->kern_data_ptr;
5550
5551			defect_list_len = scsi_2btoul(header->defect_list_len);
5552			if (defect_list_len != 0) {
5553				ctl_set_invalid_field(ctsio,
5554						      /*sks_valid*/ 1,
5555						      /*command*/ 0,
5556						      /*field*/ 2,
5557						      /*bit_valid*/ 0,
5558						      /*bit*/ 0);
5559				goto bailout;
5560			}
5561		}
5562	}
5563
5564	/*
5565	 * The format command will clear out the "Medium format corrupted"
5566	 * status if set by the configuration code.  That status is really
5567	 * just a way to notify the host that we have lost the media, and
5568	 * get them to issue a command that will basically make them think
5569	 * they're blowing away the media.
5570	 */
5571	mtx_lock(&ctl_softc->ctl_lock);
5572	lun->flags &= ~CTL_LUN_INOPERABLE;
5573	mtx_unlock(&ctl_softc->ctl_lock);
5574
5575	ctsio->scsi_status = SCSI_STATUS_OK;
5576	ctsio->io_hdr.status = CTL_SUCCESS;
5577bailout:
5578
5579	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
5580		free(ctsio->kern_data_ptr, M_CTL);
5581		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
5582	}
5583
5584	ctl_done((union ctl_io *)ctsio);
5585	return (CTL_RETVAL_COMPLETE);
5586}
5587
5588int
5589ctl_write_buffer(struct ctl_scsiio *ctsio)
5590{
5591	struct scsi_write_buffer *cdb;
5592	struct copan_page_header *header;
5593	struct ctl_lun *lun;
5594	struct ctl_softc *ctl_softc;
5595	int buffer_offset, len;
5596	int retval;
5597
5598	header = NULL;
5599
5600	retval = CTL_RETVAL_COMPLETE;
5601
5602	CTL_DEBUG_PRINT(("ctl_write_buffer\n"));
5603
5604	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5605	ctl_softc = control_softc;
5606	cdb = (struct scsi_write_buffer *)ctsio->cdb;
5607
5608	if ((cdb->byte2 & RWB_MODE) != RWB_MODE_DATA) {
5609		ctl_set_invalid_field(ctsio,
5610				      /*sks_valid*/ 1,
5611				      /*command*/ 1,
5612				      /*field*/ 1,
5613				      /*bit_valid*/ 1,
5614				      /*bit*/ 4);
5615		ctl_done((union ctl_io *)ctsio);
5616		return (CTL_RETVAL_COMPLETE);
5617	}
5618	if (cdb->buffer_id != 0) {
5619		ctl_set_invalid_field(ctsio,
5620				      /*sks_valid*/ 1,
5621				      /*command*/ 1,
5622				      /*field*/ 2,
5623				      /*bit_valid*/ 0,
5624				      /*bit*/ 0);
5625		ctl_done((union ctl_io *)ctsio);
5626		return (CTL_RETVAL_COMPLETE);
5627	}
5628
5629	len = scsi_3btoul(cdb->length);
5630	buffer_offset = scsi_3btoul(cdb->offset);
5631
5632	if (len > sizeof(lun->write_buffer)) {
5633		ctl_set_invalid_field(ctsio,
5634				      /*sks_valid*/ 1,
5635				      /*command*/ 1,
5636				      /*field*/ 6,
5637				      /*bit_valid*/ 0,
5638				      /*bit*/ 0);
5639		ctl_done((union ctl_io *)ctsio);
5640		return (CTL_RETVAL_COMPLETE);
5641	}
5642
5643	if (buffer_offset != 0) {
5644		ctl_set_invalid_field(ctsio,
5645				      /*sks_valid*/ 1,
5646				      /*command*/ 1,
5647				      /*field*/ 3,
5648				      /*bit_valid*/ 0,
5649				      /*bit*/ 0);
5650		ctl_done((union ctl_io *)ctsio);
5651		return (CTL_RETVAL_COMPLETE);
5652	}
5653
5654	/*
5655	 * If we've got a kernel request that hasn't been malloced yet,
5656	 * malloc it and tell the caller the data buffer is here.
5657	 */
5658	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
5659		ctsio->kern_data_ptr = lun->write_buffer;
5660		ctsio->kern_data_len = len;
5661		ctsio->kern_total_len = len;
5662		ctsio->kern_data_resid = 0;
5663		ctsio->kern_rel_offset = 0;
5664		ctsio->kern_sg_entries = 0;
5665		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
5666		ctsio->be_move_done = ctl_config_move_done;
5667		ctl_datamove((union ctl_io *)ctsio);
5668
5669		return (CTL_RETVAL_COMPLETE);
5670	}
5671
5672	ctl_done((union ctl_io *)ctsio);
5673
5674	return (CTL_RETVAL_COMPLETE);
5675}
5676
5677/*
5678 * Note that this function currently doesn't actually do anything inside
5679 * CTL to enforce things if the DQue bit is turned on.
5680 *
5681 * Also note that this function can't be used in the default case, because
5682 * the DQue bit isn't set in the changeable mask for the control mode page
5683 * anyway.  This is just here as an example for how to implement a page
5684 * handler, and a placeholder in case we want to allow the user to turn
5685 * tagged queueing on and off.
5686 *
5687 * The D_SENSE bit handling is functional, however, and will turn
5688 * descriptor sense on and off for a given LUN.
5689 */
5690int
5691ctl_control_page_handler(struct ctl_scsiio *ctsio,
5692			 struct ctl_page_index *page_index, uint8_t *page_ptr)
5693{
5694	struct scsi_control_page *current_cp, *saved_cp, *user_cp;
5695	struct ctl_lun *lun;
5696	struct ctl_softc *softc;
5697	int set_ua;
5698	uint32_t initidx;
5699
5700	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5701	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
5702	set_ua = 0;
5703
5704	user_cp = (struct scsi_control_page *)page_ptr;
5705	current_cp = (struct scsi_control_page *)
5706		(page_index->page_data + (page_index->page_len *
5707		CTL_PAGE_CURRENT));
5708	saved_cp = (struct scsi_control_page *)
5709		(page_index->page_data + (page_index->page_len *
5710		CTL_PAGE_SAVED));
5711
5712	softc = control_softc;
5713
5714	mtx_lock(&softc->ctl_lock);
5715	if (((current_cp->rlec & SCP_DSENSE) == 0)
5716	 && ((user_cp->rlec & SCP_DSENSE) != 0)) {
5717		/*
5718		 * Descriptor sense is currently turned off and the user
5719		 * wants to turn it on.
5720		 */
5721		current_cp->rlec |= SCP_DSENSE;
5722		saved_cp->rlec |= SCP_DSENSE;
5723		lun->flags |= CTL_LUN_SENSE_DESC;
5724		set_ua = 1;
5725	} else if (((current_cp->rlec & SCP_DSENSE) != 0)
5726		&& ((user_cp->rlec & SCP_DSENSE) == 0)) {
5727		/*
5728		 * Descriptor sense is currently turned on, and the user
5729		 * wants to turn it off.
5730		 */
5731		current_cp->rlec &= ~SCP_DSENSE;
5732		saved_cp->rlec &= ~SCP_DSENSE;
5733		lun->flags &= ~CTL_LUN_SENSE_DESC;
5734		set_ua = 1;
5735	}
5736	if (current_cp->queue_flags & SCP_QUEUE_DQUE) {
5737		if (user_cp->queue_flags & SCP_QUEUE_DQUE) {
5738#ifdef NEEDTOPORT
5739			csevent_log(CSC_CTL | CSC_SHELF_SW |
5740				    CTL_UNTAG_TO_UNTAG,
5741				    csevent_LogType_Trace,
5742				    csevent_Severity_Information,
5743				    csevent_AlertLevel_Green,
5744				    csevent_FRU_Firmware,
5745				    csevent_FRU_Unknown,
5746				    "Received untagged to untagged transition");
5747#endif /* NEEDTOPORT */
5748		} else {
5749#ifdef NEEDTOPORT
5750			csevent_log(CSC_CTL | CSC_SHELF_SW |
5751				    CTL_UNTAG_TO_TAG,
5752				    csevent_LogType_ConfigChange,
5753				    csevent_Severity_Information,
5754				    csevent_AlertLevel_Green,
5755				    csevent_FRU_Firmware,
5756				    csevent_FRU_Unknown,
5757				    "Received untagged to tagged "
5758				    "queueing transition");
5759#endif /* NEEDTOPORT */
5760
5761			current_cp->queue_flags &= ~SCP_QUEUE_DQUE;
5762			saved_cp->queue_flags &= ~SCP_QUEUE_DQUE;
5763			set_ua = 1;
5764		}
5765	} else {
5766		if (user_cp->queue_flags & SCP_QUEUE_DQUE) {
5767#ifdef NEEDTOPORT
5768			csevent_log(CSC_CTL | CSC_SHELF_SW |
5769				    CTL_TAG_TO_UNTAG,
5770				    csevent_LogType_ConfigChange,
5771				    csevent_Severity_Warning,
5772				    csevent_AlertLevel_Yellow,
5773				    csevent_FRU_Firmware,
5774				    csevent_FRU_Unknown,
5775				    "Received tagged queueing to untagged "
5776				    "transition");
5777#endif /* NEEDTOPORT */
5778
5779			current_cp->queue_flags |= SCP_QUEUE_DQUE;
5780			saved_cp->queue_flags |= SCP_QUEUE_DQUE;
5781			set_ua = 1;
5782		} else {
5783#ifdef NEEDTOPORT
5784			csevent_log(CSC_CTL | CSC_SHELF_SW |
5785				    CTL_TAG_TO_TAG,
5786				    csevent_LogType_Trace,
5787				    csevent_Severity_Information,
5788				    csevent_AlertLevel_Green,
5789				    csevent_FRU_Firmware,
5790				    csevent_FRU_Unknown,
5791				    "Received tagged queueing to tagged "
5792				    "queueing transition");
5793#endif /* NEEDTOPORT */
5794		}
5795	}
5796	if (set_ua != 0) {
5797		int i;
5798		/*
5799		 * Let other initiators know that the mode
5800		 * parameters for this LUN have changed.
5801		 */
5802		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
5803			if (i == initidx)
5804				continue;
5805
5806			lun->pending_sense[i].ua_pending |=
5807				CTL_UA_MODE_CHANGE;
5808		}
5809	}
5810	mtx_unlock(&softc->ctl_lock);
5811
5812	return (0);
5813}
5814
5815int
5816ctl_power_sp_handler(struct ctl_scsiio *ctsio,
5817		     struct ctl_page_index *page_index, uint8_t *page_ptr)
5818{
5819	return (0);
5820}
5821
5822int
5823ctl_power_sp_sense_handler(struct ctl_scsiio *ctsio,
5824			   struct ctl_page_index *page_index, int pc)
5825{
5826	struct copan_power_subpage *page;
5827
5828	page = (struct copan_power_subpage *)page_index->page_data +
5829		(page_index->page_len * pc);
5830
5831	switch (pc) {
5832	case SMS_PAGE_CTRL_CHANGEABLE >> 6:
5833		/*
5834		 * We don't update the changable bits for this page.
5835		 */
5836		break;
5837	case SMS_PAGE_CTRL_CURRENT >> 6:
5838	case SMS_PAGE_CTRL_DEFAULT >> 6:
5839	case SMS_PAGE_CTRL_SAVED >> 6:
5840#ifdef NEEDTOPORT
5841		ctl_update_power_subpage(page);
5842#endif
5843		break;
5844	default:
5845#ifdef NEEDTOPORT
5846		EPRINT(0, "Invalid PC %d!!", pc);
5847#endif
5848		break;
5849	}
5850	return (0);
5851}
5852
5853
5854int
5855ctl_aps_sp_handler(struct ctl_scsiio *ctsio,
5856		   struct ctl_page_index *page_index, uint8_t *page_ptr)
5857{
5858	struct copan_aps_subpage *user_sp;
5859	struct copan_aps_subpage *current_sp;
5860	union ctl_modepage_info *modepage_info;
5861	struct ctl_softc *softc;
5862	struct ctl_lun *lun;
5863	int retval;
5864
5865	retval = CTL_RETVAL_COMPLETE;
5866	current_sp = (struct copan_aps_subpage *)(page_index->page_data +
5867		     (page_index->page_len * CTL_PAGE_CURRENT));
5868	softc = control_softc;
5869	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5870
5871	user_sp = (struct copan_aps_subpage *)page_ptr;
5872
5873	modepage_info = (union ctl_modepage_info *)
5874		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
5875
5876	modepage_info->header.page_code = page_index->page_code & SMPH_PC_MASK;
5877	modepage_info->header.subpage = page_index->subpage;
5878	modepage_info->aps.lock_active = user_sp->lock_active;
5879
5880	mtx_lock(&softc->ctl_lock);
5881
5882	/*
5883	 * If there is a request to lock the LUN and another LUN is locked
5884	 * this is an error. If the requested LUN is already locked ignore
5885	 * the request. If no LUN is locked attempt to lock it.
5886	 * if there is a request to unlock the LUN and the LUN is currently
5887	 * locked attempt to unlock it. Otherwise ignore the request. i.e.
5888	 * if another LUN is locked or no LUN is locked.
5889	 */
5890	if (user_sp->lock_active & APS_LOCK_ACTIVE) {
5891		if (softc->aps_locked_lun == lun->lun) {
5892			/*
5893			 * This LUN is already locked, so we're done.
5894			 */
5895			retval = CTL_RETVAL_COMPLETE;
5896		} else if (softc->aps_locked_lun == 0) {
5897			/*
5898			 * No one has the lock, pass the request to the
5899			 * backend.
5900			 */
5901			retval = lun->backend->config_write(
5902				(union ctl_io *)ctsio);
5903		} else {
5904			/*
5905			 * Someone else has the lock, throw out the request.
5906			 */
5907			ctl_set_already_locked(ctsio);
5908			free(ctsio->kern_data_ptr, M_CTL);
5909			ctl_done((union ctl_io *)ctsio);
5910
5911			/*
5912			 * Set the return value so that ctl_do_mode_select()
5913			 * won't try to complete the command.  We already
5914			 * completed it here.
5915			 */
5916			retval = CTL_RETVAL_ERROR;
5917		}
5918	} else if (softc->aps_locked_lun == lun->lun) {
5919		/*
5920		 * This LUN is locked, so pass the unlock request to the
5921		 * backend.
5922		 */
5923		retval = lun->backend->config_write((union ctl_io *)ctsio);
5924	}
5925	mtx_unlock(&softc->ctl_lock);
5926
5927	return (retval);
5928}
5929
5930int
5931ctl_debugconf_sp_select_handler(struct ctl_scsiio *ctsio,
5932				struct ctl_page_index *page_index,
5933				uint8_t *page_ptr)
5934{
5935	uint8_t *c;
5936	int i;
5937
5938	c = ((struct copan_debugconf_subpage *)page_ptr)->ctl_time_io_secs;
5939	ctl_time_io_secs =
5940		(c[0] << 8) |
5941		(c[1] << 0) |
5942		0;
5943	CTL_DEBUG_PRINT(("set ctl_time_io_secs to %d\n", ctl_time_io_secs));
5944	printf("set ctl_time_io_secs to %d\n", ctl_time_io_secs);
5945	printf("page data:");
5946	for (i=0; i<8; i++)
5947		printf(" %.2x",page_ptr[i]);
5948	printf("\n");
5949	return (0);
5950}
5951
5952int
5953ctl_debugconf_sp_sense_handler(struct ctl_scsiio *ctsio,
5954			       struct ctl_page_index *page_index,
5955			       int pc)
5956{
5957	struct copan_debugconf_subpage *page;
5958
5959	page = (struct copan_debugconf_subpage *)page_index->page_data +
5960		(page_index->page_len * pc);
5961
5962	switch (pc) {
5963	case SMS_PAGE_CTRL_CHANGEABLE >> 6:
5964	case SMS_PAGE_CTRL_DEFAULT >> 6:
5965	case SMS_PAGE_CTRL_SAVED >> 6:
5966		/*
5967		 * We don't update the changable or default bits for this page.
5968		 */
5969		break;
5970	case SMS_PAGE_CTRL_CURRENT >> 6:
5971		page->ctl_time_io_secs[0] = ctl_time_io_secs >> 8;
5972		page->ctl_time_io_secs[1] = ctl_time_io_secs >> 0;
5973		break;
5974	default:
5975#ifdef NEEDTOPORT
5976		EPRINT(0, "Invalid PC %d!!", pc);
5977#endif /* NEEDTOPORT */
5978		break;
5979	}
5980	return (0);
5981}
5982
5983
5984static int
5985ctl_do_mode_select(union ctl_io *io)
5986{
5987	struct scsi_mode_page_header *page_header;
5988	struct ctl_page_index *page_index;
5989	struct ctl_scsiio *ctsio;
5990	int control_dev, page_len;
5991	int page_len_offset, page_len_size;
5992	union ctl_modepage_info *modepage_info;
5993	struct ctl_lun *lun;
5994	int *len_left, *len_used;
5995	int retval, i;
5996
5997	ctsio = &io->scsiio;
5998	page_index = NULL;
5999	page_len = 0;
6000	retval = CTL_RETVAL_COMPLETE;
6001
6002	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6003
6004	if (lun->be_lun->lun_type != T_DIRECT)
6005		control_dev = 1;
6006	else
6007		control_dev = 0;
6008
6009	modepage_info = (union ctl_modepage_info *)
6010		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
6011	len_left = &modepage_info->header.len_left;
6012	len_used = &modepage_info->header.len_used;
6013
6014do_next_page:
6015
6016	page_header = (struct scsi_mode_page_header *)
6017		(ctsio->kern_data_ptr + *len_used);
6018
6019	if (*len_left == 0) {
6020		free(ctsio->kern_data_ptr, M_CTL);
6021		ctl_set_success(ctsio);
6022		ctl_done((union ctl_io *)ctsio);
6023		return (CTL_RETVAL_COMPLETE);
6024	} else if (*len_left < sizeof(struct scsi_mode_page_header)) {
6025
6026		free(ctsio->kern_data_ptr, M_CTL);
6027		ctl_set_param_len_error(ctsio);
6028		ctl_done((union ctl_io *)ctsio);
6029		return (CTL_RETVAL_COMPLETE);
6030
6031	} else if ((page_header->page_code & SMPH_SPF)
6032		&& (*len_left < sizeof(struct scsi_mode_page_header_sp))) {
6033
6034		free(ctsio->kern_data_ptr, M_CTL);
6035		ctl_set_param_len_error(ctsio);
6036		ctl_done((union ctl_io *)ctsio);
6037		return (CTL_RETVAL_COMPLETE);
6038	}
6039
6040
6041	/*
6042	 * XXX KDM should we do something with the block descriptor?
6043	 */
6044	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6045
6046		if ((control_dev != 0)
6047		 && (lun->mode_pages.index[i].page_flags &
6048		     CTL_PAGE_FLAG_DISK_ONLY))
6049			continue;
6050
6051		if ((lun->mode_pages.index[i].page_code & SMPH_PC_MASK) !=
6052		    (page_header->page_code & SMPH_PC_MASK))
6053			continue;
6054
6055		/*
6056		 * If neither page has a subpage code, then we've got a
6057		 * match.
6058		 */
6059		if (((lun->mode_pages.index[i].page_code & SMPH_SPF) == 0)
6060		 && ((page_header->page_code & SMPH_SPF) == 0)) {
6061			page_index = &lun->mode_pages.index[i];
6062			page_len = page_header->page_length;
6063			break;
6064		}
6065
6066		/*
6067		 * If both pages have subpages, then the subpage numbers
6068		 * have to match.
6069		 */
6070		if ((lun->mode_pages.index[i].page_code & SMPH_SPF)
6071		  && (page_header->page_code & SMPH_SPF)) {
6072			struct scsi_mode_page_header_sp *sph;
6073
6074			sph = (struct scsi_mode_page_header_sp *)page_header;
6075
6076			if (lun->mode_pages.index[i].subpage ==
6077			    sph->subpage) {
6078				page_index = &lun->mode_pages.index[i];
6079				page_len = scsi_2btoul(sph->page_length);
6080				break;
6081			}
6082		}
6083	}
6084
6085	/*
6086	 * If we couldn't find the page, or if we don't have a mode select
6087	 * handler for it, send back an error to the user.
6088	 */
6089	if ((page_index == NULL)
6090	 || (page_index->select_handler == NULL)) {
6091		ctl_set_invalid_field(ctsio,
6092				      /*sks_valid*/ 1,
6093				      /*command*/ 0,
6094				      /*field*/ *len_used,
6095				      /*bit_valid*/ 0,
6096				      /*bit*/ 0);
6097		free(ctsio->kern_data_ptr, M_CTL);
6098		ctl_done((union ctl_io *)ctsio);
6099		return (CTL_RETVAL_COMPLETE);
6100	}
6101
6102	if (page_index->page_code & SMPH_SPF) {
6103		page_len_offset = 2;
6104		page_len_size = 2;
6105	} else {
6106		page_len_size = 1;
6107		page_len_offset = 1;
6108	}
6109
6110	/*
6111	 * If the length the initiator gives us isn't the one we specify in
6112	 * the mode page header, or if they didn't specify enough data in
6113	 * the CDB to avoid truncating this page, kick out the request.
6114	 */
6115	if ((page_len != (page_index->page_len - page_len_offset -
6116			  page_len_size))
6117	 || (*len_left < page_index->page_len)) {
6118
6119
6120		ctl_set_invalid_field(ctsio,
6121				      /*sks_valid*/ 1,
6122				      /*command*/ 0,
6123				      /*field*/ *len_used + page_len_offset,
6124				      /*bit_valid*/ 0,
6125				      /*bit*/ 0);
6126		free(ctsio->kern_data_ptr, M_CTL);
6127		ctl_done((union ctl_io *)ctsio);
6128		return (CTL_RETVAL_COMPLETE);
6129	}
6130
6131	/*
6132	 * Run through the mode page, checking to make sure that the bits
6133	 * the user changed are actually legal for him to change.
6134	 */
6135	for (i = 0; i < page_index->page_len; i++) {
6136		uint8_t *user_byte, *change_mask, *current_byte;
6137		int bad_bit;
6138		int j;
6139
6140		user_byte = (uint8_t *)page_header + i;
6141		change_mask = page_index->page_data +
6142			      (page_index->page_len * CTL_PAGE_CHANGEABLE) + i;
6143		current_byte = page_index->page_data +
6144			       (page_index->page_len * CTL_PAGE_CURRENT) + i;
6145
6146		/*
6147		 * Check to see whether the user set any bits in this byte
6148		 * that he is not allowed to set.
6149		 */
6150		if ((*user_byte & ~(*change_mask)) ==
6151		    (*current_byte & ~(*change_mask)))
6152			continue;
6153
6154		/*
6155		 * Go through bit by bit to determine which one is illegal.
6156		 */
6157		bad_bit = 0;
6158		for (j = 7; j >= 0; j--) {
6159			if ((((1 << i) & ~(*change_mask)) & *user_byte) !=
6160			    (((1 << i) & ~(*change_mask)) & *current_byte)) {
6161				bad_bit = i;
6162				break;
6163			}
6164		}
6165		ctl_set_invalid_field(ctsio,
6166				      /*sks_valid*/ 1,
6167				      /*command*/ 0,
6168				      /*field*/ *len_used + i,
6169				      /*bit_valid*/ 1,
6170				      /*bit*/ bad_bit);
6171		free(ctsio->kern_data_ptr, M_CTL);
6172		ctl_done((union ctl_io *)ctsio);
6173		return (CTL_RETVAL_COMPLETE);
6174	}
6175
6176	/*
6177	 * Decrement these before we call the page handler, since we may
6178	 * end up getting called back one way or another before the handler
6179	 * returns to this context.
6180	 */
6181	*len_left -= page_index->page_len;
6182	*len_used += page_index->page_len;
6183
6184	retval = page_index->select_handler(ctsio, page_index,
6185					    (uint8_t *)page_header);
6186
6187	/*
6188	 * If the page handler returns CTL_RETVAL_QUEUED, then we need to
6189	 * wait until this queued command completes to finish processing
6190	 * the mode page.  If it returns anything other than
6191	 * CTL_RETVAL_COMPLETE (e.g. CTL_RETVAL_ERROR), then it should have
6192	 * already set the sense information, freed the data pointer, and
6193	 * completed the io for us.
6194	 */
6195	if (retval != CTL_RETVAL_COMPLETE)
6196		goto bailout_no_done;
6197
6198	/*
6199	 * If the initiator sent us more than one page, parse the next one.
6200	 */
6201	if (*len_left > 0)
6202		goto do_next_page;
6203
6204	ctl_set_success(ctsio);
6205	free(ctsio->kern_data_ptr, M_CTL);
6206	ctl_done((union ctl_io *)ctsio);
6207
6208bailout_no_done:
6209
6210	return (CTL_RETVAL_COMPLETE);
6211
6212}
6213
6214int
6215ctl_mode_select(struct ctl_scsiio *ctsio)
6216{
6217	int param_len, pf, sp;
6218	int header_size, bd_len;
6219	int len_left, len_used;
6220	struct ctl_page_index *page_index;
6221	struct ctl_lun *lun;
6222	int control_dev, page_len;
6223	union ctl_modepage_info *modepage_info;
6224	int retval;
6225
6226	pf = 0;
6227	sp = 0;
6228	page_len = 0;
6229	len_used = 0;
6230	len_left = 0;
6231	retval = 0;
6232	bd_len = 0;
6233	page_index = NULL;
6234
6235	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6236
6237	if (lun->be_lun->lun_type != T_DIRECT)
6238		control_dev = 1;
6239	else
6240		control_dev = 0;
6241
6242	switch (ctsio->cdb[0]) {
6243	case MODE_SELECT_6: {
6244		struct scsi_mode_select_6 *cdb;
6245
6246		cdb = (struct scsi_mode_select_6 *)ctsio->cdb;
6247
6248		pf = (cdb->byte2 & SMS_PF) ? 1 : 0;
6249		sp = (cdb->byte2 & SMS_SP) ? 1 : 0;
6250
6251		param_len = cdb->length;
6252		header_size = sizeof(struct scsi_mode_header_6);
6253		break;
6254	}
6255	case MODE_SELECT_10: {
6256		struct scsi_mode_select_10 *cdb;
6257
6258		cdb = (struct scsi_mode_select_10 *)ctsio->cdb;
6259
6260		pf = (cdb->byte2 & SMS_PF) ? 1 : 0;
6261		sp = (cdb->byte2 & SMS_SP) ? 1 : 0;
6262
6263		param_len = scsi_2btoul(cdb->length);
6264		header_size = sizeof(struct scsi_mode_header_10);
6265		break;
6266	}
6267	default:
6268		ctl_set_invalid_opcode(ctsio);
6269		ctl_done((union ctl_io *)ctsio);
6270		return (CTL_RETVAL_COMPLETE);
6271		break; /* NOTREACHED */
6272	}
6273
6274	/*
6275	 * From SPC-3:
6276	 * "A parameter list length of zero indicates that the Data-Out Buffer
6277	 * shall be empty. This condition shall not be considered as an error."
6278	 */
6279	if (param_len == 0) {
6280		ctl_set_success(ctsio);
6281		ctl_done((union ctl_io *)ctsio);
6282		return (CTL_RETVAL_COMPLETE);
6283	}
6284
6285	/*
6286	 * Since we'll hit this the first time through, prior to
6287	 * allocation, we don't need to free a data buffer here.
6288	 */
6289	if (param_len < header_size) {
6290		ctl_set_param_len_error(ctsio);
6291		ctl_done((union ctl_io *)ctsio);
6292		return (CTL_RETVAL_COMPLETE);
6293	}
6294
6295	/*
6296	 * Allocate the data buffer and grab the user's data.  In theory,
6297	 * we shouldn't have to sanity check the parameter list length here
6298	 * because the maximum size is 64K.  We should be able to malloc
6299	 * that much without too many problems.
6300	 */
6301	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
6302		ctsio->kern_data_ptr = malloc(param_len, M_CTL, M_WAITOK);
6303		if (ctsio->kern_data_ptr == NULL) {
6304			ctl_set_busy(ctsio);
6305			ctl_done((union ctl_io *)ctsio);
6306			return (CTL_RETVAL_COMPLETE);
6307		}
6308		ctsio->kern_data_len = param_len;
6309		ctsio->kern_total_len = param_len;
6310		ctsio->kern_data_resid = 0;
6311		ctsio->kern_rel_offset = 0;
6312		ctsio->kern_sg_entries = 0;
6313		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
6314		ctsio->be_move_done = ctl_config_move_done;
6315		ctl_datamove((union ctl_io *)ctsio);
6316
6317		return (CTL_RETVAL_COMPLETE);
6318	}
6319
6320	switch (ctsio->cdb[0]) {
6321	case MODE_SELECT_6: {
6322		struct scsi_mode_header_6 *mh6;
6323
6324		mh6 = (struct scsi_mode_header_6 *)ctsio->kern_data_ptr;
6325		bd_len = mh6->blk_desc_len;
6326		break;
6327	}
6328	case MODE_SELECT_10: {
6329		struct scsi_mode_header_10 *mh10;
6330
6331		mh10 = (struct scsi_mode_header_10 *)ctsio->kern_data_ptr;
6332		bd_len = scsi_2btoul(mh10->blk_desc_len);
6333		break;
6334	}
6335	default:
6336		panic("Invalid CDB type %#x", ctsio->cdb[0]);
6337		break;
6338	}
6339
6340	if (param_len < (header_size + bd_len)) {
6341		free(ctsio->kern_data_ptr, M_CTL);
6342		ctl_set_param_len_error(ctsio);
6343		ctl_done((union ctl_io *)ctsio);
6344		return (CTL_RETVAL_COMPLETE);
6345	}
6346
6347	/*
6348	 * Set the IO_CONT flag, so that if this I/O gets passed to
6349	 * ctl_config_write_done(), it'll get passed back to
6350	 * ctl_do_mode_select() for further processing, or completion if
6351	 * we're all done.
6352	 */
6353	ctsio->io_hdr.flags |= CTL_FLAG_IO_CONT;
6354	ctsio->io_cont = ctl_do_mode_select;
6355
6356	modepage_info = (union ctl_modepage_info *)
6357		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
6358
6359	memset(modepage_info, 0, sizeof(*modepage_info));
6360
6361	len_left = param_len - header_size - bd_len;
6362	len_used = header_size + bd_len;
6363
6364	modepage_info->header.len_left = len_left;
6365	modepage_info->header.len_used = len_used;
6366
6367	return (ctl_do_mode_select((union ctl_io *)ctsio));
6368}
6369
6370int
6371ctl_mode_sense(struct ctl_scsiio *ctsio)
6372{
6373	struct ctl_lun *lun;
6374	int pc, page_code, dbd, llba, subpage;
6375	int alloc_len, page_len, header_len, total_len;
6376	struct scsi_mode_block_descr *block_desc;
6377	struct ctl_page_index *page_index;
6378	int control_dev;
6379
6380	dbd = 0;
6381	llba = 0;
6382	block_desc = NULL;
6383	page_index = NULL;
6384
6385	CTL_DEBUG_PRINT(("ctl_mode_sense\n"));
6386
6387	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6388
6389	if (lun->be_lun->lun_type != T_DIRECT)
6390		control_dev = 1;
6391	else
6392		control_dev = 0;
6393
6394	switch (ctsio->cdb[0]) {
6395	case MODE_SENSE_6: {
6396		struct scsi_mode_sense_6 *cdb;
6397
6398		cdb = (struct scsi_mode_sense_6 *)ctsio->cdb;
6399
6400		header_len = sizeof(struct scsi_mode_hdr_6);
6401		if (cdb->byte2 & SMS_DBD)
6402			dbd = 1;
6403		else
6404			header_len += sizeof(struct scsi_mode_block_descr);
6405
6406		pc = (cdb->page & SMS_PAGE_CTRL_MASK) >> 6;
6407		page_code = cdb->page & SMS_PAGE_CODE;
6408		subpage = cdb->subpage;
6409		alloc_len = cdb->length;
6410		break;
6411	}
6412	case MODE_SENSE_10: {
6413		struct scsi_mode_sense_10 *cdb;
6414
6415		cdb = (struct scsi_mode_sense_10 *)ctsio->cdb;
6416
6417		header_len = sizeof(struct scsi_mode_hdr_10);
6418
6419		if (cdb->byte2 & SMS_DBD)
6420			dbd = 1;
6421		else
6422			header_len += sizeof(struct scsi_mode_block_descr);
6423		if (cdb->byte2 & SMS10_LLBAA)
6424			llba = 1;
6425		pc = (cdb->page & SMS_PAGE_CTRL_MASK) >> 6;
6426		page_code = cdb->page & SMS_PAGE_CODE;
6427		subpage = cdb->subpage;
6428		alloc_len = scsi_2btoul(cdb->length);
6429		break;
6430	}
6431	default:
6432		ctl_set_invalid_opcode(ctsio);
6433		ctl_done((union ctl_io *)ctsio);
6434		return (CTL_RETVAL_COMPLETE);
6435		break; /* NOTREACHED */
6436	}
6437
6438	/*
6439	 * We have to make a first pass through to calculate the size of
6440	 * the pages that match the user's query.  Then we allocate enough
6441	 * memory to hold it, and actually copy the data into the buffer.
6442	 */
6443	switch (page_code) {
6444	case SMS_ALL_PAGES_PAGE: {
6445		int i;
6446
6447		page_len = 0;
6448
6449		/*
6450		 * At the moment, values other than 0 and 0xff here are
6451		 * reserved according to SPC-3.
6452		 */
6453		if ((subpage != SMS_SUBPAGE_PAGE_0)
6454		 && (subpage != SMS_SUBPAGE_ALL)) {
6455			ctl_set_invalid_field(ctsio,
6456					      /*sks_valid*/ 1,
6457					      /*command*/ 1,
6458					      /*field*/ 3,
6459					      /*bit_valid*/ 0,
6460					      /*bit*/ 0);
6461			ctl_done((union ctl_io *)ctsio);
6462			return (CTL_RETVAL_COMPLETE);
6463		}
6464
6465		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6466			if ((control_dev != 0)
6467			 && (lun->mode_pages.index[i].page_flags &
6468			     CTL_PAGE_FLAG_DISK_ONLY))
6469				continue;
6470
6471			/*
6472			 * We don't use this subpage if the user didn't
6473			 * request all subpages.
6474			 */
6475			if ((lun->mode_pages.index[i].subpage != 0)
6476			 && (subpage == SMS_SUBPAGE_PAGE_0))
6477				continue;
6478
6479#if 0
6480			printf("found page %#x len %d\n",
6481			       lun->mode_pages.index[i].page_code &
6482			       SMPH_PC_MASK,
6483			       lun->mode_pages.index[i].page_len);
6484#endif
6485			page_len += lun->mode_pages.index[i].page_len;
6486		}
6487		break;
6488	}
6489	default: {
6490		int i;
6491
6492		page_len = 0;
6493
6494		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6495			/* Look for the right page code */
6496			if ((lun->mode_pages.index[i].page_code &
6497			     SMPH_PC_MASK) != page_code)
6498				continue;
6499
6500			/* Look for the right subpage or the subpage wildcard*/
6501			if ((lun->mode_pages.index[i].subpage != subpage)
6502			 && (subpage != SMS_SUBPAGE_ALL))
6503				continue;
6504
6505			/* Make sure the page is supported for this dev type */
6506			if ((control_dev != 0)
6507			 && (lun->mode_pages.index[i].page_flags &
6508			     CTL_PAGE_FLAG_DISK_ONLY))
6509				continue;
6510
6511#if 0
6512			printf("found page %#x len %d\n",
6513			       lun->mode_pages.index[i].page_code &
6514			       SMPH_PC_MASK,
6515			       lun->mode_pages.index[i].page_len);
6516#endif
6517
6518			page_len += lun->mode_pages.index[i].page_len;
6519		}
6520
6521		if (page_len == 0) {
6522			ctl_set_invalid_field(ctsio,
6523					      /*sks_valid*/ 1,
6524					      /*command*/ 1,
6525					      /*field*/ 2,
6526					      /*bit_valid*/ 1,
6527					      /*bit*/ 5);
6528			ctl_done((union ctl_io *)ctsio);
6529			return (CTL_RETVAL_COMPLETE);
6530		}
6531		break;
6532	}
6533	}
6534
6535	total_len = header_len + page_len;
6536#if 0
6537	printf("header_len = %d, page_len = %d, total_len = %d\n",
6538	       header_len, page_len, total_len);
6539#endif
6540
6541	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK);
6542	if (ctsio->kern_data_ptr == NULL) {
6543		ctsio->io_hdr.status = CTL_SCSI_ERROR;
6544		ctsio->scsi_status = SCSI_STATUS_BUSY;
6545		ctl_done((union ctl_io *)ctsio);
6546		return (CTL_RETVAL_COMPLETE);
6547	}
6548	ctsio->kern_sg_entries = 0;
6549	ctsio->kern_data_resid = 0;
6550	ctsio->kern_rel_offset = 0;
6551	if (total_len < alloc_len) {
6552		ctsio->residual = alloc_len - total_len;
6553		ctsio->kern_data_len = total_len;
6554		ctsio->kern_total_len = total_len;
6555	} else {
6556		ctsio->residual = 0;
6557		ctsio->kern_data_len = alloc_len;
6558		ctsio->kern_total_len = alloc_len;
6559	}
6560	memset(ctsio->kern_data_ptr, 0, total_len);
6561
6562	switch (ctsio->cdb[0]) {
6563	case MODE_SENSE_6: {
6564		struct scsi_mode_hdr_6 *header;
6565
6566		header = (struct scsi_mode_hdr_6 *)ctsio->kern_data_ptr;
6567
6568		header->datalen = ctl_min(total_len - 1, 254);
6569
6570		if (dbd)
6571			header->block_descr_len = 0;
6572		else
6573			header->block_descr_len =
6574				sizeof(struct scsi_mode_block_descr);
6575		block_desc = (struct scsi_mode_block_descr *)&header[1];
6576		break;
6577	}
6578	case MODE_SENSE_10: {
6579		struct scsi_mode_hdr_10 *header;
6580		int datalen;
6581
6582		header = (struct scsi_mode_hdr_10 *)ctsio->kern_data_ptr;
6583
6584		datalen = ctl_min(total_len - 2, 65533);
6585		scsi_ulto2b(datalen, header->datalen);
6586		if (dbd)
6587			scsi_ulto2b(0, header->block_descr_len);
6588		else
6589			scsi_ulto2b(sizeof(struct scsi_mode_block_descr),
6590				    header->block_descr_len);
6591		block_desc = (struct scsi_mode_block_descr *)&header[1];
6592		break;
6593	}
6594	default:
6595		panic("invalid CDB type %#x", ctsio->cdb[0]);
6596		break; /* NOTREACHED */
6597	}
6598
6599	/*
6600	 * If we've got a disk, use its blocksize in the block
6601	 * descriptor.  Otherwise, just set it to 0.
6602	 */
6603	if (dbd == 0) {
6604		if (control_dev != 0)
6605			scsi_ulto3b(lun->be_lun->blocksize,
6606				    block_desc->block_len);
6607		else
6608			scsi_ulto3b(0, block_desc->block_len);
6609	}
6610
6611	switch (page_code) {
6612	case SMS_ALL_PAGES_PAGE: {
6613		int i, data_used;
6614
6615		data_used = header_len;
6616		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6617			struct ctl_page_index *page_index;
6618
6619			page_index = &lun->mode_pages.index[i];
6620
6621			if ((control_dev != 0)
6622			 && (page_index->page_flags &
6623			    CTL_PAGE_FLAG_DISK_ONLY))
6624				continue;
6625
6626			/*
6627			 * We don't use this subpage if the user didn't
6628			 * request all subpages.  We already checked (above)
6629			 * to make sure the user only specified a subpage
6630			 * of 0 or 0xff in the SMS_ALL_PAGES_PAGE case.
6631			 */
6632			if ((page_index->subpage != 0)
6633			 && (subpage == SMS_SUBPAGE_PAGE_0))
6634				continue;
6635
6636			/*
6637			 * Call the handler, if it exists, to update the
6638			 * page to the latest values.
6639			 */
6640			if (page_index->sense_handler != NULL)
6641				page_index->sense_handler(ctsio, page_index,pc);
6642
6643			memcpy(ctsio->kern_data_ptr + data_used,
6644			       page_index->page_data +
6645			       (page_index->page_len * pc),
6646			       page_index->page_len);
6647			data_used += page_index->page_len;
6648		}
6649		break;
6650	}
6651	default: {
6652		int i, data_used;
6653
6654		data_used = header_len;
6655
6656		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6657			struct ctl_page_index *page_index;
6658
6659			page_index = &lun->mode_pages.index[i];
6660
6661			/* Look for the right page code */
6662			if ((page_index->page_code & SMPH_PC_MASK) != page_code)
6663				continue;
6664
6665			/* Look for the right subpage or the subpage wildcard*/
6666			if ((page_index->subpage != subpage)
6667			 && (subpage != SMS_SUBPAGE_ALL))
6668				continue;
6669
6670			/* Make sure the page is supported for this dev type */
6671			if ((control_dev != 0)
6672			 && (page_index->page_flags &
6673			     CTL_PAGE_FLAG_DISK_ONLY))
6674				continue;
6675
6676			/*
6677			 * Call the handler, if it exists, to update the
6678			 * page to the latest values.
6679			 */
6680			if (page_index->sense_handler != NULL)
6681				page_index->sense_handler(ctsio, page_index,pc);
6682
6683			memcpy(ctsio->kern_data_ptr + data_used,
6684			       page_index->page_data +
6685			       (page_index->page_len * pc),
6686			       page_index->page_len);
6687			data_used += page_index->page_len;
6688		}
6689		break;
6690	}
6691	}
6692
6693	ctsio->scsi_status = SCSI_STATUS_OK;
6694
6695	ctsio->be_move_done = ctl_config_move_done;
6696	ctl_datamove((union ctl_io *)ctsio);
6697
6698	return (CTL_RETVAL_COMPLETE);
6699}
6700
6701int
6702ctl_read_capacity(struct ctl_scsiio *ctsio)
6703{
6704	struct scsi_read_capacity *cdb;
6705	struct scsi_read_capacity_data *data;
6706	struct ctl_lun *lun;
6707	uint32_t lba;
6708
6709	CTL_DEBUG_PRINT(("ctl_read_capacity\n"));
6710
6711	cdb = (struct scsi_read_capacity *)ctsio->cdb;
6712
6713	lba = scsi_4btoul(cdb->addr);
6714	if (((cdb->pmi & SRC_PMI) == 0)
6715	 && (lba != 0)) {
6716		ctl_set_invalid_field(/*ctsio*/ ctsio,
6717				      /*sks_valid*/ 1,
6718				      /*command*/ 1,
6719				      /*field*/ 2,
6720				      /*bit_valid*/ 0,
6721				      /*bit*/ 0);
6722		ctl_done((union ctl_io *)ctsio);
6723		return (CTL_RETVAL_COMPLETE);
6724	}
6725
6726	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6727
6728	ctsio->kern_data_ptr = malloc(sizeof(*data), M_CTL, M_WAITOK);
6729	if (ctsio->kern_data_ptr == NULL) {
6730		ctsio->io_hdr.status = CTL_SCSI_ERROR;
6731		ctsio->scsi_status = SCSI_STATUS_BUSY;
6732		ctl_done((union ctl_io *)ctsio);
6733		return (CTL_RETVAL_COMPLETE);
6734	}
6735	data = (struct scsi_read_capacity_data *)ctsio->kern_data_ptr;
6736	ctsio->residual = 0;
6737	ctsio->kern_data_len = sizeof(*data);
6738	ctsio->kern_total_len = sizeof(*data);
6739	ctsio->kern_data_resid = 0;
6740	ctsio->kern_rel_offset = 0;
6741	ctsio->kern_sg_entries = 0;
6742
6743	memset(data, 0, sizeof(*data));
6744
6745	/*
6746	 * If the maximum LBA is greater than 0xfffffffe, the user must
6747	 * issue a SERVICE ACTION IN (16) command, with the read capacity
6748	 * serivce action set.
6749	 */
6750	if (lun->be_lun->maxlba > 0xfffffffe)
6751		scsi_ulto4b(0xffffffff, data->addr);
6752	else
6753		scsi_ulto4b(lun->be_lun->maxlba, data->addr);
6754
6755	/*
6756	 * XXX KDM this may not be 512 bytes...
6757	 */
6758	scsi_ulto4b(lun->be_lun->blocksize, data->length);
6759
6760	ctsio->scsi_status = SCSI_STATUS_OK;
6761
6762	ctsio->be_move_done = ctl_config_move_done;
6763	ctl_datamove((union ctl_io *)ctsio);
6764
6765	return (CTL_RETVAL_COMPLETE);
6766}
6767
6768static int
6769ctl_read_capacity_16(struct ctl_scsiio *ctsio)
6770{
6771	struct scsi_read_capacity_16 *cdb;
6772	struct scsi_read_capacity_data_long *data;
6773	struct ctl_lun *lun;
6774	uint64_t lba;
6775	uint32_t alloc_len;
6776
6777	CTL_DEBUG_PRINT(("ctl_read_capacity_16\n"));
6778
6779	cdb = (struct scsi_read_capacity_16 *)ctsio->cdb;
6780
6781	alloc_len = scsi_4btoul(cdb->alloc_len);
6782	lba = scsi_8btou64(cdb->addr);
6783
6784	if ((cdb->reladr & SRC16_PMI)
6785	 && (lba != 0)) {
6786		ctl_set_invalid_field(/*ctsio*/ ctsio,
6787				      /*sks_valid*/ 1,
6788				      /*command*/ 1,
6789				      /*field*/ 2,
6790				      /*bit_valid*/ 0,
6791				      /*bit*/ 0);
6792		ctl_done((union ctl_io *)ctsio);
6793		return (CTL_RETVAL_COMPLETE);
6794	}
6795
6796	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6797
6798	ctsio->kern_data_ptr = malloc(sizeof(*data), M_CTL, M_WAITOK);
6799	if (ctsio->kern_data_ptr == NULL) {
6800		ctsio->io_hdr.status = CTL_SCSI_ERROR;
6801		ctsio->scsi_status = SCSI_STATUS_BUSY;
6802		ctl_done((union ctl_io *)ctsio);
6803		return (CTL_RETVAL_COMPLETE);
6804	}
6805	data = (struct scsi_read_capacity_data_long *)ctsio->kern_data_ptr;
6806
6807	if (sizeof(*data) < alloc_len) {
6808		ctsio->residual = alloc_len - sizeof(*data);
6809		ctsio->kern_data_len = sizeof(*data);
6810		ctsio->kern_total_len = sizeof(*data);
6811	} else {
6812		ctsio->residual = 0;
6813		ctsio->kern_data_len = alloc_len;
6814		ctsio->kern_total_len = alloc_len;
6815	}
6816	ctsio->kern_data_resid = 0;
6817	ctsio->kern_rel_offset = 0;
6818	ctsio->kern_sg_entries = 0;
6819
6820	memset(data, 0, sizeof(*data));
6821
6822	scsi_u64to8b(lun->be_lun->maxlba, data->addr);
6823	/* XXX KDM this may not be 512 bytes... */
6824	scsi_ulto4b(lun->be_lun->blocksize, data->length);
6825
6826	ctsio->scsi_status = SCSI_STATUS_OK;
6827
6828	ctsio->be_move_done = ctl_config_move_done;
6829	ctl_datamove((union ctl_io *)ctsio);
6830
6831	return (CTL_RETVAL_COMPLETE);
6832}
6833
6834int
6835ctl_service_action_in(struct ctl_scsiio *ctsio)
6836{
6837	struct scsi_service_action_in *cdb;
6838	int retval;
6839
6840	CTL_DEBUG_PRINT(("ctl_service_action_in\n"));
6841
6842	cdb = (struct scsi_service_action_in *)ctsio->cdb;
6843
6844	retval = CTL_RETVAL_COMPLETE;
6845
6846	switch (cdb->service_action) {
6847	case SRC16_SERVICE_ACTION:
6848		retval = ctl_read_capacity_16(ctsio);
6849		break;
6850	default:
6851		ctl_set_invalid_field(/*ctsio*/ ctsio,
6852				      /*sks_valid*/ 1,
6853				      /*command*/ 1,
6854				      /*field*/ 1,
6855				      /*bit_valid*/ 1,
6856				      /*bit*/ 4);
6857		ctl_done((union ctl_io *)ctsio);
6858		break;
6859	}
6860
6861	return (retval);
6862}
6863
6864int
6865ctl_maintenance_in(struct ctl_scsiio *ctsio)
6866{
6867	struct scsi_maintenance_in *cdb;
6868	int retval;
6869	int alloc_len, total_len = 0;
6870	int num_target_port_groups;
6871	struct ctl_lun *lun;
6872	struct ctl_softc *softc;
6873	struct scsi_target_group_data *rtg_ptr;
6874	struct scsi_target_port_group_descriptor *tpg_desc_ptr1, *tpg_desc_ptr2;
6875	struct scsi_target_port_descriptor  *tp_desc_ptr1_1, *tp_desc_ptr1_2,
6876	                                    *tp_desc_ptr2_1, *tp_desc_ptr2_2;
6877
6878	CTL_DEBUG_PRINT(("ctl_maintenance_in\n"));
6879
6880	cdb = (struct scsi_maintenance_in *)ctsio->cdb;
6881	softc = control_softc;
6882	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6883
6884	retval = CTL_RETVAL_COMPLETE;
6885	mtx_lock(&softc->ctl_lock);
6886
6887	if ((cdb->byte2 & SERVICE_ACTION_MASK) != SA_RPRT_TRGT_GRP) {
6888		ctl_set_invalid_field(/*ctsio*/ ctsio,
6889				      /*sks_valid*/ 1,
6890				      /*command*/ 1,
6891				      /*field*/ 1,
6892				      /*bit_valid*/ 1,
6893				      /*bit*/ 4);
6894		ctl_done((union ctl_io *)ctsio);
6895		return(retval);
6896	}
6897
6898	if (ctl_is_single)
6899        	num_target_port_groups = NUM_TARGET_PORT_GROUPS - 1;
6900	else
6901        	num_target_port_groups = NUM_TARGET_PORT_GROUPS;
6902
6903	total_len = sizeof(struct scsi_target_group_data) +
6904		sizeof(struct scsi_target_port_group_descriptor) *
6905		num_target_port_groups +
6906		sizeof(struct scsi_target_port_descriptor) *
6907		NUM_PORTS_PER_GRP * num_target_port_groups;
6908
6909	alloc_len = scsi_4btoul(cdb->length);
6910
6911	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK);
6912	if (ctsio->kern_data_ptr == NULL) {
6913		ctsio->io_hdr.status = CTL_SCSI_ERROR;
6914		ctsio->scsi_status = SCSI_STATUS_BUSY;
6915		ctl_done((union ctl_io *)ctsio);
6916		return (CTL_RETVAL_COMPLETE);
6917	}
6918	memset(ctsio->kern_data_ptr, 0, total_len);
6919
6920	ctsio->kern_sg_entries = 0;
6921
6922	if (total_len < alloc_len) {
6923		ctsio->residual = alloc_len - total_len;
6924		ctsio->kern_data_len = total_len;
6925		ctsio->kern_total_len = total_len;
6926	} else {
6927		ctsio->residual = 0;
6928		ctsio->kern_data_len = alloc_len;
6929		ctsio->kern_total_len = alloc_len;
6930	}
6931	ctsio->kern_data_resid = 0;
6932	ctsio->kern_rel_offset = 0;
6933
6934	rtg_ptr = (struct scsi_target_group_data *)ctsio->kern_data_ptr;
6935
6936	tpg_desc_ptr1 = &rtg_ptr->groups[0];
6937	tp_desc_ptr1_1 = &tpg_desc_ptr1->descriptors[0];
6938	tp_desc_ptr1_2 = (struct scsi_target_port_descriptor *)
6939	        &tp_desc_ptr1_1->desc_list[0];
6940
6941
6942
6943	if (ctl_is_single == 0) {
6944		tpg_desc_ptr2 = (struct scsi_target_port_group_descriptor *)
6945	                &tp_desc_ptr1_2->desc_list[0];
6946		tp_desc_ptr2_1 = &tpg_desc_ptr2->descriptors[0];
6947		tp_desc_ptr2_2 = (struct scsi_target_port_descriptor *)
6948	        	&tp_desc_ptr2_1->desc_list[0];
6949        } else {
6950		tpg_desc_ptr2 = NULL;
6951		tp_desc_ptr2_1 = NULL;
6952		tp_desc_ptr2_2 = NULL;
6953	}
6954
6955	scsi_ulto4b(total_len - 4, rtg_ptr->length);
6956	if (ctl_is_single == 0) {
6957        	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS) {
6958			if (lun->flags & CTL_LUN_PRIMARY_SC) {
6959				tpg_desc_ptr1->pref_state = TPG_PRIMARY;
6960				tpg_desc_ptr2->pref_state =
6961					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
6962			} else {
6963				tpg_desc_ptr1->pref_state =
6964					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
6965				tpg_desc_ptr2->pref_state = TPG_PRIMARY;
6966			}
6967		} else {
6968			if (lun->flags & CTL_LUN_PRIMARY_SC) {
6969				tpg_desc_ptr1->pref_state =
6970					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
6971				tpg_desc_ptr2->pref_state = TPG_PRIMARY;
6972			} else {
6973				tpg_desc_ptr1->pref_state = TPG_PRIMARY;
6974				tpg_desc_ptr2->pref_state =
6975					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
6976			}
6977		}
6978	} else {
6979		tpg_desc_ptr1->pref_state = TPG_PRIMARY;
6980	}
6981	tpg_desc_ptr1->support = 0;
6982	tpg_desc_ptr1->target_port_group[1] = 1;
6983	tpg_desc_ptr1->status = TPG_IMPLICIT;
6984	tpg_desc_ptr1->target_port_count= NUM_PORTS_PER_GRP;
6985
6986	if (ctl_is_single == 0) {
6987		tpg_desc_ptr2->support = 0;
6988		tpg_desc_ptr2->target_port_group[1] = 2;
6989		tpg_desc_ptr2->status = TPG_IMPLICIT;
6990		tpg_desc_ptr2->target_port_count = NUM_PORTS_PER_GRP;
6991
6992		tp_desc_ptr1_1->relative_target_port_identifier[1] = 1;
6993		tp_desc_ptr1_2->relative_target_port_identifier[1] = 2;
6994
6995		tp_desc_ptr2_1->relative_target_port_identifier[1] = 9;
6996		tp_desc_ptr2_2->relative_target_port_identifier[1] = 10;
6997	} else {
6998        	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS) {
6999			tp_desc_ptr1_1->relative_target_port_identifier[1] = 1;
7000			tp_desc_ptr1_2->relative_target_port_identifier[1] = 2;
7001		} else {
7002			tp_desc_ptr1_1->relative_target_port_identifier[1] = 9;
7003			tp_desc_ptr1_2->relative_target_port_identifier[1] = 10;
7004		}
7005	}
7006
7007	mtx_unlock(&softc->ctl_lock);
7008
7009	ctsio->be_move_done = ctl_config_move_done;
7010
7011	CTL_DEBUG_PRINT(("buf = %x %x %x %x %x %x %x %x\n",
7012			 ctsio->kern_data_ptr[0], ctsio->kern_data_ptr[1],
7013			 ctsio->kern_data_ptr[2], ctsio->kern_data_ptr[3],
7014			 ctsio->kern_data_ptr[4], ctsio->kern_data_ptr[5],
7015			 ctsio->kern_data_ptr[6], ctsio->kern_data_ptr[7]));
7016
7017	ctl_datamove((union ctl_io *)ctsio);
7018	return(retval);
7019}
7020
7021int
7022ctl_persistent_reserve_in(struct ctl_scsiio *ctsio)
7023{
7024	struct scsi_per_res_in *cdb;
7025	int alloc_len, total_len = 0;
7026	/* struct scsi_per_res_in_rsrv in_data; */
7027	struct ctl_lun *lun;
7028	struct ctl_softc *softc;
7029
7030	CTL_DEBUG_PRINT(("ctl_persistent_reserve_in\n"));
7031
7032	softc = control_softc;
7033
7034	cdb = (struct scsi_per_res_in *)ctsio->cdb;
7035
7036	alloc_len = scsi_2btoul(cdb->length);
7037
7038	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
7039
7040retry:
7041	mtx_lock(&softc->ctl_lock);
7042	switch (cdb->action) {
7043	case SPRI_RK: /* read keys */
7044		total_len = sizeof(struct scsi_per_res_in_keys) +
7045			lun->pr_key_count *
7046			sizeof(struct scsi_per_res_key);
7047		break;
7048	case SPRI_RR: /* read reservation */
7049		if (lun->flags & CTL_LUN_PR_RESERVED)
7050			total_len = sizeof(struct scsi_per_res_in_rsrv);
7051		else
7052			total_len = sizeof(struct scsi_per_res_in_header);
7053		break;
7054	case SPRI_RC: /* report capabilities */
7055		total_len = sizeof(struct scsi_per_res_cap);
7056		break;
7057	case SPRI_RS: /* read full status */
7058	default:
7059		mtx_unlock(&softc->ctl_lock);
7060		ctl_set_invalid_field(ctsio,
7061				      /*sks_valid*/ 1,
7062				      /*command*/ 1,
7063				      /*field*/ 1,
7064				      /*bit_valid*/ 1,
7065				      /*bit*/ 0);
7066		ctl_done((union ctl_io *)ctsio);
7067		return (CTL_RETVAL_COMPLETE);
7068		break; /* NOTREACHED */
7069	}
7070	mtx_unlock(&softc->ctl_lock);
7071
7072	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK);
7073	if (ctsio->kern_data_ptr == NULL) {
7074		ctsio->io_hdr.status = CTL_SCSI_ERROR;
7075		ctsio->scsi_status = SCSI_STATUS_BUSY;
7076		ctl_done((union ctl_io *)ctsio);
7077		return (CTL_RETVAL_COMPLETE);
7078	}
7079
7080	if (total_len < alloc_len) {
7081		ctsio->residual = alloc_len - total_len;
7082		ctsio->kern_data_len = total_len;
7083		ctsio->kern_total_len = total_len;
7084	} else {
7085		ctsio->residual = 0;
7086		ctsio->kern_data_len = alloc_len;
7087		ctsio->kern_total_len = alloc_len;
7088	}
7089
7090	ctsio->kern_data_resid = 0;
7091	ctsio->kern_rel_offset = 0;
7092	ctsio->kern_sg_entries = 0;
7093
7094	memset(ctsio->kern_data_ptr, 0, total_len);
7095
7096	mtx_lock(&softc->ctl_lock);
7097	switch (cdb->action) {
7098	case SPRI_RK: { // read keys
7099        struct scsi_per_res_in_keys *res_keys;
7100		int i, key_count;
7101
7102		res_keys = (struct scsi_per_res_in_keys*)ctsio->kern_data_ptr;
7103
7104		/*
7105		 * We had to drop the lock to allocate our buffer, which
7106		 * leaves time for someone to come in with another
7107		 * persistent reservation.  (That is unlikely, though,
7108		 * since this should be the only persistent reservation
7109		 * command active right now.)
7110		 */
7111		if (total_len != (sizeof(struct scsi_per_res_in_keys) +
7112		    (lun->pr_key_count *
7113		     sizeof(struct scsi_per_res_key)))){
7114			mtx_unlock(&softc->ctl_lock);
7115			free(ctsio->kern_data_ptr, M_CTL);
7116			printf("%s: reservation length changed, retrying\n",
7117			       __func__);
7118			goto retry;
7119		}
7120
7121		scsi_ulto4b(lun->PRGeneration, res_keys->header.generation);
7122
7123		scsi_ulto4b(sizeof(struct scsi_per_res_key) *
7124			     lun->pr_key_count, res_keys->header.length);
7125
7126		for (i = 0, key_count = 0; i < 2*CTL_MAX_INITIATORS; i++) {
7127			if (!lun->per_res[i].registered)
7128				continue;
7129
7130			/*
7131			 * We used lun->pr_key_count to calculate the
7132			 * size to allocate.  If it turns out the number of
7133			 * initiators with the registered flag set is
7134			 * larger than that (i.e. they haven't been kept in
7135			 * sync), we've got a problem.
7136			 */
7137			if (key_count >= lun->pr_key_count) {
7138#ifdef NEEDTOPORT
7139				csevent_log(CSC_CTL | CSC_SHELF_SW |
7140					    CTL_PR_ERROR,
7141					    csevent_LogType_Fault,
7142					    csevent_AlertLevel_Yellow,
7143					    csevent_FRU_ShelfController,
7144					    csevent_FRU_Firmware,
7145				        csevent_FRU_Unknown,
7146					    "registered keys %d >= key "
7147					    "count %d", key_count,
7148					    lun->pr_key_count);
7149#endif
7150				key_count++;
7151				continue;
7152			}
7153			memcpy(res_keys->keys[key_count].key,
7154			       lun->per_res[i].res_key.key,
7155			       ctl_min(sizeof(res_keys->keys[key_count].key),
7156			       sizeof(lun->per_res[i].res_key)));
7157			key_count++;
7158		}
7159		break;
7160	}
7161	case SPRI_RR: { // read reservation
7162		struct scsi_per_res_in_rsrv *res;
7163		int tmp_len, header_only;
7164
7165		res = (struct scsi_per_res_in_rsrv *)ctsio->kern_data_ptr;
7166
7167		scsi_ulto4b(lun->PRGeneration, res->header.generation);
7168
7169		if (lun->flags & CTL_LUN_PR_RESERVED)
7170		{
7171			tmp_len = sizeof(struct scsi_per_res_in_rsrv);
7172			scsi_ulto4b(sizeof(struct scsi_per_res_in_rsrv_data),
7173				    res->header.length);
7174			header_only = 0;
7175		} else {
7176			tmp_len = sizeof(struct scsi_per_res_in_header);
7177			scsi_ulto4b(0, res->header.length);
7178			header_only = 1;
7179		}
7180
7181		/*
7182		 * We had to drop the lock to allocate our buffer, which
7183		 * leaves time for someone to come in with another
7184		 * persistent reservation.  (That is unlikely, though,
7185		 * since this should be the only persistent reservation
7186		 * command active right now.)
7187		 */
7188		if (tmp_len != total_len) {
7189			mtx_unlock(&softc->ctl_lock);
7190			free(ctsio->kern_data_ptr, M_CTL);
7191			printf("%s: reservation status changed, retrying\n",
7192			       __func__);
7193			goto retry;
7194		}
7195
7196		/*
7197		 * No reservation held, so we're done.
7198		 */
7199		if (header_only != 0)
7200			break;
7201
7202		/*
7203		 * If the registration is an All Registrants type, the key
7204		 * is 0, since it doesn't really matter.
7205		 */
7206		if (lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS) {
7207			memcpy(res->data.reservation,
7208			       &lun->per_res[lun->pr_res_idx].res_key,
7209			       sizeof(struct scsi_per_res_key));
7210		}
7211		res->data.scopetype = lun->res_type;
7212		break;
7213	}
7214	case SPRI_RC:     //report capabilities
7215	{
7216		struct scsi_per_res_cap *res_cap;
7217		uint16_t type_mask;
7218
7219		res_cap = (struct scsi_per_res_cap *)ctsio->kern_data_ptr;
7220		scsi_ulto2b(sizeof(*res_cap), res_cap->length);
7221		res_cap->flags2 |= SPRI_TMV;
7222		type_mask = SPRI_TM_WR_EX_AR |
7223			    SPRI_TM_EX_AC_RO |
7224			    SPRI_TM_WR_EX_RO |
7225			    SPRI_TM_EX_AC |
7226			    SPRI_TM_WR_EX |
7227			    SPRI_TM_EX_AC_AR;
7228		scsi_ulto2b(type_mask, res_cap->type_mask);
7229		break;
7230	}
7231	case SPRI_RS: //read full status
7232	default:
7233		/*
7234		 * This is a bug, because we just checked for this above,
7235		 * and should have returned an error.
7236		 */
7237		panic("Invalid PR type %x", cdb->action);
7238		break; /* NOTREACHED */
7239	}
7240	mtx_unlock(&softc->ctl_lock);
7241
7242	ctsio->be_move_done = ctl_config_move_done;
7243
7244	CTL_DEBUG_PRINT(("buf = %x %x %x %x %x %x %x %x\n",
7245			 ctsio->kern_data_ptr[0], ctsio->kern_data_ptr[1],
7246			 ctsio->kern_data_ptr[2], ctsio->kern_data_ptr[3],
7247			 ctsio->kern_data_ptr[4], ctsio->kern_data_ptr[5],
7248			 ctsio->kern_data_ptr[6], ctsio->kern_data_ptr[7]));
7249
7250	ctl_datamove((union ctl_io *)ctsio);
7251
7252	return (CTL_RETVAL_COMPLETE);
7253}
7254
7255/*
7256 * Returns 0 if ctl_persistent_reserve_out() should continue, non-zero if
7257 * it should return.
7258 */
7259static int
7260ctl_pro_preempt(struct ctl_softc *softc, struct ctl_lun *lun, uint64_t res_key,
7261		uint64_t sa_res_key, uint8_t type, uint32_t residx,
7262		struct ctl_scsiio *ctsio, struct scsi_per_res_out *cdb,
7263		struct scsi_per_res_out_parms* param)
7264{
7265	union ctl_ha_msg persis_io;
7266	int retval, i;
7267	int isc_retval;
7268
7269	retval = 0;
7270
7271	if (sa_res_key == 0) {
7272		mtx_lock(&softc->ctl_lock);
7273		if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
7274			/* validate scope and type */
7275			if ((cdb->scope_type & SPR_SCOPE_MASK) !=
7276			     SPR_LU_SCOPE) {
7277				mtx_unlock(&softc->ctl_lock);
7278				ctl_set_invalid_field(/*ctsio*/ ctsio,
7279						      /*sks_valid*/ 1,
7280						      /*command*/ 1,
7281						      /*field*/ 2,
7282						      /*bit_valid*/ 1,
7283						      /*bit*/ 4);
7284				ctl_done((union ctl_io *)ctsio);
7285				return (1);
7286			}
7287
7288		        if (type>8 || type==2 || type==4 || type==0) {
7289				mtx_unlock(&softc->ctl_lock);
7290				ctl_set_invalid_field(/*ctsio*/ ctsio,
7291       	           				      /*sks_valid*/ 1,
7292						      /*command*/ 1,
7293						      /*field*/ 2,
7294						      /*bit_valid*/ 1,
7295						      /*bit*/ 0);
7296				ctl_done((union ctl_io *)ctsio);
7297				return (1);
7298		        }
7299
7300			/* temporarily unregister this nexus */
7301			lun->per_res[residx].registered = 0;
7302
7303			/*
7304			 * Unregister everybody else and build UA for
7305			 * them
7306			 */
7307			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7308				if (lun->per_res[i].registered == 0)
7309					continue;
7310
7311				if (!persis_offset
7312				 && i <CTL_MAX_INITIATORS)
7313					lun->pending_sense[i].ua_pending |=
7314						CTL_UA_REG_PREEMPT;
7315				else if (persis_offset
7316				      && i >= persis_offset)
7317					lun->pending_sense[i-persis_offset
7318						].ua_pending |=
7319						CTL_UA_REG_PREEMPT;
7320				lun->per_res[i].registered = 0;
7321				memset(&lun->per_res[i].res_key, 0,
7322				       sizeof(struct scsi_per_res_key));
7323			}
7324			lun->per_res[residx].registered = 1;
7325			lun->pr_key_count = 1;
7326			lun->res_type = type;
7327			if (lun->res_type != SPR_TYPE_WR_EX_AR
7328			 && lun->res_type != SPR_TYPE_EX_AC_AR)
7329				lun->pr_res_idx = residx;
7330
7331			mtx_unlock(&softc->ctl_lock);
7332			/* send msg to other side */
7333			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7334			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7335			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
7336			persis_io.pr.pr_info.residx = lun->pr_res_idx;
7337			persis_io.pr.pr_info.res_type = type;
7338			memcpy(persis_io.pr.pr_info.sa_res_key,
7339			       param->serv_act_res_key,
7340			       sizeof(param->serv_act_res_key));
7341			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7342			     &persis_io, sizeof(persis_io), 0)) >
7343			     CTL_HA_STATUS_SUCCESS) {
7344				printf("CTL:Persis Out error returned "
7345				       "from ctl_ha_msg_send %d\n",
7346				       isc_retval);
7347			}
7348		} else {
7349			/* not all registrants */
7350			mtx_unlock(&softc->ctl_lock);
7351			free(ctsio->kern_data_ptr, M_CTL);
7352			ctl_set_invalid_field(ctsio,
7353					      /*sks_valid*/ 1,
7354					      /*command*/ 0,
7355					      /*field*/ 8,
7356					      /*bit_valid*/ 0,
7357					      /*bit*/ 0);
7358			ctl_done((union ctl_io *)ctsio);
7359			return (1);
7360		}
7361	} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS
7362		|| !(lun->flags & CTL_LUN_PR_RESERVED)) {
7363		int found = 0;
7364
7365		mtx_lock(&softc->ctl_lock);
7366		if (res_key == sa_res_key) {
7367			/* special case */
7368			/*
7369			 * The spec implies this is not good but doesn't
7370			 * say what to do. There are two choices either
7371			 * generate a res conflict or check condition
7372			 * with illegal field in parameter data. Since
7373			 * that is what is done when the sa_res_key is
7374			 * zero I'll take that approach since this has
7375			 * to do with the sa_res_key.
7376			 */
7377			mtx_unlock(&softc->ctl_lock);
7378			free(ctsio->kern_data_ptr, M_CTL);
7379			ctl_set_invalid_field(ctsio,
7380					      /*sks_valid*/ 1,
7381					      /*command*/ 0,
7382					      /*field*/ 8,
7383					      /*bit_valid*/ 0,
7384					      /*bit*/ 0);
7385			ctl_done((union ctl_io *)ctsio);
7386			return (1);
7387		}
7388
7389		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7390			if (lun->per_res[i].registered
7391			 && memcmp(param->serv_act_res_key,
7392			    lun->per_res[i].res_key.key,
7393			    sizeof(struct scsi_per_res_key)) != 0)
7394				continue;
7395
7396			found = 1;
7397			lun->per_res[i].registered = 0;
7398			memset(&lun->per_res[i].res_key, 0,
7399			       sizeof(struct scsi_per_res_key));
7400			lun->pr_key_count--;
7401
7402			if (!persis_offset
7403			 && i < CTL_MAX_INITIATORS)
7404				lun->pending_sense[i].ua_pending |=
7405					CTL_UA_REG_PREEMPT;
7406			else if (persis_offset
7407			      && i >= persis_offset)
7408				lun->pending_sense[i-persis_offset].ua_pending|=
7409					CTL_UA_REG_PREEMPT;
7410		}
7411		mtx_unlock(&softc->ctl_lock);
7412		if (!found) {
7413			free(ctsio->kern_data_ptr, M_CTL);
7414			ctl_set_reservation_conflict(ctsio);
7415			ctl_done((union ctl_io *)ctsio);
7416			return (CTL_RETVAL_COMPLETE);
7417		}
7418		/* send msg to other side */
7419		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7420		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7421		persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
7422		persis_io.pr.pr_info.residx = lun->pr_res_idx;
7423		persis_io.pr.pr_info.res_type = type;
7424		memcpy(persis_io.pr.pr_info.sa_res_key,
7425		       param->serv_act_res_key,
7426		       sizeof(param->serv_act_res_key));
7427		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7428		     &persis_io, sizeof(persis_io), 0)) >
7429		     CTL_HA_STATUS_SUCCESS) {
7430			printf("CTL:Persis Out error returned from "
7431			       "ctl_ha_msg_send %d\n", isc_retval);
7432		}
7433	} else {
7434		/* Reserved but not all registrants */
7435		/* sa_res_key is res holder */
7436		if (memcmp(param->serv_act_res_key,
7437                   lun->per_res[lun->pr_res_idx].res_key.key,
7438                   sizeof(struct scsi_per_res_key)) == 0) {
7439			/* validate scope and type */
7440			if ((cdb->scope_type & SPR_SCOPE_MASK) !=
7441			     SPR_LU_SCOPE) {
7442				ctl_set_invalid_field(/*ctsio*/ ctsio,
7443						      /*sks_valid*/ 1,
7444						      /*command*/ 1,
7445						      /*field*/ 2,
7446						      /*bit_valid*/ 1,
7447						      /*bit*/ 4);
7448				ctl_done((union ctl_io *)ctsio);
7449				return (1);
7450			}
7451
7452			if (type>8 || type==2 || type==4 || type==0) {
7453				ctl_set_invalid_field(/*ctsio*/ ctsio,
7454						      /*sks_valid*/ 1,
7455						      /*command*/ 1,
7456						      /*field*/ 2,
7457						      /*bit_valid*/ 1,
7458						      /*bit*/ 0);
7459				ctl_done((union ctl_io *)ctsio);
7460				return (1);
7461			}
7462
7463			/*
7464			 * Do the following:
7465			 * if sa_res_key != res_key remove all
7466			 * registrants w/sa_res_key and generate UA
7467			 * for these registrants(Registrations
7468			 * Preempted) if it wasn't an exclusive
7469			 * reservation generate UA(Reservations
7470			 * Preempted) for all other registered nexuses
7471			 * if the type has changed. Establish the new
7472			 * reservation and holder. If res_key and
7473			 * sa_res_key are the same do the above
7474			 * except don't unregister the res holder.
7475			 */
7476
7477			/*
7478			 * Temporarily unregister so it won't get
7479			 * removed or UA generated
7480			 */
7481			lun->per_res[residx].registered = 0;
7482			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7483				if (lun->per_res[i].registered == 0)
7484					continue;
7485
7486				if (memcmp(param->serv_act_res_key,
7487				    lun->per_res[i].res_key.key,
7488				    sizeof(struct scsi_per_res_key)) == 0) {
7489					lun->per_res[i].registered = 0;
7490					memset(&lun->per_res[i].res_key,
7491					       0,
7492					       sizeof(struct scsi_per_res_key));
7493					lun->pr_key_count--;
7494
7495					if (!persis_offset
7496					 && i < CTL_MAX_INITIATORS)
7497						lun->pending_sense[i
7498							].ua_pending |=
7499							CTL_UA_REG_PREEMPT;
7500					else if (persis_offset
7501					      && i >= persis_offset)
7502						lun->pending_sense[
7503						  i-persis_offset].ua_pending |=
7504						  CTL_UA_REG_PREEMPT;
7505				} else if (type != lun->res_type
7506					&& (lun->res_type == SPR_TYPE_WR_EX_RO
7507					 || lun->res_type ==SPR_TYPE_EX_AC_RO)){
7508						if (!persis_offset
7509						 && i < CTL_MAX_INITIATORS)
7510							lun->pending_sense[i
7511							].ua_pending |=
7512							CTL_UA_RES_RELEASE;
7513						else if (persis_offset
7514						      && i >= persis_offset)
7515							lun->pending_sense[
7516							i-persis_offset
7517							].ua_pending |=
7518							CTL_UA_RES_RELEASE;
7519				}
7520			}
7521			lun->per_res[residx].registered = 1;
7522			lun->res_type = type;
7523			if (lun->res_type != SPR_TYPE_WR_EX_AR
7524			 && lun->res_type != SPR_TYPE_EX_AC_AR)
7525				lun->pr_res_idx = residx;
7526			else
7527				lun->pr_res_idx =
7528					CTL_PR_ALL_REGISTRANTS;
7529
7530			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7531			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7532			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
7533			persis_io.pr.pr_info.residx = lun->pr_res_idx;
7534			persis_io.pr.pr_info.res_type = type;
7535			memcpy(persis_io.pr.pr_info.sa_res_key,
7536			       param->serv_act_res_key,
7537			       sizeof(param->serv_act_res_key));
7538			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7539			     &persis_io, sizeof(persis_io), 0)) >
7540			     CTL_HA_STATUS_SUCCESS) {
7541				printf("CTL:Persis Out error returned "
7542				       "from ctl_ha_msg_send %d\n",
7543				       isc_retval);
7544			}
7545		} else {
7546			/*
7547			 * sa_res_key is not the res holder just
7548			 * remove registrants
7549			 */
7550			int found=0;
7551			mtx_lock(&softc->ctl_lock);
7552
7553			for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7554				if (memcmp(param->serv_act_res_key,
7555				    lun->per_res[i].res_key.key,
7556				    sizeof(struct scsi_per_res_key)) != 0)
7557					continue;
7558
7559				found = 1;
7560				lun->per_res[i].registered = 0;
7561				memset(&lun->per_res[i].res_key, 0,
7562				       sizeof(struct scsi_per_res_key));
7563				lun->pr_key_count--;
7564
7565				if (!persis_offset
7566				 && i < CTL_MAX_INITIATORS)
7567					lun->pending_sense[i].ua_pending |=
7568						CTL_UA_REG_PREEMPT;
7569				else if (persis_offset
7570				      && i >= persis_offset)
7571					lun->pending_sense[
7572						i-persis_offset].ua_pending |=
7573						CTL_UA_REG_PREEMPT;
7574			}
7575
7576			if (!found) {
7577				mtx_unlock(&softc->ctl_lock);
7578				free(ctsio->kern_data_ptr, M_CTL);
7579				ctl_set_reservation_conflict(ctsio);
7580				ctl_done((union ctl_io *)ctsio);
7581		        	return (1);
7582			}
7583			mtx_unlock(&softc->ctl_lock);
7584			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7585			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7586			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
7587			persis_io.pr.pr_info.residx = lun->pr_res_idx;
7588			persis_io.pr.pr_info.res_type = type;
7589			memcpy(persis_io.pr.pr_info.sa_res_key,
7590			       param->serv_act_res_key,
7591			       sizeof(param->serv_act_res_key));
7592			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7593			     &persis_io, sizeof(persis_io), 0)) >
7594			     CTL_HA_STATUS_SUCCESS) {
7595				printf("CTL:Persis Out error returned "
7596				       "from ctl_ha_msg_send %d\n",
7597				isc_retval);
7598			}
7599		}
7600	}
7601
7602	lun->PRGeneration++;
7603
7604	return (retval);
7605}
7606
7607static void
7608ctl_pro_preempt_other(struct ctl_lun *lun, union ctl_ha_msg *msg)
7609{
7610	int i;
7611
7612	if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS
7613	 || lun->pr_res_idx == CTL_PR_NO_RESERVATION
7614	 || memcmp(&lun->per_res[lun->pr_res_idx].res_key,
7615		   msg->pr.pr_info.sa_res_key,
7616		   sizeof(struct scsi_per_res_key)) != 0) {
7617		uint64_t sa_res_key;
7618		sa_res_key = scsi_8btou64(msg->pr.pr_info.sa_res_key);
7619
7620		if (sa_res_key == 0) {
7621			/* temporarily unregister this nexus */
7622			lun->per_res[msg->pr.pr_info.residx].registered = 0;
7623
7624			/*
7625			 * Unregister everybody else and build UA for
7626			 * them
7627			 */
7628			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7629				if (lun->per_res[i].registered == 0)
7630					continue;
7631
7632				if (!persis_offset
7633				 && i < CTL_MAX_INITIATORS)
7634					lun->pending_sense[i].ua_pending |=
7635						CTL_UA_REG_PREEMPT;
7636				else if (persis_offset && i >= persis_offset)
7637					lun->pending_sense[i -
7638						persis_offset].ua_pending |=
7639						CTL_UA_REG_PREEMPT;
7640				lun->per_res[i].registered = 0;
7641				memset(&lun->per_res[i].res_key, 0,
7642				       sizeof(struct scsi_per_res_key));
7643			}
7644
7645			lun->per_res[msg->pr.pr_info.residx].registered = 1;
7646			lun->pr_key_count = 1;
7647			lun->res_type = msg->pr.pr_info.res_type;
7648			if (lun->res_type != SPR_TYPE_WR_EX_AR
7649			 && lun->res_type != SPR_TYPE_EX_AC_AR)
7650				lun->pr_res_idx = msg->pr.pr_info.residx;
7651		} else {
7652		        for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7653				if (memcmp(msg->pr.pr_info.sa_res_key,
7654		                   lun->per_res[i].res_key.key,
7655		                   sizeof(struct scsi_per_res_key)) != 0)
7656					continue;
7657
7658				lun->per_res[i].registered = 0;
7659				memset(&lun->per_res[i].res_key, 0,
7660				       sizeof(struct scsi_per_res_key));
7661				lun->pr_key_count--;
7662
7663				if (!persis_offset
7664				 && i < persis_offset)
7665					lun->pending_sense[i].ua_pending |=
7666						CTL_UA_REG_PREEMPT;
7667				else if (persis_offset
7668				      && i >= persis_offset)
7669					lun->pending_sense[i -
7670						persis_offset].ua_pending |=
7671						CTL_UA_REG_PREEMPT;
7672			}
7673		}
7674	} else {
7675		/*
7676		 * Temporarily unregister so it won't get removed
7677		 * or UA generated
7678		 */
7679		lun->per_res[msg->pr.pr_info.residx].registered = 0;
7680		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7681			if (lun->per_res[i].registered == 0)
7682				continue;
7683
7684			if (memcmp(msg->pr.pr_info.sa_res_key,
7685	                   lun->per_res[i].res_key.key,
7686	                   sizeof(struct scsi_per_res_key)) == 0) {
7687				lun->per_res[i].registered = 0;
7688				memset(&lun->per_res[i].res_key, 0,
7689				       sizeof(struct scsi_per_res_key));
7690				lun->pr_key_count--;
7691				if (!persis_offset
7692				 && i < CTL_MAX_INITIATORS)
7693					lun->pending_sense[i].ua_pending |=
7694						CTL_UA_REG_PREEMPT;
7695				else if (persis_offset
7696				      && i >= persis_offset)
7697					lun->pending_sense[i -
7698						persis_offset].ua_pending |=
7699						CTL_UA_REG_PREEMPT;
7700			} else if (msg->pr.pr_info.res_type != lun->res_type
7701				&& (lun->res_type == SPR_TYPE_WR_EX_RO
7702				 || lun->res_type == SPR_TYPE_EX_AC_RO)) {
7703					if (!persis_offset
7704					 && i < persis_offset)
7705						lun->pending_sense[i
7706							].ua_pending |=
7707							CTL_UA_RES_RELEASE;
7708					else if (persis_offset
7709					      && i >= persis_offset)
7710					lun->pending_sense[i -
7711						persis_offset].ua_pending |=
7712						CTL_UA_RES_RELEASE;
7713			}
7714		}
7715		lun->per_res[msg->pr.pr_info.residx].registered = 1;
7716		lun->res_type = msg->pr.pr_info.res_type;
7717		if (lun->res_type != SPR_TYPE_WR_EX_AR
7718		 && lun->res_type != SPR_TYPE_EX_AC_AR)
7719			lun->pr_res_idx = msg->pr.pr_info.residx;
7720		else
7721			lun->pr_res_idx = CTL_PR_ALL_REGISTRANTS;
7722	}
7723	lun->PRGeneration++;
7724
7725}
7726
7727
7728int
7729ctl_persistent_reserve_out(struct ctl_scsiio *ctsio)
7730{
7731	int retval;
7732	int isc_retval;
7733	u_int32_t param_len;
7734	struct scsi_per_res_out *cdb;
7735	struct ctl_lun *lun;
7736	struct scsi_per_res_out_parms* param;
7737	struct ctl_softc *softc;
7738	uint32_t residx;
7739	uint64_t res_key, sa_res_key;
7740	uint8_t type;
7741	union ctl_ha_msg persis_io;
7742	int    i;
7743
7744	CTL_DEBUG_PRINT(("ctl_persistent_reserve_out\n"));
7745
7746	retval = CTL_RETVAL_COMPLETE;
7747
7748	softc = control_softc;
7749
7750	cdb = (struct scsi_per_res_out *)ctsio->cdb;
7751	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
7752
7753	/*
7754	 * We only support whole-LUN scope.  The scope & type are ignored for
7755	 * register, register and ignore existing key and clear.
7756	 * We sometimes ignore scope and type on preempts too!!
7757	 * Verify reservation type here as well.
7758	 */
7759	type = cdb->scope_type & SPR_TYPE_MASK;
7760	if ((cdb->action == SPRO_RESERVE)
7761	 || (cdb->action == SPRO_RELEASE)) {
7762		if ((cdb->scope_type & SPR_SCOPE_MASK) != SPR_LU_SCOPE) {
7763			ctl_set_invalid_field(/*ctsio*/ ctsio,
7764					      /*sks_valid*/ 1,
7765					      /*command*/ 1,
7766					      /*field*/ 2,
7767					      /*bit_valid*/ 1,
7768					      /*bit*/ 4);
7769			ctl_done((union ctl_io *)ctsio);
7770			return (CTL_RETVAL_COMPLETE);
7771		}
7772
7773		if (type>8 || type==2 || type==4 || type==0) {
7774			ctl_set_invalid_field(/*ctsio*/ ctsio,
7775					      /*sks_valid*/ 1,
7776					      /*command*/ 1,
7777					      /*field*/ 2,
7778					      /*bit_valid*/ 1,
7779					      /*bit*/ 0);
7780			ctl_done((union ctl_io *)ctsio);
7781			return (CTL_RETVAL_COMPLETE);
7782		}
7783	}
7784
7785	switch (cdb->action & SPRO_ACTION_MASK) {
7786	case SPRO_REGISTER:
7787	case SPRO_RESERVE:
7788	case SPRO_RELEASE:
7789	case SPRO_CLEAR:
7790	case SPRO_PREEMPT:
7791	case SPRO_REG_IGNO:
7792		break;
7793	case SPRO_REG_MOVE:
7794	case SPRO_PRE_ABO:
7795	default:
7796		ctl_set_invalid_field(/*ctsio*/ ctsio,
7797				      /*sks_valid*/ 1,
7798				      /*command*/ 1,
7799				      /*field*/ 1,
7800				      /*bit_valid*/ 1,
7801				      /*bit*/ 0);
7802		ctl_done((union ctl_io *)ctsio);
7803		return (CTL_RETVAL_COMPLETE);
7804		break; /* NOTREACHED */
7805	}
7806
7807	param_len = scsi_4btoul(cdb->length);
7808
7809	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
7810		ctsio->kern_data_ptr = malloc(param_len, M_CTL, M_WAITOK);
7811		if (ctsio->kern_data_ptr == NULL) {
7812			ctl_set_busy(ctsio);
7813			ctl_done((union ctl_io *)ctsio);
7814			return (CTL_RETVAL_COMPLETE);
7815		}
7816		ctsio->kern_data_len = param_len;
7817		ctsio->kern_total_len = param_len;
7818		ctsio->kern_data_resid = 0;
7819		ctsio->kern_rel_offset = 0;
7820		ctsio->kern_sg_entries = 0;
7821		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
7822		ctsio->be_move_done = ctl_config_move_done;
7823		ctl_datamove((union ctl_io *)ctsio);
7824
7825		return (CTL_RETVAL_COMPLETE);
7826	}
7827
7828	param = (struct scsi_per_res_out_parms *)ctsio->kern_data_ptr;
7829
7830	residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
7831	res_key = scsi_8btou64(param->res_key.key);
7832	sa_res_key = scsi_8btou64(param->serv_act_res_key);
7833
7834	/*
7835	 * Validate the reservation key here except for SPRO_REG_IGNO
7836	 * This must be done for all other service actions
7837	 */
7838	if ((cdb->action & SPRO_ACTION_MASK) != SPRO_REG_IGNO) {
7839		mtx_lock(&softc->ctl_lock);
7840		if (lun->per_res[residx].registered) {
7841		    if (memcmp(param->res_key.key,
7842			       lun->per_res[residx].res_key.key,
7843			       ctl_min(sizeof(param->res_key),
7844			       sizeof(lun->per_res[residx].res_key))) != 0) {
7845				/*
7846				 * The current key passed in doesn't match
7847				 * the one the initiator previously
7848				 * registered.
7849				 */
7850				mtx_unlock(&softc->ctl_lock);
7851				free(ctsio->kern_data_ptr, M_CTL);
7852				ctl_set_reservation_conflict(ctsio);
7853				ctl_done((union ctl_io *)ctsio);
7854				return (CTL_RETVAL_COMPLETE);
7855			}
7856		} else if ((cdb->action & SPRO_ACTION_MASK) != SPRO_REGISTER) {
7857		    /*
7858			 * We are not registered
7859			 */
7860			mtx_unlock(&softc->ctl_lock);
7861			free(ctsio->kern_data_ptr, M_CTL);
7862			ctl_set_reservation_conflict(ctsio);
7863			ctl_done((union ctl_io *)ctsio);
7864			return (CTL_RETVAL_COMPLETE);
7865		} else if (res_key != 0) {
7866			/*
7867			 * We are not registered and trying to register but
7868			 * the register key isn't zero.
7869			 */
7870			mtx_unlock(&softc->ctl_lock);
7871			free(ctsio->kern_data_ptr, M_CTL);
7872			ctl_set_reservation_conflict(ctsio);
7873			ctl_done((union ctl_io *)ctsio);
7874			return (CTL_RETVAL_COMPLETE);
7875		}
7876		mtx_unlock(&softc->ctl_lock);
7877	}
7878
7879	switch (cdb->action & SPRO_ACTION_MASK) {
7880	case SPRO_REGISTER:
7881	case SPRO_REG_IGNO: {
7882
7883#if 0
7884		printf("Registration received\n");
7885#endif
7886
7887		/*
7888		 * We don't support any of these options, as we report in
7889		 * the read capabilities request (see
7890		 * ctl_persistent_reserve_in(), above).
7891		 */
7892		if ((param->flags & SPR_SPEC_I_PT)
7893		 || (param->flags & SPR_ALL_TG_PT)
7894		 || (param->flags & SPR_APTPL)) {
7895			int bit_ptr;
7896
7897			if (param->flags & SPR_APTPL)
7898				bit_ptr = 0;
7899			else if (param->flags & SPR_ALL_TG_PT)
7900				bit_ptr = 2;
7901			else /* SPR_SPEC_I_PT */
7902				bit_ptr = 3;
7903
7904			free(ctsio->kern_data_ptr, M_CTL);
7905			ctl_set_invalid_field(ctsio,
7906					      /*sks_valid*/ 1,
7907					      /*command*/ 0,
7908					      /*field*/ 20,
7909					      /*bit_valid*/ 1,
7910					      /*bit*/ bit_ptr);
7911			ctl_done((union ctl_io *)ctsio);
7912			return (CTL_RETVAL_COMPLETE);
7913		}
7914
7915		mtx_lock(&softc->ctl_lock);
7916
7917		/*
7918		 * The initiator wants to clear the
7919		 * key/unregister.
7920		 */
7921		if (sa_res_key == 0) {
7922			if ((res_key == 0
7923			  && (cdb->action & SPRO_ACTION_MASK) == SPRO_REGISTER)
7924			 || ((cdb->action & SPRO_ACTION_MASK) == SPRO_REG_IGNO
7925			  && !lun->per_res[residx].registered)) {
7926				mtx_unlock(&softc->ctl_lock);
7927				goto done;
7928			}
7929
7930			lun->per_res[residx].registered = 0;
7931			memset(&lun->per_res[residx].res_key,
7932			       0, sizeof(lun->per_res[residx].res_key));
7933			lun->pr_key_count--;
7934
7935			if (residx == lun->pr_res_idx) {
7936				lun->flags &= ~CTL_LUN_PR_RESERVED;
7937				lun->pr_res_idx = CTL_PR_NO_RESERVATION;
7938
7939				if ((lun->res_type == SPR_TYPE_WR_EX_RO
7940				  || lun->res_type == SPR_TYPE_EX_AC_RO)
7941				 && lun->pr_key_count) {
7942					/*
7943					 * If the reservation is a registrants
7944					 * only type we need to generate a UA
7945					 * for other registered inits.  The
7946					 * sense code should be RESERVATIONS
7947					 * RELEASED
7948					 */
7949
7950					for (i = 0; i < CTL_MAX_INITIATORS;i++){
7951						if (lun->per_res[
7952						    i+persis_offset].registered
7953						    == 0)
7954							continue;
7955						lun->pending_sense[i
7956							].ua_pending |=
7957							CTL_UA_RES_RELEASE;
7958					}
7959				}
7960				lun->res_type = 0;
7961			} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
7962				if (lun->pr_key_count==0) {
7963					lun->flags &= ~CTL_LUN_PR_RESERVED;
7964					lun->res_type = 0;
7965					lun->pr_res_idx = CTL_PR_NO_RESERVATION;
7966				}
7967			}
7968			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7969			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7970			persis_io.pr.pr_info.action = CTL_PR_UNREG_KEY;
7971			persis_io.pr.pr_info.residx = residx;
7972			if ((isc_retval = ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7973			     &persis_io, sizeof(persis_io), 0 )) >
7974			     CTL_HA_STATUS_SUCCESS) {
7975				printf("CTL:Persis Out error returned from "
7976				       "ctl_ha_msg_send %d\n", isc_retval);
7977			}
7978			mtx_unlock(&softc->ctl_lock);
7979		} else /* sa_res_key != 0 */ {
7980
7981			/*
7982			 * If we aren't registered currently then increment
7983			 * the key count and set the registered flag.
7984			 */
7985			if (!lun->per_res[residx].registered) {
7986				lun->pr_key_count++;
7987				lun->per_res[residx].registered = 1;
7988			}
7989
7990			memcpy(&lun->per_res[residx].res_key,
7991			       param->serv_act_res_key,
7992			       ctl_min(sizeof(param->serv_act_res_key),
7993			       sizeof(lun->per_res[residx].res_key)));
7994
7995			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7996			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7997			persis_io.pr.pr_info.action = CTL_PR_REG_KEY;
7998			persis_io.pr.pr_info.residx = residx;
7999			memcpy(persis_io.pr.pr_info.sa_res_key,
8000			       param->serv_act_res_key,
8001			       sizeof(param->serv_act_res_key));
8002			mtx_unlock(&softc->ctl_lock);
8003			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
8004			     &persis_io, sizeof(persis_io), 0)) >
8005			     CTL_HA_STATUS_SUCCESS) {
8006				printf("CTL:Persis Out error returned from "
8007				       "ctl_ha_msg_send %d\n", isc_retval);
8008			}
8009		}
8010		lun->PRGeneration++;
8011
8012		break;
8013	}
8014	case SPRO_RESERVE:
8015#if 0
8016                printf("Reserve executed type %d\n", type);
8017#endif
8018		mtx_lock(&softc->ctl_lock);
8019		if (lun->flags & CTL_LUN_PR_RESERVED) {
8020			/*
8021			 * if this isn't the reservation holder and it's
8022			 * not a "all registrants" type or if the type is
8023			 * different then we have a conflict
8024			 */
8025			if ((lun->pr_res_idx != residx
8026			  && lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS)
8027			 || lun->res_type != type) {
8028				mtx_unlock(&softc->ctl_lock);
8029				free(ctsio->kern_data_ptr, M_CTL);
8030				ctl_set_reservation_conflict(ctsio);
8031				ctl_done((union ctl_io *)ctsio);
8032				return (CTL_RETVAL_COMPLETE);
8033			}
8034		} else /* create a reservation */ {
8035			/*
8036			 * If it's not an "all registrants" type record
8037			 * reservation holder
8038			 */
8039			if (type != SPR_TYPE_WR_EX_AR
8040			 && type != SPR_TYPE_EX_AC_AR)
8041				lun->pr_res_idx = residx; /* Res holder */
8042			else
8043				lun->pr_res_idx = CTL_PR_ALL_REGISTRANTS;
8044
8045			lun->flags |= CTL_LUN_PR_RESERVED;
8046			lun->res_type = type;
8047
8048			mtx_unlock(&softc->ctl_lock);
8049
8050			/* send msg to other side */
8051			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
8052			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
8053			persis_io.pr.pr_info.action = CTL_PR_RESERVE;
8054			persis_io.pr.pr_info.residx = lun->pr_res_idx;
8055			persis_io.pr.pr_info.res_type = type;
8056			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
8057			     &persis_io, sizeof(persis_io), 0)) >
8058			     CTL_HA_STATUS_SUCCESS) {
8059				printf("CTL:Persis Out error returned from "
8060				       "ctl_ha_msg_send %d\n", isc_retval);
8061			}
8062		}
8063		break;
8064
8065	case SPRO_RELEASE:
8066		mtx_lock(&softc->ctl_lock);
8067		if ((lun->flags & CTL_LUN_PR_RESERVED) == 0) {
8068			/* No reservation exists return good status */
8069			mtx_unlock(&softc->ctl_lock);
8070			goto done;
8071		}
8072		/*
8073		 * Is this nexus a reservation holder?
8074		 */
8075		if (lun->pr_res_idx != residx
8076		 && lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS) {
8077			/*
8078			 * not a res holder return good status but
8079			 * do nothing
8080			 */
8081			mtx_unlock(&softc->ctl_lock);
8082			goto done;
8083		}
8084
8085		if (lun->res_type != type) {
8086			mtx_unlock(&softc->ctl_lock);
8087			free(ctsio->kern_data_ptr, M_CTL);
8088			ctl_set_illegal_pr_release(ctsio);
8089			ctl_done((union ctl_io *)ctsio);
8090			return (CTL_RETVAL_COMPLETE);
8091		}
8092
8093		/* okay to release */
8094		lun->flags &= ~CTL_LUN_PR_RESERVED;
8095		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8096		lun->res_type = 0;
8097
8098		/*
8099		 * if this isn't an exclusive access
8100		 * res generate UA for all other
8101		 * registrants.
8102		 */
8103		if (type != SPR_TYPE_EX_AC
8104		 && type != SPR_TYPE_WR_EX) {
8105			/*
8106			 * temporarily unregister so we don't generate UA
8107			 */
8108			lun->per_res[residx].registered = 0;
8109
8110			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
8111				if (lun->per_res[i+persis_offset].registered
8112				    == 0)
8113					continue;
8114				lun->pending_sense[i].ua_pending |=
8115					CTL_UA_RES_RELEASE;
8116			}
8117
8118			lun->per_res[residx].registered = 1;
8119		}
8120		mtx_unlock(&softc->ctl_lock);
8121		/* Send msg to other side */
8122		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
8123		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
8124		persis_io.pr.pr_info.action = CTL_PR_RELEASE;
8125		if ((isc_retval=ctl_ha_msg_send( CTL_HA_CHAN_CTL, &persis_io,
8126		     sizeof(persis_io), 0)) > CTL_HA_STATUS_SUCCESS) {
8127			printf("CTL:Persis Out error returned from "
8128			       "ctl_ha_msg_send %d\n", isc_retval);
8129		}
8130		break;
8131
8132	case SPRO_CLEAR:
8133		/* send msg to other side */
8134
8135		mtx_lock(&softc->ctl_lock);
8136		lun->flags &= ~CTL_LUN_PR_RESERVED;
8137		lun->res_type = 0;
8138		lun->pr_key_count = 0;
8139		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8140
8141
8142		memset(&lun->per_res[residx].res_key,
8143		       0, sizeof(lun->per_res[residx].res_key));
8144		lun->per_res[residx].registered = 0;
8145
8146		for (i=0; i < 2*CTL_MAX_INITIATORS; i++)
8147			if (lun->per_res[i].registered) {
8148				if (!persis_offset && i < CTL_MAX_INITIATORS)
8149					lun->pending_sense[i].ua_pending |=
8150						CTL_UA_RES_PREEMPT;
8151				else if (persis_offset && i >= persis_offset)
8152					lun->pending_sense[i-persis_offset
8153					    ].ua_pending |= CTL_UA_RES_PREEMPT;
8154
8155				memset(&lun->per_res[i].res_key,
8156				       0, sizeof(struct scsi_per_res_key));
8157				lun->per_res[i].registered = 0;
8158			}
8159		lun->PRGeneration++;
8160		mtx_unlock(&softc->ctl_lock);
8161		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
8162		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
8163		persis_io.pr.pr_info.action = CTL_PR_CLEAR;
8164		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL, &persis_io,
8165		     sizeof(persis_io), 0)) > CTL_HA_STATUS_SUCCESS) {
8166			printf("CTL:Persis Out error returned from "
8167			       "ctl_ha_msg_send %d\n", isc_retval);
8168		}
8169		break;
8170
8171	case SPRO_PREEMPT: {
8172		int nretval;
8173
8174		nretval = ctl_pro_preempt(softc, lun, res_key, sa_res_key, type,
8175					  residx, ctsio, cdb, param);
8176		if (nretval != 0)
8177			return (CTL_RETVAL_COMPLETE);
8178		break;
8179	}
8180	case SPRO_REG_MOVE:
8181	case SPRO_PRE_ABO:
8182	default:
8183		free(ctsio->kern_data_ptr, M_CTL);
8184		ctl_set_invalid_field(/*ctsio*/ ctsio,
8185				      /*sks_valid*/ 1,
8186				      /*command*/ 1,
8187				      /*field*/ 1,
8188				      /*bit_valid*/ 1,
8189				      /*bit*/ 0);
8190		ctl_done((union ctl_io *)ctsio);
8191		return (CTL_RETVAL_COMPLETE);
8192		break; /* NOTREACHED */
8193	}
8194
8195done:
8196	free(ctsio->kern_data_ptr, M_CTL);
8197	ctl_set_success(ctsio);
8198	ctl_done((union ctl_io *)ctsio);
8199
8200	return (retval);
8201}
8202
8203/*
8204 * This routine is for handling a message from the other SC pertaining to
8205 * persistent reserve out. All the error checking will have been done
8206 * so only perorming the action need be done here to keep the two
8207 * in sync.
8208 */
8209static void
8210ctl_hndl_per_res_out_on_other_sc(union ctl_ha_msg *msg)
8211{
8212	struct ctl_lun *lun;
8213	struct ctl_softc *softc;
8214	int i;
8215
8216	softc = control_softc;
8217
8218	mtx_lock(&softc->ctl_lock);
8219
8220	lun = softc->ctl_luns[msg->hdr.nexus.targ_lun];
8221	switch(msg->pr.pr_info.action) {
8222	case CTL_PR_REG_KEY:
8223		if (!lun->per_res[msg->pr.pr_info.residx].registered) {
8224			lun->per_res[msg->pr.pr_info.residx].registered = 1;
8225			lun->pr_key_count++;
8226		}
8227		lun->PRGeneration++;
8228		memcpy(&lun->per_res[msg->pr.pr_info.residx].res_key,
8229		       msg->pr.pr_info.sa_res_key,
8230		       sizeof(struct scsi_per_res_key));
8231		break;
8232
8233	case CTL_PR_UNREG_KEY:
8234		lun->per_res[msg->pr.pr_info.residx].registered = 0;
8235		memset(&lun->per_res[msg->pr.pr_info.residx].res_key,
8236		       0, sizeof(struct scsi_per_res_key));
8237		lun->pr_key_count--;
8238
8239		/* XXX Need to see if the reservation has been released */
8240		/* if so do we need to generate UA? */
8241		if (msg->pr.pr_info.residx == lun->pr_res_idx) {
8242			lun->flags &= ~CTL_LUN_PR_RESERVED;
8243			lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8244
8245			if ((lun->res_type == SPR_TYPE_WR_EX_RO
8246			  || lun->res_type == SPR_TYPE_EX_AC_RO)
8247			 && lun->pr_key_count) {
8248				/*
8249				 * If the reservation is a registrants
8250				 * only type we need to generate a UA
8251				 * for other registered inits.  The
8252				 * sense code should be RESERVATIONS
8253				 * RELEASED
8254				 */
8255
8256				for (i = 0; i < CTL_MAX_INITIATORS; i++) {
8257					if (lun->per_res[i+
8258					    persis_offset].registered == 0)
8259						continue;
8260
8261					lun->pending_sense[i
8262						].ua_pending |=
8263						CTL_UA_RES_RELEASE;
8264				}
8265			}
8266			lun->res_type = 0;
8267		} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
8268			if (lun->pr_key_count==0) {
8269				lun->flags &= ~CTL_LUN_PR_RESERVED;
8270				lun->res_type = 0;
8271				lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8272			}
8273		}
8274		lun->PRGeneration++;
8275		break;
8276
8277	case CTL_PR_RESERVE:
8278		lun->flags |= CTL_LUN_PR_RESERVED;
8279		lun->res_type = msg->pr.pr_info.res_type;
8280		lun->pr_res_idx = msg->pr.pr_info.residx;
8281
8282		break;
8283
8284	case CTL_PR_RELEASE:
8285		/*
8286		 * if this isn't an exclusive access res generate UA for all
8287		 * other registrants.
8288		 */
8289		if (lun->res_type != SPR_TYPE_EX_AC
8290		 && lun->res_type != SPR_TYPE_WR_EX) {
8291			for (i = 0; i < CTL_MAX_INITIATORS; i++)
8292				if (lun->per_res[i+persis_offset].registered)
8293					lun->pending_sense[i].ua_pending |=
8294						CTL_UA_RES_RELEASE;
8295		}
8296
8297		lun->flags &= ~CTL_LUN_PR_RESERVED;
8298		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8299		lun->res_type = 0;
8300		break;
8301
8302	case CTL_PR_PREEMPT:
8303		ctl_pro_preempt_other(lun, msg);
8304		break;
8305	case CTL_PR_CLEAR:
8306		lun->flags &= ~CTL_LUN_PR_RESERVED;
8307		lun->res_type = 0;
8308		lun->pr_key_count = 0;
8309		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8310
8311		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
8312			if (lun->per_res[i].registered == 0)
8313				continue;
8314			if (!persis_offset
8315			 && i < CTL_MAX_INITIATORS)
8316				lun->pending_sense[i].ua_pending |=
8317					CTL_UA_RES_PREEMPT;
8318			else if (persis_offset
8319			      && i >= persis_offset)
8320   				lun->pending_sense[i-persis_offset].ua_pending|=
8321					CTL_UA_RES_PREEMPT;
8322			memset(&lun->per_res[i].res_key, 0,
8323			       sizeof(struct scsi_per_res_key));
8324			lun->per_res[i].registered = 0;
8325		}
8326		lun->PRGeneration++;
8327		break;
8328	}
8329
8330	mtx_unlock(&softc->ctl_lock);
8331}
8332
8333int
8334ctl_read_write(struct ctl_scsiio *ctsio)
8335{
8336	struct ctl_lun *lun;
8337	struct ctl_lba_len lbalen;
8338	uint64_t lba;
8339	uint32_t num_blocks;
8340	int reladdr, fua, dpo, ebp;
8341	int retval;
8342	int isread;
8343
8344	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8345
8346	CTL_DEBUG_PRINT(("ctl_read_write: command: %#x\n", ctsio->cdb[0]));
8347
8348	reladdr = 0;
8349	fua = 0;
8350	dpo = 0;
8351	ebp = 0;
8352
8353	retval = CTL_RETVAL_COMPLETE;
8354
8355	isread = ctsio->cdb[0] == READ_6  || ctsio->cdb[0] == READ_10
8356	      || ctsio->cdb[0] == READ_12 || ctsio->cdb[0] == READ_16;
8357	if (lun->flags & CTL_LUN_PR_RESERVED && isread) {
8358		uint32_t residx;
8359
8360		/*
8361		 * XXX KDM need a lock here.
8362		 */
8363		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
8364		if ((lun->res_type == SPR_TYPE_EX_AC
8365		  && residx != lun->pr_res_idx)
8366		 || ((lun->res_type == SPR_TYPE_EX_AC_RO
8367		   || lun->res_type == SPR_TYPE_EX_AC_AR)
8368		  && !lun->per_res[residx].registered)) {
8369			ctl_set_reservation_conflict(ctsio);
8370			ctl_done((union ctl_io *)ctsio);
8371			return (CTL_RETVAL_COMPLETE);
8372	        }
8373	}
8374
8375	switch (ctsio->cdb[0]) {
8376	case READ_6:
8377	case WRITE_6: {
8378		struct scsi_rw_6 *cdb;
8379
8380		cdb = (struct scsi_rw_6 *)ctsio->cdb;
8381
8382		lba = scsi_3btoul(cdb->addr);
8383		/* only 5 bits are valid in the most significant address byte */
8384		lba &= 0x1fffff;
8385		num_blocks = cdb->length;
8386		/*
8387		 * This is correct according to SBC-2.
8388		 */
8389		if (num_blocks == 0)
8390			num_blocks = 256;
8391		break;
8392	}
8393	case READ_10:
8394	case WRITE_10: {
8395		struct scsi_rw_10 *cdb;
8396
8397		cdb = (struct scsi_rw_10 *)ctsio->cdb;
8398
8399		if (cdb->byte2 & SRW10_RELADDR)
8400			reladdr = 1;
8401		if (cdb->byte2 & SRW10_FUA)
8402			fua = 1;
8403		if (cdb->byte2 & SRW10_DPO)
8404			dpo = 1;
8405
8406		if ((cdb->opcode == WRITE_10)
8407		 && (cdb->byte2 & SRW10_EBP))
8408			ebp = 1;
8409
8410		lba = scsi_4btoul(cdb->addr);
8411		num_blocks = scsi_2btoul(cdb->length);
8412		break;
8413	}
8414	case WRITE_VERIFY_10: {
8415		struct scsi_write_verify_10 *cdb;
8416
8417		cdb = (struct scsi_write_verify_10 *)ctsio->cdb;
8418
8419		/*
8420		 * XXX KDM we should do actual write verify support at some
8421		 * point.  This is obviously fake, we're just translating
8422		 * things to a write.  So we don't even bother checking the
8423		 * BYTCHK field, since we don't do any verification.  If
8424		 * the user asks for it, we'll just pretend we did it.
8425		 */
8426		if (cdb->byte2 & SWV_DPO)
8427			dpo = 1;
8428
8429		lba = scsi_4btoul(cdb->addr);
8430		num_blocks = scsi_2btoul(cdb->length);
8431		break;
8432	}
8433	case READ_12:
8434	case WRITE_12: {
8435		struct scsi_rw_12 *cdb;
8436
8437		cdb = (struct scsi_rw_12 *)ctsio->cdb;
8438
8439		if (cdb->byte2 & SRW12_RELADDR)
8440			reladdr = 1;
8441		if (cdb->byte2 & SRW12_FUA)
8442			fua = 1;
8443		if (cdb->byte2 & SRW12_DPO)
8444			dpo = 1;
8445		lba = scsi_4btoul(cdb->addr);
8446		num_blocks = scsi_4btoul(cdb->length);
8447		break;
8448	}
8449	case WRITE_VERIFY_12: {
8450		struct scsi_write_verify_12 *cdb;
8451
8452		cdb = (struct scsi_write_verify_12 *)ctsio->cdb;
8453
8454		if (cdb->byte2 & SWV_DPO)
8455			dpo = 1;
8456
8457		lba = scsi_4btoul(cdb->addr);
8458		num_blocks = scsi_4btoul(cdb->length);
8459
8460		break;
8461	}
8462	case READ_16:
8463	case WRITE_16: {
8464		struct scsi_rw_16 *cdb;
8465
8466		cdb = (struct scsi_rw_16 *)ctsio->cdb;
8467
8468		if (cdb->byte2 & SRW12_RELADDR)
8469			reladdr = 1;
8470		if (cdb->byte2 & SRW12_FUA)
8471			fua = 1;
8472		if (cdb->byte2 & SRW12_DPO)
8473			dpo = 1;
8474
8475		lba = scsi_8btou64(cdb->addr);
8476		num_blocks = scsi_4btoul(cdb->length);
8477		break;
8478	}
8479	case WRITE_VERIFY_16: {
8480		struct scsi_write_verify_16 *cdb;
8481
8482		cdb = (struct scsi_write_verify_16 *)ctsio->cdb;
8483
8484		if (cdb->byte2 & SWV_DPO)
8485			dpo = 1;
8486
8487		lba = scsi_8btou64(cdb->addr);
8488		num_blocks = scsi_4btoul(cdb->length);
8489		break;
8490	}
8491	default:
8492		/*
8493		 * We got a command we don't support.  This shouldn't
8494		 * happen, commands should be filtered out above us.
8495		 */
8496		ctl_set_invalid_opcode(ctsio);
8497		ctl_done((union ctl_io *)ctsio);
8498
8499		return (CTL_RETVAL_COMPLETE);
8500		break; /* NOTREACHED */
8501	}
8502
8503	/*
8504	 * XXX KDM what do we do with the DPO and FUA bits?  FUA might be
8505	 * interesting for us, but if RAIDCore is in write-back mode,
8506	 * getting it to do write-through for a particular transaction may
8507	 * not be possible.
8508	 */
8509	/*
8510	 * We don't support relative addressing.  That also requires
8511	 * supporting linked commands, which we don't do.
8512	 */
8513	if (reladdr != 0) {
8514		ctl_set_invalid_field(ctsio,
8515				      /*sks_valid*/ 1,
8516				      /*command*/ 1,
8517				      /*field*/ 1,
8518				      /*bit_valid*/ 1,
8519				      /*bit*/ 0);
8520		ctl_done((union ctl_io *)ctsio);
8521		return (CTL_RETVAL_COMPLETE);
8522	}
8523
8524	/*
8525	 * The first check is to make sure we're in bounds, the second
8526	 * check is to catch wrap-around problems.  If the lba + num blocks
8527	 * is less than the lba, then we've wrapped around and the block
8528	 * range is invalid anyway.
8529	 */
8530	if (((lba + num_blocks) > (lun->be_lun->maxlba + 1))
8531	 || ((lba + num_blocks) < lba)) {
8532		ctl_set_lba_out_of_range(ctsio);
8533		ctl_done((union ctl_io *)ctsio);
8534		return (CTL_RETVAL_COMPLETE);
8535	}
8536
8537	/*
8538	 * According to SBC-3, a transfer length of 0 is not an error.
8539	 * Note that this cannot happen with WRITE(6) or READ(6), since 0
8540	 * translates to 256 blocks for those commands.
8541	 */
8542	if (num_blocks == 0) {
8543		ctl_set_success(ctsio);
8544		ctl_done((union ctl_io *)ctsio);
8545		return (CTL_RETVAL_COMPLETE);
8546	}
8547
8548	lbalen.lba = lba;
8549	lbalen.len = num_blocks;
8550	memcpy(ctsio->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes, &lbalen,
8551	       sizeof(lbalen));
8552
8553	CTL_DEBUG_PRINT(("ctl_read_write: calling data_submit()\n"));
8554
8555	retval = lun->backend->data_submit((union ctl_io *)ctsio);
8556
8557	return (retval);
8558}
8559
8560int
8561ctl_report_luns(struct ctl_scsiio *ctsio)
8562{
8563	struct scsi_report_luns *cdb;
8564	struct scsi_report_luns_data *lun_data;
8565	struct ctl_lun *lun, *request_lun;
8566	int num_luns, retval;
8567	uint32_t alloc_len, lun_datalen;
8568	int num_filled, well_known;
8569	uint32_t initidx;
8570
8571	retval = CTL_RETVAL_COMPLETE;
8572	well_known = 0;
8573
8574	cdb = (struct scsi_report_luns *)ctsio->cdb;
8575
8576	CTL_DEBUG_PRINT(("ctl_report_luns\n"));
8577
8578	mtx_lock(&control_softc->ctl_lock);
8579	num_luns = control_softc->num_luns;
8580	mtx_unlock(&control_softc->ctl_lock);
8581
8582	switch (cdb->select_report) {
8583	case RPL_REPORT_DEFAULT:
8584	case RPL_REPORT_ALL:
8585		break;
8586	case RPL_REPORT_WELLKNOWN:
8587		well_known = 1;
8588		num_luns = 0;
8589		break;
8590	default:
8591		ctl_set_invalid_field(ctsio,
8592				      /*sks_valid*/ 1,
8593				      /*command*/ 1,
8594				      /*field*/ 2,
8595				      /*bit_valid*/ 0,
8596				      /*bit*/ 0);
8597		ctl_done((union ctl_io *)ctsio);
8598		return (retval);
8599		break; /* NOTREACHED */
8600	}
8601
8602	alloc_len = scsi_4btoul(cdb->length);
8603	/*
8604	 * The initiator has to allocate at least 16 bytes for this request,
8605	 * so he can at least get the header and the first LUN.  Otherwise
8606	 * we reject the request (per SPC-3 rev 14, section 6.21).
8607	 */
8608	if (alloc_len < (sizeof(struct scsi_report_luns_data) +
8609	    sizeof(struct scsi_report_luns_lundata))) {
8610		ctl_set_invalid_field(ctsio,
8611				      /*sks_valid*/ 1,
8612				      /*command*/ 1,
8613				      /*field*/ 6,
8614				      /*bit_valid*/ 0,
8615				      /*bit*/ 0);
8616		ctl_done((union ctl_io *)ctsio);
8617		return (retval);
8618	}
8619
8620	request_lun = (struct ctl_lun *)
8621		ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8622
8623	lun_datalen = sizeof(*lun_data) +
8624		(num_luns * sizeof(struct scsi_report_luns_lundata));
8625
8626	ctsio->kern_data_ptr = malloc(lun_datalen, M_CTL, M_WAITOK);
8627	if (ctsio->kern_data_ptr == NULL) {
8628		ctsio->io_hdr.status = CTL_SCSI_ERROR;
8629		ctsio->scsi_status = SCSI_STATUS_BUSY;
8630		ctl_done((union ctl_io *)ctsio);
8631		return (CTL_RETVAL_COMPLETE);
8632	}
8633
8634	lun_data = (struct scsi_report_luns_data *)ctsio->kern_data_ptr;
8635	ctsio->kern_sg_entries = 0;
8636
8637	if (lun_datalen < alloc_len) {
8638		ctsio->residual = alloc_len - lun_datalen;
8639		ctsio->kern_data_len = lun_datalen;
8640		ctsio->kern_total_len = lun_datalen;
8641	} else {
8642		ctsio->residual = 0;
8643		ctsio->kern_data_len = alloc_len;
8644		ctsio->kern_total_len = alloc_len;
8645	}
8646	ctsio->kern_data_resid = 0;
8647	ctsio->kern_rel_offset = 0;
8648	ctsio->kern_sg_entries = 0;
8649
8650	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
8651
8652	memset(lun_data, 0, lun_datalen);
8653
8654	/*
8655	 * We set this to the actual data length, regardless of how much
8656	 * space we actually have to return results.  If the user looks at
8657	 * this value, he'll know whether or not he allocated enough space
8658	 * and reissue the command if necessary.  We don't support well
8659	 * known logical units, so if the user asks for that, return none.
8660	 */
8661	scsi_ulto4b(lun_datalen - 8, lun_data->length);
8662
8663	mtx_lock(&control_softc->ctl_lock);
8664	for (num_filled = 0, lun = STAILQ_FIRST(&control_softc->lun_list);
8665	     (lun != NULL) && (num_filled < num_luns);
8666	     lun = STAILQ_NEXT(lun, links)) {
8667
8668		if (lun->lun <= 0xff) {
8669			/*
8670			 * Peripheral addressing method, bus number 0.
8671			 */
8672			lun_data->luns[num_filled].lundata[0] =
8673				RPL_LUNDATA_ATYP_PERIPH;
8674			lun_data->luns[num_filled].lundata[1] = lun->lun;
8675			num_filled++;
8676		} else if (lun->lun <= 0x3fff) {
8677			/*
8678			 * Flat addressing method.
8679			 */
8680			lun_data->luns[num_filled].lundata[0] =
8681				RPL_LUNDATA_ATYP_FLAT |
8682				(lun->lun & RPL_LUNDATA_FLAT_LUN_MASK);
8683#ifdef OLDCTLHEADERS
8684				(SRLD_ADDR_FLAT << SRLD_ADDR_SHIFT) |
8685				(lun->lun & SRLD_BUS_LUN_MASK);
8686#endif
8687			lun_data->luns[num_filled].lundata[1] =
8688#ifdef OLDCTLHEADERS
8689				lun->lun >> SRLD_BUS_LUN_BITS;
8690#endif
8691				lun->lun >> RPL_LUNDATA_FLAT_LUN_BITS;
8692			num_filled++;
8693		} else {
8694			printf("ctl_report_luns: bogus LUN number %jd, "
8695			       "skipping\n", (intmax_t)lun->lun);
8696		}
8697		/*
8698		 * According to SPC-3, rev 14 section 6.21:
8699		 *
8700		 * "The execution of a REPORT LUNS command to any valid and
8701		 * installed logical unit shall clear the REPORTED LUNS DATA
8702		 * HAS CHANGED unit attention condition for all logical
8703		 * units of that target with respect to the requesting
8704		 * initiator. A valid and installed logical unit is one
8705		 * having a PERIPHERAL QUALIFIER of 000b in the standard
8706		 * INQUIRY data (see 6.4.2)."
8707		 *
8708		 * If request_lun is NULL, the LUN this report luns command
8709		 * was issued to is either disabled or doesn't exist. In that
8710		 * case, we shouldn't clear any pending lun change unit
8711		 * attention.
8712		 */
8713		if (request_lun != NULL)
8714			lun->pending_sense[initidx].ua_pending &=
8715				~CTL_UA_LUN_CHANGE;
8716	}
8717	mtx_unlock(&control_softc->ctl_lock);
8718
8719	/*
8720	 * We can only return SCSI_STATUS_CHECK_COND when we can't satisfy
8721	 * this request.
8722	 */
8723	ctsio->scsi_status = SCSI_STATUS_OK;
8724
8725	ctsio->be_move_done = ctl_config_move_done;
8726	ctl_datamove((union ctl_io *)ctsio);
8727
8728	return (retval);
8729}
8730
8731int
8732ctl_request_sense(struct ctl_scsiio *ctsio)
8733{
8734	struct scsi_request_sense *cdb;
8735	struct scsi_sense_data *sense_ptr;
8736	struct ctl_lun *lun;
8737	uint32_t initidx;
8738	int have_error;
8739	ctl_sense_format sense_format;
8740
8741	cdb = (struct scsi_request_sense *)ctsio->cdb;
8742
8743	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8744
8745	CTL_DEBUG_PRINT(("ctl_request_sense\n"));
8746
8747	/*
8748	 * Determine which sense format the user wants.
8749	 */
8750	if (cdb->byte2 & SRS_DESC)
8751		sense_format = CTL_SENSE_DESCRIPTOR;
8752	else
8753		sense_format = CTL_SENSE_FIXED;
8754
8755	ctsio->kern_data_ptr = malloc(sizeof(*sense_ptr), M_CTL, M_WAITOK);
8756	if (ctsio->kern_data_ptr == NULL) {
8757		ctsio->io_hdr.status = CTL_SCSI_ERROR;
8758		ctsio->scsi_status = SCSI_STATUS_BUSY;
8759		ctl_done((union ctl_io *)ctsio);
8760		return (CTL_RETVAL_COMPLETE);
8761	}
8762	sense_ptr = (struct scsi_sense_data *)ctsio->kern_data_ptr;
8763	ctsio->kern_sg_entries = 0;
8764
8765	/*
8766	 * struct scsi_sense_data, which is currently set to 256 bytes, is
8767	 * larger than the largest allowed value for the length field in the
8768	 * REQUEST SENSE CDB, which is 252 bytes as of SPC-4.
8769	 */
8770	ctsio->residual = 0;
8771	ctsio->kern_data_len = cdb->length;
8772	ctsio->kern_total_len = cdb->length;
8773
8774	ctsio->kern_data_resid = 0;
8775	ctsio->kern_rel_offset = 0;
8776	ctsio->kern_sg_entries = 0;
8777
8778	/*
8779	 * If we don't have a LUN, we don't have any pending sense.
8780	 */
8781	if (lun == NULL)
8782		goto no_sense;
8783
8784	have_error = 0;
8785	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
8786	/*
8787	 * Check for pending sense, and then for pending unit attentions.
8788	 * Pending sense gets returned first, then pending unit attentions.
8789	 */
8790	mtx_lock(&lun->ctl_softc->ctl_lock);
8791	if (ctl_is_set(lun->have_ca, initidx)) {
8792		ctl_sense_format stored_format;
8793
8794		/*
8795		 * Check to see which sense format was used for the stored
8796		 * sense data.
8797		 */
8798		stored_format = ctl_get_sense_format(
8799		    &lun->pending_sense[initidx].sense);
8800
8801		/*
8802		 * If the user requested a different sense format than the
8803		 * one we stored, then we need to convert it to the other
8804		 * format.  If we're going from descriptor to fixed format
8805		 * sense data, we may lose things in translation, depending
8806		 * on what options were used.
8807		 */
8808		if ((stored_format == CTL_SENSE_FIXED)
8809		 && (sense_format == CTL_SENSE_DESCRIPTOR))
8810			ctl_sense_to_desc((struct scsi_sense_data_fixed *)
8811			    &lun->pending_sense[initidx].sense,
8812			    (struct scsi_sense_data_desc *)sense_ptr);
8813		else if ((stored_format == CTL_SENSE_DESCRIPTOR)
8814		      && (sense_format == CTL_SENSE_FIXED))
8815			ctl_sense_to_fixed((struct scsi_sense_data_desc *)
8816			    &lun->pending_sense[initidx].sense,
8817			    (struct scsi_sense_data_fixed *)sense_ptr);
8818		else
8819			memcpy(sense_ptr, &lun->pending_sense[initidx].sense,
8820			       ctl_min(sizeof(*sense_ptr),
8821			       sizeof(lun->pending_sense[initidx].sense)));
8822
8823		ctl_clear_mask(lun->have_ca, initidx);
8824		have_error = 1;
8825	} else if (lun->pending_sense[initidx].ua_pending != CTL_UA_NONE) {
8826		ctl_ua_type ua_type;
8827
8828		ua_type = ctl_build_ua(lun->pending_sense[initidx].ua_pending,
8829				       sense_ptr, sense_format);
8830		if (ua_type != CTL_UA_NONE) {
8831			have_error = 1;
8832			/* We're reporting this UA, so clear it */
8833			lun->pending_sense[initidx].ua_pending &= ~ua_type;
8834		}
8835	}
8836	mtx_unlock(&lun->ctl_softc->ctl_lock);
8837
8838	/*
8839	 * We already have a pending error, return it.
8840	 */
8841	if (have_error != 0) {
8842		/*
8843		 * We report the SCSI status as OK, since the status of the
8844		 * request sense command itself is OK.
8845		 */
8846		ctsio->scsi_status = SCSI_STATUS_OK;
8847
8848		/*
8849		 * We report 0 for the sense length, because we aren't doing
8850		 * autosense in this case.  We're reporting sense as
8851		 * parameter data.
8852		 */
8853		ctsio->sense_len = 0;
8854
8855		ctsio->be_move_done = ctl_config_move_done;
8856		ctl_datamove((union ctl_io *)ctsio);
8857
8858		return (CTL_RETVAL_COMPLETE);
8859	}
8860
8861no_sense:
8862
8863	/*
8864	 * No sense information to report, so we report that everything is
8865	 * okay.
8866	 */
8867	ctl_set_sense_data(sense_ptr,
8868			   lun,
8869			   sense_format,
8870			   /*current_error*/ 1,
8871			   /*sense_key*/ SSD_KEY_NO_SENSE,
8872			   /*asc*/ 0x00,
8873			   /*ascq*/ 0x00,
8874			   SSD_ELEM_NONE);
8875
8876	ctsio->scsi_status = SCSI_STATUS_OK;
8877
8878	/*
8879	 * We report 0 for the sense length, because we aren't doing
8880	 * autosense in this case.  We're reporting sense as parameter data.
8881	 */
8882	ctsio->sense_len = 0;
8883	ctsio->be_move_done = ctl_config_move_done;
8884	ctl_datamove((union ctl_io *)ctsio);
8885
8886	return (CTL_RETVAL_COMPLETE);
8887}
8888
8889int
8890ctl_tur(struct ctl_scsiio *ctsio)
8891{
8892	struct ctl_lun *lun;
8893
8894	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8895
8896	CTL_DEBUG_PRINT(("ctl_tur\n"));
8897
8898	if (lun == NULL)
8899		return (-EINVAL);
8900
8901	ctsio->scsi_status = SCSI_STATUS_OK;
8902	ctsio->io_hdr.status = CTL_SUCCESS;
8903
8904	ctl_done((union ctl_io *)ctsio);
8905
8906	return (CTL_RETVAL_COMPLETE);
8907}
8908
8909#ifdef notyet
8910static int
8911ctl_cmddt_inquiry(struct ctl_scsiio *ctsio)
8912{
8913
8914}
8915#endif
8916
8917static int
8918ctl_inquiry_evpd_supported(struct ctl_scsiio *ctsio, int alloc_len)
8919{
8920	struct scsi_vpd_supported_pages *pages;
8921	int sup_page_size;
8922	struct ctl_lun *lun;
8923
8924	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8925
8926	sup_page_size = sizeof(struct scsi_vpd_supported_pages) +
8927		SCSI_EVPD_NUM_SUPPORTED_PAGES;
8928	/*
8929	 * XXX KDM GFP_???  We probably don't want to wait here,
8930	 * unless we end up having a process/thread context.
8931	 */
8932	ctsio->kern_data_ptr = malloc(sup_page_size, M_CTL, M_WAITOK);
8933	if (ctsio->kern_data_ptr == NULL) {
8934		ctsio->io_hdr.status = CTL_SCSI_ERROR;
8935		ctsio->scsi_status = SCSI_STATUS_BUSY;
8936		ctl_done((union ctl_io *)ctsio);
8937		return (CTL_RETVAL_COMPLETE);
8938	}
8939	pages = (struct scsi_vpd_supported_pages *)ctsio->kern_data_ptr;
8940	ctsio->kern_sg_entries = 0;
8941
8942	if (sup_page_size < alloc_len) {
8943		ctsio->residual = alloc_len - sup_page_size;
8944		ctsio->kern_data_len = sup_page_size;
8945		ctsio->kern_total_len = sup_page_size;
8946	} else {
8947		ctsio->residual = 0;
8948		ctsio->kern_data_len = alloc_len;
8949		ctsio->kern_total_len = alloc_len;
8950	}
8951	ctsio->kern_data_resid = 0;
8952	ctsio->kern_rel_offset = 0;
8953	ctsio->kern_sg_entries = 0;
8954
8955	memset(pages, 0, sup_page_size);
8956
8957	/*
8958	 * The control device is always connected.  The disk device, on the
8959	 * other hand, may not be online all the time.  Need to change this
8960	 * to figure out whether the disk device is actually online or not.
8961	 */
8962	if (lun != NULL)
8963		pages->device = (SID_QUAL_LU_CONNECTED << 5) |
8964				lun->be_lun->lun_type;
8965	else
8966		pages->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
8967
8968	pages->length = SCSI_EVPD_NUM_SUPPORTED_PAGES;
8969	/* Supported VPD pages */
8970	pages->page_list[0] = SVPD_SUPPORTED_PAGES;
8971	/* Serial Number */
8972	pages->page_list[1] = SVPD_UNIT_SERIAL_NUMBER;
8973	/* Device Identification */
8974	pages->page_list[2] = SVPD_DEVICE_ID;
8975
8976	ctsio->scsi_status = SCSI_STATUS_OK;
8977
8978	ctsio->be_move_done = ctl_config_move_done;
8979	ctl_datamove((union ctl_io *)ctsio);
8980
8981	return (CTL_RETVAL_COMPLETE);
8982}
8983
8984static int
8985ctl_inquiry_evpd_serial(struct ctl_scsiio *ctsio, int alloc_len)
8986{
8987	struct scsi_vpd_unit_serial_number *sn_ptr;
8988	struct ctl_lun *lun;
8989#ifndef CTL_USE_BACKEND_SN
8990	char tmpstr[32];
8991#endif
8992
8993	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8994
8995	/* XXX KDM which malloc flags here?? */
8996	ctsio->kern_data_ptr = malloc(sizeof(*sn_ptr), M_CTL, M_WAITOK);
8997	if (ctsio->kern_data_ptr == NULL) {
8998		ctsio->io_hdr.status = CTL_SCSI_ERROR;
8999		ctsio->scsi_status = SCSI_STATUS_BUSY;
9000		ctl_done((union ctl_io *)ctsio);
9001		return (CTL_RETVAL_COMPLETE);
9002	}
9003	sn_ptr = (struct scsi_vpd_unit_serial_number *)ctsio->kern_data_ptr;
9004	ctsio->kern_sg_entries = 0;
9005
9006	if (sizeof(*sn_ptr) < alloc_len) {
9007		ctsio->residual = alloc_len - sizeof(*sn_ptr);
9008		ctsio->kern_data_len = sizeof(*sn_ptr);
9009		ctsio->kern_total_len = sizeof(*sn_ptr);
9010	} else {
9011		ctsio->residual = 0;
9012		ctsio->kern_data_len = alloc_len;
9013		ctsio->kern_total_len = alloc_len;
9014	}
9015	ctsio->kern_data_resid = 0;
9016	ctsio->kern_rel_offset = 0;
9017	ctsio->kern_sg_entries = 0;
9018
9019	memset(sn_ptr, 0, sizeof(*sn_ptr));
9020
9021	/*
9022	 * The control device is always connected.  The disk device, on the
9023	 * other hand, may not be online all the time.  Need to change this
9024	 * to figure out whether the disk device is actually online or not.
9025	 */
9026	if (lun != NULL)
9027		sn_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
9028				  lun->be_lun->lun_type;
9029	else
9030		sn_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
9031
9032	sn_ptr->page_code = SVPD_UNIT_SERIAL_NUMBER;
9033	sn_ptr->length = ctl_min(sizeof(*sn_ptr) - 4, CTL_SN_LEN);
9034#ifdef CTL_USE_BACKEND_SN
9035	/*
9036	 * If we don't have a LUN, we just leave the serial number as
9037	 * all spaces.
9038	 */
9039	memset(sn_ptr->serial_num, 0x20, sizeof(sn_ptr->serial_num));
9040	if (lun != NULL) {
9041		strncpy((char *)sn_ptr->serial_num,
9042			(char *)lun->be_lun->serial_num, CTL_SN_LEN);
9043	}
9044#else
9045	/*
9046	 * Note that we're using a non-unique serial number here,
9047	 */
9048	snprintf(tmpstr, sizeof(tmpstr), "MYSERIALNUMIS000");
9049	memset(sn_ptr->serial_num, 0x20, sizeof(sn_ptr->serial_num));
9050	strncpy(sn_ptr->serial_num, tmpstr, ctl_min(CTL_SN_LEN,
9051		ctl_min(sizeof(tmpstr), sizeof(*sn_ptr) - 4)));
9052#endif
9053	ctsio->scsi_status = SCSI_STATUS_OK;
9054
9055	ctsio->be_move_done = ctl_config_move_done;
9056	ctl_datamove((union ctl_io *)ctsio);
9057
9058	return (CTL_RETVAL_COMPLETE);
9059}
9060
9061
9062static int
9063ctl_inquiry_evpd_devid(struct ctl_scsiio *ctsio, int alloc_len)
9064{
9065	struct scsi_vpd_device_id *devid_ptr;
9066	struct scsi_vpd_id_descriptor *desc, *desc1;
9067	struct scsi_vpd_id_descriptor *desc2, *desc3; /* for types 4h and 5h */
9068	struct scsi_vpd_id_t10 *t10id;
9069	struct ctl_softc *ctl_softc;
9070	struct ctl_lun *lun;
9071	struct ctl_frontend *fe;
9072#ifndef CTL_USE_BACKEND_SN
9073	char tmpstr[32];
9074#endif /* CTL_USE_BACKEND_SN */
9075	int devid_len;
9076
9077	ctl_softc = control_softc;
9078	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
9079
9080	devid_len = sizeof(struct scsi_vpd_device_id) +
9081		sizeof(struct scsi_vpd_id_descriptor) +
9082		sizeof(struct scsi_vpd_id_t10) + CTL_DEVID_LEN +
9083		sizeof(struct scsi_vpd_id_descriptor) + CTL_WWPN_LEN +
9084		sizeof(struct scsi_vpd_id_descriptor) +
9085		sizeof(struct scsi_vpd_id_rel_trgt_port_id) +
9086		sizeof(struct scsi_vpd_id_descriptor) +
9087		sizeof(struct scsi_vpd_id_trgt_port_grp_id);
9088
9089	/* XXX KDM which malloc flags here ?? */
9090	ctsio->kern_data_ptr = malloc(devid_len, M_CTL, M_WAITOK);
9091	if (ctsio->kern_data_ptr == NULL) {
9092		ctsio->io_hdr.status = CTL_SCSI_ERROR;
9093		ctsio->scsi_status = SCSI_STATUS_BUSY;
9094		ctl_done((union ctl_io *)ctsio);
9095		return (CTL_RETVAL_COMPLETE);
9096	}
9097	devid_ptr = (struct scsi_vpd_device_id *)ctsio->kern_data_ptr;
9098	ctsio->kern_sg_entries = 0;
9099
9100	if (devid_len < alloc_len) {
9101		ctsio->residual = alloc_len - devid_len;
9102		ctsio->kern_data_len = devid_len;
9103		ctsio->kern_total_len = devid_len;
9104	} else {
9105		ctsio->residual = 0;
9106		ctsio->kern_data_len = alloc_len;
9107		ctsio->kern_total_len = alloc_len;
9108	}
9109	ctsio->kern_data_resid = 0;
9110	ctsio->kern_rel_offset = 0;
9111	ctsio->kern_sg_entries = 0;
9112
9113	desc = (struct scsi_vpd_id_descriptor *)devid_ptr->desc_list;
9114	t10id = (struct scsi_vpd_id_t10 *)&desc->identifier[0];
9115	desc1 = (struct scsi_vpd_id_descriptor *)(&desc->identifier[0] +
9116		sizeof(struct scsi_vpd_id_t10) + CTL_DEVID_LEN);
9117	desc2 = (struct scsi_vpd_id_descriptor *)(&desc1->identifier[0] +
9118	          CTL_WWPN_LEN);
9119	desc3 = (struct scsi_vpd_id_descriptor *)(&desc2->identifier[0] +
9120	         sizeof(struct scsi_vpd_id_rel_trgt_port_id));
9121	memset(devid_ptr, 0, devid_len);
9122
9123	/*
9124	 * The control device is always connected.  The disk device, on the
9125	 * other hand, may not be online all the time.
9126	 */
9127	if (lun != NULL)
9128		devid_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
9129				     lun->be_lun->lun_type;
9130	else
9131		devid_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
9132
9133	devid_ptr->page_code = SVPD_DEVICE_ID;
9134
9135	scsi_ulto2b(devid_len - 4, devid_ptr->length);
9136
9137	mtx_lock(&ctl_softc->ctl_lock);
9138
9139	fe = ctl_softc->ctl_ports[ctl_port_idx(ctsio->io_hdr.nexus.targ_port)];
9140
9141	/*
9142	 * For Fibre channel,
9143	 */
9144	if (fe->port_type == CTL_PORT_FC)
9145	{
9146		desc->proto_codeset = (SCSI_PROTO_FC << 4) |
9147				      SVPD_ID_CODESET_ASCII;
9148        	desc1->proto_codeset = (SCSI_PROTO_FC << 4) |
9149		              SVPD_ID_CODESET_BINARY;
9150	}
9151	else
9152	{
9153		desc->proto_codeset = (SCSI_PROTO_SPI << 4) |
9154				      SVPD_ID_CODESET_ASCII;
9155        	desc1->proto_codeset = (SCSI_PROTO_SPI << 4) |
9156		              SVPD_ID_CODESET_BINARY;
9157	}
9158	desc2->proto_codeset = desc3->proto_codeset = desc1->proto_codeset;
9159	mtx_unlock(&ctl_softc->ctl_lock);
9160
9161	/*
9162	 * We're using a LUN association here.  i.e., this device ID is a
9163	 * per-LUN identifier.
9164	 */
9165	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_LUN | SVPD_ID_TYPE_T10;
9166	desc->length = sizeof(*t10id) + CTL_DEVID_LEN;
9167	strncpy((char *)t10id->vendor, CTL_VENDOR, sizeof(t10id->vendor));
9168
9169	/*
9170	 * desc1 is for the WWPN which is a port asscociation.
9171	 */
9172	desc1->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT | SVPD_ID_TYPE_NAA;
9173	desc1->length = CTL_WWPN_LEN;
9174	/* XXX Call Reggie's get_WWNN func here then add port # to the end */
9175	/* For testing just create the WWPN */
9176#if 0
9177	ddb_GetWWNN((char *)desc1->identifier);
9178
9179	/* NOTE: if the port is 0 or 8 we don't want to subtract 1 */
9180	/* This is so Copancontrol will return something sane */
9181	if (ctsio->io_hdr.nexus.targ_port!=0 &&
9182	    ctsio->io_hdr.nexus.targ_port!=8)
9183		desc1->identifier[7] += ctsio->io_hdr.nexus.targ_port-1;
9184	else
9185		desc1->identifier[7] += ctsio->io_hdr.nexus.targ_port;
9186#endif
9187
9188	be64enc(desc1->identifier, fe->wwpn);
9189
9190	/*
9191	 * desc2 is for the Relative Target Port(type 4h) identifier
9192	 */
9193	desc2->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT
9194	                 | SVPD_ID_TYPE_RELTARG;
9195	desc2->length = 4;
9196//#if 0
9197	/* NOTE: if the port is 0 or 8 we don't want to subtract 1 */
9198	/* This is so Copancontrol will return something sane */
9199	if (ctsio->io_hdr.nexus.targ_port!=0 &&
9200	    ctsio->io_hdr.nexus.targ_port!=8)
9201		desc2->identifier[3] = ctsio->io_hdr.nexus.targ_port - 1;
9202	else
9203	        desc2->identifier[3] = ctsio->io_hdr.nexus.targ_port;
9204//#endif
9205
9206	/*
9207	 * desc3 is for the Target Port Group(type 5h) identifier
9208	 */
9209	desc3->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT
9210	                 | SVPD_ID_TYPE_TPORTGRP;
9211	desc3->length = 4;
9212	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS || ctl_is_single)
9213		desc3->identifier[3] = 1;
9214	else
9215		desc3->identifier[3] = 2;
9216
9217#ifdef CTL_USE_BACKEND_SN
9218	/*
9219	 * If we've actually got a backend, copy the device id from the
9220	 * per-LUN data.  Otherwise, set it to all spaces.
9221	 */
9222	if (lun != NULL) {
9223		/*
9224		 * Copy the backend's LUN ID.
9225		 */
9226		strncpy((char *)t10id->vendor_spec_id,
9227			(char *)lun->be_lun->device_id, CTL_DEVID_LEN);
9228	} else {
9229		/*
9230		 * No backend, set this to spaces.
9231		 */
9232		memset(t10id->vendor_spec_id, 0x20, CTL_DEVID_LEN);
9233	}
9234#else
9235	snprintf(tmpstr, sizeof(tmpstr), "MYDEVICEIDIS%4d",
9236		 (lun != NULL) ?  (int)lun->lun : 0);
9237	strncpy(t10id->vendor_spec_id, tmpstr, ctl_min(CTL_DEVID_LEN,
9238		sizeof(tmpstr)));
9239#endif
9240
9241	ctsio->scsi_status = SCSI_STATUS_OK;
9242
9243	ctsio->be_move_done = ctl_config_move_done;
9244	ctl_datamove((union ctl_io *)ctsio);
9245
9246	return (CTL_RETVAL_COMPLETE);
9247}
9248
9249static int
9250ctl_inquiry_evpd(struct ctl_scsiio *ctsio)
9251{
9252	struct scsi_inquiry *cdb;
9253	int alloc_len, retval;
9254
9255	cdb = (struct scsi_inquiry *)ctsio->cdb;
9256
9257	retval = CTL_RETVAL_COMPLETE;
9258
9259	alloc_len = scsi_2btoul(cdb->length);
9260
9261	switch (cdb->page_code) {
9262	case SVPD_SUPPORTED_PAGES:
9263		retval = ctl_inquiry_evpd_supported(ctsio, alloc_len);
9264		break;
9265	case SVPD_UNIT_SERIAL_NUMBER:
9266		retval = ctl_inquiry_evpd_serial(ctsio, alloc_len);
9267		break;
9268	case SVPD_DEVICE_ID:
9269		retval = ctl_inquiry_evpd_devid(ctsio, alloc_len);
9270		break;
9271	default:
9272		ctl_set_invalid_field(ctsio,
9273				      /*sks_valid*/ 1,
9274				      /*command*/ 1,
9275				      /*field*/ 2,
9276				      /*bit_valid*/ 0,
9277				      /*bit*/ 0);
9278		ctl_done((union ctl_io *)ctsio);
9279		retval = CTL_RETVAL_COMPLETE;
9280		break;
9281	}
9282
9283	return (retval);
9284}
9285
9286static int
9287ctl_inquiry_std(struct ctl_scsiio *ctsio)
9288{
9289	struct scsi_inquiry_data *inq_ptr;
9290	struct scsi_inquiry *cdb;
9291	struct ctl_softc *ctl_softc;
9292	struct ctl_lun *lun;
9293	uint32_t alloc_len;
9294	int is_fc;
9295
9296	ctl_softc = control_softc;
9297
9298	/*
9299	 * Figure out whether we're talking to a Fibre Channel port or not.
9300	 * We treat the ioctl front end, and any SCSI adapters, as packetized
9301	 * SCSI front ends.
9302	 */
9303	mtx_lock(&ctl_softc->ctl_lock);
9304	if (ctl_softc->ctl_ports[ctl_port_idx(ctsio->io_hdr.nexus.targ_port)]->port_type !=
9305	    CTL_PORT_FC)
9306		is_fc = 0;
9307	else
9308		is_fc = 1;
9309	mtx_unlock(&ctl_softc->ctl_lock);
9310
9311	lun = ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
9312	cdb = (struct scsi_inquiry *)ctsio->cdb;
9313	alloc_len = scsi_2btoul(cdb->length);
9314
9315	/*
9316	 * We malloc the full inquiry data size here and fill it
9317	 * in.  If the user only asks for less, we'll give him
9318	 * that much.
9319	 */
9320	/* XXX KDM what malloc flags should we use here?? */
9321	ctsio->kern_data_ptr = malloc(sizeof(*inq_ptr), M_CTL, M_WAITOK);
9322	if (ctsio->kern_data_ptr == NULL) {
9323		ctsio->io_hdr.status = CTL_SCSI_ERROR;
9324		ctsio->scsi_status = SCSI_STATUS_BUSY;
9325		ctl_done((union ctl_io *)ctsio);
9326		return (CTL_RETVAL_COMPLETE);
9327	}
9328	inq_ptr = (struct scsi_inquiry_data *)ctsio->kern_data_ptr;
9329	ctsio->kern_sg_entries = 0;
9330	ctsio->kern_data_resid = 0;
9331	ctsio->kern_rel_offset = 0;
9332
9333	if (sizeof(*inq_ptr) < alloc_len) {
9334		ctsio->residual = alloc_len - sizeof(*inq_ptr);
9335		ctsio->kern_data_len = sizeof(*inq_ptr);
9336		ctsio->kern_total_len = sizeof(*inq_ptr);
9337	} else {
9338		ctsio->residual = 0;
9339		ctsio->kern_data_len = alloc_len;
9340		ctsio->kern_total_len = alloc_len;
9341	}
9342
9343	memset(inq_ptr, 0, sizeof(*inq_ptr));
9344
9345	/*
9346	 * The control device is always connected.  The disk device, on the
9347	 * other hand, may not be online all the time.  If we don't have a
9348	 * LUN mapping, we'll just say it's offline.
9349	 */
9350	if (lun != NULL)
9351		inq_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
9352				  lun->be_lun->lun_type;
9353	else
9354		inq_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
9355
9356	/* RMB in byte 2 is 0 */
9357	inq_ptr->version = SCSI_REV_SPC3;
9358
9359	/*
9360	 * According to SAM-3, even if a device only supports a single
9361	 * level of LUN addressing, it should still set the HISUP bit:
9362	 *
9363	 * 4.9.1 Logical unit numbers overview
9364	 *
9365	 * All logical unit number formats described in this standard are
9366	 * hierarchical in structure even when only a single level in that
9367	 * hierarchy is used. The HISUP bit shall be set to one in the
9368	 * standard INQUIRY data (see SPC-2) when any logical unit number
9369	 * format described in this standard is used.  Non-hierarchical
9370	 * formats are outside the scope of this standard.
9371	 *
9372	 * Therefore we set the HiSup bit here.
9373	 *
9374	 * The reponse format is 2, per SPC-3.
9375	 */
9376	inq_ptr->response_format = SID_HiSup | 2;
9377
9378	inq_ptr->additional_length = sizeof(*inq_ptr) - 4;
9379	CTL_DEBUG_PRINT(("additional_length = %d\n",
9380			 inq_ptr->additional_length));
9381
9382	inq_ptr->spc3_flags = SPC3_SID_TPGS_IMPLICIT;
9383	/* 16 bit addressing */
9384	if (is_fc == 0)
9385		inq_ptr->spc2_flags = SPC2_SID_ADDR16;
9386	/* XXX set the SID_MultiP bit here if we're actually going to
9387	   respond on multiple ports */
9388	inq_ptr->spc2_flags |= SPC2_SID_MultiP;
9389
9390	/* 16 bit data bus, synchronous transfers */
9391	/* XXX these flags don't apply for FC */
9392	if (is_fc == 0)
9393		inq_ptr->flags = SID_WBus16 | SID_Sync;
9394	/*
9395	 * XXX KDM do we want to support tagged queueing on the control
9396	 * device at all?
9397	 */
9398	if ((lun == NULL)
9399	 || (lun->be_lun->lun_type != T_PROCESSOR))
9400		inq_ptr->flags |= SID_CmdQue;
9401	/*
9402	 * Per SPC-3, unused bytes in ASCII strings are filled with spaces.
9403	 * We have 8 bytes for the vendor name, and 16 bytes for the device
9404	 * name and 4 bytes for the revision.
9405	 */
9406	strncpy(inq_ptr->vendor, CTL_VENDOR, sizeof(inq_ptr->vendor));
9407	if (lun == NULL) {
9408		strcpy(inq_ptr->product, CTL_DIRECT_PRODUCT);
9409	} else {
9410		switch (lun->be_lun->lun_type) {
9411		case T_DIRECT:
9412			strcpy(inq_ptr->product, CTL_DIRECT_PRODUCT);
9413			break;
9414		case T_PROCESSOR:
9415			strcpy(inq_ptr->product, CTL_PROCESSOR_PRODUCT);
9416			break;
9417		default:
9418			strcpy(inq_ptr->product, CTL_UNKNOWN_PRODUCT);
9419			break;
9420		}
9421	}
9422
9423	/*
9424	 * XXX make this a macro somewhere so it automatically gets
9425	 * incremented when we make changes.
9426	 */
9427	strncpy(inq_ptr->revision, "0001", sizeof(inq_ptr->revision));
9428
9429	/*
9430	 * For parallel SCSI, we support double transition and single
9431	 * transition clocking.  We also support QAS (Quick Arbitration
9432	 * and Selection) and Information Unit transfers on both the
9433	 * control and array devices.
9434	 */
9435	if (is_fc == 0)
9436		inq_ptr->spi3data = SID_SPI_CLOCK_DT_ST | SID_SPI_QAS |
9437				    SID_SPI_IUS;
9438
9439	/* SAM-3 */
9440	scsi_ulto2b(0x0060, inq_ptr->version1);
9441	/* SPC-3 (no version claimed) XXX should we claim a version? */
9442	scsi_ulto2b(0x0300, inq_ptr->version2);
9443	if (is_fc) {
9444		/* FCP-2 ANSI INCITS.350:2003 */
9445		scsi_ulto2b(0x0917, inq_ptr->version3);
9446	} else {
9447		/* SPI-4 ANSI INCITS.362:200x */
9448		scsi_ulto2b(0x0B56, inq_ptr->version3);
9449	}
9450
9451	if (lun == NULL) {
9452		/* SBC-2 (no version claimed) XXX should we claim a version? */
9453		scsi_ulto2b(0x0320, inq_ptr->version4);
9454	} else {
9455		switch (lun->be_lun->lun_type) {
9456		case T_DIRECT:
9457			/*
9458			 * SBC-2 (no version claimed) XXX should we claim a
9459			 * version?
9460			 */
9461			scsi_ulto2b(0x0320, inq_ptr->version4);
9462			break;
9463		case T_PROCESSOR:
9464		default:
9465			break;
9466		}
9467	}
9468	sprintf((char *)inq_ptr->vendor_specific1, "Copyright (C) 2004, COPAN "
9469		"Systems, Inc.  All Rights Reserved.");
9470
9471	ctsio->scsi_status = SCSI_STATUS_OK;
9472	if (ctsio->kern_data_len > 0) {
9473		ctsio->be_move_done = ctl_config_move_done;
9474		ctl_datamove((union ctl_io *)ctsio);
9475	} else {
9476		ctsio->io_hdr.status = CTL_SUCCESS;
9477		ctl_done((union ctl_io *)ctsio);
9478	}
9479
9480	return (CTL_RETVAL_COMPLETE);
9481}
9482
9483int
9484ctl_inquiry(struct ctl_scsiio *ctsio)
9485{
9486	struct scsi_inquiry *cdb;
9487	int retval;
9488
9489	cdb = (struct scsi_inquiry *)ctsio->cdb;
9490
9491	retval = 0;
9492
9493	CTL_DEBUG_PRINT(("ctl_inquiry\n"));
9494
9495	/*
9496	 * Right now, we don't support the CmdDt inquiry information.
9497	 * This would be nice to support in the future.  When we do
9498	 * support it, we should change this test so that it checks to make
9499	 * sure SI_EVPD and SI_CMDDT aren't both set at the same time.
9500	 */
9501#ifdef notyet
9502	if (((cdb->byte2 & SI_EVPD)
9503	 && (cdb->byte2 & SI_CMDDT)))
9504#endif
9505	if (cdb->byte2 & SI_CMDDT) {
9506		/*
9507		 * Point to the SI_CMDDT bit.  We might change this
9508		 * when we support SI_CMDDT, but since both bits would be
9509		 * "wrong", this should probably just stay as-is then.
9510		 */
9511		ctl_set_invalid_field(ctsio,
9512				      /*sks_valid*/ 1,
9513				      /*command*/ 1,
9514				      /*field*/ 1,
9515				      /*bit_valid*/ 1,
9516				      /*bit*/ 1);
9517		ctl_done((union ctl_io *)ctsio);
9518		return (CTL_RETVAL_COMPLETE);
9519	}
9520	if (cdb->byte2 & SI_EVPD)
9521		retval = ctl_inquiry_evpd(ctsio);
9522#ifdef notyet
9523	else if (cdb->byte2 & SI_CMDDT)
9524		retval = ctl_inquiry_cmddt(ctsio);
9525#endif
9526	else
9527		retval = ctl_inquiry_std(ctsio);
9528
9529	return (retval);
9530}
9531
9532/*
9533 * For known CDB types, parse the LBA and length.
9534 */
9535static int
9536ctl_get_lba_len(union ctl_io *io, uint64_t *lba, uint32_t *len)
9537{
9538	if (io->io_hdr.io_type != CTL_IO_SCSI)
9539		return (1);
9540
9541	switch (io->scsiio.cdb[0]) {
9542	case READ_6:
9543	case WRITE_6: {
9544		struct scsi_rw_6 *cdb;
9545
9546		cdb = (struct scsi_rw_6 *)io->scsiio.cdb;
9547
9548		*lba = scsi_3btoul(cdb->addr);
9549		/* only 5 bits are valid in the most significant address byte */
9550		*lba &= 0x1fffff;
9551		*len = cdb->length;
9552		break;
9553	}
9554	case READ_10:
9555	case WRITE_10: {
9556		struct scsi_rw_10 *cdb;
9557
9558		cdb = (struct scsi_rw_10 *)io->scsiio.cdb;
9559
9560		*lba = scsi_4btoul(cdb->addr);
9561		*len = scsi_2btoul(cdb->length);
9562		break;
9563	}
9564	case WRITE_VERIFY_10: {
9565		struct scsi_write_verify_10 *cdb;
9566
9567		cdb = (struct scsi_write_verify_10 *)io->scsiio.cdb;
9568
9569		*lba = scsi_4btoul(cdb->addr);
9570		*len = scsi_2btoul(cdb->length);
9571		break;
9572	}
9573	case READ_12:
9574	case WRITE_12: {
9575		struct scsi_rw_12 *cdb;
9576
9577		cdb = (struct scsi_rw_12 *)io->scsiio.cdb;
9578
9579		*lba = scsi_4btoul(cdb->addr);
9580		*len = scsi_4btoul(cdb->length);
9581		break;
9582	}
9583	case WRITE_VERIFY_12: {
9584		struct scsi_write_verify_12 *cdb;
9585
9586		cdb = (struct scsi_write_verify_12 *)io->scsiio.cdb;
9587
9588		*lba = scsi_4btoul(cdb->addr);
9589		*len = scsi_4btoul(cdb->length);
9590		break;
9591	}
9592	case READ_16:
9593	case WRITE_16: {
9594		struct scsi_rw_16 *cdb;
9595
9596		cdb = (struct scsi_rw_16 *)io->scsiio.cdb;
9597
9598		*lba = scsi_8btou64(cdb->addr);
9599		*len = scsi_4btoul(cdb->length);
9600		break;
9601	}
9602	case WRITE_VERIFY_16: {
9603		struct scsi_write_verify_16 *cdb;
9604
9605		cdb = (struct scsi_write_verify_16 *)io->scsiio.cdb;
9606
9607
9608		*lba = scsi_8btou64(cdb->addr);
9609		*len = scsi_4btoul(cdb->length);
9610		break;
9611	}
9612	default:
9613		return (1);
9614		break; /* NOTREACHED */
9615	}
9616
9617	return (0);
9618}
9619
9620static ctl_action
9621ctl_extent_check_lba(uint64_t lba1, uint32_t len1, uint64_t lba2, uint32_t len2)
9622{
9623	uint64_t endlba1, endlba2;
9624
9625	endlba1 = lba1 + len1 - 1;
9626	endlba2 = lba2 + len2 - 1;
9627
9628	if ((endlba1 < lba2)
9629	 || (endlba2 < lba1))
9630		return (CTL_ACTION_PASS);
9631	else
9632		return (CTL_ACTION_BLOCK);
9633}
9634
9635static ctl_action
9636ctl_extent_check(union ctl_io *io1, union ctl_io *io2)
9637{
9638	uint64_t lba1, lba2;
9639	uint32_t len1, len2;
9640	int retval;
9641
9642	retval = ctl_get_lba_len(io1, &lba1, &len1);
9643	if (retval != 0)
9644		return (CTL_ACTION_ERROR);
9645
9646	retval = ctl_get_lba_len(io2, &lba2, &len2);
9647	if (retval != 0)
9648		return (CTL_ACTION_ERROR);
9649
9650	return (ctl_extent_check_lba(lba1, len1, lba2, len2));
9651}
9652
9653static ctl_action
9654ctl_check_for_blockage(union ctl_io *pending_io, union ctl_io *ooa_io)
9655{
9656	struct ctl_cmd_entry *pending_entry, *ooa_entry;
9657	ctl_serialize_action *serialize_row;
9658
9659	/*
9660	 * The initiator attempted multiple untagged commands at the same
9661	 * time.  Can't do that.
9662	 */
9663	if ((pending_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
9664	 && (ooa_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
9665	 && ((pending_io->io_hdr.nexus.targ_port ==
9666	      ooa_io->io_hdr.nexus.targ_port)
9667	  && (pending_io->io_hdr.nexus.initid.id ==
9668	      ooa_io->io_hdr.nexus.initid.id))
9669	 && ((ooa_io->io_hdr.flags & CTL_FLAG_ABORT) == 0))
9670		return (CTL_ACTION_OVERLAP);
9671
9672	/*
9673	 * The initiator attempted to send multiple tagged commands with
9674	 * the same ID.  (It's fine if different initiators have the same
9675	 * tag ID.)
9676	 *
9677	 * Even if all of those conditions are true, we don't kill the I/O
9678	 * if the command ahead of us has been aborted.  We won't end up
9679	 * sending it to the FETD, and it's perfectly legal to resend a
9680	 * command with the same tag number as long as the previous
9681	 * instance of this tag number has been aborted somehow.
9682	 */
9683	if ((pending_io->scsiio.tag_type != CTL_TAG_UNTAGGED)
9684	 && (ooa_io->scsiio.tag_type != CTL_TAG_UNTAGGED)
9685	 && (pending_io->scsiio.tag_num == ooa_io->scsiio.tag_num)
9686	 && ((pending_io->io_hdr.nexus.targ_port ==
9687	      ooa_io->io_hdr.nexus.targ_port)
9688	  && (pending_io->io_hdr.nexus.initid.id ==
9689	      ooa_io->io_hdr.nexus.initid.id))
9690	 && ((ooa_io->io_hdr.flags & CTL_FLAG_ABORT) == 0))
9691		return (CTL_ACTION_OVERLAP_TAG);
9692
9693	/*
9694	 * If we get a head of queue tag, SAM-3 says that we should
9695	 * immediately execute it.
9696	 *
9697	 * What happens if this command would normally block for some other
9698	 * reason?  e.g. a request sense with a head of queue tag
9699	 * immediately after a write.  Normally that would block, but this
9700	 * will result in its getting executed immediately...
9701	 *
9702	 * We currently return "pass" instead of "skip", so we'll end up
9703	 * going through the rest of the queue to check for overlapped tags.
9704	 *
9705	 * XXX KDM check for other types of blockage first??
9706	 */
9707	if (pending_io->scsiio.tag_type == CTL_TAG_HEAD_OF_QUEUE)
9708		return (CTL_ACTION_PASS);
9709
9710	/*
9711	 * Ordered tags have to block until all items ahead of them
9712	 * have completed.  If we get called with an ordered tag, we always
9713	 * block, if something else is ahead of us in the queue.
9714	 */
9715	if (pending_io->scsiio.tag_type == CTL_TAG_ORDERED)
9716		return (CTL_ACTION_BLOCK);
9717
9718	/*
9719	 * Simple tags get blocked until all head of queue and ordered tags
9720	 * ahead of them have completed.  I'm lumping untagged commands in
9721	 * with simple tags here.  XXX KDM is that the right thing to do?
9722	 */
9723	if (((pending_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
9724	  || (pending_io->scsiio.tag_type == CTL_TAG_SIMPLE))
9725	 && ((ooa_io->scsiio.tag_type == CTL_TAG_HEAD_OF_QUEUE)
9726	  || (ooa_io->scsiio.tag_type == CTL_TAG_ORDERED)))
9727		return (CTL_ACTION_BLOCK);
9728
9729	pending_entry = &ctl_cmd_table[pending_io->scsiio.cdb[0]];
9730	ooa_entry = &ctl_cmd_table[ooa_io->scsiio.cdb[0]];
9731
9732	serialize_row = ctl_serialize_table[ooa_entry->seridx];
9733
9734	switch (serialize_row[pending_entry->seridx]) {
9735	case CTL_SER_BLOCK:
9736		return (CTL_ACTION_BLOCK);
9737		break; /* NOTREACHED */
9738	case CTL_SER_EXTENT:
9739		return (ctl_extent_check(pending_io, ooa_io));
9740		break; /* NOTREACHED */
9741	case CTL_SER_PASS:
9742		return (CTL_ACTION_PASS);
9743		break; /* NOTREACHED */
9744	case CTL_SER_SKIP:
9745		return (CTL_ACTION_SKIP);
9746		break;
9747	default:
9748		panic("invalid serialization value %d",
9749		      serialize_row[pending_entry->seridx]);
9750		break; /* NOTREACHED */
9751	}
9752
9753	return (CTL_ACTION_ERROR);
9754}
9755
9756/*
9757 * Check for blockage or overlaps against the OOA (Order Of Arrival) queue.
9758 * Assumptions:
9759 * - caller holds ctl_lock
9760 * - pending_io is generally either incoming, or on the blocked queue
9761 * - starting I/O is the I/O we want to start the check with.
9762 */
9763static ctl_action
9764ctl_check_ooa(struct ctl_lun *lun, union ctl_io *pending_io,
9765	      union ctl_io *starting_io)
9766{
9767	union ctl_io *ooa_io;
9768	ctl_action action;
9769
9770	/*
9771	 * Run back along the OOA queue, starting with the current
9772	 * blocked I/O and going through every I/O before it on the
9773	 * queue.  If starting_io is NULL, we'll just end up returning
9774	 * CTL_ACTION_PASS.
9775	 */
9776	for (ooa_io = starting_io; ooa_io != NULL;
9777	     ooa_io = (union ctl_io *)TAILQ_PREV(&ooa_io->io_hdr, ctl_ooaq,
9778	     ooa_links)){
9779
9780		/*
9781		 * This routine just checks to see whether
9782		 * cur_blocked is blocked by ooa_io, which is ahead
9783		 * of it in the queue.  It doesn't queue/dequeue
9784		 * cur_blocked.
9785		 */
9786		action = ctl_check_for_blockage(pending_io, ooa_io);
9787		switch (action) {
9788		case CTL_ACTION_BLOCK:
9789		case CTL_ACTION_OVERLAP:
9790		case CTL_ACTION_OVERLAP_TAG:
9791		case CTL_ACTION_SKIP:
9792		case CTL_ACTION_ERROR:
9793			return (action);
9794			break; /* NOTREACHED */
9795		case CTL_ACTION_PASS:
9796			break;
9797		default:
9798			panic("invalid action %d", action);
9799			break;  /* NOTREACHED */
9800		}
9801	}
9802
9803	return (CTL_ACTION_PASS);
9804}
9805
9806/*
9807 * Assumptions:
9808 * - An I/O has just completed, and has been removed from the per-LUN OOA
9809 *   queue, so some items on the blocked queue may now be unblocked.
9810 * - The caller holds ctl_softc->ctl_lock
9811 */
9812static int
9813ctl_check_blocked(struct ctl_lun *lun)
9814{
9815	union ctl_io *cur_blocked, *next_blocked;
9816
9817	/*
9818	 * Run forward from the head of the blocked queue, checking each
9819	 * entry against the I/Os prior to it on the OOA queue to see if
9820	 * there is still any blockage.
9821	 *
9822	 * We cannot use the TAILQ_FOREACH() macro, because it can't deal
9823	 * with our removing a variable on it while it is traversing the
9824	 * list.
9825	 */
9826	for (cur_blocked = (union ctl_io *)TAILQ_FIRST(&lun->blocked_queue);
9827	     cur_blocked != NULL; cur_blocked = next_blocked) {
9828		union ctl_io *prev_ooa;
9829		ctl_action action;
9830
9831		next_blocked = (union ctl_io *)TAILQ_NEXT(&cur_blocked->io_hdr,
9832							  blocked_links);
9833
9834		prev_ooa = (union ctl_io *)TAILQ_PREV(&cur_blocked->io_hdr,
9835						      ctl_ooaq, ooa_links);
9836
9837		/*
9838		 * If cur_blocked happens to be the first item in the OOA
9839		 * queue now, prev_ooa will be NULL, and the action
9840		 * returned will just be CTL_ACTION_PASS.
9841		 */
9842		action = ctl_check_ooa(lun, cur_blocked, prev_ooa);
9843
9844		switch (action) {
9845		case CTL_ACTION_BLOCK:
9846			/* Nothing to do here, still blocked */
9847			break;
9848		case CTL_ACTION_OVERLAP:
9849		case CTL_ACTION_OVERLAP_TAG:
9850			/*
9851			 * This shouldn't happen!  In theory we've already
9852			 * checked this command for overlap...
9853			 */
9854			break;
9855		case CTL_ACTION_PASS:
9856		case CTL_ACTION_SKIP: {
9857			struct ctl_softc *softc;
9858			struct ctl_cmd_entry *entry;
9859			uint32_t initidx;
9860			uint8_t opcode;
9861			int isc_retval;
9862
9863			/*
9864			 * The skip case shouldn't happen, this transaction
9865			 * should have never made it onto the blocked queue.
9866			 */
9867			/*
9868			 * This I/O is no longer blocked, we can remove it
9869			 * from the blocked queue.  Since this is a TAILQ
9870			 * (doubly linked list), we can do O(1) removals
9871			 * from any place on the list.
9872			 */
9873			TAILQ_REMOVE(&lun->blocked_queue, &cur_blocked->io_hdr,
9874				     blocked_links);
9875			cur_blocked->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
9876
9877			if (cur_blocked->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC){
9878				/*
9879				 * Need to send IO back to original side to
9880				 * run
9881				 */
9882				union ctl_ha_msg msg_info;
9883
9884				msg_info.hdr.original_sc =
9885					cur_blocked->io_hdr.original_sc;
9886				msg_info.hdr.serializing_sc = cur_blocked;
9887				msg_info.hdr.msg_type = CTL_MSG_R2R;
9888				if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
9889				     &msg_info, sizeof(msg_info), 0)) >
9890				     CTL_HA_STATUS_SUCCESS) {
9891					printf("CTL:Check Blocked error from "
9892					       "ctl_ha_msg_send %d\n",
9893					       isc_retval);
9894				}
9895				break;
9896			}
9897			opcode = cur_blocked->scsiio.cdb[0];
9898			entry = &ctl_cmd_table[opcode];
9899			softc = control_softc;
9900
9901			initidx = ctl_get_initindex(&cur_blocked->io_hdr.nexus);
9902
9903			/*
9904			 * Check this I/O for LUN state changes that may
9905			 * have happened while this command was blocked.
9906			 * The LUN state may have been changed by a command
9907			 * ahead of us in the queue, so we need to re-check
9908			 * for any states that can be caused by SCSI
9909			 * commands.
9910			 */
9911			if (ctl_scsiio_lun_check(softc, lun, entry,
9912						 &cur_blocked->scsiio) == 0) {
9913				cur_blocked->io_hdr.flags |=
9914				                      CTL_FLAG_IS_WAS_ON_RTR;
9915				STAILQ_INSERT_TAIL(&lun->ctl_softc->rtr_queue,
9916						   &cur_blocked->io_hdr, links);
9917				/*
9918				 * In the non CTL_DONE_THREAD case, we need
9919				 * to wake up the work thread here.  When
9920				 * we're processing completed requests from
9921				 * the work thread context, we'll pop back
9922				 * around and end up pulling things off the
9923				 * RtR queue.  When we aren't processing
9924				 * things from the work thread context,
9925				 * though, we won't ever check the RtR queue.
9926				 * So we need to wake up the thread to clear
9927				 * things off the queue.  Otherwise this
9928				 * transaction will just sit on the RtR queue
9929				 * until a new I/O comes in.  (Which may or
9930				 * may not happen...)
9931				 */
9932#ifndef CTL_DONE_THREAD
9933				ctl_wakeup_thread();
9934#endif
9935			} else
9936				ctl_done_lock(cur_blocked, /*have_lock*/ 1);
9937			break;
9938		}
9939		default:
9940			/*
9941			 * This probably shouldn't happen -- we shouldn't
9942			 * get CTL_ACTION_ERROR, or anything else.
9943			 */
9944			break;
9945		}
9946	}
9947
9948	return (CTL_RETVAL_COMPLETE);
9949}
9950
9951/*
9952 * This routine (with one exception) checks LUN flags that can be set by
9953 * commands ahead of us in the OOA queue.  These flags have to be checked
9954 * when a command initially comes in, and when we pull a command off the
9955 * blocked queue and are preparing to execute it.  The reason we have to
9956 * check these flags for commands on the blocked queue is that the LUN
9957 * state may have been changed by a command ahead of us while we're on the
9958 * blocked queue.
9959 *
9960 * Ordering is somewhat important with these checks, so please pay
9961 * careful attention to the placement of any new checks.
9962 */
9963static int
9964ctl_scsiio_lun_check(struct ctl_softc *ctl_softc, struct ctl_lun *lun,
9965		     struct ctl_cmd_entry *entry, struct ctl_scsiio *ctsio)
9966{
9967	int retval;
9968
9969	retval = 0;
9970
9971	/*
9972	 * If this shelf is a secondary shelf controller, we have to reject
9973	 * any media access commands.
9974	 */
9975#if 0
9976	/* No longer needed for HA */
9977	if (((ctl_softc->flags & CTL_FLAG_MASTER_SHELF) == 0)
9978	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_SECONDARY) == 0)) {
9979		ctl_set_lun_standby(ctsio);
9980		retval = 1;
9981		goto bailout;
9982	}
9983#endif
9984
9985	/*
9986	 * Check for a reservation conflict.  If this command isn't allowed
9987	 * even on reserved LUNs, and if this initiator isn't the one who
9988	 * reserved us, reject the command with a reservation conflict.
9989	 */
9990	if ((lun->flags & CTL_LUN_RESERVED)
9991	 && ((entry->flags & CTL_CMD_FLAG_ALLOW_ON_RESV) == 0)) {
9992		if ((ctsio->io_hdr.nexus.initid.id != lun->rsv_nexus.initid.id)
9993		 || (ctsio->io_hdr.nexus.targ_port != lun->rsv_nexus.targ_port)
9994		 || (ctsio->io_hdr.nexus.targ_target.id !=
9995		     lun->rsv_nexus.targ_target.id)) {
9996			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
9997			ctsio->io_hdr.status = CTL_SCSI_ERROR;
9998			retval = 1;
9999			goto bailout;
10000		}
10001	}
10002
10003	if ( (lun->flags & CTL_LUN_PR_RESERVED)
10004	 && ((entry->flags & CTL_CMD_FLAG_ALLOW_ON_PR_RESV) == 0)) {
10005		uint32_t residx;
10006
10007		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
10008		/*
10009		 * if we aren't registered or it's a res holder type
10010		 * reservation and this isn't the res holder then set a
10011		 * conflict.
10012		 * NOTE: Commands which might be allowed on write exclusive
10013		 * type reservations are checked in the particular command
10014		 * for a conflict. Read and SSU are the only ones.
10015		 */
10016		if (!lun->per_res[residx].registered
10017		 || (residx != lun->pr_res_idx && lun->res_type < 4)) {
10018			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
10019			ctsio->io_hdr.status = CTL_SCSI_ERROR;
10020			retval = 1;
10021			goto bailout;
10022		}
10023
10024	}
10025
10026	if ((lun->flags & CTL_LUN_OFFLINE)
10027	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_OFFLINE) == 0)) {
10028		ctl_set_lun_not_ready(ctsio);
10029		retval = 1;
10030		goto bailout;
10031	}
10032
10033	/*
10034	 * If the LUN is stopped, see if this particular command is allowed
10035	 * for a stopped lun.  Otherwise, reject it with 0x04,0x02.
10036	 */
10037	if ((lun->flags & CTL_LUN_STOPPED)
10038	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_STOPPED) == 0)) {
10039		/* "Logical unit not ready, initializing cmd. required" */
10040		ctl_set_lun_stopped(ctsio);
10041		retval = 1;
10042		goto bailout;
10043	}
10044
10045	if ((lun->flags & CTL_LUN_INOPERABLE)
10046	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_INOPERABLE) == 0)) {
10047		/* "Medium format corrupted" */
10048		ctl_set_medium_format_corrupted(ctsio);
10049		retval = 1;
10050		goto bailout;
10051	}
10052
10053bailout:
10054	return (retval);
10055
10056}
10057
10058static void
10059ctl_failover_io(union ctl_io *io, int have_lock)
10060{
10061	ctl_set_busy(&io->scsiio);
10062	ctl_done_lock(io, have_lock);
10063}
10064
10065static void
10066ctl_failover(void)
10067{
10068	struct ctl_lun *lun;
10069	struct ctl_softc *ctl_softc;
10070	union ctl_io *next_io, *pending_io;
10071	union ctl_io *io;
10072	int lun_idx;
10073	int i;
10074
10075	ctl_softc = control_softc;
10076
10077	mtx_lock(&ctl_softc->ctl_lock);
10078	/*
10079	 * Remove any cmds from the other SC from the rtr queue.  These
10080	 * will obviously only be for LUNs for which we're the primary.
10081	 * We can't send status or get/send data for these commands.
10082	 * Since they haven't been executed yet, we can just remove them.
10083	 * We'll either abort them or delete them below, depending on
10084	 * which HA mode we're in.
10085	 */
10086	for (io = (union ctl_io *)STAILQ_FIRST(&ctl_softc->rtr_queue);
10087	     io != NULL; io = next_io) {
10088		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
10089		if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
10090			STAILQ_REMOVE(&ctl_softc->rtr_queue, &io->io_hdr,
10091				      ctl_io_hdr, links);
10092	}
10093
10094	for (lun_idx=0; lun_idx < ctl_softc->num_luns; lun_idx++) {
10095		lun = ctl_softc->ctl_luns[lun_idx];
10096		if (lun==NULL)
10097			continue;
10098
10099		/*
10100		 * Processor LUNs are primary on both sides.
10101		 * XXX will this always be true?
10102		 */
10103		if (lun->be_lun->lun_type == T_PROCESSOR)
10104			continue;
10105
10106		if ((lun->flags & CTL_LUN_PRIMARY_SC)
10107		 && (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)) {
10108			printf("FAILOVER: primary lun %d\n", lun_idx);
10109		        /*
10110			 * Remove all commands from the other SC. First from the
10111			 * blocked queue then from the ooa queue. Once we have
10112			 * removed them. Call ctl_check_blocked to see if there
10113			 * is anything that can run.
10114			 */
10115			for (io = (union ctl_io *)TAILQ_FIRST(
10116			     &lun->blocked_queue); io != NULL; io = next_io) {
10117
10118		        	next_io = (union ctl_io *)TAILQ_NEXT(
10119				    &io->io_hdr, blocked_links);
10120
10121				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC) {
10122					TAILQ_REMOVE(&lun->blocked_queue,
10123						     &io->io_hdr,blocked_links);
10124					io->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
10125					TAILQ_REMOVE(&lun->ooa_queue,
10126						     &io->io_hdr, ooa_links);
10127
10128					ctl_free_io_internal(io, 1);
10129				}
10130			}
10131
10132			for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
10133	     		     io != NULL; io = next_io) {
10134
10135		        	next_io = (union ctl_io *)TAILQ_NEXT(
10136				    &io->io_hdr, ooa_links);
10137
10138				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC) {
10139
10140					TAILQ_REMOVE(&lun->ooa_queue,
10141						&io->io_hdr,
10142					     	ooa_links);
10143
10144					ctl_free_io_internal(io, 1);
10145				}
10146			}
10147			ctl_check_blocked(lun);
10148		} else if ((lun->flags & CTL_LUN_PRIMARY_SC)
10149			&& (ctl_softc->ha_mode == CTL_HA_MODE_XFER)) {
10150
10151			printf("FAILOVER: primary lun %d\n", lun_idx);
10152			/*
10153			 * Abort all commands from the other SC.  We can't
10154			 * send status back for them now.  These should get
10155			 * cleaned up when they are completed or come out
10156			 * for a datamove operation.
10157			 */
10158			for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
10159	     		     io != NULL; io = next_io) {
10160		        	next_io = (union ctl_io *)TAILQ_NEXT(
10161					&io->io_hdr, ooa_links);
10162
10163				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
10164					io->io_hdr.flags |= CTL_FLAG_ABORT;
10165			}
10166		} else if (((lun->flags & CTL_LUN_PRIMARY_SC) == 0)
10167			&& (ctl_softc->ha_mode == CTL_HA_MODE_XFER)) {
10168
10169			printf("FAILOVER: secondary lun %d\n", lun_idx);
10170
10171			lun->flags |= CTL_LUN_PRIMARY_SC;
10172
10173			/*
10174			 * We send all I/O that was sent to this controller
10175			 * and redirected to the other side back with
10176			 * busy status, and have the initiator retry it.
10177			 * Figuring out how much data has been transferred,
10178			 * etc. and picking up where we left off would be
10179			 * very tricky.
10180			 *
10181			 * XXX KDM need to remove I/O from the blocked
10182			 * queue as well!
10183			 */
10184			for (pending_io = (union ctl_io *)TAILQ_FIRST(
10185			     &lun->ooa_queue); pending_io != NULL;
10186			     pending_io = next_io) {
10187
10188				next_io =  (union ctl_io *)TAILQ_NEXT(
10189					&pending_io->io_hdr, ooa_links);
10190
10191				pending_io->io_hdr.flags &=
10192					~CTL_FLAG_SENT_2OTHER_SC;
10193
10194				if (pending_io->io_hdr.flags &
10195				    CTL_FLAG_IO_ACTIVE) {
10196					pending_io->io_hdr.flags |=
10197						CTL_FLAG_FAILOVER;
10198				} else {
10199					ctl_set_busy(&pending_io->scsiio);
10200					ctl_done_lock(pending_io,
10201						      /*have_lock*/1);
10202				}
10203			}
10204
10205			/*
10206			 * Build Unit Attention
10207			 */
10208			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
10209				lun->pending_sense[i].ua_pending |=
10210				                     CTL_UA_ASYM_ACC_CHANGE;
10211			}
10212		} else if (((lun->flags & CTL_LUN_PRIMARY_SC) == 0)
10213			&& (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)) {
10214			printf("FAILOVER: secondary lun %d\n", lun_idx);
10215			/*
10216			 * if the first io on the OOA is not on the RtR queue
10217			 * add it.
10218			 */
10219			lun->flags |= CTL_LUN_PRIMARY_SC;
10220
10221			pending_io = (union ctl_io *)TAILQ_FIRST(
10222			    &lun->ooa_queue);
10223			if (pending_io==NULL) {
10224				printf("Nothing on OOA queue\n");
10225				continue;
10226			}
10227
10228			pending_io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
10229			if ((pending_io->io_hdr.flags &
10230			     CTL_FLAG_IS_WAS_ON_RTR) == 0) {
10231				pending_io->io_hdr.flags |=
10232				    CTL_FLAG_IS_WAS_ON_RTR;
10233				STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
10234						   &pending_io->io_hdr, links);
10235			}
10236#if 0
10237			else
10238			{
10239				printf("Tag 0x%04x is running\n",
10240				      pending_io->scsiio.tag_num);
10241			}
10242#endif
10243
10244			next_io = (union ctl_io *)TAILQ_NEXT(
10245			    &pending_io->io_hdr, ooa_links);
10246			for (pending_io=next_io; pending_io != NULL;
10247			     pending_io = next_io) {
10248				pending_io->io_hdr.flags &=
10249				    ~CTL_FLAG_SENT_2OTHER_SC;
10250				next_io = (union ctl_io *)TAILQ_NEXT(
10251					&pending_io->io_hdr, ooa_links);
10252				if (pending_io->io_hdr.flags &
10253				    CTL_FLAG_IS_WAS_ON_RTR) {
10254#if 0
10255				        printf("Tag 0x%04x is running\n",
10256				      		pending_io->scsiio.tag_num);
10257#endif
10258					continue;
10259				}
10260
10261				switch (ctl_check_ooa(lun, pending_io,
10262			            (union ctl_io *)TAILQ_PREV(
10263				    &pending_io->io_hdr, ctl_ooaq,
10264				    ooa_links))) {
10265
10266				case CTL_ACTION_BLOCK:
10267					TAILQ_INSERT_TAIL(&lun->blocked_queue,
10268							  &pending_io->io_hdr,
10269							  blocked_links);
10270					pending_io->io_hdr.flags |=
10271					    CTL_FLAG_BLOCKED;
10272					break;
10273				case CTL_ACTION_PASS:
10274				case CTL_ACTION_SKIP:
10275					pending_io->io_hdr.flags |=
10276					    CTL_FLAG_IS_WAS_ON_RTR;
10277					STAILQ_INSERT_TAIL(
10278					    &ctl_softc->rtr_queue,
10279					    &pending_io->io_hdr, links);
10280					break;
10281				case CTL_ACTION_OVERLAP:
10282					ctl_set_overlapped_cmd(
10283					    (struct ctl_scsiio *)pending_io);
10284					ctl_done_lock(pending_io,
10285						      /*have_lock*/ 1);
10286					break;
10287				case CTL_ACTION_OVERLAP_TAG:
10288					ctl_set_overlapped_tag(
10289					    (struct ctl_scsiio *)pending_io,
10290					    pending_io->scsiio.tag_num & 0xff);
10291					ctl_done_lock(pending_io,
10292						      /*have_lock*/ 1);
10293					break;
10294				case CTL_ACTION_ERROR:
10295				default:
10296					ctl_set_internal_failure(
10297						(struct ctl_scsiio *)pending_io,
10298						0,  // sks_valid
10299						0); //retry count
10300					ctl_done_lock(pending_io,
10301						      /*have_lock*/ 1);
10302					break;
10303				}
10304			}
10305
10306			/*
10307			 * Build Unit Attention
10308			 */
10309			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
10310				lun->pending_sense[i].ua_pending |=
10311				                     CTL_UA_ASYM_ACC_CHANGE;
10312			}
10313		} else {
10314			panic("Unhandled HA mode failover, LUN flags = %#x, "
10315			      "ha_mode = #%x", lun->flags, ctl_softc->ha_mode);
10316		}
10317	}
10318	ctl_pause_rtr = 0;
10319	mtx_unlock(&ctl_softc->ctl_lock);
10320}
10321
10322static int
10323ctl_scsiio_precheck(struct ctl_softc *ctl_softc, struct ctl_scsiio *ctsio)
10324{
10325	struct ctl_lun *lun;
10326	struct ctl_cmd_entry *entry;
10327	uint8_t opcode;
10328	uint32_t initidx;
10329	int retval;
10330
10331	retval = 0;
10332
10333	lun = NULL;
10334
10335	opcode = ctsio->cdb[0];
10336
10337	mtx_lock(&ctl_softc->ctl_lock);
10338
10339	if ((ctsio->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
10340	 && (ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun] != NULL)) {
10341		lun = ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun];
10342		/*
10343		 * If the LUN is invalid, pretend that it doesn't exist.
10344		 * It will go away as soon as all pending I/O has been
10345		 * completed.
10346		 */
10347		if (lun->flags & CTL_LUN_DISABLED) {
10348			lun = NULL;
10349		} else {
10350			ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr = lun;
10351			ctsio->io_hdr.ctl_private[CTL_PRIV_BACKEND_LUN].ptr =
10352				lun->be_lun;
10353			if (lun->be_lun->lun_type == T_PROCESSOR) {
10354				ctsio->io_hdr.flags |= CTL_FLAG_CONTROL_DEV;
10355			}
10356		}
10357	} else {
10358		ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr = NULL;
10359		ctsio->io_hdr.ctl_private[CTL_PRIV_BACKEND_LUN].ptr = NULL;
10360	}
10361
10362	entry = &ctl_cmd_table[opcode];
10363
10364	ctsio->io_hdr.flags &= ~CTL_FLAG_DATA_MASK;
10365	ctsio->io_hdr.flags |= entry->flags & CTL_FLAG_DATA_MASK;
10366
10367	/*
10368	 * Check to see whether we can send this command to LUNs that don't
10369	 * exist.  This should pretty much only be the case for inquiry
10370	 * and request sense.  Further checks, below, really require having
10371	 * a LUN, so we can't really check the command anymore.  Just put
10372	 * it on the rtr queue.
10373	 */
10374	if (lun == NULL) {
10375		if (entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
10376			goto queue_rtr;
10377
10378		ctl_set_unsupported_lun(ctsio);
10379		mtx_unlock(&ctl_softc->ctl_lock);
10380		ctl_done((union ctl_io *)ctsio);
10381		goto bailout;
10382	} else {
10383		/*
10384		 * Every I/O goes into the OOA queue for a particular LUN, and
10385		 * stays there until completion.
10386		 */
10387		TAILQ_INSERT_TAIL(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
10388
10389		/*
10390		 * Make sure we support this particular command on this LUN.
10391		 * e.g., we don't support writes to the control LUN.
10392		 */
10393		switch (lun->be_lun->lun_type) {
10394		case T_PROCESSOR:
10395		 	if (((entry->flags & CTL_CMD_FLAG_OK_ON_PROC) == 0)
10396			 && ((entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
10397			      == 0)) {
10398				ctl_set_invalid_opcode(ctsio);
10399				mtx_unlock(&ctl_softc->ctl_lock);
10400				ctl_done((union ctl_io *)ctsio);
10401				goto bailout;
10402			}
10403			break;
10404		case T_DIRECT:
10405			if (((entry->flags & CTL_CMD_FLAG_OK_ON_SLUN) == 0)
10406			 && ((entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
10407			      == 0)){
10408				ctl_set_invalid_opcode(ctsio);
10409				mtx_unlock(&ctl_softc->ctl_lock);
10410				ctl_done((union ctl_io *)ctsio);
10411				goto bailout;
10412			}
10413			break;
10414		default:
10415			printf("Unsupported CTL LUN type %d\n",
10416			       lun->be_lun->lun_type);
10417			panic("Unsupported CTL LUN type %d\n",
10418			      lun->be_lun->lun_type);
10419			break; /* NOTREACHED */
10420		}
10421	}
10422
10423	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
10424
10425	/*
10426	 * If we've got a request sense, it'll clear the contingent
10427	 * allegiance condition.  Otherwise, if we have a CA condition for
10428	 * this initiator, clear it, because it sent down a command other
10429	 * than request sense.
10430	 */
10431	if ((opcode != REQUEST_SENSE)
10432	 && (ctl_is_set(lun->have_ca, initidx)))
10433		ctl_clear_mask(lun->have_ca, initidx);
10434
10435	/*
10436	 * If the command has this flag set, it handles its own unit
10437	 * attention reporting, we shouldn't do anything.  Otherwise we
10438	 * check for any pending unit attentions, and send them back to the
10439	 * initiator.  We only do this when a command initially comes in,
10440	 * not when we pull it off the blocked queue.
10441	 *
10442	 * According to SAM-3, section 5.3.2, the order that things get
10443	 * presented back to the host is basically unit attentions caused
10444	 * by some sort of reset event, busy status, reservation conflicts
10445	 * or task set full, and finally any other status.
10446	 *
10447	 * One issue here is that some of the unit attentions we report
10448	 * don't fall into the "reset" category (e.g. "reported luns data
10449	 * has changed").  So reporting it here, before the reservation
10450	 * check, may be technically wrong.  I guess the only thing to do
10451	 * would be to check for and report the reset events here, and then
10452	 * check for the other unit attention types after we check for a
10453	 * reservation conflict.
10454	 *
10455	 * XXX KDM need to fix this
10456	 */
10457	if ((entry->flags & CTL_CMD_FLAG_NO_SENSE) == 0) {
10458		ctl_ua_type ua_type;
10459
10460		ua_type = lun->pending_sense[initidx].ua_pending;
10461		if (ua_type != CTL_UA_NONE) {
10462			ctl_sense_format sense_format;
10463
10464			if (lun != NULL)
10465				sense_format = (lun->flags &
10466				    CTL_LUN_SENSE_DESC) ? CTL_SENSE_DESCRIPTOR :
10467				    CTL_SENSE_FIXED;
10468			else
10469				sense_format = CTL_SENSE_FIXED;
10470
10471			ua_type = ctl_build_ua(ua_type, &ctsio->sense_data,
10472					       sense_format);
10473			if (ua_type != CTL_UA_NONE) {
10474				ctsio->scsi_status = SCSI_STATUS_CHECK_COND;
10475				ctsio->io_hdr.status = CTL_SCSI_ERROR |
10476						       CTL_AUTOSENSE;
10477				ctsio->sense_len = SSD_FULL_SIZE;
10478				lun->pending_sense[initidx].ua_pending &=
10479					~ua_type;
10480				mtx_unlock(&ctl_softc->ctl_lock);
10481				ctl_done((union ctl_io *)ctsio);
10482				goto bailout;
10483			}
10484		}
10485	}
10486
10487
10488	if (ctl_scsiio_lun_check(ctl_softc, lun, entry, ctsio) != 0) {
10489		mtx_unlock(&ctl_softc->ctl_lock);
10490		ctl_done((union ctl_io *)ctsio);
10491		goto bailout;
10492	}
10493
10494	/*
10495	 * XXX CHD this is where we want to send IO to other side if
10496	 * this LUN is secondary on this SC. We will need to make a copy
10497	 * of the IO and flag the IO on this side as SENT_2OTHER and the flag
10498	 * the copy we send as FROM_OTHER.
10499	 * We also need to stuff the address of the original IO so we can
10500	 * find it easily. Something similar will need be done on the other
10501	 * side so when we are done we can find the copy.
10502	 */
10503	if ((lun->flags & CTL_LUN_PRIMARY_SC) == 0) {
10504		union ctl_ha_msg msg_info;
10505		int isc_retval;
10506
10507		ctsio->io_hdr.flags |= CTL_FLAG_SENT_2OTHER_SC;
10508
10509		msg_info.hdr.msg_type = CTL_MSG_SERIALIZE;
10510		msg_info.hdr.original_sc = (union ctl_io *)ctsio;
10511#if 0
10512		printf("1. ctsio %p\n", ctsio);
10513#endif
10514		msg_info.hdr.serializing_sc = NULL;
10515		msg_info.hdr.nexus = ctsio->io_hdr.nexus;
10516		msg_info.scsi.tag_num = ctsio->tag_num;
10517		msg_info.scsi.tag_type = ctsio->tag_type;
10518		memcpy(msg_info.scsi.cdb, ctsio->cdb, CTL_MAX_CDBLEN);
10519
10520		ctsio->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
10521
10522		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
10523		    (void *)&msg_info, sizeof(msg_info), 0)) >
10524		    CTL_HA_STATUS_SUCCESS) {
10525			printf("CTL:precheck, ctl_ha_msg_send returned %d\n",
10526			       isc_retval);
10527			printf("CTL:opcode is %x\n",opcode);
10528		} else {
10529#if 0
10530			printf("CTL:Precheck sent msg, opcode is %x\n",opcode);
10531#endif
10532		}
10533
10534		/*
10535		 * XXX KDM this I/O is off the incoming queue, but hasn't
10536		 * been inserted on any other queue.  We may need to come
10537		 * up with a holding queue while we wait for serialization
10538		 * so that we have an idea of what we're waiting for from
10539		 * the other side.
10540		 */
10541		goto bailout_unlock;
10542	}
10543
10544	switch (ctl_check_ooa(lun, (union ctl_io *)ctsio,
10545			      (union ctl_io *)TAILQ_PREV(&ctsio->io_hdr,
10546			      ctl_ooaq, ooa_links))) {
10547	case CTL_ACTION_BLOCK:
10548		ctsio->io_hdr.flags |= CTL_FLAG_BLOCKED;
10549		TAILQ_INSERT_TAIL(&lun->blocked_queue, &ctsio->io_hdr,
10550				  blocked_links);
10551		goto bailout_unlock;
10552		break; /* NOTREACHED */
10553	case CTL_ACTION_PASS:
10554	case CTL_ACTION_SKIP:
10555		goto queue_rtr;
10556		break; /* NOTREACHED */
10557	case CTL_ACTION_OVERLAP:
10558		ctl_set_overlapped_cmd(ctsio);
10559		mtx_unlock(&ctl_softc->ctl_lock);
10560		ctl_done((union ctl_io *)ctsio);
10561		goto bailout;
10562		break; /* NOTREACHED */
10563	case CTL_ACTION_OVERLAP_TAG:
10564		ctl_set_overlapped_tag(ctsio, ctsio->tag_num & 0xff);
10565		mtx_unlock(&ctl_softc->ctl_lock);
10566		ctl_done((union ctl_io *)ctsio);
10567		goto bailout;
10568		break; /* NOTREACHED */
10569	case CTL_ACTION_ERROR:
10570	default:
10571		ctl_set_internal_failure(ctsio,
10572					 /*sks_valid*/ 0,
10573					 /*retry_count*/ 0);
10574		mtx_unlock(&ctl_softc->ctl_lock);
10575		ctl_done((union ctl_io *)ctsio);
10576		goto bailout;
10577		break; /* NOTREACHED */
10578	}
10579
10580	goto bailout_unlock;
10581
10582queue_rtr:
10583	ctsio->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
10584	STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue, &ctsio->io_hdr, links);
10585
10586bailout_unlock:
10587	mtx_unlock(&ctl_softc->ctl_lock);
10588
10589bailout:
10590	return (retval);
10591}
10592
10593static int
10594ctl_scsiio(struct ctl_scsiio *ctsio)
10595{
10596	int retval;
10597	struct ctl_cmd_entry *entry;
10598
10599	retval = CTL_RETVAL_COMPLETE;
10600
10601	CTL_DEBUG_PRINT(("ctl_scsiio cdb[0]=%02X\n", ctsio->cdb[0]));
10602
10603	entry = &ctl_cmd_table[ctsio->cdb[0]];
10604
10605	/*
10606	 * If this I/O has been aborted, just send it straight to
10607	 * ctl_done() without executing it.
10608	 */
10609	if (ctsio->io_hdr.flags & CTL_FLAG_ABORT) {
10610		ctl_done((union ctl_io *)ctsio);
10611		goto bailout;
10612	}
10613
10614	/*
10615	 * All the checks should have been handled by ctl_scsiio_precheck().
10616	 * We should be clear now to just execute the I/O.
10617	 */
10618	retval = entry->execute(ctsio);
10619
10620bailout:
10621	return (retval);
10622}
10623
10624/*
10625 * Since we only implement one target right now, a bus reset simply resets
10626 * our single target.
10627 */
10628static int
10629ctl_bus_reset(struct ctl_softc *ctl_softc, union ctl_io *io)
10630{
10631	return(ctl_target_reset(ctl_softc, io, CTL_UA_BUS_RESET));
10632}
10633
10634static int
10635ctl_target_reset(struct ctl_softc *ctl_softc, union ctl_io *io,
10636		 ctl_ua_type ua_type)
10637{
10638	struct ctl_lun *lun;
10639	int retval;
10640
10641	if (!(io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
10642		union ctl_ha_msg msg_info;
10643
10644		io->io_hdr.flags |= CTL_FLAG_SENT_2OTHER_SC;
10645		msg_info.hdr.nexus = io->io_hdr.nexus;
10646		if (ua_type==CTL_UA_TARG_RESET)
10647			msg_info.task.task_action = CTL_TASK_TARGET_RESET;
10648		else
10649			msg_info.task.task_action = CTL_TASK_BUS_RESET;
10650		msg_info.hdr.msg_type = CTL_MSG_MANAGE_TASKS;
10651		msg_info.hdr.original_sc = NULL;
10652		msg_info.hdr.serializing_sc = NULL;
10653		if (CTL_HA_STATUS_SUCCESS != ctl_ha_msg_send(CTL_HA_CHAN_CTL,
10654		    (void *)&msg_info, sizeof(msg_info), 0)) {
10655		}
10656	}
10657	retval = 0;
10658
10659	STAILQ_FOREACH(lun, &ctl_softc->lun_list, links)
10660		retval += ctl_lun_reset(lun, io, ua_type);
10661
10662	return (retval);
10663}
10664
10665/*
10666 * The LUN should always be set.  The I/O is optional, and is used to
10667 * distinguish between I/Os sent by this initiator, and by other
10668 * initiators.  We set unit attention for initiators other than this one.
10669 * SAM-3 is vague on this point.  It does say that a unit attention should
10670 * be established for other initiators when a LUN is reset (see section
10671 * 5.7.3), but it doesn't specifically say that the unit attention should
10672 * be established for this particular initiator when a LUN is reset.  Here
10673 * is the relevant text, from SAM-3 rev 8:
10674 *
10675 * 5.7.2 When a SCSI initiator port aborts its own tasks
10676 *
10677 * When a SCSI initiator port causes its own task(s) to be aborted, no
10678 * notification that the task(s) have been aborted shall be returned to
10679 * the SCSI initiator port other than the completion response for the
10680 * command or task management function action that caused the task(s) to
10681 * be aborted and notification(s) associated with related effects of the
10682 * action (e.g., a reset unit attention condition).
10683 *
10684 * XXX KDM for now, we're setting unit attention for all initiators.
10685 */
10686static int
10687ctl_lun_reset(struct ctl_lun *lun, union ctl_io *io, ctl_ua_type ua_type)
10688{
10689	union ctl_io *xio;
10690#if 0
10691	uint32_t initindex;
10692#endif
10693	int i;
10694
10695	/*
10696	 * Run through the OOA queue and abort each I/O.
10697	 */
10698#if 0
10699	TAILQ_FOREACH((struct ctl_io_hdr *)xio, &lun->ooa_queue, ooa_links) {
10700#endif
10701	for (xio = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); xio != NULL;
10702	     xio = (union ctl_io *)TAILQ_NEXT(&xio->io_hdr, ooa_links)) {
10703		xio->io_hdr.flags |= CTL_FLAG_ABORT;
10704	}
10705
10706	/*
10707	 * This version sets unit attention for every
10708	 */
10709#if 0
10710	initindex = ctl_get_initindex(&io->io_hdr.nexus);
10711	for (i = 0; i < CTL_MAX_INITIATORS; i++) {
10712		if (initindex == i)
10713			continue;
10714		lun->pending_sense[i].ua_pending |= ua_type;
10715	}
10716#endif
10717
10718	/*
10719	 * A reset (any kind, really) clears reservations established with
10720	 * RESERVE/RELEASE.  It does not clear reservations established
10721	 * with PERSISTENT RESERVE OUT, but we don't support that at the
10722	 * moment anyway.  See SPC-2, section 5.6.  SPC-3 doesn't address
10723	 * reservations made with the RESERVE/RELEASE commands, because
10724	 * those commands are obsolete in SPC-3.
10725	 */
10726	lun->flags &= ~CTL_LUN_RESERVED;
10727
10728	for (i = 0; i < CTL_MAX_INITIATORS; i++) {
10729		ctl_clear_mask(lun->have_ca, i);
10730		lun->pending_sense[i].ua_pending |= ua_type;
10731	}
10732
10733	return (0);
10734}
10735
10736static int
10737ctl_abort_task(union ctl_io *io)
10738{
10739	union ctl_io *xio;
10740	struct ctl_lun *lun;
10741	struct ctl_softc *ctl_softc;
10742#if 0
10743	struct sbuf sb;
10744	char printbuf[128];
10745#endif
10746	int found;
10747
10748	ctl_softc = control_softc;
10749	found = 0;
10750
10751	/*
10752	 * Look up the LUN.
10753	 */
10754	if ((io->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
10755	 && (ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun] != NULL))
10756		lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
10757	else
10758		goto bailout;
10759
10760#if 0
10761	printf("ctl_abort_task: called for lun %lld, tag %d type %d\n",
10762	       lun->lun, io->taskio.tag_num, io->taskio.tag_type);
10763#endif
10764
10765	/*
10766	 * Run through the OOA queue and attempt to find the given I/O.
10767	 * The target port, initiator ID, tag type and tag number have to
10768	 * match the values that we got from the initiator.  If we have an
10769	 * untagged command to abort, simply abort the first untagged command
10770	 * we come to.  We only allow one untagged command at a time of course.
10771	 */
10772#if 0
10773	TAILQ_FOREACH((struct ctl_io_hdr *)xio, &lun->ooa_queue, ooa_links) {
10774#endif
10775	for (xio = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); xio != NULL;
10776	     xio = (union ctl_io *)TAILQ_NEXT(&xio->io_hdr, ooa_links)) {
10777#if 0
10778		sbuf_new(&sb, printbuf, sizeof(printbuf), SBUF_FIXEDLEN);
10779
10780		sbuf_printf(&sb, "LUN %lld tag %d type %d%s%s%s%s: ",
10781			    lun->lun, xio->scsiio.tag_num,
10782			    xio->scsiio.tag_type,
10783			    (xio->io_hdr.blocked_links.tqe_prev
10784			    == NULL) ? "" : " BLOCKED",
10785			    (xio->io_hdr.flags &
10786			    CTL_FLAG_DMA_INPROG) ? " DMA" : "",
10787			    (xio->io_hdr.flags &
10788			    CTL_FLAG_ABORT) ? " ABORT" : ""),
10789			    (xio->io_hdr.flags &
10790			    CTL_FLAG_IS_WAS_ON_RTR ? " RTR" : "");
10791		ctl_scsi_command_string(&xio->scsiio, NULL, &sb);
10792		sbuf_finish(&sb);
10793		printf("%s\n", sbuf_data(&sb));
10794#endif
10795
10796		if ((xio->io_hdr.nexus.targ_port == io->io_hdr.nexus.targ_port)
10797		 && (xio->io_hdr.nexus.initid.id ==
10798		     io->io_hdr.nexus.initid.id)) {
10799			/*
10800			 * If the abort says that the task is untagged, the
10801			 * task in the queue must be untagged.  Otherwise,
10802			 * we just check to see whether the tag numbers
10803			 * match.  This is because the QLogic firmware
10804			 * doesn't pass back the tag type in an abort
10805			 * request.
10806			 */
10807#if 0
10808			if (((xio->scsiio.tag_type == CTL_TAG_UNTAGGED)
10809			  && (io->taskio.tag_type == CTL_TAG_UNTAGGED))
10810			 || (xio->scsiio.tag_num == io->taskio.tag_num)) {
10811#endif
10812			/*
10813			 * XXX KDM we've got problems with FC, because it
10814			 * doesn't send down a tag type with aborts.  So we
10815			 * can only really go by the tag number...
10816			 * This may cause problems with parallel SCSI.
10817			 * Need to figure that out!!
10818			 */
10819			if (xio->scsiio.tag_num == io->taskio.tag_num) {
10820				xio->io_hdr.flags |= CTL_FLAG_ABORT;
10821				found = 1;
10822				if ((io->io_hdr.flags &
10823				     CTL_FLAG_FROM_OTHER_SC) == 0 &&
10824				    !(lun->flags & CTL_LUN_PRIMARY_SC)) {
10825					union ctl_ha_msg msg_info;
10826
10827					io->io_hdr.flags |=
10828					                CTL_FLAG_SENT_2OTHER_SC;
10829					msg_info.hdr.nexus = io->io_hdr.nexus;
10830					msg_info.task.task_action =
10831						CTL_TASK_ABORT_TASK;
10832					msg_info.task.tag_num =
10833						io->taskio.tag_num;
10834					msg_info.task.tag_type =
10835						io->taskio.tag_type;
10836					msg_info.hdr.msg_type =
10837						CTL_MSG_MANAGE_TASKS;
10838					msg_info.hdr.original_sc = NULL;
10839					msg_info.hdr.serializing_sc = NULL;
10840#if 0
10841					printf("Sent Abort to other side\n");
10842#endif
10843					if (CTL_HA_STATUS_SUCCESS !=
10844					        ctl_ha_msg_send(CTL_HA_CHAN_CTL,
10845		    				(void *)&msg_info,
10846						sizeof(msg_info), 0)) {
10847					}
10848				}
10849#if 0
10850				printf("ctl_abort_task: found I/O to abort\n");
10851#endif
10852				break;
10853			}
10854		}
10855	}
10856
10857bailout:
10858
10859	if (found == 0) {
10860		/*
10861		 * This isn't really an error.  It's entirely possible for
10862		 * the abort and command completion to cross on the wire.
10863		 * This is more of an informative/diagnostic error.
10864		 */
10865#if 0
10866		printf("ctl_abort_task: ABORT sent for nonexistent I/O: "
10867		       "%d:%d:%d:%d tag %d type %d\n",
10868		       io->io_hdr.nexus.initid.id,
10869		       io->io_hdr.nexus.targ_port,
10870		       io->io_hdr.nexus.targ_target.id,
10871		       io->io_hdr.nexus.targ_lun, io->taskio.tag_num,
10872		       io->taskio.tag_type);
10873#endif
10874		return (1);
10875	} else
10876		return (0);
10877}
10878
10879/*
10880 * Assumptions:  caller holds ctl_softc->ctl_lock
10881 *
10882 * This routine cannot block!  It must be callable from an interrupt
10883 * handler as well as from the work thread.
10884 */
10885static void
10886ctl_run_task_queue(struct ctl_softc *ctl_softc)
10887{
10888	union ctl_io *io, *next_io;
10889
10890	CTL_DEBUG_PRINT(("ctl_run_task_queue\n"));
10891
10892	for (io = (union ctl_io *)STAILQ_FIRST(&ctl_softc->task_queue);
10893	     io != NULL; io = next_io) {
10894		int retval;
10895		const char *task_desc;
10896
10897		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
10898
10899		retval = 0;
10900
10901		switch (io->io_hdr.io_type) {
10902		case CTL_IO_TASK: {
10903			task_desc = ctl_scsi_task_string(&io->taskio);
10904			if (task_desc != NULL) {
10905#ifdef NEEDTOPORT
10906				csevent_log(CSC_CTL | CSC_SHELF_SW |
10907					    CTL_TASK_REPORT,
10908					    csevent_LogType_Trace,
10909					    csevent_Severity_Information,
10910					    csevent_AlertLevel_Green,
10911					    csevent_FRU_Firmware,
10912					    csevent_FRU_Unknown,
10913					    "CTL: received task: %s",task_desc);
10914#endif
10915			} else {
10916#ifdef NEEDTOPORT
10917				csevent_log(CSC_CTL | CSC_SHELF_SW |
10918					    CTL_TASK_REPORT,
10919					    csevent_LogType_Trace,
10920					    csevent_Severity_Information,
10921					    csevent_AlertLevel_Green,
10922					    csevent_FRU_Firmware,
10923					    csevent_FRU_Unknown,
10924					    "CTL: received unknown task "
10925					    "type: %d (%#x)",
10926					    io->taskio.task_action,
10927					    io->taskio.task_action);
10928#endif
10929			}
10930			switch (io->taskio.task_action) {
10931			case CTL_TASK_ABORT_TASK:
10932				retval = ctl_abort_task(io);
10933				break;
10934			case CTL_TASK_ABORT_TASK_SET:
10935				break;
10936			case CTL_TASK_CLEAR_ACA:
10937				break;
10938			case CTL_TASK_CLEAR_TASK_SET:
10939				break;
10940			case CTL_TASK_LUN_RESET: {
10941				struct ctl_lun *lun;
10942				uint32_t targ_lun;
10943				int retval;
10944
10945				targ_lun = io->io_hdr.nexus.targ_lun;
10946
10947				if ((targ_lun < CTL_MAX_LUNS)
10948				 && (ctl_softc->ctl_luns[targ_lun] != NULL))
10949					lun = ctl_softc->ctl_luns[targ_lun];
10950				else {
10951					retval = 1;
10952					break;
10953				}
10954
10955				if (!(io->io_hdr.flags &
10956				    CTL_FLAG_FROM_OTHER_SC)) {
10957					union ctl_ha_msg msg_info;
10958
10959					io->io_hdr.flags |=
10960						CTL_FLAG_SENT_2OTHER_SC;
10961					msg_info.hdr.msg_type =
10962						CTL_MSG_MANAGE_TASKS;
10963					msg_info.hdr.nexus = io->io_hdr.nexus;
10964					msg_info.task.task_action =
10965						CTL_TASK_LUN_RESET;
10966					msg_info.hdr.original_sc = NULL;
10967					msg_info.hdr.serializing_sc = NULL;
10968					if (CTL_HA_STATUS_SUCCESS !=
10969					    ctl_ha_msg_send(CTL_HA_CHAN_CTL,
10970					    (void *)&msg_info,
10971					    sizeof(msg_info), 0)) {
10972					}
10973				}
10974
10975				retval = ctl_lun_reset(lun, io,
10976						       CTL_UA_LUN_RESET);
10977				break;
10978			}
10979			case CTL_TASK_TARGET_RESET:
10980				retval = ctl_target_reset(ctl_softc, io,
10981							  CTL_UA_TARG_RESET);
10982				break;
10983			case CTL_TASK_BUS_RESET:
10984				retval = ctl_bus_reset(ctl_softc, io);
10985				break;
10986			case CTL_TASK_PORT_LOGIN:
10987				break;
10988			case CTL_TASK_PORT_LOGOUT:
10989				break;
10990			default:
10991				printf("ctl_run_task_queue: got unknown task "
10992				       "management event %d\n",
10993				       io->taskio.task_action);
10994				break;
10995			}
10996			if (retval == 0)
10997				io->io_hdr.status = CTL_SUCCESS;
10998			else
10999				io->io_hdr.status = CTL_ERROR;
11000
11001			STAILQ_REMOVE(&ctl_softc->task_queue, &io->io_hdr,
11002				      ctl_io_hdr, links);
11003			/*
11004			 * This will queue this I/O to the done queue, but the
11005			 * work thread won't be able to process it until we
11006			 * return and the lock is released.
11007			 */
11008			ctl_done_lock(io, /*have_lock*/ 1);
11009			break;
11010		}
11011		default: {
11012
11013			printf("%s: invalid I/O type %d msg %d cdb %x"
11014			       " iptl: %ju:%d:%ju:%d tag 0x%04x\n",
11015			       __func__, io->io_hdr.io_type,
11016			       io->io_hdr.msg_type, io->scsiio.cdb[0],
11017			       (uintmax_t)io->io_hdr.nexus.initid.id,
11018			       io->io_hdr.nexus.targ_port,
11019			       (uintmax_t)io->io_hdr.nexus.targ_target.id,
11020			       io->io_hdr.nexus.targ_lun,
11021			       (io->io_hdr.io_type == CTL_IO_TASK) ?
11022			       io->taskio.tag_num : io->scsiio.tag_num);
11023			STAILQ_REMOVE(&ctl_softc->task_queue, &io->io_hdr,
11024				      ctl_io_hdr, links);
11025			ctl_free_io_internal(io, 1);
11026			break;
11027		}
11028		}
11029	}
11030
11031	ctl_softc->flags &= ~CTL_FLAG_TASK_PENDING;
11032}
11033
11034/*
11035 * For HA operation.  Handle commands that come in from the other
11036 * controller.
11037 */
11038static void
11039ctl_handle_isc(union ctl_io *io)
11040{
11041	int free_io;
11042	struct ctl_lun *lun;
11043	struct ctl_softc *ctl_softc;
11044
11045	ctl_softc = control_softc;
11046
11047	lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
11048
11049	switch (io->io_hdr.msg_type) {
11050	case CTL_MSG_SERIALIZE:
11051		free_io = ctl_serialize_other_sc_cmd(&io->scsiio,
11052						     /*have_lock*/ 0);
11053		break;
11054	case CTL_MSG_R2R: {
11055		uint8_t opcode;
11056		struct ctl_cmd_entry *entry;
11057
11058		/*
11059		 * This is only used in SER_ONLY mode.
11060		 */
11061		free_io = 0;
11062		opcode = io->scsiio.cdb[0];
11063		entry = &ctl_cmd_table[opcode];
11064		mtx_lock(&ctl_softc->ctl_lock);
11065		if (ctl_scsiio_lun_check(ctl_softc, lun,
11066		    entry, (struct ctl_scsiio *)io) != 0) {
11067			ctl_done_lock(io, /*have_lock*/ 1);
11068			mtx_unlock(&ctl_softc->ctl_lock);
11069			break;
11070		}
11071		io->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
11072		STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
11073				   &io->io_hdr, links);
11074		mtx_unlock(&ctl_softc->ctl_lock);
11075		break;
11076	}
11077	case CTL_MSG_FINISH_IO:
11078		if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
11079			free_io = 0;
11080			ctl_done_lock(io, /*have_lock*/ 0);
11081		} else {
11082			free_io = 1;
11083			mtx_lock(&ctl_softc->ctl_lock);
11084			TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr,
11085				     ooa_links);
11086			STAILQ_REMOVE(&ctl_softc->task_queue,
11087				      &io->io_hdr, ctl_io_hdr, links);
11088			ctl_check_blocked(lun);
11089			mtx_unlock(&ctl_softc->ctl_lock);
11090		}
11091		break;
11092	case CTL_MSG_PERS_ACTION:
11093		ctl_hndl_per_res_out_on_other_sc(
11094			(union ctl_ha_msg *)&io->presio.pr_msg);
11095		free_io = 1;
11096		break;
11097	case CTL_MSG_BAD_JUJU:
11098		free_io = 0;
11099		ctl_done_lock(io, /*have_lock*/ 0);
11100		break;
11101	case CTL_MSG_DATAMOVE:
11102		/* Only used in XFER mode */
11103		free_io = 0;
11104		ctl_datamove_remote(io);
11105		break;
11106	case CTL_MSG_DATAMOVE_DONE:
11107		/* Only used in XFER mode */
11108		free_io = 0;
11109		io->scsiio.be_move_done(io);
11110		break;
11111	default:
11112		free_io = 1;
11113		printf("%s: Invalid message type %d\n",
11114		       __func__, io->io_hdr.msg_type);
11115		break;
11116	}
11117	if (free_io)
11118		ctl_free_io_internal(io, 0);
11119
11120}
11121
11122
11123/*
11124 * Returns the match type in the case of a match, or CTL_LUN_PAT_NONE if
11125 * there is no match.
11126 */
11127static ctl_lun_error_pattern
11128ctl_cmd_pattern_match(struct ctl_scsiio *ctsio, struct ctl_error_desc *desc)
11129{
11130	struct ctl_cmd_entry *entry;
11131	ctl_lun_error_pattern filtered_pattern, pattern;
11132	uint8_t opcode;
11133
11134	pattern = desc->error_pattern;
11135
11136	/*
11137	 * XXX KDM we need more data passed into this function to match a
11138	 * custom pattern, and we actually need to implement custom pattern
11139	 * matching.
11140	 */
11141	if (pattern & CTL_LUN_PAT_CMD)
11142		return (CTL_LUN_PAT_CMD);
11143
11144	if ((pattern & CTL_LUN_PAT_MASK) == CTL_LUN_PAT_ANY)
11145		return (CTL_LUN_PAT_ANY);
11146
11147	opcode = ctsio->cdb[0];
11148	entry = &ctl_cmd_table[opcode];
11149
11150	filtered_pattern = entry->pattern & pattern;
11151
11152	/*
11153	 * If the user requested specific flags in the pattern (e.g.
11154	 * CTL_LUN_PAT_RANGE), make sure the command supports all of those
11155	 * flags.
11156	 *
11157	 * If the user did not specify any flags, it doesn't matter whether
11158	 * or not the command supports the flags.
11159	 */
11160	if ((filtered_pattern & ~CTL_LUN_PAT_MASK) !=
11161	     (pattern & ~CTL_LUN_PAT_MASK))
11162		return (CTL_LUN_PAT_NONE);
11163
11164	/*
11165	 * If the user asked for a range check, see if the requested LBA
11166	 * range overlaps with this command's LBA range.
11167	 */
11168	if (filtered_pattern & CTL_LUN_PAT_RANGE) {
11169		uint64_t lba1;
11170		uint32_t len1;
11171		ctl_action action;
11172		int retval;
11173
11174		retval = ctl_get_lba_len((union ctl_io *)ctsio, &lba1, &len1);
11175		if (retval != 0)
11176			return (CTL_LUN_PAT_NONE);
11177
11178		action = ctl_extent_check_lba(lba1, len1, desc->lba_range.lba,
11179					      desc->lba_range.len);
11180		/*
11181		 * A "pass" means that the LBA ranges don't overlap, so
11182		 * this doesn't match the user's range criteria.
11183		 */
11184		if (action == CTL_ACTION_PASS)
11185			return (CTL_LUN_PAT_NONE);
11186	}
11187
11188	return (filtered_pattern);
11189}
11190
11191/*
11192 * Called with the CTL lock held.
11193 */
11194static void
11195ctl_inject_error(struct ctl_lun *lun, union ctl_io *io)
11196{
11197	struct ctl_error_desc *desc, *desc2;
11198
11199	STAILQ_FOREACH_SAFE(desc, &lun->error_list, links, desc2) {
11200		ctl_lun_error_pattern pattern;
11201		/*
11202		 * Check to see whether this particular command matches
11203		 * the pattern in the descriptor.
11204		 */
11205		pattern = ctl_cmd_pattern_match(&io->scsiio, desc);
11206		if ((pattern & CTL_LUN_PAT_MASK) == CTL_LUN_PAT_NONE)
11207			continue;
11208
11209		switch (desc->lun_error & CTL_LUN_INJ_TYPE) {
11210		case CTL_LUN_INJ_ABORTED:
11211			ctl_set_aborted(&io->scsiio);
11212			break;
11213		case CTL_LUN_INJ_MEDIUM_ERR:
11214			ctl_set_medium_error(&io->scsiio);
11215			break;
11216		case CTL_LUN_INJ_UA:
11217			/* 29h/00h  POWER ON, RESET, OR BUS DEVICE RESET
11218			 * OCCURRED */
11219			ctl_set_ua(&io->scsiio, 0x29, 0x00);
11220			break;
11221		case CTL_LUN_INJ_CUSTOM:
11222			/*
11223			 * We're assuming the user knows what he is doing.
11224			 * Just copy the sense information without doing
11225			 * checks.
11226			 */
11227			bcopy(&desc->custom_sense, &io->scsiio.sense_data,
11228			      ctl_min(sizeof(desc->custom_sense),
11229				      sizeof(io->scsiio.sense_data)));
11230			io->scsiio.scsi_status = SCSI_STATUS_CHECK_COND;
11231			io->scsiio.sense_len = SSD_FULL_SIZE;
11232			io->io_hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
11233			break;
11234		case CTL_LUN_INJ_NONE:
11235		default:
11236			/*
11237			 * If this is an error injection type we don't know
11238			 * about, clear the continuous flag (if it is set)
11239			 * so it will get deleted below.
11240			 */
11241			desc->lun_error &= ~CTL_LUN_INJ_CONTINUOUS;
11242			break;
11243		}
11244		/*
11245		 * By default, each error injection action is a one-shot
11246		 */
11247		if (desc->lun_error & CTL_LUN_INJ_CONTINUOUS)
11248			continue;
11249
11250		STAILQ_REMOVE(&lun->error_list, desc, ctl_error_desc, links);
11251
11252		free(desc, M_CTL);
11253	}
11254}
11255
11256#ifdef CTL_IO_DELAY
11257static void
11258ctl_datamove_timer_wakeup(void *arg)
11259{
11260	union ctl_io *io;
11261
11262	io = (union ctl_io *)arg;
11263
11264	ctl_datamove(io);
11265}
11266#endif /* CTL_IO_DELAY */
11267
11268/*
11269 * Assumption:  caller does NOT hold ctl_lock
11270 */
11271void
11272ctl_datamove(union ctl_io *io)
11273{
11274	void (*fe_datamove)(union ctl_io *io);
11275
11276	CTL_DEBUG_PRINT(("ctl_datamove\n"));
11277
11278#ifdef CTL_TIME_IO
11279	if ((time_uptime - io->io_hdr.start_time) > ctl_time_io_secs) {
11280		char str[256];
11281		char path_str[64];
11282		struct sbuf sb;
11283
11284		ctl_scsi_path_string(io, path_str, sizeof(path_str));
11285		sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
11286
11287		sbuf_cat(&sb, path_str);
11288		switch (io->io_hdr.io_type) {
11289		case CTL_IO_SCSI:
11290			ctl_scsi_command_string(&io->scsiio, NULL, &sb);
11291			sbuf_printf(&sb, "\n");
11292			sbuf_cat(&sb, path_str);
11293			sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
11294				    io->scsiio.tag_num, io->scsiio.tag_type);
11295			break;
11296		case CTL_IO_TASK:
11297			sbuf_printf(&sb, "Task I/O type: %d, Tag: 0x%04x, "
11298				    "Tag Type: %d\n", io->taskio.task_action,
11299				    io->taskio.tag_num, io->taskio.tag_type);
11300			break;
11301		default:
11302			printf("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
11303			panic("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
11304			break;
11305		}
11306		sbuf_cat(&sb, path_str);
11307		sbuf_printf(&sb, "ctl_datamove: %jd seconds\n",
11308			    (intmax_t)time_uptime - io->io_hdr.start_time);
11309		sbuf_finish(&sb);
11310		printf("%s", sbuf_data(&sb));
11311	}
11312#endif /* CTL_TIME_IO */
11313
11314	mtx_lock(&control_softc->ctl_lock);
11315#ifdef CTL_IO_DELAY
11316	if (io->io_hdr.flags & CTL_FLAG_DELAY_DONE) {
11317		struct ctl_lun *lun;
11318
11319		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
11320
11321		io->io_hdr.flags &= ~CTL_FLAG_DELAY_DONE;
11322	} else {
11323		struct ctl_lun *lun;
11324
11325		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
11326		if ((lun != NULL)
11327		 && (lun->delay_info.datamove_delay > 0)) {
11328			struct callout *callout;
11329
11330			callout = (struct callout *)&io->io_hdr.timer_bytes;
11331			callout_init(callout, /*mpsafe*/ 1);
11332			io->io_hdr.flags |= CTL_FLAG_DELAY_DONE;
11333			callout_reset(callout,
11334				      lun->delay_info.datamove_delay * hz,
11335				      ctl_datamove_timer_wakeup, io);
11336			if (lun->delay_info.datamove_type ==
11337			    CTL_DELAY_TYPE_ONESHOT)
11338				lun->delay_info.datamove_delay = 0;
11339			mtx_unlock(&control_softc->ctl_lock);
11340			return;
11341		}
11342	}
11343#endif
11344	/*
11345	 * If we have any pending task management commands, process them
11346	 * first.  This is necessary to eliminate a race condition with the
11347	 * FETD:
11348	 *
11349	 * - FETD submits a task management command, like an abort.
11350	 * - Back end calls fe_datamove() to move the data for the aborted
11351	 *   command.  The FETD can't really accept it, but if it did, it
11352	 *   would end up transmitting data for a command that the initiator
11353	 *   told us to abort.
11354	 *
11355	 * We close the race by processing all pending task management
11356	 * commands here (we can't block!), and then check this I/O to see
11357	 * if it has been aborted.  If so, return it to the back end with
11358	 * bad status, so the back end can say return an error to the back end
11359	 * and then when the back end returns an error, we can return the
11360	 * aborted command to the FETD, so it can clean up its resources.
11361	 */
11362	if (control_softc->flags & CTL_FLAG_TASK_PENDING)
11363		ctl_run_task_queue(control_softc);
11364
11365	/*
11366	 * This command has been aborted.  Set the port status, so we fail
11367	 * the data move.
11368	 */
11369	if (io->io_hdr.flags & CTL_FLAG_ABORT) {
11370		printf("ctl_datamove: tag 0x%04x on (%ju:%d:%ju:%d) aborted\n",
11371		       io->scsiio.tag_num,(uintmax_t)io->io_hdr.nexus.initid.id,
11372		       io->io_hdr.nexus.targ_port,
11373		       (uintmax_t)io->io_hdr.nexus.targ_target.id,
11374		       io->io_hdr.nexus.targ_lun);
11375		io->io_hdr.status = CTL_CMD_ABORTED;
11376		io->io_hdr.port_status = 31337;
11377		mtx_unlock(&control_softc->ctl_lock);
11378		/*
11379		 * Note that the backend, in this case, will get the
11380		 * callback in its context.  In other cases it may get
11381		 * called in the frontend's interrupt thread context.
11382		 */
11383		io->scsiio.be_move_done(io);
11384		return;
11385	}
11386
11387	/*
11388	 * If we're in XFER mode and this I/O is from the other shelf
11389	 * controller, we need to send the DMA to the other side to
11390	 * actually transfer the data to/from the host.  In serialize only
11391	 * mode the transfer happens below CTL and ctl_datamove() is only
11392	 * called on the machine that originally received the I/O.
11393	 */
11394	if ((control_softc->ha_mode == CTL_HA_MODE_XFER)
11395	 && (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
11396		union ctl_ha_msg msg;
11397		uint32_t sg_entries_sent;
11398		int do_sg_copy;
11399		int i;
11400
11401		memset(&msg, 0, sizeof(msg));
11402		msg.hdr.msg_type = CTL_MSG_DATAMOVE;
11403		msg.hdr.original_sc = io->io_hdr.original_sc;
11404		msg.hdr.serializing_sc = io;
11405		msg.hdr.nexus = io->io_hdr.nexus;
11406		msg.dt.flags = io->io_hdr.flags;
11407		/*
11408		 * We convert everything into a S/G list here.  We can't
11409		 * pass by reference, only by value between controllers.
11410		 * So we can't pass a pointer to the S/G list, only as many
11411		 * S/G entries as we can fit in here.  If it's possible for
11412		 * us to get more than CTL_HA_MAX_SG_ENTRIES S/G entries,
11413		 * then we need to break this up into multiple transfers.
11414		 */
11415		if (io->scsiio.kern_sg_entries == 0) {
11416			msg.dt.kern_sg_entries = 1;
11417			/*
11418			 * If this is in cached memory, flush the cache
11419			 * before we send the DMA request to the other
11420			 * controller.  We want to do this in either the
11421			 * read or the write case.  The read case is
11422			 * straightforward.  In the write case, we want to
11423			 * make sure nothing is in the local cache that
11424			 * could overwrite the DMAed data.
11425			 */
11426			if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
11427				/*
11428				 * XXX KDM use bus_dmamap_sync() here.
11429				 */
11430			}
11431
11432			/*
11433			 * Convert to a physical address if this is a
11434			 * virtual address.
11435			 */
11436			if (io->io_hdr.flags & CTL_FLAG_BUS_ADDR) {
11437				msg.dt.sg_list[0].addr =
11438					io->scsiio.kern_data_ptr;
11439			} else {
11440				/*
11441				 * XXX KDM use busdma here!
11442				 */
11443#if 0
11444				msg.dt.sg_list[0].addr = (void *)
11445					vtophys(io->scsiio.kern_data_ptr);
11446#endif
11447			}
11448
11449			msg.dt.sg_list[0].len = io->scsiio.kern_data_len;
11450			do_sg_copy = 0;
11451		} else {
11452			struct ctl_sg_entry *sgl;
11453
11454			do_sg_copy = 1;
11455			msg.dt.kern_sg_entries = io->scsiio.kern_sg_entries;
11456			sgl = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
11457			if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
11458				/*
11459				 * XXX KDM use bus_dmamap_sync() here.
11460				 */
11461			}
11462		}
11463
11464		msg.dt.kern_data_len = io->scsiio.kern_data_len;
11465		msg.dt.kern_total_len = io->scsiio.kern_total_len;
11466		msg.dt.kern_data_resid = io->scsiio.kern_data_resid;
11467		msg.dt.kern_rel_offset = io->scsiio.kern_rel_offset;
11468		msg.dt.sg_sequence = 0;
11469
11470		/*
11471		 * Loop until we've sent all of the S/G entries.  On the
11472		 * other end, we'll recompose these S/G entries into one
11473		 * contiguous list before passing it to the
11474		 */
11475		for (sg_entries_sent = 0; sg_entries_sent <
11476		     msg.dt.kern_sg_entries; msg.dt.sg_sequence++) {
11477			msg.dt.cur_sg_entries = ctl_min((sizeof(msg.dt.sg_list)/
11478				sizeof(msg.dt.sg_list[0])),
11479				msg.dt.kern_sg_entries - sg_entries_sent);
11480
11481			if (do_sg_copy != 0) {
11482				struct ctl_sg_entry *sgl;
11483				int j;
11484
11485				sgl = (struct ctl_sg_entry *)
11486					io->scsiio.kern_data_ptr;
11487				/*
11488				 * If this is in cached memory, flush the cache
11489				 * before we send the DMA request to the other
11490				 * controller.  We want to do this in either
11491				 * the * read or the write case.  The read
11492				 * case is straightforward.  In the write
11493				 * case, we want to make sure nothing is
11494				 * in the local cache that could overwrite
11495				 * the DMAed data.
11496				 */
11497
11498				for (i = sg_entries_sent, j = 0;
11499				     i < msg.dt.cur_sg_entries; i++, j++) {
11500					if ((io->io_hdr.flags &
11501					     CTL_FLAG_NO_DATASYNC) == 0) {
11502						/*
11503						 * XXX KDM use bus_dmamap_sync()
11504						 */
11505					}
11506					if ((io->io_hdr.flags &
11507					     CTL_FLAG_BUS_ADDR) == 0) {
11508						/*
11509						 * XXX KDM use busdma.
11510						 */
11511#if 0
11512						msg.dt.sg_list[j].addr =(void *)
11513						       vtophys(sgl[i].addr);
11514#endif
11515					} else {
11516						msg.dt.sg_list[j].addr =
11517							sgl[i].addr;
11518					}
11519					msg.dt.sg_list[j].len = sgl[i].len;
11520				}
11521			}
11522
11523			sg_entries_sent += msg.dt.cur_sg_entries;
11524			if (sg_entries_sent >= msg.dt.kern_sg_entries)
11525				msg.dt.sg_last = 1;
11526			else
11527				msg.dt.sg_last = 0;
11528
11529			/*
11530			 * XXX KDM drop and reacquire the lock here?
11531			 */
11532			if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg,
11533			    sizeof(msg), 0) > CTL_HA_STATUS_SUCCESS) {
11534				/*
11535				 * XXX do something here.
11536				 */
11537			}
11538
11539			msg.dt.sent_sg_entries = sg_entries_sent;
11540		}
11541		io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
11542		if (io->io_hdr.flags & CTL_FLAG_FAILOVER)
11543			ctl_failover_io(io, /*have_lock*/ 1);
11544
11545	} else {
11546
11547		/*
11548		 * Lookup the fe_datamove() function for this particular
11549		 * front end.
11550		 */
11551		fe_datamove =
11552		    control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
11553		mtx_unlock(&control_softc->ctl_lock);
11554
11555		fe_datamove(io);
11556	}
11557}
11558
11559static void
11560ctl_send_datamove_done(union ctl_io *io, int have_lock)
11561{
11562	union ctl_ha_msg msg;
11563	int isc_status;
11564
11565	memset(&msg, 0, sizeof(msg));
11566
11567	msg.hdr.msg_type = CTL_MSG_DATAMOVE_DONE;
11568	msg.hdr.original_sc = io;
11569	msg.hdr.serializing_sc = io->io_hdr.serializing_sc;
11570	msg.hdr.nexus = io->io_hdr.nexus;
11571	msg.hdr.status = io->io_hdr.status;
11572	msg.scsi.tag_num = io->scsiio.tag_num;
11573	msg.scsi.tag_type = io->scsiio.tag_type;
11574	msg.scsi.scsi_status = io->scsiio.scsi_status;
11575	memcpy(&msg.scsi.sense_data, &io->scsiio.sense_data,
11576	       sizeof(io->scsiio.sense_data));
11577	msg.scsi.sense_len = io->scsiio.sense_len;
11578	msg.scsi.sense_residual = io->scsiio.sense_residual;
11579	msg.scsi.fetd_status = io->io_hdr.port_status;
11580	msg.scsi.residual = io->scsiio.residual;
11581	io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
11582
11583	if (io->io_hdr.flags & CTL_FLAG_FAILOVER) {
11584		ctl_failover_io(io, /*have_lock*/ have_lock);
11585		return;
11586	}
11587
11588	isc_status = ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg, sizeof(msg), 0);
11589	if (isc_status > CTL_HA_STATUS_SUCCESS) {
11590		/* XXX do something if this fails */
11591	}
11592
11593}
11594
11595/*
11596 * The DMA to the remote side is done, now we need to tell the other side
11597 * we're done so it can continue with its data movement.
11598 */
11599static void
11600ctl_datamove_remote_write_cb(struct ctl_ha_dt_req *rq)
11601{
11602	union ctl_io *io;
11603
11604	io = rq->context;
11605
11606	if (rq->ret != CTL_HA_STATUS_SUCCESS) {
11607		printf("%s: ISC DMA write failed with error %d", __func__,
11608		       rq->ret);
11609		ctl_set_internal_failure(&io->scsiio,
11610					 /*sks_valid*/ 1,
11611					 /*retry_count*/ rq->ret);
11612	}
11613
11614	ctl_dt_req_free(rq);
11615
11616	/*
11617	 * In this case, we had to malloc the memory locally.  Free it.
11618	 */
11619	if ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0) {
11620		int i;
11621		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
11622			free(io->io_hdr.local_sglist[i].addr, M_CTL);
11623	}
11624	/*
11625	 * The data is in local and remote memory, so now we need to send
11626	 * status (good or back) back to the other side.
11627	 */
11628	ctl_send_datamove_done(io, /*have_lock*/ 0);
11629}
11630
11631/*
11632 * We've moved the data from the host/controller into local memory.  Now we
11633 * need to push it over to the remote controller's memory.
11634 */
11635static int
11636ctl_datamove_remote_dm_write_cb(union ctl_io *io)
11637{
11638	int retval;
11639
11640	retval = 0;
11641
11642	retval = ctl_datamove_remote_xfer(io, CTL_HA_DT_CMD_WRITE,
11643					  ctl_datamove_remote_write_cb);
11644
11645	return (retval);
11646}
11647
11648static void
11649ctl_datamove_remote_write(union ctl_io *io)
11650{
11651	int retval;
11652	void (*fe_datamove)(union ctl_io *io);
11653
11654	/*
11655	 * - Get the data from the host/HBA into local memory.
11656	 * - DMA memory from the local controller to the remote controller.
11657	 * - Send status back to the remote controller.
11658	 */
11659
11660	retval = ctl_datamove_remote_sgl_setup(io);
11661	if (retval != 0)
11662		return;
11663
11664	/* Switch the pointer over so the FETD knows what to do */
11665	io->scsiio.kern_data_ptr = (uint8_t *)io->io_hdr.local_sglist;
11666
11667	/*
11668	 * Use a custom move done callback, since we need to send completion
11669	 * back to the other controller, not to the backend on this side.
11670	 */
11671	io->scsiio.be_move_done = ctl_datamove_remote_dm_write_cb;
11672
11673	fe_datamove = control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
11674
11675	fe_datamove(io);
11676
11677	return;
11678
11679}
11680
11681static int
11682ctl_datamove_remote_dm_read_cb(union ctl_io *io)
11683{
11684#if 0
11685	char str[256];
11686	char path_str[64];
11687	struct sbuf sb;
11688#endif
11689
11690	/*
11691	 * In this case, we had to malloc the memory locally.  Free it.
11692	 */
11693	if ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0) {
11694		int i;
11695		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
11696			free(io->io_hdr.local_sglist[i].addr, M_CTL);
11697	}
11698
11699#if 0
11700	scsi_path_string(io, path_str, sizeof(path_str));
11701	sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
11702	sbuf_cat(&sb, path_str);
11703	scsi_command_string(&io->scsiio, NULL, &sb);
11704	sbuf_printf(&sb, "\n");
11705	sbuf_cat(&sb, path_str);
11706	sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
11707		    io->scsiio.tag_num, io->scsiio.tag_type);
11708	sbuf_cat(&sb, path_str);
11709	sbuf_printf(&sb, "%s: flags %#x, status %#x\n", __func__,
11710		    io->io_hdr.flags, io->io_hdr.status);
11711	sbuf_finish(&sb);
11712	printk("%s", sbuf_data(&sb));
11713#endif
11714
11715
11716	/*
11717	 * The read is done, now we need to send status (good or bad) back
11718	 * to the other side.
11719	 */
11720	ctl_send_datamove_done(io, /*have_lock*/ 0);
11721
11722	return (0);
11723}
11724
11725static void
11726ctl_datamove_remote_read_cb(struct ctl_ha_dt_req *rq)
11727{
11728	union ctl_io *io;
11729	void (*fe_datamove)(union ctl_io *io);
11730
11731	io = rq->context;
11732
11733	if (rq->ret != CTL_HA_STATUS_SUCCESS) {
11734		printf("%s: ISC DMA read failed with error %d", __func__,
11735		       rq->ret);
11736		ctl_set_internal_failure(&io->scsiio,
11737					 /*sks_valid*/ 1,
11738					 /*retry_count*/ rq->ret);
11739	}
11740
11741	ctl_dt_req_free(rq);
11742
11743	/* Switch the pointer over so the FETD knows what to do */
11744	io->scsiio.kern_data_ptr = (uint8_t *)io->io_hdr.local_sglist;
11745
11746	/*
11747	 * Use a custom move done callback, since we need to send completion
11748	 * back to the other controller, not to the backend on this side.
11749	 */
11750	io->scsiio.be_move_done = ctl_datamove_remote_dm_read_cb;
11751
11752	/* XXX KDM add checks like the ones in ctl_datamove? */
11753
11754	fe_datamove = control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
11755
11756	fe_datamove(io);
11757}
11758
11759static int
11760ctl_datamove_remote_sgl_setup(union ctl_io *io)
11761{
11762	struct ctl_sg_entry *local_sglist, *remote_sglist;
11763	struct ctl_sg_entry *local_dma_sglist, *remote_dma_sglist;
11764	struct ctl_softc *softc;
11765	int retval;
11766	int i;
11767
11768	retval = 0;
11769	softc = control_softc;
11770
11771	local_sglist = io->io_hdr.local_sglist;
11772	local_dma_sglist = io->io_hdr.local_dma_sglist;
11773	remote_sglist = io->io_hdr.remote_sglist;
11774	remote_dma_sglist = io->io_hdr.remote_dma_sglist;
11775
11776	if (io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) {
11777		for (i = 0; i < io->scsiio.kern_sg_entries; i++) {
11778			local_sglist[i].len = remote_sglist[i].len;
11779
11780			/*
11781			 * XXX Detect the situation where the RS-level I/O
11782			 * redirector on the other side has already read the
11783			 * data off of the AOR RS on this side, and
11784			 * transferred it to remote (mirror) memory on the
11785			 * other side.  Since we already have the data in
11786			 * memory here, we just need to use it.
11787			 *
11788			 * XXX KDM this can probably be removed once we
11789			 * get the cache device code in and take the
11790			 * current AOR implementation out.
11791			 */
11792#ifdef NEEDTOPORT
11793			if ((remote_sglist[i].addr >=
11794			     (void *)vtophys(softc->mirr->addr))
11795			 && (remote_sglist[i].addr <
11796			     ((void *)vtophys(softc->mirr->addr) +
11797			     CacheMirrorOffset))) {
11798				local_sglist[i].addr = remote_sglist[i].addr -
11799					CacheMirrorOffset;
11800				if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) ==
11801				     CTL_FLAG_DATA_IN)
11802					io->io_hdr.flags |= CTL_FLAG_REDIR_DONE;
11803			} else {
11804				local_sglist[i].addr = remote_sglist[i].addr +
11805					CacheMirrorOffset;
11806			}
11807#endif
11808#if 0
11809			printf("%s: local %p, remote %p, len %d\n",
11810			       __func__, local_sglist[i].addr,
11811			       remote_sglist[i].addr, local_sglist[i].len);
11812#endif
11813		}
11814	} else {
11815		uint32_t len_to_go;
11816
11817		/*
11818		 * In this case, we don't have automatically allocated
11819		 * memory for this I/O on this controller.  This typically
11820		 * happens with internal CTL I/O -- e.g. inquiry, mode
11821		 * sense, etc.  Anything coming from RAIDCore will have
11822		 * a mirror area available.
11823		 */
11824		len_to_go = io->scsiio.kern_data_len;
11825
11826		/*
11827		 * Clear the no datasync flag, we have to use malloced
11828		 * buffers.
11829		 */
11830		io->io_hdr.flags &= ~CTL_FLAG_NO_DATASYNC;
11831
11832		/*
11833		 * The difficult thing here is that the size of the various
11834		 * S/G segments may be different than the size from the
11835		 * remote controller.  That'll make it harder when DMAing
11836		 * the data back to the other side.
11837		 */
11838		for (i = 0; (i < sizeof(io->io_hdr.remote_sglist) /
11839		     sizeof(io->io_hdr.remote_sglist[0])) &&
11840		     (len_to_go > 0); i++) {
11841			local_sglist[i].len = ctl_min(len_to_go, 131072);
11842			CTL_SIZE_8B(local_dma_sglist[i].len,
11843				    local_sglist[i].len);
11844			local_sglist[i].addr =
11845				malloc(local_dma_sglist[i].len, M_CTL,M_WAITOK);
11846
11847			local_dma_sglist[i].addr = local_sglist[i].addr;
11848
11849			if (local_sglist[i].addr == NULL) {
11850				int j;
11851
11852				printf("malloc failed for %zd bytes!",
11853				       local_dma_sglist[i].len);
11854				for (j = 0; j < i; j++) {
11855					free(local_sglist[j].addr, M_CTL);
11856				}
11857				ctl_set_internal_failure(&io->scsiio,
11858							 /*sks_valid*/ 1,
11859							 /*retry_count*/ 4857);
11860				retval = 1;
11861				goto bailout_error;
11862
11863			}
11864			/* XXX KDM do we need a sync here? */
11865
11866			len_to_go -= local_sglist[i].len;
11867		}
11868		/*
11869		 * Reset the number of S/G entries accordingly.  The
11870		 * original number of S/G entries is available in
11871		 * rem_sg_entries.
11872		 */
11873		io->scsiio.kern_sg_entries = i;
11874
11875#if 0
11876		printf("%s: kern_sg_entries = %d\n", __func__,
11877		       io->scsiio.kern_sg_entries);
11878		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
11879			printf("%s: sg[%d] = %p, %d (DMA: %d)\n", __func__, i,
11880			       local_sglist[i].addr, local_sglist[i].len,
11881			       local_dma_sglist[i].len);
11882#endif
11883	}
11884
11885
11886	return (retval);
11887
11888bailout_error:
11889
11890	ctl_send_datamove_done(io, /*have_lock*/ 0);
11891
11892	return (retval);
11893}
11894
11895static int
11896ctl_datamove_remote_xfer(union ctl_io *io, unsigned command,
11897			 ctl_ha_dt_cb callback)
11898{
11899	struct ctl_ha_dt_req *rq;
11900	struct ctl_sg_entry *remote_sglist, *local_sglist;
11901	struct ctl_sg_entry *remote_dma_sglist, *local_dma_sglist;
11902	uint32_t local_used, remote_used, total_used;
11903	int retval;
11904	int i, j;
11905
11906	retval = 0;
11907
11908	rq = ctl_dt_req_alloc();
11909
11910	/*
11911	 * If we failed to allocate the request, and if the DMA didn't fail
11912	 * anyway, set busy status.  This is just a resource allocation
11913	 * failure.
11914	 */
11915	if ((rq == NULL)
11916	 && ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE))
11917		ctl_set_busy(&io->scsiio);
11918
11919	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE) {
11920
11921		if (rq != NULL)
11922			ctl_dt_req_free(rq);
11923
11924		/*
11925		 * The data move failed.  We need to return status back
11926		 * to the other controller.  No point in trying to DMA
11927		 * data to the remote controller.
11928		 */
11929
11930		ctl_send_datamove_done(io, /*have_lock*/ 0);
11931
11932		retval = 1;
11933
11934		goto bailout;
11935	}
11936
11937	local_sglist = io->io_hdr.local_sglist;
11938	local_dma_sglist = io->io_hdr.local_dma_sglist;
11939	remote_sglist = io->io_hdr.remote_sglist;
11940	remote_dma_sglist = io->io_hdr.remote_dma_sglist;
11941	local_used = 0;
11942	remote_used = 0;
11943	total_used = 0;
11944
11945	if (io->io_hdr.flags & CTL_FLAG_REDIR_DONE) {
11946		rq->ret = CTL_HA_STATUS_SUCCESS;
11947		rq->context = io;
11948		callback(rq);
11949		goto bailout;
11950	}
11951
11952	/*
11953	 * Pull/push the data over the wire from/to the other controller.
11954	 * This takes into account the possibility that the local and
11955	 * remote sglists may not be identical in terms of the size of
11956	 * the elements and the number of elements.
11957	 *
11958	 * One fundamental assumption here is that the length allocated for
11959	 * both the local and remote sglists is identical.  Otherwise, we've
11960	 * essentially got a coding error of some sort.
11961	 */
11962	for (i = 0, j = 0; total_used < io->scsiio.kern_data_len; ) {
11963		int isc_ret;
11964		uint32_t cur_len, dma_length;
11965		uint8_t *tmp_ptr;
11966
11967		rq->id = CTL_HA_DATA_CTL;
11968		rq->command = command;
11969		rq->context = io;
11970
11971		/*
11972		 * Both pointers should be aligned.  But it is possible
11973		 * that the allocation length is not.  They should both
11974		 * also have enough slack left over at the end, though,
11975		 * to round up to the next 8 byte boundary.
11976		 */
11977		cur_len = ctl_min(local_sglist[i].len - local_used,
11978				  remote_sglist[j].len - remote_used);
11979
11980		/*
11981		 * In this case, we have a size issue and need to decrease
11982		 * the size, except in the case where we actually have less
11983		 * than 8 bytes left.  In that case, we need to increase
11984		 * the DMA length to get the last bit.
11985		 */
11986		if ((cur_len & 0x7) != 0) {
11987			if (cur_len > 0x7) {
11988				cur_len = cur_len - (cur_len & 0x7);
11989				dma_length = cur_len;
11990			} else {
11991				CTL_SIZE_8B(dma_length, cur_len);
11992			}
11993
11994		} else
11995			dma_length = cur_len;
11996
11997		/*
11998		 * If we had to allocate memory for this I/O, instead of using
11999		 * the non-cached mirror memory, we'll need to flush the cache
12000		 * before trying to DMA to the other controller.
12001		 *
12002		 * We could end up doing this multiple times for the same
12003		 * segment if we have a larger local segment than remote
12004		 * segment.  That shouldn't be an issue.
12005		 */
12006		if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
12007			/*
12008			 * XXX KDM use bus_dmamap_sync() here.
12009			 */
12010		}
12011
12012		rq->size = dma_length;
12013
12014		tmp_ptr = (uint8_t *)local_sglist[i].addr;
12015		tmp_ptr += local_used;
12016
12017		/* Use physical addresses when talking to ISC hardware */
12018		if ((io->io_hdr.flags & CTL_FLAG_BUS_ADDR) == 0) {
12019			/* XXX KDM use busdma */
12020#if 0
12021			rq->local = vtophys(tmp_ptr);
12022#endif
12023		} else
12024			rq->local = tmp_ptr;
12025
12026		tmp_ptr = (uint8_t *)remote_sglist[j].addr;
12027		tmp_ptr += remote_used;
12028		rq->remote = tmp_ptr;
12029
12030		rq->callback = NULL;
12031
12032		local_used += cur_len;
12033		if (local_used >= local_sglist[i].len) {
12034			i++;
12035			local_used = 0;
12036		}
12037
12038		remote_used += cur_len;
12039		if (remote_used >= remote_sglist[j].len) {
12040			j++;
12041			remote_used = 0;
12042		}
12043		total_used += cur_len;
12044
12045		if (total_used >= io->scsiio.kern_data_len)
12046			rq->callback = callback;
12047
12048		if ((rq->size & 0x7) != 0) {
12049			printf("%s: warning: size %d is not on 8b boundary\n",
12050			       __func__, rq->size);
12051		}
12052		if (((uintptr_t)rq->local & 0x7) != 0) {
12053			printf("%s: warning: local %p not on 8b boundary\n",
12054			       __func__, rq->local);
12055		}
12056		if (((uintptr_t)rq->remote & 0x7) != 0) {
12057			printf("%s: warning: remote %p not on 8b boundary\n",
12058			       __func__, rq->local);
12059		}
12060#if 0
12061		printf("%s: %s: local %#x remote %#x size %d\n", __func__,
12062		       (command == CTL_HA_DT_CMD_WRITE) ? "WRITE" : "READ",
12063		       rq->local, rq->remote, rq->size);
12064#endif
12065
12066		isc_ret = ctl_dt_single(rq);
12067		if (isc_ret == CTL_HA_STATUS_WAIT)
12068			continue;
12069
12070		if (isc_ret == CTL_HA_STATUS_DISCONNECT) {
12071			rq->ret = CTL_HA_STATUS_SUCCESS;
12072		} else {
12073			rq->ret = isc_ret;
12074		}
12075		callback(rq);
12076		goto bailout;
12077	}
12078
12079bailout:
12080	return (retval);
12081
12082}
12083
12084static void
12085ctl_datamove_remote_read(union ctl_io *io)
12086{
12087	int retval;
12088	int i;
12089
12090	/*
12091	 * This will send an error to the other controller in the case of a
12092	 * failure.
12093	 */
12094	retval = ctl_datamove_remote_sgl_setup(io);
12095	if (retval != 0)
12096		return;
12097
12098	retval = ctl_datamove_remote_xfer(io, CTL_HA_DT_CMD_READ,
12099					  ctl_datamove_remote_read_cb);
12100	if ((retval != 0)
12101	 && ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0)) {
12102		/*
12103		 * Make sure we free memory if there was an error..  The
12104		 * ctl_datamove_remote_xfer() function will send the
12105		 * datamove done message, or call the callback with an
12106		 * error if there is a problem.
12107		 */
12108		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
12109			free(io->io_hdr.local_sglist[i].addr, M_CTL);
12110	}
12111
12112	return;
12113}
12114
12115/*
12116 * Process a datamove request from the other controller.  This is used for
12117 * XFER mode only, not SER_ONLY mode.  For writes, we DMA into local memory
12118 * first.  Once that is complete, the data gets DMAed into the remote
12119 * controller's memory.  For reads, we DMA from the remote controller's
12120 * memory into our memory first, and then move it out to the FETD.
12121 *
12122 * Should be called without the ctl_lock held.
12123 */
12124static void
12125ctl_datamove_remote(union ctl_io *io)
12126{
12127	struct ctl_softc *softc;
12128
12129	softc = control_softc;
12130
12131	/*
12132	 * Note that we look for an aborted I/O here, but don't do some of
12133	 * the other checks that ctl_datamove() normally does.  We don't
12134	 * need to run the task queue, because this I/O is on the ISC
12135	 * queue, which is executed by the work thread after the task queue.
12136	 * We don't need to run the datamove delay code, since that should
12137	 * have been done if need be on the other controller.
12138	 */
12139	mtx_lock(&softc->ctl_lock);
12140
12141	if (io->io_hdr.flags & CTL_FLAG_ABORT) {
12142
12143		printf("%s: tag 0x%04x on (%d:%d:%d:%d) aborted\n", __func__,
12144		       io->scsiio.tag_num, io->io_hdr.nexus.initid.id,
12145		       io->io_hdr.nexus.targ_port,
12146		       io->io_hdr.nexus.targ_target.id,
12147		       io->io_hdr.nexus.targ_lun);
12148		io->io_hdr.status = CTL_CMD_ABORTED;
12149		io->io_hdr.port_status = 31338;
12150
12151		mtx_unlock(&softc->ctl_lock);
12152
12153		ctl_send_datamove_done(io, /*have_lock*/ 0);
12154
12155		return;
12156	}
12157
12158	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_OUT) {
12159		mtx_unlock(&softc->ctl_lock);
12160		ctl_datamove_remote_write(io);
12161	} else if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN){
12162		mtx_unlock(&softc->ctl_lock);
12163		ctl_datamove_remote_read(io);
12164	} else {
12165		union ctl_ha_msg msg;
12166		struct scsi_sense_data *sense;
12167		uint8_t sks[3];
12168		int retry_count;
12169
12170		memset(&msg, 0, sizeof(msg));
12171
12172		msg.hdr.msg_type = CTL_MSG_BAD_JUJU;
12173		msg.hdr.status = CTL_SCSI_ERROR;
12174		msg.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
12175
12176		retry_count = 4243;
12177
12178		sense = &msg.scsi.sense_data;
12179		sks[0] = SSD_SCS_VALID;
12180		sks[1] = (retry_count >> 8) & 0xff;
12181		sks[2] = retry_count & 0xff;
12182
12183		/* "Internal target failure" */
12184		scsi_set_sense_data(sense,
12185				    /*sense_format*/ SSD_TYPE_NONE,
12186				    /*current_error*/ 1,
12187				    /*sense_key*/ SSD_KEY_HARDWARE_ERROR,
12188				    /*asc*/ 0x44,
12189				    /*ascq*/ 0x00,
12190				    /*type*/ SSD_ELEM_SKS,
12191				    /*size*/ sizeof(sks),
12192				    /*data*/ sks,
12193				    SSD_ELEM_NONE);
12194
12195		io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
12196		if (io->io_hdr.flags & CTL_FLAG_FAILOVER) {
12197			ctl_failover_io(io, /*have_lock*/ 1);
12198			mtx_unlock(&softc->ctl_lock);
12199			return;
12200		}
12201
12202		mtx_unlock(&softc->ctl_lock);
12203
12204		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg, sizeof(msg), 0) >
12205		    CTL_HA_STATUS_SUCCESS) {
12206			/* XXX KDM what to do if this fails? */
12207		}
12208		return;
12209	}
12210
12211}
12212
12213static int
12214ctl_process_done(union ctl_io *io, int have_lock)
12215{
12216	struct ctl_lun *lun;
12217	struct ctl_softc *ctl_softc;
12218	void (*fe_done)(union ctl_io *io);
12219	uint32_t targ_port = ctl_port_idx(io->io_hdr.nexus.targ_port);
12220
12221	CTL_DEBUG_PRINT(("ctl_process_done\n"));
12222
12223	fe_done =
12224	    control_softc->ctl_ports[targ_port]->fe_done;
12225
12226#ifdef CTL_TIME_IO
12227	if ((time_uptime - io->io_hdr.start_time) > ctl_time_io_secs) {
12228		char str[256];
12229		char path_str[64];
12230		struct sbuf sb;
12231
12232		ctl_scsi_path_string(io, path_str, sizeof(path_str));
12233		sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
12234
12235		sbuf_cat(&sb, path_str);
12236		switch (io->io_hdr.io_type) {
12237		case CTL_IO_SCSI:
12238			ctl_scsi_command_string(&io->scsiio, NULL, &sb);
12239			sbuf_printf(&sb, "\n");
12240			sbuf_cat(&sb, path_str);
12241			sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
12242				    io->scsiio.tag_num, io->scsiio.tag_type);
12243			break;
12244		case CTL_IO_TASK:
12245			sbuf_printf(&sb, "Task I/O type: %d, Tag: 0x%04x, "
12246				    "Tag Type: %d\n", io->taskio.task_action,
12247				    io->taskio.tag_num, io->taskio.tag_type);
12248			break;
12249		default:
12250			printf("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
12251			panic("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
12252			break;
12253		}
12254		sbuf_cat(&sb, path_str);
12255		sbuf_printf(&sb, "ctl_process_done: %jd seconds\n",
12256			    (intmax_t)time_uptime - io->io_hdr.start_time);
12257		sbuf_finish(&sb);
12258		printf("%s", sbuf_data(&sb));
12259	}
12260#endif /* CTL_TIME_IO */
12261
12262	switch (io->io_hdr.io_type) {
12263	case CTL_IO_SCSI:
12264		break;
12265	case CTL_IO_TASK:
12266		ctl_io_error_print(io, NULL);
12267		if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
12268			ctl_free_io_internal(io, /*have_lock*/ 0);
12269		else
12270			fe_done(io);
12271		return (CTL_RETVAL_COMPLETE);
12272		break;
12273	default:
12274		printf("ctl_process_done: invalid io type %d\n",
12275		       io->io_hdr.io_type);
12276		panic("ctl_process_done: invalid io type %d\n",
12277		      io->io_hdr.io_type);
12278		break; /* NOTREACHED */
12279	}
12280
12281	lun = (struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
12282	if (lun == NULL) {
12283		CTL_DEBUG_PRINT(("NULL LUN for lun %d\n",
12284				 io->io_hdr.nexus.targ_lun));
12285		fe_done(io);
12286		goto bailout;
12287	}
12288	ctl_softc = lun->ctl_softc;
12289
12290	/*
12291	 * Remove this from the OOA queue.
12292	 */
12293	if (have_lock == 0)
12294		mtx_lock(&ctl_softc->ctl_lock);
12295
12296	/*
12297	 * Check to see if we have any errors to inject here.  We only
12298	 * inject errors for commands that don't already have errors set.
12299	 */
12300	if ((STAILQ_FIRST(&lun->error_list) != NULL)
12301	 && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS))
12302		ctl_inject_error(lun, io);
12303
12304	/*
12305	 * XXX KDM how do we treat commands that aren't completed
12306	 * successfully?
12307	 *
12308	 * XXX KDM should we also track I/O latency?
12309	 */
12310	if ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS) {
12311		uint32_t blocksize;
12312#ifdef CTL_TIME_IO
12313		struct bintime cur_bt;
12314#endif
12315
12316		if ((lun->be_lun != NULL)
12317		 && (lun->be_lun->blocksize != 0))
12318			blocksize = lun->be_lun->blocksize;
12319		else
12320			blocksize = 512;
12321
12322		switch (io->io_hdr.io_type) {
12323		case CTL_IO_SCSI: {
12324			int isread;
12325			struct ctl_lba_len lbalen;
12326
12327			isread = 0;
12328			switch (io->scsiio.cdb[0]) {
12329			case READ_6:
12330			case READ_10:
12331			case READ_12:
12332			case READ_16:
12333				isread = 1;
12334				/* FALLTHROUGH */
12335			case WRITE_6:
12336			case WRITE_10:
12337			case WRITE_12:
12338			case WRITE_16:
12339			case WRITE_VERIFY_10:
12340			case WRITE_VERIFY_12:
12341			case WRITE_VERIFY_16:
12342				memcpy(&lbalen, io->io_hdr.ctl_private[
12343				       CTL_PRIV_LBA_LEN].bytes, sizeof(lbalen));
12344
12345				if (isread) {
12346					lun->stats.ports[targ_port].bytes[CTL_STATS_READ] +=
12347						lbalen.len * blocksize;
12348					lun->stats.ports[targ_port].operations[CTL_STATS_READ]++;
12349
12350#ifdef CTL_TIME_IO
12351					bintime_add(
12352					   &lun->stats.ports[targ_port].dma_time[CTL_STATS_READ],
12353					   &io->io_hdr.dma_bt);
12354					lun->stats.ports[targ_port].num_dmas[CTL_STATS_READ] +=
12355						io->io_hdr.num_dmas;
12356					getbintime(&cur_bt);
12357					bintime_sub(&cur_bt,
12358						    &io->io_hdr.start_bt);
12359
12360					bintime_add(
12361					    &lun->stats.ports[targ_port].time[CTL_STATS_READ],
12362					    &cur_bt);
12363
12364#if 0
12365					cs_prof_gettime(&cur_ticks);
12366					lun->stats.time[CTL_STATS_READ] +=
12367						cur_ticks -
12368						io->io_hdr.start_ticks;
12369#endif
12370#if 0
12371					lun->stats.time[CTL_STATS_READ] +=
12372						jiffies - io->io_hdr.start_time;
12373#endif
12374#endif /* CTL_TIME_IO */
12375				} else {
12376					lun->stats.ports[targ_port].bytes[CTL_STATS_WRITE] +=
12377						lbalen.len * blocksize;
12378					lun->stats.ports[targ_port].operations[
12379						CTL_STATS_WRITE]++;
12380
12381#ifdef CTL_TIME_IO
12382					bintime_add(
12383					  &lun->stats.ports[targ_port].dma_time[CTL_STATS_WRITE],
12384					  &io->io_hdr.dma_bt);
12385					lun->stats.ports[targ_port].num_dmas[CTL_STATS_WRITE] +=
12386						io->io_hdr.num_dmas;
12387					getbintime(&cur_bt);
12388					bintime_sub(&cur_bt,
12389						    &io->io_hdr.start_bt);
12390
12391					bintime_add(
12392					    &lun->stats.ports[targ_port].time[CTL_STATS_WRITE],
12393					    &cur_bt);
12394#if 0
12395					cs_prof_gettime(&cur_ticks);
12396					lun->stats.ports[targ_port].time[CTL_STATS_WRITE] +=
12397						cur_ticks -
12398						io->io_hdr.start_ticks;
12399					lun->stats.ports[targ_port].time[CTL_STATS_WRITE] +=
12400						jiffies - io->io_hdr.start_time;
12401#endif
12402#endif /* CTL_TIME_IO */
12403				}
12404				break;
12405			default:
12406				lun->stats.ports[targ_port].operations[CTL_STATS_NO_IO]++;
12407
12408#ifdef CTL_TIME_IO
12409				bintime_add(
12410				  &lun->stats.ports[targ_port].dma_time[CTL_STATS_NO_IO],
12411				  &io->io_hdr.dma_bt);
12412				lun->stats.ports[targ_port].num_dmas[CTL_STATS_NO_IO] +=
12413					io->io_hdr.num_dmas;
12414				getbintime(&cur_bt);
12415				bintime_sub(&cur_bt, &io->io_hdr.start_bt);
12416
12417				bintime_add(&lun->stats.ports[targ_port].time[CTL_STATS_NO_IO],
12418					    &cur_bt);
12419
12420#if 0
12421				cs_prof_gettime(&cur_ticks);
12422				lun->stats.ports[targ_port].time[CTL_STATS_NO_IO] +=
12423					cur_ticks -
12424					io->io_hdr.start_ticks;
12425				lun->stats.ports[targ_port].time[CTL_STATS_NO_IO] +=
12426					jiffies - io->io_hdr.start_time;
12427#endif
12428#endif /* CTL_TIME_IO */
12429				break;
12430			}
12431			break;
12432		}
12433		default:
12434			break;
12435		}
12436	}
12437
12438	TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr, ooa_links);
12439
12440	/*
12441	 * Run through the blocked queue on this LUN and see if anything
12442	 * has become unblocked, now that this transaction is done.
12443	 */
12444	ctl_check_blocked(lun);
12445
12446	/*
12447	 * If the LUN has been invalidated, free it if there is nothing
12448	 * left on its OOA queue.
12449	 */
12450	if ((lun->flags & CTL_LUN_INVALID)
12451	 && (TAILQ_FIRST(&lun->ooa_queue) == NULL))
12452		ctl_free_lun(lun);
12453
12454	/*
12455	 * If this command has been aborted, make sure we set the status
12456	 * properly.  The FETD is responsible for freeing the I/O and doing
12457	 * whatever it needs to do to clean up its state.
12458	 */
12459	if (io->io_hdr.flags & CTL_FLAG_ABORT)
12460		io->io_hdr.status = CTL_CMD_ABORTED;
12461
12462	/*
12463	 * We print out status for every task management command.  For SCSI
12464	 * commands, we filter out any unit attention errors; they happen
12465	 * on every boot, and would clutter up the log.  Note:  task
12466	 * management commands aren't printed here, they are printed above,
12467	 * since they should never even make it down here.
12468	 */
12469	switch (io->io_hdr.io_type) {
12470	case CTL_IO_SCSI: {
12471		int error_code, sense_key, asc, ascq;
12472
12473		sense_key = 0;
12474
12475		if (((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SCSI_ERROR)
12476		 && (io->scsiio.scsi_status == SCSI_STATUS_CHECK_COND)) {
12477			/*
12478			 * Since this is just for printing, no need to
12479			 * show errors here.
12480			 */
12481			scsi_extract_sense_len(&io->scsiio.sense_data,
12482					       io->scsiio.sense_len,
12483					       &error_code,
12484					       &sense_key,
12485					       &asc,
12486					       &ascq,
12487					       /*show_errors*/ 0);
12488		}
12489
12490		if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
12491		 && (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SCSI_ERROR)
12492		  || (io->scsiio.scsi_status != SCSI_STATUS_CHECK_COND)
12493		  || (sense_key != SSD_KEY_UNIT_ATTENTION))) {
12494
12495			if ((time_uptime - ctl_softc->last_print_jiffies) <= 0){
12496				ctl_softc->skipped_prints++;
12497				if (have_lock == 0)
12498					mtx_unlock(&ctl_softc->ctl_lock);
12499			} else {
12500				uint32_t skipped_prints;
12501
12502				skipped_prints = ctl_softc->skipped_prints;
12503
12504				ctl_softc->skipped_prints = 0;
12505				ctl_softc->last_print_jiffies = time_uptime;
12506
12507				if (have_lock == 0)
12508					mtx_unlock(&ctl_softc->ctl_lock);
12509				if (skipped_prints > 0) {
12510#ifdef NEEDTOPORT
12511					csevent_log(CSC_CTL | CSC_SHELF_SW |
12512					    CTL_ERROR_REPORT,
12513					    csevent_LogType_Trace,
12514					    csevent_Severity_Information,
12515					    csevent_AlertLevel_Green,
12516					    csevent_FRU_Firmware,
12517					    csevent_FRU_Unknown,
12518					    "High CTL error volume, %d prints "
12519					    "skipped", skipped_prints);
12520#endif
12521				}
12522				ctl_io_error_print(io, NULL);
12523			}
12524		} else {
12525			if (have_lock == 0)
12526				mtx_unlock(&ctl_softc->ctl_lock);
12527		}
12528		break;
12529	}
12530	case CTL_IO_TASK:
12531		if (have_lock == 0)
12532			mtx_unlock(&ctl_softc->ctl_lock);
12533		ctl_io_error_print(io, NULL);
12534		break;
12535	default:
12536		if (have_lock == 0)
12537			mtx_unlock(&ctl_softc->ctl_lock);
12538		break;
12539	}
12540
12541	/*
12542	 * Tell the FETD or the other shelf controller we're done with this
12543	 * command.  Note that only SCSI commands get to this point.  Task
12544	 * management commands are completed above.
12545	 *
12546	 * We only send status to the other controller if we're in XFER
12547	 * mode.  In SER_ONLY mode, the I/O is done on the controller that
12548	 * received the I/O (from CTL's perspective), and so the status is
12549	 * generated there.
12550	 *
12551	 * XXX KDM if we hold the lock here, we could cause a deadlock
12552	 * if the frontend comes back in in this context to queue
12553	 * something.
12554	 */
12555	if ((ctl_softc->ha_mode == CTL_HA_MODE_XFER)
12556	 && (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
12557		union ctl_ha_msg msg;
12558
12559		memset(&msg, 0, sizeof(msg));
12560		msg.hdr.msg_type = CTL_MSG_FINISH_IO;
12561		msg.hdr.original_sc = io->io_hdr.original_sc;
12562		msg.hdr.nexus = io->io_hdr.nexus;
12563		msg.hdr.status = io->io_hdr.status;
12564		msg.scsi.scsi_status = io->scsiio.scsi_status;
12565		msg.scsi.tag_num = io->scsiio.tag_num;
12566		msg.scsi.tag_type = io->scsiio.tag_type;
12567		msg.scsi.sense_len = io->scsiio.sense_len;
12568		msg.scsi.sense_residual = io->scsiio.sense_residual;
12569		msg.scsi.residual = io->scsiio.residual;
12570		memcpy(&msg.scsi.sense_data, &io->scsiio.sense_data,
12571		       sizeof(io->scsiio.sense_data));
12572		/*
12573		 * We copy this whether or not this is an I/O-related
12574		 * command.  Otherwise, we'd have to go and check to see
12575		 * whether it's a read/write command, and it really isn't
12576		 * worth it.
12577		 */
12578		memcpy(&msg.scsi.lbalen,
12579		       &io->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes,
12580		       sizeof(msg.scsi.lbalen));;
12581
12582		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg,
12583				sizeof(msg), 0) > CTL_HA_STATUS_SUCCESS) {
12584			/* XXX do something here */
12585		}
12586
12587		ctl_free_io_internal(io, /*have_lock*/ 0);
12588	} else
12589		fe_done(io);
12590
12591bailout:
12592
12593	return (CTL_RETVAL_COMPLETE);
12594}
12595
12596/*
12597 * Front end should call this if it doesn't do autosense.  When the request
12598 * sense comes back in from the initiator, we'll dequeue this and send it.
12599 */
12600int
12601ctl_queue_sense(union ctl_io *io)
12602{
12603	struct ctl_lun *lun;
12604	struct ctl_softc *ctl_softc;
12605	uint32_t initidx;
12606
12607	ctl_softc = control_softc;
12608
12609	CTL_DEBUG_PRINT(("ctl_queue_sense\n"));
12610
12611	/*
12612	 * LUN lookup will likely move to the ctl_work_thread() once we
12613	 * have our new queueing infrastructure (that doesn't put things on
12614	 * a per-LUN queue initially).  That is so that we can handle
12615	 * things like an INQUIRY to a LUN that we don't have enabled.  We
12616	 * can't deal with that right now.
12617	 */
12618	mtx_lock(&ctl_softc->ctl_lock);
12619
12620	/*
12621	 * If we don't have a LUN for this, just toss the sense
12622	 * information.
12623	 */
12624	if ((io->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
12625	 && (ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun] != NULL))
12626		lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
12627	else
12628		goto bailout;
12629
12630	initidx = ctl_get_initindex(&io->io_hdr.nexus);
12631
12632	/*
12633	 * Already have CA set for this LUN...toss the sense information.
12634	 */
12635	if (ctl_is_set(lun->have_ca, initidx))
12636		goto bailout;
12637
12638	memcpy(&lun->pending_sense[initidx].sense, &io->scsiio.sense_data,
12639	       ctl_min(sizeof(lun->pending_sense[initidx].sense),
12640	       sizeof(io->scsiio.sense_data)));
12641	ctl_set_mask(lun->have_ca, initidx);
12642
12643bailout:
12644	mtx_unlock(&ctl_softc->ctl_lock);
12645
12646	ctl_free_io(io);
12647
12648	return (CTL_RETVAL_COMPLETE);
12649}
12650
12651/*
12652 * Primary command inlet from frontend ports.  All SCSI and task I/O
12653 * requests must go through this function.
12654 */
12655int
12656ctl_queue(union ctl_io *io)
12657{
12658	struct ctl_softc *ctl_softc;
12659
12660	CTL_DEBUG_PRINT(("ctl_queue cdb[0]=%02X\n", io->scsiio.cdb[0]));
12661
12662	ctl_softc = control_softc;
12663
12664#ifdef CTL_TIME_IO
12665	io->io_hdr.start_time = time_uptime;
12666	getbintime(&io->io_hdr.start_bt);
12667#endif /* CTL_TIME_IO */
12668
12669	mtx_lock(&ctl_softc->ctl_lock);
12670
12671	switch (io->io_hdr.io_type) {
12672	case CTL_IO_SCSI:
12673		STAILQ_INSERT_TAIL(&ctl_softc->incoming_queue, &io->io_hdr,
12674				   links);
12675		break;
12676	case CTL_IO_TASK:
12677		STAILQ_INSERT_TAIL(&ctl_softc->task_queue, &io->io_hdr, links);
12678		/*
12679		 * Set the task pending flag.  This is necessary to close a
12680		 * race condition with the FETD:
12681		 *
12682		 * - FETD submits a task management command, like an abort.
12683		 * - Back end calls fe_datamove() to move the data for the
12684		 *   aborted command.  The FETD can't really accept it, but
12685		 *   if it did, it would end up transmitting data for a
12686		 *   command that the initiator told us to abort.
12687		 *
12688		 * We close the race condition by setting the flag here,
12689		 * and checking it in ctl_datamove(), before calling the
12690		 * FETD's fe_datamove routine.  If we've got a task
12691		 * pending, we run the task queue and then check to see
12692		 * whether our particular I/O has been aborted.
12693		 */
12694		ctl_softc->flags |= CTL_FLAG_TASK_PENDING;
12695		break;
12696	default:
12697		mtx_unlock(&ctl_softc->ctl_lock);
12698		printf("ctl_queue: unknown I/O type %d\n", io->io_hdr.io_type);
12699		return (-EINVAL);
12700		break; /* NOTREACHED */
12701	}
12702	mtx_unlock(&ctl_softc->ctl_lock);
12703
12704	ctl_wakeup_thread();
12705
12706	return (CTL_RETVAL_COMPLETE);
12707}
12708
12709#ifdef CTL_IO_DELAY
12710static void
12711ctl_done_timer_wakeup(void *arg)
12712{
12713	union ctl_io *io;
12714
12715	io = (union ctl_io *)arg;
12716	ctl_done_lock(io, /*have_lock*/ 0);
12717}
12718#endif /* CTL_IO_DELAY */
12719
12720void
12721ctl_done_lock(union ctl_io *io, int have_lock)
12722{
12723	struct ctl_softc *ctl_softc;
12724#ifndef CTL_DONE_THREAD
12725	union ctl_io *xio;
12726#endif /* !CTL_DONE_THREAD */
12727
12728	ctl_softc = control_softc;
12729
12730	if (have_lock == 0)
12731		mtx_lock(&ctl_softc->ctl_lock);
12732
12733	/*
12734	 * Enable this to catch duplicate completion issues.
12735	 */
12736#if 0
12737	if (io->io_hdr.flags & CTL_FLAG_ALREADY_DONE) {
12738		printf("%s: type %d msg %d cdb %x iptl: "
12739		       "%d:%d:%d:%d tag 0x%04x "
12740		       "flag %#x status %x\n",
12741			__func__,
12742			io->io_hdr.io_type,
12743			io->io_hdr.msg_type,
12744			io->scsiio.cdb[0],
12745			io->io_hdr.nexus.initid.id,
12746			io->io_hdr.nexus.targ_port,
12747			io->io_hdr.nexus.targ_target.id,
12748			io->io_hdr.nexus.targ_lun,
12749			(io->io_hdr.io_type ==
12750			CTL_IO_TASK) ?
12751			io->taskio.tag_num :
12752			io->scsiio.tag_num,
12753		        io->io_hdr.flags,
12754			io->io_hdr.status);
12755	} else
12756		io->io_hdr.flags |= CTL_FLAG_ALREADY_DONE;
12757#endif
12758
12759	/*
12760	 * This is an internal copy of an I/O, and should not go through
12761	 * the normal done processing logic.
12762	 */
12763	if (io->io_hdr.flags & CTL_FLAG_INT_COPY) {
12764		if (have_lock == 0)
12765			mtx_unlock(&ctl_softc->ctl_lock);
12766		return;
12767	}
12768
12769	/*
12770	 * We need to send a msg to the serializing shelf to finish the IO
12771	 * as well.  We don't send a finish message to the other shelf if
12772	 * this is a task management command.  Task management commands
12773	 * aren't serialized in the OOA queue, but rather just executed on
12774	 * both shelf controllers for commands that originated on that
12775	 * controller.
12776	 */
12777	if ((io->io_hdr.flags & CTL_FLAG_SENT_2OTHER_SC)
12778	 && (io->io_hdr.io_type != CTL_IO_TASK)) {
12779		union ctl_ha_msg msg_io;
12780
12781		msg_io.hdr.msg_type = CTL_MSG_FINISH_IO;
12782		msg_io.hdr.serializing_sc = io->io_hdr.serializing_sc;
12783		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_io,
12784		    sizeof(msg_io), 0 ) != CTL_HA_STATUS_SUCCESS) {
12785		}
12786		/* continue on to finish IO */
12787	}
12788#ifdef CTL_IO_DELAY
12789	if (io->io_hdr.flags & CTL_FLAG_DELAY_DONE) {
12790		struct ctl_lun *lun;
12791
12792		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
12793
12794		io->io_hdr.flags &= ~CTL_FLAG_DELAY_DONE;
12795	} else {
12796		struct ctl_lun *lun;
12797
12798		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
12799
12800		if ((lun != NULL)
12801		 && (lun->delay_info.done_delay > 0)) {
12802			struct callout *callout;
12803
12804			callout = (struct callout *)&io->io_hdr.timer_bytes;
12805			callout_init(callout, /*mpsafe*/ 1);
12806			io->io_hdr.flags |= CTL_FLAG_DELAY_DONE;
12807			callout_reset(callout,
12808				      lun->delay_info.done_delay * hz,
12809				      ctl_done_timer_wakeup, io);
12810			if (lun->delay_info.done_type == CTL_DELAY_TYPE_ONESHOT)
12811				lun->delay_info.done_delay = 0;
12812			if (have_lock == 0)
12813				mtx_unlock(&ctl_softc->ctl_lock);
12814			return;
12815		}
12816	}
12817#endif /* CTL_IO_DELAY */
12818
12819	STAILQ_INSERT_TAIL(&ctl_softc->done_queue, &io->io_hdr, links);
12820
12821#ifdef CTL_DONE_THREAD
12822	if (have_lock == 0)
12823		mtx_unlock(&ctl_softc->ctl_lock);
12824
12825	ctl_wakeup_thread();
12826#else /* CTL_DONE_THREAD */
12827	for (xio = (union ctl_io *)STAILQ_FIRST(&ctl_softc->done_queue);
12828	     xio != NULL;
12829	     xio =(union ctl_io *)STAILQ_FIRST(&ctl_softc->done_queue)) {
12830
12831		STAILQ_REMOVE_HEAD(&ctl_softc->done_queue, links);
12832
12833		ctl_process_done(xio, /*have_lock*/ 1);
12834	}
12835	if (have_lock == 0)
12836		mtx_unlock(&ctl_softc->ctl_lock);
12837#endif /* CTL_DONE_THREAD */
12838}
12839
12840void
12841ctl_done(union ctl_io *io)
12842{
12843	ctl_done_lock(io, /*have_lock*/ 0);
12844}
12845
12846int
12847ctl_isc(struct ctl_scsiio *ctsio)
12848{
12849	struct ctl_lun *lun;
12850	int retval;
12851
12852	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
12853
12854	CTL_DEBUG_PRINT(("ctl_isc: command: %02x\n", ctsio->cdb[0]));
12855
12856	CTL_DEBUG_PRINT(("ctl_isc: calling data_submit()\n"));
12857
12858	retval = lun->backend->data_submit((union ctl_io *)ctsio);
12859
12860	return (retval);
12861}
12862
12863
12864static void
12865ctl_work_thread(void *arg)
12866{
12867	struct ctl_softc *softc;
12868	union ctl_io *io;
12869	struct ctl_be_lun *be_lun;
12870	int retval;
12871
12872	CTL_DEBUG_PRINT(("ctl_work_thread starting\n"));
12873
12874	softc = (struct ctl_softc *)arg;
12875	if (softc == NULL)
12876		return;
12877
12878	mtx_lock(&softc->ctl_lock);
12879	for (;;) {
12880		retval = 0;
12881
12882		/*
12883		 * We handle the queues in this order:
12884		 * - task management
12885		 * - ISC
12886		 * - done queue (to free up resources, unblock other commands)
12887		 * - RtR queue
12888		 * - incoming queue
12889		 *
12890		 * If those queues are empty, we break out of the loop and
12891		 * go to sleep.
12892		 */
12893		io = (union ctl_io *)STAILQ_FIRST(&softc->task_queue);
12894		if (io != NULL) {
12895			ctl_run_task_queue(softc);
12896			continue;
12897		}
12898		io = (union ctl_io *)STAILQ_FIRST(&softc->isc_queue);
12899		if (io != NULL) {
12900			STAILQ_REMOVE_HEAD(&softc->isc_queue, links);
12901			ctl_handle_isc(io);
12902			continue;
12903		}
12904		io = (union ctl_io *)STAILQ_FIRST(&softc->done_queue);
12905		if (io != NULL) {
12906			STAILQ_REMOVE_HEAD(&softc->done_queue, links);
12907			/* clear any blocked commands, call fe_done */
12908			mtx_unlock(&softc->ctl_lock);
12909			/*
12910			 * XXX KDM
12911			 * Call this without a lock for now.  This will
12912			 * depend on whether there is any way the FETD can
12913			 * sleep or deadlock if called with the CTL lock
12914			 * held.
12915			 */
12916			retval = ctl_process_done(io, /*have_lock*/ 0);
12917			mtx_lock(&softc->ctl_lock);
12918			continue;
12919		}
12920		if (!ctl_pause_rtr) {
12921			io = (union ctl_io *)STAILQ_FIRST(&softc->rtr_queue);
12922			if (io != NULL) {
12923				STAILQ_REMOVE_HEAD(&softc->rtr_queue, links);
12924				mtx_unlock(&softc->ctl_lock);
12925				goto execute;
12926			}
12927		}
12928		io = (union ctl_io *)STAILQ_FIRST(&softc->incoming_queue);
12929		if (io != NULL) {
12930			STAILQ_REMOVE_HEAD(&softc->incoming_queue, links);
12931			mtx_unlock(&softc->ctl_lock);
12932			ctl_scsiio_precheck(softc, &io->scsiio);
12933			mtx_lock(&softc->ctl_lock);
12934			continue;
12935		}
12936		/*
12937		 * We might want to move this to a separate thread, so that
12938		 * configuration requests (in this case LUN creations)
12939		 * won't impact the I/O path.
12940		 */
12941		be_lun = STAILQ_FIRST(&softc->pending_lun_queue);
12942		if (be_lun != NULL) {
12943			STAILQ_REMOVE_HEAD(&softc->pending_lun_queue, links);
12944			mtx_unlock(&softc->ctl_lock);
12945			ctl_create_lun(be_lun);
12946			mtx_lock(&softc->ctl_lock);
12947			continue;
12948		}
12949
12950		/* XXX KDM use the PDROP flag?? */
12951		/* Sleep until we have something to do. */
12952		mtx_sleep(softc, &softc->ctl_lock, PRIBIO, "ctl_work", 0);
12953
12954		/* Back to the top of the loop to see what woke us up. */
12955		continue;
12956
12957execute:
12958		retval = ctl_scsiio(&io->scsiio);
12959		switch (retval) {
12960		case CTL_RETVAL_COMPLETE:
12961			break;
12962		default:
12963			/*
12964			 * Probably need to make sure this doesn't happen.
12965			 */
12966			break;
12967		}
12968		mtx_lock(&softc->ctl_lock);
12969	}
12970}
12971
12972void
12973ctl_wakeup_thread()
12974{
12975	struct ctl_softc *softc;
12976
12977	softc = control_softc;
12978
12979	wakeup(softc);
12980}
12981
12982/* Initialization and failover */
12983
12984void
12985ctl_init_isc_msg(void)
12986{
12987	printf("CTL: Still calling this thing\n");
12988}
12989
12990/*
12991 * Init component
12992 * 	Initializes component into configuration defined by bootMode
12993 *	(see hasc-sv.c)
12994 *  	returns hasc_Status:
12995 * 		OK
12996 *		ERROR - fatal error
12997 */
12998static ctl_ha_comp_status
12999ctl_isc_init(struct ctl_ha_component *c)
13000{
13001	ctl_ha_comp_status ret = CTL_HA_COMP_STATUS_OK;
13002
13003	c->status = ret;
13004	return ret;
13005}
13006
13007/* Start component
13008 * 	Starts component in state requested. If component starts successfully,
13009 *	it must set its own state to the requestrd state
13010 *	When requested state is HASC_STATE_HA, the component may refine it
13011 * 	by adding _SLAVE or _MASTER flags.
13012 *	Currently allowed state transitions are:
13013 *	UNKNOWN->HA		- initial startup
13014 *	UNKNOWN->SINGLE - initial startup when no parter detected
13015 *	HA->SINGLE		- failover
13016 * returns ctl_ha_comp_status:
13017 * 		OK	- component successfully started in requested state
13018 *		FAILED  - could not start the requested state, failover may
13019 * 			  be possible
13020 *		ERROR	- fatal error detected, no future startup possible
13021 */
13022static ctl_ha_comp_status
13023ctl_isc_start(struct ctl_ha_component *c, ctl_ha_state state)
13024{
13025	ctl_ha_comp_status ret = CTL_HA_COMP_STATUS_OK;
13026
13027	// UNKNOWN->HA or UNKNOWN->SINGLE (bootstrap)
13028	if (c->state == CTL_HA_STATE_UNKNOWN ) {
13029		ctl_is_single = 0;
13030		if (ctl_ha_msg_create(CTL_HA_CHAN_CTL, ctl_isc_event_handler)
13031		    != CTL_HA_STATUS_SUCCESS) {
13032			printf("ctl_isc_start: ctl_ha_msg_create failed.\n");
13033			ret = CTL_HA_COMP_STATUS_ERROR;
13034		}
13035	} else if (CTL_HA_STATE_IS_HA(c->state)
13036		&& CTL_HA_STATE_IS_SINGLE(state)){
13037		// HA->SINGLE transition
13038	        ctl_failover();
13039		ctl_is_single = 1;
13040	} else {
13041		printf("ctl_isc_start:Invalid state transition %X->%X\n",
13042		       c->state, state);
13043		ret = CTL_HA_COMP_STATUS_ERROR;
13044	}
13045	if (CTL_HA_STATE_IS_SINGLE(state))
13046		ctl_is_single = 1;
13047
13048	c->state = state;
13049	c->status = ret;
13050	return ret;
13051}
13052
13053/*
13054 * Quiesce component
13055 * The component must clear any error conditions (set status to OK) and
13056 * prepare itself to another Start call
13057 * returns ctl_ha_comp_status:
13058 * 	OK
13059 *	ERROR
13060 */
13061static ctl_ha_comp_status
13062ctl_isc_quiesce(struct ctl_ha_component *c)
13063{
13064	int ret = CTL_HA_COMP_STATUS_OK;
13065
13066	ctl_pause_rtr = 1;
13067	c->status = ret;
13068	return ret;
13069}
13070
13071struct ctl_ha_component ctl_ha_component_ctlisc =
13072{
13073	.name = "CTL ISC",
13074	.state = CTL_HA_STATE_UNKNOWN,
13075	.init = ctl_isc_init,
13076	.start = ctl_isc_start,
13077	.quiesce = ctl_isc_quiesce
13078};
13079
13080/*
13081 *  vim: ts=8
13082 */
13083