1/*-
2 * Copyright (c) 2003-2009 Silicon Graphics International Corp.
3 * Copyright (c) 2012 The FreeBSD Foundation
4 * All rights reserved.
5 *
6 * Portions of this software were developed by Edward Tomasz Napierala
7 * under sponsorship from the FreeBSD Foundation.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions, and the following disclaimer,
14 *    without modification.
15 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
16 *    substantially similar to the "NO WARRANTY" disclaimer below
17 *    ("Disclaimer") and any redistribution must be conditioned upon
18 *    including a substantially similar Disclaimer requirement for further
19 *    binary redistribution.
20 *
21 * NO WARRANTY
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
30 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
31 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32 * POSSIBILITY OF SUCH DAMAGES.
33 *
34 * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl.c#8 $
35 */
36/*
37 * CAM Target Layer, a SCSI device emulation subsystem.
38 *
39 * Author: Ken Merry <ken@FreeBSD.org>
40 */
41
42#define _CTL_C
43
44#include <sys/cdefs.h>
45__FBSDID("$FreeBSD$");
46
47#include <sys/param.h>
48#include <sys/systm.h>
49#include <sys/kernel.h>
50#include <sys/types.h>
51#include <sys/kthread.h>
52#include <sys/bio.h>
53#include <sys/fcntl.h>
54#include <sys/lock.h>
55#include <sys/module.h>
56#include <sys/mutex.h>
57#include <sys/condvar.h>
58#include <sys/malloc.h>
59#include <sys/conf.h>
60#include <sys/ioccom.h>
61#include <sys/queue.h>
62#include <sys/sbuf.h>
63#include <sys/endian.h>
64#include <sys/sysctl.h>
65
66#include <cam/cam.h>
67#include <cam/scsi/scsi_all.h>
68#include <cam/scsi/scsi_da.h>
69#include <cam/ctl/ctl_io.h>
70#include <cam/ctl/ctl.h>
71#include <cam/ctl/ctl_frontend.h>
72#include <cam/ctl/ctl_frontend_internal.h>
73#include <cam/ctl/ctl_util.h>
74#include <cam/ctl/ctl_backend.h>
75#include <cam/ctl/ctl_ioctl.h>
76#include <cam/ctl/ctl_ha.h>
77#include <cam/ctl/ctl_private.h>
78#include <cam/ctl/ctl_debug.h>
79#include <cam/ctl/ctl_scsi_all.h>
80#include <cam/ctl/ctl_error.h>
81
82struct ctl_softc *control_softc = NULL;
83
84/*
85 * The default is to run with CTL_DONE_THREAD turned on.  Completed
86 * transactions are queued for processing by the CTL work thread.  When
87 * CTL_DONE_THREAD is not defined, completed transactions are processed in
88 * the caller's context.
89 */
90#define CTL_DONE_THREAD
91
92/*
93 * Use the serial number and device ID provided by the backend, rather than
94 * making up our own.
95 */
96#define CTL_USE_BACKEND_SN
97
98/*
99 * Size and alignment macros needed for Copan-specific HA hardware.  These
100 * can go away when the HA code is re-written, and uses busdma for any
101 * hardware.
102 */
103#define	CTL_ALIGN_8B(target, source, type)				\
104	if (((uint32_t)source & 0x7) != 0)				\
105		target = (type)(source + (0x8 - ((uint32_t)source & 0x7)));\
106	else								\
107		target = (type)source;
108
109#define	CTL_SIZE_8B(target, size)					\
110	if ((size & 0x7) != 0)						\
111		target = size + (0x8 - (size & 0x7));			\
112	else								\
113		target = size;
114
115#define CTL_ALIGN_8B_MARGIN	16
116
117/*
118 * Template mode pages.
119 */
120
121/*
122 * Note that these are default values only.  The actual values will be
123 * filled in when the user does a mode sense.
124 */
125static struct copan_power_subpage power_page_default = {
126	/*page_code*/ PWR_PAGE_CODE | SMPH_SPF,
127	/*subpage*/ PWR_SUBPAGE_CODE,
128	/*page_length*/ {(sizeof(struct copan_power_subpage) - 4) & 0xff00,
129			 (sizeof(struct copan_power_subpage) - 4) & 0x00ff},
130	/*page_version*/ PWR_VERSION,
131	/* total_luns */ 26,
132	/* max_active_luns*/ PWR_DFLT_MAX_LUNS,
133	/*reserved*/ {0, 0, 0, 0, 0, 0, 0, 0, 0,
134		      0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
135		      0, 0, 0, 0, 0, 0}
136};
137
138static struct copan_power_subpage power_page_changeable = {
139	/*page_code*/ PWR_PAGE_CODE | SMPH_SPF,
140	/*subpage*/ PWR_SUBPAGE_CODE,
141	/*page_length*/ {(sizeof(struct copan_power_subpage) - 4) & 0xff00,
142			 (sizeof(struct copan_power_subpage) - 4) & 0x00ff},
143	/*page_version*/ 0,
144	/* total_luns */ 0,
145	/* max_active_luns*/ 0,
146	/*reserved*/ {0, 0, 0, 0, 0, 0, 0, 0, 0,
147		      0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
148		      0, 0, 0, 0, 0, 0}
149};
150
151static struct copan_aps_subpage aps_page_default = {
152	APS_PAGE_CODE | SMPH_SPF, //page_code
153	APS_SUBPAGE_CODE, //subpage
154	{(sizeof(struct copan_aps_subpage) - 4) & 0xff00,
155	 (sizeof(struct copan_aps_subpage) - 4) & 0x00ff}, //page_length
156	APS_VERSION, //page_version
157	0, //lock_active
158	{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
159	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
160	0, 0, 0, 0, 0} //reserved
161};
162
163static struct copan_aps_subpage aps_page_changeable = {
164	APS_PAGE_CODE | SMPH_SPF, //page_code
165	APS_SUBPAGE_CODE, //subpage
166	{(sizeof(struct copan_aps_subpage) - 4) & 0xff00,
167	 (sizeof(struct copan_aps_subpage) - 4) & 0x00ff}, //page_length
168	0, //page_version
169	0, //lock_active
170	{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
171	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
172	0, 0, 0, 0, 0} //reserved
173};
174
175static struct copan_debugconf_subpage debugconf_page_default = {
176	DBGCNF_PAGE_CODE | SMPH_SPF,	/* page_code */
177	DBGCNF_SUBPAGE_CODE,		/* subpage */
178	{(sizeof(struct copan_debugconf_subpage) - 4) >> 8,
179	 (sizeof(struct copan_debugconf_subpage) - 4) >> 0}, /* page_length */
180	DBGCNF_VERSION,			/* page_version */
181	{CTL_TIME_IO_DEFAULT_SECS>>8,
182	 CTL_TIME_IO_DEFAULT_SECS>>0},	/* ctl_time_io_secs */
183};
184
185static struct copan_debugconf_subpage debugconf_page_changeable = {
186	DBGCNF_PAGE_CODE | SMPH_SPF,	/* page_code */
187	DBGCNF_SUBPAGE_CODE,		/* subpage */
188	{(sizeof(struct copan_debugconf_subpage) - 4) >> 8,
189	 (sizeof(struct copan_debugconf_subpage) - 4) >> 0}, /* page_length */
190	0,				/* page_version */
191	{0xff,0xff},			/* ctl_time_io_secs */
192};
193
194static struct scsi_format_page format_page_default = {
195	/*page_code*/SMS_FORMAT_DEVICE_PAGE,
196	/*page_length*/sizeof(struct scsi_format_page) - 2,
197	/*tracks_per_zone*/ {0, 0},
198	/*alt_sectors_per_zone*/ {0, 0},
199	/*alt_tracks_per_zone*/ {0, 0},
200	/*alt_tracks_per_lun*/ {0, 0},
201	/*sectors_per_track*/ {(CTL_DEFAULT_SECTORS_PER_TRACK >> 8) & 0xff,
202			        CTL_DEFAULT_SECTORS_PER_TRACK & 0xff},
203	/*bytes_per_sector*/ {0, 0},
204	/*interleave*/ {0, 0},
205	/*track_skew*/ {0, 0},
206	/*cylinder_skew*/ {0, 0},
207	/*flags*/ SFP_HSEC,
208	/*reserved*/ {0, 0, 0}
209};
210
211static struct scsi_format_page format_page_changeable = {
212	/*page_code*/SMS_FORMAT_DEVICE_PAGE,
213	/*page_length*/sizeof(struct scsi_format_page) - 2,
214	/*tracks_per_zone*/ {0, 0},
215	/*alt_sectors_per_zone*/ {0, 0},
216	/*alt_tracks_per_zone*/ {0, 0},
217	/*alt_tracks_per_lun*/ {0, 0},
218	/*sectors_per_track*/ {0, 0},
219	/*bytes_per_sector*/ {0, 0},
220	/*interleave*/ {0, 0},
221	/*track_skew*/ {0, 0},
222	/*cylinder_skew*/ {0, 0},
223	/*flags*/ 0,
224	/*reserved*/ {0, 0, 0}
225};
226
227static struct scsi_rigid_disk_page rigid_disk_page_default = {
228	/*page_code*/SMS_RIGID_DISK_PAGE,
229	/*page_length*/sizeof(struct scsi_rigid_disk_page) - 2,
230	/*cylinders*/ {0, 0, 0},
231	/*heads*/ CTL_DEFAULT_HEADS,
232	/*start_write_precomp*/ {0, 0, 0},
233	/*start_reduced_current*/ {0, 0, 0},
234	/*step_rate*/ {0, 0},
235	/*landing_zone_cylinder*/ {0, 0, 0},
236	/*rpl*/ SRDP_RPL_DISABLED,
237	/*rotational_offset*/ 0,
238	/*reserved1*/ 0,
239	/*rotation_rate*/ {(CTL_DEFAULT_ROTATION_RATE >> 8) & 0xff,
240			   CTL_DEFAULT_ROTATION_RATE & 0xff},
241	/*reserved2*/ {0, 0}
242};
243
244static struct scsi_rigid_disk_page rigid_disk_page_changeable = {
245	/*page_code*/SMS_RIGID_DISK_PAGE,
246	/*page_length*/sizeof(struct scsi_rigid_disk_page) - 2,
247	/*cylinders*/ {0, 0, 0},
248	/*heads*/ 0,
249	/*start_write_precomp*/ {0, 0, 0},
250	/*start_reduced_current*/ {0, 0, 0},
251	/*step_rate*/ {0, 0},
252	/*landing_zone_cylinder*/ {0, 0, 0},
253	/*rpl*/ 0,
254	/*rotational_offset*/ 0,
255	/*reserved1*/ 0,
256	/*rotation_rate*/ {0, 0},
257	/*reserved2*/ {0, 0}
258};
259
260static struct scsi_caching_page caching_page_default = {
261	/*page_code*/SMS_CACHING_PAGE,
262	/*page_length*/sizeof(struct scsi_caching_page) - 2,
263	/*flags1*/ SCP_DISC | SCP_WCE,
264	/*ret_priority*/ 0,
265	/*disable_pf_transfer_len*/ {0xff, 0xff},
266	/*min_prefetch*/ {0, 0},
267	/*max_prefetch*/ {0xff, 0xff},
268	/*max_pf_ceiling*/ {0xff, 0xff},
269	/*flags2*/ 0,
270	/*cache_segments*/ 0,
271	/*cache_seg_size*/ {0, 0},
272	/*reserved*/ 0,
273	/*non_cache_seg_size*/ {0, 0, 0}
274};
275
276static struct scsi_caching_page caching_page_changeable = {
277	/*page_code*/SMS_CACHING_PAGE,
278	/*page_length*/sizeof(struct scsi_caching_page) - 2,
279	/*flags1*/ 0,
280	/*ret_priority*/ 0,
281	/*disable_pf_transfer_len*/ {0, 0},
282	/*min_prefetch*/ {0, 0},
283	/*max_prefetch*/ {0, 0},
284	/*max_pf_ceiling*/ {0, 0},
285	/*flags2*/ 0,
286	/*cache_segments*/ 0,
287	/*cache_seg_size*/ {0, 0},
288	/*reserved*/ 0,
289	/*non_cache_seg_size*/ {0, 0, 0}
290};
291
292static struct scsi_control_page control_page_default = {
293	/*page_code*/SMS_CONTROL_MODE_PAGE,
294	/*page_length*/sizeof(struct scsi_control_page) - 2,
295	/*rlec*/0,
296	/*queue_flags*/0,
297	/*eca_and_aen*/0,
298	/*reserved*/0,
299	/*aen_holdoff_period*/{0, 0}
300};
301
302static struct scsi_control_page control_page_changeable = {
303	/*page_code*/SMS_CONTROL_MODE_PAGE,
304	/*page_length*/sizeof(struct scsi_control_page) - 2,
305	/*rlec*/SCP_DSENSE,
306	/*queue_flags*/0,
307	/*eca_and_aen*/0,
308	/*reserved*/0,
309	/*aen_holdoff_period*/{0, 0}
310};
311
312
313/*
314 * XXX KDM move these into the softc.
315 */
316static int rcv_sync_msg;
317static int persis_offset;
318static uint8_t ctl_pause_rtr;
319static int     ctl_is_single = 1;
320static int     index_to_aps_page;
321int	   ctl_disable = 0;
322
323SYSCTL_NODE(_kern_cam, OID_AUTO, ctl, CTLFLAG_RD, 0, "CAM Target Layer");
324SYSCTL_INT(_kern_cam_ctl, OID_AUTO, disable, CTLFLAG_RDTUN, &ctl_disable, 0,
325	   "Disable CTL");
326TUNABLE_INT("kern.cam.ctl.disable", &ctl_disable);
327static int verbose = 0;
328TUNABLE_INT("kern.cam.ctl.verbose", &verbose);
329SYSCTL_INT(_kern_cam_ctl, OID_AUTO, verbose, CTLFLAG_RWTUN,
330    &verbose, 0, "Show SCSI errors returned to initiator");
331
332/*
333 * Serial number (0x80), device id (0x83), and supported pages (0x00)
334 */
335#define SCSI_EVPD_NUM_SUPPORTED_PAGES	3
336
337static void ctl_isc_event_handler(ctl_ha_channel chanel, ctl_ha_event event,
338				  int param);
339static void ctl_copy_sense_data(union ctl_ha_msg *src, union ctl_io *dest);
340static int ctl_init(void);
341void ctl_shutdown(void);
342static int ctl_open(struct cdev *dev, int flags, int fmt, struct thread *td);
343static int ctl_close(struct cdev *dev, int flags, int fmt, struct thread *td);
344static void ctl_ioctl_online(void *arg);
345static void ctl_ioctl_offline(void *arg);
346static int ctl_ioctl_targ_enable(void *arg, struct ctl_id targ_id);
347static int ctl_ioctl_targ_disable(void *arg, struct ctl_id targ_id);
348static int ctl_ioctl_lun_enable(void *arg, struct ctl_id targ_id, int lun_id);
349static int ctl_ioctl_lun_disable(void *arg, struct ctl_id targ_id, int lun_id);
350static int ctl_ioctl_do_datamove(struct ctl_scsiio *ctsio);
351static int ctl_serialize_other_sc_cmd(struct ctl_scsiio *ctsio, int have_lock);
352static int ctl_ioctl_submit_wait(union ctl_io *io);
353static void ctl_ioctl_datamove(union ctl_io *io);
354static void ctl_ioctl_done(union ctl_io *io);
355static void ctl_ioctl_hard_startstop_callback(void *arg,
356					      struct cfi_metatask *metatask);
357static void ctl_ioctl_bbrread_callback(void *arg,struct cfi_metatask *metatask);
358static int ctl_ioctl_fill_ooa(struct ctl_lun *lun, uint32_t *cur_fill_num,
359			      struct ctl_ooa *ooa_hdr,
360			      struct ctl_ooa_entry *kern_entries);
361static int ctl_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
362		     struct thread *td);
363uint32_t ctl_get_resindex(struct ctl_nexus *nexus);
364uint32_t ctl_port_idx(int port_num);
365#ifdef unused
366static union ctl_io *ctl_malloc_io(ctl_io_type io_type, uint32_t targ_port,
367				   uint32_t targ_target, uint32_t targ_lun,
368				   int can_wait);
369static void ctl_kfree_io(union ctl_io *io);
370#endif /* unused */
371static int ctl_alloc_lun(struct ctl_softc *ctl_softc, struct ctl_lun *lun,
372			 struct ctl_be_lun *be_lun, struct ctl_id target_id);
373static int ctl_free_lun(struct ctl_lun *lun);
374static void ctl_create_lun(struct ctl_be_lun *be_lun);
375/**
376static void ctl_failover_change_pages(struct ctl_softc *softc,
377				      struct ctl_scsiio *ctsio, int master);
378**/
379
380static int ctl_do_mode_select(union ctl_io *io);
381static int ctl_pro_preempt(struct ctl_softc *softc, struct ctl_lun *lun,
382			   uint64_t res_key, uint64_t sa_res_key,
383			   uint8_t type, uint32_t residx,
384			   struct ctl_scsiio *ctsio,
385			   struct scsi_per_res_out *cdb,
386			   struct scsi_per_res_out_parms* param);
387static void ctl_pro_preempt_other(struct ctl_lun *lun,
388				  union ctl_ha_msg *msg);
389static void ctl_hndl_per_res_out_on_other_sc(union ctl_ha_msg *msg);
390static int ctl_inquiry_evpd_supported(struct ctl_scsiio *ctsio, int alloc_len);
391static int ctl_inquiry_evpd_serial(struct ctl_scsiio *ctsio, int alloc_len);
392static int ctl_inquiry_evpd_devid(struct ctl_scsiio *ctsio, int alloc_len);
393static int ctl_inquiry_evpd(struct ctl_scsiio *ctsio);
394static int ctl_inquiry_std(struct ctl_scsiio *ctsio);
395static int ctl_get_lba_len(union ctl_io *io, uint64_t *lba, uint32_t *len);
396static ctl_action ctl_extent_check(union ctl_io *io1, union ctl_io *io2);
397static ctl_action ctl_check_for_blockage(union ctl_io *pending_io,
398					 union ctl_io *ooa_io);
399static ctl_action ctl_check_ooa(struct ctl_lun *lun, union ctl_io *pending_io,
400				union ctl_io *starting_io);
401static int ctl_check_blocked(struct ctl_lun *lun);
402static int ctl_scsiio_lun_check(struct ctl_softc *ctl_softc,
403				struct ctl_lun *lun,
404				struct ctl_cmd_entry *entry,
405				struct ctl_scsiio *ctsio);
406//static int ctl_check_rtr(union ctl_io *pending_io, struct ctl_softc *softc);
407static void ctl_failover(void);
408static int ctl_scsiio_precheck(struct ctl_softc *ctl_softc,
409			       struct ctl_scsiio *ctsio);
410static int ctl_scsiio(struct ctl_scsiio *ctsio);
411
412static int ctl_bus_reset(struct ctl_softc *ctl_softc, union ctl_io *io);
413static int ctl_target_reset(struct ctl_softc *ctl_softc, union ctl_io *io,
414			    ctl_ua_type ua_type);
415static int ctl_lun_reset(struct ctl_lun *lun, union ctl_io *io,
416			 ctl_ua_type ua_type);
417static int ctl_abort_task(union ctl_io *io);
418static void ctl_run_task_queue(struct ctl_softc *ctl_softc);
419#ifdef CTL_IO_DELAY
420static void ctl_datamove_timer_wakeup(void *arg);
421static void ctl_done_timer_wakeup(void *arg);
422#endif /* CTL_IO_DELAY */
423
424static void ctl_send_datamove_done(union ctl_io *io, int have_lock);
425static void ctl_datamove_remote_write_cb(struct ctl_ha_dt_req *rq);
426static int ctl_datamove_remote_dm_write_cb(union ctl_io *io);
427static void ctl_datamove_remote_write(union ctl_io *io);
428static int ctl_datamove_remote_dm_read_cb(union ctl_io *io);
429static void ctl_datamove_remote_read_cb(struct ctl_ha_dt_req *rq);
430static int ctl_datamove_remote_sgl_setup(union ctl_io *io);
431static int ctl_datamove_remote_xfer(union ctl_io *io, unsigned command,
432				    ctl_ha_dt_cb callback);
433static void ctl_datamove_remote_read(union ctl_io *io);
434static void ctl_datamove_remote(union ctl_io *io);
435static int ctl_process_done(union ctl_io *io, int have_lock);
436static void ctl_work_thread(void *arg);
437
438/*
439 * Load the serialization table.  This isn't very pretty, but is probably
440 * the easiest way to do it.
441 */
442#include "ctl_ser_table.c"
443
444/*
445 * We only need to define open, close and ioctl routines for this driver.
446 */
447static struct cdevsw ctl_cdevsw = {
448	.d_version =	D_VERSION,
449	.d_flags =	0,
450	.d_open =	ctl_open,
451	.d_close =	ctl_close,
452	.d_ioctl =	ctl_ioctl,
453	.d_name =	"ctl",
454};
455
456
457MALLOC_DEFINE(M_CTL, "ctlmem", "Memory used for CTL");
458
459static int ctl_module_event_handler(module_t, int /*modeventtype_t*/, void *);
460
461static moduledata_t ctl_moduledata = {
462	"ctl",
463	ctl_module_event_handler,
464	NULL
465};
466
467DECLARE_MODULE(ctl, ctl_moduledata, SI_SUB_CONFIGURE, SI_ORDER_THIRD);
468MODULE_VERSION(ctl, 1);
469
470static void
471ctl_isc_handler_finish_xfer(struct ctl_softc *ctl_softc,
472			    union ctl_ha_msg *msg_info)
473{
474	struct ctl_scsiio *ctsio;
475
476	if (msg_info->hdr.original_sc == NULL) {
477		printf("%s: original_sc == NULL!\n", __func__);
478		/* XXX KDM now what? */
479		return;
480	}
481
482	ctsio = &msg_info->hdr.original_sc->scsiio;
483	ctsio->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
484	ctsio->io_hdr.msg_type = CTL_MSG_FINISH_IO;
485	ctsio->io_hdr.status = msg_info->hdr.status;
486	ctsio->scsi_status = msg_info->scsi.scsi_status;
487	ctsio->sense_len = msg_info->scsi.sense_len;
488	ctsio->sense_residual = msg_info->scsi.sense_residual;
489	ctsio->residual = msg_info->scsi.residual;
490	memcpy(&ctsio->sense_data, &msg_info->scsi.sense_data,
491	       sizeof(ctsio->sense_data));
492	memcpy(&ctsio->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes,
493	       &msg_info->scsi.lbalen, sizeof(msg_info->scsi.lbalen));
494	STAILQ_INSERT_TAIL(&ctl_softc->isc_queue, &ctsio->io_hdr, links);
495	ctl_wakeup_thread();
496}
497
498static void
499ctl_isc_handler_finish_ser_only(struct ctl_softc *ctl_softc,
500				union ctl_ha_msg *msg_info)
501{
502	struct ctl_scsiio *ctsio;
503
504	if (msg_info->hdr.serializing_sc == NULL) {
505		printf("%s: serializing_sc == NULL!\n", __func__);
506		/* XXX KDM now what? */
507		return;
508	}
509
510	ctsio = &msg_info->hdr.serializing_sc->scsiio;
511#if 0
512	/*
513	 * Attempt to catch the situation where an I/O has
514	 * been freed, and we're using it again.
515	 */
516	if (ctsio->io_hdr.io_type == 0xff) {
517		union ctl_io *tmp_io;
518		tmp_io = (union ctl_io *)ctsio;
519		printf("%s: %p use after free!\n", __func__,
520		       ctsio);
521		printf("%s: type %d msg %d cdb %x iptl: "
522		       "%d:%d:%d:%d tag 0x%04x "
523		       "flag %#x status %x\n",
524			__func__,
525			tmp_io->io_hdr.io_type,
526			tmp_io->io_hdr.msg_type,
527			tmp_io->scsiio.cdb[0],
528			tmp_io->io_hdr.nexus.initid.id,
529			tmp_io->io_hdr.nexus.targ_port,
530			tmp_io->io_hdr.nexus.targ_target.id,
531			tmp_io->io_hdr.nexus.targ_lun,
532			(tmp_io->io_hdr.io_type ==
533			CTL_IO_TASK) ?
534			tmp_io->taskio.tag_num :
535			tmp_io->scsiio.tag_num,
536		        tmp_io->io_hdr.flags,
537			tmp_io->io_hdr.status);
538	}
539#endif
540	ctsio->io_hdr.msg_type = CTL_MSG_FINISH_IO;
541	STAILQ_INSERT_TAIL(&ctl_softc->isc_queue, &ctsio->io_hdr, links);
542	ctl_wakeup_thread();
543}
544
545/*
546 * ISC (Inter Shelf Communication) event handler.  Events from the HA
547 * subsystem come in here.
548 */
549static void
550ctl_isc_event_handler(ctl_ha_channel channel, ctl_ha_event event, int param)
551{
552	struct ctl_softc *ctl_softc;
553	union ctl_io *io;
554	struct ctl_prio *presio;
555	ctl_ha_status isc_status;
556
557	ctl_softc = control_softc;
558	io = NULL;
559
560
561#if 0
562	printf("CTL: Isc Msg event %d\n", event);
563#endif
564	if (event == CTL_HA_EVT_MSG_RECV) {
565		union ctl_ha_msg msg_info;
566
567		isc_status = ctl_ha_msg_recv(CTL_HA_CHAN_CTL, &msg_info,
568					     sizeof(msg_info), /*wait*/ 0);
569#if 0
570		printf("CTL: msg_type %d\n", msg_info.msg_type);
571#endif
572		if (isc_status != 0) {
573			printf("Error receiving message, status = %d\n",
574			       isc_status);
575			return;
576		}
577		mtx_lock(&ctl_softc->ctl_lock);
578
579		switch (msg_info.hdr.msg_type) {
580		case CTL_MSG_SERIALIZE:
581#if 0
582			printf("Serialize\n");
583#endif
584			io = ctl_alloc_io((void *)ctl_softc->othersc_pool);
585			if (io == NULL) {
586				printf("ctl_isc_event_handler: can't allocate "
587				       "ctl_io!\n");
588				/* Bad Juju */
589				/* Need to set busy and send msg back */
590				mtx_unlock(&ctl_softc->ctl_lock);
591				msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
592				msg_info.hdr.status = CTL_SCSI_ERROR;
593				msg_info.scsi.scsi_status = SCSI_STATUS_BUSY;
594				msg_info.scsi.sense_len = 0;
595			        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
596				    sizeof(msg_info), 0) > CTL_HA_STATUS_SUCCESS){
597				}
598				goto bailout;
599			}
600			ctl_zero_io(io);
601			// populate ctsio from msg_info
602			io->io_hdr.io_type = CTL_IO_SCSI;
603			io->io_hdr.msg_type = CTL_MSG_SERIALIZE;
604			io->io_hdr.original_sc = msg_info.hdr.original_sc;
605#if 0
606			printf("pOrig %x\n", (int)msg_info.original_sc);
607#endif
608			io->io_hdr.flags |= CTL_FLAG_FROM_OTHER_SC |
609					    CTL_FLAG_IO_ACTIVE;
610			/*
611			 * If we're in serialization-only mode, we don't
612			 * want to go through full done processing.  Thus
613			 * the COPY flag.
614			 *
615			 * XXX KDM add another flag that is more specific.
616			 */
617			if (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)
618				io->io_hdr.flags |= CTL_FLAG_INT_COPY;
619			io->io_hdr.nexus = msg_info.hdr.nexus;
620#if 0
621			printf("targ %d, port %d, iid %d, lun %d\n",
622			       io->io_hdr.nexus.targ_target.id,
623			       io->io_hdr.nexus.targ_port,
624			       io->io_hdr.nexus.initid.id,
625			       io->io_hdr.nexus.targ_lun);
626#endif
627			io->scsiio.tag_num = msg_info.scsi.tag_num;
628			io->scsiio.tag_type = msg_info.scsi.tag_type;
629			memcpy(io->scsiio.cdb, msg_info.scsi.cdb,
630			       CTL_MAX_CDBLEN);
631			if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
632				struct ctl_cmd_entry *entry;
633				uint8_t opcode;
634
635				opcode = io->scsiio.cdb[0];
636				entry = &ctl_cmd_table[opcode];
637				io->io_hdr.flags &= ~CTL_FLAG_DATA_MASK;
638				io->io_hdr.flags |=
639					entry->flags & CTL_FLAG_DATA_MASK;
640			}
641			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
642					   &io->io_hdr, links);
643			ctl_wakeup_thread();
644			break;
645
646		/* Performed on the Originating SC, XFER mode only */
647		case CTL_MSG_DATAMOVE: {
648			struct ctl_sg_entry *sgl;
649			int i, j;
650
651			io = msg_info.hdr.original_sc;
652			if (io == NULL) {
653				printf("%s: original_sc == NULL!\n", __func__);
654				/* XXX KDM do something here */
655				break;
656			}
657			io->io_hdr.msg_type = CTL_MSG_DATAMOVE;
658			io->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
659			/*
660			 * Keep track of this, we need to send it back over
661			 * when the datamove is complete.
662			 */
663			io->io_hdr.serializing_sc = msg_info.hdr.serializing_sc;
664
665			if (msg_info.dt.sg_sequence == 0) {
666				/*
667				 * XXX KDM we use the preallocated S/G list
668				 * here, but we'll need to change this to
669				 * dynamic allocation if we need larger S/G
670				 * lists.
671				 */
672				if (msg_info.dt.kern_sg_entries >
673				    sizeof(io->io_hdr.remote_sglist) /
674				    sizeof(io->io_hdr.remote_sglist[0])) {
675					printf("%s: number of S/G entries "
676					    "needed %u > allocated num %zd\n",
677					    __func__,
678					    msg_info.dt.kern_sg_entries,
679					    sizeof(io->io_hdr.remote_sglist)/
680					    sizeof(io->io_hdr.remote_sglist[0]));
681
682					/*
683					 * XXX KDM send a message back to
684					 * the other side to shut down the
685					 * DMA.  The error will come back
686					 * through via the normal channel.
687					 */
688					break;
689				}
690				sgl = io->io_hdr.remote_sglist;
691				memset(sgl, 0,
692				       sizeof(io->io_hdr.remote_sglist));
693
694				io->scsiio.kern_data_ptr = (uint8_t *)sgl;
695
696				io->scsiio.kern_sg_entries =
697					msg_info.dt.kern_sg_entries;
698				io->scsiio.rem_sg_entries =
699					msg_info.dt.kern_sg_entries;
700				io->scsiio.kern_data_len =
701					msg_info.dt.kern_data_len;
702				io->scsiio.kern_total_len =
703					msg_info.dt.kern_total_len;
704				io->scsiio.kern_data_resid =
705					msg_info.dt.kern_data_resid;
706				io->scsiio.kern_rel_offset =
707					msg_info.dt.kern_rel_offset;
708				/*
709				 * Clear out per-DMA flags.
710				 */
711				io->io_hdr.flags &= ~CTL_FLAG_RDMA_MASK;
712				/*
713				 * Add per-DMA flags that are set for this
714				 * particular DMA request.
715				 */
716				io->io_hdr.flags |= msg_info.dt.flags &
717						    CTL_FLAG_RDMA_MASK;
718			} else
719				sgl = (struct ctl_sg_entry *)
720					io->scsiio.kern_data_ptr;
721
722			for (i = msg_info.dt.sent_sg_entries, j = 0;
723			     i < (msg_info.dt.sent_sg_entries +
724			     msg_info.dt.cur_sg_entries); i++, j++) {
725				sgl[i].addr = msg_info.dt.sg_list[j].addr;
726				sgl[i].len = msg_info.dt.sg_list[j].len;
727
728#if 0
729				printf("%s: L: %p,%d -> %p,%d j=%d, i=%d\n",
730				       __func__,
731				       msg_info.dt.sg_list[j].addr,
732				       msg_info.dt.sg_list[j].len,
733				       sgl[i].addr, sgl[i].len, j, i);
734#endif
735			}
736#if 0
737			memcpy(&sgl[msg_info.dt.sent_sg_entries],
738			       msg_info.dt.sg_list,
739			       sizeof(*sgl) * msg_info.dt.cur_sg_entries);
740#endif
741
742			/*
743			 * If this is the last piece of the I/O, we've got
744			 * the full S/G list.  Queue processing in the thread.
745			 * Otherwise wait for the next piece.
746			 */
747			if (msg_info.dt.sg_last != 0) {
748				STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
749						   &io->io_hdr, links);
750				ctl_wakeup_thread();
751			}
752			break;
753		}
754		/* Performed on the Serializing (primary) SC, XFER mode only */
755		case CTL_MSG_DATAMOVE_DONE: {
756			if (msg_info.hdr.serializing_sc == NULL) {
757				printf("%s: serializing_sc == NULL!\n",
758				       __func__);
759				/* XXX KDM now what? */
760				break;
761			}
762			/*
763			 * We grab the sense information here in case
764			 * there was a failure, so we can return status
765			 * back to the initiator.
766			 */
767			io = msg_info.hdr.serializing_sc;
768			io->io_hdr.msg_type = CTL_MSG_DATAMOVE_DONE;
769			io->io_hdr.status = msg_info.hdr.status;
770			io->scsiio.scsi_status = msg_info.scsi.scsi_status;
771			io->scsiio.sense_len = msg_info.scsi.sense_len;
772			io->scsiio.sense_residual =msg_info.scsi.sense_residual;
773			io->io_hdr.port_status = msg_info.scsi.fetd_status;
774			io->scsiio.residual = msg_info.scsi.residual;
775			memcpy(&io->scsiio.sense_data,&msg_info.scsi.sense_data,
776			       sizeof(io->scsiio.sense_data));
777
778			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
779					   &io->io_hdr, links);
780			ctl_wakeup_thread();
781			break;
782		}
783
784		/* Preformed on Originating SC, SER_ONLY mode */
785		case CTL_MSG_R2R:
786			io = msg_info.hdr.original_sc;
787			if (io == NULL) {
788				printf("%s: Major Bummer\n", __func__);
789				mtx_unlock(&ctl_softc->ctl_lock);
790				return;
791			} else {
792#if 0
793				printf("pOrig %x\n",(int) ctsio);
794#endif
795			}
796			io->io_hdr.msg_type = CTL_MSG_R2R;
797			io->io_hdr.serializing_sc = msg_info.hdr.serializing_sc;
798			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
799					   &io->io_hdr, links);
800			ctl_wakeup_thread();
801			break;
802
803		/*
804		 * Performed on Serializing(i.e. primary SC) SC in SER_ONLY
805		 * mode.
806		 * Performed on the Originating (i.e. secondary) SC in XFER
807		 * mode
808		 */
809		case CTL_MSG_FINISH_IO:
810			if (ctl_softc->ha_mode == CTL_HA_MODE_XFER)
811				ctl_isc_handler_finish_xfer(ctl_softc,
812							    &msg_info);
813			else
814				ctl_isc_handler_finish_ser_only(ctl_softc,
815								&msg_info);
816			break;
817
818		/* Preformed on Originating SC */
819		case CTL_MSG_BAD_JUJU:
820			io = msg_info.hdr.original_sc;
821			if (io == NULL) {
822				printf("%s: Bad JUJU!, original_sc is NULL!\n",
823				       __func__);
824				break;
825			}
826			ctl_copy_sense_data(&msg_info, io);
827			/*
828			 * IO should have already been cleaned up on other
829			 * SC so clear this flag so we won't send a message
830			 * back to finish the IO there.
831			 */
832			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
833			io->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
834
835			/* io = msg_info.hdr.serializing_sc; */
836			io->io_hdr.msg_type = CTL_MSG_BAD_JUJU;
837		        STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
838					   &io->io_hdr, links);
839			ctl_wakeup_thread();
840			break;
841
842		/* Handle resets sent from the other side */
843		case CTL_MSG_MANAGE_TASKS: {
844			struct ctl_taskio *taskio;
845			taskio = (struct ctl_taskio *)ctl_alloc_io(
846				(void *)ctl_softc->othersc_pool);
847			if (taskio == NULL) {
848				printf("ctl_isc_event_handler: can't allocate "
849				       "ctl_io!\n");
850				/* Bad Juju */
851				/* should I just call the proper reset func
852				   here??? */
853				mtx_unlock(&ctl_softc->ctl_lock);
854				goto bailout;
855			}
856			ctl_zero_io((union ctl_io *)taskio);
857			taskio->io_hdr.io_type = CTL_IO_TASK;
858			taskio->io_hdr.flags |= CTL_FLAG_FROM_OTHER_SC;
859			taskio->io_hdr.nexus = msg_info.hdr.nexus;
860			taskio->task_action = msg_info.task.task_action;
861			taskio->tag_num = msg_info.task.tag_num;
862			taskio->tag_type = msg_info.task.tag_type;
863#ifdef CTL_TIME_IO
864			taskio->io_hdr.start_time = time_uptime;
865			getbintime(&taskio->io_hdr.start_bt);
866#if 0
867			cs_prof_gettime(&taskio->io_hdr.start_ticks);
868#endif
869#endif /* CTL_TIME_IO */
870		        STAILQ_INSERT_TAIL(&ctl_softc->task_queue,
871					   &taskio->io_hdr, links);
872			ctl_softc->flags |= CTL_FLAG_TASK_PENDING;
873			ctl_wakeup_thread();
874			break;
875		}
876		/* Persistent Reserve action which needs attention */
877		case CTL_MSG_PERS_ACTION:
878			presio = (struct ctl_prio *)ctl_alloc_io(
879				(void *)ctl_softc->othersc_pool);
880			if (presio == NULL) {
881				printf("ctl_isc_event_handler: can't allocate "
882				       "ctl_io!\n");
883				/* Bad Juju */
884				/* Need to set busy and send msg back */
885				mtx_unlock(&ctl_softc->ctl_lock);
886				goto bailout;
887			}
888			ctl_zero_io((union ctl_io *)presio);
889			presio->io_hdr.msg_type = CTL_MSG_PERS_ACTION;
890			presio->pr_msg = msg_info.pr;
891		        STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
892					   &presio->io_hdr, links);
893			ctl_wakeup_thread();
894			break;
895		case CTL_MSG_SYNC_FE:
896			rcv_sync_msg = 1;
897			break;
898		case CTL_MSG_APS_LOCK: {
899			// It's quicker to execute this then to
900			// queue it.
901			struct ctl_lun *lun;
902			struct ctl_page_index *page_index;
903			struct copan_aps_subpage *current_sp;
904
905			lun = ctl_softc->ctl_luns[msg_info.hdr.nexus.targ_lun];
906			page_index = &lun->mode_pages.index[index_to_aps_page];
907			current_sp = (struct copan_aps_subpage *)
908				     (page_index->page_data +
909				     (page_index->page_len * CTL_PAGE_CURRENT));
910
911			current_sp->lock_active = msg_info.aps.lock_flag;
912		        break;
913		}
914		default:
915		        printf("How did I get here?\n");
916		}
917		mtx_unlock(&ctl_softc->ctl_lock);
918	} else if (event == CTL_HA_EVT_MSG_SENT) {
919		if (param != CTL_HA_STATUS_SUCCESS) {
920			printf("Bad status from ctl_ha_msg_send status %d\n",
921			       param);
922		}
923		return;
924	} else if (event == CTL_HA_EVT_DISCONNECT) {
925		printf("CTL: Got a disconnect from Isc\n");
926		return;
927	} else {
928		printf("ctl_isc_event_handler: Unknown event %d\n", event);
929		return;
930	}
931
932bailout:
933	return;
934}
935
936static void
937ctl_copy_sense_data(union ctl_ha_msg *src, union ctl_io *dest)
938{
939	struct scsi_sense_data *sense;
940
941	sense = &dest->scsiio.sense_data;
942	bcopy(&src->scsi.sense_data, sense, sizeof(*sense));
943	dest->scsiio.scsi_status = src->scsi.scsi_status;
944	dest->scsiio.sense_len = src->scsi.sense_len;
945	dest->io_hdr.status = src->hdr.status;
946}
947
948static int
949ctl_init(void)
950{
951	struct ctl_softc *softc;
952	struct ctl_io_pool *internal_pool, *emergency_pool, *other_pool;
953	struct ctl_frontend *fe;
954	struct ctl_lun *lun;
955        uint8_t sc_id =0;
956#if 0
957	int i;
958#endif
959	int error, retval;
960	//int isc_retval;
961
962	retval = 0;
963	ctl_pause_rtr = 0;
964        rcv_sync_msg = 0;
965
966	/* If we're disabled, don't initialize. */
967	if (ctl_disable != 0)
968		return (0);
969
970	control_softc = malloc(sizeof(*control_softc), M_DEVBUF,
971			       M_WAITOK | M_ZERO);
972	softc = control_softc;
973
974	softc->dev = make_dev(&ctl_cdevsw, 0, UID_ROOT, GID_OPERATOR, 0600,
975			      "cam/ctl");
976
977	softc->dev->si_drv1 = softc;
978
979	/*
980	 * By default, return a "bad LUN" peripheral qualifier for unknown
981	 * LUNs.  The user can override this default using the tunable or
982	 * sysctl.  See the comment in ctl_inquiry_std() for more details.
983	 */
984	softc->inquiry_pq_no_lun = 1;
985	TUNABLE_INT_FETCH("kern.cam.ctl.inquiry_pq_no_lun",
986			  &softc->inquiry_pq_no_lun);
987	sysctl_ctx_init(&softc->sysctl_ctx);
988	softc->sysctl_tree = SYSCTL_ADD_NODE(&softc->sysctl_ctx,
989		SYSCTL_STATIC_CHILDREN(_kern_cam), OID_AUTO, "ctl",
990		CTLFLAG_RD, 0, "CAM Target Layer");
991
992	if (softc->sysctl_tree == NULL) {
993		printf("%s: unable to allocate sysctl tree\n", __func__);
994		destroy_dev(softc->dev);
995		free(control_softc, M_DEVBUF);
996		control_softc = NULL;
997		return (ENOMEM);
998	}
999
1000	SYSCTL_ADD_INT(&softc->sysctl_ctx,
1001		       SYSCTL_CHILDREN(softc->sysctl_tree), OID_AUTO,
1002		       "inquiry_pq_no_lun", CTLFLAG_RW,
1003		       &softc->inquiry_pq_no_lun, 0,
1004		       "Report no lun possible for invalid LUNs");
1005
1006	mtx_init(&softc->ctl_lock, "CTL mutex", NULL, MTX_DEF);
1007	mtx_init(&softc->pool_lock, "CTL pool mutex", NULL, MTX_DEF);
1008	softc->open_count = 0;
1009
1010	/*
1011	 * Default to actually sending a SYNCHRONIZE CACHE command down to
1012	 * the drive.
1013	 */
1014	softc->flags = CTL_FLAG_REAL_SYNC;
1015
1016	/*
1017	 * In Copan's HA scheme, the "master" and "slave" roles are
1018	 * figured out through the slot the controller is in.  Although it
1019	 * is an active/active system, someone has to be in charge.
1020 	 */
1021#ifdef NEEDTOPORT
1022        scmicro_rw(SCMICRO_GET_SHELF_ID, &sc_id);
1023#endif
1024
1025        if (sc_id == 0) {
1026		softc->flags |= CTL_FLAG_MASTER_SHELF;
1027		persis_offset = 0;
1028	} else
1029		persis_offset = CTL_MAX_INITIATORS;
1030
1031	/*
1032	 * XXX KDM need to figure out where we want to get our target ID
1033	 * and WWID.  Is it different on each port?
1034	 */
1035	softc->target.id = 0;
1036	softc->target.wwid[0] = 0x12345678;
1037	softc->target.wwid[1] = 0x87654321;
1038	STAILQ_INIT(&softc->lun_list);
1039	STAILQ_INIT(&softc->pending_lun_queue);
1040	STAILQ_INIT(&softc->task_queue);
1041	STAILQ_INIT(&softc->incoming_queue);
1042	STAILQ_INIT(&softc->rtr_queue);
1043	STAILQ_INIT(&softc->done_queue);
1044	STAILQ_INIT(&softc->isc_queue);
1045	STAILQ_INIT(&softc->fe_list);
1046	STAILQ_INIT(&softc->be_list);
1047	STAILQ_INIT(&softc->io_pools);
1048
1049	lun = &softc->lun;
1050
1051	/*
1052	 * We don't bother calling these with ctl_lock held here, because,
1053	 * in theory, no one else can try to do anything while we're in our
1054	 * module init routine.
1055	 */
1056	if (ctl_pool_create(softc, CTL_POOL_INTERNAL, CTL_POOL_ENTRIES_INTERNAL,
1057			    &internal_pool)!= 0){
1058		printf("ctl: can't allocate %d entry internal pool, "
1059		       "exiting\n", CTL_POOL_ENTRIES_INTERNAL);
1060		return (ENOMEM);
1061	}
1062
1063	if (ctl_pool_create(softc, CTL_POOL_EMERGENCY,
1064			    CTL_POOL_ENTRIES_EMERGENCY, &emergency_pool) != 0) {
1065		printf("ctl: can't allocate %d entry emergency pool, "
1066		       "exiting\n", CTL_POOL_ENTRIES_EMERGENCY);
1067		ctl_pool_free(internal_pool);
1068		return (ENOMEM);
1069	}
1070
1071	if (ctl_pool_create(softc, CTL_POOL_4OTHERSC, CTL_POOL_ENTRIES_OTHER_SC,
1072	                    &other_pool) != 0)
1073	{
1074		printf("ctl: can't allocate %d entry other SC pool, "
1075		       "exiting\n", CTL_POOL_ENTRIES_OTHER_SC);
1076		ctl_pool_free(internal_pool);
1077		ctl_pool_free(emergency_pool);
1078		return (ENOMEM);
1079	}
1080
1081	softc->internal_pool = internal_pool;
1082	softc->emergency_pool = emergency_pool;
1083	softc->othersc_pool = other_pool;
1084
1085	/*
1086	 * We used to allocate a processor LUN here.  The new scheme is to
1087	 * just let the user allocate LUNs as he sees fit.
1088	 */
1089#if 0
1090	mtx_lock(&softc->ctl_lock);
1091	ctl_alloc_lun(softc, lun, /*be_lun*/NULL, /*target*/softc->target);
1092	mtx_unlock(&softc->ctl_lock);
1093#endif
1094
1095	error = kproc_create(ctl_work_thread, softc, &softc->work_thread, 0, 0,
1096			 "ctl_thrd");
1097	if (error != 0) {
1098		printf("error creating CTL work thread!\n");
1099		mtx_lock(&softc->ctl_lock);
1100		ctl_free_lun(lun);
1101		mtx_unlock(&softc->ctl_lock);
1102		ctl_pool_free(internal_pool);
1103		ctl_pool_free(emergency_pool);
1104		ctl_pool_free(other_pool);
1105		return (error);
1106	}
1107	printf("ctl: CAM Target Layer loaded\n");
1108
1109	/*
1110	 * Initialize the initiator and portname mappings
1111	 */
1112	memset(softc->wwpn_iid, 0, sizeof(softc->wwpn_iid));
1113
1114	/*
1115	 * Initialize the ioctl front end.
1116	 */
1117	fe = &softc->ioctl_info.fe;
1118	sprintf(softc->ioctl_info.port_name, "CTL ioctl");
1119	fe->port_type = CTL_PORT_IOCTL;
1120	fe->num_requested_ctl_io = 100;
1121	fe->port_name = softc->ioctl_info.port_name;
1122	fe->port_online = ctl_ioctl_online;
1123	fe->port_offline = ctl_ioctl_offline;
1124	fe->onoff_arg = &softc->ioctl_info;
1125	fe->targ_enable = ctl_ioctl_targ_enable;
1126	fe->targ_disable = ctl_ioctl_targ_disable;
1127	fe->lun_enable = ctl_ioctl_lun_enable;
1128	fe->lun_disable = ctl_ioctl_lun_disable;
1129	fe->targ_lun_arg = &softc->ioctl_info;
1130	fe->fe_datamove = ctl_ioctl_datamove;
1131	fe->fe_done = ctl_ioctl_done;
1132	fe->max_targets = 15;
1133	fe->max_target_id = 15;
1134
1135	if (ctl_frontend_register(&softc->ioctl_info.fe,
1136	                  (softc->flags & CTL_FLAG_MASTER_SHELF)) != 0) {
1137		printf("ctl: ioctl front end registration failed, will "
1138		       "continue anyway\n");
1139	}
1140
1141#ifdef CTL_IO_DELAY
1142	if (sizeof(struct callout) > CTL_TIMER_BYTES) {
1143		printf("sizeof(struct callout) %zd > CTL_TIMER_BYTES %zd\n",
1144		       sizeof(struct callout), CTL_TIMER_BYTES);
1145		return (EINVAL);
1146	}
1147#endif /* CTL_IO_DELAY */
1148
1149	return (0);
1150}
1151
1152void
1153ctl_shutdown(void)
1154{
1155	struct ctl_softc *softc;
1156	struct ctl_lun *lun, *next_lun;
1157	struct ctl_io_pool *pool;
1158
1159	softc = (struct ctl_softc *)control_softc;
1160
1161	if (ctl_frontend_deregister(&softc->ioctl_info.fe) != 0)
1162		printf("ctl: ioctl front end deregistration failed\n");
1163
1164	mtx_lock(&softc->ctl_lock);
1165
1166	/*
1167	 * Free up each LUN.
1168	 */
1169	for (lun = STAILQ_FIRST(&softc->lun_list); lun != NULL; lun = next_lun){
1170		next_lun = STAILQ_NEXT(lun, links);
1171		ctl_free_lun(lun);
1172	}
1173
1174	mtx_unlock(&softc->ctl_lock);
1175
1176	/*
1177	 * This will rip the rug out from under any FETDs or anyone else
1178	 * that has a pool allocated.  Since we increment our module
1179	 * refcount any time someone outside the main CTL module allocates
1180	 * a pool, we shouldn't have any problems here.  The user won't be
1181	 * able to unload the CTL module until client modules have
1182	 * successfully unloaded.
1183	 */
1184	while ((pool = STAILQ_FIRST(&softc->io_pools)) != NULL)
1185		ctl_pool_free(pool);
1186
1187#if 0
1188	ctl_shutdown_thread(softc->work_thread);
1189#endif
1190
1191	mtx_destroy(&softc->pool_lock);
1192	mtx_destroy(&softc->ctl_lock);
1193
1194	destroy_dev(softc->dev);
1195
1196	sysctl_ctx_free(&softc->sysctl_ctx);
1197
1198	free(control_softc, M_DEVBUF);
1199	control_softc = NULL;
1200
1201	printf("ctl: CAM Target Layer unloaded\n");
1202}
1203
1204static int
1205ctl_module_event_handler(module_t mod, int what, void *arg)
1206{
1207
1208	switch (what) {
1209	case MOD_LOAD:
1210		return (ctl_init());
1211	case MOD_UNLOAD:
1212		return (EBUSY);
1213	default:
1214		return (EOPNOTSUPP);
1215	}
1216}
1217
1218/*
1219 * XXX KDM should we do some access checks here?  Bump a reference count to
1220 * prevent a CTL module from being unloaded while someone has it open?
1221 */
1222static int
1223ctl_open(struct cdev *dev, int flags, int fmt, struct thread *td)
1224{
1225	return (0);
1226}
1227
1228static int
1229ctl_close(struct cdev *dev, int flags, int fmt, struct thread *td)
1230{
1231	return (0);
1232}
1233
1234int
1235ctl_port_enable(ctl_port_type port_type)
1236{
1237	struct ctl_softc *softc;
1238	struct ctl_frontend *fe;
1239
1240	if (ctl_is_single == 0) {
1241		union ctl_ha_msg msg_info;
1242		int isc_retval;
1243
1244#if 0
1245		printf("%s: HA mode, synchronizing frontend enable\n",
1246		        __func__);
1247#endif
1248		msg_info.hdr.msg_type = CTL_MSG_SYNC_FE;
1249	        if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1250		        sizeof(msg_info), 1 )) > CTL_HA_STATUS_SUCCESS) {
1251			printf("Sync msg send error retval %d\n", isc_retval);
1252		}
1253		if (!rcv_sync_msg) {
1254			isc_retval=ctl_ha_msg_recv(CTL_HA_CHAN_CTL, &msg_info,
1255			        sizeof(msg_info), 1);
1256		}
1257#if 0
1258        	printf("CTL:Frontend Enable\n");
1259	} else {
1260		printf("%s: single mode, skipping frontend synchronization\n",
1261		        __func__);
1262#endif
1263	}
1264
1265	softc = control_softc;
1266
1267	STAILQ_FOREACH(fe, &softc->fe_list, links) {
1268		if (port_type & fe->port_type)
1269		{
1270#if 0
1271			printf("port %d\n", fe->targ_port);
1272#endif
1273			ctl_frontend_online(fe);
1274		}
1275	}
1276
1277	return (0);
1278}
1279
1280int
1281ctl_port_disable(ctl_port_type port_type)
1282{
1283	struct ctl_softc *softc;
1284	struct ctl_frontend *fe;
1285
1286	softc = control_softc;
1287
1288	STAILQ_FOREACH(fe, &softc->fe_list, links) {
1289		if (port_type & fe->port_type)
1290			ctl_frontend_offline(fe);
1291	}
1292
1293	return (0);
1294}
1295
1296/*
1297 * Returns 0 for success, 1 for failure.
1298 * Currently the only failure mode is if there aren't enough entries
1299 * allocated.  So, in case of a failure, look at num_entries_dropped,
1300 * reallocate and try again.
1301 */
1302int
1303ctl_port_list(struct ctl_port_entry *entries, int num_entries_alloced,
1304	      int *num_entries_filled, int *num_entries_dropped,
1305	      ctl_port_type port_type, int no_virtual)
1306{
1307	struct ctl_softc *softc;
1308	struct ctl_frontend *fe;
1309	int entries_dropped, entries_filled;
1310	int retval;
1311	int i;
1312
1313	softc = control_softc;
1314
1315	retval = 0;
1316	entries_filled = 0;
1317	entries_dropped = 0;
1318
1319	i = 0;
1320	mtx_lock(&softc->ctl_lock);
1321	STAILQ_FOREACH(fe, &softc->fe_list, links) {
1322		struct ctl_port_entry *entry;
1323
1324		if ((fe->port_type & port_type) == 0)
1325			continue;
1326
1327		if ((no_virtual != 0)
1328		 && (fe->virtual_port != 0))
1329			continue;
1330
1331		if (entries_filled >= num_entries_alloced) {
1332			entries_dropped++;
1333			continue;
1334		}
1335		entry = &entries[i];
1336
1337		entry->port_type = fe->port_type;
1338		strlcpy(entry->port_name, fe->port_name,
1339			sizeof(entry->port_name));
1340		entry->physical_port = fe->physical_port;
1341		entry->virtual_port = fe->virtual_port;
1342		entry->wwnn = fe->wwnn;
1343		entry->wwpn = fe->wwpn;
1344
1345		i++;
1346		entries_filled++;
1347	}
1348
1349	mtx_unlock(&softc->ctl_lock);
1350
1351	if (entries_dropped > 0)
1352		retval = 1;
1353
1354	*num_entries_dropped = entries_dropped;
1355	*num_entries_filled = entries_filled;
1356
1357	return (retval);
1358}
1359
1360static void
1361ctl_ioctl_online(void *arg)
1362{
1363	struct ctl_ioctl_info *ioctl_info;
1364
1365	ioctl_info = (struct ctl_ioctl_info *)arg;
1366
1367	ioctl_info->flags |= CTL_IOCTL_FLAG_ENABLED;
1368}
1369
1370static void
1371ctl_ioctl_offline(void *arg)
1372{
1373	struct ctl_ioctl_info *ioctl_info;
1374
1375	ioctl_info = (struct ctl_ioctl_info *)arg;
1376
1377	ioctl_info->flags &= ~CTL_IOCTL_FLAG_ENABLED;
1378}
1379
1380/*
1381 * Remove an initiator by port number and initiator ID.
1382 * Returns 0 for success, 1 for failure.
1383 */
1384int
1385ctl_remove_initiator(int32_t targ_port, uint32_t iid)
1386{
1387	struct ctl_softc *softc;
1388
1389	softc = control_softc;
1390
1391	mtx_assert(&softc->ctl_lock, MA_NOTOWNED);
1392
1393	if ((targ_port < 0)
1394	 || (targ_port > CTL_MAX_PORTS)) {
1395		printf("%s: invalid port number %d\n", __func__, targ_port);
1396		return (1);
1397	}
1398	if (iid > CTL_MAX_INIT_PER_PORT) {
1399		printf("%s: initiator ID %u > maximun %u!\n",
1400		       __func__, iid, CTL_MAX_INIT_PER_PORT);
1401		return (1);
1402	}
1403
1404	mtx_lock(&softc->ctl_lock);
1405
1406	softc->wwpn_iid[targ_port][iid].in_use = 0;
1407
1408	mtx_unlock(&softc->ctl_lock);
1409
1410	return (0);
1411}
1412
1413/*
1414 * Add an initiator to the initiator map.
1415 * Returns 0 for success, 1 for failure.
1416 */
1417int
1418ctl_add_initiator(uint64_t wwpn, int32_t targ_port, uint32_t iid)
1419{
1420	struct ctl_softc *softc;
1421	int retval;
1422
1423	softc = control_softc;
1424
1425	mtx_assert(&softc->ctl_lock, MA_NOTOWNED);
1426
1427	retval = 0;
1428
1429	if ((targ_port < 0)
1430	 || (targ_port > CTL_MAX_PORTS)) {
1431		printf("%s: invalid port number %d\n", __func__, targ_port);
1432		return (1);
1433	}
1434	if (iid > CTL_MAX_INIT_PER_PORT) {
1435		printf("%s: WWPN %#jx initiator ID %u > maximun %u!\n",
1436		       __func__, wwpn, iid, CTL_MAX_INIT_PER_PORT);
1437		return (1);
1438	}
1439
1440	mtx_lock(&softc->ctl_lock);
1441
1442	if (softc->wwpn_iid[targ_port][iid].in_use != 0) {
1443		/*
1444		 * We don't treat this as an error.
1445		 */
1446		if (softc->wwpn_iid[targ_port][iid].wwpn == wwpn) {
1447			printf("%s: port %d iid %u WWPN %#jx arrived again?\n",
1448			       __func__, targ_port, iid, (uintmax_t)wwpn);
1449			goto bailout;
1450		}
1451
1452		/*
1453		 * This is an error, but what do we do about it?  The
1454		 * driver is telling us we have a new WWPN for this
1455		 * initiator ID, so we pretty much need to use it.
1456		 */
1457		printf("%s: port %d iid %u WWPN %#jx arrived, WWPN %#jx is "
1458		       "still at that address\n", __func__, targ_port, iid,
1459		       (uintmax_t)wwpn,
1460		       (uintmax_t)softc->wwpn_iid[targ_port][iid].wwpn);
1461
1462		/*
1463		 * XXX KDM clear have_ca and ua_pending on each LUN for
1464		 * this initiator.
1465		 */
1466	}
1467	softc->wwpn_iid[targ_port][iid].in_use = 1;
1468	softc->wwpn_iid[targ_port][iid].iid = iid;
1469	softc->wwpn_iid[targ_port][iid].wwpn = wwpn;
1470	softc->wwpn_iid[targ_port][iid].port = targ_port;
1471
1472bailout:
1473
1474	mtx_unlock(&softc->ctl_lock);
1475
1476	return (retval);
1477}
1478
1479/*
1480 * XXX KDM should we pretend to do something in the target/lun
1481 * enable/disable functions?
1482 */
1483static int
1484ctl_ioctl_targ_enable(void *arg, struct ctl_id targ_id)
1485{
1486	return (0);
1487}
1488
1489static int
1490ctl_ioctl_targ_disable(void *arg, struct ctl_id targ_id)
1491{
1492	return (0);
1493}
1494
1495static int
1496ctl_ioctl_lun_enable(void *arg, struct ctl_id targ_id, int lun_id)
1497{
1498	return (0);
1499}
1500
1501static int
1502ctl_ioctl_lun_disable(void *arg, struct ctl_id targ_id, int lun_id)
1503{
1504	return (0);
1505}
1506
1507/*
1508 * Data movement routine for the CTL ioctl frontend port.
1509 */
1510static int
1511ctl_ioctl_do_datamove(struct ctl_scsiio *ctsio)
1512{
1513	struct ctl_sg_entry *ext_sglist, *kern_sglist;
1514	struct ctl_sg_entry ext_entry, kern_entry;
1515	int ext_sglen, ext_sg_entries, kern_sg_entries;
1516	int ext_sg_start, ext_offset;
1517	int len_to_copy, len_copied;
1518	int kern_watermark, ext_watermark;
1519	int ext_sglist_malloced;
1520	int i, j;
1521
1522	ext_sglist_malloced = 0;
1523	ext_sg_start = 0;
1524	ext_offset = 0;
1525
1526	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove\n"));
1527
1528	/*
1529	 * If this flag is set, fake the data transfer.
1530	 */
1531	if (ctsio->io_hdr.flags & CTL_FLAG_NO_DATAMOVE) {
1532		ctsio->ext_data_filled = ctsio->ext_data_len;
1533		goto bailout;
1534	}
1535
1536	/*
1537	 * To simplify things here, if we have a single buffer, stick it in
1538	 * a S/G entry and just make it a single entry S/G list.
1539	 */
1540	if (ctsio->io_hdr.flags & CTL_FLAG_EDPTR_SGLIST) {
1541		int len_seen;
1542
1543		ext_sglen = ctsio->ext_sg_entries * sizeof(*ext_sglist);
1544
1545		ext_sglist = (struct ctl_sg_entry *)malloc(ext_sglen, M_CTL,
1546							   M_WAITOK);
1547		ext_sglist_malloced = 1;
1548		if (copyin(ctsio->ext_data_ptr, ext_sglist,
1549				   ext_sglen) != 0) {
1550			ctl_set_internal_failure(ctsio,
1551						 /*sks_valid*/ 0,
1552						 /*retry_count*/ 0);
1553			goto bailout;
1554		}
1555		ext_sg_entries = ctsio->ext_sg_entries;
1556		len_seen = 0;
1557		for (i = 0; i < ext_sg_entries; i++) {
1558			if ((len_seen + ext_sglist[i].len) >=
1559			     ctsio->ext_data_filled) {
1560				ext_sg_start = i;
1561				ext_offset = ctsio->ext_data_filled - len_seen;
1562				break;
1563			}
1564			len_seen += ext_sglist[i].len;
1565		}
1566	} else {
1567		ext_sglist = &ext_entry;
1568		ext_sglist->addr = ctsio->ext_data_ptr;
1569		ext_sglist->len = ctsio->ext_data_len;
1570		ext_sg_entries = 1;
1571		ext_sg_start = 0;
1572		ext_offset = ctsio->ext_data_filled;
1573	}
1574
1575	if (ctsio->kern_sg_entries > 0) {
1576		kern_sglist = (struct ctl_sg_entry *)ctsio->kern_data_ptr;
1577		kern_sg_entries = ctsio->kern_sg_entries;
1578	} else {
1579		kern_sglist = &kern_entry;
1580		kern_sglist->addr = ctsio->kern_data_ptr;
1581		kern_sglist->len = ctsio->kern_data_len;
1582		kern_sg_entries = 1;
1583	}
1584
1585
1586	kern_watermark = 0;
1587	ext_watermark = ext_offset;
1588	len_copied = 0;
1589	for (i = ext_sg_start, j = 0;
1590	     i < ext_sg_entries && j < kern_sg_entries;) {
1591		uint8_t *ext_ptr, *kern_ptr;
1592
1593		len_to_copy = ctl_min(ext_sglist[i].len - ext_watermark,
1594				      kern_sglist[j].len - kern_watermark);
1595
1596		ext_ptr = (uint8_t *)ext_sglist[i].addr;
1597		ext_ptr = ext_ptr + ext_watermark;
1598		if (ctsio->io_hdr.flags & CTL_FLAG_BUS_ADDR) {
1599			/*
1600			 * XXX KDM fix this!
1601			 */
1602			panic("need to implement bus address support");
1603#if 0
1604			kern_ptr = bus_to_virt(kern_sglist[j].addr);
1605#endif
1606		} else
1607			kern_ptr = (uint8_t *)kern_sglist[j].addr;
1608		kern_ptr = kern_ptr + kern_watermark;
1609
1610		kern_watermark += len_to_copy;
1611		ext_watermark += len_to_copy;
1612
1613		if ((ctsio->io_hdr.flags & CTL_FLAG_DATA_MASK) ==
1614		     CTL_FLAG_DATA_IN) {
1615			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: copying %d "
1616					 "bytes to user\n", len_to_copy));
1617			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: from %p "
1618					 "to %p\n", kern_ptr, ext_ptr));
1619			if (copyout(kern_ptr, ext_ptr, len_to_copy) != 0) {
1620				ctl_set_internal_failure(ctsio,
1621							 /*sks_valid*/ 0,
1622							 /*retry_count*/ 0);
1623				goto bailout;
1624			}
1625		} else {
1626			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: copying %d "
1627					 "bytes from user\n", len_to_copy));
1628			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: from %p "
1629					 "to %p\n", ext_ptr, kern_ptr));
1630			if (copyin(ext_ptr, kern_ptr, len_to_copy)!= 0){
1631				ctl_set_internal_failure(ctsio,
1632							 /*sks_valid*/ 0,
1633							 /*retry_count*/0);
1634				goto bailout;
1635			}
1636		}
1637
1638		len_copied += len_to_copy;
1639
1640		if (ext_sglist[i].len == ext_watermark) {
1641			i++;
1642			ext_watermark = 0;
1643		}
1644
1645		if (kern_sglist[j].len == kern_watermark) {
1646			j++;
1647			kern_watermark = 0;
1648		}
1649	}
1650
1651	ctsio->ext_data_filled += len_copied;
1652
1653	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: ext_sg_entries: %d, "
1654			 "kern_sg_entries: %d\n", ext_sg_entries,
1655			 kern_sg_entries));
1656	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: ext_data_len = %d, "
1657			 "kern_data_len = %d\n", ctsio->ext_data_len,
1658			 ctsio->kern_data_len));
1659
1660
1661	/* XXX KDM set residual?? */
1662bailout:
1663
1664	if (ext_sglist_malloced != 0)
1665		free(ext_sglist, M_CTL);
1666
1667	return (CTL_RETVAL_COMPLETE);
1668}
1669
1670/*
1671 * Serialize a command that went down the "wrong" side, and so was sent to
1672 * this controller for execution.  The logic is a little different than the
1673 * standard case in ctl_scsiio_precheck().  Errors in this case need to get
1674 * sent back to the other side, but in the success case, we execute the
1675 * command on this side (XFER mode) or tell the other side to execute it
1676 * (SER_ONLY mode).
1677 */
1678static int
1679ctl_serialize_other_sc_cmd(struct ctl_scsiio *ctsio, int have_lock)
1680{
1681	struct ctl_softc *ctl_softc;
1682	union ctl_ha_msg msg_info;
1683	struct ctl_lun *lun;
1684	int retval = 0;
1685
1686	ctl_softc = control_softc;
1687	if (have_lock == 0)
1688		mtx_lock(&ctl_softc->ctl_lock);
1689
1690	lun = ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun];
1691	if (lun==NULL)
1692	{
1693		/*
1694		 * Why isn't LUN defined? The other side wouldn't
1695		 * send a cmd if the LUN is undefined.
1696		 */
1697		printf("%s: Bad JUJU!, LUN is NULL!\n", __func__);
1698
1699		/* "Logical unit not supported" */
1700		ctl_set_sense_data(&msg_info.scsi.sense_data,
1701				   lun,
1702				   /*sense_format*/SSD_TYPE_NONE,
1703				   /*current_error*/ 1,
1704				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1705				   /*asc*/ 0x25,
1706				   /*ascq*/ 0x00,
1707				   SSD_ELEM_NONE);
1708
1709		msg_info.scsi.sense_len = SSD_FULL_SIZE;
1710		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
1711		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
1712		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1713		msg_info.hdr.serializing_sc = NULL;
1714		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
1715	        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1716				sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1717		}
1718		if (have_lock == 0)
1719			mtx_unlock(&ctl_softc->ctl_lock);
1720		return(1);
1721
1722	}
1723
1724    	TAILQ_INSERT_TAIL(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
1725
1726	switch (ctl_check_ooa(lun, (union ctl_io *)ctsio,
1727		(union ctl_io *)TAILQ_PREV(&ctsio->io_hdr, ctl_ooaq,
1728		 ooa_links))) {
1729	case CTL_ACTION_BLOCK:
1730		ctsio->io_hdr.flags |= CTL_FLAG_BLOCKED;
1731		TAILQ_INSERT_TAIL(&lun->blocked_queue, &ctsio->io_hdr,
1732				  blocked_links);
1733		break;
1734	case CTL_ACTION_PASS:
1735	case CTL_ACTION_SKIP:
1736		if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
1737			ctsio->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
1738			STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
1739					   &ctsio->io_hdr, links);
1740		} else {
1741
1742			/* send msg back to other side */
1743			msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1744			msg_info.hdr.serializing_sc = (union ctl_io *)ctsio;
1745			msg_info.hdr.msg_type = CTL_MSG_R2R;
1746#if 0
1747			printf("2. pOrig %x\n", (int)msg_info.hdr.original_sc);
1748#endif
1749		        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1750			    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1751			}
1752		}
1753		break;
1754	case CTL_ACTION_OVERLAP:
1755		/* OVERLAPPED COMMANDS ATTEMPTED */
1756		ctl_set_sense_data(&msg_info.scsi.sense_data,
1757				   lun,
1758				   /*sense_format*/SSD_TYPE_NONE,
1759				   /*current_error*/ 1,
1760				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1761				   /*asc*/ 0x4E,
1762				   /*ascq*/ 0x00,
1763				   SSD_ELEM_NONE);
1764
1765		msg_info.scsi.sense_len = SSD_FULL_SIZE;
1766		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
1767		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
1768		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1769		msg_info.hdr.serializing_sc = NULL;
1770		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
1771#if 0
1772		printf("BAD JUJU:Major Bummer Overlap\n");
1773#endif
1774		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
1775		retval = 1;
1776		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1777		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1778		}
1779		break;
1780	case CTL_ACTION_OVERLAP_TAG:
1781		/* TAGGED OVERLAPPED COMMANDS (NN = QUEUE TAG) */
1782		ctl_set_sense_data(&msg_info.scsi.sense_data,
1783				   lun,
1784				   /*sense_format*/SSD_TYPE_NONE,
1785				   /*current_error*/ 1,
1786				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
1787				   /*asc*/ 0x4D,
1788				   /*ascq*/ ctsio->tag_num & 0xff,
1789				   SSD_ELEM_NONE);
1790
1791		msg_info.scsi.sense_len = SSD_FULL_SIZE;
1792		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
1793		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
1794		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1795		msg_info.hdr.serializing_sc = NULL;
1796		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
1797#if 0
1798		printf("BAD JUJU:Major Bummer Overlap Tag\n");
1799#endif
1800		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
1801		retval = 1;
1802		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1803		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1804		}
1805		break;
1806	case CTL_ACTION_ERROR:
1807	default:
1808		/* "Internal target failure" */
1809		ctl_set_sense_data(&msg_info.scsi.sense_data,
1810				   lun,
1811				   /*sense_format*/SSD_TYPE_NONE,
1812				   /*current_error*/ 1,
1813				   /*sense_key*/ SSD_KEY_HARDWARE_ERROR,
1814				   /*asc*/ 0x44,
1815				   /*ascq*/ 0x00,
1816				   SSD_ELEM_NONE);
1817
1818		msg_info.scsi.sense_len = SSD_FULL_SIZE;
1819		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
1820		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
1821		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
1822		msg_info.hdr.serializing_sc = NULL;
1823		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
1824#if 0
1825		printf("BAD JUJU:Major Bummer HW Error\n");
1826#endif
1827		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
1828		retval = 1;
1829		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
1830		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
1831		}
1832		break;
1833	}
1834	if (have_lock == 0)
1835		mtx_unlock(&ctl_softc->ctl_lock);
1836	return (retval);
1837}
1838
1839static int
1840ctl_ioctl_submit_wait(union ctl_io *io)
1841{
1842	struct ctl_fe_ioctl_params params;
1843	ctl_fe_ioctl_state last_state;
1844	int done, retval;
1845
1846	retval = 0;
1847
1848	bzero(&params, sizeof(params));
1849
1850	mtx_init(&params.ioctl_mtx, "ctliocmtx", NULL, MTX_DEF);
1851	cv_init(&params.sem, "ctlioccv");
1852	params.state = CTL_IOCTL_INPROG;
1853	last_state = params.state;
1854
1855	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = &params;
1856
1857	CTL_DEBUG_PRINT(("ctl_ioctl_submit_wait\n"));
1858
1859	/* This shouldn't happen */
1860	if ((retval = ctl_queue(io)) != CTL_RETVAL_COMPLETE)
1861		return (retval);
1862
1863	done = 0;
1864
1865	do {
1866		mtx_lock(&params.ioctl_mtx);
1867		/*
1868		 * Check the state here, and don't sleep if the state has
1869		 * already changed (i.e. wakeup has already occured, but we
1870		 * weren't waiting yet).
1871		 */
1872		if (params.state == last_state) {
1873			/* XXX KDM cv_wait_sig instead? */
1874			cv_wait(&params.sem, &params.ioctl_mtx);
1875		}
1876		last_state = params.state;
1877
1878		switch (params.state) {
1879		case CTL_IOCTL_INPROG:
1880			/* Why did we wake up? */
1881			/* XXX KDM error here? */
1882			mtx_unlock(&params.ioctl_mtx);
1883			break;
1884		case CTL_IOCTL_DATAMOVE:
1885			CTL_DEBUG_PRINT(("got CTL_IOCTL_DATAMOVE\n"));
1886
1887			/*
1888			 * change last_state back to INPROG to avoid
1889			 * deadlock on subsequent data moves.
1890			 */
1891			params.state = last_state = CTL_IOCTL_INPROG;
1892
1893			mtx_unlock(&params.ioctl_mtx);
1894			ctl_ioctl_do_datamove(&io->scsiio);
1895			/*
1896			 * Note that in some cases, most notably writes,
1897			 * this will queue the I/O and call us back later.
1898			 * In other cases, generally reads, this routine
1899			 * will immediately call back and wake us up,
1900			 * probably using our own context.
1901			 */
1902			io->scsiio.be_move_done(io);
1903			break;
1904		case CTL_IOCTL_DONE:
1905			mtx_unlock(&params.ioctl_mtx);
1906			CTL_DEBUG_PRINT(("got CTL_IOCTL_DONE\n"));
1907			done = 1;
1908			break;
1909		default:
1910			mtx_unlock(&params.ioctl_mtx);
1911			/* XXX KDM error here? */
1912			break;
1913		}
1914	} while (done == 0);
1915
1916	mtx_destroy(&params.ioctl_mtx);
1917	cv_destroy(&params.sem);
1918
1919	return (CTL_RETVAL_COMPLETE);
1920}
1921
1922static void
1923ctl_ioctl_datamove(union ctl_io *io)
1924{
1925	struct ctl_fe_ioctl_params *params;
1926
1927	params = (struct ctl_fe_ioctl_params *)
1928		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1929
1930	mtx_lock(&params->ioctl_mtx);
1931	params->state = CTL_IOCTL_DATAMOVE;
1932	cv_broadcast(&params->sem);
1933	mtx_unlock(&params->ioctl_mtx);
1934}
1935
1936static void
1937ctl_ioctl_done(union ctl_io *io)
1938{
1939	struct ctl_fe_ioctl_params *params;
1940
1941	params = (struct ctl_fe_ioctl_params *)
1942		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
1943
1944	mtx_lock(&params->ioctl_mtx);
1945	params->state = CTL_IOCTL_DONE;
1946	cv_broadcast(&params->sem);
1947	mtx_unlock(&params->ioctl_mtx);
1948}
1949
1950static void
1951ctl_ioctl_hard_startstop_callback(void *arg, struct cfi_metatask *metatask)
1952{
1953	struct ctl_fe_ioctl_startstop_info *sd_info;
1954
1955	sd_info = (struct ctl_fe_ioctl_startstop_info *)arg;
1956
1957	sd_info->hs_info.status = metatask->status;
1958	sd_info->hs_info.total_luns = metatask->taskinfo.startstop.total_luns;
1959	sd_info->hs_info.luns_complete =
1960		metatask->taskinfo.startstop.luns_complete;
1961	sd_info->hs_info.luns_failed = metatask->taskinfo.startstop.luns_failed;
1962
1963	cv_broadcast(&sd_info->sem);
1964}
1965
1966static void
1967ctl_ioctl_bbrread_callback(void *arg, struct cfi_metatask *metatask)
1968{
1969	struct ctl_fe_ioctl_bbrread_info *fe_bbr_info;
1970
1971	fe_bbr_info = (struct ctl_fe_ioctl_bbrread_info *)arg;
1972
1973	mtx_lock(fe_bbr_info->lock);
1974	fe_bbr_info->bbr_info->status = metatask->status;
1975	fe_bbr_info->bbr_info->bbr_status = metatask->taskinfo.bbrread.status;
1976	fe_bbr_info->wakeup_done = 1;
1977	mtx_unlock(fe_bbr_info->lock);
1978
1979	cv_broadcast(&fe_bbr_info->sem);
1980}
1981
1982/*
1983 * Returns 0 for success, errno for failure.
1984 */
1985static int
1986ctl_ioctl_fill_ooa(struct ctl_lun *lun, uint32_t *cur_fill_num,
1987		   struct ctl_ooa *ooa_hdr, struct ctl_ooa_entry *kern_entries)
1988{
1989	union ctl_io *io;
1990	int retval;
1991
1992	retval = 0;
1993
1994	mtx_assert(&control_softc->ctl_lock, MA_OWNED);
1995
1996	for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); (io != NULL);
1997	     (*cur_fill_num)++, io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,
1998	     ooa_links)) {
1999		struct ctl_ooa_entry *entry;
2000
2001		/*
2002		 * If we've got more than we can fit, just count the
2003		 * remaining entries.
2004		 */
2005		if (*cur_fill_num >= ooa_hdr->alloc_num)
2006			continue;
2007
2008		entry = &kern_entries[*cur_fill_num];
2009
2010		entry->tag_num = io->scsiio.tag_num;
2011		entry->lun_num = lun->lun;
2012#ifdef CTL_TIME_IO
2013		entry->start_bt = io->io_hdr.start_bt;
2014#endif
2015		bcopy(io->scsiio.cdb, entry->cdb, io->scsiio.cdb_len);
2016		entry->cdb_len = io->scsiio.cdb_len;
2017		if (io->io_hdr.flags & CTL_FLAG_BLOCKED)
2018			entry->cmd_flags |= CTL_OOACMD_FLAG_BLOCKED;
2019
2020		if (io->io_hdr.flags & CTL_FLAG_DMA_INPROG)
2021			entry->cmd_flags |= CTL_OOACMD_FLAG_DMA;
2022
2023		if (io->io_hdr.flags & CTL_FLAG_ABORT)
2024			entry->cmd_flags |= CTL_OOACMD_FLAG_ABORT;
2025
2026		if (io->io_hdr.flags & CTL_FLAG_IS_WAS_ON_RTR)
2027			entry->cmd_flags |= CTL_OOACMD_FLAG_RTR;
2028
2029		if (io->io_hdr.flags & CTL_FLAG_DMA_QUEUED)
2030			entry->cmd_flags |= CTL_OOACMD_FLAG_DMA_QUEUED;
2031	}
2032
2033	return (retval);
2034}
2035
2036static void *
2037ctl_copyin_alloc(void *user_addr, int len, char *error_str,
2038		 size_t error_str_len)
2039{
2040	void *kptr;
2041
2042	kptr = malloc(len, M_CTL, M_WAITOK | M_ZERO);
2043
2044	if (copyin(user_addr, kptr, len) != 0) {
2045		snprintf(error_str, error_str_len, "Error copying %d bytes "
2046			 "from user address %p to kernel address %p", len,
2047			 user_addr, kptr);
2048		free(kptr, M_CTL);
2049		return (NULL);
2050	}
2051
2052	return (kptr);
2053}
2054
2055static void
2056ctl_free_args(int num_be_args, struct ctl_be_arg *be_args)
2057{
2058	int i;
2059
2060	if (be_args == NULL)
2061		return;
2062
2063	for (i = 0; i < num_be_args; i++) {
2064		free(be_args[i].kname, M_CTL);
2065		free(be_args[i].kvalue, M_CTL);
2066	}
2067
2068	free(be_args, M_CTL);
2069}
2070
2071static struct ctl_be_arg *
2072ctl_copyin_args(int num_be_args, struct ctl_be_arg *be_args,
2073		char *error_str, size_t error_str_len)
2074{
2075	struct ctl_be_arg *args;
2076	int i;
2077
2078	args = ctl_copyin_alloc(be_args, num_be_args * sizeof(*be_args),
2079				error_str, error_str_len);
2080
2081	if (args == NULL)
2082		goto bailout;
2083
2084	for (i = 0; i < num_be_args; i++) {
2085		args[i].kname = NULL;
2086		args[i].kvalue = NULL;
2087	}
2088
2089	for (i = 0; i < num_be_args; i++) {
2090		uint8_t *tmpptr;
2091
2092		args[i].kname = ctl_copyin_alloc(args[i].name,
2093			args[i].namelen, error_str, error_str_len);
2094		if (args[i].kname == NULL)
2095			goto bailout;
2096
2097		if (args[i].kname[args[i].namelen - 1] != '\0') {
2098			snprintf(error_str, error_str_len, "Argument %d "
2099				 "name is not NUL-terminated", i);
2100			goto bailout;
2101		}
2102
2103		args[i].kvalue = NULL;
2104
2105		tmpptr = ctl_copyin_alloc(args[i].value,
2106			args[i].vallen, error_str, error_str_len);
2107		if (tmpptr == NULL)
2108			goto bailout;
2109
2110		args[i].kvalue = tmpptr;
2111
2112		if ((args[i].flags & CTL_BEARG_ASCII)
2113		 && (tmpptr[args[i].vallen - 1] != '\0')) {
2114			snprintf(error_str, error_str_len, "Argument %d "
2115				 "value is not NUL-terminated", i);
2116			goto bailout;
2117		}
2118	}
2119
2120	return (args);
2121bailout:
2122
2123	ctl_free_args(num_be_args, args);
2124
2125	return (NULL);
2126}
2127
2128/*
2129 * Escape characters that are illegal or not recommended in XML.
2130 */
2131int
2132ctl_sbuf_printf_esc(struct sbuf *sb, char *str)
2133{
2134	int retval;
2135
2136	retval = 0;
2137
2138	for (; *str; str++) {
2139		switch (*str) {
2140		case '&':
2141			retval = sbuf_printf(sb, "&amp;");
2142			break;
2143		case '>':
2144			retval = sbuf_printf(sb, "&gt;");
2145			break;
2146		case '<':
2147			retval = sbuf_printf(sb, "&lt;");
2148			break;
2149		default:
2150			retval = sbuf_putc(sb, *str);
2151			break;
2152		}
2153
2154		if (retval != 0)
2155			break;
2156
2157	}
2158
2159	return (retval);
2160}
2161
2162static int
2163ctl_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
2164	  struct thread *td)
2165{
2166	struct ctl_softc *softc;
2167	int retval;
2168
2169	softc = control_softc;
2170
2171	retval = 0;
2172
2173	switch (cmd) {
2174	case CTL_IO: {
2175		union ctl_io *io;
2176		void *pool_tmp;
2177
2178		/*
2179		 * If we haven't been "enabled", don't allow any SCSI I/O
2180		 * to this FETD.
2181		 */
2182		if ((softc->ioctl_info.flags & CTL_IOCTL_FLAG_ENABLED) == 0) {
2183			retval = -EPERM;
2184			break;
2185		}
2186
2187		io = ctl_alloc_io(softc->ioctl_info.fe.ctl_pool_ref);
2188		if (io == NULL) {
2189			printf("ctl_ioctl: can't allocate ctl_io!\n");
2190			retval = -ENOSPC;
2191			break;
2192		}
2193
2194		/*
2195		 * Need to save the pool reference so it doesn't get
2196		 * spammed by the user's ctl_io.
2197		 */
2198		pool_tmp = io->io_hdr.pool;
2199
2200		memcpy(io, (void *)addr, sizeof(*io));
2201
2202		io->io_hdr.pool = pool_tmp;
2203		/*
2204		 * No status yet, so make sure the status is set properly.
2205		 */
2206		io->io_hdr.status = CTL_STATUS_NONE;
2207
2208		/*
2209		 * The user sets the initiator ID, target and LUN IDs.
2210		 */
2211		io->io_hdr.nexus.targ_port = softc->ioctl_info.fe.targ_port;
2212		io->io_hdr.flags |= CTL_FLAG_USER_REQ;
2213		if ((io->io_hdr.io_type == CTL_IO_SCSI)
2214		 && (io->scsiio.tag_type != CTL_TAG_UNTAGGED))
2215			io->scsiio.tag_num = softc->ioctl_info.cur_tag_num++;
2216
2217		retval = ctl_ioctl_submit_wait(io);
2218
2219		if (retval != 0) {
2220			ctl_free_io(io);
2221			break;
2222		}
2223
2224		memcpy((void *)addr, io, sizeof(*io));
2225
2226		/* return this to our pool */
2227		ctl_free_io(io);
2228
2229		break;
2230	}
2231	case CTL_ENABLE_PORT:
2232	case CTL_DISABLE_PORT:
2233	case CTL_SET_PORT_WWNS: {
2234		struct ctl_frontend *fe;
2235		struct ctl_port_entry *entry;
2236
2237		entry = (struct ctl_port_entry *)addr;
2238
2239		mtx_lock(&softc->ctl_lock);
2240		STAILQ_FOREACH(fe, &softc->fe_list, links) {
2241			int action, done;
2242
2243			action = 0;
2244			done = 0;
2245
2246			if ((entry->port_type == CTL_PORT_NONE)
2247			 && (entry->targ_port == fe->targ_port)) {
2248				/*
2249				 * If the user only wants to enable or
2250				 * disable or set WWNs on a specific port,
2251				 * do the operation and we're done.
2252				 */
2253				action = 1;
2254				done = 1;
2255			} else if (entry->port_type & fe->port_type) {
2256				/*
2257				 * Compare the user's type mask with the
2258				 * particular frontend type to see if we
2259				 * have a match.
2260				 */
2261				action = 1;
2262				done = 0;
2263
2264				/*
2265				 * Make sure the user isn't trying to set
2266				 * WWNs on multiple ports at the same time.
2267				 */
2268				if (cmd == CTL_SET_PORT_WWNS) {
2269					printf("%s: Can't set WWNs on "
2270					       "multiple ports\n", __func__);
2271					retval = EINVAL;
2272					break;
2273				}
2274			}
2275			if (action != 0) {
2276				/*
2277				 * XXX KDM we have to drop the lock here,
2278				 * because the online/offline operations
2279				 * can potentially block.  We need to
2280				 * reference count the frontends so they
2281				 * can't go away,
2282				 */
2283				mtx_unlock(&softc->ctl_lock);
2284
2285				if (cmd == CTL_ENABLE_PORT) {
2286					struct ctl_lun *lun;
2287
2288					STAILQ_FOREACH(lun, &softc->lun_list,
2289						       links) {
2290						fe->lun_enable(fe->targ_lun_arg,
2291						    lun->target,
2292						    lun->lun);
2293					}
2294
2295					ctl_frontend_online(fe);
2296				} else if (cmd == CTL_DISABLE_PORT) {
2297					struct ctl_lun *lun;
2298
2299					ctl_frontend_offline(fe);
2300
2301					STAILQ_FOREACH(lun, &softc->lun_list,
2302						       links) {
2303						fe->lun_disable(
2304						    fe->targ_lun_arg,
2305						    lun->target,
2306						    lun->lun);
2307					}
2308				}
2309
2310				mtx_lock(&softc->ctl_lock);
2311
2312				if (cmd == CTL_SET_PORT_WWNS)
2313					ctl_frontend_set_wwns(fe,
2314					    (entry->flags & CTL_PORT_WWNN_VALID) ?
2315					    1 : 0, entry->wwnn,
2316					    (entry->flags & CTL_PORT_WWPN_VALID) ?
2317					    1 : 0, entry->wwpn);
2318			}
2319			if (done != 0)
2320				break;
2321		}
2322		mtx_unlock(&softc->ctl_lock);
2323		break;
2324	}
2325	case CTL_GET_PORT_LIST: {
2326		struct ctl_frontend *fe;
2327		struct ctl_port_list *list;
2328		int i;
2329
2330		list = (struct ctl_port_list *)addr;
2331
2332		if (list->alloc_len != (list->alloc_num *
2333		    sizeof(struct ctl_port_entry))) {
2334			printf("%s: CTL_GET_PORT_LIST: alloc_len %u != "
2335			       "alloc_num %u * sizeof(struct ctl_port_entry) "
2336			       "%zu\n", __func__, list->alloc_len,
2337			       list->alloc_num, sizeof(struct ctl_port_entry));
2338			retval = EINVAL;
2339			break;
2340		}
2341		list->fill_len = 0;
2342		list->fill_num = 0;
2343		list->dropped_num = 0;
2344		i = 0;
2345		mtx_lock(&softc->ctl_lock);
2346		STAILQ_FOREACH(fe, &softc->fe_list, links) {
2347			struct ctl_port_entry entry, *list_entry;
2348
2349			if (list->fill_num >= list->alloc_num) {
2350				list->dropped_num++;
2351				continue;
2352			}
2353
2354			entry.port_type = fe->port_type;
2355			strlcpy(entry.port_name, fe->port_name,
2356				sizeof(entry.port_name));
2357			entry.targ_port = fe->targ_port;
2358			entry.physical_port = fe->physical_port;
2359			entry.virtual_port = fe->virtual_port;
2360			entry.wwnn = fe->wwnn;
2361			entry.wwpn = fe->wwpn;
2362			if (fe->status & CTL_PORT_STATUS_ONLINE)
2363				entry.online = 1;
2364			else
2365				entry.online = 0;
2366
2367			list_entry = &list->entries[i];
2368
2369			retval = copyout(&entry, list_entry, sizeof(entry));
2370			if (retval != 0) {
2371				printf("%s: CTL_GET_PORT_LIST: copyout "
2372				       "returned %d\n", __func__, retval);
2373				break;
2374			}
2375			i++;
2376			list->fill_num++;
2377			list->fill_len += sizeof(entry);
2378		}
2379		mtx_unlock(&softc->ctl_lock);
2380
2381		/*
2382		 * If this is non-zero, we had a copyout fault, so there's
2383		 * probably no point in attempting to set the status inside
2384		 * the structure.
2385		 */
2386		if (retval != 0)
2387			break;
2388
2389		if (list->dropped_num > 0)
2390			list->status = CTL_PORT_LIST_NEED_MORE_SPACE;
2391		else
2392			list->status = CTL_PORT_LIST_OK;
2393		break;
2394	}
2395	case CTL_DUMP_OOA: {
2396		struct ctl_lun *lun;
2397		union ctl_io *io;
2398		char printbuf[128];
2399		struct sbuf sb;
2400
2401		mtx_lock(&softc->ctl_lock);
2402		printf("Dumping OOA queues:\n");
2403		STAILQ_FOREACH(lun, &softc->lun_list, links) {
2404			for (io = (union ctl_io *)TAILQ_FIRST(
2405			     &lun->ooa_queue); io != NULL;
2406			     io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,
2407			     ooa_links)) {
2408				sbuf_new(&sb, printbuf, sizeof(printbuf),
2409					 SBUF_FIXEDLEN);
2410				sbuf_printf(&sb, "LUN %jd tag 0x%04x%s%s%s%s: ",
2411					    (intmax_t)lun->lun,
2412					    io->scsiio.tag_num,
2413					    (io->io_hdr.flags &
2414					    CTL_FLAG_BLOCKED) ? "" : " BLOCKED",
2415					    (io->io_hdr.flags &
2416					    CTL_FLAG_DMA_INPROG) ? " DMA" : "",
2417					    (io->io_hdr.flags &
2418					    CTL_FLAG_ABORT) ? " ABORT" : "",
2419			                    (io->io_hdr.flags &
2420		                        CTL_FLAG_IS_WAS_ON_RTR) ? " RTR" : "");
2421				ctl_scsi_command_string(&io->scsiio, NULL, &sb);
2422				sbuf_finish(&sb);
2423				printf("%s\n", sbuf_data(&sb));
2424			}
2425		}
2426		printf("OOA queues dump done\n");
2427		mtx_unlock(&softc->ctl_lock);
2428		break;
2429	}
2430	case CTL_GET_OOA: {
2431		struct ctl_lun *lun;
2432		struct ctl_ooa *ooa_hdr;
2433		struct ctl_ooa_entry *entries;
2434		uint32_t cur_fill_num;
2435
2436		ooa_hdr = (struct ctl_ooa *)addr;
2437
2438		if ((ooa_hdr->alloc_len == 0)
2439		 || (ooa_hdr->alloc_num == 0)) {
2440			printf("%s: CTL_GET_OOA: alloc len %u and alloc num %u "
2441			       "must be non-zero\n", __func__,
2442			       ooa_hdr->alloc_len, ooa_hdr->alloc_num);
2443			retval = EINVAL;
2444			break;
2445		}
2446
2447		if (ooa_hdr->alloc_len != (ooa_hdr->alloc_num *
2448		    sizeof(struct ctl_ooa_entry))) {
2449			printf("%s: CTL_GET_OOA: alloc len %u must be alloc "
2450			       "num %d * sizeof(struct ctl_ooa_entry) %zd\n",
2451			       __func__, ooa_hdr->alloc_len,
2452			       ooa_hdr->alloc_num,sizeof(struct ctl_ooa_entry));
2453			retval = EINVAL;
2454			break;
2455		}
2456
2457		entries = malloc(ooa_hdr->alloc_len, M_CTL, M_WAITOK | M_ZERO);
2458		if (entries == NULL) {
2459			printf("%s: could not allocate %d bytes for OOA "
2460			       "dump\n", __func__, ooa_hdr->alloc_len);
2461			retval = ENOMEM;
2462			break;
2463		}
2464
2465		mtx_lock(&softc->ctl_lock);
2466		if (((ooa_hdr->flags & CTL_OOA_FLAG_ALL_LUNS) == 0)
2467		 && ((ooa_hdr->lun_num > CTL_MAX_LUNS)
2468		  || (softc->ctl_luns[ooa_hdr->lun_num] == NULL))) {
2469			mtx_unlock(&softc->ctl_lock);
2470			free(entries, M_CTL);
2471			printf("%s: CTL_GET_OOA: invalid LUN %ju\n",
2472			       __func__, (uintmax_t)ooa_hdr->lun_num);
2473			retval = EINVAL;
2474			break;
2475		}
2476
2477		cur_fill_num = 0;
2478
2479		if (ooa_hdr->flags & CTL_OOA_FLAG_ALL_LUNS) {
2480			STAILQ_FOREACH(lun, &softc->lun_list, links) {
2481				retval = ctl_ioctl_fill_ooa(lun, &cur_fill_num,
2482					ooa_hdr, entries);
2483				if (retval != 0)
2484					break;
2485			}
2486			if (retval != 0) {
2487				mtx_unlock(&softc->ctl_lock);
2488				free(entries, M_CTL);
2489				break;
2490			}
2491		} else {
2492			lun = softc->ctl_luns[ooa_hdr->lun_num];
2493
2494			retval = ctl_ioctl_fill_ooa(lun, &cur_fill_num,ooa_hdr,
2495						    entries);
2496		}
2497		mtx_unlock(&softc->ctl_lock);
2498
2499		ooa_hdr->fill_num = min(cur_fill_num, ooa_hdr->alloc_num);
2500		ooa_hdr->fill_len = ooa_hdr->fill_num *
2501			sizeof(struct ctl_ooa_entry);
2502		retval = copyout(entries, ooa_hdr->entries, ooa_hdr->fill_len);
2503		if (retval != 0) {
2504			printf("%s: error copying out %d bytes for OOA dump\n",
2505			       __func__, ooa_hdr->fill_len);
2506		}
2507
2508		getbintime(&ooa_hdr->cur_bt);
2509
2510		if (cur_fill_num > ooa_hdr->alloc_num) {
2511			ooa_hdr->dropped_num = cur_fill_num -ooa_hdr->alloc_num;
2512			ooa_hdr->status = CTL_OOA_NEED_MORE_SPACE;
2513		} else {
2514			ooa_hdr->dropped_num = 0;
2515			ooa_hdr->status = CTL_OOA_OK;
2516		}
2517
2518		free(entries, M_CTL);
2519		break;
2520	}
2521	case CTL_CHECK_OOA: {
2522		union ctl_io *io;
2523		struct ctl_lun *lun;
2524		struct ctl_ooa_info *ooa_info;
2525
2526
2527		ooa_info = (struct ctl_ooa_info *)addr;
2528
2529		if (ooa_info->lun_id >= CTL_MAX_LUNS) {
2530			ooa_info->status = CTL_OOA_INVALID_LUN;
2531			break;
2532		}
2533		mtx_lock(&softc->ctl_lock);
2534		lun = softc->ctl_luns[ooa_info->lun_id];
2535		if (lun == NULL) {
2536			mtx_unlock(&softc->ctl_lock);
2537			ooa_info->status = CTL_OOA_INVALID_LUN;
2538			break;
2539		}
2540
2541		ooa_info->num_entries = 0;
2542		for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
2543		     io != NULL; io = (union ctl_io *)TAILQ_NEXT(
2544		     &io->io_hdr, ooa_links)) {
2545			ooa_info->num_entries++;
2546		}
2547
2548		mtx_unlock(&softc->ctl_lock);
2549		ooa_info->status = CTL_OOA_SUCCESS;
2550
2551		break;
2552	}
2553	case CTL_HARD_START:
2554	case CTL_HARD_STOP: {
2555		struct ctl_fe_ioctl_startstop_info ss_info;
2556		struct cfi_metatask *metatask;
2557		struct mtx hs_mtx;
2558
2559		mtx_init(&hs_mtx, "HS Mutex", NULL, MTX_DEF);
2560
2561		cv_init(&ss_info.sem, "hard start/stop cv" );
2562
2563		metatask = cfi_alloc_metatask(/*can_wait*/ 1);
2564		if (metatask == NULL) {
2565			retval = ENOMEM;
2566			mtx_destroy(&hs_mtx);
2567			break;
2568		}
2569
2570		if (cmd == CTL_HARD_START)
2571			metatask->tasktype = CFI_TASK_STARTUP;
2572		else
2573			metatask->tasktype = CFI_TASK_SHUTDOWN;
2574
2575		metatask->callback = ctl_ioctl_hard_startstop_callback;
2576		metatask->callback_arg = &ss_info;
2577
2578		cfi_action(metatask);
2579
2580		/* Wait for the callback */
2581		mtx_lock(&hs_mtx);
2582		cv_wait_sig(&ss_info.sem, &hs_mtx);
2583		mtx_unlock(&hs_mtx);
2584
2585		/*
2586		 * All information has been copied from the metatask by the
2587		 * time cv_broadcast() is called, so we free the metatask here.
2588		 */
2589		cfi_free_metatask(metatask);
2590
2591		memcpy((void *)addr, &ss_info.hs_info, sizeof(ss_info.hs_info));
2592
2593		mtx_destroy(&hs_mtx);
2594		break;
2595	}
2596	case CTL_BBRREAD: {
2597		struct ctl_bbrread_info *bbr_info;
2598		struct ctl_fe_ioctl_bbrread_info fe_bbr_info;
2599		struct mtx bbr_mtx;
2600		struct cfi_metatask *metatask;
2601
2602		bbr_info = (struct ctl_bbrread_info *)addr;
2603
2604		bzero(&fe_bbr_info, sizeof(fe_bbr_info));
2605
2606		bzero(&bbr_mtx, sizeof(bbr_mtx));
2607		mtx_init(&bbr_mtx, "BBR Mutex", NULL, MTX_DEF);
2608
2609		fe_bbr_info.bbr_info = bbr_info;
2610		fe_bbr_info.lock = &bbr_mtx;
2611
2612		cv_init(&fe_bbr_info.sem, "BBR read cv");
2613		metatask = cfi_alloc_metatask(/*can_wait*/ 1);
2614
2615		if (metatask == NULL) {
2616			mtx_destroy(&bbr_mtx);
2617			cv_destroy(&fe_bbr_info.sem);
2618			retval = ENOMEM;
2619			break;
2620		}
2621		metatask->tasktype = CFI_TASK_BBRREAD;
2622		metatask->callback = ctl_ioctl_bbrread_callback;
2623		metatask->callback_arg = &fe_bbr_info;
2624		metatask->taskinfo.bbrread.lun_num = bbr_info->lun_num;
2625		metatask->taskinfo.bbrread.lba = bbr_info->lba;
2626		metatask->taskinfo.bbrread.len = bbr_info->len;
2627
2628		cfi_action(metatask);
2629
2630		mtx_lock(&bbr_mtx);
2631		while (fe_bbr_info.wakeup_done == 0)
2632			cv_wait_sig(&fe_bbr_info.sem, &bbr_mtx);
2633		mtx_unlock(&bbr_mtx);
2634
2635		bbr_info->status = metatask->status;
2636		bbr_info->bbr_status = metatask->taskinfo.bbrread.status;
2637		bbr_info->scsi_status = metatask->taskinfo.bbrread.scsi_status;
2638		memcpy(&bbr_info->sense_data,
2639		       &metatask->taskinfo.bbrread.sense_data,
2640		       ctl_min(sizeof(bbr_info->sense_data),
2641			       sizeof(metatask->taskinfo.bbrread.sense_data)));
2642
2643		cfi_free_metatask(metatask);
2644
2645		mtx_destroy(&bbr_mtx);
2646		cv_destroy(&fe_bbr_info.sem);
2647
2648		break;
2649	}
2650	case CTL_DELAY_IO: {
2651		struct ctl_io_delay_info *delay_info;
2652#ifdef CTL_IO_DELAY
2653		struct ctl_lun *lun;
2654#endif /* CTL_IO_DELAY */
2655
2656		delay_info = (struct ctl_io_delay_info *)addr;
2657
2658#ifdef CTL_IO_DELAY
2659		mtx_lock(&softc->ctl_lock);
2660
2661		if ((delay_info->lun_id > CTL_MAX_LUNS)
2662		 || (softc->ctl_luns[delay_info->lun_id] == NULL)) {
2663			delay_info->status = CTL_DELAY_STATUS_INVALID_LUN;
2664		} else {
2665			lun = softc->ctl_luns[delay_info->lun_id];
2666
2667			delay_info->status = CTL_DELAY_STATUS_OK;
2668
2669			switch (delay_info->delay_type) {
2670			case CTL_DELAY_TYPE_CONT:
2671				break;
2672			case CTL_DELAY_TYPE_ONESHOT:
2673				break;
2674			default:
2675				delay_info->status =
2676					CTL_DELAY_STATUS_INVALID_TYPE;
2677				break;
2678			}
2679
2680			switch (delay_info->delay_loc) {
2681			case CTL_DELAY_LOC_DATAMOVE:
2682				lun->delay_info.datamove_type =
2683					delay_info->delay_type;
2684				lun->delay_info.datamove_delay =
2685					delay_info->delay_secs;
2686				break;
2687			case CTL_DELAY_LOC_DONE:
2688				lun->delay_info.done_type =
2689					delay_info->delay_type;
2690				lun->delay_info.done_delay =
2691					delay_info->delay_secs;
2692				break;
2693			default:
2694				delay_info->status =
2695					CTL_DELAY_STATUS_INVALID_LOC;
2696				break;
2697			}
2698		}
2699
2700		mtx_unlock(&softc->ctl_lock);
2701#else
2702		delay_info->status = CTL_DELAY_STATUS_NOT_IMPLEMENTED;
2703#endif /* CTL_IO_DELAY */
2704		break;
2705	}
2706	case CTL_REALSYNC_SET: {
2707		int *syncstate;
2708
2709		syncstate = (int *)addr;
2710
2711		mtx_lock(&softc->ctl_lock);
2712		switch (*syncstate) {
2713		case 0:
2714			softc->flags &= ~CTL_FLAG_REAL_SYNC;
2715			break;
2716		case 1:
2717			softc->flags |= CTL_FLAG_REAL_SYNC;
2718			break;
2719		default:
2720			retval = -EINVAL;
2721			break;
2722		}
2723		mtx_unlock(&softc->ctl_lock);
2724		break;
2725	}
2726	case CTL_REALSYNC_GET: {
2727		int *syncstate;
2728
2729		syncstate = (int*)addr;
2730
2731		mtx_lock(&softc->ctl_lock);
2732		if (softc->flags & CTL_FLAG_REAL_SYNC)
2733			*syncstate = 1;
2734		else
2735			*syncstate = 0;
2736		mtx_unlock(&softc->ctl_lock);
2737
2738		break;
2739	}
2740	case CTL_SETSYNC:
2741	case CTL_GETSYNC: {
2742		struct ctl_sync_info *sync_info;
2743		struct ctl_lun *lun;
2744
2745		sync_info = (struct ctl_sync_info *)addr;
2746
2747		mtx_lock(&softc->ctl_lock);
2748		lun = softc->ctl_luns[sync_info->lun_id];
2749		if (lun == NULL) {
2750			mtx_unlock(&softc->ctl_lock);
2751			sync_info->status = CTL_GS_SYNC_NO_LUN;
2752		}
2753		/*
2754		 * Get or set the sync interval.  We're not bounds checking
2755		 * in the set case, hopefully the user won't do something
2756		 * silly.
2757		 */
2758		if (cmd == CTL_GETSYNC)
2759			sync_info->sync_interval = lun->sync_interval;
2760		else
2761			lun->sync_interval = sync_info->sync_interval;
2762
2763		mtx_unlock(&softc->ctl_lock);
2764
2765		sync_info->status = CTL_GS_SYNC_OK;
2766
2767		break;
2768	}
2769	case CTL_GETSTATS: {
2770		struct ctl_stats *stats;
2771		struct ctl_lun *lun;
2772		int i;
2773
2774		stats = (struct ctl_stats *)addr;
2775
2776		if ((sizeof(struct ctl_lun_io_stats) * softc->num_luns) >
2777		     stats->alloc_len) {
2778			stats->status = CTL_SS_NEED_MORE_SPACE;
2779			stats->num_luns = softc->num_luns;
2780			break;
2781		}
2782		/*
2783		 * XXX KDM no locking here.  If the LUN list changes,
2784		 * things can blow up.
2785		 */
2786		for (i = 0, lun = STAILQ_FIRST(&softc->lun_list); lun != NULL;
2787		     i++, lun = STAILQ_NEXT(lun, links)) {
2788			retval = copyout(&lun->stats, &stats->lun_stats[i],
2789					 sizeof(lun->stats));
2790			if (retval != 0)
2791				break;
2792		}
2793		stats->num_luns = softc->num_luns;
2794		stats->fill_len = sizeof(struct ctl_lun_io_stats) *
2795				 softc->num_luns;
2796		stats->status = CTL_SS_OK;
2797#ifdef CTL_TIME_IO
2798		stats->flags = CTL_STATS_FLAG_TIME_VALID;
2799#else
2800		stats->flags = CTL_STATS_FLAG_NONE;
2801#endif
2802		getnanouptime(&stats->timestamp);
2803		break;
2804	}
2805	case CTL_ERROR_INJECT: {
2806		struct ctl_error_desc *err_desc, *new_err_desc;
2807		struct ctl_lun *lun;
2808
2809		err_desc = (struct ctl_error_desc *)addr;
2810
2811		new_err_desc = malloc(sizeof(*new_err_desc), M_CTL,
2812				      M_WAITOK | M_ZERO);
2813		bcopy(err_desc, new_err_desc, sizeof(*new_err_desc));
2814
2815		mtx_lock(&softc->ctl_lock);
2816		lun = softc->ctl_luns[err_desc->lun_id];
2817		if (lun == NULL) {
2818			mtx_unlock(&softc->ctl_lock);
2819			printf("%s: CTL_ERROR_INJECT: invalid LUN %ju\n",
2820			       __func__, (uintmax_t)err_desc->lun_id);
2821			retval = EINVAL;
2822			break;
2823		}
2824
2825		/*
2826		 * We could do some checking here to verify the validity
2827		 * of the request, but given the complexity of error
2828		 * injection requests, the checking logic would be fairly
2829		 * complex.
2830		 *
2831		 * For now, if the request is invalid, it just won't get
2832		 * executed and might get deleted.
2833		 */
2834		STAILQ_INSERT_TAIL(&lun->error_list, new_err_desc, links);
2835
2836		/*
2837		 * XXX KDM check to make sure the serial number is unique,
2838		 * in case we somehow manage to wrap.  That shouldn't
2839		 * happen for a very long time, but it's the right thing to
2840		 * do.
2841		 */
2842		new_err_desc->serial = lun->error_serial;
2843		err_desc->serial = lun->error_serial;
2844		lun->error_serial++;
2845
2846		mtx_unlock(&softc->ctl_lock);
2847		break;
2848	}
2849	case CTL_ERROR_INJECT_DELETE: {
2850		struct ctl_error_desc *delete_desc, *desc, *desc2;
2851		struct ctl_lun *lun;
2852		int delete_done;
2853
2854		delete_desc = (struct ctl_error_desc *)addr;
2855		delete_done = 0;
2856
2857		mtx_lock(&softc->ctl_lock);
2858		lun = softc->ctl_luns[delete_desc->lun_id];
2859		if (lun == NULL) {
2860			mtx_unlock(&softc->ctl_lock);
2861			printf("%s: CTL_ERROR_INJECT_DELETE: invalid LUN %ju\n",
2862			       __func__, (uintmax_t)delete_desc->lun_id);
2863			retval = EINVAL;
2864			break;
2865		}
2866		STAILQ_FOREACH_SAFE(desc, &lun->error_list, links, desc2) {
2867			if (desc->serial != delete_desc->serial)
2868				continue;
2869
2870			STAILQ_REMOVE(&lun->error_list, desc, ctl_error_desc,
2871				      links);
2872			free(desc, M_CTL);
2873			delete_done = 1;
2874		}
2875		mtx_unlock(&softc->ctl_lock);
2876		if (delete_done == 0) {
2877			printf("%s: CTL_ERROR_INJECT_DELETE: can't find "
2878			       "error serial %ju on LUN %u\n", __func__,
2879			       delete_desc->serial, delete_desc->lun_id);
2880			retval = EINVAL;
2881			break;
2882		}
2883		break;
2884	}
2885	case CTL_DUMP_STRUCTS: {
2886		int i, j, k;
2887		struct ctl_frontend *fe;
2888
2889		printf("CTL IID to WWPN map start:\n");
2890		for (i = 0; i < CTL_MAX_PORTS; i++) {
2891			for (j = 0; j < CTL_MAX_INIT_PER_PORT; j++) {
2892				if (softc->wwpn_iid[i][j].in_use == 0)
2893					continue;
2894
2895				printf("port %d iid %u WWPN %#jx\n",
2896				       softc->wwpn_iid[i][j].port,
2897				       softc->wwpn_iid[i][j].iid,
2898				       (uintmax_t)softc->wwpn_iid[i][j].wwpn);
2899			}
2900		}
2901		printf("CTL IID to WWPN map end\n");
2902		printf("CTL Persistent Reservation information start:\n");
2903		for (i = 0; i < CTL_MAX_LUNS; i++) {
2904			struct ctl_lun *lun;
2905
2906			lun = softc->ctl_luns[i];
2907
2908			if ((lun == NULL)
2909			 || ((lun->flags & CTL_LUN_DISABLED) != 0))
2910				continue;
2911
2912			for (j = 0; j < (CTL_MAX_PORTS * 2); j++) {
2913				for (k = 0; k < CTL_MAX_INIT_PER_PORT; k++){
2914					if (lun->per_res[j+k].registered == 0)
2915						continue;
2916					printf("LUN %d port %d iid %d key "
2917					       "%#jx\n", i, j, k,
2918					       (uintmax_t)scsi_8btou64(
2919					       lun->per_res[j+k].res_key.key));
2920				}
2921			}
2922		}
2923		printf("CTL Persistent Reservation information end\n");
2924		printf("CTL Frontends:\n");
2925		/*
2926		 * XXX KDM calling this without a lock.  We'd likely want
2927		 * to drop the lock before calling the frontend's dump
2928		 * routine anyway.
2929		 */
2930		STAILQ_FOREACH(fe, &softc->fe_list, links) {
2931			printf("Frontend %s Type %u pport %d vport %d WWNN "
2932			       "%#jx WWPN %#jx\n", fe->port_name, fe->port_type,
2933			       fe->physical_port, fe->virtual_port,
2934			       (uintmax_t)fe->wwnn, (uintmax_t)fe->wwpn);
2935
2936			/*
2937			 * Frontends are not required to support the dump
2938			 * routine.
2939			 */
2940			if (fe->fe_dump == NULL)
2941				continue;
2942
2943			fe->fe_dump();
2944		}
2945		printf("CTL Frontend information end\n");
2946		break;
2947	}
2948	case CTL_LUN_REQ: {
2949		struct ctl_lun_req *lun_req;
2950		struct ctl_backend_driver *backend;
2951
2952		lun_req = (struct ctl_lun_req *)addr;
2953
2954		backend = ctl_backend_find(lun_req->backend);
2955		if (backend == NULL) {
2956			lun_req->status = CTL_LUN_ERROR;
2957			snprintf(lun_req->error_str,
2958				 sizeof(lun_req->error_str),
2959				 "Backend \"%s\" not found.",
2960				 lun_req->backend);
2961			break;
2962		}
2963		if (lun_req->num_be_args > 0) {
2964			lun_req->kern_be_args = ctl_copyin_args(
2965				lun_req->num_be_args,
2966				lun_req->be_args,
2967				lun_req->error_str,
2968				sizeof(lun_req->error_str));
2969			if (lun_req->kern_be_args == NULL) {
2970				lun_req->status = CTL_LUN_ERROR;
2971				break;
2972			}
2973		}
2974
2975		retval = backend->ioctl(dev, cmd, addr, flag, td);
2976
2977		if (lun_req->num_be_args > 0) {
2978			ctl_free_args(lun_req->num_be_args,
2979				      lun_req->kern_be_args);
2980		}
2981		break;
2982	}
2983	case CTL_LUN_LIST: {
2984		struct sbuf *sb;
2985		struct ctl_lun *lun;
2986		struct ctl_lun_list *list;
2987
2988		list = (struct ctl_lun_list *)addr;
2989
2990		/*
2991		 * Allocate a fixed length sbuf here, based on the length
2992		 * of the user's buffer.  We could allocate an auto-extending
2993		 * buffer, and then tell the user how much larger our
2994		 * amount of data is than his buffer, but that presents
2995		 * some problems:
2996		 *
2997		 * 1.  The sbuf(9) routines use a blocking malloc, and so
2998		 *     we can't hold a lock while calling them with an
2999		 *     auto-extending buffer.
3000 		 *
3001		 * 2.  There is not currently a LUN reference counting
3002		 *     mechanism, outside of outstanding transactions on
3003		 *     the LUN's OOA queue.  So a LUN could go away on us
3004		 *     while we're getting the LUN number, backend-specific
3005		 *     information, etc.  Thus, given the way things
3006		 *     currently work, we need to hold the CTL lock while
3007		 *     grabbing LUN information.
3008		 *
3009		 * So, from the user's standpoint, the best thing to do is
3010		 * allocate what he thinks is a reasonable buffer length,
3011		 * and then if he gets a CTL_LUN_LIST_NEED_MORE_SPACE error,
3012		 * double the buffer length and try again.  (And repeat
3013		 * that until he succeeds.)
3014		 */
3015		sb = sbuf_new(NULL, NULL, list->alloc_len, SBUF_FIXEDLEN);
3016		if (sb == NULL) {
3017			list->status = CTL_LUN_LIST_ERROR;
3018			snprintf(list->error_str, sizeof(list->error_str),
3019				 "Unable to allocate %d bytes for LUN list",
3020				 list->alloc_len);
3021			break;
3022		}
3023
3024		sbuf_printf(sb, "<ctllunlist>\n");
3025
3026		mtx_lock(&softc->ctl_lock);
3027
3028		STAILQ_FOREACH(lun, &softc->lun_list, links) {
3029			retval = sbuf_printf(sb, "<lun id=\"%ju\">\n",
3030					     (uintmax_t)lun->lun);
3031
3032			/*
3033			 * Bail out as soon as we see that we've overfilled
3034			 * the buffer.
3035			 */
3036			if (retval != 0)
3037				break;
3038
3039			retval = sbuf_printf(sb, "<backend_type>%s"
3040					     "</backend_type>\n",
3041					     (lun->backend == NULL) ?  "none" :
3042					     lun->backend->name);
3043
3044			if (retval != 0)
3045				break;
3046
3047			retval = sbuf_printf(sb, "<lun_type>%d</lun_type>\n",
3048					     lun->be_lun->lun_type);
3049
3050			if (retval != 0)
3051				break;
3052
3053			if (lun->backend == NULL) {
3054				retval = sbuf_printf(sb, "</lun>\n");
3055				if (retval != 0)
3056					break;
3057				continue;
3058			}
3059
3060			retval = sbuf_printf(sb, "<size>%ju</size>\n",
3061					     (lun->be_lun->maxlba > 0) ?
3062					     lun->be_lun->maxlba + 1 : 0);
3063
3064			if (retval != 0)
3065				break;
3066
3067			retval = sbuf_printf(sb, "<blocksize>%u</blocksize>\n",
3068					     lun->be_lun->blocksize);
3069
3070			if (retval != 0)
3071				break;
3072
3073			retval = sbuf_printf(sb, "<serial_number>");
3074
3075			if (retval != 0)
3076				break;
3077
3078			retval = ctl_sbuf_printf_esc(sb,
3079						     lun->be_lun->serial_num);
3080
3081			if (retval != 0)
3082				break;
3083
3084			retval = sbuf_printf(sb, "</serial_number>\n");
3085
3086			if (retval != 0)
3087				break;
3088
3089			retval = sbuf_printf(sb, "<device_id>");
3090
3091			if (retval != 0)
3092				break;
3093
3094			retval = ctl_sbuf_printf_esc(sb,lun->be_lun->device_id);
3095
3096			if (retval != 0)
3097				break;
3098
3099			retval = sbuf_printf(sb, "</device_id>\n");
3100
3101			if (retval != 0)
3102				break;
3103
3104			if (lun->backend->lun_info == NULL) {
3105				retval = sbuf_printf(sb, "</lun>\n");
3106				if (retval != 0)
3107					break;
3108				continue;
3109			}
3110
3111			retval =lun->backend->lun_info(lun->be_lun->be_lun, sb);
3112
3113			if (retval != 0)
3114				break;
3115
3116			retval = sbuf_printf(sb, "</lun>\n");
3117
3118			if (retval != 0)
3119				break;
3120		}
3121		mtx_unlock(&softc->ctl_lock);
3122
3123		if ((retval != 0)
3124		 || ((retval = sbuf_printf(sb, "</ctllunlist>\n")) != 0)) {
3125			retval = 0;
3126			sbuf_delete(sb);
3127			list->status = CTL_LUN_LIST_NEED_MORE_SPACE;
3128			snprintf(list->error_str, sizeof(list->error_str),
3129				 "Out of space, %d bytes is too small",
3130				 list->alloc_len);
3131			break;
3132		}
3133
3134		sbuf_finish(sb);
3135
3136		retval = copyout(sbuf_data(sb), list->lun_xml,
3137				 sbuf_len(sb) + 1);
3138
3139		list->fill_len = sbuf_len(sb) + 1;
3140		list->status = CTL_LUN_LIST_OK;
3141		sbuf_delete(sb);
3142		break;
3143	}
3144	default: {
3145		/* XXX KDM should we fix this? */
3146#if 0
3147		struct ctl_backend_driver *backend;
3148		unsigned int type;
3149		int found;
3150
3151		found = 0;
3152
3153		/*
3154		 * We encode the backend type as the ioctl type for backend
3155		 * ioctls.  So parse it out here, and then search for a
3156		 * backend of this type.
3157		 */
3158		type = _IOC_TYPE(cmd);
3159
3160		STAILQ_FOREACH(backend, &softc->be_list, links) {
3161			if (backend->type == type) {
3162				found = 1;
3163				break;
3164			}
3165		}
3166		if (found == 0) {
3167			printf("ctl: unknown ioctl command %#lx or backend "
3168			       "%d\n", cmd, type);
3169			retval = -EINVAL;
3170			break;
3171		}
3172		retval = backend->ioctl(dev, cmd, addr, flag, td);
3173#endif
3174		retval = ENOTTY;
3175		break;
3176	}
3177	}
3178	return (retval);
3179}
3180
3181uint32_t
3182ctl_get_initindex(struct ctl_nexus *nexus)
3183{
3184	if (nexus->targ_port < CTL_MAX_PORTS)
3185		return (nexus->initid.id +
3186			(nexus->targ_port * CTL_MAX_INIT_PER_PORT));
3187	else
3188		return (nexus->initid.id +
3189		       ((nexus->targ_port - CTL_MAX_PORTS) *
3190			CTL_MAX_INIT_PER_PORT));
3191}
3192
3193uint32_t
3194ctl_get_resindex(struct ctl_nexus *nexus)
3195{
3196	return (nexus->initid.id + (nexus->targ_port * CTL_MAX_INIT_PER_PORT));
3197}
3198
3199uint32_t
3200ctl_port_idx(int port_num)
3201{
3202	if (port_num < CTL_MAX_PORTS)
3203		return(port_num);
3204	else
3205		return(port_num - CTL_MAX_PORTS);
3206}
3207
3208/*
3209 * Note:  This only works for bitmask sizes that are at least 32 bits, and
3210 * that are a power of 2.
3211 */
3212int
3213ctl_ffz(uint32_t *mask, uint32_t size)
3214{
3215	uint32_t num_chunks, num_pieces;
3216	int i, j;
3217
3218	num_chunks = (size >> 5);
3219	if (num_chunks == 0)
3220		num_chunks++;
3221	num_pieces = ctl_min((sizeof(uint32_t) * 8), size);
3222
3223	for (i = 0; i < num_chunks; i++) {
3224		for (j = 0; j < num_pieces; j++) {
3225			if ((mask[i] & (1 << j)) == 0)
3226				return ((i << 5) + j);
3227		}
3228	}
3229
3230	return (-1);
3231}
3232
3233int
3234ctl_set_mask(uint32_t *mask, uint32_t bit)
3235{
3236	uint32_t chunk, piece;
3237
3238	chunk = bit >> 5;
3239	piece = bit % (sizeof(uint32_t) * 8);
3240
3241	if ((mask[chunk] & (1 << piece)) != 0)
3242		return (-1);
3243	else
3244		mask[chunk] |= (1 << piece);
3245
3246	return (0);
3247}
3248
3249int
3250ctl_clear_mask(uint32_t *mask, uint32_t bit)
3251{
3252	uint32_t chunk, piece;
3253
3254	chunk = bit >> 5;
3255	piece = bit % (sizeof(uint32_t) * 8);
3256
3257	if ((mask[chunk] & (1 << piece)) == 0)
3258		return (-1);
3259	else
3260		mask[chunk] &= ~(1 << piece);
3261
3262	return (0);
3263}
3264
3265int
3266ctl_is_set(uint32_t *mask, uint32_t bit)
3267{
3268	uint32_t chunk, piece;
3269
3270	chunk = bit >> 5;
3271	piece = bit % (sizeof(uint32_t) * 8);
3272
3273	if ((mask[chunk] & (1 << piece)) == 0)
3274		return (0);
3275	else
3276		return (1);
3277}
3278
3279#ifdef unused
3280/*
3281 * The bus, target and lun are optional, they can be filled in later.
3282 * can_wait is used to determine whether we can wait on the malloc or not.
3283 */
3284union ctl_io*
3285ctl_malloc_io(ctl_io_type io_type, uint32_t targ_port, uint32_t targ_target,
3286	      uint32_t targ_lun, int can_wait)
3287{
3288	union ctl_io *io;
3289
3290	if (can_wait)
3291		io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_WAITOK);
3292	else
3293		io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_NOWAIT);
3294
3295	if (io != NULL) {
3296		io->io_hdr.io_type = io_type;
3297		io->io_hdr.targ_port = targ_port;
3298		/*
3299		 * XXX KDM this needs to change/go away.  We need to move
3300		 * to a preallocated pool of ctl_scsiio structures.
3301		 */
3302		io->io_hdr.nexus.targ_target.id = targ_target;
3303		io->io_hdr.nexus.targ_lun = targ_lun;
3304	}
3305
3306	return (io);
3307}
3308
3309void
3310ctl_kfree_io(union ctl_io *io)
3311{
3312	free(io, M_CTL);
3313}
3314#endif /* unused */
3315
3316/*
3317 * ctl_softc, pool_type, total_ctl_io are passed in.
3318 * npool is passed out.
3319 */
3320int
3321ctl_pool_create(struct ctl_softc *ctl_softc, ctl_pool_type pool_type,
3322		uint32_t total_ctl_io, struct ctl_io_pool **npool)
3323{
3324	uint32_t i;
3325	union ctl_io *cur_io, *next_io;
3326	struct ctl_io_pool *pool;
3327	int retval;
3328
3329	retval = 0;
3330
3331	pool = (struct ctl_io_pool *)malloc(sizeof(*pool), M_CTL,
3332					    M_NOWAIT | M_ZERO);
3333	if (pool == NULL) {
3334		retval = -ENOMEM;
3335		goto bailout;
3336	}
3337
3338	pool->type = pool_type;
3339	pool->ctl_softc = ctl_softc;
3340
3341	mtx_lock(&ctl_softc->pool_lock);
3342	pool->id = ctl_softc->cur_pool_id++;
3343	mtx_unlock(&ctl_softc->pool_lock);
3344
3345	pool->flags = CTL_POOL_FLAG_NONE;
3346	pool->refcount = 1;		/* Reference for validity. */
3347	STAILQ_INIT(&pool->free_queue);
3348
3349	/*
3350	 * XXX KDM other options here:
3351	 * - allocate a page at a time
3352	 * - allocate one big chunk of memory.
3353	 * Page allocation might work well, but would take a little more
3354	 * tracking.
3355	 */
3356	for (i = 0; i < total_ctl_io; i++) {
3357		cur_io = (union ctl_io *)malloc(sizeof(*cur_io), M_CTL,
3358						M_NOWAIT);
3359		if (cur_io == NULL) {
3360			retval = ENOMEM;
3361			break;
3362		}
3363		cur_io->io_hdr.pool = pool;
3364		STAILQ_INSERT_TAIL(&pool->free_queue, &cur_io->io_hdr, links);
3365		pool->total_ctl_io++;
3366		pool->free_ctl_io++;
3367	}
3368
3369	if (retval != 0) {
3370		for (cur_io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue);
3371		     cur_io != NULL; cur_io = next_io) {
3372			next_io = (union ctl_io *)STAILQ_NEXT(&cur_io->io_hdr,
3373							      links);
3374			STAILQ_REMOVE(&pool->free_queue, &cur_io->io_hdr,
3375				      ctl_io_hdr, links);
3376			free(cur_io, M_CTL);
3377		}
3378
3379		free(pool, M_CTL);
3380		goto bailout;
3381	}
3382	mtx_lock(&ctl_softc->pool_lock);
3383	ctl_softc->num_pools++;
3384	STAILQ_INSERT_TAIL(&ctl_softc->io_pools, pool, links);
3385	/*
3386	 * Increment our usage count if this is an external consumer, so we
3387	 * can't get unloaded until the external consumer (most likely a
3388	 * FETD) unloads and frees his pool.
3389	 *
3390	 * XXX KDM will this increment the caller's module use count, or
3391	 * mine?
3392	 */
3393#if 0
3394	if ((pool_type != CTL_POOL_EMERGENCY)
3395	 && (pool_type != CTL_POOL_INTERNAL)
3396	 && (pool_type != CTL_POOL_IOCTL)
3397	 && (pool_type != CTL_POOL_4OTHERSC))
3398		MOD_INC_USE_COUNT;
3399#endif
3400
3401	mtx_unlock(&ctl_softc->pool_lock);
3402
3403	*npool = pool;
3404
3405bailout:
3406
3407	return (retval);
3408}
3409
3410static int
3411ctl_pool_acquire(struct ctl_io_pool *pool)
3412{
3413
3414	mtx_assert(&pool->ctl_softc->pool_lock, MA_OWNED);
3415
3416	if (pool->flags & CTL_POOL_FLAG_INVALID)
3417		return (-EINVAL);
3418
3419	pool->refcount++;
3420
3421	return (0);
3422}
3423
3424static void
3425ctl_pool_release(struct ctl_io_pool *pool)
3426{
3427	struct ctl_softc *ctl_softc = pool->ctl_softc;
3428	union ctl_io *io;
3429
3430	mtx_assert(&ctl_softc->pool_lock, MA_OWNED);
3431
3432	if (--pool->refcount != 0)
3433		return;
3434
3435	while ((io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue)) != NULL) {
3436		STAILQ_REMOVE(&pool->free_queue, &io->io_hdr, ctl_io_hdr,
3437			      links);
3438		free(io, M_CTL);
3439	}
3440
3441	STAILQ_REMOVE(&ctl_softc->io_pools, pool, ctl_io_pool, links);
3442	ctl_softc->num_pools--;
3443
3444	/*
3445	 * XXX KDM will this decrement the caller's usage count or mine?
3446	 */
3447#if 0
3448	if ((pool->type != CTL_POOL_EMERGENCY)
3449	 && (pool->type != CTL_POOL_INTERNAL)
3450	 && (pool->type != CTL_POOL_IOCTL))
3451		MOD_DEC_USE_COUNT;
3452#endif
3453
3454	free(pool, M_CTL);
3455}
3456
3457void
3458ctl_pool_free(struct ctl_io_pool *pool)
3459{
3460	struct ctl_softc *ctl_softc;
3461
3462	if (pool == NULL)
3463		return;
3464
3465	ctl_softc = pool->ctl_softc;
3466	mtx_lock(&ctl_softc->pool_lock);
3467	pool->flags |= CTL_POOL_FLAG_INVALID;
3468	ctl_pool_release(pool);
3469	mtx_unlock(&ctl_softc->pool_lock);
3470}
3471
3472/*
3473 * This routine does not block (except for spinlocks of course).
3474 * It tries to allocate a ctl_io union from the caller's pool as quickly as
3475 * possible.
3476 */
3477union ctl_io *
3478ctl_alloc_io(void *pool_ref)
3479{
3480	union ctl_io *io;
3481	struct ctl_softc *ctl_softc;
3482	struct ctl_io_pool *pool, *npool;
3483	struct ctl_io_pool *emergency_pool;
3484
3485	pool = (struct ctl_io_pool *)pool_ref;
3486
3487	if (pool == NULL) {
3488		printf("%s: pool is NULL\n", __func__);
3489		return (NULL);
3490	}
3491
3492	emergency_pool = NULL;
3493
3494	ctl_softc = pool->ctl_softc;
3495
3496	mtx_lock(&ctl_softc->pool_lock);
3497	/*
3498	 * First, try to get the io structure from the user's pool.
3499	 */
3500	if (ctl_pool_acquire(pool) == 0) {
3501		io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue);
3502		if (io != NULL) {
3503			STAILQ_REMOVE_HEAD(&pool->free_queue, links);
3504			pool->total_allocated++;
3505			pool->free_ctl_io--;
3506			mtx_unlock(&ctl_softc->pool_lock);
3507			return (io);
3508		} else
3509			ctl_pool_release(pool);
3510	}
3511	/*
3512	 * If he doesn't have any io structures left, search for an
3513	 * emergency pool and grab one from there.
3514	 */
3515	STAILQ_FOREACH(npool, &ctl_softc->io_pools, links) {
3516		if (npool->type != CTL_POOL_EMERGENCY)
3517			continue;
3518
3519		if (ctl_pool_acquire(npool) != 0)
3520			continue;
3521
3522		emergency_pool = npool;
3523
3524		io = (union ctl_io *)STAILQ_FIRST(&npool->free_queue);
3525		if (io != NULL) {
3526			STAILQ_REMOVE_HEAD(&npool->free_queue, links);
3527			npool->total_allocated++;
3528			npool->free_ctl_io--;
3529			mtx_unlock(&ctl_softc->pool_lock);
3530			return (io);
3531		} else
3532			ctl_pool_release(npool);
3533	}
3534
3535	/* Drop the spinlock before we malloc */
3536	mtx_unlock(&ctl_softc->pool_lock);
3537
3538	/*
3539	 * The emergency pool (if it exists) didn't have one, so try an
3540	 * atomic (i.e. nonblocking) malloc and see if we get lucky.
3541	 */
3542	io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_NOWAIT);
3543	if (io != NULL) {
3544		/*
3545		 * If the emergency pool exists but is empty, add this
3546		 * ctl_io to its list when it gets freed.
3547		 */
3548		if (emergency_pool != NULL) {
3549			mtx_lock(&ctl_softc->pool_lock);
3550			if (ctl_pool_acquire(emergency_pool) == 0) {
3551				io->io_hdr.pool = emergency_pool;
3552				emergency_pool->total_ctl_io++;
3553				/*
3554				 * Need to bump this, otherwise
3555				 * total_allocated and total_freed won't
3556				 * match when we no longer have anything
3557				 * outstanding.
3558				 */
3559				emergency_pool->total_allocated++;
3560			}
3561			mtx_unlock(&ctl_softc->pool_lock);
3562		} else
3563			io->io_hdr.pool = NULL;
3564	}
3565
3566	return (io);
3567}
3568
3569void
3570ctl_free_io(union ctl_io *io)
3571{
3572	if (io == NULL)
3573		return;
3574
3575	/*
3576	 * If this ctl_io has a pool, return it to that pool.
3577	 */
3578	if (io->io_hdr.pool != NULL) {
3579		struct ctl_io_pool *pool;
3580#if 0
3581		struct ctl_softc *ctl_softc;
3582		union ctl_io *tmp_io;
3583		unsigned long xflags;
3584		int i;
3585
3586		ctl_softc = control_softc;
3587#endif
3588
3589		pool = (struct ctl_io_pool *)io->io_hdr.pool;
3590
3591		mtx_lock(&pool->ctl_softc->pool_lock);
3592#if 0
3593		save_flags(xflags);
3594
3595		for (i = 0, tmp_io = (union ctl_io *)STAILQ_FIRST(
3596		     &ctl_softc->task_queue); tmp_io != NULL; i++,
3597		     tmp_io = (union ctl_io *)STAILQ_NEXT(&tmp_io->io_hdr,
3598		     links)) {
3599			if (tmp_io == io) {
3600				printf("%s: %p is still on the task queue!\n",
3601				       __func__, tmp_io);
3602				printf("%s: (%d): type %d "
3603				       "msg %d cdb %x iptl: "
3604				       "%d:%d:%d:%d tag 0x%04x "
3605				       "flg %#lx\n",
3606					__func__, i,
3607					tmp_io->io_hdr.io_type,
3608					tmp_io->io_hdr.msg_type,
3609					tmp_io->scsiio.cdb[0],
3610					tmp_io->io_hdr.nexus.initid.id,
3611					tmp_io->io_hdr.nexus.targ_port,
3612					tmp_io->io_hdr.nexus.targ_target.id,
3613					tmp_io->io_hdr.nexus.targ_lun,
3614					(tmp_io->io_hdr.io_type ==
3615					CTL_IO_TASK) ?
3616					tmp_io->taskio.tag_num :
3617					tmp_io->scsiio.tag_num,
3618					xflags);
3619				panic("I/O still on the task queue!");
3620			}
3621		}
3622#endif
3623		io->io_hdr.io_type = 0xff;
3624		STAILQ_INSERT_TAIL(&pool->free_queue, &io->io_hdr, links);
3625		pool->total_freed++;
3626		pool->free_ctl_io++;
3627		ctl_pool_release(pool);
3628		mtx_unlock(&pool->ctl_softc->pool_lock);
3629	} else {
3630		/*
3631		 * Otherwise, just free it.  We probably malloced it and
3632		 * the emergency pool wasn't available.
3633		 */
3634		free(io, M_CTL);
3635	}
3636
3637}
3638
3639void
3640ctl_zero_io(union ctl_io *io)
3641{
3642	void *pool_ref;
3643
3644	if (io == NULL)
3645		return;
3646
3647	/*
3648	 * May need to preserve linked list pointers at some point too.
3649	 */
3650	pool_ref = io->io_hdr.pool;
3651
3652	memset(io, 0, sizeof(*io));
3653
3654	io->io_hdr.pool = pool_ref;
3655}
3656
3657/*
3658 * This routine is currently used for internal copies of ctl_ios that need
3659 * to persist for some reason after we've already returned status to the
3660 * FETD.  (Thus the flag set.)
3661 *
3662 * XXX XXX
3663 * Note that this makes a blind copy of all fields in the ctl_io, except
3664 * for the pool reference.  This includes any memory that has been
3665 * allocated!  That memory will no longer be valid after done has been
3666 * called, so this would be VERY DANGEROUS for command that actually does
3667 * any reads or writes.  Right now (11/7/2005), this is only used for immediate
3668 * start and stop commands, which don't transfer any data, so this is not a
3669 * problem.  If it is used for anything else, the caller would also need to
3670 * allocate data buffer space and this routine would need to be modified to
3671 * copy the data buffer(s) as well.
3672 */
3673void
3674ctl_copy_io(union ctl_io *src, union ctl_io *dest)
3675{
3676	void *pool_ref;
3677
3678	if ((src == NULL)
3679	 || (dest == NULL))
3680		return;
3681
3682	/*
3683	 * May need to preserve linked list pointers at some point too.
3684	 */
3685	pool_ref = dest->io_hdr.pool;
3686
3687	memcpy(dest, src, ctl_min(sizeof(*src), sizeof(*dest)));
3688
3689	dest->io_hdr.pool = pool_ref;
3690	/*
3691	 * We need to know that this is an internal copy, and doesn't need
3692	 * to get passed back to the FETD that allocated it.
3693	 */
3694	dest->io_hdr.flags |= CTL_FLAG_INT_COPY;
3695}
3696
3697#ifdef NEEDTOPORT
3698static void
3699ctl_update_power_subpage(struct copan_power_subpage *page)
3700{
3701	int num_luns, num_partitions, config_type;
3702	struct ctl_softc *softc;
3703	cs_BOOL_t aor_present, shelf_50pct_power;
3704	cs_raidset_personality_t rs_type;
3705	int max_active_luns;
3706
3707	softc = control_softc;
3708
3709	/* subtract out the processor LUN */
3710	num_luns = softc->num_luns - 1;
3711	/*
3712	 * Default to 7 LUNs active, which was the only number we allowed
3713	 * in the past.
3714	 */
3715	max_active_luns = 7;
3716
3717	num_partitions = config_GetRsPartitionInfo();
3718	config_type = config_GetConfigType();
3719	shelf_50pct_power = config_GetShelfPowerMode();
3720	aor_present = config_IsAorRsPresent();
3721
3722	rs_type = ddb_GetRsRaidType(1);
3723	if ((rs_type != CS_RAIDSET_PERSONALITY_RAID5)
3724	 && (rs_type != CS_RAIDSET_PERSONALITY_RAID1)) {
3725		EPRINT(0, "Unsupported RS type %d!", rs_type);
3726	}
3727
3728
3729	page->total_luns = num_luns;
3730
3731	switch (config_type) {
3732	case 40:
3733		/*
3734		 * In a 40 drive configuration, it doesn't matter what DC
3735		 * cards we have, whether we have AOR enabled or not,
3736		 * partitioning or not, or what type of RAIDset we have.
3737		 * In that scenario, we can power up every LUN we present
3738		 * to the user.
3739		 */
3740		max_active_luns = num_luns;
3741
3742		break;
3743	case 64:
3744		if (shelf_50pct_power == CS_FALSE) {
3745			/* 25% power */
3746			if (aor_present == CS_TRUE) {
3747				if (rs_type ==
3748				     CS_RAIDSET_PERSONALITY_RAID5) {
3749					max_active_luns = 7;
3750				} else if (rs_type ==
3751					 CS_RAIDSET_PERSONALITY_RAID1){
3752					max_active_luns = 14;
3753				} else {
3754					/* XXX KDM now what?? */
3755				}
3756			} else {
3757				if (rs_type ==
3758				     CS_RAIDSET_PERSONALITY_RAID5) {
3759					max_active_luns = 8;
3760				} else if (rs_type ==
3761					 CS_RAIDSET_PERSONALITY_RAID1){
3762					max_active_luns = 16;
3763				} else {
3764					/* XXX KDM now what?? */
3765				}
3766			}
3767		} else {
3768			/* 50% power */
3769			/*
3770			 * With 50% power in a 64 drive configuration, we
3771			 * can power all LUNs we present.
3772			 */
3773			max_active_luns = num_luns;
3774		}
3775		break;
3776	case 112:
3777		if (shelf_50pct_power == CS_FALSE) {
3778			/* 25% power */
3779			if (aor_present == CS_TRUE) {
3780				if (rs_type ==
3781				     CS_RAIDSET_PERSONALITY_RAID5) {
3782					max_active_luns = 7;
3783				} else if (rs_type ==
3784					 CS_RAIDSET_PERSONALITY_RAID1){
3785					max_active_luns = 14;
3786				} else {
3787					/* XXX KDM now what?? */
3788				}
3789			} else {
3790				if (rs_type ==
3791				     CS_RAIDSET_PERSONALITY_RAID5) {
3792					max_active_luns = 8;
3793				} else if (rs_type ==
3794					 CS_RAIDSET_PERSONALITY_RAID1){
3795					max_active_luns = 16;
3796				} else {
3797					/* XXX KDM now what?? */
3798				}
3799			}
3800		} else {
3801			/* 50% power */
3802			if (aor_present == CS_TRUE) {
3803				if (rs_type ==
3804				     CS_RAIDSET_PERSONALITY_RAID5) {
3805					max_active_luns = 14;
3806				} else if (rs_type ==
3807					 CS_RAIDSET_PERSONALITY_RAID1){
3808					/*
3809					 * We're assuming here that disk
3810					 * caching is enabled, and so we're
3811					 * able to power up half of each
3812					 * LUN, and cache all writes.
3813					 */
3814					max_active_luns = num_luns;
3815				} else {
3816					/* XXX KDM now what?? */
3817				}
3818			} else {
3819				if (rs_type ==
3820				     CS_RAIDSET_PERSONALITY_RAID5) {
3821					max_active_luns = 15;
3822				} else if (rs_type ==
3823					 CS_RAIDSET_PERSONALITY_RAID1){
3824					max_active_luns = 30;
3825				} else {
3826					/* XXX KDM now what?? */
3827				}
3828			}
3829		}
3830		break;
3831	default:
3832		/*
3833		 * In this case, we have an unknown configuration, so we
3834		 * just use the default from above.
3835		 */
3836		break;
3837	}
3838
3839	page->max_active_luns = max_active_luns;
3840#if 0
3841	printk("%s: total_luns = %d, max_active_luns = %d\n", __func__,
3842	       page->total_luns, page->max_active_luns);
3843#endif
3844}
3845#endif /* NEEDTOPORT */
3846
3847/*
3848 * This routine could be used in the future to load default and/or saved
3849 * mode page parameters for a particuar lun.
3850 */
3851static int
3852ctl_init_page_index(struct ctl_lun *lun)
3853{
3854	int i;
3855	struct ctl_page_index *page_index;
3856	struct ctl_softc *softc;
3857
3858	memcpy(&lun->mode_pages.index, page_index_template,
3859	       sizeof(page_index_template));
3860
3861	softc = lun->ctl_softc;
3862
3863	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
3864
3865		page_index = &lun->mode_pages.index[i];
3866		/*
3867		 * If this is a disk-only mode page, there's no point in
3868		 * setting it up.  For some pages, we have to have some
3869		 * basic information about the disk in order to calculate the
3870		 * mode page data.
3871		 */
3872		if ((lun->be_lun->lun_type != T_DIRECT)
3873		 && (page_index->page_flags & CTL_PAGE_FLAG_DISK_ONLY))
3874			continue;
3875
3876		switch (page_index->page_code & SMPH_PC_MASK) {
3877		case SMS_FORMAT_DEVICE_PAGE: {
3878			struct scsi_format_page *format_page;
3879
3880			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
3881				panic("subpage is incorrect!");
3882
3883			/*
3884			 * Sectors per track are set above.  Bytes per
3885			 * sector need to be set here on a per-LUN basis.
3886			 */
3887			memcpy(&lun->mode_pages.format_page[CTL_PAGE_CURRENT],
3888			       &format_page_default,
3889			       sizeof(format_page_default));
3890			memcpy(&lun->mode_pages.format_page[
3891			       CTL_PAGE_CHANGEABLE], &format_page_changeable,
3892			       sizeof(format_page_changeable));
3893			memcpy(&lun->mode_pages.format_page[CTL_PAGE_DEFAULT],
3894			       &format_page_default,
3895			       sizeof(format_page_default));
3896			memcpy(&lun->mode_pages.format_page[CTL_PAGE_SAVED],
3897			       &format_page_default,
3898			       sizeof(format_page_default));
3899
3900			format_page = &lun->mode_pages.format_page[
3901				CTL_PAGE_CURRENT];
3902			scsi_ulto2b(lun->be_lun->blocksize,
3903				    format_page->bytes_per_sector);
3904
3905			format_page = &lun->mode_pages.format_page[
3906				CTL_PAGE_DEFAULT];
3907			scsi_ulto2b(lun->be_lun->blocksize,
3908				    format_page->bytes_per_sector);
3909
3910			format_page = &lun->mode_pages.format_page[
3911				CTL_PAGE_SAVED];
3912			scsi_ulto2b(lun->be_lun->blocksize,
3913				    format_page->bytes_per_sector);
3914
3915			page_index->page_data =
3916				(uint8_t *)lun->mode_pages.format_page;
3917			break;
3918		}
3919		case SMS_RIGID_DISK_PAGE: {
3920			struct scsi_rigid_disk_page *rigid_disk_page;
3921			uint32_t sectors_per_cylinder;
3922			uint64_t cylinders;
3923#ifndef	__XSCALE__
3924			int shift;
3925#endif /* !__XSCALE__ */
3926
3927			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
3928				panic("invalid subpage value %d",
3929				      page_index->subpage);
3930
3931			/*
3932			 * Rotation rate and sectors per track are set
3933			 * above.  We calculate the cylinders here based on
3934			 * capacity.  Due to the number of heads and
3935			 * sectors per track we're using, smaller arrays
3936			 * may turn out to have 0 cylinders.  Linux and
3937			 * FreeBSD don't pay attention to these mode pages
3938			 * to figure out capacity, but Solaris does.  It
3939			 * seems to deal with 0 cylinders just fine, and
3940			 * works out a fake geometry based on the capacity.
3941			 */
3942			memcpy(&lun->mode_pages.rigid_disk_page[
3943			       CTL_PAGE_CURRENT], &rigid_disk_page_default,
3944			       sizeof(rigid_disk_page_default));
3945			memcpy(&lun->mode_pages.rigid_disk_page[
3946			       CTL_PAGE_CHANGEABLE],&rigid_disk_page_changeable,
3947			       sizeof(rigid_disk_page_changeable));
3948			memcpy(&lun->mode_pages.rigid_disk_page[
3949			       CTL_PAGE_DEFAULT], &rigid_disk_page_default,
3950			       sizeof(rigid_disk_page_default));
3951			memcpy(&lun->mode_pages.rigid_disk_page[
3952			       CTL_PAGE_SAVED], &rigid_disk_page_default,
3953			       sizeof(rigid_disk_page_default));
3954
3955			sectors_per_cylinder = CTL_DEFAULT_SECTORS_PER_TRACK *
3956				CTL_DEFAULT_HEADS;
3957
3958			/*
3959			 * The divide method here will be more accurate,
3960			 * probably, but results in floating point being
3961			 * used in the kernel on i386 (__udivdi3()).  On the
3962			 * XScale, though, __udivdi3() is implemented in
3963			 * software.
3964			 *
3965			 * The shift method for cylinder calculation is
3966			 * accurate if sectors_per_cylinder is a power of
3967			 * 2.  Otherwise it might be slightly off -- you
3968			 * might have a bit of a truncation problem.
3969			 */
3970#ifdef	__XSCALE__
3971			cylinders = (lun->be_lun->maxlba + 1) /
3972				sectors_per_cylinder;
3973#else
3974			for (shift = 31; shift > 0; shift--) {
3975				if (sectors_per_cylinder & (1 << shift))
3976					break;
3977			}
3978			cylinders = (lun->be_lun->maxlba + 1) >> shift;
3979#endif
3980
3981			/*
3982			 * We've basically got 3 bytes, or 24 bits for the
3983			 * cylinder size in the mode page.  If we're over,
3984			 * just round down to 2^24.
3985			 */
3986			if (cylinders > 0xffffff)
3987				cylinders = 0xffffff;
3988
3989			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
3990				CTL_PAGE_CURRENT];
3991			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
3992
3993			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
3994				CTL_PAGE_DEFAULT];
3995			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
3996
3997			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
3998				CTL_PAGE_SAVED];
3999			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
4000
4001			page_index->page_data =
4002				(uint8_t *)lun->mode_pages.rigid_disk_page;
4003			break;
4004		}
4005		case SMS_CACHING_PAGE: {
4006
4007			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
4008				panic("invalid subpage value %d",
4009				      page_index->subpage);
4010			/*
4011			 * Defaults should be okay here, no calculations
4012			 * needed.
4013			 */
4014			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_CURRENT],
4015			       &caching_page_default,
4016			       sizeof(caching_page_default));
4017			memcpy(&lun->mode_pages.caching_page[
4018			       CTL_PAGE_CHANGEABLE], &caching_page_changeable,
4019			       sizeof(caching_page_changeable));
4020			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_DEFAULT],
4021			       &caching_page_default,
4022			       sizeof(caching_page_default));
4023			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_SAVED],
4024			       &caching_page_default,
4025			       sizeof(caching_page_default));
4026			page_index->page_data =
4027				(uint8_t *)lun->mode_pages.caching_page;
4028			break;
4029		}
4030		case SMS_CONTROL_MODE_PAGE: {
4031
4032			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
4033				panic("invalid subpage value %d",
4034				      page_index->subpage);
4035
4036			/*
4037			 * Defaults should be okay here, no calculations
4038			 * needed.
4039			 */
4040			memcpy(&lun->mode_pages.control_page[CTL_PAGE_CURRENT],
4041			       &control_page_default,
4042			       sizeof(control_page_default));
4043			memcpy(&lun->mode_pages.control_page[
4044			       CTL_PAGE_CHANGEABLE], &control_page_changeable,
4045			       sizeof(control_page_changeable));
4046			memcpy(&lun->mode_pages.control_page[CTL_PAGE_DEFAULT],
4047			       &control_page_default,
4048			       sizeof(control_page_default));
4049			memcpy(&lun->mode_pages.control_page[CTL_PAGE_SAVED],
4050			       &control_page_default,
4051			       sizeof(control_page_default));
4052			page_index->page_data =
4053				(uint8_t *)lun->mode_pages.control_page;
4054			break;
4055
4056		}
4057		case SMS_VENDOR_SPECIFIC_PAGE:{
4058			switch (page_index->subpage) {
4059			case PWR_SUBPAGE_CODE: {
4060				struct copan_power_subpage *current_page,
4061							   *saved_page;
4062
4063				memcpy(&lun->mode_pages.power_subpage[
4064				       CTL_PAGE_CURRENT],
4065				       &power_page_default,
4066				       sizeof(power_page_default));
4067				memcpy(&lun->mode_pages.power_subpage[
4068				       CTL_PAGE_CHANGEABLE],
4069				       &power_page_changeable,
4070				       sizeof(power_page_changeable));
4071				memcpy(&lun->mode_pages.power_subpage[
4072				       CTL_PAGE_DEFAULT],
4073				       &power_page_default,
4074				       sizeof(power_page_default));
4075				memcpy(&lun->mode_pages.power_subpage[
4076				       CTL_PAGE_SAVED],
4077				       &power_page_default,
4078				       sizeof(power_page_default));
4079				page_index->page_data =
4080				    (uint8_t *)lun->mode_pages.power_subpage;
4081
4082				current_page = (struct copan_power_subpage *)
4083					(page_index->page_data +
4084					 (page_index->page_len *
4085					  CTL_PAGE_CURRENT));
4086			        saved_page = (struct copan_power_subpage *)
4087				        (page_index->page_data +
4088					 (page_index->page_len *
4089					  CTL_PAGE_SAVED));
4090				break;
4091			}
4092			case APS_SUBPAGE_CODE: {
4093				struct copan_aps_subpage *current_page,
4094							 *saved_page;
4095
4096				// This gets set multiple times but
4097				// it should always be the same. It's
4098				// only done during init so who cares.
4099				index_to_aps_page = i;
4100
4101				memcpy(&lun->mode_pages.aps_subpage[
4102				       CTL_PAGE_CURRENT],
4103				       &aps_page_default,
4104				       sizeof(aps_page_default));
4105				memcpy(&lun->mode_pages.aps_subpage[
4106				       CTL_PAGE_CHANGEABLE],
4107				       &aps_page_changeable,
4108				       sizeof(aps_page_changeable));
4109				memcpy(&lun->mode_pages.aps_subpage[
4110				       CTL_PAGE_DEFAULT],
4111				       &aps_page_default,
4112				       sizeof(aps_page_default));
4113				memcpy(&lun->mode_pages.aps_subpage[
4114				       CTL_PAGE_SAVED],
4115				       &aps_page_default,
4116				       sizeof(aps_page_default));
4117				page_index->page_data =
4118					(uint8_t *)lun->mode_pages.aps_subpage;
4119
4120				current_page = (struct copan_aps_subpage *)
4121					(page_index->page_data +
4122					 (page_index->page_len *
4123					  CTL_PAGE_CURRENT));
4124				saved_page = (struct copan_aps_subpage *)
4125					(page_index->page_data +
4126					 (page_index->page_len *
4127					  CTL_PAGE_SAVED));
4128				break;
4129			}
4130			case DBGCNF_SUBPAGE_CODE: {
4131				struct copan_debugconf_subpage *current_page,
4132							       *saved_page;
4133
4134				memcpy(&lun->mode_pages.debugconf_subpage[
4135				       CTL_PAGE_CURRENT],
4136				       &debugconf_page_default,
4137				       sizeof(debugconf_page_default));
4138				memcpy(&lun->mode_pages.debugconf_subpage[
4139				       CTL_PAGE_CHANGEABLE],
4140				       &debugconf_page_changeable,
4141				       sizeof(debugconf_page_changeable));
4142				memcpy(&lun->mode_pages.debugconf_subpage[
4143				       CTL_PAGE_DEFAULT],
4144				       &debugconf_page_default,
4145				       sizeof(debugconf_page_default));
4146				memcpy(&lun->mode_pages.debugconf_subpage[
4147				       CTL_PAGE_SAVED],
4148				       &debugconf_page_default,
4149				       sizeof(debugconf_page_default));
4150				page_index->page_data =
4151					(uint8_t *)lun->mode_pages.debugconf_subpage;
4152
4153				current_page = (struct copan_debugconf_subpage *)
4154					(page_index->page_data +
4155					 (page_index->page_len *
4156					  CTL_PAGE_CURRENT));
4157				saved_page = (struct copan_debugconf_subpage *)
4158					(page_index->page_data +
4159					 (page_index->page_len *
4160					  CTL_PAGE_SAVED));
4161				break;
4162			}
4163			default:
4164				panic("invalid subpage value %d",
4165				      page_index->subpage);
4166				break;
4167			}
4168   			break;
4169		}
4170		default:
4171			panic("invalid page value %d",
4172			      page_index->page_code & SMPH_PC_MASK);
4173			break;
4174    	}
4175	}
4176
4177	return (CTL_RETVAL_COMPLETE);
4178}
4179
4180/*
4181 * LUN allocation.
4182 *
4183 * Requirements:
4184 * - caller allocates and zeros LUN storage, or passes in a NULL LUN if he
4185 *   wants us to allocate the LUN and he can block.
4186 * - ctl_softc is always set
4187 * - be_lun is set if the LUN has a backend (needed for disk LUNs)
4188 *
4189 * Returns 0 for success, non-zero (errno) for failure.
4190 */
4191static int
4192ctl_alloc_lun(struct ctl_softc *ctl_softc, struct ctl_lun *ctl_lun,
4193	      struct ctl_be_lun *const be_lun, struct ctl_id target_id)
4194{
4195	struct ctl_lun *nlun, *lun;
4196	struct ctl_frontend *fe;
4197	int lun_number, i, lun_malloced;
4198
4199	if (be_lun == NULL)
4200		return (EINVAL);
4201
4202	/*
4203	 * We currently only support Direct Access or Processor LUN types.
4204	 */
4205	switch (be_lun->lun_type) {
4206	case T_DIRECT:
4207		break;
4208	case T_PROCESSOR:
4209		break;
4210	case T_SEQUENTIAL:
4211	case T_CHANGER:
4212	default:
4213		be_lun->lun_config_status(be_lun->be_lun,
4214					  CTL_LUN_CONFIG_FAILURE);
4215		break;
4216	}
4217	if (ctl_lun == NULL) {
4218		lun = malloc(sizeof(*lun), M_CTL, M_WAITOK);
4219		lun_malloced = 1;
4220	} else {
4221		lun_malloced = 0;
4222		lun = ctl_lun;
4223	}
4224
4225	memset(lun, 0, sizeof(*lun));
4226	if (lun_malloced)
4227		lun->flags = CTL_LUN_MALLOCED;
4228
4229	mtx_lock(&ctl_softc->ctl_lock);
4230	/*
4231	 * See if the caller requested a particular LUN number.  If so, see
4232	 * if it is available.  Otherwise, allocate the first available LUN.
4233	 */
4234	if (be_lun->flags & CTL_LUN_FLAG_ID_REQ) {
4235		if ((be_lun->req_lun_id > (CTL_MAX_LUNS - 1))
4236		 || (ctl_is_set(ctl_softc->ctl_lun_mask, be_lun->req_lun_id))) {
4237			mtx_unlock(&ctl_softc->ctl_lock);
4238			if (be_lun->req_lun_id > (CTL_MAX_LUNS - 1)) {
4239				printf("ctl: requested LUN ID %d is higher "
4240				       "than CTL_MAX_LUNS - 1 (%d)\n",
4241				       be_lun->req_lun_id, CTL_MAX_LUNS - 1);
4242			} else {
4243				/*
4244				 * XXX KDM return an error, or just assign
4245				 * another LUN ID in this case??
4246				 */
4247				printf("ctl: requested LUN ID %d is already "
4248				       "in use\n", be_lun->req_lun_id);
4249			}
4250			if (lun->flags & CTL_LUN_MALLOCED)
4251				free(lun, M_CTL);
4252			be_lun->lun_config_status(be_lun->be_lun,
4253						  CTL_LUN_CONFIG_FAILURE);
4254			return (ENOSPC);
4255		}
4256		lun_number = be_lun->req_lun_id;
4257	} else {
4258		lun_number = ctl_ffz(ctl_softc->ctl_lun_mask, CTL_MAX_LUNS);
4259		if (lun_number == -1) {
4260			mtx_unlock(&ctl_softc->ctl_lock);
4261			printf("ctl: can't allocate LUN on target %ju, out of "
4262			       "LUNs\n", (uintmax_t)target_id.id);
4263			if (lun->flags & CTL_LUN_MALLOCED)
4264				free(lun, M_CTL);
4265			be_lun->lun_config_status(be_lun->be_lun,
4266						  CTL_LUN_CONFIG_FAILURE);
4267			return (ENOSPC);
4268		}
4269	}
4270	ctl_set_mask(ctl_softc->ctl_lun_mask, lun_number);
4271
4272	lun->target = target_id;
4273	lun->lun = lun_number;
4274	lun->be_lun = be_lun;
4275	/*
4276	 * The processor LUN is always enabled.  Disk LUNs come on line
4277	 * disabled, and must be enabled by the backend.
4278	 */
4279	lun->flags |= CTL_LUN_DISABLED;
4280	lun->backend = be_lun->be;
4281	be_lun->ctl_lun = lun;
4282	be_lun->lun_id = lun_number;
4283	atomic_add_int(&be_lun->be->num_luns, 1);
4284	if (be_lun->flags & CTL_LUN_FLAG_POWERED_OFF)
4285		lun->flags |= CTL_LUN_STOPPED;
4286
4287	if (be_lun->flags & CTL_LUN_FLAG_INOPERABLE)
4288		lun->flags |= CTL_LUN_INOPERABLE;
4289
4290	if (be_lun->flags & CTL_LUN_FLAG_PRIMARY)
4291		lun->flags |= CTL_LUN_PRIMARY_SC;
4292
4293	lun->ctl_softc = ctl_softc;
4294	TAILQ_INIT(&lun->ooa_queue);
4295	TAILQ_INIT(&lun->blocked_queue);
4296	STAILQ_INIT(&lun->error_list);
4297
4298	/*
4299	 * Initialize the mode page index.
4300	 */
4301	ctl_init_page_index(lun);
4302
4303	/*
4304	 * Set the poweron UA for all initiators on this LUN only.
4305	 */
4306	for (i = 0; i < CTL_MAX_INITIATORS; i++)
4307		lun->pending_sense[i].ua_pending = CTL_UA_POWERON;
4308
4309	/*
4310	 * Now, before we insert this lun on the lun list, set the lun
4311	 * inventory changed UA for all other luns.
4312	 */
4313	STAILQ_FOREACH(nlun, &ctl_softc->lun_list, links) {
4314		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
4315			nlun->pending_sense[i].ua_pending |= CTL_UA_LUN_CHANGE;
4316		}
4317	}
4318
4319	STAILQ_INSERT_TAIL(&ctl_softc->lun_list, lun, links);
4320
4321	ctl_softc->ctl_luns[lun_number] = lun;
4322
4323	ctl_softc->num_luns++;
4324
4325	/* Setup statistics gathering */
4326	lun->stats.device_type = be_lun->lun_type;
4327	lun->stats.lun_number = lun_number;
4328	if (lun->stats.device_type == T_DIRECT)
4329		lun->stats.blocksize = be_lun->blocksize;
4330	else
4331		lun->stats.flags = CTL_LUN_STATS_NO_BLOCKSIZE;
4332	for (i = 0;i < CTL_MAX_PORTS;i++)
4333		lun->stats.ports[i].targ_port = i;
4334
4335	mtx_unlock(&ctl_softc->ctl_lock);
4336
4337	lun->be_lun->lun_config_status(lun->be_lun->be_lun, CTL_LUN_CONFIG_OK);
4338
4339	/*
4340	 * Run through each registered FETD and bring it online if it isn't
4341	 * already.  Enable the target ID if it hasn't been enabled, and
4342	 * enable this particular LUN.
4343	 */
4344	STAILQ_FOREACH(fe, &ctl_softc->fe_list, links) {
4345		int retval;
4346
4347		/*
4348		 * XXX KDM this only works for ONE TARGET ID.  We'll need
4349		 * to do things differently if we go to a multiple target
4350		 * ID scheme.
4351		 */
4352		if ((fe->status & CTL_PORT_STATUS_TARG_ONLINE) == 0) {
4353
4354			retval = fe->targ_enable(fe->targ_lun_arg, target_id);
4355			if (retval != 0) {
4356				printf("ctl_alloc_lun: FETD %s port %d "
4357				       "returned error %d for targ_enable on "
4358				       "target %ju\n", fe->port_name,
4359				       fe->targ_port, retval,
4360				       (uintmax_t)target_id.id);
4361			} else
4362				fe->status |= CTL_PORT_STATUS_TARG_ONLINE;
4363		}
4364
4365		retval = fe->lun_enable(fe->targ_lun_arg, target_id,lun_number);
4366		if (retval != 0) {
4367			printf("ctl_alloc_lun: FETD %s port %d returned error "
4368			       "%d for lun_enable on target %ju lun %d\n",
4369			       fe->port_name, fe->targ_port, retval,
4370			       (uintmax_t)target_id.id, lun_number);
4371		} else
4372			fe->status |= CTL_PORT_STATUS_LUN_ONLINE;
4373	}
4374	return (0);
4375}
4376
4377/*
4378 * Delete a LUN.
4379 * Assumptions:
4380 * - LUN has already been marked invalid and any pending I/O has been taken
4381 *   care of.
4382 */
4383static int
4384ctl_free_lun(struct ctl_lun *lun)
4385{
4386	struct ctl_softc *softc;
4387#if 0
4388	struct ctl_frontend *fe;
4389#endif
4390	struct ctl_lun *nlun;
4391	union ctl_io *io, *next_io;
4392	int i;
4393
4394	softc = lun->ctl_softc;
4395
4396	mtx_assert(&softc->ctl_lock, MA_OWNED);
4397
4398	STAILQ_REMOVE(&softc->lun_list, lun, ctl_lun, links);
4399
4400	ctl_clear_mask(softc->ctl_lun_mask, lun->lun);
4401
4402	softc->ctl_luns[lun->lun] = NULL;
4403
4404	if (TAILQ_FIRST(&lun->ooa_queue) != NULL) {
4405		printf("ctl_free_lun: aieee!! freeing a LUN with "
4406		       "outstanding I/O!!\n");
4407	}
4408
4409	/*
4410	 * If we have anything pending on the RtR queue, remove it.
4411	 */
4412	for (io = (union ctl_io *)STAILQ_FIRST(&softc->rtr_queue); io != NULL;
4413	     io = next_io) {
4414		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
4415		if ((io->io_hdr.nexus.targ_target.id == lun->target.id)
4416		 && (io->io_hdr.nexus.targ_lun == lun->lun))
4417			STAILQ_REMOVE(&softc->rtr_queue, &io->io_hdr,
4418				      ctl_io_hdr, links);
4419	}
4420
4421	/*
4422	 * Then remove everything from the blocked queue.
4423	 */
4424	for (io = (union ctl_io *)TAILQ_FIRST(&lun->blocked_queue); io != NULL;
4425	     io = next_io) {
4426		next_io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,blocked_links);
4427		TAILQ_REMOVE(&lun->blocked_queue, &io->io_hdr, blocked_links);
4428		io->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
4429	}
4430
4431	/*
4432	 * Now clear out the OOA queue, and free all the I/O.
4433	 * XXX KDM should we notify the FETD here?  We probably need to
4434	 * quiesce the LUN before deleting it.
4435	 */
4436	for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); io != NULL;
4437	     io = next_io) {
4438		next_io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr, ooa_links);
4439		TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr, ooa_links);
4440		ctl_free_io(io);
4441	}
4442
4443	softc->num_luns--;
4444
4445	/*
4446	 * XXX KDM this scheme only works for a single target/multiple LUN
4447	 * setup.  It needs to be revamped for a multiple target scheme.
4448	 *
4449	 * XXX KDM this results in fe->lun_disable() getting called twice,
4450	 * once when ctl_disable_lun() is called, and a second time here.
4451	 * We really need to re-think the LUN disable semantics.  There
4452	 * should probably be several steps/levels to LUN removal:
4453	 *  - disable
4454	 *  - invalidate
4455	 *  - free
4456 	 *
4457	 * Right now we only have a disable method when communicating to
4458	 * the front end ports, at least for individual LUNs.
4459	 */
4460#if 0
4461	STAILQ_FOREACH(fe, &softc->fe_list, links) {
4462		int retval;
4463
4464		retval = fe->lun_disable(fe->targ_lun_arg, lun->target,
4465					 lun->lun);
4466		if (retval != 0) {
4467			printf("ctl_free_lun: FETD %s port %d returned error "
4468			       "%d for lun_disable on target %ju lun %jd\n",
4469			       fe->port_name, fe->targ_port, retval,
4470			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
4471		}
4472
4473		if (STAILQ_FIRST(&softc->lun_list) == NULL) {
4474			fe->status &= ~CTL_PORT_STATUS_LUN_ONLINE;
4475
4476			retval = fe->targ_disable(fe->targ_lun_arg,lun->target);
4477			if (retval != 0) {
4478				printf("ctl_free_lun: FETD %s port %d "
4479				       "returned error %d for targ_disable on "
4480				       "target %ju\n", fe->port_name,
4481				       fe->targ_port, retval,
4482				       (uintmax_t)lun->target.id);
4483			} else
4484				fe->status &= ~CTL_PORT_STATUS_TARG_ONLINE;
4485
4486			if ((fe->status & CTL_PORT_STATUS_TARG_ONLINE) != 0)
4487				continue;
4488
4489#if 0
4490			fe->port_offline(fe->onoff_arg);
4491			fe->status &= ~CTL_PORT_STATUS_ONLINE;
4492#endif
4493		}
4494	}
4495#endif
4496
4497	/*
4498	 * Tell the backend to free resources, if this LUN has a backend.
4499	 */
4500	atomic_subtract_int(&lun->be_lun->be->num_luns, 1);
4501	lun->be_lun->lun_shutdown(lun->be_lun->be_lun);
4502
4503	if (lun->flags & CTL_LUN_MALLOCED)
4504		free(lun, M_CTL);
4505
4506	STAILQ_FOREACH(nlun, &softc->lun_list, links) {
4507		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
4508			nlun->pending_sense[i].ua_pending |= CTL_UA_LUN_CHANGE;
4509		}
4510	}
4511
4512	return (0);
4513}
4514
4515static void
4516ctl_create_lun(struct ctl_be_lun *be_lun)
4517{
4518	struct ctl_softc *ctl_softc;
4519
4520	ctl_softc = control_softc;
4521
4522	/*
4523	 * ctl_alloc_lun() should handle all potential failure cases.
4524	 */
4525	ctl_alloc_lun(ctl_softc, NULL, be_lun, ctl_softc->target);
4526}
4527
4528int
4529ctl_add_lun(struct ctl_be_lun *be_lun)
4530{
4531	struct ctl_softc *ctl_softc;
4532
4533	ctl_softc = control_softc;
4534
4535	mtx_lock(&ctl_softc->ctl_lock);
4536	STAILQ_INSERT_TAIL(&ctl_softc->pending_lun_queue, be_lun, links);
4537	mtx_unlock(&ctl_softc->ctl_lock);
4538
4539	ctl_wakeup_thread();
4540
4541	return (0);
4542}
4543
4544int
4545ctl_enable_lun(struct ctl_be_lun *be_lun)
4546{
4547	struct ctl_softc *ctl_softc;
4548	struct ctl_frontend *fe, *nfe;
4549	struct ctl_lun *lun;
4550	int retval;
4551
4552	ctl_softc = control_softc;
4553
4554	lun = (struct ctl_lun *)be_lun->ctl_lun;
4555
4556	mtx_lock(&ctl_softc->ctl_lock);
4557	if ((lun->flags & CTL_LUN_DISABLED) == 0) {
4558		/*
4559		 * eh?  Why did we get called if the LUN is already
4560		 * enabled?
4561		 */
4562		mtx_unlock(&ctl_softc->ctl_lock);
4563		return (0);
4564	}
4565	lun->flags &= ~CTL_LUN_DISABLED;
4566
4567	for (fe = STAILQ_FIRST(&ctl_softc->fe_list); fe != NULL; fe = nfe) {
4568		nfe = STAILQ_NEXT(fe, links);
4569
4570		/*
4571		 * Drop the lock while we call the FETD's enable routine.
4572		 * This can lead to a callback into CTL (at least in the
4573		 * case of the internal initiator frontend.
4574		 */
4575		mtx_unlock(&ctl_softc->ctl_lock);
4576		retval = fe->lun_enable(fe->targ_lun_arg, lun->target,lun->lun);
4577		mtx_lock(&ctl_softc->ctl_lock);
4578		if (retval != 0) {
4579			printf("%s: FETD %s port %d returned error "
4580			       "%d for lun_enable on target %ju lun %jd\n",
4581			       __func__, fe->port_name, fe->targ_port, retval,
4582			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
4583		}
4584#if 0
4585		 else {
4586            /* NOTE:  TODO:  why does lun enable affect port status? */
4587			fe->status |= CTL_PORT_STATUS_LUN_ONLINE;
4588		}
4589#endif
4590	}
4591
4592	mtx_unlock(&ctl_softc->ctl_lock);
4593
4594	return (0);
4595}
4596
4597int
4598ctl_disable_lun(struct ctl_be_lun *be_lun)
4599{
4600	struct ctl_softc *ctl_softc;
4601	struct ctl_frontend *fe;
4602	struct ctl_lun *lun;
4603	int retval;
4604
4605	ctl_softc = control_softc;
4606
4607	lun = (struct ctl_lun *)be_lun->ctl_lun;
4608
4609	mtx_lock(&ctl_softc->ctl_lock);
4610
4611	if (lun->flags & CTL_LUN_DISABLED) {
4612		mtx_unlock(&ctl_softc->ctl_lock);
4613		return (0);
4614	}
4615	lun->flags |= CTL_LUN_DISABLED;
4616
4617	STAILQ_FOREACH(fe, &ctl_softc->fe_list, links) {
4618		mtx_unlock(&ctl_softc->ctl_lock);
4619		/*
4620		 * Drop the lock before we call the frontend's disable
4621		 * routine, to avoid lock order reversals.
4622		 *
4623		 * XXX KDM what happens if the frontend list changes while
4624		 * we're traversing it?  It's unlikely, but should be handled.
4625		 */
4626		retval = fe->lun_disable(fe->targ_lun_arg, lun->target,
4627					 lun->lun);
4628		mtx_lock(&ctl_softc->ctl_lock);
4629		if (retval != 0) {
4630			printf("ctl_alloc_lun: FETD %s port %d returned error "
4631			       "%d for lun_disable on target %ju lun %jd\n",
4632			       fe->port_name, fe->targ_port, retval,
4633			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
4634		}
4635	}
4636
4637	mtx_unlock(&ctl_softc->ctl_lock);
4638
4639	return (0);
4640}
4641
4642int
4643ctl_start_lun(struct ctl_be_lun *be_lun)
4644{
4645	struct ctl_softc *ctl_softc;
4646	struct ctl_lun *lun;
4647
4648	ctl_softc = control_softc;
4649
4650	lun = (struct ctl_lun *)be_lun->ctl_lun;
4651
4652	mtx_lock(&ctl_softc->ctl_lock);
4653	lun->flags &= ~CTL_LUN_STOPPED;
4654	mtx_unlock(&ctl_softc->ctl_lock);
4655
4656	return (0);
4657}
4658
4659int
4660ctl_stop_lun(struct ctl_be_lun *be_lun)
4661{
4662	struct ctl_softc *ctl_softc;
4663	struct ctl_lun *lun;
4664
4665	ctl_softc = control_softc;
4666
4667	lun = (struct ctl_lun *)be_lun->ctl_lun;
4668
4669	mtx_lock(&ctl_softc->ctl_lock);
4670	lun->flags |= CTL_LUN_STOPPED;
4671	mtx_unlock(&ctl_softc->ctl_lock);
4672
4673	return (0);
4674}
4675
4676int
4677ctl_lun_offline(struct ctl_be_lun *be_lun)
4678{
4679	struct ctl_softc *ctl_softc;
4680	struct ctl_lun *lun;
4681
4682	ctl_softc = control_softc;
4683
4684	lun = (struct ctl_lun *)be_lun->ctl_lun;
4685
4686	mtx_lock(&ctl_softc->ctl_lock);
4687	lun->flags |= CTL_LUN_OFFLINE;
4688	mtx_unlock(&ctl_softc->ctl_lock);
4689
4690	return (0);
4691}
4692
4693int
4694ctl_lun_online(struct ctl_be_lun *be_lun)
4695{
4696	struct ctl_softc *ctl_softc;
4697	struct ctl_lun *lun;
4698
4699	ctl_softc = control_softc;
4700
4701	lun = (struct ctl_lun *)be_lun->ctl_lun;
4702
4703	mtx_lock(&ctl_softc->ctl_lock);
4704	lun->flags &= ~CTL_LUN_OFFLINE;
4705	mtx_unlock(&ctl_softc->ctl_lock);
4706
4707	return (0);
4708}
4709
4710int
4711ctl_invalidate_lun(struct ctl_be_lun *be_lun)
4712{
4713	struct ctl_softc *ctl_softc;
4714	struct ctl_lun *lun;
4715
4716	ctl_softc = control_softc;
4717
4718	lun = (struct ctl_lun *)be_lun->ctl_lun;
4719
4720	mtx_lock(&ctl_softc->ctl_lock);
4721
4722	/*
4723	 * The LUN needs to be disabled before it can be marked invalid.
4724	 */
4725	if ((lun->flags & CTL_LUN_DISABLED) == 0) {
4726		mtx_unlock(&ctl_softc->ctl_lock);
4727		return (-1);
4728	}
4729	/*
4730	 * Mark the LUN invalid.
4731	 */
4732	lun->flags |= CTL_LUN_INVALID;
4733
4734	/*
4735	 * If there is nothing in the OOA queue, go ahead and free the LUN.
4736	 * If we have something in the OOA queue, we'll free it when the
4737	 * last I/O completes.
4738	 */
4739	if (TAILQ_FIRST(&lun->ooa_queue) == NULL)
4740		ctl_free_lun(lun);
4741	mtx_unlock(&ctl_softc->ctl_lock);
4742
4743	return (0);
4744}
4745
4746int
4747ctl_lun_inoperable(struct ctl_be_lun *be_lun)
4748{
4749	struct ctl_softc *ctl_softc;
4750	struct ctl_lun *lun;
4751
4752	ctl_softc = control_softc;
4753	lun = (struct ctl_lun *)be_lun->ctl_lun;
4754
4755	mtx_lock(&ctl_softc->ctl_lock);
4756	lun->flags |= CTL_LUN_INOPERABLE;
4757	mtx_unlock(&ctl_softc->ctl_lock);
4758
4759	return (0);
4760}
4761
4762int
4763ctl_lun_operable(struct ctl_be_lun *be_lun)
4764{
4765	struct ctl_softc *ctl_softc;
4766	struct ctl_lun *lun;
4767
4768	ctl_softc = control_softc;
4769	lun = (struct ctl_lun *)be_lun->ctl_lun;
4770
4771	mtx_lock(&ctl_softc->ctl_lock);
4772	lun->flags &= ~CTL_LUN_INOPERABLE;
4773	mtx_unlock(&ctl_softc->ctl_lock);
4774
4775	return (0);
4776}
4777
4778int
4779ctl_lun_power_lock(struct ctl_be_lun *be_lun, struct ctl_nexus *nexus,
4780		   int lock)
4781{
4782	struct ctl_softc *softc;
4783	struct ctl_lun *lun;
4784	struct copan_aps_subpage *current_sp;
4785	struct ctl_page_index *page_index;
4786	int i;
4787
4788	softc = control_softc;
4789
4790	mtx_lock(&softc->ctl_lock);
4791
4792	lun = (struct ctl_lun *)be_lun->ctl_lun;
4793
4794	page_index = NULL;
4795	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
4796		if ((lun->mode_pages.index[i].page_code & SMPH_PC_MASK) !=
4797		     APS_PAGE_CODE)
4798			continue;
4799
4800		if (lun->mode_pages.index[i].subpage != APS_SUBPAGE_CODE)
4801			continue;
4802		page_index = &lun->mode_pages.index[i];
4803	}
4804
4805	if (page_index == NULL) {
4806		mtx_unlock(&softc->ctl_lock);
4807		printf("%s: APS subpage not found for lun %ju!\n", __func__,
4808		       (uintmax_t)lun->lun);
4809		return (1);
4810	}
4811#if 0
4812	if ((softc->aps_locked_lun != 0)
4813	 && (softc->aps_locked_lun != lun->lun)) {
4814		printf("%s: attempt to lock LUN %llu when %llu is already "
4815		       "locked\n");
4816		mtx_unlock(&softc->ctl_lock);
4817		return (1);
4818	}
4819#endif
4820
4821	current_sp = (struct copan_aps_subpage *)(page_index->page_data +
4822		(page_index->page_len * CTL_PAGE_CURRENT));
4823
4824	if (lock != 0) {
4825		current_sp->lock_active = APS_LOCK_ACTIVE;
4826		softc->aps_locked_lun = lun->lun;
4827	} else {
4828		current_sp->lock_active = 0;
4829		softc->aps_locked_lun = 0;
4830	}
4831
4832
4833	/*
4834	 * If we're in HA mode, try to send the lock message to the other
4835	 * side.
4836	 */
4837	if (ctl_is_single == 0) {
4838		int isc_retval;
4839		union ctl_ha_msg lock_msg;
4840
4841		lock_msg.hdr.nexus = *nexus;
4842		lock_msg.hdr.msg_type = CTL_MSG_APS_LOCK;
4843		if (lock != 0)
4844			lock_msg.aps.lock_flag = 1;
4845		else
4846			lock_msg.aps.lock_flag = 0;
4847		isc_retval = ctl_ha_msg_send(CTL_HA_CHAN_CTL, &lock_msg,
4848					 sizeof(lock_msg), 0);
4849		if (isc_retval > CTL_HA_STATUS_SUCCESS) {
4850			printf("%s: APS (lock=%d) error returned from "
4851			       "ctl_ha_msg_send: %d\n", __func__, lock, isc_retval);
4852			mtx_unlock(&softc->ctl_lock);
4853			return (1);
4854		}
4855	}
4856
4857	mtx_unlock(&softc->ctl_lock);
4858
4859	return (0);
4860}
4861
4862void
4863ctl_lun_capacity_changed(struct ctl_be_lun *be_lun)
4864{
4865	struct ctl_lun *lun;
4866	struct ctl_softc *softc;
4867	int i;
4868
4869	softc = control_softc;
4870
4871	mtx_lock(&softc->ctl_lock);
4872
4873	lun = (struct ctl_lun *)be_lun->ctl_lun;
4874
4875	for (i = 0; i < CTL_MAX_INITIATORS; i++)
4876		lun->pending_sense[i].ua_pending |= CTL_UA_CAPACITY_CHANGED;
4877
4878	mtx_unlock(&softc->ctl_lock);
4879}
4880
4881/*
4882 * Backend "memory move is complete" callback for requests that never
4883 * make it down to say RAIDCore's configuration code.
4884 */
4885int
4886ctl_config_move_done(union ctl_io *io)
4887{
4888	int retval;
4889
4890	retval = CTL_RETVAL_COMPLETE;
4891
4892
4893	CTL_DEBUG_PRINT(("ctl_config_move_done\n"));
4894	/*
4895	 * XXX KDM this shouldn't happen, but what if it does?
4896	 */
4897	if (io->io_hdr.io_type != CTL_IO_SCSI)
4898		panic("I/O type isn't CTL_IO_SCSI!");
4899
4900	if ((io->io_hdr.port_status == 0)
4901	 && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
4902	 && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE))
4903		io->io_hdr.status = CTL_SUCCESS;
4904	else if ((io->io_hdr.port_status != 0)
4905	      && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
4906	      && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE)){
4907		/*
4908		 * For hardware error sense keys, the sense key
4909		 * specific value is defined to be a retry count,
4910		 * but we use it to pass back an internal FETD
4911		 * error code.  XXX KDM  Hopefully the FETD is only
4912		 * using 16 bits for an error code, since that's
4913		 * all the space we have in the sks field.
4914		 */
4915		ctl_set_internal_failure(&io->scsiio,
4916					 /*sks_valid*/ 1,
4917					 /*retry_count*/
4918					 io->io_hdr.port_status);
4919		free(io->scsiio.kern_data_ptr, M_CTL);
4920		ctl_done(io);
4921		goto bailout;
4922	}
4923
4924	if (((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
4925	 || ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
4926	 || ((io->io_hdr.flags & CTL_FLAG_ABORT) != 0)) {
4927		/*
4928		 * XXX KDM just assuming a single pointer here, and not a
4929		 * S/G list.  If we start using S/G lists for config data,
4930		 * we'll need to know how to clean them up here as well.
4931		 */
4932		free(io->scsiio.kern_data_ptr, M_CTL);
4933		/* Hopefully the user has already set the status... */
4934		ctl_done(io);
4935	} else {
4936		/*
4937		 * XXX KDM now we need to continue data movement.  Some
4938		 * options:
4939		 * - call ctl_scsiio() again?  We don't do this for data
4940		 *   writes, because for those at least we know ahead of
4941		 *   time where the write will go and how long it is.  For
4942		 *   config writes, though, that information is largely
4943		 *   contained within the write itself, thus we need to
4944		 *   parse out the data again.
4945		 *
4946		 * - Call some other function once the data is in?
4947		 */
4948
4949		/*
4950		 * XXX KDM call ctl_scsiio() again for now, and check flag
4951		 * bits to see whether we're allocated or not.
4952		 */
4953		retval = ctl_scsiio(&io->scsiio);
4954	}
4955bailout:
4956	return (retval);
4957}
4958
4959/*
4960 * This gets called by a backend driver when it is done with a
4961 * configuration write.
4962 */
4963void
4964ctl_config_write_done(union ctl_io *io)
4965{
4966	/*
4967	 * If the IO_CONT flag is set, we need to call the supplied
4968	 * function to continue processing the I/O, instead of completing
4969	 * the I/O just yet.
4970	 *
4971	 * If there is an error, though, we don't want to keep processing.
4972	 * Instead, just send status back to the initiator.
4973	 */
4974	if ((io->io_hdr.flags & CTL_FLAG_IO_CONT)
4975	 && (((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE)
4976	  || ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS))) {
4977		io->scsiio.io_cont(io);
4978		return;
4979	}
4980	/*
4981	 * Since a configuration write can be done for commands that actually
4982	 * have data allocated, like write buffer, and commands that have
4983	 * no data, like start/stop unit, we need to check here.
4984	 */
4985	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_OUT)
4986		free(io->scsiio.kern_data_ptr, M_CTL);
4987	ctl_done(io);
4988}
4989
4990/*
4991 * SCSI release command.
4992 */
4993int
4994ctl_scsi_release(struct ctl_scsiio *ctsio)
4995{
4996	int length, longid, thirdparty_id, resv_id;
4997	struct ctl_softc *ctl_softc;
4998	struct ctl_lun *lun;
4999
5000	length = 0;
5001	resv_id = 0;
5002
5003	CTL_DEBUG_PRINT(("ctl_scsi_release\n"));
5004
5005	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5006	ctl_softc = control_softc;
5007
5008	switch (ctsio->cdb[0]) {
5009	case RELEASE: {
5010		struct scsi_release *cdb;
5011
5012		cdb = (struct scsi_release *)ctsio->cdb;
5013		if ((cdb->byte2 & 0x1f) != 0) {
5014			ctl_set_invalid_field(ctsio,
5015					      /*sks_valid*/ 1,
5016					      /*command*/ 1,
5017					      /*field*/ 1,
5018					      /*bit_valid*/ 0,
5019					      /*bit*/ 0);
5020			ctl_done((union ctl_io *)ctsio);
5021			return (CTL_RETVAL_COMPLETE);
5022		}
5023		break;
5024	}
5025	case RELEASE_10: {
5026		struct scsi_release_10 *cdb;
5027
5028		cdb = (struct scsi_release_10 *)ctsio->cdb;
5029
5030		if ((cdb->byte2 & SR10_EXTENT) != 0) {
5031			ctl_set_invalid_field(ctsio,
5032					      /*sks_valid*/ 1,
5033					      /*command*/ 1,
5034					      /*field*/ 1,
5035					      /*bit_valid*/ 1,
5036					      /*bit*/ 0);
5037			ctl_done((union ctl_io *)ctsio);
5038			return (CTL_RETVAL_COMPLETE);
5039
5040		}
5041
5042		if ((cdb->byte2 & SR10_3RDPTY) != 0) {
5043			ctl_set_invalid_field(ctsio,
5044					      /*sks_valid*/ 1,
5045					      /*command*/ 1,
5046					      /*field*/ 1,
5047					      /*bit_valid*/ 1,
5048					      /*bit*/ 4);
5049			ctl_done((union ctl_io *)ctsio);
5050			return (CTL_RETVAL_COMPLETE);
5051		}
5052
5053		if (cdb->byte2 & SR10_LONGID)
5054			longid = 1;
5055		else
5056			thirdparty_id = cdb->thirdparty_id;
5057
5058		resv_id = cdb->resv_id;
5059		length = scsi_2btoul(cdb->length);
5060		break;
5061	}
5062	}
5063
5064
5065	/*
5066	 * XXX KDM right now, we only support LUN reservation.  We don't
5067	 * support 3rd party reservations, or extent reservations, which
5068	 * might actually need the parameter list.  If we've gotten this
5069	 * far, we've got a LUN reservation.  Anything else got kicked out
5070	 * above.  So, according to SPC, ignore the length.
5071	 */
5072	length = 0;
5073
5074	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
5075	 && (length > 0)) {
5076		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
5077		ctsio->kern_data_len = length;
5078		ctsio->kern_total_len = length;
5079		ctsio->kern_data_resid = 0;
5080		ctsio->kern_rel_offset = 0;
5081		ctsio->kern_sg_entries = 0;
5082		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
5083		ctsio->be_move_done = ctl_config_move_done;
5084		ctl_datamove((union ctl_io *)ctsio);
5085
5086		return (CTL_RETVAL_COMPLETE);
5087	}
5088
5089	if (length > 0)
5090		thirdparty_id = scsi_8btou64(ctsio->kern_data_ptr);
5091
5092	mtx_lock(&ctl_softc->ctl_lock);
5093
5094	/*
5095	 * According to SPC, it is not an error for an intiator to attempt
5096	 * to release a reservation on a LUN that isn't reserved, or that
5097	 * is reserved by another initiator.  The reservation can only be
5098	 * released, though, by the initiator who made it or by one of
5099	 * several reset type events.
5100	 */
5101	if (lun->flags & CTL_LUN_RESERVED) {
5102		if ((ctsio->io_hdr.nexus.initid.id == lun->rsv_nexus.initid.id)
5103		 && (ctsio->io_hdr.nexus.targ_port == lun->rsv_nexus.targ_port)
5104		 && (ctsio->io_hdr.nexus.targ_target.id ==
5105		     lun->rsv_nexus.targ_target.id)) {
5106			lun->flags &= ~CTL_LUN_RESERVED;
5107		}
5108	}
5109
5110	ctsio->scsi_status = SCSI_STATUS_OK;
5111	ctsio->io_hdr.status = CTL_SUCCESS;
5112
5113	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
5114		free(ctsio->kern_data_ptr, M_CTL);
5115		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
5116	}
5117
5118	mtx_unlock(&ctl_softc->ctl_lock);
5119
5120	ctl_done((union ctl_io *)ctsio);
5121	return (CTL_RETVAL_COMPLETE);
5122}
5123
5124int
5125ctl_scsi_reserve(struct ctl_scsiio *ctsio)
5126{
5127	int extent, thirdparty, longid;
5128	int resv_id, length;
5129	uint64_t thirdparty_id;
5130	struct ctl_softc *ctl_softc;
5131	struct ctl_lun *lun;
5132
5133	extent = 0;
5134	thirdparty = 0;
5135	longid = 0;
5136	resv_id = 0;
5137	length = 0;
5138	thirdparty_id = 0;
5139
5140	CTL_DEBUG_PRINT(("ctl_reserve\n"));
5141
5142	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5143	ctl_softc = control_softc;
5144
5145	switch (ctsio->cdb[0]) {
5146	case RESERVE: {
5147		struct scsi_reserve *cdb;
5148
5149		cdb = (struct scsi_reserve *)ctsio->cdb;
5150		if ((cdb->byte2 & 0x1f) != 0) {
5151			ctl_set_invalid_field(ctsio,
5152					      /*sks_valid*/ 1,
5153					      /*command*/ 1,
5154					      /*field*/ 1,
5155					      /*bit_valid*/ 0,
5156					      /*bit*/ 0);
5157			ctl_done((union ctl_io *)ctsio);
5158			return (CTL_RETVAL_COMPLETE);
5159		}
5160		resv_id = cdb->resv_id;
5161		length = scsi_2btoul(cdb->length);
5162		break;
5163	}
5164	case RESERVE_10: {
5165		struct scsi_reserve_10 *cdb;
5166
5167		cdb = (struct scsi_reserve_10 *)ctsio->cdb;
5168
5169		if ((cdb->byte2 & SR10_EXTENT) != 0) {
5170			ctl_set_invalid_field(ctsio,
5171					      /*sks_valid*/ 1,
5172					      /*command*/ 1,
5173					      /*field*/ 1,
5174					      /*bit_valid*/ 1,
5175					      /*bit*/ 0);
5176			ctl_done((union ctl_io *)ctsio);
5177			return (CTL_RETVAL_COMPLETE);
5178		}
5179		if ((cdb->byte2 & SR10_3RDPTY) != 0) {
5180			ctl_set_invalid_field(ctsio,
5181					      /*sks_valid*/ 1,
5182					      /*command*/ 1,
5183					      /*field*/ 1,
5184					      /*bit_valid*/ 1,
5185					      /*bit*/ 4);
5186			ctl_done((union ctl_io *)ctsio);
5187			return (CTL_RETVAL_COMPLETE);
5188		}
5189		if (cdb->byte2 & SR10_LONGID)
5190			longid = 1;
5191		else
5192			thirdparty_id = cdb->thirdparty_id;
5193
5194		resv_id = cdb->resv_id;
5195		length = scsi_2btoul(cdb->length);
5196		break;
5197	}
5198	}
5199
5200	/*
5201	 * XXX KDM right now, we only support LUN reservation.  We don't
5202	 * support 3rd party reservations, or extent reservations, which
5203	 * might actually need the parameter list.  If we've gotten this
5204	 * far, we've got a LUN reservation.  Anything else got kicked out
5205	 * above.  So, according to SPC, ignore the length.
5206	 */
5207	length = 0;
5208
5209	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
5210	 && (length > 0)) {
5211		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
5212		ctsio->kern_data_len = length;
5213		ctsio->kern_total_len = length;
5214		ctsio->kern_data_resid = 0;
5215		ctsio->kern_rel_offset = 0;
5216		ctsio->kern_sg_entries = 0;
5217		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
5218		ctsio->be_move_done = ctl_config_move_done;
5219		ctl_datamove((union ctl_io *)ctsio);
5220
5221		return (CTL_RETVAL_COMPLETE);
5222	}
5223
5224	if (length > 0)
5225		thirdparty_id = scsi_8btou64(ctsio->kern_data_ptr);
5226
5227	mtx_lock(&ctl_softc->ctl_lock);
5228	if (lun->flags & CTL_LUN_RESERVED) {
5229		if ((ctsio->io_hdr.nexus.initid.id != lun->rsv_nexus.initid.id)
5230		 || (ctsio->io_hdr.nexus.targ_port != lun->rsv_nexus.targ_port)
5231		 || (ctsio->io_hdr.nexus.targ_target.id !=
5232		     lun->rsv_nexus.targ_target.id)) {
5233			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
5234			ctsio->io_hdr.status = CTL_SCSI_ERROR;
5235			goto bailout;
5236		}
5237	}
5238
5239	lun->flags |= CTL_LUN_RESERVED;
5240	lun->rsv_nexus = ctsio->io_hdr.nexus;
5241
5242	ctsio->scsi_status = SCSI_STATUS_OK;
5243	ctsio->io_hdr.status = CTL_SUCCESS;
5244
5245bailout:
5246	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
5247		free(ctsio->kern_data_ptr, M_CTL);
5248		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
5249	}
5250
5251	mtx_unlock(&ctl_softc->ctl_lock);
5252
5253	ctl_done((union ctl_io *)ctsio);
5254	return (CTL_RETVAL_COMPLETE);
5255}
5256
5257int
5258ctl_start_stop(struct ctl_scsiio *ctsio)
5259{
5260	struct scsi_start_stop_unit *cdb;
5261	struct ctl_lun *lun;
5262	struct ctl_softc *ctl_softc;
5263	int retval;
5264
5265	CTL_DEBUG_PRINT(("ctl_start_stop\n"));
5266
5267	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5268	ctl_softc = control_softc;
5269	retval = 0;
5270
5271	cdb = (struct scsi_start_stop_unit *)ctsio->cdb;
5272
5273	/*
5274	 * XXX KDM
5275	 * We don't support the immediate bit on a stop unit.  In order to
5276	 * do that, we would need to code up a way to know that a stop is
5277	 * pending, and hold off any new commands until it completes, one
5278	 * way or another.  Then we could accept or reject those commands
5279	 * depending on its status.  We would almost need to do the reverse
5280	 * of what we do below for an immediate start -- return the copy of
5281	 * the ctl_io to the FETD with status to send to the host (and to
5282	 * free the copy!) and then free the original I/O once the stop
5283	 * actually completes.  That way, the OOA queue mechanism can work
5284	 * to block commands that shouldn't proceed.  Another alternative
5285	 * would be to put the copy in the queue in place of the original,
5286	 * and return the original back to the caller.  That could be
5287	 * slightly safer..
5288	 */
5289	if ((cdb->byte2 & SSS_IMMED)
5290	 && ((cdb->how & SSS_START) == 0)) {
5291		ctl_set_invalid_field(ctsio,
5292				      /*sks_valid*/ 1,
5293				      /*command*/ 1,
5294				      /*field*/ 1,
5295				      /*bit_valid*/ 1,
5296				      /*bit*/ 0);
5297		ctl_done((union ctl_io *)ctsio);
5298		return (CTL_RETVAL_COMPLETE);
5299	}
5300
5301	/*
5302	 * We don't support the power conditions field.  We need to check
5303	 * this prior to checking the load/eject and start/stop bits.
5304	 */
5305	if ((cdb->how & SSS_PC_MASK) != SSS_PC_START_VALID) {
5306		ctl_set_invalid_field(ctsio,
5307				      /*sks_valid*/ 1,
5308				      /*command*/ 1,
5309				      /*field*/ 4,
5310				      /*bit_valid*/ 1,
5311				      /*bit*/ 4);
5312		ctl_done((union ctl_io *)ctsio);
5313		return (CTL_RETVAL_COMPLETE);
5314	}
5315
5316	/*
5317	 * Media isn't removable, so we can't load or eject it.
5318	 */
5319	if ((cdb->how & SSS_LOEJ) != 0) {
5320		ctl_set_invalid_field(ctsio,
5321				      /*sks_valid*/ 1,
5322				      /*command*/ 1,
5323				      /*field*/ 4,
5324				      /*bit_valid*/ 1,
5325				      /*bit*/ 1);
5326		ctl_done((union ctl_io *)ctsio);
5327		return (CTL_RETVAL_COMPLETE);
5328	}
5329
5330	if ((lun->flags & CTL_LUN_PR_RESERVED)
5331	 && ((cdb->how & SSS_START)==0)) {
5332		uint32_t residx;
5333
5334		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
5335		if (!lun->per_res[residx].registered
5336		 || (lun->pr_res_idx!=residx && lun->res_type < 4)) {
5337
5338			ctl_set_reservation_conflict(ctsio);
5339			ctl_done((union ctl_io *)ctsio);
5340			return (CTL_RETVAL_COMPLETE);
5341		}
5342	}
5343
5344	/*
5345	 * If there is no backend on this device, we can't start or stop
5346	 * it.  In theory we shouldn't get any start/stop commands in the
5347	 * first place at this level if the LUN doesn't have a backend.
5348	 * That should get stopped by the command decode code.
5349	 */
5350	if (lun->backend == NULL) {
5351		ctl_set_invalid_opcode(ctsio);
5352		ctl_done((union ctl_io *)ctsio);
5353		return (CTL_RETVAL_COMPLETE);
5354	}
5355
5356	/*
5357	 * XXX KDM Copan-specific offline behavior.
5358	 * Figure out a reasonable way to port this?
5359	 */
5360#ifdef NEEDTOPORT
5361	mtx_lock(&ctl_softc->ctl_lock);
5362
5363	if (((cdb->byte2 & SSS_ONOFFLINE) == 0)
5364	 && (lun->flags & CTL_LUN_OFFLINE)) {
5365		/*
5366		 * If the LUN is offline, and the on/offline bit isn't set,
5367		 * reject the start or stop.  Otherwise, let it through.
5368		 */
5369		mtx_unlock(&ctl_softc->ctl_lock);
5370		ctl_set_lun_not_ready(ctsio);
5371		ctl_done((union ctl_io *)ctsio);
5372	} else {
5373		mtx_unlock(&ctl_softc->ctl_lock);
5374#endif /* NEEDTOPORT */
5375		/*
5376		 * This could be a start or a stop when we're online,
5377		 * or a stop/offline or start/online.  A start or stop when
5378		 * we're offline is covered in the case above.
5379		 */
5380		/*
5381		 * In the non-immediate case, we send the request to
5382		 * the backend and return status to the user when
5383		 * it is done.
5384		 *
5385		 * In the immediate case, we allocate a new ctl_io
5386		 * to hold a copy of the request, and send that to
5387		 * the backend.  We then set good status on the
5388		 * user's request and return it immediately.
5389		 */
5390		if (cdb->byte2 & SSS_IMMED) {
5391			union ctl_io *new_io;
5392
5393			new_io = ctl_alloc_io(ctsio->io_hdr.pool);
5394			if (new_io == NULL) {
5395				ctl_set_busy(ctsio);
5396				ctl_done((union ctl_io *)ctsio);
5397			} else {
5398				ctl_copy_io((union ctl_io *)ctsio,
5399					    new_io);
5400				retval = lun->backend->config_write(new_io);
5401				ctl_set_success(ctsio);
5402				ctl_done((union ctl_io *)ctsio);
5403			}
5404		} else {
5405			retval = lun->backend->config_write(
5406				(union ctl_io *)ctsio);
5407		}
5408#ifdef NEEDTOPORT
5409	}
5410#endif
5411	return (retval);
5412}
5413
5414/*
5415 * We support the SYNCHRONIZE CACHE command (10 and 16 byte versions), but
5416 * we don't really do anything with the LBA and length fields if the user
5417 * passes them in.  Instead we'll just flush out the cache for the entire
5418 * LUN.
5419 */
5420int
5421ctl_sync_cache(struct ctl_scsiio *ctsio)
5422{
5423	struct ctl_lun *lun;
5424	struct ctl_softc *ctl_softc;
5425	uint64_t starting_lba;
5426	uint32_t block_count;
5427	int reladr, immed;
5428	int retval;
5429
5430	CTL_DEBUG_PRINT(("ctl_sync_cache\n"));
5431
5432	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5433	ctl_softc = control_softc;
5434	retval = 0;
5435	reladr = 0;
5436	immed = 0;
5437
5438	switch (ctsio->cdb[0]) {
5439	case SYNCHRONIZE_CACHE: {
5440		struct scsi_sync_cache *cdb;
5441		cdb = (struct scsi_sync_cache *)ctsio->cdb;
5442
5443		if (cdb->byte2 & SSC_RELADR)
5444			reladr = 1;
5445
5446		if (cdb->byte2 & SSC_IMMED)
5447			immed = 1;
5448
5449		starting_lba = scsi_4btoul(cdb->begin_lba);
5450		block_count = scsi_2btoul(cdb->lb_count);
5451		break;
5452	}
5453	case SYNCHRONIZE_CACHE_16: {
5454		struct scsi_sync_cache_16 *cdb;
5455		cdb = (struct scsi_sync_cache_16 *)ctsio->cdb;
5456
5457		if (cdb->byte2 & SSC_RELADR)
5458			reladr = 1;
5459
5460		if (cdb->byte2 & SSC_IMMED)
5461			immed = 1;
5462
5463		starting_lba = scsi_8btou64(cdb->begin_lba);
5464		block_count = scsi_4btoul(cdb->lb_count);
5465		break;
5466	}
5467	default:
5468		ctl_set_invalid_opcode(ctsio);
5469		ctl_done((union ctl_io *)ctsio);
5470		goto bailout;
5471		break; /* NOTREACHED */
5472	}
5473
5474	if (immed) {
5475		/*
5476		 * We don't support the immediate bit.  Since it's in the
5477		 * same place for the 10 and 16 byte SYNCHRONIZE CACHE
5478		 * commands, we can just return the same error in either
5479		 * case.
5480		 */
5481		ctl_set_invalid_field(ctsio,
5482				      /*sks_valid*/ 1,
5483				      /*command*/ 1,
5484				      /*field*/ 1,
5485				      /*bit_valid*/ 1,
5486				      /*bit*/ 1);
5487		ctl_done((union ctl_io *)ctsio);
5488		goto bailout;
5489	}
5490
5491	if (reladr) {
5492		/*
5493		 * We don't support the reladr bit either.  It can only be
5494		 * used with linked commands, and we don't support linked
5495		 * commands.  Since the bit is in the same place for the
5496		 * 10 and 16 byte SYNCHRONIZE CACHE * commands, we can
5497		 * just return the same error in either case.
5498		 */
5499		ctl_set_invalid_field(ctsio,
5500				      /*sks_valid*/ 1,
5501				      /*command*/ 1,
5502				      /*field*/ 1,
5503				      /*bit_valid*/ 1,
5504				      /*bit*/ 0);
5505		ctl_done((union ctl_io *)ctsio);
5506		goto bailout;
5507	}
5508
5509	/*
5510	 * We check the LBA and length, but don't do anything with them.
5511	 * A SYNCHRONIZE CACHE will cause the entire cache for this lun to
5512	 * get flushed.  This check will just help satisfy anyone who wants
5513	 * to see an error for an out of range LBA.
5514	 */
5515	if ((starting_lba + block_count) > (lun->be_lun->maxlba + 1)) {
5516		ctl_set_lba_out_of_range(ctsio);
5517		ctl_done((union ctl_io *)ctsio);
5518		goto bailout;
5519	}
5520
5521	/*
5522	 * If this LUN has no backend, we can't flush the cache anyway.
5523	 */
5524	if (lun->backend == NULL) {
5525		ctl_set_invalid_opcode(ctsio);
5526		ctl_done((union ctl_io *)ctsio);
5527		goto bailout;
5528	}
5529
5530	/*
5531	 * Check to see whether we're configured to send the SYNCHRONIZE
5532	 * CACHE command directly to the back end.
5533	 */
5534	mtx_lock(&ctl_softc->ctl_lock);
5535	if ((ctl_softc->flags & CTL_FLAG_REAL_SYNC)
5536	 && (++(lun->sync_count) >= lun->sync_interval)) {
5537		lun->sync_count = 0;
5538		mtx_unlock(&ctl_softc->ctl_lock);
5539		retval = lun->backend->config_write((union ctl_io *)ctsio);
5540	} else {
5541		mtx_unlock(&ctl_softc->ctl_lock);
5542		ctl_set_success(ctsio);
5543		ctl_done((union ctl_io *)ctsio);
5544	}
5545
5546bailout:
5547
5548	return (retval);
5549}
5550
5551int
5552ctl_format(struct ctl_scsiio *ctsio)
5553{
5554	struct scsi_format *cdb;
5555	struct ctl_lun *lun;
5556	struct ctl_softc *ctl_softc;
5557	int length, defect_list_len;
5558
5559	CTL_DEBUG_PRINT(("ctl_format\n"));
5560
5561	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5562	ctl_softc = control_softc;
5563
5564	cdb = (struct scsi_format *)ctsio->cdb;
5565
5566	length = 0;
5567	if (cdb->byte2 & SF_FMTDATA) {
5568		if (cdb->byte2 & SF_LONGLIST)
5569			length = sizeof(struct scsi_format_header_long);
5570		else
5571			length = sizeof(struct scsi_format_header_short);
5572	}
5573
5574	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
5575	 && (length > 0)) {
5576		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
5577		ctsio->kern_data_len = length;
5578		ctsio->kern_total_len = length;
5579		ctsio->kern_data_resid = 0;
5580		ctsio->kern_rel_offset = 0;
5581		ctsio->kern_sg_entries = 0;
5582		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
5583		ctsio->be_move_done = ctl_config_move_done;
5584		ctl_datamove((union ctl_io *)ctsio);
5585
5586		return (CTL_RETVAL_COMPLETE);
5587	}
5588
5589	defect_list_len = 0;
5590
5591	if (cdb->byte2 & SF_FMTDATA) {
5592		if (cdb->byte2 & SF_LONGLIST) {
5593			struct scsi_format_header_long *header;
5594
5595			header = (struct scsi_format_header_long *)
5596				ctsio->kern_data_ptr;
5597
5598			defect_list_len = scsi_4btoul(header->defect_list_len);
5599			if (defect_list_len != 0) {
5600				ctl_set_invalid_field(ctsio,
5601						      /*sks_valid*/ 1,
5602						      /*command*/ 0,
5603						      /*field*/ 2,
5604						      /*bit_valid*/ 0,
5605						      /*bit*/ 0);
5606				goto bailout;
5607			}
5608		} else {
5609			struct scsi_format_header_short *header;
5610
5611			header = (struct scsi_format_header_short *)
5612				ctsio->kern_data_ptr;
5613
5614			defect_list_len = scsi_2btoul(header->defect_list_len);
5615			if (defect_list_len != 0) {
5616				ctl_set_invalid_field(ctsio,
5617						      /*sks_valid*/ 1,
5618						      /*command*/ 0,
5619						      /*field*/ 2,
5620						      /*bit_valid*/ 0,
5621						      /*bit*/ 0);
5622				goto bailout;
5623			}
5624		}
5625	}
5626
5627	/*
5628	 * The format command will clear out the "Medium format corrupted"
5629	 * status if set by the configuration code.  That status is really
5630	 * just a way to notify the host that we have lost the media, and
5631	 * get them to issue a command that will basically make them think
5632	 * they're blowing away the media.
5633	 */
5634	mtx_lock(&ctl_softc->ctl_lock);
5635	lun->flags &= ~CTL_LUN_INOPERABLE;
5636	mtx_unlock(&ctl_softc->ctl_lock);
5637
5638	ctsio->scsi_status = SCSI_STATUS_OK;
5639	ctsio->io_hdr.status = CTL_SUCCESS;
5640bailout:
5641
5642	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
5643		free(ctsio->kern_data_ptr, M_CTL);
5644		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
5645	}
5646
5647	ctl_done((union ctl_io *)ctsio);
5648	return (CTL_RETVAL_COMPLETE);
5649}
5650
5651int
5652ctl_write_buffer(struct ctl_scsiio *ctsio)
5653{
5654	struct scsi_write_buffer *cdb;
5655	struct copan_page_header *header;
5656	struct ctl_lun *lun;
5657	struct ctl_softc *ctl_softc;
5658	int buffer_offset, len;
5659	int retval;
5660
5661	header = NULL;
5662
5663	retval = CTL_RETVAL_COMPLETE;
5664
5665	CTL_DEBUG_PRINT(("ctl_write_buffer\n"));
5666
5667	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5668	ctl_softc = control_softc;
5669	cdb = (struct scsi_write_buffer *)ctsio->cdb;
5670
5671	if ((cdb->byte2 & RWB_MODE) != RWB_MODE_DATA) {
5672		ctl_set_invalid_field(ctsio,
5673				      /*sks_valid*/ 1,
5674				      /*command*/ 1,
5675				      /*field*/ 1,
5676				      /*bit_valid*/ 1,
5677				      /*bit*/ 4);
5678		ctl_done((union ctl_io *)ctsio);
5679		return (CTL_RETVAL_COMPLETE);
5680	}
5681	if (cdb->buffer_id != 0) {
5682		ctl_set_invalid_field(ctsio,
5683				      /*sks_valid*/ 1,
5684				      /*command*/ 1,
5685				      /*field*/ 2,
5686				      /*bit_valid*/ 0,
5687				      /*bit*/ 0);
5688		ctl_done((union ctl_io *)ctsio);
5689		return (CTL_RETVAL_COMPLETE);
5690	}
5691
5692	len = scsi_3btoul(cdb->length);
5693	buffer_offset = scsi_3btoul(cdb->offset);
5694
5695	if (len > sizeof(lun->write_buffer)) {
5696		ctl_set_invalid_field(ctsio,
5697				      /*sks_valid*/ 1,
5698				      /*command*/ 1,
5699				      /*field*/ 6,
5700				      /*bit_valid*/ 0,
5701				      /*bit*/ 0);
5702		ctl_done((union ctl_io *)ctsio);
5703		return (CTL_RETVAL_COMPLETE);
5704	}
5705
5706	if (buffer_offset != 0) {
5707		ctl_set_invalid_field(ctsio,
5708				      /*sks_valid*/ 1,
5709				      /*command*/ 1,
5710				      /*field*/ 3,
5711				      /*bit_valid*/ 0,
5712				      /*bit*/ 0);
5713		ctl_done((union ctl_io *)ctsio);
5714		return (CTL_RETVAL_COMPLETE);
5715	}
5716
5717	/*
5718	 * If we've got a kernel request that hasn't been malloced yet,
5719	 * malloc it and tell the caller the data buffer is here.
5720	 */
5721	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
5722		ctsio->kern_data_ptr = lun->write_buffer;
5723		ctsio->kern_data_len = len;
5724		ctsio->kern_total_len = len;
5725		ctsio->kern_data_resid = 0;
5726		ctsio->kern_rel_offset = 0;
5727		ctsio->kern_sg_entries = 0;
5728		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
5729		ctsio->be_move_done = ctl_config_move_done;
5730		ctl_datamove((union ctl_io *)ctsio);
5731
5732		return (CTL_RETVAL_COMPLETE);
5733	}
5734
5735	ctl_done((union ctl_io *)ctsio);
5736
5737	return (CTL_RETVAL_COMPLETE);
5738}
5739
5740/*
5741 * Note that this function currently doesn't actually do anything inside
5742 * CTL to enforce things if the DQue bit is turned on.
5743 *
5744 * Also note that this function can't be used in the default case, because
5745 * the DQue bit isn't set in the changeable mask for the control mode page
5746 * anyway.  This is just here as an example for how to implement a page
5747 * handler, and a placeholder in case we want to allow the user to turn
5748 * tagged queueing on and off.
5749 *
5750 * The D_SENSE bit handling is functional, however, and will turn
5751 * descriptor sense on and off for a given LUN.
5752 */
5753int
5754ctl_control_page_handler(struct ctl_scsiio *ctsio,
5755			 struct ctl_page_index *page_index, uint8_t *page_ptr)
5756{
5757	struct scsi_control_page *current_cp, *saved_cp, *user_cp;
5758	struct ctl_lun *lun;
5759	struct ctl_softc *softc;
5760	int set_ua;
5761	uint32_t initidx;
5762
5763	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5764	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
5765	set_ua = 0;
5766
5767	user_cp = (struct scsi_control_page *)page_ptr;
5768	current_cp = (struct scsi_control_page *)
5769		(page_index->page_data + (page_index->page_len *
5770		CTL_PAGE_CURRENT));
5771	saved_cp = (struct scsi_control_page *)
5772		(page_index->page_data + (page_index->page_len *
5773		CTL_PAGE_SAVED));
5774
5775	softc = control_softc;
5776
5777	mtx_lock(&softc->ctl_lock);
5778	if (((current_cp->rlec & SCP_DSENSE) == 0)
5779	 && ((user_cp->rlec & SCP_DSENSE) != 0)) {
5780		/*
5781		 * Descriptor sense is currently turned off and the user
5782		 * wants to turn it on.
5783		 */
5784		current_cp->rlec |= SCP_DSENSE;
5785		saved_cp->rlec |= SCP_DSENSE;
5786		lun->flags |= CTL_LUN_SENSE_DESC;
5787		set_ua = 1;
5788	} else if (((current_cp->rlec & SCP_DSENSE) != 0)
5789		&& ((user_cp->rlec & SCP_DSENSE) == 0)) {
5790		/*
5791		 * Descriptor sense is currently turned on, and the user
5792		 * wants to turn it off.
5793		 */
5794		current_cp->rlec &= ~SCP_DSENSE;
5795		saved_cp->rlec &= ~SCP_DSENSE;
5796		lun->flags &= ~CTL_LUN_SENSE_DESC;
5797		set_ua = 1;
5798	}
5799	if (current_cp->queue_flags & SCP_QUEUE_DQUE) {
5800		if (user_cp->queue_flags & SCP_QUEUE_DQUE) {
5801#ifdef NEEDTOPORT
5802			csevent_log(CSC_CTL | CSC_SHELF_SW |
5803				    CTL_UNTAG_TO_UNTAG,
5804				    csevent_LogType_Trace,
5805				    csevent_Severity_Information,
5806				    csevent_AlertLevel_Green,
5807				    csevent_FRU_Firmware,
5808				    csevent_FRU_Unknown,
5809				    "Received untagged to untagged transition");
5810#endif /* NEEDTOPORT */
5811		} else {
5812#ifdef NEEDTOPORT
5813			csevent_log(CSC_CTL | CSC_SHELF_SW |
5814				    CTL_UNTAG_TO_TAG,
5815				    csevent_LogType_ConfigChange,
5816				    csevent_Severity_Information,
5817				    csevent_AlertLevel_Green,
5818				    csevent_FRU_Firmware,
5819				    csevent_FRU_Unknown,
5820				    "Received untagged to tagged "
5821				    "queueing transition");
5822#endif /* NEEDTOPORT */
5823
5824			current_cp->queue_flags &= ~SCP_QUEUE_DQUE;
5825			saved_cp->queue_flags &= ~SCP_QUEUE_DQUE;
5826			set_ua = 1;
5827		}
5828	} else {
5829		if (user_cp->queue_flags & SCP_QUEUE_DQUE) {
5830#ifdef NEEDTOPORT
5831			csevent_log(CSC_CTL | CSC_SHELF_SW |
5832				    CTL_TAG_TO_UNTAG,
5833				    csevent_LogType_ConfigChange,
5834				    csevent_Severity_Warning,
5835				    csevent_AlertLevel_Yellow,
5836				    csevent_FRU_Firmware,
5837				    csevent_FRU_Unknown,
5838				    "Received tagged queueing to untagged "
5839				    "transition");
5840#endif /* NEEDTOPORT */
5841
5842			current_cp->queue_flags |= SCP_QUEUE_DQUE;
5843			saved_cp->queue_flags |= SCP_QUEUE_DQUE;
5844			set_ua = 1;
5845		} else {
5846#ifdef NEEDTOPORT
5847			csevent_log(CSC_CTL | CSC_SHELF_SW |
5848				    CTL_TAG_TO_TAG,
5849				    csevent_LogType_Trace,
5850				    csevent_Severity_Information,
5851				    csevent_AlertLevel_Green,
5852				    csevent_FRU_Firmware,
5853				    csevent_FRU_Unknown,
5854				    "Received tagged queueing to tagged "
5855				    "queueing transition");
5856#endif /* NEEDTOPORT */
5857		}
5858	}
5859	if (set_ua != 0) {
5860		int i;
5861		/*
5862		 * Let other initiators know that the mode
5863		 * parameters for this LUN have changed.
5864		 */
5865		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
5866			if (i == initidx)
5867				continue;
5868
5869			lun->pending_sense[i].ua_pending |=
5870				CTL_UA_MODE_CHANGE;
5871		}
5872	}
5873	mtx_unlock(&softc->ctl_lock);
5874
5875	return (0);
5876}
5877
5878int
5879ctl_power_sp_handler(struct ctl_scsiio *ctsio,
5880		     struct ctl_page_index *page_index, uint8_t *page_ptr)
5881{
5882	return (0);
5883}
5884
5885int
5886ctl_power_sp_sense_handler(struct ctl_scsiio *ctsio,
5887			   struct ctl_page_index *page_index, int pc)
5888{
5889	struct copan_power_subpage *page;
5890
5891	page = (struct copan_power_subpage *)page_index->page_data +
5892		(page_index->page_len * pc);
5893
5894	switch (pc) {
5895	case SMS_PAGE_CTRL_CHANGEABLE >> 6:
5896		/*
5897		 * We don't update the changable bits for this page.
5898		 */
5899		break;
5900	case SMS_PAGE_CTRL_CURRENT >> 6:
5901	case SMS_PAGE_CTRL_DEFAULT >> 6:
5902	case SMS_PAGE_CTRL_SAVED >> 6:
5903#ifdef NEEDTOPORT
5904		ctl_update_power_subpage(page);
5905#endif
5906		break;
5907	default:
5908#ifdef NEEDTOPORT
5909		EPRINT(0, "Invalid PC %d!!", pc);
5910#endif
5911		break;
5912	}
5913	return (0);
5914}
5915
5916
5917int
5918ctl_aps_sp_handler(struct ctl_scsiio *ctsio,
5919		   struct ctl_page_index *page_index, uint8_t *page_ptr)
5920{
5921	struct copan_aps_subpage *user_sp;
5922	struct copan_aps_subpage *current_sp;
5923	union ctl_modepage_info *modepage_info;
5924	struct ctl_softc *softc;
5925	struct ctl_lun *lun;
5926	int retval;
5927
5928	retval = CTL_RETVAL_COMPLETE;
5929	current_sp = (struct copan_aps_subpage *)(page_index->page_data +
5930		     (page_index->page_len * CTL_PAGE_CURRENT));
5931	softc = control_softc;
5932	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
5933
5934	user_sp = (struct copan_aps_subpage *)page_ptr;
5935
5936	modepage_info = (union ctl_modepage_info *)
5937		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
5938
5939	modepage_info->header.page_code = page_index->page_code & SMPH_PC_MASK;
5940	modepage_info->header.subpage = page_index->subpage;
5941	modepage_info->aps.lock_active = user_sp->lock_active;
5942
5943	mtx_lock(&softc->ctl_lock);
5944
5945	/*
5946	 * If there is a request to lock the LUN and another LUN is locked
5947	 * this is an error. If the requested LUN is already locked ignore
5948	 * the request. If no LUN is locked attempt to lock it.
5949	 * if there is a request to unlock the LUN and the LUN is currently
5950	 * locked attempt to unlock it. Otherwise ignore the request. i.e.
5951	 * if another LUN is locked or no LUN is locked.
5952	 */
5953	if (user_sp->lock_active & APS_LOCK_ACTIVE) {
5954		if (softc->aps_locked_lun == lun->lun) {
5955			/*
5956			 * This LUN is already locked, so we're done.
5957			 */
5958			retval = CTL_RETVAL_COMPLETE;
5959		} else if (softc->aps_locked_lun == 0) {
5960			/*
5961			 * No one has the lock, pass the request to the
5962			 * backend.
5963			 */
5964			retval = lun->backend->config_write(
5965				(union ctl_io *)ctsio);
5966		} else {
5967			/*
5968			 * Someone else has the lock, throw out the request.
5969			 */
5970			ctl_set_already_locked(ctsio);
5971			free(ctsio->kern_data_ptr, M_CTL);
5972			ctl_done((union ctl_io *)ctsio);
5973
5974			/*
5975			 * Set the return value so that ctl_do_mode_select()
5976			 * won't try to complete the command.  We already
5977			 * completed it here.
5978			 */
5979			retval = CTL_RETVAL_ERROR;
5980		}
5981	} else if (softc->aps_locked_lun == lun->lun) {
5982		/*
5983		 * This LUN is locked, so pass the unlock request to the
5984		 * backend.
5985		 */
5986		retval = lun->backend->config_write((union ctl_io *)ctsio);
5987	}
5988	mtx_unlock(&softc->ctl_lock);
5989
5990	return (retval);
5991}
5992
5993int
5994ctl_debugconf_sp_select_handler(struct ctl_scsiio *ctsio,
5995				struct ctl_page_index *page_index,
5996				uint8_t *page_ptr)
5997{
5998	uint8_t *c;
5999	int i;
6000
6001	c = ((struct copan_debugconf_subpage *)page_ptr)->ctl_time_io_secs;
6002	ctl_time_io_secs =
6003		(c[0] << 8) |
6004		(c[1] << 0) |
6005		0;
6006	CTL_DEBUG_PRINT(("set ctl_time_io_secs to %d\n", ctl_time_io_secs));
6007	printf("set ctl_time_io_secs to %d\n", ctl_time_io_secs);
6008	printf("page data:");
6009	for (i=0; i<8; i++)
6010		printf(" %.2x",page_ptr[i]);
6011	printf("\n");
6012	return (0);
6013}
6014
6015int
6016ctl_debugconf_sp_sense_handler(struct ctl_scsiio *ctsio,
6017			       struct ctl_page_index *page_index,
6018			       int pc)
6019{
6020	struct copan_debugconf_subpage *page;
6021
6022	page = (struct copan_debugconf_subpage *)page_index->page_data +
6023		(page_index->page_len * pc);
6024
6025	switch (pc) {
6026	case SMS_PAGE_CTRL_CHANGEABLE >> 6:
6027	case SMS_PAGE_CTRL_DEFAULT >> 6:
6028	case SMS_PAGE_CTRL_SAVED >> 6:
6029		/*
6030		 * We don't update the changable or default bits for this page.
6031		 */
6032		break;
6033	case SMS_PAGE_CTRL_CURRENT >> 6:
6034		page->ctl_time_io_secs[0] = ctl_time_io_secs >> 8;
6035		page->ctl_time_io_secs[1] = ctl_time_io_secs >> 0;
6036		break;
6037	default:
6038#ifdef NEEDTOPORT
6039		EPRINT(0, "Invalid PC %d!!", pc);
6040#endif /* NEEDTOPORT */
6041		break;
6042	}
6043	return (0);
6044}
6045
6046
6047static int
6048ctl_do_mode_select(union ctl_io *io)
6049{
6050	struct scsi_mode_page_header *page_header;
6051	struct ctl_page_index *page_index;
6052	struct ctl_scsiio *ctsio;
6053	int control_dev, page_len;
6054	int page_len_offset, page_len_size;
6055	union ctl_modepage_info *modepage_info;
6056	struct ctl_lun *lun;
6057	int *len_left, *len_used;
6058	int retval, i;
6059
6060	ctsio = &io->scsiio;
6061	page_index = NULL;
6062	page_len = 0;
6063	retval = CTL_RETVAL_COMPLETE;
6064
6065	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6066
6067	if (lun->be_lun->lun_type != T_DIRECT)
6068		control_dev = 1;
6069	else
6070		control_dev = 0;
6071
6072	modepage_info = (union ctl_modepage_info *)
6073		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
6074	len_left = &modepage_info->header.len_left;
6075	len_used = &modepage_info->header.len_used;
6076
6077do_next_page:
6078
6079	page_header = (struct scsi_mode_page_header *)
6080		(ctsio->kern_data_ptr + *len_used);
6081
6082	if (*len_left == 0) {
6083		free(ctsio->kern_data_ptr, M_CTL);
6084		ctl_set_success(ctsio);
6085		ctl_done((union ctl_io *)ctsio);
6086		return (CTL_RETVAL_COMPLETE);
6087	} else if (*len_left < sizeof(struct scsi_mode_page_header)) {
6088
6089		free(ctsio->kern_data_ptr, M_CTL);
6090		ctl_set_param_len_error(ctsio);
6091		ctl_done((union ctl_io *)ctsio);
6092		return (CTL_RETVAL_COMPLETE);
6093
6094	} else if ((page_header->page_code & SMPH_SPF)
6095		&& (*len_left < sizeof(struct scsi_mode_page_header_sp))) {
6096
6097		free(ctsio->kern_data_ptr, M_CTL);
6098		ctl_set_param_len_error(ctsio);
6099		ctl_done((union ctl_io *)ctsio);
6100		return (CTL_RETVAL_COMPLETE);
6101	}
6102
6103
6104	/*
6105	 * XXX KDM should we do something with the block descriptor?
6106	 */
6107	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6108
6109		if ((control_dev != 0)
6110		 && (lun->mode_pages.index[i].page_flags &
6111		     CTL_PAGE_FLAG_DISK_ONLY))
6112			continue;
6113
6114		if ((lun->mode_pages.index[i].page_code & SMPH_PC_MASK) !=
6115		    (page_header->page_code & SMPH_PC_MASK))
6116			continue;
6117
6118		/*
6119		 * If neither page has a subpage code, then we've got a
6120		 * match.
6121		 */
6122		if (((lun->mode_pages.index[i].page_code & SMPH_SPF) == 0)
6123		 && ((page_header->page_code & SMPH_SPF) == 0)) {
6124			page_index = &lun->mode_pages.index[i];
6125			page_len = page_header->page_length;
6126			break;
6127		}
6128
6129		/*
6130		 * If both pages have subpages, then the subpage numbers
6131		 * have to match.
6132		 */
6133		if ((lun->mode_pages.index[i].page_code & SMPH_SPF)
6134		  && (page_header->page_code & SMPH_SPF)) {
6135			struct scsi_mode_page_header_sp *sph;
6136
6137			sph = (struct scsi_mode_page_header_sp *)page_header;
6138
6139			if (lun->mode_pages.index[i].subpage ==
6140			    sph->subpage) {
6141				page_index = &lun->mode_pages.index[i];
6142				page_len = scsi_2btoul(sph->page_length);
6143				break;
6144			}
6145		}
6146	}
6147
6148	/*
6149	 * If we couldn't find the page, or if we don't have a mode select
6150	 * handler for it, send back an error to the user.
6151	 */
6152	if ((page_index == NULL)
6153	 || (page_index->select_handler == NULL)) {
6154		ctl_set_invalid_field(ctsio,
6155				      /*sks_valid*/ 1,
6156				      /*command*/ 0,
6157				      /*field*/ *len_used,
6158				      /*bit_valid*/ 0,
6159				      /*bit*/ 0);
6160		free(ctsio->kern_data_ptr, M_CTL);
6161		ctl_done((union ctl_io *)ctsio);
6162		return (CTL_RETVAL_COMPLETE);
6163	}
6164
6165	if (page_index->page_code & SMPH_SPF) {
6166		page_len_offset = 2;
6167		page_len_size = 2;
6168	} else {
6169		page_len_size = 1;
6170		page_len_offset = 1;
6171	}
6172
6173	/*
6174	 * If the length the initiator gives us isn't the one we specify in
6175	 * the mode page header, or if they didn't specify enough data in
6176	 * the CDB to avoid truncating this page, kick out the request.
6177	 */
6178	if ((page_len != (page_index->page_len - page_len_offset -
6179			  page_len_size))
6180	 || (*len_left < page_index->page_len)) {
6181
6182
6183		ctl_set_invalid_field(ctsio,
6184				      /*sks_valid*/ 1,
6185				      /*command*/ 0,
6186				      /*field*/ *len_used + page_len_offset,
6187				      /*bit_valid*/ 0,
6188				      /*bit*/ 0);
6189		free(ctsio->kern_data_ptr, M_CTL);
6190		ctl_done((union ctl_io *)ctsio);
6191		return (CTL_RETVAL_COMPLETE);
6192	}
6193
6194	/*
6195	 * Run through the mode page, checking to make sure that the bits
6196	 * the user changed are actually legal for him to change.
6197	 */
6198	for (i = 0; i < page_index->page_len; i++) {
6199		uint8_t *user_byte, *change_mask, *current_byte;
6200		int bad_bit;
6201		int j;
6202
6203		user_byte = (uint8_t *)page_header + i;
6204		change_mask = page_index->page_data +
6205			      (page_index->page_len * CTL_PAGE_CHANGEABLE) + i;
6206		current_byte = page_index->page_data +
6207			       (page_index->page_len * CTL_PAGE_CURRENT) + i;
6208
6209		/*
6210		 * Check to see whether the user set any bits in this byte
6211		 * that he is not allowed to set.
6212		 */
6213		if ((*user_byte & ~(*change_mask)) ==
6214		    (*current_byte & ~(*change_mask)))
6215			continue;
6216
6217		/*
6218		 * Go through bit by bit to determine which one is illegal.
6219		 */
6220		bad_bit = 0;
6221		for (j = 7; j >= 0; j--) {
6222			if ((((1 << i) & ~(*change_mask)) & *user_byte) !=
6223			    (((1 << i) & ~(*change_mask)) & *current_byte)) {
6224				bad_bit = i;
6225				break;
6226			}
6227		}
6228		ctl_set_invalid_field(ctsio,
6229				      /*sks_valid*/ 1,
6230				      /*command*/ 0,
6231				      /*field*/ *len_used + i,
6232				      /*bit_valid*/ 1,
6233				      /*bit*/ bad_bit);
6234		free(ctsio->kern_data_ptr, M_CTL);
6235		ctl_done((union ctl_io *)ctsio);
6236		return (CTL_RETVAL_COMPLETE);
6237	}
6238
6239	/*
6240	 * Decrement these before we call the page handler, since we may
6241	 * end up getting called back one way or another before the handler
6242	 * returns to this context.
6243	 */
6244	*len_left -= page_index->page_len;
6245	*len_used += page_index->page_len;
6246
6247	retval = page_index->select_handler(ctsio, page_index,
6248					    (uint8_t *)page_header);
6249
6250	/*
6251	 * If the page handler returns CTL_RETVAL_QUEUED, then we need to
6252	 * wait until this queued command completes to finish processing
6253	 * the mode page.  If it returns anything other than
6254	 * CTL_RETVAL_COMPLETE (e.g. CTL_RETVAL_ERROR), then it should have
6255	 * already set the sense information, freed the data pointer, and
6256	 * completed the io for us.
6257	 */
6258	if (retval != CTL_RETVAL_COMPLETE)
6259		goto bailout_no_done;
6260
6261	/*
6262	 * If the initiator sent us more than one page, parse the next one.
6263	 */
6264	if (*len_left > 0)
6265		goto do_next_page;
6266
6267	ctl_set_success(ctsio);
6268	free(ctsio->kern_data_ptr, M_CTL);
6269	ctl_done((union ctl_io *)ctsio);
6270
6271bailout_no_done:
6272
6273	return (CTL_RETVAL_COMPLETE);
6274
6275}
6276
6277int
6278ctl_mode_select(struct ctl_scsiio *ctsio)
6279{
6280	int param_len, pf, sp;
6281	int header_size, bd_len;
6282	int len_left, len_used;
6283	struct ctl_page_index *page_index;
6284	struct ctl_lun *lun;
6285	int control_dev, page_len;
6286	union ctl_modepage_info *modepage_info;
6287	int retval;
6288
6289	pf = 0;
6290	sp = 0;
6291	page_len = 0;
6292	len_used = 0;
6293	len_left = 0;
6294	retval = 0;
6295	bd_len = 0;
6296	page_index = NULL;
6297
6298	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6299
6300	if (lun->be_lun->lun_type != T_DIRECT)
6301		control_dev = 1;
6302	else
6303		control_dev = 0;
6304
6305	switch (ctsio->cdb[0]) {
6306	case MODE_SELECT_6: {
6307		struct scsi_mode_select_6 *cdb;
6308
6309		cdb = (struct scsi_mode_select_6 *)ctsio->cdb;
6310
6311		pf = (cdb->byte2 & SMS_PF) ? 1 : 0;
6312		sp = (cdb->byte2 & SMS_SP) ? 1 : 0;
6313
6314		param_len = cdb->length;
6315		header_size = sizeof(struct scsi_mode_header_6);
6316		break;
6317	}
6318	case MODE_SELECT_10: {
6319		struct scsi_mode_select_10 *cdb;
6320
6321		cdb = (struct scsi_mode_select_10 *)ctsio->cdb;
6322
6323		pf = (cdb->byte2 & SMS_PF) ? 1 : 0;
6324		sp = (cdb->byte2 & SMS_SP) ? 1 : 0;
6325
6326		param_len = scsi_2btoul(cdb->length);
6327		header_size = sizeof(struct scsi_mode_header_10);
6328		break;
6329	}
6330	default:
6331		ctl_set_invalid_opcode(ctsio);
6332		ctl_done((union ctl_io *)ctsio);
6333		return (CTL_RETVAL_COMPLETE);
6334		break; /* NOTREACHED */
6335	}
6336
6337	/*
6338	 * From SPC-3:
6339	 * "A parameter list length of zero indicates that the Data-Out Buffer
6340	 * shall be empty. This condition shall not be considered as an error."
6341	 */
6342	if (param_len == 0) {
6343		ctl_set_success(ctsio);
6344		ctl_done((union ctl_io *)ctsio);
6345		return (CTL_RETVAL_COMPLETE);
6346	}
6347
6348	/*
6349	 * Since we'll hit this the first time through, prior to
6350	 * allocation, we don't need to free a data buffer here.
6351	 */
6352	if (param_len < header_size) {
6353		ctl_set_param_len_error(ctsio);
6354		ctl_done((union ctl_io *)ctsio);
6355		return (CTL_RETVAL_COMPLETE);
6356	}
6357
6358	/*
6359	 * Allocate the data buffer and grab the user's data.  In theory,
6360	 * we shouldn't have to sanity check the parameter list length here
6361	 * because the maximum size is 64K.  We should be able to malloc
6362	 * that much without too many problems.
6363	 */
6364	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
6365		ctsio->kern_data_ptr = malloc(param_len, M_CTL, M_WAITOK);
6366		ctsio->kern_data_len = param_len;
6367		ctsio->kern_total_len = param_len;
6368		ctsio->kern_data_resid = 0;
6369		ctsio->kern_rel_offset = 0;
6370		ctsio->kern_sg_entries = 0;
6371		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
6372		ctsio->be_move_done = ctl_config_move_done;
6373		ctl_datamove((union ctl_io *)ctsio);
6374
6375		return (CTL_RETVAL_COMPLETE);
6376	}
6377
6378	switch (ctsio->cdb[0]) {
6379	case MODE_SELECT_6: {
6380		struct scsi_mode_header_6 *mh6;
6381
6382		mh6 = (struct scsi_mode_header_6 *)ctsio->kern_data_ptr;
6383		bd_len = mh6->blk_desc_len;
6384		break;
6385	}
6386	case MODE_SELECT_10: {
6387		struct scsi_mode_header_10 *mh10;
6388
6389		mh10 = (struct scsi_mode_header_10 *)ctsio->kern_data_ptr;
6390		bd_len = scsi_2btoul(mh10->blk_desc_len);
6391		break;
6392	}
6393	default:
6394		panic("Invalid CDB type %#x", ctsio->cdb[0]);
6395		break;
6396	}
6397
6398	if (param_len < (header_size + bd_len)) {
6399		free(ctsio->kern_data_ptr, M_CTL);
6400		ctl_set_param_len_error(ctsio);
6401		ctl_done((union ctl_io *)ctsio);
6402		return (CTL_RETVAL_COMPLETE);
6403	}
6404
6405	/*
6406	 * Set the IO_CONT flag, so that if this I/O gets passed to
6407	 * ctl_config_write_done(), it'll get passed back to
6408	 * ctl_do_mode_select() for further processing, or completion if
6409	 * we're all done.
6410	 */
6411	ctsio->io_hdr.flags |= CTL_FLAG_IO_CONT;
6412	ctsio->io_cont = ctl_do_mode_select;
6413
6414	modepage_info = (union ctl_modepage_info *)
6415		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
6416
6417	memset(modepage_info, 0, sizeof(*modepage_info));
6418
6419	len_left = param_len - header_size - bd_len;
6420	len_used = header_size + bd_len;
6421
6422	modepage_info->header.len_left = len_left;
6423	modepage_info->header.len_used = len_used;
6424
6425	return (ctl_do_mode_select((union ctl_io *)ctsio));
6426}
6427
6428int
6429ctl_mode_sense(struct ctl_scsiio *ctsio)
6430{
6431	struct ctl_lun *lun;
6432	int pc, page_code, dbd, llba, subpage;
6433	int alloc_len, page_len, header_len, total_len;
6434	struct scsi_mode_block_descr *block_desc;
6435	struct ctl_page_index *page_index;
6436	int control_dev;
6437
6438	dbd = 0;
6439	llba = 0;
6440	block_desc = NULL;
6441	page_index = NULL;
6442
6443	CTL_DEBUG_PRINT(("ctl_mode_sense\n"));
6444
6445	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6446
6447	if (lun->be_lun->lun_type != T_DIRECT)
6448		control_dev = 1;
6449	else
6450		control_dev = 0;
6451
6452	switch (ctsio->cdb[0]) {
6453	case MODE_SENSE_6: {
6454		struct scsi_mode_sense_6 *cdb;
6455
6456		cdb = (struct scsi_mode_sense_6 *)ctsio->cdb;
6457
6458		header_len = sizeof(struct scsi_mode_hdr_6);
6459		if (cdb->byte2 & SMS_DBD)
6460			dbd = 1;
6461		else
6462			header_len += sizeof(struct scsi_mode_block_descr);
6463
6464		pc = (cdb->page & SMS_PAGE_CTRL_MASK) >> 6;
6465		page_code = cdb->page & SMS_PAGE_CODE;
6466		subpage = cdb->subpage;
6467		alloc_len = cdb->length;
6468		break;
6469	}
6470	case MODE_SENSE_10: {
6471		struct scsi_mode_sense_10 *cdb;
6472
6473		cdb = (struct scsi_mode_sense_10 *)ctsio->cdb;
6474
6475		header_len = sizeof(struct scsi_mode_hdr_10);
6476
6477		if (cdb->byte2 & SMS_DBD)
6478			dbd = 1;
6479		else
6480			header_len += sizeof(struct scsi_mode_block_descr);
6481		if (cdb->byte2 & SMS10_LLBAA)
6482			llba = 1;
6483		pc = (cdb->page & SMS_PAGE_CTRL_MASK) >> 6;
6484		page_code = cdb->page & SMS_PAGE_CODE;
6485		subpage = cdb->subpage;
6486		alloc_len = scsi_2btoul(cdb->length);
6487		break;
6488	}
6489	default:
6490		ctl_set_invalid_opcode(ctsio);
6491		ctl_done((union ctl_io *)ctsio);
6492		return (CTL_RETVAL_COMPLETE);
6493		break; /* NOTREACHED */
6494	}
6495
6496	/*
6497	 * We have to make a first pass through to calculate the size of
6498	 * the pages that match the user's query.  Then we allocate enough
6499	 * memory to hold it, and actually copy the data into the buffer.
6500	 */
6501	switch (page_code) {
6502	case SMS_ALL_PAGES_PAGE: {
6503		int i;
6504
6505		page_len = 0;
6506
6507		/*
6508		 * At the moment, values other than 0 and 0xff here are
6509		 * reserved according to SPC-3.
6510		 */
6511		if ((subpage != SMS_SUBPAGE_PAGE_0)
6512		 && (subpage != SMS_SUBPAGE_ALL)) {
6513			ctl_set_invalid_field(ctsio,
6514					      /*sks_valid*/ 1,
6515					      /*command*/ 1,
6516					      /*field*/ 3,
6517					      /*bit_valid*/ 0,
6518					      /*bit*/ 0);
6519			ctl_done((union ctl_io *)ctsio);
6520			return (CTL_RETVAL_COMPLETE);
6521		}
6522
6523		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6524			if ((control_dev != 0)
6525			 && (lun->mode_pages.index[i].page_flags &
6526			     CTL_PAGE_FLAG_DISK_ONLY))
6527				continue;
6528
6529			/*
6530			 * We don't use this subpage if the user didn't
6531			 * request all subpages.
6532			 */
6533			if ((lun->mode_pages.index[i].subpage != 0)
6534			 && (subpage == SMS_SUBPAGE_PAGE_0))
6535				continue;
6536
6537#if 0
6538			printf("found page %#x len %d\n",
6539			       lun->mode_pages.index[i].page_code &
6540			       SMPH_PC_MASK,
6541			       lun->mode_pages.index[i].page_len);
6542#endif
6543			page_len += lun->mode_pages.index[i].page_len;
6544		}
6545		break;
6546	}
6547	default: {
6548		int i;
6549
6550		page_len = 0;
6551
6552		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6553			/* Look for the right page code */
6554			if ((lun->mode_pages.index[i].page_code &
6555			     SMPH_PC_MASK) != page_code)
6556				continue;
6557
6558			/* Look for the right subpage or the subpage wildcard*/
6559			if ((lun->mode_pages.index[i].subpage != subpage)
6560			 && (subpage != SMS_SUBPAGE_ALL))
6561				continue;
6562
6563			/* Make sure the page is supported for this dev type */
6564			if ((control_dev != 0)
6565			 && (lun->mode_pages.index[i].page_flags &
6566			     CTL_PAGE_FLAG_DISK_ONLY))
6567				continue;
6568
6569#if 0
6570			printf("found page %#x len %d\n",
6571			       lun->mode_pages.index[i].page_code &
6572			       SMPH_PC_MASK,
6573			       lun->mode_pages.index[i].page_len);
6574#endif
6575
6576			page_len += lun->mode_pages.index[i].page_len;
6577		}
6578
6579		if (page_len == 0) {
6580			ctl_set_invalid_field(ctsio,
6581					      /*sks_valid*/ 1,
6582					      /*command*/ 1,
6583					      /*field*/ 2,
6584					      /*bit_valid*/ 1,
6585					      /*bit*/ 5);
6586			ctl_done((union ctl_io *)ctsio);
6587			return (CTL_RETVAL_COMPLETE);
6588		}
6589		break;
6590	}
6591	}
6592
6593	total_len = header_len + page_len;
6594#if 0
6595	printf("header_len = %d, page_len = %d, total_len = %d\n",
6596	       header_len, page_len, total_len);
6597#endif
6598
6599	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
6600	ctsio->kern_sg_entries = 0;
6601	ctsio->kern_data_resid = 0;
6602	ctsio->kern_rel_offset = 0;
6603	if (total_len < alloc_len) {
6604		ctsio->residual = alloc_len - total_len;
6605		ctsio->kern_data_len = total_len;
6606		ctsio->kern_total_len = total_len;
6607	} else {
6608		ctsio->residual = 0;
6609		ctsio->kern_data_len = alloc_len;
6610		ctsio->kern_total_len = alloc_len;
6611	}
6612
6613	switch (ctsio->cdb[0]) {
6614	case MODE_SENSE_6: {
6615		struct scsi_mode_hdr_6 *header;
6616
6617		header = (struct scsi_mode_hdr_6 *)ctsio->kern_data_ptr;
6618
6619		header->datalen = ctl_min(total_len - 1, 254);
6620
6621		if (dbd)
6622			header->block_descr_len = 0;
6623		else
6624			header->block_descr_len =
6625				sizeof(struct scsi_mode_block_descr);
6626		block_desc = (struct scsi_mode_block_descr *)&header[1];
6627		break;
6628	}
6629	case MODE_SENSE_10: {
6630		struct scsi_mode_hdr_10 *header;
6631		int datalen;
6632
6633		header = (struct scsi_mode_hdr_10 *)ctsio->kern_data_ptr;
6634
6635		datalen = ctl_min(total_len - 2, 65533);
6636		scsi_ulto2b(datalen, header->datalen);
6637		if (dbd)
6638			scsi_ulto2b(0, header->block_descr_len);
6639		else
6640			scsi_ulto2b(sizeof(struct scsi_mode_block_descr),
6641				    header->block_descr_len);
6642		block_desc = (struct scsi_mode_block_descr *)&header[1];
6643		break;
6644	}
6645	default:
6646		panic("invalid CDB type %#x", ctsio->cdb[0]);
6647		break; /* NOTREACHED */
6648	}
6649
6650	/*
6651	 * If we've got a disk, use its blocksize in the block
6652	 * descriptor.  Otherwise, just set it to 0.
6653	 */
6654	if (dbd == 0) {
6655		if (control_dev != 0)
6656			scsi_ulto3b(lun->be_lun->blocksize,
6657				    block_desc->block_len);
6658		else
6659			scsi_ulto3b(0, block_desc->block_len);
6660	}
6661
6662	switch (page_code) {
6663	case SMS_ALL_PAGES_PAGE: {
6664		int i, data_used;
6665
6666		data_used = header_len;
6667		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6668			struct ctl_page_index *page_index;
6669
6670			page_index = &lun->mode_pages.index[i];
6671
6672			if ((control_dev != 0)
6673			 && (page_index->page_flags &
6674			    CTL_PAGE_FLAG_DISK_ONLY))
6675				continue;
6676
6677			/*
6678			 * We don't use this subpage if the user didn't
6679			 * request all subpages.  We already checked (above)
6680			 * to make sure the user only specified a subpage
6681			 * of 0 or 0xff in the SMS_ALL_PAGES_PAGE case.
6682			 */
6683			if ((page_index->subpage != 0)
6684			 && (subpage == SMS_SUBPAGE_PAGE_0))
6685				continue;
6686
6687			/*
6688			 * Call the handler, if it exists, to update the
6689			 * page to the latest values.
6690			 */
6691			if (page_index->sense_handler != NULL)
6692				page_index->sense_handler(ctsio, page_index,pc);
6693
6694			memcpy(ctsio->kern_data_ptr + data_used,
6695			       page_index->page_data +
6696			       (page_index->page_len * pc),
6697			       page_index->page_len);
6698			data_used += page_index->page_len;
6699		}
6700		break;
6701	}
6702	default: {
6703		int i, data_used;
6704
6705		data_used = header_len;
6706
6707		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
6708			struct ctl_page_index *page_index;
6709
6710			page_index = &lun->mode_pages.index[i];
6711
6712			/* Look for the right page code */
6713			if ((page_index->page_code & SMPH_PC_MASK) != page_code)
6714				continue;
6715
6716			/* Look for the right subpage or the subpage wildcard*/
6717			if ((page_index->subpage != subpage)
6718			 && (subpage != SMS_SUBPAGE_ALL))
6719				continue;
6720
6721			/* Make sure the page is supported for this dev type */
6722			if ((control_dev != 0)
6723			 && (page_index->page_flags &
6724			     CTL_PAGE_FLAG_DISK_ONLY))
6725				continue;
6726
6727			/*
6728			 * Call the handler, if it exists, to update the
6729			 * page to the latest values.
6730			 */
6731			if (page_index->sense_handler != NULL)
6732				page_index->sense_handler(ctsio, page_index,pc);
6733
6734			memcpy(ctsio->kern_data_ptr + data_used,
6735			       page_index->page_data +
6736			       (page_index->page_len * pc),
6737			       page_index->page_len);
6738			data_used += page_index->page_len;
6739		}
6740		break;
6741	}
6742	}
6743
6744	ctsio->scsi_status = SCSI_STATUS_OK;
6745
6746	ctsio->be_move_done = ctl_config_move_done;
6747	ctl_datamove((union ctl_io *)ctsio);
6748
6749	return (CTL_RETVAL_COMPLETE);
6750}
6751
6752int
6753ctl_read_capacity(struct ctl_scsiio *ctsio)
6754{
6755	struct scsi_read_capacity *cdb;
6756	struct scsi_read_capacity_data *data;
6757	struct ctl_lun *lun;
6758	uint32_t lba;
6759
6760	CTL_DEBUG_PRINT(("ctl_read_capacity\n"));
6761
6762	cdb = (struct scsi_read_capacity *)ctsio->cdb;
6763
6764	lba = scsi_4btoul(cdb->addr);
6765	if (((cdb->pmi & SRC_PMI) == 0)
6766	 && (lba != 0)) {
6767		ctl_set_invalid_field(/*ctsio*/ ctsio,
6768				      /*sks_valid*/ 1,
6769				      /*command*/ 1,
6770				      /*field*/ 2,
6771				      /*bit_valid*/ 0,
6772				      /*bit*/ 0);
6773		ctl_done((union ctl_io *)ctsio);
6774		return (CTL_RETVAL_COMPLETE);
6775	}
6776
6777	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6778
6779	ctsio->kern_data_ptr = malloc(sizeof(*data), M_CTL, M_WAITOK | M_ZERO);
6780	data = (struct scsi_read_capacity_data *)ctsio->kern_data_ptr;
6781	ctsio->residual = 0;
6782	ctsio->kern_data_len = sizeof(*data);
6783	ctsio->kern_total_len = sizeof(*data);
6784	ctsio->kern_data_resid = 0;
6785	ctsio->kern_rel_offset = 0;
6786	ctsio->kern_sg_entries = 0;
6787
6788	/*
6789	 * If the maximum LBA is greater than 0xfffffffe, the user must
6790	 * issue a SERVICE ACTION IN (16) command, with the read capacity
6791	 * serivce action set.
6792	 */
6793	if (lun->be_lun->maxlba > 0xfffffffe)
6794		scsi_ulto4b(0xffffffff, data->addr);
6795	else
6796		scsi_ulto4b(lun->be_lun->maxlba, data->addr);
6797
6798	/*
6799	 * XXX KDM this may not be 512 bytes...
6800	 */
6801	scsi_ulto4b(lun->be_lun->blocksize, data->length);
6802
6803	ctsio->scsi_status = SCSI_STATUS_OK;
6804
6805	ctsio->be_move_done = ctl_config_move_done;
6806	ctl_datamove((union ctl_io *)ctsio);
6807
6808	return (CTL_RETVAL_COMPLETE);
6809}
6810
6811static int
6812ctl_read_capacity_16(struct ctl_scsiio *ctsio)
6813{
6814	struct scsi_read_capacity_16 *cdb;
6815	struct scsi_read_capacity_data_long *data;
6816	struct ctl_lun *lun;
6817	uint64_t lba;
6818	uint32_t alloc_len;
6819
6820	CTL_DEBUG_PRINT(("ctl_read_capacity_16\n"));
6821
6822	cdb = (struct scsi_read_capacity_16 *)ctsio->cdb;
6823
6824	alloc_len = scsi_4btoul(cdb->alloc_len);
6825	lba = scsi_8btou64(cdb->addr);
6826
6827	if ((cdb->reladr & SRC16_PMI)
6828	 && (lba != 0)) {
6829		ctl_set_invalid_field(/*ctsio*/ ctsio,
6830				      /*sks_valid*/ 1,
6831				      /*command*/ 1,
6832				      /*field*/ 2,
6833				      /*bit_valid*/ 0,
6834				      /*bit*/ 0);
6835		ctl_done((union ctl_io *)ctsio);
6836		return (CTL_RETVAL_COMPLETE);
6837	}
6838
6839	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6840
6841	ctsio->kern_data_ptr = malloc(sizeof(*data), M_CTL, M_WAITOK | M_ZERO);
6842	data = (struct scsi_read_capacity_data_long *)ctsio->kern_data_ptr;
6843
6844	if (sizeof(*data) < alloc_len) {
6845		ctsio->residual = alloc_len - sizeof(*data);
6846		ctsio->kern_data_len = sizeof(*data);
6847		ctsio->kern_total_len = sizeof(*data);
6848	} else {
6849		ctsio->residual = 0;
6850		ctsio->kern_data_len = alloc_len;
6851		ctsio->kern_total_len = alloc_len;
6852	}
6853	ctsio->kern_data_resid = 0;
6854	ctsio->kern_rel_offset = 0;
6855	ctsio->kern_sg_entries = 0;
6856
6857	scsi_u64to8b(lun->be_lun->maxlba, data->addr);
6858	/* XXX KDM this may not be 512 bytes... */
6859	scsi_ulto4b(lun->be_lun->blocksize, data->length);
6860	data->prot_lbppbe = lun->be_lun->pblockexp & SRC16_LBPPBE;
6861	scsi_ulto2b(lun->be_lun->pblockoff & SRC16_LALBA_A, data->lalba_lbp);
6862
6863	ctsio->scsi_status = SCSI_STATUS_OK;
6864
6865	ctsio->be_move_done = ctl_config_move_done;
6866	ctl_datamove((union ctl_io *)ctsio);
6867
6868	return (CTL_RETVAL_COMPLETE);
6869}
6870
6871int
6872ctl_service_action_in(struct ctl_scsiio *ctsio)
6873{
6874	struct scsi_service_action_in *cdb;
6875	int retval;
6876
6877	CTL_DEBUG_PRINT(("ctl_service_action_in\n"));
6878
6879	cdb = (struct scsi_service_action_in *)ctsio->cdb;
6880
6881	retval = CTL_RETVAL_COMPLETE;
6882
6883	switch (cdb->service_action) {
6884	case SRC16_SERVICE_ACTION:
6885		retval = ctl_read_capacity_16(ctsio);
6886		break;
6887	default:
6888		ctl_set_invalid_field(/*ctsio*/ ctsio,
6889				      /*sks_valid*/ 1,
6890				      /*command*/ 1,
6891				      /*field*/ 1,
6892				      /*bit_valid*/ 1,
6893				      /*bit*/ 4);
6894		ctl_done((union ctl_io *)ctsio);
6895		break;
6896	}
6897
6898	return (retval);
6899}
6900
6901int
6902ctl_maintenance_in(struct ctl_scsiio *ctsio)
6903{
6904	struct scsi_maintenance_in *cdb;
6905	int retval;
6906	int alloc_len, total_len = 0;
6907	int num_target_port_groups, single;
6908	struct ctl_lun *lun;
6909	struct ctl_softc *softc;
6910	struct scsi_target_group_data *rtg_ptr;
6911	struct scsi_target_port_group_descriptor *tpg_desc_ptr1, *tpg_desc_ptr2;
6912	struct scsi_target_port_descriptor  *tp_desc_ptr1_1, *tp_desc_ptr1_2,
6913	                                    *tp_desc_ptr2_1, *tp_desc_ptr2_2;
6914
6915	CTL_DEBUG_PRINT(("ctl_maintenance_in\n"));
6916
6917	cdb = (struct scsi_maintenance_in *)ctsio->cdb;
6918	softc = control_softc;
6919	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
6920
6921	retval = CTL_RETVAL_COMPLETE;
6922
6923	if ((cdb->byte2 & SERVICE_ACTION_MASK) != SA_RPRT_TRGT_GRP) {
6924		ctl_set_invalid_field(/*ctsio*/ ctsio,
6925				      /*sks_valid*/ 1,
6926				      /*command*/ 1,
6927				      /*field*/ 1,
6928				      /*bit_valid*/ 1,
6929				      /*bit*/ 4);
6930		ctl_done((union ctl_io *)ctsio);
6931		return(retval);
6932	}
6933
6934	mtx_lock(&softc->ctl_lock);
6935	single = ctl_is_single;
6936	mtx_unlock(&softc->ctl_lock);
6937
6938	if (single)
6939        	num_target_port_groups = NUM_TARGET_PORT_GROUPS - 1;
6940	else
6941        	num_target_port_groups = NUM_TARGET_PORT_GROUPS;
6942
6943	total_len = sizeof(struct scsi_target_group_data) +
6944		sizeof(struct scsi_target_port_group_descriptor) *
6945		num_target_port_groups +
6946		sizeof(struct scsi_target_port_descriptor) *
6947		NUM_PORTS_PER_GRP * num_target_port_groups;
6948
6949	alloc_len = scsi_4btoul(cdb->length);
6950
6951	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
6952
6953	ctsio->kern_sg_entries = 0;
6954
6955	if (total_len < alloc_len) {
6956		ctsio->residual = alloc_len - total_len;
6957		ctsio->kern_data_len = total_len;
6958		ctsio->kern_total_len = total_len;
6959	} else {
6960		ctsio->residual = 0;
6961		ctsio->kern_data_len = alloc_len;
6962		ctsio->kern_total_len = alloc_len;
6963	}
6964	ctsio->kern_data_resid = 0;
6965	ctsio->kern_rel_offset = 0;
6966
6967	rtg_ptr = (struct scsi_target_group_data *)ctsio->kern_data_ptr;
6968
6969	tpg_desc_ptr1 = &rtg_ptr->groups[0];
6970	tp_desc_ptr1_1 = &tpg_desc_ptr1->descriptors[0];
6971	tp_desc_ptr1_2 = (struct scsi_target_port_descriptor *)
6972	        &tp_desc_ptr1_1->desc_list[0];
6973
6974	if (single == 0) {
6975		tpg_desc_ptr2 = (struct scsi_target_port_group_descriptor *)
6976	                &tp_desc_ptr1_2->desc_list[0];
6977		tp_desc_ptr2_1 = &tpg_desc_ptr2->descriptors[0];
6978		tp_desc_ptr2_2 = (struct scsi_target_port_descriptor *)
6979	        	&tp_desc_ptr2_1->desc_list[0];
6980        } else {
6981		tpg_desc_ptr2 = NULL;
6982		tp_desc_ptr2_1 = NULL;
6983		tp_desc_ptr2_2 = NULL;
6984	}
6985
6986	scsi_ulto4b(total_len - 4, rtg_ptr->length);
6987	if (single == 0) {
6988        	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS) {
6989			if (lun->flags & CTL_LUN_PRIMARY_SC) {
6990				tpg_desc_ptr1->pref_state = TPG_PRIMARY;
6991				tpg_desc_ptr2->pref_state =
6992					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
6993			} else {
6994				tpg_desc_ptr1->pref_state =
6995					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
6996				tpg_desc_ptr2->pref_state = TPG_PRIMARY;
6997			}
6998		} else {
6999			if (lun->flags & CTL_LUN_PRIMARY_SC) {
7000				tpg_desc_ptr1->pref_state =
7001					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
7002				tpg_desc_ptr2->pref_state = TPG_PRIMARY;
7003			} else {
7004				tpg_desc_ptr1->pref_state = TPG_PRIMARY;
7005				tpg_desc_ptr2->pref_state =
7006					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
7007			}
7008		}
7009	} else {
7010		tpg_desc_ptr1->pref_state = TPG_PRIMARY;
7011	}
7012	tpg_desc_ptr1->support = 0;
7013	tpg_desc_ptr1->target_port_group[1] = 1;
7014	tpg_desc_ptr1->status = TPG_IMPLICIT;
7015	tpg_desc_ptr1->target_port_count= NUM_PORTS_PER_GRP;
7016
7017	if (single == 0) {
7018		tpg_desc_ptr2->support = 0;
7019		tpg_desc_ptr2->target_port_group[1] = 2;
7020		tpg_desc_ptr2->status = TPG_IMPLICIT;
7021		tpg_desc_ptr2->target_port_count = NUM_PORTS_PER_GRP;
7022
7023		tp_desc_ptr1_1->relative_target_port_identifier[1] = 1;
7024		tp_desc_ptr1_2->relative_target_port_identifier[1] = 2;
7025
7026		tp_desc_ptr2_1->relative_target_port_identifier[1] = 9;
7027		tp_desc_ptr2_2->relative_target_port_identifier[1] = 10;
7028	} else {
7029        	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS) {
7030			tp_desc_ptr1_1->relative_target_port_identifier[1] = 1;
7031			tp_desc_ptr1_2->relative_target_port_identifier[1] = 2;
7032		} else {
7033			tp_desc_ptr1_1->relative_target_port_identifier[1] = 9;
7034			tp_desc_ptr1_2->relative_target_port_identifier[1] = 10;
7035		}
7036	}
7037
7038	ctsio->be_move_done = ctl_config_move_done;
7039
7040	CTL_DEBUG_PRINT(("buf = %x %x %x %x %x %x %x %x\n",
7041			 ctsio->kern_data_ptr[0], ctsio->kern_data_ptr[1],
7042			 ctsio->kern_data_ptr[2], ctsio->kern_data_ptr[3],
7043			 ctsio->kern_data_ptr[4], ctsio->kern_data_ptr[5],
7044			 ctsio->kern_data_ptr[6], ctsio->kern_data_ptr[7]));
7045
7046	ctl_datamove((union ctl_io *)ctsio);
7047	return(retval);
7048}
7049
7050int
7051ctl_persistent_reserve_in(struct ctl_scsiio *ctsio)
7052{
7053	struct scsi_per_res_in *cdb;
7054	int alloc_len, total_len = 0;
7055	/* struct scsi_per_res_in_rsrv in_data; */
7056	struct ctl_lun *lun;
7057	struct ctl_softc *softc;
7058
7059	CTL_DEBUG_PRINT(("ctl_persistent_reserve_in\n"));
7060
7061	softc = control_softc;
7062
7063	cdb = (struct scsi_per_res_in *)ctsio->cdb;
7064
7065	alloc_len = scsi_2btoul(cdb->length);
7066
7067	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
7068
7069retry:
7070	mtx_lock(&softc->ctl_lock);
7071	switch (cdb->action) {
7072	case SPRI_RK: /* read keys */
7073		total_len = sizeof(struct scsi_per_res_in_keys) +
7074			lun->pr_key_count *
7075			sizeof(struct scsi_per_res_key);
7076		break;
7077	case SPRI_RR: /* read reservation */
7078		if (lun->flags & CTL_LUN_PR_RESERVED)
7079			total_len = sizeof(struct scsi_per_res_in_rsrv);
7080		else
7081			total_len = sizeof(struct scsi_per_res_in_header);
7082		break;
7083	case SPRI_RC: /* report capabilities */
7084		total_len = sizeof(struct scsi_per_res_cap);
7085		break;
7086	case SPRI_RS: /* read full status */
7087	default:
7088		mtx_unlock(&softc->ctl_lock);
7089		ctl_set_invalid_field(ctsio,
7090				      /*sks_valid*/ 1,
7091				      /*command*/ 1,
7092				      /*field*/ 1,
7093				      /*bit_valid*/ 1,
7094				      /*bit*/ 0);
7095		ctl_done((union ctl_io *)ctsio);
7096		return (CTL_RETVAL_COMPLETE);
7097		break; /* NOTREACHED */
7098	}
7099	mtx_unlock(&softc->ctl_lock);
7100
7101	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK | M_ZERO);
7102
7103	if (total_len < alloc_len) {
7104		ctsio->residual = alloc_len - total_len;
7105		ctsio->kern_data_len = total_len;
7106		ctsio->kern_total_len = total_len;
7107	} else {
7108		ctsio->residual = 0;
7109		ctsio->kern_data_len = alloc_len;
7110		ctsio->kern_total_len = alloc_len;
7111	}
7112
7113	ctsio->kern_data_resid = 0;
7114	ctsio->kern_rel_offset = 0;
7115	ctsio->kern_sg_entries = 0;
7116
7117	mtx_lock(&softc->ctl_lock);
7118	switch (cdb->action) {
7119	case SPRI_RK: { // read keys
7120        struct scsi_per_res_in_keys *res_keys;
7121		int i, key_count;
7122
7123		res_keys = (struct scsi_per_res_in_keys*)ctsio->kern_data_ptr;
7124
7125		/*
7126		 * We had to drop the lock to allocate our buffer, which
7127		 * leaves time for someone to come in with another
7128		 * persistent reservation.  (That is unlikely, though,
7129		 * since this should be the only persistent reservation
7130		 * command active right now.)
7131		 */
7132		if (total_len != (sizeof(struct scsi_per_res_in_keys) +
7133		    (lun->pr_key_count *
7134		     sizeof(struct scsi_per_res_key)))){
7135			mtx_unlock(&softc->ctl_lock);
7136			free(ctsio->kern_data_ptr, M_CTL);
7137			printf("%s: reservation length changed, retrying\n",
7138			       __func__);
7139			goto retry;
7140		}
7141
7142		scsi_ulto4b(lun->PRGeneration, res_keys->header.generation);
7143
7144		scsi_ulto4b(sizeof(struct scsi_per_res_key) *
7145			     lun->pr_key_count, res_keys->header.length);
7146
7147		for (i = 0, key_count = 0; i < 2*CTL_MAX_INITIATORS; i++) {
7148			if (!lun->per_res[i].registered)
7149				continue;
7150
7151			/*
7152			 * We used lun->pr_key_count to calculate the
7153			 * size to allocate.  If it turns out the number of
7154			 * initiators with the registered flag set is
7155			 * larger than that (i.e. they haven't been kept in
7156			 * sync), we've got a problem.
7157			 */
7158			if (key_count >= lun->pr_key_count) {
7159#ifdef NEEDTOPORT
7160				csevent_log(CSC_CTL | CSC_SHELF_SW |
7161					    CTL_PR_ERROR,
7162					    csevent_LogType_Fault,
7163					    csevent_AlertLevel_Yellow,
7164					    csevent_FRU_ShelfController,
7165					    csevent_FRU_Firmware,
7166				        csevent_FRU_Unknown,
7167					    "registered keys %d >= key "
7168					    "count %d", key_count,
7169					    lun->pr_key_count);
7170#endif
7171				key_count++;
7172				continue;
7173			}
7174			memcpy(res_keys->keys[key_count].key,
7175			       lun->per_res[i].res_key.key,
7176			       ctl_min(sizeof(res_keys->keys[key_count].key),
7177			       sizeof(lun->per_res[i].res_key)));
7178			key_count++;
7179		}
7180		break;
7181	}
7182	case SPRI_RR: { // read reservation
7183		struct scsi_per_res_in_rsrv *res;
7184		int tmp_len, header_only;
7185
7186		res = (struct scsi_per_res_in_rsrv *)ctsio->kern_data_ptr;
7187
7188		scsi_ulto4b(lun->PRGeneration, res->header.generation);
7189
7190		if (lun->flags & CTL_LUN_PR_RESERVED)
7191		{
7192			tmp_len = sizeof(struct scsi_per_res_in_rsrv);
7193			scsi_ulto4b(sizeof(struct scsi_per_res_in_rsrv_data),
7194				    res->header.length);
7195			header_only = 0;
7196		} else {
7197			tmp_len = sizeof(struct scsi_per_res_in_header);
7198			scsi_ulto4b(0, res->header.length);
7199			header_only = 1;
7200		}
7201
7202		/*
7203		 * We had to drop the lock to allocate our buffer, which
7204		 * leaves time for someone to come in with another
7205		 * persistent reservation.  (That is unlikely, though,
7206		 * since this should be the only persistent reservation
7207		 * command active right now.)
7208		 */
7209		if (tmp_len != total_len) {
7210			mtx_unlock(&softc->ctl_lock);
7211			free(ctsio->kern_data_ptr, M_CTL);
7212			printf("%s: reservation status changed, retrying\n",
7213			       __func__);
7214			goto retry;
7215		}
7216
7217		/*
7218		 * No reservation held, so we're done.
7219		 */
7220		if (header_only != 0)
7221			break;
7222
7223		/*
7224		 * If the registration is an All Registrants type, the key
7225		 * is 0, since it doesn't really matter.
7226		 */
7227		if (lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS) {
7228			memcpy(res->data.reservation,
7229			       &lun->per_res[lun->pr_res_idx].res_key,
7230			       sizeof(struct scsi_per_res_key));
7231		}
7232		res->data.scopetype = lun->res_type;
7233		break;
7234	}
7235	case SPRI_RC:     //report capabilities
7236	{
7237		struct scsi_per_res_cap *res_cap;
7238		uint16_t type_mask;
7239
7240		res_cap = (struct scsi_per_res_cap *)ctsio->kern_data_ptr;
7241		scsi_ulto2b(sizeof(*res_cap), res_cap->length);
7242		res_cap->flags2 |= SPRI_TMV;
7243		type_mask = SPRI_TM_WR_EX_AR |
7244			    SPRI_TM_EX_AC_RO |
7245			    SPRI_TM_WR_EX_RO |
7246			    SPRI_TM_EX_AC |
7247			    SPRI_TM_WR_EX |
7248			    SPRI_TM_EX_AC_AR;
7249		scsi_ulto2b(type_mask, res_cap->type_mask);
7250		break;
7251	}
7252	case SPRI_RS: //read full status
7253	default:
7254		/*
7255		 * This is a bug, because we just checked for this above,
7256		 * and should have returned an error.
7257		 */
7258		panic("Invalid PR type %x", cdb->action);
7259		break; /* NOTREACHED */
7260	}
7261	mtx_unlock(&softc->ctl_lock);
7262
7263	ctsio->be_move_done = ctl_config_move_done;
7264
7265	CTL_DEBUG_PRINT(("buf = %x %x %x %x %x %x %x %x\n",
7266			 ctsio->kern_data_ptr[0], ctsio->kern_data_ptr[1],
7267			 ctsio->kern_data_ptr[2], ctsio->kern_data_ptr[3],
7268			 ctsio->kern_data_ptr[4], ctsio->kern_data_ptr[5],
7269			 ctsio->kern_data_ptr[6], ctsio->kern_data_ptr[7]));
7270
7271	ctl_datamove((union ctl_io *)ctsio);
7272
7273	return (CTL_RETVAL_COMPLETE);
7274}
7275
7276/*
7277 * Returns 0 if ctl_persistent_reserve_out() should continue, non-zero if
7278 * it should return.
7279 */
7280static int
7281ctl_pro_preempt(struct ctl_softc *softc, struct ctl_lun *lun, uint64_t res_key,
7282		uint64_t sa_res_key, uint8_t type, uint32_t residx,
7283		struct ctl_scsiio *ctsio, struct scsi_per_res_out *cdb,
7284		struct scsi_per_res_out_parms* param)
7285{
7286	union ctl_ha_msg persis_io;
7287	int retval, i;
7288	int isc_retval;
7289
7290	retval = 0;
7291
7292	if (sa_res_key == 0) {
7293		mtx_lock(&softc->ctl_lock);
7294		if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
7295			/* validate scope and type */
7296			if ((cdb->scope_type & SPR_SCOPE_MASK) !=
7297			     SPR_LU_SCOPE) {
7298				mtx_unlock(&softc->ctl_lock);
7299				ctl_set_invalid_field(/*ctsio*/ ctsio,
7300						      /*sks_valid*/ 1,
7301						      /*command*/ 1,
7302						      /*field*/ 2,
7303						      /*bit_valid*/ 1,
7304						      /*bit*/ 4);
7305				ctl_done((union ctl_io *)ctsio);
7306				return (1);
7307			}
7308
7309		        if (type>8 || type==2 || type==4 || type==0) {
7310				mtx_unlock(&softc->ctl_lock);
7311				ctl_set_invalid_field(/*ctsio*/ ctsio,
7312       	           				      /*sks_valid*/ 1,
7313						      /*command*/ 1,
7314						      /*field*/ 2,
7315						      /*bit_valid*/ 1,
7316						      /*bit*/ 0);
7317				ctl_done((union ctl_io *)ctsio);
7318				return (1);
7319		        }
7320
7321			/* temporarily unregister this nexus */
7322			lun->per_res[residx].registered = 0;
7323
7324			/*
7325			 * Unregister everybody else and build UA for
7326			 * them
7327			 */
7328			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7329				if (lun->per_res[i].registered == 0)
7330					continue;
7331
7332				if (!persis_offset
7333				 && i <CTL_MAX_INITIATORS)
7334					lun->pending_sense[i].ua_pending |=
7335						CTL_UA_REG_PREEMPT;
7336				else if (persis_offset
7337				      && i >= persis_offset)
7338					lun->pending_sense[i-persis_offset
7339						].ua_pending |=
7340						CTL_UA_REG_PREEMPT;
7341				lun->per_res[i].registered = 0;
7342				memset(&lun->per_res[i].res_key, 0,
7343				       sizeof(struct scsi_per_res_key));
7344			}
7345			lun->per_res[residx].registered = 1;
7346			lun->pr_key_count = 1;
7347			lun->res_type = type;
7348			if (lun->res_type != SPR_TYPE_WR_EX_AR
7349			 && lun->res_type != SPR_TYPE_EX_AC_AR)
7350				lun->pr_res_idx = residx;
7351
7352			mtx_unlock(&softc->ctl_lock);
7353			/* send msg to other side */
7354			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7355			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7356			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
7357			persis_io.pr.pr_info.residx = lun->pr_res_idx;
7358			persis_io.pr.pr_info.res_type = type;
7359			memcpy(persis_io.pr.pr_info.sa_res_key,
7360			       param->serv_act_res_key,
7361			       sizeof(param->serv_act_res_key));
7362			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7363			     &persis_io, sizeof(persis_io), 0)) >
7364			     CTL_HA_STATUS_SUCCESS) {
7365				printf("CTL:Persis Out error returned "
7366				       "from ctl_ha_msg_send %d\n",
7367				       isc_retval);
7368			}
7369		} else {
7370			/* not all registrants */
7371			mtx_unlock(&softc->ctl_lock);
7372			free(ctsio->kern_data_ptr, M_CTL);
7373			ctl_set_invalid_field(ctsio,
7374					      /*sks_valid*/ 1,
7375					      /*command*/ 0,
7376					      /*field*/ 8,
7377					      /*bit_valid*/ 0,
7378					      /*bit*/ 0);
7379			ctl_done((union ctl_io *)ctsio);
7380			return (1);
7381		}
7382	} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS
7383		|| !(lun->flags & CTL_LUN_PR_RESERVED)) {
7384		int found = 0;
7385
7386		mtx_lock(&softc->ctl_lock);
7387		if (res_key == sa_res_key) {
7388			/* special case */
7389			/*
7390			 * The spec implies this is not good but doesn't
7391			 * say what to do. There are two choices either
7392			 * generate a res conflict or check condition
7393			 * with illegal field in parameter data. Since
7394			 * that is what is done when the sa_res_key is
7395			 * zero I'll take that approach since this has
7396			 * to do with the sa_res_key.
7397			 */
7398			mtx_unlock(&softc->ctl_lock);
7399			free(ctsio->kern_data_ptr, M_CTL);
7400			ctl_set_invalid_field(ctsio,
7401					      /*sks_valid*/ 1,
7402					      /*command*/ 0,
7403					      /*field*/ 8,
7404					      /*bit_valid*/ 0,
7405					      /*bit*/ 0);
7406			ctl_done((union ctl_io *)ctsio);
7407			return (1);
7408		}
7409
7410		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7411			if (lun->per_res[i].registered
7412			 && memcmp(param->serv_act_res_key,
7413			    lun->per_res[i].res_key.key,
7414			    sizeof(struct scsi_per_res_key)) != 0)
7415				continue;
7416
7417			found = 1;
7418			lun->per_res[i].registered = 0;
7419			memset(&lun->per_res[i].res_key, 0,
7420			       sizeof(struct scsi_per_res_key));
7421			lun->pr_key_count--;
7422
7423			if (!persis_offset
7424			 && i < CTL_MAX_INITIATORS)
7425				lun->pending_sense[i].ua_pending |=
7426					CTL_UA_REG_PREEMPT;
7427			else if (persis_offset
7428			      && i >= persis_offset)
7429				lun->pending_sense[i-persis_offset].ua_pending|=
7430					CTL_UA_REG_PREEMPT;
7431		}
7432		mtx_unlock(&softc->ctl_lock);
7433		if (!found) {
7434			free(ctsio->kern_data_ptr, M_CTL);
7435			ctl_set_reservation_conflict(ctsio);
7436			ctl_done((union ctl_io *)ctsio);
7437			return (CTL_RETVAL_COMPLETE);
7438		}
7439		/* send msg to other side */
7440		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7441		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7442		persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
7443		persis_io.pr.pr_info.residx = lun->pr_res_idx;
7444		persis_io.pr.pr_info.res_type = type;
7445		memcpy(persis_io.pr.pr_info.sa_res_key,
7446		       param->serv_act_res_key,
7447		       sizeof(param->serv_act_res_key));
7448		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7449		     &persis_io, sizeof(persis_io), 0)) >
7450		     CTL_HA_STATUS_SUCCESS) {
7451			printf("CTL:Persis Out error returned from "
7452			       "ctl_ha_msg_send %d\n", isc_retval);
7453		}
7454	} else {
7455		/* Reserved but not all registrants */
7456		/* sa_res_key is res holder */
7457		if (memcmp(param->serv_act_res_key,
7458                   lun->per_res[lun->pr_res_idx].res_key.key,
7459                   sizeof(struct scsi_per_res_key)) == 0) {
7460			/* validate scope and type */
7461			if ((cdb->scope_type & SPR_SCOPE_MASK) !=
7462			     SPR_LU_SCOPE) {
7463				ctl_set_invalid_field(/*ctsio*/ ctsio,
7464						      /*sks_valid*/ 1,
7465						      /*command*/ 1,
7466						      /*field*/ 2,
7467						      /*bit_valid*/ 1,
7468						      /*bit*/ 4);
7469				ctl_done((union ctl_io *)ctsio);
7470				return (1);
7471			}
7472
7473			if (type>8 || type==2 || type==4 || type==0) {
7474				ctl_set_invalid_field(/*ctsio*/ ctsio,
7475						      /*sks_valid*/ 1,
7476						      /*command*/ 1,
7477						      /*field*/ 2,
7478						      /*bit_valid*/ 1,
7479						      /*bit*/ 0);
7480				ctl_done((union ctl_io *)ctsio);
7481				return (1);
7482			}
7483
7484			/*
7485			 * Do the following:
7486			 * if sa_res_key != res_key remove all
7487			 * registrants w/sa_res_key and generate UA
7488			 * for these registrants(Registrations
7489			 * Preempted) if it wasn't an exclusive
7490			 * reservation generate UA(Reservations
7491			 * Preempted) for all other registered nexuses
7492			 * if the type has changed. Establish the new
7493			 * reservation and holder. If res_key and
7494			 * sa_res_key are the same do the above
7495			 * except don't unregister the res holder.
7496			 */
7497
7498			/*
7499			 * Temporarily unregister so it won't get
7500			 * removed or UA generated
7501			 */
7502			lun->per_res[residx].registered = 0;
7503			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7504				if (lun->per_res[i].registered == 0)
7505					continue;
7506
7507				if (memcmp(param->serv_act_res_key,
7508				    lun->per_res[i].res_key.key,
7509				    sizeof(struct scsi_per_res_key)) == 0) {
7510					lun->per_res[i].registered = 0;
7511					memset(&lun->per_res[i].res_key,
7512					       0,
7513					       sizeof(struct scsi_per_res_key));
7514					lun->pr_key_count--;
7515
7516					if (!persis_offset
7517					 && i < CTL_MAX_INITIATORS)
7518						lun->pending_sense[i
7519							].ua_pending |=
7520							CTL_UA_REG_PREEMPT;
7521					else if (persis_offset
7522					      && i >= persis_offset)
7523						lun->pending_sense[
7524						  i-persis_offset].ua_pending |=
7525						  CTL_UA_REG_PREEMPT;
7526				} else if (type != lun->res_type
7527					&& (lun->res_type == SPR_TYPE_WR_EX_RO
7528					 || lun->res_type ==SPR_TYPE_EX_AC_RO)){
7529						if (!persis_offset
7530						 && i < CTL_MAX_INITIATORS)
7531							lun->pending_sense[i
7532							].ua_pending |=
7533							CTL_UA_RES_RELEASE;
7534						else if (persis_offset
7535						      && i >= persis_offset)
7536							lun->pending_sense[
7537							i-persis_offset
7538							].ua_pending |=
7539							CTL_UA_RES_RELEASE;
7540				}
7541			}
7542			lun->per_res[residx].registered = 1;
7543			lun->res_type = type;
7544			if (lun->res_type != SPR_TYPE_WR_EX_AR
7545			 && lun->res_type != SPR_TYPE_EX_AC_AR)
7546				lun->pr_res_idx = residx;
7547			else
7548				lun->pr_res_idx =
7549					CTL_PR_ALL_REGISTRANTS;
7550
7551			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7552			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7553			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
7554			persis_io.pr.pr_info.residx = lun->pr_res_idx;
7555			persis_io.pr.pr_info.res_type = type;
7556			memcpy(persis_io.pr.pr_info.sa_res_key,
7557			       param->serv_act_res_key,
7558			       sizeof(param->serv_act_res_key));
7559			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7560			     &persis_io, sizeof(persis_io), 0)) >
7561			     CTL_HA_STATUS_SUCCESS) {
7562				printf("CTL:Persis Out error returned "
7563				       "from ctl_ha_msg_send %d\n",
7564				       isc_retval);
7565			}
7566		} else {
7567			/*
7568			 * sa_res_key is not the res holder just
7569			 * remove registrants
7570			 */
7571			int found=0;
7572			mtx_lock(&softc->ctl_lock);
7573
7574			for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7575				if (memcmp(param->serv_act_res_key,
7576				    lun->per_res[i].res_key.key,
7577				    sizeof(struct scsi_per_res_key)) != 0)
7578					continue;
7579
7580				found = 1;
7581				lun->per_res[i].registered = 0;
7582				memset(&lun->per_res[i].res_key, 0,
7583				       sizeof(struct scsi_per_res_key));
7584				lun->pr_key_count--;
7585
7586				if (!persis_offset
7587				 && i < CTL_MAX_INITIATORS)
7588					lun->pending_sense[i].ua_pending |=
7589						CTL_UA_REG_PREEMPT;
7590				else if (persis_offset
7591				      && i >= persis_offset)
7592					lun->pending_sense[
7593						i-persis_offset].ua_pending |=
7594						CTL_UA_REG_PREEMPT;
7595			}
7596
7597			if (!found) {
7598				mtx_unlock(&softc->ctl_lock);
7599				free(ctsio->kern_data_ptr, M_CTL);
7600				ctl_set_reservation_conflict(ctsio);
7601				ctl_done((union ctl_io *)ctsio);
7602		        	return (1);
7603			}
7604			mtx_unlock(&softc->ctl_lock);
7605			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7606			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7607			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
7608			persis_io.pr.pr_info.residx = lun->pr_res_idx;
7609			persis_io.pr.pr_info.res_type = type;
7610			memcpy(persis_io.pr.pr_info.sa_res_key,
7611			       param->serv_act_res_key,
7612			       sizeof(param->serv_act_res_key));
7613			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7614			     &persis_io, sizeof(persis_io), 0)) >
7615			     CTL_HA_STATUS_SUCCESS) {
7616				printf("CTL:Persis Out error returned "
7617				       "from ctl_ha_msg_send %d\n",
7618				isc_retval);
7619			}
7620		}
7621	}
7622
7623	lun->PRGeneration++;
7624
7625	return (retval);
7626}
7627
7628static void
7629ctl_pro_preempt_other(struct ctl_lun *lun, union ctl_ha_msg *msg)
7630{
7631	int i;
7632
7633	if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS
7634	 || lun->pr_res_idx == CTL_PR_NO_RESERVATION
7635	 || memcmp(&lun->per_res[lun->pr_res_idx].res_key,
7636		   msg->pr.pr_info.sa_res_key,
7637		   sizeof(struct scsi_per_res_key)) != 0) {
7638		uint64_t sa_res_key;
7639		sa_res_key = scsi_8btou64(msg->pr.pr_info.sa_res_key);
7640
7641		if (sa_res_key == 0) {
7642			/* temporarily unregister this nexus */
7643			lun->per_res[msg->pr.pr_info.residx].registered = 0;
7644
7645			/*
7646			 * Unregister everybody else and build UA for
7647			 * them
7648			 */
7649			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7650				if (lun->per_res[i].registered == 0)
7651					continue;
7652
7653				if (!persis_offset
7654				 && i < CTL_MAX_INITIATORS)
7655					lun->pending_sense[i].ua_pending |=
7656						CTL_UA_REG_PREEMPT;
7657				else if (persis_offset && i >= persis_offset)
7658					lun->pending_sense[i -
7659						persis_offset].ua_pending |=
7660						CTL_UA_REG_PREEMPT;
7661				lun->per_res[i].registered = 0;
7662				memset(&lun->per_res[i].res_key, 0,
7663				       sizeof(struct scsi_per_res_key));
7664			}
7665
7666			lun->per_res[msg->pr.pr_info.residx].registered = 1;
7667			lun->pr_key_count = 1;
7668			lun->res_type = msg->pr.pr_info.res_type;
7669			if (lun->res_type != SPR_TYPE_WR_EX_AR
7670			 && lun->res_type != SPR_TYPE_EX_AC_AR)
7671				lun->pr_res_idx = msg->pr.pr_info.residx;
7672		} else {
7673		        for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7674				if (memcmp(msg->pr.pr_info.sa_res_key,
7675		                   lun->per_res[i].res_key.key,
7676		                   sizeof(struct scsi_per_res_key)) != 0)
7677					continue;
7678
7679				lun->per_res[i].registered = 0;
7680				memset(&lun->per_res[i].res_key, 0,
7681				       sizeof(struct scsi_per_res_key));
7682				lun->pr_key_count--;
7683
7684				if (!persis_offset
7685				 && i < persis_offset)
7686					lun->pending_sense[i].ua_pending |=
7687						CTL_UA_REG_PREEMPT;
7688				else if (persis_offset
7689				      && i >= persis_offset)
7690					lun->pending_sense[i -
7691						persis_offset].ua_pending |=
7692						CTL_UA_REG_PREEMPT;
7693			}
7694		}
7695	} else {
7696		/*
7697		 * Temporarily unregister so it won't get removed
7698		 * or UA generated
7699		 */
7700		lun->per_res[msg->pr.pr_info.residx].registered = 0;
7701		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
7702			if (lun->per_res[i].registered == 0)
7703				continue;
7704
7705			if (memcmp(msg->pr.pr_info.sa_res_key,
7706	                   lun->per_res[i].res_key.key,
7707	                   sizeof(struct scsi_per_res_key)) == 0) {
7708				lun->per_res[i].registered = 0;
7709				memset(&lun->per_res[i].res_key, 0,
7710				       sizeof(struct scsi_per_res_key));
7711				lun->pr_key_count--;
7712				if (!persis_offset
7713				 && i < CTL_MAX_INITIATORS)
7714					lun->pending_sense[i].ua_pending |=
7715						CTL_UA_REG_PREEMPT;
7716				else if (persis_offset
7717				      && i >= persis_offset)
7718					lun->pending_sense[i -
7719						persis_offset].ua_pending |=
7720						CTL_UA_REG_PREEMPT;
7721			} else if (msg->pr.pr_info.res_type != lun->res_type
7722				&& (lun->res_type == SPR_TYPE_WR_EX_RO
7723				 || lun->res_type == SPR_TYPE_EX_AC_RO)) {
7724					if (!persis_offset
7725					 && i < persis_offset)
7726						lun->pending_sense[i
7727							].ua_pending |=
7728							CTL_UA_RES_RELEASE;
7729					else if (persis_offset
7730					      && i >= persis_offset)
7731					lun->pending_sense[i -
7732						persis_offset].ua_pending |=
7733						CTL_UA_RES_RELEASE;
7734			}
7735		}
7736		lun->per_res[msg->pr.pr_info.residx].registered = 1;
7737		lun->res_type = msg->pr.pr_info.res_type;
7738		if (lun->res_type != SPR_TYPE_WR_EX_AR
7739		 && lun->res_type != SPR_TYPE_EX_AC_AR)
7740			lun->pr_res_idx = msg->pr.pr_info.residx;
7741		else
7742			lun->pr_res_idx = CTL_PR_ALL_REGISTRANTS;
7743	}
7744	lun->PRGeneration++;
7745
7746}
7747
7748
7749int
7750ctl_persistent_reserve_out(struct ctl_scsiio *ctsio)
7751{
7752	int retval;
7753	int isc_retval;
7754	u_int32_t param_len;
7755	struct scsi_per_res_out *cdb;
7756	struct ctl_lun *lun;
7757	struct scsi_per_res_out_parms* param;
7758	struct ctl_softc *softc;
7759	uint32_t residx;
7760	uint64_t res_key, sa_res_key;
7761	uint8_t type;
7762	union ctl_ha_msg persis_io;
7763	int    i;
7764
7765	CTL_DEBUG_PRINT(("ctl_persistent_reserve_out\n"));
7766
7767	retval = CTL_RETVAL_COMPLETE;
7768
7769	softc = control_softc;
7770
7771	cdb = (struct scsi_per_res_out *)ctsio->cdb;
7772	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
7773
7774	/*
7775	 * We only support whole-LUN scope.  The scope & type are ignored for
7776	 * register, register and ignore existing key and clear.
7777	 * We sometimes ignore scope and type on preempts too!!
7778	 * Verify reservation type here as well.
7779	 */
7780	type = cdb->scope_type & SPR_TYPE_MASK;
7781	if ((cdb->action == SPRO_RESERVE)
7782	 || (cdb->action == SPRO_RELEASE)) {
7783		if ((cdb->scope_type & SPR_SCOPE_MASK) != SPR_LU_SCOPE) {
7784			ctl_set_invalid_field(/*ctsio*/ ctsio,
7785					      /*sks_valid*/ 1,
7786					      /*command*/ 1,
7787					      /*field*/ 2,
7788					      /*bit_valid*/ 1,
7789					      /*bit*/ 4);
7790			ctl_done((union ctl_io *)ctsio);
7791			return (CTL_RETVAL_COMPLETE);
7792		}
7793
7794		if (type>8 || type==2 || type==4 || type==0) {
7795			ctl_set_invalid_field(/*ctsio*/ ctsio,
7796					      /*sks_valid*/ 1,
7797					      /*command*/ 1,
7798					      /*field*/ 2,
7799					      /*bit_valid*/ 1,
7800					      /*bit*/ 0);
7801			ctl_done((union ctl_io *)ctsio);
7802			return (CTL_RETVAL_COMPLETE);
7803		}
7804	}
7805
7806	switch (cdb->action & SPRO_ACTION_MASK) {
7807	case SPRO_REGISTER:
7808	case SPRO_RESERVE:
7809	case SPRO_RELEASE:
7810	case SPRO_CLEAR:
7811	case SPRO_PREEMPT:
7812	case SPRO_REG_IGNO:
7813		break;
7814	case SPRO_REG_MOVE:
7815	case SPRO_PRE_ABO:
7816	default:
7817		ctl_set_invalid_field(/*ctsio*/ ctsio,
7818				      /*sks_valid*/ 1,
7819				      /*command*/ 1,
7820				      /*field*/ 1,
7821				      /*bit_valid*/ 1,
7822				      /*bit*/ 0);
7823		ctl_done((union ctl_io *)ctsio);
7824		return (CTL_RETVAL_COMPLETE);
7825		break; /* NOTREACHED */
7826	}
7827
7828	param_len = scsi_4btoul(cdb->length);
7829
7830	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
7831		ctsio->kern_data_ptr = malloc(param_len, M_CTL, M_WAITOK);
7832		ctsio->kern_data_len = param_len;
7833		ctsio->kern_total_len = param_len;
7834		ctsio->kern_data_resid = 0;
7835		ctsio->kern_rel_offset = 0;
7836		ctsio->kern_sg_entries = 0;
7837		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
7838		ctsio->be_move_done = ctl_config_move_done;
7839		ctl_datamove((union ctl_io *)ctsio);
7840
7841		return (CTL_RETVAL_COMPLETE);
7842	}
7843
7844	param = (struct scsi_per_res_out_parms *)ctsio->kern_data_ptr;
7845
7846	residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
7847	res_key = scsi_8btou64(param->res_key.key);
7848	sa_res_key = scsi_8btou64(param->serv_act_res_key);
7849
7850	/*
7851	 * Validate the reservation key here except for SPRO_REG_IGNO
7852	 * This must be done for all other service actions
7853	 */
7854	if ((cdb->action & SPRO_ACTION_MASK) != SPRO_REG_IGNO) {
7855		mtx_lock(&softc->ctl_lock);
7856		if (lun->per_res[residx].registered) {
7857		    if (memcmp(param->res_key.key,
7858			       lun->per_res[residx].res_key.key,
7859			       ctl_min(sizeof(param->res_key),
7860			       sizeof(lun->per_res[residx].res_key))) != 0) {
7861				/*
7862				 * The current key passed in doesn't match
7863				 * the one the initiator previously
7864				 * registered.
7865				 */
7866				mtx_unlock(&softc->ctl_lock);
7867				free(ctsio->kern_data_ptr, M_CTL);
7868				ctl_set_reservation_conflict(ctsio);
7869				ctl_done((union ctl_io *)ctsio);
7870				return (CTL_RETVAL_COMPLETE);
7871			}
7872		} else if ((cdb->action & SPRO_ACTION_MASK) != SPRO_REGISTER) {
7873			/*
7874			 * We are not registered
7875			 */
7876			mtx_unlock(&softc->ctl_lock);
7877			free(ctsio->kern_data_ptr, M_CTL);
7878			ctl_set_reservation_conflict(ctsio);
7879			ctl_done((union ctl_io *)ctsio);
7880			return (CTL_RETVAL_COMPLETE);
7881		} else if (res_key != 0) {
7882			/*
7883			 * We are not registered and trying to register but
7884			 * the register key isn't zero.
7885			 */
7886			mtx_unlock(&softc->ctl_lock);
7887			free(ctsio->kern_data_ptr, M_CTL);
7888			ctl_set_reservation_conflict(ctsio);
7889			ctl_done((union ctl_io *)ctsio);
7890			return (CTL_RETVAL_COMPLETE);
7891		}
7892		mtx_unlock(&softc->ctl_lock);
7893	}
7894
7895	switch (cdb->action & SPRO_ACTION_MASK) {
7896	case SPRO_REGISTER:
7897	case SPRO_REG_IGNO: {
7898
7899#if 0
7900		printf("Registration received\n");
7901#endif
7902
7903		/*
7904		 * We don't support any of these options, as we report in
7905		 * the read capabilities request (see
7906		 * ctl_persistent_reserve_in(), above).
7907		 */
7908		if ((param->flags & SPR_SPEC_I_PT)
7909		 || (param->flags & SPR_ALL_TG_PT)
7910		 || (param->flags & SPR_APTPL)) {
7911			int bit_ptr;
7912
7913			if (param->flags & SPR_APTPL)
7914				bit_ptr = 0;
7915			else if (param->flags & SPR_ALL_TG_PT)
7916				bit_ptr = 2;
7917			else /* SPR_SPEC_I_PT */
7918				bit_ptr = 3;
7919
7920			free(ctsio->kern_data_ptr, M_CTL);
7921			ctl_set_invalid_field(ctsio,
7922					      /*sks_valid*/ 1,
7923					      /*command*/ 0,
7924					      /*field*/ 20,
7925					      /*bit_valid*/ 1,
7926					      /*bit*/ bit_ptr);
7927			ctl_done((union ctl_io *)ctsio);
7928			return (CTL_RETVAL_COMPLETE);
7929		}
7930
7931		mtx_lock(&softc->ctl_lock);
7932
7933		/*
7934		 * The initiator wants to clear the
7935		 * key/unregister.
7936		 */
7937		if (sa_res_key == 0) {
7938			if ((res_key == 0
7939			  && (cdb->action & SPRO_ACTION_MASK) == SPRO_REGISTER)
7940			 || ((cdb->action & SPRO_ACTION_MASK) == SPRO_REG_IGNO
7941			  && !lun->per_res[residx].registered)) {
7942				mtx_unlock(&softc->ctl_lock);
7943				goto done;
7944			}
7945
7946			lun->per_res[residx].registered = 0;
7947			memset(&lun->per_res[residx].res_key,
7948			       0, sizeof(lun->per_res[residx].res_key));
7949			lun->pr_key_count--;
7950
7951			if (residx == lun->pr_res_idx) {
7952				lun->flags &= ~CTL_LUN_PR_RESERVED;
7953				lun->pr_res_idx = CTL_PR_NO_RESERVATION;
7954
7955				if ((lun->res_type == SPR_TYPE_WR_EX_RO
7956				  || lun->res_type == SPR_TYPE_EX_AC_RO)
7957				 && lun->pr_key_count) {
7958					/*
7959					 * If the reservation is a registrants
7960					 * only type we need to generate a UA
7961					 * for other registered inits.  The
7962					 * sense code should be RESERVATIONS
7963					 * RELEASED
7964					 */
7965
7966					for (i = 0; i < CTL_MAX_INITIATORS;i++){
7967						if (lun->per_res[
7968						    i+persis_offset].registered
7969						    == 0)
7970							continue;
7971						lun->pending_sense[i
7972							].ua_pending |=
7973							CTL_UA_RES_RELEASE;
7974					}
7975				}
7976				lun->res_type = 0;
7977			} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
7978				if (lun->pr_key_count==0) {
7979					lun->flags &= ~CTL_LUN_PR_RESERVED;
7980					lun->res_type = 0;
7981					lun->pr_res_idx = CTL_PR_NO_RESERVATION;
7982				}
7983			}
7984			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
7985			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
7986			persis_io.pr.pr_info.action = CTL_PR_UNREG_KEY;
7987			persis_io.pr.pr_info.residx = residx;
7988			if ((isc_retval = ctl_ha_msg_send(CTL_HA_CHAN_CTL,
7989			     &persis_io, sizeof(persis_io), 0 )) >
7990			     CTL_HA_STATUS_SUCCESS) {
7991				printf("CTL:Persis Out error returned from "
7992				       "ctl_ha_msg_send %d\n", isc_retval);
7993			}
7994			mtx_unlock(&softc->ctl_lock);
7995		} else /* sa_res_key != 0 */ {
7996
7997			/*
7998			 * If we aren't registered currently then increment
7999			 * the key count and set the registered flag.
8000			 */
8001			if (!lun->per_res[residx].registered) {
8002				lun->pr_key_count++;
8003				lun->per_res[residx].registered = 1;
8004			}
8005
8006			memcpy(&lun->per_res[residx].res_key,
8007			       param->serv_act_res_key,
8008			       ctl_min(sizeof(param->serv_act_res_key),
8009			       sizeof(lun->per_res[residx].res_key)));
8010
8011			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
8012			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
8013			persis_io.pr.pr_info.action = CTL_PR_REG_KEY;
8014			persis_io.pr.pr_info.residx = residx;
8015			memcpy(persis_io.pr.pr_info.sa_res_key,
8016			       param->serv_act_res_key,
8017			       sizeof(param->serv_act_res_key));
8018			mtx_unlock(&softc->ctl_lock);
8019			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
8020			     &persis_io, sizeof(persis_io), 0)) >
8021			     CTL_HA_STATUS_SUCCESS) {
8022				printf("CTL:Persis Out error returned from "
8023				       "ctl_ha_msg_send %d\n", isc_retval);
8024			}
8025		}
8026		lun->PRGeneration++;
8027
8028		break;
8029	}
8030	case SPRO_RESERVE:
8031#if 0
8032                printf("Reserve executed type %d\n", type);
8033#endif
8034		mtx_lock(&softc->ctl_lock);
8035		if (lun->flags & CTL_LUN_PR_RESERVED) {
8036			/*
8037			 * if this isn't the reservation holder and it's
8038			 * not a "all registrants" type or if the type is
8039			 * different then we have a conflict
8040			 */
8041			if ((lun->pr_res_idx != residx
8042			  && lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS)
8043			 || lun->res_type != type) {
8044				mtx_unlock(&softc->ctl_lock);
8045				free(ctsio->kern_data_ptr, M_CTL);
8046				ctl_set_reservation_conflict(ctsio);
8047				ctl_done((union ctl_io *)ctsio);
8048				return (CTL_RETVAL_COMPLETE);
8049			}
8050			mtx_unlock(&softc->ctl_lock);
8051		} else /* create a reservation */ {
8052			/*
8053			 * If it's not an "all registrants" type record
8054			 * reservation holder
8055			 */
8056			if (type != SPR_TYPE_WR_EX_AR
8057			 && type != SPR_TYPE_EX_AC_AR)
8058				lun->pr_res_idx = residx; /* Res holder */
8059			else
8060				lun->pr_res_idx = CTL_PR_ALL_REGISTRANTS;
8061
8062			lun->flags |= CTL_LUN_PR_RESERVED;
8063			lun->res_type = type;
8064
8065			mtx_unlock(&softc->ctl_lock);
8066
8067			/* send msg to other side */
8068			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
8069			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
8070			persis_io.pr.pr_info.action = CTL_PR_RESERVE;
8071			persis_io.pr.pr_info.residx = lun->pr_res_idx;
8072			persis_io.pr.pr_info.res_type = type;
8073			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
8074			     &persis_io, sizeof(persis_io), 0)) >
8075			     CTL_HA_STATUS_SUCCESS) {
8076				printf("CTL:Persis Out error returned from "
8077				       "ctl_ha_msg_send %d\n", isc_retval);
8078			}
8079		}
8080		break;
8081
8082	case SPRO_RELEASE:
8083		mtx_lock(&softc->ctl_lock);
8084		if ((lun->flags & CTL_LUN_PR_RESERVED) == 0) {
8085			/* No reservation exists return good status */
8086			mtx_unlock(&softc->ctl_lock);
8087			goto done;
8088		}
8089		/*
8090		 * Is this nexus a reservation holder?
8091		 */
8092		if (lun->pr_res_idx != residx
8093		 && lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS) {
8094			/*
8095			 * not a res holder return good status but
8096			 * do nothing
8097			 */
8098			mtx_unlock(&softc->ctl_lock);
8099			goto done;
8100		}
8101
8102		if (lun->res_type != type) {
8103			mtx_unlock(&softc->ctl_lock);
8104			free(ctsio->kern_data_ptr, M_CTL);
8105			ctl_set_illegal_pr_release(ctsio);
8106			ctl_done((union ctl_io *)ctsio);
8107			return (CTL_RETVAL_COMPLETE);
8108		}
8109
8110		/* okay to release */
8111		lun->flags &= ~CTL_LUN_PR_RESERVED;
8112		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8113		lun->res_type = 0;
8114
8115		/*
8116		 * if this isn't an exclusive access
8117		 * res generate UA for all other
8118		 * registrants.
8119		 */
8120		if (type != SPR_TYPE_EX_AC
8121		 && type != SPR_TYPE_WR_EX) {
8122			/*
8123			 * temporarily unregister so we don't generate UA
8124			 */
8125			lun->per_res[residx].registered = 0;
8126
8127			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
8128				if (lun->per_res[i+persis_offset].registered
8129				    == 0)
8130					continue;
8131				lun->pending_sense[i].ua_pending |=
8132					CTL_UA_RES_RELEASE;
8133			}
8134
8135			lun->per_res[residx].registered = 1;
8136		}
8137		mtx_unlock(&softc->ctl_lock);
8138		/* Send msg to other side */
8139		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
8140		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
8141		persis_io.pr.pr_info.action = CTL_PR_RELEASE;
8142		if ((isc_retval=ctl_ha_msg_send( CTL_HA_CHAN_CTL, &persis_io,
8143		     sizeof(persis_io), 0)) > CTL_HA_STATUS_SUCCESS) {
8144			printf("CTL:Persis Out error returned from "
8145			       "ctl_ha_msg_send %d\n", isc_retval);
8146		}
8147		break;
8148
8149	case SPRO_CLEAR:
8150		/* send msg to other side */
8151
8152		mtx_lock(&softc->ctl_lock);
8153		lun->flags &= ~CTL_LUN_PR_RESERVED;
8154		lun->res_type = 0;
8155		lun->pr_key_count = 0;
8156		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8157
8158
8159		memset(&lun->per_res[residx].res_key,
8160		       0, sizeof(lun->per_res[residx].res_key));
8161		lun->per_res[residx].registered = 0;
8162
8163		for (i=0; i < 2*CTL_MAX_INITIATORS; i++)
8164			if (lun->per_res[i].registered) {
8165				if (!persis_offset && i < CTL_MAX_INITIATORS)
8166					lun->pending_sense[i].ua_pending |=
8167						CTL_UA_RES_PREEMPT;
8168				else if (persis_offset && i >= persis_offset)
8169					lun->pending_sense[i-persis_offset
8170					    ].ua_pending |= CTL_UA_RES_PREEMPT;
8171
8172				memset(&lun->per_res[i].res_key,
8173				       0, sizeof(struct scsi_per_res_key));
8174				lun->per_res[i].registered = 0;
8175			}
8176		lun->PRGeneration++;
8177		mtx_unlock(&softc->ctl_lock);
8178		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
8179		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
8180		persis_io.pr.pr_info.action = CTL_PR_CLEAR;
8181		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL, &persis_io,
8182		     sizeof(persis_io), 0)) > CTL_HA_STATUS_SUCCESS) {
8183			printf("CTL:Persis Out error returned from "
8184			       "ctl_ha_msg_send %d\n", isc_retval);
8185		}
8186		break;
8187
8188	case SPRO_PREEMPT: {
8189		int nretval;
8190
8191		nretval = ctl_pro_preempt(softc, lun, res_key, sa_res_key, type,
8192					  residx, ctsio, cdb, param);
8193		if (nretval != 0)
8194			return (CTL_RETVAL_COMPLETE);
8195		break;
8196	}
8197	case SPRO_REG_MOVE:
8198	case SPRO_PRE_ABO:
8199	default:
8200		free(ctsio->kern_data_ptr, M_CTL);
8201		ctl_set_invalid_field(/*ctsio*/ ctsio,
8202				      /*sks_valid*/ 1,
8203				      /*command*/ 1,
8204				      /*field*/ 1,
8205				      /*bit_valid*/ 1,
8206				      /*bit*/ 0);
8207		ctl_done((union ctl_io *)ctsio);
8208		return (CTL_RETVAL_COMPLETE);
8209		break; /* NOTREACHED */
8210	}
8211
8212done:
8213	free(ctsio->kern_data_ptr, M_CTL);
8214	ctl_set_success(ctsio);
8215	ctl_done((union ctl_io *)ctsio);
8216
8217	return (retval);
8218}
8219
8220/*
8221 * This routine is for handling a message from the other SC pertaining to
8222 * persistent reserve out. All the error checking will have been done
8223 * so only perorming the action need be done here to keep the two
8224 * in sync.
8225 */
8226static void
8227ctl_hndl_per_res_out_on_other_sc(union ctl_ha_msg *msg)
8228{
8229	struct ctl_lun *lun;
8230	struct ctl_softc *softc;
8231	int i;
8232
8233	softc = control_softc;
8234
8235	mtx_lock(&softc->ctl_lock);
8236
8237	lun = softc->ctl_luns[msg->hdr.nexus.targ_lun];
8238	switch(msg->pr.pr_info.action) {
8239	case CTL_PR_REG_KEY:
8240		if (!lun->per_res[msg->pr.pr_info.residx].registered) {
8241			lun->per_res[msg->pr.pr_info.residx].registered = 1;
8242			lun->pr_key_count++;
8243		}
8244		lun->PRGeneration++;
8245		memcpy(&lun->per_res[msg->pr.pr_info.residx].res_key,
8246		       msg->pr.pr_info.sa_res_key,
8247		       sizeof(struct scsi_per_res_key));
8248		break;
8249
8250	case CTL_PR_UNREG_KEY:
8251		lun->per_res[msg->pr.pr_info.residx].registered = 0;
8252		memset(&lun->per_res[msg->pr.pr_info.residx].res_key,
8253		       0, sizeof(struct scsi_per_res_key));
8254		lun->pr_key_count--;
8255
8256		/* XXX Need to see if the reservation has been released */
8257		/* if so do we need to generate UA? */
8258		if (msg->pr.pr_info.residx == lun->pr_res_idx) {
8259			lun->flags &= ~CTL_LUN_PR_RESERVED;
8260			lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8261
8262			if ((lun->res_type == SPR_TYPE_WR_EX_RO
8263			  || lun->res_type == SPR_TYPE_EX_AC_RO)
8264			 && lun->pr_key_count) {
8265				/*
8266				 * If the reservation is a registrants
8267				 * only type we need to generate a UA
8268				 * for other registered inits.  The
8269				 * sense code should be RESERVATIONS
8270				 * RELEASED
8271				 */
8272
8273				for (i = 0; i < CTL_MAX_INITIATORS; i++) {
8274					if (lun->per_res[i+
8275					    persis_offset].registered == 0)
8276						continue;
8277
8278					lun->pending_sense[i
8279						].ua_pending |=
8280						CTL_UA_RES_RELEASE;
8281				}
8282			}
8283			lun->res_type = 0;
8284		} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
8285			if (lun->pr_key_count==0) {
8286				lun->flags &= ~CTL_LUN_PR_RESERVED;
8287				lun->res_type = 0;
8288				lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8289			}
8290		}
8291		lun->PRGeneration++;
8292		break;
8293
8294	case CTL_PR_RESERVE:
8295		lun->flags |= CTL_LUN_PR_RESERVED;
8296		lun->res_type = msg->pr.pr_info.res_type;
8297		lun->pr_res_idx = msg->pr.pr_info.residx;
8298
8299		break;
8300
8301	case CTL_PR_RELEASE:
8302		/*
8303		 * if this isn't an exclusive access res generate UA for all
8304		 * other registrants.
8305		 */
8306		if (lun->res_type != SPR_TYPE_EX_AC
8307		 && lun->res_type != SPR_TYPE_WR_EX) {
8308			for (i = 0; i < CTL_MAX_INITIATORS; i++)
8309				if (lun->per_res[i+persis_offset].registered)
8310					lun->pending_sense[i].ua_pending |=
8311						CTL_UA_RES_RELEASE;
8312		}
8313
8314		lun->flags &= ~CTL_LUN_PR_RESERVED;
8315		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8316		lun->res_type = 0;
8317		break;
8318
8319	case CTL_PR_PREEMPT:
8320		ctl_pro_preempt_other(lun, msg);
8321		break;
8322	case CTL_PR_CLEAR:
8323		lun->flags &= ~CTL_LUN_PR_RESERVED;
8324		lun->res_type = 0;
8325		lun->pr_key_count = 0;
8326		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
8327
8328		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
8329			if (lun->per_res[i].registered == 0)
8330				continue;
8331			if (!persis_offset
8332			 && i < CTL_MAX_INITIATORS)
8333				lun->pending_sense[i].ua_pending |=
8334					CTL_UA_RES_PREEMPT;
8335			else if (persis_offset
8336			      && i >= persis_offset)
8337   				lun->pending_sense[i-persis_offset].ua_pending|=
8338					CTL_UA_RES_PREEMPT;
8339			memset(&lun->per_res[i].res_key, 0,
8340			       sizeof(struct scsi_per_res_key));
8341			lun->per_res[i].registered = 0;
8342		}
8343		lun->PRGeneration++;
8344		break;
8345	}
8346
8347	mtx_unlock(&softc->ctl_lock);
8348}
8349
8350int
8351ctl_read_write(struct ctl_scsiio *ctsio)
8352{
8353	struct ctl_lun *lun;
8354	struct ctl_lba_len lbalen;
8355	uint64_t lba;
8356	uint32_t num_blocks;
8357	int reladdr, fua, dpo, ebp;
8358	int retval;
8359	int isread;
8360
8361	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8362
8363	CTL_DEBUG_PRINT(("ctl_read_write: command: %#x\n", ctsio->cdb[0]));
8364
8365	reladdr = 0;
8366	fua = 0;
8367	dpo = 0;
8368	ebp = 0;
8369
8370	retval = CTL_RETVAL_COMPLETE;
8371
8372	isread = ctsio->cdb[0] == READ_6  || ctsio->cdb[0] == READ_10
8373	      || ctsio->cdb[0] == READ_12 || ctsio->cdb[0] == READ_16;
8374	if (lun->flags & CTL_LUN_PR_RESERVED && isread) {
8375		uint32_t residx;
8376
8377		/*
8378		 * XXX KDM need a lock here.
8379		 */
8380		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
8381		if ((lun->res_type == SPR_TYPE_EX_AC
8382		  && residx != lun->pr_res_idx)
8383		 || ((lun->res_type == SPR_TYPE_EX_AC_RO
8384		   || lun->res_type == SPR_TYPE_EX_AC_AR)
8385		  && !lun->per_res[residx].registered)) {
8386			ctl_set_reservation_conflict(ctsio);
8387			ctl_done((union ctl_io *)ctsio);
8388			return (CTL_RETVAL_COMPLETE);
8389	        }
8390	}
8391
8392	switch (ctsio->cdb[0]) {
8393	case READ_6:
8394	case WRITE_6: {
8395		struct scsi_rw_6 *cdb;
8396
8397		cdb = (struct scsi_rw_6 *)ctsio->cdb;
8398
8399		lba = scsi_3btoul(cdb->addr);
8400		/* only 5 bits are valid in the most significant address byte */
8401		lba &= 0x1fffff;
8402		num_blocks = cdb->length;
8403		/*
8404		 * This is correct according to SBC-2.
8405		 */
8406		if (num_blocks == 0)
8407			num_blocks = 256;
8408		break;
8409	}
8410	case READ_10:
8411	case WRITE_10: {
8412		struct scsi_rw_10 *cdb;
8413
8414		cdb = (struct scsi_rw_10 *)ctsio->cdb;
8415
8416		if (cdb->byte2 & SRW10_RELADDR)
8417			reladdr = 1;
8418		if (cdb->byte2 & SRW10_FUA)
8419			fua = 1;
8420		if (cdb->byte2 & SRW10_DPO)
8421			dpo = 1;
8422
8423		if ((cdb->opcode == WRITE_10)
8424		 && (cdb->byte2 & SRW10_EBP))
8425			ebp = 1;
8426
8427		lba = scsi_4btoul(cdb->addr);
8428		num_blocks = scsi_2btoul(cdb->length);
8429		break;
8430	}
8431	case WRITE_VERIFY_10: {
8432		struct scsi_write_verify_10 *cdb;
8433
8434		cdb = (struct scsi_write_verify_10 *)ctsio->cdb;
8435
8436		/*
8437		 * XXX KDM we should do actual write verify support at some
8438		 * point.  This is obviously fake, we're just translating
8439		 * things to a write.  So we don't even bother checking the
8440		 * BYTCHK field, since we don't do any verification.  If
8441		 * the user asks for it, we'll just pretend we did it.
8442		 */
8443		if (cdb->byte2 & SWV_DPO)
8444			dpo = 1;
8445
8446		lba = scsi_4btoul(cdb->addr);
8447		num_blocks = scsi_2btoul(cdb->length);
8448		break;
8449	}
8450	case READ_12:
8451	case WRITE_12: {
8452		struct scsi_rw_12 *cdb;
8453
8454		cdb = (struct scsi_rw_12 *)ctsio->cdb;
8455
8456		if (cdb->byte2 & SRW12_RELADDR)
8457			reladdr = 1;
8458		if (cdb->byte2 & SRW12_FUA)
8459			fua = 1;
8460		if (cdb->byte2 & SRW12_DPO)
8461			dpo = 1;
8462		lba = scsi_4btoul(cdb->addr);
8463		num_blocks = scsi_4btoul(cdb->length);
8464		break;
8465	}
8466	case WRITE_VERIFY_12: {
8467		struct scsi_write_verify_12 *cdb;
8468
8469		cdb = (struct scsi_write_verify_12 *)ctsio->cdb;
8470
8471		if (cdb->byte2 & SWV_DPO)
8472			dpo = 1;
8473
8474		lba = scsi_4btoul(cdb->addr);
8475		num_blocks = scsi_4btoul(cdb->length);
8476
8477		break;
8478	}
8479	case READ_16:
8480	case WRITE_16: {
8481		struct scsi_rw_16 *cdb;
8482
8483		cdb = (struct scsi_rw_16 *)ctsio->cdb;
8484
8485		if (cdb->byte2 & SRW12_RELADDR)
8486			reladdr = 1;
8487		if (cdb->byte2 & SRW12_FUA)
8488			fua = 1;
8489		if (cdb->byte2 & SRW12_DPO)
8490			dpo = 1;
8491
8492		lba = scsi_8btou64(cdb->addr);
8493		num_blocks = scsi_4btoul(cdb->length);
8494		break;
8495	}
8496	case WRITE_VERIFY_16: {
8497		struct scsi_write_verify_16 *cdb;
8498
8499		cdb = (struct scsi_write_verify_16 *)ctsio->cdb;
8500
8501		if (cdb->byte2 & SWV_DPO)
8502			dpo = 1;
8503
8504		lba = scsi_8btou64(cdb->addr);
8505		num_blocks = scsi_4btoul(cdb->length);
8506		break;
8507	}
8508	default:
8509		/*
8510		 * We got a command we don't support.  This shouldn't
8511		 * happen, commands should be filtered out above us.
8512		 */
8513		ctl_set_invalid_opcode(ctsio);
8514		ctl_done((union ctl_io *)ctsio);
8515
8516		return (CTL_RETVAL_COMPLETE);
8517		break; /* NOTREACHED */
8518	}
8519
8520	/*
8521	 * XXX KDM what do we do with the DPO and FUA bits?  FUA might be
8522	 * interesting for us, but if RAIDCore is in write-back mode,
8523	 * getting it to do write-through for a particular transaction may
8524	 * not be possible.
8525	 */
8526	/*
8527	 * We don't support relative addressing.  That also requires
8528	 * supporting linked commands, which we don't do.
8529	 */
8530	if (reladdr != 0) {
8531		ctl_set_invalid_field(ctsio,
8532				      /*sks_valid*/ 1,
8533				      /*command*/ 1,
8534				      /*field*/ 1,
8535				      /*bit_valid*/ 1,
8536				      /*bit*/ 0);
8537		ctl_done((union ctl_io *)ctsio);
8538		return (CTL_RETVAL_COMPLETE);
8539	}
8540
8541	/*
8542	 * The first check is to make sure we're in bounds, the second
8543	 * check is to catch wrap-around problems.  If the lba + num blocks
8544	 * is less than the lba, then we've wrapped around and the block
8545	 * range is invalid anyway.
8546	 */
8547	if (((lba + num_blocks) > (lun->be_lun->maxlba + 1))
8548	 || ((lba + num_blocks) < lba)) {
8549		ctl_set_lba_out_of_range(ctsio);
8550		ctl_done((union ctl_io *)ctsio);
8551		return (CTL_RETVAL_COMPLETE);
8552	}
8553
8554	/*
8555	 * According to SBC-3, a transfer length of 0 is not an error.
8556	 * Note that this cannot happen with WRITE(6) or READ(6), since 0
8557	 * translates to 256 blocks for those commands.
8558	 */
8559	if (num_blocks == 0) {
8560		ctl_set_success(ctsio);
8561		ctl_done((union ctl_io *)ctsio);
8562		return (CTL_RETVAL_COMPLETE);
8563	}
8564
8565	lbalen.lba = lba;
8566	lbalen.len = num_blocks;
8567	memcpy(ctsio->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes, &lbalen,
8568	       sizeof(lbalen));
8569
8570	CTL_DEBUG_PRINT(("ctl_read_write: calling data_submit()\n"));
8571
8572	retval = lun->backend->data_submit((union ctl_io *)ctsio);
8573
8574	return (retval);
8575}
8576
8577int
8578ctl_report_luns(struct ctl_scsiio *ctsio)
8579{
8580	struct scsi_report_luns *cdb;
8581	struct scsi_report_luns_data *lun_data;
8582	struct ctl_lun *lun, *request_lun;
8583	int num_luns, retval;
8584	uint32_t alloc_len, lun_datalen;
8585	int num_filled, well_known;
8586	uint32_t initidx;
8587
8588	retval = CTL_RETVAL_COMPLETE;
8589	well_known = 0;
8590
8591	cdb = (struct scsi_report_luns *)ctsio->cdb;
8592
8593	CTL_DEBUG_PRINT(("ctl_report_luns\n"));
8594
8595	mtx_lock(&control_softc->ctl_lock);
8596	num_luns = control_softc->num_luns;
8597	mtx_unlock(&control_softc->ctl_lock);
8598
8599	switch (cdb->select_report) {
8600	case RPL_REPORT_DEFAULT:
8601	case RPL_REPORT_ALL:
8602		break;
8603	case RPL_REPORT_WELLKNOWN:
8604		well_known = 1;
8605		num_luns = 0;
8606		break;
8607	default:
8608		ctl_set_invalid_field(ctsio,
8609				      /*sks_valid*/ 1,
8610				      /*command*/ 1,
8611				      /*field*/ 2,
8612				      /*bit_valid*/ 0,
8613				      /*bit*/ 0);
8614		ctl_done((union ctl_io *)ctsio);
8615		return (retval);
8616		break; /* NOTREACHED */
8617	}
8618
8619	alloc_len = scsi_4btoul(cdb->length);
8620	/*
8621	 * The initiator has to allocate at least 16 bytes for this request,
8622	 * so he can at least get the header and the first LUN.  Otherwise
8623	 * we reject the request (per SPC-3 rev 14, section 6.21).
8624	 */
8625	if (alloc_len < (sizeof(struct scsi_report_luns_data) +
8626	    sizeof(struct scsi_report_luns_lundata))) {
8627		ctl_set_invalid_field(ctsio,
8628				      /*sks_valid*/ 1,
8629				      /*command*/ 1,
8630				      /*field*/ 6,
8631				      /*bit_valid*/ 0,
8632				      /*bit*/ 0);
8633		ctl_done((union ctl_io *)ctsio);
8634		return (retval);
8635	}
8636
8637	request_lun = (struct ctl_lun *)
8638		ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8639
8640	lun_datalen = sizeof(*lun_data) +
8641		(num_luns * sizeof(struct scsi_report_luns_lundata));
8642
8643	ctsio->kern_data_ptr = malloc(lun_datalen, M_CTL, M_WAITOK | M_ZERO);
8644	lun_data = (struct scsi_report_luns_data *)ctsio->kern_data_ptr;
8645	ctsio->kern_sg_entries = 0;
8646
8647	if (lun_datalen < alloc_len) {
8648		ctsio->residual = alloc_len - lun_datalen;
8649		ctsio->kern_data_len = lun_datalen;
8650		ctsio->kern_total_len = lun_datalen;
8651	} else {
8652		ctsio->residual = 0;
8653		ctsio->kern_data_len = alloc_len;
8654		ctsio->kern_total_len = alloc_len;
8655	}
8656	ctsio->kern_data_resid = 0;
8657	ctsio->kern_rel_offset = 0;
8658	ctsio->kern_sg_entries = 0;
8659
8660	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
8661
8662	/*
8663	 * We set this to the actual data length, regardless of how much
8664	 * space we actually have to return results.  If the user looks at
8665	 * this value, he'll know whether or not he allocated enough space
8666	 * and reissue the command if necessary.  We don't support well
8667	 * known logical units, so if the user asks for that, return none.
8668	 */
8669	scsi_ulto4b(lun_datalen - 8, lun_data->length);
8670
8671	mtx_lock(&control_softc->ctl_lock);
8672	for (num_filled = 0, lun = STAILQ_FIRST(&control_softc->lun_list);
8673	     (lun != NULL) && (num_filled < num_luns);
8674	     lun = STAILQ_NEXT(lun, links)) {
8675
8676		if (lun->lun <= 0xff) {
8677			/*
8678			 * Peripheral addressing method, bus number 0.
8679			 */
8680			lun_data->luns[num_filled].lundata[0] =
8681				RPL_LUNDATA_ATYP_PERIPH;
8682			lun_data->luns[num_filled].lundata[1] = lun->lun;
8683			num_filled++;
8684		} else if (lun->lun <= 0x3fff) {
8685			/*
8686			 * Flat addressing method.
8687			 */
8688			lun_data->luns[num_filled].lundata[0] =
8689				RPL_LUNDATA_ATYP_FLAT |
8690				(lun->lun & RPL_LUNDATA_FLAT_LUN_MASK);
8691#ifdef OLDCTLHEADERS
8692				(SRLD_ADDR_FLAT << SRLD_ADDR_SHIFT) |
8693				(lun->lun & SRLD_BUS_LUN_MASK);
8694#endif
8695			lun_data->luns[num_filled].lundata[1] =
8696#ifdef OLDCTLHEADERS
8697				lun->lun >> SRLD_BUS_LUN_BITS;
8698#endif
8699				lun->lun >> RPL_LUNDATA_FLAT_LUN_BITS;
8700			num_filled++;
8701		} else {
8702			printf("ctl_report_luns: bogus LUN number %jd, "
8703			       "skipping\n", (intmax_t)lun->lun);
8704		}
8705		/*
8706		 * According to SPC-3, rev 14 section 6.21:
8707		 *
8708		 * "The execution of a REPORT LUNS command to any valid and
8709		 * installed logical unit shall clear the REPORTED LUNS DATA
8710		 * HAS CHANGED unit attention condition for all logical
8711		 * units of that target with respect to the requesting
8712		 * initiator. A valid and installed logical unit is one
8713		 * having a PERIPHERAL QUALIFIER of 000b in the standard
8714		 * INQUIRY data (see 6.4.2)."
8715		 *
8716		 * If request_lun is NULL, the LUN this report luns command
8717		 * was issued to is either disabled or doesn't exist. In that
8718		 * case, we shouldn't clear any pending lun change unit
8719		 * attention.
8720		 */
8721		if (request_lun != NULL)
8722			lun->pending_sense[initidx].ua_pending &=
8723				~CTL_UA_LUN_CHANGE;
8724	}
8725	mtx_unlock(&control_softc->ctl_lock);
8726
8727	/*
8728	 * We can only return SCSI_STATUS_CHECK_COND when we can't satisfy
8729	 * this request.
8730	 */
8731	ctsio->scsi_status = SCSI_STATUS_OK;
8732
8733	ctsio->be_move_done = ctl_config_move_done;
8734	ctl_datamove((union ctl_io *)ctsio);
8735
8736	return (retval);
8737}
8738
8739int
8740ctl_request_sense(struct ctl_scsiio *ctsio)
8741{
8742	struct scsi_request_sense *cdb;
8743	struct scsi_sense_data *sense_ptr;
8744	struct ctl_lun *lun;
8745	uint32_t initidx;
8746	int have_error;
8747	scsi_sense_data_type sense_format;
8748
8749	cdb = (struct scsi_request_sense *)ctsio->cdb;
8750
8751	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8752
8753	CTL_DEBUG_PRINT(("ctl_request_sense\n"));
8754
8755	/*
8756	 * Determine which sense format the user wants.
8757	 */
8758	if (cdb->byte2 & SRS_DESC)
8759		sense_format = SSD_TYPE_DESC;
8760	else
8761		sense_format = SSD_TYPE_FIXED;
8762
8763	ctsio->kern_data_ptr = malloc(sizeof(*sense_ptr), M_CTL, M_WAITOK);
8764	sense_ptr = (struct scsi_sense_data *)ctsio->kern_data_ptr;
8765	ctsio->kern_sg_entries = 0;
8766
8767	/*
8768	 * struct scsi_sense_data, which is currently set to 256 bytes, is
8769	 * larger than the largest allowed value for the length field in the
8770	 * REQUEST SENSE CDB, which is 252 bytes as of SPC-4.
8771	 */
8772	ctsio->residual = 0;
8773	ctsio->kern_data_len = cdb->length;
8774	ctsio->kern_total_len = cdb->length;
8775
8776	ctsio->kern_data_resid = 0;
8777	ctsio->kern_rel_offset = 0;
8778	ctsio->kern_sg_entries = 0;
8779
8780	/*
8781	 * If we don't have a LUN, we don't have any pending sense.
8782	 */
8783	if (lun == NULL)
8784		goto no_sense;
8785
8786	have_error = 0;
8787	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
8788	/*
8789	 * Check for pending sense, and then for pending unit attentions.
8790	 * Pending sense gets returned first, then pending unit attentions.
8791	 */
8792	mtx_lock(&lun->ctl_softc->ctl_lock);
8793	if (ctl_is_set(lun->have_ca, initidx)) {
8794		scsi_sense_data_type stored_format;
8795
8796		/*
8797		 * Check to see which sense format was used for the stored
8798		 * sense data.
8799		 */
8800		stored_format = scsi_sense_type(
8801		    &lun->pending_sense[initidx].sense);
8802
8803		/*
8804		 * If the user requested a different sense format than the
8805		 * one we stored, then we need to convert it to the other
8806		 * format.  If we're going from descriptor to fixed format
8807		 * sense data, we may lose things in translation, depending
8808		 * on what options were used.
8809		 *
8810		 * If the stored format is SSD_TYPE_NONE (i.e. invalid),
8811		 * for some reason we'll just copy it out as-is.
8812		 */
8813		if ((stored_format == SSD_TYPE_FIXED)
8814		 && (sense_format == SSD_TYPE_DESC))
8815			ctl_sense_to_desc((struct scsi_sense_data_fixed *)
8816			    &lun->pending_sense[initidx].sense,
8817			    (struct scsi_sense_data_desc *)sense_ptr);
8818		else if ((stored_format == SSD_TYPE_DESC)
8819		      && (sense_format == SSD_TYPE_FIXED))
8820			ctl_sense_to_fixed((struct scsi_sense_data_desc *)
8821			    &lun->pending_sense[initidx].sense,
8822			    (struct scsi_sense_data_fixed *)sense_ptr);
8823		else
8824			memcpy(sense_ptr, &lun->pending_sense[initidx].sense,
8825			       ctl_min(sizeof(*sense_ptr),
8826			       sizeof(lun->pending_sense[initidx].sense)));
8827
8828		ctl_clear_mask(lun->have_ca, initidx);
8829		have_error = 1;
8830	} else if (lun->pending_sense[initidx].ua_pending != CTL_UA_NONE) {
8831		ctl_ua_type ua_type;
8832
8833		ua_type = ctl_build_ua(lun->pending_sense[initidx].ua_pending,
8834				       sense_ptr, sense_format);
8835		if (ua_type != CTL_UA_NONE) {
8836			have_error = 1;
8837			/* We're reporting this UA, so clear it */
8838			lun->pending_sense[initidx].ua_pending &= ~ua_type;
8839		}
8840	}
8841	mtx_unlock(&lun->ctl_softc->ctl_lock);
8842
8843	/*
8844	 * We already have a pending error, return it.
8845	 */
8846	if (have_error != 0) {
8847		/*
8848		 * We report the SCSI status as OK, since the status of the
8849		 * request sense command itself is OK.
8850		 */
8851		ctsio->scsi_status = SCSI_STATUS_OK;
8852
8853		/*
8854		 * We report 0 for the sense length, because we aren't doing
8855		 * autosense in this case.  We're reporting sense as
8856		 * parameter data.
8857		 */
8858		ctsio->sense_len = 0;
8859
8860		ctsio->be_move_done = ctl_config_move_done;
8861		ctl_datamove((union ctl_io *)ctsio);
8862
8863		return (CTL_RETVAL_COMPLETE);
8864	}
8865
8866no_sense:
8867
8868	/*
8869	 * No sense information to report, so we report that everything is
8870	 * okay.
8871	 */
8872	ctl_set_sense_data(sense_ptr,
8873			   lun,
8874			   sense_format,
8875			   /*current_error*/ 1,
8876			   /*sense_key*/ SSD_KEY_NO_SENSE,
8877			   /*asc*/ 0x00,
8878			   /*ascq*/ 0x00,
8879			   SSD_ELEM_NONE);
8880
8881	ctsio->scsi_status = SCSI_STATUS_OK;
8882
8883	/*
8884	 * We report 0 for the sense length, because we aren't doing
8885	 * autosense in this case.  We're reporting sense as parameter data.
8886	 */
8887	ctsio->sense_len = 0;
8888	ctsio->be_move_done = ctl_config_move_done;
8889	ctl_datamove((union ctl_io *)ctsio);
8890
8891	return (CTL_RETVAL_COMPLETE);
8892}
8893
8894int
8895ctl_tur(struct ctl_scsiio *ctsio)
8896{
8897	struct ctl_lun *lun;
8898
8899	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8900
8901	CTL_DEBUG_PRINT(("ctl_tur\n"));
8902
8903	if (lun == NULL)
8904		return (-EINVAL);
8905
8906	ctsio->scsi_status = SCSI_STATUS_OK;
8907	ctsio->io_hdr.status = CTL_SUCCESS;
8908
8909	ctl_done((union ctl_io *)ctsio);
8910
8911	return (CTL_RETVAL_COMPLETE);
8912}
8913
8914#ifdef notyet
8915static int
8916ctl_cmddt_inquiry(struct ctl_scsiio *ctsio)
8917{
8918
8919}
8920#endif
8921
8922static int
8923ctl_inquiry_evpd_supported(struct ctl_scsiio *ctsio, int alloc_len)
8924{
8925	struct scsi_vpd_supported_pages *pages;
8926	int sup_page_size;
8927	struct ctl_lun *lun;
8928
8929	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8930
8931	sup_page_size = sizeof(struct scsi_vpd_supported_pages) +
8932		SCSI_EVPD_NUM_SUPPORTED_PAGES;
8933	ctsio->kern_data_ptr = malloc(sup_page_size, M_CTL, M_WAITOK | M_ZERO);
8934	pages = (struct scsi_vpd_supported_pages *)ctsio->kern_data_ptr;
8935	ctsio->kern_sg_entries = 0;
8936
8937	if (sup_page_size < alloc_len) {
8938		ctsio->residual = alloc_len - sup_page_size;
8939		ctsio->kern_data_len = sup_page_size;
8940		ctsio->kern_total_len = sup_page_size;
8941	} else {
8942		ctsio->residual = 0;
8943		ctsio->kern_data_len = alloc_len;
8944		ctsio->kern_total_len = alloc_len;
8945	}
8946	ctsio->kern_data_resid = 0;
8947	ctsio->kern_rel_offset = 0;
8948	ctsio->kern_sg_entries = 0;
8949
8950	/*
8951	 * The control device is always connected.  The disk device, on the
8952	 * other hand, may not be online all the time.  Need to change this
8953	 * to figure out whether the disk device is actually online or not.
8954	 */
8955	if (lun != NULL)
8956		pages->device = (SID_QUAL_LU_CONNECTED << 5) |
8957				lun->be_lun->lun_type;
8958	else
8959		pages->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
8960
8961	pages->length = SCSI_EVPD_NUM_SUPPORTED_PAGES;
8962	/* Supported VPD pages */
8963	pages->page_list[0] = SVPD_SUPPORTED_PAGES;
8964	/* Serial Number */
8965	pages->page_list[1] = SVPD_UNIT_SERIAL_NUMBER;
8966	/* Device Identification */
8967	pages->page_list[2] = SVPD_DEVICE_ID;
8968
8969	ctsio->scsi_status = SCSI_STATUS_OK;
8970
8971	ctsio->be_move_done = ctl_config_move_done;
8972	ctl_datamove((union ctl_io *)ctsio);
8973
8974	return (CTL_RETVAL_COMPLETE);
8975}
8976
8977static int
8978ctl_inquiry_evpd_serial(struct ctl_scsiio *ctsio, int alloc_len)
8979{
8980	struct scsi_vpd_unit_serial_number *sn_ptr;
8981	struct ctl_lun *lun;
8982#ifndef CTL_USE_BACKEND_SN
8983	char tmpstr[32];
8984#endif
8985
8986	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
8987
8988	ctsio->kern_data_ptr = malloc(sizeof(*sn_ptr), M_CTL, M_WAITOK | M_ZERO);
8989	sn_ptr = (struct scsi_vpd_unit_serial_number *)ctsio->kern_data_ptr;
8990	ctsio->kern_sg_entries = 0;
8991
8992	if (sizeof(*sn_ptr) < alloc_len) {
8993		ctsio->residual = alloc_len - sizeof(*sn_ptr);
8994		ctsio->kern_data_len = sizeof(*sn_ptr);
8995		ctsio->kern_total_len = sizeof(*sn_ptr);
8996	} else {
8997		ctsio->residual = 0;
8998		ctsio->kern_data_len = alloc_len;
8999		ctsio->kern_total_len = alloc_len;
9000	}
9001	ctsio->kern_data_resid = 0;
9002	ctsio->kern_rel_offset = 0;
9003	ctsio->kern_sg_entries = 0;
9004
9005	/*
9006	 * The control device is always connected.  The disk device, on the
9007	 * other hand, may not be online all the time.  Need to change this
9008	 * to figure out whether the disk device is actually online or not.
9009	 */
9010	if (lun != NULL)
9011		sn_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
9012				  lun->be_lun->lun_type;
9013	else
9014		sn_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
9015
9016	sn_ptr->page_code = SVPD_UNIT_SERIAL_NUMBER;
9017	sn_ptr->length = ctl_min(sizeof(*sn_ptr) - 4, CTL_SN_LEN);
9018#ifdef CTL_USE_BACKEND_SN
9019	/*
9020	 * If we don't have a LUN, we just leave the serial number as
9021	 * all spaces.
9022	 */
9023	memset(sn_ptr->serial_num, 0x20, sizeof(sn_ptr->serial_num));
9024	if (lun != NULL) {
9025		strncpy((char *)sn_ptr->serial_num,
9026			(char *)lun->be_lun->serial_num, CTL_SN_LEN);
9027	}
9028#else
9029	/*
9030	 * Note that we're using a non-unique serial number here,
9031	 */
9032	snprintf(tmpstr, sizeof(tmpstr), "MYSERIALNUMIS000");
9033	memset(sn_ptr->serial_num, 0x20, sizeof(sn_ptr->serial_num));
9034	strncpy(sn_ptr->serial_num, tmpstr, ctl_min(CTL_SN_LEN,
9035		ctl_min(sizeof(tmpstr), sizeof(*sn_ptr) - 4)));
9036#endif
9037	ctsio->scsi_status = SCSI_STATUS_OK;
9038
9039	ctsio->be_move_done = ctl_config_move_done;
9040	ctl_datamove((union ctl_io *)ctsio);
9041
9042	return (CTL_RETVAL_COMPLETE);
9043}
9044
9045
9046static int
9047ctl_inquiry_evpd_devid(struct ctl_scsiio *ctsio, int alloc_len)
9048{
9049	struct scsi_vpd_device_id *devid_ptr;
9050	struct scsi_vpd_id_descriptor *desc, *desc1;
9051	struct scsi_vpd_id_descriptor *desc2, *desc3; /* for types 4h and 5h */
9052	struct scsi_vpd_id_t10 *t10id;
9053	struct ctl_softc *ctl_softc;
9054	struct ctl_lun *lun;
9055	struct ctl_frontend *fe;
9056#ifndef CTL_USE_BACKEND_SN
9057	char tmpstr[32];
9058#endif /* CTL_USE_BACKEND_SN */
9059	int devid_len;
9060
9061	ctl_softc = control_softc;
9062	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
9063
9064	devid_len = sizeof(struct scsi_vpd_device_id) +
9065		sizeof(struct scsi_vpd_id_descriptor) +
9066		sizeof(struct scsi_vpd_id_t10) + CTL_DEVID_LEN +
9067		sizeof(struct scsi_vpd_id_descriptor) + CTL_WWPN_LEN +
9068		sizeof(struct scsi_vpd_id_descriptor) +
9069		sizeof(struct scsi_vpd_id_rel_trgt_port_id) +
9070		sizeof(struct scsi_vpd_id_descriptor) +
9071		sizeof(struct scsi_vpd_id_trgt_port_grp_id);
9072
9073	ctsio->kern_data_ptr = malloc(devid_len, M_CTL, M_WAITOK | M_ZERO);
9074	devid_ptr = (struct scsi_vpd_device_id *)ctsio->kern_data_ptr;
9075	ctsio->kern_sg_entries = 0;
9076
9077	if (devid_len < alloc_len) {
9078		ctsio->residual = alloc_len - devid_len;
9079		ctsio->kern_data_len = devid_len;
9080		ctsio->kern_total_len = devid_len;
9081	} else {
9082		ctsio->residual = 0;
9083		ctsio->kern_data_len = alloc_len;
9084		ctsio->kern_total_len = alloc_len;
9085	}
9086	ctsio->kern_data_resid = 0;
9087	ctsio->kern_rel_offset = 0;
9088	ctsio->kern_sg_entries = 0;
9089
9090	desc = (struct scsi_vpd_id_descriptor *)devid_ptr->desc_list;
9091	t10id = (struct scsi_vpd_id_t10 *)&desc->identifier[0];
9092	desc1 = (struct scsi_vpd_id_descriptor *)(&desc->identifier[0] +
9093		sizeof(struct scsi_vpd_id_t10) + CTL_DEVID_LEN);
9094	desc2 = (struct scsi_vpd_id_descriptor *)(&desc1->identifier[0] +
9095	          CTL_WWPN_LEN);
9096	desc3 = (struct scsi_vpd_id_descriptor *)(&desc2->identifier[0] +
9097	         sizeof(struct scsi_vpd_id_rel_trgt_port_id));
9098
9099	/*
9100	 * The control device is always connected.  The disk device, on the
9101	 * other hand, may not be online all the time.
9102	 */
9103	if (lun != NULL)
9104		devid_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
9105				     lun->be_lun->lun_type;
9106	else
9107		devid_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
9108
9109	devid_ptr->page_code = SVPD_DEVICE_ID;
9110
9111	scsi_ulto2b(devid_len - 4, devid_ptr->length);
9112
9113	mtx_lock(&ctl_softc->ctl_lock);
9114
9115	fe = ctl_softc->ctl_ports[ctl_port_idx(ctsio->io_hdr.nexus.targ_port)];
9116
9117	/*
9118	 * For Fibre channel,
9119	 */
9120	if (fe->port_type == CTL_PORT_FC)
9121	{
9122		desc->proto_codeset = (SCSI_PROTO_FC << 4) |
9123				      SVPD_ID_CODESET_ASCII;
9124        	desc1->proto_codeset = (SCSI_PROTO_FC << 4) |
9125		              SVPD_ID_CODESET_BINARY;
9126	}
9127	else
9128	{
9129		desc->proto_codeset = (SCSI_PROTO_SPI << 4) |
9130				      SVPD_ID_CODESET_ASCII;
9131        	desc1->proto_codeset = (SCSI_PROTO_SPI << 4) |
9132		              SVPD_ID_CODESET_BINARY;
9133	}
9134	desc2->proto_codeset = desc3->proto_codeset = desc1->proto_codeset;
9135	mtx_unlock(&ctl_softc->ctl_lock);
9136
9137	/*
9138	 * We're using a LUN association here.  i.e., this device ID is a
9139	 * per-LUN identifier.
9140	 */
9141	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_LUN | SVPD_ID_TYPE_T10;
9142	desc->length = sizeof(*t10id) + CTL_DEVID_LEN;
9143	strncpy((char *)t10id->vendor, CTL_VENDOR, sizeof(t10id->vendor));
9144
9145	/*
9146	 * desc1 is for the WWPN which is a port asscociation.
9147	 */
9148	desc1->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT | SVPD_ID_TYPE_NAA;
9149	desc1->length = CTL_WWPN_LEN;
9150	/* XXX Call Reggie's get_WWNN func here then add port # to the end */
9151	/* For testing just create the WWPN */
9152#if 0
9153	ddb_GetWWNN((char *)desc1->identifier);
9154
9155	/* NOTE: if the port is 0 or 8 we don't want to subtract 1 */
9156	/* This is so Copancontrol will return something sane */
9157	if (ctsio->io_hdr.nexus.targ_port!=0 &&
9158	    ctsio->io_hdr.nexus.targ_port!=8)
9159		desc1->identifier[7] += ctsio->io_hdr.nexus.targ_port-1;
9160	else
9161		desc1->identifier[7] += ctsio->io_hdr.nexus.targ_port;
9162#endif
9163
9164	be64enc(desc1->identifier, fe->wwpn);
9165
9166	/*
9167	 * desc2 is for the Relative Target Port(type 4h) identifier
9168	 */
9169	desc2->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT
9170	                 | SVPD_ID_TYPE_RELTARG;
9171	desc2->length = 4;
9172//#if 0
9173	/* NOTE: if the port is 0 or 8 we don't want to subtract 1 */
9174	/* This is so Copancontrol will return something sane */
9175	if (ctsio->io_hdr.nexus.targ_port!=0 &&
9176	    ctsio->io_hdr.nexus.targ_port!=8)
9177		desc2->identifier[3] = ctsio->io_hdr.nexus.targ_port - 1;
9178	else
9179	        desc2->identifier[3] = ctsio->io_hdr.nexus.targ_port;
9180//#endif
9181
9182	/*
9183	 * desc3 is for the Target Port Group(type 5h) identifier
9184	 */
9185	desc3->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT
9186	                 | SVPD_ID_TYPE_TPORTGRP;
9187	desc3->length = 4;
9188	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS || ctl_is_single)
9189		desc3->identifier[3] = 1;
9190	else
9191		desc3->identifier[3] = 2;
9192
9193#ifdef CTL_USE_BACKEND_SN
9194	/*
9195	 * If we've actually got a backend, copy the device id from the
9196	 * per-LUN data.  Otherwise, set it to all spaces.
9197	 */
9198	if (lun != NULL) {
9199		/*
9200		 * Copy the backend's LUN ID.
9201		 */
9202		strncpy((char *)t10id->vendor_spec_id,
9203			(char *)lun->be_lun->device_id, CTL_DEVID_LEN);
9204	} else {
9205		/*
9206		 * No backend, set this to spaces.
9207		 */
9208		memset(t10id->vendor_spec_id, 0x20, CTL_DEVID_LEN);
9209	}
9210#else
9211	snprintf(tmpstr, sizeof(tmpstr), "MYDEVICEIDIS%4d",
9212		 (lun != NULL) ?  (int)lun->lun : 0);
9213	strncpy(t10id->vendor_spec_id, tmpstr, ctl_min(CTL_DEVID_LEN,
9214		sizeof(tmpstr)));
9215#endif
9216
9217	ctsio->scsi_status = SCSI_STATUS_OK;
9218
9219	ctsio->be_move_done = ctl_config_move_done;
9220	ctl_datamove((union ctl_io *)ctsio);
9221
9222	return (CTL_RETVAL_COMPLETE);
9223}
9224
9225static int
9226ctl_inquiry_evpd(struct ctl_scsiio *ctsio)
9227{
9228	struct scsi_inquiry *cdb;
9229	int alloc_len, retval;
9230
9231	cdb = (struct scsi_inquiry *)ctsio->cdb;
9232
9233	retval = CTL_RETVAL_COMPLETE;
9234
9235	alloc_len = scsi_2btoul(cdb->length);
9236
9237	switch (cdb->page_code) {
9238	case SVPD_SUPPORTED_PAGES:
9239		retval = ctl_inquiry_evpd_supported(ctsio, alloc_len);
9240		break;
9241	case SVPD_UNIT_SERIAL_NUMBER:
9242		retval = ctl_inquiry_evpd_serial(ctsio, alloc_len);
9243		break;
9244	case SVPD_DEVICE_ID:
9245		retval = ctl_inquiry_evpd_devid(ctsio, alloc_len);
9246		break;
9247	default:
9248		ctl_set_invalid_field(ctsio,
9249				      /*sks_valid*/ 1,
9250				      /*command*/ 1,
9251				      /*field*/ 2,
9252				      /*bit_valid*/ 0,
9253				      /*bit*/ 0);
9254		ctl_done((union ctl_io *)ctsio);
9255		retval = CTL_RETVAL_COMPLETE;
9256		break;
9257	}
9258
9259	return (retval);
9260}
9261
9262static int
9263ctl_inquiry_std(struct ctl_scsiio *ctsio)
9264{
9265	struct scsi_inquiry_data *inq_ptr;
9266	struct scsi_inquiry *cdb;
9267	struct ctl_softc *ctl_softc;
9268	struct ctl_lun *lun;
9269	uint32_t alloc_len;
9270	int is_fc;
9271
9272	ctl_softc = control_softc;
9273
9274	/*
9275	 * Figure out whether we're talking to a Fibre Channel port or not.
9276	 * We treat the ioctl front end, and any SCSI adapters, as packetized
9277	 * SCSI front ends.
9278	 */
9279	mtx_lock(&ctl_softc->ctl_lock);
9280	if (ctl_softc->ctl_ports[ctl_port_idx(ctsio->io_hdr.nexus.targ_port)]->port_type !=
9281	    CTL_PORT_FC)
9282		is_fc = 0;
9283	else
9284		is_fc = 1;
9285	mtx_unlock(&ctl_softc->ctl_lock);
9286
9287	lun = ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
9288	cdb = (struct scsi_inquiry *)ctsio->cdb;
9289	alloc_len = scsi_2btoul(cdb->length);
9290
9291	/*
9292	 * We malloc the full inquiry data size here and fill it
9293	 * in.  If the user only asks for less, we'll give him
9294	 * that much.
9295	 */
9296	ctsio->kern_data_ptr = malloc(sizeof(*inq_ptr), M_CTL, M_WAITOK | M_ZERO);
9297	inq_ptr = (struct scsi_inquiry_data *)ctsio->kern_data_ptr;
9298	ctsio->kern_sg_entries = 0;
9299	ctsio->kern_data_resid = 0;
9300	ctsio->kern_rel_offset = 0;
9301
9302	if (sizeof(*inq_ptr) < alloc_len) {
9303		ctsio->residual = alloc_len - sizeof(*inq_ptr);
9304		ctsio->kern_data_len = sizeof(*inq_ptr);
9305		ctsio->kern_total_len = sizeof(*inq_ptr);
9306	} else {
9307		ctsio->residual = 0;
9308		ctsio->kern_data_len = alloc_len;
9309		ctsio->kern_total_len = alloc_len;
9310	}
9311
9312	/*
9313	 * If we have a LUN configured, report it as connected.  Otherwise,
9314	 * report that it is offline or no device is supported, depending
9315	 * on the value of inquiry_pq_no_lun.
9316	 *
9317	 * According to the spec (SPC-4 r34), the peripheral qualifier
9318	 * SID_QUAL_LU_OFFLINE (001b) is used in the following scenario:
9319	 *
9320	 * "A peripheral device having the specified peripheral device type
9321	 * is not connected to this logical unit. However, the device
9322	 * server is capable of supporting the specified peripheral device
9323	 * type on this logical unit."
9324	 *
9325	 * According to the same spec, the peripheral qualifier
9326	 * SID_QUAL_BAD_LU (011b) is used in this scenario:
9327	 *
9328	 * "The device server is not capable of supporting a peripheral
9329	 * device on this logical unit. For this peripheral qualifier the
9330	 * peripheral device type shall be set to 1Fh. All other peripheral
9331	 * device type values are reserved for this peripheral qualifier."
9332	 *
9333	 * Given the text, it would seem that we probably want to report that
9334	 * the LUN is offline here.  There is no LUN connected, but we can
9335	 * support a LUN at the given LUN number.
9336	 *
9337	 * In the real world, though, it sounds like things are a little
9338	 * different:
9339	 *
9340	 * - Linux, when presented with a LUN with the offline peripheral
9341	 *   qualifier, will create an sg driver instance for it.  So when
9342	 *   you attach it to CTL, you wind up with a ton of sg driver
9343	 *   instances.  (One for every LUN that Linux bothered to probe.)
9344	 *   Linux does this despite the fact that it issues a REPORT LUNs
9345	 *   to LUN 0 to get the inventory of supported LUNs.
9346	 *
9347	 * - There is other anecdotal evidence (from Emulex folks) about
9348	 *   arrays that use the offline peripheral qualifier for LUNs that
9349	 *   are on the "passive" path in an active/passive array.
9350	 *
9351	 * So the solution is provide a hopefully reasonable default
9352	 * (return bad/no LUN) and allow the user to change the behavior
9353	 * with a tunable/sysctl variable.
9354	 */
9355	if (lun != NULL)
9356		inq_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
9357				  lun->be_lun->lun_type;
9358	else if (ctl_softc->inquiry_pq_no_lun == 0)
9359		inq_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
9360	else
9361		inq_ptr->device = (SID_QUAL_BAD_LU << 5) | T_NODEVICE;
9362
9363	/* RMB in byte 2 is 0 */
9364	inq_ptr->version = SCSI_REV_SPC3;
9365
9366	/*
9367	 * According to SAM-3, even if a device only supports a single
9368	 * level of LUN addressing, it should still set the HISUP bit:
9369	 *
9370	 * 4.9.1 Logical unit numbers overview
9371	 *
9372	 * All logical unit number formats described in this standard are
9373	 * hierarchical in structure even when only a single level in that
9374	 * hierarchy is used. The HISUP bit shall be set to one in the
9375	 * standard INQUIRY data (see SPC-2) when any logical unit number
9376	 * format described in this standard is used.  Non-hierarchical
9377	 * formats are outside the scope of this standard.
9378	 *
9379	 * Therefore we set the HiSup bit here.
9380	 *
9381	 * The reponse format is 2, per SPC-3.
9382	 */
9383	inq_ptr->response_format = SID_HiSup | 2;
9384
9385	inq_ptr->additional_length = sizeof(*inq_ptr) - 4;
9386	CTL_DEBUG_PRINT(("additional_length = %d\n",
9387			 inq_ptr->additional_length));
9388
9389	inq_ptr->spc3_flags = SPC3_SID_TPGS_IMPLICIT;
9390	/* 16 bit addressing */
9391	if (is_fc == 0)
9392		inq_ptr->spc2_flags = SPC2_SID_ADDR16;
9393	/* XXX set the SID_MultiP bit here if we're actually going to
9394	   respond on multiple ports */
9395	inq_ptr->spc2_flags |= SPC2_SID_MultiP;
9396
9397	/* 16 bit data bus, synchronous transfers */
9398	/* XXX these flags don't apply for FC */
9399	if (is_fc == 0)
9400		inq_ptr->flags = SID_WBus16 | SID_Sync;
9401	/*
9402	 * XXX KDM do we want to support tagged queueing on the control
9403	 * device at all?
9404	 */
9405	if ((lun == NULL)
9406	 || (lun->be_lun->lun_type != T_PROCESSOR))
9407		inq_ptr->flags |= SID_CmdQue;
9408	/*
9409	 * Per SPC-3, unused bytes in ASCII strings are filled with spaces.
9410	 * We have 8 bytes for the vendor name, and 16 bytes for the device
9411	 * name and 4 bytes for the revision.
9412	 */
9413	strncpy(inq_ptr->vendor, CTL_VENDOR, sizeof(inq_ptr->vendor));
9414	if (lun == NULL) {
9415		strcpy(inq_ptr->product, CTL_DIRECT_PRODUCT);
9416	} else {
9417		switch (lun->be_lun->lun_type) {
9418		case T_DIRECT:
9419			strcpy(inq_ptr->product, CTL_DIRECT_PRODUCT);
9420			break;
9421		case T_PROCESSOR:
9422			strcpy(inq_ptr->product, CTL_PROCESSOR_PRODUCT);
9423			break;
9424		default:
9425			strcpy(inq_ptr->product, CTL_UNKNOWN_PRODUCT);
9426			break;
9427		}
9428	}
9429
9430	/*
9431	 * XXX make this a macro somewhere so it automatically gets
9432	 * incremented when we make changes.
9433	 */
9434	strncpy(inq_ptr->revision, "0001", sizeof(inq_ptr->revision));
9435
9436	/*
9437	 * For parallel SCSI, we support double transition and single
9438	 * transition clocking.  We also support QAS (Quick Arbitration
9439	 * and Selection) and Information Unit transfers on both the
9440	 * control and array devices.
9441	 */
9442	if (is_fc == 0)
9443		inq_ptr->spi3data = SID_SPI_CLOCK_DT_ST | SID_SPI_QAS |
9444				    SID_SPI_IUS;
9445
9446	/* SAM-3 */
9447	scsi_ulto2b(0x0060, inq_ptr->version1);
9448	/* SPC-3 (no version claimed) XXX should we claim a version? */
9449	scsi_ulto2b(0x0300, inq_ptr->version2);
9450	if (is_fc) {
9451		/* FCP-2 ANSI INCITS.350:2003 */
9452		scsi_ulto2b(0x0917, inq_ptr->version3);
9453	} else {
9454		/* SPI-4 ANSI INCITS.362:200x */
9455		scsi_ulto2b(0x0B56, inq_ptr->version3);
9456	}
9457
9458	if (lun == NULL) {
9459		/* SBC-2 (no version claimed) XXX should we claim a version? */
9460		scsi_ulto2b(0x0320, inq_ptr->version4);
9461	} else {
9462		switch (lun->be_lun->lun_type) {
9463		case T_DIRECT:
9464			/*
9465			 * SBC-2 (no version claimed) XXX should we claim a
9466			 * version?
9467			 */
9468			scsi_ulto2b(0x0320, inq_ptr->version4);
9469			break;
9470		case T_PROCESSOR:
9471		default:
9472			break;
9473		}
9474	}
9475
9476	ctsio->scsi_status = SCSI_STATUS_OK;
9477	if (ctsio->kern_data_len > 0) {
9478		ctsio->be_move_done = ctl_config_move_done;
9479		ctl_datamove((union ctl_io *)ctsio);
9480	} else {
9481		ctsio->io_hdr.status = CTL_SUCCESS;
9482		ctl_done((union ctl_io *)ctsio);
9483	}
9484
9485	return (CTL_RETVAL_COMPLETE);
9486}
9487
9488int
9489ctl_inquiry(struct ctl_scsiio *ctsio)
9490{
9491	struct scsi_inquiry *cdb;
9492	int retval;
9493
9494	cdb = (struct scsi_inquiry *)ctsio->cdb;
9495
9496	retval = 0;
9497
9498	CTL_DEBUG_PRINT(("ctl_inquiry\n"));
9499
9500	/*
9501	 * Right now, we don't support the CmdDt inquiry information.
9502	 * This would be nice to support in the future.  When we do
9503	 * support it, we should change this test so that it checks to make
9504	 * sure SI_EVPD and SI_CMDDT aren't both set at the same time.
9505	 */
9506#ifdef notyet
9507	if (((cdb->byte2 & SI_EVPD)
9508	 && (cdb->byte2 & SI_CMDDT)))
9509#endif
9510	if (cdb->byte2 & SI_CMDDT) {
9511		/*
9512		 * Point to the SI_CMDDT bit.  We might change this
9513		 * when we support SI_CMDDT, but since both bits would be
9514		 * "wrong", this should probably just stay as-is then.
9515		 */
9516		ctl_set_invalid_field(ctsio,
9517				      /*sks_valid*/ 1,
9518				      /*command*/ 1,
9519				      /*field*/ 1,
9520				      /*bit_valid*/ 1,
9521				      /*bit*/ 1);
9522		ctl_done((union ctl_io *)ctsio);
9523		return (CTL_RETVAL_COMPLETE);
9524	}
9525	if (cdb->byte2 & SI_EVPD)
9526		retval = ctl_inquiry_evpd(ctsio);
9527#ifdef notyet
9528	else if (cdb->byte2 & SI_CMDDT)
9529		retval = ctl_inquiry_cmddt(ctsio);
9530#endif
9531	else
9532		retval = ctl_inquiry_std(ctsio);
9533
9534	return (retval);
9535}
9536
9537/*
9538 * For known CDB types, parse the LBA and length.
9539 */
9540static int
9541ctl_get_lba_len(union ctl_io *io, uint64_t *lba, uint32_t *len)
9542{
9543	if (io->io_hdr.io_type != CTL_IO_SCSI)
9544		return (1);
9545
9546	switch (io->scsiio.cdb[0]) {
9547	case READ_6:
9548	case WRITE_6: {
9549		struct scsi_rw_6 *cdb;
9550
9551		cdb = (struct scsi_rw_6 *)io->scsiio.cdb;
9552
9553		*lba = scsi_3btoul(cdb->addr);
9554		/* only 5 bits are valid in the most significant address byte */
9555		*lba &= 0x1fffff;
9556		*len = cdb->length;
9557		break;
9558	}
9559	case READ_10:
9560	case WRITE_10: {
9561		struct scsi_rw_10 *cdb;
9562
9563		cdb = (struct scsi_rw_10 *)io->scsiio.cdb;
9564
9565		*lba = scsi_4btoul(cdb->addr);
9566		*len = scsi_2btoul(cdb->length);
9567		break;
9568	}
9569	case WRITE_VERIFY_10: {
9570		struct scsi_write_verify_10 *cdb;
9571
9572		cdb = (struct scsi_write_verify_10 *)io->scsiio.cdb;
9573
9574		*lba = scsi_4btoul(cdb->addr);
9575		*len = scsi_2btoul(cdb->length);
9576		break;
9577	}
9578	case READ_12:
9579	case WRITE_12: {
9580		struct scsi_rw_12 *cdb;
9581
9582		cdb = (struct scsi_rw_12 *)io->scsiio.cdb;
9583
9584		*lba = scsi_4btoul(cdb->addr);
9585		*len = scsi_4btoul(cdb->length);
9586		break;
9587	}
9588	case WRITE_VERIFY_12: {
9589		struct scsi_write_verify_12 *cdb;
9590
9591		cdb = (struct scsi_write_verify_12 *)io->scsiio.cdb;
9592
9593		*lba = scsi_4btoul(cdb->addr);
9594		*len = scsi_4btoul(cdb->length);
9595		break;
9596	}
9597	case READ_16:
9598	case WRITE_16: {
9599		struct scsi_rw_16 *cdb;
9600
9601		cdb = (struct scsi_rw_16 *)io->scsiio.cdb;
9602
9603		*lba = scsi_8btou64(cdb->addr);
9604		*len = scsi_4btoul(cdb->length);
9605		break;
9606	}
9607	case WRITE_VERIFY_16: {
9608		struct scsi_write_verify_16 *cdb;
9609
9610		cdb = (struct scsi_write_verify_16 *)io->scsiio.cdb;
9611
9612
9613		*lba = scsi_8btou64(cdb->addr);
9614		*len = scsi_4btoul(cdb->length);
9615		break;
9616	}
9617	default:
9618		return (1);
9619		break; /* NOTREACHED */
9620	}
9621
9622	return (0);
9623}
9624
9625static ctl_action
9626ctl_extent_check_lba(uint64_t lba1, uint32_t len1, uint64_t lba2, uint32_t len2)
9627{
9628	uint64_t endlba1, endlba2;
9629
9630	endlba1 = lba1 + len1 - 1;
9631	endlba2 = lba2 + len2 - 1;
9632
9633	if ((endlba1 < lba2)
9634	 || (endlba2 < lba1))
9635		return (CTL_ACTION_PASS);
9636	else
9637		return (CTL_ACTION_BLOCK);
9638}
9639
9640static ctl_action
9641ctl_extent_check(union ctl_io *io1, union ctl_io *io2)
9642{
9643	uint64_t lba1, lba2;
9644	uint32_t len1, len2;
9645	int retval;
9646
9647	retval = ctl_get_lba_len(io1, &lba1, &len1);
9648	if (retval != 0)
9649		return (CTL_ACTION_ERROR);
9650
9651	retval = ctl_get_lba_len(io2, &lba2, &len2);
9652	if (retval != 0)
9653		return (CTL_ACTION_ERROR);
9654
9655	return (ctl_extent_check_lba(lba1, len1, lba2, len2));
9656}
9657
9658static ctl_action
9659ctl_check_for_blockage(union ctl_io *pending_io, union ctl_io *ooa_io)
9660{
9661	struct ctl_cmd_entry *pending_entry, *ooa_entry;
9662	ctl_serialize_action *serialize_row;
9663
9664	/*
9665	 * The initiator attempted multiple untagged commands at the same
9666	 * time.  Can't do that.
9667	 */
9668	if ((pending_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
9669	 && (ooa_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
9670	 && ((pending_io->io_hdr.nexus.targ_port ==
9671	      ooa_io->io_hdr.nexus.targ_port)
9672	  && (pending_io->io_hdr.nexus.initid.id ==
9673	      ooa_io->io_hdr.nexus.initid.id))
9674	 && ((ooa_io->io_hdr.flags & CTL_FLAG_ABORT) == 0))
9675		return (CTL_ACTION_OVERLAP);
9676
9677	/*
9678	 * The initiator attempted to send multiple tagged commands with
9679	 * the same ID.  (It's fine if different initiators have the same
9680	 * tag ID.)
9681	 *
9682	 * Even if all of those conditions are true, we don't kill the I/O
9683	 * if the command ahead of us has been aborted.  We won't end up
9684	 * sending it to the FETD, and it's perfectly legal to resend a
9685	 * command with the same tag number as long as the previous
9686	 * instance of this tag number has been aborted somehow.
9687	 */
9688	if ((pending_io->scsiio.tag_type != CTL_TAG_UNTAGGED)
9689	 && (ooa_io->scsiio.tag_type != CTL_TAG_UNTAGGED)
9690	 && (pending_io->scsiio.tag_num == ooa_io->scsiio.tag_num)
9691	 && ((pending_io->io_hdr.nexus.targ_port ==
9692	      ooa_io->io_hdr.nexus.targ_port)
9693	  && (pending_io->io_hdr.nexus.initid.id ==
9694	      ooa_io->io_hdr.nexus.initid.id))
9695	 && ((ooa_io->io_hdr.flags & CTL_FLAG_ABORT) == 0))
9696		return (CTL_ACTION_OVERLAP_TAG);
9697
9698	/*
9699	 * If we get a head of queue tag, SAM-3 says that we should
9700	 * immediately execute it.
9701	 *
9702	 * What happens if this command would normally block for some other
9703	 * reason?  e.g. a request sense with a head of queue tag
9704	 * immediately after a write.  Normally that would block, but this
9705	 * will result in its getting executed immediately...
9706	 *
9707	 * We currently return "pass" instead of "skip", so we'll end up
9708	 * going through the rest of the queue to check for overlapped tags.
9709	 *
9710	 * XXX KDM check for other types of blockage first??
9711	 */
9712	if (pending_io->scsiio.tag_type == CTL_TAG_HEAD_OF_QUEUE)
9713		return (CTL_ACTION_PASS);
9714
9715	/*
9716	 * Ordered tags have to block until all items ahead of them
9717	 * have completed.  If we get called with an ordered tag, we always
9718	 * block, if something else is ahead of us in the queue.
9719	 */
9720	if (pending_io->scsiio.tag_type == CTL_TAG_ORDERED)
9721		return (CTL_ACTION_BLOCK);
9722
9723	/*
9724	 * Simple tags get blocked until all head of queue and ordered tags
9725	 * ahead of them have completed.  I'm lumping untagged commands in
9726	 * with simple tags here.  XXX KDM is that the right thing to do?
9727	 */
9728	if (((pending_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
9729	  || (pending_io->scsiio.tag_type == CTL_TAG_SIMPLE))
9730	 && ((ooa_io->scsiio.tag_type == CTL_TAG_HEAD_OF_QUEUE)
9731	  || (ooa_io->scsiio.tag_type == CTL_TAG_ORDERED)))
9732		return (CTL_ACTION_BLOCK);
9733
9734	pending_entry = &ctl_cmd_table[pending_io->scsiio.cdb[0]];
9735	ooa_entry = &ctl_cmd_table[ooa_io->scsiio.cdb[0]];
9736
9737	serialize_row = ctl_serialize_table[ooa_entry->seridx];
9738
9739	switch (serialize_row[pending_entry->seridx]) {
9740	case CTL_SER_BLOCK:
9741		return (CTL_ACTION_BLOCK);
9742		break; /* NOTREACHED */
9743	case CTL_SER_EXTENT:
9744		return (ctl_extent_check(pending_io, ooa_io));
9745		break; /* NOTREACHED */
9746	case CTL_SER_PASS:
9747		return (CTL_ACTION_PASS);
9748		break; /* NOTREACHED */
9749	case CTL_SER_SKIP:
9750		return (CTL_ACTION_SKIP);
9751		break;
9752	default:
9753		panic("invalid serialization value %d",
9754		      serialize_row[pending_entry->seridx]);
9755		break; /* NOTREACHED */
9756	}
9757
9758	return (CTL_ACTION_ERROR);
9759}
9760
9761/*
9762 * Check for blockage or overlaps against the OOA (Order Of Arrival) queue.
9763 * Assumptions:
9764 * - pending_io is generally either incoming, or on the blocked queue
9765 * - starting I/O is the I/O we want to start the check with.
9766 */
9767static ctl_action
9768ctl_check_ooa(struct ctl_lun *lun, union ctl_io *pending_io,
9769	      union ctl_io *starting_io)
9770{
9771	union ctl_io *ooa_io;
9772	ctl_action action;
9773
9774	mtx_assert(&control_softc->ctl_lock, MA_OWNED);
9775
9776	/*
9777	 * Run back along the OOA queue, starting with the current
9778	 * blocked I/O and going through every I/O before it on the
9779	 * queue.  If starting_io is NULL, we'll just end up returning
9780	 * CTL_ACTION_PASS.
9781	 */
9782	for (ooa_io = starting_io; ooa_io != NULL;
9783	     ooa_io = (union ctl_io *)TAILQ_PREV(&ooa_io->io_hdr, ctl_ooaq,
9784	     ooa_links)){
9785
9786		/*
9787		 * This routine just checks to see whether
9788		 * cur_blocked is blocked by ooa_io, which is ahead
9789		 * of it in the queue.  It doesn't queue/dequeue
9790		 * cur_blocked.
9791		 */
9792		action = ctl_check_for_blockage(pending_io, ooa_io);
9793		switch (action) {
9794		case CTL_ACTION_BLOCK:
9795		case CTL_ACTION_OVERLAP:
9796		case CTL_ACTION_OVERLAP_TAG:
9797		case CTL_ACTION_SKIP:
9798		case CTL_ACTION_ERROR:
9799			return (action);
9800			break; /* NOTREACHED */
9801		case CTL_ACTION_PASS:
9802			break;
9803		default:
9804			panic("invalid action %d", action);
9805			break;  /* NOTREACHED */
9806		}
9807	}
9808
9809	return (CTL_ACTION_PASS);
9810}
9811
9812/*
9813 * Assumptions:
9814 * - An I/O has just completed, and has been removed from the per-LUN OOA
9815 *   queue, so some items on the blocked queue may now be unblocked.
9816 */
9817static int
9818ctl_check_blocked(struct ctl_lun *lun)
9819{
9820	union ctl_io *cur_blocked, *next_blocked;
9821
9822	mtx_assert(&control_softc->ctl_lock, MA_OWNED);
9823
9824	/*
9825	 * Run forward from the head of the blocked queue, checking each
9826	 * entry against the I/Os prior to it on the OOA queue to see if
9827	 * there is still any blockage.
9828	 *
9829	 * We cannot use the TAILQ_FOREACH() macro, because it can't deal
9830	 * with our removing a variable on it while it is traversing the
9831	 * list.
9832	 */
9833	for (cur_blocked = (union ctl_io *)TAILQ_FIRST(&lun->blocked_queue);
9834	     cur_blocked != NULL; cur_blocked = next_blocked) {
9835		union ctl_io *prev_ooa;
9836		ctl_action action;
9837
9838		next_blocked = (union ctl_io *)TAILQ_NEXT(&cur_blocked->io_hdr,
9839							  blocked_links);
9840
9841		prev_ooa = (union ctl_io *)TAILQ_PREV(&cur_blocked->io_hdr,
9842						      ctl_ooaq, ooa_links);
9843
9844		/*
9845		 * If cur_blocked happens to be the first item in the OOA
9846		 * queue now, prev_ooa will be NULL, and the action
9847		 * returned will just be CTL_ACTION_PASS.
9848		 */
9849		action = ctl_check_ooa(lun, cur_blocked, prev_ooa);
9850
9851		switch (action) {
9852		case CTL_ACTION_BLOCK:
9853			/* Nothing to do here, still blocked */
9854			break;
9855		case CTL_ACTION_OVERLAP:
9856		case CTL_ACTION_OVERLAP_TAG:
9857			/*
9858			 * This shouldn't happen!  In theory we've already
9859			 * checked this command for overlap...
9860			 */
9861			break;
9862		case CTL_ACTION_PASS:
9863		case CTL_ACTION_SKIP: {
9864			struct ctl_softc *softc;
9865			struct ctl_cmd_entry *entry;
9866			uint32_t initidx;
9867			uint8_t opcode;
9868			int isc_retval;
9869
9870			/*
9871			 * The skip case shouldn't happen, this transaction
9872			 * should have never made it onto the blocked queue.
9873			 */
9874			/*
9875			 * This I/O is no longer blocked, we can remove it
9876			 * from the blocked queue.  Since this is a TAILQ
9877			 * (doubly linked list), we can do O(1) removals
9878			 * from any place on the list.
9879			 */
9880			TAILQ_REMOVE(&lun->blocked_queue, &cur_blocked->io_hdr,
9881				     blocked_links);
9882			cur_blocked->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
9883
9884			if (cur_blocked->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC){
9885				/*
9886				 * Need to send IO back to original side to
9887				 * run
9888				 */
9889				union ctl_ha_msg msg_info;
9890
9891				msg_info.hdr.original_sc =
9892					cur_blocked->io_hdr.original_sc;
9893				msg_info.hdr.serializing_sc = cur_blocked;
9894				msg_info.hdr.msg_type = CTL_MSG_R2R;
9895				if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
9896				     &msg_info, sizeof(msg_info), 0)) >
9897				     CTL_HA_STATUS_SUCCESS) {
9898					printf("CTL:Check Blocked error from "
9899					       "ctl_ha_msg_send %d\n",
9900					       isc_retval);
9901				}
9902				break;
9903			}
9904			opcode = cur_blocked->scsiio.cdb[0];
9905			entry = &ctl_cmd_table[opcode];
9906			softc = control_softc;
9907
9908			initidx = ctl_get_initindex(&cur_blocked->io_hdr.nexus);
9909
9910			/*
9911			 * Check this I/O for LUN state changes that may
9912			 * have happened while this command was blocked.
9913			 * The LUN state may have been changed by a command
9914			 * ahead of us in the queue, so we need to re-check
9915			 * for any states that can be caused by SCSI
9916			 * commands.
9917			 */
9918			if (ctl_scsiio_lun_check(softc, lun, entry,
9919						 &cur_blocked->scsiio) == 0) {
9920				cur_blocked->io_hdr.flags |=
9921				                      CTL_FLAG_IS_WAS_ON_RTR;
9922				STAILQ_INSERT_TAIL(&lun->ctl_softc->rtr_queue,
9923						   &cur_blocked->io_hdr, links);
9924				/*
9925				 * In the non CTL_DONE_THREAD case, we need
9926				 * to wake up the work thread here.  When
9927				 * we're processing completed requests from
9928				 * the work thread context, we'll pop back
9929				 * around and end up pulling things off the
9930				 * RtR queue.  When we aren't processing
9931				 * things from the work thread context,
9932				 * though, we won't ever check the RtR queue.
9933				 * So we need to wake up the thread to clear
9934				 * things off the queue.  Otherwise this
9935				 * transaction will just sit on the RtR queue
9936				 * until a new I/O comes in.  (Which may or
9937				 * may not happen...)
9938				 */
9939#ifndef CTL_DONE_THREAD
9940				ctl_wakeup_thread();
9941#endif
9942			} else
9943				ctl_done_lock(cur_blocked, /*have_lock*/ 1);
9944			break;
9945		}
9946		default:
9947			/*
9948			 * This probably shouldn't happen -- we shouldn't
9949			 * get CTL_ACTION_ERROR, or anything else.
9950			 */
9951			break;
9952		}
9953	}
9954
9955	return (CTL_RETVAL_COMPLETE);
9956}
9957
9958/*
9959 * This routine (with one exception) checks LUN flags that can be set by
9960 * commands ahead of us in the OOA queue.  These flags have to be checked
9961 * when a command initially comes in, and when we pull a command off the
9962 * blocked queue and are preparing to execute it.  The reason we have to
9963 * check these flags for commands on the blocked queue is that the LUN
9964 * state may have been changed by a command ahead of us while we're on the
9965 * blocked queue.
9966 *
9967 * Ordering is somewhat important with these checks, so please pay
9968 * careful attention to the placement of any new checks.
9969 */
9970static int
9971ctl_scsiio_lun_check(struct ctl_softc *ctl_softc, struct ctl_lun *lun,
9972		     struct ctl_cmd_entry *entry, struct ctl_scsiio *ctsio)
9973{
9974	int retval;
9975
9976	retval = 0;
9977
9978	/*
9979	 * If this shelf is a secondary shelf controller, we have to reject
9980	 * any media access commands.
9981	 */
9982#if 0
9983	/* No longer needed for HA */
9984	if (((ctl_softc->flags & CTL_FLAG_MASTER_SHELF) == 0)
9985	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_SECONDARY) == 0)) {
9986		ctl_set_lun_standby(ctsio);
9987		retval = 1;
9988		goto bailout;
9989	}
9990#endif
9991
9992	/*
9993	 * Check for a reservation conflict.  If this command isn't allowed
9994	 * even on reserved LUNs, and if this initiator isn't the one who
9995	 * reserved us, reject the command with a reservation conflict.
9996	 */
9997	if ((lun->flags & CTL_LUN_RESERVED)
9998	 && ((entry->flags & CTL_CMD_FLAG_ALLOW_ON_RESV) == 0)) {
9999		if ((ctsio->io_hdr.nexus.initid.id != lun->rsv_nexus.initid.id)
10000		 || (ctsio->io_hdr.nexus.targ_port != lun->rsv_nexus.targ_port)
10001		 || (ctsio->io_hdr.nexus.targ_target.id !=
10002		     lun->rsv_nexus.targ_target.id)) {
10003			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
10004			ctsio->io_hdr.status = CTL_SCSI_ERROR;
10005			retval = 1;
10006			goto bailout;
10007		}
10008	}
10009
10010	if ( (lun->flags & CTL_LUN_PR_RESERVED)
10011	 && ((entry->flags & CTL_CMD_FLAG_ALLOW_ON_PR_RESV) == 0)) {
10012		uint32_t residx;
10013
10014		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
10015		/*
10016		 * if we aren't registered or it's a res holder type
10017		 * reservation and this isn't the res holder then set a
10018		 * conflict.
10019		 * NOTE: Commands which might be allowed on write exclusive
10020		 * type reservations are checked in the particular command
10021		 * for a conflict. Read and SSU are the only ones.
10022		 */
10023		if (!lun->per_res[residx].registered
10024		 || (residx != lun->pr_res_idx && lun->res_type < 4)) {
10025			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
10026			ctsio->io_hdr.status = CTL_SCSI_ERROR;
10027			retval = 1;
10028			goto bailout;
10029		}
10030
10031	}
10032
10033	if ((lun->flags & CTL_LUN_OFFLINE)
10034	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_OFFLINE) == 0)) {
10035		ctl_set_lun_not_ready(ctsio);
10036		retval = 1;
10037		goto bailout;
10038	}
10039
10040	/*
10041	 * If the LUN is stopped, see if this particular command is allowed
10042	 * for a stopped lun.  Otherwise, reject it with 0x04,0x02.
10043	 */
10044	if ((lun->flags & CTL_LUN_STOPPED)
10045	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_STOPPED) == 0)) {
10046		/* "Logical unit not ready, initializing cmd. required" */
10047		ctl_set_lun_stopped(ctsio);
10048		retval = 1;
10049		goto bailout;
10050	}
10051
10052	if ((lun->flags & CTL_LUN_INOPERABLE)
10053	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_INOPERABLE) == 0)) {
10054		/* "Medium format corrupted" */
10055		ctl_set_medium_format_corrupted(ctsio);
10056		retval = 1;
10057		goto bailout;
10058	}
10059
10060bailout:
10061	return (retval);
10062
10063}
10064
10065static void
10066ctl_failover_io(union ctl_io *io, int have_lock)
10067{
10068	ctl_set_busy(&io->scsiio);
10069	ctl_done_lock(io, have_lock);
10070}
10071
10072static void
10073ctl_failover(void)
10074{
10075	struct ctl_lun *lun;
10076	struct ctl_softc *ctl_softc;
10077	union ctl_io *next_io, *pending_io;
10078	union ctl_io *io;
10079	int lun_idx;
10080	int i;
10081
10082	ctl_softc = control_softc;
10083
10084	mtx_lock(&ctl_softc->ctl_lock);
10085	/*
10086	 * Remove any cmds from the other SC from the rtr queue.  These
10087	 * will obviously only be for LUNs for which we're the primary.
10088	 * We can't send status or get/send data for these commands.
10089	 * Since they haven't been executed yet, we can just remove them.
10090	 * We'll either abort them or delete them below, depending on
10091	 * which HA mode we're in.
10092	 */
10093	for (io = (union ctl_io *)STAILQ_FIRST(&ctl_softc->rtr_queue);
10094	     io != NULL; io = next_io) {
10095		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
10096		if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
10097			STAILQ_REMOVE(&ctl_softc->rtr_queue, &io->io_hdr,
10098				      ctl_io_hdr, links);
10099	}
10100
10101	for (lun_idx=0; lun_idx < ctl_softc->num_luns; lun_idx++) {
10102		lun = ctl_softc->ctl_luns[lun_idx];
10103		if (lun==NULL)
10104			continue;
10105
10106		/*
10107		 * Processor LUNs are primary on both sides.
10108		 * XXX will this always be true?
10109		 */
10110		if (lun->be_lun->lun_type == T_PROCESSOR)
10111			continue;
10112
10113		if ((lun->flags & CTL_LUN_PRIMARY_SC)
10114		 && (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)) {
10115			printf("FAILOVER: primary lun %d\n", lun_idx);
10116		        /*
10117			 * Remove all commands from the other SC. First from the
10118			 * blocked queue then from the ooa queue. Once we have
10119			 * removed them. Call ctl_check_blocked to see if there
10120			 * is anything that can run.
10121			 */
10122			for (io = (union ctl_io *)TAILQ_FIRST(
10123			     &lun->blocked_queue); io != NULL; io = next_io) {
10124
10125		        	next_io = (union ctl_io *)TAILQ_NEXT(
10126				    &io->io_hdr, blocked_links);
10127
10128				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC) {
10129					TAILQ_REMOVE(&lun->blocked_queue,
10130						     &io->io_hdr,blocked_links);
10131					io->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
10132					TAILQ_REMOVE(&lun->ooa_queue,
10133						     &io->io_hdr, ooa_links);
10134
10135					ctl_free_io(io);
10136				}
10137			}
10138
10139			for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
10140	     		     io != NULL; io = next_io) {
10141
10142		        	next_io = (union ctl_io *)TAILQ_NEXT(
10143				    &io->io_hdr, ooa_links);
10144
10145				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC) {
10146
10147					TAILQ_REMOVE(&lun->ooa_queue,
10148						&io->io_hdr,
10149					     	ooa_links);
10150
10151					ctl_free_io(io);
10152				}
10153			}
10154			ctl_check_blocked(lun);
10155		} else if ((lun->flags & CTL_LUN_PRIMARY_SC)
10156			&& (ctl_softc->ha_mode == CTL_HA_MODE_XFER)) {
10157
10158			printf("FAILOVER: primary lun %d\n", lun_idx);
10159			/*
10160			 * Abort all commands from the other SC.  We can't
10161			 * send status back for them now.  These should get
10162			 * cleaned up when they are completed or come out
10163			 * for a datamove operation.
10164			 */
10165			for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
10166	     		     io != NULL; io = next_io) {
10167		        	next_io = (union ctl_io *)TAILQ_NEXT(
10168					&io->io_hdr, ooa_links);
10169
10170				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
10171					io->io_hdr.flags |= CTL_FLAG_ABORT;
10172			}
10173		} else if (((lun->flags & CTL_LUN_PRIMARY_SC) == 0)
10174			&& (ctl_softc->ha_mode == CTL_HA_MODE_XFER)) {
10175
10176			printf("FAILOVER: secondary lun %d\n", lun_idx);
10177
10178			lun->flags |= CTL_LUN_PRIMARY_SC;
10179
10180			/*
10181			 * We send all I/O that was sent to this controller
10182			 * and redirected to the other side back with
10183			 * busy status, and have the initiator retry it.
10184			 * Figuring out how much data has been transferred,
10185			 * etc. and picking up where we left off would be
10186			 * very tricky.
10187			 *
10188			 * XXX KDM need to remove I/O from the blocked
10189			 * queue as well!
10190			 */
10191			for (pending_io = (union ctl_io *)TAILQ_FIRST(
10192			     &lun->ooa_queue); pending_io != NULL;
10193			     pending_io = next_io) {
10194
10195				next_io =  (union ctl_io *)TAILQ_NEXT(
10196					&pending_io->io_hdr, ooa_links);
10197
10198				pending_io->io_hdr.flags &=
10199					~CTL_FLAG_SENT_2OTHER_SC;
10200
10201				if (pending_io->io_hdr.flags &
10202				    CTL_FLAG_IO_ACTIVE) {
10203					pending_io->io_hdr.flags |=
10204						CTL_FLAG_FAILOVER;
10205				} else {
10206					ctl_set_busy(&pending_io->scsiio);
10207					ctl_done_lock(pending_io,
10208						      /*have_lock*/1);
10209				}
10210			}
10211
10212			/*
10213			 * Build Unit Attention
10214			 */
10215			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
10216				lun->pending_sense[i].ua_pending |=
10217				                     CTL_UA_ASYM_ACC_CHANGE;
10218			}
10219		} else if (((lun->flags & CTL_LUN_PRIMARY_SC) == 0)
10220			&& (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)) {
10221			printf("FAILOVER: secondary lun %d\n", lun_idx);
10222			/*
10223			 * if the first io on the OOA is not on the RtR queue
10224			 * add it.
10225			 */
10226			lun->flags |= CTL_LUN_PRIMARY_SC;
10227
10228			pending_io = (union ctl_io *)TAILQ_FIRST(
10229			    &lun->ooa_queue);
10230			if (pending_io==NULL) {
10231				printf("Nothing on OOA queue\n");
10232				continue;
10233			}
10234
10235			pending_io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
10236			if ((pending_io->io_hdr.flags &
10237			     CTL_FLAG_IS_WAS_ON_RTR) == 0) {
10238				pending_io->io_hdr.flags |=
10239				    CTL_FLAG_IS_WAS_ON_RTR;
10240				STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
10241						   &pending_io->io_hdr, links);
10242			}
10243#if 0
10244			else
10245			{
10246				printf("Tag 0x%04x is running\n",
10247				      pending_io->scsiio.tag_num);
10248			}
10249#endif
10250
10251			next_io = (union ctl_io *)TAILQ_NEXT(
10252			    &pending_io->io_hdr, ooa_links);
10253			for (pending_io=next_io; pending_io != NULL;
10254			     pending_io = next_io) {
10255				pending_io->io_hdr.flags &=
10256				    ~CTL_FLAG_SENT_2OTHER_SC;
10257				next_io = (union ctl_io *)TAILQ_NEXT(
10258					&pending_io->io_hdr, ooa_links);
10259				if (pending_io->io_hdr.flags &
10260				    CTL_FLAG_IS_WAS_ON_RTR) {
10261#if 0
10262				        printf("Tag 0x%04x is running\n",
10263				      		pending_io->scsiio.tag_num);
10264#endif
10265					continue;
10266				}
10267
10268				switch (ctl_check_ooa(lun, pending_io,
10269			            (union ctl_io *)TAILQ_PREV(
10270				    &pending_io->io_hdr, ctl_ooaq,
10271				    ooa_links))) {
10272
10273				case CTL_ACTION_BLOCK:
10274					TAILQ_INSERT_TAIL(&lun->blocked_queue,
10275							  &pending_io->io_hdr,
10276							  blocked_links);
10277					pending_io->io_hdr.flags |=
10278					    CTL_FLAG_BLOCKED;
10279					break;
10280				case CTL_ACTION_PASS:
10281				case CTL_ACTION_SKIP:
10282					pending_io->io_hdr.flags |=
10283					    CTL_FLAG_IS_WAS_ON_RTR;
10284					STAILQ_INSERT_TAIL(
10285					    &ctl_softc->rtr_queue,
10286					    &pending_io->io_hdr, links);
10287					break;
10288				case CTL_ACTION_OVERLAP:
10289					ctl_set_overlapped_cmd(
10290					    (struct ctl_scsiio *)pending_io);
10291					ctl_done_lock(pending_io,
10292						      /*have_lock*/ 1);
10293					break;
10294				case CTL_ACTION_OVERLAP_TAG:
10295					ctl_set_overlapped_tag(
10296					    (struct ctl_scsiio *)pending_io,
10297					    pending_io->scsiio.tag_num & 0xff);
10298					ctl_done_lock(pending_io,
10299						      /*have_lock*/ 1);
10300					break;
10301				case CTL_ACTION_ERROR:
10302				default:
10303					ctl_set_internal_failure(
10304						(struct ctl_scsiio *)pending_io,
10305						0,  // sks_valid
10306						0); //retry count
10307					ctl_done_lock(pending_io,
10308						      /*have_lock*/ 1);
10309					break;
10310				}
10311			}
10312
10313			/*
10314			 * Build Unit Attention
10315			 */
10316			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
10317				lun->pending_sense[i].ua_pending |=
10318				                     CTL_UA_ASYM_ACC_CHANGE;
10319			}
10320		} else {
10321			panic("Unhandled HA mode failover, LUN flags = %#x, "
10322			      "ha_mode = #%x", lun->flags, ctl_softc->ha_mode);
10323		}
10324	}
10325	ctl_pause_rtr = 0;
10326	mtx_unlock(&ctl_softc->ctl_lock);
10327}
10328
10329static int
10330ctl_scsiio_precheck(struct ctl_softc *ctl_softc, struct ctl_scsiio *ctsio)
10331{
10332	struct ctl_lun *lun;
10333	struct ctl_cmd_entry *entry;
10334	uint8_t opcode;
10335	uint32_t initidx;
10336	int retval;
10337
10338	retval = 0;
10339
10340	lun = NULL;
10341
10342	opcode = ctsio->cdb[0];
10343
10344	mtx_lock(&ctl_softc->ctl_lock);
10345
10346	if ((ctsio->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
10347	 && (ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun] != NULL)) {
10348		lun = ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun];
10349		/*
10350		 * If the LUN is invalid, pretend that it doesn't exist.
10351		 * It will go away as soon as all pending I/O has been
10352		 * completed.
10353		 */
10354		if (lun->flags & CTL_LUN_DISABLED) {
10355			lun = NULL;
10356		} else {
10357			ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr = lun;
10358			ctsio->io_hdr.ctl_private[CTL_PRIV_BACKEND_LUN].ptr =
10359				lun->be_lun;
10360			if (lun->be_lun->lun_type == T_PROCESSOR) {
10361				ctsio->io_hdr.flags |= CTL_FLAG_CONTROL_DEV;
10362			}
10363		}
10364	} else {
10365		ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr = NULL;
10366		ctsio->io_hdr.ctl_private[CTL_PRIV_BACKEND_LUN].ptr = NULL;
10367	}
10368
10369	entry = &ctl_cmd_table[opcode];
10370
10371	ctsio->io_hdr.flags &= ~CTL_FLAG_DATA_MASK;
10372	ctsio->io_hdr.flags |= entry->flags & CTL_FLAG_DATA_MASK;
10373
10374	/*
10375	 * Check to see whether we can send this command to LUNs that don't
10376	 * exist.  This should pretty much only be the case for inquiry
10377	 * and request sense.  Further checks, below, really require having
10378	 * a LUN, so we can't really check the command anymore.  Just put
10379	 * it on the rtr queue.
10380	 */
10381	if (lun == NULL) {
10382		if (entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
10383			goto queue_rtr;
10384
10385		ctl_set_unsupported_lun(ctsio);
10386		mtx_unlock(&ctl_softc->ctl_lock);
10387		ctl_done((union ctl_io *)ctsio);
10388		goto bailout;
10389	} else {
10390		/*
10391		 * Every I/O goes into the OOA queue for a particular LUN, and
10392		 * stays there until completion.
10393		 */
10394		TAILQ_INSERT_TAIL(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
10395
10396		/*
10397		 * Make sure we support this particular command on this LUN.
10398		 * e.g., we don't support writes to the control LUN.
10399		 */
10400		switch (lun->be_lun->lun_type) {
10401		case T_PROCESSOR:
10402		 	if (((entry->flags & CTL_CMD_FLAG_OK_ON_PROC) == 0)
10403			 && ((entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
10404			      == 0)) {
10405				ctl_set_invalid_opcode(ctsio);
10406				mtx_unlock(&ctl_softc->ctl_lock);
10407				ctl_done((union ctl_io *)ctsio);
10408				goto bailout;
10409			}
10410			break;
10411		case T_DIRECT:
10412			if (((entry->flags & CTL_CMD_FLAG_OK_ON_SLUN) == 0)
10413			 && ((entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
10414			      == 0)){
10415				ctl_set_invalid_opcode(ctsio);
10416				mtx_unlock(&ctl_softc->ctl_lock);
10417				ctl_done((union ctl_io *)ctsio);
10418				goto bailout;
10419			}
10420			break;
10421		default:
10422			printf("Unsupported CTL LUN type %d\n",
10423			       lun->be_lun->lun_type);
10424			panic("Unsupported CTL LUN type %d\n",
10425			      lun->be_lun->lun_type);
10426			break; /* NOTREACHED */
10427		}
10428	}
10429
10430	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
10431
10432	/*
10433	 * If we've got a request sense, it'll clear the contingent
10434	 * allegiance condition.  Otherwise, if we have a CA condition for
10435	 * this initiator, clear it, because it sent down a command other
10436	 * than request sense.
10437	 */
10438	if ((opcode != REQUEST_SENSE)
10439	 && (ctl_is_set(lun->have_ca, initidx)))
10440		ctl_clear_mask(lun->have_ca, initidx);
10441
10442	/*
10443	 * If the command has this flag set, it handles its own unit
10444	 * attention reporting, we shouldn't do anything.  Otherwise we
10445	 * check for any pending unit attentions, and send them back to the
10446	 * initiator.  We only do this when a command initially comes in,
10447	 * not when we pull it off the blocked queue.
10448	 *
10449	 * According to SAM-3, section 5.3.2, the order that things get
10450	 * presented back to the host is basically unit attentions caused
10451	 * by some sort of reset event, busy status, reservation conflicts
10452	 * or task set full, and finally any other status.
10453	 *
10454	 * One issue here is that some of the unit attentions we report
10455	 * don't fall into the "reset" category (e.g. "reported luns data
10456	 * has changed").  So reporting it here, before the reservation
10457	 * check, may be technically wrong.  I guess the only thing to do
10458	 * would be to check for and report the reset events here, and then
10459	 * check for the other unit attention types after we check for a
10460	 * reservation conflict.
10461	 *
10462	 * XXX KDM need to fix this
10463	 */
10464	if ((entry->flags & CTL_CMD_FLAG_NO_SENSE) == 0) {
10465		ctl_ua_type ua_type;
10466
10467		ua_type = lun->pending_sense[initidx].ua_pending;
10468		if (ua_type != CTL_UA_NONE) {
10469			scsi_sense_data_type sense_format;
10470
10471			if (lun != NULL)
10472				sense_format = (lun->flags &
10473				    CTL_LUN_SENSE_DESC) ? SSD_TYPE_DESC :
10474				    SSD_TYPE_FIXED;
10475			else
10476				sense_format = SSD_TYPE_FIXED;
10477
10478			ua_type = ctl_build_ua(ua_type, &ctsio->sense_data,
10479					       sense_format);
10480			if (ua_type != CTL_UA_NONE) {
10481				ctsio->scsi_status = SCSI_STATUS_CHECK_COND;
10482				ctsio->io_hdr.status = CTL_SCSI_ERROR |
10483						       CTL_AUTOSENSE;
10484				ctsio->sense_len = SSD_FULL_SIZE;
10485				lun->pending_sense[initidx].ua_pending &=
10486					~ua_type;
10487				mtx_unlock(&ctl_softc->ctl_lock);
10488				ctl_done((union ctl_io *)ctsio);
10489				goto bailout;
10490			}
10491		}
10492	}
10493
10494
10495	if (ctl_scsiio_lun_check(ctl_softc, lun, entry, ctsio) != 0) {
10496		mtx_unlock(&ctl_softc->ctl_lock);
10497		ctl_done((union ctl_io *)ctsio);
10498		goto bailout;
10499	}
10500
10501	/*
10502	 * XXX CHD this is where we want to send IO to other side if
10503	 * this LUN is secondary on this SC. We will need to make a copy
10504	 * of the IO and flag the IO on this side as SENT_2OTHER and the flag
10505	 * the copy we send as FROM_OTHER.
10506	 * We also need to stuff the address of the original IO so we can
10507	 * find it easily. Something similar will need be done on the other
10508	 * side so when we are done we can find the copy.
10509	 */
10510	if ((lun->flags & CTL_LUN_PRIMARY_SC) == 0) {
10511		union ctl_ha_msg msg_info;
10512		int isc_retval;
10513
10514		ctsio->io_hdr.flags |= CTL_FLAG_SENT_2OTHER_SC;
10515
10516		msg_info.hdr.msg_type = CTL_MSG_SERIALIZE;
10517		msg_info.hdr.original_sc = (union ctl_io *)ctsio;
10518#if 0
10519		printf("1. ctsio %p\n", ctsio);
10520#endif
10521		msg_info.hdr.serializing_sc = NULL;
10522		msg_info.hdr.nexus = ctsio->io_hdr.nexus;
10523		msg_info.scsi.tag_num = ctsio->tag_num;
10524		msg_info.scsi.tag_type = ctsio->tag_type;
10525		memcpy(msg_info.scsi.cdb, ctsio->cdb, CTL_MAX_CDBLEN);
10526
10527		ctsio->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
10528
10529		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
10530		    (void *)&msg_info, sizeof(msg_info), 0)) >
10531		    CTL_HA_STATUS_SUCCESS) {
10532			printf("CTL:precheck, ctl_ha_msg_send returned %d\n",
10533			       isc_retval);
10534			printf("CTL:opcode is %x\n",opcode);
10535		} else {
10536#if 0
10537			printf("CTL:Precheck sent msg, opcode is %x\n",opcode);
10538#endif
10539		}
10540
10541		/*
10542		 * XXX KDM this I/O is off the incoming queue, but hasn't
10543		 * been inserted on any other queue.  We may need to come
10544		 * up with a holding queue while we wait for serialization
10545		 * so that we have an idea of what we're waiting for from
10546		 * the other side.
10547		 */
10548		goto bailout_unlock;
10549	}
10550
10551	switch (ctl_check_ooa(lun, (union ctl_io *)ctsio,
10552			      (union ctl_io *)TAILQ_PREV(&ctsio->io_hdr,
10553			      ctl_ooaq, ooa_links))) {
10554	case CTL_ACTION_BLOCK:
10555		ctsio->io_hdr.flags |= CTL_FLAG_BLOCKED;
10556		TAILQ_INSERT_TAIL(&lun->blocked_queue, &ctsio->io_hdr,
10557				  blocked_links);
10558		goto bailout_unlock;
10559		break; /* NOTREACHED */
10560	case CTL_ACTION_PASS:
10561	case CTL_ACTION_SKIP:
10562		goto queue_rtr;
10563		break; /* NOTREACHED */
10564	case CTL_ACTION_OVERLAP:
10565		ctl_set_overlapped_cmd(ctsio);
10566		mtx_unlock(&ctl_softc->ctl_lock);
10567		ctl_done((union ctl_io *)ctsio);
10568		goto bailout;
10569		break; /* NOTREACHED */
10570	case CTL_ACTION_OVERLAP_TAG:
10571		ctl_set_overlapped_tag(ctsio, ctsio->tag_num & 0xff);
10572		mtx_unlock(&ctl_softc->ctl_lock);
10573		ctl_done((union ctl_io *)ctsio);
10574		goto bailout;
10575		break; /* NOTREACHED */
10576	case CTL_ACTION_ERROR:
10577	default:
10578		ctl_set_internal_failure(ctsio,
10579					 /*sks_valid*/ 0,
10580					 /*retry_count*/ 0);
10581		mtx_unlock(&ctl_softc->ctl_lock);
10582		ctl_done((union ctl_io *)ctsio);
10583		goto bailout;
10584		break; /* NOTREACHED */
10585	}
10586
10587	goto bailout_unlock;
10588
10589queue_rtr:
10590	ctsio->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
10591	STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue, &ctsio->io_hdr, links);
10592
10593bailout_unlock:
10594	mtx_unlock(&ctl_softc->ctl_lock);
10595
10596bailout:
10597	return (retval);
10598}
10599
10600static int
10601ctl_scsiio(struct ctl_scsiio *ctsio)
10602{
10603	int retval;
10604	struct ctl_cmd_entry *entry;
10605
10606	retval = CTL_RETVAL_COMPLETE;
10607
10608	CTL_DEBUG_PRINT(("ctl_scsiio cdb[0]=%02X\n", ctsio->cdb[0]));
10609
10610	entry = &ctl_cmd_table[ctsio->cdb[0]];
10611
10612	/*
10613	 * If this I/O has been aborted, just send it straight to
10614	 * ctl_done() without executing it.
10615	 */
10616	if (ctsio->io_hdr.flags & CTL_FLAG_ABORT) {
10617		ctl_done((union ctl_io *)ctsio);
10618		goto bailout;
10619	}
10620
10621	/*
10622	 * All the checks should have been handled by ctl_scsiio_precheck().
10623	 * We should be clear now to just execute the I/O.
10624	 */
10625	retval = entry->execute(ctsio);
10626
10627bailout:
10628	return (retval);
10629}
10630
10631/*
10632 * Since we only implement one target right now, a bus reset simply resets
10633 * our single target.
10634 */
10635static int
10636ctl_bus_reset(struct ctl_softc *ctl_softc, union ctl_io *io)
10637{
10638	return(ctl_target_reset(ctl_softc, io, CTL_UA_BUS_RESET));
10639}
10640
10641static int
10642ctl_target_reset(struct ctl_softc *ctl_softc, union ctl_io *io,
10643		 ctl_ua_type ua_type)
10644{
10645	struct ctl_lun *lun;
10646	int retval;
10647
10648	if (!(io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
10649		union ctl_ha_msg msg_info;
10650
10651		io->io_hdr.flags |= CTL_FLAG_SENT_2OTHER_SC;
10652		msg_info.hdr.nexus = io->io_hdr.nexus;
10653		if (ua_type==CTL_UA_TARG_RESET)
10654			msg_info.task.task_action = CTL_TASK_TARGET_RESET;
10655		else
10656			msg_info.task.task_action = CTL_TASK_BUS_RESET;
10657		msg_info.hdr.msg_type = CTL_MSG_MANAGE_TASKS;
10658		msg_info.hdr.original_sc = NULL;
10659		msg_info.hdr.serializing_sc = NULL;
10660		if (CTL_HA_STATUS_SUCCESS != ctl_ha_msg_send(CTL_HA_CHAN_CTL,
10661		    (void *)&msg_info, sizeof(msg_info), 0)) {
10662		}
10663	}
10664	retval = 0;
10665
10666	STAILQ_FOREACH(lun, &ctl_softc->lun_list, links)
10667		retval += ctl_lun_reset(lun, io, ua_type);
10668
10669	return (retval);
10670}
10671
10672/*
10673 * The LUN should always be set.  The I/O is optional, and is used to
10674 * distinguish between I/Os sent by this initiator, and by other
10675 * initiators.  We set unit attention for initiators other than this one.
10676 * SAM-3 is vague on this point.  It does say that a unit attention should
10677 * be established for other initiators when a LUN is reset (see section
10678 * 5.7.3), but it doesn't specifically say that the unit attention should
10679 * be established for this particular initiator when a LUN is reset.  Here
10680 * is the relevant text, from SAM-3 rev 8:
10681 *
10682 * 5.7.2 When a SCSI initiator port aborts its own tasks
10683 *
10684 * When a SCSI initiator port causes its own task(s) to be aborted, no
10685 * notification that the task(s) have been aborted shall be returned to
10686 * the SCSI initiator port other than the completion response for the
10687 * command or task management function action that caused the task(s) to
10688 * be aborted and notification(s) associated with related effects of the
10689 * action (e.g., a reset unit attention condition).
10690 *
10691 * XXX KDM for now, we're setting unit attention for all initiators.
10692 */
10693static int
10694ctl_lun_reset(struct ctl_lun *lun, union ctl_io *io, ctl_ua_type ua_type)
10695{
10696	union ctl_io *xio;
10697#if 0
10698	uint32_t initindex;
10699#endif
10700	int i;
10701
10702	/*
10703	 * Run through the OOA queue and abort each I/O.
10704	 */
10705#if 0
10706	TAILQ_FOREACH((struct ctl_io_hdr *)xio, &lun->ooa_queue, ooa_links) {
10707#endif
10708	for (xio = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); xio != NULL;
10709	     xio = (union ctl_io *)TAILQ_NEXT(&xio->io_hdr, ooa_links)) {
10710		xio->io_hdr.flags |= CTL_FLAG_ABORT;
10711	}
10712
10713	/*
10714	 * This version sets unit attention for every
10715	 */
10716#if 0
10717	initindex = ctl_get_initindex(&io->io_hdr.nexus);
10718	for (i = 0; i < CTL_MAX_INITIATORS; i++) {
10719		if (initindex == i)
10720			continue;
10721		lun->pending_sense[i].ua_pending |= ua_type;
10722	}
10723#endif
10724
10725	/*
10726	 * A reset (any kind, really) clears reservations established with
10727	 * RESERVE/RELEASE.  It does not clear reservations established
10728	 * with PERSISTENT RESERVE OUT, but we don't support that at the
10729	 * moment anyway.  See SPC-2, section 5.6.  SPC-3 doesn't address
10730	 * reservations made with the RESERVE/RELEASE commands, because
10731	 * those commands are obsolete in SPC-3.
10732	 */
10733	lun->flags &= ~CTL_LUN_RESERVED;
10734
10735	for (i = 0; i < CTL_MAX_INITIATORS; i++) {
10736		ctl_clear_mask(lun->have_ca, i);
10737		lun->pending_sense[i].ua_pending |= ua_type;
10738	}
10739
10740	return (0);
10741}
10742
10743static int
10744ctl_abort_task(union ctl_io *io)
10745{
10746	union ctl_io *xio;
10747	struct ctl_lun *lun;
10748	struct ctl_softc *ctl_softc;
10749#if 0
10750	struct sbuf sb;
10751	char printbuf[128];
10752#endif
10753	int found;
10754
10755	ctl_softc = control_softc;
10756	found = 0;
10757
10758	/*
10759	 * Look up the LUN.
10760	 */
10761	if ((io->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
10762	 && (ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun] != NULL))
10763		lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
10764	else
10765		goto bailout;
10766
10767#if 0
10768	printf("ctl_abort_task: called for lun %lld, tag %d type %d\n",
10769	       lun->lun, io->taskio.tag_num, io->taskio.tag_type);
10770#endif
10771
10772	/*
10773	 * Run through the OOA queue and attempt to find the given I/O.
10774	 * The target port, initiator ID, tag type and tag number have to
10775	 * match the values that we got from the initiator.  If we have an
10776	 * untagged command to abort, simply abort the first untagged command
10777	 * we come to.  We only allow one untagged command at a time of course.
10778	 */
10779#if 0
10780	TAILQ_FOREACH((struct ctl_io_hdr *)xio, &lun->ooa_queue, ooa_links) {
10781#endif
10782	for (xio = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); xio != NULL;
10783	     xio = (union ctl_io *)TAILQ_NEXT(&xio->io_hdr, ooa_links)) {
10784#if 0
10785		sbuf_new(&sb, printbuf, sizeof(printbuf), SBUF_FIXEDLEN);
10786
10787		sbuf_printf(&sb, "LUN %lld tag %d type %d%s%s%s%s: ",
10788			    lun->lun, xio->scsiio.tag_num,
10789			    xio->scsiio.tag_type,
10790			    (xio->io_hdr.blocked_links.tqe_prev
10791			    == NULL) ? "" : " BLOCKED",
10792			    (xio->io_hdr.flags &
10793			    CTL_FLAG_DMA_INPROG) ? " DMA" : "",
10794			    (xio->io_hdr.flags &
10795			    CTL_FLAG_ABORT) ? " ABORT" : "",
10796			    (xio->io_hdr.flags &
10797			    CTL_FLAG_IS_WAS_ON_RTR ? " RTR" : ""));
10798		ctl_scsi_command_string(&xio->scsiio, NULL, &sb);
10799		sbuf_finish(&sb);
10800		printf("%s\n", sbuf_data(&sb));
10801#endif
10802
10803		if ((xio->io_hdr.nexus.targ_port == io->io_hdr.nexus.targ_port)
10804		 && (xio->io_hdr.nexus.initid.id ==
10805		     io->io_hdr.nexus.initid.id)) {
10806			/*
10807			 * If the abort says that the task is untagged, the
10808			 * task in the queue must be untagged.  Otherwise,
10809			 * we just check to see whether the tag numbers
10810			 * match.  This is because the QLogic firmware
10811			 * doesn't pass back the tag type in an abort
10812			 * request.
10813			 */
10814#if 0
10815			if (((xio->scsiio.tag_type == CTL_TAG_UNTAGGED)
10816			  && (io->taskio.tag_type == CTL_TAG_UNTAGGED))
10817			 || (xio->scsiio.tag_num == io->taskio.tag_num)) {
10818#endif
10819			/*
10820			 * XXX KDM we've got problems with FC, because it
10821			 * doesn't send down a tag type with aborts.  So we
10822			 * can only really go by the tag number...
10823			 * This may cause problems with parallel SCSI.
10824			 * Need to figure that out!!
10825			 */
10826			if (xio->scsiio.tag_num == io->taskio.tag_num) {
10827				xio->io_hdr.flags |= CTL_FLAG_ABORT;
10828				found = 1;
10829				if ((io->io_hdr.flags &
10830				     CTL_FLAG_FROM_OTHER_SC) == 0 &&
10831				    !(lun->flags & CTL_LUN_PRIMARY_SC)) {
10832					union ctl_ha_msg msg_info;
10833
10834					io->io_hdr.flags |=
10835					                CTL_FLAG_SENT_2OTHER_SC;
10836					msg_info.hdr.nexus = io->io_hdr.nexus;
10837					msg_info.task.task_action =
10838						CTL_TASK_ABORT_TASK;
10839					msg_info.task.tag_num =
10840						io->taskio.tag_num;
10841					msg_info.task.tag_type =
10842						io->taskio.tag_type;
10843					msg_info.hdr.msg_type =
10844						CTL_MSG_MANAGE_TASKS;
10845					msg_info.hdr.original_sc = NULL;
10846					msg_info.hdr.serializing_sc = NULL;
10847#if 0
10848					printf("Sent Abort to other side\n");
10849#endif
10850					if (CTL_HA_STATUS_SUCCESS !=
10851					        ctl_ha_msg_send(CTL_HA_CHAN_CTL,
10852		    				(void *)&msg_info,
10853						sizeof(msg_info), 0)) {
10854					}
10855				}
10856#if 0
10857				printf("ctl_abort_task: found I/O to abort\n");
10858#endif
10859				break;
10860			}
10861		}
10862	}
10863
10864bailout:
10865
10866	if (found == 0) {
10867		/*
10868		 * This isn't really an error.  It's entirely possible for
10869		 * the abort and command completion to cross on the wire.
10870		 * This is more of an informative/diagnostic error.
10871		 */
10872#if 0
10873		printf("ctl_abort_task: ABORT sent for nonexistent I/O: "
10874		       "%d:%d:%d:%d tag %d type %d\n",
10875		       io->io_hdr.nexus.initid.id,
10876		       io->io_hdr.nexus.targ_port,
10877		       io->io_hdr.nexus.targ_target.id,
10878		       io->io_hdr.nexus.targ_lun, io->taskio.tag_num,
10879		       io->taskio.tag_type);
10880#endif
10881		return (1);
10882	} else
10883		return (0);
10884}
10885
10886/*
10887 * This routine cannot block!  It must be callable from an interrupt
10888 * handler as well as from the work thread.
10889 */
10890static void
10891ctl_run_task_queue(struct ctl_softc *ctl_softc)
10892{
10893	union ctl_io *io, *next_io;
10894
10895	mtx_assert(&ctl_softc->ctl_lock, MA_OWNED);
10896
10897	CTL_DEBUG_PRINT(("ctl_run_task_queue\n"));
10898
10899	for (io = (union ctl_io *)STAILQ_FIRST(&ctl_softc->task_queue);
10900	     io != NULL; io = next_io) {
10901		int retval;
10902		const char *task_desc;
10903
10904		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
10905
10906		retval = 0;
10907
10908		switch (io->io_hdr.io_type) {
10909		case CTL_IO_TASK: {
10910			task_desc = ctl_scsi_task_string(&io->taskio);
10911			if (task_desc != NULL) {
10912#ifdef NEEDTOPORT
10913				csevent_log(CSC_CTL | CSC_SHELF_SW |
10914					    CTL_TASK_REPORT,
10915					    csevent_LogType_Trace,
10916					    csevent_Severity_Information,
10917					    csevent_AlertLevel_Green,
10918					    csevent_FRU_Firmware,
10919					    csevent_FRU_Unknown,
10920					    "CTL: received task: %s",task_desc);
10921#endif
10922			} else {
10923#ifdef NEEDTOPORT
10924				csevent_log(CSC_CTL | CSC_SHELF_SW |
10925					    CTL_TASK_REPORT,
10926					    csevent_LogType_Trace,
10927					    csevent_Severity_Information,
10928					    csevent_AlertLevel_Green,
10929					    csevent_FRU_Firmware,
10930					    csevent_FRU_Unknown,
10931					    "CTL: received unknown task "
10932					    "type: %d (%#x)",
10933					    io->taskio.task_action,
10934					    io->taskio.task_action);
10935#endif
10936			}
10937			switch (io->taskio.task_action) {
10938			case CTL_TASK_ABORT_TASK:
10939				retval = ctl_abort_task(io);
10940				break;
10941			case CTL_TASK_ABORT_TASK_SET:
10942				break;
10943			case CTL_TASK_CLEAR_ACA:
10944				break;
10945			case CTL_TASK_CLEAR_TASK_SET:
10946				break;
10947			case CTL_TASK_LUN_RESET: {
10948				struct ctl_lun *lun;
10949				uint32_t targ_lun;
10950				int retval;
10951
10952				targ_lun = io->io_hdr.nexus.targ_lun;
10953
10954				if ((targ_lun < CTL_MAX_LUNS)
10955				 && (ctl_softc->ctl_luns[targ_lun] != NULL))
10956					lun = ctl_softc->ctl_luns[targ_lun];
10957				else {
10958					retval = 1;
10959					break;
10960				}
10961
10962				if (!(io->io_hdr.flags &
10963				    CTL_FLAG_FROM_OTHER_SC)) {
10964					union ctl_ha_msg msg_info;
10965
10966					io->io_hdr.flags |=
10967						CTL_FLAG_SENT_2OTHER_SC;
10968					msg_info.hdr.msg_type =
10969						CTL_MSG_MANAGE_TASKS;
10970					msg_info.hdr.nexus = io->io_hdr.nexus;
10971					msg_info.task.task_action =
10972						CTL_TASK_LUN_RESET;
10973					msg_info.hdr.original_sc = NULL;
10974					msg_info.hdr.serializing_sc = NULL;
10975					if (CTL_HA_STATUS_SUCCESS !=
10976					    ctl_ha_msg_send(CTL_HA_CHAN_CTL,
10977					    (void *)&msg_info,
10978					    sizeof(msg_info), 0)) {
10979					}
10980				}
10981
10982				retval = ctl_lun_reset(lun, io,
10983						       CTL_UA_LUN_RESET);
10984				break;
10985			}
10986			case CTL_TASK_TARGET_RESET:
10987				retval = ctl_target_reset(ctl_softc, io,
10988							  CTL_UA_TARG_RESET);
10989				break;
10990			case CTL_TASK_BUS_RESET:
10991				retval = ctl_bus_reset(ctl_softc, io);
10992				break;
10993			case CTL_TASK_PORT_LOGIN:
10994				break;
10995			case CTL_TASK_PORT_LOGOUT:
10996				break;
10997			default:
10998				printf("ctl_run_task_queue: got unknown task "
10999				       "management event %d\n",
11000				       io->taskio.task_action);
11001				break;
11002			}
11003			if (retval == 0)
11004				io->io_hdr.status = CTL_SUCCESS;
11005			else
11006				io->io_hdr.status = CTL_ERROR;
11007
11008			STAILQ_REMOVE(&ctl_softc->task_queue, &io->io_hdr,
11009				      ctl_io_hdr, links);
11010			/*
11011			 * This will queue this I/O to the done queue, but the
11012			 * work thread won't be able to process it until we
11013			 * return and the lock is released.
11014			 */
11015			ctl_done_lock(io, /*have_lock*/ 1);
11016			break;
11017		}
11018		default: {
11019
11020			printf("%s: invalid I/O type %d msg %d cdb %x"
11021			       " iptl: %ju:%d:%ju:%d tag 0x%04x\n",
11022			       __func__, io->io_hdr.io_type,
11023			       io->io_hdr.msg_type, io->scsiio.cdb[0],
11024			       (uintmax_t)io->io_hdr.nexus.initid.id,
11025			       io->io_hdr.nexus.targ_port,
11026			       (uintmax_t)io->io_hdr.nexus.targ_target.id,
11027			       io->io_hdr.nexus.targ_lun,
11028			       (io->io_hdr.io_type == CTL_IO_TASK) ?
11029			       io->taskio.tag_num : io->scsiio.tag_num);
11030			STAILQ_REMOVE(&ctl_softc->task_queue, &io->io_hdr,
11031				      ctl_io_hdr, links);
11032			ctl_free_io(io);
11033			break;
11034		}
11035		}
11036	}
11037
11038	ctl_softc->flags &= ~CTL_FLAG_TASK_PENDING;
11039}
11040
11041/*
11042 * For HA operation.  Handle commands that come in from the other
11043 * controller.
11044 */
11045static void
11046ctl_handle_isc(union ctl_io *io)
11047{
11048	int free_io;
11049	struct ctl_lun *lun;
11050	struct ctl_softc *ctl_softc;
11051
11052	ctl_softc = control_softc;
11053
11054	lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
11055
11056	switch (io->io_hdr.msg_type) {
11057	case CTL_MSG_SERIALIZE:
11058		free_io = ctl_serialize_other_sc_cmd(&io->scsiio,
11059						     /*have_lock*/ 0);
11060		break;
11061	case CTL_MSG_R2R: {
11062		uint8_t opcode;
11063		struct ctl_cmd_entry *entry;
11064
11065		/*
11066		 * This is only used in SER_ONLY mode.
11067		 */
11068		free_io = 0;
11069		opcode = io->scsiio.cdb[0];
11070		entry = &ctl_cmd_table[opcode];
11071		mtx_lock(&ctl_softc->ctl_lock);
11072		if (ctl_scsiio_lun_check(ctl_softc, lun,
11073		    entry, (struct ctl_scsiio *)io) != 0) {
11074			ctl_done_lock(io, /*have_lock*/ 1);
11075			mtx_unlock(&ctl_softc->ctl_lock);
11076			break;
11077		}
11078		io->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
11079		STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
11080				   &io->io_hdr, links);
11081		mtx_unlock(&ctl_softc->ctl_lock);
11082		break;
11083	}
11084	case CTL_MSG_FINISH_IO:
11085		if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
11086			free_io = 0;
11087			ctl_done_lock(io, /*have_lock*/ 0);
11088		} else {
11089			free_io = 1;
11090			mtx_lock(&ctl_softc->ctl_lock);
11091			TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr,
11092				     ooa_links);
11093			STAILQ_REMOVE(&ctl_softc->task_queue,
11094				      &io->io_hdr, ctl_io_hdr, links);
11095			ctl_check_blocked(lun);
11096			mtx_unlock(&ctl_softc->ctl_lock);
11097		}
11098		break;
11099	case CTL_MSG_PERS_ACTION:
11100		ctl_hndl_per_res_out_on_other_sc(
11101			(union ctl_ha_msg *)&io->presio.pr_msg);
11102		free_io = 1;
11103		break;
11104	case CTL_MSG_BAD_JUJU:
11105		free_io = 0;
11106		ctl_done_lock(io, /*have_lock*/ 0);
11107		break;
11108	case CTL_MSG_DATAMOVE:
11109		/* Only used in XFER mode */
11110		free_io = 0;
11111		ctl_datamove_remote(io);
11112		break;
11113	case CTL_MSG_DATAMOVE_DONE:
11114		/* Only used in XFER mode */
11115		free_io = 0;
11116		io->scsiio.be_move_done(io);
11117		break;
11118	default:
11119		free_io = 1;
11120		printf("%s: Invalid message type %d\n",
11121		       __func__, io->io_hdr.msg_type);
11122		break;
11123	}
11124	if (free_io)
11125		ctl_free_io(io);
11126
11127}
11128
11129
11130/*
11131 * Returns the match type in the case of a match, or CTL_LUN_PAT_NONE if
11132 * there is no match.
11133 */
11134static ctl_lun_error_pattern
11135ctl_cmd_pattern_match(struct ctl_scsiio *ctsio, struct ctl_error_desc *desc)
11136{
11137	struct ctl_cmd_entry *entry;
11138	ctl_lun_error_pattern filtered_pattern, pattern;
11139	uint8_t opcode;
11140
11141	pattern = desc->error_pattern;
11142
11143	/*
11144	 * XXX KDM we need more data passed into this function to match a
11145	 * custom pattern, and we actually need to implement custom pattern
11146	 * matching.
11147	 */
11148	if (pattern & CTL_LUN_PAT_CMD)
11149		return (CTL_LUN_PAT_CMD);
11150
11151	if ((pattern & CTL_LUN_PAT_MASK) == CTL_LUN_PAT_ANY)
11152		return (CTL_LUN_PAT_ANY);
11153
11154	opcode = ctsio->cdb[0];
11155	entry = &ctl_cmd_table[opcode];
11156
11157	filtered_pattern = entry->pattern & pattern;
11158
11159	/*
11160	 * If the user requested specific flags in the pattern (e.g.
11161	 * CTL_LUN_PAT_RANGE), make sure the command supports all of those
11162	 * flags.
11163	 *
11164	 * If the user did not specify any flags, it doesn't matter whether
11165	 * or not the command supports the flags.
11166	 */
11167	if ((filtered_pattern & ~CTL_LUN_PAT_MASK) !=
11168	     (pattern & ~CTL_LUN_PAT_MASK))
11169		return (CTL_LUN_PAT_NONE);
11170
11171	/*
11172	 * If the user asked for a range check, see if the requested LBA
11173	 * range overlaps with this command's LBA range.
11174	 */
11175	if (filtered_pattern & CTL_LUN_PAT_RANGE) {
11176		uint64_t lba1;
11177		uint32_t len1;
11178		ctl_action action;
11179		int retval;
11180
11181		retval = ctl_get_lba_len((union ctl_io *)ctsio, &lba1, &len1);
11182		if (retval != 0)
11183			return (CTL_LUN_PAT_NONE);
11184
11185		action = ctl_extent_check_lba(lba1, len1, desc->lba_range.lba,
11186					      desc->lba_range.len);
11187		/*
11188		 * A "pass" means that the LBA ranges don't overlap, so
11189		 * this doesn't match the user's range criteria.
11190		 */
11191		if (action == CTL_ACTION_PASS)
11192			return (CTL_LUN_PAT_NONE);
11193	}
11194
11195	return (filtered_pattern);
11196}
11197
11198static void
11199ctl_inject_error(struct ctl_lun *lun, union ctl_io *io)
11200{
11201	struct ctl_error_desc *desc, *desc2;
11202
11203	mtx_assert(&control_softc->ctl_lock, MA_OWNED);
11204
11205	STAILQ_FOREACH_SAFE(desc, &lun->error_list, links, desc2) {
11206		ctl_lun_error_pattern pattern;
11207		/*
11208		 * Check to see whether this particular command matches
11209		 * the pattern in the descriptor.
11210		 */
11211		pattern = ctl_cmd_pattern_match(&io->scsiio, desc);
11212		if ((pattern & CTL_LUN_PAT_MASK) == CTL_LUN_PAT_NONE)
11213			continue;
11214
11215		switch (desc->lun_error & CTL_LUN_INJ_TYPE) {
11216		case CTL_LUN_INJ_ABORTED:
11217			ctl_set_aborted(&io->scsiio);
11218			break;
11219		case CTL_LUN_INJ_MEDIUM_ERR:
11220			ctl_set_medium_error(&io->scsiio);
11221			break;
11222		case CTL_LUN_INJ_UA:
11223			/* 29h/00h  POWER ON, RESET, OR BUS DEVICE RESET
11224			 * OCCURRED */
11225			ctl_set_ua(&io->scsiio, 0x29, 0x00);
11226			break;
11227		case CTL_LUN_INJ_CUSTOM:
11228			/*
11229			 * We're assuming the user knows what he is doing.
11230			 * Just copy the sense information without doing
11231			 * checks.
11232			 */
11233			bcopy(&desc->custom_sense, &io->scsiio.sense_data,
11234			      ctl_min(sizeof(desc->custom_sense),
11235				      sizeof(io->scsiio.sense_data)));
11236			io->scsiio.scsi_status = SCSI_STATUS_CHECK_COND;
11237			io->scsiio.sense_len = SSD_FULL_SIZE;
11238			io->io_hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
11239			break;
11240		case CTL_LUN_INJ_NONE:
11241		default:
11242			/*
11243			 * If this is an error injection type we don't know
11244			 * about, clear the continuous flag (if it is set)
11245			 * so it will get deleted below.
11246			 */
11247			desc->lun_error &= ~CTL_LUN_INJ_CONTINUOUS;
11248			break;
11249		}
11250		/*
11251		 * By default, each error injection action is a one-shot
11252		 */
11253		if (desc->lun_error & CTL_LUN_INJ_CONTINUOUS)
11254			continue;
11255
11256		STAILQ_REMOVE(&lun->error_list, desc, ctl_error_desc, links);
11257
11258		free(desc, M_CTL);
11259	}
11260}
11261
11262#ifdef CTL_IO_DELAY
11263static void
11264ctl_datamove_timer_wakeup(void *arg)
11265{
11266	union ctl_io *io;
11267
11268	io = (union ctl_io *)arg;
11269
11270	ctl_datamove(io);
11271}
11272#endif /* CTL_IO_DELAY */
11273
11274void
11275ctl_datamove(union ctl_io *io)
11276{
11277	void (*fe_datamove)(union ctl_io *io);
11278
11279	mtx_assert(&control_softc->ctl_lock, MA_NOTOWNED);
11280
11281	CTL_DEBUG_PRINT(("ctl_datamove\n"));
11282
11283#ifdef CTL_TIME_IO
11284	if ((time_uptime - io->io_hdr.start_time) > ctl_time_io_secs) {
11285		char str[256];
11286		char path_str[64];
11287		struct sbuf sb;
11288
11289		ctl_scsi_path_string(io, path_str, sizeof(path_str));
11290		sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
11291
11292		sbuf_cat(&sb, path_str);
11293		switch (io->io_hdr.io_type) {
11294		case CTL_IO_SCSI:
11295			ctl_scsi_command_string(&io->scsiio, NULL, &sb);
11296			sbuf_printf(&sb, "\n");
11297			sbuf_cat(&sb, path_str);
11298			sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
11299				    io->scsiio.tag_num, io->scsiio.tag_type);
11300			break;
11301		case CTL_IO_TASK:
11302			sbuf_printf(&sb, "Task I/O type: %d, Tag: 0x%04x, "
11303				    "Tag Type: %d\n", io->taskio.task_action,
11304				    io->taskio.tag_num, io->taskio.tag_type);
11305			break;
11306		default:
11307			printf("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
11308			panic("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
11309			break;
11310		}
11311		sbuf_cat(&sb, path_str);
11312		sbuf_printf(&sb, "ctl_datamove: %jd seconds\n",
11313			    (intmax_t)time_uptime - io->io_hdr.start_time);
11314		sbuf_finish(&sb);
11315		printf("%s", sbuf_data(&sb));
11316	}
11317#endif /* CTL_TIME_IO */
11318
11319	mtx_lock(&control_softc->ctl_lock);
11320#ifdef CTL_IO_DELAY
11321	if (io->io_hdr.flags & CTL_FLAG_DELAY_DONE) {
11322		struct ctl_lun *lun;
11323
11324		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
11325
11326		io->io_hdr.flags &= ~CTL_FLAG_DELAY_DONE;
11327	} else {
11328		struct ctl_lun *lun;
11329
11330		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
11331		if ((lun != NULL)
11332		 && (lun->delay_info.datamove_delay > 0)) {
11333			struct callout *callout;
11334
11335			callout = (struct callout *)&io->io_hdr.timer_bytes;
11336			callout_init(callout, /*mpsafe*/ 1);
11337			io->io_hdr.flags |= CTL_FLAG_DELAY_DONE;
11338			callout_reset(callout,
11339				      lun->delay_info.datamove_delay * hz,
11340				      ctl_datamove_timer_wakeup, io);
11341			if (lun->delay_info.datamove_type ==
11342			    CTL_DELAY_TYPE_ONESHOT)
11343				lun->delay_info.datamove_delay = 0;
11344			mtx_unlock(&control_softc->ctl_lock);
11345			return;
11346		}
11347	}
11348#endif
11349	/*
11350	 * If we have any pending task management commands, process them
11351	 * first.  This is necessary to eliminate a race condition with the
11352	 * FETD:
11353	 *
11354	 * - FETD submits a task management command, like an abort.
11355	 * - Back end calls fe_datamove() to move the data for the aborted
11356	 *   command.  The FETD can't really accept it, but if it did, it
11357	 *   would end up transmitting data for a command that the initiator
11358	 *   told us to abort.
11359	 *
11360	 * We close the race by processing all pending task management
11361	 * commands here (we can't block!), and then check this I/O to see
11362	 * if it has been aborted.  If so, return it to the back end with
11363	 * bad status, so the back end can say return an error to the back end
11364	 * and then when the back end returns an error, we can return the
11365	 * aborted command to the FETD, so it can clean up its resources.
11366	 */
11367	if (control_softc->flags & CTL_FLAG_TASK_PENDING)
11368		ctl_run_task_queue(control_softc);
11369
11370	/*
11371	 * This command has been aborted.  Set the port status, so we fail
11372	 * the data move.
11373	 */
11374	if (io->io_hdr.flags & CTL_FLAG_ABORT) {
11375		printf("ctl_datamove: tag 0x%04x on (%ju:%d:%ju:%d) aborted\n",
11376		       io->scsiio.tag_num,(uintmax_t)io->io_hdr.nexus.initid.id,
11377		       io->io_hdr.nexus.targ_port,
11378		       (uintmax_t)io->io_hdr.nexus.targ_target.id,
11379		       io->io_hdr.nexus.targ_lun);
11380		io->io_hdr.status = CTL_CMD_ABORTED;
11381		io->io_hdr.port_status = 31337;
11382		mtx_unlock(&control_softc->ctl_lock);
11383		/*
11384		 * Note that the backend, in this case, will get the
11385		 * callback in its context.  In other cases it may get
11386		 * called in the frontend's interrupt thread context.
11387		 */
11388		io->scsiio.be_move_done(io);
11389		return;
11390	}
11391
11392	/*
11393	 * If we're in XFER mode and this I/O is from the other shelf
11394	 * controller, we need to send the DMA to the other side to
11395	 * actually transfer the data to/from the host.  In serialize only
11396	 * mode the transfer happens below CTL and ctl_datamove() is only
11397	 * called on the machine that originally received the I/O.
11398	 */
11399	if ((control_softc->ha_mode == CTL_HA_MODE_XFER)
11400	 && (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
11401		union ctl_ha_msg msg;
11402		uint32_t sg_entries_sent;
11403		int do_sg_copy;
11404		int i;
11405
11406		memset(&msg, 0, sizeof(msg));
11407		msg.hdr.msg_type = CTL_MSG_DATAMOVE;
11408		msg.hdr.original_sc = io->io_hdr.original_sc;
11409		msg.hdr.serializing_sc = io;
11410		msg.hdr.nexus = io->io_hdr.nexus;
11411		msg.dt.flags = io->io_hdr.flags;
11412		/*
11413		 * We convert everything into a S/G list here.  We can't
11414		 * pass by reference, only by value between controllers.
11415		 * So we can't pass a pointer to the S/G list, only as many
11416		 * S/G entries as we can fit in here.  If it's possible for
11417		 * us to get more than CTL_HA_MAX_SG_ENTRIES S/G entries,
11418		 * then we need to break this up into multiple transfers.
11419		 */
11420		if (io->scsiio.kern_sg_entries == 0) {
11421			msg.dt.kern_sg_entries = 1;
11422			/*
11423			 * If this is in cached memory, flush the cache
11424			 * before we send the DMA request to the other
11425			 * controller.  We want to do this in either the
11426			 * read or the write case.  The read case is
11427			 * straightforward.  In the write case, we want to
11428			 * make sure nothing is in the local cache that
11429			 * could overwrite the DMAed data.
11430			 */
11431			if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
11432				/*
11433				 * XXX KDM use bus_dmamap_sync() here.
11434				 */
11435			}
11436
11437			/*
11438			 * Convert to a physical address if this is a
11439			 * virtual address.
11440			 */
11441			if (io->io_hdr.flags & CTL_FLAG_BUS_ADDR) {
11442				msg.dt.sg_list[0].addr =
11443					io->scsiio.kern_data_ptr;
11444			} else {
11445				/*
11446				 * XXX KDM use busdma here!
11447				 */
11448#if 0
11449				msg.dt.sg_list[0].addr = (void *)
11450					vtophys(io->scsiio.kern_data_ptr);
11451#endif
11452			}
11453
11454			msg.dt.sg_list[0].len = io->scsiio.kern_data_len;
11455			do_sg_copy = 0;
11456		} else {
11457			struct ctl_sg_entry *sgl;
11458
11459			do_sg_copy = 1;
11460			msg.dt.kern_sg_entries = io->scsiio.kern_sg_entries;
11461			sgl = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
11462			if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
11463				/*
11464				 * XXX KDM use bus_dmamap_sync() here.
11465				 */
11466			}
11467		}
11468
11469		msg.dt.kern_data_len = io->scsiio.kern_data_len;
11470		msg.dt.kern_total_len = io->scsiio.kern_total_len;
11471		msg.dt.kern_data_resid = io->scsiio.kern_data_resid;
11472		msg.dt.kern_rel_offset = io->scsiio.kern_rel_offset;
11473		msg.dt.sg_sequence = 0;
11474
11475		/*
11476		 * Loop until we've sent all of the S/G entries.  On the
11477		 * other end, we'll recompose these S/G entries into one
11478		 * contiguous list before passing it to the
11479		 */
11480		for (sg_entries_sent = 0; sg_entries_sent <
11481		     msg.dt.kern_sg_entries; msg.dt.sg_sequence++) {
11482			msg.dt.cur_sg_entries = ctl_min((sizeof(msg.dt.sg_list)/
11483				sizeof(msg.dt.sg_list[0])),
11484				msg.dt.kern_sg_entries - sg_entries_sent);
11485
11486			if (do_sg_copy != 0) {
11487				struct ctl_sg_entry *sgl;
11488				int j;
11489
11490				sgl = (struct ctl_sg_entry *)
11491					io->scsiio.kern_data_ptr;
11492				/*
11493				 * If this is in cached memory, flush the cache
11494				 * before we send the DMA request to the other
11495				 * controller.  We want to do this in either
11496				 * the * read or the write case.  The read
11497				 * case is straightforward.  In the write
11498				 * case, we want to make sure nothing is
11499				 * in the local cache that could overwrite
11500				 * the DMAed data.
11501				 */
11502
11503				for (i = sg_entries_sent, j = 0;
11504				     i < msg.dt.cur_sg_entries; i++, j++) {
11505					if ((io->io_hdr.flags &
11506					     CTL_FLAG_NO_DATASYNC) == 0) {
11507						/*
11508						 * XXX KDM use bus_dmamap_sync()
11509						 */
11510					}
11511					if ((io->io_hdr.flags &
11512					     CTL_FLAG_BUS_ADDR) == 0) {
11513						/*
11514						 * XXX KDM use busdma.
11515						 */
11516#if 0
11517						msg.dt.sg_list[j].addr =(void *)
11518						       vtophys(sgl[i].addr);
11519#endif
11520					} else {
11521						msg.dt.sg_list[j].addr =
11522							sgl[i].addr;
11523					}
11524					msg.dt.sg_list[j].len = sgl[i].len;
11525				}
11526			}
11527
11528			sg_entries_sent += msg.dt.cur_sg_entries;
11529			if (sg_entries_sent >= msg.dt.kern_sg_entries)
11530				msg.dt.sg_last = 1;
11531			else
11532				msg.dt.sg_last = 0;
11533
11534			/*
11535			 * XXX KDM drop and reacquire the lock here?
11536			 */
11537			if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg,
11538			    sizeof(msg), 0) > CTL_HA_STATUS_SUCCESS) {
11539				/*
11540				 * XXX do something here.
11541				 */
11542			}
11543
11544			msg.dt.sent_sg_entries = sg_entries_sent;
11545		}
11546		io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
11547		if (io->io_hdr.flags & CTL_FLAG_FAILOVER)
11548			ctl_failover_io(io, /*have_lock*/ 1);
11549
11550	} else {
11551
11552		/*
11553		 * Lookup the fe_datamove() function for this particular
11554		 * front end.
11555		 */
11556		fe_datamove =
11557		    control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
11558		mtx_unlock(&control_softc->ctl_lock);
11559
11560		fe_datamove(io);
11561	}
11562}
11563
11564static void
11565ctl_send_datamove_done(union ctl_io *io, int have_lock)
11566{
11567	union ctl_ha_msg msg;
11568	int isc_status;
11569
11570	memset(&msg, 0, sizeof(msg));
11571
11572	msg.hdr.msg_type = CTL_MSG_DATAMOVE_DONE;
11573	msg.hdr.original_sc = io;
11574	msg.hdr.serializing_sc = io->io_hdr.serializing_sc;
11575	msg.hdr.nexus = io->io_hdr.nexus;
11576	msg.hdr.status = io->io_hdr.status;
11577	msg.scsi.tag_num = io->scsiio.tag_num;
11578	msg.scsi.tag_type = io->scsiio.tag_type;
11579	msg.scsi.scsi_status = io->scsiio.scsi_status;
11580	memcpy(&msg.scsi.sense_data, &io->scsiio.sense_data,
11581	       sizeof(io->scsiio.sense_data));
11582	msg.scsi.sense_len = io->scsiio.sense_len;
11583	msg.scsi.sense_residual = io->scsiio.sense_residual;
11584	msg.scsi.fetd_status = io->io_hdr.port_status;
11585	msg.scsi.residual = io->scsiio.residual;
11586	io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
11587
11588	if (io->io_hdr.flags & CTL_FLAG_FAILOVER) {
11589		ctl_failover_io(io, /*have_lock*/ have_lock);
11590		return;
11591	}
11592
11593	isc_status = ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg, sizeof(msg), 0);
11594	if (isc_status > CTL_HA_STATUS_SUCCESS) {
11595		/* XXX do something if this fails */
11596	}
11597
11598}
11599
11600/*
11601 * The DMA to the remote side is done, now we need to tell the other side
11602 * we're done so it can continue with its data movement.
11603 */
11604static void
11605ctl_datamove_remote_write_cb(struct ctl_ha_dt_req *rq)
11606{
11607	union ctl_io *io;
11608
11609	io = rq->context;
11610
11611	if (rq->ret != CTL_HA_STATUS_SUCCESS) {
11612		printf("%s: ISC DMA write failed with error %d", __func__,
11613		       rq->ret);
11614		ctl_set_internal_failure(&io->scsiio,
11615					 /*sks_valid*/ 1,
11616					 /*retry_count*/ rq->ret);
11617	}
11618
11619	ctl_dt_req_free(rq);
11620
11621	/*
11622	 * In this case, we had to malloc the memory locally.  Free it.
11623	 */
11624	if ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0) {
11625		int i;
11626		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
11627			free(io->io_hdr.local_sglist[i].addr, M_CTL);
11628	}
11629	/*
11630	 * The data is in local and remote memory, so now we need to send
11631	 * status (good or back) back to the other side.
11632	 */
11633	ctl_send_datamove_done(io, /*have_lock*/ 0);
11634}
11635
11636/*
11637 * We've moved the data from the host/controller into local memory.  Now we
11638 * need to push it over to the remote controller's memory.
11639 */
11640static int
11641ctl_datamove_remote_dm_write_cb(union ctl_io *io)
11642{
11643	int retval;
11644
11645	retval = 0;
11646
11647	retval = ctl_datamove_remote_xfer(io, CTL_HA_DT_CMD_WRITE,
11648					  ctl_datamove_remote_write_cb);
11649
11650	return (retval);
11651}
11652
11653static void
11654ctl_datamove_remote_write(union ctl_io *io)
11655{
11656	int retval;
11657	void (*fe_datamove)(union ctl_io *io);
11658
11659	/*
11660	 * - Get the data from the host/HBA into local memory.
11661	 * - DMA memory from the local controller to the remote controller.
11662	 * - Send status back to the remote controller.
11663	 */
11664
11665	retval = ctl_datamove_remote_sgl_setup(io);
11666	if (retval != 0)
11667		return;
11668
11669	/* Switch the pointer over so the FETD knows what to do */
11670	io->scsiio.kern_data_ptr = (uint8_t *)io->io_hdr.local_sglist;
11671
11672	/*
11673	 * Use a custom move done callback, since we need to send completion
11674	 * back to the other controller, not to the backend on this side.
11675	 */
11676	io->scsiio.be_move_done = ctl_datamove_remote_dm_write_cb;
11677
11678	fe_datamove = control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
11679
11680	fe_datamove(io);
11681
11682	return;
11683
11684}
11685
11686static int
11687ctl_datamove_remote_dm_read_cb(union ctl_io *io)
11688{
11689#if 0
11690	char str[256];
11691	char path_str[64];
11692	struct sbuf sb;
11693#endif
11694
11695	/*
11696	 * In this case, we had to malloc the memory locally.  Free it.
11697	 */
11698	if ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0) {
11699		int i;
11700		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
11701			free(io->io_hdr.local_sglist[i].addr, M_CTL);
11702	}
11703
11704#if 0
11705	scsi_path_string(io, path_str, sizeof(path_str));
11706	sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
11707	sbuf_cat(&sb, path_str);
11708	scsi_command_string(&io->scsiio, NULL, &sb);
11709	sbuf_printf(&sb, "\n");
11710	sbuf_cat(&sb, path_str);
11711	sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
11712		    io->scsiio.tag_num, io->scsiio.tag_type);
11713	sbuf_cat(&sb, path_str);
11714	sbuf_printf(&sb, "%s: flags %#x, status %#x\n", __func__,
11715		    io->io_hdr.flags, io->io_hdr.status);
11716	sbuf_finish(&sb);
11717	printk("%s", sbuf_data(&sb));
11718#endif
11719
11720
11721	/*
11722	 * The read is done, now we need to send status (good or bad) back
11723	 * to the other side.
11724	 */
11725	ctl_send_datamove_done(io, /*have_lock*/ 0);
11726
11727	return (0);
11728}
11729
11730static void
11731ctl_datamove_remote_read_cb(struct ctl_ha_dt_req *rq)
11732{
11733	union ctl_io *io;
11734	void (*fe_datamove)(union ctl_io *io);
11735
11736	io = rq->context;
11737
11738	if (rq->ret != CTL_HA_STATUS_SUCCESS) {
11739		printf("%s: ISC DMA read failed with error %d", __func__,
11740		       rq->ret);
11741		ctl_set_internal_failure(&io->scsiio,
11742					 /*sks_valid*/ 1,
11743					 /*retry_count*/ rq->ret);
11744	}
11745
11746	ctl_dt_req_free(rq);
11747
11748	/* Switch the pointer over so the FETD knows what to do */
11749	io->scsiio.kern_data_ptr = (uint8_t *)io->io_hdr.local_sglist;
11750
11751	/*
11752	 * Use a custom move done callback, since we need to send completion
11753	 * back to the other controller, not to the backend on this side.
11754	 */
11755	io->scsiio.be_move_done = ctl_datamove_remote_dm_read_cb;
11756
11757	/* XXX KDM add checks like the ones in ctl_datamove? */
11758
11759	fe_datamove = control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
11760
11761	fe_datamove(io);
11762}
11763
11764static int
11765ctl_datamove_remote_sgl_setup(union ctl_io *io)
11766{
11767	struct ctl_sg_entry *local_sglist, *remote_sglist;
11768	struct ctl_sg_entry *local_dma_sglist, *remote_dma_sglist;
11769	struct ctl_softc *softc;
11770	int retval;
11771	int i;
11772
11773	retval = 0;
11774	softc = control_softc;
11775
11776	local_sglist = io->io_hdr.local_sglist;
11777	local_dma_sglist = io->io_hdr.local_dma_sglist;
11778	remote_sglist = io->io_hdr.remote_sglist;
11779	remote_dma_sglist = io->io_hdr.remote_dma_sglist;
11780
11781	if (io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) {
11782		for (i = 0; i < io->scsiio.kern_sg_entries; i++) {
11783			local_sglist[i].len = remote_sglist[i].len;
11784
11785			/*
11786			 * XXX Detect the situation where the RS-level I/O
11787			 * redirector on the other side has already read the
11788			 * data off of the AOR RS on this side, and
11789			 * transferred it to remote (mirror) memory on the
11790			 * other side.  Since we already have the data in
11791			 * memory here, we just need to use it.
11792			 *
11793			 * XXX KDM this can probably be removed once we
11794			 * get the cache device code in and take the
11795			 * current AOR implementation out.
11796			 */
11797#ifdef NEEDTOPORT
11798			if ((remote_sglist[i].addr >=
11799			     (void *)vtophys(softc->mirr->addr))
11800			 && (remote_sglist[i].addr <
11801			     ((void *)vtophys(softc->mirr->addr) +
11802			     CacheMirrorOffset))) {
11803				local_sglist[i].addr = remote_sglist[i].addr -
11804					CacheMirrorOffset;
11805				if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) ==
11806				     CTL_FLAG_DATA_IN)
11807					io->io_hdr.flags |= CTL_FLAG_REDIR_DONE;
11808			} else {
11809				local_sglist[i].addr = remote_sglist[i].addr +
11810					CacheMirrorOffset;
11811			}
11812#endif
11813#if 0
11814			printf("%s: local %p, remote %p, len %d\n",
11815			       __func__, local_sglist[i].addr,
11816			       remote_sglist[i].addr, local_sglist[i].len);
11817#endif
11818		}
11819	} else {
11820		uint32_t len_to_go;
11821
11822		/*
11823		 * In this case, we don't have automatically allocated
11824		 * memory for this I/O on this controller.  This typically
11825		 * happens with internal CTL I/O -- e.g. inquiry, mode
11826		 * sense, etc.  Anything coming from RAIDCore will have
11827		 * a mirror area available.
11828		 */
11829		len_to_go = io->scsiio.kern_data_len;
11830
11831		/*
11832		 * Clear the no datasync flag, we have to use malloced
11833		 * buffers.
11834		 */
11835		io->io_hdr.flags &= ~CTL_FLAG_NO_DATASYNC;
11836
11837		/*
11838		 * The difficult thing here is that the size of the various
11839		 * S/G segments may be different than the size from the
11840		 * remote controller.  That'll make it harder when DMAing
11841		 * the data back to the other side.
11842		 */
11843		for (i = 0; (i < sizeof(io->io_hdr.remote_sglist) /
11844		     sizeof(io->io_hdr.remote_sglist[0])) &&
11845		     (len_to_go > 0); i++) {
11846			local_sglist[i].len = ctl_min(len_to_go, 131072);
11847			CTL_SIZE_8B(local_dma_sglist[i].len,
11848				    local_sglist[i].len);
11849			local_sglist[i].addr =
11850				malloc(local_dma_sglist[i].len, M_CTL,M_WAITOK);
11851
11852			local_dma_sglist[i].addr = local_sglist[i].addr;
11853
11854			if (local_sglist[i].addr == NULL) {
11855				int j;
11856
11857				printf("malloc failed for %zd bytes!",
11858				       local_dma_sglist[i].len);
11859				for (j = 0; j < i; j++) {
11860					free(local_sglist[j].addr, M_CTL);
11861				}
11862				ctl_set_internal_failure(&io->scsiio,
11863							 /*sks_valid*/ 1,
11864							 /*retry_count*/ 4857);
11865				retval = 1;
11866				goto bailout_error;
11867
11868			}
11869			/* XXX KDM do we need a sync here? */
11870
11871			len_to_go -= local_sglist[i].len;
11872		}
11873		/*
11874		 * Reset the number of S/G entries accordingly.  The
11875		 * original number of S/G entries is available in
11876		 * rem_sg_entries.
11877		 */
11878		io->scsiio.kern_sg_entries = i;
11879
11880#if 0
11881		printf("%s: kern_sg_entries = %d\n", __func__,
11882		       io->scsiio.kern_sg_entries);
11883		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
11884			printf("%s: sg[%d] = %p, %d (DMA: %d)\n", __func__, i,
11885			       local_sglist[i].addr, local_sglist[i].len,
11886			       local_dma_sglist[i].len);
11887#endif
11888	}
11889
11890
11891	return (retval);
11892
11893bailout_error:
11894
11895	ctl_send_datamove_done(io, /*have_lock*/ 0);
11896
11897	return (retval);
11898}
11899
11900static int
11901ctl_datamove_remote_xfer(union ctl_io *io, unsigned command,
11902			 ctl_ha_dt_cb callback)
11903{
11904	struct ctl_ha_dt_req *rq;
11905	struct ctl_sg_entry *remote_sglist, *local_sglist;
11906	struct ctl_sg_entry *remote_dma_sglist, *local_dma_sglist;
11907	uint32_t local_used, remote_used, total_used;
11908	int retval;
11909	int i, j;
11910
11911	retval = 0;
11912
11913	rq = ctl_dt_req_alloc();
11914
11915	/*
11916	 * If we failed to allocate the request, and if the DMA didn't fail
11917	 * anyway, set busy status.  This is just a resource allocation
11918	 * failure.
11919	 */
11920	if ((rq == NULL)
11921	 && ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE))
11922		ctl_set_busy(&io->scsiio);
11923
11924	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE) {
11925
11926		if (rq != NULL)
11927			ctl_dt_req_free(rq);
11928
11929		/*
11930		 * The data move failed.  We need to return status back
11931		 * to the other controller.  No point in trying to DMA
11932		 * data to the remote controller.
11933		 */
11934
11935		ctl_send_datamove_done(io, /*have_lock*/ 0);
11936
11937		retval = 1;
11938
11939		goto bailout;
11940	}
11941
11942	local_sglist = io->io_hdr.local_sglist;
11943	local_dma_sglist = io->io_hdr.local_dma_sglist;
11944	remote_sglist = io->io_hdr.remote_sglist;
11945	remote_dma_sglist = io->io_hdr.remote_dma_sglist;
11946	local_used = 0;
11947	remote_used = 0;
11948	total_used = 0;
11949
11950	if (io->io_hdr.flags & CTL_FLAG_REDIR_DONE) {
11951		rq->ret = CTL_HA_STATUS_SUCCESS;
11952		rq->context = io;
11953		callback(rq);
11954		goto bailout;
11955	}
11956
11957	/*
11958	 * Pull/push the data over the wire from/to the other controller.
11959	 * This takes into account the possibility that the local and
11960	 * remote sglists may not be identical in terms of the size of
11961	 * the elements and the number of elements.
11962	 *
11963	 * One fundamental assumption here is that the length allocated for
11964	 * both the local and remote sglists is identical.  Otherwise, we've
11965	 * essentially got a coding error of some sort.
11966	 */
11967	for (i = 0, j = 0; total_used < io->scsiio.kern_data_len; ) {
11968		int isc_ret;
11969		uint32_t cur_len, dma_length;
11970		uint8_t *tmp_ptr;
11971
11972		rq->id = CTL_HA_DATA_CTL;
11973		rq->command = command;
11974		rq->context = io;
11975
11976		/*
11977		 * Both pointers should be aligned.  But it is possible
11978		 * that the allocation length is not.  They should both
11979		 * also have enough slack left over at the end, though,
11980		 * to round up to the next 8 byte boundary.
11981		 */
11982		cur_len = ctl_min(local_sglist[i].len - local_used,
11983				  remote_sglist[j].len - remote_used);
11984
11985		/*
11986		 * In this case, we have a size issue and need to decrease
11987		 * the size, except in the case where we actually have less
11988		 * than 8 bytes left.  In that case, we need to increase
11989		 * the DMA length to get the last bit.
11990		 */
11991		if ((cur_len & 0x7) != 0) {
11992			if (cur_len > 0x7) {
11993				cur_len = cur_len - (cur_len & 0x7);
11994				dma_length = cur_len;
11995			} else {
11996				CTL_SIZE_8B(dma_length, cur_len);
11997			}
11998
11999		} else
12000			dma_length = cur_len;
12001
12002		/*
12003		 * If we had to allocate memory for this I/O, instead of using
12004		 * the non-cached mirror memory, we'll need to flush the cache
12005		 * before trying to DMA to the other controller.
12006		 *
12007		 * We could end up doing this multiple times for the same
12008		 * segment if we have a larger local segment than remote
12009		 * segment.  That shouldn't be an issue.
12010		 */
12011		if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
12012			/*
12013			 * XXX KDM use bus_dmamap_sync() here.
12014			 */
12015		}
12016
12017		rq->size = dma_length;
12018
12019		tmp_ptr = (uint8_t *)local_sglist[i].addr;
12020		tmp_ptr += local_used;
12021
12022		/* Use physical addresses when talking to ISC hardware */
12023		if ((io->io_hdr.flags & CTL_FLAG_BUS_ADDR) == 0) {
12024			/* XXX KDM use busdma */
12025#if 0
12026			rq->local = vtophys(tmp_ptr);
12027#endif
12028		} else
12029			rq->local = tmp_ptr;
12030
12031		tmp_ptr = (uint8_t *)remote_sglist[j].addr;
12032		tmp_ptr += remote_used;
12033		rq->remote = tmp_ptr;
12034
12035		rq->callback = NULL;
12036
12037		local_used += cur_len;
12038		if (local_used >= local_sglist[i].len) {
12039			i++;
12040			local_used = 0;
12041		}
12042
12043		remote_used += cur_len;
12044		if (remote_used >= remote_sglist[j].len) {
12045			j++;
12046			remote_used = 0;
12047		}
12048		total_used += cur_len;
12049
12050		if (total_used >= io->scsiio.kern_data_len)
12051			rq->callback = callback;
12052
12053		if ((rq->size & 0x7) != 0) {
12054			printf("%s: warning: size %d is not on 8b boundary\n",
12055			       __func__, rq->size);
12056		}
12057		if (((uintptr_t)rq->local & 0x7) != 0) {
12058			printf("%s: warning: local %p not on 8b boundary\n",
12059			       __func__, rq->local);
12060		}
12061		if (((uintptr_t)rq->remote & 0x7) != 0) {
12062			printf("%s: warning: remote %p not on 8b boundary\n",
12063			       __func__, rq->local);
12064		}
12065#if 0
12066		printf("%s: %s: local %#x remote %#x size %d\n", __func__,
12067		       (command == CTL_HA_DT_CMD_WRITE) ? "WRITE" : "READ",
12068		       rq->local, rq->remote, rq->size);
12069#endif
12070
12071		isc_ret = ctl_dt_single(rq);
12072		if (isc_ret == CTL_HA_STATUS_WAIT)
12073			continue;
12074
12075		if (isc_ret == CTL_HA_STATUS_DISCONNECT) {
12076			rq->ret = CTL_HA_STATUS_SUCCESS;
12077		} else {
12078			rq->ret = isc_ret;
12079		}
12080		callback(rq);
12081		goto bailout;
12082	}
12083
12084bailout:
12085	return (retval);
12086
12087}
12088
12089static void
12090ctl_datamove_remote_read(union ctl_io *io)
12091{
12092	int retval;
12093	int i;
12094
12095	/*
12096	 * This will send an error to the other controller in the case of a
12097	 * failure.
12098	 */
12099	retval = ctl_datamove_remote_sgl_setup(io);
12100	if (retval != 0)
12101		return;
12102
12103	retval = ctl_datamove_remote_xfer(io, CTL_HA_DT_CMD_READ,
12104					  ctl_datamove_remote_read_cb);
12105	if ((retval != 0)
12106	 && ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0)) {
12107		/*
12108		 * Make sure we free memory if there was an error..  The
12109		 * ctl_datamove_remote_xfer() function will send the
12110		 * datamove done message, or call the callback with an
12111		 * error if there is a problem.
12112		 */
12113		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
12114			free(io->io_hdr.local_sglist[i].addr, M_CTL);
12115	}
12116
12117	return;
12118}
12119
12120/*
12121 * Process a datamove request from the other controller.  This is used for
12122 * XFER mode only, not SER_ONLY mode.  For writes, we DMA into local memory
12123 * first.  Once that is complete, the data gets DMAed into the remote
12124 * controller's memory.  For reads, we DMA from the remote controller's
12125 * memory into our memory first, and then move it out to the FETD.
12126 */
12127static void
12128ctl_datamove_remote(union ctl_io *io)
12129{
12130	struct ctl_softc *softc;
12131
12132	softc = control_softc;
12133
12134	mtx_assert(&softc->ctl_lock, MA_NOTOWNED);
12135
12136	/*
12137	 * Note that we look for an aborted I/O here, but don't do some of
12138	 * the other checks that ctl_datamove() normally does.  We don't
12139	 * need to run the task queue, because this I/O is on the ISC
12140	 * queue, which is executed by the work thread after the task queue.
12141	 * We don't need to run the datamove delay code, since that should
12142	 * have been done if need be on the other controller.
12143	 */
12144	mtx_lock(&softc->ctl_lock);
12145
12146	if (io->io_hdr.flags & CTL_FLAG_ABORT) {
12147
12148		printf("%s: tag 0x%04x on (%d:%d:%d:%d) aborted\n", __func__,
12149		       io->scsiio.tag_num, io->io_hdr.nexus.initid.id,
12150		       io->io_hdr.nexus.targ_port,
12151		       io->io_hdr.nexus.targ_target.id,
12152		       io->io_hdr.nexus.targ_lun);
12153		io->io_hdr.status = CTL_CMD_ABORTED;
12154		io->io_hdr.port_status = 31338;
12155
12156		mtx_unlock(&softc->ctl_lock);
12157
12158		ctl_send_datamove_done(io, /*have_lock*/ 0);
12159
12160		return;
12161	}
12162
12163	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_OUT) {
12164		mtx_unlock(&softc->ctl_lock);
12165		ctl_datamove_remote_write(io);
12166	} else if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN){
12167		mtx_unlock(&softc->ctl_lock);
12168		ctl_datamove_remote_read(io);
12169	} else {
12170		union ctl_ha_msg msg;
12171		struct scsi_sense_data *sense;
12172		uint8_t sks[3];
12173		int retry_count;
12174
12175		memset(&msg, 0, sizeof(msg));
12176
12177		msg.hdr.msg_type = CTL_MSG_BAD_JUJU;
12178		msg.hdr.status = CTL_SCSI_ERROR;
12179		msg.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
12180
12181		retry_count = 4243;
12182
12183		sense = &msg.scsi.sense_data;
12184		sks[0] = SSD_SCS_VALID;
12185		sks[1] = (retry_count >> 8) & 0xff;
12186		sks[2] = retry_count & 0xff;
12187
12188		/* "Internal target failure" */
12189		scsi_set_sense_data(sense,
12190				    /*sense_format*/ SSD_TYPE_NONE,
12191				    /*current_error*/ 1,
12192				    /*sense_key*/ SSD_KEY_HARDWARE_ERROR,
12193				    /*asc*/ 0x44,
12194				    /*ascq*/ 0x00,
12195				    /*type*/ SSD_ELEM_SKS,
12196				    /*size*/ sizeof(sks),
12197				    /*data*/ sks,
12198				    SSD_ELEM_NONE);
12199
12200		io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
12201		if (io->io_hdr.flags & CTL_FLAG_FAILOVER) {
12202			ctl_failover_io(io, /*have_lock*/ 1);
12203			mtx_unlock(&softc->ctl_lock);
12204			return;
12205		}
12206
12207		mtx_unlock(&softc->ctl_lock);
12208
12209		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg, sizeof(msg), 0) >
12210		    CTL_HA_STATUS_SUCCESS) {
12211			/* XXX KDM what to do if this fails? */
12212		}
12213		return;
12214	}
12215
12216}
12217
12218static int
12219ctl_process_done(union ctl_io *io, int have_lock)
12220{
12221	struct ctl_lun *lun;
12222	struct ctl_softc *ctl_softc;
12223	void (*fe_done)(union ctl_io *io);
12224	uint32_t targ_port = ctl_port_idx(io->io_hdr.nexus.targ_port);
12225
12226	CTL_DEBUG_PRINT(("ctl_process_done\n"));
12227
12228	fe_done =
12229	    control_softc->ctl_ports[targ_port]->fe_done;
12230
12231#ifdef CTL_TIME_IO
12232	if ((time_uptime - io->io_hdr.start_time) > ctl_time_io_secs) {
12233		char str[256];
12234		char path_str[64];
12235		struct sbuf sb;
12236
12237		ctl_scsi_path_string(io, path_str, sizeof(path_str));
12238		sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
12239
12240		sbuf_cat(&sb, path_str);
12241		switch (io->io_hdr.io_type) {
12242		case CTL_IO_SCSI:
12243			ctl_scsi_command_string(&io->scsiio, NULL, &sb);
12244			sbuf_printf(&sb, "\n");
12245			sbuf_cat(&sb, path_str);
12246			sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
12247				    io->scsiio.tag_num, io->scsiio.tag_type);
12248			break;
12249		case CTL_IO_TASK:
12250			sbuf_printf(&sb, "Task I/O type: %d, Tag: 0x%04x, "
12251				    "Tag Type: %d\n", io->taskio.task_action,
12252				    io->taskio.tag_num, io->taskio.tag_type);
12253			break;
12254		default:
12255			printf("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
12256			panic("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
12257			break;
12258		}
12259		sbuf_cat(&sb, path_str);
12260		sbuf_printf(&sb, "ctl_process_done: %jd seconds\n",
12261			    (intmax_t)time_uptime - io->io_hdr.start_time);
12262		sbuf_finish(&sb);
12263		printf("%s", sbuf_data(&sb));
12264	}
12265#endif /* CTL_TIME_IO */
12266
12267	switch (io->io_hdr.io_type) {
12268	case CTL_IO_SCSI:
12269		break;
12270	case CTL_IO_TASK:
12271		if (bootverbose || verbose > 0)
12272			ctl_io_error_print(io, NULL);
12273		if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
12274			ctl_free_io(io);
12275		else
12276			fe_done(io);
12277		return (CTL_RETVAL_COMPLETE);
12278		break;
12279	default:
12280		printf("ctl_process_done: invalid io type %d\n",
12281		       io->io_hdr.io_type);
12282		panic("ctl_process_done: invalid io type %d\n",
12283		      io->io_hdr.io_type);
12284		break; /* NOTREACHED */
12285	}
12286
12287	lun = (struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
12288	if (lun == NULL) {
12289		CTL_DEBUG_PRINT(("NULL LUN for lun %d\n",
12290				 io->io_hdr.nexus.targ_lun));
12291		fe_done(io);
12292		goto bailout;
12293	}
12294	ctl_softc = lun->ctl_softc;
12295
12296	/*
12297	 * Remove this from the OOA queue.
12298	 */
12299	if (have_lock == 0)
12300		mtx_lock(&ctl_softc->ctl_lock);
12301
12302	/*
12303	 * Check to see if we have any errors to inject here.  We only
12304	 * inject errors for commands that don't already have errors set.
12305	 */
12306	if ((STAILQ_FIRST(&lun->error_list) != NULL)
12307	 && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS))
12308		ctl_inject_error(lun, io);
12309
12310	/*
12311	 * XXX KDM how do we treat commands that aren't completed
12312	 * successfully?
12313	 *
12314	 * XXX KDM should we also track I/O latency?
12315	 */
12316	if ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS) {
12317		uint32_t blocksize;
12318#ifdef CTL_TIME_IO
12319		struct bintime cur_bt;
12320#endif
12321
12322		if ((lun->be_lun != NULL)
12323		 && (lun->be_lun->blocksize != 0))
12324			blocksize = lun->be_lun->blocksize;
12325		else
12326			blocksize = 512;
12327
12328		switch (io->io_hdr.io_type) {
12329		case CTL_IO_SCSI: {
12330			int isread;
12331			struct ctl_lba_len lbalen;
12332
12333			isread = 0;
12334			switch (io->scsiio.cdb[0]) {
12335			case READ_6:
12336			case READ_10:
12337			case READ_12:
12338			case READ_16:
12339				isread = 1;
12340				/* FALLTHROUGH */
12341			case WRITE_6:
12342			case WRITE_10:
12343			case WRITE_12:
12344			case WRITE_16:
12345			case WRITE_VERIFY_10:
12346			case WRITE_VERIFY_12:
12347			case WRITE_VERIFY_16:
12348				memcpy(&lbalen, io->io_hdr.ctl_private[
12349				       CTL_PRIV_LBA_LEN].bytes, sizeof(lbalen));
12350
12351				if (isread) {
12352					lun->stats.ports[targ_port].bytes[CTL_STATS_READ] +=
12353						lbalen.len * blocksize;
12354					lun->stats.ports[targ_port].operations[CTL_STATS_READ]++;
12355
12356#ifdef CTL_TIME_IO
12357					bintime_add(
12358					   &lun->stats.ports[targ_port].dma_time[CTL_STATS_READ],
12359					   &io->io_hdr.dma_bt);
12360					lun->stats.ports[targ_port].num_dmas[CTL_STATS_READ] +=
12361						io->io_hdr.num_dmas;
12362					getbintime(&cur_bt);
12363					bintime_sub(&cur_bt,
12364						    &io->io_hdr.start_bt);
12365
12366					bintime_add(
12367					    &lun->stats.ports[targ_port].time[CTL_STATS_READ],
12368					    &cur_bt);
12369
12370#if 0
12371					cs_prof_gettime(&cur_ticks);
12372					lun->stats.time[CTL_STATS_READ] +=
12373						cur_ticks -
12374						io->io_hdr.start_ticks;
12375#endif
12376#if 0
12377					lun->stats.time[CTL_STATS_READ] +=
12378						jiffies - io->io_hdr.start_time;
12379#endif
12380#endif /* CTL_TIME_IO */
12381				} else {
12382					lun->stats.ports[targ_port].bytes[CTL_STATS_WRITE] +=
12383						lbalen.len * blocksize;
12384					lun->stats.ports[targ_port].operations[
12385						CTL_STATS_WRITE]++;
12386
12387#ifdef CTL_TIME_IO
12388					bintime_add(
12389					  &lun->stats.ports[targ_port].dma_time[CTL_STATS_WRITE],
12390					  &io->io_hdr.dma_bt);
12391					lun->stats.ports[targ_port].num_dmas[CTL_STATS_WRITE] +=
12392						io->io_hdr.num_dmas;
12393					getbintime(&cur_bt);
12394					bintime_sub(&cur_bt,
12395						    &io->io_hdr.start_bt);
12396
12397					bintime_add(
12398					    &lun->stats.ports[targ_port].time[CTL_STATS_WRITE],
12399					    &cur_bt);
12400#if 0
12401					cs_prof_gettime(&cur_ticks);
12402					lun->stats.ports[targ_port].time[CTL_STATS_WRITE] +=
12403						cur_ticks -
12404						io->io_hdr.start_ticks;
12405					lun->stats.ports[targ_port].time[CTL_STATS_WRITE] +=
12406						jiffies - io->io_hdr.start_time;
12407#endif
12408#endif /* CTL_TIME_IO */
12409				}
12410				break;
12411			default:
12412				lun->stats.ports[targ_port].operations[CTL_STATS_NO_IO]++;
12413
12414#ifdef CTL_TIME_IO
12415				bintime_add(
12416				  &lun->stats.ports[targ_port].dma_time[CTL_STATS_NO_IO],
12417				  &io->io_hdr.dma_bt);
12418				lun->stats.ports[targ_port].num_dmas[CTL_STATS_NO_IO] +=
12419					io->io_hdr.num_dmas;
12420				getbintime(&cur_bt);
12421				bintime_sub(&cur_bt, &io->io_hdr.start_bt);
12422
12423				bintime_add(&lun->stats.ports[targ_port].time[CTL_STATS_NO_IO],
12424					    &cur_bt);
12425
12426#if 0
12427				cs_prof_gettime(&cur_ticks);
12428				lun->stats.ports[targ_port].time[CTL_STATS_NO_IO] +=
12429					cur_ticks -
12430					io->io_hdr.start_ticks;
12431				lun->stats.ports[targ_port].time[CTL_STATS_NO_IO] +=
12432					jiffies - io->io_hdr.start_time;
12433#endif
12434#endif /* CTL_TIME_IO */
12435				break;
12436			}
12437			break;
12438		}
12439		default:
12440			break;
12441		}
12442	}
12443
12444	TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr, ooa_links);
12445
12446	/*
12447	 * Run through the blocked queue on this LUN and see if anything
12448	 * has become unblocked, now that this transaction is done.
12449	 */
12450	ctl_check_blocked(lun);
12451
12452	/*
12453	 * If the LUN has been invalidated, free it if there is nothing
12454	 * left on its OOA queue.
12455	 */
12456	if ((lun->flags & CTL_LUN_INVALID)
12457	 && (TAILQ_FIRST(&lun->ooa_queue) == NULL))
12458		ctl_free_lun(lun);
12459
12460	/*
12461	 * If this command has been aborted, make sure we set the status
12462	 * properly.  The FETD is responsible for freeing the I/O and doing
12463	 * whatever it needs to do to clean up its state.
12464	 */
12465	if (io->io_hdr.flags & CTL_FLAG_ABORT)
12466		io->io_hdr.status = CTL_CMD_ABORTED;
12467
12468	/*
12469	 * We print out status for every task management command.  For SCSI
12470	 * commands, we filter out any unit attention errors; they happen
12471	 * on every boot, and would clutter up the log.  Note:  task
12472	 * management commands aren't printed here, they are printed above,
12473	 * since they should never even make it down here.
12474	 */
12475	switch (io->io_hdr.io_type) {
12476	case CTL_IO_SCSI: {
12477		int error_code, sense_key, asc, ascq;
12478
12479		sense_key = 0;
12480
12481		if (((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SCSI_ERROR)
12482		 && (io->scsiio.scsi_status == SCSI_STATUS_CHECK_COND)) {
12483			/*
12484			 * Since this is just for printing, no need to
12485			 * show errors here.
12486			 */
12487			scsi_extract_sense_len(&io->scsiio.sense_data,
12488					       io->scsiio.sense_len,
12489					       &error_code,
12490					       &sense_key,
12491					       &asc,
12492					       &ascq,
12493					       /*show_errors*/ 0);
12494		}
12495
12496		if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
12497		 && (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SCSI_ERROR)
12498		  || (io->scsiio.scsi_status != SCSI_STATUS_CHECK_COND)
12499		  || (sense_key != SSD_KEY_UNIT_ATTENTION))) {
12500
12501			if ((time_uptime - ctl_softc->last_print_jiffies) <= 0){
12502				ctl_softc->skipped_prints++;
12503				if (have_lock == 0)
12504					mtx_unlock(&ctl_softc->ctl_lock);
12505			} else {
12506				uint32_t skipped_prints;
12507
12508				skipped_prints = ctl_softc->skipped_prints;
12509
12510				ctl_softc->skipped_prints = 0;
12511				ctl_softc->last_print_jiffies = time_uptime;
12512
12513				if (have_lock == 0)
12514					mtx_unlock(&ctl_softc->ctl_lock);
12515				if (skipped_prints > 0) {
12516#ifdef NEEDTOPORT
12517					csevent_log(CSC_CTL | CSC_SHELF_SW |
12518					    CTL_ERROR_REPORT,
12519					    csevent_LogType_Trace,
12520					    csevent_Severity_Information,
12521					    csevent_AlertLevel_Green,
12522					    csevent_FRU_Firmware,
12523					    csevent_FRU_Unknown,
12524					    "High CTL error volume, %d prints "
12525					    "skipped", skipped_prints);
12526#endif
12527				}
12528				if (bootverbose || verbose > 0)
12529					ctl_io_error_print(io, NULL);
12530			}
12531		} else {
12532			if (have_lock == 0)
12533				mtx_unlock(&ctl_softc->ctl_lock);
12534		}
12535		break;
12536	}
12537	case CTL_IO_TASK:
12538		if (have_lock == 0)
12539			mtx_unlock(&ctl_softc->ctl_lock);
12540		if (bootverbose || verbose > 0)
12541			ctl_io_error_print(io, NULL);
12542		break;
12543	default:
12544		if (have_lock == 0)
12545			mtx_unlock(&ctl_softc->ctl_lock);
12546		break;
12547	}
12548
12549	/*
12550	 * Tell the FETD or the other shelf controller we're done with this
12551	 * command.  Note that only SCSI commands get to this point.  Task
12552	 * management commands are completed above.
12553	 *
12554	 * We only send status to the other controller if we're in XFER
12555	 * mode.  In SER_ONLY mode, the I/O is done on the controller that
12556	 * received the I/O (from CTL's perspective), and so the status is
12557	 * generated there.
12558	 *
12559	 * XXX KDM if we hold the lock here, we could cause a deadlock
12560	 * if the frontend comes back in in this context to queue
12561	 * something.
12562	 */
12563	if ((ctl_softc->ha_mode == CTL_HA_MODE_XFER)
12564	 && (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
12565		union ctl_ha_msg msg;
12566
12567		memset(&msg, 0, sizeof(msg));
12568		msg.hdr.msg_type = CTL_MSG_FINISH_IO;
12569		msg.hdr.original_sc = io->io_hdr.original_sc;
12570		msg.hdr.nexus = io->io_hdr.nexus;
12571		msg.hdr.status = io->io_hdr.status;
12572		msg.scsi.scsi_status = io->scsiio.scsi_status;
12573		msg.scsi.tag_num = io->scsiio.tag_num;
12574		msg.scsi.tag_type = io->scsiio.tag_type;
12575		msg.scsi.sense_len = io->scsiio.sense_len;
12576		msg.scsi.sense_residual = io->scsiio.sense_residual;
12577		msg.scsi.residual = io->scsiio.residual;
12578		memcpy(&msg.scsi.sense_data, &io->scsiio.sense_data,
12579		       sizeof(io->scsiio.sense_data));
12580		/*
12581		 * We copy this whether or not this is an I/O-related
12582		 * command.  Otherwise, we'd have to go and check to see
12583		 * whether it's a read/write command, and it really isn't
12584		 * worth it.
12585		 */
12586		memcpy(&msg.scsi.lbalen,
12587		       &io->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes,
12588		       sizeof(msg.scsi.lbalen));
12589
12590		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg,
12591				sizeof(msg), 0) > CTL_HA_STATUS_SUCCESS) {
12592			/* XXX do something here */
12593		}
12594
12595		ctl_free_io(io);
12596	} else
12597		fe_done(io);
12598
12599bailout:
12600
12601	return (CTL_RETVAL_COMPLETE);
12602}
12603
12604/*
12605 * Front end should call this if it doesn't do autosense.  When the request
12606 * sense comes back in from the initiator, we'll dequeue this and send it.
12607 */
12608int
12609ctl_queue_sense(union ctl_io *io)
12610{
12611	struct ctl_lun *lun;
12612	struct ctl_softc *ctl_softc;
12613	uint32_t initidx;
12614
12615	ctl_softc = control_softc;
12616
12617	CTL_DEBUG_PRINT(("ctl_queue_sense\n"));
12618
12619	/*
12620	 * LUN lookup will likely move to the ctl_work_thread() once we
12621	 * have our new queueing infrastructure (that doesn't put things on
12622	 * a per-LUN queue initially).  That is so that we can handle
12623	 * things like an INQUIRY to a LUN that we don't have enabled.  We
12624	 * can't deal with that right now.
12625	 */
12626	mtx_lock(&ctl_softc->ctl_lock);
12627
12628	/*
12629	 * If we don't have a LUN for this, just toss the sense
12630	 * information.
12631	 */
12632	if ((io->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
12633	 && (ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun] != NULL))
12634		lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
12635	else
12636		goto bailout;
12637
12638	initidx = ctl_get_initindex(&io->io_hdr.nexus);
12639
12640	/*
12641	 * Already have CA set for this LUN...toss the sense information.
12642	 */
12643	if (ctl_is_set(lun->have_ca, initidx))
12644		goto bailout;
12645
12646	memcpy(&lun->pending_sense[initidx].sense, &io->scsiio.sense_data,
12647	       ctl_min(sizeof(lun->pending_sense[initidx].sense),
12648	       sizeof(io->scsiio.sense_data)));
12649	ctl_set_mask(lun->have_ca, initidx);
12650
12651bailout:
12652	mtx_unlock(&ctl_softc->ctl_lock);
12653
12654	ctl_free_io(io);
12655
12656	return (CTL_RETVAL_COMPLETE);
12657}
12658
12659/*
12660 * Primary command inlet from frontend ports.  All SCSI and task I/O
12661 * requests must go through this function.
12662 */
12663int
12664ctl_queue(union ctl_io *io)
12665{
12666	struct ctl_softc *ctl_softc;
12667
12668	CTL_DEBUG_PRINT(("ctl_queue cdb[0]=%02X\n", io->scsiio.cdb[0]));
12669
12670	ctl_softc = control_softc;
12671
12672#ifdef CTL_TIME_IO
12673	io->io_hdr.start_time = time_uptime;
12674	getbintime(&io->io_hdr.start_bt);
12675#endif /* CTL_TIME_IO */
12676
12677	mtx_lock(&ctl_softc->ctl_lock);
12678
12679	switch (io->io_hdr.io_type) {
12680	case CTL_IO_SCSI:
12681		STAILQ_INSERT_TAIL(&ctl_softc->incoming_queue, &io->io_hdr,
12682				   links);
12683		break;
12684	case CTL_IO_TASK:
12685		STAILQ_INSERT_TAIL(&ctl_softc->task_queue, &io->io_hdr, links);
12686		/*
12687		 * Set the task pending flag.  This is necessary to close a
12688		 * race condition with the FETD:
12689		 *
12690		 * - FETD submits a task management command, like an abort.
12691		 * - Back end calls fe_datamove() to move the data for the
12692		 *   aborted command.  The FETD can't really accept it, but
12693		 *   if it did, it would end up transmitting data for a
12694		 *   command that the initiator told us to abort.
12695		 *
12696		 * We close the race condition by setting the flag here,
12697		 * and checking it in ctl_datamove(), before calling the
12698		 * FETD's fe_datamove routine.  If we've got a task
12699		 * pending, we run the task queue and then check to see
12700		 * whether our particular I/O has been aborted.
12701		 */
12702		ctl_softc->flags |= CTL_FLAG_TASK_PENDING;
12703		break;
12704	default:
12705		mtx_unlock(&ctl_softc->ctl_lock);
12706		printf("ctl_queue: unknown I/O type %d\n", io->io_hdr.io_type);
12707		return (-EINVAL);
12708		break; /* NOTREACHED */
12709	}
12710	mtx_unlock(&ctl_softc->ctl_lock);
12711
12712	ctl_wakeup_thread();
12713
12714	return (CTL_RETVAL_COMPLETE);
12715}
12716
12717#ifdef CTL_IO_DELAY
12718static void
12719ctl_done_timer_wakeup(void *arg)
12720{
12721	union ctl_io *io;
12722
12723	io = (union ctl_io *)arg;
12724	ctl_done_lock(io, /*have_lock*/ 0);
12725}
12726#endif /* CTL_IO_DELAY */
12727
12728void
12729ctl_done_lock(union ctl_io *io, int have_lock)
12730{
12731	struct ctl_softc *ctl_softc;
12732#ifndef CTL_DONE_THREAD
12733	union ctl_io *xio;
12734#endif /* !CTL_DONE_THREAD */
12735
12736	ctl_softc = control_softc;
12737
12738	if (have_lock == 0)
12739		mtx_lock(&ctl_softc->ctl_lock);
12740
12741	/*
12742	 * Enable this to catch duplicate completion issues.
12743	 */
12744#if 0
12745	if (io->io_hdr.flags & CTL_FLAG_ALREADY_DONE) {
12746		printf("%s: type %d msg %d cdb %x iptl: "
12747		       "%d:%d:%d:%d tag 0x%04x "
12748		       "flag %#x status %x\n",
12749			__func__,
12750			io->io_hdr.io_type,
12751			io->io_hdr.msg_type,
12752			io->scsiio.cdb[0],
12753			io->io_hdr.nexus.initid.id,
12754			io->io_hdr.nexus.targ_port,
12755			io->io_hdr.nexus.targ_target.id,
12756			io->io_hdr.nexus.targ_lun,
12757			(io->io_hdr.io_type ==
12758			CTL_IO_TASK) ?
12759			io->taskio.tag_num :
12760			io->scsiio.tag_num,
12761		        io->io_hdr.flags,
12762			io->io_hdr.status);
12763	} else
12764		io->io_hdr.flags |= CTL_FLAG_ALREADY_DONE;
12765#endif
12766
12767	/*
12768	 * This is an internal copy of an I/O, and should not go through
12769	 * the normal done processing logic.
12770	 */
12771	if (io->io_hdr.flags & CTL_FLAG_INT_COPY) {
12772		if (have_lock == 0)
12773			mtx_unlock(&ctl_softc->ctl_lock);
12774		return;
12775	}
12776
12777	/*
12778	 * We need to send a msg to the serializing shelf to finish the IO
12779	 * as well.  We don't send a finish message to the other shelf if
12780	 * this is a task management command.  Task management commands
12781	 * aren't serialized in the OOA queue, but rather just executed on
12782	 * both shelf controllers for commands that originated on that
12783	 * controller.
12784	 */
12785	if ((io->io_hdr.flags & CTL_FLAG_SENT_2OTHER_SC)
12786	 && (io->io_hdr.io_type != CTL_IO_TASK)) {
12787		union ctl_ha_msg msg_io;
12788
12789		msg_io.hdr.msg_type = CTL_MSG_FINISH_IO;
12790		msg_io.hdr.serializing_sc = io->io_hdr.serializing_sc;
12791		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_io,
12792		    sizeof(msg_io), 0 ) != CTL_HA_STATUS_SUCCESS) {
12793		}
12794		/* continue on to finish IO */
12795	}
12796#ifdef CTL_IO_DELAY
12797	if (io->io_hdr.flags & CTL_FLAG_DELAY_DONE) {
12798		struct ctl_lun *lun;
12799
12800		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
12801
12802		io->io_hdr.flags &= ~CTL_FLAG_DELAY_DONE;
12803	} else {
12804		struct ctl_lun *lun;
12805
12806		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
12807
12808		if ((lun != NULL)
12809		 && (lun->delay_info.done_delay > 0)) {
12810			struct callout *callout;
12811
12812			callout = (struct callout *)&io->io_hdr.timer_bytes;
12813			callout_init(callout, /*mpsafe*/ 1);
12814			io->io_hdr.flags |= CTL_FLAG_DELAY_DONE;
12815			callout_reset(callout,
12816				      lun->delay_info.done_delay * hz,
12817				      ctl_done_timer_wakeup, io);
12818			if (lun->delay_info.done_type == CTL_DELAY_TYPE_ONESHOT)
12819				lun->delay_info.done_delay = 0;
12820			if (have_lock == 0)
12821				mtx_unlock(&ctl_softc->ctl_lock);
12822			return;
12823		}
12824	}
12825#endif /* CTL_IO_DELAY */
12826
12827	STAILQ_INSERT_TAIL(&ctl_softc->done_queue, &io->io_hdr, links);
12828
12829#ifdef CTL_DONE_THREAD
12830	if (have_lock == 0)
12831		mtx_unlock(&ctl_softc->ctl_lock);
12832
12833	ctl_wakeup_thread();
12834#else /* CTL_DONE_THREAD */
12835	for (xio = (union ctl_io *)STAILQ_FIRST(&ctl_softc->done_queue);
12836	     xio != NULL;
12837	     xio =(union ctl_io *)STAILQ_FIRST(&ctl_softc->done_queue)) {
12838
12839		STAILQ_REMOVE_HEAD(&ctl_softc->done_queue, links);
12840
12841		ctl_process_done(xio, /*have_lock*/ 1);
12842	}
12843	if (have_lock == 0)
12844		mtx_unlock(&ctl_softc->ctl_lock);
12845#endif /* CTL_DONE_THREAD */
12846}
12847
12848void
12849ctl_done(union ctl_io *io)
12850{
12851	ctl_done_lock(io, /*have_lock*/ 0);
12852}
12853
12854int
12855ctl_isc(struct ctl_scsiio *ctsio)
12856{
12857	struct ctl_lun *lun;
12858	int retval;
12859
12860	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
12861
12862	CTL_DEBUG_PRINT(("ctl_isc: command: %02x\n", ctsio->cdb[0]));
12863
12864	CTL_DEBUG_PRINT(("ctl_isc: calling data_submit()\n"));
12865
12866	retval = lun->backend->data_submit((union ctl_io *)ctsio);
12867
12868	return (retval);
12869}
12870
12871
12872static void
12873ctl_work_thread(void *arg)
12874{
12875	struct ctl_softc *softc;
12876	union ctl_io *io;
12877	struct ctl_be_lun *be_lun;
12878	int retval;
12879
12880	CTL_DEBUG_PRINT(("ctl_work_thread starting\n"));
12881
12882	softc = (struct ctl_softc *)arg;
12883	if (softc == NULL)
12884		return;
12885
12886	mtx_lock(&softc->ctl_lock);
12887	for (;;) {
12888		retval = 0;
12889
12890		/*
12891		 * We handle the queues in this order:
12892		 * - task management
12893		 * - ISC
12894		 * - done queue (to free up resources, unblock other commands)
12895		 * - RtR queue
12896		 * - incoming queue
12897		 *
12898		 * If those queues are empty, we break out of the loop and
12899		 * go to sleep.
12900		 */
12901		io = (union ctl_io *)STAILQ_FIRST(&softc->task_queue);
12902		if (io != NULL) {
12903			ctl_run_task_queue(softc);
12904			continue;
12905		}
12906		io = (union ctl_io *)STAILQ_FIRST(&softc->isc_queue);
12907		if (io != NULL) {
12908			STAILQ_REMOVE_HEAD(&softc->isc_queue, links);
12909			ctl_handle_isc(io);
12910			continue;
12911		}
12912		io = (union ctl_io *)STAILQ_FIRST(&softc->done_queue);
12913		if (io != NULL) {
12914			STAILQ_REMOVE_HEAD(&softc->done_queue, links);
12915			/* clear any blocked commands, call fe_done */
12916			mtx_unlock(&softc->ctl_lock);
12917			/*
12918			 * XXX KDM
12919			 * Call this without a lock for now.  This will
12920			 * depend on whether there is any way the FETD can
12921			 * sleep or deadlock if called with the CTL lock
12922			 * held.
12923			 */
12924			retval = ctl_process_done(io, /*have_lock*/ 0);
12925			mtx_lock(&softc->ctl_lock);
12926			continue;
12927		}
12928		if (!ctl_pause_rtr) {
12929			io = (union ctl_io *)STAILQ_FIRST(&softc->rtr_queue);
12930			if (io != NULL) {
12931				STAILQ_REMOVE_HEAD(&softc->rtr_queue, links);
12932				mtx_unlock(&softc->ctl_lock);
12933				goto execute;
12934			}
12935		}
12936		io = (union ctl_io *)STAILQ_FIRST(&softc->incoming_queue);
12937		if (io != NULL) {
12938			STAILQ_REMOVE_HEAD(&softc->incoming_queue, links);
12939			mtx_unlock(&softc->ctl_lock);
12940			ctl_scsiio_precheck(softc, &io->scsiio);
12941			mtx_lock(&softc->ctl_lock);
12942			continue;
12943		}
12944		/*
12945		 * We might want to move this to a separate thread, so that
12946		 * configuration requests (in this case LUN creations)
12947		 * won't impact the I/O path.
12948		 */
12949		be_lun = STAILQ_FIRST(&softc->pending_lun_queue);
12950		if (be_lun != NULL) {
12951			STAILQ_REMOVE_HEAD(&softc->pending_lun_queue, links);
12952			mtx_unlock(&softc->ctl_lock);
12953			ctl_create_lun(be_lun);
12954			mtx_lock(&softc->ctl_lock);
12955			continue;
12956		}
12957
12958		/* XXX KDM use the PDROP flag?? */
12959		/* Sleep until we have something to do. */
12960		mtx_sleep(softc, &softc->ctl_lock, PRIBIO, "ctl_work", 0);
12961
12962		/* Back to the top of the loop to see what woke us up. */
12963		continue;
12964
12965execute:
12966		retval = ctl_scsiio(&io->scsiio);
12967		switch (retval) {
12968		case CTL_RETVAL_COMPLETE:
12969			break;
12970		default:
12971			/*
12972			 * Probably need to make sure this doesn't happen.
12973			 */
12974			break;
12975		}
12976		mtx_lock(&softc->ctl_lock);
12977	}
12978}
12979
12980void
12981ctl_wakeup_thread()
12982{
12983	struct ctl_softc *softc;
12984
12985	softc = control_softc;
12986
12987	wakeup(softc);
12988}
12989
12990/* Initialization and failover */
12991
12992void
12993ctl_init_isc_msg(void)
12994{
12995	printf("CTL: Still calling this thing\n");
12996}
12997
12998/*
12999 * Init component
13000 * 	Initializes component into configuration defined by bootMode
13001 *	(see hasc-sv.c)
13002 *  	returns hasc_Status:
13003 * 		OK
13004 *		ERROR - fatal error
13005 */
13006static ctl_ha_comp_status
13007ctl_isc_init(struct ctl_ha_component *c)
13008{
13009	ctl_ha_comp_status ret = CTL_HA_COMP_STATUS_OK;
13010
13011	c->status = ret;
13012	return ret;
13013}
13014
13015/* Start component
13016 * 	Starts component in state requested. If component starts successfully,
13017 *	it must set its own state to the requestrd state
13018 *	When requested state is HASC_STATE_HA, the component may refine it
13019 * 	by adding _SLAVE or _MASTER flags.
13020 *	Currently allowed state transitions are:
13021 *	UNKNOWN->HA		- initial startup
13022 *	UNKNOWN->SINGLE - initial startup when no parter detected
13023 *	HA->SINGLE		- failover
13024 * returns ctl_ha_comp_status:
13025 * 		OK	- component successfully started in requested state
13026 *		FAILED  - could not start the requested state, failover may
13027 * 			  be possible
13028 *		ERROR	- fatal error detected, no future startup possible
13029 */
13030static ctl_ha_comp_status
13031ctl_isc_start(struct ctl_ha_component *c, ctl_ha_state state)
13032{
13033	ctl_ha_comp_status ret = CTL_HA_COMP_STATUS_OK;
13034
13035	// UNKNOWN->HA or UNKNOWN->SINGLE (bootstrap)
13036	if (c->state == CTL_HA_STATE_UNKNOWN ) {
13037		ctl_is_single = 0;
13038		if (ctl_ha_msg_create(CTL_HA_CHAN_CTL, ctl_isc_event_handler)
13039		    != CTL_HA_STATUS_SUCCESS) {
13040			printf("ctl_isc_start: ctl_ha_msg_create failed.\n");
13041			ret = CTL_HA_COMP_STATUS_ERROR;
13042		}
13043	} else if (CTL_HA_STATE_IS_HA(c->state)
13044		&& CTL_HA_STATE_IS_SINGLE(state)){
13045		// HA->SINGLE transition
13046	        ctl_failover();
13047		ctl_is_single = 1;
13048	} else {
13049		printf("ctl_isc_start:Invalid state transition %X->%X\n",
13050		       c->state, state);
13051		ret = CTL_HA_COMP_STATUS_ERROR;
13052	}
13053	if (CTL_HA_STATE_IS_SINGLE(state))
13054		ctl_is_single = 1;
13055
13056	c->state = state;
13057	c->status = ret;
13058	return ret;
13059}
13060
13061/*
13062 * Quiesce component
13063 * The component must clear any error conditions (set status to OK) and
13064 * prepare itself to another Start call
13065 * returns ctl_ha_comp_status:
13066 * 	OK
13067 *	ERROR
13068 */
13069static ctl_ha_comp_status
13070ctl_isc_quiesce(struct ctl_ha_component *c)
13071{
13072	int ret = CTL_HA_COMP_STATUS_OK;
13073
13074	ctl_pause_rtr = 1;
13075	c->status = ret;
13076	return ret;
13077}
13078
13079struct ctl_ha_component ctl_ha_component_ctlisc =
13080{
13081	.name = "CTL ISC",
13082	.state = CTL_HA_STATE_UNKNOWN,
13083	.init = ctl_isc_init,
13084	.start = ctl_isc_start,
13085	.quiesce = ctl_isc_quiesce
13086};
13087
13088/*
13089 *  vim: ts=8
13090 */
13091