1 /*-
2 * Copyright (c) 2005-2010 Daniel Braniss <danny@cs.huji.ac.il>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 */
27 /*
28 | $Id: iscsi_subr.c 743 2009-08-08 10:54:53Z danny $
29 */
30
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
33
34 #include "opt_iscsi_initiator.h"
35
36 #include <sys/param.h>
37 #include <sys/kernel.h>
38 #include <sys/callout.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/kthread.h>
42 #include <sys/lock.h>
43 #include <sys/mutex.h>
44 #include <sys/uio.h>
45 #include <sys/sysctl.h>
46 #include <sys/sx.h>
47 #include <vm/uma.h>
48
49 #include <cam/cam.h>
50 #include <cam/cam_ccb.h>
51 #include <cam/cam_sim.h>
52 #include <cam/cam_xpt_sim.h>
53 #include <cam/cam_periph.h>
54 #include <cam/scsi/scsi_message.h>
55 #include <sys/eventhandler.h>
56
57 #include <dev/iscsi_initiator/iscsi.h>
58 #include <dev/iscsi_initiator/iscsivar.h>
59
60 /*
61 | Interface to the SCSI layer
62 */
63 void
iscsi_r2t(isc_session_t * sp,pduq_t * opq,pduq_t * pq)64 iscsi_r2t(isc_session_t *sp, pduq_t *opq, pduq_t *pq)
65 {
66 union ccb *ccb = opq->ccb;
67 struct ccb_scsiio *csio = &ccb->csio;
68 pdu_t *opp = &opq->pdu;
69 bhs_t *bhp = &opp->ipdu.bhs;
70 r2t_t *r2t = &pq->pdu.ipdu.r2t;
71 pduq_t *wpq;
72 int error;
73
74 debug_called(8);
75 sdebug(4, "itt=%x r2tSN=%d bo=%x ddtl=%x W=%d", ntohl(r2t->itt),
76 ntohl(r2t->r2tSN), ntohl(r2t->bo), ntohl(r2t->ddtl), opp->ipdu.scsi_req.W);
77
78 switch(bhp->opcode) {
79 case ISCSI_SCSI_CMD:
80 if(opp->ipdu.scsi_req.W) {
81 data_out_t *cmd;
82 u_int ddtl = ntohl(r2t->ddtl);
83 u_int edtl = ntohl(opp->ipdu.scsi_req.edtlen);
84 u_int bleft, bs, dsn, bo;
85 caddr_t bp = csio->data_ptr;
86
87 bo = ntohl(r2t->bo);
88 bp += MIN(bo, edtl - ddtl);
89 bleft = ddtl;
90
91 if(sp->opt.maxXmitDataSegmentLength > 0) // danny's RFC
92 bs = MIN(sp->opt.maxXmitDataSegmentLength, ddtl);
93 else
94 bs = ddtl;
95 dsn = 0;
96 sdebug(4, "edtl=%x ddtl=%x bo=%x dsn=%x bs=%x maxX=%x",
97 edtl, ddtl, bo, dsn, bs, sp->opt.maxXmitDataSegmentLength);
98 while(bleft > 0) {
99 wpq = pdu_alloc(sp->isc, M_NOWAIT); // testing ...
100 if(wpq == NULL) {
101 sdebug(3, "itt=%x r2tSN=%d bo=%x ddtl=%x W=%d", ntohl(r2t->itt),
102 ntohl(r2t->r2tSN), ntohl(r2t->bo), ntohl(r2t->ddtl), opp->ipdu.scsi_req.W);
103 sdebug(1, "npdu_max=%d npdu_alloc=%d", sp->isc->npdu_max, sp->isc->npdu_alloc);
104
105 while((wpq = pdu_alloc(sp->isc, M_NOWAIT)) == NULL) {
106 sdebug(2, "waiting...");
107 #if __FreeBSD_version >= 700000
108 pause("isc_r2t", 5*hz);
109 #else
110 tsleep(sp->isc, 0, "isc_r2t", 5*hz);
111 #endif
112 }
113 }
114 cmd = &wpq->pdu.ipdu.data_out;
115 cmd->opcode = ISCSI_WRITE_DATA;
116 cmd->lun[0] = r2t->lun[0];
117 cmd->lun[1] = r2t->lun[1];
118 cmd->ttt = r2t->ttt;
119 cmd->itt = r2t->itt;
120
121 cmd->dsn = htonl(dsn);
122 cmd->bo = htonl(bo);
123
124 cmd->F = (bs < bleft)? 0: 1; // is this the last one?
125 bs = MIN(bs, bleft);
126
127 wpq->pdu.ds_len = bs;
128 wpq->pdu.ds_addr = bp;
129
130 error = isc_qout(sp, wpq);
131 sdebug(6, "bs=%x bo=%x bp=%p dsn=%x error=%d", bs, bo, bp, dsn, error);
132 if(error)
133 break;
134 bo += bs;
135 bp += bs;
136 bleft -= bs;
137 dsn++;
138 }
139 }
140 break;
141
142 default:
143 // XXX: should not happen ...
144 xdebug("huh? opcode=0x%x", bhp->opcode);
145 }
146 }
147
148 static int
getSenseData(u_int status,union ccb * ccb,pduq_t * pq)149 getSenseData(u_int status, union ccb *ccb, pduq_t *pq)
150 {
151 pdu_t *pp = &pq->pdu;
152 struct ccb_scsiio *scsi = (struct ccb_scsiio *)ccb;
153 struct scsi_sense_data *sense = &scsi->sense_data;
154 struct mbuf *m = pq->mp;
155 scsi_rsp_t *cmd = &pp->ipdu.scsi_rsp;
156 caddr_t bp;
157 int sense_len, mustfree = 0;
158 int error_code, sense_key, asc, ascq;
159
160 bp = mtod(pq->mp, caddr_t);
161 if((sense_len = scsi_2btoul(bp)) == 0)
162 return 0;
163 debug(4, "sense_len=%d", sense_len);
164 /*
165 | according to the specs, the sense data cannot
166 | be larger than 252 ...
167 */
168 if(sense_len > m->m_len) {
169 bp = malloc(sense_len, M_ISCSI, M_WAITOK);
170 debug(3, "calling i_mbufcopy(len=%d)", sense_len);
171 i_mbufcopy(pq->mp, bp, sense_len);
172 mustfree++;
173 }
174 scsi->scsi_status = status;
175
176 bcopy(bp+2, sense, min(sense_len, scsi->sense_len));
177 scsi->sense_resid = 0;
178 if(cmd->flag & (BIT(1)|BIT(2)))
179 scsi->sense_resid = ntohl(pp->ipdu.scsi_rsp.rcnt);
180 scsi_extract_sense_len(sense, scsi->sense_len - scsi->sense_resid,
181 &error_code, &sense_key, &asc, &ascq, /*show_errors*/ 1);
182
183 debug(3, "sense_len=%d rcnt=%d sense_resid=%d dsl=%d error_code=%x flags=%x",
184 sense_len,
185 ntohl(pp->ipdu.scsi_rsp.rcnt), scsi->sense_resid,
186 pp->ds_len, error_code, sense_key);
187
188 if(mustfree)
189 free(bp, M_ISCSI);
190
191 return 1;
192 }
193
194 /*
195 | Some information is from SAM draft.
196 */
197 static void
_scsi_done(isc_session_t * sp,u_int response,u_int status,union ccb * ccb,pduq_t * pq)198 _scsi_done(isc_session_t *sp, u_int response, u_int status, union ccb *ccb, pduq_t *pq)
199 {
200 struct ccb_hdr *ccb_h = &ccb->ccb_h;
201
202 debug_called(8);
203
204 if(status || response) {
205 sdebug(3, "response=%x status=%x ccb=%p pq=%p", response, status, ccb, pq);
206 if(pq != NULL)
207 sdebug(3, "mp=%p buf=%p len=%d", pq->mp, pq->buf, pq->len);
208 }
209 ccb_h->status = 0;
210 switch(response) {
211 case 0: // Command Completed at Target
212 switch(status) {
213 case 0: // Good, all is ok
214 ccb_h->status = CAM_REQ_CMP;
215 break;
216
217 case 0x02: // Check Condition
218 if((pq != NULL) && (pq->mp != NULL) && getSenseData(status, ccb, pq))
219 ccb_h->status |= CAM_AUTOSNS_VALID;
220
221 case 0x14: // Intermediate-Condition Met
222 case 0x10: // Intermediate
223 case 0x04: // Condition Met
224 ccb_h->status |= CAM_SCSI_STATUS_ERROR;
225 break;
226
227 case 0x08:
228 ccb_h->status = CAM_BUSY;
229 break;
230
231 case 0x18: // Reservation Conflict
232 case 0x28: // Task Set Full
233 ccb_h->status = CAM_REQUEUE_REQ;
234 break;
235 default:
236 //case 0x22: // Command Terminated
237 //case 0x30: // ACA Active
238 //case 0x40: // Task Aborted
239 ccb_h->status = CAM_REQ_CMP_ERR; //CAM_REQ_ABORTED;
240 }
241 break;
242
243 default:
244 if((response >= 0x80) && (response <= 0xFF)) {
245 // Vendor specific ...
246 }
247 case 1: // target failure
248 ccb_h->status = CAM_REQ_CMP_ERR; //CAM_REQ_ABORTED;
249 break;
250 }
251 sdebug(5, "ccb_h->status=%x", ccb_h->status);
252
253 XPT_DONE(sp, ccb);
254 }
255
256 /*
257 | returns the lowest cmdseq that was not acked
258 */
259 int
iscsi_requeue(isc_session_t * sp)260 iscsi_requeue(isc_session_t *sp)
261 {
262 pduq_t *pq;
263 u_int i, n, last;
264
265 debug_called(8);
266 i = last = 0;
267 sp->flags |= ISC_HOLD;
268 while((pq = i_dqueue_hld(sp)) != NULL) {
269 i++;
270 if(pq->ccb != NULL) {
271 _scsi_done(sp, 0, 0x28, pq->ccb, NULL);
272 n = ntohl(pq->pdu.ipdu.bhs.CmdSN);
273 if(last==0 || (last > n))
274 last = n;
275 sdebug(2, "last=%x n=%x", last, n);
276 }
277 pdu_free(sp->isc, pq);
278 }
279 sp->flags &= ~ISC_HOLD;
280 return i? last: sp->sn.cmd;
281 }
282
283 int
i_pdu_flush(isc_session_t * sp)284 i_pdu_flush(isc_session_t *sp)
285 {
286 int n = 0;
287 pduq_t *pq;
288
289 debug_called(8);
290 while((pq = i_dqueue_rsp(sp)) != NULL) {
291 pdu_free(sp->isc, pq);
292 n++;
293 }
294 while((pq = i_dqueue_rsv(sp)) != NULL) {
295 pdu_free(sp->isc, pq);
296 n++;
297 }
298 while((pq = i_dqueue_snd(sp, -1)) != NULL) {
299 pdu_free(sp->isc, pq);
300 n++;
301 }
302 while((pq = i_dqueue_hld(sp)) != NULL) {
303 pdu_free(sp->isc, pq);
304 n++;
305 }
306 while((pq = i_dqueue_wsnd(sp)) != NULL) {
307 pdu_free(sp->isc, pq);
308 n++;
309 }
310 if(n != 0)
311 xdebug("%d pdus recovered, should have been ZERO!", n);
312 return n;
313 }
314 /*
315 | called from ism_destroy.
316 */
317 void
iscsi_cleanup(isc_session_t * sp)318 iscsi_cleanup(isc_session_t *sp)
319 {
320 pduq_t *pq, *pqtmp;
321
322 debug_called(8);
323
324 TAILQ_FOREACH_SAFE(pq, &sp->hld, pq_link, pqtmp) {
325 sdebug(3, "hld pq=%p", pq);
326 if(pq->ccb)
327 _scsi_done(sp, 1, 0x40, pq->ccb, NULL);
328 TAILQ_REMOVE(&sp->hld, pq, pq_link);
329 if(pq->buf) {
330 free(pq->buf, M_ISCSIBUF);
331 pq->buf = NULL;
332 }
333 pdu_free(sp->isc, pq);
334 }
335 while((pq = i_dqueue_snd(sp, BIT(0)|BIT(1)|BIT(2))) != NULL) {
336 sdebug(3, "pq=%p", pq);
337 if(pq->ccb)
338 _scsi_done(sp, 1, 0x40, pq->ccb, NULL);
339 if(pq->buf) {
340 free(pq->buf, M_ISCSIBUF);
341 pq->buf = NULL;
342 }
343 pdu_free(sp->isc, pq);
344 }
345
346 wakeup(&sp->rsp);
347 }
348
349 void
iscsi_done(isc_session_t * sp,pduq_t * opq,pduq_t * pq)350 iscsi_done(isc_session_t *sp, pduq_t *opq, pduq_t *pq)
351 {
352 pdu_t *pp = &pq->pdu;
353 scsi_rsp_t *cmd = &pp->ipdu.scsi_rsp;
354
355 debug_called(8);
356
357 _scsi_done(sp, cmd->response, cmd->status, opq->ccb, pq);
358
359 pdu_free(sp->isc, opq);
360 }
361
362 // see RFC 3720, 10.9.1 page 146
363 /*
364 | NOTE:
365 | the call to isc_stop_receiver is a kludge,
366 | instead, it should be handled by the userland controller,
367 | but that means that there should be a better way, other than
368 | sending a signal. Somehow, this packet should be supplied to
369 | the userland via read.
370 */
371 void
iscsi_async(isc_session_t * sp,pduq_t * pq)372 iscsi_async(isc_session_t *sp, pduq_t *pq)
373 {
374 pdu_t *pp = &pq->pdu;
375 async_t *cmd = &pp->ipdu.async;
376
377 debug_called(8);
378
379 sdebug(3, "asyncevent=0x%x asyncVCode=0x%0x", cmd->asyncEvent, cmd->asyncVCode);
380 switch(cmd->asyncEvent) {
381 case 0: // check status ...
382 break;
383
384 case 1: // target request logout
385 isc_stop_receiver(sp); // XXX: temporary solution
386 break;
387
388 case 2: // target indicates it wants to drop connection
389 isc_stop_receiver(sp); // XXX: temporary solution
390 break;
391
392 case 3: // target indicates it will drop all connections.
393 isc_stop_receiver(sp); // XXX: temporary solution
394 break;
395
396 case 4: // target request parameter negotiation
397 break;
398
399 default:
400 break;
401 }
402 }
403
404 void
iscsi_reject(isc_session_t * sp,pduq_t * opq,pduq_t * pq)405 iscsi_reject(isc_session_t *sp, pduq_t *opq, pduq_t *pq)
406 {
407 union ccb *ccb = opq->ccb;
408 //reject_t *reject = &pq->pdu.ipdu.reject;
409
410 debug_called(8);
411 //XXX: check RFC 10.17.1 (page 176)
412 ccb->ccb_h.status = CAM_REQ_ABORTED;
413 XPT_DONE(sp, ccb);
414
415 pdu_free(sp->isc, opq);
416 }
417
418 /*
419 | deal with lun
420 */
421 static int
dwl(isc_session_t * sp,int lun,u_char * lp)422 dwl(isc_session_t *sp, int lun, u_char *lp)
423 {
424 debug_called(8);
425 sdebug(4, "lun=%d", lun);
426 /*
427 | mapping LUN to iSCSI LUN
428 | check the SAM-2 specs
429 | hint: maxLUNS is a small number, cam's LUN is 32bits
430 | iSCSI is 64bits, scsi is ?
431 */
432 // XXX: check if this will pass the endian test
433 if(lun < 256) {
434 lp[0] = 0;
435 lp[1] = lun;
436 } else
437 if(lun < 16384) {
438 lp[0] = (1 << 5) | ((lun >> 8) & 0x3f);
439 lp[1] = lun & 0xff;
440 }
441 else {
442 xdebug("lun %d: is unsupported!", lun);
443 return -1;
444 }
445
446 return 0;
447 }
448
449 /*
450 | encapsulate the scsi command and
451 */
452 int
scsi_encap(struct cam_sim * sim,union ccb * ccb)453 scsi_encap(struct cam_sim *sim, union ccb *ccb)
454 {
455 isc_session_t *sp = cam_sim_softc(sim);
456 struct ccb_scsiio *csio = &ccb->csio;
457 struct ccb_hdr *ccb_h = &ccb->ccb_h;
458 pduq_t *pq;
459 scsi_req_t *cmd;
460
461 debug_called(8);
462
463 debug(4, "ccb->sp=%p", ccb_h->spriv_ptr0);
464 sp = ccb_h->spriv_ptr0;
465
466 if((pq = pdu_alloc(sp->isc, M_NOWAIT)) == NULL) {
467 debug(2, "ccb->sp=%p", ccb_h->spriv_ptr0);
468 sdebug(1, "pdu_alloc failed sc->npdu_max=%d npdu_alloc=%d",
469 sp->isc->npdu_max, sp->isc->npdu_alloc);
470 while((pq = pdu_alloc(sp->isc, M_NOWAIT)) == NULL) {
471 sdebug(2, "waiting...");
472 #if __FreeBSD_version >= 700000
473 pause("isc_encap", 5*hz);
474 #else
475 tsleep(sp->isc, 0, "isc_encap", 5*hz);
476 #endif
477 }
478 }
479 cmd = &pq->pdu.ipdu.scsi_req;
480 cmd->opcode = ISCSI_SCSI_CMD;
481 cmd->F = 1;
482 #if 0
483 // this breaks at least Isilon's iscsi target.
484 /*
485 | map tag option, default is UNTAGGED
486 */
487 switch(csio->tag_action) {
488 case MSG_SIMPLE_Q_TAG: cmd->attr = iSCSI_TASK_SIMPLE; break;
489 case MSG_HEAD_OF_Q_TAG: cmd->attr = iSCSI_TASK_HOFQ; break;
490 case MSG_ORDERED_Q_TAG: cmd->attr = iSCSI_TASK_ORDER; break;
491 case MSG_ACA_TASK: cmd->attr = iSCSI_TASK_ACA; break;
492 }
493 #else
494 cmd->attr = iSCSI_TASK_SIMPLE;
495 #endif
496
497 dwl(sp, ccb_h->target_lun, (u_char *)&cmd->lun);
498
499 if((ccb_h->flags & CAM_CDB_POINTER) != 0) {
500 if((ccb_h->flags & CAM_CDB_PHYS) == 0) {
501 if(csio->cdb_len > 16) {
502 sdebug(3, "oversize cdb %d > 16", csio->cdb_len);
503 goto invalid;
504 }
505 }
506 else {
507 sdebug(3, "not phys");
508 goto invalid;
509 }
510 }
511
512 if(csio->cdb_len > sizeof(cmd->cdb))
513 xdebug("guevalt! %d > %ld", csio->cdb_len, (long)sizeof(cmd->cdb));
514
515 memcpy(cmd->cdb,
516 ccb_h->flags & CAM_CDB_POINTER? csio->cdb_io.cdb_ptr: csio->cdb_io.cdb_bytes,
517 csio->cdb_len);
518
519 cmd->W = (ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_OUT;
520 cmd->R = (ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN;
521 cmd->edtlen = htonl(csio->dxfer_len);
522
523 pq->ccb = ccb;
524 /*
525 | place it in the out queue
526 */
527 if(isc_qout(sp, pq) == 0)
528 return 1;
529 invalid:
530 ccb->ccb_h.status = CAM_REQ_INVALID;
531 pdu_free(sp->isc, pq);
532
533 return 0;
534 }
535
536 int
scsi_decap(isc_session_t * sp,pduq_t * opq,pduq_t * pq)537 scsi_decap(isc_session_t *sp, pduq_t *opq, pduq_t *pq)
538 {
539 union ccb *ccb = opq->ccb;
540 struct ccb_scsiio *csio = &ccb->csio;
541 pdu_t *opp = &opq->pdu;
542 bhs_t *bhp = &opp->ipdu.bhs;
543
544 debug_called(8);
545 sdebug(6, "pq=%p opq=%p bhp->opcode=0x%x len=%d",
546 pq, opq, bhp->opcode, pq->pdu.ds_len);
547 if(ccb == NULL) {
548 sdebug(1, "itt=0x%x pq=%p opq=%p bhp->opcode=0x%x len=%d",
549 ntohl(pq->pdu.ipdu.bhs.itt),
550 pq, opq, bhp->opcode, pq->pdu.ds_len);
551 xdebug("%d] ccb == NULL!", sp->sid);
552 return 0;
553 }
554 if(pq->pdu.ds_len != 0) {
555 switch(bhp->opcode) {
556 case ISCSI_SCSI_CMD: {
557 scsi_req_t *cmd = &opp->ipdu.scsi_req;
558 sdebug(5, "itt=0x%x opcode=%x R=%d",
559 ntohl(pq->pdu.ipdu.bhs.itt),
560 pq->pdu.ipdu.bhs.opcode, cmd->R);
561
562 switch(pq->pdu.ipdu.bhs.opcode) {
563 case ISCSI_READ_DATA: // SCSI Data in
564 {
565 caddr_t bp = NULL; // = mtod(pq->mp, caddr_t);
566 data_in_t *rcmd = &pq->pdu.ipdu.data_in;
567
568 if(cmd->R) {
569 sdebug(5, "copy to=%p from=%p l1=%d l2=%d mp@%p",
570 csio->data_ptr, bp? mtod(pq->mp, caddr_t): 0,
571 ntohl(cmd->edtlen), pq->pdu.ds_len, pq->mp);
572 if(ntohl(cmd->edtlen) >= pq->pdu.ds_len) {
573 int offset, len = pq->pdu.ds_len;
574
575 if(pq->mp != NULL) {
576 caddr_t dp;
577
578 offset = ntohl(rcmd->bo);
579 dp = csio->data_ptr + offset;
580 i_mbufcopy(pq->mp, dp, len);
581 }
582 }
583 else {
584 xdebug("edtlen=%d < ds_len=%d",
585 ntohl(cmd->edtlen), pq->pdu.ds_len);
586 }
587 }
588 if(rcmd->S) {
589 /*
590 | contains also the SCSI Status
591 */
592 _scsi_done(sp, 0, rcmd->status, opq->ccb, NULL);
593 return 0;
594 } else
595 return 1;
596 }
597 break;
598 }
599 }
600 default:
601 sdebug(3, "opcode=%02x", bhp->opcode);
602 break;
603 }
604 }
605 /*
606 | XXX: error ...
607 */
608 return 1;
609 }
610