1 /*-
2 * Copyright (c) 2005-2010 Daniel Braniss <danny@cs.huji.ac.il>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 */
27 /*
28 | $Id: iscsi_subr.c 743 2009-08-08 10:54:53Z danny $
29 */
30
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
33
34 #include "opt_iscsi_initiator.h"
35
36 #include <sys/param.h>
37 #include <sys/kernel.h>
38 #include <sys/callout.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/kthread.h>
42 #include <sys/lock.h>
43 #include <sys/mutex.h>
44 #include <sys/uio.h>
45 #include <sys/sysctl.h>
46 #include <sys/sx.h>
47
48 #include <cam/cam.h>
49 #include <cam/cam_ccb.h>
50 #include <cam/cam_sim.h>
51 #include <cam/cam_xpt_sim.h>
52 #include <cam/cam_periph.h>
53 #include <cam/scsi/scsi_message.h>
54 #include <sys/eventhandler.h>
55
56 #include <dev/iscsi_initiator/iscsi.h>
57 #include <dev/iscsi_initiator/iscsivar.h>
58
59 /*
60 | Interface to the SCSI layer
61 */
62 void
iscsi_r2t(isc_session_t * sp,pduq_t * opq,pduq_t * pq)63 iscsi_r2t(isc_session_t *sp, pduq_t *opq, pduq_t *pq)
64 {
65 union ccb *ccb = opq->ccb;
66 struct ccb_scsiio *csio = &ccb->csio;
67 pdu_t *opp = &opq->pdu;
68 bhs_t *bhp = &opp->ipdu.bhs;
69 r2t_t *r2t = &pq->pdu.ipdu.r2t;
70 pduq_t *wpq;
71 int error;
72
73 debug_called(8);
74 sdebug(4, "itt=%x r2tSN=%d bo=%x ddtl=%x W=%d", ntohl(r2t->itt),
75 ntohl(r2t->r2tSN), ntohl(r2t->bo), ntohl(r2t->ddtl), opp->ipdu.scsi_req.W);
76
77 switch(bhp->opcode) {
78 case ISCSI_SCSI_CMD:
79 if(opp->ipdu.scsi_req.W) {
80 data_out_t *cmd;
81 u_int ddtl = ntohl(r2t->ddtl);
82 u_int edtl = ntohl(opp->ipdu.scsi_req.edtlen);
83 u_int bleft, bs, dsn, bo;
84 caddr_t bp = csio->data_ptr;
85
86 bo = ntohl(r2t->bo);
87 bp += MIN(bo, edtl - ddtl);
88 bleft = ddtl;
89
90 if(sp->opt.maxXmitDataSegmentLength > 0) // danny's RFC
91 bs = MIN(sp->opt.maxXmitDataSegmentLength, ddtl);
92 else
93 bs = ddtl;
94 dsn = 0;
95 sdebug(4, "edtl=%x ddtl=%x bo=%x dsn=%x bs=%x maxX=%x",
96 edtl, ddtl, bo, dsn, bs, sp->opt.maxXmitDataSegmentLength);
97 while(bleft > 0) {
98 wpq = pdu_alloc(sp->isc, M_NOWAIT); // testing ...
99 if(wpq == NULL) {
100 sdebug(3, "itt=%x r2tSN=%d bo=%x ddtl=%x W=%d", ntohl(r2t->itt),
101 ntohl(r2t->r2tSN), ntohl(r2t->bo), ntohl(r2t->ddtl), opp->ipdu.scsi_req.W);
102 sdebug(1, "npdu_max=%d npdu_alloc=%d", sp->isc->npdu_max, sp->isc->npdu_alloc);
103
104 while((wpq = pdu_alloc(sp->isc, M_NOWAIT)) == NULL) {
105 sdebug(2, "waiting...");
106 #if __FreeBSD_version >= 700000
107 pause("isc_r2t", 5*hz);
108 #else
109 tsleep(sp->isc, 0, "isc_r2t", 5*hz);
110 #endif
111 }
112 }
113 cmd = &wpq->pdu.ipdu.data_out;
114 cmd->opcode = ISCSI_WRITE_DATA;
115 cmd->lun[0] = r2t->lun[0];
116 cmd->lun[1] = r2t->lun[1];
117 cmd->ttt = r2t->ttt;
118 cmd->itt = r2t->itt;
119
120 cmd->dsn = htonl(dsn);
121 cmd->bo = htonl(bo);
122
123 cmd->F = (bs < bleft)? 0: 1; // is this the last one?
124 bs = MIN(bs, bleft);
125
126 wpq->pdu.ds_len = bs;
127 wpq->pdu.ds_addr = bp;
128
129 error = isc_qout(sp, wpq);
130 sdebug(6, "bs=%x bo=%x bp=%p dsn=%x error=%d", bs, bo, bp, dsn, error);
131 if(error)
132 break;
133 bo += bs;
134 bp += bs;
135 bleft -= bs;
136 dsn++;
137 }
138 }
139 break;
140
141 default:
142 // XXX: should not happen ...
143 xdebug("huh? opcode=0x%x", bhp->opcode);
144 }
145 }
146
147 static int
getSenseData(u_int status,union ccb * ccb,pduq_t * pq)148 getSenseData(u_int status, union ccb *ccb, pduq_t *pq)
149 {
150 pdu_t *pp = &pq->pdu;
151 struct ccb_scsiio *scsi = (struct ccb_scsiio *)ccb;
152 struct scsi_sense_data *sense = &scsi->sense_data;
153 struct mbuf *m = pq->mp;
154 scsi_rsp_t *cmd = &pp->ipdu.scsi_rsp;
155 caddr_t bp;
156 int sense_len, mustfree = 0;
157 int error_code, sense_key, asc, ascq;
158
159 bp = mtod(pq->mp, caddr_t);
160 if((sense_len = scsi_2btoul(bp)) == 0)
161 return 0;
162 debug(4, "sense_len=%d", sense_len);
163 /*
164 | according to the specs, the sense data cannot
165 | be larger than 252 ...
166 */
167 if(sense_len > m->m_len) {
168 bp = malloc(sense_len, M_ISCSI, M_WAITOK);
169 debug(3, "calling i_mbufcopy(len=%d)", sense_len);
170 i_mbufcopy(pq->mp, bp, sense_len);
171 mustfree++;
172 }
173 scsi->scsi_status = status;
174
175 bcopy(bp+2, sense, min(sense_len, scsi->sense_len));
176 scsi->sense_resid = 0;
177 if(cmd->flag & (BIT(1)|BIT(2)))
178 scsi->sense_resid = ntohl(pp->ipdu.scsi_rsp.rcnt);
179 scsi_extract_sense_len(sense, scsi->sense_len - scsi->sense_resid,
180 &error_code, &sense_key, &asc, &ascq, /*show_errors*/ 1);
181
182 debug(3, "sense_len=%d rcnt=%d sense_resid=%d dsl=%d error_code=%x flags=%x",
183 sense_len,
184 ntohl(pp->ipdu.scsi_rsp.rcnt), scsi->sense_resid,
185 pp->ds_len, error_code, sense_key);
186
187 if(mustfree)
188 free(bp, M_ISCSI);
189
190 return 1;
191 }
192
193 /*
194 | Some information is from SAM draft.
195 */
196 static void
_scsi_done(isc_session_t * sp,u_int response,u_int status,union ccb * ccb,pduq_t * pq)197 _scsi_done(isc_session_t *sp, u_int response, u_int status, union ccb *ccb, pduq_t *pq)
198 {
199 struct ccb_hdr *ccb_h = &ccb->ccb_h;
200
201 debug_called(8);
202
203 if(status || response) {
204 sdebug(3, "response=%x status=%x ccb=%p pq=%p", response, status, ccb, pq);
205 if(pq != NULL)
206 sdebug(3, "mp=%p buf=%p len=%d", pq->mp, pq->buf, pq->len);
207 }
208 ccb_h->status = 0;
209 switch(response) {
210 case 0: // Command Completed at Target
211 switch(status) {
212 case 0: // Good, all is ok
213 ccb_h->status = CAM_REQ_CMP;
214 break;
215
216 case 0x02: // Check Condition
217 if((pq != NULL) && (pq->mp != NULL) && getSenseData(status, ccb, pq))
218 ccb_h->status |= CAM_AUTOSNS_VALID;
219
220 case 0x14: // Intermediate-Condition Met
221 case 0x10: // Intermediate
222 case 0x04: // Condition Met
223 ccb_h->status |= CAM_SCSI_STATUS_ERROR;
224 break;
225
226 case 0x08:
227 ccb_h->status = CAM_BUSY;
228 break;
229
230 case 0x18: // Reservation Conflict
231 case 0x28: // Task Set Full
232 ccb_h->status = CAM_REQUEUE_REQ;
233 break;
234 default:
235 //case 0x22: // Command Terminated
236 //case 0x30: // ACA Active
237 //case 0x40: // Task Aborted
238 ccb_h->status = CAM_REQ_CMP_ERR; //CAM_REQ_ABORTED;
239 }
240 break;
241
242 default:
243 if((response >= 0x80) && (response <= 0xFF)) {
244 // Vendor specific ...
245 }
246 case 1: // target failure
247 ccb_h->status = CAM_REQ_CMP_ERR; //CAM_REQ_ABORTED;
248 break;
249 }
250 sdebug(5, "ccb_h->status=%x", ccb_h->status);
251
252 XPT_DONE(sp, ccb);
253 }
254
255 /*
256 | returns the lowest cmdseq that was not acked
257 */
258 int
iscsi_requeue(isc_session_t * sp)259 iscsi_requeue(isc_session_t *sp)
260 {
261 pduq_t *pq;
262 u_int i, n, last;
263
264 debug_called(8);
265 i = last = 0;
266 sp->flags |= ISC_HOLD;
267 while((pq = i_dqueue_hld(sp)) != NULL) {
268 i++;
269 if(pq->ccb != NULL) {
270 _scsi_done(sp, 0, 0x28, pq->ccb, NULL);
271 n = ntohl(pq->pdu.ipdu.bhs.CmdSN);
272 if(last==0 || (last > n))
273 last = n;
274 sdebug(2, "last=%x n=%x", last, n);
275 }
276 pdu_free(sp->isc, pq);
277 }
278 sp->flags &= ~ISC_HOLD;
279 return i? last: sp->sn.cmd;
280 }
281
282 int
i_pdu_flush(isc_session_t * sp)283 i_pdu_flush(isc_session_t *sp)
284 {
285 int n = 0;
286 pduq_t *pq;
287
288 debug_called(8);
289 while((pq = i_dqueue_rsp(sp)) != NULL) {
290 pdu_free(sp->isc, pq);
291 n++;
292 }
293 while((pq = i_dqueue_rsv(sp)) != NULL) {
294 pdu_free(sp->isc, pq);
295 n++;
296 }
297 while((pq = i_dqueue_snd(sp, -1)) != NULL) {
298 pdu_free(sp->isc, pq);
299 n++;
300 }
301 while((pq = i_dqueue_hld(sp)) != NULL) {
302 pdu_free(sp->isc, pq);
303 n++;
304 }
305 while((pq = i_dqueue_wsnd(sp)) != NULL) {
306 pdu_free(sp->isc, pq);
307 n++;
308 }
309 if(n != 0)
310 xdebug("%d pdus recovered, should have been ZERO!", n);
311 return n;
312 }
313 /*
314 | called from ism_destroy.
315 */
316 void
iscsi_cleanup(isc_session_t * sp)317 iscsi_cleanup(isc_session_t *sp)
318 {
319 pduq_t *pq, *pqtmp;
320
321 debug_called(8);
322
323 TAILQ_FOREACH_SAFE(pq, &sp->hld, pq_link, pqtmp) {
324 sdebug(3, "hld pq=%p", pq);
325 if(pq->ccb)
326 _scsi_done(sp, 1, 0x40, pq->ccb, NULL);
327 TAILQ_REMOVE(&sp->hld, pq, pq_link);
328 if(pq->buf) {
329 free(pq->buf, M_ISCSIBUF);
330 pq->buf = NULL;
331 }
332 pdu_free(sp->isc, pq);
333 }
334 while((pq = i_dqueue_snd(sp, BIT(0)|BIT(1)|BIT(2))) != NULL) {
335 sdebug(3, "pq=%p", pq);
336 if(pq->ccb)
337 _scsi_done(sp, 1, 0x40, pq->ccb, NULL);
338 if(pq->buf) {
339 free(pq->buf, M_ISCSIBUF);
340 pq->buf = NULL;
341 }
342 pdu_free(sp->isc, pq);
343 }
344
345 wakeup(&sp->rsp);
346 }
347
348 void
iscsi_done(isc_session_t * sp,pduq_t * opq,pduq_t * pq)349 iscsi_done(isc_session_t *sp, pduq_t *opq, pduq_t *pq)
350 {
351 pdu_t *pp = &pq->pdu;
352 scsi_rsp_t *cmd = &pp->ipdu.scsi_rsp;
353
354 debug_called(8);
355
356 _scsi_done(sp, cmd->response, cmd->status, opq->ccb, pq);
357
358 pdu_free(sp->isc, opq);
359 }
360
361 // see RFC 3720, 10.9.1 page 146
362 /*
363 | NOTE:
364 | the call to isc_stop_receiver is a kludge,
365 | instead, it should be handled by the userland controller,
366 | but that means that there should be a better way, other than
367 | sending a signal. Somehow, this packet should be supplied to
368 | the userland via read.
369 */
370 void
iscsi_async(isc_session_t * sp,pduq_t * pq)371 iscsi_async(isc_session_t *sp, pduq_t *pq)
372 {
373 pdu_t *pp = &pq->pdu;
374 async_t *cmd = &pp->ipdu.async;
375
376 debug_called(8);
377
378 sdebug(3, "asyncevent=0x%x asyncVCode=0x%0x", cmd->asyncEvent, cmd->asyncVCode);
379 switch(cmd->asyncEvent) {
380 case 0: // check status ...
381 break;
382
383 case 1: // target request logout
384 isc_stop_receiver(sp); // XXX: temporary solution
385 break;
386
387 case 2: // target indicates it wants to drop connection
388 isc_stop_receiver(sp); // XXX: temporary solution
389 break;
390
391 case 3: // target indicates it will drop all connections.
392 isc_stop_receiver(sp); // XXX: temporary solution
393 break;
394
395 case 4: // target request parameter negotiation
396 break;
397
398 default:
399 break;
400 }
401 }
402
403 void
iscsi_reject(isc_session_t * sp,pduq_t * opq,pduq_t * pq)404 iscsi_reject(isc_session_t *sp, pduq_t *opq, pduq_t *pq)
405 {
406 union ccb *ccb = opq->ccb;
407 //reject_t *reject = &pq->pdu.ipdu.reject;
408
409 debug_called(8);
410 //XXX: check RFC 10.17.1 (page 176)
411 ccb->ccb_h.status = CAM_REQ_ABORTED;
412 XPT_DONE(sp, ccb);
413
414 pdu_free(sp->isc, opq);
415 }
416
417 /*
418 | deal with lun
419 */
420 static int
dwl(isc_session_t * sp,int lun,u_char * lp)421 dwl(isc_session_t *sp, int lun, u_char *lp)
422 {
423 debug_called(8);
424 sdebug(4, "lun=%d", lun);
425 /*
426 | mapping LUN to iSCSI LUN
427 | check the SAM-2 specs
428 | hint: maxLUNS is a small number, cam's LUN is 32bits
429 | iSCSI is 64bits, scsi is ?
430 */
431 // XXX: check if this will pass the endian test
432 if(lun < 256) {
433 lp[0] = 0;
434 lp[1] = lun;
435 } else
436 if(lun < 16384) {
437 lp[0] = (1 << 5) | ((lun >> 8) & 0x3f);
438 lp[1] = lun & 0xff;
439 }
440 else {
441 xdebug("lun %d: is unsupported!", lun);
442 return -1;
443 }
444
445 return 0;
446 }
447
448 /*
449 | encapsulate the scsi command and
450 */
451 int
scsi_encap(struct cam_sim * sim,union ccb * ccb)452 scsi_encap(struct cam_sim *sim, union ccb *ccb)
453 {
454 isc_session_t *sp = cam_sim_softc(sim);
455 struct ccb_scsiio *csio = &ccb->csio;
456 struct ccb_hdr *ccb_h = &ccb->ccb_h;
457 pduq_t *pq;
458 scsi_req_t *cmd;
459
460 debug_called(8);
461
462 debug(4, "ccb->sp=%p", ccb_h->spriv_ptr0);
463 sp = ccb_h->spriv_ptr0;
464
465 if((pq = pdu_alloc(sp->isc, M_NOWAIT)) == NULL) {
466 debug(2, "ccb->sp=%p", ccb_h->spriv_ptr0);
467 sdebug(1, "pdu_alloc failed sc->npdu_max=%d npdu_alloc=%d",
468 sp->isc->npdu_max, sp->isc->npdu_alloc);
469 while((pq = pdu_alloc(sp->isc, M_NOWAIT)) == NULL) {
470 sdebug(2, "waiting...");
471 #if __FreeBSD_version >= 700000
472 pause("isc_encap", 5*hz);
473 #else
474 tsleep(sp->isc, 0, "isc_encap", 5*hz);
475 #endif
476 }
477 }
478 cmd = &pq->pdu.ipdu.scsi_req;
479 cmd->opcode = ISCSI_SCSI_CMD;
480 cmd->F = 1;
481 #if 0
482 // this breaks at least Isilon's iscsi target.
483 /*
484 | map tag option, default is UNTAGGED
485 */
486 switch(csio->tag_action) {
487 case MSG_SIMPLE_Q_TAG: cmd->attr = iSCSI_TASK_SIMPLE; break;
488 case MSG_HEAD_OF_Q_TAG: cmd->attr = iSCSI_TASK_HOFQ; break;
489 case MSG_ORDERED_Q_TAG: cmd->attr = iSCSI_TASK_ORDER; break;
490 case MSG_ACA_TASK: cmd->attr = iSCSI_TASK_ACA; break;
491 }
492 #else
493 cmd->attr = iSCSI_TASK_SIMPLE;
494 #endif
495
496 dwl(sp, ccb_h->target_lun, (u_char *)&cmd->lun);
497
498 if((ccb_h->flags & CAM_CDB_POINTER) != 0) {
499 if((ccb_h->flags & CAM_CDB_PHYS) == 0) {
500 if(csio->cdb_len > 16) {
501 sdebug(3, "oversize cdb %d > 16", csio->cdb_len);
502 goto invalid;
503 }
504 }
505 else {
506 sdebug(3, "not phys");
507 goto invalid;
508 }
509 }
510
511 if(csio->cdb_len > sizeof(cmd->cdb))
512 xdebug("guevalt! %d > %ld", csio->cdb_len, (long)sizeof(cmd->cdb));
513
514 memcpy(cmd->cdb,
515 ccb_h->flags & CAM_CDB_POINTER? csio->cdb_io.cdb_ptr: csio->cdb_io.cdb_bytes,
516 csio->cdb_len);
517
518 cmd->W = (ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_OUT;
519 cmd->R = (ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN;
520 cmd->edtlen = htonl(csio->dxfer_len);
521
522 pq->ccb = ccb;
523 /*
524 | place it in the out queue
525 */
526 if(isc_qout(sp, pq) == 0)
527 return 1;
528 invalid:
529 ccb->ccb_h.status = CAM_REQ_INVALID;
530 pdu_free(sp->isc, pq);
531
532 return 0;
533 }
534
535 int
scsi_decap(isc_session_t * sp,pduq_t * opq,pduq_t * pq)536 scsi_decap(isc_session_t *sp, pduq_t *opq, pduq_t *pq)
537 {
538 union ccb *ccb = opq->ccb;
539 struct ccb_scsiio *csio = &ccb->csio;
540 pdu_t *opp = &opq->pdu;
541 bhs_t *bhp = &opp->ipdu.bhs;
542
543 debug_called(8);
544 sdebug(6, "pq=%p opq=%p bhp->opcode=0x%x len=%d",
545 pq, opq, bhp->opcode, pq->pdu.ds_len);
546 if(ccb == NULL) {
547 sdebug(1, "itt=0x%x pq=%p opq=%p bhp->opcode=0x%x len=%d",
548 ntohl(pq->pdu.ipdu.bhs.itt),
549 pq, opq, bhp->opcode, pq->pdu.ds_len);
550 xdebug("%d] ccb == NULL!", sp->sid);
551 return 0;
552 }
553 if(pq->pdu.ds_len != 0) {
554 switch(bhp->opcode) {
555 case ISCSI_SCSI_CMD: {
556 scsi_req_t *cmd = &opp->ipdu.scsi_req;
557 sdebug(5, "itt=0x%x opcode=%x R=%d",
558 ntohl(pq->pdu.ipdu.bhs.itt),
559 pq->pdu.ipdu.bhs.opcode, cmd->R);
560
561 switch(pq->pdu.ipdu.bhs.opcode) {
562 case ISCSI_READ_DATA: // SCSI Data in
563 {
564 caddr_t bp = NULL; // = mtod(pq->mp, caddr_t);
565 data_in_t *rcmd = &pq->pdu.ipdu.data_in;
566
567 if(cmd->R) {
568 sdebug(5, "copy to=%p from=%p l1=%d l2=%d mp@%p",
569 csio->data_ptr, bp? mtod(pq->mp, caddr_t): 0,
570 ntohl(cmd->edtlen), pq->pdu.ds_len, pq->mp);
571 if(ntohl(cmd->edtlen) >= pq->pdu.ds_len) {
572 int offset, len = pq->pdu.ds_len;
573
574 if(pq->mp != NULL) {
575 caddr_t dp;
576
577 offset = ntohl(rcmd->bo);
578 dp = csio->data_ptr + offset;
579 i_mbufcopy(pq->mp, dp, len);
580 }
581 }
582 else {
583 xdebug("edtlen=%d < ds_len=%d",
584 ntohl(cmd->edtlen), pq->pdu.ds_len);
585 }
586 }
587 if(rcmd->S) {
588 /*
589 | contains also the SCSI Status
590 */
591 _scsi_done(sp, 0, rcmd->status, opq->ccb, NULL);
592 return 0;
593 } else
594 return 1;
595 }
596 break;
597 }
598 }
599 default:
600 sdebug(3, "opcode=%02x", bhp->opcode);
601 break;
602 }
603 }
604 /*
605 | XXX: error ...
606 */
607 return 1;
608 }
609