1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2007 Scott Long
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions, and the following disclaimer,
12 * without modification, immediately at the beginning of the file.
13 * 2. The name of the author may not be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
20 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 /*
30 * scsi_sg peripheral driver. This driver is meant to implement the Linux
31 * SG passthrough interface for SCSI.
32 */
33
34 #include <sys/cdefs.h>
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/kernel.h>
38 #include <sys/types.h>
39 #include <sys/bio.h>
40 #include <sys/malloc.h>
41 #include <sys/fcntl.h>
42 #include <sys/ioccom.h>
43 #include <sys/conf.h>
44 #include <sys/errno.h>
45 #include <sys/devicestat.h>
46 #include <sys/proc.h>
47 #include <sys/uio.h>
48
49 #include <cam/cam.h>
50 #include <cam/cam_ccb.h>
51 #include <cam/cam_periph.h>
52 #include <cam/cam_queue.h>
53 #include <cam/cam_xpt_periph.h>
54 #include <cam/cam_debug.h>
55 #include <cam/cam_sim.h>
56
57 #include <cam/scsi/scsi_all.h>
58 #include <cam/scsi/scsi_message.h>
59 #include <cam/scsi/scsi_sg.h>
60
61 typedef enum {
62 SG_FLAG_LOCKED = 0x01,
63 SG_FLAG_INVALID = 0x02
64 } sg_flags;
65
66 typedef enum {
67 SG_STATE_NORMAL
68 } sg_state;
69
70 typedef enum {
71 SG_RDWR_FREE,
72 SG_RDWR_INPROG,
73 SG_RDWR_DONE
74 } sg_rdwr_state;
75
76 typedef enum {
77 SG_CCB_RDWR_IO
78 } sg_ccb_types;
79
80 #define ccb_type ppriv_field0
81 #define ccb_rdwr ppriv_ptr1
82
83 struct sg_rdwr {
84 TAILQ_ENTRY(sg_rdwr) rdwr_link;
85 int tag;
86 int state;
87 int buf_len;
88 char *buf;
89 union ccb *ccb;
90 union {
91 struct sg_header hdr;
92 struct sg_io_hdr io_hdr;
93 } hdr;
94 };
95
96 struct sg_softc {
97 sg_state state;
98 sg_flags flags;
99 int open_count;
100 u_int maxio;
101 struct devstat *device_stats;
102 TAILQ_HEAD(, sg_rdwr) rdwr_done;
103 struct cdev *dev;
104 int sg_timeout;
105 int sg_user_timeout;
106 uint8_t pd_type;
107 union ccb saved_ccb;
108 };
109
110 static d_open_t sgopen;
111 static d_close_t sgclose;
112 static d_ioctl_t sgioctl;
113 static d_write_t sgwrite;
114 static d_read_t sgread;
115
116 static periph_init_t sginit;
117 static periph_ctor_t sgregister;
118 static periph_oninv_t sgoninvalidate;
119 static periph_dtor_t sgcleanup;
120 static void sgasync(void *callback_arg, uint32_t code,
121 struct cam_path *path, void *arg);
122 static void sgdone(struct cam_periph *periph, union ccb *done_ccb);
123 static int sgsendccb(struct cam_periph *periph, union ccb *ccb);
124 static int sgsendrdwr(struct cam_periph *periph, union ccb *ccb);
125 static int sgerror(union ccb *ccb, uint32_t cam_flags,
126 uint32_t sense_flags);
127 static void sg_scsiio_status(struct ccb_scsiio *csio,
128 u_short *hoststat, u_short *drvstat);
129
130 static int scsi_group_len(u_char cmd);
131
132 static struct periph_driver sgdriver =
133 {
134 sginit, "sg",
135 TAILQ_HEAD_INITIALIZER(sgdriver.units), /* gen */ 0
136 };
137 PERIPHDRIVER_DECLARE(sg, sgdriver);
138
139 static struct cdevsw sg_cdevsw = {
140 .d_version = D_VERSION,
141 .d_flags = D_TRACKCLOSE,
142 .d_open = sgopen,
143 .d_close = sgclose,
144 .d_ioctl = sgioctl,
145 .d_write = sgwrite,
146 .d_read = sgread,
147 .d_name = "sg",
148 };
149
150 static int sg_version = 30125;
151
152 static void
sginit(void)153 sginit(void)
154 {
155 cam_status status;
156
157 /*
158 * Install a global async callback. This callback will receive aync
159 * callbacks like "new device found".
160 */
161 status = xpt_register_async(AC_FOUND_DEVICE, sgasync, NULL, NULL);
162
163 if (status != CAM_REQ_CMP) {
164 printf("sg: Failed to attach master async callbac "
165 "due to status 0x%x!\n", status);
166 }
167 }
168
169 static void
sgdevgonecb(void * arg)170 sgdevgonecb(void *arg)
171 {
172 struct cam_periph *periph;
173 struct sg_softc *softc;
174 struct mtx *mtx;
175 int i;
176
177 periph = (struct cam_periph *)arg;
178 mtx = cam_periph_mtx(periph);
179 mtx_lock(mtx);
180
181 softc = (struct sg_softc *)periph->softc;
182 KASSERT(softc->open_count >= 0, ("Negative open count %d",
183 softc->open_count));
184
185 /*
186 * When we get this callback, we will get no more close calls from
187 * devfs. So if we have any dangling opens, we need to release the
188 * reference held for that particular context.
189 */
190 for (i = 0; i < softc->open_count; i++)
191 cam_periph_release_locked(periph);
192
193 softc->open_count = 0;
194
195 /*
196 * Release the reference held for the device node, it is gone now.
197 */
198 cam_periph_release_locked(periph);
199
200 /*
201 * We reference the lock directly here, instead of using
202 * cam_periph_unlock(). The reason is that the final call to
203 * cam_periph_release_locked() above could result in the periph
204 * getting freed. If that is the case, dereferencing the periph
205 * with a cam_periph_unlock() call would cause a page fault.
206 */
207 mtx_unlock(mtx);
208 }
209
210 static void
sgoninvalidate(struct cam_periph * periph)211 sgoninvalidate(struct cam_periph *periph)
212 {
213 struct sg_softc *softc;
214
215 softc = (struct sg_softc *)periph->softc;
216
217 /*
218 * Deregister any async callbacks.
219 */
220 xpt_register_async(0, sgasync, periph, periph->path);
221
222 softc->flags |= SG_FLAG_INVALID;
223
224 /*
225 * Tell devfs this device has gone away, and ask for a callback
226 * when it has cleaned up its state.
227 */
228 destroy_dev_sched_cb(softc->dev, sgdevgonecb, periph);
229
230 /*
231 * XXX Return all queued I/O with ENXIO.
232 * XXX Handle any transactions queued to the card
233 * with XPT_ABORT_CCB.
234 */
235
236 }
237
238 static void
sgcleanup(struct cam_periph * periph)239 sgcleanup(struct cam_periph *periph)
240 {
241 struct sg_softc *softc;
242
243 softc = (struct sg_softc *)periph->softc;
244
245 devstat_remove_entry(softc->device_stats);
246
247 free(softc, M_DEVBUF);
248 }
249
250 static void
sgasync(void * callback_arg,uint32_t code,struct cam_path * path,void * arg)251 sgasync(void *callback_arg, uint32_t code, struct cam_path *path, void *arg)
252 {
253 struct cam_periph *periph;
254
255 periph = (struct cam_periph *)callback_arg;
256
257 switch (code) {
258 case AC_FOUND_DEVICE:
259 {
260 struct ccb_getdev *cgd;
261 cam_status status;
262
263 cgd = (struct ccb_getdev *)arg;
264 if (cgd == NULL)
265 break;
266
267 if (cgd->protocol != PROTO_SCSI)
268 break;
269
270 /*
271 * Allocate a peripheral instance for this device and
272 * start the probe process.
273 */
274 status = cam_periph_alloc(sgregister, sgoninvalidate,
275 sgcleanup, NULL, "sg",
276 CAM_PERIPH_BIO, path,
277 sgasync, AC_FOUND_DEVICE, cgd);
278 if ((status != CAM_REQ_CMP) && (status != CAM_REQ_INPROG)) {
279 const struct cam_status_entry *entry;
280
281 entry = cam_fetch_status_entry(status);
282 printf("sgasync: Unable to attach new device "
283 "due to status %#x: %s\n", status, entry ?
284 entry->status_text : "Unknown");
285 }
286 break;
287 }
288 default:
289 cam_periph_async(periph, code, path, arg);
290 break;
291 }
292 }
293
294 static cam_status
sgregister(struct cam_periph * periph,void * arg)295 sgregister(struct cam_periph *periph, void *arg)
296 {
297 struct sg_softc *softc;
298 struct ccb_getdev *cgd;
299 struct ccb_pathinq cpi;
300 struct make_dev_args args;
301 int no_tags, error;
302
303 cgd = (struct ccb_getdev *)arg;
304 if (cgd == NULL) {
305 printf("sgregister: no getdev CCB, can't register device\n");
306 return (CAM_REQ_CMP_ERR);
307 }
308
309 softc = malloc(sizeof(*softc), M_DEVBUF, M_ZERO | M_NOWAIT);
310 if (softc == NULL) {
311 printf("sgregister: Unable to allocate softc\n");
312 return (CAM_REQ_CMP_ERR);
313 }
314
315 softc->state = SG_STATE_NORMAL;
316 softc->pd_type = SID_TYPE(&cgd->inq_data);
317 softc->sg_timeout = SG_DEFAULT_TIMEOUT / SG_DEFAULT_HZ * hz;
318 softc->sg_user_timeout = SG_DEFAULT_TIMEOUT;
319 TAILQ_INIT(&softc->rdwr_done);
320 periph->softc = softc;
321
322 xpt_path_inq(&cpi, periph->path);
323
324 if (cpi.maxio == 0)
325 softc->maxio = DFLTPHYS; /* traditional default */
326 else if (cpi.maxio > maxphys)
327 softc->maxio = maxphys; /* for safety */
328 else
329 softc->maxio = cpi.maxio; /* real value */
330
331 /*
332 * We pass in 0 for all blocksize, since we don't know what the
333 * blocksize of the device is, if it even has a blocksize.
334 */
335 cam_periph_unlock(periph);
336 no_tags = (cgd->inq_data.flags & SID_CmdQue) == 0;
337 softc->device_stats = devstat_new_entry("sg",
338 periph->unit_number, 0,
339 DEVSTAT_NO_BLOCKSIZE
340 | (no_tags ? DEVSTAT_NO_ORDERED_TAGS : 0),
341 softc->pd_type |
342 XPORT_DEVSTAT_TYPE(cpi.transport) |
343 DEVSTAT_TYPE_PASS,
344 DEVSTAT_PRIORITY_PASS);
345
346 /*
347 * Acquire a reference to the periph before we create the devfs
348 * instance for it. We'll release this reference once the devfs
349 * instance has been freed.
350 */
351 if (cam_periph_acquire(periph) != 0) {
352 xpt_print(periph->path, "%s: lost periph during "
353 "registration!\n", __func__);
354 cam_periph_lock(periph);
355 return (CAM_REQ_CMP_ERR);
356 }
357
358 /* Register the device */
359 make_dev_args_init(&args);
360 args.mda_devsw = &sg_cdevsw;
361 args.mda_unit = periph->unit_number;
362 args.mda_uid = UID_ROOT;
363 args.mda_gid = GID_OPERATOR;
364 args.mda_mode = 0600;
365 args.mda_si_drv1 = periph;
366 error = make_dev_s(&args, &softc->dev, "%s%d",
367 periph->periph_name, periph->unit_number);
368 if (error != 0) {
369 cam_periph_lock(periph);
370 cam_periph_release_locked(periph);
371 return (CAM_REQ_CMP_ERR);
372 }
373 if (periph->unit_number < 26) {
374 (void)make_dev_alias(softc->dev, "sg%c",
375 periph->unit_number + 'a');
376 } else {
377 (void)make_dev_alias(softc->dev, "sg%c%c",
378 ((periph->unit_number / 26) - 1) + 'a',
379 (periph->unit_number % 26) + 'a');
380 }
381 cam_periph_lock(periph);
382
383 /*
384 * Add as async callback so that we get
385 * notified if this device goes away.
386 */
387 xpt_register_async(AC_LOST_DEVICE, sgasync, periph, periph->path);
388
389 if (bootverbose)
390 xpt_announce_periph(periph, NULL);
391
392 return (CAM_REQ_CMP);
393 }
394
395 static void
sgdone(struct cam_periph * periph,union ccb * done_ccb)396 sgdone(struct cam_periph *periph, union ccb *done_ccb)
397 {
398 struct sg_softc *softc;
399 struct ccb_scsiio *csio;
400
401 softc = (struct sg_softc *)periph->softc;
402 csio = &done_ccb->csio;
403 switch (csio->ccb_h.ccb_type) {
404 case SG_CCB_RDWR_IO:
405 {
406 struct sg_rdwr *rdwr;
407 int state;
408
409 devstat_end_transaction(softc->device_stats,
410 csio->dxfer_len,
411 csio->tag_action & 0xf,
412 ((csio->ccb_h.flags & CAM_DIR_MASK) ==
413 CAM_DIR_NONE) ? DEVSTAT_NO_DATA :
414 (csio->ccb_h.flags & CAM_DIR_OUT) ?
415 DEVSTAT_WRITE : DEVSTAT_READ,
416 NULL, NULL);
417
418 rdwr = done_ccb->ccb_h.ccb_rdwr;
419 state = rdwr->state;
420 rdwr->state = SG_RDWR_DONE;
421 wakeup(rdwr);
422 break;
423 }
424 default:
425 panic("unknown sg CCB type");
426 }
427 }
428
429 static int
sgopen(struct cdev * dev,int flags,int fmt,struct thread * td)430 sgopen(struct cdev *dev, int flags, int fmt, struct thread *td)
431 {
432 struct cam_periph *periph;
433 struct sg_softc *softc;
434 int error = 0;
435
436 periph = (struct cam_periph *)dev->si_drv1;
437 if (cam_periph_acquire(periph) != 0)
438 return (ENXIO);
439
440 /*
441 * Don't allow access when we're running at a high securelevel.
442 */
443 error = securelevel_gt(td->td_ucred, 1);
444 if (error) {
445 cam_periph_release(periph);
446 return (error);
447 }
448
449 cam_periph_lock(periph);
450
451 softc = (struct sg_softc *)periph->softc;
452 if (softc->flags & SG_FLAG_INVALID) {
453 cam_periph_release_locked(periph);
454 cam_periph_unlock(periph);
455 return (ENXIO);
456 }
457
458 softc->open_count++;
459
460 cam_periph_unlock(periph);
461
462 return (error);
463 }
464
465 static int
sgclose(struct cdev * dev,int flag,int fmt,struct thread * td)466 sgclose(struct cdev *dev, int flag, int fmt, struct thread *td)
467 {
468 struct cam_periph *periph;
469 struct sg_softc *softc;
470 struct mtx *mtx;
471
472 periph = (struct cam_periph *)dev->si_drv1;
473 mtx = cam_periph_mtx(periph);
474 mtx_lock(mtx);
475
476 softc = periph->softc;
477 softc->open_count--;
478
479 cam_periph_release_locked(periph);
480
481 /*
482 * We reference the lock directly here, instead of using
483 * cam_periph_unlock(). The reason is that the call to
484 * cam_periph_release_locked() above could result in the periph
485 * getting freed. If that is the case, dereferencing the periph
486 * with a cam_periph_unlock() call would cause a page fault.
487 *
488 * cam_periph_release() avoids this problem using the same method,
489 * but we're manually acquiring and dropping the lock here to
490 * protect the open count and avoid another lock acquisition and
491 * release.
492 */
493 mtx_unlock(mtx);
494
495 return (0);
496 }
497
498 static int
sgioctl(struct cdev * dev,u_long cmd,caddr_t arg,int flag,struct thread * td)499 sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, int flag, struct thread *td)
500 {
501 union ccb *ccb;
502 struct ccb_scsiio *csio;
503 struct cam_periph *periph;
504 struct sg_softc *softc;
505 struct sg_io_hdr *req;
506 int dir, error;
507
508 periph = (struct cam_periph *)dev->si_drv1;
509 cam_periph_lock(periph);
510
511 softc = (struct sg_softc *)periph->softc;
512 error = 0;
513
514 switch (cmd) {
515 case SG_GET_VERSION_NUM:
516 {
517 int *version = (int *)arg;
518
519 *version = sg_version;
520 break;
521 }
522 case SG_SET_TIMEOUT:
523 {
524 u_int user_timeout = *(u_int *)arg;
525
526 softc->sg_user_timeout = user_timeout;
527 softc->sg_timeout = user_timeout / SG_DEFAULT_HZ * hz;
528 break;
529 }
530 case SG_GET_TIMEOUT:
531 /*
532 * The value is returned directly to the syscall.
533 */
534 td->td_retval[0] = softc->sg_user_timeout;
535 error = 0;
536 break;
537 case SG_IO:
538 req = (struct sg_io_hdr *)arg;
539
540 if (req->cmd_len > IOCDBLEN) {
541 error = EINVAL;
542 break;
543 }
544
545 if (req->iovec_count != 0) {
546 error = EOPNOTSUPP;
547 break;
548 }
549
550 ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
551 csio = &ccb->csio;
552
553 error = copyin(req->cmdp, &csio->cdb_io.cdb_bytes,
554 req->cmd_len);
555 if (error) {
556 xpt_release_ccb(ccb);
557 break;
558 }
559
560 switch(req->dxfer_direction) {
561 case SG_DXFER_TO_DEV:
562 dir = CAM_DIR_OUT;
563 break;
564 case SG_DXFER_FROM_DEV:
565 dir = CAM_DIR_IN;
566 break;
567 case SG_DXFER_TO_FROM_DEV:
568 dir = CAM_DIR_BOTH;
569 break;
570 case SG_DXFER_NONE:
571 default:
572 dir = CAM_DIR_NONE;
573 break;
574 }
575
576 cam_fill_csio(csio,
577 /*retries*/1,
578 /*cbfcnp*/NULL,
579 dir|CAM_DEV_QFRZDIS,
580 MSG_SIMPLE_Q_TAG,
581 req->dxferp,
582 req->dxfer_len,
583 req->mx_sb_len,
584 req->cmd_len,
585 req->timeout);
586
587 error = sgsendccb(periph, ccb);
588 if (error) {
589 req->host_status = DID_ERROR;
590 req->driver_status = DRIVER_INVALID;
591 xpt_release_ccb(ccb);
592 break;
593 }
594
595 req->status = csio->scsi_status;
596 req->masked_status = (csio->scsi_status >> 1) & 0x7f;
597 sg_scsiio_status(csio, &req->host_status, &req->driver_status);
598 req->resid = csio->resid;
599 req->duration = csio->ccb_h.timeout;
600 req->info = 0;
601
602 if ((csio->ccb_h.status & CAM_AUTOSNS_VALID)
603 && (req->sbp != NULL)) {
604 req->sb_len_wr = req->mx_sb_len - csio->sense_resid;
605 error = copyout(&csio->sense_data, req->sbp,
606 req->sb_len_wr);
607 }
608
609 xpt_release_ccb(ccb);
610 break;
611
612 case SG_GET_RESERVED_SIZE:
613 {
614 int *size = (int *)arg;
615 *size = DFLTPHYS;
616 break;
617 }
618
619 case SG_GET_SCSI_ID:
620 {
621 struct sg_scsi_id *id = (struct sg_scsi_id *)arg;
622
623 id->host_no = cam_sim_path(xpt_path_sim(periph->path));
624 id->channel = xpt_path_path_id(periph->path);
625 id->scsi_id = xpt_path_target_id(periph->path);
626 id->lun = xpt_path_lun_id(periph->path);
627 id->scsi_type = softc->pd_type;
628 id->h_cmd_per_lun = 1;
629 id->d_queue_depth = 1;
630 id->unused[0] = 0;
631 id->unused[1] = 0;
632 break;
633 }
634
635 case SG_GET_SG_TABLESIZE:
636 {
637 int *size = (int *)arg;
638 *size = 0;
639 break;
640 }
641
642 case SG_EMULATED_HOST:
643 case SG_SET_TRANSFORM:
644 case SG_GET_TRANSFORM:
645 case SG_GET_NUM_WAITING:
646 case SG_SCSI_RESET:
647 case SG_GET_REQUEST_TABLE:
648 case SG_SET_KEEP_ORPHAN:
649 case SG_GET_KEEP_ORPHAN:
650 case SG_GET_ACCESS_COUNT:
651 case SG_SET_FORCE_LOW_DMA:
652 case SG_GET_LOW_DMA:
653 case SG_SET_FORCE_PACK_ID:
654 case SG_GET_PACK_ID:
655 case SG_SET_RESERVED_SIZE:
656 case SG_GET_COMMAND_Q:
657 case SG_SET_COMMAND_Q:
658 case SG_SET_DEBUG:
659 case SG_NEXT_CMD_LEN:
660 default:
661 #ifdef CAMDEBUG
662 printf("sgioctl: rejecting cmd 0x%lx\n", cmd);
663 #endif
664 error = ENODEV;
665 break;
666 }
667
668 cam_periph_unlock(periph);
669 return (error);
670 }
671
672 static int
sgwrite(struct cdev * dev,struct uio * uio,int ioflag)673 sgwrite(struct cdev *dev, struct uio *uio, int ioflag)
674 {
675 union ccb *ccb;
676 struct cam_periph *periph;
677 struct ccb_scsiio *csio;
678 struct sg_softc *sc;
679 struct sg_header *hdr;
680 struct sg_rdwr *rdwr;
681 u_char cdb_cmd;
682 char *buf;
683 int error = 0, cdb_len, buf_len, dir;
684
685 periph = dev->si_drv1;
686 rdwr = malloc(sizeof(*rdwr), M_DEVBUF, M_WAITOK | M_ZERO);
687 hdr = &rdwr->hdr.hdr;
688
689 /* Copy in the header block and sanity check it */
690 if (uio->uio_resid < sizeof(*hdr)) {
691 error = EINVAL;
692 goto out_hdr;
693 }
694 error = uiomove(hdr, sizeof(*hdr), uio);
695 if (error)
696 goto out_hdr;
697
698 /* XXX: We don't support SG 3.x read/write API. */
699 if (hdr->reply_len < 0) {
700 error = ENODEV;
701 goto out_hdr;
702 }
703
704 ccb = xpt_alloc_ccb();
705 if (ccb == NULL) {
706 error = ENOMEM;
707 goto out_hdr;
708 }
709 csio = &ccb->csio;
710
711 /*
712 * Copy in the CDB block. The designers of the interface didn't
713 * bother to provide a size for this in the header, so we have to
714 * figure it out ourselves.
715 */
716 if (uio->uio_resid < 1)
717 goto out_ccb;
718 error = uiomove(&cdb_cmd, 1, uio);
719 if (error)
720 goto out_ccb;
721 if (hdr->twelve_byte)
722 cdb_len = 12;
723 else
724 cdb_len = scsi_group_len(cdb_cmd);
725 /*
726 * We've already read the first byte of the CDB and advanced the uio
727 * pointer. Just read the rest.
728 */
729 csio->cdb_io.cdb_bytes[0] = cdb_cmd;
730 error = uiomove(&csio->cdb_io.cdb_bytes[1], cdb_len - 1, uio);
731 if (error)
732 goto out_ccb;
733
734 /*
735 * Now set up the data block. Again, the designers didn't bother
736 * to make this reliable.
737 */
738 buf_len = uio->uio_resid;
739 if (buf_len != 0) {
740 buf = malloc(buf_len, M_DEVBUF, M_WAITOK | M_ZERO);
741 error = uiomove(buf, buf_len, uio);
742 if (error)
743 goto out_buf;
744 dir = CAM_DIR_OUT;
745 } else if (hdr->reply_len != 0) {
746 buf = malloc(hdr->reply_len, M_DEVBUF, M_WAITOK | M_ZERO);
747 buf_len = hdr->reply_len;
748 dir = CAM_DIR_IN;
749 } else {
750 buf = NULL;
751 buf_len = 0;
752 dir = CAM_DIR_NONE;
753 }
754
755 cam_periph_lock(periph);
756 sc = periph->softc;
757 xpt_setup_ccb(&ccb->ccb_h, periph->path, CAM_PRIORITY_NORMAL);
758 cam_fill_csio(csio,
759 /*retries*/1,
760 sgdone,
761 dir|CAM_DEV_QFRZDIS,
762 MSG_SIMPLE_Q_TAG,
763 buf,
764 buf_len,
765 SG_MAX_SENSE,
766 cdb_len,
767 sc->sg_timeout);
768
769 /*
770 * Send off the command and hope that it works. This path does not
771 * go through sgstart because the I/O is supposed to be asynchronous.
772 */
773 rdwr->buf = buf;
774 rdwr->buf_len = buf_len;
775 rdwr->tag = hdr->pack_id;
776 rdwr->ccb = ccb;
777 rdwr->state = SG_RDWR_INPROG;
778 ccb->ccb_h.ccb_rdwr = rdwr;
779 ccb->ccb_h.ccb_type = SG_CCB_RDWR_IO;
780 TAILQ_INSERT_TAIL(&sc->rdwr_done, rdwr, rdwr_link);
781 error = sgsendrdwr(periph, ccb);
782 cam_periph_unlock(periph);
783 return (error);
784
785 out_buf:
786 free(buf, M_DEVBUF);
787 out_ccb:
788 xpt_free_ccb(ccb);
789 out_hdr:
790 free(rdwr, M_DEVBUF);
791 return (error);
792 }
793
794 static int
sgread(struct cdev * dev,struct uio * uio,int ioflag)795 sgread(struct cdev *dev, struct uio *uio, int ioflag)
796 {
797 struct ccb_scsiio *csio;
798 struct cam_periph *periph;
799 struct sg_softc *sc;
800 struct sg_header *hdr;
801 struct sg_rdwr *rdwr;
802 u_short hstat, dstat;
803 int error, pack_len, reply_len, pack_id;
804
805 periph = dev->si_drv1;
806
807 /* XXX The pack len field needs to be updated and written out instead
808 * of discarded. Not sure how to do that.
809 */
810 uio->uio_rw = UIO_WRITE;
811 if ((error = uiomove(&pack_len, 4, uio)) != 0)
812 return (error);
813 if ((error = uiomove(&reply_len, 4, uio)) != 0)
814 return (error);
815 if ((error = uiomove(&pack_id, 4, uio)) != 0)
816 return (error);
817 uio->uio_rw = UIO_READ;
818
819 cam_periph_lock(periph);
820 sc = periph->softc;
821 search:
822 TAILQ_FOREACH(rdwr, &sc->rdwr_done, rdwr_link) {
823 if (rdwr->tag == pack_id)
824 break;
825 }
826 if ((rdwr == NULL) || (rdwr->state != SG_RDWR_DONE)) {
827 if (cam_periph_sleep(periph, rdwr, PCATCH, "sgread", 0) == ERESTART)
828 return (EAGAIN);
829 goto search;
830 }
831 TAILQ_REMOVE(&sc->rdwr_done, rdwr, rdwr_link);
832 cam_periph_unlock(periph);
833
834 hdr = &rdwr->hdr.hdr;
835 csio = &rdwr->ccb->csio;
836 sg_scsiio_status(csio, &hstat, &dstat);
837 hdr->host_status = hstat;
838 hdr->driver_status = dstat;
839 hdr->target_status = csio->scsi_status >> 1;
840
841 switch (hstat) {
842 case DID_OK:
843 case DID_PASSTHROUGH:
844 case DID_SOFT_ERROR:
845 hdr->result = 0;
846 break;
847 case DID_NO_CONNECT:
848 case DID_BUS_BUSY:
849 case DID_TIME_OUT:
850 hdr->result = EBUSY;
851 break;
852 case DID_BAD_TARGET:
853 case DID_ABORT:
854 case DID_PARITY:
855 case DID_RESET:
856 case DID_BAD_INTR:
857 case DID_ERROR:
858 default:
859 hdr->result = EIO;
860 break;
861 }
862
863 if (dstat == DRIVER_SENSE) {
864 bcopy(&csio->sense_data, hdr->sense_buffer,
865 min(csio->sense_len, SG_MAX_SENSE));
866 #ifdef CAMDEBUG
867 scsi_sense_print(csio);
868 #endif
869 }
870
871 error = uiomove(&hdr->result, sizeof(*hdr) -
872 offsetof(struct sg_header, result), uio);
873 if ((error == 0) && (hdr->result == 0))
874 error = uiomove(rdwr->buf, rdwr->buf_len, uio);
875
876 cam_periph_lock(periph);
877 xpt_free_ccb(rdwr->ccb);
878 cam_periph_unlock(periph);
879 free(rdwr->buf, M_DEVBUF);
880 free(rdwr, M_DEVBUF);
881 return (error);
882 }
883
884 static int
sgsendccb(struct cam_periph * periph,union ccb * ccb)885 sgsendccb(struct cam_periph *periph, union ccb *ccb)
886 {
887 struct sg_softc *softc;
888 struct cam_periph_map_info mapinfo;
889 int error;
890
891 softc = periph->softc;
892 bzero(&mapinfo, sizeof(mapinfo));
893
894 /*
895 * cam_periph_mapmem calls into proc and vm functions that can
896 * sleep as well as trigger I/O, so we can't hold the lock.
897 * Dropping it here is reasonably safe.
898 * The only CCB opcode that is possible here is XPT_SCSI_IO, no
899 * need for additional checks.
900 */
901 cam_periph_unlock(periph);
902 error = cam_periph_mapmem(ccb, &mapinfo, softc->maxio);
903 cam_periph_lock(periph);
904 if (error)
905 return (error);
906
907 error = cam_periph_runccb(ccb,
908 sgerror,
909 CAM_RETRY_SELTO,
910 SF_RETRY_UA,
911 softc->device_stats);
912
913 cam_periph_unlock(periph);
914 cam_periph_unmapmem(ccb, &mapinfo);
915 cam_periph_lock(periph);
916
917 return (error);
918 }
919
920 static int
sgsendrdwr(struct cam_periph * periph,union ccb * ccb)921 sgsendrdwr(struct cam_periph *periph, union ccb *ccb)
922 {
923 struct sg_softc *softc;
924
925 softc = periph->softc;
926 devstat_start_transaction(softc->device_stats, NULL);
927 xpt_action(ccb);
928 return (0);
929 }
930
931 static int
sgerror(union ccb * ccb,uint32_t cam_flags,uint32_t sense_flags)932 sgerror(union ccb *ccb, uint32_t cam_flags, uint32_t sense_flags)
933 {
934 struct cam_periph *periph;
935 struct sg_softc *softc;
936
937 periph = xpt_path_periph(ccb->ccb_h.path);
938 softc = (struct sg_softc *)periph->softc;
939
940 return (cam_periph_error(ccb, cam_flags, sense_flags));
941 }
942
943 static void
sg_scsiio_status(struct ccb_scsiio * csio,u_short * hoststat,u_short * drvstat)944 sg_scsiio_status(struct ccb_scsiio *csio, u_short *hoststat, u_short *drvstat)
945 {
946 int status;
947
948 status = csio->ccb_h.status;
949
950 switch (status & CAM_STATUS_MASK) {
951 case CAM_REQ_CMP:
952 *hoststat = DID_OK;
953 *drvstat = 0;
954 break;
955 case CAM_REQ_CMP_ERR:
956 *hoststat = DID_ERROR;
957 *drvstat = 0;
958 break;
959 case CAM_REQ_ABORTED:
960 *hoststat = DID_ABORT;
961 *drvstat = 0;
962 break;
963 case CAM_REQ_INVALID:
964 *hoststat = DID_ERROR;
965 *drvstat = DRIVER_INVALID;
966 break;
967 case CAM_DEV_NOT_THERE:
968 *hoststat = DID_BAD_TARGET;
969 *drvstat = 0;
970 break;
971 case CAM_SEL_TIMEOUT:
972 *hoststat = DID_NO_CONNECT;
973 *drvstat = 0;
974 break;
975 case CAM_CMD_TIMEOUT:
976 *hoststat = DID_TIME_OUT;
977 *drvstat = 0;
978 break;
979 case CAM_SCSI_STATUS_ERROR:
980 *hoststat = DID_ERROR;
981 *drvstat = 0;
982 break;
983 case CAM_SCSI_BUS_RESET:
984 *hoststat = DID_RESET;
985 *drvstat = 0;
986 break;
987 case CAM_UNCOR_PARITY:
988 *hoststat = DID_PARITY;
989 *drvstat = 0;
990 break;
991 case CAM_SCSI_BUSY:
992 *hoststat = DID_BUS_BUSY;
993 *drvstat = 0;
994 break;
995 default:
996 *hoststat = DID_ERROR;
997 *drvstat = DRIVER_ERROR;
998 }
999
1000 if (status & CAM_AUTOSNS_VALID)
1001 *drvstat = DRIVER_SENSE;
1002 }
1003
1004 static int
scsi_group_len(u_char cmd)1005 scsi_group_len(u_char cmd)
1006 {
1007 int len[] = {6, 10, 10, 12, 12, 12, 10, 10};
1008 int group;
1009
1010 group = (cmd >> 5) & 0x7;
1011 return (len[group]);
1012 }
1013