1 /*- 2 * Common functions for CAM "type" (peripheral) drivers. 3 * 4 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 5 * 6 * Copyright (c) 1997, 1998 Justin T. Gibbs. 7 * Copyright (c) 1997, 1998, 1999, 2000 Kenneth D. Merry. 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions, and the following disclaimer, 15 * without modification, immediately at the beginning of the file. 16 * 2. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 23 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/types.h> 38 #include <sys/malloc.h> 39 #include <sys/kernel.h> 40 #include <sys/bio.h> 41 #include <sys/conf.h> 42 #include <sys/lock.h> 43 #include <sys/mutex.h> 44 #include <sys/buf.h> 45 #include <sys/proc.h> 46 #include <sys/devicestat.h> 47 #include <sys/bus.h> 48 #include <sys/sbuf.h> 49 #include <sys/sysctl.h> 50 #include <vm/vm.h> 51 #include <vm/vm_extern.h> 52 53 #include <cam/cam.h> 54 #include <cam/cam_ccb.h> 55 #include <cam/cam_queue.h> 56 #include <cam/cam_xpt_periph.h> 57 #include <cam/cam_periph.h> 58 #include <cam/cam_debug.h> 59 #include <cam/cam_sim.h> 60 61 #include <cam/scsi/scsi_all.h> 62 #include <cam/scsi/scsi_message.h> 63 #include <cam/scsi/scsi_pass.h> 64 65 static u_int camperiphnextunit(struct periph_driver *p_drv, 66 u_int newunit, int wired, 67 path_id_t pathid, target_id_t target, 68 lun_id_t lun); 69 static u_int camperiphunit(struct periph_driver *p_drv, 70 path_id_t pathid, target_id_t target, 71 lun_id_t lun); 72 static void camperiphdone(struct cam_periph *periph, 73 union ccb *done_ccb); 74 static void camperiphfree(struct cam_periph *periph); 75 static int camperiphscsistatuserror(union ccb *ccb, 76 union ccb **orig_ccb, 77 cam_flags camflags, 78 u_int32_t sense_flags, 79 int *openings, 80 u_int32_t *relsim_flags, 81 u_int32_t *timeout, 82 u_int32_t *action, 83 const char **action_string); 84 static int camperiphscsisenseerror(union ccb *ccb, 85 union ccb **orig_ccb, 86 cam_flags camflags, 87 u_int32_t sense_flags, 88 int *openings, 89 u_int32_t *relsim_flags, 90 u_int32_t *timeout, 91 u_int32_t *action, 92 const char **action_string); 93 static void cam_periph_devctl_notify(union ccb *ccb); 94 95 static int nperiph_drivers; 96 static int initialized = 0; 97 struct periph_driver **periph_drivers; 98 99 static MALLOC_DEFINE(M_CAMPERIPH, "CAM periph", "CAM peripheral buffers"); 100 101 static int periph_selto_delay = 1000; 102 TUNABLE_INT("kern.cam.periph_selto_delay", &periph_selto_delay); 103 static int periph_noresrc_delay = 500; 104 TUNABLE_INT("kern.cam.periph_noresrc_delay", &periph_noresrc_delay); 105 static int periph_busy_delay = 500; 106 TUNABLE_INT("kern.cam.periph_busy_delay", &periph_busy_delay); 107 108 static u_int periph_mapmem_thresh = 65536; 109 SYSCTL_UINT(_kern_cam, OID_AUTO, mapmem_thresh, CTLFLAG_RWTUN, 110 &periph_mapmem_thresh, 0, "Threshold for user-space buffer mapping"); 111 112 void 113 periphdriver_register(void *data) 114 { 115 struct periph_driver *drv = (struct periph_driver *)data; 116 struct periph_driver **newdrivers, **old; 117 int ndrivers; 118 119 again: 120 ndrivers = nperiph_drivers + 2; 121 newdrivers = malloc(sizeof(*newdrivers) * ndrivers, M_CAMPERIPH, 122 M_WAITOK); 123 xpt_lock_buses(); 124 if (ndrivers != nperiph_drivers + 2) { 125 /* 126 * Lost race against itself; go around. 127 */ 128 xpt_unlock_buses(); 129 free(newdrivers, M_CAMPERIPH); 130 goto again; 131 } 132 if (periph_drivers) 133 bcopy(periph_drivers, newdrivers, 134 sizeof(*newdrivers) * nperiph_drivers); 135 newdrivers[nperiph_drivers] = drv; 136 newdrivers[nperiph_drivers + 1] = NULL; 137 old = periph_drivers; 138 periph_drivers = newdrivers; 139 nperiph_drivers++; 140 xpt_unlock_buses(); 141 if (old) 142 free(old, M_CAMPERIPH); 143 /* If driver marked as early or it is late now, initialize it. */ 144 if (((drv->flags & CAM_PERIPH_DRV_EARLY) != 0 && initialized > 0) || 145 initialized > 1) 146 (*drv->init)(); 147 } 148 149 int 150 periphdriver_unregister(void *data) 151 { 152 struct periph_driver *drv = (struct periph_driver *)data; 153 int error, n; 154 155 /* If driver marked as early or it is late now, deinitialize it. */ 156 if (((drv->flags & CAM_PERIPH_DRV_EARLY) != 0 && initialized > 0) || 157 initialized > 1) { 158 if (drv->deinit == NULL) { 159 printf("CAM periph driver '%s' doesn't have deinit.\n", 160 drv->driver_name); 161 return (EOPNOTSUPP); 162 } 163 error = drv->deinit(); 164 if (error != 0) 165 return (error); 166 } 167 168 xpt_lock_buses(); 169 for (n = 0; n < nperiph_drivers && periph_drivers[n] != drv; n++) 170 ; 171 KASSERT(n < nperiph_drivers, 172 ("Periph driver '%s' was not registered", drv->driver_name)); 173 for (; n + 1 < nperiph_drivers; n++) 174 periph_drivers[n] = periph_drivers[n + 1]; 175 periph_drivers[n + 1] = NULL; 176 nperiph_drivers--; 177 xpt_unlock_buses(); 178 return (0); 179 } 180 181 void 182 periphdriver_init(int level) 183 { 184 int i, early; 185 186 initialized = max(initialized, level); 187 for (i = 0; periph_drivers[i] != NULL; i++) { 188 early = (periph_drivers[i]->flags & CAM_PERIPH_DRV_EARLY) ? 1 : 2; 189 if (early == initialized) 190 (*periph_drivers[i]->init)(); 191 } 192 } 193 194 cam_status 195 cam_periph_alloc(periph_ctor_t *periph_ctor, 196 periph_oninv_t *periph_oninvalidate, 197 periph_dtor_t *periph_dtor, periph_start_t *periph_start, 198 char *name, cam_periph_type type, struct cam_path *path, 199 ac_callback_t *ac_callback, ac_code code, void *arg) 200 { 201 struct periph_driver **p_drv; 202 struct cam_sim *sim; 203 struct cam_periph *periph; 204 struct cam_periph *cur_periph; 205 path_id_t path_id; 206 target_id_t target_id; 207 lun_id_t lun_id; 208 cam_status status; 209 u_int init_level; 210 211 init_level = 0; 212 /* 213 * Handle Hot-Plug scenarios. If there is already a peripheral 214 * of our type assigned to this path, we are likely waiting for 215 * final close on an old, invalidated, peripheral. If this is 216 * the case, queue up a deferred call to the peripheral's async 217 * handler. If it looks like a mistaken re-allocation, complain. 218 */ 219 if ((periph = cam_periph_find(path, name)) != NULL) { 220 221 if ((periph->flags & CAM_PERIPH_INVALID) != 0 222 && (periph->flags & CAM_PERIPH_NEW_DEV_FOUND) == 0) { 223 periph->flags |= CAM_PERIPH_NEW_DEV_FOUND; 224 periph->deferred_callback = ac_callback; 225 periph->deferred_ac = code; 226 return (CAM_REQ_INPROG); 227 } else { 228 printf("cam_periph_alloc: attempt to re-allocate " 229 "valid device %s%d rejected flags %#x " 230 "refcount %d\n", periph->periph_name, 231 periph->unit_number, periph->flags, 232 periph->refcount); 233 } 234 return (CAM_REQ_INVALID); 235 } 236 237 periph = (struct cam_periph *)malloc(sizeof(*periph), M_CAMPERIPH, 238 M_NOWAIT|M_ZERO); 239 240 if (periph == NULL) 241 return (CAM_RESRC_UNAVAIL); 242 243 init_level++; 244 245 246 sim = xpt_path_sim(path); 247 path_id = xpt_path_path_id(path); 248 target_id = xpt_path_target_id(path); 249 lun_id = xpt_path_lun_id(path); 250 periph->periph_start = periph_start; 251 periph->periph_dtor = periph_dtor; 252 periph->periph_oninval = periph_oninvalidate; 253 periph->type = type; 254 periph->periph_name = name; 255 periph->scheduled_priority = CAM_PRIORITY_NONE; 256 periph->immediate_priority = CAM_PRIORITY_NONE; 257 periph->refcount = 1; /* Dropped by invalidation. */ 258 periph->sim = sim; 259 SLIST_INIT(&periph->ccb_list); 260 status = xpt_create_path(&path, periph, path_id, target_id, lun_id); 261 if (status != CAM_REQ_CMP) 262 goto failure; 263 periph->path = path; 264 265 xpt_lock_buses(); 266 for (p_drv = periph_drivers; *p_drv != NULL; p_drv++) { 267 if (strcmp((*p_drv)->driver_name, name) == 0) 268 break; 269 } 270 if (*p_drv == NULL) { 271 printf("cam_periph_alloc: invalid periph name '%s'\n", name); 272 xpt_unlock_buses(); 273 xpt_free_path(periph->path); 274 free(periph, M_CAMPERIPH); 275 return (CAM_REQ_INVALID); 276 } 277 periph->unit_number = camperiphunit(*p_drv, path_id, target_id, lun_id); 278 cur_periph = TAILQ_FIRST(&(*p_drv)->units); 279 while (cur_periph != NULL 280 && cur_periph->unit_number < periph->unit_number) 281 cur_periph = TAILQ_NEXT(cur_periph, unit_links); 282 if (cur_periph != NULL) { 283 KASSERT(cur_periph->unit_number != periph->unit_number, ("duplicate units on periph list")); 284 TAILQ_INSERT_BEFORE(cur_periph, periph, unit_links); 285 } else { 286 TAILQ_INSERT_TAIL(&(*p_drv)->units, periph, unit_links); 287 (*p_drv)->generation++; 288 } 289 xpt_unlock_buses(); 290 291 init_level++; 292 293 status = xpt_add_periph(periph); 294 if (status != CAM_REQ_CMP) 295 goto failure; 296 297 init_level++; 298 CAM_DEBUG(periph->path, CAM_DEBUG_INFO, ("Periph created\n")); 299 300 status = periph_ctor(periph, arg); 301 302 if (status == CAM_REQ_CMP) 303 init_level++; 304 305 failure: 306 switch (init_level) { 307 case 4: 308 /* Initialized successfully */ 309 break; 310 case 3: 311 CAM_DEBUG(periph->path, CAM_DEBUG_INFO, ("Periph destroyed\n")); 312 xpt_remove_periph(periph); 313 /* FALLTHROUGH */ 314 case 2: 315 xpt_lock_buses(); 316 TAILQ_REMOVE(&(*p_drv)->units, periph, unit_links); 317 xpt_unlock_buses(); 318 xpt_free_path(periph->path); 319 /* FALLTHROUGH */ 320 case 1: 321 free(periph, M_CAMPERIPH); 322 /* FALLTHROUGH */ 323 case 0: 324 /* No cleanup to perform. */ 325 break; 326 default: 327 panic("%s: Unknown init level", __func__); 328 } 329 return(status); 330 } 331 332 /* 333 * Find a peripheral structure with the specified path, target, lun, 334 * and (optionally) type. If the name is NULL, this function will return 335 * the first peripheral driver that matches the specified path. 336 */ 337 struct cam_periph * 338 cam_periph_find(struct cam_path *path, char *name) 339 { 340 struct periph_driver **p_drv; 341 struct cam_periph *periph; 342 343 xpt_lock_buses(); 344 for (p_drv = periph_drivers; *p_drv != NULL; p_drv++) { 345 346 if (name != NULL && (strcmp((*p_drv)->driver_name, name) != 0)) 347 continue; 348 349 TAILQ_FOREACH(periph, &(*p_drv)->units, unit_links) { 350 if (xpt_path_comp(periph->path, path) == 0) { 351 xpt_unlock_buses(); 352 cam_periph_assert(periph, MA_OWNED); 353 return(periph); 354 } 355 } 356 if (name != NULL) { 357 xpt_unlock_buses(); 358 return(NULL); 359 } 360 } 361 xpt_unlock_buses(); 362 return(NULL); 363 } 364 365 /* 366 * Find peripheral driver instances attached to the specified path. 367 */ 368 int 369 cam_periph_list(struct cam_path *path, struct sbuf *sb) 370 { 371 struct sbuf local_sb; 372 struct periph_driver **p_drv; 373 struct cam_periph *periph; 374 int count; 375 int sbuf_alloc_len; 376 377 sbuf_alloc_len = 16; 378 retry: 379 sbuf_new(&local_sb, NULL, sbuf_alloc_len, SBUF_FIXEDLEN); 380 count = 0; 381 xpt_lock_buses(); 382 for (p_drv = periph_drivers; *p_drv != NULL; p_drv++) { 383 384 TAILQ_FOREACH(periph, &(*p_drv)->units, unit_links) { 385 if (xpt_path_comp(periph->path, path) != 0) 386 continue; 387 388 if (sbuf_len(&local_sb) != 0) 389 sbuf_cat(&local_sb, ","); 390 391 sbuf_printf(&local_sb, "%s%d", periph->periph_name, 392 periph->unit_number); 393 394 if (sbuf_error(&local_sb) == ENOMEM) { 395 sbuf_alloc_len *= 2; 396 xpt_unlock_buses(); 397 sbuf_delete(&local_sb); 398 goto retry; 399 } 400 count++; 401 } 402 } 403 xpt_unlock_buses(); 404 sbuf_finish(&local_sb); 405 if (sbuf_len(sb) != 0) 406 sbuf_cat(sb, ","); 407 sbuf_cat(sb, sbuf_data(&local_sb)); 408 sbuf_delete(&local_sb); 409 return (count); 410 } 411 412 int 413 cam_periph_acquire(struct cam_periph *periph) 414 { 415 int status; 416 417 if (periph == NULL) 418 return (EINVAL); 419 420 status = ENOENT; 421 xpt_lock_buses(); 422 if ((periph->flags & CAM_PERIPH_INVALID) == 0) { 423 periph->refcount++; 424 status = 0; 425 } 426 xpt_unlock_buses(); 427 428 return (status); 429 } 430 431 void 432 cam_periph_doacquire(struct cam_periph *periph) 433 { 434 435 xpt_lock_buses(); 436 KASSERT(periph->refcount >= 1, 437 ("cam_periph_doacquire() with refcount == %d", periph->refcount)); 438 periph->refcount++; 439 xpt_unlock_buses(); 440 } 441 442 void 443 cam_periph_release_locked_buses(struct cam_periph *periph) 444 { 445 446 cam_periph_assert(periph, MA_OWNED); 447 KASSERT(periph->refcount >= 1, ("periph->refcount >= 1")); 448 if (--periph->refcount == 0) 449 camperiphfree(periph); 450 } 451 452 void 453 cam_periph_release_locked(struct cam_periph *periph) 454 { 455 456 if (periph == NULL) 457 return; 458 459 xpt_lock_buses(); 460 cam_periph_release_locked_buses(periph); 461 xpt_unlock_buses(); 462 } 463 464 void 465 cam_periph_release(struct cam_periph *periph) 466 { 467 struct mtx *mtx; 468 469 if (periph == NULL) 470 return; 471 472 cam_periph_assert(periph, MA_NOTOWNED); 473 mtx = cam_periph_mtx(periph); 474 mtx_lock(mtx); 475 cam_periph_release_locked(periph); 476 mtx_unlock(mtx); 477 } 478 479 /* 480 * hold/unhold act as mutual exclusion for sections of the code that 481 * need to sleep and want to make sure that other sections that 482 * will interfere are held off. This only protects exclusive sections 483 * from each other. 484 */ 485 int 486 cam_periph_hold(struct cam_periph *periph, int priority) 487 { 488 int error; 489 490 /* 491 * Increment the reference count on the peripheral 492 * while we wait for our lock attempt to succeed 493 * to ensure the peripheral doesn't disappear out 494 * from user us while we sleep. 495 */ 496 497 if (cam_periph_acquire(periph) != 0) 498 return (ENXIO); 499 500 cam_periph_assert(periph, MA_OWNED); 501 while ((periph->flags & CAM_PERIPH_LOCKED) != 0) { 502 periph->flags |= CAM_PERIPH_LOCK_WANTED; 503 if ((error = cam_periph_sleep(periph, periph, priority, 504 "caplck", 0)) != 0) { 505 cam_periph_release_locked(periph); 506 return (error); 507 } 508 if (periph->flags & CAM_PERIPH_INVALID) { 509 cam_periph_release_locked(periph); 510 return (ENXIO); 511 } 512 } 513 514 periph->flags |= CAM_PERIPH_LOCKED; 515 return (0); 516 } 517 518 void 519 cam_periph_unhold(struct cam_periph *periph) 520 { 521 522 cam_periph_assert(periph, MA_OWNED); 523 524 periph->flags &= ~CAM_PERIPH_LOCKED; 525 if ((periph->flags & CAM_PERIPH_LOCK_WANTED) != 0) { 526 periph->flags &= ~CAM_PERIPH_LOCK_WANTED; 527 wakeup(periph); 528 } 529 530 cam_periph_release_locked(periph); 531 } 532 533 /* 534 * Look for the next unit number that is not currently in use for this 535 * peripheral type starting at "newunit". Also exclude unit numbers that 536 * are reserved by for future "hardwiring" unless we already know that this 537 * is a potential wired device. Only assume that the device is "wired" the 538 * first time through the loop since after that we'll be looking at unit 539 * numbers that did not match a wiring entry. 540 */ 541 static u_int 542 camperiphnextunit(struct periph_driver *p_drv, u_int newunit, int wired, 543 path_id_t pathid, target_id_t target, lun_id_t lun) 544 { 545 struct cam_periph *periph; 546 char *periph_name; 547 int i, val, dunit, r; 548 const char *dname, *strval; 549 550 periph_name = p_drv->driver_name; 551 for (;;newunit++) { 552 553 for (periph = TAILQ_FIRST(&p_drv->units); 554 periph != NULL && periph->unit_number != newunit; 555 periph = TAILQ_NEXT(periph, unit_links)) 556 ; 557 558 if (periph != NULL && periph->unit_number == newunit) { 559 if (wired != 0) { 560 xpt_print(periph->path, "Duplicate Wired " 561 "Device entry!\n"); 562 xpt_print(periph->path, "Second device (%s " 563 "device at scbus%d target %d lun %d) will " 564 "not be wired\n", periph_name, pathid, 565 target, lun); 566 wired = 0; 567 } 568 continue; 569 } 570 if (wired) 571 break; 572 573 /* 574 * Don't match entries like "da 4" as a wired down 575 * device, but do match entries like "da 4 target 5" 576 * or even "da 4 scbus 1". 577 */ 578 i = 0; 579 dname = periph_name; 580 for (;;) { 581 r = resource_find_dev(&i, dname, &dunit, NULL, NULL); 582 if (r != 0) 583 break; 584 /* if no "target" and no specific scbus, skip */ 585 if (resource_int_value(dname, dunit, "target", &val) && 586 (resource_string_value(dname, dunit, "at",&strval)|| 587 strcmp(strval, "scbus") == 0)) 588 continue; 589 if (newunit == dunit) 590 break; 591 } 592 if (r != 0) 593 break; 594 } 595 return (newunit); 596 } 597 598 static u_int 599 camperiphunit(struct periph_driver *p_drv, path_id_t pathid, 600 target_id_t target, lun_id_t lun) 601 { 602 u_int unit; 603 int wired, i, val, dunit; 604 const char *dname, *strval; 605 char pathbuf[32], *periph_name; 606 607 periph_name = p_drv->driver_name; 608 snprintf(pathbuf, sizeof(pathbuf), "scbus%d", pathid); 609 unit = 0; 610 i = 0; 611 dname = periph_name; 612 for (wired = 0; resource_find_dev(&i, dname, &dunit, NULL, NULL) == 0; 613 wired = 0) { 614 if (resource_string_value(dname, dunit, "at", &strval) == 0) { 615 if (strcmp(strval, pathbuf) != 0) 616 continue; 617 wired++; 618 } 619 if (resource_int_value(dname, dunit, "target", &val) == 0) { 620 if (val != target) 621 continue; 622 wired++; 623 } 624 if (resource_int_value(dname, dunit, "lun", &val) == 0) { 625 if (val != lun) 626 continue; 627 wired++; 628 } 629 if (wired != 0) { 630 unit = dunit; 631 break; 632 } 633 } 634 635 /* 636 * Either start from 0 looking for the next unit or from 637 * the unit number given in the resource config. This way, 638 * if we have wildcard matches, we don't return the same 639 * unit number twice. 640 */ 641 unit = camperiphnextunit(p_drv, unit, wired, pathid, target, lun); 642 643 return (unit); 644 } 645 646 void 647 cam_periph_invalidate(struct cam_periph *periph) 648 { 649 650 cam_periph_assert(periph, MA_OWNED); 651 /* 652 * We only tear down the device the first time a peripheral is 653 * invalidated. 654 */ 655 if ((periph->flags & CAM_PERIPH_INVALID) != 0) 656 return; 657 658 CAM_DEBUG(periph->path, CAM_DEBUG_INFO, ("Periph invalidated\n")); 659 if ((periph->flags & CAM_PERIPH_ANNOUNCED) && !rebooting) { 660 struct sbuf sb; 661 char buffer[160]; 662 663 sbuf_new(&sb, buffer, 160, SBUF_FIXEDLEN); 664 xpt_denounce_periph_sbuf(periph, &sb); 665 sbuf_finish(&sb); 666 sbuf_putbuf(&sb); 667 } 668 periph->flags |= CAM_PERIPH_INVALID; 669 periph->flags &= ~CAM_PERIPH_NEW_DEV_FOUND; 670 if (periph->periph_oninval != NULL) 671 periph->periph_oninval(periph); 672 cam_periph_release_locked(periph); 673 } 674 675 static void 676 camperiphfree(struct cam_periph *periph) 677 { 678 struct periph_driver **p_drv; 679 struct periph_driver *drv; 680 681 cam_periph_assert(periph, MA_OWNED); 682 KASSERT(periph->periph_allocating == 0, ("%s%d: freed while allocating", 683 periph->periph_name, periph->unit_number)); 684 for (p_drv = periph_drivers; *p_drv != NULL; p_drv++) { 685 if (strcmp((*p_drv)->driver_name, periph->periph_name) == 0) 686 break; 687 } 688 if (*p_drv == NULL) { 689 printf("camperiphfree: attempt to free non-existant periph\n"); 690 return; 691 } 692 /* 693 * Cache a pointer to the periph_driver structure. If a 694 * periph_driver is added or removed from the array (see 695 * periphdriver_register()) while we drop the toplogy lock 696 * below, p_drv may change. This doesn't protect against this 697 * particular periph_driver going away. That will require full 698 * reference counting in the periph_driver infrastructure. 699 */ 700 drv = *p_drv; 701 702 /* 703 * We need to set this flag before dropping the topology lock, to 704 * let anyone who is traversing the list that this peripheral is 705 * about to be freed, and there will be no more reference count 706 * checks. 707 */ 708 periph->flags |= CAM_PERIPH_FREE; 709 710 /* 711 * The peripheral destructor semantics dictate calling with only the 712 * SIM mutex held. Since it might sleep, it should not be called 713 * with the topology lock held. 714 */ 715 xpt_unlock_buses(); 716 717 /* 718 * We need to call the peripheral destructor prior to removing the 719 * peripheral from the list. Otherwise, we risk running into a 720 * scenario where the peripheral unit number may get reused 721 * (because it has been removed from the list), but some resources 722 * used by the peripheral are still hanging around. In particular, 723 * the devfs nodes used by some peripherals like the pass(4) driver 724 * aren't fully cleaned up until the destructor is run. If the 725 * unit number is reused before the devfs instance is fully gone, 726 * devfs will panic. 727 */ 728 if (periph->periph_dtor != NULL) 729 periph->periph_dtor(periph); 730 731 /* 732 * The peripheral list is protected by the topology lock. We have to 733 * remove the periph from the drv list before we call deferred_ac. The 734 * AC_FOUND_DEVICE callback won't create a new periph if it's still there. 735 */ 736 xpt_lock_buses(); 737 738 TAILQ_REMOVE(&drv->units, periph, unit_links); 739 drv->generation++; 740 741 xpt_remove_periph(periph); 742 743 xpt_unlock_buses(); 744 if ((periph->flags & CAM_PERIPH_ANNOUNCED) && !rebooting) 745 xpt_print(periph->path, "Periph destroyed\n"); 746 else 747 CAM_DEBUG(periph->path, CAM_DEBUG_INFO, ("Periph destroyed\n")); 748 749 if (periph->flags & CAM_PERIPH_NEW_DEV_FOUND) { 750 union ccb ccb; 751 void *arg; 752 753 switch (periph->deferred_ac) { 754 case AC_FOUND_DEVICE: 755 ccb.ccb_h.func_code = XPT_GDEV_TYPE; 756 xpt_setup_ccb(&ccb.ccb_h, periph->path, CAM_PRIORITY_NORMAL); 757 xpt_action(&ccb); 758 arg = &ccb; 759 break; 760 case AC_PATH_REGISTERED: 761 xpt_path_inq(&ccb.cpi, periph->path); 762 arg = &ccb; 763 break; 764 default: 765 arg = NULL; 766 break; 767 } 768 periph->deferred_callback(NULL, periph->deferred_ac, 769 periph->path, arg); 770 } 771 xpt_free_path(periph->path); 772 free(periph, M_CAMPERIPH); 773 xpt_lock_buses(); 774 } 775 776 /* 777 * Map user virtual pointers into kernel virtual address space, so we can 778 * access the memory. This is now a generic function that centralizes most 779 * of the sanity checks on the data flags, if any. 780 * This also only works for up to MAXPHYS memory. Since we use 781 * buffers to map stuff in and out, we're limited to the buffer size. 782 */ 783 int 784 cam_periph_mapmem(union ccb *ccb, struct cam_periph_map_info *mapinfo, 785 u_int maxmap) 786 { 787 int numbufs, i; 788 u_int8_t **data_ptrs[CAM_PERIPH_MAXMAPS]; 789 u_int32_t lengths[CAM_PERIPH_MAXMAPS]; 790 u_int32_t dirs[CAM_PERIPH_MAXMAPS]; 791 bool misaligned[CAM_PERIPH_MAXMAPS]; 792 793 bzero(mapinfo, sizeof(*mapinfo)); 794 if (maxmap == 0) 795 maxmap = DFLTPHYS; /* traditional default */ 796 else if (maxmap > MAXPHYS) 797 maxmap = MAXPHYS; /* for safety */ 798 switch(ccb->ccb_h.func_code) { 799 case XPT_DEV_MATCH: 800 if (ccb->cdm.match_buf_len == 0) { 801 printf("cam_periph_mapmem: invalid match buffer " 802 "length 0\n"); 803 return(EINVAL); 804 } 805 if (ccb->cdm.pattern_buf_len > 0) { 806 data_ptrs[0] = (u_int8_t **)&ccb->cdm.patterns; 807 lengths[0] = ccb->cdm.pattern_buf_len; 808 dirs[0] = CAM_DIR_OUT; 809 data_ptrs[1] = (u_int8_t **)&ccb->cdm.matches; 810 lengths[1] = ccb->cdm.match_buf_len; 811 dirs[1] = CAM_DIR_IN; 812 numbufs = 2; 813 } else { 814 data_ptrs[0] = (u_int8_t **)&ccb->cdm.matches; 815 lengths[0] = ccb->cdm.match_buf_len; 816 dirs[0] = CAM_DIR_IN; 817 numbufs = 1; 818 } 819 /* 820 * This request will not go to the hardware, no reason 821 * to be so strict. vmapbuf() is able to map up to MAXPHYS. 822 */ 823 maxmap = MAXPHYS; 824 break; 825 case XPT_SCSI_IO: 826 case XPT_CONT_TARGET_IO: 827 if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_NONE) 828 return(0); 829 if ((ccb->ccb_h.flags & CAM_DATA_MASK) != CAM_DATA_VADDR) 830 return (EINVAL); 831 data_ptrs[0] = &ccb->csio.data_ptr; 832 lengths[0] = ccb->csio.dxfer_len; 833 dirs[0] = ccb->ccb_h.flags & CAM_DIR_MASK; 834 numbufs = 1; 835 break; 836 case XPT_ATA_IO: 837 if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_NONE) 838 return(0); 839 if ((ccb->ccb_h.flags & CAM_DATA_MASK) != CAM_DATA_VADDR) 840 return (EINVAL); 841 data_ptrs[0] = &ccb->ataio.data_ptr; 842 lengths[0] = ccb->ataio.dxfer_len; 843 dirs[0] = ccb->ccb_h.flags & CAM_DIR_MASK; 844 numbufs = 1; 845 break; 846 case XPT_MMC_IO: 847 if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_NONE) 848 return(0); 849 /* Two mappings: one for cmd->data and one for cmd->data->data */ 850 data_ptrs[0] = (unsigned char **)&ccb->mmcio.cmd.data; 851 lengths[0] = sizeof(struct mmc_data *); 852 dirs[0] = ccb->ccb_h.flags & CAM_DIR_MASK; 853 data_ptrs[1] = (unsigned char **)&ccb->mmcio.cmd.data->data; 854 lengths[1] = ccb->mmcio.cmd.data->len; 855 dirs[1] = ccb->ccb_h.flags & CAM_DIR_MASK; 856 numbufs = 2; 857 break; 858 case XPT_SMP_IO: 859 data_ptrs[0] = &ccb->smpio.smp_request; 860 lengths[0] = ccb->smpio.smp_request_len; 861 dirs[0] = CAM_DIR_OUT; 862 data_ptrs[1] = &ccb->smpio.smp_response; 863 lengths[1] = ccb->smpio.smp_response_len; 864 dirs[1] = CAM_DIR_IN; 865 numbufs = 2; 866 break; 867 case XPT_NVME_IO: 868 case XPT_NVME_ADMIN: 869 if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_NONE) 870 return (0); 871 if ((ccb->ccb_h.flags & CAM_DATA_MASK) != CAM_DATA_VADDR) 872 return (EINVAL); 873 data_ptrs[0] = &ccb->nvmeio.data_ptr; 874 lengths[0] = ccb->nvmeio.dxfer_len; 875 dirs[0] = ccb->ccb_h.flags & CAM_DIR_MASK; 876 numbufs = 1; 877 break; 878 case XPT_DEV_ADVINFO: 879 if (ccb->cdai.bufsiz == 0) 880 return (0); 881 882 data_ptrs[0] = (uint8_t **)&ccb->cdai.buf; 883 lengths[0] = ccb->cdai.bufsiz; 884 dirs[0] = CAM_DIR_IN; 885 numbufs = 1; 886 887 /* 888 * This request will not go to the hardware, no reason 889 * to be so strict. vmapbuf() is able to map up to MAXPHYS. 890 */ 891 maxmap = MAXPHYS; 892 break; 893 default: 894 return(EINVAL); 895 break; /* NOTREACHED */ 896 } 897 898 /* 899 * Check the transfer length and permissions first, so we don't 900 * have to unmap any previously mapped buffers. 901 */ 902 for (i = 0; i < numbufs; i++) { 903 if (lengths[i] > maxmap) { 904 printf("cam_periph_mapmem: attempt to map %lu bytes, " 905 "which is greater than %lu\n", 906 (long)(lengths[i]), (u_long)maxmap); 907 return (E2BIG); 908 } 909 910 /* 911 * The userland data pointer passed in may not be page 912 * aligned. vmapbuf() truncates the address to a page 913 * boundary, so if the address isn't page aligned, we'll 914 * need enough space for the given transfer length, plus 915 * whatever extra space is necessary to make it to the page 916 * boundary. 917 */ 918 misaligned[i] = (lengths[i] + 919 (((vm_offset_t)(*data_ptrs[i])) & PAGE_MASK) > MAXPHYS); 920 } 921 922 /* 923 * This keeps the kernel stack of current thread from getting 924 * swapped. In low-memory situations where the kernel stack might 925 * otherwise get swapped out, this holds it and allows the thread 926 * to make progress and release the kernel mapped pages sooner. 927 * 928 * XXX KDM should I use P_NOSWAP instead? 929 */ 930 PHOLD(curproc); 931 932 for (i = 0; i < numbufs; i++) { 933 934 /* Save the user's data address. */ 935 mapinfo->orig[i] = *data_ptrs[i]; 936 937 /* 938 * For small buffers use malloc+copyin/copyout instead of 939 * mapping to KVA to avoid expensive TLB shootdowns. For 940 * small allocations malloc is backed by UMA, and so much 941 * cheaper on SMP systems. 942 */ 943 if ((lengths[i] <= periph_mapmem_thresh || misaligned[i]) && 944 ccb->ccb_h.func_code != XPT_MMC_IO) { 945 *data_ptrs[i] = malloc(lengths[i], M_CAMPERIPH, 946 M_WAITOK); 947 if (dirs[i] != CAM_DIR_IN) { 948 if (copyin(mapinfo->orig[i], *data_ptrs[i], 949 lengths[i]) != 0) { 950 free(*data_ptrs[i], M_CAMPERIPH); 951 *data_ptrs[i] = mapinfo->orig[i]; 952 goto fail; 953 } 954 } else 955 bzero(*data_ptrs[i], lengths[i]); 956 continue; 957 } 958 959 /* 960 * Get the buffer. 961 */ 962 mapinfo->bp[i] = uma_zalloc(pbuf_zone, M_WAITOK); 963 964 /* put our pointer in the data slot */ 965 mapinfo->bp[i]->b_data = *data_ptrs[i]; 966 967 /* set the transfer length, we know it's < MAXPHYS */ 968 mapinfo->bp[i]->b_bufsize = lengths[i]; 969 970 /* set the direction */ 971 mapinfo->bp[i]->b_iocmd = (dirs[i] == CAM_DIR_OUT) ? 972 BIO_WRITE : BIO_READ; 973 974 /* 975 * Map the buffer into kernel memory. 976 * 977 * Note that useracc() alone is not a sufficient test. 978 * vmapbuf() can still fail due to a smaller file mapped 979 * into a larger area of VM, or if userland races against 980 * vmapbuf() after the useracc() check. 981 */ 982 if (vmapbuf(mapinfo->bp[i], 1) < 0) { 983 uma_zfree(pbuf_zone, mapinfo->bp[i]); 984 goto fail; 985 } 986 987 /* set our pointer to the new mapped area */ 988 *data_ptrs[i] = mapinfo->bp[i]->b_data; 989 } 990 991 /* 992 * Now that we've gotten this far, change ownership to the kernel 993 * of the buffers so that we don't run afoul of returning to user 994 * space with locks (on the buffer) held. 995 */ 996 for (i = 0; i < numbufs; i++) { 997 if (mapinfo->bp[i]) 998 BUF_KERNPROC(mapinfo->bp[i]); 999 } 1000 1001 mapinfo->num_bufs_used = numbufs; 1002 return(0); 1003 1004 fail: 1005 for (i--; i >= 0; i--) { 1006 if (mapinfo->bp[i]) { 1007 vunmapbuf(mapinfo->bp[i]); 1008 uma_zfree(pbuf_zone, mapinfo->bp[i]); 1009 } else 1010 free(*data_ptrs[i], M_CAMPERIPH); 1011 *data_ptrs[i] = mapinfo->orig[i]; 1012 } 1013 PRELE(curproc); 1014 return(EACCES); 1015 } 1016 1017 /* 1018 * Unmap memory segments mapped into kernel virtual address space by 1019 * cam_periph_mapmem(). 1020 */ 1021 void 1022 cam_periph_unmapmem(union ccb *ccb, struct cam_periph_map_info *mapinfo) 1023 { 1024 int numbufs, i; 1025 u_int8_t **data_ptrs[CAM_PERIPH_MAXMAPS]; 1026 u_int32_t lengths[CAM_PERIPH_MAXMAPS]; 1027 u_int32_t dirs[CAM_PERIPH_MAXMAPS]; 1028 1029 if (mapinfo->num_bufs_used <= 0) { 1030 /* nothing to free and the process wasn't held. */ 1031 return; 1032 } 1033 1034 switch (ccb->ccb_h.func_code) { 1035 case XPT_DEV_MATCH: 1036 if (ccb->cdm.pattern_buf_len > 0) { 1037 data_ptrs[0] = (u_int8_t **)&ccb->cdm.patterns; 1038 lengths[0] = ccb->cdm.pattern_buf_len; 1039 dirs[0] = CAM_DIR_OUT; 1040 data_ptrs[1] = (u_int8_t **)&ccb->cdm.matches; 1041 lengths[1] = ccb->cdm.match_buf_len; 1042 dirs[1] = CAM_DIR_IN; 1043 numbufs = 2; 1044 } else { 1045 data_ptrs[0] = (u_int8_t **)&ccb->cdm.matches; 1046 lengths[0] = ccb->cdm.match_buf_len; 1047 dirs[0] = CAM_DIR_IN; 1048 numbufs = 1; 1049 } 1050 break; 1051 case XPT_SCSI_IO: 1052 case XPT_CONT_TARGET_IO: 1053 data_ptrs[0] = &ccb->csio.data_ptr; 1054 lengths[0] = ccb->csio.dxfer_len; 1055 dirs[0] = ccb->ccb_h.flags & CAM_DIR_MASK; 1056 numbufs = 1; 1057 break; 1058 case XPT_ATA_IO: 1059 data_ptrs[0] = &ccb->ataio.data_ptr; 1060 lengths[0] = ccb->ataio.dxfer_len; 1061 dirs[0] = ccb->ccb_h.flags & CAM_DIR_MASK; 1062 numbufs = 1; 1063 break; 1064 case XPT_MMC_IO: 1065 data_ptrs[0] = (u_int8_t **)&ccb->mmcio.cmd.data; 1066 lengths[0] = sizeof(struct mmc_data *); 1067 dirs[0] = ccb->ccb_h.flags & CAM_DIR_MASK; 1068 data_ptrs[1] = (u_int8_t **)&ccb->mmcio.cmd.data->data; 1069 lengths[1] = ccb->mmcio.cmd.data->len; 1070 dirs[1] = ccb->ccb_h.flags & CAM_DIR_MASK; 1071 numbufs = 2; 1072 break; 1073 case XPT_SMP_IO: 1074 data_ptrs[0] = &ccb->smpio.smp_request; 1075 lengths[0] = ccb->smpio.smp_request_len; 1076 dirs[0] = CAM_DIR_OUT; 1077 data_ptrs[1] = &ccb->smpio.smp_response; 1078 lengths[1] = ccb->smpio.smp_response_len; 1079 dirs[1] = CAM_DIR_IN; 1080 numbufs = 2; 1081 break; 1082 case XPT_NVME_IO: 1083 case XPT_NVME_ADMIN: 1084 data_ptrs[0] = &ccb->nvmeio.data_ptr; 1085 lengths[0] = ccb->nvmeio.dxfer_len; 1086 dirs[0] = ccb->ccb_h.flags & CAM_DIR_MASK; 1087 numbufs = 1; 1088 break; 1089 case XPT_DEV_ADVINFO: 1090 data_ptrs[0] = (uint8_t **)&ccb->cdai.buf; 1091 lengths[0] = ccb->cdai.bufsiz; 1092 dirs[0] = CAM_DIR_IN; 1093 numbufs = 1; 1094 break; 1095 default: 1096 /* allow ourselves to be swapped once again */ 1097 PRELE(curproc); 1098 return; 1099 break; /* NOTREACHED */ 1100 } 1101 1102 for (i = 0; i < numbufs; i++) { 1103 if (mapinfo->bp[i]) { 1104 /* unmap the buffer */ 1105 vunmapbuf(mapinfo->bp[i]); 1106 1107 /* release the buffer */ 1108 uma_zfree(pbuf_zone, mapinfo->bp[i]); 1109 } else { 1110 if (dirs[i] != CAM_DIR_OUT) { 1111 copyout(*data_ptrs[i], mapinfo->orig[i], 1112 lengths[i]); 1113 } 1114 free(*data_ptrs[i], M_CAMPERIPH); 1115 } 1116 1117 /* Set the user's pointer back to the original value */ 1118 *data_ptrs[i] = mapinfo->orig[i]; 1119 } 1120 1121 /* allow ourselves to be swapped once again */ 1122 PRELE(curproc); 1123 } 1124 1125 int 1126 cam_periph_ioctl(struct cam_periph *periph, u_long cmd, caddr_t addr, 1127 int (*error_routine)(union ccb *ccb, 1128 cam_flags camflags, 1129 u_int32_t sense_flags)) 1130 { 1131 union ccb *ccb; 1132 int error; 1133 int found; 1134 1135 error = found = 0; 1136 1137 switch(cmd){ 1138 case CAMGETPASSTHRU: 1139 ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL); 1140 xpt_setup_ccb(&ccb->ccb_h, 1141 ccb->ccb_h.path, 1142 CAM_PRIORITY_NORMAL); 1143 ccb->ccb_h.func_code = XPT_GDEVLIST; 1144 1145 /* 1146 * Basically, the point of this is that we go through 1147 * getting the list of devices, until we find a passthrough 1148 * device. In the current version of the CAM code, the 1149 * only way to determine what type of device we're dealing 1150 * with is by its name. 1151 */ 1152 while (found == 0) { 1153 ccb->cgdl.index = 0; 1154 ccb->cgdl.status = CAM_GDEVLIST_MORE_DEVS; 1155 while (ccb->cgdl.status == CAM_GDEVLIST_MORE_DEVS) { 1156 1157 /* we want the next device in the list */ 1158 xpt_action(ccb); 1159 if (strncmp(ccb->cgdl.periph_name, 1160 "pass", 4) == 0){ 1161 found = 1; 1162 break; 1163 } 1164 } 1165 if ((ccb->cgdl.status == CAM_GDEVLIST_LAST_DEVICE) && 1166 (found == 0)) { 1167 ccb->cgdl.periph_name[0] = '\0'; 1168 ccb->cgdl.unit_number = 0; 1169 break; 1170 } 1171 } 1172 1173 /* copy the result back out */ 1174 bcopy(ccb, addr, sizeof(union ccb)); 1175 1176 /* and release the ccb */ 1177 xpt_release_ccb(ccb); 1178 1179 break; 1180 default: 1181 error = ENOTTY; 1182 break; 1183 } 1184 return(error); 1185 } 1186 1187 static void 1188 cam_periph_done_panic(struct cam_periph *periph, union ccb *done_ccb) 1189 { 1190 1191 panic("%s: already done with ccb %p", __func__, done_ccb); 1192 } 1193 1194 static void 1195 cam_periph_done(struct cam_periph *periph, union ccb *done_ccb) 1196 { 1197 1198 /* Caller will release the CCB */ 1199 xpt_path_assert(done_ccb->ccb_h.path, MA_OWNED); 1200 done_ccb->ccb_h.cbfcnp = cam_periph_done_panic; 1201 wakeup(&done_ccb->ccb_h.cbfcnp); 1202 } 1203 1204 static void 1205 cam_periph_ccbwait(union ccb *ccb) 1206 { 1207 1208 if ((ccb->ccb_h.func_code & XPT_FC_QUEUED) != 0) { 1209 while (ccb->ccb_h.cbfcnp != cam_periph_done_panic) 1210 xpt_path_sleep(ccb->ccb_h.path, &ccb->ccb_h.cbfcnp, 1211 PRIBIO, "cbwait", 0); 1212 } 1213 KASSERT(ccb->ccb_h.pinfo.index == CAM_UNQUEUED_INDEX && 1214 (ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_INPROG, 1215 ("%s: proceeding with incomplete ccb: ccb=%p, func_code=%#x, " 1216 "status=%#x, index=%d", __func__, ccb, ccb->ccb_h.func_code, 1217 ccb->ccb_h.status, ccb->ccb_h.pinfo.index)); 1218 } 1219 1220 /* 1221 * Dispatch a CCB and wait for it to complete. If the CCB has set a 1222 * callback function (ccb->ccb_h.cbfcnp), it will be overwritten and lost. 1223 */ 1224 int 1225 cam_periph_runccb(union ccb *ccb, 1226 int (*error_routine)(union ccb *ccb, 1227 cam_flags camflags, 1228 u_int32_t sense_flags), 1229 cam_flags camflags, u_int32_t sense_flags, 1230 struct devstat *ds) 1231 { 1232 struct bintime *starttime; 1233 struct bintime ltime; 1234 int error; 1235 bool must_poll; 1236 uint32_t timeout = 1; 1237 1238 starttime = NULL; 1239 xpt_path_assert(ccb->ccb_h.path, MA_OWNED); 1240 KASSERT((ccb->ccb_h.flags & CAM_UNLOCKED) == 0, 1241 ("%s: ccb=%p, func_code=%#x, flags=%#x", __func__, ccb, 1242 ccb->ccb_h.func_code, ccb->ccb_h.flags)); 1243 1244 /* 1245 * If the user has supplied a stats structure, and if we understand 1246 * this particular type of ccb, record the transaction start. 1247 */ 1248 if (ds != NULL && 1249 (ccb->ccb_h.func_code == XPT_SCSI_IO || 1250 ccb->ccb_h.func_code == XPT_ATA_IO || 1251 ccb->ccb_h.func_code == XPT_NVME_IO)) { 1252 starttime = <ime; 1253 binuptime(starttime); 1254 devstat_start_transaction(ds, starttime); 1255 } 1256 1257 /* 1258 * We must poll the I/O while we're dumping. The scheduler is normally 1259 * stopped for dumping, except when we call doadump from ddb. While the 1260 * scheduler is running in this case, we still need to poll the I/O to 1261 * avoid sleeping waiting for the ccb to complete. 1262 * 1263 * A panic triggered dump stops the scheduler, any callback from the 1264 * shutdown_post_sync event will run with the scheduler stopped, but 1265 * before we're officially dumping. To avoid hanging in adashutdown 1266 * initiated commands (or other similar situations), we have to test for 1267 * either SCHEDULER_STOPPED() here as well. 1268 * 1269 * To avoid locking problems, dumping/polling callers must call 1270 * without a periph lock held. 1271 */ 1272 must_poll = dumping || SCHEDULER_STOPPED(); 1273 ccb->ccb_h.cbfcnp = cam_periph_done; 1274 1275 /* 1276 * If we're polling, then we need to ensure that we have ample resources 1277 * in the periph. cam_periph_error can reschedule the ccb by calling 1278 * xpt_action and returning ERESTART, so we have to effect the polling 1279 * in the do loop below. 1280 */ 1281 if (must_poll) { 1282 timeout = xpt_poll_setup(ccb); 1283 } 1284 1285 if (timeout == 0) { 1286 ccb->ccb_h.status = CAM_RESRC_UNAVAIL; 1287 error = EBUSY; 1288 } else { 1289 xpt_action(ccb); 1290 do { 1291 if (must_poll) { 1292 xpt_pollwait(ccb, timeout); 1293 timeout = ccb->ccb_h.timeout * 10; 1294 } else { 1295 cam_periph_ccbwait(ccb); 1296 } 1297 if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP) 1298 error = 0; 1299 else if (error_routine != NULL) { 1300 ccb->ccb_h.cbfcnp = cam_periph_done; 1301 error = (*error_routine)(ccb, camflags, sense_flags); 1302 } else 1303 error = 0; 1304 } while (error == ERESTART); 1305 } 1306 1307 if ((ccb->ccb_h.status & CAM_DEV_QFRZN) != 0) { 1308 cam_release_devq(ccb->ccb_h.path, 1309 /* relsim_flags */0, 1310 /* openings */0, 1311 /* timeout */0, 1312 /* getcount_only */ FALSE); 1313 ccb->ccb_h.status &= ~CAM_DEV_QFRZN; 1314 } 1315 1316 if (ds != NULL) { 1317 uint32_t bytes; 1318 devstat_tag_type tag; 1319 bool valid = true; 1320 1321 if (ccb->ccb_h.func_code == XPT_SCSI_IO) { 1322 bytes = ccb->csio.dxfer_len - ccb->csio.resid; 1323 tag = (devstat_tag_type)(ccb->csio.tag_action & 0x3); 1324 } else if (ccb->ccb_h.func_code == XPT_ATA_IO) { 1325 bytes = ccb->ataio.dxfer_len - ccb->ataio.resid; 1326 tag = (devstat_tag_type)0; 1327 } else if (ccb->ccb_h.func_code == XPT_NVME_IO) { 1328 bytes = ccb->nvmeio.dxfer_len; /* NB: resid no possible */ 1329 tag = (devstat_tag_type)0; 1330 } else { 1331 valid = false; 1332 } 1333 if (valid) 1334 devstat_end_transaction(ds, bytes, tag, 1335 ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_NONE) ? 1336 DEVSTAT_NO_DATA : (ccb->ccb_h.flags & CAM_DIR_OUT) ? 1337 DEVSTAT_WRITE : DEVSTAT_READ, NULL, starttime); 1338 } 1339 1340 return(error); 1341 } 1342 1343 void 1344 cam_freeze_devq(struct cam_path *path) 1345 { 1346 struct ccb_hdr ccb_h; 1347 1348 CAM_DEBUG(path, CAM_DEBUG_TRACE, ("cam_freeze_devq\n")); 1349 xpt_setup_ccb(&ccb_h, path, /*priority*/1); 1350 ccb_h.func_code = XPT_NOOP; 1351 ccb_h.flags = CAM_DEV_QFREEZE; 1352 xpt_action((union ccb *)&ccb_h); 1353 } 1354 1355 u_int32_t 1356 cam_release_devq(struct cam_path *path, u_int32_t relsim_flags, 1357 u_int32_t openings, u_int32_t arg, 1358 int getcount_only) 1359 { 1360 struct ccb_relsim crs; 1361 1362 CAM_DEBUG(path, CAM_DEBUG_TRACE, ("cam_release_devq(%u, %u, %u, %d)\n", 1363 relsim_flags, openings, arg, getcount_only)); 1364 xpt_setup_ccb(&crs.ccb_h, path, CAM_PRIORITY_NORMAL); 1365 crs.ccb_h.func_code = XPT_REL_SIMQ; 1366 crs.ccb_h.flags = getcount_only ? CAM_DEV_QFREEZE : 0; 1367 crs.release_flags = relsim_flags; 1368 crs.openings = openings; 1369 crs.release_timeout = arg; 1370 xpt_action((union ccb *)&crs); 1371 return (crs.qfrozen_cnt); 1372 } 1373 1374 #define saved_ccb_ptr ppriv_ptr0 1375 static void 1376 camperiphdone(struct cam_periph *periph, union ccb *done_ccb) 1377 { 1378 union ccb *saved_ccb; 1379 cam_status status; 1380 struct scsi_start_stop_unit *scsi_cmd; 1381 int error = 0, error_code, sense_key, asc, ascq; 1382 1383 scsi_cmd = (struct scsi_start_stop_unit *) 1384 &done_ccb->csio.cdb_io.cdb_bytes; 1385 status = done_ccb->ccb_h.status; 1386 1387 if ((status & CAM_STATUS_MASK) != CAM_REQ_CMP) { 1388 if (scsi_extract_sense_ccb(done_ccb, 1389 &error_code, &sense_key, &asc, &ascq)) { 1390 /* 1391 * If the error is "invalid field in CDB", 1392 * and the load/eject flag is set, turn the 1393 * flag off and try again. This is just in 1394 * case the drive in question barfs on the 1395 * load eject flag. The CAM code should set 1396 * the load/eject flag by default for 1397 * removable media. 1398 */ 1399 if ((scsi_cmd->opcode == START_STOP_UNIT) && 1400 ((scsi_cmd->how & SSS_LOEJ) != 0) && 1401 (asc == 0x24) && (ascq == 0x00)) { 1402 scsi_cmd->how &= ~SSS_LOEJ; 1403 if (status & CAM_DEV_QFRZN) { 1404 cam_release_devq(done_ccb->ccb_h.path, 1405 0, 0, 0, 0); 1406 done_ccb->ccb_h.status &= 1407 ~CAM_DEV_QFRZN; 1408 } 1409 xpt_action(done_ccb); 1410 goto out; 1411 } 1412 } 1413 error = cam_periph_error(done_ccb, 0, 1414 SF_RETRY_UA | SF_NO_PRINT); 1415 if (error == ERESTART) 1416 goto out; 1417 if (done_ccb->ccb_h.status & CAM_DEV_QFRZN) { 1418 cam_release_devq(done_ccb->ccb_h.path, 0, 0, 0, 0); 1419 done_ccb->ccb_h.status &= ~CAM_DEV_QFRZN; 1420 } 1421 } else { 1422 /* 1423 * If we have successfully taken a device from the not 1424 * ready to ready state, re-scan the device and re-get 1425 * the inquiry information. Many devices (mostly disks) 1426 * don't properly report their inquiry information unless 1427 * they are spun up. 1428 */ 1429 if (scsi_cmd->opcode == START_STOP_UNIT) 1430 xpt_async(AC_INQ_CHANGED, done_ccb->ccb_h.path, NULL); 1431 } 1432 1433 /* If we tried long wait and still failed, remember that. */ 1434 if ((periph->flags & CAM_PERIPH_RECOVERY_WAIT) && 1435 (done_ccb->csio.cdb_io.cdb_bytes[0] == TEST_UNIT_READY)) { 1436 periph->flags &= ~CAM_PERIPH_RECOVERY_WAIT; 1437 if (error != 0 && done_ccb->ccb_h.retry_count == 0) 1438 periph->flags |= CAM_PERIPH_RECOVERY_WAIT_FAILED; 1439 } 1440 1441 /* 1442 * After recovery action(s) completed, return to the original CCB. 1443 * If the recovery CCB has failed, considering its own possible 1444 * retries and recovery, assume we are back in state where we have 1445 * been originally, but without recovery hopes left. In such case, 1446 * after the final attempt below, we cancel any further retries, 1447 * blocking by that also any new recovery attempts for this CCB, 1448 * and the result will be the final one returned to the CCB owher. 1449 */ 1450 saved_ccb = (union ccb *)done_ccb->ccb_h.saved_ccb_ptr; 1451 bcopy(saved_ccb, done_ccb, sizeof(*done_ccb)); 1452 xpt_free_ccb(saved_ccb); 1453 if (done_ccb->ccb_h.cbfcnp != camperiphdone) 1454 periph->flags &= ~CAM_PERIPH_RECOVERY_INPROG; 1455 if (error != 0) 1456 done_ccb->ccb_h.retry_count = 0; 1457 xpt_action(done_ccb); 1458 1459 out: 1460 /* Drop freeze taken due to CAM_DEV_QFREEZE flag set. */ 1461 cam_release_devq(done_ccb->ccb_h.path, 0, 0, 0, 0); 1462 } 1463 1464 /* 1465 * Generic Async Event handler. Peripheral drivers usually 1466 * filter out the events that require personal attention, 1467 * and leave the rest to this function. 1468 */ 1469 void 1470 cam_periph_async(struct cam_periph *periph, u_int32_t code, 1471 struct cam_path *path, void *arg) 1472 { 1473 switch (code) { 1474 case AC_LOST_DEVICE: 1475 cam_periph_invalidate(periph); 1476 break; 1477 default: 1478 break; 1479 } 1480 } 1481 1482 void 1483 cam_periph_bus_settle(struct cam_periph *periph, u_int bus_settle) 1484 { 1485 struct ccb_getdevstats cgds; 1486 1487 xpt_setup_ccb(&cgds.ccb_h, periph->path, CAM_PRIORITY_NORMAL); 1488 cgds.ccb_h.func_code = XPT_GDEV_STATS; 1489 xpt_action((union ccb *)&cgds); 1490 cam_periph_freeze_after_event(periph, &cgds.last_reset, bus_settle); 1491 } 1492 1493 void 1494 cam_periph_freeze_after_event(struct cam_periph *periph, 1495 struct timeval* event_time, u_int duration_ms) 1496 { 1497 struct timeval delta; 1498 struct timeval duration_tv; 1499 1500 if (!timevalisset(event_time)) 1501 return; 1502 1503 microtime(&delta); 1504 timevalsub(&delta, event_time); 1505 duration_tv.tv_sec = duration_ms / 1000; 1506 duration_tv.tv_usec = (duration_ms % 1000) * 1000; 1507 if (timevalcmp(&delta, &duration_tv, <)) { 1508 timevalsub(&duration_tv, &delta); 1509 1510 duration_ms = duration_tv.tv_sec * 1000; 1511 duration_ms += duration_tv.tv_usec / 1000; 1512 cam_freeze_devq(periph->path); 1513 cam_release_devq(periph->path, 1514 RELSIM_RELEASE_AFTER_TIMEOUT, 1515 /*reduction*/0, 1516 /*timeout*/duration_ms, 1517 /*getcount_only*/0); 1518 } 1519 1520 } 1521 1522 static int 1523 camperiphscsistatuserror(union ccb *ccb, union ccb **orig_ccb, 1524 cam_flags camflags, u_int32_t sense_flags, 1525 int *openings, u_int32_t *relsim_flags, 1526 u_int32_t *timeout, u_int32_t *action, const char **action_string) 1527 { 1528 struct cam_periph *periph; 1529 int error; 1530 1531 switch (ccb->csio.scsi_status) { 1532 case SCSI_STATUS_OK: 1533 case SCSI_STATUS_COND_MET: 1534 case SCSI_STATUS_INTERMED: 1535 case SCSI_STATUS_INTERMED_COND_MET: 1536 error = 0; 1537 break; 1538 case SCSI_STATUS_CMD_TERMINATED: 1539 case SCSI_STATUS_CHECK_COND: 1540 error = camperiphscsisenseerror(ccb, orig_ccb, 1541 camflags, 1542 sense_flags, 1543 openings, 1544 relsim_flags, 1545 timeout, 1546 action, 1547 action_string); 1548 break; 1549 case SCSI_STATUS_QUEUE_FULL: 1550 { 1551 /* no decrement */ 1552 struct ccb_getdevstats cgds; 1553 1554 /* 1555 * First off, find out what the current 1556 * transaction counts are. 1557 */ 1558 xpt_setup_ccb(&cgds.ccb_h, 1559 ccb->ccb_h.path, 1560 CAM_PRIORITY_NORMAL); 1561 cgds.ccb_h.func_code = XPT_GDEV_STATS; 1562 xpt_action((union ccb *)&cgds); 1563 1564 /* 1565 * If we were the only transaction active, treat 1566 * the QUEUE FULL as if it were a BUSY condition. 1567 */ 1568 if (cgds.dev_active != 0) { 1569 int total_openings; 1570 1571 /* 1572 * Reduce the number of openings to 1573 * be 1 less than the amount it took 1574 * to get a queue full bounded by the 1575 * minimum allowed tag count for this 1576 * device. 1577 */ 1578 total_openings = cgds.dev_active + cgds.dev_openings; 1579 *openings = cgds.dev_active; 1580 if (*openings < cgds.mintags) 1581 *openings = cgds.mintags; 1582 if (*openings < total_openings) 1583 *relsim_flags = RELSIM_ADJUST_OPENINGS; 1584 else { 1585 /* 1586 * Some devices report queue full for 1587 * temporary resource shortages. For 1588 * this reason, we allow a minimum 1589 * tag count to be entered via a 1590 * quirk entry to prevent the queue 1591 * count on these devices from falling 1592 * to a pessimisticly low value. We 1593 * still wait for the next successful 1594 * completion, however, before queueing 1595 * more transactions to the device. 1596 */ 1597 *relsim_flags = RELSIM_RELEASE_AFTER_CMDCMPLT; 1598 } 1599 *timeout = 0; 1600 error = ERESTART; 1601 *action &= ~SSQ_PRINT_SENSE; 1602 break; 1603 } 1604 /* FALLTHROUGH */ 1605 } 1606 case SCSI_STATUS_BUSY: 1607 /* 1608 * Restart the queue after either another 1609 * command completes or a 1 second timeout. 1610 */ 1611 periph = xpt_path_periph(ccb->ccb_h.path); 1612 if (periph->flags & CAM_PERIPH_INVALID) { 1613 error = EIO; 1614 *action_string = "Periph was invalidated"; 1615 } else if ((sense_flags & SF_RETRY_BUSY) != 0 || 1616 ccb->ccb_h.retry_count > 0) { 1617 if ((sense_flags & SF_RETRY_BUSY) == 0) 1618 ccb->ccb_h.retry_count--; 1619 error = ERESTART; 1620 *relsim_flags = RELSIM_RELEASE_AFTER_TIMEOUT 1621 | RELSIM_RELEASE_AFTER_CMDCMPLT; 1622 *timeout = 1000; 1623 } else { 1624 error = EIO; 1625 *action_string = "Retries exhausted"; 1626 } 1627 break; 1628 case SCSI_STATUS_RESERV_CONFLICT: 1629 default: 1630 error = EIO; 1631 break; 1632 } 1633 return (error); 1634 } 1635 1636 static int 1637 camperiphscsisenseerror(union ccb *ccb, union ccb **orig, 1638 cam_flags camflags, u_int32_t sense_flags, 1639 int *openings, u_int32_t *relsim_flags, 1640 u_int32_t *timeout, u_int32_t *action, const char **action_string) 1641 { 1642 struct cam_periph *periph; 1643 union ccb *orig_ccb = ccb; 1644 int error, recoveryccb; 1645 1646 #if defined(BUF_TRACKING) || defined(FULL_BUF_TRACKING) 1647 if (ccb->ccb_h.func_code == XPT_SCSI_IO && ccb->csio.bio != NULL) 1648 biotrack(ccb->csio.bio, __func__); 1649 #endif 1650 1651 periph = xpt_path_periph(ccb->ccb_h.path); 1652 recoveryccb = (ccb->ccb_h.cbfcnp == camperiphdone); 1653 if ((periph->flags & CAM_PERIPH_RECOVERY_INPROG) && !recoveryccb) { 1654 /* 1655 * If error recovery is already in progress, don't attempt 1656 * to process this error, but requeue it unconditionally 1657 * and attempt to process it once error recovery has 1658 * completed. This failed command is probably related to 1659 * the error that caused the currently active error recovery 1660 * action so our current recovery efforts should also 1661 * address this command. Be aware that the error recovery 1662 * code assumes that only one recovery action is in progress 1663 * on a particular peripheral instance at any given time 1664 * (e.g. only one saved CCB for error recovery) so it is 1665 * imperitive that we don't violate this assumption. 1666 */ 1667 error = ERESTART; 1668 *action &= ~SSQ_PRINT_SENSE; 1669 } else { 1670 scsi_sense_action err_action; 1671 struct ccb_getdev cgd; 1672 1673 /* 1674 * Grab the inquiry data for this device. 1675 */ 1676 xpt_setup_ccb(&cgd.ccb_h, ccb->ccb_h.path, CAM_PRIORITY_NORMAL); 1677 cgd.ccb_h.func_code = XPT_GDEV_TYPE; 1678 xpt_action((union ccb *)&cgd); 1679 1680 err_action = scsi_error_action(&ccb->csio, &cgd.inq_data, 1681 sense_flags); 1682 error = err_action & SS_ERRMASK; 1683 1684 /* 1685 * Do not autostart sequential access devices 1686 * to avoid unexpected tape loading. 1687 */ 1688 if ((err_action & SS_MASK) == SS_START && 1689 SID_TYPE(&cgd.inq_data) == T_SEQUENTIAL) { 1690 *action_string = "Will not autostart a " 1691 "sequential access device"; 1692 goto sense_error_done; 1693 } 1694 1695 /* 1696 * Avoid recovery recursion if recovery action is the same. 1697 */ 1698 if ((err_action & SS_MASK) >= SS_START && recoveryccb) { 1699 if (((err_action & SS_MASK) == SS_START && 1700 ccb->csio.cdb_io.cdb_bytes[0] == START_STOP_UNIT) || 1701 ((err_action & SS_MASK) == SS_TUR && 1702 (ccb->csio.cdb_io.cdb_bytes[0] == TEST_UNIT_READY))) { 1703 err_action = SS_RETRY|SSQ_DECREMENT_COUNT|EIO; 1704 *relsim_flags = RELSIM_RELEASE_AFTER_TIMEOUT; 1705 *timeout = 500; 1706 } 1707 } 1708 1709 /* 1710 * If the recovery action will consume a retry, 1711 * make sure we actually have retries available. 1712 */ 1713 if ((err_action & SSQ_DECREMENT_COUNT) != 0) { 1714 if (ccb->ccb_h.retry_count > 0 && 1715 (periph->flags & CAM_PERIPH_INVALID) == 0) 1716 ccb->ccb_h.retry_count--; 1717 else { 1718 *action_string = "Retries exhausted"; 1719 goto sense_error_done; 1720 } 1721 } 1722 1723 if ((err_action & SS_MASK) >= SS_START) { 1724 /* 1725 * Do common portions of commands that 1726 * use recovery CCBs. 1727 */ 1728 orig_ccb = xpt_alloc_ccb_nowait(); 1729 if (orig_ccb == NULL) { 1730 *action_string = "Can't allocate recovery CCB"; 1731 goto sense_error_done; 1732 } 1733 /* 1734 * Clear freeze flag for original request here, as 1735 * this freeze will be dropped as part of ERESTART. 1736 */ 1737 ccb->ccb_h.status &= ~CAM_DEV_QFRZN; 1738 bcopy(ccb, orig_ccb, sizeof(*orig_ccb)); 1739 } 1740 1741 switch (err_action & SS_MASK) { 1742 case SS_NOP: 1743 *action_string = "No recovery action needed"; 1744 error = 0; 1745 break; 1746 case SS_RETRY: 1747 *action_string = "Retrying command (per sense data)"; 1748 error = ERESTART; 1749 break; 1750 case SS_FAIL: 1751 *action_string = "Unretryable error"; 1752 break; 1753 case SS_START: 1754 { 1755 int le; 1756 1757 /* 1758 * Send a start unit command to the device, and 1759 * then retry the command. 1760 */ 1761 *action_string = "Attempting to start unit"; 1762 periph->flags |= CAM_PERIPH_RECOVERY_INPROG; 1763 1764 /* 1765 * Check for removable media and set 1766 * load/eject flag appropriately. 1767 */ 1768 if (SID_IS_REMOVABLE(&cgd.inq_data)) 1769 le = TRUE; 1770 else 1771 le = FALSE; 1772 1773 scsi_start_stop(&ccb->csio, 1774 /*retries*/1, 1775 camperiphdone, 1776 MSG_SIMPLE_Q_TAG, 1777 /*start*/TRUE, 1778 /*load/eject*/le, 1779 /*immediate*/FALSE, 1780 SSD_FULL_SIZE, 1781 /*timeout*/50000); 1782 break; 1783 } 1784 case SS_TUR: 1785 { 1786 /* 1787 * Send a Test Unit Ready to the device. 1788 * If the 'many' flag is set, we send 120 1789 * test unit ready commands, one every half 1790 * second. Otherwise, we just send one TUR. 1791 * We only want to do this if the retry 1792 * count has not been exhausted. 1793 */ 1794 int retries; 1795 1796 if ((err_action & SSQ_MANY) != 0 && (periph->flags & 1797 CAM_PERIPH_RECOVERY_WAIT_FAILED) == 0) { 1798 periph->flags |= CAM_PERIPH_RECOVERY_WAIT; 1799 *action_string = "Polling device for readiness"; 1800 retries = 120; 1801 } else { 1802 *action_string = "Testing device for readiness"; 1803 retries = 1; 1804 } 1805 periph->flags |= CAM_PERIPH_RECOVERY_INPROG; 1806 scsi_test_unit_ready(&ccb->csio, 1807 retries, 1808 camperiphdone, 1809 MSG_SIMPLE_Q_TAG, 1810 SSD_FULL_SIZE, 1811 /*timeout*/5000); 1812 1813 /* 1814 * Accomplish our 500ms delay by deferring 1815 * the release of our device queue appropriately. 1816 */ 1817 *relsim_flags = RELSIM_RELEASE_AFTER_TIMEOUT; 1818 *timeout = 500; 1819 break; 1820 } 1821 default: 1822 panic("Unhandled error action %x", err_action); 1823 } 1824 1825 if ((err_action & SS_MASK) >= SS_START) { 1826 /* 1827 * Drop the priority, so that the recovery 1828 * CCB is the first to execute. Freeze the queue 1829 * after this command is sent so that we can 1830 * restore the old csio and have it queued in 1831 * the proper order before we release normal 1832 * transactions to the device. 1833 */ 1834 ccb->ccb_h.pinfo.priority--; 1835 ccb->ccb_h.flags |= CAM_DEV_QFREEZE; 1836 ccb->ccb_h.saved_ccb_ptr = orig_ccb; 1837 error = ERESTART; 1838 *orig = orig_ccb; 1839 } 1840 1841 sense_error_done: 1842 *action = err_action; 1843 } 1844 return (error); 1845 } 1846 1847 /* 1848 * Generic error handler. Peripheral drivers usually filter 1849 * out the errors that they handle in a unique manner, then 1850 * call this function. 1851 */ 1852 int 1853 cam_periph_error(union ccb *ccb, cam_flags camflags, 1854 u_int32_t sense_flags) 1855 { 1856 struct cam_path *newpath; 1857 union ccb *orig_ccb, *scan_ccb; 1858 struct cam_periph *periph; 1859 const char *action_string; 1860 cam_status status; 1861 int frozen, error, openings, devctl_err; 1862 u_int32_t action, relsim_flags, timeout; 1863 1864 action = SSQ_PRINT_SENSE; 1865 periph = xpt_path_periph(ccb->ccb_h.path); 1866 action_string = NULL; 1867 status = ccb->ccb_h.status; 1868 frozen = (status & CAM_DEV_QFRZN) != 0; 1869 status &= CAM_STATUS_MASK; 1870 devctl_err = openings = relsim_flags = timeout = 0; 1871 orig_ccb = ccb; 1872 1873 /* Filter the errors that should be reported via devctl */ 1874 switch (ccb->ccb_h.status & CAM_STATUS_MASK) { 1875 case CAM_CMD_TIMEOUT: 1876 case CAM_REQ_ABORTED: 1877 case CAM_REQ_CMP_ERR: 1878 case CAM_REQ_TERMIO: 1879 case CAM_UNREC_HBA_ERROR: 1880 case CAM_DATA_RUN_ERR: 1881 case CAM_SCSI_STATUS_ERROR: 1882 case CAM_ATA_STATUS_ERROR: 1883 case CAM_SMP_STATUS_ERROR: 1884 devctl_err++; 1885 break; 1886 default: 1887 break; 1888 } 1889 1890 switch (status) { 1891 case CAM_REQ_CMP: 1892 error = 0; 1893 action &= ~SSQ_PRINT_SENSE; 1894 break; 1895 case CAM_SCSI_STATUS_ERROR: 1896 error = camperiphscsistatuserror(ccb, &orig_ccb, 1897 camflags, sense_flags, &openings, &relsim_flags, 1898 &timeout, &action, &action_string); 1899 break; 1900 case CAM_AUTOSENSE_FAIL: 1901 error = EIO; /* we have to kill the command */ 1902 break; 1903 case CAM_UA_ABORT: 1904 case CAM_UA_TERMIO: 1905 case CAM_MSG_REJECT_REC: 1906 /* XXX Don't know that these are correct */ 1907 error = EIO; 1908 break; 1909 case CAM_SEL_TIMEOUT: 1910 if ((camflags & CAM_RETRY_SELTO) != 0) { 1911 if (ccb->ccb_h.retry_count > 0 && 1912 (periph->flags & CAM_PERIPH_INVALID) == 0) { 1913 ccb->ccb_h.retry_count--; 1914 error = ERESTART; 1915 1916 /* 1917 * Wait a bit to give the device 1918 * time to recover before we try again. 1919 */ 1920 relsim_flags = RELSIM_RELEASE_AFTER_TIMEOUT; 1921 timeout = periph_selto_delay; 1922 break; 1923 } 1924 action_string = "Retries exhausted"; 1925 } 1926 /* FALLTHROUGH */ 1927 case CAM_DEV_NOT_THERE: 1928 error = ENXIO; 1929 action = SSQ_LOST; 1930 break; 1931 case CAM_REQ_INVALID: 1932 case CAM_PATH_INVALID: 1933 case CAM_NO_HBA: 1934 case CAM_PROVIDE_FAIL: 1935 case CAM_REQ_TOO_BIG: 1936 case CAM_LUN_INVALID: 1937 case CAM_TID_INVALID: 1938 case CAM_FUNC_NOTAVAIL: 1939 error = EINVAL; 1940 break; 1941 case CAM_SCSI_BUS_RESET: 1942 case CAM_BDR_SENT: 1943 /* 1944 * Commands that repeatedly timeout and cause these 1945 * kinds of error recovery actions, should return 1946 * CAM_CMD_TIMEOUT, which allows us to safely assume 1947 * that this command was an innocent bystander to 1948 * these events and should be unconditionally 1949 * retried. 1950 */ 1951 case CAM_REQUEUE_REQ: 1952 /* Unconditional requeue if device is still there */ 1953 if (periph->flags & CAM_PERIPH_INVALID) { 1954 action_string = "Periph was invalidated"; 1955 error = EIO; 1956 } else if (sense_flags & SF_NO_RETRY) { 1957 error = EIO; 1958 action_string = "Retry was blocked"; 1959 } else { 1960 error = ERESTART; 1961 action &= ~SSQ_PRINT_SENSE; 1962 } 1963 break; 1964 case CAM_RESRC_UNAVAIL: 1965 /* Wait a bit for the resource shortage to abate. */ 1966 timeout = periph_noresrc_delay; 1967 /* FALLTHROUGH */ 1968 case CAM_BUSY: 1969 if (timeout == 0) { 1970 /* Wait a bit for the busy condition to abate. */ 1971 timeout = periph_busy_delay; 1972 } 1973 relsim_flags = RELSIM_RELEASE_AFTER_TIMEOUT; 1974 /* FALLTHROUGH */ 1975 case CAM_ATA_STATUS_ERROR: 1976 case CAM_REQ_CMP_ERR: 1977 case CAM_CMD_TIMEOUT: 1978 case CAM_UNEXP_BUSFREE: 1979 case CAM_UNCOR_PARITY: 1980 case CAM_DATA_RUN_ERR: 1981 default: 1982 if (periph->flags & CAM_PERIPH_INVALID) { 1983 error = EIO; 1984 action_string = "Periph was invalidated"; 1985 } else if (ccb->ccb_h.retry_count == 0) { 1986 error = EIO; 1987 action_string = "Retries exhausted"; 1988 } else if (sense_flags & SF_NO_RETRY) { 1989 error = EIO; 1990 action_string = "Retry was blocked"; 1991 } else { 1992 ccb->ccb_h.retry_count--; 1993 error = ERESTART; 1994 } 1995 break; 1996 } 1997 1998 if ((sense_flags & SF_PRINT_ALWAYS) || 1999 CAM_DEBUGGED(ccb->ccb_h.path, CAM_DEBUG_INFO)) 2000 action |= SSQ_PRINT_SENSE; 2001 else if (sense_flags & SF_NO_PRINT) 2002 action &= ~SSQ_PRINT_SENSE; 2003 if ((action & SSQ_PRINT_SENSE) != 0) 2004 cam_error_print(orig_ccb, CAM_ESF_ALL, CAM_EPF_ALL); 2005 if (error != 0 && (action & SSQ_PRINT_SENSE) != 0) { 2006 if (error != ERESTART) { 2007 if (action_string == NULL) 2008 action_string = "Unretryable error"; 2009 xpt_print(ccb->ccb_h.path, "Error %d, %s\n", 2010 error, action_string); 2011 } else if (action_string != NULL) 2012 xpt_print(ccb->ccb_h.path, "%s\n", action_string); 2013 else { 2014 xpt_print(ccb->ccb_h.path, 2015 "Retrying command, %d more tries remain\n", 2016 ccb->ccb_h.retry_count); 2017 } 2018 } 2019 2020 if (devctl_err && (error != 0 || (action & SSQ_PRINT_SENSE) != 0)) 2021 cam_periph_devctl_notify(orig_ccb); 2022 2023 if ((action & SSQ_LOST) != 0) { 2024 lun_id_t lun_id; 2025 2026 /* 2027 * For a selection timeout, we consider all of the LUNs on 2028 * the target to be gone. If the status is CAM_DEV_NOT_THERE, 2029 * then we only get rid of the device(s) specified by the 2030 * path in the original CCB. 2031 */ 2032 if (status == CAM_SEL_TIMEOUT) 2033 lun_id = CAM_LUN_WILDCARD; 2034 else 2035 lun_id = xpt_path_lun_id(ccb->ccb_h.path); 2036 2037 /* Should we do more if we can't create the path?? */ 2038 if (xpt_create_path(&newpath, periph, 2039 xpt_path_path_id(ccb->ccb_h.path), 2040 xpt_path_target_id(ccb->ccb_h.path), 2041 lun_id) == CAM_REQ_CMP) { 2042 2043 /* 2044 * Let peripheral drivers know that this 2045 * device has gone away. 2046 */ 2047 xpt_async(AC_LOST_DEVICE, newpath, NULL); 2048 xpt_free_path(newpath); 2049 } 2050 } 2051 2052 /* Broadcast UNIT ATTENTIONs to all periphs. */ 2053 if ((action & SSQ_UA) != 0) 2054 xpt_async(AC_UNIT_ATTENTION, orig_ccb->ccb_h.path, orig_ccb); 2055 2056 /* Rescan target on "Reported LUNs data has changed" */ 2057 if ((action & SSQ_RESCAN) != 0) { 2058 if (xpt_create_path(&newpath, NULL, 2059 xpt_path_path_id(ccb->ccb_h.path), 2060 xpt_path_target_id(ccb->ccb_h.path), 2061 CAM_LUN_WILDCARD) == CAM_REQ_CMP) { 2062 2063 scan_ccb = xpt_alloc_ccb_nowait(); 2064 if (scan_ccb != NULL) { 2065 scan_ccb->ccb_h.path = newpath; 2066 scan_ccb->ccb_h.func_code = XPT_SCAN_TGT; 2067 scan_ccb->crcn.flags = 0; 2068 xpt_rescan(scan_ccb); 2069 } else { 2070 xpt_print(newpath, 2071 "Can't allocate CCB to rescan target\n"); 2072 xpt_free_path(newpath); 2073 } 2074 } 2075 } 2076 2077 /* Attempt a retry */ 2078 if (error == ERESTART || error == 0) { 2079 if (frozen != 0) 2080 ccb->ccb_h.status &= ~CAM_DEV_QFRZN; 2081 if (error == ERESTART) 2082 xpt_action(ccb); 2083 if (frozen != 0) 2084 cam_release_devq(ccb->ccb_h.path, 2085 relsim_flags, 2086 openings, 2087 timeout, 2088 /*getcount_only*/0); 2089 } 2090 2091 return (error); 2092 } 2093 2094 #define CAM_PERIPH_DEVD_MSG_SIZE 256 2095 2096 static void 2097 cam_periph_devctl_notify(union ccb *ccb) 2098 { 2099 struct cam_periph *periph; 2100 struct ccb_getdev *cgd; 2101 struct sbuf sb; 2102 int serr, sk, asc, ascq; 2103 char *sbmsg, *type; 2104 2105 sbmsg = malloc(CAM_PERIPH_DEVD_MSG_SIZE, M_CAMPERIPH, M_NOWAIT); 2106 if (sbmsg == NULL) 2107 return; 2108 2109 sbuf_new(&sb, sbmsg, CAM_PERIPH_DEVD_MSG_SIZE, SBUF_FIXEDLEN); 2110 2111 periph = xpt_path_periph(ccb->ccb_h.path); 2112 sbuf_printf(&sb, "device=%s%d ", periph->periph_name, 2113 periph->unit_number); 2114 2115 sbuf_printf(&sb, "serial=\""); 2116 if ((cgd = (struct ccb_getdev *)xpt_alloc_ccb_nowait()) != NULL) { 2117 xpt_setup_ccb(&cgd->ccb_h, ccb->ccb_h.path, 2118 CAM_PRIORITY_NORMAL); 2119 cgd->ccb_h.func_code = XPT_GDEV_TYPE; 2120 xpt_action((union ccb *)cgd); 2121 2122 if (cgd->ccb_h.status == CAM_REQ_CMP) 2123 sbuf_bcat(&sb, cgd->serial_num, cgd->serial_num_len); 2124 xpt_free_ccb((union ccb *)cgd); 2125 } 2126 sbuf_printf(&sb, "\" "); 2127 sbuf_printf(&sb, "cam_status=\"0x%x\" ", ccb->ccb_h.status); 2128 2129 switch (ccb->ccb_h.status & CAM_STATUS_MASK) { 2130 case CAM_CMD_TIMEOUT: 2131 sbuf_printf(&sb, "timeout=%d ", ccb->ccb_h.timeout); 2132 type = "timeout"; 2133 break; 2134 case CAM_SCSI_STATUS_ERROR: 2135 sbuf_printf(&sb, "scsi_status=%d ", ccb->csio.scsi_status); 2136 if (scsi_extract_sense_ccb(ccb, &serr, &sk, &asc, &ascq)) 2137 sbuf_printf(&sb, "scsi_sense=\"%02x %02x %02x %02x\" ", 2138 serr, sk, asc, ascq); 2139 type = "error"; 2140 break; 2141 case CAM_ATA_STATUS_ERROR: 2142 sbuf_printf(&sb, "RES=\""); 2143 ata_res_sbuf(&ccb->ataio.res, &sb); 2144 sbuf_printf(&sb, "\" "); 2145 type = "error"; 2146 break; 2147 default: 2148 type = "error"; 2149 break; 2150 } 2151 2152 if (ccb->ccb_h.func_code == XPT_SCSI_IO) { 2153 sbuf_printf(&sb, "CDB=\""); 2154 scsi_cdb_sbuf(scsiio_cdb_ptr(&ccb->csio), &sb); 2155 sbuf_printf(&sb, "\" "); 2156 } else if (ccb->ccb_h.func_code == XPT_ATA_IO) { 2157 sbuf_printf(&sb, "ACB=\""); 2158 ata_cmd_sbuf(&ccb->ataio.cmd, &sb); 2159 sbuf_printf(&sb, "\" "); 2160 } 2161 2162 if (sbuf_finish(&sb) == 0) 2163 devctl_notify("CAM", "periph", type, sbuf_data(&sb)); 2164 sbuf_delete(&sb); 2165 free(sbmsg, M_CAMPERIPH); 2166 } 2167 2168 /* 2169 * Sysctl to force an invalidation of the drive right now. Can be 2170 * called with CTLFLAG_MPSAFE since we take periph lock. 2171 */ 2172 int 2173 cam_periph_invalidate_sysctl(SYSCTL_HANDLER_ARGS) 2174 { 2175 struct cam_periph *periph; 2176 int error, value; 2177 2178 periph = arg1; 2179 value = 0; 2180 error = sysctl_handle_int(oidp, &value, 0, req); 2181 if (error != 0 || req->newptr == NULL || value != 1) 2182 return (error); 2183 2184 cam_periph_lock(periph); 2185 cam_periph_invalidate(periph); 2186 cam_periph_unlock(periph); 2187 2188 return (0); 2189 } 2190