1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2007 Scott Long 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions, and the following disclaimer, 12 * without modification, immediately at the beginning of the file. 13 * 2. The name of the author may not be used to endorse or promote products 14 * derived from this software without specific prior written permission. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 20 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /* 30 * scsi_sg peripheral driver. This driver is meant to implement the Linux 31 * SG passthrough interface for SCSI. 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 #include <sys/param.h> 38 #include <sys/systm.h> 39 #include <sys/kernel.h> 40 #include <sys/types.h> 41 #include <sys/bio.h> 42 #include <sys/malloc.h> 43 #include <sys/fcntl.h> 44 #include <sys/ioccom.h> 45 #include <sys/conf.h> 46 #include <sys/errno.h> 47 #include <sys/devicestat.h> 48 #include <sys/proc.h> 49 #include <sys/uio.h> 50 51 #include <cam/cam.h> 52 #include <cam/cam_ccb.h> 53 #include <cam/cam_periph.h> 54 #include <cam/cam_queue.h> 55 #include <cam/cam_xpt_periph.h> 56 #include <cam/cam_debug.h> 57 #include <cam/cam_sim.h> 58 59 #include <cam/scsi/scsi_all.h> 60 #include <cam/scsi/scsi_message.h> 61 #include <cam/scsi/scsi_sg.h> 62 63 #include <compat/linux/linux_ioctl.h> 64 65 typedef enum { 66 SG_FLAG_LOCKED = 0x01, 67 SG_FLAG_INVALID = 0x02 68 } sg_flags; 69 70 typedef enum { 71 SG_STATE_NORMAL 72 } sg_state; 73 74 typedef enum { 75 SG_RDWR_FREE, 76 SG_RDWR_INPROG, 77 SG_RDWR_DONE 78 } sg_rdwr_state; 79 80 typedef enum { 81 SG_CCB_RDWR_IO 82 } sg_ccb_types; 83 84 #define ccb_type ppriv_field0 85 #define ccb_rdwr ppriv_ptr1 86 87 struct sg_rdwr { 88 TAILQ_ENTRY(sg_rdwr) rdwr_link; 89 int tag; 90 int state; 91 int buf_len; 92 char *buf; 93 union ccb *ccb; 94 union { 95 struct sg_header hdr; 96 struct sg_io_hdr io_hdr; 97 } hdr; 98 }; 99 100 struct sg_softc { 101 sg_state state; 102 sg_flags flags; 103 int open_count; 104 u_int maxio; 105 struct devstat *device_stats; 106 TAILQ_HEAD(, sg_rdwr) rdwr_done; 107 struct cdev *dev; 108 int sg_timeout; 109 int sg_user_timeout; 110 uint8_t pd_type; 111 union ccb saved_ccb; 112 }; 113 114 static d_open_t sgopen; 115 static d_close_t sgclose; 116 static d_ioctl_t sgioctl; 117 static d_write_t sgwrite; 118 static d_read_t sgread; 119 120 static periph_init_t sginit; 121 static periph_ctor_t sgregister; 122 static periph_oninv_t sgoninvalidate; 123 static periph_dtor_t sgcleanup; 124 static void sgasync(void *callback_arg, uint32_t code, 125 struct cam_path *path, void *arg); 126 static void sgdone(struct cam_periph *periph, union ccb *done_ccb); 127 static int sgsendccb(struct cam_periph *periph, union ccb *ccb); 128 static int sgsendrdwr(struct cam_periph *periph, union ccb *ccb); 129 static int sgerror(union ccb *ccb, uint32_t cam_flags, 130 uint32_t sense_flags); 131 static void sg_scsiio_status(struct ccb_scsiio *csio, 132 u_short *hoststat, u_short *drvstat); 133 134 static int scsi_group_len(u_char cmd); 135 136 static struct periph_driver sgdriver = 137 { 138 sginit, "sg", 139 TAILQ_HEAD_INITIALIZER(sgdriver.units), /* gen */ 0 140 }; 141 PERIPHDRIVER_DECLARE(sg, sgdriver); 142 143 static struct cdevsw sg_cdevsw = { 144 .d_version = D_VERSION, 145 .d_flags = D_TRACKCLOSE, 146 .d_open = sgopen, 147 .d_close = sgclose, 148 .d_ioctl = sgioctl, 149 .d_write = sgwrite, 150 .d_read = sgread, 151 .d_name = "sg", 152 }; 153 154 static int sg_version = 30125; 155 156 static void 157 sginit(void) 158 { 159 cam_status status; 160 161 /* 162 * Install a global async callback. This callback will receive aync 163 * callbacks like "new device found". 164 */ 165 status = xpt_register_async(AC_FOUND_DEVICE, sgasync, NULL, NULL); 166 167 if (status != CAM_REQ_CMP) { 168 printf("sg: Failed to attach master async callbac " 169 "due to status 0x%x!\n", status); 170 } 171 } 172 173 static void 174 sgdevgonecb(void *arg) 175 { 176 struct cam_periph *periph; 177 struct sg_softc *softc; 178 struct mtx *mtx; 179 int i; 180 181 periph = (struct cam_periph *)arg; 182 mtx = cam_periph_mtx(periph); 183 mtx_lock(mtx); 184 185 softc = (struct sg_softc *)periph->softc; 186 KASSERT(softc->open_count >= 0, ("Negative open count %d", 187 softc->open_count)); 188 189 /* 190 * When we get this callback, we will get no more close calls from 191 * devfs. So if we have any dangling opens, we need to release the 192 * reference held for that particular context. 193 */ 194 for (i = 0; i < softc->open_count; i++) 195 cam_periph_release_locked(periph); 196 197 softc->open_count = 0; 198 199 /* 200 * Release the reference held for the device node, it is gone now. 201 */ 202 cam_periph_release_locked(periph); 203 204 /* 205 * We reference the lock directly here, instead of using 206 * cam_periph_unlock(). The reason is that the final call to 207 * cam_periph_release_locked() above could result in the periph 208 * getting freed. If that is the case, dereferencing the periph 209 * with a cam_periph_unlock() call would cause a page fault. 210 */ 211 mtx_unlock(mtx); 212 } 213 214 static void 215 sgoninvalidate(struct cam_periph *periph) 216 { 217 struct sg_softc *softc; 218 219 softc = (struct sg_softc *)periph->softc; 220 221 /* 222 * Deregister any async callbacks. 223 */ 224 xpt_register_async(0, sgasync, periph, periph->path); 225 226 softc->flags |= SG_FLAG_INVALID; 227 228 /* 229 * Tell devfs this device has gone away, and ask for a callback 230 * when it has cleaned up its state. 231 */ 232 destroy_dev_sched_cb(softc->dev, sgdevgonecb, periph); 233 234 /* 235 * XXX Return all queued I/O with ENXIO. 236 * XXX Handle any transactions queued to the card 237 * with XPT_ABORT_CCB. 238 */ 239 240 } 241 242 static void 243 sgcleanup(struct cam_periph *periph) 244 { 245 struct sg_softc *softc; 246 247 softc = (struct sg_softc *)periph->softc; 248 249 devstat_remove_entry(softc->device_stats); 250 251 free(softc, M_DEVBUF); 252 } 253 254 static void 255 sgasync(void *callback_arg, uint32_t code, struct cam_path *path, void *arg) 256 { 257 struct cam_periph *periph; 258 259 periph = (struct cam_periph *)callback_arg; 260 261 switch (code) { 262 case AC_FOUND_DEVICE: 263 { 264 struct ccb_getdev *cgd; 265 cam_status status; 266 267 cgd = (struct ccb_getdev *)arg; 268 if (cgd == NULL) 269 break; 270 271 if (cgd->protocol != PROTO_SCSI) 272 break; 273 274 /* 275 * Allocate a peripheral instance for this device and 276 * start the probe process. 277 */ 278 status = cam_periph_alloc(sgregister, sgoninvalidate, 279 sgcleanup, NULL, "sg", 280 CAM_PERIPH_BIO, path, 281 sgasync, AC_FOUND_DEVICE, cgd); 282 if ((status != CAM_REQ_CMP) && (status != CAM_REQ_INPROG)) { 283 const struct cam_status_entry *entry; 284 285 entry = cam_fetch_status_entry(status); 286 printf("sgasync: Unable to attach new device " 287 "due to status %#x: %s\n", status, entry ? 288 entry->status_text : "Unknown"); 289 } 290 break; 291 } 292 default: 293 cam_periph_async(periph, code, path, arg); 294 break; 295 } 296 } 297 298 static cam_status 299 sgregister(struct cam_periph *periph, void *arg) 300 { 301 struct sg_softc *softc; 302 struct ccb_getdev *cgd; 303 struct ccb_pathinq cpi; 304 struct make_dev_args args; 305 int no_tags, error; 306 307 cgd = (struct ccb_getdev *)arg; 308 if (cgd == NULL) { 309 printf("sgregister: no getdev CCB, can't register device\n"); 310 return (CAM_REQ_CMP_ERR); 311 } 312 313 softc = malloc(sizeof(*softc), M_DEVBUF, M_ZERO | M_NOWAIT); 314 if (softc == NULL) { 315 printf("sgregister: Unable to allocate softc\n"); 316 return (CAM_REQ_CMP_ERR); 317 } 318 319 softc->state = SG_STATE_NORMAL; 320 softc->pd_type = SID_TYPE(&cgd->inq_data); 321 softc->sg_timeout = SG_DEFAULT_TIMEOUT / SG_DEFAULT_HZ * hz; 322 softc->sg_user_timeout = SG_DEFAULT_TIMEOUT; 323 TAILQ_INIT(&softc->rdwr_done); 324 periph->softc = softc; 325 326 xpt_path_inq(&cpi, periph->path); 327 328 if (cpi.maxio == 0) 329 softc->maxio = DFLTPHYS; /* traditional default */ 330 else if (cpi.maxio > MAXPHYS) 331 softc->maxio = MAXPHYS; /* for safety */ 332 else 333 softc->maxio = cpi.maxio; /* real value */ 334 335 /* 336 * We pass in 0 for all blocksize, since we don't know what the 337 * blocksize of the device is, if it even has a blocksize. 338 */ 339 cam_periph_unlock(periph); 340 no_tags = (cgd->inq_data.flags & SID_CmdQue) == 0; 341 softc->device_stats = devstat_new_entry("sg", 342 periph->unit_number, 0, 343 DEVSTAT_NO_BLOCKSIZE 344 | (no_tags ? DEVSTAT_NO_ORDERED_TAGS : 0), 345 softc->pd_type | 346 XPORT_DEVSTAT_TYPE(cpi.transport) | 347 DEVSTAT_TYPE_PASS, 348 DEVSTAT_PRIORITY_PASS); 349 350 /* 351 * Acquire a reference to the periph before we create the devfs 352 * instance for it. We'll release this reference once the devfs 353 * instance has been freed. 354 */ 355 if (cam_periph_acquire(periph) != 0) { 356 xpt_print(periph->path, "%s: lost periph during " 357 "registration!\n", __func__); 358 cam_periph_lock(periph); 359 return (CAM_REQ_CMP_ERR); 360 } 361 362 /* Register the device */ 363 make_dev_args_init(&args); 364 args.mda_devsw = &sg_cdevsw; 365 args.mda_unit = periph->unit_number; 366 args.mda_uid = UID_ROOT; 367 args.mda_gid = GID_OPERATOR; 368 args.mda_mode = 0600; 369 args.mda_si_drv1 = periph; 370 error = make_dev_s(&args, &softc->dev, "%s%d", 371 periph->periph_name, periph->unit_number); 372 if (error != 0) { 373 cam_periph_lock(periph); 374 cam_periph_release_locked(periph); 375 return (CAM_REQ_CMP_ERR); 376 } 377 if (periph->unit_number < 26) { 378 (void)make_dev_alias(softc->dev, "sg%c", 379 periph->unit_number + 'a'); 380 } else { 381 (void)make_dev_alias(softc->dev, "sg%c%c", 382 ((periph->unit_number / 26) - 1) + 'a', 383 (periph->unit_number % 26) + 'a'); 384 } 385 cam_periph_lock(periph); 386 387 /* 388 * Add as async callback so that we get 389 * notified if this device goes away. 390 */ 391 xpt_register_async(AC_LOST_DEVICE, sgasync, periph, periph->path); 392 393 if (bootverbose) 394 xpt_announce_periph(periph, NULL); 395 396 return (CAM_REQ_CMP); 397 } 398 399 static void 400 sgdone(struct cam_periph *periph, union ccb *done_ccb) 401 { 402 struct sg_softc *softc; 403 struct ccb_scsiio *csio; 404 405 softc = (struct sg_softc *)periph->softc; 406 csio = &done_ccb->csio; 407 switch (csio->ccb_h.ccb_type) { 408 case SG_CCB_RDWR_IO: 409 { 410 struct sg_rdwr *rdwr; 411 int state; 412 413 devstat_end_transaction(softc->device_stats, 414 csio->dxfer_len, 415 csio->tag_action & 0xf, 416 ((csio->ccb_h.flags & CAM_DIR_MASK) == 417 CAM_DIR_NONE) ? DEVSTAT_NO_DATA : 418 (csio->ccb_h.flags & CAM_DIR_OUT) ? 419 DEVSTAT_WRITE : DEVSTAT_READ, 420 NULL, NULL); 421 422 rdwr = done_ccb->ccb_h.ccb_rdwr; 423 state = rdwr->state; 424 rdwr->state = SG_RDWR_DONE; 425 wakeup(rdwr); 426 break; 427 } 428 default: 429 panic("unknown sg CCB type"); 430 } 431 } 432 433 static int 434 sgopen(struct cdev *dev, int flags, int fmt, struct thread *td) 435 { 436 struct cam_periph *periph; 437 struct sg_softc *softc; 438 int error = 0; 439 440 periph = (struct cam_periph *)dev->si_drv1; 441 if (cam_periph_acquire(periph) != 0) 442 return (ENXIO); 443 444 /* 445 * Don't allow access when we're running at a high securelevel. 446 */ 447 error = securelevel_gt(td->td_ucred, 1); 448 if (error) { 449 cam_periph_release(periph); 450 return (error); 451 } 452 453 cam_periph_lock(periph); 454 455 softc = (struct sg_softc *)periph->softc; 456 if (softc->flags & SG_FLAG_INVALID) { 457 cam_periph_release_locked(periph); 458 cam_periph_unlock(periph); 459 return (ENXIO); 460 } 461 462 softc->open_count++; 463 464 cam_periph_unlock(periph); 465 466 return (error); 467 } 468 469 static int 470 sgclose(struct cdev *dev, int flag, int fmt, struct thread *td) 471 { 472 struct cam_periph *periph; 473 struct sg_softc *softc; 474 struct mtx *mtx; 475 476 periph = (struct cam_periph *)dev->si_drv1; 477 mtx = cam_periph_mtx(periph); 478 mtx_lock(mtx); 479 480 softc = periph->softc; 481 softc->open_count--; 482 483 cam_periph_release_locked(periph); 484 485 /* 486 * We reference the lock directly here, instead of using 487 * cam_periph_unlock(). The reason is that the call to 488 * cam_periph_release_locked() above could result in the periph 489 * getting freed. If that is the case, dereferencing the periph 490 * with a cam_periph_unlock() call would cause a page fault. 491 * 492 * cam_periph_release() avoids this problem using the same method, 493 * but we're manually acquiring and dropping the lock here to 494 * protect the open count and avoid another lock acquisition and 495 * release. 496 */ 497 mtx_unlock(mtx); 498 499 return (0); 500 } 501 502 static int 503 sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, int flag, struct thread *td) 504 { 505 union ccb *ccb; 506 struct ccb_scsiio *csio; 507 struct cam_periph *periph; 508 struct sg_softc *softc; 509 struct sg_io_hdr *req; 510 void *data_ptr; 511 int dir, error; 512 513 periph = (struct cam_periph *)dev->si_drv1; 514 cam_periph_lock(periph); 515 516 softc = (struct sg_softc *)periph->softc; 517 error = 0; 518 519 switch (cmd) { 520 case SG_GET_VERSION_NUM: 521 { 522 int *version = (int *)arg; 523 524 *version = sg_version; 525 break; 526 } 527 case SG_SET_TIMEOUT: 528 { 529 u_int user_timeout = *(u_int *)arg; 530 531 softc->sg_user_timeout = user_timeout; 532 softc->sg_timeout = user_timeout / SG_DEFAULT_HZ * hz; 533 break; 534 } 535 case SG_GET_TIMEOUT: 536 /* 537 * The value is returned directly to the syscall. 538 */ 539 td->td_retval[0] = softc->sg_user_timeout; 540 error = 0; 541 break; 542 case SG_IO: 543 req = (struct sg_io_hdr *)arg; 544 545 if (req->cmd_len > IOCDBLEN) { 546 error = EINVAL; 547 break; 548 } 549 550 if (req->iovec_count != 0) { 551 error = EOPNOTSUPP; 552 break; 553 } 554 555 if (req->dxfer_len > MAXPHYS) { 556 error = EINVAL; 557 break; 558 } 559 560 data_ptr = malloc(req->dxfer_len, M_DEVBUF, M_WAITOK); 561 562 ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL); 563 csio = &ccb->csio; 564 565 error = copyin(req->cmdp, &csio->cdb_io.cdb_bytes, 566 req->cmd_len); 567 if (error) { 568 free(data_ptr, M_DEVBUF); 569 xpt_release_ccb(ccb); 570 break; 571 } 572 573 switch(req->dxfer_direction) { 574 case SG_DXFER_TO_DEV: 575 dir = CAM_DIR_OUT; 576 break; 577 case SG_DXFER_FROM_DEV: 578 dir = CAM_DIR_IN; 579 break; 580 case SG_DXFER_TO_FROM_DEV: 581 dir = CAM_DIR_BOTH; 582 break; 583 case SG_DXFER_NONE: 584 default: 585 dir = CAM_DIR_NONE; 586 break; 587 } 588 589 if (dir == CAM_DIR_IN || dir == CAM_DIR_BOTH) { 590 error = copyin(req->dxferp, data_ptr, req->dxfer_len); 591 if (error) { 592 free(data_ptr, M_DEVBUF); 593 xpt_release_ccb(ccb); 594 break; 595 } 596 } 597 598 cam_fill_csio(csio, 599 /*retries*/1, 600 /*cbfcnp*/NULL, 601 dir|CAM_DEV_QFRZDIS, 602 MSG_SIMPLE_Q_TAG, 603 data_ptr, 604 req->dxfer_len, 605 req->mx_sb_len, 606 req->cmd_len, 607 req->timeout); 608 609 error = sgsendccb(periph, ccb); 610 if (error) { 611 req->host_status = DID_ERROR; 612 req->driver_status = DRIVER_INVALID; 613 free(data_ptr, M_DEVBUF); 614 xpt_release_ccb(ccb); 615 break; 616 } 617 618 req->status = csio->scsi_status; 619 req->masked_status = (csio->scsi_status >> 1) & 0x7f; 620 sg_scsiio_status(csio, &req->host_status, &req->driver_status); 621 req->resid = csio->resid; 622 req->duration = csio->ccb_h.timeout; 623 req->info = 0; 624 625 if ((csio->ccb_h.status & CAM_AUTOSNS_VALID) 626 && (req->sbp != NULL)) { 627 req->sb_len_wr = req->mx_sb_len - csio->sense_resid; 628 error = copyout(&csio->sense_data, req->sbp, 629 req->sb_len_wr); 630 } 631 632 if ((dir == CAM_DIR_OUT || dir == CAM_DIR_BOTH) && error == 0) 633 error = copyout(data_ptr, req->dxferp, req->dxfer_len); 634 635 free(data_ptr, M_DEVBUF); 636 xpt_release_ccb(ccb); 637 break; 638 639 case SG_GET_RESERVED_SIZE: 640 { 641 int *size = (int *)arg; 642 *size = DFLTPHYS; 643 break; 644 } 645 646 case SG_GET_SCSI_ID: 647 { 648 struct sg_scsi_id *id = (struct sg_scsi_id *)arg; 649 650 id->host_no = cam_sim_path(xpt_path_sim(periph->path)); 651 id->channel = xpt_path_path_id(periph->path); 652 id->scsi_id = xpt_path_target_id(periph->path); 653 id->lun = xpt_path_lun_id(periph->path); 654 id->scsi_type = softc->pd_type; 655 id->h_cmd_per_lun = 1; 656 id->d_queue_depth = 1; 657 id->unused[0] = 0; 658 id->unused[1] = 0; 659 break; 660 } 661 662 case SG_GET_SG_TABLESIZE: 663 { 664 int *size = (int *)arg; 665 *size = 0; 666 break; 667 } 668 669 case SG_EMULATED_HOST: 670 case SG_SET_TRANSFORM: 671 case SG_GET_TRANSFORM: 672 case SG_GET_NUM_WAITING: 673 case SG_SCSI_RESET: 674 case SG_GET_REQUEST_TABLE: 675 case SG_SET_KEEP_ORPHAN: 676 case SG_GET_KEEP_ORPHAN: 677 case SG_GET_ACCESS_COUNT: 678 case SG_SET_FORCE_LOW_DMA: 679 case SG_GET_LOW_DMA: 680 case SG_SET_FORCE_PACK_ID: 681 case SG_GET_PACK_ID: 682 case SG_SET_RESERVED_SIZE: 683 case SG_GET_COMMAND_Q: 684 case SG_SET_COMMAND_Q: 685 case SG_SET_DEBUG: 686 case SG_NEXT_CMD_LEN: 687 default: 688 #ifdef CAMDEBUG 689 printf("sgioctl: rejecting cmd 0x%lx\n", cmd); 690 #endif 691 error = ENODEV; 692 break; 693 } 694 695 cam_periph_unlock(periph); 696 return (error); 697 } 698 699 static int 700 sgwrite(struct cdev *dev, struct uio *uio, int ioflag) 701 { 702 union ccb *ccb; 703 struct cam_periph *periph; 704 struct ccb_scsiio *csio; 705 struct sg_softc *sc; 706 struct sg_header *hdr; 707 struct sg_rdwr *rdwr; 708 u_char cdb_cmd; 709 char *buf; 710 int error = 0, cdb_len, buf_len, dir; 711 712 periph = dev->si_drv1; 713 rdwr = malloc(sizeof(*rdwr), M_DEVBUF, M_WAITOK | M_ZERO); 714 hdr = &rdwr->hdr.hdr; 715 716 /* Copy in the header block and sanity check it */ 717 if (uio->uio_resid < sizeof(*hdr)) { 718 error = EINVAL; 719 goto out_hdr; 720 } 721 error = uiomove(hdr, sizeof(*hdr), uio); 722 if (error) 723 goto out_hdr; 724 725 /* XXX: We don't support SG 3.x read/write API. */ 726 if (hdr->reply_len < 0) { 727 error = ENODEV; 728 goto out_hdr; 729 } 730 731 ccb = xpt_alloc_ccb(); 732 if (ccb == NULL) { 733 error = ENOMEM; 734 goto out_hdr; 735 } 736 csio = &ccb->csio; 737 738 /* 739 * Copy in the CDB block. The designers of the interface didn't 740 * bother to provide a size for this in the header, so we have to 741 * figure it out ourselves. 742 */ 743 if (uio->uio_resid < 1) 744 goto out_ccb; 745 error = uiomove(&cdb_cmd, 1, uio); 746 if (error) 747 goto out_ccb; 748 if (hdr->twelve_byte) 749 cdb_len = 12; 750 else 751 cdb_len = scsi_group_len(cdb_cmd); 752 /* 753 * We've already read the first byte of the CDB and advanced the uio 754 * pointer. Just read the rest. 755 */ 756 csio->cdb_io.cdb_bytes[0] = cdb_cmd; 757 error = uiomove(&csio->cdb_io.cdb_bytes[1], cdb_len - 1, uio); 758 if (error) 759 goto out_ccb; 760 761 /* 762 * Now set up the data block. Again, the designers didn't bother 763 * to make this reliable. 764 */ 765 buf_len = uio->uio_resid; 766 if (buf_len != 0) { 767 buf = malloc(buf_len, M_DEVBUF, M_WAITOK | M_ZERO); 768 error = uiomove(buf, buf_len, uio); 769 if (error) 770 goto out_buf; 771 dir = CAM_DIR_OUT; 772 } else if (hdr->reply_len != 0) { 773 buf = malloc(hdr->reply_len, M_DEVBUF, M_WAITOK | M_ZERO); 774 buf_len = hdr->reply_len; 775 dir = CAM_DIR_IN; 776 } else { 777 buf = NULL; 778 buf_len = 0; 779 dir = CAM_DIR_NONE; 780 } 781 782 cam_periph_lock(periph); 783 sc = periph->softc; 784 xpt_setup_ccb(&ccb->ccb_h, periph->path, CAM_PRIORITY_NORMAL); 785 cam_fill_csio(csio, 786 /*retries*/1, 787 sgdone, 788 dir|CAM_DEV_QFRZDIS, 789 MSG_SIMPLE_Q_TAG, 790 buf, 791 buf_len, 792 SG_MAX_SENSE, 793 cdb_len, 794 sc->sg_timeout); 795 796 /* 797 * Send off the command and hope that it works. This path does not 798 * go through sgstart because the I/O is supposed to be asynchronous. 799 */ 800 rdwr->buf = buf; 801 rdwr->buf_len = buf_len; 802 rdwr->tag = hdr->pack_id; 803 rdwr->ccb = ccb; 804 rdwr->state = SG_RDWR_INPROG; 805 ccb->ccb_h.ccb_rdwr = rdwr; 806 ccb->ccb_h.ccb_type = SG_CCB_RDWR_IO; 807 TAILQ_INSERT_TAIL(&sc->rdwr_done, rdwr, rdwr_link); 808 error = sgsendrdwr(periph, ccb); 809 cam_periph_unlock(periph); 810 return (error); 811 812 out_buf: 813 free(buf, M_DEVBUF); 814 out_ccb: 815 xpt_free_ccb(ccb); 816 out_hdr: 817 free(rdwr, M_DEVBUF); 818 return (error); 819 } 820 821 static int 822 sgread(struct cdev *dev, struct uio *uio, int ioflag) 823 { 824 struct ccb_scsiio *csio; 825 struct cam_periph *periph; 826 struct sg_softc *sc; 827 struct sg_header *hdr; 828 struct sg_rdwr *rdwr; 829 u_short hstat, dstat; 830 int error, pack_len, reply_len, pack_id; 831 832 periph = dev->si_drv1; 833 834 /* XXX The pack len field needs to be updated and written out instead 835 * of discarded. Not sure how to do that. 836 */ 837 uio->uio_rw = UIO_WRITE; 838 if ((error = uiomove(&pack_len, 4, uio)) != 0) 839 return (error); 840 if ((error = uiomove(&reply_len, 4, uio)) != 0) 841 return (error); 842 if ((error = uiomove(&pack_id, 4, uio)) != 0) 843 return (error); 844 uio->uio_rw = UIO_READ; 845 846 cam_periph_lock(periph); 847 sc = periph->softc; 848 search: 849 TAILQ_FOREACH(rdwr, &sc->rdwr_done, rdwr_link) { 850 if (rdwr->tag == pack_id) 851 break; 852 } 853 if ((rdwr == NULL) || (rdwr->state != SG_RDWR_DONE)) { 854 if (cam_periph_sleep(periph, rdwr, PCATCH, "sgread", 0) == ERESTART) 855 return (EAGAIN); 856 goto search; 857 } 858 TAILQ_REMOVE(&sc->rdwr_done, rdwr, rdwr_link); 859 cam_periph_unlock(periph); 860 861 hdr = &rdwr->hdr.hdr; 862 csio = &rdwr->ccb->csio; 863 sg_scsiio_status(csio, &hstat, &dstat); 864 hdr->host_status = hstat; 865 hdr->driver_status = dstat; 866 hdr->target_status = csio->scsi_status >> 1; 867 868 switch (hstat) { 869 case DID_OK: 870 case DID_PASSTHROUGH: 871 case DID_SOFT_ERROR: 872 hdr->result = 0; 873 break; 874 case DID_NO_CONNECT: 875 case DID_BUS_BUSY: 876 case DID_TIME_OUT: 877 hdr->result = EBUSY; 878 break; 879 case DID_BAD_TARGET: 880 case DID_ABORT: 881 case DID_PARITY: 882 case DID_RESET: 883 case DID_BAD_INTR: 884 case DID_ERROR: 885 default: 886 hdr->result = EIO; 887 break; 888 } 889 890 if (dstat == DRIVER_SENSE) { 891 bcopy(&csio->sense_data, hdr->sense_buffer, 892 min(csio->sense_len, SG_MAX_SENSE)); 893 #ifdef CAMDEBUG 894 scsi_sense_print(csio); 895 #endif 896 } 897 898 error = uiomove(&hdr->result, sizeof(*hdr) - 899 offsetof(struct sg_header, result), uio); 900 if ((error == 0) && (hdr->result == 0)) 901 error = uiomove(rdwr->buf, rdwr->buf_len, uio); 902 903 cam_periph_lock(periph); 904 xpt_free_ccb(rdwr->ccb); 905 cam_periph_unlock(periph); 906 free(rdwr->buf, M_DEVBUF); 907 free(rdwr, M_DEVBUF); 908 return (error); 909 } 910 911 static int 912 sgsendccb(struct cam_periph *periph, union ccb *ccb) 913 { 914 struct sg_softc *softc; 915 struct cam_periph_map_info mapinfo; 916 int error; 917 918 softc = periph->softc; 919 bzero(&mapinfo, sizeof(mapinfo)); 920 921 /* 922 * cam_periph_mapmem calls into proc and vm functions that can 923 * sleep as well as trigger I/O, so we can't hold the lock. 924 * Dropping it here is reasonably safe. 925 * The only CCB opcode that is possible here is XPT_SCSI_IO, no 926 * need for additional checks. 927 */ 928 cam_periph_unlock(periph); 929 error = cam_periph_mapmem(ccb, &mapinfo, softc->maxio); 930 cam_periph_lock(periph); 931 if (error) 932 return (error); 933 934 error = cam_periph_runccb(ccb, 935 sgerror, 936 CAM_RETRY_SELTO, 937 SF_RETRY_UA, 938 softc->device_stats); 939 940 cam_periph_unlock(periph); 941 cam_periph_unmapmem(ccb, &mapinfo); 942 cam_periph_lock(periph); 943 944 return (error); 945 } 946 947 static int 948 sgsendrdwr(struct cam_periph *periph, union ccb *ccb) 949 { 950 struct sg_softc *softc; 951 952 softc = periph->softc; 953 devstat_start_transaction(softc->device_stats, NULL); 954 xpt_action(ccb); 955 return (0); 956 } 957 958 static int 959 sgerror(union ccb *ccb, uint32_t cam_flags, uint32_t sense_flags) 960 { 961 struct cam_periph *periph; 962 struct sg_softc *softc; 963 964 periph = xpt_path_periph(ccb->ccb_h.path); 965 softc = (struct sg_softc *)periph->softc; 966 967 return (cam_periph_error(ccb, cam_flags, sense_flags)); 968 } 969 970 static void 971 sg_scsiio_status(struct ccb_scsiio *csio, u_short *hoststat, u_short *drvstat) 972 { 973 int status; 974 975 status = csio->ccb_h.status; 976 977 switch (status & CAM_STATUS_MASK) { 978 case CAM_REQ_CMP: 979 *hoststat = DID_OK; 980 *drvstat = 0; 981 break; 982 case CAM_REQ_CMP_ERR: 983 *hoststat = DID_ERROR; 984 *drvstat = 0; 985 break; 986 case CAM_REQ_ABORTED: 987 *hoststat = DID_ABORT; 988 *drvstat = 0; 989 break; 990 case CAM_REQ_INVALID: 991 *hoststat = DID_ERROR; 992 *drvstat = DRIVER_INVALID; 993 break; 994 case CAM_DEV_NOT_THERE: 995 *hoststat = DID_BAD_TARGET; 996 *drvstat = 0; 997 break; 998 case CAM_SEL_TIMEOUT: 999 *hoststat = DID_NO_CONNECT; 1000 *drvstat = 0; 1001 break; 1002 case CAM_CMD_TIMEOUT: 1003 *hoststat = DID_TIME_OUT; 1004 *drvstat = 0; 1005 break; 1006 case CAM_SCSI_STATUS_ERROR: 1007 *hoststat = DID_ERROR; 1008 *drvstat = 0; 1009 break; 1010 case CAM_SCSI_BUS_RESET: 1011 *hoststat = DID_RESET; 1012 *drvstat = 0; 1013 break; 1014 case CAM_UNCOR_PARITY: 1015 *hoststat = DID_PARITY; 1016 *drvstat = 0; 1017 break; 1018 case CAM_SCSI_BUSY: 1019 *hoststat = DID_BUS_BUSY; 1020 *drvstat = 0; 1021 break; 1022 default: 1023 *hoststat = DID_ERROR; 1024 *drvstat = DRIVER_ERROR; 1025 } 1026 1027 if (status & CAM_AUTOSNS_VALID) 1028 *drvstat = DRIVER_SENSE; 1029 } 1030 1031 static int 1032 scsi_group_len(u_char cmd) 1033 { 1034 int len[] = {6, 10, 10, 12, 12, 12, 10, 10}; 1035 int group; 1036 1037 group = (cmd >> 5) & 0x7; 1038 return (len[group]); 1039 } 1040