xref: /titanic_51/usr/src/uts/common/io/comstar/stmf/stmf.c (revision 7f79af0b29c00a006403444f61b261219f63cfbf)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/conf.h>
27 #include <sys/file.h>
28 #include <sys/ddi.h>
29 #include <sys/sunddi.h>
30 #include <sys/modctl.h>
31 #include <sys/scsi/scsi.h>
32 #include <sys/scsi/impl/scsi_reset_notify.h>
33 #include <sys/disp.h>
34 #include <sys/byteorder.h>
35 #include <sys/atomic.h>
36 #include <sys/ethernet.h>
37 #include <sys/sdt.h>
38 #include <sys/nvpair.h>
39 
40 #include <stmf.h>
41 #include <lpif.h>
42 #include <portif.h>
43 #include <stmf_ioctl.h>
44 #include <stmf_impl.h>
45 #include <lun_map.h>
46 #include <stmf_state.h>
47 
48 static uint64_t stmf_session_counter = 0;
49 static uint16_t stmf_rtpid_counter = 0;
50 
51 static int stmf_attach(dev_info_t *dip, ddi_attach_cmd_t cmd);
52 static int stmf_detach(dev_info_t *dip, ddi_detach_cmd_t cmd);
53 static int stmf_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg,
54 	void **result);
55 static int stmf_open(dev_t *devp, int flag, int otype, cred_t *credp);
56 static int stmf_close(dev_t dev, int flag, int otype, cred_t *credp);
57 static int stmf_ioctl(dev_t dev, int cmd, intptr_t data, int mode,
58 	cred_t *credp, int *rval);
59 static int stmf_get_stmf_state(stmf_state_desc_t *std);
60 static int stmf_set_stmf_state(stmf_state_desc_t *std);
61 static void stmf_abort_task_offline(scsi_task_t *task, int offline_lu,
62     char *info);
63 void stmf_svc_init();
64 stmf_status_t stmf_svc_fini();
65 void stmf_svc(void *arg);
66 void stmf_svc_queue(int cmd, void *obj, stmf_state_change_info_t *info);
67 void stmf_check_freetask();
68 void stmf_abort_target_reset(scsi_task_t *task);
69 stmf_status_t stmf_lun_reset_poll(stmf_lu_t *lu, struct scsi_task *task,
70 							int target_reset);
71 void stmf_target_reset_poll(struct scsi_task *task);
72 void stmf_handle_lun_reset(scsi_task_t *task);
73 void stmf_handle_target_reset(scsi_task_t *task);
74 void stmf_xd_to_dbuf(stmf_data_buf_t *dbuf);
75 int stmf_load_ppd_ioctl(stmf_ppioctl_data_t *ppi);
76 int stmf_delete_ppd_ioctl(stmf_ppioctl_data_t *ppi);
77 void stmf_delete_ppd(stmf_pp_data_t *ppd);
78 void stmf_delete_all_ppds();
79 void stmf_trace_clear();
80 void stmf_worker_init();
81 stmf_status_t stmf_worker_fini();
82 void stmf_worker_mgmt();
83 void stmf_worker_task(void *arg);
84 
85 extern struct mod_ops mod_driverops;
86 
87 /* =====[ Tunables ]===== */
88 /* Internal tracing */
89 volatile int	stmf_trace_on = 1;
90 volatile int	stmf_trace_buf_size = (1 * 1024 * 1024);
91 /*
92  * The reason default task timeout is 75 is because we want the
93  * host to timeout 1st and mostly host timeout is 60 seconds.
94  */
95 volatile int	stmf_default_task_timeout = 75;
96 /*
97  * Setting this to one means, you are responsible for config load and keeping
98  * things in sync with persistent database.
99  */
100 volatile int	stmf_allow_modunload = 0;
101 
102 volatile int stmf_max_nworkers = 256;
103 volatile int stmf_min_nworkers = 4;
104 volatile int stmf_worker_scale_down_delay = 20;
105 
106 /* === [ Debugging and fault injection ] === */
107 #ifdef	DEBUG
108 volatile int stmf_drop_task_counter = 0;
109 volatile int stmf_drop_buf_counter = 0;
110 
111 #endif
112 
113 stmf_state_t		stmf_state;
114 static stmf_lu_t	*dlun0;
115 
116 static uint8_t stmf_first_zero[] =
117 	{ 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0, 0xff };
118 static uint8_t stmf_first_one[] =
119 	{ 0xff, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0 };
120 
121 static kmutex_t	trace_buf_lock;
122 static int	trace_buf_size;
123 static int	trace_buf_curndx;
124 caddr_t	stmf_trace_buf;
125 
126 static enum {
127 	STMF_WORKERS_DISABLED = 0,
128 	STMF_WORKERS_ENABLING,
129 	STMF_WORKERS_ENABLED
130 } stmf_workers_state = STMF_WORKERS_DISABLED;
131 static int stmf_i_max_nworkers;
132 static int stmf_i_min_nworkers;
133 static int stmf_nworkers_cur;		/* # of workers currently running */
134 static int stmf_nworkers_needed;	/* # of workers need to be running */
135 static int stmf_worker_sel_counter = 0;
136 static uint32_t stmf_cur_ntasks = 0;
137 static clock_t stmf_wm_last = 0;
138 /*
139  * This is equal to stmf_nworkers_cur while we are increasing # workers and
140  * stmf_nworkers_needed while we are decreasing the worker count.
141  */
142 static int stmf_nworkers_accepting_cmds;
143 static stmf_worker_t *stmf_workers = NULL;
144 static clock_t stmf_worker_mgmt_delay = 2;
145 static clock_t stmf_worker_scale_down_timer = 0;
146 static int stmf_worker_scale_down_qd = 0;
147 
148 static struct cb_ops stmf_cb_ops = {
149 	stmf_open,			/* open */
150 	stmf_close,			/* close */
151 	nodev,				/* strategy */
152 	nodev,				/* print */
153 	nodev,				/* dump */
154 	nodev,				/* read */
155 	nodev,				/* write */
156 	stmf_ioctl,			/* ioctl */
157 	nodev,				/* devmap */
158 	nodev,				/* mmap */
159 	nodev,				/* segmap */
160 	nochpoll,			/* chpoll */
161 	ddi_prop_op,			/* cb_prop_op */
162 	0,				/* streamtab */
163 	D_NEW | D_MP,			/* cb_flag */
164 	CB_REV,				/* rev */
165 	nodev,				/* aread */
166 	nodev				/* awrite */
167 };
168 
169 static struct dev_ops stmf_ops = {
170 	DEVO_REV,
171 	0,
172 	stmf_getinfo,
173 	nulldev,		/* identify */
174 	nulldev,		/* probe */
175 	stmf_attach,
176 	stmf_detach,
177 	nodev,			/* reset */
178 	&stmf_cb_ops,
179 	NULL,			/* bus_ops */
180 	NULL			/* power */
181 };
182 
183 #define	STMF_NAME	"COMSTAR STMF"
184 
185 static struct modldrv modldrv = {
186 	&mod_driverops,
187 	STMF_NAME,
188 	&stmf_ops
189 };
190 
191 static struct modlinkage modlinkage = {
192 	MODREV_1,
193 	&modldrv,
194 	NULL
195 };
196 
197 int
198 _init(void)
199 {
200 	int ret;
201 
202 	ret = mod_install(&modlinkage);
203 	if (ret)
204 		return (ret);
205 	stmf_trace_buf = kmem_zalloc(stmf_trace_buf_size, KM_SLEEP);
206 	trace_buf_size = stmf_trace_buf_size;
207 	trace_buf_curndx = 0;
208 	mutex_init(&trace_buf_lock, NULL, MUTEX_DRIVER, 0);
209 	bzero(&stmf_state, sizeof (stmf_state_t));
210 	/* STMF service is off by default */
211 	stmf_state.stmf_service_running = 0;
212 	mutex_init(&stmf_state.stmf_lock, NULL, MUTEX_DRIVER, NULL);
213 	cv_init(&stmf_state.stmf_cv, NULL, CV_DRIVER, NULL);
214 	stmf_session_counter = (uint64_t)ddi_get_lbolt();
215 	stmf_view_init();
216 	stmf_svc_init();
217 	stmf_dlun_init();
218 	return (ret);
219 }
220 
221 int
222 _fini(void)
223 {
224 	int ret;
225 
226 	if (stmf_state.stmf_service_running)
227 		return (EBUSY);
228 	if ((!stmf_allow_modunload) &&
229 	    (stmf_state.stmf_config_state != STMF_CONFIG_NONE)) {
230 		return (EBUSY);
231 	}
232 	if (stmf_state.stmf_nlps || stmf_state.stmf_npps) {
233 		return (EBUSY);
234 	}
235 	if (stmf_dlun_fini() != STMF_SUCCESS)
236 		return (EBUSY);
237 	if (stmf_worker_fini() != STMF_SUCCESS) {
238 		stmf_dlun_init();
239 		return (EBUSY);
240 	}
241 	if (stmf_svc_fini() != STMF_SUCCESS) {
242 		stmf_dlun_init();
243 		stmf_worker_init();
244 		return (EBUSY);
245 	}
246 
247 	ret = mod_remove(&modlinkage);
248 	if (ret) {
249 		stmf_svc_init();
250 		stmf_dlun_init();
251 		stmf_worker_init();
252 		return (ret);
253 	}
254 
255 	stmf_view_clear_config();
256 	kmem_free(stmf_trace_buf, stmf_trace_buf_size);
257 	mutex_destroy(&trace_buf_lock);
258 	mutex_destroy(&stmf_state.stmf_lock);
259 	cv_destroy(&stmf_state.stmf_cv);
260 	return (ret);
261 }
262 
263 int
264 _info(struct modinfo *modinfop)
265 {
266 	return (mod_info(&modlinkage, modinfop));
267 }
268 
269 /* ARGSUSED */
270 static int
271 stmf_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **result)
272 {
273 	switch (cmd) {
274 	case DDI_INFO_DEVT2DEVINFO:
275 		*result = stmf_state.stmf_dip;
276 		break;
277 	case DDI_INFO_DEVT2INSTANCE:
278 		*result = (void *)(uintptr_t)ddi_get_instance(dip);
279 		break;
280 	default:
281 		return (DDI_FAILURE);
282 	}
283 
284 	return (DDI_SUCCESS);
285 }
286 
287 static int
288 stmf_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
289 {
290 	switch (cmd) {
291 	case DDI_ATTACH:
292 		stmf_state.stmf_dip = dip;
293 
294 		if (ddi_create_minor_node(dip, "admin", S_IFCHR, 0,
295 		    DDI_NT_STMF, 0) != DDI_SUCCESS) {
296 			break;
297 		}
298 		ddi_report_dev(dip);
299 		return (DDI_SUCCESS);
300 	}
301 
302 	return (DDI_FAILURE);
303 }
304 
305 static int
306 stmf_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
307 {
308 	switch (cmd) {
309 	case DDI_DETACH:
310 		ddi_remove_minor_node(dip, 0);
311 		return (DDI_SUCCESS);
312 	}
313 
314 	return (DDI_FAILURE);
315 }
316 
317 /* ARGSUSED */
318 static int
319 stmf_open(dev_t *devp, int flag, int otype, cred_t *credp)
320 {
321 	mutex_enter(&stmf_state.stmf_lock);
322 	if (stmf_state.stmf_exclusive_open) {
323 		mutex_exit(&stmf_state.stmf_lock);
324 		return (EBUSY);
325 	}
326 	if (flag & FEXCL) {
327 		if (stmf_state.stmf_opened) {
328 			mutex_exit(&stmf_state.stmf_lock);
329 			return (EBUSY);
330 		}
331 		stmf_state.stmf_exclusive_open = 1;
332 	}
333 	stmf_state.stmf_opened = 1;
334 	mutex_exit(&stmf_state.stmf_lock);
335 	return (0);
336 }
337 
338 /* ARGSUSED */
339 static int
340 stmf_close(dev_t dev, int flag, int otype, cred_t *credp)
341 {
342 	mutex_enter(&stmf_state.stmf_lock);
343 	stmf_state.stmf_opened = 0;
344 	if (stmf_state.stmf_exclusive_open &&
345 	    (stmf_state.stmf_config_state != STMF_CONFIG_INIT_DONE)) {
346 		stmf_state.stmf_config_state = STMF_CONFIG_NONE;
347 		stmf_delete_all_ppds();
348 		stmf_view_clear_config();
349 		stmf_view_init();
350 	}
351 	stmf_state.stmf_exclusive_open = 0;
352 	mutex_exit(&stmf_state.stmf_lock);
353 	return (0);
354 }
355 
356 int
357 stmf_copyin_iocdata(intptr_t data, int mode, stmf_iocdata_t **iocd,
358 						void **ibuf, void **obuf)
359 {
360 	int ret;
361 
362 	*ibuf = NULL;
363 	*obuf = NULL;
364 	*iocd = kmem_zalloc(sizeof (stmf_iocdata_t), KM_SLEEP);
365 
366 	ret = ddi_copyin((void *)data, *iocd, sizeof (stmf_iocdata_t), mode);
367 	if (ret)
368 		return (EFAULT);
369 	if ((*iocd)->stmf_version != STMF_VERSION_1) {
370 		ret = EINVAL;
371 		goto copyin_iocdata_done;
372 	}
373 	if ((*iocd)->stmf_ibuf_size) {
374 		*ibuf = kmem_zalloc((*iocd)->stmf_ibuf_size, KM_SLEEP);
375 		ret = ddi_copyin((void *)((unsigned long)(*iocd)->stmf_ibuf),
376 		    *ibuf, (*iocd)->stmf_ibuf_size, mode);
377 	}
378 	if ((*iocd)->stmf_obuf_size)
379 		*obuf = kmem_zalloc((*iocd)->stmf_obuf_size, KM_SLEEP);
380 
381 	if (ret == 0)
382 		return (0);
383 	ret = EFAULT;
384 copyin_iocdata_done:;
385 	if (*obuf) {
386 		kmem_free(*obuf, (*iocd)->stmf_obuf_size);
387 		*obuf = NULL;
388 	}
389 	if (*ibuf) {
390 		kmem_free(*ibuf, (*iocd)->stmf_ibuf_size);
391 		*ibuf = NULL;
392 	}
393 	kmem_free(*iocd, sizeof (stmf_iocdata_t));
394 	return (ret);
395 }
396 
397 int
398 stmf_copyout_iocdata(intptr_t data, int mode, stmf_iocdata_t *iocd, void *obuf)
399 {
400 	int ret;
401 
402 	if (iocd->stmf_obuf_size) {
403 		ret = ddi_copyout(obuf, (void *)(unsigned long)iocd->stmf_obuf,
404 		    iocd->stmf_obuf_size, mode);
405 		if (ret)
406 			return (EFAULT);
407 	}
408 	ret = ddi_copyout(iocd, (void *)data, sizeof (stmf_iocdata_t), mode);
409 	if (ret)
410 		return (EFAULT);
411 	return (0);
412 }
413 
414 /* ARGSUSED */
415 static int
416 stmf_ioctl(dev_t dev, int cmd, intptr_t data, int mode,
417 	cred_t *credp, int *rval)
418 {
419 	stmf_iocdata_t *iocd;
420 	void *ibuf = NULL, *obuf = NULL;
421 	slist_lu_t *luid_list;
422 	slist_target_port_t *lportid_list;
423 	stmf_i_lu_t *ilu;
424 	stmf_i_local_port_t *ilport;
425 	stmf_i_scsi_session_t *iss;
426 	slist_scsi_session_t *iss_list;
427 	sioc_lu_props_t *lup;
428 	sioc_target_port_props_t *lportp;
429 	stmf_ppioctl_data_t *ppi;
430 	uint8_t *p_id;
431 	stmf_state_desc_t *std;
432 	stmf_status_t ctl_ret;
433 	stmf_state_change_info_t ssi;
434 	int ret = 0;
435 	uint32_t n;
436 	int i;
437 	stmf_group_op_data_t *grp_entry;
438 	stmf_group_name_t *grpname;
439 	stmf_view_op_entry_t *ve;
440 	stmf_id_type_t idtype;
441 #if 0
442 	stmf_id_data_t *id_entry;
443 	stmf_id_list_t	*id_list;
444 	stmf_view_entry_t *view_entry;
445 #endif
446 	uint32_t	veid;
447 
448 	if ((cmd & 0xff000000) != STMF_IOCTL) {
449 		return (ENOTTY);
450 	}
451 
452 	if (drv_priv(credp) != 0) {
453 		return (EPERM);
454 	}
455 
456 	ret = stmf_copyin_iocdata(data, mode, &iocd, &ibuf, &obuf);
457 	if (ret)
458 		return (ret);
459 	iocd->stmf_error = 0;
460 
461 	switch (cmd) {
462 	case STMF_IOCTL_LU_LIST:
463 		mutex_enter(&stmf_state.stmf_lock);
464 		iocd->stmf_obuf_max_nentries = stmf_state.stmf_nlus;
465 		n = min(stmf_state.stmf_nlus,
466 				(iocd->stmf_obuf_size)/sizeof (slist_lu_t));
467 		iocd->stmf_obuf_nentries = n;
468 		ilu = stmf_state.stmf_ilulist;
469 		luid_list = (slist_lu_t *)obuf;
470 		for (i = 0; i < n; i++) {
471 			uint8_t *id;
472 			id = (uint8_t *)ilu->ilu_lu->lu_id;
473 			bcopy(id + 4, luid_list[i].lu_guid, 16);
474 			ilu = ilu->ilu_next;
475 		}
476 		mutex_exit(&stmf_state.stmf_lock);
477 		break;
478 
479 	case STMF_IOCTL_TARGET_PORT_LIST:
480 		mutex_enter(&stmf_state.stmf_lock);
481 		iocd->stmf_obuf_max_nentries = stmf_state.stmf_nlports;
482 		n = min(stmf_state.stmf_nlports,
483 			(iocd->stmf_obuf_size)/sizeof (slist_target_port_t));
484 		iocd->stmf_obuf_nentries = n;
485 		ilport = stmf_state.stmf_ilportlist;
486 		lportid_list = (slist_target_port_t *)obuf;
487 		for (i = 0; i < n; i++) {
488 			uint8_t *id;
489 			id = (uint8_t *)ilport->ilport_lport->lport_id;
490 			bcopy(id, lportid_list[i].target, id[3] + 4);
491 			ilport = ilport->ilport_next;
492 		}
493 		mutex_exit(&stmf_state.stmf_lock);
494 		break;
495 
496 	case STMF_IOCTL_SESSION_LIST:
497 		p_id = (uint8_t *)ibuf;
498 		if ((p_id == NULL) || (iocd->stmf_ibuf_size < 4) ||
499 		    (iocd->stmf_ibuf_size < (p_id[3] + 4))) {
500 			ret = EINVAL;
501 			break;
502 		}
503 		mutex_enter(&stmf_state.stmf_lock);
504 		for (ilport = stmf_state.stmf_ilportlist; ilport; ilport =
505 				ilport->ilport_next) {
506 			uint8_t *id;
507 			id = (uint8_t *)ilport->ilport_lport->lport_id;
508 			if ((p_id[3] == id[3]) &&
509 			    (bcmp(p_id + 4, id + 4, id[3]) == 0)) {
510 				break;
511 			}
512 		}
513 		if (ilport == NULL) {
514 			mutex_exit(&stmf_state.stmf_lock);
515 			ret = ENOENT;
516 			break;
517 		}
518 		iocd->stmf_obuf_max_nentries = ilport->ilport_nsessions;
519 		n = min(ilport->ilport_nsessions,
520 		    (iocd->stmf_obuf_size)/sizeof (slist_scsi_session_t));
521 		iocd->stmf_obuf_nentries = n;
522 		iss = ilport->ilport_ss_list;
523 		iss_list = (slist_scsi_session_t *)obuf;
524 		for (i = 0; i < n; i++) {
525 			uint8_t *id;
526 			id = (uint8_t *)iss->iss_ss->ss_rport_id;
527 			bcopy(id, iss_list[i].initiator, id[3] + 4);
528 			iss_list[i].creation_time = (uint32_t)
529 			    iss->iss_creation_time;
530 			if (iss->iss_ss->ss_rport_alias) {
531 				(void) strncpy(iss_list[i].alias,
532 				    iss->iss_ss->ss_rport_alias, 255);
533 				iss_list[i].alias[255] = 0;
534 			} else {
535 				iss_list[i].alias[0] = 0;
536 			}
537 			iss = iss->iss_next;
538 		}
539 		mutex_exit(&stmf_state.stmf_lock);
540 		break;
541 
542 	case STMF_IOCTL_GET_LU_PROPERTIES:
543 		p_id = (uint8_t *)ibuf;
544 		if ((iocd->stmf_ibuf_size < 16) ||
545 		    (iocd->stmf_obuf_size < sizeof (sioc_lu_props_t)) ||
546 		    (p_id[0] == 0)) {
547 			ret = EINVAL;
548 			break;
549 		}
550 		mutex_enter(&stmf_state.stmf_lock);
551 		for (ilu = stmf_state.stmf_ilulist; ilu; ilu = ilu->ilu_next) {
552 			if (bcmp(p_id, ilu->ilu_lu->lu_id->ident, 16) == 0)
553 				break;
554 		}
555 		if (ilu == NULL) {
556 			mutex_exit(&stmf_state.stmf_lock);
557 			ret = ENOENT;
558 			break;
559 		}
560 		lup = (sioc_lu_props_t *)obuf;
561 		bcopy(ilu->ilu_lu->lu_id->ident, lup->lu_guid, 16);
562 		lup->lu_state = ilu->ilu_state & 0x0f;
563 		lup->lu_present = 1; /* XXX */
564 		(void) strncpy(lup->lu_provider_name,
565 		    ilu->ilu_lu->lu_lp->lp_name, 255);
566 		lup->lu_provider_name[254] = 0;
567 		if (ilu->ilu_lu->lu_alias) {
568 			(void) strncpy(lup->lu_alias,
569 			    ilu->ilu_lu->lu_alias, 255);
570 			lup->lu_alias[255] = 0;
571 		} else {
572 			lup->lu_alias[0] = 0;
573 		}
574 		mutex_exit(&stmf_state.stmf_lock);
575 		break;
576 
577 	case STMF_IOCTL_GET_TARGET_PORT_PROPERTIES:
578 		p_id = (uint8_t *)ibuf;
579 		if ((p_id == NULL) ||
580 		    (iocd->stmf_ibuf_size < (p_id[3] + 4)) ||
581 		    (iocd->stmf_obuf_size <
582 		    sizeof (sioc_target_port_props_t))) {
583 			ret = EINVAL;
584 			break;
585 		}
586 		mutex_enter(&stmf_state.stmf_lock);
587 		for (ilport = stmf_state.stmf_ilportlist; ilport;
588 		    ilport = ilport->ilport_next) {
589 			uint8_t *id;
590 			id = (uint8_t *)ilport->ilport_lport->lport_id;
591 			if ((p_id[3] == id[3]) &&
592 			    (bcmp(p_id+4, id+4, id[3]) == 0))
593 				break;
594 		}
595 		if (ilport == NULL) {
596 			mutex_exit(&stmf_state.stmf_lock);
597 			ret = ENOENT;
598 			break;
599 		}
600 		lportp = (sioc_target_port_props_t *)obuf;
601 		bcopy(ilport->ilport_lport->lport_id, lportp->tgt_id,
602 		    ilport->ilport_lport->lport_id->ident_length + 4);
603 		lportp->tgt_state = ilport->ilport_state & 0x0f;
604 		lportp->tgt_present = 1; /* XXX */
605 		(void) strncpy(lportp->tgt_provider_name,
606 		    ilport->ilport_lport->lport_pp->pp_name, 255);
607 		lportp->tgt_provider_name[254] = 0;
608 		if (ilport->ilport_lport->lport_alias) {
609 			(void) strncpy(lportp->tgt_alias,
610 			    ilport->ilport_lport->lport_alias, 255);
611 			lportp->tgt_alias[255] = 0;
612 		} else {
613 			lportp->tgt_alias[0] = 0;
614 		}
615 		mutex_exit(&stmf_state.stmf_lock);
616 		break;
617 
618 	case STMF_IOCTL_SET_STMF_STATE:
619 		if ((ibuf == NULL) ||
620 		    (iocd->stmf_ibuf_size < sizeof (stmf_state_desc_t))) {
621 			ret = EINVAL;
622 			break;
623 		}
624 		ret = stmf_set_stmf_state((stmf_state_desc_t *)ibuf);
625 		break;
626 
627 	case STMF_IOCTL_GET_STMF_STATE:
628 		if ((obuf == NULL) ||
629 		    (iocd->stmf_obuf_size < sizeof (stmf_state_desc_t))) {
630 			ret = EINVAL;
631 			break;
632 		}
633 		ret = stmf_get_stmf_state((stmf_state_desc_t *)obuf);
634 		break;
635 
636 	case STMF_IOCTL_SET_LU_STATE:
637 		ssi.st_rflags = STMF_RFLAG_USER_REQUEST;
638 		ssi.st_additional_info = NULL;
639 		std = (stmf_state_desc_t *)ibuf;
640 		if ((ibuf == NULL) ||
641 		    (iocd->stmf_ibuf_size < sizeof (stmf_state_desc_t))) {
642 			ret = EINVAL;
643 			break;
644 		}
645 		p_id = std->ident;
646 		mutex_enter(&stmf_state.stmf_lock);
647 		if (stmf_state.stmf_inventory_locked) {
648 			mutex_exit(&stmf_state.stmf_lock);
649 			ret = EBUSY;
650 			break;
651 		}
652 		for (ilu = stmf_state.stmf_ilulist; ilu; ilu = ilu->ilu_next) {
653 			if (bcmp(p_id, ilu->ilu_lu->lu_id->ident, 16) == 0)
654 				break;
655 		}
656 		if (ilu == NULL) {
657 			mutex_exit(&stmf_state.stmf_lock);
658 			ret = ENOENT;
659 			break;
660 		}
661 		stmf_state.stmf_inventory_locked = 1;
662 		mutex_exit(&stmf_state.stmf_lock);
663 		cmd = (std->state == STMF_STATE_ONLINE) ? STMF_CMD_LU_ONLINE :
664 		    STMF_CMD_LU_OFFLINE;
665 		ctl_ret = stmf_ctl(cmd, (void *)ilu->ilu_lu, &ssi);
666 		if (ctl_ret == STMF_ALREADY)
667 			ret = 0;
668 		else if (ctl_ret != STMF_SUCCESS)
669 			ret = EIO;
670 		mutex_enter(&stmf_state.stmf_lock);
671 		stmf_state.stmf_inventory_locked = 0;
672 		mutex_exit(&stmf_state.stmf_lock);
673 		break;
674 
675 	case STMF_IOCTL_SET_TARGET_PORT_STATE:
676 		ssi.st_rflags = STMF_RFLAG_USER_REQUEST;
677 		ssi.st_additional_info = NULL;
678 		std = (stmf_state_desc_t *)ibuf;
679 		if ((ibuf == NULL) ||
680 		    (iocd->stmf_ibuf_size < sizeof (stmf_state_desc_t))) {
681 			ret = EINVAL;
682 			break;
683 		}
684 		p_id = std->ident;
685 		mutex_enter(&stmf_state.stmf_lock);
686 		if (stmf_state.stmf_inventory_locked) {
687 			mutex_exit(&stmf_state.stmf_lock);
688 			ret = EBUSY;
689 			break;
690 		}
691 		for (ilport = stmf_state.stmf_ilportlist; ilport;
692 		    ilport = ilport->ilport_next) {
693 			uint8_t *id;
694 			id = (uint8_t *)ilport->ilport_lport->lport_id;
695 			if ((id[3] == p_id[3]) &&
696 			    (bcmp(id+4, p_id+4, id[3]) == 0)) {
697 				break;
698 			}
699 		}
700 		if (ilport == NULL) {
701 			mutex_exit(&stmf_state.stmf_lock);
702 			ret = ENOENT;
703 			break;
704 		}
705 		stmf_state.stmf_inventory_locked = 1;
706 		mutex_exit(&stmf_state.stmf_lock);
707 		cmd = (std->state == STMF_STATE_ONLINE) ?
708 		    STMF_CMD_LPORT_ONLINE : STMF_CMD_LPORT_OFFLINE;
709 		ctl_ret = stmf_ctl(cmd, (void *)ilport->ilport_lport, &ssi);
710 		if (ctl_ret == STMF_ALREADY)
711 			ret = 0;
712 		else if (ctl_ret != STMF_SUCCESS)
713 			ret = EIO;
714 		mutex_enter(&stmf_state.stmf_lock);
715 		stmf_state.stmf_inventory_locked = 0;
716 		mutex_exit(&stmf_state.stmf_lock);
717 		break;
718 
719 	case STMF_IOCTL_ADD_HG_ENTRY:
720 		idtype = STMF_ID_TYPE_HOST;
721 		/* FALLTHROUGH */
722 	case STMF_IOCTL_ADD_TG_ENTRY:
723 		if (stmf_state.stmf_config_state == STMF_CONFIG_NONE) {
724 			ret = EACCES;
725 			iocd->stmf_error = STMF_IOCERR_UPDATE_NEED_CFG_INIT;
726 			break;
727 		}
728 		if (cmd == STMF_IOCTL_ADD_TG_ENTRY) {
729 			idtype = STMF_ID_TYPE_TARGET;
730 		}
731 		grp_entry = (stmf_group_op_data_t *)ibuf;
732 		if ((ibuf == NULL) ||
733 		    (iocd->stmf_ibuf_size < sizeof (stmf_group_op_data_t))) {
734 			ret = EINVAL;
735 			break;
736 		}
737 		if (grp_entry->group.name[0] == '*') {
738 			ret = EINVAL;
739 			break; /* not allowed */
740 		}
741 		mutex_enter(&stmf_state.stmf_lock);
742 		if (idtype == STMF_ID_TYPE_TARGET &&
743 		    stmf_state.stmf_service_running) {
744 			mutex_exit(&stmf_state.stmf_lock);
745 			iocd->stmf_error =
746 			    STMF_IOCERR_TG_UPDATE_NEED_SVC_OFFLINE;
747 			ret = EBUSY;
748 			break; /* not allowed */
749 		}
750 		ret = stmf_add_group_member(grp_entry->group.name,
751 		    grp_entry->group.name_size,
752 		    grp_entry->ident + 4,
753 		    grp_entry->ident[3],
754 		    idtype,
755 		    &iocd->stmf_error);
756 		mutex_exit(&stmf_state.stmf_lock);
757 		break;
758 	case STMF_IOCTL_REMOVE_HG_ENTRY:
759 		idtype = STMF_ID_TYPE_HOST;
760 		/* FALLTHROUGH */
761 	case STMF_IOCTL_REMOVE_TG_ENTRY:
762 		if (stmf_state.stmf_config_state == STMF_CONFIG_NONE) {
763 			ret = EACCES;
764 			iocd->stmf_error = STMF_IOCERR_UPDATE_NEED_CFG_INIT;
765 			break;
766 		}
767 		if (cmd == STMF_IOCTL_REMOVE_TG_ENTRY) {
768 			idtype = STMF_ID_TYPE_TARGET;
769 		}
770 		grp_entry = (stmf_group_op_data_t *)ibuf;
771 		if ((ibuf == NULL) ||
772 		    (iocd->stmf_ibuf_size < sizeof (stmf_group_op_data_t))) {
773 			ret = EINVAL;
774 			break;
775 		}
776 		if (grp_entry->group.name[0] == '*') {
777 			ret = EINVAL;
778 			break; /* not allowed */
779 		}
780 		mutex_enter(&stmf_state.stmf_lock);
781 		if (idtype == STMF_ID_TYPE_TARGET &&
782 		    stmf_state.stmf_service_running) {
783 			mutex_exit(&stmf_state.stmf_lock);
784 			iocd->stmf_error =
785 			    STMF_IOCERR_TG_UPDATE_NEED_SVC_OFFLINE;
786 			ret = EBUSY;
787 			break; /* not allowed */
788 		}
789 		ret = stmf_remove_group_member(grp_entry->group.name,
790 		    grp_entry->group.name_size,
791 		    grp_entry->ident + 4,
792 		    grp_entry->ident[3],
793 		    idtype,
794 		    &iocd->stmf_error);
795 		mutex_exit(&stmf_state.stmf_lock);
796 		break;
797 	case STMF_IOCTL_CREATE_HOST_GROUP:
798 		idtype = STMF_ID_TYPE_HOST_GROUP;
799 		/* FALLTHROUGH */
800 	case STMF_IOCTL_CREATE_TARGET_GROUP:
801 		if (stmf_state.stmf_config_state == STMF_CONFIG_NONE) {
802 			ret = EACCES;
803 			iocd->stmf_error = STMF_IOCERR_UPDATE_NEED_CFG_INIT;
804 			break;
805 		}
806 		grpname = (stmf_group_name_t *)ibuf;
807 
808 		if (cmd == STMF_IOCTL_CREATE_TARGET_GROUP)
809 			idtype = STMF_ID_TYPE_TARGET_GROUP;
810 		if ((ibuf == NULL) ||
811 		    (iocd->stmf_ibuf_size < sizeof (stmf_group_name_t))) {
812 			ret = EINVAL;
813 			break;
814 		}
815 		if (grpname->name[0] == '*') {
816 			ret = EINVAL;
817 			break; /* not allowed */
818 		}
819 		mutex_enter(&stmf_state.stmf_lock);
820 		ret = stmf_add_group(grpname->name,
821 		    grpname->name_size, idtype, &iocd->stmf_error);
822 		mutex_exit(&stmf_state.stmf_lock);
823 		break;
824 	case STMF_IOCTL_REMOVE_HOST_GROUP:
825 		idtype = STMF_ID_TYPE_HOST_GROUP;
826 		/* FALLTHROUGH */
827 	case STMF_IOCTL_REMOVE_TARGET_GROUP:
828 		if (stmf_state.stmf_config_state == STMF_CONFIG_NONE) {
829 			ret = EACCES;
830 			iocd->stmf_error = STMF_IOCERR_UPDATE_NEED_CFG_INIT;
831 			break;
832 		}
833 		grpname = (stmf_group_name_t *)ibuf;
834 		if (cmd == STMF_IOCTL_REMOVE_TARGET_GROUP)
835 			idtype = STMF_ID_TYPE_TARGET_GROUP;
836 		if ((ibuf == NULL) ||
837 		    (iocd->stmf_ibuf_size < sizeof (stmf_group_name_t))) {
838 			ret = EINVAL;
839 			break;
840 		}
841 		if (grpname->name[0] == '*') {
842 			ret = EINVAL;
843 			break; /* not allowed */
844 		}
845 		mutex_enter(&stmf_state.stmf_lock);
846 		ret = stmf_remove_group(grpname->name,
847 		    grpname->name_size, idtype, &iocd->stmf_error);
848 		mutex_exit(&stmf_state.stmf_lock);
849 		break;
850 	case STMF_IOCTL_ADD_VIEW_ENTRY:
851 		if (stmf_state.stmf_config_state == STMF_CONFIG_NONE) {
852 			ret = EACCES;
853 			iocd->stmf_error = STMF_IOCERR_UPDATE_NEED_CFG_INIT;
854 			break;
855 		}
856 		ve = (stmf_view_op_entry_t *)ibuf;
857 		if ((ibuf == NULL) ||
858 		    (iocd->stmf_ibuf_size < sizeof (stmf_view_op_entry_t))) {
859 			ret = EINVAL;
860 			break;
861 		}
862 		if (!ve->ve_lu_number_valid)
863 			ve->ve_lu_nbr[2] = 0xFF;
864 		if (ve->ve_all_hosts) {
865 			ve->ve_host_group.name[0] = '*';
866 			ve->ve_host_group.name_size = 1;
867 		}
868 		if (ve->ve_all_targets) {
869 			ve->ve_target_group.name[0] = '*';
870 			ve->ve_target_group.name_size = 1;
871 		}
872 		if (ve->ve_ndx_valid)
873 			veid = ve->ve_ndx;
874 		else
875 			veid = 0xffffffff;
876 		mutex_enter(&stmf_state.stmf_lock);
877 		ret = stmf_add_ve(ve->ve_host_group.name,
878 		    ve->ve_host_group.name_size,
879 		    ve->ve_target_group.name,
880 		    ve->ve_target_group.name_size,
881 		    ve->ve_guid,
882 		    &veid,
883 		    ve->ve_lu_nbr,
884 		    &iocd->stmf_error);
885 		mutex_exit(&stmf_state.stmf_lock);
886 		if (ret == 0 &&
887 		    (!ve->ve_ndx_valid || !ve->ve_lu_number_valid) &&
888 		    iocd->stmf_obuf_size >= sizeof (stmf_view_op_entry_t)) {
889 			stmf_view_op_entry_t *ve_ret =
890 			    (stmf_view_op_entry_t *)obuf;
891 			iocd->stmf_obuf_nentries = 1;
892 			iocd->stmf_obuf_max_nentries = 1;
893 			if (!ve->ve_ndx_valid) {
894 				ve_ret->ve_ndx = veid;
895 				ve_ret->ve_ndx_valid = 1;
896 			}
897 			if (!ve->ve_lu_number_valid) {
898 				ve_ret->ve_lu_number_valid = 1;
899 				bcopy(ve->ve_lu_nbr, ve_ret->ve_lu_nbr, 8);
900 			}
901 		}
902 		break;
903 	case STMF_IOCTL_REMOVE_VIEW_ENTRY:
904 		if (stmf_state.stmf_config_state == STMF_CONFIG_NONE) {
905 			ret = EACCES;
906 			iocd->stmf_error = STMF_IOCERR_UPDATE_NEED_CFG_INIT;
907 			break;
908 		}
909 		ve = (stmf_view_op_entry_t *)ibuf;
910 		if ((ibuf == NULL) ||
911 		    (iocd->stmf_ibuf_size < sizeof (stmf_view_op_entry_t))) {
912 			ret = EINVAL;
913 			break;
914 		}
915 		if (!ve->ve_ndx_valid) {
916 			ret = EINVAL;
917 			break;
918 		}
919 		mutex_enter(&stmf_state.stmf_lock);
920 		ret = stmf_remove_ve_by_id(ve->ve_guid, ve->ve_ndx,
921 		    &iocd->stmf_error);
922 		mutex_exit(&stmf_state.stmf_lock);
923 		break;
924 #if 0
925 	case STMF_IOCTL_GET_HG_LIST:
926 		id_list = &stmf_state.stmf_hg_list;
927 		/* FALLTHROUGH */
928 	case STMF_IOCTL_GET_TG_LIST:
929 		if (cmd == STMF_IOCTL_GET_TG_LIST)
930 			id_list = &stmf_state.stmf_tg_list;
931 		mutex_enter(&stmf_state.stmf_lock);
932 		iocd->stmf_obuf_max_nentries = id_list->id_count;
933 		n = min(id_list->id_count,
934 		    (iocd->stmf_obuf_size)/sizeof (stmf_group_name_t));
935 		iocd->stmf_obuf_nentries = n;
936 		id_entry = id_list->idl_head;
937 		grpname = (stmf_group_name_t *)obuf;
938 		for (i = 0; i < n; i++) {
939 			grpname[i].name_size = id_entry->id_data_size;
940 			bcopy(id_entry->id_data, grpname[i].name,
941 			    id_entry->id_data_size);
942 			id_entry = id_entry->id_next;
943 		}
944 		mutex_exit(&stmf_state.stmf_lock);
945 		break;
946 	case STMF_IOCTL_GET_HG_ENTRIES:
947 		id_list = &stmf_state.stmf_hg_list;
948 		/* FALLTHROUGH */
949 	case STMF_IOCTL_GET_TG_ENTRIES:
950 		grpname = (stmf_group_name_t *)ibuf;
951 		if ((ibuf == NULL) ||
952 		    (iocd->stmf_ibuf_size < sizeof (stmf_group_name_t))) {
953 			ret = EINVAL;
954 			break;
955 		}
956 		if (cmd == STMF_IOCTL_GET_TG_ENTRIES) {
957 			id_list = &stmf_state.stmf_tg_list;
958 		}
959 		mutex_enter(&stmf_state.stmf_lock);
960 		id_entry = stmf_lookup_id(id_list, grpname->name_size,
961 		    grpname->name);
962 		if (!id_entry)
963 			ret = ENODEV;
964 		else {
965 			stmf_ge_ident_t *grp_entry;
966 			id_list = (stmf_id_list_t *)id_entry->id_impl_specific;
967 			iocd->stmf_obuf_max_nentries = id_list->id_count;
968 			n = min(id_list->id_count,
969 			    iocd->stmf_obuf_size/sizeof (stmf_ge_ident_t));
970 			iocd->stmf_obuf_nentries = n;
971 			id_entry = id_list->idl_head;
972 			grp_entry = (stmf_ge_ident_t *)obuf;
973 			for (i = 0; i < n; i++) {
974 				bcopy(id_entry->id_data, grp_entry,
975 				    id_entry->id_data_size);
976 				id_entry = id_entry->id_next;
977 			}
978 		}
979 		mutex_exit(&stmf_state.stmf_lock);
980 		break;
981 	case STMF_IOCTL_GET_VE_LIST:
982 		n = iocd->stmf_obuf_size/sizeof (stmf_view_op_entry_t);
983 		mutex_enter(&stmf_state.stmf_lock);
984 		id_entry = stmf_state.stmf_luid_list.idl_head;
985 		ve = (stmf_view_op_entry_t *)obuf;
986 		while (id_entry) {
987 			view_entry =
988 			    (stmf_view_entry_t *)id_entry->id_impl_specific;
989 			for (; view_entry; view_entry = view_entry->ve_next) {
990 				ve->ve_ndx_valid = 1;
991 				ve->ve_ndx = view_entry->ve_id;
992 				ve->ve_lu_number_valid = 1;
993 				bcopy(view_entry->ve_lun, ve->ve_lu_nbr, 8);
994 				bcopy(view_entry->ve_luid->id_data, ve->ve_guid,
995 				    view_entry->ve_luid->id_data_size);
996 				if (view_entry->ve_hg->id_data[0] == '*')
997 					ve->ve_all_hosts = 1;
998 				else
999 					bcopy(view_entry->ve_hg->id_data,
1000 					    ve->ve_host_group.name,
1001 					    view_entry->ve_hg->id_data_size);
1002 				if (view_entry->ve_tg->id_data[0] == '*')
1003 					ve->ve_all_targets = 1;
1004 				else
1005 					bcopy(view_entry->ve_tg->id_data,
1006 					    ve->ve_target_group.name,
1007 					    view_entry->ve_tg->id_data_size);
1008 				iocd->stmf_obuf_nentries++;
1009 				if (iocd->stmf_obuf_nentries >= n)
1010 					break;
1011 			}
1012 			if (iocd->stmf_obuf_nentries >= n)
1013 				break;
1014 		}
1015 		mutex_exit(&stmf_state.stmf_lock);
1016 		break;
1017 #endif
1018 	case STMF_IOCTL_LOAD_PP_DATA:
1019 		if (stmf_state.stmf_config_state == STMF_CONFIG_NONE) {
1020 			ret = EACCES;
1021 			iocd->stmf_error = STMF_IOCERR_UPDATE_NEED_CFG_INIT;
1022 			break;
1023 		}
1024 		ppi = (stmf_ppioctl_data_t *)ibuf;
1025 		if ((ppi == NULL) ||
1026 		    (iocd->stmf_ibuf_size < sizeof (stmf_ppioctl_data_t))) {
1027 			ret = EINVAL;
1028 			break;
1029 		}
1030 		ret = stmf_load_ppd_ioctl(ppi);
1031 		break;
1032 
1033 	case STMF_IOCTL_CLEAR_PP_DATA:
1034 		if (stmf_state.stmf_config_state == STMF_CONFIG_NONE) {
1035 			ret = EACCES;
1036 			iocd->stmf_error = STMF_IOCERR_UPDATE_NEED_CFG_INIT;
1037 			break;
1038 		}
1039 		ppi = (stmf_ppioctl_data_t *)ibuf;
1040 		if ((ppi == NULL) ||
1041 		    (iocd->stmf_ibuf_size < sizeof (stmf_ppioctl_data_t))) {
1042 			ret = EINVAL;
1043 			break;
1044 		}
1045 		ret = stmf_delete_ppd_ioctl(ppi);
1046 		break;
1047 
1048 	case STMF_IOCTL_CLEAR_TRACE:
1049 		stmf_trace_clear();
1050 		break;
1051 
1052 	case STMF_IOCTL_ADD_TRACE:
1053 		if (iocd->stmf_ibuf_size && ibuf) {
1054 			((uint8_t *)ibuf)[iocd->stmf_ibuf_size - 1] = 0;
1055 			stmf_trace("\nstradm", "%s\n", ibuf);
1056 		}
1057 		break;
1058 
1059 	case STMF_IOCTL_GET_TRACE_POSITION:
1060 		if (obuf && (iocd->stmf_obuf_size > 3)) {
1061 			mutex_enter(&trace_buf_lock);
1062 			*((int *)obuf) = trace_buf_curndx;
1063 			mutex_exit(&trace_buf_lock);
1064 		} else {
1065 			ret = EINVAL;
1066 		}
1067 		break;
1068 
1069 	case STMF_IOCTL_GET_TRACE:
1070 		if ((iocd->stmf_obuf_size == 0) || (iocd->stmf_ibuf_size < 4)) {
1071 			ret = EINVAL;
1072 			break;
1073 		}
1074 		i = *((int *)ibuf);
1075 		if ((i > trace_buf_size) || ((i + iocd->stmf_obuf_size) >
1076 		    trace_buf_size)) {
1077 			ret = EINVAL;
1078 			break;
1079 		}
1080 		mutex_enter(&trace_buf_lock);
1081 		bcopy(stmf_trace_buf + i, obuf, iocd->stmf_obuf_size);
1082 		mutex_exit(&trace_buf_lock);
1083 		break;
1084 
1085 	default:
1086 		ret = ENOTTY;
1087 	}
1088 
1089 	if (ret == 0) {
1090 		ret = stmf_copyout_iocdata(data, mode, iocd, obuf);
1091 	} else if (iocd->stmf_error) {
1092 		(void) stmf_copyout_iocdata(data, mode, iocd, obuf);
1093 	}
1094 	if (obuf) {
1095 		kmem_free(obuf, iocd->stmf_obuf_size);
1096 		obuf = NULL;
1097 	}
1098 	if (ibuf) {
1099 		kmem_free(ibuf, iocd->stmf_ibuf_size);
1100 		ibuf = NULL;
1101 	}
1102 	kmem_free(iocd, sizeof (stmf_iocdata_t));
1103 	return (ret);
1104 }
1105 
1106 static int
1107 stmf_get_service_state()
1108 {
1109 	stmf_i_local_port_t *ilport;
1110 	stmf_i_lu_t *ilu;
1111 	int online = 0;
1112 	int offline = 0;
1113 	int onlining = 0;
1114 	int offlining = 0;
1115 
1116 	ASSERT(mutex_owned(&stmf_state.stmf_lock));
1117 	for (ilport = stmf_state.stmf_ilportlist; ilport != NULL;
1118 	    ilport = ilport->ilport_next) {
1119 		if (ilport->ilport_state == STMF_STATE_OFFLINE)
1120 			offline++;
1121 		else if (ilport->ilport_state == STMF_STATE_ONLINE)
1122 			online++;
1123 		else if (ilport->ilport_state == STMF_STATE_ONLINING)
1124 			onlining++;
1125 		else if (ilport->ilport_state == STMF_STATE_OFFLINING)
1126 			offlining++;
1127 	}
1128 
1129 	for (ilu = stmf_state.stmf_ilulist; ilu != NULL;
1130 	    ilu = ilu->ilu_next) {
1131 		if (ilu->ilu_state == STMF_STATE_OFFLINE)
1132 			offline++;
1133 		else if (ilu->ilu_state == STMF_STATE_ONLINE)
1134 			online++;
1135 		else if (ilu->ilu_state == STMF_STATE_ONLINING)
1136 			onlining++;
1137 		else if (ilu->ilu_state == STMF_STATE_OFFLINING)
1138 			offlining++;
1139 	}
1140 
1141 	if (stmf_state.stmf_service_running) {
1142 		if (onlining)
1143 			return (STMF_STATE_ONLINING);
1144 		else
1145 			return (STMF_STATE_ONLINE);
1146 	}
1147 
1148 	if (offlining) {
1149 		return (STMF_STATE_OFFLINING);
1150 	}
1151 
1152 	return (STMF_STATE_OFFLINE);
1153 }
1154 
1155 static int
1156 stmf_set_stmf_state(stmf_state_desc_t *std)
1157 {
1158 	stmf_i_local_port_t *ilport;
1159 	stmf_i_lu_t *ilu;
1160 	stmf_state_change_info_t ssi;
1161 	int svc_state;
1162 
1163 	ssi.st_rflags = STMF_RFLAG_USER_REQUEST;
1164 	ssi.st_additional_info = NULL;
1165 
1166 	mutex_enter(&stmf_state.stmf_lock);
1167 	if (!stmf_state.stmf_exclusive_open) {
1168 		mutex_exit(&stmf_state.stmf_lock);
1169 		return (EACCES);
1170 	}
1171 
1172 	if (stmf_state.stmf_inventory_locked) {
1173 		mutex_exit(&stmf_state.stmf_lock);
1174 		return (EBUSY);
1175 	}
1176 
1177 	if ((std->state != STMF_STATE_ONLINE) &&
1178 	    (std->state != STMF_STATE_OFFLINE)) {
1179 		mutex_exit(&stmf_state.stmf_lock);
1180 		return (EINVAL);
1181 	}
1182 
1183 	svc_state = stmf_get_service_state();
1184 	if ((svc_state == STMF_STATE_OFFLINING) ||
1185 	    (svc_state == STMF_STATE_ONLINING)) {
1186 		mutex_exit(&stmf_state.stmf_lock);
1187 		return (EBUSY);
1188 	}
1189 
1190 	if (svc_state == STMF_STATE_OFFLINE) {
1191 		if (std->config_state == STMF_CONFIG_INIT) {
1192 			if (std->state != STMF_STATE_OFFLINE) {
1193 				mutex_exit(&stmf_state.stmf_lock);
1194 				return (EINVAL);
1195 			}
1196 			stmf_state.stmf_config_state = STMF_CONFIG_INIT;
1197 			stmf_delete_all_ppds();
1198 			stmf_view_clear_config();
1199 			stmf_view_init();
1200 			mutex_exit(&stmf_state.stmf_lock);
1201 			return (0);
1202 		}
1203 		if (stmf_state.stmf_config_state == STMF_CONFIG_INIT) {
1204 			if (std->config_state != STMF_CONFIG_INIT_DONE) {
1205 				mutex_exit(&stmf_state.stmf_lock);
1206 				return (EINVAL);
1207 			}
1208 			stmf_state.stmf_config_state = STMF_CONFIG_INIT_DONE;
1209 		}
1210 		if (std->state == STMF_STATE_OFFLINE) {
1211 			mutex_exit(&stmf_state.stmf_lock);
1212 			return (0);
1213 		}
1214 		if (stmf_state.stmf_config_state == STMF_CONFIG_INIT) {
1215 			mutex_exit(&stmf_state.stmf_lock);
1216 			return (EINVAL);
1217 		}
1218 		stmf_state.stmf_inventory_locked = 1;
1219 		stmf_state.stmf_service_running = 1;
1220 		mutex_exit(&stmf_state.stmf_lock);
1221 
1222 		for (ilport = stmf_state.stmf_ilportlist; ilport != NULL;
1223 		    ilport = ilport->ilport_next) {
1224 			if (ilport->ilport_prev_state != STMF_STATE_ONLINE)
1225 				continue;
1226 			(void) stmf_ctl(STMF_CMD_LPORT_ONLINE,
1227 					ilport->ilport_lport, &ssi);
1228 		}
1229 
1230 		for (ilu = stmf_state.stmf_ilulist; ilu != NULL;
1231 		    ilu = ilu->ilu_next) {
1232 			if (ilu->ilu_prev_state != STMF_STATE_ONLINE)
1233 				continue;
1234 			(void) stmf_ctl(STMF_CMD_LU_ONLINE, ilu->ilu_lu, &ssi);
1235 		}
1236 		mutex_enter(&stmf_state.stmf_lock);
1237 		stmf_state.stmf_inventory_locked = 0;
1238 		mutex_exit(&stmf_state.stmf_lock);
1239 		return (0);
1240 	}
1241 
1242 	/* svc_state is STMF_STATE_ONLINE here */
1243 	if ((std->state != STMF_STATE_OFFLINE) ||
1244 	    (std->config_state == STMF_CONFIG_INIT)) {
1245 		mutex_exit(&stmf_state.stmf_lock);
1246 		return (EACCES);
1247 	}
1248 
1249 	stmf_state.stmf_inventory_locked = 1;
1250 	stmf_state.stmf_service_running = 0;
1251 	stmf_delete_all_ppds();
1252 	mutex_exit(&stmf_state.stmf_lock);
1253 	for (ilport = stmf_state.stmf_ilportlist; ilport != NULL;
1254 	    ilport = ilport->ilport_next) {
1255 		if (ilport->ilport_state != STMF_STATE_ONLINE)
1256 			continue;
1257 		(void) stmf_ctl(STMF_CMD_LPORT_OFFLINE,
1258 		    ilport->ilport_lport, &ssi);
1259 	}
1260 
1261 	for (ilu = stmf_state.stmf_ilulist; ilu != NULL;
1262 	    ilu = ilu->ilu_next) {
1263 		if (ilu->ilu_state != STMF_STATE_ONLINE)
1264 			continue;
1265 		(void) stmf_ctl(STMF_CMD_LU_OFFLINE, ilu->ilu_lu, &ssi);
1266 	}
1267 	mutex_enter(&stmf_state.stmf_lock);
1268 	stmf_state.stmf_inventory_locked = 0;
1269 	mutex_exit(&stmf_state.stmf_lock);
1270 	return (0);
1271 }
1272 
1273 static int
1274 stmf_get_stmf_state(stmf_state_desc_t *std)
1275 {
1276 	mutex_enter(&stmf_state.stmf_lock);
1277 	std->state = stmf_get_service_state();
1278 	std->config_state = stmf_state.stmf_config_state;
1279 	mutex_exit(&stmf_state.stmf_lock);
1280 
1281 	return (0);
1282 }
1283 
1284 typedef struct {
1285 	void	*bp;	/* back pointer from internal struct to main struct */
1286 	int	alloc_size;
1287 } __istmf_t;
1288 
1289 typedef struct {
1290 	__istmf_t	*fp;	/* Framework private */
1291 	void		*cp;	/* Caller private */
1292 	void		*ss;	/* struct specific */
1293 } __stmf_t;
1294 
1295 static struct {
1296 	int shared;
1297 	int fw_private;
1298 } stmf_sizes[] = { { 0, 0 },
1299 	{ GET_STRUCT_SIZE(stmf_lu_provider_t),
1300 		GET_STRUCT_SIZE(stmf_i_lu_provider_t) },
1301 	{ GET_STRUCT_SIZE(stmf_port_provider_t),
1302 		GET_STRUCT_SIZE(stmf_i_port_provider_t) },
1303 	{ GET_STRUCT_SIZE(stmf_local_port_t),
1304 		GET_STRUCT_SIZE(stmf_i_local_port_t) },
1305 	{ GET_STRUCT_SIZE(stmf_lu_t),
1306 		GET_STRUCT_SIZE(stmf_i_lu_t) },
1307 	{ GET_STRUCT_SIZE(stmf_scsi_session_t),
1308 		GET_STRUCT_SIZE(stmf_i_scsi_session_t) },
1309 	{ GET_STRUCT_SIZE(scsi_task_t),
1310 		GET_STRUCT_SIZE(stmf_i_scsi_task_t) },
1311 	{ GET_STRUCT_SIZE(stmf_data_buf_t),
1312 		GET_STRUCT_SIZE(__istmf_t) },
1313 	{ GET_STRUCT_SIZE(stmf_dbuf_store_t),
1314 		GET_STRUCT_SIZE(__istmf_t) }
1315 
1316 };
1317 
1318 void *
1319 stmf_alloc(stmf_struct_id_t struct_id, int additional_size, int flags)
1320 {
1321 	int stmf_size;
1322 	int kmem_flag;
1323 	__stmf_t *sh;
1324 
1325 	if ((struct_id == 0) || (struct_id >= STMF_MAX_STRUCT_IDS))
1326 		return (NULL);
1327 
1328 	if ((curthread->t_flag & T_INTR_THREAD) || (flags & AF_FORCE_NOSLEEP)) {
1329 		kmem_flag = KM_NOSLEEP;
1330 	} else {
1331 		kmem_flag = KM_SLEEP;
1332 	}
1333 
1334 	additional_size = (additional_size + 7) & (~7);
1335 	stmf_size = stmf_sizes[struct_id].shared +
1336 		stmf_sizes[struct_id].fw_private + additional_size;
1337 
1338 	sh = (__stmf_t *)kmem_zalloc(stmf_size, kmem_flag);
1339 
1340 	if (sh == NULL)
1341 		return (NULL);
1342 
1343 	sh->fp = (__istmf_t *)GET_BYTE_OFFSET(sh, stmf_sizes[struct_id].shared);
1344 	sh->cp = GET_BYTE_OFFSET(sh->fp, stmf_sizes[struct_id].fw_private);
1345 
1346 	sh->fp->bp = sh;
1347 	/* Just store the total size instead of storing additional size */
1348 	sh->fp->alloc_size = stmf_size;
1349 
1350 	return (sh);
1351 }
1352 
1353 void
1354 stmf_free(void *ptr)
1355 {
1356 	__stmf_t *sh = (__stmf_t *)ptr;
1357 
1358 	/*
1359 	 * So far we dont need any struct specific processing. If such
1360 	 * a need ever arises, then store the struct id in the framework
1361 	 * private section and get it here as sh->fp->struct_id.
1362 	 */
1363 	kmem_free(ptr, sh->fp->alloc_size);
1364 }
1365 
1366 /*
1367  * Given a pointer to stmf_lu_t, verifies if this lu is registered with the
1368  * framework and returns a pointer to framework private data for the lu.
1369  * Returns NULL if the lu was not found.
1370  */
1371 stmf_i_lu_t *
1372 stmf_lookup_lu(stmf_lu_t *lu)
1373 {
1374 	stmf_i_lu_t *ilu;
1375 	ASSERT(mutex_owned(&stmf_state.stmf_lock));
1376 
1377 	for (ilu = stmf_state.stmf_ilulist; ilu != NULL; ilu = ilu->ilu_next) {
1378 		if (ilu->ilu_lu == lu)
1379 			return (ilu);
1380 	}
1381 	return (NULL);
1382 }
1383 
1384 /*
1385  * Given a pointer to stmf_lu_t, verifies if this lu is registered with the
1386  * framework and returns a pointer to framework private data for the lu.
1387  * Returns NULL if the lu was not found.
1388  */
1389 stmf_i_local_port_t *
1390 stmf_lookup_lport(stmf_local_port_t *lport)
1391 {
1392 	stmf_i_local_port_t *ilport;
1393 	ASSERT(mutex_owned(&stmf_state.stmf_lock));
1394 
1395 	for (ilport = stmf_state.stmf_ilportlist; ilport != NULL;
1396 	    ilport = ilport->ilport_next) {
1397 		if (ilport->ilport_lport == lport)
1398 			return (ilport);
1399 	}
1400 	return (NULL);
1401 }
1402 
1403 stmf_status_t
1404 stmf_register_lu_provider(stmf_lu_provider_t *lp)
1405 {
1406 	stmf_i_lu_provider_t *ilp = (stmf_i_lu_provider_t *)lp->lp_stmf_private;
1407 	stmf_pp_data_t *ppd;
1408 	uint32_t cb_flags;
1409 
1410 	if (lp->lp_lpif_rev != LPIF_REV_1)
1411 		return (STMF_FAILURE);
1412 
1413 	mutex_enter(&stmf_state.stmf_lock);
1414 	ilp->ilp_next = stmf_state.stmf_ilplist;
1415 	stmf_state.stmf_ilplist = ilp;
1416 	stmf_state.stmf_nlps++;
1417 
1418 	/* See if we need to do a callback */
1419 	for (ppd = stmf_state.stmf_ppdlist; ppd != NULL; ppd = ppd->ppd_next) {
1420 		if (strcmp(ppd->ppd_name, lp->lp_name) == 0) {
1421 			break;
1422 		}
1423 	}
1424 	if ((ppd == NULL) || (ppd->ppd_nv == NULL)) {
1425 		goto rlp_bail_out;
1426 	}
1427 	ilp->ilp_ppd = ppd;
1428 	ppd->ppd_provider = ilp;
1429 	if (lp->lp_cb == NULL)
1430 		goto rlp_bail_out;
1431 	ilp->ilp_cb_in_progress = 1;
1432 	cb_flags = STMF_PCB_PREG_COMPLETE;
1433 	if (stmf_state.stmf_config_state == STMF_CONFIG_INIT)
1434 		cb_flags |= STMF_PCB_STMF_ONLINING;
1435 	mutex_exit(&stmf_state.stmf_lock);
1436 	lp->lp_cb(lp, STMF_PROVIDER_DATA_UPDATED, ppd->ppd_nv, cb_flags);
1437 	mutex_enter(&stmf_state.stmf_lock);
1438 	ilp->ilp_cb_in_progress = 0;
1439 
1440 rlp_bail_out:
1441 	mutex_exit(&stmf_state.stmf_lock);
1442 
1443 	return (STMF_SUCCESS);
1444 }
1445 
1446 stmf_status_t
1447 stmf_deregister_lu_provider(stmf_lu_provider_t *lp)
1448 {
1449 	stmf_i_lu_provider_t	**ppilp;
1450 	stmf_i_lu_provider_t *ilp = (stmf_i_lu_provider_t *)lp->lp_stmf_private;
1451 
1452 	mutex_enter(&stmf_state.stmf_lock);
1453 	if (ilp->ilp_nlus || ilp->ilp_cb_in_progress) {
1454 		mutex_exit(&stmf_state.stmf_lock);
1455 		return (STMF_BUSY);
1456 	}
1457 	for (ppilp = &stmf_state.stmf_ilplist; *ppilp != NULL;
1458 	    ppilp = &((*ppilp)->ilp_next)) {
1459 		if (*ppilp == ilp) {
1460 			*ppilp = ilp->ilp_next;
1461 			stmf_state.stmf_nlps--;
1462 			if (ilp->ilp_ppd) {
1463 				ilp->ilp_ppd->ppd_provider = NULL;
1464 				ilp->ilp_ppd = NULL;
1465 			}
1466 			mutex_exit(&stmf_state.stmf_lock);
1467 			return (STMF_SUCCESS);
1468 		}
1469 	}
1470 	mutex_exit(&stmf_state.stmf_lock);
1471 	return (STMF_NOT_FOUND);
1472 }
1473 
1474 stmf_status_t
1475 stmf_register_port_provider(stmf_port_provider_t *pp)
1476 {
1477 	stmf_i_port_provider_t *ipp =
1478 	    (stmf_i_port_provider_t *)pp->pp_stmf_private;
1479 	stmf_pp_data_t *ppd;
1480 	uint32_t cb_flags;
1481 
1482 	if (pp->pp_portif_rev != PORTIF_REV_1)
1483 		return (STMF_FAILURE);
1484 
1485 	mutex_enter(&stmf_state.stmf_lock);
1486 	ipp->ipp_next = stmf_state.stmf_ipplist;
1487 	stmf_state.stmf_ipplist = ipp;
1488 	stmf_state.stmf_npps++;
1489 	/* See if we need to do a callback */
1490 	for (ppd = stmf_state.stmf_ppdlist; ppd != NULL; ppd = ppd->ppd_next) {
1491 		if (strcmp(ppd->ppd_name, pp->pp_name) == 0) {
1492 			break;
1493 		}
1494 	}
1495 	if ((ppd == NULL) || (ppd->ppd_nv == NULL)) {
1496 		goto rpp_bail_out;
1497 	}
1498 	ipp->ipp_ppd = ppd;
1499 	ppd->ppd_provider = ipp;
1500 	if (pp->pp_cb == NULL)
1501 		goto rpp_bail_out;
1502 	ipp->ipp_cb_in_progress = 1;
1503 	cb_flags = STMF_PCB_PREG_COMPLETE;
1504 	if (stmf_state.stmf_config_state == STMF_CONFIG_INIT)
1505 		cb_flags |= STMF_PCB_STMF_ONLINING;
1506 	mutex_exit(&stmf_state.stmf_lock);
1507 	pp->pp_cb(pp, STMF_PROVIDER_DATA_UPDATED, ppd->ppd_nv, cb_flags);
1508 	mutex_enter(&stmf_state.stmf_lock);
1509 	ipp->ipp_cb_in_progress = 0;
1510 
1511 rpp_bail_out:
1512 	mutex_exit(&stmf_state.stmf_lock);
1513 
1514 	return (STMF_SUCCESS);
1515 }
1516 
1517 stmf_status_t
1518 stmf_deregister_port_provider(stmf_port_provider_t *pp)
1519 {
1520 	stmf_i_port_provider_t *ipp =
1521 	    (stmf_i_port_provider_t *)pp->pp_stmf_private;
1522 	stmf_i_port_provider_t **ppipp;
1523 
1524 	mutex_enter(&stmf_state.stmf_lock);
1525 	if (ipp->ipp_npps || ipp->ipp_cb_in_progress) {
1526 		mutex_exit(&stmf_state.stmf_lock);
1527 		return (STMF_BUSY);
1528 	}
1529 	for (ppipp = &stmf_state.stmf_ipplist; *ppipp != NULL;
1530 	    ppipp = &((*ppipp)->ipp_next)) {
1531 		if (*ppipp == ipp) {
1532 			*ppipp = ipp->ipp_next;
1533 			stmf_state.stmf_npps--;
1534 			if (ipp->ipp_ppd) {
1535 				ipp->ipp_ppd->ppd_provider = NULL;
1536 				ipp->ipp_ppd = NULL;
1537 			}
1538 			mutex_exit(&stmf_state.stmf_lock);
1539 			return (STMF_SUCCESS);
1540 		}
1541 	}
1542 	mutex_exit(&stmf_state.stmf_lock);
1543 	return (STMF_NOT_FOUND);
1544 }
1545 
1546 int
1547 stmf_load_ppd_ioctl(stmf_ppioctl_data_t *ppi)
1548 {
1549 	stmf_i_port_provider_t		*ipp;
1550 	stmf_i_lu_provider_t		*ilp;
1551 	stmf_pp_data_t			*ppd;
1552 	nvlist_t			*nv;
1553 	int				s;
1554 	int				ret;
1555 
1556 	if ((ppi->ppi_lu_provider + ppi->ppi_port_provider) != 1) {
1557 		return (EINVAL);
1558 	}
1559 
1560 	mutex_enter(&stmf_state.stmf_lock);
1561 	for (ppd = stmf_state.stmf_ppdlist; ppd != NULL; ppd = ppd->ppd_next) {
1562 		if (ppi->ppi_lu_provider) {
1563 			if (!ppd->ppd_lu_provider)
1564 				continue;
1565 		} else if (ppi->ppi_port_provider) {
1566 			if (!ppd->ppd_port_provider)
1567 				continue;
1568 		}
1569 		if (strncmp(ppi->ppi_name, ppd->ppd_name, 254) == 0)
1570 			break;
1571 	}
1572 
1573 	if (ppd == NULL) {
1574 		/* New provider */
1575 		s = strlen(ppi->ppi_name);
1576 		if (s > 254) {
1577 			mutex_exit(&stmf_state.stmf_lock);
1578 			return (EINVAL);
1579 		}
1580 		s += sizeof (stmf_pp_data_t) - 7;
1581 
1582 		ppd = kmem_zalloc(s, KM_NOSLEEP);
1583 		if (ppd == NULL) {
1584 			mutex_exit(&stmf_state.stmf_lock);
1585 			return (ENOMEM);
1586 		}
1587 		ppd->ppd_alloc_size = s;
1588 		(void) strcpy(ppd->ppd_name, ppi->ppi_name);
1589 
1590 		/* See if this provider already exists */
1591 		if (ppi->ppi_lu_provider) {
1592 			ppd->ppd_lu_provider = 1;
1593 			for (ilp = stmf_state.stmf_ilplist; ilp != NULL;
1594 			    ilp = ilp->ilp_next) {
1595 				if (strcmp(ppi->ppi_name,
1596 				    ilp->ilp_lp->lp_name) == 0) {
1597 					ppd->ppd_provider = ilp;
1598 					ilp->ilp_ppd = ppd;
1599 					break;
1600 				}
1601 			}
1602 		} else {
1603 			ppd->ppd_port_provider = 1;
1604 			for (ipp = stmf_state.stmf_ipplist; ipp != NULL;
1605 			    ipp = ipp->ipp_next) {
1606 				if (strcmp(ppi->ppi_name,
1607 				    ipp->ipp_pp->pp_name) == 0) {
1608 					ppd->ppd_provider = ipp;
1609 					ipp->ipp_ppd = ppd;
1610 					break;
1611 				}
1612 			}
1613 		}
1614 
1615 		/* Link this ppd in */
1616 		ppd->ppd_next = stmf_state.stmf_ppdlist;
1617 		stmf_state.stmf_ppdlist = ppd;
1618 	}
1619 
1620 	if ((ret = nvlist_unpack((char *)ppi->ppi_data,
1621 	    (size_t)ppi->ppi_data_size, &nv, KM_NOSLEEP)) != 0) {
1622 		mutex_exit(&stmf_state.stmf_lock);
1623 		return (ret);
1624 	}
1625 
1626 	/* Free any existing lists and add this one to the ppd */
1627 	if (ppd->ppd_nv)
1628 		nvlist_free(ppd->ppd_nv);
1629 	ppd->ppd_nv = nv;
1630 
1631 	/* If there is a provider registered, do the notifications */
1632 	if (ppd->ppd_provider) {
1633 		uint32_t cb_flags = 0;
1634 
1635 		if (stmf_state.stmf_config_state == STMF_CONFIG_INIT)
1636 			cb_flags |= STMF_PCB_STMF_ONLINING;
1637 		if (ppi->ppi_lu_provider) {
1638 			ilp = (stmf_i_lu_provider_t *)ppd->ppd_provider;
1639 			if (ilp->ilp_lp->lp_cb == NULL)
1640 				goto bail_out;
1641 			ilp->ilp_cb_in_progress = 1;
1642 			mutex_exit(&stmf_state.stmf_lock);
1643 			ilp->ilp_lp->lp_cb(ilp->ilp_lp,
1644 			    STMF_PROVIDER_DATA_UPDATED, ppd->ppd_nv, cb_flags);
1645 			mutex_enter(&stmf_state.stmf_lock);
1646 			ilp->ilp_cb_in_progress = 0;
1647 		} else {
1648 			ipp = (stmf_i_port_provider_t *)ppd->ppd_provider;
1649 			if (ipp->ipp_pp->pp_cb == NULL)
1650 				goto bail_out;
1651 			ipp->ipp_cb_in_progress = 1;
1652 			mutex_exit(&stmf_state.stmf_lock);
1653 			ipp->ipp_pp->pp_cb(ipp->ipp_pp,
1654 			    STMF_PROVIDER_DATA_UPDATED, ppd->ppd_nv, cb_flags);
1655 			mutex_enter(&stmf_state.stmf_lock);
1656 			ipp->ipp_cb_in_progress = 0;
1657 		}
1658 	}
1659 
1660 bail_out:
1661 	mutex_exit(&stmf_state.stmf_lock);
1662 
1663 	return (0);
1664 }
1665 
1666 void
1667 stmf_delete_ppd(stmf_pp_data_t *ppd)
1668 {
1669 	stmf_pp_data_t **pppd;
1670 
1671 	ASSERT(mutex_owned(&stmf_state.stmf_lock));
1672 	if (ppd->ppd_provider) {
1673 		if (ppd->ppd_lu_provider) {
1674 			((stmf_i_lu_provider_t *)
1675 			    ppd->ppd_provider)->ilp_ppd = NULL;
1676 		} else {
1677 			((stmf_i_port_provider_t *)
1678 			    ppd->ppd_provider)->ipp_ppd = NULL;
1679 		}
1680 		ppd->ppd_provider = NULL;
1681 	}
1682 
1683 	for (pppd = &stmf_state.stmf_ppdlist; *pppd != NULL;
1684 			pppd = &((*pppd)->ppd_next)) {
1685 		if (*pppd == ppd)
1686 			break;
1687 	}
1688 
1689 	if (*pppd == NULL)
1690 		return;
1691 
1692 	*pppd = ppd->ppd_next;
1693 	if (ppd->ppd_nv)
1694 		nvlist_free(ppd->ppd_nv);
1695 
1696 	kmem_free(ppd, ppd->ppd_alloc_size);
1697 }
1698 
1699 int
1700 stmf_delete_ppd_ioctl(stmf_ppioctl_data_t *ppi)
1701 {
1702 	stmf_pp_data_t *ppd;
1703 	int ret = ENOENT;
1704 
1705 	if ((ppi->ppi_lu_provider + ppi->ppi_port_provider) != 1) {
1706 		return (EINVAL);
1707 	}
1708 
1709 	mutex_enter(&stmf_state.stmf_lock);
1710 
1711 	for (ppd = stmf_state.stmf_ppdlist; ppd != NULL; ppd = ppd->ppd_next) {
1712 		if (ppi->ppi_lu_provider) {
1713 			if (!ppd->ppd_lu_provider)
1714 				continue;
1715 		} else if (ppi->ppi_port_provider) {
1716 			if (!ppd->ppd_port_provider)
1717 				continue;
1718 		}
1719 		if (strncmp(ppi->ppi_name, ppd->ppd_name, 254) == 0)
1720 			break;
1721 	}
1722 
1723 	if (ppd) {
1724 		ret = 0;
1725 		stmf_delete_ppd(ppd);
1726 	}
1727 	mutex_exit(&stmf_state.stmf_lock);
1728 
1729 	return (ret);
1730 }
1731 
1732 void
1733 stmf_delete_all_ppds()
1734 {
1735 	stmf_pp_data_t *ppd, *nppd;
1736 
1737 	ASSERT(mutex_owned(&stmf_state.stmf_lock));
1738 	for (ppd = stmf_state.stmf_ppdlist; ppd != NULL; ppd = nppd) {
1739 		nppd = ppd->ppd_next;
1740 		stmf_delete_ppd(ppd);
1741 	}
1742 }
1743 
1744 stmf_status_t
1745 stmf_register_lu(stmf_lu_t *lu)
1746 {
1747 	stmf_i_lu_t *ilu;
1748 	uint8_t *p1, *p2;
1749 	stmf_state_change_info_t ssci;
1750 	stmf_id_data_t *luid;
1751 
1752 	if ((lu->lu_id->ident_type != ID_TYPE_NAA) ||
1753 	    (lu->lu_id->ident_length != 16) ||
1754 	    ((lu->lu_id->ident[0] & 0xf0) != 0x60)) {
1755 		return (STMF_INVALID_ARG);
1756 	}
1757 	p1 = &lu->lu_id->ident[0];
1758 	mutex_enter(&stmf_state.stmf_lock);
1759 	if (stmf_state.stmf_inventory_locked) {
1760 		mutex_exit(&stmf_state.stmf_lock);
1761 		return (STMF_BUSY);
1762 	}
1763 
1764 	for (ilu = stmf_state.stmf_ilulist; ilu != NULL; ilu = ilu->ilu_next) {
1765 		p2 = &ilu->ilu_lu->lu_id->ident[0];
1766 		if (bcmp(p1, p2, 16) == 0) {
1767 			mutex_exit(&stmf_state.stmf_lock);
1768 			return (STMF_ALREADY);
1769 		}
1770 	}
1771 
1772 	ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
1773 	luid = stmf_lookup_id(&stmf_state.stmf_luid_list,
1774 	    lu->lu_id->ident_length, lu->lu_id->ident);
1775 	if (luid) {
1776 		luid->id_pt_to_object = (void *)ilu;
1777 		ilu->ilu_luid = luid;
1778 	}
1779 	ilu->ilu_alias = NULL;
1780 
1781 	ilu->ilu_next = stmf_state.stmf_ilulist;
1782 	ilu->ilu_prev = NULL;
1783 	if (ilu->ilu_next)
1784 		ilu->ilu_next->ilu_prev = ilu;
1785 	stmf_state.stmf_ilulist = ilu;
1786 	stmf_state.stmf_nlus++;
1787 	if (lu->lu_lp) {
1788 		((stmf_i_lu_provider_t *)
1789 		    (lu->lu_lp->lp_stmf_private))->ilp_nlus++;
1790 	}
1791 	ilu->ilu_cur_task_cntr = &ilu->ilu_task_cntr1;
1792 	STMF_EVENT_ALLOC_HANDLE(ilu->ilu_event_hdl);
1793 	mutex_exit(&stmf_state.stmf_lock);
1794 
1795 	/* XXX we should probably check if this lu can be brought online */
1796 	ilu->ilu_prev_state = STMF_STATE_ONLINE;
1797 	if (stmf_state.stmf_service_running) {
1798 		ssci.st_rflags = 0;
1799 		ssci.st_additional_info = NULL;
1800 		(void) stmf_ctl(STMF_CMD_LU_ONLINE, lu, &ssci);
1801 	}
1802 
1803 	/* XXX: Generate event */
1804 	return (STMF_SUCCESS);
1805 }
1806 
1807 stmf_status_t
1808 stmf_deregister_lu(stmf_lu_t *lu)
1809 {
1810 	stmf_i_lu_t *ilu;
1811 
1812 	mutex_enter(&stmf_state.stmf_lock);
1813 	if (stmf_state.stmf_inventory_locked) {
1814 		mutex_exit(&stmf_state.stmf_lock);
1815 		return (STMF_BUSY);
1816 	}
1817 	ilu = stmf_lookup_lu(lu);
1818 	if (ilu == NULL) {
1819 		mutex_exit(&stmf_state.stmf_lock);
1820 		return (STMF_INVALID_ARG);
1821 	}
1822 	if (ilu->ilu_state == STMF_STATE_OFFLINE) {
1823 		ASSERT(ilu->ilu_ntasks == ilu->ilu_ntasks_free);
1824 		while (ilu->ilu_flags & ILU_STALL_DEREGISTER) {
1825 			cv_wait(&stmf_state.stmf_cv, &stmf_state.stmf_lock);
1826 		}
1827 		if (ilu->ilu_ntasks) {
1828 			stmf_i_scsi_task_t *itask, *nitask;
1829 
1830 			nitask = ilu->ilu_tasks;
1831 			do {
1832 				itask = nitask;
1833 				nitask = itask->itask_lu_next;
1834 				lu->lu_task_free(itask->itask_task);
1835 				stmf_free(itask->itask_task);
1836 			} while (nitask != NULL);
1837 
1838 			ilu->ilu_tasks = ilu->ilu_free_tasks = NULL;
1839 			ilu->ilu_ntasks = ilu->ilu_ntasks_free = 0;
1840 		}
1841 
1842 		if (ilu->ilu_next)
1843 			ilu->ilu_next->ilu_prev = ilu->ilu_prev;
1844 		if (ilu->ilu_prev)
1845 			ilu->ilu_prev->ilu_next = ilu->ilu_next;
1846 		else
1847 			stmf_state.stmf_ilulist = ilu->ilu_next;
1848 		stmf_state.stmf_nlus--;
1849 
1850 		if (ilu == stmf_state.stmf_svc_ilu_draining) {
1851 			stmf_state.stmf_svc_ilu_draining = ilu->ilu_next;
1852 		}
1853 		if (ilu == stmf_state.stmf_svc_ilu_timing) {
1854 			stmf_state.stmf_svc_ilu_timing = ilu->ilu_next;
1855 		}
1856 		if (lu->lu_lp) {
1857 			((stmf_i_lu_provider_t *)
1858 			    (lu->lu_lp->lp_stmf_private))->ilp_nlus--;
1859 		}
1860 		if (ilu->ilu_luid) {
1861 			((stmf_id_data_t *)ilu->ilu_luid)->id_pt_to_object =
1862 			    NULL;
1863 			ilu->ilu_luid = NULL;
1864 		}
1865 		STMF_EVENT_FREE_HANDLE(ilu->ilu_event_hdl);
1866 	} else {
1867 		mutex_exit(&stmf_state.stmf_lock);
1868 		return (STMF_BUSY);
1869 	}
1870 	mutex_exit(&stmf_state.stmf_lock);
1871 	return (STMF_SUCCESS);
1872 }
1873 
1874 stmf_status_t
1875 stmf_register_local_port(stmf_local_port_t *lport)
1876 {
1877 	stmf_i_local_port_t *ilport;
1878 	stmf_state_change_info_t ssci;
1879 	int start_workers = 0;
1880 
1881 	mutex_enter(&stmf_state.stmf_lock);
1882 	if (stmf_state.stmf_inventory_locked) {
1883 		mutex_exit(&stmf_state.stmf_lock);
1884 		return (STMF_BUSY);
1885 	}
1886 	ilport = (stmf_i_local_port_t *)lport->lport_stmf_private;
1887 	rw_init(&ilport->ilport_lock, NULL, RW_DRIVER, NULL);
1888 
1889 	ilport->ilport_next = stmf_state.stmf_ilportlist;
1890 	ilport->ilport_prev = NULL;
1891 	if (ilport->ilport_next)
1892 		ilport->ilport_next->ilport_prev = ilport;
1893 	stmf_state.stmf_ilportlist = ilport;
1894 	stmf_state.stmf_nlports++;
1895 	if (lport->lport_pp) {
1896 		((stmf_i_port_provider_t *)
1897 		    (lport->lport_pp->pp_stmf_private))->ipp_npps++;
1898 	}
1899 	ilport->ilport_tg =
1900 	    stmf_lookup_group_for_target(lport->lport_id->ident,
1901 		lport->lport_id->ident_length);
1902 	ilport->ilport_rtpid = atomic_add_16_nv(&stmf_rtpid_counter, 1);
1903 	STMF_EVENT_ALLOC_HANDLE(ilport->ilport_event_hdl);
1904 	if (stmf_workers_state == STMF_WORKERS_DISABLED) {
1905 		stmf_workers_state = STMF_WORKERS_ENABLING;
1906 		start_workers = 1;
1907 	}
1908 	mutex_exit(&stmf_state.stmf_lock);
1909 
1910 	if (start_workers)
1911 		stmf_worker_init();
1912 
1913 	/* XXX we should probably check if this lport can be brought online */
1914 	ilport->ilport_prev_state = STMF_STATE_ONLINE;
1915 	if (stmf_state.stmf_service_running) {
1916 		ssci.st_rflags = 0;
1917 		ssci.st_additional_info = NULL;
1918 		(void) stmf_ctl(STMF_CMD_LPORT_ONLINE, lport, &ssci);
1919 	}
1920 
1921 	/* XXX: Generate event */
1922 	return (STMF_SUCCESS);
1923 }
1924 
1925 stmf_status_t
1926 stmf_deregister_local_port(stmf_local_port_t *lport)
1927 {
1928 	stmf_i_local_port_t *ilport;
1929 
1930 	mutex_enter(&stmf_state.stmf_lock);
1931 	if (stmf_state.stmf_inventory_locked) {
1932 		mutex_exit(&stmf_state.stmf_lock);
1933 		return (STMF_BUSY);
1934 	}
1935 	ilport = (stmf_i_local_port_t *)lport->lport_stmf_private;
1936 	if (ilport->ilport_nsessions == 0) {
1937 		if (ilport->ilport_next)
1938 			ilport->ilport_next->ilport_prev = ilport->ilport_prev;
1939 		if (ilport->ilport_prev)
1940 			ilport->ilport_prev->ilport_next = ilport->ilport_next;
1941 		else
1942 			stmf_state.stmf_ilportlist = ilport->ilport_next;
1943 		rw_destroy(&ilport->ilport_lock);
1944 		stmf_state.stmf_nlports--;
1945 		if (lport->lport_pp) {
1946 			((stmf_i_port_provider_t *)
1947 			    (lport->lport_pp->pp_stmf_private))->ipp_npps--;
1948 		}
1949 		ilport->ilport_tg = NULL;
1950 		STMF_EVENT_FREE_HANDLE(ilport->ilport_event_hdl);
1951 	} else {
1952 		mutex_exit(&stmf_state.stmf_lock);
1953 		return (STMF_BUSY);
1954 	}
1955 	mutex_exit(&stmf_state.stmf_lock);
1956 	return (STMF_SUCCESS);
1957 }
1958 
1959 /*
1960  * Port provider has to make sure that register/deregister session and
1961  * port are serialized calls.
1962  */
1963 stmf_status_t
1964 stmf_register_scsi_session(stmf_local_port_t *lport, stmf_scsi_session_t *ss)
1965 {
1966 	stmf_i_scsi_session_t *iss;
1967 	stmf_i_local_port_t *ilport = (stmf_i_local_port_t *)
1968 	    lport->lport_stmf_private;
1969 	uint8_t		lun[8];
1970 
1971 	/*
1972 	 * Port state has to be online to register a scsi session. It is
1973 	 * possible that we started an offline operation and a new SCSI
1974 	 * session started at the same time (in that case also we are going
1975 	 * to fail the registeration). But any other state is simply
1976 	 * a bad port provider implementation.
1977 	 */
1978 	if (ilport->ilport_state != STMF_STATE_ONLINE) {
1979 		if (ilport->ilport_state != STMF_STATE_OFFLINING) {
1980 			stmf_trace(lport->lport_alias, "Port is trying to "
1981 			    "register a session while the state is neither "
1982 			    "online nor offlining");
1983 		}
1984 		return (STMF_FAILURE);
1985 	}
1986 	bzero(lun, 8);
1987 	iss = (stmf_i_scsi_session_t *)ss->ss_stmf_private;
1988 	iss->iss_flags |= ISS_BEING_CREATED;
1989 
1990 	/* sessions use the ilport_lock. No separate lock is required */
1991 	iss->iss_lockp = &ilport->ilport_lock;
1992 	(void) stmf_session_create_lun_map(ilport, iss);
1993 
1994 	rw_enter(&ilport->ilport_lock, RW_WRITER);
1995 	ilport->ilport_nsessions++;
1996 	iss->iss_next = ilport->ilport_ss_list;
1997 	ilport->ilport_ss_list = iss;
1998 	rw_exit(&ilport->ilport_lock);
1999 
2000 	iss->iss_creation_time = ddi_get_time();
2001 	ss->ss_session_id = atomic_add_64_nv(&stmf_session_counter, 1);
2002 	iss->iss_flags &= ~ISS_BEING_CREATED;
2003 	return (STMF_SUCCESS);
2004 }
2005 
2006 void
2007 stmf_deregister_scsi_session(stmf_local_port_t *lport, stmf_scsi_session_t *ss)
2008 {
2009 	stmf_i_local_port_t *ilport = (stmf_i_local_port_t *)
2010 					lport->lport_stmf_private;
2011 	stmf_i_scsi_session_t *iss, **ppss;
2012 	int found = 0;
2013 
2014 	iss = (stmf_i_scsi_session_t *)ss->ss_stmf_private;
2015 	if (ss->ss_rport_alias) {
2016 		ss->ss_rport_alias = NULL;
2017 	}
2018 
2019 try_dereg_ss_again:
2020 	mutex_enter(&stmf_state.stmf_lock);
2021 	atomic_and_32(&iss->iss_flags,
2022 		~(ISS_LUN_INVENTORY_CHANGED | ISS_GOT_INITIAL_LUNS));
2023 	if (iss->iss_flags & ISS_EVENT_ACTIVE) {
2024 		mutex_exit(&stmf_state.stmf_lock);
2025 		delay(1);
2026 		goto try_dereg_ss_again;
2027 	}
2028 	mutex_exit(&stmf_state.stmf_lock);
2029 	rw_enter(&ilport->ilport_lock, RW_WRITER);
2030 	for (ppss = &ilport->ilport_ss_list; *ppss != NULL;
2031 	    ppss = &((*ppss)->iss_next)) {
2032 		if (iss == (*ppss)) {
2033 			*ppss = (*ppss)->iss_next;
2034 			found = 1;
2035 			break;
2036 		}
2037 	}
2038 	if (!found) {
2039 		cmn_err(CE_PANIC, "Deregister session called for non existent"
2040 		    " session");
2041 	}
2042 	ilport->ilport_nsessions--;
2043 	rw_exit(&ilport->ilport_lock);
2044 
2045 	(void) stmf_session_destroy_lun_map(ilport, iss);
2046 }
2047 
2048 stmf_i_scsi_session_t *
2049 stmf_session_id_to_issptr(uint64_t session_id, int stay_locked)
2050 {
2051 	stmf_i_local_port_t *ilport;
2052 	stmf_i_scsi_session_t *iss;
2053 
2054 	mutex_enter(&stmf_state.stmf_lock);
2055 	for (ilport = stmf_state.stmf_ilportlist; ilport != NULL;
2056 					ilport = ilport->ilport_next) {
2057 		rw_enter(&ilport->ilport_lock, RW_WRITER);
2058 		for (iss = ilport->ilport_ss_list; iss != NULL;
2059 					iss = iss->iss_next) {
2060 			if (iss->iss_ss->ss_session_id == session_id) {
2061 				if (!stay_locked)
2062 					rw_exit(&ilport->ilport_lock);
2063 				mutex_exit(&stmf_state.stmf_lock);
2064 				return (iss);
2065 			}
2066 		}
2067 		rw_exit(&ilport->ilport_lock);
2068 	}
2069 	mutex_exit(&stmf_state.stmf_lock);
2070 	return (NULL);
2071 }
2072 
2073 void
2074 stmf_release_itl_handle(stmf_lu_t *lu, stmf_itl_data_t *itl)
2075 {
2076 	stmf_itl_data_t **itlpp;
2077 	stmf_i_lu_t *ilu;
2078 
2079 	ASSERT(itl->itl_flags & STMF_ITL_BEING_TERMINATED);
2080 
2081 	ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
2082 	mutex_enter(&ilu->ilu_task_lock);
2083 	for (itlpp = &ilu->ilu_itl_list; (*itlpp) != NULL;
2084 					itlpp = &(*itlpp)->itl_next) {
2085 		if ((*itlpp) == itl)
2086 			break;
2087 	}
2088 	ASSERT((*itlpp) != NULL);
2089 	*itlpp = itl->itl_next;
2090 	mutex_exit(&ilu->ilu_task_lock);
2091 	lu->lu_abort(lu, STMF_LU_ITL_HANDLE_REMOVED, itl->itl_handle,
2092 				(uint32_t)itl->itl_hdlrm_reason);
2093 	kmem_free(itl, sizeof (*itl));
2094 }
2095 
2096 stmf_status_t
2097 stmf_register_itl_handle(stmf_lu_t *lu, uint8_t *lun,
2098     stmf_scsi_session_t *ss, uint64_t session_id, void *itl_handle)
2099 {
2100 	stmf_itl_data_t *itl;
2101 	stmf_i_scsi_session_t *iss;
2102 	stmf_lun_map_ent_t *lun_map_ent;
2103 	stmf_i_lu_t *ilu;
2104 	uint16_t n;
2105 
2106 	ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
2107 	if (ss == NULL) {
2108 		iss = stmf_session_id_to_issptr(session_id, 1);
2109 		if (iss == NULL)
2110 			return (STMF_NOT_FOUND);
2111 	} else {
2112 		iss = (stmf_i_scsi_session_t *)ss->ss_stmf_private;
2113 		rw_enter(iss->iss_lockp, RW_WRITER);
2114 	}
2115 
2116 	n = ((uint16_t)lun[1] | (((uint16_t)(lun[0] & 0x3F)) << 8));
2117 	lun_map_ent = (stmf_lun_map_ent_t *)
2118 			stmf_get_ent_from_map(iss->iss_sm, n);
2119 	if ((lun_map_ent == NULL) || (lun_map_ent->ent_lu != lu)) {
2120 		rw_exit(iss->iss_lockp);
2121 		return (STMF_NOT_FOUND);
2122 	}
2123 	if (lun_map_ent->ent_itl_datap != NULL) {
2124 		rw_exit(iss->iss_lockp);
2125 		return (STMF_ALREADY);
2126 	}
2127 
2128 	itl = (stmf_itl_data_t *)kmem_zalloc(sizeof (*itl), KM_NOSLEEP);
2129 	if (itl == NULL) {
2130 		rw_exit(iss->iss_lockp);
2131 		return (STMF_ALLOC_FAILURE);
2132 	}
2133 
2134 	itl->itl_counter = 1;
2135 	itl->itl_lun = n;
2136 	itl->itl_handle = itl_handle;
2137 	itl->itl_session = iss;
2138 	mutex_enter(&ilu->ilu_task_lock);
2139 	itl->itl_next = ilu->ilu_itl_list;
2140 	ilu->ilu_itl_list = itl;
2141 	mutex_exit(&ilu->ilu_task_lock);
2142 	lun_map_ent->ent_itl_datap = itl;
2143 	rw_exit(iss->iss_lockp);
2144 
2145 	return (STMF_SUCCESS);
2146 }
2147 
2148 void
2149 stmf_do_itl_dereg(stmf_lu_t *lu, stmf_itl_data_t *itl, uint8_t hdlrm_reason)
2150 {
2151 	uint8_t old, new;
2152 
2153 	do {
2154 		old = new = itl->itl_flags;
2155 		if (old & STMF_ITL_BEING_TERMINATED)
2156 			return;
2157 		new |= STMF_ITL_BEING_TERMINATED;
2158 	} while (atomic_cas_8(&itl->itl_flags, old, new) != old);
2159 	itl->itl_hdlrm_reason = hdlrm_reason;
2160 
2161 	ASSERT(itl->itl_counter);
2162 
2163 	if (atomic_add_32_nv(&itl->itl_counter, -1))
2164 		return;
2165 
2166 	drv_usecwait(10);
2167 	if (itl->itl_counter)
2168 		return;
2169 
2170 	stmf_release_itl_handle(lu, itl);
2171 }
2172 
2173 stmf_status_t
2174 stmf_deregister_all_lu_itl_handles(stmf_lu_t *lu)
2175 {
2176 	stmf_i_lu_t *ilu;
2177 	stmf_i_local_port_t *ilport;
2178 	stmf_i_scsi_session_t *iss;
2179 	stmf_lun_map_t *lm;
2180 	stmf_lun_map_ent_t *ent;
2181 	uint32_t nmaps, nu;
2182 	stmf_itl_data_t **itl_list;
2183 	int i;
2184 
2185 	ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
2186 
2187 dereg_itl_start:;
2188 	nmaps = ilu->ilu_ref_cnt;
2189 	if (nmaps == 0)
2190 		return (STMF_NOT_FOUND);
2191 	itl_list = (stmf_itl_data_t **)kmem_zalloc(
2192 			nmaps * sizeof (stmf_itl_data_t *), KM_SLEEP);
2193 	mutex_enter(&stmf_state.stmf_lock);
2194 	if (nmaps != ilu->ilu_ref_cnt) {
2195 		/* Something changed, start all over */
2196 		mutex_exit(&stmf_state.stmf_lock);
2197 		kmem_free(itl_list, nmaps * sizeof (stmf_itl_data_t *));
2198 		goto dereg_itl_start;
2199 	}
2200 	nu = 0;
2201 	for (ilport = stmf_state.stmf_ilportlist; ilport != NULL;
2202 				ilport = ilport->ilport_next) {
2203 		rw_enter(&ilport->ilport_lock, RW_WRITER);
2204 		for (iss = ilport->ilport_ss_list; iss != NULL;
2205 					iss = iss->iss_next) {
2206 			lm = iss->iss_sm;
2207 			if (!lm)
2208 				continue;
2209 			for (i = 0; i < lm->lm_nentries; i++) {
2210 				if (lm->lm_plus[i] == NULL)
2211 					continue;
2212 				ent = (stmf_lun_map_ent_t *)lm->lm_plus[i];
2213 				if ((ent->ent_lu == lu) &&
2214 						(ent->ent_itl_datap)) {
2215 					itl_list[nu++] = ent->ent_itl_datap;
2216 					ent->ent_itl_datap = NULL;
2217 					if (nu == nmaps) {
2218 						rw_exit(&ilport->ilport_lock);
2219 						goto dai_scan_done;
2220 					}
2221 				}
2222 			} /* lun table for a session */
2223 		} /* sessions */
2224 		rw_exit(&ilport->ilport_lock);
2225 	} /* ports */
2226 
2227 dai_scan_done:
2228 	mutex_exit(&stmf_state.stmf_lock);
2229 
2230 	for (i = 0; i < nu; i++) {
2231 		stmf_do_itl_dereg(lu, itl_list[i],
2232 					STMF_ITL_REASON_DEREG_REQUEST);
2233 	}
2234 	kmem_free(itl_list, nmaps * sizeof (stmf_itl_data_t *));
2235 
2236 	return (STMF_SUCCESS);
2237 }
2238 
2239 stmf_status_t
2240 stmf_deregister_itl_handle(stmf_lu_t *lu, uint8_t *lun,
2241     stmf_scsi_session_t *ss, uint64_t session_id, void *itl_handle)
2242 {
2243 	stmf_i_scsi_session_t *iss;
2244 	stmf_itl_data_t *itl;
2245 	stmf_lun_map_ent_t *ent;
2246 	stmf_lun_map_t *lm;
2247 	int i;
2248 	uint16_t n;
2249 
2250 	if (ss == NULL) {
2251 		if (session_id == STMF_SESSION_ID_NONE)
2252 			return (STMF_INVALID_ARG);
2253 		iss = stmf_session_id_to_issptr(session_id, 1);
2254 		if (iss == NULL)
2255 			return (STMF_NOT_FOUND);
2256 	} else {
2257 		iss = (stmf_i_scsi_session_t *)ss->ss_stmf_private;
2258 		rw_enter(iss->iss_lockp, RW_WRITER);
2259 	}
2260 	lm = iss->iss_sm;
2261 	if (lm == NULL) {
2262 		rw_exit(iss->iss_lockp);
2263 		return (STMF_NOT_FOUND);
2264 	}
2265 
2266 	if (lun) {
2267 		n = ((uint16_t)lun[1] | (((uint16_t)(lun[0] & 0x3F)) << 8));
2268 		ent = (stmf_lun_map_ent_t *)
2269 				stmf_get_ent_from_map(iss->iss_sm, n);
2270 	} else {
2271 		if (itl_handle == NULL) {
2272 			rw_exit(iss->iss_lockp);
2273 			return (STMF_INVALID_ARG);
2274 		}
2275 		ent = NULL;
2276 		for (i = 0; i < lm->lm_nentries; i++) {
2277 			if (lm->lm_plus[i] == NULL)
2278 				continue;
2279 			ent = (stmf_lun_map_ent_t *)lm->lm_plus[i];
2280 			if (ent->ent_itl_datap &&
2281 			    (ent->ent_itl_datap->itl_handle == itl_handle)) {
2282 				break;
2283 			}
2284 		}
2285 	}
2286 	if ((ent == NULL) || (ent->ent_lu != lu) ||
2287 			(ent->ent_itl_datap == NULL)) {
2288 		rw_exit(iss->iss_lockp);
2289 		return (STMF_NOT_FOUND);
2290 	}
2291 	itl = ent->ent_itl_datap;
2292 	ent->ent_itl_datap = NULL;
2293 	rw_exit(iss->iss_lockp);
2294 	stmf_do_itl_dereg(lu, itl, STMF_ITL_REASON_DEREG_REQUEST);
2295 
2296 	return (STMF_SUCCESS);
2297 }
2298 
2299 stmf_status_t
2300 stmf_get_itl_handle(stmf_lu_t *lu, uint8_t *lun, stmf_scsi_session_t *ss,
2301     uint64_t session_id, void **itl_handle_retp)
2302 {
2303 	stmf_i_scsi_session_t *iss;
2304 	stmf_lun_map_ent_t *ent;
2305 	stmf_lun_map_t *lm;
2306 	stmf_status_t ret;
2307 	int i;
2308 	uint16_t n;
2309 
2310 	if (ss == NULL) {
2311 		iss = stmf_session_id_to_issptr(session_id, 1);
2312 		if (iss == NULL)
2313 			return (STMF_NOT_FOUND);
2314 	} else {
2315 		iss = (stmf_i_scsi_session_t *)ss->ss_stmf_private;
2316 		rw_enter(iss->iss_lockp, RW_WRITER);
2317 	}
2318 
2319 	ent = NULL;
2320 	if (lun == NULL) {
2321 		lm = iss->iss_sm;
2322 		for (i = 0; i < lm->lm_nentries; i++) {
2323 			if (lm->lm_plus[i] == NULL)
2324 				continue;
2325 			ent = (stmf_lun_map_ent_t *)lm->lm_plus[i];
2326 			if (ent->ent_lu == lu)
2327 				break;
2328 		}
2329 	} else {
2330 		n = ((uint16_t)lun[1] | (((uint16_t)(lun[0] & 0x3F)) << 8));
2331 		ent = (stmf_lun_map_ent_t *)
2332 				stmf_get_ent_from_map(iss->iss_sm, n);
2333 		if (lu && (ent->ent_lu != lu))
2334 			ent = NULL;
2335 	}
2336 	if (ent && ent->ent_itl_datap) {
2337 		*itl_handle_retp = ent->ent_itl_datap->itl_handle;
2338 		ret = STMF_SUCCESS;
2339 	} else {
2340 		ret = STMF_NOT_FOUND;
2341 	}
2342 
2343 	rw_exit(iss->iss_lockp);
2344 	return (ret);
2345 }
2346 
2347 stmf_data_buf_t *
2348 stmf_alloc_dbuf(scsi_task_t *task, uint32_t size, uint32_t *pminsize,
2349     uint32_t flags)
2350 {
2351 	stmf_i_scsi_task_t *itask =
2352 	    (stmf_i_scsi_task_t *)task->task_stmf_private;
2353 	stmf_local_port_t *lport = task->task_lport;
2354 	stmf_data_buf_t *dbuf;
2355 	uint8_t ndx;
2356 
2357 	ndx = stmf_first_zero[itask->itask_allocated_buf_map];
2358 	if (ndx == 0xff)
2359 		return (NULL);
2360 	dbuf = itask->itask_dbufs[ndx] = lport->lport_ds->ds_alloc_data_buf(
2361 	    task, size, pminsize, flags);
2362 	if (dbuf) {
2363 		task->task_cur_nbufs++;
2364 		itask->itask_allocated_buf_map |= (1 << ndx);
2365 		dbuf->db_handle = ndx;
2366 		return (dbuf);
2367 	}
2368 
2369 	return (NULL);
2370 }
2371 
2372 void
2373 stmf_free_dbuf(scsi_task_t *task, stmf_data_buf_t *dbuf)
2374 {
2375 	stmf_i_scsi_task_t *itask =
2376 	    (stmf_i_scsi_task_t *)task->task_stmf_private;
2377 	stmf_local_port_t *lport = task->task_lport;
2378 
2379 	itask->itask_allocated_buf_map &= ~(1 << dbuf->db_handle);
2380 	task->task_cur_nbufs--;
2381 	lport->lport_ds->ds_free_data_buf(lport->lport_ds, dbuf);
2382 }
2383 
2384 stmf_data_buf_t *
2385 stmf_handle_to_buf(scsi_task_t *task, uint8_t h)
2386 {
2387 	stmf_i_scsi_task_t *itask;
2388 
2389 	itask = (stmf_i_scsi_task_t *)task->task_stmf_private;
2390 	if (h > 3)
2391 		return (NULL);
2392 	return (itask->itask_dbufs[h]);
2393 }
2394 
2395 /* ARGSUSED */
2396 struct scsi_task *
2397 stmf_task_alloc(struct stmf_local_port *lport, stmf_scsi_session_t *ss,
2398 			uint8_t *lun, uint16_t cdb_length_in, uint16_t ext_id)
2399 {
2400 	stmf_lu_t *lu;
2401 	stmf_i_scsi_session_t *iss;
2402 	stmf_i_lu_t *ilu;
2403 	stmf_i_scsi_task_t *itask;
2404 	stmf_i_scsi_task_t **ppitask;
2405 	scsi_task_t *task;
2406 	uint64_t *p;
2407 	uint8_t	*l;
2408 	stmf_lun_map_ent_t *lun_map_ent;
2409 	uint16_t cdb_length;
2410 	uint16_t luNbr;
2411 	uint8_t new_task = 0;
2412 
2413 	/*
2414 	 * We allocate 7 extra bytes for CDB to provide a cdb pointer which
2415 	 * is guaranteed to be 8 byte aligned. Some LU providers like OSD
2416 	 * depend upon this alignment.
2417 	 */
2418 	if (cdb_length_in >= 16)
2419 		cdb_length = cdb_length_in + 7;
2420 	else
2421 		cdb_length = 16 + 7;
2422 	iss = (stmf_i_scsi_session_t *)ss->ss_stmf_private;
2423 	luNbr = ((uint16_t)lun[1] | (((uint16_t)(lun[0] & 0x3F)) << 8));
2424 	rw_enter(iss->iss_lockp, RW_READER);
2425 	lun_map_ent =
2426 	    (stmf_lun_map_ent_t *)stmf_get_ent_from_map(iss->iss_sm, luNbr);
2427 	if (!lun_map_ent) {
2428 		lu = dlun0;
2429 	} else {
2430 		lu = lun_map_ent->ent_lu;
2431 	}
2432 	ilu = lu->lu_stmf_private;
2433 	if (ilu->ilu_flags & ILU_RESET_ACTIVE) {
2434 		rw_exit(iss->iss_lockp);
2435 		return (NULL);
2436 	}
2437 	do {
2438 		if (ilu->ilu_free_tasks == NULL) {
2439 			new_task = 1;
2440 			break;
2441 		}
2442 		mutex_enter(&ilu->ilu_task_lock);
2443 		for (ppitask = &ilu->ilu_free_tasks; (*ppitask != NULL) &&
2444 		    ((*ppitask)->itask_cdb_buf_size < cdb_length);
2445 		    ppitask = &((*ppitask)->itask_lu_free_next));
2446 		if (*ppitask) {
2447 			itask = *ppitask;
2448 			*ppitask = (*ppitask)->itask_lu_free_next;
2449 			ilu->ilu_ntasks_free--;
2450 			if (ilu->ilu_ntasks_free < ilu->ilu_ntasks_min_free)
2451 				ilu->ilu_ntasks_min_free = ilu->ilu_ntasks_free;
2452 		} else {
2453 			new_task = 1;
2454 		}
2455 		mutex_exit(&ilu->ilu_task_lock);
2456 	/* CONSTCOND */
2457 	} while (0);
2458 
2459 	if (!new_task) {
2460 		task = itask->itask_task;
2461 		task->task_timeout = 0;
2462 		p = (uint64_t *)&task->task_flags;
2463 		*p++ = 0; *p++ = 0; p++; p++; *p++ = 0; *p++ = 0; *p = 0;
2464 		itask->itask_ncmds = 0;
2465 	} else {
2466 		task = (scsi_task_t *)stmf_alloc(STMF_STRUCT_SCSI_TASK,
2467 		    cdb_length, AF_FORCE_NOSLEEP);
2468 		if (task == NULL) {
2469 			rw_exit(iss->iss_lockp);
2470 			return (NULL);
2471 		}
2472 		task->task_lu = lu;
2473 		l = task->task_lun_no;
2474 		l[0] = lun[0];
2475 		l[1] = lun[1];
2476 		l[2] = lun[2];
2477 		l[3] = lun[3];
2478 		l[4] = lun[4];
2479 		l[5] = lun[5];
2480 		l[6] = lun[6];
2481 		l[7] = lun[7];
2482 		task->task_cdb = (uint8_t *)task->task_port_private;
2483 		if ((ulong_t)(task->task_cdb) & 7ul) {
2484 			task->task_cdb = (uint8_t *)(((ulong_t)
2485 			    (task->task_cdb) + 7ul) & ~(7ul));
2486 		}
2487 		itask = (stmf_i_scsi_task_t *)task->task_stmf_private;
2488 		itask->itask_cdb_buf_size = cdb_length;
2489 	}
2490 	task->task_session = ss;
2491 	task->task_lport = lport;
2492 	task->task_cdb_length = cdb_length_in;
2493 	itask->itask_flags = ITASK_IN_TRANSITION;
2494 
2495 	if (new_task) {
2496 		if (lu->lu_task_alloc(task) != STMF_SUCCESS) {
2497 			rw_exit(iss->iss_lockp);
2498 			stmf_free(task);
2499 			return (NULL);
2500 		}
2501 		mutex_enter(&ilu->ilu_task_lock);
2502 		if (ilu->ilu_flags & ILU_RESET_ACTIVE) {
2503 			mutex_exit(&ilu->ilu_task_lock);
2504 			rw_exit(iss->iss_lockp);
2505 			stmf_free(task);
2506 			return (NULL);
2507 		}
2508 		itask->itask_lu_next = ilu->ilu_tasks;
2509 		if (ilu->ilu_tasks)
2510 			ilu->ilu_tasks->itask_lu_prev = itask;
2511 		ilu->ilu_tasks = itask;
2512 		/* kmem_zalloc automatically makes itask->itask_lu_prev NULL */
2513 		ilu->ilu_ntasks++;
2514 		mutex_exit(&ilu->ilu_task_lock);
2515 	}
2516 
2517 	itask->itask_ilu_task_cntr = ilu->ilu_cur_task_cntr;
2518 	atomic_add_32(itask->itask_ilu_task_cntr, 1);
2519 	itask->itask_start_time = ddi_get_lbolt();
2520 
2521 	if ((lun_map_ent != NULL) && ((itask->itask_itl_datap =
2522 	    lun_map_ent->ent_itl_datap) != NULL)) {
2523 		atomic_add_32(&itask->itask_itl_datap->itl_counter, 1);
2524 		task->task_lu_itl_handle = itask->itask_itl_datap->itl_handle;
2525 	} else {
2526 		itask->itask_itl_datap = NULL;
2527 		task->task_lu_itl_handle = NULL;
2528 	}
2529 
2530 	rw_exit(iss->iss_lockp);
2531 	return (task);
2532 }
2533 
2534 void
2535 stmf_task_lu_free(scsi_task_t *task)
2536 {
2537 	stmf_i_scsi_task_t *itask =
2538 	    (stmf_i_scsi_task_t *)task->task_stmf_private;
2539 	stmf_i_scsi_session_t *iss = (stmf_i_scsi_session_t *)
2540 	    task->task_session->ss_stmf_private;
2541 	stmf_i_lu_t *ilu = (stmf_i_lu_t *)task->task_lu->lu_stmf_private;
2542 
2543 	rw_enter(iss->iss_lockp, RW_READER);
2544 	itask->itask_flags = ITASK_IN_FREE_LIST;
2545 	mutex_enter(&ilu->ilu_task_lock);
2546 	itask->itask_lu_free_next = ilu->ilu_free_tasks;
2547 	ilu->ilu_free_tasks = itask;
2548 	ilu->ilu_ntasks_free++;
2549 	mutex_exit(&ilu->ilu_task_lock);
2550 	atomic_add_32(itask->itask_ilu_task_cntr, -1);
2551 	rw_exit(iss->iss_lockp);
2552 }
2553 
2554 void
2555 stmf_task_lu_check_freelist(stmf_i_lu_t *ilu)
2556 {
2557 	uint32_t	num_to_release, ndx;
2558 	stmf_i_scsi_task_t *itask;
2559 	stmf_lu_t	*lu = ilu->ilu_lu;
2560 
2561 	ASSERT(ilu->ilu_ntasks_min_free <= ilu->ilu_ntasks_free);
2562 
2563 	/* free half of the minimal free of the free tasks */
2564 	num_to_release = (ilu->ilu_ntasks_min_free + 1) / 2;
2565 	if (!num_to_release) {
2566 		return;
2567 	}
2568 	for (ndx = 0; ndx < num_to_release; ndx++) {
2569 		mutex_enter(&ilu->ilu_task_lock);
2570 		itask = ilu->ilu_free_tasks;
2571 		if (itask == NULL) {
2572 			mutex_exit(&ilu->ilu_task_lock);
2573 			break;
2574 		}
2575 		ilu->ilu_free_tasks = itask->itask_lu_free_next;
2576 		ilu->ilu_ntasks_free--;
2577 		mutex_exit(&ilu->ilu_task_lock);
2578 
2579 		lu->lu_task_free(itask->itask_task);
2580 		mutex_enter(&ilu->ilu_task_lock);
2581 		if (itask->itask_lu_next)
2582 			itask->itask_lu_next->itask_lu_prev =
2583 			    itask->itask_lu_prev;
2584 		if (itask->itask_lu_prev)
2585 			itask->itask_lu_prev->itask_lu_next =
2586 			    itask->itask_lu_next;
2587 		else
2588 			ilu->ilu_tasks = itask->itask_lu_next;
2589 
2590 		ilu->ilu_ntasks--;
2591 		mutex_exit(&ilu->ilu_task_lock);
2592 		stmf_free(itask->itask_task);
2593 	}
2594 }
2595 
2596 /*
2597  * Called with stmf_lock held
2598  */
2599 void
2600 stmf_check_freetask()
2601 {
2602 	stmf_i_lu_t *ilu;
2603 	clock_t	endtime = ddi_get_lbolt() + drv_usectohz(10000);
2604 
2605 	/* stmf_svc_ilu_draining may get changed after stmf_lock is released */
2606 	while ((ilu = stmf_state.stmf_svc_ilu_draining) != NULL) {
2607 		stmf_state.stmf_svc_ilu_draining = ilu->ilu_next;
2608 		if (!ilu->ilu_ntasks_min_free) {
2609 			ilu->ilu_ntasks_min_free = ilu->ilu_ntasks_free;
2610 			continue;
2611 		}
2612 		ilu->ilu_flags |= ILU_STALL_DEREGISTER;
2613 		mutex_exit(&stmf_state.stmf_lock);
2614 		stmf_task_lu_check_freelist(ilu);
2615 		/*
2616 		 * we do not care about the accuracy of
2617 		 * ilu_ntasks_min_free, so we don't lock here
2618 		 */
2619 		ilu->ilu_ntasks_min_free = ilu->ilu_ntasks_free;
2620 		mutex_enter(&stmf_state.stmf_lock);
2621 		ilu->ilu_flags &= ~ILU_STALL_DEREGISTER;
2622 		cv_broadcast(&stmf_state.stmf_cv);
2623 		if (ddi_get_lbolt() >= endtime)
2624 			break;
2625 	}
2626 }
2627 
2628 void
2629 stmf_do_ilu_timeouts(stmf_i_lu_t *ilu)
2630 {
2631 	clock_t l = ddi_get_lbolt();
2632 	clock_t ps = drv_usectohz(1000000);
2633 	stmf_i_scsi_task_t *itask;
2634 	scsi_task_t *task;
2635 	uint32_t to;
2636 
2637 	mutex_enter(&ilu->ilu_task_lock);
2638 	for (itask = ilu->ilu_tasks; itask != NULL;
2639 	    itask = itask->itask_lu_next) {
2640 		if (itask->itask_flags & (ITASK_IN_FREE_LIST |
2641 		    ITASK_BEING_ABORTED)) {
2642 			continue;
2643 		}
2644 		task = itask->itask_task;
2645 		if (task->task_timeout == 0)
2646 			to = stmf_default_task_timeout;
2647 		else
2648 			to = task->task_timeout;
2649 		if ((itask->itask_start_time + (to * ps)) > l)
2650 			continue;
2651 		stmf_abort(STMF_QUEUE_TASK_ABORT, task,
2652 		    STMF_TIMEOUT, NULL);
2653 	}
2654 	mutex_exit(&ilu->ilu_task_lock);
2655 }
2656 
2657 /*
2658  * Called with stmf_lock held
2659  */
2660 void
2661 stmf_check_ilu_timing()
2662 {
2663 	stmf_i_lu_t *ilu;
2664 	clock_t	endtime = ddi_get_lbolt() + drv_usectohz(10000);
2665 
2666 	/* stmf_svc_ilu_timing may get changed after stmf_lock is released */
2667 	while ((ilu = stmf_state.stmf_svc_ilu_timing) != NULL) {
2668 		stmf_state.stmf_svc_ilu_timing = ilu->ilu_next;
2669 		if (ilu->ilu_cur_task_cntr == (&ilu->ilu_task_cntr1)) {
2670 			if (ilu->ilu_task_cntr2 == 0) {
2671 				ilu->ilu_cur_task_cntr = &ilu->ilu_task_cntr2;
2672 				continue;
2673 			}
2674 		} else {
2675 			if (ilu->ilu_task_cntr1 == 0) {
2676 				ilu->ilu_cur_task_cntr = &ilu->ilu_task_cntr1;
2677 				continue;
2678 			}
2679 		}
2680 		/*
2681 		 * If we are here then it means that there is some slowdown
2682 		 * in tasks on this lu. We need to check.
2683 		 */
2684 		ilu->ilu_flags |= ILU_STALL_DEREGISTER;
2685 		mutex_exit(&stmf_state.stmf_lock);
2686 		stmf_do_ilu_timeouts(ilu);
2687 		mutex_enter(&stmf_state.stmf_lock);
2688 		ilu->ilu_flags &= ~ILU_STALL_DEREGISTER;
2689 		cv_broadcast(&stmf_state.stmf_cv);
2690 		if (ddi_get_lbolt() >= endtime)
2691 			break;
2692 	}
2693 }
2694 
2695 /*
2696  * Kills all tasks on a lu except tm_task
2697  */
2698 void
2699 stmf_task_lu_killall(stmf_lu_t *lu, scsi_task_t *tm_task, stmf_status_t s)
2700 {
2701 	stmf_i_lu_t *ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
2702 	stmf_i_scsi_task_t *itask;
2703 
2704 	mutex_enter(&ilu->ilu_task_lock);
2705 
2706 	for (itask = ilu->ilu_tasks; itask != NULL;
2707 	    itask = itask->itask_lu_next) {
2708 		if (itask->itask_flags & ITASK_IN_FREE_LIST)
2709 			continue;
2710 		if (itask->itask_task == tm_task)
2711 			continue;
2712 		stmf_abort(STMF_QUEUE_TASK_ABORT, itask->itask_task, s, NULL);
2713 	}
2714 	mutex_exit(&ilu->ilu_task_lock);
2715 }
2716 
2717 void
2718 stmf_free_task_bufs(stmf_i_scsi_task_t *itask, stmf_local_port_t *lport)
2719 {
2720 	int i;
2721 	uint8_t map;
2722 
2723 	if ((map = itask->itask_allocated_buf_map) != 0) {
2724 		for (i = 0; i < 4; i++) {
2725 			if (map & 1) {
2726 				stmf_data_buf_t *dbuf;
2727 
2728 				dbuf = itask->itask_dbufs[i];
2729 				if (dbuf->db_lu_private) {
2730 					dbuf->db_lu_private = NULL;
2731 				}
2732 				lport->lport_ds->ds_free_data_buf(
2733 				    lport->lport_ds, dbuf);
2734 			}
2735 			map >>= 1;
2736 		}
2737 		itask->itask_allocated_buf_map = 0;
2738 	}
2739 }
2740 
2741 void
2742 stmf_task_free(scsi_task_t *task)
2743 {
2744 	stmf_local_port_t *lport = task->task_lport;
2745 	stmf_i_scsi_task_t *itask = (stmf_i_scsi_task_t *)
2746 					task->task_stmf_private;
2747 
2748 	stmf_free_task_bufs(itask, lport);
2749 	if (itask->itask_itl_datap) {
2750 		if (atomic_add_32_nv(&itask->itask_itl_datap->itl_counter,
2751 		    -1) == 0) {
2752 			stmf_release_itl_handle(task->task_lu,
2753 						itask->itask_itl_datap);
2754 		}
2755 	}
2756 	lport->lport_task_free(task);
2757 	if (itask->itask_worker) {
2758 		atomic_add_32(&stmf_cur_ntasks, -1);
2759 		atomic_add_32(&itask->itask_worker->worker_ref_count, -1);
2760 	}
2761 	/*
2762 	 * After calling stmf_task_lu_free, the task pointer can no longer
2763 	 * be trusted.
2764 	 */
2765 	stmf_task_lu_free(task);
2766 }
2767 
2768 void
2769 stmf_post_task(scsi_task_t *task, stmf_data_buf_t *dbuf)
2770 {
2771 	stmf_i_scsi_task_t *itask = (stmf_i_scsi_task_t *)
2772 	    task->task_stmf_private;
2773 	stmf_i_lu_t *ilu = (stmf_i_lu_t *)task->task_lu->lu_stmf_private;
2774 	int nv;
2775 	uint32_t old, new;
2776 	uint32_t ct;
2777 	stmf_worker_t *w, *w1;
2778 	uint8_t tm;
2779 
2780 	if (task->task_max_nbufs > 4)
2781 		task->task_max_nbufs = 4;
2782 	task->task_cur_nbufs = 0;
2783 	/* Latest value of currently running tasks */
2784 	ct = atomic_add_32_nv(&stmf_cur_ntasks, 1);
2785 
2786 	/* Select the next worker using round robin */
2787 	nv = (int)atomic_add_32_nv((uint32_t *)&stmf_worker_sel_counter, 1);
2788 	if (nv >= stmf_nworkers_accepting_cmds) {
2789 		int s = nv;
2790 		do {
2791 			nv -= stmf_nworkers_accepting_cmds;
2792 		} while (nv >= stmf_nworkers_accepting_cmds);
2793 		if (nv < 0)
2794 			nv = 0;
2795 		/* Its ok if this cas fails */
2796 		(void) atomic_cas_32((uint32_t *)&stmf_worker_sel_counter,
2797 		    s, nv);
2798 	}
2799 	w = &stmf_workers[nv];
2800 
2801 	/*
2802 	 * A worker can be pinned by interrupt. So select the next one
2803 	 * if it has lower load.
2804 	 */
2805 	if ((nv + 1) >= stmf_nworkers_accepting_cmds) {
2806 		w1 = stmf_workers;
2807 	} else {
2808 		w1 = &stmf_workers[nv + 1];
2809 	}
2810 	if (w1->worker_queue_depth < w->worker_queue_depth)
2811 		w = w1;
2812 	mutex_enter(&w->worker_lock);
2813 	if (((w->worker_flags & STMF_WORKER_STARTED) == 0) ||
2814 	    (w->worker_flags & STMF_WORKER_TERMINATE)) {
2815 		/*
2816 		 * Maybe we are in the middle of a change. Just go to
2817 		 * the 1st worker.
2818 		 */
2819 		mutex_exit(&w->worker_lock);
2820 		w = stmf_workers;
2821 		mutex_enter(&w->worker_lock);
2822 	}
2823 	itask->itask_worker = w;
2824 	/*
2825 	 * Track max system load inside the worker as we already have the
2826 	 * worker lock (no point implementing another lock). The service
2827 	 * thread will do the comparisons and figure out the max overall
2828 	 * system load.
2829 	 */
2830 	if (w->worker_max_sys_qdepth_pu < ct)
2831 		w->worker_max_sys_qdepth_pu = ct;
2832 
2833 	do {
2834 		old = new = itask->itask_flags;
2835 		new |= ITASK_KNOWN_TO_TGT_PORT | ITASK_IN_WORKER_QUEUE;
2836 		if (task->task_mgmt_function) {
2837 			tm = task->task_mgmt_function;
2838 			if ((tm == TM_TARGET_RESET) ||
2839 			    (tm == TM_TARGET_COLD_RESET) ||
2840 			    (tm == TM_TARGET_WARM_RESET)) {
2841 				new |= ITASK_DEFAULT_HANDLING;
2842 			}
2843 		} else if (task->task_cdb[0] == SCMD_REPORT_LUNS) {
2844 			new |= ITASK_DEFAULT_HANDLING;
2845 		}
2846 		new &= ~ITASK_IN_TRANSITION;
2847 	} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
2848 	itask->itask_worker_next = NULL;
2849 	if (w->worker_task_tail) {
2850 		w->worker_task_tail->itask_worker_next = itask;
2851 	} else {
2852 		w->worker_task_head = itask;
2853 	}
2854 	w->worker_task_tail = itask;
2855 	if (++(w->worker_queue_depth) > w->worker_max_qdepth_pu) {
2856 		w->worker_max_qdepth_pu = w->worker_queue_depth;
2857 	}
2858 	atomic_add_32(&w->worker_ref_count, 1);
2859 	itask->itask_cmd_stack[0] = ITASK_CMD_NEW_TASK;
2860 	itask->itask_ncmds = 1;
2861 	if (dbuf) {
2862 		itask->itask_allocated_buf_map = 1;
2863 		itask->itask_dbufs[0] = dbuf;
2864 		dbuf->db_handle = 0;
2865 	} else {
2866 		itask->itask_allocated_buf_map = 0;
2867 		itask->itask_dbufs[0] = NULL;
2868 	}
2869 	if ((w->worker_flags & STMF_WORKER_ACTIVE) == 0)
2870 		cv_signal(&w->worker_cv);
2871 	mutex_exit(&w->worker_lock);
2872 
2873 	/*
2874 	 * This can only happen if during stmf_task_alloc(), ILU_RESET_ACTIVE
2875 	 * was set between checking of ILU_RESET_ACTIVE and clearing of the
2876 	 * ITASK_IN_FREE_LIST flag. Take care of these "sneaked-in" tasks here.
2877 	 */
2878 	if (ilu->ilu_flags & ILU_RESET_ACTIVE) {
2879 		stmf_abort(STMF_QUEUE_TASK_ABORT, task, STMF_ABORTED, NULL);
2880 	}
2881 }
2882 
2883 /*
2884  * ++++++++++++++ ABORT LOGIC ++++++++++++++++++++
2885  * Once ITASK_BEING_ABORTED is set, ITASK_KNOWN_TO_LU can be reset already
2886  * i.e. before ITASK_BEING_ABORTED being set. But if it was not, it cannot
2887  * be reset until the LU explicitly calls stmf_task_lu_aborted(). Of course
2888  * the LU will make this call only if we call the LU's abort entry point.
2889  * we will only call that entry point if ITASK_KNOWN_TO_LU was set.
2890  *
2891  * Same logic applies for the port.
2892  *
2893  * Also ITASK_BEING_ABORTED will not be allowed to set if both KNOWN_TO_LU
2894  * and KNOWN_TO_TGT_PORT are reset.
2895  *
2896  * +++++++++++++++++++++++++++++++++++++++++++++++
2897  */
2898 
2899 stmf_status_t
2900 stmf_xfer_data(scsi_task_t *task, stmf_data_buf_t *dbuf, uint32_t ioflags)
2901 {
2902 	stmf_i_scsi_task_t *itask =
2903 	    (stmf_i_scsi_task_t *)task->task_stmf_private;
2904 
2905 	if (ioflags & STMF_IOF_LU_DONE) {
2906 		uint32_t new, old;
2907 		do {
2908 			new = old = itask->itask_flags;
2909 			if (new & ITASK_BEING_ABORTED)
2910 				return (STMF_ABORTED);
2911 			new &= ~ITASK_KNOWN_TO_LU;
2912 		} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
2913 	}
2914 	if (itask->itask_flags & ITASK_BEING_ABORTED)
2915 		return (STMF_ABORTED);
2916 #ifdef	DEBUG
2917 	if (stmf_drop_buf_counter > 0) {
2918 		if (atomic_add_32_nv((uint32_t *)&stmf_drop_buf_counter,
2919 								-1) == 1)
2920 			return (STMF_SUCCESS);
2921 	}
2922 #endif
2923 	return (task->task_lport->lport_xfer_data(task, dbuf, ioflags));
2924 }
2925 
2926 void
2927 stmf_data_xfer_done(scsi_task_t *task, stmf_data_buf_t *dbuf, uint32_t iof)
2928 {
2929 	stmf_i_scsi_task_t *itask =
2930 	    (stmf_i_scsi_task_t *)task->task_stmf_private;
2931 	stmf_worker_t *w = itask->itask_worker;
2932 	uint32_t new, old;
2933 	uint8_t update_queue_flags, free_it, queue_it;
2934 
2935 	mutex_enter(&w->worker_lock);
2936 	do {
2937 		new = old = itask->itask_flags;
2938 		if (old & ITASK_BEING_ABORTED) {
2939 			mutex_exit(&w->worker_lock);
2940 			return;
2941 		}
2942 		free_it = 0;
2943 		if (iof & STMF_IOF_LPORT_DONE) {
2944 			new &= ~ITASK_KNOWN_TO_TGT_PORT;
2945 			task->task_completion_status = dbuf->db_xfer_status;
2946 			free_it = 1;
2947 		}
2948 		/*
2949 		 * If the task is known to LU then queue it. But if
2950 		 * it is already queued (multiple completions) then
2951 		 * just update the buffer information by grabbing the
2952 		 * worker lock. If the task is not known to LU,
2953 		 * completed/aborted, then see if we need to
2954 		 * free this task.
2955 		 */
2956 		if (old & ITASK_KNOWN_TO_LU) {
2957 			free_it = 0;
2958 			update_queue_flags = 1;
2959 			if (old & ITASK_IN_WORKER_QUEUE) {
2960 				queue_it = 0;
2961 			} else {
2962 				queue_it = 1;
2963 				new |= ITASK_IN_WORKER_QUEUE;
2964 			}
2965 		} else {
2966 			update_queue_flags = 0;
2967 			queue_it = 0;
2968 		}
2969 	} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
2970 
2971 	if (update_queue_flags) {
2972 		uint8_t cmd = (dbuf->db_handle << 5) | ITASK_CMD_DATA_XFER_DONE;
2973 
2974 		ASSERT(itask->itask_ncmds < ITASK_MAX_NCMDS);
2975 		itask->itask_cmd_stack[itask->itask_ncmds++] = cmd;
2976 		if (queue_it) {
2977 			itask->itask_worker_next = NULL;
2978 			if (w->worker_task_tail) {
2979 				w->worker_task_tail->itask_worker_next = itask;
2980 			} else {
2981 				w->worker_task_head = itask;
2982 			}
2983 			w->worker_task_tail = itask;
2984 			if (++(w->worker_queue_depth) >
2985 			    w->worker_max_qdepth_pu) {
2986 				w->worker_max_qdepth_pu = w->worker_queue_depth;
2987 			}
2988 			if ((w->worker_flags & STMF_WORKER_ACTIVE) == 0)
2989 				cv_signal(&w->worker_cv);
2990 		}
2991 	}
2992 	mutex_exit(&w->worker_lock);
2993 
2994 	if (free_it) {
2995 		if ((itask->itask_flags & (ITASK_KNOWN_TO_LU |
2996 		    ITASK_KNOWN_TO_TGT_PORT | ITASK_IN_WORKER_QUEUE |
2997 		    ITASK_BEING_ABORTED)) == 0) {
2998 			stmf_task_free(task);
2999 		}
3000 	}
3001 }
3002 
3003 stmf_status_t
3004 stmf_send_scsi_status(scsi_task_t *task, uint32_t ioflags)
3005 {
3006 	stmf_i_scsi_task_t *itask =
3007 		(stmf_i_scsi_task_t *)task->task_stmf_private;
3008 	if (ioflags & STMF_IOF_LU_DONE) {
3009 		uint32_t new, old;
3010 		do {
3011 			new = old = itask->itask_flags;
3012 			if (new & ITASK_BEING_ABORTED)
3013 				return (STMF_ABORTED);
3014 			new &= ~ITASK_KNOWN_TO_LU;
3015 		} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
3016 	}
3017 
3018 	if (!(itask->itask_flags & ITASK_KNOWN_TO_TGT_PORT)) {
3019 		return (STMF_SUCCESS);
3020 	}
3021 
3022 	if (itask->itask_flags & ITASK_BEING_ABORTED)
3023 		return (STMF_ABORTED);
3024 
3025 	if (task->task_additional_flags & TASK_AF_NO_EXPECTED_XFER_LENGTH) {
3026 		task->task_status_ctrl = 0;
3027 		task->task_resid = 0;
3028 	} else if (task->task_cmd_xfer_length >
3029 	    task->task_expected_xfer_length) {
3030 		task->task_status_ctrl = TASK_SCTRL_OVER;
3031 		task->task_resid = task->task_cmd_xfer_length -
3032 					task->task_expected_xfer_length;
3033 	} else if (task->task_nbytes_transferred <
3034 					task->task_expected_xfer_length) {
3035 		task->task_status_ctrl = TASK_SCTRL_UNDER;
3036 		task->task_resid = task->task_expected_xfer_length -
3037 					task->task_nbytes_transferred;
3038 	} else {
3039 		task->task_status_ctrl = 0;
3040 		task->task_resid = 0;
3041 	}
3042 	return (task->task_lport->lport_send_status(task, ioflags));
3043 }
3044 
3045 void
3046 stmf_send_status_done(scsi_task_t *task, stmf_status_t s, uint32_t iof)
3047 {
3048 	stmf_i_scsi_task_t *itask =
3049 	    (stmf_i_scsi_task_t *)task->task_stmf_private;
3050 	stmf_worker_t *w = itask->itask_worker;
3051 	uint32_t new, old;
3052 	uint8_t free_it, queue_it;
3053 
3054 	mutex_enter(&w->worker_lock);
3055 	do {
3056 		new = old = itask->itask_flags;
3057 		if (old & ITASK_BEING_ABORTED) {
3058 			mutex_exit(&w->worker_lock);
3059 			return;
3060 		}
3061 		free_it = 0;
3062 		if (iof & STMF_IOF_LPORT_DONE) {
3063 			new &= ~ITASK_KNOWN_TO_TGT_PORT;
3064 			free_it = 1;
3065 		}
3066 		/*
3067 		 * If the task is known to LU then queue it. But if
3068 		 * it is already queued (multiple completions) then
3069 		 * just update the buffer information by grabbing the
3070 		 * worker lock. If the task is not known to LU,
3071 		 * completed/aborted, then see if we need to
3072 		 * free this task.
3073 		 */
3074 		if (old & ITASK_KNOWN_TO_LU) {
3075 			free_it = 0;
3076 			queue_it = 1;
3077 			if (old & ITASK_IN_WORKER_QUEUE) {
3078 				cmn_err(CE_PANIC, "status completion received"
3079 				    " when task is already in worker queue "
3080 				    " task = %p", (void *)task);
3081 			}
3082 			new |= ITASK_IN_WORKER_QUEUE;
3083 		} else {
3084 			queue_it = 0;
3085 		}
3086 	} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
3087 	task->task_completion_status = s;
3088 
3089 	if (queue_it) {
3090 		ASSERT(itask->itask_ncmds < ITASK_MAX_NCMDS);
3091 		itask->itask_cmd_stack[itask->itask_ncmds++] =
3092 		    ITASK_CMD_STATUS_DONE;
3093 		itask->itask_worker_next = NULL;
3094 		if (w->worker_task_tail) {
3095 			w->worker_task_tail->itask_worker_next = itask;
3096 		} else {
3097 			w->worker_task_head = itask;
3098 		}
3099 		w->worker_task_tail = itask;
3100 		if (++(w->worker_queue_depth) > w->worker_max_qdepth_pu) {
3101 			w->worker_max_qdepth_pu = w->worker_queue_depth;
3102 		}
3103 		if ((w->worker_flags & STMF_WORKER_ACTIVE) == 0)
3104 			cv_signal(&w->worker_cv);
3105 	}
3106 	mutex_exit(&w->worker_lock);
3107 
3108 	if (free_it) {
3109 		if ((itask->itask_flags & (ITASK_KNOWN_TO_LU |
3110 		    ITASK_KNOWN_TO_TGT_PORT | ITASK_IN_WORKER_QUEUE |
3111 		    ITASK_BEING_ABORTED)) == 0) {
3112 			stmf_task_free(task);
3113 		} else {
3114 			cmn_err(CE_PANIC, "LU is done with the task but LPORT "
3115 			    " is not done, itask %p", (void *)itask);
3116 		}
3117 	}
3118 }
3119 
3120 void
3121 stmf_task_lu_done(scsi_task_t *task)
3122 {
3123 	stmf_i_scsi_task_t *itask =
3124 		(stmf_i_scsi_task_t *)task->task_stmf_private;
3125 	stmf_worker_t *w = itask->itask_worker;
3126 	uint32_t new, old;
3127 
3128 	mutex_enter(&w->worker_lock);
3129 	do {
3130 		new = old = itask->itask_flags;
3131 		if (old & ITASK_BEING_ABORTED) {
3132 			mutex_exit(&w->worker_lock);
3133 			return;
3134 		}
3135 		if (old & ITASK_IN_WORKER_QUEUE) {
3136 			cmn_err(CE_PANIC, "task_lu_done received"
3137 			    " when task is in worker queue "
3138 			    " task = %p", (void *)task);
3139 		}
3140 		new &= ~ITASK_KNOWN_TO_LU;
3141 	} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
3142 
3143 	mutex_exit(&w->worker_lock);
3144 
3145 	if ((itask->itask_flags & (ITASK_KNOWN_TO_LU |
3146 	    ITASK_KNOWN_TO_TGT_PORT | ITASK_IN_WORKER_QUEUE |
3147 	    ITASK_BEING_ABORTED)) == 0) {
3148 		stmf_task_free(task);
3149 	} else {
3150 		cmn_err(CE_PANIC, "stmf_lu_done should be the last stage but "
3151 		    " the task is still not done, task = %p", (void *)task);
3152 	}
3153 }
3154 
3155 void
3156 stmf_queue_task_for_abort(scsi_task_t *task, stmf_status_t s)
3157 {
3158 	stmf_i_scsi_task_t *itask =
3159 	    (stmf_i_scsi_task_t *)task->task_stmf_private;
3160 	stmf_worker_t *w;
3161 	uint32_t old, new;
3162 
3163 	do {
3164 		old = new = itask->itask_flags;
3165 		if ((old & ITASK_BEING_ABORTED) ||
3166 		    ((old & (ITASK_KNOWN_TO_TGT_PORT |
3167 		    ITASK_KNOWN_TO_LU)) == 0)) {
3168 			return;
3169 		}
3170 		new |= ITASK_BEING_ABORTED;
3171 	} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
3172 	task->task_completion_status = s;
3173 	itask->itask_start_time = ddi_get_lbolt();
3174 
3175 	if (((w = itask->itask_worker) == NULL) ||
3176 	    (itask->itask_flags & ITASK_IN_TRANSITION)) {
3177 		return;
3178 	}
3179 
3180 	/* Queue it and get out */
3181 	mutex_enter(&w->worker_lock);
3182 	if (itask->itask_flags & ITASK_IN_WORKER_QUEUE) {
3183 		mutex_exit(&w->worker_lock);
3184 		return;
3185 	}
3186 	atomic_or_32(&itask->itask_flags, ITASK_IN_WORKER_QUEUE);
3187 	itask->itask_worker_next = NULL;
3188 	if (w->worker_task_tail) {
3189 		w->worker_task_tail->itask_worker_next = itask;
3190 	} else {
3191 		w->worker_task_head = itask;
3192 	}
3193 	w->worker_task_tail = itask;
3194 	if (++(w->worker_queue_depth) > w->worker_max_qdepth_pu) {
3195 		w->worker_max_qdepth_pu = w->worker_queue_depth;
3196 	}
3197 	if ((w->worker_flags & STMF_WORKER_ACTIVE) == 0)
3198 		cv_signal(&w->worker_cv);
3199 	mutex_exit(&w->worker_lock);
3200 }
3201 
3202 void
3203 stmf_abort(int abort_cmd, scsi_task_t *task, stmf_status_t s, void *arg)
3204 {
3205 	stmf_i_scsi_task_t *itask = NULL;
3206 	uint32_t old, new, f, rf;
3207 
3208 	switch (abort_cmd) {
3209 	case STMF_QUEUE_ABORT_LU:
3210 		stmf_task_lu_killall((stmf_lu_t *)arg, task, s);
3211 		return;
3212 	case STMF_QUEUE_TASK_ABORT:
3213 		stmf_queue_task_for_abort(task, s);
3214 		return;
3215 	case STMF_REQUEUE_TASK_ABORT_LPORT:
3216 		rf = ITASK_TGT_PORT_ABORT_CALLED;
3217 		f = ITASK_KNOWN_TO_TGT_PORT;
3218 		break;
3219 	case STMF_REQUEUE_TASK_ABORT_LU:
3220 		rf = ITASK_LU_ABORT_CALLED;
3221 		f = ITASK_KNOWN_TO_LU;
3222 		break;
3223 	default:
3224 		return;
3225 	}
3226 	itask = (stmf_i_scsi_task_t *)task->task_stmf_private;
3227 	f |= ITASK_BEING_ABORTED | rf;
3228 	do {
3229 		old = new = itask->itask_flags;
3230 		if ((old & f) != f) {
3231 			return;
3232 		}
3233 		new &= ~rf;
3234 	} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
3235 }
3236 
3237 void
3238 stmf_task_lu_aborted(scsi_task_t *task, stmf_status_t s, uint32_t iof)
3239 {
3240 	char			 info[STMF_CHANGE_INFO_LEN];
3241 	stmf_i_scsi_task_t	*itask = TASK_TO_ITASK(task);
3242 	unsigned long long	st;
3243 
3244 	st = s;	/* gcc fix */
3245 	if ((s != STMF_ABORT_SUCCESS) && (s != STMF_NOT_FOUND)) {
3246 		(void) snprintf(info, STMF_CHANGE_INFO_LEN,
3247 		    "task %p, lu failed to abort ret=%llx", (void *)task, st);
3248 	} else if ((iof & STMF_IOF_LU_DONE) == 0) {
3249 		(void) snprintf(info, STMF_CHANGE_INFO_LEN,
3250 		    "Task aborted but LU is not finished, task ="
3251 		    "%p, s=%llx, iof=%x", (void *)task, st, iof);
3252 	} else {
3253 		/*
3254 		 * LU abort successfully
3255 		 */
3256 		atomic_and_32(&itask->itask_flags, ~ITASK_KNOWN_TO_LU);
3257 		return;
3258 	}
3259 
3260 	info[STMF_CHANGE_INFO_LEN - 1] = 0;
3261 	stmf_abort_task_offline(task, 1, info);
3262 }
3263 
3264 void
3265 stmf_task_lport_aborted(scsi_task_t *task, stmf_status_t s, uint32_t iof)
3266 {
3267 	char			 info[STMF_CHANGE_INFO_LEN];
3268 	stmf_i_scsi_task_t	*itask = TASK_TO_ITASK(task);
3269 	unsigned long long	st;
3270 
3271 	st = s;
3272 	if ((s != STMF_ABORT_SUCCESS) && (s != STMF_NOT_FOUND)) {
3273 		(void) snprintf(info, STMF_CHANGE_INFO_LEN,
3274 		    "task %p, tgt port failed to abort ret=%llx", (void *)task,
3275 		    st);
3276 	} else if ((iof & STMF_IOF_LPORT_DONE) == 0) {
3277 		(void) snprintf(info, STMF_CHANGE_INFO_LEN,
3278 		    "Task aborted but tgt port is not finished, "
3279 		    "task=%p, s=%llx, iof=%x", (void *)task, st, iof);
3280 	} else {
3281 		/*
3282 		 * LU abort successfully
3283 		 */
3284 		atomic_and_32(&itask->itask_flags, ~ITASK_KNOWN_TO_TGT_PORT);
3285 		return;
3286 	}
3287 
3288 	info[STMF_CHANGE_INFO_LEN - 1] = 0;
3289 	stmf_abort_task_offline(task, 0, info);
3290 }
3291 
3292 stmf_status_t
3293 stmf_task_poll_lu(scsi_task_t *task, uint32_t timeout)
3294 {
3295 	stmf_i_scsi_task_t *itask = (stmf_i_scsi_task_t *)
3296 	    task->task_stmf_private;
3297 	stmf_worker_t *w = itask->itask_worker;
3298 	int i;
3299 
3300 	ASSERT(itask->itask_flags & ITASK_KNOWN_TO_LU);
3301 	mutex_enter(&w->worker_lock);
3302 	if (itask->itask_ncmds >= ITASK_MAX_NCMDS) {
3303 		mutex_exit(&w->worker_lock);
3304 		return (STMF_BUSY);
3305 	}
3306 	for (i = 0; i < itask->itask_ncmds; i++) {
3307 		if (itask->itask_cmd_stack[i] == ITASK_CMD_POLL_LU) {
3308 			mutex_exit(&w->worker_lock);
3309 			return (STMF_SUCCESS);
3310 		}
3311 	}
3312 	itask->itask_cmd_stack[itask->itask_ncmds++] = ITASK_CMD_POLL_LU;
3313 	if (timeout == ITASK_DEFAULT_POLL_TIMEOUT) {
3314 		itask->itask_poll_timeout = ddi_get_lbolt() + 1;
3315 	} else {
3316 		clock_t t = drv_usectohz(timeout * 1000);
3317 		if (t == 0)
3318 			t = 1;
3319 		itask->itask_poll_timeout = ddi_get_lbolt() + t;
3320 	}
3321 	if ((itask->itask_flags & ITASK_IN_WORKER_QUEUE) == 0) {
3322 		itask->itask_worker_next = NULL;
3323 		if (w->worker_task_tail) {
3324 			w->worker_task_tail->itask_worker_next = itask;
3325 		} else {
3326 			w->worker_task_head = itask;
3327 		}
3328 		w->worker_task_tail = itask;
3329 		if (++(w->worker_queue_depth) > w->worker_max_qdepth_pu) {
3330 			w->worker_max_qdepth_pu = w->worker_queue_depth;
3331 		}
3332 		atomic_or_32(&itask->itask_flags, ITASK_IN_WORKER_QUEUE);
3333 		if ((w->worker_flags & STMF_WORKER_ACTIVE) == 0)
3334 			cv_signal(&w->worker_cv);
3335 	}
3336 	mutex_exit(&w->worker_lock);
3337 	return (STMF_SUCCESS);
3338 }
3339 
3340 stmf_status_t
3341 stmf_task_poll_lport(scsi_task_t *task, uint32_t timeout)
3342 {
3343 	stmf_i_scsi_task_t *itask = (stmf_i_scsi_task_t *)
3344 	    task->task_stmf_private;
3345 	stmf_worker_t *w = itask->itask_worker;
3346 	int i;
3347 
3348 	ASSERT(itask->itask_flags & ITASK_KNOWN_TO_TGT_PORT);
3349 	mutex_enter(&w->worker_lock);
3350 	if (itask->itask_ncmds >= ITASK_MAX_NCMDS) {
3351 		mutex_exit(&w->worker_lock);
3352 		return (STMF_BUSY);
3353 	}
3354 	for (i = 0; i < itask->itask_ncmds; i++) {
3355 		if (itask->itask_cmd_stack[i] == ITASK_CMD_POLL_LPORT) {
3356 			mutex_exit(&w->worker_lock);
3357 			return (STMF_SUCCESS);
3358 		}
3359 	}
3360 	itask->itask_cmd_stack[itask->itask_ncmds++] = ITASK_CMD_POLL_LPORT;
3361 	if (timeout == ITASK_DEFAULT_POLL_TIMEOUT) {
3362 		itask->itask_poll_timeout = ddi_get_lbolt() + 1;
3363 	} else {
3364 		clock_t t = drv_usectohz(timeout * 1000);
3365 		if (t == 0)
3366 			t = 1;
3367 		itask->itask_poll_timeout = ddi_get_lbolt() + t;
3368 	}
3369 	if ((itask->itask_flags & ITASK_IN_WORKER_QUEUE) == 0) {
3370 		itask->itask_worker_next = NULL;
3371 		if (w->worker_task_tail) {
3372 			w->worker_task_tail->itask_worker_next = itask;
3373 		} else {
3374 			w->worker_task_head = itask;
3375 		}
3376 		w->worker_task_tail = itask;
3377 		if (++(w->worker_queue_depth) > w->worker_max_qdepth_pu) {
3378 			w->worker_max_qdepth_pu = w->worker_queue_depth;
3379 		}
3380 		if ((w->worker_flags & STMF_WORKER_ACTIVE) == 0)
3381 			cv_signal(&w->worker_cv);
3382 	}
3383 	mutex_exit(&w->worker_lock);
3384 	return (STMF_SUCCESS);
3385 }
3386 
3387 void
3388 stmf_do_task_abort(scsi_task_t *task)
3389 {
3390 	stmf_i_scsi_task_t	*itask = TASK_TO_ITASK(task);
3391 	stmf_lu_t		*lu;
3392 	stmf_local_port_t	*lport;
3393 	unsigned long long	 ret;
3394 	uint32_t		 old, new;
3395 	uint8_t			 call_lu_abort, call_port_abort;
3396 	char			 info[STMF_CHANGE_INFO_LEN];
3397 
3398 	lu = task->task_lu;
3399 	lport = task->task_lport;
3400 	do {
3401 		old = new = itask->itask_flags;
3402 		if ((old & (ITASK_KNOWN_TO_LU | ITASK_LU_ABORT_CALLED)) ==
3403 		    ITASK_KNOWN_TO_LU) {
3404 			new |= ITASK_LU_ABORT_CALLED;
3405 			call_lu_abort = 1;
3406 		} else {
3407 			call_lu_abort = 0;
3408 		}
3409 	} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
3410 
3411 	if (call_lu_abort) {
3412 		if ((itask->itask_flags & ITASK_DEFAULT_HANDLING) == 0) {
3413 			ret = lu->lu_abort(lu, STMF_LU_ABORT_TASK, task, 0);
3414 		} else {
3415 			ret = dlun0->lu_abort(lu, STMF_LU_ABORT_TASK, task, 0);
3416 		}
3417 		if ((ret == STMF_ABORT_SUCCESS) || (ret == STMF_NOT_FOUND)) {
3418 			stmf_task_lu_aborted(task, ret, STMF_IOF_LU_DONE);
3419 		} else if (ret == STMF_BUSY) {
3420 			atomic_and_32(&itask->itask_flags,
3421 			    ~ITASK_LU_ABORT_CALLED);
3422 		} else if (ret != STMF_SUCCESS) {
3423 			(void) snprintf(info, STMF_CHANGE_INFO_LEN,
3424 			    "Abort failed by LU %p, ret %llx", (void *)lu, ret);
3425 			info[STMF_CHANGE_INFO_LEN - 1] = 0;
3426 			stmf_abort_task_offline(task, 1, info);
3427 		}
3428 	} else if (itask->itask_flags & ITASK_KNOWN_TO_LU) {
3429 		if (ddi_get_lbolt() > (itask->itask_start_time +
3430 		    STMF_SEC2TICK(lu->lu_abort_timeout?
3431 		    lu->lu_abort_timeout : ITASK_DEFAULT_ABORT_TIMEOUT))) {
3432 			(void) snprintf(info, STMF_CHANGE_INFO_LEN,
3433 			    "lu abort timed out");
3434 			info[STMF_CHANGE_INFO_LEN - 1] = 0;
3435 			stmf_abort_task_offline(itask->itask_task, 1, info);
3436 		}
3437 	}
3438 
3439 	do {
3440 		old = new = itask->itask_flags;
3441 		if ((old & (ITASK_KNOWN_TO_TGT_PORT |
3442 		    ITASK_TGT_PORT_ABORT_CALLED)) == ITASK_KNOWN_TO_TGT_PORT) {
3443 			new |= ITASK_TGT_PORT_ABORT_CALLED;
3444 			call_port_abort = 1;
3445 		} else {
3446 			call_port_abort = 0;
3447 		}
3448 	} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
3449 	if (call_port_abort) {
3450 		ret = lport->lport_abort(lport, STMF_LPORT_ABORT_TASK,
3451 								task, 0);
3452 		if ((ret == STMF_ABORT_SUCCESS) || (ret == STMF_NOT_FOUND)) {
3453 			stmf_task_lport_aborted(task, ret, STMF_IOF_LPORT_DONE);
3454 		} else if (ret == STMF_BUSY) {
3455 			atomic_and_32(&itask->itask_flags,
3456 			    ~ITASK_TGT_PORT_ABORT_CALLED);
3457 		} else if (ret != STMF_SUCCESS) {
3458 			(void) snprintf(info, STMF_CHANGE_INFO_LEN,
3459 			    "Abort failed by tgt port %p ret %llx",
3460 			    (void *)lport, ret);
3461 			info[STMF_CHANGE_INFO_LEN - 1] = 0;
3462 			stmf_abort_task_offline(task, 0, info);
3463 		}
3464 	} else if (itask->itask_flags & ITASK_KNOWN_TO_TGT_PORT) {
3465 		if (ddi_get_lbolt() > (itask->itask_start_time +
3466 		    STMF_SEC2TICK(lport->lport_abort_timeout?
3467 		    lport->lport_abort_timeout :
3468 		    ITASK_DEFAULT_ABORT_TIMEOUT))) {
3469 			(void) snprintf(info, STMF_CHANGE_INFO_LEN,
3470 			    "lport abort timed out");
3471 			info[STMF_CHANGE_INFO_LEN - 1] = 0;
3472 			stmf_abort_task_offline(itask->itask_task, 0, info);
3473 		}
3474 	}
3475 }
3476 
3477 stmf_status_t
3478 stmf_ctl(int cmd, void *obj, void *arg)
3479 {
3480 	stmf_status_t			ret;
3481 	stmf_i_lu_t			*ilu;
3482 	stmf_i_local_port_t		*ilport;
3483 	stmf_state_change_info_t	*ssci = (stmf_state_change_info_t *)arg;
3484 
3485 	mutex_enter(&stmf_state.stmf_lock);
3486 	ret = STMF_INVALID_ARG;
3487 	if (cmd & STMF_CMD_LU_OP) {
3488 		ilu = stmf_lookup_lu((stmf_lu_t *)obj);
3489 		if (ilu == NULL) {
3490 			goto stmf_ctl_lock_exit;
3491 		}
3492 	} else if (cmd & STMF_CMD_LPORT_OP) {
3493 		ilport = stmf_lookup_lport((stmf_local_port_t *)obj);
3494 		if (ilport == NULL) {
3495 			goto stmf_ctl_lock_exit;
3496 		}
3497 	} else {
3498 		goto stmf_ctl_lock_exit;
3499 	}
3500 
3501 	switch (cmd) {
3502 	case STMF_CMD_LU_ONLINE:
3503 		if (ilu->ilu_state == STMF_STATE_ONLINE) {
3504 			ret = STMF_ALREADY;
3505 			goto stmf_ctl_lock_exit;
3506 		}
3507 		if (ilu->ilu_state != STMF_STATE_OFFLINE) {
3508 			ret = STMF_INVALID_ARG;
3509 			goto stmf_ctl_lock_exit;
3510 		}
3511 		ilu->ilu_state = STMF_STATE_ONLINING;
3512 		mutex_exit(&stmf_state.stmf_lock);
3513 		stmf_svc_queue(cmd, obj, (stmf_state_change_info_t *)arg);
3514 		break;
3515 
3516 	case STMF_CMD_LU_ONLINE_COMPLETE:
3517 		if (ilu->ilu_state != STMF_STATE_ONLINING) {
3518 			ret = STMF_INVALID_ARG;
3519 			goto stmf_ctl_lock_exit;
3520 		}
3521 		if (((stmf_change_status_t *)arg)->st_completion_status ==
3522 		    STMF_SUCCESS) {
3523 			ilu->ilu_state = STMF_STATE_ONLINE;
3524 			mutex_exit(&stmf_state.stmf_lock);
3525 			((stmf_lu_t *)obj)->lu_ctl((stmf_lu_t *)obj,
3526 			    STMF_ACK_LU_ONLINE_COMPLETE, arg);
3527 			mutex_enter(&stmf_state.stmf_lock);
3528 			stmf_add_lu_to_active_sessions((stmf_lu_t *)obj);
3529 		} else {
3530 			/* XXX: should throw a meesage an record more data */
3531 			ilu->ilu_state = STMF_STATE_OFFLINE;
3532 		}
3533 		ret = STMF_SUCCESS;
3534 		goto stmf_ctl_lock_exit;
3535 
3536 	case STMF_CMD_LU_OFFLINE:
3537 		if (ilu->ilu_state == STMF_STATE_OFFLINE) {
3538 			ret = STMF_ALREADY;
3539 			goto stmf_ctl_lock_exit;
3540 		}
3541 		if (ilu->ilu_state != STMF_STATE_ONLINE) {
3542 			ret = STMF_INVALID_ARG;
3543 			goto stmf_ctl_lock_exit;
3544 		}
3545 		ilu->ilu_state = STMF_STATE_OFFLINING;
3546 		mutex_exit(&stmf_state.stmf_lock);
3547 		stmf_svc_queue(cmd, obj, (stmf_state_change_info_t *)arg);
3548 		break;
3549 
3550 	case STMF_CMD_LU_OFFLINE_COMPLETE:
3551 		if (ilu->ilu_state != STMF_STATE_OFFLINING) {
3552 			ret = STMF_INVALID_ARG;
3553 			goto stmf_ctl_lock_exit;
3554 		}
3555 		if (((stmf_change_status_t *)arg)->st_completion_status ==
3556 		    STMF_SUCCESS) {
3557 			ilu->ilu_state = STMF_STATE_OFFLINE;
3558 			mutex_exit(&stmf_state.stmf_lock);
3559 			((stmf_lu_t *)obj)->lu_ctl((stmf_lu_t *)obj,
3560 			    STMF_ACK_LU_OFFLINE_COMPLETE, arg);
3561 			mutex_enter(&stmf_state.stmf_lock);
3562 		} else {
3563 			ilu->ilu_state = STMF_STATE_ONLINE;
3564 			stmf_add_lu_to_active_sessions((stmf_lu_t *)obj);
3565 		}
3566 		mutex_exit(&stmf_state.stmf_lock);
3567 		break;
3568 
3569 	/*
3570 	 * LPORT_ONLINE/OFFLINE has nothing to do with link offline/online.
3571 	 * It's related with hardware disable/enable.
3572 	 */
3573 	case STMF_CMD_LPORT_ONLINE:
3574 		if (ilport->ilport_state == STMF_STATE_ONLINE) {
3575 			ret = STMF_ALREADY;
3576 			goto stmf_ctl_lock_exit;
3577 		}
3578 		if (ilport->ilport_state != STMF_STATE_OFFLINE) {
3579 			ret = STMF_INVALID_ARG;
3580 			goto stmf_ctl_lock_exit;
3581 		}
3582 
3583 		/*
3584 		 * Only user request can recover the port from the
3585 		 * FORCED_OFFLINE state
3586 		 */
3587 		if (ilport->ilport_flags & ILPORT_FORCED_OFFLINE) {
3588 			if (!(ssci->st_rflags & STMF_RFLAG_USER_REQUEST)) {
3589 				ret = STMF_FAILURE;
3590 				goto stmf_ctl_lock_exit;
3591 			}
3592 		}
3593 
3594 		/*
3595 		 * Avoid too frequent request to online
3596 		 */
3597 		if (ssci->st_rflags & STMF_RFLAG_USER_REQUEST) {
3598 			ilport->ilport_online_times = 0;
3599 			ilport->ilport_avg_interval = 0;
3600 		}
3601 		if ((ilport->ilport_avg_interval < STMF_AVG_ONLINE_INTERVAL) &&
3602 		    (ilport->ilport_online_times >= 4)) {
3603 			ret = STMF_FAILURE;
3604 			ilport->ilport_flags |= ILPORT_FORCED_OFFLINE;
3605 			stmf_trace(NULL, "stmf_ctl: too frequent request to "
3606 			    "online the port");
3607 			cmn_err(CE_WARN, "stmf_ctl: too frequent request to "
3608 			    "online the port, set FORCED_OFFLINE now");
3609 			goto stmf_ctl_lock_exit;
3610 		}
3611 		if (ilport->ilport_online_times > 0) {
3612 			if (ilport->ilport_online_times == 1) {
3613 				ilport->ilport_avg_interval = ddi_get_lbolt() -
3614 				    ilport->ilport_last_online_clock;
3615 			} else {
3616 				ilport->ilport_avg_interval =
3617 				    (ilport->ilport_avg_interval +
3618 				    ddi_get_lbolt() -
3619 				    ilport->ilport_last_online_clock) >> 1;
3620 			}
3621 		}
3622 		ilport->ilport_last_online_clock = ddi_get_lbolt();
3623 		ilport->ilport_online_times++;
3624 
3625 		/*
3626 		 * Submit online service request
3627 		 */
3628 		ilport->ilport_flags &= ~ILPORT_FORCED_OFFLINE;
3629 		ilport->ilport_state = STMF_STATE_ONLINING;
3630 		mutex_exit(&stmf_state.stmf_lock);
3631 		stmf_svc_queue(cmd, obj, (stmf_state_change_info_t *)arg);
3632 		break;
3633 
3634 	case STMF_CMD_LPORT_ONLINE_COMPLETE:
3635 		if (ilport->ilport_state != STMF_STATE_ONLINING) {
3636 			ret = STMF_INVALID_ARG;
3637 			goto stmf_ctl_lock_exit;
3638 		}
3639 		if (((stmf_change_status_t *)arg)->st_completion_status ==
3640 		    STMF_SUCCESS) {
3641 			ilport->ilport_state = STMF_STATE_ONLINE;
3642 			mutex_exit(&stmf_state.stmf_lock);
3643 			((stmf_local_port_t *)obj)->lport_ctl(
3644 			    (stmf_local_port_t *)obj,
3645 			    STMF_ACK_LPORT_ONLINE_COMPLETE, arg);
3646 			mutex_enter(&stmf_state.stmf_lock);
3647 		} else {
3648 			ilport->ilport_state = STMF_STATE_OFFLINE;
3649 		}
3650 		ret = STMF_SUCCESS;
3651 		goto stmf_ctl_lock_exit;
3652 
3653 	case STMF_CMD_LPORT_OFFLINE:
3654 		if (ilport->ilport_state == STMF_STATE_OFFLINE) {
3655 			ret = STMF_ALREADY;
3656 			goto stmf_ctl_lock_exit;
3657 		}
3658 		if (ilport->ilport_state != STMF_STATE_ONLINE) {
3659 			ret = STMF_INVALID_ARG;
3660 			goto stmf_ctl_lock_exit;
3661 		}
3662 		ilport->ilport_state = STMF_STATE_OFFLINING;
3663 		mutex_exit(&stmf_state.stmf_lock);
3664 		stmf_svc_queue(cmd, obj, (stmf_state_change_info_t *)arg);
3665 		break;
3666 
3667 	case STMF_CMD_LPORT_OFFLINE_COMPLETE:
3668 		if (ilport->ilport_state != STMF_STATE_OFFLINING) {
3669 			ret = STMF_INVALID_ARG;
3670 			goto stmf_ctl_lock_exit;
3671 		}
3672 		if (((stmf_change_status_t *)arg)->st_completion_status ==
3673 		    STMF_SUCCESS) {
3674 			ilport->ilport_state = STMF_STATE_OFFLINE;
3675 			mutex_exit(&stmf_state.stmf_lock);
3676 			((stmf_local_port_t *)obj)->lport_ctl(
3677 			    (stmf_local_port_t *)obj,
3678 			    STMF_ACK_LPORT_OFFLINE_COMPLETE, arg);
3679 			mutex_enter(&stmf_state.stmf_lock);
3680 		} else {
3681 			ilport->ilport_state = STMF_STATE_ONLINE;
3682 		}
3683 		mutex_exit(&stmf_state.stmf_lock);
3684 		break;
3685 
3686 	default:
3687 		cmn_err(CE_WARN, "Invalid ctl cmd received %x", cmd);
3688 		ret = STMF_INVALID_ARG;
3689 		goto stmf_ctl_lock_exit;
3690 	}
3691 
3692 	return (STMF_SUCCESS);
3693 
3694 stmf_ctl_lock_exit:;
3695 	mutex_exit(&stmf_state.stmf_lock);
3696 	return (ret);
3697 }
3698 
3699 /* ARGSUSED */
3700 stmf_status_t
3701 stmf_info_impl(uint32_t cmd, void *arg1, void *arg2, uint8_t *buf,
3702 						uint32_t *bufsizep)
3703 {
3704 	return (STMF_NOT_SUPPORTED);
3705 }
3706 
3707 /* ARGSUSED */
3708 stmf_status_t
3709 stmf_info(uint32_t cmd, void *arg1, void *arg2, uint8_t *buf,
3710 						uint32_t *bufsizep)
3711 {
3712 	uint32_t cl = SI_GET_CLASS(cmd);
3713 
3714 	if (cl == SI_STMF) {
3715 		return (stmf_info_impl(cmd, arg1, arg2, buf, bufsizep));
3716 	}
3717 	if (cl == SI_LPORT) {
3718 		return (((stmf_local_port_t *)arg1)->lport_info(cmd,
3719 				arg1, arg2, buf, bufsizep));
3720 	} else if (cl == SI_LU) {
3721 		return (((stmf_lu_t *)arg1)->lu_info(cmd, arg1, arg2,
3722 						buf, bufsizep));
3723 	}
3724 
3725 	return (STMF_NOT_SUPPORTED);
3726 }
3727 
3728 /*
3729  * Used by port providers. pwwn is 8 byte wwn, sdid is th devid used by
3730  * stmf to register local ports. The ident should have 20 bytes in buffer
3731  * space to convert the wwn to "wwn.xxxxxxxxxxxxxxxx" string.
3732  */
3733 void
3734 stmf_wwn_to_devid_desc(scsi_devid_desc_t *sdid, uint8_t *wwn,
3735     uint8_t protocol_id)
3736 {
3737 	sdid->protocol_id = protocol_id;
3738 	sdid->piv = 1;
3739 	sdid->code_set = CODE_SET_ASCII;
3740 	sdid->association = ID_IS_TARGET_PORT;
3741 	sdid->ident_length = 20;
3742 	(void) sprintf((char *)sdid->ident,
3743 	    "wwn.%02X%02X%02X%02X%02X%02X%02X%02X",
3744 	    wwn[0], wwn[1], wwn[2], wwn[3], wwn[4], wwn[5], wwn[6], wwn[7]);
3745 }
3746 
3747 stmf_xfer_data_t *
3748 stmf_prepare_tpgs_data()
3749 {
3750 	stmf_xfer_data_t *xd;
3751 	stmf_i_local_port_t *ilport;
3752 	uint8_t *p;
3753 	uint32_t sz, asz, nports;
3754 
3755 	mutex_enter(&stmf_state.stmf_lock);
3756 	/* The spec only allows for 255 ports to be reported */
3757 	nports = min(stmf_state.stmf_nlports, 255);
3758 	sz = (nports * 4) + 12;
3759 	asz = sz + sizeof (*xd) - 4;
3760 	xd = (stmf_xfer_data_t *)kmem_zalloc(asz, KM_NOSLEEP);
3761 	if (xd == NULL) {
3762 		mutex_exit(&stmf_state.stmf_lock);
3763 		return (NULL);
3764 	}
3765 	xd->alloc_size = asz;
3766 	xd->size_left = sz;
3767 
3768 	p = xd->buf;
3769 
3770 	*((uint32_t *)p) = BE_32(sz - 4);
3771 	p += 4;
3772 	p[0] = 0x80;	/* PREF */
3773 	p[1] = 1;	/* AO_SUP */
3774 	p[7] = nports & 0xff;
3775 	p += 8;
3776 	for (ilport = stmf_state.stmf_ilportlist; ilport && nports;
3777 	    nports++, ilport = ilport->ilport_next, p += 4) {
3778 		((uint16_t *)p)[1] = BE_16(ilport->ilport_rtpid);
3779 	}
3780 	mutex_exit(&stmf_state.stmf_lock);
3781 
3782 	return (xd);
3783 }
3784 
3785 
3786 static uint16_t stmf_lu_id_gen_number = 0;
3787 extern char hw_serial[];
3788 
3789 stmf_status_t
3790 stmf_scsilib_uniq_lu_id(uint32_t company_id, scsi_devid_desc_t *lu_id)
3791 {
3792 	uint8_t *p;
3793 	struct timeval32 timestamp32;
3794 	uint32_t *t = (uint32_t *)&timestamp32;
3795 	struct ether_addr mac;
3796 	uint8_t *e = (uint8_t *)&mac;
3797 
3798 	if (company_id == COMPANY_ID_NONE)
3799 		company_id = COMPANY_ID_SUN;
3800 
3801 	if (lu_id->ident_length != 0x10)
3802 		return (STMF_INVALID_ARG);
3803 
3804 	p = (uint8_t *)lu_id;
3805 
3806 	atomic_add_16(&stmf_lu_id_gen_number, 1);
3807 
3808 	p[0] = 0xf1; p[1] = 3; p[2] = 0; p[3] = 0x10;
3809 	p[4] = ((company_id >> 20) & 0xf) | 0x60;
3810 	p[5] = (company_id >> 12) & 0xff;
3811 	p[6] = (company_id >> 4) & 0xff;
3812 	p[7] = (company_id << 4) & 0xf0;
3813 	if (!localetheraddr((struct ether_addr *)NULL, &mac)) {
3814 		char *hp = &hw_serial[0];
3815 		int hid = BE_32(stoi(&hp));
3816 
3817 		e[0] = (hid >> 24) & 0xff;
3818 		e[1] = (hid >> 16) & 0xff;
3819 		e[2] = (hid >> 8) & 0xff;
3820 		e[3] = hid & 0xff;
3821 		e[4] = e[5] = 0;
3822 	}
3823 	bcopy(e, p+8, 6);
3824 	uniqtime32(&timestamp32);
3825 	*t = BE_32(*t);
3826 	bcopy(t, p+14, 4);
3827 	p[18] = (stmf_lu_id_gen_number >> 8) & 0xff;
3828 	p[19] = stmf_lu_id_gen_number & 0xff;
3829 
3830 	return (STMF_SUCCESS);
3831 }
3832 
3833 /*
3834  * saa is sense key, ASC, ASCQ
3835  */
3836 void
3837 stmf_scsilib_send_status(scsi_task_t *task, uint8_t st, uint32_t saa)
3838 {
3839 	uint8_t sd[18];
3840 	task->task_scsi_status = st;
3841 	if (st == 2) {
3842 		bzero(sd, 18);
3843 		sd[0] = 0x70;
3844 		sd[2] = (saa >> 16) & 0xf;
3845 		sd[7] = 10;
3846 		sd[12] = (saa >> 8) & 0xff;
3847 		sd[13] = saa & 0xff;
3848 		task->task_sense_data = sd;
3849 		task->task_sense_length = 18;
3850 	} else {
3851 		task->task_sense_data = NULL;
3852 		task->task_sense_length = 0;
3853 	}
3854 	(void) stmf_send_scsi_status(task, STMF_IOF_LU_DONE);
3855 }
3856 
3857 uint32_t
3858 stmf_scsilib_prepare_vpd_page83(scsi_task_t *task, uint8_t *page,
3859     uint32_t page_len, uint8_t byte0, uint32_t vpd_mask)
3860 {
3861 	uint8_t		*p = NULL;
3862 	uint8_t		small_buf[32];
3863 	uint32_t	sz = 0;
3864 	uint32_t	n = 4;
3865 	uint32_t	m = 0;
3866 	uint32_t	last_bit = 0;
3867 
3868 	if (page_len < 4)
3869 		return (0);
3870 	if (page_len > 65535)
3871 		page_len = 65535;
3872 
3873 	page[0] = byte0;
3874 	page[1] = 0x83;
3875 
3876 	/* CONSTCOND */
3877 	while (1) {
3878 		m += sz;
3879 		if (sz && (page_len > n)) {
3880 			uint32_t copysz;
3881 			copysz = page_len > (n + sz) ? sz : page_len - n;
3882 			bcopy(p, page + n, copysz);
3883 			n += copysz;
3884 		}
3885 		vpd_mask &= ~last_bit;
3886 		if (vpd_mask == 0)
3887 			break;
3888 
3889 		if (vpd_mask & STMF_VPD_LU_ID) {
3890 			last_bit = STMF_VPD_LU_ID;
3891 			sz = task->task_lu->lu_id->ident_length + 4;
3892 			p = (uint8_t *)task->task_lu->lu_id;
3893 			continue;
3894 		} else if (vpd_mask & STMF_VPD_TARGET_ID) {
3895 			last_bit = STMF_VPD_TARGET_ID;
3896 			sz = task->task_lport->lport_id->ident_length + 4;
3897 			p = (uint8_t *)task->task_lport->lport_id;
3898 			continue;
3899 		} else if (vpd_mask & STMF_VPD_TP_GROUP) {
3900 			last_bit = STMF_VPD_TP_GROUP;
3901 			p = small_buf;
3902 			bzero(p, 8);
3903 			p[0] = 1;
3904 			p[1] = 0x15;
3905 			p[3] = 4;
3906 			/* Group ID is always 0 */
3907 			sz = 8;
3908 			continue;
3909 		} else if (vpd_mask & STMF_VPD_RELATIVE_TP_ID) {
3910 			stmf_i_local_port_t *ilport;
3911 
3912 			last_bit = STMF_VPD_RELATIVE_TP_ID;
3913 			p = small_buf;
3914 			bzero(p, 8);
3915 			p[0] = 1;
3916 			p[1] = 0x14;
3917 			p[3] = 4;
3918 			ilport = (stmf_i_local_port_t *)
3919 					task->task_lport->lport_stmf_private;
3920 			p[6] = (ilport->ilport_rtpid >> 8) & 0xff;
3921 			p[7] = ilport->ilport_rtpid & 0xff;
3922 			sz = 8;
3923 			continue;
3924 		} else {
3925 			cmn_err(CE_WARN, "Invalid vpd_mask");
3926 			break;
3927 		}
3928 	}
3929 
3930 	page[2] = (m >> 8) & 0xff;
3931 	page[3] = m & 0xff;
3932 
3933 	return (n);
3934 }
3935 
3936 void
3937 stmf_scsilib_handle_report_tpgs(scsi_task_t *task, stmf_data_buf_t *dbuf)
3938 {
3939 	stmf_i_scsi_task_t *itask =
3940 			(stmf_i_scsi_task_t *)task->task_stmf_private;
3941 	stmf_xfer_data_t *xd;
3942 	uint32_t sz, minsz;
3943 
3944 	itask->itask_flags |= ITASK_DEFAULT_HANDLING;
3945 	task->task_cmd_xfer_length =
3946 	    ((((uint32_t)task->task_cdb[6]) << 24) |
3947 	    (((uint32_t)task->task_cdb[7]) << 16) |
3948 	    (((uint32_t)task->task_cdb[8]) << 8) |
3949 	    ((uint32_t)task->task_cdb[9]));
3950 
3951 	if (task->task_additional_flags &
3952 	    TASK_AF_NO_EXPECTED_XFER_LENGTH) {
3953 		task->task_expected_xfer_length =
3954 		    task->task_cmd_xfer_length;
3955 	}
3956 
3957 	if (task->task_cmd_xfer_length < 16) {
3958 		stmf_scsilib_send_status(task, STATUS_CHECK,
3959 			STMF_SAA_INVALID_FIELD_IN_CDB);
3960 		return;
3961 	}
3962 
3963 	sz = min(task->task_expected_xfer_length,
3964 	    task->task_cmd_xfer_length);
3965 
3966 	xd = stmf_prepare_tpgs_data();
3967 
3968 	if (xd == NULL) {
3969 		stmf_abort(STMF_QUEUE_TASK_ABORT, task,
3970 		    STMF_ALLOC_FAILURE, NULL);
3971 		return;
3972 	}
3973 
3974 	sz = min(sz, xd->size_left);
3975 	xd->size_left = sz;
3976 	minsz = min(512, sz);
3977 
3978 	if (dbuf == NULL)
3979 		dbuf = stmf_alloc_dbuf(task, sz, &minsz, 0);
3980 	if (dbuf == NULL) {
3981 		kmem_free(xd, xd->alloc_size);
3982 		stmf_abort(STMF_QUEUE_TASK_ABORT, task,
3983 		    STMF_ALLOC_FAILURE, NULL);
3984 		return;
3985 	}
3986 	dbuf->db_lu_private = xd;
3987 	stmf_xd_to_dbuf(dbuf);
3988 
3989 	dbuf->db_flags = DB_DIRECTION_TO_RPORT;
3990 	(void) stmf_xfer_data(task, dbuf, 0);
3991 
3992 }
3993 
3994 void
3995 stmf_scsilib_handle_task_mgmt(scsi_task_t *task)
3996 {
3997 	switch (task->task_mgmt_function) {
3998 	/*
3999 	 * For now we will abort all I/Os on the LU in case of ABORT_TASK_SET
4000 	 * and ABORT_TASK. But unlike LUN_RESET we will not reset LU state
4001 	 * in these cases. This needs to be changed to abort only the required
4002 	 * set.
4003 	 */
4004 	case TM_ABORT_TASK:
4005 	case TM_ABORT_TASK_SET:
4006 	case TM_CLEAR_TASK_SET:
4007 	case TM_LUN_RESET:
4008 		stmf_handle_lun_reset(task);
4009 		return;
4010 	case TM_TARGET_RESET:
4011 	case TM_TARGET_COLD_RESET:
4012 	case TM_TARGET_WARM_RESET:
4013 		stmf_handle_target_reset(task);
4014 		return;
4015 	default:
4016 		/* We dont support this task mgmt function */
4017 		stmf_scsilib_send_status(task, STATUS_CHECK,
4018 		    STMF_SAA_INVALID_FIELD_IN_CMD_IU);
4019 		return;
4020 	}
4021 }
4022 
4023 void
4024 stmf_handle_lun_reset(scsi_task_t *task)
4025 {
4026 	stmf_i_scsi_task_t *itask;
4027 	stmf_i_lu_t *ilu;
4028 
4029 	itask = (stmf_i_scsi_task_t *)task->task_stmf_private;
4030 	ilu = (stmf_i_lu_t *)task->task_lu->lu_stmf_private;
4031 
4032 	/*
4033 	 * To sync with target reset, grab this lock. The LU is not going
4034 	 * anywhere as there is atleast one task pending (this task).
4035 	 */
4036 	mutex_enter(&stmf_state.stmf_lock);
4037 
4038 	if (ilu->ilu_flags & ILU_RESET_ACTIVE) {
4039 		mutex_exit(&stmf_state.stmf_lock);
4040 		stmf_scsilib_send_status(task, STATUS_CHECK,
4041 				STMF_SAA_OPERATION_IN_PROGRESS);
4042 		return;
4043 	}
4044 	atomic_or_32(&ilu->ilu_flags, ILU_RESET_ACTIVE);
4045 	mutex_exit(&stmf_state.stmf_lock);
4046 
4047 	/*
4048 	 * Mark this task as the one causing LU reset so that we know who
4049 	 * was responsible for setting the ILU_RESET_ACTIVE. In case this
4050 	 * task itself gets aborted, we will clear ILU_RESET_ACTIVE.
4051 	 */
4052 	itask->itask_flags |= ITASK_DEFAULT_HANDLING | ITASK_CAUSING_LU_RESET;
4053 
4054 	/* Initiatiate abort on all commands on this LU except this one */
4055 	stmf_abort(STMF_QUEUE_ABORT_LU, task, STMF_ABORTED, task->task_lu);
4056 
4057 	/* Start polling on this task */
4058 	if (stmf_task_poll_lu(task, ITASK_DEFAULT_POLL_TIMEOUT)
4059 	    != STMF_SUCCESS) {
4060 		stmf_abort(STMF_QUEUE_TASK_ABORT, task, STMF_ALLOC_FAILURE,
4061 						NULL);
4062 		return;
4063 	}
4064 }
4065 
4066 void
4067 stmf_handle_target_reset(scsi_task_t *task)
4068 {
4069 	stmf_i_scsi_task_t *itask;
4070 	stmf_i_lu_t *ilu;
4071 	stmf_i_scsi_session_t *iss;
4072 	stmf_lun_map_t *lm;
4073 	stmf_lun_map_ent_t *lm_ent;
4074 	int i, lf;
4075 
4076 	itask = (stmf_i_scsi_task_t *)task->task_stmf_private;
4077 	iss = (stmf_i_scsi_session_t *)task->task_session->ss_stmf_private;
4078 	ilu = (stmf_i_lu_t *)task->task_lu->lu_stmf_private;
4079 
4080 	/*
4081 	 * To sync with LUN reset, grab this lock. The session is not going
4082 	 * anywhere as there is atleast one task pending (this task).
4083 	 */
4084 	mutex_enter(&stmf_state.stmf_lock);
4085 
4086 	/* Grab the session lock as a writer to prevent any changes in it */
4087 	rw_enter(iss->iss_lockp, RW_WRITER);
4088 
4089 	if (iss->iss_flags & ISS_RESET_ACTIVE) {
4090 		rw_exit(iss->iss_lockp);
4091 		mutex_exit(&stmf_state.stmf_lock);
4092 		stmf_scsilib_send_status(task, STATUS_CHECK,
4093 				STMF_SAA_OPERATION_IN_PROGRESS);
4094 		return;
4095 	}
4096 	atomic_or_32(&iss->iss_flags, ISS_RESET_ACTIVE);
4097 
4098 	/*
4099 	 * Now go through each LUN in this session and make sure all of them
4100 	 * can be reset.
4101 	 */
4102 	lm = iss->iss_sm;
4103 	for (i = 0, lf = 0; i < lm->lm_nentries; i++) {
4104 		if (lm->lm_plus[i] == NULL)
4105 			continue;
4106 		lf++;
4107 		lm_ent = (stmf_lun_map_ent_t *)lm->lm_plus[i];
4108 		ilu = (stmf_i_lu_t *)(lm_ent->ent_lu->lu_stmf_private);
4109 		if (ilu->ilu_flags & ILU_RESET_ACTIVE) {
4110 			atomic_and_32(&iss->iss_flags, ~ISS_RESET_ACTIVE);
4111 			rw_exit(iss->iss_lockp);
4112 			mutex_exit(&stmf_state.stmf_lock);
4113 			stmf_scsilib_send_status(task, STATUS_CHECK,
4114 					STMF_SAA_OPERATION_IN_PROGRESS);
4115 			return;
4116 		}
4117 	}
4118 	if (lf == 0) {
4119 		/* No luns in this session */
4120 		atomic_and_32(&iss->iss_flags, ~ISS_RESET_ACTIVE);
4121 		rw_exit(iss->iss_lockp);
4122 		mutex_exit(&stmf_state.stmf_lock);
4123 		stmf_scsilib_send_status(task, STATUS_GOOD, 0);
4124 		return;
4125 	}
4126 
4127 	/* ok, start the damage */
4128 	itask->itask_flags |= ITASK_DEFAULT_HANDLING |
4129 					ITASK_CAUSING_TARGET_RESET;
4130 	for (i = 0; i < lm->lm_nentries; i++) {
4131 		if (lm->lm_plus[i] == NULL)
4132 			continue;
4133 		lm_ent = (stmf_lun_map_ent_t *)lm->lm_plus[i];
4134 		ilu = (stmf_i_lu_t *)(lm_ent->ent_lu->lu_stmf_private);
4135 		atomic_or_32(&ilu->ilu_flags, ILU_RESET_ACTIVE);
4136 	}
4137 	rw_exit(iss->iss_lockp);
4138 	mutex_exit(&stmf_state.stmf_lock);
4139 
4140 	for (i = 0; i < lm->lm_nentries; i++) {
4141 		if (lm->lm_plus[i] == NULL)
4142 			continue;
4143 		lm_ent = (stmf_lun_map_ent_t *)lm->lm_plus[i];
4144 		stmf_abort(STMF_QUEUE_ABORT_LU, task, STMF_ABORTED,
4145 				lm_ent->ent_lu);
4146 	}
4147 
4148 	/* Start polling on this task */
4149 	if (stmf_task_poll_lu(task, ITASK_DEFAULT_POLL_TIMEOUT)
4150 	    != STMF_SUCCESS) {
4151 		stmf_abort(STMF_QUEUE_TASK_ABORT, task, STMF_ALLOC_FAILURE,
4152 						NULL);
4153 		return;
4154 	}
4155 }
4156 
4157 int
4158 stmf_handle_cmd_during_ic(stmf_i_scsi_task_t *itask)
4159 {
4160 	scsi_task_t *task = itask->itask_task;
4161 	stmf_i_scsi_session_t *iss = (stmf_i_scsi_session_t *)
4162 	    task->task_session->ss_stmf_private;
4163 
4164 	rw_enter(iss->iss_lockp, RW_WRITER);
4165 	if (((iss->iss_flags & ISS_LUN_INVENTORY_CHANGED) == 0) ||
4166 	    (task->task_cdb[0] == SCMD_INQUIRY)) {
4167 		rw_exit(iss->iss_lockp);
4168 		return (0);
4169 	}
4170 	atomic_and_32(&iss->iss_flags,
4171 		~(ISS_LUN_INVENTORY_CHANGED | ISS_GOT_INITIAL_LUNS));
4172 	rw_exit(iss->iss_lockp);
4173 
4174 	if (task->task_cdb[0] == SCMD_REPORT_LUNS) {
4175 		return (0);
4176 	}
4177 	stmf_scsilib_send_status(task, STATUS_CHECK,
4178 	    STMF_SAA_REPORT_LUN_DATA_HAS_CHANGED);
4179 	return (1);
4180 }
4181 
4182 void
4183 stmf_worker_init()
4184 {
4185 	uint32_t i;
4186 
4187 	/* Make local copy of global tunables */
4188 	stmf_i_max_nworkers = stmf_max_nworkers;
4189 	stmf_i_min_nworkers = stmf_min_nworkers;
4190 
4191 	ASSERT(stmf_workers == NULL);
4192 	if (stmf_i_min_nworkers < 4) {
4193 		stmf_i_min_nworkers = 4;
4194 	}
4195 	if (stmf_i_max_nworkers < stmf_i_min_nworkers) {
4196 		stmf_i_max_nworkers = stmf_i_min_nworkers;
4197 	}
4198 	stmf_workers = (stmf_worker_t *)kmem_zalloc(
4199 	    sizeof (stmf_worker_t) * stmf_i_max_nworkers, KM_SLEEP);
4200 	for (i = 0; i < stmf_i_max_nworkers; i++) {
4201 		stmf_worker_t *w = &stmf_workers[i];
4202 		mutex_init(&w->worker_lock, NULL, MUTEX_DRIVER, NULL);
4203 		cv_init(&w->worker_cv, NULL, CV_DRIVER, NULL);
4204 	}
4205 	stmf_worker_mgmt_delay = drv_usectohz(20 * 1000);
4206 	stmf_workers_state = STMF_WORKERS_ENABLED;
4207 
4208 	/* Workers will be started by stmf_worker_mgmt() */
4209 
4210 	/* Lets wait for atleast one worker to start */
4211 	while (stmf_nworkers_cur == 0)
4212 		delay(drv_usectohz(20 * 1000));
4213 	stmf_worker_mgmt_delay = drv_usectohz(3 * 1000 * 1000);
4214 }
4215 
4216 stmf_status_t
4217 stmf_worker_fini()
4218 {
4219 	int i;
4220 	clock_t sb;
4221 
4222 	if (stmf_workers_state == STMF_WORKERS_DISABLED)
4223 		return (STMF_SUCCESS);
4224 	ASSERT(stmf_workers);
4225 	stmf_workers_state = STMF_WORKERS_DISABLED;
4226 	stmf_worker_mgmt_delay = drv_usectohz(20 * 1000);
4227 	cv_signal(&stmf_state.stmf_cv);
4228 
4229 	sb = ddi_get_lbolt() + drv_usectohz(10 * 1000 * 1000);
4230 	/* Wait for all the threads to die */
4231 	while (stmf_nworkers_cur != 0) {
4232 		if (ddi_get_lbolt() > sb) {
4233 			stmf_workers_state = STMF_WORKERS_ENABLED;
4234 			return (STMF_BUSY);
4235 		}
4236 		delay(drv_usectohz(100 * 1000));
4237 	}
4238 	for (i = 0; i < stmf_i_max_nworkers; i++) {
4239 		stmf_worker_t *w = &stmf_workers[i];
4240 		mutex_destroy(&w->worker_lock);
4241 		cv_destroy(&w->worker_cv);
4242 	}
4243 	kmem_free(stmf_workers, sizeof (stmf_worker_t) * stmf_i_max_nworkers);
4244 	stmf_workers = NULL;
4245 
4246 	return (STMF_SUCCESS);
4247 }
4248 
4249 void
4250 stmf_worker_task(void *arg)
4251 {
4252 	stmf_worker_t *w;
4253 	stmf_i_scsi_session_t *iss;
4254 	scsi_task_t *task;
4255 	stmf_i_scsi_task_t *itask;
4256 	stmf_data_buf_t *dbuf;
4257 	stmf_lu_t *lu;
4258 	clock_t wait_timer = 0;
4259 	clock_t wait_ticks;
4260 	uint32_t old, new;
4261 	uint8_t curcmd;
4262 	uint8_t abort_free;
4263 	uint8_t wait_queue;
4264 	uint8_t dec_qdepth;
4265 
4266 	w = (stmf_worker_t *)arg;
4267 	wait_ticks = drv_usectohz(10000);
4268 
4269 	mutex_enter(&w->worker_lock);
4270 	w->worker_flags |= STMF_WORKER_STARTED | STMF_WORKER_ACTIVE;
4271 stmf_worker_loop:;
4272 	if ((w->worker_ref_count == 0) &&
4273 	    (w->worker_flags & STMF_WORKER_TERMINATE)) {
4274 		w->worker_flags &= ~(STMF_WORKER_STARTED |
4275 		    STMF_WORKER_ACTIVE | STMF_WORKER_TERMINATE);
4276 		w->worker_tid = NULL;
4277 		mutex_exit(&w->worker_lock);
4278 		thread_exit();
4279 	}
4280 	/* CONSTCOND */
4281 	while (1) {
4282 		dec_qdepth = 0;
4283 		if (wait_timer && (ddi_get_lbolt() >= wait_timer)) {
4284 			wait_timer = 0;
4285 			if (w->worker_wait_head) {
4286 				ASSERT(w->worker_wait_tail);
4287 				if (w->worker_task_head == NULL)
4288 					w->worker_task_head =
4289 					    w->worker_wait_head;
4290 				else
4291 					w->worker_task_tail->itask_worker_next =
4292 						w->worker_wait_head;
4293 				w->worker_task_tail = w->worker_wait_tail;
4294 				w->worker_wait_head = w->worker_wait_tail =
4295 				    NULL;
4296 			}
4297 		}
4298 		if ((itask = w->worker_task_head) == NULL) {
4299 			break;
4300 		}
4301 		task = itask->itask_task;
4302 		w->worker_task_head = itask->itask_worker_next;
4303 		if (w->worker_task_head == NULL)
4304 			w->worker_task_tail = NULL;
4305 
4306 		wait_queue = 0;
4307 		abort_free = 0;
4308 		if (itask->itask_ncmds > 0) {
4309 			curcmd = itask->itask_cmd_stack[itask->itask_ncmds - 1];
4310 		} else {
4311 			ASSERT(itask->itask_flags & ITASK_BEING_ABORTED);
4312 		}
4313 		do {
4314 			old = itask->itask_flags;
4315 			if (old & ITASK_BEING_ABORTED) {
4316 				itask->itask_ncmds = 1;
4317 				curcmd = itask->itask_cmd_stack[0] =
4318 				    ITASK_CMD_ABORT;
4319 				goto out_itask_flag_loop;
4320 			} else if ((curcmd & ITASK_CMD_MASK) ==
4321 			    ITASK_CMD_NEW_TASK) {
4322 				new = old | ITASK_KNOWN_TO_LU;
4323 			} else {
4324 				goto out_itask_flag_loop;
4325 			}
4326 		} while (atomic_cas_32(&itask->itask_flags, old, new) != old);
4327 
4328 out_itask_flag_loop:
4329 
4330 		/*
4331 		 * Decide if this task needs to go to a queue and/or if
4332 		 * we can decrement the itask_cmd_stack.
4333 		 */
4334 		if (curcmd == ITASK_CMD_ABORT) {
4335 			if (itask->itask_flags & (ITASK_KNOWN_TO_LU |
4336 			    ITASK_KNOWN_TO_TGT_PORT)) {
4337 				wait_queue = 1;
4338 			} else {
4339 				abort_free = 1;
4340 			}
4341 		} else if ((curcmd & ITASK_CMD_POLL) &&
4342 		    (itask->itask_poll_timeout > ddi_get_lbolt())) {
4343 			wait_queue = 1;
4344 		}
4345 
4346 		if (wait_queue) {
4347 			itask->itask_worker_next = NULL;
4348 			if (w->worker_wait_tail) {
4349 				w->worker_wait_tail->itask_worker_next = itask;
4350 			} else {
4351 				w->worker_wait_head = itask;
4352 			}
4353 			w->worker_wait_tail = itask;
4354 			if (wait_timer == 0) {
4355 				wait_timer = ddi_get_lbolt() + wait_ticks;
4356 			}
4357 		} else if ((--(itask->itask_ncmds)) != 0) {
4358 			itask->itask_worker_next = NULL;
4359 			if (w->worker_task_tail) {
4360 				w->worker_task_tail->itask_worker_next = itask;
4361 			} else {
4362 				w->worker_task_head = itask;
4363 			}
4364 			w->worker_task_tail = itask;
4365 		} else {
4366 			atomic_and_32(&itask->itask_flags,
4367 			    ~ITASK_IN_WORKER_QUEUE);
4368 			/*
4369 			 * This is where the queue depth should go down by
4370 			 * one but we delay that on purpose to account for
4371 			 * the call into the provider. The actual decrement
4372 			 * happens after the worker has done its job.
4373 			 */
4374 			dec_qdepth = 1;
4375 		}
4376 
4377 		/* We made it here means we are going to call LU */
4378 		if ((itask->itask_flags & ITASK_DEFAULT_HANDLING) == 0)
4379 			lu = task->task_lu;
4380 		else
4381 			lu = dlun0;
4382 		dbuf = itask->itask_dbufs[ITASK_CMD_BUF_NDX(curcmd)];
4383 		mutex_exit(&w->worker_lock);
4384 		curcmd &= ITASK_CMD_MASK;
4385 		switch (curcmd) {
4386 		case ITASK_CMD_NEW_TASK:
4387 			iss = (stmf_i_scsi_session_t *)
4388 			    task->task_session->ss_stmf_private;
4389 			if (iss->iss_flags & ISS_LUN_INVENTORY_CHANGED) {
4390 				if (stmf_handle_cmd_during_ic(itask))
4391 					break;
4392 			}
4393 #ifdef	DEBUG
4394 			if (stmf_drop_task_counter > 0) {
4395 				if (atomic_add_32_nv(
4396 				    (uint32_t *)&stmf_drop_task_counter,
4397 				    -1) == 1) {
4398 					break;
4399 				}
4400 			}
4401 #endif
4402 			lu->lu_new_task(task, dbuf);
4403 			break;
4404 		case ITASK_CMD_DATA_XFER_DONE:
4405 			lu->lu_dbuf_xfer_done(task, dbuf);
4406 			break;
4407 		case ITASK_CMD_STATUS_DONE:
4408 			lu->lu_send_status_done(task);
4409 			break;
4410 		case ITASK_CMD_ABORT:
4411 			if (abort_free) {
4412 				stmf_task_free(task);
4413 			} else {
4414 				stmf_do_task_abort(task);
4415 			}
4416 			break;
4417 		case ITASK_CMD_POLL_LU:
4418 			if (!wait_queue) {
4419 				lu->lu_task_poll(task);
4420 			}
4421 			break;
4422 		case ITASK_CMD_POLL_LPORT:
4423 			if (!wait_queue)
4424 				task->task_lport->lport_task_poll(task);
4425 			break;
4426 		case ITASK_CMD_SEND_STATUS:
4427 		/* case ITASK_CMD_XFER_DATA: */
4428 			break;
4429 		}
4430 		mutex_enter(&w->worker_lock);
4431 		if (dec_qdepth) {
4432 			w->worker_queue_depth--;
4433 		}
4434 	}
4435 	if ((w->worker_flags & STMF_WORKER_TERMINATE) && (wait_timer == 0)) {
4436 		if (w->worker_ref_count == 0)
4437 			goto stmf_worker_loop;
4438 		else
4439 			wait_timer = ddi_get_lbolt() + 1;
4440 	}
4441 	w->worker_flags &= ~STMF_WORKER_ACTIVE;
4442 	if (wait_timer) {
4443 		(void) cv_timedwait(&w->worker_cv, &w->worker_lock, wait_timer);
4444 	} else {
4445 		cv_wait(&w->worker_cv, &w->worker_lock);
4446 	}
4447 	w->worker_flags |= STMF_WORKER_ACTIVE;
4448 	goto stmf_worker_loop;
4449 }
4450 
4451 void
4452 stmf_worker_mgmt()
4453 {
4454 	int i;
4455 	int workers_needed;
4456 	uint32_t qd;
4457 	clock_t tps, d = 0;
4458 	uint32_t cur_max_ntasks = 0;
4459 	stmf_worker_t *w;
4460 
4461 	/* Check if we are trying to increase the # of threads */
4462 	for (i = stmf_nworkers_cur; i < stmf_nworkers_needed; i++) {
4463 		if (stmf_workers[i].worker_flags & STMF_WORKER_STARTED) {
4464 			stmf_nworkers_cur++;
4465 			stmf_nworkers_accepting_cmds++;
4466 		} else {
4467 			/* Wait for transition to complete */
4468 			return;
4469 		}
4470 	}
4471 	/* Check if we are trying to decrease the # of workers */
4472 	for (i = (stmf_nworkers_cur - 1); i >= stmf_nworkers_needed; i--) {
4473 		if ((stmf_workers[i].worker_flags & STMF_WORKER_STARTED) == 0) {
4474 			stmf_nworkers_cur--;
4475 			/*
4476 			 * stmf_nworkers_accepting_cmds has already been
4477 			 * updated by the request to reduce the # of workers.
4478 			 */
4479 		} else {
4480 			/* Wait for transition to complete */
4481 			return;
4482 		}
4483 	}
4484 	/* Check if we are being asked to quit */
4485 	if (stmf_workers_state != STMF_WORKERS_ENABLED) {
4486 		if (stmf_nworkers_cur) {
4487 			workers_needed = 0;
4488 			goto worker_mgmt_trigger_change;
4489 		}
4490 		return;
4491 	}
4492 	/* Check if we are starting */
4493 	if (stmf_nworkers_cur < stmf_i_min_nworkers) {
4494 		workers_needed = stmf_i_min_nworkers;
4495 		goto worker_mgmt_trigger_change;
4496 	}
4497 
4498 	tps = drv_usectohz(1 * 1000 * 1000);
4499 	if ((stmf_wm_last != 0) &&
4500 	    ((d = ddi_get_lbolt() - stmf_wm_last) > tps)) {
4501 		qd = 0;
4502 		for (i = 0; i < stmf_nworkers_accepting_cmds; i++) {
4503 			qd += stmf_workers[i].worker_max_qdepth_pu;
4504 			stmf_workers[i].worker_max_qdepth_pu = 0;
4505 			if (stmf_workers[i].worker_max_sys_qdepth_pu >
4506 			    cur_max_ntasks) {
4507 				cur_max_ntasks =
4508 				    stmf_workers[i].worker_max_sys_qdepth_pu;
4509 			}
4510 			stmf_workers[i].worker_max_sys_qdepth_pu = 0;
4511 		}
4512 	}
4513 	stmf_wm_last = ddi_get_lbolt();
4514 	if (d <= tps) {
4515 		/* still ramping up */
4516 		return;
4517 	}
4518 	/* max qdepth cannot be more than max tasks */
4519 	if (qd > cur_max_ntasks)
4520 		qd = cur_max_ntasks;
4521 
4522 	/* See if we have more workers */
4523 	if (qd < stmf_nworkers_accepting_cmds) {
4524 		/*
4525 		 * Since we dont reduce the worker count right away, monitor
4526 		 * the highest load during the scale_down_delay.
4527 		 */
4528 		if (qd > stmf_worker_scale_down_qd)
4529 			stmf_worker_scale_down_qd = qd;
4530 		if (stmf_worker_scale_down_timer == 0) {
4531 			stmf_worker_scale_down_timer = ddi_get_lbolt() +
4532 			    drv_usectohz(stmf_worker_scale_down_delay *
4533 			    1000 * 1000);
4534 			return;
4535 		}
4536 		if (ddi_get_lbolt() < stmf_worker_scale_down_timer) {
4537 			return;
4538 		}
4539 		/* Its time to reduce the workers */
4540 		if (stmf_worker_scale_down_qd < stmf_i_min_nworkers)
4541 			stmf_worker_scale_down_qd = stmf_i_min_nworkers;
4542 		if (stmf_worker_scale_down_qd > stmf_i_max_nworkers)
4543 			stmf_worker_scale_down_qd = stmf_i_max_nworkers;
4544 		if (stmf_worker_scale_down_qd == stmf_nworkers_cur)
4545 			return;
4546 		workers_needed = stmf_worker_scale_down_qd;
4547 		stmf_worker_scale_down_qd = 0;
4548 		goto worker_mgmt_trigger_change;
4549 	}
4550 	stmf_worker_scale_down_qd = 0;
4551 	stmf_worker_scale_down_timer = 0;
4552 	if (qd > stmf_i_max_nworkers)
4553 		qd = stmf_i_max_nworkers;
4554 	if (qd < stmf_i_min_nworkers)
4555 		qd = stmf_i_min_nworkers;
4556 	if (qd == stmf_nworkers_cur)
4557 		return;
4558 	workers_needed = qd;
4559 	goto worker_mgmt_trigger_change;
4560 
4561 	/* NOTREACHED */
4562 	return;
4563 
4564 worker_mgmt_trigger_change:
4565 	ASSERT(workers_needed != stmf_nworkers_cur);
4566 	if (workers_needed > stmf_nworkers_cur) {
4567 		stmf_nworkers_needed = workers_needed;
4568 		for (i = stmf_nworkers_cur; i < workers_needed; i++) {
4569 			w = &stmf_workers[i];
4570 			w->worker_tid = thread_create(NULL, 0, stmf_worker_task,
4571 			    (void *)&stmf_workers[i], 0, &p0, TS_RUN,
4572 			    minclsyspri);
4573 		}
4574 		return;
4575 	}
4576 	/* At this point we know that we are decreasing the # of workers */
4577 	stmf_nworkers_accepting_cmds = workers_needed;
4578 	stmf_nworkers_needed = workers_needed;
4579 	/* Signal the workers that its time to quit */
4580 	for (i = (stmf_nworkers_cur - 1); i >= stmf_nworkers_needed; i--) {
4581 		w = &stmf_workers[i];
4582 		ASSERT(w && (w->worker_flags & STMF_WORKER_STARTED));
4583 		mutex_enter(&w->worker_lock);
4584 		w->worker_flags |= STMF_WORKER_TERMINATE;
4585 		if ((w->worker_flags & STMF_WORKER_ACTIVE) == 0)
4586 			cv_signal(&w->worker_cv);
4587 		mutex_exit(&w->worker_lock);
4588 	}
4589 }
4590 
4591 /*
4592  * Fills out a dbuf from stmf_xfer_data_t (contained in the db_lu_private).
4593  * If all the data has been filled out, frees the xd and makes
4594  * db_lu_private NULL.
4595  */
4596 void
4597 stmf_xd_to_dbuf(stmf_data_buf_t *dbuf)
4598 {
4599 	stmf_xfer_data_t *xd;
4600 	uint8_t *p;
4601 	int i;
4602 	uint32_t s;
4603 
4604 	xd = (stmf_xfer_data_t *)dbuf->db_lu_private;
4605 	dbuf->db_data_size = 0;
4606 	dbuf->db_relative_offset = xd->size_done;
4607 	for (i = 0; i < dbuf->db_sglist_length; i++) {
4608 		s = min(xd->size_left, dbuf->db_sglist[i].seg_length);
4609 		p = &xd->buf[xd->size_done];
4610 		bcopy(p, dbuf->db_sglist[i].seg_addr, s);
4611 		xd->size_left -= s;
4612 		xd->size_done += s;
4613 		dbuf->db_data_size += s;
4614 		if (xd->size_left == 0) {
4615 			kmem_free(xd, xd->alloc_size);
4616 			dbuf->db_lu_private = NULL;
4617 			return;
4618 		}
4619 	}
4620 }
4621 
4622 /* ARGSUSED */
4623 stmf_status_t
4624 stmf_dlun0_task_alloc(scsi_task_t *task)
4625 {
4626 	return (STMF_SUCCESS);
4627 }
4628 
4629 void
4630 stmf_dlun0_new_task(scsi_task_t *task, stmf_data_buf_t *dbuf)
4631 {
4632 	uint8_t *cdbp = (uint8_t *)&task->task_cdb[0];
4633 	stmf_i_scsi_session_t *iss;
4634 	uint32_t sz, minsz;
4635 	uint8_t *p;
4636 	stmf_xfer_data_t *xd;
4637 	uint8_t inq_page_length = 31;
4638 
4639 	if (task->task_mgmt_function) {
4640 		stmf_scsilib_handle_task_mgmt(task);
4641 		return;
4642 	}
4643 
4644 	switch (cdbp[0]) {
4645 	case SCMD_INQUIRY:
4646 		/*
4647 		 * Basic protocol checks.  In addition, only reply to
4648 		 * standard inquiry.  Otherwise, the LU provider needs
4649 		 * to respond.
4650 		 */
4651 
4652 		if (cdbp[2] || (cdbp[1] & 1) || cdbp[5]) {
4653 			stmf_scsilib_send_status(task, STATUS_CHECK,
4654 			    STMF_SAA_INVALID_FIELD_IN_CDB);
4655 			return;
4656 		}
4657 
4658 		task->task_cmd_xfer_length =
4659 		    (((uint32_t)cdbp[3]) << 8) | cdbp[4];
4660 
4661 		if (task->task_additional_flags &
4662 		    TASK_AF_NO_EXPECTED_XFER_LENGTH) {
4663 			task->task_expected_xfer_length =
4664 			    task->task_cmd_xfer_length;
4665 		}
4666 
4667 		sz = min(task->task_expected_xfer_length,
4668 		    min(36, task->task_cmd_xfer_length));
4669 		minsz = 36;
4670 
4671 		if (sz == 0) {
4672 			stmf_scsilib_send_status(task, STATUS_GOOD, 0);
4673 			return;
4674 		}
4675 
4676 		if (dbuf && (dbuf->db_sglist[0].seg_length < 36)) {
4677 			/*
4678 			 * Ignore any preallocated dbuf if the size is less
4679 			 * than 36. It will be freed during the task_free.
4680 			 */
4681 			dbuf = NULL;
4682 		}
4683 		if (dbuf == NULL)
4684 			dbuf = stmf_alloc_dbuf(task, minsz, &minsz, 0);
4685 		if ((dbuf == NULL) || (dbuf->db_sglist[0].seg_length < sz)) {
4686 			stmf_abort(STMF_QUEUE_TASK_ABORT, task,
4687 			    STMF_ALLOC_FAILURE, NULL);
4688 			return;
4689 		}
4690 		dbuf->db_lu_private = NULL;
4691 
4692 		p = dbuf->db_sglist[0].seg_addr;
4693 
4694 		/*
4695 		 * Standard inquiry handling only.
4696 		 */
4697 
4698 		bzero(p, inq_page_length + 5);
4699 
4700 		p[0] = DPQ_SUPPORTED | DTYPE_UNKNOWN;
4701 		p[2] = 5;
4702 		p[3] = 0x12;
4703 		p[4] = inq_page_length;
4704 		p[6] = 0x80;
4705 
4706 		(void) strncpy((char *)p+8, "SUN     ", 8);
4707 		(void) strncpy((char *)p+16, "COMSTAR	       ", 16);
4708 		(void) strncpy((char *)p+32, "1.0 ", 4);
4709 
4710 		dbuf->db_data_size = sz;
4711 		dbuf->db_relative_offset = 0;
4712 		dbuf->db_flags = DB_DIRECTION_TO_RPORT;
4713 		(void) stmf_xfer_data(task, dbuf, 0);
4714 
4715 		return;
4716 
4717 	case SCMD_REPORT_LUNS:
4718 		task->task_cmd_xfer_length =
4719 		    ((((uint32_t)task->task_cdb[6]) << 24) |
4720 		    (((uint32_t)task->task_cdb[7]) << 16) |
4721 		    (((uint32_t)task->task_cdb[8]) << 8) |
4722 		    ((uint32_t)task->task_cdb[9]));
4723 
4724 		if (task->task_additional_flags &
4725 		    TASK_AF_NO_EXPECTED_XFER_LENGTH) {
4726 			task->task_expected_xfer_length =
4727 			    task->task_cmd_xfer_length;
4728 		}
4729 
4730 		sz = min(task->task_expected_xfer_length,
4731 		    task->task_cmd_xfer_length);
4732 
4733 		if (sz < 16) {
4734 			stmf_scsilib_send_status(task, STATUS_CHECK,
4735 				STMF_SAA_INVALID_FIELD_IN_CDB);
4736 			return;
4737 		}
4738 
4739 		iss = (stmf_i_scsi_session_t *)
4740 		    task->task_session->ss_stmf_private;
4741 		rw_enter(iss->iss_lockp, RW_WRITER);
4742 		xd = stmf_session_prepare_report_lun_data(iss->iss_sm);
4743 		rw_exit(iss->iss_lockp);
4744 
4745 		if (xd == NULL) {
4746 			stmf_abort(STMF_QUEUE_TASK_ABORT, task,
4747 			    STMF_ALLOC_FAILURE, NULL);
4748 			return;
4749 		}
4750 
4751 		sz = min(sz, xd->size_left);
4752 		xd->size_left = sz;
4753 		minsz = min(512, sz);
4754 
4755 		if (dbuf == NULL)
4756 			dbuf = stmf_alloc_dbuf(task, sz, &minsz, 0);
4757 		if (dbuf == NULL) {
4758 			kmem_free(xd, xd->alloc_size);
4759 			stmf_abort(STMF_QUEUE_TASK_ABORT, task,
4760 			    STMF_ALLOC_FAILURE, NULL);
4761 			return;
4762 		}
4763 		dbuf->db_lu_private = xd;
4764 		stmf_xd_to_dbuf(dbuf);
4765 
4766 		atomic_and_32(&iss->iss_flags,
4767 			~(ISS_LUN_INVENTORY_CHANGED | ISS_GOT_INITIAL_LUNS));
4768 		dbuf->db_flags = DB_DIRECTION_TO_RPORT;
4769 		(void) stmf_xfer_data(task, dbuf, 0);
4770 		return;
4771 	}
4772 
4773 	stmf_scsilib_send_status(task, STATUS_CHECK, STMF_SAA_INVALID_OPCODE);
4774 }
4775 
4776 void
4777 stmf_dlun0_dbuf_done(scsi_task_t *task, stmf_data_buf_t *dbuf)
4778 {
4779 	if (dbuf->db_xfer_status != STMF_SUCCESS) {
4780 		stmf_abort(STMF_QUEUE_TASK_ABORT, task,
4781 		    dbuf->db_xfer_status, NULL);
4782 		return;
4783 	}
4784 	task->task_nbytes_transferred = dbuf->db_data_size;
4785 	if (dbuf->db_lu_private) {
4786 		/* There is more */
4787 		stmf_xd_to_dbuf(dbuf);
4788 		(void) stmf_xfer_data(task, dbuf, 0);
4789 		return;
4790 	}
4791 	stmf_scsilib_send_status(task, STATUS_GOOD, 0);
4792 }
4793 
4794 /* ARGSUSED */
4795 void
4796 stmf_dlun0_status_done(scsi_task_t *task)
4797 {
4798 }
4799 
4800 /* ARGSUSED */
4801 void
4802 stmf_dlun0_task_free(scsi_task_t *task)
4803 {
4804 }
4805 
4806 /* ARGSUSED */
4807 stmf_status_t
4808 stmf_dlun0_abort(struct stmf_lu *lu, int abort_cmd, void *arg, uint32_t flags)
4809 {
4810 	scsi_task_t *task = (scsi_task_t *)arg;
4811 	stmf_i_scsi_task_t *itask =
4812 			(stmf_i_scsi_task_t *)task->task_stmf_private;
4813 	stmf_i_lu_t *ilu = (stmf_i_lu_t *)task->task_lu->lu_stmf_private;
4814 	int i;
4815 	uint8_t map;
4816 
4817 	ASSERT(abort_cmd == STMF_LU_ABORT_TASK);
4818 	if ((task->task_mgmt_function) && (itask->itask_flags &
4819 	    (ITASK_CAUSING_LU_RESET | ITASK_CAUSING_TARGET_RESET))) {
4820 		switch (task->task_mgmt_function) {
4821 		case TM_ABORT_TASK:
4822 		case TM_ABORT_TASK_SET:
4823 		case TM_CLEAR_TASK_SET:
4824 		case TM_LUN_RESET:
4825 			atomic_and_32(&ilu->ilu_flags, ~ILU_RESET_ACTIVE);
4826 			break;
4827 		case TM_TARGET_RESET:
4828 		case TM_TARGET_COLD_RESET:
4829 		case TM_TARGET_WARM_RESET:
4830 			stmf_abort_target_reset(task);
4831 			break;
4832 		}
4833 		return (STMF_ABORT_SUCCESS);
4834 	}
4835 
4836 	/*
4837 	 * OK so its not a task mgmt. Make sure we free any xd sitting
4838 	 * inside any dbuf.
4839 	 */
4840 	if ((map = itask->itask_allocated_buf_map) != 0) {
4841 		for (i = 0; i < 4; i++) {
4842 			if ((map & 1) &&
4843 			    ((itask->itask_dbufs[i])->db_lu_private)) {
4844 				stmf_xfer_data_t *xd;
4845 				stmf_data_buf_t *dbuf;
4846 
4847 				dbuf = itask->itask_dbufs[i];
4848 				xd = (stmf_xfer_data_t *)dbuf->db_lu_private;
4849 				dbuf->db_lu_private = NULL;
4850 				kmem_free(xd, xd->alloc_size);
4851 			}
4852 			map >>= 1;
4853 		}
4854 	}
4855 	return (STMF_ABORT_SUCCESS);
4856 }
4857 
4858 void
4859 stmf_dlun0_task_poll(struct scsi_task *task)
4860 {
4861 	/* Right now we only do this for handling task management functions */
4862 	ASSERT(task->task_mgmt_function);
4863 
4864 	switch (task->task_mgmt_function) {
4865 	case TM_ABORT_TASK:
4866 	case TM_ABORT_TASK_SET:
4867 	case TM_CLEAR_TASK_SET:
4868 	case TM_LUN_RESET:
4869 		(void) stmf_lun_reset_poll(task->task_lu, task, 0);
4870 		return;
4871 	case TM_TARGET_RESET:
4872 	case TM_TARGET_COLD_RESET:
4873 	case TM_TARGET_WARM_RESET:
4874 		stmf_target_reset_poll(task);
4875 		return;
4876 	}
4877 }
4878 
4879 /* ARGSUSED */
4880 void
4881 stmf_dlun0_ctl(struct stmf_lu *lu, int cmd, void *arg)
4882 {
4883 	/* This function will never be called */
4884 	cmn_err(CE_WARN, "stmf_dlun0_ctl called with cmd %x", cmd);
4885 }
4886 
4887 void
4888 stmf_dlun_init()
4889 {
4890 	stmf_i_lu_t *ilu;
4891 
4892 	dlun0 = stmf_alloc(STMF_STRUCT_STMF_LU, 0, 0);
4893 	dlun0->lu_task_alloc = stmf_dlun0_task_alloc;
4894 	dlun0->lu_new_task = stmf_dlun0_new_task;
4895 	dlun0->lu_dbuf_xfer_done = stmf_dlun0_dbuf_done;
4896 	dlun0->lu_send_status_done = stmf_dlun0_status_done;
4897 	dlun0->lu_task_free = stmf_dlun0_task_free;
4898 	dlun0->lu_abort = stmf_dlun0_abort;
4899 	dlun0->lu_task_poll = stmf_dlun0_task_poll;
4900 	dlun0->lu_ctl = stmf_dlun0_ctl;
4901 
4902 	ilu = (stmf_i_lu_t *)dlun0->lu_stmf_private;
4903 	ilu->ilu_cur_task_cntr = &ilu->ilu_task_cntr1;
4904 }
4905 
4906 stmf_status_t
4907 stmf_dlun_fini()
4908 {
4909 	stmf_i_lu_t *ilu;
4910 
4911 	ilu = (stmf_i_lu_t *)dlun0->lu_stmf_private;
4912 
4913 	ASSERT(ilu->ilu_ntasks == ilu->ilu_ntasks_free);
4914 	if (ilu->ilu_ntasks) {
4915 		stmf_i_scsi_task_t *itask, *nitask;
4916 
4917 		nitask = ilu->ilu_tasks;
4918 		do {
4919 			itask = nitask;
4920 			nitask = itask->itask_lu_next;
4921 			dlun0->lu_task_free(itask->itask_task);
4922 			stmf_free(itask->itask_task);
4923 		} while (nitask != NULL);
4924 
4925 	}
4926 	stmf_free(dlun0);
4927 	return (STMF_SUCCESS);
4928 }
4929 
4930 void
4931 stmf_abort_target_reset(scsi_task_t *task)
4932 {
4933 	stmf_i_scsi_session_t *iss = (stmf_i_scsi_session_t *)
4934 				task->task_session->ss_stmf_private;
4935 	stmf_lun_map_t *lm;
4936 	stmf_lun_map_ent_t *lm_ent;
4937 	stmf_i_lu_t *ilu;
4938 	int i;
4939 
4940 	ASSERT(iss->iss_flags & ISS_RESET_ACTIVE);
4941 
4942 	rw_enter(iss->iss_lockp, RW_READER);
4943 	lm = iss->iss_sm;
4944 	for (i = 0; i < lm->lm_nentries; i++) {
4945 		if (lm->lm_plus[i] == NULL)
4946 			continue;
4947 		lm_ent = (stmf_lun_map_ent_t *)lm->lm_plus[i];
4948 		ilu = (stmf_i_lu_t *)lm_ent->ent_lu->lu_stmf_private;
4949 		if (ilu->ilu_flags & ILU_RESET_ACTIVE) {
4950 			atomic_and_32(&ilu->ilu_flags, ~ILU_RESET_ACTIVE);
4951 		}
4952 	}
4953 	atomic_and_32(&iss->iss_flags, ~ISS_RESET_ACTIVE);
4954 	rw_exit(iss->iss_lockp);
4955 }
4956 
4957 /*
4958  * The return value is only used by function managing target reset.
4959  */
4960 stmf_status_t
4961 stmf_lun_reset_poll(stmf_lu_t *lu, struct scsi_task *task, int target_reset)
4962 {
4963 	stmf_i_lu_t *ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
4964 	int ntasks_pending;
4965 
4966 	ntasks_pending = ilu->ilu_ntasks - ilu->ilu_ntasks_free;
4967 	/*
4968 	 * This function is also used during Target reset. The idea is that
4969 	 * once all the commands are aborted, call the LU's reset entry
4970 	 * point (abort entry point with a reset flag). But if this Task
4971 	 * mgmt is running on this LU then all the tasks cannot be aborted.
4972 	 * one task (this task) will still be running which is OK.
4973 	 */
4974 	if ((ntasks_pending == 0) || ((task->task_lu == lu) &&
4975 	    (ntasks_pending == 1))) {
4976 		stmf_status_t ret;
4977 
4978 		if ((task->task_mgmt_function == TM_LUN_RESET) ||
4979 		    (task->task_mgmt_function == TM_TARGET_RESET) ||
4980 		    (task->task_mgmt_function == TM_TARGET_WARM_RESET) ||
4981 		    (task->task_mgmt_function == TM_TARGET_COLD_RESET)) {
4982 			ret = lu->lu_abort(lu, STMF_LU_RESET_STATE, task, 0);
4983 		} else {
4984 			ret = STMF_SUCCESS;
4985 		}
4986 		if (ret == STMF_SUCCESS) {
4987 			atomic_and_32(&ilu->ilu_flags, ~ILU_RESET_ACTIVE);
4988 		}
4989 		if (target_reset) {
4990 			return (ret);
4991 		}
4992 		if (ret == STMF_SUCCESS) {
4993 			stmf_scsilib_send_status(task, STATUS_GOOD, 0);
4994 			return (ret);
4995 		}
4996 		if (ret != STMF_BUSY) {
4997 			stmf_abort(STMF_QUEUE_TASK_ABORT, task, ret, NULL);
4998 			return (ret);
4999 		}
5000 	}
5001 
5002 	if (target_reset) {
5003 		/* Tell target reset polling code that we are not done */
5004 		return (STMF_BUSY);
5005 	}
5006 
5007 	if (stmf_task_poll_lu(task, ITASK_DEFAULT_POLL_TIMEOUT)
5008 	    != STMF_SUCCESS) {
5009 		stmf_abort(STMF_QUEUE_TASK_ABORT, task,
5010 		    STMF_ALLOC_FAILURE, NULL);
5011 		return (STMF_SUCCESS);
5012 	}
5013 
5014 	return (STMF_SUCCESS);
5015 }
5016 
5017 void
5018 stmf_target_reset_poll(struct scsi_task *task)
5019 {
5020 	stmf_i_scsi_session_t *iss = (stmf_i_scsi_session_t *)
5021 				task->task_session->ss_stmf_private;
5022 	stmf_lun_map_t *lm;
5023 	stmf_lun_map_ent_t *lm_ent;
5024 	stmf_i_lu_t *ilu;
5025 	stmf_status_t ret;
5026 	int i;
5027 	int not_done = 0;
5028 
5029 	ASSERT(iss->iss_flags & ISS_RESET_ACTIVE);
5030 
5031 	rw_enter(iss->iss_lockp, RW_READER);
5032 	lm = iss->iss_sm;
5033 	for (i = 0; i < lm->lm_nentries; i++) {
5034 		if (lm->lm_plus[i] == NULL)
5035 			continue;
5036 		lm_ent = (stmf_lun_map_ent_t *)lm->lm_plus[i];
5037 		ilu = (stmf_i_lu_t *)lm_ent->ent_lu->lu_stmf_private;
5038 		if (ilu->ilu_flags & ILU_RESET_ACTIVE) {
5039 			rw_exit(iss->iss_lockp);
5040 			ret = stmf_lun_reset_poll(lm_ent->ent_lu, task, 1);
5041 			rw_enter(iss->iss_lockp, RW_READER);
5042 			if (ret == STMF_SUCCESS)
5043 				continue;
5044 			not_done = 1;
5045 			if (ret != STMF_BUSY) {
5046 				rw_exit(iss->iss_lockp);
5047 				stmf_abort(STMF_QUEUE_TASK_ABORT, task,
5048 				    STMF_ABORTED, NULL);
5049 				return;
5050 			}
5051 		}
5052 	}
5053 	rw_exit(iss->iss_lockp);
5054 
5055 	if (not_done) {
5056 		if (stmf_task_poll_lu(task, ITASK_DEFAULT_POLL_TIMEOUT)
5057 		    != STMF_SUCCESS) {
5058 			stmf_abort(STMF_QUEUE_TASK_ABORT, task,
5059 			    STMF_ALLOC_FAILURE, NULL);
5060 			return;
5061 		}
5062 		return;
5063 	}
5064 
5065 	atomic_and_32(&iss->iss_flags, ~ISS_RESET_ACTIVE);
5066 
5067 	stmf_scsilib_send_status(task, STATUS_GOOD, 0);
5068 }
5069 
5070 stmf_status_t
5071 stmf_lu_add_event(stmf_lu_t *lu, int eventid)
5072 {
5073 	stmf_i_lu_t *ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
5074 
5075 	if ((eventid < 0) || (eventid >= STMF_MAX_NUM_EVENTS)) {
5076 		return (STMF_INVALID_ARG);
5077 	}
5078 
5079 	STMF_EVENT_ADD(ilu->ilu_event_hdl, eventid);
5080 	return (STMF_SUCCESS);
5081 }
5082 
5083 stmf_status_t
5084 stmf_lu_remove_event(stmf_lu_t *lu, int eventid)
5085 {
5086 	stmf_i_lu_t *ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
5087 
5088 	if (eventid == STMF_EVENT_ALL) {
5089 		STMF_EVENT_CLEAR_ALL(ilu->ilu_event_hdl);
5090 		return (STMF_SUCCESS);
5091 	}
5092 
5093 	if ((eventid < 0) || (eventid >= STMF_MAX_NUM_EVENTS)) {
5094 		return (STMF_INVALID_ARG);
5095 	}
5096 
5097 	STMF_EVENT_REMOVE(ilu->ilu_event_hdl, eventid);
5098 	return (STMF_SUCCESS);
5099 }
5100 
5101 stmf_status_t
5102 stmf_lport_add_event(stmf_local_port_t *lport, int eventid)
5103 {
5104 	stmf_i_local_port_t *ilport =
5105 		(stmf_i_local_port_t *)lport->lport_stmf_private;
5106 
5107 	if ((eventid < 0) || (eventid >= STMF_MAX_NUM_EVENTS)) {
5108 		return (STMF_INVALID_ARG);
5109 	}
5110 
5111 	STMF_EVENT_ADD(ilport->ilport_event_hdl, eventid);
5112 	return (STMF_SUCCESS);
5113 }
5114 
5115 stmf_status_t
5116 stmf_lport_remove_event(stmf_local_port_t *lport, int eventid)
5117 {
5118 	stmf_i_local_port_t *ilport =
5119 		(stmf_i_local_port_t *)lport->lport_stmf_private;
5120 
5121 	if (eventid == STMF_EVENT_ALL) {
5122 		STMF_EVENT_CLEAR_ALL(ilport->ilport_event_hdl);
5123 		return (STMF_SUCCESS);
5124 	}
5125 
5126 	if ((eventid < 0) || (eventid >= STMF_MAX_NUM_EVENTS)) {
5127 		return (STMF_INVALID_ARG);
5128 	}
5129 
5130 	STMF_EVENT_REMOVE(ilport->ilport_event_hdl, eventid);
5131 	return (STMF_SUCCESS);
5132 }
5133 
5134 void
5135 stmf_generate_lu_event(stmf_i_lu_t *ilu, int eventid, void *arg, uint32_t flags)
5136 {
5137 	if (STMF_EVENT_ENABLED(ilu->ilu_event_hdl, eventid) &&
5138 	    (ilu->ilu_lu->lu_event_handler != NULL)) {
5139 		ilu->ilu_lu->lu_event_handler(ilu->ilu_lu, eventid, arg, flags);
5140 	}
5141 }
5142 
5143 void
5144 stmf_generate_lport_event(stmf_i_local_port_t *ilport, int eventid, void *arg,
5145 				uint32_t flags)
5146 {
5147 	if (STMF_EVENT_ENABLED(ilport->ilport_event_hdl, eventid) &&
5148 	    (ilport->ilport_lport->lport_event_handler != NULL)) {
5149 		ilport->ilport_lport->lport_event_handler(
5150 		    ilport->ilport_lport, eventid, arg, flags);
5151 	}
5152 }
5153 
5154 void
5155 stmf_svc_init()
5156 {
5157 	if (stmf_state.stmf_svc_flags & STMF_SVC_STARTED)
5158 		return;
5159 	stmf_state.stmf_svc_taskq = ddi_taskq_create(0, "STMF_SVC_TASKQ", 1,
5160 	    TASKQ_DEFAULTPRI, 0);
5161 	(void) ddi_taskq_dispatch(stmf_state.stmf_svc_taskq,
5162 	    stmf_svc, 0, DDI_SLEEP);
5163 }
5164 
5165 stmf_status_t
5166 stmf_svc_fini()
5167 {
5168 	uint32_t i;
5169 
5170 	mutex_enter(&stmf_state.stmf_lock);
5171 	if (stmf_state.stmf_svc_flags & STMF_SVC_STARTED) {
5172 		stmf_state.stmf_svc_flags |= STMF_SVC_TERMINATE;
5173 		cv_signal(&stmf_state.stmf_cv);
5174 	}
5175 	mutex_exit(&stmf_state.stmf_lock);
5176 
5177 	/* Wait for 5 seconds */
5178 	for (i = 0; i < 500; i++) {
5179 		if (stmf_state.stmf_svc_flags & STMF_SVC_STARTED)
5180 			delay(drv_usectohz(10000));
5181 		else
5182 			break;
5183 	}
5184 	if (i == 500)
5185 		return (STMF_BUSY);
5186 
5187 	ddi_taskq_destroy(stmf_state.stmf_svc_taskq);
5188 
5189 	return (STMF_SUCCESS);
5190 }
5191 
5192 /* ARGSUSED */
5193 void
5194 stmf_svc(void *arg)
5195 {
5196 	stmf_svc_req_t *req, **preq;
5197 	clock_t td;
5198 	clock_t	drain_start, drain_next = 0;
5199 	clock_t	timing_start, timing_next = 0;
5200 	clock_t worker_delay = 0;
5201 	int deq;
5202 	stmf_lu_t *lu;
5203 	stmf_i_lu_t *ilu;
5204 	stmf_local_port_t *lport;
5205 	stmf_i_local_port_t *ilport, *next_ilport;
5206 	stmf_i_scsi_session_t *iss;
5207 
5208 	td = drv_usectohz(20000);
5209 
5210 	mutex_enter(&stmf_state.stmf_lock);
5211 	stmf_state.stmf_svc_flags |= STMF_SVC_STARTED | STMF_SVC_ACTIVE;
5212 
5213 stmf_svc_loop:
5214 	if (stmf_state.stmf_svc_flags & STMF_SVC_TERMINATE) {
5215 		stmf_state.stmf_svc_flags &=
5216 		    ~(STMF_SVC_STARTED | STMF_SVC_ACTIVE);
5217 		mutex_exit(&stmf_state.stmf_lock);
5218 		return;
5219 	}
5220 
5221 	if (stmf_state.stmf_svc_active) {
5222 		int waitq_add = 0;
5223 		req = stmf_state.stmf_svc_active;
5224 		stmf_state.stmf_svc_active = req->svc_next;
5225 
5226 		switch (req->svc_cmd) {
5227 		case STMF_CMD_LPORT_ONLINE:
5228 			/* Fallthrough */
5229 		case STMF_CMD_LPORT_OFFLINE:
5230 			/* Fallthrough */
5231 		case STMF_CMD_LU_ONLINE:
5232 			/* Nothing to do */
5233 			waitq_add = 1;
5234 			break;
5235 
5236 		case STMF_CMD_LU_OFFLINE:
5237 			/* Remove all mappings of this LU */
5238 			stmf_session_lu_unmapall((stmf_lu_t *)req->svc_obj);
5239 			/* Kill all the pending I/Os for this LU */
5240 			mutex_exit(&stmf_state.stmf_lock);
5241 			stmf_task_lu_killall((stmf_lu_t *)req->svc_obj, NULL,
5242 				STMF_ABORTED);
5243 			mutex_enter(&stmf_state.stmf_lock);
5244 			waitq_add = 1;
5245 			break;
5246 		default:
5247 			cmn_err(CE_PANIC, "stmf_svc: unknown cmd %d",
5248 			    req->svc_cmd);
5249 		}
5250 
5251 		if (waitq_add) {
5252 			/* Put it in the wait queue */
5253 			req->svc_next = stmf_state.stmf_svc_waiting;
5254 			stmf_state.stmf_svc_waiting = req;
5255 		}
5256 	}
5257 
5258 	/* The waiting list is not going to be modified by anybody else */
5259 	mutex_exit(&stmf_state.stmf_lock);
5260 
5261 	for (preq = &stmf_state.stmf_svc_waiting; (*preq) != NULL; ) {
5262 		req = *preq;
5263 		deq = 0;
5264 		switch (req->svc_cmd) {
5265 		case STMF_CMD_LU_ONLINE:
5266 			lu = (stmf_lu_t *)req->svc_obj;
5267 			deq = 1;
5268 			lu->lu_ctl(lu, req->svc_cmd, &req->svc_info);
5269 			break;
5270 
5271 		case STMF_CMD_LU_OFFLINE:
5272 			lu = (stmf_lu_t *)req->svc_obj;
5273 			ilu = (stmf_i_lu_t *)lu->lu_stmf_private;
5274 			if (ilu->ilu_ntasks != ilu->ilu_ntasks_free)
5275 				break;
5276 			deq = 1;
5277 			lu->lu_ctl(lu, req->svc_cmd, &req->svc_info);
5278 			break;
5279 
5280 		case STMF_CMD_LPORT_OFFLINE:
5281 			/* Fallthrough */
5282 		case STMF_CMD_LPORT_ONLINE:
5283 			lport = (stmf_local_port_t *)req->svc_obj;
5284 			deq = 1;
5285 			lport->lport_ctl(lport, req->svc_cmd, &req->svc_info);
5286 			break;
5287 		}
5288 		if (deq) {
5289 			*preq = req->svc_next;
5290 			kmem_free(req, req->svc_req_alloc_size);
5291 		} else {
5292 			preq = &req->svc_next;
5293 		}
5294 	}
5295 
5296 	mutex_enter(&stmf_state.stmf_lock);
5297 	if (stmf_state.stmf_svc_active == NULL) {
5298 		/* Do timeouts */
5299 		if (stmf_state.stmf_nlus &&
5300 		    ((!timing_next) || (ddi_get_lbolt() >= timing_next))) {
5301 			if (!stmf_state.stmf_svc_ilu_timing) {
5302 				/* we are starting a new round */
5303 				stmf_state.stmf_svc_ilu_timing =
5304 				    stmf_state.stmf_ilulist;
5305 				timing_start = ddi_get_lbolt();
5306 			}
5307 			stmf_check_ilu_timing();
5308 			if (!stmf_state.stmf_svc_ilu_timing) {
5309 				/* we finished a complete round */
5310 				timing_next =
5311 				    timing_start + drv_usectohz(5*1000*1000);
5312 			} else {
5313 				/* we still have some ilu items to check */
5314 				timing_next =
5315 				    ddi_get_lbolt() + drv_usectohz(1*1000*1000);
5316 			}
5317 			if (stmf_state.stmf_svc_active)
5318 				goto stmf_svc_loop;
5319 		}
5320 		/* Check if there are free tasks to clear */
5321 		if (stmf_state.stmf_nlus &&
5322 		    ((!drain_next) || (ddi_get_lbolt() >= drain_next))) {
5323 			if (!stmf_state.stmf_svc_ilu_draining) {
5324 				/* we are starting a new round */
5325 				stmf_state.stmf_svc_ilu_draining =
5326 				    stmf_state.stmf_ilulist;
5327 				drain_start = ddi_get_lbolt();
5328 			}
5329 			stmf_check_freetask();
5330 			if (!stmf_state.stmf_svc_ilu_draining) {
5331 				/* we finished a complete round */
5332 				drain_next =
5333 				    drain_start + drv_usectohz(10*1000*1000);
5334 			} else {
5335 				/* we still have some ilu items to check */
5336 				drain_next =
5337 				    ddi_get_lbolt() + drv_usectohz(1*1000*1000);
5338 			}
5339 			if (stmf_state.stmf_svc_active)
5340 				goto stmf_svc_loop;
5341 		}
5342 
5343 		/* Check if we need to run worker_mgmt */
5344 		if (ddi_get_lbolt() > worker_delay) {
5345 			stmf_worker_mgmt();
5346 			worker_delay = ddi_get_lbolt() +
5347 			    stmf_worker_mgmt_delay;
5348 		}
5349 
5350 		/* Check if any active session got its 1st LUN */
5351 		if (stmf_state.stmf_process_initial_luns) {
5352 			int stmf_level = 0;
5353 			int port_level;
5354 			for (ilport = stmf_state.stmf_ilportlist; ilport;
5355 			    ilport = next_ilport) {
5356 				next_ilport = ilport->ilport_next;
5357 				if ((ilport->ilport_flags &
5358 				    ILPORT_SS_GOT_INITIAL_LUNS) == 0) {
5359 					continue;
5360 				}
5361 				port_level = 0;
5362 				rw_enter(&ilport->ilport_lock, RW_READER);
5363 				for (iss = ilport->ilport_ss_list; iss;
5364 				    iss = iss->iss_next) {
5365 					if ((iss->iss_flags &
5366 					    ISS_GOT_INITIAL_LUNS) == 0) {
5367 						continue;
5368 					}
5369 					port_level++;
5370 					stmf_level++;
5371 					atomic_and_32(&iss->iss_flags,
5372 						~ISS_GOT_INITIAL_LUNS);
5373 					atomic_or_32(&iss->iss_flags,
5374 						ISS_EVENT_ACTIVE);
5375 					rw_exit(&ilport->ilport_lock);
5376 					mutex_exit(&stmf_state.stmf_lock);
5377 					stmf_generate_lport_event(ilport,
5378 					    LPORT_EVENT_INITIAL_LUN_MAPPED,
5379 					    iss->iss_ss, 0);
5380 					atomic_and_32(&iss->iss_flags,
5381 						~ISS_EVENT_ACTIVE);
5382 					mutex_enter(&stmf_state.stmf_lock);
5383 					/*
5384 					 * scan all the ilports again as the
5385 					 * ilport list might have changed.
5386 					 */
5387 					next_ilport =
5388 						stmf_state.stmf_ilportlist;
5389 					break;
5390 				}
5391 				if (port_level == 0) {
5392 					atomic_and_32(&ilport->ilport_flags,
5393 						~ILPORT_SS_GOT_INITIAL_LUNS);
5394 				}
5395 				/* drop the lock if we are holding it. */
5396 				if (rw_lock_held(&ilport->ilport_lock))
5397 					rw_exit(&ilport->ilport_lock);
5398 
5399 				/* Max 4 session at a time */
5400 				if (stmf_level >= 4) {
5401 					break;
5402 				}
5403 			}
5404 			if (stmf_level == 0) {
5405 				stmf_state.stmf_process_initial_luns = 0;
5406 			}
5407 		}
5408 
5409 		stmf_state.stmf_svc_flags &= ~STMF_SVC_ACTIVE;
5410 		(void) cv_timedwait(&stmf_state.stmf_cv, &stmf_state.stmf_lock,
5411 		    ddi_get_lbolt() + td);
5412 		stmf_state.stmf_svc_flags |= STMF_SVC_ACTIVE;
5413 	}
5414 	goto stmf_svc_loop;
5415 }
5416 
5417 void
5418 stmf_svc_queue(int cmd, void *obj, stmf_state_change_info_t *info)
5419 {
5420 	stmf_svc_req_t *req;
5421 	int s;
5422 
5423 	ASSERT(!mutex_owned(&stmf_state.stmf_lock));
5424 	s = sizeof (stmf_svc_req_t);
5425 	if (info->st_additional_info) {
5426 		s += strlen(info->st_additional_info) + 1;
5427 	}
5428 	req = kmem_zalloc(s, KM_SLEEP);
5429 
5430 	req->svc_cmd = cmd;
5431 	req->svc_obj = obj;
5432 	req->svc_info.st_rflags = info->st_rflags;
5433 	if (info->st_additional_info) {
5434 		req->svc_info.st_additional_info = (char *)(GET_BYTE_OFFSET(req,
5435 		    sizeof (stmf_svc_req_t)));
5436 		(void) strcpy(req->svc_info.st_additional_info,
5437 		    info->st_additional_info);
5438 	}
5439 	req->svc_req_alloc_size = s;
5440 
5441 	mutex_enter(&stmf_state.stmf_lock);
5442 	req->svc_next = stmf_state.stmf_svc_active;
5443 	stmf_state.stmf_svc_active = req;
5444 	if ((stmf_state.stmf_svc_flags & STMF_SVC_ACTIVE) == 0) {
5445 		cv_signal(&stmf_state.stmf_cv);
5446 	}
5447 	mutex_exit(&stmf_state.stmf_lock);
5448 }
5449 
5450 void
5451 stmf_trace(caddr_t ident, const char *fmt, ...)
5452 {
5453 	va_list args;
5454 	char tbuf[160];
5455 	int len;
5456 
5457 	if (!stmf_trace_on)
5458 		return;
5459 	len = snprintf(tbuf, 158, "%s:%07lu: ", ident ? ident : "",
5460 	    ddi_get_lbolt());
5461 	va_start(args, fmt);
5462 	len += vsnprintf(tbuf + len, 158 - len, fmt, args);
5463 	va_end(args);
5464 
5465 	if (len > 158) {
5466 		len = 158;
5467 	}
5468 	tbuf[len++] = '\n';
5469 	tbuf[len] = 0;
5470 
5471 	mutex_enter(&trace_buf_lock);
5472 	bcopy(tbuf, &stmf_trace_buf[trace_buf_curndx], len+1);
5473 	trace_buf_curndx += len;
5474 	if (trace_buf_curndx > (trace_buf_size - 320))
5475 		trace_buf_curndx = 0;
5476 	mutex_exit(&trace_buf_lock);
5477 }
5478 
5479 void
5480 stmf_trace_clear()
5481 {
5482 	if (!stmf_trace_on)
5483 		return;
5484 	mutex_enter(&trace_buf_lock);
5485 	trace_buf_curndx = 0;
5486 	if (trace_buf_size > 0)
5487 		stmf_trace_buf[0] = 0;
5488 	mutex_exit(&trace_buf_lock);
5489 }
5490 
5491 static void
5492 stmf_abort_task_offline(scsi_task_t *task, int offline_lu, char *info)
5493 {
5494 	stmf_state_change_info_t	 change_info;
5495 	void				*ctl_private;
5496 	uint32_t			 ctl_cmd;
5497 	int				msg = 0;
5498 
5499 	stmf_trace("FROM STMF", "abort_task_offline called for %s: %s",
5500 	    offline_lu ? "LU" : "LPORT", info ? info : "no additional info");
5501 	change_info.st_additional_info = info;
5502 	if (offline_lu) {
5503 		change_info.st_rflags = STMF_RFLAG_RESET |
5504 		    STMF_RFLAG_LU_ABORT;
5505 		ctl_private = task->task_lu;
5506 		if (((stmf_i_lu_t *)
5507 		    task->task_lu->lu_stmf_private)->ilu_state ==
5508 		    STMF_STATE_ONLINE) {
5509 			msg = 1;
5510 		}
5511 		ctl_cmd = STMF_CMD_LU_OFFLINE;
5512 	} else {
5513 		change_info.st_rflags = STMF_RFLAG_RESET |
5514 		    STMF_RFLAG_LPORT_ABORT;
5515 		ctl_private = task->task_lport;
5516 		if (((stmf_i_local_port_t *)
5517 		    task->task_lport->lport_stmf_private)->ilport_state ==
5518 		    STMF_STATE_ONLINE) {
5519 			msg = 1;
5520 		}
5521 		ctl_cmd = STMF_CMD_LPORT_OFFLINE;
5522 	}
5523 
5524 	if (msg) {
5525 		stmf_trace(0, "Calling stmf_ctl to offline %s : %s",
5526 		    offline_lu ? "LU" : "LPORT", info ? info :
5527 		    "<no additional info>");
5528 	}
5529 	(void) stmf_ctl(ctl_cmd, ctl_private, &change_info);
5530 }
5531