kernel: Remove some unneeded NULL checks after kmalloc() with M_WAITOK.
[dragonfly.git] / sys / bus / cam / scsi / scsi_sg.c
1 /*-
2  * Copyright (c) 2007 Scott Long
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions, and the following disclaimer,
10  *    without modification, immediately at the beginning of the file.
11  * 2. The name of the author may not be used to endorse or promote products
12  *    derived from this software without specific prior written permission.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
18  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26
27 /*
28  * scsi_sg peripheral driver.  This driver is meant to implement the Linux
29  * SG passthrough interface for SCSI.
30  */
31
32 #include <sys/conf.h>
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/kernel.h>
36 #include <sys/types.h>
37 #include <sys/bio.h>
38 #include <sys/malloc.h>
39 #include <sys/fcntl.h>
40 #include <sys/ioccom.h>
41 #include <sys/errno.h>
42 #include <sys/devicestat.h>
43 #include <sys/proc.h>
44 #include <sys/uio.h>
45 #include <sys/device.h>
46 #include <sys/sysmsg.h>
47
48 #include "../cam.h"
49 #include "../cam_ccb.h"
50 #include "../cam_periph.h"
51 #include "../cam_queue.h"
52 #include "../cam_xpt_periph.h"
53 #include "../cam_debug.h"
54 #include "../cam_sim.h"
55
56 #include <emulation/linux/linux_ioctl.h>
57
58 #include "scsi_all.h"
59 #include "scsi_message.h"
60 #include "scsi_sg.h"
61
62 typedef enum {
63         SG_FLAG_OPEN            = 0x01,
64         SG_FLAG_LOCKED          = 0x02,
65         SG_FLAG_INVALID         = 0x04
66 } sg_flags;
67
68 typedef enum {
69         SG_STATE_NORMAL
70 } sg_state;
71
72 typedef enum {
73         SG_RDWR_FREE,
74         SG_RDWR_INPROG,
75         SG_RDWR_DONE
76 } sg_rdwr_state;
77
78 typedef enum {
79         SG_CCB_RDWR_IO,
80         SG_CCB_WAITING
81 } sg_ccb_types;
82
83 #define ccb_type        ppriv_field0
84 #define ccb_rdwr        ppriv_ptr1
85
86 struct sg_rdwr {
87         TAILQ_ENTRY(sg_rdwr)    rdwr_link;
88         int                     tag;
89         int                     state;
90         int                     buf_len;
91         char                    *buf;
92         union ccb               *ccb;
93         union {
94                 struct sg_header hdr;
95                 struct sg_io_hdr io_hdr;
96         } hdr;
97 };
98
99 struct sg_softc {
100         sg_state                state;
101         sg_flags                flags;
102         struct devstat          device_stats;
103         TAILQ_HEAD(, sg_rdwr)   rdwr_done;
104         cdev_t                  dev;
105         int                     sg_timeout;
106         int                     sg_user_timeout;
107         uint8_t                 pd_type;
108         union ccb               saved_ccb;
109 };
110
111 static d_open_t         sgopen;
112 static d_close_t        sgclose;
113 static d_ioctl_t        sgioctl;
114 static d_write_t        sgwrite;
115 static d_read_t         sgread;
116
117 static periph_init_t    sginit;
118 static periph_ctor_t    sgregister;
119 static periph_oninv_t   sgoninvalidate;
120 static periph_dtor_t    sgcleanup;
121 static periph_start_t   sgstart;
122 static void             sgasync(void *callback_arg, uint32_t code,
123                                 struct cam_path *path, void *arg);
124 static void             sgdone(struct cam_periph *periph, union ccb *done_ccb);
125 static int              sgsendccb(struct cam_periph *periph, union ccb *ccb);
126 static int              sgsendrdwr(struct cam_periph *periph, union ccb *ccb);
127 static int              sgerror(union ccb *ccb, uint32_t cam_flags,
128                                 uint32_t sense_flags);
129 static void             sg_scsiio_status(struct ccb_scsiio *csio,
130                                          u_short *hoststat, u_short *drvstat);
131
132 static int              scsi_group_len(u_char cmd);
133
134 static struct periph_driver sgdriver =
135 {
136         sginit, "sg",
137         TAILQ_HEAD_INITIALIZER(sgdriver.units), /* gen */ 0
138 };
139 PERIPHDRIVER_DECLARE(sg, sgdriver);
140
141 static struct dev_ops sg_ops = {
142         { "sg", 0, D_DISK },
143         .d_open =       sgopen,
144         .d_close =      sgclose,
145         .d_read =       sgread,
146         .d_write =      sgwrite,
147         .d_ioctl =      sgioctl
148 };
149
150 static int sg_version = 30125;
151
152 static void
153 sginit(void)
154 {
155         cam_status status;
156
157         /*
158          * Install a global async callback.  This callback will receive aync
159          * callbacks like "new device found".
160          */
161         status = xpt_register_async(AC_FOUND_DEVICE, sgasync, NULL, NULL);
162
163         if (status != CAM_REQ_CMP) {
164                 kprintf("sg: Failed to attach master async callbac "
165                         "due to status 0x%x!\n", status);
166         }
167 }
168
169 static void
170 sgoninvalidate(struct cam_periph *periph)
171 {
172         struct sg_softc *softc;
173
174         softc = (struct sg_softc *)periph->softc;
175
176         /*
177          * Deregister any async callbacks.
178          */
179         xpt_register_async(0, sgasync, periph, periph->path);
180
181         softc->flags |= SG_FLAG_INVALID;
182
183         /*
184          * XXX Return all queued I/O with ENXIO.
185          * XXX Handle any transactions queued to the card
186          *     with XPT_ABORT_CCB.
187          */
188
189         if (bootverbose) {
190                 xpt_print(periph->path, "lost device\n");
191         }
192 }
193
194 static void
195 sgcleanup(struct cam_periph *periph)
196 {
197         struct sg_softc *softc;
198
199         softc = (struct sg_softc *)periph->softc;
200         if (bootverbose)
201                 xpt_print(periph->path, "removing device entry\n");
202         devstat_remove_entry(&softc->device_stats);
203         cam_periph_unlock(periph);
204         destroy_dev(softc->dev);
205         cam_periph_lock(periph);
206         kfree(softc, M_DEVBUF);
207 }
208
209 static void
210 sgasync(void *callback_arg, uint32_t code, struct cam_path *path, void *arg)
211 {
212         struct cam_periph *periph;
213
214         periph = (struct cam_periph *)callback_arg;
215
216         switch (code) {
217         case AC_FOUND_DEVICE:
218         {
219                 struct ccb_getdev *cgd;
220                 cam_status status;
221
222                 cgd = (struct ccb_getdev *)arg;
223                 if (cgd == NULL)
224                         break;
225
226 #if 0
227                 if (cgd->protocol != PROTO_SCSI)
228                         break;
229 #endif
230
231                 /*
232                  * Allocate a peripheral instance for this device and
233                  * start the probe process.
234                  */
235                 status = cam_periph_alloc(sgregister, sgoninvalidate,
236                                           sgcleanup, sgstart,
237                                           "sg", CAM_PERIPH_BIO, cgd->ccb_h.path,
238                                           sgasync, AC_FOUND_DEVICE, cgd);
239                 if ((status != CAM_REQ_CMP) && (status != CAM_REQ_INPROG)) {
240                         const struct cam_status_entry *entry;
241
242                         entry = cam_fetch_status_entry(status);
243                         kprintf("sgasync: Unable to attach new device "
244                                 "due to status %#x: %s\n", status, entry ?
245                                 entry->status_text : "Unknown");
246                 }
247                 break;
248         }
249         default:
250                 cam_periph_async(periph, code, path, arg);
251                 break;
252         }
253 }
254
255 static cam_status
256 sgregister(struct cam_periph *periph, void *arg)
257 {
258         struct sg_softc *softc;
259         struct ccb_getdev *cgd;
260         int no_tags;
261
262         cgd = (struct ccb_getdev *)arg;
263         if (periph == NULL) {
264                 kprintf("sgregister: periph was NULL!!\n");
265                 return (CAM_REQ_CMP_ERR);
266         }
267
268         if (cgd == NULL) {
269                 kprintf("sgregister: no getdev CCB, can't register device\n");
270                 return (CAM_REQ_CMP_ERR);
271         }
272
273         softc = kmalloc(sizeof(*softc), M_DEVBUF, M_WAITOK | M_ZERO);
274         softc->state = SG_STATE_NORMAL;
275         softc->pd_type = SID_TYPE(&cgd->inq_data);
276         softc->sg_timeout = SG_DEFAULT_TIMEOUT / SG_DEFAULT_HZ * hz;
277         softc->sg_user_timeout = SG_DEFAULT_TIMEOUT;
278         TAILQ_INIT(&softc->rdwr_done);
279         periph->softc = softc;
280
281         /*
282          * We pass in 0 for all blocksize, since we don't know what the
283          * blocksize of the device is, if it even has a blocksize.
284          */
285         cam_periph_unlock(periph);
286         no_tags = (cgd->inq_data.flags & SID_CmdQue) == 0;
287         devstat_add_entry(&softc->device_stats, "sg",
288                           periph->unit_number, 0,
289                           DEVSTAT_NO_BLOCKSIZE |
290                               (no_tags ? DEVSTAT_NO_ORDERED_TAGS : 0),
291                           softc->pd_type |
292                           DEVSTAT_TYPE_IF_SCSI | DEVSTAT_PRIORITY_PASS,
293                           DEVSTAT_PRIORITY_PASS);
294
295         /* Register the device */
296         softc->dev = make_dev(&sg_ops, periph->unit_number,
297                               UID_ROOT, GID_OPERATOR, 0600, "%s%d",
298                               periph->periph_name, periph->unit_number);
299         make_dev_alias(softc->dev, "sg%c", 'a' + periph->unit_number);
300         cam_periph_lock(periph);
301         softc->dev->si_drv1 = periph;
302
303         /*
304          * Add as async callback so that we get
305          * notified if this device goes away.
306          */
307         xpt_register_async(AC_LOST_DEVICE, sgasync, periph, periph->path);
308
309         if (bootverbose)
310                 xpt_announce_periph(periph, NULL);
311
312         return (CAM_REQ_CMP);
313 }
314
315 static void
316 sgstart(struct cam_periph *periph, union ccb *start_ccb)
317 {
318         struct sg_softc *softc;
319
320         softc = (struct sg_softc *)periph->softc;
321
322         switch (softc->state) {
323         case SG_STATE_NORMAL:
324                 start_ccb->ccb_h.ccb_type = SG_CCB_WAITING;
325                 SLIST_INSERT_HEAD(&periph->ccb_list, &start_ccb->ccb_h,
326                                   periph_links.sle);
327                 periph->immediate_priority = CAM_PRIORITY_NONE;
328                 wakeup(&periph->ccb_list);
329                 break;
330         }
331 }
332
333 static void
334 sgdone(struct cam_periph *periph, union ccb *done_ccb)
335 {
336         struct sg_softc *softc;
337         struct ccb_scsiio *csio;
338
339         softc = (struct sg_softc *)periph->softc;
340         csio = &done_ccb->csio;
341         switch (csio->ccb_h.ccb_type) {
342         case SG_CCB_WAITING:
343                 /* Caller will release the CCB */
344                 wakeup(&done_ccb->ccb_h.cbfcnp);
345                 return;
346         case SG_CCB_RDWR_IO:
347         {
348                 struct sg_rdwr *rdwr;
349                 int state;
350
351                 devstat_end_transaction(
352                         &softc->device_stats,
353                         csio->dxfer_len,
354                         csio->tag_action & 0xf,
355                         ((csio->ccb_h.flags & CAM_DIR_MASK) ==
356                           CAM_DIR_NONE) ? DEVSTAT_NO_DATA :
357                             ((csio->ccb_h.flags & CAM_DIR_OUT) ?
358                              DEVSTAT_WRITE : DEVSTAT_READ));
359
360                 rdwr = done_ccb->ccb_h.ccb_rdwr;
361                 state = rdwr->state;
362                 rdwr->state = SG_RDWR_DONE;
363                 wakeup(rdwr);
364                 break;
365         }
366         default:
367                 panic("unknown sg CCB type");
368         }
369 }
370
371 static int
372 sgopen(struct dev_open_args *ap)
373 /*cdev_t dev, int flags, int fmt, struct thread *td)*/
374 {
375         struct cam_periph *periph;
376         struct sg_softc *softc;
377         int error = 0;
378
379         periph = (struct cam_periph *)ap->a_head.a_dev->si_drv1;
380         if (periph == NULL)
381                 return (ENXIO);
382
383         /*
384          * Don't allow access when we're running at a high securelevel.
385          */
386         if (securelevel > 1) {
387                 cam_periph_unlock(periph);
388                 cam_periph_release(periph);
389                 return(EPERM);
390         }
391         cam_periph_lock(periph);
392
393         softc = (struct sg_softc *)periph->softc;
394         if (softc->flags & SG_FLAG_INVALID) {
395                 cam_periph_unlock(periph);
396                 return (ENXIO);
397         }
398
399         if ((softc->flags & SG_FLAG_OPEN) == 0) {
400                 softc->flags |= SG_FLAG_OPEN;
401                 cam_periph_unlock(periph);
402         } else {
403                 /* Device closes aren't symmetrical, fix up the refcount. */
404                 cam_periph_unlock(periph);
405                 cam_periph_release(periph);
406         }
407
408         return (error);
409 }
410
411 static int
412 sgclose(struct dev_close_args *ap)
413 /* cdev_t dev, int flag, int fmt, struct thread *td) */
414 {
415         struct cam_periph *periph;
416         struct sg_softc *softc;
417
418         periph = (struct cam_periph *)ap->a_head.a_dev->si_drv1;
419         if (periph == NULL)
420                 return (ENXIO);
421
422         cam_periph_lock(periph);
423
424         softc = (struct sg_softc *)periph->softc;
425         softc->flags &= ~SG_FLAG_OPEN;
426
427         cam_periph_unlock(periph);
428         cam_periph_release(periph);
429
430         return (0);
431 }
432
433 static int
434 sgioctl(struct dev_ioctl_args *ap)
435 /* cdev_t dev, u_long cmd, caddr_t arg, int flag, struct thread *td) */
436 {
437         union ccb *ccb;
438         struct ccb_scsiio *csio;
439         struct cam_periph *periph;
440         struct sg_softc *softc;
441         struct sg_io_hdr req;
442         int dir, error;
443
444         periph = (struct cam_periph *)ap->a_head.a_dev->si_drv1;
445         if (periph == NULL)
446                 return (ENXIO);
447
448         cam_periph_lock(periph);
449
450         softc = (struct sg_softc *)periph->softc;
451         error = 0;
452
453         switch (ap->a_cmd) {
454         case LINUX_SCSI_GET_BUS_NUMBER: {
455                 int busno;
456
457                 busno = xpt_path_path_id(periph->path);
458                 error = copyout(&busno, ap->a_data, sizeof(busno));
459                 break;
460         }
461         case LINUX_SCSI_GET_IDLUN: {
462                 struct scsi_idlun idlun;
463                 struct cam_sim *sim;
464
465                 idlun.dev_id = xpt_path_target_id(periph->path);
466                 sim = xpt_path_sim(periph->path);
467                 idlun.host_unique_id = sim->unit_number;
468                 error = copyout(&idlun, ap->a_data, sizeof(idlun));
469                 break;
470         }
471         case SG_GET_VERSION_NUM:
472         case LINUX_SG_GET_VERSION_NUM:
473                 error = copyout(&sg_version, ap->a_data, sizeof(sg_version));
474                 break;
475         case SG_SET_TIMEOUT:
476         case LINUX_SG_SET_TIMEOUT: {
477                 u_int user_timeout;
478
479                 error = copyin(ap->a_data, &user_timeout, sizeof(u_int));
480                 if (error == 0) {
481                         softc->sg_user_timeout = user_timeout;
482                         softc->sg_timeout = user_timeout / SG_DEFAULT_HZ * hz;
483                 }
484                 break;
485         }
486         case SG_GET_TIMEOUT:
487         case LINUX_SG_GET_TIMEOUT:
488                 /*
489                  * The value is returned directly to the syscall.
490                  */
491                 ap->a_sysmsg->sm_result.iresult = softc->sg_user_timeout;
492                 error = 0;
493                 break;
494         case SG_IO:
495         case LINUX_SG_IO:
496                 error = copyin(ap->a_data, &req, sizeof(req));
497                 if (error)
498                         break;
499
500                 if (req.cmd_len > IOCDBLEN) {
501                         error = EINVAL;
502                         break;
503                 }
504
505                 if (req.iovec_count != 0) {
506                         error = EOPNOTSUPP;
507                         break;
508                 }
509
510                 ccb = cam_periph_getccb(periph, /*priority*/5);
511                 csio = &ccb->csio;
512
513                 error = copyin(req.cmdp, &csio->cdb_io.cdb_bytes,
514                     req.cmd_len);
515                 if (error) {
516                         xpt_release_ccb(ccb);
517                         break;
518                 }
519
520                 switch(req.dxfer_direction) {
521                 case SG_DXFER_TO_DEV:
522                         dir = CAM_DIR_OUT;
523                         break;
524                 case SG_DXFER_FROM_DEV:
525                         dir = CAM_DIR_IN;
526                         break;
527                 case SG_DXFER_TO_FROM_DEV:
528                         dir = CAM_DIR_IN | CAM_DIR_OUT;
529                         break;
530                 case SG_DXFER_NONE:
531                 default:
532                         dir = CAM_DIR_NONE;
533                         break;
534                 }
535
536                 cam_fill_csio(csio,
537                               /*retries*/1,
538                               sgdone,
539                               dir|CAM_DEV_QFRZDIS,
540                               MSG_SIMPLE_Q_TAG,
541                               req.dxferp,
542                               req.dxfer_len,
543                               req.mx_sb_len,
544                               req.cmd_len,
545                               req.timeout);
546
547                 error = sgsendccb(periph, ccb);
548                 if (error) {
549                         req.host_status = DID_ERROR;
550                         req.driver_status = DRIVER_INVALID;
551                         xpt_release_ccb(ccb);
552                         break;
553                 }
554
555                 req.status = csio->scsi_status;
556                 req.masked_status = (csio->scsi_status >> 1) & 0x7f;
557                 sg_scsiio_status(csio, &req.host_status, &req.driver_status);
558                 req.resid = csio->resid;
559                 req.duration = csio->ccb_h.timeout;
560                 req.info = 0;
561
562                 error = copyout(&req, ap->a_data, sizeof(req));
563                 if ((error == 0) && (csio->ccb_h.status & CAM_AUTOSNS_VALID)
564                     && (req.sbp != NULL)) {
565                         req.sb_len_wr = req.mx_sb_len - csio->sense_resid;
566                         error = copyout(&csio->sense_data, req.sbp,
567                                         req.sb_len_wr);
568                 }
569
570                 xpt_release_ccb(ccb);
571                 break;
572
573         case SG_GET_RESERVED_SIZE:
574         case LINUX_SG_GET_RESERVED_SIZE: {
575                 int size = 32768;
576
577                 error = copyout(&size, ap->a_data, sizeof(size));
578                 break;
579         }
580
581         case SG_GET_SCSI_ID:
582         case LINUX_SG_GET_SCSI_ID:
583         {
584                 struct sg_scsi_id id;
585
586                 id.host_no = 0; /* XXX */
587                 id.channel = xpt_path_path_id(periph->path);
588                 id.scsi_id = xpt_path_target_id(periph->path);
589                 id.lun = xpt_path_lun_id(periph->path);
590                 id.scsi_type = softc->pd_type;
591                 id.h_cmd_per_lun = 1;
592                 id.d_queue_depth = 1;
593                 id.unused[0] = 0;
594                 id.unused[1] = 0;
595
596                 error = copyout(&id, ap->a_data, sizeof(id));
597                 break;
598         }
599
600         case SG_EMULATED_HOST:
601         case SG_SET_TRANSFORM:
602         case SG_GET_TRANSFORM:
603         case SG_GET_NUM_WAITING:
604         case SG_SCSI_RESET:
605         case SG_GET_REQUEST_TABLE:
606         case SG_SET_KEEP_ORPHAN:
607         case SG_GET_KEEP_ORPHAN:
608         case SG_GET_ACCESS_COUNT:
609         case SG_SET_FORCE_LOW_DMA:
610         case SG_GET_LOW_DMA:
611         case SG_GET_SG_TABLESIZE:
612         case SG_SET_FORCE_PACK_ID:
613         case SG_GET_PACK_ID:
614         case SG_SET_RESERVED_SIZE:
615         case SG_GET_COMMAND_Q:
616         case SG_SET_COMMAND_Q:
617         case SG_SET_DEBUG:
618         case SG_NEXT_CMD_LEN:
619         case LINUX_SG_EMULATED_HOST:
620         case LINUX_SG_SET_TRANSFORM:
621         case LINUX_SG_GET_TRANSFORM:
622         case LINUX_SG_GET_NUM_WAITING:
623         case LINUX_SG_SCSI_RESET:
624         case LINUX_SG_GET_REQUEST_TABLE:
625         case LINUX_SG_SET_KEEP_ORPHAN:
626         case LINUX_SG_GET_KEEP_ORPHAN:
627         case LINUX_SG_GET_ACCESS_COUNT:
628         case LINUX_SG_SET_FORCE_LOW_DMA:
629         case LINUX_SG_GET_LOW_DMA:
630         case LINUX_SG_GET_SG_TABLESIZE:
631         case LINUX_SG_SET_FORCE_PACK_ID:
632         case LINUX_SG_GET_PACK_ID:
633         case LINUX_SG_SET_RESERVED_SIZE:
634         case LINUX_SG_GET_COMMAND_Q:
635         case LINUX_SG_SET_COMMAND_Q:
636         case LINUX_SG_SET_DEBUG:
637         case LINUX_SG_NEXT_CMD_LEN:
638         default:
639 #ifdef CAMDEBUG
640                 kprintf("sgioctl: rejecting cmd 0x%lx\n", ap->a_cmd);
641 #endif
642                 error = ENODEV;
643                 break;
644         }
645
646         cam_periph_unlock(periph);
647         return (error);
648 }
649
650 static int
651 sgwrite(struct dev_write_args *ap)
652 /*cdev_t dev, struct uio *uio, int ioflag)*/
653 {
654         union ccb *ccb;
655         struct cam_periph *periph;
656         struct ccb_scsiio *csio;
657         struct sg_softc *sc;
658         struct sg_header *hdr;
659         struct sg_rdwr *rdwr;
660         u_char cdb_cmd;
661         char *buf;
662         int error = 0, cdb_len, buf_len, dir;
663         struct uio *uio = ap->a_uio;
664
665         periph = ap->a_head.a_dev->si_drv1;
666         rdwr = kmalloc(sizeof(*rdwr), M_DEVBUF, M_WAITOK | M_ZERO);
667         hdr = &rdwr->hdr.hdr;
668
669         /* Copy in the header block and sanity check it */
670         if (uio->uio_resid < sizeof(*hdr)) {
671                 error = EINVAL;
672                 goto out_hdr;
673         }
674         error = uiomove((char *)hdr, sizeof(*hdr), uio);
675         if (error)
676                 goto out_hdr;
677
678         ccb = xpt_alloc_ccb();
679         if (ccb == NULL) {
680                 error = ENOMEM;
681                 goto out_hdr;
682         }
683         csio = &ccb->csio;
684
685         /*
686          * Copy in the CDB block.  The designers of the interface didn't
687          * bother to provide a size for this in the header, so we have to
688          * figure it out ourselves.
689          */
690         if (uio->uio_resid < 1)
691                 goto out_ccb;
692         error = uiomove(&cdb_cmd, 1, uio);
693         if (error)
694                 goto out_ccb;
695         if (hdr->twelve_byte)
696                 cdb_len = 12;
697         else
698                 cdb_len = scsi_group_len(cdb_cmd);
699         /*
700          * We've already read the first byte of the CDB and advanced the uio
701          * pointer.  Just read the rest.
702          */
703         csio->cdb_io.cdb_bytes[0] = cdb_cmd;
704         error = uiomove(&csio->cdb_io.cdb_bytes[1], cdb_len - 1, uio);
705         if (error)
706                 goto out_ccb;
707
708         /*
709          * Now set up the data block.  Again, the designers didn't bother
710          * to make this reliable.
711          */
712         buf_len = uio->uio_resid;
713         if (buf_len != 0) {
714                 buf = kmalloc(buf_len, M_DEVBUF, M_WAITOK | M_ZERO);
715                 error = uiomove(buf, buf_len, uio);
716                 if (error)
717                         goto out_buf;
718                 dir = CAM_DIR_OUT;
719         } else if (hdr->reply_len != 0) {
720                 buf = kmalloc(hdr->reply_len, M_DEVBUF, M_WAITOK | M_ZERO);
721                 buf_len = hdr->reply_len;
722                 dir = CAM_DIR_IN;
723         } else {
724                 buf = NULL;
725                 buf_len = 0;
726                 dir = CAM_DIR_NONE;
727         }
728
729         cam_periph_lock(periph);
730         sc = periph->softc;
731         xpt_setup_ccb(&ccb->ccb_h, periph->path, /*priority*/5);
732         cam_fill_csio(csio,
733                       /*retries*/1,
734                       sgdone,
735                       dir|CAM_DEV_QFRZDIS,
736                       MSG_SIMPLE_Q_TAG,
737                       buf,
738                       buf_len,
739                       SG_MAX_SENSE,
740                       cdb_len,
741                       sc->sg_timeout);
742
743         /*
744          * Send off the command and hope that it works. This path does not
745          * go through sgstart because the I/O is supposed to be asynchronous.
746          */
747         rdwr->buf = buf;
748         rdwr->buf_len = buf_len;
749         rdwr->tag = hdr->pack_id;
750         rdwr->ccb = ccb;
751         rdwr->state = SG_RDWR_INPROG;
752         ccb->ccb_h.ccb_rdwr = rdwr;
753         ccb->ccb_h.ccb_type = SG_CCB_RDWR_IO;
754         TAILQ_INSERT_TAIL(&sc->rdwr_done, rdwr, rdwr_link);
755         error = sgsendrdwr(periph, ccb);
756         cam_periph_unlock(periph);
757         return (error);
758
759 out_buf:
760         kfree(buf, M_DEVBUF);
761 out_ccb:
762         xpt_free_ccb(ccb);
763 out_hdr:
764         kfree(rdwr, M_DEVBUF);
765         return (error);
766 }
767
768 static int
769 sgread(struct dev_read_args *ap)
770 /*cdev_t dev, struct uio *uio, int ioflag)*/
771 {
772         struct ccb_scsiio *csio;
773         struct cam_periph *periph;
774         struct sg_softc *sc;
775         struct sg_header *hdr;
776         struct sg_rdwr *rdwr;
777         u_short hstat, dstat;
778         int error, pack_len, reply_len, pack_id;
779         struct uio *uio = ap->a_uio;
780
781         periph = ap->a_head.a_dev->si_drv1;
782
783         /* XXX The pack len field needs to be updated and written out instead
784          * of discarded.  Not sure how to do that.
785          */
786         uio->uio_rw = UIO_WRITE;
787         if ((error = uiomove((char *)&pack_len, 4, uio)) != 0)
788                 return (error);
789         if ((error = uiomove((char *)&reply_len, 4, uio)) != 0)
790                 return (error);
791         if ((error = uiomove((char *)&pack_id, 4, uio)) != 0)
792                 return (error);
793         uio->uio_rw = UIO_READ;
794
795         cam_periph_lock(periph);
796         sc = periph->softc;
797 search:
798         TAILQ_FOREACH(rdwr, &sc->rdwr_done, rdwr_link) {
799                 if (rdwr->tag == pack_id)
800                         break;
801         }
802         if (rdwr == NULL) {
803                 cam_periph_unlock(periph);
804                 if (tsleep(&hstat, PCATCH, "sgnull", 0) == ERESTART)
805                         return(EAGAIN);
806                 cam_periph_lock(periph);
807                 goto search;
808         }
809         if (rdwr->state != SG_RDWR_DONE) {
810                 tsleep_interlock(rdwr, PCATCH);
811                 cam_periph_unlock(periph);
812                 if (rdwr->state != SG_RDWR_DONE) {
813                     if (tsleep(rdwr, PCATCH | PINTERLOCKED, "sgread", 0) ==
814                         ERESTART) {
815                                 return (EAGAIN);
816                     }
817                 }
818                 cam_periph_lock(periph);
819                 goto search;
820         }
821         TAILQ_REMOVE(&sc->rdwr_done, rdwr, rdwr_link);
822         cam_periph_unlock(periph);
823
824         hdr = &rdwr->hdr.hdr;
825         csio = &rdwr->ccb->csio;
826         sg_scsiio_status(csio, &hstat, &dstat);
827         hdr->host_status = hstat;
828         hdr->driver_status = dstat;
829         hdr->target_status = csio->scsi_status >> 1;
830
831         switch (hstat) {
832         case DID_OK:
833         case DID_PASSTHROUGH:
834         case DID_SOFT_ERROR:
835                 hdr->result = 0;
836                 break;
837         case DID_NO_CONNECT:
838         case DID_BUS_BUSY:
839         case DID_TIME_OUT:
840                 hdr->result = EBUSY;
841                 break;
842         case DID_BAD_TARGET:
843         case DID_ABORT:
844         case DID_PARITY:
845         case DID_RESET:
846         case DID_BAD_INTR:
847         case DID_ERROR:
848         default:
849                 hdr->result = EIO;
850                 break;
851         }
852
853         if (dstat == DRIVER_SENSE) {
854                 bcopy(&csio->sense_data, hdr->sense_buffer,
855                       min(csio->sense_len, SG_MAX_SENSE));
856 #ifdef CAMDEBUG
857                 scsi_sense_print(csio);
858 #endif
859         }
860
861         error = uiomove((char *)&hdr->result, sizeof(*hdr) -
862                         offsetof(struct sg_header, result), uio);
863         if ((error == 0) && (hdr->result == 0))
864                 error = uiomove(rdwr->buf, rdwr->buf_len, uio);
865
866         cam_periph_lock(periph);
867         xpt_free_ccb(rdwr->ccb);
868         cam_periph_unlock(periph);
869         kfree(rdwr->buf, M_DEVBUF);
870         kfree(rdwr, M_DEVBUF);
871         return (error);
872 }
873
874 static int
875 sgsendccb(struct cam_periph *periph, union ccb *ccb)
876 {
877         struct sg_softc *softc;
878         struct cam_periph_map_info mapinfo;
879         int error, need_unmap = 0;
880
881         softc = periph->softc;
882         if (((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE)
883             && (ccb->csio.data_ptr != NULL)) {
884                 bzero(&mapinfo, sizeof(mapinfo));
885
886                 /*
887                  * cam_periph_mapmem calls into proc and vm functions that can
888                  * sleep as well as trigger I/O, so we can't hold the lock.
889                  * Dropping it here is reasonably safe.
890                  */
891                 cam_periph_unlock(periph);
892                 error = cam_periph_mapmem(ccb, &mapinfo);
893                 cam_periph_lock(periph);
894                 if (error)
895                         return (error);
896                 need_unmap = 1;
897         }
898
899         error = cam_periph_runccb(ccb, sgerror, CAM_RETRY_SELTO,
900                                   SF_RETRY_UA, &softc->device_stats);
901
902         if (need_unmap)
903                 cam_periph_unmapmem(ccb, &mapinfo);
904
905         return (error);
906 }
907
908 static int
909 sgsendrdwr(struct cam_periph *periph, union ccb *ccb)
910 {
911         struct sg_softc *softc;
912
913         softc = periph->softc;
914         devstat_start_transaction(&softc->device_stats);
915         xpt_action(ccb);
916         return (0);
917 }
918
919 static int
920 sgerror(union ccb *ccb, uint32_t cam_flags, uint32_t sense_flags)
921 {
922         struct cam_periph *periph;
923         struct sg_softc *softc;
924
925         periph = xpt_path_periph(ccb->ccb_h.path);
926         softc = (struct sg_softc *)periph->softc;
927
928         return (cam_periph_error(ccb, cam_flags, sense_flags,
929                                  &softc->saved_ccb));
930 }
931
932 static void
933 sg_scsiio_status(struct ccb_scsiio *csio, u_short *hoststat, u_short *drvstat)
934 {
935         int status;
936
937         status = csio->ccb_h.status;
938
939         switch (status & CAM_STATUS_MASK) {
940         case CAM_REQ_CMP:
941                 *hoststat = DID_OK;
942                 *drvstat = 0;
943                 break;
944         case CAM_REQ_CMP_ERR:
945                 *hoststat = DID_ERROR;
946                 *drvstat = 0;
947                 break;
948         case CAM_REQ_ABORTED:
949                 *hoststat = DID_ABORT;
950                 *drvstat = 0;
951                 break;
952         case CAM_REQ_INVALID:
953                 *hoststat = DID_ERROR;
954                 *drvstat = DRIVER_INVALID;
955                 break;
956         case CAM_DEV_NOT_THERE:
957                 *hoststat = DID_BAD_TARGET;
958                 *drvstat = 0;
959                 break;
960         case CAM_SEL_TIMEOUT:
961                 *hoststat = DID_NO_CONNECT;
962                 *drvstat = 0;
963                 break;
964         case CAM_CMD_TIMEOUT:
965                 *hoststat = DID_TIME_OUT;
966                 *drvstat = 0;
967                 break;
968         case CAM_SCSI_STATUS_ERROR:
969                 *hoststat = DID_ERROR;
970                 *drvstat = 0;
971                 break;
972         case CAM_SCSI_BUS_RESET:
973                 *hoststat = DID_RESET;
974                 *drvstat = 0;
975                 break;
976         case CAM_UNCOR_PARITY:
977                 *hoststat = DID_PARITY;
978                 *drvstat = 0;
979                 break;
980         case CAM_SCSI_BUSY:
981                 *hoststat = DID_BUS_BUSY;
982                 *drvstat = 0;
983                 break;
984         default:
985                 *hoststat = DID_ERROR;
986                 *drvstat = DRIVER_ERROR;
987         }
988
989         if (status & CAM_AUTOSNS_VALID)
990                 *drvstat = DRIVER_SENSE;
991 }
992
993 static int
994 scsi_group_len(u_char cmd)
995 {
996         int len[] = {6, 10, 10, 12, 12, 12, 10, 10};
997         int group;
998
999         group = (cmd >> 5) & 0x7;
1000         return (len[group]);
1001 }