xref: /dragonfly/sys/bus/cam/scsi/scsi_sg.c (revision ae24b5e0)
1 /*-
2  * Copyright (c) 2007 Scott Long
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions, and the following disclaimer,
10  *    without modification, immediately at the beginning of the file.
11  * 2. The name of the author may not be used to endorse or promote products
12  *    derived from this software without specific prior written permission.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
18  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 /*
28  * scsi_sg peripheral driver.  This driver is meant to implement the Linux
29  * SG passthrough interface for SCSI.
30  */
31 
32 #include <sys/conf.h>
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/kernel.h>
36 #include <sys/types.h>
37 #include <sys/bio.h>
38 #include <sys/malloc.h>
39 #include <sys/fcntl.h>
40 #include <sys/errno.h>
41 #include <sys/devicestat.h>
42 #include <sys/proc.h>
43 #include <sys/uio.h>
44 #include <sys/device.h>
45 #include <sys/sysmsg.h>
46 
47 #include "../cam.h"
48 #include "../cam_ccb.h"
49 #include "../cam_periph.h"
50 #include "../cam_queue.h"
51 #include "../cam_xpt_periph.h"
52 #include "../cam_debug.h"
53 #include "../cam_sim.h"
54 
55 #include "scsi_all.h"
56 #include "scsi_message.h"
57 #include "scsi_sg.h"
58 
59 typedef enum {
60 	SG_FLAG_OPEN		= 0x01,
61 	SG_FLAG_LOCKED		= 0x02,
62 	SG_FLAG_INVALID		= 0x04
63 } sg_flags;
64 
65 typedef enum {
66 	SG_STATE_NORMAL
67 } sg_state;
68 
69 typedef enum {
70 	SG_RDWR_FREE,
71 	SG_RDWR_INPROG,
72 	SG_RDWR_DONE
73 } sg_rdwr_state;
74 
75 typedef enum {
76 	SG_CCB_RDWR_IO,
77 	SG_CCB_WAITING
78 } sg_ccb_types;
79 
80 #define ccb_type	ppriv_field0
81 #define ccb_rdwr	ppriv_ptr1
82 
83 struct sg_rdwr {
84 	TAILQ_ENTRY(sg_rdwr)	rdwr_link;
85 	int			tag;
86 	int			state;
87 	int			buf_len;
88 	char			*buf;
89 	union ccb		*ccb;
90 	union {
91 		struct sg_header hdr;
92 		struct sg_io_hdr io_hdr;
93 	} hdr;
94 };
95 
96 struct sg_softc {
97 	sg_state		state;
98 	sg_flags		flags;
99 	struct devstat		device_stats;
100 	TAILQ_HEAD(, sg_rdwr)	rdwr_done;
101 	cdev_t			dev;
102 	int			sg_timeout;
103 	int			sg_user_timeout;
104 	uint8_t			pd_type;
105 	union ccb		saved_ccb;
106 };
107 
108 static d_open_t		sgopen;
109 static d_close_t	sgclose;
110 static d_ioctl_t	sgioctl;
111 static d_write_t	sgwrite;
112 static d_read_t		sgread;
113 
114 static periph_init_t	sginit;
115 static periph_ctor_t	sgregister;
116 static periph_oninv_t	sgoninvalidate;
117 static periph_dtor_t	sgcleanup;
118 static periph_start_t	sgstart;
119 static void		sgasync(void *callback_arg, uint32_t code,
120 				struct cam_path *path, void *arg);
121 static void		sgdone(struct cam_periph *periph, union ccb *done_ccb);
122 static int		sgsendccb(struct cam_periph *periph, union ccb *ccb);
123 static int		sgsendrdwr(struct cam_periph *periph, union ccb *ccb);
124 static int		sgerror(union ccb *ccb, uint32_t cam_flags,
125 				uint32_t sense_flags);
126 static void		sg_scsiio_status(struct ccb_scsiio *csio,
127 					 u_short *hoststat, u_short *drvstat);
128 
129 static int		scsi_group_len(u_char cmd);
130 
131 static struct periph_driver sgdriver =
132 {
133 	sginit, "sg",
134 	TAILQ_HEAD_INITIALIZER(sgdriver.units), /* gen */ 0
135 };
136 PERIPHDRIVER_DECLARE(sg, sgdriver);
137 
138 static struct dev_ops sg_ops = {
139 	{ "sg", 0, D_DISK | D_MPSAFE },
140 	.d_open =	sgopen,
141 	.d_close =	sgclose,
142 	.d_read =	sgread,
143 	.d_write =	sgwrite,
144 	.d_ioctl =	sgioctl
145 };
146 
147 static int sg_version = 30125;
148 
149 static void
150 sginit(void)
151 {
152 	cam_status status;
153 
154 	/*
155 	 * Install a global async callback.  This callback will receive aync
156 	 * callbacks like "new device found".
157 	 */
158 	status = xpt_register_async(AC_FOUND_DEVICE, sgasync, NULL, NULL);
159 
160 	if (status != CAM_REQ_CMP) {
161 		kprintf("sg: Failed to attach master async callbac "
162 			"due to status 0x%x!\n", status);
163 	}
164 }
165 
166 static void
167 sgoninvalidate(struct cam_periph *periph)
168 {
169 	struct sg_softc *softc;
170 
171 	softc = (struct sg_softc *)periph->softc;
172 
173 	/*
174 	 * Deregister any async callbacks.
175 	 */
176 	xpt_register_async(0, sgasync, periph, periph->path);
177 
178 	softc->flags |= SG_FLAG_INVALID;
179 
180 	/*
181 	 * XXX Return all queued I/O with ENXIO.
182 	 * XXX Handle any transactions queued to the card
183 	 *     with XPT_ABORT_CCB.
184 	 */
185 
186 	if (bootverbose) {
187 		xpt_print(periph->path, "lost device\n");
188 	}
189 }
190 
191 static void
192 sgcleanup(struct cam_periph *periph)
193 {
194 	struct sg_softc *softc;
195 
196 	softc = (struct sg_softc *)periph->softc;
197 	if (bootverbose)
198 		xpt_print(periph->path, "removing device entry\n");
199 	devstat_remove_entry(&softc->device_stats);
200 	cam_periph_unlock(periph);
201 	destroy_dev(softc->dev);
202 	cam_periph_lock(periph);
203 	kfree(softc, M_DEVBUF);
204 }
205 
206 static void
207 sgasync(void *callback_arg, uint32_t code, struct cam_path *path, void *arg)
208 {
209 	struct cam_periph *periph;
210 
211 	periph = (struct cam_periph *)callback_arg;
212 
213 	switch (code) {
214 	case AC_FOUND_DEVICE:
215 	{
216 		struct ccb_getdev *cgd;
217 		cam_status status;
218 
219 		cgd = (struct ccb_getdev *)arg;
220 		if (cgd == NULL)
221 			break;
222 
223 #if 0
224 		if (cgd->protocol != PROTO_SCSI)
225 			break;
226 #endif
227 
228 		/*
229 		 * Allocate a peripheral instance for this device and
230 		 * start the probe process.
231 		 */
232 		status = cam_periph_alloc(sgregister, sgoninvalidate,
233 					  sgcleanup, sgstart,
234 					  "sg", CAM_PERIPH_BIO, cgd->ccb_h.path,
235 					  sgasync, AC_FOUND_DEVICE, cgd);
236 		if ((status != CAM_REQ_CMP) && (status != CAM_REQ_INPROG)) {
237 			const struct cam_status_entry *entry;
238 
239 			entry = cam_fetch_status_entry(status);
240 			kprintf("sgasync: Unable to attach new device "
241 				"due to status %#x: %s\n", status, entry ?
242 				entry->status_text : "Unknown");
243 		}
244 		break;
245 	}
246 	default:
247 		cam_periph_async(periph, code, path, arg);
248 		break;
249 	}
250 }
251 
252 static cam_status
253 sgregister(struct cam_periph *periph, void *arg)
254 {
255 	struct sg_softc *softc;
256 	struct ccb_getdev *cgd;
257 	int no_tags;
258 
259 	cgd = (struct ccb_getdev *)arg;
260 	if (periph == NULL) {
261 		kprintf("sgregister: periph was NULL!!\n");
262 		return (CAM_REQ_CMP_ERR);
263 	}
264 
265 	if (cgd == NULL) {
266 		kprintf("sgregister: no getdev CCB, can't register device\n");
267 		return (CAM_REQ_CMP_ERR);
268 	}
269 
270 	softc = kmalloc(sizeof(*softc), M_DEVBUF, M_WAITOK | M_ZERO);
271 	softc->state = SG_STATE_NORMAL;
272 	softc->pd_type = SID_TYPE(&cgd->inq_data);
273 	softc->sg_timeout = SG_DEFAULT_TIMEOUT / SG_DEFAULT_HZ * hz;
274 	softc->sg_user_timeout = SG_DEFAULT_TIMEOUT;
275 	TAILQ_INIT(&softc->rdwr_done);
276 	periph->softc = softc;
277 
278 	/*
279 	 * We pass in 0 for all blocksize, since we don't know what the
280 	 * blocksize of the device is, if it even has a blocksize.
281 	 */
282 	cam_periph_unlock(periph);
283 	no_tags = (cgd->inq_data.flags & SID_CmdQue) == 0;
284 	devstat_add_entry(&softc->device_stats, "sg",
285 			  periph->unit_number, 0,
286 			  DEVSTAT_NO_BLOCKSIZE |
287 			      (no_tags ? DEVSTAT_NO_ORDERED_TAGS : 0),
288 			  softc->pd_type |
289 			  DEVSTAT_TYPE_IF_SCSI | DEVSTAT_PRIORITY_PASS,
290 			  DEVSTAT_PRIORITY_PASS);
291 
292 	/* Register the device */
293 	softc->dev = make_dev(&sg_ops, periph->unit_number,
294 			      UID_ROOT, GID_OPERATOR, 0600, "%s%d",
295 			      periph->periph_name, periph->unit_number);
296 	make_dev_alias(softc->dev, "sg%c", 'a' + periph->unit_number);
297 	cam_periph_lock(periph);
298 	softc->dev->si_drv1 = periph;
299 
300 	/*
301 	 * Add as async callback so that we get
302 	 * notified if this device goes away.
303 	 */
304 	xpt_register_async(AC_LOST_DEVICE, sgasync, periph, periph->path);
305 
306 #if 0
307 	if (bootverbose)
308 		xpt_announce_periph(periph, NULL);
309 #endif
310 
311 	return (CAM_REQ_CMP);
312 }
313 
314 static void
315 sgstart(struct cam_periph *periph, union ccb *start_ccb)
316 {
317 	struct sg_softc *softc;
318 
319 	softc = (struct sg_softc *)periph->softc;
320 
321 	switch (softc->state) {
322 	case SG_STATE_NORMAL:
323 		start_ccb->ccb_h.ccb_type = SG_CCB_WAITING;
324 		SLIST_INSERT_HEAD(&periph->ccb_list, &start_ccb->ccb_h,
325 				  periph_links.sle);
326 		periph->immediate_priority = CAM_PRIORITY_NONE;
327 		wakeup(&periph->ccb_list);
328 		break;
329 	}
330 }
331 
332 static void
333 sgdone(struct cam_periph *periph, union ccb *done_ccb)
334 {
335 	struct sg_softc *softc;
336 	struct ccb_scsiio *csio;
337 
338 	softc = (struct sg_softc *)periph->softc;
339 	csio = &done_ccb->csio;
340 	switch (csio->ccb_h.ccb_type) {
341 	case SG_CCB_WAITING:
342 		/* Caller will release the CCB */
343 		wakeup(&done_ccb->ccb_h.cbfcnp);
344 		return;
345 	case SG_CCB_RDWR_IO:
346 	{
347 		struct sg_rdwr *rdwr;
348 
349 		devstat_end_transaction(
350 			&softc->device_stats,
351 			csio->dxfer_len,
352 			csio->tag_action & 0xf,
353 			((csio->ccb_h.flags & CAM_DIR_MASK) ==
354 			  CAM_DIR_NONE) ? DEVSTAT_NO_DATA :
355 			    ((csio->ccb_h.flags & CAM_DIR_OUT) ?
356 			     DEVSTAT_WRITE : DEVSTAT_READ));
357 
358 		rdwr = done_ccb->ccb_h.ccb_rdwr;
359 		rdwr->state = SG_RDWR_DONE;
360 		wakeup(rdwr);
361 		break;
362 	}
363 	default:
364 		panic("unknown sg CCB type");
365 	}
366 }
367 
368 static int
369 sgopen(struct dev_open_args *ap)
370 /*cdev_t dev, int flags, int fmt, struct thread *td)*/
371 {
372 	struct cam_periph *periph;
373 	struct sg_softc *softc;
374 	int error = 0;
375 
376 	periph = (struct cam_periph *)ap->a_head.a_dev->si_drv1;
377 	if (periph == NULL)
378 		return (ENXIO);
379 
380 	/*
381 	 * Don't allow access when we're running at a high securelevel.
382 	 */
383 	if (securelevel > 1) {
384 		cam_periph_unlock(periph);
385 		cam_periph_release(periph);
386 		return(EPERM);
387 	}
388 	cam_periph_lock(periph);
389 
390 	softc = (struct sg_softc *)periph->softc;
391 	if (softc->flags & SG_FLAG_INVALID) {
392 		cam_periph_unlock(periph);
393 		return (ENXIO);
394 	}
395 
396 	if ((softc->flags & SG_FLAG_OPEN) == 0) {
397 		softc->flags |= SG_FLAG_OPEN;
398 		cam_periph_unlock(periph);
399 	} else {
400 		/* Device closes aren't symmetrical, fix up the refcount. */
401 		cam_periph_unlock(periph);
402 		cam_periph_release(periph);
403 	}
404 
405 	return (error);
406 }
407 
408 static int
409 sgclose(struct dev_close_args *ap)
410 /* cdev_t dev, int flag, int fmt, struct thread *td) */
411 {
412 	struct cam_periph *periph;
413 	struct sg_softc *softc;
414 
415 	periph = (struct cam_periph *)ap->a_head.a_dev->si_drv1;
416 	if (periph == NULL)
417 		return (ENXIO);
418 
419 	cam_periph_lock(periph);
420 
421 	softc = (struct sg_softc *)periph->softc;
422 	softc->flags &= ~SG_FLAG_OPEN;
423 
424 	cam_periph_unlock(periph);
425 	cam_periph_release(periph);
426 
427 	return (0);
428 }
429 
430 static int
431 sgioctl(struct dev_ioctl_args *ap)
432 /* cdev_t dev, u_long cmd, caddr_t arg, int flag, struct thread *td) */
433 {
434 	union ccb *ccb;
435 	struct ccb_scsiio *csio;
436 	struct cam_periph *periph;
437 	struct sg_softc *softc;
438 	struct sg_io_hdr req;
439 	int dir, error;
440 
441 	periph = (struct cam_periph *)ap->a_head.a_dev->si_drv1;
442 	if (periph == NULL)
443 		return (ENXIO);
444 
445 	cam_periph_lock(periph);
446 
447 	softc = (struct sg_softc *)periph->softc;
448 	error = 0;
449 
450 	switch (ap->a_cmd) {
451 #if 0
452 	case LINUX_SCSI_GET_BUS_NUMBER: {
453 		int busno;
454 
455 		busno = xpt_path_path_id(periph->path);
456 		error = copyout(&busno, ap->a_data, sizeof(busno));
457 		break;
458 	}
459 	case LINUX_SCSI_GET_IDLUN: {
460 		struct scsi_idlun idlun;
461 		struct cam_sim *sim;
462 
463 		idlun.dev_id = xpt_path_target_id(periph->path);
464 		sim = xpt_path_sim(periph->path);
465 		idlun.host_unique_id = sim->unit_number;
466 		error = copyout(&idlun, ap->a_data, sizeof(idlun));
467 		break;
468 	}
469 #endif
470 	case SG_GET_VERSION_NUM:
471 		error = copyout(&sg_version, ap->a_data, sizeof(sg_version));
472 		break;
473 	case SG_SET_TIMEOUT: {
474 		u_int user_timeout;
475 
476 		error = copyin(ap->a_data, &user_timeout, sizeof(u_int));
477 		if (error == 0) {
478 			softc->sg_user_timeout = user_timeout;
479 			softc->sg_timeout = user_timeout / SG_DEFAULT_HZ * hz;
480 		}
481 		break;
482 	}
483 	case SG_GET_TIMEOUT:
484 		/*
485 		 * The value is returned directly to the syscall.
486 		 */
487 		ap->a_sysmsg->sm_result.iresult = softc->sg_user_timeout;
488 		error = 0;
489 		break;
490 	case SG_IO:
491 		error = copyin(ap->a_data, &req, sizeof(req));
492 		if (error)
493 			break;
494 
495 		if (req.cmd_len > IOCDBLEN) {
496 			error = EINVAL;
497 			break;
498 		}
499 
500 		if (req.iovec_count != 0) {
501 			error = EOPNOTSUPP;
502 			break;
503 		}
504 
505 		ccb = cam_periph_getccb(periph, /*priority*/5);
506 		csio = &ccb->csio;
507 
508 		error = copyin(req.cmdp, &csio->cdb_io.cdb_bytes,
509 		    req.cmd_len);
510 		if (error) {
511 			xpt_release_ccb(ccb);
512 			break;
513 		}
514 
515 		switch(req.dxfer_direction) {
516 		case SG_DXFER_TO_DEV:
517 			dir = CAM_DIR_OUT;
518 			break;
519 		case SG_DXFER_FROM_DEV:
520 			dir = CAM_DIR_IN;
521 			break;
522 		case SG_DXFER_TO_FROM_DEV:
523 			dir = CAM_DIR_IN | CAM_DIR_OUT;
524 			break;
525 		case SG_DXFER_NONE:
526 		default:
527 			dir = CAM_DIR_NONE;
528 			break;
529 		}
530 
531 		cam_fill_csio(csio,
532 			      /*retries*/1,
533 			      sgdone,
534 			      dir|CAM_DEV_QFRZDIS,
535 			      MSG_SIMPLE_Q_TAG,
536 			      req.dxferp,
537 			      req.dxfer_len,
538 			      req.mx_sb_len,
539 			      req.cmd_len,
540 			      req.timeout);
541 
542 		error = sgsendccb(periph, ccb);
543 		if (error) {
544 			req.host_status = DID_ERROR;
545 			req.driver_status = DRIVER_INVALID;
546 			xpt_release_ccb(ccb);
547 			break;
548 		}
549 
550 		req.status = csio->scsi_status;
551 		req.masked_status = (csio->scsi_status >> 1) & 0x7f;
552 		sg_scsiio_status(csio, &req.host_status, &req.driver_status);
553 		req.resid = csio->resid;
554 		req.duration = csio->ccb_h.timeout;
555 		req.info = 0;
556 
557 		error = copyout(&req, ap->a_data, sizeof(req));
558 		if ((error == 0) && (csio->ccb_h.status & CAM_AUTOSNS_VALID)
559 		    && (req.sbp != NULL)) {
560 			req.sb_len_wr = req.mx_sb_len - csio->sense_resid;
561 			error = copyout(&csio->sense_data, req.sbp,
562 					req.sb_len_wr);
563 		}
564 
565 		xpt_release_ccb(ccb);
566 		break;
567 
568 	case SG_GET_RESERVED_SIZE: {
569 		int size = 32768;
570 
571 		error = copyout(&size, ap->a_data, sizeof(size));
572 		break;
573 	}
574 
575 	case SG_GET_SCSI_ID:
576 	{
577 		struct sg_scsi_id id;
578 
579 		id.host_no = 0; /* XXX */
580 		id.channel = xpt_path_path_id(periph->path);
581 		id.scsi_id = xpt_path_target_id(periph->path);
582 		id.lun = xpt_path_lun_id(periph->path);
583 		id.scsi_type = softc->pd_type;
584 		id.h_cmd_per_lun = 1;
585 		id.d_queue_depth = 1;
586 		id.unused[0] = 0;
587 		id.unused[1] = 0;
588 
589 		error = copyout(&id, ap->a_data, sizeof(id));
590 		break;
591 	}
592 
593 	case SG_EMULATED_HOST:
594 	case SG_SET_TRANSFORM:
595 	case SG_GET_TRANSFORM:
596 	case SG_GET_NUM_WAITING:
597 	case SG_SCSI_RESET:
598 	case SG_GET_REQUEST_TABLE:
599 	case SG_SET_KEEP_ORPHAN:
600 	case SG_GET_KEEP_ORPHAN:
601 	case SG_GET_ACCESS_COUNT:
602 	case SG_SET_FORCE_LOW_DMA:
603 	case SG_GET_LOW_DMA:
604 	case SG_GET_SG_TABLESIZE:
605 	case SG_SET_FORCE_PACK_ID:
606 	case SG_GET_PACK_ID:
607 	case SG_SET_RESERVED_SIZE:
608 	case SG_GET_COMMAND_Q:
609 	case SG_SET_COMMAND_Q:
610 	case SG_SET_DEBUG:
611 	case SG_NEXT_CMD_LEN:
612 	default:
613 #ifdef CAMDEBUG
614 		kprintf("sgioctl: rejecting cmd 0x%lx\n", ap->a_cmd);
615 #endif
616 		error = ENODEV;
617 		break;
618 	}
619 
620 	cam_periph_unlock(periph);
621 	return (error);
622 }
623 
624 static int
625 sgwrite(struct dev_write_args *ap)
626 /*cdev_t dev, struct uio *uio, int ioflag)*/
627 {
628 	union ccb *ccb;
629 	struct cam_periph *periph;
630 	struct ccb_scsiio *csio;
631 	struct sg_softc *sc;
632 	struct sg_header *hdr;
633 	struct sg_rdwr *rdwr;
634 	u_char cdb_cmd;
635 	char *buf;
636 	int error = 0, cdb_len, buf_len, dir;
637 	struct uio *uio = ap->a_uio;
638 
639 	periph = ap->a_head.a_dev->si_drv1;
640 	rdwr = kmalloc(sizeof(*rdwr), M_DEVBUF, M_WAITOK | M_ZERO);
641 	hdr = &rdwr->hdr.hdr;
642 
643 	/* Copy in the header block and sanity check it */
644 	if (uio->uio_resid < sizeof(*hdr)) {
645 		error = EINVAL;
646 		goto out_hdr;
647 	}
648 	error = uiomove((char *)hdr, sizeof(*hdr), uio);
649 	if (error)
650 		goto out_hdr;
651 
652 	ccb = xpt_alloc_ccb();
653 	if (ccb == NULL) {
654 		error = ENOMEM;
655 		goto out_hdr;
656 	}
657 	csio = &ccb->csio;
658 
659 	/*
660 	 * Copy in the CDB block.  The designers of the interface didn't
661 	 * bother to provide a size for this in the header, so we have to
662 	 * figure it out ourselves.
663 	 */
664 	if (uio->uio_resid < 1)
665 		goto out_ccb;
666 	error = uiomove(&cdb_cmd, 1, uio);
667 	if (error)
668 		goto out_ccb;
669 	if (hdr->twelve_byte)
670 		cdb_len = 12;
671 	else
672 		cdb_len = scsi_group_len(cdb_cmd);
673 	/*
674 	 * We've already read the first byte of the CDB and advanced the uio
675 	 * pointer.  Just read the rest.
676 	 */
677 	csio->cdb_io.cdb_bytes[0] = cdb_cmd;
678 	error = uiomove(&csio->cdb_io.cdb_bytes[1], cdb_len - 1, uio);
679 	if (error)
680 		goto out_ccb;
681 
682 	/*
683 	 * Now set up the data block.  Again, the designers didn't bother
684 	 * to make this reliable.
685 	 */
686 	buf_len = uio->uio_resid;
687 	if (buf_len != 0) {
688 		buf = kmalloc(buf_len, M_DEVBUF, M_WAITOK | M_ZERO);
689 		error = uiomove(buf, buf_len, uio);
690 		if (error)
691 			goto out_buf;
692 		dir = CAM_DIR_OUT;
693 	} else if (hdr->reply_len != 0) {
694 		buf = kmalloc(hdr->reply_len, M_DEVBUF, M_WAITOK | M_ZERO);
695 		buf_len = hdr->reply_len;
696 		dir = CAM_DIR_IN;
697 	} else {
698 		buf = NULL;
699 		buf_len = 0;
700 		dir = CAM_DIR_NONE;
701 	}
702 
703 	cam_periph_lock(periph);
704 	sc = periph->softc;
705 	xpt_setup_ccb(&ccb->ccb_h, periph->path, /*priority*/5);
706 	cam_fill_csio(csio,
707 		      /*retries*/1,
708 		      sgdone,
709 		      dir|CAM_DEV_QFRZDIS,
710 		      MSG_SIMPLE_Q_TAG,
711 		      buf,
712 		      buf_len,
713 		      SG_MAX_SENSE,
714 		      cdb_len,
715 		      sc->sg_timeout);
716 
717 	/*
718 	 * Send off the command and hope that it works. This path does not
719 	 * go through sgstart because the I/O is supposed to be asynchronous.
720 	 */
721 	rdwr->buf = buf;
722 	rdwr->buf_len = buf_len;
723 	rdwr->tag = hdr->pack_id;
724 	rdwr->ccb = ccb;
725 	rdwr->state = SG_RDWR_INPROG;
726 	ccb->ccb_h.ccb_rdwr = rdwr;
727 	ccb->ccb_h.ccb_type = SG_CCB_RDWR_IO;
728 	TAILQ_INSERT_TAIL(&sc->rdwr_done, rdwr, rdwr_link);
729 	error = sgsendrdwr(periph, ccb);
730 	cam_periph_unlock(periph);
731 	return (error);
732 
733 out_buf:
734 	kfree(buf, M_DEVBUF);
735 out_ccb:
736 	xpt_free_ccb(ccb);
737 out_hdr:
738 	kfree(rdwr, M_DEVBUF);
739 	return (error);
740 }
741 
742 static int
743 sgread(struct dev_read_args *ap)
744 /*cdev_t dev, struct uio *uio, int ioflag)*/
745 {
746 	struct ccb_scsiio *csio;
747 	struct cam_periph *periph;
748 	struct sg_softc *sc;
749 	struct sg_header *hdr;
750 	struct sg_rdwr *rdwr;
751 	u_short hstat, dstat;
752 	int error, pack_len, reply_len, pack_id;
753 	struct uio *uio = ap->a_uio;
754 
755 	periph = ap->a_head.a_dev->si_drv1;
756 
757 	/* XXX The pack len field needs to be updated and written out instead
758 	 * of discarded.  Not sure how to do that.
759 	 */
760 	uio->uio_rw = UIO_WRITE;
761 	if ((error = uiomove((char *)&pack_len, 4, uio)) != 0)
762 		return (error);
763 	if ((error = uiomove((char *)&reply_len, 4, uio)) != 0)
764 		return (error);
765 	if ((error = uiomove((char *)&pack_id, 4, uio)) != 0)
766 		return (error);
767 	uio->uio_rw = UIO_READ;
768 
769 	cam_periph_lock(periph);
770 	sc = periph->softc;
771 search:
772 	TAILQ_FOREACH(rdwr, &sc->rdwr_done, rdwr_link) {
773 		if (rdwr->tag == pack_id)
774 			break;
775 	}
776 	if (rdwr == NULL) {
777 		cam_periph_unlock(periph);
778 		if (tsleep(&hstat, PCATCH, "sgnull", 0) == ERESTART)
779 			return(EAGAIN);
780 		cam_periph_lock(periph);
781 		goto search;
782 	}
783 	if (rdwr->state != SG_RDWR_DONE) {
784 		tsleep_interlock(rdwr, PCATCH);
785 		cam_periph_unlock(periph);
786 		if (rdwr->state != SG_RDWR_DONE) {
787 		    if (tsleep(rdwr, PCATCH | PINTERLOCKED, "sgread", 0) ==
788 			ERESTART) {
789 				return (EAGAIN);
790 		    }
791 		}
792 		cam_periph_lock(periph);
793 		goto search;
794 	}
795 	TAILQ_REMOVE(&sc->rdwr_done, rdwr, rdwr_link);
796 	cam_periph_unlock(periph);
797 
798 	hdr = &rdwr->hdr.hdr;
799 	csio = &rdwr->ccb->csio;
800 	sg_scsiio_status(csio, &hstat, &dstat);
801 	hdr->host_status = hstat;
802 	hdr->driver_status = dstat;
803 	hdr->target_status = csio->scsi_status >> 1;
804 
805 	switch (hstat) {
806 	case DID_OK:
807 	case DID_PASSTHROUGH:
808 	case DID_SOFT_ERROR:
809 		hdr->result = 0;
810 		break;
811 	case DID_NO_CONNECT:
812 	case DID_BUS_BUSY:
813 	case DID_TIME_OUT:
814 		hdr->result = EBUSY;
815 		break;
816 	case DID_BAD_TARGET:
817 	case DID_ABORT:
818 	case DID_PARITY:
819 	case DID_RESET:
820 	case DID_BAD_INTR:
821 	case DID_ERROR:
822 	default:
823 		hdr->result = EIO;
824 		break;
825 	}
826 
827 	if (dstat == DRIVER_SENSE) {
828 		bcopy(&csio->sense_data, hdr->sense_buffer,
829 		      min(csio->sense_len, SG_MAX_SENSE));
830 #ifdef CAMDEBUG
831 		scsi_sense_print(csio);
832 #endif
833 	}
834 
835 	error = uiomove((char *)&hdr->result, sizeof(*hdr) -
836 			offsetof(struct sg_header, result), uio);
837 	if ((error == 0) && (hdr->result == 0))
838 		error = uiomove(rdwr->buf, rdwr->buf_len, uio);
839 
840 	cam_periph_lock(periph);
841 	xpt_free_ccb(rdwr->ccb);
842 	cam_periph_unlock(periph);
843 	kfree(rdwr->buf, M_DEVBUF);
844 	kfree(rdwr, M_DEVBUF);
845 	return (error);
846 }
847 
848 static int
849 sgsendccb(struct cam_periph *periph, union ccb *ccb)
850 {
851 	struct sg_softc *softc;
852 	struct cam_periph_map_info mapinfo;
853 	int error, need_unmap = 0;
854 
855 	softc = periph->softc;
856 	if (((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE)
857 	    && (ccb->csio.data_ptr != NULL)) {
858 		bzero(&mapinfo, sizeof(mapinfo));
859 
860 		/*
861 		 * cam_periph_mapmem calls into proc and vm functions that can
862 		 * sleep as well as trigger I/O, so we can't hold the lock.
863 		 * Dropping it here is reasonably safe.
864 		 */
865 		cam_periph_unlock(periph);
866 		error = cam_periph_mapmem(ccb, &mapinfo);
867 		cam_periph_lock(periph);
868 		if (error)
869 			return (error);
870 		need_unmap = 1;
871 	}
872 
873 	error = cam_periph_runccb(ccb, sgerror, CAM_RETRY_SELTO,
874 				  SF_RETRY_UA, &softc->device_stats);
875 
876 	if (need_unmap)
877 		cam_periph_unmapmem(ccb, &mapinfo);
878 
879 	return (error);
880 }
881 
882 static int
883 sgsendrdwr(struct cam_periph *periph, union ccb *ccb)
884 {
885 	struct sg_softc *softc;
886 
887 	softc = periph->softc;
888 	devstat_start_transaction(&softc->device_stats);
889 	xpt_action(ccb);
890 	return (0);
891 }
892 
893 static int
894 sgerror(union ccb *ccb, uint32_t cam_flags, uint32_t sense_flags)
895 {
896 	struct cam_periph *periph;
897 	struct sg_softc *softc;
898 
899 	periph = xpt_path_periph(ccb->ccb_h.path);
900 	softc = (struct sg_softc *)periph->softc;
901 
902 	return (cam_periph_error(ccb, cam_flags, sense_flags,
903 				 &softc->saved_ccb));
904 }
905 
906 static void
907 sg_scsiio_status(struct ccb_scsiio *csio, u_short *hoststat, u_short *drvstat)
908 {
909 	int status;
910 
911 	status = csio->ccb_h.status;
912 
913 	switch (status & CAM_STATUS_MASK) {
914 	case CAM_REQ_CMP:
915 		*hoststat = DID_OK;
916 		*drvstat = 0;
917 		break;
918 	case CAM_REQ_CMP_ERR:
919 		*hoststat = DID_ERROR;
920 		*drvstat = 0;
921 		break;
922 	case CAM_REQ_ABORTED:
923 		*hoststat = DID_ABORT;
924 		*drvstat = 0;
925 		break;
926 	case CAM_REQ_INVALID:
927 		*hoststat = DID_ERROR;
928 		*drvstat = DRIVER_INVALID;
929 		break;
930 	case CAM_DEV_NOT_THERE:
931 		*hoststat = DID_BAD_TARGET;
932 		*drvstat = 0;
933 		break;
934 	case CAM_SEL_TIMEOUT:
935 		*hoststat = DID_NO_CONNECT;
936 		*drvstat = 0;
937 		break;
938 	case CAM_CMD_TIMEOUT:
939 		*hoststat = DID_TIME_OUT;
940 		*drvstat = 0;
941 		break;
942 	case CAM_SCSI_STATUS_ERROR:
943 		*hoststat = DID_ERROR;
944 		*drvstat = 0;
945 		break;
946 	case CAM_SCSI_BUS_RESET:
947 		*hoststat = DID_RESET;
948 		*drvstat = 0;
949 		break;
950 	case CAM_UNCOR_PARITY:
951 		*hoststat = DID_PARITY;
952 		*drvstat = 0;
953 		break;
954 	case CAM_SCSI_BUSY:
955 		*hoststat = DID_BUS_BUSY;
956 		*drvstat = 0;
957 		break;
958 	default:
959 		*hoststat = DID_ERROR;
960 		*drvstat = DRIVER_ERROR;
961 	}
962 
963 	if (status & CAM_AUTOSNS_VALID)
964 		*drvstat = DRIVER_SENSE;
965 }
966 
967 static int
968 scsi_group_len(u_char cmd)
969 {
970 	int len[] = {6, 10, 10, 12, 12, 12, 10, 10};
971 	int group;
972 
973 	group = (cmd >> 5) & 0x7;
974 	return (len[group]);
975 }
976