xref: /illumos-gate/usr/src/uts/common/io/scsi/targets/sd.c (revision 21cce053)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 /*
26  * Copyright (c) 2011 Bayard G. Bell.  All rights reserved.
27  * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
28  * Copyright 2012 DEY Storage Systems, Inc.  All rights reserved.
29  * Copyright 2016 Joyent, Inc.
30  * Copyright 2017 Nexenta Systems, Inc.
31  */
32 /*
33  * Copyright 2011 cyril.galibern@opensvc.com
34  */
35 
36 /*
37  * SCSI disk target driver.
38  */
39 #include <sys/scsi/scsi.h>
40 #include <sys/dkbad.h>
41 #include <sys/dklabel.h>
42 #include <sys/dkio.h>
43 #include <sys/fdio.h>
44 #include <sys/cdio.h>
45 #include <sys/mhd.h>
46 #include <sys/vtoc.h>
47 #include <sys/dktp/fdisk.h>
48 #include <sys/kstat.h>
49 #include <sys/vtrace.h>
50 #include <sys/note.h>
51 #include <sys/thread.h>
52 #include <sys/proc.h>
53 #include <sys/efi_partition.h>
54 #include <sys/var.h>
55 #include <sys/aio_req.h>
56 #include <sys/dkioc_free_util.h>
57 
58 #ifdef __lock_lint
59 #define	_LP64
60 #define	__amd64
61 #endif
62 
63 #if (defined(__fibre))
64 /* Note: is there a leadville version of the following? */
65 #include <sys/fc4/fcal_linkapp.h>
66 #endif
67 #include <sys/taskq.h>
68 #include <sys/uuid.h>
69 #include <sys/byteorder.h>
70 #include <sys/sdt.h>
71 
72 #include "sd_xbuf.h"
73 
74 #include <sys/scsi/targets/sddef.h>
75 #include <sys/cmlb.h>
76 #include <sys/sysevent/eventdefs.h>
77 #include <sys/sysevent/dev.h>
78 
79 #include <sys/fm/protocol.h>
80 
81 /*
82  * Loadable module info.
83  */
84 #if (defined(__fibre))
85 #define	SD_MODULE_NAME	"SCSI SSA/FCAL Disk Driver"
86 #else /* !__fibre */
87 #define	SD_MODULE_NAME	"SCSI Disk Driver"
88 #endif /* !__fibre */
89 
90 /*
91  * Define the interconnect type, to allow the driver to distinguish
92  * between parallel SCSI (sd) and fibre channel (ssd) behaviors.
93  *
94  * This is really for backward compatibility. In the future, the driver
95  * should actually check the "interconnect-type" property as reported by
96  * the HBA; however at present this property is not defined by all HBAs,
97  * so we will use this #define (1) to permit the driver to run in
98  * backward-compatibility mode; and (2) to print a notification message
99  * if an FC HBA does not support the "interconnect-type" property.  The
100  * behavior of the driver will be to assume parallel SCSI behaviors unless
101  * the "interconnect-type" property is defined by the HBA **AND** has a
102  * value of either INTERCONNECT_FIBRE, INTERCONNECT_SSA, or
103  * INTERCONNECT_FABRIC, in which case the driver will assume Fibre
104  * Channel behaviors (as per the old ssd).  (Note that the
105  * INTERCONNECT_1394 and INTERCONNECT_USB types are not supported and
106  * will result in the driver assuming parallel SCSI behaviors.)
107  *
108  * (see common/sys/scsi/impl/services.h)
109  *
110  * Note: For ssd semantics, don't use INTERCONNECT_FABRIC as the default
111  * since some FC HBAs may already support that, and there is some code in
112  * the driver that already looks for it.  Using INTERCONNECT_FABRIC as the
113  * default would confuse that code, and besides things should work fine
114  * anyways if the FC HBA already reports INTERCONNECT_FABRIC for the
115  * "interconnect_type" property.
116  *
117  */
118 #if (defined(__fibre))
119 #define	SD_DEFAULT_INTERCONNECT_TYPE	SD_INTERCONNECT_FIBRE
120 #else
121 #define	SD_DEFAULT_INTERCONNECT_TYPE	SD_INTERCONNECT_PARALLEL
122 #endif
123 
124 /*
125  * The name of the driver, established from the module name in _init.
126  */
127 static	char *sd_label			= NULL;
128 
129 /*
130  * Driver name is unfortunately prefixed on some driver.conf properties.
131  */
132 #if (defined(__fibre))
133 #define	sd_max_xfer_size		ssd_max_xfer_size
134 #define	sd_config_list			ssd_config_list
135 static	char *sd_max_xfer_size		= "ssd_max_xfer_size";
136 static	char *sd_config_list		= "ssd-config-list";
137 #else
138 static	char *sd_max_xfer_size		= "sd_max_xfer_size";
139 static	char *sd_config_list		= "sd-config-list";
140 #endif
141 
142 /*
143  * Driver global variables
144  */
145 
146 #if (defined(__fibre))
147 /*
148  * These #defines are to avoid namespace collisions that occur because this
149  * code is currently used to compile two separate driver modules: sd and ssd.
150  * All global variables need to be treated this way (even if declared static)
151  * in order to allow the debugger to resolve the names properly.
152  * It is anticipated that in the near future the ssd module will be obsoleted,
153  * at which time this namespace issue should go away.
154  */
155 #define	sd_state			ssd_state
156 #define	sd_io_time			ssd_io_time
157 #define	sd_failfast_enable		ssd_failfast_enable
158 #define	sd_ua_retry_count		ssd_ua_retry_count
159 #define	sd_report_pfa			ssd_report_pfa
160 #define	sd_max_throttle			ssd_max_throttle
161 #define	sd_min_throttle			ssd_min_throttle
162 #define	sd_rot_delay			ssd_rot_delay
163 
164 #define	sd_retry_on_reservation_conflict	\
165 					ssd_retry_on_reservation_conflict
166 #define	sd_reinstate_resv_delay		ssd_reinstate_resv_delay
167 #define	sd_resv_conflict_name		ssd_resv_conflict_name
168 
169 #define	sd_component_mask		ssd_component_mask
170 #define	sd_level_mask			ssd_level_mask
171 #define	sd_debug_un			ssd_debug_un
172 #define	sd_error_level			ssd_error_level
173 
174 #define	sd_xbuf_active_limit		ssd_xbuf_active_limit
175 #define	sd_xbuf_reserve_limit		ssd_xbuf_reserve_limit
176 
177 #define	sd_tr				ssd_tr
178 #define	sd_reset_throttle_timeout	ssd_reset_throttle_timeout
179 #define	sd_qfull_throttle_timeout	ssd_qfull_throttle_timeout
180 #define	sd_qfull_throttle_enable	ssd_qfull_throttle_enable
181 #define	sd_check_media_time		ssd_check_media_time
182 #define	sd_wait_cmds_complete		ssd_wait_cmds_complete
183 #define	sd_label_mutex			ssd_label_mutex
184 #define	sd_detach_mutex			ssd_detach_mutex
185 #define	sd_log_buf			ssd_log_buf
186 #define	sd_log_mutex			ssd_log_mutex
187 
188 #define	sd_disk_table			ssd_disk_table
189 #define	sd_disk_table_size		ssd_disk_table_size
190 #define	sd_sense_mutex			ssd_sense_mutex
191 #define	sd_cdbtab			ssd_cdbtab
192 
193 #define	sd_cb_ops			ssd_cb_ops
194 #define	sd_ops				ssd_ops
195 #define	sd_additional_codes		ssd_additional_codes
196 #define	sd_tgops			ssd_tgops
197 
198 #define	sd_minor_data			ssd_minor_data
199 #define	sd_minor_data_efi		ssd_minor_data_efi
200 
201 #define	sd_tq				ssd_tq
202 #define	sd_wmr_tq			ssd_wmr_tq
203 #define	sd_taskq_name			ssd_taskq_name
204 #define	sd_wmr_taskq_name		ssd_wmr_taskq_name
205 #define	sd_taskq_minalloc		ssd_taskq_minalloc
206 #define	sd_taskq_maxalloc		ssd_taskq_maxalloc
207 
208 #define	sd_dump_format_string		ssd_dump_format_string
209 
210 #define	sd_iostart_chain		ssd_iostart_chain
211 #define	sd_iodone_chain			ssd_iodone_chain
212 
213 #define	sd_pm_idletime			ssd_pm_idletime
214 
215 #define	sd_force_pm_supported		ssd_force_pm_supported
216 
217 #define	sd_dtype_optical_bind		ssd_dtype_optical_bind
218 
219 #define	sd_ssc_init			ssd_ssc_init
220 #define	sd_ssc_send			ssd_ssc_send
221 #define	sd_ssc_fini			ssd_ssc_fini
222 #define	sd_ssc_assessment		ssd_ssc_assessment
223 #define	sd_ssc_post			ssd_ssc_post
224 #define	sd_ssc_print			ssd_ssc_print
225 #define	sd_ssc_ereport_post		ssd_ssc_ereport_post
226 #define	sd_ssc_set_info			ssd_ssc_set_info
227 #define	sd_ssc_extract_info		ssd_ssc_extract_info
228 
229 #endif
230 
231 #ifdef	SDDEBUG
232 int	sd_force_pm_supported		= 0;
233 #endif	/* SDDEBUG */
234 
235 void *sd_state				= NULL;
236 int sd_io_time				= SD_IO_TIME;
237 int sd_failfast_enable			= 1;
238 int sd_ua_retry_count			= SD_UA_RETRY_COUNT;
239 int sd_report_pfa			= 1;
240 int sd_max_throttle			= SD_MAX_THROTTLE;
241 int sd_min_throttle			= SD_MIN_THROTTLE;
242 int sd_rot_delay			= 4; /* Default 4ms Rotation delay */
243 int sd_qfull_throttle_enable		= TRUE;
244 
245 int sd_retry_on_reservation_conflict	= 1;
246 int sd_reinstate_resv_delay		= SD_REINSTATE_RESV_DELAY;
247 _NOTE(SCHEME_PROTECTS_DATA("safe sharing", sd_reinstate_resv_delay))
248 
249 static int sd_dtype_optical_bind	= -1;
250 
251 /* Note: the following is not a bug, it really is "sd_" and not "ssd_" */
252 static	char *sd_resv_conflict_name	= "sd_retry_on_reservation_conflict";
253 
254 /*
255  * Global data for debug logging. To enable debug printing, sd_component_mask
256  * and sd_level_mask should be set to the desired bit patterns as outlined in
257  * sddef.h.
258  */
259 uint_t	sd_component_mask		= 0x0;
260 uint_t	sd_level_mask			= 0x0;
261 struct	sd_lun *sd_debug_un		= NULL;
262 uint_t	sd_error_level			= SCSI_ERR_RETRYABLE;
263 
264 /* Note: these may go away in the future... */
265 static uint32_t	sd_xbuf_active_limit	= 512;
266 static uint32_t sd_xbuf_reserve_limit	= 16;
267 
268 static struct sd_resv_reclaim_request	sd_tr = { NULL, NULL, NULL, 0, 0, 0 };
269 
270 /*
271  * Timer value used to reset the throttle after it has been reduced
272  * (typically in response to TRAN_BUSY or STATUS_QFULL)
273  */
274 static int sd_reset_throttle_timeout	= SD_RESET_THROTTLE_TIMEOUT;
275 static int sd_qfull_throttle_timeout	= SD_QFULL_THROTTLE_TIMEOUT;
276 
277 /*
278  * Interval value associated with the media change scsi watch.
279  */
280 static int sd_check_media_time		= 3000000;
281 
282 /*
283  * Wait value used for in progress operations during a DDI_SUSPEND
284  */
285 static int sd_wait_cmds_complete	= SD_WAIT_CMDS_COMPLETE;
286 
287 /*
288  * sd_label_mutex protects a static buffer used in the disk label
289  * component of the driver
290  */
291 static kmutex_t sd_label_mutex;
292 
293 /*
294  * sd_detach_mutex protects un_layer_count, un_detach_count, and
295  * un_opens_in_progress in the sd_lun structure.
296  */
297 static kmutex_t sd_detach_mutex;
298 
299 _NOTE(MUTEX_PROTECTS_DATA(sd_detach_mutex,
300 	sd_lun::{un_layer_count un_detach_count un_opens_in_progress}))
301 
302 /*
303  * Global buffer and mutex for debug logging
304  */
305 static char	sd_log_buf[1024];
306 static kmutex_t	sd_log_mutex;
307 
308 /*
309  * Structs and globals for recording attached lun information.
310  * This maintains a chain. Each node in the chain represents a SCSI controller.
311  * The structure records the number of luns attached to each target connected
312  * with the controller.
313  * For parallel scsi device only.
314  */
315 struct sd_scsi_hba_tgt_lun {
316 	struct sd_scsi_hba_tgt_lun	*next;
317 	dev_info_t			*pdip;
318 	int				nlun[NTARGETS_WIDE];
319 };
320 
321 /*
322  * Flag to indicate the lun is attached or detached
323  */
324 #define	SD_SCSI_LUN_ATTACH	0
325 #define	SD_SCSI_LUN_DETACH	1
326 
327 static kmutex_t	sd_scsi_target_lun_mutex;
328 static struct sd_scsi_hba_tgt_lun	*sd_scsi_target_lun_head = NULL;
329 
330 _NOTE(MUTEX_PROTECTS_DATA(sd_scsi_target_lun_mutex,
331     sd_scsi_hba_tgt_lun::next sd_scsi_hba_tgt_lun::pdip))
332 
333 _NOTE(MUTEX_PROTECTS_DATA(sd_scsi_target_lun_mutex,
334     sd_scsi_target_lun_head))
335 
336 /*
337  * "Smart" Probe Caching structs, globals, #defines, etc.
338  * For parallel scsi and non-self-identify device only.
339  */
340 
341 /*
342  * The following resources and routines are implemented to support
343  * "smart" probing, which caches the scsi_probe() results in an array,
344  * in order to help avoid long probe times.
345  */
346 struct sd_scsi_probe_cache {
347 	struct	sd_scsi_probe_cache	*next;
348 	dev_info_t	*pdip;
349 	int		cache[NTARGETS_WIDE];
350 };
351 
352 static kmutex_t	sd_scsi_probe_cache_mutex;
353 static struct	sd_scsi_probe_cache *sd_scsi_probe_cache_head = NULL;
354 
355 /*
356  * Really we only need protection on the head of the linked list, but
357  * better safe than sorry.
358  */
359 _NOTE(MUTEX_PROTECTS_DATA(sd_scsi_probe_cache_mutex,
360     sd_scsi_probe_cache::next sd_scsi_probe_cache::pdip))
361 
362 _NOTE(MUTEX_PROTECTS_DATA(sd_scsi_probe_cache_mutex,
363     sd_scsi_probe_cache_head))
364 
365 /*
366  * Power attribute table
367  */
368 static sd_power_attr_ss sd_pwr_ss = {
369 	{ "NAME=spindle-motor", "0=off", "1=on", NULL },
370 	{0, 100},
371 	{30, 0},
372 	{20000, 0}
373 };
374 
375 static sd_power_attr_pc sd_pwr_pc = {
376 	{ "NAME=spindle-motor", "0=stopped", "1=standby", "2=idle",
377 		"3=active", NULL },
378 	{0, 0, 0, 100},
379 	{90, 90, 20, 0},
380 	{15000, 15000, 1000, 0}
381 };
382 
383 /*
384  * Power level to power condition
385  */
386 static int sd_pl2pc[] = {
387 	SD_TARGET_START_VALID,
388 	SD_TARGET_STANDBY,
389 	SD_TARGET_IDLE,
390 	SD_TARGET_ACTIVE
391 };
392 
393 /*
394  * Vendor specific data name property declarations
395  */
396 
397 #if defined(__fibre) || defined(__i386) ||defined(__amd64)
398 
399 static sd_tunables seagate_properties = {
400 	SEAGATE_THROTTLE_VALUE,
401 	0,
402 	0,
403 	0,
404 	0,
405 	0,
406 	0,
407 	0,
408 	0
409 };
410 
411 
412 static sd_tunables fujitsu_properties = {
413 	FUJITSU_THROTTLE_VALUE,
414 	0,
415 	0,
416 	0,
417 	0,
418 	0,
419 	0,
420 	0,
421 	0
422 };
423 
424 static sd_tunables ibm_properties = {
425 	IBM_THROTTLE_VALUE,
426 	0,
427 	0,
428 	0,
429 	0,
430 	0,
431 	0,
432 	0,
433 	0
434 };
435 
436 static sd_tunables purple_properties = {
437 	PURPLE_THROTTLE_VALUE,
438 	0,
439 	0,
440 	PURPLE_BUSY_RETRIES,
441 	PURPLE_RESET_RETRY_COUNT,
442 	PURPLE_RESERVE_RELEASE_TIME,
443 	0,
444 	0,
445 	0
446 };
447 
448 static sd_tunables sve_properties = {
449 	SVE_THROTTLE_VALUE,
450 	0,
451 	0,
452 	SVE_BUSY_RETRIES,
453 	SVE_RESET_RETRY_COUNT,
454 	SVE_RESERVE_RELEASE_TIME,
455 	SVE_MIN_THROTTLE_VALUE,
456 	SVE_DISKSORT_DISABLED_FLAG,
457 	0
458 };
459 
460 static sd_tunables maserati_properties = {
461 	0,
462 	0,
463 	0,
464 	0,
465 	0,
466 	0,
467 	0,
468 	MASERATI_DISKSORT_DISABLED_FLAG,
469 	MASERATI_LUN_RESET_ENABLED_FLAG
470 };
471 
472 static sd_tunables pirus_properties = {
473 	PIRUS_THROTTLE_VALUE,
474 	0,
475 	PIRUS_NRR_COUNT,
476 	PIRUS_BUSY_RETRIES,
477 	PIRUS_RESET_RETRY_COUNT,
478 	0,
479 	PIRUS_MIN_THROTTLE_VALUE,
480 	PIRUS_DISKSORT_DISABLED_FLAG,
481 	PIRUS_LUN_RESET_ENABLED_FLAG
482 };
483 
484 #endif
485 
486 #if (defined(__sparc) && !defined(__fibre)) || \
487 	(defined(__i386) || defined(__amd64))
488 
489 
490 static sd_tunables elite_properties = {
491 	ELITE_THROTTLE_VALUE,
492 	0,
493 	0,
494 	0,
495 	0,
496 	0,
497 	0,
498 	0,
499 	0
500 };
501 
502 static sd_tunables st31200n_properties = {
503 	ST31200N_THROTTLE_VALUE,
504 	0,
505 	0,
506 	0,
507 	0,
508 	0,
509 	0,
510 	0,
511 	0
512 };
513 
514 #endif /* Fibre or not */
515 
516 static sd_tunables lsi_properties_scsi = {
517 	LSI_THROTTLE_VALUE,
518 	0,
519 	LSI_NOTREADY_RETRIES,
520 	0,
521 	0,
522 	0,
523 	0,
524 	0,
525 	0
526 };
527 
528 static sd_tunables symbios_properties = {
529 	SYMBIOS_THROTTLE_VALUE,
530 	0,
531 	SYMBIOS_NOTREADY_RETRIES,
532 	0,
533 	0,
534 	0,
535 	0,
536 	0,
537 	0
538 };
539 
540 static sd_tunables lsi_properties = {
541 	0,
542 	0,
543 	LSI_NOTREADY_RETRIES,
544 	0,
545 	0,
546 	0,
547 	0,
548 	0,
549 	0
550 };
551 
552 static sd_tunables lsi_oem_properties = {
553 	0,
554 	0,
555 	LSI_OEM_NOTREADY_RETRIES,
556 	0,
557 	0,
558 	0,
559 	0,
560 	0,
561 	0,
562 	1
563 };
564 
565 
566 
567 #if (defined(SD_PROP_TST))
568 
569 #define	SD_TST_CTYPE_VAL	CTYPE_CDROM
570 #define	SD_TST_THROTTLE_VAL	16
571 #define	SD_TST_NOTREADY_VAL	12
572 #define	SD_TST_BUSY_VAL		60
573 #define	SD_TST_RST_RETRY_VAL	36
574 #define	SD_TST_RSV_REL_TIME	60
575 
576 static sd_tunables tst_properties = {
577 	SD_TST_THROTTLE_VAL,
578 	SD_TST_CTYPE_VAL,
579 	SD_TST_NOTREADY_VAL,
580 	SD_TST_BUSY_VAL,
581 	SD_TST_RST_RETRY_VAL,
582 	SD_TST_RSV_REL_TIME,
583 	0,
584 	0,
585 	0
586 };
587 #endif
588 
589 /* This is similar to the ANSI toupper implementation */
590 #define	SD_TOUPPER(C)	(((C) >= 'a' && (C) <= 'z') ? (C) - 'a' + 'A' : (C))
591 
592 /*
593  * Static Driver Configuration Table
594  *
595  * This is the table of disks which need throttle adjustment (or, perhaps
596  * something else as defined by the flags at a future time.)  device_id
597  * is a string consisting of concatenated vid (vendor), pid (product/model)
598  * and revision strings as defined in the scsi_inquiry structure.  Offsets of
599  * the parts of the string are as defined by the sizes in the scsi_inquiry
600  * structure.  Device type is searched as far as the device_id string is
601  * defined.  Flags defines which values are to be set in the driver from the
602  * properties list.
603  *
604  * Entries below which begin and end with a "*" are a special case.
605  * These do not have a specific vendor, and the string which follows
606  * can appear anywhere in the 16 byte PID portion of the inquiry data.
607  *
608  * Entries below which begin and end with a " " (blank) are a special
609  * case. The comparison function will treat multiple consecutive blanks
610  * as equivalent to a single blank. For example, this causes a
611  * sd_disk_table entry of " NEC CDROM " to match a device's id string
612  * of  "NEC       CDROM".
613  *
614  * Note: The MD21 controller type has been obsoleted.
615  *	 ST318202F is a Legacy device
616  *	 MAM3182FC, MAM3364FC, MAM3738FC do not appear to have ever been
617  *	 made with an FC connection. The entries here are a legacy.
618  */
619 static sd_disk_config_t sd_disk_table[] = {
620 #if defined(__fibre) || defined(__i386) || defined(__amd64)
621 	{ "SEAGATE ST34371FC", SD_CONF_BSET_THROTTLE, &seagate_properties },
622 	{ "SEAGATE ST19171FC", SD_CONF_BSET_THROTTLE, &seagate_properties },
623 	{ "SEAGATE ST39102FC", SD_CONF_BSET_THROTTLE, &seagate_properties },
624 	{ "SEAGATE ST39103FC", SD_CONF_BSET_THROTTLE, &seagate_properties },
625 	{ "SEAGATE ST118273F", SD_CONF_BSET_THROTTLE, &seagate_properties },
626 	{ "SEAGATE ST318202F", SD_CONF_BSET_THROTTLE, &seagate_properties },
627 	{ "SEAGATE ST318203F", SD_CONF_BSET_THROTTLE, &seagate_properties },
628 	{ "SEAGATE ST136403F", SD_CONF_BSET_THROTTLE, &seagate_properties },
629 	{ "SEAGATE ST318304F", SD_CONF_BSET_THROTTLE, &seagate_properties },
630 	{ "SEAGATE ST336704F", SD_CONF_BSET_THROTTLE, &seagate_properties },
631 	{ "SEAGATE ST373405F", SD_CONF_BSET_THROTTLE, &seagate_properties },
632 	{ "SEAGATE ST336605F", SD_CONF_BSET_THROTTLE, &seagate_properties },
633 	{ "SEAGATE ST336752F", SD_CONF_BSET_THROTTLE, &seagate_properties },
634 	{ "SEAGATE ST318452F", SD_CONF_BSET_THROTTLE, &seagate_properties },
635 	{ "FUJITSU MAG3091F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
636 	{ "FUJITSU MAG3182F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
637 	{ "FUJITSU MAA3182F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
638 	{ "FUJITSU MAF3364F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
639 	{ "FUJITSU MAL3364F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
640 	{ "FUJITSU MAL3738F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
641 	{ "FUJITSU MAM3182FC",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
642 	{ "FUJITSU MAM3364FC",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
643 	{ "FUJITSU MAM3738FC",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
644 	{ "IBM     DDYFT1835",  SD_CONF_BSET_THROTTLE, &ibm_properties },
645 	{ "IBM     DDYFT3695",  SD_CONF_BSET_THROTTLE, &ibm_properties },
646 	{ "IBM     IC35LF2D2",  SD_CONF_BSET_THROTTLE, &ibm_properties },
647 	{ "IBM     IC35LF2PR",  SD_CONF_BSET_THROTTLE, &ibm_properties },
648 	{ "IBM     1724-100",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
649 	{ "IBM     1726-2xx",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
650 	{ "IBM     1726-22x",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
651 	{ "IBM     1726-4xx",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
652 	{ "IBM     1726-42x",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
653 	{ "IBM     1726-3xx",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
654 	{ "IBM     3526",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
655 	{ "IBM     3542",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
656 	{ "IBM     3552",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
657 	{ "IBM     1722",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
658 	{ "IBM     1742",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
659 	{ "IBM     1815",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
660 	{ "IBM     FAStT",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
661 	{ "IBM     1814",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
662 	{ "IBM     1814-200",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
663 	{ "IBM     1818",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
664 	{ "DELL    MD3000",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
665 	{ "DELL    MD3000i",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
666 	{ "LSI     INF",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
667 	{ "ENGENIO INF",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
668 	{ "SGI     TP",		SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
669 	{ "SGI     IS",		SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
670 	{ "*CSM100_*",		SD_CONF_BSET_NRR_COUNT |
671 			SD_CONF_BSET_CACHE_IS_NV, &lsi_oem_properties },
672 	{ "*CSM200_*",		SD_CONF_BSET_NRR_COUNT |
673 			SD_CONF_BSET_CACHE_IS_NV, &lsi_oem_properties },
674 	{ "Fujitsu SX300",	SD_CONF_BSET_THROTTLE,  &lsi_oem_properties },
675 	{ "LSI",		SD_CONF_BSET_NRR_COUNT, &lsi_properties },
676 	{ "SUN     T3", SD_CONF_BSET_THROTTLE |
677 			SD_CONF_BSET_BSY_RETRY_COUNT|
678 			SD_CONF_BSET_RST_RETRIES|
679 			SD_CONF_BSET_RSV_REL_TIME,
680 		&purple_properties },
681 	{ "SUN     SESS01", SD_CONF_BSET_THROTTLE |
682 		SD_CONF_BSET_BSY_RETRY_COUNT|
683 		SD_CONF_BSET_RST_RETRIES|
684 		SD_CONF_BSET_RSV_REL_TIME|
685 		SD_CONF_BSET_MIN_THROTTLE|
686 		SD_CONF_BSET_DISKSORT_DISABLED,
687 		&sve_properties },
688 	{ "SUN     T4", SD_CONF_BSET_THROTTLE |
689 			SD_CONF_BSET_BSY_RETRY_COUNT|
690 			SD_CONF_BSET_RST_RETRIES|
691 			SD_CONF_BSET_RSV_REL_TIME,
692 		&purple_properties },
693 	{ "SUN     SVE01", SD_CONF_BSET_DISKSORT_DISABLED |
694 		SD_CONF_BSET_LUN_RESET_ENABLED,
695 		&maserati_properties },
696 	{ "SUN     SE6920", SD_CONF_BSET_THROTTLE |
697 		SD_CONF_BSET_NRR_COUNT|
698 		SD_CONF_BSET_BSY_RETRY_COUNT|
699 		SD_CONF_BSET_RST_RETRIES|
700 		SD_CONF_BSET_MIN_THROTTLE|
701 		SD_CONF_BSET_DISKSORT_DISABLED|
702 		SD_CONF_BSET_LUN_RESET_ENABLED,
703 		&pirus_properties },
704 	{ "SUN     SE6940", SD_CONF_BSET_THROTTLE |
705 		SD_CONF_BSET_NRR_COUNT|
706 		SD_CONF_BSET_BSY_RETRY_COUNT|
707 		SD_CONF_BSET_RST_RETRIES|
708 		SD_CONF_BSET_MIN_THROTTLE|
709 		SD_CONF_BSET_DISKSORT_DISABLED|
710 		SD_CONF_BSET_LUN_RESET_ENABLED,
711 		&pirus_properties },
712 	{ "SUN     StorageTek 6920", SD_CONF_BSET_THROTTLE |
713 		SD_CONF_BSET_NRR_COUNT|
714 		SD_CONF_BSET_BSY_RETRY_COUNT|
715 		SD_CONF_BSET_RST_RETRIES|
716 		SD_CONF_BSET_MIN_THROTTLE|
717 		SD_CONF_BSET_DISKSORT_DISABLED|
718 		SD_CONF_BSET_LUN_RESET_ENABLED,
719 		&pirus_properties },
720 	{ "SUN     StorageTek 6940", SD_CONF_BSET_THROTTLE |
721 		SD_CONF_BSET_NRR_COUNT|
722 		SD_CONF_BSET_BSY_RETRY_COUNT|
723 		SD_CONF_BSET_RST_RETRIES|
724 		SD_CONF_BSET_MIN_THROTTLE|
725 		SD_CONF_BSET_DISKSORT_DISABLED|
726 		SD_CONF_BSET_LUN_RESET_ENABLED,
727 		&pirus_properties },
728 	{ "SUN     PSX1000", SD_CONF_BSET_THROTTLE |
729 		SD_CONF_BSET_NRR_COUNT|
730 		SD_CONF_BSET_BSY_RETRY_COUNT|
731 		SD_CONF_BSET_RST_RETRIES|
732 		SD_CONF_BSET_MIN_THROTTLE|
733 		SD_CONF_BSET_DISKSORT_DISABLED|
734 		SD_CONF_BSET_LUN_RESET_ENABLED,
735 		&pirus_properties },
736 	{ "SUN     SE6330", SD_CONF_BSET_THROTTLE |
737 		SD_CONF_BSET_NRR_COUNT|
738 		SD_CONF_BSET_BSY_RETRY_COUNT|
739 		SD_CONF_BSET_RST_RETRIES|
740 		SD_CONF_BSET_MIN_THROTTLE|
741 		SD_CONF_BSET_DISKSORT_DISABLED|
742 		SD_CONF_BSET_LUN_RESET_ENABLED,
743 		&pirus_properties },
744 	{ "SUN     STK6580_6780", SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
745 	{ "SUN     SUN_6180", SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
746 	{ "STK     OPENstorage", SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
747 	{ "STK     OpenStorage", SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
748 	{ "STK     BladeCtlr",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
749 	{ "STK     FLEXLINE",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
750 	{ "SYMBIOS", SD_CONF_BSET_NRR_COUNT, &symbios_properties },
751 #endif /* fibre or NON-sparc platforms */
752 #if ((defined(__sparc) && !defined(__fibre)) ||\
753 	(defined(__i386) || defined(__amd64)))
754 	{ "SEAGATE ST42400N", SD_CONF_BSET_THROTTLE, &elite_properties },
755 	{ "SEAGATE ST31200N", SD_CONF_BSET_THROTTLE, &st31200n_properties },
756 	{ "SEAGATE ST41600N", SD_CONF_BSET_TUR_CHECK, NULL },
757 	{ "CONNER  CP30540",  SD_CONF_BSET_NOCACHE,  NULL },
758 	{ "*SUN0104*", SD_CONF_BSET_FAB_DEVID, NULL },
759 	{ "*SUN0207*", SD_CONF_BSET_FAB_DEVID, NULL },
760 	{ "*SUN0327*", SD_CONF_BSET_FAB_DEVID, NULL },
761 	{ "*SUN0340*", SD_CONF_BSET_FAB_DEVID, NULL },
762 	{ "*SUN0424*", SD_CONF_BSET_FAB_DEVID, NULL },
763 	{ "*SUN0669*", SD_CONF_BSET_FAB_DEVID, NULL },
764 	{ "*SUN1.0G*", SD_CONF_BSET_FAB_DEVID, NULL },
765 	{ "SYMBIOS INF-01-00       ", SD_CONF_BSET_FAB_DEVID, NULL },
766 	{ "SYMBIOS", SD_CONF_BSET_THROTTLE|SD_CONF_BSET_NRR_COUNT,
767 	    &symbios_properties },
768 	{ "LSI", SD_CONF_BSET_THROTTLE | SD_CONF_BSET_NRR_COUNT,
769 	    &lsi_properties_scsi },
770 #if defined(__i386) || defined(__amd64)
771 	{ " NEC CD-ROM DRIVE:260 ", (SD_CONF_BSET_PLAYMSF_BCD
772 				    | SD_CONF_BSET_READSUB_BCD
773 				    | SD_CONF_BSET_READ_TOC_ADDR_BCD
774 				    | SD_CONF_BSET_NO_READ_HEADER
775 				    | SD_CONF_BSET_READ_CD_XD4), NULL },
776 
777 	{ " NEC CD-ROM DRIVE:270 ", (SD_CONF_BSET_PLAYMSF_BCD
778 				    | SD_CONF_BSET_READSUB_BCD
779 				    | SD_CONF_BSET_READ_TOC_ADDR_BCD
780 				    | SD_CONF_BSET_NO_READ_HEADER
781 				    | SD_CONF_BSET_READ_CD_XD4), NULL },
782 #endif /* __i386 || __amd64 */
783 #endif /* sparc NON-fibre or NON-sparc platforms */
784 
785 #if (defined(SD_PROP_TST))
786 	{ "VENDOR  PRODUCT ", (SD_CONF_BSET_THROTTLE
787 				| SD_CONF_BSET_CTYPE
788 				| SD_CONF_BSET_NRR_COUNT
789 				| SD_CONF_BSET_FAB_DEVID
790 				| SD_CONF_BSET_NOCACHE
791 				| SD_CONF_BSET_BSY_RETRY_COUNT
792 				| SD_CONF_BSET_PLAYMSF_BCD
793 				| SD_CONF_BSET_READSUB_BCD
794 				| SD_CONF_BSET_READ_TOC_TRK_BCD
795 				| SD_CONF_BSET_READ_TOC_ADDR_BCD
796 				| SD_CONF_BSET_NO_READ_HEADER
797 				| SD_CONF_BSET_READ_CD_XD4
798 				| SD_CONF_BSET_RST_RETRIES
799 				| SD_CONF_BSET_RSV_REL_TIME
800 				| SD_CONF_BSET_TUR_CHECK), &tst_properties},
801 #endif
802 };
803 
804 static const int sd_disk_table_size =
805 	sizeof (sd_disk_table)/ sizeof (sd_disk_config_t);
806 
807 /*
808  * Emulation mode disk drive VID/PID table
809  */
810 static char sd_flash_dev_table[][25] = {
811 	"ATA     MARVELL SD88SA02",
812 	"MARVELL SD88SA02",
813 	"TOSHIBA THNSNV05",
814 };
815 
816 static const int sd_flash_dev_table_size =
817 	sizeof (sd_flash_dev_table) / sizeof (sd_flash_dev_table[0]);
818 
819 #define	SD_INTERCONNECT_PARALLEL	0
820 #define	SD_INTERCONNECT_FABRIC		1
821 #define	SD_INTERCONNECT_FIBRE		2
822 #define	SD_INTERCONNECT_SSA		3
823 #define	SD_INTERCONNECT_SATA		4
824 #define	SD_INTERCONNECT_SAS		5
825 
826 #define	SD_IS_PARALLEL_SCSI(un)		\
827 	((un)->un_interconnect_type == SD_INTERCONNECT_PARALLEL)
828 #define	SD_IS_SERIAL(un)		\
829 	(((un)->un_interconnect_type == SD_INTERCONNECT_SATA) ||\
830 	((un)->un_interconnect_type == SD_INTERCONNECT_SAS))
831 
832 /*
833  * Definitions used by device id registration routines
834  */
835 #define	VPD_HEAD_OFFSET		3	/* size of head for vpd page */
836 #define	VPD_PAGE_LENGTH		3	/* offset for pge length data */
837 #define	VPD_MODE_PAGE		1	/* offset into vpd pg for "page code" */
838 
839 static kmutex_t sd_sense_mutex = {0};
840 
841 /*
842  * Macros for updates of the driver state
843  */
844 #define	New_state(un, s)        \
845 	(un)->un_last_state = (un)->un_state, (un)->un_state = (s)
846 #define	Restore_state(un)	\
847 	{ uchar_t tmp = (un)->un_last_state; New_state((un), tmp); }
848 
849 static struct sd_cdbinfo sd_cdbtab[] = {
850 	{ CDB_GROUP0, 0x00,	   0x1FFFFF,   0xFF,	    },
851 	{ CDB_GROUP1, SCMD_GROUP1, 0xFFFFFFFF, 0xFFFF,	    },
852 	{ CDB_GROUP5, SCMD_GROUP5, 0xFFFFFFFF, 0xFFFFFFFF,  },
853 	{ CDB_GROUP4, SCMD_GROUP4, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFF, },
854 };
855 
856 /*
857  * Specifies the number of seconds that must have elapsed since the last
858  * cmd. has completed for a device to be declared idle to the PM framework.
859  */
860 static int sd_pm_idletime = 1;
861 
862 /*
863  * Internal function prototypes
864  */
865 
866 #if (defined(__fibre))
867 /*
868  * These #defines are to avoid namespace collisions that occur because this
869  * code is currently used to compile two separate driver modules: sd and ssd.
870  * All function names need to be treated this way (even if declared static)
871  * in order to allow the debugger to resolve the names properly.
872  * It is anticipated that in the near future the ssd module will be obsoleted,
873  * at which time this ugliness should go away.
874  */
875 #define	sd_log_trace			ssd_log_trace
876 #define	sd_log_info			ssd_log_info
877 #define	sd_log_err			ssd_log_err
878 #define	sdprobe				ssdprobe
879 #define	sdinfo				ssdinfo
880 #define	sd_prop_op			ssd_prop_op
881 #define	sd_scsi_probe_cache_init	ssd_scsi_probe_cache_init
882 #define	sd_scsi_probe_cache_fini	ssd_scsi_probe_cache_fini
883 #define	sd_scsi_clear_probe_cache	ssd_scsi_clear_probe_cache
884 #define	sd_scsi_probe_with_cache	ssd_scsi_probe_with_cache
885 #define	sd_scsi_target_lun_init		ssd_scsi_target_lun_init
886 #define	sd_scsi_target_lun_fini		ssd_scsi_target_lun_fini
887 #define	sd_scsi_get_target_lun_count	ssd_scsi_get_target_lun_count
888 #define	sd_scsi_update_lun_on_target	ssd_scsi_update_lun_on_target
889 #define	sd_spin_up_unit			ssd_spin_up_unit
890 #define	sd_enable_descr_sense		ssd_enable_descr_sense
891 #define	sd_reenable_dsense_task		ssd_reenable_dsense_task
892 #define	sd_set_mmc_caps			ssd_set_mmc_caps
893 #define	sd_read_unit_properties		ssd_read_unit_properties
894 #define	sd_process_sdconf_file		ssd_process_sdconf_file
895 #define	sd_process_sdconf_table		ssd_process_sdconf_table
896 #define	sd_sdconf_id_match		ssd_sdconf_id_match
897 #define	sd_blank_cmp			ssd_blank_cmp
898 #define	sd_chk_vers1_data		ssd_chk_vers1_data
899 #define	sd_set_vers1_properties		ssd_set_vers1_properties
900 #define	sd_check_bdc_vpd		ssd_check_bdc_vpd
901 #define	sd_check_emulation_mode		ssd_check_emulation_mode
902 
903 #define	sd_get_physical_geometry	ssd_get_physical_geometry
904 #define	sd_get_virtual_geometry		ssd_get_virtual_geometry
905 #define	sd_update_block_info		ssd_update_block_info
906 #define	sd_register_devid		ssd_register_devid
907 #define	sd_get_devid			ssd_get_devid
908 #define	sd_create_devid			ssd_create_devid
909 #define	sd_write_deviceid		ssd_write_deviceid
910 #define	sd_check_vpd_page_support	ssd_check_vpd_page_support
911 #define	sd_setup_pm			ssd_setup_pm
912 #define	sd_create_pm_components		ssd_create_pm_components
913 #define	sd_ddi_suspend			ssd_ddi_suspend
914 #define	sd_ddi_resume			ssd_ddi_resume
915 #define	sd_pm_state_change		ssd_pm_state_change
916 #define	sdpower				ssdpower
917 #define	sdattach			ssdattach
918 #define	sddetach			ssddetach
919 #define	sd_unit_attach			ssd_unit_attach
920 #define	sd_unit_detach			ssd_unit_detach
921 #define	sd_set_unit_attributes		ssd_set_unit_attributes
922 #define	sd_create_errstats		ssd_create_errstats
923 #define	sd_set_errstats			ssd_set_errstats
924 #define	sd_set_pstats			ssd_set_pstats
925 #define	sddump				ssddump
926 #define	sd_scsi_poll			ssd_scsi_poll
927 #define	sd_send_polled_RQS		ssd_send_polled_RQS
928 #define	sd_ddi_scsi_poll		ssd_ddi_scsi_poll
929 #define	sd_init_event_callbacks		ssd_init_event_callbacks
930 #define	sd_event_callback		ssd_event_callback
931 #define	sd_cache_control		ssd_cache_control
932 #define	sd_get_write_cache_enabled	ssd_get_write_cache_enabled
933 #define	sd_get_write_cache_changeable	ssd_get_write_cache_changeable
934 #define	sd_get_nv_sup			ssd_get_nv_sup
935 #define	sd_make_device			ssd_make_device
936 #define	sdopen				ssdopen
937 #define	sdclose				ssdclose
938 #define	sd_ready_and_valid		ssd_ready_and_valid
939 #define	sdmin				ssdmin
940 #define	sdread				ssdread
941 #define	sdwrite				ssdwrite
942 #define	sdaread				ssdaread
943 #define	sdawrite			ssdawrite
944 #define	sdstrategy			ssdstrategy
945 #define	sdioctl				ssdioctl
946 #define	sd_mapblockaddr_iostart		ssd_mapblockaddr_iostart
947 #define	sd_mapblocksize_iostart		ssd_mapblocksize_iostart
948 #define	sd_checksum_iostart		ssd_checksum_iostart
949 #define	sd_checksum_uscsi_iostart	ssd_checksum_uscsi_iostart
950 #define	sd_pm_iostart			ssd_pm_iostart
951 #define	sd_core_iostart			ssd_core_iostart
952 #define	sd_mapblockaddr_iodone		ssd_mapblockaddr_iodone
953 #define	sd_mapblocksize_iodone		ssd_mapblocksize_iodone
954 #define	sd_checksum_iodone		ssd_checksum_iodone
955 #define	sd_checksum_uscsi_iodone	ssd_checksum_uscsi_iodone
956 #define	sd_pm_iodone			ssd_pm_iodone
957 #define	sd_initpkt_for_buf		ssd_initpkt_for_buf
958 #define	sd_destroypkt_for_buf		ssd_destroypkt_for_buf
959 #define	sd_setup_rw_pkt			ssd_setup_rw_pkt
960 #define	sd_setup_next_rw_pkt		ssd_setup_next_rw_pkt
961 #define	sd_buf_iodone			ssd_buf_iodone
962 #define	sd_uscsi_strategy		ssd_uscsi_strategy
963 #define	sd_initpkt_for_uscsi		ssd_initpkt_for_uscsi
964 #define	sd_destroypkt_for_uscsi		ssd_destroypkt_for_uscsi
965 #define	sd_uscsi_iodone			ssd_uscsi_iodone
966 #define	sd_xbuf_strategy		ssd_xbuf_strategy
967 #define	sd_xbuf_init			ssd_xbuf_init
968 #define	sd_pm_entry			ssd_pm_entry
969 #define	sd_pm_exit			ssd_pm_exit
970 
971 #define	sd_pm_idletimeout_handler	ssd_pm_idletimeout_handler
972 #define	sd_pm_timeout_handler		ssd_pm_timeout_handler
973 
974 #define	sd_add_buf_to_waitq		ssd_add_buf_to_waitq
975 #define	sdintr				ssdintr
976 #define	sd_start_cmds			ssd_start_cmds
977 #define	sd_send_scsi_cmd		ssd_send_scsi_cmd
978 #define	sd_bioclone_alloc		ssd_bioclone_alloc
979 #define	sd_bioclone_free		ssd_bioclone_free
980 #define	sd_shadow_buf_alloc		ssd_shadow_buf_alloc
981 #define	sd_shadow_buf_free		ssd_shadow_buf_free
982 #define	sd_print_transport_rejected_message	\
983 					ssd_print_transport_rejected_message
984 #define	sd_retry_command		ssd_retry_command
985 #define	sd_set_retry_bp			ssd_set_retry_bp
986 #define	sd_send_request_sense_command	ssd_send_request_sense_command
987 #define	sd_start_retry_command		ssd_start_retry_command
988 #define	sd_start_direct_priority_command	\
989 					ssd_start_direct_priority_command
990 #define	sd_return_failed_command	ssd_return_failed_command
991 #define	sd_return_failed_command_no_restart	\
992 					ssd_return_failed_command_no_restart
993 #define	sd_return_command		ssd_return_command
994 #define	sd_sync_with_callback		ssd_sync_with_callback
995 #define	sdrunout			ssdrunout
996 #define	sd_mark_rqs_busy		ssd_mark_rqs_busy
997 #define	sd_mark_rqs_idle		ssd_mark_rqs_idle
998 #define	sd_reduce_throttle		ssd_reduce_throttle
999 #define	sd_restore_throttle		ssd_restore_throttle
1000 #define	sd_print_incomplete_msg		ssd_print_incomplete_msg
1001 #define	sd_init_cdb_limits		ssd_init_cdb_limits
1002 #define	sd_pkt_status_good		ssd_pkt_status_good
1003 #define	sd_pkt_status_check_condition	ssd_pkt_status_check_condition
1004 #define	sd_pkt_status_busy		ssd_pkt_status_busy
1005 #define	sd_pkt_status_reservation_conflict	\
1006 					ssd_pkt_status_reservation_conflict
1007 #define	sd_pkt_status_qfull		ssd_pkt_status_qfull
1008 #define	sd_handle_request_sense		ssd_handle_request_sense
1009 #define	sd_handle_auto_request_sense	ssd_handle_auto_request_sense
1010 #define	sd_print_sense_failed_msg	ssd_print_sense_failed_msg
1011 #define	sd_validate_sense_data		ssd_validate_sense_data
1012 #define	sd_decode_sense			ssd_decode_sense
1013 #define	sd_print_sense_msg		ssd_print_sense_msg
1014 #define	sd_sense_key_no_sense		ssd_sense_key_no_sense
1015 #define	sd_sense_key_recoverable_error	ssd_sense_key_recoverable_error
1016 #define	sd_sense_key_not_ready		ssd_sense_key_not_ready
1017 #define	sd_sense_key_medium_or_hardware_error	\
1018 					ssd_sense_key_medium_or_hardware_error
1019 #define	sd_sense_key_illegal_request	ssd_sense_key_illegal_request
1020 #define	sd_sense_key_unit_attention	ssd_sense_key_unit_attention
1021 #define	sd_sense_key_fail_command	ssd_sense_key_fail_command
1022 #define	sd_sense_key_blank_check	ssd_sense_key_blank_check
1023 #define	sd_sense_key_aborted_command	ssd_sense_key_aborted_command
1024 #define	sd_sense_key_default		ssd_sense_key_default
1025 #define	sd_print_retry_msg		ssd_print_retry_msg
1026 #define	sd_print_cmd_incomplete_msg	ssd_print_cmd_incomplete_msg
1027 #define	sd_pkt_reason_cmd_incomplete	ssd_pkt_reason_cmd_incomplete
1028 #define	sd_pkt_reason_cmd_tran_err	ssd_pkt_reason_cmd_tran_err
1029 #define	sd_pkt_reason_cmd_reset		ssd_pkt_reason_cmd_reset
1030 #define	sd_pkt_reason_cmd_aborted	ssd_pkt_reason_cmd_aborted
1031 #define	sd_pkt_reason_cmd_timeout	ssd_pkt_reason_cmd_timeout
1032 #define	sd_pkt_reason_cmd_unx_bus_free	ssd_pkt_reason_cmd_unx_bus_free
1033 #define	sd_pkt_reason_cmd_tag_reject	ssd_pkt_reason_cmd_tag_reject
1034 #define	sd_pkt_reason_default		ssd_pkt_reason_default
1035 #define	sd_reset_target			ssd_reset_target
1036 #define	sd_start_stop_unit_callback	ssd_start_stop_unit_callback
1037 #define	sd_start_stop_unit_task		ssd_start_stop_unit_task
1038 #define	sd_taskq_create			ssd_taskq_create
1039 #define	sd_taskq_delete			ssd_taskq_delete
1040 #define	sd_target_change_task		ssd_target_change_task
1041 #define	sd_log_dev_status_event		ssd_log_dev_status_event
1042 #define	sd_log_lun_expansion_event	ssd_log_lun_expansion_event
1043 #define	sd_log_eject_request_event	ssd_log_eject_request_event
1044 #define	sd_media_change_task		ssd_media_change_task
1045 #define	sd_handle_mchange		ssd_handle_mchange
1046 #define	sd_send_scsi_DOORLOCK		ssd_send_scsi_DOORLOCK
1047 #define	sd_send_scsi_READ_CAPACITY	ssd_send_scsi_READ_CAPACITY
1048 #define	sd_send_scsi_READ_CAPACITY_16	ssd_send_scsi_READ_CAPACITY_16
1049 #define	sd_send_scsi_GET_CONFIGURATION	ssd_send_scsi_GET_CONFIGURATION
1050 #define	sd_send_scsi_feature_GET_CONFIGURATION	\
1051 					sd_send_scsi_feature_GET_CONFIGURATION
1052 #define	sd_send_scsi_START_STOP_UNIT	ssd_send_scsi_START_STOP_UNIT
1053 #define	sd_send_scsi_INQUIRY		ssd_send_scsi_INQUIRY
1054 #define	sd_send_scsi_TEST_UNIT_READY	ssd_send_scsi_TEST_UNIT_READY
1055 #define	sd_send_scsi_PERSISTENT_RESERVE_IN	\
1056 					ssd_send_scsi_PERSISTENT_RESERVE_IN
1057 #define	sd_send_scsi_PERSISTENT_RESERVE_OUT	\
1058 					ssd_send_scsi_PERSISTENT_RESERVE_OUT
1059 #define	sd_send_scsi_SYNCHRONIZE_CACHE	ssd_send_scsi_SYNCHRONIZE_CACHE
1060 #define	sd_send_scsi_SYNCHRONIZE_CACHE_biodone	\
1061 					ssd_send_scsi_SYNCHRONIZE_CACHE_biodone
1062 #define	sd_send_scsi_MODE_SENSE		ssd_send_scsi_MODE_SENSE
1063 #define	sd_send_scsi_MODE_SELECT	ssd_send_scsi_MODE_SELECT
1064 #define	sd_send_scsi_RDWR		ssd_send_scsi_RDWR
1065 #define	sd_send_scsi_LOG_SENSE		ssd_send_scsi_LOG_SENSE
1066 #define	sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION	\
1067 				ssd_send_scsi_GET_EVENT_STATUS_NOTIFICATION
1068 #define	sd_gesn_media_data_valid	ssd_gesn_media_data_valid
1069 #define	sd_alloc_rqs			ssd_alloc_rqs
1070 #define	sd_free_rqs			ssd_free_rqs
1071 #define	sd_dump_memory			ssd_dump_memory
1072 #define	sd_get_media_info_com		ssd_get_media_info_com
1073 #define	sd_get_media_info		ssd_get_media_info
1074 #define	sd_get_media_info_ext		ssd_get_media_info_ext
1075 #define	sd_dkio_ctrl_info		ssd_dkio_ctrl_info
1076 #define	sd_nvpair_str_decode		ssd_nvpair_str_decode
1077 #define	sd_strtok_r			ssd_strtok_r
1078 #define	sd_set_properties		ssd_set_properties
1079 #define	sd_get_tunables_from_conf	ssd_get_tunables_from_conf
1080 #define	sd_setup_next_xfer		ssd_setup_next_xfer
1081 #define	sd_dkio_get_temp		ssd_dkio_get_temp
1082 #define	sd_check_mhd			ssd_check_mhd
1083 #define	sd_mhd_watch_cb			ssd_mhd_watch_cb
1084 #define	sd_mhd_watch_incomplete		ssd_mhd_watch_incomplete
1085 #define	sd_sname			ssd_sname
1086 #define	sd_mhd_resvd_recover		ssd_mhd_resvd_recover
1087 #define	sd_resv_reclaim_thread		ssd_resv_reclaim_thread
1088 #define	sd_take_ownership		ssd_take_ownership
1089 #define	sd_reserve_release		ssd_reserve_release
1090 #define	sd_rmv_resv_reclaim_req		ssd_rmv_resv_reclaim_req
1091 #define	sd_mhd_reset_notify_cb		ssd_mhd_reset_notify_cb
1092 #define	sd_persistent_reservation_in_read_keys	\
1093 					ssd_persistent_reservation_in_read_keys
1094 #define	sd_persistent_reservation_in_read_resv	\
1095 					ssd_persistent_reservation_in_read_resv
1096 #define	sd_mhdioc_takeown		ssd_mhdioc_takeown
1097 #define	sd_mhdioc_failfast		ssd_mhdioc_failfast
1098 #define	sd_mhdioc_release		ssd_mhdioc_release
1099 #define	sd_mhdioc_register_devid	ssd_mhdioc_register_devid
1100 #define	sd_mhdioc_inkeys		ssd_mhdioc_inkeys
1101 #define	sd_mhdioc_inresv		ssd_mhdioc_inresv
1102 #define	sr_change_blkmode		ssr_change_blkmode
1103 #define	sr_change_speed			ssr_change_speed
1104 #define	sr_atapi_change_speed		ssr_atapi_change_speed
1105 #define	sr_pause_resume			ssr_pause_resume
1106 #define	sr_play_msf			ssr_play_msf
1107 #define	sr_play_trkind			ssr_play_trkind
1108 #define	sr_read_all_subcodes		ssr_read_all_subcodes
1109 #define	sr_read_subchannel		ssr_read_subchannel
1110 #define	sr_read_tocentry		ssr_read_tocentry
1111 #define	sr_read_tochdr			ssr_read_tochdr
1112 #define	sr_read_cdda			ssr_read_cdda
1113 #define	sr_read_cdxa			ssr_read_cdxa
1114 #define	sr_read_mode1			ssr_read_mode1
1115 #define	sr_read_mode2			ssr_read_mode2
1116 #define	sr_read_cd_mode2		ssr_read_cd_mode2
1117 #define	sr_sector_mode			ssr_sector_mode
1118 #define	sr_eject			ssr_eject
1119 #define	sr_ejected			ssr_ejected
1120 #define	sr_check_wp			ssr_check_wp
1121 #define	sd_watch_request_submit		ssd_watch_request_submit
1122 #define	sd_check_media			ssd_check_media
1123 #define	sd_media_watch_cb		ssd_media_watch_cb
1124 #define	sd_delayed_cv_broadcast		ssd_delayed_cv_broadcast
1125 #define	sr_volume_ctrl			ssr_volume_ctrl
1126 #define	sr_read_sony_session_offset	ssr_read_sony_session_offset
1127 #define	sd_log_page_supported		ssd_log_page_supported
1128 #define	sd_check_for_writable_cd	ssd_check_for_writable_cd
1129 #define	sd_wm_cache_constructor		ssd_wm_cache_constructor
1130 #define	sd_wm_cache_destructor		ssd_wm_cache_destructor
1131 #define	sd_range_lock			ssd_range_lock
1132 #define	sd_get_range			ssd_get_range
1133 #define	sd_free_inlist_wmap		ssd_free_inlist_wmap
1134 #define	sd_range_unlock			ssd_range_unlock
1135 #define	sd_read_modify_write_task	ssd_read_modify_write_task
1136 #define	sddump_do_read_of_rmw		ssddump_do_read_of_rmw
1137 
1138 #define	sd_iostart_chain		ssd_iostart_chain
1139 #define	sd_iodone_chain			ssd_iodone_chain
1140 #define	sd_initpkt_map			ssd_initpkt_map
1141 #define	sd_destroypkt_map		ssd_destroypkt_map
1142 #define	sd_chain_type_map		ssd_chain_type_map
1143 #define	sd_chain_index_map		ssd_chain_index_map
1144 
1145 #define	sd_failfast_flushctl		ssd_failfast_flushctl
1146 #define	sd_failfast_flushq		ssd_failfast_flushq
1147 #define	sd_failfast_flushq_callback	ssd_failfast_flushq_callback
1148 
1149 #define	sd_is_lsi			ssd_is_lsi
1150 #define	sd_tg_rdwr			ssd_tg_rdwr
1151 #define	sd_tg_getinfo			ssd_tg_getinfo
1152 #define	sd_rmw_msg_print_handler	ssd_rmw_msg_print_handler
1153 
1154 #endif	/* #if (defined(__fibre)) */
1155 
1156 typedef struct unmap_param_hdr_s {
1157 	uint16_t	uph_data_len;
1158 	uint16_t	uph_descr_data_len;
1159 	uint32_t	uph_reserved;
1160 } unmap_param_hdr_t;
1161 
1162 typedef struct unmap_blk_descr_s {
1163 	uint64_t	ubd_lba;
1164 	uint32_t	ubd_lba_cnt;
1165 	uint32_t	ubd_reserved;
1166 } unmap_blk_descr_t;
1167 
1168 /* Max number of block descriptors in UNMAP command */
1169 #define	SD_UNMAP_MAX_DESCR \
1170 	((UINT16_MAX - sizeof (unmap_param_hdr_t)) / sizeof (unmap_blk_descr_t))
1171 /* Max size of the UNMAP parameter list in bytes */
1172 #define	SD_UNMAP_PARAM_LIST_MAXSZ	(sizeof (unmap_param_hdr_t) + \
1173 	SD_UNMAP_MAX_DESCR * sizeof (unmap_blk_descr_t))
1174 
1175 int _init(void);
1176 int _fini(void);
1177 int _info(struct modinfo *modinfop);
1178 
1179 /*PRINTFLIKE3*/
1180 static void sd_log_trace(uint_t comp, struct sd_lun *un, const char *fmt, ...);
1181 /*PRINTFLIKE3*/
1182 static void sd_log_info(uint_t comp, struct sd_lun *un, const char *fmt, ...);
1183 /*PRINTFLIKE3*/
1184 static void sd_log_err(uint_t comp, struct sd_lun *un, const char *fmt, ...);
1185 
1186 static int sdprobe(dev_info_t *devi);
1187 static int sdinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg,
1188     void **result);
1189 static int sd_prop_op(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op,
1190     int mod_flags, char *name, caddr_t valuep, int *lengthp);
1191 
1192 /*
1193  * Smart probe for parallel scsi
1194  */
1195 static void sd_scsi_probe_cache_init(void);
1196 static void sd_scsi_probe_cache_fini(void);
1197 static void sd_scsi_clear_probe_cache(void);
1198 static int  sd_scsi_probe_with_cache(struct scsi_device *devp, int (*fn)());
1199 
1200 /*
1201  * Attached luns on target for parallel scsi
1202  */
1203 static void sd_scsi_target_lun_init(void);
1204 static void sd_scsi_target_lun_fini(void);
1205 static int  sd_scsi_get_target_lun_count(dev_info_t *dip, int target);
1206 static void sd_scsi_update_lun_on_target(dev_info_t *dip, int target, int flag);
1207 
1208 static int	sd_spin_up_unit(sd_ssc_t *ssc);
1209 
1210 /*
1211  * Using sd_ssc_init to establish sd_ssc_t struct
1212  * Using sd_ssc_send to send uscsi internal command
1213  * Using sd_ssc_fini to free sd_ssc_t struct
1214  */
1215 static sd_ssc_t *sd_ssc_init(struct sd_lun *un);
1216 static int sd_ssc_send(sd_ssc_t *ssc, struct uscsi_cmd *incmd,
1217     int flag, enum uio_seg dataspace, int path_flag);
1218 static void sd_ssc_fini(sd_ssc_t *ssc);
1219 
1220 /*
1221  * Using sd_ssc_assessment to set correct type-of-assessment
1222  * Using sd_ssc_post to post ereport & system log
1223  *       sd_ssc_post will call sd_ssc_print to print system log
1224  *       sd_ssc_post will call sd_ssd_ereport_post to post ereport
1225  */
1226 static void sd_ssc_assessment(sd_ssc_t *ssc,
1227     enum sd_type_assessment tp_assess);
1228 
1229 static void sd_ssc_post(sd_ssc_t *ssc, enum sd_driver_assessment sd_assess);
1230 static void sd_ssc_print(sd_ssc_t *ssc, int sd_severity);
1231 static void sd_ssc_ereport_post(sd_ssc_t *ssc,
1232     enum sd_driver_assessment drv_assess);
1233 
1234 /*
1235  * Using sd_ssc_set_info to mark an un-decodable-data error.
1236  * Using sd_ssc_extract_info to transfer information from internal
1237  *       data structures to sd_ssc_t.
1238  */
1239 static void sd_ssc_set_info(sd_ssc_t *ssc, int ssc_flags, uint_t comp,
1240     const char *fmt, ...);
1241 static void sd_ssc_extract_info(sd_ssc_t *ssc, struct sd_lun *un,
1242     struct scsi_pkt *pktp, struct buf *bp, struct sd_xbuf *xp);
1243 
1244 static int sd_send_scsi_cmd(dev_t dev, struct uscsi_cmd *incmd, int flag,
1245     enum uio_seg dataspace, int path_flag);
1246 
1247 #ifdef _LP64
1248 static void	sd_enable_descr_sense(sd_ssc_t *ssc);
1249 static void	sd_reenable_dsense_task(void *arg);
1250 #endif /* _LP64 */
1251 
1252 static void	sd_set_mmc_caps(sd_ssc_t *ssc);
1253 
1254 static void sd_read_unit_properties(struct sd_lun *un);
1255 static int  sd_process_sdconf_file(struct sd_lun *un);
1256 static void sd_nvpair_str_decode(struct sd_lun *un, char *nvpair_str);
1257 static char *sd_strtok_r(char *string, const char *sepset, char **lasts);
1258 static void sd_set_properties(struct sd_lun *un, char *name, char *value);
1259 static void sd_get_tunables_from_conf(struct sd_lun *un, int flags,
1260     int *data_list, sd_tunables *values);
1261 static void sd_process_sdconf_table(struct sd_lun *un);
1262 static int  sd_sdconf_id_match(struct sd_lun *un, char *id, int idlen);
1263 static int  sd_blank_cmp(struct sd_lun *un, char *id, int idlen);
1264 static int  sd_chk_vers1_data(struct sd_lun *un, int flags, int *prop_list,
1265 	int list_len, char *dataname_ptr);
1266 static void sd_set_vers1_properties(struct sd_lun *un, int flags,
1267     sd_tunables *prop_list);
1268 
1269 static void sd_register_devid(sd_ssc_t *ssc, dev_info_t *devi,
1270     int reservation_flag);
1271 static int  sd_get_devid(sd_ssc_t *ssc);
1272 static ddi_devid_t sd_create_devid(sd_ssc_t *ssc);
1273 static int  sd_write_deviceid(sd_ssc_t *ssc);
1274 static int  sd_check_vpd_page_support(sd_ssc_t *ssc);
1275 
1276 static void sd_setup_pm(sd_ssc_t *ssc, dev_info_t *devi);
1277 static void sd_create_pm_components(dev_info_t *devi, struct sd_lun *un);
1278 
1279 static int  sd_ddi_suspend(dev_info_t *devi);
1280 static int  sd_ddi_resume(dev_info_t *devi);
1281 static int  sd_pm_state_change(struct sd_lun *un, int level, int flag);
1282 static int  sdpower(dev_info_t *devi, int component, int level);
1283 
1284 static int  sdattach(dev_info_t *devi, ddi_attach_cmd_t cmd);
1285 static int  sddetach(dev_info_t *devi, ddi_detach_cmd_t cmd);
1286 static int  sd_unit_attach(dev_info_t *devi);
1287 static int  sd_unit_detach(dev_info_t *devi);
1288 
1289 static void sd_set_unit_attributes(struct sd_lun *un, dev_info_t *devi);
1290 static void sd_create_errstats(struct sd_lun *un, int instance);
1291 static void sd_set_errstats(struct sd_lun *un);
1292 static void sd_set_pstats(struct sd_lun *un);
1293 
1294 static int  sddump(dev_t dev, caddr_t addr, daddr_t blkno, int nblk);
1295 static int  sd_scsi_poll(struct sd_lun *un, struct scsi_pkt *pkt);
1296 static int  sd_send_polled_RQS(struct sd_lun *un);
1297 static int  sd_ddi_scsi_poll(struct scsi_pkt *pkt);
1298 
1299 #if (defined(__fibre))
1300 /*
1301  * Event callbacks (photon)
1302  */
1303 static void sd_init_event_callbacks(struct sd_lun *un);
1304 static void  sd_event_callback(dev_info_t *, ddi_eventcookie_t, void *, void *);
1305 #endif
1306 
1307 /*
1308  * Defines for sd_cache_control
1309  */
1310 
1311 #define	SD_CACHE_ENABLE		1
1312 #define	SD_CACHE_DISABLE	0
1313 #define	SD_CACHE_NOCHANGE	-1
1314 
1315 static int   sd_cache_control(sd_ssc_t *ssc, int rcd_flag, int wce_flag);
1316 static int   sd_get_write_cache_enabled(sd_ssc_t *ssc, int *is_enabled);
1317 static void  sd_get_write_cache_changeable(sd_ssc_t *ssc, int *is_changeable);
1318 static void  sd_get_nv_sup(sd_ssc_t *ssc);
1319 static dev_t sd_make_device(dev_info_t *devi);
1320 static void  sd_check_bdc_vpd(sd_ssc_t *ssc);
1321 static void  sd_check_emulation_mode(sd_ssc_t *ssc);
1322 static void  sd_update_block_info(struct sd_lun *un, uint32_t lbasize,
1323 	uint64_t capacity);
1324 
1325 /*
1326  * Driver entry point functions.
1327  */
1328 static int  sdopen(dev_t *dev_p, int flag, int otyp, cred_t *cred_p);
1329 static int  sdclose(dev_t dev, int flag, int otyp, cred_t *cred_p);
1330 static int  sd_ready_and_valid(sd_ssc_t *ssc, int part);
1331 
1332 static void sdmin(struct buf *bp);
1333 static int sdread(dev_t dev, struct uio *uio, cred_t *cred_p);
1334 static int sdwrite(dev_t dev, struct uio *uio, cred_t *cred_p);
1335 static int sdaread(dev_t dev, struct aio_req *aio, cred_t *cred_p);
1336 static int sdawrite(dev_t dev, struct aio_req *aio, cred_t *cred_p);
1337 
1338 static int sdstrategy(struct buf *bp);
1339 static int sdioctl(dev_t, int, intptr_t, int, cred_t *, int *);
1340 
1341 /*
1342  * Function prototypes for layering functions in the iostart chain.
1343  */
1344 static void sd_mapblockaddr_iostart(int index, struct sd_lun *un,
1345 	struct buf *bp);
1346 static void sd_mapblocksize_iostart(int index, struct sd_lun *un,
1347 	struct buf *bp);
1348 static void sd_checksum_iostart(int index, struct sd_lun *un, struct buf *bp);
1349 static void sd_checksum_uscsi_iostart(int index, struct sd_lun *un,
1350 	struct buf *bp);
1351 static void sd_pm_iostart(int index, struct sd_lun *un, struct buf *bp);
1352 static void sd_core_iostart(int index, struct sd_lun *un, struct buf *bp);
1353 
1354 /*
1355  * Function prototypes for layering functions in the iodone chain.
1356  */
1357 static void sd_buf_iodone(int index, struct sd_lun *un, struct buf *bp);
1358 static void sd_uscsi_iodone(int index, struct sd_lun *un, struct buf *bp);
1359 static void sd_mapblockaddr_iodone(int index, struct sd_lun *un,
1360 	struct buf *bp);
1361 static void sd_mapblocksize_iodone(int index, struct sd_lun *un,
1362 	struct buf *bp);
1363 static void sd_checksum_iodone(int index, struct sd_lun *un, struct buf *bp);
1364 static void sd_checksum_uscsi_iodone(int index, struct sd_lun *un,
1365 	struct buf *bp);
1366 static void sd_pm_iodone(int index, struct sd_lun *un, struct buf *bp);
1367 
1368 /*
1369  * Prototypes for functions to support buf(9S) based IO.
1370  */
1371 static void sd_xbuf_strategy(struct buf *bp, ddi_xbuf_t xp, void *arg);
1372 static int sd_initpkt_for_buf(struct buf *, struct scsi_pkt **);
1373 static void sd_destroypkt_for_buf(struct buf *);
1374 static int sd_setup_rw_pkt(struct sd_lun *un, struct scsi_pkt **pktpp,
1375 	struct buf *bp, int flags,
1376 	int (*callback)(caddr_t), caddr_t callback_arg,
1377 	diskaddr_t lba, uint32_t blockcount);
1378 static int sd_setup_next_rw_pkt(struct sd_lun *un, struct scsi_pkt *pktp,
1379 	struct buf *bp, diskaddr_t lba, uint32_t blockcount);
1380 
1381 /*
1382  * Prototypes for functions to support USCSI IO.
1383  */
1384 static int sd_uscsi_strategy(struct buf *bp);
1385 static int sd_initpkt_for_uscsi(struct buf *, struct scsi_pkt **);
1386 static void sd_destroypkt_for_uscsi(struct buf *);
1387 
1388 static void sd_xbuf_init(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
1389 	uchar_t chain_type, void *pktinfop);
1390 
1391 static int  sd_pm_entry(struct sd_lun *un);
1392 static void sd_pm_exit(struct sd_lun *un);
1393 
1394 static void sd_pm_idletimeout_handler(void *arg);
1395 
1396 /*
1397  * sd_core internal functions (used at the sd_core_io layer).
1398  */
1399 static void sd_add_buf_to_waitq(struct sd_lun *un, struct buf *bp);
1400 static void sdintr(struct scsi_pkt *pktp);
1401 static void sd_start_cmds(struct sd_lun *un, struct buf *immed_bp);
1402 
1403 static int sd_send_scsi_cmd(dev_t dev, struct uscsi_cmd *incmd, int flag,
1404 	enum uio_seg dataspace, int path_flag);
1405 
1406 static struct buf *sd_bioclone_alloc(struct buf *bp, size_t datalen,
1407 	daddr_t blkno, int (*func)(struct buf *));
1408 static struct buf *sd_shadow_buf_alloc(struct buf *bp, size_t datalen,
1409 	uint_t bflags, daddr_t blkno, int (*func)(struct buf *));
1410 static void sd_bioclone_free(struct buf *bp);
1411 static void sd_shadow_buf_free(struct buf *bp);
1412 
1413 static void sd_print_transport_rejected_message(struct sd_lun *un,
1414 	struct sd_xbuf *xp, int code);
1415 static void sd_print_incomplete_msg(struct sd_lun *un, struct buf *bp,
1416     void *arg, int code);
1417 static void sd_print_sense_failed_msg(struct sd_lun *un, struct buf *bp,
1418     void *arg, int code);
1419 static void sd_print_cmd_incomplete_msg(struct sd_lun *un, struct buf *bp,
1420     void *arg, int code);
1421 
1422 static void sd_retry_command(struct sd_lun *un, struct buf *bp,
1423 	int retry_check_flag,
1424 	void (*user_funcp)(struct sd_lun *un, struct buf *bp, void *argp,
1425 		int c),
1426 	void *user_arg, int failure_code,  clock_t retry_delay,
1427 	void (*statp)(kstat_io_t *));
1428 
1429 static void sd_set_retry_bp(struct sd_lun *un, struct buf *bp,
1430 	clock_t retry_delay, void (*statp)(kstat_io_t *));
1431 
1432 static void sd_send_request_sense_command(struct sd_lun *un, struct buf *bp,
1433 	struct scsi_pkt *pktp);
1434 static void sd_start_retry_command(void *arg);
1435 static void sd_start_direct_priority_command(void *arg);
1436 static void sd_return_failed_command(struct sd_lun *un, struct buf *bp,
1437 	int errcode);
1438 static void sd_return_failed_command_no_restart(struct sd_lun *un,
1439 	struct buf *bp, int errcode);
1440 static void sd_return_command(struct sd_lun *un, struct buf *bp);
1441 static void sd_sync_with_callback(struct sd_lun *un);
1442 static int sdrunout(caddr_t arg);
1443 
1444 static void sd_mark_rqs_busy(struct sd_lun *un, struct buf *bp);
1445 static struct buf *sd_mark_rqs_idle(struct sd_lun *un, struct sd_xbuf *xp);
1446 
1447 static void sd_reduce_throttle(struct sd_lun *un, int throttle_type);
1448 static void sd_restore_throttle(void *arg);
1449 
1450 static void sd_init_cdb_limits(struct sd_lun *un);
1451 
1452 static void sd_pkt_status_good(struct sd_lun *un, struct buf *bp,
1453 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1454 
1455 /*
1456  * Error handling functions
1457  */
1458 static void sd_pkt_status_check_condition(struct sd_lun *un, struct buf *bp,
1459 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1460 static void sd_pkt_status_busy(struct sd_lun *un, struct buf *bp,
1461 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1462 static void sd_pkt_status_reservation_conflict(struct sd_lun *un,
1463 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1464 static void sd_pkt_status_qfull(struct sd_lun *un, struct buf *bp,
1465 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1466 
1467 static void sd_handle_request_sense(struct sd_lun *un, struct buf *bp,
1468 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1469 static void sd_handle_auto_request_sense(struct sd_lun *un, struct buf *bp,
1470 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1471 static int sd_validate_sense_data(struct sd_lun *un, struct buf *bp,
1472 	struct sd_xbuf *xp, size_t actual_len);
1473 static void sd_decode_sense(struct sd_lun *un, struct buf *bp,
1474 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1475 
1476 static void sd_print_sense_msg(struct sd_lun *un, struct buf *bp,
1477 	void *arg, int code);
1478 
1479 static void sd_sense_key_no_sense(struct sd_lun *un, struct buf *bp,
1480 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1481 static void sd_sense_key_recoverable_error(struct sd_lun *un,
1482 	uint8_t *sense_datap,
1483 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1484 static void sd_sense_key_not_ready(struct sd_lun *un,
1485 	uint8_t *sense_datap,
1486 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1487 static void sd_sense_key_medium_or_hardware_error(struct sd_lun *un,
1488 	uint8_t *sense_datap,
1489 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1490 static void sd_sense_key_illegal_request(struct sd_lun *un, struct buf *bp,
1491 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1492 static void sd_sense_key_unit_attention(struct sd_lun *un,
1493 	uint8_t *sense_datap,
1494 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1495 static void sd_sense_key_fail_command(struct sd_lun *un, struct buf *bp,
1496 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1497 static void sd_sense_key_blank_check(struct sd_lun *un, struct buf *bp,
1498 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1499 static void sd_sense_key_aborted_command(struct sd_lun *un, struct buf *bp,
1500 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1501 static void sd_sense_key_default(struct sd_lun *un,
1502 	uint8_t *sense_datap,
1503 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1504 
1505 static void sd_print_retry_msg(struct sd_lun *un, struct buf *bp,
1506 	void *arg, int flag);
1507 
1508 static void sd_pkt_reason_cmd_incomplete(struct sd_lun *un, struct buf *bp,
1509 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1510 static void sd_pkt_reason_cmd_tran_err(struct sd_lun *un, struct buf *bp,
1511 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1512 static void sd_pkt_reason_cmd_reset(struct sd_lun *un, struct buf *bp,
1513 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1514 static void sd_pkt_reason_cmd_aborted(struct sd_lun *un, struct buf *bp,
1515 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1516 static void sd_pkt_reason_cmd_timeout(struct sd_lun *un, struct buf *bp,
1517 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1518 static void sd_pkt_reason_cmd_unx_bus_free(struct sd_lun *un, struct buf *bp,
1519 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1520 static void sd_pkt_reason_cmd_tag_reject(struct sd_lun *un, struct buf *bp,
1521 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1522 static void sd_pkt_reason_default(struct sd_lun *un, struct buf *bp,
1523 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1524 
1525 static void sd_reset_target(struct sd_lun *un, struct scsi_pkt *pktp);
1526 
1527 static void sd_start_stop_unit_callback(void *arg);
1528 static void sd_start_stop_unit_task(void *arg);
1529 
1530 static void sd_taskq_create(void);
1531 static void sd_taskq_delete(void);
1532 static void sd_target_change_task(void *arg);
1533 static void sd_log_dev_status_event(struct sd_lun *un, char *esc, int km_flag);
1534 static void sd_log_lun_expansion_event(struct sd_lun *un, int km_flag);
1535 static void sd_log_eject_request_event(struct sd_lun *un, int km_flag);
1536 static void sd_media_change_task(void *arg);
1537 
1538 static int sd_handle_mchange(struct sd_lun *un);
1539 static int sd_send_scsi_DOORLOCK(sd_ssc_t *ssc, int flag, int path_flag);
1540 static int sd_send_scsi_READ_CAPACITY(sd_ssc_t *ssc, uint64_t *capp,
1541 	uint32_t *lbap, int path_flag);
1542 static int sd_send_scsi_READ_CAPACITY_16(sd_ssc_t *ssc, uint64_t *capp,
1543 	uint32_t *lbap, uint32_t *psp, int path_flag);
1544 static int sd_send_scsi_START_STOP_UNIT(sd_ssc_t *ssc, int pc_flag,
1545 	int flag, int path_flag);
1546 static int sd_send_scsi_INQUIRY(sd_ssc_t *ssc, uchar_t *bufaddr,
1547 	size_t buflen, uchar_t evpd, uchar_t page_code, size_t *residp);
1548 static int sd_send_scsi_TEST_UNIT_READY(sd_ssc_t *ssc, int flag);
1549 static int sd_send_scsi_PERSISTENT_RESERVE_IN(sd_ssc_t *ssc,
1550 	uchar_t usr_cmd, uint16_t data_len, uchar_t *data_bufp);
1551 static int sd_send_scsi_PERSISTENT_RESERVE_OUT(sd_ssc_t *ssc,
1552 	uchar_t usr_cmd, uchar_t *usr_bufp);
1553 static int sd_send_scsi_SYNCHRONIZE_CACHE(struct sd_lun *un,
1554 	struct dk_callback *dkc);
1555 static int sd_send_scsi_SYNCHRONIZE_CACHE_biodone(struct buf *bp);
1556 static int sd_send_scsi_UNMAP(dev_t dev, sd_ssc_t *ssc, dkioc_free_list_t *dfl,
1557 	int flag);
1558 static int sd_send_scsi_GET_CONFIGURATION(sd_ssc_t *ssc,
1559 	struct uscsi_cmd *ucmdbuf, uchar_t *rqbuf, uint_t rqbuflen,
1560 	uchar_t *bufaddr, uint_t buflen, int path_flag);
1561 static int sd_send_scsi_feature_GET_CONFIGURATION(sd_ssc_t *ssc,
1562 	struct uscsi_cmd *ucmdbuf, uchar_t *rqbuf, uint_t rqbuflen,
1563 	uchar_t *bufaddr, uint_t buflen, char feature, int path_flag);
1564 static int sd_send_scsi_MODE_SENSE(sd_ssc_t *ssc, int cdbsize,
1565 	uchar_t *bufaddr, size_t buflen, uchar_t page_code, int path_flag);
1566 static int sd_send_scsi_MODE_SELECT(sd_ssc_t *ssc, int cdbsize,
1567 	uchar_t *bufaddr, size_t buflen, uchar_t save_page, int path_flag);
1568 static int sd_send_scsi_RDWR(sd_ssc_t *ssc, uchar_t cmd, void *bufaddr,
1569 	size_t buflen, daddr_t start_block, int path_flag);
1570 #define	sd_send_scsi_READ(ssc, bufaddr, buflen, start_block, path_flag)	\
1571 	sd_send_scsi_RDWR(ssc, SCMD_READ, bufaddr, buflen, start_block, \
1572 	path_flag)
1573 #define	sd_send_scsi_WRITE(ssc, bufaddr, buflen, start_block, path_flag)\
1574 	sd_send_scsi_RDWR(ssc, SCMD_WRITE, bufaddr, buflen, start_block,\
1575 	path_flag)
1576 
1577 static int sd_send_scsi_LOG_SENSE(sd_ssc_t *ssc, uchar_t *bufaddr,
1578 	uint16_t buflen, uchar_t page_code, uchar_t page_control,
1579 	uint16_t param_ptr, int path_flag);
1580 static int sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION(sd_ssc_t *ssc,
1581 	uchar_t *bufaddr, size_t buflen, uchar_t class_req);
1582 static boolean_t sd_gesn_media_data_valid(uchar_t *data);
1583 
1584 static int  sd_alloc_rqs(struct scsi_device *devp, struct sd_lun *un);
1585 static void sd_free_rqs(struct sd_lun *un);
1586 
1587 static void sd_dump_memory(struct sd_lun *un, uint_t comp, char *title,
1588 	uchar_t *data, int len, int fmt);
1589 static void sd_panic_for_res_conflict(struct sd_lun *un);
1590 
1591 /*
1592  * Disk Ioctl Function Prototypes
1593  */
1594 static int sd_get_media_info(dev_t dev, caddr_t arg, int flag);
1595 static int sd_get_media_info_ext(dev_t dev, caddr_t arg, int flag);
1596 static int sd_dkio_ctrl_info(dev_t dev, caddr_t arg, int flag);
1597 static int sd_dkio_get_temp(dev_t dev, caddr_t arg, int flag);
1598 
1599 /*
1600  * Multi-host Ioctl Prototypes
1601  */
1602 static int sd_check_mhd(dev_t dev, int interval);
1603 static int sd_mhd_watch_cb(caddr_t arg, struct scsi_watch_result *resultp);
1604 static void sd_mhd_watch_incomplete(struct sd_lun *un, struct scsi_pkt *pkt);
1605 static char *sd_sname(uchar_t status);
1606 static void sd_mhd_resvd_recover(void *arg);
1607 static void sd_resv_reclaim_thread();
1608 static int sd_take_ownership(dev_t dev, struct mhioctkown *p);
1609 static int sd_reserve_release(dev_t dev, int cmd);
1610 static void sd_rmv_resv_reclaim_req(dev_t dev);
1611 static void sd_mhd_reset_notify_cb(caddr_t arg);
1612 static int sd_persistent_reservation_in_read_keys(struct sd_lun *un,
1613 	mhioc_inkeys_t *usrp, int flag);
1614 static int sd_persistent_reservation_in_read_resv(struct sd_lun *un,
1615 	mhioc_inresvs_t *usrp, int flag);
1616 static int sd_mhdioc_takeown(dev_t dev, caddr_t arg, int flag);
1617 static int sd_mhdioc_failfast(dev_t dev, caddr_t arg, int flag);
1618 static int sd_mhdioc_release(dev_t dev);
1619 static int sd_mhdioc_register_devid(dev_t dev);
1620 static int sd_mhdioc_inkeys(dev_t dev, caddr_t arg, int flag);
1621 static int sd_mhdioc_inresv(dev_t dev, caddr_t arg, int flag);
1622 
1623 /*
1624  * SCSI removable prototypes
1625  */
1626 static int sr_change_blkmode(dev_t dev, int cmd, intptr_t data, int flag);
1627 static int sr_change_speed(dev_t dev, int cmd, intptr_t data, int flag);
1628 static int sr_atapi_change_speed(dev_t dev, int cmd, intptr_t data, int flag);
1629 static int sr_pause_resume(dev_t dev, int mode);
1630 static int sr_play_msf(dev_t dev, caddr_t data, int flag);
1631 static int sr_play_trkind(dev_t dev, caddr_t data, int flag);
1632 static int sr_read_all_subcodes(dev_t dev, caddr_t data, int flag);
1633 static int sr_read_subchannel(dev_t dev, caddr_t data, int flag);
1634 static int sr_read_tocentry(dev_t dev, caddr_t data, int flag);
1635 static int sr_read_tochdr(dev_t dev, caddr_t data, int flag);
1636 static int sr_read_cdda(dev_t dev, caddr_t data, int flag);
1637 static int sr_read_cdxa(dev_t dev, caddr_t data, int flag);
1638 static int sr_read_mode1(dev_t dev, caddr_t data, int flag);
1639 static int sr_read_mode2(dev_t dev, caddr_t data, int flag);
1640 static int sr_read_cd_mode2(dev_t dev, caddr_t data, int flag);
1641 static int sr_sector_mode(dev_t dev, uint32_t blksize);
1642 static int sr_eject(dev_t dev);
1643 static void sr_ejected(register struct sd_lun *un);
1644 static int sr_check_wp(dev_t dev);
1645 static opaque_t sd_watch_request_submit(struct sd_lun *un);
1646 static int sd_check_media(dev_t dev, enum dkio_state state);
1647 static int sd_media_watch_cb(caddr_t arg, struct scsi_watch_result *resultp);
1648 static void sd_delayed_cv_broadcast(void *arg);
1649 static int sr_volume_ctrl(dev_t dev, caddr_t data, int flag);
1650 static int sr_read_sony_session_offset(dev_t dev, caddr_t data, int flag);
1651 
1652 static int sd_log_page_supported(sd_ssc_t *ssc, int log_page);
1653 
1654 /*
1655  * Function Prototype for the non-512 support (DVDRAM, MO etc.) functions.
1656  */
1657 static void sd_check_for_writable_cd(sd_ssc_t *ssc, int path_flag);
1658 static int sd_wm_cache_constructor(void *wm, void *un, int flags);
1659 static void sd_wm_cache_destructor(void *wm, void *un);
1660 static struct sd_w_map *sd_range_lock(struct sd_lun *un, daddr_t startb,
1661     daddr_t endb, ushort_t typ);
1662 static struct sd_w_map *sd_get_range(struct sd_lun *un, daddr_t startb,
1663     daddr_t endb);
1664 static void sd_free_inlist_wmap(struct sd_lun *un, struct sd_w_map *wmp);
1665 static void sd_range_unlock(struct sd_lun *un, struct sd_w_map *wm);
1666 static void sd_read_modify_write_task(void * arg);
1667 static int
1668 sddump_do_read_of_rmw(struct sd_lun *un, uint64_t blkno, uint64_t nblk,
1669     struct buf **bpp);
1670 
1671 
1672 /*
1673  * Function prototypes for failfast support.
1674  */
1675 static void sd_failfast_flushq(struct sd_lun *un);
1676 static int sd_failfast_flushq_callback(struct buf *bp);
1677 
1678 /*
1679  * Function prototypes to check for lsi devices
1680  */
1681 static void sd_is_lsi(struct sd_lun *un);
1682 
1683 /*
1684  * Function prototypes for partial DMA support
1685  */
1686 static int sd_setup_next_xfer(struct sd_lun *un, struct buf *bp,
1687 		struct scsi_pkt *pkt, struct sd_xbuf *xp);
1688 
1689 
1690 /* Function prototypes for cmlb */
1691 static int sd_tg_rdwr(dev_info_t *devi, uchar_t cmd, void *bufaddr,
1692     diskaddr_t start_block, size_t reqlength, void *tg_cookie);
1693 
1694 static int sd_tg_getinfo(dev_info_t *devi, int cmd, void *arg, void *tg_cookie);
1695 
1696 /*
1697  * For printing RMW warning message timely
1698  */
1699 static void sd_rmw_msg_print_handler(void *arg);
1700 
1701 /*
1702  * Constants for failfast support:
1703  *
1704  * SD_FAILFAST_INACTIVE: Instance is currently in a normal state, with NO
1705  * failfast processing being performed.
1706  *
1707  * SD_FAILFAST_ACTIVE: Instance is in the failfast state and is performing
1708  * failfast processing on all bufs with B_FAILFAST set.
1709  */
1710 
1711 #define	SD_FAILFAST_INACTIVE		0
1712 #define	SD_FAILFAST_ACTIVE		1
1713 
1714 /*
1715  * Bitmask to control behavior of buf(9S) flushes when a transition to
1716  * the failfast state occurs. Optional bits include:
1717  *
1718  * SD_FAILFAST_FLUSH_ALL_BUFS: When set, flush ALL bufs including those that
1719  * do NOT have B_FAILFAST set. When clear, only bufs with B_FAILFAST will
1720  * be flushed.
1721  *
1722  * SD_FAILFAST_FLUSH_ALL_QUEUES: When set, flush any/all other queues in the
1723  * driver, in addition to the regular wait queue. This includes the xbuf
1724  * queues. When clear, only the driver's wait queue will be flushed.
1725  */
1726 #define	SD_FAILFAST_FLUSH_ALL_BUFS	0x01
1727 #define	SD_FAILFAST_FLUSH_ALL_QUEUES	0x02
1728 
1729 /*
1730  * The default behavior is to only flush bufs that have B_FAILFAST set, but
1731  * to flush all queues within the driver.
1732  */
1733 static int sd_failfast_flushctl = SD_FAILFAST_FLUSH_ALL_QUEUES;
1734 
1735 
1736 /*
1737  * SD Testing Fault Injection
1738  */
1739 #ifdef SD_FAULT_INJECTION
1740 static void sd_faultinjection_ioctl(int cmd, intptr_t arg, struct sd_lun *un);
1741 static void sd_faultinjection(struct scsi_pkt *pktp);
1742 static void sd_injection_log(char *buf, struct sd_lun *un);
1743 #endif
1744 
1745 /*
1746  * Device driver ops vector
1747  */
1748 static struct cb_ops sd_cb_ops = {
1749 	sdopen,			/* open */
1750 	sdclose,		/* close */
1751 	sdstrategy,		/* strategy */
1752 	nodev,			/* print */
1753 	sddump,			/* dump */
1754 	sdread,			/* read */
1755 	sdwrite,		/* write */
1756 	sdioctl,		/* ioctl */
1757 	nodev,			/* devmap */
1758 	nodev,			/* mmap */
1759 	nodev,			/* segmap */
1760 	nochpoll,		/* poll */
1761 	sd_prop_op,		/* cb_prop_op */
1762 	0,			/* streamtab  */
1763 	D_64BIT | D_MP | D_NEW | D_HOTPLUG, /* Driver compatibility flags */
1764 	CB_REV,			/* cb_rev */
1765 	sdaread,		/* async I/O read entry point */
1766 	sdawrite		/* async I/O write entry point */
1767 };
1768 
1769 struct dev_ops sd_ops = {
1770 	DEVO_REV,		/* devo_rev, */
1771 	0,			/* refcnt  */
1772 	sdinfo,			/* info */
1773 	nulldev,		/* identify */
1774 	sdprobe,		/* probe */
1775 	sdattach,		/* attach */
1776 	sddetach,		/* detach */
1777 	nodev,			/* reset */
1778 	&sd_cb_ops,		/* driver operations */
1779 	NULL,			/* bus operations */
1780 	sdpower,		/* power */
1781 	ddi_quiesce_not_needed,		/* quiesce */
1782 };
1783 
1784 /*
1785  * This is the loadable module wrapper.
1786  */
1787 #include <sys/modctl.h>
1788 
1789 static struct modldrv modldrv = {
1790 	&mod_driverops,		/* Type of module. This one is a driver */
1791 	SD_MODULE_NAME,		/* Module name. */
1792 	&sd_ops			/* driver ops */
1793 };
1794 
1795 static struct modlinkage modlinkage = {
1796 	MODREV_1, &modldrv, NULL
1797 };
1798 
1799 static cmlb_tg_ops_t sd_tgops = {
1800 	TG_DK_OPS_VERSION_1,
1801 	sd_tg_rdwr,
1802 	sd_tg_getinfo
1803 };
1804 
1805 static struct scsi_asq_key_strings sd_additional_codes[] = {
1806 	0x81, 0, "Logical Unit is Reserved",
1807 	0x85, 0, "Audio Address Not Valid",
1808 	0xb6, 0, "Media Load Mechanism Failed",
1809 	0xB9, 0, "Audio Play Operation Aborted",
1810 	0xbf, 0, "Buffer Overflow for Read All Subcodes Command",
1811 	0x53, 2, "Medium removal prevented",
1812 	0x6f, 0, "Authentication failed during key exchange",
1813 	0x6f, 1, "Key not present",
1814 	0x6f, 2, "Key not established",
1815 	0x6f, 3, "Read without proper authentication",
1816 	0x6f, 4, "Mismatched region to this logical unit",
1817 	0x6f, 5, "Region reset count error",
1818 	0xffff, 0x0, NULL
1819 };
1820 
1821 
1822 /*
1823  * Struct for passing printing information for sense data messages
1824  */
1825 struct sd_sense_info {
1826 	int	ssi_severity;
1827 	int	ssi_pfa_flag;
1828 };
1829 
1830 /*
1831  * Table of function pointers for iostart-side routines. Separate "chains"
1832  * of layered function calls are formed by placing the function pointers
1833  * sequentially in the desired order. Functions are called according to an
1834  * incrementing table index ordering. The last function in each chain must
1835  * be sd_core_iostart(). The corresponding iodone-side routines are expected
1836  * in the sd_iodone_chain[] array.
1837  *
1838  * Note: It may seem more natural to organize both the iostart and iodone
1839  * functions together, into an array of structures (or some similar
1840  * organization) with a common index, rather than two separate arrays which
1841  * must be maintained in synchronization. The purpose of this division is
1842  * to achieve improved performance: individual arrays allows for more
1843  * effective cache line utilization on certain platforms.
1844  */
1845 
1846 typedef void (*sd_chain_t)(int index, struct sd_lun *un, struct buf *bp);
1847 
1848 
1849 static sd_chain_t sd_iostart_chain[] = {
1850 
1851 	/* Chain for buf IO for disk drive targets (PM enabled) */
1852 	sd_mapblockaddr_iostart,	/* Index: 0 */
1853 	sd_pm_iostart,			/* Index: 1 */
1854 	sd_core_iostart,		/* Index: 2 */
1855 
1856 	/* Chain for buf IO for disk drive targets (PM disabled) */
1857 	sd_mapblockaddr_iostart,	/* Index: 3 */
1858 	sd_core_iostart,		/* Index: 4 */
1859 
1860 	/*
1861 	 * Chain for buf IO for removable-media or large sector size
1862 	 * disk drive targets with RMW needed (PM enabled)
1863 	 */
1864 	sd_mapblockaddr_iostart,	/* Index: 5 */
1865 	sd_mapblocksize_iostart,	/* Index: 6 */
1866 	sd_pm_iostart,			/* Index: 7 */
1867 	sd_core_iostart,		/* Index: 8 */
1868 
1869 	/*
1870 	 * Chain for buf IO for removable-media or large sector size
1871 	 * disk drive targets with RMW needed (PM disabled)
1872 	 */
1873 	sd_mapblockaddr_iostart,	/* Index: 9 */
1874 	sd_mapblocksize_iostart,	/* Index: 10 */
1875 	sd_core_iostart,		/* Index: 11 */
1876 
1877 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
1878 	sd_mapblockaddr_iostart,	/* Index: 12 */
1879 	sd_checksum_iostart,		/* Index: 13 */
1880 	sd_pm_iostart,			/* Index: 14 */
1881 	sd_core_iostart,		/* Index: 15 */
1882 
1883 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
1884 	sd_mapblockaddr_iostart,	/* Index: 16 */
1885 	sd_checksum_iostart,		/* Index: 17 */
1886 	sd_core_iostart,		/* Index: 18 */
1887 
1888 	/* Chain for USCSI commands (all targets) */
1889 	sd_pm_iostart,			/* Index: 19 */
1890 	sd_core_iostart,		/* Index: 20 */
1891 
1892 	/* Chain for checksumming USCSI commands (all targets) */
1893 	sd_checksum_uscsi_iostart,	/* Index: 21 */
1894 	sd_pm_iostart,			/* Index: 22 */
1895 	sd_core_iostart,		/* Index: 23 */
1896 
1897 	/* Chain for "direct" USCSI commands (all targets) */
1898 	sd_core_iostart,		/* Index: 24 */
1899 
1900 	/* Chain for "direct priority" USCSI commands (all targets) */
1901 	sd_core_iostart,		/* Index: 25 */
1902 
1903 	/*
1904 	 * Chain for buf IO for large sector size disk drive targets
1905 	 * with RMW needed with checksumming (PM enabled)
1906 	 */
1907 	sd_mapblockaddr_iostart,	/* Index: 26 */
1908 	sd_mapblocksize_iostart,	/* Index: 27 */
1909 	sd_checksum_iostart,		/* Index: 28 */
1910 	sd_pm_iostart,			/* Index: 29 */
1911 	sd_core_iostart,		/* Index: 30 */
1912 
1913 	/*
1914 	 * Chain for buf IO for large sector size disk drive targets
1915 	 * with RMW needed with checksumming (PM disabled)
1916 	 */
1917 	sd_mapblockaddr_iostart,	/* Index: 31 */
1918 	sd_mapblocksize_iostart,	/* Index: 32 */
1919 	sd_checksum_iostart,		/* Index: 33 */
1920 	sd_core_iostart,		/* Index: 34 */
1921 
1922 };
1923 
1924 /*
1925  * Macros to locate the first function of each iostart chain in the
1926  * sd_iostart_chain[] array. These are located by the index in the array.
1927  */
1928 #define	SD_CHAIN_DISK_IOSTART			0
1929 #define	SD_CHAIN_DISK_IOSTART_NO_PM		3
1930 #define	SD_CHAIN_MSS_DISK_IOSTART		5
1931 #define	SD_CHAIN_RMMEDIA_IOSTART		5
1932 #define	SD_CHAIN_MSS_DISK_IOSTART_NO_PM		9
1933 #define	SD_CHAIN_RMMEDIA_IOSTART_NO_PM		9
1934 #define	SD_CHAIN_CHKSUM_IOSTART			12
1935 #define	SD_CHAIN_CHKSUM_IOSTART_NO_PM		16
1936 #define	SD_CHAIN_USCSI_CMD_IOSTART		19
1937 #define	SD_CHAIN_USCSI_CHKSUM_IOSTART		21
1938 #define	SD_CHAIN_DIRECT_CMD_IOSTART		24
1939 #define	SD_CHAIN_PRIORITY_CMD_IOSTART		25
1940 #define	SD_CHAIN_MSS_CHKSUM_IOSTART		26
1941 #define	SD_CHAIN_MSS_CHKSUM_IOSTART_NO_PM	31
1942 
1943 
1944 /*
1945  * Table of function pointers for the iodone-side routines for the driver-
1946  * internal layering mechanism.  The calling sequence for iodone routines
1947  * uses a decrementing table index, so the last routine called in a chain
1948  * must be at the lowest array index location for that chain.  The last
1949  * routine for each chain must be either sd_buf_iodone() (for buf(9S) IOs)
1950  * or sd_uscsi_iodone() (for uscsi IOs).  Other than this, the ordering
1951  * of the functions in an iodone side chain must correspond to the ordering
1952  * of the iostart routines for that chain.  Note that there is no iodone
1953  * side routine that corresponds to sd_core_iostart(), so there is no
1954  * entry in the table for this.
1955  */
1956 
1957 static sd_chain_t sd_iodone_chain[] = {
1958 
1959 	/* Chain for buf IO for disk drive targets (PM enabled) */
1960 	sd_buf_iodone,			/* Index: 0 */
1961 	sd_mapblockaddr_iodone,		/* Index: 1 */
1962 	sd_pm_iodone,			/* Index: 2 */
1963 
1964 	/* Chain for buf IO for disk drive targets (PM disabled) */
1965 	sd_buf_iodone,			/* Index: 3 */
1966 	sd_mapblockaddr_iodone,		/* Index: 4 */
1967 
1968 	/*
1969 	 * Chain for buf IO for removable-media or large sector size
1970 	 * disk drive targets with RMW needed (PM enabled)
1971 	 */
1972 	sd_buf_iodone,			/* Index: 5 */
1973 	sd_mapblockaddr_iodone,		/* Index: 6 */
1974 	sd_mapblocksize_iodone,		/* Index: 7 */
1975 	sd_pm_iodone,			/* Index: 8 */
1976 
1977 	/*
1978 	 * Chain for buf IO for removable-media or large sector size
1979 	 * disk drive targets with RMW needed (PM disabled)
1980 	 */
1981 	sd_buf_iodone,			/* Index: 9 */
1982 	sd_mapblockaddr_iodone,		/* Index: 10 */
1983 	sd_mapblocksize_iodone,		/* Index: 11 */
1984 
1985 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
1986 	sd_buf_iodone,			/* Index: 12 */
1987 	sd_mapblockaddr_iodone,		/* Index: 13 */
1988 	sd_checksum_iodone,		/* Index: 14 */
1989 	sd_pm_iodone,			/* Index: 15 */
1990 
1991 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
1992 	sd_buf_iodone,			/* Index: 16 */
1993 	sd_mapblockaddr_iodone,		/* Index: 17 */
1994 	sd_checksum_iodone,		/* Index: 18 */
1995 
1996 	/* Chain for USCSI commands (non-checksum targets) */
1997 	sd_uscsi_iodone,		/* Index: 19 */
1998 	sd_pm_iodone,			/* Index: 20 */
1999 
2000 	/* Chain for USCSI commands (checksum targets) */
2001 	sd_uscsi_iodone,		/* Index: 21 */
2002 	sd_checksum_uscsi_iodone,	/* Index: 22 */
2003 	sd_pm_iodone,			/* Index: 22 */
2004 
2005 	/* Chain for "direct" USCSI commands (all targets) */
2006 	sd_uscsi_iodone,		/* Index: 24 */
2007 
2008 	/* Chain for "direct priority" USCSI commands (all targets) */
2009 	sd_uscsi_iodone,		/* Index: 25 */
2010 
2011 	/*
2012 	 * Chain for buf IO for large sector size disk drive targets
2013 	 * with checksumming (PM enabled)
2014 	 */
2015 	sd_buf_iodone,			/* Index: 26 */
2016 	sd_mapblockaddr_iodone,		/* Index: 27 */
2017 	sd_mapblocksize_iodone,		/* Index: 28 */
2018 	sd_checksum_iodone,		/* Index: 29 */
2019 	sd_pm_iodone,			/* Index: 30 */
2020 
2021 	/*
2022 	 * Chain for buf IO for large sector size disk drive targets
2023 	 * with checksumming (PM disabled)
2024 	 */
2025 	sd_buf_iodone,			/* Index: 31 */
2026 	sd_mapblockaddr_iodone,		/* Index: 32 */
2027 	sd_mapblocksize_iodone,		/* Index: 33 */
2028 	sd_checksum_iodone,		/* Index: 34 */
2029 };
2030 
2031 
2032 /*
2033  * Macros to locate the "first" function in the sd_iodone_chain[] array for
2034  * each iodone-side chain. These are located by the array index, but as the
2035  * iodone side functions are called in a decrementing-index order, the
2036  * highest index number in each chain must be specified (as these correspond
2037  * to the first function in the iodone chain that will be called by the core
2038  * at IO completion time).
2039  */
2040 
2041 #define	SD_CHAIN_DISK_IODONE			2
2042 #define	SD_CHAIN_DISK_IODONE_NO_PM		4
2043 #define	SD_CHAIN_RMMEDIA_IODONE			8
2044 #define	SD_CHAIN_MSS_DISK_IODONE		8
2045 #define	SD_CHAIN_RMMEDIA_IODONE_NO_PM		11
2046 #define	SD_CHAIN_MSS_DISK_IODONE_NO_PM		11
2047 #define	SD_CHAIN_CHKSUM_IODONE			15
2048 #define	SD_CHAIN_CHKSUM_IODONE_NO_PM		18
2049 #define	SD_CHAIN_USCSI_CMD_IODONE		20
2050 #define	SD_CHAIN_USCSI_CHKSUM_IODONE		22
2051 #define	SD_CHAIN_DIRECT_CMD_IODONE		24
2052 #define	SD_CHAIN_PRIORITY_CMD_IODONE		25
2053 #define	SD_CHAIN_MSS_CHKSUM_IODONE		30
2054 #define	SD_CHAIN_MSS_CHKSUM_IODONE_NO_PM	34
2055 
2056 
2057 
2058 /*
2059  * Array to map a layering chain index to the appropriate initpkt routine.
2060  * The redundant entries are present so that the index used for accessing
2061  * the above sd_iostart_chain and sd_iodone_chain tables can be used directly
2062  * with this table as well.
2063  */
2064 typedef int (*sd_initpkt_t)(struct buf *, struct scsi_pkt **);
2065 
2066 static sd_initpkt_t	sd_initpkt_map[] = {
2067 
2068 	/* Chain for buf IO for disk drive targets (PM enabled) */
2069 	sd_initpkt_for_buf,		/* Index: 0 */
2070 	sd_initpkt_for_buf,		/* Index: 1 */
2071 	sd_initpkt_for_buf,		/* Index: 2 */
2072 
2073 	/* Chain for buf IO for disk drive targets (PM disabled) */
2074 	sd_initpkt_for_buf,		/* Index: 3 */
2075 	sd_initpkt_for_buf,		/* Index: 4 */
2076 
2077 	/*
2078 	 * Chain for buf IO for removable-media or large sector size
2079 	 * disk drive targets (PM enabled)
2080 	 */
2081 	sd_initpkt_for_buf,		/* Index: 5 */
2082 	sd_initpkt_for_buf,		/* Index: 6 */
2083 	sd_initpkt_for_buf,		/* Index: 7 */
2084 	sd_initpkt_for_buf,		/* Index: 8 */
2085 
2086 	/*
2087 	 * Chain for buf IO for removable-media or large sector size
2088 	 * disk drive targets (PM disabled)
2089 	 */
2090 	sd_initpkt_for_buf,		/* Index: 9 */
2091 	sd_initpkt_for_buf,		/* Index: 10 */
2092 	sd_initpkt_for_buf,		/* Index: 11 */
2093 
2094 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
2095 	sd_initpkt_for_buf,		/* Index: 12 */
2096 	sd_initpkt_for_buf,		/* Index: 13 */
2097 	sd_initpkt_for_buf,		/* Index: 14 */
2098 	sd_initpkt_for_buf,		/* Index: 15 */
2099 
2100 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
2101 	sd_initpkt_for_buf,		/* Index: 16 */
2102 	sd_initpkt_for_buf,		/* Index: 17 */
2103 	sd_initpkt_for_buf,		/* Index: 18 */
2104 
2105 	/* Chain for USCSI commands (non-checksum targets) */
2106 	sd_initpkt_for_uscsi,		/* Index: 19 */
2107 	sd_initpkt_for_uscsi,		/* Index: 20 */
2108 
2109 	/* Chain for USCSI commands (checksum targets) */
2110 	sd_initpkt_for_uscsi,		/* Index: 21 */
2111 	sd_initpkt_for_uscsi,		/* Index: 22 */
2112 	sd_initpkt_for_uscsi,		/* Index: 22 */
2113 
2114 	/* Chain for "direct" USCSI commands (all targets) */
2115 	sd_initpkt_for_uscsi,		/* Index: 24 */
2116 
2117 	/* Chain for "direct priority" USCSI commands (all targets) */
2118 	sd_initpkt_for_uscsi,		/* Index: 25 */
2119 
2120 	/*
2121 	 * Chain for buf IO for large sector size disk drive targets
2122 	 * with checksumming (PM enabled)
2123 	 */
2124 	sd_initpkt_for_buf,		/* Index: 26 */
2125 	sd_initpkt_for_buf,		/* Index: 27 */
2126 	sd_initpkt_for_buf,		/* Index: 28 */
2127 	sd_initpkt_for_buf,		/* Index: 29 */
2128 	sd_initpkt_for_buf,		/* Index: 30 */
2129 
2130 	/*
2131 	 * Chain for buf IO for large sector size disk drive targets
2132 	 * with checksumming (PM disabled)
2133 	 */
2134 	sd_initpkt_for_buf,		/* Index: 31 */
2135 	sd_initpkt_for_buf,		/* Index: 32 */
2136 	sd_initpkt_for_buf,		/* Index: 33 */
2137 	sd_initpkt_for_buf,		/* Index: 34 */
2138 };
2139 
2140 
2141 /*
2142  * Array to map a layering chain index to the appropriate destroypktpkt routine.
2143  * The redundant entries are present so that the index used for accessing
2144  * the above sd_iostart_chain and sd_iodone_chain tables can be used directly
2145  * with this table as well.
2146  */
2147 typedef void (*sd_destroypkt_t)(struct buf *);
2148 
2149 static sd_destroypkt_t	sd_destroypkt_map[] = {
2150 
2151 	/* Chain for buf IO for disk drive targets (PM enabled) */
2152 	sd_destroypkt_for_buf,		/* Index: 0 */
2153 	sd_destroypkt_for_buf,		/* Index: 1 */
2154 	sd_destroypkt_for_buf,		/* Index: 2 */
2155 
2156 	/* Chain for buf IO for disk drive targets (PM disabled) */
2157 	sd_destroypkt_for_buf,		/* Index: 3 */
2158 	sd_destroypkt_for_buf,		/* Index: 4 */
2159 
2160 	/*
2161 	 * Chain for buf IO for removable-media or large sector size
2162 	 * disk drive targets (PM enabled)
2163 	 */
2164 	sd_destroypkt_for_buf,		/* Index: 5 */
2165 	sd_destroypkt_for_buf,		/* Index: 6 */
2166 	sd_destroypkt_for_buf,		/* Index: 7 */
2167 	sd_destroypkt_for_buf,		/* Index: 8 */
2168 
2169 	/*
2170 	 * Chain for buf IO for removable-media or large sector size
2171 	 * disk drive targets (PM disabled)
2172 	 */
2173 	sd_destroypkt_for_buf,		/* Index: 9 */
2174 	sd_destroypkt_for_buf,		/* Index: 10 */
2175 	sd_destroypkt_for_buf,		/* Index: 11 */
2176 
2177 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
2178 	sd_destroypkt_for_buf,		/* Index: 12 */
2179 	sd_destroypkt_for_buf,		/* Index: 13 */
2180 	sd_destroypkt_for_buf,		/* Index: 14 */
2181 	sd_destroypkt_for_buf,		/* Index: 15 */
2182 
2183 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
2184 	sd_destroypkt_for_buf,		/* Index: 16 */
2185 	sd_destroypkt_for_buf,		/* Index: 17 */
2186 	sd_destroypkt_for_buf,		/* Index: 18 */
2187 
2188 	/* Chain for USCSI commands (non-checksum targets) */
2189 	sd_destroypkt_for_uscsi,	/* Index: 19 */
2190 	sd_destroypkt_for_uscsi,	/* Index: 20 */
2191 
2192 	/* Chain for USCSI commands (checksum targets) */
2193 	sd_destroypkt_for_uscsi,	/* Index: 21 */
2194 	sd_destroypkt_for_uscsi,	/* Index: 22 */
2195 	sd_destroypkt_for_uscsi,	/* Index: 22 */
2196 
2197 	/* Chain for "direct" USCSI commands (all targets) */
2198 	sd_destroypkt_for_uscsi,	/* Index: 24 */
2199 
2200 	/* Chain for "direct priority" USCSI commands (all targets) */
2201 	sd_destroypkt_for_uscsi,	/* Index: 25 */
2202 
2203 	/*
2204 	 * Chain for buf IO for large sector size disk drive targets
2205 	 * with checksumming (PM disabled)
2206 	 */
2207 	sd_destroypkt_for_buf,		/* Index: 26 */
2208 	sd_destroypkt_for_buf,		/* Index: 27 */
2209 	sd_destroypkt_for_buf,		/* Index: 28 */
2210 	sd_destroypkt_for_buf,		/* Index: 29 */
2211 	sd_destroypkt_for_buf,		/* Index: 30 */
2212 
2213 	/*
2214 	 * Chain for buf IO for large sector size disk drive targets
2215 	 * with checksumming (PM enabled)
2216 	 */
2217 	sd_destroypkt_for_buf,		/* Index: 31 */
2218 	sd_destroypkt_for_buf,		/* Index: 32 */
2219 	sd_destroypkt_for_buf,		/* Index: 33 */
2220 	sd_destroypkt_for_buf,		/* Index: 34 */
2221 };
2222 
2223 
2224 
2225 /*
2226  * Array to map a layering chain index to the appropriate chain "type".
2227  * The chain type indicates a specific property/usage of the chain.
2228  * The redundant entries are present so that the index used for accessing
2229  * the above sd_iostart_chain and sd_iodone_chain tables can be used directly
2230  * with this table as well.
2231  */
2232 
2233 #define	SD_CHAIN_NULL			0	/* for the special RQS cmd */
2234 #define	SD_CHAIN_BUFIO			1	/* regular buf IO */
2235 #define	SD_CHAIN_USCSI			2	/* regular USCSI commands */
2236 #define	SD_CHAIN_DIRECT			3	/* uscsi, w/ bypass power mgt */
2237 #define	SD_CHAIN_DIRECT_PRIORITY	4	/* uscsi, w/ bypass power mgt */
2238 						/* (for error recovery) */
2239 
2240 static int sd_chain_type_map[] = {
2241 
2242 	/* Chain for buf IO for disk drive targets (PM enabled) */
2243 	SD_CHAIN_BUFIO,			/* Index: 0 */
2244 	SD_CHAIN_BUFIO,			/* Index: 1 */
2245 	SD_CHAIN_BUFIO,			/* Index: 2 */
2246 
2247 	/* Chain for buf IO for disk drive targets (PM disabled) */
2248 	SD_CHAIN_BUFIO,			/* Index: 3 */
2249 	SD_CHAIN_BUFIO,			/* Index: 4 */
2250 
2251 	/*
2252 	 * Chain for buf IO for removable-media or large sector size
2253 	 * disk drive targets (PM enabled)
2254 	 */
2255 	SD_CHAIN_BUFIO,			/* Index: 5 */
2256 	SD_CHAIN_BUFIO,			/* Index: 6 */
2257 	SD_CHAIN_BUFIO,			/* Index: 7 */
2258 	SD_CHAIN_BUFIO,			/* Index: 8 */
2259 
2260 	/*
2261 	 * Chain for buf IO for removable-media or large sector size
2262 	 * disk drive targets (PM disabled)
2263 	 */
2264 	SD_CHAIN_BUFIO,			/* Index: 9 */
2265 	SD_CHAIN_BUFIO,			/* Index: 10 */
2266 	SD_CHAIN_BUFIO,			/* Index: 11 */
2267 
2268 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
2269 	SD_CHAIN_BUFIO,			/* Index: 12 */
2270 	SD_CHAIN_BUFIO,			/* Index: 13 */
2271 	SD_CHAIN_BUFIO,			/* Index: 14 */
2272 	SD_CHAIN_BUFIO,			/* Index: 15 */
2273 
2274 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
2275 	SD_CHAIN_BUFIO,			/* Index: 16 */
2276 	SD_CHAIN_BUFIO,			/* Index: 17 */
2277 	SD_CHAIN_BUFIO,			/* Index: 18 */
2278 
2279 	/* Chain for USCSI commands (non-checksum targets) */
2280 	SD_CHAIN_USCSI,			/* Index: 19 */
2281 	SD_CHAIN_USCSI,			/* Index: 20 */
2282 
2283 	/* Chain for USCSI commands (checksum targets) */
2284 	SD_CHAIN_USCSI,			/* Index: 21 */
2285 	SD_CHAIN_USCSI,			/* Index: 22 */
2286 	SD_CHAIN_USCSI,			/* Index: 23 */
2287 
2288 	/* Chain for "direct" USCSI commands (all targets) */
2289 	SD_CHAIN_DIRECT,		/* Index: 24 */
2290 
2291 	/* Chain for "direct priority" USCSI commands (all targets) */
2292 	SD_CHAIN_DIRECT_PRIORITY,	/* Index: 25 */
2293 
2294 	/*
2295 	 * Chain for buf IO for large sector size disk drive targets
2296 	 * with checksumming (PM enabled)
2297 	 */
2298 	SD_CHAIN_BUFIO,			/* Index: 26 */
2299 	SD_CHAIN_BUFIO,			/* Index: 27 */
2300 	SD_CHAIN_BUFIO,			/* Index: 28 */
2301 	SD_CHAIN_BUFIO,			/* Index: 29 */
2302 	SD_CHAIN_BUFIO,			/* Index: 30 */
2303 
2304 	/*
2305 	 * Chain for buf IO for large sector size disk drive targets
2306 	 * with checksumming (PM disabled)
2307 	 */
2308 	SD_CHAIN_BUFIO,			/* Index: 31 */
2309 	SD_CHAIN_BUFIO,			/* Index: 32 */
2310 	SD_CHAIN_BUFIO,			/* Index: 33 */
2311 	SD_CHAIN_BUFIO,			/* Index: 34 */
2312 };
2313 
2314 
2315 /* Macro to return TRUE if the IO has come from the sd_buf_iostart() chain. */
2316 #define	SD_IS_BUFIO(xp)			\
2317 	(sd_chain_type_map[(xp)->xb_chain_iostart] == SD_CHAIN_BUFIO)
2318 
2319 /* Macro to return TRUE if the IO has come from the "direct priority" chain. */
2320 #define	SD_IS_DIRECT_PRIORITY(xp)	\
2321 	(sd_chain_type_map[(xp)->xb_chain_iostart] == SD_CHAIN_DIRECT_PRIORITY)
2322 
2323 
2324 
2325 /*
2326  * Struct, array, and macros to map a specific chain to the appropriate
2327  * layering indexes in the sd_iostart_chain[] and sd_iodone_chain[] arrays.
2328  *
2329  * The sd_chain_index_map[] array is used at attach time to set the various
2330  * un_xxx_chain type members of the sd_lun softstate to the specific layering
2331  * chain to be used with the instance. This allows different instances to use
2332  * different chain for buf IO, uscsi IO, etc.. Also, since the xb_chain_iostart
2333  * and xb_chain_iodone index values in the sd_xbuf are initialized to these
2334  * values at sd_xbuf init time, this allows (1) layering chains may be changed
2335  * dynamically & without the use of locking; and (2) a layer may update the
2336  * xb_chain_io[start|done] member in a given xbuf with its current index value,
2337  * to allow for deferred processing of an IO within the same chain from a
2338  * different execution context.
2339  */
2340 
2341 struct sd_chain_index {
2342 	int	sci_iostart_index;
2343 	int	sci_iodone_index;
2344 };
2345 
2346 static struct sd_chain_index	sd_chain_index_map[] = {
2347 	{ SD_CHAIN_DISK_IOSTART,		SD_CHAIN_DISK_IODONE },
2348 	{ SD_CHAIN_DISK_IOSTART_NO_PM,		SD_CHAIN_DISK_IODONE_NO_PM },
2349 	{ SD_CHAIN_RMMEDIA_IOSTART,		SD_CHAIN_RMMEDIA_IODONE },
2350 	{ SD_CHAIN_RMMEDIA_IOSTART_NO_PM,	SD_CHAIN_RMMEDIA_IODONE_NO_PM },
2351 	{ SD_CHAIN_CHKSUM_IOSTART,		SD_CHAIN_CHKSUM_IODONE },
2352 	{ SD_CHAIN_CHKSUM_IOSTART_NO_PM,	SD_CHAIN_CHKSUM_IODONE_NO_PM },
2353 	{ SD_CHAIN_USCSI_CMD_IOSTART,		SD_CHAIN_USCSI_CMD_IODONE },
2354 	{ SD_CHAIN_USCSI_CHKSUM_IOSTART,	SD_CHAIN_USCSI_CHKSUM_IODONE },
2355 	{ SD_CHAIN_DIRECT_CMD_IOSTART,		SD_CHAIN_DIRECT_CMD_IODONE },
2356 	{ SD_CHAIN_PRIORITY_CMD_IOSTART,	SD_CHAIN_PRIORITY_CMD_IODONE },
2357 	{ SD_CHAIN_MSS_CHKSUM_IOSTART,		SD_CHAIN_MSS_CHKSUM_IODONE },
2358 	{ SD_CHAIN_MSS_CHKSUM_IOSTART_NO_PM, SD_CHAIN_MSS_CHKSUM_IODONE_NO_PM },
2359 
2360 };
2361 
2362 
2363 /*
2364  * The following are indexes into the sd_chain_index_map[] array.
2365  */
2366 
2367 /* un->un_buf_chain_type must be set to one of these */
2368 #define	SD_CHAIN_INFO_DISK		0
2369 #define	SD_CHAIN_INFO_DISK_NO_PM	1
2370 #define	SD_CHAIN_INFO_RMMEDIA		2
2371 #define	SD_CHAIN_INFO_MSS_DISK		2
2372 #define	SD_CHAIN_INFO_RMMEDIA_NO_PM	3
2373 #define	SD_CHAIN_INFO_MSS_DSK_NO_PM	3
2374 #define	SD_CHAIN_INFO_CHKSUM		4
2375 #define	SD_CHAIN_INFO_CHKSUM_NO_PM	5
2376 #define	SD_CHAIN_INFO_MSS_DISK_CHKSUM	10
2377 #define	SD_CHAIN_INFO_MSS_DISK_CHKSUM_NO_PM	11
2378 
2379 /* un->un_uscsi_chain_type must be set to one of these */
2380 #define	SD_CHAIN_INFO_USCSI_CMD		6
2381 /* USCSI with PM disabled is the same as DIRECT */
2382 #define	SD_CHAIN_INFO_USCSI_CMD_NO_PM	8
2383 #define	SD_CHAIN_INFO_USCSI_CHKSUM	7
2384 
2385 /* un->un_direct_chain_type must be set to one of these */
2386 #define	SD_CHAIN_INFO_DIRECT_CMD	8
2387 
2388 /* un->un_priority_chain_type must be set to one of these */
2389 #define	SD_CHAIN_INFO_PRIORITY_CMD	9
2390 
2391 /* size for devid inquiries */
2392 #define	MAX_INQUIRY_SIZE		0xF0
2393 
2394 /*
2395  * Macros used by functions to pass a given buf(9S) struct along to the
2396  * next function in the layering chain for further processing.
2397  *
2398  * In the following macros, passing more than three arguments to the called
2399  * routines causes the optimizer for the SPARC compiler to stop doing tail
2400  * call elimination which results in significant performance degradation.
2401  */
2402 #define	SD_BEGIN_IOSTART(index, un, bp)	\
2403 	((*(sd_iostart_chain[index]))(index, un, bp))
2404 
2405 #define	SD_BEGIN_IODONE(index, un, bp)	\
2406 	((*(sd_iodone_chain[index]))(index, un, bp))
2407 
2408 #define	SD_NEXT_IOSTART(index, un, bp)				\
2409 	((*(sd_iostart_chain[(index) + 1]))((index) + 1, un, bp))
2410 
2411 #define	SD_NEXT_IODONE(index, un, bp)				\
2412 	((*(sd_iodone_chain[(index) - 1]))((index) - 1, un, bp))
2413 
2414 /*
2415  *    Function: _init
2416  *
2417  * Description: This is the driver _init(9E) entry point.
2418  *
2419  * Return Code: Returns the value from mod_install(9F) or
2420  *		ddi_soft_state_init(9F) as appropriate.
2421  *
2422  *     Context: Called when driver module loaded.
2423  */
2424 
2425 int
2426 _init(void)
2427 {
2428 	int	err;
2429 
2430 	/* establish driver name from module name */
2431 	sd_label = (char *)mod_modname(&modlinkage);
2432 
2433 	err = ddi_soft_state_init(&sd_state, sizeof (struct sd_lun),
2434 	    SD_MAXUNIT);
2435 	if (err != 0) {
2436 		return (err);
2437 	}
2438 
2439 	mutex_init(&sd_detach_mutex, NULL, MUTEX_DRIVER, NULL);
2440 	mutex_init(&sd_log_mutex,    NULL, MUTEX_DRIVER, NULL);
2441 	mutex_init(&sd_label_mutex,  NULL, MUTEX_DRIVER, NULL);
2442 
2443 	mutex_init(&sd_tr.srq_resv_reclaim_mutex, NULL, MUTEX_DRIVER, NULL);
2444 	cv_init(&sd_tr.srq_resv_reclaim_cv, NULL, CV_DRIVER, NULL);
2445 	cv_init(&sd_tr.srq_inprocess_cv, NULL, CV_DRIVER, NULL);
2446 
2447 	/*
2448 	 * it's ok to init here even for fibre device
2449 	 */
2450 	sd_scsi_probe_cache_init();
2451 
2452 	sd_scsi_target_lun_init();
2453 
2454 	/*
2455 	 * Creating taskq before mod_install ensures that all callers (threads)
2456 	 * that enter the module after a successful mod_install encounter
2457 	 * a valid taskq.
2458 	 */
2459 	sd_taskq_create();
2460 
2461 	err = mod_install(&modlinkage);
2462 	if (err != 0) {
2463 		/* delete taskq if install fails */
2464 		sd_taskq_delete();
2465 
2466 		mutex_destroy(&sd_detach_mutex);
2467 		mutex_destroy(&sd_log_mutex);
2468 		mutex_destroy(&sd_label_mutex);
2469 
2470 		mutex_destroy(&sd_tr.srq_resv_reclaim_mutex);
2471 		cv_destroy(&sd_tr.srq_resv_reclaim_cv);
2472 		cv_destroy(&sd_tr.srq_inprocess_cv);
2473 
2474 		sd_scsi_probe_cache_fini();
2475 
2476 		sd_scsi_target_lun_fini();
2477 
2478 		ddi_soft_state_fini(&sd_state);
2479 
2480 		return (err);
2481 	}
2482 
2483 	return (err);
2484 }
2485 
2486 
2487 /*
2488  *    Function: _fini
2489  *
2490  * Description: This is the driver _fini(9E) entry point.
2491  *
2492  * Return Code: Returns the value from mod_remove(9F)
2493  *
2494  *     Context: Called when driver module is unloaded.
2495  */
2496 
2497 int
2498 _fini(void)
2499 {
2500 	int err;
2501 
2502 	if ((err = mod_remove(&modlinkage)) != 0) {
2503 		return (err);
2504 	}
2505 
2506 	sd_taskq_delete();
2507 
2508 	mutex_destroy(&sd_detach_mutex);
2509 	mutex_destroy(&sd_log_mutex);
2510 	mutex_destroy(&sd_label_mutex);
2511 	mutex_destroy(&sd_tr.srq_resv_reclaim_mutex);
2512 
2513 	sd_scsi_probe_cache_fini();
2514 
2515 	sd_scsi_target_lun_fini();
2516 
2517 	cv_destroy(&sd_tr.srq_resv_reclaim_cv);
2518 	cv_destroy(&sd_tr.srq_inprocess_cv);
2519 
2520 	ddi_soft_state_fini(&sd_state);
2521 
2522 	return (err);
2523 }
2524 
2525 
2526 /*
2527  *    Function: _info
2528  *
2529  * Description: This is the driver _info(9E) entry point.
2530  *
2531  *   Arguments: modinfop - pointer to the driver modinfo structure
2532  *
2533  * Return Code: Returns the value from mod_info(9F).
2534  *
2535  *     Context: Kernel thread context
2536  */
2537 
2538 int
2539 _info(struct modinfo *modinfop)
2540 {
2541 	return (mod_info(&modlinkage, modinfop));
2542 }
2543 
2544 
2545 /*
2546  * The following routines implement the driver message logging facility.
2547  * They provide component- and level- based debug output filtering.
2548  * Output may also be restricted to messages for a single instance by
2549  * specifying a soft state pointer in sd_debug_un. If sd_debug_un is set
2550  * to NULL, then messages for all instances are printed.
2551  *
2552  * These routines have been cloned from each other due to the language
2553  * constraints of macros and variable argument list processing.
2554  */
2555 
2556 
2557 /*
2558  *    Function: sd_log_err
2559  *
2560  * Description: This routine is called by the SD_ERROR macro for debug
2561  *		logging of error conditions.
2562  *
2563  *   Arguments: comp - driver component being logged
2564  *		dev  - pointer to driver info structure
2565  *		fmt  - error string and format to be logged
2566  */
2567 
2568 static void
2569 sd_log_err(uint_t comp, struct sd_lun *un, const char *fmt, ...)
2570 {
2571 	va_list		ap;
2572 	dev_info_t	*dev;
2573 
2574 	ASSERT(un != NULL);
2575 	dev = SD_DEVINFO(un);
2576 	ASSERT(dev != NULL);
2577 
2578 	/*
2579 	 * Filter messages based on the global component and level masks.
2580 	 * Also print if un matches the value of sd_debug_un, or if
2581 	 * sd_debug_un is set to NULL.
2582 	 */
2583 	if ((sd_component_mask & comp) && (sd_level_mask & SD_LOGMASK_ERROR) &&
2584 	    ((sd_debug_un == NULL) || (sd_debug_un == un))) {
2585 		mutex_enter(&sd_log_mutex);
2586 		va_start(ap, fmt);
2587 		(void) vsprintf(sd_log_buf, fmt, ap);
2588 		va_end(ap);
2589 		scsi_log(dev, sd_label, CE_CONT, "%s", sd_log_buf);
2590 		mutex_exit(&sd_log_mutex);
2591 	}
2592 #ifdef SD_FAULT_INJECTION
2593 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::sd_injection_mask));
2594 	if (un->sd_injection_mask & comp) {
2595 		mutex_enter(&sd_log_mutex);
2596 		va_start(ap, fmt);
2597 		(void) vsprintf(sd_log_buf, fmt, ap);
2598 		va_end(ap);
2599 		sd_injection_log(sd_log_buf, un);
2600 		mutex_exit(&sd_log_mutex);
2601 	}
2602 #endif
2603 }
2604 
2605 
2606 /*
2607  *    Function: sd_log_info
2608  *
2609  * Description: This routine is called by the SD_INFO macro for debug
2610  *		logging of general purpose informational conditions.
2611  *
2612  *   Arguments: comp - driver component being logged
2613  *		dev  - pointer to driver info structure
2614  *		fmt  - info string and format to be logged
2615  */
2616 
2617 static void
2618 sd_log_info(uint_t component, struct sd_lun *un, const char *fmt, ...)
2619 {
2620 	va_list		ap;
2621 	dev_info_t	*dev;
2622 
2623 	ASSERT(un != NULL);
2624 	dev = SD_DEVINFO(un);
2625 	ASSERT(dev != NULL);
2626 
2627 	/*
2628 	 * Filter messages based on the global component and level masks.
2629 	 * Also print if un matches the value of sd_debug_un, or if
2630 	 * sd_debug_un is set to NULL.
2631 	 */
2632 	if ((sd_component_mask & component) &&
2633 	    (sd_level_mask & SD_LOGMASK_INFO) &&
2634 	    ((sd_debug_un == NULL) || (sd_debug_un == un))) {
2635 		mutex_enter(&sd_log_mutex);
2636 		va_start(ap, fmt);
2637 		(void) vsprintf(sd_log_buf, fmt, ap);
2638 		va_end(ap);
2639 		scsi_log(dev, sd_label, CE_CONT, "%s", sd_log_buf);
2640 		mutex_exit(&sd_log_mutex);
2641 	}
2642 #ifdef SD_FAULT_INJECTION
2643 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::sd_injection_mask));
2644 	if (un->sd_injection_mask & component) {
2645 		mutex_enter(&sd_log_mutex);
2646 		va_start(ap, fmt);
2647 		(void) vsprintf(sd_log_buf, fmt, ap);
2648 		va_end(ap);
2649 		sd_injection_log(sd_log_buf, un);
2650 		mutex_exit(&sd_log_mutex);
2651 	}
2652 #endif
2653 }
2654 
2655 
2656 /*
2657  *    Function: sd_log_trace
2658  *
2659  * Description: This routine is called by the SD_TRACE macro for debug
2660  *		logging of trace conditions (i.e. function entry/exit).
2661  *
2662  *   Arguments: comp - driver component being logged
2663  *		dev  - pointer to driver info structure
2664  *		fmt  - trace string and format to be logged
2665  */
2666 
2667 static void
2668 sd_log_trace(uint_t component, struct sd_lun *un, const char *fmt, ...)
2669 {
2670 	va_list		ap;
2671 	dev_info_t	*dev;
2672 
2673 	ASSERT(un != NULL);
2674 	dev = SD_DEVINFO(un);
2675 	ASSERT(dev != NULL);
2676 
2677 	/*
2678 	 * Filter messages based on the global component and level masks.
2679 	 * Also print if un matches the value of sd_debug_un, or if
2680 	 * sd_debug_un is set to NULL.
2681 	 */
2682 	if ((sd_component_mask & component) &&
2683 	    (sd_level_mask & SD_LOGMASK_TRACE) &&
2684 	    ((sd_debug_un == NULL) || (sd_debug_un == un))) {
2685 		mutex_enter(&sd_log_mutex);
2686 		va_start(ap, fmt);
2687 		(void) vsprintf(sd_log_buf, fmt, ap);
2688 		va_end(ap);
2689 		scsi_log(dev, sd_label, CE_CONT, "%s", sd_log_buf);
2690 		mutex_exit(&sd_log_mutex);
2691 	}
2692 #ifdef SD_FAULT_INJECTION
2693 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::sd_injection_mask));
2694 	if (un->sd_injection_mask & component) {
2695 		mutex_enter(&sd_log_mutex);
2696 		va_start(ap, fmt);
2697 		(void) vsprintf(sd_log_buf, fmt, ap);
2698 		va_end(ap);
2699 		sd_injection_log(sd_log_buf, un);
2700 		mutex_exit(&sd_log_mutex);
2701 	}
2702 #endif
2703 }
2704 
2705 
2706 /*
2707  *    Function: sdprobe
2708  *
2709  * Description: This is the driver probe(9e) entry point function.
2710  *
2711  *   Arguments: devi - opaque device info handle
2712  *
2713  * Return Code: DDI_PROBE_SUCCESS: If the probe was successful.
2714  *              DDI_PROBE_FAILURE: If the probe failed.
2715  *              DDI_PROBE_PARTIAL: If the instance is not present now,
2716  *				   but may be present in the future.
2717  */
2718 
2719 static int
2720 sdprobe(dev_info_t *devi)
2721 {
2722 	struct scsi_device	*devp;
2723 	int			rval;
2724 	int			instance = ddi_get_instance(devi);
2725 
2726 	/*
2727 	 * if it wasn't for pln, sdprobe could actually be nulldev
2728 	 * in the "__fibre" case.
2729 	 */
2730 	if (ddi_dev_is_sid(devi) == DDI_SUCCESS) {
2731 		return (DDI_PROBE_DONTCARE);
2732 	}
2733 
2734 	devp = ddi_get_driver_private(devi);
2735 
2736 	if (devp == NULL) {
2737 		/* Ooops... nexus driver is mis-configured... */
2738 		return (DDI_PROBE_FAILURE);
2739 	}
2740 
2741 	if (ddi_get_soft_state(sd_state, instance) != NULL) {
2742 		return (DDI_PROBE_PARTIAL);
2743 	}
2744 
2745 	/*
2746 	 * Call the SCSA utility probe routine to see if we actually
2747 	 * have a target at this SCSI nexus.
2748 	 */
2749 	switch (sd_scsi_probe_with_cache(devp, NULL_FUNC)) {
2750 	case SCSIPROBE_EXISTS:
2751 		switch (devp->sd_inq->inq_dtype) {
2752 		case DTYPE_DIRECT:
2753 			rval = DDI_PROBE_SUCCESS;
2754 			break;
2755 		case DTYPE_RODIRECT:
2756 			/* CDs etc. Can be removable media */
2757 			rval = DDI_PROBE_SUCCESS;
2758 			break;
2759 		case DTYPE_OPTICAL:
2760 			/*
2761 			 * Rewritable optical driver HP115AA
2762 			 * Can also be removable media
2763 			 */
2764 
2765 			/*
2766 			 * Do not attempt to bind to  DTYPE_OPTICAL if
2767 			 * pre solaris 9 sparc sd behavior is required
2768 			 *
2769 			 * If first time through and sd_dtype_optical_bind
2770 			 * has not been set in /etc/system check properties
2771 			 */
2772 
2773 			if (sd_dtype_optical_bind  < 0) {
2774 				sd_dtype_optical_bind = ddi_prop_get_int
2775 				    (DDI_DEV_T_ANY, devi, 0,
2776 				    "optical-device-bind", 1);
2777 			}
2778 
2779 			if (sd_dtype_optical_bind == 0) {
2780 				rval = DDI_PROBE_FAILURE;
2781 			} else {
2782 				rval = DDI_PROBE_SUCCESS;
2783 			}
2784 			break;
2785 
2786 		case DTYPE_NOTPRESENT:
2787 		default:
2788 			rval = DDI_PROBE_FAILURE;
2789 			break;
2790 		}
2791 		break;
2792 	default:
2793 		rval = DDI_PROBE_PARTIAL;
2794 		break;
2795 	}
2796 
2797 	/*
2798 	 * This routine checks for resource allocation prior to freeing,
2799 	 * so it will take care of the "smart probing" case where a
2800 	 * scsi_probe() may or may not have been issued and will *not*
2801 	 * free previously-freed resources.
2802 	 */
2803 	scsi_unprobe(devp);
2804 	return (rval);
2805 }
2806 
2807 
2808 /*
2809  *    Function: sdinfo
2810  *
2811  * Description: This is the driver getinfo(9e) entry point function.
2812  *		Given the device number, return the devinfo pointer from
2813  *		the scsi_device structure or the instance number
2814  *		associated with the dev_t.
2815  *
2816  *   Arguments: dip     - pointer to device info structure
2817  *		infocmd - command argument (DDI_INFO_DEVT2DEVINFO,
2818  *			  DDI_INFO_DEVT2INSTANCE)
2819  *		arg     - driver dev_t
2820  *		resultp - user buffer for request response
2821  *
2822  * Return Code: DDI_SUCCESS
2823  *              DDI_FAILURE
2824  */
2825 /* ARGSUSED */
2826 static int
2827 sdinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
2828 {
2829 	struct sd_lun	*un;
2830 	dev_t		dev;
2831 	int		instance;
2832 	int		error;
2833 
2834 	switch (infocmd) {
2835 	case DDI_INFO_DEVT2DEVINFO:
2836 		dev = (dev_t)arg;
2837 		instance = SDUNIT(dev);
2838 		if ((un = ddi_get_soft_state(sd_state, instance)) == NULL) {
2839 			return (DDI_FAILURE);
2840 		}
2841 		*result = (void *) SD_DEVINFO(un);
2842 		error = DDI_SUCCESS;
2843 		break;
2844 	case DDI_INFO_DEVT2INSTANCE:
2845 		dev = (dev_t)arg;
2846 		instance = SDUNIT(dev);
2847 		*result = (void *)(uintptr_t)instance;
2848 		error = DDI_SUCCESS;
2849 		break;
2850 	default:
2851 		error = DDI_FAILURE;
2852 	}
2853 	return (error);
2854 }
2855 
2856 /*
2857  *    Function: sd_prop_op
2858  *
2859  * Description: This is the driver prop_op(9e) entry point function.
2860  *		Return the number of blocks for the partition in question
2861  *		or forward the request to the property facilities.
2862  *
2863  *   Arguments: dev       - device number
2864  *		dip       - pointer to device info structure
2865  *		prop_op   - property operator
2866  *		mod_flags - DDI_PROP_DONTPASS, don't pass to parent
2867  *		name      - pointer to property name
2868  *		valuep    - pointer or address of the user buffer
2869  *		lengthp   - property length
2870  *
2871  * Return Code: DDI_PROP_SUCCESS
2872  *              DDI_PROP_NOT_FOUND
2873  *              DDI_PROP_UNDEFINED
2874  *              DDI_PROP_NO_MEMORY
2875  *              DDI_PROP_BUF_TOO_SMALL
2876  */
2877 
2878 static int
2879 sd_prop_op(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op, int mod_flags,
2880     char *name, caddr_t valuep, int *lengthp)
2881 {
2882 	struct sd_lun	*un;
2883 
2884 	if ((un = ddi_get_soft_state(sd_state, ddi_get_instance(dip))) == NULL)
2885 		return (ddi_prop_op(dev, dip, prop_op, mod_flags,
2886 		    name, valuep, lengthp));
2887 
2888 	return (cmlb_prop_op(un->un_cmlbhandle,
2889 	    dev, dip, prop_op, mod_flags, name, valuep, lengthp,
2890 	    SDPART(dev), (void *)SD_PATH_DIRECT));
2891 }
2892 
2893 /*
2894  * The following functions are for smart probing:
2895  * sd_scsi_probe_cache_init()
2896  * sd_scsi_probe_cache_fini()
2897  * sd_scsi_clear_probe_cache()
2898  * sd_scsi_probe_with_cache()
2899  */
2900 
2901 /*
2902  *    Function: sd_scsi_probe_cache_init
2903  *
2904  * Description: Initializes the probe response cache mutex and head pointer.
2905  *
2906  *     Context: Kernel thread context
2907  */
2908 
2909 static void
2910 sd_scsi_probe_cache_init(void)
2911 {
2912 	mutex_init(&sd_scsi_probe_cache_mutex, NULL, MUTEX_DRIVER, NULL);
2913 	sd_scsi_probe_cache_head = NULL;
2914 }
2915 
2916 
2917 /*
2918  *    Function: sd_scsi_probe_cache_fini
2919  *
2920  * Description: Frees all resources associated with the probe response cache.
2921  *
2922  *     Context: Kernel thread context
2923  */
2924 
2925 static void
2926 sd_scsi_probe_cache_fini(void)
2927 {
2928 	struct sd_scsi_probe_cache *cp;
2929 	struct sd_scsi_probe_cache *ncp;
2930 
2931 	/* Clean up our smart probing linked list */
2932 	for (cp = sd_scsi_probe_cache_head; cp != NULL; cp = ncp) {
2933 		ncp = cp->next;
2934 		kmem_free(cp, sizeof (struct sd_scsi_probe_cache));
2935 	}
2936 	sd_scsi_probe_cache_head = NULL;
2937 	mutex_destroy(&sd_scsi_probe_cache_mutex);
2938 }
2939 
2940 
2941 /*
2942  *    Function: sd_scsi_clear_probe_cache
2943  *
2944  * Description: This routine clears the probe response cache. This is
2945  *		done when open() returns ENXIO so that when deferred
2946  *		attach is attempted (possibly after a device has been
2947  *		turned on) we will retry the probe. Since we don't know
2948  *		which target we failed to open, we just clear the
2949  *		entire cache.
2950  *
2951  *     Context: Kernel thread context
2952  */
2953 
2954 static void
2955 sd_scsi_clear_probe_cache(void)
2956 {
2957 	struct sd_scsi_probe_cache	*cp;
2958 	int				i;
2959 
2960 	mutex_enter(&sd_scsi_probe_cache_mutex);
2961 	for (cp = sd_scsi_probe_cache_head; cp != NULL; cp = cp->next) {
2962 		/*
2963 		 * Reset all entries to SCSIPROBE_EXISTS.  This will
2964 		 * force probing to be performed the next time
2965 		 * sd_scsi_probe_with_cache is called.
2966 		 */
2967 		for (i = 0; i < NTARGETS_WIDE; i++) {
2968 			cp->cache[i] = SCSIPROBE_EXISTS;
2969 		}
2970 	}
2971 	mutex_exit(&sd_scsi_probe_cache_mutex);
2972 }
2973 
2974 
2975 /*
2976  *    Function: sd_scsi_probe_with_cache
2977  *
2978  * Description: This routine implements support for a scsi device probe
2979  *		with cache. The driver maintains a cache of the target
2980  *		responses to scsi probes. If we get no response from a
2981  *		target during a probe inquiry, we remember that, and we
2982  *		avoid additional calls to scsi_probe on non-zero LUNs
2983  *		on the same target until the cache is cleared. By doing
2984  *		so we avoid the 1/4 sec selection timeout for nonzero
2985  *		LUNs. lun0 of a target is always probed.
2986  *
2987  *   Arguments: devp     - Pointer to a scsi_device(9S) structure
2988  *              waitfunc - indicates what the allocator routines should
2989  *			   do when resources are not available. This value
2990  *			   is passed on to scsi_probe() when that routine
2991  *			   is called.
2992  *
2993  * Return Code: SCSIPROBE_NORESP if a NORESP in probe response cache;
2994  *		otherwise the value returned by scsi_probe(9F).
2995  *
2996  *     Context: Kernel thread context
2997  */
2998 
2999 static int
3000 sd_scsi_probe_with_cache(struct scsi_device *devp, int (*waitfn)())
3001 {
3002 	struct sd_scsi_probe_cache	*cp;
3003 	dev_info_t	*pdip = ddi_get_parent(devp->sd_dev);
3004 	int		lun, tgt;
3005 
3006 	lun = ddi_prop_get_int(DDI_DEV_T_ANY, devp->sd_dev, DDI_PROP_DONTPASS,
3007 	    SCSI_ADDR_PROP_LUN, 0);
3008 	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, devp->sd_dev, DDI_PROP_DONTPASS,
3009 	    SCSI_ADDR_PROP_TARGET, -1);
3010 
3011 	/* Make sure caching enabled and target in range */
3012 	if ((tgt < 0) || (tgt >= NTARGETS_WIDE)) {
3013 		/* do it the old way (no cache) */
3014 		return (scsi_probe(devp, waitfn));
3015 	}
3016 
3017 	mutex_enter(&sd_scsi_probe_cache_mutex);
3018 
3019 	/* Find the cache for this scsi bus instance */
3020 	for (cp = sd_scsi_probe_cache_head; cp != NULL; cp = cp->next) {
3021 		if (cp->pdip == pdip) {
3022 			break;
3023 		}
3024 	}
3025 
3026 	/* If we can't find a cache for this pdip, create one */
3027 	if (cp == NULL) {
3028 		int i;
3029 
3030 		cp = kmem_zalloc(sizeof (struct sd_scsi_probe_cache),
3031 		    KM_SLEEP);
3032 		cp->pdip = pdip;
3033 		cp->next = sd_scsi_probe_cache_head;
3034 		sd_scsi_probe_cache_head = cp;
3035 		for (i = 0; i < NTARGETS_WIDE; i++) {
3036 			cp->cache[i] = SCSIPROBE_EXISTS;
3037 		}
3038 	}
3039 
3040 	mutex_exit(&sd_scsi_probe_cache_mutex);
3041 
3042 	/* Recompute the cache for this target if LUN zero */
3043 	if (lun == 0) {
3044 		cp->cache[tgt] = SCSIPROBE_EXISTS;
3045 	}
3046 
3047 	/* Don't probe if cache remembers a NORESP from a previous LUN. */
3048 	if (cp->cache[tgt] != SCSIPROBE_EXISTS) {
3049 		return (SCSIPROBE_NORESP);
3050 	}
3051 
3052 	/* Do the actual probe; save & return the result */
3053 	return (cp->cache[tgt] = scsi_probe(devp, waitfn));
3054 }
3055 
3056 
3057 /*
3058  *    Function: sd_scsi_target_lun_init
3059  *
3060  * Description: Initializes the attached lun chain mutex and head pointer.
3061  *
3062  *     Context: Kernel thread context
3063  */
3064 
3065 static void
3066 sd_scsi_target_lun_init(void)
3067 {
3068 	mutex_init(&sd_scsi_target_lun_mutex, NULL, MUTEX_DRIVER, NULL);
3069 	sd_scsi_target_lun_head = NULL;
3070 }
3071 
3072 
3073 /*
3074  *    Function: sd_scsi_target_lun_fini
3075  *
3076  * Description: Frees all resources associated with the attached lun
3077  *              chain
3078  *
3079  *     Context: Kernel thread context
3080  */
3081 
3082 static void
3083 sd_scsi_target_lun_fini(void)
3084 {
3085 	struct sd_scsi_hba_tgt_lun	*cp;
3086 	struct sd_scsi_hba_tgt_lun	*ncp;
3087 
3088 	for (cp = sd_scsi_target_lun_head; cp != NULL; cp = ncp) {
3089 		ncp = cp->next;
3090 		kmem_free(cp, sizeof (struct sd_scsi_hba_tgt_lun));
3091 	}
3092 	sd_scsi_target_lun_head = NULL;
3093 	mutex_destroy(&sd_scsi_target_lun_mutex);
3094 }
3095 
3096 
3097 /*
3098  *    Function: sd_scsi_get_target_lun_count
3099  *
3100  * Description: This routine will check in the attached lun chain to see
3101  *		how many luns are attached on the required SCSI controller
3102  *		and target. Currently, some capabilities like tagged queue
3103  *		are supported per target based by HBA. So all luns in a
3104  *		target have the same capabilities. Based on this assumption,
3105  *		sd should only set these capabilities once per target. This
3106  *		function is called when sd needs to decide how many luns
3107  *		already attached on a target.
3108  *
3109  *   Arguments: dip	- Pointer to the system's dev_info_t for the SCSI
3110  *			  controller device.
3111  *              target	- The target ID on the controller's SCSI bus.
3112  *
3113  * Return Code: The number of luns attached on the required target and
3114  *		controller.
3115  *		-1 if target ID is not in parallel SCSI scope or the given
3116  *		dip is not in the chain.
3117  *
3118  *     Context: Kernel thread context
3119  */
3120 
3121 static int
3122 sd_scsi_get_target_lun_count(dev_info_t *dip, int target)
3123 {
3124 	struct sd_scsi_hba_tgt_lun	*cp;
3125 
3126 	if ((target < 0) || (target >= NTARGETS_WIDE)) {
3127 		return (-1);
3128 	}
3129 
3130 	mutex_enter(&sd_scsi_target_lun_mutex);
3131 
3132 	for (cp = sd_scsi_target_lun_head; cp != NULL; cp = cp->next) {
3133 		if (cp->pdip == dip) {
3134 			break;
3135 		}
3136 	}
3137 
3138 	mutex_exit(&sd_scsi_target_lun_mutex);
3139 
3140 	if (cp == NULL) {
3141 		return (-1);
3142 	}
3143 
3144 	return (cp->nlun[target]);
3145 }
3146 
3147 
3148 /*
3149  *    Function: sd_scsi_update_lun_on_target
3150  *
3151  * Description: This routine is used to update the attached lun chain when a
3152  *		lun is attached or detached on a target.
3153  *
3154  *   Arguments: dip     - Pointer to the system's dev_info_t for the SCSI
3155  *                        controller device.
3156  *              target  - The target ID on the controller's SCSI bus.
3157  *		flag	- Indicate the lun is attached or detached.
3158  *
3159  *     Context: Kernel thread context
3160  */
3161 
3162 static void
3163 sd_scsi_update_lun_on_target(dev_info_t *dip, int target, int flag)
3164 {
3165 	struct sd_scsi_hba_tgt_lun	*cp;
3166 
3167 	mutex_enter(&sd_scsi_target_lun_mutex);
3168 
3169 	for (cp = sd_scsi_target_lun_head; cp != NULL; cp = cp->next) {
3170 		if (cp->pdip == dip) {
3171 			break;
3172 		}
3173 	}
3174 
3175 	if ((cp == NULL) && (flag == SD_SCSI_LUN_ATTACH)) {
3176 		cp = kmem_zalloc(sizeof (struct sd_scsi_hba_tgt_lun),
3177 		    KM_SLEEP);
3178 		cp->pdip = dip;
3179 		cp->next = sd_scsi_target_lun_head;
3180 		sd_scsi_target_lun_head = cp;
3181 	}
3182 
3183 	mutex_exit(&sd_scsi_target_lun_mutex);
3184 
3185 	if (cp != NULL) {
3186 		if (flag == SD_SCSI_LUN_ATTACH) {
3187 			cp->nlun[target] ++;
3188 		} else {
3189 			cp->nlun[target] --;
3190 		}
3191 	}
3192 }
3193 
3194 
3195 /*
3196  *    Function: sd_spin_up_unit
3197  *
3198  * Description: Issues the following commands to spin-up the device:
3199  *		START STOP UNIT, and INQUIRY.
3200  *
3201  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
3202  *                      structure for this target.
3203  *
3204  * Return Code: 0 - success
3205  *		EIO - failure
3206  *		EACCES - reservation conflict
3207  *
3208  *     Context: Kernel thread context
3209  */
3210 
3211 static int
3212 sd_spin_up_unit(sd_ssc_t *ssc)
3213 {
3214 	size_t	resid		= 0;
3215 	int	has_conflict	= FALSE;
3216 	uchar_t *bufaddr;
3217 	int	status;
3218 	struct sd_lun	*un;
3219 
3220 	ASSERT(ssc != NULL);
3221 	un = ssc->ssc_un;
3222 	ASSERT(un != NULL);
3223 
3224 	/*
3225 	 * Send a throwaway START UNIT command.
3226 	 *
3227 	 * If we fail on this, we don't care presently what precisely
3228 	 * is wrong.  EMC's arrays will also fail this with a check
3229 	 * condition (0x2/0x4/0x3) if the device is "inactive," but
3230 	 * we don't want to fail the attach because it may become
3231 	 * "active" later.
3232 	 * We don't know if power condition is supported or not at
3233 	 * this stage, use START STOP bit.
3234 	 */
3235 	status = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
3236 	    SD_TARGET_START, SD_PATH_DIRECT);
3237 
3238 	if (status != 0) {
3239 		if (status == EACCES)
3240 			has_conflict = TRUE;
3241 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3242 	}
3243 
3244 	/*
3245 	 * Send another INQUIRY command to the target. This is necessary for
3246 	 * non-removable media direct access devices because their INQUIRY data
3247 	 * may not be fully qualified until they are spun up (perhaps via the
3248 	 * START command above).  Note: This seems to be needed for some
3249 	 * legacy devices only.) The INQUIRY command should succeed even if a
3250 	 * Reservation Conflict is present.
3251 	 */
3252 	bufaddr = kmem_zalloc(SUN_INQSIZE, KM_SLEEP);
3253 
3254 	if (sd_send_scsi_INQUIRY(ssc, bufaddr, SUN_INQSIZE, 0, 0, &resid)
3255 	    != 0) {
3256 		kmem_free(bufaddr, SUN_INQSIZE);
3257 		sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
3258 		return (EIO);
3259 	}
3260 
3261 	/*
3262 	 * If we got enough INQUIRY data, copy it over the old INQUIRY data.
3263 	 * Note that this routine does not return a failure here even if the
3264 	 * INQUIRY command did not return any data.  This is a legacy behavior.
3265 	 */
3266 	if ((SUN_INQSIZE - resid) >= SUN_MIN_INQLEN) {
3267 		bcopy(bufaddr, SD_INQUIRY(un), SUN_INQSIZE);
3268 	}
3269 
3270 	kmem_free(bufaddr, SUN_INQSIZE);
3271 
3272 	/* If we hit a reservation conflict above, tell the caller. */
3273 	if (has_conflict == TRUE) {
3274 		return (EACCES);
3275 	}
3276 
3277 	return (0);
3278 }
3279 
3280 #ifdef _LP64
3281 /*
3282  *    Function: sd_enable_descr_sense
3283  *
3284  * Description: This routine attempts to select descriptor sense format
3285  *		using the Control mode page.  Devices that support 64 bit
3286  *		LBAs (for >2TB luns) should also implement descriptor
3287  *		sense data so we will call this function whenever we see
3288  *		a lun larger than 2TB.  If for some reason the device
3289  *		supports 64 bit LBAs but doesn't support descriptor sense
3290  *		presumably the mode select will fail.  Everything will
3291  *		continue to work normally except that we will not get
3292  *		complete sense data for commands that fail with an LBA
3293  *		larger than 32 bits.
3294  *
3295  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
3296  *                      structure for this target.
3297  *
3298  *     Context: Kernel thread context only
3299  */
3300 
3301 static void
3302 sd_enable_descr_sense(sd_ssc_t *ssc)
3303 {
3304 	uchar_t			*header;
3305 	struct mode_control_scsi3 *ctrl_bufp;
3306 	size_t			buflen;
3307 	size_t			bd_len;
3308 	int			status;
3309 	struct sd_lun		*un;
3310 
3311 	ASSERT(ssc != NULL);
3312 	un = ssc->ssc_un;
3313 	ASSERT(un != NULL);
3314 
3315 	/*
3316 	 * Read MODE SENSE page 0xA, Control Mode Page
3317 	 */
3318 	buflen = MODE_HEADER_LENGTH + MODE_BLK_DESC_LENGTH +
3319 	    sizeof (struct mode_control_scsi3);
3320 	header = kmem_zalloc(buflen, KM_SLEEP);
3321 
3322 	status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, header, buflen,
3323 	    MODEPAGE_CTRL_MODE, SD_PATH_DIRECT);
3324 
3325 	if (status != 0) {
3326 		SD_ERROR(SD_LOG_COMMON, un,
3327 		    "sd_enable_descr_sense: mode sense ctrl page failed\n");
3328 		goto eds_exit;
3329 	}
3330 
3331 	/*
3332 	 * Determine size of Block Descriptors in order to locate
3333 	 * the mode page data. ATAPI devices return 0, SCSI devices
3334 	 * should return MODE_BLK_DESC_LENGTH.
3335 	 */
3336 	bd_len  = ((struct mode_header *)header)->bdesc_length;
3337 
3338 	/* Clear the mode data length field for MODE SELECT */
3339 	((struct mode_header *)header)->length = 0;
3340 
3341 	ctrl_bufp = (struct mode_control_scsi3 *)
3342 	    (header + MODE_HEADER_LENGTH + bd_len);
3343 
3344 	/*
3345 	 * If the page length is smaller than the expected value,
3346 	 * the target device doesn't support D_SENSE. Bail out here.
3347 	 */
3348 	if (ctrl_bufp->mode_page.length <
3349 	    sizeof (struct mode_control_scsi3) - 2) {
3350 		SD_ERROR(SD_LOG_COMMON, un,
3351 		    "sd_enable_descr_sense: enable D_SENSE failed\n");
3352 		goto eds_exit;
3353 	}
3354 
3355 	/*
3356 	 * Clear PS bit for MODE SELECT
3357 	 */
3358 	ctrl_bufp->mode_page.ps = 0;
3359 
3360 	/*
3361 	 * Set D_SENSE to enable descriptor sense format.
3362 	 */
3363 	ctrl_bufp->d_sense = 1;
3364 
3365 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3366 
3367 	/*
3368 	 * Use MODE SELECT to commit the change to the D_SENSE bit
3369 	 */
3370 	status = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, header,
3371 	    buflen, SD_DONTSAVE_PAGE, SD_PATH_DIRECT);
3372 
3373 	if (status != 0) {
3374 		SD_INFO(SD_LOG_COMMON, un,
3375 		    "sd_enable_descr_sense: mode select ctrl page failed\n");
3376 	} else {
3377 		kmem_free(header, buflen);
3378 		return;
3379 	}
3380 
3381 eds_exit:
3382 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3383 	kmem_free(header, buflen);
3384 }
3385 
3386 /*
3387  *    Function: sd_reenable_dsense_task
3388  *
3389  * Description: Re-enable descriptor sense after device or bus reset
3390  *
3391  *     Context: Executes in a taskq() thread context
3392  */
3393 static void
3394 sd_reenable_dsense_task(void *arg)
3395 {
3396 	struct	sd_lun	*un = arg;
3397 	sd_ssc_t	*ssc;
3398 
3399 	ASSERT(un != NULL);
3400 
3401 	ssc = sd_ssc_init(un);
3402 	sd_enable_descr_sense(ssc);
3403 	sd_ssc_fini(ssc);
3404 }
3405 #endif /* _LP64 */
3406 
3407 /*
3408  *    Function: sd_set_mmc_caps
3409  *
3410  * Description: This routine determines if the device is MMC compliant and if
3411  *		the device supports CDDA via a mode sense of the CDVD
3412  *		capabilities mode page. Also checks if the device is a
3413  *		dvdram writable device.
3414  *
3415  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
3416  *                      structure for this target.
3417  *
3418  *     Context: Kernel thread context only
3419  */
3420 
3421 static void
3422 sd_set_mmc_caps(sd_ssc_t *ssc)
3423 {
3424 	struct mode_header_grp2		*sense_mhp;
3425 	uchar_t				*sense_page;
3426 	caddr_t				buf;
3427 	int				bd_len;
3428 	int				status;
3429 	struct uscsi_cmd		com;
3430 	int				rtn;
3431 	uchar_t				*out_data_rw, *out_data_hd;
3432 	uchar_t				*rqbuf_rw, *rqbuf_hd;
3433 	uchar_t				*out_data_gesn;
3434 	int				gesn_len;
3435 	struct sd_lun			*un;
3436 
3437 	ASSERT(ssc != NULL);
3438 	un = ssc->ssc_un;
3439 	ASSERT(un != NULL);
3440 
3441 	/*
3442 	 * The flags which will be set in this function are - mmc compliant,
3443 	 * dvdram writable device, cdda support. Initialize them to FALSE
3444 	 * and if a capability is detected - it will be set to TRUE.
3445 	 */
3446 	un->un_f_mmc_cap = FALSE;
3447 	un->un_f_dvdram_writable_device = FALSE;
3448 	un->un_f_cfg_cdda = FALSE;
3449 
3450 	buf = kmem_zalloc(BUFLEN_MODE_CDROM_CAP, KM_SLEEP);
3451 	status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, (uchar_t *)buf,
3452 	    BUFLEN_MODE_CDROM_CAP, MODEPAGE_CDROM_CAP, SD_PATH_DIRECT);
3453 
3454 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3455 
3456 	if (status != 0) {
3457 		/* command failed; just return */
3458 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3459 		return;
3460 	}
3461 	/*
3462 	 * If the mode sense request for the CDROM CAPABILITIES
3463 	 * page (0x2A) succeeds the device is assumed to be MMC.
3464 	 */
3465 	un->un_f_mmc_cap = TRUE;
3466 
3467 	/* See if GET STATUS EVENT NOTIFICATION is supported */
3468 	if (un->un_f_mmc_gesn_polling) {
3469 		gesn_len = SD_GESN_HEADER_LEN + SD_GESN_MEDIA_DATA_LEN;
3470 		out_data_gesn = kmem_zalloc(gesn_len, KM_SLEEP);
3471 
3472 		rtn = sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION(ssc,
3473 		    out_data_gesn, gesn_len, 1 << SD_GESN_MEDIA_CLASS);
3474 
3475 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3476 
3477 		if ((rtn != 0) || !sd_gesn_media_data_valid(out_data_gesn)) {
3478 			un->un_f_mmc_gesn_polling = FALSE;
3479 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
3480 			    "sd_set_mmc_caps: gesn not supported "
3481 			    "%d %x %x %x %x\n", rtn,
3482 			    out_data_gesn[0], out_data_gesn[1],
3483 			    out_data_gesn[2], out_data_gesn[3]);
3484 		}
3485 
3486 		kmem_free(out_data_gesn, gesn_len);
3487 	}
3488 
3489 	/* Get to the page data */
3490 	sense_mhp = (struct mode_header_grp2 *)buf;
3491 	bd_len = (sense_mhp->bdesc_length_hi << 8) |
3492 	    sense_mhp->bdesc_length_lo;
3493 	if (bd_len > MODE_BLK_DESC_LENGTH) {
3494 		/*
3495 		 * We did not get back the expected block descriptor
3496 		 * length so we cannot determine if the device supports
3497 		 * CDDA. However, we still indicate the device is MMC
3498 		 * according to the successful response to the page
3499 		 * 0x2A mode sense request.
3500 		 */
3501 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
3502 		    "sd_set_mmc_caps: Mode Sense returned "
3503 		    "invalid block descriptor length\n");
3504 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3505 		return;
3506 	}
3507 
3508 	/* See if read CDDA is supported */
3509 	sense_page = (uchar_t *)(buf + MODE_HEADER_LENGTH_GRP2 +
3510 	    bd_len);
3511 	un->un_f_cfg_cdda = (sense_page[5] & 0x01) ? TRUE : FALSE;
3512 
3513 	/* See if writing DVD RAM is supported. */
3514 	un->un_f_dvdram_writable_device = (sense_page[3] & 0x20) ? TRUE : FALSE;
3515 	if (un->un_f_dvdram_writable_device == TRUE) {
3516 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3517 		return;
3518 	}
3519 
3520 	/*
3521 	 * If the device presents DVD or CD capabilities in the mode
3522 	 * page, we can return here since a RRD will not have
3523 	 * these capabilities.
3524 	 */
3525 	if ((sense_page[2] & 0x3f) || (sense_page[3] & 0x3f)) {
3526 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3527 		return;
3528 	}
3529 	kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3530 
3531 	/*
3532 	 * If un->un_f_dvdram_writable_device is still FALSE,
3533 	 * check for a Removable Rigid Disk (RRD).  A RRD
3534 	 * device is identified by the features RANDOM_WRITABLE and
3535 	 * HARDWARE_DEFECT_MANAGEMENT.
3536 	 */
3537 	out_data_rw = kmem_zalloc(SD_CURRENT_FEATURE_LEN, KM_SLEEP);
3538 	rqbuf_rw = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3539 
3540 	rtn = sd_send_scsi_feature_GET_CONFIGURATION(ssc, &com, rqbuf_rw,
3541 	    SENSE_LENGTH, out_data_rw, SD_CURRENT_FEATURE_LEN,
3542 	    RANDOM_WRITABLE, SD_PATH_STANDARD);
3543 
3544 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3545 
3546 	if (rtn != 0) {
3547 		kmem_free(out_data_rw, SD_CURRENT_FEATURE_LEN);
3548 		kmem_free(rqbuf_rw, SENSE_LENGTH);
3549 		return;
3550 	}
3551 
3552 	out_data_hd = kmem_zalloc(SD_CURRENT_FEATURE_LEN, KM_SLEEP);
3553 	rqbuf_hd = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3554 
3555 	rtn = sd_send_scsi_feature_GET_CONFIGURATION(ssc, &com, rqbuf_hd,
3556 	    SENSE_LENGTH, out_data_hd, SD_CURRENT_FEATURE_LEN,
3557 	    HARDWARE_DEFECT_MANAGEMENT, SD_PATH_STANDARD);
3558 
3559 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3560 
3561 	if (rtn == 0) {
3562 		/*
3563 		 * We have good information, check for random writable
3564 		 * and hardware defect features.
3565 		 */
3566 		if ((out_data_rw[9] & RANDOM_WRITABLE) &&
3567 		    (out_data_hd[9] & HARDWARE_DEFECT_MANAGEMENT)) {
3568 			un->un_f_dvdram_writable_device = TRUE;
3569 		}
3570 	}
3571 
3572 	kmem_free(out_data_rw, SD_CURRENT_FEATURE_LEN);
3573 	kmem_free(rqbuf_rw, SENSE_LENGTH);
3574 	kmem_free(out_data_hd, SD_CURRENT_FEATURE_LEN);
3575 	kmem_free(rqbuf_hd, SENSE_LENGTH);
3576 }
3577 
3578 /*
3579  *    Function: sd_check_for_writable_cd
3580  *
3581  * Description: This routine determines if the media in the device is
3582  *		writable or not. It uses the get configuration command (0x46)
3583  *		to determine if the media is writable
3584  *
3585  *   Arguments: un - driver soft state (unit) structure
3586  *              path_flag - SD_PATH_DIRECT to use the USCSI "direct"
3587  *                           chain and the normal command waitq, or
3588  *                           SD_PATH_DIRECT_PRIORITY to use the USCSI
3589  *                           "direct" chain and bypass the normal command
3590  *                           waitq.
3591  *
3592  *     Context: Never called at interrupt context.
3593  */
3594 
3595 static void
3596 sd_check_for_writable_cd(sd_ssc_t *ssc, int path_flag)
3597 {
3598 	struct uscsi_cmd		com;
3599 	uchar_t				*out_data;
3600 	uchar_t				*rqbuf;
3601 	int				rtn;
3602 	uchar_t				*out_data_rw, *out_data_hd;
3603 	uchar_t				*rqbuf_rw, *rqbuf_hd;
3604 	struct mode_header_grp2		*sense_mhp;
3605 	uchar_t				*sense_page;
3606 	caddr_t				buf;
3607 	int				bd_len;
3608 	int				status;
3609 	struct sd_lun			*un;
3610 
3611 	ASSERT(ssc != NULL);
3612 	un = ssc->ssc_un;
3613 	ASSERT(un != NULL);
3614 	ASSERT(mutex_owned(SD_MUTEX(un)));
3615 
3616 	/*
3617 	 * Initialize the writable media to false, if configuration info.
3618 	 * tells us otherwise then only we will set it.
3619 	 */
3620 	un->un_f_mmc_writable_media = FALSE;
3621 	mutex_exit(SD_MUTEX(un));
3622 
3623 	out_data = kmem_zalloc(SD_PROFILE_HEADER_LEN, KM_SLEEP);
3624 	rqbuf = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3625 
3626 	rtn = sd_send_scsi_GET_CONFIGURATION(ssc, &com, rqbuf, SENSE_LENGTH,
3627 	    out_data, SD_PROFILE_HEADER_LEN, path_flag);
3628 
3629 	if (rtn != 0)
3630 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3631 
3632 	mutex_enter(SD_MUTEX(un));
3633 	if (rtn == 0) {
3634 		/*
3635 		 * We have good information, check for writable DVD.
3636 		 */
3637 		if ((out_data[6] == 0) && (out_data[7] == 0x12)) {
3638 			un->un_f_mmc_writable_media = TRUE;
3639 			kmem_free(out_data, SD_PROFILE_HEADER_LEN);
3640 			kmem_free(rqbuf, SENSE_LENGTH);
3641 			return;
3642 		}
3643 	}
3644 
3645 	kmem_free(out_data, SD_PROFILE_HEADER_LEN);
3646 	kmem_free(rqbuf, SENSE_LENGTH);
3647 
3648 	/*
3649 	 * Determine if this is a RRD type device.
3650 	 */
3651 	mutex_exit(SD_MUTEX(un));
3652 	buf = kmem_zalloc(BUFLEN_MODE_CDROM_CAP, KM_SLEEP);
3653 	status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, (uchar_t *)buf,
3654 	    BUFLEN_MODE_CDROM_CAP, MODEPAGE_CDROM_CAP, path_flag);
3655 
3656 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3657 
3658 	mutex_enter(SD_MUTEX(un));
3659 	if (status != 0) {
3660 		/* command failed; just return */
3661 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3662 		return;
3663 	}
3664 
3665 	/* Get to the page data */
3666 	sense_mhp = (struct mode_header_grp2 *)buf;
3667 	bd_len = (sense_mhp->bdesc_length_hi << 8) | sense_mhp->bdesc_length_lo;
3668 	if (bd_len > MODE_BLK_DESC_LENGTH) {
3669 		/*
3670 		 * We did not get back the expected block descriptor length so
3671 		 * we cannot check the mode page.
3672 		 */
3673 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
3674 		    "sd_check_for_writable_cd: Mode Sense returned "
3675 		    "invalid block descriptor length\n");
3676 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3677 		return;
3678 	}
3679 
3680 	/*
3681 	 * If the device presents DVD or CD capabilities in the mode
3682 	 * page, we can return here since a RRD device will not have
3683 	 * these capabilities.
3684 	 */
3685 	sense_page = (uchar_t *)(buf + MODE_HEADER_LENGTH_GRP2 + bd_len);
3686 	if ((sense_page[2] & 0x3f) || (sense_page[3] & 0x3f)) {
3687 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3688 		return;
3689 	}
3690 	kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3691 
3692 	/*
3693 	 * If un->un_f_mmc_writable_media is still FALSE,
3694 	 * check for RRD type media.  A RRD device is identified
3695 	 * by the features RANDOM_WRITABLE and HARDWARE_DEFECT_MANAGEMENT.
3696 	 */
3697 	mutex_exit(SD_MUTEX(un));
3698 	out_data_rw = kmem_zalloc(SD_CURRENT_FEATURE_LEN, KM_SLEEP);
3699 	rqbuf_rw = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3700 
3701 	rtn = sd_send_scsi_feature_GET_CONFIGURATION(ssc, &com, rqbuf_rw,
3702 	    SENSE_LENGTH, out_data_rw, SD_CURRENT_FEATURE_LEN,
3703 	    RANDOM_WRITABLE, path_flag);
3704 
3705 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3706 	if (rtn != 0) {
3707 		kmem_free(out_data_rw, SD_CURRENT_FEATURE_LEN);
3708 		kmem_free(rqbuf_rw, SENSE_LENGTH);
3709 		mutex_enter(SD_MUTEX(un));
3710 		return;
3711 	}
3712 
3713 	out_data_hd = kmem_zalloc(SD_CURRENT_FEATURE_LEN, KM_SLEEP);
3714 	rqbuf_hd = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3715 
3716 	rtn = sd_send_scsi_feature_GET_CONFIGURATION(ssc, &com, rqbuf_hd,
3717 	    SENSE_LENGTH, out_data_hd, SD_CURRENT_FEATURE_LEN,
3718 	    HARDWARE_DEFECT_MANAGEMENT, path_flag);
3719 
3720 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3721 	mutex_enter(SD_MUTEX(un));
3722 	if (rtn == 0) {
3723 		/*
3724 		 * We have good information, check for random writable
3725 		 * and hardware defect features as current.
3726 		 */
3727 		if ((out_data_rw[9] & RANDOM_WRITABLE) &&
3728 		    (out_data_rw[10] & 0x1) &&
3729 		    (out_data_hd[9] & HARDWARE_DEFECT_MANAGEMENT) &&
3730 		    (out_data_hd[10] & 0x1)) {
3731 			un->un_f_mmc_writable_media = TRUE;
3732 		}
3733 	}
3734 
3735 	kmem_free(out_data_rw, SD_CURRENT_FEATURE_LEN);
3736 	kmem_free(rqbuf_rw, SENSE_LENGTH);
3737 	kmem_free(out_data_hd, SD_CURRENT_FEATURE_LEN);
3738 	kmem_free(rqbuf_hd, SENSE_LENGTH);
3739 }
3740 
3741 /*
3742  *    Function: sd_read_unit_properties
3743  *
3744  * Description: The following implements a property lookup mechanism.
3745  *		Properties for particular disks (keyed on vendor, model
3746  *		and rev numbers) are sought in the sd.conf file via
3747  *		sd_process_sdconf_file(), and if not found there, are
3748  *		looked for in a list hardcoded in this driver via
3749  *		sd_process_sdconf_table() Once located the properties
3750  *		are used to update the driver unit structure.
3751  *
3752  *   Arguments: un - driver soft state (unit) structure
3753  */
3754 
3755 static void
3756 sd_read_unit_properties(struct sd_lun *un)
3757 {
3758 	/*
3759 	 * sd_process_sdconf_file returns SD_FAILURE if it cannot find
3760 	 * the "sd-config-list" property (from the sd.conf file) or if
3761 	 * there was not a match for the inquiry vid/pid. If this event
3762 	 * occurs the static driver configuration table is searched for
3763 	 * a match.
3764 	 */
3765 	ASSERT(un != NULL);
3766 	if (sd_process_sdconf_file(un) == SD_FAILURE) {
3767 		sd_process_sdconf_table(un);
3768 	}
3769 
3770 	/* check for LSI device */
3771 	sd_is_lsi(un);
3772 
3773 
3774 }
3775 
3776 
3777 /*
3778  *    Function: sd_process_sdconf_file
3779  *
3780  * Description: Use ddi_prop_lookup(9F) to obtain the properties from the
3781  *		driver's config file (ie, sd.conf) and update the driver
3782  *		soft state structure accordingly.
3783  *
3784  *   Arguments: un - driver soft state (unit) structure
3785  *
3786  * Return Code: SD_SUCCESS - The properties were successfully set according
3787  *			     to the driver configuration file.
3788  *		SD_FAILURE - The driver config list was not obtained or
3789  *			     there was no vid/pid match. This indicates that
3790  *			     the static config table should be used.
3791  *
3792  * The config file has a property, "sd-config-list". Currently we support
3793  * two kinds of formats. For both formats, the value of this property
3794  * is a list of duplets:
3795  *
3796  *  sd-config-list=
3797  *	<duplet>,
3798  *	[,<duplet>]*;
3799  *
3800  * For the improved format, where
3801  *
3802  *     <duplet>:= "<vid+pid>","<tunable-list>"
3803  *
3804  * and
3805  *
3806  *     <tunable-list>:=   <tunable> [, <tunable> ]*;
3807  *     <tunable> =        <name> : <value>
3808  *
3809  * The <vid+pid> is the string that is returned by the target device on a
3810  * SCSI inquiry command, the <tunable-list> contains one or more tunables
3811  * to apply to all target devices with the specified <vid+pid>.
3812  *
3813  * Each <tunable> is a "<name> : <value>" pair.
3814  *
3815  * For the old format, the structure of each duplet is as follows:
3816  *
3817  *  <duplet>:= "<vid+pid>","<data-property-name_list>"
3818  *
3819  * The first entry of the duplet is the device ID string (the concatenated
3820  * vid & pid; not to be confused with a device_id).  This is defined in
3821  * the same way as in the sd_disk_table.
3822  *
3823  * The second part of the duplet is a string that identifies a
3824  * data-property-name-list. The data-property-name-list is defined as
3825  * follows:
3826  *
3827  *  <data-property-name-list>:=<data-property-name> [<data-property-name>]
3828  *
3829  * The syntax of <data-property-name> depends on the <version> field.
3830  *
3831  * If version = SD_CONF_VERSION_1 we have the following syntax:
3832  *
3833  *	<data-property-name>:=<version>,<flags>,<prop0>,<prop1>,.....<propN>
3834  *
3835  * where the prop0 value will be used to set prop0 if bit0 set in the
3836  * flags, prop1 if bit1 set, etc. and N = SD_CONF_MAX_ITEMS -1
3837  *
3838  */
3839 
3840 static int
3841 sd_process_sdconf_file(struct sd_lun *un)
3842 {
3843 	char	**config_list = NULL;
3844 	uint_t	nelements;
3845 	char	*vidptr;
3846 	int	vidlen;
3847 	char	*dnlist_ptr;
3848 	char	*dataname_ptr;
3849 	char	*dataname_lasts;
3850 	int	*data_list = NULL;
3851 	uint_t	data_list_len;
3852 	int	rval = SD_FAILURE;
3853 	int	i;
3854 
3855 	ASSERT(un != NULL);
3856 
3857 	/* Obtain the configuration list associated with the .conf file */
3858 	if (ddi_prop_lookup_string_array(DDI_DEV_T_ANY, SD_DEVINFO(un),
3859 	    DDI_PROP_DONTPASS | DDI_PROP_NOTPROM, sd_config_list,
3860 	    &config_list, &nelements) != DDI_PROP_SUCCESS) {
3861 		return (SD_FAILURE);
3862 	}
3863 
3864 	/*
3865 	 * Compare vids in each duplet to the inquiry vid - if a match is
3866 	 * made, get the data value and update the soft state structure
3867 	 * accordingly.
3868 	 *
3869 	 * Each duplet should show as a pair of strings, return SD_FAILURE
3870 	 * otherwise.
3871 	 */
3872 	if (nelements & 1) {
3873 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
3874 		    "sd-config-list should show as pairs of strings.\n");
3875 		if (config_list)
3876 			ddi_prop_free(config_list);
3877 		return (SD_FAILURE);
3878 	}
3879 
3880 	for (i = 0; i < nelements; i += 2) {
3881 		/*
3882 		 * Note: The assumption here is that each vid entry is on
3883 		 * a unique line from its associated duplet.
3884 		 */
3885 		vidptr = config_list[i];
3886 		vidlen = (int)strlen(vidptr);
3887 		if (sd_sdconf_id_match(un, vidptr, vidlen) != SD_SUCCESS) {
3888 			continue;
3889 		}
3890 
3891 		/*
3892 		 * dnlist contains 1 or more blank separated
3893 		 * data-property-name entries
3894 		 */
3895 		dnlist_ptr = config_list[i + 1];
3896 
3897 		if (strchr(dnlist_ptr, ':') != NULL) {
3898 			/*
3899 			 * Decode the improved format sd-config-list.
3900 			 */
3901 			sd_nvpair_str_decode(un, dnlist_ptr);
3902 		} else {
3903 			/*
3904 			 * The old format sd-config-list, loop through all
3905 			 * data-property-name entries in the
3906 			 * data-property-name-list
3907 			 * setting the properties for each.
3908 			 */
3909 			for (dataname_ptr = sd_strtok_r(dnlist_ptr, " \t",
3910 			    &dataname_lasts); dataname_ptr != NULL;
3911 			    dataname_ptr = sd_strtok_r(NULL, " \t",
3912 			    &dataname_lasts)) {
3913 				int version;
3914 
3915 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
3916 				    "sd_process_sdconf_file: disk:%s, "
3917 				    "data:%s\n", vidptr, dataname_ptr);
3918 
3919 				/* Get the data list */
3920 				if (ddi_prop_lookup_int_array(DDI_DEV_T_ANY,
3921 				    SD_DEVINFO(un), 0, dataname_ptr, &data_list,
3922 				    &data_list_len) != DDI_PROP_SUCCESS) {
3923 					SD_INFO(SD_LOG_ATTACH_DETACH, un,
3924 					    "sd_process_sdconf_file: data "
3925 					    "property (%s) has no value\n",
3926 					    dataname_ptr);
3927 					continue;
3928 				}
3929 
3930 				version = data_list[0];
3931 
3932 				if (version == SD_CONF_VERSION_1) {
3933 					sd_tunables values;
3934 
3935 					/* Set the properties */
3936 					if (sd_chk_vers1_data(un, data_list[1],
3937 					    &data_list[2], data_list_len,
3938 					    dataname_ptr) == SD_SUCCESS) {
3939 						sd_get_tunables_from_conf(un,
3940 						    data_list[1], &data_list[2],
3941 						    &values);
3942 						sd_set_vers1_properties(un,
3943 						    data_list[1], &values);
3944 						rval = SD_SUCCESS;
3945 					} else {
3946 						rval = SD_FAILURE;
3947 					}
3948 				} else {
3949 					scsi_log(SD_DEVINFO(un), sd_label,
3950 					    CE_WARN, "data property %s version "
3951 					    "0x%x is invalid.",
3952 					    dataname_ptr, version);
3953 					rval = SD_FAILURE;
3954 				}
3955 				if (data_list)
3956 					ddi_prop_free(data_list);
3957 			}
3958 		}
3959 	}
3960 
3961 	/* free up the memory allocated by ddi_prop_lookup_string_array(). */
3962 	if (config_list) {
3963 		ddi_prop_free(config_list);
3964 	}
3965 
3966 	return (rval);
3967 }
3968 
3969 /*
3970  *    Function: sd_nvpair_str_decode()
3971  *
3972  * Description: Parse the improved format sd-config-list to get
3973  *    each entry of tunable, which includes a name-value pair.
3974  *    Then call sd_set_properties() to set the property.
3975  *
3976  *   Arguments: un - driver soft state (unit) structure
3977  *    nvpair_str - the tunable list
3978  */
3979 static void
3980 sd_nvpair_str_decode(struct sd_lun *un, char *nvpair_str)
3981 {
3982 	char	*nv, *name, *value, *token;
3983 	char	*nv_lasts, *v_lasts, *x_lasts;
3984 
3985 	for (nv = sd_strtok_r(nvpair_str, ",", &nv_lasts); nv != NULL;
3986 	    nv = sd_strtok_r(NULL, ",", &nv_lasts)) {
3987 		token = sd_strtok_r(nv, ":", &v_lasts);
3988 		name  = sd_strtok_r(token, " \t", &x_lasts);
3989 		token = sd_strtok_r(NULL, ":", &v_lasts);
3990 		value = sd_strtok_r(token, " \t", &x_lasts);
3991 		if (name == NULL || value == NULL) {
3992 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
3993 			    "sd_nvpair_str_decode: "
3994 			    "name or value is not valid!\n");
3995 		} else {
3996 			sd_set_properties(un, name, value);
3997 		}
3998 	}
3999 }
4000 
4001 /*
4002  *    Function: sd_strtok_r()
4003  *
4004  * Description: This function uses strpbrk and strspn to break
4005  *    string into tokens on sequentially subsequent calls. Return
4006  *    NULL when no non-separator characters remain. The first
4007  *    argument is NULL for subsequent calls.
4008  */
4009 static char *
4010 sd_strtok_r(char *string, const char *sepset, char **lasts)
4011 {
4012 	char	*q, *r;
4013 
4014 	/* First or subsequent call */
4015 	if (string == NULL)
4016 		string = *lasts;
4017 
4018 	if (string == NULL)
4019 		return (NULL);
4020 
4021 	/* Skip leading separators */
4022 	q = string + strspn(string, sepset);
4023 
4024 	if (*q == '\0')
4025 		return (NULL);
4026 
4027 	if ((r = strpbrk(q, sepset)) == NULL)
4028 		*lasts = NULL;
4029 	else {
4030 		*r = '\0';
4031 		*lasts = r + 1;
4032 	}
4033 	return (q);
4034 }
4035 
4036 /*
4037  *    Function: sd_set_properties()
4038  *
4039  * Description: Set device properties based on the improved
4040  *    format sd-config-list.
4041  *
4042  *   Arguments: un - driver soft state (unit) structure
4043  *    name  - supported tunable name
4044  *    value - tunable value
4045  */
4046 static void
4047 sd_set_properties(struct sd_lun *un, char *name, char *value)
4048 {
4049 	char	*endptr = NULL;
4050 	long	val = 0;
4051 
4052 	if (strcasecmp(name, "cache-nonvolatile") == 0) {
4053 		if (strcasecmp(value, "true") == 0) {
4054 			un->un_f_suppress_cache_flush = TRUE;
4055 		} else if (strcasecmp(value, "false") == 0) {
4056 			un->un_f_suppress_cache_flush = FALSE;
4057 		} else {
4058 			goto value_invalid;
4059 		}
4060 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4061 		    "suppress_cache_flush flag set to %d\n",
4062 		    un->un_f_suppress_cache_flush);
4063 		return;
4064 	}
4065 
4066 	if (strcasecmp(name, "controller-type") == 0) {
4067 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4068 			un->un_ctype = val;
4069 		} else {
4070 			goto value_invalid;
4071 		}
4072 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4073 		    "ctype set to %d\n", un->un_ctype);
4074 		return;
4075 	}
4076 
4077 	if (strcasecmp(name, "delay-busy") == 0) {
4078 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4079 			un->un_busy_timeout = drv_usectohz(val / 1000);
4080 		} else {
4081 			goto value_invalid;
4082 		}
4083 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4084 		    "busy_timeout set to %d\n", un->un_busy_timeout);
4085 		return;
4086 	}
4087 
4088 	if (strcasecmp(name, "disksort") == 0) {
4089 		if (strcasecmp(value, "true") == 0) {
4090 			un->un_f_disksort_disabled = FALSE;
4091 		} else if (strcasecmp(value, "false") == 0) {
4092 			un->un_f_disksort_disabled = TRUE;
4093 		} else {
4094 			goto value_invalid;
4095 		}
4096 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4097 		    "disksort disabled flag set to %d\n",
4098 		    un->un_f_disksort_disabled);
4099 		return;
4100 	}
4101 
4102 	if (strcasecmp(name, "power-condition") == 0) {
4103 		if (strcasecmp(value, "true") == 0) {
4104 			un->un_f_power_condition_disabled = FALSE;
4105 		} else if (strcasecmp(value, "false") == 0) {
4106 			un->un_f_power_condition_disabled = TRUE;
4107 		} else {
4108 			goto value_invalid;
4109 		}
4110 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4111 		    "power condition disabled flag set to %d\n",
4112 		    un->un_f_power_condition_disabled);
4113 		return;
4114 	}
4115 
4116 	if (strcasecmp(name, "timeout-releasereservation") == 0) {
4117 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4118 			un->un_reserve_release_time = val;
4119 		} else {
4120 			goto value_invalid;
4121 		}
4122 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4123 		    "reservation release timeout set to %d\n",
4124 		    un->un_reserve_release_time);
4125 		return;
4126 	}
4127 
4128 	if (strcasecmp(name, "reset-lun") == 0) {
4129 		if (strcasecmp(value, "true") == 0) {
4130 			un->un_f_lun_reset_enabled = TRUE;
4131 		} else if (strcasecmp(value, "false") == 0) {
4132 			un->un_f_lun_reset_enabled = FALSE;
4133 		} else {
4134 			goto value_invalid;
4135 		}
4136 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4137 		    "lun reset enabled flag set to %d\n",
4138 		    un->un_f_lun_reset_enabled);
4139 		return;
4140 	}
4141 
4142 	if (strcasecmp(name, "retries-busy") == 0) {
4143 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4144 			un->un_busy_retry_count = val;
4145 		} else {
4146 			goto value_invalid;
4147 		}
4148 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4149 		    "busy retry count set to %d\n", un->un_busy_retry_count);
4150 		return;
4151 	}
4152 
4153 	if (strcasecmp(name, "retries-timeout") == 0) {
4154 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4155 			un->un_retry_count = val;
4156 		} else {
4157 			goto value_invalid;
4158 		}
4159 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4160 		    "timeout retry count set to %d\n", un->un_retry_count);
4161 		return;
4162 	}
4163 
4164 	if (strcasecmp(name, "retries-notready") == 0) {
4165 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4166 			un->un_notready_retry_count = val;
4167 		} else {
4168 			goto value_invalid;
4169 		}
4170 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4171 		    "notready retry count set to %d\n",
4172 		    un->un_notready_retry_count);
4173 		return;
4174 	}
4175 
4176 	if (strcasecmp(name, "retries-reset") == 0) {
4177 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4178 			un->un_reset_retry_count = val;
4179 		} else {
4180 			goto value_invalid;
4181 		}
4182 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4183 		    "reset retry count set to %d\n",
4184 		    un->un_reset_retry_count);
4185 		return;
4186 	}
4187 
4188 	if (strcasecmp(name, "throttle-max") == 0) {
4189 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4190 			un->un_saved_throttle = un->un_throttle = val;
4191 		} else {
4192 			goto value_invalid;
4193 		}
4194 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4195 		    "throttle set to %d\n", un->un_throttle);
4196 	}
4197 
4198 	if (strcasecmp(name, "throttle-min") == 0) {
4199 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4200 			un->un_min_throttle = val;
4201 		} else {
4202 			goto value_invalid;
4203 		}
4204 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4205 		    "min throttle set to %d\n", un->un_min_throttle);
4206 	}
4207 
4208 	if (strcasecmp(name, "rmw-type") == 0) {
4209 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4210 			un->un_f_rmw_type = val;
4211 		} else {
4212 			goto value_invalid;
4213 		}
4214 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4215 		    "RMW type set to %d\n", un->un_f_rmw_type);
4216 	}
4217 
4218 	if (strcasecmp(name, "physical-block-size") == 0) {
4219 		if (ddi_strtol(value, &endptr, 0, &val) == 0 &&
4220 		    ISP2(val) && val >= un->un_tgt_blocksize &&
4221 		    val >= un->un_sys_blocksize) {
4222 			un->un_phy_blocksize = val;
4223 		} else {
4224 			goto value_invalid;
4225 		}
4226 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4227 		    "physical block size set to %d\n", un->un_phy_blocksize);
4228 	}
4229 
4230 	if (strcasecmp(name, "retries-victim") == 0) {
4231 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4232 			un->un_victim_retry_count = val;
4233 		} else {
4234 			goto value_invalid;
4235 		}
4236 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4237 		    "victim retry count set to %d\n",
4238 		    un->un_victim_retry_count);
4239 		return;
4240 	}
4241 
4242 	/*
4243 	 * Validate the throttle values.
4244 	 * If any of the numbers are invalid, set everything to defaults.
4245 	 */
4246 	if ((un->un_throttle < SD_LOWEST_VALID_THROTTLE) ||
4247 	    (un->un_min_throttle < SD_LOWEST_VALID_THROTTLE) ||
4248 	    (un->un_min_throttle > un->un_throttle)) {
4249 		un->un_saved_throttle = un->un_throttle = sd_max_throttle;
4250 		un->un_min_throttle = sd_min_throttle;
4251 	}
4252 
4253 	if (strcasecmp(name, "mmc-gesn-polling") == 0) {
4254 		if (strcasecmp(value, "true") == 0) {
4255 			un->un_f_mmc_gesn_polling = TRUE;
4256 		} else if (strcasecmp(value, "false") == 0) {
4257 			un->un_f_mmc_gesn_polling = FALSE;
4258 		} else {
4259 			goto value_invalid;
4260 		}
4261 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4262 		    "mmc-gesn-polling set to %d\n",
4263 		    un->un_f_mmc_gesn_polling);
4264 	}
4265 
4266 	return;
4267 
4268 value_invalid:
4269 	SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4270 	    "value of prop %s is invalid\n", name);
4271 }
4272 
4273 /*
4274  *    Function: sd_get_tunables_from_conf()
4275  *
4276  *
4277  *    This function reads the data list from the sd.conf file and pulls
4278  *    the values that can have numeric values as arguments and places
4279  *    the values in the appropriate sd_tunables member.
4280  *    Since the order of the data list members varies across platforms
4281  *    This function reads them from the data list in a platform specific
4282  *    order and places them into the correct sd_tunable member that is
4283  *    consistent across all platforms.
4284  */
4285 static void
4286 sd_get_tunables_from_conf(struct sd_lun *un, int flags, int *data_list,
4287     sd_tunables *values)
4288 {
4289 	int i;
4290 	int mask;
4291 
4292 	bzero(values, sizeof (sd_tunables));
4293 
4294 	for (i = 0; i < SD_CONF_MAX_ITEMS; i++) {
4295 
4296 		mask = 1 << i;
4297 		if (mask > flags) {
4298 			break;
4299 		}
4300 
4301 		switch (mask & flags) {
4302 		case 0:	/* This mask bit not set in flags */
4303 			continue;
4304 		case SD_CONF_BSET_THROTTLE:
4305 			values->sdt_throttle = data_list[i];
4306 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4307 			    "sd_get_tunables_from_conf: throttle = %d\n",
4308 			    values->sdt_throttle);
4309 			break;
4310 		case SD_CONF_BSET_CTYPE:
4311 			values->sdt_ctype = data_list[i];
4312 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4313 			    "sd_get_tunables_from_conf: ctype = %d\n",
4314 			    values->sdt_ctype);
4315 			break;
4316 		case SD_CONF_BSET_NRR_COUNT:
4317 			values->sdt_not_rdy_retries = data_list[i];
4318 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4319 			    "sd_get_tunables_from_conf: not_rdy_retries = %d\n",
4320 			    values->sdt_not_rdy_retries);
4321 			break;
4322 		case SD_CONF_BSET_BSY_RETRY_COUNT:
4323 			values->sdt_busy_retries = data_list[i];
4324 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4325 			    "sd_get_tunables_from_conf: busy_retries = %d\n",
4326 			    values->sdt_busy_retries);
4327 			break;
4328 		case SD_CONF_BSET_RST_RETRIES:
4329 			values->sdt_reset_retries = data_list[i];
4330 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4331 			    "sd_get_tunables_from_conf: reset_retries = %d\n",
4332 			    values->sdt_reset_retries);
4333 			break;
4334 		case SD_CONF_BSET_RSV_REL_TIME:
4335 			values->sdt_reserv_rel_time = data_list[i];
4336 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4337 			    "sd_get_tunables_from_conf: reserv_rel_time = %d\n",
4338 			    values->sdt_reserv_rel_time);
4339 			break;
4340 		case SD_CONF_BSET_MIN_THROTTLE:
4341 			values->sdt_min_throttle = data_list[i];
4342 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4343 			    "sd_get_tunables_from_conf: min_throttle = %d\n",
4344 			    values->sdt_min_throttle);
4345 			break;
4346 		case SD_CONF_BSET_DISKSORT_DISABLED:
4347 			values->sdt_disk_sort_dis = data_list[i];
4348 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4349 			    "sd_get_tunables_from_conf: disk_sort_dis = %d\n",
4350 			    values->sdt_disk_sort_dis);
4351 			break;
4352 		case SD_CONF_BSET_LUN_RESET_ENABLED:
4353 			values->sdt_lun_reset_enable = data_list[i];
4354 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4355 			    "sd_get_tunables_from_conf: lun_reset_enable = %d"
4356 			    "\n", values->sdt_lun_reset_enable);
4357 			break;
4358 		case SD_CONF_BSET_CACHE_IS_NV:
4359 			values->sdt_suppress_cache_flush = data_list[i];
4360 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4361 			    "sd_get_tunables_from_conf: \
4362 			    suppress_cache_flush = %d"
4363 			    "\n", values->sdt_suppress_cache_flush);
4364 			break;
4365 		case SD_CONF_BSET_PC_DISABLED:
4366 			values->sdt_disk_sort_dis = data_list[i];
4367 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4368 			    "sd_get_tunables_from_conf: power_condition_dis = "
4369 			    "%d\n", values->sdt_power_condition_dis);
4370 			break;
4371 		}
4372 	}
4373 }
4374 
4375 /*
4376  *    Function: sd_process_sdconf_table
4377  *
4378  * Description: Search the static configuration table for a match on the
4379  *		inquiry vid/pid and update the driver soft state structure
4380  *		according to the table property values for the device.
4381  *
4382  *		The form of a configuration table entry is:
4383  *		  <vid+pid>,<flags>,<property-data>
4384  *		  "SEAGATE ST42400N",1,0x40000,
4385  *		  0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1;
4386  *
4387  *   Arguments: un - driver soft state (unit) structure
4388  */
4389 
4390 static void
4391 sd_process_sdconf_table(struct sd_lun *un)
4392 {
4393 	char	*id = NULL;
4394 	int	table_index;
4395 	int	idlen;
4396 
4397 	ASSERT(un != NULL);
4398 	for (table_index = 0; table_index < sd_disk_table_size;
4399 	    table_index++) {
4400 		id = sd_disk_table[table_index].device_id;
4401 		idlen = strlen(id);
4402 
4403 		/*
4404 		 * The static configuration table currently does not
4405 		 * implement version 10 properties. Additionally,
4406 		 * multiple data-property-name entries are not
4407 		 * implemented in the static configuration table.
4408 		 */
4409 		if (sd_sdconf_id_match(un, id, idlen) == SD_SUCCESS) {
4410 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4411 			    "sd_process_sdconf_table: disk %s\n", id);
4412 			sd_set_vers1_properties(un,
4413 			    sd_disk_table[table_index].flags,
4414 			    sd_disk_table[table_index].properties);
4415 			break;
4416 		}
4417 	}
4418 }
4419 
4420 
4421 /*
4422  *    Function: sd_sdconf_id_match
4423  *
4424  * Description: This local function implements a case sensitive vid/pid
4425  *		comparison as well as the boundary cases of wild card and
4426  *		multiple blanks.
4427  *
4428  *		Note: An implicit assumption made here is that the scsi
4429  *		inquiry structure will always keep the vid, pid and
4430  *		revision strings in consecutive sequence, so they can be
4431  *		read as a single string. If this assumption is not the
4432  *		case, a separate string, to be used for the check, needs
4433  *		to be built with these strings concatenated.
4434  *
4435  *   Arguments: un - driver soft state (unit) structure
4436  *		id - table or config file vid/pid
4437  *		idlen  - length of the vid/pid (bytes)
4438  *
4439  * Return Code: SD_SUCCESS - Indicates a match with the inquiry vid/pid
4440  *		SD_FAILURE - Indicates no match with the inquiry vid/pid
4441  */
4442 
4443 static int
4444 sd_sdconf_id_match(struct sd_lun *un, char *id, int idlen)
4445 {
4446 	struct scsi_inquiry	*sd_inq;
4447 	int			rval = SD_SUCCESS;
4448 
4449 	ASSERT(un != NULL);
4450 	sd_inq = un->un_sd->sd_inq;
4451 	ASSERT(id != NULL);
4452 
4453 	/*
4454 	 * We use the inq_vid as a pointer to a buffer containing the
4455 	 * vid and pid and use the entire vid/pid length of the table
4456 	 * entry for the comparison. This works because the inq_pid
4457 	 * data member follows inq_vid in the scsi_inquiry structure.
4458 	 */
4459 	if (strncasecmp(sd_inq->inq_vid, id, idlen) != 0) {
4460 		/*
4461 		 * The user id string is compared to the inquiry vid/pid
4462 		 * using a case insensitive comparison and ignoring
4463 		 * multiple spaces.
4464 		 */
4465 		rval = sd_blank_cmp(un, id, idlen);
4466 		if (rval != SD_SUCCESS) {
4467 			/*
4468 			 * User id strings that start and end with a "*"
4469 			 * are a special case. These do not have a
4470 			 * specific vendor, and the product string can
4471 			 * appear anywhere in the 16 byte PID portion of
4472 			 * the inquiry data. This is a simple strstr()
4473 			 * type search for the user id in the inquiry data.
4474 			 */
4475 			if ((id[0] == '*') && (id[idlen - 1] == '*')) {
4476 				char	*pidptr = &id[1];
4477 				int	i;
4478 				int	j;
4479 				int	pidstrlen = idlen - 2;
4480 				j = sizeof (SD_INQUIRY(un)->inq_pid) -
4481 				    pidstrlen;
4482 
4483 				if (j < 0) {
4484 					return (SD_FAILURE);
4485 				}
4486 				for (i = 0; i < j; i++) {
4487 					if (bcmp(&SD_INQUIRY(un)->inq_pid[i],
4488 					    pidptr, pidstrlen) == 0) {
4489 						rval = SD_SUCCESS;
4490 						break;
4491 					}
4492 				}
4493 			}
4494 		}
4495 	}
4496 	return (rval);
4497 }
4498 
4499 
4500 /*
4501  *    Function: sd_blank_cmp
4502  *
4503  * Description: If the id string starts and ends with a space, treat
4504  *		multiple consecutive spaces as equivalent to a single
4505  *		space. For example, this causes a sd_disk_table entry
4506  *		of " NEC CDROM " to match a device's id string of
4507  *		"NEC       CDROM".
4508  *
4509  *		Note: The success exit condition for this routine is if
4510  *		the pointer to the table entry is '\0' and the cnt of
4511  *		the inquiry length is zero. This will happen if the inquiry
4512  *		string returned by the device is padded with spaces to be
4513  *		exactly 24 bytes in length (8 byte vid + 16 byte pid). The
4514  *		SCSI spec states that the inquiry string is to be padded with
4515  *		spaces.
4516  *
4517  *   Arguments: un - driver soft state (unit) structure
4518  *		id - table or config file vid/pid
4519  *		idlen  - length of the vid/pid (bytes)
4520  *
4521  * Return Code: SD_SUCCESS - Indicates a match with the inquiry vid/pid
4522  *		SD_FAILURE - Indicates no match with the inquiry vid/pid
4523  */
4524 
4525 static int
4526 sd_blank_cmp(struct sd_lun *un, char *id, int idlen)
4527 {
4528 	char		*p1;
4529 	char		*p2;
4530 	int		cnt;
4531 	cnt = sizeof (SD_INQUIRY(un)->inq_vid) +
4532 	    sizeof (SD_INQUIRY(un)->inq_pid);
4533 
4534 	ASSERT(un != NULL);
4535 	p2 = un->un_sd->sd_inq->inq_vid;
4536 	ASSERT(id != NULL);
4537 	p1 = id;
4538 
4539 	if ((id[0] == ' ') && (id[idlen - 1] == ' ')) {
4540 		/*
4541 		 * Note: string p1 is terminated by a NUL but string p2
4542 		 * isn't.  The end of p2 is determined by cnt.
4543 		 */
4544 		for (;;) {
4545 			/* skip over any extra blanks in both strings */
4546 			while ((*p1 != '\0') && (*p1 == ' ')) {
4547 				p1++;
4548 			}
4549 			while ((cnt != 0) && (*p2 == ' ')) {
4550 				p2++;
4551 				cnt--;
4552 			}
4553 
4554 			/* compare the two strings */
4555 			if ((cnt == 0) ||
4556 			    (SD_TOUPPER(*p1) != SD_TOUPPER(*p2))) {
4557 				break;
4558 			}
4559 			while ((cnt > 0) &&
4560 			    (SD_TOUPPER(*p1) == SD_TOUPPER(*p2))) {
4561 				p1++;
4562 				p2++;
4563 				cnt--;
4564 			}
4565 		}
4566 	}
4567 
4568 	/* return SD_SUCCESS if both strings match */
4569 	return (((*p1 == '\0') && (cnt == 0)) ? SD_SUCCESS : SD_FAILURE);
4570 }
4571 
4572 
4573 /*
4574  *    Function: sd_chk_vers1_data
4575  *
4576  * Description: Verify the version 1 device properties provided by the
4577  *		user via the configuration file
4578  *
4579  *   Arguments: un	     - driver soft state (unit) structure
4580  *		flags	     - integer mask indicating properties to be set
4581  *		prop_list    - integer list of property values
4582  *		list_len     - number of the elements
4583  *
4584  * Return Code: SD_SUCCESS - Indicates the user provided data is valid
4585  *		SD_FAILURE - Indicates the user provided data is invalid
4586  */
4587 
4588 static int
4589 sd_chk_vers1_data(struct sd_lun *un, int flags, int *prop_list,
4590     int list_len, char *dataname_ptr)
4591 {
4592 	int i;
4593 	int mask = 1;
4594 	int index = 0;
4595 
4596 	ASSERT(un != NULL);
4597 
4598 	/* Check for a NULL property name and list */
4599 	if (dataname_ptr == NULL) {
4600 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4601 		    "sd_chk_vers1_data: NULL data property name.");
4602 		return (SD_FAILURE);
4603 	}
4604 	if (prop_list == NULL) {
4605 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4606 		    "sd_chk_vers1_data: %s NULL data property list.",
4607 		    dataname_ptr);
4608 		return (SD_FAILURE);
4609 	}
4610 
4611 	/* Display a warning if undefined bits are set in the flags */
4612 	if (flags & ~SD_CONF_BIT_MASK) {
4613 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4614 		    "sd_chk_vers1_data: invalid bits 0x%x in data list %s. "
4615 		    "Properties not set.",
4616 		    (flags & ~SD_CONF_BIT_MASK), dataname_ptr);
4617 		return (SD_FAILURE);
4618 	}
4619 
4620 	/*
4621 	 * Verify the length of the list by identifying the highest bit set
4622 	 * in the flags and validating that the property list has a length
4623 	 * up to the index of this bit.
4624 	 */
4625 	for (i = 0; i < SD_CONF_MAX_ITEMS; i++) {
4626 		if (flags & mask) {
4627 			index++;
4628 		}
4629 		mask = 1 << i;
4630 	}
4631 	if (list_len < (index + 2)) {
4632 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4633 		    "sd_chk_vers1_data: "
4634 		    "Data property list %s size is incorrect. "
4635 		    "Properties not set.", dataname_ptr);
4636 		scsi_log(SD_DEVINFO(un), sd_label, CE_CONT, "Size expected: "
4637 		    "version + 1 flagword + %d properties", SD_CONF_MAX_ITEMS);
4638 		return (SD_FAILURE);
4639 	}
4640 	return (SD_SUCCESS);
4641 }
4642 
4643 
4644 /*
4645  *    Function: sd_set_vers1_properties
4646  *
4647  * Description: Set version 1 device properties based on a property list
4648  *		retrieved from the driver configuration file or static
4649  *		configuration table. Version 1 properties have the format:
4650  *
4651  *	<data-property-name>:=<version>,<flags>,<prop0>,<prop1>,.....<propN>
4652  *
4653  *		where the prop0 value will be used to set prop0 if bit0
4654  *		is set in the flags
4655  *
4656  *   Arguments: un	     - driver soft state (unit) structure
4657  *		flags	     - integer mask indicating properties to be set
4658  *		prop_list    - integer list of property values
4659  */
4660 
4661 static void
4662 sd_set_vers1_properties(struct sd_lun *un, int flags, sd_tunables *prop_list)
4663 {
4664 	ASSERT(un != NULL);
4665 
4666 	/*
4667 	 * Set the flag to indicate cache is to be disabled. An attempt
4668 	 * to disable the cache via sd_cache_control() will be made
4669 	 * later during attach once the basic initialization is complete.
4670 	 */
4671 	if (flags & SD_CONF_BSET_NOCACHE) {
4672 		un->un_f_opt_disable_cache = TRUE;
4673 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4674 		    "sd_set_vers1_properties: caching disabled flag set\n");
4675 	}
4676 
4677 	/* CD-specific configuration parameters */
4678 	if (flags & SD_CONF_BSET_PLAYMSF_BCD) {
4679 		un->un_f_cfg_playmsf_bcd = TRUE;
4680 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4681 		    "sd_set_vers1_properties: playmsf_bcd set\n");
4682 	}
4683 	if (flags & SD_CONF_BSET_READSUB_BCD) {
4684 		un->un_f_cfg_readsub_bcd = TRUE;
4685 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4686 		    "sd_set_vers1_properties: readsub_bcd set\n");
4687 	}
4688 	if (flags & SD_CONF_BSET_READ_TOC_TRK_BCD) {
4689 		un->un_f_cfg_read_toc_trk_bcd = TRUE;
4690 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4691 		    "sd_set_vers1_properties: read_toc_trk_bcd set\n");
4692 	}
4693 	if (flags & SD_CONF_BSET_READ_TOC_ADDR_BCD) {
4694 		un->un_f_cfg_read_toc_addr_bcd = TRUE;
4695 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4696 		    "sd_set_vers1_properties: read_toc_addr_bcd set\n");
4697 	}
4698 	if (flags & SD_CONF_BSET_NO_READ_HEADER) {
4699 		un->un_f_cfg_no_read_header = TRUE;
4700 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4701 		    "sd_set_vers1_properties: no_read_header set\n");
4702 	}
4703 	if (flags & SD_CONF_BSET_READ_CD_XD4) {
4704 		un->un_f_cfg_read_cd_xd4 = TRUE;
4705 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4706 		    "sd_set_vers1_properties: read_cd_xd4 set\n");
4707 	}
4708 
4709 	/* Support for devices which do not have valid/unique serial numbers */
4710 	if (flags & SD_CONF_BSET_FAB_DEVID) {
4711 		un->un_f_opt_fab_devid = TRUE;
4712 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4713 		    "sd_set_vers1_properties: fab_devid bit set\n");
4714 	}
4715 
4716 	/* Support for user throttle configuration */
4717 	if (flags & SD_CONF_BSET_THROTTLE) {
4718 		ASSERT(prop_list != NULL);
4719 		un->un_saved_throttle = un->un_throttle =
4720 		    prop_list->sdt_throttle;
4721 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4722 		    "sd_set_vers1_properties: throttle set to %d\n",
4723 		    prop_list->sdt_throttle);
4724 	}
4725 
4726 	/* Set the per disk retry count according to the conf file or table. */
4727 	if (flags & SD_CONF_BSET_NRR_COUNT) {
4728 		ASSERT(prop_list != NULL);
4729 		if (prop_list->sdt_not_rdy_retries) {
4730 			un->un_notready_retry_count =
4731 			    prop_list->sdt_not_rdy_retries;
4732 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4733 			    "sd_set_vers1_properties: not ready retry count"
4734 			    " set to %d\n", un->un_notready_retry_count);
4735 		}
4736 	}
4737 
4738 	/* The controller type is reported for generic disk driver ioctls */
4739 	if (flags & SD_CONF_BSET_CTYPE) {
4740 		ASSERT(prop_list != NULL);
4741 		switch (prop_list->sdt_ctype) {
4742 		case CTYPE_CDROM:
4743 			un->un_ctype = prop_list->sdt_ctype;
4744 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4745 			    "sd_set_vers1_properties: ctype set to "
4746 			    "CTYPE_CDROM\n");
4747 			break;
4748 		case CTYPE_CCS:
4749 			un->un_ctype = prop_list->sdt_ctype;
4750 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4751 			    "sd_set_vers1_properties: ctype set to "
4752 			    "CTYPE_CCS\n");
4753 			break;
4754 		case CTYPE_ROD:		/* RW optical */
4755 			un->un_ctype = prop_list->sdt_ctype;
4756 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4757 			    "sd_set_vers1_properties: ctype set to "
4758 			    "CTYPE_ROD\n");
4759 			break;
4760 		default:
4761 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4762 			    "sd_set_vers1_properties: Could not set "
4763 			    "invalid ctype value (%d)",
4764 			    prop_list->sdt_ctype);
4765 		}
4766 	}
4767 
4768 	/* Purple failover timeout */
4769 	if (flags & SD_CONF_BSET_BSY_RETRY_COUNT) {
4770 		ASSERT(prop_list != NULL);
4771 		un->un_busy_retry_count =
4772 		    prop_list->sdt_busy_retries;
4773 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4774 		    "sd_set_vers1_properties: "
4775 		    "busy retry count set to %d\n",
4776 		    un->un_busy_retry_count);
4777 	}
4778 
4779 	/* Purple reset retry count */
4780 	if (flags & SD_CONF_BSET_RST_RETRIES) {
4781 		ASSERT(prop_list != NULL);
4782 		un->un_reset_retry_count =
4783 		    prop_list->sdt_reset_retries;
4784 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4785 		    "sd_set_vers1_properties: "
4786 		    "reset retry count set to %d\n",
4787 		    un->un_reset_retry_count);
4788 	}
4789 
4790 	/* Purple reservation release timeout */
4791 	if (flags & SD_CONF_BSET_RSV_REL_TIME) {
4792 		ASSERT(prop_list != NULL);
4793 		un->un_reserve_release_time =
4794 		    prop_list->sdt_reserv_rel_time;
4795 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4796 		    "sd_set_vers1_properties: "
4797 		    "reservation release timeout set to %d\n",
4798 		    un->un_reserve_release_time);
4799 	}
4800 
4801 	/*
4802 	 * Driver flag telling the driver to verify that no commands are pending
4803 	 * for a device before issuing a Test Unit Ready. This is a workaround
4804 	 * for a firmware bug in some Seagate eliteI drives.
4805 	 */
4806 	if (flags & SD_CONF_BSET_TUR_CHECK) {
4807 		un->un_f_cfg_tur_check = TRUE;
4808 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4809 		    "sd_set_vers1_properties: tur queue check set\n");
4810 	}
4811 
4812 	if (flags & SD_CONF_BSET_MIN_THROTTLE) {
4813 		un->un_min_throttle = prop_list->sdt_min_throttle;
4814 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4815 		    "sd_set_vers1_properties: min throttle set to %d\n",
4816 		    un->un_min_throttle);
4817 	}
4818 
4819 	if (flags & SD_CONF_BSET_DISKSORT_DISABLED) {
4820 		un->un_f_disksort_disabled =
4821 		    (prop_list->sdt_disk_sort_dis != 0) ?
4822 		    TRUE : FALSE;
4823 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4824 		    "sd_set_vers1_properties: disksort disabled "
4825 		    "flag set to %d\n",
4826 		    prop_list->sdt_disk_sort_dis);
4827 	}
4828 
4829 	if (flags & SD_CONF_BSET_LUN_RESET_ENABLED) {
4830 		un->un_f_lun_reset_enabled =
4831 		    (prop_list->sdt_lun_reset_enable != 0) ?
4832 		    TRUE : FALSE;
4833 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4834 		    "sd_set_vers1_properties: lun reset enabled "
4835 		    "flag set to %d\n",
4836 		    prop_list->sdt_lun_reset_enable);
4837 	}
4838 
4839 	if (flags & SD_CONF_BSET_CACHE_IS_NV) {
4840 		un->un_f_suppress_cache_flush =
4841 		    (prop_list->sdt_suppress_cache_flush != 0) ?
4842 		    TRUE : FALSE;
4843 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4844 		    "sd_set_vers1_properties: suppress_cache_flush "
4845 		    "flag set to %d\n",
4846 		    prop_list->sdt_suppress_cache_flush);
4847 	}
4848 
4849 	if (flags & SD_CONF_BSET_PC_DISABLED) {
4850 		un->un_f_power_condition_disabled =
4851 		    (prop_list->sdt_power_condition_dis != 0) ?
4852 		    TRUE : FALSE;
4853 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4854 		    "sd_set_vers1_properties: power_condition_disabled "
4855 		    "flag set to %d\n",
4856 		    prop_list->sdt_power_condition_dis);
4857 	}
4858 
4859 	/*
4860 	 * Validate the throttle values.
4861 	 * If any of the numbers are invalid, set everything to defaults.
4862 	 */
4863 	if ((un->un_throttle < SD_LOWEST_VALID_THROTTLE) ||
4864 	    (un->un_min_throttle < SD_LOWEST_VALID_THROTTLE) ||
4865 	    (un->un_min_throttle > un->un_throttle)) {
4866 		un->un_saved_throttle = un->un_throttle = sd_max_throttle;
4867 		un->un_min_throttle = sd_min_throttle;
4868 	}
4869 }
4870 
4871 /*
4872  *   Function: sd_is_lsi()
4873  *
4874  *   Description: Check for lsi devices, step through the static device
4875  *	table to match vid/pid.
4876  *
4877  *   Args: un - ptr to sd_lun
4878  *
4879  *   Notes:  When creating new LSI property, need to add the new LSI property
4880  *		to this function.
4881  */
4882 static void
4883 sd_is_lsi(struct sd_lun *un)
4884 {
4885 	char	*id = NULL;
4886 	int	table_index;
4887 	int	idlen;
4888 	void	*prop;
4889 
4890 	ASSERT(un != NULL);
4891 	for (table_index = 0; table_index < sd_disk_table_size;
4892 	    table_index++) {
4893 		id = sd_disk_table[table_index].device_id;
4894 		idlen = strlen(id);
4895 		if (idlen == 0) {
4896 			continue;
4897 		}
4898 
4899 		if (sd_sdconf_id_match(un, id, idlen) == SD_SUCCESS) {
4900 			prop = sd_disk_table[table_index].properties;
4901 			if (prop == &lsi_properties ||
4902 			    prop == &lsi_oem_properties ||
4903 			    prop == &lsi_properties_scsi ||
4904 			    prop == &symbios_properties) {
4905 				un->un_f_cfg_is_lsi = TRUE;
4906 			}
4907 			break;
4908 		}
4909 	}
4910 }
4911 
4912 /*
4913  *    Function: sd_get_physical_geometry
4914  *
4915  * Description: Retrieve the MODE SENSE page 3 (Format Device Page) and
4916  *		MODE SENSE page 4 (Rigid Disk Drive Geometry Page) from the
4917  *		target, and use this information to initialize the physical
4918  *		geometry cache specified by pgeom_p.
4919  *
4920  *		MODE SENSE is an optional command, so failure in this case
4921  *		does not necessarily denote an error. We want to use the
4922  *		MODE SENSE commands to derive the physical geometry of the
4923  *		device, but if either command fails, the logical geometry is
4924  *		used as the fallback for disk label geometry in cmlb.
4925  *
4926  *		This requires that un->un_blockcount and un->un_tgt_blocksize
4927  *		have already been initialized for the current target and
4928  *		that the current values be passed as args so that we don't
4929  *		end up ever trying to use -1 as a valid value. This could
4930  *		happen if either value is reset while we're not holding
4931  *		the mutex.
4932  *
4933  *   Arguments: un - driver soft state (unit) structure
4934  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
4935  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
4936  *			to use the USCSI "direct" chain and bypass the normal
4937  *			command waitq.
4938  *
4939  *     Context: Kernel thread only (can sleep).
4940  */
4941 
4942 static int
4943 sd_get_physical_geometry(struct sd_lun *un, cmlb_geom_t *pgeom_p,
4944     diskaddr_t capacity, int lbasize, int path_flag)
4945 {
4946 	struct	mode_format	*page3p;
4947 	struct	mode_geometry	*page4p;
4948 	struct	mode_header	*headerp;
4949 	int	sector_size;
4950 	int	nsect;
4951 	int	nhead;
4952 	int	ncyl;
4953 	int	intrlv;
4954 	int	spc;
4955 	diskaddr_t	modesense_capacity;
4956 	int	rpm;
4957 	int	bd_len;
4958 	int	mode_header_length;
4959 	uchar_t	*p3bufp;
4960 	uchar_t	*p4bufp;
4961 	int	cdbsize;
4962 	int	ret = EIO;
4963 	sd_ssc_t *ssc;
4964 	int	status;
4965 
4966 	ASSERT(un != NULL);
4967 
4968 	if (lbasize == 0) {
4969 		if (ISCD(un)) {
4970 			lbasize = 2048;
4971 		} else {
4972 			lbasize = un->un_sys_blocksize;
4973 		}
4974 	}
4975 	pgeom_p->g_secsize = (unsigned short)lbasize;
4976 
4977 	/*
4978 	 * If the unit is a cd/dvd drive MODE SENSE page three
4979 	 * and MODE SENSE page four are reserved (see SBC spec
4980 	 * and MMC spec). To prevent soft errors just return
4981 	 * using the default LBA size.
4982 	 *
4983 	 * Since SATA MODE SENSE function (sata_txlt_mode_sense()) does not
4984 	 * implement support for mode pages 3 and 4 return here to prevent
4985 	 * illegal requests on SATA drives.
4986 	 *
4987 	 * These pages are also reserved in SBC-2 and later.  We assume SBC-2
4988 	 * or later for a direct-attached block device if the SCSI version is
4989 	 * at least SPC-3.
4990 	 */
4991 
4992 	if (ISCD(un) ||
4993 	    un->un_interconnect_type == SD_INTERCONNECT_SATA ||
4994 	    (un->un_ctype == CTYPE_CCS && SD_INQUIRY(un)->inq_ansi >= 5))
4995 		return (ret);
4996 
4997 	cdbsize = (un->un_f_cfg_is_atapi == TRUE) ? CDB_GROUP2 : CDB_GROUP0;
4998 
4999 	/*
5000 	 * Retrieve MODE SENSE page 3 - Format Device Page
5001 	 */
5002 	p3bufp = kmem_zalloc(SD_MODE_SENSE_PAGE3_LENGTH, KM_SLEEP);
5003 	ssc = sd_ssc_init(un);
5004 	status = sd_send_scsi_MODE_SENSE(ssc, cdbsize, p3bufp,
5005 	    SD_MODE_SENSE_PAGE3_LENGTH, SD_MODE_SENSE_PAGE3_CODE, path_flag);
5006 	if (status != 0) {
5007 		SD_ERROR(SD_LOG_COMMON, un,
5008 		    "sd_get_physical_geometry: mode sense page 3 failed\n");
5009 		goto page3_exit;
5010 	}
5011 
5012 	/*
5013 	 * Determine size of Block Descriptors in order to locate the mode
5014 	 * page data.  ATAPI devices return 0, SCSI devices should return
5015 	 * MODE_BLK_DESC_LENGTH.
5016 	 */
5017 	headerp = (struct mode_header *)p3bufp;
5018 	if (un->un_f_cfg_is_atapi == TRUE) {
5019 		struct mode_header_grp2 *mhp =
5020 		    (struct mode_header_grp2 *)headerp;
5021 		mode_header_length = MODE_HEADER_LENGTH_GRP2;
5022 		bd_len = (mhp->bdesc_length_hi << 8) | mhp->bdesc_length_lo;
5023 	} else {
5024 		mode_header_length = MODE_HEADER_LENGTH;
5025 		bd_len = ((struct mode_header *)headerp)->bdesc_length;
5026 	}
5027 
5028 	if (bd_len > MODE_BLK_DESC_LENGTH) {
5029 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
5030 		    "sd_get_physical_geometry: received unexpected bd_len "
5031 		    "of %d, page3\n", bd_len);
5032 		status = EIO;
5033 		goto page3_exit;
5034 	}
5035 
5036 	page3p = (struct mode_format *)
5037 	    ((caddr_t)headerp + mode_header_length + bd_len);
5038 
5039 	if (page3p->mode_page.code != SD_MODE_SENSE_PAGE3_CODE) {
5040 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
5041 		    "sd_get_physical_geometry: mode sense pg3 code mismatch "
5042 		    "%d\n", page3p->mode_page.code);
5043 		status = EIO;
5044 		goto page3_exit;
5045 	}
5046 
5047 	/*
5048 	 * Use this physical geometry data only if BOTH MODE SENSE commands
5049 	 * complete successfully; otherwise, revert to the logical geometry.
5050 	 * So, we need to save everything in temporary variables.
5051 	 */
5052 	sector_size = BE_16(page3p->data_bytes_sect);
5053 
5054 	/*
5055 	 * 1243403: The NEC D38x7 drives do not support MODE SENSE sector size
5056 	 */
5057 	if (sector_size == 0) {
5058 		sector_size = un->un_sys_blocksize;
5059 	} else {
5060 		sector_size &= ~(un->un_sys_blocksize - 1);
5061 	}
5062 
5063 	nsect  = BE_16(page3p->sect_track);
5064 	intrlv = BE_16(page3p->interleave);
5065 
5066 	SD_INFO(SD_LOG_COMMON, un,
5067 	    "sd_get_physical_geometry: Format Parameters (page 3)\n");
5068 	SD_INFO(SD_LOG_COMMON, un,
5069 	    "   mode page: %d; nsect: %d; sector size: %d;\n",
5070 	    page3p->mode_page.code, nsect, sector_size);
5071 	SD_INFO(SD_LOG_COMMON, un,
5072 	    "   interleave: %d; track skew: %d; cylinder skew: %d;\n", intrlv,
5073 	    BE_16(page3p->track_skew),
5074 	    BE_16(page3p->cylinder_skew));
5075 
5076 	sd_ssc_assessment(ssc, SD_FMT_STANDARD);
5077 
5078 	/*
5079 	 * Retrieve MODE SENSE page 4 - Rigid Disk Drive Geometry Page
5080 	 */
5081 	p4bufp = kmem_zalloc(SD_MODE_SENSE_PAGE4_LENGTH, KM_SLEEP);
5082 	status = sd_send_scsi_MODE_SENSE(ssc, cdbsize, p4bufp,
5083 	    SD_MODE_SENSE_PAGE4_LENGTH, SD_MODE_SENSE_PAGE4_CODE, path_flag);
5084 	if (status != 0) {
5085 		SD_ERROR(SD_LOG_COMMON, un,
5086 		    "sd_get_physical_geometry: mode sense page 4 failed\n");
5087 		goto page4_exit;
5088 	}
5089 
5090 	/*
5091 	 * Determine size of Block Descriptors in order to locate the mode
5092 	 * page data.  ATAPI devices return 0, SCSI devices should return
5093 	 * MODE_BLK_DESC_LENGTH.
5094 	 */
5095 	headerp = (struct mode_header *)p4bufp;
5096 	if (un->un_f_cfg_is_atapi == TRUE) {
5097 		struct mode_header_grp2 *mhp =
5098 		    (struct mode_header_grp2 *)headerp;
5099 		bd_len = (mhp->bdesc_length_hi << 8) | mhp->bdesc_length_lo;
5100 	} else {
5101 		bd_len = ((struct mode_header *)headerp)->bdesc_length;
5102 	}
5103 
5104 	if (bd_len > MODE_BLK_DESC_LENGTH) {
5105 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
5106 		    "sd_get_physical_geometry: received unexpected bd_len of "
5107 		    "%d, page4\n", bd_len);
5108 		status = EIO;
5109 		goto page4_exit;
5110 	}
5111 
5112 	page4p = (struct mode_geometry *)
5113 	    ((caddr_t)headerp + mode_header_length + bd_len);
5114 
5115 	if (page4p->mode_page.code != SD_MODE_SENSE_PAGE4_CODE) {
5116 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
5117 		    "sd_get_physical_geometry: mode sense pg4 code mismatch "
5118 		    "%d\n", page4p->mode_page.code);
5119 		status = EIO;
5120 		goto page4_exit;
5121 	}
5122 
5123 	/*
5124 	 * Stash the data now, after we know that both commands completed.
5125 	 */
5126 
5127 
5128 	nhead = (int)page4p->heads;	/* uchar, so no conversion needed */
5129 	spc   = nhead * nsect;
5130 	ncyl  = (page4p->cyl_ub << 16) + (page4p->cyl_mb << 8) + page4p->cyl_lb;
5131 	rpm   = BE_16(page4p->rpm);
5132 
5133 	modesense_capacity = spc * ncyl;
5134 
5135 	SD_INFO(SD_LOG_COMMON, un,
5136 	    "sd_get_physical_geometry: Geometry Parameters (page 4)\n");
5137 	SD_INFO(SD_LOG_COMMON, un,
5138 	    "   cylinders: %d; heads: %d; rpm: %d;\n", ncyl, nhead, rpm);
5139 	SD_INFO(SD_LOG_COMMON, un,
5140 	    "   computed capacity(h*s*c): %d;\n", modesense_capacity);
5141 	SD_INFO(SD_LOG_COMMON, un, "   pgeom_p: %p; read cap: %d\n",
5142 	    (void *)pgeom_p, capacity);
5143 
5144 	/*
5145 	 * Compensate if the drive's geometry is not rectangular, i.e.,
5146 	 * the product of C * H * S returned by MODE SENSE >= that returned
5147 	 * by read capacity. This is an idiosyncrasy of the original x86
5148 	 * disk subsystem.
5149 	 */
5150 	if (modesense_capacity >= capacity) {
5151 		SD_INFO(SD_LOG_COMMON, un,
5152 		    "sd_get_physical_geometry: adjusting acyl; "
5153 		    "old: %d; new: %d\n", pgeom_p->g_acyl,
5154 		    (modesense_capacity - capacity + spc - 1) / spc);
5155 		if (sector_size != 0) {
5156 			/* 1243403: NEC D38x7 drives don't support sec size */
5157 			pgeom_p->g_secsize = (unsigned short)sector_size;
5158 		}
5159 		pgeom_p->g_nsect    = (unsigned short)nsect;
5160 		pgeom_p->g_nhead    = (unsigned short)nhead;
5161 		pgeom_p->g_capacity = capacity;
5162 		pgeom_p->g_acyl	    =
5163 		    (modesense_capacity - pgeom_p->g_capacity + spc - 1) / spc;
5164 		pgeom_p->g_ncyl	    = ncyl - pgeom_p->g_acyl;
5165 	}
5166 
5167 	pgeom_p->g_rpm    = (unsigned short)rpm;
5168 	pgeom_p->g_intrlv = (unsigned short)intrlv;
5169 	ret = 0;
5170 
5171 	SD_INFO(SD_LOG_COMMON, un,
5172 	    "sd_get_physical_geometry: mode sense geometry:\n");
5173 	SD_INFO(SD_LOG_COMMON, un,
5174 	    "   nsect: %d; sector size: %d; interlv: %d\n",
5175 	    nsect, sector_size, intrlv);
5176 	SD_INFO(SD_LOG_COMMON, un,
5177 	    "   nhead: %d; ncyl: %d; rpm: %d; capacity(ms): %d\n",
5178 	    nhead, ncyl, rpm, modesense_capacity);
5179 	SD_INFO(SD_LOG_COMMON, un,
5180 	    "sd_get_physical_geometry: (cached)\n");
5181 	SD_INFO(SD_LOG_COMMON, un,
5182 	    "   ncyl: %ld; acyl: %d; nhead: %d; nsect: %d\n",
5183 	    pgeom_p->g_ncyl,  pgeom_p->g_acyl,
5184 	    pgeom_p->g_nhead, pgeom_p->g_nsect);
5185 	SD_INFO(SD_LOG_COMMON, un,
5186 	    "   lbasize: %d; capacity: %ld; intrlv: %d; rpm: %d\n",
5187 	    pgeom_p->g_secsize, pgeom_p->g_capacity,
5188 	    pgeom_p->g_intrlv, pgeom_p->g_rpm);
5189 	sd_ssc_assessment(ssc, SD_FMT_STANDARD);
5190 
5191 page4_exit:
5192 	kmem_free(p4bufp, SD_MODE_SENSE_PAGE4_LENGTH);
5193 
5194 page3_exit:
5195 	kmem_free(p3bufp, SD_MODE_SENSE_PAGE3_LENGTH);
5196 
5197 	if (status != 0) {
5198 		if (status == EIO) {
5199 			/*
5200 			 * Some disks do not support mode sense(6), we
5201 			 * should ignore this kind of error(sense key is
5202 			 * 0x5 - illegal request).
5203 			 */
5204 			uint8_t *sensep;
5205 			int senlen;
5206 
5207 			sensep = (uint8_t *)ssc->ssc_uscsi_cmd->uscsi_rqbuf;
5208 			senlen = (int)(ssc->ssc_uscsi_cmd->uscsi_rqlen -
5209 			    ssc->ssc_uscsi_cmd->uscsi_rqresid);
5210 
5211 			if (senlen > 0 &&
5212 			    scsi_sense_key(sensep) == KEY_ILLEGAL_REQUEST) {
5213 				sd_ssc_assessment(ssc,
5214 				    SD_FMT_IGNORE_COMPROMISE);
5215 			} else {
5216 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
5217 			}
5218 		} else {
5219 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5220 		}
5221 	}
5222 	sd_ssc_fini(ssc);
5223 	return (ret);
5224 }
5225 
5226 /*
5227  *    Function: sd_get_virtual_geometry
5228  *
5229  * Description: Ask the controller to tell us about the target device.
5230  *
5231  *   Arguments: un - pointer to softstate
5232  *		capacity - disk capacity in #blocks
5233  *		lbasize - disk block size in bytes
5234  *
5235  *     Context: Kernel thread only
5236  */
5237 
5238 static int
5239 sd_get_virtual_geometry(struct sd_lun *un, cmlb_geom_t *lgeom_p,
5240     diskaddr_t capacity, int lbasize)
5241 {
5242 	uint_t	geombuf;
5243 	int	spc;
5244 
5245 	ASSERT(un != NULL);
5246 
5247 	/* Set sector size, and total number of sectors */
5248 	(void) scsi_ifsetcap(SD_ADDRESS(un), "sector-size",   lbasize,  1);
5249 	(void) scsi_ifsetcap(SD_ADDRESS(un), "total-sectors", capacity, 1);
5250 
5251 	/* Let the HBA tell us its geometry */
5252 	geombuf = (uint_t)scsi_ifgetcap(SD_ADDRESS(un), "geometry", 1);
5253 
5254 	/* A value of -1 indicates an undefined "geometry" property */
5255 	if (geombuf == (-1)) {
5256 		return (EINVAL);
5257 	}
5258 
5259 	/* Initialize the logical geometry cache. */
5260 	lgeom_p->g_nhead   = (geombuf >> 16) & 0xffff;
5261 	lgeom_p->g_nsect   = geombuf & 0xffff;
5262 	lgeom_p->g_secsize = un->un_sys_blocksize;
5263 
5264 	spc = lgeom_p->g_nhead * lgeom_p->g_nsect;
5265 
5266 	/*
5267 	 * Note: The driver originally converted the capacity value from
5268 	 * target blocks to system blocks. However, the capacity value passed
5269 	 * to this routine is already in terms of system blocks (this scaling
5270 	 * is done when the READ CAPACITY command is issued and processed).
5271 	 * This 'error' may have gone undetected because the usage of g_ncyl
5272 	 * (which is based upon g_capacity) is very limited within the driver
5273 	 */
5274 	lgeom_p->g_capacity = capacity;
5275 
5276 	/*
5277 	 * Set ncyl to zero if the hba returned a zero nhead or nsect value. The
5278 	 * hba may return zero values if the device has been removed.
5279 	 */
5280 	if (spc == 0) {
5281 		lgeom_p->g_ncyl = 0;
5282 	} else {
5283 		lgeom_p->g_ncyl = lgeom_p->g_capacity / spc;
5284 	}
5285 	lgeom_p->g_acyl = 0;
5286 
5287 	SD_INFO(SD_LOG_COMMON, un, "sd_get_virtual_geometry: (cached)\n");
5288 	return (0);
5289 
5290 }
5291 /*
5292  *    Function: sd_update_block_info
5293  *
5294  * Description: Calculate a byte count to sector count bitshift value
5295  *		from sector size.
5296  *
5297  *   Arguments: un: unit struct.
5298  *		lbasize: new target sector size
5299  *		capacity: new target capacity, ie. block count
5300  *
5301  *     Context: Kernel thread context
5302  */
5303 
5304 static void
5305 sd_update_block_info(struct sd_lun *un, uint32_t lbasize, uint64_t capacity)
5306 {
5307 	if (lbasize != 0) {
5308 		un->un_tgt_blocksize = lbasize;
5309 		un->un_f_tgt_blocksize_is_valid = TRUE;
5310 		if (!un->un_f_has_removable_media) {
5311 			un->un_sys_blocksize = lbasize;
5312 		}
5313 	}
5314 
5315 	if (capacity != 0) {
5316 		un->un_blockcount		= capacity;
5317 		un->un_f_blockcount_is_valid	= TRUE;
5318 
5319 		/*
5320 		 * The capacity has changed so update the errstats.
5321 		 */
5322 		if (un->un_errstats != NULL) {
5323 			struct sd_errstats *stp;
5324 
5325 			capacity *= un->un_sys_blocksize;
5326 			stp = (struct sd_errstats *)un->un_errstats->ks_data;
5327 			if (stp->sd_capacity.value.ui64 < capacity)
5328 				stp->sd_capacity.value.ui64 = capacity;
5329 		}
5330 	}
5331 }
5332 
5333 /*
5334  * Parses the SCSI Block Limits VPD page (0xB0). It's legal to pass NULL for
5335  * vpd_pg, in which case all the block limits will be reset to the defaults.
5336  */
5337 static void
5338 sd_parse_blk_limits_vpd(struct sd_lun *un, uchar_t *vpd_pg)
5339 {
5340 	sd_blk_limits_t *lim = &un->un_blk_lim;
5341 	unsigned pg_len;
5342 
5343 	if (vpd_pg != NULL)
5344 		pg_len = BE_IN16(&vpd_pg[2]);
5345 	else
5346 		pg_len = 0;
5347 
5348 	/* Block Limits VPD can be 16 bytes or 64 bytes long - support both */
5349 	if (pg_len >= 0x10) {
5350 		lim->lim_opt_xfer_len_gran = BE_IN16(&vpd_pg[6]);
5351 		lim->lim_max_xfer_len = BE_IN32(&vpd_pg[8]);
5352 		lim->lim_opt_xfer_len = BE_IN32(&vpd_pg[12]);
5353 
5354 		/* Zero means not reported, so use "unlimited" */
5355 		if (lim->lim_max_xfer_len == 0)
5356 			lim->lim_max_xfer_len = UINT32_MAX;
5357 		if (lim->lim_opt_xfer_len == 0)
5358 			lim->lim_opt_xfer_len = UINT32_MAX;
5359 	} else {
5360 		lim->lim_opt_xfer_len_gran = 0;
5361 		lim->lim_max_xfer_len = UINT32_MAX;
5362 		lim->lim_opt_xfer_len = UINT32_MAX;
5363 	}
5364 	if (pg_len >= 0x3c) {
5365 		lim->lim_max_pfetch_len = BE_IN32(&vpd_pg[16]);
5366 		/*
5367 		 * A zero in either of the following two fields indicates lack
5368 		 * of UNMAP support.
5369 		 */
5370 		lim->lim_max_unmap_lba_cnt = BE_IN32(&vpd_pg[20]);
5371 		lim->lim_max_unmap_descr_cnt = BE_IN32(&vpd_pg[24]);
5372 		lim->lim_opt_unmap_gran = BE_IN32(&vpd_pg[28]);
5373 		if ((vpd_pg[32] >> 7) == 1) {
5374 			lim->lim_unmap_gran_align =
5375 			    ((vpd_pg[32] & 0x7f) << 24) | (vpd_pg[33] << 16) |
5376 			    (vpd_pg[34] << 8) | vpd_pg[35];
5377 		} else {
5378 			lim->lim_unmap_gran_align = 0;
5379 		}
5380 		lim->lim_max_write_same_len = BE_IN64(&vpd_pg[36]);
5381 	} else {
5382 		lim->lim_max_pfetch_len = UINT32_MAX;
5383 		lim->lim_max_unmap_lba_cnt = UINT32_MAX;
5384 		lim->lim_max_unmap_descr_cnt = SD_UNMAP_MAX_DESCR;
5385 		lim->lim_opt_unmap_gran = 0;
5386 		lim->lim_unmap_gran_align = 0;
5387 		lim->lim_max_write_same_len = UINT64_MAX;
5388 	}
5389 }
5390 
5391 /*
5392  * Collects VPD page B0 data if available (block limits). If the data is
5393  * not available or querying the device failed, we revert to the defaults.
5394  */
5395 static void
5396 sd_setup_blk_limits(sd_ssc_t *ssc)
5397 {
5398 	struct sd_lun	*un		= ssc->ssc_un;
5399 	uchar_t		*inqB0		= NULL;
5400 	size_t		inqB0_resid	= 0;
5401 	int		rval;
5402 
5403 	if (un->un_vpd_page_mask & SD_VPD_BLK_LIMITS_PG) {
5404 		inqB0 = kmem_zalloc(MAX_INQUIRY_SIZE, KM_SLEEP);
5405 		rval = sd_send_scsi_INQUIRY(ssc, inqB0, MAX_INQUIRY_SIZE, 0x01,
5406 		    0xB0, &inqB0_resid);
5407 		if (rval != 0) {
5408 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5409 			kmem_free(inqB0, MAX_INQUIRY_SIZE);
5410 			inqB0 = NULL;
5411 		}
5412 	}
5413 	/* passing NULL inqB0 will reset to defaults */
5414 	sd_parse_blk_limits_vpd(ssc->ssc_un, inqB0);
5415 	if (inqB0)
5416 		kmem_free(inqB0, MAX_INQUIRY_SIZE);
5417 }
5418 
5419 /*
5420  *    Function: sd_register_devid
5421  *
5422  * Description: This routine will obtain the device id information from the
5423  *		target, obtain the serial number, and register the device
5424  *		id with the ddi framework.
5425  *
5426  *   Arguments: devi - the system's dev_info_t for the device.
5427  *		un - driver soft state (unit) structure
5428  *		reservation_flag - indicates if a reservation conflict
5429  *		occurred during attach
5430  *
5431  *     Context: Kernel Thread
5432  */
5433 static void
5434 sd_register_devid(sd_ssc_t *ssc, dev_info_t *devi, int reservation_flag)
5435 {
5436 	int		rval		= 0;
5437 	uchar_t		*inq80		= NULL;
5438 	size_t		inq80_len	= MAX_INQUIRY_SIZE;
5439 	size_t		inq80_resid	= 0;
5440 	uchar_t		*inq83		= NULL;
5441 	size_t		inq83_len	= MAX_INQUIRY_SIZE;
5442 	size_t		inq83_resid	= 0;
5443 	int		dlen, len;
5444 	char		*sn;
5445 	struct sd_lun	*un;
5446 
5447 	ASSERT(ssc != NULL);
5448 	un = ssc->ssc_un;
5449 	ASSERT(un != NULL);
5450 	ASSERT(mutex_owned(SD_MUTEX(un)));
5451 	ASSERT((SD_DEVINFO(un)) == devi);
5452 
5453 
5454 	/*
5455 	 * We check the availability of the World Wide Name (0x83) and Unit
5456 	 * Serial Number (0x80) pages in sd_check_vpd_page_support(), and using
5457 	 * un_vpd_page_mask from them, we decide which way to get the WWN.  If
5458 	 * 0x83 is available, that is the best choice.  Our next choice is
5459 	 * 0x80.  If neither are available, we munge the devid from the device
5460 	 * vid/pid/serial # for Sun qualified disks, or use the ddi framework
5461 	 * to fabricate a devid for non-Sun qualified disks.
5462 	 */
5463 	if (sd_check_vpd_page_support(ssc) == 0) {
5464 		/* collect page 80 data if available */
5465 		if (un->un_vpd_page_mask & SD_VPD_UNIT_SERIAL_PG) {
5466 
5467 			mutex_exit(SD_MUTEX(un));
5468 			inq80 = kmem_zalloc(inq80_len, KM_SLEEP);
5469 
5470 			rval = sd_send_scsi_INQUIRY(ssc, inq80, inq80_len,
5471 			    0x01, 0x80, &inq80_resid);
5472 
5473 			if (rval != 0) {
5474 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5475 				kmem_free(inq80, inq80_len);
5476 				inq80 = NULL;
5477 				inq80_len = 0;
5478 			} else if (ddi_prop_exists(
5479 			    DDI_DEV_T_NONE, SD_DEVINFO(un),
5480 			    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS,
5481 			    INQUIRY_SERIAL_NO) == 0) {
5482 				/*
5483 				 * If we don't already have a serial number
5484 				 * property, do quick verify of data returned
5485 				 * and define property.
5486 				 */
5487 				dlen = inq80_len - inq80_resid;
5488 				len = (size_t)inq80[3];
5489 				if ((dlen >= 4) && ((len + 4) <= dlen)) {
5490 					/*
5491 					 * Ensure sn termination, skip leading
5492 					 * blanks, and create property
5493 					 * 'inquiry-serial-no'.
5494 					 */
5495 					sn = (char *)&inq80[4];
5496 					sn[len] = 0;
5497 					while (*sn && (*sn == ' '))
5498 						sn++;
5499 					if (*sn) {
5500 						(void) ddi_prop_update_string(
5501 						    DDI_DEV_T_NONE,
5502 						    SD_DEVINFO(un),
5503 						    INQUIRY_SERIAL_NO, sn);
5504 					}
5505 				}
5506 			}
5507 			mutex_enter(SD_MUTEX(un));
5508 		}
5509 
5510 		/* collect page 83 data if available */
5511 		if (un->un_vpd_page_mask & SD_VPD_DEVID_WWN_PG) {
5512 			mutex_exit(SD_MUTEX(un));
5513 			inq83 = kmem_zalloc(inq83_len, KM_SLEEP);
5514 
5515 			rval = sd_send_scsi_INQUIRY(ssc, inq83, inq83_len,
5516 			    0x01, 0x83, &inq83_resid);
5517 
5518 			if (rval != 0) {
5519 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5520 				kmem_free(inq83, inq83_len);
5521 				inq83 = NULL;
5522 				inq83_len = 0;
5523 			}
5524 			mutex_enter(SD_MUTEX(un));
5525 		}
5526 	}
5527 
5528 	/*
5529 	 * If transport has already registered a devid for this target
5530 	 * then that takes precedence over the driver's determination
5531 	 * of the devid.
5532 	 *
5533 	 * NOTE: The reason this check is done here instead of at the beginning
5534 	 * of the function is to allow the code above to create the
5535 	 * 'inquiry-serial-no' property.
5536 	 */
5537 	if (ddi_devid_get(SD_DEVINFO(un), &un->un_devid) == DDI_SUCCESS) {
5538 		ASSERT(un->un_devid);
5539 		un->un_f_devid_transport_defined = TRUE;
5540 		goto cleanup; /* use devid registered by the transport */
5541 	}
5542 
5543 	/*
5544 	 * This is the case of antiquated Sun disk drives that have the
5545 	 * FAB_DEVID property set in the disk_table.  These drives
5546 	 * manage the devid's by storing them in last 2 available sectors
5547 	 * on the drive and have them fabricated by the ddi layer by calling
5548 	 * ddi_devid_init and passing the DEVID_FAB flag.
5549 	 */
5550 	if (un->un_f_opt_fab_devid == TRUE) {
5551 		/*
5552 		 * Depending on EINVAL isn't reliable, since a reserved disk
5553 		 * may result in invalid geometry, so check to make sure a
5554 		 * reservation conflict did not occur during attach.
5555 		 */
5556 		if ((sd_get_devid(ssc) == EINVAL) &&
5557 		    (reservation_flag != SD_TARGET_IS_RESERVED)) {
5558 			/*
5559 			 * The devid is invalid AND there is no reservation
5560 			 * conflict.  Fabricate a new devid.
5561 			 */
5562 			(void) sd_create_devid(ssc);
5563 		}
5564 
5565 		/* Register the devid if it exists */
5566 		if (un->un_devid != NULL) {
5567 			(void) ddi_devid_register(SD_DEVINFO(un),
5568 			    un->un_devid);
5569 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
5570 			    "sd_register_devid: Devid Fabricated\n");
5571 		}
5572 		goto cleanup;
5573 	}
5574 
5575 	/* encode best devid possible based on data available */
5576 	if (ddi_devid_scsi_encode(DEVID_SCSI_ENCODE_VERSION_LATEST,
5577 	    (char *)ddi_driver_name(SD_DEVINFO(un)),
5578 	    (uchar_t *)SD_INQUIRY(un), sizeof (*SD_INQUIRY(un)),
5579 	    inq80, inq80_len - inq80_resid, inq83, inq83_len -
5580 	    inq83_resid, &un->un_devid) == DDI_SUCCESS) {
5581 
5582 		/* devid successfully encoded, register devid */
5583 		(void) ddi_devid_register(SD_DEVINFO(un), un->un_devid);
5584 
5585 	} else {
5586 		/*
5587 		 * Unable to encode a devid based on data available.
5588 		 * This is not a Sun qualified disk.  Older Sun disk
5589 		 * drives that have the SD_FAB_DEVID property
5590 		 * set in the disk_table and non Sun qualified
5591 		 * disks are treated in the same manner.  These
5592 		 * drives manage the devid's by storing them in
5593 		 * last 2 available sectors on the drive and
5594 		 * have them fabricated by the ddi layer by
5595 		 * calling ddi_devid_init and passing the
5596 		 * DEVID_FAB flag.
5597 		 * Create a fabricate devid only if there's no
5598 		 * fabricate devid existed.
5599 		 */
5600 		if (sd_get_devid(ssc) == EINVAL) {
5601 			(void) sd_create_devid(ssc);
5602 		}
5603 		un->un_f_opt_fab_devid = TRUE;
5604 
5605 		/* Register the devid if it exists */
5606 		if (un->un_devid != NULL) {
5607 			(void) ddi_devid_register(SD_DEVINFO(un),
5608 			    un->un_devid);
5609 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
5610 			    "sd_register_devid: devid fabricated using "
5611 			    "ddi framework\n");
5612 		}
5613 	}
5614 
5615 cleanup:
5616 	/* clean up resources */
5617 	if (inq80 != NULL) {
5618 		kmem_free(inq80, inq80_len);
5619 	}
5620 	if (inq83 != NULL) {
5621 		kmem_free(inq83, inq83_len);
5622 	}
5623 }
5624 
5625 
5626 
5627 /*
5628  *    Function: sd_get_devid
5629  *
5630  * Description: This routine will return 0 if a valid device id has been
5631  *		obtained from the target and stored in the soft state. If a
5632  *		valid device id has not been previously read and stored, a
5633  *		read attempt will be made.
5634  *
5635  *   Arguments: un - driver soft state (unit) structure
5636  *
5637  * Return Code: 0 if we successfully get the device id
5638  *
5639  *     Context: Kernel Thread
5640  */
5641 
5642 static int
5643 sd_get_devid(sd_ssc_t *ssc)
5644 {
5645 	struct dk_devid		*dkdevid;
5646 	ddi_devid_t		tmpid;
5647 	uint_t			*ip;
5648 	size_t			sz;
5649 	diskaddr_t		blk;
5650 	int			status;
5651 	int			chksum;
5652 	int			i;
5653 	size_t			buffer_size;
5654 	struct sd_lun		*un;
5655 
5656 	ASSERT(ssc != NULL);
5657 	un = ssc->ssc_un;
5658 	ASSERT(un != NULL);
5659 	ASSERT(mutex_owned(SD_MUTEX(un)));
5660 
5661 	SD_TRACE(SD_LOG_ATTACH_DETACH, un, "sd_get_devid: entry: un: 0x%p\n",
5662 	    un);
5663 
5664 	if (un->un_devid != NULL) {
5665 		return (0);
5666 	}
5667 
5668 	mutex_exit(SD_MUTEX(un));
5669 	if (cmlb_get_devid_block(un->un_cmlbhandle, &blk,
5670 	    (void *)SD_PATH_DIRECT) != 0) {
5671 		mutex_enter(SD_MUTEX(un));
5672 		return (EINVAL);
5673 	}
5674 
5675 	/*
5676 	 * Read and verify device id, stored in the reserved cylinders at the
5677 	 * end of the disk. Backup label is on the odd sectors of the last
5678 	 * track of the last cylinder. Device id will be on track of the next
5679 	 * to last cylinder.
5680 	 */
5681 	mutex_enter(SD_MUTEX(un));
5682 	buffer_size = SD_REQBYTES2TGTBYTES(un, sizeof (struct dk_devid));
5683 	mutex_exit(SD_MUTEX(un));
5684 	dkdevid = kmem_alloc(buffer_size, KM_SLEEP);
5685 	status = sd_send_scsi_READ(ssc, dkdevid, buffer_size, blk,
5686 	    SD_PATH_DIRECT);
5687 
5688 	if (status != 0) {
5689 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5690 		goto error;
5691 	}
5692 
5693 	/* Validate the revision */
5694 	if ((dkdevid->dkd_rev_hi != DK_DEVID_REV_MSB) ||
5695 	    (dkdevid->dkd_rev_lo != DK_DEVID_REV_LSB)) {
5696 		status = EINVAL;
5697 		goto error;
5698 	}
5699 
5700 	/* Calculate the checksum */
5701 	chksum = 0;
5702 	ip = (uint_t *)dkdevid;
5703 	for (i = 0; i < ((DEV_BSIZE - sizeof (int)) / sizeof (int));
5704 	    i++) {
5705 		chksum ^= ip[i];
5706 	}
5707 
5708 	/* Compare the checksums */
5709 	if (DKD_GETCHKSUM(dkdevid) != chksum) {
5710 		status = EINVAL;
5711 		goto error;
5712 	}
5713 
5714 	/* Validate the device id */
5715 	if (ddi_devid_valid((ddi_devid_t)&dkdevid->dkd_devid) != DDI_SUCCESS) {
5716 		status = EINVAL;
5717 		goto error;
5718 	}
5719 
5720 	/*
5721 	 * Store the device id in the driver soft state
5722 	 */
5723 	sz = ddi_devid_sizeof((ddi_devid_t)&dkdevid->dkd_devid);
5724 	tmpid = kmem_alloc(sz, KM_SLEEP);
5725 
5726 	mutex_enter(SD_MUTEX(un));
5727 
5728 	un->un_devid = tmpid;
5729 	bcopy(&dkdevid->dkd_devid, un->un_devid, sz);
5730 
5731 	kmem_free(dkdevid, buffer_size);
5732 
5733 	SD_TRACE(SD_LOG_ATTACH_DETACH, un, "sd_get_devid: exit: un:0x%p\n", un);
5734 
5735 	return (status);
5736 error:
5737 	mutex_enter(SD_MUTEX(un));
5738 	kmem_free(dkdevid, buffer_size);
5739 	return (status);
5740 }
5741 
5742 
5743 /*
5744  *    Function: sd_create_devid
5745  *
5746  * Description: This routine will fabricate the device id and write it
5747  *		to the disk.
5748  *
5749  *   Arguments: un - driver soft state (unit) structure
5750  *
5751  * Return Code: value of the fabricated device id
5752  *
5753  *     Context: Kernel Thread
5754  */
5755 
5756 static ddi_devid_t
5757 sd_create_devid(sd_ssc_t *ssc)
5758 {
5759 	struct sd_lun	*un;
5760 
5761 	ASSERT(ssc != NULL);
5762 	un = ssc->ssc_un;
5763 	ASSERT(un != NULL);
5764 
5765 	/* Fabricate the devid */
5766 	if (ddi_devid_init(SD_DEVINFO(un), DEVID_FAB, 0, NULL, &un->un_devid)
5767 	    == DDI_FAILURE) {
5768 		return (NULL);
5769 	}
5770 
5771 	/* Write the devid to disk */
5772 	if (sd_write_deviceid(ssc) != 0) {
5773 		ddi_devid_free(un->un_devid);
5774 		un->un_devid = NULL;
5775 	}
5776 
5777 	return (un->un_devid);
5778 }
5779 
5780 
5781 /*
5782  *    Function: sd_write_deviceid
5783  *
5784  * Description: This routine will write the device id to the disk
5785  *		reserved sector.
5786  *
5787  *   Arguments: un - driver soft state (unit) structure
5788  *
5789  * Return Code: EINVAL
5790  *		value returned by sd_send_scsi_cmd
5791  *
5792  *     Context: Kernel Thread
5793  */
5794 
5795 static int
5796 sd_write_deviceid(sd_ssc_t *ssc)
5797 {
5798 	struct dk_devid		*dkdevid;
5799 	uchar_t			*buf;
5800 	diskaddr_t		blk;
5801 	uint_t			*ip, chksum;
5802 	int			status;
5803 	int			i;
5804 	struct sd_lun		*un;
5805 
5806 	ASSERT(ssc != NULL);
5807 	un = ssc->ssc_un;
5808 	ASSERT(un != NULL);
5809 	ASSERT(mutex_owned(SD_MUTEX(un)));
5810 
5811 	mutex_exit(SD_MUTEX(un));
5812 	if (cmlb_get_devid_block(un->un_cmlbhandle, &blk,
5813 	    (void *)SD_PATH_DIRECT) != 0) {
5814 		mutex_enter(SD_MUTEX(un));
5815 		return (-1);
5816 	}
5817 
5818 
5819 	/* Allocate the buffer */
5820 	buf = kmem_zalloc(un->un_sys_blocksize, KM_SLEEP);
5821 	dkdevid = (struct dk_devid *)buf;
5822 
5823 	/* Fill in the revision */
5824 	dkdevid->dkd_rev_hi = DK_DEVID_REV_MSB;
5825 	dkdevid->dkd_rev_lo = DK_DEVID_REV_LSB;
5826 
5827 	/* Copy in the device id */
5828 	mutex_enter(SD_MUTEX(un));
5829 	bcopy(un->un_devid, &dkdevid->dkd_devid,
5830 	    ddi_devid_sizeof(un->un_devid));
5831 	mutex_exit(SD_MUTEX(un));
5832 
5833 	/* Calculate the checksum */
5834 	chksum = 0;
5835 	ip = (uint_t *)dkdevid;
5836 	for (i = 0; i < ((DEV_BSIZE - sizeof (int)) / sizeof (int));
5837 	    i++) {
5838 		chksum ^= ip[i];
5839 	}
5840 
5841 	/* Fill-in checksum */
5842 	DKD_FORMCHKSUM(chksum, dkdevid);
5843 
5844 	/* Write the reserved sector */
5845 	status = sd_send_scsi_WRITE(ssc, buf, un->un_sys_blocksize, blk,
5846 	    SD_PATH_DIRECT);
5847 	if (status != 0)
5848 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5849 
5850 	kmem_free(buf, un->un_sys_blocksize);
5851 
5852 	mutex_enter(SD_MUTEX(un));
5853 	return (status);
5854 }
5855 
5856 
5857 /*
5858  *    Function: sd_check_vpd_page_support
5859  *
5860  * Description: This routine sends an inquiry command with the EVPD bit set and
5861  *		a page code of 0x00 to the device. It is used to determine which
5862  *		vital product pages are available to find the devid. We are
5863  *		looking for pages 0x83 0x80 or 0xB1.  If we return a negative 1,
5864  *		the device does not support that command.
5865  *
5866  *   Arguments: un  - driver soft state (unit) structure
5867  *
5868  * Return Code: 0 - success
5869  *		1 - check condition
5870  *
5871  *     Context: This routine can sleep.
5872  */
5873 
5874 static int
5875 sd_check_vpd_page_support(sd_ssc_t *ssc)
5876 {
5877 	uchar_t	*page_list	= NULL;
5878 	uchar_t	page_length	= 0xff;	/* Use max possible length */
5879 	uchar_t	evpd		= 0x01;	/* Set the EVPD bit */
5880 	uchar_t	page_code	= 0x00;	/* Supported VPD Pages */
5881 	int	rval		= 0;
5882 	int	counter;
5883 	struct sd_lun		*un;
5884 
5885 	ASSERT(ssc != NULL);
5886 	un = ssc->ssc_un;
5887 	ASSERT(un != NULL);
5888 	ASSERT(mutex_owned(SD_MUTEX(un)));
5889 
5890 	mutex_exit(SD_MUTEX(un));
5891 
5892 	/*
5893 	 * We'll set the page length to the maximum to save figuring it out
5894 	 * with an additional call.
5895 	 */
5896 	page_list =  kmem_zalloc(page_length, KM_SLEEP);
5897 
5898 	rval = sd_send_scsi_INQUIRY(ssc, page_list, page_length, evpd,
5899 	    page_code, NULL);
5900 
5901 	if (rval != 0)
5902 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5903 
5904 	mutex_enter(SD_MUTEX(un));
5905 
5906 	/*
5907 	 * Now we must validate that the device accepted the command, as some
5908 	 * drives do not support it.  If the drive does support it, we will
5909 	 * return 0, and the supported pages will be in un_vpd_page_mask.  If
5910 	 * not, we return -1.
5911 	 */
5912 	if ((rval == 0) && (page_list[VPD_MODE_PAGE] == 0x00)) {
5913 		/* Loop to find one of the 2 pages we need */
5914 		counter = 4;  /* Supported pages start at byte 4, with 0x00 */
5915 
5916 		/*
5917 		 * Pages are returned in ascending order, and 0x83 is what we
5918 		 * are hoping for.
5919 		 */
5920 		while ((page_list[counter] <= 0xB1) &&
5921 		    (counter <= (page_list[VPD_PAGE_LENGTH] +
5922 		    VPD_HEAD_OFFSET))) {
5923 			/*
5924 			 * Add 3 because page_list[3] is the number of
5925 			 * pages minus 3
5926 			 */
5927 
5928 			switch (page_list[counter]) {
5929 			case 0x00:
5930 				un->un_vpd_page_mask |= SD_VPD_SUPPORTED_PG;
5931 				break;
5932 			case 0x80:
5933 				un->un_vpd_page_mask |= SD_VPD_UNIT_SERIAL_PG;
5934 				break;
5935 			case 0x81:
5936 				un->un_vpd_page_mask |= SD_VPD_OPERATING_PG;
5937 				break;
5938 			case 0x82:
5939 				un->un_vpd_page_mask |= SD_VPD_ASCII_OP_PG;
5940 				break;
5941 			case 0x83:
5942 				un->un_vpd_page_mask |= SD_VPD_DEVID_WWN_PG;
5943 				break;
5944 			case 0x86:
5945 				un->un_vpd_page_mask |= SD_VPD_EXTENDED_DATA_PG;
5946 				break;
5947 			case 0xB0:
5948 				un->un_vpd_page_mask |= SD_VPD_BLK_LIMITS_PG;
5949 				break;
5950 			case 0xB1:
5951 				un->un_vpd_page_mask |= SD_VPD_DEV_CHARACTER_PG;
5952 				break;
5953 			}
5954 			counter++;
5955 		}
5956 
5957 	} else {
5958 		rval = -1;
5959 
5960 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
5961 		    "sd_check_vpd_page_support: This drive does not implement "
5962 		    "VPD pages.\n");
5963 	}
5964 
5965 	kmem_free(page_list, page_length);
5966 
5967 	return (rval);
5968 }
5969 
5970 
5971 /*
5972  *    Function: sd_setup_pm
5973  *
5974  * Description: Initialize Power Management on the device
5975  *
5976  *     Context: Kernel Thread
5977  */
5978 
5979 static void
5980 sd_setup_pm(sd_ssc_t *ssc, dev_info_t *devi)
5981 {
5982 	uint_t		log_page_size;
5983 	uchar_t		*log_page_data;
5984 	int		rval = 0;
5985 	struct sd_lun	*un;
5986 
5987 	ASSERT(ssc != NULL);
5988 	un = ssc->ssc_un;
5989 	ASSERT(un != NULL);
5990 
5991 	/*
5992 	 * Since we are called from attach, holding a mutex for
5993 	 * un is unnecessary. Because some of the routines called
5994 	 * from here require SD_MUTEX to not be held, assert this
5995 	 * right up front.
5996 	 */
5997 	ASSERT(!mutex_owned(SD_MUTEX(un)));
5998 	/*
5999 	 * Since the sd device does not have the 'reg' property,
6000 	 * cpr will not call its DDI_SUSPEND/DDI_RESUME entries.
6001 	 * The following code is to tell cpr that this device
6002 	 * DOES need to be suspended and resumed.
6003 	 */
6004 	(void) ddi_prop_update_string(DDI_DEV_T_NONE, devi,
6005 	    "pm-hardware-state", "needs-suspend-resume");
6006 
6007 	/*
6008 	 * This complies with the new power management framework
6009 	 * for certain desktop machines. Create the pm_components
6010 	 * property as a string array property.
6011 	 * If un_f_pm_supported is TRUE, that means the disk
6012 	 * attached HBA has set the "pm-capable" property and
6013 	 * the value of this property is bigger than 0.
6014 	 */
6015 	if (un->un_f_pm_supported) {
6016 		/*
6017 		 * not all devices have a motor, try it first.
6018 		 * some devices may return ILLEGAL REQUEST, some
6019 		 * will hang
6020 		 * The following START_STOP_UNIT is used to check if target
6021 		 * device has a motor.
6022 		 */
6023 		un->un_f_start_stop_supported = TRUE;
6024 
6025 		if (un->un_f_power_condition_supported) {
6026 			rval = sd_send_scsi_START_STOP_UNIT(ssc,
6027 			    SD_POWER_CONDITION, SD_TARGET_ACTIVE,
6028 			    SD_PATH_DIRECT);
6029 			if (rval != 0) {
6030 				un->un_f_power_condition_supported = FALSE;
6031 			}
6032 		}
6033 		if (!un->un_f_power_condition_supported) {
6034 			rval = sd_send_scsi_START_STOP_UNIT(ssc,
6035 			    SD_START_STOP, SD_TARGET_START, SD_PATH_DIRECT);
6036 		}
6037 		if (rval != 0) {
6038 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
6039 			un->un_f_start_stop_supported = FALSE;
6040 		}
6041 
6042 		/*
6043 		 * create pm properties anyways otherwise the parent can't
6044 		 * go to sleep
6045 		 */
6046 		un->un_f_pm_is_enabled = TRUE;
6047 		(void) sd_create_pm_components(devi, un);
6048 
6049 		/*
6050 		 * If it claims that log sense is supported, check it out.
6051 		 */
6052 		if (un->un_f_log_sense_supported) {
6053 			rval = sd_log_page_supported(ssc,
6054 			    START_STOP_CYCLE_PAGE);
6055 			if (rval == 1) {
6056 				/* Page found, use it. */
6057 				un->un_start_stop_cycle_page =
6058 				    START_STOP_CYCLE_PAGE;
6059 			} else {
6060 				/*
6061 				 * Page not found or log sense is not
6062 				 * supported.
6063 				 * Notice we do not check the old style
6064 				 * START_STOP_CYCLE_VU_PAGE because this
6065 				 * code path does not apply to old disks.
6066 				 */
6067 				un->un_f_log_sense_supported = FALSE;
6068 				un->un_f_pm_log_sense_smart = FALSE;
6069 			}
6070 		}
6071 
6072 		return;
6073 	}
6074 
6075 	/*
6076 	 * For the disk whose attached HBA has not set the "pm-capable"
6077 	 * property, check if it supports the power management.
6078 	 */
6079 	if (!un->un_f_log_sense_supported) {
6080 		un->un_power_level = SD_SPINDLE_ON;
6081 		un->un_f_pm_is_enabled = FALSE;
6082 		return;
6083 	}
6084 
6085 	rval = sd_log_page_supported(ssc, START_STOP_CYCLE_PAGE);
6086 
6087 #ifdef	SDDEBUG
6088 	if (sd_force_pm_supported) {
6089 		/* Force a successful result */
6090 		rval = 1;
6091 	}
6092 #endif
6093 
6094 	/*
6095 	 * If the start-stop cycle counter log page is not supported
6096 	 * or if the pm-capable property is set to be false (0),
6097 	 * then we should not create the pm_components property.
6098 	 */
6099 	if (rval == -1) {
6100 		/*
6101 		 * Error.
6102 		 * Reading log sense failed, most likely this is
6103 		 * an older drive that does not support log sense.
6104 		 * If this fails auto-pm is not supported.
6105 		 */
6106 		un->un_power_level = SD_SPINDLE_ON;
6107 		un->un_f_pm_is_enabled = FALSE;
6108 
6109 	} else if (rval == 0) {
6110 		/*
6111 		 * Page not found.
6112 		 * The start stop cycle counter is implemented as page
6113 		 * START_STOP_CYCLE_PAGE_VU_PAGE (0x31) in older disks. For
6114 		 * newer disks it is implemented as START_STOP_CYCLE_PAGE (0xE).
6115 		 */
6116 		if (sd_log_page_supported(ssc, START_STOP_CYCLE_VU_PAGE) == 1) {
6117 			/*
6118 			 * Page found, use this one.
6119 			 */
6120 			un->un_start_stop_cycle_page = START_STOP_CYCLE_VU_PAGE;
6121 			un->un_f_pm_is_enabled = TRUE;
6122 		} else {
6123 			/*
6124 			 * Error or page not found.
6125 			 * auto-pm is not supported for this device.
6126 			 */
6127 			un->un_power_level = SD_SPINDLE_ON;
6128 			un->un_f_pm_is_enabled = FALSE;
6129 		}
6130 	} else {
6131 		/*
6132 		 * Page found, use it.
6133 		 */
6134 		un->un_start_stop_cycle_page = START_STOP_CYCLE_PAGE;
6135 		un->un_f_pm_is_enabled = TRUE;
6136 	}
6137 
6138 
6139 	if (un->un_f_pm_is_enabled == TRUE) {
6140 		log_page_size = START_STOP_CYCLE_COUNTER_PAGE_SIZE;
6141 		log_page_data = kmem_zalloc(log_page_size, KM_SLEEP);
6142 
6143 		rval = sd_send_scsi_LOG_SENSE(ssc, log_page_data,
6144 		    log_page_size, un->un_start_stop_cycle_page,
6145 		    0x01, 0, SD_PATH_DIRECT);
6146 
6147 		if (rval != 0) {
6148 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
6149 		}
6150 
6151 #ifdef	SDDEBUG
6152 		if (sd_force_pm_supported) {
6153 			/* Force a successful result */
6154 			rval = 0;
6155 		}
6156 #endif
6157 
6158 		/*
6159 		 * If the Log sense for Page( Start/stop cycle counter page)
6160 		 * succeeds, then power management is supported and we can
6161 		 * enable auto-pm.
6162 		 */
6163 		if (rval == 0)  {
6164 			(void) sd_create_pm_components(devi, un);
6165 		} else {
6166 			un->un_power_level = SD_SPINDLE_ON;
6167 			un->un_f_pm_is_enabled = FALSE;
6168 		}
6169 
6170 		kmem_free(log_page_data, log_page_size);
6171 	}
6172 }
6173 
6174 
6175 /*
6176  *    Function: sd_create_pm_components
6177  *
6178  * Description: Initialize PM property.
6179  *
6180  *     Context: Kernel thread context
6181  */
6182 
6183 static void
6184 sd_create_pm_components(dev_info_t *devi, struct sd_lun *un)
6185 {
6186 	ASSERT(!mutex_owned(SD_MUTEX(un)));
6187 
6188 	if (un->un_f_power_condition_supported) {
6189 		if (ddi_prop_update_string_array(DDI_DEV_T_NONE, devi,
6190 		    "pm-components", sd_pwr_pc.pm_comp, 5)
6191 		    != DDI_PROP_SUCCESS) {
6192 			un->un_power_level = SD_SPINDLE_ACTIVE;
6193 			un->un_f_pm_is_enabled = FALSE;
6194 			return;
6195 		}
6196 	} else {
6197 		if (ddi_prop_update_string_array(DDI_DEV_T_NONE, devi,
6198 		    "pm-components", sd_pwr_ss.pm_comp, 3)
6199 		    != DDI_PROP_SUCCESS) {
6200 			un->un_power_level = SD_SPINDLE_ON;
6201 			un->un_f_pm_is_enabled = FALSE;
6202 			return;
6203 		}
6204 	}
6205 	/*
6206 	 * When components are initially created they are idle,
6207 	 * power up any non-removables.
6208 	 * Note: the return value of pm_raise_power can't be used
6209 	 * for determining if PM should be enabled for this device.
6210 	 * Even if you check the return values and remove this
6211 	 * property created above, the PM framework will not honor the
6212 	 * change after the first call to pm_raise_power. Hence,
6213 	 * removal of that property does not help if pm_raise_power
6214 	 * fails. In the case of removable media, the start/stop
6215 	 * will fail if the media is not present.
6216 	 */
6217 	if (un->un_f_attach_spinup && (pm_raise_power(SD_DEVINFO(un), 0,
6218 	    SD_PM_STATE_ACTIVE(un)) == DDI_SUCCESS)) {
6219 		mutex_enter(SD_MUTEX(un));
6220 		un->un_power_level = SD_PM_STATE_ACTIVE(un);
6221 		mutex_enter(&un->un_pm_mutex);
6222 		/* Set to on and not busy. */
6223 		un->un_pm_count = 0;
6224 	} else {
6225 		mutex_enter(SD_MUTEX(un));
6226 		un->un_power_level = SD_PM_STATE_STOPPED(un);
6227 		mutex_enter(&un->un_pm_mutex);
6228 		/* Set to off. */
6229 		un->un_pm_count = -1;
6230 	}
6231 	mutex_exit(&un->un_pm_mutex);
6232 	mutex_exit(SD_MUTEX(un));
6233 }
6234 
6235 
6236 /*
6237  *    Function: sd_ddi_suspend
6238  *
6239  * Description: Performs system power-down operations. This includes
6240  *		setting the drive state to indicate its suspended so
6241  *		that no new commands will be accepted. Also, wait for
6242  *		all commands that are in transport or queued to a timer
6243  *		for retry to complete. All timeout threads are cancelled.
6244  *
6245  * Return Code: DDI_FAILURE or DDI_SUCCESS
6246  *
6247  *     Context: Kernel thread context
6248  */
6249 
6250 static int
6251 sd_ddi_suspend(dev_info_t *devi)
6252 {
6253 	struct	sd_lun	*un;
6254 	clock_t		wait_cmds_complete;
6255 
6256 	un = ddi_get_soft_state(sd_state, ddi_get_instance(devi));
6257 	if (un == NULL) {
6258 		return (DDI_FAILURE);
6259 	}
6260 
6261 	SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: entry\n");
6262 
6263 	mutex_enter(SD_MUTEX(un));
6264 
6265 	/* Return success if the device is already suspended. */
6266 	if (un->un_state == SD_STATE_SUSPENDED) {
6267 		mutex_exit(SD_MUTEX(un));
6268 		SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: "
6269 		    "device already suspended, exiting\n");
6270 		return (DDI_SUCCESS);
6271 	}
6272 
6273 	/* Return failure if the device is being used by HA */
6274 	if (un->un_resvd_status &
6275 	    (SD_RESERVE | SD_WANT_RESERVE | SD_LOST_RESERVE)) {
6276 		mutex_exit(SD_MUTEX(un));
6277 		SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: "
6278 		    "device in use by HA, exiting\n");
6279 		return (DDI_FAILURE);
6280 	}
6281 
6282 	/*
6283 	 * Return failure if the device is in a resource wait
6284 	 * or power changing state.
6285 	 */
6286 	if ((un->un_state == SD_STATE_RWAIT) ||
6287 	    (un->un_state == SD_STATE_PM_CHANGING)) {
6288 		mutex_exit(SD_MUTEX(un));
6289 		SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: "
6290 		    "device in resource wait state, exiting\n");
6291 		return (DDI_FAILURE);
6292 	}
6293 
6294 
6295 	un->un_save_state = un->un_last_state;
6296 	New_state(un, SD_STATE_SUSPENDED);
6297 
6298 	/*
6299 	 * Wait for all commands that are in transport or queued to a timer
6300 	 * for retry to complete.
6301 	 *
6302 	 * While waiting, no new commands will be accepted or sent because of
6303 	 * the new state we set above.
6304 	 *
6305 	 * Wait till current operation has completed. If we are in the resource
6306 	 * wait state (with an intr outstanding) then we need to wait till the
6307 	 * intr completes and starts the next cmd. We want to wait for
6308 	 * SD_WAIT_CMDS_COMPLETE seconds before failing the DDI_SUSPEND.
6309 	 */
6310 	wait_cmds_complete = ddi_get_lbolt() +
6311 	    (sd_wait_cmds_complete * drv_usectohz(1000000));
6312 
6313 	while (un->un_ncmds_in_transport != 0) {
6314 		/*
6315 		 * Fail if commands do not finish in the specified time.
6316 		 */
6317 		if (cv_timedwait(&un->un_disk_busy_cv, SD_MUTEX(un),
6318 		    wait_cmds_complete) == -1) {
6319 			/*
6320 			 * Undo the state changes made above. Everything
6321 			 * must go back to it's original value.
6322 			 */
6323 			Restore_state(un);
6324 			un->un_last_state = un->un_save_state;
6325 			/* Wake up any threads that might be waiting. */
6326 			cv_broadcast(&un->un_suspend_cv);
6327 			mutex_exit(SD_MUTEX(un));
6328 			SD_ERROR(SD_LOG_IO_PM, un,
6329 			    "sd_ddi_suspend: failed due to outstanding cmds\n");
6330 			SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: exiting\n");
6331 			return (DDI_FAILURE);
6332 		}
6333 	}
6334 
6335 	/*
6336 	 * Cancel SCSI watch thread and timeouts, if any are active
6337 	 */
6338 
6339 	if (SD_OK_TO_SUSPEND_SCSI_WATCHER(un)) {
6340 		opaque_t temp_token = un->un_swr_token;
6341 		mutex_exit(SD_MUTEX(un));
6342 		scsi_watch_suspend(temp_token);
6343 		mutex_enter(SD_MUTEX(un));
6344 	}
6345 
6346 	if (un->un_reset_throttle_timeid != NULL) {
6347 		timeout_id_t temp_id = un->un_reset_throttle_timeid;
6348 		un->un_reset_throttle_timeid = NULL;
6349 		mutex_exit(SD_MUTEX(un));
6350 		(void) untimeout(temp_id);
6351 		mutex_enter(SD_MUTEX(un));
6352 	}
6353 
6354 	if (un->un_dcvb_timeid != NULL) {
6355 		timeout_id_t temp_id = un->un_dcvb_timeid;
6356 		un->un_dcvb_timeid = NULL;
6357 		mutex_exit(SD_MUTEX(un));
6358 		(void) untimeout(temp_id);
6359 		mutex_enter(SD_MUTEX(un));
6360 	}
6361 
6362 	mutex_enter(&un->un_pm_mutex);
6363 	if (un->un_pm_timeid != NULL) {
6364 		timeout_id_t temp_id = un->un_pm_timeid;
6365 		un->un_pm_timeid = NULL;
6366 		mutex_exit(&un->un_pm_mutex);
6367 		mutex_exit(SD_MUTEX(un));
6368 		(void) untimeout(temp_id);
6369 		mutex_enter(SD_MUTEX(un));
6370 	} else {
6371 		mutex_exit(&un->un_pm_mutex);
6372 	}
6373 
6374 	if (un->un_rmw_msg_timeid != NULL) {
6375 		timeout_id_t temp_id = un->un_rmw_msg_timeid;
6376 		un->un_rmw_msg_timeid = NULL;
6377 		mutex_exit(SD_MUTEX(un));
6378 		(void) untimeout(temp_id);
6379 		mutex_enter(SD_MUTEX(un));
6380 	}
6381 
6382 	if (un->un_retry_timeid != NULL) {
6383 		timeout_id_t temp_id = un->un_retry_timeid;
6384 		un->un_retry_timeid = NULL;
6385 		mutex_exit(SD_MUTEX(un));
6386 		(void) untimeout(temp_id);
6387 		mutex_enter(SD_MUTEX(un));
6388 
6389 		if (un->un_retry_bp != NULL) {
6390 			un->un_retry_bp->av_forw = un->un_waitq_headp;
6391 			un->un_waitq_headp = un->un_retry_bp;
6392 			if (un->un_waitq_tailp == NULL) {
6393 				un->un_waitq_tailp = un->un_retry_bp;
6394 			}
6395 			un->un_retry_bp = NULL;
6396 			un->un_retry_statp = NULL;
6397 		}
6398 	}
6399 
6400 	if (un->un_direct_priority_timeid != NULL) {
6401 		timeout_id_t temp_id = un->un_direct_priority_timeid;
6402 		un->un_direct_priority_timeid = NULL;
6403 		mutex_exit(SD_MUTEX(un));
6404 		(void) untimeout(temp_id);
6405 		mutex_enter(SD_MUTEX(un));
6406 	}
6407 
6408 	if (un->un_f_is_fibre == TRUE) {
6409 		/*
6410 		 * Remove callbacks for insert and remove events
6411 		 */
6412 		if (un->un_insert_event != NULL) {
6413 			mutex_exit(SD_MUTEX(un));
6414 			(void) ddi_remove_event_handler(un->un_insert_cb_id);
6415 			mutex_enter(SD_MUTEX(un));
6416 			un->un_insert_event = NULL;
6417 		}
6418 
6419 		if (un->un_remove_event != NULL) {
6420 			mutex_exit(SD_MUTEX(un));
6421 			(void) ddi_remove_event_handler(un->un_remove_cb_id);
6422 			mutex_enter(SD_MUTEX(un));
6423 			un->un_remove_event = NULL;
6424 		}
6425 	}
6426 
6427 	mutex_exit(SD_MUTEX(un));
6428 
6429 	SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: exit\n");
6430 
6431 	return (DDI_SUCCESS);
6432 }
6433 
6434 
6435 /*
6436  *    Function: sd_ddi_resume
6437  *
6438  * Description: Performs system power-up operations..
6439  *
6440  * Return Code: DDI_SUCCESS
6441  *		DDI_FAILURE
6442  *
6443  *     Context: Kernel thread context
6444  */
6445 
6446 static int
6447 sd_ddi_resume(dev_info_t *devi)
6448 {
6449 	struct	sd_lun	*un;
6450 
6451 	un = ddi_get_soft_state(sd_state, ddi_get_instance(devi));
6452 	if (un == NULL) {
6453 		return (DDI_FAILURE);
6454 	}
6455 
6456 	SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_resume: entry\n");
6457 
6458 	mutex_enter(SD_MUTEX(un));
6459 	Restore_state(un);
6460 
6461 	/*
6462 	 * Restore the state which was saved to give the
6463 	 * the right state in un_last_state
6464 	 */
6465 	un->un_last_state = un->un_save_state;
6466 	/*
6467 	 * Note: throttle comes back at full.
6468 	 * Also note: this MUST be done before calling pm_raise_power
6469 	 * otherwise the system can get hung in biowait. The scenario where
6470 	 * this'll happen is under cpr suspend. Writing of the system
6471 	 * state goes through sddump, which writes 0 to un_throttle. If
6472 	 * writing the system state then fails, example if the partition is
6473 	 * too small, then cpr attempts a resume. If throttle isn't restored
6474 	 * from the saved value until after calling pm_raise_power then
6475 	 * cmds sent in sdpower are not transported and sd_send_scsi_cmd hangs
6476 	 * in biowait.
6477 	 */
6478 	un->un_throttle = un->un_saved_throttle;
6479 
6480 	/*
6481 	 * The chance of failure is very rare as the only command done in power
6482 	 * entry point is START command when you transition from 0->1 or
6483 	 * unknown->1. Put it to SPINDLE ON state irrespective of the state at
6484 	 * which suspend was done. Ignore the return value as the resume should
6485 	 * not be failed. In the case of removable media the media need not be
6486 	 * inserted and hence there is a chance that raise power will fail with
6487 	 * media not present.
6488 	 */
6489 	if (un->un_f_attach_spinup) {
6490 		mutex_exit(SD_MUTEX(un));
6491 		(void) pm_raise_power(SD_DEVINFO(un), 0,
6492 		    SD_PM_STATE_ACTIVE(un));
6493 		mutex_enter(SD_MUTEX(un));
6494 	}
6495 
6496 	/*
6497 	 * Don't broadcast to the suspend cv and therefore possibly
6498 	 * start I/O until after power has been restored.
6499 	 */
6500 	cv_broadcast(&un->un_suspend_cv);
6501 	cv_broadcast(&un->un_state_cv);
6502 
6503 	/* restart thread */
6504 	if (SD_OK_TO_RESUME_SCSI_WATCHER(un)) {
6505 		scsi_watch_resume(un->un_swr_token);
6506 	}
6507 
6508 #if (defined(__fibre))
6509 	if (un->un_f_is_fibre == TRUE) {
6510 		/*
6511 		 * Add callbacks for insert and remove events
6512 		 */
6513 		if (strcmp(un->un_node_type, DDI_NT_BLOCK_CHAN)) {
6514 			sd_init_event_callbacks(un);
6515 		}
6516 	}
6517 #endif
6518 
6519 	/*
6520 	 * Transport any pending commands to the target.
6521 	 *
6522 	 * If this is a low-activity device commands in queue will have to wait
6523 	 * until new commands come in, which may take awhile. Also, we
6524 	 * specifically don't check un_ncmds_in_transport because we know that
6525 	 * there really are no commands in progress after the unit was
6526 	 * suspended and we could have reached the throttle level, been
6527 	 * suspended, and have no new commands coming in for awhile. Highly
6528 	 * unlikely, but so is the low-activity disk scenario.
6529 	 */
6530 	ddi_xbuf_dispatch(un->un_xbuf_attr);
6531 
6532 	sd_start_cmds(un, NULL);
6533 	mutex_exit(SD_MUTEX(un));
6534 
6535 	SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_resume: exit\n");
6536 
6537 	return (DDI_SUCCESS);
6538 }
6539 
6540 
6541 /*
6542  *    Function: sd_pm_state_change
6543  *
6544  * Description: Change the driver power state.
6545  *		Someone else is required to actually change the driver
6546  *		power level.
6547  *
6548  *   Arguments: un - driver soft state (unit) structure
6549  *              level - the power level that is changed to
6550  *              flag - to decide how to change the power state
6551  *
6552  * Return Code: DDI_SUCCESS
6553  *
6554  *     Context: Kernel thread context
6555  */
6556 static int
6557 sd_pm_state_change(struct sd_lun *un, int level, int flag)
6558 {
6559 	ASSERT(un != NULL);
6560 	SD_TRACE(SD_LOG_POWER, un, "sd_pm_state_change: entry\n");
6561 
6562 	ASSERT(!mutex_owned(SD_MUTEX(un)));
6563 	mutex_enter(SD_MUTEX(un));
6564 
6565 	if (flag == SD_PM_STATE_ROLLBACK || SD_PM_IS_IO_CAPABLE(un, level)) {
6566 		un->un_power_level = level;
6567 		ASSERT(!mutex_owned(&un->un_pm_mutex));
6568 		mutex_enter(&un->un_pm_mutex);
6569 		if (SD_DEVICE_IS_IN_LOW_POWER(un)) {
6570 			un->un_pm_count++;
6571 			ASSERT(un->un_pm_count == 0);
6572 		}
6573 		mutex_exit(&un->un_pm_mutex);
6574 	} else {
6575 		/*
6576 		 * Exit if power management is not enabled for this device,
6577 		 * or if the device is being used by HA.
6578 		 */
6579 		if ((un->un_f_pm_is_enabled == FALSE) || (un->un_resvd_status &
6580 		    (SD_RESERVE | SD_WANT_RESERVE | SD_LOST_RESERVE))) {
6581 			mutex_exit(SD_MUTEX(un));
6582 			SD_TRACE(SD_LOG_POWER, un,
6583 			    "sd_pm_state_change: exiting\n");
6584 			return (DDI_FAILURE);
6585 		}
6586 
6587 		SD_INFO(SD_LOG_POWER, un, "sd_pm_state_change: "
6588 		    "un_ncmds_in_driver=%ld\n", un->un_ncmds_in_driver);
6589 
6590 		/*
6591 		 * See if the device is not busy, ie.:
6592 		 *    - we have no commands in the driver for this device
6593 		 *    - not waiting for resources
6594 		 */
6595 		if ((un->un_ncmds_in_driver == 0) &&
6596 		    (un->un_state != SD_STATE_RWAIT)) {
6597 			/*
6598 			 * The device is not busy, so it is OK to go to low
6599 			 * power state. Indicate low power, but rely on someone
6600 			 * else to actually change it.
6601 			 */
6602 			mutex_enter(&un->un_pm_mutex);
6603 			un->un_pm_count = -1;
6604 			mutex_exit(&un->un_pm_mutex);
6605 			un->un_power_level = level;
6606 		}
6607 	}
6608 
6609 	mutex_exit(SD_MUTEX(un));
6610 
6611 	SD_TRACE(SD_LOG_POWER, un, "sd_pm_state_change: exit\n");
6612 
6613 	return (DDI_SUCCESS);
6614 }
6615 
6616 
6617 /*
6618  *    Function: sd_pm_idletimeout_handler
6619  *
6620  * Description: A timer routine that's active only while a device is busy.
6621  *		The purpose is to extend slightly the pm framework's busy
6622  *		view of the device to prevent busy/idle thrashing for
6623  *		back-to-back commands. Do this by comparing the current time
6624  *		to the time at which the last command completed and when the
6625  *		difference is greater than sd_pm_idletime, call
6626  *		pm_idle_component. In addition to indicating idle to the pm
6627  *		framework, update the chain type to again use the internal pm
6628  *		layers of the driver.
6629  *
6630  *   Arguments: arg - driver soft state (unit) structure
6631  *
6632  *     Context: Executes in a timeout(9F) thread context
6633  */
6634 
6635 static void
6636 sd_pm_idletimeout_handler(void *arg)
6637 {
6638 	const hrtime_t idletime = sd_pm_idletime * NANOSEC;
6639 	struct sd_lun *un = arg;
6640 
6641 	mutex_enter(&sd_detach_mutex);
6642 	if (un->un_detach_count != 0) {
6643 		/* Abort if the instance is detaching */
6644 		mutex_exit(&sd_detach_mutex);
6645 		return;
6646 	}
6647 	mutex_exit(&sd_detach_mutex);
6648 
6649 	/*
6650 	 * Grab both mutexes, in the proper order, since we're accessing
6651 	 * both PM and softstate variables.
6652 	 */
6653 	mutex_enter(SD_MUTEX(un));
6654 	mutex_enter(&un->un_pm_mutex);
6655 	if (((gethrtime() - un->un_pm_idle_time) > idletime) &&
6656 	    (un->un_ncmds_in_driver == 0) && (un->un_pm_count == 0)) {
6657 		/*
6658 		 * Update the chain types.
6659 		 * This takes affect on the next new command received.
6660 		 */
6661 		if (un->un_f_non_devbsize_supported) {
6662 			un->un_buf_chain_type = SD_CHAIN_INFO_RMMEDIA;
6663 		} else {
6664 			un->un_buf_chain_type = SD_CHAIN_INFO_DISK;
6665 		}
6666 		un->un_uscsi_chain_type = SD_CHAIN_INFO_USCSI_CMD;
6667 
6668 		SD_TRACE(SD_LOG_IO_PM, un,
6669 		    "sd_pm_idletimeout_handler: idling device\n");
6670 		(void) pm_idle_component(SD_DEVINFO(un), 0);
6671 		un->un_pm_idle_timeid = NULL;
6672 	} else {
6673 		un->un_pm_idle_timeid =
6674 		    timeout(sd_pm_idletimeout_handler, un,
6675 		    (drv_usectohz((clock_t)300000))); /* 300 ms. */
6676 	}
6677 	mutex_exit(&un->un_pm_mutex);
6678 	mutex_exit(SD_MUTEX(un));
6679 }
6680 
6681 
6682 /*
6683  *    Function: sd_pm_timeout_handler
6684  *
6685  * Description: Callback to tell framework we are idle.
6686  *
6687  *     Context: timeout(9f) thread context.
6688  */
6689 
6690 static void
6691 sd_pm_timeout_handler(void *arg)
6692 {
6693 	struct sd_lun *un = arg;
6694 
6695 	(void) pm_idle_component(SD_DEVINFO(un), 0);
6696 	mutex_enter(&un->un_pm_mutex);
6697 	un->un_pm_timeid = NULL;
6698 	mutex_exit(&un->un_pm_mutex);
6699 }
6700 
6701 
6702 /*
6703  *    Function: sdpower
6704  *
6705  * Description: PM entry point.
6706  *
6707  * Return Code: DDI_SUCCESS
6708  *		DDI_FAILURE
6709  *
6710  *     Context: Kernel thread context
6711  */
6712 
6713 static int
6714 sdpower(dev_info_t *devi, int component, int level)
6715 {
6716 	struct sd_lun	*un;
6717 	int		instance;
6718 	int		rval = DDI_SUCCESS;
6719 	uint_t		i, log_page_size, maxcycles, ncycles;
6720 	uchar_t		*log_page_data;
6721 	int		log_sense_page;
6722 	int		medium_present;
6723 	time_t		intvlp;
6724 	struct pm_trans_data	sd_pm_tran_data;
6725 	uchar_t		save_state = SD_STATE_NORMAL;
6726 	int		sval;
6727 	uchar_t		state_before_pm;
6728 	int		got_semaphore_here;
6729 	sd_ssc_t	*ssc;
6730 	int	last_power_level = SD_SPINDLE_UNINIT;
6731 
6732 	instance = ddi_get_instance(devi);
6733 
6734 	if (((un = ddi_get_soft_state(sd_state, instance)) == NULL) ||
6735 	    !SD_PM_IS_LEVEL_VALID(un, level) || component != 0) {
6736 		return (DDI_FAILURE);
6737 	}
6738 
6739 	ssc = sd_ssc_init(un);
6740 
6741 	SD_TRACE(SD_LOG_IO_PM, un, "sdpower: entry, level = %d\n", level);
6742 
6743 	/*
6744 	 * Must synchronize power down with close.
6745 	 * Attempt to decrement/acquire the open/close semaphore,
6746 	 * but do NOT wait on it. If it's not greater than zero,
6747 	 * ie. it can't be decremented without waiting, then
6748 	 * someone else, either open or close, already has it
6749 	 * and the try returns 0. Use that knowledge here to determine
6750 	 * if it's OK to change the device power level.
6751 	 * Also, only increment it on exit if it was decremented, ie. gotten,
6752 	 * here.
6753 	 */
6754 	got_semaphore_here = sema_tryp(&un->un_semoclose);
6755 
6756 	mutex_enter(SD_MUTEX(un));
6757 
6758 	SD_INFO(SD_LOG_POWER, un, "sdpower: un_ncmds_in_driver = %ld\n",
6759 	    un->un_ncmds_in_driver);
6760 
6761 	/*
6762 	 * If un_ncmds_in_driver is non-zero it indicates commands are
6763 	 * already being processed in the driver, or if the semaphore was
6764 	 * not gotten here it indicates an open or close is being processed.
6765 	 * At the same time somebody is requesting to go to a lower power
6766 	 * that can't perform I/O, which can't happen, therefore we need to
6767 	 * return failure.
6768 	 */
6769 	if ((!SD_PM_IS_IO_CAPABLE(un, level)) &&
6770 	    ((un->un_ncmds_in_driver != 0) || (got_semaphore_here == 0))) {
6771 		mutex_exit(SD_MUTEX(un));
6772 
6773 		if (got_semaphore_here != 0) {
6774 			sema_v(&un->un_semoclose);
6775 		}
6776 		SD_TRACE(SD_LOG_IO_PM, un,
6777 		    "sdpower: exit, device has queued cmds.\n");
6778 
6779 		goto sdpower_failed;
6780 	}
6781 
6782 	/*
6783 	 * if it is OFFLINE that means the disk is completely dead
6784 	 * in our case we have to put the disk in on or off by sending commands
6785 	 * Of course that will fail anyway so return back here.
6786 	 *
6787 	 * Power changes to a device that's OFFLINE or SUSPENDED
6788 	 * are not allowed.
6789 	 */
6790 	if ((un->un_state == SD_STATE_OFFLINE) ||
6791 	    (un->un_state == SD_STATE_SUSPENDED)) {
6792 		mutex_exit(SD_MUTEX(un));
6793 
6794 		if (got_semaphore_here != 0) {
6795 			sema_v(&un->un_semoclose);
6796 		}
6797 		SD_TRACE(SD_LOG_IO_PM, un,
6798 		    "sdpower: exit, device is off-line.\n");
6799 
6800 		goto sdpower_failed;
6801 	}
6802 
6803 	/*
6804 	 * Change the device's state to indicate it's power level
6805 	 * is being changed. Do this to prevent a power off in the
6806 	 * middle of commands, which is especially bad on devices
6807 	 * that are really powered off instead of just spun down.
6808 	 */
6809 	state_before_pm = un->un_state;
6810 	un->un_state = SD_STATE_PM_CHANGING;
6811 
6812 	mutex_exit(SD_MUTEX(un));
6813 
6814 	/*
6815 	 * If log sense command is not supported, bypass the
6816 	 * following checking, otherwise, check the log sense
6817 	 * information for this device.
6818 	 */
6819 	if (SD_PM_STOP_MOTOR_NEEDED(un, level) &&
6820 	    un->un_f_log_sense_supported) {
6821 		/*
6822 		 * Get the log sense information to understand whether the
6823 		 * the powercycle counts have gone beyond the threshhold.
6824 		 */
6825 		log_page_size = START_STOP_CYCLE_COUNTER_PAGE_SIZE;
6826 		log_page_data = kmem_zalloc(log_page_size, KM_SLEEP);
6827 
6828 		mutex_enter(SD_MUTEX(un));
6829 		log_sense_page = un->un_start_stop_cycle_page;
6830 		mutex_exit(SD_MUTEX(un));
6831 
6832 		rval = sd_send_scsi_LOG_SENSE(ssc, log_page_data,
6833 		    log_page_size, log_sense_page, 0x01, 0, SD_PATH_DIRECT);
6834 
6835 		if (rval != 0) {
6836 			if (rval == EIO)
6837 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
6838 			else
6839 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
6840 		}
6841 
6842 #ifdef	SDDEBUG
6843 		if (sd_force_pm_supported) {
6844 			/* Force a successful result */
6845 			rval = 0;
6846 		}
6847 #endif
6848 		if (rval != 0) {
6849 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
6850 			    "Log Sense Failed\n");
6851 
6852 			kmem_free(log_page_data, log_page_size);
6853 			/* Cannot support power management on those drives */
6854 
6855 			if (got_semaphore_here != 0) {
6856 				sema_v(&un->un_semoclose);
6857 			}
6858 			/*
6859 			 * On exit put the state back to it's original value
6860 			 * and broadcast to anyone waiting for the power
6861 			 * change completion.
6862 			 */
6863 			mutex_enter(SD_MUTEX(un));
6864 			un->un_state = state_before_pm;
6865 			cv_broadcast(&un->un_suspend_cv);
6866 			mutex_exit(SD_MUTEX(un));
6867 			SD_TRACE(SD_LOG_IO_PM, un,
6868 			    "sdpower: exit, Log Sense Failed.\n");
6869 
6870 			goto sdpower_failed;
6871 		}
6872 
6873 		/*
6874 		 * From the page data - Convert the essential information to
6875 		 * pm_trans_data
6876 		 */
6877 		maxcycles =
6878 		    (log_page_data[0x1c] << 24) | (log_page_data[0x1d] << 16) |
6879 		    (log_page_data[0x1E] << 8)  | log_page_data[0x1F];
6880 
6881 		ncycles =
6882 		    (log_page_data[0x24] << 24) | (log_page_data[0x25] << 16) |
6883 		    (log_page_data[0x26] << 8)  | log_page_data[0x27];
6884 
6885 		if (un->un_f_pm_log_sense_smart) {
6886 			sd_pm_tran_data.un.smart_count.allowed = maxcycles;
6887 			sd_pm_tran_data.un.smart_count.consumed = ncycles;
6888 			sd_pm_tran_data.un.smart_count.flag = 0;
6889 			sd_pm_tran_data.format = DC_SMART_FORMAT;
6890 		} else {
6891 			sd_pm_tran_data.un.scsi_cycles.lifemax = maxcycles;
6892 			sd_pm_tran_data.un.scsi_cycles.ncycles = ncycles;
6893 			for (i = 0; i < DC_SCSI_MFR_LEN; i++) {
6894 				sd_pm_tran_data.un.scsi_cycles.svc_date[i] =
6895 				    log_page_data[8+i];
6896 			}
6897 			sd_pm_tran_data.un.scsi_cycles.flag = 0;
6898 			sd_pm_tran_data.format = DC_SCSI_FORMAT;
6899 		}
6900 
6901 		kmem_free(log_page_data, log_page_size);
6902 
6903 		/*
6904 		 * Call pm_trans_check routine to get the Ok from
6905 		 * the global policy
6906 		 */
6907 		rval = pm_trans_check(&sd_pm_tran_data, &intvlp);
6908 #ifdef	SDDEBUG
6909 		if (sd_force_pm_supported) {
6910 			/* Force a successful result */
6911 			rval = 1;
6912 		}
6913 #endif
6914 		switch (rval) {
6915 		case 0:
6916 			/*
6917 			 * Not Ok to Power cycle or error in parameters passed
6918 			 * Would have given the advised time to consider power
6919 			 * cycle. Based on the new intvlp parameter we are
6920 			 * supposed to pretend we are busy so that pm framework
6921 			 * will never call our power entry point. Because of
6922 			 * that install a timeout handler and wait for the
6923 			 * recommended time to elapse so that power management
6924 			 * can be effective again.
6925 			 *
6926 			 * To effect this behavior, call pm_busy_component to
6927 			 * indicate to the framework this device is busy.
6928 			 * By not adjusting un_pm_count the rest of PM in
6929 			 * the driver will function normally, and independent
6930 			 * of this but because the framework is told the device
6931 			 * is busy it won't attempt powering down until it gets
6932 			 * a matching idle. The timeout handler sends this.
6933 			 * Note: sd_pm_entry can't be called here to do this
6934 			 * because sdpower may have been called as a result
6935 			 * of a call to pm_raise_power from within sd_pm_entry.
6936 			 *
6937 			 * If a timeout handler is already active then
6938 			 * don't install another.
6939 			 */
6940 			mutex_enter(&un->un_pm_mutex);
6941 			if (un->un_pm_timeid == NULL) {
6942 				un->un_pm_timeid =
6943 				    timeout(sd_pm_timeout_handler,
6944 				    un, intvlp * drv_usectohz(1000000));
6945 				mutex_exit(&un->un_pm_mutex);
6946 				(void) pm_busy_component(SD_DEVINFO(un), 0);
6947 			} else {
6948 				mutex_exit(&un->un_pm_mutex);
6949 			}
6950 			if (got_semaphore_here != 0) {
6951 				sema_v(&un->un_semoclose);
6952 			}
6953 			/*
6954 			 * On exit put the state back to it's original value
6955 			 * and broadcast to anyone waiting for the power
6956 			 * change completion.
6957 			 */
6958 			mutex_enter(SD_MUTEX(un));
6959 			un->un_state = state_before_pm;
6960 			cv_broadcast(&un->un_suspend_cv);
6961 			mutex_exit(SD_MUTEX(un));
6962 
6963 			SD_TRACE(SD_LOG_IO_PM, un, "sdpower: exit, "
6964 			    "trans check Failed, not ok to power cycle.\n");
6965 
6966 			goto sdpower_failed;
6967 		case -1:
6968 			if (got_semaphore_here != 0) {
6969 				sema_v(&un->un_semoclose);
6970 			}
6971 			/*
6972 			 * On exit put the state back to it's original value
6973 			 * and broadcast to anyone waiting for the power
6974 			 * change completion.
6975 			 */
6976 			mutex_enter(SD_MUTEX(un));
6977 			un->un_state = state_before_pm;
6978 			cv_broadcast(&un->un_suspend_cv);
6979 			mutex_exit(SD_MUTEX(un));
6980 			SD_TRACE(SD_LOG_IO_PM, un,
6981 			    "sdpower: exit, trans check command Failed.\n");
6982 
6983 			goto sdpower_failed;
6984 		}
6985 	}
6986 
6987 	if (!SD_PM_IS_IO_CAPABLE(un, level)) {
6988 		/*
6989 		 * Save the last state... if the STOP FAILS we need it
6990 		 * for restoring
6991 		 */
6992 		mutex_enter(SD_MUTEX(un));
6993 		save_state = un->un_last_state;
6994 		last_power_level = un->un_power_level;
6995 		/*
6996 		 * There must not be any cmds. getting processed
6997 		 * in the driver when we get here. Power to the
6998 		 * device is potentially going off.
6999 		 */
7000 		ASSERT(un->un_ncmds_in_driver == 0);
7001 		mutex_exit(SD_MUTEX(un));
7002 
7003 		/*
7004 		 * For now PM suspend the device completely before spindle is
7005 		 * turned off
7006 		 */
7007 		if ((rval = sd_pm_state_change(un, level, SD_PM_STATE_CHANGE))
7008 		    == DDI_FAILURE) {
7009 			if (got_semaphore_here != 0) {
7010 				sema_v(&un->un_semoclose);
7011 			}
7012 			/*
7013 			 * On exit put the state back to it's original value
7014 			 * and broadcast to anyone waiting for the power
7015 			 * change completion.
7016 			 */
7017 			mutex_enter(SD_MUTEX(un));
7018 			un->un_state = state_before_pm;
7019 			un->un_power_level = last_power_level;
7020 			cv_broadcast(&un->un_suspend_cv);
7021 			mutex_exit(SD_MUTEX(un));
7022 			SD_TRACE(SD_LOG_IO_PM, un,
7023 			    "sdpower: exit, PM suspend Failed.\n");
7024 
7025 			goto sdpower_failed;
7026 		}
7027 	}
7028 
7029 	/*
7030 	 * The transition from SPINDLE_OFF to SPINDLE_ON can happen in open,
7031 	 * close, or strategy. Dump no long uses this routine, it uses it's
7032 	 * own code so it can be done in polled mode.
7033 	 */
7034 
7035 	medium_present = TRUE;
7036 
7037 	/*
7038 	 * When powering up, issue a TUR in case the device is at unit
7039 	 * attention.  Don't do retries. Bypass the PM layer, otherwise
7040 	 * a deadlock on un_pm_busy_cv will occur.
7041 	 */
7042 	if (SD_PM_IS_IO_CAPABLE(un, level)) {
7043 		sval = sd_send_scsi_TEST_UNIT_READY(ssc,
7044 		    SD_DONT_RETRY_TUR | SD_BYPASS_PM);
7045 		if (sval != 0)
7046 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
7047 	}
7048 
7049 	if (un->un_f_power_condition_supported) {
7050 		char *pm_condition_name[] = {"STOPPED", "STANDBY",
7051 		    "IDLE", "ACTIVE"};
7052 		SD_TRACE(SD_LOG_IO_PM, un,
7053 		    "sdpower: sending \'%s\' power condition",
7054 		    pm_condition_name[level]);
7055 		sval = sd_send_scsi_START_STOP_UNIT(ssc, SD_POWER_CONDITION,
7056 		    sd_pl2pc[level], SD_PATH_DIRECT);
7057 	} else {
7058 		SD_TRACE(SD_LOG_IO_PM, un, "sdpower: sending \'%s\' unit\n",
7059 		    ((level == SD_SPINDLE_ON) ? "START" : "STOP"));
7060 		sval = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
7061 		    ((level == SD_SPINDLE_ON) ? SD_TARGET_START :
7062 		    SD_TARGET_STOP), SD_PATH_DIRECT);
7063 	}
7064 	if (sval != 0) {
7065 		if (sval == EIO)
7066 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
7067 		else
7068 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
7069 	}
7070 
7071 	/* Command failed, check for media present. */
7072 	if ((sval == ENXIO) && un->un_f_has_removable_media) {
7073 		medium_present = FALSE;
7074 	}
7075 
7076 	/*
7077 	 * The conditions of interest here are:
7078 	 *   if a spindle off with media present fails,
7079 	 *	then restore the state and return an error.
7080 	 *   else if a spindle on fails,
7081 	 *	then return an error (there's no state to restore).
7082 	 * In all other cases we setup for the new state
7083 	 * and return success.
7084 	 */
7085 	if (!SD_PM_IS_IO_CAPABLE(un, level)) {
7086 		if ((medium_present == TRUE) && (sval != 0)) {
7087 			/* The stop command from above failed */
7088 			rval = DDI_FAILURE;
7089 			/*
7090 			 * The stop command failed, and we have media
7091 			 * present. Put the level back by calling the
7092 			 * sd_pm_resume() and set the state back to
7093 			 * it's previous value.
7094 			 */
7095 			(void) sd_pm_state_change(un, last_power_level,
7096 			    SD_PM_STATE_ROLLBACK);
7097 			mutex_enter(SD_MUTEX(un));
7098 			un->un_last_state = save_state;
7099 			mutex_exit(SD_MUTEX(un));
7100 		} else if (un->un_f_monitor_media_state) {
7101 			/*
7102 			 * The stop command from above succeeded.
7103 			 * Terminate watch thread in case of removable media
7104 			 * devices going into low power state. This is as per
7105 			 * the requirements of pm framework, otherwise commands
7106 			 * will be generated for the device (through watch
7107 			 * thread), even when the device is in low power state.
7108 			 */
7109 			mutex_enter(SD_MUTEX(un));
7110 			un->un_f_watcht_stopped = FALSE;
7111 			if (un->un_swr_token != NULL) {
7112 				opaque_t temp_token = un->un_swr_token;
7113 				un->un_f_watcht_stopped = TRUE;
7114 				un->un_swr_token = NULL;
7115 				mutex_exit(SD_MUTEX(un));
7116 				(void) scsi_watch_request_terminate(temp_token,
7117 				    SCSI_WATCH_TERMINATE_ALL_WAIT);
7118 			} else {
7119 				mutex_exit(SD_MUTEX(un));
7120 			}
7121 		}
7122 	} else {
7123 		/*
7124 		 * The level requested is I/O capable.
7125 		 * Legacy behavior: return success on a failed spinup
7126 		 * if there is no media in the drive.
7127 		 * Do this by looking at medium_present here.
7128 		 */
7129 		if ((sval != 0) && medium_present) {
7130 			/* The start command from above failed */
7131 			rval = DDI_FAILURE;
7132 		} else {
7133 			/*
7134 			 * The start command from above succeeded
7135 			 * PM resume the devices now that we have
7136 			 * started the disks
7137 			 */
7138 			(void) sd_pm_state_change(un, level,
7139 			    SD_PM_STATE_CHANGE);
7140 
7141 			/*
7142 			 * Resume the watch thread since it was suspended
7143 			 * when the device went into low power mode.
7144 			 */
7145 			if (un->un_f_monitor_media_state) {
7146 				mutex_enter(SD_MUTEX(un));
7147 				if (un->un_f_watcht_stopped == TRUE) {
7148 					opaque_t temp_token;
7149 
7150 					un->un_f_watcht_stopped = FALSE;
7151 					mutex_exit(SD_MUTEX(un));
7152 					temp_token =
7153 					    sd_watch_request_submit(un);
7154 					mutex_enter(SD_MUTEX(un));
7155 					un->un_swr_token = temp_token;
7156 				}
7157 				mutex_exit(SD_MUTEX(un));
7158 			}
7159 		}
7160 	}
7161 
7162 	if (got_semaphore_here != 0) {
7163 		sema_v(&un->un_semoclose);
7164 	}
7165 	/*
7166 	 * On exit put the state back to it's original value
7167 	 * and broadcast to anyone waiting for the power
7168 	 * change completion.
7169 	 */
7170 	mutex_enter(SD_MUTEX(un));
7171 	un->un_state = state_before_pm;
7172 	cv_broadcast(&un->un_suspend_cv);
7173 	mutex_exit(SD_MUTEX(un));
7174 
7175 	SD_TRACE(SD_LOG_IO_PM, un, "sdpower: exit, status = 0x%x\n", rval);
7176 
7177 	sd_ssc_fini(ssc);
7178 	return (rval);
7179 
7180 sdpower_failed:
7181 
7182 	sd_ssc_fini(ssc);
7183 	return (DDI_FAILURE);
7184 }
7185 
7186 
7187 
7188 /*
7189  *    Function: sdattach
7190  *
7191  * Description: Driver's attach(9e) entry point function.
7192  *
7193  *   Arguments: devi - opaque device info handle
7194  *		cmd  - attach  type
7195  *
7196  * Return Code: DDI_SUCCESS
7197  *		DDI_FAILURE
7198  *
7199  *     Context: Kernel thread context
7200  */
7201 
7202 static int
7203 sdattach(dev_info_t *devi, ddi_attach_cmd_t cmd)
7204 {
7205 	switch (cmd) {
7206 	case DDI_ATTACH:
7207 		return (sd_unit_attach(devi));
7208 	case DDI_RESUME:
7209 		return (sd_ddi_resume(devi));
7210 	default:
7211 		break;
7212 	}
7213 	return (DDI_FAILURE);
7214 }
7215 
7216 
7217 /*
7218  *    Function: sddetach
7219  *
7220  * Description: Driver's detach(9E) entry point function.
7221  *
7222  *   Arguments: devi - opaque device info handle
7223  *		cmd  - detach  type
7224  *
7225  * Return Code: DDI_SUCCESS
7226  *		DDI_FAILURE
7227  *
7228  *     Context: Kernel thread context
7229  */
7230 
7231 static int
7232 sddetach(dev_info_t *devi, ddi_detach_cmd_t cmd)
7233 {
7234 	switch (cmd) {
7235 	case DDI_DETACH:
7236 		return (sd_unit_detach(devi));
7237 	case DDI_SUSPEND:
7238 		return (sd_ddi_suspend(devi));
7239 	default:
7240 		break;
7241 	}
7242 	return (DDI_FAILURE);
7243 }
7244 
7245 
7246 /*
7247  *     Function: sd_sync_with_callback
7248  *
7249  *  Description: Prevents sd_unit_attach or sd_unit_detach from freeing the soft
7250  *		 state while the callback routine is active.
7251  *
7252  *    Arguments: un: softstate structure for the instance
7253  *
7254  *	Context: Kernel thread context
7255  */
7256 
7257 static void
7258 sd_sync_with_callback(struct sd_lun *un)
7259 {
7260 	ASSERT(un != NULL);
7261 
7262 	mutex_enter(SD_MUTEX(un));
7263 
7264 	ASSERT(un->un_in_callback >= 0);
7265 
7266 	while (un->un_in_callback > 0) {
7267 		mutex_exit(SD_MUTEX(un));
7268 		delay(2);
7269 		mutex_enter(SD_MUTEX(un));
7270 	}
7271 
7272 	mutex_exit(SD_MUTEX(un));
7273 }
7274 
7275 /*
7276  *    Function: sd_unit_attach
7277  *
7278  * Description: Performs DDI_ATTACH processing for sdattach(). Allocates
7279  *		the soft state structure for the device and performs
7280  *		all necessary structure and device initializations.
7281  *
7282  *   Arguments: devi: the system's dev_info_t for the device.
7283  *
7284  * Return Code: DDI_SUCCESS if attach is successful.
7285  *		DDI_FAILURE if any part of the attach fails.
7286  *
7287  *     Context: Called at attach(9e) time for the DDI_ATTACH flag.
7288  *		Kernel thread context only.  Can sleep.
7289  */
7290 
7291 static int
7292 sd_unit_attach(dev_info_t *devi)
7293 {
7294 	struct	scsi_device	*devp;
7295 	struct	sd_lun		*un;
7296 	char			*variantp;
7297 	char			name_str[48];
7298 	int	reservation_flag = SD_TARGET_IS_UNRESERVED;
7299 	int	instance;
7300 	int	rval;
7301 	int	wc_enabled;
7302 	int	wc_changeable;
7303 	int	tgt;
7304 	uint64_t	capacity;
7305 	uint_t		lbasize = 0;
7306 	dev_info_t	*pdip = ddi_get_parent(devi);
7307 	int		offbyone = 0;
7308 	int		geom_label_valid = 0;
7309 	sd_ssc_t	*ssc;
7310 	int		status;
7311 	struct sd_fm_internal	*sfip = NULL;
7312 	int		max_xfer_size;
7313 
7314 	/*
7315 	 * Retrieve the target driver's private data area. This was set
7316 	 * up by the HBA.
7317 	 */
7318 	devp = ddi_get_driver_private(devi);
7319 
7320 	/*
7321 	 * Retrieve the target ID of the device.
7322 	 */
7323 	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, devi, DDI_PROP_DONTPASS,
7324 	    SCSI_ADDR_PROP_TARGET, -1);
7325 
7326 	/*
7327 	 * Since we have no idea what state things were left in by the last
7328 	 * user of the device, set up some 'default' settings, ie. turn 'em
7329 	 * off. The scsi_ifsetcap calls force re-negotiations with the drive.
7330 	 * Do this before the scsi_probe, which sends an inquiry.
7331 	 * This is a fix for bug (4430280).
7332 	 * Of special importance is wide-xfer. The drive could have been left
7333 	 * in wide transfer mode by the last driver to communicate with it,
7334 	 * this includes us. If that's the case, and if the following is not
7335 	 * setup properly or we don't re-negotiate with the drive prior to
7336 	 * transferring data to/from the drive, it causes bus parity errors,
7337 	 * data overruns, and unexpected interrupts. This first occurred when
7338 	 * the fix for bug (4378686) was made.
7339 	 */
7340 	(void) scsi_ifsetcap(&devp->sd_address, "lun-reset", 0, 1);
7341 	(void) scsi_ifsetcap(&devp->sd_address, "wide-xfer", 0, 1);
7342 	(void) scsi_ifsetcap(&devp->sd_address, "auto-rqsense", 0, 1);
7343 
7344 	/*
7345 	 * Currently, scsi_ifsetcap sets tagged-qing capability for all LUNs
7346 	 * on a target. Setting it per lun instance actually sets the
7347 	 * capability of this target, which affects those luns already
7348 	 * attached on the same target. So during attach, we can only disable
7349 	 * this capability only when no other lun has been attached on this
7350 	 * target. By doing this, we assume a target has the same tagged-qing
7351 	 * capability for every lun. The condition can be removed when HBA
7352 	 * is changed to support per lun based tagged-qing capability.
7353 	 */
7354 	if (sd_scsi_get_target_lun_count(pdip, tgt) < 1) {
7355 		(void) scsi_ifsetcap(&devp->sd_address, "tagged-qing", 0, 1);
7356 	}
7357 
7358 	/*
7359 	 * Use scsi_probe() to issue an INQUIRY command to the device.
7360 	 * This call will allocate and fill in the scsi_inquiry structure
7361 	 * and point the sd_inq member of the scsi_device structure to it.
7362 	 * If the attach succeeds, then this memory will not be de-allocated
7363 	 * (via scsi_unprobe()) until the instance is detached.
7364 	 */
7365 	if (scsi_probe(devp, SLEEP_FUNC) != SCSIPROBE_EXISTS) {
7366 		goto probe_failed;
7367 	}
7368 
7369 	/*
7370 	 * Check the device type as specified in the inquiry data and
7371 	 * claim it if it is of a type that we support.
7372 	 */
7373 	switch (devp->sd_inq->inq_dtype) {
7374 	case DTYPE_DIRECT:
7375 		break;
7376 	case DTYPE_RODIRECT:
7377 		break;
7378 	case DTYPE_OPTICAL:
7379 		break;
7380 	case DTYPE_NOTPRESENT:
7381 	default:
7382 		/* Unsupported device type; fail the attach. */
7383 		goto probe_failed;
7384 	}
7385 
7386 	/*
7387 	 * Allocate the soft state structure for this unit.
7388 	 *
7389 	 * We rely upon this memory being set to all zeroes by
7390 	 * ddi_soft_state_zalloc().  We assume that any member of the
7391 	 * soft state structure that is not explicitly initialized by
7392 	 * this routine will have a value of zero.
7393 	 */
7394 	instance = ddi_get_instance(devp->sd_dev);
7395 	if (ddi_soft_state_zalloc(sd_state, instance) != DDI_SUCCESS) {
7396 		goto probe_failed;
7397 	}
7398 
7399 	/*
7400 	 * Retrieve a pointer to the newly-allocated soft state.
7401 	 *
7402 	 * This should NEVER fail if the ddi_soft_state_zalloc() call above
7403 	 * was successful, unless something has gone horribly wrong and the
7404 	 * ddi's soft state internals are corrupt (in which case it is
7405 	 * probably better to halt here than just fail the attach....)
7406 	 */
7407 	if ((un = ddi_get_soft_state(sd_state, instance)) == NULL) {
7408 		panic("sd_unit_attach: NULL soft state on instance:0x%x",
7409 		    instance);
7410 		/*NOTREACHED*/
7411 	}
7412 
7413 	/*
7414 	 * Link the back ptr of the driver soft state to the scsi_device
7415 	 * struct for this lun.
7416 	 * Save a pointer to the softstate in the driver-private area of
7417 	 * the scsi_device struct.
7418 	 * Note: We cannot call SD_INFO, SD_TRACE, SD_ERROR, or SD_DIAG until
7419 	 * we first set un->un_sd below.
7420 	 */
7421 	un->un_sd = devp;
7422 	devp->sd_private = (opaque_t)un;
7423 
7424 	/*
7425 	 * The following must be after devp is stored in the soft state struct.
7426 	 */
7427 #ifdef SDDEBUG
7428 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7429 	    "%s_unit_attach: un:0x%p instance:%d\n",
7430 	    ddi_driver_name(devi), un, instance);
7431 #endif
7432 
7433 	/*
7434 	 * Set up the device type and node type (for the minor nodes).
7435 	 * By default we assume that the device can at least support the
7436 	 * Common Command Set. Call it a CD-ROM if it reports itself
7437 	 * as a RODIRECT device.
7438 	 */
7439 	switch (devp->sd_inq->inq_dtype) {
7440 	case DTYPE_RODIRECT:
7441 		un->un_node_type = DDI_NT_CD_CHAN;
7442 		un->un_ctype	 = CTYPE_CDROM;
7443 		break;
7444 	case DTYPE_OPTICAL:
7445 		un->un_node_type = DDI_NT_BLOCK_CHAN;
7446 		un->un_ctype	 = CTYPE_ROD;
7447 		break;
7448 	default:
7449 		un->un_node_type = DDI_NT_BLOCK_CHAN;
7450 		un->un_ctype	 = CTYPE_CCS;
7451 		break;
7452 	}
7453 
7454 	/*
7455 	 * Try to read the interconnect type from the HBA.
7456 	 *
7457 	 * Note: This driver is currently compiled as two binaries, a parallel
7458 	 * scsi version (sd) and a fibre channel version (ssd). All functional
7459 	 * differences are determined at compile time. In the future a single
7460 	 * binary will be provided and the interconnect type will be used to
7461 	 * differentiate between fibre and parallel scsi behaviors. At that time
7462 	 * it will be necessary for all fibre channel HBAs to support this
7463 	 * property.
7464 	 *
7465 	 * set un_f_is_fiber to TRUE ( default fiber )
7466 	 */
7467 	un->un_f_is_fibre = TRUE;
7468 	switch (scsi_ifgetcap(SD_ADDRESS(un), "interconnect-type", -1)) {
7469 	case INTERCONNECT_SSA:
7470 		un->un_interconnect_type = SD_INTERCONNECT_SSA;
7471 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7472 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_SSA\n", un);
7473 		break;
7474 	case INTERCONNECT_PARALLEL:
7475 		un->un_f_is_fibre = FALSE;
7476 		un->un_interconnect_type = SD_INTERCONNECT_PARALLEL;
7477 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7478 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_PARALLEL\n", un);
7479 		break;
7480 	case INTERCONNECT_SAS:
7481 		un->un_f_is_fibre = FALSE;
7482 		un->un_interconnect_type = SD_INTERCONNECT_SAS;
7483 		un->un_node_type = DDI_NT_BLOCK_SAS;
7484 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7485 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_SAS\n", un);
7486 		break;
7487 	case INTERCONNECT_SATA:
7488 		un->un_f_is_fibre = FALSE;
7489 		un->un_interconnect_type = SD_INTERCONNECT_SATA;
7490 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7491 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_SATA\n", un);
7492 		break;
7493 	case INTERCONNECT_FIBRE:
7494 		un->un_interconnect_type = SD_INTERCONNECT_FIBRE;
7495 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7496 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_FIBRE\n", un);
7497 		break;
7498 	case INTERCONNECT_FABRIC:
7499 		un->un_interconnect_type = SD_INTERCONNECT_FABRIC;
7500 		un->un_node_type = DDI_NT_BLOCK_FABRIC;
7501 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7502 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_FABRIC\n", un);
7503 		break;
7504 	default:
7505 #ifdef SD_DEFAULT_INTERCONNECT_TYPE
7506 		/*
7507 		 * The HBA does not support the "interconnect-type" property
7508 		 * (or did not provide a recognized type).
7509 		 *
7510 		 * Note: This will be obsoleted when a single fibre channel
7511 		 * and parallel scsi driver is delivered. In the meantime the
7512 		 * interconnect type will be set to the platform default.If that
7513 		 * type is not parallel SCSI, it means that we should be
7514 		 * assuming "ssd" semantics. However, here this also means that
7515 		 * the FC HBA is not supporting the "interconnect-type" property
7516 		 * like we expect it to, so log this occurrence.
7517 		 */
7518 		un->un_interconnect_type = SD_DEFAULT_INTERCONNECT_TYPE;
7519 		if (!SD_IS_PARALLEL_SCSI(un)) {
7520 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7521 			    "sd_unit_attach: un:0x%p Assuming "
7522 			    "INTERCONNECT_FIBRE\n", un);
7523 		} else {
7524 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7525 			    "sd_unit_attach: un:0x%p Assuming "
7526 			    "INTERCONNECT_PARALLEL\n", un);
7527 			un->un_f_is_fibre = FALSE;
7528 		}
7529 #else
7530 		/*
7531 		 * Note: This source will be implemented when a single fibre
7532 		 * channel and parallel scsi driver is delivered. The default
7533 		 * will be to assume that if a device does not support the
7534 		 * "interconnect-type" property it is a parallel SCSI HBA and
7535 		 * we will set the interconnect type for parallel scsi.
7536 		 */
7537 		un->un_interconnect_type = SD_INTERCONNECT_PARALLEL;
7538 		un->un_f_is_fibre = FALSE;
7539 #endif
7540 		break;
7541 	}
7542 
7543 	if (un->un_f_is_fibre == TRUE) {
7544 		if (scsi_ifgetcap(SD_ADDRESS(un), "scsi-version", 1) ==
7545 		    SCSI_VERSION_3) {
7546 			switch (un->un_interconnect_type) {
7547 			case SD_INTERCONNECT_FIBRE:
7548 			case SD_INTERCONNECT_SSA:
7549 				un->un_node_type = DDI_NT_BLOCK_WWN;
7550 				break;
7551 			default:
7552 				break;
7553 			}
7554 		}
7555 	}
7556 
7557 	/*
7558 	 * Initialize the Request Sense command for the target
7559 	 */
7560 	if (sd_alloc_rqs(devp, un) != DDI_SUCCESS) {
7561 		goto alloc_rqs_failed;
7562 	}
7563 
7564 	/*
7565 	 * Set un_retry_count with SD_RETRY_COUNT, this is ok for Sparc
7566 	 * with separate binary for sd and ssd.
7567 	 *
7568 	 * x86 has 1 binary, un_retry_count is set base on connection type.
7569 	 * The hardcoded values will go away when Sparc uses 1 binary
7570 	 * for sd and ssd.  This hardcoded values need to match
7571 	 * SD_RETRY_COUNT in sddef.h
7572 	 * The value used is base on interconnect type.
7573 	 * fibre = 3, parallel = 5
7574 	 */
7575 #if defined(__i386) || defined(__amd64)
7576 	un->un_retry_count = un->un_f_is_fibre ? 3 : 5;
7577 #else
7578 	un->un_retry_count = SD_RETRY_COUNT;
7579 #endif
7580 
7581 	/*
7582 	 * Set the per disk retry count to the default number of retries
7583 	 * for disks and CDROMs. This value can be overridden by the
7584 	 * disk property list or an entry in sd.conf.
7585 	 */
7586 	un->un_notready_retry_count =
7587 	    ISCD(un) ? CD_NOT_READY_RETRY_COUNT(un)
7588 	    : DISK_NOT_READY_RETRY_COUNT(un);
7589 
7590 	/*
7591 	 * Set the busy retry count to the default value of un_retry_count.
7592 	 * This can be overridden by entries in sd.conf or the device
7593 	 * config table.
7594 	 */
7595 	un->un_busy_retry_count = un->un_retry_count;
7596 
7597 	/*
7598 	 * Init the reset threshold for retries.  This number determines
7599 	 * how many retries must be performed before a reset can be issued
7600 	 * (for certain error conditions). This can be overridden by entries
7601 	 * in sd.conf or the device config table.
7602 	 */
7603 	un->un_reset_retry_count = (un->un_retry_count / 2);
7604 
7605 	/*
7606 	 * Set the victim_retry_count to the default un_retry_count
7607 	 */
7608 	un->un_victim_retry_count = (2 * un->un_retry_count);
7609 
7610 	/*
7611 	 * Set the reservation release timeout to the default value of
7612 	 * 5 seconds. This can be overridden by entries in ssd.conf or the
7613 	 * device config table.
7614 	 */
7615 	un->un_reserve_release_time = 5;
7616 
7617 	/*
7618 	 * Set up the default maximum transfer size. Note that this may
7619 	 * get updated later in the attach, when setting up default wide
7620 	 * operations for disks.
7621 	 */
7622 #if defined(__i386) || defined(__amd64)
7623 	un->un_max_xfer_size = (uint_t)SD_DEFAULT_MAX_XFER_SIZE;
7624 	un->un_partial_dma_supported = 1;
7625 #else
7626 	un->un_max_xfer_size = (uint_t)maxphys;
7627 #endif
7628 
7629 	/*
7630 	 * Get "allow bus device reset" property (defaults to "enabled" if
7631 	 * the property was not defined). This is to disable bus resets for
7632 	 * certain kinds of error recovery. Note: In the future when a run-time
7633 	 * fibre check is available the soft state flag should default to
7634 	 * enabled.
7635 	 */
7636 	if (un->un_f_is_fibre == TRUE) {
7637 		un->un_f_allow_bus_device_reset = TRUE;
7638 	} else {
7639 		if (ddi_getprop(DDI_DEV_T_ANY, devi, DDI_PROP_DONTPASS,
7640 		    "allow-bus-device-reset", 1) != 0) {
7641 			un->un_f_allow_bus_device_reset = TRUE;
7642 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7643 			    "sd_unit_attach: un:0x%p Bus device reset "
7644 			    "enabled\n", un);
7645 		} else {
7646 			un->un_f_allow_bus_device_reset = FALSE;
7647 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7648 			    "sd_unit_attach: un:0x%p Bus device reset "
7649 			    "disabled\n", un);
7650 		}
7651 	}
7652 
7653 	/*
7654 	 * Check if this is an ATAPI device. ATAPI devices use Group 1
7655 	 * Read/Write commands and Group 2 Mode Sense/Select commands.
7656 	 *
7657 	 * Note: The "obsolete" way of doing this is to check for the "atapi"
7658 	 * property. The new "variant" property with a value of "atapi" has been
7659 	 * introduced so that future 'variants' of standard SCSI behavior (like
7660 	 * atapi) could be specified by the underlying HBA drivers by supplying
7661 	 * a new value for the "variant" property, instead of having to define a
7662 	 * new property.
7663 	 */
7664 	if (ddi_prop_get_int(DDI_DEV_T_ANY, devi, 0, "atapi", -1) != -1) {
7665 		un->un_f_cfg_is_atapi = TRUE;
7666 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7667 		    "sd_unit_attach: un:0x%p Atapi device\n", un);
7668 	}
7669 	if (ddi_prop_lookup_string(DDI_DEV_T_ANY, devi, 0, "variant",
7670 	    &variantp) == DDI_PROP_SUCCESS) {
7671 		if (strcmp(variantp, "atapi") == 0) {
7672 			un->un_f_cfg_is_atapi = TRUE;
7673 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7674 			    "sd_unit_attach: un:0x%p Atapi device\n", un);
7675 		}
7676 		ddi_prop_free(variantp);
7677 	}
7678 
7679 	un->un_cmd_timeout	= SD_IO_TIME;
7680 
7681 	un->un_busy_timeout  = SD_BSY_TIMEOUT;
7682 
7683 	/* Info on current states, statuses, etc. (Updated frequently) */
7684 	un->un_state		= SD_STATE_NORMAL;
7685 	un->un_last_state	= SD_STATE_NORMAL;
7686 
7687 	/* Control & status info for command throttling */
7688 	un->un_throttle		= sd_max_throttle;
7689 	un->un_saved_throttle	= sd_max_throttle;
7690 	un->un_min_throttle	= sd_min_throttle;
7691 
7692 	if (un->un_f_is_fibre == TRUE) {
7693 		un->un_f_use_adaptive_throttle = TRUE;
7694 	} else {
7695 		un->un_f_use_adaptive_throttle = FALSE;
7696 	}
7697 
7698 	/* Removable media support. */
7699 	cv_init(&un->un_state_cv, NULL, CV_DRIVER, NULL);
7700 	un->un_mediastate		= DKIO_NONE;
7701 	un->un_specified_mediastate	= DKIO_NONE;
7702 
7703 	/* CVs for suspend/resume (PM or DR) */
7704 	cv_init(&un->un_suspend_cv,   NULL, CV_DRIVER, NULL);
7705 	cv_init(&un->un_disk_busy_cv, NULL, CV_DRIVER, NULL);
7706 
7707 	/* Power management support. */
7708 	un->un_power_level = SD_SPINDLE_UNINIT;
7709 
7710 	cv_init(&un->un_wcc_cv,   NULL, CV_DRIVER, NULL);
7711 	un->un_f_wcc_inprog = 0;
7712 
7713 	/*
7714 	 * The open/close semaphore is used to serialize threads executing
7715 	 * in the driver's open & close entry point routines for a given
7716 	 * instance.
7717 	 */
7718 	(void) sema_init(&un->un_semoclose, 1, NULL, SEMA_DRIVER, NULL);
7719 
7720 	/*
7721 	 * The conf file entry and softstate variable is a forceful override,
7722 	 * meaning a non-zero value must be entered to change the default.
7723 	 */
7724 	un->un_f_disksort_disabled = FALSE;
7725 	un->un_f_rmw_type = SD_RMW_TYPE_DEFAULT;
7726 	un->un_f_enable_rmw = FALSE;
7727 
7728 	/*
7729 	 * GET EVENT STATUS NOTIFICATION media polling enabled by default, but
7730 	 * can be overridden via [s]sd-config-list "mmc-gesn-polling" property.
7731 	 */
7732 	un->un_f_mmc_gesn_polling = TRUE;
7733 
7734 	/*
7735 	 * physical sector size defaults to DEV_BSIZE currently. We can
7736 	 * override this value via the driver configuration file so we must
7737 	 * set it before calling sd_read_unit_properties().
7738 	 */
7739 	un->un_phy_blocksize = DEV_BSIZE;
7740 
7741 	/*
7742 	 * Retrieve the properties from the static driver table or the driver
7743 	 * configuration file (.conf) for this unit and update the soft state
7744 	 * for the device as needed for the indicated properties.
7745 	 * Note: the property configuration needs to occur here as some of the
7746 	 * following routines may have dependencies on soft state flags set
7747 	 * as part of the driver property configuration.
7748 	 */
7749 	sd_read_unit_properties(un);
7750 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7751 	    "sd_unit_attach: un:0x%p property configuration complete.\n", un);
7752 
7753 	/*
7754 	 * Only if a device has "hotpluggable" property, it is
7755 	 * treated as hotpluggable device. Otherwise, it is
7756 	 * regarded as non-hotpluggable one.
7757 	 */
7758 	if (ddi_prop_get_int(DDI_DEV_T_ANY, devi, 0, "hotpluggable",
7759 	    -1) != -1) {
7760 		un->un_f_is_hotpluggable = TRUE;
7761 	}
7762 
7763 	/*
7764 	 * set unit's attributes(flags) according to "hotpluggable" and
7765 	 * RMB bit in INQUIRY data.
7766 	 */
7767 	sd_set_unit_attributes(un, devi);
7768 
7769 	/*
7770 	 * By default, we mark the capacity, lbasize, and geometry
7771 	 * as invalid. Only if we successfully read a valid capacity
7772 	 * will we update the un_blockcount and un_tgt_blocksize with the
7773 	 * valid values (the geometry will be validated later).
7774 	 */
7775 	un->un_f_blockcount_is_valid	= FALSE;
7776 	un->un_f_tgt_blocksize_is_valid	= FALSE;
7777 
7778 	/*
7779 	 * Use DEV_BSIZE and DEV_BSHIFT as defaults, until we can determine
7780 	 * otherwise.
7781 	 */
7782 	un->un_tgt_blocksize  = un->un_sys_blocksize  = DEV_BSIZE;
7783 	un->un_blockcount = 0;
7784 
7785 	/*
7786 	 * Set up the per-instance info needed to determine the correct
7787 	 * CDBs and other info for issuing commands to the target.
7788 	 */
7789 	sd_init_cdb_limits(un);
7790 
7791 	/*
7792 	 * Set up the IO chains to use, based upon the target type.
7793 	 */
7794 	if (un->un_f_non_devbsize_supported) {
7795 		un->un_buf_chain_type = SD_CHAIN_INFO_RMMEDIA;
7796 	} else {
7797 		un->un_buf_chain_type = SD_CHAIN_INFO_DISK;
7798 	}
7799 	un->un_uscsi_chain_type  = SD_CHAIN_INFO_USCSI_CMD;
7800 	un->un_direct_chain_type = SD_CHAIN_INFO_DIRECT_CMD;
7801 	un->un_priority_chain_type = SD_CHAIN_INFO_PRIORITY_CMD;
7802 
7803 	un->un_xbuf_attr = ddi_xbuf_attr_create(sizeof (struct sd_xbuf),
7804 	    sd_xbuf_strategy, un, sd_xbuf_active_limit,  sd_xbuf_reserve_limit,
7805 	    ddi_driver_major(devi), DDI_XBUF_QTHREAD_DRIVER);
7806 	ddi_xbuf_attr_register_devinfo(un->un_xbuf_attr, devi);
7807 
7808 
7809 	if (ISCD(un)) {
7810 		un->un_additional_codes = sd_additional_codes;
7811 	} else {
7812 		un->un_additional_codes = NULL;
7813 	}
7814 
7815 	/*
7816 	 * Create the kstats here so they can be available for attach-time
7817 	 * routines that send commands to the unit (either polled or via
7818 	 * sd_send_scsi_cmd).
7819 	 *
7820 	 * Note: This is a critical sequence that needs to be maintained:
7821 	 *	1) Instantiate the kstats here, before any routines using the
7822 	 *	   iopath (i.e. sd_send_scsi_cmd).
7823 	 *	2) Instantiate and initialize the partition stats
7824 	 *	   (sd_set_pstats).
7825 	 *	3) Initialize the error stats (sd_set_errstats), following
7826 	 *	   sd_validate_geometry(),sd_register_devid(),
7827 	 *	   and sd_cache_control().
7828 	 */
7829 
7830 	un->un_stats = kstat_create(sd_label, instance,
7831 	    NULL, "disk", KSTAT_TYPE_IO, 1, KSTAT_FLAG_PERSISTENT);
7832 	if (un->un_stats != NULL) {
7833 		un->un_stats->ks_lock = SD_MUTEX(un);
7834 		kstat_install(un->un_stats);
7835 	}
7836 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7837 	    "sd_unit_attach: un:0x%p un_stats created\n", un);
7838 
7839 	un->un_unmapstats_ks = kstat_create(sd_label, instance, "unmapstats",
7840 	    "misc", KSTAT_TYPE_NAMED, sizeof (*un->un_unmapstats) /
7841 	    sizeof (kstat_named_t), 0);
7842 	if (un->un_unmapstats_ks) {
7843 		un->un_unmapstats = un->un_unmapstats_ks->ks_data;
7844 
7845 		kstat_named_init(&un->un_unmapstats->us_cmds,
7846 		    "commands", KSTAT_DATA_UINT64);
7847 		kstat_named_init(&un->un_unmapstats->us_errs,
7848 		    "errors", KSTAT_DATA_UINT64);
7849 		kstat_named_init(&un->un_unmapstats->us_extents,
7850 		    "extents", KSTAT_DATA_UINT64);
7851 		kstat_named_init(&un->un_unmapstats->us_bytes,
7852 		    "bytes", KSTAT_DATA_UINT64);
7853 
7854 		kstat_install(un->un_unmapstats_ks);
7855 	} else {
7856 		cmn_err(CE_NOTE, "!Cannot create unmap kstats for disk %d",
7857 		    instance);
7858 	}
7859 
7860 	sd_create_errstats(un, instance);
7861 	if (un->un_errstats == NULL) {
7862 		goto create_errstats_failed;
7863 	}
7864 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7865 	    "sd_unit_attach: un:0x%p errstats created\n", un);
7866 
7867 	/*
7868 	 * The following if/else code was relocated here from below as part
7869 	 * of the fix for bug (4430280). However with the default setup added
7870 	 * on entry to this routine, it's no longer absolutely necessary for
7871 	 * this to be before the call to sd_spin_up_unit.
7872 	 */
7873 	if (SD_IS_PARALLEL_SCSI(un) || SD_IS_SERIAL(un)) {
7874 		int tq_trigger_flag = (((devp->sd_inq->inq_ansi == 4) ||
7875 		    (devp->sd_inq->inq_ansi == 5)) &&
7876 		    devp->sd_inq->inq_bque) || devp->sd_inq->inq_cmdque;
7877 
7878 		/*
7879 		 * If tagged queueing is supported by the target
7880 		 * and by the host adapter then we will enable it
7881 		 */
7882 		un->un_tagflags = 0;
7883 		if ((devp->sd_inq->inq_rdf == RDF_SCSI2) && tq_trigger_flag &&
7884 		    (un->un_f_arq_enabled == TRUE)) {
7885 			if (scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing",
7886 			    1, 1) == 1) {
7887 				un->un_tagflags = FLAG_STAG;
7888 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7889 				    "sd_unit_attach: un:0x%p tag queueing "
7890 				    "enabled\n", un);
7891 			} else if (scsi_ifgetcap(SD_ADDRESS(un),
7892 			    "untagged-qing", 0) == 1) {
7893 				un->un_f_opt_queueing = TRUE;
7894 				un->un_saved_throttle = un->un_throttle =
7895 				    min(un->un_throttle, 3);
7896 			} else {
7897 				un->un_f_opt_queueing = FALSE;
7898 				un->un_saved_throttle = un->un_throttle = 1;
7899 			}
7900 		} else if ((scsi_ifgetcap(SD_ADDRESS(un), "untagged-qing", 0)
7901 		    == 1) && (un->un_f_arq_enabled == TRUE)) {
7902 			/* The Host Adapter supports internal queueing. */
7903 			un->un_f_opt_queueing = TRUE;
7904 			un->un_saved_throttle = un->un_throttle =
7905 			    min(un->un_throttle, 3);
7906 		} else {
7907 			un->un_f_opt_queueing = FALSE;
7908 			un->un_saved_throttle = un->un_throttle = 1;
7909 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7910 			    "sd_unit_attach: un:0x%p no tag queueing\n", un);
7911 		}
7912 
7913 		/*
7914 		 * Enable large transfers for SATA/SAS drives
7915 		 */
7916 		if (SD_IS_SERIAL(un)) {
7917 			un->un_max_xfer_size =
7918 			    ddi_getprop(DDI_DEV_T_ANY, devi, 0,
7919 			    sd_max_xfer_size, SD_MAX_XFER_SIZE);
7920 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7921 			    "sd_unit_attach: un:0x%p max transfer "
7922 			    "size=0x%x\n", un, un->un_max_xfer_size);
7923 
7924 		}
7925 
7926 		/* Setup or tear down default wide operations for disks */
7927 
7928 		/*
7929 		 * Note: Legacy: it may be possible for both "sd_max_xfer_size"
7930 		 * and "ssd_max_xfer_size" to exist simultaneously on the same
7931 		 * system and be set to different values. In the future this
7932 		 * code may need to be updated when the ssd module is
7933 		 * obsoleted and removed from the system. (4299588)
7934 		 */
7935 		if (SD_IS_PARALLEL_SCSI(un) &&
7936 		    (devp->sd_inq->inq_rdf == RDF_SCSI2) &&
7937 		    (devp->sd_inq->inq_wbus16 || devp->sd_inq->inq_wbus32)) {
7938 			if (scsi_ifsetcap(SD_ADDRESS(un), "wide-xfer",
7939 			    1, 1) == 1) {
7940 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7941 				    "sd_unit_attach: un:0x%p Wide Transfer "
7942 				    "enabled\n", un);
7943 			}
7944 
7945 			/*
7946 			 * If tagged queuing has also been enabled, then
7947 			 * enable large xfers
7948 			 */
7949 			if (un->un_saved_throttle == sd_max_throttle) {
7950 				un->un_max_xfer_size =
7951 				    ddi_getprop(DDI_DEV_T_ANY, devi, 0,
7952 				    sd_max_xfer_size, SD_MAX_XFER_SIZE);
7953 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7954 				    "sd_unit_attach: un:0x%p max transfer "
7955 				    "size=0x%x\n", un, un->un_max_xfer_size);
7956 			}
7957 		} else {
7958 			if (scsi_ifsetcap(SD_ADDRESS(un), "wide-xfer",
7959 			    0, 1) == 1) {
7960 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7961 				    "sd_unit_attach: un:0x%p "
7962 				    "Wide Transfer disabled\n", un);
7963 			}
7964 		}
7965 	} else {
7966 		un->un_tagflags = FLAG_STAG;
7967 		un->un_max_xfer_size = ddi_getprop(DDI_DEV_T_ANY,
7968 		    devi, 0, sd_max_xfer_size, SD_MAX_XFER_SIZE);
7969 	}
7970 
7971 	/*
7972 	 * If this target supports LUN reset, try to enable it.
7973 	 */
7974 	if (un->un_f_lun_reset_enabled) {
7975 		if (scsi_ifsetcap(SD_ADDRESS(un), "lun-reset", 1, 1) == 1) {
7976 			SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_unit_attach: "
7977 			    "un:0x%p lun_reset capability set\n", un);
7978 		} else {
7979 			SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_unit_attach: "
7980 			    "un:0x%p lun-reset capability not set\n", un);
7981 		}
7982 	}
7983 
7984 	/*
7985 	 * Adjust the maximum transfer size. This is to fix
7986 	 * the problem of partial DMA support on SPARC. Some
7987 	 * HBA driver, like aac, has very small dma_attr_maxxfer
7988 	 * size, which requires partial DMA support on SPARC.
7989 	 * In the future the SPARC pci nexus driver may solve
7990 	 * the problem instead of this fix.
7991 	 */
7992 	max_xfer_size = scsi_ifgetcap(SD_ADDRESS(un), "dma-max", 1);
7993 	if ((max_xfer_size > 0) && (max_xfer_size < un->un_max_xfer_size)) {
7994 		/* We need DMA partial even on sparc to ensure sddump() works */
7995 		un->un_max_xfer_size = max_xfer_size;
7996 		if (un->un_partial_dma_supported == 0)
7997 			un->un_partial_dma_supported = 1;
7998 	}
7999 	if (ddi_prop_get_int(DDI_DEV_T_ANY, SD_DEVINFO(un),
8000 	    DDI_PROP_DONTPASS, "buf_break", 0) == 1) {
8001 		if (ddi_xbuf_attr_setup_brk(un->un_xbuf_attr,
8002 		    un->un_max_xfer_size) == 1) {
8003 			un->un_buf_breakup_supported = 1;
8004 			SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_unit_attach: "
8005 			    "un:0x%p Buf breakup enabled\n", un);
8006 		}
8007 	}
8008 
8009 	/*
8010 	 * Set PKT_DMA_PARTIAL flag.
8011 	 */
8012 	if (un->un_partial_dma_supported == 1) {
8013 		un->un_pkt_flags = PKT_DMA_PARTIAL;
8014 	} else {
8015 		un->un_pkt_flags = 0;
8016 	}
8017 
8018 	/* Initialize sd_ssc_t for internal uscsi commands */
8019 	ssc = sd_ssc_init(un);
8020 	scsi_fm_init(devp);
8021 
8022 	/*
8023 	 * Allocate memory for SCSI FMA stuffs.
8024 	 */
8025 	un->un_fm_private =
8026 	    kmem_zalloc(sizeof (struct sd_fm_internal), KM_SLEEP);
8027 	sfip = (struct sd_fm_internal *)un->un_fm_private;
8028 	sfip->fm_ssc.ssc_uscsi_cmd = &sfip->fm_ucmd;
8029 	sfip->fm_ssc.ssc_uscsi_info = &sfip->fm_uinfo;
8030 	sfip->fm_ssc.ssc_un = un;
8031 
8032 	if (ISCD(un) ||
8033 	    un->un_f_has_removable_media ||
8034 	    devp->sd_fm_capable == DDI_FM_NOT_CAPABLE) {
8035 		/*
8036 		 * We don't touch CDROM or the DDI_FM_NOT_CAPABLE device.
8037 		 * Their log are unchanged.
8038 		 */
8039 		sfip->fm_log_level = SD_FM_LOG_NSUP;
8040 	} else {
8041 		/*
8042 		 * If enter here, it should be non-CDROM and FM-capable
8043 		 * device, and it will not keep the old scsi_log as before
8044 		 * in /var/adm/messages. However, the property
8045 		 * "fm-scsi-log" will control whether the FM telemetry will
8046 		 * be logged in /var/adm/messages.
8047 		 */
8048 		int fm_scsi_log;
8049 		fm_scsi_log = ddi_prop_get_int(DDI_DEV_T_ANY, SD_DEVINFO(un),
8050 		    DDI_PROP_DONTPASS | DDI_PROP_NOTPROM, "fm-scsi-log", 0);
8051 
8052 		if (fm_scsi_log)
8053 			sfip->fm_log_level = SD_FM_LOG_EREPORT;
8054 		else
8055 			sfip->fm_log_level = SD_FM_LOG_SILENT;
8056 	}
8057 
8058 	/*
8059 	 * At this point in the attach, we have enough info in the
8060 	 * soft state to be able to issue commands to the target.
8061 	 *
8062 	 * All command paths used below MUST issue their commands as
8063 	 * SD_PATH_DIRECT. This is important as intermediate layers
8064 	 * are not all initialized yet (such as PM).
8065 	 */
8066 
8067 	/*
8068 	 * Send a TEST UNIT READY command to the device. This should clear
8069 	 * any outstanding UNIT ATTENTION that may be present.
8070 	 *
8071 	 * Note: Don't check for success, just track if there is a reservation,
8072 	 * this is a throw away command to clear any unit attentions.
8073 	 *
8074 	 * Note: This MUST be the first command issued to the target during
8075 	 * attach to ensure power on UNIT ATTENTIONS are cleared.
8076 	 * Pass in flag SD_DONT_RETRY_TUR to prevent the long delays associated
8077 	 * with attempts at spinning up a device with no media.
8078 	 */
8079 	status = sd_send_scsi_TEST_UNIT_READY(ssc, SD_DONT_RETRY_TUR);
8080 	if (status != 0) {
8081 		if (status == EACCES)
8082 			reservation_flag = SD_TARGET_IS_RESERVED;
8083 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8084 	}
8085 
8086 	/*
8087 	 * If the device is NOT a removable media device, attempt to spin
8088 	 * it up (using the START_STOP_UNIT command) and read its capacity
8089 	 * (using the READ CAPACITY command).  Note, however, that either
8090 	 * of these could fail and in some cases we would continue with
8091 	 * the attach despite the failure (see below).
8092 	 */
8093 	if (un->un_f_descr_format_supported) {
8094 
8095 		switch (sd_spin_up_unit(ssc)) {
8096 		case 0:
8097 			/*
8098 			 * Spin-up was successful; now try to read the
8099 			 * capacity.  If successful then save the results
8100 			 * and mark the capacity & lbasize as valid.
8101 			 */
8102 			SD_TRACE(SD_LOG_ATTACH_DETACH, un,
8103 			    "sd_unit_attach: un:0x%p spin-up successful\n", un);
8104 
8105 			status = sd_send_scsi_READ_CAPACITY(ssc, &capacity,
8106 			    &lbasize, SD_PATH_DIRECT);
8107 
8108 			switch (status) {
8109 			case 0: {
8110 				if (capacity > DK_MAX_BLOCKS) {
8111 #ifdef _LP64
8112 					if ((capacity + 1) >
8113 					    SD_GROUP1_MAX_ADDRESS) {
8114 						/*
8115 						 * Enable descriptor format
8116 						 * sense data so that we can
8117 						 * get 64 bit sense data
8118 						 * fields.
8119 						 */
8120 						sd_enable_descr_sense(ssc);
8121 					}
8122 #else
8123 					/* 32-bit kernels can't handle this */
8124 					scsi_log(SD_DEVINFO(un),
8125 					    sd_label, CE_WARN,
8126 					    "disk has %llu blocks, which "
8127 					    "is too large for a 32-bit "
8128 					    "kernel", capacity);
8129 
8130 #if defined(__i386) || defined(__amd64)
8131 					/*
8132 					 * 1TB disk was treated as (1T - 512)B
8133 					 * in the past, so that it might have
8134 					 * valid VTOC and solaris partitions,
8135 					 * we have to allow it to continue to
8136 					 * work.
8137 					 */
8138 					if (capacity -1 > DK_MAX_BLOCKS)
8139 #endif
8140 					goto spinup_failed;
8141 #endif
8142 				}
8143 
8144 				/*
8145 				 * Here it's not necessary to check the case:
8146 				 * the capacity of the device is bigger than
8147 				 * what the max hba cdb can support. Because
8148 				 * sd_send_scsi_READ_CAPACITY will retrieve
8149 				 * the capacity by sending USCSI command, which
8150 				 * is constrained by the max hba cdb. Actually,
8151 				 * sd_send_scsi_READ_CAPACITY will return
8152 				 * EINVAL when using bigger cdb than required
8153 				 * cdb length. Will handle this case in
8154 				 * "case EINVAL".
8155 				 */
8156 
8157 				/*
8158 				 * The following relies on
8159 				 * sd_send_scsi_READ_CAPACITY never
8160 				 * returning 0 for capacity and/or lbasize.
8161 				 */
8162 				sd_update_block_info(un, lbasize, capacity);
8163 
8164 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
8165 				    "sd_unit_attach: un:0x%p capacity = %ld "
8166 				    "blocks; lbasize= %ld.\n", un,
8167 				    un->un_blockcount, un->un_tgt_blocksize);
8168 
8169 				break;
8170 			}
8171 			case EINVAL:
8172 				/*
8173 				 * In the case where the max-cdb-length property
8174 				 * is smaller than the required CDB length for
8175 				 * a SCSI device, a target driver can fail to
8176 				 * attach to that device.
8177 				 */
8178 				scsi_log(SD_DEVINFO(un),
8179 				    sd_label, CE_WARN,
8180 				    "disk capacity is too large "
8181 				    "for current cdb length");
8182 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8183 
8184 				goto spinup_failed;
8185 			case EACCES:
8186 				/*
8187 				 * Should never get here if the spin-up
8188 				 * succeeded, but code it in anyway.
8189 				 * From here, just continue with the attach...
8190 				 */
8191 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
8192 				    "sd_unit_attach: un:0x%p "
8193 				    "sd_send_scsi_READ_CAPACITY "
8194 				    "returned reservation conflict\n", un);
8195 				reservation_flag = SD_TARGET_IS_RESERVED;
8196 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8197 				break;
8198 			default:
8199 				/*
8200 				 * Likewise, should never get here if the
8201 				 * spin-up succeeded. Just continue with
8202 				 * the attach...
8203 				 */
8204 				if (status == EIO)
8205 					sd_ssc_assessment(ssc,
8206 					    SD_FMT_STATUS_CHECK);
8207 				else
8208 					sd_ssc_assessment(ssc,
8209 					    SD_FMT_IGNORE);
8210 				break;
8211 			}
8212 			break;
8213 		case EACCES:
8214 			/*
8215 			 * Device is reserved by another host.  In this case
8216 			 * we could not spin it up or read the capacity, but
8217 			 * we continue with the attach anyway.
8218 			 */
8219 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
8220 			    "sd_unit_attach: un:0x%p spin-up reservation "
8221 			    "conflict.\n", un);
8222 			reservation_flag = SD_TARGET_IS_RESERVED;
8223 			break;
8224 		default:
8225 			/* Fail the attach if the spin-up failed. */
8226 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
8227 			    "sd_unit_attach: un:0x%p spin-up failed.", un);
8228 			goto spinup_failed;
8229 		}
8230 
8231 	}
8232 
8233 	/*
8234 	 * Check to see if this is a MMC drive
8235 	 */
8236 	if (ISCD(un)) {
8237 		sd_set_mmc_caps(ssc);
8238 	}
8239 
8240 	/*
8241 	 * Add a zero-length attribute to tell the world we support
8242 	 * kernel ioctls (for layered drivers)
8243 	 */
8244 	(void) ddi_prop_create(DDI_DEV_T_NONE, devi, DDI_PROP_CANSLEEP,
8245 	    DDI_KERNEL_IOCTL, NULL, 0);
8246 
8247 	/*
8248 	 * Add a boolean property to tell the world we support
8249 	 * the B_FAILFAST flag (for layered drivers)
8250 	 */
8251 	(void) ddi_prop_create(DDI_DEV_T_NONE, devi, DDI_PROP_CANSLEEP,
8252 	    "ddi-failfast-supported", NULL, 0);
8253 
8254 	/*
8255 	 * Initialize power management
8256 	 */
8257 	mutex_init(&un->un_pm_mutex, NULL, MUTEX_DRIVER, NULL);
8258 	cv_init(&un->un_pm_busy_cv, NULL, CV_DRIVER, NULL);
8259 	sd_setup_pm(ssc, devi);
8260 	if (un->un_f_pm_is_enabled == FALSE) {
8261 		/*
8262 		 * For performance, point to a jump table that does
8263 		 * not include pm.
8264 		 * The direct and priority chains don't change with PM.
8265 		 *
8266 		 * Note: this is currently done based on individual device
8267 		 * capabilities. When an interface for determining system
8268 		 * power enabled state becomes available, or when additional
8269 		 * layers are added to the command chain, these values will
8270 		 * have to be re-evaluated for correctness.
8271 		 */
8272 		if (un->un_f_non_devbsize_supported) {
8273 			un->un_buf_chain_type = SD_CHAIN_INFO_RMMEDIA_NO_PM;
8274 		} else {
8275 			un->un_buf_chain_type = SD_CHAIN_INFO_DISK_NO_PM;
8276 		}
8277 		un->un_uscsi_chain_type  = SD_CHAIN_INFO_USCSI_CMD_NO_PM;
8278 	}
8279 
8280 	/*
8281 	 * This property is set to 0 by HA software to avoid retries
8282 	 * on a reserved disk. (The preferred property name is
8283 	 * "retry-on-reservation-conflict") (1189689)
8284 	 *
8285 	 * Note: The use of a global here can have unintended consequences. A
8286 	 * per instance variable is preferable to match the capabilities of
8287 	 * different underlying hba's (4402600)
8288 	 */
8289 	sd_retry_on_reservation_conflict = ddi_getprop(DDI_DEV_T_ANY, devi,
8290 	    DDI_PROP_DONTPASS, "retry-on-reservation-conflict",
8291 	    sd_retry_on_reservation_conflict);
8292 	if (sd_retry_on_reservation_conflict != 0) {
8293 		sd_retry_on_reservation_conflict = ddi_getprop(DDI_DEV_T_ANY,
8294 		    devi, DDI_PROP_DONTPASS, sd_resv_conflict_name,
8295 		    sd_retry_on_reservation_conflict);
8296 	}
8297 
8298 	/* Set up options for QFULL handling. */
8299 	if ((rval = ddi_getprop(DDI_DEV_T_ANY, devi, 0,
8300 	    "qfull-retries", -1)) != -1) {
8301 		(void) scsi_ifsetcap(SD_ADDRESS(un), "qfull-retries",
8302 		    rval, 1);
8303 	}
8304 	if ((rval = ddi_getprop(DDI_DEV_T_ANY, devi, 0,
8305 	    "qfull-retry-interval", -1)) != -1) {
8306 		(void) scsi_ifsetcap(SD_ADDRESS(un), "qfull-retry-interval",
8307 		    rval, 1);
8308 	}
8309 
8310 	/*
8311 	 * This just prints a message that announces the existence of the
8312 	 * device. The message is always printed in the system logfile, but
8313 	 * only appears on the console if the system is booted with the
8314 	 * -v (verbose) argument.
8315 	 */
8316 	ddi_report_dev(devi);
8317 
8318 	un->un_mediastate = DKIO_NONE;
8319 
8320 	/*
8321 	 * Check Block Device Characteristics VPD.
8322 	 */
8323 	sd_check_bdc_vpd(ssc);
8324 
8325 	/*
8326 	 * Check whether the drive is in emulation mode.
8327 	 */
8328 	sd_check_emulation_mode(ssc);
8329 
8330 	cmlb_alloc_handle(&un->un_cmlbhandle);
8331 
8332 #if defined(__i386) || defined(__amd64)
8333 	/*
8334 	 * On x86, compensate for off-by-1 legacy error
8335 	 */
8336 	if (!un->un_f_has_removable_media && !un->un_f_is_hotpluggable &&
8337 	    (lbasize == un->un_sys_blocksize))
8338 		offbyone = CMLB_OFF_BY_ONE;
8339 #endif
8340 
8341 	if (cmlb_attach(devi, &sd_tgops, (int)devp->sd_inq->inq_dtype,
8342 	    VOID2BOOLEAN(un->un_f_has_removable_media != 0),
8343 	    VOID2BOOLEAN(un->un_f_is_hotpluggable != 0),
8344 	    un->un_node_type, offbyone, un->un_cmlbhandle,
8345 	    (void *)SD_PATH_DIRECT) != 0) {
8346 		goto cmlb_attach_failed;
8347 	}
8348 
8349 
8350 	/*
8351 	 * Read and validate the device's geometry (ie, disk label)
8352 	 * A new unformatted drive will not have a valid geometry, but
8353 	 * the driver needs to successfully attach to this device so
8354 	 * the drive can be formatted via ioctls.
8355 	 */
8356 	geom_label_valid = (cmlb_validate(un->un_cmlbhandle, 0,
8357 	    (void *)SD_PATH_DIRECT) == 0) ? 1: 0;
8358 
8359 	mutex_enter(SD_MUTEX(un));
8360 
8361 	/*
8362 	 * Read and initialize the devid for the unit.
8363 	 */
8364 	if (un->un_f_devid_supported) {
8365 		sd_register_devid(ssc, devi, reservation_flag);
8366 	}
8367 	mutex_exit(SD_MUTEX(un));
8368 
8369 #if (defined(__fibre))
8370 	/*
8371 	 * Register callbacks for fibre only.  You can't do this solely
8372 	 * on the basis of the devid_type because this is hba specific.
8373 	 * We need to query our hba capabilities to find out whether to
8374 	 * register or not.
8375 	 */
8376 	if (un->un_f_is_fibre) {
8377 		if (strcmp(un->un_node_type, DDI_NT_BLOCK_CHAN)) {
8378 			sd_init_event_callbacks(un);
8379 			SD_TRACE(SD_LOG_ATTACH_DETACH, un,
8380 			    "sd_unit_attach: un:0x%p event callbacks inserted",
8381 			    un);
8382 		}
8383 	}
8384 #endif
8385 
8386 	if (un->un_f_opt_disable_cache == TRUE) {
8387 		/*
8388 		 * Disable both read cache and write cache.  This is
8389 		 * the historic behavior of the keywords in the config file.
8390 		 */
8391 		if (sd_cache_control(ssc, SD_CACHE_DISABLE, SD_CACHE_DISABLE) !=
8392 		    0) {
8393 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8394 			    "sd_unit_attach: un:0x%p Could not disable "
8395 			    "caching", un);
8396 			goto devid_failed;
8397 		}
8398 	}
8399 
8400 	/*
8401 	 * Check the value of the WCE bit and if it's allowed to be changed,
8402 	 * set un_f_write_cache_enabled and un_f_cache_mode_changeable
8403 	 * accordingly.
8404 	 */
8405 	(void) sd_get_write_cache_enabled(ssc, &wc_enabled);
8406 	sd_get_write_cache_changeable(ssc, &wc_changeable);
8407 	mutex_enter(SD_MUTEX(un));
8408 	un->un_f_write_cache_enabled = (wc_enabled != 0);
8409 	un->un_f_cache_mode_changeable = (wc_changeable != 0);
8410 	mutex_exit(SD_MUTEX(un));
8411 
8412 	if ((un->un_f_rmw_type != SD_RMW_TYPE_RETURN_ERROR &&
8413 	    un->un_tgt_blocksize != DEV_BSIZE) ||
8414 	    un->un_f_enable_rmw) {
8415 		if (!(un->un_wm_cache)) {
8416 			(void) snprintf(name_str, sizeof (name_str),
8417 			    "%s%d_cache",
8418 			    ddi_driver_name(SD_DEVINFO(un)),
8419 			    ddi_get_instance(SD_DEVINFO(un)));
8420 			un->un_wm_cache = kmem_cache_create(
8421 			    name_str, sizeof (struct sd_w_map),
8422 			    8, sd_wm_cache_constructor,
8423 			    sd_wm_cache_destructor, NULL,
8424 			    (void *)un, NULL, 0);
8425 			if (!(un->un_wm_cache)) {
8426 				goto wm_cache_failed;
8427 			}
8428 		}
8429 	}
8430 
8431 	/*
8432 	 * Check the value of the NV_SUP bit and set
8433 	 * un_f_suppress_cache_flush accordingly.
8434 	 */
8435 	sd_get_nv_sup(ssc);
8436 
8437 	/*
8438 	 * Find out what type of reservation this disk supports.
8439 	 */
8440 	status = sd_send_scsi_PERSISTENT_RESERVE_IN(ssc, SD_READ_KEYS, 0, NULL);
8441 
8442 	switch (status) {
8443 	case 0:
8444 		/*
8445 		 * SCSI-3 reservations are supported.
8446 		 */
8447 		un->un_reservation_type = SD_SCSI3_RESERVATION;
8448 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
8449 		    "sd_unit_attach: un:0x%p SCSI-3 reservations\n", un);
8450 		break;
8451 	case ENOTSUP:
8452 		/*
8453 		 * The PERSISTENT RESERVE IN command would not be recognized by
8454 		 * a SCSI-2 device, so assume the reservation type is SCSI-2.
8455 		 */
8456 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
8457 		    "sd_unit_attach: un:0x%p SCSI-2 reservations\n", un);
8458 		un->un_reservation_type = SD_SCSI2_RESERVATION;
8459 
8460 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8461 		break;
8462 	default:
8463 		/*
8464 		 * default to SCSI-3 reservations
8465 		 */
8466 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
8467 		    "sd_unit_attach: un:0x%p default SCSI3 reservations\n", un);
8468 		un->un_reservation_type = SD_SCSI3_RESERVATION;
8469 
8470 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8471 		break;
8472 	}
8473 
8474 	/*
8475 	 * Set the pstat and error stat values here, so data obtained during the
8476 	 * previous attach-time routines is available.
8477 	 *
8478 	 * Note: This is a critical sequence that needs to be maintained:
8479 	 *	1) Instantiate the kstats before any routines using the iopath
8480 	 *	   (i.e. sd_send_scsi_cmd).
8481 	 *	2) Initialize the error stats (sd_set_errstats) and partition
8482 	 *	   stats (sd_set_pstats)here, following
8483 	 *	   cmlb_validate_geometry(), sd_register_devid(), and
8484 	 *	   sd_cache_control().
8485 	 */
8486 
8487 	if (un->un_f_pkstats_enabled && geom_label_valid) {
8488 		sd_set_pstats(un);
8489 		SD_TRACE(SD_LOG_IO_PARTITION, un,
8490 		    "sd_unit_attach: un:0x%p pstats created and set\n", un);
8491 	}
8492 
8493 	sd_set_errstats(un);
8494 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
8495 	    "sd_unit_attach: un:0x%p errstats set\n", un);
8496 
8497 	sd_setup_blk_limits(ssc);
8498 
8499 	/*
8500 	 * After successfully attaching an instance, we record the information
8501 	 * of how many luns have been attached on the relative target and
8502 	 * controller for parallel SCSI. This information is used when sd tries
8503 	 * to set the tagged queuing capability in HBA.
8504 	 */
8505 	if (SD_IS_PARALLEL_SCSI(un) && (tgt >= 0) && (tgt < NTARGETS_WIDE)) {
8506 		sd_scsi_update_lun_on_target(pdip, tgt, SD_SCSI_LUN_ATTACH);
8507 	}
8508 
8509 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
8510 	    "sd_unit_attach: un:0x%p exit success\n", un);
8511 
8512 	/* Uninitialize sd_ssc_t pointer */
8513 	sd_ssc_fini(ssc);
8514 
8515 	return (DDI_SUCCESS);
8516 
8517 	/*
8518 	 * An error occurred during the attach; clean up & return failure.
8519 	 */
8520 wm_cache_failed:
8521 devid_failed:
8522 	ddi_remove_minor_node(devi, NULL);
8523 
8524 cmlb_attach_failed:
8525 	/*
8526 	 * Cleanup from the scsi_ifsetcap() calls (437868)
8527 	 */
8528 	(void) scsi_ifsetcap(SD_ADDRESS(un), "lun-reset", 0, 1);
8529 	(void) scsi_ifsetcap(SD_ADDRESS(un), "wide-xfer", 0, 1);
8530 
8531 	/*
8532 	 * Refer to the comments of setting tagged-qing in the beginning of
8533 	 * sd_unit_attach. We can only disable tagged queuing when there is
8534 	 * no lun attached on the target.
8535 	 */
8536 	if (sd_scsi_get_target_lun_count(pdip, tgt) < 1) {
8537 		(void) scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing", 0, 1);
8538 	}
8539 
8540 	if (un->un_f_is_fibre == FALSE) {
8541 		(void) scsi_ifsetcap(SD_ADDRESS(un), "auto-rqsense", 0, 1);
8542 	}
8543 
8544 spinup_failed:
8545 
8546 	/* Uninitialize sd_ssc_t pointer */
8547 	sd_ssc_fini(ssc);
8548 
8549 	mutex_enter(SD_MUTEX(un));
8550 
8551 	/* Deallocate SCSI FMA memory spaces */
8552 	kmem_free(un->un_fm_private, sizeof (struct sd_fm_internal));
8553 
8554 	/* Cancel callback for SD_PATH_DIRECT_PRIORITY cmd. restart */
8555 	if (un->un_direct_priority_timeid != NULL) {
8556 		timeout_id_t temp_id = un->un_direct_priority_timeid;
8557 		un->un_direct_priority_timeid = NULL;
8558 		mutex_exit(SD_MUTEX(un));
8559 		(void) untimeout(temp_id);
8560 		mutex_enter(SD_MUTEX(un));
8561 	}
8562 
8563 	/* Cancel any pending start/stop timeouts */
8564 	if (un->un_startstop_timeid != NULL) {
8565 		timeout_id_t temp_id = un->un_startstop_timeid;
8566 		un->un_startstop_timeid = NULL;
8567 		mutex_exit(SD_MUTEX(un));
8568 		(void) untimeout(temp_id);
8569 		mutex_enter(SD_MUTEX(un));
8570 	}
8571 
8572 	/* Cancel any pending reset-throttle timeouts */
8573 	if (un->un_reset_throttle_timeid != NULL) {
8574 		timeout_id_t temp_id = un->un_reset_throttle_timeid;
8575 		un->un_reset_throttle_timeid = NULL;
8576 		mutex_exit(SD_MUTEX(un));
8577 		(void) untimeout(temp_id);
8578 		mutex_enter(SD_MUTEX(un));
8579 	}
8580 
8581 	/* Cancel rmw warning message timeouts */
8582 	if (un->un_rmw_msg_timeid != NULL) {
8583 		timeout_id_t temp_id = un->un_rmw_msg_timeid;
8584 		un->un_rmw_msg_timeid = NULL;
8585 		mutex_exit(SD_MUTEX(un));
8586 		(void) untimeout(temp_id);
8587 		mutex_enter(SD_MUTEX(un));
8588 	}
8589 
8590 	/* Cancel any pending retry timeouts */
8591 	if (un->un_retry_timeid != NULL) {
8592 		timeout_id_t temp_id = un->un_retry_timeid;
8593 		un->un_retry_timeid = NULL;
8594 		mutex_exit(SD_MUTEX(un));
8595 		(void) untimeout(temp_id);
8596 		mutex_enter(SD_MUTEX(un));
8597 	}
8598 
8599 	/* Cancel any pending delayed cv broadcast timeouts */
8600 	if (un->un_dcvb_timeid != NULL) {
8601 		timeout_id_t temp_id = un->un_dcvb_timeid;
8602 		un->un_dcvb_timeid = NULL;
8603 		mutex_exit(SD_MUTEX(un));
8604 		(void) untimeout(temp_id);
8605 		mutex_enter(SD_MUTEX(un));
8606 	}
8607 
8608 	mutex_exit(SD_MUTEX(un));
8609 
8610 	/* There should not be any in-progress I/O so ASSERT this check */
8611 	ASSERT(un->un_ncmds_in_transport == 0);
8612 	ASSERT(un->un_ncmds_in_driver == 0);
8613 
8614 	/* Do not free the softstate if the callback routine is active */
8615 	sd_sync_with_callback(un);
8616 
8617 	/*
8618 	 * Partition stats apparently are not used with removables. These would
8619 	 * not have been created during attach, so no need to clean them up...
8620 	 */
8621 	if (un->un_errstats != NULL) {
8622 		kstat_delete(un->un_errstats);
8623 		un->un_errstats = NULL;
8624 	}
8625 
8626 create_errstats_failed:
8627 
8628 	if (un->un_stats != NULL) {
8629 		kstat_delete(un->un_stats);
8630 		un->un_stats = NULL;
8631 	}
8632 
8633 	ddi_xbuf_attr_unregister_devinfo(un->un_xbuf_attr, devi);
8634 	ddi_xbuf_attr_destroy(un->un_xbuf_attr);
8635 
8636 	ddi_prop_remove_all(devi);
8637 	sema_destroy(&un->un_semoclose);
8638 	cv_destroy(&un->un_state_cv);
8639 
8640 	sd_free_rqs(un);
8641 
8642 alloc_rqs_failed:
8643 
8644 	devp->sd_private = NULL;
8645 	bzero(un, sizeof (struct sd_lun));	/* Clear any stale data! */
8646 
8647 	/*
8648 	 * Note: the man pages are unclear as to whether or not doing a
8649 	 * ddi_soft_state_free(sd_state, instance) is the right way to
8650 	 * clean up after the ddi_soft_state_zalloc() if the subsequent
8651 	 * ddi_get_soft_state() fails.  The implication seems to be
8652 	 * that the get_soft_state cannot fail if the zalloc succeeds.
8653 	 */
8654 #ifndef XPV_HVM_DRIVER
8655 	ddi_soft_state_free(sd_state, instance);
8656 #endif /* !XPV_HVM_DRIVER */
8657 
8658 probe_failed:
8659 	scsi_unprobe(devp);
8660 
8661 	return (DDI_FAILURE);
8662 }
8663 
8664 
8665 /*
8666  *    Function: sd_unit_detach
8667  *
8668  * Description: Performs DDI_DETACH processing for sddetach().
8669  *
8670  * Return Code: DDI_SUCCESS
8671  *		DDI_FAILURE
8672  *
8673  *     Context: Kernel thread context
8674  */
8675 
8676 static int
8677 sd_unit_detach(dev_info_t *devi)
8678 {
8679 	struct scsi_device	*devp;
8680 	struct sd_lun		*un;
8681 	int			i;
8682 	int			tgt;
8683 	dev_t			dev;
8684 	dev_info_t		*pdip = ddi_get_parent(devi);
8685 	int			instance = ddi_get_instance(devi);
8686 
8687 	mutex_enter(&sd_detach_mutex);
8688 
8689 	/*
8690 	 * Fail the detach for any of the following:
8691 	 *  - Unable to get the sd_lun struct for the instance
8692 	 *  - A layered driver has an outstanding open on the instance
8693 	 *  - Another thread is already detaching this instance
8694 	 *  - Another thread is currently performing an open
8695 	 */
8696 	devp = ddi_get_driver_private(devi);
8697 	if ((devp == NULL) ||
8698 	    ((un = (struct sd_lun *)devp->sd_private) == NULL) ||
8699 	    (un->un_ncmds_in_driver != 0) || (un->un_layer_count != 0) ||
8700 	    (un->un_detach_count != 0) || (un->un_opens_in_progress != 0)) {
8701 		mutex_exit(&sd_detach_mutex);
8702 		return (DDI_FAILURE);
8703 	}
8704 
8705 	SD_TRACE(SD_LOG_ATTACH_DETACH, un, "sd_unit_detach: entry 0x%p\n", un);
8706 
8707 	/*
8708 	 * Mark this instance as currently in a detach, to inhibit any
8709 	 * opens from a layered driver.
8710 	 */
8711 	un->un_detach_count++;
8712 	mutex_exit(&sd_detach_mutex);
8713 
8714 	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, devi, DDI_PROP_DONTPASS,
8715 	    SCSI_ADDR_PROP_TARGET, -1);
8716 
8717 	dev = sd_make_device(SD_DEVINFO(un));
8718 
8719 #ifndef lint
8720 	_NOTE(COMPETING_THREADS_NOW);
8721 #endif
8722 
8723 	mutex_enter(SD_MUTEX(un));
8724 
8725 	/*
8726 	 * Fail the detach if there are any outstanding layered
8727 	 * opens on this device.
8728 	 */
8729 	for (i = 0; i < NDKMAP; i++) {
8730 		if (un->un_ocmap.lyropen[i] != 0) {
8731 			goto err_notclosed;
8732 		}
8733 	}
8734 
8735 	/*
8736 	 * Verify there are NO outstanding commands issued to this device.
8737 	 * ie, un_ncmds_in_transport == 0.
8738 	 * It's possible to have outstanding commands through the physio
8739 	 * code path, even though everything's closed.
8740 	 */
8741 	if ((un->un_ncmds_in_transport != 0) || (un->un_retry_timeid != NULL) ||
8742 	    (un->un_direct_priority_timeid != NULL) ||
8743 	    (un->un_state == SD_STATE_RWAIT)) {
8744 		mutex_exit(SD_MUTEX(un));
8745 		SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8746 		    "sd_dr_detach: Detach failure due to outstanding cmds\n");
8747 		goto err_stillbusy;
8748 	}
8749 
8750 	/*
8751 	 * If we have the device reserved, release the reservation.
8752 	 */
8753 	if ((un->un_resvd_status & SD_RESERVE) &&
8754 	    !(un->un_resvd_status & SD_LOST_RESERVE)) {
8755 		mutex_exit(SD_MUTEX(un));
8756 		/*
8757 		 * Note: sd_reserve_release sends a command to the device
8758 		 * via the sd_ioctlcmd() path, and can sleep.
8759 		 */
8760 		if (sd_reserve_release(dev, SD_RELEASE) != 0) {
8761 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8762 			    "sd_dr_detach: Cannot release reservation \n");
8763 		}
8764 	} else {
8765 		mutex_exit(SD_MUTEX(un));
8766 	}
8767 
8768 	/*
8769 	 * Untimeout any reserve recover, throttle reset, restart unit
8770 	 * and delayed broadcast timeout threads. Protect the timeout pointer
8771 	 * from getting nulled by their callback functions.
8772 	 */
8773 	mutex_enter(SD_MUTEX(un));
8774 	if (un->un_resvd_timeid != NULL) {
8775 		timeout_id_t temp_id = un->un_resvd_timeid;
8776 		un->un_resvd_timeid = NULL;
8777 		mutex_exit(SD_MUTEX(un));
8778 		(void) untimeout(temp_id);
8779 		mutex_enter(SD_MUTEX(un));
8780 	}
8781 
8782 	if (un->un_reset_throttle_timeid != NULL) {
8783 		timeout_id_t temp_id = un->un_reset_throttle_timeid;
8784 		un->un_reset_throttle_timeid = NULL;
8785 		mutex_exit(SD_MUTEX(un));
8786 		(void) untimeout(temp_id);
8787 		mutex_enter(SD_MUTEX(un));
8788 	}
8789 
8790 	if (un->un_startstop_timeid != NULL) {
8791 		timeout_id_t temp_id = un->un_startstop_timeid;
8792 		un->un_startstop_timeid = NULL;
8793 		mutex_exit(SD_MUTEX(un));
8794 		(void) untimeout(temp_id);
8795 		mutex_enter(SD_MUTEX(un));
8796 	}
8797 
8798 	if (un->un_rmw_msg_timeid != NULL) {
8799 		timeout_id_t temp_id = un->un_rmw_msg_timeid;
8800 		un->un_rmw_msg_timeid = NULL;
8801 		mutex_exit(SD_MUTEX(un));
8802 		(void) untimeout(temp_id);
8803 		mutex_enter(SD_MUTEX(un));
8804 	}
8805 
8806 	if (un->un_dcvb_timeid != NULL) {
8807 		timeout_id_t temp_id = un->un_dcvb_timeid;
8808 		un->un_dcvb_timeid = NULL;
8809 		mutex_exit(SD_MUTEX(un));
8810 		(void) untimeout(temp_id);
8811 	} else {
8812 		mutex_exit(SD_MUTEX(un));
8813 	}
8814 
8815 	/* Remove any pending reservation reclaim requests for this device */
8816 	sd_rmv_resv_reclaim_req(dev);
8817 
8818 	mutex_enter(SD_MUTEX(un));
8819 
8820 	/* Cancel any pending callbacks for SD_PATH_DIRECT_PRIORITY cmd. */
8821 	if (un->un_direct_priority_timeid != NULL) {
8822 		timeout_id_t temp_id = un->un_direct_priority_timeid;
8823 		un->un_direct_priority_timeid = NULL;
8824 		mutex_exit(SD_MUTEX(un));
8825 		(void) untimeout(temp_id);
8826 		mutex_enter(SD_MUTEX(un));
8827 	}
8828 
8829 	/* Cancel any active multi-host disk watch thread requests */
8830 	if (un->un_mhd_token != NULL) {
8831 		mutex_exit(SD_MUTEX(un));
8832 		 _NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::un_mhd_token));
8833 		if (scsi_watch_request_terminate(un->un_mhd_token,
8834 		    SCSI_WATCH_TERMINATE_NOWAIT)) {
8835 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8836 			    "sd_dr_detach: Cannot cancel mhd watch request\n");
8837 			/*
8838 			 * Note: We are returning here after having removed
8839 			 * some driver timeouts above. This is consistent with
8840 			 * the legacy implementation but perhaps the watch
8841 			 * terminate call should be made with the wait flag set.
8842 			 */
8843 			goto err_stillbusy;
8844 		}
8845 		mutex_enter(SD_MUTEX(un));
8846 		un->un_mhd_token = NULL;
8847 	}
8848 
8849 	if (un->un_swr_token != NULL) {
8850 		mutex_exit(SD_MUTEX(un));
8851 		_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::un_swr_token));
8852 		if (scsi_watch_request_terminate(un->un_swr_token,
8853 		    SCSI_WATCH_TERMINATE_NOWAIT)) {
8854 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8855 			    "sd_dr_detach: Cannot cancel swr watch request\n");
8856 			/*
8857 			 * Note: We are returning here after having removed
8858 			 * some driver timeouts above. This is consistent with
8859 			 * the legacy implementation but perhaps the watch
8860 			 * terminate call should be made with the wait flag set.
8861 			 */
8862 			goto err_stillbusy;
8863 		}
8864 		mutex_enter(SD_MUTEX(un));
8865 		un->un_swr_token = NULL;
8866 	}
8867 
8868 	mutex_exit(SD_MUTEX(un));
8869 
8870 	/*
8871 	 * Clear any scsi_reset_notifies. We clear the reset notifies
8872 	 * if we have not registered one.
8873 	 * Note: The sd_mhd_reset_notify_cb() fn tries to acquire SD_MUTEX!
8874 	 */
8875 	(void) scsi_reset_notify(SD_ADDRESS(un), SCSI_RESET_CANCEL,
8876 	    sd_mhd_reset_notify_cb, (caddr_t)un);
8877 
8878 	/*
8879 	 * protect the timeout pointers from getting nulled by
8880 	 * their callback functions during the cancellation process.
8881 	 * In such a scenario untimeout can be invoked with a null value.
8882 	 */
8883 	_NOTE(NO_COMPETING_THREADS_NOW);
8884 
8885 	mutex_enter(&un->un_pm_mutex);
8886 	if (un->un_pm_idle_timeid != NULL) {
8887 		timeout_id_t temp_id = un->un_pm_idle_timeid;
8888 		un->un_pm_idle_timeid = NULL;
8889 		mutex_exit(&un->un_pm_mutex);
8890 
8891 		/*
8892 		 * Timeout is active; cancel it.
8893 		 * Note that it'll never be active on a device
8894 		 * that does not support PM therefore we don't
8895 		 * have to check before calling pm_idle_component.
8896 		 */
8897 		(void) untimeout(temp_id);
8898 		(void) pm_idle_component(SD_DEVINFO(un), 0);
8899 		mutex_enter(&un->un_pm_mutex);
8900 	}
8901 
8902 	/*
8903 	 * Check whether there is already a timeout scheduled for power
8904 	 * management. If yes then don't lower the power here, that's.
8905 	 * the timeout handler's job.
8906 	 */
8907 	if (un->un_pm_timeid != NULL) {
8908 		timeout_id_t temp_id = un->un_pm_timeid;
8909 		un->un_pm_timeid = NULL;
8910 		mutex_exit(&un->un_pm_mutex);
8911 		/*
8912 		 * Timeout is active; cancel it.
8913 		 * Note that it'll never be active on a device
8914 		 * that does not support PM therefore we don't
8915 		 * have to check before calling pm_idle_component.
8916 		 */
8917 		(void) untimeout(temp_id);
8918 		(void) pm_idle_component(SD_DEVINFO(un), 0);
8919 
8920 	} else {
8921 		mutex_exit(&un->un_pm_mutex);
8922 		if ((un->un_f_pm_is_enabled == TRUE) &&
8923 		    (pm_lower_power(SD_DEVINFO(un), 0, SD_PM_STATE_STOPPED(un))
8924 		    != DDI_SUCCESS)) {
8925 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8926 		    "sd_dr_detach: Lower power request failed, ignoring.\n");
8927 			/*
8928 			 * Fix for bug: 4297749, item # 13
8929 			 * The above test now includes a check to see if PM is
8930 			 * supported by this device before call
8931 			 * pm_lower_power().
8932 			 * Note, the following is not dead code. The call to
8933 			 * pm_lower_power above will generate a call back into
8934 			 * our sdpower routine which might result in a timeout
8935 			 * handler getting activated. Therefore the following
8936 			 * code is valid and necessary.
8937 			 */
8938 			mutex_enter(&un->un_pm_mutex);
8939 			if (un->un_pm_timeid != NULL) {
8940 				timeout_id_t temp_id = un->un_pm_timeid;
8941 				un->un_pm_timeid = NULL;
8942 				mutex_exit(&un->un_pm_mutex);
8943 				(void) untimeout(temp_id);
8944 				(void) pm_idle_component(SD_DEVINFO(un), 0);
8945 			} else {
8946 				mutex_exit(&un->un_pm_mutex);
8947 			}
8948 		}
8949 	}
8950 
8951 	/*
8952 	 * Cleanup from the scsi_ifsetcap() calls (437868)
8953 	 * Relocated here from above to be after the call to
8954 	 * pm_lower_power, which was getting errors.
8955 	 */
8956 	(void) scsi_ifsetcap(SD_ADDRESS(un), "lun-reset", 0, 1);
8957 	(void) scsi_ifsetcap(SD_ADDRESS(un), "wide-xfer", 0, 1);
8958 
8959 	/*
8960 	 * Currently, tagged queuing is supported per target based by HBA.
8961 	 * Setting this per lun instance actually sets the capability of this
8962 	 * target in HBA, which affects those luns already attached on the
8963 	 * same target. So during detach, we can only disable this capability
8964 	 * only when this is the only lun left on this target. By doing
8965 	 * this, we assume a target has the same tagged queuing capability
8966 	 * for every lun. The condition can be removed when HBA is changed to
8967 	 * support per lun based tagged queuing capability.
8968 	 */
8969 	if (sd_scsi_get_target_lun_count(pdip, tgt) <= 1) {
8970 		(void) scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing", 0, 1);
8971 	}
8972 
8973 	if (un->un_f_is_fibre == FALSE) {
8974 		(void) scsi_ifsetcap(SD_ADDRESS(un), "auto-rqsense", 0, 1);
8975 	}
8976 
8977 	/*
8978 	 * Remove any event callbacks, fibre only
8979 	 */
8980 	if (un->un_f_is_fibre == TRUE) {
8981 		if ((un->un_insert_event != NULL) &&
8982 		    (ddi_remove_event_handler(un->un_insert_cb_id) !=
8983 		    DDI_SUCCESS)) {
8984 			/*
8985 			 * Note: We are returning here after having done
8986 			 * substantial cleanup above. This is consistent
8987 			 * with the legacy implementation but this may not
8988 			 * be the right thing to do.
8989 			 */
8990 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8991 			    "sd_dr_detach: Cannot cancel insert event\n");
8992 			goto err_remove_event;
8993 		}
8994 		un->un_insert_event = NULL;
8995 
8996 		if ((un->un_remove_event != NULL) &&
8997 		    (ddi_remove_event_handler(un->un_remove_cb_id) !=
8998 		    DDI_SUCCESS)) {
8999 			/*
9000 			 * Note: We are returning here after having done
9001 			 * substantial cleanup above. This is consistent
9002 			 * with the legacy implementation but this may not
9003 			 * be the right thing to do.
9004 			 */
9005 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
9006 			    "sd_dr_detach: Cannot cancel remove event\n");
9007 			goto err_remove_event;
9008 		}
9009 		un->un_remove_event = NULL;
9010 	}
9011 
9012 	/* Do not free the softstate if the callback routine is active */
9013 	sd_sync_with_callback(un);
9014 
9015 	cmlb_detach(un->un_cmlbhandle, (void *)SD_PATH_DIRECT);
9016 	cmlb_free_handle(&un->un_cmlbhandle);
9017 
9018 	/*
9019 	 * Hold the detach mutex here, to make sure that no other threads ever
9020 	 * can access a (partially) freed soft state structure.
9021 	 */
9022 	mutex_enter(&sd_detach_mutex);
9023 
9024 	/*
9025 	 * Clean up the soft state struct.
9026 	 * Cleanup is done in reverse order of allocs/inits.
9027 	 * At this point there should be no competing threads anymore.
9028 	 */
9029 
9030 	scsi_fm_fini(devp);
9031 
9032 	/*
9033 	 * Deallocate memory for SCSI FMA.
9034 	 */
9035 	kmem_free(un->un_fm_private, sizeof (struct sd_fm_internal));
9036 
9037 	/*
9038 	 * Unregister and free device id if it was not registered
9039 	 * by the transport.
9040 	 */
9041 	if (un->un_f_devid_transport_defined == FALSE)
9042 		ddi_devid_unregister(devi);
9043 
9044 	/*
9045 	 * free the devid structure if allocated before (by ddi_devid_init()
9046 	 * or ddi_devid_get()).
9047 	 */
9048 	if (un->un_devid) {
9049 		ddi_devid_free(un->un_devid);
9050 		un->un_devid = NULL;
9051 	}
9052 
9053 	/*
9054 	 * Destroy wmap cache if it exists.
9055 	 */
9056 	if (un->un_wm_cache != NULL) {
9057 		kmem_cache_destroy(un->un_wm_cache);
9058 		un->un_wm_cache = NULL;
9059 	}
9060 
9061 	/*
9062 	 * kstat cleanup is done in detach for all device types (4363169).
9063 	 * We do not want to fail detach if the device kstats are not deleted
9064 	 * since there is a confusion about the devo_refcnt for the device.
9065 	 * We just delete the kstats and let detach complete successfully.
9066 	 */
9067 	if (un->un_stats != NULL) {
9068 		kstat_delete(un->un_stats);
9069 		un->un_stats = NULL;
9070 	}
9071 	if (un->un_unmapstats != NULL) {
9072 		kstat_delete(un->un_unmapstats_ks);
9073 		un->un_unmapstats_ks = NULL;
9074 		un->un_unmapstats = NULL;
9075 	}
9076 	if (un->un_errstats != NULL) {
9077 		kstat_delete(un->un_errstats);
9078 		un->un_errstats = NULL;
9079 	}
9080 
9081 	/* Remove partition stats */
9082 	if (un->un_f_pkstats_enabled) {
9083 		for (i = 0; i < NSDMAP; i++) {
9084 			if (un->un_pstats[i] != NULL) {
9085 				kstat_delete(un->un_pstats[i]);
9086 				un->un_pstats[i] = NULL;
9087 			}
9088 		}
9089 	}
9090 
9091 	/* Remove xbuf registration */
9092 	ddi_xbuf_attr_unregister_devinfo(un->un_xbuf_attr, devi);
9093 	ddi_xbuf_attr_destroy(un->un_xbuf_attr);
9094 
9095 	/* Remove driver properties */
9096 	ddi_prop_remove_all(devi);
9097 
9098 	mutex_destroy(&un->un_pm_mutex);
9099 	cv_destroy(&un->un_pm_busy_cv);
9100 
9101 	cv_destroy(&un->un_wcc_cv);
9102 
9103 	/* Open/close semaphore */
9104 	sema_destroy(&un->un_semoclose);
9105 
9106 	/* Removable media condvar. */
9107 	cv_destroy(&un->un_state_cv);
9108 
9109 	/* Suspend/resume condvar. */
9110 	cv_destroy(&un->un_suspend_cv);
9111 	cv_destroy(&un->un_disk_busy_cv);
9112 
9113 	sd_free_rqs(un);
9114 
9115 	/* Free up soft state */
9116 	devp->sd_private = NULL;
9117 
9118 	bzero(un, sizeof (struct sd_lun));
9119 
9120 	ddi_soft_state_free(sd_state, instance);
9121 
9122 	mutex_exit(&sd_detach_mutex);
9123 
9124 	/* This frees up the INQUIRY data associated with the device. */
9125 	scsi_unprobe(devp);
9126 
9127 	/*
9128 	 * After successfully detaching an instance, we update the information
9129 	 * of how many luns have been attached in the relative target and
9130 	 * controller for parallel SCSI. This information is used when sd tries
9131 	 * to set the tagged queuing capability in HBA.
9132 	 * Since un has been released, we can't use SD_IS_PARALLEL_SCSI(un) to
9133 	 * check if the device is parallel SCSI. However, we don't need to
9134 	 * check here because we've already checked during attach. No device
9135 	 * that is not parallel SCSI is in the chain.
9136 	 */
9137 	if ((tgt >= 0) && (tgt < NTARGETS_WIDE)) {
9138 		sd_scsi_update_lun_on_target(pdip, tgt, SD_SCSI_LUN_DETACH);
9139 	}
9140 
9141 	return (DDI_SUCCESS);
9142 
9143 err_notclosed:
9144 	mutex_exit(SD_MUTEX(un));
9145 
9146 err_stillbusy:
9147 	_NOTE(NO_COMPETING_THREADS_NOW);
9148 
9149 err_remove_event:
9150 	mutex_enter(&sd_detach_mutex);
9151 	un->un_detach_count--;
9152 	mutex_exit(&sd_detach_mutex);
9153 
9154 	SD_TRACE(SD_LOG_ATTACH_DETACH, un, "sd_unit_detach: exit failure\n");
9155 	return (DDI_FAILURE);
9156 }
9157 
9158 
9159 /*
9160  *    Function: sd_create_errstats
9161  *
9162  * Description: This routine instantiates the device error stats.
9163  *
9164  *		Note: During attach the stats are instantiated first so they are
9165  *		available for attach-time routines that utilize the driver
9166  *		iopath to send commands to the device. The stats are initialized
9167  *		separately so data obtained during some attach-time routines is
9168  *		available. (4362483)
9169  *
9170  *   Arguments: un - driver soft state (unit) structure
9171  *		instance - driver instance
9172  *
9173  *     Context: Kernel thread context
9174  */
9175 
9176 static void
9177 sd_create_errstats(struct sd_lun *un, int instance)
9178 {
9179 	struct	sd_errstats	*stp;
9180 	char	kstatmodule_err[KSTAT_STRLEN];
9181 	char	kstatname[KSTAT_STRLEN];
9182 	int	ndata = (sizeof (struct sd_errstats) / sizeof (kstat_named_t));
9183 
9184 	ASSERT(un != NULL);
9185 
9186 	if (un->un_errstats != NULL) {
9187 		return;
9188 	}
9189 
9190 	(void) snprintf(kstatmodule_err, sizeof (kstatmodule_err),
9191 	    "%serr", sd_label);
9192 	(void) snprintf(kstatname, sizeof (kstatname),
9193 	    "%s%d,err", sd_label, instance);
9194 
9195 	un->un_errstats = kstat_create(kstatmodule_err, instance, kstatname,
9196 	    "device_error", KSTAT_TYPE_NAMED, ndata, KSTAT_FLAG_PERSISTENT);
9197 
9198 	if (un->un_errstats == NULL) {
9199 		SD_ERROR(SD_LOG_ATTACH_DETACH, un,
9200 		    "sd_create_errstats: Failed kstat_create\n");
9201 		return;
9202 	}
9203 
9204 	stp = (struct sd_errstats *)un->un_errstats->ks_data;
9205 	kstat_named_init(&stp->sd_softerrs,	"Soft Errors",
9206 	    KSTAT_DATA_UINT32);
9207 	kstat_named_init(&stp->sd_harderrs,	"Hard Errors",
9208 	    KSTAT_DATA_UINT32);
9209 	kstat_named_init(&stp->sd_transerrs,	"Transport Errors",
9210 	    KSTAT_DATA_UINT32);
9211 	kstat_named_init(&stp->sd_vid,		"Vendor",
9212 	    KSTAT_DATA_CHAR);
9213 	kstat_named_init(&stp->sd_pid,		"Product",
9214 	    KSTAT_DATA_CHAR);
9215 	kstat_named_init(&stp->sd_revision,	"Revision",
9216 	    KSTAT_DATA_CHAR);
9217 	kstat_named_init(&stp->sd_serial,	"Serial No",
9218 	    KSTAT_DATA_CHAR);
9219 	kstat_named_init(&stp->sd_capacity,	"Size",
9220 	    KSTAT_DATA_ULONGLONG);
9221 	kstat_named_init(&stp->sd_rq_media_err,	"Media Error",
9222 	    KSTAT_DATA_UINT32);
9223 	kstat_named_init(&stp->sd_rq_ntrdy_err,	"Device Not Ready",
9224 	    KSTAT_DATA_UINT32);
9225 	kstat_named_init(&stp->sd_rq_nodev_err,	"No Device",
9226 	    KSTAT_DATA_UINT32);
9227 	kstat_named_init(&stp->sd_rq_recov_err,	"Recoverable",
9228 	    KSTAT_DATA_UINT32);
9229 	kstat_named_init(&stp->sd_rq_illrq_err,	"Illegal Request",
9230 	    KSTAT_DATA_UINT32);
9231 	kstat_named_init(&stp->sd_rq_pfa_err,	"Predictive Failure Analysis",
9232 	    KSTAT_DATA_UINT32);
9233 
9234 	un->un_errstats->ks_private = un;
9235 	un->un_errstats->ks_update  = nulldev;
9236 
9237 	kstat_install(un->un_errstats);
9238 }
9239 
9240 
9241 /*
9242  *    Function: sd_set_errstats
9243  *
9244  * Description: This routine sets the value of the vendor id, product id,
9245  *		revision, serial number, and capacity device error stats.
9246  *
9247  *		Note: During attach the stats are instantiated first so they are
9248  *		available for attach-time routines that utilize the driver
9249  *		iopath to send commands to the device. The stats are initialized
9250  *		separately so data obtained during some attach-time routines is
9251  *		available. (4362483)
9252  *
9253  *   Arguments: un - driver soft state (unit) structure
9254  *
9255  *     Context: Kernel thread context
9256  */
9257 
9258 static void
9259 sd_set_errstats(struct sd_lun *un)
9260 {
9261 	struct	sd_errstats	*stp;
9262 	char			*sn;
9263 
9264 	ASSERT(un != NULL);
9265 	ASSERT(un->un_errstats != NULL);
9266 	stp = (struct sd_errstats *)un->un_errstats->ks_data;
9267 	ASSERT(stp != NULL);
9268 	(void) strncpy(stp->sd_vid.value.c, un->un_sd->sd_inq->inq_vid, 8);
9269 	(void) strncpy(stp->sd_pid.value.c, un->un_sd->sd_inq->inq_pid, 16);
9270 	(void) strncpy(stp->sd_revision.value.c,
9271 	    un->un_sd->sd_inq->inq_revision, 4);
9272 
9273 	/*
9274 	 * All the errstats are persistent across detach/attach,
9275 	 * so reset all the errstats here in case of the hot
9276 	 * replacement of disk drives, except for not changed
9277 	 * Sun qualified drives.
9278 	 */
9279 	if ((bcmp(&SD_INQUIRY(un)->inq_pid[9], "SUN", 3) != 0) ||
9280 	    (bcmp(&SD_INQUIRY(un)->inq_serial, stp->sd_serial.value.c,
9281 	    sizeof (SD_INQUIRY(un)->inq_serial)) != 0)) {
9282 		stp->sd_softerrs.value.ui32 = 0;
9283 		stp->sd_harderrs.value.ui32 = 0;
9284 		stp->sd_transerrs.value.ui32 = 0;
9285 		stp->sd_rq_media_err.value.ui32 = 0;
9286 		stp->sd_rq_ntrdy_err.value.ui32 = 0;
9287 		stp->sd_rq_nodev_err.value.ui32 = 0;
9288 		stp->sd_rq_recov_err.value.ui32 = 0;
9289 		stp->sd_rq_illrq_err.value.ui32 = 0;
9290 		stp->sd_rq_pfa_err.value.ui32 = 0;
9291 	}
9292 
9293 	/*
9294 	 * Set the "Serial No" kstat for Sun qualified drives (indicated by
9295 	 * "SUN" in bytes 25-27 of the inquiry data (bytes 9-11 of the pid)
9296 	 * (4376302))
9297 	 */
9298 	if (bcmp(&SD_INQUIRY(un)->inq_pid[9], "SUN", 3) == 0) {
9299 		bcopy(&SD_INQUIRY(un)->inq_serial, stp->sd_serial.value.c,
9300 		    sizeof (SD_INQUIRY(un)->inq_serial));
9301 	} else {
9302 		/*
9303 		 * Set the "Serial No" kstat for non-Sun qualified drives
9304 		 */
9305 		if (ddi_prop_lookup_string(DDI_DEV_T_ANY, SD_DEVINFO(un),
9306 		    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS,
9307 		    INQUIRY_SERIAL_NO, &sn) == DDI_SUCCESS) {
9308 			(void) strlcpy(stp->sd_serial.value.c, sn,
9309 			    sizeof (stp->sd_serial.value.c));
9310 			ddi_prop_free(sn);
9311 		}
9312 	}
9313 
9314 	if (un->un_f_blockcount_is_valid != TRUE) {
9315 		/*
9316 		 * Set capacity error stat to 0 for no media. This ensures
9317 		 * a valid capacity is displayed in response to 'iostat -E'
9318 		 * when no media is present in the device.
9319 		 */
9320 		stp->sd_capacity.value.ui64 = 0;
9321 	} else {
9322 		/*
9323 		 * Multiply un_blockcount by un->un_sys_blocksize to get
9324 		 * capacity.
9325 		 *
9326 		 * Note: for non-512 blocksize devices "un_blockcount" has been
9327 		 * "scaled" in sd_send_scsi_READ_CAPACITY by multiplying by
9328 		 * (un_tgt_blocksize / un->un_sys_blocksize).
9329 		 */
9330 		stp->sd_capacity.value.ui64 = (uint64_t)
9331 		    ((uint64_t)un->un_blockcount * un->un_sys_blocksize);
9332 	}
9333 }
9334 
9335 
9336 /*
9337  *    Function: sd_set_pstats
9338  *
9339  * Description: This routine instantiates and initializes the partition
9340  *              stats for each partition with more than zero blocks.
9341  *		(4363169)
9342  *
9343  *   Arguments: un - driver soft state (unit) structure
9344  *
9345  *     Context: Kernel thread context
9346  */
9347 
9348 static void
9349 sd_set_pstats(struct sd_lun *un)
9350 {
9351 	char	kstatname[KSTAT_STRLEN];
9352 	int	instance;
9353 	int	i;
9354 	diskaddr_t	nblks = 0;
9355 	char	*partname = NULL;
9356 
9357 	ASSERT(un != NULL);
9358 
9359 	instance = ddi_get_instance(SD_DEVINFO(un));
9360 
9361 	/* Note:x86: is this a VTOC8/VTOC16 difference? */
9362 	for (i = 0; i < NSDMAP; i++) {
9363 
9364 		if (cmlb_partinfo(un->un_cmlbhandle, i,
9365 		    &nblks, NULL, &partname, NULL, (void *)SD_PATH_DIRECT) != 0)
9366 			continue;
9367 		mutex_enter(SD_MUTEX(un));
9368 
9369 		if ((un->un_pstats[i] == NULL) &&
9370 		    (nblks != 0)) {
9371 
9372 			(void) snprintf(kstatname, sizeof (kstatname),
9373 			    "%s%d,%s", sd_label, instance,
9374 			    partname);
9375 
9376 			un->un_pstats[i] = kstat_create(sd_label,
9377 			    instance, kstatname, "partition", KSTAT_TYPE_IO,
9378 			    1, KSTAT_FLAG_PERSISTENT);
9379 			if (un->un_pstats[i] != NULL) {
9380 				un->un_pstats[i]->ks_lock = SD_MUTEX(un);
9381 				kstat_install(un->un_pstats[i]);
9382 			}
9383 		}
9384 		mutex_exit(SD_MUTEX(un));
9385 	}
9386 }
9387 
9388 
9389 #if (defined(__fibre))
9390 /*
9391  *    Function: sd_init_event_callbacks
9392  *
9393  * Description: This routine initializes the insertion and removal event
9394  *		callbacks. (fibre only)
9395  *
9396  *   Arguments: un - driver soft state (unit) structure
9397  *
9398  *     Context: Kernel thread context
9399  */
9400 
9401 static void
9402 sd_init_event_callbacks(struct sd_lun *un)
9403 {
9404 	ASSERT(un != NULL);
9405 
9406 	if ((un->un_insert_event == NULL) &&
9407 	    (ddi_get_eventcookie(SD_DEVINFO(un), FCAL_INSERT_EVENT,
9408 	    &un->un_insert_event) == DDI_SUCCESS)) {
9409 		/*
9410 		 * Add the callback for an insertion event
9411 		 */
9412 		(void) ddi_add_event_handler(SD_DEVINFO(un),
9413 		    un->un_insert_event, sd_event_callback, (void *)un,
9414 		    &(un->un_insert_cb_id));
9415 	}
9416 
9417 	if ((un->un_remove_event == NULL) &&
9418 	    (ddi_get_eventcookie(SD_DEVINFO(un), FCAL_REMOVE_EVENT,
9419 	    &un->un_remove_event) == DDI_SUCCESS)) {
9420 		/*
9421 		 * Add the callback for a removal event
9422 		 */
9423 		(void) ddi_add_event_handler(SD_DEVINFO(un),
9424 		    un->un_remove_event, sd_event_callback, (void *)un,
9425 		    &(un->un_remove_cb_id));
9426 	}
9427 }
9428 
9429 
9430 /*
9431  *    Function: sd_event_callback
9432  *
9433  * Description: This routine handles insert/remove events (photon). The
9434  *		state is changed to OFFLINE which can be used to supress
9435  *		error msgs. (fibre only)
9436  *
9437  *   Arguments: un - driver soft state (unit) structure
9438  *
9439  *     Context: Callout thread context
9440  */
9441 /* ARGSUSED */
9442 static void
9443 sd_event_callback(dev_info_t *dip, ddi_eventcookie_t event, void *arg,
9444     void *bus_impldata)
9445 {
9446 	struct sd_lun *un = (struct sd_lun *)arg;
9447 
9448 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::un_insert_event));
9449 	if (event == un->un_insert_event) {
9450 		SD_TRACE(SD_LOG_COMMON, un, "sd_event_callback: insert event");
9451 		mutex_enter(SD_MUTEX(un));
9452 		if (un->un_state == SD_STATE_OFFLINE) {
9453 			if (un->un_last_state != SD_STATE_SUSPENDED) {
9454 				un->un_state = un->un_last_state;
9455 			} else {
9456 				/*
9457 				 * We have gone through SUSPEND/RESUME while
9458 				 * we were offline. Restore the last state
9459 				 */
9460 				un->un_state = un->un_save_state;
9461 			}
9462 		}
9463 		mutex_exit(SD_MUTEX(un));
9464 
9465 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::un_remove_event));
9466 	} else if (event == un->un_remove_event) {
9467 		SD_TRACE(SD_LOG_COMMON, un, "sd_event_callback: remove event");
9468 		mutex_enter(SD_MUTEX(un));
9469 		/*
9470 		 * We need to handle an event callback that occurs during
9471 		 * the suspend operation, since we don't prevent it.
9472 		 */
9473 		if (un->un_state != SD_STATE_OFFLINE) {
9474 			if (un->un_state != SD_STATE_SUSPENDED) {
9475 				New_state(un, SD_STATE_OFFLINE);
9476 			} else {
9477 				un->un_last_state = SD_STATE_OFFLINE;
9478 			}
9479 		}
9480 		mutex_exit(SD_MUTEX(un));
9481 	} else {
9482 		scsi_log(SD_DEVINFO(un), sd_label, CE_NOTE,
9483 		    "!Unknown event\n");
9484 	}
9485 
9486 }
9487 #endif
9488 
9489 /*
9490  * Values related to caching mode page depending on whether the unit is ATAPI.
9491  */
9492 #define	SDC_CDB_GROUP(un) ((un->un_f_cfg_is_atapi == TRUE) ? \
9493 	CDB_GROUP1 : CDB_GROUP0)
9494 #define	SDC_HDRLEN(un) ((un->un_f_cfg_is_atapi == TRUE) ? \
9495 	MODE_HEADER_LENGTH_GRP2 : MODE_HEADER_LENGTH)
9496 /*
9497  * Use mode_cache_scsi3 to ensure we get all of the mode sense data, otherwise
9498  * the mode select will fail (mode_cache_scsi3 is a superset of mode_caching).
9499  */
9500 #define	SDC_BUFLEN(un) (SDC_HDRLEN(un) + MODE_BLK_DESC_LENGTH + \
9501 	sizeof (struct mode_cache_scsi3))
9502 
9503 static int
9504 sd_get_caching_mode_page(sd_ssc_t *ssc, uchar_t page_control, uchar_t **header,
9505     int *bdlen)
9506 {
9507 	struct sd_lun	*un = ssc->ssc_un;
9508 	struct mode_caching *mode_caching_page;
9509 	size_t		buflen = SDC_BUFLEN(un);
9510 	int		hdrlen = SDC_HDRLEN(un);
9511 	int		rval;
9512 
9513 	/*
9514 	 * Do a test unit ready, otherwise a mode sense may not work if this
9515 	 * is the first command sent to the device after boot.
9516 	 */
9517 	if (sd_send_scsi_TEST_UNIT_READY(ssc, 0) != 0)
9518 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9519 
9520 	/*
9521 	 * Allocate memory for the retrieved mode page and its headers.  Set
9522 	 * a pointer to the page itself.
9523 	 */
9524 	*header = kmem_zalloc(buflen, KM_SLEEP);
9525 
9526 	/* Get the information from the device */
9527 	rval = sd_send_scsi_MODE_SENSE(ssc, SDC_CDB_GROUP(un), *header, buflen,
9528 	    page_control | MODEPAGE_CACHING, SD_PATH_DIRECT);
9529 	if (rval != 0) {
9530 		SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un, "%s: Mode Sense Failed\n",
9531 		    __func__);
9532 		goto mode_sense_failed;
9533 	}
9534 
9535 	/*
9536 	 * Determine size of Block Descriptors in order to locate
9537 	 * the mode page data. ATAPI devices return 0, SCSI devices
9538 	 * should return MODE_BLK_DESC_LENGTH.
9539 	 */
9540 	if (un->un_f_cfg_is_atapi == TRUE) {
9541 		struct mode_header_grp2 *mhp =
9542 		    (struct mode_header_grp2 *)(*header);
9543 		*bdlen = (mhp->bdesc_length_hi << 8) | mhp->bdesc_length_lo;
9544 	} else {
9545 		*bdlen = ((struct mode_header *)(*header))->bdesc_length;
9546 	}
9547 
9548 	if (*bdlen > MODE_BLK_DESC_LENGTH) {
9549 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, 0,
9550 		    "%s: Mode Sense returned invalid block descriptor length\n",
9551 		    __func__);
9552 		rval = EIO;
9553 		goto mode_sense_failed;
9554 	}
9555 
9556 	mode_caching_page = (struct mode_caching *)(*header + hdrlen + *bdlen);
9557 	if (mode_caching_page->mode_page.code != MODEPAGE_CACHING) {
9558 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
9559 		    "%s: Mode Sense caching page code mismatch %d\n",
9560 		    __func__, mode_caching_page->mode_page.code);
9561 		rval = EIO;
9562 	}
9563 
9564 mode_sense_failed:
9565 	if (rval != 0) {
9566 		kmem_free(*header, buflen);
9567 		*header = NULL;
9568 		*bdlen = 0;
9569 	}
9570 	return (rval);
9571 }
9572 
9573 /*
9574  *    Function: sd_cache_control()
9575  *
9576  * Description: This routine is the driver entry point for setting
9577  *		read and write caching by modifying the WCE (write cache
9578  *		enable) and RCD (read cache disable) bits of mode
9579  *		page 8 (MODEPAGE_CACHING).
9580  *
9581  *   Arguments: ssc		- ssc contains pointer to driver soft state
9582  *				  (unit) structure for this target.
9583  *		rcd_flag	- flag for controlling the read cache
9584  *		wce_flag	- flag for controlling the write cache
9585  *
9586  * Return Code: EIO
9587  *		code returned by sd_send_scsi_MODE_SENSE and
9588  *		sd_send_scsi_MODE_SELECT
9589  *
9590  *     Context: Kernel Thread
9591  */
9592 
9593 static int
9594 sd_cache_control(sd_ssc_t *ssc, int rcd_flag, int wce_flag)
9595 {
9596 	struct sd_lun	*un = ssc->ssc_un;
9597 	struct mode_caching *mode_caching_page;
9598 	uchar_t		*header;
9599 	size_t		buflen = SDC_BUFLEN(un);
9600 	int		hdrlen = SDC_HDRLEN(un);
9601 	int		bdlen;
9602 	int		rval;
9603 
9604 	rval = sd_get_caching_mode_page(ssc, MODEPAGE_CURRENT, &header, &bdlen);
9605 	switch (rval) {
9606 	case 0:
9607 		/* Check the relevant bits on successful mode sense */
9608 		mode_caching_page = (struct mode_caching *)(header + hdrlen +
9609 		    bdlen);
9610 		if ((mode_caching_page->rcd && rcd_flag == SD_CACHE_ENABLE) ||
9611 		    (!mode_caching_page->rcd && rcd_flag == SD_CACHE_DISABLE) ||
9612 		    (mode_caching_page->wce && wce_flag == SD_CACHE_DISABLE) ||
9613 		    (!mode_caching_page->wce && wce_flag == SD_CACHE_ENABLE)) {
9614 			size_t sbuflen;
9615 			uchar_t save_pg;
9616 
9617 			/*
9618 			 * Construct select buffer length based on the
9619 			 * length of the sense data returned.
9620 			 */
9621 			sbuflen = hdrlen + bdlen + sizeof (struct mode_page) +
9622 			    (int)mode_caching_page->mode_page.length;
9623 
9624 			/* Set the caching bits as requested */
9625 			if (rcd_flag == SD_CACHE_ENABLE)
9626 				mode_caching_page->rcd = 0;
9627 			else if (rcd_flag == SD_CACHE_DISABLE)
9628 				mode_caching_page->rcd = 1;
9629 
9630 			if (wce_flag == SD_CACHE_ENABLE)
9631 				mode_caching_page->wce = 1;
9632 			else if (wce_flag == SD_CACHE_DISABLE)
9633 				mode_caching_page->wce = 0;
9634 
9635 			/*
9636 			 * Save the page if the mode sense says the
9637 			 * drive supports it.
9638 			 */
9639 			save_pg = mode_caching_page->mode_page.ps ?
9640 			    SD_SAVE_PAGE : SD_DONTSAVE_PAGE;
9641 
9642 			/* Clear reserved bits before mode select */
9643 			mode_caching_page->mode_page.ps = 0;
9644 
9645 			/*
9646 			 * Clear out mode header for mode select.
9647 			 * The rest of the retrieved page will be reused.
9648 			 */
9649 			bzero(header, hdrlen);
9650 
9651 			if (un->un_f_cfg_is_atapi == TRUE) {
9652 				struct mode_header_grp2 *mhp =
9653 				    (struct mode_header_grp2 *)header;
9654 				mhp->bdesc_length_hi = bdlen >> 8;
9655 				mhp->bdesc_length_lo = (uchar_t)bdlen & 0xff;
9656 			} else {
9657 				((struct mode_header *)header)->bdesc_length =
9658 				    bdlen;
9659 			}
9660 
9661 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9662 
9663 			/* Issue mode select to change the cache settings */
9664 			rval = sd_send_scsi_MODE_SELECT(ssc, SDC_CDB_GROUP(un),
9665 			    header, sbuflen, save_pg, SD_PATH_DIRECT);
9666 		}
9667 		kmem_free(header, buflen);
9668 		break;
9669 	case EIO:
9670 		sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
9671 		break;
9672 	default:
9673 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9674 		break;
9675 	}
9676 
9677 	return (rval);
9678 }
9679 
9680 
9681 /*
9682  *    Function: sd_get_write_cache_enabled()
9683  *
9684  * Description: This routine is the driver entry point for determining if write
9685  *		caching is enabled.  It examines the WCE (write cache enable)
9686  *		bits of mode page 8 (MODEPAGE_CACHING) with Page Control field
9687  *		bits set to MODEPAGE_CURRENT.
9688  *
9689  *   Arguments: ssc		- ssc contains pointer to driver soft state
9690  *				  (unit) structure for this target.
9691  *		is_enabled	- pointer to int where write cache enabled state
9692  *				  is returned (non-zero -> write cache enabled)
9693  *
9694  * Return Code: EIO
9695  *		code returned by sd_send_scsi_MODE_SENSE
9696  *
9697  *     Context: Kernel Thread
9698  *
9699  * NOTE: If ioctl is added to disable write cache, this sequence should
9700  * be followed so that no locking is required for accesses to
9701  * un->un_f_write_cache_enabled:
9702  *	do mode select to clear wce
9703  *	do synchronize cache to flush cache
9704  *	set un->un_f_write_cache_enabled = FALSE
9705  *
9706  * Conversely, an ioctl to enable the write cache should be done
9707  * in this order:
9708  *	set un->un_f_write_cache_enabled = TRUE
9709  *	do mode select to set wce
9710  */
9711 
9712 static int
9713 sd_get_write_cache_enabled(sd_ssc_t *ssc, int *is_enabled)
9714 {
9715 	struct sd_lun	*un = ssc->ssc_un;
9716 	struct mode_caching *mode_caching_page;
9717 	uchar_t		*header;
9718 	size_t		buflen = SDC_BUFLEN(un);
9719 	int		hdrlen = SDC_HDRLEN(un);
9720 	int		bdlen;
9721 	int		rval;
9722 
9723 	/* In case of error, flag as enabled */
9724 	*is_enabled = TRUE;
9725 
9726 	rval = sd_get_caching_mode_page(ssc, MODEPAGE_CURRENT, &header, &bdlen);
9727 	switch (rval) {
9728 	case 0:
9729 		mode_caching_page = (struct mode_caching *)(header + hdrlen +
9730 		    bdlen);
9731 		*is_enabled = mode_caching_page->wce;
9732 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
9733 		kmem_free(header, buflen);
9734 		break;
9735 	case EIO: {
9736 		/*
9737 		 * Some disks do not support Mode Sense(6), we
9738 		 * should ignore this kind of error (sense key is
9739 		 * 0x5 - illegal request).
9740 		 */
9741 		uint8_t *sensep;
9742 		int senlen;
9743 
9744 		sensep = (uint8_t *)ssc->ssc_uscsi_cmd->uscsi_rqbuf;
9745 		senlen = (int)(ssc->ssc_uscsi_cmd->uscsi_rqlen -
9746 		    ssc->ssc_uscsi_cmd->uscsi_rqresid);
9747 
9748 		if (senlen > 0 &&
9749 		    scsi_sense_key(sensep) == KEY_ILLEGAL_REQUEST) {
9750 			sd_ssc_assessment(ssc, SD_FMT_IGNORE_COMPROMISE);
9751 		} else {
9752 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
9753 		}
9754 		break;
9755 	}
9756 	default:
9757 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9758 		break;
9759 	}
9760 
9761 	return (rval);
9762 }
9763 
9764 /*
9765  *    Function: sd_get_write_cache_changeable()
9766  *
9767  * Description: This routine is the driver entry point for determining if write
9768  *		caching is changeable.  It examines the WCE (write cache enable)
9769  *		bits of mode page 8 (MODEPAGE_CACHING) with Page Control field
9770  *		bits set to MODEPAGE_CHANGEABLE.
9771  *
9772  *   Arguments: ssc		- ssc contains pointer to driver soft state
9773  *				  (unit) structure for this target.
9774  *		is_changeable	- pointer to int where write cache changeable
9775  *				  state is returned (non-zero -> write cache
9776  *				  changeable)
9777  *
9778  *     Context: Kernel Thread
9779  */
9780 
9781 static void
9782 sd_get_write_cache_changeable(sd_ssc_t *ssc, int *is_changeable)
9783 {
9784 	struct sd_lun	*un = ssc->ssc_un;
9785 	struct mode_caching *mode_caching_page;
9786 	uchar_t		*header;
9787 	size_t		buflen = SDC_BUFLEN(un);
9788 	int		hdrlen = SDC_HDRLEN(un);
9789 	int		bdlen;
9790 	int		rval;
9791 
9792 	/* In case of error, flag as enabled */
9793 	*is_changeable = TRUE;
9794 
9795 	rval = sd_get_caching_mode_page(ssc, MODEPAGE_CHANGEABLE, &header,
9796 	    &bdlen);
9797 	switch (rval) {
9798 	case 0:
9799 		mode_caching_page = (struct mode_caching *)(header + hdrlen +
9800 		    bdlen);
9801 		*is_changeable = mode_caching_page->wce;
9802 		kmem_free(header, buflen);
9803 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
9804 		break;
9805 	case EIO:
9806 		sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
9807 		break;
9808 	default:
9809 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9810 		break;
9811 	}
9812 }
9813 
9814 /*
9815  *    Function: sd_get_nv_sup()
9816  *
9817  * Description: This routine is the driver entry point for
9818  * determining whether non-volatile cache is supported. This
9819  * determination process works as follows:
9820  *
9821  * 1. sd first queries sd.conf on whether
9822  * suppress_cache_flush bit is set for this device.
9823  *
9824  * 2. if not there, then queries the internal disk table.
9825  *
9826  * 3. if either sd.conf or internal disk table specifies
9827  * cache flush be suppressed, we don't bother checking
9828  * NV_SUP bit.
9829  *
9830  * If SUPPRESS_CACHE_FLUSH bit is not set to 1, sd queries
9831  * the optional INQUIRY VPD page 0x86. If the device
9832  * supports VPD page 0x86, sd examines the NV_SUP
9833  * (non-volatile cache support) bit in the INQUIRY VPD page
9834  * 0x86:
9835  *   o If NV_SUP bit is set, sd assumes the device has a
9836  *   non-volatile cache and set the
9837  *   un_f_sync_nv_supported to TRUE.
9838  *   o Otherwise cache is not non-volatile,
9839  *   un_f_sync_nv_supported is set to FALSE.
9840  *
9841  * Arguments: un - driver soft state (unit) structure
9842  *
9843  * Return Code:
9844  *
9845  *     Context: Kernel Thread
9846  */
9847 
9848 static void
9849 sd_get_nv_sup(sd_ssc_t *ssc)
9850 {
9851 	int		rval		= 0;
9852 	uchar_t		*inq86		= NULL;
9853 	size_t		inq86_len	= MAX_INQUIRY_SIZE;
9854 	size_t		inq86_resid	= 0;
9855 	struct		dk_callback *dkc;
9856 	struct sd_lun	*un;
9857 
9858 	ASSERT(ssc != NULL);
9859 	un = ssc->ssc_un;
9860 	ASSERT(un != NULL);
9861 
9862 	mutex_enter(SD_MUTEX(un));
9863 
9864 	/*
9865 	 * Be conservative on the device's support of
9866 	 * SYNC_NV bit: un_f_sync_nv_supported is
9867 	 * initialized to be false.
9868 	 */
9869 	un->un_f_sync_nv_supported = FALSE;
9870 
9871 	/*
9872 	 * If either sd.conf or internal disk table
9873 	 * specifies cache flush be suppressed, then
9874 	 * we don't bother checking NV_SUP bit.
9875 	 */
9876 	if (un->un_f_suppress_cache_flush == TRUE) {
9877 		mutex_exit(SD_MUTEX(un));
9878 		return;
9879 	}
9880 
9881 	if (sd_check_vpd_page_support(ssc) == 0 &&
9882 	    un->un_vpd_page_mask & SD_VPD_EXTENDED_DATA_PG) {
9883 		mutex_exit(SD_MUTEX(un));
9884 		/* collect page 86 data if available */
9885 		inq86 = kmem_zalloc(inq86_len, KM_SLEEP);
9886 
9887 		rval = sd_send_scsi_INQUIRY(ssc, inq86, inq86_len,
9888 		    0x01, 0x86, &inq86_resid);
9889 
9890 		if (rval == 0 && (inq86_len - inq86_resid > 6)) {
9891 			SD_TRACE(SD_LOG_COMMON, un,
9892 			    "sd_get_nv_sup: \
9893 			    successfully get VPD page: %x \
9894 			    PAGE LENGTH: %x BYTE 6: %x\n",
9895 			    inq86[1], inq86[3], inq86[6]);
9896 
9897 			mutex_enter(SD_MUTEX(un));
9898 			/*
9899 			 * check the value of NV_SUP bit: only if the device
9900 			 * reports NV_SUP bit to be 1, the
9901 			 * un_f_sync_nv_supported bit will be set to true.
9902 			 */
9903 			if (inq86[6] & SD_VPD_NV_SUP) {
9904 				un->un_f_sync_nv_supported = TRUE;
9905 			}
9906 			mutex_exit(SD_MUTEX(un));
9907 		} else if (rval != 0) {
9908 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9909 		}
9910 
9911 		kmem_free(inq86, inq86_len);
9912 	} else {
9913 		mutex_exit(SD_MUTEX(un));
9914 	}
9915 
9916 	/*
9917 	 * Send a SYNC CACHE command to check whether
9918 	 * SYNC_NV bit is supported. This command should have
9919 	 * un_f_sync_nv_supported set to correct value.
9920 	 */
9921 	mutex_enter(SD_MUTEX(un));
9922 	if (un->un_f_sync_nv_supported) {
9923 		mutex_exit(SD_MUTEX(un));
9924 		dkc = kmem_zalloc(sizeof (struct dk_callback), KM_SLEEP);
9925 		dkc->dkc_flag = FLUSH_VOLATILE;
9926 		(void) sd_send_scsi_SYNCHRONIZE_CACHE(un, dkc);
9927 
9928 		/*
9929 		 * Send a TEST UNIT READY command to the device. This should
9930 		 * clear any outstanding UNIT ATTENTION that may be present.
9931 		 */
9932 		rval = sd_send_scsi_TEST_UNIT_READY(ssc, SD_DONT_RETRY_TUR);
9933 		if (rval != 0)
9934 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9935 
9936 		kmem_free(dkc, sizeof (struct dk_callback));
9937 	} else {
9938 		mutex_exit(SD_MUTEX(un));
9939 	}
9940 
9941 	SD_TRACE(SD_LOG_COMMON, un, "sd_get_nv_sup: \
9942 	    un_f_suppress_cache_flush is set to %d\n",
9943 	    un->un_f_suppress_cache_flush);
9944 }
9945 
9946 /*
9947  *    Function: sd_make_device
9948  *
9949  * Description: Utility routine to return the Solaris device number from
9950  *		the data in the device's dev_info structure.
9951  *
9952  * Return Code: The Solaris device number
9953  *
9954  *     Context: Any
9955  */
9956 
9957 static dev_t
9958 sd_make_device(dev_info_t *devi)
9959 {
9960 	return (makedevice(ddi_driver_major(devi),
9961 	    ddi_get_instance(devi) << SDUNIT_SHIFT));
9962 }
9963 
9964 
9965 /*
9966  *    Function: sd_pm_entry
9967  *
9968  * Description: Called at the start of a new command to manage power
9969  *		and busy status of a device. This includes determining whether
9970  *		the current power state of the device is sufficient for
9971  *		performing the command or whether it must be changed.
9972  *		The PM framework is notified appropriately.
9973  *		Only with a return status of DDI_SUCCESS will the
9974  *		component be busy to the framework.
9975  *
9976  *		All callers of sd_pm_entry must check the return status
9977  *		and only call sd_pm_exit it it was DDI_SUCCESS. A status
9978  *		of DDI_FAILURE indicates the device failed to power up.
9979  *		In this case un_pm_count has been adjusted so the result
9980  *		on exit is still powered down, ie. count is less than 0.
9981  *		Calling sd_pm_exit with this count value hits an ASSERT.
9982  *
9983  * Return Code: DDI_SUCCESS or DDI_FAILURE
9984  *
9985  *     Context: Kernel thread context.
9986  */
9987 
9988 static int
9989 sd_pm_entry(struct sd_lun *un)
9990 {
9991 	int return_status = DDI_SUCCESS;
9992 
9993 	ASSERT(!mutex_owned(SD_MUTEX(un)));
9994 	ASSERT(!mutex_owned(&un->un_pm_mutex));
9995 
9996 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_entry: entry\n");
9997 
9998 	if (un->un_f_pm_is_enabled == FALSE) {
9999 		SD_TRACE(SD_LOG_IO_PM, un,
10000 		    "sd_pm_entry: exiting, PM not enabled\n");
10001 		return (return_status);
10002 	}
10003 
10004 	/*
10005 	 * Just increment a counter if PM is enabled. On the transition from
10006 	 * 0 ==> 1, mark the device as busy.  The iodone side will decrement
10007 	 * the count with each IO and mark the device as idle when the count
10008 	 * hits 0.
10009 	 *
10010 	 * If the count is less than 0 the device is powered down. If a powered
10011 	 * down device is successfully powered up then the count must be
10012 	 * incremented to reflect the power up. Note that it'll get incremented
10013 	 * a second time to become busy.
10014 	 *
10015 	 * Because the following has the potential to change the device state
10016 	 * and must release the un_pm_mutex to do so, only one thread can be
10017 	 * allowed through at a time.
10018 	 */
10019 
10020 	mutex_enter(&un->un_pm_mutex);
10021 	while (un->un_pm_busy == TRUE) {
10022 		cv_wait(&un->un_pm_busy_cv, &un->un_pm_mutex);
10023 	}
10024 	un->un_pm_busy = TRUE;
10025 
10026 	if (un->un_pm_count < 1) {
10027 
10028 		SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_entry: busy component\n");
10029 
10030 		/*
10031 		 * Indicate we are now busy so the framework won't attempt to
10032 		 * power down the device. This call will only fail if either
10033 		 * we passed a bad component number or the device has no
10034 		 * components. Neither of these should ever happen.
10035 		 */
10036 		mutex_exit(&un->un_pm_mutex);
10037 		return_status = pm_busy_component(SD_DEVINFO(un), 0);
10038 		ASSERT(return_status == DDI_SUCCESS);
10039 
10040 		mutex_enter(&un->un_pm_mutex);
10041 
10042 		if (un->un_pm_count < 0) {
10043 			mutex_exit(&un->un_pm_mutex);
10044 
10045 			SD_TRACE(SD_LOG_IO_PM, un,
10046 			    "sd_pm_entry: power up component\n");
10047 
10048 			/*
10049 			 * pm_raise_power will cause sdpower to be called
10050 			 * which brings the device power level to the
10051 			 * desired state, If successful, un_pm_count and
10052 			 * un_power_level will be updated appropriately.
10053 			 */
10054 			return_status = pm_raise_power(SD_DEVINFO(un), 0,
10055 			    SD_PM_STATE_ACTIVE(un));
10056 
10057 			mutex_enter(&un->un_pm_mutex);
10058 
10059 			if (return_status != DDI_SUCCESS) {
10060 				/*
10061 				 * Power up failed.
10062 				 * Idle the device and adjust the count
10063 				 * so the result on exit is that we're
10064 				 * still powered down, ie. count is less than 0.
10065 				 */
10066 				SD_TRACE(SD_LOG_IO_PM, un,
10067 				    "sd_pm_entry: power up failed,"
10068 				    " idle the component\n");
10069 
10070 				(void) pm_idle_component(SD_DEVINFO(un), 0);
10071 				un->un_pm_count--;
10072 			} else {
10073 				/*
10074 				 * Device is powered up, verify the
10075 				 * count is non-negative.
10076 				 * This is debug only.
10077 				 */
10078 				ASSERT(un->un_pm_count == 0);
10079 			}
10080 		}
10081 
10082 		if (return_status == DDI_SUCCESS) {
10083 			/*
10084 			 * For performance, now that the device has been tagged
10085 			 * as busy, and it's known to be powered up, update the
10086 			 * chain types to use jump tables that do not include
10087 			 * pm. This significantly lowers the overhead and
10088 			 * therefore improves performance.
10089 			 */
10090 
10091 			mutex_exit(&un->un_pm_mutex);
10092 			mutex_enter(SD_MUTEX(un));
10093 			SD_TRACE(SD_LOG_IO_PM, un,
10094 			    "sd_pm_entry: changing uscsi_chain_type from %d\n",
10095 			    un->un_uscsi_chain_type);
10096 
10097 			if (un->un_f_non_devbsize_supported) {
10098 				un->un_buf_chain_type =
10099 				    SD_CHAIN_INFO_RMMEDIA_NO_PM;
10100 			} else {
10101 				un->un_buf_chain_type =
10102 				    SD_CHAIN_INFO_DISK_NO_PM;
10103 			}
10104 			un->un_uscsi_chain_type = SD_CHAIN_INFO_USCSI_CMD_NO_PM;
10105 
10106 			SD_TRACE(SD_LOG_IO_PM, un,
10107 			    "             changed  uscsi_chain_type to   %d\n",
10108 			    un->un_uscsi_chain_type);
10109 			mutex_exit(SD_MUTEX(un));
10110 			mutex_enter(&un->un_pm_mutex);
10111 
10112 			if (un->un_pm_idle_timeid == NULL) {
10113 				/* 300 ms. */
10114 				un->un_pm_idle_timeid =
10115 				    timeout(sd_pm_idletimeout_handler, un,
10116 				    (drv_usectohz((clock_t)300000)));
10117 				/*
10118 				 * Include an extra call to busy which keeps the
10119 				 * device busy with-respect-to the PM layer
10120 				 * until the timer fires, at which time it'll
10121 				 * get the extra idle call.
10122 				 */
10123 				(void) pm_busy_component(SD_DEVINFO(un), 0);
10124 			}
10125 		}
10126 	}
10127 	un->un_pm_busy = FALSE;
10128 	/* Next... */
10129 	cv_signal(&un->un_pm_busy_cv);
10130 
10131 	un->un_pm_count++;
10132 
10133 	SD_TRACE(SD_LOG_IO_PM, un,
10134 	    "sd_pm_entry: exiting, un_pm_count = %d\n", un->un_pm_count);
10135 
10136 	mutex_exit(&un->un_pm_mutex);
10137 
10138 	return (return_status);
10139 }
10140 
10141 
10142 /*
10143  *    Function: sd_pm_exit
10144  *
10145  * Description: Called at the completion of a command to manage busy
10146  *		status for the device. If the device becomes idle the
10147  *		PM framework is notified.
10148  *
10149  *     Context: Kernel thread context
10150  */
10151 
10152 static void
10153 sd_pm_exit(struct sd_lun *un)
10154 {
10155 	ASSERT(!mutex_owned(SD_MUTEX(un)));
10156 	ASSERT(!mutex_owned(&un->un_pm_mutex));
10157 
10158 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_exit: entry\n");
10159 
10160 	/*
10161 	 * After attach the following flag is only read, so don't
10162 	 * take the penalty of acquiring a mutex for it.
10163 	 */
10164 	if (un->un_f_pm_is_enabled == TRUE) {
10165 
10166 		mutex_enter(&un->un_pm_mutex);
10167 		un->un_pm_count--;
10168 
10169 		SD_TRACE(SD_LOG_IO_PM, un,
10170 		    "sd_pm_exit: un_pm_count = %d\n", un->un_pm_count);
10171 
10172 		ASSERT(un->un_pm_count >= 0);
10173 		if (un->un_pm_count == 0) {
10174 			mutex_exit(&un->un_pm_mutex);
10175 
10176 			SD_TRACE(SD_LOG_IO_PM, un,
10177 			    "sd_pm_exit: idle component\n");
10178 
10179 			(void) pm_idle_component(SD_DEVINFO(un), 0);
10180 
10181 		} else {
10182 			mutex_exit(&un->un_pm_mutex);
10183 		}
10184 	}
10185 
10186 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_exit: exiting\n");
10187 }
10188 
10189 
10190 /*
10191  *    Function: sdopen
10192  *
10193  * Description: Driver's open(9e) entry point function.
10194  *
10195  *   Arguments: dev_i   - pointer to device number
10196  *		flag    - how to open file (FEXCL, FNDELAY, FREAD, FWRITE)
10197  *		otyp    - open type (OTYP_BLK, OTYP_CHR, OTYP_LYR)
10198  *		cred_p  - user credential pointer
10199  *
10200  * Return Code: EINVAL
10201  *		ENXIO
10202  *		EIO
10203  *		EROFS
10204  *		EBUSY
10205  *
10206  *     Context: Kernel thread context
10207  */
10208 /* ARGSUSED */
10209 static int
10210 sdopen(dev_t *dev_p, int flag, int otyp, cred_t *cred_p)
10211 {
10212 	struct sd_lun	*un;
10213 	int		nodelay;
10214 	int		part;
10215 	uint64_t	partmask;
10216 	int		instance;
10217 	dev_t		dev;
10218 	int		rval = EIO;
10219 	diskaddr_t	nblks = 0;
10220 	diskaddr_t	label_cap;
10221 
10222 	/* Validate the open type */
10223 	if (otyp >= OTYPCNT) {
10224 		return (EINVAL);
10225 	}
10226 
10227 	dev = *dev_p;
10228 	instance = SDUNIT(dev);
10229 	mutex_enter(&sd_detach_mutex);
10230 
10231 	/*
10232 	 * Fail the open if there is no softstate for the instance, or
10233 	 * if another thread somewhere is trying to detach the instance.
10234 	 */
10235 	if (((un = ddi_get_soft_state(sd_state, instance)) == NULL) ||
10236 	    (un->un_detach_count != 0)) {
10237 		mutex_exit(&sd_detach_mutex);
10238 		/*
10239 		 * The probe cache only needs to be cleared when open (9e) fails
10240 		 * with ENXIO (4238046).
10241 		 */
10242 		/*
10243 		 * un-conditionally clearing probe cache is ok with
10244 		 * separate sd/ssd binaries
10245 		 * x86 platform can be an issue with both parallel
10246 		 * and fibre in 1 binary
10247 		 */
10248 		sd_scsi_clear_probe_cache();
10249 		return (ENXIO);
10250 	}
10251 
10252 	/*
10253 	 * The un_layer_count is to prevent another thread in specfs from
10254 	 * trying to detach the instance, which can happen when we are
10255 	 * called from a higher-layer driver instead of thru specfs.
10256 	 * This will not be needed when DDI provides a layered driver
10257 	 * interface that allows specfs to know that an instance is in
10258 	 * use by a layered driver & should not be detached.
10259 	 *
10260 	 * Note: the semantics for layered driver opens are exactly one
10261 	 * close for every open.
10262 	 */
10263 	if (otyp == OTYP_LYR) {
10264 		un->un_layer_count++;
10265 	}
10266 
10267 	/*
10268 	 * Keep a count of the current # of opens in progress. This is because
10269 	 * some layered drivers try to call us as a regular open. This can
10270 	 * cause problems that we cannot prevent, however by keeping this count
10271 	 * we can at least keep our open and detach routines from racing against
10272 	 * each other under such conditions.
10273 	 */
10274 	un->un_opens_in_progress++;
10275 	mutex_exit(&sd_detach_mutex);
10276 
10277 	nodelay  = (flag & (FNDELAY | FNONBLOCK));
10278 	part	 = SDPART(dev);
10279 	partmask = 1 << part;
10280 
10281 	/*
10282 	 * We use a semaphore here in order to serialize
10283 	 * open and close requests on the device.
10284 	 */
10285 	sema_p(&un->un_semoclose);
10286 
10287 	mutex_enter(SD_MUTEX(un));
10288 
10289 	/*
10290 	 * All device accesses go thru sdstrategy() where we check
10291 	 * on suspend status but there could be a scsi_poll command,
10292 	 * which bypasses sdstrategy(), so we need to check pm
10293 	 * status.
10294 	 */
10295 
10296 	if (!nodelay) {
10297 		while ((un->un_state == SD_STATE_SUSPENDED) ||
10298 		    (un->un_state == SD_STATE_PM_CHANGING)) {
10299 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
10300 		}
10301 
10302 		mutex_exit(SD_MUTEX(un));
10303 		if (sd_pm_entry(un) != DDI_SUCCESS) {
10304 			rval = EIO;
10305 			SD_ERROR(SD_LOG_OPEN_CLOSE, un,
10306 			    "sdopen: sd_pm_entry failed\n");
10307 			goto open_failed_with_pm;
10308 		}
10309 		mutex_enter(SD_MUTEX(un));
10310 	}
10311 
10312 	/* check for previous exclusive open */
10313 	SD_TRACE(SD_LOG_OPEN_CLOSE, un, "sdopen: un=%p\n", (void *)un);
10314 	SD_TRACE(SD_LOG_OPEN_CLOSE, un,
10315 	    "sdopen: exclopen=%x, flag=%x, regopen=%x\n",
10316 	    un->un_exclopen, flag, un->un_ocmap.regopen[otyp]);
10317 
10318 	if (un->un_exclopen & (partmask)) {
10319 		goto excl_open_fail;
10320 	}
10321 
10322 	if (flag & FEXCL) {
10323 		int i;
10324 		if (un->un_ocmap.lyropen[part]) {
10325 			goto excl_open_fail;
10326 		}
10327 		for (i = 0; i < (OTYPCNT - 1); i++) {
10328 			if (un->un_ocmap.regopen[i] & (partmask)) {
10329 				goto excl_open_fail;
10330 			}
10331 		}
10332 	}
10333 
10334 	/*
10335 	 * Check the write permission if this is a removable media device,
10336 	 * NDELAY has not been set, and writable permission is requested.
10337 	 *
10338 	 * Note: If NDELAY was set and this is write-protected media the WRITE
10339 	 * attempt will fail with EIO as part of the I/O processing. This is a
10340 	 * more permissive implementation that allows the open to succeed and
10341 	 * WRITE attempts to fail when appropriate.
10342 	 */
10343 	if (un->un_f_chk_wp_open) {
10344 		if ((flag & FWRITE) && (!nodelay)) {
10345 			mutex_exit(SD_MUTEX(un));
10346 			/*
10347 			 * Defer the check for write permission on writable
10348 			 * DVD drive till sdstrategy and will not fail open even
10349 			 * if FWRITE is set as the device can be writable
10350 			 * depending upon the media and the media can change
10351 			 * after the call to open().
10352 			 */
10353 			if (un->un_f_dvdram_writable_device == FALSE) {
10354 				if (ISCD(un) || sr_check_wp(dev)) {
10355 				rval = EROFS;
10356 				mutex_enter(SD_MUTEX(un));
10357 				SD_ERROR(SD_LOG_OPEN_CLOSE, un, "sdopen: "
10358 				    "write to cd or write protected media\n");
10359 				goto open_fail;
10360 				}
10361 			}
10362 			mutex_enter(SD_MUTEX(un));
10363 		}
10364 	}
10365 
10366 	/*
10367 	 * If opening in NDELAY/NONBLOCK mode, just return.
10368 	 * Check if disk is ready and has a valid geometry later.
10369 	 */
10370 	if (!nodelay) {
10371 		sd_ssc_t	*ssc;
10372 
10373 		mutex_exit(SD_MUTEX(un));
10374 		ssc = sd_ssc_init(un);
10375 		rval = sd_ready_and_valid(ssc, part);
10376 		sd_ssc_fini(ssc);
10377 		mutex_enter(SD_MUTEX(un));
10378 		/*
10379 		 * Fail if device is not ready or if the number of disk
10380 		 * blocks is zero or negative for non CD devices.
10381 		 */
10382 
10383 		nblks = 0;
10384 
10385 		if (rval == SD_READY_VALID && (!ISCD(un))) {
10386 			/* if cmlb_partinfo fails, nblks remains 0 */
10387 			mutex_exit(SD_MUTEX(un));
10388 			(void) cmlb_partinfo(un->un_cmlbhandle, part, &nblks,
10389 			    NULL, NULL, NULL, (void *)SD_PATH_DIRECT);
10390 			mutex_enter(SD_MUTEX(un));
10391 		}
10392 
10393 		if ((rval != SD_READY_VALID) ||
10394 		    (!ISCD(un) && nblks <= 0)) {
10395 			rval = un->un_f_has_removable_media ? ENXIO : EIO;
10396 			SD_ERROR(SD_LOG_OPEN_CLOSE, un, "sdopen: "
10397 			    "device not ready or invalid disk block value\n");
10398 			goto open_fail;
10399 		}
10400 #if defined(__i386) || defined(__amd64)
10401 	} else {
10402 		uchar_t *cp;
10403 		/*
10404 		 * x86 requires special nodelay handling, so that p0 is
10405 		 * always defined and accessible.
10406 		 * Invalidate geometry only if device is not already open.
10407 		 */
10408 		cp = &un->un_ocmap.chkd[0];
10409 		while (cp < &un->un_ocmap.chkd[OCSIZE]) {
10410 			if (*cp != (uchar_t)0) {
10411 				break;
10412 			}
10413 			cp++;
10414 		}
10415 		if (cp == &un->un_ocmap.chkd[OCSIZE]) {
10416 			mutex_exit(SD_MUTEX(un));
10417 			cmlb_invalidate(un->un_cmlbhandle,
10418 			    (void *)SD_PATH_DIRECT);
10419 			mutex_enter(SD_MUTEX(un));
10420 		}
10421 
10422 #endif
10423 	}
10424 
10425 	if (otyp == OTYP_LYR) {
10426 		un->un_ocmap.lyropen[part]++;
10427 	} else {
10428 		un->un_ocmap.regopen[otyp] |= partmask;
10429 	}
10430 
10431 	/* Set up open and exclusive open flags */
10432 	if (flag & FEXCL) {
10433 		un->un_exclopen |= (partmask);
10434 	}
10435 
10436 	/*
10437 	 * If the lun is EFI labeled and lun capacity is greater than the
10438 	 * capacity contained in the label, log a sys-event to notify the
10439 	 * interested module.
10440 	 * To avoid an infinite loop of logging sys-event, we only log the
10441 	 * event when the lun is not opened in NDELAY mode. The event handler
10442 	 * should open the lun in NDELAY mode.
10443 	 */
10444 	if (!nodelay) {
10445 		mutex_exit(SD_MUTEX(un));
10446 		if (cmlb_efi_label_capacity(un->un_cmlbhandle, &label_cap,
10447 		    (void*)SD_PATH_DIRECT) == 0) {
10448 			mutex_enter(SD_MUTEX(un));
10449 			if (un->un_f_blockcount_is_valid &&
10450 			    un->un_blockcount > label_cap &&
10451 			    un->un_f_expnevent == B_FALSE) {
10452 				un->un_f_expnevent = B_TRUE;
10453 				mutex_exit(SD_MUTEX(un));
10454 				sd_log_lun_expansion_event(un,
10455 				    (nodelay ? KM_NOSLEEP : KM_SLEEP));
10456 				mutex_enter(SD_MUTEX(un));
10457 			}
10458 		} else {
10459 			mutex_enter(SD_MUTEX(un));
10460 		}
10461 	}
10462 
10463 	SD_TRACE(SD_LOG_OPEN_CLOSE, un, "sdopen: "
10464 	    "open of part %d type %d\n", part, otyp);
10465 
10466 	mutex_exit(SD_MUTEX(un));
10467 	if (!nodelay) {
10468 		sd_pm_exit(un);
10469 	}
10470 
10471 	sema_v(&un->un_semoclose);
10472 
10473 	mutex_enter(&sd_detach_mutex);
10474 	un->un_opens_in_progress--;
10475 	mutex_exit(&sd_detach_mutex);
10476 
10477 	SD_TRACE(SD_LOG_OPEN_CLOSE, un, "sdopen: exit success\n");
10478 	return (DDI_SUCCESS);
10479 
10480 excl_open_fail:
10481 	SD_ERROR(SD_LOG_OPEN_CLOSE, un, "sdopen: fail exclusive open\n");
10482 	rval = EBUSY;
10483 
10484 open_fail:
10485 	mutex_exit(SD_MUTEX(un));
10486 
10487 	/*
10488 	 * On a failed open we must exit the pm management.
10489 	 */
10490 	if (!nodelay) {
10491 		sd_pm_exit(un);
10492 	}
10493 open_failed_with_pm:
10494 	sema_v(&un->un_semoclose);
10495 
10496 	mutex_enter(&sd_detach_mutex);
10497 	un->un_opens_in_progress--;
10498 	if (otyp == OTYP_LYR) {
10499 		un->un_layer_count--;
10500 	}
10501 	mutex_exit(&sd_detach_mutex);
10502 
10503 	return (rval);
10504 }
10505 
10506 
10507 /*
10508  *    Function: sdclose
10509  *
10510  * Description: Driver's close(9e) entry point function.
10511  *
10512  *   Arguments: dev    - device number
10513  *		flag   - file status flag, informational only
10514  *		otyp   - close type (OTYP_BLK, OTYP_CHR, OTYP_LYR)
10515  *		cred_p - user credential pointer
10516  *
10517  * Return Code: ENXIO
10518  *
10519  *     Context: Kernel thread context
10520  */
10521 /* ARGSUSED */
10522 static int
10523 sdclose(dev_t dev, int flag, int otyp, cred_t *cred_p)
10524 {
10525 	struct sd_lun	*un;
10526 	uchar_t		*cp;
10527 	int		part;
10528 	int		nodelay;
10529 	int		rval = 0;
10530 
10531 	/* Validate the open type */
10532 	if (otyp >= OTYPCNT) {
10533 		return (ENXIO);
10534 	}
10535 
10536 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
10537 		return (ENXIO);
10538 	}
10539 
10540 	part = SDPART(dev);
10541 	nodelay = flag & (FNDELAY | FNONBLOCK);
10542 
10543 	SD_TRACE(SD_LOG_OPEN_CLOSE, un,
10544 	    "sdclose: close of part %d type %d\n", part, otyp);
10545 
10546 	/*
10547 	 * We use a semaphore here in order to serialize
10548 	 * open and close requests on the device.
10549 	 */
10550 	sema_p(&un->un_semoclose);
10551 
10552 	mutex_enter(SD_MUTEX(un));
10553 
10554 	/* Don't proceed if power is being changed. */
10555 	while (un->un_state == SD_STATE_PM_CHANGING) {
10556 		cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
10557 	}
10558 
10559 	if (un->un_exclopen & (1 << part)) {
10560 		un->un_exclopen &= ~(1 << part);
10561 	}
10562 
10563 	/* Update the open partition map */
10564 	if (otyp == OTYP_LYR) {
10565 		un->un_ocmap.lyropen[part] -= 1;
10566 	} else {
10567 		un->un_ocmap.regopen[otyp] &= ~(1 << part);
10568 	}
10569 
10570 	cp = &un->un_ocmap.chkd[0];
10571 	while (cp < &un->un_ocmap.chkd[OCSIZE]) {
10572 		if (*cp != '\0') {
10573 			break;
10574 		}
10575 		cp++;
10576 	}
10577 
10578 	if (cp == &un->un_ocmap.chkd[OCSIZE]) {
10579 		SD_TRACE(SD_LOG_OPEN_CLOSE, un, "sdclose: last close\n");
10580 
10581 		/*
10582 		 * We avoid persistance upon the last close, and set
10583 		 * the throttle back to the maximum.
10584 		 */
10585 		un->un_throttle = un->un_saved_throttle;
10586 
10587 		if (un->un_state == SD_STATE_OFFLINE) {
10588 			if (un->un_f_is_fibre == FALSE) {
10589 				scsi_log(SD_DEVINFO(un), sd_label,
10590 				    CE_WARN, "offline\n");
10591 			}
10592 			mutex_exit(SD_MUTEX(un));
10593 			cmlb_invalidate(un->un_cmlbhandle,
10594 			    (void *)SD_PATH_DIRECT);
10595 			mutex_enter(SD_MUTEX(un));
10596 
10597 		} else {
10598 			/*
10599 			 * Flush any outstanding writes in NVRAM cache.
10600 			 * Note: SYNCHRONIZE CACHE is an optional SCSI-2
10601 			 * cmd, it may not work for non-Pluto devices.
10602 			 * SYNCHRONIZE CACHE is not required for removables,
10603 			 * except DVD-RAM drives.
10604 			 *
10605 			 * Also note: because SYNCHRONIZE CACHE is currently
10606 			 * the only command issued here that requires the
10607 			 * drive be powered up, only do the power up before
10608 			 * sending the Sync Cache command. If additional
10609 			 * commands are added which require a powered up
10610 			 * drive, the following sequence may have to change.
10611 			 *
10612 			 * And finally, note that parallel SCSI on SPARC
10613 			 * only issues a Sync Cache to DVD-RAM, a newly
10614 			 * supported device.
10615 			 */
10616 #if defined(__i386) || defined(__amd64)
10617 			if ((un->un_f_sync_cache_supported &&
10618 			    un->un_f_sync_cache_required) ||
10619 			    un->un_f_dvdram_writable_device == TRUE) {
10620 #else
10621 			if (un->un_f_dvdram_writable_device == TRUE) {
10622 #endif
10623 				mutex_exit(SD_MUTEX(un));
10624 				if (sd_pm_entry(un) == DDI_SUCCESS) {
10625 					rval =
10626 					    sd_send_scsi_SYNCHRONIZE_CACHE(un,
10627 					    NULL);
10628 					/* ignore error if not supported */
10629 					if (rval == ENOTSUP) {
10630 						rval = 0;
10631 					} else if (rval != 0) {
10632 						rval = EIO;
10633 					}
10634 					sd_pm_exit(un);
10635 				} else {
10636 					rval = EIO;
10637 				}
10638 				mutex_enter(SD_MUTEX(un));
10639 			}
10640 
10641 			/*
10642 			 * For devices which supports DOOR_LOCK, send an ALLOW
10643 			 * MEDIA REMOVAL command, but don't get upset if it
10644 			 * fails. We need to raise the power of the drive before
10645 			 * we can call sd_send_scsi_DOORLOCK()
10646 			 */
10647 			if (un->un_f_doorlock_supported) {
10648 				mutex_exit(SD_MUTEX(un));
10649 				if (sd_pm_entry(un) == DDI_SUCCESS) {
10650 					sd_ssc_t	*ssc;
10651 
10652 					ssc = sd_ssc_init(un);
10653 					rval = sd_send_scsi_DOORLOCK(ssc,
10654 					    SD_REMOVAL_ALLOW, SD_PATH_DIRECT);
10655 					if (rval != 0)
10656 						sd_ssc_assessment(ssc,
10657 						    SD_FMT_IGNORE);
10658 					sd_ssc_fini(ssc);
10659 
10660 					sd_pm_exit(un);
10661 					if (ISCD(un) && (rval != 0) &&
10662 					    (nodelay != 0)) {
10663 						rval = ENXIO;
10664 					}
10665 				} else {
10666 					rval = EIO;
10667 				}
10668 				mutex_enter(SD_MUTEX(un));
10669 			}
10670 
10671 			/*
10672 			 * If a device has removable media, invalidate all
10673 			 * parameters related to media, such as geometry,
10674 			 * blocksize, and blockcount.
10675 			 */
10676 			if (un->un_f_has_removable_media) {
10677 				sr_ejected(un);
10678 			}
10679 
10680 			/*
10681 			 * Destroy the cache (if it exists) which was
10682 			 * allocated for the write maps since this is
10683 			 * the last close for this media.
10684 			 */
10685 			if (un->un_wm_cache) {
10686 				/*
10687 				 * Check if there are pending commands.
10688 				 * and if there are give a warning and
10689 				 * do not destroy the cache.
10690 				 */
10691 				if (un->un_ncmds_in_driver > 0) {
10692 					scsi_log(SD_DEVINFO(un),
10693 					    sd_label, CE_WARN,
10694 					    "Unable to clean up memory "
10695 					    "because of pending I/O\n");
10696 				} else {
10697 					kmem_cache_destroy(
10698 					    un->un_wm_cache);
10699 					un->un_wm_cache = NULL;
10700 				}
10701 			}
10702 		}
10703 	}
10704 
10705 	mutex_exit(SD_MUTEX(un));
10706 	sema_v(&un->un_semoclose);
10707 
10708 	if (otyp == OTYP_LYR) {
10709 		mutex_enter(&sd_detach_mutex);
10710 		/*
10711 		 * The detach routine may run when the layer count
10712 		 * drops to zero.
10713 		 */
10714 		un->un_layer_count--;
10715 		mutex_exit(&sd_detach_mutex);
10716 	}
10717 
10718 	return (rval);
10719 }
10720 
10721 
10722 /*
10723  *    Function: sd_ready_and_valid
10724  *
10725  * Description: Test if device is ready and has a valid geometry.
10726  *
10727  *   Arguments: ssc - sd_ssc_t will contain un
10728  *		un  - driver soft state (unit) structure
10729  *
10730  * Return Code: SD_READY_VALID		ready and valid label
10731  *		SD_NOT_READY_VALID	not ready, no label
10732  *		SD_RESERVED_BY_OTHERS	reservation conflict
10733  *
10734  *     Context: Never called at interrupt context.
10735  */
10736 
10737 static int
10738 sd_ready_and_valid(sd_ssc_t *ssc, int part)
10739 {
10740 	struct sd_errstats	*stp;
10741 	uint64_t		capacity;
10742 	uint_t			lbasize;
10743 	int			rval = SD_READY_VALID;
10744 	char			name_str[48];
10745 	boolean_t		is_valid;
10746 	struct sd_lun		*un;
10747 	int			status;
10748 
10749 	ASSERT(ssc != NULL);
10750 	un = ssc->ssc_un;
10751 	ASSERT(un != NULL);
10752 	ASSERT(!mutex_owned(SD_MUTEX(un)));
10753 
10754 	mutex_enter(SD_MUTEX(un));
10755 	/*
10756 	 * If a device has removable media, we must check if media is
10757 	 * ready when checking if this device is ready and valid.
10758 	 */
10759 	if (un->un_f_has_removable_media) {
10760 		mutex_exit(SD_MUTEX(un));
10761 		status = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
10762 
10763 		if (status != 0) {
10764 			rval = SD_NOT_READY_VALID;
10765 			mutex_enter(SD_MUTEX(un));
10766 
10767 			/* Ignore all failed status for removalbe media */
10768 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10769 
10770 			goto done;
10771 		}
10772 
10773 		is_valid = SD_IS_VALID_LABEL(un);
10774 		mutex_enter(SD_MUTEX(un));
10775 		if (!is_valid ||
10776 		    (un->un_f_blockcount_is_valid == FALSE) ||
10777 		    (un->un_f_tgt_blocksize_is_valid == FALSE)) {
10778 
10779 			/* capacity has to be read every open. */
10780 			mutex_exit(SD_MUTEX(un));
10781 			status = sd_send_scsi_READ_CAPACITY(ssc, &capacity,
10782 			    &lbasize, SD_PATH_DIRECT);
10783 
10784 			if (status != 0) {
10785 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10786 
10787 				cmlb_invalidate(un->un_cmlbhandle,
10788 				    (void *)SD_PATH_DIRECT);
10789 				mutex_enter(SD_MUTEX(un));
10790 				rval = SD_NOT_READY_VALID;
10791 
10792 				goto done;
10793 			} else {
10794 				mutex_enter(SD_MUTEX(un));
10795 				sd_update_block_info(un, lbasize, capacity);
10796 			}
10797 		}
10798 
10799 		/*
10800 		 * Check if the media in the device is writable or not.
10801 		 */
10802 		if (!is_valid && ISCD(un)) {
10803 			sd_check_for_writable_cd(ssc, SD_PATH_DIRECT);
10804 		}
10805 
10806 	} else {
10807 		/*
10808 		 * Do a test unit ready to clear any unit attention from non-cd
10809 		 * devices.
10810 		 */
10811 		mutex_exit(SD_MUTEX(un));
10812 
10813 		status = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
10814 		if (status != 0) {
10815 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10816 		}
10817 
10818 		mutex_enter(SD_MUTEX(un));
10819 	}
10820 
10821 
10822 	/*
10823 	 * If this is a non 512 block device, allocate space for
10824 	 * the wmap cache. This is being done here since every time
10825 	 * a media is changed this routine will be called and the
10826 	 * block size is a function of media rather than device.
10827 	 */
10828 	if (((un->un_f_rmw_type != SD_RMW_TYPE_RETURN_ERROR ||
10829 	    un->un_f_non_devbsize_supported) &&
10830 	    un->un_tgt_blocksize != DEV_BSIZE) ||
10831 	    un->un_f_enable_rmw) {
10832 		if (!(un->un_wm_cache)) {
10833 			(void) snprintf(name_str, sizeof (name_str),
10834 			    "%s%d_cache",
10835 			    ddi_driver_name(SD_DEVINFO(un)),
10836 			    ddi_get_instance(SD_DEVINFO(un)));
10837 			un->un_wm_cache = kmem_cache_create(
10838 			    name_str, sizeof (struct sd_w_map),
10839 			    8, sd_wm_cache_constructor,
10840 			    sd_wm_cache_destructor, NULL,
10841 			    (void *)un, NULL, 0);
10842 			if (!(un->un_wm_cache)) {
10843 				rval = ENOMEM;
10844 				goto done;
10845 			}
10846 		}
10847 	}
10848 
10849 	if (un->un_state == SD_STATE_NORMAL) {
10850 		/*
10851 		 * If the target is not yet ready here (defined by a TUR
10852 		 * failure), invalidate the geometry and print an 'offline'
10853 		 * message. This is a legacy message, as the state of the
10854 		 * target is not actually changed to SD_STATE_OFFLINE.
10855 		 *
10856 		 * If the TUR fails for EACCES (Reservation Conflict),
10857 		 * SD_RESERVED_BY_OTHERS will be returned to indicate
10858 		 * reservation conflict. If the TUR fails for other
10859 		 * reasons, SD_NOT_READY_VALID will be returned.
10860 		 */
10861 		int err;
10862 
10863 		mutex_exit(SD_MUTEX(un));
10864 		err = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
10865 		mutex_enter(SD_MUTEX(un));
10866 
10867 		if (err != 0) {
10868 			mutex_exit(SD_MUTEX(un));
10869 			cmlb_invalidate(un->un_cmlbhandle,
10870 			    (void *)SD_PATH_DIRECT);
10871 			mutex_enter(SD_MUTEX(un));
10872 			if (err == EACCES) {
10873 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
10874 				    "reservation conflict\n");
10875 				rval = SD_RESERVED_BY_OTHERS;
10876 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10877 			} else {
10878 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
10879 				    "drive offline\n");
10880 				rval = SD_NOT_READY_VALID;
10881 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
10882 			}
10883 			goto done;
10884 		}
10885 	}
10886 
10887 	if (un->un_f_format_in_progress == FALSE) {
10888 		mutex_exit(SD_MUTEX(un));
10889 
10890 		(void) cmlb_validate(un->un_cmlbhandle, 0,
10891 		    (void *)SD_PATH_DIRECT);
10892 		if (cmlb_partinfo(un->un_cmlbhandle, part, NULL, NULL, NULL,
10893 		    NULL, (void *) SD_PATH_DIRECT) != 0) {
10894 			rval = SD_NOT_READY_VALID;
10895 			mutex_enter(SD_MUTEX(un));
10896 
10897 			goto done;
10898 		}
10899 		if (un->un_f_pkstats_enabled) {
10900 			sd_set_pstats(un);
10901 			SD_TRACE(SD_LOG_IO_PARTITION, un,
10902 			    "sd_ready_and_valid: un:0x%p pstats created and "
10903 			    "set\n", un);
10904 		}
10905 		mutex_enter(SD_MUTEX(un));
10906 	}
10907 
10908 	/*
10909 	 * If this device supports DOOR_LOCK command, try and send
10910 	 * this command to PREVENT MEDIA REMOVAL, but don't get upset
10911 	 * if it fails. For a CD, however, it is an error
10912 	 */
10913 	if (un->un_f_doorlock_supported) {
10914 		mutex_exit(SD_MUTEX(un));
10915 		status = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_PREVENT,
10916 		    SD_PATH_DIRECT);
10917 
10918 		if ((status != 0) && ISCD(un)) {
10919 			rval = SD_NOT_READY_VALID;
10920 			mutex_enter(SD_MUTEX(un));
10921 
10922 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10923 
10924 			goto done;
10925 		} else if (status != 0)
10926 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10927 		mutex_enter(SD_MUTEX(un));
10928 	}
10929 
10930 	/* The state has changed, inform the media watch routines */
10931 	un->un_mediastate = DKIO_INSERTED;
10932 	cv_broadcast(&un->un_state_cv);
10933 	rval = SD_READY_VALID;
10934 
10935 done:
10936 
10937 	/*
10938 	 * Initialize the capacity kstat value, if no media previously
10939 	 * (capacity kstat is 0) and a media has been inserted
10940 	 * (un_blockcount > 0).
10941 	 */
10942 	if (un->un_errstats != NULL) {
10943 		stp = (struct sd_errstats *)un->un_errstats->ks_data;
10944 		if ((stp->sd_capacity.value.ui64 == 0) &&
10945 		    (un->un_f_blockcount_is_valid == TRUE)) {
10946 			stp->sd_capacity.value.ui64 =
10947 			    (uint64_t)((uint64_t)un->un_blockcount *
10948 			    un->un_sys_blocksize);
10949 		}
10950 	}
10951 
10952 	mutex_exit(SD_MUTEX(un));
10953 	return (rval);
10954 }
10955 
10956 
10957 /*
10958  *    Function: sdmin
10959  *
10960  * Description: Routine to limit the size of a data transfer. Used in
10961  *		conjunction with physio(9F).
10962  *
10963  *   Arguments: bp - pointer to the indicated buf(9S) struct.
10964  *
10965  *     Context: Kernel thread context.
10966  */
10967 
10968 static void
10969 sdmin(struct buf *bp)
10970 {
10971 	struct sd_lun	*un;
10972 	int		instance;
10973 
10974 	instance = SDUNIT(bp->b_edev);
10975 
10976 	un = ddi_get_soft_state(sd_state, instance);
10977 	ASSERT(un != NULL);
10978 
10979 	/*
10980 	 * We depend on buf breakup to restrict
10981 	 * IO size if it is enabled.
10982 	 */
10983 	if (un->un_buf_breakup_supported) {
10984 		return;
10985 	}
10986 
10987 	if (bp->b_bcount > un->un_max_xfer_size) {
10988 		bp->b_bcount = un->un_max_xfer_size;
10989 	}
10990 }
10991 
10992 
10993 /*
10994  *    Function: sdread
10995  *
10996  * Description: Driver's read(9e) entry point function.
10997  *
10998  *   Arguments: dev   - device number
10999  *		uio   - structure pointer describing where data is to be stored
11000  *			in user's space
11001  *		cred_p  - user credential pointer
11002  *
11003  * Return Code: ENXIO
11004  *		EIO
11005  *		EINVAL
11006  *		value returned by physio
11007  *
11008  *     Context: Kernel thread context.
11009  */
11010 /* ARGSUSED */
11011 static int
11012 sdread(dev_t dev, struct uio *uio, cred_t *cred_p)
11013 {
11014 	struct sd_lun	*un = NULL;
11015 	int		secmask;
11016 	int		err = 0;
11017 	sd_ssc_t	*ssc;
11018 
11019 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
11020 		return (ENXIO);
11021 	}
11022 
11023 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11024 
11025 
11026 	if (!SD_IS_VALID_LABEL(un) && !ISCD(un)) {
11027 		mutex_enter(SD_MUTEX(un));
11028 		/*
11029 		 * Because the call to sd_ready_and_valid will issue I/O we
11030 		 * must wait here if either the device is suspended or
11031 		 * if it's power level is changing.
11032 		 */
11033 		while ((un->un_state == SD_STATE_SUSPENDED) ||
11034 		    (un->un_state == SD_STATE_PM_CHANGING)) {
11035 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
11036 		}
11037 		un->un_ncmds_in_driver++;
11038 		mutex_exit(SD_MUTEX(un));
11039 
11040 		/* Initialize sd_ssc_t for internal uscsi commands */
11041 		ssc = sd_ssc_init(un);
11042 		if ((sd_ready_and_valid(ssc, SDPART(dev))) != SD_READY_VALID) {
11043 			err = EIO;
11044 		} else {
11045 			err = 0;
11046 		}
11047 		sd_ssc_fini(ssc);
11048 
11049 		mutex_enter(SD_MUTEX(un));
11050 		un->un_ncmds_in_driver--;
11051 		ASSERT(un->un_ncmds_in_driver >= 0);
11052 		mutex_exit(SD_MUTEX(un));
11053 		if (err != 0)
11054 			return (err);
11055 	}
11056 
11057 	/*
11058 	 * Read requests are restricted to multiples of the system block size.
11059 	 */
11060 	if (un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR &&
11061 	    !un->un_f_enable_rmw)
11062 		secmask = un->un_tgt_blocksize - 1;
11063 	else
11064 		secmask = DEV_BSIZE - 1;
11065 
11066 	if (uio->uio_loffset & ((offset_t)(secmask))) {
11067 		SD_ERROR(SD_LOG_READ_WRITE, un,
11068 		    "sdread: file offset not modulo %d\n",
11069 		    secmask + 1);
11070 		err = EINVAL;
11071 	} else if (uio->uio_iov->iov_len & (secmask)) {
11072 		SD_ERROR(SD_LOG_READ_WRITE, un,
11073 		    "sdread: transfer length not modulo %d\n",
11074 		    secmask + 1);
11075 		err = EINVAL;
11076 	} else {
11077 		err = physio(sdstrategy, NULL, dev, B_READ, sdmin, uio);
11078 	}
11079 
11080 	return (err);
11081 }
11082 
11083 
11084 /*
11085  *    Function: sdwrite
11086  *
11087  * Description: Driver's write(9e) entry point function.
11088  *
11089  *   Arguments: dev   - device number
11090  *		uio   - structure pointer describing where data is stored in
11091  *			user's space
11092  *		cred_p  - user credential pointer
11093  *
11094  * Return Code: ENXIO
11095  *		EIO
11096  *		EINVAL
11097  *		value returned by physio
11098  *
11099  *     Context: Kernel thread context.
11100  */
11101 /* ARGSUSED */
11102 static int
11103 sdwrite(dev_t dev, struct uio *uio, cred_t *cred_p)
11104 {
11105 	struct sd_lun	*un = NULL;
11106 	int		secmask;
11107 	int		err = 0;
11108 	sd_ssc_t	*ssc;
11109 
11110 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
11111 		return (ENXIO);
11112 	}
11113 
11114 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11115 
11116 	if (!SD_IS_VALID_LABEL(un) && !ISCD(un)) {
11117 		mutex_enter(SD_MUTEX(un));
11118 		/*
11119 		 * Because the call to sd_ready_and_valid will issue I/O we
11120 		 * must wait here if either the device is suspended or
11121 		 * if it's power level is changing.
11122 		 */
11123 		while ((un->un_state == SD_STATE_SUSPENDED) ||
11124 		    (un->un_state == SD_STATE_PM_CHANGING)) {
11125 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
11126 		}
11127 		un->un_ncmds_in_driver++;
11128 		mutex_exit(SD_MUTEX(un));
11129 
11130 		/* Initialize sd_ssc_t for internal uscsi commands */
11131 		ssc = sd_ssc_init(un);
11132 		if ((sd_ready_and_valid(ssc, SDPART(dev))) != SD_READY_VALID) {
11133 			err = EIO;
11134 		} else {
11135 			err = 0;
11136 		}
11137 		sd_ssc_fini(ssc);
11138 
11139 		mutex_enter(SD_MUTEX(un));
11140 		un->un_ncmds_in_driver--;
11141 		ASSERT(un->un_ncmds_in_driver >= 0);
11142 		mutex_exit(SD_MUTEX(un));
11143 		if (err != 0)
11144 			return (err);
11145 	}
11146 
11147 	/*
11148 	 * Write requests are restricted to multiples of the system block size.
11149 	 */
11150 	if (un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR &&
11151 	    !un->un_f_enable_rmw)
11152 		secmask = un->un_tgt_blocksize - 1;
11153 	else
11154 		secmask = DEV_BSIZE - 1;
11155 
11156 	if (uio->uio_loffset & ((offset_t)(secmask))) {
11157 		SD_ERROR(SD_LOG_READ_WRITE, un,
11158 		    "sdwrite: file offset not modulo %d\n",
11159 		    secmask + 1);
11160 		err = EINVAL;
11161 	} else if (uio->uio_iov->iov_len & (secmask)) {
11162 		SD_ERROR(SD_LOG_READ_WRITE, un,
11163 		    "sdwrite: transfer length not modulo %d\n",
11164 		    secmask + 1);
11165 		err = EINVAL;
11166 	} else {
11167 		err = physio(sdstrategy, NULL, dev, B_WRITE, sdmin, uio);
11168 	}
11169 
11170 	return (err);
11171 }
11172 
11173 
11174 /*
11175  *    Function: sdaread
11176  *
11177  * Description: Driver's aread(9e) entry point function.
11178  *
11179  *   Arguments: dev   - device number
11180  *		aio   - structure pointer describing where data is to be stored
11181  *		cred_p  - user credential pointer
11182  *
11183  * Return Code: ENXIO
11184  *		EIO
11185  *		EINVAL
11186  *		value returned by aphysio
11187  *
11188  *     Context: Kernel thread context.
11189  */
11190 /* ARGSUSED */
11191 static int
11192 sdaread(dev_t dev, struct aio_req *aio, cred_t *cred_p)
11193 {
11194 	struct sd_lun	*un = NULL;
11195 	struct uio	*uio = aio->aio_uio;
11196 	int		secmask;
11197 	int		err = 0;
11198 	sd_ssc_t	*ssc;
11199 
11200 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
11201 		return (ENXIO);
11202 	}
11203 
11204 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11205 
11206 	if (!SD_IS_VALID_LABEL(un) && !ISCD(un)) {
11207 		mutex_enter(SD_MUTEX(un));
11208 		/*
11209 		 * Because the call to sd_ready_and_valid will issue I/O we
11210 		 * must wait here if either the device is suspended or
11211 		 * if it's power level is changing.
11212 		 */
11213 		while ((un->un_state == SD_STATE_SUSPENDED) ||
11214 		    (un->un_state == SD_STATE_PM_CHANGING)) {
11215 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
11216 		}
11217 		un->un_ncmds_in_driver++;
11218 		mutex_exit(SD_MUTEX(un));
11219 
11220 		/* Initialize sd_ssc_t for internal uscsi commands */
11221 		ssc = sd_ssc_init(un);
11222 		if ((sd_ready_and_valid(ssc, SDPART(dev))) != SD_READY_VALID) {
11223 			err = EIO;
11224 		} else {
11225 			err = 0;
11226 		}
11227 		sd_ssc_fini(ssc);
11228 
11229 		mutex_enter(SD_MUTEX(un));
11230 		un->un_ncmds_in_driver--;
11231 		ASSERT(un->un_ncmds_in_driver >= 0);
11232 		mutex_exit(SD_MUTEX(un));
11233 		if (err != 0)
11234 			return (err);
11235 	}
11236 
11237 	/*
11238 	 * Read requests are restricted to multiples of the system block size.
11239 	 */
11240 	if (un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR &&
11241 	    !un->un_f_enable_rmw)
11242 		secmask = un->un_tgt_blocksize - 1;
11243 	else
11244 		secmask = DEV_BSIZE - 1;
11245 
11246 	if (uio->uio_loffset & ((offset_t)(secmask))) {
11247 		SD_ERROR(SD_LOG_READ_WRITE, un,
11248 		    "sdaread: file offset not modulo %d\n",
11249 		    secmask + 1);
11250 		err = EINVAL;
11251 	} else if (uio->uio_iov->iov_len & (secmask)) {
11252 		SD_ERROR(SD_LOG_READ_WRITE, un,
11253 		    "sdaread: transfer length not modulo %d\n",
11254 		    secmask + 1);
11255 		err = EINVAL;
11256 	} else {
11257 		err = aphysio(sdstrategy, anocancel, dev, B_READ, sdmin, aio);
11258 	}
11259 
11260 	return (err);
11261 }
11262 
11263 
11264 /*
11265  *    Function: sdawrite
11266  *
11267  * Description: Driver's awrite(9e) entry point function.
11268  *
11269  *   Arguments: dev   - device number
11270  *		aio   - structure pointer describing where data is stored
11271  *		cred_p  - user credential pointer
11272  *
11273  * Return Code: ENXIO
11274  *		EIO
11275  *		EINVAL
11276  *		value returned by aphysio
11277  *
11278  *     Context: Kernel thread context.
11279  */
11280 /* ARGSUSED */
11281 static int
11282 sdawrite(dev_t dev, struct aio_req *aio, cred_t *cred_p)
11283 {
11284 	struct sd_lun	*un = NULL;
11285 	struct uio	*uio = aio->aio_uio;
11286 	int		secmask;
11287 	int		err = 0;
11288 	sd_ssc_t	*ssc;
11289 
11290 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
11291 		return (ENXIO);
11292 	}
11293 
11294 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11295 
11296 	if (!SD_IS_VALID_LABEL(un) && !ISCD(un)) {
11297 		mutex_enter(SD_MUTEX(un));
11298 		/*
11299 		 * Because the call to sd_ready_and_valid will issue I/O we
11300 		 * must wait here if either the device is suspended or
11301 		 * if it's power level is changing.
11302 		 */
11303 		while ((un->un_state == SD_STATE_SUSPENDED) ||
11304 		    (un->un_state == SD_STATE_PM_CHANGING)) {
11305 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
11306 		}
11307 		un->un_ncmds_in_driver++;
11308 		mutex_exit(SD_MUTEX(un));
11309 
11310 		/* Initialize sd_ssc_t for internal uscsi commands */
11311 		ssc = sd_ssc_init(un);
11312 		if ((sd_ready_and_valid(ssc, SDPART(dev))) != SD_READY_VALID) {
11313 			err = EIO;
11314 		} else {
11315 			err = 0;
11316 		}
11317 		sd_ssc_fini(ssc);
11318 
11319 		mutex_enter(SD_MUTEX(un));
11320 		un->un_ncmds_in_driver--;
11321 		ASSERT(un->un_ncmds_in_driver >= 0);
11322 		mutex_exit(SD_MUTEX(un));
11323 		if (err != 0)
11324 			return (err);
11325 	}
11326 
11327 	/*
11328 	 * Write requests are restricted to multiples of the system block size.
11329 	 */
11330 	if (un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR &&
11331 	    !un->un_f_enable_rmw)
11332 		secmask = un->un_tgt_blocksize - 1;
11333 	else
11334 		secmask = DEV_BSIZE - 1;
11335 
11336 	if (uio->uio_loffset & ((offset_t)(secmask))) {
11337 		SD_ERROR(SD_LOG_READ_WRITE, un,
11338 		    "sdawrite: file offset not modulo %d\n",
11339 		    secmask + 1);
11340 		err = EINVAL;
11341 	} else if (uio->uio_iov->iov_len & (secmask)) {
11342 		SD_ERROR(SD_LOG_READ_WRITE, un,
11343 		    "sdawrite: transfer length not modulo %d\n",
11344 		    secmask + 1);
11345 		err = EINVAL;
11346 	} else {
11347 		err = aphysio(sdstrategy, anocancel, dev, B_WRITE, sdmin, aio);
11348 	}
11349 
11350 	return (err);
11351 }
11352 
11353 
11354 
11355 
11356 
11357 /*
11358  * Driver IO processing follows the following sequence:
11359  *
11360  *     sdioctl(9E)     sdstrategy(9E)         biodone(9F)
11361  *         |                |                     ^
11362  *         v                v                     |
11363  * sd_send_scsi_cmd()  ddi_xbuf_qstrategy()       +-------------------+
11364  *         |                |                     |                   |
11365  *         v                |                     |                   |
11366  * sd_uscsi_strategy() sd_xbuf_strategy()   sd_buf_iodone()   sd_uscsi_iodone()
11367  *         |                |                     ^                   ^
11368  *         v                v                     |                   |
11369  * SD_BEGIN_IOSTART()  SD_BEGIN_IOSTART()         |                   |
11370  *         |                |                     |                   |
11371  *     +---+                |                     +------------+      +-------+
11372  *     |                    |                                  |              |
11373  *     |   SD_NEXT_IOSTART()|                  SD_NEXT_IODONE()|              |
11374  *     |                    v                                  |              |
11375  *     |         sd_mapblockaddr_iostart()           sd_mapblockaddr_iodone() |
11376  *     |                    |                                  ^              |
11377  *     |   SD_NEXT_IOSTART()|                  SD_NEXT_IODONE()|              |
11378  *     |                    v                                  |              |
11379  *     |         sd_mapblocksize_iostart()           sd_mapblocksize_iodone() |
11380  *     |                    |                                  ^              |
11381  *     |   SD_NEXT_IOSTART()|                  SD_NEXT_IODONE()|              |
11382  *     |                    v                                  |              |
11383  *     |           sd_checksum_iostart()               sd_checksum_iodone()   |
11384  *     |                    |                                  ^              |
11385  *     +-> SD_NEXT_IOSTART()|                  SD_NEXT_IODONE()+------------->+
11386  *     |                    v                                  |              |
11387  *     |              sd_pm_iostart()                     sd_pm_iodone()      |
11388  *     |                    |                                  ^              |
11389  *     |                    |                                  |              |
11390  *     +-> SD_NEXT_IOSTART()|               SD_BEGIN_IODONE()--+--------------+
11391  *                          |                           ^
11392  *                          v                           |
11393  *                   sd_core_iostart()                  |
11394  *                          |                           |
11395  *                          |                           +------>(*destroypkt)()
11396  *                          +-> sd_start_cmds() <-+     |           |
11397  *                          |                     |     |           v
11398  *                          |                     |     |  scsi_destroy_pkt(9F)
11399  *                          |                     |     |
11400  *                          +->(*initpkt)()       +- sdintr()
11401  *                          |  |                        |  |
11402  *                          |  +-> scsi_init_pkt(9F)    |  +-> sd_handle_xxx()
11403  *                          |  +-> scsi_setup_cdb(9F)   |
11404  *                          |                           |
11405  *                          +--> scsi_transport(9F)     |
11406  *                                     |                |
11407  *                                     +----> SCSA ---->+
11408  *
11409  *
11410  * This code is based upon the following presumptions:
11411  *
11412  *   - iostart and iodone functions operate on buf(9S) structures. These
11413  *     functions perform the necessary operations on the buf(9S) and pass
11414  *     them along to the next function in the chain by using the macros
11415  *     SD_NEXT_IOSTART() (for iostart side functions) and SD_NEXT_IODONE()
11416  *     (for iodone side functions).
11417  *
11418  *   - The iostart side functions may sleep. The iodone side functions
11419  *     are called under interrupt context and may NOT sleep. Therefore
11420  *     iodone side functions also may not call iostart side functions.
11421  *     (NOTE: iostart side functions should NOT sleep for memory, as
11422  *     this could result in deadlock.)
11423  *
11424  *   - An iostart side function may call its corresponding iodone side
11425  *     function directly (if necessary).
11426  *
11427  *   - In the event of an error, an iostart side function can return a buf(9S)
11428  *     to its caller by calling SD_BEGIN_IODONE() (after setting B_ERROR and
11429  *     b_error in the usual way of course).
11430  *
11431  *   - The taskq mechanism may be used by the iodone side functions to dispatch
11432  *     requests to the iostart side functions.  The iostart side functions in
11433  *     this case would be called under the context of a taskq thread, so it's
11434  *     OK for them to block/sleep/spin in this case.
11435  *
11436  *   - iostart side functions may allocate "shadow" buf(9S) structs and
11437  *     pass them along to the next function in the chain.  The corresponding
11438  *     iodone side functions must coalesce the "shadow" bufs and return
11439  *     the "original" buf to the next higher layer.
11440  *
11441  *   - The b_private field of the buf(9S) struct holds a pointer to
11442  *     an sd_xbuf struct, which contains information needed to
11443  *     construct the scsi_pkt for the command.
11444  *
11445  *   - The SD_MUTEX(un) is NOT held across calls to the next layer. Each
11446  *     layer must acquire & release the SD_MUTEX(un) as needed.
11447  */
11448 
11449 
11450 /*
11451  * Create taskq for all targets in the system. This is created at
11452  * _init(9E) and destroyed at _fini(9E).
11453  *
11454  * Note: here we set the minalloc to a reasonably high number to ensure that
11455  * we will have an adequate supply of task entries available at interrupt time.
11456  * This is used in conjunction with the TASKQ_PREPOPULATE flag in
11457  * sd_create_taskq().  Since we do not want to sleep for allocations at
11458  * interrupt time, set maxalloc equal to minalloc. That way we will just fail
11459  * the command if we ever try to dispatch more than SD_TASKQ_MAXALLOC taskq
11460  * requests any one instant in time.
11461  */
11462 #define	SD_TASKQ_NUMTHREADS	8
11463 #define	SD_TASKQ_MINALLOC	256
11464 #define	SD_TASKQ_MAXALLOC	256
11465 
11466 static taskq_t	*sd_tq = NULL;
11467 _NOTE(SCHEME_PROTECTS_DATA("stable data", sd_tq))
11468 
11469 static int	sd_taskq_minalloc = SD_TASKQ_MINALLOC;
11470 static int	sd_taskq_maxalloc = SD_TASKQ_MAXALLOC;
11471 
11472 /*
11473  * The following task queue is being created for the write part of
11474  * read-modify-write of non-512 block size devices.
11475  * Limit the number of threads to 1 for now. This number has been chosen
11476  * considering the fact that it applies only to dvd ram drives/MO drives
11477  * currently. Performance for which is not main criteria at this stage.
11478  * Note: It needs to be explored if we can use a single taskq in future
11479  */
11480 #define	SD_WMR_TASKQ_NUMTHREADS	1
11481 static taskq_t	*sd_wmr_tq = NULL;
11482 _NOTE(SCHEME_PROTECTS_DATA("stable data", sd_wmr_tq))
11483 
11484 /*
11485  *    Function: sd_taskq_create
11486  *
11487  * Description: Create taskq thread(s) and preallocate task entries
11488  *
11489  * Return Code: Returns a pointer to the allocated taskq_t.
11490  *
11491  *     Context: Can sleep. Requires blockable context.
11492  *
11493  *       Notes: - The taskq() facility currently is NOT part of the DDI.
11494  *		  (definitely NOT recommeded for 3rd-party drivers!) :-)
11495  *		- taskq_create() will block for memory, also it will panic
11496  *		  if it cannot create the requested number of threads.
11497  *		- Currently taskq_create() creates threads that cannot be
11498  *		  swapped.
11499  *		- We use TASKQ_PREPOPULATE to ensure we have an adequate
11500  *		  supply of taskq entries at interrupt time (ie, so that we
11501  *		  do not have to sleep for memory)
11502  */
11503 
11504 static void
11505 sd_taskq_create(void)
11506 {
11507 	char	taskq_name[TASKQ_NAMELEN];
11508 
11509 	ASSERT(sd_tq == NULL);
11510 	ASSERT(sd_wmr_tq == NULL);
11511 
11512 	(void) snprintf(taskq_name, sizeof (taskq_name),
11513 	    "%s_drv_taskq", sd_label);
11514 	sd_tq = (taskq_create(taskq_name, SD_TASKQ_NUMTHREADS,
11515 	    (v.v_maxsyspri - 2), sd_taskq_minalloc, sd_taskq_maxalloc,
11516 	    TASKQ_PREPOPULATE));
11517 
11518 	(void) snprintf(taskq_name, sizeof (taskq_name),
11519 	    "%s_rmw_taskq", sd_label);
11520 	sd_wmr_tq = (taskq_create(taskq_name, SD_WMR_TASKQ_NUMTHREADS,
11521 	    (v.v_maxsyspri - 2), sd_taskq_minalloc, sd_taskq_maxalloc,
11522 	    TASKQ_PREPOPULATE));
11523 }
11524 
11525 
11526 /*
11527  *    Function: sd_taskq_delete
11528  *
11529  * Description: Complementary cleanup routine for sd_taskq_create().
11530  *
11531  *     Context: Kernel thread context.
11532  */
11533 
11534 static void
11535 sd_taskq_delete(void)
11536 {
11537 	ASSERT(sd_tq != NULL);
11538 	ASSERT(sd_wmr_tq != NULL);
11539 	taskq_destroy(sd_tq);
11540 	taskq_destroy(sd_wmr_tq);
11541 	sd_tq = NULL;
11542 	sd_wmr_tq = NULL;
11543 }
11544 
11545 
11546 /*
11547  *    Function: sdstrategy
11548  *
11549  * Description: Driver's strategy (9E) entry point function.
11550  *
11551  *   Arguments: bp - pointer to buf(9S)
11552  *
11553  * Return Code: Always returns zero
11554  *
11555  *     Context: Kernel thread context.
11556  */
11557 
11558 static int
11559 sdstrategy(struct buf *bp)
11560 {
11561 	struct sd_lun *un;
11562 
11563 	un = ddi_get_soft_state(sd_state, SD_GET_INSTANCE_FROM_BUF(bp));
11564 	if (un == NULL) {
11565 		bioerror(bp, EIO);
11566 		bp->b_resid = bp->b_bcount;
11567 		biodone(bp);
11568 		return (0);
11569 	}
11570 
11571 	/* As was done in the past, fail new cmds. if state is dumping. */
11572 	if (un->un_state == SD_STATE_DUMPING) {
11573 		bioerror(bp, ENXIO);
11574 		bp->b_resid = bp->b_bcount;
11575 		biodone(bp);
11576 		return (0);
11577 	}
11578 
11579 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11580 
11581 	/*
11582 	 * Commands may sneak in while we released the mutex in
11583 	 * DDI_SUSPEND, we should block new commands. However, old
11584 	 * commands that are still in the driver at this point should
11585 	 * still be allowed to drain.
11586 	 */
11587 	mutex_enter(SD_MUTEX(un));
11588 	/*
11589 	 * Must wait here if either the device is suspended or
11590 	 * if it's power level is changing.
11591 	 */
11592 	while ((un->un_state == SD_STATE_SUSPENDED) ||
11593 	    (un->un_state == SD_STATE_PM_CHANGING)) {
11594 		cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
11595 	}
11596 
11597 	un->un_ncmds_in_driver++;
11598 
11599 	/*
11600 	 * atapi: Since we are running the CD for now in PIO mode we need to
11601 	 * call bp_mapin here to avoid bp_mapin called interrupt context under
11602 	 * the HBA's init_pkt routine.
11603 	 */
11604 	if (un->un_f_cfg_is_atapi == TRUE) {
11605 		mutex_exit(SD_MUTEX(un));
11606 		bp_mapin(bp);
11607 		mutex_enter(SD_MUTEX(un));
11608 	}
11609 	SD_INFO(SD_LOG_IO, un, "sdstrategy: un_ncmds_in_driver = %ld\n",
11610 	    un->un_ncmds_in_driver);
11611 
11612 	if (bp->b_flags & B_WRITE)
11613 		un->un_f_sync_cache_required = TRUE;
11614 
11615 	mutex_exit(SD_MUTEX(un));
11616 
11617 	/*
11618 	 * This will (eventually) allocate the sd_xbuf area and
11619 	 * call sd_xbuf_strategy().  We just want to return the
11620 	 * result of ddi_xbuf_qstrategy so that we have an opt-
11621 	 * imized tail call which saves us a stack frame.
11622 	 */
11623 	return (ddi_xbuf_qstrategy(bp, un->un_xbuf_attr));
11624 }
11625 
11626 
11627 /*
11628  *    Function: sd_xbuf_strategy
11629  *
11630  * Description: Function for initiating IO operations via the
11631  *		ddi_xbuf_qstrategy() mechanism.
11632  *
11633  *     Context: Kernel thread context.
11634  */
11635 
11636 static void
11637 sd_xbuf_strategy(struct buf *bp, ddi_xbuf_t xp, void *arg)
11638 {
11639 	struct sd_lun *un = arg;
11640 
11641 	ASSERT(bp != NULL);
11642 	ASSERT(xp != NULL);
11643 	ASSERT(un != NULL);
11644 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11645 
11646 	/*
11647 	 * Initialize the fields in the xbuf and save a pointer to the
11648 	 * xbuf in bp->b_private.
11649 	 */
11650 	sd_xbuf_init(un, bp, xp, SD_CHAIN_BUFIO, NULL);
11651 
11652 	/* Send the buf down the iostart chain */
11653 	SD_BEGIN_IOSTART(((struct sd_xbuf *)xp)->xb_chain_iostart, un, bp);
11654 }
11655 
11656 
11657 /*
11658  *    Function: sd_xbuf_init
11659  *
11660  * Description: Prepare the given sd_xbuf struct for use.
11661  *
11662  *   Arguments: un - ptr to softstate
11663  *		bp - ptr to associated buf(9S)
11664  *		xp - ptr to associated sd_xbuf
11665  *		chain_type - IO chain type to use:
11666  *			SD_CHAIN_NULL
11667  *			SD_CHAIN_BUFIO
11668  *			SD_CHAIN_USCSI
11669  *			SD_CHAIN_DIRECT
11670  *			SD_CHAIN_DIRECT_PRIORITY
11671  *		pktinfop - ptr to private data struct for scsi_pkt(9S)
11672  *			initialization; may be NULL if none.
11673  *
11674  *     Context: Kernel thread context
11675  */
11676 
11677 static void
11678 sd_xbuf_init(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
11679     uchar_t chain_type, void *pktinfop)
11680 {
11681 	int index;
11682 
11683 	ASSERT(un != NULL);
11684 	ASSERT(bp != NULL);
11685 	ASSERT(xp != NULL);
11686 
11687 	SD_INFO(SD_LOG_IO, un, "sd_xbuf_init: buf:0x%p chain type:0x%x\n",
11688 	    bp, chain_type);
11689 
11690 	xp->xb_un	= un;
11691 	xp->xb_pktp	= NULL;
11692 	xp->xb_pktinfo	= pktinfop;
11693 	xp->xb_private	= bp->b_private;
11694 	xp->xb_blkno	= (daddr_t)bp->b_blkno;
11695 
11696 	/*
11697 	 * Set up the iostart and iodone chain indexes in the xbuf, based
11698 	 * upon the specified chain type to use.
11699 	 */
11700 	switch (chain_type) {
11701 	case SD_CHAIN_NULL:
11702 		/*
11703 		 * Fall thru to just use the values for the buf type, even
11704 		 * tho for the NULL chain these values will never be used.
11705 		 */
11706 		/* FALLTHRU */
11707 	case SD_CHAIN_BUFIO:
11708 		index = un->un_buf_chain_type;
11709 		if ((!un->un_f_has_removable_media) &&
11710 		    (un->un_tgt_blocksize != 0) &&
11711 		    (un->un_tgt_blocksize != DEV_BSIZE ||
11712 		    un->un_f_enable_rmw)) {
11713 			int secmask = 0, blknomask = 0;
11714 			if (un->un_f_enable_rmw) {
11715 				blknomask =
11716 				    (un->un_phy_blocksize / DEV_BSIZE) - 1;
11717 				secmask = un->un_phy_blocksize - 1;
11718 			} else {
11719 				blknomask =
11720 				    (un->un_tgt_blocksize / DEV_BSIZE) - 1;
11721 				secmask = un->un_tgt_blocksize - 1;
11722 			}
11723 
11724 			if ((bp->b_lblkno & (blknomask)) ||
11725 			    (bp->b_bcount & (secmask))) {
11726 				if ((un->un_f_rmw_type !=
11727 				    SD_RMW_TYPE_RETURN_ERROR) ||
11728 				    un->un_f_enable_rmw) {
11729 					if (un->un_f_pm_is_enabled == FALSE)
11730 						index =
11731 						    SD_CHAIN_INFO_MSS_DSK_NO_PM;
11732 					else
11733 						index =
11734 						    SD_CHAIN_INFO_MSS_DISK;
11735 				}
11736 			}
11737 		}
11738 		break;
11739 	case SD_CHAIN_USCSI:
11740 		index = un->un_uscsi_chain_type;
11741 		break;
11742 	case SD_CHAIN_DIRECT:
11743 		index = un->un_direct_chain_type;
11744 		break;
11745 	case SD_CHAIN_DIRECT_PRIORITY:
11746 		index = un->un_priority_chain_type;
11747 		break;
11748 	default:
11749 		/* We're really broken if we ever get here... */
11750 		panic("sd_xbuf_init: illegal chain type!");
11751 		/*NOTREACHED*/
11752 	}
11753 
11754 	xp->xb_chain_iostart = sd_chain_index_map[index].sci_iostart_index;
11755 	xp->xb_chain_iodone = sd_chain_index_map[index].sci_iodone_index;
11756 
11757 	/*
11758 	 * It might be a bit easier to simply bzero the entire xbuf above,
11759 	 * but it turns out that since we init a fair number of members anyway,
11760 	 * we save a fair number cycles by doing explicit assignment of zero.
11761 	 */
11762 	xp->xb_pkt_flags	= 0;
11763 	xp->xb_dma_resid	= 0;
11764 	xp->xb_retry_count	= 0;
11765 	xp->xb_victim_retry_count = 0;
11766 	xp->xb_ua_retry_count	= 0;
11767 	xp->xb_nr_retry_count	= 0;
11768 	xp->xb_sense_bp		= NULL;
11769 	xp->xb_sense_status	= 0;
11770 	xp->xb_sense_state	= 0;
11771 	xp->xb_sense_resid	= 0;
11772 	xp->xb_ena		= 0;
11773 
11774 	bp->b_private	= xp;
11775 	bp->b_flags	&= ~(B_DONE | B_ERROR);
11776 	bp->b_resid	= 0;
11777 	bp->av_forw	= NULL;
11778 	bp->av_back	= NULL;
11779 	bioerror(bp, 0);
11780 
11781 	SD_INFO(SD_LOG_IO, un, "sd_xbuf_init: done.\n");
11782 }
11783 
11784 
11785 /*
11786  *    Function: sd_uscsi_strategy
11787  *
11788  * Description: Wrapper for calling into the USCSI chain via physio(9F)
11789  *
11790  *   Arguments: bp - buf struct ptr
11791  *
11792  * Return Code: Always returns 0
11793  *
11794  *     Context: Kernel thread context
11795  */
11796 
11797 static int
11798 sd_uscsi_strategy(struct buf *bp)
11799 {
11800 	struct sd_lun		*un;
11801 	struct sd_uscsi_info	*uip;
11802 	struct sd_xbuf		*xp;
11803 	uchar_t			chain_type;
11804 	uchar_t			cmd;
11805 
11806 	ASSERT(bp != NULL);
11807 
11808 	un = ddi_get_soft_state(sd_state, SD_GET_INSTANCE_FROM_BUF(bp));
11809 	if (un == NULL) {
11810 		bioerror(bp, EIO);
11811 		bp->b_resid = bp->b_bcount;
11812 		biodone(bp);
11813 		return (0);
11814 	}
11815 
11816 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11817 
11818 	SD_TRACE(SD_LOG_IO, un, "sd_uscsi_strategy: entry: buf:0x%p\n", bp);
11819 
11820 	/*
11821 	 * A pointer to a struct sd_uscsi_info is expected in bp->b_private
11822 	 */
11823 	ASSERT(bp->b_private != NULL);
11824 	uip = (struct sd_uscsi_info *)bp->b_private;
11825 	cmd = ((struct uscsi_cmd *)(uip->ui_cmdp))->uscsi_cdb[0];
11826 
11827 	mutex_enter(SD_MUTEX(un));
11828 	/*
11829 	 * atapi: Since we are running the CD for now in PIO mode we need to
11830 	 * call bp_mapin here to avoid bp_mapin called interrupt context under
11831 	 * the HBA's init_pkt routine.
11832 	 */
11833 	if (un->un_f_cfg_is_atapi == TRUE) {
11834 		mutex_exit(SD_MUTEX(un));
11835 		bp_mapin(bp);
11836 		mutex_enter(SD_MUTEX(un));
11837 	}
11838 	un->un_ncmds_in_driver++;
11839 	SD_INFO(SD_LOG_IO, un, "sd_uscsi_strategy: un_ncmds_in_driver = %ld\n",
11840 	    un->un_ncmds_in_driver);
11841 
11842 	if ((bp->b_flags & B_WRITE) && (bp->b_bcount != 0) &&
11843 	    (cmd != SCMD_MODE_SELECT) && (cmd != SCMD_MODE_SELECT_G1))
11844 		un->un_f_sync_cache_required = TRUE;
11845 
11846 	mutex_exit(SD_MUTEX(un));
11847 
11848 	switch (uip->ui_flags) {
11849 	case SD_PATH_DIRECT:
11850 		chain_type = SD_CHAIN_DIRECT;
11851 		break;
11852 	case SD_PATH_DIRECT_PRIORITY:
11853 		chain_type = SD_CHAIN_DIRECT_PRIORITY;
11854 		break;
11855 	default:
11856 		chain_type = SD_CHAIN_USCSI;
11857 		break;
11858 	}
11859 
11860 	/*
11861 	 * We may allocate extra buf for external USCSI commands. If the
11862 	 * application asks for bigger than 20-byte sense data via USCSI,
11863 	 * SCSA layer will allocate 252 bytes sense buf for that command.
11864 	 */
11865 	if (((struct uscsi_cmd *)(uip->ui_cmdp))->uscsi_rqlen >
11866 	    SENSE_LENGTH) {
11867 		xp = kmem_zalloc(sizeof (struct sd_xbuf) - SENSE_LENGTH +
11868 		    MAX_SENSE_LENGTH, KM_SLEEP);
11869 	} else {
11870 		xp = kmem_zalloc(sizeof (struct sd_xbuf), KM_SLEEP);
11871 	}
11872 
11873 	sd_xbuf_init(un, bp, xp, chain_type, uip->ui_cmdp);
11874 
11875 	/* Use the index obtained within xbuf_init */
11876 	SD_BEGIN_IOSTART(xp->xb_chain_iostart, un, bp);
11877 
11878 	SD_TRACE(SD_LOG_IO, un, "sd_uscsi_strategy: exit: buf:0x%p\n", bp);
11879 
11880 	return (0);
11881 }
11882 
11883 /*
11884  *    Function: sd_send_scsi_cmd
11885  *
11886  * Description: Runs a USCSI command for user (when called thru sdioctl),
11887  *		or for the driver
11888  *
11889  *   Arguments: dev - the dev_t for the device
11890  *		incmd - ptr to a valid uscsi_cmd struct
11891  *		flag - bit flag, indicating open settings, 32/64 bit type
11892  *		dataspace - UIO_USERSPACE or UIO_SYSSPACE
11893  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
11894  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
11895  *			to use the USCSI "direct" chain and bypass the normal
11896  *			command waitq.
11897  *
11898  * Return Code: 0 -  successful completion of the given command
11899  *		EIO - scsi_uscsi_handle_command() failed
11900  *		ENXIO  - soft state not found for specified dev
11901  *		EINVAL
11902  *		EFAULT - copyin/copyout error
11903  *		return code of scsi_uscsi_handle_command():
11904  *			EIO
11905  *			ENXIO
11906  *			EACCES
11907  *
11908  *     Context: Waits for command to complete. Can sleep.
11909  */
11910 
11911 static int
11912 sd_send_scsi_cmd(dev_t dev, struct uscsi_cmd *incmd, int flag,
11913     enum uio_seg dataspace, int path_flag)
11914 {
11915 	struct sd_lun	*un;
11916 	sd_ssc_t	*ssc;
11917 	int		rval;
11918 
11919 	un = ddi_get_soft_state(sd_state, SDUNIT(dev));
11920 	if (un == NULL) {
11921 		return (ENXIO);
11922 	}
11923 
11924 	/*
11925 	 * Using sd_ssc_send to handle uscsi cmd
11926 	 */
11927 	ssc = sd_ssc_init(un);
11928 	rval = sd_ssc_send(ssc, incmd, flag, dataspace, path_flag);
11929 	sd_ssc_fini(ssc);
11930 
11931 	return (rval);
11932 }
11933 
11934 /*
11935  *    Function: sd_ssc_init
11936  *
11937  * Description: Uscsi end-user call this function to initialize necessary
11938  *              fields, such as uscsi_cmd and sd_uscsi_info struct.
11939  *
11940  *              The return value of sd_send_scsi_cmd will be treated as a
11941  *              fault in various conditions. Even it is not Zero, some
11942  *              callers may ignore the return value. That is to say, we can
11943  *              not make an accurate assessment in sdintr, since if a
11944  *              command is failed in sdintr it does not mean the caller of
11945  *              sd_send_scsi_cmd will treat it as a real failure.
11946  *
11947  *              To avoid printing too many error logs for a failed uscsi
11948  *              packet that the caller may not treat it as a failure, the
11949  *              sd will keep silent for handling all uscsi commands.
11950  *
11951  *              During detach->attach and attach-open, for some types of
11952  *              problems, the driver should be providing information about
11953  *              the problem encountered. Device use USCSI_SILENT, which
11954  *              suppresses all driver information. The result is that no
11955  *              information about the problem is available. Being
11956  *              completely silent during this time is inappropriate. The
11957  *              driver needs a more selective filter than USCSI_SILENT, so
11958  *              that information related to faults is provided.
11959  *
11960  *              To make the accurate accessment, the caller  of
11961  *              sd_send_scsi_USCSI_CMD should take the ownership and
11962  *              get necessary information to print error messages.
11963  *
11964  *              If we want to print necessary info of uscsi command, we need to
11965  *              keep the uscsi_cmd and sd_uscsi_info till we can make the
11966  *              assessment. We use sd_ssc_init to alloc necessary
11967  *              structs for sending an uscsi command and we are also
11968  *              responsible for free the memory by calling
11969  *              sd_ssc_fini.
11970  *
11971  *              The calling secquences will look like:
11972  *              sd_ssc_init->
11973  *
11974  *                  ...
11975  *
11976  *                  sd_send_scsi_USCSI_CMD->
11977  *                      sd_ssc_send-> - - - sdintr
11978  *                  ...
11979  *
11980  *                  if we think the return value should be treated as a
11981  *                  failure, we make the accessment here and print out
11982  *                  necessary by retrieving uscsi_cmd and sd_uscsi_info'
11983  *
11984  *                  ...
11985  *
11986  *              sd_ssc_fini
11987  *
11988  *
11989  *   Arguments: un - pointer to driver soft state (unit) structure for this
11990  *                   target.
11991  *
11992  * Return code: sd_ssc_t - pointer to allocated sd_ssc_t struct, it contains
11993  *                         uscsi_cmd and sd_uscsi_info.
11994  *                  NULL - if can not alloc memory for sd_ssc_t struct
11995  *
11996  *     Context: Kernel Thread.
11997  */
11998 static sd_ssc_t *
11999 sd_ssc_init(struct sd_lun *un)
12000 {
12001 	sd_ssc_t		*ssc;
12002 	struct uscsi_cmd	*ucmdp;
12003 	struct sd_uscsi_info	*uip;
12004 
12005 	ASSERT(un != NULL);
12006 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12007 
12008 	/*
12009 	 * Allocate sd_ssc_t structure
12010 	 */
12011 	ssc = kmem_zalloc(sizeof (sd_ssc_t), KM_SLEEP);
12012 
12013 	/*
12014 	 * Allocate uscsi_cmd by calling scsi_uscsi_alloc common routine
12015 	 */
12016 	ucmdp = scsi_uscsi_alloc();
12017 
12018 	/*
12019 	 * Allocate sd_uscsi_info structure
12020 	 */
12021 	uip = kmem_zalloc(sizeof (struct sd_uscsi_info), KM_SLEEP);
12022 
12023 	ssc->ssc_uscsi_cmd = ucmdp;
12024 	ssc->ssc_uscsi_info = uip;
12025 	ssc->ssc_un = un;
12026 
12027 	return (ssc);
12028 }
12029 
12030 /*
12031  * Function: sd_ssc_fini
12032  *
12033  * Description: To free sd_ssc_t and it's hanging off
12034  *
12035  * Arguments: ssc - struct pointer of sd_ssc_t.
12036  */
12037 static void
12038 sd_ssc_fini(sd_ssc_t *ssc)
12039 {
12040 	scsi_uscsi_free(ssc->ssc_uscsi_cmd);
12041 
12042 	if (ssc->ssc_uscsi_info != NULL) {
12043 		kmem_free(ssc->ssc_uscsi_info, sizeof (struct sd_uscsi_info));
12044 		ssc->ssc_uscsi_info = NULL;
12045 	}
12046 
12047 	kmem_free(ssc, sizeof (sd_ssc_t));
12048 	ssc = NULL;
12049 }
12050 
12051 /*
12052  * Function: sd_ssc_send
12053  *
12054  * Description: Runs a USCSI command for user when called through sdioctl,
12055  *              or for the driver.
12056  *
12057  *   Arguments: ssc - the struct of sd_ssc_t will bring uscsi_cmd and
12058  *                    sd_uscsi_info in.
12059  *		incmd - ptr to a valid uscsi_cmd struct
12060  *		flag - bit flag, indicating open settings, 32/64 bit type
12061  *		dataspace - UIO_USERSPACE or UIO_SYSSPACE
12062  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
12063  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
12064  *			to use the USCSI "direct" chain and bypass the normal
12065  *			command waitq.
12066  *
12067  * Return Code: 0 -  successful completion of the given command
12068  *		EIO - scsi_uscsi_handle_command() failed
12069  *		ENXIO  - soft state not found for specified dev
12070  *		ECANCELED - command cancelled due to low power
12071  *		EINVAL
12072  *		EFAULT - copyin/copyout error
12073  *		return code of scsi_uscsi_handle_command():
12074  *			EIO
12075  *			ENXIO
12076  *			EACCES
12077  *
12078  *     Context: Kernel Thread;
12079  *              Waits for command to complete. Can sleep.
12080  */
12081 static int
12082 sd_ssc_send(sd_ssc_t *ssc, struct uscsi_cmd *incmd, int flag,
12083     enum uio_seg dataspace, int path_flag)
12084 {
12085 	struct sd_uscsi_info	*uip;
12086 	struct uscsi_cmd	*uscmd;
12087 	struct sd_lun		*un;
12088 	dev_t			dev;
12089 
12090 	int	format = 0;
12091 	int	rval;
12092 
12093 	ASSERT(ssc != NULL);
12094 	un = ssc->ssc_un;
12095 	ASSERT(un != NULL);
12096 	uscmd = ssc->ssc_uscsi_cmd;
12097 	ASSERT(uscmd != NULL);
12098 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12099 	if (ssc->ssc_flags & SSC_FLAGS_NEED_ASSESSMENT) {
12100 		/*
12101 		 * If enter here, it indicates that the previous uscsi
12102 		 * command has not been processed by sd_ssc_assessment.
12103 		 * This is violating our rules of FMA telemetry processing.
12104 		 * We should print out this message and the last undisposed
12105 		 * uscsi command.
12106 		 */
12107 		if (uscmd->uscsi_cdb != NULL) {
12108 			SD_INFO(SD_LOG_SDTEST, un,
12109 			    "sd_ssc_send is missing the alternative "
12110 			    "sd_ssc_assessment when running command 0x%x.\n",
12111 			    uscmd->uscsi_cdb[0]);
12112 		}
12113 		/*
12114 		 * Set the ssc_flags to SSC_FLAGS_UNKNOWN, which should be
12115 		 * the initial status.
12116 		 */
12117 		ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12118 	}
12119 
12120 	/*
12121 	 * We need to make sure sd_ssc_send will have sd_ssc_assessment
12122 	 * followed to avoid missing FMA telemetries.
12123 	 */
12124 	ssc->ssc_flags |= SSC_FLAGS_NEED_ASSESSMENT;
12125 
12126 	/*
12127 	 * if USCSI_PMFAILFAST is set and un is in low power, fail the
12128 	 * command immediately.
12129 	 */
12130 	mutex_enter(SD_MUTEX(un));
12131 	mutex_enter(&un->un_pm_mutex);
12132 	if ((uscmd->uscsi_flags & USCSI_PMFAILFAST) &&
12133 	    SD_DEVICE_IS_IN_LOW_POWER(un)) {
12134 		SD_TRACE(SD_LOG_IO, un, "sd_ssc_send:"
12135 		    "un:0x%p is in low power\n", un);
12136 		mutex_exit(&un->un_pm_mutex);
12137 		mutex_exit(SD_MUTEX(un));
12138 		return (ECANCELED);
12139 	}
12140 	mutex_exit(&un->un_pm_mutex);
12141 	mutex_exit(SD_MUTEX(un));
12142 
12143 #ifdef SDDEBUG
12144 	switch (dataspace) {
12145 	case UIO_USERSPACE:
12146 		SD_TRACE(SD_LOG_IO, un,
12147 		    "sd_ssc_send: entry: un:0x%p UIO_USERSPACE\n", un);
12148 		break;
12149 	case UIO_SYSSPACE:
12150 		SD_TRACE(SD_LOG_IO, un,
12151 		    "sd_ssc_send: entry: un:0x%p UIO_SYSSPACE\n", un);
12152 		break;
12153 	default:
12154 		SD_TRACE(SD_LOG_IO, un,
12155 		    "sd_ssc_send: entry: un:0x%p UNEXPECTED SPACE\n", un);
12156 		break;
12157 	}
12158 #endif
12159 
12160 	rval = scsi_uscsi_copyin((intptr_t)incmd, flag,
12161 	    SD_ADDRESS(un), &uscmd);
12162 	if (rval != 0) {
12163 		SD_TRACE(SD_LOG_IO, un, "sd_sense_scsi_cmd: "
12164 		    "scsi_uscsi_alloc_and_copyin failed\n", un);
12165 		return (rval);
12166 	}
12167 
12168 	if ((uscmd->uscsi_cdb != NULL) &&
12169 	    (uscmd->uscsi_cdb[0] == SCMD_FORMAT)) {
12170 		mutex_enter(SD_MUTEX(un));
12171 		un->un_f_format_in_progress = TRUE;
12172 		mutex_exit(SD_MUTEX(un));
12173 		format = 1;
12174 	}
12175 
12176 	/*
12177 	 * Allocate an sd_uscsi_info struct and fill it with the info
12178 	 * needed by sd_initpkt_for_uscsi().  Then put the pointer into
12179 	 * b_private in the buf for sd_initpkt_for_uscsi().  Note that
12180 	 * since we allocate the buf here in this function, we do not
12181 	 * need to preserve the prior contents of b_private.
12182 	 * The sd_uscsi_info struct is also used by sd_uscsi_strategy()
12183 	 */
12184 	uip = ssc->ssc_uscsi_info;
12185 	uip->ui_flags = path_flag;
12186 	uip->ui_cmdp = uscmd;
12187 
12188 	/*
12189 	 * Commands sent with priority are intended for error recovery
12190 	 * situations, and do not have retries performed.
12191 	 */
12192 	if (path_flag == SD_PATH_DIRECT_PRIORITY) {
12193 		uscmd->uscsi_flags |= USCSI_DIAGNOSE;
12194 	}
12195 	uscmd->uscsi_flags &= ~USCSI_NOINTR;
12196 
12197 	dev = SD_GET_DEV(un);
12198 	rval = scsi_uscsi_handle_cmd(dev, dataspace, uscmd,
12199 	    sd_uscsi_strategy, NULL, uip);
12200 
12201 	/*
12202 	 * mark ssc_flags right after handle_cmd to make sure
12203 	 * the uscsi has been sent
12204 	 */
12205 	ssc->ssc_flags |= SSC_FLAGS_CMD_ISSUED;
12206 
12207 #ifdef SDDEBUG
12208 	SD_INFO(SD_LOG_IO, un, "sd_ssc_send: "
12209 	    "uscsi_status: 0x%02x  uscsi_resid:0x%x\n",
12210 	    uscmd->uscsi_status, uscmd->uscsi_resid);
12211 	if (uscmd->uscsi_bufaddr != NULL) {
12212 		SD_INFO(SD_LOG_IO, un, "sd_ssc_send: "
12213 		    "uscmd->uscsi_bufaddr: 0x%p  uscmd->uscsi_buflen:%d\n",
12214 		    uscmd->uscsi_bufaddr, uscmd->uscsi_buflen);
12215 		if (dataspace == UIO_SYSSPACE) {
12216 			SD_DUMP_MEMORY(un, SD_LOG_IO,
12217 			    "data", (uchar_t *)uscmd->uscsi_bufaddr,
12218 			    uscmd->uscsi_buflen, SD_LOG_HEX);
12219 		}
12220 	}
12221 #endif
12222 
12223 	if (format == 1) {
12224 		mutex_enter(SD_MUTEX(un));
12225 		un->un_f_format_in_progress = FALSE;
12226 		mutex_exit(SD_MUTEX(un));
12227 	}
12228 
12229 	(void) scsi_uscsi_copyout((intptr_t)incmd, uscmd);
12230 
12231 	return (rval);
12232 }
12233 
12234 /*
12235  *     Function: sd_ssc_print
12236  *
12237  * Description: Print information available to the console.
12238  *
12239  * Arguments: ssc - the struct of sd_ssc_t will bring uscsi_cmd and
12240  *                    sd_uscsi_info in.
12241  *            sd_severity - log level.
12242  *     Context: Kernel thread or interrupt context.
12243  */
12244 static void
12245 sd_ssc_print(sd_ssc_t *ssc, int sd_severity)
12246 {
12247 	struct uscsi_cmd	*ucmdp;
12248 	struct scsi_device	*devp;
12249 	dev_info_t		*devinfo;
12250 	uchar_t			*sensep;
12251 	int			senlen;
12252 	union scsi_cdb		*cdbp;
12253 	uchar_t			com;
12254 	extern struct scsi_key_strings scsi_cmds[];
12255 
12256 	ASSERT(ssc != NULL);
12257 	ASSERT(ssc->ssc_un != NULL);
12258 
12259 	if (SD_FM_LOG(ssc->ssc_un) != SD_FM_LOG_EREPORT)
12260 		return;
12261 	ucmdp = ssc->ssc_uscsi_cmd;
12262 	devp = SD_SCSI_DEVP(ssc->ssc_un);
12263 	devinfo = SD_DEVINFO(ssc->ssc_un);
12264 	ASSERT(ucmdp != NULL);
12265 	ASSERT(devp != NULL);
12266 	ASSERT(devinfo != NULL);
12267 	sensep = (uint8_t *)ucmdp->uscsi_rqbuf;
12268 	senlen = ucmdp->uscsi_rqlen - ucmdp->uscsi_rqresid;
12269 	cdbp = (union scsi_cdb *)ucmdp->uscsi_cdb;
12270 
12271 	/* In certain case (like DOORLOCK), the cdb could be NULL. */
12272 	if (cdbp == NULL)
12273 		return;
12274 	/* We don't print log if no sense data available. */
12275 	if (senlen == 0)
12276 		sensep = NULL;
12277 	com = cdbp->scc_cmd;
12278 	scsi_generic_errmsg(devp, sd_label, sd_severity, 0, 0, com,
12279 	    scsi_cmds, sensep, ssc->ssc_un->un_additional_codes, NULL);
12280 }
12281 
12282 /*
12283  *     Function: sd_ssc_assessment
12284  *
12285  * Description: We use this function to make an assessment at the point
12286  *              where SD driver may encounter a potential error.
12287  *
12288  * Arguments: ssc - the struct of sd_ssc_t will bring uscsi_cmd and
12289  *                  sd_uscsi_info in.
12290  *            tp_assess - a hint of strategy for ereport posting.
12291  *            Possible values of tp_assess include:
12292  *                SD_FMT_IGNORE - we don't post any ereport because we're
12293  *                sure that it is ok to ignore the underlying problems.
12294  *                SD_FMT_IGNORE_COMPROMISE - we don't post any ereport for now
12295  *                but it might be not correct to ignore the underlying hardware
12296  *                error.
12297  *                SD_FMT_STATUS_CHECK - we will post an ereport with the
12298  *                payload driver-assessment of value "fail" or
12299  *                "fatal"(depending on what information we have here). This
12300  *                assessment value is usually set when SD driver think there
12301  *                is a potential error occurred(Typically, when return value
12302  *                of the SCSI command is EIO).
12303  *                SD_FMT_STANDARD - we will post an ereport with the payload
12304  *                driver-assessment of value "info". This assessment value is
12305  *                set when the SCSI command returned successfully and with
12306  *                sense data sent back.
12307  *
12308  *     Context: Kernel thread.
12309  */
12310 static void
12311 sd_ssc_assessment(sd_ssc_t *ssc, enum sd_type_assessment tp_assess)
12312 {
12313 	int senlen = 0;
12314 	struct uscsi_cmd *ucmdp = NULL;
12315 	struct sd_lun *un;
12316 
12317 	ASSERT(ssc != NULL);
12318 	un = ssc->ssc_un;
12319 	ASSERT(un != NULL);
12320 	ucmdp = ssc->ssc_uscsi_cmd;
12321 	ASSERT(ucmdp != NULL);
12322 
12323 	if (ssc->ssc_flags & SSC_FLAGS_NEED_ASSESSMENT) {
12324 		ssc->ssc_flags &= ~SSC_FLAGS_NEED_ASSESSMENT;
12325 	} else {
12326 		/*
12327 		 * If enter here, it indicates that we have a wrong
12328 		 * calling sequence of sd_ssc_send and sd_ssc_assessment,
12329 		 * both of which should be called in a pair in case of
12330 		 * loss of FMA telemetries.
12331 		 */
12332 		if (ucmdp->uscsi_cdb != NULL) {
12333 			SD_INFO(SD_LOG_SDTEST, un,
12334 			    "sd_ssc_assessment is missing the "
12335 			    "alternative sd_ssc_send when running 0x%x, "
12336 			    "or there are superfluous sd_ssc_assessment for "
12337 			    "the same sd_ssc_send.\n",
12338 			    ucmdp->uscsi_cdb[0]);
12339 		}
12340 		/*
12341 		 * Set the ssc_flags to the initial value to avoid passing
12342 		 * down dirty flags to the following sd_ssc_send function.
12343 		 */
12344 		ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12345 		return;
12346 	}
12347 
12348 	/*
12349 	 * Only handle an issued command which is waiting for assessment.
12350 	 * A command which is not issued will not have
12351 	 * SSC_FLAGS_INVALID_DATA set, so it'ok we just return here.
12352 	 */
12353 	if (!(ssc->ssc_flags & SSC_FLAGS_CMD_ISSUED)) {
12354 		sd_ssc_print(ssc, SCSI_ERR_INFO);
12355 		return;
12356 	} else {
12357 		/*
12358 		 * For an issued command, we should clear this flag in
12359 		 * order to make the sd_ssc_t structure be used off
12360 		 * multiple uscsi commands.
12361 		 */
12362 		ssc->ssc_flags &= ~SSC_FLAGS_CMD_ISSUED;
12363 	}
12364 
12365 	/*
12366 	 * We will not deal with non-retryable(flag USCSI_DIAGNOSE set)
12367 	 * commands here. And we should clear the ssc_flags before return.
12368 	 */
12369 	if (ucmdp->uscsi_flags & USCSI_DIAGNOSE) {
12370 		ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12371 		return;
12372 	}
12373 
12374 	switch (tp_assess) {
12375 	case SD_FMT_IGNORE:
12376 	case SD_FMT_IGNORE_COMPROMISE:
12377 		break;
12378 	case SD_FMT_STATUS_CHECK:
12379 		/*
12380 		 * For a failed command(including the succeeded command
12381 		 * with invalid data sent back).
12382 		 */
12383 		sd_ssc_post(ssc, SD_FM_DRV_FATAL);
12384 		break;
12385 	case SD_FMT_STANDARD:
12386 		/*
12387 		 * Always for the succeeded commands probably with sense
12388 		 * data sent back.
12389 		 * Limitation:
12390 		 *	We can only handle a succeeded command with sense
12391 		 *	data sent back when auto-request-sense is enabled.
12392 		 */
12393 		senlen = ssc->ssc_uscsi_cmd->uscsi_rqlen -
12394 		    ssc->ssc_uscsi_cmd->uscsi_rqresid;
12395 		if ((ssc->ssc_uscsi_info->ui_pkt_state & STATE_ARQ_DONE) &&
12396 		    (un->un_f_arq_enabled == TRUE) &&
12397 		    senlen > 0 &&
12398 		    ssc->ssc_uscsi_cmd->uscsi_rqbuf != NULL) {
12399 			sd_ssc_post(ssc, SD_FM_DRV_NOTICE);
12400 		}
12401 		break;
12402 	default:
12403 		/*
12404 		 * Should not have other type of assessment.
12405 		 */
12406 		scsi_log(SD_DEVINFO(un), sd_label, CE_CONT,
12407 		    "sd_ssc_assessment got wrong "
12408 		    "sd_type_assessment %d.\n", tp_assess);
12409 		break;
12410 	}
12411 	/*
12412 	 * Clear up the ssc_flags before return.
12413 	 */
12414 	ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12415 }
12416 
12417 /*
12418  *    Function: sd_ssc_post
12419  *
12420  * Description: 1. read the driver property to get fm-scsi-log flag.
12421  *              2. print log if fm_log_capable is non-zero.
12422  *              3. call sd_ssc_ereport_post to post ereport if possible.
12423  *
12424  *    Context: May be called from kernel thread or interrupt context.
12425  */
12426 static void
12427 sd_ssc_post(sd_ssc_t *ssc, enum sd_driver_assessment sd_assess)
12428 {
12429 	struct sd_lun	*un;
12430 	int		sd_severity;
12431 
12432 	ASSERT(ssc != NULL);
12433 	un = ssc->ssc_un;
12434 	ASSERT(un != NULL);
12435 
12436 	/*
12437 	 * We may enter here from sd_ssc_assessment(for USCSI command) or
12438 	 * by directly called from sdintr context.
12439 	 * We don't handle a non-disk drive(CD-ROM, removable media).
12440 	 * Clear the ssc_flags before return in case we've set
12441 	 * SSC_FLAGS_INVALID_XXX which should be skipped for a non-disk
12442 	 * driver.
12443 	 */
12444 	if (ISCD(un) || un->un_f_has_removable_media) {
12445 		ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12446 		return;
12447 	}
12448 
12449 	switch (sd_assess) {
12450 		case SD_FM_DRV_FATAL:
12451 			sd_severity = SCSI_ERR_FATAL;
12452 			break;
12453 		case SD_FM_DRV_RECOVERY:
12454 			sd_severity = SCSI_ERR_RECOVERED;
12455 			break;
12456 		case SD_FM_DRV_RETRY:
12457 			sd_severity = SCSI_ERR_RETRYABLE;
12458 			break;
12459 		case SD_FM_DRV_NOTICE:
12460 			sd_severity = SCSI_ERR_INFO;
12461 			break;
12462 		default:
12463 			sd_severity = SCSI_ERR_UNKNOWN;
12464 	}
12465 	/* print log */
12466 	sd_ssc_print(ssc, sd_severity);
12467 
12468 	/* always post ereport */
12469 	sd_ssc_ereport_post(ssc, sd_assess);
12470 }
12471 
12472 /*
12473  *    Function: sd_ssc_set_info
12474  *
12475  * Description: Mark ssc_flags and set ssc_info which would be the
12476  *              payload of uderr ereport. This function will cause
12477  *              sd_ssc_ereport_post to post uderr ereport only.
12478  *              Besides, when ssc_flags == SSC_FLAGS_INVALID_DATA(USCSI),
12479  *              the function will also call SD_ERROR or scsi_log for a
12480  *              CDROM/removable-media/DDI_FM_NOT_CAPABLE device.
12481  *
12482  * Arguments: ssc - the struct of sd_ssc_t will bring uscsi_cmd and
12483  *                  sd_uscsi_info in.
12484  *            ssc_flags - indicate the sub-category of a uderr.
12485  *            comp - this argument is meaningful only when
12486  *                   ssc_flags == SSC_FLAGS_INVALID_DATA, and its possible
12487  *                   values include:
12488  *                   > 0, SD_ERROR is used with comp as the driver logging
12489  *                   component;
12490  *                   = 0, scsi-log is used to log error telemetries;
12491  *                   < 0, no log available for this telemetry.
12492  *
12493  *    Context: Kernel thread or interrupt context
12494  */
12495 static void
12496 sd_ssc_set_info(sd_ssc_t *ssc, int ssc_flags, uint_t comp, const char *fmt, ...)
12497 {
12498 	va_list	ap;
12499 
12500 	ASSERT(ssc != NULL);
12501 	ASSERT(ssc->ssc_un != NULL);
12502 
12503 	ssc->ssc_flags |= ssc_flags;
12504 	va_start(ap, fmt);
12505 	(void) vsnprintf(ssc->ssc_info, sizeof (ssc->ssc_info), fmt, ap);
12506 	va_end(ap);
12507 
12508 	/*
12509 	 * If SSC_FLAGS_INVALID_DATA is set, it should be a uscsi command
12510 	 * with invalid data sent back. For non-uscsi command, the
12511 	 * following code will be bypassed.
12512 	 */
12513 	if (ssc_flags & SSC_FLAGS_INVALID_DATA) {
12514 		if (SD_FM_LOG(ssc->ssc_un) == SD_FM_LOG_NSUP) {
12515 			/*
12516 			 * If the error belong to certain component and we
12517 			 * do not want it to show up on the console, we
12518 			 * will use SD_ERROR, otherwise scsi_log is
12519 			 * preferred.
12520 			 */
12521 			if (comp > 0) {
12522 				SD_ERROR(comp, ssc->ssc_un, ssc->ssc_info);
12523 			} else if (comp == 0) {
12524 				scsi_log(SD_DEVINFO(ssc->ssc_un), sd_label,
12525 				    CE_WARN, ssc->ssc_info);
12526 			}
12527 		}
12528 	}
12529 }
12530 
12531 /*
12532  *    Function: sd_buf_iodone
12533  *
12534  * Description: Frees the sd_xbuf & returns the buf to its originator.
12535  *
12536  *     Context: May be called from interrupt context.
12537  */
12538 /* ARGSUSED */
12539 static void
12540 sd_buf_iodone(int index, struct sd_lun *un, struct buf *bp)
12541 {
12542 	struct sd_xbuf *xp;
12543 
12544 	ASSERT(un != NULL);
12545 	ASSERT(bp != NULL);
12546 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12547 
12548 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_buf_iodone: entry.\n");
12549 
12550 	xp = SD_GET_XBUF(bp);
12551 	ASSERT(xp != NULL);
12552 
12553 	/* xbuf is gone after this */
12554 	if (ddi_xbuf_done(bp, un->un_xbuf_attr)) {
12555 		mutex_enter(SD_MUTEX(un));
12556 
12557 		/*
12558 		 * Grab time when the cmd completed.
12559 		 * This is used for determining if the system has been
12560 		 * idle long enough to make it idle to the PM framework.
12561 		 * This is for lowering the overhead, and therefore improving
12562 		 * performance per I/O operation.
12563 		 */
12564 		un->un_pm_idle_time = gethrtime();
12565 
12566 		un->un_ncmds_in_driver--;
12567 		ASSERT(un->un_ncmds_in_driver >= 0);
12568 		SD_INFO(SD_LOG_IO, un,
12569 		    "sd_buf_iodone: un_ncmds_in_driver = %ld\n",
12570 		    un->un_ncmds_in_driver);
12571 
12572 		mutex_exit(SD_MUTEX(un));
12573 	}
12574 
12575 	biodone(bp);				/* bp is gone after this */
12576 
12577 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_buf_iodone: exit.\n");
12578 }
12579 
12580 
12581 /*
12582  *    Function: sd_uscsi_iodone
12583  *
12584  * Description: Frees the sd_xbuf & returns the buf to its originator.
12585  *
12586  *     Context: May be called from interrupt context.
12587  */
12588 /* ARGSUSED */
12589 static void
12590 sd_uscsi_iodone(int index, struct sd_lun *un, struct buf *bp)
12591 {
12592 	struct sd_xbuf *xp;
12593 
12594 	ASSERT(un != NULL);
12595 	ASSERT(bp != NULL);
12596 
12597 	xp = SD_GET_XBUF(bp);
12598 	ASSERT(xp != NULL);
12599 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12600 
12601 	SD_INFO(SD_LOG_IO, un, "sd_uscsi_iodone: entry.\n");
12602 
12603 	bp->b_private = xp->xb_private;
12604 
12605 	mutex_enter(SD_MUTEX(un));
12606 
12607 	/*
12608 	 * Grab time when the cmd completed.
12609 	 * This is used for determining if the system has been
12610 	 * idle long enough to make it idle to the PM framework.
12611 	 * This is for lowering the overhead, and therefore improving
12612 	 * performance per I/O operation.
12613 	 */
12614 	un->un_pm_idle_time = gethrtime();
12615 
12616 	un->un_ncmds_in_driver--;
12617 	ASSERT(un->un_ncmds_in_driver >= 0);
12618 	SD_INFO(SD_LOG_IO, un, "sd_uscsi_iodone: un_ncmds_in_driver = %ld\n",
12619 	    un->un_ncmds_in_driver);
12620 
12621 	mutex_exit(SD_MUTEX(un));
12622 
12623 	if (((struct uscsi_cmd *)(xp->xb_pktinfo))->uscsi_rqlen >
12624 	    SENSE_LENGTH) {
12625 		kmem_free(xp, sizeof (struct sd_xbuf) - SENSE_LENGTH +
12626 		    MAX_SENSE_LENGTH);
12627 	} else {
12628 		kmem_free(xp, sizeof (struct sd_xbuf));
12629 	}
12630 
12631 	biodone(bp);
12632 
12633 	SD_INFO(SD_LOG_IO, un, "sd_uscsi_iodone: exit.\n");
12634 }
12635 
12636 
12637 /*
12638  *    Function: sd_mapblockaddr_iostart
12639  *
12640  * Description: Verify request lies within the partition limits for
12641  *		the indicated minor device.  Issue "overrun" buf if
12642  *		request would exceed partition range.  Converts
12643  *		partition-relative block address to absolute.
12644  *
12645  *              Upon exit of this function:
12646  *              1.I/O is aligned
12647  *                 xp->xb_blkno represents the absolute sector address
12648  *              2.I/O is misaligned
12649  *                 xp->xb_blkno represents the absolute logical block address
12650  *                 based on DEV_BSIZE. The logical block address will be
12651  *                 converted to physical sector address in sd_mapblocksize_\
12652  *                 iostart.
12653  *              3.I/O is misaligned but is aligned in "overrun" buf
12654  *                 xp->xb_blkno represents the absolute logical block address
12655  *                 based on DEV_BSIZE. The logical block address will be
12656  *                 converted to physical sector address in sd_mapblocksize_\
12657  *                 iostart. But no RMW will be issued in this case.
12658  *
12659  *     Context: Can sleep
12660  *
12661  *      Issues: This follows what the old code did, in terms of accessing
12662  *		some of the partition info in the unit struct without holding
12663  *		the mutext.  This is a general issue, if the partition info
12664  *		can be altered while IO is in progress... as soon as we send
12665  *		a buf, its partitioning can be invalid before it gets to the
12666  *		device.  Probably the right fix is to move partitioning out
12667  *		of the driver entirely.
12668  */
12669 
12670 static void
12671 sd_mapblockaddr_iostart(int index, struct sd_lun *un, struct buf *bp)
12672 {
12673 	diskaddr_t	nblocks;	/* #blocks in the given partition */
12674 	daddr_t	blocknum;	/* Block number specified by the buf */
12675 	size_t	requested_nblocks;
12676 	size_t	available_nblocks;
12677 	int	partition;
12678 	diskaddr_t	partition_offset;
12679 	struct sd_xbuf *xp;
12680 	int secmask = 0, blknomask = 0;
12681 	ushort_t is_aligned = TRUE;
12682 
12683 	ASSERT(un != NULL);
12684 	ASSERT(bp != NULL);
12685 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12686 
12687 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12688 	    "sd_mapblockaddr_iostart: entry: buf:0x%p\n", bp);
12689 
12690 	xp = SD_GET_XBUF(bp);
12691 	ASSERT(xp != NULL);
12692 
12693 	/*
12694 	 * If the geometry is not indicated as valid, attempt to access
12695 	 * the unit & verify the geometry/label. This can be the case for
12696 	 * removable-media devices, of if the device was opened in
12697 	 * NDELAY/NONBLOCK mode.
12698 	 */
12699 	partition = SDPART(bp->b_edev);
12700 
12701 	if (!SD_IS_VALID_LABEL(un)) {
12702 		sd_ssc_t *ssc;
12703 		/*
12704 		 * Initialize sd_ssc_t for internal uscsi commands
12705 		 * In case of potential porformance issue, we need
12706 		 * to alloc memory only if there is invalid label
12707 		 */
12708 		ssc = sd_ssc_init(un);
12709 
12710 		if (sd_ready_and_valid(ssc, partition) != SD_READY_VALID) {
12711 			/*
12712 			 * For removable devices it is possible to start an
12713 			 * I/O without a media by opening the device in nodelay
12714 			 * mode. Also for writable CDs there can be many
12715 			 * scenarios where there is no geometry yet but volume
12716 			 * manager is trying to issue a read() just because
12717 			 * it can see TOC on the CD. So do not print a message
12718 			 * for removables.
12719 			 */
12720 			if (!un->un_f_has_removable_media) {
12721 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
12722 				    "i/o to invalid geometry\n");
12723 			}
12724 			bioerror(bp, EIO);
12725 			bp->b_resid = bp->b_bcount;
12726 			SD_BEGIN_IODONE(index, un, bp);
12727 
12728 			sd_ssc_fini(ssc);
12729 			return;
12730 		}
12731 		sd_ssc_fini(ssc);
12732 	}
12733 
12734 	nblocks = 0;
12735 	(void) cmlb_partinfo(un->un_cmlbhandle, partition,
12736 	    &nblocks, &partition_offset, NULL, NULL, (void *)SD_PATH_DIRECT);
12737 
12738 	if (un->un_f_enable_rmw) {
12739 		blknomask = (un->un_phy_blocksize / DEV_BSIZE) - 1;
12740 		secmask = un->un_phy_blocksize - 1;
12741 	} else {
12742 		blknomask = (un->un_tgt_blocksize / DEV_BSIZE) - 1;
12743 		secmask = un->un_tgt_blocksize - 1;
12744 	}
12745 
12746 	if ((bp->b_lblkno & (blknomask)) || (bp->b_bcount & (secmask))) {
12747 		is_aligned = FALSE;
12748 	}
12749 
12750 	if (!(NOT_DEVBSIZE(un)) || un->un_f_enable_rmw) {
12751 		/*
12752 		 * If I/O is aligned, no need to involve RMW(Read Modify Write)
12753 		 * Convert the logical block number to target's physical sector
12754 		 * number.
12755 		 */
12756 		if (is_aligned) {
12757 			xp->xb_blkno = SD_SYS2TGTBLOCK(un, xp->xb_blkno);
12758 		} else {
12759 			/*
12760 			 * There is no RMW if we're just reading, so don't
12761 			 * warn or error out because of it.
12762 			 */
12763 			if (bp->b_flags & B_READ) {
12764 				/*EMPTY*/
12765 			} else if (!un->un_f_enable_rmw &&
12766 			    un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR) {
12767 				bp->b_flags |= B_ERROR;
12768 				goto error_exit;
12769 			} else if (un->un_f_rmw_type == SD_RMW_TYPE_DEFAULT) {
12770 				mutex_enter(SD_MUTEX(un));
12771 				if (!un->un_f_enable_rmw &&
12772 				    un->un_rmw_msg_timeid == NULL) {
12773 					scsi_log(SD_DEVINFO(un), sd_label,
12774 					    CE_WARN, "I/O request is not "
12775 					    "aligned with %d disk sector size. "
12776 					    "It is handled through Read Modify "
12777 					    "Write but the performance is "
12778 					    "very low.\n",
12779 					    un->un_tgt_blocksize);
12780 					un->un_rmw_msg_timeid =
12781 					    timeout(sd_rmw_msg_print_handler,
12782 					    un, SD_RMW_MSG_PRINT_TIMEOUT);
12783 				} else {
12784 					un->un_rmw_incre_count ++;
12785 				}
12786 				mutex_exit(SD_MUTEX(un));
12787 			}
12788 
12789 			nblocks = SD_TGT2SYSBLOCK(un, nblocks);
12790 			partition_offset = SD_TGT2SYSBLOCK(un,
12791 			    partition_offset);
12792 		}
12793 	}
12794 
12795 	/*
12796 	 * blocknum is the starting block number of the request. At this
12797 	 * point it is still relative to the start of the minor device.
12798 	 */
12799 	blocknum = xp->xb_blkno;
12800 
12801 	/*
12802 	 * Legacy: If the starting block number is one past the last block
12803 	 * in the partition, do not set B_ERROR in the buf.
12804 	 */
12805 	if (blocknum == nblocks)  {
12806 		goto error_exit;
12807 	}
12808 
12809 	/*
12810 	 * Confirm that the first block of the request lies within the
12811 	 * partition limits. Also the requested number of bytes must be
12812 	 * a multiple of the system block size.
12813 	 */
12814 	if ((blocknum < 0) || (blocknum >= nblocks) ||
12815 	    ((bp->b_bcount & (DEV_BSIZE - 1)) != 0)) {
12816 		bp->b_flags |= B_ERROR;
12817 		goto error_exit;
12818 	}
12819 
12820 	/*
12821 	 * If the requsted # blocks exceeds the available # blocks, that
12822 	 * is an overrun of the partition.
12823 	 */
12824 	if ((!NOT_DEVBSIZE(un)) && is_aligned) {
12825 		requested_nblocks = SD_BYTES2TGTBLOCKS(un, bp->b_bcount);
12826 	} else {
12827 		requested_nblocks = SD_BYTES2SYSBLOCKS(bp->b_bcount);
12828 	}
12829 
12830 	available_nblocks = (size_t)(nblocks - blocknum);
12831 	ASSERT(nblocks >= blocknum);
12832 
12833 	if (requested_nblocks > available_nblocks) {
12834 		size_t resid;
12835 
12836 		/*
12837 		 * Allocate an "overrun" buf to allow the request to proceed
12838 		 * for the amount of space available in the partition. The
12839 		 * amount not transferred will be added into the b_resid
12840 		 * when the operation is complete. The overrun buf
12841 		 * replaces the original buf here, and the original buf
12842 		 * is saved inside the overrun buf, for later use.
12843 		 */
12844 		if ((!NOT_DEVBSIZE(un)) && is_aligned) {
12845 			resid = SD_TGTBLOCKS2BYTES(un,
12846 			    (offset_t)(requested_nblocks - available_nblocks));
12847 		} else {
12848 			resid = SD_SYSBLOCKS2BYTES(
12849 			    (offset_t)(requested_nblocks - available_nblocks));
12850 		}
12851 
12852 		size_t count = bp->b_bcount - resid;
12853 		/*
12854 		 * Note: count is an unsigned entity thus it'll NEVER
12855 		 * be less than 0 so ASSERT the original values are
12856 		 * correct.
12857 		 */
12858 		ASSERT(bp->b_bcount >= resid);
12859 
12860 		bp = sd_bioclone_alloc(bp, count, blocknum,
12861 		    (int (*)(struct buf *)) sd_mapblockaddr_iodone);
12862 		xp = SD_GET_XBUF(bp); /* Update for 'new' bp! */
12863 		ASSERT(xp != NULL);
12864 	}
12865 
12866 	/* At this point there should be no residual for this buf. */
12867 	ASSERT(bp->b_resid == 0);
12868 
12869 	/* Convert the block number to an absolute address. */
12870 	xp->xb_blkno += partition_offset;
12871 
12872 	SD_NEXT_IOSTART(index, un, bp);
12873 
12874 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12875 	    "sd_mapblockaddr_iostart: exit 0: buf:0x%p\n", bp);
12876 
12877 	return;
12878 
12879 error_exit:
12880 	bp->b_resid = bp->b_bcount;
12881 	SD_BEGIN_IODONE(index, un, bp);
12882 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12883 	    "sd_mapblockaddr_iostart: exit 1: buf:0x%p\n", bp);
12884 }
12885 
12886 
12887 /*
12888  *    Function: sd_mapblockaddr_iodone
12889  *
12890  * Description: Completion-side processing for partition management.
12891  *
12892  *     Context: May be called under interrupt context
12893  */
12894 
12895 static void
12896 sd_mapblockaddr_iodone(int index, struct sd_lun *un, struct buf *bp)
12897 {
12898 	/* int	partition; */	/* Not used, see below. */
12899 	ASSERT(un != NULL);
12900 	ASSERT(bp != NULL);
12901 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12902 
12903 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12904 	    "sd_mapblockaddr_iodone: entry: buf:0x%p\n", bp);
12905 
12906 	if (bp->b_iodone == (int (*)(struct buf *)) sd_mapblockaddr_iodone) {
12907 		/*
12908 		 * We have an "overrun" buf to deal with...
12909 		 */
12910 		struct sd_xbuf	*xp;
12911 		struct buf	*obp;	/* ptr to the original buf */
12912 
12913 		xp = SD_GET_XBUF(bp);
12914 		ASSERT(xp != NULL);
12915 
12916 		/* Retrieve the pointer to the original buf */
12917 		obp = (struct buf *)xp->xb_private;
12918 		ASSERT(obp != NULL);
12919 
12920 		obp->b_resid = obp->b_bcount - (bp->b_bcount - bp->b_resid);
12921 		bioerror(obp, bp->b_error);
12922 
12923 		sd_bioclone_free(bp);
12924 
12925 		/*
12926 		 * Get back the original buf.
12927 		 * Note that since the restoration of xb_blkno below
12928 		 * was removed, the sd_xbuf is not needed.
12929 		 */
12930 		bp = obp;
12931 		/*
12932 		 * xp = SD_GET_XBUF(bp);
12933 		 * ASSERT(xp != NULL);
12934 		 */
12935 	}
12936 
12937 	/*
12938 	 * Convert sd->xb_blkno back to a minor-device relative value.
12939 	 * Note: this has been commented out, as it is not needed in the
12940 	 * current implementation of the driver (ie, since this function
12941 	 * is at the top of the layering chains, so the info will be
12942 	 * discarded) and it is in the "hot" IO path.
12943 	 *
12944 	 * partition = getminor(bp->b_edev) & SDPART_MASK;
12945 	 * xp->xb_blkno -= un->un_offset[partition];
12946 	 */
12947 
12948 	SD_NEXT_IODONE(index, un, bp);
12949 
12950 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12951 	    "sd_mapblockaddr_iodone: exit: buf:0x%p\n", bp);
12952 }
12953 
12954 
12955 /*
12956  *    Function: sd_mapblocksize_iostart
12957  *
12958  * Description: Convert between system block size (un->un_sys_blocksize)
12959  *		and target block size (un->un_tgt_blocksize).
12960  *
12961  *     Context: Can sleep to allocate resources.
12962  *
12963  * Assumptions: A higher layer has already performed any partition validation,
12964  *		and converted the xp->xb_blkno to an absolute value relative
12965  *		to the start of the device.
12966  *
12967  *		It is also assumed that the higher layer has implemented
12968  *		an "overrun" mechanism for the case where the request would
12969  *		read/write beyond the end of a partition.  In this case we
12970  *		assume (and ASSERT) that bp->b_resid == 0.
12971  *
12972  *		Note: The implementation for this routine assumes the target
12973  *		block size remains constant between allocation and transport.
12974  */
12975 
12976 static void
12977 sd_mapblocksize_iostart(int index, struct sd_lun *un, struct buf *bp)
12978 {
12979 	struct sd_mapblocksize_info	*bsp;
12980 	struct sd_xbuf			*xp;
12981 	offset_t first_byte;
12982 	daddr_t	start_block, end_block;
12983 	daddr_t	request_bytes;
12984 	ushort_t is_aligned = FALSE;
12985 
12986 	ASSERT(un != NULL);
12987 	ASSERT(bp != NULL);
12988 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12989 	ASSERT(bp->b_resid == 0);
12990 
12991 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
12992 	    "sd_mapblocksize_iostart: entry: buf:0x%p\n", bp);
12993 
12994 	/*
12995 	 * For a non-writable CD, a write request is an error
12996 	 */
12997 	if (ISCD(un) && ((bp->b_flags & B_READ) == 0) &&
12998 	    (un->un_f_mmc_writable_media == FALSE)) {
12999 		bioerror(bp, EIO);
13000 		bp->b_resid = bp->b_bcount;
13001 		SD_BEGIN_IODONE(index, un, bp);
13002 		return;
13003 	}
13004 
13005 	/*
13006 	 * We do not need a shadow buf if the device is using
13007 	 * un->un_sys_blocksize as its block size or if bcount == 0.
13008 	 * In this case there is no layer-private data block allocated.
13009 	 */
13010 	if ((un->un_tgt_blocksize == DEV_BSIZE && !un->un_f_enable_rmw) ||
13011 	    (bp->b_bcount == 0)) {
13012 		goto done;
13013 	}
13014 
13015 #if defined(__i386) || defined(__amd64)
13016 	/* We do not support non-block-aligned transfers for ROD devices */
13017 	ASSERT(!ISROD(un));
13018 #endif
13019 
13020 	xp = SD_GET_XBUF(bp);
13021 	ASSERT(xp != NULL);
13022 
13023 	SD_INFO(SD_LOG_IO_RMMEDIA, un, "sd_mapblocksize_iostart: "
13024 	    "tgt_blocksize:0x%x sys_blocksize: 0x%x\n",
13025 	    un->un_tgt_blocksize, DEV_BSIZE);
13026 	SD_INFO(SD_LOG_IO_RMMEDIA, un, "sd_mapblocksize_iostart: "
13027 	    "request start block:0x%x\n", xp->xb_blkno);
13028 	SD_INFO(SD_LOG_IO_RMMEDIA, un, "sd_mapblocksize_iostart: "
13029 	    "request len:0x%x\n", bp->b_bcount);
13030 
13031 	/*
13032 	 * Allocate the layer-private data area for the mapblocksize layer.
13033 	 * Layers are allowed to use the xp_private member of the sd_xbuf
13034 	 * struct to store the pointer to their layer-private data block, but
13035 	 * each layer also has the responsibility of restoring the prior
13036 	 * contents of xb_private before returning the buf/xbuf to the
13037 	 * higher layer that sent it.
13038 	 *
13039 	 * Here we save the prior contents of xp->xb_private into the
13040 	 * bsp->mbs_oprivate field of our layer-private data area. This value
13041 	 * is restored by sd_mapblocksize_iodone() just prior to freeing up
13042 	 * the layer-private area and returning the buf/xbuf to the layer
13043 	 * that sent it.
13044 	 *
13045 	 * Note that here we use kmem_zalloc for the allocation as there are
13046 	 * parts of the mapblocksize code that expect certain fields to be
13047 	 * zero unless explicitly set to a required value.
13048 	 */
13049 	bsp = kmem_zalloc(sizeof (struct sd_mapblocksize_info), KM_SLEEP);
13050 	bsp->mbs_oprivate = xp->xb_private;
13051 	xp->xb_private = bsp;
13052 
13053 	/*
13054 	 * This treats the data on the disk (target) as an array of bytes.
13055 	 * first_byte is the byte offset, from the beginning of the device,
13056 	 * to the location of the request. This is converted from a
13057 	 * un->un_sys_blocksize block address to a byte offset, and then back
13058 	 * to a block address based upon a un->un_tgt_blocksize block size.
13059 	 *
13060 	 * xp->xb_blkno should be absolute upon entry into this function,
13061 	 * but, but it is based upon partitions that use the "system"
13062 	 * block size. It must be adjusted to reflect the block size of
13063 	 * the target.
13064 	 *
13065 	 * Note that end_block is actually the block that follows the last
13066 	 * block of the request, but that's what is needed for the computation.
13067 	 */
13068 	first_byte  = SD_SYSBLOCKS2BYTES((offset_t)xp->xb_blkno);
13069 	if (un->un_f_enable_rmw) {
13070 		start_block = xp->xb_blkno =
13071 		    (first_byte / un->un_phy_blocksize) *
13072 		    (un->un_phy_blocksize / DEV_BSIZE);
13073 		end_block   = ((first_byte + bp->b_bcount +
13074 		    un->un_phy_blocksize - 1) / un->un_phy_blocksize) *
13075 		    (un->un_phy_blocksize / DEV_BSIZE);
13076 	} else {
13077 		start_block = xp->xb_blkno = first_byte / un->un_tgt_blocksize;
13078 		end_block   = (first_byte + bp->b_bcount +
13079 		    un->un_tgt_blocksize - 1) / un->un_tgt_blocksize;
13080 	}
13081 
13082 	/* request_bytes is rounded up to a multiple of the target block size */
13083 	request_bytes = (end_block - start_block) * un->un_tgt_blocksize;
13084 
13085 	/*
13086 	 * See if the starting address of the request and the request
13087 	 * length are aligned on a un->un_tgt_blocksize boundary. If aligned
13088 	 * then we do not need to allocate a shadow buf to handle the request.
13089 	 */
13090 	if (un->un_f_enable_rmw) {
13091 		if (((first_byte % un->un_phy_blocksize) == 0) &&
13092 		    ((bp->b_bcount % un->un_phy_blocksize) == 0)) {
13093 			is_aligned = TRUE;
13094 		}
13095 	} else {
13096 		if (((first_byte % un->un_tgt_blocksize) == 0) &&
13097 		    ((bp->b_bcount % un->un_tgt_blocksize) == 0)) {
13098 			is_aligned = TRUE;
13099 		}
13100 	}
13101 
13102 	if ((bp->b_flags & B_READ) == 0) {
13103 		/*
13104 		 * Lock the range for a write operation. An aligned request is
13105 		 * considered a simple write; otherwise the request must be a
13106 		 * read-modify-write.
13107 		 */
13108 		bsp->mbs_wmp = sd_range_lock(un, start_block, end_block - 1,
13109 		    (is_aligned == TRUE) ? SD_WTYPE_SIMPLE : SD_WTYPE_RMW);
13110 	}
13111 
13112 	/*
13113 	 * Alloc a shadow buf if the request is not aligned. Also, this is
13114 	 * where the READ command is generated for a read-modify-write. (The
13115 	 * write phase is deferred until after the read completes.)
13116 	 */
13117 	if (is_aligned == FALSE) {
13118 
13119 		struct sd_mapblocksize_info	*shadow_bsp;
13120 		struct sd_xbuf	*shadow_xp;
13121 		struct buf	*shadow_bp;
13122 
13123 		/*
13124 		 * Allocate the shadow buf and it associated xbuf. Note that
13125 		 * after this call the xb_blkno value in both the original
13126 		 * buf's sd_xbuf _and_ the shadow buf's sd_xbuf will be the
13127 		 * same: absolute relative to the start of the device, and
13128 		 * adjusted for the target block size. The b_blkno in the
13129 		 * shadow buf will also be set to this value. We should never
13130 		 * change b_blkno in the original bp however.
13131 		 *
13132 		 * Note also that the shadow buf will always need to be a
13133 		 * READ command, regardless of whether the incoming command
13134 		 * is a READ or a WRITE.
13135 		 */
13136 		shadow_bp = sd_shadow_buf_alloc(bp, request_bytes, B_READ,
13137 		    xp->xb_blkno,
13138 		    (int (*)(struct buf *)) sd_mapblocksize_iodone);
13139 
13140 		shadow_xp = SD_GET_XBUF(shadow_bp);
13141 
13142 		/*
13143 		 * Allocate the layer-private data for the shadow buf.
13144 		 * (No need to preserve xb_private in the shadow xbuf.)
13145 		 */
13146 		shadow_xp->xb_private = shadow_bsp =
13147 		    kmem_zalloc(sizeof (struct sd_mapblocksize_info), KM_SLEEP);
13148 
13149 		/*
13150 		 * bsp->mbs_copy_offset is used later by sd_mapblocksize_iodone
13151 		 * to figure out where the start of the user data is (based upon
13152 		 * the system block size) in the data returned by the READ
13153 		 * command (which will be based upon the target blocksize). Note
13154 		 * that this is only really used if the request is unaligned.
13155 		 */
13156 		if (un->un_f_enable_rmw) {
13157 			bsp->mbs_copy_offset = (ssize_t)(first_byte -
13158 			    ((offset_t)xp->xb_blkno * un->un_sys_blocksize));
13159 			ASSERT((bsp->mbs_copy_offset >= 0) &&
13160 			    (bsp->mbs_copy_offset < un->un_phy_blocksize));
13161 		} else {
13162 			bsp->mbs_copy_offset = (ssize_t)(first_byte -
13163 			    ((offset_t)xp->xb_blkno * un->un_tgt_blocksize));
13164 			ASSERT((bsp->mbs_copy_offset >= 0) &&
13165 			    (bsp->mbs_copy_offset < un->un_tgt_blocksize));
13166 		}
13167 
13168 		shadow_bsp->mbs_copy_offset = bsp->mbs_copy_offset;
13169 
13170 		shadow_bsp->mbs_layer_index = bsp->mbs_layer_index = index;
13171 
13172 		/* Transfer the wmap (if any) to the shadow buf */
13173 		shadow_bsp->mbs_wmp = bsp->mbs_wmp;
13174 		bsp->mbs_wmp = NULL;
13175 
13176 		/*
13177 		 * The shadow buf goes on from here in place of the
13178 		 * original buf.
13179 		 */
13180 		shadow_bsp->mbs_orig_bp = bp;
13181 		bp = shadow_bp;
13182 	}
13183 
13184 	SD_INFO(SD_LOG_IO_RMMEDIA, un,
13185 	    "sd_mapblocksize_iostart: tgt start block:0x%x\n", xp->xb_blkno);
13186 	SD_INFO(SD_LOG_IO_RMMEDIA, un,
13187 	    "sd_mapblocksize_iostart: tgt request len:0x%x\n",
13188 	    request_bytes);
13189 	SD_INFO(SD_LOG_IO_RMMEDIA, un,
13190 	    "sd_mapblocksize_iostart: shadow buf:0x%x\n", bp);
13191 
13192 done:
13193 	SD_NEXT_IOSTART(index, un, bp);
13194 
13195 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
13196 	    "sd_mapblocksize_iostart: exit: buf:0x%p\n", bp);
13197 }
13198 
13199 
13200 /*
13201  *    Function: sd_mapblocksize_iodone
13202  *
13203  * Description: Completion side processing for block-size mapping.
13204  *
13205  *     Context: May be called under interrupt context
13206  */
13207 
13208 static void
13209 sd_mapblocksize_iodone(int index, struct sd_lun *un, struct buf *bp)
13210 {
13211 	struct sd_mapblocksize_info	*bsp;
13212 	struct sd_xbuf	*xp;
13213 	struct sd_xbuf	*orig_xp;	/* sd_xbuf for the original buf */
13214 	struct buf	*orig_bp;	/* ptr to the original buf */
13215 	offset_t	shadow_end;
13216 	offset_t	request_end;
13217 	offset_t	shadow_start;
13218 	ssize_t		copy_offset;
13219 	size_t		copy_length;
13220 	size_t		shortfall;
13221 	uint_t		is_write;	/* TRUE if this bp is a WRITE */
13222 	uint_t		has_wmap;	/* TRUE is this bp has a wmap */
13223 
13224 	ASSERT(un != NULL);
13225 	ASSERT(bp != NULL);
13226 
13227 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
13228 	    "sd_mapblocksize_iodone: entry: buf:0x%p\n", bp);
13229 
13230 	/*
13231 	 * There is no shadow buf or layer-private data if the target is
13232 	 * using un->un_sys_blocksize as its block size or if bcount == 0.
13233 	 */
13234 	if ((un->un_tgt_blocksize == DEV_BSIZE && !un->un_f_enable_rmw) ||
13235 	    (bp->b_bcount == 0)) {
13236 		goto exit;
13237 	}
13238 
13239 	xp = SD_GET_XBUF(bp);
13240 	ASSERT(xp != NULL);
13241 
13242 	/* Retrieve the pointer to the layer-private data area from the xbuf. */
13243 	bsp = xp->xb_private;
13244 
13245 	is_write = ((bp->b_flags & B_READ) == 0) ? TRUE : FALSE;
13246 	has_wmap = (bsp->mbs_wmp != NULL) ? TRUE : FALSE;
13247 
13248 	if (is_write) {
13249 		/*
13250 		 * For a WRITE request we must free up the block range that
13251 		 * we have locked up.  This holds regardless of whether this is
13252 		 * an aligned write request or a read-modify-write request.
13253 		 */
13254 		sd_range_unlock(un, bsp->mbs_wmp);
13255 		bsp->mbs_wmp = NULL;
13256 	}
13257 
13258 	if ((bp->b_iodone != (int(*)(struct buf *))sd_mapblocksize_iodone)) {
13259 		/*
13260 		 * An aligned read or write command will have no shadow buf;
13261 		 * there is not much else to do with it.
13262 		 */
13263 		goto done;
13264 	}
13265 
13266 	orig_bp = bsp->mbs_orig_bp;
13267 	ASSERT(orig_bp != NULL);
13268 	orig_xp = SD_GET_XBUF(orig_bp);
13269 	ASSERT(orig_xp != NULL);
13270 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13271 
13272 	if (!is_write && has_wmap) {
13273 		/*
13274 		 * A READ with a wmap means this is the READ phase of a
13275 		 * read-modify-write. If an error occurred on the READ then
13276 		 * we do not proceed with the WRITE phase or copy any data.
13277 		 * Just release the write maps and return with an error.
13278 		 */
13279 		if ((bp->b_resid != 0) || (bp->b_error != 0)) {
13280 			orig_bp->b_resid = orig_bp->b_bcount;
13281 			bioerror(orig_bp, bp->b_error);
13282 			sd_range_unlock(un, bsp->mbs_wmp);
13283 			goto freebuf_done;
13284 		}
13285 	}
13286 
13287 	/*
13288 	 * Here is where we set up to copy the data from the shadow buf
13289 	 * into the space associated with the original buf.
13290 	 *
13291 	 * To deal with the conversion between block sizes, these
13292 	 * computations treat the data as an array of bytes, with the
13293 	 * first byte (byte 0) corresponding to the first byte in the
13294 	 * first block on the disk.
13295 	 */
13296 
13297 	/*
13298 	 * shadow_start and shadow_len indicate the location and size of
13299 	 * the data returned with the shadow IO request.
13300 	 */
13301 	if (un->un_f_enable_rmw) {
13302 		shadow_start  = SD_SYSBLOCKS2BYTES((offset_t)xp->xb_blkno);
13303 	} else {
13304 		shadow_start  = SD_TGTBLOCKS2BYTES(un, (offset_t)xp->xb_blkno);
13305 	}
13306 	shadow_end    = shadow_start + bp->b_bcount - bp->b_resid;
13307 
13308 	/*
13309 	 * copy_offset gives the offset (in bytes) from the start of the first
13310 	 * block of the READ request to the beginning of the data.  We retrieve
13311 	 * this value from xb_pktp in the ORIGINAL xbuf, as it has been saved
13312 	 * there by sd_mapblockize_iostart(). copy_length gives the amount of
13313 	 * data to be copied (in bytes).
13314 	 */
13315 	copy_offset  = bsp->mbs_copy_offset;
13316 	if (un->un_f_enable_rmw) {
13317 		ASSERT((copy_offset >= 0) &&
13318 		    (copy_offset < un->un_phy_blocksize));
13319 	} else {
13320 		ASSERT((copy_offset >= 0) &&
13321 		    (copy_offset < un->un_tgt_blocksize));
13322 	}
13323 
13324 	copy_length  = orig_bp->b_bcount;
13325 	request_end  = shadow_start + copy_offset + orig_bp->b_bcount;
13326 
13327 	/*
13328 	 * Set up the resid and error fields of orig_bp as appropriate.
13329 	 */
13330 	if (shadow_end >= request_end) {
13331 		/* We got all the requested data; set resid to zero */
13332 		orig_bp->b_resid = 0;
13333 	} else {
13334 		/*
13335 		 * We failed to get enough data to fully satisfy the original
13336 		 * request. Just copy back whatever data we got and set
13337 		 * up the residual and error code as required.
13338 		 *
13339 		 * 'shortfall' is the amount by which the data received with the
13340 		 * shadow buf has "fallen short" of the requested amount.
13341 		 */
13342 		shortfall = (size_t)(request_end - shadow_end);
13343 
13344 		if (shortfall > orig_bp->b_bcount) {
13345 			/*
13346 			 * We did not get enough data to even partially
13347 			 * fulfill the original request.  The residual is
13348 			 * equal to the amount requested.
13349 			 */
13350 			orig_bp->b_resid = orig_bp->b_bcount;
13351 		} else {
13352 			/*
13353 			 * We did not get all the data that we requested
13354 			 * from the device, but we will try to return what
13355 			 * portion we did get.
13356 			 */
13357 			orig_bp->b_resid = shortfall;
13358 		}
13359 		ASSERT(copy_length >= orig_bp->b_resid);
13360 		copy_length  -= orig_bp->b_resid;
13361 	}
13362 
13363 	/* Propagate the error code from the shadow buf to the original buf */
13364 	bioerror(orig_bp, bp->b_error);
13365 
13366 	if (is_write) {
13367 		goto freebuf_done;	/* No data copying for a WRITE */
13368 	}
13369 
13370 	if (has_wmap) {
13371 		/*
13372 		 * This is a READ command from the READ phase of a
13373 		 * read-modify-write request. We have to copy the data given
13374 		 * by the user OVER the data returned by the READ command,
13375 		 * then convert the command from a READ to a WRITE and send
13376 		 * it back to the target.
13377 		 */
13378 		bcopy(orig_bp->b_un.b_addr, bp->b_un.b_addr + copy_offset,
13379 		    copy_length);
13380 
13381 		bp->b_flags &= ~((int)B_READ);	/* Convert to a WRITE */
13382 
13383 		/*
13384 		 * Dispatch the WRITE command to the taskq thread, which
13385 		 * will in turn send the command to the target. When the
13386 		 * WRITE command completes, we (sd_mapblocksize_iodone())
13387 		 * will get called again as part of the iodone chain
13388 		 * processing for it. Note that we will still be dealing
13389 		 * with the shadow buf at that point.
13390 		 */
13391 		if (taskq_dispatch(sd_wmr_tq, sd_read_modify_write_task, bp,
13392 		    KM_NOSLEEP) != TASKQID_INVALID) {
13393 			/*
13394 			 * Dispatch was successful so we are done. Return
13395 			 * without going any higher up the iodone chain. Do
13396 			 * not free up any layer-private data until after the
13397 			 * WRITE completes.
13398 			 */
13399 			return;
13400 		}
13401 
13402 		/*
13403 		 * Dispatch of the WRITE command failed; set up the error
13404 		 * condition and send this IO back up the iodone chain.
13405 		 */
13406 		bioerror(orig_bp, EIO);
13407 		orig_bp->b_resid = orig_bp->b_bcount;
13408 
13409 	} else {
13410 		/*
13411 		 * This is a regular READ request (ie, not a RMW). Copy the
13412 		 * data from the shadow buf into the original buf. The
13413 		 * copy_offset compensates for any "misalignment" between the
13414 		 * shadow buf (with its un->un_tgt_blocksize blocks) and the
13415 		 * original buf (with its un->un_sys_blocksize blocks).
13416 		 */
13417 		bcopy(bp->b_un.b_addr + copy_offset, orig_bp->b_un.b_addr,
13418 		    copy_length);
13419 	}
13420 
13421 freebuf_done:
13422 
13423 	/*
13424 	 * At this point we still have both the shadow buf AND the original
13425 	 * buf to deal with, as well as the layer-private data area in each.
13426 	 * Local variables are as follows:
13427 	 *
13428 	 * bp -- points to shadow buf
13429 	 * xp -- points to xbuf of shadow buf
13430 	 * bsp -- points to layer-private data area of shadow buf
13431 	 * orig_bp -- points to original buf
13432 	 *
13433 	 * First free the shadow buf and its associated xbuf, then free the
13434 	 * layer-private data area from the shadow buf. There is no need to
13435 	 * restore xb_private in the shadow xbuf.
13436 	 */
13437 	sd_shadow_buf_free(bp);
13438 	kmem_free(bsp, sizeof (struct sd_mapblocksize_info));
13439 
13440 	/*
13441 	 * Now update the local variables to point to the original buf, xbuf,
13442 	 * and layer-private area.
13443 	 */
13444 	bp = orig_bp;
13445 	xp = SD_GET_XBUF(bp);
13446 	ASSERT(xp != NULL);
13447 	ASSERT(xp == orig_xp);
13448 	bsp = xp->xb_private;
13449 	ASSERT(bsp != NULL);
13450 
13451 done:
13452 	/*
13453 	 * Restore xb_private to whatever it was set to by the next higher
13454 	 * layer in the chain, then free the layer-private data area.
13455 	 */
13456 	xp->xb_private = bsp->mbs_oprivate;
13457 	kmem_free(bsp, sizeof (struct sd_mapblocksize_info));
13458 
13459 exit:
13460 	SD_TRACE(SD_LOG_IO_RMMEDIA, SD_GET_UN(bp),
13461 	    "sd_mapblocksize_iodone: calling SD_NEXT_IODONE: buf:0x%p\n", bp);
13462 
13463 	SD_NEXT_IODONE(index, un, bp);
13464 }
13465 
13466 
13467 /*
13468  *    Function: sd_checksum_iostart
13469  *
13470  * Description: A stub function for a layer that's currently not used.
13471  *		For now just a placeholder.
13472  *
13473  *     Context: Kernel thread context
13474  */
13475 
13476 static void
13477 sd_checksum_iostart(int index, struct sd_lun *un, struct buf *bp)
13478 {
13479 	ASSERT(un != NULL);
13480 	ASSERT(bp != NULL);
13481 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13482 	SD_NEXT_IOSTART(index, un, bp);
13483 }
13484 
13485 
13486 /*
13487  *    Function: sd_checksum_iodone
13488  *
13489  * Description: A stub function for a layer that's currently not used.
13490  *		For now just a placeholder.
13491  *
13492  *     Context: May be called under interrupt context
13493  */
13494 
13495 static void
13496 sd_checksum_iodone(int index, struct sd_lun *un, struct buf *bp)
13497 {
13498 	ASSERT(un != NULL);
13499 	ASSERT(bp != NULL);
13500 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13501 	SD_NEXT_IODONE(index, un, bp);
13502 }
13503 
13504 
13505 /*
13506  *    Function: sd_checksum_uscsi_iostart
13507  *
13508  * Description: A stub function for a layer that's currently not used.
13509  *		For now just a placeholder.
13510  *
13511  *     Context: Kernel thread context
13512  */
13513 
13514 static void
13515 sd_checksum_uscsi_iostart(int index, struct sd_lun *un, struct buf *bp)
13516 {
13517 	ASSERT(un != NULL);
13518 	ASSERT(bp != NULL);
13519 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13520 	SD_NEXT_IOSTART(index, un, bp);
13521 }
13522 
13523 
13524 /*
13525  *    Function: sd_checksum_uscsi_iodone
13526  *
13527  * Description: A stub function for a layer that's currently not used.
13528  *		For now just a placeholder.
13529  *
13530  *     Context: May be called under interrupt context
13531  */
13532 
13533 static void
13534 sd_checksum_uscsi_iodone(int index, struct sd_lun *un, struct buf *bp)
13535 {
13536 	ASSERT(un != NULL);
13537 	ASSERT(bp != NULL);
13538 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13539 	SD_NEXT_IODONE(index, un, bp);
13540 }
13541 
13542 
13543 /*
13544  *    Function: sd_pm_iostart
13545  *
13546  * Description: iostart-side routine for Power mangement.
13547  *
13548  *     Context: Kernel thread context
13549  */
13550 
13551 static void
13552 sd_pm_iostart(int index, struct sd_lun *un, struct buf *bp)
13553 {
13554 	ASSERT(un != NULL);
13555 	ASSERT(bp != NULL);
13556 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13557 	ASSERT(!mutex_owned(&un->un_pm_mutex));
13558 
13559 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iostart: entry\n");
13560 
13561 	if (sd_pm_entry(un) != DDI_SUCCESS) {
13562 		/*
13563 		 * Set up to return the failed buf back up the 'iodone'
13564 		 * side of the calling chain.
13565 		 */
13566 		bioerror(bp, EIO);
13567 		bp->b_resid = bp->b_bcount;
13568 
13569 		SD_BEGIN_IODONE(index, un, bp);
13570 
13571 		SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iostart: exit\n");
13572 		return;
13573 	}
13574 
13575 	SD_NEXT_IOSTART(index, un, bp);
13576 
13577 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iostart: exit\n");
13578 }
13579 
13580 
13581 /*
13582  *    Function: sd_pm_iodone
13583  *
13584  * Description: iodone-side routine for power mangement.
13585  *
13586  *     Context: may be called from interrupt context
13587  */
13588 
13589 static void
13590 sd_pm_iodone(int index, struct sd_lun *un, struct buf *bp)
13591 {
13592 	ASSERT(un != NULL);
13593 	ASSERT(bp != NULL);
13594 	ASSERT(!mutex_owned(&un->un_pm_mutex));
13595 
13596 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iodone: entry\n");
13597 
13598 	/*
13599 	 * After attach the following flag is only read, so don't
13600 	 * take the penalty of acquiring a mutex for it.
13601 	 */
13602 	if (un->un_f_pm_is_enabled == TRUE) {
13603 		sd_pm_exit(un);
13604 	}
13605 
13606 	SD_NEXT_IODONE(index, un, bp);
13607 
13608 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iodone: exit\n");
13609 }
13610 
13611 
13612 /*
13613  *    Function: sd_core_iostart
13614  *
13615  * Description: Primary driver function for enqueuing buf(9S) structs from
13616  *		the system and initiating IO to the target device
13617  *
13618  *     Context: Kernel thread context. Can sleep.
13619  *
13620  * Assumptions:  - The given xp->xb_blkno is absolute
13621  *		   (ie, relative to the start of the device).
13622  *		 - The IO is to be done using the native blocksize of
13623  *		   the device, as specified in un->un_tgt_blocksize.
13624  */
13625 /* ARGSUSED */
13626 static void
13627 sd_core_iostart(int index, struct sd_lun *un, struct buf *bp)
13628 {
13629 	struct sd_xbuf *xp;
13630 
13631 	ASSERT(un != NULL);
13632 	ASSERT(bp != NULL);
13633 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13634 	ASSERT(bp->b_resid == 0);
13635 
13636 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_core_iostart: entry: bp:0x%p\n", bp);
13637 
13638 	xp = SD_GET_XBUF(bp);
13639 	ASSERT(xp != NULL);
13640 
13641 	mutex_enter(SD_MUTEX(un));
13642 
13643 	/*
13644 	 * If we are currently in the failfast state, fail any new IO
13645 	 * that has B_FAILFAST set, then return.
13646 	 */
13647 	if ((bp->b_flags & B_FAILFAST) &&
13648 	    (un->un_failfast_state == SD_FAILFAST_ACTIVE)) {
13649 		mutex_exit(SD_MUTEX(un));
13650 		bioerror(bp, EIO);
13651 		bp->b_resid = bp->b_bcount;
13652 		SD_BEGIN_IODONE(index, un, bp);
13653 		return;
13654 	}
13655 
13656 	if (SD_IS_DIRECT_PRIORITY(xp)) {
13657 		/*
13658 		 * Priority command -- transport it immediately.
13659 		 *
13660 		 * Note: We may want to assert that USCSI_DIAGNOSE is set,
13661 		 * because all direct priority commands should be associated
13662 		 * with error recovery actions which we don't want to retry.
13663 		 */
13664 		sd_start_cmds(un, bp);
13665 	} else {
13666 		/*
13667 		 * Normal command -- add it to the wait queue, then start
13668 		 * transporting commands from the wait queue.
13669 		 */
13670 		sd_add_buf_to_waitq(un, bp);
13671 		SD_UPDATE_KSTATS(un, kstat_waitq_enter, bp);
13672 		sd_start_cmds(un, NULL);
13673 	}
13674 
13675 	mutex_exit(SD_MUTEX(un));
13676 
13677 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_core_iostart: exit: bp:0x%p\n", bp);
13678 }
13679 
13680 
13681 /*
13682  *    Function: sd_init_cdb_limits
13683  *
13684  * Description: This is to handle scsi_pkt initialization differences
13685  *		between the driver platforms.
13686  *
13687  *		Legacy behaviors:
13688  *
13689  *		If the block number or the sector count exceeds the
13690  *		capabilities of a Group 0 command, shift over to a
13691  *		Group 1 command. We don't blindly use Group 1
13692  *		commands because a) some drives (CDC Wren IVs) get a
13693  *		bit confused, and b) there is probably a fair amount
13694  *		of speed difference for a target to receive and decode
13695  *		a 10 byte command instead of a 6 byte command.
13696  *
13697  *		The xfer time difference of 6 vs 10 byte CDBs is
13698  *		still significant so this code is still worthwhile.
13699  *		10 byte CDBs are very inefficient with the fas HBA driver
13700  *		and older disks. Each CDB byte took 1 usec with some
13701  *		popular disks.
13702  *
13703  *     Context: Must be called at attach time
13704  */
13705 
13706 static void
13707 sd_init_cdb_limits(struct sd_lun *un)
13708 {
13709 	int hba_cdb_limit;
13710 
13711 	/*
13712 	 * Use CDB_GROUP1 commands for most devices except for
13713 	 * parallel SCSI fixed drives in which case we get better
13714 	 * performance using CDB_GROUP0 commands (where applicable).
13715 	 */
13716 	un->un_mincdb = SD_CDB_GROUP1;
13717 #if !defined(__fibre)
13718 	if (!un->un_f_is_fibre && !un->un_f_cfg_is_atapi && !ISROD(un) &&
13719 	    !un->un_f_has_removable_media) {
13720 		un->un_mincdb = SD_CDB_GROUP0;
13721 	}
13722 #endif
13723 
13724 	/*
13725 	 * Try to read the max-cdb-length supported by HBA.
13726 	 */
13727 	un->un_max_hba_cdb = scsi_ifgetcap(SD_ADDRESS(un), "max-cdb-length", 1);
13728 	if (0 >= un->un_max_hba_cdb) {
13729 		un->un_max_hba_cdb = CDB_GROUP4;
13730 		hba_cdb_limit = SD_CDB_GROUP4;
13731 	} else if (0 < un->un_max_hba_cdb &&
13732 	    un->un_max_hba_cdb < CDB_GROUP1) {
13733 		hba_cdb_limit = SD_CDB_GROUP0;
13734 	} else if (CDB_GROUP1 <= un->un_max_hba_cdb &&
13735 	    un->un_max_hba_cdb < CDB_GROUP5) {
13736 		hba_cdb_limit = SD_CDB_GROUP1;
13737 	} else if (CDB_GROUP5 <= un->un_max_hba_cdb &&
13738 	    un->un_max_hba_cdb < CDB_GROUP4) {
13739 		hba_cdb_limit = SD_CDB_GROUP5;
13740 	} else {
13741 		hba_cdb_limit = SD_CDB_GROUP4;
13742 	}
13743 
13744 	/*
13745 	 * Use CDB_GROUP5 commands for removable devices.  Use CDB_GROUP4
13746 	 * commands for fixed disks unless we are building for a 32 bit
13747 	 * kernel.
13748 	 */
13749 #ifdef _LP64
13750 	un->un_maxcdb = (un->un_f_has_removable_media) ? SD_CDB_GROUP5 :
13751 	    min(hba_cdb_limit, SD_CDB_GROUP4);
13752 #else
13753 	un->un_maxcdb = (un->un_f_has_removable_media) ? SD_CDB_GROUP5 :
13754 	    min(hba_cdb_limit, SD_CDB_GROUP1);
13755 #endif
13756 
13757 	un->un_status_len = (int)((un->un_f_arq_enabled == TRUE)
13758 	    ? sizeof (struct scsi_arq_status) : 1);
13759 	if (!ISCD(un))
13760 		un->un_cmd_timeout = (ushort_t)sd_io_time;
13761 	un->un_uscsi_timeout = ((ISCD(un)) ? 2 : 1) * un->un_cmd_timeout;
13762 }
13763 
13764 
13765 /*
13766  *    Function: sd_initpkt_for_buf
13767  *
13768  * Description: Allocate and initialize for transport a scsi_pkt struct,
13769  *		based upon the info specified in the given buf struct.
13770  *
13771  *		Assumes the xb_blkno in the request is absolute (ie,
13772  *		relative to the start of the device (NOT partition!).
13773  *		Also assumes that the request is using the native block
13774  *		size of the device (as returned by the READ CAPACITY
13775  *		command).
13776  *
13777  * Return Code: SD_PKT_ALLOC_SUCCESS
13778  *		SD_PKT_ALLOC_FAILURE
13779  *		SD_PKT_ALLOC_FAILURE_NO_DMA
13780  *		SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL
13781  *
13782  *     Context: Kernel thread and may be called from software interrupt context
13783  *		as part of a sdrunout callback. This function may not block or
13784  *		call routines that block
13785  */
13786 
13787 static int
13788 sd_initpkt_for_buf(struct buf *bp, struct scsi_pkt **pktpp)
13789 {
13790 	struct sd_xbuf	*xp;
13791 	struct scsi_pkt *pktp = NULL;
13792 	struct sd_lun	*un;
13793 	size_t		blockcount;
13794 	daddr_t		startblock;
13795 	int		rval;
13796 	int		cmd_flags;
13797 
13798 	ASSERT(bp != NULL);
13799 	ASSERT(pktpp != NULL);
13800 	xp = SD_GET_XBUF(bp);
13801 	ASSERT(xp != NULL);
13802 	un = SD_GET_UN(bp);
13803 	ASSERT(un != NULL);
13804 	ASSERT(mutex_owned(SD_MUTEX(un)));
13805 	ASSERT(bp->b_resid == 0);
13806 
13807 	SD_TRACE(SD_LOG_IO_CORE, un,
13808 	    "sd_initpkt_for_buf: entry: buf:0x%p\n", bp);
13809 
13810 	mutex_exit(SD_MUTEX(un));
13811 
13812 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
13813 	if (xp->xb_pkt_flags & SD_XB_DMA_FREED) {
13814 		/*
13815 		 * Already have a scsi_pkt -- just need DMA resources.
13816 		 * We must recompute the CDB in case the mapping returns
13817 		 * a nonzero pkt_resid.
13818 		 * Note: if this is a portion of a PKT_DMA_PARTIAL transfer
13819 		 * that is being retried, the unmap/remap of the DMA resouces
13820 		 * will result in the entire transfer starting over again
13821 		 * from the very first block.
13822 		 */
13823 		ASSERT(xp->xb_pktp != NULL);
13824 		pktp = xp->xb_pktp;
13825 	} else {
13826 		pktp = NULL;
13827 	}
13828 #endif /* __i386 || __amd64 */
13829 
13830 	startblock = xp->xb_blkno;	/* Absolute block num. */
13831 	blockcount = SD_BYTES2TGTBLOCKS(un, bp->b_bcount);
13832 
13833 	cmd_flags = un->un_pkt_flags | (xp->xb_pkt_flags & SD_XB_INITPKT_MASK);
13834 
13835 	/*
13836 	 * sd_setup_rw_pkt will determine the appropriate CDB group to use,
13837 	 * call scsi_init_pkt, and build the CDB.
13838 	 */
13839 	rval = sd_setup_rw_pkt(un, &pktp, bp,
13840 	    cmd_flags, sdrunout, (caddr_t)un,
13841 	    startblock, blockcount);
13842 
13843 	if (rval == 0) {
13844 		/*
13845 		 * Success.
13846 		 *
13847 		 * If partial DMA is being used and required for this transfer.
13848 		 * set it up here.
13849 		 */
13850 		if ((un->un_pkt_flags & PKT_DMA_PARTIAL) != 0 &&
13851 		    (pktp->pkt_resid != 0)) {
13852 
13853 			/*
13854 			 * Save the CDB length and pkt_resid for the
13855 			 * next xfer
13856 			 */
13857 			xp->xb_dma_resid = pktp->pkt_resid;
13858 
13859 			/* rezero resid */
13860 			pktp->pkt_resid = 0;
13861 
13862 		} else {
13863 			xp->xb_dma_resid = 0;
13864 		}
13865 
13866 		pktp->pkt_flags = un->un_tagflags;
13867 		pktp->pkt_time  = un->un_cmd_timeout;
13868 		pktp->pkt_comp  = sdintr;
13869 
13870 		pktp->pkt_private = bp;
13871 		*pktpp = pktp;
13872 
13873 		SD_TRACE(SD_LOG_IO_CORE, un,
13874 		    "sd_initpkt_for_buf: exit: buf:0x%p\n", bp);
13875 
13876 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
13877 		xp->xb_pkt_flags &= ~SD_XB_DMA_FREED;
13878 #endif
13879 
13880 		mutex_enter(SD_MUTEX(un));
13881 		return (SD_PKT_ALLOC_SUCCESS);
13882 
13883 	}
13884 
13885 	/*
13886 	 * SD_PKT_ALLOC_FAILURE is the only expected failure code
13887 	 * from sd_setup_rw_pkt.
13888 	 */
13889 	ASSERT(rval == SD_PKT_ALLOC_FAILURE);
13890 
13891 	if (rval == SD_PKT_ALLOC_FAILURE) {
13892 		*pktpp = NULL;
13893 		/*
13894 		 * Set the driver state to RWAIT to indicate the driver
13895 		 * is waiting on resource allocations. The driver will not
13896 		 * suspend, pm_suspend, or detatch while the state is RWAIT.
13897 		 */
13898 		mutex_enter(SD_MUTEX(un));
13899 		New_state(un, SD_STATE_RWAIT);
13900 
13901 		SD_ERROR(SD_LOG_IO_CORE, un,
13902 		    "sd_initpkt_for_buf: No pktp. exit bp:0x%p\n", bp);
13903 
13904 		if ((bp->b_flags & B_ERROR) != 0) {
13905 			return (SD_PKT_ALLOC_FAILURE_NO_DMA);
13906 		}
13907 		return (SD_PKT_ALLOC_FAILURE);
13908 	} else {
13909 		/*
13910 		 * PKT_ALLOC_FAILURE_CDB_TOO_SMALL
13911 		 *
13912 		 * This should never happen.  Maybe someone messed with the
13913 		 * kernel's minphys?
13914 		 */
13915 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
13916 		    "Request rejected: too large for CDB: "
13917 		    "lba:0x%08lx  len:0x%08lx\n", startblock, blockcount);
13918 		SD_ERROR(SD_LOG_IO_CORE, un,
13919 		    "sd_initpkt_for_buf: No cp. exit bp:0x%p\n", bp);
13920 		mutex_enter(SD_MUTEX(un));
13921 		return (SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL);
13922 
13923 	}
13924 }
13925 
13926 
13927 /*
13928  *    Function: sd_destroypkt_for_buf
13929  *
13930  * Description: Free the scsi_pkt(9S) for the given bp (buf IO processing).
13931  *
13932  *     Context: Kernel thread or interrupt context
13933  */
13934 
13935 static void
13936 sd_destroypkt_for_buf(struct buf *bp)
13937 {
13938 	ASSERT(bp != NULL);
13939 	ASSERT(SD_GET_UN(bp) != NULL);
13940 
13941 	SD_TRACE(SD_LOG_IO_CORE, SD_GET_UN(bp),
13942 	    "sd_destroypkt_for_buf: entry: buf:0x%p\n", bp);
13943 
13944 	ASSERT(SD_GET_PKTP(bp) != NULL);
13945 	scsi_destroy_pkt(SD_GET_PKTP(bp));
13946 
13947 	SD_TRACE(SD_LOG_IO_CORE, SD_GET_UN(bp),
13948 	    "sd_destroypkt_for_buf: exit: buf:0x%p\n", bp);
13949 }
13950 
13951 /*
13952  *    Function: sd_setup_rw_pkt
13953  *
13954  * Description: Determines appropriate CDB group for the requested LBA
13955  *		and transfer length, calls scsi_init_pkt, and builds
13956  *		the CDB.  Do not use for partial DMA transfers except
13957  *		for the initial transfer since the CDB size must
13958  *		remain constant.
13959  *
13960  *     Context: Kernel thread and may be called from software interrupt
13961  *		context as part of a sdrunout callback. This function may not
13962  *		block or call routines that block
13963  */
13964 
13965 
13966 int
13967 sd_setup_rw_pkt(struct sd_lun *un,
13968     struct scsi_pkt **pktpp, struct buf *bp, int flags,
13969     int (*callback)(caddr_t), caddr_t callback_arg,
13970     diskaddr_t lba, uint32_t blockcount)
13971 {
13972 	struct scsi_pkt *return_pktp;
13973 	union scsi_cdb *cdbp;
13974 	struct sd_cdbinfo *cp = NULL;
13975 	int i;
13976 
13977 	/*
13978 	 * See which size CDB to use, based upon the request.
13979 	 */
13980 	for (i = un->un_mincdb; i <= un->un_maxcdb; i++) {
13981 
13982 		/*
13983 		 * Check lba and block count against sd_cdbtab limits.
13984 		 * In the partial DMA case, we have to use the same size
13985 		 * CDB for all the transfers.  Check lba + blockcount
13986 		 * against the max LBA so we know that segment of the
13987 		 * transfer can use the CDB we select.
13988 		 */
13989 		if ((lba + blockcount - 1 <= sd_cdbtab[i].sc_maxlba) &&
13990 		    (blockcount <= sd_cdbtab[i].sc_maxlen)) {
13991 
13992 			/*
13993 			 * The command will fit into the CDB type
13994 			 * specified by sd_cdbtab[i].
13995 			 */
13996 			cp = sd_cdbtab + i;
13997 
13998 			/*
13999 			 * Call scsi_init_pkt so we can fill in the
14000 			 * CDB.
14001 			 */
14002 			return_pktp = scsi_init_pkt(SD_ADDRESS(un), *pktpp,
14003 			    bp, cp->sc_grpcode, un->un_status_len, 0,
14004 			    flags, callback, callback_arg);
14005 
14006 			if (return_pktp != NULL) {
14007 
14008 				/*
14009 				 * Return new value of pkt
14010 				 */
14011 				*pktpp = return_pktp;
14012 
14013 				/*
14014 				 * To be safe, zero the CDB insuring there is
14015 				 * no leftover data from a previous command.
14016 				 */
14017 				bzero(return_pktp->pkt_cdbp, cp->sc_grpcode);
14018 
14019 				/*
14020 				 * Handle partial DMA mapping
14021 				 */
14022 				if (return_pktp->pkt_resid != 0) {
14023 
14024 					/*
14025 					 * Not going to xfer as many blocks as
14026 					 * originally expected
14027 					 */
14028 					blockcount -=
14029 					    SD_BYTES2TGTBLOCKS(un,
14030 					    return_pktp->pkt_resid);
14031 				}
14032 
14033 				cdbp = (union scsi_cdb *)return_pktp->pkt_cdbp;
14034 
14035 				/*
14036 				 * Set command byte based on the CDB
14037 				 * type we matched.
14038 				 */
14039 				cdbp->scc_cmd = cp->sc_grpmask |
14040 				    ((bp->b_flags & B_READ) ?
14041 				    SCMD_READ : SCMD_WRITE);
14042 
14043 				SD_FILL_SCSI1_LUN(un, return_pktp);
14044 
14045 				/*
14046 				 * Fill in LBA and length
14047 				 */
14048 				ASSERT((cp->sc_grpcode == CDB_GROUP1) ||
14049 				    (cp->sc_grpcode == CDB_GROUP4) ||
14050 				    (cp->sc_grpcode == CDB_GROUP0) ||
14051 				    (cp->sc_grpcode == CDB_GROUP5));
14052 
14053 				if (cp->sc_grpcode == CDB_GROUP1) {
14054 					FORMG1ADDR(cdbp, lba);
14055 					FORMG1COUNT(cdbp, blockcount);
14056 					return (0);
14057 				} else if (cp->sc_grpcode == CDB_GROUP4) {
14058 					FORMG4LONGADDR(cdbp, lba);
14059 					FORMG4COUNT(cdbp, blockcount);
14060 					return (0);
14061 				} else if (cp->sc_grpcode == CDB_GROUP0) {
14062 					FORMG0ADDR(cdbp, lba);
14063 					FORMG0COUNT(cdbp, blockcount);
14064 					return (0);
14065 				} else if (cp->sc_grpcode == CDB_GROUP5) {
14066 					FORMG5ADDR(cdbp, lba);
14067 					FORMG5COUNT(cdbp, blockcount);
14068 					return (0);
14069 				}
14070 
14071 				/*
14072 				 * It should be impossible to not match one
14073 				 * of the CDB types above, so we should never
14074 				 * reach this point.  Set the CDB command byte
14075 				 * to test-unit-ready to avoid writing
14076 				 * to somewhere we don't intend.
14077 				 */
14078 				cdbp->scc_cmd = SCMD_TEST_UNIT_READY;
14079 				return (SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL);
14080 			} else {
14081 				/*
14082 				 * Couldn't get scsi_pkt
14083 				 */
14084 				return (SD_PKT_ALLOC_FAILURE);
14085 			}
14086 		}
14087 	}
14088 
14089 	/*
14090 	 * None of the available CDB types were suitable.  This really
14091 	 * should never happen:  on a 64 bit system we support
14092 	 * READ16/WRITE16 which will hold an entire 64 bit disk address
14093 	 * and on a 32 bit system we will refuse to bind to a device
14094 	 * larger than 2TB so addresses will never be larger than 32 bits.
14095 	 */
14096 	return (SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL);
14097 }
14098 
14099 /*
14100  *    Function: sd_setup_next_rw_pkt
14101  *
14102  * Description: Setup packet for partial DMA transfers, except for the
14103  *		initial transfer.  sd_setup_rw_pkt should be used for
14104  *		the initial transfer.
14105  *
14106  *     Context: Kernel thread and may be called from interrupt context.
14107  */
14108 
14109 int
14110 sd_setup_next_rw_pkt(struct sd_lun *un,
14111     struct scsi_pkt *pktp, struct buf *bp,
14112     diskaddr_t lba, uint32_t blockcount)
14113 {
14114 	uchar_t com;
14115 	union scsi_cdb *cdbp;
14116 	uchar_t cdb_group_id;
14117 
14118 	ASSERT(pktp != NULL);
14119 	ASSERT(pktp->pkt_cdbp != NULL);
14120 
14121 	cdbp = (union scsi_cdb *)pktp->pkt_cdbp;
14122 	com = cdbp->scc_cmd;
14123 	cdb_group_id = CDB_GROUPID(com);
14124 
14125 	ASSERT((cdb_group_id == CDB_GROUPID_0) ||
14126 	    (cdb_group_id == CDB_GROUPID_1) ||
14127 	    (cdb_group_id == CDB_GROUPID_4) ||
14128 	    (cdb_group_id == CDB_GROUPID_5));
14129 
14130 	/*
14131 	 * Move pkt to the next portion of the xfer.
14132 	 * func is NULL_FUNC so we do not have to release
14133 	 * the disk mutex here.
14134 	 */
14135 	if (scsi_init_pkt(SD_ADDRESS(un), pktp, bp, 0, 0, 0, 0,
14136 	    NULL_FUNC, NULL) == pktp) {
14137 		/* Success.  Handle partial DMA */
14138 		if (pktp->pkt_resid != 0) {
14139 			blockcount -=
14140 			    SD_BYTES2TGTBLOCKS(un, pktp->pkt_resid);
14141 		}
14142 
14143 		cdbp->scc_cmd = com;
14144 		SD_FILL_SCSI1_LUN(un, pktp);
14145 		if (cdb_group_id == CDB_GROUPID_1) {
14146 			FORMG1ADDR(cdbp, lba);
14147 			FORMG1COUNT(cdbp, blockcount);
14148 			return (0);
14149 		} else if (cdb_group_id == CDB_GROUPID_4) {
14150 			FORMG4LONGADDR(cdbp, lba);
14151 			FORMG4COUNT(cdbp, blockcount);
14152 			return (0);
14153 		} else if (cdb_group_id == CDB_GROUPID_0) {
14154 			FORMG0ADDR(cdbp, lba);
14155 			FORMG0COUNT(cdbp, blockcount);
14156 			return (0);
14157 		} else if (cdb_group_id == CDB_GROUPID_5) {
14158 			FORMG5ADDR(cdbp, lba);
14159 			FORMG5COUNT(cdbp, blockcount);
14160 			return (0);
14161 		}
14162 
14163 		/* Unreachable */
14164 		return (SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL);
14165 	}
14166 
14167 	/*
14168 	 * Error setting up next portion of cmd transfer.
14169 	 * Something is definitely very wrong and this
14170 	 * should not happen.
14171 	 */
14172 	return (SD_PKT_ALLOC_FAILURE);
14173 }
14174 
14175 /*
14176  *    Function: sd_initpkt_for_uscsi
14177  *
14178  * Description: Allocate and initialize for transport a scsi_pkt struct,
14179  *		based upon the info specified in the given uscsi_cmd struct.
14180  *
14181  * Return Code: SD_PKT_ALLOC_SUCCESS
14182  *		SD_PKT_ALLOC_FAILURE
14183  *		SD_PKT_ALLOC_FAILURE_NO_DMA
14184  *		SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL
14185  *
14186  *     Context: Kernel thread and may be called from software interrupt context
14187  *		as part of a sdrunout callback. This function may not block or
14188  *		call routines that block
14189  */
14190 
14191 static int
14192 sd_initpkt_for_uscsi(struct buf *bp, struct scsi_pkt **pktpp)
14193 {
14194 	struct uscsi_cmd *uscmd;
14195 	struct sd_xbuf	*xp;
14196 	struct scsi_pkt	*pktp;
14197 	struct sd_lun	*un;
14198 	uint32_t	flags = 0;
14199 
14200 	ASSERT(bp != NULL);
14201 	ASSERT(pktpp != NULL);
14202 	xp = SD_GET_XBUF(bp);
14203 	ASSERT(xp != NULL);
14204 	un = SD_GET_UN(bp);
14205 	ASSERT(un != NULL);
14206 	ASSERT(mutex_owned(SD_MUTEX(un)));
14207 
14208 	/* The pointer to the uscsi_cmd struct is expected in xb_pktinfo */
14209 	uscmd = (struct uscsi_cmd *)xp->xb_pktinfo;
14210 	ASSERT(uscmd != NULL);
14211 
14212 	SD_TRACE(SD_LOG_IO_CORE, un,
14213 	    "sd_initpkt_for_uscsi: entry: buf:0x%p\n", bp);
14214 
14215 	/*
14216 	 * Allocate the scsi_pkt for the command.
14217 	 *
14218 	 * Note: If PKT_DMA_PARTIAL flag is set, scsi_vhci binds a path
14219 	 *	 during scsi_init_pkt time and will continue to use the
14220 	 *	 same path as long as the same scsi_pkt is used without
14221 	 *	 intervening scsi_dmafree(). Since uscsi command does
14222 	 *	 not call scsi_dmafree() before retry failed command, it
14223 	 *	 is necessary to make sure PKT_DMA_PARTIAL flag is NOT
14224 	 *	 set such that scsi_vhci can use other available path for
14225 	 *	 retry. Besides, ucsci command does not allow DMA breakup,
14226 	 *	 so there is no need to set PKT_DMA_PARTIAL flag.
14227 	 *
14228 	 *	 More fundamentally, we can't support breaking up this DMA into
14229 	 *	 multiple windows on x86. There is, in general, no guarantee
14230 	 *	 that arbitrary SCSI commands are idempotent, which is required
14231 	 *	 if we want to use multiple windows for a given command.
14232 	 */
14233 	if (uscmd->uscsi_rqlen > SENSE_LENGTH) {
14234 		pktp = scsi_init_pkt(SD_ADDRESS(un), NULL,
14235 		    ((bp->b_bcount != 0) ? bp : NULL), uscmd->uscsi_cdblen,
14236 		    ((int)(uscmd->uscsi_rqlen) + sizeof (struct scsi_arq_status)
14237 		    - sizeof (struct scsi_extended_sense)), 0,
14238 		    (un->un_pkt_flags & ~PKT_DMA_PARTIAL) | PKT_XARQ,
14239 		    sdrunout, (caddr_t)un);
14240 	} else {
14241 		pktp = scsi_init_pkt(SD_ADDRESS(un), NULL,
14242 		    ((bp->b_bcount != 0) ? bp : NULL), uscmd->uscsi_cdblen,
14243 		    sizeof (struct scsi_arq_status), 0,
14244 		    (un->un_pkt_flags & ~PKT_DMA_PARTIAL),
14245 		    sdrunout, (caddr_t)un);
14246 	}
14247 
14248 	if (pktp == NULL) {
14249 		*pktpp = NULL;
14250 		/*
14251 		 * Set the driver state to RWAIT to indicate the driver
14252 		 * is waiting on resource allocations. The driver will not
14253 		 * suspend, pm_suspend, or detatch while the state is RWAIT.
14254 		 */
14255 		New_state(un, SD_STATE_RWAIT);
14256 
14257 		SD_ERROR(SD_LOG_IO_CORE, un,
14258 		    "sd_initpkt_for_uscsi: No pktp. exit bp:0x%p\n", bp);
14259 
14260 		if ((bp->b_flags & B_ERROR) != 0) {
14261 			return (SD_PKT_ALLOC_FAILURE_NO_DMA);
14262 		}
14263 		return (SD_PKT_ALLOC_FAILURE);
14264 	}
14265 
14266 	/*
14267 	 * We do not do DMA breakup for USCSI commands, so return failure
14268 	 * here if all the needed DMA resources were not allocated.
14269 	 */
14270 	if ((un->un_pkt_flags & PKT_DMA_PARTIAL) &&
14271 	    (bp->b_bcount != 0) && (pktp->pkt_resid != 0)) {
14272 		scsi_destroy_pkt(pktp);
14273 		SD_ERROR(SD_LOG_IO_CORE, un, "sd_initpkt_for_uscsi: "
14274 		    "No partial DMA for USCSI. exit: buf:0x%p\n", bp);
14275 		return (SD_PKT_ALLOC_FAILURE_PKT_TOO_SMALL);
14276 	}
14277 
14278 	/* Init the cdb from the given uscsi struct */
14279 	(void) scsi_setup_cdb((union scsi_cdb *)pktp->pkt_cdbp,
14280 	    uscmd->uscsi_cdb[0], 0, 0, 0);
14281 
14282 	SD_FILL_SCSI1_LUN(un, pktp);
14283 
14284 	/*
14285 	 * Set up the optional USCSI flags. See the uscsi (7I) man page
14286 	 * for listing of the supported flags.
14287 	 */
14288 
14289 	if (uscmd->uscsi_flags & USCSI_SILENT) {
14290 		flags |= FLAG_SILENT;
14291 	}
14292 
14293 	if (uscmd->uscsi_flags & USCSI_DIAGNOSE) {
14294 		flags |= FLAG_DIAGNOSE;
14295 	}
14296 
14297 	if (uscmd->uscsi_flags & USCSI_ISOLATE) {
14298 		flags |= FLAG_ISOLATE;
14299 	}
14300 
14301 	if (un->un_f_is_fibre == FALSE) {
14302 		if (uscmd->uscsi_flags & USCSI_RENEGOT) {
14303 			flags |= FLAG_RENEGOTIATE_WIDE_SYNC;
14304 		}
14305 	}
14306 
14307 	/*
14308 	 * Set the pkt flags here so we save time later.
14309 	 * Note: These flags are NOT in the uscsi man page!!!
14310 	 */
14311 	if (uscmd->uscsi_flags & USCSI_HEAD) {
14312 		flags |= FLAG_HEAD;
14313 	}
14314 
14315 	if (uscmd->uscsi_flags & USCSI_NOINTR) {
14316 		flags |= FLAG_NOINTR;
14317 	}
14318 
14319 	/*
14320 	 * For tagged queueing, things get a bit complicated.
14321 	 * Check first for head of queue and last for ordered queue.
14322 	 * If neither head nor order, use the default driver tag flags.
14323 	 */
14324 	if ((uscmd->uscsi_flags & USCSI_NOTAG) == 0) {
14325 		if (uscmd->uscsi_flags & USCSI_HTAG) {
14326 			flags |= FLAG_HTAG;
14327 		} else if (uscmd->uscsi_flags & USCSI_OTAG) {
14328 			flags |= FLAG_OTAG;
14329 		} else {
14330 			flags |= un->un_tagflags & FLAG_TAGMASK;
14331 		}
14332 	}
14333 
14334 	if (uscmd->uscsi_flags & USCSI_NODISCON) {
14335 		flags = (flags & ~FLAG_TAGMASK) | FLAG_NODISCON;
14336 	}
14337 
14338 	pktp->pkt_flags = flags;
14339 
14340 	/* Transfer uscsi information to scsi_pkt */
14341 	(void) scsi_uscsi_pktinit(uscmd, pktp);
14342 
14343 	/* Copy the caller's CDB into the pkt... */
14344 	bcopy(uscmd->uscsi_cdb, pktp->pkt_cdbp, uscmd->uscsi_cdblen);
14345 
14346 	if (uscmd->uscsi_timeout == 0) {
14347 		pktp->pkt_time = un->un_uscsi_timeout;
14348 	} else {
14349 		pktp->pkt_time = uscmd->uscsi_timeout;
14350 	}
14351 
14352 	/* need it later to identify USCSI request in sdintr */
14353 	xp->xb_pkt_flags |= SD_XB_USCSICMD;
14354 
14355 	xp->xb_sense_resid = uscmd->uscsi_rqresid;
14356 
14357 	pktp->pkt_private = bp;
14358 	pktp->pkt_comp = sdintr;
14359 	*pktpp = pktp;
14360 
14361 	SD_TRACE(SD_LOG_IO_CORE, un,
14362 	    "sd_initpkt_for_uscsi: exit: buf:0x%p\n", bp);
14363 
14364 	return (SD_PKT_ALLOC_SUCCESS);
14365 }
14366 
14367 
14368 /*
14369  *    Function: sd_destroypkt_for_uscsi
14370  *
14371  * Description: Free the scsi_pkt(9S) struct for the given bp, for uscsi
14372  *		IOs.. Also saves relevant info into the associated uscsi_cmd
14373  *		struct.
14374  *
14375  *     Context: May be called under interrupt context
14376  */
14377 
14378 static void
14379 sd_destroypkt_for_uscsi(struct buf *bp)
14380 {
14381 	struct uscsi_cmd *uscmd;
14382 	struct sd_xbuf	*xp;
14383 	struct scsi_pkt	*pktp;
14384 	struct sd_lun	*un;
14385 	struct sd_uscsi_info *suip;
14386 
14387 	ASSERT(bp != NULL);
14388 	xp = SD_GET_XBUF(bp);
14389 	ASSERT(xp != NULL);
14390 	un = SD_GET_UN(bp);
14391 	ASSERT(un != NULL);
14392 	ASSERT(!mutex_owned(SD_MUTEX(un)));
14393 	pktp = SD_GET_PKTP(bp);
14394 	ASSERT(pktp != NULL);
14395 
14396 	SD_TRACE(SD_LOG_IO_CORE, un,
14397 	    "sd_destroypkt_for_uscsi: entry: buf:0x%p\n", bp);
14398 
14399 	/* The pointer to the uscsi_cmd struct is expected in xb_pktinfo */
14400 	uscmd = (struct uscsi_cmd *)xp->xb_pktinfo;
14401 	ASSERT(uscmd != NULL);
14402 
14403 	/* Save the status and the residual into the uscsi_cmd struct */
14404 	uscmd->uscsi_status = ((*(pktp)->pkt_scbp) & STATUS_MASK);
14405 	uscmd->uscsi_resid  = bp->b_resid;
14406 
14407 	/* Transfer scsi_pkt information to uscsi */
14408 	(void) scsi_uscsi_pktfini(pktp, uscmd);
14409 
14410 	/*
14411 	 * If enabled, copy any saved sense data into the area specified
14412 	 * by the uscsi command.
14413 	 */
14414 	if (((uscmd->uscsi_flags & USCSI_RQENABLE) != 0) &&
14415 	    (uscmd->uscsi_rqlen != 0) && (uscmd->uscsi_rqbuf != NULL)) {
14416 		/*
14417 		 * Note: uscmd->uscsi_rqbuf should always point to a buffer
14418 		 * at least SENSE_LENGTH bytes in size (see sd_send_scsi_cmd())
14419 		 */
14420 		uscmd->uscsi_rqstatus = xp->xb_sense_status;
14421 		uscmd->uscsi_rqresid  = xp->xb_sense_resid;
14422 		if (uscmd->uscsi_rqlen > SENSE_LENGTH) {
14423 			bcopy(xp->xb_sense_data, uscmd->uscsi_rqbuf,
14424 			    MAX_SENSE_LENGTH);
14425 		} else {
14426 			bcopy(xp->xb_sense_data, uscmd->uscsi_rqbuf,
14427 			    SENSE_LENGTH);
14428 		}
14429 	}
14430 	/*
14431 	 * The following assignments are for SCSI FMA.
14432 	 */
14433 	ASSERT(xp->xb_private != NULL);
14434 	suip = (struct sd_uscsi_info *)xp->xb_private;
14435 	suip->ui_pkt_reason = pktp->pkt_reason;
14436 	suip->ui_pkt_state = pktp->pkt_state;
14437 	suip->ui_pkt_statistics = pktp->pkt_statistics;
14438 	suip->ui_lba = (uint64_t)SD_GET_BLKNO(bp);
14439 
14440 	/* We are done with the scsi_pkt; free it now */
14441 	ASSERT(SD_GET_PKTP(bp) != NULL);
14442 	scsi_destroy_pkt(SD_GET_PKTP(bp));
14443 
14444 	SD_TRACE(SD_LOG_IO_CORE, un,
14445 	    "sd_destroypkt_for_uscsi: exit: buf:0x%p\n", bp);
14446 }
14447 
14448 
14449 /*
14450  *    Function: sd_bioclone_alloc
14451  *
14452  * Description: Allocate a buf(9S) and init it as per the given buf
14453  *		and the various arguments.  The associated sd_xbuf
14454  *		struct is (nearly) duplicated.  The struct buf *bp
14455  *		argument is saved in new_xp->xb_private.
14456  *
14457  *   Arguments: bp - ptr the the buf(9S) to be "shadowed"
14458  *		datalen - size of data area for the shadow bp
14459  *		blkno - starting LBA
14460  *		func - function pointer for b_iodone in the shadow buf. (May
14461  *			be NULL if none.)
14462  *
14463  * Return Code: Pointer to allocates buf(9S) struct
14464  *
14465  *     Context: Can sleep.
14466  */
14467 
14468 static struct buf *
14469 sd_bioclone_alloc(struct buf *bp, size_t datalen, daddr_t blkno,
14470     int (*func)(struct buf *))
14471 {
14472 	struct	sd_lun	*un;
14473 	struct	sd_xbuf	*xp;
14474 	struct	sd_xbuf	*new_xp;
14475 	struct	buf	*new_bp;
14476 
14477 	ASSERT(bp != NULL);
14478 	xp = SD_GET_XBUF(bp);
14479 	ASSERT(xp != NULL);
14480 	un = SD_GET_UN(bp);
14481 	ASSERT(un != NULL);
14482 	ASSERT(!mutex_owned(SD_MUTEX(un)));
14483 
14484 	new_bp = bioclone(bp, 0, datalen, SD_GET_DEV(un), blkno, func,
14485 	    NULL, KM_SLEEP);
14486 
14487 	new_bp->b_lblkno	= blkno;
14488 
14489 	/*
14490 	 * Allocate an xbuf for the shadow bp and copy the contents of the
14491 	 * original xbuf into it.
14492 	 */
14493 	new_xp = kmem_alloc(sizeof (struct sd_xbuf), KM_SLEEP);
14494 	bcopy(xp, new_xp, sizeof (struct sd_xbuf));
14495 
14496 	/*
14497 	 * The given bp is automatically saved in the xb_private member
14498 	 * of the new xbuf.  Callers are allowed to depend on this.
14499 	 */
14500 	new_xp->xb_private = bp;
14501 
14502 	new_bp->b_private  = new_xp;
14503 
14504 	return (new_bp);
14505 }
14506 
14507 /*
14508  *    Function: sd_shadow_buf_alloc
14509  *
14510  * Description: Allocate a buf(9S) and init it as per the given buf
14511  *		and the various arguments.  The associated sd_xbuf
14512  *		struct is (nearly) duplicated.  The struct buf *bp
14513  *		argument is saved in new_xp->xb_private.
14514  *
14515  *   Arguments: bp - ptr the the buf(9S) to be "shadowed"
14516  *		datalen - size of data area for the shadow bp
14517  *		bflags - B_READ or B_WRITE (pseudo flag)
14518  *		blkno - starting LBA
14519  *		func - function pointer for b_iodone in the shadow buf. (May
14520  *			be NULL if none.)
14521  *
14522  * Return Code: Pointer to allocates buf(9S) struct
14523  *
14524  *     Context: Can sleep.
14525  */
14526 
14527 static struct buf *
14528 sd_shadow_buf_alloc(struct buf *bp, size_t datalen, uint_t bflags,
14529     daddr_t blkno, int (*func)(struct buf *))
14530 {
14531 	struct	sd_lun	*un;
14532 	struct	sd_xbuf	*xp;
14533 	struct	sd_xbuf	*new_xp;
14534 	struct	buf	*new_bp;
14535 
14536 	ASSERT(bp != NULL);
14537 	xp = SD_GET_XBUF(bp);
14538 	ASSERT(xp != NULL);
14539 	un = SD_GET_UN(bp);
14540 	ASSERT(un != NULL);
14541 	ASSERT(!mutex_owned(SD_MUTEX(un)));
14542 
14543 	if (bp->b_flags & (B_PAGEIO | B_PHYS)) {
14544 		bp_mapin(bp);
14545 	}
14546 
14547 	bflags &= (B_READ | B_WRITE);
14548 #if defined(__i386) || defined(__amd64)
14549 	new_bp = getrbuf(KM_SLEEP);
14550 	new_bp->b_un.b_addr = kmem_zalloc(datalen, KM_SLEEP);
14551 	new_bp->b_bcount = datalen;
14552 	new_bp->b_flags = bflags |
14553 	    (bp->b_flags & ~(B_PAGEIO | B_PHYS | B_REMAPPED | B_SHADOW));
14554 #else
14555 	new_bp = scsi_alloc_consistent_buf(SD_ADDRESS(un), NULL,
14556 	    datalen, bflags, SLEEP_FUNC, NULL);
14557 #endif
14558 	new_bp->av_forw	= NULL;
14559 	new_bp->av_back	= NULL;
14560 	new_bp->b_dev	= bp->b_dev;
14561 	new_bp->b_blkno	= blkno;
14562 	new_bp->b_iodone = func;
14563 	new_bp->b_edev	= bp->b_edev;
14564 	new_bp->b_resid	= 0;
14565 
14566 	/* We need to preserve the B_FAILFAST flag */
14567 	if (bp->b_flags & B_FAILFAST) {
14568 		new_bp->b_flags |= B_FAILFAST;
14569 	}
14570 
14571 	/*
14572 	 * Allocate an xbuf for the shadow bp and copy the contents of the
14573 	 * original xbuf into it.
14574 	 */
14575 	new_xp = kmem_alloc(sizeof (struct sd_xbuf), KM_SLEEP);
14576 	bcopy(xp, new_xp, sizeof (struct sd_xbuf));
14577 
14578 	/* Need later to copy data between the shadow buf & original buf! */
14579 	new_xp->xb_pkt_flags |= PKT_CONSISTENT;
14580 
14581 	/*
14582 	 * The given bp is automatically saved in the xb_private member
14583 	 * of the new xbuf.  Callers are allowed to depend on this.
14584 	 */
14585 	new_xp->xb_private = bp;
14586 
14587 	new_bp->b_private  = new_xp;
14588 
14589 	return (new_bp);
14590 }
14591 
14592 /*
14593  *    Function: sd_bioclone_free
14594  *
14595  * Description: Deallocate a buf(9S) that was used for 'shadow' IO operations
14596  *		in the larger than partition operation.
14597  *
14598  *     Context: May be called under interrupt context
14599  */
14600 
14601 static void
14602 sd_bioclone_free(struct buf *bp)
14603 {
14604 	struct sd_xbuf	*xp;
14605 
14606 	ASSERT(bp != NULL);
14607 	xp = SD_GET_XBUF(bp);
14608 	ASSERT(xp != NULL);
14609 
14610 	/*
14611 	 * Call bp_mapout() before freeing the buf,  in case a lower
14612 	 * layer or HBA  had done a bp_mapin().  we must do this here
14613 	 * as we are the "originator" of the shadow buf.
14614 	 */
14615 	bp_mapout(bp);
14616 
14617 	/*
14618 	 * Null out b_iodone before freeing the bp, to ensure that the driver
14619 	 * never gets confused by a stale value in this field. (Just a little
14620 	 * extra defensiveness here.)
14621 	 */
14622 	bp->b_iodone = NULL;
14623 
14624 	freerbuf(bp);
14625 
14626 	kmem_free(xp, sizeof (struct sd_xbuf));
14627 }
14628 
14629 /*
14630  *    Function: sd_shadow_buf_free
14631  *
14632  * Description: Deallocate a buf(9S) that was used for 'shadow' IO operations.
14633  *
14634  *     Context: May be called under interrupt context
14635  */
14636 
14637 static void
14638 sd_shadow_buf_free(struct buf *bp)
14639 {
14640 	struct sd_xbuf	*xp;
14641 
14642 	ASSERT(bp != NULL);
14643 	xp = SD_GET_XBUF(bp);
14644 	ASSERT(xp != NULL);
14645 
14646 #if defined(__sparc)
14647 	/*
14648 	 * Call bp_mapout() before freeing the buf,  in case a lower
14649 	 * layer or HBA  had done a bp_mapin().  we must do this here
14650 	 * as we are the "originator" of the shadow buf.
14651 	 */
14652 	bp_mapout(bp);
14653 #endif
14654 
14655 	/*
14656 	 * Null out b_iodone before freeing the bp, to ensure that the driver
14657 	 * never gets confused by a stale value in this field. (Just a little
14658 	 * extra defensiveness here.)
14659 	 */
14660 	bp->b_iodone = NULL;
14661 
14662 #if defined(__i386) || defined(__amd64)
14663 	kmem_free(bp->b_un.b_addr, bp->b_bcount);
14664 	freerbuf(bp);
14665 #else
14666 	scsi_free_consistent_buf(bp);
14667 #endif
14668 
14669 	kmem_free(xp, sizeof (struct sd_xbuf));
14670 }
14671 
14672 
14673 /*
14674  *    Function: sd_print_transport_rejected_message
14675  *
14676  * Description: This implements the ludicrously complex rules for printing
14677  *		a "transport rejected" message.  This is to address the
14678  *		specific problem of having a flood of this error message
14679  *		produced when a failover occurs.
14680  *
14681  *     Context: Any.
14682  */
14683 
14684 static void
14685 sd_print_transport_rejected_message(struct sd_lun *un, struct sd_xbuf *xp,
14686     int code)
14687 {
14688 	ASSERT(un != NULL);
14689 	ASSERT(mutex_owned(SD_MUTEX(un)));
14690 	ASSERT(xp != NULL);
14691 
14692 	/*
14693 	 * Print the "transport rejected" message under the following
14694 	 * conditions:
14695 	 *
14696 	 * - Whenever the SD_LOGMASK_DIAG bit of sd_level_mask is set
14697 	 * - The error code from scsi_transport() is NOT a TRAN_FATAL_ERROR.
14698 	 * - If the error code IS a TRAN_FATAL_ERROR, then the message is
14699 	 *   printed the FIRST time a TRAN_FATAL_ERROR is returned from
14700 	 *   scsi_transport(9F) (which indicates that the target might have
14701 	 *   gone off-line).  This uses the un->un_tran_fatal_count
14702 	 *   count, which is incremented whenever a TRAN_FATAL_ERROR is
14703 	 *   received, and reset to zero whenver a TRAN_ACCEPT is returned
14704 	 *   from scsi_transport().
14705 	 *
14706 	 * The FLAG_SILENT in the scsi_pkt must be CLEARED in ALL of
14707 	 * the preceeding cases in order for the message to be printed.
14708 	 */
14709 	if (((xp->xb_pktp->pkt_flags & FLAG_SILENT) == 0) &&
14710 	    (SD_FM_LOG(un) == SD_FM_LOG_NSUP)) {
14711 		if ((sd_level_mask & SD_LOGMASK_DIAG) ||
14712 		    (code != TRAN_FATAL_ERROR) ||
14713 		    (un->un_tran_fatal_count == 1)) {
14714 			switch (code) {
14715 			case TRAN_BADPKT:
14716 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
14717 				    "transport rejected bad packet\n");
14718 				break;
14719 			case TRAN_FATAL_ERROR:
14720 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
14721 				    "transport rejected fatal error\n");
14722 				break;
14723 			default:
14724 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
14725 				    "transport rejected (%d)\n", code);
14726 				break;
14727 			}
14728 		}
14729 	}
14730 }
14731 
14732 
14733 /*
14734  *    Function: sd_add_buf_to_waitq
14735  *
14736  * Description: Add the given buf(9S) struct to the wait queue for the
14737  *		instance.  If sorting is enabled, then the buf is added
14738  *		to the queue via an elevator sort algorithm (a la
14739  *		disksort(9F)).  The SD_GET_BLKNO(bp) is used as the sort key.
14740  *		If sorting is not enabled, then the buf is just added
14741  *		to the end of the wait queue.
14742  *
14743  * Return Code: void
14744  *
14745  *     Context: Does not sleep/block, therefore technically can be called
14746  *		from any context.  However if sorting is enabled then the
14747  *		execution time is indeterminate, and may take long if
14748  *		the wait queue grows large.
14749  */
14750 
14751 static void
14752 sd_add_buf_to_waitq(struct sd_lun *un, struct buf *bp)
14753 {
14754 	struct buf *ap;
14755 
14756 	ASSERT(bp != NULL);
14757 	ASSERT(un != NULL);
14758 	ASSERT(mutex_owned(SD_MUTEX(un)));
14759 
14760 	/* If the queue is empty, add the buf as the only entry & return. */
14761 	if (un->un_waitq_headp == NULL) {
14762 		ASSERT(un->un_waitq_tailp == NULL);
14763 		un->un_waitq_headp = un->un_waitq_tailp = bp;
14764 		bp->av_forw = NULL;
14765 		return;
14766 	}
14767 
14768 	ASSERT(un->un_waitq_tailp != NULL);
14769 
14770 	/*
14771 	 * If sorting is disabled, just add the buf to the tail end of
14772 	 * the wait queue and return.
14773 	 */
14774 	if (un->un_f_disksort_disabled || un->un_f_enable_rmw) {
14775 		un->un_waitq_tailp->av_forw = bp;
14776 		un->un_waitq_tailp = bp;
14777 		bp->av_forw = NULL;
14778 		return;
14779 	}
14780 
14781 	/*
14782 	 * Sort thru the list of requests currently on the wait queue
14783 	 * and add the new buf request at the appropriate position.
14784 	 *
14785 	 * The un->un_waitq_headp is an activity chain pointer on which
14786 	 * we keep two queues, sorted in ascending SD_GET_BLKNO() order. The
14787 	 * first queue holds those requests which are positioned after
14788 	 * the current SD_GET_BLKNO() (in the first request); the second holds
14789 	 * requests which came in after their SD_GET_BLKNO() number was passed.
14790 	 * Thus we implement a one way scan, retracting after reaching
14791 	 * the end of the drive to the first request on the second
14792 	 * queue, at which time it becomes the first queue.
14793 	 * A one-way scan is natural because of the way UNIX read-ahead
14794 	 * blocks are allocated.
14795 	 *
14796 	 * If we lie after the first request, then we must locate the
14797 	 * second request list and add ourselves to it.
14798 	 */
14799 	ap = un->un_waitq_headp;
14800 	if (SD_GET_BLKNO(bp) < SD_GET_BLKNO(ap)) {
14801 		while (ap->av_forw != NULL) {
14802 			/*
14803 			 * Look for an "inversion" in the (normally
14804 			 * ascending) block numbers. This indicates
14805 			 * the start of the second request list.
14806 			 */
14807 			if (SD_GET_BLKNO(ap->av_forw) < SD_GET_BLKNO(ap)) {
14808 				/*
14809 				 * Search the second request list for the
14810 				 * first request at a larger block number.
14811 				 * We go before that; however if there is
14812 				 * no such request, we go at the end.
14813 				 */
14814 				do {
14815 					if (SD_GET_BLKNO(bp) <
14816 					    SD_GET_BLKNO(ap->av_forw)) {
14817 						goto insert;
14818 					}
14819 					ap = ap->av_forw;
14820 				} while (ap->av_forw != NULL);
14821 				goto insert;		/* after last */
14822 			}
14823 			ap = ap->av_forw;
14824 		}
14825 
14826 		/*
14827 		 * No inversions... we will go after the last, and
14828 		 * be the first request in the second request list.
14829 		 */
14830 		goto insert;
14831 	}
14832 
14833 	/*
14834 	 * Request is at/after the current request...
14835 	 * sort in the first request list.
14836 	 */
14837 	while (ap->av_forw != NULL) {
14838 		/*
14839 		 * We want to go after the current request (1) if
14840 		 * there is an inversion after it (i.e. it is the end
14841 		 * of the first request list), or (2) if the next
14842 		 * request is a larger block no. than our request.
14843 		 */
14844 		if ((SD_GET_BLKNO(ap->av_forw) < SD_GET_BLKNO(ap)) ||
14845 		    (SD_GET_BLKNO(bp) < SD_GET_BLKNO(ap->av_forw))) {
14846 			goto insert;
14847 		}
14848 		ap = ap->av_forw;
14849 	}
14850 
14851 	/*
14852 	 * Neither a second list nor a larger request, therefore
14853 	 * we go at the end of the first list (which is the same
14854 	 * as the end of the whole schebang).
14855 	 */
14856 insert:
14857 	bp->av_forw = ap->av_forw;
14858 	ap->av_forw = bp;
14859 
14860 	/*
14861 	 * If we inserted onto the tail end of the waitq, make sure the
14862 	 * tail pointer is updated.
14863 	 */
14864 	if (ap == un->un_waitq_tailp) {
14865 		un->un_waitq_tailp = bp;
14866 	}
14867 }
14868 
14869 
14870 /*
14871  *    Function: sd_start_cmds
14872  *
14873  * Description: Remove and transport cmds from the driver queues.
14874  *
14875  *   Arguments: un - pointer to the unit (soft state) struct for the target.
14876  *
14877  *		immed_bp - ptr to a buf to be transported immediately. Only
14878  *		the immed_bp is transported; bufs on the waitq are not
14879  *		processed and the un_retry_bp is not checked.  If immed_bp is
14880  *		NULL, then normal queue processing is performed.
14881  *
14882  *     Context: May be called from kernel thread context, interrupt context,
14883  *		or runout callback context. This function may not block or
14884  *		call routines that block.
14885  */
14886 
14887 static void
14888 sd_start_cmds(struct sd_lun *un, struct buf *immed_bp)
14889 {
14890 	struct	sd_xbuf	*xp;
14891 	struct	buf	*bp;
14892 	void	(*statp)(kstat_io_t *);
14893 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
14894 	void	(*saved_statp)(kstat_io_t *);
14895 #endif
14896 	int	rval;
14897 	struct sd_fm_internal *sfip = NULL;
14898 
14899 	ASSERT(un != NULL);
14900 	ASSERT(mutex_owned(SD_MUTEX(un)));
14901 	ASSERT(un->un_ncmds_in_transport >= 0);
14902 	ASSERT(un->un_throttle >= 0);
14903 
14904 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_start_cmds: entry\n");
14905 
14906 	do {
14907 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
14908 		saved_statp = NULL;
14909 #endif
14910 
14911 		/*
14912 		 * If we are syncing or dumping, fail the command to
14913 		 * avoid recursively calling back into scsi_transport().
14914 		 * The dump I/O itself uses a separate code path so this
14915 		 * only prevents non-dump I/O from being sent while dumping.
14916 		 * File system sync takes place before dumping begins.
14917 		 * During panic, filesystem I/O is allowed provided
14918 		 * un_in_callback is <= 1.  This is to prevent recursion
14919 		 * such as sd_start_cmds -> scsi_transport -> sdintr ->
14920 		 * sd_start_cmds and so on.  See panic.c for more information
14921 		 * about the states the system can be in during panic.
14922 		 */
14923 		if ((un->un_state == SD_STATE_DUMPING) ||
14924 		    (ddi_in_panic() && (un->un_in_callback > 1))) {
14925 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14926 			    "sd_start_cmds: panicking\n");
14927 			goto exit;
14928 		}
14929 
14930 		if ((bp = immed_bp) != NULL) {
14931 			/*
14932 			 * We have a bp that must be transported immediately.
14933 			 * It's OK to transport the immed_bp here without doing
14934 			 * the throttle limit check because the immed_bp is
14935 			 * always used in a retry/recovery case. This means
14936 			 * that we know we are not at the throttle limit by
14937 			 * virtue of the fact that to get here we must have
14938 			 * already gotten a command back via sdintr(). This also
14939 			 * relies on (1) the command on un_retry_bp preventing
14940 			 * further commands from the waitq from being issued;
14941 			 * and (2) the code in sd_retry_command checking the
14942 			 * throttle limit before issuing a delayed or immediate
14943 			 * retry. This holds even if the throttle limit is
14944 			 * currently ratcheted down from its maximum value.
14945 			 */
14946 			statp = kstat_runq_enter;
14947 			if (bp == un->un_retry_bp) {
14948 				ASSERT((un->un_retry_statp == NULL) ||
14949 				    (un->un_retry_statp == kstat_waitq_enter) ||
14950 				    (un->un_retry_statp ==
14951 				    kstat_runq_back_to_waitq));
14952 				/*
14953 				 * If the waitq kstat was incremented when
14954 				 * sd_set_retry_bp() queued this bp for a retry,
14955 				 * then we must set up statp so that the waitq
14956 				 * count will get decremented correctly below.
14957 				 * Also we must clear un->un_retry_statp to
14958 				 * ensure that we do not act on a stale value
14959 				 * in this field.
14960 				 */
14961 				if ((un->un_retry_statp == kstat_waitq_enter) ||
14962 				    (un->un_retry_statp ==
14963 				    kstat_runq_back_to_waitq)) {
14964 					statp = kstat_waitq_to_runq;
14965 				}
14966 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
14967 				saved_statp = un->un_retry_statp;
14968 #endif
14969 				un->un_retry_statp = NULL;
14970 
14971 				SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
14972 				    "sd_start_cmds: un:0x%p: GOT retry_bp:0x%p "
14973 				    "un_throttle:%d un_ncmds_in_transport:%d\n",
14974 				    un, un->un_retry_bp, un->un_throttle,
14975 				    un->un_ncmds_in_transport);
14976 			} else {
14977 				SD_TRACE(SD_LOG_IO_CORE, un, "sd_start_cmds: "
14978 				    "processing priority bp:0x%p\n", bp);
14979 			}
14980 
14981 		} else if ((bp = un->un_waitq_headp) != NULL) {
14982 			/*
14983 			 * A command on the waitq is ready to go, but do not
14984 			 * send it if:
14985 			 *
14986 			 * (1) the throttle limit has been reached, or
14987 			 * (2) a retry is pending, or
14988 			 * (3) a START_STOP_UNIT callback pending, or
14989 			 * (4) a callback for a SD_PATH_DIRECT_PRIORITY
14990 			 *	command is pending.
14991 			 *
14992 			 * For all of these conditions, IO processing will
14993 			 * restart after the condition is cleared.
14994 			 */
14995 			if (un->un_ncmds_in_transport >= un->un_throttle) {
14996 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14997 				    "sd_start_cmds: exiting, "
14998 				    "throttle limit reached!\n");
14999 				goto exit;
15000 			}
15001 			if (un->un_retry_bp != NULL) {
15002 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15003 				    "sd_start_cmds: exiting, retry pending!\n");
15004 				goto exit;
15005 			}
15006 			if (un->un_startstop_timeid != NULL) {
15007 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15008 				    "sd_start_cmds: exiting, "
15009 				    "START_STOP pending!\n");
15010 				goto exit;
15011 			}
15012 			if (un->un_direct_priority_timeid != NULL) {
15013 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15014 				    "sd_start_cmds: exiting, "
15015 				    "SD_PATH_DIRECT_PRIORITY cmd. pending!\n");
15016 				goto exit;
15017 			}
15018 
15019 			/* Dequeue the command */
15020 			un->un_waitq_headp = bp->av_forw;
15021 			if (un->un_waitq_headp == NULL) {
15022 				un->un_waitq_tailp = NULL;
15023 			}
15024 			bp->av_forw = NULL;
15025 			statp = kstat_waitq_to_runq;
15026 			SD_TRACE(SD_LOG_IO_CORE, un,
15027 			    "sd_start_cmds: processing waitq bp:0x%p\n", bp);
15028 
15029 		} else {
15030 			/* No work to do so bail out now */
15031 			SD_TRACE(SD_LOG_IO_CORE, un,
15032 			    "sd_start_cmds: no more work, exiting!\n");
15033 			goto exit;
15034 		}
15035 
15036 		/*
15037 		 * Reset the state to normal. This is the mechanism by which
15038 		 * the state transitions from either SD_STATE_RWAIT or
15039 		 * SD_STATE_OFFLINE to SD_STATE_NORMAL.
15040 		 * If state is SD_STATE_PM_CHANGING then this command is
15041 		 * part of the device power control and the state must
15042 		 * not be put back to normal. Doing so would would
15043 		 * allow new commands to proceed when they shouldn't,
15044 		 * the device may be going off.
15045 		 */
15046 		if ((un->un_state != SD_STATE_SUSPENDED) &&
15047 		    (un->un_state != SD_STATE_PM_CHANGING)) {
15048 			New_state(un, SD_STATE_NORMAL);
15049 		}
15050 
15051 		xp = SD_GET_XBUF(bp);
15052 		ASSERT(xp != NULL);
15053 
15054 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
15055 		/*
15056 		 * Allocate the scsi_pkt if we need one, or attach DMA
15057 		 * resources if we have a scsi_pkt that needs them. The
15058 		 * latter should only occur for commands that are being
15059 		 * retried.
15060 		 */
15061 		if ((xp->xb_pktp == NULL) ||
15062 		    ((xp->xb_pkt_flags & SD_XB_DMA_FREED) != 0)) {
15063 #else
15064 		if (xp->xb_pktp == NULL) {
15065 #endif
15066 			/*
15067 			 * There is no scsi_pkt allocated for this buf. Call
15068 			 * the initpkt function to allocate & init one.
15069 			 *
15070 			 * The scsi_init_pkt runout callback functionality is
15071 			 * implemented as follows:
15072 			 *
15073 			 * 1) The initpkt function always calls
15074 			 *    scsi_init_pkt(9F) with sdrunout specified as the
15075 			 *    callback routine.
15076 			 * 2) A successful packet allocation is initialized and
15077 			 *    the I/O is transported.
15078 			 * 3) The I/O associated with an allocation resource
15079 			 *    failure is left on its queue to be retried via
15080 			 *    runout or the next I/O.
15081 			 * 4) The I/O associated with a DMA error is removed
15082 			 *    from the queue and failed with EIO. Processing of
15083 			 *    the transport queues is also halted to be
15084 			 *    restarted via runout or the next I/O.
15085 			 * 5) The I/O associated with a CDB size or packet
15086 			 *    size error is removed from the queue and failed
15087 			 *    with EIO. Processing of the transport queues is
15088 			 *    continued.
15089 			 *
15090 			 * Note: there is no interface for canceling a runout
15091 			 * callback. To prevent the driver from detaching or
15092 			 * suspending while a runout is pending the driver
15093 			 * state is set to SD_STATE_RWAIT
15094 			 *
15095 			 * Note: using the scsi_init_pkt callback facility can
15096 			 * result in an I/O request persisting at the head of
15097 			 * the list which cannot be satisfied even after
15098 			 * multiple retries. In the future the driver may
15099 			 * implement some kind of maximum runout count before
15100 			 * failing an I/O.
15101 			 *
15102 			 * Note: the use of funcp below may seem superfluous,
15103 			 * but it helps warlock figure out the correct
15104 			 * initpkt function calls (see [s]sd.wlcmd).
15105 			 */
15106 			struct scsi_pkt	*pktp;
15107 			int (*funcp)(struct buf *bp, struct scsi_pkt **pktp);
15108 
15109 			ASSERT(bp != un->un_rqs_bp);
15110 
15111 			funcp = sd_initpkt_map[xp->xb_chain_iostart];
15112 			switch ((*funcp)(bp, &pktp)) {
15113 			case  SD_PKT_ALLOC_SUCCESS:
15114 				xp->xb_pktp = pktp;
15115 				SD_TRACE(SD_LOG_IO_CORE, un,
15116 				    "sd_start_cmd: SD_PKT_ALLOC_SUCCESS 0x%p\n",
15117 				    pktp);
15118 				goto got_pkt;
15119 
15120 			case SD_PKT_ALLOC_FAILURE:
15121 				/*
15122 				 * Temporary (hopefully) resource depletion.
15123 				 * Since retries and RQS commands always have a
15124 				 * scsi_pkt allocated, these cases should never
15125 				 * get here. So the only cases this needs to
15126 				 * handle is a bp from the waitq (which we put
15127 				 * back onto the waitq for sdrunout), or a bp
15128 				 * sent as an immed_bp (which we just fail).
15129 				 */
15130 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15131 				    "sd_start_cmds: SD_PKT_ALLOC_FAILURE\n");
15132 
15133 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
15134 
15135 				if (bp == immed_bp) {
15136 					/*
15137 					 * If SD_XB_DMA_FREED is clear, then
15138 					 * this is a failure to allocate a
15139 					 * scsi_pkt, and we must fail the
15140 					 * command.
15141 					 */
15142 					if ((xp->xb_pkt_flags &
15143 					    SD_XB_DMA_FREED) == 0) {
15144 						break;
15145 					}
15146 
15147 					/*
15148 					 * If this immediate command is NOT our
15149 					 * un_retry_bp, then we must fail it.
15150 					 */
15151 					if (bp != un->un_retry_bp) {
15152 						break;
15153 					}
15154 
15155 					/*
15156 					 * We get here if this cmd is our
15157 					 * un_retry_bp that was DMAFREED, but
15158 					 * scsi_init_pkt() failed to reallocate
15159 					 * DMA resources when we attempted to
15160 					 * retry it. This can happen when an
15161 					 * mpxio failover is in progress, but
15162 					 * we don't want to just fail the
15163 					 * command in this case.
15164 					 *
15165 					 * Use timeout(9F) to restart it after
15166 					 * a 100ms delay.  We don't want to
15167 					 * let sdrunout() restart it, because
15168 					 * sdrunout() is just supposed to start
15169 					 * commands that are sitting on the
15170 					 * wait queue.  The un_retry_bp stays
15171 					 * set until the command completes, but
15172 					 * sdrunout can be called many times
15173 					 * before that happens.  Since sdrunout
15174 					 * cannot tell if the un_retry_bp is
15175 					 * already in the transport, it could
15176 					 * end up calling scsi_transport() for
15177 					 * the un_retry_bp multiple times.
15178 					 *
15179 					 * Also: don't schedule the callback
15180 					 * if some other callback is already
15181 					 * pending.
15182 					 */
15183 					if (un->un_retry_statp == NULL) {
15184 						/*
15185 						 * restore the kstat pointer to
15186 						 * keep kstat counts coherent
15187 						 * when we do retry the command.
15188 						 */
15189 						un->un_retry_statp =
15190 						    saved_statp;
15191 					}
15192 
15193 					if ((un->un_startstop_timeid == NULL) &&
15194 					    (un->un_retry_timeid == NULL) &&
15195 					    (un->un_direct_priority_timeid ==
15196 					    NULL)) {
15197 
15198 						un->un_retry_timeid =
15199 						    timeout(
15200 						    sd_start_retry_command,
15201 						    un, SD_RESTART_TIMEOUT);
15202 					}
15203 					goto exit;
15204 				}
15205 
15206 #else
15207 				if (bp == immed_bp) {
15208 					break;	/* Just fail the command */
15209 				}
15210 #endif
15211 
15212 				/* Add the buf back to the head of the waitq */
15213 				bp->av_forw = un->un_waitq_headp;
15214 				un->un_waitq_headp = bp;
15215 				if (un->un_waitq_tailp == NULL) {
15216 					un->un_waitq_tailp = bp;
15217 				}
15218 				goto exit;
15219 
15220 			case SD_PKT_ALLOC_FAILURE_NO_DMA:
15221 				/*
15222 				 * HBA DMA resource failure. Fail the command
15223 				 * and continue processing of the queues.
15224 				 */
15225 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15226 				    "sd_start_cmds: "
15227 				    "SD_PKT_ALLOC_FAILURE_NO_DMA\n");
15228 				break;
15229 
15230 			case SD_PKT_ALLOC_FAILURE_PKT_TOO_SMALL:
15231 				/*
15232 				 * Note:x86: Partial DMA mapping not supported
15233 				 * for USCSI commands, and all the needed DMA
15234 				 * resources were not allocated.
15235 				 */
15236 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15237 				    "sd_start_cmds: "
15238 				    "SD_PKT_ALLOC_FAILURE_PKT_TOO_SMALL\n");
15239 				break;
15240 
15241 			case SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL:
15242 				/*
15243 				 * Note:x86: Request cannot fit into CDB based
15244 				 * on lba and len.
15245 				 */
15246 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15247 				    "sd_start_cmds: "
15248 				    "SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL\n");
15249 				break;
15250 
15251 			default:
15252 				/* Should NEVER get here! */
15253 				panic("scsi_initpkt error");
15254 				/*NOTREACHED*/
15255 			}
15256 
15257 			/*
15258 			 * Fatal error in allocating a scsi_pkt for this buf.
15259 			 * Update kstats & return the buf with an error code.
15260 			 * We must use sd_return_failed_command_no_restart() to
15261 			 * avoid a recursive call back into sd_start_cmds().
15262 			 * However this also means that we must keep processing
15263 			 * the waitq here in order to avoid stalling.
15264 			 */
15265 			if (statp == kstat_waitq_to_runq) {
15266 				SD_UPDATE_KSTATS(un, kstat_waitq_exit, bp);
15267 			}
15268 			sd_return_failed_command_no_restart(un, bp, EIO);
15269 			if (bp == immed_bp) {
15270 				/* immed_bp is gone by now, so clear this */
15271 				immed_bp = NULL;
15272 			}
15273 			continue;
15274 		}
15275 got_pkt:
15276 		if (bp == immed_bp) {
15277 			/* goto the head of the class.... */
15278 			xp->xb_pktp->pkt_flags |= FLAG_HEAD;
15279 		}
15280 
15281 		un->un_ncmds_in_transport++;
15282 		SD_UPDATE_KSTATS(un, statp, bp);
15283 
15284 		/*
15285 		 * Call scsi_transport() to send the command to the target.
15286 		 * According to SCSA architecture, we must drop the mutex here
15287 		 * before calling scsi_transport() in order to avoid deadlock.
15288 		 * Note that the scsi_pkt's completion routine can be executed
15289 		 * (from interrupt context) even before the call to
15290 		 * scsi_transport() returns.
15291 		 */
15292 		SD_TRACE(SD_LOG_IO_CORE, un,
15293 		    "sd_start_cmds: calling scsi_transport()\n");
15294 		DTRACE_PROBE1(scsi__transport__dispatch, struct buf *, bp);
15295 
15296 		mutex_exit(SD_MUTEX(un));
15297 		rval = scsi_transport(xp->xb_pktp);
15298 		mutex_enter(SD_MUTEX(un));
15299 
15300 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15301 		    "sd_start_cmds: scsi_transport() returned %d\n", rval);
15302 
15303 		switch (rval) {
15304 		case TRAN_ACCEPT:
15305 			/* Clear this with every pkt accepted by the HBA */
15306 			un->un_tran_fatal_count = 0;
15307 			break;	/* Success; try the next cmd (if any) */
15308 
15309 		case TRAN_BUSY:
15310 			un->un_ncmds_in_transport--;
15311 			ASSERT(un->un_ncmds_in_transport >= 0);
15312 
15313 			/*
15314 			 * Don't retry request sense, the sense data
15315 			 * is lost when another request is sent.
15316 			 * Free up the rqs buf and retry
15317 			 * the original failed cmd.  Update kstat.
15318 			 */
15319 			if (bp == un->un_rqs_bp) {
15320 				SD_UPDATE_KSTATS(un, kstat_runq_exit, bp);
15321 				bp = sd_mark_rqs_idle(un, xp);
15322 				sd_retry_command(un, bp, SD_RETRIES_STANDARD,
15323 				    NULL, NULL, EIO, un->un_busy_timeout / 500,
15324 				    kstat_waitq_enter);
15325 				goto exit;
15326 			}
15327 
15328 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
15329 			/*
15330 			 * Free the DMA resources for the  scsi_pkt. This will
15331 			 * allow mpxio to select another path the next time
15332 			 * we call scsi_transport() with this scsi_pkt.
15333 			 * See sdintr() for the rationalization behind this.
15334 			 */
15335 			if ((un->un_f_is_fibre == TRUE) &&
15336 			    ((xp->xb_pkt_flags & SD_XB_USCSICMD) == 0) &&
15337 			    ((xp->xb_pktp->pkt_flags & FLAG_SENSING) == 0)) {
15338 				scsi_dmafree(xp->xb_pktp);
15339 				xp->xb_pkt_flags |= SD_XB_DMA_FREED;
15340 			}
15341 #endif
15342 
15343 			if (SD_IS_DIRECT_PRIORITY(SD_GET_XBUF(bp))) {
15344 				/*
15345 				 * Commands that are SD_PATH_DIRECT_PRIORITY
15346 				 * are for error recovery situations. These do
15347 				 * not use the normal command waitq, so if they
15348 				 * get a TRAN_BUSY we cannot put them back onto
15349 				 * the waitq for later retry. One possible
15350 				 * problem is that there could already be some
15351 				 * other command on un_retry_bp that is waiting
15352 				 * for this one to complete, so we would be
15353 				 * deadlocked if we put this command back onto
15354 				 * the waitq for later retry (since un_retry_bp
15355 				 * must complete before the driver gets back to
15356 				 * commands on the waitq).
15357 				 *
15358 				 * To avoid deadlock we must schedule a callback
15359 				 * that will restart this command after a set
15360 				 * interval.  This should keep retrying for as
15361 				 * long as the underlying transport keeps
15362 				 * returning TRAN_BUSY (just like for other
15363 				 * commands).  Use the same timeout interval as
15364 				 * for the ordinary TRAN_BUSY retry.
15365 				 */
15366 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15367 				    "sd_start_cmds: scsi_transport() returned "
15368 				    "TRAN_BUSY for DIRECT_PRIORITY cmd!\n");
15369 
15370 				SD_UPDATE_KSTATS(un, kstat_runq_exit, bp);
15371 				un->un_direct_priority_timeid =
15372 				    timeout(sd_start_direct_priority_command,
15373 				    bp, un->un_busy_timeout / 500);
15374 
15375 				goto exit;
15376 			}
15377 
15378 			/*
15379 			 * For TRAN_BUSY, we want to reduce the throttle value,
15380 			 * unless we are retrying a command.
15381 			 */
15382 			if (bp != un->un_retry_bp) {
15383 				sd_reduce_throttle(un, SD_THROTTLE_TRAN_BUSY);
15384 			}
15385 
15386 			/*
15387 			 * Set up the bp to be tried again 10 ms later.
15388 			 * Note:x86: Is there a timeout value in the sd_lun
15389 			 * for this condition?
15390 			 */
15391 			sd_set_retry_bp(un, bp, un->un_busy_timeout / 500,
15392 			    kstat_runq_back_to_waitq);
15393 			goto exit;
15394 
15395 		case TRAN_FATAL_ERROR:
15396 			un->un_tran_fatal_count++;
15397 			/* FALLTHRU */
15398 
15399 		case TRAN_BADPKT:
15400 		default:
15401 			un->un_ncmds_in_transport--;
15402 			ASSERT(un->un_ncmds_in_transport >= 0);
15403 
15404 			/*
15405 			 * If this is our REQUEST SENSE command with a
15406 			 * transport error, we must get back the pointers
15407 			 * to the original buf, and mark the REQUEST
15408 			 * SENSE command as "available".
15409 			 */
15410 			if (bp == un->un_rqs_bp) {
15411 				bp = sd_mark_rqs_idle(un, xp);
15412 				xp = SD_GET_XBUF(bp);
15413 			} else {
15414 				/*
15415 				 * Legacy behavior: do not update transport
15416 				 * error count for request sense commands.
15417 				 */
15418 				SD_UPDATE_ERRSTATS(un, sd_transerrs);
15419 			}
15420 
15421 			SD_UPDATE_KSTATS(un, kstat_runq_exit, bp);
15422 			sd_print_transport_rejected_message(un, xp, rval);
15423 
15424 			/*
15425 			 * This command will be terminated by SD driver due
15426 			 * to a fatal transport error. We should post
15427 			 * ereport.io.scsi.cmd.disk.tran with driver-assessment
15428 			 * of "fail" for any command to indicate this
15429 			 * situation.
15430 			 */
15431 			if (xp->xb_ena > 0) {
15432 				ASSERT(un->un_fm_private != NULL);
15433 				sfip = un->un_fm_private;
15434 				sfip->fm_ssc.ssc_flags |= SSC_FLAGS_TRAN_ABORT;
15435 				sd_ssc_extract_info(&sfip->fm_ssc, un,
15436 				    xp->xb_pktp, bp, xp);
15437 				sd_ssc_post(&sfip->fm_ssc, SD_FM_DRV_FATAL);
15438 			}
15439 
15440 			/*
15441 			 * We must use sd_return_failed_command_no_restart() to
15442 			 * avoid a recursive call back into sd_start_cmds().
15443 			 * However this also means that we must keep processing
15444 			 * the waitq here in order to avoid stalling.
15445 			 */
15446 			sd_return_failed_command_no_restart(un, bp, EIO);
15447 
15448 			/*
15449 			 * Notify any threads waiting in sd_ddi_suspend() that
15450 			 * a command completion has occurred.
15451 			 */
15452 			if (un->un_state == SD_STATE_SUSPENDED) {
15453 				cv_broadcast(&un->un_disk_busy_cv);
15454 			}
15455 
15456 			if (bp == immed_bp) {
15457 				/* immed_bp is gone by now, so clear this */
15458 				immed_bp = NULL;
15459 			}
15460 			break;
15461 		}
15462 
15463 	} while (immed_bp == NULL);
15464 
15465 exit:
15466 	ASSERT(mutex_owned(SD_MUTEX(un)));
15467 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_start_cmds: exit\n");
15468 }
15469 
15470 
15471 /*
15472  *    Function: sd_return_command
15473  *
15474  * Description: Returns a command to its originator (with or without an
15475  *		error).  Also starts commands waiting to be transported
15476  *		to the target.
15477  *
15478  *     Context: May be called from interrupt, kernel, or timeout context
15479  */
15480 
15481 static void
15482 sd_return_command(struct sd_lun *un, struct buf *bp)
15483 {
15484 	struct sd_xbuf *xp;
15485 	struct scsi_pkt *pktp;
15486 	struct sd_fm_internal *sfip;
15487 
15488 	ASSERT(bp != NULL);
15489 	ASSERT(un != NULL);
15490 	ASSERT(mutex_owned(SD_MUTEX(un)));
15491 	ASSERT(bp != un->un_rqs_bp);
15492 	xp = SD_GET_XBUF(bp);
15493 	ASSERT(xp != NULL);
15494 
15495 	pktp = SD_GET_PKTP(bp);
15496 	sfip = (struct sd_fm_internal *)un->un_fm_private;
15497 	ASSERT(sfip != NULL);
15498 
15499 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_return_command: entry\n");
15500 
15501 	/*
15502 	 * Note: check for the "sdrestart failed" case.
15503 	 */
15504 	if ((un->un_partial_dma_supported == 1) &&
15505 	    ((xp->xb_pkt_flags & SD_XB_USCSICMD) != SD_XB_USCSICMD) &&
15506 	    (geterror(bp) == 0) && (xp->xb_dma_resid != 0) &&
15507 	    (xp->xb_pktp->pkt_resid == 0)) {
15508 
15509 		if (sd_setup_next_xfer(un, bp, pktp, xp) != 0) {
15510 			/*
15511 			 * Successfully set up next portion of cmd
15512 			 * transfer, try sending it
15513 			 */
15514 			sd_retry_command(un, bp, SD_RETRIES_NOCHECK,
15515 			    NULL, NULL, 0, (clock_t)0, NULL);
15516 			sd_start_cmds(un, NULL);
15517 			return;	/* Note:x86: need a return here? */
15518 		}
15519 	}
15520 
15521 	/*
15522 	 * If this is the failfast bp, clear it from un_failfast_bp. This
15523 	 * can happen if upon being re-tried the failfast bp either
15524 	 * succeeded or encountered another error (possibly even a different
15525 	 * error than the one that precipitated the failfast state, but in
15526 	 * that case it would have had to exhaust retries as well). Regardless,
15527 	 * this should not occur whenever the instance is in the active
15528 	 * failfast state.
15529 	 */
15530 	if (bp == un->un_failfast_bp) {
15531 		ASSERT(un->un_failfast_state == SD_FAILFAST_INACTIVE);
15532 		un->un_failfast_bp = NULL;
15533 	}
15534 
15535 	/*
15536 	 * Clear the failfast state upon successful completion of ANY cmd.
15537 	 */
15538 	if (bp->b_error == 0) {
15539 		un->un_failfast_state = SD_FAILFAST_INACTIVE;
15540 		/*
15541 		 * If this is a successful command, but used to be retried,
15542 		 * we will take it as a recovered command and post an
15543 		 * ereport with driver-assessment of "recovered".
15544 		 */
15545 		if (xp->xb_ena > 0) {
15546 			sd_ssc_extract_info(&sfip->fm_ssc, un, pktp, bp, xp);
15547 			sd_ssc_post(&sfip->fm_ssc, SD_FM_DRV_RECOVERY);
15548 		}
15549 	} else {
15550 		/*
15551 		 * If this is a failed non-USCSI command we will post an
15552 		 * ereport with driver-assessment set accordingly("fail" or
15553 		 * "fatal").
15554 		 */
15555 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
15556 			sd_ssc_extract_info(&sfip->fm_ssc, un, pktp, bp, xp);
15557 			sd_ssc_post(&sfip->fm_ssc, SD_FM_DRV_FATAL);
15558 		}
15559 	}
15560 
15561 	/*
15562 	 * This is used if the command was retried one or more times. Show that
15563 	 * we are done with it, and allow processing of the waitq to resume.
15564 	 */
15565 	if (bp == un->un_retry_bp) {
15566 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15567 		    "sd_return_command: un:0x%p: "
15568 		    "RETURNING retry_bp:0x%p\n", un, un->un_retry_bp);
15569 		un->un_retry_bp = NULL;
15570 		un->un_retry_statp = NULL;
15571 	}
15572 
15573 	SD_UPDATE_RDWR_STATS(un, bp);
15574 	SD_UPDATE_PARTITION_STATS(un, bp);
15575 
15576 	switch (un->un_state) {
15577 	case SD_STATE_SUSPENDED:
15578 		/*
15579 		 * Notify any threads waiting in sd_ddi_suspend() that
15580 		 * a command completion has occurred.
15581 		 */
15582 		cv_broadcast(&un->un_disk_busy_cv);
15583 		break;
15584 	default:
15585 		sd_start_cmds(un, NULL);
15586 		break;
15587 	}
15588 
15589 	/* Return this command up the iodone chain to its originator. */
15590 	mutex_exit(SD_MUTEX(un));
15591 
15592 	(*(sd_destroypkt_map[xp->xb_chain_iodone]))(bp);
15593 	xp->xb_pktp = NULL;
15594 
15595 	SD_BEGIN_IODONE(xp->xb_chain_iodone, un, bp);
15596 
15597 	ASSERT(!mutex_owned(SD_MUTEX(un)));
15598 	mutex_enter(SD_MUTEX(un));
15599 
15600 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_return_command: exit\n");
15601 }
15602 
15603 
15604 /*
15605  *    Function: sd_return_failed_command
15606  *
15607  * Description: Command completion when an error occurred.
15608  *
15609  *     Context: May be called from interrupt context
15610  */
15611 
15612 static void
15613 sd_return_failed_command(struct sd_lun *un, struct buf *bp, int errcode)
15614 {
15615 	ASSERT(bp != NULL);
15616 	ASSERT(un != NULL);
15617 	ASSERT(mutex_owned(SD_MUTEX(un)));
15618 
15619 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15620 	    "sd_return_failed_command: entry\n");
15621 
15622 	/*
15623 	 * b_resid could already be nonzero due to a partial data
15624 	 * transfer, so do not change it here.
15625 	 */
15626 	SD_BIOERROR(bp, errcode);
15627 
15628 	sd_return_command(un, bp);
15629 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15630 	    "sd_return_failed_command: exit\n");
15631 }
15632 
15633 
15634 /*
15635  *    Function: sd_return_failed_command_no_restart
15636  *
15637  * Description: Same as sd_return_failed_command, but ensures that no
15638  *		call back into sd_start_cmds will be issued.
15639  *
15640  *     Context: May be called from interrupt context
15641  */
15642 
15643 static void
15644 sd_return_failed_command_no_restart(struct sd_lun *un, struct buf *bp,
15645     int errcode)
15646 {
15647 	struct sd_xbuf *xp;
15648 
15649 	ASSERT(bp != NULL);
15650 	ASSERT(un != NULL);
15651 	ASSERT(mutex_owned(SD_MUTEX(un)));
15652 	xp = SD_GET_XBUF(bp);
15653 	ASSERT(xp != NULL);
15654 	ASSERT(errcode != 0);
15655 
15656 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15657 	    "sd_return_failed_command_no_restart: entry\n");
15658 
15659 	/*
15660 	 * b_resid could already be nonzero due to a partial data
15661 	 * transfer, so do not change it here.
15662 	 */
15663 	SD_BIOERROR(bp, errcode);
15664 
15665 	/*
15666 	 * If this is the failfast bp, clear it. This can happen if the
15667 	 * failfast bp encounterd a fatal error when we attempted to
15668 	 * re-try it (such as a scsi_transport(9F) failure).  However
15669 	 * we should NOT be in an active failfast state if the failfast
15670 	 * bp is not NULL.
15671 	 */
15672 	if (bp == un->un_failfast_bp) {
15673 		ASSERT(un->un_failfast_state == SD_FAILFAST_INACTIVE);
15674 		un->un_failfast_bp = NULL;
15675 	}
15676 
15677 	if (bp == un->un_retry_bp) {
15678 		/*
15679 		 * This command was retried one or more times. Show that we are
15680 		 * done with it, and allow processing of the waitq to resume.
15681 		 */
15682 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15683 		    "sd_return_failed_command_no_restart: "
15684 		    " un:0x%p: RETURNING retry_bp:0x%p\n", un, un->un_retry_bp);
15685 		un->un_retry_bp = NULL;
15686 		un->un_retry_statp = NULL;
15687 	}
15688 
15689 	SD_UPDATE_RDWR_STATS(un, bp);
15690 	SD_UPDATE_PARTITION_STATS(un, bp);
15691 
15692 	mutex_exit(SD_MUTEX(un));
15693 
15694 	if (xp->xb_pktp != NULL) {
15695 		(*(sd_destroypkt_map[xp->xb_chain_iodone]))(bp);
15696 		xp->xb_pktp = NULL;
15697 	}
15698 
15699 	SD_BEGIN_IODONE(xp->xb_chain_iodone, un, bp);
15700 
15701 	mutex_enter(SD_MUTEX(un));
15702 
15703 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15704 	    "sd_return_failed_command_no_restart: exit\n");
15705 }
15706 
15707 
15708 /*
15709  *    Function: sd_retry_command
15710  *
15711  * Description: queue up a command for retry, or (optionally) fail it
15712  *		if retry counts are exhausted.
15713  *
15714  *   Arguments: un - Pointer to the sd_lun struct for the target.
15715  *
15716  *		bp - Pointer to the buf for the command to be retried.
15717  *
15718  *		retry_check_flag - Flag to see which (if any) of the retry
15719  *		   counts should be decremented/checked. If the indicated
15720  *		   retry count is exhausted, then the command will not be
15721  *		   retried; it will be failed instead. This should use a
15722  *		   value equal to one of the following:
15723  *
15724  *			SD_RETRIES_NOCHECK
15725  *			SD_RESD_RETRIES_STANDARD
15726  *			SD_RETRIES_VICTIM
15727  *
15728  *		   Optionally may be bitwise-OR'ed with SD_RETRIES_ISOLATE
15729  *		   if the check should be made to see of FLAG_ISOLATE is set
15730  *		   in the pkt. If FLAG_ISOLATE is set, then the command is
15731  *		   not retried, it is simply failed.
15732  *
15733  *		user_funcp - Ptr to function to call before dispatching the
15734  *		   command. May be NULL if no action needs to be performed.
15735  *		   (Primarily intended for printing messages.)
15736  *
15737  *		user_arg - Optional argument to be passed along to
15738  *		   the user_funcp call.
15739  *
15740  *		failure_code - errno return code to set in the bp if the
15741  *		   command is going to be failed.
15742  *
15743  *		retry_delay - Retry delay interval in (clock_t) units. May
15744  *		   be zero which indicates that the retry should be retried
15745  *		   immediately (ie, without an intervening delay).
15746  *
15747  *		statp - Ptr to kstat function to be updated if the command
15748  *		   is queued for a delayed retry. May be NULL if no kstat
15749  *		   update is desired.
15750  *
15751  *     Context: May be called from interrupt context.
15752  */
15753 
15754 static void
15755 sd_retry_command(struct sd_lun *un, struct buf *bp, int retry_check_flag,
15756     void (*user_funcp)(struct sd_lun *un, struct buf *bp, void *argp, int code),
15757     void *user_arg, int failure_code, clock_t retry_delay,
15758     void (*statp)(kstat_io_t *))
15759 {
15760 	struct sd_xbuf	*xp;
15761 	struct scsi_pkt	*pktp;
15762 	struct sd_fm_internal *sfip;
15763 
15764 	ASSERT(un != NULL);
15765 	ASSERT(mutex_owned(SD_MUTEX(un)));
15766 	ASSERT(bp != NULL);
15767 	xp = SD_GET_XBUF(bp);
15768 	ASSERT(xp != NULL);
15769 	pktp = SD_GET_PKTP(bp);
15770 	ASSERT(pktp != NULL);
15771 
15772 	sfip = (struct sd_fm_internal *)un->un_fm_private;
15773 	ASSERT(sfip != NULL);
15774 
15775 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
15776 	    "sd_retry_command: entry: bp:0x%p xp:0x%p\n", bp, xp);
15777 
15778 	/*
15779 	 * If we are syncing or dumping, fail the command to avoid
15780 	 * recursively calling back into scsi_transport().
15781 	 */
15782 	if (ddi_in_panic()) {
15783 		goto fail_command_no_log;
15784 	}
15785 
15786 	/*
15787 	 * We should never be be retrying a command with FLAG_DIAGNOSE set, so
15788 	 * log an error and fail the command.
15789 	 */
15790 	if ((pktp->pkt_flags & FLAG_DIAGNOSE) != 0) {
15791 		scsi_log(SD_DEVINFO(un), sd_label, CE_NOTE,
15792 		    "ERROR, retrying FLAG_DIAGNOSE command.\n");
15793 		sd_dump_memory(un, SD_LOG_IO, "CDB",
15794 		    (uchar_t *)pktp->pkt_cdbp, CDB_SIZE, SD_LOG_HEX);
15795 		sd_dump_memory(un, SD_LOG_IO, "Sense Data",
15796 		    (uchar_t *)xp->xb_sense_data, SENSE_LENGTH, SD_LOG_HEX);
15797 		goto fail_command;
15798 	}
15799 
15800 	/*
15801 	 * If we are suspended, then put the command onto head of the
15802 	 * wait queue since we don't want to start more commands, and
15803 	 * clear the un_retry_bp. Next time when we are resumed, will
15804 	 * handle the command in the wait queue.
15805 	 */
15806 	switch (un->un_state) {
15807 	case SD_STATE_SUSPENDED:
15808 	case SD_STATE_DUMPING:
15809 		bp->av_forw = un->un_waitq_headp;
15810 		un->un_waitq_headp = bp;
15811 		if (un->un_waitq_tailp == NULL) {
15812 			un->un_waitq_tailp = bp;
15813 		}
15814 		if (bp == un->un_retry_bp) {
15815 			un->un_retry_bp = NULL;
15816 			un->un_retry_statp = NULL;
15817 		}
15818 		SD_UPDATE_KSTATS(un, kstat_waitq_enter, bp);
15819 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_retry_command: "
15820 		    "exiting; cmd bp:0x%p requeued for SUSPEND/DUMP\n", bp);
15821 		return;
15822 	default:
15823 		break;
15824 	}
15825 
15826 	/*
15827 	 * If the caller wants us to check FLAG_ISOLATE, then see if that
15828 	 * is set; if it is then we do not want to retry the command.
15829 	 * Normally, FLAG_ISOLATE is only used with USCSI cmds.
15830 	 */
15831 	if ((retry_check_flag & SD_RETRIES_ISOLATE) != 0) {
15832 		if ((pktp->pkt_flags & FLAG_ISOLATE) != 0) {
15833 			goto fail_command;
15834 		}
15835 	}
15836 
15837 
15838 	/*
15839 	 * If SD_RETRIES_FAILFAST is set, it indicates that either a
15840 	 * command timeout or a selection timeout has occurred. This means
15841 	 * that we were unable to establish an kind of communication with
15842 	 * the target, and subsequent retries and/or commands are likely
15843 	 * to encounter similar results and take a long time to complete.
15844 	 *
15845 	 * If this is a failfast error condition, we need to update the
15846 	 * failfast state, even if this bp does not have B_FAILFAST set.
15847 	 */
15848 	if (retry_check_flag & SD_RETRIES_FAILFAST) {
15849 		if (un->un_failfast_state == SD_FAILFAST_ACTIVE) {
15850 			ASSERT(un->un_failfast_bp == NULL);
15851 			/*
15852 			 * If we are already in the active failfast state, and
15853 			 * another failfast error condition has been detected,
15854 			 * then fail this command if it has B_FAILFAST set.
15855 			 * If B_FAILFAST is clear, then maintain the legacy
15856 			 * behavior of retrying heroically, even tho this will
15857 			 * take a lot more time to fail the command.
15858 			 */
15859 			if (bp->b_flags & B_FAILFAST) {
15860 				goto fail_command;
15861 			}
15862 		} else {
15863 			/*
15864 			 * We're not in the active failfast state, but we
15865 			 * have a failfast error condition, so we must begin
15866 			 * transition to the next state. We do this regardless
15867 			 * of whether or not this bp has B_FAILFAST set.
15868 			 */
15869 			if (un->un_failfast_bp == NULL) {
15870 				/*
15871 				 * This is the first bp to meet a failfast
15872 				 * condition so save it on un_failfast_bp &
15873 				 * do normal retry processing. Do not enter
15874 				 * active failfast state yet. This marks
15875 				 * entry into the "failfast pending" state.
15876 				 */
15877 				un->un_failfast_bp = bp;
15878 
15879 			} else if (un->un_failfast_bp == bp) {
15880 				/*
15881 				 * This is the second time *this* bp has
15882 				 * encountered a failfast error condition,
15883 				 * so enter active failfast state & flush
15884 				 * queues as appropriate.
15885 				 */
15886 				un->un_failfast_state = SD_FAILFAST_ACTIVE;
15887 				un->un_failfast_bp = NULL;
15888 				sd_failfast_flushq(un);
15889 
15890 				/*
15891 				 * Fail this bp now if B_FAILFAST set;
15892 				 * otherwise continue with retries. (It would
15893 				 * be pretty ironic if this bp succeeded on a
15894 				 * subsequent retry after we just flushed all
15895 				 * the queues).
15896 				 */
15897 				if (bp->b_flags & B_FAILFAST) {
15898 					goto fail_command;
15899 				}
15900 
15901 #if !defined(lint) && !defined(__lint)
15902 			} else {
15903 				/*
15904 				 * If neither of the preceeding conditionals
15905 				 * was true, it means that there is some
15906 				 * *other* bp that has met an inital failfast
15907 				 * condition and is currently either being
15908 				 * retried or is waiting to be retried. In
15909 				 * that case we should perform normal retry
15910 				 * processing on *this* bp, since there is a
15911 				 * chance that the current failfast condition
15912 				 * is transient and recoverable. If that does
15913 				 * not turn out to be the case, then retries
15914 				 * will be cleared when the wait queue is
15915 				 * flushed anyway.
15916 				 */
15917 #endif
15918 			}
15919 		}
15920 	} else {
15921 		/*
15922 		 * SD_RETRIES_FAILFAST is clear, which indicates that we
15923 		 * likely were able to at least establish some level of
15924 		 * communication with the target and subsequent commands
15925 		 * and/or retries are likely to get through to the target,
15926 		 * In this case we want to be aggressive about clearing
15927 		 * the failfast state. Note that this does not affect
15928 		 * the "failfast pending" condition.
15929 		 */
15930 		un->un_failfast_state = SD_FAILFAST_INACTIVE;
15931 	}
15932 
15933 
15934 	/*
15935 	 * Check the specified retry count to see if we can still do
15936 	 * any retries with this pkt before we should fail it.
15937 	 */
15938 	switch (retry_check_flag & SD_RETRIES_MASK) {
15939 	case SD_RETRIES_VICTIM:
15940 		/*
15941 		 * Check the victim retry count. If exhausted, then fall
15942 		 * thru & check against the standard retry count.
15943 		 */
15944 		if (xp->xb_victim_retry_count < un->un_victim_retry_count) {
15945 			/* Increment count & proceed with the retry */
15946 			xp->xb_victim_retry_count++;
15947 			break;
15948 		}
15949 		/* Victim retries exhausted, fall back to std. retries... */
15950 		/* FALLTHRU */
15951 
15952 	case SD_RETRIES_STANDARD:
15953 		if (xp->xb_retry_count >= un->un_retry_count) {
15954 			/* Retries exhausted, fail the command */
15955 			SD_TRACE(SD_LOG_IO_CORE, un,
15956 			    "sd_retry_command: retries exhausted!\n");
15957 			/*
15958 			 * update b_resid for failed SCMD_READ & SCMD_WRITE
15959 			 * commands with nonzero pkt_resid.
15960 			 */
15961 			if ((pktp->pkt_reason == CMD_CMPLT) &&
15962 			    (SD_GET_PKT_STATUS(pktp) == STATUS_GOOD) &&
15963 			    (pktp->pkt_resid != 0)) {
15964 				uchar_t op = SD_GET_PKT_OPCODE(pktp) & 0x1F;
15965 				if ((op == SCMD_READ) || (op == SCMD_WRITE)) {
15966 					SD_UPDATE_B_RESID(bp, pktp);
15967 				}
15968 			}
15969 			goto fail_command;
15970 		}
15971 		xp->xb_retry_count++;
15972 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15973 		    "sd_retry_command: retry count:%d\n", xp->xb_retry_count);
15974 		break;
15975 
15976 	case SD_RETRIES_UA:
15977 		if (xp->xb_ua_retry_count >= sd_ua_retry_count) {
15978 			/* Retries exhausted, fail the command */
15979 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
15980 			    "Unit Attention retries exhausted. "
15981 			    "Check the target.\n");
15982 			goto fail_command;
15983 		}
15984 		xp->xb_ua_retry_count++;
15985 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15986 		    "sd_retry_command: retry count:%d\n",
15987 		    xp->xb_ua_retry_count);
15988 		break;
15989 
15990 	case SD_RETRIES_BUSY:
15991 		if (xp->xb_retry_count >= un->un_busy_retry_count) {
15992 			/* Retries exhausted, fail the command */
15993 			SD_TRACE(SD_LOG_IO_CORE, un,
15994 			    "sd_retry_command: retries exhausted!\n");
15995 			goto fail_command;
15996 		}
15997 		xp->xb_retry_count++;
15998 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15999 		    "sd_retry_command: retry count:%d\n", xp->xb_retry_count);
16000 		break;
16001 
16002 	case SD_RETRIES_NOCHECK:
16003 	default:
16004 		/* No retry count to check. Just proceed with the retry */
16005 		break;
16006 	}
16007 
16008 	xp->xb_pktp->pkt_flags |= FLAG_HEAD;
16009 
16010 	/*
16011 	 * If this is a non-USCSI command being retried
16012 	 * during execution last time, we should post an ereport with
16013 	 * driver-assessment of the value "retry".
16014 	 * For partial DMA, request sense and STATUS_QFULL, there are no
16015 	 * hardware errors, we bypass ereport posting.
16016 	 */
16017 	if (failure_code != 0) {
16018 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
16019 			sd_ssc_extract_info(&sfip->fm_ssc, un, pktp, bp, xp);
16020 			sd_ssc_post(&sfip->fm_ssc, SD_FM_DRV_RETRY);
16021 		}
16022 	}
16023 
16024 	/*
16025 	 * If we were given a zero timeout, we must attempt to retry the
16026 	 * command immediately (ie, without a delay).
16027 	 */
16028 	if (retry_delay == 0) {
16029 		/*
16030 		 * Check some limiting conditions to see if we can actually
16031 		 * do the immediate retry.  If we cannot, then we must
16032 		 * fall back to queueing up a delayed retry.
16033 		 */
16034 		if (un->un_ncmds_in_transport >= un->un_throttle) {
16035 			/*
16036 			 * We are at the throttle limit for the target,
16037 			 * fall back to delayed retry.
16038 			 */
16039 			retry_delay = un->un_busy_timeout;
16040 			statp = kstat_waitq_enter;
16041 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16042 			    "sd_retry_command: immed. retry hit "
16043 			    "throttle!\n");
16044 		} else {
16045 			/*
16046 			 * We're clear to proceed with the immediate retry.
16047 			 * First call the user-provided function (if any)
16048 			 */
16049 			if (user_funcp != NULL) {
16050 				(*user_funcp)(un, bp, user_arg,
16051 				    SD_IMMEDIATE_RETRY_ISSUED);
16052 #ifdef __lock_lint
16053 				sd_print_incomplete_msg(un, bp, user_arg,
16054 				    SD_IMMEDIATE_RETRY_ISSUED);
16055 				sd_print_cmd_incomplete_msg(un, bp, user_arg,
16056 				    SD_IMMEDIATE_RETRY_ISSUED);
16057 				sd_print_sense_failed_msg(un, bp, user_arg,
16058 				    SD_IMMEDIATE_RETRY_ISSUED);
16059 #endif
16060 			}
16061 
16062 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16063 			    "sd_retry_command: issuing immediate retry\n");
16064 
16065 			/*
16066 			 * Call sd_start_cmds() to transport the command to
16067 			 * the target.
16068 			 */
16069 			sd_start_cmds(un, bp);
16070 
16071 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16072 			    "sd_retry_command exit\n");
16073 			return;
16074 		}
16075 	}
16076 
16077 	/*
16078 	 * Set up to retry the command after a delay.
16079 	 * First call the user-provided function (if any)
16080 	 */
16081 	if (user_funcp != NULL) {
16082 		(*user_funcp)(un, bp, user_arg, SD_DELAYED_RETRY_ISSUED);
16083 	}
16084 
16085 	sd_set_retry_bp(un, bp, retry_delay, statp);
16086 
16087 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_retry_command: exit\n");
16088 	return;
16089 
16090 fail_command:
16091 
16092 	if (user_funcp != NULL) {
16093 		(*user_funcp)(un, bp, user_arg, SD_NO_RETRY_ISSUED);
16094 	}
16095 
16096 fail_command_no_log:
16097 
16098 	SD_INFO(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16099 	    "sd_retry_command: returning failed command\n");
16100 
16101 	sd_return_failed_command(un, bp, failure_code);
16102 
16103 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_retry_command: exit\n");
16104 }
16105 
16106 
16107 /*
16108  *    Function: sd_set_retry_bp
16109  *
16110  * Description: Set up the given bp for retry.
16111  *
16112  *   Arguments: un - ptr to associated softstate
16113  *		bp - ptr to buf(9S) for the command
16114  *		retry_delay - time interval before issuing retry (may be 0)
16115  *		statp - optional pointer to kstat function
16116  *
16117  *     Context: May be called under interrupt context
16118  */
16119 
16120 static void
16121 sd_set_retry_bp(struct sd_lun *un, struct buf *bp, clock_t retry_delay,
16122     void (*statp)(kstat_io_t *))
16123 {
16124 	ASSERT(un != NULL);
16125 	ASSERT(mutex_owned(SD_MUTEX(un)));
16126 	ASSERT(bp != NULL);
16127 
16128 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
16129 	    "sd_set_retry_bp: entry: un:0x%p bp:0x%p\n", un, bp);
16130 
16131 	/*
16132 	 * Indicate that the command is being retried. This will not allow any
16133 	 * other commands on the wait queue to be transported to the target
16134 	 * until this command has been completed (success or failure). The
16135 	 * "retry command" is not transported to the target until the given
16136 	 * time delay expires, unless the user specified a 0 retry_delay.
16137 	 *
16138 	 * Note: the timeout(9F) callback routine is what actually calls
16139 	 * sd_start_cmds() to transport the command, with the exception of a
16140 	 * zero retry_delay. The only current implementor of a zero retry delay
16141 	 * is the case where a START_STOP_UNIT is sent to spin-up a device.
16142 	 */
16143 	if (un->un_retry_bp == NULL) {
16144 		ASSERT(un->un_retry_statp == NULL);
16145 		un->un_retry_bp = bp;
16146 
16147 		/*
16148 		 * If the user has not specified a delay the command should
16149 		 * be queued and no timeout should be scheduled.
16150 		 */
16151 		if (retry_delay == 0) {
16152 			/*
16153 			 * Save the kstat pointer that will be used in the
16154 			 * call to SD_UPDATE_KSTATS() below, so that
16155 			 * sd_start_cmds() can correctly decrement the waitq
16156 			 * count when it is time to transport this command.
16157 			 */
16158 			un->un_retry_statp = statp;
16159 			goto done;
16160 		}
16161 	}
16162 
16163 	if (un->un_retry_bp == bp) {
16164 		/*
16165 		 * Save the kstat pointer that will be used in the call to
16166 		 * SD_UPDATE_KSTATS() below, so that sd_start_cmds() can
16167 		 * correctly decrement the waitq count when it is time to
16168 		 * transport this command.
16169 		 */
16170 		un->un_retry_statp = statp;
16171 
16172 		/*
16173 		 * Schedule a timeout if:
16174 		 *   1) The user has specified a delay.
16175 		 *   2) There is not a START_STOP_UNIT callback pending.
16176 		 *
16177 		 * If no delay has been specified, then it is up to the caller
16178 		 * to ensure that IO processing continues without stalling.
16179 		 * Effectively, this means that the caller will issue the
16180 		 * required call to sd_start_cmds(). The START_STOP_UNIT
16181 		 * callback does this after the START STOP UNIT command has
16182 		 * completed. In either of these cases we should not schedule
16183 		 * a timeout callback here.  Also don't schedule the timeout if
16184 		 * an SD_PATH_DIRECT_PRIORITY command is waiting to restart.
16185 		 */
16186 		if ((retry_delay != 0) && (un->un_startstop_timeid == NULL) &&
16187 		    (un->un_direct_priority_timeid == NULL)) {
16188 			un->un_retry_timeid =
16189 			    timeout(sd_start_retry_command, un, retry_delay);
16190 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16191 			    "sd_set_retry_bp: setting timeout: un: 0x%p"
16192 			    " bp:0x%p un_retry_timeid:0x%p\n",
16193 			    un, bp, un->un_retry_timeid);
16194 		}
16195 	} else {
16196 		/*
16197 		 * We only get in here if there is already another command
16198 		 * waiting to be retried.  In this case, we just put the
16199 		 * given command onto the wait queue, so it can be transported
16200 		 * after the current retry command has completed.
16201 		 *
16202 		 * Also we have to make sure that if the command at the head
16203 		 * of the wait queue is the un_failfast_bp, that we do not
16204 		 * put ahead of it any other commands that are to be retried.
16205 		 */
16206 		if ((un->un_failfast_bp != NULL) &&
16207 		    (un->un_failfast_bp == un->un_waitq_headp)) {
16208 			/*
16209 			 * Enqueue this command AFTER the first command on
16210 			 * the wait queue (which is also un_failfast_bp).
16211 			 */
16212 			bp->av_forw = un->un_waitq_headp->av_forw;
16213 			un->un_waitq_headp->av_forw = bp;
16214 			if (un->un_waitq_headp == un->un_waitq_tailp) {
16215 				un->un_waitq_tailp = bp;
16216 			}
16217 		} else {
16218 			/* Enqueue this command at the head of the waitq. */
16219 			bp->av_forw = un->un_waitq_headp;
16220 			un->un_waitq_headp = bp;
16221 			if (un->un_waitq_tailp == NULL) {
16222 				un->un_waitq_tailp = bp;
16223 			}
16224 		}
16225 
16226 		if (statp == NULL) {
16227 			statp = kstat_waitq_enter;
16228 		}
16229 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16230 		    "sd_set_retry_bp: un:0x%p already delayed retry\n", un);
16231 	}
16232 
16233 done:
16234 	if (statp != NULL) {
16235 		SD_UPDATE_KSTATS(un, statp, bp);
16236 	}
16237 
16238 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16239 	    "sd_set_retry_bp: exit un:0x%p\n", un);
16240 }
16241 
16242 
16243 /*
16244  *    Function: sd_start_retry_command
16245  *
16246  * Description: Start the command that has been waiting on the target's
16247  *		retry queue.  Called from timeout(9F) context after the
16248  *		retry delay interval has expired.
16249  *
16250  *   Arguments: arg - pointer to associated softstate for the device.
16251  *
16252  *     Context: timeout(9F) thread context.  May not sleep.
16253  */
16254 
16255 static void
16256 sd_start_retry_command(void *arg)
16257 {
16258 	struct sd_lun *un = arg;
16259 
16260 	ASSERT(un != NULL);
16261 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16262 
16263 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16264 	    "sd_start_retry_command: entry\n");
16265 
16266 	mutex_enter(SD_MUTEX(un));
16267 
16268 	un->un_retry_timeid = NULL;
16269 
16270 	if (un->un_retry_bp != NULL) {
16271 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16272 		    "sd_start_retry_command: un:0x%p STARTING bp:0x%p\n",
16273 		    un, un->un_retry_bp);
16274 		sd_start_cmds(un, un->un_retry_bp);
16275 	}
16276 
16277 	mutex_exit(SD_MUTEX(un));
16278 
16279 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16280 	    "sd_start_retry_command: exit\n");
16281 }
16282 
16283 /*
16284  *    Function: sd_rmw_msg_print_handler
16285  *
16286  * Description: If RMW mode is enabled and warning message is triggered
16287  *              print I/O count during a fixed interval.
16288  *
16289  *   Arguments: arg - pointer to associated softstate for the device.
16290  *
16291  *     Context: timeout(9F) thread context. May not sleep.
16292  */
16293 static void
16294 sd_rmw_msg_print_handler(void *arg)
16295 {
16296 	struct sd_lun *un = arg;
16297 
16298 	ASSERT(un != NULL);
16299 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16300 
16301 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16302 	    "sd_rmw_msg_print_handler: entry\n");
16303 
16304 	mutex_enter(SD_MUTEX(un));
16305 
16306 	if (un->un_rmw_incre_count > 0) {
16307 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
16308 		    "%"PRIu64" I/O requests are not aligned with %d disk "
16309 		    "sector size in %ld seconds. They are handled through "
16310 		    "Read Modify Write but the performance is very low!\n",
16311 		    un->un_rmw_incre_count, un->un_tgt_blocksize,
16312 		    drv_hztousec(SD_RMW_MSG_PRINT_TIMEOUT) / 1000000);
16313 		un->un_rmw_incre_count = 0;
16314 		un->un_rmw_msg_timeid = timeout(sd_rmw_msg_print_handler,
16315 		    un, SD_RMW_MSG_PRINT_TIMEOUT);
16316 	} else {
16317 		un->un_rmw_msg_timeid = NULL;
16318 	}
16319 
16320 	mutex_exit(SD_MUTEX(un));
16321 
16322 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16323 	    "sd_rmw_msg_print_handler: exit\n");
16324 }
16325 
16326 /*
16327  *    Function: sd_start_direct_priority_command
16328  *
16329  * Description: Used to re-start an SD_PATH_DIRECT_PRIORITY command that had
16330  *		received TRAN_BUSY when we called scsi_transport() to send it
16331  *		to the underlying HBA. This function is called from timeout(9F)
16332  *		context after the delay interval has expired.
16333  *
16334  *   Arguments: arg - pointer to associated buf(9S) to be restarted.
16335  *
16336  *     Context: timeout(9F) thread context.  May not sleep.
16337  */
16338 
16339 static void
16340 sd_start_direct_priority_command(void *arg)
16341 {
16342 	struct buf	*priority_bp = arg;
16343 	struct sd_lun	*un;
16344 
16345 	ASSERT(priority_bp != NULL);
16346 	un = SD_GET_UN(priority_bp);
16347 	ASSERT(un != NULL);
16348 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16349 
16350 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16351 	    "sd_start_direct_priority_command: entry\n");
16352 
16353 	mutex_enter(SD_MUTEX(un));
16354 	un->un_direct_priority_timeid = NULL;
16355 	sd_start_cmds(un, priority_bp);
16356 	mutex_exit(SD_MUTEX(un));
16357 
16358 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16359 	    "sd_start_direct_priority_command: exit\n");
16360 }
16361 
16362 
16363 /*
16364  *    Function: sd_send_request_sense_command
16365  *
16366  * Description: Sends a REQUEST SENSE command to the target
16367  *
16368  *     Context: May be called from interrupt context.
16369  */
16370 
16371 static void
16372 sd_send_request_sense_command(struct sd_lun *un, struct buf *bp,
16373     struct scsi_pkt *pktp)
16374 {
16375 	ASSERT(bp != NULL);
16376 	ASSERT(un != NULL);
16377 	ASSERT(mutex_owned(SD_MUTEX(un)));
16378 
16379 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sd_send_request_sense_command: "
16380 	    "entry: buf:0x%p\n", bp);
16381 
16382 	/*
16383 	 * If we are syncing or dumping, then fail the command to avoid a
16384 	 * recursive callback into scsi_transport(). Also fail the command
16385 	 * if we are suspended (legacy behavior).
16386 	 */
16387 	if (ddi_in_panic() || (un->un_state == SD_STATE_SUSPENDED) ||
16388 	    (un->un_state == SD_STATE_DUMPING)) {
16389 		sd_return_failed_command(un, bp, EIO);
16390 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16391 		    "sd_send_request_sense_command: syncing/dumping, exit\n");
16392 		return;
16393 	}
16394 
16395 	/*
16396 	 * Retry the failed command and don't issue the request sense if:
16397 	 *    1) the sense buf is busy
16398 	 *    2) we have 1 or more outstanding commands on the target
16399 	 *    (the sense data will be cleared or invalidated any way)
16400 	 *
16401 	 * Note: There could be an issue with not checking a retry limit here,
16402 	 * the problem is determining which retry limit to check.
16403 	 */
16404 	if ((un->un_sense_isbusy != 0) || (un->un_ncmds_in_transport > 0)) {
16405 		/* Don't retry if the command is flagged as non-retryable */
16406 		if ((pktp->pkt_flags & FLAG_DIAGNOSE) == 0) {
16407 			sd_retry_command(un, bp, SD_RETRIES_NOCHECK,
16408 			    NULL, NULL, 0, un->un_busy_timeout,
16409 			    kstat_waitq_enter);
16410 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16411 			    "sd_send_request_sense_command: "
16412 			    "at full throttle, retrying exit\n");
16413 		} else {
16414 			sd_return_failed_command(un, bp, EIO);
16415 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16416 			    "sd_send_request_sense_command: "
16417 			    "at full throttle, non-retryable exit\n");
16418 		}
16419 		return;
16420 	}
16421 
16422 	sd_mark_rqs_busy(un, bp);
16423 	sd_start_cmds(un, un->un_rqs_bp);
16424 
16425 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16426 	    "sd_send_request_sense_command: exit\n");
16427 }
16428 
16429 
16430 /*
16431  *    Function: sd_mark_rqs_busy
16432  *
16433  * Description: Indicate that the request sense bp for this instance is
16434  *		in use.
16435  *
16436  *     Context: May be called under interrupt context
16437  */
16438 
16439 static void
16440 sd_mark_rqs_busy(struct sd_lun *un, struct buf *bp)
16441 {
16442 	struct sd_xbuf	*sense_xp;
16443 
16444 	ASSERT(un != NULL);
16445 	ASSERT(bp != NULL);
16446 	ASSERT(mutex_owned(SD_MUTEX(un)));
16447 	ASSERT(un->un_sense_isbusy == 0);
16448 
16449 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_mark_rqs_busy: entry: "
16450 	    "buf:0x%p xp:0x%p un:0x%p\n", bp, SD_GET_XBUF(bp), un);
16451 
16452 	sense_xp = SD_GET_XBUF(un->un_rqs_bp);
16453 	ASSERT(sense_xp != NULL);
16454 
16455 	SD_INFO(SD_LOG_IO, un,
16456 	    "sd_mark_rqs_busy: entry: sense_xp:0x%p\n", sense_xp);
16457 
16458 	ASSERT(sense_xp->xb_pktp != NULL);
16459 	ASSERT((sense_xp->xb_pktp->pkt_flags & (FLAG_SENSING | FLAG_HEAD))
16460 	    == (FLAG_SENSING | FLAG_HEAD));
16461 
16462 	un->un_sense_isbusy = 1;
16463 	un->un_rqs_bp->b_resid = 0;
16464 	sense_xp->xb_pktp->pkt_resid  = 0;
16465 	sense_xp->xb_pktp->pkt_reason = 0;
16466 
16467 	/* So we can get back the bp at interrupt time! */
16468 	sense_xp->xb_sense_bp = bp;
16469 
16470 	bzero(un->un_rqs_bp->b_un.b_addr, SENSE_LENGTH);
16471 
16472 	/*
16473 	 * Mark this buf as awaiting sense data. (This is already set in
16474 	 * the pkt_flags for the RQS packet.)
16475 	 */
16476 	((SD_GET_XBUF(bp))->xb_pktp)->pkt_flags |= FLAG_SENSING;
16477 
16478 	/* Request sense down same path */
16479 	if (scsi_pkt_allocated_correctly((SD_GET_XBUF(bp))->xb_pktp) &&
16480 	    ((SD_GET_XBUF(bp))->xb_pktp)->pkt_path_instance)
16481 		sense_xp->xb_pktp->pkt_path_instance =
16482 		    ((SD_GET_XBUF(bp))->xb_pktp)->pkt_path_instance;
16483 
16484 	sense_xp->xb_retry_count = 0;
16485 	sense_xp->xb_victim_retry_count = 0;
16486 	sense_xp->xb_ua_retry_count = 0;
16487 	sense_xp->xb_nr_retry_count = 0;
16488 	sense_xp->xb_dma_resid  = 0;
16489 
16490 	/* Clean up the fields for auto-request sense */
16491 	sense_xp->xb_sense_status = 0;
16492 	sense_xp->xb_sense_state = 0;
16493 	sense_xp->xb_sense_resid = 0;
16494 	bzero(sense_xp->xb_sense_data, sizeof (sense_xp->xb_sense_data));
16495 
16496 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_mark_rqs_busy: exit\n");
16497 }
16498 
16499 
16500 /*
16501  *    Function: sd_mark_rqs_idle
16502  *
16503  * Description: SD_MUTEX must be held continuously through this routine
16504  *		to prevent reuse of the rqs struct before the caller can
16505  *		complete it's processing.
16506  *
16507  * Return Code: Pointer to the RQS buf
16508  *
16509  *     Context: May be called under interrupt context
16510  */
16511 
16512 static struct buf *
16513 sd_mark_rqs_idle(struct sd_lun *un, struct sd_xbuf *sense_xp)
16514 {
16515 	struct buf *bp;
16516 	ASSERT(un != NULL);
16517 	ASSERT(sense_xp != NULL);
16518 	ASSERT(mutex_owned(SD_MUTEX(un)));
16519 	ASSERT(un->un_sense_isbusy != 0);
16520 
16521 	un->un_sense_isbusy = 0;
16522 	bp = sense_xp->xb_sense_bp;
16523 	sense_xp->xb_sense_bp = NULL;
16524 
16525 	/* This pkt is no longer interested in getting sense data */
16526 	((SD_GET_XBUF(bp))->xb_pktp)->pkt_flags &= ~FLAG_SENSING;
16527 
16528 	return (bp);
16529 }
16530 
16531 
16532 
16533 /*
16534  *    Function: sd_alloc_rqs
16535  *
16536  * Description: Set up the unit to receive auto request sense data
16537  *
16538  * Return Code: DDI_SUCCESS or DDI_FAILURE
16539  *
16540  *     Context: Called under attach(9E) context
16541  */
16542 
16543 static int
16544 sd_alloc_rqs(struct scsi_device *devp, struct sd_lun *un)
16545 {
16546 	struct sd_xbuf *xp;
16547 
16548 	ASSERT(un != NULL);
16549 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16550 	ASSERT(un->un_rqs_bp == NULL);
16551 	ASSERT(un->un_rqs_pktp == NULL);
16552 
16553 	/*
16554 	 * First allocate the required buf and scsi_pkt structs, then set up
16555 	 * the CDB in the scsi_pkt for a REQUEST SENSE command.
16556 	 */
16557 	un->un_rqs_bp = scsi_alloc_consistent_buf(&devp->sd_address, NULL,
16558 	    MAX_SENSE_LENGTH, B_READ, SLEEP_FUNC, NULL);
16559 	if (un->un_rqs_bp == NULL) {
16560 		return (DDI_FAILURE);
16561 	}
16562 
16563 	un->un_rqs_pktp = scsi_init_pkt(&devp->sd_address, NULL, un->un_rqs_bp,
16564 	    CDB_GROUP0, 1, 0, PKT_CONSISTENT, SLEEP_FUNC, NULL);
16565 
16566 	if (un->un_rqs_pktp == NULL) {
16567 		sd_free_rqs(un);
16568 		return (DDI_FAILURE);
16569 	}
16570 
16571 	/* Set up the CDB in the scsi_pkt for a REQUEST SENSE command. */
16572 	(void) scsi_setup_cdb((union scsi_cdb *)un->un_rqs_pktp->pkt_cdbp,
16573 	    SCMD_REQUEST_SENSE, 0, MAX_SENSE_LENGTH, 0);
16574 
16575 	SD_FILL_SCSI1_LUN(un, un->un_rqs_pktp);
16576 
16577 	/* Set up the other needed members in the ARQ scsi_pkt. */
16578 	un->un_rqs_pktp->pkt_comp   = sdintr;
16579 	un->un_rqs_pktp->pkt_time   = sd_io_time;
16580 	un->un_rqs_pktp->pkt_flags |=
16581 	    (FLAG_SENSING | FLAG_HEAD);	/* (1222170) */
16582 
16583 	/*
16584 	 * Allocate  & init the sd_xbuf struct for the RQS command. Do not
16585 	 * provide any intpkt, destroypkt routines as we take care of
16586 	 * scsi_pkt allocation/freeing here and in sd_free_rqs().
16587 	 */
16588 	xp = kmem_alloc(sizeof (struct sd_xbuf), KM_SLEEP);
16589 	sd_xbuf_init(un, un->un_rqs_bp, xp, SD_CHAIN_NULL, NULL);
16590 	xp->xb_pktp = un->un_rqs_pktp;
16591 	SD_INFO(SD_LOG_ATTACH_DETACH, un,
16592 	    "sd_alloc_rqs: un 0x%p, rqs  xp 0x%p,  pkt 0x%p,  buf 0x%p\n",
16593 	    un, xp, un->un_rqs_pktp, un->un_rqs_bp);
16594 
16595 	/*
16596 	 * Save the pointer to the request sense private bp so it can
16597 	 * be retrieved in sdintr.
16598 	 */
16599 	un->un_rqs_pktp->pkt_private = un->un_rqs_bp;
16600 	ASSERT(un->un_rqs_bp->b_private == xp);
16601 
16602 	/*
16603 	 * See if the HBA supports auto-request sense for the specified
16604 	 * target/lun. If it does, then try to enable it (if not already
16605 	 * enabled).
16606 	 *
16607 	 * Note: For some HBAs (ifp & sf), scsi_ifsetcap will always return
16608 	 * failure, while for other HBAs (pln) scsi_ifsetcap will always
16609 	 * return success.  However, in both of these cases ARQ is always
16610 	 * enabled and scsi_ifgetcap will always return true. The best approach
16611 	 * is to issue the scsi_ifgetcap() first, then try the scsi_ifsetcap().
16612 	 *
16613 	 * The 3rd case is the HBA (adp) always return enabled on
16614 	 * scsi_ifgetgetcap even when it's not enable, the best approach
16615 	 * is issue a scsi_ifsetcap then a scsi_ifgetcap
16616 	 * Note: this case is to circumvent the Adaptec bug. (x86 only)
16617 	 */
16618 
16619 	if (un->un_f_is_fibre == TRUE) {
16620 		un->un_f_arq_enabled = TRUE;
16621 	} else {
16622 #if defined(__i386) || defined(__amd64)
16623 		/*
16624 		 * Circumvent the Adaptec bug, remove this code when
16625 		 * the bug is fixed
16626 		 */
16627 		(void) scsi_ifsetcap(SD_ADDRESS(un), "auto-rqsense", 1, 1);
16628 #endif
16629 		switch (scsi_ifgetcap(SD_ADDRESS(un), "auto-rqsense", 1)) {
16630 		case 0:
16631 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
16632 			    "sd_alloc_rqs: HBA supports ARQ\n");
16633 			/*
16634 			 * ARQ is supported by this HBA but currently is not
16635 			 * enabled. Attempt to enable it and if successful then
16636 			 * mark this instance as ARQ enabled.
16637 			 */
16638 			if (scsi_ifsetcap(SD_ADDRESS(un), "auto-rqsense", 1, 1)
16639 			    == 1) {
16640 				/* Successfully enabled ARQ in the HBA */
16641 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
16642 				    "sd_alloc_rqs: ARQ enabled\n");
16643 				un->un_f_arq_enabled = TRUE;
16644 			} else {
16645 				/* Could not enable ARQ in the HBA */
16646 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
16647 				    "sd_alloc_rqs: failed ARQ enable\n");
16648 				un->un_f_arq_enabled = FALSE;
16649 			}
16650 			break;
16651 		case 1:
16652 			/*
16653 			 * ARQ is supported by this HBA and is already enabled.
16654 			 * Just mark ARQ as enabled for this instance.
16655 			 */
16656 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
16657 			    "sd_alloc_rqs: ARQ already enabled\n");
16658 			un->un_f_arq_enabled = TRUE;
16659 			break;
16660 		default:
16661 			/*
16662 			 * ARQ is not supported by this HBA; disable it for this
16663 			 * instance.
16664 			 */
16665 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
16666 			    "sd_alloc_rqs: HBA does not support ARQ\n");
16667 			un->un_f_arq_enabled = FALSE;
16668 			break;
16669 		}
16670 	}
16671 
16672 	return (DDI_SUCCESS);
16673 }
16674 
16675 
16676 /*
16677  *    Function: sd_free_rqs
16678  *
16679  * Description: Cleanup for the pre-instance RQS command.
16680  *
16681  *     Context: Kernel thread context
16682  */
16683 
16684 static void
16685 sd_free_rqs(struct sd_lun *un)
16686 {
16687 	ASSERT(un != NULL);
16688 
16689 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_free_rqs: entry\n");
16690 
16691 	/*
16692 	 * If consistent memory is bound to a scsi_pkt, the pkt
16693 	 * has to be destroyed *before* freeing the consistent memory.
16694 	 * Don't change the sequence of this operations.
16695 	 * scsi_destroy_pkt() might access memory, which isn't allowed,
16696 	 * after it was freed in scsi_free_consistent_buf().
16697 	 */
16698 	if (un->un_rqs_pktp != NULL) {
16699 		scsi_destroy_pkt(un->un_rqs_pktp);
16700 		un->un_rqs_pktp = NULL;
16701 	}
16702 
16703 	if (un->un_rqs_bp != NULL) {
16704 		struct sd_xbuf *xp = SD_GET_XBUF(un->un_rqs_bp);
16705 		if (xp != NULL) {
16706 			kmem_free(xp, sizeof (struct sd_xbuf));
16707 		}
16708 		scsi_free_consistent_buf(un->un_rqs_bp);
16709 		un->un_rqs_bp = NULL;
16710 	}
16711 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_free_rqs: exit\n");
16712 }
16713 
16714 
16715 
16716 /*
16717  *    Function: sd_reduce_throttle
16718  *
16719  * Description: Reduces the maximum # of outstanding commands on a
16720  *		target to the current number of outstanding commands.
16721  *		Queues a tiemout(9F) callback to restore the limit
16722  *		after a specified interval has elapsed.
16723  *		Typically used when we get a TRAN_BUSY return code
16724  *		back from scsi_transport().
16725  *
16726  *   Arguments: un - ptr to the sd_lun softstate struct
16727  *		throttle_type: SD_THROTTLE_TRAN_BUSY or SD_THROTTLE_QFULL
16728  *
16729  *     Context: May be called from interrupt context
16730  */
16731 
16732 static void
16733 sd_reduce_throttle(struct sd_lun *un, int throttle_type)
16734 {
16735 	ASSERT(un != NULL);
16736 	ASSERT(mutex_owned(SD_MUTEX(un)));
16737 	ASSERT(un->un_ncmds_in_transport >= 0);
16738 
16739 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_reduce_throttle: "
16740 	    "entry: un:0x%p un_throttle:%d un_ncmds_in_transport:%d\n",
16741 	    un, un->un_throttle, un->un_ncmds_in_transport);
16742 
16743 	if (un->un_throttle > 1) {
16744 		if (un->un_f_use_adaptive_throttle == TRUE) {
16745 			switch (throttle_type) {
16746 			case SD_THROTTLE_TRAN_BUSY:
16747 				if (un->un_busy_throttle == 0) {
16748 					un->un_busy_throttle = un->un_throttle;
16749 				}
16750 				break;
16751 			case SD_THROTTLE_QFULL:
16752 				un->un_busy_throttle = 0;
16753 				break;
16754 			default:
16755 				ASSERT(FALSE);
16756 			}
16757 
16758 			if (un->un_ncmds_in_transport > 0) {
16759 				un->un_throttle = un->un_ncmds_in_transport;
16760 			}
16761 
16762 		} else {
16763 			if (un->un_ncmds_in_transport == 0) {
16764 				un->un_throttle = 1;
16765 			} else {
16766 				un->un_throttle = un->un_ncmds_in_transport;
16767 			}
16768 		}
16769 	}
16770 
16771 	/* Reschedule the timeout if none is currently active */
16772 	if (un->un_reset_throttle_timeid == NULL) {
16773 		un->un_reset_throttle_timeid = timeout(sd_restore_throttle,
16774 		    un, SD_THROTTLE_RESET_INTERVAL);
16775 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16776 		    "sd_reduce_throttle: timeout scheduled!\n");
16777 	}
16778 
16779 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_reduce_throttle: "
16780 	    "exit: un:0x%p un_throttle:%d\n", un, un->un_throttle);
16781 }
16782 
16783 
16784 
16785 /*
16786  *    Function: sd_restore_throttle
16787  *
16788  * Description: Callback function for timeout(9F).  Resets the current
16789  *		value of un->un_throttle to its default.
16790  *
16791  *   Arguments: arg - pointer to associated softstate for the device.
16792  *
16793  *     Context: May be called from interrupt context
16794  */
16795 
16796 static void
16797 sd_restore_throttle(void *arg)
16798 {
16799 	struct sd_lun	*un = arg;
16800 
16801 	ASSERT(un != NULL);
16802 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16803 
16804 	mutex_enter(SD_MUTEX(un));
16805 
16806 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sd_restore_throttle: "
16807 	    "entry: un:0x%p un_throttle:%d\n", un, un->un_throttle);
16808 
16809 	un->un_reset_throttle_timeid = NULL;
16810 
16811 	if (un->un_f_use_adaptive_throttle == TRUE) {
16812 		/*
16813 		 * If un_busy_throttle is nonzero, then it contains the
16814 		 * value that un_throttle was when we got a TRAN_BUSY back
16815 		 * from scsi_transport(). We want to revert back to this
16816 		 * value.
16817 		 *
16818 		 * In the QFULL case, the throttle limit will incrementally
16819 		 * increase until it reaches max throttle.
16820 		 */
16821 		if (un->un_busy_throttle > 0) {
16822 			un->un_throttle = un->un_busy_throttle;
16823 			un->un_busy_throttle = 0;
16824 		} else {
16825 			/*
16826 			 * increase throttle by 10% open gate slowly, schedule
16827 			 * another restore if saved throttle has not been
16828 			 * reached
16829 			 */
16830 			short throttle;
16831 			if (sd_qfull_throttle_enable) {
16832 				throttle = un->un_throttle +
16833 				    max((un->un_throttle / 10), 1);
16834 				un->un_throttle =
16835 				    (throttle < un->un_saved_throttle) ?
16836 				    throttle : un->un_saved_throttle;
16837 				if (un->un_throttle < un->un_saved_throttle) {
16838 					un->un_reset_throttle_timeid =
16839 					    timeout(sd_restore_throttle,
16840 					    un,
16841 					    SD_QFULL_THROTTLE_RESET_INTERVAL);
16842 				}
16843 			}
16844 		}
16845 
16846 		/*
16847 		 * If un_throttle has fallen below the low-water mark, we
16848 		 * restore the maximum value here (and allow it to ratchet
16849 		 * down again if necessary).
16850 		 */
16851 		if (un->un_throttle < un->un_min_throttle) {
16852 			un->un_throttle = un->un_saved_throttle;
16853 		}
16854 	} else {
16855 		SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sd_restore_throttle: "
16856 		    "restoring limit from 0x%x to 0x%x\n",
16857 		    un->un_throttle, un->un_saved_throttle);
16858 		un->un_throttle = un->un_saved_throttle;
16859 	}
16860 
16861 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
16862 	    "sd_restore_throttle: calling sd_start_cmds!\n");
16863 
16864 	sd_start_cmds(un, NULL);
16865 
16866 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
16867 	    "sd_restore_throttle: exit: un:0x%p un_throttle:%d\n",
16868 	    un, un->un_throttle);
16869 
16870 	mutex_exit(SD_MUTEX(un));
16871 
16872 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sd_restore_throttle: exit\n");
16873 }
16874 
16875 /*
16876  *    Function: sdrunout
16877  *
16878  * Description: Callback routine for scsi_init_pkt when a resource allocation
16879  *		fails.
16880  *
16881  *   Arguments: arg - a pointer to the sd_lun unit struct for the particular
16882  *		soft state instance.
16883  *
16884  * Return Code: The scsi_init_pkt routine allows for the callback function to
16885  *		return a 0 indicating the callback should be rescheduled or a 1
16886  *		indicating not to reschedule. This routine always returns 1
16887  *		because the driver always provides a callback function to
16888  *		scsi_init_pkt. This results in a callback always being scheduled
16889  *		(via the scsi_init_pkt callback implementation) if a resource
16890  *		failure occurs.
16891  *
16892  *     Context: This callback function may not block or call routines that block
16893  *
16894  *        Note: Using the scsi_init_pkt callback facility can result in an I/O
16895  *		request persisting at the head of the list which cannot be
16896  *		satisfied even after multiple retries. In the future the driver
16897  *		may implement some time of maximum runout count before failing
16898  *		an I/O.
16899  */
16900 
16901 static int
16902 sdrunout(caddr_t arg)
16903 {
16904 	struct sd_lun	*un = (struct sd_lun *)arg;
16905 
16906 	ASSERT(un != NULL);
16907 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16908 
16909 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sdrunout: entry\n");
16910 
16911 	mutex_enter(SD_MUTEX(un));
16912 	sd_start_cmds(un, NULL);
16913 	mutex_exit(SD_MUTEX(un));
16914 	/*
16915 	 * This callback routine always returns 1 (i.e. do not reschedule)
16916 	 * because we always specify sdrunout as the callback handler for
16917 	 * scsi_init_pkt inside the call to sd_start_cmds.
16918 	 */
16919 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sdrunout: exit\n");
16920 	return (1);
16921 }
16922 
16923 
16924 /*
16925  *    Function: sdintr
16926  *
16927  * Description: Completion callback routine for scsi_pkt(9S) structs
16928  *		sent to the HBA driver via scsi_transport(9F).
16929  *
16930  *     Context: Interrupt context
16931  */
16932 
16933 static void
16934 sdintr(struct scsi_pkt *pktp)
16935 {
16936 	struct buf	*bp;
16937 	struct sd_xbuf	*xp;
16938 	struct sd_lun	*un;
16939 	size_t		actual_len;
16940 	sd_ssc_t	*sscp;
16941 
16942 	ASSERT(pktp != NULL);
16943 	bp = (struct buf *)pktp->pkt_private;
16944 	ASSERT(bp != NULL);
16945 	xp = SD_GET_XBUF(bp);
16946 	ASSERT(xp != NULL);
16947 	ASSERT(xp->xb_pktp != NULL);
16948 	un = SD_GET_UN(bp);
16949 	ASSERT(un != NULL);
16950 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16951 
16952 #ifdef SD_FAULT_INJECTION
16953 
16954 	SD_INFO(SD_LOG_IOERR, un, "sdintr: sdintr calling Fault injection\n");
16955 	/* SD FaultInjection */
16956 	sd_faultinjection(pktp);
16957 
16958 #endif /* SD_FAULT_INJECTION */
16959 
16960 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sdintr: entry: buf:0x%p,"
16961 	    " xp:0x%p, un:0x%p\n", bp, xp, un);
16962 
16963 	mutex_enter(SD_MUTEX(un));
16964 
16965 	ASSERT(un->un_fm_private != NULL);
16966 	sscp = &((struct sd_fm_internal *)(un->un_fm_private))->fm_ssc;
16967 	ASSERT(sscp != NULL);
16968 
16969 	/* Reduce the count of the #commands currently in transport */
16970 	un->un_ncmds_in_transport--;
16971 	ASSERT(un->un_ncmds_in_transport >= 0);
16972 
16973 	/* Increment counter to indicate that the callback routine is active */
16974 	un->un_in_callback++;
16975 
16976 	SD_UPDATE_KSTATS(un, kstat_runq_exit, bp);
16977 
16978 #ifdef	SDDEBUG
16979 	if (bp == un->un_retry_bp) {
16980 		SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sdintr: "
16981 		    "un:0x%p: GOT retry_bp:0x%p un_ncmds_in_transport:%d\n",
16982 		    un, un->un_retry_bp, un->un_ncmds_in_transport);
16983 	}
16984 #endif
16985 
16986 	/*
16987 	 * If pkt_reason is CMD_DEV_GONE, fail the command, and update the media
16988 	 * state if needed.
16989 	 */
16990 	if (pktp->pkt_reason == CMD_DEV_GONE) {
16991 		/* Prevent multiple console messages for the same failure. */
16992 		if (un->un_last_pkt_reason != CMD_DEV_GONE) {
16993 			un->un_last_pkt_reason = CMD_DEV_GONE;
16994 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
16995 			    "Command failed to complete...Device is gone\n");
16996 		}
16997 		if (un->un_mediastate != DKIO_DEV_GONE) {
16998 			un->un_mediastate = DKIO_DEV_GONE;
16999 			cv_broadcast(&un->un_state_cv);
17000 		}
17001 		/*
17002 		 * If the command happens to be the REQUEST SENSE command,
17003 		 * free up the rqs buf and fail the original command.
17004 		 */
17005 		if (bp == un->un_rqs_bp) {
17006 			bp = sd_mark_rqs_idle(un, xp);
17007 		}
17008 		sd_return_failed_command(un, bp, EIO);
17009 		goto exit;
17010 	}
17011 
17012 	if (pktp->pkt_state & STATE_XARQ_DONE) {
17013 		SD_TRACE(SD_LOG_COMMON, un,
17014 		    "sdintr: extra sense data received. pkt=%p\n", pktp);
17015 	}
17016 
17017 	/*
17018 	 * First see if the pkt has auto-request sense data with it....
17019 	 * Look at the packet state first so we don't take a performance
17020 	 * hit looking at the arq enabled flag unless absolutely necessary.
17021 	 */
17022 	if ((pktp->pkt_state & STATE_ARQ_DONE) &&
17023 	    (un->un_f_arq_enabled == TRUE)) {
17024 		/*
17025 		 * The HBA did an auto request sense for this command so check
17026 		 * for FLAG_DIAGNOSE. If set this indicates a uscsi or internal
17027 		 * driver command that should not be retried.
17028 		 */
17029 		if ((pktp->pkt_flags & FLAG_DIAGNOSE) != 0) {
17030 			/*
17031 			 * Save the relevant sense info into the xp for the
17032 			 * original cmd.
17033 			 */
17034 			struct scsi_arq_status *asp;
17035 			asp = (struct scsi_arq_status *)(pktp->pkt_scbp);
17036 			xp->xb_sense_status =
17037 			    *((uchar_t *)(&(asp->sts_rqpkt_status)));
17038 			xp->xb_sense_state  = asp->sts_rqpkt_state;
17039 			xp->xb_sense_resid  = asp->sts_rqpkt_resid;
17040 			if (pktp->pkt_state & STATE_XARQ_DONE) {
17041 				actual_len = MAX_SENSE_LENGTH -
17042 				    xp->xb_sense_resid;
17043 				bcopy(&asp->sts_sensedata, xp->xb_sense_data,
17044 				    MAX_SENSE_LENGTH);
17045 			} else {
17046 				if (xp->xb_sense_resid > SENSE_LENGTH) {
17047 					actual_len = MAX_SENSE_LENGTH -
17048 					    xp->xb_sense_resid;
17049 				} else {
17050 					actual_len = SENSE_LENGTH -
17051 					    xp->xb_sense_resid;
17052 				}
17053 				if (xp->xb_pkt_flags & SD_XB_USCSICMD) {
17054 					if ((((struct uscsi_cmd *)
17055 					    (xp->xb_pktinfo))->uscsi_rqlen) >
17056 					    actual_len) {
17057 						xp->xb_sense_resid =
17058 						    (((struct uscsi_cmd *)
17059 						    (xp->xb_pktinfo))->
17060 						    uscsi_rqlen) - actual_len;
17061 					} else {
17062 						xp->xb_sense_resid = 0;
17063 					}
17064 				}
17065 				bcopy(&asp->sts_sensedata, xp->xb_sense_data,
17066 				    SENSE_LENGTH);
17067 			}
17068 
17069 			/* fail the command */
17070 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17071 			    "sdintr: arq done and FLAG_DIAGNOSE set\n");
17072 			sd_return_failed_command(un, bp, EIO);
17073 			goto exit;
17074 		}
17075 
17076 #if (defined(__i386) || defined(__amd64))	/* DMAFREE for x86 only */
17077 		/*
17078 		 * We want to either retry or fail this command, so free
17079 		 * the DMA resources here.  If we retry the command then
17080 		 * the DMA resources will be reallocated in sd_start_cmds().
17081 		 * Note that when PKT_DMA_PARTIAL is used, this reallocation
17082 		 * causes the *entire* transfer to start over again from the
17083 		 * beginning of the request, even for PARTIAL chunks that
17084 		 * have already transferred successfully.
17085 		 */
17086 		if ((un->un_f_is_fibre == TRUE) &&
17087 		    ((xp->xb_pkt_flags & SD_XB_USCSICMD) == 0) &&
17088 		    ((pktp->pkt_flags & FLAG_SENSING) == 0))  {
17089 			scsi_dmafree(pktp);
17090 			xp->xb_pkt_flags |= SD_XB_DMA_FREED;
17091 		}
17092 #endif
17093 
17094 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17095 		    "sdintr: arq done, sd_handle_auto_request_sense\n");
17096 
17097 		sd_handle_auto_request_sense(un, bp, xp, pktp);
17098 		goto exit;
17099 	}
17100 
17101 	/* Next see if this is the REQUEST SENSE pkt for the instance */
17102 	if (pktp->pkt_flags & FLAG_SENSING)  {
17103 		/* This pktp is from the unit's REQUEST_SENSE command */
17104 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17105 		    "sdintr: sd_handle_request_sense\n");
17106 		sd_handle_request_sense(un, bp, xp, pktp);
17107 		goto exit;
17108 	}
17109 
17110 	/*
17111 	 * Check to see if the command successfully completed as requested;
17112 	 * this is the most common case (and also the hot performance path).
17113 	 *
17114 	 * Requirements for successful completion are:
17115 	 * pkt_reason is CMD_CMPLT and packet status is status good.
17116 	 * In addition:
17117 	 * - A residual of zero indicates successful completion no matter what
17118 	 *   the command is.
17119 	 * - If the residual is not zero and the command is not a read or
17120 	 *   write, then it's still defined as successful completion. In other
17121 	 *   words, if the command is a read or write the residual must be
17122 	 *   zero for successful completion.
17123 	 * - If the residual is not zero and the command is a read or
17124 	 *   write, and it's a USCSICMD, then it's still defined as
17125 	 *   successful completion.
17126 	 */
17127 	if ((pktp->pkt_reason == CMD_CMPLT) &&
17128 	    (SD_GET_PKT_STATUS(pktp) == STATUS_GOOD)) {
17129 
17130 		/*
17131 		 * Since this command is returned with a good status, we
17132 		 * can reset the count for Sonoma failover.
17133 		 */
17134 		un->un_sonoma_failure_count = 0;
17135 
17136 		/*
17137 		 * Return all USCSI commands on good status
17138 		 */
17139 		if (pktp->pkt_resid == 0) {
17140 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17141 			    "sdintr: returning command for resid == 0\n");
17142 		} else if (((SD_GET_PKT_OPCODE(pktp) & 0x1F) != SCMD_READ) &&
17143 		    ((SD_GET_PKT_OPCODE(pktp) & 0x1F) != SCMD_WRITE)) {
17144 			SD_UPDATE_B_RESID(bp, pktp);
17145 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17146 			    "sdintr: returning command for resid != 0\n");
17147 		} else if (xp->xb_pkt_flags & SD_XB_USCSICMD) {
17148 			SD_UPDATE_B_RESID(bp, pktp);
17149 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17150 			    "sdintr: returning uscsi command\n");
17151 		} else {
17152 			goto not_successful;
17153 		}
17154 		sd_return_command(un, bp);
17155 
17156 		/*
17157 		 * Decrement counter to indicate that the callback routine
17158 		 * is done.
17159 		 */
17160 		un->un_in_callback--;
17161 		ASSERT(un->un_in_callback >= 0);
17162 		mutex_exit(SD_MUTEX(un));
17163 
17164 		return;
17165 	}
17166 
17167 not_successful:
17168 
17169 #if (defined(__i386) || defined(__amd64))	/* DMAFREE for x86 only */
17170 	/*
17171 	 * The following is based upon knowledge of the underlying transport
17172 	 * and its use of DMA resources.  This code should be removed when
17173 	 * PKT_DMA_PARTIAL support is taken out of the disk driver in favor
17174 	 * of the new PKT_CMD_BREAKUP protocol. See also sd_initpkt_for_buf()
17175 	 * and sd_start_cmds().
17176 	 *
17177 	 * Free any DMA resources associated with this command if there
17178 	 * is a chance it could be retried or enqueued for later retry.
17179 	 * If we keep the DMA binding then mpxio cannot reissue the
17180 	 * command on another path whenever a path failure occurs.
17181 	 *
17182 	 * Note that when PKT_DMA_PARTIAL is used, free/reallocation
17183 	 * causes the *entire* transfer to start over again from the
17184 	 * beginning of the request, even for PARTIAL chunks that
17185 	 * have already transferred successfully.
17186 	 *
17187 	 * This is only done for non-uscsi commands (and also skipped for the
17188 	 * driver's internal RQS command). Also just do this for Fibre Channel
17189 	 * devices as these are the only ones that support mpxio.
17190 	 */
17191 	if ((un->un_f_is_fibre == TRUE) &&
17192 	    ((xp->xb_pkt_flags & SD_XB_USCSICMD) == 0) &&
17193 	    ((pktp->pkt_flags & FLAG_SENSING) == 0))  {
17194 		scsi_dmafree(pktp);
17195 		xp->xb_pkt_flags |= SD_XB_DMA_FREED;
17196 	}
17197 #endif
17198 
17199 	/*
17200 	 * The command did not successfully complete as requested so check
17201 	 * for FLAG_DIAGNOSE. If set this indicates a uscsi or internal
17202 	 * driver command that should not be retried so just return. If
17203 	 * FLAG_DIAGNOSE is not set the error will be processed below.
17204 	 */
17205 	if ((pktp->pkt_flags & FLAG_DIAGNOSE) != 0) {
17206 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17207 		    "sdintr: FLAG_DIAGNOSE: sd_return_failed_command\n");
17208 		/*
17209 		 * Issue a request sense if a check condition caused the error
17210 		 * (we handle the auto request sense case above), otherwise
17211 		 * just fail the command.
17212 		 */
17213 		if ((pktp->pkt_reason == CMD_CMPLT) &&
17214 		    (SD_GET_PKT_STATUS(pktp) == STATUS_CHECK)) {
17215 			sd_send_request_sense_command(un, bp, pktp);
17216 		} else {
17217 			sd_return_failed_command(un, bp, EIO);
17218 		}
17219 		goto exit;
17220 	}
17221 
17222 	/*
17223 	 * The command did not successfully complete as requested so process
17224 	 * the error, retry, and/or attempt recovery.
17225 	 */
17226 	switch (pktp->pkt_reason) {
17227 	case CMD_CMPLT:
17228 		switch (SD_GET_PKT_STATUS(pktp)) {
17229 		case STATUS_GOOD:
17230 			/*
17231 			 * The command completed successfully with a non-zero
17232 			 * residual
17233 			 */
17234 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17235 			    "sdintr: STATUS_GOOD \n");
17236 			sd_pkt_status_good(un, bp, xp, pktp);
17237 			break;
17238 
17239 		case STATUS_CHECK:
17240 		case STATUS_TERMINATED:
17241 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17242 			    "sdintr: STATUS_TERMINATED | STATUS_CHECK\n");
17243 			sd_pkt_status_check_condition(un, bp, xp, pktp);
17244 			break;
17245 
17246 		case STATUS_BUSY:
17247 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17248 			    "sdintr: STATUS_BUSY\n");
17249 			sd_pkt_status_busy(un, bp, xp, pktp);
17250 			break;
17251 
17252 		case STATUS_RESERVATION_CONFLICT:
17253 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17254 			    "sdintr: STATUS_RESERVATION_CONFLICT\n");
17255 			sd_pkt_status_reservation_conflict(un, bp, xp, pktp);
17256 			break;
17257 
17258 		case STATUS_QFULL:
17259 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17260 			    "sdintr: STATUS_QFULL\n");
17261 			sd_pkt_status_qfull(un, bp, xp, pktp);
17262 			break;
17263 
17264 		case STATUS_MET:
17265 		case STATUS_INTERMEDIATE:
17266 		case STATUS_SCSI2:
17267 		case STATUS_INTERMEDIATE_MET:
17268 		case STATUS_ACA_ACTIVE:
17269 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17270 			    "Unexpected SCSI status received: 0x%x\n",
17271 			    SD_GET_PKT_STATUS(pktp));
17272 			/*
17273 			 * Mark the ssc_flags when detected invalid status
17274 			 * code for non-USCSI command.
17275 			 */
17276 			if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17277 				sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_STATUS,
17278 				    0, "stat-code");
17279 			}
17280 			sd_return_failed_command(un, bp, EIO);
17281 			break;
17282 
17283 		default:
17284 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17285 			    "Invalid SCSI status received: 0x%x\n",
17286 			    SD_GET_PKT_STATUS(pktp));
17287 			if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17288 				sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_STATUS,
17289 				    0, "stat-code");
17290 			}
17291 			sd_return_failed_command(un, bp, EIO);
17292 			break;
17293 
17294 		}
17295 		break;
17296 
17297 	case CMD_INCOMPLETE:
17298 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17299 		    "sdintr:  CMD_INCOMPLETE\n");
17300 		sd_pkt_reason_cmd_incomplete(un, bp, xp, pktp);
17301 		break;
17302 	case CMD_TRAN_ERR:
17303 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17304 		    "sdintr: CMD_TRAN_ERR\n");
17305 		sd_pkt_reason_cmd_tran_err(un, bp, xp, pktp);
17306 		break;
17307 	case CMD_RESET:
17308 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17309 		    "sdintr: CMD_RESET \n");
17310 		sd_pkt_reason_cmd_reset(un, bp, xp, pktp);
17311 		break;
17312 	case CMD_ABORTED:
17313 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17314 		    "sdintr: CMD_ABORTED \n");
17315 		sd_pkt_reason_cmd_aborted(un, bp, xp, pktp);
17316 		break;
17317 	case CMD_TIMEOUT:
17318 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17319 		    "sdintr: CMD_TIMEOUT\n");
17320 		sd_pkt_reason_cmd_timeout(un, bp, xp, pktp);
17321 		break;
17322 	case CMD_UNX_BUS_FREE:
17323 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17324 		    "sdintr: CMD_UNX_BUS_FREE \n");
17325 		sd_pkt_reason_cmd_unx_bus_free(un, bp, xp, pktp);
17326 		break;
17327 	case CMD_TAG_REJECT:
17328 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17329 		    "sdintr: CMD_TAG_REJECT\n");
17330 		sd_pkt_reason_cmd_tag_reject(un, bp, xp, pktp);
17331 		break;
17332 	default:
17333 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17334 		    "sdintr: default\n");
17335 		/*
17336 		 * Mark the ssc_flags for detecting invliad pkt_reason.
17337 		 */
17338 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17339 			sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_PKT_REASON,
17340 			    0, "pkt-reason");
17341 		}
17342 		sd_pkt_reason_default(un, bp, xp, pktp);
17343 		break;
17344 	}
17345 
17346 exit:
17347 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sdintr: exit\n");
17348 
17349 	/* Decrement counter to indicate that the callback routine is done. */
17350 	un->un_in_callback--;
17351 	ASSERT(un->un_in_callback >= 0);
17352 
17353 	/*
17354 	 * At this point, the pkt has been dispatched, ie, it is either
17355 	 * being re-tried or has been returned to its caller and should
17356 	 * not be referenced.
17357 	 */
17358 
17359 	mutex_exit(SD_MUTEX(un));
17360 }
17361 
17362 
17363 /*
17364  *    Function: sd_print_incomplete_msg
17365  *
17366  * Description: Prints the error message for a CMD_INCOMPLETE error.
17367  *
17368  *   Arguments: un - ptr to associated softstate for the device.
17369  *		bp - ptr to the buf(9S) for the command.
17370  *		arg - message string ptr
17371  *		code - SD_DELAYED_RETRY_ISSUED, SD_IMMEDIATE_RETRY_ISSUED,
17372  *			or SD_NO_RETRY_ISSUED.
17373  *
17374  *     Context: May be called under interrupt context
17375  */
17376 
17377 static void
17378 sd_print_incomplete_msg(struct sd_lun *un, struct buf *bp, void *arg, int code)
17379 {
17380 	struct scsi_pkt	*pktp;
17381 	char	*msgp;
17382 	char	*cmdp = arg;
17383 
17384 	ASSERT(un != NULL);
17385 	ASSERT(mutex_owned(SD_MUTEX(un)));
17386 	ASSERT(bp != NULL);
17387 	ASSERT(arg != NULL);
17388 	pktp = SD_GET_PKTP(bp);
17389 	ASSERT(pktp != NULL);
17390 
17391 	switch (code) {
17392 	case SD_DELAYED_RETRY_ISSUED:
17393 	case SD_IMMEDIATE_RETRY_ISSUED:
17394 		msgp = "retrying";
17395 		break;
17396 	case SD_NO_RETRY_ISSUED:
17397 	default:
17398 		msgp = "giving up";
17399 		break;
17400 	}
17401 
17402 	if ((pktp->pkt_flags & FLAG_SILENT) == 0) {
17403 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17404 		    "incomplete %s- %s\n", cmdp, msgp);
17405 	}
17406 }
17407 
17408 
17409 
17410 /*
17411  *    Function: sd_pkt_status_good
17412  *
17413  * Description: Processing for a STATUS_GOOD code in pkt_status.
17414  *
17415  *     Context: May be called under interrupt context
17416  */
17417 
17418 static void
17419 sd_pkt_status_good(struct sd_lun *un, struct buf *bp,
17420     struct sd_xbuf *xp, struct scsi_pkt *pktp)
17421 {
17422 	char	*cmdp;
17423 
17424 	ASSERT(un != NULL);
17425 	ASSERT(mutex_owned(SD_MUTEX(un)));
17426 	ASSERT(bp != NULL);
17427 	ASSERT(xp != NULL);
17428 	ASSERT(pktp != NULL);
17429 	ASSERT(pktp->pkt_reason == CMD_CMPLT);
17430 	ASSERT(SD_GET_PKT_STATUS(pktp) == STATUS_GOOD);
17431 	ASSERT(pktp->pkt_resid != 0);
17432 
17433 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_pkt_status_good: entry\n");
17434 
17435 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
17436 	switch (SD_GET_PKT_OPCODE(pktp) & 0x1F) {
17437 	case SCMD_READ:
17438 		cmdp = "read";
17439 		break;
17440 	case SCMD_WRITE:
17441 		cmdp = "write";
17442 		break;
17443 	default:
17444 		SD_UPDATE_B_RESID(bp, pktp);
17445 		sd_return_command(un, bp);
17446 		SD_TRACE(SD_LOG_IO_CORE, un, "sd_pkt_status_good: exit\n");
17447 		return;
17448 	}
17449 
17450 	/*
17451 	 * See if we can retry the read/write, preferrably immediately.
17452 	 * If retries are exhaused, then sd_retry_command() will update
17453 	 * the b_resid count.
17454 	 */
17455 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_incomplete_msg,
17456 	    cmdp, EIO, (clock_t)0, NULL);
17457 
17458 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_pkt_status_good: exit\n");
17459 }
17460 
17461 
17462 
17463 
17464 
17465 /*
17466  *    Function: sd_handle_request_sense
17467  *
17468  * Description: Processing for non-auto Request Sense command.
17469  *
17470  *   Arguments: un - ptr to associated softstate
17471  *		sense_bp - ptr to buf(9S) for the RQS command
17472  *		sense_xp - ptr to the sd_xbuf for the RQS command
17473  *		sense_pktp - ptr to the scsi_pkt(9S) for the RQS command
17474  *
17475  *     Context: May be called under interrupt context
17476  */
17477 
17478 static void
17479 sd_handle_request_sense(struct sd_lun *un, struct buf *sense_bp,
17480     struct sd_xbuf *sense_xp, struct scsi_pkt *sense_pktp)
17481 {
17482 	struct buf	*cmd_bp;	/* buf for the original command */
17483 	struct sd_xbuf	*cmd_xp;	/* sd_xbuf for the original command */
17484 	struct scsi_pkt *cmd_pktp;	/* pkt for the original command */
17485 	size_t		actual_len;	/* actual sense data length */
17486 
17487 	ASSERT(un != NULL);
17488 	ASSERT(mutex_owned(SD_MUTEX(un)));
17489 	ASSERT(sense_bp != NULL);
17490 	ASSERT(sense_xp != NULL);
17491 	ASSERT(sense_pktp != NULL);
17492 
17493 	/*
17494 	 * Note the sense_bp, sense_xp, and sense_pktp here are for the
17495 	 * RQS command and not the original command.
17496 	 */
17497 	ASSERT(sense_pktp == un->un_rqs_pktp);
17498 	ASSERT(sense_bp   == un->un_rqs_bp);
17499 	ASSERT((sense_pktp->pkt_flags & (FLAG_SENSING | FLAG_HEAD)) ==
17500 	    (FLAG_SENSING | FLAG_HEAD));
17501 	ASSERT((((SD_GET_XBUF(sense_xp->xb_sense_bp))->xb_pktp->pkt_flags) &
17502 	    FLAG_SENSING) == FLAG_SENSING);
17503 
17504 	/* These are the bp, xp, and pktp for the original command */
17505 	cmd_bp = sense_xp->xb_sense_bp;
17506 	cmd_xp = SD_GET_XBUF(cmd_bp);
17507 	cmd_pktp = SD_GET_PKTP(cmd_bp);
17508 
17509 	if (sense_pktp->pkt_reason != CMD_CMPLT) {
17510 		/*
17511 		 * The REQUEST SENSE command failed.  Release the REQUEST
17512 		 * SENSE command for re-use, get back the bp for the original
17513 		 * command, and attempt to re-try the original command if
17514 		 * FLAG_DIAGNOSE is not set in the original packet.
17515 		 */
17516 		SD_UPDATE_ERRSTATS(un, sd_harderrs);
17517 		if ((cmd_pktp->pkt_flags & FLAG_DIAGNOSE) == 0) {
17518 			cmd_bp = sd_mark_rqs_idle(un, sense_xp);
17519 			sd_retry_command(un, cmd_bp, SD_RETRIES_STANDARD,
17520 			    NULL, NULL, EIO, (clock_t)0, NULL);
17521 			return;
17522 		}
17523 	}
17524 
17525 	/*
17526 	 * Save the relevant sense info into the xp for the original cmd.
17527 	 *
17528 	 * Note: if the request sense failed the state info will be zero
17529 	 * as set in sd_mark_rqs_busy()
17530 	 */
17531 	cmd_xp->xb_sense_status = *(sense_pktp->pkt_scbp);
17532 	cmd_xp->xb_sense_state  = sense_pktp->pkt_state;
17533 	actual_len = MAX_SENSE_LENGTH - sense_pktp->pkt_resid;
17534 	if ((cmd_xp->xb_pkt_flags & SD_XB_USCSICMD) &&
17535 	    (((struct uscsi_cmd *)cmd_xp->xb_pktinfo)->uscsi_rqlen >
17536 	    SENSE_LENGTH)) {
17537 		bcopy(sense_bp->b_un.b_addr, cmd_xp->xb_sense_data,
17538 		    MAX_SENSE_LENGTH);
17539 		cmd_xp->xb_sense_resid = sense_pktp->pkt_resid;
17540 	} else {
17541 		bcopy(sense_bp->b_un.b_addr, cmd_xp->xb_sense_data,
17542 		    SENSE_LENGTH);
17543 		if (actual_len < SENSE_LENGTH) {
17544 			cmd_xp->xb_sense_resid = SENSE_LENGTH - actual_len;
17545 		} else {
17546 			cmd_xp->xb_sense_resid = 0;
17547 		}
17548 	}
17549 
17550 	/*
17551 	 *  Free up the RQS command....
17552 	 *  NOTE:
17553 	 *	Must do this BEFORE calling sd_validate_sense_data!
17554 	 *	sd_validate_sense_data may return the original command in
17555 	 *	which case the pkt will be freed and the flags can no
17556 	 *	longer be touched.
17557 	 *	SD_MUTEX is held through this process until the command
17558 	 *	is dispatched based upon the sense data, so there are
17559 	 *	no race conditions.
17560 	 */
17561 	(void) sd_mark_rqs_idle(un, sense_xp);
17562 
17563 	/*
17564 	 * For a retryable command see if we have valid sense data, if so then
17565 	 * turn it over to sd_decode_sense() to figure out the right course of
17566 	 * action. Just fail a non-retryable command.
17567 	 */
17568 	if ((cmd_pktp->pkt_flags & FLAG_DIAGNOSE) == 0) {
17569 		if (sd_validate_sense_data(un, cmd_bp, cmd_xp, actual_len) ==
17570 		    SD_SENSE_DATA_IS_VALID) {
17571 			sd_decode_sense(un, cmd_bp, cmd_xp, cmd_pktp);
17572 		}
17573 	} else {
17574 		SD_DUMP_MEMORY(un, SD_LOG_IO_CORE, "Failed CDB",
17575 		    (uchar_t *)cmd_pktp->pkt_cdbp, CDB_SIZE, SD_LOG_HEX);
17576 		SD_DUMP_MEMORY(un, SD_LOG_IO_CORE, "Sense Data",
17577 		    (uchar_t *)cmd_xp->xb_sense_data, SENSE_LENGTH, SD_LOG_HEX);
17578 		sd_return_failed_command(un, cmd_bp, EIO);
17579 	}
17580 }
17581 
17582 
17583 
17584 
17585 /*
17586  *    Function: sd_handle_auto_request_sense
17587  *
17588  * Description: Processing for auto-request sense information.
17589  *
17590  *   Arguments: un - ptr to associated softstate
17591  *		bp - ptr to buf(9S) for the command
17592  *		xp - ptr to the sd_xbuf for the command
17593  *		pktp - ptr to the scsi_pkt(9S) for the command
17594  *
17595  *     Context: May be called under interrupt context
17596  */
17597 
17598 static void
17599 sd_handle_auto_request_sense(struct sd_lun *un, struct buf *bp,
17600     struct sd_xbuf *xp, struct scsi_pkt *pktp)
17601 {
17602 	struct scsi_arq_status *asp;
17603 	size_t actual_len;
17604 
17605 	ASSERT(un != NULL);
17606 	ASSERT(mutex_owned(SD_MUTEX(un)));
17607 	ASSERT(bp != NULL);
17608 	ASSERT(xp != NULL);
17609 	ASSERT(pktp != NULL);
17610 	ASSERT(pktp != un->un_rqs_pktp);
17611 	ASSERT(bp   != un->un_rqs_bp);
17612 
17613 	/*
17614 	 * For auto-request sense, we get a scsi_arq_status back from
17615 	 * the HBA, with the sense data in the sts_sensedata member.
17616 	 * The pkt_scbp of the packet points to this scsi_arq_status.
17617 	 */
17618 	asp = (struct scsi_arq_status *)(pktp->pkt_scbp);
17619 
17620 	if (asp->sts_rqpkt_reason != CMD_CMPLT) {
17621 		/*
17622 		 * The auto REQUEST SENSE failed; see if we can re-try
17623 		 * the original command.
17624 		 */
17625 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17626 		    "auto request sense failed (reason=%s)\n",
17627 		    scsi_rname(asp->sts_rqpkt_reason));
17628 
17629 		sd_reset_target(un, pktp);
17630 
17631 		sd_retry_command(un, bp, SD_RETRIES_STANDARD,
17632 		    NULL, NULL, EIO, (clock_t)0, NULL);
17633 		return;
17634 	}
17635 
17636 	/* Save the relevant sense info into the xp for the original cmd. */
17637 	xp->xb_sense_status = *((uchar_t *)(&(asp->sts_rqpkt_status)));
17638 	xp->xb_sense_state  = asp->sts_rqpkt_state;
17639 	xp->xb_sense_resid  = asp->sts_rqpkt_resid;
17640 	if (xp->xb_sense_state & STATE_XARQ_DONE) {
17641 		actual_len = MAX_SENSE_LENGTH - xp->xb_sense_resid;
17642 		bcopy(&asp->sts_sensedata, xp->xb_sense_data,
17643 		    MAX_SENSE_LENGTH);
17644 	} else {
17645 		if (xp->xb_sense_resid > SENSE_LENGTH) {
17646 			actual_len = MAX_SENSE_LENGTH - xp->xb_sense_resid;
17647 		} else {
17648 			actual_len = SENSE_LENGTH - xp->xb_sense_resid;
17649 		}
17650 		if (xp->xb_pkt_flags & SD_XB_USCSICMD) {
17651 			if ((((struct uscsi_cmd *)
17652 			    (xp->xb_pktinfo))->uscsi_rqlen) > actual_len) {
17653 				xp->xb_sense_resid = (((struct uscsi_cmd *)
17654 				    (xp->xb_pktinfo))->uscsi_rqlen) -
17655 				    actual_len;
17656 			} else {
17657 				xp->xb_sense_resid = 0;
17658 			}
17659 		}
17660 		bcopy(&asp->sts_sensedata, xp->xb_sense_data, SENSE_LENGTH);
17661 	}
17662 
17663 	/*
17664 	 * See if we have valid sense data, if so then turn it over to
17665 	 * sd_decode_sense() to figure out the right course of action.
17666 	 */
17667 	if (sd_validate_sense_data(un, bp, xp, actual_len) ==
17668 	    SD_SENSE_DATA_IS_VALID) {
17669 		sd_decode_sense(un, bp, xp, pktp);
17670 	}
17671 }
17672 
17673 
17674 /*
17675  *    Function: sd_print_sense_failed_msg
17676  *
17677  * Description: Print log message when RQS has failed.
17678  *
17679  *   Arguments: un - ptr to associated softstate
17680  *		bp - ptr to buf(9S) for the command
17681  *		arg - generic message string ptr
17682  *		code - SD_IMMEDIATE_RETRY_ISSUED, SD_DELAYED_RETRY_ISSUED,
17683  *			or SD_NO_RETRY_ISSUED
17684  *
17685  *     Context: May be called from interrupt context
17686  */
17687 
17688 static void
17689 sd_print_sense_failed_msg(struct sd_lun *un, struct buf *bp, void *arg,
17690     int code)
17691 {
17692 	char	*msgp = arg;
17693 
17694 	ASSERT(un != NULL);
17695 	ASSERT(mutex_owned(SD_MUTEX(un)));
17696 	ASSERT(bp != NULL);
17697 
17698 	if ((code == SD_NO_RETRY_ISSUED) && (msgp != NULL)) {
17699 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN, msgp);
17700 	}
17701 }
17702 
17703 
17704 /*
17705  *    Function: sd_validate_sense_data
17706  *
17707  * Description: Check the given sense data for validity.
17708  *		If the sense data is not valid, the command will
17709  *		be either failed or retried!
17710  *
17711  * Return Code: SD_SENSE_DATA_IS_INVALID
17712  *		SD_SENSE_DATA_IS_VALID
17713  *
17714  *     Context: May be called from interrupt context
17715  */
17716 
17717 static int
17718 sd_validate_sense_data(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
17719     size_t actual_len)
17720 {
17721 	struct scsi_extended_sense *esp;
17722 	struct	scsi_pkt *pktp;
17723 	char	*msgp = NULL;
17724 	sd_ssc_t *sscp;
17725 
17726 	ASSERT(un != NULL);
17727 	ASSERT(mutex_owned(SD_MUTEX(un)));
17728 	ASSERT(bp != NULL);
17729 	ASSERT(bp != un->un_rqs_bp);
17730 	ASSERT(xp != NULL);
17731 	ASSERT(un->un_fm_private != NULL);
17732 
17733 	pktp = SD_GET_PKTP(bp);
17734 	ASSERT(pktp != NULL);
17735 
17736 	sscp = &((struct sd_fm_internal *)(un->un_fm_private))->fm_ssc;
17737 	ASSERT(sscp != NULL);
17738 
17739 	/*
17740 	 * Check the status of the RQS command (auto or manual).
17741 	 */
17742 	switch (xp->xb_sense_status & STATUS_MASK) {
17743 	case STATUS_GOOD:
17744 		break;
17745 
17746 	case STATUS_RESERVATION_CONFLICT:
17747 		sd_pkt_status_reservation_conflict(un, bp, xp, pktp);
17748 		return (SD_SENSE_DATA_IS_INVALID);
17749 
17750 	case STATUS_BUSY:
17751 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17752 		    "Busy Status on REQUEST SENSE\n");
17753 		sd_retry_command(un, bp, SD_RETRIES_BUSY, NULL,
17754 		    NULL, EIO, un->un_busy_timeout / 500, kstat_waitq_enter);
17755 		return (SD_SENSE_DATA_IS_INVALID);
17756 
17757 	case STATUS_QFULL:
17758 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17759 		    "QFULL Status on REQUEST SENSE\n");
17760 		sd_retry_command(un, bp, SD_RETRIES_STANDARD, NULL,
17761 		    NULL, EIO, un->un_busy_timeout / 500, kstat_waitq_enter);
17762 		return (SD_SENSE_DATA_IS_INVALID);
17763 
17764 	case STATUS_CHECK:
17765 	case STATUS_TERMINATED:
17766 		msgp = "Check Condition on REQUEST SENSE\n";
17767 		goto sense_failed;
17768 
17769 	default:
17770 		msgp = "Not STATUS_GOOD on REQUEST_SENSE\n";
17771 		goto sense_failed;
17772 	}
17773 
17774 	/*
17775 	 * See if we got the minimum required amount of sense data.
17776 	 * Note: We are assuming the returned sense data is SENSE_LENGTH bytes
17777 	 * or less.
17778 	 */
17779 	if (((xp->xb_sense_state & STATE_XFERRED_DATA) == 0) ||
17780 	    (actual_len == 0)) {
17781 		msgp = "Request Sense couldn't get sense data\n";
17782 		goto sense_failed;
17783 	}
17784 
17785 	if (actual_len < SUN_MIN_SENSE_LENGTH) {
17786 		msgp = "Not enough sense information\n";
17787 		/* Mark the ssc_flags for detecting invalid sense data */
17788 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17789 			sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_SENSE, 0,
17790 			    "sense-data");
17791 		}
17792 		goto sense_failed;
17793 	}
17794 
17795 	/*
17796 	 * We require the extended sense data
17797 	 */
17798 	esp = (struct scsi_extended_sense *)xp->xb_sense_data;
17799 	if (esp->es_class != CLASS_EXTENDED_SENSE) {
17800 		if ((pktp->pkt_flags & FLAG_SILENT) == 0) {
17801 			static char tmp[8];
17802 			static char buf[148];
17803 			char *p = (char *)(xp->xb_sense_data);
17804 			int i;
17805 
17806 			mutex_enter(&sd_sense_mutex);
17807 			(void) strcpy(buf, "undecodable sense information:");
17808 			for (i = 0; i < actual_len; i++) {
17809 				(void) sprintf(tmp, " 0x%x", *(p++)&0xff);
17810 				(void) strcpy(&buf[strlen(buf)], tmp);
17811 			}
17812 			i = strlen(buf);
17813 			(void) strcpy(&buf[i], "-(assumed fatal)\n");
17814 
17815 			if (SD_FM_LOG(un) == SD_FM_LOG_NSUP) {
17816 				scsi_log(SD_DEVINFO(un), sd_label,
17817 				    CE_WARN, buf);
17818 			}
17819 			mutex_exit(&sd_sense_mutex);
17820 		}
17821 
17822 		/* Mark the ssc_flags for detecting invalid sense data */
17823 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17824 			sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_SENSE, 0,
17825 			    "sense-data");
17826 		}
17827 
17828 		/* Note: Legacy behavior, fail the command with no retry */
17829 		sd_return_failed_command(un, bp, EIO);
17830 		return (SD_SENSE_DATA_IS_INVALID);
17831 	}
17832 
17833 	/*
17834 	 * Check that es_code is valid (es_class concatenated with es_code
17835 	 * make up the "response code" field.  es_class will always be 7, so
17836 	 * make sure es_code is 0, 1, 2, 3 or 0xf.  es_code will indicate the
17837 	 * format.
17838 	 */
17839 	if ((esp->es_code != CODE_FMT_FIXED_CURRENT) &&
17840 	    (esp->es_code != CODE_FMT_FIXED_DEFERRED) &&
17841 	    (esp->es_code != CODE_FMT_DESCR_CURRENT) &&
17842 	    (esp->es_code != CODE_FMT_DESCR_DEFERRED) &&
17843 	    (esp->es_code != CODE_FMT_VENDOR_SPECIFIC)) {
17844 		/* Mark the ssc_flags for detecting invalid sense data */
17845 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17846 			sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_SENSE, 0,
17847 			    "sense-data");
17848 		}
17849 		goto sense_failed;
17850 	}
17851 
17852 	return (SD_SENSE_DATA_IS_VALID);
17853 
17854 sense_failed:
17855 	/*
17856 	 * If the request sense failed (for whatever reason), attempt
17857 	 * to retry the original command.
17858 	 */
17859 #if defined(__i386) || defined(__amd64)
17860 	/*
17861 	 * SD_RETRY_DELAY is conditionally compile (#if fibre) in
17862 	 * sddef.h for Sparc platform, and x86 uses 1 binary
17863 	 * for both SCSI/FC.
17864 	 * The SD_RETRY_DELAY value need to be adjusted here
17865 	 * when SD_RETRY_DELAY change in sddef.h
17866 	 */
17867 	sd_retry_command(un, bp, SD_RETRIES_STANDARD,
17868 	    sd_print_sense_failed_msg, msgp, EIO,
17869 	    un->un_f_is_fibre?drv_usectohz(100000):(clock_t)0, NULL);
17870 #else
17871 	sd_retry_command(un, bp, SD_RETRIES_STANDARD,
17872 	    sd_print_sense_failed_msg, msgp, EIO, SD_RETRY_DELAY, NULL);
17873 #endif
17874 
17875 	return (SD_SENSE_DATA_IS_INVALID);
17876 }
17877 
17878 /*
17879  *    Function: sd_decode_sense
17880  *
17881  * Description: Take recovery action(s) when SCSI Sense Data is received.
17882  *
17883  *     Context: Interrupt context.
17884  */
17885 
17886 static void
17887 sd_decode_sense(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
17888     struct scsi_pkt *pktp)
17889 {
17890 	uint8_t sense_key;
17891 
17892 	ASSERT(un != NULL);
17893 	ASSERT(mutex_owned(SD_MUTEX(un)));
17894 	ASSERT(bp != NULL);
17895 	ASSERT(bp != un->un_rqs_bp);
17896 	ASSERT(xp != NULL);
17897 	ASSERT(pktp != NULL);
17898 
17899 	sense_key = scsi_sense_key(xp->xb_sense_data);
17900 
17901 	switch (sense_key) {
17902 	case KEY_NO_SENSE:
17903 		sd_sense_key_no_sense(un, bp, xp, pktp);
17904 		break;
17905 	case KEY_RECOVERABLE_ERROR:
17906 		sd_sense_key_recoverable_error(un, xp->xb_sense_data,
17907 		    bp, xp, pktp);
17908 		break;
17909 	case KEY_NOT_READY:
17910 		sd_sense_key_not_ready(un, xp->xb_sense_data,
17911 		    bp, xp, pktp);
17912 		break;
17913 	case KEY_MEDIUM_ERROR:
17914 	case KEY_HARDWARE_ERROR:
17915 		sd_sense_key_medium_or_hardware_error(un,
17916 		    xp->xb_sense_data, bp, xp, pktp);
17917 		break;
17918 	case KEY_ILLEGAL_REQUEST:
17919 		sd_sense_key_illegal_request(un, bp, xp, pktp);
17920 		break;
17921 	case KEY_UNIT_ATTENTION:
17922 		sd_sense_key_unit_attention(un, xp->xb_sense_data,
17923 		    bp, xp, pktp);
17924 		break;
17925 	case KEY_WRITE_PROTECT:
17926 	case KEY_VOLUME_OVERFLOW:
17927 	case KEY_MISCOMPARE:
17928 		sd_sense_key_fail_command(un, bp, xp, pktp);
17929 		break;
17930 	case KEY_BLANK_CHECK:
17931 		sd_sense_key_blank_check(un, bp, xp, pktp);
17932 		break;
17933 	case KEY_ABORTED_COMMAND:
17934 		sd_sense_key_aborted_command(un, bp, xp, pktp);
17935 		break;
17936 	case KEY_VENDOR_UNIQUE:
17937 	case KEY_COPY_ABORTED:
17938 	case KEY_EQUAL:
17939 	case KEY_RESERVED:
17940 	default:
17941 		sd_sense_key_default(un, xp->xb_sense_data,
17942 		    bp, xp, pktp);
17943 		break;
17944 	}
17945 }
17946 
17947 
17948 /*
17949  *    Function: sd_dump_memory
17950  *
17951  * Description: Debug logging routine to print the contents of a user provided
17952  *		buffer. The output of the buffer is broken up into 256 byte
17953  *		segments due to a size constraint of the scsi_log.
17954  *		implementation.
17955  *
17956  *   Arguments: un - ptr to softstate
17957  *		comp - component mask
17958  *		title - "title" string to preceed data when printed
17959  *		data - ptr to data block to be printed
17960  *		len - size of data block to be printed
17961  *		fmt - SD_LOG_HEX (use 0x%02x format) or SD_LOG_CHAR (use %c)
17962  *
17963  *     Context: May be called from interrupt context
17964  */
17965 
17966 #define	SD_DUMP_MEMORY_BUF_SIZE	256
17967 
17968 static char *sd_dump_format_string[] = {
17969 		" 0x%02x",
17970 		" %c"
17971 };
17972 
17973 static void
17974 sd_dump_memory(struct sd_lun *un, uint_t comp, char *title, uchar_t *data,
17975     int len, int fmt)
17976 {
17977 	int	i, j;
17978 	int	avail_count;
17979 	int	start_offset;
17980 	int	end_offset;
17981 	size_t	entry_len;
17982 	char	*bufp;
17983 	char	*local_buf;
17984 	char	*format_string;
17985 
17986 	ASSERT((fmt == SD_LOG_HEX) || (fmt == SD_LOG_CHAR));
17987 
17988 	/*
17989 	 * In the debug version of the driver, this function is called from a
17990 	 * number of places which are NOPs in the release driver.
17991 	 * The debug driver therefore has additional methods of filtering
17992 	 * debug output.
17993 	 */
17994 #ifdef SDDEBUG
17995 	/*
17996 	 * In the debug version of the driver we can reduce the amount of debug
17997 	 * messages by setting sd_error_level to something other than
17998 	 * SCSI_ERR_ALL and clearing bits in sd_level_mask and
17999 	 * sd_component_mask.
18000 	 */
18001 	if (((sd_level_mask & (SD_LOGMASK_DUMP_MEM | SD_LOGMASK_DIAG)) == 0) ||
18002 	    (sd_error_level != SCSI_ERR_ALL)) {
18003 		return;
18004 	}
18005 	if (((sd_component_mask & comp) == 0) ||
18006 	    (sd_error_level != SCSI_ERR_ALL)) {
18007 		return;
18008 	}
18009 #else
18010 	if (sd_error_level != SCSI_ERR_ALL) {
18011 		return;
18012 	}
18013 #endif
18014 
18015 	local_buf = kmem_zalloc(SD_DUMP_MEMORY_BUF_SIZE, KM_SLEEP);
18016 	bufp = local_buf;
18017 	/*
18018 	 * Available length is the length of local_buf[], minus the
18019 	 * length of the title string, minus one for the ":", minus
18020 	 * one for the newline, minus one for the NULL terminator.
18021 	 * This gives the #bytes available for holding the printed
18022 	 * values from the given data buffer.
18023 	 */
18024 	if (fmt == SD_LOG_HEX) {
18025 		format_string = sd_dump_format_string[0];
18026 	} else /* SD_LOG_CHAR */ {
18027 		format_string = sd_dump_format_string[1];
18028 	}
18029 	/*
18030 	 * Available count is the number of elements from the given
18031 	 * data buffer that we can fit into the available length.
18032 	 * This is based upon the size of the format string used.
18033 	 * Make one entry and find it's size.
18034 	 */
18035 	(void) sprintf(bufp, format_string, data[0]);
18036 	entry_len = strlen(bufp);
18037 	avail_count = (SD_DUMP_MEMORY_BUF_SIZE - strlen(title) - 3) / entry_len;
18038 
18039 	j = 0;
18040 	while (j < len) {
18041 		bufp = local_buf;
18042 		bzero(bufp, SD_DUMP_MEMORY_BUF_SIZE);
18043 		start_offset = j;
18044 
18045 		end_offset = start_offset + avail_count;
18046 
18047 		(void) sprintf(bufp, "%s:", title);
18048 		bufp += strlen(bufp);
18049 		for (i = start_offset; ((i < end_offset) && (j < len));
18050 		    i++, j++) {
18051 			(void) sprintf(bufp, format_string, data[i]);
18052 			bufp += entry_len;
18053 		}
18054 		(void) sprintf(bufp, "\n");
18055 
18056 		scsi_log(SD_DEVINFO(un), sd_label, CE_NOTE, "%s", local_buf);
18057 	}
18058 	kmem_free(local_buf, SD_DUMP_MEMORY_BUF_SIZE);
18059 }
18060 
18061 /*
18062  *    Function: sd_print_sense_msg
18063  *
18064  * Description: Log a message based upon the given sense data.
18065  *
18066  *   Arguments: un - ptr to associated softstate
18067  *		bp - ptr to buf(9S) for the command
18068  *		arg - ptr to associate sd_sense_info struct
18069  *		code - SD_IMMEDIATE_RETRY_ISSUED, SD_DELAYED_RETRY_ISSUED,
18070  *			or SD_NO_RETRY_ISSUED
18071  *
18072  *     Context: May be called from interrupt context
18073  */
18074 
18075 static void
18076 sd_print_sense_msg(struct sd_lun *un, struct buf *bp, void *arg, int code)
18077 {
18078 	struct sd_xbuf	*xp;
18079 	struct scsi_pkt	*pktp;
18080 	uint8_t *sensep;
18081 	daddr_t request_blkno;
18082 	diskaddr_t err_blkno;
18083 	int severity;
18084 	int pfa_flag;
18085 	extern struct scsi_key_strings scsi_cmds[];
18086 
18087 	ASSERT(un != NULL);
18088 	ASSERT(mutex_owned(SD_MUTEX(un)));
18089 	ASSERT(bp != NULL);
18090 	xp = SD_GET_XBUF(bp);
18091 	ASSERT(xp != NULL);
18092 	pktp = SD_GET_PKTP(bp);
18093 	ASSERT(pktp != NULL);
18094 	ASSERT(arg != NULL);
18095 
18096 	severity = ((struct sd_sense_info *)(arg))->ssi_severity;
18097 	pfa_flag = ((struct sd_sense_info *)(arg))->ssi_pfa_flag;
18098 
18099 	if ((code == SD_DELAYED_RETRY_ISSUED) ||
18100 	    (code == SD_IMMEDIATE_RETRY_ISSUED)) {
18101 		severity = SCSI_ERR_RETRYABLE;
18102 	}
18103 
18104 	/* Use absolute block number for the request block number */
18105 	request_blkno = xp->xb_blkno;
18106 
18107 	/*
18108 	 * Now try to get the error block number from the sense data
18109 	 */
18110 	sensep = xp->xb_sense_data;
18111 
18112 	if (scsi_sense_info_uint64(sensep, SENSE_LENGTH,
18113 	    (uint64_t *)&err_blkno)) {
18114 		/*
18115 		 * We retrieved the error block number from the information
18116 		 * portion of the sense data.
18117 		 *
18118 		 * For USCSI commands we are better off using the error
18119 		 * block no. as the requested block no. (This is the best
18120 		 * we can estimate.)
18121 		 */
18122 		if ((SD_IS_BUFIO(xp) == FALSE) &&
18123 		    ((pktp->pkt_flags & FLAG_SILENT) == 0)) {
18124 			request_blkno = err_blkno;
18125 		}
18126 	} else {
18127 		/*
18128 		 * Without the es_valid bit set (for fixed format) or an
18129 		 * information descriptor (for descriptor format) we cannot
18130 		 * be certain of the error blkno, so just use the
18131 		 * request_blkno.
18132 		 */
18133 		err_blkno = (diskaddr_t)request_blkno;
18134 	}
18135 
18136 	/*
18137 	 * The following will log the buffer contents for the release driver
18138 	 * if the SD_LOGMASK_DIAG bit of sd_level_mask is set, or the error
18139 	 * level is set to verbose.
18140 	 */
18141 	sd_dump_memory(un, SD_LOG_IO, "Failed CDB",
18142 	    (uchar_t *)pktp->pkt_cdbp, CDB_SIZE, SD_LOG_HEX);
18143 	sd_dump_memory(un, SD_LOG_IO, "Sense Data",
18144 	    (uchar_t *)sensep, SENSE_LENGTH, SD_LOG_HEX);
18145 
18146 	if (pfa_flag == FALSE) {
18147 		/* This is normally only set for USCSI */
18148 		if ((pktp->pkt_flags & FLAG_SILENT) != 0) {
18149 			return;
18150 		}
18151 
18152 		if ((SD_IS_BUFIO(xp) == TRUE) &&
18153 		    (((sd_level_mask & SD_LOGMASK_DIAG) == 0) &&
18154 		    (severity < sd_error_level))) {
18155 			return;
18156 		}
18157 	}
18158 	/*
18159 	 * Check for Sonoma Failover and keep a count of how many failed I/O's
18160 	 */
18161 	if ((SD_IS_LSI(un)) &&
18162 	    (scsi_sense_key(sensep) == KEY_ILLEGAL_REQUEST) &&
18163 	    (scsi_sense_asc(sensep) == 0x94) &&
18164 	    (scsi_sense_ascq(sensep) == 0x01)) {
18165 		un->un_sonoma_failure_count++;
18166 		if (un->un_sonoma_failure_count > 1) {
18167 			return;
18168 		}
18169 	}
18170 
18171 	if (SD_FM_LOG(un) == SD_FM_LOG_NSUP ||
18172 	    ((scsi_sense_key(sensep) == KEY_RECOVERABLE_ERROR) &&
18173 	    (pktp->pkt_resid == 0))) {
18174 		scsi_vu_errmsg(SD_SCSI_DEVP(un), pktp, sd_label, severity,
18175 		    request_blkno, err_blkno, scsi_cmds,
18176 		    (struct scsi_extended_sense *)sensep,
18177 		    un->un_additional_codes, NULL);
18178 	}
18179 }
18180 
18181 /*
18182  *    Function: sd_sense_key_no_sense
18183  *
18184  * Description: Recovery action when sense data was not received.
18185  *
18186  *     Context: May be called from interrupt context
18187  */
18188 
18189 static void
18190 sd_sense_key_no_sense(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
18191     struct scsi_pkt *pktp)
18192 {
18193 	struct sd_sense_info	si;
18194 
18195 	ASSERT(un != NULL);
18196 	ASSERT(mutex_owned(SD_MUTEX(un)));
18197 	ASSERT(bp != NULL);
18198 	ASSERT(xp != NULL);
18199 	ASSERT(pktp != NULL);
18200 
18201 	si.ssi_severity = SCSI_ERR_FATAL;
18202 	si.ssi_pfa_flag = FALSE;
18203 
18204 	SD_UPDATE_ERRSTATS(un, sd_softerrs);
18205 
18206 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18207 	    &si, EIO, (clock_t)0, NULL);
18208 }
18209 
18210 
18211 /*
18212  *    Function: sd_sense_key_recoverable_error
18213  *
18214  * Description: Recovery actions for a SCSI "Recovered Error" sense key.
18215  *
18216  *     Context: May be called from interrupt context
18217  */
18218 
18219 static void
18220 sd_sense_key_recoverable_error(struct sd_lun *un, uint8_t *sense_datap,
18221     struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp)
18222 {
18223 	struct sd_sense_info	si;
18224 	uint8_t asc = scsi_sense_asc(sense_datap);
18225 	uint8_t ascq = scsi_sense_ascq(sense_datap);
18226 
18227 	ASSERT(un != NULL);
18228 	ASSERT(mutex_owned(SD_MUTEX(un)));
18229 	ASSERT(bp != NULL);
18230 	ASSERT(xp != NULL);
18231 	ASSERT(pktp != NULL);
18232 
18233 	/*
18234 	 * 0x00, 0x1D: ATA PASSTHROUGH INFORMATION AVAILABLE
18235 	 */
18236 	if (asc == 0x00 && ascq == 0x1D) {
18237 		sd_return_command(un, bp);
18238 		return;
18239 	}
18240 
18241 	/*
18242 	 * 0x5D: FAILURE PREDICTION THRESHOLD EXCEEDED
18243 	 */
18244 	if ((asc == 0x5D) && (sd_report_pfa != 0)) {
18245 		SD_UPDATE_ERRSTATS(un, sd_rq_pfa_err);
18246 		si.ssi_severity = SCSI_ERR_INFO;
18247 		si.ssi_pfa_flag = TRUE;
18248 	} else {
18249 		SD_UPDATE_ERRSTATS(un, sd_softerrs);
18250 		SD_UPDATE_ERRSTATS(un, sd_rq_recov_err);
18251 		si.ssi_severity = SCSI_ERR_RECOVERED;
18252 		si.ssi_pfa_flag = FALSE;
18253 	}
18254 
18255 	if (pktp->pkt_resid == 0) {
18256 		sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18257 		sd_return_command(un, bp);
18258 		return;
18259 	}
18260 
18261 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18262 	    &si, EIO, (clock_t)0, NULL);
18263 }
18264 
18265 
18266 
18267 
18268 /*
18269  *    Function: sd_sense_key_not_ready
18270  *
18271  * Description: Recovery actions for a SCSI "Not Ready" sense key.
18272  *
18273  *     Context: May be called from interrupt context
18274  */
18275 
18276 static void
18277 sd_sense_key_not_ready(struct sd_lun *un, uint8_t *sense_datap, struct buf *bp,
18278     struct sd_xbuf *xp, struct scsi_pkt *pktp)
18279 {
18280 	struct sd_sense_info	si;
18281 	uint8_t asc = scsi_sense_asc(sense_datap);
18282 	uint8_t ascq = scsi_sense_ascq(sense_datap);
18283 
18284 	ASSERT(un != NULL);
18285 	ASSERT(mutex_owned(SD_MUTEX(un)));
18286 	ASSERT(bp != NULL);
18287 	ASSERT(xp != NULL);
18288 	ASSERT(pktp != NULL);
18289 
18290 	si.ssi_severity = SCSI_ERR_FATAL;
18291 	si.ssi_pfa_flag = FALSE;
18292 
18293 	/*
18294 	 * Update error stats after first NOT READY error. Disks may have
18295 	 * been powered down and may need to be restarted.  For CDROMs,
18296 	 * report NOT READY errors only if media is present.
18297 	 */
18298 	if ((ISCD(un) && (asc == 0x3A)) ||
18299 	    (xp->xb_nr_retry_count > 0)) {
18300 		SD_UPDATE_ERRSTATS(un, sd_harderrs);
18301 		SD_UPDATE_ERRSTATS(un, sd_rq_ntrdy_err);
18302 	}
18303 
18304 	/*
18305 	 * Just fail if the "not ready" retry limit has been reached.
18306 	 */
18307 	if (xp->xb_nr_retry_count >= un->un_notready_retry_count) {
18308 		/* Special check for error message printing for removables. */
18309 		if (un->un_f_has_removable_media && (asc == 0x04) &&
18310 		    (ascq >= 0x04)) {
18311 			si.ssi_severity = SCSI_ERR_ALL;
18312 		}
18313 		goto fail_command;
18314 	}
18315 
18316 	/*
18317 	 * Check the ASC and ASCQ in the sense data as needed, to determine
18318 	 * what to do.
18319 	 */
18320 	switch (asc) {
18321 	case 0x04:	/* LOGICAL UNIT NOT READY */
18322 		/*
18323 		 * disk drives that don't spin up result in a very long delay
18324 		 * in format without warning messages. We will log a message
18325 		 * if the error level is set to verbose.
18326 		 */
18327 		if (sd_error_level < SCSI_ERR_RETRYABLE) {
18328 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18329 			    "logical unit not ready, resetting disk\n");
18330 		}
18331 
18332 		/*
18333 		 * There are different requirements for CDROMs and disks for
18334 		 * the number of retries.  If a CD-ROM is giving this, it is
18335 		 * probably reading TOC and is in the process of getting
18336 		 * ready, so we should keep on trying for a long time to make
18337 		 * sure that all types of media are taken in account (for
18338 		 * some media the drive takes a long time to read TOC).  For
18339 		 * disks we do not want to retry this too many times as this
18340 		 * can cause a long hang in format when the drive refuses to
18341 		 * spin up (a very common failure).
18342 		 */
18343 		switch (ascq) {
18344 		case 0x00:  /* LUN NOT READY, CAUSE NOT REPORTABLE */
18345 			/*
18346 			 * Disk drives frequently refuse to spin up which
18347 			 * results in a very long hang in format without
18348 			 * warning messages.
18349 			 *
18350 			 * Note: This code preserves the legacy behavior of
18351 			 * comparing xb_nr_retry_count against zero for fibre
18352 			 * channel targets instead of comparing against the
18353 			 * un_reset_retry_count value.  The reason for this
18354 			 * discrepancy has been so utterly lost beneath the
18355 			 * Sands of Time that even Indiana Jones could not
18356 			 * find it.
18357 			 */
18358 			if (un->un_f_is_fibre == TRUE) {
18359 				if (((sd_level_mask & SD_LOGMASK_DIAG) ||
18360 				    (xp->xb_nr_retry_count > 0)) &&
18361 				    (un->un_startstop_timeid == NULL)) {
18362 					scsi_log(SD_DEVINFO(un), sd_label,
18363 					    CE_WARN, "logical unit not ready, "
18364 					    "resetting disk\n");
18365 					sd_reset_target(un, pktp);
18366 				}
18367 			} else {
18368 				if (((sd_level_mask & SD_LOGMASK_DIAG) ||
18369 				    (xp->xb_nr_retry_count >
18370 				    un->un_reset_retry_count)) &&
18371 				    (un->un_startstop_timeid == NULL)) {
18372 					scsi_log(SD_DEVINFO(un), sd_label,
18373 					    CE_WARN, "logical unit not ready, "
18374 					    "resetting disk\n");
18375 					sd_reset_target(un, pktp);
18376 				}
18377 			}
18378 			break;
18379 
18380 		case 0x01:  /* LUN IS IN PROCESS OF BECOMING READY */
18381 			/*
18382 			 * If the target is in the process of becoming
18383 			 * ready, just proceed with the retry. This can
18384 			 * happen with CD-ROMs that take a long time to
18385 			 * read TOC after a power cycle or reset.
18386 			 */
18387 			goto do_retry;
18388 
18389 		case 0x02:  /* LUN NOT READY, INITITIALIZING CMD REQUIRED */
18390 			break;
18391 
18392 		case 0x03:  /* LUN NOT READY, MANUAL INTERVENTION REQUIRED */
18393 			/*
18394 			 * Retries cannot help here so just fail right away.
18395 			 */
18396 			goto fail_command;
18397 
18398 		case 0x88:
18399 			/*
18400 			 * Vendor-unique code for T3/T4: it indicates a
18401 			 * path problem in a mutipathed config, but as far as
18402 			 * the target driver is concerned it equates to a fatal
18403 			 * error, so we should just fail the command right away
18404 			 * (without printing anything to the console). If this
18405 			 * is not a T3/T4, fall thru to the default recovery
18406 			 * action.
18407 			 * T3/T4 is FC only, don't need to check is_fibre
18408 			 */
18409 			if (SD_IS_T3(un) || SD_IS_T4(un)) {
18410 				sd_return_failed_command(un, bp, EIO);
18411 				return;
18412 			}
18413 			/* FALLTHRU */
18414 
18415 		case 0x04:  /* LUN NOT READY, FORMAT IN PROGRESS */
18416 		case 0x05:  /* LUN NOT READY, REBUILD IN PROGRESS */
18417 		case 0x06:  /* LUN NOT READY, RECALCULATION IN PROGRESS */
18418 		case 0x07:  /* LUN NOT READY, OPERATION IN PROGRESS */
18419 		case 0x08:  /* LUN NOT READY, LONG WRITE IN PROGRESS */
18420 		default:    /* Possible future codes in SCSI spec? */
18421 			/*
18422 			 * For removable-media devices, do not retry if
18423 			 * ASCQ > 2 as these result mostly from USCSI commands
18424 			 * on MMC devices issued to check status of an
18425 			 * operation initiated in immediate mode.  Also for
18426 			 * ASCQ >= 4 do not print console messages as these
18427 			 * mainly represent a user-initiated operation
18428 			 * instead of a system failure.
18429 			 */
18430 			if (un->un_f_has_removable_media) {
18431 				si.ssi_severity = SCSI_ERR_ALL;
18432 				goto fail_command;
18433 			}
18434 			break;
18435 		}
18436 
18437 		/*
18438 		 * As part of our recovery attempt for the NOT READY
18439 		 * condition, we issue a START STOP UNIT command. However
18440 		 * we want to wait for a short delay before attempting this
18441 		 * as there may still be more commands coming back from the
18442 		 * target with the check condition. To do this we use
18443 		 * timeout(9F) to call sd_start_stop_unit_callback() after
18444 		 * the delay interval expires. (sd_start_stop_unit_callback()
18445 		 * dispatches sd_start_stop_unit_task(), which will issue
18446 		 * the actual START STOP UNIT command. The delay interval
18447 		 * is one-half of the delay that we will use to retry the
18448 		 * command that generated the NOT READY condition.
18449 		 *
18450 		 * Note that we could just dispatch sd_start_stop_unit_task()
18451 		 * from here and allow it to sleep for the delay interval,
18452 		 * but then we would be tying up the taskq thread
18453 		 * uncesessarily for the duration of the delay.
18454 		 *
18455 		 * Do not issue the START STOP UNIT if the current command
18456 		 * is already a START STOP UNIT.
18457 		 */
18458 		if (pktp->pkt_cdbp[0] == SCMD_START_STOP) {
18459 			break;
18460 		}
18461 
18462 		/*
18463 		 * Do not schedule the timeout if one is already pending.
18464 		 */
18465 		if (un->un_startstop_timeid != NULL) {
18466 			SD_INFO(SD_LOG_ERROR, un,
18467 			    "sd_sense_key_not_ready: restart already issued to"
18468 			    " %s%d\n", ddi_driver_name(SD_DEVINFO(un)),
18469 			    ddi_get_instance(SD_DEVINFO(un)));
18470 			break;
18471 		}
18472 
18473 		/*
18474 		 * Schedule the START STOP UNIT command, then queue the command
18475 		 * for a retry.
18476 		 *
18477 		 * Note: A timeout is not scheduled for this retry because we
18478 		 * want the retry to be serial with the START_STOP_UNIT. The
18479 		 * retry will be started when the START_STOP_UNIT is completed
18480 		 * in sd_start_stop_unit_task.
18481 		 */
18482 		un->un_startstop_timeid = timeout(sd_start_stop_unit_callback,
18483 		    un, un->un_busy_timeout / 2);
18484 		xp->xb_nr_retry_count++;
18485 		sd_set_retry_bp(un, bp, 0, kstat_waitq_enter);
18486 		return;
18487 
18488 	case 0x05:	/* LOGICAL UNIT DOES NOT RESPOND TO SELECTION */
18489 		if (sd_error_level < SCSI_ERR_RETRYABLE) {
18490 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18491 			    "unit does not respond to selection\n");
18492 		}
18493 		break;
18494 
18495 	case 0x3A:	/* MEDIUM NOT PRESENT */
18496 		if (sd_error_level >= SCSI_ERR_FATAL) {
18497 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18498 			    "Caddy not inserted in drive\n");
18499 		}
18500 
18501 		sr_ejected(un);
18502 		un->un_mediastate = DKIO_EJECTED;
18503 		/* The state has changed, inform the media watch routines */
18504 		cv_broadcast(&un->un_state_cv);
18505 		/* Just fail if no media is present in the drive. */
18506 		goto fail_command;
18507 
18508 	default:
18509 		if (sd_error_level < SCSI_ERR_RETRYABLE) {
18510 			scsi_log(SD_DEVINFO(un), sd_label, CE_NOTE,
18511 			    "Unit not Ready. Additional sense code 0x%x\n",
18512 			    asc);
18513 		}
18514 		break;
18515 	}
18516 
18517 do_retry:
18518 
18519 	/*
18520 	 * Retry the command, as some targets may report NOT READY for
18521 	 * several seconds after being reset.
18522 	 */
18523 	xp->xb_nr_retry_count++;
18524 	si.ssi_severity = SCSI_ERR_RETRYABLE;
18525 	sd_retry_command(un, bp, SD_RETRIES_NOCHECK, sd_print_sense_msg,
18526 	    &si, EIO, un->un_busy_timeout, NULL);
18527 
18528 	return;
18529 
18530 fail_command:
18531 	sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18532 	sd_return_failed_command(un, bp, EIO);
18533 }
18534 
18535 
18536 
18537 /*
18538  *    Function: sd_sense_key_medium_or_hardware_error
18539  *
18540  * Description: Recovery actions for a SCSI "Medium Error" or "Hardware Error"
18541  *		sense key.
18542  *
18543  *     Context: May be called from interrupt context
18544  */
18545 
18546 static void
18547 sd_sense_key_medium_or_hardware_error(struct sd_lun *un, uint8_t *sense_datap,
18548     struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp)
18549 {
18550 	struct sd_sense_info	si;
18551 	uint8_t sense_key = scsi_sense_key(sense_datap);
18552 	uint8_t asc = scsi_sense_asc(sense_datap);
18553 
18554 	ASSERT(un != NULL);
18555 	ASSERT(mutex_owned(SD_MUTEX(un)));
18556 	ASSERT(bp != NULL);
18557 	ASSERT(xp != NULL);
18558 	ASSERT(pktp != NULL);
18559 
18560 	si.ssi_severity = SCSI_ERR_FATAL;
18561 	si.ssi_pfa_flag = FALSE;
18562 
18563 	if (sense_key == KEY_MEDIUM_ERROR) {
18564 		SD_UPDATE_ERRSTATS(un, sd_rq_media_err);
18565 	}
18566 
18567 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
18568 
18569 	if ((un->un_reset_retry_count != 0) &&
18570 	    (xp->xb_retry_count == un->un_reset_retry_count)) {
18571 		mutex_exit(SD_MUTEX(un));
18572 		/* Do NOT do a RESET_ALL here: too intrusive. (4112858) */
18573 		if (un->un_f_allow_bus_device_reset == TRUE) {
18574 
18575 			boolean_t try_resetting_target = B_TRUE;
18576 
18577 			/*
18578 			 * We need to be able to handle specific ASC when we are
18579 			 * handling a KEY_HARDWARE_ERROR. In particular
18580 			 * taking the default action of resetting the target may
18581 			 * not be the appropriate way to attempt recovery.
18582 			 * Resetting a target because of a single LUN failure
18583 			 * victimizes all LUNs on that target.
18584 			 *
18585 			 * This is true for the LSI arrays, if an LSI
18586 			 * array controller returns an ASC of 0x84 (LUN Dead) we
18587 			 * should trust it.
18588 			 */
18589 
18590 			if (sense_key == KEY_HARDWARE_ERROR) {
18591 				switch (asc) {
18592 				case 0x84:
18593 					if (SD_IS_LSI(un)) {
18594 						try_resetting_target = B_FALSE;
18595 					}
18596 					break;
18597 				default:
18598 					break;
18599 				}
18600 			}
18601 
18602 			if (try_resetting_target == B_TRUE) {
18603 				int reset_retval = 0;
18604 				if (un->un_f_lun_reset_enabled == TRUE) {
18605 					SD_TRACE(SD_LOG_IO_CORE, un,
18606 					    "sd_sense_key_medium_or_hardware_"
18607 					    "error: issuing RESET_LUN\n");
18608 					reset_retval =
18609 					    scsi_reset(SD_ADDRESS(un),
18610 					    RESET_LUN);
18611 				}
18612 				if (reset_retval == 0) {
18613 					SD_TRACE(SD_LOG_IO_CORE, un,
18614 					    "sd_sense_key_medium_or_hardware_"
18615 					    "error: issuing RESET_TARGET\n");
18616 					(void) scsi_reset(SD_ADDRESS(un),
18617 					    RESET_TARGET);
18618 				}
18619 			}
18620 		}
18621 		mutex_enter(SD_MUTEX(un));
18622 	}
18623 
18624 	/*
18625 	 * This really ought to be a fatal error, but we will retry anyway
18626 	 * as some drives report this as a spurious error.
18627 	 */
18628 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18629 	    &si, EIO, (clock_t)0, NULL);
18630 }
18631 
18632 
18633 
18634 /*
18635  *    Function: sd_sense_key_illegal_request
18636  *
18637  * Description: Recovery actions for a SCSI "Illegal Request" sense key.
18638  *
18639  *     Context: May be called from interrupt context
18640  */
18641 
18642 static void
18643 sd_sense_key_illegal_request(struct sd_lun *un, struct buf *bp,
18644     struct sd_xbuf *xp, struct scsi_pkt *pktp)
18645 {
18646 	struct sd_sense_info	si;
18647 
18648 	ASSERT(un != NULL);
18649 	ASSERT(mutex_owned(SD_MUTEX(un)));
18650 	ASSERT(bp != NULL);
18651 	ASSERT(xp != NULL);
18652 	ASSERT(pktp != NULL);
18653 
18654 	SD_UPDATE_ERRSTATS(un, sd_rq_illrq_err);
18655 
18656 	si.ssi_severity = SCSI_ERR_INFO;
18657 	si.ssi_pfa_flag = FALSE;
18658 
18659 	/* Pointless to retry if the target thinks it's an illegal request */
18660 	sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18661 	sd_return_failed_command(un, bp, EIO);
18662 }
18663 
18664 
18665 
18666 
18667 /*
18668  *    Function: sd_sense_key_unit_attention
18669  *
18670  * Description: Recovery actions for a SCSI "Unit Attention" sense key.
18671  *
18672  *     Context: May be called from interrupt context
18673  */
18674 
18675 static void
18676 sd_sense_key_unit_attention(struct sd_lun *un, uint8_t *sense_datap,
18677     struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp)
18678 {
18679 	/*
18680 	 * For UNIT ATTENTION we allow retries for one minute. Devices
18681 	 * like Sonoma can return UNIT ATTENTION close to a minute
18682 	 * under certain conditions.
18683 	 */
18684 	int	retry_check_flag = SD_RETRIES_UA;
18685 	boolean_t	kstat_updated = B_FALSE;
18686 	struct	sd_sense_info		si;
18687 	uint8_t asc = scsi_sense_asc(sense_datap);
18688 	uint8_t	ascq = scsi_sense_ascq(sense_datap);
18689 
18690 	ASSERT(un != NULL);
18691 	ASSERT(mutex_owned(SD_MUTEX(un)));
18692 	ASSERT(bp != NULL);
18693 	ASSERT(xp != NULL);
18694 	ASSERT(pktp != NULL);
18695 
18696 	si.ssi_severity = SCSI_ERR_INFO;
18697 	si.ssi_pfa_flag = FALSE;
18698 
18699 
18700 	switch (asc) {
18701 	case 0x5D:  /* FAILURE PREDICTION THRESHOLD EXCEEDED */
18702 		if (sd_report_pfa != 0) {
18703 			SD_UPDATE_ERRSTATS(un, sd_rq_pfa_err);
18704 			si.ssi_pfa_flag = TRUE;
18705 			retry_check_flag = SD_RETRIES_STANDARD;
18706 			goto do_retry;
18707 		}
18708 
18709 		break;
18710 
18711 	case 0x29:  /* POWER ON, RESET, OR BUS DEVICE RESET OCCURRED */
18712 		if ((un->un_resvd_status & SD_RESERVE) == SD_RESERVE) {
18713 			un->un_resvd_status |=
18714 			    (SD_LOST_RESERVE | SD_WANT_RESERVE);
18715 		}
18716 #ifdef _LP64
18717 		if (un->un_blockcount + 1 > SD_GROUP1_MAX_ADDRESS) {
18718 			if (taskq_dispatch(sd_tq, sd_reenable_dsense_task,
18719 			    un, KM_NOSLEEP) == TASKQID_INVALID) {
18720 				/*
18721 				 * If we can't dispatch the task we'll just
18722 				 * live without descriptor sense.  We can
18723 				 * try again on the next "unit attention"
18724 				 */
18725 				SD_ERROR(SD_LOG_ERROR, un,
18726 				    "sd_sense_key_unit_attention: "
18727 				    "Could not dispatch "
18728 				    "sd_reenable_dsense_task\n");
18729 			}
18730 		}
18731 #endif /* _LP64 */
18732 		/* FALLTHRU */
18733 
18734 	case 0x28: /* NOT READY TO READY CHANGE, MEDIUM MAY HAVE CHANGED */
18735 		if (!un->un_f_has_removable_media) {
18736 			break;
18737 		}
18738 
18739 		/*
18740 		 * When we get a unit attention from a removable-media device,
18741 		 * it may be in a state that will take a long time to recover
18742 		 * (e.g., from a reset).  Since we are executing in interrupt
18743 		 * context here, we cannot wait around for the device to come
18744 		 * back. So hand this command off to sd_media_change_task()
18745 		 * for deferred processing under taskq thread context. (Note
18746 		 * that the command still may be failed if a problem is
18747 		 * encountered at a later time.)
18748 		 */
18749 		if (taskq_dispatch(sd_tq, sd_media_change_task, pktp,
18750 		    KM_NOSLEEP) == TASKQID_INVALID) {
18751 			/*
18752 			 * Cannot dispatch the request so fail the command.
18753 			 */
18754 			SD_UPDATE_ERRSTATS(un, sd_harderrs);
18755 			SD_UPDATE_ERRSTATS(un, sd_rq_nodev_err);
18756 			si.ssi_severity = SCSI_ERR_FATAL;
18757 			sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18758 			sd_return_failed_command(un, bp, EIO);
18759 		}
18760 
18761 		/*
18762 		 * If failed to dispatch sd_media_change_task(), we already
18763 		 * updated kstat. If succeed to dispatch sd_media_change_task(),
18764 		 * we should update kstat later if it encounters an error. So,
18765 		 * we update kstat_updated flag here.
18766 		 */
18767 		kstat_updated = B_TRUE;
18768 
18769 		/*
18770 		 * Either the command has been successfully dispatched to a
18771 		 * task Q for retrying, or the dispatch failed. In either case
18772 		 * do NOT retry again by calling sd_retry_command. This sets up
18773 		 * two retries of the same command and when one completes and
18774 		 * frees the resources the other will access freed memory,
18775 		 * a bad thing.
18776 		 */
18777 		return;
18778 
18779 	default:
18780 		break;
18781 	}
18782 
18783 	/*
18784 	 * ASC  ASCQ
18785 	 *  2A   09	Capacity data has changed
18786 	 *  2A   01	Mode parameters changed
18787 	 *  3F   0E	Reported luns data has changed
18788 	 * Arrays that support logical unit expansion should report
18789 	 * capacity changes(2Ah/09). Mode parameters changed and
18790 	 * reported luns data has changed are the approximation.
18791 	 */
18792 	if (((asc == 0x2a) && (ascq == 0x09)) ||
18793 	    ((asc == 0x2a) && (ascq == 0x01)) ||
18794 	    ((asc == 0x3f) && (ascq == 0x0e))) {
18795 		if (taskq_dispatch(sd_tq, sd_target_change_task, un,
18796 		    KM_NOSLEEP) == TASKQID_INVALID) {
18797 			SD_ERROR(SD_LOG_ERROR, un,
18798 			    "sd_sense_key_unit_attention: "
18799 			    "Could not dispatch sd_target_change_task\n");
18800 		}
18801 	}
18802 
18803 	/*
18804 	 * Update kstat if we haven't done that.
18805 	 */
18806 	if (!kstat_updated) {
18807 		SD_UPDATE_ERRSTATS(un, sd_harderrs);
18808 		SD_UPDATE_ERRSTATS(un, sd_rq_nodev_err);
18809 	}
18810 
18811 do_retry:
18812 	sd_retry_command(un, bp, retry_check_flag, sd_print_sense_msg, &si,
18813 	    EIO, SD_UA_RETRY_DELAY, NULL);
18814 }
18815 
18816 
18817 
18818 /*
18819  *    Function: sd_sense_key_fail_command
18820  *
18821  * Description: Use to fail a command when we don't like the sense key that
18822  *		was returned.
18823  *
18824  *     Context: May be called from interrupt context
18825  */
18826 
18827 static void
18828 sd_sense_key_fail_command(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
18829     struct scsi_pkt *pktp)
18830 {
18831 	struct sd_sense_info	si;
18832 
18833 	ASSERT(un != NULL);
18834 	ASSERT(mutex_owned(SD_MUTEX(un)));
18835 	ASSERT(bp != NULL);
18836 	ASSERT(xp != NULL);
18837 	ASSERT(pktp != NULL);
18838 
18839 	si.ssi_severity = SCSI_ERR_FATAL;
18840 	si.ssi_pfa_flag = FALSE;
18841 
18842 	sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18843 	sd_return_failed_command(un, bp, EIO);
18844 }
18845 
18846 
18847 
18848 /*
18849  *    Function: sd_sense_key_blank_check
18850  *
18851  * Description: Recovery actions for a SCSI "Blank Check" sense key.
18852  *		Has no monetary connotation.
18853  *
18854  *     Context: May be called from interrupt context
18855  */
18856 
18857 static void
18858 sd_sense_key_blank_check(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
18859     struct scsi_pkt *pktp)
18860 {
18861 	struct sd_sense_info	si;
18862 
18863 	ASSERT(un != NULL);
18864 	ASSERT(mutex_owned(SD_MUTEX(un)));
18865 	ASSERT(bp != NULL);
18866 	ASSERT(xp != NULL);
18867 	ASSERT(pktp != NULL);
18868 
18869 	/*
18870 	 * Blank check is not fatal for removable devices, therefore
18871 	 * it does not require a console message.
18872 	 */
18873 	si.ssi_severity = (un->un_f_has_removable_media) ? SCSI_ERR_ALL :
18874 	    SCSI_ERR_FATAL;
18875 	si.ssi_pfa_flag = FALSE;
18876 
18877 	sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18878 	sd_return_failed_command(un, bp, EIO);
18879 }
18880 
18881 
18882 
18883 
18884 /*
18885  *    Function: sd_sense_key_aborted_command
18886  *
18887  * Description: Recovery actions for a SCSI "Aborted Command" sense key.
18888  *
18889  *     Context: May be called from interrupt context
18890  */
18891 
18892 static void
18893 sd_sense_key_aborted_command(struct sd_lun *un, struct buf *bp,
18894     struct sd_xbuf *xp, struct scsi_pkt *pktp)
18895 {
18896 	struct sd_sense_info	si;
18897 
18898 	ASSERT(un != NULL);
18899 	ASSERT(mutex_owned(SD_MUTEX(un)));
18900 	ASSERT(bp != NULL);
18901 	ASSERT(xp != NULL);
18902 	ASSERT(pktp != NULL);
18903 
18904 	si.ssi_severity = SCSI_ERR_FATAL;
18905 	si.ssi_pfa_flag = FALSE;
18906 
18907 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
18908 
18909 	/*
18910 	 * This really ought to be a fatal error, but we will retry anyway
18911 	 * as some drives report this as a spurious error.
18912 	 */
18913 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18914 	    &si, EIO, drv_usectohz(100000), NULL);
18915 }
18916 
18917 
18918 
18919 /*
18920  *    Function: sd_sense_key_default
18921  *
18922  * Description: Default recovery action for several SCSI sense keys (basically
18923  *		attempts a retry).
18924  *
18925  *     Context: May be called from interrupt context
18926  */
18927 
18928 static void
18929 sd_sense_key_default(struct sd_lun *un, uint8_t *sense_datap, struct buf *bp,
18930     struct sd_xbuf *xp, struct scsi_pkt *pktp)
18931 {
18932 	struct sd_sense_info	si;
18933 	uint8_t sense_key = scsi_sense_key(sense_datap);
18934 
18935 	ASSERT(un != NULL);
18936 	ASSERT(mutex_owned(SD_MUTEX(un)));
18937 	ASSERT(bp != NULL);
18938 	ASSERT(xp != NULL);
18939 	ASSERT(pktp != NULL);
18940 
18941 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
18942 
18943 	/*
18944 	 * Undecoded sense key.	Attempt retries and hope that will fix
18945 	 * the problem.  Otherwise, we're dead.
18946 	 */
18947 	if ((pktp->pkt_flags & FLAG_SILENT) == 0) {
18948 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18949 		    "Unhandled Sense Key '%s'\n", sense_keys[sense_key]);
18950 	}
18951 
18952 	si.ssi_severity = SCSI_ERR_FATAL;
18953 	si.ssi_pfa_flag = FALSE;
18954 
18955 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18956 	    &si, EIO, (clock_t)0, NULL);
18957 }
18958 
18959 
18960 
18961 /*
18962  *    Function: sd_print_retry_msg
18963  *
18964  * Description: Print a message indicating the retry action being taken.
18965  *
18966  *   Arguments: un - ptr to associated softstate
18967  *		bp - ptr to buf(9S) for the command
18968  *		arg - not used.
18969  *		flag - SD_IMMEDIATE_RETRY_ISSUED, SD_DELAYED_RETRY_ISSUED,
18970  *			or SD_NO_RETRY_ISSUED
18971  *
18972  *     Context: May be called from interrupt context
18973  */
18974 /* ARGSUSED */
18975 static void
18976 sd_print_retry_msg(struct sd_lun *un, struct buf *bp, void *arg, int flag)
18977 {
18978 	struct sd_xbuf	*xp;
18979 	struct scsi_pkt *pktp;
18980 	char *reasonp;
18981 	char *msgp;
18982 
18983 	ASSERT(un != NULL);
18984 	ASSERT(mutex_owned(SD_MUTEX(un)));
18985 	ASSERT(bp != NULL);
18986 	pktp = SD_GET_PKTP(bp);
18987 	ASSERT(pktp != NULL);
18988 	xp = SD_GET_XBUF(bp);
18989 	ASSERT(xp != NULL);
18990 
18991 	ASSERT(!mutex_owned(&un->un_pm_mutex));
18992 	mutex_enter(&un->un_pm_mutex);
18993 	if ((un->un_state == SD_STATE_SUSPENDED) ||
18994 	    (SD_DEVICE_IS_IN_LOW_POWER(un)) ||
18995 	    (pktp->pkt_flags & FLAG_SILENT)) {
18996 		mutex_exit(&un->un_pm_mutex);
18997 		goto update_pkt_reason;
18998 	}
18999 	mutex_exit(&un->un_pm_mutex);
19000 
19001 	/*
19002 	 * Suppress messages if they are all the same pkt_reason; with
19003 	 * TQ, many (up to 256) are returned with the same pkt_reason.
19004 	 * If we are in panic, then suppress the retry messages.
19005 	 */
19006 	switch (flag) {
19007 	case SD_NO_RETRY_ISSUED:
19008 		msgp = "giving up";
19009 		break;
19010 	case SD_IMMEDIATE_RETRY_ISSUED:
19011 	case SD_DELAYED_RETRY_ISSUED:
19012 		if (ddi_in_panic() || (un->un_state == SD_STATE_OFFLINE) ||
19013 		    ((pktp->pkt_reason == un->un_last_pkt_reason) &&
19014 		    (sd_error_level != SCSI_ERR_ALL))) {
19015 			return;
19016 		}
19017 		msgp = "retrying command";
19018 		break;
19019 	default:
19020 		goto update_pkt_reason;
19021 	}
19022 
19023 	reasonp = (((pktp->pkt_statistics & STAT_PERR) != 0) ? "parity error" :
19024 	    scsi_rname(pktp->pkt_reason));
19025 
19026 	if (SD_FM_LOG(un) == SD_FM_LOG_NSUP) {
19027 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
19028 		    "SCSI transport failed: reason '%s': %s\n", reasonp, msgp);
19029 	}
19030 
19031 update_pkt_reason:
19032 	/*
19033 	 * Update un->un_last_pkt_reason with the value in pktp->pkt_reason.
19034 	 * This is to prevent multiple console messages for the same failure
19035 	 * condition.  Note that un->un_last_pkt_reason is NOT restored if &
19036 	 * when the command is retried successfully because there still may be
19037 	 * more commands coming back with the same value of pktp->pkt_reason.
19038 	 */
19039 	if ((pktp->pkt_reason != CMD_CMPLT) || (xp->xb_retry_count == 0)) {
19040 		un->un_last_pkt_reason = pktp->pkt_reason;
19041 	}
19042 }
19043 
19044 
19045 /*
19046  *    Function: sd_print_cmd_incomplete_msg
19047  *
19048  * Description: Message logging fn. for a SCSA "CMD_INCOMPLETE" pkt_reason.
19049  *
19050  *   Arguments: un - ptr to associated softstate
19051  *		bp - ptr to buf(9S) for the command
19052  *		arg - passed to sd_print_retry_msg()
19053  *		code - SD_IMMEDIATE_RETRY_ISSUED, SD_DELAYED_RETRY_ISSUED,
19054  *			or SD_NO_RETRY_ISSUED
19055  *
19056  *     Context: May be called from interrupt context
19057  */
19058 
19059 static void
19060 sd_print_cmd_incomplete_msg(struct sd_lun *un, struct buf *bp, void *arg,
19061     int code)
19062 {
19063 	dev_info_t	*dip;
19064 
19065 	ASSERT(un != NULL);
19066 	ASSERT(mutex_owned(SD_MUTEX(un)));
19067 	ASSERT(bp != NULL);
19068 
19069 	switch (code) {
19070 	case SD_NO_RETRY_ISSUED:
19071 		/* Command was failed. Someone turned off this target? */
19072 		if (un->un_state != SD_STATE_OFFLINE) {
19073 			/*
19074 			 * Suppress message if we are detaching and
19075 			 * device has been disconnected
19076 			 * Note that DEVI_IS_DEVICE_REMOVED is a consolidation
19077 			 * private interface and not part of the DDI
19078 			 */
19079 			dip = un->un_sd->sd_dev;
19080 			if (!(DEVI_IS_DETACHING(dip) &&
19081 			    DEVI_IS_DEVICE_REMOVED(dip))) {
19082 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
19083 				"disk not responding to selection\n");
19084 			}
19085 			New_state(un, SD_STATE_OFFLINE);
19086 		}
19087 		break;
19088 
19089 	case SD_DELAYED_RETRY_ISSUED:
19090 	case SD_IMMEDIATE_RETRY_ISSUED:
19091 	default:
19092 		/* Command was successfully queued for retry */
19093 		sd_print_retry_msg(un, bp, arg, code);
19094 		break;
19095 	}
19096 }
19097 
19098 
19099 /*
19100  *    Function: sd_pkt_reason_cmd_incomplete
19101  *
19102  * Description: Recovery actions for a SCSA "CMD_INCOMPLETE" pkt_reason.
19103  *
19104  *     Context: May be called from interrupt context
19105  */
19106 
19107 static void
19108 sd_pkt_reason_cmd_incomplete(struct sd_lun *un, struct buf *bp,
19109     struct sd_xbuf *xp, struct scsi_pkt *pktp)
19110 {
19111 	int flag = SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE;
19112 
19113 	ASSERT(un != NULL);
19114 	ASSERT(mutex_owned(SD_MUTEX(un)));
19115 	ASSERT(bp != NULL);
19116 	ASSERT(xp != NULL);
19117 	ASSERT(pktp != NULL);
19118 
19119 	/* Do not do a reset if selection did not complete */
19120 	/* Note: Should this not just check the bit? */
19121 	if (pktp->pkt_state != STATE_GOT_BUS) {
19122 		SD_UPDATE_ERRSTATS(un, sd_transerrs);
19123 		sd_reset_target(un, pktp);
19124 	}
19125 
19126 	/*
19127 	 * If the target was not successfully selected, then set
19128 	 * SD_RETRIES_FAILFAST to indicate that we lost communication
19129 	 * with the target, and further retries and/or commands are
19130 	 * likely to take a long time.
19131 	 */
19132 	if ((pktp->pkt_state & STATE_GOT_TARGET) == 0) {
19133 		flag |= SD_RETRIES_FAILFAST;
19134 	}
19135 
19136 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19137 
19138 	sd_retry_command(un, bp, flag,
19139 	    sd_print_cmd_incomplete_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19140 }
19141 
19142 
19143 
19144 /*
19145  *    Function: sd_pkt_reason_cmd_tran_err
19146  *
19147  * Description: Recovery actions for a SCSA "CMD_TRAN_ERR" pkt_reason.
19148  *
19149  *     Context: May be called from interrupt context
19150  */
19151 
19152 static void
19153 sd_pkt_reason_cmd_tran_err(struct sd_lun *un, struct buf *bp,
19154     struct sd_xbuf *xp, struct scsi_pkt *pktp)
19155 {
19156 	ASSERT(un != NULL);
19157 	ASSERT(mutex_owned(SD_MUTEX(un)));
19158 	ASSERT(bp != NULL);
19159 	ASSERT(xp != NULL);
19160 	ASSERT(pktp != NULL);
19161 
19162 	/*
19163 	 * Do not reset if we got a parity error, or if
19164 	 * selection did not complete.
19165 	 */
19166 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
19167 	/* Note: Should this not just check the bit for pkt_state? */
19168 	if (((pktp->pkt_statistics & STAT_PERR) == 0) &&
19169 	    (pktp->pkt_state != STATE_GOT_BUS)) {
19170 		SD_UPDATE_ERRSTATS(un, sd_transerrs);
19171 		sd_reset_target(un, pktp);
19172 	}
19173 
19174 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19175 
19176 	sd_retry_command(un, bp, (SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE),
19177 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19178 }
19179 
19180 
19181 
19182 /*
19183  *    Function: sd_pkt_reason_cmd_reset
19184  *
19185  * Description: Recovery actions for a SCSA "CMD_RESET" pkt_reason.
19186  *
19187  *     Context: May be called from interrupt context
19188  */
19189 
19190 static void
19191 sd_pkt_reason_cmd_reset(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
19192     struct scsi_pkt *pktp)
19193 {
19194 	ASSERT(un != NULL);
19195 	ASSERT(mutex_owned(SD_MUTEX(un)));
19196 	ASSERT(bp != NULL);
19197 	ASSERT(xp != NULL);
19198 	ASSERT(pktp != NULL);
19199 
19200 	/* The target may still be running the command, so try to reset. */
19201 	SD_UPDATE_ERRSTATS(un, sd_transerrs);
19202 	sd_reset_target(un, pktp);
19203 
19204 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19205 
19206 	/*
19207 	 * If pkt_reason is CMD_RESET chances are that this pkt got
19208 	 * reset because another target on this bus caused it. The target
19209 	 * that caused it should get CMD_TIMEOUT with pkt_statistics
19210 	 * of STAT_TIMEOUT/STAT_DEV_RESET.
19211 	 */
19212 
19213 	sd_retry_command(un, bp, (SD_RETRIES_VICTIM | SD_RETRIES_ISOLATE),
19214 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19215 }
19216 
19217 
19218 
19219 
19220 /*
19221  *    Function: sd_pkt_reason_cmd_aborted
19222  *
19223  * Description: Recovery actions for a SCSA "CMD_ABORTED" pkt_reason.
19224  *
19225  *     Context: May be called from interrupt context
19226  */
19227 
19228 static void
19229 sd_pkt_reason_cmd_aborted(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
19230     struct scsi_pkt *pktp)
19231 {
19232 	ASSERT(un != NULL);
19233 	ASSERT(mutex_owned(SD_MUTEX(un)));
19234 	ASSERT(bp != NULL);
19235 	ASSERT(xp != NULL);
19236 	ASSERT(pktp != NULL);
19237 
19238 	/* The target may still be running the command, so try to reset. */
19239 	SD_UPDATE_ERRSTATS(un, sd_transerrs);
19240 	sd_reset_target(un, pktp);
19241 
19242 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19243 
19244 	/*
19245 	 * If pkt_reason is CMD_ABORTED chances are that this pkt got
19246 	 * aborted because another target on this bus caused it. The target
19247 	 * that caused it should get CMD_TIMEOUT with pkt_statistics
19248 	 * of STAT_TIMEOUT/STAT_DEV_RESET.
19249 	 */
19250 
19251 	sd_retry_command(un, bp, (SD_RETRIES_VICTIM | SD_RETRIES_ISOLATE),
19252 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19253 }
19254 
19255 
19256 
19257 /*
19258  *    Function: sd_pkt_reason_cmd_timeout
19259  *
19260  * Description: Recovery actions for a SCSA "CMD_TIMEOUT" pkt_reason.
19261  *
19262  *     Context: May be called from interrupt context
19263  */
19264 
19265 static void
19266 sd_pkt_reason_cmd_timeout(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
19267     struct scsi_pkt *pktp)
19268 {
19269 	ASSERT(un != NULL);
19270 	ASSERT(mutex_owned(SD_MUTEX(un)));
19271 	ASSERT(bp != NULL);
19272 	ASSERT(xp != NULL);
19273 	ASSERT(pktp != NULL);
19274 
19275 
19276 	SD_UPDATE_ERRSTATS(un, sd_transerrs);
19277 	sd_reset_target(un, pktp);
19278 
19279 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19280 
19281 	/*
19282 	 * A command timeout indicates that we could not establish
19283 	 * communication with the target, so set SD_RETRIES_FAILFAST
19284 	 * as further retries/commands are likely to take a long time.
19285 	 */
19286 	sd_retry_command(un, bp,
19287 	    (SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE | SD_RETRIES_FAILFAST),
19288 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19289 }
19290 
19291 
19292 
19293 /*
19294  *    Function: sd_pkt_reason_cmd_unx_bus_free
19295  *
19296  * Description: Recovery actions for a SCSA "CMD_UNX_BUS_FREE" pkt_reason.
19297  *
19298  *     Context: May be called from interrupt context
19299  */
19300 
19301 static void
19302 sd_pkt_reason_cmd_unx_bus_free(struct sd_lun *un, struct buf *bp,
19303     struct sd_xbuf *xp, struct scsi_pkt *pktp)
19304 {
19305 	void (*funcp)(struct sd_lun *un, struct buf *bp, void *arg, int code);
19306 
19307 	ASSERT(un != NULL);
19308 	ASSERT(mutex_owned(SD_MUTEX(un)));
19309 	ASSERT(bp != NULL);
19310 	ASSERT(xp != NULL);
19311 	ASSERT(pktp != NULL);
19312 
19313 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
19314 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19315 
19316 	funcp = ((pktp->pkt_statistics & STAT_PERR) == 0) ?
19317 	    sd_print_retry_msg : NULL;
19318 
19319 	sd_retry_command(un, bp, (SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE),
19320 	    funcp, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19321 }
19322 
19323 
19324 /*
19325  *    Function: sd_pkt_reason_cmd_tag_reject
19326  *
19327  * Description: Recovery actions for a SCSA "CMD_TAG_REJECT" pkt_reason.
19328  *
19329  *     Context: May be called from interrupt context
19330  */
19331 
19332 static void
19333 sd_pkt_reason_cmd_tag_reject(struct sd_lun *un, struct buf *bp,
19334     struct sd_xbuf *xp, struct scsi_pkt *pktp)
19335 {
19336 	ASSERT(un != NULL);
19337 	ASSERT(mutex_owned(SD_MUTEX(un)));
19338 	ASSERT(bp != NULL);
19339 	ASSERT(xp != NULL);
19340 	ASSERT(pktp != NULL);
19341 
19342 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
19343 	pktp->pkt_flags = 0;
19344 	un->un_tagflags = 0;
19345 	if (un->un_f_opt_queueing == TRUE) {
19346 		un->un_throttle = min(un->un_throttle, 3);
19347 	} else {
19348 		un->un_throttle = 1;
19349 	}
19350 	mutex_exit(SD_MUTEX(un));
19351 	(void) scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing", 0, 1);
19352 	mutex_enter(SD_MUTEX(un));
19353 
19354 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19355 
19356 	/* Legacy behavior not to check retry counts here. */
19357 	sd_retry_command(un, bp, (SD_RETRIES_NOCHECK | SD_RETRIES_ISOLATE),
19358 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19359 }
19360 
19361 
19362 /*
19363  *    Function: sd_pkt_reason_default
19364  *
19365  * Description: Default recovery actions for SCSA pkt_reason values that
19366  *		do not have more explicit recovery actions.
19367  *
19368  *     Context: May be called from interrupt context
19369  */
19370 
19371 static void
19372 sd_pkt_reason_default(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
19373     struct scsi_pkt *pktp)
19374 {
19375 	ASSERT(un != NULL);
19376 	ASSERT(mutex_owned(SD_MUTEX(un)));
19377 	ASSERT(bp != NULL);
19378 	ASSERT(xp != NULL);
19379 	ASSERT(pktp != NULL);
19380 
19381 	SD_UPDATE_ERRSTATS(un, sd_transerrs);
19382 	sd_reset_target(un, pktp);
19383 
19384 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19385 
19386 	sd_retry_command(un, bp, (SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE),
19387 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19388 }
19389 
19390 
19391 
19392 /*
19393  *    Function: sd_pkt_status_check_condition
19394  *
19395  * Description: Recovery actions for a "STATUS_CHECK" SCSI command status.
19396  *
19397  *     Context: May be called from interrupt context
19398  */
19399 
19400 static void
19401 sd_pkt_status_check_condition(struct sd_lun *un, struct buf *bp,
19402     struct sd_xbuf *xp, struct scsi_pkt *pktp)
19403 {
19404 	ASSERT(un != NULL);
19405 	ASSERT(mutex_owned(SD_MUTEX(un)));
19406 	ASSERT(bp != NULL);
19407 	ASSERT(xp != NULL);
19408 	ASSERT(pktp != NULL);
19409 
19410 	SD_TRACE(SD_LOG_IO, un, "sd_pkt_status_check_condition: "
19411 	    "entry: buf:0x%p xp:0x%p\n", bp, xp);
19412 
19413 	/*
19414 	 * If ARQ is NOT enabled, then issue a REQUEST SENSE command (the
19415 	 * command will be retried after the request sense). Otherwise, retry
19416 	 * the command. Note: we are issuing the request sense even though the
19417 	 * retry limit may have been reached for the failed command.
19418 	 */
19419 	if (un->un_f_arq_enabled == FALSE) {
19420 		SD_INFO(SD_LOG_IO_CORE, un, "sd_pkt_status_check_condition: "
19421 		    "no ARQ, sending request sense command\n");
19422 		sd_send_request_sense_command(un, bp, pktp);
19423 	} else {
19424 		SD_INFO(SD_LOG_IO_CORE, un, "sd_pkt_status_check_condition: "
19425 		    "ARQ,retrying request sense command\n");
19426 #if defined(__i386) || defined(__amd64)
19427 		/*
19428 		 * The SD_RETRY_DELAY value need to be adjusted here
19429 		 * when SD_RETRY_DELAY change in sddef.h
19430 		 */
19431 		sd_retry_command(un, bp, SD_RETRIES_STANDARD, NULL, NULL, EIO,
19432 		    un->un_f_is_fibre?drv_usectohz(100000):(clock_t)0,
19433 		    NULL);
19434 #else
19435 		sd_retry_command(un, bp, SD_RETRIES_STANDARD, NULL, NULL,
19436 		    EIO, SD_RETRY_DELAY, NULL);
19437 #endif
19438 	}
19439 
19440 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_pkt_status_check_condition: exit\n");
19441 }
19442 
19443 
19444 /*
19445  *    Function: sd_pkt_status_busy
19446  *
19447  * Description: Recovery actions for a "STATUS_BUSY" SCSI command status.
19448  *
19449  *     Context: May be called from interrupt context
19450  */
19451 
19452 static void
19453 sd_pkt_status_busy(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
19454     struct scsi_pkt *pktp)
19455 {
19456 	ASSERT(un != NULL);
19457 	ASSERT(mutex_owned(SD_MUTEX(un)));
19458 	ASSERT(bp != NULL);
19459 	ASSERT(xp != NULL);
19460 	ASSERT(pktp != NULL);
19461 
19462 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19463 	    "sd_pkt_status_busy: entry\n");
19464 
19465 	/* If retries are exhausted, just fail the command. */
19466 	if (xp->xb_retry_count >= un->un_busy_retry_count) {
19467 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
19468 		    "device busy too long\n");
19469 		sd_return_failed_command(un, bp, EIO);
19470 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19471 		    "sd_pkt_status_busy: exit\n");
19472 		return;
19473 	}
19474 	xp->xb_retry_count++;
19475 
19476 	/*
19477 	 * Try to reset the target. However, we do not want to perform
19478 	 * more than one reset if the device continues to fail. The reset
19479 	 * will be performed when the retry count reaches the reset
19480 	 * threshold.  This threshold should be set such that at least
19481 	 * one retry is issued before the reset is performed.
19482 	 */
19483 	if (xp->xb_retry_count ==
19484 	    ((un->un_reset_retry_count < 2) ? 2 : un->un_reset_retry_count)) {
19485 		int rval = 0;
19486 		mutex_exit(SD_MUTEX(un));
19487 		if (un->un_f_allow_bus_device_reset == TRUE) {
19488 			/*
19489 			 * First try to reset the LUN; if we cannot then
19490 			 * try to reset the target.
19491 			 */
19492 			if (un->un_f_lun_reset_enabled == TRUE) {
19493 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19494 				    "sd_pkt_status_busy: RESET_LUN\n");
19495 				rval = scsi_reset(SD_ADDRESS(un), RESET_LUN);
19496 			}
19497 			if (rval == 0) {
19498 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19499 				    "sd_pkt_status_busy: RESET_TARGET\n");
19500 				rval = scsi_reset(SD_ADDRESS(un), RESET_TARGET);
19501 			}
19502 		}
19503 		if (rval == 0) {
19504 			/*
19505 			 * If the RESET_LUN and/or RESET_TARGET failed,
19506 			 * try RESET_ALL
19507 			 */
19508 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19509 			    "sd_pkt_status_busy: RESET_ALL\n");
19510 			rval = scsi_reset(SD_ADDRESS(un), RESET_ALL);
19511 		}
19512 		mutex_enter(SD_MUTEX(un));
19513 		if (rval == 0) {
19514 			/*
19515 			 * The RESET_LUN, RESET_TARGET, and/or RESET_ALL failed.
19516 			 * At this point we give up & fail the command.
19517 			 */
19518 			sd_return_failed_command(un, bp, EIO);
19519 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19520 			    "sd_pkt_status_busy: exit (failed cmd)\n");
19521 			return;
19522 		}
19523 	}
19524 
19525 	/*
19526 	 * Retry the command. Be sure to specify SD_RETRIES_NOCHECK as
19527 	 * we have already checked the retry counts above.
19528 	 */
19529 	sd_retry_command(un, bp, SD_RETRIES_NOCHECK, NULL, NULL,
19530 	    EIO, un->un_busy_timeout, NULL);
19531 
19532 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19533 	    "sd_pkt_status_busy: exit\n");
19534 }
19535 
19536 
19537 /*
19538  *    Function: sd_pkt_status_reservation_conflict
19539  *
19540  * Description: Recovery actions for a "STATUS_RESERVATION_CONFLICT" SCSI
19541  *		command status.
19542  *
19543  *     Context: May be called from interrupt context
19544  */
19545 
19546 static void
19547 sd_pkt_status_reservation_conflict(struct sd_lun *un, struct buf *bp,
19548     struct sd_xbuf *xp, struct scsi_pkt *pktp)
19549 {
19550 	ASSERT(un != NULL);
19551 	ASSERT(mutex_owned(SD_MUTEX(un)));
19552 	ASSERT(bp != NULL);
19553 	ASSERT(xp != NULL);
19554 	ASSERT(pktp != NULL);
19555 
19556 	/*
19557 	 * If the command was PERSISTENT_RESERVATION_[IN|OUT] then reservation
19558 	 * conflict could be due to various reasons like incorrect keys, not
19559 	 * registered or not reserved etc. So, we return EACCES to the caller.
19560 	 */
19561 	if (un->un_reservation_type == SD_SCSI3_RESERVATION) {
19562 		int cmd = SD_GET_PKT_OPCODE(pktp);
19563 		if ((cmd == SCMD_PERSISTENT_RESERVE_IN) ||
19564 		    (cmd == SCMD_PERSISTENT_RESERVE_OUT)) {
19565 			sd_return_failed_command(un, bp, EACCES);
19566 			return;
19567 		}
19568 	}
19569 
19570 	un->un_resvd_status |= SD_RESERVATION_CONFLICT;
19571 
19572 	if ((un->un_resvd_status & SD_FAILFAST) != 0) {
19573 		if (sd_failfast_enable != 0) {
19574 			/* By definition, we must panic here.... */
19575 			sd_panic_for_res_conflict(un);
19576 			/*NOTREACHED*/
19577 		}
19578 		SD_ERROR(SD_LOG_IO, un,
19579 		    "sd_handle_resv_conflict: Disk Reserved\n");
19580 		sd_return_failed_command(un, bp, EACCES);
19581 		return;
19582 	}
19583 
19584 	/*
19585 	 * 1147670: retry only if sd_retry_on_reservation_conflict
19586 	 * property is set (default is 1). Retries will not succeed
19587 	 * on a disk reserved by another initiator. HA systems
19588 	 * may reset this via sd.conf to avoid these retries.
19589 	 *
19590 	 * Note: The legacy return code for this failure is EIO, however EACCES
19591 	 * seems more appropriate for a reservation conflict.
19592 	 */
19593 	if (sd_retry_on_reservation_conflict == 0) {
19594 		SD_ERROR(SD_LOG_IO, un,
19595 		    "sd_handle_resv_conflict: Device Reserved\n");
19596 		sd_return_failed_command(un, bp, EIO);
19597 		return;
19598 	}
19599 
19600 	/*
19601 	 * Retry the command if we can.
19602 	 *
19603 	 * Note: The legacy return code for this failure is EIO, however EACCES
19604 	 * seems more appropriate for a reservation conflict.
19605 	 */
19606 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, NULL, NULL, EIO,
19607 	    (clock_t)2, NULL);
19608 }
19609 
19610 
19611 
19612 /*
19613  *    Function: sd_pkt_status_qfull
19614  *
19615  * Description: Handle a QUEUE FULL condition from the target.  This can
19616  *		occur if the HBA does not handle the queue full condition.
19617  *		(Basically this means third-party HBAs as Sun HBAs will
19618  *		handle the queue full condition.)  Note that if there are
19619  *		some commands already in the transport, then the queue full
19620  *		has occurred because the queue for this nexus is actually
19621  *		full. If there are no commands in the transport, then the
19622  *		queue full is resulting from some other initiator or lun
19623  *		consuming all the resources at the target.
19624  *
19625  *     Context: May be called from interrupt context
19626  */
19627 
19628 static void
19629 sd_pkt_status_qfull(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
19630     struct scsi_pkt *pktp)
19631 {
19632 	ASSERT(un != NULL);
19633 	ASSERT(mutex_owned(SD_MUTEX(un)));
19634 	ASSERT(bp != NULL);
19635 	ASSERT(xp != NULL);
19636 	ASSERT(pktp != NULL);
19637 
19638 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19639 	    "sd_pkt_status_qfull: entry\n");
19640 
19641 	/*
19642 	 * Just lower the QFULL throttle and retry the command.  Note that
19643 	 * we do not limit the number of retries here.
19644 	 */
19645 	sd_reduce_throttle(un, SD_THROTTLE_QFULL);
19646 	sd_retry_command(un, bp, SD_RETRIES_NOCHECK, NULL, NULL, 0,
19647 	    SD_RESTART_TIMEOUT, NULL);
19648 
19649 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19650 	    "sd_pkt_status_qfull: exit\n");
19651 }
19652 
19653 
19654 /*
19655  *    Function: sd_reset_target
19656  *
19657  * Description: Issue a scsi_reset(9F), with either RESET_LUN,
19658  *		RESET_TARGET, or RESET_ALL.
19659  *
19660  *     Context: May be called under interrupt context.
19661  */
19662 
19663 static void
19664 sd_reset_target(struct sd_lun *un, struct scsi_pkt *pktp)
19665 {
19666 	int rval = 0;
19667 
19668 	ASSERT(un != NULL);
19669 	ASSERT(mutex_owned(SD_MUTEX(un)));
19670 	ASSERT(pktp != NULL);
19671 
19672 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_reset_target: entry\n");
19673 
19674 	/*
19675 	 * No need to reset if the transport layer has already done so.
19676 	 */
19677 	if ((pktp->pkt_statistics &
19678 	    (STAT_BUS_RESET | STAT_DEV_RESET | STAT_ABORTED)) != 0) {
19679 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19680 		    "sd_reset_target: no reset\n");
19681 		return;
19682 	}
19683 
19684 	mutex_exit(SD_MUTEX(un));
19685 
19686 	if (un->un_f_allow_bus_device_reset == TRUE) {
19687 		if (un->un_f_lun_reset_enabled == TRUE) {
19688 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19689 			    "sd_reset_target: RESET_LUN\n");
19690 			rval = scsi_reset(SD_ADDRESS(un), RESET_LUN);
19691 		}
19692 		if (rval == 0) {
19693 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19694 			    "sd_reset_target: RESET_TARGET\n");
19695 			rval = scsi_reset(SD_ADDRESS(un), RESET_TARGET);
19696 		}
19697 	}
19698 
19699 	if (rval == 0) {
19700 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19701 		    "sd_reset_target: RESET_ALL\n");
19702 		(void) scsi_reset(SD_ADDRESS(un), RESET_ALL);
19703 	}
19704 
19705 	mutex_enter(SD_MUTEX(un));
19706 
19707 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_reset_target: exit\n");
19708 }
19709 
19710 /*
19711  *    Function: sd_target_change_task
19712  *
19713  * Description: Handle dynamic target change
19714  *
19715  *     Context: Executes in a taskq() thread context
19716  */
19717 static void
19718 sd_target_change_task(void *arg)
19719 {
19720 	struct sd_lun		*un = arg;
19721 	uint64_t		capacity;
19722 	diskaddr_t		label_cap;
19723 	uint_t			lbasize;
19724 	sd_ssc_t		*ssc;
19725 
19726 	ASSERT(un != NULL);
19727 	ASSERT(!mutex_owned(SD_MUTEX(un)));
19728 
19729 	if ((un->un_f_blockcount_is_valid == FALSE) ||
19730 	    (un->un_f_tgt_blocksize_is_valid == FALSE)) {
19731 		return;
19732 	}
19733 
19734 	ssc = sd_ssc_init(un);
19735 
19736 	if (sd_send_scsi_READ_CAPACITY(ssc, &capacity,
19737 	    &lbasize, SD_PATH_DIRECT) != 0) {
19738 		SD_ERROR(SD_LOG_ERROR, un,
19739 		    "sd_target_change_task: fail to read capacity\n");
19740 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
19741 		goto task_exit;
19742 	}
19743 
19744 	mutex_enter(SD_MUTEX(un));
19745 	if (capacity <= un->un_blockcount) {
19746 		mutex_exit(SD_MUTEX(un));
19747 		goto task_exit;
19748 	}
19749 
19750 	sd_update_block_info(un, lbasize, capacity);
19751 	mutex_exit(SD_MUTEX(un));
19752 
19753 	/*
19754 	 * If lun is EFI labeled and lun capacity is greater than the
19755 	 * capacity contained in the label, log a sys event.
19756 	 */
19757 	if (cmlb_efi_label_capacity(un->un_cmlbhandle, &label_cap,
19758 	    (void*)SD_PATH_DIRECT) == 0) {
19759 		mutex_enter(SD_MUTEX(un));
19760 		if (un->un_f_blockcount_is_valid &&
19761 		    un->un_blockcount > label_cap) {
19762 			mutex_exit(SD_MUTEX(un));
19763 			sd_log_lun_expansion_event(un, KM_SLEEP);
19764 		} else {
19765 			mutex_exit(SD_MUTEX(un));
19766 		}
19767 	}
19768 
19769 task_exit:
19770 	sd_ssc_fini(ssc);
19771 }
19772 
19773 
19774 /*
19775  *    Function: sd_log_dev_status_event
19776  *
19777  * Description: Log EC_dev_status sysevent
19778  *
19779  *     Context: Never called from interrupt context
19780  */
19781 static void
19782 sd_log_dev_status_event(struct sd_lun *un, char *esc, int km_flag)
19783 {
19784 	int err;
19785 	char			*path;
19786 	nvlist_t		*attr_list;
19787 
19788 	/* Allocate and build sysevent attribute list */
19789 	err = nvlist_alloc(&attr_list, NV_UNIQUE_NAME_TYPE, km_flag);
19790 	if (err != 0) {
19791 		SD_ERROR(SD_LOG_ERROR, un,
19792 		    "sd_log_dev_status_event: fail to allocate space\n");
19793 		return;
19794 	}
19795 
19796 	path = kmem_alloc(MAXPATHLEN, km_flag);
19797 	if (path == NULL) {
19798 		nvlist_free(attr_list);
19799 		SD_ERROR(SD_LOG_ERROR, un,
19800 		    "sd_log_dev_status_event: fail to allocate space\n");
19801 		return;
19802 	}
19803 	/*
19804 	 * Add path attribute to identify the lun.
19805 	 * We are using minor node 'a' as the sysevent attribute.
19806 	 */
19807 	(void) snprintf(path, MAXPATHLEN, "/devices");
19808 	(void) ddi_pathname(SD_DEVINFO(un), path + strlen(path));
19809 	(void) snprintf(path + strlen(path), MAXPATHLEN - strlen(path),
19810 	    ":a");
19811 
19812 	err = nvlist_add_string(attr_list, DEV_PHYS_PATH, path);
19813 	if (err != 0) {
19814 		nvlist_free(attr_list);
19815 		kmem_free(path, MAXPATHLEN);
19816 		SD_ERROR(SD_LOG_ERROR, un,
19817 		    "sd_log_dev_status_event: fail to add attribute\n");
19818 		return;
19819 	}
19820 
19821 	/* Log dynamic lun expansion sysevent */
19822 	err = ddi_log_sysevent(SD_DEVINFO(un), SUNW_VENDOR, EC_DEV_STATUS,
19823 	    esc, attr_list, NULL, km_flag);
19824 	if (err != DDI_SUCCESS) {
19825 		SD_ERROR(SD_LOG_ERROR, un,
19826 		    "sd_log_dev_status_event: fail to log sysevent\n");
19827 	}
19828 
19829 	nvlist_free(attr_list);
19830 	kmem_free(path, MAXPATHLEN);
19831 }
19832 
19833 
19834 /*
19835  *    Function: sd_log_lun_expansion_event
19836  *
19837  * Description: Log lun expansion sys event
19838  *
19839  *     Context: Never called from interrupt context
19840  */
19841 static void
19842 sd_log_lun_expansion_event(struct sd_lun *un, int km_flag)
19843 {
19844 	sd_log_dev_status_event(un, ESC_DEV_DLE, km_flag);
19845 }
19846 
19847 
19848 /*
19849  *    Function: sd_log_eject_request_event
19850  *
19851  * Description: Log eject request sysevent
19852  *
19853  *     Context: Never called from interrupt context
19854  */
19855 static void
19856 sd_log_eject_request_event(struct sd_lun *un, int km_flag)
19857 {
19858 	sd_log_dev_status_event(un, ESC_DEV_EJECT_REQUEST, km_flag);
19859 }
19860 
19861 
19862 /*
19863  *    Function: sd_media_change_task
19864  *
19865  * Description: Recovery action for CDROM to become available.
19866  *
19867  *     Context: Executes in a taskq() thread context
19868  */
19869 
19870 static void
19871 sd_media_change_task(void *arg)
19872 {
19873 	struct	scsi_pkt	*pktp = arg;
19874 	struct	sd_lun		*un;
19875 	struct	buf		*bp;
19876 	struct	sd_xbuf		*xp;
19877 	int	err		= 0;
19878 	int	retry_count	= 0;
19879 	int	retry_limit	= SD_UNIT_ATTENTION_RETRY/10;
19880 	struct	sd_sense_info	si;
19881 
19882 	ASSERT(pktp != NULL);
19883 	bp = (struct buf *)pktp->pkt_private;
19884 	ASSERT(bp != NULL);
19885 	xp = SD_GET_XBUF(bp);
19886 	ASSERT(xp != NULL);
19887 	un = SD_GET_UN(bp);
19888 	ASSERT(un != NULL);
19889 	ASSERT(!mutex_owned(SD_MUTEX(un)));
19890 	ASSERT(un->un_f_monitor_media_state);
19891 
19892 	si.ssi_severity = SCSI_ERR_INFO;
19893 	si.ssi_pfa_flag = FALSE;
19894 
19895 	/*
19896 	 * When a reset is issued on a CDROM, it takes a long time to
19897 	 * recover. First few attempts to read capacity and other things
19898 	 * related to handling unit attention fail (with a ASC 0x4 and
19899 	 * ASCQ 0x1). In that case we want to do enough retries and we want
19900 	 * to limit the retries in other cases of genuine failures like
19901 	 * no media in drive.
19902 	 */
19903 	while (retry_count++ < retry_limit) {
19904 		if ((err = sd_handle_mchange(un)) == 0) {
19905 			break;
19906 		}
19907 		if (err == EAGAIN) {
19908 			retry_limit = SD_UNIT_ATTENTION_RETRY;
19909 		}
19910 		/* Sleep for 0.5 sec. & try again */
19911 		delay(drv_usectohz(500000));
19912 	}
19913 
19914 	/*
19915 	 * Dispatch (retry or fail) the original command here,
19916 	 * along with appropriate console messages....
19917 	 *
19918 	 * Must grab the mutex before calling sd_retry_command,
19919 	 * sd_print_sense_msg and sd_return_failed_command.
19920 	 */
19921 	mutex_enter(SD_MUTEX(un));
19922 	if (err != SD_CMD_SUCCESS) {
19923 		SD_UPDATE_ERRSTATS(un, sd_harderrs);
19924 		SD_UPDATE_ERRSTATS(un, sd_rq_nodev_err);
19925 		si.ssi_severity = SCSI_ERR_FATAL;
19926 		sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
19927 		sd_return_failed_command(un, bp, EIO);
19928 	} else {
19929 		sd_retry_command(un, bp, SD_RETRIES_UA, sd_print_sense_msg,
19930 		    &si, EIO, (clock_t)0, NULL);
19931 	}
19932 	mutex_exit(SD_MUTEX(un));
19933 }
19934 
19935 
19936 
19937 /*
19938  *    Function: sd_handle_mchange
19939  *
19940  * Description: Perform geometry validation & other recovery when CDROM
19941  *		has been removed from drive.
19942  *
19943  * Return Code: 0 for success
19944  *		errno-type return code of either sd_send_scsi_DOORLOCK() or
19945  *		sd_send_scsi_READ_CAPACITY()
19946  *
19947  *     Context: Executes in a taskq() thread context
19948  */
19949 
19950 static int
19951 sd_handle_mchange(struct sd_lun *un)
19952 {
19953 	uint64_t	capacity;
19954 	uint32_t	lbasize;
19955 	int		rval;
19956 	sd_ssc_t	*ssc;
19957 
19958 	ASSERT(!mutex_owned(SD_MUTEX(un)));
19959 	ASSERT(un->un_f_monitor_media_state);
19960 
19961 	ssc = sd_ssc_init(un);
19962 	rval = sd_send_scsi_READ_CAPACITY(ssc, &capacity, &lbasize,
19963 	    SD_PATH_DIRECT_PRIORITY);
19964 
19965 	if (rval != 0)
19966 		goto failed;
19967 
19968 	mutex_enter(SD_MUTEX(un));
19969 	sd_update_block_info(un, lbasize, capacity);
19970 
19971 	if (un->un_errstats != NULL) {
19972 		struct	sd_errstats *stp =
19973 		    (struct sd_errstats *)un->un_errstats->ks_data;
19974 		stp->sd_capacity.value.ui64 = (uint64_t)
19975 		    ((uint64_t)un->un_blockcount *
19976 		    (uint64_t)un->un_tgt_blocksize);
19977 	}
19978 
19979 	/*
19980 	 * Check if the media in the device is writable or not
19981 	 */
19982 	if (ISCD(un)) {
19983 		sd_check_for_writable_cd(ssc, SD_PATH_DIRECT_PRIORITY);
19984 	}
19985 
19986 	/*
19987 	 * Note: Maybe let the strategy/partitioning chain worry about getting
19988 	 * valid geometry.
19989 	 */
19990 	mutex_exit(SD_MUTEX(un));
19991 	cmlb_invalidate(un->un_cmlbhandle, (void *)SD_PATH_DIRECT_PRIORITY);
19992 
19993 
19994 	if (cmlb_validate(un->un_cmlbhandle, 0,
19995 	    (void *)SD_PATH_DIRECT_PRIORITY) != 0) {
19996 		sd_ssc_fini(ssc);
19997 		return (EIO);
19998 	} else {
19999 		if (un->un_f_pkstats_enabled) {
20000 			sd_set_pstats(un);
20001 			SD_TRACE(SD_LOG_IO_PARTITION, un,
20002 			    "sd_handle_mchange: un:0x%p pstats created and "
20003 			    "set\n", un);
20004 		}
20005 	}
20006 
20007 	/*
20008 	 * Try to lock the door
20009 	 */
20010 	rval = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_PREVENT,
20011 	    SD_PATH_DIRECT_PRIORITY);
20012 failed:
20013 	if (rval != 0)
20014 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
20015 	sd_ssc_fini(ssc);
20016 	return (rval);
20017 }
20018 
20019 
20020 /*
20021  *    Function: sd_send_scsi_DOORLOCK
20022  *
20023  * Description: Issue the scsi DOOR LOCK command
20024  *
20025  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
20026  *                      structure for this target.
20027  *		flag  - SD_REMOVAL_ALLOW
20028  *			SD_REMOVAL_PREVENT
20029  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
20030  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
20031  *			to use the USCSI "direct" chain and bypass the normal
20032  *			command waitq. SD_PATH_DIRECT_PRIORITY is used when this
20033  *			command is issued as part of an error recovery action.
20034  *
20035  * Return Code: 0   - Success
20036  *		errno return code from sd_ssc_send()
20037  *
20038  *     Context: Can sleep.
20039  */
20040 
20041 static int
20042 sd_send_scsi_DOORLOCK(sd_ssc_t *ssc, int flag, int path_flag)
20043 {
20044 	struct scsi_extended_sense	sense_buf;
20045 	union scsi_cdb		cdb;
20046 	struct uscsi_cmd	ucmd_buf;
20047 	int			status;
20048 	struct sd_lun		*un;
20049 
20050 	ASSERT(ssc != NULL);
20051 	un = ssc->ssc_un;
20052 	ASSERT(un != NULL);
20053 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20054 
20055 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_DOORLOCK: entry: un:0x%p\n", un);
20056 
20057 	/* already determined doorlock is not supported, fake success */
20058 	if (un->un_f_doorlock_supported == FALSE) {
20059 		return (0);
20060 	}
20061 
20062 	/*
20063 	 * If we are ejecting and see an SD_REMOVAL_PREVENT
20064 	 * ignore the command so we can complete the eject
20065 	 * operation.
20066 	 */
20067 	if (flag == SD_REMOVAL_PREVENT) {
20068 		mutex_enter(SD_MUTEX(un));
20069 		if (un->un_f_ejecting == TRUE) {
20070 			mutex_exit(SD_MUTEX(un));
20071 			return (EAGAIN);
20072 		}
20073 		mutex_exit(SD_MUTEX(un));
20074 	}
20075 
20076 	bzero(&cdb, sizeof (cdb));
20077 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20078 
20079 	cdb.scc_cmd = SCMD_DOORLOCK;
20080 	cdb.cdb_opaque[4] = (uchar_t)flag;
20081 
20082 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20083 	ucmd_buf.uscsi_cdblen	= CDB_GROUP0;
20084 	ucmd_buf.uscsi_bufaddr	= NULL;
20085 	ucmd_buf.uscsi_buflen	= 0;
20086 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20087 	ucmd_buf.uscsi_rqlen	= sizeof (sense_buf);
20088 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_SILENT;
20089 	ucmd_buf.uscsi_timeout	= 15;
20090 
20091 	SD_TRACE(SD_LOG_IO, un,
20092 	    "sd_send_scsi_DOORLOCK: returning sd_ssc_send\n");
20093 
20094 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20095 	    UIO_SYSSPACE, path_flag);
20096 
20097 	if (status == 0)
20098 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20099 
20100 	if ((status == EIO) && (ucmd_buf.uscsi_status == STATUS_CHECK) &&
20101 	    (ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20102 	    (scsi_sense_key((uint8_t *)&sense_buf) == KEY_ILLEGAL_REQUEST)) {
20103 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
20104 
20105 		/* fake success and skip subsequent doorlock commands */
20106 		un->un_f_doorlock_supported = FALSE;
20107 		return (0);
20108 	}
20109 
20110 	return (status);
20111 }
20112 
20113 /*
20114  *    Function: sd_send_scsi_READ_CAPACITY
20115  *
20116  * Description: This routine uses the scsi READ CAPACITY command to determine
20117  *		the device capacity in number of blocks and the device native
20118  *		block size. If this function returns a failure, then the
20119  *		values in *capp and *lbap are undefined.  If the capacity
20120  *		returned is 0xffffffff then the lun is too large for a
20121  *		normal READ CAPACITY command and the results of a
20122  *		READ CAPACITY 16 will be used instead.
20123  *
20124  *   Arguments: ssc   - ssc contains ptr to soft state struct for the target
20125  *		capp - ptr to unsigned 64-bit variable to receive the
20126  *			capacity value from the command.
20127  *		lbap - ptr to unsigned 32-bit varaible to receive the
20128  *			block size value from the command
20129  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
20130  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
20131  *			to use the USCSI "direct" chain and bypass the normal
20132  *			command waitq. SD_PATH_DIRECT_PRIORITY is used when this
20133  *			command is issued as part of an error recovery action.
20134  *
20135  * Return Code: 0   - Success
20136  *		EIO - IO error
20137  *		EACCES - Reservation conflict detected
20138  *		EAGAIN - Device is becoming ready
20139  *		errno return code from sd_ssc_send()
20140  *
20141  *     Context: Can sleep.  Blocks until command completes.
20142  */
20143 
20144 #define	SD_CAPACITY_SIZE	sizeof (struct scsi_capacity)
20145 
20146 static int
20147 sd_send_scsi_READ_CAPACITY(sd_ssc_t *ssc, uint64_t *capp, uint32_t *lbap,
20148     int path_flag)
20149 {
20150 	struct	scsi_extended_sense	sense_buf;
20151 	struct	uscsi_cmd	ucmd_buf;
20152 	union	scsi_cdb	cdb;
20153 	uint32_t		*capacity_buf;
20154 	uint64_t		capacity;
20155 	uint32_t		lbasize;
20156 	uint32_t		pbsize;
20157 	int			status;
20158 	struct sd_lun		*un;
20159 
20160 	ASSERT(ssc != NULL);
20161 
20162 	un = ssc->ssc_un;
20163 	ASSERT(un != NULL);
20164 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20165 	ASSERT(capp != NULL);
20166 	ASSERT(lbap != NULL);
20167 
20168 	SD_TRACE(SD_LOG_IO, un,
20169 	    "sd_send_scsi_READ_CAPACITY: entry: un:0x%p\n", un);
20170 
20171 	/*
20172 	 * First send a READ_CAPACITY command to the target.
20173 	 * (This command is mandatory under SCSI-2.)
20174 	 *
20175 	 * Set up the CDB for the READ_CAPACITY command.  The Partial
20176 	 * Medium Indicator bit is cleared.  The address field must be
20177 	 * zero if the PMI bit is zero.
20178 	 */
20179 	bzero(&cdb, sizeof (cdb));
20180 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20181 
20182 	capacity_buf = kmem_zalloc(SD_CAPACITY_SIZE, KM_SLEEP);
20183 
20184 	cdb.scc_cmd = SCMD_READ_CAPACITY;
20185 
20186 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20187 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
20188 	ucmd_buf.uscsi_bufaddr	= (caddr_t)capacity_buf;
20189 	ucmd_buf.uscsi_buflen	= SD_CAPACITY_SIZE;
20190 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20191 	ucmd_buf.uscsi_rqlen	= sizeof (sense_buf);
20192 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
20193 	ucmd_buf.uscsi_timeout	= 60;
20194 
20195 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20196 	    UIO_SYSSPACE, path_flag);
20197 
20198 	switch (status) {
20199 	case 0:
20200 		/* Return failure if we did not get valid capacity data. */
20201 		if (ucmd_buf.uscsi_resid != 0) {
20202 			sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
20203 			    "sd_send_scsi_READ_CAPACITY received invalid "
20204 			    "capacity data");
20205 			kmem_free(capacity_buf, SD_CAPACITY_SIZE);
20206 			return (EIO);
20207 		}
20208 		/*
20209 		 * Read capacity and block size from the READ CAPACITY 10 data.
20210 		 * This data may be adjusted later due to device specific
20211 		 * issues.
20212 		 *
20213 		 * According to the SCSI spec, the READ CAPACITY 10
20214 		 * command returns the following:
20215 		 *
20216 		 *  bytes 0-3: Maximum logical block address available.
20217 		 *		(MSB in byte:0 & LSB in byte:3)
20218 		 *
20219 		 *  bytes 4-7: Block length in bytes
20220 		 *		(MSB in byte:4 & LSB in byte:7)
20221 		 *
20222 		 */
20223 		capacity = BE_32(capacity_buf[0]);
20224 		lbasize = BE_32(capacity_buf[1]);
20225 
20226 		/*
20227 		 * Done with capacity_buf
20228 		 */
20229 		kmem_free(capacity_buf, SD_CAPACITY_SIZE);
20230 
20231 		/*
20232 		 * if the reported capacity is set to all 0xf's, then
20233 		 * this disk is too large and requires SBC-2 commands.
20234 		 * Reissue the request using READ CAPACITY 16.
20235 		 */
20236 		if (capacity == 0xffffffff) {
20237 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
20238 			status = sd_send_scsi_READ_CAPACITY_16(ssc, &capacity,
20239 			    &lbasize, &pbsize, path_flag);
20240 			if (status != 0) {
20241 				return (status);
20242 			} else {
20243 				goto rc16_done;
20244 			}
20245 		}
20246 		break;	/* Success! */
20247 	case EIO:
20248 		switch (ucmd_buf.uscsi_status) {
20249 		case STATUS_RESERVATION_CONFLICT:
20250 			status = EACCES;
20251 			break;
20252 		case STATUS_CHECK:
20253 			/*
20254 			 * Check condition; look for ASC/ASCQ of 0x04/0x01
20255 			 * (LOGICAL UNIT IS IN PROCESS OF BECOMING READY)
20256 			 */
20257 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20258 			    (scsi_sense_asc((uint8_t *)&sense_buf) == 0x04) &&
20259 			    (scsi_sense_ascq((uint8_t *)&sense_buf) == 0x01)) {
20260 				kmem_free(capacity_buf, SD_CAPACITY_SIZE);
20261 				return (EAGAIN);
20262 			}
20263 			break;
20264 		default:
20265 			break;
20266 		}
20267 		/* FALLTHRU */
20268 	default:
20269 		kmem_free(capacity_buf, SD_CAPACITY_SIZE);
20270 		return (status);
20271 	}
20272 
20273 	/*
20274 	 * Some ATAPI CD-ROM drives report inaccurate LBA size values
20275 	 * (2352 and 0 are common) so for these devices always force the value
20276 	 * to 2048 as required by the ATAPI specs.
20277 	 */
20278 	if ((un->un_f_cfg_is_atapi == TRUE) && (ISCD(un))) {
20279 		lbasize = 2048;
20280 	}
20281 
20282 	/*
20283 	 * Get the maximum LBA value from the READ CAPACITY data.
20284 	 * Here we assume that the Partial Medium Indicator (PMI) bit
20285 	 * was cleared when issuing the command. This means that the LBA
20286 	 * returned from the device is the LBA of the last logical block
20287 	 * on the logical unit.  The actual logical block count will be
20288 	 * this value plus one.
20289 	 */
20290 	capacity += 1;
20291 
20292 	/*
20293 	 * Currently, for removable media, the capacity is saved in terms
20294 	 * of un->un_sys_blocksize, so scale the capacity value to reflect this.
20295 	 */
20296 	if (un->un_f_has_removable_media)
20297 		capacity *= (lbasize / un->un_sys_blocksize);
20298 
20299 rc16_done:
20300 
20301 	/*
20302 	 * Copy the values from the READ CAPACITY command into the space
20303 	 * provided by the caller.
20304 	 */
20305 	*capp = capacity;
20306 	*lbap = lbasize;
20307 
20308 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_READ_CAPACITY: "
20309 	    "capacity:0x%llx  lbasize:0x%x\n", capacity, lbasize);
20310 
20311 	/*
20312 	 * Both the lbasize and capacity from the device must be nonzero,
20313 	 * otherwise we assume that the values are not valid and return
20314 	 * failure to the caller. (4203735)
20315 	 */
20316 	if ((capacity == 0) || (lbasize == 0)) {
20317 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
20318 		    "sd_send_scsi_READ_CAPACITY received invalid value "
20319 		    "capacity %llu lbasize %d", capacity, lbasize);
20320 		return (EIO);
20321 	}
20322 	sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20323 	return (0);
20324 }
20325 
20326 /*
20327  *    Function: sd_send_scsi_READ_CAPACITY_16
20328  *
20329  * Description: This routine uses the scsi READ CAPACITY 16 command to
20330  *		determine the device capacity in number of blocks and the
20331  *		device native block size.  If this function returns a failure,
20332  *		then the values in *capp and *lbap are undefined.
20333  *		This routine should be called by sd_send_scsi_READ_CAPACITY
20334  *              which will apply any device specific adjustments to capacity
20335  *              and lbasize. One exception is it is also called by
20336  *              sd_get_media_info_ext. In that function, there is no need to
20337  *              adjust the capacity and lbasize.
20338  *
20339  *   Arguments: ssc   - ssc contains ptr to soft state struct for the target
20340  *		capp - ptr to unsigned 64-bit variable to receive the
20341  *			capacity value from the command.
20342  *		lbap - ptr to unsigned 32-bit varaible to receive the
20343  *			block size value from the command
20344  *              psp  - ptr to unsigned 32-bit variable to receive the
20345  *                      physical block size value from the command
20346  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
20347  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
20348  *			to use the USCSI "direct" chain and bypass the normal
20349  *			command waitq. SD_PATH_DIRECT_PRIORITY is used when
20350  *			this command is issued as part of an error recovery
20351  *			action.
20352  *
20353  * Return Code: 0   - Success
20354  *		EIO - IO error
20355  *		EACCES - Reservation conflict detected
20356  *		EAGAIN - Device is becoming ready
20357  *		errno return code from sd_ssc_send()
20358  *
20359  *     Context: Can sleep.  Blocks until command completes.
20360  */
20361 
20362 #define	SD_CAPACITY_16_SIZE	sizeof (struct scsi_capacity_16)
20363 
20364 static int
20365 sd_send_scsi_READ_CAPACITY_16(sd_ssc_t *ssc, uint64_t *capp, uint32_t *lbap,
20366     uint32_t *psp, int path_flag)
20367 {
20368 	struct	scsi_extended_sense	sense_buf;
20369 	struct	uscsi_cmd	ucmd_buf;
20370 	union	scsi_cdb	cdb;
20371 	uint64_t		*capacity16_buf;
20372 	uint64_t		capacity;
20373 	uint32_t		lbasize;
20374 	uint32_t		pbsize;
20375 	uint32_t		lbpb_exp;
20376 	int			status;
20377 	struct sd_lun		*un;
20378 
20379 	ASSERT(ssc != NULL);
20380 
20381 	un = ssc->ssc_un;
20382 	ASSERT(un != NULL);
20383 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20384 	ASSERT(capp != NULL);
20385 	ASSERT(lbap != NULL);
20386 
20387 	SD_TRACE(SD_LOG_IO, un,
20388 	    "sd_send_scsi_READ_CAPACITY: entry: un:0x%p\n", un);
20389 
20390 	/*
20391 	 * First send a READ_CAPACITY_16 command to the target.
20392 	 *
20393 	 * Set up the CDB for the READ_CAPACITY_16 command.  The Partial
20394 	 * Medium Indicator bit is cleared.  The address field must be
20395 	 * zero if the PMI bit is zero.
20396 	 */
20397 	bzero(&cdb, sizeof (cdb));
20398 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20399 
20400 	capacity16_buf = kmem_zalloc(SD_CAPACITY_16_SIZE, KM_SLEEP);
20401 
20402 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20403 	ucmd_buf.uscsi_cdblen	= CDB_GROUP4;
20404 	ucmd_buf.uscsi_bufaddr	= (caddr_t)capacity16_buf;
20405 	ucmd_buf.uscsi_buflen	= SD_CAPACITY_16_SIZE;
20406 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20407 	ucmd_buf.uscsi_rqlen	= sizeof (sense_buf);
20408 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
20409 	ucmd_buf.uscsi_timeout	= 60;
20410 
20411 	/*
20412 	 * Read Capacity (16) is a Service Action In command.  One
20413 	 * command byte (0x9E) is overloaded for multiple operations,
20414 	 * with the second CDB byte specifying the desired operation
20415 	 */
20416 	cdb.scc_cmd = SCMD_SVC_ACTION_IN_G4;
20417 	cdb.cdb_opaque[1] = SSVC_ACTION_READ_CAPACITY_G4;
20418 
20419 	/*
20420 	 * Fill in allocation length field
20421 	 */
20422 	FORMG4COUNT(&cdb, ucmd_buf.uscsi_buflen);
20423 
20424 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20425 	    UIO_SYSSPACE, path_flag);
20426 
20427 	switch (status) {
20428 	case 0:
20429 		/* Return failure if we did not get valid capacity data. */
20430 		if (ucmd_buf.uscsi_resid > 20) {
20431 			sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
20432 			    "sd_send_scsi_READ_CAPACITY_16 received invalid "
20433 			    "capacity data");
20434 			kmem_free(capacity16_buf, SD_CAPACITY_16_SIZE);
20435 			return (EIO);
20436 		}
20437 
20438 		/*
20439 		 * Read capacity and block size from the READ CAPACITY 16 data.
20440 		 * This data may be adjusted later due to device specific
20441 		 * issues.
20442 		 *
20443 		 * According to the SCSI spec, the READ CAPACITY 16
20444 		 * command returns the following:
20445 		 *
20446 		 *  bytes 0-7: Maximum logical block address available.
20447 		 *		(MSB in byte:0 & LSB in byte:7)
20448 		 *
20449 		 *  bytes 8-11: Block length in bytes
20450 		 *		(MSB in byte:8 & LSB in byte:11)
20451 		 *
20452 		 *  byte 13: LOGICAL BLOCKS PER PHYSICAL BLOCK EXPONENT
20453 		 *
20454 		 *  byte 14:
20455 		 *	bit 7: Thin-Provisioning Enabled
20456 		 *	bit 6: Thin-Provisioning Read Zeros
20457 		 */
20458 		capacity = BE_64(capacity16_buf[0]);
20459 		lbasize = BE_32(*(uint32_t *)&capacity16_buf[1]);
20460 		lbpb_exp = (BE_64(capacity16_buf[1]) >> 16) & 0x0f;
20461 
20462 		un->un_thin_flags = 0;
20463 		if (((uint8_t *)capacity16_buf)[14] & (1 << 7))
20464 			un->un_thin_flags |= SD_THIN_PROV_ENABLED;
20465 		if (((uint8_t *)capacity16_buf)[14] & (1 << 6))
20466 			un->un_thin_flags |= SD_THIN_PROV_READ_ZEROS;
20467 
20468 		pbsize = lbasize << lbpb_exp;
20469 
20470 		/*
20471 		 * Done with capacity16_buf
20472 		 */
20473 		kmem_free(capacity16_buf, SD_CAPACITY_16_SIZE);
20474 
20475 		/*
20476 		 * if the reported capacity is set to all 0xf's, then
20477 		 * this disk is too large.  This could only happen with
20478 		 * a device that supports LBAs larger than 64 bits which
20479 		 * are not defined by any current T10 standards.
20480 		 */
20481 		if (capacity == 0xffffffffffffffff) {
20482 			sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
20483 			    "disk is too large");
20484 			return (EIO);
20485 		}
20486 		break;	/* Success! */
20487 	case EIO:
20488 		switch (ucmd_buf.uscsi_status) {
20489 		case STATUS_RESERVATION_CONFLICT:
20490 			status = EACCES;
20491 			break;
20492 		case STATUS_CHECK:
20493 			/*
20494 			 * Check condition; look for ASC/ASCQ of 0x04/0x01
20495 			 * (LOGICAL UNIT IS IN PROCESS OF BECOMING READY)
20496 			 */
20497 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20498 			    (scsi_sense_asc((uint8_t *)&sense_buf) == 0x04) &&
20499 			    (scsi_sense_ascq((uint8_t *)&sense_buf) == 0x01)) {
20500 				kmem_free(capacity16_buf, SD_CAPACITY_16_SIZE);
20501 				return (EAGAIN);
20502 			}
20503 			break;
20504 		default:
20505 			break;
20506 		}
20507 		/* FALLTHRU */
20508 	default:
20509 		kmem_free(capacity16_buf, SD_CAPACITY_16_SIZE);
20510 		return (status);
20511 	}
20512 
20513 	/*
20514 	 * Some ATAPI CD-ROM drives report inaccurate LBA size values
20515 	 * (2352 and 0 are common) so for these devices always force the value
20516 	 * to 2048 as required by the ATAPI specs.
20517 	 */
20518 	if ((un->un_f_cfg_is_atapi == TRUE) && (ISCD(un))) {
20519 		lbasize = 2048;
20520 	}
20521 
20522 	/*
20523 	 * Get the maximum LBA value from the READ CAPACITY 16 data.
20524 	 * Here we assume that the Partial Medium Indicator (PMI) bit
20525 	 * was cleared when issuing the command. This means that the LBA
20526 	 * returned from the device is the LBA of the last logical block
20527 	 * on the logical unit.  The actual logical block count will be
20528 	 * this value plus one.
20529 	 */
20530 	capacity += 1;
20531 
20532 	/*
20533 	 * Currently, for removable media, the capacity is saved in terms
20534 	 * of un->un_sys_blocksize, so scale the capacity value to reflect this.
20535 	 */
20536 	if (un->un_f_has_removable_media)
20537 		capacity *= (lbasize / un->un_sys_blocksize);
20538 
20539 	*capp = capacity;
20540 	*lbap = lbasize;
20541 	*psp = pbsize;
20542 
20543 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_READ_CAPACITY_16: "
20544 	    "capacity:0x%llx  lbasize:0x%x, pbsize: 0x%x\n",
20545 	    capacity, lbasize, pbsize);
20546 
20547 	if ((capacity == 0) || (lbasize == 0) || (pbsize == 0)) {
20548 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
20549 		    "sd_send_scsi_READ_CAPACITY_16 received invalid value "
20550 		    "capacity %llu lbasize %d pbsize %d", capacity, lbasize);
20551 		return (EIO);
20552 	}
20553 
20554 	sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20555 	return (0);
20556 }
20557 
20558 
20559 /*
20560  *    Function: sd_send_scsi_START_STOP_UNIT
20561  *
20562  * Description: Issue a scsi START STOP UNIT command to the target.
20563  *
20564  *   Arguments: ssc    - ssc contatins pointer to driver soft state (unit)
20565  *                       structure for this target.
20566  *      pc_flag - SD_POWER_CONDITION
20567  *                SD_START_STOP
20568  *		flag  - SD_TARGET_START
20569  *			SD_TARGET_STOP
20570  *			SD_TARGET_EJECT
20571  *			SD_TARGET_CLOSE
20572  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
20573  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
20574  *			to use the USCSI "direct" chain and bypass the normal
20575  *			command waitq. SD_PATH_DIRECT_PRIORITY is used when this
20576  *			command is issued as part of an error recovery action.
20577  *
20578  * Return Code: 0   - Success
20579  *		EIO - IO error
20580  *		EACCES - Reservation conflict detected
20581  *		ENXIO  - Not Ready, medium not present
20582  *		errno return code from sd_ssc_send()
20583  *
20584  *     Context: Can sleep.
20585  */
20586 
20587 static int
20588 sd_send_scsi_START_STOP_UNIT(sd_ssc_t *ssc, int pc_flag, int flag,
20589     int path_flag)
20590 {
20591 	struct	scsi_extended_sense	sense_buf;
20592 	union scsi_cdb		cdb;
20593 	struct uscsi_cmd	ucmd_buf;
20594 	int			status;
20595 	struct sd_lun		*un;
20596 
20597 	ASSERT(ssc != NULL);
20598 	un = ssc->ssc_un;
20599 	ASSERT(un != NULL);
20600 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20601 
20602 	SD_TRACE(SD_LOG_IO, un,
20603 	    "sd_send_scsi_START_STOP_UNIT: entry: un:0x%p\n", un);
20604 
20605 	if (un->un_f_check_start_stop &&
20606 	    (pc_flag == SD_START_STOP) &&
20607 	    ((flag == SD_TARGET_START) || (flag == SD_TARGET_STOP)) &&
20608 	    (un->un_f_start_stop_supported != TRUE)) {
20609 		return (0);
20610 	}
20611 
20612 	/*
20613 	 * If we are performing an eject operation and
20614 	 * we receive any command other than SD_TARGET_EJECT
20615 	 * we should immediately return.
20616 	 */
20617 	if (flag != SD_TARGET_EJECT) {
20618 		mutex_enter(SD_MUTEX(un));
20619 		if (un->un_f_ejecting == TRUE) {
20620 			mutex_exit(SD_MUTEX(un));
20621 			return (EAGAIN);
20622 		}
20623 		mutex_exit(SD_MUTEX(un));
20624 	}
20625 
20626 	bzero(&cdb, sizeof (cdb));
20627 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20628 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
20629 
20630 	cdb.scc_cmd = SCMD_START_STOP;
20631 	cdb.cdb_opaque[4] = (pc_flag == SD_POWER_CONDITION) ?
20632 	    (uchar_t)(flag << 4) : (uchar_t)flag;
20633 
20634 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20635 	ucmd_buf.uscsi_cdblen	= CDB_GROUP0;
20636 	ucmd_buf.uscsi_bufaddr	= NULL;
20637 	ucmd_buf.uscsi_buflen	= 0;
20638 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20639 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
20640 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_SILENT;
20641 	ucmd_buf.uscsi_timeout	= 200;
20642 
20643 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20644 	    UIO_SYSSPACE, path_flag);
20645 
20646 	switch (status) {
20647 	case 0:
20648 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20649 		break;	/* Success! */
20650 	case EIO:
20651 		switch (ucmd_buf.uscsi_status) {
20652 		case STATUS_RESERVATION_CONFLICT:
20653 			status = EACCES;
20654 			break;
20655 		case STATUS_CHECK:
20656 			if (ucmd_buf.uscsi_rqstatus == STATUS_GOOD) {
20657 				switch (scsi_sense_key(
20658 				    (uint8_t *)&sense_buf)) {
20659 				case KEY_ILLEGAL_REQUEST:
20660 					status = ENOTSUP;
20661 					break;
20662 				case KEY_NOT_READY:
20663 					if (scsi_sense_asc(
20664 					    (uint8_t *)&sense_buf)
20665 					    == 0x3A) {
20666 						status = ENXIO;
20667 					}
20668 					break;
20669 				default:
20670 					break;
20671 				}
20672 			}
20673 			break;
20674 		default:
20675 			break;
20676 		}
20677 		break;
20678 	default:
20679 		break;
20680 	}
20681 
20682 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_START_STOP_UNIT: exit\n");
20683 
20684 	return (status);
20685 }
20686 
20687 
20688 /*
20689  *    Function: sd_start_stop_unit_callback
20690  *
20691  * Description: timeout(9F) callback to begin recovery process for a
20692  *		device that has spun down.
20693  *
20694  *   Arguments: arg - pointer to associated softstate struct.
20695  *
20696  *     Context: Executes in a timeout(9F) thread context
20697  */
20698 
20699 static void
20700 sd_start_stop_unit_callback(void *arg)
20701 {
20702 	struct sd_lun	*un = arg;
20703 	ASSERT(un != NULL);
20704 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20705 
20706 	SD_TRACE(SD_LOG_IO, un, "sd_start_stop_unit_callback: entry\n");
20707 
20708 	(void) taskq_dispatch(sd_tq, sd_start_stop_unit_task, un, KM_NOSLEEP);
20709 }
20710 
20711 
20712 /*
20713  *    Function: sd_start_stop_unit_task
20714  *
20715  * Description: Recovery procedure when a drive is spun down.
20716  *
20717  *   Arguments: arg - pointer to associated softstate struct.
20718  *
20719  *     Context: Executes in a taskq() thread context
20720  */
20721 
20722 static void
20723 sd_start_stop_unit_task(void *arg)
20724 {
20725 	struct sd_lun	*un = arg;
20726 	sd_ssc_t	*ssc;
20727 	int		power_level;
20728 	int		rval;
20729 
20730 	ASSERT(un != NULL);
20731 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20732 
20733 	SD_TRACE(SD_LOG_IO, un, "sd_start_stop_unit_task: entry\n");
20734 
20735 	/*
20736 	 * Some unformatted drives report not ready error, no need to
20737 	 * restart if format has been initiated.
20738 	 */
20739 	mutex_enter(SD_MUTEX(un));
20740 	if (un->un_f_format_in_progress == TRUE) {
20741 		mutex_exit(SD_MUTEX(un));
20742 		return;
20743 	}
20744 	mutex_exit(SD_MUTEX(un));
20745 
20746 	ssc = sd_ssc_init(un);
20747 	/*
20748 	 * When a START STOP command is issued from here, it is part of a
20749 	 * failure recovery operation and must be issued before any other
20750 	 * commands, including any pending retries. Thus it must be sent
20751 	 * using SD_PATH_DIRECT_PRIORITY. It doesn't matter if the spin up
20752 	 * succeeds or not, we will start I/O after the attempt.
20753 	 * If power condition is supported and the current power level
20754 	 * is capable of performing I/O, we should set the power condition
20755 	 * to that level. Otherwise, set the power condition to ACTIVE.
20756 	 */
20757 	if (un->un_f_power_condition_supported) {
20758 		mutex_enter(SD_MUTEX(un));
20759 		ASSERT(SD_PM_IS_LEVEL_VALID(un, un->un_power_level));
20760 		power_level = sd_pwr_pc.ran_perf[un->un_power_level]
20761 		    > 0 ? un->un_power_level : SD_SPINDLE_ACTIVE;
20762 		mutex_exit(SD_MUTEX(un));
20763 		rval = sd_send_scsi_START_STOP_UNIT(ssc, SD_POWER_CONDITION,
20764 		    sd_pl2pc[power_level], SD_PATH_DIRECT_PRIORITY);
20765 	} else {
20766 		rval = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
20767 		    SD_TARGET_START, SD_PATH_DIRECT_PRIORITY);
20768 	}
20769 
20770 	if (rval != 0)
20771 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
20772 	sd_ssc_fini(ssc);
20773 	/*
20774 	 * The above call blocks until the START_STOP_UNIT command completes.
20775 	 * Now that it has completed, we must re-try the original IO that
20776 	 * received the NOT READY condition in the first place. There are
20777 	 * three possible conditions here:
20778 	 *
20779 	 *  (1) The original IO is on un_retry_bp.
20780 	 *  (2) The original IO is on the regular wait queue, and un_retry_bp
20781 	 *	is NULL.
20782 	 *  (3) The original IO is on the regular wait queue, and un_retry_bp
20783 	 *	points to some other, unrelated bp.
20784 	 *
20785 	 * For each case, we must call sd_start_cmds() with un_retry_bp
20786 	 * as the argument. If un_retry_bp is NULL, this will initiate
20787 	 * processing of the regular wait queue.  If un_retry_bp is not NULL,
20788 	 * then this will process the bp on un_retry_bp. That may or may not
20789 	 * be the original IO, but that does not matter: the important thing
20790 	 * is to keep the IO processing going at this point.
20791 	 *
20792 	 * Note: This is a very specific error recovery sequence associated
20793 	 * with a drive that is not spun up. We attempt a START_STOP_UNIT and
20794 	 * serialize the I/O with completion of the spin-up.
20795 	 */
20796 	mutex_enter(SD_MUTEX(un));
20797 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
20798 	    "sd_start_stop_unit_task: un:0x%p starting bp:0x%p\n",
20799 	    un, un->un_retry_bp);
20800 	un->un_startstop_timeid = NULL;	/* Timeout is no longer pending */
20801 	sd_start_cmds(un, un->un_retry_bp);
20802 	mutex_exit(SD_MUTEX(un));
20803 
20804 	SD_TRACE(SD_LOG_IO, un, "sd_start_stop_unit_task: exit\n");
20805 }
20806 
20807 
20808 /*
20809  *    Function: sd_send_scsi_INQUIRY
20810  *
20811  * Description: Issue the scsi INQUIRY command.
20812  *
20813  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
20814  *                      structure for this target.
20815  *		bufaddr
20816  *		buflen
20817  *		evpd
20818  *		page_code
20819  *		page_length
20820  *
20821  * Return Code: 0   - Success
20822  *		errno return code from sd_ssc_send()
20823  *
20824  *     Context: Can sleep. Does not return until command is completed.
20825  */
20826 
20827 static int
20828 sd_send_scsi_INQUIRY(sd_ssc_t *ssc, uchar_t *bufaddr, size_t buflen,
20829     uchar_t evpd, uchar_t page_code, size_t *residp)
20830 {
20831 	union scsi_cdb		cdb;
20832 	struct uscsi_cmd	ucmd_buf;
20833 	int			status;
20834 	struct sd_lun		*un;
20835 
20836 	ASSERT(ssc != NULL);
20837 	un = ssc->ssc_un;
20838 	ASSERT(un != NULL);
20839 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20840 	ASSERT(bufaddr != NULL);
20841 
20842 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_INQUIRY: entry: un:0x%p\n", un);
20843 
20844 	bzero(&cdb, sizeof (cdb));
20845 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20846 	bzero(bufaddr, buflen);
20847 
20848 	cdb.scc_cmd = SCMD_INQUIRY;
20849 	cdb.cdb_opaque[1] = evpd;
20850 	cdb.cdb_opaque[2] = page_code;
20851 	FORMG0COUNT(&cdb, buflen);
20852 
20853 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20854 	ucmd_buf.uscsi_cdblen	= CDB_GROUP0;
20855 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
20856 	ucmd_buf.uscsi_buflen	= buflen;
20857 	ucmd_buf.uscsi_rqbuf	= NULL;
20858 	ucmd_buf.uscsi_rqlen	= 0;
20859 	ucmd_buf.uscsi_flags	= USCSI_READ | USCSI_SILENT;
20860 	ucmd_buf.uscsi_timeout	= 200;	/* Excessive legacy value */
20861 
20862 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20863 	    UIO_SYSSPACE, SD_PATH_DIRECT);
20864 
20865 	/*
20866 	 * Only handle status == 0, the upper-level caller
20867 	 * will put different assessment based on the context.
20868 	 */
20869 	if (status == 0)
20870 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20871 
20872 	if ((status == 0) && (residp != NULL)) {
20873 		*residp = ucmd_buf.uscsi_resid;
20874 	}
20875 
20876 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_INQUIRY: exit\n");
20877 
20878 	return (status);
20879 }
20880 
20881 
20882 /*
20883  *    Function: sd_send_scsi_TEST_UNIT_READY
20884  *
20885  * Description: Issue the scsi TEST UNIT READY command.
20886  *		This routine can be told to set the flag USCSI_DIAGNOSE to
20887  *		prevent retrying failed commands. Use this when the intent
20888  *		is either to check for device readiness, to clear a Unit
20889  *		Attention, or to clear any outstanding sense data.
20890  *		However under specific conditions the expected behavior
20891  *		is for retries to bring a device ready, so use the flag
20892  *		with caution.
20893  *
20894  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
20895  *                      structure for this target.
20896  *		flag:   SD_CHECK_FOR_MEDIA: return ENXIO if no media present
20897  *			SD_DONT_RETRY_TUR: include uscsi flag USCSI_DIAGNOSE.
20898  *			0: dont check for media present, do retries on cmd.
20899  *
20900  * Return Code: 0   - Success
20901  *		EIO - IO error
20902  *		EACCES - Reservation conflict detected
20903  *		ENXIO  - Not Ready, medium not present
20904  *		errno return code from sd_ssc_send()
20905  *
20906  *     Context: Can sleep. Does not return until command is completed.
20907  */
20908 
20909 static int
20910 sd_send_scsi_TEST_UNIT_READY(sd_ssc_t *ssc, int flag)
20911 {
20912 	struct	scsi_extended_sense	sense_buf;
20913 	union scsi_cdb		cdb;
20914 	struct uscsi_cmd	ucmd_buf;
20915 	int			status;
20916 	struct sd_lun		*un;
20917 
20918 	ASSERT(ssc != NULL);
20919 	un = ssc->ssc_un;
20920 	ASSERT(un != NULL);
20921 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20922 
20923 	SD_TRACE(SD_LOG_IO, un,
20924 	    "sd_send_scsi_TEST_UNIT_READY: entry: un:0x%p\n", un);
20925 
20926 	/*
20927 	 * Some Seagate elite1 TQ devices get hung with disconnect/reconnect
20928 	 * timeouts when they receive a TUR and the queue is not empty. Check
20929 	 * the configuration flag set during attach (indicating the drive has
20930 	 * this firmware bug) and un_ncmds_in_transport before issuing the
20931 	 * TUR. If there are
20932 	 * pending commands return success, this is a bit arbitrary but is ok
20933 	 * for non-removables (i.e. the eliteI disks) and non-clustering
20934 	 * configurations.
20935 	 */
20936 	if (un->un_f_cfg_tur_check == TRUE) {
20937 		mutex_enter(SD_MUTEX(un));
20938 		if (un->un_ncmds_in_transport != 0) {
20939 			mutex_exit(SD_MUTEX(un));
20940 			return (0);
20941 		}
20942 		mutex_exit(SD_MUTEX(un));
20943 	}
20944 
20945 	bzero(&cdb, sizeof (cdb));
20946 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20947 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
20948 
20949 	cdb.scc_cmd = SCMD_TEST_UNIT_READY;
20950 
20951 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20952 	ucmd_buf.uscsi_cdblen	= CDB_GROUP0;
20953 	ucmd_buf.uscsi_bufaddr	= NULL;
20954 	ucmd_buf.uscsi_buflen	= 0;
20955 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20956 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
20957 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_SILENT;
20958 
20959 	/* Use flag USCSI_DIAGNOSE to prevent retries if it fails. */
20960 	if ((flag & SD_DONT_RETRY_TUR) != 0) {
20961 		ucmd_buf.uscsi_flags |= USCSI_DIAGNOSE;
20962 	}
20963 	ucmd_buf.uscsi_timeout	= 60;
20964 
20965 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20966 	    UIO_SYSSPACE, ((flag & SD_BYPASS_PM) ? SD_PATH_DIRECT :
20967 	    SD_PATH_STANDARD));
20968 
20969 	switch (status) {
20970 	case 0:
20971 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20972 		break;	/* Success! */
20973 	case EIO:
20974 		switch (ucmd_buf.uscsi_status) {
20975 		case STATUS_RESERVATION_CONFLICT:
20976 			status = EACCES;
20977 			break;
20978 		case STATUS_CHECK:
20979 			if ((flag & SD_CHECK_FOR_MEDIA) == 0) {
20980 				break;
20981 			}
20982 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20983 			    (scsi_sense_key((uint8_t *)&sense_buf) ==
20984 			    KEY_NOT_READY) &&
20985 			    (scsi_sense_asc((uint8_t *)&sense_buf) == 0x3A)) {
20986 				status = ENXIO;
20987 			}
20988 			break;
20989 		default:
20990 			break;
20991 		}
20992 		break;
20993 	default:
20994 		break;
20995 	}
20996 
20997 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_TEST_UNIT_READY: exit\n");
20998 
20999 	return (status);
21000 }
21001 
21002 /*
21003  *    Function: sd_send_scsi_PERSISTENT_RESERVE_IN
21004  *
21005  * Description: Issue the scsi PERSISTENT RESERVE IN command.
21006  *
21007  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
21008  *                      structure for this target.
21009  *
21010  * Return Code: 0   - Success
21011  *		EACCES
21012  *		ENOTSUP
21013  *		errno return code from sd_ssc_send()
21014  *
21015  *     Context: Can sleep. Does not return until command is completed.
21016  */
21017 
21018 static int
21019 sd_send_scsi_PERSISTENT_RESERVE_IN(sd_ssc_t *ssc, uchar_t usr_cmd,
21020     uint16_t data_len, uchar_t *data_bufp)
21021 {
21022 	struct scsi_extended_sense	sense_buf;
21023 	union scsi_cdb		cdb;
21024 	struct uscsi_cmd	ucmd_buf;
21025 	int			status;
21026 	int			no_caller_buf = FALSE;
21027 	struct sd_lun		*un;
21028 
21029 	ASSERT(ssc != NULL);
21030 	un = ssc->ssc_un;
21031 	ASSERT(un != NULL);
21032 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21033 	ASSERT((usr_cmd == SD_READ_KEYS) || (usr_cmd == SD_READ_RESV));
21034 
21035 	SD_TRACE(SD_LOG_IO, un,
21036 	    "sd_send_scsi_PERSISTENT_RESERVE_IN: entry: un:0x%p\n", un);
21037 
21038 	bzero(&cdb, sizeof (cdb));
21039 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21040 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
21041 	if (data_bufp == NULL) {
21042 		/* Allocate a default buf if the caller did not give one */
21043 		ASSERT(data_len == 0);
21044 		data_len  = MHIOC_RESV_KEY_SIZE;
21045 		data_bufp = kmem_zalloc(MHIOC_RESV_KEY_SIZE, KM_SLEEP);
21046 		no_caller_buf = TRUE;
21047 	}
21048 
21049 	cdb.scc_cmd = SCMD_PERSISTENT_RESERVE_IN;
21050 	cdb.cdb_opaque[1] = usr_cmd;
21051 	FORMG1COUNT(&cdb, data_len);
21052 
21053 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
21054 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
21055 	ucmd_buf.uscsi_bufaddr	= (caddr_t)data_bufp;
21056 	ucmd_buf.uscsi_buflen	= data_len;
21057 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
21058 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
21059 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
21060 	ucmd_buf.uscsi_timeout	= 60;
21061 
21062 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
21063 	    UIO_SYSSPACE, SD_PATH_STANDARD);
21064 
21065 	switch (status) {
21066 	case 0:
21067 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21068 
21069 		break;	/* Success! */
21070 	case EIO:
21071 		switch (ucmd_buf.uscsi_status) {
21072 		case STATUS_RESERVATION_CONFLICT:
21073 			status = EACCES;
21074 			break;
21075 		case STATUS_CHECK:
21076 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
21077 			    (scsi_sense_key((uint8_t *)&sense_buf) ==
21078 			    KEY_ILLEGAL_REQUEST)) {
21079 				status = ENOTSUP;
21080 			}
21081 			break;
21082 		default:
21083 			break;
21084 		}
21085 		break;
21086 	default:
21087 		break;
21088 	}
21089 
21090 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_PERSISTENT_RESERVE_IN: exit\n");
21091 
21092 	if (no_caller_buf == TRUE) {
21093 		kmem_free(data_bufp, data_len);
21094 	}
21095 
21096 	return (status);
21097 }
21098 
21099 
21100 /*
21101  *    Function: sd_send_scsi_PERSISTENT_RESERVE_OUT
21102  *
21103  * Description: This routine is the driver entry point for handling CD-ROM
21104  *		multi-host persistent reservation requests (MHIOCGRP_INKEYS,
21105  *		MHIOCGRP_INRESV) by sending the SCSI-3 PROUT commands to the
21106  *		device.
21107  *
21108  *   Arguments: ssc  -  ssc contains un - pointer to soft state struct
21109  *                      for the target.
21110  *		usr_cmd SCSI-3 reservation facility command (one of
21111  *			SD_SCSI3_REGISTER, SD_SCSI3_RESERVE, SD_SCSI3_RELEASE,
21112  *			SD_SCSI3_PREEMPTANDABORT, SD_SCSI3_CLEAR)
21113  *		usr_bufp - user provided pointer register, reserve descriptor or
21114  *			preempt and abort structure (mhioc_register_t,
21115  *                      mhioc_resv_desc_t, mhioc_preemptandabort_t)
21116  *
21117  * Return Code: 0   - Success
21118  *		EACCES
21119  *		ENOTSUP
21120  *		errno return code from sd_ssc_send()
21121  *
21122  *     Context: Can sleep. Does not return until command is completed.
21123  */
21124 
21125 static int
21126 sd_send_scsi_PERSISTENT_RESERVE_OUT(sd_ssc_t *ssc, uchar_t usr_cmd,
21127     uchar_t *usr_bufp)
21128 {
21129 	struct scsi_extended_sense	sense_buf;
21130 	union scsi_cdb		cdb;
21131 	struct uscsi_cmd	ucmd_buf;
21132 	int			status;
21133 	uchar_t			data_len = sizeof (sd_prout_t);
21134 	sd_prout_t		*prp;
21135 	struct sd_lun		*un;
21136 
21137 	ASSERT(ssc != NULL);
21138 	un = ssc->ssc_un;
21139 	ASSERT(un != NULL);
21140 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21141 	ASSERT(data_len == 24);	/* required by scsi spec */
21142 
21143 	SD_TRACE(SD_LOG_IO, un,
21144 	    "sd_send_scsi_PERSISTENT_RESERVE_OUT: entry: un:0x%p\n", un);
21145 
21146 	if (usr_bufp == NULL) {
21147 		return (EINVAL);
21148 	}
21149 
21150 	bzero(&cdb, sizeof (cdb));
21151 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21152 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
21153 	prp = kmem_zalloc(data_len, KM_SLEEP);
21154 
21155 	cdb.scc_cmd = SCMD_PERSISTENT_RESERVE_OUT;
21156 	cdb.cdb_opaque[1] = usr_cmd;
21157 	FORMG1COUNT(&cdb, data_len);
21158 
21159 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
21160 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
21161 	ucmd_buf.uscsi_bufaddr	= (caddr_t)prp;
21162 	ucmd_buf.uscsi_buflen	= data_len;
21163 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
21164 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
21165 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_WRITE | USCSI_SILENT;
21166 	ucmd_buf.uscsi_timeout	= 60;
21167 
21168 	switch (usr_cmd) {
21169 	case SD_SCSI3_REGISTER: {
21170 		mhioc_register_t *ptr = (mhioc_register_t *)usr_bufp;
21171 
21172 		bcopy(ptr->oldkey.key, prp->res_key, MHIOC_RESV_KEY_SIZE);
21173 		bcopy(ptr->newkey.key, prp->service_key,
21174 		    MHIOC_RESV_KEY_SIZE);
21175 		prp->aptpl = ptr->aptpl;
21176 		break;
21177 	}
21178 	case SD_SCSI3_CLEAR: {
21179 		mhioc_resv_desc_t *ptr = (mhioc_resv_desc_t *)usr_bufp;
21180 
21181 		bcopy(ptr->key.key, prp->res_key, MHIOC_RESV_KEY_SIZE);
21182 		break;
21183 	}
21184 	case SD_SCSI3_RESERVE:
21185 	case SD_SCSI3_RELEASE: {
21186 		mhioc_resv_desc_t *ptr = (mhioc_resv_desc_t *)usr_bufp;
21187 
21188 		bcopy(ptr->key.key, prp->res_key, MHIOC_RESV_KEY_SIZE);
21189 		prp->scope_address = BE_32(ptr->scope_specific_addr);
21190 		cdb.cdb_opaque[2] = ptr->type;
21191 		break;
21192 	}
21193 	case SD_SCSI3_PREEMPTANDABORT: {
21194 		mhioc_preemptandabort_t *ptr =
21195 		    (mhioc_preemptandabort_t *)usr_bufp;
21196 
21197 		bcopy(ptr->resvdesc.key.key, prp->res_key, MHIOC_RESV_KEY_SIZE);
21198 		bcopy(ptr->victim_key.key, prp->service_key,
21199 		    MHIOC_RESV_KEY_SIZE);
21200 		prp->scope_address = BE_32(ptr->resvdesc.scope_specific_addr);
21201 		cdb.cdb_opaque[2] = ptr->resvdesc.type;
21202 		ucmd_buf.uscsi_flags |= USCSI_HEAD;
21203 		break;
21204 	}
21205 	case SD_SCSI3_REGISTERANDIGNOREKEY:
21206 	{
21207 		mhioc_registerandignorekey_t *ptr;
21208 		ptr = (mhioc_registerandignorekey_t *)usr_bufp;
21209 		bcopy(ptr->newkey.key,
21210 		    prp->service_key, MHIOC_RESV_KEY_SIZE);
21211 		prp->aptpl = ptr->aptpl;
21212 		break;
21213 	}
21214 	default:
21215 		ASSERT(FALSE);
21216 		break;
21217 	}
21218 
21219 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
21220 	    UIO_SYSSPACE, SD_PATH_STANDARD);
21221 
21222 	switch (status) {
21223 	case 0:
21224 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21225 		break;	/* Success! */
21226 	case EIO:
21227 		switch (ucmd_buf.uscsi_status) {
21228 		case STATUS_RESERVATION_CONFLICT:
21229 			status = EACCES;
21230 			break;
21231 		case STATUS_CHECK:
21232 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
21233 			    (scsi_sense_key((uint8_t *)&sense_buf) ==
21234 			    KEY_ILLEGAL_REQUEST)) {
21235 				status = ENOTSUP;
21236 			}
21237 			break;
21238 		default:
21239 			break;
21240 		}
21241 		break;
21242 	default:
21243 		break;
21244 	}
21245 
21246 	kmem_free(prp, data_len);
21247 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_PERSISTENT_RESERVE_OUT: exit\n");
21248 	return (status);
21249 }
21250 
21251 
21252 /*
21253  *    Function: sd_send_scsi_SYNCHRONIZE_CACHE
21254  *
21255  * Description: Issues a scsi SYNCHRONIZE CACHE command to the target
21256  *
21257  *   Arguments: un - pointer to the target's soft state struct
21258  *              dkc - pointer to the callback structure
21259  *
21260  * Return Code: 0 - success
21261  *		errno-type error code
21262  *
21263  *     Context: kernel thread context only.
21264  *
21265  *  _______________________________________________________________
21266  * | dkc_flag &   | dkc_callback | DKIOCFLUSHWRITECACHE            |
21267  * |FLUSH_VOLATILE|              | operation                       |
21268  * |______________|______________|_________________________________|
21269  * | 0            | NULL         | Synchronous flush on both       |
21270  * |              |              | volatile and non-volatile cache |
21271  * |______________|______________|_________________________________|
21272  * | 1            | NULL         | Synchronous flush on volatile   |
21273  * |              |              | cache; disk drivers may suppress|
21274  * |              |              | flush if disk table indicates   |
21275  * |              |              | non-volatile cache              |
21276  * |______________|______________|_________________________________|
21277  * | 0            | !NULL        | Asynchronous flush on both      |
21278  * |              |              | volatile and non-volatile cache;|
21279  * |______________|______________|_________________________________|
21280  * | 1            | !NULL        | Asynchronous flush on volatile  |
21281  * |              |              | cache; disk drivers may suppress|
21282  * |              |              | flush if disk table indicates   |
21283  * |              |              | non-volatile cache              |
21284  * |______________|______________|_________________________________|
21285  *
21286  */
21287 
21288 static int
21289 sd_send_scsi_SYNCHRONIZE_CACHE(struct sd_lun *un, struct dk_callback *dkc)
21290 {
21291 	struct sd_uscsi_info	*uip;
21292 	struct uscsi_cmd	*uscmd;
21293 	union scsi_cdb		*cdb;
21294 	struct buf		*bp;
21295 	int			rval = 0;
21296 	int			is_async;
21297 
21298 	SD_TRACE(SD_LOG_IO, un,
21299 	    "sd_send_scsi_SYNCHRONIZE_CACHE: entry: un:0x%p\n", un);
21300 
21301 	ASSERT(un != NULL);
21302 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21303 
21304 	if (dkc == NULL || dkc->dkc_callback == NULL) {
21305 		is_async = FALSE;
21306 	} else {
21307 		is_async = TRUE;
21308 	}
21309 
21310 	mutex_enter(SD_MUTEX(un));
21311 	/* check whether cache flush should be suppressed */
21312 	if (un->un_f_suppress_cache_flush == TRUE) {
21313 		mutex_exit(SD_MUTEX(un));
21314 		/*
21315 		 * suppress the cache flush if the device is told to do
21316 		 * so by sd.conf or disk table
21317 		 */
21318 		SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_SYNCHRONIZE_CACHE: \
21319 		    skip the cache flush since suppress_cache_flush is %d!\n",
21320 		    un->un_f_suppress_cache_flush);
21321 
21322 		if (is_async == TRUE) {
21323 			/* invoke callback for asynchronous flush */
21324 			(*dkc->dkc_callback)(dkc->dkc_cookie, 0);
21325 		}
21326 		return (rval);
21327 	}
21328 	mutex_exit(SD_MUTEX(un));
21329 
21330 	/*
21331 	 * check dkc_flag & FLUSH_VOLATILE so SYNC_NV bit can be
21332 	 * set properly
21333 	 */
21334 	cdb = kmem_zalloc(CDB_GROUP1, KM_SLEEP);
21335 	cdb->scc_cmd = SCMD_SYNCHRONIZE_CACHE;
21336 
21337 	mutex_enter(SD_MUTEX(un));
21338 	if (dkc != NULL && un->un_f_sync_nv_supported &&
21339 	    (dkc->dkc_flag & FLUSH_VOLATILE)) {
21340 		/*
21341 		 * if the device supports SYNC_NV bit, turn on
21342 		 * the SYNC_NV bit to only flush volatile cache
21343 		 */
21344 		cdb->cdb_un.tag |= SD_SYNC_NV_BIT;
21345 	}
21346 	mutex_exit(SD_MUTEX(un));
21347 
21348 	/*
21349 	 * First get some memory for the uscsi_cmd struct and cdb
21350 	 * and initialize for SYNCHRONIZE_CACHE cmd.
21351 	 */
21352 	uscmd = kmem_zalloc(sizeof (struct uscsi_cmd), KM_SLEEP);
21353 	uscmd->uscsi_cdblen = CDB_GROUP1;
21354 	uscmd->uscsi_cdb = (caddr_t)cdb;
21355 	uscmd->uscsi_bufaddr = NULL;
21356 	uscmd->uscsi_buflen = 0;
21357 	uscmd->uscsi_rqbuf = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
21358 	uscmd->uscsi_rqlen = SENSE_LENGTH;
21359 	uscmd->uscsi_rqresid = SENSE_LENGTH;
21360 	uscmd->uscsi_flags = USCSI_RQENABLE | USCSI_SILENT;
21361 	uscmd->uscsi_timeout = sd_io_time;
21362 
21363 	/*
21364 	 * Allocate an sd_uscsi_info struct and fill it with the info
21365 	 * needed by sd_initpkt_for_uscsi().  Then put the pointer into
21366 	 * b_private in the buf for sd_initpkt_for_uscsi().  Note that
21367 	 * since we allocate the buf here in this function, we do not
21368 	 * need to preserve the prior contents of b_private.
21369 	 * The sd_uscsi_info struct is also used by sd_uscsi_strategy()
21370 	 */
21371 	uip = kmem_zalloc(sizeof (struct sd_uscsi_info), KM_SLEEP);
21372 	uip->ui_flags = SD_PATH_DIRECT;
21373 	uip->ui_cmdp  = uscmd;
21374 
21375 	bp = getrbuf(KM_SLEEP);
21376 	bp->b_private = uip;
21377 
21378 	/*
21379 	 * Setup buffer to carry uscsi request.
21380 	 */
21381 	bp->b_flags  = B_BUSY;
21382 	bp->b_bcount = 0;
21383 	bp->b_blkno  = 0;
21384 
21385 	if (is_async == TRUE) {
21386 		bp->b_iodone = sd_send_scsi_SYNCHRONIZE_CACHE_biodone;
21387 		uip->ui_dkc = *dkc;
21388 	}
21389 
21390 	bp->b_edev = SD_GET_DEV(un);
21391 	bp->b_dev = cmpdev(bp->b_edev);	/* maybe unnecessary? */
21392 
21393 	/*
21394 	 * Unset un_f_sync_cache_required flag
21395 	 */
21396 	mutex_enter(SD_MUTEX(un));
21397 	un->un_f_sync_cache_required = FALSE;
21398 	mutex_exit(SD_MUTEX(un));
21399 
21400 	(void) sd_uscsi_strategy(bp);
21401 
21402 	/*
21403 	 * If synchronous request, wait for completion
21404 	 * If async just return and let b_iodone callback
21405 	 * cleanup.
21406 	 * NOTE: On return, u_ncmds_in_driver will be decremented,
21407 	 * but it was also incremented in sd_uscsi_strategy(), so
21408 	 * we should be ok.
21409 	 */
21410 	if (is_async == FALSE) {
21411 		(void) biowait(bp);
21412 		rval = sd_send_scsi_SYNCHRONIZE_CACHE_biodone(bp);
21413 	}
21414 
21415 	return (rval);
21416 }
21417 
21418 
21419 static int
21420 sd_send_scsi_SYNCHRONIZE_CACHE_biodone(struct buf *bp)
21421 {
21422 	struct sd_uscsi_info *uip;
21423 	struct uscsi_cmd *uscmd;
21424 	uint8_t *sense_buf;
21425 	struct sd_lun *un;
21426 	int status;
21427 	union scsi_cdb *cdb;
21428 
21429 	uip = (struct sd_uscsi_info *)(bp->b_private);
21430 	ASSERT(uip != NULL);
21431 
21432 	uscmd = uip->ui_cmdp;
21433 	ASSERT(uscmd != NULL);
21434 
21435 	sense_buf = (uint8_t *)uscmd->uscsi_rqbuf;
21436 	ASSERT(sense_buf != NULL);
21437 
21438 	un = ddi_get_soft_state(sd_state, SD_GET_INSTANCE_FROM_BUF(bp));
21439 	ASSERT(un != NULL);
21440 
21441 	cdb = (union scsi_cdb *)uscmd->uscsi_cdb;
21442 
21443 	status = geterror(bp);
21444 	switch (status) {
21445 	case 0:
21446 		break;	/* Success! */
21447 	case EIO:
21448 		switch (uscmd->uscsi_status) {
21449 		case STATUS_RESERVATION_CONFLICT:
21450 			/* Ignore reservation conflict */
21451 			status = 0;
21452 			goto done;
21453 
21454 		case STATUS_CHECK:
21455 			if ((uscmd->uscsi_rqstatus == STATUS_GOOD) &&
21456 			    (scsi_sense_key(sense_buf) ==
21457 			    KEY_ILLEGAL_REQUEST)) {
21458 				/* Ignore Illegal Request error */
21459 				if (cdb->cdb_un.tag&SD_SYNC_NV_BIT) {
21460 					mutex_enter(SD_MUTEX(un));
21461 					un->un_f_sync_nv_supported = FALSE;
21462 					mutex_exit(SD_MUTEX(un));
21463 					status = 0;
21464 					SD_TRACE(SD_LOG_IO, un,
21465 					    "un_f_sync_nv_supported \
21466 					    is set to false.\n");
21467 					goto done;
21468 				}
21469 
21470 				mutex_enter(SD_MUTEX(un));
21471 				un->un_f_sync_cache_supported = FALSE;
21472 				mutex_exit(SD_MUTEX(un));
21473 				SD_TRACE(SD_LOG_IO, un,
21474 				    "sd_send_scsi_SYNCHRONIZE_CACHE_biodone: \
21475 				    un_f_sync_cache_supported set to false \
21476 				    with asc = %x, ascq = %x\n",
21477 				    scsi_sense_asc(sense_buf),
21478 				    scsi_sense_ascq(sense_buf));
21479 				status = ENOTSUP;
21480 				goto done;
21481 			}
21482 			break;
21483 		default:
21484 			break;
21485 		}
21486 		/* FALLTHRU */
21487 	default:
21488 		/*
21489 		 * Turn on the un_f_sync_cache_required flag
21490 		 * since the SYNC CACHE command failed
21491 		 */
21492 		mutex_enter(SD_MUTEX(un));
21493 		un->un_f_sync_cache_required = TRUE;
21494 		mutex_exit(SD_MUTEX(un));
21495 
21496 		/*
21497 		 * Don't log an error message if this device
21498 		 * has removable media.
21499 		 */
21500 		if (!un->un_f_has_removable_media) {
21501 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
21502 			    "SYNCHRONIZE CACHE command failed (%d)\n", status);
21503 		}
21504 		break;
21505 	}
21506 
21507 done:
21508 	if (uip->ui_dkc.dkc_callback != NULL) {
21509 		(*uip->ui_dkc.dkc_callback)(uip->ui_dkc.dkc_cookie, status);
21510 	}
21511 
21512 	ASSERT((bp->b_flags & B_REMAPPED) == 0);
21513 	freerbuf(bp);
21514 	kmem_free(uip, sizeof (struct sd_uscsi_info));
21515 	kmem_free(uscmd->uscsi_rqbuf, SENSE_LENGTH);
21516 	kmem_free(uscmd->uscsi_cdb, (size_t)uscmd->uscsi_cdblen);
21517 	kmem_free(uscmd, sizeof (struct uscsi_cmd));
21518 
21519 	return (status);
21520 }
21521 
21522 /*
21523  * Issues a single SCSI UNMAP command with a prepared UNMAP parameter list.
21524  * Returns zero on success, or the non-zero command error code on failure.
21525  */
21526 static int
21527 sd_send_scsi_UNMAP_issue_one(sd_ssc_t *ssc, unmap_param_hdr_t *uph,
21528     uint64_t num_descr, uint64_t bytes)
21529 {
21530 	struct sd_lun		*un = ssc->ssc_un;
21531 	struct scsi_extended_sense	sense_buf;
21532 	union scsi_cdb		cdb;
21533 	struct uscsi_cmd	ucmd_buf;
21534 	int			status;
21535 	const uint64_t		param_size = sizeof (unmap_param_hdr_t) +
21536 	    num_descr * sizeof (unmap_blk_descr_t);
21537 
21538 	ASSERT3U(param_size - 2, <=, UINT16_MAX);
21539 	uph->uph_data_len = BE_16(param_size - 2);
21540 	uph->uph_descr_data_len = BE_16(param_size - 8);
21541 
21542 	bzero(&cdb, sizeof (cdb));
21543 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21544 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
21545 
21546 	cdb.scc_cmd = SCMD_UNMAP;
21547 	FORMG1COUNT(&cdb, param_size);
21548 
21549 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
21550 	ucmd_buf.uscsi_cdblen	= (uchar_t)CDB_GROUP1;
21551 	ucmd_buf.uscsi_bufaddr	= (caddr_t)uph;
21552 	ucmd_buf.uscsi_buflen	= param_size;
21553 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
21554 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
21555 	ucmd_buf.uscsi_flags	= USCSI_WRITE | USCSI_RQENABLE | USCSI_SILENT;
21556 	ucmd_buf.uscsi_timeout	= un->un_cmd_timeout;
21557 
21558 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL, UIO_SYSSPACE,
21559 	    SD_PATH_STANDARD);
21560 
21561 	switch (status) {
21562 	case 0:
21563 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21564 
21565 		if (un->un_unmapstats) {
21566 			atomic_inc_64(&un->un_unmapstats->us_cmds.value.ui64);
21567 			atomic_add_64(&un->un_unmapstats->us_extents.value.ui64,
21568 			    num_descr);
21569 			atomic_add_64(&un->un_unmapstats->us_bytes.value.ui64,
21570 			    bytes);
21571 		}
21572 		break;	/* Success! */
21573 	case EIO:
21574 		if (un->un_unmapstats)
21575 			atomic_inc_64(&un->un_unmapstats->us_errs.value.ui64);
21576 		switch (ucmd_buf.uscsi_status) {
21577 		case STATUS_RESERVATION_CONFLICT:
21578 			status = EACCES;
21579 			break;
21580 		default:
21581 			break;
21582 		}
21583 		break;
21584 	default:
21585 		if (un->un_unmapstats)
21586 			atomic_inc_64(&un->un_unmapstats->us_errs.value.ui64);
21587 		break;
21588 	}
21589 
21590 	return (status);
21591 }
21592 
21593 /*
21594  * Returns a pointer to the i'th block descriptor inside an UNMAP param list.
21595  */
21596 static inline unmap_blk_descr_t *
21597 UNMAP_blk_descr_i(void *buf, size_t i)
21598 {
21599 	return ((unmap_blk_descr_t *)((uintptr_t)buf +
21600 	    sizeof (unmap_param_hdr_t) + (i * sizeof (unmap_blk_descr_t))));
21601 }
21602 
21603 /*
21604  * Takes the list of extents from sd_send_scsi_UNMAP, chops it up, prepares
21605  * UNMAP block descriptors and issues individual SCSI UNMAP commands. While
21606  * doing so we consult the block limits to determine at most how many
21607  * extents and LBAs we can UNMAP in one command.
21608  * If a command fails for whatever, reason, extent list processing is aborted
21609  * and the failed command's status is returned. Otherwise returns 0 on
21610  * success.
21611  */
21612 static int
21613 sd_send_scsi_UNMAP_issue(dev_t dev, sd_ssc_t *ssc, const dkioc_free_list_t *dfl)
21614 {
21615 	struct sd_lun		*un = ssc->ssc_un;
21616 	unmap_param_hdr_t	*uph;
21617 	sd_blk_limits_t		*lim = &un->un_blk_lim;
21618 	int			rval = 0;
21619 	int			partition;
21620 	/* partition offset & length in system blocks */
21621 	diskaddr_t		part_off_sysblks = 0, part_len_sysblks = 0;
21622 	uint64_t		part_off, part_len;
21623 	uint64_t		descr_cnt_lim, byte_cnt_lim;
21624 	uint64_t		descr_issued = 0, bytes_issued = 0;
21625 
21626 	uph = kmem_zalloc(SD_UNMAP_PARAM_LIST_MAXSZ, KM_SLEEP);
21627 
21628 	partition = SDPART(dev);
21629 	rval = cmlb_partinfo(un->un_cmlbhandle, partition, &part_len_sysblks,
21630 	    &part_off_sysblks, NULL, NULL, (void *)SD_PATH_DIRECT);
21631 	if (rval != 0)
21632 		goto out;
21633 	part_off = SD_SYSBLOCKS2BYTES(part_off_sysblks);
21634 	part_len = SD_SYSBLOCKS2BYTES(part_len_sysblks);
21635 
21636 	ASSERT(un->un_blk_lim.lim_max_unmap_lba_cnt != 0);
21637 	ASSERT(un->un_blk_lim.lim_max_unmap_descr_cnt != 0);
21638 	/* Spec says 0xffffffff are special values, so compute maximums. */
21639 	byte_cnt_lim = lim->lim_max_unmap_lba_cnt < UINT32_MAX ?
21640 	    (uint64_t)lim->lim_max_unmap_lba_cnt * un->un_tgt_blocksize :
21641 	    UINT64_MAX;
21642 	descr_cnt_lim = MIN(lim->lim_max_unmap_descr_cnt, SD_UNMAP_MAX_DESCR);
21643 
21644 	if (dfl->dfl_offset >= part_len) {
21645 		rval = SET_ERROR(EINVAL);
21646 		goto out;
21647 	}
21648 
21649 	for (size_t i = 0; i < dfl->dfl_num_exts; i++) {
21650 		const dkioc_free_list_ext_t *ext = &dfl->dfl_exts[i];
21651 		uint64_t ext_start = ext->dfle_start;
21652 		uint64_t ext_length = ext->dfle_length;
21653 
21654 		while (ext_length > 0) {
21655 			unmap_blk_descr_t *ubd;
21656 			/* Respect device limit on LBA count per command */
21657 			uint64_t len = MIN(MIN(ext_length, byte_cnt_lim -
21658 			    bytes_issued), SD_TGTBLOCKS2BYTES(un, UINT32_MAX));
21659 
21660 			/* check partition limits */
21661 			if (ext_start >= part_len ||
21662 			    ext_start + len < ext_start ||
21663 			    dfl->dfl_offset + ext_start + len <
21664 			    dfl->dfl_offset ||
21665 			    dfl->dfl_offset + ext_start + len > part_len) {
21666 				rval = SET_ERROR(EINVAL);
21667 				goto out;
21668 			}
21669 
21670 			ASSERT3U(descr_issued, <, descr_cnt_lim);
21671 			ASSERT3U(bytes_issued, <, byte_cnt_lim);
21672 			ubd = UNMAP_blk_descr_i(uph, descr_issued);
21673 
21674 			/* adjust in-partition addresses to be device-global */
21675 			ubd->ubd_lba = BE_64(SD_BYTES2TGTBLOCKS(un,
21676 			    dfl->dfl_offset + ext_start + part_off));
21677 			ubd->ubd_lba_cnt = BE_32(SD_BYTES2TGTBLOCKS(un, len));
21678 
21679 			descr_issued++;
21680 			bytes_issued += len;
21681 
21682 			/* Issue command when device limits reached */
21683 			if (descr_issued == descr_cnt_lim ||
21684 			    bytes_issued == byte_cnt_lim) {
21685 				rval = sd_send_scsi_UNMAP_issue_one(ssc, uph,
21686 				    descr_issued, bytes_issued);
21687 				if (rval != 0)
21688 					goto out;
21689 				descr_issued = 0;
21690 				bytes_issued = 0;
21691 			}
21692 
21693 			ext_start += len;
21694 			ext_length -= len;
21695 		}
21696 	}
21697 
21698 	if (descr_issued > 0) {
21699 		/* issue last command */
21700 		rval = sd_send_scsi_UNMAP_issue_one(ssc, uph, descr_issued,
21701 		    bytes_issued);
21702 	}
21703 
21704 out:
21705 	kmem_free(uph, SD_UNMAP_PARAM_LIST_MAXSZ);
21706 	return (rval);
21707 }
21708 
21709 /*
21710  * Issues one or several UNMAP commands based on a list of extents to be
21711  * unmapped. The internal multi-command processing is hidden, as the exact
21712  * number of commands and extents per command is limited by both SCSI
21713  * command syntax and device limits (as expressed in the SCSI Block Limits
21714  * VPD page and un_blk_lim in struct sd_lun).
21715  * Returns zero on success, or the error code of the first failed SCSI UNMAP
21716  * command.
21717  */
21718 static int
21719 sd_send_scsi_UNMAP(dev_t dev, sd_ssc_t *ssc, dkioc_free_list_t *dfl, int flag)
21720 {
21721 	struct sd_lun		*un = ssc->ssc_un;
21722 	int			rval = 0;
21723 
21724 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21725 	ASSERT(dfl != NULL);
21726 
21727 	/* Per spec, any of these conditions signals lack of UNMAP support. */
21728 	if (!(un->un_thin_flags & SD_THIN_PROV_ENABLED) ||
21729 	    un->un_blk_lim.lim_max_unmap_descr_cnt == 0 ||
21730 	    un->un_blk_lim.lim_max_unmap_lba_cnt == 0) {
21731 		return (SET_ERROR(ENOTSUP));
21732 	}
21733 
21734 	/* For userspace calls we must copy in. */
21735 	if (!(flag & FKIOCTL)) {
21736 		int err = dfl_copyin(dfl, &dfl, flag, KM_SLEEP);
21737 		if (err != 0)
21738 			return (err);
21739 	} else if (dfl->dfl_num_exts > DFL_COPYIN_MAX_EXTS) {
21740 		ASSERT3U(dfl->dfl_num_exts, <=, DFL_COPYIN_MAX_EXTS);
21741 		return (SET_ERROR(EINVAL));
21742 	}
21743 
21744 	rval = sd_send_scsi_UNMAP_issue(dev, ssc, dfl);
21745 
21746 	if (!(flag & FKIOCTL)) {
21747 		dfl_free(dfl);
21748 		dfl = NULL;
21749 	}
21750 
21751 	return (rval);
21752 }
21753 
21754 /*
21755  *    Function: sd_send_scsi_GET_CONFIGURATION
21756  *
21757  * Description: Issues the get configuration command to the device.
21758  *		Called from sd_check_for_writable_cd & sd_get_media_info
21759  *		caller needs to ensure that buflen = SD_PROFILE_HEADER_LEN
21760  *   Arguments: ssc
21761  *		ucmdbuf
21762  *		rqbuf
21763  *		rqbuflen
21764  *		bufaddr
21765  *		buflen
21766  *		path_flag
21767  *
21768  * Return Code: 0   - Success
21769  *		errno return code from sd_ssc_send()
21770  *
21771  *     Context: Can sleep. Does not return until command is completed.
21772  *
21773  */
21774 
21775 static int
21776 sd_send_scsi_GET_CONFIGURATION(sd_ssc_t *ssc, struct uscsi_cmd *ucmdbuf,
21777     uchar_t *rqbuf, uint_t rqbuflen, uchar_t *bufaddr, uint_t buflen,
21778     int path_flag)
21779 {
21780 	char	cdb[CDB_GROUP1];
21781 	int	status;
21782 	struct sd_lun	*un;
21783 
21784 	ASSERT(ssc != NULL);
21785 	un = ssc->ssc_un;
21786 	ASSERT(un != NULL);
21787 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21788 	ASSERT(bufaddr != NULL);
21789 	ASSERT(ucmdbuf != NULL);
21790 	ASSERT(rqbuf != NULL);
21791 
21792 	SD_TRACE(SD_LOG_IO, un,
21793 	    "sd_send_scsi_GET_CONFIGURATION: entry: un:0x%p\n", un);
21794 
21795 	bzero(cdb, sizeof (cdb));
21796 	bzero(ucmdbuf, sizeof (struct uscsi_cmd));
21797 	bzero(rqbuf, rqbuflen);
21798 	bzero(bufaddr, buflen);
21799 
21800 	/*
21801 	 * Set up cdb field for the get configuration command.
21802 	 */
21803 	cdb[0] = SCMD_GET_CONFIGURATION;
21804 	cdb[1] = 0x02;  /* Requested Type */
21805 	cdb[8] = SD_PROFILE_HEADER_LEN;
21806 	ucmdbuf->uscsi_cdb = cdb;
21807 	ucmdbuf->uscsi_cdblen = CDB_GROUP1;
21808 	ucmdbuf->uscsi_bufaddr = (caddr_t)bufaddr;
21809 	ucmdbuf->uscsi_buflen = buflen;
21810 	ucmdbuf->uscsi_timeout = sd_io_time;
21811 	ucmdbuf->uscsi_rqbuf = (caddr_t)rqbuf;
21812 	ucmdbuf->uscsi_rqlen = rqbuflen;
21813 	ucmdbuf->uscsi_flags = USCSI_RQENABLE|USCSI_SILENT|USCSI_READ;
21814 
21815 	status = sd_ssc_send(ssc, ucmdbuf, FKIOCTL,
21816 	    UIO_SYSSPACE, path_flag);
21817 
21818 	switch (status) {
21819 	case 0:
21820 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21821 		break;  /* Success! */
21822 	case EIO:
21823 		switch (ucmdbuf->uscsi_status) {
21824 		case STATUS_RESERVATION_CONFLICT:
21825 			status = EACCES;
21826 			break;
21827 		default:
21828 			break;
21829 		}
21830 		break;
21831 	default:
21832 		break;
21833 	}
21834 
21835 	if (status == 0) {
21836 		SD_DUMP_MEMORY(un, SD_LOG_IO,
21837 		    "sd_send_scsi_GET_CONFIGURATION: data",
21838 		    (uchar_t *)bufaddr, SD_PROFILE_HEADER_LEN, SD_LOG_HEX);
21839 	}
21840 
21841 	SD_TRACE(SD_LOG_IO, un,
21842 	    "sd_send_scsi_GET_CONFIGURATION: exit\n");
21843 
21844 	return (status);
21845 }
21846 
21847 /*
21848  *    Function: sd_send_scsi_feature_GET_CONFIGURATION
21849  *
21850  * Description: Issues the get configuration command to the device to
21851  *              retrieve a specific feature. Called from
21852  *		sd_check_for_writable_cd & sd_set_mmc_caps.
21853  *   Arguments: ssc
21854  *              ucmdbuf
21855  *              rqbuf
21856  *              rqbuflen
21857  *              bufaddr
21858  *              buflen
21859  *		feature
21860  *
21861  * Return Code: 0   - Success
21862  *              errno return code from sd_ssc_send()
21863  *
21864  *     Context: Can sleep. Does not return until command is completed.
21865  *
21866  */
21867 static int
21868 sd_send_scsi_feature_GET_CONFIGURATION(sd_ssc_t *ssc, struct uscsi_cmd *ucmdbuf,
21869     uchar_t *rqbuf, uint_t rqbuflen, uchar_t *bufaddr, uint_t buflen,
21870     char feature, int path_flag)
21871 {
21872 	char    cdb[CDB_GROUP1];
21873 	int	status;
21874 	struct sd_lun	*un;
21875 
21876 	ASSERT(ssc != NULL);
21877 	un = ssc->ssc_un;
21878 	ASSERT(un != NULL);
21879 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21880 	ASSERT(bufaddr != NULL);
21881 	ASSERT(ucmdbuf != NULL);
21882 	ASSERT(rqbuf != NULL);
21883 
21884 	SD_TRACE(SD_LOG_IO, un,
21885 	    "sd_send_scsi_feature_GET_CONFIGURATION: entry: un:0x%p\n", un);
21886 
21887 	bzero(cdb, sizeof (cdb));
21888 	bzero(ucmdbuf, sizeof (struct uscsi_cmd));
21889 	bzero(rqbuf, rqbuflen);
21890 	bzero(bufaddr, buflen);
21891 
21892 	/*
21893 	 * Set up cdb field for the get configuration command.
21894 	 */
21895 	cdb[0] = SCMD_GET_CONFIGURATION;
21896 	cdb[1] = 0x02;  /* Requested Type */
21897 	cdb[3] = feature;
21898 	cdb[8] = buflen;
21899 	ucmdbuf->uscsi_cdb = cdb;
21900 	ucmdbuf->uscsi_cdblen = CDB_GROUP1;
21901 	ucmdbuf->uscsi_bufaddr = (caddr_t)bufaddr;
21902 	ucmdbuf->uscsi_buflen = buflen;
21903 	ucmdbuf->uscsi_timeout = sd_io_time;
21904 	ucmdbuf->uscsi_rqbuf = (caddr_t)rqbuf;
21905 	ucmdbuf->uscsi_rqlen = rqbuflen;
21906 	ucmdbuf->uscsi_flags = USCSI_RQENABLE|USCSI_SILENT|USCSI_READ;
21907 
21908 	status = sd_ssc_send(ssc, ucmdbuf, FKIOCTL,
21909 	    UIO_SYSSPACE, path_flag);
21910 
21911 	switch (status) {
21912 	case 0:
21913 
21914 		break;  /* Success! */
21915 	case EIO:
21916 		switch (ucmdbuf->uscsi_status) {
21917 		case STATUS_RESERVATION_CONFLICT:
21918 			status = EACCES;
21919 			break;
21920 		default:
21921 			break;
21922 		}
21923 		break;
21924 	default:
21925 		break;
21926 	}
21927 
21928 	if (status == 0) {
21929 		SD_DUMP_MEMORY(un, SD_LOG_IO,
21930 		    "sd_send_scsi_feature_GET_CONFIGURATION: data",
21931 		    (uchar_t *)bufaddr, SD_PROFILE_HEADER_LEN, SD_LOG_HEX);
21932 	}
21933 
21934 	SD_TRACE(SD_LOG_IO, un,
21935 	    "sd_send_scsi_feature_GET_CONFIGURATION: exit\n");
21936 
21937 	return (status);
21938 }
21939 
21940 
21941 /*
21942  *    Function: sd_send_scsi_MODE_SENSE
21943  *
21944  * Description: Utility function for issuing a scsi MODE SENSE command.
21945  *		Note: This routine uses a consistent implementation for Group0,
21946  *		Group1, and Group2 commands across all platforms. ATAPI devices
21947  *		use Group 1 Read/Write commands and Group 2 Mode Sense/Select
21948  *
21949  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
21950  *                      structure for this target.
21951  *		cdbsize - size CDB to be used (CDB_GROUP0 (6 byte), or
21952  *			  CDB_GROUP[1|2] (10 byte).
21953  *		bufaddr - buffer for page data retrieved from the target.
21954  *		buflen - size of page to be retrieved.
21955  *		page_code - page code of data to be retrieved from the target.
21956  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
21957  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
21958  *			to use the USCSI "direct" chain and bypass the normal
21959  *			command waitq.
21960  *
21961  * Return Code: 0   - Success
21962  *		errno return code from sd_ssc_send()
21963  *
21964  *     Context: Can sleep. Does not return until command is completed.
21965  */
21966 
21967 static int
21968 sd_send_scsi_MODE_SENSE(sd_ssc_t *ssc, int cdbsize, uchar_t *bufaddr,
21969     size_t buflen,  uchar_t page_code, int path_flag)
21970 {
21971 	struct	scsi_extended_sense	sense_buf;
21972 	union scsi_cdb		cdb;
21973 	struct uscsi_cmd	ucmd_buf;
21974 	int			status;
21975 	int			headlen;
21976 	struct sd_lun		*un;
21977 
21978 	ASSERT(ssc != NULL);
21979 	un = ssc->ssc_un;
21980 	ASSERT(un != NULL);
21981 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21982 	ASSERT(bufaddr != NULL);
21983 	ASSERT((cdbsize == CDB_GROUP0) || (cdbsize == CDB_GROUP1) ||
21984 	    (cdbsize == CDB_GROUP2));
21985 
21986 	SD_TRACE(SD_LOG_IO, un,
21987 	    "sd_send_scsi_MODE_SENSE: entry: un:0x%p\n", un);
21988 
21989 	bzero(&cdb, sizeof (cdb));
21990 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21991 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
21992 	bzero(bufaddr, buflen);
21993 
21994 	if (cdbsize == CDB_GROUP0) {
21995 		cdb.scc_cmd = SCMD_MODE_SENSE;
21996 		cdb.cdb_opaque[2] = page_code;
21997 		FORMG0COUNT(&cdb, buflen);
21998 		headlen = MODE_HEADER_LENGTH;
21999 	} else {
22000 		cdb.scc_cmd = SCMD_MODE_SENSE_G1;
22001 		cdb.cdb_opaque[2] = page_code;
22002 		FORMG1COUNT(&cdb, buflen);
22003 		headlen = MODE_HEADER_LENGTH_GRP2;
22004 	}
22005 
22006 	ASSERT(headlen <= buflen);
22007 	SD_FILL_SCSI1_LUN_CDB(un, &cdb);
22008 
22009 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
22010 	ucmd_buf.uscsi_cdblen	= (uchar_t)cdbsize;
22011 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
22012 	ucmd_buf.uscsi_buflen	= buflen;
22013 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
22014 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
22015 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
22016 	ucmd_buf.uscsi_timeout	= 60;
22017 
22018 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
22019 	    UIO_SYSSPACE, path_flag);
22020 
22021 	switch (status) {
22022 	case 0:
22023 		/*
22024 		 * sr_check_wp() uses 0x3f page code and check the header of
22025 		 * mode page to determine if target device is write-protected.
22026 		 * But some USB devices return 0 bytes for 0x3f page code. For
22027 		 * this case, make sure that mode page header is returned at
22028 		 * least.
22029 		 */
22030 		if (buflen - ucmd_buf.uscsi_resid <  headlen) {
22031 			status = EIO;
22032 			sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
22033 			    "mode page header is not returned");
22034 		}
22035 		break;	/* Success! */
22036 	case EIO:
22037 		switch (ucmd_buf.uscsi_status) {
22038 		case STATUS_RESERVATION_CONFLICT:
22039 			status = EACCES;
22040 			break;
22041 		default:
22042 			break;
22043 		}
22044 		break;
22045 	default:
22046 		break;
22047 	}
22048 
22049 	if (status == 0) {
22050 		SD_DUMP_MEMORY(un, SD_LOG_IO, "sd_send_scsi_MODE_SENSE: data",
22051 		    (uchar_t *)bufaddr, buflen, SD_LOG_HEX);
22052 	}
22053 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_MODE_SENSE: exit\n");
22054 
22055 	return (status);
22056 }
22057 
22058 
22059 /*
22060  *    Function: sd_send_scsi_MODE_SELECT
22061  *
22062  * Description: Utility function for issuing a scsi MODE SELECT command.
22063  *		Note: This routine uses a consistent implementation for Group0,
22064  *		Group1, and Group2 commands across all platforms. ATAPI devices
22065  *		use Group 1 Read/Write commands and Group 2 Mode Sense/Select
22066  *
22067  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
22068  *                      structure for this target.
22069  *		cdbsize - size CDB to be used (CDB_GROUP0 (6 byte), or
22070  *			  CDB_GROUP[1|2] (10 byte).
22071  *		bufaddr - buffer for page data retrieved from the target.
22072  *		buflen - size of page to be retrieved.
22073  *		save_page - boolean to determin if SP bit should be set.
22074  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
22075  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
22076  *			to use the USCSI "direct" chain and bypass the normal
22077  *			command waitq.
22078  *
22079  * Return Code: 0   - Success
22080  *		errno return code from sd_ssc_send()
22081  *
22082  *     Context: Can sleep. Does not return until command is completed.
22083  */
22084 
22085 static int
22086 sd_send_scsi_MODE_SELECT(sd_ssc_t *ssc, int cdbsize, uchar_t *bufaddr,
22087     size_t buflen,  uchar_t save_page, int path_flag)
22088 {
22089 	struct	scsi_extended_sense	sense_buf;
22090 	union scsi_cdb		cdb;
22091 	struct uscsi_cmd	ucmd_buf;
22092 	int			status;
22093 	struct sd_lun		*un;
22094 
22095 	ASSERT(ssc != NULL);
22096 	un = ssc->ssc_un;
22097 	ASSERT(un != NULL);
22098 	ASSERT(!mutex_owned(SD_MUTEX(un)));
22099 	ASSERT(bufaddr != NULL);
22100 	ASSERT((cdbsize == CDB_GROUP0) || (cdbsize == CDB_GROUP1) ||
22101 	    (cdbsize == CDB_GROUP2));
22102 
22103 	SD_TRACE(SD_LOG_IO, un,
22104 	    "sd_send_scsi_MODE_SELECT: entry: un:0x%p\n", un);
22105 
22106 	bzero(&cdb, sizeof (cdb));
22107 	bzero(&ucmd_buf, sizeof (ucmd_buf));
22108 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
22109 
22110 	/* Set the PF bit for many third party drives */
22111 	cdb.cdb_opaque[1] = 0x10;
22112 
22113 	/* Set the savepage(SP) bit if given */
22114 	if (save_page == SD_SAVE_PAGE) {
22115 		cdb.cdb_opaque[1] |= 0x01;
22116 	}
22117 
22118 	if (cdbsize == CDB_GROUP0) {
22119 		cdb.scc_cmd = SCMD_MODE_SELECT;
22120 		FORMG0COUNT(&cdb, buflen);
22121 	} else {
22122 		cdb.scc_cmd = SCMD_MODE_SELECT_G1;
22123 		FORMG1COUNT(&cdb, buflen);
22124 	}
22125 
22126 	SD_FILL_SCSI1_LUN_CDB(un, &cdb);
22127 
22128 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
22129 	ucmd_buf.uscsi_cdblen	= (uchar_t)cdbsize;
22130 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
22131 	ucmd_buf.uscsi_buflen	= buflen;
22132 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
22133 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
22134 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_WRITE | USCSI_SILENT;
22135 	ucmd_buf.uscsi_timeout	= 60;
22136 
22137 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
22138 	    UIO_SYSSPACE, path_flag);
22139 
22140 	switch (status) {
22141 	case 0:
22142 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
22143 		break;	/* Success! */
22144 	case EIO:
22145 		switch (ucmd_buf.uscsi_status) {
22146 		case STATUS_RESERVATION_CONFLICT:
22147 			status = EACCES;
22148 			break;
22149 		default:
22150 			break;
22151 		}
22152 		break;
22153 	default:
22154 		break;
22155 	}
22156 
22157 	if (status == 0) {
22158 		SD_DUMP_MEMORY(un, SD_LOG_IO, "sd_send_scsi_MODE_SELECT: data",
22159 		    (uchar_t *)bufaddr, buflen, SD_LOG_HEX);
22160 	}
22161 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_MODE_SELECT: exit\n");
22162 
22163 	return (status);
22164 }
22165 
22166 
22167 /*
22168  *    Function: sd_send_scsi_RDWR
22169  *
22170  * Description: Issue a scsi READ or WRITE command with the given parameters.
22171  *
22172  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
22173  *                      structure for this target.
22174  *		cmd:	 SCMD_READ or SCMD_WRITE
22175  *		bufaddr: Address of caller's buffer to receive the RDWR data
22176  *		buflen:  Length of caller's buffer receive the RDWR data.
22177  *		start_block: Block number for the start of the RDWR operation.
22178  *			 (Assumes target-native block size.)
22179  *		residp:  Pointer to variable to receive the redisual of the
22180  *			 RDWR operation (may be NULL of no residual requested).
22181  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
22182  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
22183  *			to use the USCSI "direct" chain and bypass the normal
22184  *			command waitq.
22185  *
22186  * Return Code: 0   - Success
22187  *		errno return code from sd_ssc_send()
22188  *
22189  *     Context: Can sleep. Does not return until command is completed.
22190  */
22191 
22192 static int
22193 sd_send_scsi_RDWR(sd_ssc_t *ssc, uchar_t cmd, void *bufaddr,
22194     size_t buflen, daddr_t start_block, int path_flag)
22195 {
22196 	struct	scsi_extended_sense	sense_buf;
22197 	union scsi_cdb		cdb;
22198 	struct uscsi_cmd	ucmd_buf;
22199 	uint32_t		block_count;
22200 	int			status;
22201 	int			cdbsize;
22202 	uchar_t			flag;
22203 	struct sd_lun		*un;
22204 
22205 	ASSERT(ssc != NULL);
22206 	un = ssc->ssc_un;
22207 	ASSERT(un != NULL);
22208 	ASSERT(!mutex_owned(SD_MUTEX(un)));
22209 	ASSERT(bufaddr != NULL);
22210 	ASSERT((cmd == SCMD_READ) || (cmd == SCMD_WRITE));
22211 
22212 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_RDWR: entry: un:0x%p\n", un);
22213 
22214 	if (un->un_f_tgt_blocksize_is_valid != TRUE) {
22215 		return (EINVAL);
22216 	}
22217 
22218 	mutex_enter(SD_MUTEX(un));
22219 	block_count = SD_BYTES2TGTBLOCKS(un, buflen);
22220 	mutex_exit(SD_MUTEX(un));
22221 
22222 	flag = (cmd == SCMD_READ) ? USCSI_READ : USCSI_WRITE;
22223 
22224 	SD_INFO(SD_LOG_IO, un, "sd_send_scsi_RDWR: "
22225 	    "bufaddr:0x%p buflen:0x%x start_block:0x%p block_count:0x%x\n",
22226 	    bufaddr, buflen, start_block, block_count);
22227 
22228 	bzero(&cdb, sizeof (cdb));
22229 	bzero(&ucmd_buf, sizeof (ucmd_buf));
22230 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
22231 
22232 	/* Compute CDB size to use */
22233 	if (start_block > 0xffffffff)
22234 		cdbsize = CDB_GROUP4;
22235 	else if ((start_block & 0xFFE00000) ||
22236 	    (un->un_f_cfg_is_atapi == TRUE))
22237 		cdbsize = CDB_GROUP1;
22238 	else
22239 		cdbsize = CDB_GROUP0;
22240 
22241 	switch (cdbsize) {
22242 	case CDB_GROUP0:	/* 6-byte CDBs */
22243 		cdb.scc_cmd = cmd;
22244 		FORMG0ADDR(&cdb, start_block);
22245 		FORMG0COUNT(&cdb, block_count);
22246 		break;
22247 	case CDB_GROUP1:	/* 10-byte CDBs */
22248 		cdb.scc_cmd = cmd | SCMD_GROUP1;
22249 		FORMG1ADDR(&cdb, start_block);
22250 		FORMG1COUNT(&cdb, block_count);
22251 		break;
22252 	case CDB_GROUP4:	/* 16-byte CDBs */
22253 		cdb.scc_cmd = cmd | SCMD_GROUP4;
22254 		FORMG4LONGADDR(&cdb, (uint64_t)start_block);
22255 		FORMG4COUNT(&cdb, block_count);
22256 		break;
22257 	case CDB_GROUP5:	/* 12-byte CDBs (currently unsupported) */
22258 	default:
22259 		/* All others reserved */
22260 		return (EINVAL);
22261 	}
22262 
22263 	/* Set LUN bit(s) in CDB if this is a SCSI-1 device */
22264 	SD_FILL_SCSI1_LUN_CDB(un, &cdb);
22265 
22266 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
22267 	ucmd_buf.uscsi_cdblen	= (uchar_t)cdbsize;
22268 	ucmd_buf.uscsi_bufaddr	= bufaddr;
22269 	ucmd_buf.uscsi_buflen	= buflen;
22270 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
22271 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
22272 	ucmd_buf.uscsi_flags	= flag | USCSI_RQENABLE | USCSI_SILENT;
22273 	ucmd_buf.uscsi_timeout	= 60;
22274 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
22275 	    UIO_SYSSPACE, path_flag);
22276 
22277 	switch (status) {
22278 	case 0:
22279 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
22280 		break;	/* Success! */
22281 	case EIO:
22282 		switch (ucmd_buf.uscsi_status) {
22283 		case STATUS_RESERVATION_CONFLICT:
22284 			status = EACCES;
22285 			break;
22286 		default:
22287 			break;
22288 		}
22289 		break;
22290 	default:
22291 		break;
22292 	}
22293 
22294 	if (status == 0) {
22295 		SD_DUMP_MEMORY(un, SD_LOG_IO, "sd_send_scsi_RDWR: data",
22296 		    (uchar_t *)bufaddr, buflen, SD_LOG_HEX);
22297 	}
22298 
22299 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_RDWR: exit\n");
22300 
22301 	return (status);
22302 }
22303 
22304 
22305 /*
22306  *    Function: sd_send_scsi_LOG_SENSE
22307  *
22308  * Description: Issue a scsi LOG_SENSE command with the given parameters.
22309  *
22310  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
22311  *                      structure for this target.
22312  *
22313  * Return Code: 0   - Success
22314  *		errno return code from sd_ssc_send()
22315  *
22316  *     Context: Can sleep. Does not return until command is completed.
22317  */
22318 
22319 static int
22320 sd_send_scsi_LOG_SENSE(sd_ssc_t *ssc, uchar_t *bufaddr, uint16_t buflen,
22321     uchar_t page_code, uchar_t page_control, uint16_t param_ptr, int path_flag)
22322 {
22323 	struct scsi_extended_sense	sense_buf;
22324 	union scsi_cdb		cdb;
22325 	struct uscsi_cmd	ucmd_buf;
22326 	int			status;
22327 	struct sd_lun		*un;
22328 
22329 	ASSERT(ssc != NULL);
22330 	un = ssc->ssc_un;
22331 	ASSERT(un != NULL);
22332 	ASSERT(!mutex_owned(SD_MUTEX(un)));
22333 
22334 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_LOG_SENSE: entry: un:0x%p\n", un);
22335 
22336 	bzero(&cdb, sizeof (cdb));
22337 	bzero(&ucmd_buf, sizeof (ucmd_buf));
22338 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
22339 
22340 	cdb.scc_cmd = SCMD_LOG_SENSE_G1;
22341 	cdb.cdb_opaque[2] = (page_control << 6) | page_code;
22342 	cdb.cdb_opaque[5] = (uchar_t)((param_ptr & 0xFF00) >> 8);
22343 	cdb.cdb_opaque[6] = (uchar_t)(param_ptr  & 0x00FF);
22344 	FORMG1COUNT(&cdb, buflen);
22345 
22346 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
22347 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
22348 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
22349 	ucmd_buf.uscsi_buflen	= buflen;
22350 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
22351 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
22352 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
22353 	ucmd_buf.uscsi_timeout	= 60;
22354 
22355 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
22356 	    UIO_SYSSPACE, path_flag);
22357 
22358 	switch (status) {
22359 	case 0:
22360 		break;
22361 	case EIO:
22362 		switch (ucmd_buf.uscsi_status) {
22363 		case STATUS_RESERVATION_CONFLICT:
22364 			status = EACCES;
22365 			break;
22366 		case STATUS_CHECK:
22367 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
22368 			    (scsi_sense_key((uint8_t *)&sense_buf) ==
22369 			    KEY_ILLEGAL_REQUEST) &&
22370 			    (scsi_sense_asc((uint8_t *)&sense_buf) == 0x24)) {
22371 				/*
22372 				 * ASC 0x24: INVALID FIELD IN CDB
22373 				 */
22374 				switch (page_code) {
22375 				case START_STOP_CYCLE_PAGE:
22376 					/*
22377 					 * The start stop cycle counter is
22378 					 * implemented as page 0x31 in earlier
22379 					 * generation disks. In new generation
22380 					 * disks the start stop cycle counter is
22381 					 * implemented as page 0xE. To properly
22382 					 * handle this case if an attempt for
22383 					 * log page 0xE is made and fails we
22384 					 * will try again using page 0x31.
22385 					 *
22386 					 * Network storage BU committed to
22387 					 * maintain the page 0x31 for this
22388 					 * purpose and will not have any other
22389 					 * page implemented with page code 0x31
22390 					 * until all disks transition to the
22391 					 * standard page.
22392 					 */
22393 					mutex_enter(SD_MUTEX(un));
22394 					un->un_start_stop_cycle_page =
22395 					    START_STOP_CYCLE_VU_PAGE;
22396 					cdb.cdb_opaque[2] =
22397 					    (char)(page_control << 6) |
22398 					    un->un_start_stop_cycle_page;
22399 					mutex_exit(SD_MUTEX(un));
22400 					sd_ssc_assessment(ssc, SD_FMT_IGNORE);
22401 					status = sd_ssc_send(
22402 					    ssc, &ucmd_buf, FKIOCTL,
22403 					    UIO_SYSSPACE, path_flag);
22404 
22405 					break;
22406 				case TEMPERATURE_PAGE:
22407 					status = ENOTTY;
22408 					break;
22409 				default:
22410 					break;
22411 				}
22412 			}
22413 			break;
22414 		default:
22415 			break;
22416 		}
22417 		break;
22418 	default:
22419 		break;
22420 	}
22421 
22422 	if (status == 0) {
22423 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
22424 		SD_DUMP_MEMORY(un, SD_LOG_IO, "sd_send_scsi_LOG_SENSE: data",
22425 		    (uchar_t *)bufaddr, buflen, SD_LOG_HEX);
22426 	}
22427 
22428 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_LOG_SENSE: exit\n");
22429 
22430 	return (status);
22431 }
22432 
22433 
22434 /*
22435  *    Function: sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION
22436  *
22437  * Description: Issue the scsi GET EVENT STATUS NOTIFICATION command.
22438  *
22439  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
22440  *                      structure for this target.
22441  *		bufaddr
22442  *		buflen
22443  *		class_req
22444  *
22445  * Return Code: 0   - Success
22446  *		errno return code from sd_ssc_send()
22447  *
22448  *     Context: Can sleep. Does not return until command is completed.
22449  */
22450 
22451 static int
22452 sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION(sd_ssc_t *ssc, uchar_t *bufaddr,
22453     size_t buflen, uchar_t class_req)
22454 {
22455 	union scsi_cdb		cdb;
22456 	struct uscsi_cmd	ucmd_buf;
22457 	int			status;
22458 	struct sd_lun		*un;
22459 
22460 	ASSERT(ssc != NULL);
22461 	un = ssc->ssc_un;
22462 	ASSERT(un != NULL);
22463 	ASSERT(!mutex_owned(SD_MUTEX(un)));
22464 	ASSERT(bufaddr != NULL);
22465 
22466 	SD_TRACE(SD_LOG_IO, un,
22467 	    "sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION: entry: un:0x%p\n", un);
22468 
22469 	bzero(&cdb, sizeof (cdb));
22470 	bzero(&ucmd_buf, sizeof (ucmd_buf));
22471 	bzero(bufaddr, buflen);
22472 
22473 	cdb.scc_cmd = SCMD_GET_EVENT_STATUS_NOTIFICATION;
22474 	cdb.cdb_opaque[1] = 1; /* polled */
22475 	cdb.cdb_opaque[4] = class_req;
22476 	FORMG1COUNT(&cdb, buflen);
22477 
22478 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
22479 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
22480 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
22481 	ucmd_buf.uscsi_buflen	= buflen;
22482 	ucmd_buf.uscsi_rqbuf	= NULL;
22483 	ucmd_buf.uscsi_rqlen	= 0;
22484 	ucmd_buf.uscsi_flags	= USCSI_READ | USCSI_SILENT;
22485 	ucmd_buf.uscsi_timeout	= 60;
22486 
22487 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
22488 	    UIO_SYSSPACE, SD_PATH_DIRECT);
22489 
22490 	/*
22491 	 * Only handle status == 0, the upper-level caller
22492 	 * will put different assessment based on the context.
22493 	 */
22494 	if (status == 0) {
22495 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
22496 
22497 		if (ucmd_buf.uscsi_resid != 0) {
22498 			status = EIO;
22499 		}
22500 	}
22501 
22502 	SD_TRACE(SD_LOG_IO, un,
22503 	    "sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION: exit\n");
22504 
22505 	return (status);
22506 }
22507 
22508 
22509 static boolean_t
22510 sd_gesn_media_data_valid(uchar_t *data)
22511 {
22512 	uint16_t			len;
22513 
22514 	len = (data[1] << 8) | data[0];
22515 	return ((len >= 6) &&
22516 	    ((data[2] & SD_GESN_HEADER_NEA) == 0) &&
22517 	    ((data[2] & SD_GESN_HEADER_CLASS) == SD_GESN_MEDIA_CLASS) &&
22518 	    ((data[3] & (1 << SD_GESN_MEDIA_CLASS)) != 0));
22519 }
22520 
22521 
22522 /*
22523  *    Function: sdioctl
22524  *
22525  * Description: Driver's ioctl(9e) entry point function.
22526  *
22527  *   Arguments: dev     - device number
22528  *		cmd     - ioctl operation to be performed
22529  *		arg     - user argument, contains data to be set or reference
22530  *			  parameter for get
22531  *		flag    - bit flag, indicating open settings, 32/64 bit type
22532  *		cred_p  - user credential pointer
22533  *		rval_p  - calling process return value (OPT)
22534  *
22535  * Return Code: EINVAL
22536  *		ENOTTY
22537  *		ENXIO
22538  *		EIO
22539  *		EFAULT
22540  *		ENOTSUP
22541  *		EPERM
22542  *
22543  *     Context: Called from the device switch at normal priority.
22544  */
22545 
22546 static int
22547 sdioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cred_p, int *rval_p)
22548 {
22549 	struct sd_lun	*un = NULL;
22550 	int		err = 0;
22551 	int		i = 0;
22552 	cred_t		*cr;
22553 	int		tmprval = EINVAL;
22554 	boolean_t	is_valid;
22555 	sd_ssc_t	*ssc;
22556 
22557 	/*
22558 	 * All device accesses go thru sdstrategy where we check on suspend
22559 	 * status
22560 	 */
22561 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
22562 		return (ENXIO);
22563 	}
22564 
22565 	ASSERT(!mutex_owned(SD_MUTEX(un)));
22566 
22567 	/* Initialize sd_ssc_t for internal uscsi commands */
22568 	ssc = sd_ssc_init(un);
22569 
22570 	is_valid = SD_IS_VALID_LABEL(un);
22571 
22572 	/*
22573 	 * Moved this wait from sd_uscsi_strategy to here for
22574 	 * reasons of deadlock prevention. Internal driver commands,
22575 	 * specifically those to change a devices power level, result
22576 	 * in a call to sd_uscsi_strategy.
22577 	 */
22578 	mutex_enter(SD_MUTEX(un));
22579 	while ((un->un_state == SD_STATE_SUSPENDED) ||
22580 	    (un->un_state == SD_STATE_PM_CHANGING)) {
22581 		cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
22582 	}
22583 	/*
22584 	 * Twiddling the counter here protects commands from now
22585 	 * through to the top of sd_uscsi_strategy. Without the
22586 	 * counter inc. a power down, for example, could get in
22587 	 * after the above check for state is made and before
22588 	 * execution gets to the top of sd_uscsi_strategy.
22589 	 * That would cause problems.
22590 	 */
22591 	un->un_ncmds_in_driver++;
22592 
22593 	if (!is_valid &&
22594 	    (flag & (FNDELAY | FNONBLOCK))) {
22595 		switch (cmd) {
22596 		case DKIOCGGEOM:	/* SD_PATH_DIRECT */
22597 		case DKIOCGVTOC:
22598 		case DKIOCGEXTVTOC:
22599 		case DKIOCGAPART:
22600 		case DKIOCPARTINFO:
22601 		case DKIOCEXTPARTINFO:
22602 		case DKIOCSGEOM:
22603 		case DKIOCSAPART:
22604 		case DKIOCGETEFI:
22605 		case DKIOCPARTITION:
22606 		case DKIOCSVTOC:
22607 		case DKIOCSEXTVTOC:
22608 		case DKIOCSETEFI:
22609 		case DKIOCGMBOOT:
22610 		case DKIOCSMBOOT:
22611 		case DKIOCG_PHYGEOM:
22612 		case DKIOCG_VIRTGEOM:
22613 #if defined(__i386) || defined(__amd64)
22614 		case DKIOCSETEXTPART:
22615 #endif
22616 			/* let cmlb handle it */
22617 			goto skip_ready_valid;
22618 
22619 		case CDROMPAUSE:
22620 		case CDROMRESUME:
22621 		case CDROMPLAYMSF:
22622 		case CDROMPLAYTRKIND:
22623 		case CDROMREADTOCHDR:
22624 		case CDROMREADTOCENTRY:
22625 		case CDROMSTOP:
22626 		case CDROMSTART:
22627 		case CDROMVOLCTRL:
22628 		case CDROMSUBCHNL:
22629 		case CDROMREADMODE2:
22630 		case CDROMREADMODE1:
22631 		case CDROMREADOFFSET:
22632 		case CDROMSBLKMODE:
22633 		case CDROMGBLKMODE:
22634 		case CDROMGDRVSPEED:
22635 		case CDROMSDRVSPEED:
22636 		case CDROMCDDA:
22637 		case CDROMCDXA:
22638 		case CDROMSUBCODE:
22639 			if (!ISCD(un)) {
22640 				un->un_ncmds_in_driver--;
22641 				ASSERT(un->un_ncmds_in_driver >= 0);
22642 				mutex_exit(SD_MUTEX(un));
22643 				err = ENOTTY;
22644 				goto done_without_assess;
22645 			}
22646 			break;
22647 		case FDEJECT:
22648 		case DKIOCEJECT:
22649 		case CDROMEJECT:
22650 			if (!un->un_f_eject_media_supported) {
22651 				un->un_ncmds_in_driver--;
22652 				ASSERT(un->un_ncmds_in_driver >= 0);
22653 				mutex_exit(SD_MUTEX(un));
22654 				err = ENOTTY;
22655 				goto done_without_assess;
22656 			}
22657 			break;
22658 		case DKIOCFLUSHWRITECACHE:
22659 			mutex_exit(SD_MUTEX(un));
22660 			err = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
22661 			if (err != 0) {
22662 				mutex_enter(SD_MUTEX(un));
22663 				un->un_ncmds_in_driver--;
22664 				ASSERT(un->un_ncmds_in_driver >= 0);
22665 				mutex_exit(SD_MUTEX(un));
22666 				err = EIO;
22667 				goto done_quick_assess;
22668 			}
22669 			mutex_enter(SD_MUTEX(un));
22670 			/* FALLTHROUGH */
22671 		case DKIOCREMOVABLE:
22672 		case DKIOCHOTPLUGGABLE:
22673 		case DKIOCINFO:
22674 		case DKIOCGMEDIAINFO:
22675 		case DKIOCGMEDIAINFOEXT:
22676 		case DKIOCSOLIDSTATE:
22677 		case MHIOCENFAILFAST:
22678 		case MHIOCSTATUS:
22679 		case MHIOCTKOWN:
22680 		case MHIOCRELEASE:
22681 		case MHIOCGRP_INKEYS:
22682 		case MHIOCGRP_INRESV:
22683 		case MHIOCGRP_REGISTER:
22684 		case MHIOCGRP_CLEAR:
22685 		case MHIOCGRP_RESERVE:
22686 		case MHIOCGRP_PREEMPTANDABORT:
22687 		case MHIOCGRP_REGISTERANDIGNOREKEY:
22688 		case CDROMCLOSETRAY:
22689 		case USCSICMD:
22690 		case USCSIMAXXFER:
22691 			goto skip_ready_valid;
22692 		default:
22693 			break;
22694 		}
22695 
22696 		mutex_exit(SD_MUTEX(un));
22697 		err = sd_ready_and_valid(ssc, SDPART(dev));
22698 		mutex_enter(SD_MUTEX(un));
22699 
22700 		if (err != SD_READY_VALID) {
22701 			switch (cmd) {
22702 			case DKIOCSTATE:
22703 			case CDROMGDRVSPEED:
22704 			case CDROMSDRVSPEED:
22705 			case FDEJECT:	/* for eject command */
22706 			case DKIOCEJECT:
22707 			case CDROMEJECT:
22708 			case DKIOCREMOVABLE:
22709 			case DKIOCHOTPLUGGABLE:
22710 				break;
22711 			default:
22712 				if (un->un_f_has_removable_media) {
22713 					err = ENXIO;
22714 				} else {
22715 				/* Do not map SD_RESERVED_BY_OTHERS to EIO */
22716 					if (err == SD_RESERVED_BY_OTHERS) {
22717 						err = EACCES;
22718 					} else {
22719 						err = EIO;
22720 					}
22721 				}
22722 				un->un_ncmds_in_driver--;
22723 				ASSERT(un->un_ncmds_in_driver >= 0);
22724 				mutex_exit(SD_MUTEX(un));
22725 
22726 				goto done_without_assess;
22727 			}
22728 		}
22729 	}
22730 
22731 skip_ready_valid:
22732 	mutex_exit(SD_MUTEX(un));
22733 
22734 	switch (cmd) {
22735 	case DKIOCINFO:
22736 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCINFO\n");
22737 		err = sd_dkio_ctrl_info(dev, (caddr_t)arg, flag);
22738 		break;
22739 
22740 	case DKIOCGMEDIAINFO:
22741 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCGMEDIAINFO\n");
22742 		err = sd_get_media_info(dev, (caddr_t)arg, flag);
22743 		break;
22744 
22745 	case DKIOCGMEDIAINFOEXT:
22746 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCGMEDIAINFOEXT\n");
22747 		err = sd_get_media_info_ext(dev, (caddr_t)arg, flag);
22748 		break;
22749 
22750 	case DKIOCGGEOM:
22751 	case DKIOCGVTOC:
22752 	case DKIOCGEXTVTOC:
22753 	case DKIOCGAPART:
22754 	case DKIOCPARTINFO:
22755 	case DKIOCEXTPARTINFO:
22756 	case DKIOCSGEOM:
22757 	case DKIOCSAPART:
22758 	case DKIOCGETEFI:
22759 	case DKIOCPARTITION:
22760 	case DKIOCSVTOC:
22761 	case DKIOCSEXTVTOC:
22762 	case DKIOCSETEFI:
22763 	case DKIOCGMBOOT:
22764 	case DKIOCSMBOOT:
22765 	case DKIOCG_PHYGEOM:
22766 	case DKIOCG_VIRTGEOM:
22767 #if defined(__i386) || defined(__amd64)
22768 	case DKIOCSETEXTPART:
22769 #endif
22770 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOC %d\n", cmd);
22771 
22772 		/* TUR should spin up */
22773 
22774 		if (un->un_f_has_removable_media)
22775 			err = sd_send_scsi_TEST_UNIT_READY(ssc,
22776 			    SD_CHECK_FOR_MEDIA);
22777 
22778 		else
22779 			err = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
22780 
22781 		if (err != 0)
22782 			goto done_with_assess;
22783 
22784 		err = cmlb_ioctl(un->un_cmlbhandle, dev,
22785 		    cmd, arg, flag, cred_p, rval_p, (void *)SD_PATH_DIRECT);
22786 
22787 		if ((err == 0) &&
22788 		    ((cmd == DKIOCSETEFI) ||
22789 		    ((un->un_f_pkstats_enabled) &&
22790 		    (cmd == DKIOCSAPART || cmd == DKIOCSVTOC ||
22791 		    cmd == DKIOCSEXTVTOC)))) {
22792 
22793 			tmprval = cmlb_validate(un->un_cmlbhandle, CMLB_SILENT,
22794 			    (void *)SD_PATH_DIRECT);
22795 			if ((tmprval == 0) && un->un_f_pkstats_enabled) {
22796 				sd_set_pstats(un);
22797 				SD_TRACE(SD_LOG_IO_PARTITION, un,
22798 				    "sd_ioctl: un:0x%p pstats created and "
22799 				    "set\n", un);
22800 			}
22801 		}
22802 
22803 		if ((cmd == DKIOCSVTOC || cmd == DKIOCSEXTVTOC) ||
22804 		    ((cmd == DKIOCSETEFI) && (tmprval == 0))) {
22805 
22806 			mutex_enter(SD_MUTEX(un));
22807 			if (un->un_f_devid_supported &&
22808 			    (un->un_f_opt_fab_devid == TRUE)) {
22809 				if (un->un_devid == NULL) {
22810 					sd_register_devid(ssc, SD_DEVINFO(un),
22811 					    SD_TARGET_IS_UNRESERVED);
22812 				} else {
22813 					/*
22814 					 * The device id for this disk
22815 					 * has been fabricated. The
22816 					 * device id must be preserved
22817 					 * by writing it back out to
22818 					 * disk.
22819 					 */
22820 					if (sd_write_deviceid(ssc) != 0) {
22821 						ddi_devid_free(un->un_devid);
22822 						un->un_devid = NULL;
22823 					}
22824 				}
22825 			}
22826 			mutex_exit(SD_MUTEX(un));
22827 		}
22828 
22829 		break;
22830 
22831 	case DKIOCLOCK:
22832 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCLOCK\n");
22833 		err = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_PREVENT,
22834 		    SD_PATH_STANDARD);
22835 		goto done_with_assess;
22836 
22837 	case DKIOCUNLOCK:
22838 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCUNLOCK\n");
22839 		err = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_ALLOW,
22840 		    SD_PATH_STANDARD);
22841 		goto done_with_assess;
22842 
22843 	case DKIOCSTATE: {
22844 		enum dkio_state		state;
22845 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCSTATE\n");
22846 
22847 		if (ddi_copyin((void *)arg, &state, sizeof (int), flag) != 0) {
22848 			err = EFAULT;
22849 		} else {
22850 			err = sd_check_media(dev, state);
22851 			if (err == 0) {
22852 				if (ddi_copyout(&un->un_mediastate, (void *)arg,
22853 				    sizeof (int), flag) != 0)
22854 					err = EFAULT;
22855 			}
22856 		}
22857 		break;
22858 	}
22859 
22860 	case DKIOCREMOVABLE:
22861 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCREMOVABLE\n");
22862 		i = un->un_f_has_removable_media ? 1 : 0;
22863 		if (ddi_copyout(&i, (void *)arg, sizeof (int), flag) != 0) {
22864 			err = EFAULT;
22865 		} else {
22866 			err = 0;
22867 		}
22868 		break;
22869 
22870 	case DKIOCSOLIDSTATE:
22871 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCSOLIDSTATE\n");
22872 		i = un->un_f_is_solid_state ? 1 : 0;
22873 		if (ddi_copyout(&i, (void *)arg, sizeof (int), flag) != 0) {
22874 			err = EFAULT;
22875 		} else {
22876 			err = 0;
22877 		}
22878 		break;
22879 
22880 	case DKIOCHOTPLUGGABLE:
22881 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCHOTPLUGGABLE\n");
22882 		i = un->un_f_is_hotpluggable ? 1 : 0;
22883 		if (ddi_copyout(&i, (void *)arg, sizeof (int), flag) != 0) {
22884 			err = EFAULT;
22885 		} else {
22886 			err = 0;
22887 		}
22888 		break;
22889 
22890 	case DKIOCREADONLY:
22891 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCREADONLY\n");
22892 		i = 0;
22893 		if ((ISCD(un) && !un->un_f_mmc_writable_media) ||
22894 		    (sr_check_wp(dev) != 0)) {
22895 			i = 1;
22896 		}
22897 		if (ddi_copyout(&i, (void *)arg, sizeof (int), flag) != 0) {
22898 			err = EFAULT;
22899 		} else {
22900 			err = 0;
22901 		}
22902 		break;
22903 
22904 	case DKIOCGTEMPERATURE:
22905 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCGTEMPERATURE\n");
22906 		err = sd_dkio_get_temp(dev, (caddr_t)arg, flag);
22907 		break;
22908 
22909 	case MHIOCENFAILFAST:
22910 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCENFAILFAST\n");
22911 		if ((err = drv_priv(cred_p)) == 0) {
22912 			err = sd_mhdioc_failfast(dev, (caddr_t)arg, flag);
22913 		}
22914 		break;
22915 
22916 	case MHIOCTKOWN:
22917 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCTKOWN\n");
22918 		if ((err = drv_priv(cred_p)) == 0) {
22919 			err = sd_mhdioc_takeown(dev, (caddr_t)arg, flag);
22920 		}
22921 		break;
22922 
22923 	case MHIOCRELEASE:
22924 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCRELEASE\n");
22925 		if ((err = drv_priv(cred_p)) == 0) {
22926 			err = sd_mhdioc_release(dev);
22927 		}
22928 		break;
22929 
22930 	case MHIOCSTATUS:
22931 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCSTATUS\n");
22932 		if ((err = drv_priv(cred_p)) == 0) {
22933 			switch (sd_send_scsi_TEST_UNIT_READY(ssc, 0)) {
22934 			case 0:
22935 				err = 0;
22936 				break;
22937 			case EACCES:
22938 				*rval_p = 1;
22939 				err = 0;
22940 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
22941 				break;
22942 			default:
22943 				err = EIO;
22944 				goto done_with_assess;
22945 			}
22946 		}
22947 		break;
22948 
22949 	case MHIOCQRESERVE:
22950 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCQRESERVE\n");
22951 		if ((err = drv_priv(cred_p)) == 0) {
22952 			err = sd_reserve_release(dev, SD_RESERVE);
22953 		}
22954 		break;
22955 
22956 	case MHIOCREREGISTERDEVID:
22957 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCREREGISTERDEVID\n");
22958 		if (drv_priv(cred_p) == EPERM) {
22959 			err = EPERM;
22960 		} else if (!un->un_f_devid_supported) {
22961 			err = ENOTTY;
22962 		} else {
22963 			err = sd_mhdioc_register_devid(dev);
22964 		}
22965 		break;
22966 
22967 	case MHIOCGRP_INKEYS:
22968 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_INKEYS\n");
22969 		if (((err = drv_priv(cred_p)) != EPERM) &&
22970 		    arg != (intptr_t)NULL) {
22971 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22972 				err = ENOTSUP;
22973 			} else {
22974 				err = sd_mhdioc_inkeys(dev, (caddr_t)arg,
22975 				    flag);
22976 			}
22977 		}
22978 		break;
22979 
22980 	case MHIOCGRP_INRESV:
22981 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_INRESV\n");
22982 		if (((err = drv_priv(cred_p)) != EPERM) &&
22983 		    arg != (intptr_t)NULL) {
22984 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22985 				err = ENOTSUP;
22986 			} else {
22987 				err = sd_mhdioc_inresv(dev, (caddr_t)arg, flag);
22988 			}
22989 		}
22990 		break;
22991 
22992 	case MHIOCGRP_REGISTER:
22993 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_REGISTER\n");
22994 		if ((err = drv_priv(cred_p)) != EPERM) {
22995 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22996 				err = ENOTSUP;
22997 			} else if (arg != (intptr_t)NULL) {
22998 				mhioc_register_t reg;
22999 				if (ddi_copyin((void *)arg, &reg,
23000 				    sizeof (mhioc_register_t), flag) != 0) {
23001 					err = EFAULT;
23002 				} else {
23003 					err =
23004 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
23005 					    ssc, SD_SCSI3_REGISTER,
23006 					    (uchar_t *)&reg);
23007 					if (err != 0)
23008 						goto done_with_assess;
23009 				}
23010 			}
23011 		}
23012 		break;
23013 
23014 	case MHIOCGRP_CLEAR:
23015 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_CLEAR\n");
23016 		if ((err = drv_priv(cred_p)) != EPERM) {
23017 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
23018 				err = ENOTSUP;
23019 			} else if (arg != (intptr_t)NULL) {
23020 				mhioc_register_t reg;
23021 				if (ddi_copyin((void *)arg, &reg,
23022 				    sizeof (mhioc_register_t), flag) != 0) {
23023 					err = EFAULT;
23024 				} else {
23025 					err =
23026 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
23027 					    ssc, SD_SCSI3_CLEAR,
23028 					    (uchar_t *)&reg);
23029 					if (err != 0)
23030 						goto done_with_assess;
23031 				}
23032 			}
23033 		}
23034 		break;
23035 
23036 	case MHIOCGRP_RESERVE:
23037 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_RESERVE\n");
23038 		if ((err = drv_priv(cred_p)) != EPERM) {
23039 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
23040 				err = ENOTSUP;
23041 			} else if (arg != (intptr_t)NULL) {
23042 				mhioc_resv_desc_t resv_desc;
23043 				if (ddi_copyin((void *)arg, &resv_desc,
23044 				    sizeof (mhioc_resv_desc_t), flag) != 0) {
23045 					err = EFAULT;
23046 				} else {
23047 					err =
23048 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
23049 					    ssc, SD_SCSI3_RESERVE,
23050 					    (uchar_t *)&resv_desc);
23051 					if (err != 0)
23052 						goto done_with_assess;
23053 				}
23054 			}
23055 		}
23056 		break;
23057 
23058 	case MHIOCGRP_PREEMPTANDABORT:
23059 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_PREEMPTANDABORT\n");
23060 		if ((err = drv_priv(cred_p)) != EPERM) {
23061 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
23062 				err = ENOTSUP;
23063 			} else if (arg != (intptr_t)NULL) {
23064 				mhioc_preemptandabort_t preempt_abort;
23065 				if (ddi_copyin((void *)arg, &preempt_abort,
23066 				    sizeof (mhioc_preemptandabort_t),
23067 				    flag) != 0) {
23068 					err = EFAULT;
23069 				} else {
23070 					err =
23071 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
23072 					    ssc, SD_SCSI3_PREEMPTANDABORT,
23073 					    (uchar_t *)&preempt_abort);
23074 					if (err != 0)
23075 						goto done_with_assess;
23076 				}
23077 			}
23078 		}
23079 		break;
23080 
23081 	case MHIOCGRP_REGISTERANDIGNOREKEY:
23082 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_REGISTERANDIGNOREKEY\n");
23083 		if ((err = drv_priv(cred_p)) != EPERM) {
23084 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
23085 				err = ENOTSUP;
23086 			} else if (arg != (intptr_t)NULL) {
23087 				mhioc_registerandignorekey_t r_and_i;
23088 				if (ddi_copyin((void *)arg, (void *)&r_and_i,
23089 				    sizeof (mhioc_registerandignorekey_t),
23090 				    flag) != 0) {
23091 					err = EFAULT;
23092 				} else {
23093 					err =
23094 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
23095 					    ssc, SD_SCSI3_REGISTERANDIGNOREKEY,
23096 					    (uchar_t *)&r_and_i);
23097 					if (err != 0)
23098 						goto done_with_assess;
23099 				}
23100 			}
23101 		}
23102 		break;
23103 
23104 	case USCSICMD:
23105 		SD_TRACE(SD_LOG_IOCTL, un, "USCSICMD\n");
23106 		cr = ddi_get_cred();
23107 		if ((drv_priv(cred_p) != 0) && (drv_priv(cr) != 0)) {
23108 			err = EPERM;
23109 		} else {
23110 			enum uio_seg	uioseg;
23111 
23112 			uioseg = (flag & FKIOCTL) ? UIO_SYSSPACE :
23113 			    UIO_USERSPACE;
23114 			if (un->un_f_format_in_progress == TRUE) {
23115 				err = EAGAIN;
23116 				break;
23117 			}
23118 
23119 			err = sd_ssc_send(ssc,
23120 			    (struct uscsi_cmd *)arg,
23121 			    flag, uioseg, SD_PATH_STANDARD);
23122 			if (err != 0)
23123 				goto done_with_assess;
23124 			else
23125 				sd_ssc_assessment(ssc, SD_FMT_STANDARD);
23126 		}
23127 		break;
23128 
23129 	case USCSIMAXXFER:
23130 		SD_TRACE(SD_LOG_IOCTL, un, "USCSIMAXXFER\n");
23131 		cr = ddi_get_cred();
23132 		if ((drv_priv(cred_p) != 0) && (drv_priv(cr) != 0)) {
23133 			err = EPERM;
23134 		} else {
23135 			const uscsi_xfer_t xfer = un->un_max_xfer_size;
23136 
23137 			if (ddi_copyout(&xfer, (void *)arg, sizeof (xfer),
23138 			    flag) != 0) {
23139 				err = EFAULT;
23140 			} else {
23141 				err = 0;
23142 			}
23143 		}
23144 		break;
23145 
23146 	case CDROMPAUSE:
23147 	case CDROMRESUME:
23148 		SD_TRACE(SD_LOG_IOCTL, un, "PAUSE-RESUME\n");
23149 		if (!ISCD(un)) {
23150 			err = ENOTTY;
23151 		} else {
23152 			err = sr_pause_resume(dev, cmd);
23153 		}
23154 		break;
23155 
23156 	case CDROMPLAYMSF:
23157 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMPLAYMSF\n");
23158 		if (!ISCD(un)) {
23159 			err = ENOTTY;
23160 		} else {
23161 			err = sr_play_msf(dev, (caddr_t)arg, flag);
23162 		}
23163 		break;
23164 
23165 	case CDROMPLAYTRKIND:
23166 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMPLAYTRKIND\n");
23167 #if defined(__i386) || defined(__amd64)
23168 		/*
23169 		 * not supported on ATAPI CD drives, use CDROMPLAYMSF instead
23170 		 */
23171 		if (!ISCD(un) || (un->un_f_cfg_is_atapi == TRUE)) {
23172 #else
23173 		if (!ISCD(un)) {
23174 #endif
23175 			err = ENOTTY;
23176 		} else {
23177 			err = sr_play_trkind(dev, (caddr_t)arg, flag);
23178 		}
23179 		break;
23180 
23181 	case CDROMREADTOCHDR:
23182 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADTOCHDR\n");
23183 		if (!ISCD(un)) {
23184 			err = ENOTTY;
23185 		} else {
23186 			err = sr_read_tochdr(dev, (caddr_t)arg, flag);
23187 		}
23188 		break;
23189 
23190 	case CDROMREADTOCENTRY:
23191 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADTOCENTRY\n");
23192 		if (!ISCD(un)) {
23193 			err = ENOTTY;
23194 		} else {
23195 			err = sr_read_tocentry(dev, (caddr_t)arg, flag);
23196 		}
23197 		break;
23198 
23199 	case CDROMSTOP:
23200 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSTOP\n");
23201 		if (!ISCD(un)) {
23202 			err = ENOTTY;
23203 		} else {
23204 			err = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
23205 			    SD_TARGET_STOP, SD_PATH_STANDARD);
23206 			goto done_with_assess;
23207 		}
23208 		break;
23209 
23210 	case CDROMSTART:
23211 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSTART\n");
23212 		if (!ISCD(un)) {
23213 			err = ENOTTY;
23214 		} else {
23215 			err = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
23216 			    SD_TARGET_START, SD_PATH_STANDARD);
23217 			goto done_with_assess;
23218 		}
23219 		break;
23220 
23221 	case CDROMCLOSETRAY:
23222 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMCLOSETRAY\n");
23223 		if (!ISCD(un)) {
23224 			err = ENOTTY;
23225 		} else {
23226 			err = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
23227 			    SD_TARGET_CLOSE, SD_PATH_STANDARD);
23228 			goto done_with_assess;
23229 		}
23230 		break;
23231 
23232 	case FDEJECT:	/* for eject command */
23233 	case DKIOCEJECT:
23234 	case CDROMEJECT:
23235 		SD_TRACE(SD_LOG_IOCTL, un, "EJECT\n");
23236 		if (!un->un_f_eject_media_supported) {
23237 			err = ENOTTY;
23238 		} else {
23239 			err = sr_eject(dev);
23240 		}
23241 		break;
23242 
23243 	case CDROMVOLCTRL:
23244 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMVOLCTRL\n");
23245 		if (!ISCD(un)) {
23246 			err = ENOTTY;
23247 		} else {
23248 			err = sr_volume_ctrl(dev, (caddr_t)arg, flag);
23249 		}
23250 		break;
23251 
23252 	case CDROMSUBCHNL:
23253 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSUBCHNL\n");
23254 		if (!ISCD(un)) {
23255 			err = ENOTTY;
23256 		} else {
23257 			err = sr_read_subchannel(dev, (caddr_t)arg, flag);
23258 		}
23259 		break;
23260 
23261 	case CDROMREADMODE2:
23262 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADMODE2\n");
23263 		if (!ISCD(un)) {
23264 			err = ENOTTY;
23265 		} else if (un->un_f_cfg_is_atapi == TRUE) {
23266 			/*
23267 			 * If the drive supports READ CD, use that instead of
23268 			 * switching the LBA size via a MODE SELECT
23269 			 * Block Descriptor
23270 			 */
23271 			err = sr_read_cd_mode2(dev, (caddr_t)arg, flag);
23272 		} else {
23273 			err = sr_read_mode2(dev, (caddr_t)arg, flag);
23274 		}
23275 		break;
23276 
23277 	case CDROMREADMODE1:
23278 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADMODE1\n");
23279 		if (!ISCD(un)) {
23280 			err = ENOTTY;
23281 		} else {
23282 			err = sr_read_mode1(dev, (caddr_t)arg, flag);
23283 		}
23284 		break;
23285 
23286 	case CDROMREADOFFSET:
23287 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADOFFSET\n");
23288 		if (!ISCD(un)) {
23289 			err = ENOTTY;
23290 		} else {
23291 			err = sr_read_sony_session_offset(dev, (caddr_t)arg,
23292 			    flag);
23293 		}
23294 		break;
23295 
23296 	case CDROMSBLKMODE:
23297 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSBLKMODE\n");
23298 		/*
23299 		 * There is no means of changing block size in case of atapi
23300 		 * drives, thus return ENOTTY if drive type is atapi
23301 		 */
23302 		if (!ISCD(un) || (un->un_f_cfg_is_atapi == TRUE)) {
23303 			err = ENOTTY;
23304 		} else if (un->un_f_mmc_cap == TRUE) {
23305 
23306 			/*
23307 			 * MMC Devices do not support changing the
23308 			 * logical block size
23309 			 *
23310 			 * Note: EINVAL is being returned instead of ENOTTY to
23311 			 * maintain consistancy with the original mmc
23312 			 * driver update.
23313 			 */
23314 			err = EINVAL;
23315 		} else {
23316 			mutex_enter(SD_MUTEX(un));
23317 			if ((!(un->un_exclopen & (1<<SDPART(dev)))) ||
23318 			    (un->un_ncmds_in_transport > 0)) {
23319 				mutex_exit(SD_MUTEX(un));
23320 				err = EINVAL;
23321 			} else {
23322 				mutex_exit(SD_MUTEX(un));
23323 				err = sr_change_blkmode(dev, cmd, arg, flag);
23324 			}
23325 		}
23326 		break;
23327 
23328 	case CDROMGBLKMODE:
23329 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMGBLKMODE\n");
23330 		if (!ISCD(un)) {
23331 			err = ENOTTY;
23332 		} else if ((un->un_f_cfg_is_atapi != FALSE) &&
23333 		    (un->un_f_blockcount_is_valid != FALSE)) {
23334 			/*
23335 			 * Drive is an ATAPI drive so return target block
23336 			 * size for ATAPI drives since we cannot change the
23337 			 * blocksize on ATAPI drives. Used primarily to detect
23338 			 * if an ATAPI cdrom is present.
23339 			 */
23340 			if (ddi_copyout(&un->un_tgt_blocksize, (void *)arg,
23341 			    sizeof (int), flag) != 0) {
23342 				err = EFAULT;
23343 			} else {
23344 				err = 0;
23345 			}
23346 
23347 		} else {
23348 			/*
23349 			 * Drive supports changing block sizes via a Mode
23350 			 * Select.
23351 			 */
23352 			err = sr_change_blkmode(dev, cmd, arg, flag);
23353 		}
23354 		break;
23355 
23356 	case CDROMGDRVSPEED:
23357 	case CDROMSDRVSPEED:
23358 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMXDRVSPEED\n");
23359 		if (!ISCD(un)) {
23360 			err = ENOTTY;
23361 		} else if (un->un_f_mmc_cap == TRUE) {
23362 			/*
23363 			 * Note: In the future the driver implementation
23364 			 * for getting and
23365 			 * setting cd speed should entail:
23366 			 * 1) If non-mmc try the Toshiba mode page
23367 			 *    (sr_change_speed)
23368 			 * 2) If mmc but no support for Real Time Streaming try
23369 			 *    the SET CD SPEED (0xBB) command
23370 			 *   (sr_atapi_change_speed)
23371 			 * 3) If mmc and support for Real Time Streaming
23372 			 *    try the GET PERFORMANCE and SET STREAMING
23373 			 *    commands (not yet implemented, 4380808)
23374 			 */
23375 			/*
23376 			 * As per recent MMC spec, CD-ROM speed is variable
23377 			 * and changes with LBA. Since there is no such
23378 			 * things as drive speed now, fail this ioctl.
23379 			 *
23380 			 * Note: EINVAL is returned for consistancy of original
23381 			 * implementation which included support for getting
23382 			 * the drive speed of mmc devices but not setting
23383 			 * the drive speed. Thus EINVAL would be returned
23384 			 * if a set request was made for an mmc device.
23385 			 * We no longer support get or set speed for
23386 			 * mmc but need to remain consistent with regard
23387 			 * to the error code returned.
23388 			 */
23389 			err = EINVAL;
23390 		} else if (un->un_f_cfg_is_atapi == TRUE) {
23391 			err = sr_atapi_change_speed(dev, cmd, arg, flag);
23392 		} else {
23393 			err = sr_change_speed(dev, cmd, arg, flag);
23394 		}
23395 		break;
23396 
23397 	case CDROMCDDA:
23398 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMCDDA\n");
23399 		if (!ISCD(un)) {
23400 			err = ENOTTY;
23401 		} else {
23402 			err = sr_read_cdda(dev, (void *)arg, flag);
23403 		}
23404 		break;
23405 
23406 	case CDROMCDXA:
23407 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMCDXA\n");
23408 		if (!ISCD(un)) {
23409 			err = ENOTTY;
23410 		} else {
23411 			err = sr_read_cdxa(dev, (caddr_t)arg, flag);
23412 		}
23413 		break;
23414 
23415 	case CDROMSUBCODE:
23416 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSUBCODE\n");
23417 		if (!ISCD(un)) {
23418 			err = ENOTTY;
23419 		} else {
23420 			err = sr_read_all_subcodes(dev, (caddr_t)arg, flag);
23421 		}
23422 		break;
23423 
23424 
23425 #ifdef SDDEBUG
23426 /* RESET/ABORTS testing ioctls */
23427 	case DKIOCRESET: {
23428 		int	reset_level;
23429 
23430 		if (ddi_copyin((void *)arg, &reset_level, sizeof (int), flag)) {
23431 			err = EFAULT;
23432 		} else {
23433 			SD_INFO(SD_LOG_IOCTL, un, "sdioctl: DKIOCRESET: "
23434 			    "reset_level = 0x%lx\n", reset_level);
23435 			if (scsi_reset(SD_ADDRESS(un), reset_level)) {
23436 				err = 0;
23437 			} else {
23438 				err = EIO;
23439 			}
23440 		}
23441 		break;
23442 	}
23443 
23444 	case DKIOCABORT:
23445 		SD_INFO(SD_LOG_IOCTL, un, "sdioctl: DKIOCABORT:\n");
23446 		if (scsi_abort(SD_ADDRESS(un), NULL)) {
23447 			err = 0;
23448 		} else {
23449 			err = EIO;
23450 		}
23451 		break;
23452 #endif
23453 
23454 #ifdef SD_FAULT_INJECTION
23455 /* SDIOC FaultInjection testing ioctls */
23456 	case SDIOCSTART:
23457 	case SDIOCSTOP:
23458 	case SDIOCINSERTPKT:
23459 	case SDIOCINSERTXB:
23460 	case SDIOCINSERTUN:
23461 	case SDIOCINSERTARQ:
23462 	case SDIOCPUSH:
23463 	case SDIOCRETRIEVE:
23464 	case SDIOCRUN:
23465 		SD_INFO(SD_LOG_SDTEST, un, "sdioctl:"
23466 		    "SDIOC detected cmd:0x%X:\n", cmd);
23467 		/* call error generator */
23468 		sd_faultinjection_ioctl(cmd, arg, un);
23469 		err = 0;
23470 		break;
23471 
23472 #endif /* SD_FAULT_INJECTION */
23473 
23474 	case DKIOCFLUSHWRITECACHE:
23475 		{
23476 			struct dk_callback *dkc = (struct dk_callback *)arg;
23477 
23478 			mutex_enter(SD_MUTEX(un));
23479 			if (!un->un_f_sync_cache_supported ||
23480 			    !un->un_f_write_cache_enabled) {
23481 				err = un->un_f_sync_cache_supported ?
23482 				    0 : ENOTSUP;
23483 				mutex_exit(SD_MUTEX(un));
23484 				if ((flag & FKIOCTL) && dkc != NULL &&
23485 				    dkc->dkc_callback != NULL) {
23486 					(*dkc->dkc_callback)(dkc->dkc_cookie,
23487 					    err);
23488 					/*
23489 					 * Did callback and reported error.
23490 					 * Since we did a callback, ioctl
23491 					 * should return 0.
23492 					 */
23493 					err = 0;
23494 				}
23495 				break;
23496 			}
23497 			mutex_exit(SD_MUTEX(un));
23498 
23499 			if ((flag & FKIOCTL) && dkc != NULL &&
23500 			    dkc->dkc_callback != NULL) {
23501 				/* async SYNC CACHE request */
23502 				err = sd_send_scsi_SYNCHRONIZE_CACHE(un, dkc);
23503 			} else {
23504 				/* synchronous SYNC CACHE request */
23505 				err = sd_send_scsi_SYNCHRONIZE_CACHE(un, NULL);
23506 			}
23507 		}
23508 		break;
23509 
23510 	case DKIOCFREE:
23511 		{
23512 			dkioc_free_list_t *dfl = (dkioc_free_list_t *)arg;
23513 
23514 			/* bad ioctls shouldn't panic */
23515 			if (dfl == NULL) {
23516 				/* check kernel callers strictly in debug */
23517 				ASSERT0(flag & FKIOCTL);
23518 				err = SET_ERROR(EINVAL);
23519 				break;
23520 			}
23521 			/* synchronous UNMAP request */
23522 			err = sd_send_scsi_UNMAP(dev, ssc, dfl, flag);
23523 		}
23524 		break;
23525 
23526 	case DKIOCGETWCE: {
23527 
23528 		int wce;
23529 
23530 		if ((err = sd_get_write_cache_enabled(ssc, &wce)) != 0) {
23531 			break;
23532 		}
23533 
23534 		if (ddi_copyout(&wce, (void *)arg, sizeof (wce), flag)) {
23535 			err = EFAULT;
23536 		}
23537 		break;
23538 	}
23539 
23540 	case DKIOCSETWCE: {
23541 
23542 		int wce, sync_supported;
23543 		int cur_wce = 0;
23544 
23545 		if (!un->un_f_cache_mode_changeable) {
23546 			err = EINVAL;
23547 			break;
23548 		}
23549 
23550 		if (ddi_copyin((void *)arg, &wce, sizeof (wce), flag)) {
23551 			err = EFAULT;
23552 			break;
23553 		}
23554 
23555 		/*
23556 		 * Synchronize multiple threads trying to enable
23557 		 * or disable the cache via the un_f_wcc_cv
23558 		 * condition variable.
23559 		 */
23560 		mutex_enter(SD_MUTEX(un));
23561 
23562 		/*
23563 		 * Don't allow the cache to be enabled if the
23564 		 * config file has it disabled.
23565 		 */
23566 		if (un->un_f_opt_disable_cache && wce) {
23567 			mutex_exit(SD_MUTEX(un));
23568 			err = EINVAL;
23569 			break;
23570 		}
23571 
23572 		/*
23573 		 * Wait for write cache change in progress
23574 		 * bit to be clear before proceeding.
23575 		 */
23576 		while (un->un_f_wcc_inprog)
23577 			cv_wait(&un->un_wcc_cv, SD_MUTEX(un));
23578 
23579 		un->un_f_wcc_inprog = 1;
23580 
23581 		mutex_exit(SD_MUTEX(un));
23582 
23583 		/*
23584 		 * Get the current write cache state
23585 		 */
23586 		if ((err = sd_get_write_cache_enabled(ssc, &cur_wce)) != 0) {
23587 			mutex_enter(SD_MUTEX(un));
23588 			un->un_f_wcc_inprog = 0;
23589 			cv_broadcast(&un->un_wcc_cv);
23590 			mutex_exit(SD_MUTEX(un));
23591 			break;
23592 		}
23593 
23594 		mutex_enter(SD_MUTEX(un));
23595 		un->un_f_write_cache_enabled = (cur_wce != 0);
23596 
23597 		if (un->un_f_write_cache_enabled && wce == 0) {
23598 			/*
23599 			 * Disable the write cache.  Don't clear
23600 			 * un_f_write_cache_enabled until after
23601 			 * the mode select and flush are complete.
23602 			 */
23603 			sync_supported = un->un_f_sync_cache_supported;
23604 
23605 			/*
23606 			 * If cache flush is suppressed, we assume that the
23607 			 * controller firmware will take care of managing the
23608 			 * write cache for us: no need to explicitly
23609 			 * disable it.
23610 			 */
23611 			if (!un->un_f_suppress_cache_flush) {
23612 				mutex_exit(SD_MUTEX(un));
23613 				if ((err = sd_cache_control(ssc,
23614 				    SD_CACHE_NOCHANGE,
23615 				    SD_CACHE_DISABLE)) == 0 &&
23616 				    sync_supported) {
23617 					err = sd_send_scsi_SYNCHRONIZE_CACHE(un,
23618 					    NULL);
23619 				}
23620 			} else {
23621 				mutex_exit(SD_MUTEX(un));
23622 			}
23623 
23624 			mutex_enter(SD_MUTEX(un));
23625 			if (err == 0) {
23626 				un->un_f_write_cache_enabled = 0;
23627 			}
23628 
23629 		} else if (!un->un_f_write_cache_enabled && wce != 0) {
23630 			/*
23631 			 * Set un_f_write_cache_enabled first, so there is
23632 			 * no window where the cache is enabled, but the
23633 			 * bit says it isn't.
23634 			 */
23635 			un->un_f_write_cache_enabled = 1;
23636 
23637 			/*
23638 			 * If cache flush is suppressed, we assume that the
23639 			 * controller firmware will take care of managing the
23640 			 * write cache for us: no need to explicitly
23641 			 * enable it.
23642 			 */
23643 			if (!un->un_f_suppress_cache_flush) {
23644 				mutex_exit(SD_MUTEX(un));
23645 				err = sd_cache_control(ssc, SD_CACHE_NOCHANGE,
23646 				    SD_CACHE_ENABLE);
23647 			} else {
23648 				mutex_exit(SD_MUTEX(un));
23649 			}
23650 
23651 			mutex_enter(SD_MUTEX(un));
23652 
23653 			if (err) {
23654 				un->un_f_write_cache_enabled = 0;
23655 			}
23656 		}
23657 
23658 		un->un_f_wcc_inprog = 0;
23659 		cv_broadcast(&un->un_wcc_cv);
23660 		mutex_exit(SD_MUTEX(un));
23661 		break;
23662 	}
23663 
23664 	default:
23665 		err = ENOTTY;
23666 		break;
23667 	}
23668 	mutex_enter(SD_MUTEX(un));
23669 	un->un_ncmds_in_driver--;
23670 	ASSERT(un->un_ncmds_in_driver >= 0);
23671 	mutex_exit(SD_MUTEX(un));
23672 
23673 
23674 done_without_assess:
23675 	sd_ssc_fini(ssc);
23676 
23677 	SD_TRACE(SD_LOG_IOCTL, un, "sdioctl: exit: %d\n", err);
23678 	return (err);
23679 
23680 done_with_assess:
23681 	mutex_enter(SD_MUTEX(un));
23682 	un->un_ncmds_in_driver--;
23683 	ASSERT(un->un_ncmds_in_driver >= 0);
23684 	mutex_exit(SD_MUTEX(un));
23685 
23686 done_quick_assess:
23687 	if (err != 0)
23688 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23689 	/* Uninitialize sd_ssc_t pointer */
23690 	sd_ssc_fini(ssc);
23691 
23692 	SD_TRACE(SD_LOG_IOCTL, un, "sdioctl: exit: %d\n", err);
23693 	return (err);
23694 }
23695 
23696 
23697 /*
23698  *    Function: sd_dkio_ctrl_info
23699  *
23700  * Description: This routine is the driver entry point for handling controller
23701  *		information ioctl requests (DKIOCINFO).
23702  *
23703  *   Arguments: dev  - the device number
23704  *		arg  - pointer to user provided dk_cinfo structure
23705  *		       specifying the controller type and attributes.
23706  *		flag - this argument is a pass through to ddi_copyxxx()
23707  *		       directly from the mode argument of ioctl().
23708  *
23709  * Return Code: 0
23710  *		EFAULT
23711  *		ENXIO
23712  */
23713 
23714 static int
23715 sd_dkio_ctrl_info(dev_t dev, caddr_t arg, int flag)
23716 {
23717 	struct sd_lun	*un = NULL;
23718 	struct dk_cinfo	*info;
23719 	dev_info_t	*pdip;
23720 	int		lun, tgt;
23721 
23722 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
23723 		return (ENXIO);
23724 	}
23725 
23726 	info = (struct dk_cinfo *)
23727 	    kmem_zalloc(sizeof (struct dk_cinfo), KM_SLEEP);
23728 
23729 	switch (un->un_ctype) {
23730 	case CTYPE_CDROM:
23731 		info->dki_ctype = DKC_CDROM;
23732 		break;
23733 	default:
23734 		info->dki_ctype = DKC_SCSI_CCS;
23735 		break;
23736 	}
23737 	pdip = ddi_get_parent(SD_DEVINFO(un));
23738 	info->dki_cnum = ddi_get_instance(pdip);
23739 	if (strlen(ddi_get_name(pdip)) < DK_DEVLEN) {
23740 		(void) strcpy(info->dki_cname, ddi_get_name(pdip));
23741 	} else {
23742 		(void) strncpy(info->dki_cname, ddi_node_name(pdip),
23743 		    DK_DEVLEN - 1);
23744 	}
23745 
23746 	lun = ddi_prop_get_int(DDI_DEV_T_ANY, SD_DEVINFO(un),
23747 	    DDI_PROP_DONTPASS, SCSI_ADDR_PROP_LUN, 0);
23748 	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, SD_DEVINFO(un),
23749 	    DDI_PROP_DONTPASS, SCSI_ADDR_PROP_TARGET, 0);
23750 
23751 	/* Unit Information */
23752 	info->dki_unit = ddi_get_instance(SD_DEVINFO(un));
23753 	info->dki_slave = ((tgt << 3) | lun);
23754 	(void) strncpy(info->dki_dname, ddi_driver_name(SD_DEVINFO(un)),
23755 	    DK_DEVLEN - 1);
23756 	info->dki_flags = DKI_FMTVOL;
23757 	info->dki_partition = SDPART(dev);
23758 
23759 	/* Max Transfer size of this device in blocks */
23760 	info->dki_maxtransfer = un->un_max_xfer_size / un->un_sys_blocksize;
23761 	info->dki_addr = 0;
23762 	info->dki_space = 0;
23763 	info->dki_prio = 0;
23764 	info->dki_vec = 0;
23765 
23766 	if (ddi_copyout(info, arg, sizeof (struct dk_cinfo), flag) != 0) {
23767 		kmem_free(info, sizeof (struct dk_cinfo));
23768 		return (EFAULT);
23769 	} else {
23770 		kmem_free(info, sizeof (struct dk_cinfo));
23771 		return (0);
23772 	}
23773 }
23774 
23775 /*
23776  *    Function: sd_get_media_info_com
23777  *
23778  * Description: This routine returns the information required to populate
23779  *		the fields for the dk_minfo/dk_minfo_ext structures.
23780  *
23781  *   Arguments: dev		- the device number
23782  *		dki_media_type	- media_type
23783  *		dki_lbsize	- logical block size
23784  *		dki_capacity	- capacity in blocks
23785  *		dki_pbsize	- physical block size (if requested)
23786  *
23787  * Return Code: 0
23788  *		EACCESS
23789  *		EFAULT
23790  *		ENXIO
23791  *		EIO
23792  */
23793 static int
23794 sd_get_media_info_com(dev_t dev, uint_t *dki_media_type, uint_t *dki_lbsize,
23795     diskaddr_t *dki_capacity, uint_t *dki_pbsize)
23796 {
23797 	struct sd_lun		*un = NULL;
23798 	struct uscsi_cmd	com;
23799 	struct scsi_inquiry	*sinq;
23800 	u_longlong_t		media_capacity;
23801 	uint64_t		capacity;
23802 	uint_t			lbasize;
23803 	uint_t			pbsize;
23804 	uchar_t			*out_data;
23805 	uchar_t			*rqbuf;
23806 	int			rval = 0;
23807 	int			rtn;
23808 	sd_ssc_t		*ssc;
23809 
23810 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
23811 	    (un->un_state == SD_STATE_OFFLINE)) {
23812 		return (ENXIO);
23813 	}
23814 
23815 	SD_TRACE(SD_LOG_IOCTL_DKIO, un, "sd_get_media_info_com: entry\n");
23816 
23817 	out_data = kmem_zalloc(SD_PROFILE_HEADER_LEN, KM_SLEEP);
23818 	rqbuf = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
23819 	ssc = sd_ssc_init(un);
23820 
23821 	/* Issue a TUR to determine if the drive is ready with media present */
23822 	rval = sd_send_scsi_TEST_UNIT_READY(ssc, SD_CHECK_FOR_MEDIA);
23823 	if (rval == ENXIO) {
23824 		goto done;
23825 	} else if (rval != 0) {
23826 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23827 	}
23828 
23829 	/* Now get configuration data */
23830 	if (ISCD(un)) {
23831 		*dki_media_type = DK_CDROM;
23832 
23833 		/* Allow SCMD_GET_CONFIGURATION to MMC devices only */
23834 		if (un->un_f_mmc_cap == TRUE) {
23835 			rtn = sd_send_scsi_GET_CONFIGURATION(ssc, &com, rqbuf,
23836 			    SENSE_LENGTH, out_data, SD_PROFILE_HEADER_LEN,
23837 			    SD_PATH_STANDARD);
23838 
23839 			if (rtn) {
23840 				/*
23841 				 * We ignore all failures for CD and need to
23842 				 * put the assessment before processing code
23843 				 * to avoid missing assessment for FMA.
23844 				 */
23845 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23846 				/*
23847 				 * Failed for other than an illegal request
23848 				 * or command not supported
23849 				 */
23850 				if ((com.uscsi_status == STATUS_CHECK) &&
23851 				    (com.uscsi_rqstatus == STATUS_GOOD)) {
23852 					if ((rqbuf[2] != KEY_ILLEGAL_REQUEST) ||
23853 					    (rqbuf[12] != 0x20)) {
23854 						rval = EIO;
23855 						goto no_assessment;
23856 					}
23857 				}
23858 			} else {
23859 				/*
23860 				 * The GET CONFIGURATION command succeeded
23861 				 * so set the media type according to the
23862 				 * returned data
23863 				 */
23864 				*dki_media_type = out_data[6];
23865 				*dki_media_type <<= 8;
23866 				*dki_media_type |= out_data[7];
23867 			}
23868 		}
23869 	} else {
23870 		/*
23871 		 * The profile list is not available, so we attempt to identify
23872 		 * the media type based on the inquiry data
23873 		 */
23874 		sinq = un->un_sd->sd_inq;
23875 		if ((sinq->inq_dtype == DTYPE_DIRECT) ||
23876 		    (sinq->inq_dtype == DTYPE_OPTICAL)) {
23877 			/* This is a direct access device  or optical disk */
23878 			*dki_media_type = DK_FIXED_DISK;
23879 
23880 			if ((bcmp(sinq->inq_vid, "IOMEGA", 6) == 0) ||
23881 			    (bcmp(sinq->inq_vid, "iomega", 6) == 0)) {
23882 				if ((bcmp(sinq->inq_pid, "ZIP", 3) == 0)) {
23883 					*dki_media_type = DK_ZIP;
23884 				} else if (
23885 				    (bcmp(sinq->inq_pid, "jaz", 3) == 0)) {
23886 					*dki_media_type = DK_JAZ;
23887 				}
23888 			}
23889 		} else {
23890 			/*
23891 			 * Not a CD, direct access or optical disk so return
23892 			 * unknown media
23893 			 */
23894 			*dki_media_type = DK_UNKNOWN;
23895 		}
23896 	}
23897 
23898 	/*
23899 	 * Now read the capacity so we can provide the lbasize,
23900 	 * pbsize and capacity.
23901 	 */
23902 	if (dki_pbsize && un->un_f_descr_format_supported) {
23903 		rval = sd_send_scsi_READ_CAPACITY_16(ssc, &capacity, &lbasize,
23904 		    &pbsize, SD_PATH_DIRECT);
23905 
23906 		/*
23907 		 * Override the physical blocksize if the instance already
23908 		 * has a larger value.
23909 		 */
23910 		pbsize = MAX(pbsize, un->un_phy_blocksize);
23911 	}
23912 
23913 	if (dki_pbsize == NULL || rval != 0 ||
23914 	    !un->un_f_descr_format_supported) {
23915 		rval = sd_send_scsi_READ_CAPACITY(ssc, &capacity, &lbasize,
23916 		    SD_PATH_DIRECT);
23917 
23918 		switch (rval) {
23919 		case 0:
23920 			if (un->un_f_enable_rmw &&
23921 			    un->un_phy_blocksize != 0) {
23922 				pbsize = un->un_phy_blocksize;
23923 			} else {
23924 				pbsize = lbasize;
23925 			}
23926 			media_capacity = capacity;
23927 
23928 			/*
23929 			 * sd_send_scsi_READ_CAPACITY() reports capacity in
23930 			 * un->un_sys_blocksize chunks. So we need to convert
23931 			 * it into cap.lbsize chunks.
23932 			 */
23933 			if (un->un_f_has_removable_media) {
23934 				media_capacity *= un->un_sys_blocksize;
23935 				media_capacity /= lbasize;
23936 			}
23937 			break;
23938 		case EACCES:
23939 			rval = EACCES;
23940 			goto done;
23941 		default:
23942 			rval = EIO;
23943 			goto done;
23944 		}
23945 	} else {
23946 		if (un->un_f_enable_rmw &&
23947 		    !ISP2(pbsize % DEV_BSIZE)) {
23948 			pbsize = SSD_SECSIZE;
23949 		} else if (!ISP2(lbasize % DEV_BSIZE) ||
23950 		    !ISP2(pbsize % DEV_BSIZE)) {
23951 			pbsize = lbasize = DEV_BSIZE;
23952 		}
23953 		media_capacity = capacity;
23954 	}
23955 
23956 	/*
23957 	 * If lun is expanded dynamically, update the un structure.
23958 	 */
23959 	mutex_enter(SD_MUTEX(un));
23960 	if ((un->un_f_blockcount_is_valid == TRUE) &&
23961 	    (un->un_f_tgt_blocksize_is_valid == TRUE) &&
23962 	    (capacity > un->un_blockcount)) {
23963 		un->un_f_expnevent = B_FALSE;
23964 		sd_update_block_info(un, lbasize, capacity);
23965 	}
23966 	mutex_exit(SD_MUTEX(un));
23967 
23968 	*dki_lbsize = lbasize;
23969 	*dki_capacity = media_capacity;
23970 	if (dki_pbsize)
23971 		*dki_pbsize = pbsize;
23972 
23973 done:
23974 	if (rval != 0) {
23975 		if (rval == EIO)
23976 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
23977 		else
23978 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23979 	}
23980 no_assessment:
23981 	sd_ssc_fini(ssc);
23982 	kmem_free(out_data, SD_PROFILE_HEADER_LEN);
23983 	kmem_free(rqbuf, SENSE_LENGTH);
23984 	return (rval);
23985 }
23986 
23987 /*
23988  *    Function: sd_get_media_info
23989  *
23990  * Description: This routine is the driver entry point for handling ioctl
23991  *		requests for the media type or command set profile used by the
23992  *		drive to operate on the media (DKIOCGMEDIAINFO).
23993  *
23994  *   Arguments: dev	- the device number
23995  *		arg	- pointer to user provided dk_minfo structure
23996  *			  specifying the media type, logical block size and
23997  *			  drive capacity.
23998  *		flag	- this argument is a pass through to ddi_copyxxx()
23999  *			  directly from the mode argument of ioctl().
24000  *
24001  * Return Code: returns the value from sd_get_media_info_com
24002  */
24003 static int
24004 sd_get_media_info(dev_t dev, caddr_t arg, int flag)
24005 {
24006 	struct dk_minfo		mi;
24007 	int			rval;
24008 
24009 	rval = sd_get_media_info_com(dev, &mi.dki_media_type,
24010 	    &mi.dki_lbsize, &mi.dki_capacity, NULL);
24011 
24012 	if (rval)
24013 		return (rval);
24014 	if (ddi_copyout(&mi, arg, sizeof (struct dk_minfo), flag))
24015 		rval = EFAULT;
24016 	return (rval);
24017 }
24018 
24019 /*
24020  *    Function: sd_get_media_info_ext
24021  *
24022  * Description: This routine is the driver entry point for handling ioctl
24023  *		requests for the media type or command set profile used by the
24024  *		drive to operate on the media (DKIOCGMEDIAINFOEXT). The
24025  *		difference this ioctl and DKIOCGMEDIAINFO is the return value
24026  *		of this ioctl contains both logical block size and physical
24027  *		block size.
24028  *
24029  *
24030  *   Arguments: dev	- the device number
24031  *		arg	- pointer to user provided dk_minfo_ext structure
24032  *			  specifying the media type, logical block size,
24033  *			  physical block size and disk capacity.
24034  *		flag	- this argument is a pass through to ddi_copyxxx()
24035  *			  directly from the mode argument of ioctl().
24036  *
24037  * Return Code: returns the value from sd_get_media_info_com
24038  */
24039 static int
24040 sd_get_media_info_ext(dev_t dev, caddr_t arg, int flag)
24041 {
24042 	struct dk_minfo_ext	mie;
24043 	int			rval = 0;
24044 
24045 	rval = sd_get_media_info_com(dev, &mie.dki_media_type,
24046 	    &mie.dki_lbsize, &mie.dki_capacity, &mie.dki_pbsize);
24047 
24048 	if (rval)
24049 		return (rval);
24050 	if (ddi_copyout(&mie, arg, sizeof (struct dk_minfo_ext), flag))
24051 		rval = EFAULT;
24052 	return (rval);
24053 
24054 }
24055 
24056 /*
24057  *    Function: sd_watch_request_submit
24058  *
24059  * Description: Call scsi_watch_request_submit or scsi_mmc_watch_request_submit
24060  *		depending on which is supported by device.
24061  */
24062 static opaque_t
24063 sd_watch_request_submit(struct sd_lun *un)
24064 {
24065 	dev_t			dev;
24066 
24067 	/* All submissions are unified to use same device number */
24068 	dev = sd_make_device(SD_DEVINFO(un));
24069 
24070 	if (un->un_f_mmc_cap && un->un_f_mmc_gesn_polling) {
24071 		return (scsi_mmc_watch_request_submit(SD_SCSI_DEVP(un),
24072 		    sd_check_media_time, SENSE_LENGTH, sd_media_watch_cb,
24073 		    (caddr_t)dev));
24074 	} else {
24075 		return (scsi_watch_request_submit(SD_SCSI_DEVP(un),
24076 		    sd_check_media_time, SENSE_LENGTH, sd_media_watch_cb,
24077 		    (caddr_t)dev));
24078 	}
24079 }
24080 
24081 
24082 /*
24083  *    Function: sd_check_media
24084  *
24085  * Description: This utility routine implements the functionality for the
24086  *		DKIOCSTATE ioctl. This ioctl blocks the user thread until the
24087  *		driver state changes from that specified by the user
24088  *		(inserted or ejected). For example, if the user specifies
24089  *		DKIO_EJECTED and the current media state is inserted this
24090  *		routine will immediately return DKIO_INSERTED. However, if the
24091  *		current media state is not inserted the user thread will be
24092  *		blocked until the drive state changes. If DKIO_NONE is specified
24093  *		the user thread will block until a drive state change occurs.
24094  *
24095  *   Arguments: dev  - the device number
24096  *		state  - user pointer to a dkio_state, updated with the current
24097  *			drive state at return.
24098  *
24099  * Return Code: ENXIO
24100  *		EIO
24101  *		EAGAIN
24102  *		EINTR
24103  */
24104 
24105 static int
24106 sd_check_media(dev_t dev, enum dkio_state state)
24107 {
24108 	struct sd_lun		*un = NULL;
24109 	enum dkio_state		prev_state;
24110 	opaque_t		token = NULL;
24111 	int			rval = 0;
24112 	sd_ssc_t		*ssc;
24113 
24114 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24115 		return (ENXIO);
24116 	}
24117 
24118 	SD_TRACE(SD_LOG_COMMON, un, "sd_check_media: entry\n");
24119 
24120 	ssc = sd_ssc_init(un);
24121 
24122 	mutex_enter(SD_MUTEX(un));
24123 
24124 	SD_TRACE(SD_LOG_COMMON, un, "sd_check_media: "
24125 	    "state=%x, mediastate=%x\n", state, un->un_mediastate);
24126 
24127 	prev_state = un->un_mediastate;
24128 
24129 	/* is there anything to do? */
24130 	if (state == un->un_mediastate || un->un_mediastate == DKIO_NONE) {
24131 		/*
24132 		 * submit the request to the scsi_watch service;
24133 		 * scsi_media_watch_cb() does the real work
24134 		 */
24135 		mutex_exit(SD_MUTEX(un));
24136 
24137 		/*
24138 		 * This change handles the case where a scsi watch request is
24139 		 * added to a device that is powered down. To accomplish this
24140 		 * we power up the device before adding the scsi watch request,
24141 		 * since the scsi watch sends a TUR directly to the device
24142 		 * which the device cannot handle if it is powered down.
24143 		 */
24144 		if (sd_pm_entry(un) != DDI_SUCCESS) {
24145 			mutex_enter(SD_MUTEX(un));
24146 			goto done;
24147 		}
24148 
24149 		token = sd_watch_request_submit(un);
24150 
24151 		sd_pm_exit(un);
24152 
24153 		mutex_enter(SD_MUTEX(un));
24154 		if (token == NULL) {
24155 			rval = EAGAIN;
24156 			goto done;
24157 		}
24158 
24159 		/*
24160 		 * This is a special case IOCTL that doesn't return
24161 		 * until the media state changes. Routine sdpower
24162 		 * knows about and handles this so don't count it
24163 		 * as an active cmd in the driver, which would
24164 		 * keep the device busy to the pm framework.
24165 		 * If the count isn't decremented the device can't
24166 		 * be powered down.
24167 		 */
24168 		un->un_ncmds_in_driver--;
24169 		ASSERT(un->un_ncmds_in_driver >= 0);
24170 
24171 		/*
24172 		 * if a prior request had been made, this will be the same
24173 		 * token, as scsi_watch was designed that way.
24174 		 */
24175 		un->un_swr_token = token;
24176 		un->un_specified_mediastate = state;
24177 
24178 		/*
24179 		 * now wait for media change
24180 		 * we will not be signalled unless mediastate == state but it is
24181 		 * still better to test for this condition, since there is a
24182 		 * 2 sec cv_broadcast delay when mediastate == DKIO_INSERTED
24183 		 */
24184 		SD_TRACE(SD_LOG_COMMON, un,
24185 		    "sd_check_media: waiting for media state change\n");
24186 		while (un->un_mediastate == state) {
24187 			if (cv_wait_sig(&un->un_state_cv, SD_MUTEX(un)) == 0) {
24188 				SD_TRACE(SD_LOG_COMMON, un,
24189 				    "sd_check_media: waiting for media state "
24190 				    "was interrupted\n");
24191 				un->un_ncmds_in_driver++;
24192 				rval = EINTR;
24193 				goto done;
24194 			}
24195 			SD_TRACE(SD_LOG_COMMON, un,
24196 			    "sd_check_media: received signal, state=%x\n",
24197 			    un->un_mediastate);
24198 		}
24199 		/*
24200 		 * Inc the counter to indicate the device once again
24201 		 * has an active outstanding cmd.
24202 		 */
24203 		un->un_ncmds_in_driver++;
24204 	}
24205 
24206 	/* invalidate geometry */
24207 	if (prev_state == DKIO_INSERTED && un->un_mediastate == DKIO_EJECTED) {
24208 		sr_ejected(un);
24209 	}
24210 
24211 	if (un->un_mediastate == DKIO_INSERTED && prev_state != DKIO_INSERTED) {
24212 		uint64_t	capacity;
24213 		uint_t		lbasize;
24214 
24215 		SD_TRACE(SD_LOG_COMMON, un, "sd_check_media: media inserted\n");
24216 		mutex_exit(SD_MUTEX(un));
24217 		/*
24218 		 * Since the following routines use SD_PATH_DIRECT, we must
24219 		 * call PM directly before the upcoming disk accesses. This
24220 		 * may cause the disk to be power/spin up.
24221 		 */
24222 
24223 		if (sd_pm_entry(un) == DDI_SUCCESS) {
24224 			rval = sd_send_scsi_READ_CAPACITY(ssc,
24225 			    &capacity, &lbasize, SD_PATH_DIRECT);
24226 			if (rval != 0) {
24227 				sd_pm_exit(un);
24228 				if (rval == EIO)
24229 					sd_ssc_assessment(ssc,
24230 					    SD_FMT_STATUS_CHECK);
24231 				else
24232 					sd_ssc_assessment(ssc, SD_FMT_IGNORE);
24233 				mutex_enter(SD_MUTEX(un));
24234 				goto done;
24235 			}
24236 		} else {
24237 			rval = EIO;
24238 			mutex_enter(SD_MUTEX(un));
24239 			goto done;
24240 		}
24241 		mutex_enter(SD_MUTEX(un));
24242 
24243 		sd_update_block_info(un, lbasize, capacity);
24244 
24245 		/*
24246 		 *  Check if the media in the device is writable or not
24247 		 */
24248 		if (ISCD(un)) {
24249 			sd_check_for_writable_cd(ssc, SD_PATH_DIRECT);
24250 		}
24251 
24252 		mutex_exit(SD_MUTEX(un));
24253 		cmlb_invalidate(un->un_cmlbhandle, (void *)SD_PATH_DIRECT);
24254 		if ((cmlb_validate(un->un_cmlbhandle, 0,
24255 		    (void *)SD_PATH_DIRECT) == 0) && un->un_f_pkstats_enabled) {
24256 			sd_set_pstats(un);
24257 			SD_TRACE(SD_LOG_IO_PARTITION, un,
24258 			    "sd_check_media: un:0x%p pstats created and "
24259 			    "set\n", un);
24260 		}
24261 
24262 		rval = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_PREVENT,
24263 		    SD_PATH_DIRECT);
24264 
24265 		sd_pm_exit(un);
24266 
24267 		if (rval != 0) {
24268 			if (rval == EIO)
24269 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
24270 			else
24271 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
24272 		}
24273 
24274 		mutex_enter(SD_MUTEX(un));
24275 	}
24276 done:
24277 	sd_ssc_fini(ssc);
24278 	un->un_f_watcht_stopped = FALSE;
24279 	if (token != NULL && un->un_swr_token != NULL) {
24280 		/*
24281 		 * Use of this local token and the mutex ensures that we avoid
24282 		 * some race conditions associated with terminating the
24283 		 * scsi watch.
24284 		 */
24285 		token = un->un_swr_token;
24286 		mutex_exit(SD_MUTEX(un));
24287 		(void) scsi_watch_request_terminate(token,
24288 		    SCSI_WATCH_TERMINATE_WAIT);
24289 		if (scsi_watch_get_ref_count(token) == 0) {
24290 			mutex_enter(SD_MUTEX(un));
24291 			un->un_swr_token = (opaque_t)NULL;
24292 		} else {
24293 			mutex_enter(SD_MUTEX(un));
24294 		}
24295 	}
24296 
24297 	/*
24298 	 * Update the capacity kstat value, if no media previously
24299 	 * (capacity kstat is 0) and a media has been inserted
24300 	 * (un_f_blockcount_is_valid == TRUE)
24301 	 */
24302 	if (un->un_errstats) {
24303 		struct sd_errstats	*stp = NULL;
24304 
24305 		stp = (struct sd_errstats *)un->un_errstats->ks_data;
24306 		if ((stp->sd_capacity.value.ui64 == 0) &&
24307 		    (un->un_f_blockcount_is_valid == TRUE)) {
24308 			stp->sd_capacity.value.ui64 =
24309 			    (uint64_t)((uint64_t)un->un_blockcount *
24310 			    un->un_sys_blocksize);
24311 		}
24312 	}
24313 	mutex_exit(SD_MUTEX(un));
24314 	SD_TRACE(SD_LOG_COMMON, un, "sd_check_media: done\n");
24315 	return (rval);
24316 }
24317 
24318 
24319 /*
24320  *    Function: sd_delayed_cv_broadcast
24321  *
24322  * Description: Delayed cv_broadcast to allow for target to recover from media
24323  *		insertion.
24324  *
24325  *   Arguments: arg - driver soft state (unit) structure
24326  */
24327 
24328 static void
24329 sd_delayed_cv_broadcast(void *arg)
24330 {
24331 	struct sd_lun *un = arg;
24332 
24333 	SD_TRACE(SD_LOG_COMMON, un, "sd_delayed_cv_broadcast\n");
24334 
24335 	mutex_enter(SD_MUTEX(un));
24336 	un->un_dcvb_timeid = NULL;
24337 	cv_broadcast(&un->un_state_cv);
24338 	mutex_exit(SD_MUTEX(un));
24339 }
24340 
24341 
24342 /*
24343  *    Function: sd_media_watch_cb
24344  *
24345  * Description: Callback routine used for support of the DKIOCSTATE ioctl. This
24346  *		routine processes the TUR sense data and updates the driver
24347  *		state if a transition has occurred. The user thread
24348  *		(sd_check_media) is then signalled.
24349  *
24350  *   Arguments: arg -   the device 'dev_t' is used for context to discriminate
24351  *			among multiple watches that share this callback function
24352  *		resultp - scsi watch facility result packet containing scsi
24353  *			  packet, status byte and sense data
24354  *
24355  * Return Code: 0 for success, -1 for failure
24356  */
24357 
24358 static int
24359 sd_media_watch_cb(caddr_t arg, struct scsi_watch_result *resultp)
24360 {
24361 	struct sd_lun			*un;
24362 	struct scsi_status		*statusp = resultp->statusp;
24363 	uint8_t				*sensep = (uint8_t *)resultp->sensep;
24364 	enum dkio_state			state = DKIO_NONE;
24365 	dev_t				dev = (dev_t)arg;
24366 	uchar_t				actual_sense_length;
24367 	uint8_t				skey, asc, ascq;
24368 
24369 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24370 		return (-1);
24371 	}
24372 	actual_sense_length = resultp->actual_sense_length;
24373 
24374 	mutex_enter(SD_MUTEX(un));
24375 	SD_TRACE(SD_LOG_COMMON, un,
24376 	    "sd_media_watch_cb: status=%x, sensep=%p, len=%x\n",
24377 	    *((char *)statusp), (void *)sensep, actual_sense_length);
24378 
24379 	if (resultp->pkt->pkt_reason == CMD_DEV_GONE) {
24380 		un->un_mediastate = DKIO_DEV_GONE;
24381 		cv_broadcast(&un->un_state_cv);
24382 		mutex_exit(SD_MUTEX(un));
24383 
24384 		return (0);
24385 	}
24386 
24387 	if (un->un_f_mmc_cap && un->un_f_mmc_gesn_polling) {
24388 		if (sd_gesn_media_data_valid(resultp->mmc_data)) {
24389 			if ((resultp->mmc_data[5] &
24390 			    SD_GESN_MEDIA_EVENT_STATUS_PRESENT) != 0) {
24391 				state = DKIO_INSERTED;
24392 			} else {
24393 				state = DKIO_EJECTED;
24394 			}
24395 			if ((resultp->mmc_data[4] & SD_GESN_MEDIA_EVENT_CODE) ==
24396 			    SD_GESN_MEDIA_EVENT_EJECTREQUEST) {
24397 				sd_log_eject_request_event(un, KM_NOSLEEP);
24398 			}
24399 		}
24400 	} else if (sensep != NULL) {
24401 		/*
24402 		 * If there was a check condition then sensep points to valid
24403 		 * sense data. If status was not a check condition but a
24404 		 * reservation or busy status then the new state is DKIO_NONE.
24405 		 */
24406 		skey = scsi_sense_key(sensep);
24407 		asc = scsi_sense_asc(sensep);
24408 		ascq = scsi_sense_ascq(sensep);
24409 
24410 		SD_INFO(SD_LOG_COMMON, un,
24411 		    "sd_media_watch_cb: sense KEY=%x, ASC=%x, ASCQ=%x\n",
24412 		    skey, asc, ascq);
24413 		/* This routine only uses up to 13 bytes of sense data. */
24414 		if (actual_sense_length >= 13) {
24415 			if (skey == KEY_UNIT_ATTENTION) {
24416 				if (asc == 0x28) {
24417 					state = DKIO_INSERTED;
24418 				}
24419 			} else if (skey == KEY_NOT_READY) {
24420 				/*
24421 				 * Sense data of 02/06/00 means that the
24422 				 * drive could not read the media (No
24423 				 * reference position found). In this case
24424 				 * to prevent a hang on the DKIOCSTATE IOCTL
24425 				 * we set the media state to DKIO_INSERTED.
24426 				 */
24427 				if (asc == 0x06 && ascq == 0x00)
24428 					state = DKIO_INSERTED;
24429 
24430 				/*
24431 				 * if 02/04/02  means that the host
24432 				 * should send start command. Explicitly
24433 				 * leave the media state as is
24434 				 * (inserted) as the media is inserted
24435 				 * and host has stopped device for PM
24436 				 * reasons. Upon next true read/write
24437 				 * to this media will bring the
24438 				 * device to the right state good for
24439 				 * media access.
24440 				 */
24441 				if (asc == 0x3a) {
24442 					state = DKIO_EJECTED;
24443 				} else {
24444 					/*
24445 					 * If the drive is busy with an
24446 					 * operation or long write, keep the
24447 					 * media in an inserted state.
24448 					 */
24449 
24450 					if ((asc == 0x04) &&
24451 					    ((ascq == 0x02) ||
24452 					    (ascq == 0x07) ||
24453 					    (ascq == 0x08))) {
24454 						state = DKIO_INSERTED;
24455 					}
24456 				}
24457 			} else if (skey == KEY_NO_SENSE) {
24458 				if ((asc == 0x00) && (ascq == 0x00)) {
24459 					/*
24460 					 * Sense Data 00/00/00 does not provide
24461 					 * any information about the state of
24462 					 * the media. Ignore it.
24463 					 */
24464 					mutex_exit(SD_MUTEX(un));
24465 					return (0);
24466 				}
24467 			}
24468 		}
24469 	} else if ((*((char *)statusp) == STATUS_GOOD) &&
24470 	    (resultp->pkt->pkt_reason == CMD_CMPLT)) {
24471 		state = DKIO_INSERTED;
24472 	}
24473 
24474 	SD_TRACE(SD_LOG_COMMON, un,
24475 	    "sd_media_watch_cb: state=%x, specified=%x\n",
24476 	    state, un->un_specified_mediastate);
24477 
24478 	/*
24479 	 * now signal the waiting thread if this is *not* the specified state;
24480 	 * delay the signal if the state is DKIO_INSERTED to allow the target
24481 	 * to recover
24482 	 */
24483 	if (state != un->un_specified_mediastate) {
24484 		un->un_mediastate = state;
24485 		if (state == DKIO_INSERTED) {
24486 			/*
24487 			 * delay the signal to give the drive a chance
24488 			 * to do what it apparently needs to do
24489 			 */
24490 			SD_TRACE(SD_LOG_COMMON, un,
24491 			    "sd_media_watch_cb: delayed cv_broadcast\n");
24492 			if (un->un_dcvb_timeid == NULL) {
24493 				un->un_dcvb_timeid =
24494 				    timeout(sd_delayed_cv_broadcast, un,
24495 				    drv_usectohz((clock_t)MEDIA_ACCESS_DELAY));
24496 			}
24497 		} else {
24498 			SD_TRACE(SD_LOG_COMMON, un,
24499 			    "sd_media_watch_cb: immediate cv_broadcast\n");
24500 			cv_broadcast(&un->un_state_cv);
24501 		}
24502 	}
24503 	mutex_exit(SD_MUTEX(un));
24504 	return (0);
24505 }
24506 
24507 
24508 /*
24509  *    Function: sd_dkio_get_temp
24510  *
24511  * Description: This routine is the driver entry point for handling ioctl
24512  *		requests to get the disk temperature.
24513  *
24514  *   Arguments: dev  - the device number
24515  *		arg  - pointer to user provided dk_temperature structure.
24516  *		flag - this argument is a pass through to ddi_copyxxx()
24517  *		       directly from the mode argument of ioctl().
24518  *
24519  * Return Code: 0
24520  *		EFAULT
24521  *		ENXIO
24522  *		EAGAIN
24523  */
24524 
24525 static int
24526 sd_dkio_get_temp(dev_t dev, caddr_t arg, int flag)
24527 {
24528 	struct sd_lun		*un = NULL;
24529 	struct dk_temperature	*dktemp = NULL;
24530 	uchar_t			*temperature_page;
24531 	int			rval = 0;
24532 	int			path_flag = SD_PATH_STANDARD;
24533 	sd_ssc_t		*ssc;
24534 
24535 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24536 		return (ENXIO);
24537 	}
24538 
24539 	ssc = sd_ssc_init(un);
24540 	dktemp = kmem_zalloc(sizeof (struct dk_temperature), KM_SLEEP);
24541 
24542 	/* copyin the disk temp argument to get the user flags */
24543 	if (ddi_copyin((void *)arg, dktemp,
24544 	    sizeof (struct dk_temperature), flag) != 0) {
24545 		rval = EFAULT;
24546 		goto done;
24547 	}
24548 
24549 	/* Initialize the temperature to invalid. */
24550 	dktemp->dkt_cur_temp = (short)DKT_INVALID_TEMP;
24551 	dktemp->dkt_ref_temp = (short)DKT_INVALID_TEMP;
24552 
24553 	/*
24554 	 * Note: Investigate removing the "bypass pm" semantic.
24555 	 * Can we just bypass PM always?
24556 	 */
24557 	if (dktemp->dkt_flags & DKT_BYPASS_PM) {
24558 		path_flag = SD_PATH_DIRECT;
24559 		ASSERT(!mutex_owned(&un->un_pm_mutex));
24560 		mutex_enter(&un->un_pm_mutex);
24561 		if (SD_DEVICE_IS_IN_LOW_POWER(un)) {
24562 			/*
24563 			 * If DKT_BYPASS_PM is set, and the drive happens to be
24564 			 * in low power mode, we can not wake it up, Need to
24565 			 * return EAGAIN.
24566 			 */
24567 			mutex_exit(&un->un_pm_mutex);
24568 			rval = EAGAIN;
24569 			goto done;
24570 		} else {
24571 			/*
24572 			 * Indicate to PM the device is busy. This is required
24573 			 * to avoid a race - i.e. the ioctl is issuing a
24574 			 * command and the pm framework brings down the device
24575 			 * to low power mode (possible power cut-off on some
24576 			 * platforms).
24577 			 */
24578 			mutex_exit(&un->un_pm_mutex);
24579 			if (sd_pm_entry(un) != DDI_SUCCESS) {
24580 				rval = EAGAIN;
24581 				goto done;
24582 			}
24583 		}
24584 	}
24585 
24586 	temperature_page = kmem_zalloc(TEMPERATURE_PAGE_SIZE, KM_SLEEP);
24587 
24588 	rval = sd_send_scsi_LOG_SENSE(ssc, temperature_page,
24589 	    TEMPERATURE_PAGE_SIZE, TEMPERATURE_PAGE, 1, 0, path_flag);
24590 	if (rval != 0)
24591 		goto done2;
24592 
24593 	/*
24594 	 * For the current temperature verify that the parameter length is 0x02
24595 	 * and the parameter code is 0x00
24596 	 */
24597 	if ((temperature_page[7] == 0x02) && (temperature_page[4] == 0x00) &&
24598 	    (temperature_page[5] == 0x00)) {
24599 		if (temperature_page[9] == 0xFF) {
24600 			dktemp->dkt_cur_temp = (short)DKT_INVALID_TEMP;
24601 		} else {
24602 			dktemp->dkt_cur_temp = (short)(temperature_page[9]);
24603 		}
24604 	}
24605 
24606 	/*
24607 	 * For the reference temperature verify that the parameter
24608 	 * length is 0x02 and the parameter code is 0x01
24609 	 */
24610 	if ((temperature_page[13] == 0x02) && (temperature_page[10] == 0x00) &&
24611 	    (temperature_page[11] == 0x01)) {
24612 		if (temperature_page[15] == 0xFF) {
24613 			dktemp->dkt_ref_temp = (short)DKT_INVALID_TEMP;
24614 		} else {
24615 			dktemp->dkt_ref_temp = (short)(temperature_page[15]);
24616 		}
24617 	}
24618 
24619 	/* Do the copyout regardless of the temperature commands status. */
24620 	if (ddi_copyout(dktemp, (void *)arg, sizeof (struct dk_temperature),
24621 	    flag) != 0) {
24622 		rval = EFAULT;
24623 		goto done1;
24624 	}
24625 
24626 done2:
24627 	if (rval != 0) {
24628 		if (rval == EIO)
24629 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
24630 		else
24631 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
24632 	}
24633 done1:
24634 	if (path_flag == SD_PATH_DIRECT) {
24635 		sd_pm_exit(un);
24636 	}
24637 
24638 	kmem_free(temperature_page, TEMPERATURE_PAGE_SIZE);
24639 done:
24640 	sd_ssc_fini(ssc);
24641 	if (dktemp != NULL) {
24642 		kmem_free(dktemp, sizeof (struct dk_temperature));
24643 	}
24644 
24645 	return (rval);
24646 }
24647 
24648 
24649 /*
24650  *    Function: sd_log_page_supported
24651  *
24652  * Description: This routine uses sd_send_scsi_LOG_SENSE to find the list of
24653  *		supported log pages.
24654  *
24655  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
24656  *                      structure for this target.
24657  *		log_page -
24658  *
24659  * Return Code: -1 - on error (log sense is optional and may not be supported).
24660  *		0  - log page not found.
24661  *		1  - log page found.
24662  */
24663 
24664 static int
24665 sd_log_page_supported(sd_ssc_t *ssc, int log_page)
24666 {
24667 	uchar_t *log_page_data;
24668 	int	i;
24669 	int	match = 0;
24670 	int	log_size;
24671 	int	status = 0;
24672 	struct sd_lun	*un;
24673 
24674 	ASSERT(ssc != NULL);
24675 	un = ssc->ssc_un;
24676 	ASSERT(un != NULL);
24677 
24678 	log_page_data = kmem_zalloc(0xFF, KM_SLEEP);
24679 
24680 	status = sd_send_scsi_LOG_SENSE(ssc, log_page_data, 0xFF, 0, 0x01, 0,
24681 	    SD_PATH_DIRECT);
24682 
24683 	if (status != 0) {
24684 		if (status == EIO) {
24685 			/*
24686 			 * Some disks do not support log sense, we
24687 			 * should ignore this kind of error(sense key is
24688 			 * 0x5 - illegal request).
24689 			 */
24690 			uint8_t *sensep;
24691 			int senlen;
24692 
24693 			sensep = (uint8_t *)ssc->ssc_uscsi_cmd->uscsi_rqbuf;
24694 			senlen = (int)(ssc->ssc_uscsi_cmd->uscsi_rqlen -
24695 			    ssc->ssc_uscsi_cmd->uscsi_rqresid);
24696 
24697 			if (senlen > 0 &&
24698 			    scsi_sense_key(sensep) == KEY_ILLEGAL_REQUEST) {
24699 				sd_ssc_assessment(ssc,
24700 				    SD_FMT_IGNORE_COMPROMISE);
24701 			} else {
24702 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
24703 			}
24704 		} else {
24705 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
24706 		}
24707 
24708 		SD_ERROR(SD_LOG_COMMON, un,
24709 		    "sd_log_page_supported: failed log page retrieval\n");
24710 		kmem_free(log_page_data, 0xFF);
24711 		return (-1);
24712 	}
24713 
24714 	log_size = log_page_data[3];
24715 
24716 	/*
24717 	 * The list of supported log pages start from the fourth byte. Check
24718 	 * until we run out of log pages or a match is found.
24719 	 */
24720 	for (i = 4; (i < (log_size + 4)) && !match; i++) {
24721 		if (log_page_data[i] == log_page) {
24722 			match++;
24723 		}
24724 	}
24725 	kmem_free(log_page_data, 0xFF);
24726 	return (match);
24727 }
24728 
24729 
24730 /*
24731  *    Function: sd_mhdioc_failfast
24732  *
24733  * Description: This routine is the driver entry point for handling ioctl
24734  *		requests to enable/disable the multihost failfast option.
24735  *		(MHIOCENFAILFAST)
24736  *
24737  *   Arguments: dev	- the device number
24738  *		arg	- user specified probing interval.
24739  *		flag	- this argument is a pass through to ddi_copyxxx()
24740  *			  directly from the mode argument of ioctl().
24741  *
24742  * Return Code: 0
24743  *		EFAULT
24744  *		ENXIO
24745  */
24746 
24747 static int
24748 sd_mhdioc_failfast(dev_t dev, caddr_t arg, int flag)
24749 {
24750 	struct sd_lun	*un = NULL;
24751 	int		mh_time;
24752 	int		rval = 0;
24753 
24754 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24755 		return (ENXIO);
24756 	}
24757 
24758 	if (ddi_copyin((void *)arg, &mh_time, sizeof (int), flag))
24759 		return (EFAULT);
24760 
24761 	if (mh_time) {
24762 		mutex_enter(SD_MUTEX(un));
24763 		un->un_resvd_status |= SD_FAILFAST;
24764 		mutex_exit(SD_MUTEX(un));
24765 		/*
24766 		 * If mh_time is INT_MAX, then this ioctl is being used for
24767 		 * SCSI-3 PGR purposes, and we don't need to spawn watch thread.
24768 		 */
24769 		if (mh_time != INT_MAX) {
24770 			rval = sd_check_mhd(dev, mh_time);
24771 		}
24772 	} else {
24773 		(void) sd_check_mhd(dev, 0);
24774 		mutex_enter(SD_MUTEX(un));
24775 		un->un_resvd_status &= ~SD_FAILFAST;
24776 		mutex_exit(SD_MUTEX(un));
24777 	}
24778 	return (rval);
24779 }
24780 
24781 
24782 /*
24783  *    Function: sd_mhdioc_takeown
24784  *
24785  * Description: This routine is the driver entry point for handling ioctl
24786  *		requests to forcefully acquire exclusive access rights to the
24787  *		multihost disk (MHIOCTKOWN).
24788  *
24789  *   Arguments: dev	- the device number
24790  *		arg	- user provided structure specifying the delay
24791  *			  parameters in milliseconds
24792  *		flag	- this argument is a pass through to ddi_copyxxx()
24793  *			  directly from the mode argument of ioctl().
24794  *
24795  * Return Code: 0
24796  *		EFAULT
24797  *		ENXIO
24798  */
24799 
24800 static int
24801 sd_mhdioc_takeown(dev_t dev, caddr_t arg, int flag)
24802 {
24803 	struct sd_lun		*un = NULL;
24804 	struct mhioctkown	*tkown = NULL;
24805 	int			rval = 0;
24806 
24807 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24808 		return (ENXIO);
24809 	}
24810 
24811 	if (arg != NULL) {
24812 		tkown = (struct mhioctkown *)
24813 		    kmem_zalloc(sizeof (struct mhioctkown), KM_SLEEP);
24814 		rval = ddi_copyin(arg, tkown, sizeof (struct mhioctkown), flag);
24815 		if (rval != 0) {
24816 			rval = EFAULT;
24817 			goto error;
24818 		}
24819 	}
24820 
24821 	rval = sd_take_ownership(dev, tkown);
24822 	mutex_enter(SD_MUTEX(un));
24823 	if (rval == 0) {
24824 		un->un_resvd_status |= SD_RESERVE;
24825 		if (tkown != NULL && tkown->reinstate_resv_delay != 0) {
24826 			sd_reinstate_resv_delay =
24827 			    tkown->reinstate_resv_delay * 1000;
24828 		} else {
24829 			sd_reinstate_resv_delay = SD_REINSTATE_RESV_DELAY;
24830 		}
24831 		/*
24832 		 * Give the scsi_watch routine interval set by
24833 		 * the MHIOCENFAILFAST ioctl precedence here.
24834 		 */
24835 		if ((un->un_resvd_status & SD_FAILFAST) == 0) {
24836 			mutex_exit(SD_MUTEX(un));
24837 			(void) sd_check_mhd(dev, sd_reinstate_resv_delay/1000);
24838 			SD_TRACE(SD_LOG_IOCTL_MHD, un,
24839 			    "sd_mhdioc_takeown : %d\n",
24840 			    sd_reinstate_resv_delay);
24841 		} else {
24842 			mutex_exit(SD_MUTEX(un));
24843 		}
24844 		(void) scsi_reset_notify(SD_ADDRESS(un), SCSI_RESET_NOTIFY,
24845 		    sd_mhd_reset_notify_cb, (caddr_t)un);
24846 	} else {
24847 		un->un_resvd_status &= ~SD_RESERVE;
24848 		mutex_exit(SD_MUTEX(un));
24849 	}
24850 
24851 error:
24852 	if (tkown != NULL) {
24853 		kmem_free(tkown, sizeof (struct mhioctkown));
24854 	}
24855 	return (rval);
24856 }
24857 
24858 
24859 /*
24860  *    Function: sd_mhdioc_release
24861  *
24862  * Description: This routine is the driver entry point for handling ioctl
24863  *		requests to release exclusive access rights to the multihost
24864  *		disk (MHIOCRELEASE).
24865  *
24866  *   Arguments: dev	- the device number
24867  *
24868  * Return Code: 0
24869  *		ENXIO
24870  */
24871 
24872 static int
24873 sd_mhdioc_release(dev_t dev)
24874 {
24875 	struct sd_lun		*un = NULL;
24876 	timeout_id_t		resvd_timeid_save;
24877 	int			resvd_status_save;
24878 	int			rval = 0;
24879 
24880 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24881 		return (ENXIO);
24882 	}
24883 
24884 	mutex_enter(SD_MUTEX(un));
24885 	resvd_status_save = un->un_resvd_status;
24886 	un->un_resvd_status &=
24887 	    ~(SD_RESERVE | SD_LOST_RESERVE | SD_WANT_RESERVE);
24888 	if (un->un_resvd_timeid) {
24889 		resvd_timeid_save = un->un_resvd_timeid;
24890 		un->un_resvd_timeid = NULL;
24891 		mutex_exit(SD_MUTEX(un));
24892 		(void) untimeout(resvd_timeid_save);
24893 	} else {
24894 		mutex_exit(SD_MUTEX(un));
24895 	}
24896 
24897 	/*
24898 	 * destroy any pending timeout thread that may be attempting to
24899 	 * reinstate reservation on this device.
24900 	 */
24901 	sd_rmv_resv_reclaim_req(dev);
24902 
24903 	if ((rval = sd_reserve_release(dev, SD_RELEASE)) == 0) {
24904 		mutex_enter(SD_MUTEX(un));
24905 		if ((un->un_mhd_token) &&
24906 		    ((un->un_resvd_status & SD_FAILFAST) == 0)) {
24907 			mutex_exit(SD_MUTEX(un));
24908 			(void) sd_check_mhd(dev, 0);
24909 		} else {
24910 			mutex_exit(SD_MUTEX(un));
24911 		}
24912 		(void) scsi_reset_notify(SD_ADDRESS(un), SCSI_RESET_CANCEL,
24913 		    sd_mhd_reset_notify_cb, (caddr_t)un);
24914 	} else {
24915 		/*
24916 		 * sd_mhd_watch_cb will restart the resvd recover timeout thread
24917 		 */
24918 		mutex_enter(SD_MUTEX(un));
24919 		un->un_resvd_status = resvd_status_save;
24920 		mutex_exit(SD_MUTEX(un));
24921 	}
24922 	return (rval);
24923 }
24924 
24925 
24926 /*
24927  *    Function: sd_mhdioc_register_devid
24928  *
24929  * Description: This routine is the driver entry point for handling ioctl
24930  *		requests to register the device id (MHIOCREREGISTERDEVID).
24931  *
24932  *		Note: The implementation for this ioctl has been updated to
24933  *		be consistent with the original PSARC case (1999/357)
24934  *		(4375899, 4241671, 4220005)
24935  *
24936  *   Arguments: dev	- the device number
24937  *
24938  * Return Code: 0
24939  *		ENXIO
24940  */
24941 
24942 static int
24943 sd_mhdioc_register_devid(dev_t dev)
24944 {
24945 	struct sd_lun	*un = NULL;
24946 	int		rval = 0;
24947 	sd_ssc_t	*ssc;
24948 
24949 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24950 		return (ENXIO);
24951 	}
24952 
24953 	ASSERT(!mutex_owned(SD_MUTEX(un)));
24954 
24955 	mutex_enter(SD_MUTEX(un));
24956 
24957 	/* If a devid already exists, de-register it */
24958 	if (un->un_devid != NULL) {
24959 		ddi_devid_unregister(SD_DEVINFO(un));
24960 		/*
24961 		 * After unregister devid, needs to free devid memory
24962 		 */
24963 		ddi_devid_free(un->un_devid);
24964 		un->un_devid = NULL;
24965 	}
24966 
24967 	/* Check for reservation conflict */
24968 	mutex_exit(SD_MUTEX(un));
24969 	ssc = sd_ssc_init(un);
24970 	rval = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
24971 	mutex_enter(SD_MUTEX(un));
24972 
24973 	switch (rval) {
24974 	case 0:
24975 		sd_register_devid(ssc, SD_DEVINFO(un), SD_TARGET_IS_UNRESERVED);
24976 		break;
24977 	case EACCES:
24978 		break;
24979 	default:
24980 		rval = EIO;
24981 	}
24982 
24983 	mutex_exit(SD_MUTEX(un));
24984 	if (rval != 0) {
24985 		if (rval == EIO)
24986 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
24987 		else
24988 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
24989 	}
24990 	sd_ssc_fini(ssc);
24991 	return (rval);
24992 }
24993 
24994 
24995 /*
24996  *    Function: sd_mhdioc_inkeys
24997  *
24998  * Description: This routine is the driver entry point for handling ioctl
24999  *		requests to issue the SCSI-3 Persistent In Read Keys command
25000  *		to the device (MHIOCGRP_INKEYS).
25001  *
25002  *   Arguments: dev	- the device number
25003  *		arg	- user provided in_keys structure
25004  *		flag	- this argument is a pass through to ddi_copyxxx()
25005  *			  directly from the mode argument of ioctl().
25006  *
25007  * Return Code: code returned by sd_persistent_reservation_in_read_keys()
25008  *		ENXIO
25009  *		EFAULT
25010  */
25011 
25012 static int
25013 sd_mhdioc_inkeys(dev_t dev, caddr_t arg, int flag)
25014 {
25015 	struct sd_lun		*un;
25016 	mhioc_inkeys_t		inkeys;
25017 	int			rval = 0;
25018 
25019 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25020 		return (ENXIO);
25021 	}
25022 
25023 #ifdef _MULTI_DATAMODEL
25024 	switch (ddi_model_convert_from(flag & FMODELS)) {
25025 	case DDI_MODEL_ILP32: {
25026 		struct mhioc_inkeys32	inkeys32;
25027 
25028 		if (ddi_copyin(arg, &inkeys32,
25029 		    sizeof (struct mhioc_inkeys32), flag) != 0) {
25030 			return (EFAULT);
25031 		}
25032 		inkeys.li = (mhioc_key_list_t *)(uintptr_t)inkeys32.li;
25033 		if ((rval = sd_persistent_reservation_in_read_keys(un,
25034 		    &inkeys, flag)) != 0) {
25035 			return (rval);
25036 		}
25037 		inkeys32.generation = inkeys.generation;
25038 		if (ddi_copyout(&inkeys32, arg, sizeof (struct mhioc_inkeys32),
25039 		    flag) != 0) {
25040 			return (EFAULT);
25041 		}
25042 		break;
25043 	}
25044 	case DDI_MODEL_NONE:
25045 		if (ddi_copyin(arg, &inkeys, sizeof (mhioc_inkeys_t),
25046 		    flag) != 0) {
25047 			return (EFAULT);
25048 		}
25049 		if ((rval = sd_persistent_reservation_in_read_keys(un,
25050 		    &inkeys, flag)) != 0) {
25051 			return (rval);
25052 		}
25053 		if (ddi_copyout(&inkeys, arg, sizeof (mhioc_inkeys_t),
25054 		    flag) != 0) {
25055 			return (EFAULT);
25056 		}
25057 		break;
25058 	}
25059 
25060 #else /* ! _MULTI_DATAMODEL */
25061 
25062 	if (ddi_copyin(arg, &inkeys, sizeof (mhioc_inkeys_t), flag) != 0) {
25063 		return (EFAULT);
25064 	}
25065 	rval = sd_persistent_reservation_in_read_keys(un, &inkeys, flag);
25066 	if (rval != 0) {
25067 		return (rval);
25068 	}
25069 	if (ddi_copyout(&inkeys, arg, sizeof (mhioc_inkeys_t), flag) != 0) {
25070 		return (EFAULT);
25071 	}
25072 
25073 #endif /* _MULTI_DATAMODEL */
25074 
25075 	return (rval);
25076 }
25077 
25078 
25079 /*
25080  *    Function: sd_mhdioc_inresv
25081  *
25082  * Description: This routine is the driver entry point for handling ioctl
25083  *		requests to issue the SCSI-3 Persistent In Read Reservations
25084  *		command to the device (MHIOCGRP_INKEYS).
25085  *
25086  *   Arguments: dev	- the device number
25087  *		arg	- user provided in_resv structure
25088  *		flag	- this argument is a pass through to ddi_copyxxx()
25089  *			  directly from the mode argument of ioctl().
25090  *
25091  * Return Code: code returned by sd_persistent_reservation_in_read_resv()
25092  *		ENXIO
25093  *		EFAULT
25094  */
25095 
25096 static int
25097 sd_mhdioc_inresv(dev_t dev, caddr_t arg, int flag)
25098 {
25099 	struct sd_lun		*un;
25100 	mhioc_inresvs_t		inresvs;
25101 	int			rval = 0;
25102 
25103 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25104 		return (ENXIO);
25105 	}
25106 
25107 #ifdef _MULTI_DATAMODEL
25108 
25109 	switch (ddi_model_convert_from(flag & FMODELS)) {
25110 	case DDI_MODEL_ILP32: {
25111 		struct mhioc_inresvs32	inresvs32;
25112 
25113 		if (ddi_copyin(arg, &inresvs32,
25114 		    sizeof (struct mhioc_inresvs32), flag) != 0) {
25115 			return (EFAULT);
25116 		}
25117 		inresvs.li = (mhioc_resv_desc_list_t *)(uintptr_t)inresvs32.li;
25118 		if ((rval = sd_persistent_reservation_in_read_resv(un,
25119 		    &inresvs, flag)) != 0) {
25120 			return (rval);
25121 		}
25122 		inresvs32.generation = inresvs.generation;
25123 		if (ddi_copyout(&inresvs32, arg,
25124 		    sizeof (struct mhioc_inresvs32), flag) != 0) {
25125 			return (EFAULT);
25126 		}
25127 		break;
25128 	}
25129 	case DDI_MODEL_NONE:
25130 		if (ddi_copyin(arg, &inresvs,
25131 		    sizeof (mhioc_inresvs_t), flag) != 0) {
25132 			return (EFAULT);
25133 		}
25134 		if ((rval = sd_persistent_reservation_in_read_resv(un,
25135 		    &inresvs, flag)) != 0) {
25136 			return (rval);
25137 		}
25138 		if (ddi_copyout(&inresvs, arg,
25139 		    sizeof (mhioc_inresvs_t), flag) != 0) {
25140 			return (EFAULT);
25141 		}
25142 		break;
25143 	}
25144 
25145 #else /* ! _MULTI_DATAMODEL */
25146 
25147 	if (ddi_copyin(arg, &inresvs, sizeof (mhioc_inresvs_t), flag) != 0) {
25148 		return (EFAULT);
25149 	}
25150 	rval = sd_persistent_reservation_in_read_resv(un, &inresvs, flag);
25151 	if (rval != 0) {
25152 		return (rval);
25153 	}
25154 	if (ddi_copyout(&inresvs, arg, sizeof (mhioc_inresvs_t), flag)) {
25155 		return (EFAULT);
25156 	}
25157 
25158 #endif /* ! _MULTI_DATAMODEL */
25159 
25160 	return (rval);
25161 }
25162 
25163 
25164 /*
25165  * The following routines support the clustering functionality described below
25166  * and implement lost reservation reclaim functionality.
25167  *
25168  * Clustering
25169  * ----------
25170  * The clustering code uses two different, independent forms of SCSI
25171  * reservation. Traditional SCSI-2 Reserve/Release and the newer SCSI-3
25172  * Persistent Group Reservations. For any particular disk, it will use either
25173  * SCSI-2 or SCSI-3 PGR but never both at the same time for the same disk.
25174  *
25175  * SCSI-2
25176  * The cluster software takes ownership of a multi-hosted disk by issuing the
25177  * MHIOCTKOWN ioctl to the disk driver. It releases ownership by issuing the
25178  * MHIOCRELEASE ioctl.  Closely related is the MHIOCENFAILFAST ioctl -- a
25179  * cluster, just after taking ownership of the disk with the MHIOCTKOWN ioctl
25180  * then issues the MHIOCENFAILFAST ioctl.  This ioctl "enables failfast" in the
25181  * driver. The meaning of failfast is that if the driver (on this host) ever
25182  * encounters the scsi error return code RESERVATION_CONFLICT from the device,
25183  * it should immediately panic the host. The motivation for this ioctl is that
25184  * if this host does encounter reservation conflict, the underlying cause is
25185  * that some other host of the cluster has decided that this host is no longer
25186  * in the cluster and has seized control of the disks for itself. Since this
25187  * host is no longer in the cluster, it ought to panic itself. The
25188  * MHIOCENFAILFAST ioctl does two things:
25189  *	(a) it sets a flag that will cause any returned RESERVATION_CONFLICT
25190  *      error to panic the host
25191  *      (b) it sets up a periodic timer to test whether this host still has
25192  *      "access" (in that no other host has reserved the device):  if the
25193  *      periodic timer gets RESERVATION_CONFLICT, the host is panicked. The
25194  *      purpose of that periodic timer is to handle scenarios where the host is
25195  *      otherwise temporarily quiescent, temporarily doing no real i/o.
25196  * The MHIOCTKOWN ioctl will "break" a reservation that is held by another host,
25197  * by issuing a SCSI Bus Device Reset.  It will then issue a SCSI Reserve for
25198  * the device itself.
25199  *
25200  * SCSI-3 PGR
25201  * A direct semantic implementation of the SCSI-3 Persistent Reservation
25202  * facility is supported through the shared multihost disk ioctls
25203  * (MHIOCGRP_INKEYS, MHIOCGRP_INRESV, MHIOCGRP_REGISTER, MHIOCGRP_RESERVE,
25204  * MHIOCGRP_PREEMPTANDABORT, MHIOCGRP_CLEAR)
25205  *
25206  * Reservation Reclaim:
25207  * --------------------
25208  * To support the lost reservation reclaim operations this driver creates a
25209  * single thread to handle reinstating reservations on all devices that have
25210  * lost reservations sd_resv_reclaim_requests are logged for all devices that
25211  * have LOST RESERVATIONS when the scsi watch facility callsback sd_mhd_watch_cb
25212  * and the reservation reclaim thread loops through the requests to regain the
25213  * lost reservations.
25214  */
25215 
25216 /*
25217  *    Function: sd_check_mhd()
25218  *
25219  * Description: This function sets up and submits a scsi watch request or
25220  *		terminates an existing watch request. This routine is used in
25221  *		support of reservation reclaim.
25222  *
25223  *   Arguments: dev    - the device 'dev_t' is used for context to discriminate
25224  *			 among multiple watches that share the callback function
25225  *		interval - the number of microseconds specifying the watch
25226  *			   interval for issuing TEST UNIT READY commands. If
25227  *			   set to 0 the watch should be terminated. If the
25228  *			   interval is set to 0 and if the device is required
25229  *			   to hold reservation while disabling failfast, the
25230  *			   watch is restarted with an interval of
25231  *			   reinstate_resv_delay.
25232  *
25233  * Return Code: 0	   - Successful submit/terminate of scsi watch request
25234  *		ENXIO      - Indicates an invalid device was specified
25235  *		EAGAIN     - Unable to submit the scsi watch request
25236  */
25237 
25238 static int
25239 sd_check_mhd(dev_t dev, int interval)
25240 {
25241 	struct sd_lun	*un;
25242 	opaque_t	token;
25243 
25244 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25245 		return (ENXIO);
25246 	}
25247 
25248 	/* is this a watch termination request? */
25249 	if (interval == 0) {
25250 		mutex_enter(SD_MUTEX(un));
25251 		/* if there is an existing watch task then terminate it */
25252 		if (un->un_mhd_token) {
25253 			token = un->un_mhd_token;
25254 			un->un_mhd_token = NULL;
25255 			mutex_exit(SD_MUTEX(un));
25256 			(void) scsi_watch_request_terminate(token,
25257 			    SCSI_WATCH_TERMINATE_ALL_WAIT);
25258 			mutex_enter(SD_MUTEX(un));
25259 		} else {
25260 			mutex_exit(SD_MUTEX(un));
25261 			/*
25262 			 * Note: If we return here we don't check for the
25263 			 * failfast case. This is the original legacy
25264 			 * implementation but perhaps we should be checking
25265 			 * the failfast case.
25266 			 */
25267 			return (0);
25268 		}
25269 		/*
25270 		 * If the device is required to hold reservation while
25271 		 * disabling failfast, we need to restart the scsi_watch
25272 		 * routine with an interval of reinstate_resv_delay.
25273 		 */
25274 		if (un->un_resvd_status & SD_RESERVE) {
25275 			interval = sd_reinstate_resv_delay/1000;
25276 		} else {
25277 			/* no failfast so bail */
25278 			mutex_exit(SD_MUTEX(un));
25279 			return (0);
25280 		}
25281 		mutex_exit(SD_MUTEX(un));
25282 	}
25283 
25284 	/*
25285 	 * adjust minimum time interval to 1 second,
25286 	 * and convert from msecs to usecs
25287 	 */
25288 	if (interval > 0 && interval < 1000) {
25289 		interval = 1000;
25290 	}
25291 	interval *= 1000;
25292 
25293 	/*
25294 	 * submit the request to the scsi_watch service
25295 	 */
25296 	token = scsi_watch_request_submit(SD_SCSI_DEVP(un), interval,
25297 	    SENSE_LENGTH, sd_mhd_watch_cb, (caddr_t)dev);
25298 	if (token == NULL) {
25299 		return (EAGAIN);
25300 	}
25301 
25302 	/*
25303 	 * save token for termination later on
25304 	 */
25305 	mutex_enter(SD_MUTEX(un));
25306 	un->un_mhd_token = token;
25307 	mutex_exit(SD_MUTEX(un));
25308 	return (0);
25309 }
25310 
25311 
25312 /*
25313  *    Function: sd_mhd_watch_cb()
25314  *
25315  * Description: This function is the call back function used by the scsi watch
25316  *		facility. The scsi watch facility sends the "Test Unit Ready"
25317  *		and processes the status. If applicable (i.e. a "Unit Attention"
25318  *		status and automatic "Request Sense" not used) the scsi watch
25319  *		facility will send a "Request Sense" and retrieve the sense data
25320  *		to be passed to this callback function. In either case the
25321  *		automatic "Request Sense" or the facility submitting one, this
25322  *		callback is passed the status and sense data.
25323  *
25324  *   Arguments: arg -   the device 'dev_t' is used for context to discriminate
25325  *			among multiple watches that share this callback function
25326  *		resultp - scsi watch facility result packet containing scsi
25327  *			  packet, status byte and sense data
25328  *
25329  * Return Code: 0 - continue the watch task
25330  *		non-zero - terminate the watch task
25331  */
25332 
25333 static int
25334 sd_mhd_watch_cb(caddr_t arg, struct scsi_watch_result *resultp)
25335 {
25336 	struct sd_lun			*un;
25337 	struct scsi_status		*statusp;
25338 	uint8_t				*sensep;
25339 	struct scsi_pkt			*pkt;
25340 	uchar_t				actual_sense_length;
25341 	dev_t				dev = (dev_t)arg;
25342 
25343 	ASSERT(resultp != NULL);
25344 	statusp			= resultp->statusp;
25345 	sensep			= (uint8_t *)resultp->sensep;
25346 	pkt			= resultp->pkt;
25347 	actual_sense_length	= resultp->actual_sense_length;
25348 
25349 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25350 		return (ENXIO);
25351 	}
25352 
25353 	SD_TRACE(SD_LOG_IOCTL_MHD, un,
25354 	    "sd_mhd_watch_cb: reason '%s', status '%s'\n",
25355 	    scsi_rname(pkt->pkt_reason), sd_sname(*((unsigned char *)statusp)));
25356 
25357 	/* Begin processing of the status and/or sense data */
25358 	if (pkt->pkt_reason != CMD_CMPLT) {
25359 		/* Handle the incomplete packet */
25360 		sd_mhd_watch_incomplete(un, pkt);
25361 		return (0);
25362 	} else if (*((unsigned char *)statusp) != STATUS_GOOD) {
25363 		if (*((unsigned char *)statusp)
25364 		    == STATUS_RESERVATION_CONFLICT) {
25365 			/*
25366 			 * Handle a reservation conflict by panicking if
25367 			 * configured for failfast or by logging the conflict
25368 			 * and updating the reservation status
25369 			 */
25370 			mutex_enter(SD_MUTEX(un));
25371 			if ((un->un_resvd_status & SD_FAILFAST) &&
25372 			    (sd_failfast_enable)) {
25373 				sd_panic_for_res_conflict(un);
25374 				/*NOTREACHED*/
25375 			}
25376 			SD_INFO(SD_LOG_IOCTL_MHD, un,
25377 			    "sd_mhd_watch_cb: Reservation Conflict\n");
25378 			un->un_resvd_status |= SD_RESERVATION_CONFLICT;
25379 			mutex_exit(SD_MUTEX(un));
25380 		}
25381 	}
25382 
25383 	if (sensep != NULL) {
25384 		if (actual_sense_length >= (SENSE_LENGTH - 2)) {
25385 			mutex_enter(SD_MUTEX(un));
25386 			if ((scsi_sense_asc(sensep) ==
25387 			    SD_SCSI_RESET_SENSE_CODE) &&
25388 			    (un->un_resvd_status & SD_RESERVE)) {
25389 				/*
25390 				 * The additional sense code indicates a power
25391 				 * on or bus device reset has occurred; update
25392 				 * the reservation status.
25393 				 */
25394 				un->un_resvd_status |=
25395 				    (SD_LOST_RESERVE | SD_WANT_RESERVE);
25396 				SD_INFO(SD_LOG_IOCTL_MHD, un,
25397 				    "sd_mhd_watch_cb: Lost Reservation\n");
25398 			}
25399 		} else {
25400 			return (0);
25401 		}
25402 	} else {
25403 		mutex_enter(SD_MUTEX(un));
25404 	}
25405 
25406 	if ((un->un_resvd_status & SD_RESERVE) &&
25407 	    (un->un_resvd_status & SD_LOST_RESERVE)) {
25408 		if (un->un_resvd_status & SD_WANT_RESERVE) {
25409 			/*
25410 			 * A reset occurred in between the last probe and this
25411 			 * one so if a timeout is pending cancel it.
25412 			 */
25413 			if (un->un_resvd_timeid) {
25414 				timeout_id_t temp_id = un->un_resvd_timeid;
25415 				un->un_resvd_timeid = NULL;
25416 				mutex_exit(SD_MUTEX(un));
25417 				(void) untimeout(temp_id);
25418 				mutex_enter(SD_MUTEX(un));
25419 			}
25420 			un->un_resvd_status &= ~SD_WANT_RESERVE;
25421 		}
25422 		if (un->un_resvd_timeid == 0) {
25423 			/* Schedule a timeout to handle the lost reservation */
25424 			un->un_resvd_timeid = timeout(sd_mhd_resvd_recover,
25425 			    (void *)dev,
25426 			    drv_usectohz(sd_reinstate_resv_delay));
25427 		}
25428 	}
25429 	mutex_exit(SD_MUTEX(un));
25430 	return (0);
25431 }
25432 
25433 
25434 /*
25435  *    Function: sd_mhd_watch_incomplete()
25436  *
25437  * Description: This function is used to find out why a scsi pkt sent by the
25438  *		scsi watch facility was not completed. Under some scenarios this
25439  *		routine will return. Otherwise it will send a bus reset to see
25440  *		if the drive is still online.
25441  *
25442  *   Arguments: un  - driver soft state (unit) structure
25443  *		pkt - incomplete scsi pkt
25444  */
25445 
25446 static void
25447 sd_mhd_watch_incomplete(struct sd_lun *un, struct scsi_pkt *pkt)
25448 {
25449 	int	be_chatty;
25450 	int	perr;
25451 
25452 	ASSERT(pkt != NULL);
25453 	ASSERT(un != NULL);
25454 	be_chatty	= (!(pkt->pkt_flags & FLAG_SILENT));
25455 	perr		= (pkt->pkt_statistics & STAT_PERR);
25456 
25457 	mutex_enter(SD_MUTEX(un));
25458 	if (un->un_state == SD_STATE_DUMPING) {
25459 		mutex_exit(SD_MUTEX(un));
25460 		return;
25461 	}
25462 
25463 	switch (pkt->pkt_reason) {
25464 	case CMD_UNX_BUS_FREE:
25465 		/*
25466 		 * If we had a parity error that caused the target to drop BSY*,
25467 		 * don't be chatty about it.
25468 		 */
25469 		if (perr && be_chatty) {
25470 			be_chatty = 0;
25471 		}
25472 		break;
25473 	case CMD_TAG_REJECT:
25474 		/*
25475 		 * The SCSI-2 spec states that a tag reject will be sent by the
25476 		 * target if tagged queuing is not supported. A tag reject may
25477 		 * also be sent during certain initialization periods or to
25478 		 * control internal resources. For the latter case the target
25479 		 * may also return Queue Full.
25480 		 *
25481 		 * If this driver receives a tag reject from a target that is
25482 		 * going through an init period or controlling internal
25483 		 * resources tagged queuing will be disabled. This is a less
25484 		 * than optimal behavior but the driver is unable to determine
25485 		 * the target state and assumes tagged queueing is not supported
25486 		 */
25487 		pkt->pkt_flags = 0;
25488 		un->un_tagflags = 0;
25489 
25490 		if (un->un_f_opt_queueing == TRUE) {
25491 			un->un_throttle = min(un->un_throttle, 3);
25492 		} else {
25493 			un->un_throttle = 1;
25494 		}
25495 		mutex_exit(SD_MUTEX(un));
25496 		(void) scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing", 0, 1);
25497 		mutex_enter(SD_MUTEX(un));
25498 		break;
25499 	case CMD_INCOMPLETE:
25500 		/*
25501 		 * The transport stopped with an abnormal state, fallthrough and
25502 		 * reset the target and/or bus unless selection did not complete
25503 		 * (indicated by STATE_GOT_BUS) in which case we don't want to
25504 		 * go through a target/bus reset
25505 		 */
25506 		if (pkt->pkt_state == STATE_GOT_BUS) {
25507 			break;
25508 		}
25509 		/*FALLTHROUGH*/
25510 
25511 	case CMD_TIMEOUT:
25512 	default:
25513 		/*
25514 		 * The lun may still be running the command, so a lun reset
25515 		 * should be attempted. If the lun reset fails or cannot be
25516 		 * issued, than try a target reset. Lastly try a bus reset.
25517 		 */
25518 		if ((pkt->pkt_statistics &
25519 		    (STAT_BUS_RESET|STAT_DEV_RESET|STAT_ABORTED)) == 0) {
25520 			int reset_retval = 0;
25521 			mutex_exit(SD_MUTEX(un));
25522 			if (un->un_f_allow_bus_device_reset == TRUE) {
25523 				if (un->un_f_lun_reset_enabled == TRUE) {
25524 					reset_retval =
25525 					    scsi_reset(SD_ADDRESS(un),
25526 					    RESET_LUN);
25527 				}
25528 				if (reset_retval == 0) {
25529 					reset_retval =
25530 					    scsi_reset(SD_ADDRESS(un),
25531 					    RESET_TARGET);
25532 				}
25533 			}
25534 			if (reset_retval == 0) {
25535 				(void) scsi_reset(SD_ADDRESS(un), RESET_ALL);
25536 			}
25537 			mutex_enter(SD_MUTEX(un));
25538 		}
25539 		break;
25540 	}
25541 
25542 	/* A device/bus reset has occurred; update the reservation status. */
25543 	if ((pkt->pkt_reason == CMD_RESET) || (pkt->pkt_statistics &
25544 	    (STAT_BUS_RESET | STAT_DEV_RESET))) {
25545 		if ((un->un_resvd_status & SD_RESERVE) == SD_RESERVE) {
25546 			un->un_resvd_status |=
25547 			    (SD_LOST_RESERVE | SD_WANT_RESERVE);
25548 			SD_INFO(SD_LOG_IOCTL_MHD, un,
25549 			    "sd_mhd_watch_incomplete: Lost Reservation\n");
25550 		}
25551 	}
25552 
25553 	/*
25554 	 * The disk has been turned off; Update the device state.
25555 	 *
25556 	 * Note: Should we be offlining the disk here?
25557 	 */
25558 	if (pkt->pkt_state == STATE_GOT_BUS) {
25559 		SD_INFO(SD_LOG_IOCTL_MHD, un, "sd_mhd_watch_incomplete: "
25560 		    "Disk not responding to selection\n");
25561 		if (un->un_state != SD_STATE_OFFLINE) {
25562 			New_state(un, SD_STATE_OFFLINE);
25563 		}
25564 	} else if (be_chatty) {
25565 		/*
25566 		 * suppress messages if they are all the same pkt reason;
25567 		 * with TQ, many (up to 256) are returned with the same
25568 		 * pkt_reason
25569 		 */
25570 		if (pkt->pkt_reason != un->un_last_pkt_reason) {
25571 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
25572 			    "sd_mhd_watch_incomplete: "
25573 			    "SCSI transport failed: reason '%s'\n",
25574 			    scsi_rname(pkt->pkt_reason));
25575 		}
25576 	}
25577 	un->un_last_pkt_reason = pkt->pkt_reason;
25578 	mutex_exit(SD_MUTEX(un));
25579 }
25580 
25581 
25582 /*
25583  *    Function: sd_sname()
25584  *
25585  * Description: This is a simple little routine to return a string containing
25586  *		a printable description of command status byte for use in
25587  *		logging.
25588  *
25589  *   Arguments: status - pointer to a status byte
25590  *
25591  * Return Code: char * - string containing status description.
25592  */
25593 
25594 static char *
25595 sd_sname(uchar_t status)
25596 {
25597 	switch (status & STATUS_MASK) {
25598 	case STATUS_GOOD:
25599 		return ("good status");
25600 	case STATUS_CHECK:
25601 		return ("check condition");
25602 	case STATUS_MET:
25603 		return ("condition met");
25604 	case STATUS_BUSY:
25605 		return ("busy");
25606 	case STATUS_INTERMEDIATE:
25607 		return ("intermediate");
25608 	case STATUS_INTERMEDIATE_MET:
25609 		return ("intermediate - condition met");
25610 	case STATUS_RESERVATION_CONFLICT:
25611 		return ("reservation_conflict");
25612 	case STATUS_TERMINATED:
25613 		return ("command terminated");
25614 	case STATUS_QFULL:
25615 		return ("queue full");
25616 	default:
25617 		return ("<unknown status>");
25618 	}
25619 }
25620 
25621 
25622 /*
25623  *    Function: sd_mhd_resvd_recover()
25624  *
25625  * Description: This function adds a reservation entry to the
25626  *		sd_resv_reclaim_request list and signals the reservation
25627  *		reclaim thread that there is work pending. If the reservation
25628  *		reclaim thread has not been previously created this function
25629  *		will kick it off.
25630  *
25631  *   Arguments: arg -   the device 'dev_t' is used for context to discriminate
25632  *			among multiple watches that share this callback function
25633  *
25634  *     Context: This routine is called by timeout() and is run in interrupt
25635  *		context. It must not sleep or call other functions which may
25636  *		sleep.
25637  */
25638 
25639 static void
25640 sd_mhd_resvd_recover(void *arg)
25641 {
25642 	dev_t			dev = (dev_t)arg;
25643 	struct sd_lun		*un;
25644 	struct sd_thr_request	*sd_treq = NULL;
25645 	struct sd_thr_request	*sd_cur = NULL;
25646 	struct sd_thr_request	*sd_prev = NULL;
25647 	int			already_there = 0;
25648 
25649 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25650 		return;
25651 	}
25652 
25653 	mutex_enter(SD_MUTEX(un));
25654 	un->un_resvd_timeid = NULL;
25655 	if (un->un_resvd_status & SD_WANT_RESERVE) {
25656 		/*
25657 		 * There was a reset so don't issue the reserve, allow the
25658 		 * sd_mhd_watch_cb callback function to notice this and
25659 		 * reschedule the timeout for reservation.
25660 		 */
25661 		mutex_exit(SD_MUTEX(un));
25662 		return;
25663 	}
25664 	mutex_exit(SD_MUTEX(un));
25665 
25666 	/*
25667 	 * Add this device to the sd_resv_reclaim_request list and the
25668 	 * sd_resv_reclaim_thread should take care of the rest.
25669 	 *
25670 	 * Note: We can't sleep in this context so if the memory allocation
25671 	 * fails allow the sd_mhd_watch_cb callback function to notice this and
25672 	 * reschedule the timeout for reservation.  (4378460)
25673 	 */
25674 	sd_treq = (struct sd_thr_request *)
25675 	    kmem_zalloc(sizeof (struct sd_thr_request), KM_NOSLEEP);
25676 	if (sd_treq == NULL) {
25677 		return;
25678 	}
25679 
25680 	sd_treq->sd_thr_req_next = NULL;
25681 	sd_treq->dev = dev;
25682 	mutex_enter(&sd_tr.srq_resv_reclaim_mutex);
25683 	if (sd_tr.srq_thr_req_head == NULL) {
25684 		sd_tr.srq_thr_req_head = sd_treq;
25685 	} else {
25686 		sd_cur = sd_prev = sd_tr.srq_thr_req_head;
25687 		for (; sd_cur != NULL; sd_cur = sd_cur->sd_thr_req_next) {
25688 			if (sd_cur->dev == dev) {
25689 				/*
25690 				 * already in Queue so don't log
25691 				 * another request for the device
25692 				 */
25693 				already_there = 1;
25694 				break;
25695 			}
25696 			sd_prev = sd_cur;
25697 		}
25698 		if (!already_there) {
25699 			SD_INFO(SD_LOG_IOCTL_MHD, un, "sd_mhd_resvd_recover: "
25700 			    "logging request for %lx\n", dev);
25701 			sd_prev->sd_thr_req_next = sd_treq;
25702 		} else {
25703 			kmem_free(sd_treq, sizeof (struct sd_thr_request));
25704 		}
25705 	}
25706 
25707 	/*
25708 	 * Create a kernel thread to do the reservation reclaim and free up this
25709 	 * thread. We cannot block this thread while we go away to do the
25710 	 * reservation reclaim
25711 	 */
25712 	if (sd_tr.srq_resv_reclaim_thread == NULL)
25713 		sd_tr.srq_resv_reclaim_thread = thread_create(NULL, 0,
25714 		    sd_resv_reclaim_thread, NULL,
25715 		    0, &p0, TS_RUN, v.v_maxsyspri - 2);
25716 
25717 	/* Tell the reservation reclaim thread that it has work to do */
25718 	cv_signal(&sd_tr.srq_resv_reclaim_cv);
25719 	mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25720 }
25721 
25722 /*
25723  *    Function: sd_resv_reclaim_thread()
25724  *
25725  * Description: This function implements the reservation reclaim operations
25726  *
25727  *   Arguments: arg - the device 'dev_t' is used for context to discriminate
25728  *		      among multiple watches that share this callback function
25729  */
25730 
25731 static void
25732 sd_resv_reclaim_thread()
25733 {
25734 	struct sd_lun		*un;
25735 	struct sd_thr_request	*sd_mhreq;
25736 
25737 	/* Wait for work */
25738 	mutex_enter(&sd_tr.srq_resv_reclaim_mutex);
25739 	if (sd_tr.srq_thr_req_head == NULL) {
25740 		cv_wait(&sd_tr.srq_resv_reclaim_cv,
25741 		    &sd_tr.srq_resv_reclaim_mutex);
25742 	}
25743 
25744 	/* Loop while we have work */
25745 	while ((sd_tr.srq_thr_cur_req = sd_tr.srq_thr_req_head) != NULL) {
25746 		un = ddi_get_soft_state(sd_state,
25747 		    SDUNIT(sd_tr.srq_thr_cur_req->dev));
25748 		if (un == NULL) {
25749 			/*
25750 			 * softstate structure is NULL so just
25751 			 * dequeue the request and continue
25752 			 */
25753 			sd_tr.srq_thr_req_head =
25754 			    sd_tr.srq_thr_cur_req->sd_thr_req_next;
25755 			kmem_free(sd_tr.srq_thr_cur_req,
25756 			    sizeof (struct sd_thr_request));
25757 			continue;
25758 		}
25759 
25760 		/* dequeue the request */
25761 		sd_mhreq = sd_tr.srq_thr_cur_req;
25762 		sd_tr.srq_thr_req_head =
25763 		    sd_tr.srq_thr_cur_req->sd_thr_req_next;
25764 		mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25765 
25766 		/*
25767 		 * Reclaim reservation only if SD_RESERVE is still set. There
25768 		 * may have been a call to MHIOCRELEASE before we got here.
25769 		 */
25770 		mutex_enter(SD_MUTEX(un));
25771 		if ((un->un_resvd_status & SD_RESERVE) == SD_RESERVE) {
25772 			/*
25773 			 * Note: The SD_LOST_RESERVE flag is cleared before
25774 			 * reclaiming the reservation. If this is done after the
25775 			 * call to sd_reserve_release a reservation loss in the
25776 			 * window between pkt completion of reserve cmd and
25777 			 * mutex_enter below may not be recognized
25778 			 */
25779 			un->un_resvd_status &= ~SD_LOST_RESERVE;
25780 			mutex_exit(SD_MUTEX(un));
25781 
25782 			if (sd_reserve_release(sd_mhreq->dev,
25783 			    SD_RESERVE) == 0) {
25784 				mutex_enter(SD_MUTEX(un));
25785 				un->un_resvd_status |= SD_RESERVE;
25786 				mutex_exit(SD_MUTEX(un));
25787 				SD_INFO(SD_LOG_IOCTL_MHD, un,
25788 				    "sd_resv_reclaim_thread: "
25789 				    "Reservation Recovered\n");
25790 			} else {
25791 				mutex_enter(SD_MUTEX(un));
25792 				un->un_resvd_status |= SD_LOST_RESERVE;
25793 				mutex_exit(SD_MUTEX(un));
25794 				SD_INFO(SD_LOG_IOCTL_MHD, un,
25795 				    "sd_resv_reclaim_thread: Failed "
25796 				    "Reservation Recovery\n");
25797 			}
25798 		} else {
25799 			mutex_exit(SD_MUTEX(un));
25800 		}
25801 		mutex_enter(&sd_tr.srq_resv_reclaim_mutex);
25802 		ASSERT(sd_mhreq == sd_tr.srq_thr_cur_req);
25803 		kmem_free(sd_mhreq, sizeof (struct sd_thr_request));
25804 		sd_mhreq = sd_tr.srq_thr_cur_req = NULL;
25805 		/*
25806 		 * wakeup the destroy thread if anyone is waiting on
25807 		 * us to complete.
25808 		 */
25809 		cv_signal(&sd_tr.srq_inprocess_cv);
25810 		SD_TRACE(SD_LOG_IOCTL_MHD, un,
25811 		    "sd_resv_reclaim_thread: cv_signalling current request \n");
25812 	}
25813 
25814 	/*
25815 	 * cleanup the sd_tr structure now that this thread will not exist
25816 	 */
25817 	ASSERT(sd_tr.srq_thr_req_head == NULL);
25818 	ASSERT(sd_tr.srq_thr_cur_req == NULL);
25819 	sd_tr.srq_resv_reclaim_thread = NULL;
25820 	mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25821 	thread_exit();
25822 }
25823 
25824 
25825 /*
25826  *    Function: sd_rmv_resv_reclaim_req()
25827  *
25828  * Description: This function removes any pending reservation reclaim requests
25829  *		for the specified device.
25830  *
25831  *   Arguments: dev - the device 'dev_t'
25832  */
25833 
25834 static void
25835 sd_rmv_resv_reclaim_req(dev_t dev)
25836 {
25837 	struct sd_thr_request *sd_mhreq;
25838 	struct sd_thr_request *sd_prev;
25839 
25840 	/* Remove a reservation reclaim request from the list */
25841 	mutex_enter(&sd_tr.srq_resv_reclaim_mutex);
25842 	if (sd_tr.srq_thr_cur_req && sd_tr.srq_thr_cur_req->dev == dev) {
25843 		/*
25844 		 * We are attempting to reinstate reservation for
25845 		 * this device. We wait for sd_reserve_release()
25846 		 * to return before we return.
25847 		 */
25848 		cv_wait(&sd_tr.srq_inprocess_cv,
25849 		    &sd_tr.srq_resv_reclaim_mutex);
25850 	} else {
25851 		sd_prev = sd_mhreq = sd_tr.srq_thr_req_head;
25852 		if (sd_mhreq && sd_mhreq->dev == dev) {
25853 			sd_tr.srq_thr_req_head = sd_mhreq->sd_thr_req_next;
25854 			kmem_free(sd_mhreq, sizeof (struct sd_thr_request));
25855 			mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25856 			return;
25857 		}
25858 		for (; sd_mhreq != NULL; sd_mhreq = sd_mhreq->sd_thr_req_next) {
25859 			if (sd_mhreq && sd_mhreq->dev == dev) {
25860 				break;
25861 			}
25862 			sd_prev = sd_mhreq;
25863 		}
25864 		if (sd_mhreq != NULL) {
25865 			sd_prev->sd_thr_req_next = sd_mhreq->sd_thr_req_next;
25866 			kmem_free(sd_mhreq, sizeof (struct sd_thr_request));
25867 		}
25868 	}
25869 	mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25870 }
25871 
25872 
25873 /*
25874  *    Function: sd_mhd_reset_notify_cb()
25875  *
25876  * Description: This is a call back function for scsi_reset_notify. This
25877  *		function updates the softstate reserved status and logs the
25878  *		reset. The driver scsi watch facility callback function
25879  *		(sd_mhd_watch_cb) and reservation reclaim thread functionality
25880  *		will reclaim the reservation.
25881  *
25882  *   Arguments: arg  - driver soft state (unit) structure
25883  */
25884 
25885 static void
25886 sd_mhd_reset_notify_cb(caddr_t arg)
25887 {
25888 	struct sd_lun *un = (struct sd_lun *)arg;
25889 
25890 	mutex_enter(SD_MUTEX(un));
25891 	if ((un->un_resvd_status & SD_RESERVE) == SD_RESERVE) {
25892 		un->un_resvd_status |= (SD_LOST_RESERVE | SD_WANT_RESERVE);
25893 		SD_INFO(SD_LOG_IOCTL_MHD, un,
25894 		    "sd_mhd_reset_notify_cb: Lost Reservation\n");
25895 	}
25896 	mutex_exit(SD_MUTEX(un));
25897 }
25898 
25899 
25900 /*
25901  *    Function: sd_take_ownership()
25902  *
25903  * Description: This routine implements an algorithm to achieve a stable
25904  *		reservation on disks which don't implement priority reserve,
25905  *		and makes sure that other host lose re-reservation attempts.
25906  *		This algorithm contains of a loop that keeps issuing the RESERVE
25907  *		for some period of time (min_ownership_delay, default 6 seconds)
25908  *		During that loop, it looks to see if there has been a bus device
25909  *		reset or bus reset (both of which cause an existing reservation
25910  *		to be lost). If the reservation is lost issue RESERVE until a
25911  *		period of min_ownership_delay with no resets has gone by, or
25912  *		until max_ownership_delay has expired. This loop ensures that
25913  *		the host really did manage to reserve the device, in spite of
25914  *		resets. The looping for min_ownership_delay (default six
25915  *		seconds) is important to early generation clustering products,
25916  *		Solstice HA 1.x and Sun Cluster 2.x. Those products use an
25917  *		MHIOCENFAILFAST periodic timer of two seconds. By having
25918  *		MHIOCTKOWN issue Reserves in a loop for six seconds, and having
25919  *		MHIOCENFAILFAST poll every two seconds, the idea is that by the
25920  *		time the MHIOCTKOWN ioctl returns, the other host (if any) will
25921  *		have already noticed, via the MHIOCENFAILFAST polling, that it
25922  *		no longer "owns" the disk and will have panicked itself.  Thus,
25923  *		the host issuing the MHIOCTKOWN is assured (with timing
25924  *		dependencies) that by the time it actually starts to use the
25925  *		disk for real work, the old owner is no longer accessing it.
25926  *
25927  *		min_ownership_delay is the minimum amount of time for which the
25928  *		disk must be reserved continuously devoid of resets before the
25929  *		MHIOCTKOWN ioctl will return success.
25930  *
25931  *		max_ownership_delay indicates the amount of time by which the
25932  *		take ownership should succeed or timeout with an error.
25933  *
25934  *   Arguments: dev - the device 'dev_t'
25935  *		*p  - struct containing timing info.
25936  *
25937  * Return Code: 0 for success or error code
25938  */
25939 
25940 static int
25941 sd_take_ownership(dev_t dev, struct mhioctkown *p)
25942 {
25943 	struct sd_lun	*un;
25944 	int		rval;
25945 	int		err;
25946 	int		reservation_count   = 0;
25947 	int		min_ownership_delay =  6000000; /* in usec */
25948 	int		max_ownership_delay = 30000000; /* in usec */
25949 	clock_t		start_time;	/* starting time of this algorithm */
25950 	clock_t		end_time;	/* time limit for giving up */
25951 	clock_t		ownership_time;	/* time limit for stable ownership */
25952 	clock_t		current_time;
25953 	clock_t		previous_current_time;
25954 
25955 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25956 		return (ENXIO);
25957 	}
25958 
25959 	/*
25960 	 * Attempt a device reservation. A priority reservation is requested.
25961 	 */
25962 	if ((rval = sd_reserve_release(dev, SD_PRIORITY_RESERVE))
25963 	    != SD_SUCCESS) {
25964 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
25965 		    "sd_take_ownership: return(1)=%d\n", rval);
25966 		return (rval);
25967 	}
25968 
25969 	/* Update the softstate reserved status to indicate the reservation */
25970 	mutex_enter(SD_MUTEX(un));
25971 	un->un_resvd_status |= SD_RESERVE;
25972 	un->un_resvd_status &=
25973 	    ~(SD_LOST_RESERVE | SD_WANT_RESERVE | SD_RESERVATION_CONFLICT);
25974 	mutex_exit(SD_MUTEX(un));
25975 
25976 	if (p != NULL) {
25977 		if (p->min_ownership_delay != 0) {
25978 			min_ownership_delay = p->min_ownership_delay * 1000;
25979 		}
25980 		if (p->max_ownership_delay != 0) {
25981 			max_ownership_delay = p->max_ownership_delay * 1000;
25982 		}
25983 	}
25984 	SD_INFO(SD_LOG_IOCTL_MHD, un,
25985 	    "sd_take_ownership: min, max delays: %d, %d\n",
25986 	    min_ownership_delay, max_ownership_delay);
25987 
25988 	start_time = ddi_get_lbolt();
25989 	current_time	= start_time;
25990 	ownership_time	= current_time + drv_usectohz(min_ownership_delay);
25991 	end_time	= start_time + drv_usectohz(max_ownership_delay);
25992 
25993 	while (current_time - end_time < 0) {
25994 		delay(drv_usectohz(500000));
25995 
25996 		if ((err = sd_reserve_release(dev, SD_RESERVE)) != 0) {
25997 			if ((sd_reserve_release(dev, SD_RESERVE)) != 0) {
25998 				mutex_enter(SD_MUTEX(un));
25999 				rval = (un->un_resvd_status &
26000 				    SD_RESERVATION_CONFLICT) ? EACCES : EIO;
26001 				mutex_exit(SD_MUTEX(un));
26002 				break;
26003 			}
26004 		}
26005 		previous_current_time = current_time;
26006 		current_time = ddi_get_lbolt();
26007 		mutex_enter(SD_MUTEX(un));
26008 		if (err || (un->un_resvd_status & SD_LOST_RESERVE)) {
26009 			ownership_time = ddi_get_lbolt() +
26010 			    drv_usectohz(min_ownership_delay);
26011 			reservation_count = 0;
26012 		} else {
26013 			reservation_count++;
26014 		}
26015 		un->un_resvd_status |= SD_RESERVE;
26016 		un->un_resvd_status &= ~(SD_LOST_RESERVE | SD_WANT_RESERVE);
26017 		mutex_exit(SD_MUTEX(un));
26018 
26019 		SD_INFO(SD_LOG_IOCTL_MHD, un,
26020 		    "sd_take_ownership: ticks for loop iteration=%ld, "
26021 		    "reservation=%s\n", (current_time - previous_current_time),
26022 		    reservation_count ? "ok" : "reclaimed");
26023 
26024 		if (current_time - ownership_time >= 0 &&
26025 		    reservation_count >= 4) {
26026 			rval = 0; /* Achieved a stable ownership */
26027 			break;
26028 		}
26029 		if (current_time - end_time >= 0) {
26030 			rval = EACCES; /* No ownership in max possible time */
26031 			break;
26032 		}
26033 	}
26034 	SD_TRACE(SD_LOG_IOCTL_MHD, un,
26035 	    "sd_take_ownership: return(2)=%d\n", rval);
26036 	return (rval);
26037 }
26038 
26039 
26040 /*
26041  *    Function: sd_reserve_release()
26042  *
26043  * Description: This function builds and sends scsi RESERVE, RELEASE, and
26044  *		PRIORITY RESERVE commands based on a user specified command type
26045  *
26046  *   Arguments: dev - the device 'dev_t'
26047  *		cmd - user specified command type; one of SD_PRIORITY_RESERVE,
26048  *		      SD_RESERVE, SD_RELEASE
26049  *
26050  * Return Code: 0 or Error Code
26051  */
26052 
26053 static int
26054 sd_reserve_release(dev_t dev, int cmd)
26055 {
26056 	struct uscsi_cmd	*com = NULL;
26057 	struct sd_lun		*un = NULL;
26058 	char			cdb[CDB_GROUP0];
26059 	int			rval;
26060 
26061 	ASSERT((cmd == SD_RELEASE) || (cmd == SD_RESERVE) ||
26062 	    (cmd == SD_PRIORITY_RESERVE));
26063 
26064 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
26065 		return (ENXIO);
26066 	}
26067 
26068 	/* instantiate and initialize the command and cdb */
26069 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
26070 	bzero(cdb, CDB_GROUP0);
26071 	com->uscsi_flags   = USCSI_SILENT;
26072 	com->uscsi_timeout = un->un_reserve_release_time;
26073 	com->uscsi_cdblen  = CDB_GROUP0;
26074 	com->uscsi_cdb	   = cdb;
26075 	if (cmd == SD_RELEASE) {
26076 		cdb[0] = SCMD_RELEASE;
26077 	} else {
26078 		cdb[0] = SCMD_RESERVE;
26079 	}
26080 
26081 	/* Send the command. */
26082 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
26083 	    SD_PATH_STANDARD);
26084 
26085 	/*
26086 	 * "break" a reservation that is held by another host, by issuing a
26087 	 * reset if priority reserve is desired, and we could not get the
26088 	 * device.
26089 	 */
26090 	if ((cmd == SD_PRIORITY_RESERVE) &&
26091 	    (rval != 0) && (com->uscsi_status == STATUS_RESERVATION_CONFLICT)) {
26092 		/*
26093 		 * First try to reset the LUN. If we cannot, then try a target
26094 		 * reset, followed by a bus reset if the target reset fails.
26095 		 */
26096 		int reset_retval = 0;
26097 		if (un->un_f_lun_reset_enabled == TRUE) {
26098 			reset_retval = scsi_reset(SD_ADDRESS(un), RESET_LUN);
26099 		}
26100 		if (reset_retval == 0) {
26101 			/* The LUN reset either failed or was not issued */
26102 			reset_retval = scsi_reset(SD_ADDRESS(un), RESET_TARGET);
26103 		}
26104 		if ((reset_retval == 0) &&
26105 		    (scsi_reset(SD_ADDRESS(un), RESET_ALL) == 0)) {
26106 			rval = EIO;
26107 			kmem_free(com, sizeof (*com));
26108 			return (rval);
26109 		}
26110 
26111 		bzero(com, sizeof (struct uscsi_cmd));
26112 		com->uscsi_flags   = USCSI_SILENT;
26113 		com->uscsi_cdb	   = cdb;
26114 		com->uscsi_cdblen  = CDB_GROUP0;
26115 		com->uscsi_timeout = 5;
26116 
26117 		/*
26118 		 * Reissue the last reserve command, this time without request
26119 		 * sense.  Assume that it is just a regular reserve command.
26120 		 */
26121 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
26122 		    SD_PATH_STANDARD);
26123 	}
26124 
26125 	/* Return an error if still getting a reservation conflict. */
26126 	if ((rval != 0) && (com->uscsi_status == STATUS_RESERVATION_CONFLICT)) {
26127 		rval = EACCES;
26128 	}
26129 
26130 	kmem_free(com, sizeof (*com));
26131 	return (rval);
26132 }
26133 
26134 
26135 #define	SD_NDUMP_RETRIES	12
26136 /*
26137  *	System Crash Dump routine
26138  */
26139 
26140 static int
26141 sddump(dev_t dev, caddr_t addr, daddr_t blkno, int nblk)
26142 {
26143 	int		instance;
26144 	int		partition;
26145 	int		i;
26146 	int		err;
26147 	struct sd_lun	*un;
26148 	struct scsi_pkt *wr_pktp;
26149 	struct buf	*wr_bp;
26150 	struct buf	wr_buf;
26151 	daddr_t		tgt_byte_offset; /* rmw - byte offset for target */
26152 	daddr_t		tgt_blkno;	/* rmw - blkno for target */
26153 	size_t		tgt_byte_count; /* rmw -  # of bytes to xfer */
26154 	size_t		tgt_nblk; /* rmw -  # of tgt blks to xfer */
26155 	size_t		io_start_offset;
26156 	int		doing_rmw = FALSE;
26157 	int		rval;
26158 	ssize_t		dma_resid;
26159 	daddr_t		oblkno;
26160 	diskaddr_t	nblks = 0;
26161 	diskaddr_t	start_block;
26162 
26163 	instance = SDUNIT(dev);
26164 	if (((un = ddi_get_soft_state(sd_state, instance)) == NULL) ||
26165 	    !SD_IS_VALID_LABEL(un) || ISCD(un)) {
26166 		return (ENXIO);
26167 	}
26168 
26169 	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*un))
26170 
26171 	SD_TRACE(SD_LOG_DUMP, un, "sddump: entry\n");
26172 
26173 	partition = SDPART(dev);
26174 	SD_INFO(SD_LOG_DUMP, un, "sddump: partition = %d\n", partition);
26175 
26176 	if (!(NOT_DEVBSIZE(un))) {
26177 		int secmask = 0;
26178 		int blknomask = 0;
26179 
26180 		blknomask = (un->un_tgt_blocksize / DEV_BSIZE) - 1;
26181 		secmask = un->un_tgt_blocksize - 1;
26182 
26183 		if (blkno & blknomask) {
26184 			SD_TRACE(SD_LOG_DUMP, un,
26185 			    "sddump: dump start block not modulo %d\n",
26186 			    un->un_tgt_blocksize);
26187 			return (EINVAL);
26188 		}
26189 
26190 		if ((nblk * DEV_BSIZE) & secmask) {
26191 			SD_TRACE(SD_LOG_DUMP, un,
26192 			    "sddump: dump length not modulo %d\n",
26193 			    un->un_tgt_blocksize);
26194 			return (EINVAL);
26195 		}
26196 
26197 	}
26198 
26199 	/* Validate blocks to dump at against partition size. */
26200 
26201 	(void) cmlb_partinfo(un->un_cmlbhandle, partition,
26202 	    &nblks, &start_block, NULL, NULL, (void *)SD_PATH_DIRECT);
26203 
26204 	if (NOT_DEVBSIZE(un)) {
26205 		if ((blkno + nblk) > nblks) {
26206 			SD_TRACE(SD_LOG_DUMP, un,
26207 			    "sddump: dump range larger than partition: "
26208 			    "blkno = 0x%x, nblk = 0x%x, dkl_nblk = 0x%x\n",
26209 			    blkno, nblk, nblks);
26210 			return (EINVAL);
26211 		}
26212 	} else {
26213 		if (((blkno / (un->un_tgt_blocksize / DEV_BSIZE)) +
26214 		    (nblk / (un->un_tgt_blocksize / DEV_BSIZE))) > nblks) {
26215 			SD_TRACE(SD_LOG_DUMP, un,
26216 			    "sddump: dump range larger than partition: "
26217 			    "blkno = 0x%x, nblk = 0x%x, dkl_nblk = 0x%x\n",
26218 			    blkno, nblk, nblks);
26219 			return (EINVAL);
26220 		}
26221 	}
26222 
26223 	mutex_enter(&un->un_pm_mutex);
26224 	if (SD_DEVICE_IS_IN_LOW_POWER(un)) {
26225 		struct scsi_pkt *start_pktp;
26226 
26227 		mutex_exit(&un->un_pm_mutex);
26228 
26229 		/*
26230 		 * use pm framework to power on HBA 1st
26231 		 */
26232 		(void) pm_raise_power(SD_DEVINFO(un), 0,
26233 		    SD_PM_STATE_ACTIVE(un));
26234 
26235 		/*
26236 		 * Dump no long uses sdpower to power on a device, it's
26237 		 * in-line here so it can be done in polled mode.
26238 		 */
26239 
26240 		SD_INFO(SD_LOG_DUMP, un, "sddump: starting device\n");
26241 
26242 		start_pktp = scsi_init_pkt(SD_ADDRESS(un), NULL, NULL,
26243 		    CDB_GROUP0, un->un_status_len, 0, 0, NULL_FUNC, NULL);
26244 
26245 		if (start_pktp == NULL) {
26246 			/* We were not given a SCSI packet, fail. */
26247 			return (EIO);
26248 		}
26249 		bzero(start_pktp->pkt_cdbp, CDB_GROUP0);
26250 		start_pktp->pkt_cdbp[0] = SCMD_START_STOP;
26251 		start_pktp->pkt_cdbp[4] = SD_TARGET_START;
26252 		start_pktp->pkt_flags = FLAG_NOINTR;
26253 
26254 		mutex_enter(SD_MUTEX(un));
26255 		SD_FILL_SCSI1_LUN(un, start_pktp);
26256 		mutex_exit(SD_MUTEX(un));
26257 		/*
26258 		 * Scsi_poll returns 0 (success) if the command completes and
26259 		 * the status block is STATUS_GOOD.
26260 		 */
26261 		if (sd_scsi_poll(un, start_pktp) != 0) {
26262 			scsi_destroy_pkt(start_pktp);
26263 			return (EIO);
26264 		}
26265 		scsi_destroy_pkt(start_pktp);
26266 		(void) sd_pm_state_change(un, SD_PM_STATE_ACTIVE(un),
26267 		    SD_PM_STATE_CHANGE);
26268 	} else {
26269 		mutex_exit(&un->un_pm_mutex);
26270 	}
26271 
26272 	mutex_enter(SD_MUTEX(un));
26273 	un->un_throttle = 0;
26274 
26275 	/*
26276 	 * The first time through, reset the specific target device.
26277 	 * However, when cpr calls sddump we know that sd is in a
26278 	 * a good state so no bus reset is required.
26279 	 * Clear sense data via Request Sense cmd.
26280 	 * In sddump we don't care about allow_bus_device_reset anymore
26281 	 */
26282 
26283 	if ((un->un_state != SD_STATE_SUSPENDED) &&
26284 	    (un->un_state != SD_STATE_DUMPING)) {
26285 
26286 		New_state(un, SD_STATE_DUMPING);
26287 
26288 		if (un->un_f_is_fibre == FALSE) {
26289 			mutex_exit(SD_MUTEX(un));
26290 			/*
26291 			 * Attempt a bus reset for parallel scsi.
26292 			 *
26293 			 * Note: A bus reset is required because on some host
26294 			 * systems (i.e. E420R) a bus device reset is
26295 			 * insufficient to reset the state of the target.
26296 			 *
26297 			 * Note: Don't issue the reset for fibre-channel,
26298 			 * because this tends to hang the bus (loop) for
26299 			 * too long while everyone is logging out and in
26300 			 * and the deadman timer for dumping will fire
26301 			 * before the dump is complete.
26302 			 */
26303 			if (scsi_reset(SD_ADDRESS(un), RESET_ALL) == 0) {
26304 				mutex_enter(SD_MUTEX(un));
26305 				Restore_state(un);
26306 				mutex_exit(SD_MUTEX(un));
26307 				return (EIO);
26308 			}
26309 
26310 			/* Delay to give the device some recovery time. */
26311 			drv_usecwait(10000);
26312 
26313 			if (sd_send_polled_RQS(un) == SD_FAILURE) {
26314 				SD_INFO(SD_LOG_DUMP, un,
26315 				    "sddump: sd_send_polled_RQS failed\n");
26316 			}
26317 			mutex_enter(SD_MUTEX(un));
26318 		}
26319 	}
26320 
26321 	/*
26322 	 * Convert the partition-relative block number to a
26323 	 * disk physical block number.
26324 	 */
26325 	if (NOT_DEVBSIZE(un)) {
26326 		blkno += start_block;
26327 	} else {
26328 		blkno = blkno / (un->un_tgt_blocksize / DEV_BSIZE);
26329 		blkno += start_block;
26330 	}
26331 
26332 	SD_INFO(SD_LOG_DUMP, un, "sddump: disk blkno = 0x%x\n", blkno);
26333 
26334 
26335 	/*
26336 	 * Check if the device has a non-512 block size.
26337 	 */
26338 	wr_bp = NULL;
26339 	if (NOT_DEVBSIZE(un)) {
26340 		tgt_byte_offset = blkno * un->un_sys_blocksize;
26341 		tgt_byte_count = nblk * un->un_sys_blocksize;
26342 		if ((tgt_byte_offset % un->un_tgt_blocksize) ||
26343 		    (tgt_byte_count % un->un_tgt_blocksize)) {
26344 			doing_rmw = TRUE;
26345 			/*
26346 			 * Calculate the block number and number of block
26347 			 * in terms of the media block size.
26348 			 */
26349 			tgt_blkno = tgt_byte_offset / un->un_tgt_blocksize;
26350 			tgt_nblk =
26351 			    ((tgt_byte_offset + tgt_byte_count +
26352 			    (un->un_tgt_blocksize - 1)) /
26353 			    un->un_tgt_blocksize) - tgt_blkno;
26354 
26355 			/*
26356 			 * Invoke the routine which is going to do read part
26357 			 * of read-modify-write.
26358 			 * Note that this routine returns a pointer to
26359 			 * a valid bp in wr_bp.
26360 			 */
26361 			err = sddump_do_read_of_rmw(un, tgt_blkno, tgt_nblk,
26362 			    &wr_bp);
26363 			if (err) {
26364 				mutex_exit(SD_MUTEX(un));
26365 				return (err);
26366 			}
26367 			/*
26368 			 * Offset is being calculated as -
26369 			 * (original block # * system block size) -
26370 			 * (new block # * target block size)
26371 			 */
26372 			io_start_offset =
26373 			    ((uint64_t)(blkno * un->un_sys_blocksize)) -
26374 			    ((uint64_t)(tgt_blkno * un->un_tgt_blocksize));
26375 
26376 			ASSERT(io_start_offset < un->un_tgt_blocksize);
26377 			/*
26378 			 * Do the modify portion of read modify write.
26379 			 */
26380 			bcopy(addr, &wr_bp->b_un.b_addr[io_start_offset],
26381 			    (size_t)nblk * un->un_sys_blocksize);
26382 		} else {
26383 			doing_rmw = FALSE;
26384 			tgt_blkno = tgt_byte_offset / un->un_tgt_blocksize;
26385 			tgt_nblk = tgt_byte_count / un->un_tgt_blocksize;
26386 		}
26387 
26388 		/* Convert blkno and nblk to target blocks */
26389 		blkno = tgt_blkno;
26390 		nblk = tgt_nblk;
26391 	} else {
26392 		wr_bp = &wr_buf;
26393 		bzero(wr_bp, sizeof (struct buf));
26394 		wr_bp->b_flags		= B_BUSY;
26395 		wr_bp->b_un.b_addr	= addr;
26396 		wr_bp->b_bcount		= nblk << DEV_BSHIFT;
26397 		wr_bp->b_resid		= 0;
26398 	}
26399 
26400 	mutex_exit(SD_MUTEX(un));
26401 
26402 	/*
26403 	 * Obtain a SCSI packet for the write command.
26404 	 * It should be safe to call the allocator here without
26405 	 * worrying about being locked for DVMA mapping because
26406 	 * the address we're passed is already a DVMA mapping
26407 	 *
26408 	 * We are also not going to worry about semaphore ownership
26409 	 * in the dump buffer. Dumping is single threaded at present.
26410 	 */
26411 
26412 	wr_pktp = NULL;
26413 
26414 	dma_resid = wr_bp->b_bcount;
26415 	oblkno = blkno;
26416 
26417 	if (!(NOT_DEVBSIZE(un))) {
26418 		nblk = nblk / (un->un_tgt_blocksize / DEV_BSIZE);
26419 	}
26420 
26421 	while (dma_resid != 0) {
26422 
26423 	for (i = 0; i < SD_NDUMP_RETRIES; i++) {
26424 		wr_bp->b_flags &= ~B_ERROR;
26425 
26426 		if (un->un_partial_dma_supported == 1) {
26427 			blkno = oblkno +
26428 			    ((wr_bp->b_bcount - dma_resid) /
26429 			    un->un_tgt_blocksize);
26430 			nblk = dma_resid / un->un_tgt_blocksize;
26431 
26432 			if (wr_pktp) {
26433 				/*
26434 				 * Partial DMA transfers after initial transfer
26435 				 */
26436 				rval = sd_setup_next_rw_pkt(un, wr_pktp, wr_bp,
26437 				    blkno, nblk);
26438 			} else {
26439 				/* Initial transfer */
26440 				rval = sd_setup_rw_pkt(un, &wr_pktp, wr_bp,
26441 				    un->un_pkt_flags, NULL_FUNC, NULL,
26442 				    blkno, nblk);
26443 			}
26444 		} else {
26445 			rval = sd_setup_rw_pkt(un, &wr_pktp, wr_bp,
26446 			    0, NULL_FUNC, NULL, blkno, nblk);
26447 		}
26448 
26449 		if (rval == 0) {
26450 			/* We were given a SCSI packet, continue. */
26451 			break;
26452 		}
26453 
26454 		if (i == 0) {
26455 			if (wr_bp->b_flags & B_ERROR) {
26456 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26457 				    "no resources for dumping; "
26458 				    "error code: 0x%x, retrying",
26459 				    geterror(wr_bp));
26460 			} else {
26461 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26462 				    "no resources for dumping; retrying");
26463 			}
26464 		} else if (i != (SD_NDUMP_RETRIES - 1)) {
26465 			if (wr_bp->b_flags & B_ERROR) {
26466 				scsi_log(SD_DEVINFO(un), sd_label, CE_CONT,
26467 				    "no resources for dumping; error code: "
26468 				    "0x%x, retrying\n", geterror(wr_bp));
26469 			}
26470 		} else {
26471 			if (wr_bp->b_flags & B_ERROR) {
26472 				scsi_log(SD_DEVINFO(un), sd_label, CE_CONT,
26473 				    "no resources for dumping; "
26474 				    "error code: 0x%x, retries failed, "
26475 				    "giving up.\n", geterror(wr_bp));
26476 			} else {
26477 				scsi_log(SD_DEVINFO(un), sd_label, CE_CONT,
26478 				    "no resources for dumping; "
26479 				    "retries failed, giving up.\n");
26480 			}
26481 			mutex_enter(SD_MUTEX(un));
26482 			Restore_state(un);
26483 			if (NOT_DEVBSIZE(un) && (doing_rmw == TRUE)) {
26484 				mutex_exit(SD_MUTEX(un));
26485 				scsi_free_consistent_buf(wr_bp);
26486 			} else {
26487 				mutex_exit(SD_MUTEX(un));
26488 			}
26489 			return (EIO);
26490 		}
26491 		drv_usecwait(10000);
26492 	}
26493 
26494 	if (un->un_partial_dma_supported == 1) {
26495 		/*
26496 		 * save the resid from PARTIAL_DMA
26497 		 */
26498 		dma_resid = wr_pktp->pkt_resid;
26499 		if (dma_resid != 0)
26500 			nblk -= SD_BYTES2TGTBLOCKS(un, dma_resid);
26501 		wr_pktp->pkt_resid = 0;
26502 	} else {
26503 		dma_resid = 0;
26504 	}
26505 
26506 	/* SunBug 1222170 */
26507 	wr_pktp->pkt_flags = FLAG_NOINTR;
26508 
26509 	err = EIO;
26510 	for (i = 0; i < SD_NDUMP_RETRIES; i++) {
26511 
26512 		/*
26513 		 * Scsi_poll returns 0 (success) if the command completes and
26514 		 * the status block is STATUS_GOOD.  We should only check
26515 		 * errors if this condition is not true.  Even then we should
26516 		 * send our own request sense packet only if we have a check
26517 		 * condition and auto request sense has not been performed by
26518 		 * the hba.
26519 		 */
26520 		SD_TRACE(SD_LOG_DUMP, un, "sddump: sending write\n");
26521 
26522 		if ((sd_scsi_poll(un, wr_pktp) == 0) &&
26523 		    (wr_pktp->pkt_resid == 0)) {
26524 			err = SD_SUCCESS;
26525 			break;
26526 		}
26527 
26528 		/*
26529 		 * Check CMD_DEV_GONE 1st, give up if device is gone.
26530 		 */
26531 		if (wr_pktp->pkt_reason == CMD_DEV_GONE) {
26532 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26533 			    "Error while dumping state...Device is gone\n");
26534 			break;
26535 		}
26536 
26537 		if (SD_GET_PKT_STATUS(wr_pktp) == STATUS_CHECK) {
26538 			SD_INFO(SD_LOG_DUMP, un,
26539 			    "sddump: write failed with CHECK, try # %d\n", i);
26540 			if (((wr_pktp->pkt_state & STATE_ARQ_DONE) == 0)) {
26541 				(void) sd_send_polled_RQS(un);
26542 			}
26543 
26544 			continue;
26545 		}
26546 
26547 		if (SD_GET_PKT_STATUS(wr_pktp) == STATUS_BUSY) {
26548 			int reset_retval = 0;
26549 
26550 			SD_INFO(SD_LOG_DUMP, un,
26551 			    "sddump: write failed with BUSY, try # %d\n", i);
26552 
26553 			if (un->un_f_lun_reset_enabled == TRUE) {
26554 				reset_retval = scsi_reset(SD_ADDRESS(un),
26555 				    RESET_LUN);
26556 			}
26557 			if (reset_retval == 0) {
26558 				(void) scsi_reset(SD_ADDRESS(un), RESET_TARGET);
26559 			}
26560 			(void) sd_send_polled_RQS(un);
26561 
26562 		} else {
26563 			SD_INFO(SD_LOG_DUMP, un,
26564 			    "sddump: write failed with 0x%x, try # %d\n",
26565 			    SD_GET_PKT_STATUS(wr_pktp), i);
26566 			mutex_enter(SD_MUTEX(un));
26567 			sd_reset_target(un, wr_pktp);
26568 			mutex_exit(SD_MUTEX(un));
26569 		}
26570 
26571 		/*
26572 		 * If we are not getting anywhere with lun/target resets,
26573 		 * let's reset the bus.
26574 		 */
26575 		if (i == SD_NDUMP_RETRIES/2) {
26576 			(void) scsi_reset(SD_ADDRESS(un), RESET_ALL);
26577 			(void) sd_send_polled_RQS(un);
26578 		}
26579 	}
26580 	}
26581 
26582 	scsi_destroy_pkt(wr_pktp);
26583 	mutex_enter(SD_MUTEX(un));
26584 	if ((NOT_DEVBSIZE(un)) && (doing_rmw == TRUE)) {
26585 		mutex_exit(SD_MUTEX(un));
26586 		scsi_free_consistent_buf(wr_bp);
26587 	} else {
26588 		mutex_exit(SD_MUTEX(un));
26589 	}
26590 	SD_TRACE(SD_LOG_DUMP, un, "sddump: exit: err = %d\n", err);
26591 	return (err);
26592 }
26593 
26594 /*
26595  *    Function: sd_scsi_poll()
26596  *
26597  * Description: This is a wrapper for the scsi_poll call.
26598  *
26599  *   Arguments: sd_lun - The unit structure
26600  *              scsi_pkt - The scsi packet being sent to the device.
26601  *
26602  * Return Code: 0 - Command completed successfully with good status
26603  *             -1 - Command failed.  This could indicate a check condition
26604  *                  or other status value requiring recovery action.
26605  *
26606  * NOTE: This code is only called off sddump().
26607  */
26608 
26609 static int
26610 sd_scsi_poll(struct sd_lun *un, struct scsi_pkt *pktp)
26611 {
26612 	int status;
26613 
26614 	ASSERT(un != NULL);
26615 	ASSERT(!mutex_owned(SD_MUTEX(un)));
26616 	ASSERT(pktp != NULL);
26617 
26618 	status = SD_SUCCESS;
26619 
26620 	if (scsi_ifgetcap(&pktp->pkt_address, "tagged-qing", 1) == 1) {
26621 		pktp->pkt_flags |= un->un_tagflags;
26622 		pktp->pkt_flags &= ~FLAG_NODISCON;
26623 	}
26624 
26625 	status = sd_ddi_scsi_poll(pktp);
26626 	/*
26627 	 * Scsi_poll returns 0 (success) if the command completes and the
26628 	 * status block is STATUS_GOOD.  We should only check errors if this
26629 	 * condition is not true.  Even then we should send our own request
26630 	 * sense packet only if we have a check condition and auto
26631 	 * request sense has not been performed by the hba.
26632 	 * Don't get RQS data if pkt_reason is CMD_DEV_GONE.
26633 	 */
26634 	if ((status != SD_SUCCESS) &&
26635 	    (SD_GET_PKT_STATUS(pktp) == STATUS_CHECK) &&
26636 	    (pktp->pkt_state & STATE_ARQ_DONE) == 0 &&
26637 	    (pktp->pkt_reason != CMD_DEV_GONE))
26638 		(void) sd_send_polled_RQS(un);
26639 
26640 	return (status);
26641 }
26642 
26643 /*
26644  *    Function: sd_send_polled_RQS()
26645  *
26646  * Description: This sends the request sense command to a device.
26647  *
26648  *   Arguments: sd_lun - The unit structure
26649  *
26650  * Return Code: 0 - Command completed successfully with good status
26651  *             -1 - Command failed.
26652  *
26653  */
26654 
26655 static int
26656 sd_send_polled_RQS(struct sd_lun *un)
26657 {
26658 	int	ret_val;
26659 	struct	scsi_pkt	*rqs_pktp;
26660 	struct	buf		*rqs_bp;
26661 
26662 	ASSERT(un != NULL);
26663 	ASSERT(!mutex_owned(SD_MUTEX(un)));
26664 
26665 	ret_val = SD_SUCCESS;
26666 
26667 	rqs_pktp = un->un_rqs_pktp;
26668 	rqs_bp	 = un->un_rqs_bp;
26669 
26670 	mutex_enter(SD_MUTEX(un));
26671 
26672 	if (un->un_sense_isbusy) {
26673 		ret_val = SD_FAILURE;
26674 		mutex_exit(SD_MUTEX(un));
26675 		return (ret_val);
26676 	}
26677 
26678 	/*
26679 	 * If the request sense buffer (and packet) is not in use,
26680 	 * let's set the un_sense_isbusy and send our packet
26681 	 */
26682 	un->un_sense_isbusy = 1;
26683 	rqs_pktp->pkt_resid = 0;
26684 	rqs_pktp->pkt_reason = 0;
26685 	rqs_pktp->pkt_flags |= FLAG_NOINTR;
26686 	bzero(rqs_bp->b_un.b_addr, SENSE_LENGTH);
26687 
26688 	mutex_exit(SD_MUTEX(un));
26689 
26690 	SD_INFO(SD_LOG_COMMON, un, "sd_send_polled_RQS: req sense buf at"
26691 	    " 0x%p\n", rqs_bp->b_un.b_addr);
26692 
26693 	/*
26694 	 * Can't send this to sd_scsi_poll, we wrap ourselves around the
26695 	 * axle - it has a call into us!
26696 	 */
26697 	if ((ret_val = sd_ddi_scsi_poll(rqs_pktp)) != 0) {
26698 		SD_INFO(SD_LOG_COMMON, un,
26699 		    "sd_send_polled_RQS: RQS failed\n");
26700 	}
26701 
26702 	SD_DUMP_MEMORY(un, SD_LOG_COMMON, "sd_send_polled_RQS:",
26703 	    (uchar_t *)rqs_bp->b_un.b_addr, SENSE_LENGTH, SD_LOG_HEX);
26704 
26705 	mutex_enter(SD_MUTEX(un));
26706 	un->un_sense_isbusy = 0;
26707 	mutex_exit(SD_MUTEX(un));
26708 
26709 	return (ret_val);
26710 }
26711 
26712 /*
26713  * Defines needed for localized version of the scsi_poll routine.
26714  */
26715 #define	CSEC		10000			/* usecs */
26716 #define	SEC_TO_CSEC	(1000000/CSEC)
26717 
26718 /*
26719  *    Function: sd_ddi_scsi_poll()
26720  *
26721  * Description: Localized version of the scsi_poll routine.  The purpose is to
26722  *		send a scsi_pkt to a device as a polled command.  This version
26723  *		is to ensure more robust handling of transport errors.
26724  *		Specifically this routine cures not ready, coming ready
26725  *		transition for power up and reset of sonoma's.  This can take
26726  *		up to 45 seconds for power-on and 20 seconds for reset of a
26727  *		sonoma lun.
26728  *
26729  *   Arguments: scsi_pkt - The scsi_pkt being sent to a device
26730  *
26731  * Return Code: 0 - Command completed successfully with good status
26732  *             -1 - Command failed.
26733  *
26734  * NOTE: This code is almost identical to scsi_poll, however before 6668774 can
26735  * be fixed (removing this code), we need to determine how to handle the
26736  * KEY_UNIT_ATTENTION condition below in conditions not as limited as sddump().
26737  *
26738  * NOTE: This code is only called off sddump().
26739  */
26740 static int
26741 sd_ddi_scsi_poll(struct scsi_pkt *pkt)
26742 {
26743 	int			rval = -1;
26744 	int			savef;
26745 	long			savet;
26746 	void			(*savec)();
26747 	int			timeout;
26748 	int			busy_count;
26749 	int			poll_delay;
26750 	int			rc;
26751 	uint8_t			*sensep;
26752 	struct scsi_arq_status	*arqstat;
26753 	extern int		do_polled_io;
26754 
26755 	ASSERT(pkt->pkt_scbp);
26756 
26757 	/*
26758 	 * save old flags..
26759 	 */
26760 	savef = pkt->pkt_flags;
26761 	savec = pkt->pkt_comp;
26762 	savet = pkt->pkt_time;
26763 
26764 	pkt->pkt_flags |= FLAG_NOINTR;
26765 
26766 	/*
26767 	 * XXX there is nothing in the SCSA spec that states that we should not
26768 	 * do a callback for polled cmds; however, removing this will break sd
26769 	 * and probably other target drivers
26770 	 */
26771 	pkt->pkt_comp = NULL;
26772 
26773 	/*
26774 	 * we don't like a polled command without timeout.
26775 	 * 60 seconds seems long enough.
26776 	 */
26777 	if (pkt->pkt_time == 0)
26778 		pkt->pkt_time = SCSI_POLL_TIMEOUT;
26779 
26780 	/*
26781 	 * Send polled cmd.
26782 	 *
26783 	 * We do some error recovery for various errors.  Tran_busy,
26784 	 * queue full, and non-dispatched commands are retried every 10 msec.
26785 	 * as they are typically transient failures.  Busy status and Not
26786 	 * Ready are retried every second as this status takes a while to
26787 	 * change.
26788 	 */
26789 	timeout = pkt->pkt_time * SEC_TO_CSEC;
26790 
26791 	for (busy_count = 0; busy_count < timeout; busy_count++) {
26792 		/*
26793 		 * Initialize pkt status variables.
26794 		 */
26795 		*pkt->pkt_scbp = pkt->pkt_reason = pkt->pkt_state = 0;
26796 
26797 		if ((rc = scsi_transport(pkt)) != TRAN_ACCEPT) {
26798 			if (rc != TRAN_BUSY) {
26799 				/* Transport failed - give up. */
26800 				break;
26801 			} else {
26802 				/* Transport busy - try again. */
26803 				poll_delay = 1 * CSEC;		/* 10 msec. */
26804 			}
26805 		} else {
26806 			/*
26807 			 * Transport accepted - check pkt status.
26808 			 */
26809 			rc = (*pkt->pkt_scbp) & STATUS_MASK;
26810 			if ((pkt->pkt_reason == CMD_CMPLT) &&
26811 			    (rc == STATUS_CHECK) &&
26812 			    (pkt->pkt_state & STATE_ARQ_DONE)) {
26813 				arqstat =
26814 				    (struct scsi_arq_status *)(pkt->pkt_scbp);
26815 				sensep = (uint8_t *)&arqstat->sts_sensedata;
26816 			} else {
26817 				sensep = NULL;
26818 			}
26819 
26820 			if ((pkt->pkt_reason == CMD_CMPLT) &&
26821 			    (rc == STATUS_GOOD)) {
26822 				/* No error - we're done */
26823 				rval = 0;
26824 				break;
26825 
26826 			} else if (pkt->pkt_reason == CMD_DEV_GONE) {
26827 				/* Lost connection - give up */
26828 				break;
26829 
26830 			} else if ((pkt->pkt_reason == CMD_INCOMPLETE) &&
26831 			    (pkt->pkt_state == 0)) {
26832 				/* Pkt not dispatched - try again. */
26833 				poll_delay = 1 * CSEC;		/* 10 msec. */
26834 
26835 			} else if ((pkt->pkt_reason == CMD_CMPLT) &&
26836 			    (rc == STATUS_QFULL)) {
26837 				/* Queue full - try again. */
26838 				poll_delay = 1 * CSEC;		/* 10 msec. */
26839 
26840 			} else if ((pkt->pkt_reason == CMD_CMPLT) &&
26841 			    (rc == STATUS_BUSY)) {
26842 				/* Busy - try again. */
26843 				poll_delay = 100 * CSEC;	/* 1 sec. */
26844 				busy_count += (SEC_TO_CSEC - 1);
26845 
26846 			} else if ((sensep != NULL) &&
26847 			    (scsi_sense_key(sensep) == KEY_UNIT_ATTENTION)) {
26848 				/*
26849 				 * Unit Attention - try again.
26850 				 * Pretend it took 1 sec.
26851 				 * NOTE: 'continue' avoids poll_delay
26852 				 */
26853 				busy_count += (SEC_TO_CSEC - 1);
26854 				continue;
26855 
26856 			} else if ((sensep != NULL) &&
26857 			    (scsi_sense_key(sensep) == KEY_NOT_READY) &&
26858 			    (scsi_sense_asc(sensep) == 0x04) &&
26859 			    (scsi_sense_ascq(sensep) == 0x01)) {
26860 				/*
26861 				 * Not ready -> ready - try again.
26862 				 * 04h/01h: LUN IS IN PROCESS OF BECOMING READY
26863 				 * ...same as STATUS_BUSY
26864 				 */
26865 				poll_delay = 100 * CSEC;	/* 1 sec. */
26866 				busy_count += (SEC_TO_CSEC - 1);
26867 
26868 			} else {
26869 				/* BAD status - give up. */
26870 				break;
26871 			}
26872 		}
26873 
26874 		if (((curthread->t_flag & T_INTR_THREAD) == 0) &&
26875 		    !do_polled_io) {
26876 			delay(drv_usectohz(poll_delay));
26877 		} else {
26878 			/* we busy wait during cpr_dump or interrupt threads */
26879 			drv_usecwait(poll_delay);
26880 		}
26881 	}
26882 
26883 	pkt->pkt_flags = savef;
26884 	pkt->pkt_comp = savec;
26885 	pkt->pkt_time = savet;
26886 
26887 	/* return on error */
26888 	if (rval)
26889 		return (rval);
26890 
26891 	/*
26892 	 * This is not a performance critical code path.
26893 	 *
26894 	 * As an accommodation for scsi_poll callers, to avoid ddi_dma_sync()
26895 	 * issues associated with looking at DMA memory prior to
26896 	 * scsi_pkt_destroy(), we scsi_sync_pkt() prior to return.
26897 	 */
26898 	scsi_sync_pkt(pkt);
26899 	return (0);
26900 }
26901 
26902 
26903 
26904 /*
26905  *    Function: sd_persistent_reservation_in_read_keys
26906  *
26907  * Description: This routine is the driver entry point for handling CD-ROM
26908  *		multi-host persistent reservation requests (MHIOCGRP_INKEYS)
26909  *		by sending the SCSI-3 PRIN commands to the device.
26910  *		Processes the read keys command response by copying the
26911  *		reservation key information into the user provided buffer.
26912  *		Support for the 32/64 bit _MULTI_DATAMODEL is implemented.
26913  *
26914  *   Arguments: un   -  Pointer to soft state struct for the target.
26915  *		usrp -	user provided pointer to multihost Persistent In Read
26916  *			Keys structure (mhioc_inkeys_t)
26917  *		flag -	this argument is a pass through to ddi_copyxxx()
26918  *			directly from the mode argument of ioctl().
26919  *
26920  * Return Code: 0   - Success
26921  *		EACCES
26922  *		ENOTSUP
26923  *		errno return code from sd_send_scsi_cmd()
26924  *
26925  *     Context: Can sleep. Does not return until command is completed.
26926  */
26927 
26928 static int
26929 sd_persistent_reservation_in_read_keys(struct sd_lun *un,
26930     mhioc_inkeys_t *usrp, int flag)
26931 {
26932 #ifdef _MULTI_DATAMODEL
26933 	struct mhioc_key_list32	li32;
26934 #endif
26935 	sd_prin_readkeys_t	*in;
26936 	mhioc_inkeys_t		*ptr;
26937 	mhioc_key_list_t	li;
26938 	uchar_t			*data_bufp = NULL;
26939 	int			data_len = 0;
26940 	int			rval = 0;
26941 	size_t			copysz = 0;
26942 	sd_ssc_t		*ssc;
26943 
26944 	if ((ptr = (mhioc_inkeys_t *)usrp) == NULL) {
26945 		return (EINVAL);
26946 	}
26947 	bzero(&li, sizeof (mhioc_key_list_t));
26948 
26949 	ssc = sd_ssc_init(un);
26950 
26951 	/*
26952 	 * Get the listsize from user
26953 	 */
26954 #ifdef _MULTI_DATAMODEL
26955 	switch (ddi_model_convert_from(flag & FMODELS)) {
26956 	case DDI_MODEL_ILP32:
26957 		copysz = sizeof (struct mhioc_key_list32);
26958 		if (ddi_copyin(ptr->li, &li32, copysz, flag)) {
26959 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26960 			    "sd_persistent_reservation_in_read_keys: "
26961 			    "failed ddi_copyin: mhioc_key_list32_t\n");
26962 			rval = EFAULT;
26963 			goto done;
26964 		}
26965 		li.listsize = li32.listsize;
26966 		li.list = (mhioc_resv_key_t *)(uintptr_t)li32.list;
26967 		break;
26968 
26969 	case DDI_MODEL_NONE:
26970 		copysz = sizeof (mhioc_key_list_t);
26971 		if (ddi_copyin(ptr->li, &li, copysz, flag)) {
26972 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26973 			    "sd_persistent_reservation_in_read_keys: "
26974 			    "failed ddi_copyin: mhioc_key_list_t\n");
26975 			rval = EFAULT;
26976 			goto done;
26977 		}
26978 		break;
26979 	}
26980 
26981 #else /* ! _MULTI_DATAMODEL */
26982 	copysz = sizeof (mhioc_key_list_t);
26983 	if (ddi_copyin(ptr->li, &li, copysz, flag)) {
26984 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
26985 		    "sd_persistent_reservation_in_read_keys: "
26986 		    "failed ddi_copyin: mhioc_key_list_t\n");
26987 		rval = EFAULT;
26988 		goto done;
26989 	}
26990 #endif
26991 
26992 	data_len  = li.listsize * MHIOC_RESV_KEY_SIZE;
26993 	data_len += (sizeof (sd_prin_readkeys_t) - sizeof (caddr_t));
26994 	data_bufp = kmem_zalloc(data_len, KM_SLEEP);
26995 
26996 	rval = sd_send_scsi_PERSISTENT_RESERVE_IN(ssc, SD_READ_KEYS,
26997 	    data_len, data_bufp);
26998 	if (rval != 0) {
26999 		if (rval == EIO)
27000 			sd_ssc_assessment(ssc, SD_FMT_IGNORE_COMPROMISE);
27001 		else
27002 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
27003 		goto done;
27004 	}
27005 	in = (sd_prin_readkeys_t *)data_bufp;
27006 	ptr->generation = BE_32(in->generation);
27007 	li.listlen = BE_32(in->len) / MHIOC_RESV_KEY_SIZE;
27008 
27009 	/*
27010 	 * Return the min(listsize, listlen) keys
27011 	 */
27012 #ifdef _MULTI_DATAMODEL
27013 
27014 	switch (ddi_model_convert_from(flag & FMODELS)) {
27015 	case DDI_MODEL_ILP32:
27016 		li32.listlen = li.listlen;
27017 		if (ddi_copyout(&li32, ptr->li, copysz, flag)) {
27018 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
27019 			    "sd_persistent_reservation_in_read_keys: "
27020 			    "failed ddi_copyout: mhioc_key_list32_t\n");
27021 			rval = EFAULT;
27022 			goto done;
27023 		}
27024 		break;
27025 
27026 	case DDI_MODEL_NONE:
27027 		if (ddi_copyout(&li, ptr->li, copysz, flag)) {
27028 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
27029 			    "sd_persistent_reservation_in_read_keys: "
27030 			    "failed ddi_copyout: mhioc_key_list_t\n");
27031 			rval = EFAULT;
27032 			goto done;
27033 		}
27034 		break;
27035 	}
27036 
27037 #else /* ! _MULTI_DATAMODEL */
27038 
27039 	if (ddi_copyout(&li, ptr->li, copysz, flag)) {
27040 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
27041 		    "sd_persistent_reservation_in_read_keys: "
27042 		    "failed ddi_copyout: mhioc_key_list_t\n");
27043 		rval = EFAULT;
27044 		goto done;
27045 	}
27046 
27047 #endif /* _MULTI_DATAMODEL */
27048 
27049 	copysz = min(li.listlen * MHIOC_RESV_KEY_SIZE,
27050 	    li.listsize * MHIOC_RESV_KEY_SIZE);
27051 	if (ddi_copyout(&in->keylist, li.list, copysz, flag)) {
27052 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
27053 		    "sd_persistent_reservation_in_read_keys: "
27054 		    "failed ddi_copyout: keylist\n");
27055 		rval = EFAULT;
27056 	}
27057 done:
27058 	sd_ssc_fini(ssc);
27059 	kmem_free(data_bufp, data_len);
27060 	return (rval);
27061 }
27062 
27063 
27064 /*
27065  *    Function: sd_persistent_reservation_in_read_resv
27066  *
27067  * Description: This routine is the driver entry point for handling CD-ROM
27068  *		multi-host persistent reservation requests (MHIOCGRP_INRESV)
27069  *		by sending the SCSI-3 PRIN commands to the device.
27070  *		Process the read persistent reservations command response by
27071  *		copying the reservation information into the user provided
27072  *		buffer. Support for the 32/64 _MULTI_DATAMODEL is implemented.
27073  *
27074  *   Arguments: un   -  Pointer to soft state struct for the target.
27075  *		usrp -	user provided pointer to multihost Persistent In Read
27076  *			Keys structure (mhioc_inkeys_t)
27077  *		flag -	this argument is a pass through to ddi_copyxxx()
27078  *			directly from the mode argument of ioctl().
27079  *
27080  * Return Code: 0   - Success
27081  *		EACCES
27082  *		ENOTSUP
27083  *		errno return code from sd_send_scsi_cmd()
27084  *
27085  *     Context: Can sleep. Does not return until command is completed.
27086  */
27087 
27088 static int
27089 sd_persistent_reservation_in_read_resv(struct sd_lun *un,
27090     mhioc_inresvs_t *usrp, int flag)
27091 {
27092 #ifdef _MULTI_DATAMODEL
27093 	struct mhioc_resv_desc_list32 resvlist32;
27094 #endif
27095 	sd_prin_readresv_t	*in;
27096 	mhioc_inresvs_t		*ptr;
27097 	sd_readresv_desc_t	*readresv_ptr;
27098 	mhioc_resv_desc_list_t	resvlist;
27099 	mhioc_resv_desc_t	resvdesc;
27100 	uchar_t			*data_bufp = NULL;
27101 	int			data_len;
27102 	int			rval = 0;
27103 	int			i;
27104 	size_t			copysz = 0;
27105 	mhioc_resv_desc_t	*bufp;
27106 	sd_ssc_t		*ssc;
27107 
27108 	if ((ptr = usrp) == NULL) {
27109 		return (EINVAL);
27110 	}
27111 
27112 	ssc = sd_ssc_init(un);
27113 
27114 	/*
27115 	 * Get the listsize from user
27116 	 */
27117 #ifdef _MULTI_DATAMODEL
27118 	switch (ddi_model_convert_from(flag & FMODELS)) {
27119 	case DDI_MODEL_ILP32:
27120 		copysz = sizeof (struct mhioc_resv_desc_list32);
27121 		if (ddi_copyin(ptr->li, &resvlist32, copysz, flag)) {
27122 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
27123 			    "sd_persistent_reservation_in_read_resv: "
27124 			    "failed ddi_copyin: mhioc_resv_desc_list_t\n");
27125 			rval = EFAULT;
27126 			goto done;
27127 		}
27128 		resvlist.listsize = resvlist32.listsize;
27129 		resvlist.list = (mhioc_resv_desc_t *)(uintptr_t)resvlist32.list;
27130 		break;
27131 
27132 	case DDI_MODEL_NONE:
27133 		copysz = sizeof (mhioc_resv_desc_list_t);
27134 		if (ddi_copyin(ptr->li, &resvlist, copysz, flag)) {
27135 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
27136 			    "sd_persistent_reservation_in_read_resv: "
27137 			    "failed ddi_copyin: mhioc_resv_desc_list_t\n");
27138 			rval = EFAULT;
27139 			goto done;
27140 		}
27141 		break;
27142 	}
27143 #else /* ! _MULTI_DATAMODEL */
27144 	copysz = sizeof (mhioc_resv_desc_list_t);
27145 	if (ddi_copyin(ptr->li, &resvlist, copysz, flag)) {
27146 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
27147 		    "sd_persistent_reservation_in_read_resv: "
27148 		    "failed ddi_copyin: mhioc_resv_desc_list_t\n");
27149 		rval = EFAULT;
27150 		goto done;
27151 	}
27152 #endif /* ! _MULTI_DATAMODEL */
27153 
27154 	data_len  = resvlist.listsize * SCSI3_RESV_DESC_LEN;
27155 	data_len += (sizeof (sd_prin_readresv_t) - sizeof (caddr_t));
27156 	data_bufp = kmem_zalloc(data_len, KM_SLEEP);
27157 
27158 	rval = sd_send_scsi_PERSISTENT_RESERVE_IN(ssc, SD_READ_RESV,
27159 	    data_len, data_bufp);
27160 	if (rval != 0) {
27161 		if (rval == EIO)
27162 			sd_ssc_assessment(ssc, SD_FMT_IGNORE_COMPROMISE);
27163 		else
27164 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
27165 		goto done;
27166 	}
27167 	in = (sd_prin_readresv_t *)data_bufp;
27168 	ptr->generation = BE_32(in->generation);
27169 	resvlist.listlen = BE_32(in->len) / SCSI3_RESV_DESC_LEN;
27170 
27171 	/*
27172 	 * Return the min(listsize, listlen( keys
27173 	 */
27174 #ifdef _MULTI_DATAMODEL
27175 
27176 	switch (ddi_model_convert_from(flag & FMODELS)) {
27177 	case DDI_MODEL_ILP32:
27178 		resvlist32.listlen = resvlist.listlen;
27179 		if (ddi_copyout(&resvlist32, ptr->li, copysz, flag)) {
27180 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
27181 			    "sd_persistent_reservation_in_read_resv: "
27182 			    "failed ddi_copyout: mhioc_resv_desc_list_t\n");
27183 			rval = EFAULT;
27184 			goto done;
27185 		}
27186 		break;
27187 
27188 	case DDI_MODEL_NONE:
27189 		if (ddi_copyout(&resvlist, ptr->li, copysz, flag)) {
27190 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
27191 			    "sd_persistent_reservation_in_read_resv: "
27192 			    "failed ddi_copyout: mhioc_resv_desc_list_t\n");
27193 			rval = EFAULT;
27194 			goto done;
27195 		}
27196 		break;
27197 	}
27198 
27199 #else /* ! _MULTI_DATAMODEL */
27200 
27201 	if (ddi_copyout(&resvlist, ptr->li, copysz, flag)) {
27202 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
27203 		    "sd_persistent_reservation_in_read_resv: "
27204 		    "failed ddi_copyout: mhioc_resv_desc_list_t\n");
27205 		rval = EFAULT;
27206 		goto done;
27207 	}
27208 
27209 #endif /* ! _MULTI_DATAMODEL */
27210 
27211 	readresv_ptr = (sd_readresv_desc_t *)&in->readresv_desc;
27212 	bufp = resvlist.list;
27213 	copysz = sizeof (mhioc_resv_desc_t);
27214 	for (i = 0; i < min(resvlist.listlen, resvlist.listsize);
27215 	    i++, readresv_ptr++, bufp++) {
27216 
27217 		bcopy(&readresv_ptr->resvkey, &resvdesc.key,
27218 		    MHIOC_RESV_KEY_SIZE);
27219 		resvdesc.type  = readresv_ptr->type;
27220 		resvdesc.scope = readresv_ptr->scope;
27221 		resvdesc.scope_specific_addr =
27222 		    BE_32(readresv_ptr->scope_specific_addr);
27223 
27224 		if (ddi_copyout(&resvdesc, bufp, copysz, flag)) {
27225 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
27226 			    "sd_persistent_reservation_in_read_resv: "
27227 			    "failed ddi_copyout: resvlist\n");
27228 			rval = EFAULT;
27229 			goto done;
27230 		}
27231 	}
27232 done:
27233 	sd_ssc_fini(ssc);
27234 	/* only if data_bufp is allocated, we need to free it */
27235 	if (data_bufp) {
27236 		kmem_free(data_bufp, data_len);
27237 	}
27238 	return (rval);
27239 }
27240 
27241 
27242 /*
27243  *    Function: sr_change_blkmode()
27244  *
27245  * Description: This routine is the driver entry point for handling CD-ROM
27246  *		block mode ioctl requests. Support for returning and changing
27247  *		the current block size in use by the device is implemented. The
27248  *		LBA size is changed via a MODE SELECT Block Descriptor.
27249  *
27250  *		This routine issues a mode sense with an allocation length of
27251  *		12 bytes for the mode page header and a single block descriptor.
27252  *
27253  *   Arguments: dev - the device 'dev_t'
27254  *		cmd - the request type; one of CDROMGBLKMODE (get) or
27255  *		      CDROMSBLKMODE (set)
27256  *		data - current block size or requested block size
27257  *		flag - this argument is a pass through to ddi_copyxxx() directly
27258  *		       from the mode argument of ioctl().
27259  *
27260  * Return Code: the code returned by sd_send_scsi_cmd()
27261  *		EINVAL if invalid arguments are provided
27262  *		EFAULT if ddi_copyxxx() fails
27263  *		ENXIO if fail ddi_get_soft_state
27264  *		EIO if invalid mode sense block descriptor length
27265  *
27266  */
27267 
27268 static int
27269 sr_change_blkmode(dev_t dev, int cmd, intptr_t data, int flag)
27270 {
27271 	struct sd_lun			*un = NULL;
27272 	struct mode_header		*sense_mhp, *select_mhp;
27273 	struct block_descriptor		*sense_desc, *select_desc;
27274 	int				current_bsize;
27275 	int				rval = EINVAL;
27276 	uchar_t				*sense = NULL;
27277 	uchar_t				*select = NULL;
27278 	sd_ssc_t			*ssc;
27279 
27280 	ASSERT((cmd == CDROMGBLKMODE) || (cmd == CDROMSBLKMODE));
27281 
27282 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27283 		return (ENXIO);
27284 	}
27285 
27286 	/*
27287 	 * The block length is changed via the Mode Select block descriptor, the
27288 	 * "Read/Write Error Recovery" mode page (0x1) contents are not actually
27289 	 * required as part of this routine. Therefore the mode sense allocation
27290 	 * length is specified to be the length of a mode page header and a
27291 	 * block descriptor.
27292 	 */
27293 	sense = kmem_zalloc(BUFLEN_CHG_BLK_MODE, KM_SLEEP);
27294 
27295 	ssc = sd_ssc_init(un);
27296 	rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense,
27297 	    BUFLEN_CHG_BLK_MODE, MODEPAGE_ERR_RECOV, SD_PATH_STANDARD);
27298 	sd_ssc_fini(ssc);
27299 	if (rval != 0) {
27300 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27301 		    "sr_change_blkmode: Mode Sense Failed\n");
27302 		kmem_free(sense, BUFLEN_CHG_BLK_MODE);
27303 		return (rval);
27304 	}
27305 
27306 	/* Check the block descriptor len to handle only 1 block descriptor */
27307 	sense_mhp = (struct mode_header *)sense;
27308 	if ((sense_mhp->bdesc_length == 0) ||
27309 	    (sense_mhp->bdesc_length > MODE_BLK_DESC_LENGTH)) {
27310 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27311 		    "sr_change_blkmode: Mode Sense returned invalid block"
27312 		    " descriptor length\n");
27313 		kmem_free(sense, BUFLEN_CHG_BLK_MODE);
27314 		return (EIO);
27315 	}
27316 	sense_desc = (struct block_descriptor *)(sense + MODE_HEADER_LENGTH);
27317 	current_bsize = ((sense_desc->blksize_hi << 16) |
27318 	    (sense_desc->blksize_mid << 8) | sense_desc->blksize_lo);
27319 
27320 	/* Process command */
27321 	switch (cmd) {
27322 	case CDROMGBLKMODE:
27323 		/* Return the block size obtained during the mode sense */
27324 		if (ddi_copyout(&current_bsize, (void *)data,
27325 		    sizeof (int), flag) != 0)
27326 			rval = EFAULT;
27327 		break;
27328 	case CDROMSBLKMODE:
27329 		/* Validate the requested block size */
27330 		switch (data) {
27331 		case CDROM_BLK_512:
27332 		case CDROM_BLK_1024:
27333 		case CDROM_BLK_2048:
27334 		case CDROM_BLK_2056:
27335 		case CDROM_BLK_2336:
27336 		case CDROM_BLK_2340:
27337 		case CDROM_BLK_2352:
27338 		case CDROM_BLK_2368:
27339 		case CDROM_BLK_2448:
27340 		case CDROM_BLK_2646:
27341 		case CDROM_BLK_2647:
27342 			break;
27343 		default:
27344 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27345 			    "sr_change_blkmode: "
27346 			    "Block Size '%ld' Not Supported\n", data);
27347 			kmem_free(sense, BUFLEN_CHG_BLK_MODE);
27348 			return (EINVAL);
27349 		}
27350 
27351 		/*
27352 		 * The current block size matches the requested block size so
27353 		 * there is no need to send the mode select to change the size
27354 		 */
27355 		if (current_bsize == data) {
27356 			break;
27357 		}
27358 
27359 		/* Build the select data for the requested block size */
27360 		select = kmem_zalloc(BUFLEN_CHG_BLK_MODE, KM_SLEEP);
27361 		select_mhp = (struct mode_header *)select;
27362 		select_desc =
27363 		    (struct block_descriptor *)(select + MODE_HEADER_LENGTH);
27364 		/*
27365 		 * The LBA size is changed via the block descriptor, so the
27366 		 * descriptor is built according to the user data
27367 		 */
27368 		select_mhp->bdesc_length = MODE_BLK_DESC_LENGTH;
27369 		select_desc->blksize_hi  = (char)(((data) & 0x00ff0000) >> 16);
27370 		select_desc->blksize_mid = (char)(((data) & 0x0000ff00) >> 8);
27371 		select_desc->blksize_lo  = (char)((data) & 0x000000ff);
27372 
27373 		/* Send the mode select for the requested block size */
27374 		ssc = sd_ssc_init(un);
27375 		rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0,
27376 		    select, BUFLEN_CHG_BLK_MODE, SD_DONTSAVE_PAGE,
27377 		    SD_PATH_STANDARD);
27378 		sd_ssc_fini(ssc);
27379 		if (rval != 0) {
27380 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27381 			    "sr_change_blkmode: Mode Select Failed\n");
27382 			/*
27383 			 * The mode select failed for the requested block size,
27384 			 * so reset the data for the original block size and
27385 			 * send it to the target. The error is indicated by the
27386 			 * return value for the failed mode select.
27387 			 */
27388 			select_desc->blksize_hi  = sense_desc->blksize_hi;
27389 			select_desc->blksize_mid = sense_desc->blksize_mid;
27390 			select_desc->blksize_lo  = sense_desc->blksize_lo;
27391 			ssc = sd_ssc_init(un);
27392 			(void) sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0,
27393 			    select, BUFLEN_CHG_BLK_MODE, SD_DONTSAVE_PAGE,
27394 			    SD_PATH_STANDARD);
27395 			sd_ssc_fini(ssc);
27396 		} else {
27397 			ASSERT(!mutex_owned(SD_MUTEX(un)));
27398 			mutex_enter(SD_MUTEX(un));
27399 			sd_update_block_info(un, (uint32_t)data, 0);
27400 			mutex_exit(SD_MUTEX(un));
27401 		}
27402 		break;
27403 	default:
27404 		/* should not reach here, but check anyway */
27405 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27406 		    "sr_change_blkmode: Command '%x' Not Supported\n", cmd);
27407 		rval = EINVAL;
27408 		break;
27409 	}
27410 
27411 	if (select) {
27412 		kmem_free(select, BUFLEN_CHG_BLK_MODE);
27413 	}
27414 	if (sense) {
27415 		kmem_free(sense, BUFLEN_CHG_BLK_MODE);
27416 	}
27417 	return (rval);
27418 }
27419 
27420 
27421 /*
27422  * Note: The following sr_change_speed() and sr_atapi_change_speed() routines
27423  * implement driver support for getting and setting the CD speed. The command
27424  * set used will be based on the device type. If the device has not been
27425  * identified as MMC the Toshiba vendor specific mode page will be used. If
27426  * the device is MMC but does not support the Real Time Streaming feature
27427  * the SET CD SPEED command will be used to set speed and mode page 0x2A will
27428  * be used to read the speed.
27429  */
27430 
27431 /*
27432  *    Function: sr_change_speed()
27433  *
27434  * Description: This routine is the driver entry point for handling CD-ROM
27435  *		drive speed ioctl requests for devices supporting the Toshiba
27436  *		vendor specific drive speed mode page. Support for returning
27437  *		and changing the current drive speed in use by the device is
27438  *		implemented.
27439  *
27440  *   Arguments: dev - the device 'dev_t'
27441  *		cmd - the request type; one of CDROMGDRVSPEED (get) or
27442  *		      CDROMSDRVSPEED (set)
27443  *		data - current drive speed or requested drive speed
27444  *		flag - this argument is a pass through to ddi_copyxxx() directly
27445  *		       from the mode argument of ioctl().
27446  *
27447  * Return Code: the code returned by sd_send_scsi_cmd()
27448  *		EINVAL if invalid arguments are provided
27449  *		EFAULT if ddi_copyxxx() fails
27450  *		ENXIO if fail ddi_get_soft_state
27451  *		EIO if invalid mode sense block descriptor length
27452  */
27453 
27454 static int
27455 sr_change_speed(dev_t dev, int cmd, intptr_t data, int flag)
27456 {
27457 	struct sd_lun			*un = NULL;
27458 	struct mode_header		*sense_mhp, *select_mhp;
27459 	struct mode_speed		*sense_page, *select_page;
27460 	int				current_speed;
27461 	int				rval = EINVAL;
27462 	int				bd_len;
27463 	uchar_t				*sense = NULL;
27464 	uchar_t				*select = NULL;
27465 	sd_ssc_t			*ssc;
27466 
27467 	ASSERT((cmd == CDROMGDRVSPEED) || (cmd == CDROMSDRVSPEED));
27468 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27469 		return (ENXIO);
27470 	}
27471 
27472 	/*
27473 	 * Note: The drive speed is being modified here according to a Toshiba
27474 	 * vendor specific mode page (0x31).
27475 	 */
27476 	sense = kmem_zalloc(BUFLEN_MODE_CDROM_SPEED, KM_SLEEP);
27477 
27478 	ssc = sd_ssc_init(un);
27479 	rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense,
27480 	    BUFLEN_MODE_CDROM_SPEED, CDROM_MODE_SPEED,
27481 	    SD_PATH_STANDARD);
27482 	sd_ssc_fini(ssc);
27483 	if (rval != 0) {
27484 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27485 		    "sr_change_speed: Mode Sense Failed\n");
27486 		kmem_free(sense, BUFLEN_MODE_CDROM_SPEED);
27487 		return (rval);
27488 	}
27489 	sense_mhp  = (struct mode_header *)sense;
27490 
27491 	/* Check the block descriptor len to handle only 1 block descriptor */
27492 	bd_len = sense_mhp->bdesc_length;
27493 	if (bd_len > MODE_BLK_DESC_LENGTH) {
27494 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27495 		    "sr_change_speed: Mode Sense returned invalid block "
27496 		    "descriptor length\n");
27497 		kmem_free(sense, BUFLEN_MODE_CDROM_SPEED);
27498 		return (EIO);
27499 	}
27500 
27501 	sense_page = (struct mode_speed *)
27502 	    (sense + MODE_HEADER_LENGTH + sense_mhp->bdesc_length);
27503 	current_speed = sense_page->speed;
27504 
27505 	/* Process command */
27506 	switch (cmd) {
27507 	case CDROMGDRVSPEED:
27508 		/* Return the drive speed obtained during the mode sense */
27509 		if (current_speed == 0x2) {
27510 			current_speed = CDROM_TWELVE_SPEED;
27511 		}
27512 		if (ddi_copyout(&current_speed, (void *)data,
27513 		    sizeof (int), flag) != 0) {
27514 			rval = EFAULT;
27515 		}
27516 		break;
27517 	case CDROMSDRVSPEED:
27518 		/* Validate the requested drive speed */
27519 		switch ((uchar_t)data) {
27520 		case CDROM_TWELVE_SPEED:
27521 			data = 0x2;
27522 			/*FALLTHROUGH*/
27523 		case CDROM_NORMAL_SPEED:
27524 		case CDROM_DOUBLE_SPEED:
27525 		case CDROM_QUAD_SPEED:
27526 		case CDROM_MAXIMUM_SPEED:
27527 			break;
27528 		default:
27529 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27530 			    "sr_change_speed: "
27531 			    "Drive Speed '%d' Not Supported\n", (uchar_t)data);
27532 			kmem_free(sense, BUFLEN_MODE_CDROM_SPEED);
27533 			return (EINVAL);
27534 		}
27535 
27536 		/*
27537 		 * The current drive speed matches the requested drive speed so
27538 		 * there is no need to send the mode select to change the speed
27539 		 */
27540 		if (current_speed == data) {
27541 			break;
27542 		}
27543 
27544 		/* Build the select data for the requested drive speed */
27545 		select = kmem_zalloc(BUFLEN_MODE_CDROM_SPEED, KM_SLEEP);
27546 		select_mhp = (struct mode_header *)select;
27547 		select_mhp->bdesc_length = 0;
27548 		select_page =
27549 		    (struct mode_speed *)(select + MODE_HEADER_LENGTH);
27550 		select_page =
27551 		    (struct mode_speed *)(select + MODE_HEADER_LENGTH);
27552 		select_page->mode_page.code = CDROM_MODE_SPEED;
27553 		select_page->mode_page.length = 2;
27554 		select_page->speed = (uchar_t)data;
27555 
27556 		/* Send the mode select for the requested block size */
27557 		ssc = sd_ssc_init(un);
27558 		rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, select,
27559 		    MODEPAGE_CDROM_SPEED_LEN + MODE_HEADER_LENGTH,
27560 		    SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
27561 		sd_ssc_fini(ssc);
27562 		if (rval != 0) {
27563 			/*
27564 			 * The mode select failed for the requested drive speed,
27565 			 * so reset the data for the original drive speed and
27566 			 * send it to the target. The error is indicated by the
27567 			 * return value for the failed mode select.
27568 			 */
27569 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27570 			    "sr_drive_speed: Mode Select Failed\n");
27571 			select_page->speed = sense_page->speed;
27572 			ssc = sd_ssc_init(un);
27573 			(void) sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, select,
27574 			    MODEPAGE_CDROM_SPEED_LEN + MODE_HEADER_LENGTH,
27575 			    SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
27576 			sd_ssc_fini(ssc);
27577 		}
27578 		break;
27579 	default:
27580 		/* should not reach here, but check anyway */
27581 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27582 		    "sr_change_speed: Command '%x' Not Supported\n", cmd);
27583 		rval = EINVAL;
27584 		break;
27585 	}
27586 
27587 	if (select) {
27588 		kmem_free(select, BUFLEN_MODE_CDROM_SPEED);
27589 	}
27590 	if (sense) {
27591 		kmem_free(sense, BUFLEN_MODE_CDROM_SPEED);
27592 	}
27593 
27594 	return (rval);
27595 }
27596 
27597 
27598 /*
27599  *    Function: sr_atapi_change_speed()
27600  *
27601  * Description: This routine is the driver entry point for handling CD-ROM
27602  *		drive speed ioctl requests for MMC devices that do not support
27603  *		the Real Time Streaming feature (0x107).
27604  *
27605  *		Note: This routine will use the SET SPEED command which may not
27606  *		be supported by all devices.
27607  *
27608  *   Arguments: dev- the device 'dev_t'
27609  *		cmd- the request type; one of CDROMGDRVSPEED (get) or
27610  *		     CDROMSDRVSPEED (set)
27611  *		data- current drive speed or requested drive speed
27612  *		flag- this argument is a pass through to ddi_copyxxx() directly
27613  *		      from the mode argument of ioctl().
27614  *
27615  * Return Code: the code returned by sd_send_scsi_cmd()
27616  *		EINVAL if invalid arguments are provided
27617  *		EFAULT if ddi_copyxxx() fails
27618  *		ENXIO if fail ddi_get_soft_state
27619  *		EIO if invalid mode sense block descriptor length
27620  */
27621 
27622 static int
27623 sr_atapi_change_speed(dev_t dev, int cmd, intptr_t data, int flag)
27624 {
27625 	struct sd_lun			*un;
27626 	struct uscsi_cmd		*com = NULL;
27627 	struct mode_header_grp2		*sense_mhp;
27628 	uchar_t				*sense_page;
27629 	uchar_t				*sense = NULL;
27630 	char				cdb[CDB_GROUP5];
27631 	int				bd_len;
27632 	int				current_speed = 0;
27633 	int				max_speed = 0;
27634 	int				rval;
27635 	sd_ssc_t			*ssc;
27636 
27637 	ASSERT((cmd == CDROMGDRVSPEED) || (cmd == CDROMSDRVSPEED));
27638 
27639 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27640 		return (ENXIO);
27641 	}
27642 
27643 	sense = kmem_zalloc(BUFLEN_MODE_CDROM_CAP, KM_SLEEP);
27644 
27645 	ssc = sd_ssc_init(un);
27646 	rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, sense,
27647 	    BUFLEN_MODE_CDROM_CAP, MODEPAGE_CDROM_CAP,
27648 	    SD_PATH_STANDARD);
27649 	sd_ssc_fini(ssc);
27650 	if (rval != 0) {
27651 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27652 		    "sr_atapi_change_speed: Mode Sense Failed\n");
27653 		kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27654 		return (rval);
27655 	}
27656 
27657 	/* Check the block descriptor len to handle only 1 block descriptor */
27658 	sense_mhp = (struct mode_header_grp2 *)sense;
27659 	bd_len = (sense_mhp->bdesc_length_hi << 8) | sense_mhp->bdesc_length_lo;
27660 	if (bd_len > MODE_BLK_DESC_LENGTH) {
27661 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27662 		    "sr_atapi_change_speed: Mode Sense returned invalid "
27663 		    "block descriptor length\n");
27664 		kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27665 		return (EIO);
27666 	}
27667 
27668 	/* Calculate the current and maximum drive speeds */
27669 	sense_page = (uchar_t *)(sense + MODE_HEADER_LENGTH_GRP2 + bd_len);
27670 	current_speed = (sense_page[14] << 8) | sense_page[15];
27671 	max_speed = (sense_page[8] << 8) | sense_page[9];
27672 
27673 	/* Process the command */
27674 	switch (cmd) {
27675 	case CDROMGDRVSPEED:
27676 		current_speed /= SD_SPEED_1X;
27677 		if (ddi_copyout(&current_speed, (void *)data,
27678 		    sizeof (int), flag) != 0)
27679 			rval = EFAULT;
27680 		break;
27681 	case CDROMSDRVSPEED:
27682 		/* Convert the speed code to KB/sec */
27683 		switch ((uchar_t)data) {
27684 		case CDROM_NORMAL_SPEED:
27685 			current_speed = SD_SPEED_1X;
27686 			break;
27687 		case CDROM_DOUBLE_SPEED:
27688 			current_speed = 2 * SD_SPEED_1X;
27689 			break;
27690 		case CDROM_QUAD_SPEED:
27691 			current_speed = 4 * SD_SPEED_1X;
27692 			break;
27693 		case CDROM_TWELVE_SPEED:
27694 			current_speed = 12 * SD_SPEED_1X;
27695 			break;
27696 		case CDROM_MAXIMUM_SPEED:
27697 			current_speed = 0xffff;
27698 			break;
27699 		default:
27700 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27701 			    "sr_atapi_change_speed: invalid drive speed %d\n",
27702 			    (uchar_t)data);
27703 			kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27704 			return (EINVAL);
27705 		}
27706 
27707 		/* Check the request against the drive's max speed. */
27708 		if (current_speed != 0xffff) {
27709 			if (current_speed > max_speed) {
27710 				kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27711 				return (EINVAL);
27712 			}
27713 		}
27714 
27715 		/*
27716 		 * Build and send the SET SPEED command
27717 		 *
27718 		 * Note: The SET SPEED (0xBB) command used in this routine is
27719 		 * obsolete per the SCSI MMC spec but still supported in the
27720 		 * MT FUJI vendor spec. Most equipment is adhereing to MT FUJI
27721 		 * therefore the command is still implemented in this routine.
27722 		 */
27723 		bzero(cdb, sizeof (cdb));
27724 		cdb[0] = (char)SCMD_SET_CDROM_SPEED;
27725 		cdb[2] = (uchar_t)(current_speed >> 8);
27726 		cdb[3] = (uchar_t)current_speed;
27727 		com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27728 		com->uscsi_cdb	   = (caddr_t)cdb;
27729 		com->uscsi_cdblen  = CDB_GROUP5;
27730 		com->uscsi_bufaddr = NULL;
27731 		com->uscsi_buflen  = 0;
27732 		com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT;
27733 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, 0, SD_PATH_STANDARD);
27734 		break;
27735 	default:
27736 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27737 		    "sr_atapi_change_speed: Command '%x' Not Supported\n", cmd);
27738 		rval = EINVAL;
27739 	}
27740 
27741 	if (sense) {
27742 		kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27743 	}
27744 	if (com) {
27745 		kmem_free(com, sizeof (*com));
27746 	}
27747 	return (rval);
27748 }
27749 
27750 
27751 /*
27752  *    Function: sr_pause_resume()
27753  *
27754  * Description: This routine is the driver entry point for handling CD-ROM
27755  *		pause/resume ioctl requests. This only affects the audio play
27756  *		operation.
27757  *
27758  *   Arguments: dev - the device 'dev_t'
27759  *		cmd - the request type; one of CDROMPAUSE or CDROMRESUME, used
27760  *		      for setting the resume bit of the cdb.
27761  *
27762  * Return Code: the code returned by sd_send_scsi_cmd()
27763  *		EINVAL if invalid mode specified
27764  *
27765  */
27766 
27767 static int
27768 sr_pause_resume(dev_t dev, int cmd)
27769 {
27770 	struct sd_lun		*un;
27771 	struct uscsi_cmd	*com;
27772 	char			cdb[CDB_GROUP1];
27773 	int			rval;
27774 
27775 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27776 		return (ENXIO);
27777 	}
27778 
27779 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27780 	bzero(cdb, CDB_GROUP1);
27781 	cdb[0] = SCMD_PAUSE_RESUME;
27782 	switch (cmd) {
27783 	case CDROMRESUME:
27784 		cdb[8] = 1;
27785 		break;
27786 	case CDROMPAUSE:
27787 		cdb[8] = 0;
27788 		break;
27789 	default:
27790 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN, "sr_pause_resume:"
27791 		    " Command '%x' Not Supported\n", cmd);
27792 		rval = EINVAL;
27793 		goto done;
27794 	}
27795 
27796 	com->uscsi_cdb    = cdb;
27797 	com->uscsi_cdblen = CDB_GROUP1;
27798 	com->uscsi_flags  = USCSI_DIAGNOSE|USCSI_SILENT;
27799 
27800 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27801 	    SD_PATH_STANDARD);
27802 
27803 done:
27804 	kmem_free(com, sizeof (*com));
27805 	return (rval);
27806 }
27807 
27808 
27809 /*
27810  *    Function: sr_play_msf()
27811  *
27812  * Description: This routine is the driver entry point for handling CD-ROM
27813  *		ioctl requests to output the audio signals at the specified
27814  *		starting address and continue the audio play until the specified
27815  *		ending address (CDROMPLAYMSF) The address is in Minute Second
27816  *		Frame (MSF) format.
27817  *
27818  *   Arguments: dev	- the device 'dev_t'
27819  *		data	- pointer to user provided audio msf structure,
27820  *		          specifying start/end addresses.
27821  *		flag	- this argument is a pass through to ddi_copyxxx()
27822  *		          directly from the mode argument of ioctl().
27823  *
27824  * Return Code: the code returned by sd_send_scsi_cmd()
27825  *		EFAULT if ddi_copyxxx() fails
27826  *		ENXIO if fail ddi_get_soft_state
27827  *		EINVAL if data pointer is NULL
27828  */
27829 
27830 static int
27831 sr_play_msf(dev_t dev, caddr_t data, int flag)
27832 {
27833 	struct sd_lun		*un;
27834 	struct uscsi_cmd	*com;
27835 	struct cdrom_msf	msf_struct;
27836 	struct cdrom_msf	*msf = &msf_struct;
27837 	char			cdb[CDB_GROUP1];
27838 	int			rval;
27839 
27840 	if (data == NULL) {
27841 		return (EINVAL);
27842 	}
27843 
27844 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27845 		return (ENXIO);
27846 	}
27847 
27848 	if (ddi_copyin(data, msf, sizeof (struct cdrom_msf), flag)) {
27849 		return (EFAULT);
27850 	}
27851 
27852 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27853 	bzero(cdb, CDB_GROUP1);
27854 	cdb[0] = SCMD_PLAYAUDIO_MSF;
27855 	if (un->un_f_cfg_playmsf_bcd == TRUE) {
27856 		cdb[3] = BYTE_TO_BCD(msf->cdmsf_min0);
27857 		cdb[4] = BYTE_TO_BCD(msf->cdmsf_sec0);
27858 		cdb[5] = BYTE_TO_BCD(msf->cdmsf_frame0);
27859 		cdb[6] = BYTE_TO_BCD(msf->cdmsf_min1);
27860 		cdb[7] = BYTE_TO_BCD(msf->cdmsf_sec1);
27861 		cdb[8] = BYTE_TO_BCD(msf->cdmsf_frame1);
27862 	} else {
27863 		cdb[3] = msf->cdmsf_min0;
27864 		cdb[4] = msf->cdmsf_sec0;
27865 		cdb[5] = msf->cdmsf_frame0;
27866 		cdb[6] = msf->cdmsf_min1;
27867 		cdb[7] = msf->cdmsf_sec1;
27868 		cdb[8] = msf->cdmsf_frame1;
27869 	}
27870 	com->uscsi_cdb    = cdb;
27871 	com->uscsi_cdblen = CDB_GROUP1;
27872 	com->uscsi_flags  = USCSI_DIAGNOSE|USCSI_SILENT;
27873 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27874 	    SD_PATH_STANDARD);
27875 	kmem_free(com, sizeof (*com));
27876 	return (rval);
27877 }
27878 
27879 
27880 /*
27881  *    Function: sr_play_trkind()
27882  *
27883  * Description: This routine is the driver entry point for handling CD-ROM
27884  *		ioctl requests to output the audio signals at the specified
27885  *		starting address and continue the audio play until the specified
27886  *		ending address (CDROMPLAYTRKIND). The address is in Track Index
27887  *		format.
27888  *
27889  *   Arguments: dev	- the device 'dev_t'
27890  *		data	- pointer to user provided audio track/index structure,
27891  *		          specifying start/end addresses.
27892  *		flag	- this argument is a pass through to ddi_copyxxx()
27893  *		          directly from the mode argument of ioctl().
27894  *
27895  * Return Code: the code returned by sd_send_scsi_cmd()
27896  *		EFAULT if ddi_copyxxx() fails
27897  *		ENXIO if fail ddi_get_soft_state
27898  *		EINVAL if data pointer is NULL
27899  */
27900 
27901 static int
27902 sr_play_trkind(dev_t dev, caddr_t data, int flag)
27903 {
27904 	struct cdrom_ti		ti_struct;
27905 	struct cdrom_ti		*ti = &ti_struct;
27906 	struct uscsi_cmd	*com = NULL;
27907 	char			cdb[CDB_GROUP1];
27908 	int			rval;
27909 
27910 	if (data == NULL) {
27911 		return (EINVAL);
27912 	}
27913 
27914 	if (ddi_copyin(data, ti, sizeof (struct cdrom_ti), flag)) {
27915 		return (EFAULT);
27916 	}
27917 
27918 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27919 	bzero(cdb, CDB_GROUP1);
27920 	cdb[0] = SCMD_PLAYAUDIO_TI;
27921 	cdb[4] = ti->cdti_trk0;
27922 	cdb[5] = ti->cdti_ind0;
27923 	cdb[7] = ti->cdti_trk1;
27924 	cdb[8] = ti->cdti_ind1;
27925 	com->uscsi_cdb    = cdb;
27926 	com->uscsi_cdblen = CDB_GROUP1;
27927 	com->uscsi_flags  = USCSI_DIAGNOSE|USCSI_SILENT;
27928 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27929 	    SD_PATH_STANDARD);
27930 	kmem_free(com, sizeof (*com));
27931 	return (rval);
27932 }
27933 
27934 
27935 /*
27936  *    Function: sr_read_all_subcodes()
27937  *
27938  * Description: This routine is the driver entry point for handling CD-ROM
27939  *		ioctl requests to return raw subcode data while the target is
27940  *		playing audio (CDROMSUBCODE).
27941  *
27942  *   Arguments: dev	- the device 'dev_t'
27943  *		data	- pointer to user provided cdrom subcode structure,
27944  *		          specifying the transfer length and address.
27945  *		flag	- this argument is a pass through to ddi_copyxxx()
27946  *		          directly from the mode argument of ioctl().
27947  *
27948  * Return Code: the code returned by sd_send_scsi_cmd()
27949  *		EFAULT if ddi_copyxxx() fails
27950  *		ENXIO if fail ddi_get_soft_state
27951  *		EINVAL if data pointer is NULL
27952  */
27953 
27954 static int
27955 sr_read_all_subcodes(dev_t dev, caddr_t data, int flag)
27956 {
27957 	struct sd_lun		*un = NULL;
27958 	struct uscsi_cmd	*com = NULL;
27959 	struct cdrom_subcode	*subcode = NULL;
27960 	int			rval;
27961 	size_t			buflen;
27962 	char			cdb[CDB_GROUP5];
27963 
27964 #ifdef _MULTI_DATAMODEL
27965 	/* To support ILP32 applications in an LP64 world */
27966 	struct cdrom_subcode32		cdrom_subcode32;
27967 	struct cdrom_subcode32		*cdsc32 = &cdrom_subcode32;
27968 #endif
27969 	if (data == NULL) {
27970 		return (EINVAL);
27971 	}
27972 
27973 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27974 		return (ENXIO);
27975 	}
27976 
27977 	subcode = kmem_zalloc(sizeof (struct cdrom_subcode), KM_SLEEP);
27978 
27979 #ifdef _MULTI_DATAMODEL
27980 	switch (ddi_model_convert_from(flag & FMODELS)) {
27981 	case DDI_MODEL_ILP32:
27982 		if (ddi_copyin(data, cdsc32, sizeof (*cdsc32), flag)) {
27983 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27984 			    "sr_read_all_subcodes: ddi_copyin Failed\n");
27985 			kmem_free(subcode, sizeof (struct cdrom_subcode));
27986 			return (EFAULT);
27987 		}
27988 		/* Convert the ILP32 uscsi data from the application to LP64 */
27989 		cdrom_subcode32tocdrom_subcode(cdsc32, subcode);
27990 		break;
27991 	case DDI_MODEL_NONE:
27992 		if (ddi_copyin(data, subcode,
27993 		    sizeof (struct cdrom_subcode), flag)) {
27994 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27995 			    "sr_read_all_subcodes: ddi_copyin Failed\n");
27996 			kmem_free(subcode, sizeof (struct cdrom_subcode));
27997 			return (EFAULT);
27998 		}
27999 		break;
28000 	}
28001 #else /* ! _MULTI_DATAMODEL */
28002 	if (ddi_copyin(data, subcode, sizeof (struct cdrom_subcode), flag)) {
28003 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28004 		    "sr_read_all_subcodes: ddi_copyin Failed\n");
28005 		kmem_free(subcode, sizeof (struct cdrom_subcode));
28006 		return (EFAULT);
28007 	}
28008 #endif /* _MULTI_DATAMODEL */
28009 
28010 	/*
28011 	 * Since MMC-2 expects max 3 bytes for length, check if the
28012 	 * length input is greater than 3 bytes
28013 	 */
28014 	if ((subcode->cdsc_length & 0xFF000000) != 0) {
28015 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28016 		    "sr_read_all_subcodes: "
28017 		    "cdrom transfer length too large: %d (limit %d)\n",
28018 		    subcode->cdsc_length, 0xFFFFFF);
28019 		kmem_free(subcode, sizeof (struct cdrom_subcode));
28020 		return (EINVAL);
28021 	}
28022 
28023 	buflen = CDROM_BLK_SUBCODE * subcode->cdsc_length;
28024 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28025 	bzero(cdb, CDB_GROUP5);
28026 
28027 	if (un->un_f_mmc_cap == TRUE) {
28028 		cdb[0] = (char)SCMD_READ_CD;
28029 		cdb[2] = (char)0xff;
28030 		cdb[3] = (char)0xff;
28031 		cdb[4] = (char)0xff;
28032 		cdb[5] = (char)0xff;
28033 		cdb[6] = (((subcode->cdsc_length) & 0x00ff0000) >> 16);
28034 		cdb[7] = (((subcode->cdsc_length) & 0x0000ff00) >> 8);
28035 		cdb[8] = ((subcode->cdsc_length) & 0x000000ff);
28036 		cdb[10] = 1;
28037 	} else {
28038 		/*
28039 		 * Note: A vendor specific command (0xDF) is being used here to
28040 		 * request a read of all subcodes.
28041 		 */
28042 		cdb[0] = (char)SCMD_READ_ALL_SUBCODES;
28043 		cdb[6] = (((subcode->cdsc_length) & 0xff000000) >> 24);
28044 		cdb[7] = (((subcode->cdsc_length) & 0x00ff0000) >> 16);
28045 		cdb[8] = (((subcode->cdsc_length) & 0x0000ff00) >> 8);
28046 		cdb[9] = ((subcode->cdsc_length) & 0x000000ff);
28047 	}
28048 	com->uscsi_cdb	   = cdb;
28049 	com->uscsi_cdblen  = CDB_GROUP5;
28050 	com->uscsi_bufaddr = (caddr_t)subcode->cdsc_addr;
28051 	com->uscsi_buflen  = buflen;
28052 	com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28053 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
28054 	    SD_PATH_STANDARD);
28055 	kmem_free(subcode, sizeof (struct cdrom_subcode));
28056 	kmem_free(com, sizeof (*com));
28057 	return (rval);
28058 }
28059 
28060 
28061 /*
28062  *    Function: sr_read_subchannel()
28063  *
28064  * Description: This routine is the driver entry point for handling CD-ROM
28065  *		ioctl requests to return the Q sub-channel data of the CD
28066  *		current position block. (CDROMSUBCHNL) The data includes the
28067  *		track number, index number, absolute CD-ROM address (LBA or MSF
28068  *		format per the user) , track relative CD-ROM address (LBA or MSF
28069  *		format per the user), control data and audio status.
28070  *
28071  *   Arguments: dev	- the device 'dev_t'
28072  *		data	- pointer to user provided cdrom sub-channel structure
28073  *		flag	- this argument is a pass through to ddi_copyxxx()
28074  *		          directly from the mode argument of ioctl().
28075  *
28076  * Return Code: the code returned by sd_send_scsi_cmd()
28077  *		EFAULT if ddi_copyxxx() fails
28078  *		ENXIO if fail ddi_get_soft_state
28079  *		EINVAL if data pointer is NULL
28080  */
28081 
28082 static int
28083 sr_read_subchannel(dev_t dev, caddr_t data, int flag)
28084 {
28085 	struct sd_lun		*un;
28086 	struct uscsi_cmd	*com;
28087 	struct cdrom_subchnl	subchanel;
28088 	struct cdrom_subchnl	*subchnl = &subchanel;
28089 	char			cdb[CDB_GROUP1];
28090 	caddr_t			buffer;
28091 	int			rval;
28092 
28093 	if (data == NULL) {
28094 		return (EINVAL);
28095 	}
28096 
28097 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28098 	    (un->un_state == SD_STATE_OFFLINE)) {
28099 		return (ENXIO);
28100 	}
28101 
28102 	if (ddi_copyin(data, subchnl, sizeof (struct cdrom_subchnl), flag)) {
28103 		return (EFAULT);
28104 	}
28105 
28106 	buffer = kmem_zalloc((size_t)16, KM_SLEEP);
28107 	bzero(cdb, CDB_GROUP1);
28108 	cdb[0] = SCMD_READ_SUBCHANNEL;
28109 	/* Set the MSF bit based on the user requested address format */
28110 	cdb[1] = (subchnl->cdsc_format & CDROM_LBA) ? 0 : 0x02;
28111 	/*
28112 	 * Set the Q bit in byte 2 to indicate that Q sub-channel data be
28113 	 * returned
28114 	 */
28115 	cdb[2] = 0x40;
28116 	/*
28117 	 * Set byte 3 to specify the return data format. A value of 0x01
28118 	 * indicates that the CD-ROM current position should be returned.
28119 	 */
28120 	cdb[3] = 0x01;
28121 	cdb[8] = 0x10;
28122 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28123 	com->uscsi_cdb	   = cdb;
28124 	com->uscsi_cdblen  = CDB_GROUP1;
28125 	com->uscsi_bufaddr = buffer;
28126 	com->uscsi_buflen  = 16;
28127 	com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28128 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
28129 	    SD_PATH_STANDARD);
28130 	if (rval != 0) {
28131 		kmem_free(buffer, 16);
28132 		kmem_free(com, sizeof (*com));
28133 		return (rval);
28134 	}
28135 
28136 	/* Process the returned Q sub-channel data */
28137 	subchnl->cdsc_audiostatus = buffer[1];
28138 	subchnl->cdsc_adr	= (buffer[5] & 0xF0) >> 4;
28139 	subchnl->cdsc_ctrl	= (buffer[5] & 0x0F);
28140 	subchnl->cdsc_trk	= buffer[6];
28141 	subchnl->cdsc_ind	= buffer[7];
28142 	if (subchnl->cdsc_format & CDROM_LBA) {
28143 		subchnl->cdsc_absaddr.lba =
28144 		    ((uchar_t)buffer[8] << 24) + ((uchar_t)buffer[9] << 16) +
28145 		    ((uchar_t)buffer[10] << 8) + ((uchar_t)buffer[11]);
28146 		subchnl->cdsc_reladdr.lba =
28147 		    ((uchar_t)buffer[12] << 24) + ((uchar_t)buffer[13] << 16) +
28148 		    ((uchar_t)buffer[14] << 8) + ((uchar_t)buffer[15]);
28149 	} else if (un->un_f_cfg_readsub_bcd == TRUE) {
28150 		subchnl->cdsc_absaddr.msf.minute = BCD_TO_BYTE(buffer[9]);
28151 		subchnl->cdsc_absaddr.msf.second = BCD_TO_BYTE(buffer[10]);
28152 		subchnl->cdsc_absaddr.msf.frame  = BCD_TO_BYTE(buffer[11]);
28153 		subchnl->cdsc_reladdr.msf.minute = BCD_TO_BYTE(buffer[13]);
28154 		subchnl->cdsc_reladdr.msf.second = BCD_TO_BYTE(buffer[14]);
28155 		subchnl->cdsc_reladdr.msf.frame  = BCD_TO_BYTE(buffer[15]);
28156 	} else {
28157 		subchnl->cdsc_absaddr.msf.minute = buffer[9];
28158 		subchnl->cdsc_absaddr.msf.second = buffer[10];
28159 		subchnl->cdsc_absaddr.msf.frame  = buffer[11];
28160 		subchnl->cdsc_reladdr.msf.minute = buffer[13];
28161 		subchnl->cdsc_reladdr.msf.second = buffer[14];
28162 		subchnl->cdsc_reladdr.msf.frame  = buffer[15];
28163 	}
28164 	kmem_free(buffer, 16);
28165 	kmem_free(com, sizeof (*com));
28166 	if (ddi_copyout(subchnl, data, sizeof (struct cdrom_subchnl), flag)
28167 	    != 0) {
28168 		return (EFAULT);
28169 	}
28170 	return (rval);
28171 }
28172 
28173 
28174 /*
28175  *    Function: sr_read_tocentry()
28176  *
28177  * Description: This routine is the driver entry point for handling CD-ROM
28178  *		ioctl requests to read from the Table of Contents (TOC)
28179  *		(CDROMREADTOCENTRY). This routine provides the ADR and CTRL
28180  *		fields, the starting address (LBA or MSF format per the user)
28181  *		and the data mode if the user specified track is a data track.
28182  *
28183  *		Note: The READ HEADER (0x44) command used in this routine is
28184  *		obsolete per the SCSI MMC spec but still supported in the
28185  *		MT FUJI vendor spec. Most equipment is adhereing to MT FUJI
28186  *		therefore the command is still implemented in this routine.
28187  *
28188  *   Arguments: dev	- the device 'dev_t'
28189  *		data	- pointer to user provided toc entry structure,
28190  *			  specifying the track # and the address format
28191  *			  (LBA or MSF).
28192  *		flag	- this argument is a pass through to ddi_copyxxx()
28193  *		          directly from the mode argument of ioctl().
28194  *
28195  * Return Code: the code returned by sd_send_scsi_cmd()
28196  *		EFAULT if ddi_copyxxx() fails
28197  *		ENXIO if fail ddi_get_soft_state
28198  *		EINVAL if data pointer is NULL
28199  */
28200 
28201 static int
28202 sr_read_tocentry(dev_t dev, caddr_t data, int flag)
28203 {
28204 	struct sd_lun		*un = NULL;
28205 	struct uscsi_cmd	*com;
28206 	struct cdrom_tocentry	toc_entry;
28207 	struct cdrom_tocentry	*entry = &toc_entry;
28208 	caddr_t			buffer;
28209 	int			rval;
28210 	char			cdb[CDB_GROUP1];
28211 
28212 	if (data == NULL) {
28213 		return (EINVAL);
28214 	}
28215 
28216 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28217 	    (un->un_state == SD_STATE_OFFLINE)) {
28218 		return (ENXIO);
28219 	}
28220 
28221 	if (ddi_copyin(data, entry, sizeof (struct cdrom_tocentry), flag)) {
28222 		return (EFAULT);
28223 	}
28224 
28225 	/* Validate the requested track and address format */
28226 	if (!(entry->cdte_format & (CDROM_LBA | CDROM_MSF))) {
28227 		return (EINVAL);
28228 	}
28229 
28230 	if (entry->cdte_track == 0) {
28231 		return (EINVAL);
28232 	}
28233 
28234 	buffer = kmem_zalloc((size_t)12, KM_SLEEP);
28235 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28236 	bzero(cdb, CDB_GROUP1);
28237 
28238 	cdb[0] = SCMD_READ_TOC;
28239 	/* Set the MSF bit based on the user requested address format  */
28240 	cdb[1] = ((entry->cdte_format & CDROM_LBA) ? 0 : 2);
28241 	if (un->un_f_cfg_read_toc_trk_bcd == TRUE) {
28242 		cdb[6] = BYTE_TO_BCD(entry->cdte_track);
28243 	} else {
28244 		cdb[6] = entry->cdte_track;
28245 	}
28246 
28247 	/*
28248 	 * Bytes 7 & 8 are the 12 byte allocation length for a single entry.
28249 	 * (4 byte TOC response header + 8 byte track descriptor)
28250 	 */
28251 	cdb[8] = 12;
28252 	com->uscsi_cdb	   = cdb;
28253 	com->uscsi_cdblen  = CDB_GROUP1;
28254 	com->uscsi_bufaddr = buffer;
28255 	com->uscsi_buflen  = 0x0C;
28256 	com->uscsi_flags   = (USCSI_DIAGNOSE | USCSI_SILENT | USCSI_READ);
28257 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
28258 	    SD_PATH_STANDARD);
28259 	if (rval != 0) {
28260 		kmem_free(buffer, 12);
28261 		kmem_free(com, sizeof (*com));
28262 		return (rval);
28263 	}
28264 
28265 	/* Process the toc entry */
28266 	entry->cdte_adr		= (buffer[5] & 0xF0) >> 4;
28267 	entry->cdte_ctrl	= (buffer[5] & 0x0F);
28268 	if (entry->cdte_format & CDROM_LBA) {
28269 		entry->cdte_addr.lba =
28270 		    ((uchar_t)buffer[8] << 24) + ((uchar_t)buffer[9] << 16) +
28271 		    ((uchar_t)buffer[10] << 8) + ((uchar_t)buffer[11]);
28272 	} else if (un->un_f_cfg_read_toc_addr_bcd == TRUE) {
28273 		entry->cdte_addr.msf.minute	= BCD_TO_BYTE(buffer[9]);
28274 		entry->cdte_addr.msf.second	= BCD_TO_BYTE(buffer[10]);
28275 		entry->cdte_addr.msf.frame	= BCD_TO_BYTE(buffer[11]);
28276 		/*
28277 		 * Send a READ TOC command using the LBA address format to get
28278 		 * the LBA for the track requested so it can be used in the
28279 		 * READ HEADER request
28280 		 *
28281 		 * Note: The MSF bit of the READ HEADER command specifies the
28282 		 * output format. The block address specified in that command
28283 		 * must be in LBA format.
28284 		 */
28285 		cdb[1] = 0;
28286 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
28287 		    SD_PATH_STANDARD);
28288 		if (rval != 0) {
28289 			kmem_free(buffer, 12);
28290 			kmem_free(com, sizeof (*com));
28291 			return (rval);
28292 		}
28293 	} else {
28294 		entry->cdte_addr.msf.minute	= buffer[9];
28295 		entry->cdte_addr.msf.second	= buffer[10];
28296 		entry->cdte_addr.msf.frame	= buffer[11];
28297 		/*
28298 		 * Send a READ TOC command using the LBA address format to get
28299 		 * the LBA for the track requested so it can be used in the
28300 		 * READ HEADER request
28301 		 *
28302 		 * Note: The MSF bit of the READ HEADER command specifies the
28303 		 * output format. The block address specified in that command
28304 		 * must be in LBA format.
28305 		 */
28306 		cdb[1] = 0;
28307 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
28308 		    SD_PATH_STANDARD);
28309 		if (rval != 0) {
28310 			kmem_free(buffer, 12);
28311 			kmem_free(com, sizeof (*com));
28312 			return (rval);
28313 		}
28314 	}
28315 
28316 	/*
28317 	 * Build and send the READ HEADER command to determine the data mode of
28318 	 * the user specified track.
28319 	 */
28320 	if ((entry->cdte_ctrl & CDROM_DATA_TRACK) &&
28321 	    (entry->cdte_track != CDROM_LEADOUT)) {
28322 		bzero(cdb, CDB_GROUP1);
28323 		cdb[0] = SCMD_READ_HEADER;
28324 		cdb[2] = buffer[8];
28325 		cdb[3] = buffer[9];
28326 		cdb[4] = buffer[10];
28327 		cdb[5] = buffer[11];
28328 		cdb[8] = 0x08;
28329 		com->uscsi_buflen = 0x08;
28330 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
28331 		    SD_PATH_STANDARD);
28332 		if (rval == 0) {
28333 			entry->cdte_datamode = buffer[0];
28334 		} else {
28335 			/*
28336 			 * READ HEADER command failed, since this is
28337 			 * obsoleted in one spec, its better to return
28338 			 * -1 for an invlid track so that we can still
28339 			 * receive the rest of the TOC data.
28340 			 */
28341 			entry->cdte_datamode = (uchar_t)-1;
28342 		}
28343 	} else {
28344 		entry->cdte_datamode = (uchar_t)-1;
28345 	}
28346 
28347 	kmem_free(buffer, 12);
28348 	kmem_free(com, sizeof (*com));
28349 	if (ddi_copyout(entry, data, sizeof (struct cdrom_tocentry), flag) != 0)
28350 		return (EFAULT);
28351 
28352 	return (rval);
28353 }
28354 
28355 
28356 /*
28357  *    Function: sr_read_tochdr()
28358  *
28359  * Description: This routine is the driver entry point for handling CD-ROM
28360  *		ioctl requests to read the Table of Contents (TOC) header
28361  *		(CDROMREADTOHDR). The TOC header consists of the disk starting
28362  *		and ending track numbers
28363  *
28364  *   Arguments: dev	- the device 'dev_t'
28365  *		data	- pointer to user provided toc header structure,
28366  *			  specifying the starting and ending track numbers.
28367  *		flag	- this argument is a pass through to ddi_copyxxx()
28368  *			  directly from the mode argument of ioctl().
28369  *
28370  * Return Code: the code returned by sd_send_scsi_cmd()
28371  *		EFAULT if ddi_copyxxx() fails
28372  *		ENXIO if fail ddi_get_soft_state
28373  *		EINVAL if data pointer is NULL
28374  */
28375 
28376 static int
28377 sr_read_tochdr(dev_t dev, caddr_t data, int flag)
28378 {
28379 	struct sd_lun		*un;
28380 	struct uscsi_cmd	*com;
28381 	struct cdrom_tochdr	toc_header;
28382 	struct cdrom_tochdr	*hdr = &toc_header;
28383 	char			cdb[CDB_GROUP1];
28384 	int			rval;
28385 	caddr_t			buffer;
28386 
28387 	if (data == NULL) {
28388 		return (EINVAL);
28389 	}
28390 
28391 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28392 	    (un->un_state == SD_STATE_OFFLINE)) {
28393 		return (ENXIO);
28394 	}
28395 
28396 	buffer = kmem_zalloc(4, KM_SLEEP);
28397 	bzero(cdb, CDB_GROUP1);
28398 	cdb[0] = SCMD_READ_TOC;
28399 	/*
28400 	 * Specifying a track number of 0x00 in the READ TOC command indicates
28401 	 * that the TOC header should be returned
28402 	 */
28403 	cdb[6] = 0x00;
28404 	/*
28405 	 * Bytes 7 & 8 are the 4 byte allocation length for TOC header.
28406 	 * (2 byte data len + 1 byte starting track # + 1 byte ending track #)
28407 	 */
28408 	cdb[8] = 0x04;
28409 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28410 	com->uscsi_cdb	   = cdb;
28411 	com->uscsi_cdblen  = CDB_GROUP1;
28412 	com->uscsi_bufaddr = buffer;
28413 	com->uscsi_buflen  = 0x04;
28414 	com->uscsi_timeout = 300;
28415 	com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28416 
28417 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
28418 	    SD_PATH_STANDARD);
28419 	if (un->un_f_cfg_read_toc_trk_bcd == TRUE) {
28420 		hdr->cdth_trk0 = BCD_TO_BYTE(buffer[2]);
28421 		hdr->cdth_trk1 = BCD_TO_BYTE(buffer[3]);
28422 	} else {
28423 		hdr->cdth_trk0 = buffer[2];
28424 		hdr->cdth_trk1 = buffer[3];
28425 	}
28426 	kmem_free(buffer, 4);
28427 	kmem_free(com, sizeof (*com));
28428 	if (ddi_copyout(hdr, data, sizeof (struct cdrom_tochdr), flag) != 0) {
28429 		return (EFAULT);
28430 	}
28431 	return (rval);
28432 }
28433 
28434 
28435 /*
28436  * Note: The following sr_read_mode1(), sr_read_cd_mode2(), sr_read_mode2(),
28437  * sr_read_cdda(), sr_read_cdxa(), routines implement driver support for
28438  * handling CDROMREAD ioctl requests for mode 1 user data, mode 2 user data,
28439  * digital audio and extended architecture digital audio. These modes are
28440  * defined in the IEC908 (Red Book), ISO10149 (Yellow Book), and the SCSI3
28441  * MMC specs.
28442  *
28443  * In addition to support for the various data formats these routines also
28444  * include support for devices that implement only the direct access READ
28445  * commands (0x08, 0x28), devices that implement the READ_CD commands
28446  * (0xBE, 0xD4), and devices that implement the vendor unique READ CDDA and
28447  * READ CDXA commands (0xD8, 0xDB)
28448  */
28449 
28450 /*
28451  *    Function: sr_read_mode1()
28452  *
28453  * Description: This routine is the driver entry point for handling CD-ROM
28454  *		ioctl read mode1 requests (CDROMREADMODE1).
28455  *
28456  *   Arguments: dev	- the device 'dev_t'
28457  *		data	- pointer to user provided cd read structure specifying
28458  *			  the lba buffer address and length.
28459  *		flag	- this argument is a pass through to ddi_copyxxx()
28460  *			  directly from the mode argument of ioctl().
28461  *
28462  * Return Code: the code returned by sd_send_scsi_cmd()
28463  *		EFAULT if ddi_copyxxx() fails
28464  *		ENXIO if fail ddi_get_soft_state
28465  *		EINVAL if data pointer is NULL
28466  */
28467 
28468 static int
28469 sr_read_mode1(dev_t dev, caddr_t data, int flag)
28470 {
28471 	struct sd_lun		*un;
28472 	struct cdrom_read	mode1_struct;
28473 	struct cdrom_read	*mode1 = &mode1_struct;
28474 	int			rval;
28475 	sd_ssc_t		*ssc;
28476 
28477 #ifdef _MULTI_DATAMODEL
28478 	/* To support ILP32 applications in an LP64 world */
28479 	struct cdrom_read32	cdrom_read32;
28480 	struct cdrom_read32	*cdrd32 = &cdrom_read32;
28481 #endif /* _MULTI_DATAMODEL */
28482 
28483 	if (data == NULL) {
28484 		return (EINVAL);
28485 	}
28486 
28487 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28488 	    (un->un_state == SD_STATE_OFFLINE)) {
28489 		return (ENXIO);
28490 	}
28491 
28492 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
28493 	    "sd_read_mode1: entry: un:0x%p\n", un);
28494 
28495 #ifdef _MULTI_DATAMODEL
28496 	switch (ddi_model_convert_from(flag & FMODELS)) {
28497 	case DDI_MODEL_ILP32:
28498 		if (ddi_copyin(data, cdrd32, sizeof (*cdrd32), flag) != 0) {
28499 			return (EFAULT);
28500 		}
28501 		/* Convert the ILP32 uscsi data from the application to LP64 */
28502 		cdrom_read32tocdrom_read(cdrd32, mode1);
28503 		break;
28504 	case DDI_MODEL_NONE:
28505 		if (ddi_copyin(data, mode1, sizeof (struct cdrom_read), flag)) {
28506 			return (EFAULT);
28507 		}
28508 	}
28509 #else /* ! _MULTI_DATAMODEL */
28510 	if (ddi_copyin(data, mode1, sizeof (struct cdrom_read), flag)) {
28511 		return (EFAULT);
28512 	}
28513 #endif /* _MULTI_DATAMODEL */
28514 
28515 	ssc = sd_ssc_init(un);
28516 	rval = sd_send_scsi_READ(ssc, mode1->cdread_bufaddr,
28517 	    mode1->cdread_buflen, mode1->cdread_lba, SD_PATH_STANDARD);
28518 	sd_ssc_fini(ssc);
28519 
28520 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
28521 	    "sd_read_mode1: exit: un:0x%p\n", un);
28522 
28523 	return (rval);
28524 }
28525 
28526 
28527 /*
28528  *    Function: sr_read_cd_mode2()
28529  *
28530  * Description: This routine is the driver entry point for handling CD-ROM
28531  *		ioctl read mode2 requests (CDROMREADMODE2) for devices that
28532  *		support the READ CD (0xBE) command or the 1st generation
28533  *		READ CD (0xD4) command.
28534  *
28535  *   Arguments: dev	- the device 'dev_t'
28536  *		data	- pointer to user provided cd read structure specifying
28537  *			  the lba buffer address and length.
28538  *		flag	- this argument is a pass through to ddi_copyxxx()
28539  *			  directly from the mode argument of ioctl().
28540  *
28541  * Return Code: the code returned by sd_send_scsi_cmd()
28542  *		EFAULT if ddi_copyxxx() fails
28543  *		ENXIO if fail ddi_get_soft_state
28544  *		EINVAL if data pointer is NULL
28545  */
28546 
28547 static int
28548 sr_read_cd_mode2(dev_t dev, caddr_t data, int flag)
28549 {
28550 	struct sd_lun		*un;
28551 	struct uscsi_cmd	*com;
28552 	struct cdrom_read	mode2_struct;
28553 	struct cdrom_read	*mode2 = &mode2_struct;
28554 	uchar_t			cdb[CDB_GROUP5];
28555 	int			nblocks;
28556 	int			rval;
28557 #ifdef _MULTI_DATAMODEL
28558 	/*  To support ILP32 applications in an LP64 world */
28559 	struct cdrom_read32	cdrom_read32;
28560 	struct cdrom_read32	*cdrd32 = &cdrom_read32;
28561 #endif /* _MULTI_DATAMODEL */
28562 
28563 	if (data == NULL) {
28564 		return (EINVAL);
28565 	}
28566 
28567 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28568 	    (un->un_state == SD_STATE_OFFLINE)) {
28569 		return (ENXIO);
28570 	}
28571 
28572 #ifdef _MULTI_DATAMODEL
28573 	switch (ddi_model_convert_from(flag & FMODELS)) {
28574 	case DDI_MODEL_ILP32:
28575 		if (ddi_copyin(data, cdrd32, sizeof (*cdrd32), flag) != 0) {
28576 			return (EFAULT);
28577 		}
28578 		/* Convert the ILP32 uscsi data from the application to LP64 */
28579 		cdrom_read32tocdrom_read(cdrd32, mode2);
28580 		break;
28581 	case DDI_MODEL_NONE:
28582 		if (ddi_copyin(data, mode2, sizeof (*mode2), flag) != 0) {
28583 			return (EFAULT);
28584 		}
28585 		break;
28586 	}
28587 
28588 #else /* ! _MULTI_DATAMODEL */
28589 	if (ddi_copyin(data, mode2, sizeof (*mode2), flag) != 0) {
28590 		return (EFAULT);
28591 	}
28592 #endif /* _MULTI_DATAMODEL */
28593 
28594 	bzero(cdb, sizeof (cdb));
28595 	if (un->un_f_cfg_read_cd_xd4 == TRUE) {
28596 		/* Read command supported by 1st generation atapi drives */
28597 		cdb[0] = SCMD_READ_CDD4;
28598 	} else {
28599 		/* Universal CD Access Command */
28600 		cdb[0] = SCMD_READ_CD;
28601 	}
28602 
28603 	/*
28604 	 * Set expected sector type to: 2336s byte, Mode 2 Yellow Book
28605 	 */
28606 	cdb[1] = CDROM_SECTOR_TYPE_MODE2;
28607 
28608 	/* set the start address */
28609 	cdb[2] = (uchar_t)((mode2->cdread_lba >> 24) & 0XFF);
28610 	cdb[3] = (uchar_t)((mode2->cdread_lba >> 16) & 0XFF);
28611 	cdb[4] = (uchar_t)((mode2->cdread_lba >> 8) & 0xFF);
28612 	cdb[5] = (uchar_t)(mode2->cdread_lba & 0xFF);
28613 
28614 	/* set the transfer length */
28615 	nblocks = mode2->cdread_buflen / 2336;
28616 	cdb[6] = (uchar_t)(nblocks >> 16);
28617 	cdb[7] = (uchar_t)(nblocks >> 8);
28618 	cdb[8] = (uchar_t)nblocks;
28619 
28620 	/* set the filter bits */
28621 	cdb[9] = CDROM_READ_CD_USERDATA;
28622 
28623 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28624 	com->uscsi_cdb = (caddr_t)cdb;
28625 	com->uscsi_cdblen = sizeof (cdb);
28626 	com->uscsi_bufaddr = mode2->cdread_bufaddr;
28627 	com->uscsi_buflen = mode2->cdread_buflen;
28628 	com->uscsi_flags = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28629 
28630 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
28631 	    SD_PATH_STANDARD);
28632 	kmem_free(com, sizeof (*com));
28633 	return (rval);
28634 }
28635 
28636 
28637 /*
28638  *    Function: sr_read_mode2()
28639  *
28640  * Description: This routine is the driver entry point for handling CD-ROM
28641  *		ioctl read mode2 requests (CDROMREADMODE2) for devices that
28642  *		do not support the READ CD (0xBE) command.
28643  *
28644  *   Arguments: dev	- the device 'dev_t'
28645  *		data	- pointer to user provided cd read structure specifying
28646  *			  the lba buffer address and length.
28647  *		flag	- this argument is a pass through to ddi_copyxxx()
28648  *			  directly from the mode argument of ioctl().
28649  *
28650  * Return Code: the code returned by sd_send_scsi_cmd()
28651  *		EFAULT if ddi_copyxxx() fails
28652  *		ENXIO if fail ddi_get_soft_state
28653  *		EINVAL if data pointer is NULL
28654  *		EIO if fail to reset block size
28655  *		EAGAIN if commands are in progress in the driver
28656  */
28657 
28658 static int
28659 sr_read_mode2(dev_t dev, caddr_t data, int flag)
28660 {
28661 	struct sd_lun		*un;
28662 	struct cdrom_read	mode2_struct;
28663 	struct cdrom_read	*mode2 = &mode2_struct;
28664 	int			rval;
28665 	uint32_t		restore_blksize;
28666 	struct uscsi_cmd	*com;
28667 	uchar_t			cdb[CDB_GROUP0];
28668 	int			nblocks;
28669 
28670 #ifdef _MULTI_DATAMODEL
28671 	/* To support ILP32 applications in an LP64 world */
28672 	struct cdrom_read32	cdrom_read32;
28673 	struct cdrom_read32	*cdrd32 = &cdrom_read32;
28674 #endif /* _MULTI_DATAMODEL */
28675 
28676 	if (data == NULL) {
28677 		return (EINVAL);
28678 	}
28679 
28680 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28681 	    (un->un_state == SD_STATE_OFFLINE)) {
28682 		return (ENXIO);
28683 	}
28684 
28685 	/*
28686 	 * Because this routine will update the device and driver block size
28687 	 * being used we want to make sure there are no commands in progress.
28688 	 * If commands are in progress the user will have to try again.
28689 	 *
28690 	 * We check for 1 instead of 0 because we increment un_ncmds_in_driver
28691 	 * in sdioctl to protect commands from sdioctl through to the top of
28692 	 * sd_uscsi_strategy. See sdioctl for details.
28693 	 */
28694 	mutex_enter(SD_MUTEX(un));
28695 	if (un->un_ncmds_in_driver != 1) {
28696 		mutex_exit(SD_MUTEX(un));
28697 		return (EAGAIN);
28698 	}
28699 	mutex_exit(SD_MUTEX(un));
28700 
28701 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
28702 	    "sd_read_mode2: entry: un:0x%p\n", un);
28703 
28704 #ifdef _MULTI_DATAMODEL
28705 	switch (ddi_model_convert_from(flag & FMODELS)) {
28706 	case DDI_MODEL_ILP32:
28707 		if (ddi_copyin(data, cdrd32, sizeof (*cdrd32), flag) != 0) {
28708 			return (EFAULT);
28709 		}
28710 		/* Convert the ILP32 uscsi data from the application to LP64 */
28711 		cdrom_read32tocdrom_read(cdrd32, mode2);
28712 		break;
28713 	case DDI_MODEL_NONE:
28714 		if (ddi_copyin(data, mode2, sizeof (*mode2), flag) != 0) {
28715 			return (EFAULT);
28716 		}
28717 		break;
28718 	}
28719 #else /* ! _MULTI_DATAMODEL */
28720 	if (ddi_copyin(data, mode2, sizeof (*mode2), flag)) {
28721 		return (EFAULT);
28722 	}
28723 #endif /* _MULTI_DATAMODEL */
28724 
28725 	/* Store the current target block size for restoration later */
28726 	restore_blksize = un->un_tgt_blocksize;
28727 
28728 	/* Change the device and soft state target block size to 2336 */
28729 	if (sr_sector_mode(dev, SD_MODE2_BLKSIZE) != 0) {
28730 		rval = EIO;
28731 		goto done;
28732 	}
28733 
28734 
28735 	bzero(cdb, sizeof (cdb));
28736 
28737 	/* set READ operation */
28738 	cdb[0] = SCMD_READ;
28739 
28740 	/* adjust lba for 2kbyte blocks from 512 byte blocks */
28741 	mode2->cdread_lba >>= 2;
28742 
28743 	/* set the start address */
28744 	cdb[1] = (uchar_t)((mode2->cdread_lba >> 16) & 0X1F);
28745 	cdb[2] = (uchar_t)((mode2->cdread_lba >> 8) & 0xFF);
28746 	cdb[3] = (uchar_t)(mode2->cdread_lba & 0xFF);
28747 
28748 	/* set the transfer length */
28749 	nblocks = mode2->cdread_buflen / 2336;
28750 	cdb[4] = (uchar_t)nblocks & 0xFF;
28751 
28752 	/* build command */
28753 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28754 	com->uscsi_cdb = (caddr_t)cdb;
28755 	com->uscsi_cdblen = sizeof (cdb);
28756 	com->uscsi_bufaddr = mode2->cdread_bufaddr;
28757 	com->uscsi_buflen = mode2->cdread_buflen;
28758 	com->uscsi_flags = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28759 
28760 	/*
28761 	 * Issue SCSI command with user space address for read buffer.
28762 	 *
28763 	 * This sends the command through main channel in the driver.
28764 	 *
28765 	 * Since this is accessed via an IOCTL call, we go through the
28766 	 * standard path, so that if the device was powered down, then
28767 	 * it would be 'awakened' to handle the command.
28768 	 */
28769 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
28770 	    SD_PATH_STANDARD);
28771 
28772 	kmem_free(com, sizeof (*com));
28773 
28774 	/* Restore the device and soft state target block size */
28775 	if (sr_sector_mode(dev, restore_blksize) != 0) {
28776 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28777 		    "can't do switch back to mode 1\n");
28778 		/*
28779 		 * If sd_send_scsi_READ succeeded we still need to report
28780 		 * an error because we failed to reset the block size
28781 		 */
28782 		if (rval == 0) {
28783 			rval = EIO;
28784 		}
28785 	}
28786 
28787 done:
28788 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
28789 	    "sd_read_mode2: exit: un:0x%p\n", un);
28790 
28791 	return (rval);
28792 }
28793 
28794 
28795 /*
28796  *    Function: sr_sector_mode()
28797  *
28798  * Description: This utility function is used by sr_read_mode2 to set the target
28799  *		block size based on the user specified size. This is a legacy
28800  *		implementation based upon a vendor specific mode page
28801  *
28802  *   Arguments: dev	- the device 'dev_t'
28803  *		data	- flag indicating if block size is being set to 2336 or
28804  *			  512.
28805  *
28806  * Return Code: the code returned by sd_send_scsi_cmd()
28807  *		EFAULT if ddi_copyxxx() fails
28808  *		ENXIO if fail ddi_get_soft_state
28809  *		EINVAL if data pointer is NULL
28810  */
28811 
28812 static int
28813 sr_sector_mode(dev_t dev, uint32_t blksize)
28814 {
28815 	struct sd_lun	*un;
28816 	uchar_t		*sense;
28817 	uchar_t		*select;
28818 	int		rval;
28819 	sd_ssc_t	*ssc;
28820 
28821 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28822 	    (un->un_state == SD_STATE_OFFLINE)) {
28823 		return (ENXIO);
28824 	}
28825 
28826 	sense = kmem_zalloc(20, KM_SLEEP);
28827 
28828 	/* Note: This is a vendor specific mode page (0x81) */
28829 	ssc = sd_ssc_init(un);
28830 	rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense, 20, 0x81,
28831 	    SD_PATH_STANDARD);
28832 	sd_ssc_fini(ssc);
28833 	if (rval != 0) {
28834 		SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un,
28835 		    "sr_sector_mode: Mode Sense failed\n");
28836 		kmem_free(sense, 20);
28837 		return (rval);
28838 	}
28839 	select = kmem_zalloc(20, KM_SLEEP);
28840 	select[3] = 0x08;
28841 	select[10] = ((blksize >> 8) & 0xff);
28842 	select[11] = (blksize & 0xff);
28843 	select[12] = 0x01;
28844 	select[13] = 0x06;
28845 	select[14] = sense[14];
28846 	select[15] = sense[15];
28847 	if (blksize == SD_MODE2_BLKSIZE) {
28848 		select[14] |= 0x01;
28849 	}
28850 
28851 	ssc = sd_ssc_init(un);
28852 	rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, select, 20,
28853 	    SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
28854 	sd_ssc_fini(ssc);
28855 	if (rval != 0) {
28856 		SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un,
28857 		    "sr_sector_mode: Mode Select failed\n");
28858 	} else {
28859 		/*
28860 		 * Only update the softstate block size if we successfully
28861 		 * changed the device block mode.
28862 		 */
28863 		mutex_enter(SD_MUTEX(un));
28864 		sd_update_block_info(un, blksize, 0);
28865 		mutex_exit(SD_MUTEX(un));
28866 	}
28867 	kmem_free(sense, 20);
28868 	kmem_free(select, 20);
28869 	return (rval);
28870 }
28871 
28872 
28873 /*
28874  *    Function: sr_read_cdda()
28875  *
28876  * Description: This routine is the driver entry point for handling CD-ROM
28877  *		ioctl requests to return CD-DA or subcode data. (CDROMCDDA) If
28878  *		the target supports CDDA these requests are handled via a vendor
28879  *		specific command (0xD8) If the target does not support CDDA
28880  *		these requests are handled via the READ CD command (0xBE).
28881  *
28882  *   Arguments: dev	- the device 'dev_t'
28883  *		data	- pointer to user provided CD-DA structure specifying
28884  *			  the track starting address, transfer length, and
28885  *			  subcode options.
28886  *		flag	- this argument is a pass through to ddi_copyxxx()
28887  *			  directly from the mode argument of ioctl().
28888  *
28889  * Return Code: the code returned by sd_send_scsi_cmd()
28890  *		EFAULT if ddi_copyxxx() fails
28891  *		ENXIO if fail ddi_get_soft_state
28892  *		EINVAL if invalid arguments are provided
28893  *		ENOTTY
28894  */
28895 
28896 static int
28897 sr_read_cdda(dev_t dev, caddr_t data, int flag)
28898 {
28899 	struct sd_lun			*un;
28900 	struct uscsi_cmd		*com;
28901 	struct cdrom_cdda		*cdda;
28902 	int				rval;
28903 	size_t				buflen;
28904 	char				cdb[CDB_GROUP5];
28905 
28906 #ifdef _MULTI_DATAMODEL
28907 	/* To support ILP32 applications in an LP64 world */
28908 	struct cdrom_cdda32	cdrom_cdda32;
28909 	struct cdrom_cdda32	*cdda32 = &cdrom_cdda32;
28910 #endif /* _MULTI_DATAMODEL */
28911 
28912 	if (data == NULL) {
28913 		return (EINVAL);
28914 	}
28915 
28916 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
28917 		return (ENXIO);
28918 	}
28919 
28920 	cdda = kmem_zalloc(sizeof (struct cdrom_cdda), KM_SLEEP);
28921 
28922 #ifdef _MULTI_DATAMODEL
28923 	switch (ddi_model_convert_from(flag & FMODELS)) {
28924 	case DDI_MODEL_ILP32:
28925 		if (ddi_copyin(data, cdda32, sizeof (*cdda32), flag)) {
28926 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28927 			    "sr_read_cdda: ddi_copyin Failed\n");
28928 			kmem_free(cdda, sizeof (struct cdrom_cdda));
28929 			return (EFAULT);
28930 		}
28931 		/* Convert the ILP32 uscsi data from the application to LP64 */
28932 		cdrom_cdda32tocdrom_cdda(cdda32, cdda);
28933 		break;
28934 	case DDI_MODEL_NONE:
28935 		if (ddi_copyin(data, cdda, sizeof (struct cdrom_cdda), flag)) {
28936 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28937 			    "sr_read_cdda: ddi_copyin Failed\n");
28938 			kmem_free(cdda, sizeof (struct cdrom_cdda));
28939 			return (EFAULT);
28940 		}
28941 		break;
28942 	}
28943 #else /* ! _MULTI_DATAMODEL */
28944 	if (ddi_copyin(data, cdda, sizeof (struct cdrom_cdda), flag)) {
28945 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28946 		    "sr_read_cdda: ddi_copyin Failed\n");
28947 		kmem_free(cdda, sizeof (struct cdrom_cdda));
28948 		return (EFAULT);
28949 	}
28950 #endif /* _MULTI_DATAMODEL */
28951 
28952 	/*
28953 	 * Since MMC-2 expects max 3 bytes for length, check if the
28954 	 * length input is greater than 3 bytes
28955 	 */
28956 	if ((cdda->cdda_length & 0xFF000000) != 0) {
28957 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN, "sr_read_cdda: "
28958 		    "cdrom transfer length too large: %d (limit %d)\n",
28959 		    cdda->cdda_length, 0xFFFFFF);
28960 		kmem_free(cdda, sizeof (struct cdrom_cdda));
28961 		return (EINVAL);
28962 	}
28963 
28964 	switch (cdda->cdda_subcode) {
28965 	case CDROM_DA_NO_SUBCODE:
28966 		buflen = CDROM_BLK_2352 * cdda->cdda_length;
28967 		break;
28968 	case CDROM_DA_SUBQ:
28969 		buflen = CDROM_BLK_2368 * cdda->cdda_length;
28970 		break;
28971 	case CDROM_DA_ALL_SUBCODE:
28972 		buflen = CDROM_BLK_2448 * cdda->cdda_length;
28973 		break;
28974 	case CDROM_DA_SUBCODE_ONLY:
28975 		buflen = CDROM_BLK_SUBCODE * cdda->cdda_length;
28976 		break;
28977 	default:
28978 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28979 		    "sr_read_cdda: Subcode '0x%x' Not Supported\n",
28980 		    cdda->cdda_subcode);
28981 		kmem_free(cdda, sizeof (struct cdrom_cdda));
28982 		return (EINVAL);
28983 	}
28984 
28985 	/* Build and send the command */
28986 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28987 	bzero(cdb, CDB_GROUP5);
28988 
28989 	if (un->un_f_cfg_cdda == TRUE) {
28990 		cdb[0] = (char)SCMD_READ_CD;
28991 		cdb[1] = 0x04;
28992 		cdb[2] = (((cdda->cdda_addr) & 0xff000000) >> 24);
28993 		cdb[3] = (((cdda->cdda_addr) & 0x00ff0000) >> 16);
28994 		cdb[4] = (((cdda->cdda_addr) & 0x0000ff00) >> 8);
28995 		cdb[5] = ((cdda->cdda_addr) & 0x000000ff);
28996 		cdb[6] = (((cdda->cdda_length) & 0x00ff0000) >> 16);
28997 		cdb[7] = (((cdda->cdda_length) & 0x0000ff00) >> 8);
28998 		cdb[8] = ((cdda->cdda_length) & 0x000000ff);
28999 		cdb[9] = 0x10;
29000 		switch (cdda->cdda_subcode) {
29001 		case CDROM_DA_NO_SUBCODE :
29002 			cdb[10] = 0x0;
29003 			break;
29004 		case CDROM_DA_SUBQ :
29005 			cdb[10] = 0x2;
29006 			break;
29007 		case CDROM_DA_ALL_SUBCODE :
29008 			cdb[10] = 0x1;
29009 			break;
29010 		case CDROM_DA_SUBCODE_ONLY :
29011 			/* FALLTHROUGH */
29012 		default :
29013 			kmem_free(cdda, sizeof (struct cdrom_cdda));
29014 			kmem_free(com, sizeof (*com));
29015 			return (ENOTTY);
29016 		}
29017 	} else {
29018 		cdb[0] = (char)SCMD_READ_CDDA;
29019 		cdb[2] = (((cdda->cdda_addr) & 0xff000000) >> 24);
29020 		cdb[3] = (((cdda->cdda_addr) & 0x00ff0000) >> 16);
29021 		cdb[4] = (((cdda->cdda_addr) & 0x0000ff00) >> 8);
29022 		cdb[5] = ((cdda->cdda_addr) & 0x000000ff);
29023 		cdb[6] = (((cdda->cdda_length) & 0xff000000) >> 24);
29024 		cdb[7] = (((cdda->cdda_length) & 0x00ff0000) >> 16);
29025 		cdb[8] = (((cdda->cdda_length) & 0x0000ff00) >> 8);
29026 		cdb[9] = ((cdda->cdda_length) & 0x000000ff);
29027 		cdb[10] = cdda->cdda_subcode;
29028 	}
29029 
29030 	com->uscsi_cdb = cdb;
29031 	com->uscsi_cdblen = CDB_GROUP5;
29032 	com->uscsi_bufaddr = (caddr_t)cdda->cdda_data;
29033 	com->uscsi_buflen = buflen;
29034 	com->uscsi_flags = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
29035 
29036 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
29037 	    SD_PATH_STANDARD);
29038 
29039 	kmem_free(cdda, sizeof (struct cdrom_cdda));
29040 	kmem_free(com, sizeof (*com));
29041 	return (rval);
29042 }
29043 
29044 
29045 /*
29046  *    Function: sr_read_cdxa()
29047  *
29048  * Description: This routine is the driver entry point for handling CD-ROM
29049  *		ioctl requests to return CD-XA (Extended Architecture) data.
29050  *		(CDROMCDXA).
29051  *
29052  *   Arguments: dev	- the device 'dev_t'
29053  *		data	- pointer to user provided CD-XA structure specifying
29054  *			  the data starting address, transfer length, and format
29055  *		flag	- this argument is a pass through to ddi_copyxxx()
29056  *			  directly from the mode argument of ioctl().
29057  *
29058  * Return Code: the code returned by sd_send_scsi_cmd()
29059  *		EFAULT if ddi_copyxxx() fails
29060  *		ENXIO if fail ddi_get_soft_state
29061  *		EINVAL if data pointer is NULL
29062  */
29063 
29064 static int
29065 sr_read_cdxa(dev_t dev, caddr_t data, int flag)
29066 {
29067 	struct sd_lun		*un;
29068 	struct uscsi_cmd	*com;
29069 	struct cdrom_cdxa	*cdxa;
29070 	int			rval;
29071 	size_t			buflen;
29072 	char			cdb[CDB_GROUP5];
29073 	uchar_t			read_flags;
29074 
29075 #ifdef _MULTI_DATAMODEL
29076 	/* To support ILP32 applications in an LP64 world */
29077 	struct cdrom_cdxa32		cdrom_cdxa32;
29078 	struct cdrom_cdxa32		*cdxa32 = &cdrom_cdxa32;
29079 #endif /* _MULTI_DATAMODEL */
29080 
29081 	if (data == NULL) {
29082 		return (EINVAL);
29083 	}
29084 
29085 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
29086 		return (ENXIO);
29087 	}
29088 
29089 	cdxa = kmem_zalloc(sizeof (struct cdrom_cdxa), KM_SLEEP);
29090 
29091 #ifdef _MULTI_DATAMODEL
29092 	switch (ddi_model_convert_from(flag & FMODELS)) {
29093 	case DDI_MODEL_ILP32:
29094 		if (ddi_copyin(data, cdxa32, sizeof (*cdxa32), flag)) {
29095 			kmem_free(cdxa, sizeof (struct cdrom_cdxa));
29096 			return (EFAULT);
29097 		}
29098 		/*
29099 		 * Convert the ILP32 uscsi data from the
29100 		 * application to LP64 for internal use.
29101 		 */
29102 		cdrom_cdxa32tocdrom_cdxa(cdxa32, cdxa);
29103 		break;
29104 	case DDI_MODEL_NONE:
29105 		if (ddi_copyin(data, cdxa, sizeof (struct cdrom_cdxa), flag)) {
29106 			kmem_free(cdxa, sizeof (struct cdrom_cdxa));
29107 			return (EFAULT);
29108 		}
29109 		break;
29110 	}
29111 #else /* ! _MULTI_DATAMODEL */
29112 	if (ddi_copyin(data, cdxa, sizeof (struct cdrom_cdxa), flag)) {
29113 		kmem_free(cdxa, sizeof (struct cdrom_cdxa));
29114 		return (EFAULT);
29115 	}
29116 #endif /* _MULTI_DATAMODEL */
29117 
29118 	/*
29119 	 * Since MMC-2 expects max 3 bytes for length, check if the
29120 	 * length input is greater than 3 bytes
29121 	 */
29122 	if ((cdxa->cdxa_length & 0xFF000000) != 0) {
29123 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN, "sr_read_cdxa: "
29124 		    "cdrom transfer length too large: %d (limit %d)\n",
29125 		    cdxa->cdxa_length, 0xFFFFFF);
29126 		kmem_free(cdxa, sizeof (struct cdrom_cdxa));
29127 		return (EINVAL);
29128 	}
29129 
29130 	switch (cdxa->cdxa_format) {
29131 	case CDROM_XA_DATA:
29132 		buflen = CDROM_BLK_2048 * cdxa->cdxa_length;
29133 		read_flags = 0x10;
29134 		break;
29135 	case CDROM_XA_SECTOR_DATA:
29136 		buflen = CDROM_BLK_2352 * cdxa->cdxa_length;
29137 		read_flags = 0xf8;
29138 		break;
29139 	case CDROM_XA_DATA_W_ERROR:
29140 		buflen = CDROM_BLK_2646 * cdxa->cdxa_length;
29141 		read_flags = 0xfc;
29142 		break;
29143 	default:
29144 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
29145 		    "sr_read_cdxa: Format '0x%x' Not Supported\n",
29146 		    cdxa->cdxa_format);
29147 		kmem_free(cdxa, sizeof (struct cdrom_cdxa));
29148 		return (EINVAL);
29149 	}
29150 
29151 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
29152 	bzero(cdb, CDB_GROUP5);
29153 	if (un->un_f_mmc_cap == TRUE) {
29154 		cdb[0] = (char)SCMD_READ_CD;
29155 		cdb[2] = (((cdxa->cdxa_addr) & 0xff000000) >> 24);
29156 		cdb[3] = (((cdxa->cdxa_addr) & 0x00ff0000) >> 16);
29157 		cdb[4] = (((cdxa->cdxa_addr) & 0x0000ff00) >> 8);
29158 		cdb[5] = ((cdxa->cdxa_addr) & 0x000000ff);
29159 		cdb[6] = (((cdxa->cdxa_length) & 0x00ff0000) >> 16);
29160 		cdb[7] = (((cdxa->cdxa_length) & 0x0000ff00) >> 8);
29161 		cdb[8] = ((cdxa->cdxa_length) & 0x000000ff);
29162 		cdb[9] = (char)read_flags;
29163 	} else {
29164 		/*
29165 		 * Note: A vendor specific command (0xDB) is being used her to
29166 		 * request a read of all subcodes.
29167 		 */
29168 		cdb[0] = (char)SCMD_READ_CDXA;
29169 		cdb[2] = (((cdxa->cdxa_addr) & 0xff000000) >> 24);
29170 		cdb[3] = (((cdxa->cdxa_addr) & 0x00ff0000) >> 16);
29171 		cdb[4] = (((cdxa->cdxa_addr) & 0x0000ff00) >> 8);
29172 		cdb[5] = ((cdxa->cdxa_addr) & 0x000000ff);
29173 		cdb[6] = (((cdxa->cdxa_length) & 0xff000000) >> 24);
29174 		cdb[7] = (((cdxa->cdxa_length) & 0x00ff0000) >> 16);
29175 		cdb[8] = (((cdxa->cdxa_length) & 0x0000ff00) >> 8);
29176 		cdb[9] = ((cdxa->cdxa_length) & 0x000000ff);
29177 		cdb[10] = cdxa->cdxa_format;
29178 	}
29179 	com->uscsi_cdb	   = cdb;
29180 	com->uscsi_cdblen  = CDB_GROUP5;
29181 	com->uscsi_bufaddr = (caddr_t)cdxa->cdxa_data;
29182 	com->uscsi_buflen  = buflen;
29183 	com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
29184 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
29185 	    SD_PATH_STANDARD);
29186 	kmem_free(cdxa, sizeof (struct cdrom_cdxa));
29187 	kmem_free(com, sizeof (*com));
29188 	return (rval);
29189 }
29190 
29191 
29192 /*
29193  *    Function: sr_eject()
29194  *
29195  * Description: This routine is the driver entry point for handling CD-ROM
29196  *		eject ioctl requests (FDEJECT, DKIOCEJECT, CDROMEJECT)
29197  *
29198  *   Arguments: dev	- the device 'dev_t'
29199  *
29200  * Return Code: the code returned by sd_send_scsi_cmd()
29201  */
29202 
29203 static int
29204 sr_eject(dev_t dev)
29205 {
29206 	struct sd_lun	*un;
29207 	int		rval;
29208 	sd_ssc_t	*ssc;
29209 
29210 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
29211 	    (un->un_state == SD_STATE_OFFLINE)) {
29212 		return (ENXIO);
29213 	}
29214 
29215 	/*
29216 	 * To prevent race conditions with the eject
29217 	 * command, keep track of an eject command as
29218 	 * it progresses. If we are already handling
29219 	 * an eject command in the driver for the given
29220 	 * unit and another request to eject is received
29221 	 * immediately return EAGAIN so we don't lose
29222 	 * the command if the current eject command fails.
29223 	 */
29224 	mutex_enter(SD_MUTEX(un));
29225 	if (un->un_f_ejecting == TRUE) {
29226 		mutex_exit(SD_MUTEX(un));
29227 		return (EAGAIN);
29228 	}
29229 	un->un_f_ejecting = TRUE;
29230 	mutex_exit(SD_MUTEX(un));
29231 
29232 	ssc = sd_ssc_init(un);
29233 	rval = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_ALLOW,
29234 	    SD_PATH_STANDARD);
29235 	sd_ssc_fini(ssc);
29236 
29237 	if (rval != 0) {
29238 		mutex_enter(SD_MUTEX(un));
29239 		un->un_f_ejecting = FALSE;
29240 		mutex_exit(SD_MUTEX(un));
29241 		return (rval);
29242 	}
29243 
29244 	ssc = sd_ssc_init(un);
29245 	rval = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
29246 	    SD_TARGET_EJECT, SD_PATH_STANDARD);
29247 	sd_ssc_fini(ssc);
29248 
29249 	if (rval == 0) {
29250 		mutex_enter(SD_MUTEX(un));
29251 		sr_ejected(un);
29252 		un->un_mediastate = DKIO_EJECTED;
29253 		un->un_f_ejecting = FALSE;
29254 		cv_broadcast(&un->un_state_cv);
29255 		mutex_exit(SD_MUTEX(un));
29256 	} else {
29257 		mutex_enter(SD_MUTEX(un));
29258 		un->un_f_ejecting = FALSE;
29259 		mutex_exit(SD_MUTEX(un));
29260 	}
29261 	return (rval);
29262 }
29263 
29264 
29265 /*
29266  *    Function: sr_ejected()
29267  *
29268  * Description: This routine updates the soft state structure to invalidate the
29269  *		geometry information after the media has been ejected or a
29270  *		media eject has been detected.
29271  *
29272  *   Arguments: un - driver soft state (unit) structure
29273  */
29274 
29275 static void
29276 sr_ejected(struct sd_lun *un)
29277 {
29278 	struct sd_errstats *stp;
29279 
29280 	ASSERT(un != NULL);
29281 	ASSERT(mutex_owned(SD_MUTEX(un)));
29282 
29283 	un->un_f_blockcount_is_valid	= FALSE;
29284 	un->un_f_tgt_blocksize_is_valid	= FALSE;
29285 	mutex_exit(SD_MUTEX(un));
29286 	cmlb_invalidate(un->un_cmlbhandle, (void *)SD_PATH_DIRECT_PRIORITY);
29287 	mutex_enter(SD_MUTEX(un));
29288 
29289 	if (un->un_errstats != NULL) {
29290 		stp = (struct sd_errstats *)un->un_errstats->ks_data;
29291 		stp->sd_capacity.value.ui64 = 0;
29292 	}
29293 }
29294 
29295 
29296 /*
29297  *    Function: sr_check_wp()
29298  *
29299  * Description: This routine checks the write protection of a removable
29300  *      media disk and hotpluggable devices via the write protect bit of
29301  *      the Mode Page Header device specific field. Some devices choke
29302  *      on unsupported mode page. In order to workaround this issue,
29303  *      this routine has been implemented to use 0x3f mode page(request
29304  *      for all pages) for all device types.
29305  *
29306  *   Arguments: dev             - the device 'dev_t'
29307  *
29308  * Return Code: int indicating if the device is write protected (1) or not (0)
29309  *
29310  *     Context: Kernel thread.
29311  *
29312  */
29313 
29314 static int
29315 sr_check_wp(dev_t dev)
29316 {
29317 	struct sd_lun	*un;
29318 	uchar_t		device_specific;
29319 	uchar_t		*sense;
29320 	int		hdrlen;
29321 	int		rval = FALSE;
29322 	int		status;
29323 	sd_ssc_t	*ssc;
29324 
29325 	/*
29326 	 * Note: The return codes for this routine should be reworked to
29327 	 * properly handle the case of a NULL softstate.
29328 	 */
29329 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
29330 		return (FALSE);
29331 	}
29332 
29333 	if (un->un_f_cfg_is_atapi == TRUE) {
29334 		/*
29335 		 * The mode page contents are not required; set the allocation
29336 		 * length for the mode page header only
29337 		 */
29338 		hdrlen = MODE_HEADER_LENGTH_GRP2;
29339 		sense = kmem_zalloc(hdrlen, KM_SLEEP);
29340 		ssc = sd_ssc_init(un);
29341 		status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, sense, hdrlen,
29342 		    MODEPAGE_ALLPAGES, SD_PATH_STANDARD);
29343 		sd_ssc_fini(ssc);
29344 		if (status != 0)
29345 			goto err_exit;
29346 		device_specific =
29347 		    ((struct mode_header_grp2 *)sense)->device_specific;
29348 	} else {
29349 		hdrlen = MODE_HEADER_LENGTH;
29350 		sense = kmem_zalloc(hdrlen, KM_SLEEP);
29351 		ssc = sd_ssc_init(un);
29352 		status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense, hdrlen,
29353 		    MODEPAGE_ALLPAGES, SD_PATH_STANDARD);
29354 		sd_ssc_fini(ssc);
29355 		if (status != 0)
29356 			goto err_exit;
29357 		device_specific =
29358 		    ((struct mode_header *)sense)->device_specific;
29359 	}
29360 
29361 
29362 	/*
29363 	 * Write protect mode sense failed; not all disks
29364 	 * understand this query. Return FALSE assuming that
29365 	 * these devices are not writable.
29366 	 */
29367 	if (device_specific & WRITE_PROTECT) {
29368 		rval = TRUE;
29369 	}
29370 
29371 err_exit:
29372 	kmem_free(sense, hdrlen);
29373 	return (rval);
29374 }
29375 
29376 /*
29377  *    Function: sr_volume_ctrl()
29378  *
29379  * Description: This routine is the driver entry point for handling CD-ROM
29380  *		audio output volume ioctl requests. (CDROMVOLCTRL)
29381  *
29382  *   Arguments: dev	- the device 'dev_t'
29383  *		data	- pointer to user audio volume control structure
29384  *		flag	- this argument is a pass through to ddi_copyxxx()
29385  *			  directly from the mode argument of ioctl().
29386  *
29387  * Return Code: the code returned by sd_send_scsi_cmd()
29388  *		EFAULT if ddi_copyxxx() fails
29389  *		ENXIO if fail ddi_get_soft_state
29390  *		EINVAL if data pointer is NULL
29391  *
29392  */
29393 
29394 static int
29395 sr_volume_ctrl(dev_t dev, caddr_t data, int flag)
29396 {
29397 	struct sd_lun		*un;
29398 	struct cdrom_volctrl    volume;
29399 	struct cdrom_volctrl    *vol = &volume;
29400 	uchar_t			*sense_page;
29401 	uchar_t			*select_page;
29402 	uchar_t			*sense;
29403 	uchar_t			*select;
29404 	int			sense_buflen;
29405 	int			select_buflen;
29406 	int			rval;
29407 	sd_ssc_t		*ssc;
29408 
29409 	if (data == NULL) {
29410 		return (EINVAL);
29411 	}
29412 
29413 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
29414 	    (un->un_state == SD_STATE_OFFLINE)) {
29415 		return (ENXIO);
29416 	}
29417 
29418 	if (ddi_copyin(data, vol, sizeof (struct cdrom_volctrl), flag)) {
29419 		return (EFAULT);
29420 	}
29421 
29422 	if ((un->un_f_cfg_is_atapi == TRUE) || (un->un_f_mmc_cap == TRUE)) {
29423 		struct mode_header_grp2		*sense_mhp;
29424 		struct mode_header_grp2		*select_mhp;
29425 		int				bd_len;
29426 
29427 		sense_buflen = MODE_PARAM_LENGTH_GRP2 + MODEPAGE_AUDIO_CTRL_LEN;
29428 		select_buflen = MODE_HEADER_LENGTH_GRP2 +
29429 		    MODEPAGE_AUDIO_CTRL_LEN;
29430 		sense  = kmem_zalloc(sense_buflen, KM_SLEEP);
29431 		select = kmem_zalloc(select_buflen, KM_SLEEP);
29432 		ssc = sd_ssc_init(un);
29433 		rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, sense,
29434 		    sense_buflen, MODEPAGE_AUDIO_CTRL,
29435 		    SD_PATH_STANDARD);
29436 		sd_ssc_fini(ssc);
29437 
29438 		if (rval != 0) {
29439 			SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un,
29440 			    "sr_volume_ctrl: Mode Sense Failed\n");
29441 			kmem_free(sense, sense_buflen);
29442 			kmem_free(select, select_buflen);
29443 			return (rval);
29444 		}
29445 		sense_mhp = (struct mode_header_grp2 *)sense;
29446 		select_mhp = (struct mode_header_grp2 *)select;
29447 		bd_len = (sense_mhp->bdesc_length_hi << 8) |
29448 		    sense_mhp->bdesc_length_lo;
29449 		if (bd_len > MODE_BLK_DESC_LENGTH) {
29450 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
29451 			    "sr_volume_ctrl: Mode Sense returned invalid "
29452 			    "block descriptor length\n");
29453 			kmem_free(sense, sense_buflen);
29454 			kmem_free(select, select_buflen);
29455 			return (EIO);
29456 		}
29457 		sense_page = (uchar_t *)
29458 		    (sense + MODE_HEADER_LENGTH_GRP2 + bd_len);
29459 		select_page = (uchar_t *)(select + MODE_HEADER_LENGTH_GRP2);
29460 		select_mhp->length_msb = 0;
29461 		select_mhp->length_lsb = 0;
29462 		select_mhp->bdesc_length_hi = 0;
29463 		select_mhp->bdesc_length_lo = 0;
29464 	} else {
29465 		struct mode_header		*sense_mhp, *select_mhp;
29466 
29467 		sense_buflen = MODE_PARAM_LENGTH + MODEPAGE_AUDIO_CTRL_LEN;
29468 		select_buflen = MODE_HEADER_LENGTH + MODEPAGE_AUDIO_CTRL_LEN;
29469 		sense  = kmem_zalloc(sense_buflen, KM_SLEEP);
29470 		select = kmem_zalloc(select_buflen, KM_SLEEP);
29471 		ssc = sd_ssc_init(un);
29472 		rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense,
29473 		    sense_buflen, MODEPAGE_AUDIO_CTRL,
29474 		    SD_PATH_STANDARD);
29475 		sd_ssc_fini(ssc);
29476 
29477 		if (rval != 0) {
29478 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
29479 			    "sr_volume_ctrl: Mode Sense Failed\n");
29480 			kmem_free(sense, sense_buflen);
29481 			kmem_free(select, select_buflen);
29482 			return (rval);
29483 		}
29484 		sense_mhp  = (struct mode_header *)sense;
29485 		select_mhp = (struct mode_header *)select;
29486 		if (sense_mhp->bdesc_length > MODE_BLK_DESC_LENGTH) {
29487 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
29488 			    "sr_volume_ctrl: Mode Sense returned invalid "
29489 			    "block descriptor length\n");
29490 			kmem_free(sense, sense_buflen);
29491 			kmem_free(select, select_buflen);
29492 			return (EIO);
29493 		}
29494 		sense_page = (uchar_t *)
29495 		    (sense + MODE_HEADER_LENGTH + sense_mhp->bdesc_length);
29496 		select_page = (uchar_t *)(select + MODE_HEADER_LENGTH);
29497 		select_mhp->length = 0;
29498 		select_mhp->bdesc_length = 0;
29499 	}
29500 	/*
29501 	 * Note: An audio control data structure could be created and overlayed
29502 	 * on the following in place of the array indexing method implemented.
29503 	 */
29504 
29505 	/* Build the select data for the user volume data */
29506 	select_page[0] = MODEPAGE_AUDIO_CTRL;
29507 	select_page[1] = 0xE;
29508 	/* Set the immediate bit */
29509 	select_page[2] = 0x04;
29510 	/* Zero out reserved fields */
29511 	select_page[3] = 0x00;
29512 	select_page[4] = 0x00;
29513 	/* Return sense data for fields not to be modified */
29514 	select_page[5] = sense_page[5];
29515 	select_page[6] = sense_page[6];
29516 	select_page[7] = sense_page[7];
29517 	/* Set the user specified volume levels for channel 0 and 1 */
29518 	select_page[8] = 0x01;
29519 	select_page[9] = vol->channel0;
29520 	select_page[10] = 0x02;
29521 	select_page[11] = vol->channel1;
29522 	/* Channel 2 and 3 are currently unsupported so return the sense data */
29523 	select_page[12] = sense_page[12];
29524 	select_page[13] = sense_page[13];
29525 	select_page[14] = sense_page[14];
29526 	select_page[15] = sense_page[15];
29527 
29528 	ssc = sd_ssc_init(un);
29529 	if ((un->un_f_cfg_is_atapi == TRUE) || (un->un_f_mmc_cap == TRUE)) {
29530 		rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP1, select,
29531 		    select_buflen, SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
29532 	} else {
29533 		rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, select,
29534 		    select_buflen, SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
29535 	}
29536 	sd_ssc_fini(ssc);
29537 
29538 	kmem_free(sense, sense_buflen);
29539 	kmem_free(select, select_buflen);
29540 	return (rval);
29541 }
29542 
29543 
29544 /*
29545  *    Function: sr_read_sony_session_offset()
29546  *
29547  * Description: This routine is the driver entry point for handling CD-ROM
29548  *		ioctl requests for session offset information. (CDROMREADOFFSET)
29549  *		The address of the first track in the last session of a
29550  *		multi-session CD-ROM is returned
29551  *
29552  *		Note: This routine uses a vendor specific key value in the
29553  *		command control field without implementing any vendor check here
29554  *		or in the ioctl routine.
29555  *
29556  *   Arguments: dev	- the device 'dev_t'
29557  *		data	- pointer to an int to hold the requested address
29558  *		flag	- this argument is a pass through to ddi_copyxxx()
29559  *			  directly from the mode argument of ioctl().
29560  *
29561  * Return Code: the code returned by sd_send_scsi_cmd()
29562  *		EFAULT if ddi_copyxxx() fails
29563  *		ENXIO if fail ddi_get_soft_state
29564  *		EINVAL if data pointer is NULL
29565  */
29566 
29567 static int
29568 sr_read_sony_session_offset(dev_t dev, caddr_t data, int flag)
29569 {
29570 	struct sd_lun		*un;
29571 	struct uscsi_cmd	*com;
29572 	caddr_t			buffer;
29573 	char			cdb[CDB_GROUP1];
29574 	int			session_offset = 0;
29575 	int			rval;
29576 
29577 	if (data == NULL) {
29578 		return (EINVAL);
29579 	}
29580 
29581 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
29582 	    (un->un_state == SD_STATE_OFFLINE)) {
29583 		return (ENXIO);
29584 	}
29585 
29586 	buffer = kmem_zalloc((size_t)SONY_SESSION_OFFSET_LEN, KM_SLEEP);
29587 	bzero(cdb, CDB_GROUP1);
29588 	cdb[0] = SCMD_READ_TOC;
29589 	/*
29590 	 * Bytes 7 & 8 are the 12 byte allocation length for a single entry.
29591 	 * (4 byte TOC response header + 8 byte response data)
29592 	 */
29593 	cdb[8] = SONY_SESSION_OFFSET_LEN;
29594 	/* Byte 9 is the control byte. A vendor specific value is used */
29595 	cdb[9] = SONY_SESSION_OFFSET_KEY;
29596 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
29597 	com->uscsi_cdb = cdb;
29598 	com->uscsi_cdblen = CDB_GROUP1;
29599 	com->uscsi_bufaddr = buffer;
29600 	com->uscsi_buflen = SONY_SESSION_OFFSET_LEN;
29601 	com->uscsi_flags = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
29602 
29603 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
29604 	    SD_PATH_STANDARD);
29605 	if (rval != 0) {
29606 		kmem_free(buffer, SONY_SESSION_OFFSET_LEN);
29607 		kmem_free(com, sizeof (*com));
29608 		return (rval);
29609 	}
29610 	if (buffer[1] == SONY_SESSION_OFFSET_VALID) {
29611 		session_offset =
29612 		    ((uchar_t)buffer[8] << 24) + ((uchar_t)buffer[9] << 16) +
29613 		    ((uchar_t)buffer[10] << 8) + ((uchar_t)buffer[11]);
29614 		/*
29615 		 * Offset returned offset in current lbasize block's. Convert to
29616 		 * 2k block's to return to the user
29617 		 */
29618 		if (un->un_tgt_blocksize == CDROM_BLK_512) {
29619 			session_offset >>= 2;
29620 		} else if (un->un_tgt_blocksize == CDROM_BLK_1024) {
29621 			session_offset >>= 1;
29622 		}
29623 	}
29624 
29625 	if (ddi_copyout(&session_offset, data, sizeof (int), flag) != 0) {
29626 		rval = EFAULT;
29627 	}
29628 
29629 	kmem_free(buffer, SONY_SESSION_OFFSET_LEN);
29630 	kmem_free(com, sizeof (*com));
29631 	return (rval);
29632 }
29633 
29634 
29635 /*
29636  *    Function: sd_wm_cache_constructor()
29637  *
29638  * Description: Cache Constructor for the wmap cache for the read/modify/write
29639  *		devices.
29640  *
29641  *   Arguments: wm      - A pointer to the sd_w_map to be initialized.
29642  *		un	- sd_lun structure for the device.
29643  *		flag	- the km flags passed to constructor
29644  *
29645  * Return Code: 0 on success.
29646  *		-1 on failure.
29647  */
29648 
29649 /*ARGSUSED*/
29650 static int
29651 sd_wm_cache_constructor(void *wm, void *un, int flags)
29652 {
29653 	bzero(wm, sizeof (struct sd_w_map));
29654 	cv_init(&((struct sd_w_map *)wm)->wm_avail, NULL, CV_DRIVER, NULL);
29655 	return (0);
29656 }
29657 
29658 
29659 /*
29660  *    Function: sd_wm_cache_destructor()
29661  *
29662  * Description: Cache destructor for the wmap cache for the read/modify/write
29663  *		devices.
29664  *
29665  *   Arguments: wm      - A pointer to the sd_w_map to be initialized.
29666  *		un	- sd_lun structure for the device.
29667  */
29668 /*ARGSUSED*/
29669 static void
29670 sd_wm_cache_destructor(void *wm, void *un)
29671 {
29672 	cv_destroy(&((struct sd_w_map *)wm)->wm_avail);
29673 }
29674 
29675 
29676 /*
29677  *    Function: sd_range_lock()
29678  *
29679  * Description: Lock the range of blocks specified as parameter to ensure
29680  *		that read, modify write is atomic and no other i/o writes
29681  *		to the same location. The range is specified in terms
29682  *		of start and end blocks. Block numbers are the actual
29683  *		media block numbers and not system.
29684  *
29685  *   Arguments: un	- sd_lun structure for the device.
29686  *		startb - The starting block number
29687  *		endb - The end block number
29688  *		typ - type of i/o - simple/read_modify_write
29689  *
29690  * Return Code: wm  - pointer to the wmap structure.
29691  *
29692  *     Context: This routine can sleep.
29693  */
29694 
29695 static struct sd_w_map *
29696 sd_range_lock(struct sd_lun *un, daddr_t startb, daddr_t endb, ushort_t typ)
29697 {
29698 	struct sd_w_map *wmp = NULL;
29699 	struct sd_w_map *sl_wmp = NULL;
29700 	struct sd_w_map *tmp_wmp;
29701 	wm_state state = SD_WM_CHK_LIST;
29702 
29703 
29704 	ASSERT(un != NULL);
29705 	ASSERT(!mutex_owned(SD_MUTEX(un)));
29706 
29707 	mutex_enter(SD_MUTEX(un));
29708 
29709 	while (state != SD_WM_DONE) {
29710 
29711 		switch (state) {
29712 		case SD_WM_CHK_LIST:
29713 			/*
29714 			 * This is the starting state. Check the wmap list
29715 			 * to see if the range is currently available.
29716 			 */
29717 			if (!(typ & SD_WTYPE_RMW) && !(un->un_rmw_count)) {
29718 				/*
29719 				 * If this is a simple write and no rmw
29720 				 * i/o is pending then try to lock the
29721 				 * range as the range should be available.
29722 				 */
29723 				state = SD_WM_LOCK_RANGE;
29724 			} else {
29725 				tmp_wmp = sd_get_range(un, startb, endb);
29726 				if (tmp_wmp != NULL) {
29727 					if ((wmp != NULL) && ONLIST(un, wmp)) {
29728 						/*
29729 						 * Should not keep onlist wmps
29730 						 * while waiting this macro
29731 						 * will also do wmp = NULL;
29732 						 */
29733 						FREE_ONLIST_WMAP(un, wmp);
29734 					}
29735 					/*
29736 					 * sl_wmp is the wmap on which wait
29737 					 * is done, since the tmp_wmp points
29738 					 * to the inuse wmap, set sl_wmp to
29739 					 * tmp_wmp and change the state to sleep
29740 					 */
29741 					sl_wmp = tmp_wmp;
29742 					state = SD_WM_WAIT_MAP;
29743 				} else {
29744 					state = SD_WM_LOCK_RANGE;
29745 				}
29746 
29747 			}
29748 			break;
29749 
29750 		case SD_WM_LOCK_RANGE:
29751 			ASSERT(un->un_wm_cache);
29752 			/*
29753 			 * The range need to be locked, try to get a wmap.
29754 			 * First attempt it with NO_SLEEP, want to avoid a sleep
29755 			 * if possible as we will have to release the sd mutex
29756 			 * if we have to sleep.
29757 			 */
29758 			if (wmp == NULL)
29759 				wmp = kmem_cache_alloc(un->un_wm_cache,
29760 				    KM_NOSLEEP);
29761 			if (wmp == NULL) {
29762 				mutex_exit(SD_MUTEX(un));
29763 				_NOTE(DATA_READABLE_WITHOUT_LOCK
29764 				    (sd_lun::un_wm_cache))
29765 				wmp = kmem_cache_alloc(un->un_wm_cache,
29766 				    KM_SLEEP);
29767 				mutex_enter(SD_MUTEX(un));
29768 				/*
29769 				 * we released the mutex so recheck and go to
29770 				 * check list state.
29771 				 */
29772 				state = SD_WM_CHK_LIST;
29773 			} else {
29774 				/*
29775 				 * We exit out of state machine since we
29776 				 * have the wmap. Do the housekeeping first.
29777 				 * place the wmap on the wmap list if it is not
29778 				 * on it already and then set the state to done.
29779 				 */
29780 				wmp->wm_start = startb;
29781 				wmp->wm_end = endb;
29782 				wmp->wm_flags = typ | SD_WM_BUSY;
29783 				if (typ & SD_WTYPE_RMW) {
29784 					un->un_rmw_count++;
29785 				}
29786 				/*
29787 				 * If not already on the list then link
29788 				 */
29789 				if (!ONLIST(un, wmp)) {
29790 					wmp->wm_next = un->un_wm;
29791 					wmp->wm_prev = NULL;
29792 					if (wmp->wm_next)
29793 						wmp->wm_next->wm_prev = wmp;
29794 					un->un_wm = wmp;
29795 				}
29796 				state = SD_WM_DONE;
29797 			}
29798 			break;
29799 
29800 		case SD_WM_WAIT_MAP:
29801 			ASSERT(sl_wmp->wm_flags & SD_WM_BUSY);
29802 			/*
29803 			 * Wait is done on sl_wmp, which is set in the
29804 			 * check_list state.
29805 			 */
29806 			sl_wmp->wm_wanted_count++;
29807 			cv_wait(&sl_wmp->wm_avail, SD_MUTEX(un));
29808 			sl_wmp->wm_wanted_count--;
29809 			/*
29810 			 * We can reuse the memory from the completed sl_wmp
29811 			 * lock range for our new lock, but only if noone is
29812 			 * waiting for it.
29813 			 */
29814 			ASSERT(!(sl_wmp->wm_flags & SD_WM_BUSY));
29815 			if (sl_wmp->wm_wanted_count == 0) {
29816 				if (wmp != NULL) {
29817 					CHK_N_FREEWMP(un, wmp);
29818 				}
29819 				wmp = sl_wmp;
29820 			}
29821 			sl_wmp = NULL;
29822 			/*
29823 			 * After waking up, need to recheck for availability of
29824 			 * range.
29825 			 */
29826 			state = SD_WM_CHK_LIST;
29827 			break;
29828 
29829 		default:
29830 			panic("sd_range_lock: "
29831 			    "Unknown state %d in sd_range_lock", state);
29832 			/*NOTREACHED*/
29833 		} /* switch(state) */
29834 
29835 	} /* while(state != SD_WM_DONE) */
29836 
29837 	mutex_exit(SD_MUTEX(un));
29838 
29839 	ASSERT(wmp != NULL);
29840 
29841 	return (wmp);
29842 }
29843 
29844 
29845 /*
29846  *    Function: sd_get_range()
29847  *
29848  * Description: Find if there any overlapping I/O to this one
29849  *		Returns the write-map of 1st such I/O, NULL otherwise.
29850  *
29851  *   Arguments: un	- sd_lun structure for the device.
29852  *		startb - The starting block number
29853  *		endb - The end block number
29854  *
29855  * Return Code: wm  - pointer to the wmap structure.
29856  */
29857 
29858 static struct sd_w_map *
29859 sd_get_range(struct sd_lun *un, daddr_t startb, daddr_t endb)
29860 {
29861 	struct sd_w_map *wmp;
29862 
29863 	ASSERT(un != NULL);
29864 
29865 	for (wmp = un->un_wm; wmp != NULL; wmp = wmp->wm_next) {
29866 		if (!(wmp->wm_flags & SD_WM_BUSY)) {
29867 			continue;
29868 		}
29869 		if ((startb >= wmp->wm_start) && (startb <= wmp->wm_end)) {
29870 			break;
29871 		}
29872 		if ((endb >= wmp->wm_start) && (endb <= wmp->wm_end)) {
29873 			break;
29874 		}
29875 	}
29876 
29877 	return (wmp);
29878 }
29879 
29880 
29881 /*
29882  *    Function: sd_free_inlist_wmap()
29883  *
29884  * Description: Unlink and free a write map struct.
29885  *
29886  *   Arguments: un      - sd_lun structure for the device.
29887  *		wmp	- sd_w_map which needs to be unlinked.
29888  */
29889 
29890 static void
29891 sd_free_inlist_wmap(struct sd_lun *un, struct sd_w_map *wmp)
29892 {
29893 	ASSERT(un != NULL);
29894 
29895 	if (un->un_wm == wmp) {
29896 		un->un_wm = wmp->wm_next;
29897 	} else {
29898 		wmp->wm_prev->wm_next = wmp->wm_next;
29899 	}
29900 
29901 	if (wmp->wm_next) {
29902 		wmp->wm_next->wm_prev = wmp->wm_prev;
29903 	}
29904 
29905 	wmp->wm_next = wmp->wm_prev = NULL;
29906 
29907 	kmem_cache_free(un->un_wm_cache, wmp);
29908 }
29909 
29910 
29911 /*
29912  *    Function: sd_range_unlock()
29913  *
29914  * Description: Unlock the range locked by wm.
29915  *		Free write map if nobody else is waiting on it.
29916  *
29917  *   Arguments: un      - sd_lun structure for the device.
29918  *              wmp     - sd_w_map which needs to be unlinked.
29919  */
29920 
29921 static void
29922 sd_range_unlock(struct sd_lun *un, struct sd_w_map *wm)
29923 {
29924 	ASSERT(un != NULL);
29925 	ASSERT(wm != NULL);
29926 	ASSERT(!mutex_owned(SD_MUTEX(un)));
29927 
29928 	mutex_enter(SD_MUTEX(un));
29929 
29930 	if (wm->wm_flags & SD_WTYPE_RMW) {
29931 		un->un_rmw_count--;
29932 	}
29933 
29934 	if (wm->wm_wanted_count) {
29935 		wm->wm_flags = 0;
29936 		/*
29937 		 * Broadcast that the wmap is available now.
29938 		 */
29939 		cv_broadcast(&wm->wm_avail);
29940 	} else {
29941 		/*
29942 		 * If no one is waiting on the map, it should be free'ed.
29943 		 */
29944 		sd_free_inlist_wmap(un, wm);
29945 	}
29946 
29947 	mutex_exit(SD_MUTEX(un));
29948 }
29949 
29950 
29951 /*
29952  *    Function: sd_read_modify_write_task
29953  *
29954  * Description: Called from a taskq thread to initiate the write phase of
29955  *		a read-modify-write request.  This is used for targets where
29956  *		un->un_sys_blocksize != un->un_tgt_blocksize.
29957  *
29958  *   Arguments: arg - a pointer to the buf(9S) struct for the write command.
29959  *
29960  *     Context: Called under taskq thread context.
29961  */
29962 
29963 static void
29964 sd_read_modify_write_task(void *arg)
29965 {
29966 	struct sd_mapblocksize_info	*bsp;
29967 	struct buf	*bp;
29968 	struct sd_xbuf	*xp;
29969 	struct sd_lun	*un;
29970 
29971 	bp = arg;	/* The bp is given in arg */
29972 	ASSERT(bp != NULL);
29973 
29974 	/* Get the pointer to the layer-private data struct */
29975 	xp = SD_GET_XBUF(bp);
29976 	ASSERT(xp != NULL);
29977 	bsp = xp->xb_private;
29978 	ASSERT(bsp != NULL);
29979 
29980 	un = SD_GET_UN(bp);
29981 	ASSERT(un != NULL);
29982 	ASSERT(!mutex_owned(SD_MUTEX(un)));
29983 
29984 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
29985 	    "sd_read_modify_write_task: entry: buf:0x%p\n", bp);
29986 
29987 	/*
29988 	 * This is the write phase of a read-modify-write request, called
29989 	 * under the context of a taskq thread in response to the completion
29990 	 * of the read portion of the rmw request completing under interrupt
29991 	 * context. The write request must be sent from here down the iostart
29992 	 * chain as if it were being sent from sd_mapblocksize_iostart(), so
29993 	 * we use the layer index saved in the layer-private data area.
29994 	 */
29995 	SD_NEXT_IOSTART(bsp->mbs_layer_index, un, bp);
29996 
29997 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
29998 	    "sd_read_modify_write_task: exit: buf:0x%p\n", bp);
29999 }
30000 
30001 
30002 /*
30003  *    Function: sddump_do_read_of_rmw()
30004  *
30005  * Description: This routine will be called from sddump, If sddump is called
30006  *		with an I/O which not aligned on device blocksize boundary
30007  *		then the write has to be converted to read-modify-write.
30008  *		Do the read part here in order to keep sddump simple.
30009  *		Note - That the sd_mutex is held across the call to this
30010  *		routine.
30011  *
30012  *   Arguments: un	- sd_lun
30013  *		blkno	- block number in terms of media block size.
30014  *		nblk	- number of blocks.
30015  *		bpp	- pointer to pointer to the buf structure. On return
30016  *			from this function, *bpp points to the valid buffer
30017  *			to which the write has to be done.
30018  *
30019  * Return Code: 0 for success or errno-type return code
30020  */
30021 
30022 static int
30023 sddump_do_read_of_rmw(struct sd_lun *un, uint64_t blkno, uint64_t nblk,
30024     struct buf **bpp)
30025 {
30026 	int err;
30027 	int i;
30028 	int rval;
30029 	struct buf *bp;
30030 	struct scsi_pkt *pkt = NULL;
30031 	uint32_t target_blocksize;
30032 
30033 	ASSERT(un != NULL);
30034 	ASSERT(mutex_owned(SD_MUTEX(un)));
30035 
30036 	target_blocksize = un->un_tgt_blocksize;
30037 
30038 	mutex_exit(SD_MUTEX(un));
30039 
30040 	bp = scsi_alloc_consistent_buf(SD_ADDRESS(un), (struct buf *)NULL,
30041 	    (size_t)(nblk * target_blocksize), B_READ, NULL_FUNC, NULL);
30042 	if (bp == NULL) {
30043 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
30044 		    "no resources for dumping; giving up");
30045 		err = ENOMEM;
30046 		goto done;
30047 	}
30048 
30049 	rval = sd_setup_rw_pkt(un, &pkt, bp, 0, NULL_FUNC, NULL,
30050 	    blkno, nblk);
30051 	if (rval != 0) {
30052 		scsi_free_consistent_buf(bp);
30053 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
30054 		    "no resources for dumping; giving up");
30055 		err = ENOMEM;
30056 		goto done;
30057 	}
30058 
30059 	pkt->pkt_flags |= FLAG_NOINTR;
30060 
30061 	err = EIO;
30062 	for (i = 0; i < SD_NDUMP_RETRIES; i++) {
30063 
30064 		/*
30065 		 * Scsi_poll returns 0 (success) if the command completes and
30066 		 * the status block is STATUS_GOOD.  We should only check
30067 		 * errors if this condition is not true.  Even then we should
30068 		 * send our own request sense packet only if we have a check
30069 		 * condition and auto request sense has not been performed by
30070 		 * the hba.
30071 		 */
30072 		SD_TRACE(SD_LOG_DUMP, un, "sddump: sending read\n");
30073 
30074 		if ((sd_scsi_poll(un, pkt) == 0) && (pkt->pkt_resid == 0)) {
30075 			err = 0;
30076 			break;
30077 		}
30078 
30079 		/*
30080 		 * Check CMD_DEV_GONE 1st, give up if device is gone,
30081 		 * no need to read RQS data.
30082 		 */
30083 		if (pkt->pkt_reason == CMD_DEV_GONE) {
30084 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
30085 			    "Error while dumping state with rmw..."
30086 			    "Device is gone\n");
30087 			break;
30088 		}
30089 
30090 		if (SD_GET_PKT_STATUS(pkt) == STATUS_CHECK) {
30091 			SD_INFO(SD_LOG_DUMP, un,
30092 			    "sddump: read failed with CHECK, try # %d\n", i);
30093 			if (((pkt->pkt_state & STATE_ARQ_DONE) == 0)) {
30094 				(void) sd_send_polled_RQS(un);
30095 			}
30096 
30097 			continue;
30098 		}
30099 
30100 		if (SD_GET_PKT_STATUS(pkt) == STATUS_BUSY) {
30101 			int reset_retval = 0;
30102 
30103 			SD_INFO(SD_LOG_DUMP, un,
30104 			    "sddump: read failed with BUSY, try # %d\n", i);
30105 
30106 			if (un->un_f_lun_reset_enabled == TRUE) {
30107 				reset_retval = scsi_reset(SD_ADDRESS(un),
30108 				    RESET_LUN);
30109 			}
30110 			if (reset_retval == 0) {
30111 				(void) scsi_reset(SD_ADDRESS(un), RESET_TARGET);
30112 			}
30113 			(void) sd_send_polled_RQS(un);
30114 
30115 		} else {
30116 			SD_INFO(SD_LOG_DUMP, un,
30117 			    "sddump: read failed with 0x%x, try # %d\n",
30118 			    SD_GET_PKT_STATUS(pkt), i);
30119 			mutex_enter(SD_MUTEX(un));
30120 			sd_reset_target(un, pkt);
30121 			mutex_exit(SD_MUTEX(un));
30122 		}
30123 
30124 		/*
30125 		 * If we are not getting anywhere with lun/target resets,
30126 		 * let's reset the bus.
30127 		 */
30128 		if (i > SD_NDUMP_RETRIES/2) {
30129 			(void) scsi_reset(SD_ADDRESS(un), RESET_ALL);
30130 			(void) sd_send_polled_RQS(un);
30131 		}
30132 
30133 	}
30134 	scsi_destroy_pkt(pkt);
30135 
30136 	if (err != 0) {
30137 		scsi_free_consistent_buf(bp);
30138 		*bpp = NULL;
30139 	} else {
30140 		*bpp = bp;
30141 	}
30142 
30143 done:
30144 	mutex_enter(SD_MUTEX(un));
30145 	return (err);
30146 }
30147 
30148 
30149 /*
30150  *    Function: sd_failfast_flushq
30151  *
30152  * Description: Take all bp's on the wait queue that have B_FAILFAST set
30153  *		in b_flags and move them onto the failfast queue, then kick
30154  *		off a thread to return all bp's on the failfast queue to
30155  *		their owners with an error set.
30156  *
30157  *   Arguments: un - pointer to the soft state struct for the instance.
30158  *
30159  *     Context: may execute in interrupt context.
30160  */
30161 
30162 static void
30163 sd_failfast_flushq(struct sd_lun *un)
30164 {
30165 	struct buf *bp;
30166 	struct buf *next_waitq_bp;
30167 	struct buf *prev_waitq_bp = NULL;
30168 
30169 	ASSERT(un != NULL);
30170 	ASSERT(mutex_owned(SD_MUTEX(un)));
30171 	ASSERT(un->un_failfast_state == SD_FAILFAST_ACTIVE);
30172 	ASSERT(un->un_failfast_bp == NULL);
30173 
30174 	SD_TRACE(SD_LOG_IO_FAILFAST, un,
30175 	    "sd_failfast_flushq: entry: un:0x%p\n", un);
30176 
30177 	/*
30178 	 * Check if we should flush all bufs when entering failfast state, or
30179 	 * just those with B_FAILFAST set.
30180 	 */
30181 	if (sd_failfast_flushctl & SD_FAILFAST_FLUSH_ALL_BUFS) {
30182 		/*
30183 		 * Move *all* bp's on the wait queue to the failfast flush
30184 		 * queue, including those that do NOT have B_FAILFAST set.
30185 		 */
30186 		if (un->un_failfast_headp == NULL) {
30187 			ASSERT(un->un_failfast_tailp == NULL);
30188 			un->un_failfast_headp = un->un_waitq_headp;
30189 		} else {
30190 			ASSERT(un->un_failfast_tailp != NULL);
30191 			un->un_failfast_tailp->av_forw = un->un_waitq_headp;
30192 		}
30193 
30194 		un->un_failfast_tailp = un->un_waitq_tailp;
30195 
30196 		/* update kstat for each bp moved out of the waitq */
30197 		for (bp = un->un_waitq_headp; bp != NULL; bp = bp->av_forw) {
30198 			SD_UPDATE_KSTATS(un, kstat_waitq_exit, bp);
30199 		}
30200 
30201 		/* empty the waitq */
30202 		un->un_waitq_headp = un->un_waitq_tailp = NULL;
30203 
30204 	} else {
30205 		/*
30206 		 * Go thru the wait queue, pick off all entries with
30207 		 * B_FAILFAST set, and move these onto the failfast queue.
30208 		 */
30209 		for (bp = un->un_waitq_headp; bp != NULL; bp = next_waitq_bp) {
30210 			/*
30211 			 * Save the pointer to the next bp on the wait queue,
30212 			 * so we get to it on the next iteration of this loop.
30213 			 */
30214 			next_waitq_bp = bp->av_forw;
30215 
30216 			/*
30217 			 * If this bp from the wait queue does NOT have
30218 			 * B_FAILFAST set, just move on to the next element
30219 			 * in the wait queue. Note, this is the only place
30220 			 * where it is correct to set prev_waitq_bp.
30221 			 */
30222 			if ((bp->b_flags & B_FAILFAST) == 0) {
30223 				prev_waitq_bp = bp;
30224 				continue;
30225 			}
30226 
30227 			/*
30228 			 * Remove the bp from the wait queue.
30229 			 */
30230 			if (bp == un->un_waitq_headp) {
30231 				/* The bp is the first element of the waitq. */
30232 				un->un_waitq_headp = next_waitq_bp;
30233 				if (un->un_waitq_headp == NULL) {
30234 					/* The wait queue is now empty */
30235 					un->un_waitq_tailp = NULL;
30236 				}
30237 			} else {
30238 				/*
30239 				 * The bp is either somewhere in the middle
30240 				 * or at the end of the wait queue.
30241 				 */
30242 				ASSERT(un->un_waitq_headp != NULL);
30243 				ASSERT(prev_waitq_bp != NULL);
30244 				ASSERT((prev_waitq_bp->b_flags & B_FAILFAST)
30245 				    == 0);
30246 				if (bp == un->un_waitq_tailp) {
30247 					/* bp is the last entry on the waitq. */
30248 					ASSERT(next_waitq_bp == NULL);
30249 					un->un_waitq_tailp = prev_waitq_bp;
30250 				}
30251 				prev_waitq_bp->av_forw = next_waitq_bp;
30252 			}
30253 			bp->av_forw = NULL;
30254 
30255 			/*
30256 			 * update kstat since the bp is moved out of
30257 			 * the waitq
30258 			 */
30259 			SD_UPDATE_KSTATS(un, kstat_waitq_exit, bp);
30260 
30261 			/*
30262 			 * Now put the bp onto the failfast queue.
30263 			 */
30264 			if (un->un_failfast_headp == NULL) {
30265 				/* failfast queue is currently empty */
30266 				ASSERT(un->un_failfast_tailp == NULL);
30267 				un->un_failfast_headp =
30268 				    un->un_failfast_tailp = bp;
30269 			} else {
30270 				/* Add the bp to the end of the failfast q */
30271 				ASSERT(un->un_failfast_tailp != NULL);
30272 				ASSERT(un->un_failfast_tailp->b_flags &
30273 				    B_FAILFAST);
30274 				un->un_failfast_tailp->av_forw = bp;
30275 				un->un_failfast_tailp = bp;
30276 			}
30277 		}
30278 	}
30279 
30280 	/*
30281 	 * Now return all bp's on the failfast queue to their owners.
30282 	 */
30283 	while ((bp = un->un_failfast_headp) != NULL) {
30284 
30285 		un->un_failfast_headp = bp->av_forw;
30286 		if (un->un_failfast_headp == NULL) {
30287 			un->un_failfast_tailp = NULL;
30288 		}
30289 
30290 		/*
30291 		 * We want to return the bp with a failure error code, but
30292 		 * we do not want a call to sd_start_cmds() to occur here,
30293 		 * so use sd_return_failed_command_no_restart() instead of
30294 		 * sd_return_failed_command().
30295 		 */
30296 		sd_return_failed_command_no_restart(un, bp, EIO);
30297 	}
30298 
30299 	/* Flush the xbuf queues if required. */
30300 	if (sd_failfast_flushctl & SD_FAILFAST_FLUSH_ALL_QUEUES) {
30301 		ddi_xbuf_flushq(un->un_xbuf_attr, sd_failfast_flushq_callback);
30302 	}
30303 
30304 	SD_TRACE(SD_LOG_IO_FAILFAST, un,
30305 	    "sd_failfast_flushq: exit: un:0x%p\n", un);
30306 }
30307 
30308 
30309 /*
30310  *    Function: sd_failfast_flushq_callback
30311  *
30312  * Description: Return TRUE if the given bp meets the criteria for failfast
30313  *		flushing. Used with ddi_xbuf_flushq(9F).
30314  *
30315  *   Arguments: bp - ptr to buf struct to be examined.
30316  *
30317  *     Context: Any
30318  */
30319 
30320 static int
30321 sd_failfast_flushq_callback(struct buf *bp)
30322 {
30323 	/*
30324 	 * Return TRUE if (1) we want to flush ALL bufs when the failfast
30325 	 * state is entered; OR (2) the given bp has B_FAILFAST set.
30326 	 */
30327 	return (((sd_failfast_flushctl & SD_FAILFAST_FLUSH_ALL_BUFS) ||
30328 	    (bp->b_flags & B_FAILFAST)) ? TRUE : FALSE);
30329 }
30330 
30331 
30332 
30333 /*
30334  * Function: sd_setup_next_xfer
30335  *
30336  * Description: Prepare next I/O operation using DMA_PARTIAL
30337  *
30338  */
30339 
30340 static int
30341 sd_setup_next_xfer(struct sd_lun *un, struct buf *bp,
30342     struct scsi_pkt *pkt, struct sd_xbuf *xp)
30343 {
30344 	ssize_t	num_blks_not_xfered;
30345 	daddr_t	strt_blk_num;
30346 	ssize_t	bytes_not_xfered;
30347 	int	rval;
30348 
30349 	ASSERT(pkt->pkt_resid == 0);
30350 
30351 	/*
30352 	 * Calculate next block number and amount to be transferred.
30353 	 *
30354 	 * How much data NOT transfered to the HBA yet.
30355 	 */
30356 	bytes_not_xfered = xp->xb_dma_resid;
30357 
30358 	/*
30359 	 * figure how many blocks NOT transfered to the HBA yet.
30360 	 */
30361 	num_blks_not_xfered = SD_BYTES2TGTBLOCKS(un, bytes_not_xfered);
30362 
30363 	/*
30364 	 * set starting block number to the end of what WAS transfered.
30365 	 */
30366 	strt_blk_num = xp->xb_blkno +
30367 	    SD_BYTES2TGTBLOCKS(un, bp->b_bcount - bytes_not_xfered);
30368 
30369 	/*
30370 	 * Move pkt to the next portion of the xfer.  sd_setup_next_rw_pkt
30371 	 * will call scsi_initpkt with NULL_FUNC so we do not have to release
30372 	 * the disk mutex here.
30373 	 */
30374 	rval = sd_setup_next_rw_pkt(un, pkt, bp,
30375 	    strt_blk_num, num_blks_not_xfered);
30376 
30377 	if (rval == 0) {
30378 
30379 		/*
30380 		 * Success.
30381 		 *
30382 		 * Adjust things if there are still more blocks to be
30383 		 * transfered.
30384 		 */
30385 		xp->xb_dma_resid = pkt->pkt_resid;
30386 		pkt->pkt_resid = 0;
30387 
30388 		return (1);
30389 	}
30390 
30391 	/*
30392 	 * There's really only one possible return value from
30393 	 * sd_setup_next_rw_pkt which occurs when scsi_init_pkt
30394 	 * returns NULL.
30395 	 */
30396 	ASSERT(rval == SD_PKT_ALLOC_FAILURE);
30397 
30398 	bp->b_resid = bp->b_bcount;
30399 	bp->b_flags |= B_ERROR;
30400 
30401 	scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
30402 	    "Error setting up next portion of DMA transfer\n");
30403 
30404 	return (0);
30405 }
30406 
30407 /*
30408  *    Function: sd_panic_for_res_conflict
30409  *
30410  * Description: Call panic with a string formatted with "Reservation Conflict"
30411  *		and a human readable identifier indicating the SD instance
30412  *		that experienced the reservation conflict.
30413  *
30414  *   Arguments: un - pointer to the soft state struct for the instance.
30415  *
30416  *     Context: may execute in interrupt context.
30417  */
30418 
30419 #define	SD_RESV_CONFLICT_FMT_LEN 40
30420 void
30421 sd_panic_for_res_conflict(struct sd_lun *un)
30422 {
30423 	char panic_str[SD_RESV_CONFLICT_FMT_LEN+MAXPATHLEN];
30424 	char path_str[MAXPATHLEN];
30425 
30426 	(void) snprintf(panic_str, sizeof (panic_str),
30427 	    "Reservation Conflict\nDisk: %s",
30428 	    ddi_pathname(SD_DEVINFO(un), path_str));
30429 
30430 	panic(panic_str);
30431 }
30432 
30433 /*
30434  * Note: The following sd_faultinjection_ioctl( ) routines implement
30435  * driver support for handling fault injection for error analysis
30436  * causing faults in multiple layers of the driver.
30437  *
30438  */
30439 
30440 #ifdef SD_FAULT_INJECTION
30441 static uint_t   sd_fault_injection_on = 0;
30442 
30443 /*
30444  *    Function: sd_faultinjection_ioctl()
30445  *
30446  * Description: This routine is the driver entry point for handling
30447  *              faultinjection ioctls to inject errors into the
30448  *              layer model
30449  *
30450  *   Arguments: cmd	- the ioctl cmd received
30451  *		arg	- the arguments from user and returns
30452  */
30453 
30454 static void
30455 sd_faultinjection_ioctl(int cmd, intptr_t arg,  struct sd_lun *un)
30456 {
30457 	uint_t i = 0;
30458 	uint_t rval;
30459 
30460 	SD_TRACE(SD_LOG_IOERR, un, "sd_faultinjection_ioctl: entry\n");
30461 
30462 	mutex_enter(SD_MUTEX(un));
30463 
30464 	switch (cmd) {
30465 	case SDIOCRUN:
30466 		/* Allow pushed faults to be injected */
30467 		SD_INFO(SD_LOG_SDTEST, un,
30468 		    "sd_faultinjection_ioctl: Injecting Fault Run\n");
30469 
30470 		sd_fault_injection_on = 1;
30471 
30472 		SD_INFO(SD_LOG_IOERR, un,
30473 		    "sd_faultinjection_ioctl: run finished\n");
30474 		break;
30475 
30476 	case SDIOCSTART:
30477 		/* Start Injection Session */
30478 		SD_INFO(SD_LOG_SDTEST, un,
30479 		    "sd_faultinjection_ioctl: Injecting Fault Start\n");
30480 
30481 		sd_fault_injection_on = 0;
30482 		un->sd_injection_mask = 0xFFFFFFFF;
30483 		for (i = 0; i < SD_FI_MAX_ERROR; i++) {
30484 			un->sd_fi_fifo_pkt[i] = NULL;
30485 			un->sd_fi_fifo_xb[i] = NULL;
30486 			un->sd_fi_fifo_un[i] = NULL;
30487 			un->sd_fi_fifo_arq[i] = NULL;
30488 		}
30489 		un->sd_fi_fifo_start = 0;
30490 		un->sd_fi_fifo_end = 0;
30491 
30492 		mutex_enter(&(un->un_fi_mutex));
30493 		un->sd_fi_log[0] = '\0';
30494 		un->sd_fi_buf_len = 0;
30495 		mutex_exit(&(un->un_fi_mutex));
30496 
30497 		SD_INFO(SD_LOG_IOERR, un,
30498 		    "sd_faultinjection_ioctl: start finished\n");
30499 		break;
30500 
30501 	case SDIOCSTOP:
30502 		/* Stop Injection Session */
30503 		SD_INFO(SD_LOG_SDTEST, un,
30504 		    "sd_faultinjection_ioctl: Injecting Fault Stop\n");
30505 		sd_fault_injection_on = 0;
30506 		un->sd_injection_mask = 0x0;
30507 
30508 		/* Empty stray or unuseds structs from fifo */
30509 		for (i = 0; i < SD_FI_MAX_ERROR; i++) {
30510 			if (un->sd_fi_fifo_pkt[i] != NULL) {
30511 				kmem_free(un->sd_fi_fifo_pkt[i],
30512 				    sizeof (struct sd_fi_pkt));
30513 			}
30514 			if (un->sd_fi_fifo_xb[i] != NULL) {
30515 				kmem_free(un->sd_fi_fifo_xb[i],
30516 				    sizeof (struct sd_fi_xb));
30517 			}
30518 			if (un->sd_fi_fifo_un[i] != NULL) {
30519 				kmem_free(un->sd_fi_fifo_un[i],
30520 				    sizeof (struct sd_fi_un));
30521 			}
30522 			if (un->sd_fi_fifo_arq[i] != NULL) {
30523 				kmem_free(un->sd_fi_fifo_arq[i],
30524 				    sizeof (struct sd_fi_arq));
30525 			}
30526 			un->sd_fi_fifo_pkt[i] = NULL;
30527 			un->sd_fi_fifo_un[i] = NULL;
30528 			un->sd_fi_fifo_xb[i] = NULL;
30529 			un->sd_fi_fifo_arq[i] = NULL;
30530 		}
30531 		un->sd_fi_fifo_start = 0;
30532 		un->sd_fi_fifo_end = 0;
30533 
30534 		SD_INFO(SD_LOG_IOERR, un,
30535 		    "sd_faultinjection_ioctl: stop finished\n");
30536 		break;
30537 
30538 	case SDIOCINSERTPKT:
30539 		/* Store a packet struct to be pushed onto fifo */
30540 		SD_INFO(SD_LOG_SDTEST, un,
30541 		    "sd_faultinjection_ioctl: Injecting Fault Insert Pkt\n");
30542 
30543 		i = un->sd_fi_fifo_end % SD_FI_MAX_ERROR;
30544 
30545 		sd_fault_injection_on = 0;
30546 
30547 		/* No more that SD_FI_MAX_ERROR allowed in Queue */
30548 		if (un->sd_fi_fifo_pkt[i] != NULL) {
30549 			kmem_free(un->sd_fi_fifo_pkt[i],
30550 			    sizeof (struct sd_fi_pkt));
30551 		}
30552 		if (arg != NULL) {
30553 			un->sd_fi_fifo_pkt[i] =
30554 			    kmem_alloc(sizeof (struct sd_fi_pkt), KM_NOSLEEP);
30555 			if (un->sd_fi_fifo_pkt[i] == NULL) {
30556 				/* Alloc failed don't store anything */
30557 				break;
30558 			}
30559 			rval = ddi_copyin((void *)arg, un->sd_fi_fifo_pkt[i],
30560 			    sizeof (struct sd_fi_pkt), 0);
30561 			if (rval == -1) {
30562 				kmem_free(un->sd_fi_fifo_pkt[i],
30563 				    sizeof (struct sd_fi_pkt));
30564 				un->sd_fi_fifo_pkt[i] = NULL;
30565 			}
30566 		} else {
30567 			SD_INFO(SD_LOG_IOERR, un,
30568 			    "sd_faultinjection_ioctl: pkt null\n");
30569 		}
30570 		break;
30571 
30572 	case SDIOCINSERTXB:
30573 		/* Store a xb struct to be pushed onto fifo */
30574 		SD_INFO(SD_LOG_SDTEST, un,
30575 		    "sd_faultinjection_ioctl: Injecting Fault Insert XB\n");
30576 
30577 		i = un->sd_fi_fifo_end % SD_FI_MAX_ERROR;
30578 
30579 		sd_fault_injection_on = 0;
30580 
30581 		if (un->sd_fi_fifo_xb[i] != NULL) {
30582 			kmem_free(un->sd_fi_fifo_xb[i],
30583 			    sizeof (struct sd_fi_xb));
30584 			un->sd_fi_fifo_xb[i] = NULL;
30585 		}
30586 		if (arg != NULL) {
30587 			un->sd_fi_fifo_xb[i] =
30588 			    kmem_alloc(sizeof (struct sd_fi_xb), KM_NOSLEEP);
30589 			if (un->sd_fi_fifo_xb[i] == NULL) {
30590 				/* Alloc failed don't store anything */
30591 				break;
30592 			}
30593 			rval = ddi_copyin((void *)arg, un->sd_fi_fifo_xb[i],
30594 			    sizeof (struct sd_fi_xb), 0);
30595 
30596 			if (rval == -1) {
30597 				kmem_free(un->sd_fi_fifo_xb[i],
30598 				    sizeof (struct sd_fi_xb));
30599 				un->sd_fi_fifo_xb[i] = NULL;
30600 			}
30601 		} else {
30602 			SD_INFO(SD_LOG_IOERR, un,
30603 			    "sd_faultinjection_ioctl: xb null\n");
30604 		}
30605 		break;
30606 
30607 	case SDIOCINSERTUN:
30608 		/* Store a un struct to be pushed onto fifo */
30609 		SD_INFO(SD_LOG_SDTEST, un,
30610 		    "sd_faultinjection_ioctl: Injecting Fault Insert UN\n");
30611 
30612 		i = un->sd_fi_fifo_end % SD_FI_MAX_ERROR;
30613 
30614 		sd_fault_injection_on = 0;
30615 
30616 		if (un->sd_fi_fifo_un[i] != NULL) {
30617 			kmem_free(un->sd_fi_fifo_un[i],
30618 			    sizeof (struct sd_fi_un));
30619 			un->sd_fi_fifo_un[i] = NULL;
30620 		}
30621 		if (arg != NULL) {
30622 			un->sd_fi_fifo_un[i] =
30623 			    kmem_alloc(sizeof (struct sd_fi_un), KM_NOSLEEP);
30624 			if (un->sd_fi_fifo_un[i] == NULL) {
30625 				/* Alloc failed don't store anything */
30626 				break;
30627 			}
30628 			rval = ddi_copyin((void *)arg, un->sd_fi_fifo_un[i],
30629 			    sizeof (struct sd_fi_un), 0);
30630 			if (rval == -1) {
30631 				kmem_free(un->sd_fi_fifo_un[i],
30632 				    sizeof (struct sd_fi_un));
30633 				un->sd_fi_fifo_un[i] = NULL;
30634 			}
30635 
30636 		} else {
30637 			SD_INFO(SD_LOG_IOERR, un,
30638 			    "sd_faultinjection_ioctl: un null\n");
30639 		}
30640 
30641 		break;
30642 
30643 	case SDIOCINSERTARQ:
30644 		/* Store a arq struct to be pushed onto fifo */
30645 		SD_INFO(SD_LOG_SDTEST, un,
30646 		    "sd_faultinjection_ioctl: Injecting Fault Insert ARQ\n");
30647 		i = un->sd_fi_fifo_end % SD_FI_MAX_ERROR;
30648 
30649 		sd_fault_injection_on = 0;
30650 
30651 		if (un->sd_fi_fifo_arq[i] != NULL) {
30652 			kmem_free(un->sd_fi_fifo_arq[i],
30653 			    sizeof (struct sd_fi_arq));
30654 			un->sd_fi_fifo_arq[i] = NULL;
30655 		}
30656 		if (arg != NULL) {
30657 			un->sd_fi_fifo_arq[i] =
30658 			    kmem_alloc(sizeof (struct sd_fi_arq), KM_NOSLEEP);
30659 			if (un->sd_fi_fifo_arq[i] == NULL) {
30660 				/* Alloc failed don't store anything */
30661 				break;
30662 			}
30663 			rval = ddi_copyin((void *)arg, un->sd_fi_fifo_arq[i],
30664 			    sizeof (struct sd_fi_arq), 0);
30665 			if (rval == -1) {
30666 				kmem_free(un->sd_fi_fifo_arq[i],
30667 				    sizeof (struct sd_fi_arq));
30668 				un->sd_fi_fifo_arq[i] = NULL;
30669 			}
30670 
30671 		} else {
30672 			SD_INFO(SD_LOG_IOERR, un,
30673 			    "sd_faultinjection_ioctl: arq null\n");
30674 		}
30675 
30676 		break;
30677 
30678 	case SDIOCPUSH:
30679 		/* Push stored xb, pkt, un, and arq onto fifo */
30680 		sd_fault_injection_on = 0;
30681 
30682 		if (arg != NULL) {
30683 			rval = ddi_copyin((void *)arg, &i, sizeof (uint_t), 0);
30684 			if (rval != -1 &&
30685 			    un->sd_fi_fifo_end + i < SD_FI_MAX_ERROR) {
30686 				un->sd_fi_fifo_end += i;
30687 			}
30688 		} else {
30689 			SD_INFO(SD_LOG_IOERR, un,
30690 			    "sd_faultinjection_ioctl: push arg null\n");
30691 			if (un->sd_fi_fifo_end + i < SD_FI_MAX_ERROR) {
30692 				un->sd_fi_fifo_end++;
30693 			}
30694 		}
30695 		SD_INFO(SD_LOG_IOERR, un,
30696 		    "sd_faultinjection_ioctl: push to end=%d\n",
30697 		    un->sd_fi_fifo_end);
30698 		break;
30699 
30700 	case SDIOCRETRIEVE:
30701 		/* Return buffer of log from Injection session */
30702 		SD_INFO(SD_LOG_SDTEST, un,
30703 		    "sd_faultinjection_ioctl: Injecting Fault Retreive");
30704 
30705 		sd_fault_injection_on = 0;
30706 
30707 		mutex_enter(&(un->un_fi_mutex));
30708 		rval = ddi_copyout(un->sd_fi_log, (void *)arg,
30709 		    un->sd_fi_buf_len+1, 0);
30710 		mutex_exit(&(un->un_fi_mutex));
30711 
30712 		if (rval == -1) {
30713 			/*
30714 			 * arg is possibly invalid setting
30715 			 * it to NULL for return
30716 			 */
30717 			arg = NULL;
30718 		}
30719 		break;
30720 	}
30721 
30722 	mutex_exit(SD_MUTEX(un));
30723 	SD_TRACE(SD_LOG_IOERR, un, "sd_faultinjection_ioctl: exit\n");
30724 }
30725 
30726 
30727 /*
30728  *    Function: sd_injection_log()
30729  *
30730  * Description: This routine adds buff to the already existing injection log
30731  *              for retrieval via faultinjection_ioctl for use in fault
30732  *              detection and recovery
30733  *
30734  *   Arguments: buf - the string to add to the log
30735  */
30736 
30737 static void
30738 sd_injection_log(char *buf, struct sd_lun *un)
30739 {
30740 	uint_t len;
30741 
30742 	ASSERT(un != NULL);
30743 	ASSERT(buf != NULL);
30744 
30745 	mutex_enter(&(un->un_fi_mutex));
30746 
30747 	len = min(strlen(buf), 255);
30748 	/* Add logged value to Injection log to be returned later */
30749 	if (len + un->sd_fi_buf_len < SD_FI_MAX_BUF) {
30750 		uint_t	offset = strlen((char *)un->sd_fi_log);
30751 		char *destp = (char *)un->sd_fi_log + offset;
30752 		int i;
30753 		for (i = 0; i < len; i++) {
30754 			*destp++ = *buf++;
30755 		}
30756 		un->sd_fi_buf_len += len;
30757 		un->sd_fi_log[un->sd_fi_buf_len] = '\0';
30758 	}
30759 
30760 	mutex_exit(&(un->un_fi_mutex));
30761 }
30762 
30763 
30764 /*
30765  *    Function: sd_faultinjection()
30766  *
30767  * Description: This routine takes the pkt and changes its
30768  *		content based on error injection scenerio.
30769  *
30770  *   Arguments: pktp	- packet to be changed
30771  */
30772 
30773 static void
30774 sd_faultinjection(struct scsi_pkt *pktp)
30775 {
30776 	uint_t i;
30777 	struct sd_fi_pkt *fi_pkt;
30778 	struct sd_fi_xb *fi_xb;
30779 	struct sd_fi_un *fi_un;
30780 	struct sd_fi_arq *fi_arq;
30781 	struct buf *bp;
30782 	struct sd_xbuf *xb;
30783 	struct sd_lun *un;
30784 
30785 	ASSERT(pktp != NULL);
30786 
30787 	/* pull bp xb and un from pktp */
30788 	bp = (struct buf *)pktp->pkt_private;
30789 	xb = SD_GET_XBUF(bp);
30790 	un = SD_GET_UN(bp);
30791 
30792 	ASSERT(un != NULL);
30793 
30794 	mutex_enter(SD_MUTEX(un));
30795 
30796 	SD_TRACE(SD_LOG_SDTEST, un,
30797 	    "sd_faultinjection: entry Injection from sdintr\n");
30798 
30799 	/* if injection is off return */
30800 	if (sd_fault_injection_on == 0 ||
30801 	    un->sd_fi_fifo_start == un->sd_fi_fifo_end) {
30802 		mutex_exit(SD_MUTEX(un));
30803 		return;
30804 	}
30805 
30806 	SD_INFO(SD_LOG_SDTEST, un,
30807 	    "sd_faultinjection: is working for copying\n");
30808 
30809 	/* take next set off fifo */
30810 	i = un->sd_fi_fifo_start % SD_FI_MAX_ERROR;
30811 
30812 	fi_pkt = un->sd_fi_fifo_pkt[i];
30813 	fi_xb = un->sd_fi_fifo_xb[i];
30814 	fi_un = un->sd_fi_fifo_un[i];
30815 	fi_arq = un->sd_fi_fifo_arq[i];
30816 
30817 
30818 	/* set variables accordingly */
30819 	/* set pkt if it was on fifo */
30820 	if (fi_pkt != NULL) {
30821 		SD_CONDSET(pktp, pkt, pkt_flags, "pkt_flags");
30822 		SD_CONDSET(*pktp, pkt, pkt_scbp, "pkt_scbp");
30823 		if (fi_pkt->pkt_cdbp != 0xff)
30824 			SD_CONDSET(*pktp, pkt, pkt_cdbp, "pkt_cdbp");
30825 		SD_CONDSET(pktp, pkt, pkt_state, "pkt_state");
30826 		SD_CONDSET(pktp, pkt, pkt_statistics, "pkt_statistics");
30827 		SD_CONDSET(pktp, pkt, pkt_reason, "pkt_reason");
30828 
30829 	}
30830 	/* set xb if it was on fifo */
30831 	if (fi_xb != NULL) {
30832 		SD_CONDSET(xb, xb, xb_blkno, "xb_blkno");
30833 		SD_CONDSET(xb, xb, xb_dma_resid, "xb_dma_resid");
30834 		if (fi_xb->xb_retry_count != 0)
30835 			SD_CONDSET(xb, xb, xb_retry_count, "xb_retry_count");
30836 		SD_CONDSET(xb, xb, xb_victim_retry_count,
30837 		    "xb_victim_retry_count");
30838 		SD_CONDSET(xb, xb, xb_sense_status, "xb_sense_status");
30839 		SD_CONDSET(xb, xb, xb_sense_state, "xb_sense_state");
30840 		SD_CONDSET(xb, xb, xb_sense_resid, "xb_sense_resid");
30841 
30842 		/* copy in block data from sense */
30843 		/*
30844 		 * if (fi_xb->xb_sense_data[0] != -1) {
30845 		 *	bcopy(fi_xb->xb_sense_data, xb->xb_sense_data,
30846 		 *	SENSE_LENGTH);
30847 		 * }
30848 		 */
30849 		bcopy(fi_xb->xb_sense_data, xb->xb_sense_data, SENSE_LENGTH);
30850 
30851 		/* copy in extended sense codes */
30852 		SD_CONDSET(((struct scsi_extended_sense *)xb->xb_sense_data),
30853 		    xb, es_code, "es_code");
30854 		SD_CONDSET(((struct scsi_extended_sense *)xb->xb_sense_data),
30855 		    xb, es_key, "es_key");
30856 		SD_CONDSET(((struct scsi_extended_sense *)xb->xb_sense_data),
30857 		    xb, es_add_code, "es_add_code");
30858 		SD_CONDSET(((struct scsi_extended_sense *)xb->xb_sense_data),
30859 		    xb, es_qual_code, "es_qual_code");
30860 		struct scsi_extended_sense *esp;
30861 		esp = (struct scsi_extended_sense *)xb->xb_sense_data;
30862 		esp->es_class = CLASS_EXTENDED_SENSE;
30863 	}
30864 
30865 	/* set un if it was on fifo */
30866 	if (fi_un != NULL) {
30867 		SD_CONDSET(un->un_sd->sd_inq, un, inq_rmb, "inq_rmb");
30868 		SD_CONDSET(un, un, un_ctype, "un_ctype");
30869 		SD_CONDSET(un, un, un_reset_retry_count,
30870 		    "un_reset_retry_count");
30871 		SD_CONDSET(un, un, un_reservation_type, "un_reservation_type");
30872 		SD_CONDSET(un, un, un_resvd_status, "un_resvd_status");
30873 		SD_CONDSET(un, un, un_f_arq_enabled, "un_f_arq_enabled");
30874 		SD_CONDSET(un, un, un_f_allow_bus_device_reset,
30875 		    "un_f_allow_bus_device_reset");
30876 		SD_CONDSET(un, un, un_f_opt_queueing, "un_f_opt_queueing");
30877 
30878 	}
30879 
30880 	/* copy in auto request sense if it was on fifo */
30881 	if (fi_arq != NULL) {
30882 		bcopy(fi_arq, pktp->pkt_scbp, sizeof (struct sd_fi_arq));
30883 	}
30884 
30885 	/* free structs */
30886 	if (un->sd_fi_fifo_pkt[i] != NULL) {
30887 		kmem_free(un->sd_fi_fifo_pkt[i], sizeof (struct sd_fi_pkt));
30888 	}
30889 	if (un->sd_fi_fifo_xb[i] != NULL) {
30890 		kmem_free(un->sd_fi_fifo_xb[i], sizeof (struct sd_fi_xb));
30891 	}
30892 	if (un->sd_fi_fifo_un[i] != NULL) {
30893 		kmem_free(un->sd_fi_fifo_un[i], sizeof (struct sd_fi_un));
30894 	}
30895 	if (un->sd_fi_fifo_arq[i] != NULL) {
30896 		kmem_free(un->sd_fi_fifo_arq[i], sizeof (struct sd_fi_arq));
30897 	}
30898 
30899 	/*
30900 	 * kmem_free does not gurantee to set to NULL
30901 	 * since we uses these to determine if we set
30902 	 * values or not lets confirm they are always
30903 	 * NULL after free
30904 	 */
30905 	un->sd_fi_fifo_pkt[i] = NULL;
30906 	un->sd_fi_fifo_un[i] = NULL;
30907 	un->sd_fi_fifo_xb[i] = NULL;
30908 	un->sd_fi_fifo_arq[i] = NULL;
30909 
30910 	un->sd_fi_fifo_start++;
30911 
30912 	mutex_exit(SD_MUTEX(un));
30913 
30914 	SD_INFO(SD_LOG_SDTEST, un, "sd_faultinjection: exit\n");
30915 }
30916 
30917 #endif /* SD_FAULT_INJECTION */
30918 
30919 /*
30920  * This routine is invoked in sd_unit_attach(). Before calling it, the
30921  * properties in conf file should be processed already, and "hotpluggable"
30922  * property was processed also.
30923  *
30924  * The sd driver distinguishes 3 different type of devices: removable media,
30925  * non-removable media, and hotpluggable. Below the differences are defined:
30926  *
30927  * 1. Device ID
30928  *
30929  *     The device ID of a device is used to identify this device. Refer to
30930  *     ddi_devid_register(9F).
30931  *
30932  *     For a non-removable media disk device which can provide 0x80 or 0x83
30933  *     VPD page (refer to INQUIRY command of SCSI SPC specification), a unique
30934  *     device ID is created to identify this device. For other non-removable
30935  *     media devices, a default device ID is created only if this device has
30936  *     at least 2 alter cylinders. Otherwise, this device has no devid.
30937  *
30938  *     -------------------------------------------------------
30939  *     removable media   hotpluggable  | Can Have Device ID
30940  *     -------------------------------------------------------
30941  *         false             false     |     Yes
30942  *         false             true      |     Yes
30943  *         true                x       |     No
30944  *     ------------------------------------------------------
30945  *
30946  *
30947  * 2. SCSI group 4 commands
30948  *
30949  *     In SCSI specs, only some commands in group 4 command set can use
30950  *     8-byte addresses that can be used to access >2TB storage spaces.
30951  *     Other commands have no such capability. Without supporting group4,
30952  *     it is impossible to make full use of storage spaces of a disk with
30953  *     capacity larger than 2TB.
30954  *
30955  *     -----------------------------------------------
30956  *     removable media   hotpluggable   LP64  |  Group
30957  *     -----------------------------------------------
30958  *           false          false       false |   1
30959  *           false          false       true  |   4
30960  *           false          true        false |   1
30961  *           false          true        true  |   4
30962  *           true             x           x   |   5
30963  *     -----------------------------------------------
30964  *
30965  *
30966  * 3. Check for VTOC Label
30967  *
30968  *     If a direct-access disk has no EFI label, sd will check if it has a
30969  *     valid VTOC label. Now, sd also does that check for removable media
30970  *     and hotpluggable devices.
30971  *
30972  *     --------------------------------------------------------------
30973  *     Direct-Access   removable media    hotpluggable |  Check Label
30974  *     -------------------------------------------------------------
30975  *         false          false           false        |   No
30976  *         false          false           true         |   No
30977  *         false          true            false        |   Yes
30978  *         false          true            true         |   Yes
30979  *         true            x                x          |   Yes
30980  *     --------------------------------------------------------------
30981  *
30982  *
30983  * 4. Building default VTOC label
30984  *
30985  *     As section 3 says, sd checks if some kinds of devices have VTOC label.
30986  *     If those devices have no valid VTOC label, sd(7d) will attempt to
30987  *     create default VTOC for them. Currently sd creates default VTOC label
30988  *     for all devices on x86 platform (VTOC_16), but only for removable
30989  *     media devices on SPARC (VTOC_8).
30990  *
30991  *     -----------------------------------------------------------
30992  *       removable media hotpluggable platform   |   Default Label
30993  *     -----------------------------------------------------------
30994  *             false          false    sparc     |     No
30995  *             false          true      x86      |     Yes
30996  *             false          true     sparc     |     Yes
30997  *             true             x        x       |     Yes
30998  *     ----------------------------------------------------------
30999  *
31000  *
31001  * 5. Supported blocksizes of target devices
31002  *
31003  *     Sd supports non-512-byte blocksize for removable media devices only.
31004  *     For other devices, only 512-byte blocksize is supported. This may be
31005  *     changed in near future because some RAID devices require non-512-byte
31006  *     blocksize
31007  *
31008  *     -----------------------------------------------------------
31009  *     removable media    hotpluggable    | non-512-byte blocksize
31010  *     -----------------------------------------------------------
31011  *           false          false         |   No
31012  *           false          true          |   No
31013  *           true             x           |   Yes
31014  *     -----------------------------------------------------------
31015  *
31016  *
31017  * 6. Automatic mount & unmount
31018  *
31019  *     Sd(7d) driver provides DKIOCREMOVABLE ioctl. This ioctl is used to query
31020  *     if a device is removable media device. It return 1 for removable media
31021  *     devices, and 0 for others.
31022  *
31023  *     The automatic mounting subsystem should distinguish between the types
31024  *     of devices and apply automounting policies to each.
31025  *
31026  *
31027  * 7. fdisk partition management
31028  *
31029  *     Fdisk is traditional partition method on x86 platform. Sd(7d) driver
31030  *     just supports fdisk partitions on x86 platform. On sparc platform, sd
31031  *     doesn't support fdisk partitions at all. Note: pcfs(7fs) can recognize
31032  *     fdisk partitions on both x86 and SPARC platform.
31033  *
31034  *     -----------------------------------------------------------
31035  *       platform   removable media  USB/1394  |  fdisk supported
31036  *     -----------------------------------------------------------
31037  *        x86         X               X        |       true
31038  *     ------------------------------------------------------------
31039  *        sparc       X               X        |       false
31040  *     ------------------------------------------------------------
31041  *
31042  *
31043  * 8. MBOOT/MBR
31044  *
31045  *     Although sd(7d) doesn't support fdisk on SPARC platform, it does support
31046  *     read/write mboot for removable media devices on sparc platform.
31047  *
31048  *     -----------------------------------------------------------
31049  *       platform   removable media  USB/1394  |  mboot supported
31050  *     -----------------------------------------------------------
31051  *        x86         X               X        |       true
31052  *     ------------------------------------------------------------
31053  *        sparc      false           false     |       false
31054  *        sparc      false           true      |       true
31055  *        sparc      true            false     |       true
31056  *        sparc      true            true      |       true
31057  *     ------------------------------------------------------------
31058  *
31059  *
31060  * 9.  error handling during opening device
31061  *
31062  *     If failed to open a disk device, an errno is returned. For some kinds
31063  *     of errors, different errno is returned depending on if this device is
31064  *     a removable media device. This brings USB/1394 hard disks in line with
31065  *     expected hard disk behavior. It is not expected that this breaks any
31066  *     application.
31067  *
31068  *     ------------------------------------------------------
31069  *       removable media    hotpluggable   |  errno
31070  *     ------------------------------------------------------
31071  *             false          false        |   EIO
31072  *             false          true         |   EIO
31073  *             true             x          |   ENXIO
31074  *     ------------------------------------------------------
31075  *
31076  *
31077  * 11. ioctls: DKIOCEJECT, CDROMEJECT
31078  *
31079  *     These IOCTLs are applicable only to removable media devices.
31080  *
31081  *     -----------------------------------------------------------
31082  *       removable media    hotpluggable   |DKIOCEJECT, CDROMEJECT
31083  *     -----------------------------------------------------------
31084  *             false          false        |     No
31085  *             false          true         |     No
31086  *             true            x           |     Yes
31087  *     -----------------------------------------------------------
31088  *
31089  *
31090  * 12. Kstats for partitions
31091  *
31092  *     sd creates partition kstat for non-removable media devices. USB and
31093  *     Firewire hard disks now have partition kstats
31094  *
31095  *      ------------------------------------------------------
31096  *       removable media    hotpluggable   |   kstat
31097  *      ------------------------------------------------------
31098  *             false          false        |    Yes
31099  *             false          true         |    Yes
31100  *             true             x          |    No
31101  *       ------------------------------------------------------
31102  *
31103  *
31104  * 13. Removable media & hotpluggable properties
31105  *
31106  *     Sd driver creates a "removable-media" property for removable media
31107  *     devices. Parent nexus drivers create a "hotpluggable" property if
31108  *     it supports hotplugging.
31109  *
31110  *     ---------------------------------------------------------------------
31111  *     removable media   hotpluggable |  "removable-media"   " hotpluggable"
31112  *     ---------------------------------------------------------------------
31113  *       false            false       |    No                   No
31114  *       false            true        |    No                   Yes
31115  *       true             false       |    Yes                  No
31116  *       true             true        |    Yes                  Yes
31117  *     ---------------------------------------------------------------------
31118  *
31119  *
31120  * 14. Power Management
31121  *
31122  *     sd only power manages removable media devices or devices that support
31123  *     LOG_SENSE or have a "pm-capable" property  (PSARC/2002/250)
31124  *
31125  *     A parent nexus that supports hotplugging can also set "pm-capable"
31126  *     if the disk can be power managed.
31127  *
31128  *     ------------------------------------------------------------
31129  *       removable media hotpluggable pm-capable  |   power manage
31130  *     ------------------------------------------------------------
31131  *             false          false     false     |     No
31132  *             false          false     true      |     Yes
31133  *             false          true      false     |     No
31134  *             false          true      true      |     Yes
31135  *             true             x        x        |     Yes
31136  *     ------------------------------------------------------------
31137  *
31138  *      USB and firewire hard disks can now be power managed independently
31139  *      of the framebuffer
31140  *
31141  *
31142  * 15. Support for USB disks with capacity larger than 1TB
31143  *
31144  *     Currently, sd doesn't permit a fixed disk device with capacity
31145  *     larger than 1TB to be used in a 32-bit operating system environment.
31146  *     However, sd doesn't do that for removable media devices. Instead, it
31147  *     assumes that removable media devices cannot have a capacity larger
31148  *     than 1TB. Therefore, using those devices on 32-bit system is partially
31149  *     supported, which can cause some unexpected results.
31150  *
31151  *     ---------------------------------------------------------------------
31152  *       removable media    USB/1394 | Capacity > 1TB |   Used in 32-bit env
31153  *     ---------------------------------------------------------------------
31154  *             false          false  |   true         |     no
31155  *             false          true   |   true         |     no
31156  *             true           false  |   true         |     Yes
31157  *             true           true   |   true         |     Yes
31158  *     ---------------------------------------------------------------------
31159  *
31160  *
31161  * 16. Check write-protection at open time
31162  *
31163  *     When a removable media device is being opened for writing without NDELAY
31164  *     flag, sd will check if this device is writable. If attempting to open
31165  *     without NDELAY flag a write-protected device, this operation will abort.
31166  *
31167  *     ------------------------------------------------------------
31168  *       removable media    USB/1394   |   WP Check
31169  *     ------------------------------------------------------------
31170  *             false          false    |     No
31171  *             false          true     |     No
31172  *             true           false    |     Yes
31173  *             true           true     |     Yes
31174  *     ------------------------------------------------------------
31175  *
31176  *
31177  * 17. syslog when corrupted VTOC is encountered
31178  *
31179  *      Currently, if an invalid VTOC is encountered, sd only print syslog
31180  *      for fixed SCSI disks.
31181  *     ------------------------------------------------------------
31182  *       removable media    USB/1394   |   print syslog
31183  *     ------------------------------------------------------------
31184  *             false          false    |     Yes
31185  *             false          true     |     No
31186  *             true           false    |     No
31187  *             true           true     |     No
31188  *     ------------------------------------------------------------
31189  */
31190 static void
31191 sd_set_unit_attributes(struct sd_lun *un, dev_info_t *devi)
31192 {
31193 	int	pm_cap;
31194 
31195 	ASSERT(un->un_sd);
31196 	ASSERT(un->un_sd->sd_inq);
31197 
31198 	/*
31199 	 * Enable SYNC CACHE support for all devices.
31200 	 */
31201 	un->un_f_sync_cache_supported = TRUE;
31202 
31203 	/*
31204 	 * Set the sync cache required flag to false.
31205 	 * This would ensure that there is no SYNC CACHE
31206 	 * sent when there are no writes
31207 	 */
31208 	un->un_f_sync_cache_required = FALSE;
31209 
31210 	if (un->un_sd->sd_inq->inq_rmb) {
31211 		/*
31212 		 * The media of this device is removable. And for this kind
31213 		 * of devices, it is possible to change medium after opening
31214 		 * devices. Thus we should support this operation.
31215 		 */
31216 		un->un_f_has_removable_media = TRUE;
31217 
31218 		/*
31219 		 * support non-512-byte blocksize of removable media devices
31220 		 */
31221 		un->un_f_non_devbsize_supported = TRUE;
31222 
31223 		/*
31224 		 * Assume that all removable media devices support DOOR_LOCK
31225 		 */
31226 		un->un_f_doorlock_supported = TRUE;
31227 
31228 		/*
31229 		 * For a removable media device, it is possible to be opened
31230 		 * with NDELAY flag when there is no media in drive, in this
31231 		 * case we don't care if device is writable. But if without
31232 		 * NDELAY flag, we need to check if media is write-protected.
31233 		 */
31234 		un->un_f_chk_wp_open = TRUE;
31235 
31236 		/*
31237 		 * need to start a SCSI watch thread to monitor media state,
31238 		 * when media is being inserted or ejected, notify syseventd.
31239 		 */
31240 		un->un_f_monitor_media_state = TRUE;
31241 
31242 		/*
31243 		 * Some devices don't support START_STOP_UNIT command.
31244 		 * Therefore, we'd better check if a device supports it
31245 		 * before sending it.
31246 		 */
31247 		un->un_f_check_start_stop = TRUE;
31248 
31249 		/*
31250 		 * support eject media ioctl:
31251 		 *		FDEJECT, DKIOCEJECT, CDROMEJECT
31252 		 */
31253 		un->un_f_eject_media_supported = TRUE;
31254 
31255 		/*
31256 		 * Because many removable-media devices don't support
31257 		 * LOG_SENSE, we couldn't use this command to check if
31258 		 * a removable media device support power-management.
31259 		 * We assume that they support power-management via
31260 		 * START_STOP_UNIT command and can be spun up and down
31261 		 * without limitations.
31262 		 */
31263 		un->un_f_pm_supported = TRUE;
31264 
31265 		/*
31266 		 * Need to create a zero length (Boolean) property
31267 		 * removable-media for the removable media devices.
31268 		 * Note that the return value of the property is not being
31269 		 * checked, since if unable to create the property
31270 		 * then do not want the attach to fail altogether. Consistent
31271 		 * with other property creation in attach.
31272 		 */
31273 		(void) ddi_prop_create(DDI_DEV_T_NONE, devi,
31274 		    DDI_PROP_CANSLEEP, "removable-media", NULL, 0);
31275 
31276 	} else {
31277 		/*
31278 		 * create device ID for device
31279 		 */
31280 		un->un_f_devid_supported = TRUE;
31281 
31282 		/*
31283 		 * Spin up non-removable-media devices once it is attached
31284 		 */
31285 		un->un_f_attach_spinup = TRUE;
31286 
31287 		/*
31288 		 * According to SCSI specification, Sense data has two kinds of
31289 		 * format: fixed format, and descriptor format. At present, we
31290 		 * don't support descriptor format sense data for removable
31291 		 * media.
31292 		 */
31293 		if (SD_INQUIRY(un)->inq_dtype == DTYPE_DIRECT) {
31294 			un->un_f_descr_format_supported = TRUE;
31295 		}
31296 
31297 		/*
31298 		 * kstats are created only for non-removable media devices.
31299 		 *
31300 		 * Set this in sd.conf to 0 in order to disable kstats.  The
31301 		 * default is 1, so they are enabled by default.
31302 		 */
31303 		un->un_f_pkstats_enabled = (ddi_prop_get_int(DDI_DEV_T_ANY,
31304 		    SD_DEVINFO(un), DDI_PROP_DONTPASS,
31305 		    "enable-partition-kstats", 1));
31306 
31307 		/*
31308 		 * Check if HBA has set the "pm-capable" property.
31309 		 * If "pm-capable" exists and is non-zero then we can
31310 		 * power manage the device without checking the start/stop
31311 		 * cycle count log sense page.
31312 		 *
31313 		 * If "pm-capable" exists and is set to be false (0),
31314 		 * then we should not power manage the device.
31315 		 *
31316 		 * If "pm-capable" doesn't exist then pm_cap will
31317 		 * be set to SD_PM_CAPABLE_UNDEFINED (-1).  In this case,
31318 		 * sd will check the start/stop cycle count log sense page
31319 		 * and power manage the device if the cycle count limit has
31320 		 * not been exceeded.
31321 		 */
31322 		pm_cap = ddi_prop_get_int(DDI_DEV_T_ANY, devi,
31323 		    DDI_PROP_DONTPASS, "pm-capable", SD_PM_CAPABLE_UNDEFINED);
31324 		if (SD_PM_CAPABLE_IS_UNDEFINED(pm_cap)) {
31325 			un->un_f_log_sense_supported = TRUE;
31326 			if (!un->un_f_power_condition_disabled &&
31327 			    SD_INQUIRY(un)->inq_ansi == 6) {
31328 				un->un_f_power_condition_supported = TRUE;
31329 			}
31330 		} else {
31331 			/*
31332 			 * pm-capable property exists.
31333 			 *
31334 			 * Convert "TRUE" values for pm_cap to
31335 			 * SD_PM_CAPABLE_IS_TRUE to make it easier to check
31336 			 * later. "TRUE" values are any values defined in
31337 			 * inquiry.h.
31338 			 */
31339 			if (SD_PM_CAPABLE_IS_FALSE(pm_cap)) {
31340 				un->un_f_log_sense_supported = FALSE;
31341 			} else {
31342 				/* SD_PM_CAPABLE_IS_TRUE case */
31343 				un->un_f_pm_supported = TRUE;
31344 				if (!un->un_f_power_condition_disabled &&
31345 				    SD_PM_CAPABLE_IS_SPC_4(pm_cap)) {
31346 					un->un_f_power_condition_supported =
31347 					    TRUE;
31348 				}
31349 				if (SD_PM_CAP_LOG_SUPPORTED(pm_cap)) {
31350 					un->un_f_log_sense_supported = TRUE;
31351 					un->un_f_pm_log_sense_smart =
31352 					    SD_PM_CAP_SMART_LOG(pm_cap);
31353 				}
31354 			}
31355 
31356 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
31357 			    "sd_unit_attach: un:0x%p pm-capable "
31358 			    "property set to %d.\n", un, un->un_f_pm_supported);
31359 		}
31360 	}
31361 
31362 	if (un->un_f_is_hotpluggable) {
31363 
31364 		/*
31365 		 * Have to watch hotpluggable devices as well, since
31366 		 * that's the only way for userland applications to
31367 		 * detect hot removal while device is busy/mounted.
31368 		 */
31369 		un->un_f_monitor_media_state = TRUE;
31370 
31371 		un->un_f_check_start_stop = TRUE;
31372 
31373 	}
31374 }
31375 
31376 /*
31377  * sd_tg_rdwr:
31378  * Provides rdwr access for cmlb via sd_tgops. The start_block is
31379  * in sys block size, req_length in bytes.
31380  *
31381  */
31382 static int
31383 sd_tg_rdwr(dev_info_t *devi, uchar_t cmd, void *bufaddr,
31384     diskaddr_t start_block, size_t reqlength, void *tg_cookie)
31385 {
31386 	struct sd_lun *un;
31387 	int path_flag = (int)(uintptr_t)tg_cookie;
31388 	char *dkl = NULL;
31389 	diskaddr_t real_addr = start_block;
31390 	diskaddr_t first_byte, end_block;
31391 
31392 	size_t	buffer_size = reqlength;
31393 	int rval = 0;
31394 	diskaddr_t	cap;
31395 	uint32_t	lbasize;
31396 	sd_ssc_t	*ssc;
31397 
31398 	un = ddi_get_soft_state(sd_state, ddi_get_instance(devi));
31399 	if (un == NULL)
31400 		return (ENXIO);
31401 
31402 	if (cmd != TG_READ && cmd != TG_WRITE)
31403 		return (EINVAL);
31404 
31405 	ssc = sd_ssc_init(un);
31406 	mutex_enter(SD_MUTEX(un));
31407 	if (un->un_f_tgt_blocksize_is_valid == FALSE) {
31408 		mutex_exit(SD_MUTEX(un));
31409 		rval = sd_send_scsi_READ_CAPACITY(ssc, (uint64_t *)&cap,
31410 		    &lbasize, path_flag);
31411 		if (rval != 0)
31412 			goto done1;
31413 		mutex_enter(SD_MUTEX(un));
31414 		sd_update_block_info(un, lbasize, cap);
31415 		if ((un->un_f_tgt_blocksize_is_valid == FALSE)) {
31416 			mutex_exit(SD_MUTEX(un));
31417 			rval = EIO;
31418 			goto done;
31419 		}
31420 	}
31421 
31422 	if (NOT_DEVBSIZE(un)) {
31423 		/*
31424 		 * sys_blocksize != tgt_blocksize, need to re-adjust
31425 		 * blkno and save the index to beginning of dk_label
31426 		 */
31427 		first_byte  = SD_SYSBLOCKS2BYTES(start_block);
31428 		real_addr = first_byte / un->un_tgt_blocksize;
31429 
31430 		end_block = (first_byte + reqlength +
31431 		    un->un_tgt_blocksize - 1) / un->un_tgt_blocksize;
31432 
31433 		/* round up buffer size to multiple of target block size */
31434 		buffer_size = (end_block - real_addr) * un->un_tgt_blocksize;
31435 
31436 		SD_TRACE(SD_LOG_IO_PARTITION, un, "sd_tg_rdwr",
31437 		    "label_addr: 0x%x allocation size: 0x%x\n",
31438 		    real_addr, buffer_size);
31439 
31440 		if (((first_byte % un->un_tgt_blocksize) != 0) ||
31441 		    (reqlength % un->un_tgt_blocksize) != 0)
31442 			/* the request is not aligned */
31443 			dkl = kmem_zalloc(buffer_size, KM_SLEEP);
31444 	}
31445 
31446 	/*
31447 	 * The MMC standard allows READ CAPACITY to be
31448 	 * inaccurate by a bounded amount (in the interest of
31449 	 * response latency).  As a result, failed READs are
31450 	 * commonplace (due to the reading of metadata and not
31451 	 * data). Depending on the per-Vendor/drive Sense data,
31452 	 * the failed READ can cause many (unnecessary) retries.
31453 	 */
31454 
31455 	if (ISCD(un) && (cmd == TG_READ) &&
31456 	    (un->un_f_blockcount_is_valid == TRUE) &&
31457 	    ((start_block == (un->un_blockcount - 1))||
31458 	    (start_block == (un->un_blockcount - 2)))) {
31459 			path_flag = SD_PATH_DIRECT_PRIORITY;
31460 	}
31461 
31462 	mutex_exit(SD_MUTEX(un));
31463 	if (cmd == TG_READ) {
31464 		rval = sd_send_scsi_READ(ssc, (dkl != NULL)? dkl: bufaddr,
31465 		    buffer_size, real_addr, path_flag);
31466 		if (dkl != NULL)
31467 			bcopy(dkl + SD_TGTBYTEOFFSET(un, start_block,
31468 			    real_addr), bufaddr, reqlength);
31469 	} else {
31470 		if (dkl) {
31471 			rval = sd_send_scsi_READ(ssc, dkl, buffer_size,
31472 			    real_addr, path_flag);
31473 			if (rval) {
31474 				goto done1;
31475 			}
31476 			bcopy(bufaddr, dkl + SD_TGTBYTEOFFSET(un, start_block,
31477 			    real_addr), reqlength);
31478 		}
31479 		rval = sd_send_scsi_WRITE(ssc, (dkl != NULL)? dkl: bufaddr,
31480 		    buffer_size, real_addr, path_flag);
31481 	}
31482 
31483 done1:
31484 	if (dkl != NULL)
31485 		kmem_free(dkl, buffer_size);
31486 
31487 	if (rval != 0) {
31488 		if (rval == EIO)
31489 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
31490 		else
31491 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
31492 	}
31493 done:
31494 	sd_ssc_fini(ssc);
31495 	return (rval);
31496 }
31497 
31498 
31499 static int
31500 sd_tg_getinfo(dev_info_t *devi, int cmd, void *arg, void *tg_cookie)
31501 {
31502 
31503 	struct sd_lun *un;
31504 	diskaddr_t	cap;
31505 	uint32_t	lbasize;
31506 	int		path_flag = (int)(uintptr_t)tg_cookie;
31507 	int		ret = 0;
31508 
31509 	un = ddi_get_soft_state(sd_state, ddi_get_instance(devi));
31510 	if (un == NULL)
31511 		return (ENXIO);
31512 
31513 	switch (cmd) {
31514 	case TG_GETPHYGEOM:
31515 	case TG_GETVIRTGEOM:
31516 	case TG_GETCAPACITY:
31517 	case TG_GETBLOCKSIZE:
31518 		mutex_enter(SD_MUTEX(un));
31519 
31520 		if ((un->un_f_blockcount_is_valid == TRUE) &&
31521 		    (un->un_f_tgt_blocksize_is_valid == TRUE)) {
31522 			cap = un->un_blockcount;
31523 			lbasize = un->un_tgt_blocksize;
31524 			mutex_exit(SD_MUTEX(un));
31525 		} else {
31526 			sd_ssc_t	*ssc;
31527 			mutex_exit(SD_MUTEX(un));
31528 			ssc = sd_ssc_init(un);
31529 			ret = sd_send_scsi_READ_CAPACITY(ssc, (uint64_t *)&cap,
31530 			    &lbasize, path_flag);
31531 			if (ret != 0) {
31532 				if (ret == EIO)
31533 					sd_ssc_assessment(ssc,
31534 					    SD_FMT_STATUS_CHECK);
31535 				else
31536 					sd_ssc_assessment(ssc,
31537 					    SD_FMT_IGNORE);
31538 				sd_ssc_fini(ssc);
31539 				return (ret);
31540 			}
31541 			sd_ssc_fini(ssc);
31542 			mutex_enter(SD_MUTEX(un));
31543 			sd_update_block_info(un, lbasize, cap);
31544 			if ((un->un_f_blockcount_is_valid == FALSE) ||
31545 			    (un->un_f_tgt_blocksize_is_valid == FALSE)) {
31546 				mutex_exit(SD_MUTEX(un));
31547 				return (EIO);
31548 			}
31549 			mutex_exit(SD_MUTEX(un));
31550 		}
31551 
31552 		if (cmd == TG_GETCAPACITY) {
31553 			*(diskaddr_t *)arg = cap;
31554 			return (0);
31555 		}
31556 
31557 		if (cmd == TG_GETBLOCKSIZE) {
31558 			*(uint32_t *)arg = lbasize;
31559 			return (0);
31560 		}
31561 
31562 		if (cmd == TG_GETPHYGEOM)
31563 			ret = sd_get_physical_geometry(un, (cmlb_geom_t *)arg,
31564 			    cap, lbasize, path_flag);
31565 		else
31566 			/* TG_GETVIRTGEOM */
31567 			ret = sd_get_virtual_geometry(un,
31568 			    (cmlb_geom_t *)arg, cap, lbasize);
31569 
31570 		return (ret);
31571 
31572 	case TG_GETATTR:
31573 		mutex_enter(SD_MUTEX(un));
31574 		((tg_attribute_t *)arg)->media_is_writable =
31575 		    un->un_f_mmc_writable_media;
31576 		((tg_attribute_t *)arg)->media_is_solid_state =
31577 		    un->un_f_is_solid_state;
31578 		((tg_attribute_t *)arg)->media_is_rotational =
31579 		    un->un_f_is_rotational;
31580 		mutex_exit(SD_MUTEX(un));
31581 		return (0);
31582 	default:
31583 		return (ENOTTY);
31584 
31585 	}
31586 }
31587 
31588 /*
31589  *    Function: sd_ssc_ereport_post
31590  *
31591  * Description: Will be called when SD driver need to post an ereport.
31592  *
31593  *    Context: Kernel thread or interrupt context.
31594  */
31595 
31596 #define	DEVID_IF_KNOWN(d) "devid", DATA_TYPE_STRING, (d) ? (d) : "unknown"
31597 
31598 static void
31599 sd_ssc_ereport_post(sd_ssc_t *ssc, enum sd_driver_assessment drv_assess)
31600 {
31601 	int uscsi_path_instance = 0;
31602 	uchar_t	uscsi_pkt_reason;
31603 	uint32_t uscsi_pkt_state;
31604 	uint32_t uscsi_pkt_statistics;
31605 	uint64_t uscsi_ena;
31606 	uchar_t op_code;
31607 	uint8_t *sensep;
31608 	union scsi_cdb *cdbp;
31609 	uint_t cdblen = 0;
31610 	uint_t senlen = 0;
31611 	struct sd_lun *un;
31612 	dev_info_t *dip;
31613 	char *devid;
31614 	int ssc_invalid_flags = SSC_FLAGS_INVALID_PKT_REASON |
31615 	    SSC_FLAGS_INVALID_STATUS |
31616 	    SSC_FLAGS_INVALID_SENSE |
31617 	    SSC_FLAGS_INVALID_DATA;
31618 	char assessment[16];
31619 
31620 	ASSERT(ssc != NULL);
31621 	ASSERT(ssc->ssc_uscsi_cmd != NULL);
31622 	ASSERT(ssc->ssc_uscsi_info != NULL);
31623 
31624 	un = ssc->ssc_un;
31625 	ASSERT(un != NULL);
31626 
31627 	dip = un->un_sd->sd_dev;
31628 
31629 	/*
31630 	 * Get the devid:
31631 	 *	devid will only be passed to non-transport error reports.
31632 	 */
31633 	devid = DEVI(dip)->devi_devid_str;
31634 
31635 	/*
31636 	 * If we are syncing or dumping, the command will not be executed
31637 	 * so we bypass this situation.
31638 	 */
31639 	if (ddi_in_panic() || (un->un_state == SD_STATE_SUSPENDED) ||
31640 	    (un->un_state == SD_STATE_DUMPING))
31641 		return;
31642 
31643 	uscsi_pkt_reason = ssc->ssc_uscsi_info->ui_pkt_reason;
31644 	uscsi_path_instance = ssc->ssc_uscsi_cmd->uscsi_path_instance;
31645 	uscsi_pkt_state = ssc->ssc_uscsi_info->ui_pkt_state;
31646 	uscsi_pkt_statistics = ssc->ssc_uscsi_info->ui_pkt_statistics;
31647 	uscsi_ena = ssc->ssc_uscsi_info->ui_ena;
31648 
31649 	sensep = (uint8_t *)ssc->ssc_uscsi_cmd->uscsi_rqbuf;
31650 	cdbp = (union scsi_cdb *)ssc->ssc_uscsi_cmd->uscsi_cdb;
31651 
31652 	/* In rare cases, EG:DOORLOCK, the cdb could be NULL */
31653 	if (cdbp == NULL) {
31654 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
31655 		    "sd_ssc_ereport_post meet empty cdb\n");
31656 		return;
31657 	}
31658 
31659 	op_code = cdbp->scc_cmd;
31660 
31661 	cdblen = (int)ssc->ssc_uscsi_cmd->uscsi_cdblen;
31662 	senlen = (int)(ssc->ssc_uscsi_cmd->uscsi_rqlen -
31663 	    ssc->ssc_uscsi_cmd->uscsi_rqresid);
31664 
31665 	if (senlen > 0)
31666 		ASSERT(sensep != NULL);
31667 
31668 	/*
31669 	 * Initialize drv_assess to corresponding values.
31670 	 * SD_FM_DRV_FATAL will be mapped to "fail" or "fatal" depending
31671 	 * on the sense-key returned back.
31672 	 */
31673 	switch (drv_assess) {
31674 		case SD_FM_DRV_RECOVERY:
31675 			(void) sprintf(assessment, "%s", "recovered");
31676 			break;
31677 		case SD_FM_DRV_RETRY:
31678 			(void) sprintf(assessment, "%s", "retry");
31679 			break;
31680 		case SD_FM_DRV_NOTICE:
31681 			(void) sprintf(assessment, "%s", "info");
31682 			break;
31683 		case SD_FM_DRV_FATAL:
31684 		default:
31685 			(void) sprintf(assessment, "%s", "unknown");
31686 	}
31687 	/*
31688 	 * If drv_assess == SD_FM_DRV_RECOVERY, this should be a recovered
31689 	 * command, we will post ereport.io.scsi.cmd.disk.recovered.
31690 	 * driver-assessment will always be "recovered" here.
31691 	 */
31692 	if (drv_assess == SD_FM_DRV_RECOVERY) {
31693 		scsi_fm_ereport_post(un->un_sd, uscsi_path_instance, NULL,
31694 		    "cmd.disk.recovered", uscsi_ena, devid, NULL,
31695 		    DDI_NOSLEEP, NULL,
31696 		    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31697 		    DEVID_IF_KNOWN(devid),
31698 		    "driver-assessment", DATA_TYPE_STRING, assessment,
31699 		    "op-code", DATA_TYPE_UINT8, op_code,
31700 		    "cdb", DATA_TYPE_UINT8_ARRAY,
31701 		    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31702 		    "pkt-reason", DATA_TYPE_UINT8, uscsi_pkt_reason,
31703 		    "pkt-state", DATA_TYPE_UINT32, uscsi_pkt_state,
31704 		    "pkt-stats", DATA_TYPE_UINT32, uscsi_pkt_statistics,
31705 		    NULL);
31706 		return;
31707 	}
31708 
31709 	/*
31710 	 * If there is un-expected/un-decodable data, we should post
31711 	 * ereport.io.scsi.cmd.disk.dev.uderr.
31712 	 * driver-assessment will be set based on parameter drv_assess.
31713 	 * SSC_FLAGS_INVALID_SENSE - invalid sense data sent back.
31714 	 * SSC_FLAGS_INVALID_PKT_REASON - invalid pkt-reason encountered.
31715 	 * SSC_FLAGS_INVALID_STATUS - invalid stat-code encountered.
31716 	 * SSC_FLAGS_INVALID_DATA - invalid data sent back.
31717 	 */
31718 	if (ssc->ssc_flags & ssc_invalid_flags) {
31719 		if (ssc->ssc_flags & SSC_FLAGS_INVALID_SENSE) {
31720 			scsi_fm_ereport_post(un->un_sd, uscsi_path_instance,
31721 			    NULL, "cmd.disk.dev.uderr", uscsi_ena, devid,
31722 			    NULL, DDI_NOSLEEP, NULL,
31723 			    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31724 			    DEVID_IF_KNOWN(devid),
31725 			    "driver-assessment", DATA_TYPE_STRING,
31726 			    drv_assess == SD_FM_DRV_FATAL ?
31727 			    "fail" : assessment,
31728 			    "op-code", DATA_TYPE_UINT8, op_code,
31729 			    "cdb", DATA_TYPE_UINT8_ARRAY,
31730 			    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31731 			    "pkt-reason", DATA_TYPE_UINT8, uscsi_pkt_reason,
31732 			    "pkt-state", DATA_TYPE_UINT32, uscsi_pkt_state,
31733 			    "pkt-stats", DATA_TYPE_UINT32,
31734 			    uscsi_pkt_statistics,
31735 			    "stat-code", DATA_TYPE_UINT8,
31736 			    ssc->ssc_uscsi_cmd->uscsi_status,
31737 			    "un-decode-info", DATA_TYPE_STRING,
31738 			    ssc->ssc_info,
31739 			    "un-decode-value", DATA_TYPE_UINT8_ARRAY,
31740 			    senlen, sensep,
31741 			    NULL);
31742 		} else {
31743 			/*
31744 			 * For other type of invalid data, the
31745 			 * un-decode-value field would be empty because the
31746 			 * un-decodable content could be seen from upper
31747 			 * level payload or inside un-decode-info.
31748 			 */
31749 			scsi_fm_ereport_post(un->un_sd, uscsi_path_instance,
31750 			    NULL,
31751 			    "cmd.disk.dev.uderr", uscsi_ena, devid,
31752 			    NULL, DDI_NOSLEEP, NULL,
31753 			    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31754 			    DEVID_IF_KNOWN(devid),
31755 			    "driver-assessment", DATA_TYPE_STRING,
31756 			    drv_assess == SD_FM_DRV_FATAL ?
31757 			    "fail" : assessment,
31758 			    "op-code", DATA_TYPE_UINT8, op_code,
31759 			    "cdb", DATA_TYPE_UINT8_ARRAY,
31760 			    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31761 			    "pkt-reason", DATA_TYPE_UINT8, uscsi_pkt_reason,
31762 			    "pkt-state", DATA_TYPE_UINT32, uscsi_pkt_state,
31763 			    "pkt-stats", DATA_TYPE_UINT32,
31764 			    uscsi_pkt_statistics,
31765 			    "stat-code", DATA_TYPE_UINT8,
31766 			    ssc->ssc_uscsi_cmd->uscsi_status,
31767 			    "un-decode-info", DATA_TYPE_STRING,
31768 			    ssc->ssc_info,
31769 			    "un-decode-value", DATA_TYPE_UINT8_ARRAY,
31770 			    0, NULL,
31771 			    NULL);
31772 		}
31773 		ssc->ssc_flags &= ~ssc_invalid_flags;
31774 		return;
31775 	}
31776 
31777 	if (uscsi_pkt_reason != CMD_CMPLT ||
31778 	    (ssc->ssc_flags & SSC_FLAGS_TRAN_ABORT)) {
31779 		/*
31780 		 * pkt-reason != CMD_CMPLT or SSC_FLAGS_TRAN_ABORT was
31781 		 * set inside sd_start_cmds due to errors(bad packet or
31782 		 * fatal transport error), we should take it as a
31783 		 * transport error, so we post ereport.io.scsi.cmd.disk.tran.
31784 		 * driver-assessment will be set based on drv_assess.
31785 		 * We will set devid to NULL because it is a transport
31786 		 * error.
31787 		 */
31788 		if (ssc->ssc_flags & SSC_FLAGS_TRAN_ABORT)
31789 			ssc->ssc_flags &= ~SSC_FLAGS_TRAN_ABORT;
31790 
31791 		scsi_fm_ereport_post(un->un_sd, uscsi_path_instance, NULL,
31792 		    "cmd.disk.tran", uscsi_ena, NULL, NULL, DDI_NOSLEEP, NULL,
31793 		    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31794 		    DEVID_IF_KNOWN(devid),
31795 		    "driver-assessment", DATA_TYPE_STRING,
31796 		    drv_assess == SD_FM_DRV_FATAL ? "fail" : assessment,
31797 		    "op-code", DATA_TYPE_UINT8, op_code,
31798 		    "cdb", DATA_TYPE_UINT8_ARRAY,
31799 		    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31800 		    "pkt-reason", DATA_TYPE_UINT8, uscsi_pkt_reason,
31801 		    "pkt-state", DATA_TYPE_UINT8, uscsi_pkt_state,
31802 		    "pkt-stats", DATA_TYPE_UINT32, uscsi_pkt_statistics,
31803 		    NULL);
31804 	} else {
31805 		/*
31806 		 * If we got here, we have a completed command, and we need
31807 		 * to further investigate the sense data to see what kind
31808 		 * of ereport we should post.
31809 		 * No ereport is needed if sense-key is KEY_RECOVERABLE_ERROR
31810 		 * and asc/ascq is "ATA PASS-THROUGH INFORMATION AVAILABLE".
31811 		 * Post ereport.io.scsi.cmd.disk.dev.rqs.merr if sense-key is
31812 		 * KEY_MEDIUM_ERROR.
31813 		 * Post ereport.io.scsi.cmd.disk.dev.rqs.derr otherwise.
31814 		 * driver-assessment will be set based on the parameter
31815 		 * drv_assess.
31816 		 */
31817 		if (senlen > 0) {
31818 			/*
31819 			 * Here we have sense data available.
31820 			 */
31821 			uint8_t sense_key = scsi_sense_key(sensep);
31822 			uint8_t sense_asc = scsi_sense_asc(sensep);
31823 			uint8_t sense_ascq = scsi_sense_ascq(sensep);
31824 
31825 			if (sense_key == KEY_RECOVERABLE_ERROR &&
31826 			    sense_asc == 0x00 && sense_ascq == 0x1d)
31827 				return;
31828 
31829 			if (sense_key == KEY_MEDIUM_ERROR) {
31830 				/*
31831 				 * driver-assessment should be "fatal" if
31832 				 * drv_assess is SD_FM_DRV_FATAL.
31833 				 */
31834 				scsi_fm_ereport_post(un->un_sd,
31835 				    uscsi_path_instance, NULL,
31836 				    "cmd.disk.dev.rqs.merr",
31837 				    uscsi_ena, devid, NULL, DDI_NOSLEEP, NULL,
31838 				    FM_VERSION, DATA_TYPE_UINT8,
31839 				    FM_EREPORT_VERS0,
31840 				    DEVID_IF_KNOWN(devid),
31841 				    "driver-assessment",
31842 				    DATA_TYPE_STRING,
31843 				    drv_assess == SD_FM_DRV_FATAL ?
31844 				    "fatal" : assessment,
31845 				    "op-code",
31846 				    DATA_TYPE_UINT8, op_code,
31847 				    "cdb",
31848 				    DATA_TYPE_UINT8_ARRAY, cdblen,
31849 				    ssc->ssc_uscsi_cmd->uscsi_cdb,
31850 				    "pkt-reason",
31851 				    DATA_TYPE_UINT8, uscsi_pkt_reason,
31852 				    "pkt-state",
31853 				    DATA_TYPE_UINT8, uscsi_pkt_state,
31854 				    "pkt-stats",
31855 				    DATA_TYPE_UINT32,
31856 				    uscsi_pkt_statistics,
31857 				    "stat-code",
31858 				    DATA_TYPE_UINT8,
31859 				    ssc->ssc_uscsi_cmd->uscsi_status,
31860 				    "key",
31861 				    DATA_TYPE_UINT8,
31862 				    scsi_sense_key(sensep),
31863 				    "asc",
31864 				    DATA_TYPE_UINT8,
31865 				    scsi_sense_asc(sensep),
31866 				    "ascq",
31867 				    DATA_TYPE_UINT8,
31868 				    scsi_sense_ascq(sensep),
31869 				    "sense-data",
31870 				    DATA_TYPE_UINT8_ARRAY,
31871 				    senlen, sensep,
31872 				    "lba",
31873 				    DATA_TYPE_UINT64,
31874 				    ssc->ssc_uscsi_info->ui_lba,
31875 				    NULL);
31876 			} else {
31877 				/*
31878 				 * if sense-key == 0x4(hardware
31879 				 * error), driver-assessment should
31880 				 * be "fatal" if drv_assess is
31881 				 * SD_FM_DRV_FATAL.
31882 				 */
31883 				scsi_fm_ereport_post(un->un_sd,
31884 				    uscsi_path_instance, NULL,
31885 				    "cmd.disk.dev.rqs.derr",
31886 				    uscsi_ena, devid,
31887 				    NULL, DDI_NOSLEEP, NULL,
31888 				    FM_VERSION,
31889 				    DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31890 				    DEVID_IF_KNOWN(devid),
31891 				    "driver-assessment",
31892 				    DATA_TYPE_STRING,
31893 				    drv_assess == SD_FM_DRV_FATAL ?
31894 				    (sense_key == 0x4 ?
31895 				    "fatal" : "fail") : assessment,
31896 				    "op-code",
31897 				    DATA_TYPE_UINT8, op_code,
31898 				    "cdb",
31899 				    DATA_TYPE_UINT8_ARRAY, cdblen,
31900 				    ssc->ssc_uscsi_cmd->uscsi_cdb,
31901 				    "pkt-reason",
31902 				    DATA_TYPE_UINT8, uscsi_pkt_reason,
31903 				    "pkt-state",
31904 				    DATA_TYPE_UINT8, uscsi_pkt_state,
31905 				    "pkt-stats",
31906 				    DATA_TYPE_UINT32,
31907 				    uscsi_pkt_statistics,
31908 				    "stat-code",
31909 				    DATA_TYPE_UINT8,
31910 				    ssc->ssc_uscsi_cmd->uscsi_status,
31911 				    "key",
31912 				    DATA_TYPE_UINT8,
31913 				    scsi_sense_key(sensep),
31914 				    "asc",
31915 				    DATA_TYPE_UINT8,
31916 				    scsi_sense_asc(sensep),
31917 				    "ascq",
31918 				    DATA_TYPE_UINT8,
31919 				    scsi_sense_ascq(sensep),
31920 				    "sense-data",
31921 				    DATA_TYPE_UINT8_ARRAY,
31922 				    senlen, sensep,
31923 				    NULL);
31924 			}
31925 		} else {
31926 			/*
31927 			 * For stat_code == STATUS_GOOD, this is not a
31928 			 * hardware error.
31929 			 */
31930 			if (ssc->ssc_uscsi_cmd->uscsi_status == STATUS_GOOD)
31931 				return;
31932 
31933 			/*
31934 			 * Post ereport.io.scsi.cmd.disk.dev.serr if we got the
31935 			 * stat-code but with sense data unavailable.
31936 			 * driver-assessment will be set based on parameter
31937 			 * drv_assess.
31938 			 */
31939 			scsi_fm_ereport_post(un->un_sd, uscsi_path_instance,
31940 			    NULL,
31941 			    "cmd.disk.dev.serr", uscsi_ena,
31942 			    devid, NULL, DDI_NOSLEEP, NULL,
31943 			    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31944 			    DEVID_IF_KNOWN(devid),
31945 			    "driver-assessment", DATA_TYPE_STRING,
31946 			    drv_assess == SD_FM_DRV_FATAL ? "fail" : assessment,
31947 			    "op-code", DATA_TYPE_UINT8, op_code,
31948 			    "cdb",
31949 			    DATA_TYPE_UINT8_ARRAY,
31950 			    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31951 			    "pkt-reason",
31952 			    DATA_TYPE_UINT8, uscsi_pkt_reason,
31953 			    "pkt-state",
31954 			    DATA_TYPE_UINT8, uscsi_pkt_state,
31955 			    "pkt-stats",
31956 			    DATA_TYPE_UINT32, uscsi_pkt_statistics,
31957 			    "stat-code",
31958 			    DATA_TYPE_UINT8,
31959 			    ssc->ssc_uscsi_cmd->uscsi_status,
31960 			    NULL);
31961 		}
31962 	}
31963 }
31964 
31965 /*
31966  *     Function: sd_ssc_extract_info
31967  *
31968  * Description: Extract information available to help generate ereport.
31969  *
31970  *     Context: Kernel thread or interrupt context.
31971  */
31972 static void
31973 sd_ssc_extract_info(sd_ssc_t *ssc, struct sd_lun *un, struct scsi_pkt *pktp,
31974     struct buf *bp, struct sd_xbuf *xp)
31975 {
31976 	size_t senlen = 0;
31977 	union scsi_cdb *cdbp;
31978 	int path_instance;
31979 	/*
31980 	 * Need scsi_cdb_size array to determine the cdb length.
31981 	 */
31982 	extern uchar_t	scsi_cdb_size[];
31983 
31984 	ASSERT(un != NULL);
31985 	ASSERT(pktp != NULL);
31986 	ASSERT(bp != NULL);
31987 	ASSERT(xp != NULL);
31988 	ASSERT(ssc != NULL);
31989 	ASSERT(mutex_owned(SD_MUTEX(un)));
31990 
31991 	/*
31992 	 * Transfer the cdb buffer pointer here.
31993 	 */
31994 	cdbp = (union scsi_cdb *)pktp->pkt_cdbp;
31995 
31996 	ssc->ssc_uscsi_cmd->uscsi_cdblen = scsi_cdb_size[GETGROUP(cdbp)];
31997 	ssc->ssc_uscsi_cmd->uscsi_cdb = (caddr_t)cdbp;
31998 
31999 	/*
32000 	 * Transfer the sense data buffer pointer if sense data is available,
32001 	 * calculate the sense data length first.
32002 	 */
32003 	if ((xp->xb_sense_state & STATE_XARQ_DONE) ||
32004 	    (xp->xb_sense_state & STATE_ARQ_DONE)) {
32005 		/*
32006 		 * For arq case, we will enter here.
32007 		 */
32008 		if (xp->xb_sense_state & STATE_XARQ_DONE) {
32009 			senlen = MAX_SENSE_LENGTH - xp->xb_sense_resid;
32010 		} else {
32011 			senlen = SENSE_LENGTH;
32012 		}
32013 	} else {
32014 		/*
32015 		 * For non-arq case, we will enter this branch.
32016 		 */
32017 		if (SD_GET_PKT_STATUS(pktp) == STATUS_CHECK &&
32018 		    (xp->xb_sense_state & STATE_XFERRED_DATA)) {
32019 			senlen = SENSE_LENGTH - xp->xb_sense_resid;
32020 		}
32021 
32022 	}
32023 
32024 	ssc->ssc_uscsi_cmd->uscsi_rqlen = (senlen & 0xff);
32025 	ssc->ssc_uscsi_cmd->uscsi_rqresid = 0;
32026 	ssc->ssc_uscsi_cmd->uscsi_rqbuf = (caddr_t)xp->xb_sense_data;
32027 
32028 	ssc->ssc_uscsi_cmd->uscsi_status = ((*(pktp)->pkt_scbp) & STATUS_MASK);
32029 
32030 	/*
32031 	 * Only transfer path_instance when scsi_pkt was properly allocated.
32032 	 */
32033 	path_instance = pktp->pkt_path_instance;
32034 	if (scsi_pkt_allocated_correctly(pktp) && path_instance)
32035 		ssc->ssc_uscsi_cmd->uscsi_path_instance = path_instance;
32036 	else
32037 		ssc->ssc_uscsi_cmd->uscsi_path_instance = 0;
32038 
32039 	/*
32040 	 * Copy in the other fields we may need when posting ereport.
32041 	 */
32042 	ssc->ssc_uscsi_info->ui_pkt_reason = pktp->pkt_reason;
32043 	ssc->ssc_uscsi_info->ui_pkt_state = pktp->pkt_state;
32044 	ssc->ssc_uscsi_info->ui_pkt_statistics = pktp->pkt_statistics;
32045 	ssc->ssc_uscsi_info->ui_lba = (uint64_t)SD_GET_BLKNO(bp);
32046 
32047 	/*
32048 	 * For partially read/write command, we will not create ena
32049 	 * in case of a successful command be reconized as recovered.
32050 	 */
32051 	if ((pktp->pkt_reason == CMD_CMPLT) &&
32052 	    (ssc->ssc_uscsi_cmd->uscsi_status == STATUS_GOOD) &&
32053 	    (senlen == 0)) {
32054 		return;
32055 	}
32056 
32057 	/*
32058 	 * To associate ereports of a single command execution flow, we
32059 	 * need a shared ena for a specific command.
32060 	 */
32061 	if (xp->xb_ena == 0)
32062 		xp->xb_ena = fm_ena_generate(0, FM_ENA_FMT1);
32063 	ssc->ssc_uscsi_info->ui_ena = xp->xb_ena;
32064 }
32065 
32066 
32067 /*
32068  *     Function: sd_check_bdc_vpd
32069  *
32070  * Description: Query the optional INQUIRY VPD page 0xb1. If the device
32071  *              supports VPD page 0xb1, sd examines the MEDIUM ROTATION
32072  *              RATE.
32073  *
32074  *		Set the following based on RPM value:
32075  *		= 0	device is not solid state, non-rotational
32076  *		= 1	device is solid state, non-rotational
32077  *		> 1	device is not solid state, rotational
32078  *
32079  *     Context: Kernel thread or interrupt context.
32080  */
32081 
32082 static void
32083 sd_check_bdc_vpd(sd_ssc_t *ssc)
32084 {
32085 	int		rval		= 0;
32086 	uchar_t		*inqb1		= NULL;
32087 	size_t		inqb1_len	= MAX_INQUIRY_SIZE;
32088 	size_t		inqb1_resid	= 0;
32089 	struct sd_lun	*un;
32090 
32091 	ASSERT(ssc != NULL);
32092 	un = ssc->ssc_un;
32093 	ASSERT(un != NULL);
32094 	ASSERT(!mutex_owned(SD_MUTEX(un)));
32095 
32096 	mutex_enter(SD_MUTEX(un));
32097 	un->un_f_is_rotational = TRUE;
32098 	un->un_f_is_solid_state = FALSE;
32099 
32100 	if (ISCD(un)) {
32101 		mutex_exit(SD_MUTEX(un));
32102 		return;
32103 	}
32104 
32105 	if (sd_check_vpd_page_support(ssc) == 0 &&
32106 	    un->un_vpd_page_mask & SD_VPD_DEV_CHARACTER_PG) {
32107 		mutex_exit(SD_MUTEX(un));
32108 		/* collect page b1 data */
32109 		inqb1 = kmem_zalloc(inqb1_len, KM_SLEEP);
32110 
32111 		rval = sd_send_scsi_INQUIRY(ssc, inqb1, inqb1_len,
32112 		    0x01, 0xB1, &inqb1_resid);
32113 
32114 		if (rval == 0 && (inqb1_len - inqb1_resid > 5)) {
32115 			SD_TRACE(SD_LOG_COMMON, un,
32116 			    "sd_check_bdc_vpd: \
32117 			    successfully get VPD page: %x \
32118 			    PAGE LENGTH: %x BYTE 4: %x \
32119 			    BYTE 5: %x", inqb1[1], inqb1[3], inqb1[4],
32120 			    inqb1[5]);
32121 
32122 			mutex_enter(SD_MUTEX(un));
32123 			/*
32124 			 * Check the MEDIUM ROTATION RATE.
32125 			 */
32126 			if (inqb1[4] == 0) {
32127 				if (inqb1[5] == 0) {
32128 					un->un_f_is_rotational = FALSE;
32129 				} else if (inqb1[5] == 1) {
32130 					un->un_f_is_rotational = FALSE;
32131 					un->un_f_is_solid_state = TRUE;
32132 					/*
32133 					 * Solid state drives don't need
32134 					 * disksort.
32135 					 */
32136 					un->un_f_disksort_disabled = TRUE;
32137 				}
32138 			}
32139 			mutex_exit(SD_MUTEX(un));
32140 		} else if (rval != 0) {
32141 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
32142 		}
32143 
32144 		kmem_free(inqb1, inqb1_len);
32145 	} else {
32146 		mutex_exit(SD_MUTEX(un));
32147 	}
32148 }
32149 
32150 /*
32151  *	Function: sd_check_emulation_mode
32152  *
32153  *   Description: Check whether the SSD is at emulation mode
32154  *		  by issuing READ_CAPACITY_16 to see whether
32155  *		  we can get physical block size of the drive.
32156  *
32157  *	 Context: Kernel thread or interrupt context.
32158  */
32159 
32160 static void
32161 sd_check_emulation_mode(sd_ssc_t *ssc)
32162 {
32163 	int		rval = 0;
32164 	uint64_t	capacity;
32165 	uint_t		lbasize;
32166 	uint_t		pbsize;
32167 	int		i;
32168 	int		devid_len;
32169 	struct sd_lun	*un;
32170 
32171 	ASSERT(ssc != NULL);
32172 	un = ssc->ssc_un;
32173 	ASSERT(un != NULL);
32174 	ASSERT(!mutex_owned(SD_MUTEX(un)));
32175 
32176 	mutex_enter(SD_MUTEX(un));
32177 	if (ISCD(un)) {
32178 		mutex_exit(SD_MUTEX(un));
32179 		return;
32180 	}
32181 
32182 	if (un->un_f_descr_format_supported) {
32183 		mutex_exit(SD_MUTEX(un));
32184 		rval = sd_send_scsi_READ_CAPACITY_16(ssc, &capacity, &lbasize,
32185 		    &pbsize, SD_PATH_DIRECT);
32186 		mutex_enter(SD_MUTEX(un));
32187 
32188 		if (rval != 0) {
32189 			un->un_phy_blocksize = DEV_BSIZE;
32190 		} else {
32191 			if (!ISP2(pbsize % DEV_BSIZE) || pbsize == 0) {
32192 				un->un_phy_blocksize = DEV_BSIZE;
32193 			} else if (pbsize > un->un_phy_blocksize) {
32194 				/*
32195 				 * Don't reset the physical blocksize
32196 				 * unless we've detected a larger value.
32197 				 */
32198 				un->un_phy_blocksize = pbsize;
32199 			}
32200 		}
32201 	}
32202 
32203 	for (i = 0; i < sd_flash_dev_table_size; i++) {
32204 		devid_len = (int)strlen(sd_flash_dev_table[i]);
32205 		if (sd_sdconf_id_match(un, sd_flash_dev_table[i], devid_len)
32206 		    == SD_SUCCESS) {
32207 			un->un_phy_blocksize = SSD_SECSIZE;
32208 			if (un->un_f_is_solid_state &&
32209 			    un->un_phy_blocksize != un->un_tgt_blocksize)
32210 				un->un_f_enable_rmw = TRUE;
32211 		}
32212 	}
32213 
32214 	mutex_exit(SD_MUTEX(un));
32215 }
32216