xref: /illumos-gate/usr/src/uts/common/io/scsi/targets/sd.c (revision 34de8762)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * SCSI disk target driver.
29  */
30 #include <sys/scsi/scsi.h>
31 #include <sys/dkbad.h>
32 #include <sys/dklabel.h>
33 #include <sys/dkio.h>
34 #include <sys/fdio.h>
35 #include <sys/cdio.h>
36 #include <sys/mhd.h>
37 #include <sys/vtoc.h>
38 #include <sys/dktp/fdisk.h>
39 #include <sys/kstat.h>
40 #include <sys/vtrace.h>
41 #include <sys/note.h>
42 #include <sys/thread.h>
43 #include <sys/proc.h>
44 #include <sys/efi_partition.h>
45 #include <sys/var.h>
46 #include <sys/aio_req.h>
47 
48 #ifdef __lock_lint
49 #define	_LP64
50 #define	__amd64
51 #endif
52 
53 #if (defined(__fibre))
54 /* Note: is there a leadville version of the following? */
55 #include <sys/fc4/fcal_linkapp.h>
56 #endif
57 #include <sys/taskq.h>
58 #include <sys/uuid.h>
59 #include <sys/byteorder.h>
60 #include <sys/sdt.h>
61 
62 #include "sd_xbuf.h"
63 
64 #include <sys/scsi/targets/sddef.h>
65 #include <sys/cmlb.h>
66 #include <sys/sysevent/eventdefs.h>
67 #include <sys/sysevent/dev.h>
68 
69 #include <sys/fm/protocol.h>
70 
71 /*
72  * Loadable module info.
73  */
74 #if (defined(__fibre))
75 #define	SD_MODULE_NAME	"SCSI SSA/FCAL Disk Driver"
76 char _depends_on[]	= "misc/scsi misc/cmlb drv/fcp";
77 #else /* !__fibre */
78 #define	SD_MODULE_NAME	"SCSI Disk Driver"
79 char _depends_on[]	= "misc/scsi misc/cmlb";
80 #endif /* !__fibre */
81 
82 /*
83  * Define the interconnect type, to allow the driver to distinguish
84  * between parallel SCSI (sd) and fibre channel (ssd) behaviors.
85  *
86  * This is really for backward compatibility. In the future, the driver
87  * should actually check the "interconnect-type" property as reported by
88  * the HBA; however at present this property is not defined by all HBAs,
89  * so we will use this #define (1) to permit the driver to run in
90  * backward-compatibility mode; and (2) to print a notification message
91  * if an FC HBA does not support the "interconnect-type" property.  The
92  * behavior of the driver will be to assume parallel SCSI behaviors unless
93  * the "interconnect-type" property is defined by the HBA **AND** has a
94  * value of either INTERCONNECT_FIBRE, INTERCONNECT_SSA, or
95  * INTERCONNECT_FABRIC, in which case the driver will assume Fibre
96  * Channel behaviors (as per the old ssd).  (Note that the
97  * INTERCONNECT_1394 and INTERCONNECT_USB types are not supported and
98  * will result in the driver assuming parallel SCSI behaviors.)
99  *
100  * (see common/sys/scsi/impl/services.h)
101  *
102  * Note: For ssd semantics, don't use INTERCONNECT_FABRIC as the default
103  * since some FC HBAs may already support that, and there is some code in
104  * the driver that already looks for it.  Using INTERCONNECT_FABRIC as the
105  * default would confuse that code, and besides things should work fine
106  * anyways if the FC HBA already reports INTERCONNECT_FABRIC for the
107  * "interconnect_type" property.
108  *
109  */
110 #if (defined(__fibre))
111 #define	SD_DEFAULT_INTERCONNECT_TYPE	SD_INTERCONNECT_FIBRE
112 #else
113 #define	SD_DEFAULT_INTERCONNECT_TYPE	SD_INTERCONNECT_PARALLEL
114 #endif
115 
116 /*
117  * The name of the driver, established from the module name in _init.
118  */
119 static	char *sd_label			= NULL;
120 
121 /*
122  * Driver name is unfortunately prefixed on some driver.conf properties.
123  */
124 #if (defined(__fibre))
125 #define	sd_max_xfer_size		ssd_max_xfer_size
126 #define	sd_config_list			ssd_config_list
127 static	char *sd_max_xfer_size		= "ssd_max_xfer_size";
128 static	char *sd_config_list		= "ssd-config-list";
129 #else
130 static	char *sd_max_xfer_size		= "sd_max_xfer_size";
131 static	char *sd_config_list		= "sd-config-list";
132 #endif
133 
134 /*
135  * Driver global variables
136  */
137 
138 #if (defined(__fibre))
139 /*
140  * These #defines are to avoid namespace collisions that occur because this
141  * code is currently used to compile two separate driver modules: sd and ssd.
142  * All global variables need to be treated this way (even if declared static)
143  * in order to allow the debugger to resolve the names properly.
144  * It is anticipated that in the near future the ssd module will be obsoleted,
145  * at which time this namespace issue should go away.
146  */
147 #define	sd_state			ssd_state
148 #define	sd_io_time			ssd_io_time
149 #define	sd_failfast_enable		ssd_failfast_enable
150 #define	sd_ua_retry_count		ssd_ua_retry_count
151 #define	sd_report_pfa			ssd_report_pfa
152 #define	sd_max_throttle			ssd_max_throttle
153 #define	sd_min_throttle			ssd_min_throttle
154 #define	sd_rot_delay			ssd_rot_delay
155 
156 #define	sd_retry_on_reservation_conflict	\
157 					ssd_retry_on_reservation_conflict
158 #define	sd_reinstate_resv_delay		ssd_reinstate_resv_delay
159 #define	sd_resv_conflict_name		ssd_resv_conflict_name
160 
161 #define	sd_component_mask		ssd_component_mask
162 #define	sd_level_mask			ssd_level_mask
163 #define	sd_debug_un			ssd_debug_un
164 #define	sd_error_level			ssd_error_level
165 
166 #define	sd_xbuf_active_limit		ssd_xbuf_active_limit
167 #define	sd_xbuf_reserve_limit		ssd_xbuf_reserve_limit
168 
169 #define	sd_tr				ssd_tr
170 #define	sd_reset_throttle_timeout	ssd_reset_throttle_timeout
171 #define	sd_qfull_throttle_timeout	ssd_qfull_throttle_timeout
172 #define	sd_qfull_throttle_enable	ssd_qfull_throttle_enable
173 #define	sd_check_media_time		ssd_check_media_time
174 #define	sd_wait_cmds_complete		ssd_wait_cmds_complete
175 #define	sd_label_mutex			ssd_label_mutex
176 #define	sd_detach_mutex			ssd_detach_mutex
177 #define	sd_log_buf			ssd_log_buf
178 #define	sd_log_mutex			ssd_log_mutex
179 
180 #define	sd_disk_table			ssd_disk_table
181 #define	sd_disk_table_size		ssd_disk_table_size
182 #define	sd_sense_mutex			ssd_sense_mutex
183 #define	sd_cdbtab			ssd_cdbtab
184 
185 #define	sd_cb_ops			ssd_cb_ops
186 #define	sd_ops				ssd_ops
187 #define	sd_additional_codes		ssd_additional_codes
188 #define	sd_tgops			ssd_tgops
189 
190 #define	sd_minor_data			ssd_minor_data
191 #define	sd_minor_data_efi		ssd_minor_data_efi
192 
193 #define	sd_tq				ssd_tq
194 #define	sd_wmr_tq			ssd_wmr_tq
195 #define	sd_taskq_name			ssd_taskq_name
196 #define	sd_wmr_taskq_name		ssd_wmr_taskq_name
197 #define	sd_taskq_minalloc		ssd_taskq_minalloc
198 #define	sd_taskq_maxalloc		ssd_taskq_maxalloc
199 
200 #define	sd_dump_format_string		ssd_dump_format_string
201 
202 #define	sd_iostart_chain		ssd_iostart_chain
203 #define	sd_iodone_chain			ssd_iodone_chain
204 
205 #define	sd_pm_idletime			ssd_pm_idletime
206 
207 #define	sd_force_pm_supported		ssd_force_pm_supported
208 
209 #define	sd_dtype_optical_bind		ssd_dtype_optical_bind
210 
211 #define	sd_ssc_init			ssd_ssc_init
212 #define	sd_ssc_send			ssd_ssc_send
213 #define	sd_ssc_fini			ssd_ssc_fini
214 #define	sd_ssc_assessment		ssd_ssc_assessment
215 #define	sd_ssc_post			ssd_ssc_post
216 #define	sd_ssc_print			ssd_ssc_print
217 #define	sd_ssc_ereport_post		ssd_ssc_ereport_post
218 #define	sd_ssc_set_info			ssd_ssc_set_info
219 #define	sd_ssc_extract_info		ssd_ssc_extract_info
220 
221 #endif
222 
223 #ifdef	SDDEBUG
224 int	sd_force_pm_supported		= 0;
225 #endif	/* SDDEBUG */
226 
227 void *sd_state				= NULL;
228 int sd_io_time				= SD_IO_TIME;
229 int sd_failfast_enable			= 1;
230 int sd_ua_retry_count			= SD_UA_RETRY_COUNT;
231 int sd_report_pfa			= 1;
232 int sd_max_throttle			= SD_MAX_THROTTLE;
233 int sd_min_throttle			= SD_MIN_THROTTLE;
234 int sd_rot_delay			= 4; /* Default 4ms Rotation delay */
235 int sd_qfull_throttle_enable		= TRUE;
236 
237 int sd_retry_on_reservation_conflict	= 1;
238 int sd_reinstate_resv_delay		= SD_REINSTATE_RESV_DELAY;
239 _NOTE(SCHEME_PROTECTS_DATA("safe sharing", sd_reinstate_resv_delay))
240 
241 static int sd_dtype_optical_bind	= -1;
242 
243 /* Note: the following is not a bug, it really is "sd_" and not "ssd_" */
244 static	char *sd_resv_conflict_name	= "sd_retry_on_reservation_conflict";
245 
246 /*
247  * Global data for debug logging. To enable debug printing, sd_component_mask
248  * and sd_level_mask should be set to the desired bit patterns as outlined in
249  * sddef.h.
250  */
251 uint_t	sd_component_mask		= 0x0;
252 uint_t	sd_level_mask			= 0x0;
253 struct	sd_lun *sd_debug_un		= NULL;
254 uint_t	sd_error_level			= SCSI_ERR_RETRYABLE;
255 
256 /* Note: these may go away in the future... */
257 static uint32_t	sd_xbuf_active_limit	= 512;
258 static uint32_t sd_xbuf_reserve_limit	= 16;
259 
260 static struct sd_resv_reclaim_request	sd_tr = { NULL, NULL, NULL, 0, 0, 0 };
261 
262 /*
263  * Timer value used to reset the throttle after it has been reduced
264  * (typically in response to TRAN_BUSY or STATUS_QFULL)
265  */
266 static int sd_reset_throttle_timeout	= SD_RESET_THROTTLE_TIMEOUT;
267 static int sd_qfull_throttle_timeout	= SD_QFULL_THROTTLE_TIMEOUT;
268 
269 /*
270  * Interval value associated with the media change scsi watch.
271  */
272 static int sd_check_media_time		= 3000000;
273 
274 /*
275  * Wait value used for in progress operations during a DDI_SUSPEND
276  */
277 static int sd_wait_cmds_complete	= SD_WAIT_CMDS_COMPLETE;
278 
279 /*
280  * sd_label_mutex protects a static buffer used in the disk label
281  * component of the driver
282  */
283 static kmutex_t sd_label_mutex;
284 
285 /*
286  * sd_detach_mutex protects un_layer_count, un_detach_count, and
287  * un_opens_in_progress in the sd_lun structure.
288  */
289 static kmutex_t sd_detach_mutex;
290 
291 _NOTE(MUTEX_PROTECTS_DATA(sd_detach_mutex,
292 	sd_lun::{un_layer_count un_detach_count un_opens_in_progress}))
293 
294 /*
295  * Global buffer and mutex for debug logging
296  */
297 static char	sd_log_buf[1024];
298 static kmutex_t	sd_log_mutex;
299 
300 /*
301  * Structs and globals for recording attached lun information.
302  * This maintains a chain. Each node in the chain represents a SCSI controller.
303  * The structure records the number of luns attached to each target connected
304  * with the controller.
305  * For parallel scsi device only.
306  */
307 struct sd_scsi_hba_tgt_lun {
308 	struct sd_scsi_hba_tgt_lun	*next;
309 	dev_info_t			*pdip;
310 	int				nlun[NTARGETS_WIDE];
311 };
312 
313 /*
314  * Flag to indicate the lun is attached or detached
315  */
316 #define	SD_SCSI_LUN_ATTACH	0
317 #define	SD_SCSI_LUN_DETACH	1
318 
319 static kmutex_t	sd_scsi_target_lun_mutex;
320 static struct sd_scsi_hba_tgt_lun	*sd_scsi_target_lun_head = NULL;
321 
322 _NOTE(MUTEX_PROTECTS_DATA(sd_scsi_target_lun_mutex,
323     sd_scsi_hba_tgt_lun::next sd_scsi_hba_tgt_lun::pdip))
324 
325 _NOTE(MUTEX_PROTECTS_DATA(sd_scsi_target_lun_mutex,
326     sd_scsi_target_lun_head))
327 
328 /*
329  * "Smart" Probe Caching structs, globals, #defines, etc.
330  * For parallel scsi and non-self-identify device only.
331  */
332 
333 /*
334  * The following resources and routines are implemented to support
335  * "smart" probing, which caches the scsi_probe() results in an array,
336  * in order to help avoid long probe times.
337  */
338 struct sd_scsi_probe_cache {
339 	struct	sd_scsi_probe_cache	*next;
340 	dev_info_t	*pdip;
341 	int		cache[NTARGETS_WIDE];
342 };
343 
344 static kmutex_t	sd_scsi_probe_cache_mutex;
345 static struct	sd_scsi_probe_cache *sd_scsi_probe_cache_head = NULL;
346 
347 /*
348  * Really we only need protection on the head of the linked list, but
349  * better safe than sorry.
350  */
351 _NOTE(MUTEX_PROTECTS_DATA(sd_scsi_probe_cache_mutex,
352     sd_scsi_probe_cache::next sd_scsi_probe_cache::pdip))
353 
354 _NOTE(MUTEX_PROTECTS_DATA(sd_scsi_probe_cache_mutex,
355     sd_scsi_probe_cache_head))
356 
357 /*
358  * Power attribute table
359  */
360 static sd_power_attr_ss sd_pwr_ss = {
361 	{ "NAME=spindle-motor", "0=off", "1=on", NULL },
362 	{0, 100},
363 	{30, 0},
364 	{20000, 0}
365 };
366 
367 static sd_power_attr_pc sd_pwr_pc = {
368 	{ "NAME=spindle-motor", "0=stopped", "1=standby", "2=idle",
369 		"3=active", NULL },
370 	{0, 0, 0, 100},
371 	{90, 90, 20, 0},
372 	{15000, 15000, 1000, 0}
373 };
374 
375 /*
376  * Power level to power condition
377  */
378 static int sd_pl2pc[] = {
379 	SD_TARGET_START_VALID,
380 	SD_TARGET_STANDBY,
381 	SD_TARGET_IDLE,
382 	SD_TARGET_ACTIVE
383 };
384 
385 /*
386  * Vendor specific data name property declarations
387  */
388 
389 #if defined(__fibre) || defined(__i386) ||defined(__amd64)
390 
391 static sd_tunables seagate_properties = {
392 	SEAGATE_THROTTLE_VALUE,
393 	0,
394 	0,
395 	0,
396 	0,
397 	0,
398 	0,
399 	0,
400 	0
401 };
402 
403 
404 static sd_tunables fujitsu_properties = {
405 	FUJITSU_THROTTLE_VALUE,
406 	0,
407 	0,
408 	0,
409 	0,
410 	0,
411 	0,
412 	0,
413 	0
414 };
415 
416 static sd_tunables ibm_properties = {
417 	IBM_THROTTLE_VALUE,
418 	0,
419 	0,
420 	0,
421 	0,
422 	0,
423 	0,
424 	0,
425 	0
426 };
427 
428 static sd_tunables purple_properties = {
429 	PURPLE_THROTTLE_VALUE,
430 	0,
431 	0,
432 	PURPLE_BUSY_RETRIES,
433 	PURPLE_RESET_RETRY_COUNT,
434 	PURPLE_RESERVE_RELEASE_TIME,
435 	0,
436 	0,
437 	0
438 };
439 
440 static sd_tunables sve_properties = {
441 	SVE_THROTTLE_VALUE,
442 	0,
443 	0,
444 	SVE_BUSY_RETRIES,
445 	SVE_RESET_RETRY_COUNT,
446 	SVE_RESERVE_RELEASE_TIME,
447 	SVE_MIN_THROTTLE_VALUE,
448 	SVE_DISKSORT_DISABLED_FLAG,
449 	0
450 };
451 
452 static sd_tunables maserati_properties = {
453 	0,
454 	0,
455 	0,
456 	0,
457 	0,
458 	0,
459 	0,
460 	MASERATI_DISKSORT_DISABLED_FLAG,
461 	MASERATI_LUN_RESET_ENABLED_FLAG
462 };
463 
464 static sd_tunables pirus_properties = {
465 	PIRUS_THROTTLE_VALUE,
466 	0,
467 	PIRUS_NRR_COUNT,
468 	PIRUS_BUSY_RETRIES,
469 	PIRUS_RESET_RETRY_COUNT,
470 	0,
471 	PIRUS_MIN_THROTTLE_VALUE,
472 	PIRUS_DISKSORT_DISABLED_FLAG,
473 	PIRUS_LUN_RESET_ENABLED_FLAG
474 };
475 
476 #endif
477 
478 #if (defined(__sparc) && !defined(__fibre)) || \
479 	(defined(__i386) || defined(__amd64))
480 
481 
482 static sd_tunables elite_properties = {
483 	ELITE_THROTTLE_VALUE,
484 	0,
485 	0,
486 	0,
487 	0,
488 	0,
489 	0,
490 	0,
491 	0
492 };
493 
494 static sd_tunables st31200n_properties = {
495 	ST31200N_THROTTLE_VALUE,
496 	0,
497 	0,
498 	0,
499 	0,
500 	0,
501 	0,
502 	0,
503 	0
504 };
505 
506 #endif /* Fibre or not */
507 
508 static sd_tunables lsi_properties_scsi = {
509 	LSI_THROTTLE_VALUE,
510 	0,
511 	LSI_NOTREADY_RETRIES,
512 	0,
513 	0,
514 	0,
515 	0,
516 	0,
517 	0
518 };
519 
520 static sd_tunables symbios_properties = {
521 	SYMBIOS_THROTTLE_VALUE,
522 	0,
523 	SYMBIOS_NOTREADY_RETRIES,
524 	0,
525 	0,
526 	0,
527 	0,
528 	0,
529 	0
530 };
531 
532 static sd_tunables lsi_properties = {
533 	0,
534 	0,
535 	LSI_NOTREADY_RETRIES,
536 	0,
537 	0,
538 	0,
539 	0,
540 	0,
541 	0
542 };
543 
544 static sd_tunables lsi_oem_properties = {
545 	0,
546 	0,
547 	LSI_OEM_NOTREADY_RETRIES,
548 	0,
549 	0,
550 	0,
551 	0,
552 	0,
553 	0,
554 	1
555 };
556 
557 
558 
559 #if (defined(SD_PROP_TST))
560 
561 #define	SD_TST_CTYPE_VAL	CTYPE_CDROM
562 #define	SD_TST_THROTTLE_VAL	16
563 #define	SD_TST_NOTREADY_VAL	12
564 #define	SD_TST_BUSY_VAL		60
565 #define	SD_TST_RST_RETRY_VAL	36
566 #define	SD_TST_RSV_REL_TIME	60
567 
568 static sd_tunables tst_properties = {
569 	SD_TST_THROTTLE_VAL,
570 	SD_TST_CTYPE_VAL,
571 	SD_TST_NOTREADY_VAL,
572 	SD_TST_BUSY_VAL,
573 	SD_TST_RST_RETRY_VAL,
574 	SD_TST_RSV_REL_TIME,
575 	0,
576 	0,
577 	0
578 };
579 #endif
580 
581 /* This is similar to the ANSI toupper implementation */
582 #define	SD_TOUPPER(C)	(((C) >= 'a' && (C) <= 'z') ? (C) - 'a' + 'A' : (C))
583 
584 /*
585  * Static Driver Configuration Table
586  *
587  * This is the table of disks which need throttle adjustment (or, perhaps
588  * something else as defined by the flags at a future time.)  device_id
589  * is a string consisting of concatenated vid (vendor), pid (product/model)
590  * and revision strings as defined in the scsi_inquiry structure.  Offsets of
591  * the parts of the string are as defined by the sizes in the scsi_inquiry
592  * structure.  Device type is searched as far as the device_id string is
593  * defined.  Flags defines which values are to be set in the driver from the
594  * properties list.
595  *
596  * Entries below which begin and end with a "*" are a special case.
597  * These do not have a specific vendor, and the string which follows
598  * can appear anywhere in the 16 byte PID portion of the inquiry data.
599  *
600  * Entries below which begin and end with a " " (blank) are a special
601  * case. The comparison function will treat multiple consecutive blanks
602  * as equivalent to a single blank. For example, this causes a
603  * sd_disk_table entry of " NEC CDROM " to match a device's id string
604  * of  "NEC       CDROM".
605  *
606  * Note: The MD21 controller type has been obsoleted.
607  *	 ST318202F is a Legacy device
608  *	 MAM3182FC, MAM3364FC, MAM3738FC do not appear to have ever been
609  *	 made with an FC connection. The entries here are a legacy.
610  */
611 static sd_disk_config_t sd_disk_table[] = {
612 #if defined(__fibre) || defined(__i386) || defined(__amd64)
613 	{ "SEAGATE ST34371FC", SD_CONF_BSET_THROTTLE, &seagate_properties },
614 	{ "SEAGATE ST19171FC", SD_CONF_BSET_THROTTLE, &seagate_properties },
615 	{ "SEAGATE ST39102FC", SD_CONF_BSET_THROTTLE, &seagate_properties },
616 	{ "SEAGATE ST39103FC", SD_CONF_BSET_THROTTLE, &seagate_properties },
617 	{ "SEAGATE ST118273F", SD_CONF_BSET_THROTTLE, &seagate_properties },
618 	{ "SEAGATE ST318202F", SD_CONF_BSET_THROTTLE, &seagate_properties },
619 	{ "SEAGATE ST318203F", SD_CONF_BSET_THROTTLE, &seagate_properties },
620 	{ "SEAGATE ST136403F", SD_CONF_BSET_THROTTLE, &seagate_properties },
621 	{ "SEAGATE ST318304F", SD_CONF_BSET_THROTTLE, &seagate_properties },
622 	{ "SEAGATE ST336704F", SD_CONF_BSET_THROTTLE, &seagate_properties },
623 	{ "SEAGATE ST373405F", SD_CONF_BSET_THROTTLE, &seagate_properties },
624 	{ "SEAGATE ST336605F", SD_CONF_BSET_THROTTLE, &seagate_properties },
625 	{ "SEAGATE ST336752F", SD_CONF_BSET_THROTTLE, &seagate_properties },
626 	{ "SEAGATE ST318452F", SD_CONF_BSET_THROTTLE, &seagate_properties },
627 	{ "FUJITSU MAG3091F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
628 	{ "FUJITSU MAG3182F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
629 	{ "FUJITSU MAA3182F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
630 	{ "FUJITSU MAF3364F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
631 	{ "FUJITSU MAL3364F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
632 	{ "FUJITSU MAL3738F",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
633 	{ "FUJITSU MAM3182FC",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
634 	{ "FUJITSU MAM3364FC",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
635 	{ "FUJITSU MAM3738FC",  SD_CONF_BSET_THROTTLE, &fujitsu_properties },
636 	{ "IBM     DDYFT1835",  SD_CONF_BSET_THROTTLE, &ibm_properties },
637 	{ "IBM     DDYFT3695",  SD_CONF_BSET_THROTTLE, &ibm_properties },
638 	{ "IBM     IC35LF2D2",  SD_CONF_BSET_THROTTLE, &ibm_properties },
639 	{ "IBM     IC35LF2PR",  SD_CONF_BSET_THROTTLE, &ibm_properties },
640 	{ "IBM     1724-100",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
641 	{ "IBM     1726-2xx",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
642 	{ "IBM     1726-22x",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
643 	{ "IBM     1726-4xx",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
644 	{ "IBM     1726-42x",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
645 	{ "IBM     1726-3xx",   SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
646 	{ "IBM     3526",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
647 	{ "IBM     3542",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
648 	{ "IBM     3552",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
649 	{ "IBM     1722",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
650 	{ "IBM     1742",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
651 	{ "IBM     1815",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
652 	{ "IBM     FAStT",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
653 	{ "IBM     1814",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
654 	{ "IBM     1814-200",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
655 	{ "IBM     1818",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
656 	{ "DELL    MD3000",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
657 	{ "DELL    MD3000i",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
658 	{ "LSI     INF",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
659 	{ "ENGENIO INF",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
660 	{ "SGI     TP",		SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
661 	{ "SGI     IS",		SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
662 	{ "*CSM100_*",		SD_CONF_BSET_NRR_COUNT |
663 			SD_CONF_BSET_CACHE_IS_NV, &lsi_oem_properties },
664 	{ "*CSM200_*",		SD_CONF_BSET_NRR_COUNT |
665 			SD_CONF_BSET_CACHE_IS_NV, &lsi_oem_properties },
666 	{ "Fujitsu SX300",	SD_CONF_BSET_THROTTLE,  &lsi_oem_properties },
667 	{ "LSI",		SD_CONF_BSET_NRR_COUNT, &lsi_properties },
668 	{ "SUN     T3", SD_CONF_BSET_THROTTLE |
669 			SD_CONF_BSET_BSY_RETRY_COUNT|
670 			SD_CONF_BSET_RST_RETRIES|
671 			SD_CONF_BSET_RSV_REL_TIME,
672 		&purple_properties },
673 	{ "SUN     SESS01", SD_CONF_BSET_THROTTLE |
674 		SD_CONF_BSET_BSY_RETRY_COUNT|
675 		SD_CONF_BSET_RST_RETRIES|
676 		SD_CONF_BSET_RSV_REL_TIME|
677 		SD_CONF_BSET_MIN_THROTTLE|
678 		SD_CONF_BSET_DISKSORT_DISABLED,
679 		&sve_properties },
680 	{ "SUN     T4", SD_CONF_BSET_THROTTLE |
681 			SD_CONF_BSET_BSY_RETRY_COUNT|
682 			SD_CONF_BSET_RST_RETRIES|
683 			SD_CONF_BSET_RSV_REL_TIME,
684 		&purple_properties },
685 	{ "SUN     SVE01", SD_CONF_BSET_DISKSORT_DISABLED |
686 		SD_CONF_BSET_LUN_RESET_ENABLED,
687 		&maserati_properties },
688 	{ "SUN     SE6920", SD_CONF_BSET_THROTTLE |
689 		SD_CONF_BSET_NRR_COUNT|
690 		SD_CONF_BSET_BSY_RETRY_COUNT|
691 		SD_CONF_BSET_RST_RETRIES|
692 		SD_CONF_BSET_MIN_THROTTLE|
693 		SD_CONF_BSET_DISKSORT_DISABLED|
694 		SD_CONF_BSET_LUN_RESET_ENABLED,
695 		&pirus_properties },
696 	{ "SUN     SE6940", SD_CONF_BSET_THROTTLE |
697 		SD_CONF_BSET_NRR_COUNT|
698 		SD_CONF_BSET_BSY_RETRY_COUNT|
699 		SD_CONF_BSET_RST_RETRIES|
700 		SD_CONF_BSET_MIN_THROTTLE|
701 		SD_CONF_BSET_DISKSORT_DISABLED|
702 		SD_CONF_BSET_LUN_RESET_ENABLED,
703 		&pirus_properties },
704 	{ "SUN     StorageTek 6920", SD_CONF_BSET_THROTTLE |
705 		SD_CONF_BSET_NRR_COUNT|
706 		SD_CONF_BSET_BSY_RETRY_COUNT|
707 		SD_CONF_BSET_RST_RETRIES|
708 		SD_CONF_BSET_MIN_THROTTLE|
709 		SD_CONF_BSET_DISKSORT_DISABLED|
710 		SD_CONF_BSET_LUN_RESET_ENABLED,
711 		&pirus_properties },
712 	{ "SUN     StorageTek 6940", SD_CONF_BSET_THROTTLE |
713 		SD_CONF_BSET_NRR_COUNT|
714 		SD_CONF_BSET_BSY_RETRY_COUNT|
715 		SD_CONF_BSET_RST_RETRIES|
716 		SD_CONF_BSET_MIN_THROTTLE|
717 		SD_CONF_BSET_DISKSORT_DISABLED|
718 		SD_CONF_BSET_LUN_RESET_ENABLED,
719 		&pirus_properties },
720 	{ "SUN     PSX1000", SD_CONF_BSET_THROTTLE |
721 		SD_CONF_BSET_NRR_COUNT|
722 		SD_CONF_BSET_BSY_RETRY_COUNT|
723 		SD_CONF_BSET_RST_RETRIES|
724 		SD_CONF_BSET_MIN_THROTTLE|
725 		SD_CONF_BSET_DISKSORT_DISABLED|
726 		SD_CONF_BSET_LUN_RESET_ENABLED,
727 		&pirus_properties },
728 	{ "SUN     SE6330", SD_CONF_BSET_THROTTLE |
729 		SD_CONF_BSET_NRR_COUNT|
730 		SD_CONF_BSET_BSY_RETRY_COUNT|
731 		SD_CONF_BSET_RST_RETRIES|
732 		SD_CONF_BSET_MIN_THROTTLE|
733 		SD_CONF_BSET_DISKSORT_DISABLED|
734 		SD_CONF_BSET_LUN_RESET_ENABLED,
735 		&pirus_properties },
736 	{ "SUN     STK6580_6780", SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
737 	{ "SUN     SUN_6180", SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
738 	{ "STK     OPENstorage", SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
739 	{ "STK     OpenStorage", SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
740 	{ "STK     BladeCtlr",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
741 	{ "STK     FLEXLINE",	SD_CONF_BSET_NRR_COUNT, &lsi_oem_properties },
742 	{ "SYMBIOS", SD_CONF_BSET_NRR_COUNT, &symbios_properties },
743 #endif /* fibre or NON-sparc platforms */
744 #if ((defined(__sparc) && !defined(__fibre)) ||\
745 	(defined(__i386) || defined(__amd64)))
746 	{ "SEAGATE ST42400N", SD_CONF_BSET_THROTTLE, &elite_properties },
747 	{ "SEAGATE ST31200N", SD_CONF_BSET_THROTTLE, &st31200n_properties },
748 	{ "SEAGATE ST41600N", SD_CONF_BSET_TUR_CHECK, NULL },
749 	{ "CONNER  CP30540",  SD_CONF_BSET_NOCACHE,  NULL },
750 	{ "*SUN0104*", SD_CONF_BSET_FAB_DEVID, NULL },
751 	{ "*SUN0207*", SD_CONF_BSET_FAB_DEVID, NULL },
752 	{ "*SUN0327*", SD_CONF_BSET_FAB_DEVID, NULL },
753 	{ "*SUN0340*", SD_CONF_BSET_FAB_DEVID, NULL },
754 	{ "*SUN0424*", SD_CONF_BSET_FAB_DEVID, NULL },
755 	{ "*SUN0669*", SD_CONF_BSET_FAB_DEVID, NULL },
756 	{ "*SUN1.0G*", SD_CONF_BSET_FAB_DEVID, NULL },
757 	{ "SYMBIOS INF-01-00       ", SD_CONF_BSET_FAB_DEVID, NULL },
758 	{ "SYMBIOS", SD_CONF_BSET_THROTTLE|SD_CONF_BSET_NRR_COUNT,
759 	    &symbios_properties },
760 	{ "LSI", SD_CONF_BSET_THROTTLE | SD_CONF_BSET_NRR_COUNT,
761 	    &lsi_properties_scsi },
762 #if defined(__i386) || defined(__amd64)
763 	{ " NEC CD-ROM DRIVE:260 ", (SD_CONF_BSET_PLAYMSF_BCD
764 				    | SD_CONF_BSET_READSUB_BCD
765 				    | SD_CONF_BSET_READ_TOC_ADDR_BCD
766 				    | SD_CONF_BSET_NO_READ_HEADER
767 				    | SD_CONF_BSET_READ_CD_XD4), NULL },
768 
769 	{ " NEC CD-ROM DRIVE:270 ", (SD_CONF_BSET_PLAYMSF_BCD
770 				    | SD_CONF_BSET_READSUB_BCD
771 				    | SD_CONF_BSET_READ_TOC_ADDR_BCD
772 				    | SD_CONF_BSET_NO_READ_HEADER
773 				    | SD_CONF_BSET_READ_CD_XD4), NULL },
774 #endif /* __i386 || __amd64 */
775 #endif /* sparc NON-fibre or NON-sparc platforms */
776 
777 #if (defined(SD_PROP_TST))
778 	{ "VENDOR  PRODUCT ", (SD_CONF_BSET_THROTTLE
779 				| SD_CONF_BSET_CTYPE
780 				| SD_CONF_BSET_NRR_COUNT
781 				| SD_CONF_BSET_FAB_DEVID
782 				| SD_CONF_BSET_NOCACHE
783 				| SD_CONF_BSET_BSY_RETRY_COUNT
784 				| SD_CONF_BSET_PLAYMSF_BCD
785 				| SD_CONF_BSET_READSUB_BCD
786 				| SD_CONF_BSET_READ_TOC_TRK_BCD
787 				| SD_CONF_BSET_READ_TOC_ADDR_BCD
788 				| SD_CONF_BSET_NO_READ_HEADER
789 				| SD_CONF_BSET_READ_CD_XD4
790 				| SD_CONF_BSET_RST_RETRIES
791 				| SD_CONF_BSET_RSV_REL_TIME
792 				| SD_CONF_BSET_TUR_CHECK), &tst_properties},
793 #endif
794 };
795 
796 static const int sd_disk_table_size =
797 	sizeof (sd_disk_table)/ sizeof (sd_disk_config_t);
798 
799 
800 
801 #define	SD_INTERCONNECT_PARALLEL	0
802 #define	SD_INTERCONNECT_FABRIC		1
803 #define	SD_INTERCONNECT_FIBRE		2
804 #define	SD_INTERCONNECT_SSA		3
805 #define	SD_INTERCONNECT_SATA		4
806 #define	SD_INTERCONNECT_SAS		5
807 
808 #define	SD_IS_PARALLEL_SCSI(un)		\
809 	((un)->un_interconnect_type == SD_INTERCONNECT_PARALLEL)
810 #define	SD_IS_SERIAL(un)		\
811 	(((un)->un_interconnect_type == SD_INTERCONNECT_SATA) ||\
812 	((un)->un_interconnect_type == SD_INTERCONNECT_SAS))
813 
814 /*
815  * Definitions used by device id registration routines
816  */
817 #define	VPD_HEAD_OFFSET		3	/* size of head for vpd page */
818 #define	VPD_PAGE_LENGTH		3	/* offset for pge length data */
819 #define	VPD_MODE_PAGE		1	/* offset into vpd pg for "page code" */
820 
821 static kmutex_t sd_sense_mutex = {0};
822 
823 /*
824  * Macros for updates of the driver state
825  */
826 #define	New_state(un, s)        \
827 	(un)->un_last_state = (un)->un_state, (un)->un_state = (s)
828 #define	Restore_state(un)	\
829 	{ uchar_t tmp = (un)->un_last_state; New_state((un), tmp); }
830 
831 static struct sd_cdbinfo sd_cdbtab[] = {
832 	{ CDB_GROUP0, 0x00,	   0x1FFFFF,   0xFF,	    },
833 	{ CDB_GROUP1, SCMD_GROUP1, 0xFFFFFFFF, 0xFFFF,	    },
834 	{ CDB_GROUP5, SCMD_GROUP5, 0xFFFFFFFF, 0xFFFFFFFF,  },
835 	{ CDB_GROUP4, SCMD_GROUP4, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFF, },
836 };
837 
838 /*
839  * Specifies the number of seconds that must have elapsed since the last
840  * cmd. has completed for a device to be declared idle to the PM framework.
841  */
842 static int sd_pm_idletime = 1;
843 
844 /*
845  * Internal function prototypes
846  */
847 
848 #if (defined(__fibre))
849 /*
850  * These #defines are to avoid namespace collisions that occur because this
851  * code is currently used to compile two separate driver modules: sd and ssd.
852  * All function names need to be treated this way (even if declared static)
853  * in order to allow the debugger to resolve the names properly.
854  * It is anticipated that in the near future the ssd module will be obsoleted,
855  * at which time this ugliness should go away.
856  */
857 #define	sd_log_trace			ssd_log_trace
858 #define	sd_log_info			ssd_log_info
859 #define	sd_log_err			ssd_log_err
860 #define	sdprobe				ssdprobe
861 #define	sdinfo				ssdinfo
862 #define	sd_prop_op			ssd_prop_op
863 #define	sd_scsi_probe_cache_init	ssd_scsi_probe_cache_init
864 #define	sd_scsi_probe_cache_fini	ssd_scsi_probe_cache_fini
865 #define	sd_scsi_clear_probe_cache	ssd_scsi_clear_probe_cache
866 #define	sd_scsi_probe_with_cache	ssd_scsi_probe_with_cache
867 #define	sd_scsi_target_lun_init		ssd_scsi_target_lun_init
868 #define	sd_scsi_target_lun_fini		ssd_scsi_target_lun_fini
869 #define	sd_scsi_get_target_lun_count	ssd_scsi_get_target_lun_count
870 #define	sd_scsi_update_lun_on_target	ssd_scsi_update_lun_on_target
871 #define	sd_spin_up_unit			ssd_spin_up_unit
872 #define	sd_enable_descr_sense		ssd_enable_descr_sense
873 #define	sd_reenable_dsense_task		ssd_reenable_dsense_task
874 #define	sd_set_mmc_caps			ssd_set_mmc_caps
875 #define	sd_read_unit_properties		ssd_read_unit_properties
876 #define	sd_process_sdconf_file		ssd_process_sdconf_file
877 #define	sd_process_sdconf_table		ssd_process_sdconf_table
878 #define	sd_sdconf_id_match		ssd_sdconf_id_match
879 #define	sd_blank_cmp			ssd_blank_cmp
880 #define	sd_chk_vers1_data		ssd_chk_vers1_data
881 #define	sd_set_vers1_properties		ssd_set_vers1_properties
882 #define	sd_check_solid_state		ssd_check_solid_state
883 
884 #define	sd_get_physical_geometry	ssd_get_physical_geometry
885 #define	sd_get_virtual_geometry		ssd_get_virtual_geometry
886 #define	sd_update_block_info		ssd_update_block_info
887 #define	sd_register_devid		ssd_register_devid
888 #define	sd_get_devid			ssd_get_devid
889 #define	sd_create_devid			ssd_create_devid
890 #define	sd_write_deviceid		ssd_write_deviceid
891 #define	sd_check_vpd_page_support	ssd_check_vpd_page_support
892 #define	sd_setup_pm			ssd_setup_pm
893 #define	sd_create_pm_components		ssd_create_pm_components
894 #define	sd_ddi_suspend			ssd_ddi_suspend
895 #define	sd_ddi_resume			ssd_ddi_resume
896 #define	sd_pm_state_change		ssd_pm_state_change
897 #define	sdpower				ssdpower
898 #define	sdattach			ssdattach
899 #define	sddetach			ssddetach
900 #define	sd_unit_attach			ssd_unit_attach
901 #define	sd_unit_detach			ssd_unit_detach
902 #define	sd_set_unit_attributes		ssd_set_unit_attributes
903 #define	sd_create_errstats		ssd_create_errstats
904 #define	sd_set_errstats			ssd_set_errstats
905 #define	sd_set_pstats			ssd_set_pstats
906 #define	sddump				ssddump
907 #define	sd_scsi_poll			ssd_scsi_poll
908 #define	sd_send_polled_RQS		ssd_send_polled_RQS
909 #define	sd_ddi_scsi_poll		ssd_ddi_scsi_poll
910 #define	sd_init_event_callbacks		ssd_init_event_callbacks
911 #define	sd_event_callback		ssd_event_callback
912 #define	sd_cache_control		ssd_cache_control
913 #define	sd_get_write_cache_enabled	ssd_get_write_cache_enabled
914 #define	sd_get_nv_sup			ssd_get_nv_sup
915 #define	sd_make_device			ssd_make_device
916 #define	sdopen				ssdopen
917 #define	sdclose				ssdclose
918 #define	sd_ready_and_valid		ssd_ready_and_valid
919 #define	sdmin				ssdmin
920 #define	sdread				ssdread
921 #define	sdwrite				ssdwrite
922 #define	sdaread				ssdaread
923 #define	sdawrite			ssdawrite
924 #define	sdstrategy			ssdstrategy
925 #define	sdioctl				ssdioctl
926 #define	sd_mapblockaddr_iostart		ssd_mapblockaddr_iostart
927 #define	sd_mapblocksize_iostart		ssd_mapblocksize_iostart
928 #define	sd_checksum_iostart		ssd_checksum_iostart
929 #define	sd_checksum_uscsi_iostart	ssd_checksum_uscsi_iostart
930 #define	sd_pm_iostart			ssd_pm_iostart
931 #define	sd_core_iostart			ssd_core_iostart
932 #define	sd_mapblockaddr_iodone		ssd_mapblockaddr_iodone
933 #define	sd_mapblocksize_iodone		ssd_mapblocksize_iodone
934 #define	sd_checksum_iodone		ssd_checksum_iodone
935 #define	sd_checksum_uscsi_iodone	ssd_checksum_uscsi_iodone
936 #define	sd_pm_iodone			ssd_pm_iodone
937 #define	sd_initpkt_for_buf		ssd_initpkt_for_buf
938 #define	sd_destroypkt_for_buf		ssd_destroypkt_for_buf
939 #define	sd_setup_rw_pkt			ssd_setup_rw_pkt
940 #define	sd_setup_next_rw_pkt		ssd_setup_next_rw_pkt
941 #define	sd_buf_iodone			ssd_buf_iodone
942 #define	sd_uscsi_strategy		ssd_uscsi_strategy
943 #define	sd_initpkt_for_uscsi		ssd_initpkt_for_uscsi
944 #define	sd_destroypkt_for_uscsi		ssd_destroypkt_for_uscsi
945 #define	sd_uscsi_iodone			ssd_uscsi_iodone
946 #define	sd_xbuf_strategy		ssd_xbuf_strategy
947 #define	sd_xbuf_init			ssd_xbuf_init
948 #define	sd_pm_entry			ssd_pm_entry
949 #define	sd_pm_exit			ssd_pm_exit
950 
951 #define	sd_pm_idletimeout_handler	ssd_pm_idletimeout_handler
952 #define	sd_pm_timeout_handler		ssd_pm_timeout_handler
953 
954 #define	sd_add_buf_to_waitq		ssd_add_buf_to_waitq
955 #define	sdintr				ssdintr
956 #define	sd_start_cmds			ssd_start_cmds
957 #define	sd_send_scsi_cmd		ssd_send_scsi_cmd
958 #define	sd_bioclone_alloc		ssd_bioclone_alloc
959 #define	sd_bioclone_free		ssd_bioclone_free
960 #define	sd_shadow_buf_alloc		ssd_shadow_buf_alloc
961 #define	sd_shadow_buf_free		ssd_shadow_buf_free
962 #define	sd_print_transport_rejected_message	\
963 					ssd_print_transport_rejected_message
964 #define	sd_retry_command		ssd_retry_command
965 #define	sd_set_retry_bp			ssd_set_retry_bp
966 #define	sd_send_request_sense_command	ssd_send_request_sense_command
967 #define	sd_start_retry_command		ssd_start_retry_command
968 #define	sd_start_direct_priority_command	\
969 					ssd_start_direct_priority_command
970 #define	sd_return_failed_command	ssd_return_failed_command
971 #define	sd_return_failed_command_no_restart	\
972 					ssd_return_failed_command_no_restart
973 #define	sd_return_command		ssd_return_command
974 #define	sd_sync_with_callback		ssd_sync_with_callback
975 #define	sdrunout			ssdrunout
976 #define	sd_mark_rqs_busy		ssd_mark_rqs_busy
977 #define	sd_mark_rqs_idle		ssd_mark_rqs_idle
978 #define	sd_reduce_throttle		ssd_reduce_throttle
979 #define	sd_restore_throttle		ssd_restore_throttle
980 #define	sd_print_incomplete_msg		ssd_print_incomplete_msg
981 #define	sd_init_cdb_limits		ssd_init_cdb_limits
982 #define	sd_pkt_status_good		ssd_pkt_status_good
983 #define	sd_pkt_status_check_condition	ssd_pkt_status_check_condition
984 #define	sd_pkt_status_busy		ssd_pkt_status_busy
985 #define	sd_pkt_status_reservation_conflict	\
986 					ssd_pkt_status_reservation_conflict
987 #define	sd_pkt_status_qfull		ssd_pkt_status_qfull
988 #define	sd_handle_request_sense		ssd_handle_request_sense
989 #define	sd_handle_auto_request_sense	ssd_handle_auto_request_sense
990 #define	sd_print_sense_failed_msg	ssd_print_sense_failed_msg
991 #define	sd_validate_sense_data		ssd_validate_sense_data
992 #define	sd_decode_sense			ssd_decode_sense
993 #define	sd_print_sense_msg		ssd_print_sense_msg
994 #define	sd_sense_key_no_sense		ssd_sense_key_no_sense
995 #define	sd_sense_key_recoverable_error	ssd_sense_key_recoverable_error
996 #define	sd_sense_key_not_ready		ssd_sense_key_not_ready
997 #define	sd_sense_key_medium_or_hardware_error	\
998 					ssd_sense_key_medium_or_hardware_error
999 #define	sd_sense_key_illegal_request	ssd_sense_key_illegal_request
1000 #define	sd_sense_key_unit_attention	ssd_sense_key_unit_attention
1001 #define	sd_sense_key_fail_command	ssd_sense_key_fail_command
1002 #define	sd_sense_key_blank_check	ssd_sense_key_blank_check
1003 #define	sd_sense_key_aborted_command	ssd_sense_key_aborted_command
1004 #define	sd_sense_key_default		ssd_sense_key_default
1005 #define	sd_print_retry_msg		ssd_print_retry_msg
1006 #define	sd_print_cmd_incomplete_msg	ssd_print_cmd_incomplete_msg
1007 #define	sd_pkt_reason_cmd_incomplete	ssd_pkt_reason_cmd_incomplete
1008 #define	sd_pkt_reason_cmd_tran_err	ssd_pkt_reason_cmd_tran_err
1009 #define	sd_pkt_reason_cmd_reset		ssd_pkt_reason_cmd_reset
1010 #define	sd_pkt_reason_cmd_aborted	ssd_pkt_reason_cmd_aborted
1011 #define	sd_pkt_reason_cmd_timeout	ssd_pkt_reason_cmd_timeout
1012 #define	sd_pkt_reason_cmd_unx_bus_free	ssd_pkt_reason_cmd_unx_bus_free
1013 #define	sd_pkt_reason_cmd_tag_reject	ssd_pkt_reason_cmd_tag_reject
1014 #define	sd_pkt_reason_default		ssd_pkt_reason_default
1015 #define	sd_reset_target			ssd_reset_target
1016 #define	sd_start_stop_unit_callback	ssd_start_stop_unit_callback
1017 #define	sd_start_stop_unit_task		ssd_start_stop_unit_task
1018 #define	sd_taskq_create			ssd_taskq_create
1019 #define	sd_taskq_delete			ssd_taskq_delete
1020 #define	sd_target_change_task		ssd_target_change_task
1021 #define	sd_log_dev_status_event		ssd_log_dev_status_event
1022 #define	sd_log_lun_expansion_event	ssd_log_lun_expansion_event
1023 #define	sd_log_eject_request_event	ssd_log_eject_request_event
1024 #define	sd_media_change_task		ssd_media_change_task
1025 #define	sd_handle_mchange		ssd_handle_mchange
1026 #define	sd_send_scsi_DOORLOCK		ssd_send_scsi_DOORLOCK
1027 #define	sd_send_scsi_READ_CAPACITY	ssd_send_scsi_READ_CAPACITY
1028 #define	sd_send_scsi_READ_CAPACITY_16	ssd_send_scsi_READ_CAPACITY_16
1029 #define	sd_send_scsi_GET_CONFIGURATION	ssd_send_scsi_GET_CONFIGURATION
1030 #define	sd_send_scsi_feature_GET_CONFIGURATION	\
1031 					sd_send_scsi_feature_GET_CONFIGURATION
1032 #define	sd_send_scsi_START_STOP_UNIT	ssd_send_scsi_START_STOP_UNIT
1033 #define	sd_send_scsi_INQUIRY		ssd_send_scsi_INQUIRY
1034 #define	sd_send_scsi_TEST_UNIT_READY	ssd_send_scsi_TEST_UNIT_READY
1035 #define	sd_send_scsi_PERSISTENT_RESERVE_IN	\
1036 					ssd_send_scsi_PERSISTENT_RESERVE_IN
1037 #define	sd_send_scsi_PERSISTENT_RESERVE_OUT	\
1038 					ssd_send_scsi_PERSISTENT_RESERVE_OUT
1039 #define	sd_send_scsi_SYNCHRONIZE_CACHE	ssd_send_scsi_SYNCHRONIZE_CACHE
1040 #define	sd_send_scsi_SYNCHRONIZE_CACHE_biodone	\
1041 					ssd_send_scsi_SYNCHRONIZE_CACHE_biodone
1042 #define	sd_send_scsi_MODE_SENSE		ssd_send_scsi_MODE_SENSE
1043 #define	sd_send_scsi_MODE_SELECT	ssd_send_scsi_MODE_SELECT
1044 #define	sd_send_scsi_RDWR		ssd_send_scsi_RDWR
1045 #define	sd_send_scsi_LOG_SENSE		ssd_send_scsi_LOG_SENSE
1046 #define	sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION	\
1047 				ssd_send_scsi_GET_EVENT_STATUS_NOTIFICATION
1048 #define	sd_gesn_media_data_valid	ssd_gesn_media_data_valid
1049 #define	sd_alloc_rqs			ssd_alloc_rqs
1050 #define	sd_free_rqs			ssd_free_rqs
1051 #define	sd_dump_memory			ssd_dump_memory
1052 #define	sd_get_media_info		ssd_get_media_info
1053 #define	sd_get_media_info_ext		ssd_get_media_info_ext
1054 #define	sd_dkio_ctrl_info		ssd_dkio_ctrl_info
1055 #define	sd_nvpair_str_decode		ssd_nvpair_str_decode
1056 #define	sd_strtok_r			ssd_strtok_r
1057 #define	sd_set_properties		ssd_set_properties
1058 #define	sd_get_tunables_from_conf	ssd_get_tunables_from_conf
1059 #define	sd_setup_next_xfer		ssd_setup_next_xfer
1060 #define	sd_dkio_get_temp		ssd_dkio_get_temp
1061 #define	sd_check_mhd			ssd_check_mhd
1062 #define	sd_mhd_watch_cb			ssd_mhd_watch_cb
1063 #define	sd_mhd_watch_incomplete		ssd_mhd_watch_incomplete
1064 #define	sd_sname			ssd_sname
1065 #define	sd_mhd_resvd_recover		ssd_mhd_resvd_recover
1066 #define	sd_resv_reclaim_thread		ssd_resv_reclaim_thread
1067 #define	sd_take_ownership		ssd_take_ownership
1068 #define	sd_reserve_release		ssd_reserve_release
1069 #define	sd_rmv_resv_reclaim_req		ssd_rmv_resv_reclaim_req
1070 #define	sd_mhd_reset_notify_cb		ssd_mhd_reset_notify_cb
1071 #define	sd_persistent_reservation_in_read_keys	\
1072 					ssd_persistent_reservation_in_read_keys
1073 #define	sd_persistent_reservation_in_read_resv	\
1074 					ssd_persistent_reservation_in_read_resv
1075 #define	sd_mhdioc_takeown		ssd_mhdioc_takeown
1076 #define	sd_mhdioc_failfast		ssd_mhdioc_failfast
1077 #define	sd_mhdioc_release		ssd_mhdioc_release
1078 #define	sd_mhdioc_register_devid	ssd_mhdioc_register_devid
1079 #define	sd_mhdioc_inkeys		ssd_mhdioc_inkeys
1080 #define	sd_mhdioc_inresv		ssd_mhdioc_inresv
1081 #define	sr_change_blkmode		ssr_change_blkmode
1082 #define	sr_change_speed			ssr_change_speed
1083 #define	sr_atapi_change_speed		ssr_atapi_change_speed
1084 #define	sr_pause_resume			ssr_pause_resume
1085 #define	sr_play_msf			ssr_play_msf
1086 #define	sr_play_trkind			ssr_play_trkind
1087 #define	sr_read_all_subcodes		ssr_read_all_subcodes
1088 #define	sr_read_subchannel		ssr_read_subchannel
1089 #define	sr_read_tocentry		ssr_read_tocentry
1090 #define	sr_read_tochdr			ssr_read_tochdr
1091 #define	sr_read_cdda			ssr_read_cdda
1092 #define	sr_read_cdxa			ssr_read_cdxa
1093 #define	sr_read_mode1			ssr_read_mode1
1094 #define	sr_read_mode2			ssr_read_mode2
1095 #define	sr_read_cd_mode2		ssr_read_cd_mode2
1096 #define	sr_sector_mode			ssr_sector_mode
1097 #define	sr_eject			ssr_eject
1098 #define	sr_ejected			ssr_ejected
1099 #define	sr_check_wp			ssr_check_wp
1100 #define	sd_watch_request_submit		ssd_watch_request_submit
1101 #define	sd_check_media			ssd_check_media
1102 #define	sd_media_watch_cb		ssd_media_watch_cb
1103 #define	sd_delayed_cv_broadcast		ssd_delayed_cv_broadcast
1104 #define	sr_volume_ctrl			ssr_volume_ctrl
1105 #define	sr_read_sony_session_offset	ssr_read_sony_session_offset
1106 #define	sd_log_page_supported		ssd_log_page_supported
1107 #define	sd_check_for_writable_cd	ssd_check_for_writable_cd
1108 #define	sd_wm_cache_constructor		ssd_wm_cache_constructor
1109 #define	sd_wm_cache_destructor		ssd_wm_cache_destructor
1110 #define	sd_range_lock			ssd_range_lock
1111 #define	sd_get_range			ssd_get_range
1112 #define	sd_free_inlist_wmap		ssd_free_inlist_wmap
1113 #define	sd_range_unlock			ssd_range_unlock
1114 #define	sd_read_modify_write_task	ssd_read_modify_write_task
1115 #define	sddump_do_read_of_rmw		ssddump_do_read_of_rmw
1116 
1117 #define	sd_iostart_chain		ssd_iostart_chain
1118 #define	sd_iodone_chain			ssd_iodone_chain
1119 #define	sd_initpkt_map			ssd_initpkt_map
1120 #define	sd_destroypkt_map		ssd_destroypkt_map
1121 #define	sd_chain_type_map		ssd_chain_type_map
1122 #define	sd_chain_index_map		ssd_chain_index_map
1123 
1124 #define	sd_failfast_flushctl		ssd_failfast_flushctl
1125 #define	sd_failfast_flushq		ssd_failfast_flushq
1126 #define	sd_failfast_flushq_callback	ssd_failfast_flushq_callback
1127 
1128 #define	sd_is_lsi			ssd_is_lsi
1129 #define	sd_tg_rdwr			ssd_tg_rdwr
1130 #define	sd_tg_getinfo			ssd_tg_getinfo
1131 #define	sd_rmw_msg_print_handler	ssd_rmw_msg_print_handler
1132 
1133 #endif	/* #if (defined(__fibre)) */
1134 
1135 
1136 int _init(void);
1137 int _fini(void);
1138 int _info(struct modinfo *modinfop);
1139 
1140 /*PRINTFLIKE3*/
1141 static void sd_log_trace(uint_t comp, struct sd_lun *un, const char *fmt, ...);
1142 /*PRINTFLIKE3*/
1143 static void sd_log_info(uint_t comp, struct sd_lun *un, const char *fmt, ...);
1144 /*PRINTFLIKE3*/
1145 static void sd_log_err(uint_t comp, struct sd_lun *un, const char *fmt, ...);
1146 
1147 static int sdprobe(dev_info_t *devi);
1148 static int sdinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg,
1149     void **result);
1150 static int sd_prop_op(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op,
1151     int mod_flags, char *name, caddr_t valuep, int *lengthp);
1152 
1153 /*
1154  * Smart probe for parallel scsi
1155  */
1156 static void sd_scsi_probe_cache_init(void);
1157 static void sd_scsi_probe_cache_fini(void);
1158 static void sd_scsi_clear_probe_cache(void);
1159 static int  sd_scsi_probe_with_cache(struct scsi_device *devp, int (*fn)());
1160 
1161 /*
1162  * Attached luns on target for parallel scsi
1163  */
1164 static void sd_scsi_target_lun_init(void);
1165 static void sd_scsi_target_lun_fini(void);
1166 static int  sd_scsi_get_target_lun_count(dev_info_t *dip, int target);
1167 static void sd_scsi_update_lun_on_target(dev_info_t *dip, int target, int flag);
1168 
1169 static int	sd_spin_up_unit(sd_ssc_t *ssc);
1170 
1171 /*
1172  * Using sd_ssc_init to establish sd_ssc_t struct
1173  * Using sd_ssc_send to send uscsi internal command
1174  * Using sd_ssc_fini to free sd_ssc_t struct
1175  */
1176 static sd_ssc_t *sd_ssc_init(struct sd_lun *un);
1177 static int sd_ssc_send(sd_ssc_t *ssc, struct uscsi_cmd *incmd,
1178     int flag, enum uio_seg dataspace, int path_flag);
1179 static void sd_ssc_fini(sd_ssc_t *ssc);
1180 
1181 /*
1182  * Using sd_ssc_assessment to set correct type-of-assessment
1183  * Using sd_ssc_post to post ereport & system log
1184  *       sd_ssc_post will call sd_ssc_print to print system log
1185  *       sd_ssc_post will call sd_ssd_ereport_post to post ereport
1186  */
1187 static void sd_ssc_assessment(sd_ssc_t *ssc,
1188     enum sd_type_assessment tp_assess);
1189 
1190 static void sd_ssc_post(sd_ssc_t *ssc, enum sd_driver_assessment sd_assess);
1191 static void sd_ssc_print(sd_ssc_t *ssc, int sd_severity);
1192 static void sd_ssc_ereport_post(sd_ssc_t *ssc,
1193     enum sd_driver_assessment drv_assess);
1194 
1195 /*
1196  * Using sd_ssc_set_info to mark an un-decodable-data error.
1197  * Using sd_ssc_extract_info to transfer information from internal
1198  *       data structures to sd_ssc_t.
1199  */
1200 static void sd_ssc_set_info(sd_ssc_t *ssc, int ssc_flags, uint_t comp,
1201     const char *fmt, ...);
1202 static void sd_ssc_extract_info(sd_ssc_t *ssc, struct sd_lun *un,
1203     struct scsi_pkt *pktp, struct buf *bp, struct sd_xbuf *xp);
1204 
1205 static int sd_send_scsi_cmd(dev_t dev, struct uscsi_cmd *incmd, int flag,
1206     enum uio_seg dataspace, int path_flag);
1207 
1208 #ifdef _LP64
1209 static void	sd_enable_descr_sense(sd_ssc_t *ssc);
1210 static void	sd_reenable_dsense_task(void *arg);
1211 #endif /* _LP64 */
1212 
1213 static void	sd_set_mmc_caps(sd_ssc_t *ssc);
1214 
1215 static void sd_read_unit_properties(struct sd_lun *un);
1216 static int  sd_process_sdconf_file(struct sd_lun *un);
1217 static void sd_nvpair_str_decode(struct sd_lun *un, char *nvpair_str);
1218 static char *sd_strtok_r(char *string, const char *sepset, char **lasts);
1219 static void sd_set_properties(struct sd_lun *un, char *name, char *value);
1220 static void sd_get_tunables_from_conf(struct sd_lun *un, int flags,
1221     int *data_list, sd_tunables *values);
1222 static void sd_process_sdconf_table(struct sd_lun *un);
1223 static int  sd_sdconf_id_match(struct sd_lun *un, char *id, int idlen);
1224 static int  sd_blank_cmp(struct sd_lun *un, char *id, int idlen);
1225 static int  sd_chk_vers1_data(struct sd_lun *un, int flags, int *prop_list,
1226 	int list_len, char *dataname_ptr);
1227 static void sd_set_vers1_properties(struct sd_lun *un, int flags,
1228     sd_tunables *prop_list);
1229 
1230 static void sd_register_devid(sd_ssc_t *ssc, dev_info_t *devi,
1231     int reservation_flag);
1232 static int  sd_get_devid(sd_ssc_t *ssc);
1233 static ddi_devid_t sd_create_devid(sd_ssc_t *ssc);
1234 static int  sd_write_deviceid(sd_ssc_t *ssc);
1235 static int  sd_get_devid_page(struct sd_lun *un, uchar_t *wwn, int *len);
1236 static int  sd_check_vpd_page_support(sd_ssc_t *ssc);
1237 
1238 static void sd_setup_pm(sd_ssc_t *ssc, dev_info_t *devi);
1239 static void sd_create_pm_components(dev_info_t *devi, struct sd_lun *un);
1240 
1241 static int  sd_ddi_suspend(dev_info_t *devi);
1242 static int  sd_ddi_resume(dev_info_t *devi);
1243 static int  sd_pm_state_change(struct sd_lun *un, int level, int flag);
1244 static int  sdpower(dev_info_t *devi, int component, int level);
1245 
1246 static int  sdattach(dev_info_t *devi, ddi_attach_cmd_t cmd);
1247 static int  sddetach(dev_info_t *devi, ddi_detach_cmd_t cmd);
1248 static int  sd_unit_attach(dev_info_t *devi);
1249 static int  sd_unit_detach(dev_info_t *devi);
1250 
1251 static void sd_set_unit_attributes(struct sd_lun *un, dev_info_t *devi);
1252 static void sd_create_errstats(struct sd_lun *un, int instance);
1253 static void sd_set_errstats(struct sd_lun *un);
1254 static void sd_set_pstats(struct sd_lun *un);
1255 
1256 static int  sddump(dev_t dev, caddr_t addr, daddr_t blkno, int nblk);
1257 static int  sd_scsi_poll(struct sd_lun *un, struct scsi_pkt *pkt);
1258 static int  sd_send_polled_RQS(struct sd_lun *un);
1259 static int  sd_ddi_scsi_poll(struct scsi_pkt *pkt);
1260 
1261 #if (defined(__fibre))
1262 /*
1263  * Event callbacks (photon)
1264  */
1265 static void sd_init_event_callbacks(struct sd_lun *un);
1266 static void  sd_event_callback(dev_info_t *, ddi_eventcookie_t, void *, void *);
1267 #endif
1268 
1269 /*
1270  * Defines for sd_cache_control
1271  */
1272 
1273 #define	SD_CACHE_ENABLE		1
1274 #define	SD_CACHE_DISABLE	0
1275 #define	SD_CACHE_NOCHANGE	-1
1276 
1277 static int   sd_cache_control(sd_ssc_t *ssc, int rcd_flag, int wce_flag);
1278 static int   sd_get_write_cache_enabled(sd_ssc_t *ssc, int *is_enabled);
1279 static void  sd_get_nv_sup(sd_ssc_t *ssc);
1280 static dev_t sd_make_device(dev_info_t *devi);
1281 static void  sd_check_solid_state(sd_ssc_t *ssc);
1282 
1283 static void  sd_update_block_info(struct sd_lun *un, uint32_t lbasize,
1284 	uint64_t capacity);
1285 
1286 /*
1287  * Driver entry point functions.
1288  */
1289 static int  sdopen(dev_t *dev_p, int flag, int otyp, cred_t *cred_p);
1290 static int  sdclose(dev_t dev, int flag, int otyp, cred_t *cred_p);
1291 static int  sd_ready_and_valid(sd_ssc_t *ssc, int part);
1292 
1293 static void sdmin(struct buf *bp);
1294 static int sdread(dev_t dev, struct uio *uio, cred_t *cred_p);
1295 static int sdwrite(dev_t dev, struct uio *uio, cred_t *cred_p);
1296 static int sdaread(dev_t dev, struct aio_req *aio, cred_t *cred_p);
1297 static int sdawrite(dev_t dev, struct aio_req *aio, cred_t *cred_p);
1298 
1299 static int sdstrategy(struct buf *bp);
1300 static int sdioctl(dev_t, int, intptr_t, int, cred_t *, int *);
1301 
1302 /*
1303  * Function prototypes for layering functions in the iostart chain.
1304  */
1305 static void sd_mapblockaddr_iostart(int index, struct sd_lun *un,
1306 	struct buf *bp);
1307 static void sd_mapblocksize_iostart(int index, struct sd_lun *un,
1308 	struct buf *bp);
1309 static void sd_checksum_iostart(int index, struct sd_lun *un, struct buf *bp);
1310 static void sd_checksum_uscsi_iostart(int index, struct sd_lun *un,
1311 	struct buf *bp);
1312 static void sd_pm_iostart(int index, struct sd_lun *un, struct buf *bp);
1313 static void sd_core_iostart(int index, struct sd_lun *un, struct buf *bp);
1314 
1315 /*
1316  * Function prototypes for layering functions in the iodone chain.
1317  */
1318 static void sd_buf_iodone(int index, struct sd_lun *un, struct buf *bp);
1319 static void sd_uscsi_iodone(int index, struct sd_lun *un, struct buf *bp);
1320 static void sd_mapblockaddr_iodone(int index, struct sd_lun *un,
1321 	struct buf *bp);
1322 static void sd_mapblocksize_iodone(int index, struct sd_lun *un,
1323 	struct buf *bp);
1324 static void sd_checksum_iodone(int index, struct sd_lun *un, struct buf *bp);
1325 static void sd_checksum_uscsi_iodone(int index, struct sd_lun *un,
1326 	struct buf *bp);
1327 static void sd_pm_iodone(int index, struct sd_lun *un, struct buf *bp);
1328 
1329 /*
1330  * Prototypes for functions to support buf(9S) based IO.
1331  */
1332 static void sd_xbuf_strategy(struct buf *bp, ddi_xbuf_t xp, void *arg);
1333 static int sd_initpkt_for_buf(struct buf *, struct scsi_pkt **);
1334 static void sd_destroypkt_for_buf(struct buf *);
1335 static int sd_setup_rw_pkt(struct sd_lun *un, struct scsi_pkt **pktpp,
1336 	struct buf *bp, int flags,
1337 	int (*callback)(caddr_t), caddr_t callback_arg,
1338 	diskaddr_t lba, uint32_t blockcount);
1339 static int sd_setup_next_rw_pkt(struct sd_lun *un, struct scsi_pkt *pktp,
1340 	struct buf *bp, diskaddr_t lba, uint32_t blockcount);
1341 
1342 /*
1343  * Prototypes for functions to support USCSI IO.
1344  */
1345 static int sd_uscsi_strategy(struct buf *bp);
1346 static int sd_initpkt_for_uscsi(struct buf *, struct scsi_pkt **);
1347 static void sd_destroypkt_for_uscsi(struct buf *);
1348 
1349 static void sd_xbuf_init(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
1350 	uchar_t chain_type, void *pktinfop);
1351 
1352 static int  sd_pm_entry(struct sd_lun *un);
1353 static void sd_pm_exit(struct sd_lun *un);
1354 
1355 static void sd_pm_idletimeout_handler(void *arg);
1356 
1357 /*
1358  * sd_core internal functions (used at the sd_core_io layer).
1359  */
1360 static void sd_add_buf_to_waitq(struct sd_lun *un, struct buf *bp);
1361 static void sdintr(struct scsi_pkt *pktp);
1362 static void sd_start_cmds(struct sd_lun *un, struct buf *immed_bp);
1363 
1364 static int sd_send_scsi_cmd(dev_t dev, struct uscsi_cmd *incmd, int flag,
1365 	enum uio_seg dataspace, int path_flag);
1366 
1367 static struct buf *sd_bioclone_alloc(struct buf *bp, size_t datalen,
1368 	daddr_t blkno, int (*func)(struct buf *));
1369 static struct buf *sd_shadow_buf_alloc(struct buf *bp, size_t datalen,
1370 	uint_t bflags, daddr_t blkno, int (*func)(struct buf *));
1371 static void sd_bioclone_free(struct buf *bp);
1372 static void sd_shadow_buf_free(struct buf *bp);
1373 
1374 static void sd_print_transport_rejected_message(struct sd_lun *un,
1375 	struct sd_xbuf *xp, int code);
1376 static void sd_print_incomplete_msg(struct sd_lun *un, struct buf *bp,
1377     void *arg, int code);
1378 static void sd_print_sense_failed_msg(struct sd_lun *un, struct buf *bp,
1379     void *arg, int code);
1380 static void sd_print_cmd_incomplete_msg(struct sd_lun *un, struct buf *bp,
1381     void *arg, int code);
1382 
1383 static void sd_retry_command(struct sd_lun *un, struct buf *bp,
1384 	int retry_check_flag,
1385 	void (*user_funcp)(struct sd_lun *un, struct buf *bp, void *argp,
1386 		int c),
1387 	void *user_arg, int failure_code,  clock_t retry_delay,
1388 	void (*statp)(kstat_io_t *));
1389 
1390 static void sd_set_retry_bp(struct sd_lun *un, struct buf *bp,
1391 	clock_t retry_delay, void (*statp)(kstat_io_t *));
1392 
1393 static void sd_send_request_sense_command(struct sd_lun *un, struct buf *bp,
1394 	struct scsi_pkt *pktp);
1395 static void sd_start_retry_command(void *arg);
1396 static void sd_start_direct_priority_command(void *arg);
1397 static void sd_return_failed_command(struct sd_lun *un, struct buf *bp,
1398 	int errcode);
1399 static void sd_return_failed_command_no_restart(struct sd_lun *un,
1400 	struct buf *bp, int errcode);
1401 static void sd_return_command(struct sd_lun *un, struct buf *bp);
1402 static void sd_sync_with_callback(struct sd_lun *un);
1403 static int sdrunout(caddr_t arg);
1404 
1405 static void sd_mark_rqs_busy(struct sd_lun *un, struct buf *bp);
1406 static struct buf *sd_mark_rqs_idle(struct sd_lun *un, struct sd_xbuf *xp);
1407 
1408 static void sd_reduce_throttle(struct sd_lun *un, int throttle_type);
1409 static void sd_restore_throttle(void *arg);
1410 
1411 static void sd_init_cdb_limits(struct sd_lun *un);
1412 
1413 static void sd_pkt_status_good(struct sd_lun *un, struct buf *bp,
1414 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1415 
1416 /*
1417  * Error handling functions
1418  */
1419 static void sd_pkt_status_check_condition(struct sd_lun *un, struct buf *bp,
1420 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1421 static void sd_pkt_status_busy(struct sd_lun *un, struct buf *bp,
1422 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1423 static void sd_pkt_status_reservation_conflict(struct sd_lun *un,
1424 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1425 static void sd_pkt_status_qfull(struct sd_lun *un, struct buf *bp,
1426 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1427 
1428 static void sd_handle_request_sense(struct sd_lun *un, struct buf *bp,
1429 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1430 static void sd_handle_auto_request_sense(struct sd_lun *un, struct buf *bp,
1431 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1432 static int sd_validate_sense_data(struct sd_lun *un, struct buf *bp,
1433 	struct sd_xbuf *xp, size_t actual_len);
1434 static void sd_decode_sense(struct sd_lun *un, struct buf *bp,
1435 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1436 
1437 static void sd_print_sense_msg(struct sd_lun *un, struct buf *bp,
1438 	void *arg, int code);
1439 
1440 static void sd_sense_key_no_sense(struct sd_lun *un, struct buf *bp,
1441 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1442 static void sd_sense_key_recoverable_error(struct sd_lun *un,
1443 	uint8_t *sense_datap,
1444 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1445 static void sd_sense_key_not_ready(struct sd_lun *un,
1446 	uint8_t *sense_datap,
1447 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1448 static void sd_sense_key_medium_or_hardware_error(struct sd_lun *un,
1449 	uint8_t *sense_datap,
1450 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1451 static void sd_sense_key_illegal_request(struct sd_lun *un, struct buf *bp,
1452 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1453 static void sd_sense_key_unit_attention(struct sd_lun *un,
1454 	uint8_t *sense_datap,
1455 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1456 static void sd_sense_key_fail_command(struct sd_lun *un, struct buf *bp,
1457 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1458 static void sd_sense_key_blank_check(struct sd_lun *un, struct buf *bp,
1459 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1460 static void sd_sense_key_aborted_command(struct sd_lun *un, struct buf *bp,
1461 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1462 static void sd_sense_key_default(struct sd_lun *un,
1463 	uint8_t *sense_datap,
1464 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp);
1465 
1466 static void sd_print_retry_msg(struct sd_lun *un, struct buf *bp,
1467 	void *arg, int flag);
1468 
1469 static void sd_pkt_reason_cmd_incomplete(struct sd_lun *un, struct buf *bp,
1470 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1471 static void sd_pkt_reason_cmd_tran_err(struct sd_lun *un, struct buf *bp,
1472 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1473 static void sd_pkt_reason_cmd_reset(struct sd_lun *un, struct buf *bp,
1474 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1475 static void sd_pkt_reason_cmd_aborted(struct sd_lun *un, struct buf *bp,
1476 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1477 static void sd_pkt_reason_cmd_timeout(struct sd_lun *un, struct buf *bp,
1478 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1479 static void sd_pkt_reason_cmd_unx_bus_free(struct sd_lun *un, struct buf *bp,
1480 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1481 static void sd_pkt_reason_cmd_tag_reject(struct sd_lun *un, struct buf *bp,
1482 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1483 static void sd_pkt_reason_default(struct sd_lun *un, struct buf *bp,
1484 	struct sd_xbuf *xp, struct scsi_pkt *pktp);
1485 
1486 static void sd_reset_target(struct sd_lun *un, struct scsi_pkt *pktp);
1487 
1488 static void sd_start_stop_unit_callback(void *arg);
1489 static void sd_start_stop_unit_task(void *arg);
1490 
1491 static void sd_taskq_create(void);
1492 static void sd_taskq_delete(void);
1493 static void sd_target_change_task(void *arg);
1494 static void sd_log_dev_status_event(struct sd_lun *un, char *esc, int km_flag);
1495 static void sd_log_lun_expansion_event(struct sd_lun *un, int km_flag);
1496 static void sd_log_eject_request_event(struct sd_lun *un, int km_flag);
1497 static void sd_media_change_task(void *arg);
1498 
1499 static int sd_handle_mchange(struct sd_lun *un);
1500 static int sd_send_scsi_DOORLOCK(sd_ssc_t *ssc, int flag, int path_flag);
1501 static int sd_send_scsi_READ_CAPACITY(sd_ssc_t *ssc, uint64_t *capp,
1502 	uint32_t *lbap, int path_flag);
1503 static int sd_send_scsi_READ_CAPACITY_16(sd_ssc_t *ssc, uint64_t *capp,
1504 	uint32_t *lbap, uint32_t *psp, int path_flag);
1505 static int sd_send_scsi_START_STOP_UNIT(sd_ssc_t *ssc, int pc_flag,
1506 	int flag, int path_flag);
1507 static int sd_send_scsi_INQUIRY(sd_ssc_t *ssc, uchar_t *bufaddr,
1508 	size_t buflen, uchar_t evpd, uchar_t page_code, size_t *residp);
1509 static int sd_send_scsi_TEST_UNIT_READY(sd_ssc_t *ssc, int flag);
1510 static int sd_send_scsi_PERSISTENT_RESERVE_IN(sd_ssc_t *ssc,
1511 	uchar_t usr_cmd, uint16_t data_len, uchar_t *data_bufp);
1512 static int sd_send_scsi_PERSISTENT_RESERVE_OUT(sd_ssc_t *ssc,
1513 	uchar_t usr_cmd, uchar_t *usr_bufp);
1514 static int sd_send_scsi_SYNCHRONIZE_CACHE(struct sd_lun *un,
1515 	struct dk_callback *dkc);
1516 static int sd_send_scsi_SYNCHRONIZE_CACHE_biodone(struct buf *bp);
1517 static int sd_send_scsi_GET_CONFIGURATION(sd_ssc_t *ssc,
1518 	struct uscsi_cmd *ucmdbuf, uchar_t *rqbuf, uint_t rqbuflen,
1519 	uchar_t *bufaddr, uint_t buflen, int path_flag);
1520 static int sd_send_scsi_feature_GET_CONFIGURATION(sd_ssc_t *ssc,
1521 	struct uscsi_cmd *ucmdbuf, uchar_t *rqbuf, uint_t rqbuflen,
1522 	uchar_t *bufaddr, uint_t buflen, char feature, int path_flag);
1523 static int sd_send_scsi_MODE_SENSE(sd_ssc_t *ssc, int cdbsize,
1524 	uchar_t *bufaddr, size_t buflen, uchar_t page_code, int path_flag);
1525 static int sd_send_scsi_MODE_SELECT(sd_ssc_t *ssc, int cdbsize,
1526 	uchar_t *bufaddr, size_t buflen, uchar_t save_page, int path_flag);
1527 static int sd_send_scsi_RDWR(sd_ssc_t *ssc, uchar_t cmd, void *bufaddr,
1528 	size_t buflen, daddr_t start_block, int path_flag);
1529 #define	sd_send_scsi_READ(ssc, bufaddr, buflen, start_block, path_flag)	\
1530 	sd_send_scsi_RDWR(ssc, SCMD_READ, bufaddr, buflen, start_block, \
1531 	path_flag)
1532 #define	sd_send_scsi_WRITE(ssc, bufaddr, buflen, start_block, path_flag)\
1533 	sd_send_scsi_RDWR(ssc, SCMD_WRITE, bufaddr, buflen, start_block,\
1534 	path_flag)
1535 
1536 static int sd_send_scsi_LOG_SENSE(sd_ssc_t *ssc, uchar_t *bufaddr,
1537 	uint16_t buflen, uchar_t page_code, uchar_t page_control,
1538 	uint16_t param_ptr, int path_flag);
1539 static int sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION(sd_ssc_t *ssc,
1540 	uchar_t *bufaddr, size_t buflen, uchar_t class_req);
1541 static boolean_t sd_gesn_media_data_valid(uchar_t *data);
1542 
1543 static int  sd_alloc_rqs(struct scsi_device *devp, struct sd_lun *un);
1544 static void sd_free_rqs(struct sd_lun *un);
1545 
1546 static void sd_dump_memory(struct sd_lun *un, uint_t comp, char *title,
1547 	uchar_t *data, int len, int fmt);
1548 static void sd_panic_for_res_conflict(struct sd_lun *un);
1549 
1550 /*
1551  * Disk Ioctl Function Prototypes
1552  */
1553 static int sd_get_media_info(dev_t dev, caddr_t arg, int flag);
1554 static int sd_get_media_info_ext(dev_t dev, caddr_t arg, int flag);
1555 static int sd_dkio_ctrl_info(dev_t dev, caddr_t arg, int flag);
1556 static int sd_dkio_get_temp(dev_t dev, caddr_t arg, int flag);
1557 
1558 /*
1559  * Multi-host Ioctl Prototypes
1560  */
1561 static int sd_check_mhd(dev_t dev, int interval);
1562 static int sd_mhd_watch_cb(caddr_t arg, struct scsi_watch_result *resultp);
1563 static void sd_mhd_watch_incomplete(struct sd_lun *un, struct scsi_pkt *pkt);
1564 static char *sd_sname(uchar_t status);
1565 static void sd_mhd_resvd_recover(void *arg);
1566 static void sd_resv_reclaim_thread();
1567 static int sd_take_ownership(dev_t dev, struct mhioctkown *p);
1568 static int sd_reserve_release(dev_t dev, int cmd);
1569 static void sd_rmv_resv_reclaim_req(dev_t dev);
1570 static void sd_mhd_reset_notify_cb(caddr_t arg);
1571 static int sd_persistent_reservation_in_read_keys(struct sd_lun *un,
1572 	mhioc_inkeys_t *usrp, int flag);
1573 static int sd_persistent_reservation_in_read_resv(struct sd_lun *un,
1574 	mhioc_inresvs_t *usrp, int flag);
1575 static int sd_mhdioc_takeown(dev_t dev, caddr_t arg, int flag);
1576 static int sd_mhdioc_failfast(dev_t dev, caddr_t arg, int flag);
1577 static int sd_mhdioc_release(dev_t dev);
1578 static int sd_mhdioc_register_devid(dev_t dev);
1579 static int sd_mhdioc_inkeys(dev_t dev, caddr_t arg, int flag);
1580 static int sd_mhdioc_inresv(dev_t dev, caddr_t arg, int flag);
1581 
1582 /*
1583  * SCSI removable prototypes
1584  */
1585 static int sr_change_blkmode(dev_t dev, int cmd, intptr_t data, int flag);
1586 static int sr_change_speed(dev_t dev, int cmd, intptr_t data, int flag);
1587 static int sr_atapi_change_speed(dev_t dev, int cmd, intptr_t data, int flag);
1588 static int sr_pause_resume(dev_t dev, int mode);
1589 static int sr_play_msf(dev_t dev, caddr_t data, int flag);
1590 static int sr_play_trkind(dev_t dev, caddr_t data, int flag);
1591 static int sr_read_all_subcodes(dev_t dev, caddr_t data, int flag);
1592 static int sr_read_subchannel(dev_t dev, caddr_t data, int flag);
1593 static int sr_read_tocentry(dev_t dev, caddr_t data, int flag);
1594 static int sr_read_tochdr(dev_t dev, caddr_t data, int flag);
1595 static int sr_read_cdda(dev_t dev, caddr_t data, int flag);
1596 static int sr_read_cdxa(dev_t dev, caddr_t data, int flag);
1597 static int sr_read_mode1(dev_t dev, caddr_t data, int flag);
1598 static int sr_read_mode2(dev_t dev, caddr_t data, int flag);
1599 static int sr_read_cd_mode2(dev_t dev, caddr_t data, int flag);
1600 static int sr_sector_mode(dev_t dev, uint32_t blksize);
1601 static int sr_eject(dev_t dev);
1602 static void sr_ejected(register struct sd_lun *un);
1603 static int sr_check_wp(dev_t dev);
1604 static opaque_t sd_watch_request_submit(struct sd_lun *un);
1605 static int sd_check_media(dev_t dev, enum dkio_state state);
1606 static int sd_media_watch_cb(caddr_t arg, struct scsi_watch_result *resultp);
1607 static void sd_delayed_cv_broadcast(void *arg);
1608 static int sr_volume_ctrl(dev_t dev, caddr_t data, int flag);
1609 static int sr_read_sony_session_offset(dev_t dev, caddr_t data, int flag);
1610 
1611 static int sd_log_page_supported(sd_ssc_t *ssc, int log_page);
1612 
1613 /*
1614  * Function Prototype for the non-512 support (DVDRAM, MO etc.) functions.
1615  */
1616 static void sd_check_for_writable_cd(sd_ssc_t *ssc, int path_flag);
1617 static int sd_wm_cache_constructor(void *wm, void *un, int flags);
1618 static void sd_wm_cache_destructor(void *wm, void *un);
1619 static struct sd_w_map *sd_range_lock(struct sd_lun *un, daddr_t startb,
1620 	daddr_t endb, ushort_t typ);
1621 static struct sd_w_map *sd_get_range(struct sd_lun *un, daddr_t startb,
1622 	daddr_t endb);
1623 static void sd_free_inlist_wmap(struct sd_lun *un, struct sd_w_map *wmp);
1624 static void sd_range_unlock(struct sd_lun *un, struct sd_w_map *wm);
1625 static void sd_read_modify_write_task(void * arg);
1626 static int
1627 sddump_do_read_of_rmw(struct sd_lun *un, uint64_t blkno, uint64_t nblk,
1628 	struct buf **bpp);
1629 
1630 
1631 /*
1632  * Function prototypes for failfast support.
1633  */
1634 static void sd_failfast_flushq(struct sd_lun *un);
1635 static int sd_failfast_flushq_callback(struct buf *bp);
1636 
1637 /*
1638  * Function prototypes to check for lsi devices
1639  */
1640 static void sd_is_lsi(struct sd_lun *un);
1641 
1642 /*
1643  * Function prototypes for partial DMA support
1644  */
1645 static int sd_setup_next_xfer(struct sd_lun *un, struct buf *bp,
1646 		struct scsi_pkt *pkt, struct sd_xbuf *xp);
1647 
1648 
1649 /* Function prototypes for cmlb */
1650 static int sd_tg_rdwr(dev_info_t *devi, uchar_t cmd, void *bufaddr,
1651     diskaddr_t start_block, size_t reqlength, void *tg_cookie);
1652 
1653 static int sd_tg_getinfo(dev_info_t *devi, int cmd, void *arg, void *tg_cookie);
1654 
1655 /*
1656  * For printing RMW warning message timely
1657  */
1658 static void sd_rmw_msg_print_handler(void *arg);
1659 
1660 /*
1661  * Constants for failfast support:
1662  *
1663  * SD_FAILFAST_INACTIVE: Instance is currently in a normal state, with NO
1664  * failfast processing being performed.
1665  *
1666  * SD_FAILFAST_ACTIVE: Instance is in the failfast state and is performing
1667  * failfast processing on all bufs with B_FAILFAST set.
1668  */
1669 
1670 #define	SD_FAILFAST_INACTIVE		0
1671 #define	SD_FAILFAST_ACTIVE		1
1672 
1673 /*
1674  * Bitmask to control behavior of buf(9S) flushes when a transition to
1675  * the failfast state occurs. Optional bits include:
1676  *
1677  * SD_FAILFAST_FLUSH_ALL_BUFS: When set, flush ALL bufs including those that
1678  * do NOT have B_FAILFAST set. When clear, only bufs with B_FAILFAST will
1679  * be flushed.
1680  *
1681  * SD_FAILFAST_FLUSH_ALL_QUEUES: When set, flush any/all other queues in the
1682  * driver, in addition to the regular wait queue. This includes the xbuf
1683  * queues. When clear, only the driver's wait queue will be flushed.
1684  */
1685 #define	SD_FAILFAST_FLUSH_ALL_BUFS	0x01
1686 #define	SD_FAILFAST_FLUSH_ALL_QUEUES	0x02
1687 
1688 /*
1689  * The default behavior is to only flush bufs that have B_FAILFAST set, but
1690  * to flush all queues within the driver.
1691  */
1692 static int sd_failfast_flushctl = SD_FAILFAST_FLUSH_ALL_QUEUES;
1693 
1694 
1695 /*
1696  * SD Testing Fault Injection
1697  */
1698 #ifdef SD_FAULT_INJECTION
1699 static void sd_faultinjection_ioctl(int cmd, intptr_t arg, struct sd_lun *un);
1700 static void sd_faultinjection(struct scsi_pkt *pktp);
1701 static void sd_injection_log(char *buf, struct sd_lun *un);
1702 #endif
1703 
1704 /*
1705  * Device driver ops vector
1706  */
1707 static struct cb_ops sd_cb_ops = {
1708 	sdopen,			/* open */
1709 	sdclose,		/* close */
1710 	sdstrategy,		/* strategy */
1711 	nodev,			/* print */
1712 	sddump,			/* dump */
1713 	sdread,			/* read */
1714 	sdwrite,		/* write */
1715 	sdioctl,		/* ioctl */
1716 	nodev,			/* devmap */
1717 	nodev,			/* mmap */
1718 	nodev,			/* segmap */
1719 	nochpoll,		/* poll */
1720 	sd_prop_op,		/* cb_prop_op */
1721 	0,			/* streamtab  */
1722 	D_64BIT | D_MP | D_NEW | D_HOTPLUG, /* Driver compatibility flags */
1723 	CB_REV,			/* cb_rev */
1724 	sdaread, 		/* async I/O read entry point */
1725 	sdawrite		/* async I/O write entry point */
1726 };
1727 
1728 struct dev_ops sd_ops = {
1729 	DEVO_REV,		/* devo_rev, */
1730 	0,			/* refcnt  */
1731 	sdinfo,			/* info */
1732 	nulldev,		/* identify */
1733 	sdprobe,		/* probe */
1734 	sdattach,		/* attach */
1735 	sddetach,		/* detach */
1736 	nodev,			/* reset */
1737 	&sd_cb_ops,		/* driver operations */
1738 	NULL,			/* bus operations */
1739 	sdpower,		/* power */
1740 	ddi_quiesce_not_needed,		/* quiesce */
1741 };
1742 
1743 /*
1744  * This is the loadable module wrapper.
1745  */
1746 #include <sys/modctl.h>
1747 
1748 #ifndef XPV_HVM_DRIVER
1749 static struct modldrv modldrv = {
1750 	&mod_driverops,		/* Type of module. This one is a driver */
1751 	SD_MODULE_NAME,		/* Module name. */
1752 	&sd_ops			/* driver ops */
1753 };
1754 
1755 static struct modlinkage modlinkage = {
1756 	MODREV_1, &modldrv, NULL
1757 };
1758 
1759 #else /* XPV_HVM_DRIVER */
1760 static struct modlmisc modlmisc = {
1761 	&mod_miscops,		/* Type of module. This one is a misc */
1762 	"HVM " SD_MODULE_NAME,		/* Module name. */
1763 };
1764 
1765 static struct modlinkage modlinkage = {
1766 	MODREV_1, &modlmisc, NULL
1767 };
1768 
1769 #endif /* XPV_HVM_DRIVER */
1770 
1771 static cmlb_tg_ops_t sd_tgops = {
1772 	TG_DK_OPS_VERSION_1,
1773 	sd_tg_rdwr,
1774 	sd_tg_getinfo
1775 };
1776 
1777 static struct scsi_asq_key_strings sd_additional_codes[] = {
1778 	0x81, 0, "Logical Unit is Reserved",
1779 	0x85, 0, "Audio Address Not Valid",
1780 	0xb6, 0, "Media Load Mechanism Failed",
1781 	0xB9, 0, "Audio Play Operation Aborted",
1782 	0xbf, 0, "Buffer Overflow for Read All Subcodes Command",
1783 	0x53, 2, "Medium removal prevented",
1784 	0x6f, 0, "Authentication failed during key exchange",
1785 	0x6f, 1, "Key not present",
1786 	0x6f, 2, "Key not established",
1787 	0x6f, 3, "Read without proper authentication",
1788 	0x6f, 4, "Mismatched region to this logical unit",
1789 	0x6f, 5, "Region reset count error",
1790 	0xffff, 0x0, NULL
1791 };
1792 
1793 
1794 /*
1795  * Struct for passing printing information for sense data messages
1796  */
1797 struct sd_sense_info {
1798 	int	ssi_severity;
1799 	int	ssi_pfa_flag;
1800 };
1801 
1802 /*
1803  * Table of function pointers for iostart-side routines. Separate "chains"
1804  * of layered function calls are formed by placing the function pointers
1805  * sequentially in the desired order. Functions are called according to an
1806  * incrementing table index ordering. The last function in each chain must
1807  * be sd_core_iostart(). The corresponding iodone-side routines are expected
1808  * in the sd_iodone_chain[] array.
1809  *
1810  * Note: It may seem more natural to organize both the iostart and iodone
1811  * functions together, into an array of structures (or some similar
1812  * organization) with a common index, rather than two separate arrays which
1813  * must be maintained in synchronization. The purpose of this division is
1814  * to achieve improved performance: individual arrays allows for more
1815  * effective cache line utilization on certain platforms.
1816  */
1817 
1818 typedef void (*sd_chain_t)(int index, struct sd_lun *un, struct buf *bp);
1819 
1820 
1821 static sd_chain_t sd_iostart_chain[] = {
1822 
1823 	/* Chain for buf IO for disk drive targets (PM enabled) */
1824 	sd_mapblockaddr_iostart,	/* Index: 0 */
1825 	sd_pm_iostart,			/* Index: 1 */
1826 	sd_core_iostart,		/* Index: 2 */
1827 
1828 	/* Chain for buf IO for disk drive targets (PM disabled) */
1829 	sd_mapblockaddr_iostart,	/* Index: 3 */
1830 	sd_core_iostart,		/* Index: 4 */
1831 
1832 	/*
1833 	 * Chain for buf IO for removable-media or large sector size
1834 	 * disk drive targets with RMW needed (PM enabled)
1835 	 */
1836 	sd_mapblockaddr_iostart,	/* Index: 5 */
1837 	sd_mapblocksize_iostart,	/* Index: 6 */
1838 	sd_pm_iostart,			/* Index: 7 */
1839 	sd_core_iostart,		/* Index: 8 */
1840 
1841 	/*
1842 	 * Chain for buf IO for removable-media or large sector size
1843 	 * disk drive targets with RMW needed (PM disabled)
1844 	 */
1845 	sd_mapblockaddr_iostart,	/* Index: 9 */
1846 	sd_mapblocksize_iostart,	/* Index: 10 */
1847 	sd_core_iostart,		/* Index: 11 */
1848 
1849 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
1850 	sd_mapblockaddr_iostart,	/* Index: 12 */
1851 	sd_checksum_iostart,		/* Index: 13 */
1852 	sd_pm_iostart,			/* Index: 14 */
1853 	sd_core_iostart,		/* Index: 15 */
1854 
1855 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
1856 	sd_mapblockaddr_iostart,	/* Index: 16 */
1857 	sd_checksum_iostart,		/* Index: 17 */
1858 	sd_core_iostart,		/* Index: 18 */
1859 
1860 	/* Chain for USCSI commands (all targets) */
1861 	sd_pm_iostart,			/* Index: 19 */
1862 	sd_core_iostart,		/* Index: 20 */
1863 
1864 	/* Chain for checksumming USCSI commands (all targets) */
1865 	sd_checksum_uscsi_iostart,	/* Index: 21 */
1866 	sd_pm_iostart,			/* Index: 22 */
1867 	sd_core_iostart,		/* Index: 23 */
1868 
1869 	/* Chain for "direct" USCSI commands (all targets) */
1870 	sd_core_iostart,		/* Index: 24 */
1871 
1872 	/* Chain for "direct priority" USCSI commands (all targets) */
1873 	sd_core_iostart,		/* Index: 25 */
1874 
1875 	/*
1876 	 * Chain for buf IO for large sector size disk drive targets
1877 	 * with RMW needed with checksumming (PM enabled)
1878 	 */
1879 	sd_mapblockaddr_iostart,	/* Index: 26 */
1880 	sd_mapblocksize_iostart,	/* Index: 27 */
1881 	sd_checksum_iostart,		/* Index: 28 */
1882 	sd_pm_iostart,			/* Index: 29 */
1883 	sd_core_iostart,		/* Index: 30 */
1884 
1885 	/*
1886 	 * Chain for buf IO for large sector size disk drive targets
1887 	 * with RMW needed with checksumming (PM disabled)
1888 	 */
1889 	sd_mapblockaddr_iostart,	/* Index: 31 */
1890 	sd_mapblocksize_iostart,	/* Index: 32 */
1891 	sd_checksum_iostart,		/* Index: 33 */
1892 	sd_core_iostart,		/* Index: 34 */
1893 
1894 };
1895 
1896 /*
1897  * Macros to locate the first function of each iostart chain in the
1898  * sd_iostart_chain[] array. These are located by the index in the array.
1899  */
1900 #define	SD_CHAIN_DISK_IOSTART			0
1901 #define	SD_CHAIN_DISK_IOSTART_NO_PM		3
1902 #define	SD_CHAIN_MSS_DISK_IOSTART		5
1903 #define	SD_CHAIN_RMMEDIA_IOSTART		5
1904 #define	SD_CHAIN_MSS_DISK_IOSTART_NO_PM		9
1905 #define	SD_CHAIN_RMMEDIA_IOSTART_NO_PM		9
1906 #define	SD_CHAIN_CHKSUM_IOSTART			12
1907 #define	SD_CHAIN_CHKSUM_IOSTART_NO_PM		16
1908 #define	SD_CHAIN_USCSI_CMD_IOSTART		19
1909 #define	SD_CHAIN_USCSI_CHKSUM_IOSTART		21
1910 #define	SD_CHAIN_DIRECT_CMD_IOSTART		24
1911 #define	SD_CHAIN_PRIORITY_CMD_IOSTART		25
1912 #define	SD_CHAIN_MSS_CHKSUM_IOSTART		26
1913 #define	SD_CHAIN_MSS_CHKSUM_IOSTART_NO_PM	31
1914 
1915 
1916 /*
1917  * Table of function pointers for the iodone-side routines for the driver-
1918  * internal layering mechanism.  The calling sequence for iodone routines
1919  * uses a decrementing table index, so the last routine called in a chain
1920  * must be at the lowest array index location for that chain.  The last
1921  * routine for each chain must be either sd_buf_iodone() (for buf(9S) IOs)
1922  * or sd_uscsi_iodone() (for uscsi IOs).  Other than this, the ordering
1923  * of the functions in an iodone side chain must correspond to the ordering
1924  * of the iostart routines for that chain.  Note that there is no iodone
1925  * side routine that corresponds to sd_core_iostart(), so there is no
1926  * entry in the table for this.
1927  */
1928 
1929 static sd_chain_t sd_iodone_chain[] = {
1930 
1931 	/* Chain for buf IO for disk drive targets (PM enabled) */
1932 	sd_buf_iodone,			/* Index: 0 */
1933 	sd_mapblockaddr_iodone,		/* Index: 1 */
1934 	sd_pm_iodone,			/* Index: 2 */
1935 
1936 	/* Chain for buf IO for disk drive targets (PM disabled) */
1937 	sd_buf_iodone,			/* Index: 3 */
1938 	sd_mapblockaddr_iodone,		/* Index: 4 */
1939 
1940 	/*
1941 	 * Chain for buf IO for removable-media or large sector size
1942 	 * disk drive targets with RMW needed (PM enabled)
1943 	 */
1944 	sd_buf_iodone,			/* Index: 5 */
1945 	sd_mapblockaddr_iodone,		/* Index: 6 */
1946 	sd_mapblocksize_iodone,		/* Index: 7 */
1947 	sd_pm_iodone,			/* Index: 8 */
1948 
1949 	/*
1950 	 * Chain for buf IO for removable-media or large sector size
1951 	 * disk drive targets with RMW needed (PM disabled)
1952 	 */
1953 	sd_buf_iodone,			/* Index: 9 */
1954 	sd_mapblockaddr_iodone,		/* Index: 10 */
1955 	sd_mapblocksize_iodone,		/* Index: 11 */
1956 
1957 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
1958 	sd_buf_iodone,			/* Index: 12 */
1959 	sd_mapblockaddr_iodone,		/* Index: 13 */
1960 	sd_checksum_iodone,		/* Index: 14 */
1961 	sd_pm_iodone,			/* Index: 15 */
1962 
1963 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
1964 	sd_buf_iodone,			/* Index: 16 */
1965 	sd_mapblockaddr_iodone,		/* Index: 17 */
1966 	sd_checksum_iodone,		/* Index: 18 */
1967 
1968 	/* Chain for USCSI commands (non-checksum targets) */
1969 	sd_uscsi_iodone,		/* Index: 19 */
1970 	sd_pm_iodone,			/* Index: 20 */
1971 
1972 	/* Chain for USCSI commands (checksum targets) */
1973 	sd_uscsi_iodone,		/* Index: 21 */
1974 	sd_checksum_uscsi_iodone,	/* Index: 22 */
1975 	sd_pm_iodone,			/* Index: 22 */
1976 
1977 	/* Chain for "direct" USCSI commands (all targets) */
1978 	sd_uscsi_iodone,		/* Index: 24 */
1979 
1980 	/* Chain for "direct priority" USCSI commands (all targets) */
1981 	sd_uscsi_iodone,		/* Index: 25 */
1982 
1983 	/*
1984 	 * Chain for buf IO for large sector size disk drive targets
1985 	 * with checksumming (PM enabled)
1986 	 */
1987 	sd_buf_iodone,			/* Index: 26 */
1988 	sd_mapblockaddr_iodone,		/* Index: 27 */
1989 	sd_mapblocksize_iodone,		/* Index: 28 */
1990 	sd_checksum_iodone,		/* Index: 29 */
1991 	sd_pm_iodone,			/* Index: 30 */
1992 
1993 	/*
1994 	 * Chain for buf IO for large sector size disk drive targets
1995 	 * with checksumming (PM disabled)
1996 	 */
1997 	sd_buf_iodone,			/* Index: 31 */
1998 	sd_mapblockaddr_iodone,		/* Index: 32 */
1999 	sd_mapblocksize_iodone,		/* Index: 33 */
2000 	sd_checksum_iodone,		/* Index: 34 */
2001 };
2002 
2003 
2004 /*
2005  * Macros to locate the "first" function in the sd_iodone_chain[] array for
2006  * each iodone-side chain. These are located by the array index, but as the
2007  * iodone side functions are called in a decrementing-index order, the
2008  * highest index number in each chain must be specified (as these correspond
2009  * to the first function in the iodone chain that will be called by the core
2010  * at IO completion time).
2011  */
2012 
2013 #define	SD_CHAIN_DISK_IODONE			2
2014 #define	SD_CHAIN_DISK_IODONE_NO_PM		4
2015 #define	SD_CHAIN_RMMEDIA_IODONE			8
2016 #define	SD_CHAIN_MSS_DISK_IODONE		8
2017 #define	SD_CHAIN_RMMEDIA_IODONE_NO_PM		11
2018 #define	SD_CHAIN_MSS_DISK_IODONE_NO_PM		11
2019 #define	SD_CHAIN_CHKSUM_IODONE			15
2020 #define	SD_CHAIN_CHKSUM_IODONE_NO_PM		18
2021 #define	SD_CHAIN_USCSI_CMD_IODONE		20
2022 #define	SD_CHAIN_USCSI_CHKSUM_IODONE		22
2023 #define	SD_CHAIN_DIRECT_CMD_IODONE		24
2024 #define	SD_CHAIN_PRIORITY_CMD_IODONE		25
2025 #define	SD_CHAIN_MSS_CHKSUM_IODONE		30
2026 #define	SD_CHAIN_MSS_CHKSUM_IODONE_NO_PM	34
2027 
2028 
2029 
2030 /*
2031  * Array to map a layering chain index to the appropriate initpkt routine.
2032  * The redundant entries are present so that the index used for accessing
2033  * the above sd_iostart_chain and sd_iodone_chain tables can be used directly
2034  * with this table as well.
2035  */
2036 typedef int (*sd_initpkt_t)(struct buf *, struct scsi_pkt **);
2037 
2038 static sd_initpkt_t	sd_initpkt_map[] = {
2039 
2040 	/* Chain for buf IO for disk drive targets (PM enabled) */
2041 	sd_initpkt_for_buf,		/* Index: 0 */
2042 	sd_initpkt_for_buf,		/* Index: 1 */
2043 	sd_initpkt_for_buf,		/* Index: 2 */
2044 
2045 	/* Chain for buf IO for disk drive targets (PM disabled) */
2046 	sd_initpkt_for_buf,		/* Index: 3 */
2047 	sd_initpkt_for_buf,		/* Index: 4 */
2048 
2049 	/*
2050 	 * Chain for buf IO for removable-media or large sector size
2051 	 * disk drive targets (PM enabled)
2052 	 */
2053 	sd_initpkt_for_buf,		/* Index: 5 */
2054 	sd_initpkt_for_buf,		/* Index: 6 */
2055 	sd_initpkt_for_buf,		/* Index: 7 */
2056 	sd_initpkt_for_buf,		/* Index: 8 */
2057 
2058 	/*
2059 	 * Chain for buf IO for removable-media or large sector size
2060 	 * disk drive targets (PM disabled)
2061 	 */
2062 	sd_initpkt_for_buf,		/* Index: 9 */
2063 	sd_initpkt_for_buf,		/* Index: 10 */
2064 	sd_initpkt_for_buf,		/* Index: 11 */
2065 
2066 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
2067 	sd_initpkt_for_buf,		/* Index: 12 */
2068 	sd_initpkt_for_buf,		/* Index: 13 */
2069 	sd_initpkt_for_buf,		/* Index: 14 */
2070 	sd_initpkt_for_buf,		/* Index: 15 */
2071 
2072 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
2073 	sd_initpkt_for_buf,		/* Index: 16 */
2074 	sd_initpkt_for_buf,		/* Index: 17 */
2075 	sd_initpkt_for_buf,		/* Index: 18 */
2076 
2077 	/* Chain for USCSI commands (non-checksum targets) */
2078 	sd_initpkt_for_uscsi,		/* Index: 19 */
2079 	sd_initpkt_for_uscsi,		/* Index: 20 */
2080 
2081 	/* Chain for USCSI commands (checksum targets) */
2082 	sd_initpkt_for_uscsi,		/* Index: 21 */
2083 	sd_initpkt_for_uscsi,		/* Index: 22 */
2084 	sd_initpkt_for_uscsi,		/* Index: 22 */
2085 
2086 	/* Chain for "direct" USCSI commands (all targets) */
2087 	sd_initpkt_for_uscsi,		/* Index: 24 */
2088 
2089 	/* Chain for "direct priority" USCSI commands (all targets) */
2090 	sd_initpkt_for_uscsi,		/* Index: 25 */
2091 
2092 	/*
2093 	 * Chain for buf IO for large sector size disk drive targets
2094 	 * with checksumming (PM enabled)
2095 	 */
2096 	sd_initpkt_for_buf,		/* Index: 26 */
2097 	sd_initpkt_for_buf,		/* Index: 27 */
2098 	sd_initpkt_for_buf,		/* Index: 28 */
2099 	sd_initpkt_for_buf,		/* Index: 29 */
2100 	sd_initpkt_for_buf,		/* Index: 30 */
2101 
2102 	/*
2103 	 * Chain for buf IO for large sector size disk drive targets
2104 	 * with checksumming (PM disabled)
2105 	 */
2106 	sd_initpkt_for_buf,		/* Index: 31 */
2107 	sd_initpkt_for_buf,		/* Index: 32 */
2108 	sd_initpkt_for_buf,		/* Index: 33 */
2109 	sd_initpkt_for_buf,		/* Index: 34 */
2110 };
2111 
2112 
2113 /*
2114  * Array to map a layering chain index to the appropriate destroypktpkt routine.
2115  * The redundant entries are present so that the index used for accessing
2116  * the above sd_iostart_chain and sd_iodone_chain tables can be used directly
2117  * with this table as well.
2118  */
2119 typedef void (*sd_destroypkt_t)(struct buf *);
2120 
2121 static sd_destroypkt_t	sd_destroypkt_map[] = {
2122 
2123 	/* Chain for buf IO for disk drive targets (PM enabled) */
2124 	sd_destroypkt_for_buf,		/* Index: 0 */
2125 	sd_destroypkt_for_buf,		/* Index: 1 */
2126 	sd_destroypkt_for_buf,		/* Index: 2 */
2127 
2128 	/* Chain for buf IO for disk drive targets (PM disabled) */
2129 	sd_destroypkt_for_buf,		/* Index: 3 */
2130 	sd_destroypkt_for_buf,		/* Index: 4 */
2131 
2132 	/*
2133 	 * Chain for buf IO for removable-media or large sector size
2134 	 * disk drive targets (PM enabled)
2135 	 */
2136 	sd_destroypkt_for_buf,		/* Index: 5 */
2137 	sd_destroypkt_for_buf,		/* Index: 6 */
2138 	sd_destroypkt_for_buf,		/* Index: 7 */
2139 	sd_destroypkt_for_buf,		/* Index: 8 */
2140 
2141 	/*
2142 	 * Chain for buf IO for removable-media or large sector size
2143 	 * disk drive targets (PM disabled)
2144 	 */
2145 	sd_destroypkt_for_buf,		/* Index: 9 */
2146 	sd_destroypkt_for_buf,		/* Index: 10 */
2147 	sd_destroypkt_for_buf,		/* Index: 11 */
2148 
2149 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
2150 	sd_destroypkt_for_buf,		/* Index: 12 */
2151 	sd_destroypkt_for_buf,		/* Index: 13 */
2152 	sd_destroypkt_for_buf,		/* Index: 14 */
2153 	sd_destroypkt_for_buf,		/* Index: 15 */
2154 
2155 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
2156 	sd_destroypkt_for_buf,		/* Index: 16 */
2157 	sd_destroypkt_for_buf,		/* Index: 17 */
2158 	sd_destroypkt_for_buf,		/* Index: 18 */
2159 
2160 	/* Chain for USCSI commands (non-checksum targets) */
2161 	sd_destroypkt_for_uscsi,	/* Index: 19 */
2162 	sd_destroypkt_for_uscsi,	/* Index: 20 */
2163 
2164 	/* Chain for USCSI commands (checksum targets) */
2165 	sd_destroypkt_for_uscsi,	/* Index: 21 */
2166 	sd_destroypkt_for_uscsi,	/* Index: 22 */
2167 	sd_destroypkt_for_uscsi,	/* Index: 22 */
2168 
2169 	/* Chain for "direct" USCSI commands (all targets) */
2170 	sd_destroypkt_for_uscsi,	/* Index: 24 */
2171 
2172 	/* Chain for "direct priority" USCSI commands (all targets) */
2173 	sd_destroypkt_for_uscsi,	/* Index: 25 */
2174 
2175 	/*
2176 	 * Chain for buf IO for large sector size disk drive targets
2177 	 * with checksumming (PM disabled)
2178 	 */
2179 	sd_destroypkt_for_buf,		/* Index: 26 */
2180 	sd_destroypkt_for_buf,		/* Index: 27 */
2181 	sd_destroypkt_for_buf,		/* Index: 28 */
2182 	sd_destroypkt_for_buf,		/* Index: 29 */
2183 	sd_destroypkt_for_buf,		/* Index: 30 */
2184 
2185 	/*
2186 	 * Chain for buf IO for large sector size disk drive targets
2187 	 * with checksumming (PM enabled)
2188 	 */
2189 	sd_destroypkt_for_buf,		/* Index: 31 */
2190 	sd_destroypkt_for_buf,		/* Index: 32 */
2191 	sd_destroypkt_for_buf,		/* Index: 33 */
2192 	sd_destroypkt_for_buf,		/* Index: 34 */
2193 };
2194 
2195 
2196 
2197 /*
2198  * Array to map a layering chain index to the appropriate chain "type".
2199  * The chain type indicates a specific property/usage of the chain.
2200  * The redundant entries are present so that the index used for accessing
2201  * the above sd_iostart_chain and sd_iodone_chain tables can be used directly
2202  * with this table as well.
2203  */
2204 
2205 #define	SD_CHAIN_NULL			0	/* for the special RQS cmd */
2206 #define	SD_CHAIN_BUFIO			1	/* regular buf IO */
2207 #define	SD_CHAIN_USCSI			2	/* regular USCSI commands */
2208 #define	SD_CHAIN_DIRECT			3	/* uscsi, w/ bypass power mgt */
2209 #define	SD_CHAIN_DIRECT_PRIORITY	4	/* uscsi, w/ bypass power mgt */
2210 						/* (for error recovery) */
2211 
2212 static int sd_chain_type_map[] = {
2213 
2214 	/* Chain for buf IO for disk drive targets (PM enabled) */
2215 	SD_CHAIN_BUFIO,			/* Index: 0 */
2216 	SD_CHAIN_BUFIO,			/* Index: 1 */
2217 	SD_CHAIN_BUFIO,			/* Index: 2 */
2218 
2219 	/* Chain for buf IO for disk drive targets (PM disabled) */
2220 	SD_CHAIN_BUFIO,			/* Index: 3 */
2221 	SD_CHAIN_BUFIO,			/* Index: 4 */
2222 
2223 	/*
2224 	 * Chain for buf IO for removable-media or large sector size
2225 	 * disk drive targets (PM enabled)
2226 	 */
2227 	SD_CHAIN_BUFIO,			/* Index: 5 */
2228 	SD_CHAIN_BUFIO,			/* Index: 6 */
2229 	SD_CHAIN_BUFIO,			/* Index: 7 */
2230 	SD_CHAIN_BUFIO,			/* Index: 8 */
2231 
2232 	/*
2233 	 * Chain for buf IO for removable-media or large sector size
2234 	 * disk drive targets (PM disabled)
2235 	 */
2236 	SD_CHAIN_BUFIO,			/* Index: 9 */
2237 	SD_CHAIN_BUFIO,			/* Index: 10 */
2238 	SD_CHAIN_BUFIO,			/* Index: 11 */
2239 
2240 	/* Chain for buf IO for disk drives with checksumming (PM enabled) */
2241 	SD_CHAIN_BUFIO,			/* Index: 12 */
2242 	SD_CHAIN_BUFIO,			/* Index: 13 */
2243 	SD_CHAIN_BUFIO,			/* Index: 14 */
2244 	SD_CHAIN_BUFIO,			/* Index: 15 */
2245 
2246 	/* Chain for buf IO for disk drives with checksumming (PM disabled) */
2247 	SD_CHAIN_BUFIO,			/* Index: 16 */
2248 	SD_CHAIN_BUFIO,			/* Index: 17 */
2249 	SD_CHAIN_BUFIO,			/* Index: 18 */
2250 
2251 	/* Chain for USCSI commands (non-checksum targets) */
2252 	SD_CHAIN_USCSI,			/* Index: 19 */
2253 	SD_CHAIN_USCSI,			/* Index: 20 */
2254 
2255 	/* Chain for USCSI commands (checksum targets) */
2256 	SD_CHAIN_USCSI,			/* Index: 21 */
2257 	SD_CHAIN_USCSI,			/* Index: 22 */
2258 	SD_CHAIN_USCSI,			/* Index: 23 */
2259 
2260 	/* Chain for "direct" USCSI commands (all targets) */
2261 	SD_CHAIN_DIRECT,		/* Index: 24 */
2262 
2263 	/* Chain for "direct priority" USCSI commands (all targets) */
2264 	SD_CHAIN_DIRECT_PRIORITY,	/* Index: 25 */
2265 
2266 	/*
2267 	 * Chain for buf IO for large sector size disk drive targets
2268 	 * with checksumming (PM enabled)
2269 	 */
2270 	SD_CHAIN_BUFIO,			/* Index: 26 */
2271 	SD_CHAIN_BUFIO,			/* Index: 27 */
2272 	SD_CHAIN_BUFIO,			/* Index: 28 */
2273 	SD_CHAIN_BUFIO,			/* Index: 29 */
2274 	SD_CHAIN_BUFIO,			/* Index: 30 */
2275 
2276 	/*
2277 	 * Chain for buf IO for large sector size disk drive targets
2278 	 * with checksumming (PM disabled)
2279 	 */
2280 	SD_CHAIN_BUFIO,			/* Index: 31 */
2281 	SD_CHAIN_BUFIO,			/* Index: 32 */
2282 	SD_CHAIN_BUFIO,			/* Index: 33 */
2283 	SD_CHAIN_BUFIO,			/* Index: 34 */
2284 };
2285 
2286 
2287 /* Macro to return TRUE if the IO has come from the sd_buf_iostart() chain. */
2288 #define	SD_IS_BUFIO(xp)			\
2289 	(sd_chain_type_map[(xp)->xb_chain_iostart] == SD_CHAIN_BUFIO)
2290 
2291 /* Macro to return TRUE if the IO has come from the "direct priority" chain. */
2292 #define	SD_IS_DIRECT_PRIORITY(xp)	\
2293 	(sd_chain_type_map[(xp)->xb_chain_iostart] == SD_CHAIN_DIRECT_PRIORITY)
2294 
2295 
2296 
2297 /*
2298  * Struct, array, and macros to map a specific chain to the appropriate
2299  * layering indexes in the sd_iostart_chain[] and sd_iodone_chain[] arrays.
2300  *
2301  * The sd_chain_index_map[] array is used at attach time to set the various
2302  * un_xxx_chain type members of the sd_lun softstate to the specific layering
2303  * chain to be used with the instance. This allows different instances to use
2304  * different chain for buf IO, uscsi IO, etc.. Also, since the xb_chain_iostart
2305  * and xb_chain_iodone index values in the sd_xbuf are initialized to these
2306  * values at sd_xbuf init time, this allows (1) layering chains may be changed
2307  * dynamically & without the use of locking; and (2) a layer may update the
2308  * xb_chain_io[start|done] member in a given xbuf with its current index value,
2309  * to allow for deferred processing of an IO within the same chain from a
2310  * different execution context.
2311  */
2312 
2313 struct sd_chain_index {
2314 	int	sci_iostart_index;
2315 	int	sci_iodone_index;
2316 };
2317 
2318 static struct sd_chain_index	sd_chain_index_map[] = {
2319 	{ SD_CHAIN_DISK_IOSTART,		SD_CHAIN_DISK_IODONE },
2320 	{ SD_CHAIN_DISK_IOSTART_NO_PM,		SD_CHAIN_DISK_IODONE_NO_PM },
2321 	{ SD_CHAIN_RMMEDIA_IOSTART,		SD_CHAIN_RMMEDIA_IODONE },
2322 	{ SD_CHAIN_RMMEDIA_IOSTART_NO_PM,	SD_CHAIN_RMMEDIA_IODONE_NO_PM },
2323 	{ SD_CHAIN_CHKSUM_IOSTART,		SD_CHAIN_CHKSUM_IODONE },
2324 	{ SD_CHAIN_CHKSUM_IOSTART_NO_PM,	SD_CHAIN_CHKSUM_IODONE_NO_PM },
2325 	{ SD_CHAIN_USCSI_CMD_IOSTART,		SD_CHAIN_USCSI_CMD_IODONE },
2326 	{ SD_CHAIN_USCSI_CHKSUM_IOSTART,	SD_CHAIN_USCSI_CHKSUM_IODONE },
2327 	{ SD_CHAIN_DIRECT_CMD_IOSTART,		SD_CHAIN_DIRECT_CMD_IODONE },
2328 	{ SD_CHAIN_PRIORITY_CMD_IOSTART,	SD_CHAIN_PRIORITY_CMD_IODONE },
2329 	{ SD_CHAIN_MSS_CHKSUM_IOSTART,		SD_CHAIN_MSS_CHKSUM_IODONE },
2330 	{ SD_CHAIN_MSS_CHKSUM_IOSTART_NO_PM, SD_CHAIN_MSS_CHKSUM_IODONE_NO_PM },
2331 
2332 };
2333 
2334 
2335 /*
2336  * The following are indexes into the sd_chain_index_map[] array.
2337  */
2338 
2339 /* un->un_buf_chain_type must be set to one of these */
2340 #define	SD_CHAIN_INFO_DISK		0
2341 #define	SD_CHAIN_INFO_DISK_NO_PM	1
2342 #define	SD_CHAIN_INFO_RMMEDIA		2
2343 #define	SD_CHAIN_INFO_MSS_DISK		2
2344 #define	SD_CHAIN_INFO_RMMEDIA_NO_PM	3
2345 #define	SD_CHAIN_INFO_MSS_DSK_NO_PM	3
2346 #define	SD_CHAIN_INFO_CHKSUM		4
2347 #define	SD_CHAIN_INFO_CHKSUM_NO_PM	5
2348 #define	SD_CHAIN_INFO_MSS_DISK_CHKSUM	10
2349 #define	SD_CHAIN_INFO_MSS_DISK_CHKSUM_NO_PM	11
2350 
2351 /* un->un_uscsi_chain_type must be set to one of these */
2352 #define	SD_CHAIN_INFO_USCSI_CMD		6
2353 /* USCSI with PM disabled is the same as DIRECT */
2354 #define	SD_CHAIN_INFO_USCSI_CMD_NO_PM	8
2355 #define	SD_CHAIN_INFO_USCSI_CHKSUM	7
2356 
2357 /* un->un_direct_chain_type must be set to one of these */
2358 #define	SD_CHAIN_INFO_DIRECT_CMD	8
2359 
2360 /* un->un_priority_chain_type must be set to one of these */
2361 #define	SD_CHAIN_INFO_PRIORITY_CMD	9
2362 
2363 /* size for devid inquiries */
2364 #define	MAX_INQUIRY_SIZE		0xF0
2365 
2366 /*
2367  * Macros used by functions to pass a given buf(9S) struct along to the
2368  * next function in the layering chain for further processing.
2369  *
2370  * In the following macros, passing more than three arguments to the called
2371  * routines causes the optimizer for the SPARC compiler to stop doing tail
2372  * call elimination which results in significant performance degradation.
2373  */
2374 #define	SD_BEGIN_IOSTART(index, un, bp)	\
2375 	((*(sd_iostart_chain[index]))(index, un, bp))
2376 
2377 #define	SD_BEGIN_IODONE(index, un, bp)	\
2378 	((*(sd_iodone_chain[index]))(index, un, bp))
2379 
2380 #define	SD_NEXT_IOSTART(index, un, bp)				\
2381 	((*(sd_iostart_chain[(index) + 1]))((index) + 1, un, bp))
2382 
2383 #define	SD_NEXT_IODONE(index, un, bp)				\
2384 	((*(sd_iodone_chain[(index) - 1]))((index) - 1, un, bp))
2385 
2386 /*
2387  *    Function: _init
2388  *
2389  * Description: This is the driver _init(9E) entry point.
2390  *
2391  * Return Code: Returns the value from mod_install(9F) or
2392  *		ddi_soft_state_init(9F) as appropriate.
2393  *
2394  *     Context: Called when driver module loaded.
2395  */
2396 
2397 int
2398 _init(void)
2399 {
2400 	int	err;
2401 
2402 	/* establish driver name from module name */
2403 	sd_label = (char *)mod_modname(&modlinkage);
2404 
2405 #ifndef XPV_HVM_DRIVER
2406 	err = ddi_soft_state_init(&sd_state, sizeof (struct sd_lun),
2407 	    SD_MAXUNIT);
2408 	if (err != 0) {
2409 		return (err);
2410 	}
2411 
2412 #else /* XPV_HVM_DRIVER */
2413 	/* Remove the leading "hvm_" from the module name */
2414 	ASSERT(strncmp(sd_label, "hvm_", strlen("hvm_")) == 0);
2415 	sd_label += strlen("hvm_");
2416 
2417 #endif /* XPV_HVM_DRIVER */
2418 
2419 	mutex_init(&sd_detach_mutex, NULL, MUTEX_DRIVER, NULL);
2420 	mutex_init(&sd_log_mutex,    NULL, MUTEX_DRIVER, NULL);
2421 	mutex_init(&sd_label_mutex,  NULL, MUTEX_DRIVER, NULL);
2422 
2423 	mutex_init(&sd_tr.srq_resv_reclaim_mutex, NULL, MUTEX_DRIVER, NULL);
2424 	cv_init(&sd_tr.srq_resv_reclaim_cv, NULL, CV_DRIVER, NULL);
2425 	cv_init(&sd_tr.srq_inprocess_cv, NULL, CV_DRIVER, NULL);
2426 
2427 	/*
2428 	 * it's ok to init here even for fibre device
2429 	 */
2430 	sd_scsi_probe_cache_init();
2431 
2432 	sd_scsi_target_lun_init();
2433 
2434 	/*
2435 	 * Creating taskq before mod_install ensures that all callers (threads)
2436 	 * that enter the module after a successful mod_install encounter
2437 	 * a valid taskq.
2438 	 */
2439 	sd_taskq_create();
2440 
2441 	err = mod_install(&modlinkage);
2442 	if (err != 0) {
2443 		/* delete taskq if install fails */
2444 		sd_taskq_delete();
2445 
2446 		mutex_destroy(&sd_detach_mutex);
2447 		mutex_destroy(&sd_log_mutex);
2448 		mutex_destroy(&sd_label_mutex);
2449 
2450 		mutex_destroy(&sd_tr.srq_resv_reclaim_mutex);
2451 		cv_destroy(&sd_tr.srq_resv_reclaim_cv);
2452 		cv_destroy(&sd_tr.srq_inprocess_cv);
2453 
2454 		sd_scsi_probe_cache_fini();
2455 
2456 		sd_scsi_target_lun_fini();
2457 
2458 #ifndef XPV_HVM_DRIVER
2459 		ddi_soft_state_fini(&sd_state);
2460 #endif /* !XPV_HVM_DRIVER */
2461 		return (err);
2462 	}
2463 
2464 	return (err);
2465 }
2466 
2467 
2468 /*
2469  *    Function: _fini
2470  *
2471  * Description: This is the driver _fini(9E) entry point.
2472  *
2473  * Return Code: Returns the value from mod_remove(9F)
2474  *
2475  *     Context: Called when driver module is unloaded.
2476  */
2477 
2478 int
2479 _fini(void)
2480 {
2481 	int err;
2482 
2483 	if ((err = mod_remove(&modlinkage)) != 0) {
2484 		return (err);
2485 	}
2486 
2487 	sd_taskq_delete();
2488 
2489 	mutex_destroy(&sd_detach_mutex);
2490 	mutex_destroy(&sd_log_mutex);
2491 	mutex_destroy(&sd_label_mutex);
2492 	mutex_destroy(&sd_tr.srq_resv_reclaim_mutex);
2493 
2494 	sd_scsi_probe_cache_fini();
2495 
2496 	sd_scsi_target_lun_fini();
2497 
2498 	cv_destroy(&sd_tr.srq_resv_reclaim_cv);
2499 	cv_destroy(&sd_tr.srq_inprocess_cv);
2500 
2501 #ifndef XPV_HVM_DRIVER
2502 	ddi_soft_state_fini(&sd_state);
2503 #endif /* !XPV_HVM_DRIVER */
2504 
2505 	return (err);
2506 }
2507 
2508 
2509 /*
2510  *    Function: _info
2511  *
2512  * Description: This is the driver _info(9E) entry point.
2513  *
2514  *   Arguments: modinfop - pointer to the driver modinfo structure
2515  *
2516  * Return Code: Returns the value from mod_info(9F).
2517  *
2518  *     Context: Kernel thread context
2519  */
2520 
2521 int
2522 _info(struct modinfo *modinfop)
2523 {
2524 	return (mod_info(&modlinkage, modinfop));
2525 }
2526 
2527 
2528 /*
2529  * The following routines implement the driver message logging facility.
2530  * They provide component- and level- based debug output filtering.
2531  * Output may also be restricted to messages for a single instance by
2532  * specifying a soft state pointer in sd_debug_un. If sd_debug_un is set
2533  * to NULL, then messages for all instances are printed.
2534  *
2535  * These routines have been cloned from each other due to the language
2536  * constraints of macros and variable argument list processing.
2537  */
2538 
2539 
2540 /*
2541  *    Function: sd_log_err
2542  *
2543  * Description: This routine is called by the SD_ERROR macro for debug
2544  *		logging of error conditions.
2545  *
2546  *   Arguments: comp - driver component being logged
2547  *		dev  - pointer to driver info structure
2548  *		fmt  - error string and format to be logged
2549  */
2550 
2551 static void
2552 sd_log_err(uint_t comp, struct sd_lun *un, const char *fmt, ...)
2553 {
2554 	va_list		ap;
2555 	dev_info_t	*dev;
2556 
2557 	ASSERT(un != NULL);
2558 	dev = SD_DEVINFO(un);
2559 	ASSERT(dev != NULL);
2560 
2561 	/*
2562 	 * Filter messages based on the global component and level masks.
2563 	 * Also print if un matches the value of sd_debug_un, or if
2564 	 * sd_debug_un is set to NULL.
2565 	 */
2566 	if ((sd_component_mask & comp) && (sd_level_mask & SD_LOGMASK_ERROR) &&
2567 	    ((sd_debug_un == NULL) || (sd_debug_un == un))) {
2568 		mutex_enter(&sd_log_mutex);
2569 		va_start(ap, fmt);
2570 		(void) vsprintf(sd_log_buf, fmt, ap);
2571 		va_end(ap);
2572 		scsi_log(dev, sd_label, CE_CONT, "%s", sd_log_buf);
2573 		mutex_exit(&sd_log_mutex);
2574 	}
2575 #ifdef SD_FAULT_INJECTION
2576 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::sd_injection_mask));
2577 	if (un->sd_injection_mask & comp) {
2578 		mutex_enter(&sd_log_mutex);
2579 		va_start(ap, fmt);
2580 		(void) vsprintf(sd_log_buf, fmt, ap);
2581 		va_end(ap);
2582 		sd_injection_log(sd_log_buf, un);
2583 		mutex_exit(&sd_log_mutex);
2584 	}
2585 #endif
2586 }
2587 
2588 
2589 /*
2590  *    Function: sd_log_info
2591  *
2592  * Description: This routine is called by the SD_INFO macro for debug
2593  *		logging of general purpose informational conditions.
2594  *
2595  *   Arguments: comp - driver component being logged
2596  *		dev  - pointer to driver info structure
2597  *		fmt  - info string and format to be logged
2598  */
2599 
2600 static void
2601 sd_log_info(uint_t component, struct sd_lun *un, const char *fmt, ...)
2602 {
2603 	va_list		ap;
2604 	dev_info_t	*dev;
2605 
2606 	ASSERT(un != NULL);
2607 	dev = SD_DEVINFO(un);
2608 	ASSERT(dev != NULL);
2609 
2610 	/*
2611 	 * Filter messages based on the global component and level masks.
2612 	 * Also print if un matches the value of sd_debug_un, or if
2613 	 * sd_debug_un is set to NULL.
2614 	 */
2615 	if ((sd_component_mask & component) &&
2616 	    (sd_level_mask & SD_LOGMASK_INFO) &&
2617 	    ((sd_debug_un == NULL) || (sd_debug_un == un))) {
2618 		mutex_enter(&sd_log_mutex);
2619 		va_start(ap, fmt);
2620 		(void) vsprintf(sd_log_buf, fmt, ap);
2621 		va_end(ap);
2622 		scsi_log(dev, sd_label, CE_CONT, "%s", sd_log_buf);
2623 		mutex_exit(&sd_log_mutex);
2624 	}
2625 #ifdef SD_FAULT_INJECTION
2626 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::sd_injection_mask));
2627 	if (un->sd_injection_mask & component) {
2628 		mutex_enter(&sd_log_mutex);
2629 		va_start(ap, fmt);
2630 		(void) vsprintf(sd_log_buf, fmt, ap);
2631 		va_end(ap);
2632 		sd_injection_log(sd_log_buf, un);
2633 		mutex_exit(&sd_log_mutex);
2634 	}
2635 #endif
2636 }
2637 
2638 
2639 /*
2640  *    Function: sd_log_trace
2641  *
2642  * Description: This routine is called by the SD_TRACE macro for debug
2643  *		logging of trace conditions (i.e. function entry/exit).
2644  *
2645  *   Arguments: comp - driver component being logged
2646  *		dev  - pointer to driver info structure
2647  *		fmt  - trace string and format to be logged
2648  */
2649 
2650 static void
2651 sd_log_trace(uint_t component, struct sd_lun *un, const char *fmt, ...)
2652 {
2653 	va_list		ap;
2654 	dev_info_t	*dev;
2655 
2656 	ASSERT(un != NULL);
2657 	dev = SD_DEVINFO(un);
2658 	ASSERT(dev != NULL);
2659 
2660 	/*
2661 	 * Filter messages based on the global component and level masks.
2662 	 * Also print if un matches the value of sd_debug_un, or if
2663 	 * sd_debug_un is set to NULL.
2664 	 */
2665 	if ((sd_component_mask & component) &&
2666 	    (sd_level_mask & SD_LOGMASK_TRACE) &&
2667 	    ((sd_debug_un == NULL) || (sd_debug_un == un))) {
2668 		mutex_enter(&sd_log_mutex);
2669 		va_start(ap, fmt);
2670 		(void) vsprintf(sd_log_buf, fmt, ap);
2671 		va_end(ap);
2672 		scsi_log(dev, sd_label, CE_CONT, "%s", sd_log_buf);
2673 		mutex_exit(&sd_log_mutex);
2674 	}
2675 #ifdef SD_FAULT_INJECTION
2676 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::sd_injection_mask));
2677 	if (un->sd_injection_mask & component) {
2678 		mutex_enter(&sd_log_mutex);
2679 		va_start(ap, fmt);
2680 		(void) vsprintf(sd_log_buf, fmt, ap);
2681 		va_end(ap);
2682 		sd_injection_log(sd_log_buf, un);
2683 		mutex_exit(&sd_log_mutex);
2684 	}
2685 #endif
2686 }
2687 
2688 
2689 /*
2690  *    Function: sdprobe
2691  *
2692  * Description: This is the driver probe(9e) entry point function.
2693  *
2694  *   Arguments: devi - opaque device info handle
2695  *
2696  * Return Code: DDI_PROBE_SUCCESS: If the probe was successful.
2697  *              DDI_PROBE_FAILURE: If the probe failed.
2698  *              DDI_PROBE_PARTIAL: If the instance is not present now,
2699  *				   but may be present in the future.
2700  */
2701 
2702 static int
2703 sdprobe(dev_info_t *devi)
2704 {
2705 	struct scsi_device	*devp;
2706 	int			rval;
2707 #ifndef XPV_HVM_DRIVER
2708 	int			instance = ddi_get_instance(devi);
2709 #endif /* !XPV_HVM_DRIVER */
2710 
2711 	/*
2712 	 * if it wasn't for pln, sdprobe could actually be nulldev
2713 	 * in the "__fibre" case.
2714 	 */
2715 	if (ddi_dev_is_sid(devi) == DDI_SUCCESS) {
2716 		return (DDI_PROBE_DONTCARE);
2717 	}
2718 
2719 	devp = ddi_get_driver_private(devi);
2720 
2721 	if (devp == NULL) {
2722 		/* Ooops... nexus driver is mis-configured... */
2723 		return (DDI_PROBE_FAILURE);
2724 	}
2725 
2726 #ifndef XPV_HVM_DRIVER
2727 	if (ddi_get_soft_state(sd_state, instance) != NULL) {
2728 		return (DDI_PROBE_PARTIAL);
2729 	}
2730 #endif /* !XPV_HVM_DRIVER */
2731 
2732 	/*
2733 	 * Call the SCSA utility probe routine to see if we actually
2734 	 * have a target at this SCSI nexus.
2735 	 */
2736 	switch (sd_scsi_probe_with_cache(devp, NULL_FUNC)) {
2737 	case SCSIPROBE_EXISTS:
2738 		switch (devp->sd_inq->inq_dtype) {
2739 		case DTYPE_DIRECT:
2740 			rval = DDI_PROBE_SUCCESS;
2741 			break;
2742 		case DTYPE_RODIRECT:
2743 			/* CDs etc. Can be removable media */
2744 			rval = DDI_PROBE_SUCCESS;
2745 			break;
2746 		case DTYPE_OPTICAL:
2747 			/*
2748 			 * Rewritable optical driver HP115AA
2749 			 * Can also be removable media
2750 			 */
2751 
2752 			/*
2753 			 * Do not attempt to bind to  DTYPE_OPTICAL if
2754 			 * pre solaris 9 sparc sd behavior is required
2755 			 *
2756 			 * If first time through and sd_dtype_optical_bind
2757 			 * has not been set in /etc/system check properties
2758 			 */
2759 
2760 			if (sd_dtype_optical_bind  < 0) {
2761 				sd_dtype_optical_bind = ddi_prop_get_int
2762 				    (DDI_DEV_T_ANY, devi, 0,
2763 				    "optical-device-bind", 1);
2764 			}
2765 
2766 			if (sd_dtype_optical_bind == 0) {
2767 				rval = DDI_PROBE_FAILURE;
2768 			} else {
2769 				rval = DDI_PROBE_SUCCESS;
2770 			}
2771 			break;
2772 
2773 		case DTYPE_NOTPRESENT:
2774 		default:
2775 			rval = DDI_PROBE_FAILURE;
2776 			break;
2777 		}
2778 		break;
2779 	default:
2780 		rval = DDI_PROBE_PARTIAL;
2781 		break;
2782 	}
2783 
2784 	/*
2785 	 * This routine checks for resource allocation prior to freeing,
2786 	 * so it will take care of the "smart probing" case where a
2787 	 * scsi_probe() may or may not have been issued and will *not*
2788 	 * free previously-freed resources.
2789 	 */
2790 	scsi_unprobe(devp);
2791 	return (rval);
2792 }
2793 
2794 
2795 /*
2796  *    Function: sdinfo
2797  *
2798  * Description: This is the driver getinfo(9e) entry point function.
2799  * 		Given the device number, return the devinfo pointer from
2800  *		the scsi_device structure or the instance number
2801  *		associated with the dev_t.
2802  *
2803  *   Arguments: dip     - pointer to device info structure
2804  *		infocmd - command argument (DDI_INFO_DEVT2DEVINFO,
2805  *			  DDI_INFO_DEVT2INSTANCE)
2806  *		arg     - driver dev_t
2807  *		resultp - user buffer for request response
2808  *
2809  * Return Code: DDI_SUCCESS
2810  *              DDI_FAILURE
2811  */
2812 /* ARGSUSED */
2813 static int
2814 sdinfo(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
2815 {
2816 	struct sd_lun	*un;
2817 	dev_t		dev;
2818 	int		instance;
2819 	int		error;
2820 
2821 	switch (infocmd) {
2822 	case DDI_INFO_DEVT2DEVINFO:
2823 		dev = (dev_t)arg;
2824 		instance = SDUNIT(dev);
2825 		if ((un = ddi_get_soft_state(sd_state, instance)) == NULL) {
2826 			return (DDI_FAILURE);
2827 		}
2828 		*result = (void *) SD_DEVINFO(un);
2829 		error = DDI_SUCCESS;
2830 		break;
2831 	case DDI_INFO_DEVT2INSTANCE:
2832 		dev = (dev_t)arg;
2833 		instance = SDUNIT(dev);
2834 		*result = (void *)(uintptr_t)instance;
2835 		error = DDI_SUCCESS;
2836 		break;
2837 	default:
2838 		error = DDI_FAILURE;
2839 	}
2840 	return (error);
2841 }
2842 
2843 /*
2844  *    Function: sd_prop_op
2845  *
2846  * Description: This is the driver prop_op(9e) entry point function.
2847  *		Return the number of blocks for the partition in question
2848  *		or forward the request to the property facilities.
2849  *
2850  *   Arguments: dev       - device number
2851  *		dip       - pointer to device info structure
2852  *		prop_op   - property operator
2853  *		mod_flags - DDI_PROP_DONTPASS, don't pass to parent
2854  *		name      - pointer to property name
2855  *		valuep    - pointer or address of the user buffer
2856  *		lengthp   - property length
2857  *
2858  * Return Code: DDI_PROP_SUCCESS
2859  *              DDI_PROP_NOT_FOUND
2860  *              DDI_PROP_UNDEFINED
2861  *              DDI_PROP_NO_MEMORY
2862  *              DDI_PROP_BUF_TOO_SMALL
2863  */
2864 
2865 static int
2866 sd_prop_op(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op, int mod_flags,
2867 	char *name, caddr_t valuep, int *lengthp)
2868 {
2869 	struct sd_lun	*un;
2870 
2871 	if ((un = ddi_get_soft_state(sd_state, ddi_get_instance(dip))) == NULL)
2872 		return (ddi_prop_op(dev, dip, prop_op, mod_flags,
2873 		    name, valuep, lengthp));
2874 
2875 	return (cmlb_prop_op(un->un_cmlbhandle,
2876 	    dev, dip, prop_op, mod_flags, name, valuep, lengthp,
2877 	    SDPART(dev), (void *)SD_PATH_DIRECT));
2878 }
2879 
2880 /*
2881  * The following functions are for smart probing:
2882  * sd_scsi_probe_cache_init()
2883  * sd_scsi_probe_cache_fini()
2884  * sd_scsi_clear_probe_cache()
2885  * sd_scsi_probe_with_cache()
2886  */
2887 
2888 /*
2889  *    Function: sd_scsi_probe_cache_init
2890  *
2891  * Description: Initializes the probe response cache mutex and head pointer.
2892  *
2893  *     Context: Kernel thread context
2894  */
2895 
2896 static void
2897 sd_scsi_probe_cache_init(void)
2898 {
2899 	mutex_init(&sd_scsi_probe_cache_mutex, NULL, MUTEX_DRIVER, NULL);
2900 	sd_scsi_probe_cache_head = NULL;
2901 }
2902 
2903 
2904 /*
2905  *    Function: sd_scsi_probe_cache_fini
2906  *
2907  * Description: Frees all resources associated with the probe response cache.
2908  *
2909  *     Context: Kernel thread context
2910  */
2911 
2912 static void
2913 sd_scsi_probe_cache_fini(void)
2914 {
2915 	struct sd_scsi_probe_cache *cp;
2916 	struct sd_scsi_probe_cache *ncp;
2917 
2918 	/* Clean up our smart probing linked list */
2919 	for (cp = sd_scsi_probe_cache_head; cp != NULL; cp = ncp) {
2920 		ncp = cp->next;
2921 		kmem_free(cp, sizeof (struct sd_scsi_probe_cache));
2922 	}
2923 	sd_scsi_probe_cache_head = NULL;
2924 	mutex_destroy(&sd_scsi_probe_cache_mutex);
2925 }
2926 
2927 
2928 /*
2929  *    Function: sd_scsi_clear_probe_cache
2930  *
2931  * Description: This routine clears the probe response cache. This is
2932  *		done when open() returns ENXIO so that when deferred
2933  *		attach is attempted (possibly after a device has been
2934  *		turned on) we will retry the probe. Since we don't know
2935  *		which target we failed to open, we just clear the
2936  *		entire cache.
2937  *
2938  *     Context: Kernel thread context
2939  */
2940 
2941 static void
2942 sd_scsi_clear_probe_cache(void)
2943 {
2944 	struct sd_scsi_probe_cache	*cp;
2945 	int				i;
2946 
2947 	mutex_enter(&sd_scsi_probe_cache_mutex);
2948 	for (cp = sd_scsi_probe_cache_head; cp != NULL; cp = cp->next) {
2949 		/*
2950 		 * Reset all entries to SCSIPROBE_EXISTS.  This will
2951 		 * force probing to be performed the next time
2952 		 * sd_scsi_probe_with_cache is called.
2953 		 */
2954 		for (i = 0; i < NTARGETS_WIDE; i++) {
2955 			cp->cache[i] = SCSIPROBE_EXISTS;
2956 		}
2957 	}
2958 	mutex_exit(&sd_scsi_probe_cache_mutex);
2959 }
2960 
2961 
2962 /*
2963  *    Function: sd_scsi_probe_with_cache
2964  *
2965  * Description: This routine implements support for a scsi device probe
2966  *		with cache. The driver maintains a cache of the target
2967  *		responses to scsi probes. If we get no response from a
2968  *		target during a probe inquiry, we remember that, and we
2969  *		avoid additional calls to scsi_probe on non-zero LUNs
2970  *		on the same target until the cache is cleared. By doing
2971  *		so we avoid the 1/4 sec selection timeout for nonzero
2972  *		LUNs. lun0 of a target is always probed.
2973  *
2974  *   Arguments: devp     - Pointer to a scsi_device(9S) structure
2975  *              waitfunc - indicates what the allocator routines should
2976  *			   do when resources are not available. This value
2977  *			   is passed on to scsi_probe() when that routine
2978  *			   is called.
2979  *
2980  * Return Code: SCSIPROBE_NORESP if a NORESP in probe response cache;
2981  *		otherwise the value returned by scsi_probe(9F).
2982  *
2983  *     Context: Kernel thread context
2984  */
2985 
2986 static int
2987 sd_scsi_probe_with_cache(struct scsi_device *devp, int (*waitfn)())
2988 {
2989 	struct sd_scsi_probe_cache	*cp;
2990 	dev_info_t	*pdip = ddi_get_parent(devp->sd_dev);
2991 	int		lun, tgt;
2992 
2993 	lun = ddi_prop_get_int(DDI_DEV_T_ANY, devp->sd_dev, DDI_PROP_DONTPASS,
2994 	    SCSI_ADDR_PROP_LUN, 0);
2995 	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, devp->sd_dev, DDI_PROP_DONTPASS,
2996 	    SCSI_ADDR_PROP_TARGET, -1);
2997 
2998 	/* Make sure caching enabled and target in range */
2999 	if ((tgt < 0) || (tgt >= NTARGETS_WIDE)) {
3000 		/* do it the old way (no cache) */
3001 		return (scsi_probe(devp, waitfn));
3002 	}
3003 
3004 	mutex_enter(&sd_scsi_probe_cache_mutex);
3005 
3006 	/* Find the cache for this scsi bus instance */
3007 	for (cp = sd_scsi_probe_cache_head; cp != NULL; cp = cp->next) {
3008 		if (cp->pdip == pdip) {
3009 			break;
3010 		}
3011 	}
3012 
3013 	/* If we can't find a cache for this pdip, create one */
3014 	if (cp == NULL) {
3015 		int i;
3016 
3017 		cp = kmem_zalloc(sizeof (struct sd_scsi_probe_cache),
3018 		    KM_SLEEP);
3019 		cp->pdip = pdip;
3020 		cp->next = sd_scsi_probe_cache_head;
3021 		sd_scsi_probe_cache_head = cp;
3022 		for (i = 0; i < NTARGETS_WIDE; i++) {
3023 			cp->cache[i] = SCSIPROBE_EXISTS;
3024 		}
3025 	}
3026 
3027 	mutex_exit(&sd_scsi_probe_cache_mutex);
3028 
3029 	/* Recompute the cache for this target if LUN zero */
3030 	if (lun == 0) {
3031 		cp->cache[tgt] = SCSIPROBE_EXISTS;
3032 	}
3033 
3034 	/* Don't probe if cache remembers a NORESP from a previous LUN. */
3035 	if (cp->cache[tgt] != SCSIPROBE_EXISTS) {
3036 		return (SCSIPROBE_NORESP);
3037 	}
3038 
3039 	/* Do the actual probe; save & return the result */
3040 	return (cp->cache[tgt] = scsi_probe(devp, waitfn));
3041 }
3042 
3043 
3044 /*
3045  *    Function: sd_scsi_target_lun_init
3046  *
3047  * Description: Initializes the attached lun chain mutex and head pointer.
3048  *
3049  *     Context: Kernel thread context
3050  */
3051 
3052 static void
3053 sd_scsi_target_lun_init(void)
3054 {
3055 	mutex_init(&sd_scsi_target_lun_mutex, NULL, MUTEX_DRIVER, NULL);
3056 	sd_scsi_target_lun_head = NULL;
3057 }
3058 
3059 
3060 /*
3061  *    Function: sd_scsi_target_lun_fini
3062  *
3063  * Description: Frees all resources associated with the attached lun
3064  *              chain
3065  *
3066  *     Context: Kernel thread context
3067  */
3068 
3069 static void
3070 sd_scsi_target_lun_fini(void)
3071 {
3072 	struct sd_scsi_hba_tgt_lun	*cp;
3073 	struct sd_scsi_hba_tgt_lun	*ncp;
3074 
3075 	for (cp = sd_scsi_target_lun_head; cp != NULL; cp = ncp) {
3076 		ncp = cp->next;
3077 		kmem_free(cp, sizeof (struct sd_scsi_hba_tgt_lun));
3078 	}
3079 	sd_scsi_target_lun_head = NULL;
3080 	mutex_destroy(&sd_scsi_target_lun_mutex);
3081 }
3082 
3083 
3084 /*
3085  *    Function: sd_scsi_get_target_lun_count
3086  *
3087  * Description: This routine will check in the attached lun chain to see
3088  * 		how many luns are attached on the required SCSI controller
3089  * 		and target. Currently, some capabilities like tagged queue
3090  *		are supported per target based by HBA. So all luns in a
3091  *		target have the same capabilities. Based on this assumption,
3092  * 		sd should only set these capabilities once per target. This
3093  *		function is called when sd needs to decide how many luns
3094  *		already attached on a target.
3095  *
3096  *   Arguments: dip	- Pointer to the system's dev_info_t for the SCSI
3097  *			  controller device.
3098  *              target	- The target ID on the controller's SCSI bus.
3099  *
3100  * Return Code: The number of luns attached on the required target and
3101  *		controller.
3102  *		-1 if target ID is not in parallel SCSI scope or the given
3103  * 		dip is not in the chain.
3104  *
3105  *     Context: Kernel thread context
3106  */
3107 
3108 static int
3109 sd_scsi_get_target_lun_count(dev_info_t *dip, int target)
3110 {
3111 	struct sd_scsi_hba_tgt_lun	*cp;
3112 
3113 	if ((target < 0) || (target >= NTARGETS_WIDE)) {
3114 		return (-1);
3115 	}
3116 
3117 	mutex_enter(&sd_scsi_target_lun_mutex);
3118 
3119 	for (cp = sd_scsi_target_lun_head; cp != NULL; cp = cp->next) {
3120 		if (cp->pdip == dip) {
3121 			break;
3122 		}
3123 	}
3124 
3125 	mutex_exit(&sd_scsi_target_lun_mutex);
3126 
3127 	if (cp == NULL) {
3128 		return (-1);
3129 	}
3130 
3131 	return (cp->nlun[target]);
3132 }
3133 
3134 
3135 /*
3136  *    Function: sd_scsi_update_lun_on_target
3137  *
3138  * Description: This routine is used to update the attached lun chain when a
3139  *		lun is attached or detached on a target.
3140  *
3141  *   Arguments: dip     - Pointer to the system's dev_info_t for the SCSI
3142  *                        controller device.
3143  *              target  - The target ID on the controller's SCSI bus.
3144  *		flag	- Indicate the lun is attached or detached.
3145  *
3146  *     Context: Kernel thread context
3147  */
3148 
3149 static void
3150 sd_scsi_update_lun_on_target(dev_info_t *dip, int target, int flag)
3151 {
3152 	struct sd_scsi_hba_tgt_lun	*cp;
3153 
3154 	mutex_enter(&sd_scsi_target_lun_mutex);
3155 
3156 	for (cp = sd_scsi_target_lun_head; cp != NULL; cp = cp->next) {
3157 		if (cp->pdip == dip) {
3158 			break;
3159 		}
3160 	}
3161 
3162 	if ((cp == NULL) && (flag == SD_SCSI_LUN_ATTACH)) {
3163 		cp = kmem_zalloc(sizeof (struct sd_scsi_hba_tgt_lun),
3164 		    KM_SLEEP);
3165 		cp->pdip = dip;
3166 		cp->next = sd_scsi_target_lun_head;
3167 		sd_scsi_target_lun_head = cp;
3168 	}
3169 
3170 	mutex_exit(&sd_scsi_target_lun_mutex);
3171 
3172 	if (cp != NULL) {
3173 		if (flag == SD_SCSI_LUN_ATTACH) {
3174 			cp->nlun[target] ++;
3175 		} else {
3176 			cp->nlun[target] --;
3177 		}
3178 	}
3179 }
3180 
3181 
3182 /*
3183  *    Function: sd_spin_up_unit
3184  *
3185  * Description: Issues the following commands to spin-up the device:
3186  *		START STOP UNIT, and INQUIRY.
3187  *
3188  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
3189  *                      structure for this target.
3190  *
3191  * Return Code: 0 - success
3192  *		EIO - failure
3193  *		EACCES - reservation conflict
3194  *
3195  *     Context: Kernel thread context
3196  */
3197 
3198 static int
3199 sd_spin_up_unit(sd_ssc_t *ssc)
3200 {
3201 	size_t	resid		= 0;
3202 	int	has_conflict	= FALSE;
3203 	uchar_t *bufaddr;
3204 	int 	status;
3205 	struct sd_lun	*un;
3206 
3207 	ASSERT(ssc != NULL);
3208 	un = ssc->ssc_un;
3209 	ASSERT(un != NULL);
3210 
3211 	/*
3212 	 * Send a throwaway START UNIT command.
3213 	 *
3214 	 * If we fail on this, we don't care presently what precisely
3215 	 * is wrong.  EMC's arrays will also fail this with a check
3216 	 * condition (0x2/0x4/0x3) if the device is "inactive," but
3217 	 * we don't want to fail the attach because it may become
3218 	 * "active" later.
3219 	 * We don't know if power condition is supported or not at
3220 	 * this stage, use START STOP bit.
3221 	 */
3222 	status = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
3223 	    SD_TARGET_START, SD_PATH_DIRECT);
3224 
3225 	if (status != 0) {
3226 		if (status == EACCES)
3227 			has_conflict = TRUE;
3228 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3229 	}
3230 
3231 	/*
3232 	 * Send another INQUIRY command to the target. This is necessary for
3233 	 * non-removable media direct access devices because their INQUIRY data
3234 	 * may not be fully qualified until they are spun up (perhaps via the
3235 	 * START command above).  Note: This seems to be needed for some
3236 	 * legacy devices only.) The INQUIRY command should succeed even if a
3237 	 * Reservation Conflict is present.
3238 	 */
3239 	bufaddr = kmem_zalloc(SUN_INQSIZE, KM_SLEEP);
3240 
3241 	if (sd_send_scsi_INQUIRY(ssc, bufaddr, SUN_INQSIZE, 0, 0, &resid)
3242 	    != 0) {
3243 		kmem_free(bufaddr, SUN_INQSIZE);
3244 		sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
3245 		return (EIO);
3246 	}
3247 
3248 	/*
3249 	 * If we got enough INQUIRY data, copy it over the old INQUIRY data.
3250 	 * Note that this routine does not return a failure here even if the
3251 	 * INQUIRY command did not return any data.  This is a legacy behavior.
3252 	 */
3253 	if ((SUN_INQSIZE - resid) >= SUN_MIN_INQLEN) {
3254 		bcopy(bufaddr, SD_INQUIRY(un), SUN_INQSIZE);
3255 	}
3256 
3257 	kmem_free(bufaddr, SUN_INQSIZE);
3258 
3259 	/* If we hit a reservation conflict above, tell the caller. */
3260 	if (has_conflict == TRUE) {
3261 		return (EACCES);
3262 	}
3263 
3264 	return (0);
3265 }
3266 
3267 #ifdef _LP64
3268 /*
3269  *    Function: sd_enable_descr_sense
3270  *
3271  * Description: This routine attempts to select descriptor sense format
3272  *		using the Control mode page.  Devices that support 64 bit
3273  *		LBAs (for >2TB luns) should also implement descriptor
3274  *		sense data so we will call this function whenever we see
3275  *		a lun larger than 2TB.  If for some reason the device
3276  *		supports 64 bit LBAs but doesn't support descriptor sense
3277  *		presumably the mode select will fail.  Everything will
3278  *		continue to work normally except that we will not get
3279  *		complete sense data for commands that fail with an LBA
3280  *		larger than 32 bits.
3281  *
3282  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
3283  *                      structure for this target.
3284  *
3285  *     Context: Kernel thread context only
3286  */
3287 
3288 static void
3289 sd_enable_descr_sense(sd_ssc_t *ssc)
3290 {
3291 	uchar_t			*header;
3292 	struct mode_control_scsi3 *ctrl_bufp;
3293 	size_t			buflen;
3294 	size_t			bd_len;
3295 	int			status;
3296 	struct sd_lun		*un;
3297 
3298 	ASSERT(ssc != NULL);
3299 	un = ssc->ssc_un;
3300 	ASSERT(un != NULL);
3301 
3302 	/*
3303 	 * Read MODE SENSE page 0xA, Control Mode Page
3304 	 */
3305 	buflen = MODE_HEADER_LENGTH + MODE_BLK_DESC_LENGTH +
3306 	    sizeof (struct mode_control_scsi3);
3307 	header = kmem_zalloc(buflen, KM_SLEEP);
3308 
3309 	status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, header, buflen,
3310 	    MODEPAGE_CTRL_MODE, SD_PATH_DIRECT);
3311 
3312 	if (status != 0) {
3313 		SD_ERROR(SD_LOG_COMMON, un,
3314 		    "sd_enable_descr_sense: mode sense ctrl page failed\n");
3315 		goto eds_exit;
3316 	}
3317 
3318 	/*
3319 	 * Determine size of Block Descriptors in order to locate
3320 	 * the mode page data. ATAPI devices return 0, SCSI devices
3321 	 * should return MODE_BLK_DESC_LENGTH.
3322 	 */
3323 	bd_len  = ((struct mode_header *)header)->bdesc_length;
3324 
3325 	/* Clear the mode data length field for MODE SELECT */
3326 	((struct mode_header *)header)->length = 0;
3327 
3328 	ctrl_bufp = (struct mode_control_scsi3 *)
3329 	    (header + MODE_HEADER_LENGTH + bd_len);
3330 
3331 	/*
3332 	 * If the page length is smaller than the expected value,
3333 	 * the target device doesn't support D_SENSE. Bail out here.
3334 	 */
3335 	if (ctrl_bufp->mode_page.length <
3336 	    sizeof (struct mode_control_scsi3) - 2) {
3337 		SD_ERROR(SD_LOG_COMMON, un,
3338 		    "sd_enable_descr_sense: enable D_SENSE failed\n");
3339 		goto eds_exit;
3340 	}
3341 
3342 	/*
3343 	 * Clear PS bit for MODE SELECT
3344 	 */
3345 	ctrl_bufp->mode_page.ps = 0;
3346 
3347 	/*
3348 	 * Set D_SENSE to enable descriptor sense format.
3349 	 */
3350 	ctrl_bufp->d_sense = 1;
3351 
3352 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3353 
3354 	/*
3355 	 * Use MODE SELECT to commit the change to the D_SENSE bit
3356 	 */
3357 	status = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, header,
3358 	    buflen, SD_DONTSAVE_PAGE, SD_PATH_DIRECT);
3359 
3360 	if (status != 0) {
3361 		SD_INFO(SD_LOG_COMMON, un,
3362 		    "sd_enable_descr_sense: mode select ctrl page failed\n");
3363 	} else {
3364 		kmem_free(header, buflen);
3365 		return;
3366 	}
3367 
3368 eds_exit:
3369 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3370 	kmem_free(header, buflen);
3371 }
3372 
3373 /*
3374  *    Function: sd_reenable_dsense_task
3375  *
3376  * Description: Re-enable descriptor sense after device or bus reset
3377  *
3378  *     Context: Executes in a taskq() thread context
3379  */
3380 static void
3381 sd_reenable_dsense_task(void *arg)
3382 {
3383 	struct	sd_lun	*un = arg;
3384 	sd_ssc_t	*ssc;
3385 
3386 	ASSERT(un != NULL);
3387 
3388 	ssc = sd_ssc_init(un);
3389 	sd_enable_descr_sense(ssc);
3390 	sd_ssc_fini(ssc);
3391 }
3392 #endif /* _LP64 */
3393 
3394 /*
3395  *    Function: sd_set_mmc_caps
3396  *
3397  * Description: This routine determines if the device is MMC compliant and if
3398  *		the device supports CDDA via a mode sense of the CDVD
3399  *		capabilities mode page. Also checks if the device is a
3400  *		dvdram writable device.
3401  *
3402  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
3403  *                      structure for this target.
3404  *
3405  *     Context: Kernel thread context only
3406  */
3407 
3408 static void
3409 sd_set_mmc_caps(sd_ssc_t *ssc)
3410 {
3411 	struct mode_header_grp2		*sense_mhp;
3412 	uchar_t				*sense_page;
3413 	caddr_t				buf;
3414 	int				bd_len;
3415 	int				status;
3416 	struct uscsi_cmd		com;
3417 	int				rtn;
3418 	uchar_t				*out_data_rw, *out_data_hd;
3419 	uchar_t				*rqbuf_rw, *rqbuf_hd;
3420 	uchar_t				*out_data_gesn;
3421 	int				gesn_len;
3422 	struct sd_lun			*un;
3423 
3424 	ASSERT(ssc != NULL);
3425 	un = ssc->ssc_un;
3426 	ASSERT(un != NULL);
3427 
3428 	/*
3429 	 * The flags which will be set in this function are - mmc compliant,
3430 	 * dvdram writable device, cdda support. Initialize them to FALSE
3431 	 * and if a capability is detected - it will be set to TRUE.
3432 	 */
3433 	un->un_f_mmc_cap = FALSE;
3434 	un->un_f_dvdram_writable_device = FALSE;
3435 	un->un_f_cfg_cdda = FALSE;
3436 
3437 	buf = kmem_zalloc(BUFLEN_MODE_CDROM_CAP, KM_SLEEP);
3438 	status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, (uchar_t *)buf,
3439 	    BUFLEN_MODE_CDROM_CAP, MODEPAGE_CDROM_CAP, SD_PATH_DIRECT);
3440 
3441 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3442 
3443 	if (status != 0) {
3444 		/* command failed; just return */
3445 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3446 		return;
3447 	}
3448 	/*
3449 	 * If the mode sense request for the CDROM CAPABILITIES
3450 	 * page (0x2A) succeeds the device is assumed to be MMC.
3451 	 */
3452 	un->un_f_mmc_cap = TRUE;
3453 
3454 	/* See if GET STATUS EVENT NOTIFICATION is supported */
3455 	if (un->un_f_mmc_gesn_polling) {
3456 		gesn_len = SD_GESN_HEADER_LEN + SD_GESN_MEDIA_DATA_LEN;
3457 		out_data_gesn = kmem_zalloc(gesn_len, KM_SLEEP);
3458 
3459 		rtn = sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION(ssc,
3460 		    out_data_gesn, gesn_len, 1 << SD_GESN_MEDIA_CLASS);
3461 
3462 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3463 
3464 		if ((rtn != 0) || !sd_gesn_media_data_valid(out_data_gesn)) {
3465 			un->un_f_mmc_gesn_polling = FALSE;
3466 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
3467 			    "sd_set_mmc_caps: gesn not supported "
3468 			    "%d %x %x %x %x\n", rtn,
3469 			    out_data_gesn[0], out_data_gesn[1],
3470 			    out_data_gesn[2], out_data_gesn[3]);
3471 		}
3472 
3473 		kmem_free(out_data_gesn, gesn_len);
3474 	}
3475 
3476 	/* Get to the page data */
3477 	sense_mhp = (struct mode_header_grp2 *)buf;
3478 	bd_len = (sense_mhp->bdesc_length_hi << 8) |
3479 	    sense_mhp->bdesc_length_lo;
3480 	if (bd_len > MODE_BLK_DESC_LENGTH) {
3481 		/*
3482 		 * We did not get back the expected block descriptor
3483 		 * length so we cannot determine if the device supports
3484 		 * CDDA. However, we still indicate the device is MMC
3485 		 * according to the successful response to the page
3486 		 * 0x2A mode sense request.
3487 		 */
3488 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
3489 		    "sd_set_mmc_caps: Mode Sense returned "
3490 		    "invalid block descriptor length\n");
3491 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3492 		return;
3493 	}
3494 
3495 	/* See if read CDDA is supported */
3496 	sense_page = (uchar_t *)(buf + MODE_HEADER_LENGTH_GRP2 +
3497 	    bd_len);
3498 	un->un_f_cfg_cdda = (sense_page[5] & 0x01) ? TRUE : FALSE;
3499 
3500 	/* See if writing DVD RAM is supported. */
3501 	un->un_f_dvdram_writable_device = (sense_page[3] & 0x20) ? TRUE : FALSE;
3502 	if (un->un_f_dvdram_writable_device == TRUE) {
3503 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3504 		return;
3505 	}
3506 
3507 	/*
3508 	 * If the device presents DVD or CD capabilities in the mode
3509 	 * page, we can return here since a RRD will not have
3510 	 * these capabilities.
3511 	 */
3512 	if ((sense_page[2] & 0x3f) || (sense_page[3] & 0x3f)) {
3513 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3514 		return;
3515 	}
3516 	kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3517 
3518 	/*
3519 	 * If un->un_f_dvdram_writable_device is still FALSE,
3520 	 * check for a Removable Rigid Disk (RRD).  A RRD
3521 	 * device is identified by the features RANDOM_WRITABLE and
3522 	 * HARDWARE_DEFECT_MANAGEMENT.
3523 	 */
3524 	out_data_rw = kmem_zalloc(SD_CURRENT_FEATURE_LEN, KM_SLEEP);
3525 	rqbuf_rw = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3526 
3527 	rtn = sd_send_scsi_feature_GET_CONFIGURATION(ssc, &com, rqbuf_rw,
3528 	    SENSE_LENGTH, out_data_rw, SD_CURRENT_FEATURE_LEN,
3529 	    RANDOM_WRITABLE, SD_PATH_STANDARD);
3530 
3531 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3532 
3533 	if (rtn != 0) {
3534 		kmem_free(out_data_rw, SD_CURRENT_FEATURE_LEN);
3535 		kmem_free(rqbuf_rw, SENSE_LENGTH);
3536 		return;
3537 	}
3538 
3539 	out_data_hd = kmem_zalloc(SD_CURRENT_FEATURE_LEN, KM_SLEEP);
3540 	rqbuf_hd = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3541 
3542 	rtn = sd_send_scsi_feature_GET_CONFIGURATION(ssc, &com, rqbuf_hd,
3543 	    SENSE_LENGTH, out_data_hd, SD_CURRENT_FEATURE_LEN,
3544 	    HARDWARE_DEFECT_MANAGEMENT, SD_PATH_STANDARD);
3545 
3546 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3547 
3548 	if (rtn == 0) {
3549 		/*
3550 		 * We have good information, check for random writable
3551 		 * and hardware defect features.
3552 		 */
3553 		if ((out_data_rw[9] & RANDOM_WRITABLE) &&
3554 		    (out_data_hd[9] & HARDWARE_DEFECT_MANAGEMENT)) {
3555 			un->un_f_dvdram_writable_device = TRUE;
3556 		}
3557 	}
3558 
3559 	kmem_free(out_data_rw, SD_CURRENT_FEATURE_LEN);
3560 	kmem_free(rqbuf_rw, SENSE_LENGTH);
3561 	kmem_free(out_data_hd, SD_CURRENT_FEATURE_LEN);
3562 	kmem_free(rqbuf_hd, SENSE_LENGTH);
3563 }
3564 
3565 /*
3566  *    Function: sd_check_for_writable_cd
3567  *
3568  * Description: This routine determines if the media in the device is
3569  *		writable or not. It uses the get configuration command (0x46)
3570  *		to determine if the media is writable
3571  *
3572  *   Arguments: un - driver soft state (unit) structure
3573  *              path_flag - SD_PATH_DIRECT to use the USCSI "direct"
3574  *                           chain and the normal command waitq, or
3575  *                           SD_PATH_DIRECT_PRIORITY to use the USCSI
3576  *                           "direct" chain and bypass the normal command
3577  *                           waitq.
3578  *
3579  *     Context: Never called at interrupt context.
3580  */
3581 
3582 static void
3583 sd_check_for_writable_cd(sd_ssc_t *ssc, int path_flag)
3584 {
3585 	struct uscsi_cmd		com;
3586 	uchar_t				*out_data;
3587 	uchar_t				*rqbuf;
3588 	int				rtn;
3589 	uchar_t				*out_data_rw, *out_data_hd;
3590 	uchar_t				*rqbuf_rw, *rqbuf_hd;
3591 	struct mode_header_grp2		*sense_mhp;
3592 	uchar_t				*sense_page;
3593 	caddr_t				buf;
3594 	int				bd_len;
3595 	int				status;
3596 	struct sd_lun			*un;
3597 
3598 	ASSERT(ssc != NULL);
3599 	un = ssc->ssc_un;
3600 	ASSERT(un != NULL);
3601 	ASSERT(mutex_owned(SD_MUTEX(un)));
3602 
3603 	/*
3604 	 * Initialize the writable media to false, if configuration info.
3605 	 * tells us otherwise then only we will set it.
3606 	 */
3607 	un->un_f_mmc_writable_media = FALSE;
3608 	mutex_exit(SD_MUTEX(un));
3609 
3610 	out_data = kmem_zalloc(SD_PROFILE_HEADER_LEN, KM_SLEEP);
3611 	rqbuf = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3612 
3613 	rtn = sd_send_scsi_GET_CONFIGURATION(ssc, &com, rqbuf, SENSE_LENGTH,
3614 	    out_data, SD_PROFILE_HEADER_LEN, path_flag);
3615 
3616 	if (rtn != 0)
3617 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3618 
3619 	mutex_enter(SD_MUTEX(un));
3620 	if (rtn == 0) {
3621 		/*
3622 		 * We have good information, check for writable DVD.
3623 		 */
3624 		if ((out_data[6] == 0) && (out_data[7] == 0x12)) {
3625 			un->un_f_mmc_writable_media = TRUE;
3626 			kmem_free(out_data, SD_PROFILE_HEADER_LEN);
3627 			kmem_free(rqbuf, SENSE_LENGTH);
3628 			return;
3629 		}
3630 	}
3631 
3632 	kmem_free(out_data, SD_PROFILE_HEADER_LEN);
3633 	kmem_free(rqbuf, SENSE_LENGTH);
3634 
3635 	/*
3636 	 * Determine if this is a RRD type device.
3637 	 */
3638 	mutex_exit(SD_MUTEX(un));
3639 	buf = kmem_zalloc(BUFLEN_MODE_CDROM_CAP, KM_SLEEP);
3640 	status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, (uchar_t *)buf,
3641 	    BUFLEN_MODE_CDROM_CAP, MODEPAGE_CDROM_CAP, path_flag);
3642 
3643 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3644 
3645 	mutex_enter(SD_MUTEX(un));
3646 	if (status != 0) {
3647 		/* command failed; just return */
3648 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3649 		return;
3650 	}
3651 
3652 	/* Get to the page data */
3653 	sense_mhp = (struct mode_header_grp2 *)buf;
3654 	bd_len = (sense_mhp->bdesc_length_hi << 8) | sense_mhp->bdesc_length_lo;
3655 	if (bd_len > MODE_BLK_DESC_LENGTH) {
3656 		/*
3657 		 * We did not get back the expected block descriptor length so
3658 		 * we cannot check the mode page.
3659 		 */
3660 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
3661 		    "sd_check_for_writable_cd: Mode Sense returned "
3662 		    "invalid block descriptor length\n");
3663 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3664 		return;
3665 	}
3666 
3667 	/*
3668 	 * If the device presents DVD or CD capabilities in the mode
3669 	 * page, we can return here since a RRD device will not have
3670 	 * these capabilities.
3671 	 */
3672 	sense_page = (uchar_t *)(buf + MODE_HEADER_LENGTH_GRP2 + bd_len);
3673 	if ((sense_page[2] & 0x3f) || (sense_page[3] & 0x3f)) {
3674 		kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3675 		return;
3676 	}
3677 	kmem_free(buf, BUFLEN_MODE_CDROM_CAP);
3678 
3679 	/*
3680 	 * If un->un_f_mmc_writable_media is still FALSE,
3681 	 * check for RRD type media.  A RRD device is identified
3682 	 * by the features RANDOM_WRITABLE and HARDWARE_DEFECT_MANAGEMENT.
3683 	 */
3684 	mutex_exit(SD_MUTEX(un));
3685 	out_data_rw = kmem_zalloc(SD_CURRENT_FEATURE_LEN, KM_SLEEP);
3686 	rqbuf_rw = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3687 
3688 	rtn = sd_send_scsi_feature_GET_CONFIGURATION(ssc, &com, rqbuf_rw,
3689 	    SENSE_LENGTH, out_data_rw, SD_CURRENT_FEATURE_LEN,
3690 	    RANDOM_WRITABLE, path_flag);
3691 
3692 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3693 	if (rtn != 0) {
3694 		kmem_free(out_data_rw, SD_CURRENT_FEATURE_LEN);
3695 		kmem_free(rqbuf_rw, SENSE_LENGTH);
3696 		mutex_enter(SD_MUTEX(un));
3697 		return;
3698 	}
3699 
3700 	out_data_hd = kmem_zalloc(SD_CURRENT_FEATURE_LEN, KM_SLEEP);
3701 	rqbuf_hd = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
3702 
3703 	rtn = sd_send_scsi_feature_GET_CONFIGURATION(ssc, &com, rqbuf_hd,
3704 	    SENSE_LENGTH, out_data_hd, SD_CURRENT_FEATURE_LEN,
3705 	    HARDWARE_DEFECT_MANAGEMENT, path_flag);
3706 
3707 	sd_ssc_assessment(ssc, SD_FMT_IGNORE);
3708 	mutex_enter(SD_MUTEX(un));
3709 	if (rtn == 0) {
3710 		/*
3711 		 * We have good information, check for random writable
3712 		 * and hardware defect features as current.
3713 		 */
3714 		if ((out_data_rw[9] & RANDOM_WRITABLE) &&
3715 		    (out_data_rw[10] & 0x1) &&
3716 		    (out_data_hd[9] & HARDWARE_DEFECT_MANAGEMENT) &&
3717 		    (out_data_hd[10] & 0x1)) {
3718 			un->un_f_mmc_writable_media = TRUE;
3719 		}
3720 	}
3721 
3722 	kmem_free(out_data_rw, SD_CURRENT_FEATURE_LEN);
3723 	kmem_free(rqbuf_rw, SENSE_LENGTH);
3724 	kmem_free(out_data_hd, SD_CURRENT_FEATURE_LEN);
3725 	kmem_free(rqbuf_hd, SENSE_LENGTH);
3726 }
3727 
3728 /*
3729  *    Function: sd_read_unit_properties
3730  *
3731  * Description: The following implements a property lookup mechanism.
3732  *		Properties for particular disks (keyed on vendor, model
3733  *		and rev numbers) are sought in the sd.conf file via
3734  *		sd_process_sdconf_file(), and if not found there, are
3735  *		looked for in a list hardcoded in this driver via
3736  *		sd_process_sdconf_table() Once located the properties
3737  *		are used to update the driver unit structure.
3738  *
3739  *   Arguments: un - driver soft state (unit) structure
3740  */
3741 
3742 static void
3743 sd_read_unit_properties(struct sd_lun *un)
3744 {
3745 	/*
3746 	 * sd_process_sdconf_file returns SD_FAILURE if it cannot find
3747 	 * the "sd-config-list" property (from the sd.conf file) or if
3748 	 * there was not a match for the inquiry vid/pid. If this event
3749 	 * occurs the static driver configuration table is searched for
3750 	 * a match.
3751 	 */
3752 	ASSERT(un != NULL);
3753 	if (sd_process_sdconf_file(un) == SD_FAILURE) {
3754 		sd_process_sdconf_table(un);
3755 	}
3756 
3757 	/* check for LSI device */
3758 	sd_is_lsi(un);
3759 
3760 
3761 }
3762 
3763 
3764 /*
3765  *    Function: sd_process_sdconf_file
3766  *
3767  * Description: Use ddi_prop_lookup(9F) to obtain the properties from the
3768  *		driver's config file (ie, sd.conf) and update the driver
3769  *		soft state structure accordingly.
3770  *
3771  *   Arguments: un - driver soft state (unit) structure
3772  *
3773  * Return Code: SD_SUCCESS - The properties were successfully set according
3774  *			     to the driver configuration file.
3775  *		SD_FAILURE - The driver config list was not obtained or
3776  *			     there was no vid/pid match. This indicates that
3777  *			     the static config table should be used.
3778  *
3779  * The config file has a property, "sd-config-list". Currently we support
3780  * two kinds of formats. For both formats, the value of this property
3781  * is a list of duplets:
3782  *
3783  *  sd-config-list=
3784  *	<duplet>,
3785  *	[,<duplet>]*;
3786  *
3787  * For the improved format, where
3788  *
3789  *     <duplet>:= "<vid+pid>","<tunable-list>"
3790  *
3791  * and
3792  *
3793  *     <tunable-list>:=   <tunable> [, <tunable> ]*;
3794  *     <tunable> =        <name> : <value>
3795  *
3796  * The <vid+pid> is the string that is returned by the target device on a
3797  * SCSI inquiry command, the <tunable-list> contains one or more tunables
3798  * to apply to all target devices with the specified <vid+pid>.
3799  *
3800  * Each <tunable> is a "<name> : <value>" pair.
3801  *
3802  * For the old format, the structure of each duplet is as follows:
3803  *
3804  *  <duplet>:= "<vid+pid>","<data-property-name_list>"
3805  *
3806  * The first entry of the duplet is the device ID string (the concatenated
3807  * vid & pid; not to be confused with a device_id).  This is defined in
3808  * the same way as in the sd_disk_table.
3809  *
3810  * The second part of the duplet is a string that identifies a
3811  * data-property-name-list. The data-property-name-list is defined as
3812  * follows:
3813  *
3814  *  <data-property-name-list>:=<data-property-name> [<data-property-name>]
3815  *
3816  * The syntax of <data-property-name> depends on the <version> field.
3817  *
3818  * If version = SD_CONF_VERSION_1 we have the following syntax:
3819  *
3820  * 	<data-property-name>:=<version>,<flags>,<prop0>,<prop1>,.....<propN>
3821  *
3822  * where the prop0 value will be used to set prop0 if bit0 set in the
3823  * flags, prop1 if bit1 set, etc. and N = SD_CONF_MAX_ITEMS -1
3824  *
3825  */
3826 
3827 static int
3828 sd_process_sdconf_file(struct sd_lun *un)
3829 {
3830 	char	**config_list = NULL;
3831 	uint_t	nelements;
3832 	char	*vidptr;
3833 	int	vidlen;
3834 	char	*dnlist_ptr;
3835 	char	*dataname_ptr;
3836 	char	*dataname_lasts;
3837 	int	*data_list = NULL;
3838 	uint_t	data_list_len;
3839 	int	rval = SD_FAILURE;
3840 	int	i;
3841 
3842 	ASSERT(un != NULL);
3843 
3844 	/* Obtain the configuration list associated with the .conf file */
3845 	if (ddi_prop_lookup_string_array(DDI_DEV_T_ANY, SD_DEVINFO(un),
3846 	    DDI_PROP_DONTPASS | DDI_PROP_NOTPROM, sd_config_list,
3847 	    &config_list, &nelements) != DDI_PROP_SUCCESS) {
3848 		return (SD_FAILURE);
3849 	}
3850 
3851 	/*
3852 	 * Compare vids in each duplet to the inquiry vid - if a match is
3853 	 * made, get the data value and update the soft state structure
3854 	 * accordingly.
3855 	 *
3856 	 * Each duplet should show as a pair of strings, return SD_FAILURE
3857 	 * otherwise.
3858 	 */
3859 	if (nelements & 1) {
3860 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
3861 		    "sd-config-list should show as pairs of strings.\n");
3862 		if (config_list)
3863 			ddi_prop_free(config_list);
3864 		return (SD_FAILURE);
3865 	}
3866 
3867 	for (i = 0; i < nelements; i += 2) {
3868 		/*
3869 		 * Note: The assumption here is that each vid entry is on
3870 		 * a unique line from its associated duplet.
3871 		 */
3872 		vidptr = config_list[i];
3873 		vidlen = (int)strlen(vidptr);
3874 		if ((vidlen == 0) ||
3875 		    (sd_sdconf_id_match(un, vidptr, vidlen) != SD_SUCCESS)) {
3876 			continue;
3877 		}
3878 
3879 		/*
3880 		 * dnlist contains 1 or more blank separated
3881 		 * data-property-name entries
3882 		 */
3883 		dnlist_ptr = config_list[i + 1];
3884 
3885 		if (strchr(dnlist_ptr, ':') != NULL) {
3886 			/*
3887 			 * Decode the improved format sd-config-list.
3888 			 */
3889 			sd_nvpair_str_decode(un, dnlist_ptr);
3890 		} else {
3891 			/*
3892 			 * The old format sd-config-list, loop through all
3893 			 * data-property-name entries in the
3894 			 * data-property-name-list
3895 			 * setting the properties for each.
3896 			 */
3897 			for (dataname_ptr = sd_strtok_r(dnlist_ptr, " \t",
3898 			    &dataname_lasts); dataname_ptr != NULL;
3899 			    dataname_ptr = sd_strtok_r(NULL, " \t",
3900 			    &dataname_lasts)) {
3901 				int version;
3902 
3903 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
3904 				    "sd_process_sdconf_file: disk:%s, "
3905 				    "data:%s\n", vidptr, dataname_ptr);
3906 
3907 				/* Get the data list */
3908 				if (ddi_prop_lookup_int_array(DDI_DEV_T_ANY,
3909 				    SD_DEVINFO(un), 0, dataname_ptr, &data_list,
3910 				    &data_list_len) != DDI_PROP_SUCCESS) {
3911 					SD_INFO(SD_LOG_ATTACH_DETACH, un,
3912 					    "sd_process_sdconf_file: data "
3913 					    "property (%s) has no value\n",
3914 					    dataname_ptr);
3915 					continue;
3916 				}
3917 
3918 				version = data_list[0];
3919 
3920 				if (version == SD_CONF_VERSION_1) {
3921 					sd_tunables values;
3922 
3923 					/* Set the properties */
3924 					if (sd_chk_vers1_data(un, data_list[1],
3925 					    &data_list[2], data_list_len,
3926 					    dataname_ptr) == SD_SUCCESS) {
3927 						sd_get_tunables_from_conf(un,
3928 						    data_list[1], &data_list[2],
3929 						    &values);
3930 						sd_set_vers1_properties(un,
3931 						    data_list[1], &values);
3932 						rval = SD_SUCCESS;
3933 					} else {
3934 						rval = SD_FAILURE;
3935 					}
3936 				} else {
3937 					scsi_log(SD_DEVINFO(un), sd_label,
3938 					    CE_WARN, "data property %s version "
3939 					    "0x%x is invalid.",
3940 					    dataname_ptr, version);
3941 					rval = SD_FAILURE;
3942 				}
3943 				if (data_list)
3944 					ddi_prop_free(data_list);
3945 			}
3946 		}
3947 	}
3948 
3949 	/* free up the memory allocated by ddi_prop_lookup_string_array(). */
3950 	if (config_list) {
3951 		ddi_prop_free(config_list);
3952 	}
3953 
3954 	return (rval);
3955 }
3956 
3957 /*
3958  *    Function: sd_nvpair_str_decode()
3959  *
3960  * Description: Parse the improved format sd-config-list to get
3961  *    each entry of tunable, which includes a name-value pair.
3962  *    Then call sd_set_properties() to set the property.
3963  *
3964  *   Arguments: un - driver soft state (unit) structure
3965  *    nvpair_str - the tunable list
3966  */
3967 static void
3968 sd_nvpair_str_decode(struct sd_lun *un, char *nvpair_str)
3969 {
3970 	char	*nv, *name, *value, *token;
3971 	char	*nv_lasts, *v_lasts, *x_lasts;
3972 
3973 	for (nv = sd_strtok_r(nvpair_str, ",", &nv_lasts); nv != NULL;
3974 	    nv = sd_strtok_r(NULL, ",", &nv_lasts)) {
3975 		token = sd_strtok_r(nv, ":", &v_lasts);
3976 		name  = sd_strtok_r(token, " \t", &x_lasts);
3977 		token = sd_strtok_r(NULL, ":", &v_lasts);
3978 		value = sd_strtok_r(token, " \t", &x_lasts);
3979 		if (name == NULL || value == NULL) {
3980 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
3981 			    "sd_nvpair_str_decode: "
3982 			    "name or value is not valid!\n");
3983 		} else {
3984 			sd_set_properties(un, name, value);
3985 		}
3986 	}
3987 }
3988 
3989 /*
3990  *    Function: sd_strtok_r()
3991  *
3992  * Description: This function uses strpbrk and strspn to break
3993  *    string into tokens on sequentially subsequent calls. Return
3994  *    NULL when no non-separator characters remain. The first
3995  *    argument is NULL for subsequent calls.
3996  */
3997 static char *
3998 sd_strtok_r(char *string, const char *sepset, char **lasts)
3999 {
4000 	char	*q, *r;
4001 
4002 	/* First or subsequent call */
4003 	if (string == NULL)
4004 		string = *lasts;
4005 
4006 	if (string == NULL)
4007 		return (NULL);
4008 
4009 	/* Skip leading separators */
4010 	q = string + strspn(string, sepset);
4011 
4012 	if (*q == '\0')
4013 		return (NULL);
4014 
4015 	if ((r = strpbrk(q, sepset)) == NULL)
4016 		*lasts = NULL;
4017 	else {
4018 		*r = '\0';
4019 		*lasts = r + 1;
4020 	}
4021 	return (q);
4022 }
4023 
4024 /*
4025  *    Function: sd_set_properties()
4026  *
4027  * Description: Set device properties based on the improved
4028  *    format sd-config-list.
4029  *
4030  *   Arguments: un - driver soft state (unit) structure
4031  *    name  - supported tunable name
4032  *    value - tunable value
4033  */
4034 static void
4035 sd_set_properties(struct sd_lun *un, char *name, char *value)
4036 {
4037 	char	*endptr = NULL;
4038 	long	val = 0;
4039 
4040 	if (strcasecmp(name, "cache-nonvolatile") == 0) {
4041 		if (strcasecmp(value, "true") == 0) {
4042 			un->un_f_suppress_cache_flush = TRUE;
4043 		} else if (strcasecmp(value, "false") == 0) {
4044 			un->un_f_suppress_cache_flush = FALSE;
4045 		} else {
4046 			goto value_invalid;
4047 		}
4048 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4049 		    "suppress_cache_flush flag set to %d\n",
4050 		    un->un_f_suppress_cache_flush);
4051 		return;
4052 	}
4053 
4054 	if (strcasecmp(name, "controller-type") == 0) {
4055 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4056 			un->un_ctype = val;
4057 		} else {
4058 			goto value_invalid;
4059 		}
4060 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4061 		    "ctype set to %d\n", un->un_ctype);
4062 		return;
4063 	}
4064 
4065 	if (strcasecmp(name, "delay-busy") == 0) {
4066 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4067 			un->un_busy_timeout = drv_usectohz(val / 1000);
4068 		} else {
4069 			goto value_invalid;
4070 		}
4071 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4072 		    "busy_timeout set to %d\n", un->un_busy_timeout);
4073 		return;
4074 	}
4075 
4076 	if (strcasecmp(name, "disksort") == 0) {
4077 		if (strcasecmp(value, "true") == 0) {
4078 			un->un_f_disksort_disabled = FALSE;
4079 		} else if (strcasecmp(value, "false") == 0) {
4080 			un->un_f_disksort_disabled = TRUE;
4081 		} else {
4082 			goto value_invalid;
4083 		}
4084 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4085 		    "disksort disabled flag set to %d\n",
4086 		    un->un_f_disksort_disabled);
4087 		return;
4088 	}
4089 
4090 	if (strcasecmp(name, "power-condition") == 0) {
4091 		if (strcasecmp(value, "true") == 0) {
4092 			un->un_f_power_condition_disabled = FALSE;
4093 		} else if (strcasecmp(value, "false") == 0) {
4094 			un->un_f_power_condition_disabled = TRUE;
4095 		} else {
4096 			goto value_invalid;
4097 		}
4098 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4099 		    "power condition disabled flag set to %d\n",
4100 		    un->un_f_power_condition_disabled);
4101 		return;
4102 	}
4103 
4104 	if (strcasecmp(name, "timeout-releasereservation") == 0) {
4105 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4106 			un->un_reserve_release_time = val;
4107 		} else {
4108 			goto value_invalid;
4109 		}
4110 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4111 		    "reservation release timeout set to %d\n",
4112 		    un->un_reserve_release_time);
4113 		return;
4114 	}
4115 
4116 	if (strcasecmp(name, "reset-lun") == 0) {
4117 		if (strcasecmp(value, "true") == 0) {
4118 			un->un_f_lun_reset_enabled = TRUE;
4119 		} else if (strcasecmp(value, "false") == 0) {
4120 			un->un_f_lun_reset_enabled = FALSE;
4121 		} else {
4122 			goto value_invalid;
4123 		}
4124 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4125 		    "lun reset enabled flag set to %d\n",
4126 		    un->un_f_lun_reset_enabled);
4127 		return;
4128 	}
4129 
4130 	if (strcasecmp(name, "retries-busy") == 0) {
4131 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4132 			un->un_busy_retry_count = val;
4133 		} else {
4134 			goto value_invalid;
4135 		}
4136 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4137 		    "busy retry count set to %d\n", un->un_busy_retry_count);
4138 		return;
4139 	}
4140 
4141 	if (strcasecmp(name, "retries-timeout") == 0) {
4142 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4143 			un->un_retry_count = val;
4144 		} else {
4145 			goto value_invalid;
4146 		}
4147 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4148 		    "timeout retry count set to %d\n", un->un_retry_count);
4149 		return;
4150 	}
4151 
4152 	if (strcasecmp(name, "retries-notready") == 0) {
4153 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4154 			un->un_notready_retry_count = val;
4155 		} else {
4156 			goto value_invalid;
4157 		}
4158 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4159 		    "notready retry count set to %d\n",
4160 		    un->un_notready_retry_count);
4161 		return;
4162 	}
4163 
4164 	if (strcasecmp(name, "retries-reset") == 0) {
4165 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4166 			un->un_reset_retry_count = val;
4167 		} else {
4168 			goto value_invalid;
4169 		}
4170 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4171 		    "reset retry count set to %d\n",
4172 		    un->un_reset_retry_count);
4173 		return;
4174 	}
4175 
4176 	if (strcasecmp(name, "throttle-max") == 0) {
4177 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4178 			un->un_saved_throttle = un->un_throttle = val;
4179 		} else {
4180 			goto value_invalid;
4181 		}
4182 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4183 		    "throttle set to %d\n", un->un_throttle);
4184 	}
4185 
4186 	if (strcasecmp(name, "throttle-min") == 0) {
4187 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4188 			un->un_min_throttle = val;
4189 		} else {
4190 			goto value_invalid;
4191 		}
4192 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4193 		    "min throttle set to %d\n", un->un_min_throttle);
4194 	}
4195 
4196 	if (strcasecmp(name, "rmw-type") == 0) {
4197 		if (ddi_strtol(value, &endptr, 0, &val) == 0) {
4198 			un->un_f_rmw_type = val;
4199 		} else {
4200 			goto value_invalid;
4201 		}
4202 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4203 		    "RMW type set to %d\n", un->un_f_rmw_type);
4204 	}
4205 
4206 	/*
4207 	 * Validate the throttle values.
4208 	 * If any of the numbers are invalid, set everything to defaults.
4209 	 */
4210 	if ((un->un_throttle < SD_LOWEST_VALID_THROTTLE) ||
4211 	    (un->un_min_throttle < SD_LOWEST_VALID_THROTTLE) ||
4212 	    (un->un_min_throttle > un->un_throttle)) {
4213 		un->un_saved_throttle = un->un_throttle = sd_max_throttle;
4214 		un->un_min_throttle = sd_min_throttle;
4215 	}
4216 
4217 	if (strcasecmp(name, "mmc-gesn-polling") == 0) {
4218 		if (strcasecmp(value, "true") == 0) {
4219 			un->un_f_mmc_gesn_polling = TRUE;
4220 		} else if (strcasecmp(value, "false") == 0) {
4221 			un->un_f_mmc_gesn_polling = FALSE;
4222 		} else {
4223 			goto value_invalid;
4224 		}
4225 		SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4226 		    "mmc-gesn-polling set to %d\n",
4227 		    un->un_f_mmc_gesn_polling);
4228 	}
4229 
4230 	return;
4231 
4232 value_invalid:
4233 	SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_set_properties: "
4234 	    "value of prop %s is invalid\n", name);
4235 }
4236 
4237 /*
4238  *    Function: sd_get_tunables_from_conf()
4239  *
4240  *
4241  *    This function reads the data list from the sd.conf file and pulls
4242  *    the values that can have numeric values as arguments and places
4243  *    the values in the appropriate sd_tunables member.
4244  *    Since the order of the data list members varies across platforms
4245  *    This function reads them from the data list in a platform specific
4246  *    order and places them into the correct sd_tunable member that is
4247  *    consistent across all platforms.
4248  */
4249 static void
4250 sd_get_tunables_from_conf(struct sd_lun *un, int flags, int *data_list,
4251     sd_tunables *values)
4252 {
4253 	int i;
4254 	int mask;
4255 
4256 	bzero(values, sizeof (sd_tunables));
4257 
4258 	for (i = 0; i < SD_CONF_MAX_ITEMS; i++) {
4259 
4260 		mask = 1 << i;
4261 		if (mask > flags) {
4262 			break;
4263 		}
4264 
4265 		switch (mask & flags) {
4266 		case 0:	/* This mask bit not set in flags */
4267 			continue;
4268 		case SD_CONF_BSET_THROTTLE:
4269 			values->sdt_throttle = data_list[i];
4270 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4271 			    "sd_get_tunables_from_conf: throttle = %d\n",
4272 			    values->sdt_throttle);
4273 			break;
4274 		case SD_CONF_BSET_CTYPE:
4275 			values->sdt_ctype = data_list[i];
4276 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4277 			    "sd_get_tunables_from_conf: ctype = %d\n",
4278 			    values->sdt_ctype);
4279 			break;
4280 		case SD_CONF_BSET_NRR_COUNT:
4281 			values->sdt_not_rdy_retries = data_list[i];
4282 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4283 			    "sd_get_tunables_from_conf: not_rdy_retries = %d\n",
4284 			    values->sdt_not_rdy_retries);
4285 			break;
4286 		case SD_CONF_BSET_BSY_RETRY_COUNT:
4287 			values->sdt_busy_retries = data_list[i];
4288 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4289 			    "sd_get_tunables_from_conf: busy_retries = %d\n",
4290 			    values->sdt_busy_retries);
4291 			break;
4292 		case SD_CONF_BSET_RST_RETRIES:
4293 			values->sdt_reset_retries = data_list[i];
4294 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4295 			    "sd_get_tunables_from_conf: reset_retries = %d\n",
4296 			    values->sdt_reset_retries);
4297 			break;
4298 		case SD_CONF_BSET_RSV_REL_TIME:
4299 			values->sdt_reserv_rel_time = data_list[i];
4300 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4301 			    "sd_get_tunables_from_conf: reserv_rel_time = %d\n",
4302 			    values->sdt_reserv_rel_time);
4303 			break;
4304 		case SD_CONF_BSET_MIN_THROTTLE:
4305 			values->sdt_min_throttle = data_list[i];
4306 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4307 			    "sd_get_tunables_from_conf: min_throttle = %d\n",
4308 			    values->sdt_min_throttle);
4309 			break;
4310 		case SD_CONF_BSET_DISKSORT_DISABLED:
4311 			values->sdt_disk_sort_dis = data_list[i];
4312 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4313 			    "sd_get_tunables_from_conf: disk_sort_dis = %d\n",
4314 			    values->sdt_disk_sort_dis);
4315 			break;
4316 		case SD_CONF_BSET_LUN_RESET_ENABLED:
4317 			values->sdt_lun_reset_enable = data_list[i];
4318 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4319 			    "sd_get_tunables_from_conf: lun_reset_enable = %d"
4320 			    "\n", values->sdt_lun_reset_enable);
4321 			break;
4322 		case SD_CONF_BSET_CACHE_IS_NV:
4323 			values->sdt_suppress_cache_flush = data_list[i];
4324 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4325 			    "sd_get_tunables_from_conf: \
4326 			    suppress_cache_flush = %d"
4327 			    "\n", values->sdt_suppress_cache_flush);
4328 			break;
4329 		case SD_CONF_BSET_PC_DISABLED:
4330 			values->sdt_disk_sort_dis = data_list[i];
4331 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4332 			    "sd_get_tunables_from_conf: power_condition_dis = "
4333 			    "%d\n", values->sdt_power_condition_dis);
4334 			break;
4335 		}
4336 	}
4337 }
4338 
4339 /*
4340  *    Function: sd_process_sdconf_table
4341  *
4342  * Description: Search the static configuration table for a match on the
4343  *		inquiry vid/pid and update the driver soft state structure
4344  *		according to the table property values for the device.
4345  *
4346  *		The form of a configuration table entry is:
4347  *		  <vid+pid>,<flags>,<property-data>
4348  *		  "SEAGATE ST42400N",1,0x40000,
4349  *		  0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1;
4350  *
4351  *   Arguments: un - driver soft state (unit) structure
4352  */
4353 
4354 static void
4355 sd_process_sdconf_table(struct sd_lun *un)
4356 {
4357 	char	*id = NULL;
4358 	int	table_index;
4359 	int	idlen;
4360 
4361 	ASSERT(un != NULL);
4362 	for (table_index = 0; table_index < sd_disk_table_size;
4363 	    table_index++) {
4364 		id = sd_disk_table[table_index].device_id;
4365 		idlen = strlen(id);
4366 		if (idlen == 0) {
4367 			continue;
4368 		}
4369 
4370 		/*
4371 		 * The static configuration table currently does not
4372 		 * implement version 10 properties. Additionally,
4373 		 * multiple data-property-name entries are not
4374 		 * implemented in the static configuration table.
4375 		 */
4376 		if (sd_sdconf_id_match(un, id, idlen) == SD_SUCCESS) {
4377 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4378 			    "sd_process_sdconf_table: disk %s\n", id);
4379 			sd_set_vers1_properties(un,
4380 			    sd_disk_table[table_index].flags,
4381 			    sd_disk_table[table_index].properties);
4382 			break;
4383 		}
4384 	}
4385 }
4386 
4387 
4388 /*
4389  *    Function: sd_sdconf_id_match
4390  *
4391  * Description: This local function implements a case sensitive vid/pid
4392  *		comparison as well as the boundary cases of wild card and
4393  *		multiple blanks.
4394  *
4395  *		Note: An implicit assumption made here is that the scsi
4396  *		inquiry structure will always keep the vid, pid and
4397  *		revision strings in consecutive sequence, so they can be
4398  *		read as a single string. If this assumption is not the
4399  *		case, a separate string, to be used for the check, needs
4400  *		to be built with these strings concatenated.
4401  *
4402  *   Arguments: un - driver soft state (unit) structure
4403  *		id - table or config file vid/pid
4404  *		idlen  - length of the vid/pid (bytes)
4405  *
4406  * Return Code: SD_SUCCESS - Indicates a match with the inquiry vid/pid
4407  *		SD_FAILURE - Indicates no match with the inquiry vid/pid
4408  */
4409 
4410 static int
4411 sd_sdconf_id_match(struct sd_lun *un, char *id, int idlen)
4412 {
4413 	struct scsi_inquiry	*sd_inq;
4414 	int 			rval = SD_SUCCESS;
4415 
4416 	ASSERT(un != NULL);
4417 	sd_inq = un->un_sd->sd_inq;
4418 	ASSERT(id != NULL);
4419 
4420 	/*
4421 	 * We use the inq_vid as a pointer to a buffer containing the
4422 	 * vid and pid and use the entire vid/pid length of the table
4423 	 * entry for the comparison. This works because the inq_pid
4424 	 * data member follows inq_vid in the scsi_inquiry structure.
4425 	 */
4426 	if (strncasecmp(sd_inq->inq_vid, id, idlen) != 0) {
4427 		/*
4428 		 * The user id string is compared to the inquiry vid/pid
4429 		 * using a case insensitive comparison and ignoring
4430 		 * multiple spaces.
4431 		 */
4432 		rval = sd_blank_cmp(un, id, idlen);
4433 		if (rval != SD_SUCCESS) {
4434 			/*
4435 			 * User id strings that start and end with a "*"
4436 			 * are a special case. These do not have a
4437 			 * specific vendor, and the product string can
4438 			 * appear anywhere in the 16 byte PID portion of
4439 			 * the inquiry data. This is a simple strstr()
4440 			 * type search for the user id in the inquiry data.
4441 			 */
4442 			if ((id[0] == '*') && (id[idlen - 1] == '*')) {
4443 				char	*pidptr = &id[1];
4444 				int	i;
4445 				int	j;
4446 				int	pidstrlen = idlen - 2;
4447 				j = sizeof (SD_INQUIRY(un)->inq_pid) -
4448 				    pidstrlen;
4449 
4450 				if (j < 0) {
4451 					return (SD_FAILURE);
4452 				}
4453 				for (i = 0; i < j; i++) {
4454 					if (bcmp(&SD_INQUIRY(un)->inq_pid[i],
4455 					    pidptr, pidstrlen) == 0) {
4456 						rval = SD_SUCCESS;
4457 						break;
4458 					}
4459 				}
4460 			}
4461 		}
4462 	}
4463 	return (rval);
4464 }
4465 
4466 
4467 /*
4468  *    Function: sd_blank_cmp
4469  *
4470  * Description: If the id string starts and ends with a space, treat
4471  *		multiple consecutive spaces as equivalent to a single
4472  *		space. For example, this causes a sd_disk_table entry
4473  *		of " NEC CDROM " to match a device's id string of
4474  *		"NEC       CDROM".
4475  *
4476  *		Note: The success exit condition for this routine is if
4477  *		the pointer to the table entry is '\0' and the cnt of
4478  *		the inquiry length is zero. This will happen if the inquiry
4479  *		string returned by the device is padded with spaces to be
4480  *		exactly 24 bytes in length (8 byte vid + 16 byte pid). The
4481  *		SCSI spec states that the inquiry string is to be padded with
4482  *		spaces.
4483  *
4484  *   Arguments: un - driver soft state (unit) structure
4485  *		id - table or config file vid/pid
4486  *		idlen  - length of the vid/pid (bytes)
4487  *
4488  * Return Code: SD_SUCCESS - Indicates a match with the inquiry vid/pid
4489  *		SD_FAILURE - Indicates no match with the inquiry vid/pid
4490  */
4491 
4492 static int
4493 sd_blank_cmp(struct sd_lun *un, char *id, int idlen)
4494 {
4495 	char		*p1;
4496 	char		*p2;
4497 	int		cnt;
4498 	cnt = sizeof (SD_INQUIRY(un)->inq_vid) +
4499 	    sizeof (SD_INQUIRY(un)->inq_pid);
4500 
4501 	ASSERT(un != NULL);
4502 	p2 = un->un_sd->sd_inq->inq_vid;
4503 	ASSERT(id != NULL);
4504 	p1 = id;
4505 
4506 	if ((id[0] == ' ') && (id[idlen - 1] == ' ')) {
4507 		/*
4508 		 * Note: string p1 is terminated by a NUL but string p2
4509 		 * isn't.  The end of p2 is determined by cnt.
4510 		 */
4511 		for (;;) {
4512 			/* skip over any extra blanks in both strings */
4513 			while ((*p1 != '\0') && (*p1 == ' ')) {
4514 				p1++;
4515 			}
4516 			while ((cnt != 0) && (*p2 == ' ')) {
4517 				p2++;
4518 				cnt--;
4519 			}
4520 
4521 			/* compare the two strings */
4522 			if ((cnt == 0) ||
4523 			    (SD_TOUPPER(*p1) != SD_TOUPPER(*p2))) {
4524 				break;
4525 			}
4526 			while ((cnt > 0) &&
4527 			    (SD_TOUPPER(*p1) == SD_TOUPPER(*p2))) {
4528 				p1++;
4529 				p2++;
4530 				cnt--;
4531 			}
4532 		}
4533 	}
4534 
4535 	/* return SD_SUCCESS if both strings match */
4536 	return (((*p1 == '\0') && (cnt == 0)) ? SD_SUCCESS : SD_FAILURE);
4537 }
4538 
4539 
4540 /*
4541  *    Function: sd_chk_vers1_data
4542  *
4543  * Description: Verify the version 1 device properties provided by the
4544  *		user via the configuration file
4545  *
4546  *   Arguments: un	     - driver soft state (unit) structure
4547  *		flags	     - integer mask indicating properties to be set
4548  *		prop_list    - integer list of property values
4549  *		list_len     - number of the elements
4550  *
4551  * Return Code: SD_SUCCESS - Indicates the user provided data is valid
4552  *		SD_FAILURE - Indicates the user provided data is invalid
4553  */
4554 
4555 static int
4556 sd_chk_vers1_data(struct sd_lun *un, int flags, int *prop_list,
4557     int list_len, char *dataname_ptr)
4558 {
4559 	int i;
4560 	int mask = 1;
4561 	int index = 0;
4562 
4563 	ASSERT(un != NULL);
4564 
4565 	/* Check for a NULL property name and list */
4566 	if (dataname_ptr == NULL) {
4567 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4568 		    "sd_chk_vers1_data: NULL data property name.");
4569 		return (SD_FAILURE);
4570 	}
4571 	if (prop_list == NULL) {
4572 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4573 		    "sd_chk_vers1_data: %s NULL data property list.",
4574 		    dataname_ptr);
4575 		return (SD_FAILURE);
4576 	}
4577 
4578 	/* Display a warning if undefined bits are set in the flags */
4579 	if (flags & ~SD_CONF_BIT_MASK) {
4580 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4581 		    "sd_chk_vers1_data: invalid bits 0x%x in data list %s. "
4582 		    "Properties not set.",
4583 		    (flags & ~SD_CONF_BIT_MASK), dataname_ptr);
4584 		return (SD_FAILURE);
4585 	}
4586 
4587 	/*
4588 	 * Verify the length of the list by identifying the highest bit set
4589 	 * in the flags and validating that the property list has a length
4590 	 * up to the index of this bit.
4591 	 */
4592 	for (i = 0; i < SD_CONF_MAX_ITEMS; i++) {
4593 		if (flags & mask) {
4594 			index++;
4595 		}
4596 		mask = 1 << i;
4597 	}
4598 	if (list_len < (index + 2)) {
4599 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4600 		    "sd_chk_vers1_data: "
4601 		    "Data property list %s size is incorrect. "
4602 		    "Properties not set.", dataname_ptr);
4603 		scsi_log(SD_DEVINFO(un), sd_label, CE_CONT, "Size expected: "
4604 		    "version + 1 flagword + %d properties", SD_CONF_MAX_ITEMS);
4605 		return (SD_FAILURE);
4606 	}
4607 	return (SD_SUCCESS);
4608 }
4609 
4610 
4611 /*
4612  *    Function: sd_set_vers1_properties
4613  *
4614  * Description: Set version 1 device properties based on a property list
4615  *		retrieved from the driver configuration file or static
4616  *		configuration table. Version 1 properties have the format:
4617  *
4618  * 	<data-property-name>:=<version>,<flags>,<prop0>,<prop1>,.....<propN>
4619  *
4620  *		where the prop0 value will be used to set prop0 if bit0
4621  *		is set in the flags
4622  *
4623  *   Arguments: un	     - driver soft state (unit) structure
4624  *		flags	     - integer mask indicating properties to be set
4625  *		prop_list    - integer list of property values
4626  */
4627 
4628 static void
4629 sd_set_vers1_properties(struct sd_lun *un, int flags, sd_tunables *prop_list)
4630 {
4631 	ASSERT(un != NULL);
4632 
4633 	/*
4634 	 * Set the flag to indicate cache is to be disabled. An attempt
4635 	 * to disable the cache via sd_cache_control() will be made
4636 	 * later during attach once the basic initialization is complete.
4637 	 */
4638 	if (flags & SD_CONF_BSET_NOCACHE) {
4639 		un->un_f_opt_disable_cache = TRUE;
4640 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4641 		    "sd_set_vers1_properties: caching disabled flag set\n");
4642 	}
4643 
4644 	/* CD-specific configuration parameters */
4645 	if (flags & SD_CONF_BSET_PLAYMSF_BCD) {
4646 		un->un_f_cfg_playmsf_bcd = TRUE;
4647 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4648 		    "sd_set_vers1_properties: playmsf_bcd set\n");
4649 	}
4650 	if (flags & SD_CONF_BSET_READSUB_BCD) {
4651 		un->un_f_cfg_readsub_bcd = TRUE;
4652 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4653 		    "sd_set_vers1_properties: readsub_bcd set\n");
4654 	}
4655 	if (flags & SD_CONF_BSET_READ_TOC_TRK_BCD) {
4656 		un->un_f_cfg_read_toc_trk_bcd = TRUE;
4657 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4658 		    "sd_set_vers1_properties: read_toc_trk_bcd set\n");
4659 	}
4660 	if (flags & SD_CONF_BSET_READ_TOC_ADDR_BCD) {
4661 		un->un_f_cfg_read_toc_addr_bcd = TRUE;
4662 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4663 		    "sd_set_vers1_properties: read_toc_addr_bcd set\n");
4664 	}
4665 	if (flags & SD_CONF_BSET_NO_READ_HEADER) {
4666 		un->un_f_cfg_no_read_header = TRUE;
4667 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4668 		    "sd_set_vers1_properties: no_read_header set\n");
4669 	}
4670 	if (flags & SD_CONF_BSET_READ_CD_XD4) {
4671 		un->un_f_cfg_read_cd_xd4 = TRUE;
4672 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4673 		    "sd_set_vers1_properties: read_cd_xd4 set\n");
4674 	}
4675 
4676 	/* Support for devices which do not have valid/unique serial numbers */
4677 	if (flags & SD_CONF_BSET_FAB_DEVID) {
4678 		un->un_f_opt_fab_devid = TRUE;
4679 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4680 		    "sd_set_vers1_properties: fab_devid bit set\n");
4681 	}
4682 
4683 	/* Support for user throttle configuration */
4684 	if (flags & SD_CONF_BSET_THROTTLE) {
4685 		ASSERT(prop_list != NULL);
4686 		un->un_saved_throttle = un->un_throttle =
4687 		    prop_list->sdt_throttle;
4688 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4689 		    "sd_set_vers1_properties: throttle set to %d\n",
4690 		    prop_list->sdt_throttle);
4691 	}
4692 
4693 	/* Set the per disk retry count according to the conf file or table. */
4694 	if (flags & SD_CONF_BSET_NRR_COUNT) {
4695 		ASSERT(prop_list != NULL);
4696 		if (prop_list->sdt_not_rdy_retries) {
4697 			un->un_notready_retry_count =
4698 			    prop_list->sdt_not_rdy_retries;
4699 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4700 			    "sd_set_vers1_properties: not ready retry count"
4701 			    " set to %d\n", un->un_notready_retry_count);
4702 		}
4703 	}
4704 
4705 	/* The controller type is reported for generic disk driver ioctls */
4706 	if (flags & SD_CONF_BSET_CTYPE) {
4707 		ASSERT(prop_list != NULL);
4708 		switch (prop_list->sdt_ctype) {
4709 		case CTYPE_CDROM:
4710 			un->un_ctype = prop_list->sdt_ctype;
4711 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4712 			    "sd_set_vers1_properties: ctype set to "
4713 			    "CTYPE_CDROM\n");
4714 			break;
4715 		case CTYPE_CCS:
4716 			un->un_ctype = prop_list->sdt_ctype;
4717 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4718 			    "sd_set_vers1_properties: ctype set to "
4719 			    "CTYPE_CCS\n");
4720 			break;
4721 		case CTYPE_ROD:		/* RW optical */
4722 			un->un_ctype = prop_list->sdt_ctype;
4723 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
4724 			    "sd_set_vers1_properties: ctype set to "
4725 			    "CTYPE_ROD\n");
4726 			break;
4727 		default:
4728 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
4729 			    "sd_set_vers1_properties: Could not set "
4730 			    "invalid ctype value (%d)",
4731 			    prop_list->sdt_ctype);
4732 		}
4733 	}
4734 
4735 	/* Purple failover timeout */
4736 	if (flags & SD_CONF_BSET_BSY_RETRY_COUNT) {
4737 		ASSERT(prop_list != NULL);
4738 		un->un_busy_retry_count =
4739 		    prop_list->sdt_busy_retries;
4740 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4741 		    "sd_set_vers1_properties: "
4742 		    "busy retry count set to %d\n",
4743 		    un->un_busy_retry_count);
4744 	}
4745 
4746 	/* Purple reset retry count */
4747 	if (flags & SD_CONF_BSET_RST_RETRIES) {
4748 		ASSERT(prop_list != NULL);
4749 		un->un_reset_retry_count =
4750 		    prop_list->sdt_reset_retries;
4751 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4752 		    "sd_set_vers1_properties: "
4753 		    "reset retry count set to %d\n",
4754 		    un->un_reset_retry_count);
4755 	}
4756 
4757 	/* Purple reservation release timeout */
4758 	if (flags & SD_CONF_BSET_RSV_REL_TIME) {
4759 		ASSERT(prop_list != NULL);
4760 		un->un_reserve_release_time =
4761 		    prop_list->sdt_reserv_rel_time;
4762 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4763 		    "sd_set_vers1_properties: "
4764 		    "reservation release timeout set to %d\n",
4765 		    un->un_reserve_release_time);
4766 	}
4767 
4768 	/*
4769 	 * Driver flag telling the driver to verify that no commands are pending
4770 	 * for a device before issuing a Test Unit Ready. This is a workaround
4771 	 * for a firmware bug in some Seagate eliteI drives.
4772 	 */
4773 	if (flags & SD_CONF_BSET_TUR_CHECK) {
4774 		un->un_f_cfg_tur_check = TRUE;
4775 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4776 		    "sd_set_vers1_properties: tur queue check set\n");
4777 	}
4778 
4779 	if (flags & SD_CONF_BSET_MIN_THROTTLE) {
4780 		un->un_min_throttle = prop_list->sdt_min_throttle;
4781 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4782 		    "sd_set_vers1_properties: min throttle set to %d\n",
4783 		    un->un_min_throttle);
4784 	}
4785 
4786 	if (flags & SD_CONF_BSET_DISKSORT_DISABLED) {
4787 		un->un_f_disksort_disabled =
4788 		    (prop_list->sdt_disk_sort_dis != 0) ?
4789 		    TRUE : FALSE;
4790 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4791 		    "sd_set_vers1_properties: disksort disabled "
4792 		    "flag set to %d\n",
4793 		    prop_list->sdt_disk_sort_dis);
4794 	}
4795 
4796 	if (flags & SD_CONF_BSET_LUN_RESET_ENABLED) {
4797 		un->un_f_lun_reset_enabled =
4798 		    (prop_list->sdt_lun_reset_enable != 0) ?
4799 		    TRUE : FALSE;
4800 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4801 		    "sd_set_vers1_properties: lun reset enabled "
4802 		    "flag set to %d\n",
4803 		    prop_list->sdt_lun_reset_enable);
4804 	}
4805 
4806 	if (flags & SD_CONF_BSET_CACHE_IS_NV) {
4807 		un->un_f_suppress_cache_flush =
4808 		    (prop_list->sdt_suppress_cache_flush != 0) ?
4809 		    TRUE : FALSE;
4810 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4811 		    "sd_set_vers1_properties: suppress_cache_flush "
4812 		    "flag set to %d\n",
4813 		    prop_list->sdt_suppress_cache_flush);
4814 	}
4815 
4816 	if (flags & SD_CONF_BSET_PC_DISABLED) {
4817 		un->un_f_power_condition_disabled =
4818 		    (prop_list->sdt_power_condition_dis != 0) ?
4819 		    TRUE : FALSE;
4820 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
4821 		    "sd_set_vers1_properties: power_condition_disabled "
4822 		    "flag set to %d\n",
4823 		    prop_list->sdt_power_condition_dis);
4824 	}
4825 
4826 	/*
4827 	 * Validate the throttle values.
4828 	 * If any of the numbers are invalid, set everything to defaults.
4829 	 */
4830 	if ((un->un_throttle < SD_LOWEST_VALID_THROTTLE) ||
4831 	    (un->un_min_throttle < SD_LOWEST_VALID_THROTTLE) ||
4832 	    (un->un_min_throttle > un->un_throttle)) {
4833 		un->un_saved_throttle = un->un_throttle = sd_max_throttle;
4834 		un->un_min_throttle = sd_min_throttle;
4835 	}
4836 }
4837 
4838 /*
4839  *   Function: sd_is_lsi()
4840  *
4841  *   Description: Check for lsi devices, step through the static device
4842  *	table to match vid/pid.
4843  *
4844  *   Args: un - ptr to sd_lun
4845  *
4846  *   Notes:  When creating new LSI property, need to add the new LSI property
4847  *		to this function.
4848  */
4849 static void
4850 sd_is_lsi(struct sd_lun *un)
4851 {
4852 	char	*id = NULL;
4853 	int	table_index;
4854 	int	idlen;
4855 	void	*prop;
4856 
4857 	ASSERT(un != NULL);
4858 	for (table_index = 0; table_index < sd_disk_table_size;
4859 	    table_index++) {
4860 		id = sd_disk_table[table_index].device_id;
4861 		idlen = strlen(id);
4862 		if (idlen == 0) {
4863 			continue;
4864 		}
4865 
4866 		if (sd_sdconf_id_match(un, id, idlen) == SD_SUCCESS) {
4867 			prop = sd_disk_table[table_index].properties;
4868 			if (prop == &lsi_properties ||
4869 			    prop == &lsi_oem_properties ||
4870 			    prop == &lsi_properties_scsi ||
4871 			    prop == &symbios_properties) {
4872 				un->un_f_cfg_is_lsi = TRUE;
4873 			}
4874 			break;
4875 		}
4876 	}
4877 }
4878 
4879 /*
4880  *    Function: sd_get_physical_geometry
4881  *
4882  * Description: Retrieve the MODE SENSE page 3 (Format Device Page) and
4883  *		MODE SENSE page 4 (Rigid Disk Drive Geometry Page) from the
4884  *		target, and use this information to initialize the physical
4885  *		geometry cache specified by pgeom_p.
4886  *
4887  *		MODE SENSE is an optional command, so failure in this case
4888  *		does not necessarily denote an error. We want to use the
4889  *		MODE SENSE commands to derive the physical geometry of the
4890  *		device, but if either command fails, the logical geometry is
4891  *		used as the fallback for disk label geometry in cmlb.
4892  *
4893  *		This requires that un->un_blockcount and un->un_tgt_blocksize
4894  *		have already been initialized for the current target and
4895  *		that the current values be passed as args so that we don't
4896  *		end up ever trying to use -1 as a valid value. This could
4897  *		happen if either value is reset while we're not holding
4898  *		the mutex.
4899  *
4900  *   Arguments: un - driver soft state (unit) structure
4901  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
4902  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
4903  *			to use the USCSI "direct" chain and bypass the normal
4904  *			command waitq.
4905  *
4906  *     Context: Kernel thread only (can sleep).
4907  */
4908 
4909 static int
4910 sd_get_physical_geometry(struct sd_lun *un, cmlb_geom_t *pgeom_p,
4911 	diskaddr_t capacity, int lbasize, int path_flag)
4912 {
4913 	struct	mode_format	*page3p;
4914 	struct	mode_geometry	*page4p;
4915 	struct	mode_header	*headerp;
4916 	int	sector_size;
4917 	int	nsect;
4918 	int	nhead;
4919 	int	ncyl;
4920 	int	intrlv;
4921 	int	spc;
4922 	diskaddr_t	modesense_capacity;
4923 	int	rpm;
4924 	int	bd_len;
4925 	int	mode_header_length;
4926 	uchar_t	*p3bufp;
4927 	uchar_t	*p4bufp;
4928 	int	cdbsize;
4929 	int 	ret = EIO;
4930 	sd_ssc_t *ssc;
4931 	int	status;
4932 
4933 	ASSERT(un != NULL);
4934 
4935 	if (lbasize == 0) {
4936 		if (ISCD(un)) {
4937 			lbasize = 2048;
4938 		} else {
4939 			lbasize = un->un_sys_blocksize;
4940 		}
4941 	}
4942 	pgeom_p->g_secsize = (unsigned short)lbasize;
4943 
4944 	/*
4945 	 * If the unit is a cd/dvd drive MODE SENSE page three
4946 	 * and MODE SENSE page four are reserved (see SBC spec
4947 	 * and MMC spec). To prevent soft errors just return
4948 	 * using the default LBA size.
4949 	 */
4950 	if (ISCD(un))
4951 		return (ret);
4952 
4953 	cdbsize = (un->un_f_cfg_is_atapi == TRUE) ? CDB_GROUP2 : CDB_GROUP0;
4954 
4955 	/*
4956 	 * Retrieve MODE SENSE page 3 - Format Device Page
4957 	 */
4958 	p3bufp = kmem_zalloc(SD_MODE_SENSE_PAGE3_LENGTH, KM_SLEEP);
4959 	ssc = sd_ssc_init(un);
4960 	status = sd_send_scsi_MODE_SENSE(ssc, cdbsize, p3bufp,
4961 	    SD_MODE_SENSE_PAGE3_LENGTH, SD_MODE_SENSE_PAGE3_CODE, path_flag);
4962 	if (status != 0) {
4963 		SD_ERROR(SD_LOG_COMMON, un,
4964 		    "sd_get_physical_geometry: mode sense page 3 failed\n");
4965 		goto page3_exit;
4966 	}
4967 
4968 	/*
4969 	 * Determine size of Block Descriptors in order to locate the mode
4970 	 * page data.  ATAPI devices return 0, SCSI devices should return
4971 	 * MODE_BLK_DESC_LENGTH.
4972 	 */
4973 	headerp = (struct mode_header *)p3bufp;
4974 	if (un->un_f_cfg_is_atapi == TRUE) {
4975 		struct mode_header_grp2 *mhp =
4976 		    (struct mode_header_grp2 *)headerp;
4977 		mode_header_length = MODE_HEADER_LENGTH_GRP2;
4978 		bd_len = (mhp->bdesc_length_hi << 8) | mhp->bdesc_length_lo;
4979 	} else {
4980 		mode_header_length = MODE_HEADER_LENGTH;
4981 		bd_len = ((struct mode_header *)headerp)->bdesc_length;
4982 	}
4983 
4984 	if (bd_len > MODE_BLK_DESC_LENGTH) {
4985 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
4986 		    "sd_get_physical_geometry: received unexpected bd_len "
4987 		    "of %d, page3\n", bd_len);
4988 		status = EIO;
4989 		goto page3_exit;
4990 	}
4991 
4992 	page3p = (struct mode_format *)
4993 	    ((caddr_t)headerp + mode_header_length + bd_len);
4994 
4995 	if (page3p->mode_page.code != SD_MODE_SENSE_PAGE3_CODE) {
4996 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
4997 		    "sd_get_physical_geometry: mode sense pg3 code mismatch "
4998 		    "%d\n", page3p->mode_page.code);
4999 		status = EIO;
5000 		goto page3_exit;
5001 	}
5002 
5003 	/*
5004 	 * Use this physical geometry data only if BOTH MODE SENSE commands
5005 	 * complete successfully; otherwise, revert to the logical geometry.
5006 	 * So, we need to save everything in temporary variables.
5007 	 */
5008 	sector_size = BE_16(page3p->data_bytes_sect);
5009 
5010 	/*
5011 	 * 1243403: The NEC D38x7 drives do not support MODE SENSE sector size
5012 	 */
5013 	if (sector_size == 0) {
5014 		sector_size = un->un_sys_blocksize;
5015 	} else {
5016 		sector_size &= ~(un->un_sys_blocksize - 1);
5017 	}
5018 
5019 	nsect  = BE_16(page3p->sect_track);
5020 	intrlv = BE_16(page3p->interleave);
5021 
5022 	SD_INFO(SD_LOG_COMMON, un,
5023 	    "sd_get_physical_geometry: Format Parameters (page 3)\n");
5024 	SD_INFO(SD_LOG_COMMON, un,
5025 	    "   mode page: %d; nsect: %d; sector size: %d;\n",
5026 	    page3p->mode_page.code, nsect, sector_size);
5027 	SD_INFO(SD_LOG_COMMON, un,
5028 	    "   interleave: %d; track skew: %d; cylinder skew: %d;\n", intrlv,
5029 	    BE_16(page3p->track_skew),
5030 	    BE_16(page3p->cylinder_skew));
5031 
5032 	sd_ssc_assessment(ssc, SD_FMT_STANDARD);
5033 
5034 	/*
5035 	 * Retrieve MODE SENSE page 4 - Rigid Disk Drive Geometry Page
5036 	 */
5037 	p4bufp = kmem_zalloc(SD_MODE_SENSE_PAGE4_LENGTH, KM_SLEEP);
5038 	status = sd_send_scsi_MODE_SENSE(ssc, cdbsize, p4bufp,
5039 	    SD_MODE_SENSE_PAGE4_LENGTH, SD_MODE_SENSE_PAGE4_CODE, path_flag);
5040 	if (status != 0) {
5041 		SD_ERROR(SD_LOG_COMMON, un,
5042 		    "sd_get_physical_geometry: mode sense page 4 failed\n");
5043 		goto page4_exit;
5044 	}
5045 
5046 	/*
5047 	 * Determine size of Block Descriptors in order to locate the mode
5048 	 * page data.  ATAPI devices return 0, SCSI devices should return
5049 	 * MODE_BLK_DESC_LENGTH.
5050 	 */
5051 	headerp = (struct mode_header *)p4bufp;
5052 	if (un->un_f_cfg_is_atapi == TRUE) {
5053 		struct mode_header_grp2 *mhp =
5054 		    (struct mode_header_grp2 *)headerp;
5055 		bd_len = (mhp->bdesc_length_hi << 8) | mhp->bdesc_length_lo;
5056 	} else {
5057 		bd_len = ((struct mode_header *)headerp)->bdesc_length;
5058 	}
5059 
5060 	if (bd_len > MODE_BLK_DESC_LENGTH) {
5061 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
5062 		    "sd_get_physical_geometry: received unexpected bd_len of "
5063 		    "%d, page4\n", bd_len);
5064 		status = EIO;
5065 		goto page4_exit;
5066 	}
5067 
5068 	page4p = (struct mode_geometry *)
5069 	    ((caddr_t)headerp + mode_header_length + bd_len);
5070 
5071 	if (page4p->mode_page.code != SD_MODE_SENSE_PAGE4_CODE) {
5072 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
5073 		    "sd_get_physical_geometry: mode sense pg4 code mismatch "
5074 		    "%d\n", page4p->mode_page.code);
5075 		status = EIO;
5076 		goto page4_exit;
5077 	}
5078 
5079 	/*
5080 	 * Stash the data now, after we know that both commands completed.
5081 	 */
5082 
5083 
5084 	nhead = (int)page4p->heads;	/* uchar, so no conversion needed */
5085 	spc   = nhead * nsect;
5086 	ncyl  = (page4p->cyl_ub << 16) + (page4p->cyl_mb << 8) + page4p->cyl_lb;
5087 	rpm   = BE_16(page4p->rpm);
5088 
5089 	modesense_capacity = spc * ncyl;
5090 
5091 	SD_INFO(SD_LOG_COMMON, un,
5092 	    "sd_get_physical_geometry: Geometry Parameters (page 4)\n");
5093 	SD_INFO(SD_LOG_COMMON, un,
5094 	    "   cylinders: %d; heads: %d; rpm: %d;\n", ncyl, nhead, rpm);
5095 	SD_INFO(SD_LOG_COMMON, un,
5096 	    "   computed capacity(h*s*c): %d;\n", modesense_capacity);
5097 	SD_INFO(SD_LOG_COMMON, un, "   pgeom_p: %p; read cap: %d\n",
5098 	    (void *)pgeom_p, capacity);
5099 
5100 	/*
5101 	 * Compensate if the drive's geometry is not rectangular, i.e.,
5102 	 * the product of C * H * S returned by MODE SENSE >= that returned
5103 	 * by read capacity. This is an idiosyncrasy of the original x86
5104 	 * disk subsystem.
5105 	 */
5106 	if (modesense_capacity >= capacity) {
5107 		SD_INFO(SD_LOG_COMMON, un,
5108 		    "sd_get_physical_geometry: adjusting acyl; "
5109 		    "old: %d; new: %d\n", pgeom_p->g_acyl,
5110 		    (modesense_capacity - capacity + spc - 1) / spc);
5111 		if (sector_size != 0) {
5112 			/* 1243403: NEC D38x7 drives don't support sec size */
5113 			pgeom_p->g_secsize = (unsigned short)sector_size;
5114 		}
5115 		pgeom_p->g_nsect    = (unsigned short)nsect;
5116 		pgeom_p->g_nhead    = (unsigned short)nhead;
5117 		pgeom_p->g_capacity = capacity;
5118 		pgeom_p->g_acyl	    =
5119 		    (modesense_capacity - pgeom_p->g_capacity + spc - 1) / spc;
5120 		pgeom_p->g_ncyl	    = ncyl - pgeom_p->g_acyl;
5121 	}
5122 
5123 	pgeom_p->g_rpm    = (unsigned short)rpm;
5124 	pgeom_p->g_intrlv = (unsigned short)intrlv;
5125 	ret = 0;
5126 
5127 	SD_INFO(SD_LOG_COMMON, un,
5128 	    "sd_get_physical_geometry: mode sense geometry:\n");
5129 	SD_INFO(SD_LOG_COMMON, un,
5130 	    "   nsect: %d; sector size: %d; interlv: %d\n",
5131 	    nsect, sector_size, intrlv);
5132 	SD_INFO(SD_LOG_COMMON, un,
5133 	    "   nhead: %d; ncyl: %d; rpm: %d; capacity(ms): %d\n",
5134 	    nhead, ncyl, rpm, modesense_capacity);
5135 	SD_INFO(SD_LOG_COMMON, un,
5136 	    "sd_get_physical_geometry: (cached)\n");
5137 	SD_INFO(SD_LOG_COMMON, un,
5138 	    "   ncyl: %ld; acyl: %d; nhead: %d; nsect: %d\n",
5139 	    pgeom_p->g_ncyl,  pgeom_p->g_acyl,
5140 	    pgeom_p->g_nhead, pgeom_p->g_nsect);
5141 	SD_INFO(SD_LOG_COMMON, un,
5142 	    "   lbasize: %d; capacity: %ld; intrlv: %d; rpm: %d\n",
5143 	    pgeom_p->g_secsize, pgeom_p->g_capacity,
5144 	    pgeom_p->g_intrlv, pgeom_p->g_rpm);
5145 	sd_ssc_assessment(ssc, SD_FMT_STANDARD);
5146 
5147 page4_exit:
5148 	kmem_free(p4bufp, SD_MODE_SENSE_PAGE4_LENGTH);
5149 
5150 page3_exit:
5151 	kmem_free(p3bufp, SD_MODE_SENSE_PAGE3_LENGTH);
5152 
5153 	if (status != 0) {
5154 		if (status == EIO) {
5155 			/*
5156 			 * Some disks do not support mode sense(6), we
5157 			 * should ignore this kind of error(sense key is
5158 			 * 0x5 - illegal request).
5159 			 */
5160 			uint8_t *sensep;
5161 			int senlen;
5162 
5163 			sensep = (uint8_t *)ssc->ssc_uscsi_cmd->uscsi_rqbuf;
5164 			senlen = (int)(ssc->ssc_uscsi_cmd->uscsi_rqlen -
5165 			    ssc->ssc_uscsi_cmd->uscsi_rqresid);
5166 
5167 			if (senlen > 0 &&
5168 			    scsi_sense_key(sensep) == KEY_ILLEGAL_REQUEST) {
5169 				sd_ssc_assessment(ssc,
5170 				    SD_FMT_IGNORE_COMPROMISE);
5171 			} else {
5172 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
5173 			}
5174 		} else {
5175 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5176 		}
5177 	}
5178 	sd_ssc_fini(ssc);
5179 	return (ret);
5180 }
5181 
5182 /*
5183  *    Function: sd_get_virtual_geometry
5184  *
5185  * Description: Ask the controller to tell us about the target device.
5186  *
5187  *   Arguments: un - pointer to softstate
5188  *		capacity - disk capacity in #blocks
5189  *		lbasize - disk block size in bytes
5190  *
5191  *     Context: Kernel thread only
5192  */
5193 
5194 static int
5195 sd_get_virtual_geometry(struct sd_lun *un, cmlb_geom_t *lgeom_p,
5196     diskaddr_t capacity, int lbasize)
5197 {
5198 	uint_t	geombuf;
5199 	int	spc;
5200 
5201 	ASSERT(un != NULL);
5202 
5203 	/* Set sector size, and total number of sectors */
5204 	(void) scsi_ifsetcap(SD_ADDRESS(un), "sector-size",   lbasize,  1);
5205 	(void) scsi_ifsetcap(SD_ADDRESS(un), "total-sectors", capacity, 1);
5206 
5207 	/* Let the HBA tell us its geometry */
5208 	geombuf = (uint_t)scsi_ifgetcap(SD_ADDRESS(un), "geometry", 1);
5209 
5210 	/* A value of -1 indicates an undefined "geometry" property */
5211 	if (geombuf == (-1)) {
5212 		return (EINVAL);
5213 	}
5214 
5215 	/* Initialize the logical geometry cache. */
5216 	lgeom_p->g_nhead   = (geombuf >> 16) & 0xffff;
5217 	lgeom_p->g_nsect   = geombuf & 0xffff;
5218 	lgeom_p->g_secsize = un->un_sys_blocksize;
5219 
5220 	spc = lgeom_p->g_nhead * lgeom_p->g_nsect;
5221 
5222 	/*
5223 	 * Note: The driver originally converted the capacity value from
5224 	 * target blocks to system blocks. However, the capacity value passed
5225 	 * to this routine is already in terms of system blocks (this scaling
5226 	 * is done when the READ CAPACITY command is issued and processed).
5227 	 * This 'error' may have gone undetected because the usage of g_ncyl
5228 	 * (which is based upon g_capacity) is very limited within the driver
5229 	 */
5230 	lgeom_p->g_capacity = capacity;
5231 
5232 	/*
5233 	 * Set ncyl to zero if the hba returned a zero nhead or nsect value. The
5234 	 * hba may return zero values if the device has been removed.
5235 	 */
5236 	if (spc == 0) {
5237 		lgeom_p->g_ncyl = 0;
5238 	} else {
5239 		lgeom_p->g_ncyl = lgeom_p->g_capacity / spc;
5240 	}
5241 	lgeom_p->g_acyl = 0;
5242 
5243 	SD_INFO(SD_LOG_COMMON, un, "sd_get_virtual_geometry: (cached)\n");
5244 	return (0);
5245 
5246 }
5247 /*
5248  *    Function: sd_update_block_info
5249  *
5250  * Description: Calculate a byte count to sector count bitshift value
5251  *		from sector size.
5252  *
5253  *   Arguments: un: unit struct.
5254  *		lbasize: new target sector size
5255  *		capacity: new target capacity, ie. block count
5256  *
5257  *     Context: Kernel thread context
5258  */
5259 
5260 static void
5261 sd_update_block_info(struct sd_lun *un, uint32_t lbasize, uint64_t capacity)
5262 {
5263 	if (lbasize != 0) {
5264 		un->un_tgt_blocksize = lbasize;
5265 		un->un_f_tgt_blocksize_is_valid = TRUE;
5266 		if (!un->un_f_has_removable_media) {
5267 			un->un_sys_blocksize = lbasize;
5268 		}
5269 	}
5270 
5271 	if (capacity != 0) {
5272 		un->un_blockcount		= capacity;
5273 		un->un_f_blockcount_is_valid	= TRUE;
5274 	}
5275 }
5276 
5277 
5278 /*
5279  *    Function: sd_register_devid
5280  *
5281  * Description: This routine will obtain the device id information from the
5282  *		target, obtain the serial number, and register the device
5283  *		id with the ddi framework.
5284  *
5285  *   Arguments: devi - the system's dev_info_t for the device.
5286  *		un - driver soft state (unit) structure
5287  *		reservation_flag - indicates if a reservation conflict
5288  *		occurred during attach
5289  *
5290  *     Context: Kernel Thread
5291  */
5292 static void
5293 sd_register_devid(sd_ssc_t *ssc, dev_info_t *devi, int reservation_flag)
5294 {
5295 	int		rval		= 0;
5296 	uchar_t		*inq80		= NULL;
5297 	size_t		inq80_len	= MAX_INQUIRY_SIZE;
5298 	size_t		inq80_resid	= 0;
5299 	uchar_t		*inq83		= NULL;
5300 	size_t		inq83_len	= MAX_INQUIRY_SIZE;
5301 	size_t		inq83_resid	= 0;
5302 	int		dlen, len;
5303 	char		*sn;
5304 	struct sd_lun	*un;
5305 
5306 	ASSERT(ssc != NULL);
5307 	un = ssc->ssc_un;
5308 	ASSERT(un != NULL);
5309 	ASSERT(mutex_owned(SD_MUTEX(un)));
5310 	ASSERT((SD_DEVINFO(un)) == devi);
5311 
5312 
5313 	/*
5314 	 * We check the availability of the World Wide Name (0x83) and Unit
5315 	 * Serial Number (0x80) pages in sd_check_vpd_page_support(), and using
5316 	 * un_vpd_page_mask from them, we decide which way to get the WWN.  If
5317 	 * 0x83 is available, that is the best choice.  Our next choice is
5318 	 * 0x80.  If neither are available, we munge the devid from the device
5319 	 * vid/pid/serial # for Sun qualified disks, or use the ddi framework
5320 	 * to fabricate a devid for non-Sun qualified disks.
5321 	 */
5322 	if (sd_check_vpd_page_support(ssc) == 0) {
5323 		/* collect page 80 data if available */
5324 		if (un->un_vpd_page_mask & SD_VPD_UNIT_SERIAL_PG) {
5325 
5326 			mutex_exit(SD_MUTEX(un));
5327 			inq80 = kmem_zalloc(inq80_len, KM_SLEEP);
5328 
5329 			rval = sd_send_scsi_INQUIRY(ssc, inq80, inq80_len,
5330 			    0x01, 0x80, &inq80_resid);
5331 
5332 			if (rval != 0) {
5333 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5334 				kmem_free(inq80, inq80_len);
5335 				inq80 = NULL;
5336 				inq80_len = 0;
5337 			} else if (ddi_prop_exists(
5338 			    DDI_DEV_T_NONE, SD_DEVINFO(un),
5339 			    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS,
5340 			    INQUIRY_SERIAL_NO) == 0) {
5341 				/*
5342 				 * If we don't already have a serial number
5343 				 * property, do quick verify of data returned
5344 				 * and define property.
5345 				 */
5346 				dlen = inq80_len - inq80_resid;
5347 				len = (size_t)inq80[3];
5348 				if ((dlen >= 4) && ((len + 4) <= dlen)) {
5349 					/*
5350 					 * Ensure sn termination, skip leading
5351 					 * blanks, and create property
5352 					 * 'inquiry-serial-no'.
5353 					 */
5354 					sn = (char *)&inq80[4];
5355 					sn[len] = 0;
5356 					while (*sn && (*sn == ' '))
5357 						sn++;
5358 					if (*sn) {
5359 						(void) ddi_prop_update_string(
5360 						    DDI_DEV_T_NONE,
5361 						    SD_DEVINFO(un),
5362 						    INQUIRY_SERIAL_NO, sn);
5363 					}
5364 				}
5365 			}
5366 			mutex_enter(SD_MUTEX(un));
5367 		}
5368 
5369 		/* collect page 83 data if available */
5370 		if (un->un_vpd_page_mask & SD_VPD_DEVID_WWN_PG) {
5371 			mutex_exit(SD_MUTEX(un));
5372 			inq83 = kmem_zalloc(inq83_len, KM_SLEEP);
5373 
5374 			rval = sd_send_scsi_INQUIRY(ssc, inq83, inq83_len,
5375 			    0x01, 0x83, &inq83_resid);
5376 
5377 			if (rval != 0) {
5378 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5379 				kmem_free(inq83, inq83_len);
5380 				inq83 = NULL;
5381 				inq83_len = 0;
5382 			}
5383 			mutex_enter(SD_MUTEX(un));
5384 		}
5385 	}
5386 
5387 	/*
5388 	 * If transport has already registered a devid for this target
5389 	 * then that takes precedence over the driver's determination
5390 	 * of the devid.
5391 	 *
5392 	 * NOTE: The reason this check is done here instead of at the beginning
5393 	 * of the function is to allow the code above to create the
5394 	 * 'inquiry-serial-no' property.
5395 	 */
5396 	if (ddi_devid_get(SD_DEVINFO(un), &un->un_devid) == DDI_SUCCESS) {
5397 		ASSERT(un->un_devid);
5398 		un->un_f_devid_transport_defined = TRUE;
5399 		goto cleanup; /* use devid registered by the transport */
5400 	}
5401 
5402 	/*
5403 	 * This is the case of antiquated Sun disk drives that have the
5404 	 * FAB_DEVID property set in the disk_table.  These drives
5405 	 * manage the devid's by storing them in last 2 available sectors
5406 	 * on the drive and have them fabricated by the ddi layer by calling
5407 	 * ddi_devid_init and passing the DEVID_FAB flag.
5408 	 */
5409 	if (un->un_f_opt_fab_devid == TRUE) {
5410 		/*
5411 		 * Depending on EINVAL isn't reliable, since a reserved disk
5412 		 * may result in invalid geometry, so check to make sure a
5413 		 * reservation conflict did not occur during attach.
5414 		 */
5415 		if ((sd_get_devid(ssc) == EINVAL) &&
5416 		    (reservation_flag != SD_TARGET_IS_RESERVED)) {
5417 			/*
5418 			 * The devid is invalid AND there is no reservation
5419 			 * conflict.  Fabricate a new devid.
5420 			 */
5421 			(void) sd_create_devid(ssc);
5422 		}
5423 
5424 		/* Register the devid if it exists */
5425 		if (un->un_devid != NULL) {
5426 			(void) ddi_devid_register(SD_DEVINFO(un),
5427 			    un->un_devid);
5428 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
5429 			    "sd_register_devid: Devid Fabricated\n");
5430 		}
5431 		goto cleanup;
5432 	}
5433 
5434 	/* encode best devid possible based on data available */
5435 	if (ddi_devid_scsi_encode(DEVID_SCSI_ENCODE_VERSION_LATEST,
5436 	    (char *)ddi_driver_name(SD_DEVINFO(un)),
5437 	    (uchar_t *)SD_INQUIRY(un), sizeof (*SD_INQUIRY(un)),
5438 	    inq80, inq80_len - inq80_resid, inq83, inq83_len -
5439 	    inq83_resid, &un->un_devid) == DDI_SUCCESS) {
5440 
5441 		/* devid successfully encoded, register devid */
5442 		(void) ddi_devid_register(SD_DEVINFO(un), un->un_devid);
5443 
5444 	} else {
5445 		/*
5446 		 * Unable to encode a devid based on data available.
5447 		 * This is not a Sun qualified disk.  Older Sun disk
5448 		 * drives that have the SD_FAB_DEVID property
5449 		 * set in the disk_table and non Sun qualified
5450 		 * disks are treated in the same manner.  These
5451 		 * drives manage the devid's by storing them in
5452 		 * last 2 available sectors on the drive and
5453 		 * have them fabricated by the ddi layer by
5454 		 * calling ddi_devid_init and passing the
5455 		 * DEVID_FAB flag.
5456 		 * Create a fabricate devid only if there's no
5457 		 * fabricate devid existed.
5458 		 */
5459 		if (sd_get_devid(ssc) == EINVAL) {
5460 			(void) sd_create_devid(ssc);
5461 		}
5462 		un->un_f_opt_fab_devid = TRUE;
5463 
5464 		/* Register the devid if it exists */
5465 		if (un->un_devid != NULL) {
5466 			(void) ddi_devid_register(SD_DEVINFO(un),
5467 			    un->un_devid);
5468 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
5469 			    "sd_register_devid: devid fabricated using "
5470 			    "ddi framework\n");
5471 		}
5472 	}
5473 
5474 cleanup:
5475 	/* clean up resources */
5476 	if (inq80 != NULL) {
5477 		kmem_free(inq80, inq80_len);
5478 	}
5479 	if (inq83 != NULL) {
5480 		kmem_free(inq83, inq83_len);
5481 	}
5482 }
5483 
5484 
5485 
5486 /*
5487  *    Function: sd_get_devid
5488  *
5489  * Description: This routine will return 0 if a valid device id has been
5490  *		obtained from the target and stored in the soft state. If a
5491  *		valid device id has not been previously read and stored, a
5492  *		read attempt will be made.
5493  *
5494  *   Arguments: un - driver soft state (unit) structure
5495  *
5496  * Return Code: 0 if we successfully get the device id
5497  *
5498  *     Context: Kernel Thread
5499  */
5500 
5501 static int
5502 sd_get_devid(sd_ssc_t *ssc)
5503 {
5504 	struct dk_devid		*dkdevid;
5505 	ddi_devid_t		tmpid;
5506 	uint_t			*ip;
5507 	size_t			sz;
5508 	diskaddr_t		blk;
5509 	int			status;
5510 	int			chksum;
5511 	int			i;
5512 	size_t			buffer_size;
5513 	struct sd_lun		*un;
5514 
5515 	ASSERT(ssc != NULL);
5516 	un = ssc->ssc_un;
5517 	ASSERT(un != NULL);
5518 	ASSERT(mutex_owned(SD_MUTEX(un)));
5519 
5520 	SD_TRACE(SD_LOG_ATTACH_DETACH, un, "sd_get_devid: entry: un: 0x%p\n",
5521 	    un);
5522 
5523 	if (un->un_devid != NULL) {
5524 		return (0);
5525 	}
5526 
5527 	mutex_exit(SD_MUTEX(un));
5528 	if (cmlb_get_devid_block(un->un_cmlbhandle, &blk,
5529 	    (void *)SD_PATH_DIRECT) != 0) {
5530 		mutex_enter(SD_MUTEX(un));
5531 		return (EINVAL);
5532 	}
5533 
5534 	/*
5535 	 * Read and verify device id, stored in the reserved cylinders at the
5536 	 * end of the disk. Backup label is on the odd sectors of the last
5537 	 * track of the last cylinder. Device id will be on track of the next
5538 	 * to last cylinder.
5539 	 */
5540 	mutex_enter(SD_MUTEX(un));
5541 	buffer_size = SD_REQBYTES2TGTBYTES(un, sizeof (struct dk_devid));
5542 	mutex_exit(SD_MUTEX(un));
5543 	dkdevid = kmem_alloc(buffer_size, KM_SLEEP);
5544 	status = sd_send_scsi_READ(ssc, dkdevid, buffer_size, blk,
5545 	    SD_PATH_DIRECT);
5546 
5547 	if (status != 0) {
5548 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5549 		goto error;
5550 	}
5551 
5552 	/* Validate the revision */
5553 	if ((dkdevid->dkd_rev_hi != DK_DEVID_REV_MSB) ||
5554 	    (dkdevid->dkd_rev_lo != DK_DEVID_REV_LSB)) {
5555 		status = EINVAL;
5556 		goto error;
5557 	}
5558 
5559 	/* Calculate the checksum */
5560 	chksum = 0;
5561 	ip = (uint_t *)dkdevid;
5562 	for (i = 0; i < ((DEV_BSIZE - sizeof (int)) / sizeof (int));
5563 	    i++) {
5564 		chksum ^= ip[i];
5565 	}
5566 
5567 	/* Compare the checksums */
5568 	if (DKD_GETCHKSUM(dkdevid) != chksum) {
5569 		status = EINVAL;
5570 		goto error;
5571 	}
5572 
5573 	/* Validate the device id */
5574 	if (ddi_devid_valid((ddi_devid_t)&dkdevid->dkd_devid) != DDI_SUCCESS) {
5575 		status = EINVAL;
5576 		goto error;
5577 	}
5578 
5579 	/*
5580 	 * Store the device id in the driver soft state
5581 	 */
5582 	sz = ddi_devid_sizeof((ddi_devid_t)&dkdevid->dkd_devid);
5583 	tmpid = kmem_alloc(sz, KM_SLEEP);
5584 
5585 	mutex_enter(SD_MUTEX(un));
5586 
5587 	un->un_devid = tmpid;
5588 	bcopy(&dkdevid->dkd_devid, un->un_devid, sz);
5589 
5590 	kmem_free(dkdevid, buffer_size);
5591 
5592 	SD_TRACE(SD_LOG_ATTACH_DETACH, un, "sd_get_devid: exit: un:0x%p\n", un);
5593 
5594 	return (status);
5595 error:
5596 	mutex_enter(SD_MUTEX(un));
5597 	kmem_free(dkdevid, buffer_size);
5598 	return (status);
5599 }
5600 
5601 
5602 /*
5603  *    Function: sd_create_devid
5604  *
5605  * Description: This routine will fabricate the device id and write it
5606  *		to the disk.
5607  *
5608  *   Arguments: un - driver soft state (unit) structure
5609  *
5610  * Return Code: value of the fabricated device id
5611  *
5612  *     Context: Kernel Thread
5613  */
5614 
5615 static ddi_devid_t
5616 sd_create_devid(sd_ssc_t *ssc)
5617 {
5618 	struct sd_lun	*un;
5619 
5620 	ASSERT(ssc != NULL);
5621 	un = ssc->ssc_un;
5622 	ASSERT(un != NULL);
5623 
5624 	/* Fabricate the devid */
5625 	if (ddi_devid_init(SD_DEVINFO(un), DEVID_FAB, 0, NULL, &un->un_devid)
5626 	    == DDI_FAILURE) {
5627 		return (NULL);
5628 	}
5629 
5630 	/* Write the devid to disk */
5631 	if (sd_write_deviceid(ssc) != 0) {
5632 		ddi_devid_free(un->un_devid);
5633 		un->un_devid = NULL;
5634 	}
5635 
5636 	return (un->un_devid);
5637 }
5638 
5639 
5640 /*
5641  *    Function: sd_write_deviceid
5642  *
5643  * Description: This routine will write the device id to the disk
5644  *		reserved sector.
5645  *
5646  *   Arguments: un - driver soft state (unit) structure
5647  *
5648  * Return Code: EINVAL
5649  *		value returned by sd_send_scsi_cmd
5650  *
5651  *     Context: Kernel Thread
5652  */
5653 
5654 static int
5655 sd_write_deviceid(sd_ssc_t *ssc)
5656 {
5657 	struct dk_devid		*dkdevid;
5658 	uchar_t			*buf;
5659 	diskaddr_t		blk;
5660 	uint_t			*ip, chksum;
5661 	int			status;
5662 	int			i;
5663 	struct sd_lun		*un;
5664 
5665 	ASSERT(ssc != NULL);
5666 	un = ssc->ssc_un;
5667 	ASSERT(un != NULL);
5668 	ASSERT(mutex_owned(SD_MUTEX(un)));
5669 
5670 	mutex_exit(SD_MUTEX(un));
5671 	if (cmlb_get_devid_block(un->un_cmlbhandle, &blk,
5672 	    (void *)SD_PATH_DIRECT) != 0) {
5673 		mutex_enter(SD_MUTEX(un));
5674 		return (-1);
5675 	}
5676 
5677 
5678 	/* Allocate the buffer */
5679 	buf = kmem_zalloc(un->un_sys_blocksize, KM_SLEEP);
5680 	dkdevid = (struct dk_devid *)buf;
5681 
5682 	/* Fill in the revision */
5683 	dkdevid->dkd_rev_hi = DK_DEVID_REV_MSB;
5684 	dkdevid->dkd_rev_lo = DK_DEVID_REV_LSB;
5685 
5686 	/* Copy in the device id */
5687 	mutex_enter(SD_MUTEX(un));
5688 	bcopy(un->un_devid, &dkdevid->dkd_devid,
5689 	    ddi_devid_sizeof(un->un_devid));
5690 	mutex_exit(SD_MUTEX(un));
5691 
5692 	/* Calculate the checksum */
5693 	chksum = 0;
5694 	ip = (uint_t *)dkdevid;
5695 	for (i = 0; i < ((DEV_BSIZE - sizeof (int)) / sizeof (int));
5696 	    i++) {
5697 		chksum ^= ip[i];
5698 	}
5699 
5700 	/* Fill-in checksum */
5701 	DKD_FORMCHKSUM(chksum, dkdevid);
5702 
5703 	/* Write the reserved sector */
5704 	status = sd_send_scsi_WRITE(ssc, buf, un->un_sys_blocksize, blk,
5705 	    SD_PATH_DIRECT);
5706 	if (status != 0)
5707 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5708 
5709 	kmem_free(buf, un->un_sys_blocksize);
5710 
5711 	mutex_enter(SD_MUTEX(un));
5712 	return (status);
5713 }
5714 
5715 
5716 /*
5717  *    Function: sd_check_vpd_page_support
5718  *
5719  * Description: This routine sends an inquiry command with the EVPD bit set and
5720  *		a page code of 0x00 to the device. It is used to determine which
5721  *		vital product pages are available to find the devid. We are
5722  *		looking for pages 0x83 0x80 or 0xB1.  If we return a negative 1,
5723  *		the device does not support that command.
5724  *
5725  *   Arguments: un  - driver soft state (unit) structure
5726  *
5727  * Return Code: 0 - success
5728  *		1 - check condition
5729  *
5730  *     Context: This routine can sleep.
5731  */
5732 
5733 static int
5734 sd_check_vpd_page_support(sd_ssc_t *ssc)
5735 {
5736 	uchar_t	*page_list	= NULL;
5737 	uchar_t	page_length	= 0xff;	/* Use max possible length */
5738 	uchar_t	evpd		= 0x01;	/* Set the EVPD bit */
5739 	uchar_t	page_code	= 0x00;	/* Supported VPD Pages */
5740 	int    	rval		= 0;
5741 	int	counter;
5742 	struct sd_lun		*un;
5743 
5744 	ASSERT(ssc != NULL);
5745 	un = ssc->ssc_un;
5746 	ASSERT(un != NULL);
5747 	ASSERT(mutex_owned(SD_MUTEX(un)));
5748 
5749 	mutex_exit(SD_MUTEX(un));
5750 
5751 	/*
5752 	 * We'll set the page length to the maximum to save figuring it out
5753 	 * with an additional call.
5754 	 */
5755 	page_list =  kmem_zalloc(page_length, KM_SLEEP);
5756 
5757 	rval = sd_send_scsi_INQUIRY(ssc, page_list, page_length, evpd,
5758 	    page_code, NULL);
5759 
5760 	if (rval != 0)
5761 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5762 
5763 	mutex_enter(SD_MUTEX(un));
5764 
5765 	/*
5766 	 * Now we must validate that the device accepted the command, as some
5767 	 * drives do not support it.  If the drive does support it, we will
5768 	 * return 0, and the supported pages will be in un_vpd_page_mask.  If
5769 	 * not, we return -1.
5770 	 */
5771 	if ((rval == 0) && (page_list[VPD_MODE_PAGE] == 0x00)) {
5772 		/* Loop to find one of the 2 pages we need */
5773 		counter = 4;  /* Supported pages start at byte 4, with 0x00 */
5774 
5775 		/*
5776 		 * Pages are returned in ascending order, and 0x83 is what we
5777 		 * are hoping for.
5778 		 */
5779 		while ((page_list[counter] <= 0xB1) &&
5780 		    (counter <= (page_list[VPD_PAGE_LENGTH] +
5781 		    VPD_HEAD_OFFSET))) {
5782 			/*
5783 			 * Add 3 because page_list[3] is the number of
5784 			 * pages minus 3
5785 			 */
5786 
5787 			switch (page_list[counter]) {
5788 			case 0x00:
5789 				un->un_vpd_page_mask |= SD_VPD_SUPPORTED_PG;
5790 				break;
5791 			case 0x80:
5792 				un->un_vpd_page_mask |= SD_VPD_UNIT_SERIAL_PG;
5793 				break;
5794 			case 0x81:
5795 				un->un_vpd_page_mask |= SD_VPD_OPERATING_PG;
5796 				break;
5797 			case 0x82:
5798 				un->un_vpd_page_mask |= SD_VPD_ASCII_OP_PG;
5799 				break;
5800 			case 0x83:
5801 				un->un_vpd_page_mask |= SD_VPD_DEVID_WWN_PG;
5802 				break;
5803 			case 0x86:
5804 				un->un_vpd_page_mask |= SD_VPD_EXTENDED_DATA_PG;
5805 				break;
5806 			case 0xB1:
5807 				un->un_vpd_page_mask |= SD_VPD_DEV_CHARACTER_PG;
5808 				break;
5809 			}
5810 			counter++;
5811 		}
5812 
5813 	} else {
5814 		rval = -1;
5815 
5816 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
5817 		    "sd_check_vpd_page_support: This drive does not implement "
5818 		    "VPD pages.\n");
5819 	}
5820 
5821 	kmem_free(page_list, page_length);
5822 
5823 	return (rval);
5824 }
5825 
5826 
5827 /*
5828  *    Function: sd_setup_pm
5829  *
5830  * Description: Initialize Power Management on the device
5831  *
5832  *     Context: Kernel Thread
5833  */
5834 
5835 static void
5836 sd_setup_pm(sd_ssc_t *ssc, dev_info_t *devi)
5837 {
5838 	uint_t		log_page_size;
5839 	uchar_t		*log_page_data;
5840 	int		rval = 0;
5841 	struct sd_lun	*un;
5842 
5843 	ASSERT(ssc != NULL);
5844 	un = ssc->ssc_un;
5845 	ASSERT(un != NULL);
5846 
5847 	/*
5848 	 * Since we are called from attach, holding a mutex for
5849 	 * un is unnecessary. Because some of the routines called
5850 	 * from here require SD_MUTEX to not be held, assert this
5851 	 * right up front.
5852 	 */
5853 	ASSERT(!mutex_owned(SD_MUTEX(un)));
5854 	/*
5855 	 * Since the sd device does not have the 'reg' property,
5856 	 * cpr will not call its DDI_SUSPEND/DDI_RESUME entries.
5857 	 * The following code is to tell cpr that this device
5858 	 * DOES need to be suspended and resumed.
5859 	 */
5860 	(void) ddi_prop_update_string(DDI_DEV_T_NONE, devi,
5861 	    "pm-hardware-state", "needs-suspend-resume");
5862 
5863 	/*
5864 	 * This complies with the new power management framework
5865 	 * for certain desktop machines. Create the pm_components
5866 	 * property as a string array property.
5867 	 * If un_f_pm_supported is TRUE, that means the disk
5868 	 * attached HBA has set the "pm-capable" property and
5869 	 * the value of this property is bigger than 0.
5870 	 */
5871 	if (un->un_f_pm_supported) {
5872 		/*
5873 		 * not all devices have a motor, try it first.
5874 		 * some devices may return ILLEGAL REQUEST, some
5875 		 * will hang
5876 		 * The following START_STOP_UNIT is used to check if target
5877 		 * device has a motor.
5878 		 */
5879 		un->un_f_start_stop_supported = TRUE;
5880 
5881 		if (un->un_f_power_condition_supported) {
5882 			rval = sd_send_scsi_START_STOP_UNIT(ssc,
5883 			    SD_POWER_CONDITION, SD_TARGET_ACTIVE,
5884 			    SD_PATH_DIRECT);
5885 			if (rval != 0) {
5886 				un->un_f_power_condition_supported = FALSE;
5887 			}
5888 		}
5889 		if (!un->un_f_power_condition_supported) {
5890 			rval = sd_send_scsi_START_STOP_UNIT(ssc,
5891 			    SD_START_STOP, SD_TARGET_START, SD_PATH_DIRECT);
5892 		}
5893 		if (rval != 0) {
5894 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
5895 			un->un_f_start_stop_supported = FALSE;
5896 		}
5897 
5898 		/*
5899 		 * create pm properties anyways otherwise the parent can't
5900 		 * go to sleep
5901 		 */
5902 		un->un_f_pm_is_enabled = TRUE;
5903 		(void) sd_create_pm_components(devi, un);
5904 
5905 		/*
5906 		 * If it claims that log sense is supported, check it out.
5907 		 */
5908 		if (un->un_f_log_sense_supported) {
5909 			rval = sd_log_page_supported(ssc,
5910 			    START_STOP_CYCLE_PAGE);
5911 			if (rval == 1) {
5912 				/* Page found, use it. */
5913 				un->un_start_stop_cycle_page =
5914 				    START_STOP_CYCLE_PAGE;
5915 			} else {
5916 				/*
5917 				 * Page not found or log sense is not
5918 				 * supported.
5919 				 * Notice we do not check the old style
5920 				 * START_STOP_CYCLE_VU_PAGE because this
5921 				 * code path does not apply to old disks.
5922 				 */
5923 				un->un_f_log_sense_supported = FALSE;
5924 				un->un_f_pm_log_sense_smart = FALSE;
5925 			}
5926 		}
5927 
5928 		return;
5929 	}
5930 
5931 	/*
5932 	 * For the disk whose attached HBA has not set the "pm-capable"
5933 	 * property, check if it supports the power management.
5934 	 */
5935 	if (!un->un_f_log_sense_supported) {
5936 		un->un_power_level = SD_SPINDLE_ON;
5937 		un->un_f_pm_is_enabled = FALSE;
5938 		return;
5939 	}
5940 
5941 	rval = sd_log_page_supported(ssc, START_STOP_CYCLE_PAGE);
5942 
5943 #ifdef	SDDEBUG
5944 	if (sd_force_pm_supported) {
5945 		/* Force a successful result */
5946 		rval = 1;
5947 	}
5948 #endif
5949 
5950 	/*
5951 	 * If the start-stop cycle counter log page is not supported
5952 	 * or if the pm-capable property is set to be false (0),
5953 	 * then we should not create the pm_components property.
5954 	 */
5955 	if (rval == -1) {
5956 		/*
5957 		 * Error.
5958 		 * Reading log sense failed, most likely this is
5959 		 * an older drive that does not support log sense.
5960 		 * If this fails auto-pm is not supported.
5961 		 */
5962 		un->un_power_level = SD_SPINDLE_ON;
5963 		un->un_f_pm_is_enabled = FALSE;
5964 
5965 	} else if (rval == 0) {
5966 		/*
5967 		 * Page not found.
5968 		 * The start stop cycle counter is implemented as page
5969 		 * START_STOP_CYCLE_PAGE_VU_PAGE (0x31) in older disks. For
5970 		 * newer disks it is implemented as START_STOP_CYCLE_PAGE (0xE).
5971 		 */
5972 		if (sd_log_page_supported(ssc, START_STOP_CYCLE_VU_PAGE) == 1) {
5973 			/*
5974 			 * Page found, use this one.
5975 			 */
5976 			un->un_start_stop_cycle_page = START_STOP_CYCLE_VU_PAGE;
5977 			un->un_f_pm_is_enabled = TRUE;
5978 		} else {
5979 			/*
5980 			 * Error or page not found.
5981 			 * auto-pm is not supported for this device.
5982 			 */
5983 			un->un_power_level = SD_SPINDLE_ON;
5984 			un->un_f_pm_is_enabled = FALSE;
5985 		}
5986 	} else {
5987 		/*
5988 		 * Page found, use it.
5989 		 */
5990 		un->un_start_stop_cycle_page = START_STOP_CYCLE_PAGE;
5991 		un->un_f_pm_is_enabled = TRUE;
5992 	}
5993 
5994 
5995 	if (un->un_f_pm_is_enabled == TRUE) {
5996 		log_page_size = START_STOP_CYCLE_COUNTER_PAGE_SIZE;
5997 		log_page_data = kmem_zalloc(log_page_size, KM_SLEEP);
5998 
5999 		rval = sd_send_scsi_LOG_SENSE(ssc, log_page_data,
6000 		    log_page_size, un->un_start_stop_cycle_page,
6001 		    0x01, 0, SD_PATH_DIRECT);
6002 
6003 		if (rval != 0) {
6004 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
6005 		}
6006 
6007 #ifdef	SDDEBUG
6008 		if (sd_force_pm_supported) {
6009 			/* Force a successful result */
6010 			rval = 0;
6011 		}
6012 #endif
6013 
6014 		/*
6015 		 * If the Log sense for Page( Start/stop cycle counter page)
6016 		 * succeeds, then power management is supported and we can
6017 		 * enable auto-pm.
6018 		 */
6019 		if (rval == 0)  {
6020 			(void) sd_create_pm_components(devi, un);
6021 		} else {
6022 			un->un_power_level = SD_SPINDLE_ON;
6023 			un->un_f_pm_is_enabled = FALSE;
6024 		}
6025 
6026 		kmem_free(log_page_data, log_page_size);
6027 	}
6028 }
6029 
6030 
6031 /*
6032  *    Function: sd_create_pm_components
6033  *
6034  * Description: Initialize PM property.
6035  *
6036  *     Context: Kernel thread context
6037  */
6038 
6039 static void
6040 sd_create_pm_components(dev_info_t *devi, struct sd_lun *un)
6041 {
6042 	ASSERT(!mutex_owned(SD_MUTEX(un)));
6043 
6044 	if (un->un_f_power_condition_supported) {
6045 		if (ddi_prop_update_string_array(DDI_DEV_T_NONE, devi,
6046 		    "pm-components", sd_pwr_pc.pm_comp, 5)
6047 		    != DDI_PROP_SUCCESS) {
6048 			un->un_power_level = SD_SPINDLE_ACTIVE;
6049 			un->un_f_pm_is_enabled = FALSE;
6050 			return;
6051 		}
6052 	} else {
6053 		if (ddi_prop_update_string_array(DDI_DEV_T_NONE, devi,
6054 		    "pm-components", sd_pwr_ss.pm_comp, 3)
6055 		    != DDI_PROP_SUCCESS) {
6056 			un->un_power_level = SD_SPINDLE_ON;
6057 			un->un_f_pm_is_enabled = FALSE;
6058 			return;
6059 		}
6060 	}
6061 	/*
6062 	 * When components are initially created they are idle,
6063 	 * power up any non-removables.
6064 	 * Note: the return value of pm_raise_power can't be used
6065 	 * for determining if PM should be enabled for this device.
6066 	 * Even if you check the return values and remove this
6067 	 * property created above, the PM framework will not honor the
6068 	 * change after the first call to pm_raise_power. Hence,
6069 	 * removal of that property does not help if pm_raise_power
6070 	 * fails. In the case of removable media, the start/stop
6071 	 * will fail if the media is not present.
6072 	 */
6073 	if (un->un_f_attach_spinup && (pm_raise_power(SD_DEVINFO(un), 0,
6074 	    SD_PM_STATE_ACTIVE(un)) == DDI_SUCCESS)) {
6075 		mutex_enter(SD_MUTEX(un));
6076 		un->un_power_level = SD_PM_STATE_ACTIVE(un);
6077 		mutex_enter(&un->un_pm_mutex);
6078 		/* Set to on and not busy. */
6079 		un->un_pm_count = 0;
6080 	} else {
6081 		mutex_enter(SD_MUTEX(un));
6082 		un->un_power_level = SD_PM_STATE_STOPPED(un);
6083 		mutex_enter(&un->un_pm_mutex);
6084 		/* Set to off. */
6085 		un->un_pm_count = -1;
6086 	}
6087 	mutex_exit(&un->un_pm_mutex);
6088 	mutex_exit(SD_MUTEX(un));
6089 }
6090 
6091 
6092 /*
6093  *    Function: sd_ddi_suspend
6094  *
6095  * Description: Performs system power-down operations. This includes
6096  *		setting the drive state to indicate its suspended so
6097  *		that no new commands will be accepted. Also, wait for
6098  *		all commands that are in transport or queued to a timer
6099  *		for retry to complete. All timeout threads are cancelled.
6100  *
6101  * Return Code: DDI_FAILURE or DDI_SUCCESS
6102  *
6103  *     Context: Kernel thread context
6104  */
6105 
6106 static int
6107 sd_ddi_suspend(dev_info_t *devi)
6108 {
6109 	struct	sd_lun	*un;
6110 	clock_t		wait_cmds_complete;
6111 
6112 	un = ddi_get_soft_state(sd_state, ddi_get_instance(devi));
6113 	if (un == NULL) {
6114 		return (DDI_FAILURE);
6115 	}
6116 
6117 	SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: entry\n");
6118 
6119 	mutex_enter(SD_MUTEX(un));
6120 
6121 	/* Return success if the device is already suspended. */
6122 	if (un->un_state == SD_STATE_SUSPENDED) {
6123 		mutex_exit(SD_MUTEX(un));
6124 		SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: "
6125 		    "device already suspended, exiting\n");
6126 		return (DDI_SUCCESS);
6127 	}
6128 
6129 	/* Return failure if the device is being used by HA */
6130 	if (un->un_resvd_status &
6131 	    (SD_RESERVE | SD_WANT_RESERVE | SD_LOST_RESERVE)) {
6132 		mutex_exit(SD_MUTEX(un));
6133 		SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: "
6134 		    "device in use by HA, exiting\n");
6135 		return (DDI_FAILURE);
6136 	}
6137 
6138 	/*
6139 	 * Return failure if the device is in a resource wait
6140 	 * or power changing state.
6141 	 */
6142 	if ((un->un_state == SD_STATE_RWAIT) ||
6143 	    (un->un_state == SD_STATE_PM_CHANGING)) {
6144 		mutex_exit(SD_MUTEX(un));
6145 		SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: "
6146 		    "device in resource wait state, exiting\n");
6147 		return (DDI_FAILURE);
6148 	}
6149 
6150 
6151 	un->un_save_state = un->un_last_state;
6152 	New_state(un, SD_STATE_SUSPENDED);
6153 
6154 	/*
6155 	 * Wait for all commands that are in transport or queued to a timer
6156 	 * for retry to complete.
6157 	 *
6158 	 * While waiting, no new commands will be accepted or sent because of
6159 	 * the new state we set above.
6160 	 *
6161 	 * Wait till current operation has completed. If we are in the resource
6162 	 * wait state (with an intr outstanding) then we need to wait till the
6163 	 * intr completes and starts the next cmd. We want to wait for
6164 	 * SD_WAIT_CMDS_COMPLETE seconds before failing the DDI_SUSPEND.
6165 	 */
6166 	wait_cmds_complete = ddi_get_lbolt() +
6167 	    (sd_wait_cmds_complete * drv_usectohz(1000000));
6168 
6169 	while (un->un_ncmds_in_transport != 0) {
6170 		/*
6171 		 * Fail if commands do not finish in the specified time.
6172 		 */
6173 		if (cv_timedwait(&un->un_disk_busy_cv, SD_MUTEX(un),
6174 		    wait_cmds_complete) == -1) {
6175 			/*
6176 			 * Undo the state changes made above. Everything
6177 			 * must go back to it's original value.
6178 			 */
6179 			Restore_state(un);
6180 			un->un_last_state = un->un_save_state;
6181 			/* Wake up any threads that might be waiting. */
6182 			cv_broadcast(&un->un_suspend_cv);
6183 			mutex_exit(SD_MUTEX(un));
6184 			SD_ERROR(SD_LOG_IO_PM, un,
6185 			    "sd_ddi_suspend: failed due to outstanding cmds\n");
6186 			SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: exiting\n");
6187 			return (DDI_FAILURE);
6188 		}
6189 	}
6190 
6191 	/*
6192 	 * Cancel SCSI watch thread and timeouts, if any are active
6193 	 */
6194 
6195 	if (SD_OK_TO_SUSPEND_SCSI_WATCHER(un)) {
6196 		opaque_t temp_token = un->un_swr_token;
6197 		mutex_exit(SD_MUTEX(un));
6198 		scsi_watch_suspend(temp_token);
6199 		mutex_enter(SD_MUTEX(un));
6200 	}
6201 
6202 	if (un->un_reset_throttle_timeid != NULL) {
6203 		timeout_id_t temp_id = un->un_reset_throttle_timeid;
6204 		un->un_reset_throttle_timeid = NULL;
6205 		mutex_exit(SD_MUTEX(un));
6206 		(void) untimeout(temp_id);
6207 		mutex_enter(SD_MUTEX(un));
6208 	}
6209 
6210 	if (un->un_dcvb_timeid != NULL) {
6211 		timeout_id_t temp_id = un->un_dcvb_timeid;
6212 		un->un_dcvb_timeid = NULL;
6213 		mutex_exit(SD_MUTEX(un));
6214 		(void) untimeout(temp_id);
6215 		mutex_enter(SD_MUTEX(un));
6216 	}
6217 
6218 	mutex_enter(&un->un_pm_mutex);
6219 	if (un->un_pm_timeid != NULL) {
6220 		timeout_id_t temp_id = un->un_pm_timeid;
6221 		un->un_pm_timeid = NULL;
6222 		mutex_exit(&un->un_pm_mutex);
6223 		mutex_exit(SD_MUTEX(un));
6224 		(void) untimeout(temp_id);
6225 		mutex_enter(SD_MUTEX(un));
6226 	} else {
6227 		mutex_exit(&un->un_pm_mutex);
6228 	}
6229 
6230 	if (un->un_rmw_msg_timeid != NULL) {
6231 		timeout_id_t temp_id = un->un_rmw_msg_timeid;
6232 		un->un_rmw_msg_timeid = NULL;
6233 		mutex_exit(SD_MUTEX(un));
6234 		(void) untimeout(temp_id);
6235 		mutex_enter(SD_MUTEX(un));
6236 	}
6237 
6238 	if (un->un_retry_timeid != NULL) {
6239 		timeout_id_t temp_id = un->un_retry_timeid;
6240 		un->un_retry_timeid = NULL;
6241 		mutex_exit(SD_MUTEX(un));
6242 		(void) untimeout(temp_id);
6243 		mutex_enter(SD_MUTEX(un));
6244 
6245 		if (un->un_retry_bp != NULL) {
6246 			un->un_retry_bp->av_forw = un->un_waitq_headp;
6247 			un->un_waitq_headp = un->un_retry_bp;
6248 			if (un->un_waitq_tailp == NULL) {
6249 				un->un_waitq_tailp = un->un_retry_bp;
6250 			}
6251 			un->un_retry_bp = NULL;
6252 			un->un_retry_statp = NULL;
6253 		}
6254 	}
6255 
6256 	if (un->un_direct_priority_timeid != NULL) {
6257 		timeout_id_t temp_id = un->un_direct_priority_timeid;
6258 		un->un_direct_priority_timeid = NULL;
6259 		mutex_exit(SD_MUTEX(un));
6260 		(void) untimeout(temp_id);
6261 		mutex_enter(SD_MUTEX(un));
6262 	}
6263 
6264 	if (un->un_f_is_fibre == TRUE) {
6265 		/*
6266 		 * Remove callbacks for insert and remove events
6267 		 */
6268 		if (un->un_insert_event != NULL) {
6269 			mutex_exit(SD_MUTEX(un));
6270 			(void) ddi_remove_event_handler(un->un_insert_cb_id);
6271 			mutex_enter(SD_MUTEX(un));
6272 			un->un_insert_event = NULL;
6273 		}
6274 
6275 		if (un->un_remove_event != NULL) {
6276 			mutex_exit(SD_MUTEX(un));
6277 			(void) ddi_remove_event_handler(un->un_remove_cb_id);
6278 			mutex_enter(SD_MUTEX(un));
6279 			un->un_remove_event = NULL;
6280 		}
6281 	}
6282 
6283 	mutex_exit(SD_MUTEX(un));
6284 
6285 	SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_suspend: exit\n");
6286 
6287 	return (DDI_SUCCESS);
6288 }
6289 
6290 
6291 /*
6292  *    Function: sd_ddi_resume
6293  *
6294  * Description: Performs system power-up operations..
6295  *
6296  * Return Code: DDI_SUCCESS
6297  *		DDI_FAILURE
6298  *
6299  *     Context: Kernel thread context
6300  */
6301 
6302 static int
6303 sd_ddi_resume(dev_info_t *devi)
6304 {
6305 	struct	sd_lun	*un;
6306 
6307 	un = ddi_get_soft_state(sd_state, ddi_get_instance(devi));
6308 	if (un == NULL) {
6309 		return (DDI_FAILURE);
6310 	}
6311 
6312 	SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_resume: entry\n");
6313 
6314 	mutex_enter(SD_MUTEX(un));
6315 	Restore_state(un);
6316 
6317 	/*
6318 	 * Restore the state which was saved to give the
6319 	 * the right state in un_last_state
6320 	 */
6321 	un->un_last_state = un->un_save_state;
6322 	/*
6323 	 * Note: throttle comes back at full.
6324 	 * Also note: this MUST be done before calling pm_raise_power
6325 	 * otherwise the system can get hung in biowait. The scenario where
6326 	 * this'll happen is under cpr suspend. Writing of the system
6327 	 * state goes through sddump, which writes 0 to un_throttle. If
6328 	 * writing the system state then fails, example if the partition is
6329 	 * too small, then cpr attempts a resume. If throttle isn't restored
6330 	 * from the saved value until after calling pm_raise_power then
6331 	 * cmds sent in sdpower are not transported and sd_send_scsi_cmd hangs
6332 	 * in biowait.
6333 	 */
6334 	un->un_throttle = un->un_saved_throttle;
6335 
6336 	/*
6337 	 * The chance of failure is very rare as the only command done in power
6338 	 * entry point is START command when you transition from 0->1 or
6339 	 * unknown->1. Put it to SPINDLE ON state irrespective of the state at
6340 	 * which suspend was done. Ignore the return value as the resume should
6341 	 * not be failed. In the case of removable media the media need not be
6342 	 * inserted and hence there is a chance that raise power will fail with
6343 	 * media not present.
6344 	 */
6345 	if (un->un_f_attach_spinup) {
6346 		mutex_exit(SD_MUTEX(un));
6347 		(void) pm_raise_power(SD_DEVINFO(un), 0,
6348 		    SD_PM_STATE_ACTIVE(un));
6349 		mutex_enter(SD_MUTEX(un));
6350 	}
6351 
6352 	/*
6353 	 * Don't broadcast to the suspend cv and therefore possibly
6354 	 * start I/O until after power has been restored.
6355 	 */
6356 	cv_broadcast(&un->un_suspend_cv);
6357 	cv_broadcast(&un->un_state_cv);
6358 
6359 	/* restart thread */
6360 	if (SD_OK_TO_RESUME_SCSI_WATCHER(un)) {
6361 		scsi_watch_resume(un->un_swr_token);
6362 	}
6363 
6364 #if (defined(__fibre))
6365 	if (un->un_f_is_fibre == TRUE) {
6366 		/*
6367 		 * Add callbacks for insert and remove events
6368 		 */
6369 		if (strcmp(un->un_node_type, DDI_NT_BLOCK_CHAN)) {
6370 			sd_init_event_callbacks(un);
6371 		}
6372 	}
6373 #endif
6374 
6375 	/*
6376 	 * Transport any pending commands to the target.
6377 	 *
6378 	 * If this is a low-activity device commands in queue will have to wait
6379 	 * until new commands come in, which may take awhile. Also, we
6380 	 * specifically don't check un_ncmds_in_transport because we know that
6381 	 * there really are no commands in progress after the unit was
6382 	 * suspended and we could have reached the throttle level, been
6383 	 * suspended, and have no new commands coming in for awhile. Highly
6384 	 * unlikely, but so is the low-activity disk scenario.
6385 	 */
6386 	ddi_xbuf_dispatch(un->un_xbuf_attr);
6387 
6388 	sd_start_cmds(un, NULL);
6389 	mutex_exit(SD_MUTEX(un));
6390 
6391 	SD_TRACE(SD_LOG_IO_PM, un, "sd_ddi_resume: exit\n");
6392 
6393 	return (DDI_SUCCESS);
6394 }
6395 
6396 
6397 /*
6398  *    Function: sd_pm_state_change
6399  *
6400  * Description: Change the driver power state.
6401  * 		Someone else is required to actually change the driver
6402  * 		power level.
6403  *
6404  *   Arguments: un - driver soft state (unit) structure
6405  *              level - the power level that is changed to
6406  *              flag - to decide how to change the power state
6407  *
6408  * Return Code: DDI_SUCCESS
6409  *
6410  *     Context: Kernel thread context
6411  */
6412 static int
6413 sd_pm_state_change(struct sd_lun *un, int level, int flag)
6414 {
6415 	ASSERT(un != NULL);
6416 	SD_TRACE(SD_LOG_POWER, un, "sd_pm_state_change: entry\n");
6417 
6418 	ASSERT(!mutex_owned(SD_MUTEX(un)));
6419 	mutex_enter(SD_MUTEX(un));
6420 
6421 	if (flag == SD_PM_STATE_ROLLBACK || SD_PM_IS_IO_CAPABLE(un, level)) {
6422 		un->un_power_level = level;
6423 		ASSERT(!mutex_owned(&un->un_pm_mutex));
6424 		mutex_enter(&un->un_pm_mutex);
6425 		if (SD_DEVICE_IS_IN_LOW_POWER(un)) {
6426 			un->un_pm_count++;
6427 			ASSERT(un->un_pm_count == 0);
6428 		}
6429 		mutex_exit(&un->un_pm_mutex);
6430 	} else {
6431 		/*
6432 		 * Exit if power management is not enabled for this device,
6433 		 * or if the device is being used by HA.
6434 		 */
6435 		if ((un->un_f_pm_is_enabled == FALSE) || (un->un_resvd_status &
6436 		    (SD_RESERVE | SD_WANT_RESERVE | SD_LOST_RESERVE))) {
6437 			mutex_exit(SD_MUTEX(un));
6438 			SD_TRACE(SD_LOG_POWER, un,
6439 			    "sd_pm_state_change: exiting\n");
6440 			return (DDI_FAILURE);
6441 		}
6442 
6443 		SD_INFO(SD_LOG_POWER, un, "sd_pm_state_change: "
6444 		    "un_ncmds_in_driver=%ld\n", un->un_ncmds_in_driver);
6445 
6446 		/*
6447 		 * See if the device is not busy, ie.:
6448 		 *    - we have no commands in the driver for this device
6449 		 *    - not waiting for resources
6450 		 */
6451 		if ((un->un_ncmds_in_driver == 0) &&
6452 		    (un->un_state != SD_STATE_RWAIT)) {
6453 			/*
6454 			 * The device is not busy, so it is OK to go to low
6455 			 * power state. Indicate low power, but rely on someone
6456 			 * else to actually change it.
6457 			 */
6458 			mutex_enter(&un->un_pm_mutex);
6459 			un->un_pm_count = -1;
6460 			mutex_exit(&un->un_pm_mutex);
6461 			un->un_power_level = level;
6462 		}
6463 	}
6464 
6465 	mutex_exit(SD_MUTEX(un));
6466 
6467 	SD_TRACE(SD_LOG_POWER, un, "sd_pm_state_change: exit\n");
6468 
6469 	return (DDI_SUCCESS);
6470 }
6471 
6472 
6473 /*
6474  *    Function: sd_pm_idletimeout_handler
6475  *
6476  * Description: A timer routine that's active only while a device is busy.
6477  *		The purpose is to extend slightly the pm framework's busy
6478  *		view of the device to prevent busy/idle thrashing for
6479  *		back-to-back commands. Do this by comparing the current time
6480  *		to the time at which the last command completed and when the
6481  *		difference is greater than sd_pm_idletime, call
6482  *		pm_idle_component. In addition to indicating idle to the pm
6483  *		framework, update the chain type to again use the internal pm
6484  *		layers of the driver.
6485  *
6486  *   Arguments: arg - driver soft state (unit) structure
6487  *
6488  *     Context: Executes in a timeout(9F) thread context
6489  */
6490 
6491 static void
6492 sd_pm_idletimeout_handler(void *arg)
6493 {
6494 	struct sd_lun *un = arg;
6495 
6496 	time_t	now;
6497 
6498 	mutex_enter(&sd_detach_mutex);
6499 	if (un->un_detach_count != 0) {
6500 		/* Abort if the instance is detaching */
6501 		mutex_exit(&sd_detach_mutex);
6502 		return;
6503 	}
6504 	mutex_exit(&sd_detach_mutex);
6505 
6506 	now = ddi_get_time();
6507 	/*
6508 	 * Grab both mutexes, in the proper order, since we're accessing
6509 	 * both PM and softstate variables.
6510 	 */
6511 	mutex_enter(SD_MUTEX(un));
6512 	mutex_enter(&un->un_pm_mutex);
6513 	if (((now - un->un_pm_idle_time) > sd_pm_idletime) &&
6514 	    (un->un_ncmds_in_driver == 0) && (un->un_pm_count == 0)) {
6515 		/*
6516 		 * Update the chain types.
6517 		 * This takes affect on the next new command received.
6518 		 */
6519 		if (un->un_f_non_devbsize_supported) {
6520 			un->un_buf_chain_type = SD_CHAIN_INFO_RMMEDIA;
6521 		} else {
6522 			un->un_buf_chain_type = SD_CHAIN_INFO_DISK;
6523 		}
6524 		un->un_uscsi_chain_type = SD_CHAIN_INFO_USCSI_CMD;
6525 
6526 		SD_TRACE(SD_LOG_IO_PM, un,
6527 		    "sd_pm_idletimeout_handler: idling device\n");
6528 		(void) pm_idle_component(SD_DEVINFO(un), 0);
6529 		un->un_pm_idle_timeid = NULL;
6530 	} else {
6531 		un->un_pm_idle_timeid =
6532 		    timeout(sd_pm_idletimeout_handler, un,
6533 		    (drv_usectohz((clock_t)300000))); /* 300 ms. */
6534 	}
6535 	mutex_exit(&un->un_pm_mutex);
6536 	mutex_exit(SD_MUTEX(un));
6537 }
6538 
6539 
6540 /*
6541  *    Function: sd_pm_timeout_handler
6542  *
6543  * Description: Callback to tell framework we are idle.
6544  *
6545  *     Context: timeout(9f) thread context.
6546  */
6547 
6548 static void
6549 sd_pm_timeout_handler(void *arg)
6550 {
6551 	struct sd_lun *un = arg;
6552 
6553 	(void) pm_idle_component(SD_DEVINFO(un), 0);
6554 	mutex_enter(&un->un_pm_mutex);
6555 	un->un_pm_timeid = NULL;
6556 	mutex_exit(&un->un_pm_mutex);
6557 }
6558 
6559 
6560 /*
6561  *    Function: sdpower
6562  *
6563  * Description: PM entry point.
6564  *
6565  * Return Code: DDI_SUCCESS
6566  *		DDI_FAILURE
6567  *
6568  *     Context: Kernel thread context
6569  */
6570 
6571 static int
6572 sdpower(dev_info_t *devi, int component, int level)
6573 {
6574 	struct sd_lun	*un;
6575 	int		instance;
6576 	int		rval = DDI_SUCCESS;
6577 	uint_t		i, log_page_size, maxcycles, ncycles;
6578 	uchar_t		*log_page_data;
6579 	int		log_sense_page;
6580 	int		medium_present;
6581 	time_t		intvlp;
6582 	struct pm_trans_data	sd_pm_tran_data;
6583 	uchar_t		save_state;
6584 	int		sval;
6585 	uchar_t		state_before_pm;
6586 	int		got_semaphore_here;
6587 	sd_ssc_t	*ssc;
6588 	int	last_power_level;
6589 
6590 	instance = ddi_get_instance(devi);
6591 
6592 	if (((un = ddi_get_soft_state(sd_state, instance)) == NULL) ||
6593 	    !SD_PM_IS_LEVEL_VALID(un, level) || component != 0) {
6594 		return (DDI_FAILURE);
6595 	}
6596 
6597 	ssc = sd_ssc_init(un);
6598 
6599 	SD_TRACE(SD_LOG_IO_PM, un, "sdpower: entry, level = %d\n", level);
6600 
6601 	/*
6602 	 * Must synchronize power down with close.
6603 	 * Attempt to decrement/acquire the open/close semaphore,
6604 	 * but do NOT wait on it. If it's not greater than zero,
6605 	 * ie. it can't be decremented without waiting, then
6606 	 * someone else, either open or close, already has it
6607 	 * and the try returns 0. Use that knowledge here to determine
6608 	 * if it's OK to change the device power level.
6609 	 * Also, only increment it on exit if it was decremented, ie. gotten,
6610 	 * here.
6611 	 */
6612 	got_semaphore_here = sema_tryp(&un->un_semoclose);
6613 
6614 	mutex_enter(SD_MUTEX(un));
6615 
6616 	SD_INFO(SD_LOG_POWER, un, "sdpower: un_ncmds_in_driver = %ld\n",
6617 	    un->un_ncmds_in_driver);
6618 
6619 	/*
6620 	 * If un_ncmds_in_driver is non-zero it indicates commands are
6621 	 * already being processed in the driver, or if the semaphore was
6622 	 * not gotten here it indicates an open or close is being processed.
6623 	 * At the same time somebody is requesting to go to a lower power
6624 	 * that can't perform I/O, which can't happen, therefore we need to
6625 	 * return failure.
6626 	 */
6627 	if ((!SD_PM_IS_IO_CAPABLE(un, level)) &&
6628 	    ((un->un_ncmds_in_driver != 0) || (got_semaphore_here == 0))) {
6629 		mutex_exit(SD_MUTEX(un));
6630 
6631 		if (got_semaphore_here != 0) {
6632 			sema_v(&un->un_semoclose);
6633 		}
6634 		SD_TRACE(SD_LOG_IO_PM, un,
6635 		    "sdpower: exit, device has queued cmds.\n");
6636 
6637 		goto sdpower_failed;
6638 	}
6639 
6640 	/*
6641 	 * if it is OFFLINE that means the disk is completely dead
6642 	 * in our case we have to put the disk in on or off by sending commands
6643 	 * Of course that will fail anyway so return back here.
6644 	 *
6645 	 * Power changes to a device that's OFFLINE or SUSPENDED
6646 	 * are not allowed.
6647 	 */
6648 	if ((un->un_state == SD_STATE_OFFLINE) ||
6649 	    (un->un_state == SD_STATE_SUSPENDED)) {
6650 		mutex_exit(SD_MUTEX(un));
6651 
6652 		if (got_semaphore_here != 0) {
6653 			sema_v(&un->un_semoclose);
6654 		}
6655 		SD_TRACE(SD_LOG_IO_PM, un,
6656 		    "sdpower: exit, device is off-line.\n");
6657 
6658 		goto sdpower_failed;
6659 	}
6660 
6661 	/*
6662 	 * Change the device's state to indicate it's power level
6663 	 * is being changed. Do this to prevent a power off in the
6664 	 * middle of commands, which is especially bad on devices
6665 	 * that are really powered off instead of just spun down.
6666 	 */
6667 	state_before_pm = un->un_state;
6668 	un->un_state = SD_STATE_PM_CHANGING;
6669 
6670 	mutex_exit(SD_MUTEX(un));
6671 
6672 	/*
6673 	 * If log sense command is not supported, bypass the
6674 	 * following checking, otherwise, check the log sense
6675 	 * information for this device.
6676 	 */
6677 	if (SD_PM_STOP_MOTOR_NEEDED(un, level) &&
6678 	    un->un_f_log_sense_supported) {
6679 		/*
6680 		 * Get the log sense information to understand whether the
6681 		 * the powercycle counts have gone beyond the threshhold.
6682 		 */
6683 		log_page_size = START_STOP_CYCLE_COUNTER_PAGE_SIZE;
6684 		log_page_data = kmem_zalloc(log_page_size, KM_SLEEP);
6685 
6686 		mutex_enter(SD_MUTEX(un));
6687 		log_sense_page = un->un_start_stop_cycle_page;
6688 		mutex_exit(SD_MUTEX(un));
6689 
6690 		rval = sd_send_scsi_LOG_SENSE(ssc, log_page_data,
6691 		    log_page_size, log_sense_page, 0x01, 0, SD_PATH_DIRECT);
6692 
6693 		if (rval != 0) {
6694 			if (rval == EIO)
6695 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
6696 			else
6697 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
6698 		}
6699 
6700 #ifdef	SDDEBUG
6701 		if (sd_force_pm_supported) {
6702 			/* Force a successful result */
6703 			rval = 0;
6704 		}
6705 #endif
6706 		if (rval != 0) {
6707 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
6708 			    "Log Sense Failed\n");
6709 
6710 			kmem_free(log_page_data, log_page_size);
6711 			/* Cannot support power management on those drives */
6712 
6713 			if (got_semaphore_here != 0) {
6714 				sema_v(&un->un_semoclose);
6715 			}
6716 			/*
6717 			 * On exit put the state back to it's original value
6718 			 * and broadcast to anyone waiting for the power
6719 			 * change completion.
6720 			 */
6721 			mutex_enter(SD_MUTEX(un));
6722 			un->un_state = state_before_pm;
6723 			cv_broadcast(&un->un_suspend_cv);
6724 			mutex_exit(SD_MUTEX(un));
6725 			SD_TRACE(SD_LOG_IO_PM, un,
6726 			    "sdpower: exit, Log Sense Failed.\n");
6727 
6728 			goto sdpower_failed;
6729 		}
6730 
6731 		/*
6732 		 * From the page data - Convert the essential information to
6733 		 * pm_trans_data
6734 		 */
6735 		maxcycles =
6736 		    (log_page_data[0x1c] << 24) | (log_page_data[0x1d] << 16) |
6737 		    (log_page_data[0x1E] << 8)  | log_page_data[0x1F];
6738 
6739 		ncycles =
6740 		    (log_page_data[0x24] << 24) | (log_page_data[0x25] << 16) |
6741 		    (log_page_data[0x26] << 8)  | log_page_data[0x27];
6742 
6743 		if (un->un_f_pm_log_sense_smart) {
6744 			sd_pm_tran_data.un.smart_count.allowed = maxcycles;
6745 			sd_pm_tran_data.un.smart_count.consumed = ncycles;
6746 			sd_pm_tran_data.un.smart_count.flag = 0;
6747 			sd_pm_tran_data.format = DC_SMART_FORMAT;
6748 		} else {
6749 			sd_pm_tran_data.un.scsi_cycles.lifemax = maxcycles;
6750 			sd_pm_tran_data.un.scsi_cycles.ncycles = ncycles;
6751 			for (i = 0; i < DC_SCSI_MFR_LEN; i++) {
6752 				sd_pm_tran_data.un.scsi_cycles.svc_date[i] =
6753 				    log_page_data[8+i];
6754 			}
6755 			sd_pm_tran_data.un.scsi_cycles.flag = 0;
6756 			sd_pm_tran_data.format = DC_SCSI_FORMAT;
6757 		}
6758 
6759 		kmem_free(log_page_data, log_page_size);
6760 
6761 		/*
6762 		 * Call pm_trans_check routine to get the Ok from
6763 		 * the global policy
6764 		 */
6765 		rval = pm_trans_check(&sd_pm_tran_data, &intvlp);
6766 #ifdef	SDDEBUG
6767 		if (sd_force_pm_supported) {
6768 			/* Force a successful result */
6769 			rval = 1;
6770 		}
6771 #endif
6772 		switch (rval) {
6773 		case 0:
6774 			/*
6775 			 * Not Ok to Power cycle or error in parameters passed
6776 			 * Would have given the advised time to consider power
6777 			 * cycle. Based on the new intvlp parameter we are
6778 			 * supposed to pretend we are busy so that pm framework
6779 			 * will never call our power entry point. Because of
6780 			 * that install a timeout handler and wait for the
6781 			 * recommended time to elapse so that power management
6782 			 * can be effective again.
6783 			 *
6784 			 * To effect this behavior, call pm_busy_component to
6785 			 * indicate to the framework this device is busy.
6786 			 * By not adjusting un_pm_count the rest of PM in
6787 			 * the driver will function normally, and independent
6788 			 * of this but because the framework is told the device
6789 			 * is busy it won't attempt powering down until it gets
6790 			 * a matching idle. The timeout handler sends this.
6791 			 * Note: sd_pm_entry can't be called here to do this
6792 			 * because sdpower may have been called as a result
6793 			 * of a call to pm_raise_power from within sd_pm_entry.
6794 			 *
6795 			 * If a timeout handler is already active then
6796 			 * don't install another.
6797 			 */
6798 			mutex_enter(&un->un_pm_mutex);
6799 			if (un->un_pm_timeid == NULL) {
6800 				un->un_pm_timeid =
6801 				    timeout(sd_pm_timeout_handler,
6802 				    un, intvlp * drv_usectohz(1000000));
6803 				mutex_exit(&un->un_pm_mutex);
6804 				(void) pm_busy_component(SD_DEVINFO(un), 0);
6805 			} else {
6806 				mutex_exit(&un->un_pm_mutex);
6807 			}
6808 			if (got_semaphore_here != 0) {
6809 				sema_v(&un->un_semoclose);
6810 			}
6811 			/*
6812 			 * On exit put the state back to it's original value
6813 			 * and broadcast to anyone waiting for the power
6814 			 * change completion.
6815 			 */
6816 			mutex_enter(SD_MUTEX(un));
6817 			un->un_state = state_before_pm;
6818 			cv_broadcast(&un->un_suspend_cv);
6819 			mutex_exit(SD_MUTEX(un));
6820 
6821 			SD_TRACE(SD_LOG_IO_PM, un, "sdpower: exit, "
6822 			    "trans check Failed, not ok to power cycle.\n");
6823 
6824 			goto sdpower_failed;
6825 		case -1:
6826 			if (got_semaphore_here != 0) {
6827 				sema_v(&un->un_semoclose);
6828 			}
6829 			/*
6830 			 * On exit put the state back to it's original value
6831 			 * and broadcast to anyone waiting for the power
6832 			 * change completion.
6833 			 */
6834 			mutex_enter(SD_MUTEX(un));
6835 			un->un_state = state_before_pm;
6836 			cv_broadcast(&un->un_suspend_cv);
6837 			mutex_exit(SD_MUTEX(un));
6838 			SD_TRACE(SD_LOG_IO_PM, un,
6839 			    "sdpower: exit, trans check command Failed.\n");
6840 
6841 			goto sdpower_failed;
6842 		}
6843 	}
6844 
6845 	if (!SD_PM_IS_IO_CAPABLE(un, level)) {
6846 		/*
6847 		 * Save the last state... if the STOP FAILS we need it
6848 		 * for restoring
6849 		 */
6850 		mutex_enter(SD_MUTEX(un));
6851 		save_state = un->un_last_state;
6852 		last_power_level = un->un_power_level;
6853 		/*
6854 		 * There must not be any cmds. getting processed
6855 		 * in the driver when we get here. Power to the
6856 		 * device is potentially going off.
6857 		 */
6858 		ASSERT(un->un_ncmds_in_driver == 0);
6859 		mutex_exit(SD_MUTEX(un));
6860 
6861 		/*
6862 		 * For now PM suspend the device completely before spindle is
6863 		 * turned off
6864 		 */
6865 		if ((rval = sd_pm_state_change(un, level, SD_PM_STATE_CHANGE))
6866 		    == DDI_FAILURE) {
6867 			if (got_semaphore_here != 0) {
6868 				sema_v(&un->un_semoclose);
6869 			}
6870 			/*
6871 			 * On exit put the state back to it's original value
6872 			 * and broadcast to anyone waiting for the power
6873 			 * change completion.
6874 			 */
6875 			mutex_enter(SD_MUTEX(un));
6876 			un->un_state = state_before_pm;
6877 			un->un_power_level = last_power_level;
6878 			cv_broadcast(&un->un_suspend_cv);
6879 			mutex_exit(SD_MUTEX(un));
6880 			SD_TRACE(SD_LOG_IO_PM, un,
6881 			    "sdpower: exit, PM suspend Failed.\n");
6882 
6883 			goto sdpower_failed;
6884 		}
6885 	}
6886 
6887 	/*
6888 	 * The transition from SPINDLE_OFF to SPINDLE_ON can happen in open,
6889 	 * close, or strategy. Dump no long uses this routine, it uses it's
6890 	 * own code so it can be done in polled mode.
6891 	 */
6892 
6893 	medium_present = TRUE;
6894 
6895 	/*
6896 	 * When powering up, issue a TUR in case the device is at unit
6897 	 * attention.  Don't do retries. Bypass the PM layer, otherwise
6898 	 * a deadlock on un_pm_busy_cv will occur.
6899 	 */
6900 	if (SD_PM_IS_IO_CAPABLE(un, level)) {
6901 		sval = sd_send_scsi_TEST_UNIT_READY(ssc,
6902 		    SD_DONT_RETRY_TUR | SD_BYPASS_PM);
6903 		if (sval != 0)
6904 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
6905 	}
6906 
6907 	if (un->un_f_power_condition_supported) {
6908 		char *pm_condition_name[] = {"STOPPED", "STANDBY",
6909 		    "IDLE", "ACTIVE"};
6910 		SD_TRACE(SD_LOG_IO_PM, un,
6911 		    "sdpower: sending \'%s\' power condition",
6912 		    pm_condition_name[level]);
6913 		sval = sd_send_scsi_START_STOP_UNIT(ssc, SD_POWER_CONDITION,
6914 		    sd_pl2pc[level], SD_PATH_DIRECT);
6915 	} else {
6916 		SD_TRACE(SD_LOG_IO_PM, un, "sdpower: sending \'%s\' unit\n",
6917 		    ((level == SD_SPINDLE_ON) ? "START" : "STOP"));
6918 		sval = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
6919 		    ((level == SD_SPINDLE_ON) ? SD_TARGET_START :
6920 		    SD_TARGET_STOP), SD_PATH_DIRECT);
6921 	}
6922 	if (sval != 0) {
6923 		if (sval == EIO)
6924 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
6925 		else
6926 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
6927 	}
6928 
6929 	/* Command failed, check for media present. */
6930 	if ((sval == ENXIO) && un->un_f_has_removable_media) {
6931 		medium_present = FALSE;
6932 	}
6933 
6934 	/*
6935 	 * The conditions of interest here are:
6936 	 *   if a spindle off with media present fails,
6937 	 *	then restore the state and return an error.
6938 	 *   else if a spindle on fails,
6939 	 *	then return an error (there's no state to restore).
6940 	 * In all other cases we setup for the new state
6941 	 * and return success.
6942 	 */
6943 	if (!SD_PM_IS_IO_CAPABLE(un, level)) {
6944 		if ((medium_present == TRUE) && (sval != 0)) {
6945 			/* The stop command from above failed */
6946 			rval = DDI_FAILURE;
6947 			/*
6948 			 * The stop command failed, and we have media
6949 			 * present. Put the level back by calling the
6950 			 * sd_pm_resume() and set the state back to
6951 			 * it's previous value.
6952 			 */
6953 			(void) sd_pm_state_change(un, last_power_level,
6954 			    SD_PM_STATE_ROLLBACK);
6955 			mutex_enter(SD_MUTEX(un));
6956 			un->un_last_state = save_state;
6957 			mutex_exit(SD_MUTEX(un));
6958 		} else if (un->un_f_monitor_media_state) {
6959 			/*
6960 			 * The stop command from above succeeded.
6961 			 * Terminate watch thread in case of removable media
6962 			 * devices going into low power state. This is as per
6963 			 * the requirements of pm framework, otherwise commands
6964 			 * will be generated for the device (through watch
6965 			 * thread), even when the device is in low power state.
6966 			 */
6967 			mutex_enter(SD_MUTEX(un));
6968 			un->un_f_watcht_stopped = FALSE;
6969 			if (un->un_swr_token != NULL) {
6970 				opaque_t temp_token = un->un_swr_token;
6971 				un->un_f_watcht_stopped = TRUE;
6972 				un->un_swr_token = NULL;
6973 				mutex_exit(SD_MUTEX(un));
6974 				(void) scsi_watch_request_terminate(temp_token,
6975 				    SCSI_WATCH_TERMINATE_ALL_WAIT);
6976 			} else {
6977 				mutex_exit(SD_MUTEX(un));
6978 			}
6979 		}
6980 	} else {
6981 		/*
6982 		 * The level requested is I/O capable.
6983 		 * Legacy behavior: return success on a failed spinup
6984 		 * if there is no media in the drive.
6985 		 * Do this by looking at medium_present here.
6986 		 */
6987 		if ((sval != 0) && medium_present) {
6988 			/* The start command from above failed */
6989 			rval = DDI_FAILURE;
6990 		} else {
6991 			/*
6992 			 * The start command from above succeeded
6993 			 * PM resume the devices now that we have
6994 			 * started the disks
6995 			 */
6996 			(void) sd_pm_state_change(un, level,
6997 			    SD_PM_STATE_CHANGE);
6998 
6999 			/*
7000 			 * Resume the watch thread since it was suspended
7001 			 * when the device went into low power mode.
7002 			 */
7003 			if (un->un_f_monitor_media_state) {
7004 				mutex_enter(SD_MUTEX(un));
7005 				if (un->un_f_watcht_stopped == TRUE) {
7006 					opaque_t temp_token;
7007 
7008 					un->un_f_watcht_stopped = FALSE;
7009 					mutex_exit(SD_MUTEX(un));
7010 					temp_token =
7011 					    sd_watch_request_submit(un);
7012 					mutex_enter(SD_MUTEX(un));
7013 					un->un_swr_token = temp_token;
7014 				}
7015 				mutex_exit(SD_MUTEX(un));
7016 			}
7017 		}
7018 	}
7019 
7020 	if (got_semaphore_here != 0) {
7021 		sema_v(&un->un_semoclose);
7022 	}
7023 	/*
7024 	 * On exit put the state back to it's original value
7025 	 * and broadcast to anyone waiting for the power
7026 	 * change completion.
7027 	 */
7028 	mutex_enter(SD_MUTEX(un));
7029 	un->un_state = state_before_pm;
7030 	cv_broadcast(&un->un_suspend_cv);
7031 	mutex_exit(SD_MUTEX(un));
7032 
7033 	SD_TRACE(SD_LOG_IO_PM, un, "sdpower: exit, status = 0x%x\n", rval);
7034 
7035 	sd_ssc_fini(ssc);
7036 	return (rval);
7037 
7038 sdpower_failed:
7039 
7040 	sd_ssc_fini(ssc);
7041 	return (DDI_FAILURE);
7042 }
7043 
7044 
7045 
7046 /*
7047  *    Function: sdattach
7048  *
7049  * Description: Driver's attach(9e) entry point function.
7050  *
7051  *   Arguments: devi - opaque device info handle
7052  *		cmd  - attach  type
7053  *
7054  * Return Code: DDI_SUCCESS
7055  *		DDI_FAILURE
7056  *
7057  *     Context: Kernel thread context
7058  */
7059 
7060 static int
7061 sdattach(dev_info_t *devi, ddi_attach_cmd_t cmd)
7062 {
7063 	switch (cmd) {
7064 	case DDI_ATTACH:
7065 		return (sd_unit_attach(devi));
7066 	case DDI_RESUME:
7067 		return (sd_ddi_resume(devi));
7068 	default:
7069 		break;
7070 	}
7071 	return (DDI_FAILURE);
7072 }
7073 
7074 
7075 /*
7076  *    Function: sddetach
7077  *
7078  * Description: Driver's detach(9E) entry point function.
7079  *
7080  *   Arguments: devi - opaque device info handle
7081  *		cmd  - detach  type
7082  *
7083  * Return Code: DDI_SUCCESS
7084  *		DDI_FAILURE
7085  *
7086  *     Context: Kernel thread context
7087  */
7088 
7089 static int
7090 sddetach(dev_info_t *devi, ddi_detach_cmd_t cmd)
7091 {
7092 	switch (cmd) {
7093 	case DDI_DETACH:
7094 		return (sd_unit_detach(devi));
7095 	case DDI_SUSPEND:
7096 		return (sd_ddi_suspend(devi));
7097 	default:
7098 		break;
7099 	}
7100 	return (DDI_FAILURE);
7101 }
7102 
7103 
7104 /*
7105  *     Function: sd_sync_with_callback
7106  *
7107  *  Description: Prevents sd_unit_attach or sd_unit_detach from freeing the soft
7108  *		 state while the callback routine is active.
7109  *
7110  *    Arguments: un: softstate structure for the instance
7111  *
7112  *	Context: Kernel thread context
7113  */
7114 
7115 static void
7116 sd_sync_with_callback(struct sd_lun *un)
7117 {
7118 	ASSERT(un != NULL);
7119 
7120 	mutex_enter(SD_MUTEX(un));
7121 
7122 	ASSERT(un->un_in_callback >= 0);
7123 
7124 	while (un->un_in_callback > 0) {
7125 		mutex_exit(SD_MUTEX(un));
7126 		delay(2);
7127 		mutex_enter(SD_MUTEX(un));
7128 	}
7129 
7130 	mutex_exit(SD_MUTEX(un));
7131 }
7132 
7133 /*
7134  *    Function: sd_unit_attach
7135  *
7136  * Description: Performs DDI_ATTACH processing for sdattach(). Allocates
7137  *		the soft state structure for the device and performs
7138  *		all necessary structure and device initializations.
7139  *
7140  *   Arguments: devi: the system's dev_info_t for the device.
7141  *
7142  * Return Code: DDI_SUCCESS if attach is successful.
7143  *		DDI_FAILURE if any part of the attach fails.
7144  *
7145  *     Context: Called at attach(9e) time for the DDI_ATTACH flag.
7146  *		Kernel thread context only.  Can sleep.
7147  */
7148 
7149 static int
7150 sd_unit_attach(dev_info_t *devi)
7151 {
7152 	struct	scsi_device	*devp;
7153 	struct	sd_lun		*un;
7154 	char			*variantp;
7155 	char			name_str[48];
7156 	int	reservation_flag = SD_TARGET_IS_UNRESERVED;
7157 	int	instance;
7158 	int	rval;
7159 	int	wc_enabled;
7160 	int	tgt;
7161 	uint64_t	capacity;
7162 	uint_t		lbasize = 0;
7163 	dev_info_t	*pdip = ddi_get_parent(devi);
7164 	int		offbyone = 0;
7165 	int		geom_label_valid = 0;
7166 	sd_ssc_t	*ssc;
7167 	int		status;
7168 	struct sd_fm_internal	*sfip = NULL;
7169 	int		max_xfer_size;
7170 
7171 	/*
7172 	 * Retrieve the target driver's private data area. This was set
7173 	 * up by the HBA.
7174 	 */
7175 	devp = ddi_get_driver_private(devi);
7176 
7177 	/*
7178 	 * Retrieve the target ID of the device.
7179 	 */
7180 	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, devi, DDI_PROP_DONTPASS,
7181 	    SCSI_ADDR_PROP_TARGET, -1);
7182 
7183 	/*
7184 	 * Since we have no idea what state things were left in by the last
7185 	 * user of the device, set up some 'default' settings, ie. turn 'em
7186 	 * off. The scsi_ifsetcap calls force re-negotiations with the drive.
7187 	 * Do this before the scsi_probe, which sends an inquiry.
7188 	 * This is a fix for bug (4430280).
7189 	 * Of special importance is wide-xfer. The drive could have been left
7190 	 * in wide transfer mode by the last driver to communicate with it,
7191 	 * this includes us. If that's the case, and if the following is not
7192 	 * setup properly or we don't re-negotiate with the drive prior to
7193 	 * transferring data to/from the drive, it causes bus parity errors,
7194 	 * data overruns, and unexpected interrupts. This first occurred when
7195 	 * the fix for bug (4378686) was made.
7196 	 */
7197 	(void) scsi_ifsetcap(&devp->sd_address, "lun-reset", 0, 1);
7198 	(void) scsi_ifsetcap(&devp->sd_address, "wide-xfer", 0, 1);
7199 	(void) scsi_ifsetcap(&devp->sd_address, "auto-rqsense", 0, 1);
7200 
7201 	/*
7202 	 * Currently, scsi_ifsetcap sets tagged-qing capability for all LUNs
7203 	 * on a target. Setting it per lun instance actually sets the
7204 	 * capability of this target, which affects those luns already
7205 	 * attached on the same target. So during attach, we can only disable
7206 	 * this capability only when no other lun has been attached on this
7207 	 * target. By doing this, we assume a target has the same tagged-qing
7208 	 * capability for every lun. The condition can be removed when HBA
7209 	 * is changed to support per lun based tagged-qing capability.
7210 	 */
7211 	if (sd_scsi_get_target_lun_count(pdip, tgt) < 1) {
7212 		(void) scsi_ifsetcap(&devp->sd_address, "tagged-qing", 0, 1);
7213 	}
7214 
7215 	/*
7216 	 * Use scsi_probe() to issue an INQUIRY command to the device.
7217 	 * This call will allocate and fill in the scsi_inquiry structure
7218 	 * and point the sd_inq member of the scsi_device structure to it.
7219 	 * If the attach succeeds, then this memory will not be de-allocated
7220 	 * (via scsi_unprobe()) until the instance is detached.
7221 	 */
7222 	if (scsi_probe(devp, SLEEP_FUNC) != SCSIPROBE_EXISTS) {
7223 		goto probe_failed;
7224 	}
7225 
7226 	/*
7227 	 * Check the device type as specified in the inquiry data and
7228 	 * claim it if it is of a type that we support.
7229 	 */
7230 	switch (devp->sd_inq->inq_dtype) {
7231 	case DTYPE_DIRECT:
7232 		break;
7233 	case DTYPE_RODIRECT:
7234 		break;
7235 	case DTYPE_OPTICAL:
7236 		break;
7237 	case DTYPE_NOTPRESENT:
7238 	default:
7239 		/* Unsupported device type; fail the attach. */
7240 		goto probe_failed;
7241 	}
7242 
7243 	/*
7244 	 * Allocate the soft state structure for this unit.
7245 	 *
7246 	 * We rely upon this memory being set to all zeroes by
7247 	 * ddi_soft_state_zalloc().  We assume that any member of the
7248 	 * soft state structure that is not explicitly initialized by
7249 	 * this routine will have a value of zero.
7250 	 */
7251 	instance = ddi_get_instance(devp->sd_dev);
7252 #ifndef XPV_HVM_DRIVER
7253 	if (ddi_soft_state_zalloc(sd_state, instance) != DDI_SUCCESS) {
7254 		goto probe_failed;
7255 	}
7256 #endif /* !XPV_HVM_DRIVER */
7257 
7258 	/*
7259 	 * Retrieve a pointer to the newly-allocated soft state.
7260 	 *
7261 	 * This should NEVER fail if the ddi_soft_state_zalloc() call above
7262 	 * was successful, unless something has gone horribly wrong and the
7263 	 * ddi's soft state internals are corrupt (in which case it is
7264 	 * probably better to halt here than just fail the attach....)
7265 	 */
7266 	if ((un = ddi_get_soft_state(sd_state, instance)) == NULL) {
7267 		panic("sd_unit_attach: NULL soft state on instance:0x%x",
7268 		    instance);
7269 		/*NOTREACHED*/
7270 	}
7271 
7272 	/*
7273 	 * Link the back ptr of the driver soft state to the scsi_device
7274 	 * struct for this lun.
7275 	 * Save a pointer to the softstate in the driver-private area of
7276 	 * the scsi_device struct.
7277 	 * Note: We cannot call SD_INFO, SD_TRACE, SD_ERROR, or SD_DIAG until
7278 	 * we first set un->un_sd below.
7279 	 */
7280 	un->un_sd = devp;
7281 	devp->sd_private = (opaque_t)un;
7282 
7283 	/*
7284 	 * The following must be after devp is stored in the soft state struct.
7285 	 */
7286 #ifdef SDDEBUG
7287 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7288 	    "%s_unit_attach: un:0x%p instance:%d\n",
7289 	    ddi_driver_name(devi), un, instance);
7290 #endif
7291 
7292 	/*
7293 	 * Set up the device type and node type (for the minor nodes).
7294 	 * By default we assume that the device can at least support the
7295 	 * Common Command Set. Call it a CD-ROM if it reports itself
7296 	 * as a RODIRECT device.
7297 	 */
7298 	switch (devp->sd_inq->inq_dtype) {
7299 	case DTYPE_RODIRECT:
7300 		un->un_node_type = DDI_NT_CD_CHAN;
7301 		un->un_ctype	 = CTYPE_CDROM;
7302 		break;
7303 	case DTYPE_OPTICAL:
7304 		un->un_node_type = DDI_NT_BLOCK_CHAN;
7305 		un->un_ctype	 = CTYPE_ROD;
7306 		break;
7307 	default:
7308 		un->un_node_type = DDI_NT_BLOCK_CHAN;
7309 		un->un_ctype	 = CTYPE_CCS;
7310 		break;
7311 	}
7312 
7313 	/*
7314 	 * Try to read the interconnect type from the HBA.
7315 	 *
7316 	 * Note: This driver is currently compiled as two binaries, a parallel
7317 	 * scsi version (sd) and a fibre channel version (ssd). All functional
7318 	 * differences are determined at compile time. In the future a single
7319 	 * binary will be provided and the interconnect type will be used to
7320 	 * differentiate between fibre and parallel scsi behaviors. At that time
7321 	 * it will be necessary for all fibre channel HBAs to support this
7322 	 * property.
7323 	 *
7324 	 * set un_f_is_fiber to TRUE ( default fiber )
7325 	 */
7326 	un->un_f_is_fibre = TRUE;
7327 	switch (scsi_ifgetcap(SD_ADDRESS(un), "interconnect-type", -1)) {
7328 	case INTERCONNECT_SSA:
7329 		un->un_interconnect_type = SD_INTERCONNECT_SSA;
7330 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7331 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_SSA\n", un);
7332 		break;
7333 	case INTERCONNECT_PARALLEL:
7334 		un->un_f_is_fibre = FALSE;
7335 		un->un_interconnect_type = SD_INTERCONNECT_PARALLEL;
7336 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7337 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_PARALLEL\n", un);
7338 		break;
7339 	case INTERCONNECT_SAS:
7340 		un->un_f_is_fibre = FALSE;
7341 		un->un_interconnect_type = SD_INTERCONNECT_SAS;
7342 		un->un_node_type = DDI_NT_BLOCK_SAS;
7343 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7344 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_SAS\n", un);
7345 		break;
7346 	case INTERCONNECT_SATA:
7347 		un->un_f_is_fibre = FALSE;
7348 		un->un_interconnect_type = SD_INTERCONNECT_SATA;
7349 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7350 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_SATA\n", un);
7351 		break;
7352 	case INTERCONNECT_FIBRE:
7353 		un->un_interconnect_type = SD_INTERCONNECT_FIBRE;
7354 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7355 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_FIBRE\n", un);
7356 		break;
7357 	case INTERCONNECT_FABRIC:
7358 		un->un_interconnect_type = SD_INTERCONNECT_FABRIC;
7359 		un->un_node_type = DDI_NT_BLOCK_FABRIC;
7360 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7361 		    "sd_unit_attach: un:0x%p SD_INTERCONNECT_FABRIC\n", un);
7362 		break;
7363 	default:
7364 #ifdef SD_DEFAULT_INTERCONNECT_TYPE
7365 		/*
7366 		 * The HBA does not support the "interconnect-type" property
7367 		 * (or did not provide a recognized type).
7368 		 *
7369 		 * Note: This will be obsoleted when a single fibre channel
7370 		 * and parallel scsi driver is delivered. In the meantime the
7371 		 * interconnect type will be set to the platform default.If that
7372 		 * type is not parallel SCSI, it means that we should be
7373 		 * assuming "ssd" semantics. However, here this also means that
7374 		 * the FC HBA is not supporting the "interconnect-type" property
7375 		 * like we expect it to, so log this occurrence.
7376 		 */
7377 		un->un_interconnect_type = SD_DEFAULT_INTERCONNECT_TYPE;
7378 		if (!SD_IS_PARALLEL_SCSI(un)) {
7379 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7380 			    "sd_unit_attach: un:0x%p Assuming "
7381 			    "INTERCONNECT_FIBRE\n", un);
7382 		} else {
7383 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7384 			    "sd_unit_attach: un:0x%p Assuming "
7385 			    "INTERCONNECT_PARALLEL\n", un);
7386 			un->un_f_is_fibre = FALSE;
7387 		}
7388 #else
7389 		/*
7390 		 * Note: This source will be implemented when a single fibre
7391 		 * channel and parallel scsi driver is delivered. The default
7392 		 * will be to assume that if a device does not support the
7393 		 * "interconnect-type" property it is a parallel SCSI HBA and
7394 		 * we will set the interconnect type for parallel scsi.
7395 		 */
7396 		un->un_interconnect_type = SD_INTERCONNECT_PARALLEL;
7397 		un->un_f_is_fibre = FALSE;
7398 #endif
7399 		break;
7400 	}
7401 
7402 	if (un->un_f_is_fibre == TRUE) {
7403 		if (scsi_ifgetcap(SD_ADDRESS(un), "scsi-version", 1) ==
7404 		    SCSI_VERSION_3) {
7405 			switch (un->un_interconnect_type) {
7406 			case SD_INTERCONNECT_FIBRE:
7407 			case SD_INTERCONNECT_SSA:
7408 				un->un_node_type = DDI_NT_BLOCK_WWN;
7409 				break;
7410 			default:
7411 				break;
7412 			}
7413 		}
7414 	}
7415 
7416 	/*
7417 	 * Initialize the Request Sense command for the target
7418 	 */
7419 	if (sd_alloc_rqs(devp, un) != DDI_SUCCESS) {
7420 		goto alloc_rqs_failed;
7421 	}
7422 
7423 	/*
7424 	 * Set un_retry_count with SD_RETRY_COUNT, this is ok for Sparc
7425 	 * with separate binary for sd and ssd.
7426 	 *
7427 	 * x86 has 1 binary, un_retry_count is set base on connection type.
7428 	 * The hardcoded values will go away when Sparc uses 1 binary
7429 	 * for sd and ssd.  This hardcoded values need to match
7430 	 * SD_RETRY_COUNT in sddef.h
7431 	 * The value used is base on interconnect type.
7432 	 * fibre = 3, parallel = 5
7433 	 */
7434 #if defined(__i386) || defined(__amd64)
7435 	un->un_retry_count = un->un_f_is_fibre ? 3 : 5;
7436 #else
7437 	un->un_retry_count = SD_RETRY_COUNT;
7438 #endif
7439 
7440 	/*
7441 	 * Set the per disk retry count to the default number of retries
7442 	 * for disks and CDROMs. This value can be overridden by the
7443 	 * disk property list or an entry in sd.conf.
7444 	 */
7445 	un->un_notready_retry_count =
7446 	    ISCD(un) ? CD_NOT_READY_RETRY_COUNT(un)
7447 	    : DISK_NOT_READY_RETRY_COUNT(un);
7448 
7449 	/*
7450 	 * Set the busy retry count to the default value of un_retry_count.
7451 	 * This can be overridden by entries in sd.conf or the device
7452 	 * config table.
7453 	 */
7454 	un->un_busy_retry_count = un->un_retry_count;
7455 
7456 	/*
7457 	 * Init the reset threshold for retries.  This number determines
7458 	 * how many retries must be performed before a reset can be issued
7459 	 * (for certain error conditions). This can be overridden by entries
7460 	 * in sd.conf or the device config table.
7461 	 */
7462 	un->un_reset_retry_count = (un->un_retry_count / 2);
7463 
7464 	/*
7465 	 * Set the victim_retry_count to the default un_retry_count
7466 	 */
7467 	un->un_victim_retry_count = (2 * un->un_retry_count);
7468 
7469 	/*
7470 	 * Set the reservation release timeout to the default value of
7471 	 * 5 seconds. This can be overridden by entries in ssd.conf or the
7472 	 * device config table.
7473 	 */
7474 	un->un_reserve_release_time = 5;
7475 
7476 	/*
7477 	 * Set up the default maximum transfer size. Note that this may
7478 	 * get updated later in the attach, when setting up default wide
7479 	 * operations for disks.
7480 	 */
7481 #if defined(__i386) || defined(__amd64)
7482 	un->un_max_xfer_size = (uint_t)SD_DEFAULT_MAX_XFER_SIZE;
7483 	un->un_partial_dma_supported = 1;
7484 #else
7485 	un->un_max_xfer_size = (uint_t)maxphys;
7486 #endif
7487 
7488 	/*
7489 	 * Get "allow bus device reset" property (defaults to "enabled" if
7490 	 * the property was not defined). This is to disable bus resets for
7491 	 * certain kinds of error recovery. Note: In the future when a run-time
7492 	 * fibre check is available the soft state flag should default to
7493 	 * enabled.
7494 	 */
7495 	if (un->un_f_is_fibre == TRUE) {
7496 		un->un_f_allow_bus_device_reset = TRUE;
7497 	} else {
7498 		if (ddi_getprop(DDI_DEV_T_ANY, devi, DDI_PROP_DONTPASS,
7499 		    "allow-bus-device-reset", 1) != 0) {
7500 			un->un_f_allow_bus_device_reset = TRUE;
7501 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7502 			    "sd_unit_attach: un:0x%p Bus device reset "
7503 			    "enabled\n", un);
7504 		} else {
7505 			un->un_f_allow_bus_device_reset = FALSE;
7506 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7507 			    "sd_unit_attach: un:0x%p Bus device reset "
7508 			    "disabled\n", un);
7509 		}
7510 	}
7511 
7512 	/*
7513 	 * Check if this is an ATAPI device. ATAPI devices use Group 1
7514 	 * Read/Write commands and Group 2 Mode Sense/Select commands.
7515 	 *
7516 	 * Note: The "obsolete" way of doing this is to check for the "atapi"
7517 	 * property. The new "variant" property with a value of "atapi" has been
7518 	 * introduced so that future 'variants' of standard SCSI behavior (like
7519 	 * atapi) could be specified by the underlying HBA drivers by supplying
7520 	 * a new value for the "variant" property, instead of having to define a
7521 	 * new property.
7522 	 */
7523 	if (ddi_prop_get_int(DDI_DEV_T_ANY, devi, 0, "atapi", -1) != -1) {
7524 		un->un_f_cfg_is_atapi = TRUE;
7525 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
7526 		    "sd_unit_attach: un:0x%p Atapi device\n", un);
7527 	}
7528 	if (ddi_prop_lookup_string(DDI_DEV_T_ANY, devi, 0, "variant",
7529 	    &variantp) == DDI_PROP_SUCCESS) {
7530 		if (strcmp(variantp, "atapi") == 0) {
7531 			un->un_f_cfg_is_atapi = TRUE;
7532 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7533 			    "sd_unit_attach: un:0x%p Atapi device\n", un);
7534 		}
7535 		ddi_prop_free(variantp);
7536 	}
7537 
7538 	un->un_cmd_timeout	= SD_IO_TIME;
7539 
7540 	un->un_busy_timeout  = SD_BSY_TIMEOUT;
7541 
7542 	/* Info on current states, statuses, etc. (Updated frequently) */
7543 	un->un_state		= SD_STATE_NORMAL;
7544 	un->un_last_state	= SD_STATE_NORMAL;
7545 
7546 	/* Control & status info for command throttling */
7547 	un->un_throttle		= sd_max_throttle;
7548 	un->un_saved_throttle	= sd_max_throttle;
7549 	un->un_min_throttle	= sd_min_throttle;
7550 
7551 	if (un->un_f_is_fibre == TRUE) {
7552 		un->un_f_use_adaptive_throttle = TRUE;
7553 	} else {
7554 		un->un_f_use_adaptive_throttle = FALSE;
7555 	}
7556 
7557 	/* Removable media support. */
7558 	cv_init(&un->un_state_cv, NULL, CV_DRIVER, NULL);
7559 	un->un_mediastate		= DKIO_NONE;
7560 	un->un_specified_mediastate	= DKIO_NONE;
7561 
7562 	/* CVs for suspend/resume (PM or DR) */
7563 	cv_init(&un->un_suspend_cv,   NULL, CV_DRIVER, NULL);
7564 	cv_init(&un->un_disk_busy_cv, NULL, CV_DRIVER, NULL);
7565 
7566 	/* Power management support. */
7567 	un->un_power_level = SD_SPINDLE_UNINIT;
7568 
7569 	cv_init(&un->un_wcc_cv,   NULL, CV_DRIVER, NULL);
7570 	un->un_f_wcc_inprog = 0;
7571 
7572 	/*
7573 	 * The open/close semaphore is used to serialize threads executing
7574 	 * in the driver's open & close entry point routines for a given
7575 	 * instance.
7576 	 */
7577 	(void) sema_init(&un->un_semoclose, 1, NULL, SEMA_DRIVER, NULL);
7578 
7579 	/*
7580 	 * The conf file entry and softstate variable is a forceful override,
7581 	 * meaning a non-zero value must be entered to change the default.
7582 	 */
7583 	un->un_f_disksort_disabled = FALSE;
7584 	un->un_f_rmw_type = SD_RMW_TYPE_DEFAULT;
7585 
7586 	/*
7587 	 * GET EVENT STATUS NOTIFICATION media polling enabled by default, but
7588 	 * can be overridden via [s]sd-config-list "mmc-gesn-polling" property.
7589 	 */
7590 	un->un_f_mmc_gesn_polling = TRUE;
7591 
7592 	/*
7593 	 * Retrieve the properties from the static driver table or the driver
7594 	 * configuration file (.conf) for this unit and update the soft state
7595 	 * for the device as needed for the indicated properties.
7596 	 * Note: the property configuration needs to occur here as some of the
7597 	 * following routines may have dependencies on soft state flags set
7598 	 * as part of the driver property configuration.
7599 	 */
7600 	sd_read_unit_properties(un);
7601 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7602 	    "sd_unit_attach: un:0x%p property configuration complete.\n", un);
7603 
7604 	/*
7605 	 * Only if a device has "hotpluggable" property, it is
7606 	 * treated as hotpluggable device. Otherwise, it is
7607 	 * regarded as non-hotpluggable one.
7608 	 */
7609 	if (ddi_prop_get_int(DDI_DEV_T_ANY, devi, 0, "hotpluggable",
7610 	    -1) != -1) {
7611 		un->un_f_is_hotpluggable = TRUE;
7612 	}
7613 
7614 	/*
7615 	 * set unit's attributes(flags) according to "hotpluggable" and
7616 	 * RMB bit in INQUIRY data.
7617 	 */
7618 	sd_set_unit_attributes(un, devi);
7619 
7620 	/*
7621 	 * By default, we mark the capacity, lbasize, and geometry
7622 	 * as invalid. Only if we successfully read a valid capacity
7623 	 * will we update the un_blockcount and un_tgt_blocksize with the
7624 	 * valid values (the geometry will be validated later).
7625 	 */
7626 	un->un_f_blockcount_is_valid	= FALSE;
7627 	un->un_f_tgt_blocksize_is_valid	= FALSE;
7628 
7629 	/*
7630 	 * Use DEV_BSIZE and DEV_BSHIFT as defaults, until we can determine
7631 	 * otherwise.
7632 	 */
7633 	un->un_tgt_blocksize  = un->un_sys_blocksize  = DEV_BSIZE;
7634 	un->un_blockcount = 0;
7635 
7636 	/*
7637 	 * Set up the per-instance info needed to determine the correct
7638 	 * CDBs and other info for issuing commands to the target.
7639 	 */
7640 	sd_init_cdb_limits(un);
7641 
7642 	/*
7643 	 * Set up the IO chains to use, based upon the target type.
7644 	 */
7645 	if (un->un_f_non_devbsize_supported) {
7646 		un->un_buf_chain_type = SD_CHAIN_INFO_RMMEDIA;
7647 	} else {
7648 		un->un_buf_chain_type = SD_CHAIN_INFO_DISK;
7649 	}
7650 	un->un_uscsi_chain_type  = SD_CHAIN_INFO_USCSI_CMD;
7651 	un->un_direct_chain_type = SD_CHAIN_INFO_DIRECT_CMD;
7652 	un->un_priority_chain_type = SD_CHAIN_INFO_PRIORITY_CMD;
7653 
7654 	un->un_xbuf_attr = ddi_xbuf_attr_create(sizeof (struct sd_xbuf),
7655 	    sd_xbuf_strategy, un, sd_xbuf_active_limit,  sd_xbuf_reserve_limit,
7656 	    ddi_driver_major(devi), DDI_XBUF_QTHREAD_DRIVER);
7657 	ddi_xbuf_attr_register_devinfo(un->un_xbuf_attr, devi);
7658 
7659 
7660 	if (ISCD(un)) {
7661 		un->un_additional_codes = sd_additional_codes;
7662 	} else {
7663 		un->un_additional_codes = NULL;
7664 	}
7665 
7666 	/*
7667 	 * Create the kstats here so they can be available for attach-time
7668 	 * routines that send commands to the unit (either polled or via
7669 	 * sd_send_scsi_cmd).
7670 	 *
7671 	 * Note: This is a critical sequence that needs to be maintained:
7672 	 *	1) Instantiate the kstats here, before any routines using the
7673 	 *	   iopath (i.e. sd_send_scsi_cmd).
7674 	 *	2) Instantiate and initialize the partition stats
7675 	 *	   (sd_set_pstats).
7676 	 *	3) Initialize the error stats (sd_set_errstats), following
7677 	 *	   sd_validate_geometry(),sd_register_devid(),
7678 	 *	   and sd_cache_control().
7679 	 */
7680 
7681 	un->un_stats = kstat_create(sd_label, instance,
7682 	    NULL, "disk", KSTAT_TYPE_IO, 1, KSTAT_FLAG_PERSISTENT);
7683 	if (un->un_stats != NULL) {
7684 		un->un_stats->ks_lock = SD_MUTEX(un);
7685 		kstat_install(un->un_stats);
7686 	}
7687 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7688 	    "sd_unit_attach: un:0x%p un_stats created\n", un);
7689 
7690 	sd_create_errstats(un, instance);
7691 	if (un->un_errstats == NULL) {
7692 		goto create_errstats_failed;
7693 	}
7694 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7695 	    "sd_unit_attach: un:0x%p errstats created\n", un);
7696 
7697 	/*
7698 	 * The following if/else code was relocated here from below as part
7699 	 * of the fix for bug (4430280). However with the default setup added
7700 	 * on entry to this routine, it's no longer absolutely necessary for
7701 	 * this to be before the call to sd_spin_up_unit.
7702 	 */
7703 	if (SD_IS_PARALLEL_SCSI(un) || SD_IS_SERIAL(un)) {
7704 		int tq_trigger_flag = (((devp->sd_inq->inq_ansi == 4) ||
7705 		    (devp->sd_inq->inq_ansi == 5)) &&
7706 		    devp->sd_inq->inq_bque) || devp->sd_inq->inq_cmdque;
7707 
7708 		/*
7709 		 * If tagged queueing is supported by the target
7710 		 * and by the host adapter then we will enable it
7711 		 */
7712 		un->un_tagflags = 0;
7713 		if ((devp->sd_inq->inq_rdf == RDF_SCSI2) && tq_trigger_flag &&
7714 		    (un->un_f_arq_enabled == TRUE)) {
7715 			if (scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing",
7716 			    1, 1) == 1) {
7717 				un->un_tagflags = FLAG_STAG;
7718 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7719 				    "sd_unit_attach: un:0x%p tag queueing "
7720 				    "enabled\n", un);
7721 			} else if (scsi_ifgetcap(SD_ADDRESS(un),
7722 			    "untagged-qing", 0) == 1) {
7723 				un->un_f_opt_queueing = TRUE;
7724 				un->un_saved_throttle = un->un_throttle =
7725 				    min(un->un_throttle, 3);
7726 			} else {
7727 				un->un_f_opt_queueing = FALSE;
7728 				un->un_saved_throttle = un->un_throttle = 1;
7729 			}
7730 		} else if ((scsi_ifgetcap(SD_ADDRESS(un), "untagged-qing", 0)
7731 		    == 1) && (un->un_f_arq_enabled == TRUE)) {
7732 			/* The Host Adapter supports internal queueing. */
7733 			un->un_f_opt_queueing = TRUE;
7734 			un->un_saved_throttle = un->un_throttle =
7735 			    min(un->un_throttle, 3);
7736 		} else {
7737 			un->un_f_opt_queueing = FALSE;
7738 			un->un_saved_throttle = un->un_throttle = 1;
7739 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7740 			    "sd_unit_attach: un:0x%p no tag queueing\n", un);
7741 		}
7742 
7743 		/*
7744 		 * Enable large transfers for SATA/SAS drives
7745 		 */
7746 		if (SD_IS_SERIAL(un)) {
7747 			un->un_max_xfer_size =
7748 			    ddi_getprop(DDI_DEV_T_ANY, devi, 0,
7749 			    sd_max_xfer_size, SD_MAX_XFER_SIZE);
7750 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
7751 			    "sd_unit_attach: un:0x%p max transfer "
7752 			    "size=0x%x\n", un, un->un_max_xfer_size);
7753 
7754 		}
7755 
7756 		/* Setup or tear down default wide operations for disks */
7757 
7758 		/*
7759 		 * Note: Legacy: it may be possible for both "sd_max_xfer_size"
7760 		 * and "ssd_max_xfer_size" to exist simultaneously on the same
7761 		 * system and be set to different values. In the future this
7762 		 * code may need to be updated when the ssd module is
7763 		 * obsoleted and removed from the system. (4299588)
7764 		 */
7765 		if (SD_IS_PARALLEL_SCSI(un) &&
7766 		    (devp->sd_inq->inq_rdf == RDF_SCSI2) &&
7767 		    (devp->sd_inq->inq_wbus16 || devp->sd_inq->inq_wbus32)) {
7768 			if (scsi_ifsetcap(SD_ADDRESS(un), "wide-xfer",
7769 			    1, 1) == 1) {
7770 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7771 				    "sd_unit_attach: un:0x%p Wide Transfer "
7772 				    "enabled\n", un);
7773 			}
7774 
7775 			/*
7776 			 * If tagged queuing has also been enabled, then
7777 			 * enable large xfers
7778 			 */
7779 			if (un->un_saved_throttle == sd_max_throttle) {
7780 				un->un_max_xfer_size =
7781 				    ddi_getprop(DDI_DEV_T_ANY, devi, 0,
7782 				    sd_max_xfer_size, SD_MAX_XFER_SIZE);
7783 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7784 				    "sd_unit_attach: un:0x%p max transfer "
7785 				    "size=0x%x\n", un, un->un_max_xfer_size);
7786 			}
7787 		} else {
7788 			if (scsi_ifsetcap(SD_ADDRESS(un), "wide-xfer",
7789 			    0, 1) == 1) {
7790 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7791 				    "sd_unit_attach: un:0x%p "
7792 				    "Wide Transfer disabled\n", un);
7793 			}
7794 		}
7795 	} else {
7796 		un->un_tagflags = FLAG_STAG;
7797 		un->un_max_xfer_size = ddi_getprop(DDI_DEV_T_ANY,
7798 		    devi, 0, sd_max_xfer_size, SD_MAX_XFER_SIZE);
7799 	}
7800 
7801 	/*
7802 	 * If this target supports LUN reset, try to enable it.
7803 	 */
7804 	if (un->un_f_lun_reset_enabled) {
7805 		if (scsi_ifsetcap(SD_ADDRESS(un), "lun-reset", 1, 1) == 1) {
7806 			SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_unit_attach: "
7807 			    "un:0x%p lun_reset capability set\n", un);
7808 		} else {
7809 			SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_unit_attach: "
7810 			    "un:0x%p lun-reset capability not set\n", un);
7811 		}
7812 	}
7813 
7814 	/*
7815 	 * Adjust the maximum transfer size. This is to fix
7816 	 * the problem of partial DMA support on SPARC. Some
7817 	 * HBA driver, like aac, has very small dma_attr_maxxfer
7818 	 * size, which requires partial DMA support on SPARC.
7819 	 * In the future the SPARC pci nexus driver may solve
7820 	 * the problem instead of this fix.
7821 	 */
7822 	max_xfer_size = scsi_ifgetcap(SD_ADDRESS(un), "dma-max", 1);
7823 	if ((max_xfer_size > 0) && (max_xfer_size < un->un_max_xfer_size)) {
7824 		/* We need DMA partial even on sparc to ensure sddump() works */
7825 		un->un_max_xfer_size = max_xfer_size;
7826 		if (un->un_partial_dma_supported == 0)
7827 			un->un_partial_dma_supported = 1;
7828 	}
7829 	if (ddi_prop_get_int(DDI_DEV_T_ANY, SD_DEVINFO(un),
7830 	    DDI_PROP_DONTPASS, "buf_break", 0) == 1) {
7831 		if (ddi_xbuf_attr_setup_brk(un->un_xbuf_attr,
7832 		    un->un_max_xfer_size) == 1) {
7833 			un->un_buf_breakup_supported = 1;
7834 			SD_INFO(SD_LOG_ATTACH_DETACH, un, "sd_unit_attach: "
7835 			    "un:0x%p Buf breakup enabled\n", un);
7836 		}
7837 	}
7838 
7839 	/*
7840 	 * Set PKT_DMA_PARTIAL flag.
7841 	 */
7842 	if (un->un_partial_dma_supported == 1) {
7843 		un->un_pkt_flags = PKT_DMA_PARTIAL;
7844 	} else {
7845 		un->un_pkt_flags = 0;
7846 	}
7847 
7848 	/* Initialize sd_ssc_t for internal uscsi commands */
7849 	ssc = sd_ssc_init(un);
7850 	scsi_fm_init(devp);
7851 
7852 	/*
7853 	 * Allocate memory for SCSI FMA stuffs.
7854 	 */
7855 	un->un_fm_private =
7856 	    kmem_zalloc(sizeof (struct sd_fm_internal), KM_SLEEP);
7857 	sfip = (struct sd_fm_internal *)un->un_fm_private;
7858 	sfip->fm_ssc.ssc_uscsi_cmd = &sfip->fm_ucmd;
7859 	sfip->fm_ssc.ssc_uscsi_info = &sfip->fm_uinfo;
7860 	sfip->fm_ssc.ssc_un = un;
7861 
7862 	if (ISCD(un) ||
7863 	    un->un_f_has_removable_media ||
7864 	    devp->sd_fm_capable == DDI_FM_NOT_CAPABLE) {
7865 		/*
7866 		 * We don't touch CDROM or the DDI_FM_NOT_CAPABLE device.
7867 		 * Their log are unchanged.
7868 		 */
7869 		sfip->fm_log_level = SD_FM_LOG_NSUP;
7870 	} else {
7871 		/*
7872 		 * If enter here, it should be non-CDROM and FM-capable
7873 		 * device, and it will not keep the old scsi_log as before
7874 		 * in /var/adm/messages. However, the property
7875 		 * "fm-scsi-log" will control whether the FM telemetry will
7876 		 * be logged in /var/adm/messages.
7877 		 */
7878 		int fm_scsi_log;
7879 		fm_scsi_log = ddi_prop_get_int(DDI_DEV_T_ANY, SD_DEVINFO(un),
7880 		    DDI_PROP_DONTPASS | DDI_PROP_NOTPROM, "fm-scsi-log", 0);
7881 
7882 		if (fm_scsi_log)
7883 			sfip->fm_log_level = SD_FM_LOG_EREPORT;
7884 		else
7885 			sfip->fm_log_level = SD_FM_LOG_SILENT;
7886 	}
7887 
7888 	/*
7889 	 * At this point in the attach, we have enough info in the
7890 	 * soft state to be able to issue commands to the target.
7891 	 *
7892 	 * All command paths used below MUST issue their commands as
7893 	 * SD_PATH_DIRECT. This is important as intermediate layers
7894 	 * are not all initialized yet (such as PM).
7895 	 */
7896 
7897 	/*
7898 	 * Send a TEST UNIT READY command to the device. This should clear
7899 	 * any outstanding UNIT ATTENTION that may be present.
7900 	 *
7901 	 * Note: Don't check for success, just track if there is a reservation,
7902 	 * this is a throw away command to clear any unit attentions.
7903 	 *
7904 	 * Note: This MUST be the first command issued to the target during
7905 	 * attach to ensure power on UNIT ATTENTIONS are cleared.
7906 	 * Pass in flag SD_DONT_RETRY_TUR to prevent the long delays associated
7907 	 * with attempts at spinning up a device with no media.
7908 	 */
7909 	status = sd_send_scsi_TEST_UNIT_READY(ssc, SD_DONT_RETRY_TUR);
7910 	if (status != 0) {
7911 		if (status == EACCES)
7912 			reservation_flag = SD_TARGET_IS_RESERVED;
7913 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
7914 	}
7915 
7916 	/*
7917 	 * If the device is NOT a removable media device, attempt to spin
7918 	 * it up (using the START_STOP_UNIT command) and read its capacity
7919 	 * (using the READ CAPACITY command).  Note, however, that either
7920 	 * of these could fail and in some cases we would continue with
7921 	 * the attach despite the failure (see below).
7922 	 */
7923 	if (un->un_f_descr_format_supported) {
7924 
7925 		switch (sd_spin_up_unit(ssc)) {
7926 		case 0:
7927 			/*
7928 			 * Spin-up was successful; now try to read the
7929 			 * capacity.  If successful then save the results
7930 			 * and mark the capacity & lbasize as valid.
7931 			 */
7932 			SD_TRACE(SD_LOG_ATTACH_DETACH, un,
7933 			    "sd_unit_attach: un:0x%p spin-up successful\n", un);
7934 
7935 			status = sd_send_scsi_READ_CAPACITY(ssc, &capacity,
7936 			    &lbasize, SD_PATH_DIRECT);
7937 
7938 			switch (status) {
7939 			case 0: {
7940 				if (capacity > DK_MAX_BLOCKS) {
7941 #ifdef _LP64
7942 					if ((capacity + 1) >
7943 					    SD_GROUP1_MAX_ADDRESS) {
7944 						/*
7945 						 * Enable descriptor format
7946 						 * sense data so that we can
7947 						 * get 64 bit sense data
7948 						 * fields.
7949 						 */
7950 						sd_enable_descr_sense(ssc);
7951 					}
7952 #else
7953 					/* 32-bit kernels can't handle this */
7954 					scsi_log(SD_DEVINFO(un),
7955 					    sd_label, CE_WARN,
7956 					    "disk has %llu blocks, which "
7957 					    "is too large for a 32-bit "
7958 					    "kernel", capacity);
7959 
7960 #if defined(__i386) || defined(__amd64)
7961 					/*
7962 					 * 1TB disk was treated as (1T - 512)B
7963 					 * in the past, so that it might have
7964 					 * valid VTOC and solaris partitions,
7965 					 * we have to allow it to continue to
7966 					 * work.
7967 					 */
7968 					if (capacity -1 > DK_MAX_BLOCKS)
7969 #endif
7970 					goto spinup_failed;
7971 #endif
7972 				}
7973 
7974 				/*
7975 				 * Here it's not necessary to check the case:
7976 				 * the capacity of the device is bigger than
7977 				 * what the max hba cdb can support. Because
7978 				 * sd_send_scsi_READ_CAPACITY will retrieve
7979 				 * the capacity by sending USCSI command, which
7980 				 * is constrained by the max hba cdb. Actually,
7981 				 * sd_send_scsi_READ_CAPACITY will return
7982 				 * EINVAL when using bigger cdb than required
7983 				 * cdb length. Will handle this case in
7984 				 * "case EINVAL".
7985 				 */
7986 
7987 				/*
7988 				 * The following relies on
7989 				 * sd_send_scsi_READ_CAPACITY never
7990 				 * returning 0 for capacity and/or lbasize.
7991 				 */
7992 				sd_update_block_info(un, lbasize, capacity);
7993 
7994 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
7995 				    "sd_unit_attach: un:0x%p capacity = %ld "
7996 				    "blocks; lbasize= %ld.\n", un,
7997 				    un->un_blockcount, un->un_tgt_blocksize);
7998 
7999 				break;
8000 			}
8001 			case EINVAL:
8002 				/*
8003 				 * In the case where the max-cdb-length property
8004 				 * is smaller than the required CDB length for
8005 				 * a SCSI device, a target driver can fail to
8006 				 * attach to that device.
8007 				 */
8008 				scsi_log(SD_DEVINFO(un),
8009 				    sd_label, CE_WARN,
8010 				    "disk capacity is too large "
8011 				    "for current cdb length");
8012 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8013 
8014 				goto spinup_failed;
8015 			case EACCES:
8016 				/*
8017 				 * Should never get here if the spin-up
8018 				 * succeeded, but code it in anyway.
8019 				 * From here, just continue with the attach...
8020 				 */
8021 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
8022 				    "sd_unit_attach: un:0x%p "
8023 				    "sd_send_scsi_READ_CAPACITY "
8024 				    "returned reservation conflict\n", un);
8025 				reservation_flag = SD_TARGET_IS_RESERVED;
8026 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8027 				break;
8028 			default:
8029 				/*
8030 				 * Likewise, should never get here if the
8031 				 * spin-up succeeded. Just continue with
8032 				 * the attach...
8033 				 */
8034 				if (status == EIO)
8035 					sd_ssc_assessment(ssc,
8036 					    SD_FMT_STATUS_CHECK);
8037 				else
8038 					sd_ssc_assessment(ssc,
8039 					    SD_FMT_IGNORE);
8040 				break;
8041 			}
8042 			break;
8043 		case EACCES:
8044 			/*
8045 			 * Device is reserved by another host.  In this case
8046 			 * we could not spin it up or read the capacity, but
8047 			 * we continue with the attach anyway.
8048 			 */
8049 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
8050 			    "sd_unit_attach: un:0x%p spin-up reservation "
8051 			    "conflict.\n", un);
8052 			reservation_flag = SD_TARGET_IS_RESERVED;
8053 			break;
8054 		default:
8055 			/* Fail the attach if the spin-up failed. */
8056 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
8057 			    "sd_unit_attach: un:0x%p spin-up failed.", un);
8058 			goto spinup_failed;
8059 		}
8060 
8061 	}
8062 
8063 	/*
8064 	 * Check to see if this is a MMC drive
8065 	 */
8066 	if (ISCD(un)) {
8067 		sd_set_mmc_caps(ssc);
8068 	}
8069 
8070 	/*
8071 	 * Add a zero-length attribute to tell the world we support
8072 	 * kernel ioctls (for layered drivers)
8073 	 */
8074 	(void) ddi_prop_create(DDI_DEV_T_NONE, devi, DDI_PROP_CANSLEEP,
8075 	    DDI_KERNEL_IOCTL, NULL, 0);
8076 
8077 	/*
8078 	 * Add a boolean property to tell the world we support
8079 	 * the B_FAILFAST flag (for layered drivers)
8080 	 */
8081 	(void) ddi_prop_create(DDI_DEV_T_NONE, devi, DDI_PROP_CANSLEEP,
8082 	    "ddi-failfast-supported", NULL, 0);
8083 
8084 	/*
8085 	 * Initialize power management
8086 	 */
8087 	mutex_init(&un->un_pm_mutex, NULL, MUTEX_DRIVER, NULL);
8088 	cv_init(&un->un_pm_busy_cv, NULL, CV_DRIVER, NULL);
8089 	sd_setup_pm(ssc, devi);
8090 	if (un->un_f_pm_is_enabled == FALSE) {
8091 		/*
8092 		 * For performance, point to a jump table that does
8093 		 * not include pm.
8094 		 * The direct and priority chains don't change with PM.
8095 		 *
8096 		 * Note: this is currently done based on individual device
8097 		 * capabilities. When an interface for determining system
8098 		 * power enabled state becomes available, or when additional
8099 		 * layers are added to the command chain, these values will
8100 		 * have to be re-evaluated for correctness.
8101 		 */
8102 		if (un->un_f_non_devbsize_supported) {
8103 			un->un_buf_chain_type = SD_CHAIN_INFO_RMMEDIA_NO_PM;
8104 		} else {
8105 			un->un_buf_chain_type = SD_CHAIN_INFO_DISK_NO_PM;
8106 		}
8107 		un->un_uscsi_chain_type  = SD_CHAIN_INFO_USCSI_CMD_NO_PM;
8108 	}
8109 
8110 	/*
8111 	 * This property is set to 0 by HA software to avoid retries
8112 	 * on a reserved disk. (The preferred property name is
8113 	 * "retry-on-reservation-conflict") (1189689)
8114 	 *
8115 	 * Note: The use of a global here can have unintended consequences. A
8116 	 * per instance variable is preferable to match the capabilities of
8117 	 * different underlying hba's (4402600)
8118 	 */
8119 	sd_retry_on_reservation_conflict = ddi_getprop(DDI_DEV_T_ANY, devi,
8120 	    DDI_PROP_DONTPASS, "retry-on-reservation-conflict",
8121 	    sd_retry_on_reservation_conflict);
8122 	if (sd_retry_on_reservation_conflict != 0) {
8123 		sd_retry_on_reservation_conflict = ddi_getprop(DDI_DEV_T_ANY,
8124 		    devi, DDI_PROP_DONTPASS, sd_resv_conflict_name,
8125 		    sd_retry_on_reservation_conflict);
8126 	}
8127 
8128 	/* Set up options for QFULL handling. */
8129 	if ((rval = ddi_getprop(DDI_DEV_T_ANY, devi, 0,
8130 	    "qfull-retries", -1)) != -1) {
8131 		(void) scsi_ifsetcap(SD_ADDRESS(un), "qfull-retries",
8132 		    rval, 1);
8133 	}
8134 	if ((rval = ddi_getprop(DDI_DEV_T_ANY, devi, 0,
8135 	    "qfull-retry-interval", -1)) != -1) {
8136 		(void) scsi_ifsetcap(SD_ADDRESS(un), "qfull-retry-interval",
8137 		    rval, 1);
8138 	}
8139 
8140 	/*
8141 	 * This just prints a message that announces the existence of the
8142 	 * device. The message is always printed in the system logfile, but
8143 	 * only appears on the console if the system is booted with the
8144 	 * -v (verbose) argument.
8145 	 */
8146 	ddi_report_dev(devi);
8147 
8148 	un->un_mediastate = DKIO_NONE;
8149 
8150 	/*
8151 	 * Check if this is a SSD(Solid State Drive).
8152 	 */
8153 	sd_check_solid_state(ssc);
8154 
8155 	cmlb_alloc_handle(&un->un_cmlbhandle);
8156 
8157 #if defined(__i386) || defined(__amd64)
8158 	/*
8159 	 * On x86, compensate for off-by-1 legacy error
8160 	 */
8161 	if (!un->un_f_has_removable_media && !un->un_f_is_hotpluggable &&
8162 	    (lbasize == un->un_sys_blocksize))
8163 		offbyone = CMLB_OFF_BY_ONE;
8164 #endif
8165 
8166 	if (cmlb_attach(devi, &sd_tgops, (int)devp->sd_inq->inq_dtype,
8167 	    VOID2BOOLEAN(un->un_f_has_removable_media != 0),
8168 	    VOID2BOOLEAN(un->un_f_is_hotpluggable != 0),
8169 	    un->un_node_type, offbyone, un->un_cmlbhandle,
8170 	    (void *)SD_PATH_DIRECT) != 0) {
8171 		goto cmlb_attach_failed;
8172 	}
8173 
8174 
8175 	/*
8176 	 * Read and validate the device's geometry (ie, disk label)
8177 	 * A new unformatted drive will not have a valid geometry, but
8178 	 * the driver needs to successfully attach to this device so
8179 	 * the drive can be formatted via ioctls.
8180 	 */
8181 	geom_label_valid = (cmlb_validate(un->un_cmlbhandle, 0,
8182 	    (void *)SD_PATH_DIRECT) == 0) ? 1: 0;
8183 
8184 	mutex_enter(SD_MUTEX(un));
8185 
8186 	/*
8187 	 * Read and initialize the devid for the unit.
8188 	 */
8189 	if (un->un_f_devid_supported) {
8190 		sd_register_devid(ssc, devi, reservation_flag);
8191 	}
8192 	mutex_exit(SD_MUTEX(un));
8193 
8194 #if (defined(__fibre))
8195 	/*
8196 	 * Register callbacks for fibre only.  You can't do this solely
8197 	 * on the basis of the devid_type because this is hba specific.
8198 	 * We need to query our hba capabilities to find out whether to
8199 	 * register or not.
8200 	 */
8201 	if (un->un_f_is_fibre) {
8202 		if (strcmp(un->un_node_type, DDI_NT_BLOCK_CHAN)) {
8203 			sd_init_event_callbacks(un);
8204 			SD_TRACE(SD_LOG_ATTACH_DETACH, un,
8205 			    "sd_unit_attach: un:0x%p event callbacks inserted",
8206 			    un);
8207 		}
8208 	}
8209 #endif
8210 
8211 	if (un->un_f_opt_disable_cache == TRUE) {
8212 		/*
8213 		 * Disable both read cache and write cache.  This is
8214 		 * the historic behavior of the keywords in the config file.
8215 		 */
8216 		if (sd_cache_control(ssc, SD_CACHE_DISABLE, SD_CACHE_DISABLE) !=
8217 		    0) {
8218 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8219 			    "sd_unit_attach: un:0x%p Could not disable "
8220 			    "caching", un);
8221 			goto devid_failed;
8222 		}
8223 	}
8224 
8225 	/*
8226 	 * Check the value of the WCE bit now and
8227 	 * set un_f_write_cache_enabled accordingly.
8228 	 */
8229 	(void) sd_get_write_cache_enabled(ssc, &wc_enabled);
8230 	mutex_enter(SD_MUTEX(un));
8231 	un->un_f_write_cache_enabled = (wc_enabled != 0);
8232 	mutex_exit(SD_MUTEX(un));
8233 
8234 	if (un->un_f_rmw_type != SD_RMW_TYPE_RETURN_ERROR &&
8235 	    un->un_tgt_blocksize != DEV_BSIZE) {
8236 		if (!(un->un_wm_cache)) {
8237 			(void) snprintf(name_str, sizeof (name_str),
8238 			    "%s%d_cache",
8239 			    ddi_driver_name(SD_DEVINFO(un)),
8240 			    ddi_get_instance(SD_DEVINFO(un)));
8241 			un->un_wm_cache = kmem_cache_create(
8242 			    name_str, sizeof (struct sd_w_map),
8243 			    8, sd_wm_cache_constructor,
8244 			    sd_wm_cache_destructor, NULL,
8245 			    (void *)un, NULL, 0);
8246 			if (!(un->un_wm_cache)) {
8247 				goto wm_cache_failed;
8248 			}
8249 		}
8250 	}
8251 
8252 	/*
8253 	 * Check the value of the NV_SUP bit and set
8254 	 * un_f_suppress_cache_flush accordingly.
8255 	 */
8256 	sd_get_nv_sup(ssc);
8257 
8258 	/*
8259 	 * Find out what type of reservation this disk supports.
8260 	 */
8261 	status = sd_send_scsi_PERSISTENT_RESERVE_IN(ssc, SD_READ_KEYS, 0, NULL);
8262 
8263 	switch (status) {
8264 	case 0:
8265 		/*
8266 		 * SCSI-3 reservations are supported.
8267 		 */
8268 		un->un_reservation_type = SD_SCSI3_RESERVATION;
8269 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
8270 		    "sd_unit_attach: un:0x%p SCSI-3 reservations\n", un);
8271 		break;
8272 	case ENOTSUP:
8273 		/*
8274 		 * The PERSISTENT RESERVE IN command would not be recognized by
8275 		 * a SCSI-2 device, so assume the reservation type is SCSI-2.
8276 		 */
8277 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
8278 		    "sd_unit_attach: un:0x%p SCSI-2 reservations\n", un);
8279 		un->un_reservation_type = SD_SCSI2_RESERVATION;
8280 
8281 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8282 		break;
8283 	default:
8284 		/*
8285 		 * default to SCSI-3 reservations
8286 		 */
8287 		SD_INFO(SD_LOG_ATTACH_DETACH, un,
8288 		    "sd_unit_attach: un:0x%p default SCSI3 reservations\n", un);
8289 		un->un_reservation_type = SD_SCSI3_RESERVATION;
8290 
8291 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
8292 		break;
8293 	}
8294 
8295 	/*
8296 	 * Set the pstat and error stat values here, so data obtained during the
8297 	 * previous attach-time routines is available.
8298 	 *
8299 	 * Note: This is a critical sequence that needs to be maintained:
8300 	 *	1) Instantiate the kstats before any routines using the iopath
8301 	 *	   (i.e. sd_send_scsi_cmd).
8302 	 *	2) Initialize the error stats (sd_set_errstats) and partition
8303 	 *	   stats (sd_set_pstats)here, following
8304 	 *	   cmlb_validate_geometry(), sd_register_devid(), and
8305 	 *	   sd_cache_control().
8306 	 */
8307 
8308 	if (un->un_f_pkstats_enabled && geom_label_valid) {
8309 		sd_set_pstats(un);
8310 		SD_TRACE(SD_LOG_IO_PARTITION, un,
8311 		    "sd_unit_attach: un:0x%p pstats created and set\n", un);
8312 	}
8313 
8314 	sd_set_errstats(un);
8315 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
8316 	    "sd_unit_attach: un:0x%p errstats set\n", un);
8317 
8318 
8319 	/*
8320 	 * After successfully attaching an instance, we record the information
8321 	 * of how many luns have been attached on the relative target and
8322 	 * controller for parallel SCSI. This information is used when sd tries
8323 	 * to set the tagged queuing capability in HBA.
8324 	 */
8325 	if (SD_IS_PARALLEL_SCSI(un) && (tgt >= 0) && (tgt < NTARGETS_WIDE)) {
8326 		sd_scsi_update_lun_on_target(pdip, tgt, SD_SCSI_LUN_ATTACH);
8327 	}
8328 
8329 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
8330 	    "sd_unit_attach: un:0x%p exit success\n", un);
8331 
8332 	/* Uninitialize sd_ssc_t pointer */
8333 	sd_ssc_fini(ssc);
8334 
8335 	return (DDI_SUCCESS);
8336 
8337 	/*
8338 	 * An error occurred during the attach; clean up & return failure.
8339 	 */
8340 wm_cache_failed:
8341 devid_failed:
8342 
8343 setup_pm_failed:
8344 	ddi_remove_minor_node(devi, NULL);
8345 
8346 cmlb_attach_failed:
8347 	/*
8348 	 * Cleanup from the scsi_ifsetcap() calls (437868)
8349 	 */
8350 	(void) scsi_ifsetcap(SD_ADDRESS(un), "lun-reset", 0, 1);
8351 	(void) scsi_ifsetcap(SD_ADDRESS(un), "wide-xfer", 0, 1);
8352 
8353 	/*
8354 	 * Refer to the comments of setting tagged-qing in the beginning of
8355 	 * sd_unit_attach. We can only disable tagged queuing when there is
8356 	 * no lun attached on the target.
8357 	 */
8358 	if (sd_scsi_get_target_lun_count(pdip, tgt) < 1) {
8359 		(void) scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing", 0, 1);
8360 	}
8361 
8362 	if (un->un_f_is_fibre == FALSE) {
8363 		(void) scsi_ifsetcap(SD_ADDRESS(un), "auto-rqsense", 0, 1);
8364 	}
8365 
8366 spinup_failed:
8367 
8368 	/* Uninitialize sd_ssc_t pointer */
8369 	sd_ssc_fini(ssc);
8370 
8371 	mutex_enter(SD_MUTEX(un));
8372 
8373 	/* Deallocate SCSI FMA memory spaces */
8374 	kmem_free(un->un_fm_private, sizeof (struct sd_fm_internal));
8375 
8376 	/* Cancel callback for SD_PATH_DIRECT_PRIORITY cmd. restart */
8377 	if (un->un_direct_priority_timeid != NULL) {
8378 		timeout_id_t temp_id = un->un_direct_priority_timeid;
8379 		un->un_direct_priority_timeid = NULL;
8380 		mutex_exit(SD_MUTEX(un));
8381 		(void) untimeout(temp_id);
8382 		mutex_enter(SD_MUTEX(un));
8383 	}
8384 
8385 	/* Cancel any pending start/stop timeouts */
8386 	if (un->un_startstop_timeid != NULL) {
8387 		timeout_id_t temp_id = un->un_startstop_timeid;
8388 		un->un_startstop_timeid = NULL;
8389 		mutex_exit(SD_MUTEX(un));
8390 		(void) untimeout(temp_id);
8391 		mutex_enter(SD_MUTEX(un));
8392 	}
8393 
8394 	/* Cancel any pending reset-throttle timeouts */
8395 	if (un->un_reset_throttle_timeid != NULL) {
8396 		timeout_id_t temp_id = un->un_reset_throttle_timeid;
8397 		un->un_reset_throttle_timeid = NULL;
8398 		mutex_exit(SD_MUTEX(un));
8399 		(void) untimeout(temp_id);
8400 		mutex_enter(SD_MUTEX(un));
8401 	}
8402 
8403 	/* Cancel rmw warning message timeouts */
8404 	if (un->un_rmw_msg_timeid != NULL) {
8405 		timeout_id_t temp_id = un->un_rmw_msg_timeid;
8406 		un->un_rmw_msg_timeid = NULL;
8407 		mutex_exit(SD_MUTEX(un));
8408 		(void) untimeout(temp_id);
8409 		mutex_enter(SD_MUTEX(un));
8410 	}
8411 
8412 	/* Cancel any pending retry timeouts */
8413 	if (un->un_retry_timeid != NULL) {
8414 		timeout_id_t temp_id = un->un_retry_timeid;
8415 		un->un_retry_timeid = NULL;
8416 		mutex_exit(SD_MUTEX(un));
8417 		(void) untimeout(temp_id);
8418 		mutex_enter(SD_MUTEX(un));
8419 	}
8420 
8421 	/* Cancel any pending delayed cv broadcast timeouts */
8422 	if (un->un_dcvb_timeid != NULL) {
8423 		timeout_id_t temp_id = un->un_dcvb_timeid;
8424 		un->un_dcvb_timeid = NULL;
8425 		mutex_exit(SD_MUTEX(un));
8426 		(void) untimeout(temp_id);
8427 		mutex_enter(SD_MUTEX(un));
8428 	}
8429 
8430 	mutex_exit(SD_MUTEX(un));
8431 
8432 	/* There should not be any in-progress I/O so ASSERT this check */
8433 	ASSERT(un->un_ncmds_in_transport == 0);
8434 	ASSERT(un->un_ncmds_in_driver == 0);
8435 
8436 	/* Do not free the softstate if the callback routine is active */
8437 	sd_sync_with_callback(un);
8438 
8439 	/*
8440 	 * Partition stats apparently are not used with removables. These would
8441 	 * not have been created during attach, so no need to clean them up...
8442 	 */
8443 	if (un->un_errstats != NULL) {
8444 		kstat_delete(un->un_errstats);
8445 		un->un_errstats = NULL;
8446 	}
8447 
8448 create_errstats_failed:
8449 
8450 	if (un->un_stats != NULL) {
8451 		kstat_delete(un->un_stats);
8452 		un->un_stats = NULL;
8453 	}
8454 
8455 	ddi_xbuf_attr_unregister_devinfo(un->un_xbuf_attr, devi);
8456 	ddi_xbuf_attr_destroy(un->un_xbuf_attr);
8457 
8458 	ddi_prop_remove_all(devi);
8459 	sema_destroy(&un->un_semoclose);
8460 	cv_destroy(&un->un_state_cv);
8461 
8462 getrbuf_failed:
8463 
8464 	sd_free_rqs(un);
8465 
8466 alloc_rqs_failed:
8467 
8468 	devp->sd_private = NULL;
8469 	bzero(un, sizeof (struct sd_lun));	/* Clear any stale data! */
8470 
8471 get_softstate_failed:
8472 	/*
8473 	 * Note: the man pages are unclear as to whether or not doing a
8474 	 * ddi_soft_state_free(sd_state, instance) is the right way to
8475 	 * clean up after the ddi_soft_state_zalloc() if the subsequent
8476 	 * ddi_get_soft_state() fails.  The implication seems to be
8477 	 * that the get_soft_state cannot fail if the zalloc succeeds.
8478 	 */
8479 #ifndef XPV_HVM_DRIVER
8480 	ddi_soft_state_free(sd_state, instance);
8481 #endif /* !XPV_HVM_DRIVER */
8482 
8483 probe_failed:
8484 	scsi_unprobe(devp);
8485 
8486 	return (DDI_FAILURE);
8487 }
8488 
8489 
8490 /*
8491  *    Function: sd_unit_detach
8492  *
8493  * Description: Performs DDI_DETACH processing for sddetach().
8494  *
8495  * Return Code: DDI_SUCCESS
8496  *		DDI_FAILURE
8497  *
8498  *     Context: Kernel thread context
8499  */
8500 
8501 static int
8502 sd_unit_detach(dev_info_t *devi)
8503 {
8504 	struct scsi_device	*devp;
8505 	struct sd_lun		*un;
8506 	int			i;
8507 	int			tgt;
8508 	dev_t			dev;
8509 	dev_info_t		*pdip = ddi_get_parent(devi);
8510 #ifndef XPV_HVM_DRIVER
8511 	int			instance = ddi_get_instance(devi);
8512 #endif /* !XPV_HVM_DRIVER */
8513 
8514 	mutex_enter(&sd_detach_mutex);
8515 
8516 	/*
8517 	 * Fail the detach for any of the following:
8518 	 *  - Unable to get the sd_lun struct for the instance
8519 	 *  - A layered driver has an outstanding open on the instance
8520 	 *  - Another thread is already detaching this instance
8521 	 *  - Another thread is currently performing an open
8522 	 */
8523 	devp = ddi_get_driver_private(devi);
8524 	if ((devp == NULL) ||
8525 	    ((un = (struct sd_lun *)devp->sd_private) == NULL) ||
8526 	    (un->un_ncmds_in_driver != 0) || (un->un_layer_count != 0) ||
8527 	    (un->un_detach_count != 0) || (un->un_opens_in_progress != 0)) {
8528 		mutex_exit(&sd_detach_mutex);
8529 		return (DDI_FAILURE);
8530 	}
8531 
8532 	SD_TRACE(SD_LOG_ATTACH_DETACH, un, "sd_unit_detach: entry 0x%p\n", un);
8533 
8534 	/*
8535 	 * Mark this instance as currently in a detach, to inhibit any
8536 	 * opens from a layered driver.
8537 	 */
8538 	un->un_detach_count++;
8539 	mutex_exit(&sd_detach_mutex);
8540 
8541 	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, devi, DDI_PROP_DONTPASS,
8542 	    SCSI_ADDR_PROP_TARGET, -1);
8543 
8544 	dev = sd_make_device(SD_DEVINFO(un));
8545 
8546 #ifndef lint
8547 	_NOTE(COMPETING_THREADS_NOW);
8548 #endif
8549 
8550 	mutex_enter(SD_MUTEX(un));
8551 
8552 	/*
8553 	 * Fail the detach if there are any outstanding layered
8554 	 * opens on this device.
8555 	 */
8556 	for (i = 0; i < NDKMAP; i++) {
8557 		if (un->un_ocmap.lyropen[i] != 0) {
8558 			goto err_notclosed;
8559 		}
8560 	}
8561 
8562 	/*
8563 	 * Verify there are NO outstanding commands issued to this device.
8564 	 * ie, un_ncmds_in_transport == 0.
8565 	 * It's possible to have outstanding commands through the physio
8566 	 * code path, even though everything's closed.
8567 	 */
8568 	if ((un->un_ncmds_in_transport != 0) || (un->un_retry_timeid != NULL) ||
8569 	    (un->un_direct_priority_timeid != NULL) ||
8570 	    (un->un_state == SD_STATE_RWAIT)) {
8571 		mutex_exit(SD_MUTEX(un));
8572 		SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8573 		    "sd_dr_detach: Detach failure due to outstanding cmds\n");
8574 		goto err_stillbusy;
8575 	}
8576 
8577 	/*
8578 	 * If we have the device reserved, release the reservation.
8579 	 */
8580 	if ((un->un_resvd_status & SD_RESERVE) &&
8581 	    !(un->un_resvd_status & SD_LOST_RESERVE)) {
8582 		mutex_exit(SD_MUTEX(un));
8583 		/*
8584 		 * Note: sd_reserve_release sends a command to the device
8585 		 * via the sd_ioctlcmd() path, and can sleep.
8586 		 */
8587 		if (sd_reserve_release(dev, SD_RELEASE) != 0) {
8588 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8589 			    "sd_dr_detach: Cannot release reservation \n");
8590 		}
8591 	} else {
8592 		mutex_exit(SD_MUTEX(un));
8593 	}
8594 
8595 	/*
8596 	 * Untimeout any reserve recover, throttle reset, restart unit
8597 	 * and delayed broadcast timeout threads. Protect the timeout pointer
8598 	 * from getting nulled by their callback functions.
8599 	 */
8600 	mutex_enter(SD_MUTEX(un));
8601 	if (un->un_resvd_timeid != NULL) {
8602 		timeout_id_t temp_id = un->un_resvd_timeid;
8603 		un->un_resvd_timeid = NULL;
8604 		mutex_exit(SD_MUTEX(un));
8605 		(void) untimeout(temp_id);
8606 		mutex_enter(SD_MUTEX(un));
8607 	}
8608 
8609 	if (un->un_reset_throttle_timeid != NULL) {
8610 		timeout_id_t temp_id = un->un_reset_throttle_timeid;
8611 		un->un_reset_throttle_timeid = NULL;
8612 		mutex_exit(SD_MUTEX(un));
8613 		(void) untimeout(temp_id);
8614 		mutex_enter(SD_MUTEX(un));
8615 	}
8616 
8617 	if (un->un_startstop_timeid != NULL) {
8618 		timeout_id_t temp_id = un->un_startstop_timeid;
8619 		un->un_startstop_timeid = NULL;
8620 		mutex_exit(SD_MUTEX(un));
8621 		(void) untimeout(temp_id);
8622 		mutex_enter(SD_MUTEX(un));
8623 	}
8624 
8625 	if (un->un_rmw_msg_timeid != NULL) {
8626 		timeout_id_t temp_id = un->un_rmw_msg_timeid;
8627 		un->un_rmw_msg_timeid = NULL;
8628 		mutex_exit(SD_MUTEX(un));
8629 		(void) untimeout(temp_id);
8630 		mutex_enter(SD_MUTEX(un));
8631 	}
8632 
8633 	if (un->un_dcvb_timeid != NULL) {
8634 		timeout_id_t temp_id = un->un_dcvb_timeid;
8635 		un->un_dcvb_timeid = NULL;
8636 		mutex_exit(SD_MUTEX(un));
8637 		(void) untimeout(temp_id);
8638 	} else {
8639 		mutex_exit(SD_MUTEX(un));
8640 	}
8641 
8642 	/* Remove any pending reservation reclaim requests for this device */
8643 	sd_rmv_resv_reclaim_req(dev);
8644 
8645 	mutex_enter(SD_MUTEX(un));
8646 
8647 	/* Cancel any pending callbacks for SD_PATH_DIRECT_PRIORITY cmd. */
8648 	if (un->un_direct_priority_timeid != NULL) {
8649 		timeout_id_t temp_id = un->un_direct_priority_timeid;
8650 		un->un_direct_priority_timeid = NULL;
8651 		mutex_exit(SD_MUTEX(un));
8652 		(void) untimeout(temp_id);
8653 		mutex_enter(SD_MUTEX(un));
8654 	}
8655 
8656 	/* Cancel any active multi-host disk watch thread requests */
8657 	if (un->un_mhd_token != NULL) {
8658 		mutex_exit(SD_MUTEX(un));
8659 		 _NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::un_mhd_token));
8660 		if (scsi_watch_request_terminate(un->un_mhd_token,
8661 		    SCSI_WATCH_TERMINATE_NOWAIT)) {
8662 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8663 			    "sd_dr_detach: Cannot cancel mhd watch request\n");
8664 			/*
8665 			 * Note: We are returning here after having removed
8666 			 * some driver timeouts above. This is consistent with
8667 			 * the legacy implementation but perhaps the watch
8668 			 * terminate call should be made with the wait flag set.
8669 			 */
8670 			goto err_stillbusy;
8671 		}
8672 		mutex_enter(SD_MUTEX(un));
8673 		un->un_mhd_token = NULL;
8674 	}
8675 
8676 	if (un->un_swr_token != NULL) {
8677 		mutex_exit(SD_MUTEX(un));
8678 		_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::un_swr_token));
8679 		if (scsi_watch_request_terminate(un->un_swr_token,
8680 		    SCSI_WATCH_TERMINATE_NOWAIT)) {
8681 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8682 			    "sd_dr_detach: Cannot cancel swr watch request\n");
8683 			/*
8684 			 * Note: We are returning here after having removed
8685 			 * some driver timeouts above. This is consistent with
8686 			 * the legacy implementation but perhaps the watch
8687 			 * terminate call should be made with the wait flag set.
8688 			 */
8689 			goto err_stillbusy;
8690 		}
8691 		mutex_enter(SD_MUTEX(un));
8692 		un->un_swr_token = NULL;
8693 	}
8694 
8695 	mutex_exit(SD_MUTEX(un));
8696 
8697 	/*
8698 	 * Clear any scsi_reset_notifies. We clear the reset notifies
8699 	 * if we have not registered one.
8700 	 * Note: The sd_mhd_reset_notify_cb() fn tries to acquire SD_MUTEX!
8701 	 */
8702 	(void) scsi_reset_notify(SD_ADDRESS(un), SCSI_RESET_CANCEL,
8703 	    sd_mhd_reset_notify_cb, (caddr_t)un);
8704 
8705 	/*
8706 	 * protect the timeout pointers from getting nulled by
8707 	 * their callback functions during the cancellation process.
8708 	 * In such a scenario untimeout can be invoked with a null value.
8709 	 */
8710 	_NOTE(NO_COMPETING_THREADS_NOW);
8711 
8712 	mutex_enter(&un->un_pm_mutex);
8713 	if (un->un_pm_idle_timeid != NULL) {
8714 		timeout_id_t temp_id = un->un_pm_idle_timeid;
8715 		un->un_pm_idle_timeid = NULL;
8716 		mutex_exit(&un->un_pm_mutex);
8717 
8718 		/*
8719 		 * Timeout is active; cancel it.
8720 		 * Note that it'll never be active on a device
8721 		 * that does not support PM therefore we don't
8722 		 * have to check before calling pm_idle_component.
8723 		 */
8724 		(void) untimeout(temp_id);
8725 		(void) pm_idle_component(SD_DEVINFO(un), 0);
8726 		mutex_enter(&un->un_pm_mutex);
8727 	}
8728 
8729 	/*
8730 	 * Check whether there is already a timeout scheduled for power
8731 	 * management. If yes then don't lower the power here, that's.
8732 	 * the timeout handler's job.
8733 	 */
8734 	if (un->un_pm_timeid != NULL) {
8735 		timeout_id_t temp_id = un->un_pm_timeid;
8736 		un->un_pm_timeid = NULL;
8737 		mutex_exit(&un->un_pm_mutex);
8738 		/*
8739 		 * Timeout is active; cancel it.
8740 		 * Note that it'll never be active on a device
8741 		 * that does not support PM therefore we don't
8742 		 * have to check before calling pm_idle_component.
8743 		 */
8744 		(void) untimeout(temp_id);
8745 		(void) pm_idle_component(SD_DEVINFO(un), 0);
8746 
8747 	} else {
8748 		mutex_exit(&un->un_pm_mutex);
8749 		if ((un->un_f_pm_is_enabled == TRUE) &&
8750 		    (pm_lower_power(SD_DEVINFO(un), 0, SD_PM_STATE_STOPPED(un))
8751 		    != DDI_SUCCESS)) {
8752 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8753 		    "sd_dr_detach: Lower power request failed, ignoring.\n");
8754 			/*
8755 			 * Fix for bug: 4297749, item # 13
8756 			 * The above test now includes a check to see if PM is
8757 			 * supported by this device before call
8758 			 * pm_lower_power().
8759 			 * Note, the following is not dead code. The call to
8760 			 * pm_lower_power above will generate a call back into
8761 			 * our sdpower routine which might result in a timeout
8762 			 * handler getting activated. Therefore the following
8763 			 * code is valid and necessary.
8764 			 */
8765 			mutex_enter(&un->un_pm_mutex);
8766 			if (un->un_pm_timeid != NULL) {
8767 				timeout_id_t temp_id = un->un_pm_timeid;
8768 				un->un_pm_timeid = NULL;
8769 				mutex_exit(&un->un_pm_mutex);
8770 				(void) untimeout(temp_id);
8771 				(void) pm_idle_component(SD_DEVINFO(un), 0);
8772 			} else {
8773 				mutex_exit(&un->un_pm_mutex);
8774 			}
8775 		}
8776 	}
8777 
8778 	/*
8779 	 * Cleanup from the scsi_ifsetcap() calls (437868)
8780 	 * Relocated here from above to be after the call to
8781 	 * pm_lower_power, which was getting errors.
8782 	 */
8783 	(void) scsi_ifsetcap(SD_ADDRESS(un), "lun-reset", 0, 1);
8784 	(void) scsi_ifsetcap(SD_ADDRESS(un), "wide-xfer", 0, 1);
8785 
8786 	/*
8787 	 * Currently, tagged queuing is supported per target based by HBA.
8788 	 * Setting this per lun instance actually sets the capability of this
8789 	 * target in HBA, which affects those luns already attached on the
8790 	 * same target. So during detach, we can only disable this capability
8791 	 * only when this is the only lun left on this target. By doing
8792 	 * this, we assume a target has the same tagged queuing capability
8793 	 * for every lun. The condition can be removed when HBA is changed to
8794 	 * support per lun based tagged queuing capability.
8795 	 */
8796 	if (sd_scsi_get_target_lun_count(pdip, tgt) <= 1) {
8797 		(void) scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing", 0, 1);
8798 	}
8799 
8800 	if (un->un_f_is_fibre == FALSE) {
8801 		(void) scsi_ifsetcap(SD_ADDRESS(un), "auto-rqsense", 0, 1);
8802 	}
8803 
8804 	/*
8805 	 * Remove any event callbacks, fibre only
8806 	 */
8807 	if (un->un_f_is_fibre == TRUE) {
8808 		if ((un->un_insert_event != NULL) &&
8809 		    (ddi_remove_event_handler(un->un_insert_cb_id) !=
8810 		    DDI_SUCCESS)) {
8811 			/*
8812 			 * Note: We are returning here after having done
8813 			 * substantial cleanup above. This is consistent
8814 			 * with the legacy implementation but this may not
8815 			 * be the right thing to do.
8816 			 */
8817 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8818 			    "sd_dr_detach: Cannot cancel insert event\n");
8819 			goto err_remove_event;
8820 		}
8821 		un->un_insert_event = NULL;
8822 
8823 		if ((un->un_remove_event != NULL) &&
8824 		    (ddi_remove_event_handler(un->un_remove_cb_id) !=
8825 		    DDI_SUCCESS)) {
8826 			/*
8827 			 * Note: We are returning here after having done
8828 			 * substantial cleanup above. This is consistent
8829 			 * with the legacy implementation but this may not
8830 			 * be the right thing to do.
8831 			 */
8832 			SD_ERROR(SD_LOG_ATTACH_DETACH, un,
8833 			    "sd_dr_detach: Cannot cancel remove event\n");
8834 			goto err_remove_event;
8835 		}
8836 		un->un_remove_event = NULL;
8837 	}
8838 
8839 	/* Do not free the softstate if the callback routine is active */
8840 	sd_sync_with_callback(un);
8841 
8842 	cmlb_detach(un->un_cmlbhandle, (void *)SD_PATH_DIRECT);
8843 	cmlb_free_handle(&un->un_cmlbhandle);
8844 
8845 	/*
8846 	 * Hold the detach mutex here, to make sure that no other threads ever
8847 	 * can access a (partially) freed soft state structure.
8848 	 */
8849 	mutex_enter(&sd_detach_mutex);
8850 
8851 	/*
8852 	 * Clean up the soft state struct.
8853 	 * Cleanup is done in reverse order of allocs/inits.
8854 	 * At this point there should be no competing threads anymore.
8855 	 */
8856 
8857 	scsi_fm_fini(devp);
8858 
8859 	/*
8860 	 * Deallocate memory for SCSI FMA.
8861 	 */
8862 	kmem_free(un->un_fm_private, sizeof (struct sd_fm_internal));
8863 
8864 	/*
8865 	 * Unregister and free device id if it was not registered
8866 	 * by the transport.
8867 	 */
8868 	if (un->un_f_devid_transport_defined == FALSE)
8869 		ddi_devid_unregister(devi);
8870 
8871 	/*
8872 	 * free the devid structure if allocated before (by ddi_devid_init()
8873 	 * or ddi_devid_get()).
8874 	 */
8875 	if (un->un_devid) {
8876 		ddi_devid_free(un->un_devid);
8877 		un->un_devid = NULL;
8878 	}
8879 
8880 	/*
8881 	 * Destroy wmap cache if it exists.
8882 	 */
8883 	if (un->un_wm_cache != NULL) {
8884 		kmem_cache_destroy(un->un_wm_cache);
8885 		un->un_wm_cache = NULL;
8886 	}
8887 
8888 	/*
8889 	 * kstat cleanup is done in detach for all device types (4363169).
8890 	 * We do not want to fail detach if the device kstats are not deleted
8891 	 * since there is a confusion about the devo_refcnt for the device.
8892 	 * We just delete the kstats and let detach complete successfully.
8893 	 */
8894 	if (un->un_stats != NULL) {
8895 		kstat_delete(un->un_stats);
8896 		un->un_stats = NULL;
8897 	}
8898 	if (un->un_errstats != NULL) {
8899 		kstat_delete(un->un_errstats);
8900 		un->un_errstats = NULL;
8901 	}
8902 
8903 	/* Remove partition stats */
8904 	if (un->un_f_pkstats_enabled) {
8905 		for (i = 0; i < NSDMAP; i++) {
8906 			if (un->un_pstats[i] != NULL) {
8907 				kstat_delete(un->un_pstats[i]);
8908 				un->un_pstats[i] = NULL;
8909 			}
8910 		}
8911 	}
8912 
8913 	/* Remove xbuf registration */
8914 	ddi_xbuf_attr_unregister_devinfo(un->un_xbuf_attr, devi);
8915 	ddi_xbuf_attr_destroy(un->un_xbuf_attr);
8916 
8917 	/* Remove driver properties */
8918 	ddi_prop_remove_all(devi);
8919 
8920 	mutex_destroy(&un->un_pm_mutex);
8921 	cv_destroy(&un->un_pm_busy_cv);
8922 
8923 	cv_destroy(&un->un_wcc_cv);
8924 
8925 	/* Open/close semaphore */
8926 	sema_destroy(&un->un_semoclose);
8927 
8928 	/* Removable media condvar. */
8929 	cv_destroy(&un->un_state_cv);
8930 
8931 	/* Suspend/resume condvar. */
8932 	cv_destroy(&un->un_suspend_cv);
8933 	cv_destroy(&un->un_disk_busy_cv);
8934 
8935 	sd_free_rqs(un);
8936 
8937 	/* Free up soft state */
8938 	devp->sd_private = NULL;
8939 
8940 	bzero(un, sizeof (struct sd_lun));
8941 #ifndef XPV_HVM_DRIVER
8942 	ddi_soft_state_free(sd_state, instance);
8943 #endif /* !XPV_HVM_DRIVER */
8944 
8945 	mutex_exit(&sd_detach_mutex);
8946 
8947 	/* This frees up the INQUIRY data associated with the device. */
8948 	scsi_unprobe(devp);
8949 
8950 	/*
8951 	 * After successfully detaching an instance, we update the information
8952 	 * of how many luns have been attached in the relative target and
8953 	 * controller for parallel SCSI. This information is used when sd tries
8954 	 * to set the tagged queuing capability in HBA.
8955 	 * Since un has been released, we can't use SD_IS_PARALLEL_SCSI(un) to
8956 	 * check if the device is parallel SCSI. However, we don't need to
8957 	 * check here because we've already checked during attach. No device
8958 	 * that is not parallel SCSI is in the chain.
8959 	 */
8960 	if ((tgt >= 0) && (tgt < NTARGETS_WIDE)) {
8961 		sd_scsi_update_lun_on_target(pdip, tgt, SD_SCSI_LUN_DETACH);
8962 	}
8963 
8964 	return (DDI_SUCCESS);
8965 
8966 err_notclosed:
8967 	mutex_exit(SD_MUTEX(un));
8968 
8969 err_stillbusy:
8970 	_NOTE(NO_COMPETING_THREADS_NOW);
8971 
8972 err_remove_event:
8973 	mutex_enter(&sd_detach_mutex);
8974 	un->un_detach_count--;
8975 	mutex_exit(&sd_detach_mutex);
8976 
8977 	SD_TRACE(SD_LOG_ATTACH_DETACH, un, "sd_unit_detach: exit failure\n");
8978 	return (DDI_FAILURE);
8979 }
8980 
8981 
8982 /*
8983  *    Function: sd_create_errstats
8984  *
8985  * Description: This routine instantiates the device error stats.
8986  *
8987  *		Note: During attach the stats are instantiated first so they are
8988  *		available for attach-time routines that utilize the driver
8989  *		iopath to send commands to the device. The stats are initialized
8990  *		separately so data obtained during some attach-time routines is
8991  *		available. (4362483)
8992  *
8993  *   Arguments: un - driver soft state (unit) structure
8994  *		instance - driver instance
8995  *
8996  *     Context: Kernel thread context
8997  */
8998 
8999 static void
9000 sd_create_errstats(struct sd_lun *un, int instance)
9001 {
9002 	struct	sd_errstats	*stp;
9003 	char	kstatmodule_err[KSTAT_STRLEN];
9004 	char	kstatname[KSTAT_STRLEN];
9005 	int	ndata = (sizeof (struct sd_errstats) / sizeof (kstat_named_t));
9006 
9007 	ASSERT(un != NULL);
9008 
9009 	if (un->un_errstats != NULL) {
9010 		return;
9011 	}
9012 
9013 	(void) snprintf(kstatmodule_err, sizeof (kstatmodule_err),
9014 	    "%serr", sd_label);
9015 	(void) snprintf(kstatname, sizeof (kstatname),
9016 	    "%s%d,err", sd_label, instance);
9017 
9018 	un->un_errstats = kstat_create(kstatmodule_err, instance, kstatname,
9019 	    "device_error", KSTAT_TYPE_NAMED, ndata, KSTAT_FLAG_PERSISTENT);
9020 
9021 	if (un->un_errstats == NULL) {
9022 		SD_ERROR(SD_LOG_ATTACH_DETACH, un,
9023 		    "sd_create_errstats: Failed kstat_create\n");
9024 		return;
9025 	}
9026 
9027 	stp = (struct sd_errstats *)un->un_errstats->ks_data;
9028 	kstat_named_init(&stp->sd_softerrs,	"Soft Errors",
9029 	    KSTAT_DATA_UINT32);
9030 	kstat_named_init(&stp->sd_harderrs,	"Hard Errors",
9031 	    KSTAT_DATA_UINT32);
9032 	kstat_named_init(&stp->sd_transerrs,	"Transport Errors",
9033 	    KSTAT_DATA_UINT32);
9034 	kstat_named_init(&stp->sd_vid,		"Vendor",
9035 	    KSTAT_DATA_CHAR);
9036 	kstat_named_init(&stp->sd_pid,		"Product",
9037 	    KSTAT_DATA_CHAR);
9038 	kstat_named_init(&stp->sd_revision,	"Revision",
9039 	    KSTAT_DATA_CHAR);
9040 	kstat_named_init(&stp->sd_serial,	"Serial No",
9041 	    KSTAT_DATA_CHAR);
9042 	kstat_named_init(&stp->sd_capacity,	"Size",
9043 	    KSTAT_DATA_ULONGLONG);
9044 	kstat_named_init(&stp->sd_rq_media_err,	"Media Error",
9045 	    KSTAT_DATA_UINT32);
9046 	kstat_named_init(&stp->sd_rq_ntrdy_err,	"Device Not Ready",
9047 	    KSTAT_DATA_UINT32);
9048 	kstat_named_init(&stp->sd_rq_nodev_err,	"No Device",
9049 	    KSTAT_DATA_UINT32);
9050 	kstat_named_init(&stp->sd_rq_recov_err,	"Recoverable",
9051 	    KSTAT_DATA_UINT32);
9052 	kstat_named_init(&stp->sd_rq_illrq_err,	"Illegal Request",
9053 	    KSTAT_DATA_UINT32);
9054 	kstat_named_init(&stp->sd_rq_pfa_err,	"Predictive Failure Analysis",
9055 	    KSTAT_DATA_UINT32);
9056 
9057 	un->un_errstats->ks_private = un;
9058 	un->un_errstats->ks_update  = nulldev;
9059 
9060 	kstat_install(un->un_errstats);
9061 }
9062 
9063 
9064 /*
9065  *    Function: sd_set_errstats
9066  *
9067  * Description: This routine sets the value of the vendor id, product id,
9068  *		revision, serial number, and capacity device error stats.
9069  *
9070  *		Note: During attach the stats are instantiated first so they are
9071  *		available for attach-time routines that utilize the driver
9072  *		iopath to send commands to the device. The stats are initialized
9073  *		separately so data obtained during some attach-time routines is
9074  *		available. (4362483)
9075  *
9076  *   Arguments: un - driver soft state (unit) structure
9077  *
9078  *     Context: Kernel thread context
9079  */
9080 
9081 static void
9082 sd_set_errstats(struct sd_lun *un)
9083 {
9084 	struct	sd_errstats	*stp;
9085 
9086 	ASSERT(un != NULL);
9087 	ASSERT(un->un_errstats != NULL);
9088 	stp = (struct sd_errstats *)un->un_errstats->ks_data;
9089 	ASSERT(stp != NULL);
9090 	(void) strncpy(stp->sd_vid.value.c, un->un_sd->sd_inq->inq_vid, 8);
9091 	(void) strncpy(stp->sd_pid.value.c, un->un_sd->sd_inq->inq_pid, 16);
9092 	(void) strncpy(stp->sd_revision.value.c,
9093 	    un->un_sd->sd_inq->inq_revision, 4);
9094 
9095 	/*
9096 	 * All the errstats are persistent across detach/attach,
9097 	 * so reset all the errstats here in case of the hot
9098 	 * replacement of disk drives, except for not changed
9099 	 * Sun qualified drives.
9100 	 */
9101 	if ((bcmp(&SD_INQUIRY(un)->inq_pid[9], "SUN", 3) != 0) ||
9102 	    (bcmp(&SD_INQUIRY(un)->inq_serial, stp->sd_serial.value.c,
9103 	    sizeof (SD_INQUIRY(un)->inq_serial)) != 0)) {
9104 		stp->sd_softerrs.value.ui32 = 0;
9105 		stp->sd_harderrs.value.ui32 = 0;
9106 		stp->sd_transerrs.value.ui32 = 0;
9107 		stp->sd_rq_media_err.value.ui32 = 0;
9108 		stp->sd_rq_ntrdy_err.value.ui32 = 0;
9109 		stp->sd_rq_nodev_err.value.ui32 = 0;
9110 		stp->sd_rq_recov_err.value.ui32 = 0;
9111 		stp->sd_rq_illrq_err.value.ui32 = 0;
9112 		stp->sd_rq_pfa_err.value.ui32 = 0;
9113 	}
9114 
9115 	/*
9116 	 * Set the "Serial No" kstat for Sun qualified drives (indicated by
9117 	 * "SUN" in bytes 25-27 of the inquiry data (bytes 9-11 of the pid)
9118 	 * (4376302))
9119 	 */
9120 	if (bcmp(&SD_INQUIRY(un)->inq_pid[9], "SUN", 3) == 0) {
9121 		bcopy(&SD_INQUIRY(un)->inq_serial, stp->sd_serial.value.c,
9122 		    sizeof (SD_INQUIRY(un)->inq_serial));
9123 	}
9124 
9125 	if (un->un_f_blockcount_is_valid != TRUE) {
9126 		/*
9127 		 * Set capacity error stat to 0 for no media. This ensures
9128 		 * a valid capacity is displayed in response to 'iostat -E'
9129 		 * when no media is present in the device.
9130 		 */
9131 		stp->sd_capacity.value.ui64 = 0;
9132 	} else {
9133 		/*
9134 		 * Multiply un_blockcount by un->un_sys_blocksize to get
9135 		 * capacity.
9136 		 *
9137 		 * Note: for non-512 blocksize devices "un_blockcount" has been
9138 		 * "scaled" in sd_send_scsi_READ_CAPACITY by multiplying by
9139 		 * (un_tgt_blocksize / un->un_sys_blocksize).
9140 		 */
9141 		stp->sd_capacity.value.ui64 = (uint64_t)
9142 		    ((uint64_t)un->un_blockcount * un->un_sys_blocksize);
9143 	}
9144 }
9145 
9146 
9147 /*
9148  *    Function: sd_set_pstats
9149  *
9150  * Description: This routine instantiates and initializes the partition
9151  *              stats for each partition with more than zero blocks.
9152  *		(4363169)
9153  *
9154  *   Arguments: un - driver soft state (unit) structure
9155  *
9156  *     Context: Kernel thread context
9157  */
9158 
9159 static void
9160 sd_set_pstats(struct sd_lun *un)
9161 {
9162 	char	kstatname[KSTAT_STRLEN];
9163 	int	instance;
9164 	int	i;
9165 	diskaddr_t	nblks = 0;
9166 	char	*partname = NULL;
9167 
9168 	ASSERT(un != NULL);
9169 
9170 	instance = ddi_get_instance(SD_DEVINFO(un));
9171 
9172 	/* Note:x86: is this a VTOC8/VTOC16 difference? */
9173 	for (i = 0; i < NSDMAP; i++) {
9174 
9175 		if (cmlb_partinfo(un->un_cmlbhandle, i,
9176 		    &nblks, NULL, &partname, NULL, (void *)SD_PATH_DIRECT) != 0)
9177 			continue;
9178 		mutex_enter(SD_MUTEX(un));
9179 
9180 		if ((un->un_pstats[i] == NULL) &&
9181 		    (nblks != 0)) {
9182 
9183 			(void) snprintf(kstatname, sizeof (kstatname),
9184 			    "%s%d,%s", sd_label, instance,
9185 			    partname);
9186 
9187 			un->un_pstats[i] = kstat_create(sd_label,
9188 			    instance, kstatname, "partition", KSTAT_TYPE_IO,
9189 			    1, KSTAT_FLAG_PERSISTENT);
9190 			if (un->un_pstats[i] != NULL) {
9191 				un->un_pstats[i]->ks_lock = SD_MUTEX(un);
9192 				kstat_install(un->un_pstats[i]);
9193 			}
9194 		}
9195 		mutex_exit(SD_MUTEX(un));
9196 	}
9197 }
9198 
9199 
9200 #if (defined(__fibre))
9201 /*
9202  *    Function: sd_init_event_callbacks
9203  *
9204  * Description: This routine initializes the insertion and removal event
9205  *		callbacks. (fibre only)
9206  *
9207  *   Arguments: un - driver soft state (unit) structure
9208  *
9209  *     Context: Kernel thread context
9210  */
9211 
9212 static void
9213 sd_init_event_callbacks(struct sd_lun *un)
9214 {
9215 	ASSERT(un != NULL);
9216 
9217 	if ((un->un_insert_event == NULL) &&
9218 	    (ddi_get_eventcookie(SD_DEVINFO(un), FCAL_INSERT_EVENT,
9219 	    &un->un_insert_event) == DDI_SUCCESS)) {
9220 		/*
9221 		 * Add the callback for an insertion event
9222 		 */
9223 		(void) ddi_add_event_handler(SD_DEVINFO(un),
9224 		    un->un_insert_event, sd_event_callback, (void *)un,
9225 		    &(un->un_insert_cb_id));
9226 	}
9227 
9228 	if ((un->un_remove_event == NULL) &&
9229 	    (ddi_get_eventcookie(SD_DEVINFO(un), FCAL_REMOVE_EVENT,
9230 	    &un->un_remove_event) == DDI_SUCCESS)) {
9231 		/*
9232 		 * Add the callback for a removal event
9233 		 */
9234 		(void) ddi_add_event_handler(SD_DEVINFO(un),
9235 		    un->un_remove_event, sd_event_callback, (void *)un,
9236 		    &(un->un_remove_cb_id));
9237 	}
9238 }
9239 
9240 
9241 /*
9242  *    Function: sd_event_callback
9243  *
9244  * Description: This routine handles insert/remove events (photon). The
9245  *		state is changed to OFFLINE which can be used to supress
9246  *		error msgs. (fibre only)
9247  *
9248  *   Arguments: un - driver soft state (unit) structure
9249  *
9250  *     Context: Callout thread context
9251  */
9252 /* ARGSUSED */
9253 static void
9254 sd_event_callback(dev_info_t *dip, ddi_eventcookie_t event, void *arg,
9255     void *bus_impldata)
9256 {
9257 	struct sd_lun *un = (struct sd_lun *)arg;
9258 
9259 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::un_insert_event));
9260 	if (event == un->un_insert_event) {
9261 		SD_TRACE(SD_LOG_COMMON, un, "sd_event_callback: insert event");
9262 		mutex_enter(SD_MUTEX(un));
9263 		if (un->un_state == SD_STATE_OFFLINE) {
9264 			if (un->un_last_state != SD_STATE_SUSPENDED) {
9265 				un->un_state = un->un_last_state;
9266 			} else {
9267 				/*
9268 				 * We have gone through SUSPEND/RESUME while
9269 				 * we were offline. Restore the last state
9270 				 */
9271 				un->un_state = un->un_save_state;
9272 			}
9273 		}
9274 		mutex_exit(SD_MUTEX(un));
9275 
9276 	_NOTE(DATA_READABLE_WITHOUT_LOCK(sd_lun::un_remove_event));
9277 	} else if (event == un->un_remove_event) {
9278 		SD_TRACE(SD_LOG_COMMON, un, "sd_event_callback: remove event");
9279 		mutex_enter(SD_MUTEX(un));
9280 		/*
9281 		 * We need to handle an event callback that occurs during
9282 		 * the suspend operation, since we don't prevent it.
9283 		 */
9284 		if (un->un_state != SD_STATE_OFFLINE) {
9285 			if (un->un_state != SD_STATE_SUSPENDED) {
9286 				New_state(un, SD_STATE_OFFLINE);
9287 			} else {
9288 				un->un_last_state = SD_STATE_OFFLINE;
9289 			}
9290 		}
9291 		mutex_exit(SD_MUTEX(un));
9292 	} else {
9293 		scsi_log(SD_DEVINFO(un), sd_label, CE_NOTE,
9294 		    "!Unknown event\n");
9295 	}
9296 
9297 }
9298 #endif
9299 
9300 /*
9301  *    Function: sd_cache_control()
9302  *
9303  * Description: This routine is the driver entry point for setting
9304  *		read and write caching by modifying the WCE (write cache
9305  *		enable) and RCD (read cache disable) bits of mode
9306  *		page 8 (MODEPAGE_CACHING).
9307  *
9308  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
9309  *                      structure for this target.
9310  *		rcd_flag - flag for controlling the read cache
9311  *		wce_flag - flag for controlling the write cache
9312  *
9313  * Return Code: EIO
9314  *		code returned by sd_send_scsi_MODE_SENSE and
9315  *		sd_send_scsi_MODE_SELECT
9316  *
9317  *     Context: Kernel Thread
9318  */
9319 
9320 static int
9321 sd_cache_control(sd_ssc_t *ssc, int rcd_flag, int wce_flag)
9322 {
9323 	struct mode_caching	*mode_caching_page;
9324 	uchar_t			*header;
9325 	size_t			buflen;
9326 	int			hdrlen;
9327 	int			bd_len;
9328 	int			rval = 0;
9329 	struct mode_header_grp2	*mhp;
9330 	struct sd_lun		*un;
9331 	int			status;
9332 
9333 	ASSERT(ssc != NULL);
9334 	un = ssc->ssc_un;
9335 	ASSERT(un != NULL);
9336 
9337 	/*
9338 	 * Do a test unit ready, otherwise a mode sense may not work if this
9339 	 * is the first command sent to the device after boot.
9340 	 */
9341 	status = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
9342 	if (status != 0)
9343 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9344 
9345 	if (un->un_f_cfg_is_atapi == TRUE) {
9346 		hdrlen = MODE_HEADER_LENGTH_GRP2;
9347 	} else {
9348 		hdrlen = MODE_HEADER_LENGTH;
9349 	}
9350 
9351 	/*
9352 	 * Allocate memory for the retrieved mode page and its headers.  Set
9353 	 * a pointer to the page itself.  Use mode_cache_scsi3 to insure
9354 	 * we get all of the mode sense data otherwise, the mode select
9355 	 * will fail.  mode_cache_scsi3 is a superset of mode_caching.
9356 	 */
9357 	buflen = hdrlen + MODE_BLK_DESC_LENGTH +
9358 	    sizeof (struct mode_cache_scsi3);
9359 
9360 	header = kmem_zalloc(buflen, KM_SLEEP);
9361 
9362 	/* Get the information from the device. */
9363 	if (un->un_f_cfg_is_atapi == TRUE) {
9364 		rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, header, buflen,
9365 		    MODEPAGE_CACHING, SD_PATH_DIRECT);
9366 	} else {
9367 		rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, header, buflen,
9368 		    MODEPAGE_CACHING, SD_PATH_DIRECT);
9369 	}
9370 
9371 	if (rval != 0) {
9372 		SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un,
9373 		    "sd_cache_control: Mode Sense Failed\n");
9374 		goto mode_sense_failed;
9375 	}
9376 
9377 	/*
9378 	 * Determine size of Block Descriptors in order to locate
9379 	 * the mode page data. ATAPI devices return 0, SCSI devices
9380 	 * should return MODE_BLK_DESC_LENGTH.
9381 	 */
9382 	if (un->un_f_cfg_is_atapi == TRUE) {
9383 		mhp	= (struct mode_header_grp2 *)header;
9384 		bd_len  = (mhp->bdesc_length_hi << 8) | mhp->bdesc_length_lo;
9385 	} else {
9386 		bd_len  = ((struct mode_header *)header)->bdesc_length;
9387 	}
9388 
9389 	if (bd_len > MODE_BLK_DESC_LENGTH) {
9390 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, 0,
9391 		    "sd_cache_control: Mode Sense returned invalid block "
9392 		    "descriptor length\n");
9393 		rval = EIO;
9394 		goto mode_sense_failed;
9395 	}
9396 
9397 	mode_caching_page = (struct mode_caching *)(header + hdrlen + bd_len);
9398 	if (mode_caching_page->mode_page.code != MODEPAGE_CACHING) {
9399 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
9400 		    "sd_cache_control: Mode Sense caching page code mismatch "
9401 		    "%d\n", mode_caching_page->mode_page.code);
9402 		rval = EIO;
9403 		goto mode_sense_failed;
9404 	}
9405 
9406 	/* Check the relevant bits on successful mode sense. */
9407 	if ((mode_caching_page->rcd && rcd_flag == SD_CACHE_ENABLE) ||
9408 	    (!mode_caching_page->rcd && rcd_flag == SD_CACHE_DISABLE) ||
9409 	    (mode_caching_page->wce && wce_flag == SD_CACHE_DISABLE) ||
9410 	    (!mode_caching_page->wce && wce_flag == SD_CACHE_ENABLE)) {
9411 
9412 		size_t sbuflen;
9413 		uchar_t save_pg;
9414 
9415 		/*
9416 		 * Construct select buffer length based on the
9417 		 * length of the sense data returned.
9418 		 */
9419 		sbuflen =  hdrlen + bd_len +
9420 		    sizeof (struct mode_page) +
9421 		    (int)mode_caching_page->mode_page.length;
9422 
9423 		/*
9424 		 * Set the caching bits as requested.
9425 		 */
9426 		if (rcd_flag == SD_CACHE_ENABLE)
9427 			mode_caching_page->rcd = 0;
9428 		else if (rcd_flag == SD_CACHE_DISABLE)
9429 			mode_caching_page->rcd = 1;
9430 
9431 		if (wce_flag == SD_CACHE_ENABLE)
9432 			mode_caching_page->wce = 1;
9433 		else if (wce_flag == SD_CACHE_DISABLE)
9434 			mode_caching_page->wce = 0;
9435 
9436 		/*
9437 		 * Save the page if the mode sense says the
9438 		 * drive supports it.
9439 		 */
9440 		save_pg = mode_caching_page->mode_page.ps ?
9441 		    SD_SAVE_PAGE : SD_DONTSAVE_PAGE;
9442 
9443 		/* Clear reserved bits before mode select. */
9444 		mode_caching_page->mode_page.ps = 0;
9445 
9446 		/*
9447 		 * Clear out mode header for mode select.
9448 		 * The rest of the retrieved page will be reused.
9449 		 */
9450 		bzero(header, hdrlen);
9451 
9452 		if (un->un_f_cfg_is_atapi == TRUE) {
9453 			mhp = (struct mode_header_grp2 *)header;
9454 			mhp->bdesc_length_hi = bd_len >> 8;
9455 			mhp->bdesc_length_lo = (uchar_t)bd_len & 0xff;
9456 		} else {
9457 			((struct mode_header *)header)->bdesc_length = bd_len;
9458 		}
9459 
9460 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9461 
9462 		/* Issue mode select to change the cache settings */
9463 		if (un->un_f_cfg_is_atapi == TRUE) {
9464 			rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP1, header,
9465 			    sbuflen, save_pg, SD_PATH_DIRECT);
9466 		} else {
9467 			rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, header,
9468 			    sbuflen, save_pg, SD_PATH_DIRECT);
9469 		}
9470 
9471 	}
9472 
9473 
9474 mode_sense_failed:
9475 
9476 	kmem_free(header, buflen);
9477 
9478 	if (rval != 0) {
9479 		if (rval == EIO)
9480 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
9481 		else
9482 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9483 	}
9484 	return (rval);
9485 }
9486 
9487 
9488 /*
9489  *    Function: sd_get_write_cache_enabled()
9490  *
9491  * Description: This routine is the driver entry point for determining if
9492  *		write caching is enabled.  It examines the WCE (write cache
9493  *		enable) bits of mode page 8 (MODEPAGE_CACHING).
9494  *
9495  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
9496  *                      structure for this target.
9497  *		is_enabled - pointer to int where write cache enabled state
9498  *		is returned (non-zero -> write cache enabled)
9499  *
9500  *
9501  * Return Code: EIO
9502  *		code returned by sd_send_scsi_MODE_SENSE
9503  *
9504  *     Context: Kernel Thread
9505  *
9506  * NOTE: If ioctl is added to disable write cache, this sequence should
9507  * be followed so that no locking is required for accesses to
9508  * un->un_f_write_cache_enabled:
9509  * 	do mode select to clear wce
9510  * 	do synchronize cache to flush cache
9511  * 	set un->un_f_write_cache_enabled = FALSE
9512  *
9513  * Conversely, an ioctl to enable the write cache should be done
9514  * in this order:
9515  * 	set un->un_f_write_cache_enabled = TRUE
9516  * 	do mode select to set wce
9517  */
9518 
9519 static int
9520 sd_get_write_cache_enabled(sd_ssc_t *ssc, int *is_enabled)
9521 {
9522 	struct mode_caching	*mode_caching_page;
9523 	uchar_t			*header;
9524 	size_t			buflen;
9525 	int			hdrlen;
9526 	int			bd_len;
9527 	int			rval = 0;
9528 	struct sd_lun		*un;
9529 	int			status;
9530 
9531 	ASSERT(ssc != NULL);
9532 	un = ssc->ssc_un;
9533 	ASSERT(un != NULL);
9534 	ASSERT(is_enabled != NULL);
9535 
9536 	/* in case of error, flag as enabled */
9537 	*is_enabled = TRUE;
9538 
9539 	/*
9540 	 * Do a test unit ready, otherwise a mode sense may not work if this
9541 	 * is the first command sent to the device after boot.
9542 	 */
9543 	status = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
9544 
9545 	if (status != 0)
9546 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9547 
9548 	if (un->un_f_cfg_is_atapi == TRUE) {
9549 		hdrlen = MODE_HEADER_LENGTH_GRP2;
9550 	} else {
9551 		hdrlen = MODE_HEADER_LENGTH;
9552 	}
9553 
9554 	/*
9555 	 * Allocate memory for the retrieved mode page and its headers.  Set
9556 	 * a pointer to the page itself.
9557 	 */
9558 	buflen = hdrlen + MODE_BLK_DESC_LENGTH + sizeof (struct mode_caching);
9559 	header = kmem_zalloc(buflen, KM_SLEEP);
9560 
9561 	/* Get the information from the device. */
9562 	if (un->un_f_cfg_is_atapi == TRUE) {
9563 		rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, header, buflen,
9564 		    MODEPAGE_CACHING, SD_PATH_DIRECT);
9565 	} else {
9566 		rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, header, buflen,
9567 		    MODEPAGE_CACHING, SD_PATH_DIRECT);
9568 	}
9569 
9570 	if (rval != 0) {
9571 		SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un,
9572 		    "sd_get_write_cache_enabled: Mode Sense Failed\n");
9573 		goto mode_sense_failed;
9574 	}
9575 
9576 	/*
9577 	 * Determine size of Block Descriptors in order to locate
9578 	 * the mode page data. ATAPI devices return 0, SCSI devices
9579 	 * should return MODE_BLK_DESC_LENGTH.
9580 	 */
9581 	if (un->un_f_cfg_is_atapi == TRUE) {
9582 		struct mode_header_grp2	*mhp;
9583 		mhp	= (struct mode_header_grp2 *)header;
9584 		bd_len  = (mhp->bdesc_length_hi << 8) | mhp->bdesc_length_lo;
9585 	} else {
9586 		bd_len  = ((struct mode_header *)header)->bdesc_length;
9587 	}
9588 
9589 	if (bd_len > MODE_BLK_DESC_LENGTH) {
9590 		/* FMA should make upset complain here */
9591 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, 0,
9592 		    "sd_get_write_cache_enabled: Mode Sense returned invalid "
9593 		    "block descriptor length\n");
9594 		rval = EIO;
9595 		goto mode_sense_failed;
9596 	}
9597 
9598 	mode_caching_page = (struct mode_caching *)(header + hdrlen + bd_len);
9599 	if (mode_caching_page->mode_page.code != MODEPAGE_CACHING) {
9600 		/* FMA could make upset complain here */
9601 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, SD_LOG_COMMON,
9602 		    "sd_get_write_cache_enabled: Mode Sense caching page "
9603 		    "code mismatch %d\n", mode_caching_page->mode_page.code);
9604 		rval = EIO;
9605 		goto mode_sense_failed;
9606 	}
9607 	*is_enabled = mode_caching_page->wce;
9608 
9609 mode_sense_failed:
9610 	if (rval == 0) {
9611 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
9612 	} else if (rval == EIO) {
9613 		/*
9614 		 * Some disks do not support mode sense(6), we
9615 		 * should ignore this kind of error(sense key is
9616 		 * 0x5 - illegal request).
9617 		 */
9618 		uint8_t *sensep;
9619 		int senlen;
9620 
9621 		sensep = (uint8_t *)ssc->ssc_uscsi_cmd->uscsi_rqbuf;
9622 		senlen = (int)(ssc->ssc_uscsi_cmd->uscsi_rqlen -
9623 		    ssc->ssc_uscsi_cmd->uscsi_rqresid);
9624 
9625 		if (senlen > 0 &&
9626 		    scsi_sense_key(sensep) == KEY_ILLEGAL_REQUEST) {
9627 			sd_ssc_assessment(ssc, SD_FMT_IGNORE_COMPROMISE);
9628 		} else {
9629 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
9630 		}
9631 	} else {
9632 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9633 	}
9634 	kmem_free(header, buflen);
9635 	return (rval);
9636 }
9637 
9638 /*
9639  *    Function: sd_get_nv_sup()
9640  *
9641  * Description: This routine is the driver entry point for
9642  * determining whether non-volatile cache is supported. This
9643  * determination process works as follows:
9644  *
9645  * 1. sd first queries sd.conf on whether
9646  * suppress_cache_flush bit is set for this device.
9647  *
9648  * 2. if not there, then queries the internal disk table.
9649  *
9650  * 3. if either sd.conf or internal disk table specifies
9651  * cache flush be suppressed, we don't bother checking
9652  * NV_SUP bit.
9653  *
9654  * If SUPPRESS_CACHE_FLUSH bit is not set to 1, sd queries
9655  * the optional INQUIRY VPD page 0x86. If the device
9656  * supports VPD page 0x86, sd examines the NV_SUP
9657  * (non-volatile cache support) bit in the INQUIRY VPD page
9658  * 0x86:
9659  *   o If NV_SUP bit is set, sd assumes the device has a
9660  *   non-volatile cache and set the
9661  *   un_f_sync_nv_supported to TRUE.
9662  *   o Otherwise cache is not non-volatile,
9663  *   un_f_sync_nv_supported is set to FALSE.
9664  *
9665  * Arguments: un - driver soft state (unit) structure
9666  *
9667  * Return Code:
9668  *
9669  *     Context: Kernel Thread
9670  */
9671 
9672 static void
9673 sd_get_nv_sup(sd_ssc_t *ssc)
9674 {
9675 	int		rval		= 0;
9676 	uchar_t		*inq86		= NULL;
9677 	size_t		inq86_len	= MAX_INQUIRY_SIZE;
9678 	size_t		inq86_resid	= 0;
9679 	struct		dk_callback *dkc;
9680 	struct sd_lun	*un;
9681 
9682 	ASSERT(ssc != NULL);
9683 	un = ssc->ssc_un;
9684 	ASSERT(un != NULL);
9685 
9686 	mutex_enter(SD_MUTEX(un));
9687 
9688 	/*
9689 	 * Be conservative on the device's support of
9690 	 * SYNC_NV bit: un_f_sync_nv_supported is
9691 	 * initialized to be false.
9692 	 */
9693 	un->un_f_sync_nv_supported = FALSE;
9694 
9695 	/*
9696 	 * If either sd.conf or internal disk table
9697 	 * specifies cache flush be suppressed, then
9698 	 * we don't bother checking NV_SUP bit.
9699 	 */
9700 	if (un->un_f_suppress_cache_flush == TRUE) {
9701 		mutex_exit(SD_MUTEX(un));
9702 		return;
9703 	}
9704 
9705 	if (sd_check_vpd_page_support(ssc) == 0 &&
9706 	    un->un_vpd_page_mask & SD_VPD_EXTENDED_DATA_PG) {
9707 		mutex_exit(SD_MUTEX(un));
9708 		/* collect page 86 data if available */
9709 		inq86 = kmem_zalloc(inq86_len, KM_SLEEP);
9710 
9711 		rval = sd_send_scsi_INQUIRY(ssc, inq86, inq86_len,
9712 		    0x01, 0x86, &inq86_resid);
9713 
9714 		if (rval == 0 && (inq86_len - inq86_resid > 6)) {
9715 			SD_TRACE(SD_LOG_COMMON, un,
9716 			    "sd_get_nv_sup: \
9717 			    successfully get VPD page: %x \
9718 			    PAGE LENGTH: %x BYTE 6: %x\n",
9719 			    inq86[1], inq86[3], inq86[6]);
9720 
9721 			mutex_enter(SD_MUTEX(un));
9722 			/*
9723 			 * check the value of NV_SUP bit: only if the device
9724 			 * reports NV_SUP bit to be 1, the
9725 			 * un_f_sync_nv_supported bit will be set to true.
9726 			 */
9727 			if (inq86[6] & SD_VPD_NV_SUP) {
9728 				un->un_f_sync_nv_supported = TRUE;
9729 			}
9730 			mutex_exit(SD_MUTEX(un));
9731 		} else if (rval != 0) {
9732 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9733 		}
9734 
9735 		kmem_free(inq86, inq86_len);
9736 	} else {
9737 		mutex_exit(SD_MUTEX(un));
9738 	}
9739 
9740 	/*
9741 	 * Send a SYNC CACHE command to check whether
9742 	 * SYNC_NV bit is supported. This command should have
9743 	 * un_f_sync_nv_supported set to correct value.
9744 	 */
9745 	mutex_enter(SD_MUTEX(un));
9746 	if (un->un_f_sync_nv_supported) {
9747 		mutex_exit(SD_MUTEX(un));
9748 		dkc = kmem_zalloc(sizeof (struct dk_callback), KM_SLEEP);
9749 		dkc->dkc_flag = FLUSH_VOLATILE;
9750 		(void) sd_send_scsi_SYNCHRONIZE_CACHE(un, dkc);
9751 
9752 		/*
9753 		 * Send a TEST UNIT READY command to the device. This should
9754 		 * clear any outstanding UNIT ATTENTION that may be present.
9755 		 */
9756 		rval = sd_send_scsi_TEST_UNIT_READY(ssc, SD_DONT_RETRY_TUR);
9757 		if (rval != 0)
9758 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
9759 
9760 		kmem_free(dkc, sizeof (struct dk_callback));
9761 	} else {
9762 		mutex_exit(SD_MUTEX(un));
9763 	}
9764 
9765 	SD_TRACE(SD_LOG_COMMON, un, "sd_get_nv_sup: \
9766 	    un_f_suppress_cache_flush is set to %d\n",
9767 	    un->un_f_suppress_cache_flush);
9768 }
9769 
9770 /*
9771  *    Function: sd_make_device
9772  *
9773  * Description: Utility routine to return the Solaris device number from
9774  *		the data in the device's dev_info structure.
9775  *
9776  * Return Code: The Solaris device number
9777  *
9778  *     Context: Any
9779  */
9780 
9781 static dev_t
9782 sd_make_device(dev_info_t *devi)
9783 {
9784 	return (makedevice(ddi_driver_major(devi),
9785 	    ddi_get_instance(devi) << SDUNIT_SHIFT));
9786 }
9787 
9788 
9789 /*
9790  *    Function: sd_pm_entry
9791  *
9792  * Description: Called at the start of a new command to manage power
9793  *		and busy status of a device. This includes determining whether
9794  *		the current power state of the device is sufficient for
9795  *		performing the command or whether it must be changed.
9796  *		The PM framework is notified appropriately.
9797  *		Only with a return status of DDI_SUCCESS will the
9798  *		component be busy to the framework.
9799  *
9800  *		All callers of sd_pm_entry must check the return status
9801  *		and only call sd_pm_exit it it was DDI_SUCCESS. A status
9802  *		of DDI_FAILURE indicates the device failed to power up.
9803  *		In this case un_pm_count has been adjusted so the result
9804  *		on exit is still powered down, ie. count is less than 0.
9805  *		Calling sd_pm_exit with this count value hits an ASSERT.
9806  *
9807  * Return Code: DDI_SUCCESS or DDI_FAILURE
9808  *
9809  *     Context: Kernel thread context.
9810  */
9811 
9812 static int
9813 sd_pm_entry(struct sd_lun *un)
9814 {
9815 	int return_status = DDI_SUCCESS;
9816 
9817 	ASSERT(!mutex_owned(SD_MUTEX(un)));
9818 	ASSERT(!mutex_owned(&un->un_pm_mutex));
9819 
9820 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_entry: entry\n");
9821 
9822 	if (un->un_f_pm_is_enabled == FALSE) {
9823 		SD_TRACE(SD_LOG_IO_PM, un,
9824 		    "sd_pm_entry: exiting, PM not enabled\n");
9825 		return (return_status);
9826 	}
9827 
9828 	/*
9829 	 * Just increment a counter if PM is enabled. On the transition from
9830 	 * 0 ==> 1, mark the device as busy.  The iodone side will decrement
9831 	 * the count with each IO and mark the device as idle when the count
9832 	 * hits 0.
9833 	 *
9834 	 * If the count is less than 0 the device is powered down. If a powered
9835 	 * down device is successfully powered up then the count must be
9836 	 * incremented to reflect the power up. Note that it'll get incremented
9837 	 * a second time to become busy.
9838 	 *
9839 	 * Because the following has the potential to change the device state
9840 	 * and must release the un_pm_mutex to do so, only one thread can be
9841 	 * allowed through at a time.
9842 	 */
9843 
9844 	mutex_enter(&un->un_pm_mutex);
9845 	while (un->un_pm_busy == TRUE) {
9846 		cv_wait(&un->un_pm_busy_cv, &un->un_pm_mutex);
9847 	}
9848 	un->un_pm_busy = TRUE;
9849 
9850 	if (un->un_pm_count < 1) {
9851 
9852 		SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_entry: busy component\n");
9853 
9854 		/*
9855 		 * Indicate we are now busy so the framework won't attempt to
9856 		 * power down the device. This call will only fail if either
9857 		 * we passed a bad component number or the device has no
9858 		 * components. Neither of these should ever happen.
9859 		 */
9860 		mutex_exit(&un->un_pm_mutex);
9861 		return_status = pm_busy_component(SD_DEVINFO(un), 0);
9862 		ASSERT(return_status == DDI_SUCCESS);
9863 
9864 		mutex_enter(&un->un_pm_mutex);
9865 
9866 		if (un->un_pm_count < 0) {
9867 			mutex_exit(&un->un_pm_mutex);
9868 
9869 			SD_TRACE(SD_LOG_IO_PM, un,
9870 			    "sd_pm_entry: power up component\n");
9871 
9872 			/*
9873 			 * pm_raise_power will cause sdpower to be called
9874 			 * which brings the device power level to the
9875 			 * desired state, If successful, un_pm_count and
9876 			 * un_power_level will be updated appropriately.
9877 			 */
9878 			return_status = pm_raise_power(SD_DEVINFO(un), 0,
9879 			    SD_PM_STATE_ACTIVE(un));
9880 
9881 			mutex_enter(&un->un_pm_mutex);
9882 
9883 			if (return_status != DDI_SUCCESS) {
9884 				/*
9885 				 * Power up failed.
9886 				 * Idle the device and adjust the count
9887 				 * so the result on exit is that we're
9888 				 * still powered down, ie. count is less than 0.
9889 				 */
9890 				SD_TRACE(SD_LOG_IO_PM, un,
9891 				    "sd_pm_entry: power up failed,"
9892 				    " idle the component\n");
9893 
9894 				(void) pm_idle_component(SD_DEVINFO(un), 0);
9895 				un->un_pm_count--;
9896 			} else {
9897 				/*
9898 				 * Device is powered up, verify the
9899 				 * count is non-negative.
9900 				 * This is debug only.
9901 				 */
9902 				ASSERT(un->un_pm_count == 0);
9903 			}
9904 		}
9905 
9906 		if (return_status == DDI_SUCCESS) {
9907 			/*
9908 			 * For performance, now that the device has been tagged
9909 			 * as busy, and it's known to be powered up, update the
9910 			 * chain types to use jump tables that do not include
9911 			 * pm. This significantly lowers the overhead and
9912 			 * therefore improves performance.
9913 			 */
9914 
9915 			mutex_exit(&un->un_pm_mutex);
9916 			mutex_enter(SD_MUTEX(un));
9917 			SD_TRACE(SD_LOG_IO_PM, un,
9918 			    "sd_pm_entry: changing uscsi_chain_type from %d\n",
9919 			    un->un_uscsi_chain_type);
9920 
9921 			if (un->un_f_non_devbsize_supported) {
9922 				un->un_buf_chain_type =
9923 				    SD_CHAIN_INFO_RMMEDIA_NO_PM;
9924 			} else {
9925 				un->un_buf_chain_type =
9926 				    SD_CHAIN_INFO_DISK_NO_PM;
9927 			}
9928 			un->un_uscsi_chain_type = SD_CHAIN_INFO_USCSI_CMD_NO_PM;
9929 
9930 			SD_TRACE(SD_LOG_IO_PM, un,
9931 			    "             changed  uscsi_chain_type to   %d\n",
9932 			    un->un_uscsi_chain_type);
9933 			mutex_exit(SD_MUTEX(un));
9934 			mutex_enter(&un->un_pm_mutex);
9935 
9936 			if (un->un_pm_idle_timeid == NULL) {
9937 				/* 300 ms. */
9938 				un->un_pm_idle_timeid =
9939 				    timeout(sd_pm_idletimeout_handler, un,
9940 				    (drv_usectohz((clock_t)300000)));
9941 				/*
9942 				 * Include an extra call to busy which keeps the
9943 				 * device busy with-respect-to the PM layer
9944 				 * until the timer fires, at which time it'll
9945 				 * get the extra idle call.
9946 				 */
9947 				(void) pm_busy_component(SD_DEVINFO(un), 0);
9948 			}
9949 		}
9950 	}
9951 	un->un_pm_busy = FALSE;
9952 	/* Next... */
9953 	cv_signal(&un->un_pm_busy_cv);
9954 
9955 	un->un_pm_count++;
9956 
9957 	SD_TRACE(SD_LOG_IO_PM, un,
9958 	    "sd_pm_entry: exiting, un_pm_count = %d\n", un->un_pm_count);
9959 
9960 	mutex_exit(&un->un_pm_mutex);
9961 
9962 	return (return_status);
9963 }
9964 
9965 
9966 /*
9967  *    Function: sd_pm_exit
9968  *
9969  * Description: Called at the completion of a command to manage busy
9970  *		status for the device. If the device becomes idle the
9971  *		PM framework is notified.
9972  *
9973  *     Context: Kernel thread context
9974  */
9975 
9976 static void
9977 sd_pm_exit(struct sd_lun *un)
9978 {
9979 	ASSERT(!mutex_owned(SD_MUTEX(un)));
9980 	ASSERT(!mutex_owned(&un->un_pm_mutex));
9981 
9982 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_exit: entry\n");
9983 
9984 	/*
9985 	 * After attach the following flag is only read, so don't
9986 	 * take the penalty of acquiring a mutex for it.
9987 	 */
9988 	if (un->un_f_pm_is_enabled == TRUE) {
9989 
9990 		mutex_enter(&un->un_pm_mutex);
9991 		un->un_pm_count--;
9992 
9993 		SD_TRACE(SD_LOG_IO_PM, un,
9994 		    "sd_pm_exit: un_pm_count = %d\n", un->un_pm_count);
9995 
9996 		ASSERT(un->un_pm_count >= 0);
9997 		if (un->un_pm_count == 0) {
9998 			mutex_exit(&un->un_pm_mutex);
9999 
10000 			SD_TRACE(SD_LOG_IO_PM, un,
10001 			    "sd_pm_exit: idle component\n");
10002 
10003 			(void) pm_idle_component(SD_DEVINFO(un), 0);
10004 
10005 		} else {
10006 			mutex_exit(&un->un_pm_mutex);
10007 		}
10008 	}
10009 
10010 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_exit: exiting\n");
10011 }
10012 
10013 
10014 /*
10015  *    Function: sdopen
10016  *
10017  * Description: Driver's open(9e) entry point function.
10018  *
10019  *   Arguments: dev_i   - pointer to device number
10020  *		flag    - how to open file (FEXCL, FNDELAY, FREAD, FWRITE)
10021  *		otyp    - open type (OTYP_BLK, OTYP_CHR, OTYP_LYR)
10022  *		cred_p  - user credential pointer
10023  *
10024  * Return Code: EINVAL
10025  *		ENXIO
10026  *		EIO
10027  *		EROFS
10028  *		EBUSY
10029  *
10030  *     Context: Kernel thread context
10031  */
10032 /* ARGSUSED */
10033 static int
10034 sdopen(dev_t *dev_p, int flag, int otyp, cred_t *cred_p)
10035 {
10036 	struct sd_lun	*un;
10037 	int		nodelay;
10038 	int		part;
10039 	uint64_t	partmask;
10040 	int		instance;
10041 	dev_t		dev;
10042 	int		rval = EIO;
10043 	diskaddr_t	nblks = 0;
10044 	diskaddr_t	label_cap;
10045 
10046 	/* Validate the open type */
10047 	if (otyp >= OTYPCNT) {
10048 		return (EINVAL);
10049 	}
10050 
10051 	dev = *dev_p;
10052 	instance = SDUNIT(dev);
10053 	mutex_enter(&sd_detach_mutex);
10054 
10055 	/*
10056 	 * Fail the open if there is no softstate for the instance, or
10057 	 * if another thread somewhere is trying to detach the instance.
10058 	 */
10059 	if (((un = ddi_get_soft_state(sd_state, instance)) == NULL) ||
10060 	    (un->un_detach_count != 0)) {
10061 		mutex_exit(&sd_detach_mutex);
10062 		/*
10063 		 * The probe cache only needs to be cleared when open (9e) fails
10064 		 * with ENXIO (4238046).
10065 		 */
10066 		/*
10067 		 * un-conditionally clearing probe cache is ok with
10068 		 * separate sd/ssd binaries
10069 		 * x86 platform can be an issue with both parallel
10070 		 * and fibre in 1 binary
10071 		 */
10072 		sd_scsi_clear_probe_cache();
10073 		return (ENXIO);
10074 	}
10075 
10076 	/*
10077 	 * The un_layer_count is to prevent another thread in specfs from
10078 	 * trying to detach the instance, which can happen when we are
10079 	 * called from a higher-layer driver instead of thru specfs.
10080 	 * This will not be needed when DDI provides a layered driver
10081 	 * interface that allows specfs to know that an instance is in
10082 	 * use by a layered driver & should not be detached.
10083 	 *
10084 	 * Note: the semantics for layered driver opens are exactly one
10085 	 * close for every open.
10086 	 */
10087 	if (otyp == OTYP_LYR) {
10088 		un->un_layer_count++;
10089 	}
10090 
10091 	/*
10092 	 * Keep a count of the current # of opens in progress. This is because
10093 	 * some layered drivers try to call us as a regular open. This can
10094 	 * cause problems that we cannot prevent, however by keeping this count
10095 	 * we can at least keep our open and detach routines from racing against
10096 	 * each other under such conditions.
10097 	 */
10098 	un->un_opens_in_progress++;
10099 	mutex_exit(&sd_detach_mutex);
10100 
10101 	nodelay  = (flag & (FNDELAY | FNONBLOCK));
10102 	part	 = SDPART(dev);
10103 	partmask = 1 << part;
10104 
10105 	/*
10106 	 * We use a semaphore here in order to serialize
10107 	 * open and close requests on the device.
10108 	 */
10109 	sema_p(&un->un_semoclose);
10110 
10111 	mutex_enter(SD_MUTEX(un));
10112 
10113 	/*
10114 	 * All device accesses go thru sdstrategy() where we check
10115 	 * on suspend status but there could be a scsi_poll command,
10116 	 * which bypasses sdstrategy(), so we need to check pm
10117 	 * status.
10118 	 */
10119 
10120 	if (!nodelay) {
10121 		while ((un->un_state == SD_STATE_SUSPENDED) ||
10122 		    (un->un_state == SD_STATE_PM_CHANGING)) {
10123 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
10124 		}
10125 
10126 		mutex_exit(SD_MUTEX(un));
10127 		if (sd_pm_entry(un) != DDI_SUCCESS) {
10128 			rval = EIO;
10129 			SD_ERROR(SD_LOG_OPEN_CLOSE, un,
10130 			    "sdopen: sd_pm_entry failed\n");
10131 			goto open_failed_with_pm;
10132 		}
10133 		mutex_enter(SD_MUTEX(un));
10134 	}
10135 
10136 	/* check for previous exclusive open */
10137 	SD_TRACE(SD_LOG_OPEN_CLOSE, un, "sdopen: un=%p\n", (void *)un);
10138 	SD_TRACE(SD_LOG_OPEN_CLOSE, un,
10139 	    "sdopen: exclopen=%x, flag=%x, regopen=%x\n",
10140 	    un->un_exclopen, flag, un->un_ocmap.regopen[otyp]);
10141 
10142 	if (un->un_exclopen & (partmask)) {
10143 		goto excl_open_fail;
10144 	}
10145 
10146 	if (flag & FEXCL) {
10147 		int i;
10148 		if (un->un_ocmap.lyropen[part]) {
10149 			goto excl_open_fail;
10150 		}
10151 		for (i = 0; i < (OTYPCNT - 1); i++) {
10152 			if (un->un_ocmap.regopen[i] & (partmask)) {
10153 				goto excl_open_fail;
10154 			}
10155 		}
10156 	}
10157 
10158 	/*
10159 	 * Check the write permission if this is a removable media device,
10160 	 * NDELAY has not been set, and writable permission is requested.
10161 	 *
10162 	 * Note: If NDELAY was set and this is write-protected media the WRITE
10163 	 * attempt will fail with EIO as part of the I/O processing. This is a
10164 	 * more permissive implementation that allows the open to succeed and
10165 	 * WRITE attempts to fail when appropriate.
10166 	 */
10167 	if (un->un_f_chk_wp_open) {
10168 		if ((flag & FWRITE) && (!nodelay)) {
10169 			mutex_exit(SD_MUTEX(un));
10170 			/*
10171 			 * Defer the check for write permission on writable
10172 			 * DVD drive till sdstrategy and will not fail open even
10173 			 * if FWRITE is set as the device can be writable
10174 			 * depending upon the media and the media can change
10175 			 * after the call to open().
10176 			 */
10177 			if (un->un_f_dvdram_writable_device == FALSE) {
10178 				if (ISCD(un) || sr_check_wp(dev)) {
10179 				rval = EROFS;
10180 				mutex_enter(SD_MUTEX(un));
10181 				SD_ERROR(SD_LOG_OPEN_CLOSE, un, "sdopen: "
10182 				    "write to cd or write protected media\n");
10183 				goto open_fail;
10184 				}
10185 			}
10186 			mutex_enter(SD_MUTEX(un));
10187 		}
10188 	}
10189 
10190 	/*
10191 	 * If opening in NDELAY/NONBLOCK mode, just return.
10192 	 * Check if disk is ready and has a valid geometry later.
10193 	 */
10194 	if (!nodelay) {
10195 		sd_ssc_t	*ssc;
10196 
10197 		mutex_exit(SD_MUTEX(un));
10198 		ssc = sd_ssc_init(un);
10199 		rval = sd_ready_and_valid(ssc, part);
10200 		sd_ssc_fini(ssc);
10201 		mutex_enter(SD_MUTEX(un));
10202 		/*
10203 		 * Fail if device is not ready or if the number of disk
10204 		 * blocks is zero or negative for non CD devices.
10205 		 */
10206 
10207 		nblks = 0;
10208 
10209 		if (rval == SD_READY_VALID && (!ISCD(un))) {
10210 			/* if cmlb_partinfo fails, nblks remains 0 */
10211 			mutex_exit(SD_MUTEX(un));
10212 			(void) cmlb_partinfo(un->un_cmlbhandle, part, &nblks,
10213 			    NULL, NULL, NULL, (void *)SD_PATH_DIRECT);
10214 			mutex_enter(SD_MUTEX(un));
10215 		}
10216 
10217 		if ((rval != SD_READY_VALID) ||
10218 		    (!ISCD(un) && nblks <= 0)) {
10219 			rval = un->un_f_has_removable_media ? ENXIO : EIO;
10220 			SD_ERROR(SD_LOG_OPEN_CLOSE, un, "sdopen: "
10221 			    "device not ready or invalid disk block value\n");
10222 			goto open_fail;
10223 		}
10224 #if defined(__i386) || defined(__amd64)
10225 	} else {
10226 		uchar_t *cp;
10227 		/*
10228 		 * x86 requires special nodelay handling, so that p0 is
10229 		 * always defined and accessible.
10230 		 * Invalidate geometry only if device is not already open.
10231 		 */
10232 		cp = &un->un_ocmap.chkd[0];
10233 		while (cp < &un->un_ocmap.chkd[OCSIZE]) {
10234 			if (*cp != (uchar_t)0) {
10235 				break;
10236 			}
10237 			cp++;
10238 		}
10239 		if (cp == &un->un_ocmap.chkd[OCSIZE]) {
10240 			mutex_exit(SD_MUTEX(un));
10241 			cmlb_invalidate(un->un_cmlbhandle,
10242 			    (void *)SD_PATH_DIRECT);
10243 			mutex_enter(SD_MUTEX(un));
10244 		}
10245 
10246 #endif
10247 	}
10248 
10249 	if (otyp == OTYP_LYR) {
10250 		un->un_ocmap.lyropen[part]++;
10251 	} else {
10252 		un->un_ocmap.regopen[otyp] |= partmask;
10253 	}
10254 
10255 	/* Set up open and exclusive open flags */
10256 	if (flag & FEXCL) {
10257 		un->un_exclopen |= (partmask);
10258 	}
10259 
10260 	/*
10261 	 * If the lun is EFI labeled and lun capacity is greater than the
10262 	 * capacity contained in the label, log a sys-event to notify the
10263 	 * interested module.
10264 	 * To avoid an infinite loop of logging sys-event, we only log the
10265 	 * event when the lun is not opened in NDELAY mode. The event handler
10266 	 * should open the lun in NDELAY mode.
10267 	 */
10268 	if (!(flag & FNDELAY)) {
10269 		mutex_exit(SD_MUTEX(un));
10270 		if (cmlb_efi_label_capacity(un->un_cmlbhandle, &label_cap,
10271 		    (void*)SD_PATH_DIRECT) == 0) {
10272 			mutex_enter(SD_MUTEX(un));
10273 			if (un->un_f_blockcount_is_valid &&
10274 			    un->un_blockcount > label_cap) {
10275 				mutex_exit(SD_MUTEX(un));
10276 				sd_log_lun_expansion_event(un,
10277 				    (nodelay ? KM_NOSLEEP : KM_SLEEP));
10278 				mutex_enter(SD_MUTEX(un));
10279 			}
10280 		} else {
10281 			mutex_enter(SD_MUTEX(un));
10282 		}
10283 	}
10284 
10285 	SD_TRACE(SD_LOG_OPEN_CLOSE, un, "sdopen: "
10286 	    "open of part %d type %d\n", part, otyp);
10287 
10288 	mutex_exit(SD_MUTEX(un));
10289 	if (!nodelay) {
10290 		sd_pm_exit(un);
10291 	}
10292 
10293 	sema_v(&un->un_semoclose);
10294 
10295 	mutex_enter(&sd_detach_mutex);
10296 	un->un_opens_in_progress--;
10297 	mutex_exit(&sd_detach_mutex);
10298 
10299 	SD_TRACE(SD_LOG_OPEN_CLOSE, un, "sdopen: exit success\n");
10300 	return (DDI_SUCCESS);
10301 
10302 excl_open_fail:
10303 	SD_ERROR(SD_LOG_OPEN_CLOSE, un, "sdopen: fail exclusive open\n");
10304 	rval = EBUSY;
10305 
10306 open_fail:
10307 	mutex_exit(SD_MUTEX(un));
10308 
10309 	/*
10310 	 * On a failed open we must exit the pm management.
10311 	 */
10312 	if (!nodelay) {
10313 		sd_pm_exit(un);
10314 	}
10315 open_failed_with_pm:
10316 	sema_v(&un->un_semoclose);
10317 
10318 	mutex_enter(&sd_detach_mutex);
10319 	un->un_opens_in_progress--;
10320 	if (otyp == OTYP_LYR) {
10321 		un->un_layer_count--;
10322 	}
10323 	mutex_exit(&sd_detach_mutex);
10324 
10325 	return (rval);
10326 }
10327 
10328 
10329 /*
10330  *    Function: sdclose
10331  *
10332  * Description: Driver's close(9e) entry point function.
10333  *
10334  *   Arguments: dev    - device number
10335  *		flag   - file status flag, informational only
10336  *		otyp   - close type (OTYP_BLK, OTYP_CHR, OTYP_LYR)
10337  *		cred_p - user credential pointer
10338  *
10339  * Return Code: ENXIO
10340  *
10341  *     Context: Kernel thread context
10342  */
10343 /* ARGSUSED */
10344 static int
10345 sdclose(dev_t dev, int flag, int otyp, cred_t *cred_p)
10346 {
10347 	struct sd_lun	*un;
10348 	uchar_t		*cp;
10349 	int		part;
10350 	int		nodelay;
10351 	int		rval = 0;
10352 
10353 	/* Validate the open type */
10354 	if (otyp >= OTYPCNT) {
10355 		return (ENXIO);
10356 	}
10357 
10358 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
10359 		return (ENXIO);
10360 	}
10361 
10362 	part = SDPART(dev);
10363 	nodelay = flag & (FNDELAY | FNONBLOCK);
10364 
10365 	SD_TRACE(SD_LOG_OPEN_CLOSE, un,
10366 	    "sdclose: close of part %d type %d\n", part, otyp);
10367 
10368 	/*
10369 	 * We use a semaphore here in order to serialize
10370 	 * open and close requests on the device.
10371 	 */
10372 	sema_p(&un->un_semoclose);
10373 
10374 	mutex_enter(SD_MUTEX(un));
10375 
10376 	/* Don't proceed if power is being changed. */
10377 	while (un->un_state == SD_STATE_PM_CHANGING) {
10378 		cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
10379 	}
10380 
10381 	if (un->un_exclopen & (1 << part)) {
10382 		un->un_exclopen &= ~(1 << part);
10383 	}
10384 
10385 	/* Update the open partition map */
10386 	if (otyp == OTYP_LYR) {
10387 		un->un_ocmap.lyropen[part] -= 1;
10388 	} else {
10389 		un->un_ocmap.regopen[otyp] &= ~(1 << part);
10390 	}
10391 
10392 	cp = &un->un_ocmap.chkd[0];
10393 	while (cp < &un->un_ocmap.chkd[OCSIZE]) {
10394 		if (*cp != NULL) {
10395 			break;
10396 		}
10397 		cp++;
10398 	}
10399 
10400 	if (cp == &un->un_ocmap.chkd[OCSIZE]) {
10401 		SD_TRACE(SD_LOG_OPEN_CLOSE, un, "sdclose: last close\n");
10402 
10403 		/*
10404 		 * We avoid persistance upon the last close, and set
10405 		 * the throttle back to the maximum.
10406 		 */
10407 		un->un_throttle = un->un_saved_throttle;
10408 
10409 		if (un->un_state == SD_STATE_OFFLINE) {
10410 			if (un->un_f_is_fibre == FALSE) {
10411 				scsi_log(SD_DEVINFO(un), sd_label,
10412 				    CE_WARN, "offline\n");
10413 			}
10414 			mutex_exit(SD_MUTEX(un));
10415 			cmlb_invalidate(un->un_cmlbhandle,
10416 			    (void *)SD_PATH_DIRECT);
10417 			mutex_enter(SD_MUTEX(un));
10418 
10419 		} else {
10420 			/*
10421 			 * Flush any outstanding writes in NVRAM cache.
10422 			 * Note: SYNCHRONIZE CACHE is an optional SCSI-2
10423 			 * cmd, it may not work for non-Pluto devices.
10424 			 * SYNCHRONIZE CACHE is not required for removables,
10425 			 * except DVD-RAM drives.
10426 			 *
10427 			 * Also note: because SYNCHRONIZE CACHE is currently
10428 			 * the only command issued here that requires the
10429 			 * drive be powered up, only do the power up before
10430 			 * sending the Sync Cache command. If additional
10431 			 * commands are added which require a powered up
10432 			 * drive, the following sequence may have to change.
10433 			 *
10434 			 * And finally, note that parallel SCSI on SPARC
10435 			 * only issues a Sync Cache to DVD-RAM, a newly
10436 			 * supported device.
10437 			 */
10438 #if defined(__i386) || defined(__amd64)
10439 			if ((un->un_f_sync_cache_supported &&
10440 			    un->un_f_sync_cache_required) ||
10441 			    un->un_f_dvdram_writable_device == TRUE) {
10442 #else
10443 			if (un->un_f_dvdram_writable_device == TRUE) {
10444 #endif
10445 				mutex_exit(SD_MUTEX(un));
10446 				if (sd_pm_entry(un) == DDI_SUCCESS) {
10447 					rval =
10448 					    sd_send_scsi_SYNCHRONIZE_CACHE(un,
10449 					    NULL);
10450 					/* ignore error if not supported */
10451 					if (rval == ENOTSUP) {
10452 						rval = 0;
10453 					} else if (rval != 0) {
10454 						rval = EIO;
10455 					}
10456 					sd_pm_exit(un);
10457 				} else {
10458 					rval = EIO;
10459 				}
10460 				mutex_enter(SD_MUTEX(un));
10461 			}
10462 
10463 			/*
10464 			 * For devices which supports DOOR_LOCK, send an ALLOW
10465 			 * MEDIA REMOVAL command, but don't get upset if it
10466 			 * fails. We need to raise the power of the drive before
10467 			 * we can call sd_send_scsi_DOORLOCK()
10468 			 */
10469 			if (un->un_f_doorlock_supported) {
10470 				mutex_exit(SD_MUTEX(un));
10471 				if (sd_pm_entry(un) == DDI_SUCCESS) {
10472 					sd_ssc_t	*ssc;
10473 
10474 					ssc = sd_ssc_init(un);
10475 					rval = sd_send_scsi_DOORLOCK(ssc,
10476 					    SD_REMOVAL_ALLOW, SD_PATH_DIRECT);
10477 					if (rval != 0)
10478 						sd_ssc_assessment(ssc,
10479 						    SD_FMT_IGNORE);
10480 					sd_ssc_fini(ssc);
10481 
10482 					sd_pm_exit(un);
10483 					if (ISCD(un) && (rval != 0) &&
10484 					    (nodelay != 0)) {
10485 						rval = ENXIO;
10486 					}
10487 				} else {
10488 					rval = EIO;
10489 				}
10490 				mutex_enter(SD_MUTEX(un));
10491 			}
10492 
10493 			/*
10494 			 * If a device has removable media, invalidate all
10495 			 * parameters related to media, such as geometry,
10496 			 * blocksize, and blockcount.
10497 			 */
10498 			if (un->un_f_has_removable_media) {
10499 				sr_ejected(un);
10500 			}
10501 
10502 			/*
10503 			 * Destroy the cache (if it exists) which was
10504 			 * allocated for the write maps since this is
10505 			 * the last close for this media.
10506 			 */
10507 			if (un->un_wm_cache) {
10508 				/*
10509 				 * Check if there are pending commands.
10510 				 * and if there are give a warning and
10511 				 * do not destroy the cache.
10512 				 */
10513 				if (un->un_ncmds_in_driver > 0) {
10514 					scsi_log(SD_DEVINFO(un),
10515 					    sd_label, CE_WARN,
10516 					    "Unable to clean up memory "
10517 					    "because of pending I/O\n");
10518 				} else {
10519 					kmem_cache_destroy(
10520 					    un->un_wm_cache);
10521 					un->un_wm_cache = NULL;
10522 				}
10523 			}
10524 		}
10525 	}
10526 
10527 	mutex_exit(SD_MUTEX(un));
10528 	sema_v(&un->un_semoclose);
10529 
10530 	if (otyp == OTYP_LYR) {
10531 		mutex_enter(&sd_detach_mutex);
10532 		/*
10533 		 * The detach routine may run when the layer count
10534 		 * drops to zero.
10535 		 */
10536 		un->un_layer_count--;
10537 		mutex_exit(&sd_detach_mutex);
10538 	}
10539 
10540 	return (rval);
10541 }
10542 
10543 
10544 /*
10545  *    Function: sd_ready_and_valid
10546  *
10547  * Description: Test if device is ready and has a valid geometry.
10548  *
10549  *   Arguments: ssc - sd_ssc_t will contain un
10550  *		un  - driver soft state (unit) structure
10551  *
10552  * Return Code: SD_READY_VALID		ready and valid label
10553  *		SD_NOT_READY_VALID	not ready, no label
10554  *		SD_RESERVED_BY_OTHERS	reservation conflict
10555  *
10556  *     Context: Never called at interrupt context.
10557  */
10558 
10559 static int
10560 sd_ready_and_valid(sd_ssc_t *ssc, int part)
10561 {
10562 	struct sd_errstats	*stp;
10563 	uint64_t		capacity;
10564 	uint_t			lbasize;
10565 	int			rval = SD_READY_VALID;
10566 	char			name_str[48];
10567 	boolean_t		is_valid;
10568 	struct sd_lun		*un;
10569 	int			status;
10570 
10571 	ASSERT(ssc != NULL);
10572 	un = ssc->ssc_un;
10573 	ASSERT(un != NULL);
10574 	ASSERT(!mutex_owned(SD_MUTEX(un)));
10575 
10576 	mutex_enter(SD_MUTEX(un));
10577 	/*
10578 	 * If a device has removable media, we must check if media is
10579 	 * ready when checking if this device is ready and valid.
10580 	 */
10581 	if (un->un_f_has_removable_media) {
10582 		mutex_exit(SD_MUTEX(un));
10583 		status = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
10584 
10585 		if (status != 0) {
10586 			rval = SD_NOT_READY_VALID;
10587 			mutex_enter(SD_MUTEX(un));
10588 
10589 			/* Ignore all failed status for removalbe media */
10590 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10591 
10592 			goto done;
10593 		}
10594 
10595 		is_valid = SD_IS_VALID_LABEL(un);
10596 		mutex_enter(SD_MUTEX(un));
10597 		if (!is_valid ||
10598 		    (un->un_f_blockcount_is_valid == FALSE) ||
10599 		    (un->un_f_tgt_blocksize_is_valid == FALSE)) {
10600 
10601 			/* capacity has to be read every open. */
10602 			mutex_exit(SD_MUTEX(un));
10603 			status = sd_send_scsi_READ_CAPACITY(ssc, &capacity,
10604 			    &lbasize, SD_PATH_DIRECT);
10605 
10606 			if (status != 0) {
10607 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10608 
10609 				cmlb_invalidate(un->un_cmlbhandle,
10610 				    (void *)SD_PATH_DIRECT);
10611 				mutex_enter(SD_MUTEX(un));
10612 				rval = SD_NOT_READY_VALID;
10613 
10614 				goto done;
10615 			} else {
10616 				mutex_enter(SD_MUTEX(un));
10617 				sd_update_block_info(un, lbasize, capacity);
10618 			}
10619 		}
10620 
10621 		/*
10622 		 * Check if the media in the device is writable or not.
10623 		 */
10624 		if (!is_valid && ISCD(un)) {
10625 			sd_check_for_writable_cd(ssc, SD_PATH_DIRECT);
10626 		}
10627 
10628 	} else {
10629 		/*
10630 		 * Do a test unit ready to clear any unit attention from non-cd
10631 		 * devices.
10632 		 */
10633 		mutex_exit(SD_MUTEX(un));
10634 
10635 		status = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
10636 		if (status != 0) {
10637 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10638 		}
10639 
10640 		mutex_enter(SD_MUTEX(un));
10641 	}
10642 
10643 
10644 	/*
10645 	 * If this is a non 512 block device, allocate space for
10646 	 * the wmap cache. This is being done here since every time
10647 	 * a media is changed this routine will be called and the
10648 	 * block size is a function of media rather than device.
10649 	 */
10650 	if ((un->un_f_rmw_type != SD_RMW_TYPE_RETURN_ERROR ||
10651 	    un->un_f_non_devbsize_supported) &&
10652 	    un->un_tgt_blocksize != DEV_BSIZE) {
10653 		if (!(un->un_wm_cache)) {
10654 			(void) snprintf(name_str, sizeof (name_str),
10655 			    "%s%d_cache",
10656 			    ddi_driver_name(SD_DEVINFO(un)),
10657 			    ddi_get_instance(SD_DEVINFO(un)));
10658 			un->un_wm_cache = kmem_cache_create(
10659 			    name_str, sizeof (struct sd_w_map),
10660 			    8, sd_wm_cache_constructor,
10661 			    sd_wm_cache_destructor, NULL,
10662 			    (void *)un, NULL, 0);
10663 			if (!(un->un_wm_cache)) {
10664 				rval = ENOMEM;
10665 				goto done;
10666 			}
10667 		}
10668 	}
10669 
10670 	if (un->un_state == SD_STATE_NORMAL) {
10671 		/*
10672 		 * If the target is not yet ready here (defined by a TUR
10673 		 * failure), invalidate the geometry and print an 'offline'
10674 		 * message. This is a legacy message, as the state of the
10675 		 * target is not actually changed to SD_STATE_OFFLINE.
10676 		 *
10677 		 * If the TUR fails for EACCES (Reservation Conflict),
10678 		 * SD_RESERVED_BY_OTHERS will be returned to indicate
10679 		 * reservation conflict. If the TUR fails for other
10680 		 * reasons, SD_NOT_READY_VALID will be returned.
10681 		 */
10682 		int err;
10683 
10684 		mutex_exit(SD_MUTEX(un));
10685 		err = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
10686 		mutex_enter(SD_MUTEX(un));
10687 
10688 		if (err != 0) {
10689 			mutex_exit(SD_MUTEX(un));
10690 			cmlb_invalidate(un->un_cmlbhandle,
10691 			    (void *)SD_PATH_DIRECT);
10692 			mutex_enter(SD_MUTEX(un));
10693 			if (err == EACCES) {
10694 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
10695 				    "reservation conflict\n");
10696 				rval = SD_RESERVED_BY_OTHERS;
10697 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10698 			} else {
10699 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
10700 				    "drive offline\n");
10701 				rval = SD_NOT_READY_VALID;
10702 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
10703 			}
10704 			goto done;
10705 		}
10706 	}
10707 
10708 	if (un->un_f_format_in_progress == FALSE) {
10709 		mutex_exit(SD_MUTEX(un));
10710 
10711 		(void) cmlb_validate(un->un_cmlbhandle, 0,
10712 		    (void *)SD_PATH_DIRECT);
10713 		if (cmlb_partinfo(un->un_cmlbhandle, part, NULL, NULL, NULL,
10714 		    NULL, (void *) SD_PATH_DIRECT) != 0) {
10715 			rval = SD_NOT_READY_VALID;
10716 			mutex_enter(SD_MUTEX(un));
10717 
10718 			goto done;
10719 		}
10720 		if (un->un_f_pkstats_enabled) {
10721 			sd_set_pstats(un);
10722 			SD_TRACE(SD_LOG_IO_PARTITION, un,
10723 			    "sd_ready_and_valid: un:0x%p pstats created and "
10724 			    "set\n", un);
10725 		}
10726 		mutex_enter(SD_MUTEX(un));
10727 	}
10728 
10729 	/*
10730 	 * If this device supports DOOR_LOCK command, try and send
10731 	 * this command to PREVENT MEDIA REMOVAL, but don't get upset
10732 	 * if it fails. For a CD, however, it is an error
10733 	 */
10734 	if (un->un_f_doorlock_supported) {
10735 		mutex_exit(SD_MUTEX(un));
10736 		status = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_PREVENT,
10737 		    SD_PATH_DIRECT);
10738 
10739 		if ((status != 0) && ISCD(un)) {
10740 			rval = SD_NOT_READY_VALID;
10741 			mutex_enter(SD_MUTEX(un));
10742 
10743 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10744 
10745 			goto done;
10746 		} else if (status != 0)
10747 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
10748 		mutex_enter(SD_MUTEX(un));
10749 	}
10750 
10751 	/* The state has changed, inform the media watch routines */
10752 	un->un_mediastate = DKIO_INSERTED;
10753 	cv_broadcast(&un->un_state_cv);
10754 	rval = SD_READY_VALID;
10755 
10756 done:
10757 
10758 	/*
10759 	 * Initialize the capacity kstat value, if no media previously
10760 	 * (capacity kstat is 0) and a media has been inserted
10761 	 * (un_blockcount > 0).
10762 	 */
10763 	if (un->un_errstats != NULL) {
10764 		stp = (struct sd_errstats *)un->un_errstats->ks_data;
10765 		if ((stp->sd_capacity.value.ui64 == 0) &&
10766 		    (un->un_f_blockcount_is_valid == TRUE)) {
10767 			stp->sd_capacity.value.ui64 =
10768 			    (uint64_t)((uint64_t)un->un_blockcount *
10769 			    un->un_sys_blocksize);
10770 		}
10771 	}
10772 
10773 	mutex_exit(SD_MUTEX(un));
10774 	return (rval);
10775 }
10776 
10777 
10778 /*
10779  *    Function: sdmin
10780  *
10781  * Description: Routine to limit the size of a data transfer. Used in
10782  *		conjunction with physio(9F).
10783  *
10784  *   Arguments: bp - pointer to the indicated buf(9S) struct.
10785  *
10786  *     Context: Kernel thread context.
10787  */
10788 
10789 static void
10790 sdmin(struct buf *bp)
10791 {
10792 	struct sd_lun	*un;
10793 	int		instance;
10794 
10795 	instance = SDUNIT(bp->b_edev);
10796 
10797 	un = ddi_get_soft_state(sd_state, instance);
10798 	ASSERT(un != NULL);
10799 
10800 	/*
10801 	 * We depend on buf breakup to restrict
10802 	 * IO size if it is enabled.
10803 	 */
10804 	if (un->un_buf_breakup_supported) {
10805 		return;
10806 	}
10807 
10808 	if (bp->b_bcount > un->un_max_xfer_size) {
10809 		bp->b_bcount = un->un_max_xfer_size;
10810 	}
10811 }
10812 
10813 
10814 /*
10815  *    Function: sdread
10816  *
10817  * Description: Driver's read(9e) entry point function.
10818  *
10819  *   Arguments: dev   - device number
10820  *		uio   - structure pointer describing where data is to be stored
10821  *			in user's space
10822  *		cred_p  - user credential pointer
10823  *
10824  * Return Code: ENXIO
10825  *		EIO
10826  *		EINVAL
10827  *		value returned by physio
10828  *
10829  *     Context: Kernel thread context.
10830  */
10831 /* ARGSUSED */
10832 static int
10833 sdread(dev_t dev, struct uio *uio, cred_t *cred_p)
10834 {
10835 	struct sd_lun	*un = NULL;
10836 	int		secmask;
10837 	int		err = 0;
10838 	sd_ssc_t	*ssc;
10839 
10840 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
10841 		return (ENXIO);
10842 	}
10843 
10844 	ASSERT(!mutex_owned(SD_MUTEX(un)));
10845 
10846 
10847 	if (!SD_IS_VALID_LABEL(un) && !ISCD(un)) {
10848 		mutex_enter(SD_MUTEX(un));
10849 		/*
10850 		 * Because the call to sd_ready_and_valid will issue I/O we
10851 		 * must wait here if either the device is suspended or
10852 		 * if it's power level is changing.
10853 		 */
10854 		while ((un->un_state == SD_STATE_SUSPENDED) ||
10855 		    (un->un_state == SD_STATE_PM_CHANGING)) {
10856 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
10857 		}
10858 		un->un_ncmds_in_driver++;
10859 		mutex_exit(SD_MUTEX(un));
10860 
10861 		/* Initialize sd_ssc_t for internal uscsi commands */
10862 		ssc = sd_ssc_init(un);
10863 		if ((sd_ready_and_valid(ssc, SDPART(dev))) != SD_READY_VALID) {
10864 			err = EIO;
10865 		} else {
10866 			err = 0;
10867 		}
10868 		sd_ssc_fini(ssc);
10869 
10870 		mutex_enter(SD_MUTEX(un));
10871 		un->un_ncmds_in_driver--;
10872 		ASSERT(un->un_ncmds_in_driver >= 0);
10873 		mutex_exit(SD_MUTEX(un));
10874 		if (err != 0)
10875 			return (err);
10876 	}
10877 
10878 	/*
10879 	 * Read requests are restricted to multiples of the system block size.
10880 	 */
10881 	if (un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR)
10882 		secmask = un->un_tgt_blocksize - 1;
10883 	else
10884 		secmask = DEV_BSIZE - 1;
10885 
10886 	if (uio->uio_loffset & ((offset_t)(secmask))) {
10887 		SD_ERROR(SD_LOG_READ_WRITE, un,
10888 		    "sdread: file offset not modulo %d\n",
10889 		    secmask + 1);
10890 		err = EINVAL;
10891 	} else if (uio->uio_iov->iov_len & (secmask)) {
10892 		SD_ERROR(SD_LOG_READ_WRITE, un,
10893 		    "sdread: transfer length not modulo %d\n",
10894 		    secmask + 1);
10895 		err = EINVAL;
10896 	} else {
10897 		err = physio(sdstrategy, NULL, dev, B_READ, sdmin, uio);
10898 	}
10899 
10900 	return (err);
10901 }
10902 
10903 
10904 /*
10905  *    Function: sdwrite
10906  *
10907  * Description: Driver's write(9e) entry point function.
10908  *
10909  *   Arguments: dev   - device number
10910  *		uio   - structure pointer describing where data is stored in
10911  *			user's space
10912  *		cred_p  - user credential pointer
10913  *
10914  * Return Code: ENXIO
10915  *		EIO
10916  *		EINVAL
10917  *		value returned by physio
10918  *
10919  *     Context: Kernel thread context.
10920  */
10921 /* ARGSUSED */
10922 static int
10923 sdwrite(dev_t dev, struct uio *uio, cred_t *cred_p)
10924 {
10925 	struct sd_lun	*un = NULL;
10926 	int		secmask;
10927 	int		err = 0;
10928 	sd_ssc_t	*ssc;
10929 
10930 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
10931 		return (ENXIO);
10932 	}
10933 
10934 	ASSERT(!mutex_owned(SD_MUTEX(un)));
10935 
10936 	if (!SD_IS_VALID_LABEL(un) && !ISCD(un)) {
10937 		mutex_enter(SD_MUTEX(un));
10938 		/*
10939 		 * Because the call to sd_ready_and_valid will issue I/O we
10940 		 * must wait here if either the device is suspended or
10941 		 * if it's power level is changing.
10942 		 */
10943 		while ((un->un_state == SD_STATE_SUSPENDED) ||
10944 		    (un->un_state == SD_STATE_PM_CHANGING)) {
10945 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
10946 		}
10947 		un->un_ncmds_in_driver++;
10948 		mutex_exit(SD_MUTEX(un));
10949 
10950 		/* Initialize sd_ssc_t for internal uscsi commands */
10951 		ssc = sd_ssc_init(un);
10952 		if ((sd_ready_and_valid(ssc, SDPART(dev))) != SD_READY_VALID) {
10953 			err = EIO;
10954 		} else {
10955 			err = 0;
10956 		}
10957 		sd_ssc_fini(ssc);
10958 
10959 		mutex_enter(SD_MUTEX(un));
10960 		un->un_ncmds_in_driver--;
10961 		ASSERT(un->un_ncmds_in_driver >= 0);
10962 		mutex_exit(SD_MUTEX(un));
10963 		if (err != 0)
10964 			return (err);
10965 	}
10966 
10967 	/*
10968 	 * Write requests are restricted to multiples of the system block size.
10969 	 */
10970 	if (un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR)
10971 		secmask = un->un_tgt_blocksize - 1;
10972 	else
10973 		secmask = DEV_BSIZE - 1;
10974 
10975 	if (uio->uio_loffset & ((offset_t)(secmask))) {
10976 		SD_ERROR(SD_LOG_READ_WRITE, un,
10977 		    "sdwrite: file offset not modulo %d\n",
10978 		    secmask + 1);
10979 		err = EINVAL;
10980 	} else if (uio->uio_iov->iov_len & (secmask)) {
10981 		SD_ERROR(SD_LOG_READ_WRITE, un,
10982 		    "sdwrite: transfer length not modulo %d\n",
10983 		    secmask + 1);
10984 		err = EINVAL;
10985 	} else {
10986 		err = physio(sdstrategy, NULL, dev, B_WRITE, sdmin, uio);
10987 	}
10988 
10989 	return (err);
10990 }
10991 
10992 
10993 /*
10994  *    Function: sdaread
10995  *
10996  * Description: Driver's aread(9e) entry point function.
10997  *
10998  *   Arguments: dev   - device number
10999  *		aio   - structure pointer describing where data is to be stored
11000  *		cred_p  - user credential pointer
11001  *
11002  * Return Code: ENXIO
11003  *		EIO
11004  *		EINVAL
11005  *		value returned by aphysio
11006  *
11007  *     Context: Kernel thread context.
11008  */
11009 /* ARGSUSED */
11010 static int
11011 sdaread(dev_t dev, struct aio_req *aio, cred_t *cred_p)
11012 {
11013 	struct sd_lun	*un = NULL;
11014 	struct uio	*uio = aio->aio_uio;
11015 	int		secmask;
11016 	int		err = 0;
11017 	sd_ssc_t	*ssc;
11018 
11019 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
11020 		return (ENXIO);
11021 	}
11022 
11023 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11024 
11025 	if (!SD_IS_VALID_LABEL(un) && !ISCD(un)) {
11026 		mutex_enter(SD_MUTEX(un));
11027 		/*
11028 		 * Because the call to sd_ready_and_valid will issue I/O we
11029 		 * must wait here if either the device is suspended or
11030 		 * if it's power level is changing.
11031 		 */
11032 		while ((un->un_state == SD_STATE_SUSPENDED) ||
11033 		    (un->un_state == SD_STATE_PM_CHANGING)) {
11034 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
11035 		}
11036 		un->un_ncmds_in_driver++;
11037 		mutex_exit(SD_MUTEX(un));
11038 
11039 		/* Initialize sd_ssc_t for internal uscsi commands */
11040 		ssc = sd_ssc_init(un);
11041 		if ((sd_ready_and_valid(ssc, SDPART(dev))) != SD_READY_VALID) {
11042 			err = EIO;
11043 		} else {
11044 			err = 0;
11045 		}
11046 		sd_ssc_fini(ssc);
11047 
11048 		mutex_enter(SD_MUTEX(un));
11049 		un->un_ncmds_in_driver--;
11050 		ASSERT(un->un_ncmds_in_driver >= 0);
11051 		mutex_exit(SD_MUTEX(un));
11052 		if (err != 0)
11053 			return (err);
11054 	}
11055 
11056 	/*
11057 	 * Read requests are restricted to multiples of the system block size.
11058 	 */
11059 	if (un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR)
11060 		secmask = un->un_tgt_blocksize - 1;
11061 	else
11062 		secmask = DEV_BSIZE - 1;
11063 
11064 	if (uio->uio_loffset & ((offset_t)(secmask))) {
11065 		SD_ERROR(SD_LOG_READ_WRITE, un,
11066 		    "sdaread: file offset not modulo %d\n",
11067 		    secmask + 1);
11068 		err = EINVAL;
11069 	} else if (uio->uio_iov->iov_len & (secmask)) {
11070 		SD_ERROR(SD_LOG_READ_WRITE, un,
11071 		    "sdaread: transfer length not modulo %d\n",
11072 		    secmask + 1);
11073 		err = EINVAL;
11074 	} else {
11075 		err = aphysio(sdstrategy, anocancel, dev, B_READ, sdmin, aio);
11076 	}
11077 
11078 	return (err);
11079 }
11080 
11081 
11082 /*
11083  *    Function: sdawrite
11084  *
11085  * Description: Driver's awrite(9e) entry point function.
11086  *
11087  *   Arguments: dev   - device number
11088  *		aio   - structure pointer describing where data is stored
11089  *		cred_p  - user credential pointer
11090  *
11091  * Return Code: ENXIO
11092  *		EIO
11093  *		EINVAL
11094  *		value returned by aphysio
11095  *
11096  *     Context: Kernel thread context.
11097  */
11098 /* ARGSUSED */
11099 static int
11100 sdawrite(dev_t dev, struct aio_req *aio, cred_t *cred_p)
11101 {
11102 	struct sd_lun	*un = NULL;
11103 	struct uio	*uio = aio->aio_uio;
11104 	int		secmask;
11105 	int		err = 0;
11106 	sd_ssc_t	*ssc;
11107 
11108 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
11109 		return (ENXIO);
11110 	}
11111 
11112 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11113 
11114 	if (!SD_IS_VALID_LABEL(un) && !ISCD(un)) {
11115 		mutex_enter(SD_MUTEX(un));
11116 		/*
11117 		 * Because the call to sd_ready_and_valid will issue I/O we
11118 		 * must wait here if either the device is suspended or
11119 		 * if it's power level is changing.
11120 		 */
11121 		while ((un->un_state == SD_STATE_SUSPENDED) ||
11122 		    (un->un_state == SD_STATE_PM_CHANGING)) {
11123 			cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
11124 		}
11125 		un->un_ncmds_in_driver++;
11126 		mutex_exit(SD_MUTEX(un));
11127 
11128 		/* Initialize sd_ssc_t for internal uscsi commands */
11129 		ssc = sd_ssc_init(un);
11130 		if ((sd_ready_and_valid(ssc, SDPART(dev))) != SD_READY_VALID) {
11131 			err = EIO;
11132 		} else {
11133 			err = 0;
11134 		}
11135 		sd_ssc_fini(ssc);
11136 
11137 		mutex_enter(SD_MUTEX(un));
11138 		un->un_ncmds_in_driver--;
11139 		ASSERT(un->un_ncmds_in_driver >= 0);
11140 		mutex_exit(SD_MUTEX(un));
11141 		if (err != 0)
11142 			return (err);
11143 	}
11144 
11145 	/*
11146 	 * Write requests are restricted to multiples of the system block size.
11147 	 */
11148 	if (un->un_f_rmw_type == SD_RMW_TYPE_RETURN_ERROR)
11149 		secmask = un->un_tgt_blocksize - 1;
11150 	else
11151 		secmask = DEV_BSIZE - 1;
11152 
11153 	if (uio->uio_loffset & ((offset_t)(secmask))) {
11154 		SD_ERROR(SD_LOG_READ_WRITE, un,
11155 		    "sdawrite: file offset not modulo %d\n",
11156 		    secmask + 1);
11157 		err = EINVAL;
11158 	} else if (uio->uio_iov->iov_len & (secmask)) {
11159 		SD_ERROR(SD_LOG_READ_WRITE, un,
11160 		    "sdawrite: transfer length not modulo %d\n",
11161 		    secmask + 1);
11162 		err = EINVAL;
11163 	} else {
11164 		err = aphysio(sdstrategy, anocancel, dev, B_WRITE, sdmin, aio);
11165 	}
11166 
11167 	return (err);
11168 }
11169 
11170 
11171 
11172 
11173 
11174 /*
11175  * Driver IO processing follows the following sequence:
11176  *
11177  *     sdioctl(9E)     sdstrategy(9E)         biodone(9F)
11178  *         |                |                     ^
11179  *         v                v                     |
11180  * sd_send_scsi_cmd()  ddi_xbuf_qstrategy()       +-------------------+
11181  *         |                |                     |                   |
11182  *         v                |                     |                   |
11183  * sd_uscsi_strategy() sd_xbuf_strategy()   sd_buf_iodone()   sd_uscsi_iodone()
11184  *         |                |                     ^                   ^
11185  *         v                v                     |                   |
11186  * SD_BEGIN_IOSTART()  SD_BEGIN_IOSTART()         |                   |
11187  *         |                |                     |                   |
11188  *     +---+                |                     +------------+      +-------+
11189  *     |                    |                                  |              |
11190  *     |   SD_NEXT_IOSTART()|                  SD_NEXT_IODONE()|              |
11191  *     |                    v                                  |              |
11192  *     |         sd_mapblockaddr_iostart()           sd_mapblockaddr_iodone() |
11193  *     |                    |                                  ^              |
11194  *     |   SD_NEXT_IOSTART()|                  SD_NEXT_IODONE()|              |
11195  *     |                    v                                  |              |
11196  *     |         sd_mapblocksize_iostart()           sd_mapblocksize_iodone() |
11197  *     |                    |                                  ^              |
11198  *     |   SD_NEXT_IOSTART()|                  SD_NEXT_IODONE()|              |
11199  *     |                    v                                  |              |
11200  *     |           sd_checksum_iostart()               sd_checksum_iodone()   |
11201  *     |                    |                                  ^              |
11202  *     +-> SD_NEXT_IOSTART()|                  SD_NEXT_IODONE()+------------->+
11203  *     |                    v                                  |              |
11204  *     |              sd_pm_iostart()                     sd_pm_iodone()      |
11205  *     |                    |                                  ^              |
11206  *     |                    |                                  |              |
11207  *     +-> SD_NEXT_IOSTART()|               SD_BEGIN_IODONE()--+--------------+
11208  *                          |                           ^
11209  *                          v                           |
11210  *                   sd_core_iostart()                  |
11211  *                          |                           |
11212  *                          |                           +------>(*destroypkt)()
11213  *                          +-> sd_start_cmds() <-+     |           |
11214  *                          |                     |     |           v
11215  *                          |                     |     |  scsi_destroy_pkt(9F)
11216  *                          |                     |     |
11217  *                          +->(*initpkt)()       +- sdintr()
11218  *                          |  |                        |  |
11219  *                          |  +-> scsi_init_pkt(9F)    |  +-> sd_handle_xxx()
11220  *                          |  +-> scsi_setup_cdb(9F)   |
11221  *                          |                           |
11222  *                          +--> scsi_transport(9F)     |
11223  *                                     |                |
11224  *                                     +----> SCSA ---->+
11225  *
11226  *
11227  * This code is based upon the following presumptions:
11228  *
11229  *   - iostart and iodone functions operate on buf(9S) structures. These
11230  *     functions perform the necessary operations on the buf(9S) and pass
11231  *     them along to the next function in the chain by using the macros
11232  *     SD_NEXT_IOSTART() (for iostart side functions) and SD_NEXT_IODONE()
11233  *     (for iodone side functions).
11234  *
11235  *   - The iostart side functions may sleep. The iodone side functions
11236  *     are called under interrupt context and may NOT sleep. Therefore
11237  *     iodone side functions also may not call iostart side functions.
11238  *     (NOTE: iostart side functions should NOT sleep for memory, as
11239  *     this could result in deadlock.)
11240  *
11241  *   - An iostart side function may call its corresponding iodone side
11242  *     function directly (if necessary).
11243  *
11244  *   - In the event of an error, an iostart side function can return a buf(9S)
11245  *     to its caller by calling SD_BEGIN_IODONE() (after setting B_ERROR and
11246  *     b_error in the usual way of course).
11247  *
11248  *   - The taskq mechanism may be used by the iodone side functions to dispatch
11249  *     requests to the iostart side functions.  The iostart side functions in
11250  *     this case would be called under the context of a taskq thread, so it's
11251  *     OK for them to block/sleep/spin in this case.
11252  *
11253  *   - iostart side functions may allocate "shadow" buf(9S) structs and
11254  *     pass them along to the next function in the chain.  The corresponding
11255  *     iodone side functions must coalesce the "shadow" bufs and return
11256  *     the "original" buf to the next higher layer.
11257  *
11258  *   - The b_private field of the buf(9S) struct holds a pointer to
11259  *     an sd_xbuf struct, which contains information needed to
11260  *     construct the scsi_pkt for the command.
11261  *
11262  *   - The SD_MUTEX(un) is NOT held across calls to the next layer. Each
11263  *     layer must acquire & release the SD_MUTEX(un) as needed.
11264  */
11265 
11266 
11267 /*
11268  * Create taskq for all targets in the system. This is created at
11269  * _init(9E) and destroyed at _fini(9E).
11270  *
11271  * Note: here we set the minalloc to a reasonably high number to ensure that
11272  * we will have an adequate supply of task entries available at interrupt time.
11273  * This is used in conjunction with the TASKQ_PREPOPULATE flag in
11274  * sd_create_taskq().  Since we do not want to sleep for allocations at
11275  * interrupt time, set maxalloc equal to minalloc. That way we will just fail
11276  * the command if we ever try to dispatch more than SD_TASKQ_MAXALLOC taskq
11277  * requests any one instant in time.
11278  */
11279 #define	SD_TASKQ_NUMTHREADS	8
11280 #define	SD_TASKQ_MINALLOC	256
11281 #define	SD_TASKQ_MAXALLOC	256
11282 
11283 static taskq_t	*sd_tq = NULL;
11284 _NOTE(SCHEME_PROTECTS_DATA("stable data", sd_tq))
11285 
11286 static int	sd_taskq_minalloc = SD_TASKQ_MINALLOC;
11287 static int	sd_taskq_maxalloc = SD_TASKQ_MAXALLOC;
11288 
11289 /*
11290  * The following task queue is being created for the write part of
11291  * read-modify-write of non-512 block size devices.
11292  * Limit the number of threads to 1 for now. This number has been chosen
11293  * considering the fact that it applies only to dvd ram drives/MO drives
11294  * currently. Performance for which is not main criteria at this stage.
11295  * Note: It needs to be explored if we can use a single taskq in future
11296  */
11297 #define	SD_WMR_TASKQ_NUMTHREADS	1
11298 static taskq_t	*sd_wmr_tq = NULL;
11299 _NOTE(SCHEME_PROTECTS_DATA("stable data", sd_wmr_tq))
11300 
11301 /*
11302  *    Function: sd_taskq_create
11303  *
11304  * Description: Create taskq thread(s) and preallocate task entries
11305  *
11306  * Return Code: Returns a pointer to the allocated taskq_t.
11307  *
11308  *     Context: Can sleep. Requires blockable context.
11309  *
11310  *       Notes: - The taskq() facility currently is NOT part of the DDI.
11311  *		  (definitely NOT recommeded for 3rd-party drivers!) :-)
11312  *		- taskq_create() will block for memory, also it will panic
11313  *		  if it cannot create the requested number of threads.
11314  *		- Currently taskq_create() creates threads that cannot be
11315  *		  swapped.
11316  *		- We use TASKQ_PREPOPULATE to ensure we have an adequate
11317  *		  supply of taskq entries at interrupt time (ie, so that we
11318  *		  do not have to sleep for memory)
11319  */
11320 
11321 static void
11322 sd_taskq_create(void)
11323 {
11324 	char	taskq_name[TASKQ_NAMELEN];
11325 
11326 	ASSERT(sd_tq == NULL);
11327 	ASSERT(sd_wmr_tq == NULL);
11328 
11329 	(void) snprintf(taskq_name, sizeof (taskq_name),
11330 	    "%s_drv_taskq", sd_label);
11331 	sd_tq = (taskq_create(taskq_name, SD_TASKQ_NUMTHREADS,
11332 	    (v.v_maxsyspri - 2), sd_taskq_minalloc, sd_taskq_maxalloc,
11333 	    TASKQ_PREPOPULATE));
11334 
11335 	(void) snprintf(taskq_name, sizeof (taskq_name),
11336 	    "%s_rmw_taskq", sd_label);
11337 	sd_wmr_tq = (taskq_create(taskq_name, SD_WMR_TASKQ_NUMTHREADS,
11338 	    (v.v_maxsyspri - 2), sd_taskq_minalloc, sd_taskq_maxalloc,
11339 	    TASKQ_PREPOPULATE));
11340 }
11341 
11342 
11343 /*
11344  *    Function: sd_taskq_delete
11345  *
11346  * Description: Complementary cleanup routine for sd_taskq_create().
11347  *
11348  *     Context: Kernel thread context.
11349  */
11350 
11351 static void
11352 sd_taskq_delete(void)
11353 {
11354 	ASSERT(sd_tq != NULL);
11355 	ASSERT(sd_wmr_tq != NULL);
11356 	taskq_destroy(sd_tq);
11357 	taskq_destroy(sd_wmr_tq);
11358 	sd_tq = NULL;
11359 	sd_wmr_tq = NULL;
11360 }
11361 
11362 
11363 /*
11364  *    Function: sdstrategy
11365  *
11366  * Description: Driver's strategy (9E) entry point function.
11367  *
11368  *   Arguments: bp - pointer to buf(9S)
11369  *
11370  * Return Code: Always returns zero
11371  *
11372  *     Context: Kernel thread context.
11373  */
11374 
11375 static int
11376 sdstrategy(struct buf *bp)
11377 {
11378 	struct sd_lun *un;
11379 
11380 	un = ddi_get_soft_state(sd_state, SD_GET_INSTANCE_FROM_BUF(bp));
11381 	if (un == NULL) {
11382 		bioerror(bp, EIO);
11383 		bp->b_resid = bp->b_bcount;
11384 		biodone(bp);
11385 		return (0);
11386 	}
11387 
11388 	/* As was done in the past, fail new cmds. if state is dumping. */
11389 	if (un->un_state == SD_STATE_DUMPING) {
11390 		bioerror(bp, ENXIO);
11391 		bp->b_resid = bp->b_bcount;
11392 		biodone(bp);
11393 		return (0);
11394 	}
11395 
11396 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11397 
11398 	/*
11399 	 * Commands may sneak in while we released the mutex in
11400 	 * DDI_SUSPEND, we should block new commands. However, old
11401 	 * commands that are still in the driver at this point should
11402 	 * still be allowed to drain.
11403 	 */
11404 	mutex_enter(SD_MUTEX(un));
11405 	/*
11406 	 * Must wait here if either the device is suspended or
11407 	 * if it's power level is changing.
11408 	 */
11409 	while ((un->un_state == SD_STATE_SUSPENDED) ||
11410 	    (un->un_state == SD_STATE_PM_CHANGING)) {
11411 		cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
11412 	}
11413 
11414 	un->un_ncmds_in_driver++;
11415 
11416 	/*
11417 	 * atapi: Since we are running the CD for now in PIO mode we need to
11418 	 * call bp_mapin here to avoid bp_mapin called interrupt context under
11419 	 * the HBA's init_pkt routine.
11420 	 */
11421 	if (un->un_f_cfg_is_atapi == TRUE) {
11422 		mutex_exit(SD_MUTEX(un));
11423 		bp_mapin(bp);
11424 		mutex_enter(SD_MUTEX(un));
11425 	}
11426 	SD_INFO(SD_LOG_IO, un, "sdstrategy: un_ncmds_in_driver = %ld\n",
11427 	    un->un_ncmds_in_driver);
11428 
11429 	if (bp->b_flags & B_WRITE)
11430 		un->un_f_sync_cache_required = TRUE;
11431 
11432 	mutex_exit(SD_MUTEX(un));
11433 
11434 	/*
11435 	 * This will (eventually) allocate the sd_xbuf area and
11436 	 * call sd_xbuf_strategy().  We just want to return the
11437 	 * result of ddi_xbuf_qstrategy so that we have an opt-
11438 	 * imized tail call which saves us a stack frame.
11439 	 */
11440 	return (ddi_xbuf_qstrategy(bp, un->un_xbuf_attr));
11441 }
11442 
11443 
11444 /*
11445  *    Function: sd_xbuf_strategy
11446  *
11447  * Description: Function for initiating IO operations via the
11448  *		ddi_xbuf_qstrategy() mechanism.
11449  *
11450  *     Context: Kernel thread context.
11451  */
11452 
11453 static void
11454 sd_xbuf_strategy(struct buf *bp, ddi_xbuf_t xp, void *arg)
11455 {
11456 	struct sd_lun *un = arg;
11457 
11458 	ASSERT(bp != NULL);
11459 	ASSERT(xp != NULL);
11460 	ASSERT(un != NULL);
11461 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11462 
11463 	/*
11464 	 * Initialize the fields in the xbuf and save a pointer to the
11465 	 * xbuf in bp->b_private.
11466 	 */
11467 	sd_xbuf_init(un, bp, xp, SD_CHAIN_BUFIO, NULL);
11468 
11469 	/* Send the buf down the iostart chain */
11470 	SD_BEGIN_IOSTART(((struct sd_xbuf *)xp)->xb_chain_iostart, un, bp);
11471 }
11472 
11473 
11474 /*
11475  *    Function: sd_xbuf_init
11476  *
11477  * Description: Prepare the given sd_xbuf struct for use.
11478  *
11479  *   Arguments: un - ptr to softstate
11480  *		bp - ptr to associated buf(9S)
11481  *		xp - ptr to associated sd_xbuf
11482  *		chain_type - IO chain type to use:
11483  *			SD_CHAIN_NULL
11484  *			SD_CHAIN_BUFIO
11485  *			SD_CHAIN_USCSI
11486  *			SD_CHAIN_DIRECT
11487  *			SD_CHAIN_DIRECT_PRIORITY
11488  *		pktinfop - ptr to private data struct for scsi_pkt(9S)
11489  *			initialization; may be NULL if none.
11490  *
11491  *     Context: Kernel thread context
11492  */
11493 
11494 static void
11495 sd_xbuf_init(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
11496 	uchar_t chain_type, void *pktinfop)
11497 {
11498 	int index;
11499 
11500 	ASSERT(un != NULL);
11501 	ASSERT(bp != NULL);
11502 	ASSERT(xp != NULL);
11503 
11504 	SD_INFO(SD_LOG_IO, un, "sd_xbuf_init: buf:0x%p chain type:0x%x\n",
11505 	    bp, chain_type);
11506 
11507 	xp->xb_un	= un;
11508 	xp->xb_pktp	= NULL;
11509 	xp->xb_pktinfo	= pktinfop;
11510 	xp->xb_private	= bp->b_private;
11511 	xp->xb_blkno	= (daddr_t)bp->b_blkno;
11512 
11513 	/*
11514 	 * Set up the iostart and iodone chain indexes in the xbuf, based
11515 	 * upon the specified chain type to use.
11516 	 */
11517 	switch (chain_type) {
11518 	case SD_CHAIN_NULL:
11519 		/*
11520 		 * Fall thru to just use the values for the buf type, even
11521 		 * tho for the NULL chain these values will never be used.
11522 		 */
11523 		/* FALLTHRU */
11524 	case SD_CHAIN_BUFIO:
11525 		index = un->un_buf_chain_type;
11526 		if ((!un->un_f_has_removable_media) &&
11527 		    (un->un_tgt_blocksize != 0) &&
11528 		    (un->un_tgt_blocksize != DEV_BSIZE)) {
11529 			int secmask = 0, blknomask = 0;
11530 			blknomask =
11531 			    (un->un_tgt_blocksize / DEV_BSIZE) - 1;
11532 			secmask = un->un_tgt_blocksize - 1;
11533 
11534 			if ((bp->b_lblkno & (blknomask)) ||
11535 			    (bp->b_bcount & (secmask))) {
11536 				if (un->un_f_rmw_type !=
11537 				    SD_RMW_TYPE_RETURN_ERROR) {
11538 					if (un->un_f_pm_is_enabled == FALSE)
11539 						index =
11540 						    SD_CHAIN_INFO_MSS_DSK_NO_PM;
11541 					else
11542 						index =
11543 						    SD_CHAIN_INFO_MSS_DISK;
11544 				}
11545 			}
11546 		}
11547 		break;
11548 	case SD_CHAIN_USCSI:
11549 		index = un->un_uscsi_chain_type;
11550 		break;
11551 	case SD_CHAIN_DIRECT:
11552 		index = un->un_direct_chain_type;
11553 		break;
11554 	case SD_CHAIN_DIRECT_PRIORITY:
11555 		index = un->un_priority_chain_type;
11556 		break;
11557 	default:
11558 		/* We're really broken if we ever get here... */
11559 		panic("sd_xbuf_init: illegal chain type!");
11560 		/*NOTREACHED*/
11561 	}
11562 
11563 	xp->xb_chain_iostart = sd_chain_index_map[index].sci_iostart_index;
11564 	xp->xb_chain_iodone = sd_chain_index_map[index].sci_iodone_index;
11565 
11566 	/*
11567 	 * It might be a bit easier to simply bzero the entire xbuf above,
11568 	 * but it turns out that since we init a fair number of members anyway,
11569 	 * we save a fair number cycles by doing explicit assignment of zero.
11570 	 */
11571 	xp->xb_pkt_flags	= 0;
11572 	xp->xb_dma_resid	= 0;
11573 	xp->xb_retry_count	= 0;
11574 	xp->xb_victim_retry_count = 0;
11575 	xp->xb_ua_retry_count	= 0;
11576 	xp->xb_nr_retry_count	= 0;
11577 	xp->xb_sense_bp		= NULL;
11578 	xp->xb_sense_status	= 0;
11579 	xp->xb_sense_state	= 0;
11580 	xp->xb_sense_resid	= 0;
11581 	xp->xb_ena		= 0;
11582 
11583 	bp->b_private	= xp;
11584 	bp->b_flags	&= ~(B_DONE | B_ERROR);
11585 	bp->b_resid	= 0;
11586 	bp->av_forw	= NULL;
11587 	bp->av_back	= NULL;
11588 	bioerror(bp, 0);
11589 
11590 	SD_INFO(SD_LOG_IO, un, "sd_xbuf_init: done.\n");
11591 }
11592 
11593 
11594 /*
11595  *    Function: sd_uscsi_strategy
11596  *
11597  * Description: Wrapper for calling into the USCSI chain via physio(9F)
11598  *
11599  *   Arguments: bp - buf struct ptr
11600  *
11601  * Return Code: Always returns 0
11602  *
11603  *     Context: Kernel thread context
11604  */
11605 
11606 static int
11607 sd_uscsi_strategy(struct buf *bp)
11608 {
11609 	struct sd_lun		*un;
11610 	struct sd_uscsi_info	*uip;
11611 	struct sd_xbuf		*xp;
11612 	uchar_t			chain_type;
11613 	uchar_t			cmd;
11614 
11615 	ASSERT(bp != NULL);
11616 
11617 	un = ddi_get_soft_state(sd_state, SD_GET_INSTANCE_FROM_BUF(bp));
11618 	if (un == NULL) {
11619 		bioerror(bp, EIO);
11620 		bp->b_resid = bp->b_bcount;
11621 		biodone(bp);
11622 		return (0);
11623 	}
11624 
11625 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11626 
11627 	SD_TRACE(SD_LOG_IO, un, "sd_uscsi_strategy: entry: buf:0x%p\n", bp);
11628 
11629 	/*
11630 	 * A pointer to a struct sd_uscsi_info is expected in bp->b_private
11631 	 */
11632 	ASSERT(bp->b_private != NULL);
11633 	uip = (struct sd_uscsi_info *)bp->b_private;
11634 	cmd = ((struct uscsi_cmd *)(uip->ui_cmdp))->uscsi_cdb[0];
11635 
11636 	mutex_enter(SD_MUTEX(un));
11637 	/*
11638 	 * atapi: Since we are running the CD for now in PIO mode we need to
11639 	 * call bp_mapin here to avoid bp_mapin called interrupt context under
11640 	 * the HBA's init_pkt routine.
11641 	 */
11642 	if (un->un_f_cfg_is_atapi == TRUE) {
11643 		mutex_exit(SD_MUTEX(un));
11644 		bp_mapin(bp);
11645 		mutex_enter(SD_MUTEX(un));
11646 	}
11647 	un->un_ncmds_in_driver++;
11648 	SD_INFO(SD_LOG_IO, un, "sd_uscsi_strategy: un_ncmds_in_driver = %ld\n",
11649 	    un->un_ncmds_in_driver);
11650 
11651 	if ((bp->b_flags & B_WRITE) && (bp->b_bcount != 0) &&
11652 	    (cmd != SCMD_MODE_SELECT) && (cmd != SCMD_MODE_SELECT_G1))
11653 		un->un_f_sync_cache_required = TRUE;
11654 
11655 	mutex_exit(SD_MUTEX(un));
11656 
11657 	switch (uip->ui_flags) {
11658 	case SD_PATH_DIRECT:
11659 		chain_type = SD_CHAIN_DIRECT;
11660 		break;
11661 	case SD_PATH_DIRECT_PRIORITY:
11662 		chain_type = SD_CHAIN_DIRECT_PRIORITY;
11663 		break;
11664 	default:
11665 		chain_type = SD_CHAIN_USCSI;
11666 		break;
11667 	}
11668 
11669 	/*
11670 	 * We may allocate extra buf for external USCSI commands. If the
11671 	 * application asks for bigger than 20-byte sense data via USCSI,
11672 	 * SCSA layer will allocate 252 bytes sense buf for that command.
11673 	 */
11674 	if (((struct uscsi_cmd *)(uip->ui_cmdp))->uscsi_rqlen >
11675 	    SENSE_LENGTH) {
11676 		xp = kmem_zalloc(sizeof (struct sd_xbuf) - SENSE_LENGTH +
11677 		    MAX_SENSE_LENGTH, KM_SLEEP);
11678 	} else {
11679 		xp = kmem_zalloc(sizeof (struct sd_xbuf), KM_SLEEP);
11680 	}
11681 
11682 	sd_xbuf_init(un, bp, xp, chain_type, uip->ui_cmdp);
11683 
11684 	/* Use the index obtained within xbuf_init */
11685 	SD_BEGIN_IOSTART(xp->xb_chain_iostart, un, bp);
11686 
11687 	SD_TRACE(SD_LOG_IO, un, "sd_uscsi_strategy: exit: buf:0x%p\n", bp);
11688 
11689 	return (0);
11690 }
11691 
11692 /*
11693  *    Function: sd_send_scsi_cmd
11694  *
11695  * Description: Runs a USCSI command for user (when called thru sdioctl),
11696  *		or for the driver
11697  *
11698  *   Arguments: dev - the dev_t for the device
11699  *		incmd - ptr to a valid uscsi_cmd struct
11700  *		flag - bit flag, indicating open settings, 32/64 bit type
11701  *		dataspace - UIO_USERSPACE or UIO_SYSSPACE
11702  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
11703  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
11704  *			to use the USCSI "direct" chain and bypass the normal
11705  *			command waitq.
11706  *
11707  * Return Code: 0 -  successful completion of the given command
11708  *		EIO - scsi_uscsi_handle_command() failed
11709  *		ENXIO  - soft state not found for specified dev
11710  *		EINVAL
11711  *		EFAULT - copyin/copyout error
11712  *		return code of scsi_uscsi_handle_command():
11713  *			EIO
11714  *			ENXIO
11715  *			EACCES
11716  *
11717  *     Context: Waits for command to complete. Can sleep.
11718  */
11719 
11720 static int
11721 sd_send_scsi_cmd(dev_t dev, struct uscsi_cmd *incmd, int flag,
11722 	enum uio_seg dataspace, int path_flag)
11723 {
11724 	struct sd_lun	*un;
11725 	sd_ssc_t	*ssc;
11726 	int		rval;
11727 
11728 	un = ddi_get_soft_state(sd_state, SDUNIT(dev));
11729 	if (un == NULL) {
11730 		return (ENXIO);
11731 	}
11732 
11733 	/*
11734 	 * Using sd_ssc_send to handle uscsi cmd
11735 	 */
11736 	ssc = sd_ssc_init(un);
11737 	rval = sd_ssc_send(ssc, incmd, flag, dataspace, path_flag);
11738 	sd_ssc_fini(ssc);
11739 
11740 	return (rval);
11741 }
11742 
11743 /*
11744  *    Function: sd_ssc_init
11745  *
11746  * Description: Uscsi end-user call this function to initialize necessary
11747  *              fields, such as uscsi_cmd and sd_uscsi_info struct.
11748  *
11749  *              The return value of sd_send_scsi_cmd will be treated as a
11750  *              fault in various conditions. Even it is not Zero, some
11751  *              callers may ignore the return value. That is to say, we can
11752  *              not make an accurate assessment in sdintr, since if a
11753  *              command is failed in sdintr it does not mean the caller of
11754  *              sd_send_scsi_cmd will treat it as a real failure.
11755  *
11756  *              To avoid printing too many error logs for a failed uscsi
11757  *              packet that the caller may not treat it as a failure, the
11758  *              sd will keep silent for handling all uscsi commands.
11759  *
11760  *              During detach->attach and attach-open, for some types of
11761  *              problems, the driver should be providing information about
11762  *              the problem encountered. Device use USCSI_SILENT, which
11763  *              suppresses all driver information. The result is that no
11764  *              information about the problem is available. Being
11765  *              completely silent during this time is inappropriate. The
11766  *              driver needs a more selective filter than USCSI_SILENT, so
11767  *              that information related to faults is provided.
11768  *
11769  *              To make the accurate accessment, the caller  of
11770  *              sd_send_scsi_USCSI_CMD should take the ownership and
11771  *              get necessary information to print error messages.
11772  *
11773  *              If we want to print necessary info of uscsi command, we need to
11774  *              keep the uscsi_cmd and sd_uscsi_info till we can make the
11775  *              assessment. We use sd_ssc_init to alloc necessary
11776  *              structs for sending an uscsi command and we are also
11777  *              responsible for free the memory by calling
11778  *              sd_ssc_fini.
11779  *
11780  *              The calling secquences will look like:
11781  *              sd_ssc_init->
11782  *
11783  *                  ...
11784  *
11785  *                  sd_send_scsi_USCSI_CMD->
11786  *                      sd_ssc_send-> - - - sdintr
11787  *                  ...
11788  *
11789  *                  if we think the return value should be treated as a
11790  *                  failure, we make the accessment here and print out
11791  *                  necessary by retrieving uscsi_cmd and sd_uscsi_info'
11792  *
11793  *                  ...
11794  *
11795  *              sd_ssc_fini
11796  *
11797  *
11798  *   Arguments: un - pointer to driver soft state (unit) structure for this
11799  *                   target.
11800  *
11801  * Return code: sd_ssc_t - pointer to allocated sd_ssc_t struct, it contains
11802  *                         uscsi_cmd and sd_uscsi_info.
11803  *                  NULL - if can not alloc memory for sd_ssc_t struct
11804  *
11805  *     Context: Kernel Thread.
11806  */
11807 static sd_ssc_t *
11808 sd_ssc_init(struct sd_lun *un)
11809 {
11810 	sd_ssc_t		*ssc;
11811 	struct uscsi_cmd	*ucmdp;
11812 	struct sd_uscsi_info	*uip;
11813 
11814 	ASSERT(un != NULL);
11815 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11816 
11817 	/*
11818 	 * Allocate sd_ssc_t structure
11819 	 */
11820 	ssc = kmem_zalloc(sizeof (sd_ssc_t), KM_SLEEP);
11821 
11822 	/*
11823 	 * Allocate uscsi_cmd by calling scsi_uscsi_alloc common routine
11824 	 */
11825 	ucmdp = scsi_uscsi_alloc();
11826 
11827 	/*
11828 	 * Allocate sd_uscsi_info structure
11829 	 */
11830 	uip = kmem_zalloc(sizeof (struct sd_uscsi_info), KM_SLEEP);
11831 
11832 	ssc->ssc_uscsi_cmd = ucmdp;
11833 	ssc->ssc_uscsi_info = uip;
11834 	ssc->ssc_un = un;
11835 
11836 	return (ssc);
11837 }
11838 
11839 /*
11840  * Function: sd_ssc_fini
11841  *
11842  * Description: To free sd_ssc_t and it's hanging off
11843  *
11844  * Arguments: ssc - struct pointer of sd_ssc_t.
11845  */
11846 static void
11847 sd_ssc_fini(sd_ssc_t *ssc)
11848 {
11849 	scsi_uscsi_free(ssc->ssc_uscsi_cmd);
11850 
11851 	if (ssc->ssc_uscsi_info != NULL) {
11852 		kmem_free(ssc->ssc_uscsi_info, sizeof (struct sd_uscsi_info));
11853 		ssc->ssc_uscsi_info = NULL;
11854 	}
11855 
11856 	kmem_free(ssc, sizeof (sd_ssc_t));
11857 	ssc = NULL;
11858 }
11859 
11860 /*
11861  * Function: sd_ssc_send
11862  *
11863  * Description: Runs a USCSI command for user when called through sdioctl,
11864  *              or for the driver.
11865  *
11866  *   Arguments: ssc - the struct of sd_ssc_t will bring uscsi_cmd and
11867  *                    sd_uscsi_info in.
11868  *		incmd - ptr to a valid uscsi_cmd struct
11869  *		flag - bit flag, indicating open settings, 32/64 bit type
11870  *		dataspace - UIO_USERSPACE or UIO_SYSSPACE
11871  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
11872  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
11873  *			to use the USCSI "direct" chain and bypass the normal
11874  *			command waitq.
11875  *
11876  * Return Code: 0 -  successful completion of the given command
11877  *		EIO - scsi_uscsi_handle_command() failed
11878  *		ENXIO  - soft state not found for specified dev
11879  *		ECANCELED - command cancelled due to low power
11880  *		EINVAL
11881  *		EFAULT - copyin/copyout error
11882  *		return code of scsi_uscsi_handle_command():
11883  *			EIO
11884  *			ENXIO
11885  *			EACCES
11886  *
11887  *     Context: Kernel Thread;
11888  *              Waits for command to complete. Can sleep.
11889  */
11890 static int
11891 sd_ssc_send(sd_ssc_t *ssc, struct uscsi_cmd *incmd, int flag,
11892 	enum uio_seg dataspace, int path_flag)
11893 {
11894 	struct sd_uscsi_info	*uip;
11895 	struct uscsi_cmd	*uscmd;
11896 	struct sd_lun		*un;
11897 	dev_t			dev;
11898 
11899 	int	format = 0;
11900 	int	rval;
11901 
11902 	ASSERT(ssc != NULL);
11903 	un = ssc->ssc_un;
11904 	ASSERT(un != NULL);
11905 	uscmd = ssc->ssc_uscsi_cmd;
11906 	ASSERT(uscmd != NULL);
11907 	ASSERT(!mutex_owned(SD_MUTEX(un)));
11908 	if (ssc->ssc_flags & SSC_FLAGS_NEED_ASSESSMENT) {
11909 		/*
11910 		 * If enter here, it indicates that the previous uscsi
11911 		 * command has not been processed by sd_ssc_assessment.
11912 		 * This is violating our rules of FMA telemetry processing.
11913 		 * We should print out this message and the last undisposed
11914 		 * uscsi command.
11915 		 */
11916 		if (uscmd->uscsi_cdb != NULL) {
11917 			SD_INFO(SD_LOG_SDTEST, un,
11918 			    "sd_ssc_send is missing the alternative "
11919 			    "sd_ssc_assessment when running command 0x%x.\n",
11920 			    uscmd->uscsi_cdb[0]);
11921 		}
11922 		/*
11923 		 * Set the ssc_flags to SSC_FLAGS_UNKNOWN, which should be
11924 		 * the initial status.
11925 		 */
11926 		ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
11927 	}
11928 
11929 	/*
11930 	 * We need to make sure sd_ssc_send will have sd_ssc_assessment
11931 	 * followed to avoid missing FMA telemetries.
11932 	 */
11933 	ssc->ssc_flags |= SSC_FLAGS_NEED_ASSESSMENT;
11934 
11935 	/*
11936 	 * if USCSI_PMFAILFAST is set and un is in low power, fail the
11937 	 * command immediately.
11938 	 */
11939 	mutex_enter(SD_MUTEX(un));
11940 	mutex_enter(&un->un_pm_mutex);
11941 	if ((uscmd->uscsi_flags & USCSI_PMFAILFAST) &&
11942 	    SD_DEVICE_IS_IN_LOW_POWER(un)) {
11943 		SD_TRACE(SD_LOG_IO, un, "sd_ssc_send:"
11944 		    "un:0x%p is in low power\n", un);
11945 		mutex_exit(&un->un_pm_mutex);
11946 		mutex_exit(SD_MUTEX(un));
11947 		return (ECANCELED);
11948 	}
11949 	mutex_exit(&un->un_pm_mutex);
11950 	mutex_exit(SD_MUTEX(un));
11951 
11952 #ifdef SDDEBUG
11953 	switch (dataspace) {
11954 	case UIO_USERSPACE:
11955 		SD_TRACE(SD_LOG_IO, un,
11956 		    "sd_ssc_send: entry: un:0x%p UIO_USERSPACE\n", un);
11957 		break;
11958 	case UIO_SYSSPACE:
11959 		SD_TRACE(SD_LOG_IO, un,
11960 		    "sd_ssc_send: entry: un:0x%p UIO_SYSSPACE\n", un);
11961 		break;
11962 	default:
11963 		SD_TRACE(SD_LOG_IO, un,
11964 		    "sd_ssc_send: entry: un:0x%p UNEXPECTED SPACE\n", un);
11965 		break;
11966 	}
11967 #endif
11968 
11969 	rval = scsi_uscsi_copyin((intptr_t)incmd, flag,
11970 	    SD_ADDRESS(un), &uscmd);
11971 	if (rval != 0) {
11972 		SD_TRACE(SD_LOG_IO, un, "sd_sense_scsi_cmd: "
11973 		    "scsi_uscsi_alloc_and_copyin failed\n", un);
11974 		return (rval);
11975 	}
11976 
11977 	if ((uscmd->uscsi_cdb != NULL) &&
11978 	    (uscmd->uscsi_cdb[0] == SCMD_FORMAT)) {
11979 		mutex_enter(SD_MUTEX(un));
11980 		un->un_f_format_in_progress = TRUE;
11981 		mutex_exit(SD_MUTEX(un));
11982 		format = 1;
11983 	}
11984 
11985 	/*
11986 	 * Allocate an sd_uscsi_info struct and fill it with the info
11987 	 * needed by sd_initpkt_for_uscsi().  Then put the pointer into
11988 	 * b_private in the buf for sd_initpkt_for_uscsi().  Note that
11989 	 * since we allocate the buf here in this function, we do not
11990 	 * need to preserve the prior contents of b_private.
11991 	 * The sd_uscsi_info struct is also used by sd_uscsi_strategy()
11992 	 */
11993 	uip = ssc->ssc_uscsi_info;
11994 	uip->ui_flags = path_flag;
11995 	uip->ui_cmdp = uscmd;
11996 
11997 	/*
11998 	 * Commands sent with priority are intended for error recovery
11999 	 * situations, and do not have retries performed.
12000 	 */
12001 	if (path_flag == SD_PATH_DIRECT_PRIORITY) {
12002 		uscmd->uscsi_flags |= USCSI_DIAGNOSE;
12003 	}
12004 	uscmd->uscsi_flags &= ~USCSI_NOINTR;
12005 
12006 	dev = SD_GET_DEV(un);
12007 	rval = scsi_uscsi_handle_cmd(dev, dataspace, uscmd,
12008 	    sd_uscsi_strategy, NULL, uip);
12009 
12010 	/*
12011 	 * mark ssc_flags right after handle_cmd to make sure
12012 	 * the uscsi has been sent
12013 	 */
12014 	ssc->ssc_flags |= SSC_FLAGS_CMD_ISSUED;
12015 
12016 #ifdef SDDEBUG
12017 	SD_INFO(SD_LOG_IO, un, "sd_ssc_send: "
12018 	    "uscsi_status: 0x%02x  uscsi_resid:0x%x\n",
12019 	    uscmd->uscsi_status, uscmd->uscsi_resid);
12020 	if (uscmd->uscsi_bufaddr != NULL) {
12021 		SD_INFO(SD_LOG_IO, un, "sd_ssc_send: "
12022 		    "uscmd->uscsi_bufaddr: 0x%p  uscmd->uscsi_buflen:%d\n",
12023 		    uscmd->uscsi_bufaddr, uscmd->uscsi_buflen);
12024 		if (dataspace == UIO_SYSSPACE) {
12025 			SD_DUMP_MEMORY(un, SD_LOG_IO,
12026 			    "data", (uchar_t *)uscmd->uscsi_bufaddr,
12027 			    uscmd->uscsi_buflen, SD_LOG_HEX);
12028 		}
12029 	}
12030 #endif
12031 
12032 	if (format == 1) {
12033 		mutex_enter(SD_MUTEX(un));
12034 		un->un_f_format_in_progress = FALSE;
12035 		mutex_exit(SD_MUTEX(un));
12036 	}
12037 
12038 	(void) scsi_uscsi_copyout((intptr_t)incmd, uscmd);
12039 
12040 	return (rval);
12041 }
12042 
12043 /*
12044  *     Function: sd_ssc_print
12045  *
12046  * Description: Print information available to the console.
12047  *
12048  * Arguments: ssc - the struct of sd_ssc_t will bring uscsi_cmd and
12049  *                    sd_uscsi_info in.
12050  *            sd_severity - log level.
12051  *     Context: Kernel thread or interrupt context.
12052  */
12053 static void
12054 sd_ssc_print(sd_ssc_t *ssc, int sd_severity)
12055 {
12056 	struct uscsi_cmd	*ucmdp;
12057 	struct scsi_device	*devp;
12058 	dev_info_t 		*devinfo;
12059 	uchar_t			*sensep;
12060 	int			senlen;
12061 	union scsi_cdb		*cdbp;
12062 	uchar_t			com;
12063 	extern struct scsi_key_strings scsi_cmds[];
12064 
12065 	ASSERT(ssc != NULL);
12066 	ASSERT(ssc->ssc_un != NULL);
12067 
12068 	if (SD_FM_LOG(ssc->ssc_un) != SD_FM_LOG_EREPORT)
12069 		return;
12070 	ucmdp = ssc->ssc_uscsi_cmd;
12071 	devp = SD_SCSI_DEVP(ssc->ssc_un);
12072 	devinfo = SD_DEVINFO(ssc->ssc_un);
12073 	ASSERT(ucmdp != NULL);
12074 	ASSERT(devp != NULL);
12075 	ASSERT(devinfo != NULL);
12076 	sensep = (uint8_t *)ucmdp->uscsi_rqbuf;
12077 	senlen = ucmdp->uscsi_rqlen - ucmdp->uscsi_rqresid;
12078 	cdbp = (union scsi_cdb *)ucmdp->uscsi_cdb;
12079 
12080 	/* In certain case (like DOORLOCK), the cdb could be NULL. */
12081 	if (cdbp == NULL)
12082 		return;
12083 	/* We don't print log if no sense data available. */
12084 	if (senlen == 0)
12085 		sensep = NULL;
12086 	com = cdbp->scc_cmd;
12087 	scsi_generic_errmsg(devp, sd_label, sd_severity, 0, 0, com,
12088 	    scsi_cmds, sensep, ssc->ssc_un->un_additional_codes, NULL);
12089 }
12090 
12091 /*
12092  *     Function: sd_ssc_assessment
12093  *
12094  * Description: We use this function to make an assessment at the point
12095  *              where SD driver may encounter a potential error.
12096  *
12097  * Arguments: ssc - the struct of sd_ssc_t will bring uscsi_cmd and
12098  *                  sd_uscsi_info in.
12099  *            tp_assess - a hint of strategy for ereport posting.
12100  *            Possible values of tp_assess include:
12101  *                SD_FMT_IGNORE - we don't post any ereport because we're
12102  *                sure that it is ok to ignore the underlying problems.
12103  *                SD_FMT_IGNORE_COMPROMISE - we don't post any ereport for now
12104  *                but it might be not correct to ignore the underlying hardware
12105  *                error.
12106  *                SD_FMT_STATUS_CHECK - we will post an ereport with the
12107  *                payload driver-assessment of value "fail" or
12108  *                "fatal"(depending on what information we have here). This
12109  *                assessment value is usually set when SD driver think there
12110  *                is a potential error occurred(Typically, when return value
12111  *                of the SCSI command is EIO).
12112  *                SD_FMT_STANDARD - we will post an ereport with the payload
12113  *                driver-assessment of value "info". This assessment value is
12114  *                set when the SCSI command returned successfully and with
12115  *                sense data sent back.
12116  *
12117  *     Context: Kernel thread.
12118  */
12119 static void
12120 sd_ssc_assessment(sd_ssc_t *ssc, enum sd_type_assessment tp_assess)
12121 {
12122 	int senlen = 0;
12123 	struct uscsi_cmd *ucmdp = NULL;
12124 	struct sd_lun *un;
12125 
12126 	ASSERT(ssc != NULL);
12127 	un = ssc->ssc_un;
12128 	ASSERT(un != NULL);
12129 	ucmdp = ssc->ssc_uscsi_cmd;
12130 	ASSERT(ucmdp != NULL);
12131 
12132 	if (ssc->ssc_flags & SSC_FLAGS_NEED_ASSESSMENT) {
12133 		ssc->ssc_flags &= ~SSC_FLAGS_NEED_ASSESSMENT;
12134 	} else {
12135 		/*
12136 		 * If enter here, it indicates that we have a wrong
12137 		 * calling sequence of sd_ssc_send and sd_ssc_assessment,
12138 		 * both of which should be called in a pair in case of
12139 		 * loss of FMA telemetries.
12140 		 */
12141 		if (ucmdp->uscsi_cdb != NULL) {
12142 			SD_INFO(SD_LOG_SDTEST, un,
12143 			    "sd_ssc_assessment is missing the "
12144 			    "alternative sd_ssc_send when running 0x%x, "
12145 			    "or there are superfluous sd_ssc_assessment for "
12146 			    "the same sd_ssc_send.\n",
12147 			    ucmdp->uscsi_cdb[0]);
12148 		}
12149 		/*
12150 		 * Set the ssc_flags to the initial value to avoid passing
12151 		 * down dirty flags to the following sd_ssc_send function.
12152 		 */
12153 		ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12154 		return;
12155 	}
12156 
12157 	/*
12158 	 * Only handle an issued command which is waiting for assessment.
12159 	 * A command which is not issued will not have
12160 	 * SSC_FLAGS_INVALID_DATA set, so it'ok we just return here.
12161 	 */
12162 	if (!(ssc->ssc_flags & SSC_FLAGS_CMD_ISSUED)) {
12163 		sd_ssc_print(ssc, SCSI_ERR_INFO);
12164 		return;
12165 	} else {
12166 		/*
12167 		 * For an issued command, we should clear this flag in
12168 		 * order to make the sd_ssc_t structure be used off
12169 		 * multiple uscsi commands.
12170 		 */
12171 		ssc->ssc_flags &= ~SSC_FLAGS_CMD_ISSUED;
12172 	}
12173 
12174 	/*
12175 	 * We will not deal with non-retryable(flag USCSI_DIAGNOSE set)
12176 	 * commands here. And we should clear the ssc_flags before return.
12177 	 */
12178 	if (ucmdp->uscsi_flags & USCSI_DIAGNOSE) {
12179 		ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12180 		return;
12181 	}
12182 
12183 	switch (tp_assess) {
12184 	case SD_FMT_IGNORE:
12185 	case SD_FMT_IGNORE_COMPROMISE:
12186 		break;
12187 	case SD_FMT_STATUS_CHECK:
12188 		/*
12189 		 * For a failed command(including the succeeded command
12190 		 * with invalid data sent back).
12191 		 */
12192 		sd_ssc_post(ssc, SD_FM_DRV_FATAL);
12193 		break;
12194 	case SD_FMT_STANDARD:
12195 		/*
12196 		 * Always for the succeeded commands probably with sense
12197 		 * data sent back.
12198 		 * Limitation:
12199 		 *	We can only handle a succeeded command with sense
12200 		 *	data sent back when auto-request-sense is enabled.
12201 		 */
12202 		senlen = ssc->ssc_uscsi_cmd->uscsi_rqlen -
12203 		    ssc->ssc_uscsi_cmd->uscsi_rqresid;
12204 		if ((ssc->ssc_uscsi_info->ui_pkt_state & STATE_ARQ_DONE) &&
12205 		    (un->un_f_arq_enabled == TRUE) &&
12206 		    senlen > 0 &&
12207 		    ssc->ssc_uscsi_cmd->uscsi_rqbuf != NULL) {
12208 			sd_ssc_post(ssc, SD_FM_DRV_NOTICE);
12209 		}
12210 		break;
12211 	default:
12212 		/*
12213 		 * Should not have other type of assessment.
12214 		 */
12215 		scsi_log(SD_DEVINFO(un), sd_label, CE_CONT,
12216 		    "sd_ssc_assessment got wrong "
12217 		    "sd_type_assessment %d.\n", tp_assess);
12218 		break;
12219 	}
12220 	/*
12221 	 * Clear up the ssc_flags before return.
12222 	 */
12223 	ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12224 }
12225 
12226 /*
12227  *    Function: sd_ssc_post
12228  *
12229  * Description: 1. read the driver property to get fm-scsi-log flag.
12230  *              2. print log if fm_log_capable is non-zero.
12231  *              3. call sd_ssc_ereport_post to post ereport if possible.
12232  *
12233  *    Context: May be called from kernel thread or interrupt context.
12234  */
12235 static void
12236 sd_ssc_post(sd_ssc_t *ssc, enum sd_driver_assessment sd_assess)
12237 {
12238 	struct sd_lun	*un;
12239 	int		sd_severity;
12240 
12241 	ASSERT(ssc != NULL);
12242 	un = ssc->ssc_un;
12243 	ASSERT(un != NULL);
12244 
12245 	/*
12246 	 * We may enter here from sd_ssc_assessment(for USCSI command) or
12247 	 * by directly called from sdintr context.
12248 	 * We don't handle a non-disk drive(CD-ROM, removable media).
12249 	 * Clear the ssc_flags before return in case we've set
12250 	 * SSC_FLAGS_INVALID_XXX which should be skipped for a non-disk
12251 	 * driver.
12252 	 */
12253 	if (ISCD(un) || un->un_f_has_removable_media) {
12254 		ssc->ssc_flags = SSC_FLAGS_UNKNOWN;
12255 		return;
12256 	}
12257 
12258 	switch (sd_assess) {
12259 		case SD_FM_DRV_FATAL:
12260 			sd_severity = SCSI_ERR_FATAL;
12261 			break;
12262 		case SD_FM_DRV_RECOVERY:
12263 			sd_severity = SCSI_ERR_RECOVERED;
12264 			break;
12265 		case SD_FM_DRV_RETRY:
12266 			sd_severity = SCSI_ERR_RETRYABLE;
12267 			break;
12268 		case SD_FM_DRV_NOTICE:
12269 			sd_severity = SCSI_ERR_INFO;
12270 			break;
12271 		default:
12272 			sd_severity = SCSI_ERR_UNKNOWN;
12273 	}
12274 	/* print log */
12275 	sd_ssc_print(ssc, sd_severity);
12276 
12277 	/* always post ereport */
12278 	sd_ssc_ereport_post(ssc, sd_assess);
12279 }
12280 
12281 /*
12282  *    Function: sd_ssc_set_info
12283  *
12284  * Description: Mark ssc_flags and set ssc_info which would be the
12285  *              payload of uderr ereport. This function will cause
12286  *              sd_ssc_ereport_post to post uderr ereport only.
12287  *              Besides, when ssc_flags == SSC_FLAGS_INVALID_DATA(USCSI),
12288  *              the function will also call SD_ERROR or scsi_log for a
12289  *              CDROM/removable-media/DDI_FM_NOT_CAPABLE device.
12290  *
12291  * Arguments: ssc - the struct of sd_ssc_t will bring uscsi_cmd and
12292  *                  sd_uscsi_info in.
12293  *            ssc_flags - indicate the sub-category of a uderr.
12294  *            comp - this argument is meaningful only when
12295  *                   ssc_flags == SSC_FLAGS_INVALID_DATA, and its possible
12296  *                   values include:
12297  *                   > 0, SD_ERROR is used with comp as the driver logging
12298  *                   component;
12299  *                   = 0, scsi-log is used to log error telemetries;
12300  *                   < 0, no log available for this telemetry.
12301  *
12302  *    Context: Kernel thread or interrupt context
12303  */
12304 static void
12305 sd_ssc_set_info(sd_ssc_t *ssc, int ssc_flags, uint_t comp, const char *fmt, ...)
12306 {
12307 	va_list	ap;
12308 
12309 	ASSERT(ssc != NULL);
12310 	ASSERT(ssc->ssc_un != NULL);
12311 
12312 	ssc->ssc_flags |= ssc_flags;
12313 	va_start(ap, fmt);
12314 	(void) vsnprintf(ssc->ssc_info, sizeof (ssc->ssc_info), fmt, ap);
12315 	va_end(ap);
12316 
12317 	/*
12318 	 * If SSC_FLAGS_INVALID_DATA is set, it should be a uscsi command
12319 	 * with invalid data sent back. For non-uscsi command, the
12320 	 * following code will be bypassed.
12321 	 */
12322 	if (ssc_flags & SSC_FLAGS_INVALID_DATA) {
12323 		if (SD_FM_LOG(ssc->ssc_un) == SD_FM_LOG_NSUP) {
12324 			/*
12325 			 * If the error belong to certain component and we
12326 			 * do not want it to show up on the console, we
12327 			 * will use SD_ERROR, otherwise scsi_log is
12328 			 * preferred.
12329 			 */
12330 			if (comp > 0) {
12331 				SD_ERROR(comp, ssc->ssc_un, ssc->ssc_info);
12332 			} else if (comp == 0) {
12333 				scsi_log(SD_DEVINFO(ssc->ssc_un), sd_label,
12334 				    CE_WARN, ssc->ssc_info);
12335 			}
12336 		}
12337 	}
12338 }
12339 
12340 /*
12341  *    Function: sd_buf_iodone
12342  *
12343  * Description: Frees the sd_xbuf & returns the buf to its originator.
12344  *
12345  *     Context: May be called from interrupt context.
12346  */
12347 /* ARGSUSED */
12348 static void
12349 sd_buf_iodone(int index, struct sd_lun *un, struct buf *bp)
12350 {
12351 	struct sd_xbuf *xp;
12352 
12353 	ASSERT(un != NULL);
12354 	ASSERT(bp != NULL);
12355 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12356 
12357 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_buf_iodone: entry.\n");
12358 
12359 	xp = SD_GET_XBUF(bp);
12360 	ASSERT(xp != NULL);
12361 
12362 	/* xbuf is gone after this */
12363 	if (ddi_xbuf_done(bp, un->un_xbuf_attr)) {
12364 		mutex_enter(SD_MUTEX(un));
12365 
12366 		/*
12367 		 * Grab time when the cmd completed.
12368 		 * This is used for determining if the system has been
12369 		 * idle long enough to make it idle to the PM framework.
12370 		 * This is for lowering the overhead, and therefore improving
12371 		 * performance per I/O operation.
12372 		 */
12373 		un->un_pm_idle_time = ddi_get_time();
12374 
12375 		un->un_ncmds_in_driver--;
12376 		ASSERT(un->un_ncmds_in_driver >= 0);
12377 		SD_INFO(SD_LOG_IO, un,
12378 		    "sd_buf_iodone: un_ncmds_in_driver = %ld\n",
12379 		    un->un_ncmds_in_driver);
12380 
12381 		mutex_exit(SD_MUTEX(un));
12382 	}
12383 
12384 	biodone(bp);				/* bp is gone after this */
12385 
12386 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_buf_iodone: exit.\n");
12387 }
12388 
12389 
12390 /*
12391  *    Function: sd_uscsi_iodone
12392  *
12393  * Description: Frees the sd_xbuf & returns the buf to its originator.
12394  *
12395  *     Context: May be called from interrupt context.
12396  */
12397 /* ARGSUSED */
12398 static void
12399 sd_uscsi_iodone(int index, struct sd_lun *un, struct buf *bp)
12400 {
12401 	struct sd_xbuf *xp;
12402 
12403 	ASSERT(un != NULL);
12404 	ASSERT(bp != NULL);
12405 
12406 	xp = SD_GET_XBUF(bp);
12407 	ASSERT(xp != NULL);
12408 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12409 
12410 	SD_INFO(SD_LOG_IO, un, "sd_uscsi_iodone: entry.\n");
12411 
12412 	bp->b_private = xp->xb_private;
12413 
12414 	mutex_enter(SD_MUTEX(un));
12415 
12416 	/*
12417 	 * Grab time when the cmd completed.
12418 	 * This is used for determining if the system has been
12419 	 * idle long enough to make it idle to the PM framework.
12420 	 * This is for lowering the overhead, and therefore improving
12421 	 * performance per I/O operation.
12422 	 */
12423 	un->un_pm_idle_time = ddi_get_time();
12424 
12425 	un->un_ncmds_in_driver--;
12426 	ASSERT(un->un_ncmds_in_driver >= 0);
12427 	SD_INFO(SD_LOG_IO, un, "sd_uscsi_iodone: un_ncmds_in_driver = %ld\n",
12428 	    un->un_ncmds_in_driver);
12429 
12430 	mutex_exit(SD_MUTEX(un));
12431 
12432 	if (((struct uscsi_cmd *)(xp->xb_pktinfo))->uscsi_rqlen >
12433 	    SENSE_LENGTH) {
12434 		kmem_free(xp, sizeof (struct sd_xbuf) - SENSE_LENGTH +
12435 		    MAX_SENSE_LENGTH);
12436 	} else {
12437 		kmem_free(xp, sizeof (struct sd_xbuf));
12438 	}
12439 
12440 	biodone(bp);
12441 
12442 	SD_INFO(SD_LOG_IO, un, "sd_uscsi_iodone: exit.\n");
12443 }
12444 
12445 
12446 /*
12447  *    Function: sd_mapblockaddr_iostart
12448  *
12449  * Description: Verify request lies within the partition limits for
12450  *		the indicated minor device.  Issue "overrun" buf if
12451  *		request would exceed partition range.  Converts
12452  *		partition-relative block address to absolute.
12453  *
12454  *              Upon exit of this function:
12455  *              1.I/O is aligned
12456  *                 xp->xb_blkno represents the absolute sector address
12457  *              2.I/O is misaligned
12458  *                 xp->xb_blkno represents the absolute logical block address
12459  *                 based on DEV_BSIZE. The logical block address will be
12460  *                 converted to physical sector address in sd_mapblocksize_\
12461  *                 iostart.
12462  *              3.I/O is misaligned but is aligned in "overrun" buf
12463  *                 xp->xb_blkno represents the absolute logical block address
12464  *                 based on DEV_BSIZE. The logical block address will be
12465  *                 converted to physical sector address in sd_mapblocksize_\
12466  *                 iostart. But no RMW will be issued in this case.
12467  *
12468  *     Context: Can sleep
12469  *
12470  *      Issues: This follows what the old code did, in terms of accessing
12471  *		some of the partition info in the unit struct without holding
12472  *		the mutext.  This is a general issue, if the partition info
12473  *		can be altered while IO is in progress... as soon as we send
12474  *		a buf, its partitioning can be invalid before it gets to the
12475  *		device.  Probably the right fix is to move partitioning out
12476  *		of the driver entirely.
12477  */
12478 
12479 static void
12480 sd_mapblockaddr_iostart(int index, struct sd_lun *un, struct buf *bp)
12481 {
12482 	diskaddr_t	nblocks;	/* #blocks in the given partition */
12483 	daddr_t	blocknum;	/* Block number specified by the buf */
12484 	size_t	requested_nblocks;
12485 	size_t	available_nblocks;
12486 	int	partition;
12487 	diskaddr_t	partition_offset;
12488 	struct sd_xbuf *xp;
12489 	int secmask = 0, blknomask = 0;
12490 	ushort_t is_aligned = TRUE;
12491 
12492 	ASSERT(un != NULL);
12493 	ASSERT(bp != NULL);
12494 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12495 
12496 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12497 	    "sd_mapblockaddr_iostart: entry: buf:0x%p\n", bp);
12498 
12499 	xp = SD_GET_XBUF(bp);
12500 	ASSERT(xp != NULL);
12501 
12502 	/*
12503 	 * If the geometry is not indicated as valid, attempt to access
12504 	 * the unit & verify the geometry/label. This can be the case for
12505 	 * removable-media devices, of if the device was opened in
12506 	 * NDELAY/NONBLOCK mode.
12507 	 */
12508 	partition = SDPART(bp->b_edev);
12509 
12510 	if (!SD_IS_VALID_LABEL(un)) {
12511 		sd_ssc_t *ssc;
12512 		/*
12513 		 * Initialize sd_ssc_t for internal uscsi commands
12514 		 * In case of potential porformance issue, we need
12515 		 * to alloc memory only if there is invalid label
12516 		 */
12517 		ssc = sd_ssc_init(un);
12518 
12519 		if (sd_ready_and_valid(ssc, partition) != SD_READY_VALID) {
12520 			/*
12521 			 * For removable devices it is possible to start an
12522 			 * I/O without a media by opening the device in nodelay
12523 			 * mode. Also for writable CDs there can be many
12524 			 * scenarios where there is no geometry yet but volume
12525 			 * manager is trying to issue a read() just because
12526 			 * it can see TOC on the CD. So do not print a message
12527 			 * for removables.
12528 			 */
12529 			if (!un->un_f_has_removable_media) {
12530 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
12531 				    "i/o to invalid geometry\n");
12532 			}
12533 			bioerror(bp, EIO);
12534 			bp->b_resid = bp->b_bcount;
12535 			SD_BEGIN_IODONE(index, un, bp);
12536 
12537 			sd_ssc_fini(ssc);
12538 			return;
12539 		}
12540 		sd_ssc_fini(ssc);
12541 	}
12542 
12543 	nblocks = 0;
12544 	(void) cmlb_partinfo(un->un_cmlbhandle, partition,
12545 	    &nblocks, &partition_offset, NULL, NULL, (void *)SD_PATH_DIRECT);
12546 
12547 	blknomask = (un->un_tgt_blocksize / DEV_BSIZE) - 1;
12548 	secmask = un->un_tgt_blocksize - 1;
12549 
12550 	if ((bp->b_lblkno & (blknomask)) || (bp->b_bcount & (secmask))) {
12551 		is_aligned = FALSE;
12552 	}
12553 
12554 	if (!(NOT_DEVBSIZE(un))) {
12555 		/*
12556 		 * If I/O is aligned, no need to involve RMW(Read Modify Write)
12557 		 * Convert the logical block number to target's physical sector
12558 		 * number.
12559 		 */
12560 		if (is_aligned) {
12561 			xp->xb_blkno = SD_SYS2TGTBLOCK(un, xp->xb_blkno);
12562 		} else {
12563 			switch (un->un_f_rmw_type) {
12564 			case SD_RMW_TYPE_RETURN_ERROR:
12565 				bp->b_flags |= B_ERROR;
12566 				goto error_exit;
12567 
12568 			case SD_RMW_TYPE_DEFAULT:
12569 				mutex_enter(SD_MUTEX(un));
12570 				if (un->un_rmw_msg_timeid == NULL) {
12571 					scsi_log(SD_DEVINFO(un), sd_label,
12572 					    CE_WARN, "I/O request is not "
12573 					    "aligned with %d disk sector size. "
12574 					    "It is handled through Read Modify "
12575 					    "Write but the performance is "
12576 					    "very low.\n",
12577 					    un->un_tgt_blocksize);
12578 					un->un_rmw_msg_timeid =
12579 					    timeout(sd_rmw_msg_print_handler,
12580 					    un, SD_RMW_MSG_PRINT_TIMEOUT);
12581 				} else {
12582 					un->un_rmw_incre_count ++;
12583 				}
12584 				mutex_exit(SD_MUTEX(un));
12585 				break;
12586 
12587 			case SD_RMW_TYPE_NO_WARNING:
12588 			default:
12589 				break;
12590 			}
12591 
12592 			nblocks = SD_TGT2SYSBLOCK(un, nblocks);
12593 			partition_offset = SD_TGT2SYSBLOCK(un,
12594 			    partition_offset);
12595 		}
12596 	}
12597 
12598 	/*
12599 	 * blocknum is the starting block number of the request. At this
12600 	 * point it is still relative to the start of the minor device.
12601 	 */
12602 	blocknum = xp->xb_blkno;
12603 
12604 	/*
12605 	 * Legacy: If the starting block number is one past the last block
12606 	 * in the partition, do not set B_ERROR in the buf.
12607 	 */
12608 	if (blocknum == nblocks)  {
12609 		goto error_exit;
12610 	}
12611 
12612 	/*
12613 	 * Confirm that the first block of the request lies within the
12614 	 * partition limits. Also the requested number of bytes must be
12615 	 * a multiple of the system block size.
12616 	 */
12617 	if ((blocknum < 0) || (blocknum >= nblocks) ||
12618 	    ((bp->b_bcount & (DEV_BSIZE - 1)) != 0)) {
12619 		bp->b_flags |= B_ERROR;
12620 		goto error_exit;
12621 	}
12622 
12623 	/*
12624 	 * If the requsted # blocks exceeds the available # blocks, that
12625 	 * is an overrun of the partition.
12626 	 */
12627 	if ((!NOT_DEVBSIZE(un)) && is_aligned) {
12628 		requested_nblocks = SD_BYTES2TGTBLOCKS(un, bp->b_bcount);
12629 	} else {
12630 		requested_nblocks = SD_BYTES2SYSBLOCKS(bp->b_bcount);
12631 	}
12632 
12633 	available_nblocks = (size_t)(nblocks - blocknum);
12634 	ASSERT(nblocks >= blocknum);
12635 
12636 	if (requested_nblocks > available_nblocks) {
12637 		size_t resid;
12638 
12639 		/*
12640 		 * Allocate an "overrun" buf to allow the request to proceed
12641 		 * for the amount of space available in the partition. The
12642 		 * amount not transferred will be added into the b_resid
12643 		 * when the operation is complete. The overrun buf
12644 		 * replaces the original buf here, and the original buf
12645 		 * is saved inside the overrun buf, for later use.
12646 		 */
12647 		if ((!NOT_DEVBSIZE(un)) && is_aligned) {
12648 			resid = SD_TGTBLOCKS2BYTES(un,
12649 			    (offset_t)(requested_nblocks - available_nblocks));
12650 		} else {
12651 			resid = SD_SYSBLOCKS2BYTES(
12652 			    (offset_t)(requested_nblocks - available_nblocks));
12653 		}
12654 
12655 		size_t count = bp->b_bcount - resid;
12656 		/*
12657 		 * Note: count is an unsigned entity thus it'll NEVER
12658 		 * be less than 0 so ASSERT the original values are
12659 		 * correct.
12660 		 */
12661 		ASSERT(bp->b_bcount >= resid);
12662 
12663 		bp = sd_bioclone_alloc(bp, count, blocknum,
12664 		    (int (*)(struct buf *)) sd_mapblockaddr_iodone);
12665 		xp = SD_GET_XBUF(bp); /* Update for 'new' bp! */
12666 		ASSERT(xp != NULL);
12667 	}
12668 
12669 	/* At this point there should be no residual for this buf. */
12670 	ASSERT(bp->b_resid == 0);
12671 
12672 	/* Convert the block number to an absolute address. */
12673 	xp->xb_blkno += partition_offset;
12674 
12675 	SD_NEXT_IOSTART(index, un, bp);
12676 
12677 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12678 	    "sd_mapblockaddr_iostart: exit 0: buf:0x%p\n", bp);
12679 
12680 	return;
12681 
12682 error_exit:
12683 	bp->b_resid = bp->b_bcount;
12684 	SD_BEGIN_IODONE(index, un, bp);
12685 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12686 	    "sd_mapblockaddr_iostart: exit 1: buf:0x%p\n", bp);
12687 }
12688 
12689 
12690 /*
12691  *    Function: sd_mapblockaddr_iodone
12692  *
12693  * Description: Completion-side processing for partition management.
12694  *
12695  *     Context: May be called under interrupt context
12696  */
12697 
12698 static void
12699 sd_mapblockaddr_iodone(int index, struct sd_lun *un, struct buf *bp)
12700 {
12701 	/* int	partition; */	/* Not used, see below. */
12702 	ASSERT(un != NULL);
12703 	ASSERT(bp != NULL);
12704 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12705 
12706 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12707 	    "sd_mapblockaddr_iodone: entry: buf:0x%p\n", bp);
12708 
12709 	if (bp->b_iodone == (int (*)(struct buf *)) sd_mapblockaddr_iodone) {
12710 		/*
12711 		 * We have an "overrun" buf to deal with...
12712 		 */
12713 		struct sd_xbuf	*xp;
12714 		struct buf	*obp;	/* ptr to the original buf */
12715 
12716 		xp = SD_GET_XBUF(bp);
12717 		ASSERT(xp != NULL);
12718 
12719 		/* Retrieve the pointer to the original buf */
12720 		obp = (struct buf *)xp->xb_private;
12721 		ASSERT(obp != NULL);
12722 
12723 		obp->b_resid = obp->b_bcount - (bp->b_bcount - bp->b_resid);
12724 		bioerror(obp, bp->b_error);
12725 
12726 		sd_bioclone_free(bp);
12727 
12728 		/*
12729 		 * Get back the original buf.
12730 		 * Note that since the restoration of xb_blkno below
12731 		 * was removed, the sd_xbuf is not needed.
12732 		 */
12733 		bp = obp;
12734 		/*
12735 		 * xp = SD_GET_XBUF(bp);
12736 		 * ASSERT(xp != NULL);
12737 		 */
12738 	}
12739 
12740 	/*
12741 	 * Convert sd->xb_blkno back to a minor-device relative value.
12742 	 * Note: this has been commented out, as it is not needed in the
12743 	 * current implementation of the driver (ie, since this function
12744 	 * is at the top of the layering chains, so the info will be
12745 	 * discarded) and it is in the "hot" IO path.
12746 	 *
12747 	 * partition = getminor(bp->b_edev) & SDPART_MASK;
12748 	 * xp->xb_blkno -= un->un_offset[partition];
12749 	 */
12750 
12751 	SD_NEXT_IODONE(index, un, bp);
12752 
12753 	SD_TRACE(SD_LOG_IO_PARTITION, un,
12754 	    "sd_mapblockaddr_iodone: exit: buf:0x%p\n", bp);
12755 }
12756 
12757 
12758 /*
12759  *    Function: sd_mapblocksize_iostart
12760  *
12761  * Description: Convert between system block size (un->un_sys_blocksize)
12762  *		and target block size (un->un_tgt_blocksize).
12763  *
12764  *     Context: Can sleep to allocate resources.
12765  *
12766  * Assumptions: A higher layer has already performed any partition validation,
12767  *		and converted the xp->xb_blkno to an absolute value relative
12768  *		to the start of the device.
12769  *
12770  *		It is also assumed that the higher layer has implemented
12771  *		an "overrun" mechanism for the case where the request would
12772  *		read/write beyond the end of a partition.  In this case we
12773  *		assume (and ASSERT) that bp->b_resid == 0.
12774  *
12775  *		Note: The implementation for this routine assumes the target
12776  *		block size remains constant between allocation and transport.
12777  */
12778 
12779 static void
12780 sd_mapblocksize_iostart(int index, struct sd_lun *un, struct buf *bp)
12781 {
12782 	struct sd_mapblocksize_info	*bsp;
12783 	struct sd_xbuf			*xp;
12784 	offset_t first_byte;
12785 	daddr_t	start_block, end_block;
12786 	daddr_t	request_bytes;
12787 	ushort_t is_aligned = FALSE;
12788 
12789 	ASSERT(un != NULL);
12790 	ASSERT(bp != NULL);
12791 	ASSERT(!mutex_owned(SD_MUTEX(un)));
12792 	ASSERT(bp->b_resid == 0);
12793 
12794 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
12795 	    "sd_mapblocksize_iostart: entry: buf:0x%p\n", bp);
12796 
12797 	/*
12798 	 * For a non-writable CD, a write request is an error
12799 	 */
12800 	if (ISCD(un) && ((bp->b_flags & B_READ) == 0) &&
12801 	    (un->un_f_mmc_writable_media == FALSE)) {
12802 		bioerror(bp, EIO);
12803 		bp->b_resid = bp->b_bcount;
12804 		SD_BEGIN_IODONE(index, un, bp);
12805 		return;
12806 	}
12807 
12808 	/*
12809 	 * We do not need a shadow buf if the device is using
12810 	 * un->un_sys_blocksize as its block size or if bcount == 0.
12811 	 * In this case there is no layer-private data block allocated.
12812 	 */
12813 	if ((un->un_tgt_blocksize == DEV_BSIZE) ||
12814 	    (bp->b_bcount == 0)) {
12815 		goto done;
12816 	}
12817 
12818 #if defined(__i386) || defined(__amd64)
12819 	/* We do not support non-block-aligned transfers for ROD devices */
12820 	ASSERT(!ISROD(un));
12821 #endif
12822 
12823 	xp = SD_GET_XBUF(bp);
12824 	ASSERT(xp != NULL);
12825 
12826 	SD_INFO(SD_LOG_IO_RMMEDIA, un, "sd_mapblocksize_iostart: "
12827 	    "tgt_blocksize:0x%x sys_blocksize: 0x%x\n",
12828 	    un->un_tgt_blocksize, DEV_BSIZE);
12829 	SD_INFO(SD_LOG_IO_RMMEDIA, un, "sd_mapblocksize_iostart: "
12830 	    "request start block:0x%x\n", xp->xb_blkno);
12831 	SD_INFO(SD_LOG_IO_RMMEDIA, un, "sd_mapblocksize_iostart: "
12832 	    "request len:0x%x\n", bp->b_bcount);
12833 
12834 	/*
12835 	 * Allocate the layer-private data area for the mapblocksize layer.
12836 	 * Layers are allowed to use the xp_private member of the sd_xbuf
12837 	 * struct to store the pointer to their layer-private data block, but
12838 	 * each layer also has the responsibility of restoring the prior
12839 	 * contents of xb_private before returning the buf/xbuf to the
12840 	 * higher layer that sent it.
12841 	 *
12842 	 * Here we save the prior contents of xp->xb_private into the
12843 	 * bsp->mbs_oprivate field of our layer-private data area. This value
12844 	 * is restored by sd_mapblocksize_iodone() just prior to freeing up
12845 	 * the layer-private area and returning the buf/xbuf to the layer
12846 	 * that sent it.
12847 	 *
12848 	 * Note that here we use kmem_zalloc for the allocation as there are
12849 	 * parts of the mapblocksize code that expect certain fields to be
12850 	 * zero unless explicitly set to a required value.
12851 	 */
12852 	bsp = kmem_zalloc(sizeof (struct sd_mapblocksize_info), KM_SLEEP);
12853 	bsp->mbs_oprivate = xp->xb_private;
12854 	xp->xb_private = bsp;
12855 
12856 	/*
12857 	 * This treats the data on the disk (target) as an array of bytes.
12858 	 * first_byte is the byte offset, from the beginning of the device,
12859 	 * to the location of the request. This is converted from a
12860 	 * un->un_sys_blocksize block address to a byte offset, and then back
12861 	 * to a block address based upon a un->un_tgt_blocksize block size.
12862 	 *
12863 	 * xp->xb_blkno should be absolute upon entry into this function,
12864 	 * but, but it is based upon partitions that use the "system"
12865 	 * block size. It must be adjusted to reflect the block size of
12866 	 * the target.
12867 	 *
12868 	 * Note that end_block is actually the block that follows the last
12869 	 * block of the request, but that's what is needed for the computation.
12870 	 */
12871 	first_byte  = SD_SYSBLOCKS2BYTES((offset_t)xp->xb_blkno);
12872 	start_block = xp->xb_blkno = first_byte / un->un_tgt_blocksize;
12873 	end_block   = (first_byte + bp->b_bcount + un->un_tgt_blocksize - 1) /
12874 	    un->un_tgt_blocksize;
12875 
12876 	/* request_bytes is rounded up to a multiple of the target block size */
12877 	request_bytes = (end_block - start_block) * un->un_tgt_blocksize;
12878 
12879 	/*
12880 	 * See if the starting address of the request and the request
12881 	 * length are aligned on a un->un_tgt_blocksize boundary. If aligned
12882 	 * then we do not need to allocate a shadow buf to handle the request.
12883 	 */
12884 	if (((first_byte   % un->un_tgt_blocksize) == 0) &&
12885 	    ((bp->b_bcount % un->un_tgt_blocksize) == 0)) {
12886 		is_aligned = TRUE;
12887 	}
12888 
12889 	if ((bp->b_flags & B_READ) == 0) {
12890 		/*
12891 		 * Lock the range for a write operation. An aligned request is
12892 		 * considered a simple write; otherwise the request must be a
12893 		 * read-modify-write.
12894 		 */
12895 		bsp->mbs_wmp = sd_range_lock(un, start_block, end_block - 1,
12896 		    (is_aligned == TRUE) ? SD_WTYPE_SIMPLE : SD_WTYPE_RMW);
12897 	}
12898 
12899 	/*
12900 	 * Alloc a shadow buf if the request is not aligned. Also, this is
12901 	 * where the READ command is generated for a read-modify-write. (The
12902 	 * write phase is deferred until after the read completes.)
12903 	 */
12904 	if (is_aligned == FALSE) {
12905 
12906 		struct sd_mapblocksize_info	*shadow_bsp;
12907 		struct sd_xbuf	*shadow_xp;
12908 		struct buf	*shadow_bp;
12909 
12910 		/*
12911 		 * Allocate the shadow buf and it associated xbuf. Note that
12912 		 * after this call the xb_blkno value in both the original
12913 		 * buf's sd_xbuf _and_ the shadow buf's sd_xbuf will be the
12914 		 * same: absolute relative to the start of the device, and
12915 		 * adjusted for the target block size. The b_blkno in the
12916 		 * shadow buf will also be set to this value. We should never
12917 		 * change b_blkno in the original bp however.
12918 		 *
12919 		 * Note also that the shadow buf will always need to be a
12920 		 * READ command, regardless of whether the incoming command
12921 		 * is a READ or a WRITE.
12922 		 */
12923 		shadow_bp = sd_shadow_buf_alloc(bp, request_bytes, B_READ,
12924 		    xp->xb_blkno,
12925 		    (int (*)(struct buf *)) sd_mapblocksize_iodone);
12926 
12927 		shadow_xp = SD_GET_XBUF(shadow_bp);
12928 
12929 		/*
12930 		 * Allocate the layer-private data for the shadow buf.
12931 		 * (No need to preserve xb_private in the shadow xbuf.)
12932 		 */
12933 		shadow_xp->xb_private = shadow_bsp =
12934 		    kmem_zalloc(sizeof (struct sd_mapblocksize_info), KM_SLEEP);
12935 
12936 		/*
12937 		 * bsp->mbs_copy_offset is used later by sd_mapblocksize_iodone
12938 		 * to figure out where the start of the user data is (based upon
12939 		 * the system block size) in the data returned by the READ
12940 		 * command (which will be based upon the target blocksize). Note
12941 		 * that this is only really used if the request is unaligned.
12942 		 */
12943 		bsp->mbs_copy_offset = (ssize_t)(first_byte -
12944 		    ((offset_t)xp->xb_blkno * un->un_tgt_blocksize));
12945 		ASSERT((bsp->mbs_copy_offset >= 0) &&
12946 		    (bsp->mbs_copy_offset < un->un_tgt_blocksize));
12947 
12948 		shadow_bsp->mbs_copy_offset = bsp->mbs_copy_offset;
12949 
12950 		shadow_bsp->mbs_layer_index = bsp->mbs_layer_index = index;
12951 
12952 		/* Transfer the wmap (if any) to the shadow buf */
12953 		shadow_bsp->mbs_wmp = bsp->mbs_wmp;
12954 		bsp->mbs_wmp = NULL;
12955 
12956 		/*
12957 		 * The shadow buf goes on from here in place of the
12958 		 * original buf.
12959 		 */
12960 		shadow_bsp->mbs_orig_bp = bp;
12961 		bp = shadow_bp;
12962 	}
12963 
12964 	SD_INFO(SD_LOG_IO_RMMEDIA, un,
12965 	    "sd_mapblocksize_iostart: tgt start block:0x%x\n", xp->xb_blkno);
12966 	SD_INFO(SD_LOG_IO_RMMEDIA, un,
12967 	    "sd_mapblocksize_iostart: tgt request len:0x%x\n",
12968 	    request_bytes);
12969 	SD_INFO(SD_LOG_IO_RMMEDIA, un,
12970 	    "sd_mapblocksize_iostart: shadow buf:0x%x\n", bp);
12971 
12972 done:
12973 	SD_NEXT_IOSTART(index, un, bp);
12974 
12975 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
12976 	    "sd_mapblocksize_iostart: exit: buf:0x%p\n", bp);
12977 }
12978 
12979 
12980 /*
12981  *    Function: sd_mapblocksize_iodone
12982  *
12983  * Description: Completion side processing for block-size mapping.
12984  *
12985  *     Context: May be called under interrupt context
12986  */
12987 
12988 static void
12989 sd_mapblocksize_iodone(int index, struct sd_lun *un, struct buf *bp)
12990 {
12991 	struct sd_mapblocksize_info	*bsp;
12992 	struct sd_xbuf	*xp;
12993 	struct sd_xbuf	*orig_xp;	/* sd_xbuf for the original buf */
12994 	struct buf	*orig_bp;	/* ptr to the original buf */
12995 	offset_t	shadow_end;
12996 	offset_t	request_end;
12997 	offset_t	shadow_start;
12998 	ssize_t		copy_offset;
12999 	size_t		copy_length;
13000 	size_t		shortfall;
13001 	uint_t		is_write;	/* TRUE if this bp is a WRITE */
13002 	uint_t		has_wmap;	/* TRUE is this bp has a wmap */
13003 
13004 	ASSERT(un != NULL);
13005 	ASSERT(bp != NULL);
13006 
13007 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
13008 	    "sd_mapblocksize_iodone: entry: buf:0x%p\n", bp);
13009 
13010 	/*
13011 	 * There is no shadow buf or layer-private data if the target is
13012 	 * using un->un_sys_blocksize as its block size or if bcount == 0.
13013 	 */
13014 	if ((un->un_tgt_blocksize == DEV_BSIZE) ||
13015 	    (bp->b_bcount == 0)) {
13016 		goto exit;
13017 	}
13018 
13019 	xp = SD_GET_XBUF(bp);
13020 	ASSERT(xp != NULL);
13021 
13022 	/* Retrieve the pointer to the layer-private data area from the xbuf. */
13023 	bsp = xp->xb_private;
13024 
13025 	is_write = ((bp->b_flags & B_READ) == 0) ? TRUE : FALSE;
13026 	has_wmap = (bsp->mbs_wmp != NULL) ? TRUE : FALSE;
13027 
13028 	if (is_write) {
13029 		/*
13030 		 * For a WRITE request we must free up the block range that
13031 		 * we have locked up.  This holds regardless of whether this is
13032 		 * an aligned write request or a read-modify-write request.
13033 		 */
13034 		sd_range_unlock(un, bsp->mbs_wmp);
13035 		bsp->mbs_wmp = NULL;
13036 	}
13037 
13038 	if ((bp->b_iodone != (int(*)(struct buf *))sd_mapblocksize_iodone)) {
13039 		/*
13040 		 * An aligned read or write command will have no shadow buf;
13041 		 * there is not much else to do with it.
13042 		 */
13043 		goto done;
13044 	}
13045 
13046 	orig_bp = bsp->mbs_orig_bp;
13047 	ASSERT(orig_bp != NULL);
13048 	orig_xp = SD_GET_XBUF(orig_bp);
13049 	ASSERT(orig_xp != NULL);
13050 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13051 
13052 	if (!is_write && has_wmap) {
13053 		/*
13054 		 * A READ with a wmap means this is the READ phase of a
13055 		 * read-modify-write. If an error occurred on the READ then
13056 		 * we do not proceed with the WRITE phase or copy any data.
13057 		 * Just release the write maps and return with an error.
13058 		 */
13059 		if ((bp->b_resid != 0) || (bp->b_error != 0)) {
13060 			orig_bp->b_resid = orig_bp->b_bcount;
13061 			bioerror(orig_bp, bp->b_error);
13062 			sd_range_unlock(un, bsp->mbs_wmp);
13063 			goto freebuf_done;
13064 		}
13065 	}
13066 
13067 	/*
13068 	 * Here is where we set up to copy the data from the shadow buf
13069 	 * into the space associated with the original buf.
13070 	 *
13071 	 * To deal with the conversion between block sizes, these
13072 	 * computations treat the data as an array of bytes, with the
13073 	 * first byte (byte 0) corresponding to the first byte in the
13074 	 * first block on the disk.
13075 	 */
13076 
13077 	/*
13078 	 * shadow_start and shadow_len indicate the location and size of
13079 	 * the data returned with the shadow IO request.
13080 	 */
13081 	shadow_start  = SD_TGTBLOCKS2BYTES(un, (offset_t)xp->xb_blkno);
13082 	shadow_end    = shadow_start + bp->b_bcount - bp->b_resid;
13083 
13084 	/*
13085 	 * copy_offset gives the offset (in bytes) from the start of the first
13086 	 * block of the READ request to the beginning of the data.  We retrieve
13087 	 * this value from xb_pktp in the ORIGINAL xbuf, as it has been saved
13088 	 * there by sd_mapblockize_iostart(). copy_length gives the amount of
13089 	 * data to be copied (in bytes).
13090 	 */
13091 	copy_offset  = bsp->mbs_copy_offset;
13092 	ASSERT((copy_offset >= 0) && (copy_offset < un->un_tgt_blocksize));
13093 	copy_length  = orig_bp->b_bcount;
13094 	request_end  = shadow_start + copy_offset + orig_bp->b_bcount;
13095 
13096 	/*
13097 	 * Set up the resid and error fields of orig_bp as appropriate.
13098 	 */
13099 	if (shadow_end >= request_end) {
13100 		/* We got all the requested data; set resid to zero */
13101 		orig_bp->b_resid = 0;
13102 	} else {
13103 		/*
13104 		 * We failed to get enough data to fully satisfy the original
13105 		 * request. Just copy back whatever data we got and set
13106 		 * up the residual and error code as required.
13107 		 *
13108 		 * 'shortfall' is the amount by which the data received with the
13109 		 * shadow buf has "fallen short" of the requested amount.
13110 		 */
13111 		shortfall = (size_t)(request_end - shadow_end);
13112 
13113 		if (shortfall > orig_bp->b_bcount) {
13114 			/*
13115 			 * We did not get enough data to even partially
13116 			 * fulfill the original request.  The residual is
13117 			 * equal to the amount requested.
13118 			 */
13119 			orig_bp->b_resid = orig_bp->b_bcount;
13120 		} else {
13121 			/*
13122 			 * We did not get all the data that we requested
13123 			 * from the device, but we will try to return what
13124 			 * portion we did get.
13125 			 */
13126 			orig_bp->b_resid = shortfall;
13127 		}
13128 		ASSERT(copy_length >= orig_bp->b_resid);
13129 		copy_length  -= orig_bp->b_resid;
13130 	}
13131 
13132 	/* Propagate the error code from the shadow buf to the original buf */
13133 	bioerror(orig_bp, bp->b_error);
13134 
13135 	if (is_write) {
13136 		goto freebuf_done;	/* No data copying for a WRITE */
13137 	}
13138 
13139 	if (has_wmap) {
13140 		/*
13141 		 * This is a READ command from the READ phase of a
13142 		 * read-modify-write request. We have to copy the data given
13143 		 * by the user OVER the data returned by the READ command,
13144 		 * then convert the command from a READ to a WRITE and send
13145 		 * it back to the target.
13146 		 */
13147 		bcopy(orig_bp->b_un.b_addr, bp->b_un.b_addr + copy_offset,
13148 		    copy_length);
13149 
13150 		bp->b_flags &= ~((int)B_READ);	/* Convert to a WRITE */
13151 
13152 		/*
13153 		 * Dispatch the WRITE command to the taskq thread, which
13154 		 * will in turn send the command to the target. When the
13155 		 * WRITE command completes, we (sd_mapblocksize_iodone())
13156 		 * will get called again as part of the iodone chain
13157 		 * processing for it. Note that we will still be dealing
13158 		 * with the shadow buf at that point.
13159 		 */
13160 		if (taskq_dispatch(sd_wmr_tq, sd_read_modify_write_task, bp,
13161 		    KM_NOSLEEP) != 0) {
13162 			/*
13163 			 * Dispatch was successful so we are done. Return
13164 			 * without going any higher up the iodone chain. Do
13165 			 * not free up any layer-private data until after the
13166 			 * WRITE completes.
13167 			 */
13168 			return;
13169 		}
13170 
13171 		/*
13172 		 * Dispatch of the WRITE command failed; set up the error
13173 		 * condition and send this IO back up the iodone chain.
13174 		 */
13175 		bioerror(orig_bp, EIO);
13176 		orig_bp->b_resid = orig_bp->b_bcount;
13177 
13178 	} else {
13179 		/*
13180 		 * This is a regular READ request (ie, not a RMW). Copy the
13181 		 * data from the shadow buf into the original buf. The
13182 		 * copy_offset compensates for any "misalignment" between the
13183 		 * shadow buf (with its un->un_tgt_blocksize blocks) and the
13184 		 * original buf (with its un->un_sys_blocksize blocks).
13185 		 */
13186 		bcopy(bp->b_un.b_addr + copy_offset, orig_bp->b_un.b_addr,
13187 		    copy_length);
13188 	}
13189 
13190 freebuf_done:
13191 
13192 	/*
13193 	 * At this point we still have both the shadow buf AND the original
13194 	 * buf to deal with, as well as the layer-private data area in each.
13195 	 * Local variables are as follows:
13196 	 *
13197 	 * bp -- points to shadow buf
13198 	 * xp -- points to xbuf of shadow buf
13199 	 * bsp -- points to layer-private data area of shadow buf
13200 	 * orig_bp -- points to original buf
13201 	 *
13202 	 * First free the shadow buf and its associated xbuf, then free the
13203 	 * layer-private data area from the shadow buf. There is no need to
13204 	 * restore xb_private in the shadow xbuf.
13205 	 */
13206 	sd_shadow_buf_free(bp);
13207 	kmem_free(bsp, sizeof (struct sd_mapblocksize_info));
13208 
13209 	/*
13210 	 * Now update the local variables to point to the original buf, xbuf,
13211 	 * and layer-private area.
13212 	 */
13213 	bp = orig_bp;
13214 	xp = SD_GET_XBUF(bp);
13215 	ASSERT(xp != NULL);
13216 	ASSERT(xp == orig_xp);
13217 	bsp = xp->xb_private;
13218 	ASSERT(bsp != NULL);
13219 
13220 done:
13221 	/*
13222 	 * Restore xb_private to whatever it was set to by the next higher
13223 	 * layer in the chain, then free the layer-private data area.
13224 	 */
13225 	xp->xb_private = bsp->mbs_oprivate;
13226 	kmem_free(bsp, sizeof (struct sd_mapblocksize_info));
13227 
13228 exit:
13229 	SD_TRACE(SD_LOG_IO_RMMEDIA, SD_GET_UN(bp),
13230 	    "sd_mapblocksize_iodone: calling SD_NEXT_IODONE: buf:0x%p\n", bp);
13231 
13232 	SD_NEXT_IODONE(index, un, bp);
13233 }
13234 
13235 
13236 /*
13237  *    Function: sd_checksum_iostart
13238  *
13239  * Description: A stub function for a layer that's currently not used.
13240  *		For now just a placeholder.
13241  *
13242  *     Context: Kernel thread context
13243  */
13244 
13245 static void
13246 sd_checksum_iostart(int index, struct sd_lun *un, struct buf *bp)
13247 {
13248 	ASSERT(un != NULL);
13249 	ASSERT(bp != NULL);
13250 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13251 	SD_NEXT_IOSTART(index, un, bp);
13252 }
13253 
13254 
13255 /*
13256  *    Function: sd_checksum_iodone
13257  *
13258  * Description: A stub function for a layer that's currently not used.
13259  *		For now just a placeholder.
13260  *
13261  *     Context: May be called under interrupt context
13262  */
13263 
13264 static void
13265 sd_checksum_iodone(int index, struct sd_lun *un, struct buf *bp)
13266 {
13267 	ASSERT(un != NULL);
13268 	ASSERT(bp != NULL);
13269 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13270 	SD_NEXT_IODONE(index, un, bp);
13271 }
13272 
13273 
13274 /*
13275  *    Function: sd_checksum_uscsi_iostart
13276  *
13277  * Description: A stub function for a layer that's currently not used.
13278  *		For now just a placeholder.
13279  *
13280  *     Context: Kernel thread context
13281  */
13282 
13283 static void
13284 sd_checksum_uscsi_iostart(int index, struct sd_lun *un, struct buf *bp)
13285 {
13286 	ASSERT(un != NULL);
13287 	ASSERT(bp != NULL);
13288 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13289 	SD_NEXT_IOSTART(index, un, bp);
13290 }
13291 
13292 
13293 /*
13294  *    Function: sd_checksum_uscsi_iodone
13295  *
13296  * Description: A stub function for a layer that's currently not used.
13297  *		For now just a placeholder.
13298  *
13299  *     Context: May be called under interrupt context
13300  */
13301 
13302 static void
13303 sd_checksum_uscsi_iodone(int index, struct sd_lun *un, struct buf *bp)
13304 {
13305 	ASSERT(un != NULL);
13306 	ASSERT(bp != NULL);
13307 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13308 	SD_NEXT_IODONE(index, un, bp);
13309 }
13310 
13311 
13312 /*
13313  *    Function: sd_pm_iostart
13314  *
13315  * Description: iostart-side routine for Power mangement.
13316  *
13317  *     Context: Kernel thread context
13318  */
13319 
13320 static void
13321 sd_pm_iostart(int index, struct sd_lun *un, struct buf *bp)
13322 {
13323 	ASSERT(un != NULL);
13324 	ASSERT(bp != NULL);
13325 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13326 	ASSERT(!mutex_owned(&un->un_pm_mutex));
13327 
13328 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iostart: entry\n");
13329 
13330 	if (sd_pm_entry(un) != DDI_SUCCESS) {
13331 		/*
13332 		 * Set up to return the failed buf back up the 'iodone'
13333 		 * side of the calling chain.
13334 		 */
13335 		bioerror(bp, EIO);
13336 		bp->b_resid = bp->b_bcount;
13337 
13338 		SD_BEGIN_IODONE(index, un, bp);
13339 
13340 		SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iostart: exit\n");
13341 		return;
13342 	}
13343 
13344 	SD_NEXT_IOSTART(index, un, bp);
13345 
13346 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iostart: exit\n");
13347 }
13348 
13349 
13350 /*
13351  *    Function: sd_pm_iodone
13352  *
13353  * Description: iodone-side routine for power mangement.
13354  *
13355  *     Context: may be called from interrupt context
13356  */
13357 
13358 static void
13359 sd_pm_iodone(int index, struct sd_lun *un, struct buf *bp)
13360 {
13361 	ASSERT(un != NULL);
13362 	ASSERT(bp != NULL);
13363 	ASSERT(!mutex_owned(&un->un_pm_mutex));
13364 
13365 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iodone: entry\n");
13366 
13367 	/*
13368 	 * After attach the following flag is only read, so don't
13369 	 * take the penalty of acquiring a mutex for it.
13370 	 */
13371 	if (un->un_f_pm_is_enabled == TRUE) {
13372 		sd_pm_exit(un);
13373 	}
13374 
13375 	SD_NEXT_IODONE(index, un, bp);
13376 
13377 	SD_TRACE(SD_LOG_IO_PM, un, "sd_pm_iodone: exit\n");
13378 }
13379 
13380 
13381 /*
13382  *    Function: sd_core_iostart
13383  *
13384  * Description: Primary driver function for enqueuing buf(9S) structs from
13385  *		the system and initiating IO to the target device
13386  *
13387  *     Context: Kernel thread context. Can sleep.
13388  *
13389  * Assumptions:  - The given xp->xb_blkno is absolute
13390  *		   (ie, relative to the start of the device).
13391  *		 - The IO is to be done using the native blocksize of
13392  *		   the device, as specified in un->un_tgt_blocksize.
13393  */
13394 /* ARGSUSED */
13395 static void
13396 sd_core_iostart(int index, struct sd_lun *un, struct buf *bp)
13397 {
13398 	struct sd_xbuf *xp;
13399 
13400 	ASSERT(un != NULL);
13401 	ASSERT(bp != NULL);
13402 	ASSERT(!mutex_owned(SD_MUTEX(un)));
13403 	ASSERT(bp->b_resid == 0);
13404 
13405 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_core_iostart: entry: bp:0x%p\n", bp);
13406 
13407 	xp = SD_GET_XBUF(bp);
13408 	ASSERT(xp != NULL);
13409 
13410 	mutex_enter(SD_MUTEX(un));
13411 
13412 	/*
13413 	 * If we are currently in the failfast state, fail any new IO
13414 	 * that has B_FAILFAST set, then return.
13415 	 */
13416 	if ((bp->b_flags & B_FAILFAST) &&
13417 	    (un->un_failfast_state == SD_FAILFAST_ACTIVE)) {
13418 		mutex_exit(SD_MUTEX(un));
13419 		bioerror(bp, EIO);
13420 		bp->b_resid = bp->b_bcount;
13421 		SD_BEGIN_IODONE(index, un, bp);
13422 		return;
13423 	}
13424 
13425 	if (SD_IS_DIRECT_PRIORITY(xp)) {
13426 		/*
13427 		 * Priority command -- transport it immediately.
13428 		 *
13429 		 * Note: We may want to assert that USCSI_DIAGNOSE is set,
13430 		 * because all direct priority commands should be associated
13431 		 * with error recovery actions which we don't want to retry.
13432 		 */
13433 		sd_start_cmds(un, bp);
13434 	} else {
13435 		/*
13436 		 * Normal command -- add it to the wait queue, then start
13437 		 * transporting commands from the wait queue.
13438 		 */
13439 		sd_add_buf_to_waitq(un, bp);
13440 		SD_UPDATE_KSTATS(un, kstat_waitq_enter, bp);
13441 		sd_start_cmds(un, NULL);
13442 	}
13443 
13444 	mutex_exit(SD_MUTEX(un));
13445 
13446 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_core_iostart: exit: bp:0x%p\n", bp);
13447 }
13448 
13449 
13450 /*
13451  *    Function: sd_init_cdb_limits
13452  *
13453  * Description: This is to handle scsi_pkt initialization differences
13454  *		between the driver platforms.
13455  *
13456  *		Legacy behaviors:
13457  *
13458  *		If the block number or the sector count exceeds the
13459  *		capabilities of a Group 0 command, shift over to a
13460  *		Group 1 command. We don't blindly use Group 1
13461  *		commands because a) some drives (CDC Wren IVs) get a
13462  *		bit confused, and b) there is probably a fair amount
13463  *		of speed difference for a target to receive and decode
13464  *		a 10 byte command instead of a 6 byte command.
13465  *
13466  *		The xfer time difference of 6 vs 10 byte CDBs is
13467  *		still significant so this code is still worthwhile.
13468  *		10 byte CDBs are very inefficient with the fas HBA driver
13469  *		and older disks. Each CDB byte took 1 usec with some
13470  *		popular disks.
13471  *
13472  *     Context: Must be called at attach time
13473  */
13474 
13475 static void
13476 sd_init_cdb_limits(struct sd_lun *un)
13477 {
13478 	int hba_cdb_limit;
13479 
13480 	/*
13481 	 * Use CDB_GROUP1 commands for most devices except for
13482 	 * parallel SCSI fixed drives in which case we get better
13483 	 * performance using CDB_GROUP0 commands (where applicable).
13484 	 */
13485 	un->un_mincdb = SD_CDB_GROUP1;
13486 #if !defined(__fibre)
13487 	if (!un->un_f_is_fibre && !un->un_f_cfg_is_atapi && !ISROD(un) &&
13488 	    !un->un_f_has_removable_media) {
13489 		un->un_mincdb = SD_CDB_GROUP0;
13490 	}
13491 #endif
13492 
13493 	/*
13494 	 * Try to read the max-cdb-length supported by HBA.
13495 	 */
13496 	un->un_max_hba_cdb = scsi_ifgetcap(SD_ADDRESS(un), "max-cdb-length", 1);
13497 	if (0 >= un->un_max_hba_cdb) {
13498 		un->un_max_hba_cdb = CDB_GROUP4;
13499 		hba_cdb_limit = SD_CDB_GROUP4;
13500 	} else if (0 < un->un_max_hba_cdb &&
13501 	    un->un_max_hba_cdb < CDB_GROUP1) {
13502 		hba_cdb_limit = SD_CDB_GROUP0;
13503 	} else if (CDB_GROUP1 <= un->un_max_hba_cdb &&
13504 	    un->un_max_hba_cdb < CDB_GROUP5) {
13505 		hba_cdb_limit = SD_CDB_GROUP1;
13506 	} else if (CDB_GROUP5 <= un->un_max_hba_cdb &&
13507 	    un->un_max_hba_cdb < CDB_GROUP4) {
13508 		hba_cdb_limit = SD_CDB_GROUP5;
13509 	} else {
13510 		hba_cdb_limit = SD_CDB_GROUP4;
13511 	}
13512 
13513 	/*
13514 	 * Use CDB_GROUP5 commands for removable devices.  Use CDB_GROUP4
13515 	 * commands for fixed disks unless we are building for a 32 bit
13516 	 * kernel.
13517 	 */
13518 #ifdef _LP64
13519 	un->un_maxcdb = (un->un_f_has_removable_media) ? SD_CDB_GROUP5 :
13520 	    min(hba_cdb_limit, SD_CDB_GROUP4);
13521 #else
13522 	un->un_maxcdb = (un->un_f_has_removable_media) ? SD_CDB_GROUP5 :
13523 	    min(hba_cdb_limit, SD_CDB_GROUP1);
13524 #endif
13525 
13526 	un->un_status_len = (int)((un->un_f_arq_enabled == TRUE)
13527 	    ? sizeof (struct scsi_arq_status) : 1);
13528 	un->un_cmd_timeout = (ushort_t)sd_io_time;
13529 	un->un_uscsi_timeout = ((ISCD(un)) ? 2 : 1) * un->un_cmd_timeout;
13530 }
13531 
13532 
13533 /*
13534  *    Function: sd_initpkt_for_buf
13535  *
13536  * Description: Allocate and initialize for transport a scsi_pkt struct,
13537  *		based upon the info specified in the given buf struct.
13538  *
13539  *		Assumes the xb_blkno in the request is absolute (ie,
13540  *		relative to the start of the device (NOT partition!).
13541  *		Also assumes that the request is using the native block
13542  *		size of the device (as returned by the READ CAPACITY
13543  *		command).
13544  *
13545  * Return Code: SD_PKT_ALLOC_SUCCESS
13546  *		SD_PKT_ALLOC_FAILURE
13547  *		SD_PKT_ALLOC_FAILURE_NO_DMA
13548  *		SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL
13549  *
13550  *     Context: Kernel thread and may be called from software interrupt context
13551  *		as part of a sdrunout callback. This function may not block or
13552  *		call routines that block
13553  */
13554 
13555 static int
13556 sd_initpkt_for_buf(struct buf *bp, struct scsi_pkt **pktpp)
13557 {
13558 	struct sd_xbuf	*xp;
13559 	struct scsi_pkt *pktp = NULL;
13560 	struct sd_lun	*un;
13561 	size_t		blockcount;
13562 	daddr_t		startblock;
13563 	int		rval;
13564 	int		cmd_flags;
13565 
13566 	ASSERT(bp != NULL);
13567 	ASSERT(pktpp != NULL);
13568 	xp = SD_GET_XBUF(bp);
13569 	ASSERT(xp != NULL);
13570 	un = SD_GET_UN(bp);
13571 	ASSERT(un != NULL);
13572 	ASSERT(mutex_owned(SD_MUTEX(un)));
13573 	ASSERT(bp->b_resid == 0);
13574 
13575 	SD_TRACE(SD_LOG_IO_CORE, un,
13576 	    "sd_initpkt_for_buf: entry: buf:0x%p\n", bp);
13577 
13578 	mutex_exit(SD_MUTEX(un));
13579 
13580 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
13581 	if (xp->xb_pkt_flags & SD_XB_DMA_FREED) {
13582 		/*
13583 		 * Already have a scsi_pkt -- just need DMA resources.
13584 		 * We must recompute the CDB in case the mapping returns
13585 		 * a nonzero pkt_resid.
13586 		 * Note: if this is a portion of a PKT_DMA_PARTIAL transfer
13587 		 * that is being retried, the unmap/remap of the DMA resouces
13588 		 * will result in the entire transfer starting over again
13589 		 * from the very first block.
13590 		 */
13591 		ASSERT(xp->xb_pktp != NULL);
13592 		pktp = xp->xb_pktp;
13593 	} else {
13594 		pktp = NULL;
13595 	}
13596 #endif /* __i386 || __amd64 */
13597 
13598 	startblock = xp->xb_blkno;	/* Absolute block num. */
13599 	blockcount = SD_BYTES2TGTBLOCKS(un, bp->b_bcount);
13600 
13601 	cmd_flags = un->un_pkt_flags | (xp->xb_pkt_flags & SD_XB_INITPKT_MASK);
13602 
13603 	/*
13604 	 * sd_setup_rw_pkt will determine the appropriate CDB group to use,
13605 	 * call scsi_init_pkt, and build the CDB.
13606 	 */
13607 	rval = sd_setup_rw_pkt(un, &pktp, bp,
13608 	    cmd_flags, sdrunout, (caddr_t)un,
13609 	    startblock, blockcount);
13610 
13611 	if (rval == 0) {
13612 		/*
13613 		 * Success.
13614 		 *
13615 		 * If partial DMA is being used and required for this transfer.
13616 		 * set it up here.
13617 		 */
13618 		if ((un->un_pkt_flags & PKT_DMA_PARTIAL) != 0 &&
13619 		    (pktp->pkt_resid != 0)) {
13620 
13621 			/*
13622 			 * Save the CDB length and pkt_resid for the
13623 			 * next xfer
13624 			 */
13625 			xp->xb_dma_resid = pktp->pkt_resid;
13626 
13627 			/* rezero resid */
13628 			pktp->pkt_resid = 0;
13629 
13630 		} else {
13631 			xp->xb_dma_resid = 0;
13632 		}
13633 
13634 		pktp->pkt_flags = un->un_tagflags;
13635 		pktp->pkt_time  = un->un_cmd_timeout;
13636 		pktp->pkt_comp  = sdintr;
13637 
13638 		pktp->pkt_private = bp;
13639 		*pktpp = pktp;
13640 
13641 		SD_TRACE(SD_LOG_IO_CORE, un,
13642 		    "sd_initpkt_for_buf: exit: buf:0x%p\n", bp);
13643 
13644 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
13645 		xp->xb_pkt_flags &= ~SD_XB_DMA_FREED;
13646 #endif
13647 
13648 		mutex_enter(SD_MUTEX(un));
13649 		return (SD_PKT_ALLOC_SUCCESS);
13650 
13651 	}
13652 
13653 	/*
13654 	 * SD_PKT_ALLOC_FAILURE is the only expected failure code
13655 	 * from sd_setup_rw_pkt.
13656 	 */
13657 	ASSERT(rval == SD_PKT_ALLOC_FAILURE);
13658 
13659 	if (rval == SD_PKT_ALLOC_FAILURE) {
13660 		*pktpp = NULL;
13661 		/*
13662 		 * Set the driver state to RWAIT to indicate the driver
13663 		 * is waiting on resource allocations. The driver will not
13664 		 * suspend, pm_suspend, or detatch while the state is RWAIT.
13665 		 */
13666 		mutex_enter(SD_MUTEX(un));
13667 		New_state(un, SD_STATE_RWAIT);
13668 
13669 		SD_ERROR(SD_LOG_IO_CORE, un,
13670 		    "sd_initpkt_for_buf: No pktp. exit bp:0x%p\n", bp);
13671 
13672 		if ((bp->b_flags & B_ERROR) != 0) {
13673 			return (SD_PKT_ALLOC_FAILURE_NO_DMA);
13674 		}
13675 		return (SD_PKT_ALLOC_FAILURE);
13676 	} else {
13677 		/*
13678 		 * PKT_ALLOC_FAILURE_CDB_TOO_SMALL
13679 		 *
13680 		 * This should never happen.  Maybe someone messed with the
13681 		 * kernel's minphys?
13682 		 */
13683 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
13684 		    "Request rejected: too large for CDB: "
13685 		    "lba:0x%08lx  len:0x%08lx\n", startblock, blockcount);
13686 		SD_ERROR(SD_LOG_IO_CORE, un,
13687 		    "sd_initpkt_for_buf: No cp. exit bp:0x%p\n", bp);
13688 		mutex_enter(SD_MUTEX(un));
13689 		return (SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL);
13690 
13691 	}
13692 }
13693 
13694 
13695 /*
13696  *    Function: sd_destroypkt_for_buf
13697  *
13698  * Description: Free the scsi_pkt(9S) for the given bp (buf IO processing).
13699  *
13700  *     Context: Kernel thread or interrupt context
13701  */
13702 
13703 static void
13704 sd_destroypkt_for_buf(struct buf *bp)
13705 {
13706 	ASSERT(bp != NULL);
13707 	ASSERT(SD_GET_UN(bp) != NULL);
13708 
13709 	SD_TRACE(SD_LOG_IO_CORE, SD_GET_UN(bp),
13710 	    "sd_destroypkt_for_buf: entry: buf:0x%p\n", bp);
13711 
13712 	ASSERT(SD_GET_PKTP(bp) != NULL);
13713 	scsi_destroy_pkt(SD_GET_PKTP(bp));
13714 
13715 	SD_TRACE(SD_LOG_IO_CORE, SD_GET_UN(bp),
13716 	    "sd_destroypkt_for_buf: exit: buf:0x%p\n", bp);
13717 }
13718 
13719 /*
13720  *    Function: sd_setup_rw_pkt
13721  *
13722  * Description: Determines appropriate CDB group for the requested LBA
13723  *		and transfer length, calls scsi_init_pkt, and builds
13724  *		the CDB.  Do not use for partial DMA transfers except
13725  *		for the initial transfer since the CDB size must
13726  *		remain constant.
13727  *
13728  *     Context: Kernel thread and may be called from software interrupt
13729  *		context as part of a sdrunout callback. This function may not
13730  *		block or call routines that block
13731  */
13732 
13733 
13734 int
13735 sd_setup_rw_pkt(struct sd_lun *un,
13736     struct scsi_pkt **pktpp, struct buf *bp, int flags,
13737     int (*callback)(caddr_t), caddr_t callback_arg,
13738     diskaddr_t lba, uint32_t blockcount)
13739 {
13740 	struct scsi_pkt *return_pktp;
13741 	union scsi_cdb *cdbp;
13742 	struct sd_cdbinfo *cp = NULL;
13743 	int i;
13744 
13745 	/*
13746 	 * See which size CDB to use, based upon the request.
13747 	 */
13748 	for (i = un->un_mincdb; i <= un->un_maxcdb; i++) {
13749 
13750 		/*
13751 		 * Check lba and block count against sd_cdbtab limits.
13752 		 * In the partial DMA case, we have to use the same size
13753 		 * CDB for all the transfers.  Check lba + blockcount
13754 		 * against the max LBA so we know that segment of the
13755 		 * transfer can use the CDB we select.
13756 		 */
13757 		if ((lba + blockcount - 1 <= sd_cdbtab[i].sc_maxlba) &&
13758 		    (blockcount <= sd_cdbtab[i].sc_maxlen)) {
13759 
13760 			/*
13761 			 * The command will fit into the CDB type
13762 			 * specified by sd_cdbtab[i].
13763 			 */
13764 			cp = sd_cdbtab + i;
13765 
13766 			/*
13767 			 * Call scsi_init_pkt so we can fill in the
13768 			 * CDB.
13769 			 */
13770 			return_pktp = scsi_init_pkt(SD_ADDRESS(un), *pktpp,
13771 			    bp, cp->sc_grpcode, un->un_status_len, 0,
13772 			    flags, callback, callback_arg);
13773 
13774 			if (return_pktp != NULL) {
13775 
13776 				/*
13777 				 * Return new value of pkt
13778 				 */
13779 				*pktpp = return_pktp;
13780 
13781 				/*
13782 				 * To be safe, zero the CDB insuring there is
13783 				 * no leftover data from a previous command.
13784 				 */
13785 				bzero(return_pktp->pkt_cdbp, cp->sc_grpcode);
13786 
13787 				/*
13788 				 * Handle partial DMA mapping
13789 				 */
13790 				if (return_pktp->pkt_resid != 0) {
13791 
13792 					/*
13793 					 * Not going to xfer as many blocks as
13794 					 * originally expected
13795 					 */
13796 					blockcount -=
13797 					    SD_BYTES2TGTBLOCKS(un,
13798 					    return_pktp->pkt_resid);
13799 				}
13800 
13801 				cdbp = (union scsi_cdb *)return_pktp->pkt_cdbp;
13802 
13803 				/*
13804 				 * Set command byte based on the CDB
13805 				 * type we matched.
13806 				 */
13807 				cdbp->scc_cmd = cp->sc_grpmask |
13808 				    ((bp->b_flags & B_READ) ?
13809 				    SCMD_READ : SCMD_WRITE);
13810 
13811 				SD_FILL_SCSI1_LUN(un, return_pktp);
13812 
13813 				/*
13814 				 * Fill in LBA and length
13815 				 */
13816 				ASSERT((cp->sc_grpcode == CDB_GROUP1) ||
13817 				    (cp->sc_grpcode == CDB_GROUP4) ||
13818 				    (cp->sc_grpcode == CDB_GROUP0) ||
13819 				    (cp->sc_grpcode == CDB_GROUP5));
13820 
13821 				if (cp->sc_grpcode == CDB_GROUP1) {
13822 					FORMG1ADDR(cdbp, lba);
13823 					FORMG1COUNT(cdbp, blockcount);
13824 					return (0);
13825 				} else if (cp->sc_grpcode == CDB_GROUP4) {
13826 					FORMG4LONGADDR(cdbp, lba);
13827 					FORMG4COUNT(cdbp, blockcount);
13828 					return (0);
13829 				} else if (cp->sc_grpcode == CDB_GROUP0) {
13830 					FORMG0ADDR(cdbp, lba);
13831 					FORMG0COUNT(cdbp, blockcount);
13832 					return (0);
13833 				} else if (cp->sc_grpcode == CDB_GROUP5) {
13834 					FORMG5ADDR(cdbp, lba);
13835 					FORMG5COUNT(cdbp, blockcount);
13836 					return (0);
13837 				}
13838 
13839 				/*
13840 				 * It should be impossible to not match one
13841 				 * of the CDB types above, so we should never
13842 				 * reach this point.  Set the CDB command byte
13843 				 * to test-unit-ready to avoid writing
13844 				 * to somewhere we don't intend.
13845 				 */
13846 				cdbp->scc_cmd = SCMD_TEST_UNIT_READY;
13847 				return (SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL);
13848 			} else {
13849 				/*
13850 				 * Couldn't get scsi_pkt
13851 				 */
13852 				return (SD_PKT_ALLOC_FAILURE);
13853 			}
13854 		}
13855 	}
13856 
13857 	/*
13858 	 * None of the available CDB types were suitable.  This really
13859 	 * should never happen:  on a 64 bit system we support
13860 	 * READ16/WRITE16 which will hold an entire 64 bit disk address
13861 	 * and on a 32 bit system we will refuse to bind to a device
13862 	 * larger than 2TB so addresses will never be larger than 32 bits.
13863 	 */
13864 	return (SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL);
13865 }
13866 
13867 /*
13868  *    Function: sd_setup_next_rw_pkt
13869  *
13870  * Description: Setup packet for partial DMA transfers, except for the
13871  * 		initial transfer.  sd_setup_rw_pkt should be used for
13872  *		the initial transfer.
13873  *
13874  *     Context: Kernel thread and may be called from interrupt context.
13875  */
13876 
13877 int
13878 sd_setup_next_rw_pkt(struct sd_lun *un,
13879     struct scsi_pkt *pktp, struct buf *bp,
13880     diskaddr_t lba, uint32_t blockcount)
13881 {
13882 	uchar_t com;
13883 	union scsi_cdb *cdbp;
13884 	uchar_t cdb_group_id;
13885 
13886 	ASSERT(pktp != NULL);
13887 	ASSERT(pktp->pkt_cdbp != NULL);
13888 
13889 	cdbp = (union scsi_cdb *)pktp->pkt_cdbp;
13890 	com = cdbp->scc_cmd;
13891 	cdb_group_id = CDB_GROUPID(com);
13892 
13893 	ASSERT((cdb_group_id == CDB_GROUPID_0) ||
13894 	    (cdb_group_id == CDB_GROUPID_1) ||
13895 	    (cdb_group_id == CDB_GROUPID_4) ||
13896 	    (cdb_group_id == CDB_GROUPID_5));
13897 
13898 	/*
13899 	 * Move pkt to the next portion of the xfer.
13900 	 * func is NULL_FUNC so we do not have to release
13901 	 * the disk mutex here.
13902 	 */
13903 	if (scsi_init_pkt(SD_ADDRESS(un), pktp, bp, 0, 0, 0, 0,
13904 	    NULL_FUNC, NULL) == pktp) {
13905 		/* Success.  Handle partial DMA */
13906 		if (pktp->pkt_resid != 0) {
13907 			blockcount -=
13908 			    SD_BYTES2TGTBLOCKS(un, pktp->pkt_resid);
13909 		}
13910 
13911 		cdbp->scc_cmd = com;
13912 		SD_FILL_SCSI1_LUN(un, pktp);
13913 		if (cdb_group_id == CDB_GROUPID_1) {
13914 			FORMG1ADDR(cdbp, lba);
13915 			FORMG1COUNT(cdbp, blockcount);
13916 			return (0);
13917 		} else if (cdb_group_id == CDB_GROUPID_4) {
13918 			FORMG4LONGADDR(cdbp, lba);
13919 			FORMG4COUNT(cdbp, blockcount);
13920 			return (0);
13921 		} else if (cdb_group_id == CDB_GROUPID_0) {
13922 			FORMG0ADDR(cdbp, lba);
13923 			FORMG0COUNT(cdbp, blockcount);
13924 			return (0);
13925 		} else if (cdb_group_id == CDB_GROUPID_5) {
13926 			FORMG5ADDR(cdbp, lba);
13927 			FORMG5COUNT(cdbp, blockcount);
13928 			return (0);
13929 		}
13930 
13931 		/* Unreachable */
13932 		return (SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL);
13933 	}
13934 
13935 	/*
13936 	 * Error setting up next portion of cmd transfer.
13937 	 * Something is definitely very wrong and this
13938 	 * should not happen.
13939 	 */
13940 	return (SD_PKT_ALLOC_FAILURE);
13941 }
13942 
13943 /*
13944  *    Function: sd_initpkt_for_uscsi
13945  *
13946  * Description: Allocate and initialize for transport a scsi_pkt struct,
13947  *		based upon the info specified in the given uscsi_cmd struct.
13948  *
13949  * Return Code: SD_PKT_ALLOC_SUCCESS
13950  *		SD_PKT_ALLOC_FAILURE
13951  *		SD_PKT_ALLOC_FAILURE_NO_DMA
13952  *		SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL
13953  *
13954  *     Context: Kernel thread and may be called from software interrupt context
13955  *		as part of a sdrunout callback. This function may not block or
13956  *		call routines that block
13957  */
13958 
13959 static int
13960 sd_initpkt_for_uscsi(struct buf *bp, struct scsi_pkt **pktpp)
13961 {
13962 	struct uscsi_cmd *uscmd;
13963 	struct sd_xbuf	*xp;
13964 	struct scsi_pkt	*pktp;
13965 	struct sd_lun	*un;
13966 	uint32_t	flags = 0;
13967 
13968 	ASSERT(bp != NULL);
13969 	ASSERT(pktpp != NULL);
13970 	xp = SD_GET_XBUF(bp);
13971 	ASSERT(xp != NULL);
13972 	un = SD_GET_UN(bp);
13973 	ASSERT(un != NULL);
13974 	ASSERT(mutex_owned(SD_MUTEX(un)));
13975 
13976 	/* The pointer to the uscsi_cmd struct is expected in xb_pktinfo */
13977 	uscmd = (struct uscsi_cmd *)xp->xb_pktinfo;
13978 	ASSERT(uscmd != NULL);
13979 
13980 	SD_TRACE(SD_LOG_IO_CORE, un,
13981 	    "sd_initpkt_for_uscsi: entry: buf:0x%p\n", bp);
13982 
13983 	/*
13984 	 * Allocate the scsi_pkt for the command.
13985 	 * Note: If PKT_DMA_PARTIAL flag is set, scsi_vhci binds a path
13986 	 *	 during scsi_init_pkt time and will continue to use the
13987 	 *	 same path as long as the same scsi_pkt is used without
13988 	 *	 intervening scsi_dma_free(). Since uscsi command does
13989 	 *	 not call scsi_dmafree() before retry failed command, it
13990 	 *	 is necessary to make sure PKT_DMA_PARTIAL flag is NOT
13991 	 *	 set such that scsi_vhci can use other available path for
13992 	 *	 retry. Besides, ucsci command does not allow DMA breakup,
13993 	 *	 so there is no need to set PKT_DMA_PARTIAL flag.
13994 	 */
13995 	if (uscmd->uscsi_rqlen > SENSE_LENGTH) {
13996 		pktp = scsi_init_pkt(SD_ADDRESS(un), NULL,
13997 		    ((bp->b_bcount != 0) ? bp : NULL), uscmd->uscsi_cdblen,
13998 		    ((int)(uscmd->uscsi_rqlen) + sizeof (struct scsi_arq_status)
13999 		    - sizeof (struct scsi_extended_sense)), 0,
14000 		    (un->un_pkt_flags & ~PKT_DMA_PARTIAL) | PKT_XARQ,
14001 		    sdrunout, (caddr_t)un);
14002 	} else {
14003 		pktp = scsi_init_pkt(SD_ADDRESS(un), NULL,
14004 		    ((bp->b_bcount != 0) ? bp : NULL), uscmd->uscsi_cdblen,
14005 		    sizeof (struct scsi_arq_status), 0,
14006 		    (un->un_pkt_flags & ~PKT_DMA_PARTIAL),
14007 		    sdrunout, (caddr_t)un);
14008 	}
14009 
14010 	if (pktp == NULL) {
14011 		*pktpp = NULL;
14012 		/*
14013 		 * Set the driver state to RWAIT to indicate the driver
14014 		 * is waiting on resource allocations. The driver will not
14015 		 * suspend, pm_suspend, or detatch while the state is RWAIT.
14016 		 */
14017 		New_state(un, SD_STATE_RWAIT);
14018 
14019 		SD_ERROR(SD_LOG_IO_CORE, un,
14020 		    "sd_initpkt_for_uscsi: No pktp. exit bp:0x%p\n", bp);
14021 
14022 		if ((bp->b_flags & B_ERROR) != 0) {
14023 			return (SD_PKT_ALLOC_FAILURE_NO_DMA);
14024 		}
14025 		return (SD_PKT_ALLOC_FAILURE);
14026 	}
14027 
14028 	/*
14029 	 * We do not do DMA breakup for USCSI commands, so return failure
14030 	 * here if all the needed DMA resources were not allocated.
14031 	 */
14032 	if ((un->un_pkt_flags & PKT_DMA_PARTIAL) &&
14033 	    (bp->b_bcount != 0) && (pktp->pkt_resid != 0)) {
14034 		scsi_destroy_pkt(pktp);
14035 		SD_ERROR(SD_LOG_IO_CORE, un, "sd_initpkt_for_uscsi: "
14036 		    "No partial DMA for USCSI. exit: buf:0x%p\n", bp);
14037 		return (SD_PKT_ALLOC_FAILURE_PKT_TOO_SMALL);
14038 	}
14039 
14040 	/* Init the cdb from the given uscsi struct */
14041 	(void) scsi_setup_cdb((union scsi_cdb *)pktp->pkt_cdbp,
14042 	    uscmd->uscsi_cdb[0], 0, 0, 0);
14043 
14044 	SD_FILL_SCSI1_LUN(un, pktp);
14045 
14046 	/*
14047 	 * Set up the optional USCSI flags. See the uscsi (7I) man page
14048 	 * for listing of the supported flags.
14049 	 */
14050 
14051 	if (uscmd->uscsi_flags & USCSI_SILENT) {
14052 		flags |= FLAG_SILENT;
14053 	}
14054 
14055 	if (uscmd->uscsi_flags & USCSI_DIAGNOSE) {
14056 		flags |= FLAG_DIAGNOSE;
14057 	}
14058 
14059 	if (uscmd->uscsi_flags & USCSI_ISOLATE) {
14060 		flags |= FLAG_ISOLATE;
14061 	}
14062 
14063 	if (un->un_f_is_fibre == FALSE) {
14064 		if (uscmd->uscsi_flags & USCSI_RENEGOT) {
14065 			flags |= FLAG_RENEGOTIATE_WIDE_SYNC;
14066 		}
14067 	}
14068 
14069 	/*
14070 	 * Set the pkt flags here so we save time later.
14071 	 * Note: These flags are NOT in the uscsi man page!!!
14072 	 */
14073 	if (uscmd->uscsi_flags & USCSI_HEAD) {
14074 		flags |= FLAG_HEAD;
14075 	}
14076 
14077 	if (uscmd->uscsi_flags & USCSI_NOINTR) {
14078 		flags |= FLAG_NOINTR;
14079 	}
14080 
14081 	/*
14082 	 * For tagged queueing, things get a bit complicated.
14083 	 * Check first for head of queue and last for ordered queue.
14084 	 * If neither head nor order, use the default driver tag flags.
14085 	 */
14086 	if ((uscmd->uscsi_flags & USCSI_NOTAG) == 0) {
14087 		if (uscmd->uscsi_flags & USCSI_HTAG) {
14088 			flags |= FLAG_HTAG;
14089 		} else if (uscmd->uscsi_flags & USCSI_OTAG) {
14090 			flags |= FLAG_OTAG;
14091 		} else {
14092 			flags |= un->un_tagflags & FLAG_TAGMASK;
14093 		}
14094 	}
14095 
14096 	if (uscmd->uscsi_flags & USCSI_NODISCON) {
14097 		flags = (flags & ~FLAG_TAGMASK) | FLAG_NODISCON;
14098 	}
14099 
14100 	pktp->pkt_flags = flags;
14101 
14102 	/* Transfer uscsi information to scsi_pkt */
14103 	(void) scsi_uscsi_pktinit(uscmd, pktp);
14104 
14105 	/* Copy the caller's CDB into the pkt... */
14106 	bcopy(uscmd->uscsi_cdb, pktp->pkt_cdbp, uscmd->uscsi_cdblen);
14107 
14108 	if (uscmd->uscsi_timeout == 0) {
14109 		pktp->pkt_time = un->un_uscsi_timeout;
14110 	} else {
14111 		pktp->pkt_time = uscmd->uscsi_timeout;
14112 	}
14113 
14114 	/* need it later to identify USCSI request in sdintr */
14115 	xp->xb_pkt_flags |= SD_XB_USCSICMD;
14116 
14117 	xp->xb_sense_resid = uscmd->uscsi_rqresid;
14118 
14119 	pktp->pkt_private = bp;
14120 	pktp->pkt_comp = sdintr;
14121 	*pktpp = pktp;
14122 
14123 	SD_TRACE(SD_LOG_IO_CORE, un,
14124 	    "sd_initpkt_for_uscsi: exit: buf:0x%p\n", bp);
14125 
14126 	return (SD_PKT_ALLOC_SUCCESS);
14127 }
14128 
14129 
14130 /*
14131  *    Function: sd_destroypkt_for_uscsi
14132  *
14133  * Description: Free the scsi_pkt(9S) struct for the given bp, for uscsi
14134  *		IOs.. Also saves relevant info into the associated uscsi_cmd
14135  *		struct.
14136  *
14137  *     Context: May be called under interrupt context
14138  */
14139 
14140 static void
14141 sd_destroypkt_for_uscsi(struct buf *bp)
14142 {
14143 	struct uscsi_cmd *uscmd;
14144 	struct sd_xbuf	*xp;
14145 	struct scsi_pkt	*pktp;
14146 	struct sd_lun	*un;
14147 	struct sd_uscsi_info *suip;
14148 
14149 	ASSERT(bp != NULL);
14150 	xp = SD_GET_XBUF(bp);
14151 	ASSERT(xp != NULL);
14152 	un = SD_GET_UN(bp);
14153 	ASSERT(un != NULL);
14154 	ASSERT(!mutex_owned(SD_MUTEX(un)));
14155 	pktp = SD_GET_PKTP(bp);
14156 	ASSERT(pktp != NULL);
14157 
14158 	SD_TRACE(SD_LOG_IO_CORE, un,
14159 	    "sd_destroypkt_for_uscsi: entry: buf:0x%p\n", bp);
14160 
14161 	/* The pointer to the uscsi_cmd struct is expected in xb_pktinfo */
14162 	uscmd = (struct uscsi_cmd *)xp->xb_pktinfo;
14163 	ASSERT(uscmd != NULL);
14164 
14165 	/* Save the status and the residual into the uscsi_cmd struct */
14166 	uscmd->uscsi_status = ((*(pktp)->pkt_scbp) & STATUS_MASK);
14167 	uscmd->uscsi_resid  = bp->b_resid;
14168 
14169 	/* Transfer scsi_pkt information to uscsi */
14170 	(void) scsi_uscsi_pktfini(pktp, uscmd);
14171 
14172 	/*
14173 	 * If enabled, copy any saved sense data into the area specified
14174 	 * by the uscsi command.
14175 	 */
14176 	if (((uscmd->uscsi_flags & USCSI_RQENABLE) != 0) &&
14177 	    (uscmd->uscsi_rqlen != 0) && (uscmd->uscsi_rqbuf != NULL)) {
14178 		/*
14179 		 * Note: uscmd->uscsi_rqbuf should always point to a buffer
14180 		 * at least SENSE_LENGTH bytes in size (see sd_send_scsi_cmd())
14181 		 */
14182 		uscmd->uscsi_rqstatus = xp->xb_sense_status;
14183 		uscmd->uscsi_rqresid  = xp->xb_sense_resid;
14184 		if (uscmd->uscsi_rqlen > SENSE_LENGTH) {
14185 			bcopy(xp->xb_sense_data, uscmd->uscsi_rqbuf,
14186 			    MAX_SENSE_LENGTH);
14187 		} else {
14188 			bcopy(xp->xb_sense_data, uscmd->uscsi_rqbuf,
14189 			    SENSE_LENGTH);
14190 		}
14191 	}
14192 	/*
14193 	 * The following assignments are for SCSI FMA.
14194 	 */
14195 	ASSERT(xp->xb_private != NULL);
14196 	suip = (struct sd_uscsi_info *)xp->xb_private;
14197 	suip->ui_pkt_reason = pktp->pkt_reason;
14198 	suip->ui_pkt_state = pktp->pkt_state;
14199 	suip->ui_pkt_statistics = pktp->pkt_statistics;
14200 	suip->ui_lba = (uint64_t)SD_GET_BLKNO(bp);
14201 
14202 	/* We are done with the scsi_pkt; free it now */
14203 	ASSERT(SD_GET_PKTP(bp) != NULL);
14204 	scsi_destroy_pkt(SD_GET_PKTP(bp));
14205 
14206 	SD_TRACE(SD_LOG_IO_CORE, un,
14207 	    "sd_destroypkt_for_uscsi: exit: buf:0x%p\n", bp);
14208 }
14209 
14210 
14211 /*
14212  *    Function: sd_bioclone_alloc
14213  *
14214  * Description: Allocate a buf(9S) and init it as per the given buf
14215  *		and the various arguments.  The associated sd_xbuf
14216  *		struct is (nearly) duplicated.  The struct buf *bp
14217  *		argument is saved in new_xp->xb_private.
14218  *
14219  *   Arguments: bp - ptr the the buf(9S) to be "shadowed"
14220  *		datalen - size of data area for the shadow bp
14221  *		blkno - starting LBA
14222  *		func - function pointer for b_iodone in the shadow buf. (May
14223  *			be NULL if none.)
14224  *
14225  * Return Code: Pointer to allocates buf(9S) struct
14226  *
14227  *     Context: Can sleep.
14228  */
14229 
14230 static struct buf *
14231 sd_bioclone_alloc(struct buf *bp, size_t datalen,
14232 	daddr_t blkno, int (*func)(struct buf *))
14233 {
14234 	struct	sd_lun	*un;
14235 	struct	sd_xbuf	*xp;
14236 	struct	sd_xbuf	*new_xp;
14237 	struct	buf	*new_bp;
14238 
14239 	ASSERT(bp != NULL);
14240 	xp = SD_GET_XBUF(bp);
14241 	ASSERT(xp != NULL);
14242 	un = SD_GET_UN(bp);
14243 	ASSERT(un != NULL);
14244 	ASSERT(!mutex_owned(SD_MUTEX(un)));
14245 
14246 	new_bp = bioclone(bp, 0, datalen, SD_GET_DEV(un), blkno, func,
14247 	    NULL, KM_SLEEP);
14248 
14249 	new_bp->b_lblkno	= blkno;
14250 
14251 	/*
14252 	 * Allocate an xbuf for the shadow bp and copy the contents of the
14253 	 * original xbuf into it.
14254 	 */
14255 	new_xp = kmem_alloc(sizeof (struct sd_xbuf), KM_SLEEP);
14256 	bcopy(xp, new_xp, sizeof (struct sd_xbuf));
14257 
14258 	/*
14259 	 * The given bp is automatically saved in the xb_private member
14260 	 * of the new xbuf.  Callers are allowed to depend on this.
14261 	 */
14262 	new_xp->xb_private = bp;
14263 
14264 	new_bp->b_private  = new_xp;
14265 
14266 	return (new_bp);
14267 }
14268 
14269 /*
14270  *    Function: sd_shadow_buf_alloc
14271  *
14272  * Description: Allocate a buf(9S) and init it as per the given buf
14273  *		and the various arguments.  The associated sd_xbuf
14274  *		struct is (nearly) duplicated.  The struct buf *bp
14275  *		argument is saved in new_xp->xb_private.
14276  *
14277  *   Arguments: bp - ptr the the buf(9S) to be "shadowed"
14278  *		datalen - size of data area for the shadow bp
14279  *		bflags - B_READ or B_WRITE (pseudo flag)
14280  *		blkno - starting LBA
14281  *		func - function pointer for b_iodone in the shadow buf. (May
14282  *			be NULL if none.)
14283  *
14284  * Return Code: Pointer to allocates buf(9S) struct
14285  *
14286  *     Context: Can sleep.
14287  */
14288 
14289 static struct buf *
14290 sd_shadow_buf_alloc(struct buf *bp, size_t datalen, uint_t bflags,
14291 	daddr_t blkno, int (*func)(struct buf *))
14292 {
14293 	struct	sd_lun	*un;
14294 	struct	sd_xbuf	*xp;
14295 	struct	sd_xbuf	*new_xp;
14296 	struct	buf	*new_bp;
14297 
14298 	ASSERT(bp != NULL);
14299 	xp = SD_GET_XBUF(bp);
14300 	ASSERT(xp != NULL);
14301 	un = SD_GET_UN(bp);
14302 	ASSERT(un != NULL);
14303 	ASSERT(!mutex_owned(SD_MUTEX(un)));
14304 
14305 	if (bp->b_flags & (B_PAGEIO | B_PHYS)) {
14306 		bp_mapin(bp);
14307 	}
14308 
14309 	bflags &= (B_READ | B_WRITE);
14310 #if defined(__i386) || defined(__amd64)
14311 	new_bp = getrbuf(KM_SLEEP);
14312 	new_bp->b_un.b_addr = kmem_zalloc(datalen, KM_SLEEP);
14313 	new_bp->b_bcount = datalen;
14314 	new_bp->b_flags = bflags |
14315 	    (bp->b_flags & ~(B_PAGEIO | B_PHYS | B_REMAPPED | B_SHADOW));
14316 #else
14317 	new_bp = scsi_alloc_consistent_buf(SD_ADDRESS(un), NULL,
14318 	    datalen, bflags, SLEEP_FUNC, NULL);
14319 #endif
14320 	new_bp->av_forw	= NULL;
14321 	new_bp->av_back	= NULL;
14322 	new_bp->b_dev	= bp->b_dev;
14323 	new_bp->b_blkno	= blkno;
14324 	new_bp->b_iodone = func;
14325 	new_bp->b_edev	= bp->b_edev;
14326 	new_bp->b_resid	= 0;
14327 
14328 	/* We need to preserve the B_FAILFAST flag */
14329 	if (bp->b_flags & B_FAILFAST) {
14330 		new_bp->b_flags |= B_FAILFAST;
14331 	}
14332 
14333 	/*
14334 	 * Allocate an xbuf for the shadow bp and copy the contents of the
14335 	 * original xbuf into it.
14336 	 */
14337 	new_xp = kmem_alloc(sizeof (struct sd_xbuf), KM_SLEEP);
14338 	bcopy(xp, new_xp, sizeof (struct sd_xbuf));
14339 
14340 	/* Need later to copy data between the shadow buf & original buf! */
14341 	new_xp->xb_pkt_flags |= PKT_CONSISTENT;
14342 
14343 	/*
14344 	 * The given bp is automatically saved in the xb_private member
14345 	 * of the new xbuf.  Callers are allowed to depend on this.
14346 	 */
14347 	new_xp->xb_private = bp;
14348 
14349 	new_bp->b_private  = new_xp;
14350 
14351 	return (new_bp);
14352 }
14353 
14354 /*
14355  *    Function: sd_bioclone_free
14356  *
14357  * Description: Deallocate a buf(9S) that was used for 'shadow' IO operations
14358  *		in the larger than partition operation.
14359  *
14360  *     Context: May be called under interrupt context
14361  */
14362 
14363 static void
14364 sd_bioclone_free(struct buf *bp)
14365 {
14366 	struct sd_xbuf	*xp;
14367 
14368 	ASSERT(bp != NULL);
14369 	xp = SD_GET_XBUF(bp);
14370 	ASSERT(xp != NULL);
14371 
14372 	/*
14373 	 * Call bp_mapout() before freeing the buf,  in case a lower
14374 	 * layer or HBA  had done a bp_mapin().  we must do this here
14375 	 * as we are the "originator" of the shadow buf.
14376 	 */
14377 	bp_mapout(bp);
14378 
14379 	/*
14380 	 * Null out b_iodone before freeing the bp, to ensure that the driver
14381 	 * never gets confused by a stale value in this field. (Just a little
14382 	 * extra defensiveness here.)
14383 	 */
14384 	bp->b_iodone = NULL;
14385 
14386 	freerbuf(bp);
14387 
14388 	kmem_free(xp, sizeof (struct sd_xbuf));
14389 }
14390 
14391 /*
14392  *    Function: sd_shadow_buf_free
14393  *
14394  * Description: Deallocate a buf(9S) that was used for 'shadow' IO operations.
14395  *
14396  *     Context: May be called under interrupt context
14397  */
14398 
14399 static void
14400 sd_shadow_buf_free(struct buf *bp)
14401 {
14402 	struct sd_xbuf	*xp;
14403 
14404 	ASSERT(bp != NULL);
14405 	xp = SD_GET_XBUF(bp);
14406 	ASSERT(xp != NULL);
14407 
14408 #if defined(__sparc)
14409 	/*
14410 	 * Call bp_mapout() before freeing the buf,  in case a lower
14411 	 * layer or HBA  had done a bp_mapin().  we must do this here
14412 	 * as we are the "originator" of the shadow buf.
14413 	 */
14414 	bp_mapout(bp);
14415 #endif
14416 
14417 	/*
14418 	 * Null out b_iodone before freeing the bp, to ensure that the driver
14419 	 * never gets confused by a stale value in this field. (Just a little
14420 	 * extra defensiveness here.)
14421 	 */
14422 	bp->b_iodone = NULL;
14423 
14424 #if defined(__i386) || defined(__amd64)
14425 	kmem_free(bp->b_un.b_addr, bp->b_bcount);
14426 	freerbuf(bp);
14427 #else
14428 	scsi_free_consistent_buf(bp);
14429 #endif
14430 
14431 	kmem_free(xp, sizeof (struct sd_xbuf));
14432 }
14433 
14434 
14435 /*
14436  *    Function: sd_print_transport_rejected_message
14437  *
14438  * Description: This implements the ludicrously complex rules for printing
14439  *		a "transport rejected" message.  This is to address the
14440  *		specific problem of having a flood of this error message
14441  *		produced when a failover occurs.
14442  *
14443  *     Context: Any.
14444  */
14445 
14446 static void
14447 sd_print_transport_rejected_message(struct sd_lun *un, struct sd_xbuf *xp,
14448 	int code)
14449 {
14450 	ASSERT(un != NULL);
14451 	ASSERT(mutex_owned(SD_MUTEX(un)));
14452 	ASSERT(xp != NULL);
14453 
14454 	/*
14455 	 * Print the "transport rejected" message under the following
14456 	 * conditions:
14457 	 *
14458 	 * - Whenever the SD_LOGMASK_DIAG bit of sd_level_mask is set
14459 	 * - The error code from scsi_transport() is NOT a TRAN_FATAL_ERROR.
14460 	 * - If the error code IS a TRAN_FATAL_ERROR, then the message is
14461 	 *   printed the FIRST time a TRAN_FATAL_ERROR is returned from
14462 	 *   scsi_transport(9F) (which indicates that the target might have
14463 	 *   gone off-line).  This uses the un->un_tran_fatal_count
14464 	 *   count, which is incremented whenever a TRAN_FATAL_ERROR is
14465 	 *   received, and reset to zero whenver a TRAN_ACCEPT is returned
14466 	 *   from scsi_transport().
14467 	 *
14468 	 * The FLAG_SILENT in the scsi_pkt must be CLEARED in ALL of
14469 	 * the preceeding cases in order for the message to be printed.
14470 	 */
14471 	if (((xp->xb_pktp->pkt_flags & FLAG_SILENT) == 0) &&
14472 	    (SD_FM_LOG(un) == SD_FM_LOG_NSUP)) {
14473 		if ((sd_level_mask & SD_LOGMASK_DIAG) ||
14474 		    (code != TRAN_FATAL_ERROR) ||
14475 		    (un->un_tran_fatal_count == 1)) {
14476 			switch (code) {
14477 			case TRAN_BADPKT:
14478 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
14479 				    "transport rejected bad packet\n");
14480 				break;
14481 			case TRAN_FATAL_ERROR:
14482 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
14483 				    "transport rejected fatal error\n");
14484 				break;
14485 			default:
14486 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
14487 				    "transport rejected (%d)\n", code);
14488 				break;
14489 			}
14490 		}
14491 	}
14492 }
14493 
14494 
14495 /*
14496  *    Function: sd_add_buf_to_waitq
14497  *
14498  * Description: Add the given buf(9S) struct to the wait queue for the
14499  *		instance.  If sorting is enabled, then the buf is added
14500  *		to the queue via an elevator sort algorithm (a la
14501  *		disksort(9F)).  The SD_GET_BLKNO(bp) is used as the sort key.
14502  *		If sorting is not enabled, then the buf is just added
14503  *		to the end of the wait queue.
14504  *
14505  * Return Code: void
14506  *
14507  *     Context: Does not sleep/block, therefore technically can be called
14508  *		from any context.  However if sorting is enabled then the
14509  *		execution time is indeterminate, and may take long if
14510  *		the wait queue grows large.
14511  */
14512 
14513 static void
14514 sd_add_buf_to_waitq(struct sd_lun *un, struct buf *bp)
14515 {
14516 	struct buf *ap;
14517 
14518 	ASSERT(bp != NULL);
14519 	ASSERT(un != NULL);
14520 	ASSERT(mutex_owned(SD_MUTEX(un)));
14521 
14522 	/* If the queue is empty, add the buf as the only entry & return. */
14523 	if (un->un_waitq_headp == NULL) {
14524 		ASSERT(un->un_waitq_tailp == NULL);
14525 		un->un_waitq_headp = un->un_waitq_tailp = bp;
14526 		bp->av_forw = NULL;
14527 		return;
14528 	}
14529 
14530 	ASSERT(un->un_waitq_tailp != NULL);
14531 
14532 	/*
14533 	 * If sorting is disabled, just add the buf to the tail end of
14534 	 * the wait queue and return.
14535 	 */
14536 	if (un->un_f_disksort_disabled) {
14537 		un->un_waitq_tailp->av_forw = bp;
14538 		un->un_waitq_tailp = bp;
14539 		bp->av_forw = NULL;
14540 		return;
14541 	}
14542 
14543 	/*
14544 	 * Sort thru the list of requests currently on the wait queue
14545 	 * and add the new buf request at the appropriate position.
14546 	 *
14547 	 * The un->un_waitq_headp is an activity chain pointer on which
14548 	 * we keep two queues, sorted in ascending SD_GET_BLKNO() order. The
14549 	 * first queue holds those requests which are positioned after
14550 	 * the current SD_GET_BLKNO() (in the first request); the second holds
14551 	 * requests which came in after their SD_GET_BLKNO() number was passed.
14552 	 * Thus we implement a one way scan, retracting after reaching
14553 	 * the end of the drive to the first request on the second
14554 	 * queue, at which time it becomes the first queue.
14555 	 * A one-way scan is natural because of the way UNIX read-ahead
14556 	 * blocks are allocated.
14557 	 *
14558 	 * If we lie after the first request, then we must locate the
14559 	 * second request list and add ourselves to it.
14560 	 */
14561 	ap = un->un_waitq_headp;
14562 	if (SD_GET_BLKNO(bp) < SD_GET_BLKNO(ap)) {
14563 		while (ap->av_forw != NULL) {
14564 			/*
14565 			 * Look for an "inversion" in the (normally
14566 			 * ascending) block numbers. This indicates
14567 			 * the start of the second request list.
14568 			 */
14569 			if (SD_GET_BLKNO(ap->av_forw) < SD_GET_BLKNO(ap)) {
14570 				/*
14571 				 * Search the second request list for the
14572 				 * first request at a larger block number.
14573 				 * We go before that; however if there is
14574 				 * no such request, we go at the end.
14575 				 */
14576 				do {
14577 					if (SD_GET_BLKNO(bp) <
14578 					    SD_GET_BLKNO(ap->av_forw)) {
14579 						goto insert;
14580 					}
14581 					ap = ap->av_forw;
14582 				} while (ap->av_forw != NULL);
14583 				goto insert;		/* after last */
14584 			}
14585 			ap = ap->av_forw;
14586 		}
14587 
14588 		/*
14589 		 * No inversions... we will go after the last, and
14590 		 * be the first request in the second request list.
14591 		 */
14592 		goto insert;
14593 	}
14594 
14595 	/*
14596 	 * Request is at/after the current request...
14597 	 * sort in the first request list.
14598 	 */
14599 	while (ap->av_forw != NULL) {
14600 		/*
14601 		 * We want to go after the current request (1) if
14602 		 * there is an inversion after it (i.e. it is the end
14603 		 * of the first request list), or (2) if the next
14604 		 * request is a larger block no. than our request.
14605 		 */
14606 		if ((SD_GET_BLKNO(ap->av_forw) < SD_GET_BLKNO(ap)) ||
14607 		    (SD_GET_BLKNO(bp) < SD_GET_BLKNO(ap->av_forw))) {
14608 			goto insert;
14609 		}
14610 		ap = ap->av_forw;
14611 	}
14612 
14613 	/*
14614 	 * Neither a second list nor a larger request, therefore
14615 	 * we go at the end of the first list (which is the same
14616 	 * as the end of the whole schebang).
14617 	 */
14618 insert:
14619 	bp->av_forw = ap->av_forw;
14620 	ap->av_forw = bp;
14621 
14622 	/*
14623 	 * If we inserted onto the tail end of the waitq, make sure the
14624 	 * tail pointer is updated.
14625 	 */
14626 	if (ap == un->un_waitq_tailp) {
14627 		un->un_waitq_tailp = bp;
14628 	}
14629 }
14630 
14631 
14632 /*
14633  *    Function: sd_start_cmds
14634  *
14635  * Description: Remove and transport cmds from the driver queues.
14636  *
14637  *   Arguments: un - pointer to the unit (soft state) struct for the target.
14638  *
14639  *		immed_bp - ptr to a buf to be transported immediately. Only
14640  *		the immed_bp is transported; bufs on the waitq are not
14641  *		processed and the un_retry_bp is not checked.  If immed_bp is
14642  *		NULL, then normal queue processing is performed.
14643  *
14644  *     Context: May be called from kernel thread context, interrupt context,
14645  *		or runout callback context. This function may not block or
14646  *		call routines that block.
14647  */
14648 
14649 static void
14650 sd_start_cmds(struct sd_lun *un, struct buf *immed_bp)
14651 {
14652 	struct	sd_xbuf	*xp;
14653 	struct	buf	*bp;
14654 	void	(*statp)(kstat_io_t *);
14655 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
14656 	void	(*saved_statp)(kstat_io_t *);
14657 #endif
14658 	int	rval;
14659 	struct sd_fm_internal *sfip = NULL;
14660 
14661 	ASSERT(un != NULL);
14662 	ASSERT(mutex_owned(SD_MUTEX(un)));
14663 	ASSERT(un->un_ncmds_in_transport >= 0);
14664 	ASSERT(un->un_throttle >= 0);
14665 
14666 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_start_cmds: entry\n");
14667 
14668 	do {
14669 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
14670 		saved_statp = NULL;
14671 #endif
14672 
14673 		/*
14674 		 * If we are syncing or dumping, fail the command to
14675 		 * avoid recursively calling back into scsi_transport().
14676 		 * The dump I/O itself uses a separate code path so this
14677 		 * only prevents non-dump I/O from being sent while dumping.
14678 		 * File system sync takes place before dumping begins.
14679 		 * During panic, filesystem I/O is allowed provided
14680 		 * un_in_callback is <= 1.  This is to prevent recursion
14681 		 * such as sd_start_cmds -> scsi_transport -> sdintr ->
14682 		 * sd_start_cmds and so on.  See panic.c for more information
14683 		 * about the states the system can be in during panic.
14684 		 */
14685 		if ((un->un_state == SD_STATE_DUMPING) ||
14686 		    (ddi_in_panic() && (un->un_in_callback > 1))) {
14687 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14688 			    "sd_start_cmds: panicking\n");
14689 			goto exit;
14690 		}
14691 
14692 		if ((bp = immed_bp) != NULL) {
14693 			/*
14694 			 * We have a bp that must be transported immediately.
14695 			 * It's OK to transport the immed_bp here without doing
14696 			 * the throttle limit check because the immed_bp is
14697 			 * always used in a retry/recovery case. This means
14698 			 * that we know we are not at the throttle limit by
14699 			 * virtue of the fact that to get here we must have
14700 			 * already gotten a command back via sdintr(). This also
14701 			 * relies on (1) the command on un_retry_bp preventing
14702 			 * further commands from the waitq from being issued;
14703 			 * and (2) the code in sd_retry_command checking the
14704 			 * throttle limit before issuing a delayed or immediate
14705 			 * retry. This holds even if the throttle limit is
14706 			 * currently ratcheted down from its maximum value.
14707 			 */
14708 			statp = kstat_runq_enter;
14709 			if (bp == un->un_retry_bp) {
14710 				ASSERT((un->un_retry_statp == NULL) ||
14711 				    (un->un_retry_statp == kstat_waitq_enter) ||
14712 				    (un->un_retry_statp ==
14713 				    kstat_runq_back_to_waitq));
14714 				/*
14715 				 * If the waitq kstat was incremented when
14716 				 * sd_set_retry_bp() queued this bp for a retry,
14717 				 * then we must set up statp so that the waitq
14718 				 * count will get decremented correctly below.
14719 				 * Also we must clear un->un_retry_statp to
14720 				 * ensure that we do not act on a stale value
14721 				 * in this field.
14722 				 */
14723 				if ((un->un_retry_statp == kstat_waitq_enter) ||
14724 				    (un->un_retry_statp ==
14725 				    kstat_runq_back_to_waitq)) {
14726 					statp = kstat_waitq_to_runq;
14727 				}
14728 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
14729 				saved_statp = un->un_retry_statp;
14730 #endif
14731 				un->un_retry_statp = NULL;
14732 
14733 				SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
14734 				    "sd_start_cmds: un:0x%p: GOT retry_bp:0x%p "
14735 				    "un_throttle:%d un_ncmds_in_transport:%d\n",
14736 				    un, un->un_retry_bp, un->un_throttle,
14737 				    un->un_ncmds_in_transport);
14738 			} else {
14739 				SD_TRACE(SD_LOG_IO_CORE, un, "sd_start_cmds: "
14740 				    "processing priority bp:0x%p\n", bp);
14741 			}
14742 
14743 		} else if ((bp = un->un_waitq_headp) != NULL) {
14744 			/*
14745 			 * A command on the waitq is ready to go, but do not
14746 			 * send it if:
14747 			 *
14748 			 * (1) the throttle limit has been reached, or
14749 			 * (2) a retry is pending, or
14750 			 * (3) a START_STOP_UNIT callback pending, or
14751 			 * (4) a callback for a SD_PATH_DIRECT_PRIORITY
14752 			 *	command is pending.
14753 			 *
14754 			 * For all of these conditions, IO processing will
14755 			 * restart after the condition is cleared.
14756 			 */
14757 			if (un->un_ncmds_in_transport >= un->un_throttle) {
14758 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14759 				    "sd_start_cmds: exiting, "
14760 				    "throttle limit reached!\n");
14761 				goto exit;
14762 			}
14763 			if (un->un_retry_bp != NULL) {
14764 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14765 				    "sd_start_cmds: exiting, retry pending!\n");
14766 				goto exit;
14767 			}
14768 			if (un->un_startstop_timeid != NULL) {
14769 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14770 				    "sd_start_cmds: exiting, "
14771 				    "START_STOP pending!\n");
14772 				goto exit;
14773 			}
14774 			if (un->un_direct_priority_timeid != NULL) {
14775 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14776 				    "sd_start_cmds: exiting, "
14777 				    "SD_PATH_DIRECT_PRIORITY cmd. pending!\n");
14778 				goto exit;
14779 			}
14780 
14781 			/* Dequeue the command */
14782 			un->un_waitq_headp = bp->av_forw;
14783 			if (un->un_waitq_headp == NULL) {
14784 				un->un_waitq_tailp = NULL;
14785 			}
14786 			bp->av_forw = NULL;
14787 			statp = kstat_waitq_to_runq;
14788 			SD_TRACE(SD_LOG_IO_CORE, un,
14789 			    "sd_start_cmds: processing waitq bp:0x%p\n", bp);
14790 
14791 		} else {
14792 			/* No work to do so bail out now */
14793 			SD_TRACE(SD_LOG_IO_CORE, un,
14794 			    "sd_start_cmds: no more work, exiting!\n");
14795 			goto exit;
14796 		}
14797 
14798 		/*
14799 		 * Reset the state to normal. This is the mechanism by which
14800 		 * the state transitions from either SD_STATE_RWAIT or
14801 		 * SD_STATE_OFFLINE to SD_STATE_NORMAL.
14802 		 * If state is SD_STATE_PM_CHANGING then this command is
14803 		 * part of the device power control and the state must
14804 		 * not be put back to normal. Doing so would would
14805 		 * allow new commands to proceed when they shouldn't,
14806 		 * the device may be going off.
14807 		 */
14808 		if ((un->un_state != SD_STATE_SUSPENDED) &&
14809 		    (un->un_state != SD_STATE_PM_CHANGING)) {
14810 			New_state(un, SD_STATE_NORMAL);
14811 		}
14812 
14813 		xp = SD_GET_XBUF(bp);
14814 		ASSERT(xp != NULL);
14815 
14816 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
14817 		/*
14818 		 * Allocate the scsi_pkt if we need one, or attach DMA
14819 		 * resources if we have a scsi_pkt that needs them. The
14820 		 * latter should only occur for commands that are being
14821 		 * retried.
14822 		 */
14823 		if ((xp->xb_pktp == NULL) ||
14824 		    ((xp->xb_pkt_flags & SD_XB_DMA_FREED) != 0)) {
14825 #else
14826 		if (xp->xb_pktp == NULL) {
14827 #endif
14828 			/*
14829 			 * There is no scsi_pkt allocated for this buf. Call
14830 			 * the initpkt function to allocate & init one.
14831 			 *
14832 			 * The scsi_init_pkt runout callback functionality is
14833 			 * implemented as follows:
14834 			 *
14835 			 * 1) The initpkt function always calls
14836 			 *    scsi_init_pkt(9F) with sdrunout specified as the
14837 			 *    callback routine.
14838 			 * 2) A successful packet allocation is initialized and
14839 			 *    the I/O is transported.
14840 			 * 3) The I/O associated with an allocation resource
14841 			 *    failure is left on its queue to be retried via
14842 			 *    runout or the next I/O.
14843 			 * 4) The I/O associated with a DMA error is removed
14844 			 *    from the queue and failed with EIO. Processing of
14845 			 *    the transport queues is also halted to be
14846 			 *    restarted via runout or the next I/O.
14847 			 * 5) The I/O associated with a CDB size or packet
14848 			 *    size error is removed from the queue and failed
14849 			 *    with EIO. Processing of the transport queues is
14850 			 *    continued.
14851 			 *
14852 			 * Note: there is no interface for canceling a runout
14853 			 * callback. To prevent the driver from detaching or
14854 			 * suspending while a runout is pending the driver
14855 			 * state is set to SD_STATE_RWAIT
14856 			 *
14857 			 * Note: using the scsi_init_pkt callback facility can
14858 			 * result in an I/O request persisting at the head of
14859 			 * the list which cannot be satisfied even after
14860 			 * multiple retries. In the future the driver may
14861 			 * implement some kind of maximum runout count before
14862 			 * failing an I/O.
14863 			 *
14864 			 * Note: the use of funcp below may seem superfluous,
14865 			 * but it helps warlock figure out the correct
14866 			 * initpkt function calls (see [s]sd.wlcmd).
14867 			 */
14868 			struct scsi_pkt	*pktp;
14869 			int (*funcp)(struct buf *bp, struct scsi_pkt **pktp);
14870 
14871 			ASSERT(bp != un->un_rqs_bp);
14872 
14873 			funcp = sd_initpkt_map[xp->xb_chain_iostart];
14874 			switch ((*funcp)(bp, &pktp)) {
14875 			case  SD_PKT_ALLOC_SUCCESS:
14876 				xp->xb_pktp = pktp;
14877 				SD_TRACE(SD_LOG_IO_CORE, un,
14878 				    "sd_start_cmd: SD_PKT_ALLOC_SUCCESS 0x%p\n",
14879 				    pktp);
14880 				goto got_pkt;
14881 
14882 			case SD_PKT_ALLOC_FAILURE:
14883 				/*
14884 				 * Temporary (hopefully) resource depletion.
14885 				 * Since retries and RQS commands always have a
14886 				 * scsi_pkt allocated, these cases should never
14887 				 * get here. So the only cases this needs to
14888 				 * handle is a bp from the waitq (which we put
14889 				 * back onto the waitq for sdrunout), or a bp
14890 				 * sent as an immed_bp (which we just fail).
14891 				 */
14892 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14893 				    "sd_start_cmds: SD_PKT_ALLOC_FAILURE\n");
14894 
14895 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
14896 
14897 				if (bp == immed_bp) {
14898 					/*
14899 					 * If SD_XB_DMA_FREED is clear, then
14900 					 * this is a failure to allocate a
14901 					 * scsi_pkt, and we must fail the
14902 					 * command.
14903 					 */
14904 					if ((xp->xb_pkt_flags &
14905 					    SD_XB_DMA_FREED) == 0) {
14906 						break;
14907 					}
14908 
14909 					/*
14910 					 * If this immediate command is NOT our
14911 					 * un_retry_bp, then we must fail it.
14912 					 */
14913 					if (bp != un->un_retry_bp) {
14914 						break;
14915 					}
14916 
14917 					/*
14918 					 * We get here if this cmd is our
14919 					 * un_retry_bp that was DMAFREED, but
14920 					 * scsi_init_pkt() failed to reallocate
14921 					 * DMA resources when we attempted to
14922 					 * retry it. This can happen when an
14923 					 * mpxio failover is in progress, but
14924 					 * we don't want to just fail the
14925 					 * command in this case.
14926 					 *
14927 					 * Use timeout(9F) to restart it after
14928 					 * a 100ms delay.  We don't want to
14929 					 * let sdrunout() restart it, because
14930 					 * sdrunout() is just supposed to start
14931 					 * commands that are sitting on the
14932 					 * wait queue.  The un_retry_bp stays
14933 					 * set until the command completes, but
14934 					 * sdrunout can be called many times
14935 					 * before that happens.  Since sdrunout
14936 					 * cannot tell if the un_retry_bp is
14937 					 * already in the transport, it could
14938 					 * end up calling scsi_transport() for
14939 					 * the un_retry_bp multiple times.
14940 					 *
14941 					 * Also: don't schedule the callback
14942 					 * if some other callback is already
14943 					 * pending.
14944 					 */
14945 					if (un->un_retry_statp == NULL) {
14946 						/*
14947 						 * restore the kstat pointer to
14948 						 * keep kstat counts coherent
14949 						 * when we do retry the command.
14950 						 */
14951 						un->un_retry_statp =
14952 						    saved_statp;
14953 					}
14954 
14955 					if ((un->un_startstop_timeid == NULL) &&
14956 					    (un->un_retry_timeid == NULL) &&
14957 					    (un->un_direct_priority_timeid ==
14958 					    NULL)) {
14959 
14960 						un->un_retry_timeid =
14961 						    timeout(
14962 						    sd_start_retry_command,
14963 						    un, SD_RESTART_TIMEOUT);
14964 					}
14965 					goto exit;
14966 				}
14967 
14968 #else
14969 				if (bp == immed_bp) {
14970 					break;	/* Just fail the command */
14971 				}
14972 #endif
14973 
14974 				/* Add the buf back to the head of the waitq */
14975 				bp->av_forw = un->un_waitq_headp;
14976 				un->un_waitq_headp = bp;
14977 				if (un->un_waitq_tailp == NULL) {
14978 					un->un_waitq_tailp = bp;
14979 				}
14980 				goto exit;
14981 
14982 			case SD_PKT_ALLOC_FAILURE_NO_DMA:
14983 				/*
14984 				 * HBA DMA resource failure. Fail the command
14985 				 * and continue processing of the queues.
14986 				 */
14987 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14988 				    "sd_start_cmds: "
14989 				    "SD_PKT_ALLOC_FAILURE_NO_DMA\n");
14990 				break;
14991 
14992 			case SD_PKT_ALLOC_FAILURE_PKT_TOO_SMALL:
14993 				/*
14994 				 * Note:x86: Partial DMA mapping not supported
14995 				 * for USCSI commands, and all the needed DMA
14996 				 * resources were not allocated.
14997 				 */
14998 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
14999 				    "sd_start_cmds: "
15000 				    "SD_PKT_ALLOC_FAILURE_PKT_TOO_SMALL\n");
15001 				break;
15002 
15003 			case SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL:
15004 				/*
15005 				 * Note:x86: Request cannot fit into CDB based
15006 				 * on lba and len.
15007 				 */
15008 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15009 				    "sd_start_cmds: "
15010 				    "SD_PKT_ALLOC_FAILURE_CDB_TOO_SMALL\n");
15011 				break;
15012 
15013 			default:
15014 				/* Should NEVER get here! */
15015 				panic("scsi_initpkt error");
15016 				/*NOTREACHED*/
15017 			}
15018 
15019 			/*
15020 			 * Fatal error in allocating a scsi_pkt for this buf.
15021 			 * Update kstats & return the buf with an error code.
15022 			 * We must use sd_return_failed_command_no_restart() to
15023 			 * avoid a recursive call back into sd_start_cmds().
15024 			 * However this also means that we must keep processing
15025 			 * the waitq here in order to avoid stalling.
15026 			 */
15027 			if (statp == kstat_waitq_to_runq) {
15028 				SD_UPDATE_KSTATS(un, kstat_waitq_exit, bp);
15029 			}
15030 			sd_return_failed_command_no_restart(un, bp, EIO);
15031 			if (bp == immed_bp) {
15032 				/* immed_bp is gone by now, so clear this */
15033 				immed_bp = NULL;
15034 			}
15035 			continue;
15036 		}
15037 got_pkt:
15038 		if (bp == immed_bp) {
15039 			/* goto the head of the class.... */
15040 			xp->xb_pktp->pkt_flags |= FLAG_HEAD;
15041 		}
15042 
15043 		un->un_ncmds_in_transport++;
15044 		SD_UPDATE_KSTATS(un, statp, bp);
15045 
15046 		/*
15047 		 * Call scsi_transport() to send the command to the target.
15048 		 * According to SCSA architecture, we must drop the mutex here
15049 		 * before calling scsi_transport() in order to avoid deadlock.
15050 		 * Note that the scsi_pkt's completion routine can be executed
15051 		 * (from interrupt context) even before the call to
15052 		 * scsi_transport() returns.
15053 		 */
15054 		SD_TRACE(SD_LOG_IO_CORE, un,
15055 		    "sd_start_cmds: calling scsi_transport()\n");
15056 		DTRACE_PROBE1(scsi__transport__dispatch, struct buf *, bp);
15057 
15058 		mutex_exit(SD_MUTEX(un));
15059 		rval = scsi_transport(xp->xb_pktp);
15060 		mutex_enter(SD_MUTEX(un));
15061 
15062 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15063 		    "sd_start_cmds: scsi_transport() returned %d\n", rval);
15064 
15065 		switch (rval) {
15066 		case TRAN_ACCEPT:
15067 			/* Clear this with every pkt accepted by the HBA */
15068 			un->un_tran_fatal_count = 0;
15069 			break;	/* Success; try the next cmd (if any) */
15070 
15071 		case TRAN_BUSY:
15072 			un->un_ncmds_in_transport--;
15073 			ASSERT(un->un_ncmds_in_transport >= 0);
15074 
15075 			/*
15076 			 * Don't retry request sense, the sense data
15077 			 * is lost when another request is sent.
15078 			 * Free up the rqs buf and retry
15079 			 * the original failed cmd.  Update kstat.
15080 			 */
15081 			if (bp == un->un_rqs_bp) {
15082 				SD_UPDATE_KSTATS(un, kstat_runq_exit, bp);
15083 				bp = sd_mark_rqs_idle(un, xp);
15084 				sd_retry_command(un, bp, SD_RETRIES_STANDARD,
15085 				    NULL, NULL, EIO, un->un_busy_timeout / 500,
15086 				    kstat_waitq_enter);
15087 				goto exit;
15088 			}
15089 
15090 #if defined(__i386) || defined(__amd64)	/* DMAFREE for x86 only */
15091 			/*
15092 			 * Free the DMA resources for the  scsi_pkt. This will
15093 			 * allow mpxio to select another path the next time
15094 			 * we call scsi_transport() with this scsi_pkt.
15095 			 * See sdintr() for the rationalization behind this.
15096 			 */
15097 			if ((un->un_f_is_fibre == TRUE) &&
15098 			    ((xp->xb_pkt_flags & SD_XB_USCSICMD) == 0) &&
15099 			    ((xp->xb_pktp->pkt_flags & FLAG_SENSING) == 0)) {
15100 				scsi_dmafree(xp->xb_pktp);
15101 				xp->xb_pkt_flags |= SD_XB_DMA_FREED;
15102 			}
15103 #endif
15104 
15105 			if (SD_IS_DIRECT_PRIORITY(SD_GET_XBUF(bp))) {
15106 				/*
15107 				 * Commands that are SD_PATH_DIRECT_PRIORITY
15108 				 * are for error recovery situations. These do
15109 				 * not use the normal command waitq, so if they
15110 				 * get a TRAN_BUSY we cannot put them back onto
15111 				 * the waitq for later retry. One possible
15112 				 * problem is that there could already be some
15113 				 * other command on un_retry_bp that is waiting
15114 				 * for this one to complete, so we would be
15115 				 * deadlocked if we put this command back onto
15116 				 * the waitq for later retry (since un_retry_bp
15117 				 * must complete before the driver gets back to
15118 				 * commands on the waitq).
15119 				 *
15120 				 * To avoid deadlock we must schedule a callback
15121 				 * that will restart this command after a set
15122 				 * interval.  This should keep retrying for as
15123 				 * long as the underlying transport keeps
15124 				 * returning TRAN_BUSY (just like for other
15125 				 * commands).  Use the same timeout interval as
15126 				 * for the ordinary TRAN_BUSY retry.
15127 				 */
15128 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15129 				    "sd_start_cmds: scsi_transport() returned "
15130 				    "TRAN_BUSY for DIRECT_PRIORITY cmd!\n");
15131 
15132 				SD_UPDATE_KSTATS(un, kstat_runq_exit, bp);
15133 				un->un_direct_priority_timeid =
15134 				    timeout(sd_start_direct_priority_command,
15135 				    bp, un->un_busy_timeout / 500);
15136 
15137 				goto exit;
15138 			}
15139 
15140 			/*
15141 			 * For TRAN_BUSY, we want to reduce the throttle value,
15142 			 * unless we are retrying a command.
15143 			 */
15144 			if (bp != un->un_retry_bp) {
15145 				sd_reduce_throttle(un, SD_THROTTLE_TRAN_BUSY);
15146 			}
15147 
15148 			/*
15149 			 * Set up the bp to be tried again 10 ms later.
15150 			 * Note:x86: Is there a timeout value in the sd_lun
15151 			 * for this condition?
15152 			 */
15153 			sd_set_retry_bp(un, bp, un->un_busy_timeout / 500,
15154 			    kstat_runq_back_to_waitq);
15155 			goto exit;
15156 
15157 		case TRAN_FATAL_ERROR:
15158 			un->un_tran_fatal_count++;
15159 			/* FALLTHRU */
15160 
15161 		case TRAN_BADPKT:
15162 		default:
15163 			un->un_ncmds_in_transport--;
15164 			ASSERT(un->un_ncmds_in_transport >= 0);
15165 
15166 			/*
15167 			 * If this is our REQUEST SENSE command with a
15168 			 * transport error, we must get back the pointers
15169 			 * to the original buf, and mark the REQUEST
15170 			 * SENSE command as "available".
15171 			 */
15172 			if (bp == un->un_rqs_bp) {
15173 				bp = sd_mark_rqs_idle(un, xp);
15174 				xp = SD_GET_XBUF(bp);
15175 			} else {
15176 				/*
15177 				 * Legacy behavior: do not update transport
15178 				 * error count for request sense commands.
15179 				 */
15180 				SD_UPDATE_ERRSTATS(un, sd_transerrs);
15181 			}
15182 
15183 			SD_UPDATE_KSTATS(un, kstat_runq_exit, bp);
15184 			sd_print_transport_rejected_message(un, xp, rval);
15185 
15186 			/*
15187 			 * This command will be terminated by SD driver due
15188 			 * to a fatal transport error. We should post
15189 			 * ereport.io.scsi.cmd.disk.tran with driver-assessment
15190 			 * of "fail" for any command to indicate this
15191 			 * situation.
15192 			 */
15193 			if (xp->xb_ena > 0) {
15194 				ASSERT(un->un_fm_private != NULL);
15195 				sfip = un->un_fm_private;
15196 				sfip->fm_ssc.ssc_flags |= SSC_FLAGS_TRAN_ABORT;
15197 				sd_ssc_extract_info(&sfip->fm_ssc, un,
15198 				    xp->xb_pktp, bp, xp);
15199 				sd_ssc_post(&sfip->fm_ssc, SD_FM_DRV_FATAL);
15200 			}
15201 
15202 			/*
15203 			 * We must use sd_return_failed_command_no_restart() to
15204 			 * avoid a recursive call back into sd_start_cmds().
15205 			 * However this also means that we must keep processing
15206 			 * the waitq here in order to avoid stalling.
15207 			 */
15208 			sd_return_failed_command_no_restart(un, bp, EIO);
15209 
15210 			/*
15211 			 * Notify any threads waiting in sd_ddi_suspend() that
15212 			 * a command completion has occurred.
15213 			 */
15214 			if (un->un_state == SD_STATE_SUSPENDED) {
15215 				cv_broadcast(&un->un_disk_busy_cv);
15216 			}
15217 
15218 			if (bp == immed_bp) {
15219 				/* immed_bp is gone by now, so clear this */
15220 				immed_bp = NULL;
15221 			}
15222 			break;
15223 		}
15224 
15225 	} while (immed_bp == NULL);
15226 
15227 exit:
15228 	ASSERT(mutex_owned(SD_MUTEX(un)));
15229 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_start_cmds: exit\n");
15230 }
15231 
15232 
15233 /*
15234  *    Function: sd_return_command
15235  *
15236  * Description: Returns a command to its originator (with or without an
15237  *		error).  Also starts commands waiting to be transported
15238  *		to the target.
15239  *
15240  *     Context: May be called from interrupt, kernel, or timeout context
15241  */
15242 
15243 static void
15244 sd_return_command(struct sd_lun *un, struct buf *bp)
15245 {
15246 	struct sd_xbuf *xp;
15247 	struct scsi_pkt *pktp;
15248 	struct sd_fm_internal *sfip;
15249 
15250 	ASSERT(bp != NULL);
15251 	ASSERT(un != NULL);
15252 	ASSERT(mutex_owned(SD_MUTEX(un)));
15253 	ASSERT(bp != un->un_rqs_bp);
15254 	xp = SD_GET_XBUF(bp);
15255 	ASSERT(xp != NULL);
15256 
15257 	pktp = SD_GET_PKTP(bp);
15258 	sfip = (struct sd_fm_internal *)un->un_fm_private;
15259 	ASSERT(sfip != NULL);
15260 
15261 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_return_command: entry\n");
15262 
15263 	/*
15264 	 * Note: check for the "sdrestart failed" case.
15265 	 */
15266 	if ((un->un_partial_dma_supported == 1) &&
15267 	    ((xp->xb_pkt_flags & SD_XB_USCSICMD) != SD_XB_USCSICMD) &&
15268 	    (geterror(bp) == 0) && (xp->xb_dma_resid != 0) &&
15269 	    (xp->xb_pktp->pkt_resid == 0)) {
15270 
15271 		if (sd_setup_next_xfer(un, bp, pktp, xp) != 0) {
15272 			/*
15273 			 * Successfully set up next portion of cmd
15274 			 * transfer, try sending it
15275 			 */
15276 			sd_retry_command(un, bp, SD_RETRIES_NOCHECK,
15277 			    NULL, NULL, 0, (clock_t)0, NULL);
15278 			sd_start_cmds(un, NULL);
15279 			return;	/* Note:x86: need a return here? */
15280 		}
15281 	}
15282 
15283 	/*
15284 	 * If this is the failfast bp, clear it from un_failfast_bp. This
15285 	 * can happen if upon being re-tried the failfast bp either
15286 	 * succeeded or encountered another error (possibly even a different
15287 	 * error than the one that precipitated the failfast state, but in
15288 	 * that case it would have had to exhaust retries as well). Regardless,
15289 	 * this should not occur whenever the instance is in the active
15290 	 * failfast state.
15291 	 */
15292 	if (bp == un->un_failfast_bp) {
15293 		ASSERT(un->un_failfast_state == SD_FAILFAST_INACTIVE);
15294 		un->un_failfast_bp = NULL;
15295 	}
15296 
15297 	/*
15298 	 * Clear the failfast state upon successful completion of ANY cmd.
15299 	 */
15300 	if (bp->b_error == 0) {
15301 		un->un_failfast_state = SD_FAILFAST_INACTIVE;
15302 		/*
15303 		 * If this is a successful command, but used to be retried,
15304 		 * we will take it as a recovered command and post an
15305 		 * ereport with driver-assessment of "recovered".
15306 		 */
15307 		if (xp->xb_ena > 0) {
15308 			sd_ssc_extract_info(&sfip->fm_ssc, un, pktp, bp, xp);
15309 			sd_ssc_post(&sfip->fm_ssc, SD_FM_DRV_RECOVERY);
15310 		}
15311 	} else {
15312 		/*
15313 		 * If this is a failed non-USCSI command we will post an
15314 		 * ereport with driver-assessment set accordingly("fail" or
15315 		 * "fatal").
15316 		 */
15317 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
15318 			sd_ssc_extract_info(&sfip->fm_ssc, un, pktp, bp, xp);
15319 			sd_ssc_post(&sfip->fm_ssc, SD_FM_DRV_FATAL);
15320 		}
15321 	}
15322 
15323 	/*
15324 	 * This is used if the command was retried one or more times. Show that
15325 	 * we are done with it, and allow processing of the waitq to resume.
15326 	 */
15327 	if (bp == un->un_retry_bp) {
15328 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15329 		    "sd_return_command: un:0x%p: "
15330 		    "RETURNING retry_bp:0x%p\n", un, un->un_retry_bp);
15331 		un->un_retry_bp = NULL;
15332 		un->un_retry_statp = NULL;
15333 	}
15334 
15335 	SD_UPDATE_RDWR_STATS(un, bp);
15336 	SD_UPDATE_PARTITION_STATS(un, bp);
15337 
15338 	switch (un->un_state) {
15339 	case SD_STATE_SUSPENDED:
15340 		/*
15341 		 * Notify any threads waiting in sd_ddi_suspend() that
15342 		 * a command completion has occurred.
15343 		 */
15344 		cv_broadcast(&un->un_disk_busy_cv);
15345 		break;
15346 	default:
15347 		sd_start_cmds(un, NULL);
15348 		break;
15349 	}
15350 
15351 	/* Return this command up the iodone chain to its originator. */
15352 	mutex_exit(SD_MUTEX(un));
15353 
15354 	(*(sd_destroypkt_map[xp->xb_chain_iodone]))(bp);
15355 	xp->xb_pktp = NULL;
15356 
15357 	SD_BEGIN_IODONE(xp->xb_chain_iodone, un, bp);
15358 
15359 	ASSERT(!mutex_owned(SD_MUTEX(un)));
15360 	mutex_enter(SD_MUTEX(un));
15361 
15362 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_return_command: exit\n");
15363 }
15364 
15365 
15366 /*
15367  *    Function: sd_return_failed_command
15368  *
15369  * Description: Command completion when an error occurred.
15370  *
15371  *     Context: May be called from interrupt context
15372  */
15373 
15374 static void
15375 sd_return_failed_command(struct sd_lun *un, struct buf *bp, int errcode)
15376 {
15377 	ASSERT(bp != NULL);
15378 	ASSERT(un != NULL);
15379 	ASSERT(mutex_owned(SD_MUTEX(un)));
15380 
15381 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15382 	    "sd_return_failed_command: entry\n");
15383 
15384 	/*
15385 	 * b_resid could already be nonzero due to a partial data
15386 	 * transfer, so do not change it here.
15387 	 */
15388 	SD_BIOERROR(bp, errcode);
15389 
15390 	sd_return_command(un, bp);
15391 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15392 	    "sd_return_failed_command: exit\n");
15393 }
15394 
15395 
15396 /*
15397  *    Function: sd_return_failed_command_no_restart
15398  *
15399  * Description: Same as sd_return_failed_command, but ensures that no
15400  *		call back into sd_start_cmds will be issued.
15401  *
15402  *     Context: May be called from interrupt context
15403  */
15404 
15405 static void
15406 sd_return_failed_command_no_restart(struct sd_lun *un, struct buf *bp,
15407 	int errcode)
15408 {
15409 	struct sd_xbuf *xp;
15410 
15411 	ASSERT(bp != NULL);
15412 	ASSERT(un != NULL);
15413 	ASSERT(mutex_owned(SD_MUTEX(un)));
15414 	xp = SD_GET_XBUF(bp);
15415 	ASSERT(xp != NULL);
15416 	ASSERT(errcode != 0);
15417 
15418 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15419 	    "sd_return_failed_command_no_restart: entry\n");
15420 
15421 	/*
15422 	 * b_resid could already be nonzero due to a partial data
15423 	 * transfer, so do not change it here.
15424 	 */
15425 	SD_BIOERROR(bp, errcode);
15426 
15427 	/*
15428 	 * If this is the failfast bp, clear it. This can happen if the
15429 	 * failfast bp encounterd a fatal error when we attempted to
15430 	 * re-try it (such as a scsi_transport(9F) failure).  However
15431 	 * we should NOT be in an active failfast state if the failfast
15432 	 * bp is not NULL.
15433 	 */
15434 	if (bp == un->un_failfast_bp) {
15435 		ASSERT(un->un_failfast_state == SD_FAILFAST_INACTIVE);
15436 		un->un_failfast_bp = NULL;
15437 	}
15438 
15439 	if (bp == un->un_retry_bp) {
15440 		/*
15441 		 * This command was retried one or more times. Show that we are
15442 		 * done with it, and allow processing of the waitq to resume.
15443 		 */
15444 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15445 		    "sd_return_failed_command_no_restart: "
15446 		    " un:0x%p: RETURNING retry_bp:0x%p\n", un, un->un_retry_bp);
15447 		un->un_retry_bp = NULL;
15448 		un->un_retry_statp = NULL;
15449 	}
15450 
15451 	SD_UPDATE_RDWR_STATS(un, bp);
15452 	SD_UPDATE_PARTITION_STATS(un, bp);
15453 
15454 	mutex_exit(SD_MUTEX(un));
15455 
15456 	if (xp->xb_pktp != NULL) {
15457 		(*(sd_destroypkt_map[xp->xb_chain_iodone]))(bp);
15458 		xp->xb_pktp = NULL;
15459 	}
15460 
15461 	SD_BEGIN_IODONE(xp->xb_chain_iodone, un, bp);
15462 
15463 	mutex_enter(SD_MUTEX(un));
15464 
15465 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15466 	    "sd_return_failed_command_no_restart: exit\n");
15467 }
15468 
15469 
15470 /*
15471  *    Function: sd_retry_command
15472  *
15473  * Description: queue up a command for retry, or (optionally) fail it
15474  *		if retry counts are exhausted.
15475  *
15476  *   Arguments: un - Pointer to the sd_lun struct for the target.
15477  *
15478  *		bp - Pointer to the buf for the command to be retried.
15479  *
15480  *		retry_check_flag - Flag to see which (if any) of the retry
15481  *		   counts should be decremented/checked. If the indicated
15482  *		   retry count is exhausted, then the command will not be
15483  *		   retried; it will be failed instead. This should use a
15484  *		   value equal to one of the following:
15485  *
15486  *			SD_RETRIES_NOCHECK
15487  *			SD_RESD_RETRIES_STANDARD
15488  *			SD_RETRIES_VICTIM
15489  *
15490  *		   Optionally may be bitwise-OR'ed with SD_RETRIES_ISOLATE
15491  *		   if the check should be made to see of FLAG_ISOLATE is set
15492  *		   in the pkt. If FLAG_ISOLATE is set, then the command is
15493  *		   not retried, it is simply failed.
15494  *
15495  *		user_funcp - Ptr to function to call before dispatching the
15496  *		   command. May be NULL if no action needs to be performed.
15497  *		   (Primarily intended for printing messages.)
15498  *
15499  *		user_arg - Optional argument to be passed along to
15500  *		   the user_funcp call.
15501  *
15502  *		failure_code - errno return code to set in the bp if the
15503  *		   command is going to be failed.
15504  *
15505  *		retry_delay - Retry delay interval in (clock_t) units. May
15506  *		   be zero which indicates that the retry should be retried
15507  *		   immediately (ie, without an intervening delay).
15508  *
15509  *		statp - Ptr to kstat function to be updated if the command
15510  *		   is queued for a delayed retry. May be NULL if no kstat
15511  *		   update is desired.
15512  *
15513  *     Context: May be called from interrupt context.
15514  */
15515 
15516 static void
15517 sd_retry_command(struct sd_lun *un, struct buf *bp, int retry_check_flag,
15518 	void (*user_funcp)(struct sd_lun *un, struct buf *bp, void *argp, int
15519 	code), void *user_arg, int failure_code,  clock_t retry_delay,
15520 	void (*statp)(kstat_io_t *))
15521 {
15522 	struct sd_xbuf	*xp;
15523 	struct scsi_pkt	*pktp;
15524 	struct sd_fm_internal *sfip;
15525 
15526 	ASSERT(un != NULL);
15527 	ASSERT(mutex_owned(SD_MUTEX(un)));
15528 	ASSERT(bp != NULL);
15529 	xp = SD_GET_XBUF(bp);
15530 	ASSERT(xp != NULL);
15531 	pktp = SD_GET_PKTP(bp);
15532 	ASSERT(pktp != NULL);
15533 
15534 	sfip = (struct sd_fm_internal *)un->un_fm_private;
15535 	ASSERT(sfip != NULL);
15536 
15537 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
15538 	    "sd_retry_command: entry: bp:0x%p xp:0x%p\n", bp, xp);
15539 
15540 	/*
15541 	 * If we are syncing or dumping, fail the command to avoid
15542 	 * recursively calling back into scsi_transport().
15543 	 */
15544 	if (ddi_in_panic()) {
15545 		goto fail_command_no_log;
15546 	}
15547 
15548 	/*
15549 	 * We should never be be retrying a command with FLAG_DIAGNOSE set, so
15550 	 * log an error and fail the command.
15551 	 */
15552 	if ((pktp->pkt_flags & FLAG_DIAGNOSE) != 0) {
15553 		scsi_log(SD_DEVINFO(un), sd_label, CE_NOTE,
15554 		    "ERROR, retrying FLAG_DIAGNOSE command.\n");
15555 		sd_dump_memory(un, SD_LOG_IO, "CDB",
15556 		    (uchar_t *)pktp->pkt_cdbp, CDB_SIZE, SD_LOG_HEX);
15557 		sd_dump_memory(un, SD_LOG_IO, "Sense Data",
15558 		    (uchar_t *)xp->xb_sense_data, SENSE_LENGTH, SD_LOG_HEX);
15559 		goto fail_command;
15560 	}
15561 
15562 	/*
15563 	 * If we are suspended, then put the command onto head of the
15564 	 * wait queue since we don't want to start more commands, and
15565 	 * clear the un_retry_bp. Next time when we are resumed, will
15566 	 * handle the command in the wait queue.
15567 	 */
15568 	switch (un->un_state) {
15569 	case SD_STATE_SUSPENDED:
15570 	case SD_STATE_DUMPING:
15571 		bp->av_forw = un->un_waitq_headp;
15572 		un->un_waitq_headp = bp;
15573 		if (un->un_waitq_tailp == NULL) {
15574 			un->un_waitq_tailp = bp;
15575 		}
15576 		if (bp == un->un_retry_bp) {
15577 			un->un_retry_bp = NULL;
15578 			un->un_retry_statp = NULL;
15579 		}
15580 		SD_UPDATE_KSTATS(un, kstat_waitq_enter, bp);
15581 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_retry_command: "
15582 		    "exiting; cmd bp:0x%p requeued for SUSPEND/DUMP\n", bp);
15583 		return;
15584 	default:
15585 		break;
15586 	}
15587 
15588 	/*
15589 	 * If the caller wants us to check FLAG_ISOLATE, then see if that
15590 	 * is set; if it is then we do not want to retry the command.
15591 	 * Normally, FLAG_ISOLATE is only used with USCSI cmds.
15592 	 */
15593 	if ((retry_check_flag & SD_RETRIES_ISOLATE) != 0) {
15594 		if ((pktp->pkt_flags & FLAG_ISOLATE) != 0) {
15595 			goto fail_command;
15596 		}
15597 	}
15598 
15599 
15600 	/*
15601 	 * If SD_RETRIES_FAILFAST is set, it indicates that either a
15602 	 * command timeout or a selection timeout has occurred. This means
15603 	 * that we were unable to establish an kind of communication with
15604 	 * the target, and subsequent retries and/or commands are likely
15605 	 * to encounter similar results and take a long time to complete.
15606 	 *
15607 	 * If this is a failfast error condition, we need to update the
15608 	 * failfast state, even if this bp does not have B_FAILFAST set.
15609 	 */
15610 	if (retry_check_flag & SD_RETRIES_FAILFAST) {
15611 		if (un->un_failfast_state == SD_FAILFAST_ACTIVE) {
15612 			ASSERT(un->un_failfast_bp == NULL);
15613 			/*
15614 			 * If we are already in the active failfast state, and
15615 			 * another failfast error condition has been detected,
15616 			 * then fail this command if it has B_FAILFAST set.
15617 			 * If B_FAILFAST is clear, then maintain the legacy
15618 			 * behavior of retrying heroically, even tho this will
15619 			 * take a lot more time to fail the command.
15620 			 */
15621 			if (bp->b_flags & B_FAILFAST) {
15622 				goto fail_command;
15623 			}
15624 		} else {
15625 			/*
15626 			 * We're not in the active failfast state, but we
15627 			 * have a failfast error condition, so we must begin
15628 			 * transition to the next state. We do this regardless
15629 			 * of whether or not this bp has B_FAILFAST set.
15630 			 */
15631 			if (un->un_failfast_bp == NULL) {
15632 				/*
15633 				 * This is the first bp to meet a failfast
15634 				 * condition so save it on un_failfast_bp &
15635 				 * do normal retry processing. Do not enter
15636 				 * active failfast state yet. This marks
15637 				 * entry into the "failfast pending" state.
15638 				 */
15639 				un->un_failfast_bp = bp;
15640 
15641 			} else if (un->un_failfast_bp == bp) {
15642 				/*
15643 				 * This is the second time *this* bp has
15644 				 * encountered a failfast error condition,
15645 				 * so enter active failfast state & flush
15646 				 * queues as appropriate.
15647 				 */
15648 				un->un_failfast_state = SD_FAILFAST_ACTIVE;
15649 				un->un_failfast_bp = NULL;
15650 				sd_failfast_flushq(un);
15651 
15652 				/*
15653 				 * Fail this bp now if B_FAILFAST set;
15654 				 * otherwise continue with retries. (It would
15655 				 * be pretty ironic if this bp succeeded on a
15656 				 * subsequent retry after we just flushed all
15657 				 * the queues).
15658 				 */
15659 				if (bp->b_flags & B_FAILFAST) {
15660 					goto fail_command;
15661 				}
15662 
15663 #if !defined(lint) && !defined(__lint)
15664 			} else {
15665 				/*
15666 				 * If neither of the preceeding conditionals
15667 				 * was true, it means that there is some
15668 				 * *other* bp that has met an inital failfast
15669 				 * condition and is currently either being
15670 				 * retried or is waiting to be retried. In
15671 				 * that case we should perform normal retry
15672 				 * processing on *this* bp, since there is a
15673 				 * chance that the current failfast condition
15674 				 * is transient and recoverable. If that does
15675 				 * not turn out to be the case, then retries
15676 				 * will be cleared when the wait queue is
15677 				 * flushed anyway.
15678 				 */
15679 #endif
15680 			}
15681 		}
15682 	} else {
15683 		/*
15684 		 * SD_RETRIES_FAILFAST is clear, which indicates that we
15685 		 * likely were able to at least establish some level of
15686 		 * communication with the target and subsequent commands
15687 		 * and/or retries are likely to get through to the target,
15688 		 * In this case we want to be aggressive about clearing
15689 		 * the failfast state. Note that this does not affect
15690 		 * the "failfast pending" condition.
15691 		 */
15692 		un->un_failfast_state = SD_FAILFAST_INACTIVE;
15693 	}
15694 
15695 
15696 	/*
15697 	 * Check the specified retry count to see if we can still do
15698 	 * any retries with this pkt before we should fail it.
15699 	 */
15700 	switch (retry_check_flag & SD_RETRIES_MASK) {
15701 	case SD_RETRIES_VICTIM:
15702 		/*
15703 		 * Check the victim retry count. If exhausted, then fall
15704 		 * thru & check against the standard retry count.
15705 		 */
15706 		if (xp->xb_victim_retry_count < un->un_victim_retry_count) {
15707 			/* Increment count & proceed with the retry */
15708 			xp->xb_victim_retry_count++;
15709 			break;
15710 		}
15711 		/* Victim retries exhausted, fall back to std. retries... */
15712 		/* FALLTHRU */
15713 
15714 	case SD_RETRIES_STANDARD:
15715 		if (xp->xb_retry_count >= un->un_retry_count) {
15716 			/* Retries exhausted, fail the command */
15717 			SD_TRACE(SD_LOG_IO_CORE, un,
15718 			    "sd_retry_command: retries exhausted!\n");
15719 			/*
15720 			 * update b_resid for failed SCMD_READ & SCMD_WRITE
15721 			 * commands with nonzero pkt_resid.
15722 			 */
15723 			if ((pktp->pkt_reason == CMD_CMPLT) &&
15724 			    (SD_GET_PKT_STATUS(pktp) == STATUS_GOOD) &&
15725 			    (pktp->pkt_resid != 0)) {
15726 				uchar_t op = SD_GET_PKT_OPCODE(pktp) & 0x1F;
15727 				if ((op == SCMD_READ) || (op == SCMD_WRITE)) {
15728 					SD_UPDATE_B_RESID(bp, pktp);
15729 				}
15730 			}
15731 			goto fail_command;
15732 		}
15733 		xp->xb_retry_count++;
15734 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15735 		    "sd_retry_command: retry count:%d\n", xp->xb_retry_count);
15736 		break;
15737 
15738 	case SD_RETRIES_UA:
15739 		if (xp->xb_ua_retry_count >= sd_ua_retry_count) {
15740 			/* Retries exhausted, fail the command */
15741 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
15742 			    "Unit Attention retries exhausted. "
15743 			    "Check the target.\n");
15744 			goto fail_command;
15745 		}
15746 		xp->xb_ua_retry_count++;
15747 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15748 		    "sd_retry_command: retry count:%d\n",
15749 		    xp->xb_ua_retry_count);
15750 		break;
15751 
15752 	case SD_RETRIES_BUSY:
15753 		if (xp->xb_retry_count >= un->un_busy_retry_count) {
15754 			/* Retries exhausted, fail the command */
15755 			SD_TRACE(SD_LOG_IO_CORE, un,
15756 			    "sd_retry_command: retries exhausted!\n");
15757 			goto fail_command;
15758 		}
15759 		xp->xb_retry_count++;
15760 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15761 		    "sd_retry_command: retry count:%d\n", xp->xb_retry_count);
15762 		break;
15763 
15764 	case SD_RETRIES_NOCHECK:
15765 	default:
15766 		/* No retry count to check. Just proceed with the retry */
15767 		break;
15768 	}
15769 
15770 	xp->xb_pktp->pkt_flags |= FLAG_HEAD;
15771 
15772 	/*
15773 	 * If this is a non-USCSI command being retried
15774 	 * during execution last time, we should post an ereport with
15775 	 * driver-assessment of the value "retry".
15776 	 * For partial DMA, request sense and STATUS_QFULL, there are no
15777 	 * hardware errors, we bypass ereport posting.
15778 	 */
15779 	if (failure_code != 0) {
15780 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
15781 			sd_ssc_extract_info(&sfip->fm_ssc, un, pktp, bp, xp);
15782 			sd_ssc_post(&sfip->fm_ssc, SD_FM_DRV_RETRY);
15783 		}
15784 	}
15785 
15786 	/*
15787 	 * If we were given a zero timeout, we must attempt to retry the
15788 	 * command immediately (ie, without a delay).
15789 	 */
15790 	if (retry_delay == 0) {
15791 		/*
15792 		 * Check some limiting conditions to see if we can actually
15793 		 * do the immediate retry.  If we cannot, then we must
15794 		 * fall back to queueing up a delayed retry.
15795 		 */
15796 		if (un->un_ncmds_in_transport >= un->un_throttle) {
15797 			/*
15798 			 * We are at the throttle limit for the target,
15799 			 * fall back to delayed retry.
15800 			 */
15801 			retry_delay = un->un_busy_timeout;
15802 			statp = kstat_waitq_enter;
15803 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15804 			    "sd_retry_command: immed. retry hit "
15805 			    "throttle!\n");
15806 		} else {
15807 			/*
15808 			 * We're clear to proceed with the immediate retry.
15809 			 * First call the user-provided function (if any)
15810 			 */
15811 			if (user_funcp != NULL) {
15812 				(*user_funcp)(un, bp, user_arg,
15813 				    SD_IMMEDIATE_RETRY_ISSUED);
15814 #ifdef __lock_lint
15815 				sd_print_incomplete_msg(un, bp, user_arg,
15816 				    SD_IMMEDIATE_RETRY_ISSUED);
15817 				sd_print_cmd_incomplete_msg(un, bp, user_arg,
15818 				    SD_IMMEDIATE_RETRY_ISSUED);
15819 				sd_print_sense_failed_msg(un, bp, user_arg,
15820 				    SD_IMMEDIATE_RETRY_ISSUED);
15821 #endif
15822 			}
15823 
15824 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15825 			    "sd_retry_command: issuing immediate retry\n");
15826 
15827 			/*
15828 			 * Call sd_start_cmds() to transport the command to
15829 			 * the target.
15830 			 */
15831 			sd_start_cmds(un, bp);
15832 
15833 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15834 			    "sd_retry_command exit\n");
15835 			return;
15836 		}
15837 	}
15838 
15839 	/*
15840 	 * Set up to retry the command after a delay.
15841 	 * First call the user-provided function (if any)
15842 	 */
15843 	if (user_funcp != NULL) {
15844 		(*user_funcp)(un, bp, user_arg, SD_DELAYED_RETRY_ISSUED);
15845 	}
15846 
15847 	sd_set_retry_bp(un, bp, retry_delay, statp);
15848 
15849 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_retry_command: exit\n");
15850 	return;
15851 
15852 fail_command:
15853 
15854 	if (user_funcp != NULL) {
15855 		(*user_funcp)(un, bp, user_arg, SD_NO_RETRY_ISSUED);
15856 	}
15857 
15858 fail_command_no_log:
15859 
15860 	SD_INFO(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15861 	    "sd_retry_command: returning failed command\n");
15862 
15863 	sd_return_failed_command(un, bp, failure_code);
15864 
15865 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_retry_command: exit\n");
15866 }
15867 
15868 
15869 /*
15870  *    Function: sd_set_retry_bp
15871  *
15872  * Description: Set up the given bp for retry.
15873  *
15874  *   Arguments: un - ptr to associated softstate
15875  *		bp - ptr to buf(9S) for the command
15876  *		retry_delay - time interval before issuing retry (may be 0)
15877  *		statp - optional pointer to kstat function
15878  *
15879  *     Context: May be called under interrupt context
15880  */
15881 
15882 static void
15883 sd_set_retry_bp(struct sd_lun *un, struct buf *bp, clock_t retry_delay,
15884 	void (*statp)(kstat_io_t *))
15885 {
15886 	ASSERT(un != NULL);
15887 	ASSERT(mutex_owned(SD_MUTEX(un)));
15888 	ASSERT(bp != NULL);
15889 
15890 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
15891 	    "sd_set_retry_bp: entry: un:0x%p bp:0x%p\n", un, bp);
15892 
15893 	/*
15894 	 * Indicate that the command is being retried. This will not allow any
15895 	 * other commands on the wait queue to be transported to the target
15896 	 * until this command has been completed (success or failure). The
15897 	 * "retry command" is not transported to the target until the given
15898 	 * time delay expires, unless the user specified a 0 retry_delay.
15899 	 *
15900 	 * Note: the timeout(9F) callback routine is what actually calls
15901 	 * sd_start_cmds() to transport the command, with the exception of a
15902 	 * zero retry_delay. The only current implementor of a zero retry delay
15903 	 * is the case where a START_STOP_UNIT is sent to spin-up a device.
15904 	 */
15905 	if (un->un_retry_bp == NULL) {
15906 		ASSERT(un->un_retry_statp == NULL);
15907 		un->un_retry_bp = bp;
15908 
15909 		/*
15910 		 * If the user has not specified a delay the command should
15911 		 * be queued and no timeout should be scheduled.
15912 		 */
15913 		if (retry_delay == 0) {
15914 			/*
15915 			 * Save the kstat pointer that will be used in the
15916 			 * call to SD_UPDATE_KSTATS() below, so that
15917 			 * sd_start_cmds() can correctly decrement the waitq
15918 			 * count when it is time to transport this command.
15919 			 */
15920 			un->un_retry_statp = statp;
15921 			goto done;
15922 		}
15923 	}
15924 
15925 	if (un->un_retry_bp == bp) {
15926 		/*
15927 		 * Save the kstat pointer that will be used in the call to
15928 		 * SD_UPDATE_KSTATS() below, so that sd_start_cmds() can
15929 		 * correctly decrement the waitq count when it is time to
15930 		 * transport this command.
15931 		 */
15932 		un->un_retry_statp = statp;
15933 
15934 		/*
15935 		 * Schedule a timeout if:
15936 		 *   1) The user has specified a delay.
15937 		 *   2) There is not a START_STOP_UNIT callback pending.
15938 		 *
15939 		 * If no delay has been specified, then it is up to the caller
15940 		 * to ensure that IO processing continues without stalling.
15941 		 * Effectively, this means that the caller will issue the
15942 		 * required call to sd_start_cmds(). The START_STOP_UNIT
15943 		 * callback does this after the START STOP UNIT command has
15944 		 * completed. In either of these cases we should not schedule
15945 		 * a timeout callback here.  Also don't schedule the timeout if
15946 		 * an SD_PATH_DIRECT_PRIORITY command is waiting to restart.
15947 		 */
15948 		if ((retry_delay != 0) && (un->un_startstop_timeid == NULL) &&
15949 		    (un->un_direct_priority_timeid == NULL)) {
15950 			un->un_retry_timeid =
15951 			    timeout(sd_start_retry_command, un, retry_delay);
15952 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15953 			    "sd_set_retry_bp: setting timeout: un: 0x%p"
15954 			    " bp:0x%p un_retry_timeid:0x%p\n",
15955 			    un, bp, un->un_retry_timeid);
15956 		}
15957 	} else {
15958 		/*
15959 		 * We only get in here if there is already another command
15960 		 * waiting to be retried.  In this case, we just put the
15961 		 * given command onto the wait queue, so it can be transported
15962 		 * after the current retry command has completed.
15963 		 *
15964 		 * Also we have to make sure that if the command at the head
15965 		 * of the wait queue is the un_failfast_bp, that we do not
15966 		 * put ahead of it any other commands that are to be retried.
15967 		 */
15968 		if ((un->un_failfast_bp != NULL) &&
15969 		    (un->un_failfast_bp == un->un_waitq_headp)) {
15970 			/*
15971 			 * Enqueue this command AFTER the first command on
15972 			 * the wait queue (which is also un_failfast_bp).
15973 			 */
15974 			bp->av_forw = un->un_waitq_headp->av_forw;
15975 			un->un_waitq_headp->av_forw = bp;
15976 			if (un->un_waitq_headp == un->un_waitq_tailp) {
15977 				un->un_waitq_tailp = bp;
15978 			}
15979 		} else {
15980 			/* Enqueue this command at the head of the waitq. */
15981 			bp->av_forw = un->un_waitq_headp;
15982 			un->un_waitq_headp = bp;
15983 			if (un->un_waitq_tailp == NULL) {
15984 				un->un_waitq_tailp = bp;
15985 			}
15986 		}
15987 
15988 		if (statp == NULL) {
15989 			statp = kstat_waitq_enter;
15990 		}
15991 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
15992 		    "sd_set_retry_bp: un:0x%p already delayed retry\n", un);
15993 	}
15994 
15995 done:
15996 	if (statp != NULL) {
15997 		SD_UPDATE_KSTATS(un, statp, bp);
15998 	}
15999 
16000 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16001 	    "sd_set_retry_bp: exit un:0x%p\n", un);
16002 }
16003 
16004 
16005 /*
16006  *    Function: sd_start_retry_command
16007  *
16008  * Description: Start the command that has been waiting on the target's
16009  *		retry queue.  Called from timeout(9F) context after the
16010  *		retry delay interval has expired.
16011  *
16012  *   Arguments: arg - pointer to associated softstate for the device.
16013  *
16014  *     Context: timeout(9F) thread context.  May not sleep.
16015  */
16016 
16017 static void
16018 sd_start_retry_command(void *arg)
16019 {
16020 	struct sd_lun *un = arg;
16021 
16022 	ASSERT(un != NULL);
16023 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16024 
16025 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16026 	    "sd_start_retry_command: entry\n");
16027 
16028 	mutex_enter(SD_MUTEX(un));
16029 
16030 	un->un_retry_timeid = NULL;
16031 
16032 	if (un->un_retry_bp != NULL) {
16033 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16034 		    "sd_start_retry_command: un:0x%p STARTING bp:0x%p\n",
16035 		    un, un->un_retry_bp);
16036 		sd_start_cmds(un, un->un_retry_bp);
16037 	}
16038 
16039 	mutex_exit(SD_MUTEX(un));
16040 
16041 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16042 	    "sd_start_retry_command: exit\n");
16043 }
16044 
16045 /*
16046  *    Function: sd_rmw_msg_print_handler
16047  *
16048  * Description: If RMW mode is enabled and warning message is triggered
16049  *              print I/O count during a fixed interval.
16050  *
16051  *   Arguments: arg - pointer to associated softstate for the device.
16052  *
16053  *     Context: timeout(9F) thread context. May not sleep.
16054  */
16055 static void
16056 sd_rmw_msg_print_handler(void *arg)
16057 {
16058 	struct sd_lun *un = arg;
16059 
16060 	ASSERT(un != NULL);
16061 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16062 
16063 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16064 	    "sd_rmw_msg_print_handler: entry\n");
16065 
16066 	mutex_enter(SD_MUTEX(un));
16067 
16068 	if (un->un_rmw_incre_count > 0) {
16069 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
16070 		    "%"PRIu64" I/O requests are not aligned with %d disk "
16071 		    "sector size in %ld seconds. They are handled through "
16072 		    "Read Modify Write but the performance is very low!\n",
16073 		    un->un_rmw_incre_count, un->un_tgt_blocksize,
16074 		    drv_hztousec(SD_RMW_MSG_PRINT_TIMEOUT) / 1000000);
16075 		un->un_rmw_incre_count = 0;
16076 		un->un_rmw_msg_timeid = timeout(sd_rmw_msg_print_handler,
16077 		    un, SD_RMW_MSG_PRINT_TIMEOUT);
16078 	} else {
16079 		un->un_rmw_msg_timeid = NULL;
16080 	}
16081 
16082 	mutex_exit(SD_MUTEX(un));
16083 
16084 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16085 	    "sd_rmw_msg_print_handler: exit\n");
16086 }
16087 
16088 /*
16089  *    Function: sd_start_direct_priority_command
16090  *
16091  * Description: Used to re-start an SD_PATH_DIRECT_PRIORITY command that had
16092  *		received TRAN_BUSY when we called scsi_transport() to send it
16093  *		to the underlying HBA. This function is called from timeout(9F)
16094  *		context after the delay interval has expired.
16095  *
16096  *   Arguments: arg - pointer to associated buf(9S) to be restarted.
16097  *
16098  *     Context: timeout(9F) thread context.  May not sleep.
16099  */
16100 
16101 static void
16102 sd_start_direct_priority_command(void *arg)
16103 {
16104 	struct buf	*priority_bp = arg;
16105 	struct sd_lun	*un;
16106 
16107 	ASSERT(priority_bp != NULL);
16108 	un = SD_GET_UN(priority_bp);
16109 	ASSERT(un != NULL);
16110 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16111 
16112 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16113 	    "sd_start_direct_priority_command: entry\n");
16114 
16115 	mutex_enter(SD_MUTEX(un));
16116 	un->un_direct_priority_timeid = NULL;
16117 	sd_start_cmds(un, priority_bp);
16118 	mutex_exit(SD_MUTEX(un));
16119 
16120 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16121 	    "sd_start_direct_priority_command: exit\n");
16122 }
16123 
16124 
16125 /*
16126  *    Function: sd_send_request_sense_command
16127  *
16128  * Description: Sends a REQUEST SENSE command to the target
16129  *
16130  *     Context: May be called from interrupt context.
16131  */
16132 
16133 static void
16134 sd_send_request_sense_command(struct sd_lun *un, struct buf *bp,
16135 	struct scsi_pkt *pktp)
16136 {
16137 	ASSERT(bp != NULL);
16138 	ASSERT(un != NULL);
16139 	ASSERT(mutex_owned(SD_MUTEX(un)));
16140 
16141 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sd_send_request_sense_command: "
16142 	    "entry: buf:0x%p\n", bp);
16143 
16144 	/*
16145 	 * If we are syncing or dumping, then fail the command to avoid a
16146 	 * recursive callback into scsi_transport(). Also fail the command
16147 	 * if we are suspended (legacy behavior).
16148 	 */
16149 	if (ddi_in_panic() || (un->un_state == SD_STATE_SUSPENDED) ||
16150 	    (un->un_state == SD_STATE_DUMPING)) {
16151 		sd_return_failed_command(un, bp, EIO);
16152 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16153 		    "sd_send_request_sense_command: syncing/dumping, exit\n");
16154 		return;
16155 	}
16156 
16157 	/*
16158 	 * Retry the failed command and don't issue the request sense if:
16159 	 *    1) the sense buf is busy
16160 	 *    2) we have 1 or more outstanding commands on the target
16161 	 *    (the sense data will be cleared or invalidated any way)
16162 	 *
16163 	 * Note: There could be an issue with not checking a retry limit here,
16164 	 * the problem is determining which retry limit to check.
16165 	 */
16166 	if ((un->un_sense_isbusy != 0) || (un->un_ncmds_in_transport > 0)) {
16167 		/* Don't retry if the command is flagged as non-retryable */
16168 		if ((pktp->pkt_flags & FLAG_DIAGNOSE) == 0) {
16169 			sd_retry_command(un, bp, SD_RETRIES_NOCHECK,
16170 			    NULL, NULL, 0, un->un_busy_timeout,
16171 			    kstat_waitq_enter);
16172 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16173 			    "sd_send_request_sense_command: "
16174 			    "at full throttle, retrying exit\n");
16175 		} else {
16176 			sd_return_failed_command(un, bp, EIO);
16177 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16178 			    "sd_send_request_sense_command: "
16179 			    "at full throttle, non-retryable exit\n");
16180 		}
16181 		return;
16182 	}
16183 
16184 	sd_mark_rqs_busy(un, bp);
16185 	sd_start_cmds(un, un->un_rqs_bp);
16186 
16187 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16188 	    "sd_send_request_sense_command: exit\n");
16189 }
16190 
16191 
16192 /*
16193  *    Function: sd_mark_rqs_busy
16194  *
16195  * Description: Indicate that the request sense bp for this instance is
16196  *		in use.
16197  *
16198  *     Context: May be called under interrupt context
16199  */
16200 
16201 static void
16202 sd_mark_rqs_busy(struct sd_lun *un, struct buf *bp)
16203 {
16204 	struct sd_xbuf	*sense_xp;
16205 
16206 	ASSERT(un != NULL);
16207 	ASSERT(bp != NULL);
16208 	ASSERT(mutex_owned(SD_MUTEX(un)));
16209 	ASSERT(un->un_sense_isbusy == 0);
16210 
16211 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_mark_rqs_busy: entry: "
16212 	    "buf:0x%p xp:0x%p un:0x%p\n", bp, SD_GET_XBUF(bp), un);
16213 
16214 	sense_xp = SD_GET_XBUF(un->un_rqs_bp);
16215 	ASSERT(sense_xp != NULL);
16216 
16217 	SD_INFO(SD_LOG_IO, un,
16218 	    "sd_mark_rqs_busy: entry: sense_xp:0x%p\n", sense_xp);
16219 
16220 	ASSERT(sense_xp->xb_pktp != NULL);
16221 	ASSERT((sense_xp->xb_pktp->pkt_flags & (FLAG_SENSING | FLAG_HEAD))
16222 	    == (FLAG_SENSING | FLAG_HEAD));
16223 
16224 	un->un_sense_isbusy = 1;
16225 	un->un_rqs_bp->b_resid = 0;
16226 	sense_xp->xb_pktp->pkt_resid  = 0;
16227 	sense_xp->xb_pktp->pkt_reason = 0;
16228 
16229 	/* So we can get back the bp at interrupt time! */
16230 	sense_xp->xb_sense_bp = bp;
16231 
16232 	bzero(un->un_rqs_bp->b_un.b_addr, SENSE_LENGTH);
16233 
16234 	/*
16235 	 * Mark this buf as awaiting sense data. (This is already set in
16236 	 * the pkt_flags for the RQS packet.)
16237 	 */
16238 	((SD_GET_XBUF(bp))->xb_pktp)->pkt_flags |= FLAG_SENSING;
16239 
16240 	/* Request sense down same path */
16241 	if (scsi_pkt_allocated_correctly((SD_GET_XBUF(bp))->xb_pktp) &&
16242 	    ((SD_GET_XBUF(bp))->xb_pktp)->pkt_path_instance)
16243 		sense_xp->xb_pktp->pkt_path_instance =
16244 		    ((SD_GET_XBUF(bp))->xb_pktp)->pkt_path_instance;
16245 
16246 	sense_xp->xb_retry_count	= 0;
16247 	sense_xp->xb_victim_retry_count = 0;
16248 	sense_xp->xb_ua_retry_count	= 0;
16249 	sense_xp->xb_nr_retry_count 	= 0;
16250 	sense_xp->xb_dma_resid  = 0;
16251 
16252 	/* Clean up the fields for auto-request sense */
16253 	sense_xp->xb_sense_status = 0;
16254 	sense_xp->xb_sense_state  = 0;
16255 	sense_xp->xb_sense_resid  = 0;
16256 	bzero(sense_xp->xb_sense_data, sizeof (sense_xp->xb_sense_data));
16257 
16258 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_mark_rqs_busy: exit\n");
16259 }
16260 
16261 
16262 /*
16263  *    Function: sd_mark_rqs_idle
16264  *
16265  * Description: SD_MUTEX must be held continuously through this routine
16266  *		to prevent reuse of the rqs struct before the caller can
16267  *		complete it's processing.
16268  *
16269  * Return Code: Pointer to the RQS buf
16270  *
16271  *     Context: May be called under interrupt context
16272  */
16273 
16274 static struct buf *
16275 sd_mark_rqs_idle(struct sd_lun *un, struct sd_xbuf *sense_xp)
16276 {
16277 	struct buf *bp;
16278 	ASSERT(un != NULL);
16279 	ASSERT(sense_xp != NULL);
16280 	ASSERT(mutex_owned(SD_MUTEX(un)));
16281 	ASSERT(un->un_sense_isbusy != 0);
16282 
16283 	un->un_sense_isbusy = 0;
16284 	bp = sense_xp->xb_sense_bp;
16285 	sense_xp->xb_sense_bp = NULL;
16286 
16287 	/* This pkt is no longer interested in getting sense data */
16288 	((SD_GET_XBUF(bp))->xb_pktp)->pkt_flags &= ~FLAG_SENSING;
16289 
16290 	return (bp);
16291 }
16292 
16293 
16294 
16295 /*
16296  *    Function: sd_alloc_rqs
16297  *
16298  * Description: Set up the unit to receive auto request sense data
16299  *
16300  * Return Code: DDI_SUCCESS or DDI_FAILURE
16301  *
16302  *     Context: Called under attach(9E) context
16303  */
16304 
16305 static int
16306 sd_alloc_rqs(struct scsi_device *devp, struct sd_lun *un)
16307 {
16308 	struct sd_xbuf *xp;
16309 
16310 	ASSERT(un != NULL);
16311 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16312 	ASSERT(un->un_rqs_bp == NULL);
16313 	ASSERT(un->un_rqs_pktp == NULL);
16314 
16315 	/*
16316 	 * First allocate the required buf and scsi_pkt structs, then set up
16317 	 * the CDB in the scsi_pkt for a REQUEST SENSE command.
16318 	 */
16319 	un->un_rqs_bp = scsi_alloc_consistent_buf(&devp->sd_address, NULL,
16320 	    MAX_SENSE_LENGTH, B_READ, SLEEP_FUNC, NULL);
16321 	if (un->un_rqs_bp == NULL) {
16322 		return (DDI_FAILURE);
16323 	}
16324 
16325 	un->un_rqs_pktp = scsi_init_pkt(&devp->sd_address, NULL, un->un_rqs_bp,
16326 	    CDB_GROUP0, 1, 0, PKT_CONSISTENT, SLEEP_FUNC, NULL);
16327 
16328 	if (un->un_rqs_pktp == NULL) {
16329 		sd_free_rqs(un);
16330 		return (DDI_FAILURE);
16331 	}
16332 
16333 	/* Set up the CDB in the scsi_pkt for a REQUEST SENSE command. */
16334 	(void) scsi_setup_cdb((union scsi_cdb *)un->un_rqs_pktp->pkt_cdbp,
16335 	    SCMD_REQUEST_SENSE, 0, MAX_SENSE_LENGTH, 0);
16336 
16337 	SD_FILL_SCSI1_LUN(un, un->un_rqs_pktp);
16338 
16339 	/* Set up the other needed members in the ARQ scsi_pkt. */
16340 	un->un_rqs_pktp->pkt_comp   = sdintr;
16341 	un->un_rqs_pktp->pkt_time   = sd_io_time;
16342 	un->un_rqs_pktp->pkt_flags |=
16343 	    (FLAG_SENSING | FLAG_HEAD);	/* (1222170) */
16344 
16345 	/*
16346 	 * Allocate  & init the sd_xbuf struct for the RQS command. Do not
16347 	 * provide any intpkt, destroypkt routines as we take care of
16348 	 * scsi_pkt allocation/freeing here and in sd_free_rqs().
16349 	 */
16350 	xp = kmem_alloc(sizeof (struct sd_xbuf), KM_SLEEP);
16351 	sd_xbuf_init(un, un->un_rqs_bp, xp, SD_CHAIN_NULL, NULL);
16352 	xp->xb_pktp = un->un_rqs_pktp;
16353 	SD_INFO(SD_LOG_ATTACH_DETACH, un,
16354 	    "sd_alloc_rqs: un 0x%p, rqs  xp 0x%p,  pkt 0x%p,  buf 0x%p\n",
16355 	    un, xp, un->un_rqs_pktp, un->un_rqs_bp);
16356 
16357 	/*
16358 	 * Save the pointer to the request sense private bp so it can
16359 	 * be retrieved in sdintr.
16360 	 */
16361 	un->un_rqs_pktp->pkt_private = un->un_rqs_bp;
16362 	ASSERT(un->un_rqs_bp->b_private == xp);
16363 
16364 	/*
16365 	 * See if the HBA supports auto-request sense for the specified
16366 	 * target/lun. If it does, then try to enable it (if not already
16367 	 * enabled).
16368 	 *
16369 	 * Note: For some HBAs (ifp & sf), scsi_ifsetcap will always return
16370 	 * failure, while for other HBAs (pln) scsi_ifsetcap will always
16371 	 * return success.  However, in both of these cases ARQ is always
16372 	 * enabled and scsi_ifgetcap will always return true. The best approach
16373 	 * is to issue the scsi_ifgetcap() first, then try the scsi_ifsetcap().
16374 	 *
16375 	 * The 3rd case is the HBA (adp) always return enabled on
16376 	 * scsi_ifgetgetcap even when it's not enable, the best approach
16377 	 * is issue a scsi_ifsetcap then a scsi_ifgetcap
16378 	 * Note: this case is to circumvent the Adaptec bug. (x86 only)
16379 	 */
16380 
16381 	if (un->un_f_is_fibre == TRUE) {
16382 		un->un_f_arq_enabled = TRUE;
16383 	} else {
16384 #if defined(__i386) || defined(__amd64)
16385 		/*
16386 		 * Circumvent the Adaptec bug, remove this code when
16387 		 * the bug is fixed
16388 		 */
16389 		(void) scsi_ifsetcap(SD_ADDRESS(un), "auto-rqsense", 1, 1);
16390 #endif
16391 		switch (scsi_ifgetcap(SD_ADDRESS(un), "auto-rqsense", 1)) {
16392 		case 0:
16393 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
16394 			    "sd_alloc_rqs: HBA supports ARQ\n");
16395 			/*
16396 			 * ARQ is supported by this HBA but currently is not
16397 			 * enabled. Attempt to enable it and if successful then
16398 			 * mark this instance as ARQ enabled.
16399 			 */
16400 			if (scsi_ifsetcap(SD_ADDRESS(un), "auto-rqsense", 1, 1)
16401 			    == 1) {
16402 				/* Successfully enabled ARQ in the HBA */
16403 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
16404 				    "sd_alloc_rqs: ARQ enabled\n");
16405 				un->un_f_arq_enabled = TRUE;
16406 			} else {
16407 				/* Could not enable ARQ in the HBA */
16408 				SD_INFO(SD_LOG_ATTACH_DETACH, un,
16409 				    "sd_alloc_rqs: failed ARQ enable\n");
16410 				un->un_f_arq_enabled = FALSE;
16411 			}
16412 			break;
16413 		case 1:
16414 			/*
16415 			 * ARQ is supported by this HBA and is already enabled.
16416 			 * Just mark ARQ as enabled for this instance.
16417 			 */
16418 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
16419 			    "sd_alloc_rqs: ARQ already enabled\n");
16420 			un->un_f_arq_enabled = TRUE;
16421 			break;
16422 		default:
16423 			/*
16424 			 * ARQ is not supported by this HBA; disable it for this
16425 			 * instance.
16426 			 */
16427 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
16428 			    "sd_alloc_rqs: HBA does not support ARQ\n");
16429 			un->un_f_arq_enabled = FALSE;
16430 			break;
16431 		}
16432 	}
16433 
16434 	return (DDI_SUCCESS);
16435 }
16436 
16437 
16438 /*
16439  *    Function: sd_free_rqs
16440  *
16441  * Description: Cleanup for the pre-instance RQS command.
16442  *
16443  *     Context: Kernel thread context
16444  */
16445 
16446 static void
16447 sd_free_rqs(struct sd_lun *un)
16448 {
16449 	ASSERT(un != NULL);
16450 
16451 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_free_rqs: entry\n");
16452 
16453 	/*
16454 	 * If consistent memory is bound to a scsi_pkt, the pkt
16455 	 * has to be destroyed *before* freeing the consistent memory.
16456 	 * Don't change the sequence of this operations.
16457 	 * scsi_destroy_pkt() might access memory, which isn't allowed,
16458 	 * after it was freed in scsi_free_consistent_buf().
16459 	 */
16460 	if (un->un_rqs_pktp != NULL) {
16461 		scsi_destroy_pkt(un->un_rqs_pktp);
16462 		un->un_rqs_pktp = NULL;
16463 	}
16464 
16465 	if (un->un_rqs_bp != NULL) {
16466 		struct sd_xbuf *xp = SD_GET_XBUF(un->un_rqs_bp);
16467 		if (xp != NULL) {
16468 			kmem_free(xp, sizeof (struct sd_xbuf));
16469 		}
16470 		scsi_free_consistent_buf(un->un_rqs_bp);
16471 		un->un_rqs_bp = NULL;
16472 	}
16473 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_free_rqs: exit\n");
16474 }
16475 
16476 
16477 
16478 /*
16479  *    Function: sd_reduce_throttle
16480  *
16481  * Description: Reduces the maximum # of outstanding commands on a
16482  *		target to the current number of outstanding commands.
16483  *		Queues a tiemout(9F) callback to restore the limit
16484  *		after a specified interval has elapsed.
16485  *		Typically used when we get a TRAN_BUSY return code
16486  *		back from scsi_transport().
16487  *
16488  *   Arguments: un - ptr to the sd_lun softstate struct
16489  *		throttle_type: SD_THROTTLE_TRAN_BUSY or SD_THROTTLE_QFULL
16490  *
16491  *     Context: May be called from interrupt context
16492  */
16493 
16494 static void
16495 sd_reduce_throttle(struct sd_lun *un, int throttle_type)
16496 {
16497 	ASSERT(un != NULL);
16498 	ASSERT(mutex_owned(SD_MUTEX(un)));
16499 	ASSERT(un->un_ncmds_in_transport >= 0);
16500 
16501 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_reduce_throttle: "
16502 	    "entry: un:0x%p un_throttle:%d un_ncmds_in_transport:%d\n",
16503 	    un, un->un_throttle, un->un_ncmds_in_transport);
16504 
16505 	if (un->un_throttle > 1) {
16506 		if (un->un_f_use_adaptive_throttle == TRUE) {
16507 			switch (throttle_type) {
16508 			case SD_THROTTLE_TRAN_BUSY:
16509 				if (un->un_busy_throttle == 0) {
16510 					un->un_busy_throttle = un->un_throttle;
16511 				}
16512 				break;
16513 			case SD_THROTTLE_QFULL:
16514 				un->un_busy_throttle = 0;
16515 				break;
16516 			default:
16517 				ASSERT(FALSE);
16518 			}
16519 
16520 			if (un->un_ncmds_in_transport > 0) {
16521 				un->un_throttle = un->un_ncmds_in_transport;
16522 			}
16523 
16524 		} else {
16525 			if (un->un_ncmds_in_transport == 0) {
16526 				un->un_throttle = 1;
16527 			} else {
16528 				un->un_throttle = un->un_ncmds_in_transport;
16529 			}
16530 		}
16531 	}
16532 
16533 	/* Reschedule the timeout if none is currently active */
16534 	if (un->un_reset_throttle_timeid == NULL) {
16535 		un->un_reset_throttle_timeid = timeout(sd_restore_throttle,
16536 		    un, SD_THROTTLE_RESET_INTERVAL);
16537 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16538 		    "sd_reduce_throttle: timeout scheduled!\n");
16539 	}
16540 
16541 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_reduce_throttle: "
16542 	    "exit: un:0x%p un_throttle:%d\n", un, un->un_throttle);
16543 }
16544 
16545 
16546 
16547 /*
16548  *    Function: sd_restore_throttle
16549  *
16550  * Description: Callback function for timeout(9F).  Resets the current
16551  *		value of un->un_throttle to its default.
16552  *
16553  *   Arguments: arg - pointer to associated softstate for the device.
16554  *
16555  *     Context: May be called from interrupt context
16556  */
16557 
16558 static void
16559 sd_restore_throttle(void *arg)
16560 {
16561 	struct sd_lun	*un = arg;
16562 
16563 	ASSERT(un != NULL);
16564 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16565 
16566 	mutex_enter(SD_MUTEX(un));
16567 
16568 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sd_restore_throttle: "
16569 	    "entry: un:0x%p un_throttle:%d\n", un, un->un_throttle);
16570 
16571 	un->un_reset_throttle_timeid = NULL;
16572 
16573 	if (un->un_f_use_adaptive_throttle == TRUE) {
16574 		/*
16575 		 * If un_busy_throttle is nonzero, then it contains the
16576 		 * value that un_throttle was when we got a TRAN_BUSY back
16577 		 * from scsi_transport(). We want to revert back to this
16578 		 * value.
16579 		 *
16580 		 * In the QFULL case, the throttle limit will incrementally
16581 		 * increase until it reaches max throttle.
16582 		 */
16583 		if (un->un_busy_throttle > 0) {
16584 			un->un_throttle = un->un_busy_throttle;
16585 			un->un_busy_throttle = 0;
16586 		} else {
16587 			/*
16588 			 * increase throttle by 10% open gate slowly, schedule
16589 			 * another restore if saved throttle has not been
16590 			 * reached
16591 			 */
16592 			short throttle;
16593 			if (sd_qfull_throttle_enable) {
16594 				throttle = un->un_throttle +
16595 				    max((un->un_throttle / 10), 1);
16596 				un->un_throttle =
16597 				    (throttle < un->un_saved_throttle) ?
16598 				    throttle : un->un_saved_throttle;
16599 				if (un->un_throttle < un->un_saved_throttle) {
16600 					un->un_reset_throttle_timeid =
16601 					    timeout(sd_restore_throttle,
16602 					    un,
16603 					    SD_QFULL_THROTTLE_RESET_INTERVAL);
16604 				}
16605 			}
16606 		}
16607 
16608 		/*
16609 		 * If un_throttle has fallen below the low-water mark, we
16610 		 * restore the maximum value here (and allow it to ratchet
16611 		 * down again if necessary).
16612 		 */
16613 		if (un->un_throttle < un->un_min_throttle) {
16614 			un->un_throttle = un->un_saved_throttle;
16615 		}
16616 	} else {
16617 		SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sd_restore_throttle: "
16618 		    "restoring limit from 0x%x to 0x%x\n",
16619 		    un->un_throttle, un->un_saved_throttle);
16620 		un->un_throttle = un->un_saved_throttle;
16621 	}
16622 
16623 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
16624 	    "sd_restore_throttle: calling sd_start_cmds!\n");
16625 
16626 	sd_start_cmds(un, NULL);
16627 
16628 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un,
16629 	    "sd_restore_throttle: exit: un:0x%p un_throttle:%d\n",
16630 	    un, un->un_throttle);
16631 
16632 	mutex_exit(SD_MUTEX(un));
16633 
16634 	SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sd_restore_throttle: exit\n");
16635 }
16636 
16637 /*
16638  *    Function: sdrunout
16639  *
16640  * Description: Callback routine for scsi_init_pkt when a resource allocation
16641  *		fails.
16642  *
16643  *   Arguments: arg - a pointer to the sd_lun unit struct for the particular
16644  *		soft state instance.
16645  *
16646  * Return Code: The scsi_init_pkt routine allows for the callback function to
16647  *		return a 0 indicating the callback should be rescheduled or a 1
16648  *		indicating not to reschedule. This routine always returns 1
16649  *		because the driver always provides a callback function to
16650  *		scsi_init_pkt. This results in a callback always being scheduled
16651  *		(via the scsi_init_pkt callback implementation) if a resource
16652  *		failure occurs.
16653  *
16654  *     Context: This callback function may not block or call routines that block
16655  *
16656  *        Note: Using the scsi_init_pkt callback facility can result in an I/O
16657  *		request persisting at the head of the list which cannot be
16658  *		satisfied even after multiple retries. In the future the driver
16659  *		may implement some time of maximum runout count before failing
16660  *		an I/O.
16661  */
16662 
16663 static int
16664 sdrunout(caddr_t arg)
16665 {
16666 	struct sd_lun	*un = (struct sd_lun *)arg;
16667 
16668 	ASSERT(un != NULL);
16669 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16670 
16671 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sdrunout: entry\n");
16672 
16673 	mutex_enter(SD_MUTEX(un));
16674 	sd_start_cmds(un, NULL);
16675 	mutex_exit(SD_MUTEX(un));
16676 	/*
16677 	 * This callback routine always returns 1 (i.e. do not reschedule)
16678 	 * because we always specify sdrunout as the callback handler for
16679 	 * scsi_init_pkt inside the call to sd_start_cmds.
16680 	 */
16681 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sdrunout: exit\n");
16682 	return (1);
16683 }
16684 
16685 
16686 /*
16687  *    Function: sdintr
16688  *
16689  * Description: Completion callback routine for scsi_pkt(9S) structs
16690  *		sent to the HBA driver via scsi_transport(9F).
16691  *
16692  *     Context: Interrupt context
16693  */
16694 
16695 static void
16696 sdintr(struct scsi_pkt *pktp)
16697 {
16698 	struct buf	*bp;
16699 	struct sd_xbuf	*xp;
16700 	struct sd_lun	*un;
16701 	size_t		actual_len;
16702 	sd_ssc_t	*sscp;
16703 
16704 	ASSERT(pktp != NULL);
16705 	bp = (struct buf *)pktp->pkt_private;
16706 	ASSERT(bp != NULL);
16707 	xp = SD_GET_XBUF(bp);
16708 	ASSERT(xp != NULL);
16709 	ASSERT(xp->xb_pktp != NULL);
16710 	un = SD_GET_UN(bp);
16711 	ASSERT(un != NULL);
16712 	ASSERT(!mutex_owned(SD_MUTEX(un)));
16713 
16714 #ifdef SD_FAULT_INJECTION
16715 
16716 	SD_INFO(SD_LOG_IOERR, un, "sdintr: sdintr calling Fault injection\n");
16717 	/* SD FaultInjection */
16718 	sd_faultinjection(pktp);
16719 
16720 #endif /* SD_FAULT_INJECTION */
16721 
16722 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sdintr: entry: buf:0x%p,"
16723 	    " xp:0x%p, un:0x%p\n", bp, xp, un);
16724 
16725 	mutex_enter(SD_MUTEX(un));
16726 
16727 	ASSERT(un->un_fm_private != NULL);
16728 	sscp = &((struct sd_fm_internal *)(un->un_fm_private))->fm_ssc;
16729 	ASSERT(sscp != NULL);
16730 
16731 	/* Reduce the count of the #commands currently in transport */
16732 	un->un_ncmds_in_transport--;
16733 	ASSERT(un->un_ncmds_in_transport >= 0);
16734 
16735 	/* Increment counter to indicate that the callback routine is active */
16736 	un->un_in_callback++;
16737 
16738 	SD_UPDATE_KSTATS(un, kstat_runq_exit, bp);
16739 
16740 #ifdef	SDDEBUG
16741 	if (bp == un->un_retry_bp) {
16742 		SD_TRACE(SD_LOG_IO | SD_LOG_ERROR, un, "sdintr: "
16743 		    "un:0x%p: GOT retry_bp:0x%p un_ncmds_in_transport:%d\n",
16744 		    un, un->un_retry_bp, un->un_ncmds_in_transport);
16745 	}
16746 #endif
16747 
16748 	/*
16749 	 * If pkt_reason is CMD_DEV_GONE, fail the command, and update the media
16750 	 * state if needed.
16751 	 */
16752 	if (pktp->pkt_reason == CMD_DEV_GONE) {
16753 		/* Prevent multiple console messages for the same failure. */
16754 		if (un->un_last_pkt_reason != CMD_DEV_GONE) {
16755 			un->un_last_pkt_reason = CMD_DEV_GONE;
16756 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
16757 			    "Command failed to complete...Device is gone\n");
16758 		}
16759 		if (un->un_mediastate != DKIO_DEV_GONE) {
16760 			un->un_mediastate = DKIO_DEV_GONE;
16761 			cv_broadcast(&un->un_state_cv);
16762 		}
16763 		/*
16764 		 * If the command happens to be the REQUEST SENSE command,
16765 		 * free up the rqs buf and fail the original command.
16766 		 */
16767 		if (bp == un->un_rqs_bp) {
16768 			bp = sd_mark_rqs_idle(un, xp);
16769 		}
16770 		sd_return_failed_command(un, bp, EIO);
16771 		goto exit;
16772 	}
16773 
16774 	if (pktp->pkt_state & STATE_XARQ_DONE) {
16775 		SD_TRACE(SD_LOG_COMMON, un,
16776 		    "sdintr: extra sense data received. pkt=%p\n", pktp);
16777 	}
16778 
16779 	/*
16780 	 * First see if the pkt has auto-request sense data with it....
16781 	 * Look at the packet state first so we don't take a performance
16782 	 * hit looking at the arq enabled flag unless absolutely necessary.
16783 	 */
16784 	if ((pktp->pkt_state & STATE_ARQ_DONE) &&
16785 	    (un->un_f_arq_enabled == TRUE)) {
16786 		/*
16787 		 * The HBA did an auto request sense for this command so check
16788 		 * for FLAG_DIAGNOSE. If set this indicates a uscsi or internal
16789 		 * driver command that should not be retried.
16790 		 */
16791 		if ((pktp->pkt_flags & FLAG_DIAGNOSE) != 0) {
16792 			/*
16793 			 * Save the relevant sense info into the xp for the
16794 			 * original cmd.
16795 			 */
16796 			struct scsi_arq_status *asp;
16797 			asp = (struct scsi_arq_status *)(pktp->pkt_scbp);
16798 			xp->xb_sense_status =
16799 			    *((uchar_t *)(&(asp->sts_rqpkt_status)));
16800 			xp->xb_sense_state  = asp->sts_rqpkt_state;
16801 			xp->xb_sense_resid  = asp->sts_rqpkt_resid;
16802 			if (pktp->pkt_state & STATE_XARQ_DONE) {
16803 				actual_len = MAX_SENSE_LENGTH -
16804 				    xp->xb_sense_resid;
16805 				bcopy(&asp->sts_sensedata, xp->xb_sense_data,
16806 				    MAX_SENSE_LENGTH);
16807 			} else {
16808 				if (xp->xb_sense_resid > SENSE_LENGTH) {
16809 					actual_len = MAX_SENSE_LENGTH -
16810 					    xp->xb_sense_resid;
16811 				} else {
16812 					actual_len = SENSE_LENGTH -
16813 					    xp->xb_sense_resid;
16814 				}
16815 				if (xp->xb_pkt_flags & SD_XB_USCSICMD) {
16816 					if ((((struct uscsi_cmd *)
16817 					    (xp->xb_pktinfo))->uscsi_rqlen) >
16818 					    actual_len) {
16819 						xp->xb_sense_resid =
16820 						    (((struct uscsi_cmd *)
16821 						    (xp->xb_pktinfo))->
16822 						    uscsi_rqlen) - actual_len;
16823 					} else {
16824 						xp->xb_sense_resid = 0;
16825 					}
16826 				}
16827 				bcopy(&asp->sts_sensedata, xp->xb_sense_data,
16828 				    SENSE_LENGTH);
16829 			}
16830 
16831 			/* fail the command */
16832 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16833 			    "sdintr: arq done and FLAG_DIAGNOSE set\n");
16834 			sd_return_failed_command(un, bp, EIO);
16835 			goto exit;
16836 		}
16837 
16838 #if (defined(__i386) || defined(__amd64))	/* DMAFREE for x86 only */
16839 		/*
16840 		 * We want to either retry or fail this command, so free
16841 		 * the DMA resources here.  If we retry the command then
16842 		 * the DMA resources will be reallocated in sd_start_cmds().
16843 		 * Note that when PKT_DMA_PARTIAL is used, this reallocation
16844 		 * causes the *entire* transfer to start over again from the
16845 		 * beginning of the request, even for PARTIAL chunks that
16846 		 * have already transferred successfully.
16847 		 */
16848 		if ((un->un_f_is_fibre == TRUE) &&
16849 		    ((xp->xb_pkt_flags & SD_XB_USCSICMD) == 0) &&
16850 		    ((pktp->pkt_flags & FLAG_SENSING) == 0))  {
16851 			scsi_dmafree(pktp);
16852 			xp->xb_pkt_flags |= SD_XB_DMA_FREED;
16853 		}
16854 #endif
16855 
16856 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16857 		    "sdintr: arq done, sd_handle_auto_request_sense\n");
16858 
16859 		sd_handle_auto_request_sense(un, bp, xp, pktp);
16860 		goto exit;
16861 	}
16862 
16863 	/* Next see if this is the REQUEST SENSE pkt for the instance */
16864 	if (pktp->pkt_flags & FLAG_SENSING)  {
16865 		/* This pktp is from the unit's REQUEST_SENSE command */
16866 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16867 		    "sdintr: sd_handle_request_sense\n");
16868 		sd_handle_request_sense(un, bp, xp, pktp);
16869 		goto exit;
16870 	}
16871 
16872 	/*
16873 	 * Check to see if the command successfully completed as requested;
16874 	 * this is the most common case (and also the hot performance path).
16875 	 *
16876 	 * Requirements for successful completion are:
16877 	 * pkt_reason is CMD_CMPLT and packet status is status good.
16878 	 * In addition:
16879 	 * - A residual of zero indicates successful completion no matter what
16880 	 *   the command is.
16881 	 * - If the residual is not zero and the command is not a read or
16882 	 *   write, then it's still defined as successful completion. In other
16883 	 *   words, if the command is a read or write the residual must be
16884 	 *   zero for successful completion.
16885 	 * - If the residual is not zero and the command is a read or
16886 	 *   write, and it's a USCSICMD, then it's still defined as
16887 	 *   successful completion.
16888 	 */
16889 	if ((pktp->pkt_reason == CMD_CMPLT) &&
16890 	    (SD_GET_PKT_STATUS(pktp) == STATUS_GOOD)) {
16891 
16892 		/*
16893 		 * Since this command is returned with a good status, we
16894 		 * can reset the count for Sonoma failover.
16895 		 */
16896 		un->un_sonoma_failure_count = 0;
16897 
16898 		/*
16899 		 * Return all USCSI commands on good status
16900 		 */
16901 		if (pktp->pkt_resid == 0) {
16902 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16903 			    "sdintr: returning command for resid == 0\n");
16904 		} else if (((SD_GET_PKT_OPCODE(pktp) & 0x1F) != SCMD_READ) &&
16905 		    ((SD_GET_PKT_OPCODE(pktp) & 0x1F) != SCMD_WRITE)) {
16906 			SD_UPDATE_B_RESID(bp, pktp);
16907 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16908 			    "sdintr: returning command for resid != 0\n");
16909 		} else if (xp->xb_pkt_flags & SD_XB_USCSICMD) {
16910 			SD_UPDATE_B_RESID(bp, pktp);
16911 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16912 			    "sdintr: returning uscsi command\n");
16913 		} else {
16914 			goto not_successful;
16915 		}
16916 		sd_return_command(un, bp);
16917 
16918 		/*
16919 		 * Decrement counter to indicate that the callback routine
16920 		 * is done.
16921 		 */
16922 		un->un_in_callback--;
16923 		ASSERT(un->un_in_callback >= 0);
16924 		mutex_exit(SD_MUTEX(un));
16925 
16926 		return;
16927 	}
16928 
16929 not_successful:
16930 
16931 #if (defined(__i386) || defined(__amd64))	/* DMAFREE for x86 only */
16932 	/*
16933 	 * The following is based upon knowledge of the underlying transport
16934 	 * and its use of DMA resources.  This code should be removed when
16935 	 * PKT_DMA_PARTIAL support is taken out of the disk driver in favor
16936 	 * of the new PKT_CMD_BREAKUP protocol. See also sd_initpkt_for_buf()
16937 	 * and sd_start_cmds().
16938 	 *
16939 	 * Free any DMA resources associated with this command if there
16940 	 * is a chance it could be retried or enqueued for later retry.
16941 	 * If we keep the DMA binding then mpxio cannot reissue the
16942 	 * command on another path whenever a path failure occurs.
16943 	 *
16944 	 * Note that when PKT_DMA_PARTIAL is used, free/reallocation
16945 	 * causes the *entire* transfer to start over again from the
16946 	 * beginning of the request, even for PARTIAL chunks that
16947 	 * have already transferred successfully.
16948 	 *
16949 	 * This is only done for non-uscsi commands (and also skipped for the
16950 	 * driver's internal RQS command). Also just do this for Fibre Channel
16951 	 * devices as these are the only ones that support mpxio.
16952 	 */
16953 	if ((un->un_f_is_fibre == TRUE) &&
16954 	    ((xp->xb_pkt_flags & SD_XB_USCSICMD) == 0) &&
16955 	    ((pktp->pkt_flags & FLAG_SENSING) == 0))  {
16956 		scsi_dmafree(pktp);
16957 		xp->xb_pkt_flags |= SD_XB_DMA_FREED;
16958 	}
16959 #endif
16960 
16961 	/*
16962 	 * The command did not successfully complete as requested so check
16963 	 * for FLAG_DIAGNOSE. If set this indicates a uscsi or internal
16964 	 * driver command that should not be retried so just return. If
16965 	 * FLAG_DIAGNOSE is not set the error will be processed below.
16966 	 */
16967 	if ((pktp->pkt_flags & FLAG_DIAGNOSE) != 0) {
16968 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16969 		    "sdintr: FLAG_DIAGNOSE: sd_return_failed_command\n");
16970 		/*
16971 		 * Issue a request sense if a check condition caused the error
16972 		 * (we handle the auto request sense case above), otherwise
16973 		 * just fail the command.
16974 		 */
16975 		if ((pktp->pkt_reason == CMD_CMPLT) &&
16976 		    (SD_GET_PKT_STATUS(pktp) == STATUS_CHECK)) {
16977 			sd_send_request_sense_command(un, bp, pktp);
16978 		} else {
16979 			sd_return_failed_command(un, bp, EIO);
16980 		}
16981 		goto exit;
16982 	}
16983 
16984 	/*
16985 	 * The command did not successfully complete as requested so process
16986 	 * the error, retry, and/or attempt recovery.
16987 	 */
16988 	switch (pktp->pkt_reason) {
16989 	case CMD_CMPLT:
16990 		switch (SD_GET_PKT_STATUS(pktp)) {
16991 		case STATUS_GOOD:
16992 			/*
16993 			 * The command completed successfully with a non-zero
16994 			 * residual
16995 			 */
16996 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
16997 			    "sdintr: STATUS_GOOD \n");
16998 			sd_pkt_status_good(un, bp, xp, pktp);
16999 			break;
17000 
17001 		case STATUS_CHECK:
17002 		case STATUS_TERMINATED:
17003 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17004 			    "sdintr: STATUS_TERMINATED | STATUS_CHECK\n");
17005 			sd_pkt_status_check_condition(un, bp, xp, pktp);
17006 			break;
17007 
17008 		case STATUS_BUSY:
17009 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17010 			    "sdintr: STATUS_BUSY\n");
17011 			sd_pkt_status_busy(un, bp, xp, pktp);
17012 			break;
17013 
17014 		case STATUS_RESERVATION_CONFLICT:
17015 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17016 			    "sdintr: STATUS_RESERVATION_CONFLICT\n");
17017 			sd_pkt_status_reservation_conflict(un, bp, xp, pktp);
17018 			break;
17019 
17020 		case STATUS_QFULL:
17021 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17022 			    "sdintr: STATUS_QFULL\n");
17023 			sd_pkt_status_qfull(un, bp, xp, pktp);
17024 			break;
17025 
17026 		case STATUS_MET:
17027 		case STATUS_INTERMEDIATE:
17028 		case STATUS_SCSI2:
17029 		case STATUS_INTERMEDIATE_MET:
17030 		case STATUS_ACA_ACTIVE:
17031 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17032 			    "Unexpected SCSI status received: 0x%x\n",
17033 			    SD_GET_PKT_STATUS(pktp));
17034 			/*
17035 			 * Mark the ssc_flags when detected invalid status
17036 			 * code for non-USCSI command.
17037 			 */
17038 			if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17039 				sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_STATUS,
17040 				    0, "stat-code");
17041 			}
17042 			sd_return_failed_command(un, bp, EIO);
17043 			break;
17044 
17045 		default:
17046 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17047 			    "Invalid SCSI status received: 0x%x\n",
17048 			    SD_GET_PKT_STATUS(pktp));
17049 			if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17050 				sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_STATUS,
17051 				    0, "stat-code");
17052 			}
17053 			sd_return_failed_command(un, bp, EIO);
17054 			break;
17055 
17056 		}
17057 		break;
17058 
17059 	case CMD_INCOMPLETE:
17060 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17061 		    "sdintr:  CMD_INCOMPLETE\n");
17062 		sd_pkt_reason_cmd_incomplete(un, bp, xp, pktp);
17063 		break;
17064 	case CMD_TRAN_ERR:
17065 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17066 		    "sdintr: CMD_TRAN_ERR\n");
17067 		sd_pkt_reason_cmd_tran_err(un, bp, xp, pktp);
17068 		break;
17069 	case CMD_RESET:
17070 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17071 		    "sdintr: CMD_RESET \n");
17072 		sd_pkt_reason_cmd_reset(un, bp, xp, pktp);
17073 		break;
17074 	case CMD_ABORTED:
17075 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17076 		    "sdintr: CMD_ABORTED \n");
17077 		sd_pkt_reason_cmd_aborted(un, bp, xp, pktp);
17078 		break;
17079 	case CMD_TIMEOUT:
17080 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17081 		    "sdintr: CMD_TIMEOUT\n");
17082 		sd_pkt_reason_cmd_timeout(un, bp, xp, pktp);
17083 		break;
17084 	case CMD_UNX_BUS_FREE:
17085 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17086 		    "sdintr: CMD_UNX_BUS_FREE \n");
17087 		sd_pkt_reason_cmd_unx_bus_free(un, bp, xp, pktp);
17088 		break;
17089 	case CMD_TAG_REJECT:
17090 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17091 		    "sdintr: CMD_TAG_REJECT\n");
17092 		sd_pkt_reason_cmd_tag_reject(un, bp, xp, pktp);
17093 		break;
17094 	default:
17095 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
17096 		    "sdintr: default\n");
17097 		/*
17098 		 * Mark the ssc_flags for detecting invliad pkt_reason.
17099 		 */
17100 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17101 			sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_PKT_REASON,
17102 			    0, "pkt-reason");
17103 		}
17104 		sd_pkt_reason_default(un, bp, xp, pktp);
17105 		break;
17106 	}
17107 
17108 exit:
17109 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sdintr: exit\n");
17110 
17111 	/* Decrement counter to indicate that the callback routine is done. */
17112 	un->un_in_callback--;
17113 	ASSERT(un->un_in_callback >= 0);
17114 
17115 	/*
17116 	 * At this point, the pkt has been dispatched, ie, it is either
17117 	 * being re-tried or has been returned to its caller and should
17118 	 * not be referenced.
17119 	 */
17120 
17121 	mutex_exit(SD_MUTEX(un));
17122 }
17123 
17124 
17125 /*
17126  *    Function: sd_print_incomplete_msg
17127  *
17128  * Description: Prints the error message for a CMD_INCOMPLETE error.
17129  *
17130  *   Arguments: un - ptr to associated softstate for the device.
17131  *		bp - ptr to the buf(9S) for the command.
17132  *		arg - message string ptr
17133  *		code - SD_DELAYED_RETRY_ISSUED, SD_IMMEDIATE_RETRY_ISSUED,
17134  *			or SD_NO_RETRY_ISSUED.
17135  *
17136  *     Context: May be called under interrupt context
17137  */
17138 
17139 static void
17140 sd_print_incomplete_msg(struct sd_lun *un, struct buf *bp, void *arg, int code)
17141 {
17142 	struct scsi_pkt	*pktp;
17143 	char	*msgp;
17144 	char	*cmdp = arg;
17145 
17146 	ASSERT(un != NULL);
17147 	ASSERT(mutex_owned(SD_MUTEX(un)));
17148 	ASSERT(bp != NULL);
17149 	ASSERT(arg != NULL);
17150 	pktp = SD_GET_PKTP(bp);
17151 	ASSERT(pktp != NULL);
17152 
17153 	switch (code) {
17154 	case SD_DELAYED_RETRY_ISSUED:
17155 	case SD_IMMEDIATE_RETRY_ISSUED:
17156 		msgp = "retrying";
17157 		break;
17158 	case SD_NO_RETRY_ISSUED:
17159 	default:
17160 		msgp = "giving up";
17161 		break;
17162 	}
17163 
17164 	if ((pktp->pkt_flags & FLAG_SILENT) == 0) {
17165 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17166 		    "incomplete %s- %s\n", cmdp, msgp);
17167 	}
17168 }
17169 
17170 
17171 
17172 /*
17173  *    Function: sd_pkt_status_good
17174  *
17175  * Description: Processing for a STATUS_GOOD code in pkt_status.
17176  *
17177  *     Context: May be called under interrupt context
17178  */
17179 
17180 static void
17181 sd_pkt_status_good(struct sd_lun *un, struct buf *bp,
17182 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
17183 {
17184 	char	*cmdp;
17185 
17186 	ASSERT(un != NULL);
17187 	ASSERT(mutex_owned(SD_MUTEX(un)));
17188 	ASSERT(bp != NULL);
17189 	ASSERT(xp != NULL);
17190 	ASSERT(pktp != NULL);
17191 	ASSERT(pktp->pkt_reason == CMD_CMPLT);
17192 	ASSERT(SD_GET_PKT_STATUS(pktp) == STATUS_GOOD);
17193 	ASSERT(pktp->pkt_resid != 0);
17194 
17195 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_pkt_status_good: entry\n");
17196 
17197 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
17198 	switch (SD_GET_PKT_OPCODE(pktp) & 0x1F) {
17199 	case SCMD_READ:
17200 		cmdp = "read";
17201 		break;
17202 	case SCMD_WRITE:
17203 		cmdp = "write";
17204 		break;
17205 	default:
17206 		SD_UPDATE_B_RESID(bp, pktp);
17207 		sd_return_command(un, bp);
17208 		SD_TRACE(SD_LOG_IO_CORE, un, "sd_pkt_status_good: exit\n");
17209 		return;
17210 	}
17211 
17212 	/*
17213 	 * See if we can retry the read/write, preferrably immediately.
17214 	 * If retries are exhaused, then sd_retry_command() will update
17215 	 * the b_resid count.
17216 	 */
17217 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_incomplete_msg,
17218 	    cmdp, EIO, (clock_t)0, NULL);
17219 
17220 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_pkt_status_good: exit\n");
17221 }
17222 
17223 
17224 
17225 
17226 
17227 /*
17228  *    Function: sd_handle_request_sense
17229  *
17230  * Description: Processing for non-auto Request Sense command.
17231  *
17232  *   Arguments: un - ptr to associated softstate
17233  *		sense_bp - ptr to buf(9S) for the RQS command
17234  *		sense_xp - ptr to the sd_xbuf for the RQS command
17235  *		sense_pktp - ptr to the scsi_pkt(9S) for the RQS command
17236  *
17237  *     Context: May be called under interrupt context
17238  */
17239 
17240 static void
17241 sd_handle_request_sense(struct sd_lun *un, struct buf *sense_bp,
17242 	struct sd_xbuf *sense_xp, struct scsi_pkt *sense_pktp)
17243 {
17244 	struct buf	*cmd_bp;	/* buf for the original command */
17245 	struct sd_xbuf	*cmd_xp;	/* sd_xbuf for the original command */
17246 	struct scsi_pkt *cmd_pktp;	/* pkt for the original command */
17247 	size_t		actual_len;	/* actual sense data length */
17248 
17249 	ASSERT(un != NULL);
17250 	ASSERT(mutex_owned(SD_MUTEX(un)));
17251 	ASSERT(sense_bp != NULL);
17252 	ASSERT(sense_xp != NULL);
17253 	ASSERT(sense_pktp != NULL);
17254 
17255 	/*
17256 	 * Note the sense_bp, sense_xp, and sense_pktp here are for the
17257 	 * RQS command and not the original command.
17258 	 */
17259 	ASSERT(sense_pktp == un->un_rqs_pktp);
17260 	ASSERT(sense_bp   == un->un_rqs_bp);
17261 	ASSERT((sense_pktp->pkt_flags & (FLAG_SENSING | FLAG_HEAD)) ==
17262 	    (FLAG_SENSING | FLAG_HEAD));
17263 	ASSERT((((SD_GET_XBUF(sense_xp->xb_sense_bp))->xb_pktp->pkt_flags) &
17264 	    FLAG_SENSING) == FLAG_SENSING);
17265 
17266 	/* These are the bp, xp, and pktp for the original command */
17267 	cmd_bp = sense_xp->xb_sense_bp;
17268 	cmd_xp = SD_GET_XBUF(cmd_bp);
17269 	cmd_pktp = SD_GET_PKTP(cmd_bp);
17270 
17271 	if (sense_pktp->pkt_reason != CMD_CMPLT) {
17272 		/*
17273 		 * The REQUEST SENSE command failed.  Release the REQUEST
17274 		 * SENSE command for re-use, get back the bp for the original
17275 		 * command, and attempt to re-try the original command if
17276 		 * FLAG_DIAGNOSE is not set in the original packet.
17277 		 */
17278 		SD_UPDATE_ERRSTATS(un, sd_harderrs);
17279 		if ((cmd_pktp->pkt_flags & FLAG_DIAGNOSE) == 0) {
17280 			cmd_bp = sd_mark_rqs_idle(un, sense_xp);
17281 			sd_retry_command(un, cmd_bp, SD_RETRIES_STANDARD,
17282 			    NULL, NULL, EIO, (clock_t)0, NULL);
17283 			return;
17284 		}
17285 	}
17286 
17287 	/*
17288 	 * Save the relevant sense info into the xp for the original cmd.
17289 	 *
17290 	 * Note: if the request sense failed the state info will be zero
17291 	 * as set in sd_mark_rqs_busy()
17292 	 */
17293 	cmd_xp->xb_sense_status = *(sense_pktp->pkt_scbp);
17294 	cmd_xp->xb_sense_state  = sense_pktp->pkt_state;
17295 	actual_len = MAX_SENSE_LENGTH - sense_pktp->pkt_resid;
17296 	if ((cmd_xp->xb_pkt_flags & SD_XB_USCSICMD) &&
17297 	    (((struct uscsi_cmd *)cmd_xp->xb_pktinfo)->uscsi_rqlen >
17298 	    SENSE_LENGTH)) {
17299 		bcopy(sense_bp->b_un.b_addr, cmd_xp->xb_sense_data,
17300 		    MAX_SENSE_LENGTH);
17301 		cmd_xp->xb_sense_resid = sense_pktp->pkt_resid;
17302 	} else {
17303 		bcopy(sense_bp->b_un.b_addr, cmd_xp->xb_sense_data,
17304 		    SENSE_LENGTH);
17305 		if (actual_len < SENSE_LENGTH) {
17306 			cmd_xp->xb_sense_resid = SENSE_LENGTH - actual_len;
17307 		} else {
17308 			cmd_xp->xb_sense_resid = 0;
17309 		}
17310 	}
17311 
17312 	/*
17313 	 *  Free up the RQS command....
17314 	 *  NOTE:
17315 	 *	Must do this BEFORE calling sd_validate_sense_data!
17316 	 *	sd_validate_sense_data may return the original command in
17317 	 *	which case the pkt will be freed and the flags can no
17318 	 *	longer be touched.
17319 	 *	SD_MUTEX is held through this process until the command
17320 	 *	is dispatched based upon the sense data, so there are
17321 	 *	no race conditions.
17322 	 */
17323 	(void) sd_mark_rqs_idle(un, sense_xp);
17324 
17325 	/*
17326 	 * For a retryable command see if we have valid sense data, if so then
17327 	 * turn it over to sd_decode_sense() to figure out the right course of
17328 	 * action. Just fail a non-retryable command.
17329 	 */
17330 	if ((cmd_pktp->pkt_flags & FLAG_DIAGNOSE) == 0) {
17331 		if (sd_validate_sense_data(un, cmd_bp, cmd_xp, actual_len) ==
17332 		    SD_SENSE_DATA_IS_VALID) {
17333 			sd_decode_sense(un, cmd_bp, cmd_xp, cmd_pktp);
17334 		}
17335 	} else {
17336 		SD_DUMP_MEMORY(un, SD_LOG_IO_CORE, "Failed CDB",
17337 		    (uchar_t *)cmd_pktp->pkt_cdbp, CDB_SIZE, SD_LOG_HEX);
17338 		SD_DUMP_MEMORY(un, SD_LOG_IO_CORE, "Sense Data",
17339 		    (uchar_t *)cmd_xp->xb_sense_data, SENSE_LENGTH, SD_LOG_HEX);
17340 		sd_return_failed_command(un, cmd_bp, EIO);
17341 	}
17342 }
17343 
17344 
17345 
17346 
17347 /*
17348  *    Function: sd_handle_auto_request_sense
17349  *
17350  * Description: Processing for auto-request sense information.
17351  *
17352  *   Arguments: un - ptr to associated softstate
17353  *		bp - ptr to buf(9S) for the command
17354  *		xp - ptr to the sd_xbuf for the command
17355  *		pktp - ptr to the scsi_pkt(9S) for the command
17356  *
17357  *     Context: May be called under interrupt context
17358  */
17359 
17360 static void
17361 sd_handle_auto_request_sense(struct sd_lun *un, struct buf *bp,
17362 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
17363 {
17364 	struct scsi_arq_status *asp;
17365 	size_t actual_len;
17366 
17367 	ASSERT(un != NULL);
17368 	ASSERT(mutex_owned(SD_MUTEX(un)));
17369 	ASSERT(bp != NULL);
17370 	ASSERT(xp != NULL);
17371 	ASSERT(pktp != NULL);
17372 	ASSERT(pktp != un->un_rqs_pktp);
17373 	ASSERT(bp   != un->un_rqs_bp);
17374 
17375 	/*
17376 	 * For auto-request sense, we get a scsi_arq_status back from
17377 	 * the HBA, with the sense data in the sts_sensedata member.
17378 	 * The pkt_scbp of the packet points to this scsi_arq_status.
17379 	 */
17380 	asp = (struct scsi_arq_status *)(pktp->pkt_scbp);
17381 
17382 	if (asp->sts_rqpkt_reason != CMD_CMPLT) {
17383 		/*
17384 		 * The auto REQUEST SENSE failed; see if we can re-try
17385 		 * the original command.
17386 		 */
17387 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17388 		    "auto request sense failed (reason=%s)\n",
17389 		    scsi_rname(asp->sts_rqpkt_reason));
17390 
17391 		sd_reset_target(un, pktp);
17392 
17393 		sd_retry_command(un, bp, SD_RETRIES_STANDARD,
17394 		    NULL, NULL, EIO, (clock_t)0, NULL);
17395 		return;
17396 	}
17397 
17398 	/* Save the relevant sense info into the xp for the original cmd. */
17399 	xp->xb_sense_status = *((uchar_t *)(&(asp->sts_rqpkt_status)));
17400 	xp->xb_sense_state  = asp->sts_rqpkt_state;
17401 	xp->xb_sense_resid  = asp->sts_rqpkt_resid;
17402 	if (xp->xb_sense_state & STATE_XARQ_DONE) {
17403 		actual_len = MAX_SENSE_LENGTH - xp->xb_sense_resid;
17404 		bcopy(&asp->sts_sensedata, xp->xb_sense_data,
17405 		    MAX_SENSE_LENGTH);
17406 	} else {
17407 		if (xp->xb_sense_resid > SENSE_LENGTH) {
17408 			actual_len = MAX_SENSE_LENGTH - xp->xb_sense_resid;
17409 		} else {
17410 			actual_len = SENSE_LENGTH - xp->xb_sense_resid;
17411 		}
17412 		if (xp->xb_pkt_flags & SD_XB_USCSICMD) {
17413 			if ((((struct uscsi_cmd *)
17414 			    (xp->xb_pktinfo))->uscsi_rqlen) > actual_len) {
17415 				xp->xb_sense_resid = (((struct uscsi_cmd *)
17416 				    (xp->xb_pktinfo))->uscsi_rqlen) -
17417 				    actual_len;
17418 			} else {
17419 				xp->xb_sense_resid = 0;
17420 			}
17421 		}
17422 		bcopy(&asp->sts_sensedata, xp->xb_sense_data, SENSE_LENGTH);
17423 	}
17424 
17425 	/*
17426 	 * See if we have valid sense data, if so then turn it over to
17427 	 * sd_decode_sense() to figure out the right course of action.
17428 	 */
17429 	if (sd_validate_sense_data(un, bp, xp, actual_len) ==
17430 	    SD_SENSE_DATA_IS_VALID) {
17431 		sd_decode_sense(un, bp, xp, pktp);
17432 	}
17433 }
17434 
17435 
17436 /*
17437  *    Function: sd_print_sense_failed_msg
17438  *
17439  * Description: Print log message when RQS has failed.
17440  *
17441  *   Arguments: un - ptr to associated softstate
17442  *		bp - ptr to buf(9S) for the command
17443  *		arg - generic message string ptr
17444  *		code - SD_IMMEDIATE_RETRY_ISSUED, SD_DELAYED_RETRY_ISSUED,
17445  *			or SD_NO_RETRY_ISSUED
17446  *
17447  *     Context: May be called from interrupt context
17448  */
17449 
17450 static void
17451 sd_print_sense_failed_msg(struct sd_lun *un, struct buf *bp, void *arg,
17452 	int code)
17453 {
17454 	char	*msgp = arg;
17455 
17456 	ASSERT(un != NULL);
17457 	ASSERT(mutex_owned(SD_MUTEX(un)));
17458 	ASSERT(bp != NULL);
17459 
17460 	if ((code == SD_NO_RETRY_ISSUED) && (msgp != NULL)) {
17461 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN, msgp);
17462 	}
17463 }
17464 
17465 
17466 /*
17467  *    Function: sd_validate_sense_data
17468  *
17469  * Description: Check the given sense data for validity.
17470  *		If the sense data is not valid, the command will
17471  *		be either failed or retried!
17472  *
17473  * Return Code: SD_SENSE_DATA_IS_INVALID
17474  *		SD_SENSE_DATA_IS_VALID
17475  *
17476  *     Context: May be called from interrupt context
17477  */
17478 
17479 static int
17480 sd_validate_sense_data(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
17481 	size_t actual_len)
17482 {
17483 	struct scsi_extended_sense *esp;
17484 	struct	scsi_pkt *pktp;
17485 	char	*msgp = NULL;
17486 	sd_ssc_t *sscp;
17487 
17488 	ASSERT(un != NULL);
17489 	ASSERT(mutex_owned(SD_MUTEX(un)));
17490 	ASSERT(bp != NULL);
17491 	ASSERT(bp != un->un_rqs_bp);
17492 	ASSERT(xp != NULL);
17493 	ASSERT(un->un_fm_private != NULL);
17494 
17495 	pktp = SD_GET_PKTP(bp);
17496 	ASSERT(pktp != NULL);
17497 
17498 	sscp = &((struct sd_fm_internal *)(un->un_fm_private))->fm_ssc;
17499 	ASSERT(sscp != NULL);
17500 
17501 	/*
17502 	 * Check the status of the RQS command (auto or manual).
17503 	 */
17504 	switch (xp->xb_sense_status & STATUS_MASK) {
17505 	case STATUS_GOOD:
17506 		break;
17507 
17508 	case STATUS_RESERVATION_CONFLICT:
17509 		sd_pkt_status_reservation_conflict(un, bp, xp, pktp);
17510 		return (SD_SENSE_DATA_IS_INVALID);
17511 
17512 	case STATUS_BUSY:
17513 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17514 		    "Busy Status on REQUEST SENSE\n");
17515 		sd_retry_command(un, bp, SD_RETRIES_BUSY, NULL,
17516 		    NULL, EIO, un->un_busy_timeout / 500, kstat_waitq_enter);
17517 		return (SD_SENSE_DATA_IS_INVALID);
17518 
17519 	case STATUS_QFULL:
17520 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
17521 		    "QFULL Status on REQUEST SENSE\n");
17522 		sd_retry_command(un, bp, SD_RETRIES_STANDARD, NULL,
17523 		    NULL, EIO, un->un_busy_timeout / 500, kstat_waitq_enter);
17524 		return (SD_SENSE_DATA_IS_INVALID);
17525 
17526 	case STATUS_CHECK:
17527 	case STATUS_TERMINATED:
17528 		msgp = "Check Condition on REQUEST SENSE\n";
17529 		goto sense_failed;
17530 
17531 	default:
17532 		msgp = "Not STATUS_GOOD on REQUEST_SENSE\n";
17533 		goto sense_failed;
17534 	}
17535 
17536 	/*
17537 	 * See if we got the minimum required amount of sense data.
17538 	 * Note: We are assuming the returned sense data is SENSE_LENGTH bytes
17539 	 * or less.
17540 	 */
17541 	if (((xp->xb_sense_state & STATE_XFERRED_DATA) == 0) ||
17542 	    (actual_len == 0)) {
17543 		msgp = "Request Sense couldn't get sense data\n";
17544 		goto sense_failed;
17545 	}
17546 
17547 	if (actual_len < SUN_MIN_SENSE_LENGTH) {
17548 		msgp = "Not enough sense information\n";
17549 		/* Mark the ssc_flags for detecting invalid sense data */
17550 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17551 			sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_SENSE, 0,
17552 			    "sense-data");
17553 		}
17554 		goto sense_failed;
17555 	}
17556 
17557 	/*
17558 	 * We require the extended sense data
17559 	 */
17560 	esp = (struct scsi_extended_sense *)xp->xb_sense_data;
17561 	if (esp->es_class != CLASS_EXTENDED_SENSE) {
17562 		if ((pktp->pkt_flags & FLAG_SILENT) == 0) {
17563 			static char tmp[8];
17564 			static char buf[148];
17565 			char *p = (char *)(xp->xb_sense_data);
17566 			int i;
17567 
17568 			mutex_enter(&sd_sense_mutex);
17569 			(void) strcpy(buf, "undecodable sense information:");
17570 			for (i = 0; i < actual_len; i++) {
17571 				(void) sprintf(tmp, " 0x%x", *(p++)&0xff);
17572 				(void) strcpy(&buf[strlen(buf)], tmp);
17573 			}
17574 			i = strlen(buf);
17575 			(void) strcpy(&buf[i], "-(assumed fatal)\n");
17576 
17577 			if (SD_FM_LOG(un) == SD_FM_LOG_NSUP) {
17578 				scsi_log(SD_DEVINFO(un), sd_label,
17579 				    CE_WARN, buf);
17580 			}
17581 			mutex_exit(&sd_sense_mutex);
17582 		}
17583 
17584 		/* Mark the ssc_flags for detecting invalid sense data */
17585 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17586 			sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_SENSE, 0,
17587 			    "sense-data");
17588 		}
17589 
17590 		/* Note: Legacy behavior, fail the command with no retry */
17591 		sd_return_failed_command(un, bp, EIO);
17592 		return (SD_SENSE_DATA_IS_INVALID);
17593 	}
17594 
17595 	/*
17596 	 * Check that es_code is valid (es_class concatenated with es_code
17597 	 * make up the "response code" field.  es_class will always be 7, so
17598 	 * make sure es_code is 0, 1, 2, 3 or 0xf.  es_code will indicate the
17599 	 * format.
17600 	 */
17601 	if ((esp->es_code != CODE_FMT_FIXED_CURRENT) &&
17602 	    (esp->es_code != CODE_FMT_FIXED_DEFERRED) &&
17603 	    (esp->es_code != CODE_FMT_DESCR_CURRENT) &&
17604 	    (esp->es_code != CODE_FMT_DESCR_DEFERRED) &&
17605 	    (esp->es_code != CODE_FMT_VENDOR_SPECIFIC)) {
17606 		/* Mark the ssc_flags for detecting invalid sense data */
17607 		if (!(xp->xb_pkt_flags & SD_XB_USCSICMD)) {
17608 			sd_ssc_set_info(sscp, SSC_FLAGS_INVALID_SENSE, 0,
17609 			    "sense-data");
17610 		}
17611 		goto sense_failed;
17612 	}
17613 
17614 	return (SD_SENSE_DATA_IS_VALID);
17615 
17616 sense_failed:
17617 	/*
17618 	 * If the request sense failed (for whatever reason), attempt
17619 	 * to retry the original command.
17620 	 */
17621 #if defined(__i386) || defined(__amd64)
17622 	/*
17623 	 * SD_RETRY_DELAY is conditionally compile (#if fibre) in
17624 	 * sddef.h for Sparc platform, and x86 uses 1 binary
17625 	 * for both SCSI/FC.
17626 	 * The SD_RETRY_DELAY value need to be adjusted here
17627 	 * when SD_RETRY_DELAY change in sddef.h
17628 	 */
17629 	sd_retry_command(un, bp, SD_RETRIES_STANDARD,
17630 	    sd_print_sense_failed_msg, msgp, EIO,
17631 	    un->un_f_is_fibre?drv_usectohz(100000):(clock_t)0, NULL);
17632 #else
17633 	sd_retry_command(un, bp, SD_RETRIES_STANDARD,
17634 	    sd_print_sense_failed_msg, msgp, EIO, SD_RETRY_DELAY, NULL);
17635 #endif
17636 
17637 	return (SD_SENSE_DATA_IS_INVALID);
17638 }
17639 
17640 /*
17641  *    Function: sd_decode_sense
17642  *
17643  * Description: Take recovery action(s) when SCSI Sense Data is received.
17644  *
17645  *     Context: Interrupt context.
17646  */
17647 
17648 static void
17649 sd_decode_sense(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
17650 	struct scsi_pkt *pktp)
17651 {
17652 	uint8_t sense_key;
17653 
17654 	ASSERT(un != NULL);
17655 	ASSERT(mutex_owned(SD_MUTEX(un)));
17656 	ASSERT(bp != NULL);
17657 	ASSERT(bp != un->un_rqs_bp);
17658 	ASSERT(xp != NULL);
17659 	ASSERT(pktp != NULL);
17660 
17661 	sense_key = scsi_sense_key(xp->xb_sense_data);
17662 
17663 	switch (sense_key) {
17664 	case KEY_NO_SENSE:
17665 		sd_sense_key_no_sense(un, bp, xp, pktp);
17666 		break;
17667 	case KEY_RECOVERABLE_ERROR:
17668 		sd_sense_key_recoverable_error(un, xp->xb_sense_data,
17669 		    bp, xp, pktp);
17670 		break;
17671 	case KEY_NOT_READY:
17672 		sd_sense_key_not_ready(un, xp->xb_sense_data,
17673 		    bp, xp, pktp);
17674 		break;
17675 	case KEY_MEDIUM_ERROR:
17676 	case KEY_HARDWARE_ERROR:
17677 		sd_sense_key_medium_or_hardware_error(un,
17678 		    xp->xb_sense_data, bp, xp, pktp);
17679 		break;
17680 	case KEY_ILLEGAL_REQUEST:
17681 		sd_sense_key_illegal_request(un, bp, xp, pktp);
17682 		break;
17683 	case KEY_UNIT_ATTENTION:
17684 		sd_sense_key_unit_attention(un, xp->xb_sense_data,
17685 		    bp, xp, pktp);
17686 		break;
17687 	case KEY_WRITE_PROTECT:
17688 	case KEY_VOLUME_OVERFLOW:
17689 	case KEY_MISCOMPARE:
17690 		sd_sense_key_fail_command(un, bp, xp, pktp);
17691 		break;
17692 	case KEY_BLANK_CHECK:
17693 		sd_sense_key_blank_check(un, bp, xp, pktp);
17694 		break;
17695 	case KEY_ABORTED_COMMAND:
17696 		sd_sense_key_aborted_command(un, bp, xp, pktp);
17697 		break;
17698 	case KEY_VENDOR_UNIQUE:
17699 	case KEY_COPY_ABORTED:
17700 	case KEY_EQUAL:
17701 	case KEY_RESERVED:
17702 	default:
17703 		sd_sense_key_default(un, xp->xb_sense_data,
17704 		    bp, xp, pktp);
17705 		break;
17706 	}
17707 }
17708 
17709 
17710 /*
17711  *    Function: sd_dump_memory
17712  *
17713  * Description: Debug logging routine to print the contents of a user provided
17714  *		buffer. The output of the buffer is broken up into 256 byte
17715  *		segments due to a size constraint of the scsi_log.
17716  *		implementation.
17717  *
17718  *   Arguments: un - ptr to softstate
17719  *		comp - component mask
17720  *		title - "title" string to preceed data when printed
17721  *		data - ptr to data block to be printed
17722  *		len - size of data block to be printed
17723  *		fmt - SD_LOG_HEX (use 0x%02x format) or SD_LOG_CHAR (use %c)
17724  *
17725  *     Context: May be called from interrupt context
17726  */
17727 
17728 #define	SD_DUMP_MEMORY_BUF_SIZE	256
17729 
17730 static char *sd_dump_format_string[] = {
17731 		" 0x%02x",
17732 		" %c"
17733 };
17734 
17735 static void
17736 sd_dump_memory(struct sd_lun *un, uint_t comp, char *title, uchar_t *data,
17737     int len, int fmt)
17738 {
17739 	int	i, j;
17740 	int	avail_count;
17741 	int	start_offset;
17742 	int	end_offset;
17743 	size_t	entry_len;
17744 	char	*bufp;
17745 	char	*local_buf;
17746 	char	*format_string;
17747 
17748 	ASSERT((fmt == SD_LOG_HEX) || (fmt == SD_LOG_CHAR));
17749 
17750 	/*
17751 	 * In the debug version of the driver, this function is called from a
17752 	 * number of places which are NOPs in the release driver.
17753 	 * The debug driver therefore has additional methods of filtering
17754 	 * debug output.
17755 	 */
17756 #ifdef SDDEBUG
17757 	/*
17758 	 * In the debug version of the driver we can reduce the amount of debug
17759 	 * messages by setting sd_error_level to something other than
17760 	 * SCSI_ERR_ALL and clearing bits in sd_level_mask and
17761 	 * sd_component_mask.
17762 	 */
17763 	if (((sd_level_mask & (SD_LOGMASK_DUMP_MEM | SD_LOGMASK_DIAG)) == 0) ||
17764 	    (sd_error_level != SCSI_ERR_ALL)) {
17765 		return;
17766 	}
17767 	if (((sd_component_mask & comp) == 0) ||
17768 	    (sd_error_level != SCSI_ERR_ALL)) {
17769 		return;
17770 	}
17771 #else
17772 	if (sd_error_level != SCSI_ERR_ALL) {
17773 		return;
17774 	}
17775 #endif
17776 
17777 	local_buf = kmem_zalloc(SD_DUMP_MEMORY_BUF_SIZE, KM_SLEEP);
17778 	bufp = local_buf;
17779 	/*
17780 	 * Available length is the length of local_buf[], minus the
17781 	 * length of the title string, minus one for the ":", minus
17782 	 * one for the newline, minus one for the NULL terminator.
17783 	 * This gives the #bytes available for holding the printed
17784 	 * values from the given data buffer.
17785 	 */
17786 	if (fmt == SD_LOG_HEX) {
17787 		format_string = sd_dump_format_string[0];
17788 	} else /* SD_LOG_CHAR */ {
17789 		format_string = sd_dump_format_string[1];
17790 	}
17791 	/*
17792 	 * Available count is the number of elements from the given
17793 	 * data buffer that we can fit into the available length.
17794 	 * This is based upon the size of the format string used.
17795 	 * Make one entry and find it's size.
17796 	 */
17797 	(void) sprintf(bufp, format_string, data[0]);
17798 	entry_len = strlen(bufp);
17799 	avail_count = (SD_DUMP_MEMORY_BUF_SIZE - strlen(title) - 3) / entry_len;
17800 
17801 	j = 0;
17802 	while (j < len) {
17803 		bufp = local_buf;
17804 		bzero(bufp, SD_DUMP_MEMORY_BUF_SIZE);
17805 		start_offset = j;
17806 
17807 		end_offset = start_offset + avail_count;
17808 
17809 		(void) sprintf(bufp, "%s:", title);
17810 		bufp += strlen(bufp);
17811 		for (i = start_offset; ((i < end_offset) && (j < len));
17812 		    i++, j++) {
17813 			(void) sprintf(bufp, format_string, data[i]);
17814 			bufp += entry_len;
17815 		}
17816 		(void) sprintf(bufp, "\n");
17817 
17818 		scsi_log(SD_DEVINFO(un), sd_label, CE_NOTE, "%s", local_buf);
17819 	}
17820 	kmem_free(local_buf, SD_DUMP_MEMORY_BUF_SIZE);
17821 }
17822 
17823 /*
17824  *    Function: sd_print_sense_msg
17825  *
17826  * Description: Log a message based upon the given sense data.
17827  *
17828  *   Arguments: un - ptr to associated softstate
17829  *		bp - ptr to buf(9S) for the command
17830  *		arg - ptr to associate sd_sense_info struct
17831  *		code - SD_IMMEDIATE_RETRY_ISSUED, SD_DELAYED_RETRY_ISSUED,
17832  *			or SD_NO_RETRY_ISSUED
17833  *
17834  *     Context: May be called from interrupt context
17835  */
17836 
17837 static void
17838 sd_print_sense_msg(struct sd_lun *un, struct buf *bp, void *arg, int code)
17839 {
17840 	struct sd_xbuf	*xp;
17841 	struct scsi_pkt	*pktp;
17842 	uint8_t *sensep;
17843 	daddr_t request_blkno;
17844 	diskaddr_t err_blkno;
17845 	int severity;
17846 	int pfa_flag;
17847 	extern struct scsi_key_strings scsi_cmds[];
17848 
17849 	ASSERT(un != NULL);
17850 	ASSERT(mutex_owned(SD_MUTEX(un)));
17851 	ASSERT(bp != NULL);
17852 	xp = SD_GET_XBUF(bp);
17853 	ASSERT(xp != NULL);
17854 	pktp = SD_GET_PKTP(bp);
17855 	ASSERT(pktp != NULL);
17856 	ASSERT(arg != NULL);
17857 
17858 	severity = ((struct sd_sense_info *)(arg))->ssi_severity;
17859 	pfa_flag = ((struct sd_sense_info *)(arg))->ssi_pfa_flag;
17860 
17861 	if ((code == SD_DELAYED_RETRY_ISSUED) ||
17862 	    (code == SD_IMMEDIATE_RETRY_ISSUED)) {
17863 		severity = SCSI_ERR_RETRYABLE;
17864 	}
17865 
17866 	/* Use absolute block number for the request block number */
17867 	request_blkno = xp->xb_blkno;
17868 
17869 	/*
17870 	 * Now try to get the error block number from the sense data
17871 	 */
17872 	sensep = xp->xb_sense_data;
17873 
17874 	if (scsi_sense_info_uint64(sensep, SENSE_LENGTH,
17875 	    (uint64_t *)&err_blkno)) {
17876 		/*
17877 		 * We retrieved the error block number from the information
17878 		 * portion of the sense data.
17879 		 *
17880 		 * For USCSI commands we are better off using the error
17881 		 * block no. as the requested block no. (This is the best
17882 		 * we can estimate.)
17883 		 */
17884 		if ((SD_IS_BUFIO(xp) == FALSE) &&
17885 		    ((pktp->pkt_flags & FLAG_SILENT) == 0)) {
17886 			request_blkno = err_blkno;
17887 		}
17888 	} else {
17889 		/*
17890 		 * Without the es_valid bit set (for fixed format) or an
17891 		 * information descriptor (for descriptor format) we cannot
17892 		 * be certain of the error blkno, so just use the
17893 		 * request_blkno.
17894 		 */
17895 		err_blkno = (diskaddr_t)request_blkno;
17896 	}
17897 
17898 	/*
17899 	 * The following will log the buffer contents for the release driver
17900 	 * if the SD_LOGMASK_DIAG bit of sd_level_mask is set, or the error
17901 	 * level is set to verbose.
17902 	 */
17903 	sd_dump_memory(un, SD_LOG_IO, "Failed CDB",
17904 	    (uchar_t *)pktp->pkt_cdbp, CDB_SIZE, SD_LOG_HEX);
17905 	sd_dump_memory(un, SD_LOG_IO, "Sense Data",
17906 	    (uchar_t *)sensep, SENSE_LENGTH, SD_LOG_HEX);
17907 
17908 	if (pfa_flag == FALSE) {
17909 		/* This is normally only set for USCSI */
17910 		if ((pktp->pkt_flags & FLAG_SILENT) != 0) {
17911 			return;
17912 		}
17913 
17914 		if ((SD_IS_BUFIO(xp) == TRUE) &&
17915 		    (((sd_level_mask & SD_LOGMASK_DIAG) == 0) &&
17916 		    (severity < sd_error_level))) {
17917 			return;
17918 		}
17919 	}
17920 	/*
17921 	 * Check for Sonoma Failover and keep a count of how many failed I/O's
17922 	 */
17923 	if ((SD_IS_LSI(un)) &&
17924 	    (scsi_sense_key(sensep) == KEY_ILLEGAL_REQUEST) &&
17925 	    (scsi_sense_asc(sensep) == 0x94) &&
17926 	    (scsi_sense_ascq(sensep) == 0x01)) {
17927 		un->un_sonoma_failure_count++;
17928 		if (un->un_sonoma_failure_count > 1) {
17929 			return;
17930 		}
17931 	}
17932 
17933 	if (SD_FM_LOG(un) == SD_FM_LOG_NSUP ||
17934 	    ((scsi_sense_key(sensep) == KEY_RECOVERABLE_ERROR) &&
17935 	    (pktp->pkt_resid == 0))) {
17936 		scsi_vu_errmsg(SD_SCSI_DEVP(un), pktp, sd_label, severity,
17937 		    request_blkno, err_blkno, scsi_cmds,
17938 		    (struct scsi_extended_sense *)sensep,
17939 		    un->un_additional_codes, NULL);
17940 	}
17941 }
17942 
17943 /*
17944  *    Function: sd_sense_key_no_sense
17945  *
17946  * Description: Recovery action when sense data was not received.
17947  *
17948  *     Context: May be called from interrupt context
17949  */
17950 
17951 static void
17952 sd_sense_key_no_sense(struct sd_lun *un, struct buf *bp,
17953 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
17954 {
17955 	struct sd_sense_info	si;
17956 
17957 	ASSERT(un != NULL);
17958 	ASSERT(mutex_owned(SD_MUTEX(un)));
17959 	ASSERT(bp != NULL);
17960 	ASSERT(xp != NULL);
17961 	ASSERT(pktp != NULL);
17962 
17963 	si.ssi_severity = SCSI_ERR_FATAL;
17964 	si.ssi_pfa_flag = FALSE;
17965 
17966 	SD_UPDATE_ERRSTATS(un, sd_softerrs);
17967 
17968 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
17969 	    &si, EIO, (clock_t)0, NULL);
17970 }
17971 
17972 
17973 /*
17974  *    Function: sd_sense_key_recoverable_error
17975  *
17976  * Description: Recovery actions for a SCSI "Recovered Error" sense key.
17977  *
17978  *     Context: May be called from interrupt context
17979  */
17980 
17981 static void
17982 sd_sense_key_recoverable_error(struct sd_lun *un,
17983 	uint8_t *sense_datap,
17984 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp)
17985 {
17986 	struct sd_sense_info	si;
17987 	uint8_t asc = scsi_sense_asc(sense_datap);
17988 
17989 	ASSERT(un != NULL);
17990 	ASSERT(mutex_owned(SD_MUTEX(un)));
17991 	ASSERT(bp != NULL);
17992 	ASSERT(xp != NULL);
17993 	ASSERT(pktp != NULL);
17994 
17995 	/*
17996 	 * 0x5D: FAILURE PREDICTION THRESHOLD EXCEEDED
17997 	 */
17998 	if ((asc == 0x5D) && (sd_report_pfa != 0)) {
17999 		SD_UPDATE_ERRSTATS(un, sd_rq_pfa_err);
18000 		si.ssi_severity = SCSI_ERR_INFO;
18001 		si.ssi_pfa_flag = TRUE;
18002 	} else {
18003 		SD_UPDATE_ERRSTATS(un, sd_softerrs);
18004 		SD_UPDATE_ERRSTATS(un, sd_rq_recov_err);
18005 		si.ssi_severity = SCSI_ERR_RECOVERED;
18006 		si.ssi_pfa_flag = FALSE;
18007 	}
18008 
18009 	if (pktp->pkt_resid == 0) {
18010 		sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18011 		sd_return_command(un, bp);
18012 		return;
18013 	}
18014 
18015 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18016 	    &si, EIO, (clock_t)0, NULL);
18017 }
18018 
18019 
18020 
18021 
18022 /*
18023  *    Function: sd_sense_key_not_ready
18024  *
18025  * Description: Recovery actions for a SCSI "Not Ready" sense key.
18026  *
18027  *     Context: May be called from interrupt context
18028  */
18029 
18030 static void
18031 sd_sense_key_not_ready(struct sd_lun *un,
18032 	uint8_t *sense_datap,
18033 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp)
18034 {
18035 	struct sd_sense_info	si;
18036 	uint8_t asc = scsi_sense_asc(sense_datap);
18037 	uint8_t ascq = scsi_sense_ascq(sense_datap);
18038 
18039 	ASSERT(un != NULL);
18040 	ASSERT(mutex_owned(SD_MUTEX(un)));
18041 	ASSERT(bp != NULL);
18042 	ASSERT(xp != NULL);
18043 	ASSERT(pktp != NULL);
18044 
18045 	si.ssi_severity = SCSI_ERR_FATAL;
18046 	si.ssi_pfa_flag = FALSE;
18047 
18048 	/*
18049 	 * Update error stats after first NOT READY error. Disks may have
18050 	 * been powered down and may need to be restarted.  For CDROMs,
18051 	 * report NOT READY errors only if media is present.
18052 	 */
18053 	if ((ISCD(un) && (asc == 0x3A)) ||
18054 	    (xp->xb_nr_retry_count > 0)) {
18055 		SD_UPDATE_ERRSTATS(un, sd_harderrs);
18056 		SD_UPDATE_ERRSTATS(un, sd_rq_ntrdy_err);
18057 	}
18058 
18059 	/*
18060 	 * Just fail if the "not ready" retry limit has been reached.
18061 	 */
18062 	if (xp->xb_nr_retry_count >= un->un_notready_retry_count) {
18063 		/* Special check for error message printing for removables. */
18064 		if (un->un_f_has_removable_media && (asc == 0x04) &&
18065 		    (ascq >= 0x04)) {
18066 			si.ssi_severity = SCSI_ERR_ALL;
18067 		}
18068 		goto fail_command;
18069 	}
18070 
18071 	/*
18072 	 * Check the ASC and ASCQ in the sense data as needed, to determine
18073 	 * what to do.
18074 	 */
18075 	switch (asc) {
18076 	case 0x04:	/* LOGICAL UNIT NOT READY */
18077 		/*
18078 		 * disk drives that don't spin up result in a very long delay
18079 		 * in format without warning messages. We will log a message
18080 		 * if the error level is set to verbose.
18081 		 */
18082 		if (sd_error_level < SCSI_ERR_RETRYABLE) {
18083 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18084 			    "logical unit not ready, resetting disk\n");
18085 		}
18086 
18087 		/*
18088 		 * There are different requirements for CDROMs and disks for
18089 		 * the number of retries.  If a CD-ROM is giving this, it is
18090 		 * probably reading TOC and is in the process of getting
18091 		 * ready, so we should keep on trying for a long time to make
18092 		 * sure that all types of media are taken in account (for
18093 		 * some media the drive takes a long time to read TOC).  For
18094 		 * disks we do not want to retry this too many times as this
18095 		 * can cause a long hang in format when the drive refuses to
18096 		 * spin up (a very common failure).
18097 		 */
18098 		switch (ascq) {
18099 		case 0x00:  /* LUN NOT READY, CAUSE NOT REPORTABLE */
18100 			/*
18101 			 * Disk drives frequently refuse to spin up which
18102 			 * results in a very long hang in format without
18103 			 * warning messages.
18104 			 *
18105 			 * Note: This code preserves the legacy behavior of
18106 			 * comparing xb_nr_retry_count against zero for fibre
18107 			 * channel targets instead of comparing against the
18108 			 * un_reset_retry_count value.  The reason for this
18109 			 * discrepancy has been so utterly lost beneath the
18110 			 * Sands of Time that even Indiana Jones could not
18111 			 * find it.
18112 			 */
18113 			if (un->un_f_is_fibre == TRUE) {
18114 				if (((sd_level_mask & SD_LOGMASK_DIAG) ||
18115 				    (xp->xb_nr_retry_count > 0)) &&
18116 				    (un->un_startstop_timeid == NULL)) {
18117 					scsi_log(SD_DEVINFO(un), sd_label,
18118 					    CE_WARN, "logical unit not ready, "
18119 					    "resetting disk\n");
18120 					sd_reset_target(un, pktp);
18121 				}
18122 			} else {
18123 				if (((sd_level_mask & SD_LOGMASK_DIAG) ||
18124 				    (xp->xb_nr_retry_count >
18125 				    un->un_reset_retry_count)) &&
18126 				    (un->un_startstop_timeid == NULL)) {
18127 					scsi_log(SD_DEVINFO(un), sd_label,
18128 					    CE_WARN, "logical unit not ready, "
18129 					    "resetting disk\n");
18130 					sd_reset_target(un, pktp);
18131 				}
18132 			}
18133 			break;
18134 
18135 		case 0x01:  /* LUN IS IN PROCESS OF BECOMING READY */
18136 			/*
18137 			 * If the target is in the process of becoming
18138 			 * ready, just proceed with the retry. This can
18139 			 * happen with CD-ROMs that take a long time to
18140 			 * read TOC after a power cycle or reset.
18141 			 */
18142 			goto do_retry;
18143 
18144 		case 0x02:  /* LUN NOT READY, INITITIALIZING CMD REQUIRED */
18145 			break;
18146 
18147 		case 0x03:  /* LUN NOT READY, MANUAL INTERVENTION REQUIRED */
18148 			/*
18149 			 * Retries cannot help here so just fail right away.
18150 			 */
18151 			goto fail_command;
18152 
18153 		case 0x88:
18154 			/*
18155 			 * Vendor-unique code for T3/T4: it indicates a
18156 			 * path problem in a mutipathed config, but as far as
18157 			 * the target driver is concerned it equates to a fatal
18158 			 * error, so we should just fail the command right away
18159 			 * (without printing anything to the console). If this
18160 			 * is not a T3/T4, fall thru to the default recovery
18161 			 * action.
18162 			 * T3/T4 is FC only, don't need to check is_fibre
18163 			 */
18164 			if (SD_IS_T3(un) || SD_IS_T4(un)) {
18165 				sd_return_failed_command(un, bp, EIO);
18166 				return;
18167 			}
18168 			/* FALLTHRU */
18169 
18170 		case 0x04:  /* LUN NOT READY, FORMAT IN PROGRESS */
18171 		case 0x05:  /* LUN NOT READY, REBUILD IN PROGRESS */
18172 		case 0x06:  /* LUN NOT READY, RECALCULATION IN PROGRESS */
18173 		case 0x07:  /* LUN NOT READY, OPERATION IN PROGRESS */
18174 		case 0x08:  /* LUN NOT READY, LONG WRITE IN PROGRESS */
18175 		default:    /* Possible future codes in SCSI spec? */
18176 			/*
18177 			 * For removable-media devices, do not retry if
18178 			 * ASCQ > 2 as these result mostly from USCSI commands
18179 			 * on MMC devices issued to check status of an
18180 			 * operation initiated in immediate mode.  Also for
18181 			 * ASCQ >= 4 do not print console messages as these
18182 			 * mainly represent a user-initiated operation
18183 			 * instead of a system failure.
18184 			 */
18185 			if (un->un_f_has_removable_media) {
18186 				si.ssi_severity = SCSI_ERR_ALL;
18187 				goto fail_command;
18188 			}
18189 			break;
18190 		}
18191 
18192 		/*
18193 		 * As part of our recovery attempt for the NOT READY
18194 		 * condition, we issue a START STOP UNIT command. However
18195 		 * we want to wait for a short delay before attempting this
18196 		 * as there may still be more commands coming back from the
18197 		 * target with the check condition. To do this we use
18198 		 * timeout(9F) to call sd_start_stop_unit_callback() after
18199 		 * the delay interval expires. (sd_start_stop_unit_callback()
18200 		 * dispatches sd_start_stop_unit_task(), which will issue
18201 		 * the actual START STOP UNIT command. The delay interval
18202 		 * is one-half of the delay that we will use to retry the
18203 		 * command that generated the NOT READY condition.
18204 		 *
18205 		 * Note that we could just dispatch sd_start_stop_unit_task()
18206 		 * from here and allow it to sleep for the delay interval,
18207 		 * but then we would be tying up the taskq thread
18208 		 * uncesessarily for the duration of the delay.
18209 		 *
18210 		 * Do not issue the START STOP UNIT if the current command
18211 		 * is already a START STOP UNIT.
18212 		 */
18213 		if (pktp->pkt_cdbp[0] == SCMD_START_STOP) {
18214 			break;
18215 		}
18216 
18217 		/*
18218 		 * Do not schedule the timeout if one is already pending.
18219 		 */
18220 		if (un->un_startstop_timeid != NULL) {
18221 			SD_INFO(SD_LOG_ERROR, un,
18222 			    "sd_sense_key_not_ready: restart already issued to"
18223 			    " %s%d\n", ddi_driver_name(SD_DEVINFO(un)),
18224 			    ddi_get_instance(SD_DEVINFO(un)));
18225 			break;
18226 		}
18227 
18228 		/*
18229 		 * Schedule the START STOP UNIT command, then queue the command
18230 		 * for a retry.
18231 		 *
18232 		 * Note: A timeout is not scheduled for this retry because we
18233 		 * want the retry to be serial with the START_STOP_UNIT. The
18234 		 * retry will be started when the START_STOP_UNIT is completed
18235 		 * in sd_start_stop_unit_task.
18236 		 */
18237 		un->un_startstop_timeid = timeout(sd_start_stop_unit_callback,
18238 		    un, un->un_busy_timeout / 2);
18239 		xp->xb_nr_retry_count++;
18240 		sd_set_retry_bp(un, bp, 0, kstat_waitq_enter);
18241 		return;
18242 
18243 	case 0x05:	/* LOGICAL UNIT DOES NOT RESPOND TO SELECTION */
18244 		if (sd_error_level < SCSI_ERR_RETRYABLE) {
18245 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18246 			    "unit does not respond to selection\n");
18247 		}
18248 		break;
18249 
18250 	case 0x3A:	/* MEDIUM NOT PRESENT */
18251 		if (sd_error_level >= SCSI_ERR_FATAL) {
18252 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18253 			    "Caddy not inserted in drive\n");
18254 		}
18255 
18256 		sr_ejected(un);
18257 		un->un_mediastate = DKIO_EJECTED;
18258 		/* The state has changed, inform the media watch routines */
18259 		cv_broadcast(&un->un_state_cv);
18260 		/* Just fail if no media is present in the drive. */
18261 		goto fail_command;
18262 
18263 	default:
18264 		if (sd_error_level < SCSI_ERR_RETRYABLE) {
18265 			scsi_log(SD_DEVINFO(un), sd_label, CE_NOTE,
18266 			    "Unit not Ready. Additional sense code 0x%x\n",
18267 			    asc);
18268 		}
18269 		break;
18270 	}
18271 
18272 do_retry:
18273 
18274 	/*
18275 	 * Retry the command, as some targets may report NOT READY for
18276 	 * several seconds after being reset.
18277 	 */
18278 	xp->xb_nr_retry_count++;
18279 	si.ssi_severity = SCSI_ERR_RETRYABLE;
18280 	sd_retry_command(un, bp, SD_RETRIES_NOCHECK, sd_print_sense_msg,
18281 	    &si, EIO, un->un_busy_timeout, NULL);
18282 
18283 	return;
18284 
18285 fail_command:
18286 	sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18287 	sd_return_failed_command(un, bp, EIO);
18288 }
18289 
18290 
18291 
18292 /*
18293  *    Function: sd_sense_key_medium_or_hardware_error
18294  *
18295  * Description: Recovery actions for a SCSI "Medium Error" or "Hardware Error"
18296  *		sense key.
18297  *
18298  *     Context: May be called from interrupt context
18299  */
18300 
18301 static void
18302 sd_sense_key_medium_or_hardware_error(struct sd_lun *un,
18303 	uint8_t *sense_datap,
18304 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp)
18305 {
18306 	struct sd_sense_info	si;
18307 	uint8_t sense_key = scsi_sense_key(sense_datap);
18308 	uint8_t asc = scsi_sense_asc(sense_datap);
18309 
18310 	ASSERT(un != NULL);
18311 	ASSERT(mutex_owned(SD_MUTEX(un)));
18312 	ASSERT(bp != NULL);
18313 	ASSERT(xp != NULL);
18314 	ASSERT(pktp != NULL);
18315 
18316 	si.ssi_severity = SCSI_ERR_FATAL;
18317 	si.ssi_pfa_flag = FALSE;
18318 
18319 	if (sense_key == KEY_MEDIUM_ERROR) {
18320 		SD_UPDATE_ERRSTATS(un, sd_rq_media_err);
18321 	}
18322 
18323 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
18324 
18325 	if ((un->un_reset_retry_count != 0) &&
18326 	    (xp->xb_retry_count == un->un_reset_retry_count)) {
18327 		mutex_exit(SD_MUTEX(un));
18328 		/* Do NOT do a RESET_ALL here: too intrusive. (4112858) */
18329 		if (un->un_f_allow_bus_device_reset == TRUE) {
18330 
18331 			boolean_t try_resetting_target = B_TRUE;
18332 
18333 			/*
18334 			 * We need to be able to handle specific ASC when we are
18335 			 * handling a KEY_HARDWARE_ERROR. In particular
18336 			 * taking the default action of resetting the target may
18337 			 * not be the appropriate way to attempt recovery.
18338 			 * Resetting a target because of a single LUN failure
18339 			 * victimizes all LUNs on that target.
18340 			 *
18341 			 * This is true for the LSI arrays, if an LSI
18342 			 * array controller returns an ASC of 0x84 (LUN Dead) we
18343 			 * should trust it.
18344 			 */
18345 
18346 			if (sense_key == KEY_HARDWARE_ERROR) {
18347 				switch (asc) {
18348 				case 0x84:
18349 					if (SD_IS_LSI(un)) {
18350 						try_resetting_target = B_FALSE;
18351 					}
18352 					break;
18353 				default:
18354 					break;
18355 				}
18356 			}
18357 
18358 			if (try_resetting_target == B_TRUE) {
18359 				int reset_retval = 0;
18360 				if (un->un_f_lun_reset_enabled == TRUE) {
18361 					SD_TRACE(SD_LOG_IO_CORE, un,
18362 					    "sd_sense_key_medium_or_hardware_"
18363 					    "error: issuing RESET_LUN\n");
18364 					reset_retval =
18365 					    scsi_reset(SD_ADDRESS(un),
18366 					    RESET_LUN);
18367 				}
18368 				if (reset_retval == 0) {
18369 					SD_TRACE(SD_LOG_IO_CORE, un,
18370 					    "sd_sense_key_medium_or_hardware_"
18371 					    "error: issuing RESET_TARGET\n");
18372 					(void) scsi_reset(SD_ADDRESS(un),
18373 					    RESET_TARGET);
18374 				}
18375 			}
18376 		}
18377 		mutex_enter(SD_MUTEX(un));
18378 	}
18379 
18380 	/*
18381 	 * This really ought to be a fatal error, but we will retry anyway
18382 	 * as some drives report this as a spurious error.
18383 	 */
18384 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18385 	    &si, EIO, (clock_t)0, NULL);
18386 }
18387 
18388 
18389 
18390 /*
18391  *    Function: sd_sense_key_illegal_request
18392  *
18393  * Description: Recovery actions for a SCSI "Illegal Request" sense key.
18394  *
18395  *     Context: May be called from interrupt context
18396  */
18397 
18398 static void
18399 sd_sense_key_illegal_request(struct sd_lun *un, struct buf *bp,
18400 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
18401 {
18402 	struct sd_sense_info	si;
18403 
18404 	ASSERT(un != NULL);
18405 	ASSERT(mutex_owned(SD_MUTEX(un)));
18406 	ASSERT(bp != NULL);
18407 	ASSERT(xp != NULL);
18408 	ASSERT(pktp != NULL);
18409 
18410 	SD_UPDATE_ERRSTATS(un, sd_rq_illrq_err);
18411 
18412 	si.ssi_severity = SCSI_ERR_INFO;
18413 	si.ssi_pfa_flag = FALSE;
18414 
18415 	/* Pointless to retry if the target thinks it's an illegal request */
18416 	sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18417 	sd_return_failed_command(un, bp, EIO);
18418 }
18419 
18420 
18421 
18422 
18423 /*
18424  *    Function: sd_sense_key_unit_attention
18425  *
18426  * Description: Recovery actions for a SCSI "Unit Attention" sense key.
18427  *
18428  *     Context: May be called from interrupt context
18429  */
18430 
18431 static void
18432 sd_sense_key_unit_attention(struct sd_lun *un,
18433 	uint8_t *sense_datap,
18434 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp)
18435 {
18436 	/*
18437 	 * For UNIT ATTENTION we allow retries for one minute. Devices
18438 	 * like Sonoma can return UNIT ATTENTION close to a minute
18439 	 * under certain conditions.
18440 	 */
18441 	int	retry_check_flag = SD_RETRIES_UA;
18442 	boolean_t	kstat_updated = B_FALSE;
18443 	struct	sd_sense_info		si;
18444 	uint8_t asc = scsi_sense_asc(sense_datap);
18445 	uint8_t	ascq = scsi_sense_ascq(sense_datap);
18446 
18447 	ASSERT(un != NULL);
18448 	ASSERT(mutex_owned(SD_MUTEX(un)));
18449 	ASSERT(bp != NULL);
18450 	ASSERT(xp != NULL);
18451 	ASSERT(pktp != NULL);
18452 
18453 	si.ssi_severity = SCSI_ERR_INFO;
18454 	si.ssi_pfa_flag = FALSE;
18455 
18456 
18457 	switch (asc) {
18458 	case 0x5D:  /* FAILURE PREDICTION THRESHOLD EXCEEDED */
18459 		if (sd_report_pfa != 0) {
18460 			SD_UPDATE_ERRSTATS(un, sd_rq_pfa_err);
18461 			si.ssi_pfa_flag = TRUE;
18462 			retry_check_flag = SD_RETRIES_STANDARD;
18463 			goto do_retry;
18464 		}
18465 
18466 		break;
18467 
18468 	case 0x29:  /* POWER ON, RESET, OR BUS DEVICE RESET OCCURRED */
18469 		if ((un->un_resvd_status & SD_RESERVE) == SD_RESERVE) {
18470 			un->un_resvd_status |=
18471 			    (SD_LOST_RESERVE | SD_WANT_RESERVE);
18472 		}
18473 #ifdef _LP64
18474 		if (un->un_blockcount + 1 > SD_GROUP1_MAX_ADDRESS) {
18475 			if (taskq_dispatch(sd_tq, sd_reenable_dsense_task,
18476 			    un, KM_NOSLEEP) == 0) {
18477 				/*
18478 				 * If we can't dispatch the task we'll just
18479 				 * live without descriptor sense.  We can
18480 				 * try again on the next "unit attention"
18481 				 */
18482 				SD_ERROR(SD_LOG_ERROR, un,
18483 				    "sd_sense_key_unit_attention: "
18484 				    "Could not dispatch "
18485 				    "sd_reenable_dsense_task\n");
18486 			}
18487 		}
18488 #endif /* _LP64 */
18489 		/* FALLTHRU */
18490 
18491 	case 0x28: /* NOT READY TO READY CHANGE, MEDIUM MAY HAVE CHANGED */
18492 		if (!un->un_f_has_removable_media) {
18493 			break;
18494 		}
18495 
18496 		/*
18497 		 * When we get a unit attention from a removable-media device,
18498 		 * it may be in a state that will take a long time to recover
18499 		 * (e.g., from a reset).  Since we are executing in interrupt
18500 		 * context here, we cannot wait around for the device to come
18501 		 * back. So hand this command off to sd_media_change_task()
18502 		 * for deferred processing under taskq thread context. (Note
18503 		 * that the command still may be failed if a problem is
18504 		 * encountered at a later time.)
18505 		 */
18506 		if (taskq_dispatch(sd_tq, sd_media_change_task, pktp,
18507 		    KM_NOSLEEP) == 0) {
18508 			/*
18509 			 * Cannot dispatch the request so fail the command.
18510 			 */
18511 			SD_UPDATE_ERRSTATS(un, sd_harderrs);
18512 			SD_UPDATE_ERRSTATS(un, sd_rq_nodev_err);
18513 			si.ssi_severity = SCSI_ERR_FATAL;
18514 			sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18515 			sd_return_failed_command(un, bp, EIO);
18516 		}
18517 
18518 		/*
18519 		 * If failed to dispatch sd_media_change_task(), we already
18520 		 * updated kstat. If succeed to dispatch sd_media_change_task(),
18521 		 * we should update kstat later if it encounters an error. So,
18522 		 * we update kstat_updated flag here.
18523 		 */
18524 		kstat_updated = B_TRUE;
18525 
18526 		/*
18527 		 * Either the command has been successfully dispatched to a
18528 		 * task Q for retrying, or the dispatch failed. In either case
18529 		 * do NOT retry again by calling sd_retry_command. This sets up
18530 		 * two retries of the same command and when one completes and
18531 		 * frees the resources the other will access freed memory,
18532 		 * a bad thing.
18533 		 */
18534 		return;
18535 
18536 	default:
18537 		break;
18538 	}
18539 
18540 	/*
18541 	 * ASC  ASCQ
18542 	 *  2A   09	Capacity data has changed
18543 	 *  2A   01	Mode parameters changed
18544 	 *  3F   0E	Reported luns data has changed
18545 	 * Arrays that support logical unit expansion should report
18546 	 * capacity changes(2Ah/09). Mode parameters changed and
18547 	 * reported luns data has changed are the approximation.
18548 	 */
18549 	if (((asc == 0x2a) && (ascq == 0x09)) ||
18550 	    ((asc == 0x2a) && (ascq == 0x01)) ||
18551 	    ((asc == 0x3f) && (ascq == 0x0e))) {
18552 		if (taskq_dispatch(sd_tq, sd_target_change_task, un,
18553 		    KM_NOSLEEP) == 0) {
18554 			SD_ERROR(SD_LOG_ERROR, un,
18555 			    "sd_sense_key_unit_attention: "
18556 			    "Could not dispatch sd_target_change_task\n");
18557 		}
18558 	}
18559 
18560 	/*
18561 	 * Update kstat if we haven't done that.
18562 	 */
18563 	if (!kstat_updated) {
18564 		SD_UPDATE_ERRSTATS(un, sd_harderrs);
18565 		SD_UPDATE_ERRSTATS(un, sd_rq_nodev_err);
18566 	}
18567 
18568 do_retry:
18569 	sd_retry_command(un, bp, retry_check_flag, sd_print_sense_msg, &si,
18570 	    EIO, SD_UA_RETRY_DELAY, NULL);
18571 }
18572 
18573 
18574 
18575 /*
18576  *    Function: sd_sense_key_fail_command
18577  *
18578  * Description: Use to fail a command when we don't like the sense key that
18579  *		was returned.
18580  *
18581  *     Context: May be called from interrupt context
18582  */
18583 
18584 static void
18585 sd_sense_key_fail_command(struct sd_lun *un, struct buf *bp,
18586 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
18587 {
18588 	struct sd_sense_info	si;
18589 
18590 	ASSERT(un != NULL);
18591 	ASSERT(mutex_owned(SD_MUTEX(un)));
18592 	ASSERT(bp != NULL);
18593 	ASSERT(xp != NULL);
18594 	ASSERT(pktp != NULL);
18595 
18596 	si.ssi_severity = SCSI_ERR_FATAL;
18597 	si.ssi_pfa_flag = FALSE;
18598 
18599 	sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18600 	sd_return_failed_command(un, bp, EIO);
18601 }
18602 
18603 
18604 
18605 /*
18606  *    Function: sd_sense_key_blank_check
18607  *
18608  * Description: Recovery actions for a SCSI "Blank Check" sense key.
18609  *		Has no monetary connotation.
18610  *
18611  *     Context: May be called from interrupt context
18612  */
18613 
18614 static void
18615 sd_sense_key_blank_check(struct sd_lun *un, struct buf *bp,
18616 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
18617 {
18618 	struct sd_sense_info	si;
18619 
18620 	ASSERT(un != NULL);
18621 	ASSERT(mutex_owned(SD_MUTEX(un)));
18622 	ASSERT(bp != NULL);
18623 	ASSERT(xp != NULL);
18624 	ASSERT(pktp != NULL);
18625 
18626 	/*
18627 	 * Blank check is not fatal for removable devices, therefore
18628 	 * it does not require a console message.
18629 	 */
18630 	si.ssi_severity = (un->un_f_has_removable_media) ? SCSI_ERR_ALL :
18631 	    SCSI_ERR_FATAL;
18632 	si.ssi_pfa_flag = FALSE;
18633 
18634 	sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
18635 	sd_return_failed_command(un, bp, EIO);
18636 }
18637 
18638 
18639 
18640 
18641 /*
18642  *    Function: sd_sense_key_aborted_command
18643  *
18644  * Description: Recovery actions for a SCSI "Aborted Command" sense key.
18645  *
18646  *     Context: May be called from interrupt context
18647  */
18648 
18649 static void
18650 sd_sense_key_aborted_command(struct sd_lun *un, struct buf *bp,
18651 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
18652 {
18653 	struct sd_sense_info	si;
18654 
18655 	ASSERT(un != NULL);
18656 	ASSERT(mutex_owned(SD_MUTEX(un)));
18657 	ASSERT(bp != NULL);
18658 	ASSERT(xp != NULL);
18659 	ASSERT(pktp != NULL);
18660 
18661 	si.ssi_severity = SCSI_ERR_FATAL;
18662 	si.ssi_pfa_flag = FALSE;
18663 
18664 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
18665 
18666 	/*
18667 	 * This really ought to be a fatal error, but we will retry anyway
18668 	 * as some drives report this as a spurious error.
18669 	 */
18670 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18671 	    &si, EIO, drv_usectohz(100000), NULL);
18672 }
18673 
18674 
18675 
18676 /*
18677  *    Function: sd_sense_key_default
18678  *
18679  * Description: Default recovery action for several SCSI sense keys (basically
18680  *		attempts a retry).
18681  *
18682  *     Context: May be called from interrupt context
18683  */
18684 
18685 static void
18686 sd_sense_key_default(struct sd_lun *un,
18687 	uint8_t *sense_datap,
18688 	struct buf *bp, struct sd_xbuf *xp, struct scsi_pkt *pktp)
18689 {
18690 	struct sd_sense_info	si;
18691 	uint8_t sense_key = scsi_sense_key(sense_datap);
18692 
18693 	ASSERT(un != NULL);
18694 	ASSERT(mutex_owned(SD_MUTEX(un)));
18695 	ASSERT(bp != NULL);
18696 	ASSERT(xp != NULL);
18697 	ASSERT(pktp != NULL);
18698 
18699 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
18700 
18701 	/*
18702 	 * Undecoded sense key.	Attempt retries and hope that will fix
18703 	 * the problem.  Otherwise, we're dead.
18704 	 */
18705 	if ((pktp->pkt_flags & FLAG_SILENT) == 0) {
18706 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18707 		    "Unhandled Sense Key '%s'\n", sense_keys[sense_key]);
18708 	}
18709 
18710 	si.ssi_severity = SCSI_ERR_FATAL;
18711 	si.ssi_pfa_flag = FALSE;
18712 
18713 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, sd_print_sense_msg,
18714 	    &si, EIO, (clock_t)0, NULL);
18715 }
18716 
18717 
18718 
18719 /*
18720  *    Function: sd_print_retry_msg
18721  *
18722  * Description: Print a message indicating the retry action being taken.
18723  *
18724  *   Arguments: un - ptr to associated softstate
18725  *		bp - ptr to buf(9S) for the command
18726  *		arg - not used.
18727  *		flag - SD_IMMEDIATE_RETRY_ISSUED, SD_DELAYED_RETRY_ISSUED,
18728  *			or SD_NO_RETRY_ISSUED
18729  *
18730  *     Context: May be called from interrupt context
18731  */
18732 /* ARGSUSED */
18733 static void
18734 sd_print_retry_msg(struct sd_lun *un, struct buf *bp, void *arg, int flag)
18735 {
18736 	struct sd_xbuf	*xp;
18737 	struct scsi_pkt *pktp;
18738 	char *reasonp;
18739 	char *msgp;
18740 
18741 	ASSERT(un != NULL);
18742 	ASSERT(mutex_owned(SD_MUTEX(un)));
18743 	ASSERT(bp != NULL);
18744 	pktp = SD_GET_PKTP(bp);
18745 	ASSERT(pktp != NULL);
18746 	xp = SD_GET_XBUF(bp);
18747 	ASSERT(xp != NULL);
18748 
18749 	ASSERT(!mutex_owned(&un->un_pm_mutex));
18750 	mutex_enter(&un->un_pm_mutex);
18751 	if ((un->un_state == SD_STATE_SUSPENDED) ||
18752 	    (SD_DEVICE_IS_IN_LOW_POWER(un)) ||
18753 	    (pktp->pkt_flags & FLAG_SILENT)) {
18754 		mutex_exit(&un->un_pm_mutex);
18755 		goto update_pkt_reason;
18756 	}
18757 	mutex_exit(&un->un_pm_mutex);
18758 
18759 	/*
18760 	 * Suppress messages if they are all the same pkt_reason; with
18761 	 * TQ, many (up to 256) are returned with the same pkt_reason.
18762 	 * If we are in panic, then suppress the retry messages.
18763 	 */
18764 	switch (flag) {
18765 	case SD_NO_RETRY_ISSUED:
18766 		msgp = "giving up";
18767 		break;
18768 	case SD_IMMEDIATE_RETRY_ISSUED:
18769 	case SD_DELAYED_RETRY_ISSUED:
18770 		if (ddi_in_panic() || (un->un_state == SD_STATE_OFFLINE) ||
18771 		    ((pktp->pkt_reason == un->un_last_pkt_reason) &&
18772 		    (sd_error_level != SCSI_ERR_ALL))) {
18773 			return;
18774 		}
18775 		msgp = "retrying command";
18776 		break;
18777 	default:
18778 		goto update_pkt_reason;
18779 	}
18780 
18781 	reasonp = (((pktp->pkt_statistics & STAT_PERR) != 0) ? "parity error" :
18782 	    scsi_rname(pktp->pkt_reason));
18783 
18784 	if (SD_FM_LOG(un) == SD_FM_LOG_NSUP) {
18785 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18786 		    "SCSI transport failed: reason '%s': %s\n", reasonp, msgp);
18787 	}
18788 
18789 update_pkt_reason:
18790 	/*
18791 	 * Update un->un_last_pkt_reason with the value in pktp->pkt_reason.
18792 	 * This is to prevent multiple console messages for the same failure
18793 	 * condition.  Note that un->un_last_pkt_reason is NOT restored if &
18794 	 * when the command is retried successfully because there still may be
18795 	 * more commands coming back with the same value of pktp->pkt_reason.
18796 	 */
18797 	if ((pktp->pkt_reason != CMD_CMPLT) || (xp->xb_retry_count == 0)) {
18798 		un->un_last_pkt_reason = pktp->pkt_reason;
18799 	}
18800 }
18801 
18802 
18803 /*
18804  *    Function: sd_print_cmd_incomplete_msg
18805  *
18806  * Description: Message logging fn. for a SCSA "CMD_INCOMPLETE" pkt_reason.
18807  *
18808  *   Arguments: un - ptr to associated softstate
18809  *		bp - ptr to buf(9S) for the command
18810  *		arg - passed to sd_print_retry_msg()
18811  *		code - SD_IMMEDIATE_RETRY_ISSUED, SD_DELAYED_RETRY_ISSUED,
18812  *			or SD_NO_RETRY_ISSUED
18813  *
18814  *     Context: May be called from interrupt context
18815  */
18816 
18817 static void
18818 sd_print_cmd_incomplete_msg(struct sd_lun *un, struct buf *bp, void *arg,
18819 	int code)
18820 {
18821 	dev_info_t	*dip;
18822 
18823 	ASSERT(un != NULL);
18824 	ASSERT(mutex_owned(SD_MUTEX(un)));
18825 	ASSERT(bp != NULL);
18826 
18827 	switch (code) {
18828 	case SD_NO_RETRY_ISSUED:
18829 		/* Command was failed. Someone turned off this target? */
18830 		if (un->un_state != SD_STATE_OFFLINE) {
18831 			/*
18832 			 * Suppress message if we are detaching and
18833 			 * device has been disconnected
18834 			 * Note that DEVI_IS_DEVICE_REMOVED is a consolidation
18835 			 * private interface and not part of the DDI
18836 			 */
18837 			dip = un->un_sd->sd_dev;
18838 			if (!(DEVI_IS_DETACHING(dip) &&
18839 			    DEVI_IS_DEVICE_REMOVED(dip))) {
18840 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
18841 				"disk not responding to selection\n");
18842 			}
18843 			New_state(un, SD_STATE_OFFLINE);
18844 		}
18845 		break;
18846 
18847 	case SD_DELAYED_RETRY_ISSUED:
18848 	case SD_IMMEDIATE_RETRY_ISSUED:
18849 	default:
18850 		/* Command was successfully queued for retry */
18851 		sd_print_retry_msg(un, bp, arg, code);
18852 		break;
18853 	}
18854 }
18855 
18856 
18857 /*
18858  *    Function: sd_pkt_reason_cmd_incomplete
18859  *
18860  * Description: Recovery actions for a SCSA "CMD_INCOMPLETE" pkt_reason.
18861  *
18862  *     Context: May be called from interrupt context
18863  */
18864 
18865 static void
18866 sd_pkt_reason_cmd_incomplete(struct sd_lun *un, struct buf *bp,
18867 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
18868 {
18869 	int flag = SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE;
18870 
18871 	ASSERT(un != NULL);
18872 	ASSERT(mutex_owned(SD_MUTEX(un)));
18873 	ASSERT(bp != NULL);
18874 	ASSERT(xp != NULL);
18875 	ASSERT(pktp != NULL);
18876 
18877 	/* Do not do a reset if selection did not complete */
18878 	/* Note: Should this not just check the bit? */
18879 	if (pktp->pkt_state != STATE_GOT_BUS) {
18880 		SD_UPDATE_ERRSTATS(un, sd_transerrs);
18881 		sd_reset_target(un, pktp);
18882 	}
18883 
18884 	/*
18885 	 * If the target was not successfully selected, then set
18886 	 * SD_RETRIES_FAILFAST to indicate that we lost communication
18887 	 * with the target, and further retries and/or commands are
18888 	 * likely to take a long time.
18889 	 */
18890 	if ((pktp->pkt_state & STATE_GOT_TARGET) == 0) {
18891 		flag |= SD_RETRIES_FAILFAST;
18892 	}
18893 
18894 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
18895 
18896 	sd_retry_command(un, bp, flag,
18897 	    sd_print_cmd_incomplete_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
18898 }
18899 
18900 
18901 
18902 /*
18903  *    Function: sd_pkt_reason_cmd_tran_err
18904  *
18905  * Description: Recovery actions for a SCSA "CMD_TRAN_ERR" pkt_reason.
18906  *
18907  *     Context: May be called from interrupt context
18908  */
18909 
18910 static void
18911 sd_pkt_reason_cmd_tran_err(struct sd_lun *un, struct buf *bp,
18912 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
18913 {
18914 	ASSERT(un != NULL);
18915 	ASSERT(mutex_owned(SD_MUTEX(un)));
18916 	ASSERT(bp != NULL);
18917 	ASSERT(xp != NULL);
18918 	ASSERT(pktp != NULL);
18919 
18920 	/*
18921 	 * Do not reset if we got a parity error, or if
18922 	 * selection did not complete.
18923 	 */
18924 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
18925 	/* Note: Should this not just check the bit for pkt_state? */
18926 	if (((pktp->pkt_statistics & STAT_PERR) == 0) &&
18927 	    (pktp->pkt_state != STATE_GOT_BUS)) {
18928 		SD_UPDATE_ERRSTATS(un, sd_transerrs);
18929 		sd_reset_target(un, pktp);
18930 	}
18931 
18932 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
18933 
18934 	sd_retry_command(un, bp, (SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE),
18935 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
18936 }
18937 
18938 
18939 
18940 /*
18941  *    Function: sd_pkt_reason_cmd_reset
18942  *
18943  * Description: Recovery actions for a SCSA "CMD_RESET" pkt_reason.
18944  *
18945  *     Context: May be called from interrupt context
18946  */
18947 
18948 static void
18949 sd_pkt_reason_cmd_reset(struct sd_lun *un, struct buf *bp,
18950 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
18951 {
18952 	ASSERT(un != NULL);
18953 	ASSERT(mutex_owned(SD_MUTEX(un)));
18954 	ASSERT(bp != NULL);
18955 	ASSERT(xp != NULL);
18956 	ASSERT(pktp != NULL);
18957 
18958 	/* The target may still be running the command, so try to reset. */
18959 	SD_UPDATE_ERRSTATS(un, sd_transerrs);
18960 	sd_reset_target(un, pktp);
18961 
18962 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
18963 
18964 	/*
18965 	 * If pkt_reason is CMD_RESET chances are that this pkt got
18966 	 * reset because another target on this bus caused it. The target
18967 	 * that caused it should get CMD_TIMEOUT with pkt_statistics
18968 	 * of STAT_TIMEOUT/STAT_DEV_RESET.
18969 	 */
18970 
18971 	sd_retry_command(un, bp, (SD_RETRIES_VICTIM | SD_RETRIES_ISOLATE),
18972 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
18973 }
18974 
18975 
18976 
18977 
18978 /*
18979  *    Function: sd_pkt_reason_cmd_aborted
18980  *
18981  * Description: Recovery actions for a SCSA "CMD_ABORTED" pkt_reason.
18982  *
18983  *     Context: May be called from interrupt context
18984  */
18985 
18986 static void
18987 sd_pkt_reason_cmd_aborted(struct sd_lun *un, struct buf *bp,
18988 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
18989 {
18990 	ASSERT(un != NULL);
18991 	ASSERT(mutex_owned(SD_MUTEX(un)));
18992 	ASSERT(bp != NULL);
18993 	ASSERT(xp != NULL);
18994 	ASSERT(pktp != NULL);
18995 
18996 	/* The target may still be running the command, so try to reset. */
18997 	SD_UPDATE_ERRSTATS(un, sd_transerrs);
18998 	sd_reset_target(un, pktp);
18999 
19000 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19001 
19002 	/*
19003 	 * If pkt_reason is CMD_ABORTED chances are that this pkt got
19004 	 * aborted because another target on this bus caused it. The target
19005 	 * that caused it should get CMD_TIMEOUT with pkt_statistics
19006 	 * of STAT_TIMEOUT/STAT_DEV_RESET.
19007 	 */
19008 
19009 	sd_retry_command(un, bp, (SD_RETRIES_VICTIM | SD_RETRIES_ISOLATE),
19010 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19011 }
19012 
19013 
19014 
19015 /*
19016  *    Function: sd_pkt_reason_cmd_timeout
19017  *
19018  * Description: Recovery actions for a SCSA "CMD_TIMEOUT" pkt_reason.
19019  *
19020  *     Context: May be called from interrupt context
19021  */
19022 
19023 static void
19024 sd_pkt_reason_cmd_timeout(struct sd_lun *un, struct buf *bp,
19025 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
19026 {
19027 	ASSERT(un != NULL);
19028 	ASSERT(mutex_owned(SD_MUTEX(un)));
19029 	ASSERT(bp != NULL);
19030 	ASSERT(xp != NULL);
19031 	ASSERT(pktp != NULL);
19032 
19033 
19034 	SD_UPDATE_ERRSTATS(un, sd_transerrs);
19035 	sd_reset_target(un, pktp);
19036 
19037 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19038 
19039 	/*
19040 	 * A command timeout indicates that we could not establish
19041 	 * communication with the target, so set SD_RETRIES_FAILFAST
19042 	 * as further retries/commands are likely to take a long time.
19043 	 */
19044 	sd_retry_command(un, bp,
19045 	    (SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE | SD_RETRIES_FAILFAST),
19046 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19047 }
19048 
19049 
19050 
19051 /*
19052  *    Function: sd_pkt_reason_cmd_unx_bus_free
19053  *
19054  * Description: Recovery actions for a SCSA "CMD_UNX_BUS_FREE" pkt_reason.
19055  *
19056  *     Context: May be called from interrupt context
19057  */
19058 
19059 static void
19060 sd_pkt_reason_cmd_unx_bus_free(struct sd_lun *un, struct buf *bp,
19061 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
19062 {
19063 	void (*funcp)(struct sd_lun *un, struct buf *bp, void *arg, int code);
19064 
19065 	ASSERT(un != NULL);
19066 	ASSERT(mutex_owned(SD_MUTEX(un)));
19067 	ASSERT(bp != NULL);
19068 	ASSERT(xp != NULL);
19069 	ASSERT(pktp != NULL);
19070 
19071 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
19072 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19073 
19074 	funcp = ((pktp->pkt_statistics & STAT_PERR) == 0) ?
19075 	    sd_print_retry_msg : NULL;
19076 
19077 	sd_retry_command(un, bp, (SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE),
19078 	    funcp, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19079 }
19080 
19081 
19082 /*
19083  *    Function: sd_pkt_reason_cmd_tag_reject
19084  *
19085  * Description: Recovery actions for a SCSA "CMD_TAG_REJECT" pkt_reason.
19086  *
19087  *     Context: May be called from interrupt context
19088  */
19089 
19090 static void
19091 sd_pkt_reason_cmd_tag_reject(struct sd_lun *un, struct buf *bp,
19092 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
19093 {
19094 	ASSERT(un != NULL);
19095 	ASSERT(mutex_owned(SD_MUTEX(un)));
19096 	ASSERT(bp != NULL);
19097 	ASSERT(xp != NULL);
19098 	ASSERT(pktp != NULL);
19099 
19100 	SD_UPDATE_ERRSTATS(un, sd_harderrs);
19101 	pktp->pkt_flags = 0;
19102 	un->un_tagflags = 0;
19103 	if (un->un_f_opt_queueing == TRUE) {
19104 		un->un_throttle = min(un->un_throttle, 3);
19105 	} else {
19106 		un->un_throttle = 1;
19107 	}
19108 	mutex_exit(SD_MUTEX(un));
19109 	(void) scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing", 0, 1);
19110 	mutex_enter(SD_MUTEX(un));
19111 
19112 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19113 
19114 	/* Legacy behavior not to check retry counts here. */
19115 	sd_retry_command(un, bp, (SD_RETRIES_NOCHECK | SD_RETRIES_ISOLATE),
19116 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19117 }
19118 
19119 
19120 /*
19121  *    Function: sd_pkt_reason_default
19122  *
19123  * Description: Default recovery actions for SCSA pkt_reason values that
19124  *		do not have more explicit recovery actions.
19125  *
19126  *     Context: May be called from interrupt context
19127  */
19128 
19129 static void
19130 sd_pkt_reason_default(struct sd_lun *un, struct buf *bp,
19131 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
19132 {
19133 	ASSERT(un != NULL);
19134 	ASSERT(mutex_owned(SD_MUTEX(un)));
19135 	ASSERT(bp != NULL);
19136 	ASSERT(xp != NULL);
19137 	ASSERT(pktp != NULL);
19138 
19139 	SD_UPDATE_ERRSTATS(un, sd_transerrs);
19140 	sd_reset_target(un, pktp);
19141 
19142 	SD_UPDATE_RESERVATION_STATUS(un, pktp);
19143 
19144 	sd_retry_command(un, bp, (SD_RETRIES_STANDARD | SD_RETRIES_ISOLATE),
19145 	    sd_print_retry_msg, NULL, EIO, SD_RESTART_TIMEOUT, NULL);
19146 }
19147 
19148 
19149 
19150 /*
19151  *    Function: sd_pkt_status_check_condition
19152  *
19153  * Description: Recovery actions for a "STATUS_CHECK" SCSI command status.
19154  *
19155  *     Context: May be called from interrupt context
19156  */
19157 
19158 static void
19159 sd_pkt_status_check_condition(struct sd_lun *un, struct buf *bp,
19160 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
19161 {
19162 	ASSERT(un != NULL);
19163 	ASSERT(mutex_owned(SD_MUTEX(un)));
19164 	ASSERT(bp != NULL);
19165 	ASSERT(xp != NULL);
19166 	ASSERT(pktp != NULL);
19167 
19168 	SD_TRACE(SD_LOG_IO, un, "sd_pkt_status_check_condition: "
19169 	    "entry: buf:0x%p xp:0x%p\n", bp, xp);
19170 
19171 	/*
19172 	 * If ARQ is NOT enabled, then issue a REQUEST SENSE command (the
19173 	 * command will be retried after the request sense). Otherwise, retry
19174 	 * the command. Note: we are issuing the request sense even though the
19175 	 * retry limit may have been reached for the failed command.
19176 	 */
19177 	if (un->un_f_arq_enabled == FALSE) {
19178 		SD_INFO(SD_LOG_IO_CORE, un, "sd_pkt_status_check_condition: "
19179 		    "no ARQ, sending request sense command\n");
19180 		sd_send_request_sense_command(un, bp, pktp);
19181 	} else {
19182 		SD_INFO(SD_LOG_IO_CORE, un, "sd_pkt_status_check_condition: "
19183 		    "ARQ,retrying request sense command\n");
19184 #if defined(__i386) || defined(__amd64)
19185 		/*
19186 		 * The SD_RETRY_DELAY value need to be adjusted here
19187 		 * when SD_RETRY_DELAY change in sddef.h
19188 		 */
19189 		sd_retry_command(un, bp, SD_RETRIES_STANDARD, NULL, NULL, EIO,
19190 		    un->un_f_is_fibre?drv_usectohz(100000):(clock_t)0,
19191 		    NULL);
19192 #else
19193 		sd_retry_command(un, bp, SD_RETRIES_STANDARD, NULL, NULL,
19194 		    EIO, SD_RETRY_DELAY, NULL);
19195 #endif
19196 	}
19197 
19198 	SD_TRACE(SD_LOG_IO_CORE, un, "sd_pkt_status_check_condition: exit\n");
19199 }
19200 
19201 
19202 /*
19203  *    Function: sd_pkt_status_busy
19204  *
19205  * Description: Recovery actions for a "STATUS_BUSY" SCSI command status.
19206  *
19207  *     Context: May be called from interrupt context
19208  */
19209 
19210 static void
19211 sd_pkt_status_busy(struct sd_lun *un, struct buf *bp, struct sd_xbuf *xp,
19212 	struct scsi_pkt *pktp)
19213 {
19214 	ASSERT(un != NULL);
19215 	ASSERT(mutex_owned(SD_MUTEX(un)));
19216 	ASSERT(bp != NULL);
19217 	ASSERT(xp != NULL);
19218 	ASSERT(pktp != NULL);
19219 
19220 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19221 	    "sd_pkt_status_busy: entry\n");
19222 
19223 	/* If retries are exhausted, just fail the command. */
19224 	if (xp->xb_retry_count >= un->un_busy_retry_count) {
19225 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
19226 		    "device busy too long\n");
19227 		sd_return_failed_command(un, bp, EIO);
19228 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19229 		    "sd_pkt_status_busy: exit\n");
19230 		return;
19231 	}
19232 	xp->xb_retry_count++;
19233 
19234 	/*
19235 	 * Try to reset the target. However, we do not want to perform
19236 	 * more than one reset if the device continues to fail. The reset
19237 	 * will be performed when the retry count reaches the reset
19238 	 * threshold.  This threshold should be set such that at least
19239 	 * one retry is issued before the reset is performed.
19240 	 */
19241 	if (xp->xb_retry_count ==
19242 	    ((un->un_reset_retry_count < 2) ? 2 : un->un_reset_retry_count)) {
19243 		int rval = 0;
19244 		mutex_exit(SD_MUTEX(un));
19245 		if (un->un_f_allow_bus_device_reset == TRUE) {
19246 			/*
19247 			 * First try to reset the LUN; if we cannot then
19248 			 * try to reset the target.
19249 			 */
19250 			if (un->un_f_lun_reset_enabled == TRUE) {
19251 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19252 				    "sd_pkt_status_busy: RESET_LUN\n");
19253 				rval = scsi_reset(SD_ADDRESS(un), RESET_LUN);
19254 			}
19255 			if (rval == 0) {
19256 				SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19257 				    "sd_pkt_status_busy: RESET_TARGET\n");
19258 				rval = scsi_reset(SD_ADDRESS(un), RESET_TARGET);
19259 			}
19260 		}
19261 		if (rval == 0) {
19262 			/*
19263 			 * If the RESET_LUN and/or RESET_TARGET failed,
19264 			 * try RESET_ALL
19265 			 */
19266 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19267 			    "sd_pkt_status_busy: RESET_ALL\n");
19268 			rval = scsi_reset(SD_ADDRESS(un), RESET_ALL);
19269 		}
19270 		mutex_enter(SD_MUTEX(un));
19271 		if (rval == 0) {
19272 			/*
19273 			 * The RESET_LUN, RESET_TARGET, and/or RESET_ALL failed.
19274 			 * At this point we give up & fail the command.
19275 			 */
19276 			sd_return_failed_command(un, bp, EIO);
19277 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19278 			    "sd_pkt_status_busy: exit (failed cmd)\n");
19279 			return;
19280 		}
19281 	}
19282 
19283 	/*
19284 	 * Retry the command. Be sure to specify SD_RETRIES_NOCHECK as
19285 	 * we have already checked the retry counts above.
19286 	 */
19287 	sd_retry_command(un, bp, SD_RETRIES_NOCHECK, NULL, NULL,
19288 	    EIO, un->un_busy_timeout, NULL);
19289 
19290 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19291 	    "sd_pkt_status_busy: exit\n");
19292 }
19293 
19294 
19295 /*
19296  *    Function: sd_pkt_status_reservation_conflict
19297  *
19298  * Description: Recovery actions for a "STATUS_RESERVATION_CONFLICT" SCSI
19299  *		command status.
19300  *
19301  *     Context: May be called from interrupt context
19302  */
19303 
19304 static void
19305 sd_pkt_status_reservation_conflict(struct sd_lun *un, struct buf *bp,
19306 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
19307 {
19308 	ASSERT(un != NULL);
19309 	ASSERT(mutex_owned(SD_MUTEX(un)));
19310 	ASSERT(bp != NULL);
19311 	ASSERT(xp != NULL);
19312 	ASSERT(pktp != NULL);
19313 
19314 	/*
19315 	 * If the command was PERSISTENT_RESERVATION_[IN|OUT] then reservation
19316 	 * conflict could be due to various reasons like incorrect keys, not
19317 	 * registered or not reserved etc. So, we return EACCES to the caller.
19318 	 */
19319 	if (un->un_reservation_type == SD_SCSI3_RESERVATION) {
19320 		int cmd = SD_GET_PKT_OPCODE(pktp);
19321 		if ((cmd == SCMD_PERSISTENT_RESERVE_IN) ||
19322 		    (cmd == SCMD_PERSISTENT_RESERVE_OUT)) {
19323 			sd_return_failed_command(un, bp, EACCES);
19324 			return;
19325 		}
19326 	}
19327 
19328 	un->un_resvd_status |= SD_RESERVATION_CONFLICT;
19329 
19330 	if ((un->un_resvd_status & SD_FAILFAST) != 0) {
19331 		if (sd_failfast_enable != 0) {
19332 			/* By definition, we must panic here.... */
19333 			sd_panic_for_res_conflict(un);
19334 			/*NOTREACHED*/
19335 		}
19336 		SD_ERROR(SD_LOG_IO, un,
19337 		    "sd_handle_resv_conflict: Disk Reserved\n");
19338 		sd_return_failed_command(un, bp, EACCES);
19339 		return;
19340 	}
19341 
19342 	/*
19343 	 * 1147670: retry only if sd_retry_on_reservation_conflict
19344 	 * property is set (default is 1). Retries will not succeed
19345 	 * on a disk reserved by another initiator. HA systems
19346 	 * may reset this via sd.conf to avoid these retries.
19347 	 *
19348 	 * Note: The legacy return code for this failure is EIO, however EACCES
19349 	 * seems more appropriate for a reservation conflict.
19350 	 */
19351 	if (sd_retry_on_reservation_conflict == 0) {
19352 		SD_ERROR(SD_LOG_IO, un,
19353 		    "sd_handle_resv_conflict: Device Reserved\n");
19354 		sd_return_failed_command(un, bp, EIO);
19355 		return;
19356 	}
19357 
19358 	/*
19359 	 * Retry the command if we can.
19360 	 *
19361 	 * Note: The legacy return code for this failure is EIO, however EACCES
19362 	 * seems more appropriate for a reservation conflict.
19363 	 */
19364 	sd_retry_command(un, bp, SD_RETRIES_STANDARD, NULL, NULL, EIO,
19365 	    (clock_t)2, NULL);
19366 }
19367 
19368 
19369 
19370 /*
19371  *    Function: sd_pkt_status_qfull
19372  *
19373  * Description: Handle a QUEUE FULL condition from the target.  This can
19374  *		occur if the HBA does not handle the queue full condition.
19375  *		(Basically this means third-party HBAs as Sun HBAs will
19376  *		handle the queue full condition.)  Note that if there are
19377  *		some commands already in the transport, then the queue full
19378  *		has occurred because the queue for this nexus is actually
19379  *		full. If there are no commands in the transport, then the
19380  *		queue full is resulting from some other initiator or lun
19381  *		consuming all the resources at the target.
19382  *
19383  *     Context: May be called from interrupt context
19384  */
19385 
19386 static void
19387 sd_pkt_status_qfull(struct sd_lun *un, struct buf *bp,
19388 	struct sd_xbuf *xp, struct scsi_pkt *pktp)
19389 {
19390 	ASSERT(un != NULL);
19391 	ASSERT(mutex_owned(SD_MUTEX(un)));
19392 	ASSERT(bp != NULL);
19393 	ASSERT(xp != NULL);
19394 	ASSERT(pktp != NULL);
19395 
19396 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19397 	    "sd_pkt_status_qfull: entry\n");
19398 
19399 	/*
19400 	 * Just lower the QFULL throttle and retry the command.  Note that
19401 	 * we do not limit the number of retries here.
19402 	 */
19403 	sd_reduce_throttle(un, SD_THROTTLE_QFULL);
19404 	sd_retry_command(un, bp, SD_RETRIES_NOCHECK, NULL, NULL, 0,
19405 	    SD_RESTART_TIMEOUT, NULL);
19406 
19407 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19408 	    "sd_pkt_status_qfull: exit\n");
19409 }
19410 
19411 
19412 /*
19413  *    Function: sd_reset_target
19414  *
19415  * Description: Issue a scsi_reset(9F), with either RESET_LUN,
19416  *		RESET_TARGET, or RESET_ALL.
19417  *
19418  *     Context: May be called under interrupt context.
19419  */
19420 
19421 static void
19422 sd_reset_target(struct sd_lun *un, struct scsi_pkt *pktp)
19423 {
19424 	int rval = 0;
19425 
19426 	ASSERT(un != NULL);
19427 	ASSERT(mutex_owned(SD_MUTEX(un)));
19428 	ASSERT(pktp != NULL);
19429 
19430 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_reset_target: entry\n");
19431 
19432 	/*
19433 	 * No need to reset if the transport layer has already done so.
19434 	 */
19435 	if ((pktp->pkt_statistics &
19436 	    (STAT_BUS_RESET | STAT_DEV_RESET | STAT_ABORTED)) != 0) {
19437 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19438 		    "sd_reset_target: no reset\n");
19439 		return;
19440 	}
19441 
19442 	mutex_exit(SD_MUTEX(un));
19443 
19444 	if (un->un_f_allow_bus_device_reset == TRUE) {
19445 		if (un->un_f_lun_reset_enabled == TRUE) {
19446 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19447 			    "sd_reset_target: RESET_LUN\n");
19448 			rval = scsi_reset(SD_ADDRESS(un), RESET_LUN);
19449 		}
19450 		if (rval == 0) {
19451 			SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19452 			    "sd_reset_target: RESET_TARGET\n");
19453 			rval = scsi_reset(SD_ADDRESS(un), RESET_TARGET);
19454 		}
19455 	}
19456 
19457 	if (rval == 0) {
19458 		SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
19459 		    "sd_reset_target: RESET_ALL\n");
19460 		(void) scsi_reset(SD_ADDRESS(un), RESET_ALL);
19461 	}
19462 
19463 	mutex_enter(SD_MUTEX(un));
19464 
19465 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un, "sd_reset_target: exit\n");
19466 }
19467 
19468 /*
19469  *    Function: sd_target_change_task
19470  *
19471  * Description: Handle dynamic target change
19472  *
19473  *     Context: Executes in a taskq() thread context
19474  */
19475 static void
19476 sd_target_change_task(void *arg)
19477 {
19478 	struct sd_lun		*un = arg;
19479 	uint64_t		capacity;
19480 	diskaddr_t		label_cap;
19481 	uint_t			lbasize;
19482 	sd_ssc_t		*ssc;
19483 
19484 	ASSERT(un != NULL);
19485 	ASSERT(!mutex_owned(SD_MUTEX(un)));
19486 
19487 	if ((un->un_f_blockcount_is_valid == FALSE) ||
19488 	    (un->un_f_tgt_blocksize_is_valid == FALSE)) {
19489 		return;
19490 	}
19491 
19492 	ssc = sd_ssc_init(un);
19493 
19494 	if (sd_send_scsi_READ_CAPACITY(ssc, &capacity,
19495 	    &lbasize, SD_PATH_DIRECT) != 0) {
19496 		SD_ERROR(SD_LOG_ERROR, un,
19497 		    "sd_target_change_task: fail to read capacity\n");
19498 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
19499 		goto task_exit;
19500 	}
19501 
19502 	mutex_enter(SD_MUTEX(un));
19503 	if (capacity <= un->un_blockcount) {
19504 		mutex_exit(SD_MUTEX(un));
19505 		goto task_exit;
19506 	}
19507 
19508 	sd_update_block_info(un, lbasize, capacity);
19509 	mutex_exit(SD_MUTEX(un));
19510 
19511 	/*
19512 	 * If lun is EFI labeled and lun capacity is greater than the
19513 	 * capacity contained in the label, log a sys event.
19514 	 */
19515 	if (cmlb_efi_label_capacity(un->un_cmlbhandle, &label_cap,
19516 	    (void*)SD_PATH_DIRECT) == 0) {
19517 		mutex_enter(SD_MUTEX(un));
19518 		if (un->un_f_blockcount_is_valid &&
19519 		    un->un_blockcount > label_cap) {
19520 			mutex_exit(SD_MUTEX(un));
19521 			sd_log_lun_expansion_event(un, KM_SLEEP);
19522 		} else {
19523 			mutex_exit(SD_MUTEX(un));
19524 		}
19525 	}
19526 
19527 task_exit:
19528 	sd_ssc_fini(ssc);
19529 }
19530 
19531 
19532 /*
19533  *    Function: sd_log_dev_status_event
19534  *
19535  * Description: Log EC_dev_status sysevent
19536  *
19537  *     Context: Never called from interrupt context
19538  */
19539 static void
19540 sd_log_dev_status_event(struct sd_lun *un, char *esc, int km_flag)
19541 {
19542 	int err;
19543 	char			*path;
19544 	nvlist_t		*attr_list;
19545 
19546 	/* Allocate and build sysevent attribute list */
19547 	err = nvlist_alloc(&attr_list, NV_UNIQUE_NAME_TYPE, km_flag);
19548 	if (err != 0) {
19549 		SD_ERROR(SD_LOG_ERROR, un,
19550 		    "sd_log_dev_status_event: fail to allocate space\n");
19551 		return;
19552 	}
19553 
19554 	path = kmem_alloc(MAXPATHLEN, km_flag);
19555 	if (path == NULL) {
19556 		nvlist_free(attr_list);
19557 		SD_ERROR(SD_LOG_ERROR, un,
19558 		    "sd_log_dev_status_event: fail to allocate space\n");
19559 		return;
19560 	}
19561 	/*
19562 	 * Add path attribute to identify the lun.
19563 	 * We are using minor node 'a' as the sysevent attribute.
19564 	 */
19565 	(void) snprintf(path, MAXPATHLEN, "/devices");
19566 	(void) ddi_pathname(SD_DEVINFO(un), path + strlen(path));
19567 	(void) snprintf(path + strlen(path), MAXPATHLEN - strlen(path),
19568 	    ":a");
19569 
19570 	err = nvlist_add_string(attr_list, DEV_PHYS_PATH, path);
19571 	if (err != 0) {
19572 		nvlist_free(attr_list);
19573 		kmem_free(path, MAXPATHLEN);
19574 		SD_ERROR(SD_LOG_ERROR, un,
19575 		    "sd_log_dev_status_event: fail to add attribute\n");
19576 		return;
19577 	}
19578 
19579 	/* Log dynamic lun expansion sysevent */
19580 	err = ddi_log_sysevent(SD_DEVINFO(un), SUNW_VENDOR, EC_DEV_STATUS,
19581 	    esc, attr_list, NULL, km_flag);
19582 	if (err != DDI_SUCCESS) {
19583 		SD_ERROR(SD_LOG_ERROR, un,
19584 		    "sd_log_dev_status_event: fail to log sysevent\n");
19585 	}
19586 
19587 	nvlist_free(attr_list);
19588 	kmem_free(path, MAXPATHLEN);
19589 }
19590 
19591 
19592 /*
19593  *    Function: sd_log_lun_expansion_event
19594  *
19595  * Description: Log lun expansion sys event
19596  *
19597  *     Context: Never called from interrupt context
19598  */
19599 static void
19600 sd_log_lun_expansion_event(struct sd_lun *un, int km_flag)
19601 {
19602 	sd_log_dev_status_event(un, ESC_DEV_DLE, km_flag);
19603 }
19604 
19605 
19606 /*
19607  *    Function: sd_log_eject_request_event
19608  *
19609  * Description: Log eject request sysevent
19610  *
19611  *     Context: Never called from interrupt context
19612  */
19613 static void
19614 sd_log_eject_request_event(struct sd_lun *un, int km_flag)
19615 {
19616 	sd_log_dev_status_event(un, ESC_DEV_EJECT_REQUEST, km_flag);
19617 }
19618 
19619 
19620 /*
19621  *    Function: sd_media_change_task
19622  *
19623  * Description: Recovery action for CDROM to become available.
19624  *
19625  *     Context: Executes in a taskq() thread context
19626  */
19627 
19628 static void
19629 sd_media_change_task(void *arg)
19630 {
19631 	struct	scsi_pkt	*pktp = arg;
19632 	struct	sd_lun		*un;
19633 	struct	buf		*bp;
19634 	struct	sd_xbuf		*xp;
19635 	int	err		= 0;
19636 	int	retry_count	= 0;
19637 	int	retry_limit	= SD_UNIT_ATTENTION_RETRY/10;
19638 	struct	sd_sense_info	si;
19639 
19640 	ASSERT(pktp != NULL);
19641 	bp = (struct buf *)pktp->pkt_private;
19642 	ASSERT(bp != NULL);
19643 	xp = SD_GET_XBUF(bp);
19644 	ASSERT(xp != NULL);
19645 	un = SD_GET_UN(bp);
19646 	ASSERT(un != NULL);
19647 	ASSERT(!mutex_owned(SD_MUTEX(un)));
19648 	ASSERT(un->un_f_monitor_media_state);
19649 
19650 	si.ssi_severity = SCSI_ERR_INFO;
19651 	si.ssi_pfa_flag = FALSE;
19652 
19653 	/*
19654 	 * When a reset is issued on a CDROM, it takes a long time to
19655 	 * recover. First few attempts to read capacity and other things
19656 	 * related to handling unit attention fail (with a ASC 0x4 and
19657 	 * ASCQ 0x1). In that case we want to do enough retries and we want
19658 	 * to limit the retries in other cases of genuine failures like
19659 	 * no media in drive.
19660 	 */
19661 	while (retry_count++ < retry_limit) {
19662 		if ((err = sd_handle_mchange(un)) == 0) {
19663 			break;
19664 		}
19665 		if (err == EAGAIN) {
19666 			retry_limit = SD_UNIT_ATTENTION_RETRY;
19667 		}
19668 		/* Sleep for 0.5 sec. & try again */
19669 		delay(drv_usectohz(500000));
19670 	}
19671 
19672 	/*
19673 	 * Dispatch (retry or fail) the original command here,
19674 	 * along with appropriate console messages....
19675 	 *
19676 	 * Must grab the mutex before calling sd_retry_command,
19677 	 * sd_print_sense_msg and sd_return_failed_command.
19678 	 */
19679 	mutex_enter(SD_MUTEX(un));
19680 	if (err != SD_CMD_SUCCESS) {
19681 		SD_UPDATE_ERRSTATS(un, sd_harderrs);
19682 		SD_UPDATE_ERRSTATS(un, sd_rq_nodev_err);
19683 		si.ssi_severity = SCSI_ERR_FATAL;
19684 		sd_print_sense_msg(un, bp, &si, SD_NO_RETRY_ISSUED);
19685 		sd_return_failed_command(un, bp, EIO);
19686 	} else {
19687 		sd_retry_command(un, bp, SD_RETRIES_NOCHECK, sd_print_sense_msg,
19688 		    &si, EIO, (clock_t)0, NULL);
19689 	}
19690 	mutex_exit(SD_MUTEX(un));
19691 }
19692 
19693 
19694 
19695 /*
19696  *    Function: sd_handle_mchange
19697  *
19698  * Description: Perform geometry validation & other recovery when CDROM
19699  *		has been removed from drive.
19700  *
19701  * Return Code: 0 for success
19702  *		errno-type return code of either sd_send_scsi_DOORLOCK() or
19703  *		sd_send_scsi_READ_CAPACITY()
19704  *
19705  *     Context: Executes in a taskq() thread context
19706  */
19707 
19708 static int
19709 sd_handle_mchange(struct sd_lun *un)
19710 {
19711 	uint64_t	capacity;
19712 	uint32_t	lbasize;
19713 	int		rval;
19714 	sd_ssc_t	*ssc;
19715 
19716 	ASSERT(!mutex_owned(SD_MUTEX(un)));
19717 	ASSERT(un->un_f_monitor_media_state);
19718 
19719 	ssc = sd_ssc_init(un);
19720 	rval = sd_send_scsi_READ_CAPACITY(ssc, &capacity, &lbasize,
19721 	    SD_PATH_DIRECT_PRIORITY);
19722 
19723 	if (rval != 0)
19724 		goto failed;
19725 
19726 	mutex_enter(SD_MUTEX(un));
19727 	sd_update_block_info(un, lbasize, capacity);
19728 
19729 	if (un->un_errstats != NULL) {
19730 		struct	sd_errstats *stp =
19731 		    (struct sd_errstats *)un->un_errstats->ks_data;
19732 		stp->sd_capacity.value.ui64 = (uint64_t)
19733 		    ((uint64_t)un->un_blockcount *
19734 		    (uint64_t)un->un_tgt_blocksize);
19735 	}
19736 
19737 	/*
19738 	 * Check if the media in the device is writable or not
19739 	 */
19740 	if (ISCD(un)) {
19741 		sd_check_for_writable_cd(ssc, SD_PATH_DIRECT_PRIORITY);
19742 	}
19743 
19744 	/*
19745 	 * Note: Maybe let the strategy/partitioning chain worry about getting
19746 	 * valid geometry.
19747 	 */
19748 	mutex_exit(SD_MUTEX(un));
19749 	cmlb_invalidate(un->un_cmlbhandle, (void *)SD_PATH_DIRECT_PRIORITY);
19750 
19751 
19752 	if (cmlb_validate(un->un_cmlbhandle, 0,
19753 	    (void *)SD_PATH_DIRECT_PRIORITY) != 0) {
19754 		sd_ssc_fini(ssc);
19755 		return (EIO);
19756 	} else {
19757 		if (un->un_f_pkstats_enabled) {
19758 			sd_set_pstats(un);
19759 			SD_TRACE(SD_LOG_IO_PARTITION, un,
19760 			    "sd_handle_mchange: un:0x%p pstats created and "
19761 			    "set\n", un);
19762 		}
19763 	}
19764 
19765 	/*
19766 	 * Try to lock the door
19767 	 */
19768 	rval = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_PREVENT,
19769 	    SD_PATH_DIRECT_PRIORITY);
19770 failed:
19771 	if (rval != 0)
19772 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
19773 	sd_ssc_fini(ssc);
19774 	return (rval);
19775 }
19776 
19777 
19778 /*
19779  *    Function: sd_send_scsi_DOORLOCK
19780  *
19781  * Description: Issue the scsi DOOR LOCK command
19782  *
19783  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
19784  *                      structure for this target.
19785  *		flag  - SD_REMOVAL_ALLOW
19786  *			SD_REMOVAL_PREVENT
19787  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
19788  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
19789  *			to use the USCSI "direct" chain and bypass the normal
19790  *			command waitq. SD_PATH_DIRECT_PRIORITY is used when this
19791  *			command is issued as part of an error recovery action.
19792  *
19793  * Return Code: 0   - Success
19794  *		errno return code from sd_ssc_send()
19795  *
19796  *     Context: Can sleep.
19797  */
19798 
19799 static int
19800 sd_send_scsi_DOORLOCK(sd_ssc_t *ssc, int flag, int path_flag)
19801 {
19802 	struct scsi_extended_sense	sense_buf;
19803 	union scsi_cdb		cdb;
19804 	struct uscsi_cmd	ucmd_buf;
19805 	int			status;
19806 	struct sd_lun		*un;
19807 
19808 	ASSERT(ssc != NULL);
19809 	un = ssc->ssc_un;
19810 	ASSERT(un != NULL);
19811 	ASSERT(!mutex_owned(SD_MUTEX(un)));
19812 
19813 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_DOORLOCK: entry: un:0x%p\n", un);
19814 
19815 	/* already determined doorlock is not supported, fake success */
19816 	if (un->un_f_doorlock_supported == FALSE) {
19817 		return (0);
19818 	}
19819 
19820 	/*
19821 	 * If we are ejecting and see an SD_REMOVAL_PREVENT
19822 	 * ignore the command so we can complete the eject
19823 	 * operation.
19824 	 */
19825 	if (flag == SD_REMOVAL_PREVENT) {
19826 		mutex_enter(SD_MUTEX(un));
19827 		if (un->un_f_ejecting == TRUE) {
19828 			mutex_exit(SD_MUTEX(un));
19829 			return (EAGAIN);
19830 		}
19831 		mutex_exit(SD_MUTEX(un));
19832 	}
19833 
19834 	bzero(&cdb, sizeof (cdb));
19835 	bzero(&ucmd_buf, sizeof (ucmd_buf));
19836 
19837 	cdb.scc_cmd = SCMD_DOORLOCK;
19838 	cdb.cdb_opaque[4] = (uchar_t)flag;
19839 
19840 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
19841 	ucmd_buf.uscsi_cdblen	= CDB_GROUP0;
19842 	ucmd_buf.uscsi_bufaddr	= NULL;
19843 	ucmd_buf.uscsi_buflen	= 0;
19844 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
19845 	ucmd_buf.uscsi_rqlen	= sizeof (sense_buf);
19846 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_SILENT;
19847 	ucmd_buf.uscsi_timeout	= 15;
19848 
19849 	SD_TRACE(SD_LOG_IO, un,
19850 	    "sd_send_scsi_DOORLOCK: returning sd_ssc_send\n");
19851 
19852 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
19853 	    UIO_SYSSPACE, path_flag);
19854 
19855 	if (status == 0)
19856 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
19857 
19858 	if ((status == EIO) && (ucmd_buf.uscsi_status == STATUS_CHECK) &&
19859 	    (ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
19860 	    (scsi_sense_key((uint8_t *)&sense_buf) == KEY_ILLEGAL_REQUEST)) {
19861 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
19862 
19863 		/* fake success and skip subsequent doorlock commands */
19864 		un->un_f_doorlock_supported = FALSE;
19865 		return (0);
19866 	}
19867 
19868 	return (status);
19869 }
19870 
19871 /*
19872  *    Function: sd_send_scsi_READ_CAPACITY
19873  *
19874  * Description: This routine uses the scsi READ CAPACITY command to determine
19875  *		the device capacity in number of blocks and the device native
19876  *		block size. If this function returns a failure, then the
19877  *		values in *capp and *lbap are undefined.  If the capacity
19878  *		returned is 0xffffffff then the lun is too large for a
19879  *		normal READ CAPACITY command and the results of a
19880  *		READ CAPACITY 16 will be used instead.
19881  *
19882  *   Arguments: ssc   - ssc contains ptr to soft state struct for the target
19883  *		capp - ptr to unsigned 64-bit variable to receive the
19884  *			capacity value from the command.
19885  *		lbap - ptr to unsigned 32-bit varaible to receive the
19886  *			block size value from the command
19887  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
19888  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
19889  *			to use the USCSI "direct" chain and bypass the normal
19890  *			command waitq. SD_PATH_DIRECT_PRIORITY is used when this
19891  *			command is issued as part of an error recovery action.
19892  *
19893  * Return Code: 0   - Success
19894  *		EIO - IO error
19895  *		EACCES - Reservation conflict detected
19896  *		EAGAIN - Device is becoming ready
19897  *		errno return code from sd_ssc_send()
19898  *
19899  *     Context: Can sleep.  Blocks until command completes.
19900  */
19901 
19902 #define	SD_CAPACITY_SIZE	sizeof (struct scsi_capacity)
19903 
19904 static int
19905 sd_send_scsi_READ_CAPACITY(sd_ssc_t *ssc, uint64_t *capp, uint32_t *lbap,
19906 	int path_flag)
19907 {
19908 	struct	scsi_extended_sense	sense_buf;
19909 	struct	uscsi_cmd	ucmd_buf;
19910 	union	scsi_cdb	cdb;
19911 	uint32_t		*capacity_buf;
19912 	uint64_t		capacity;
19913 	uint32_t		lbasize;
19914 	uint32_t		pbsize;
19915 	int			status;
19916 	struct sd_lun		*un;
19917 
19918 	ASSERT(ssc != NULL);
19919 
19920 	un = ssc->ssc_un;
19921 	ASSERT(un != NULL);
19922 	ASSERT(!mutex_owned(SD_MUTEX(un)));
19923 	ASSERT(capp != NULL);
19924 	ASSERT(lbap != NULL);
19925 
19926 	SD_TRACE(SD_LOG_IO, un,
19927 	    "sd_send_scsi_READ_CAPACITY: entry: un:0x%p\n", un);
19928 
19929 	/*
19930 	 * First send a READ_CAPACITY command to the target.
19931 	 * (This command is mandatory under SCSI-2.)
19932 	 *
19933 	 * Set up the CDB for the READ_CAPACITY command.  The Partial
19934 	 * Medium Indicator bit is cleared.  The address field must be
19935 	 * zero if the PMI bit is zero.
19936 	 */
19937 	bzero(&cdb, sizeof (cdb));
19938 	bzero(&ucmd_buf, sizeof (ucmd_buf));
19939 
19940 	capacity_buf = kmem_zalloc(SD_CAPACITY_SIZE, KM_SLEEP);
19941 
19942 	cdb.scc_cmd = SCMD_READ_CAPACITY;
19943 
19944 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
19945 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
19946 	ucmd_buf.uscsi_bufaddr	= (caddr_t)capacity_buf;
19947 	ucmd_buf.uscsi_buflen	= SD_CAPACITY_SIZE;
19948 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
19949 	ucmd_buf.uscsi_rqlen	= sizeof (sense_buf);
19950 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
19951 	ucmd_buf.uscsi_timeout	= 60;
19952 
19953 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
19954 	    UIO_SYSSPACE, path_flag);
19955 
19956 	switch (status) {
19957 	case 0:
19958 		/* Return failure if we did not get valid capacity data. */
19959 		if (ucmd_buf.uscsi_resid != 0) {
19960 			sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
19961 			    "sd_send_scsi_READ_CAPACITY received invalid "
19962 			    "capacity data");
19963 			kmem_free(capacity_buf, SD_CAPACITY_SIZE);
19964 			return (EIO);
19965 		}
19966 		/*
19967 		 * Read capacity and block size from the READ CAPACITY 10 data.
19968 		 * This data may be adjusted later due to device specific
19969 		 * issues.
19970 		 *
19971 		 * According to the SCSI spec, the READ CAPACITY 10
19972 		 * command returns the following:
19973 		 *
19974 		 *  bytes 0-3: Maximum logical block address available.
19975 		 *		(MSB in byte:0 & LSB in byte:3)
19976 		 *
19977 		 *  bytes 4-7: Block length in bytes
19978 		 *		(MSB in byte:4 & LSB in byte:7)
19979 		 *
19980 		 */
19981 		capacity = BE_32(capacity_buf[0]);
19982 		lbasize = BE_32(capacity_buf[1]);
19983 
19984 		/*
19985 		 * Done with capacity_buf
19986 		 */
19987 		kmem_free(capacity_buf, SD_CAPACITY_SIZE);
19988 
19989 		/*
19990 		 * if the reported capacity is set to all 0xf's, then
19991 		 * this disk is too large and requires SBC-2 commands.
19992 		 * Reissue the request using READ CAPACITY 16.
19993 		 */
19994 		if (capacity == 0xffffffff) {
19995 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
19996 			status = sd_send_scsi_READ_CAPACITY_16(ssc, &capacity,
19997 			    &lbasize, &pbsize, path_flag);
19998 			if (status != 0) {
19999 				return (status);
20000 			}
20001 		}
20002 		break;	/* Success! */
20003 	case EIO:
20004 		switch (ucmd_buf.uscsi_status) {
20005 		case STATUS_RESERVATION_CONFLICT:
20006 			status = EACCES;
20007 			break;
20008 		case STATUS_CHECK:
20009 			/*
20010 			 * Check condition; look for ASC/ASCQ of 0x04/0x01
20011 			 * (LOGICAL UNIT IS IN PROCESS OF BECOMING READY)
20012 			 */
20013 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20014 			    (scsi_sense_asc((uint8_t *)&sense_buf) == 0x04) &&
20015 			    (scsi_sense_ascq((uint8_t *)&sense_buf) == 0x01)) {
20016 				kmem_free(capacity_buf, SD_CAPACITY_SIZE);
20017 				return (EAGAIN);
20018 			}
20019 			break;
20020 		default:
20021 			break;
20022 		}
20023 		/* FALLTHRU */
20024 	default:
20025 		kmem_free(capacity_buf, SD_CAPACITY_SIZE);
20026 		return (status);
20027 	}
20028 
20029 	/*
20030 	 * Some ATAPI CD-ROM drives report inaccurate LBA size values
20031 	 * (2352 and 0 are common) so for these devices always force the value
20032 	 * to 2048 as required by the ATAPI specs.
20033 	 */
20034 	if ((un->un_f_cfg_is_atapi == TRUE) && (ISCD(un))) {
20035 		lbasize = 2048;
20036 	}
20037 
20038 	/*
20039 	 * Get the maximum LBA value from the READ CAPACITY data.
20040 	 * Here we assume that the Partial Medium Indicator (PMI) bit
20041 	 * was cleared when issuing the command. This means that the LBA
20042 	 * returned from the device is the LBA of the last logical block
20043 	 * on the logical unit.  The actual logical block count will be
20044 	 * this value plus one.
20045 	 */
20046 	capacity += 1;
20047 
20048 	/*
20049 	 * Currently, for removable media, the capacity is saved in terms
20050 	 * of un->un_sys_blocksize, so scale the capacity value to reflect this.
20051 	 */
20052 	if (un->un_f_has_removable_media)
20053 		capacity *= (lbasize / un->un_sys_blocksize);
20054 
20055 	/*
20056 	 * Copy the values from the READ CAPACITY command into the space
20057 	 * provided by the caller.
20058 	 */
20059 	*capp = capacity;
20060 	*lbap = lbasize;
20061 
20062 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_READ_CAPACITY: "
20063 	    "capacity:0x%llx  lbasize:0x%x\n", capacity, lbasize);
20064 
20065 	/*
20066 	 * Both the lbasize and capacity from the device must be nonzero,
20067 	 * otherwise we assume that the values are not valid and return
20068 	 * failure to the caller. (4203735)
20069 	 */
20070 	if ((capacity == 0) || (lbasize == 0)) {
20071 		sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
20072 		    "sd_send_scsi_READ_CAPACITY received invalid value "
20073 		    "capacity %llu lbasize %d", capacity, lbasize);
20074 		return (EIO);
20075 	}
20076 	sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20077 	return (0);
20078 }
20079 
20080 /*
20081  *    Function: sd_send_scsi_READ_CAPACITY_16
20082  *
20083  * Description: This routine uses the scsi READ CAPACITY 16 command to
20084  *		determine the device capacity in number of blocks and the
20085  *		device native block size.  If this function returns a failure,
20086  *		then the values in *capp and *lbap are undefined.
20087  *		This routine should be called by sd_send_scsi_READ_CAPACITY
20088  *              which will apply any device specific adjustments to capacity
20089  *              and lbasize. One exception is it is also called by
20090  *              sd_get_media_info_ext. In that function, there is no need to
20091  *              adjust the capacity and lbasize.
20092  *
20093  *   Arguments: ssc   - ssc contains ptr to soft state struct for the target
20094  *		capp - ptr to unsigned 64-bit variable to receive the
20095  *			capacity value from the command.
20096  *		lbap - ptr to unsigned 32-bit varaible to receive the
20097  *			block size value from the command
20098  *              psp  - ptr to unsigned 32-bit variable to receive the
20099  *                      physical block size value from the command
20100  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
20101  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
20102  *			to use the USCSI "direct" chain and bypass the normal
20103  *			command waitq. SD_PATH_DIRECT_PRIORITY is used when
20104  *			this command is issued as part of an error recovery
20105  *			action.
20106  *
20107  * Return Code: 0   - Success
20108  *		EIO - IO error
20109  *		EACCES - Reservation conflict detected
20110  *		EAGAIN - Device is becoming ready
20111  *		errno return code from sd_ssc_send()
20112  *
20113  *     Context: Can sleep.  Blocks until command completes.
20114  */
20115 
20116 #define	SD_CAPACITY_16_SIZE	sizeof (struct scsi_capacity_16)
20117 
20118 static int
20119 sd_send_scsi_READ_CAPACITY_16(sd_ssc_t *ssc, uint64_t *capp,
20120 	uint32_t *lbap, uint32_t *psp, int path_flag)
20121 {
20122 	struct	scsi_extended_sense	sense_buf;
20123 	struct	uscsi_cmd	ucmd_buf;
20124 	union	scsi_cdb	cdb;
20125 	uint64_t		*capacity16_buf;
20126 	uint64_t		capacity;
20127 	uint32_t		lbasize;
20128 	uint32_t		pbsize;
20129 	uint32_t		lbpb_exp;
20130 	int			status;
20131 	struct sd_lun		*un;
20132 
20133 	ASSERT(ssc != NULL);
20134 
20135 	un = ssc->ssc_un;
20136 	ASSERT(un != NULL);
20137 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20138 	ASSERT(capp != NULL);
20139 	ASSERT(lbap != NULL);
20140 
20141 	SD_TRACE(SD_LOG_IO, un,
20142 	    "sd_send_scsi_READ_CAPACITY: entry: un:0x%p\n", un);
20143 
20144 	/*
20145 	 * First send a READ_CAPACITY_16 command to the target.
20146 	 *
20147 	 * Set up the CDB for the READ_CAPACITY_16 command.  The Partial
20148 	 * Medium Indicator bit is cleared.  The address field must be
20149 	 * zero if the PMI bit is zero.
20150 	 */
20151 	bzero(&cdb, sizeof (cdb));
20152 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20153 
20154 	capacity16_buf = kmem_zalloc(SD_CAPACITY_16_SIZE, KM_SLEEP);
20155 
20156 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20157 	ucmd_buf.uscsi_cdblen	= CDB_GROUP4;
20158 	ucmd_buf.uscsi_bufaddr	= (caddr_t)capacity16_buf;
20159 	ucmd_buf.uscsi_buflen	= SD_CAPACITY_16_SIZE;
20160 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20161 	ucmd_buf.uscsi_rqlen	= sizeof (sense_buf);
20162 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
20163 	ucmd_buf.uscsi_timeout	= 60;
20164 
20165 	/*
20166 	 * Read Capacity (16) is a Service Action In command.  One
20167 	 * command byte (0x9E) is overloaded for multiple operations,
20168 	 * with the second CDB byte specifying the desired operation
20169 	 */
20170 	cdb.scc_cmd = SCMD_SVC_ACTION_IN_G4;
20171 	cdb.cdb_opaque[1] = SSVC_ACTION_READ_CAPACITY_G4;
20172 
20173 	/*
20174 	 * Fill in allocation length field
20175 	 */
20176 	FORMG4COUNT(&cdb, ucmd_buf.uscsi_buflen);
20177 
20178 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20179 	    UIO_SYSSPACE, path_flag);
20180 
20181 	switch (status) {
20182 	case 0:
20183 		/* Return failure if we did not get valid capacity data. */
20184 		if (ucmd_buf.uscsi_resid > 20) {
20185 			sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
20186 			    "sd_send_scsi_READ_CAPACITY_16 received invalid "
20187 			    "capacity data");
20188 			kmem_free(capacity16_buf, SD_CAPACITY_16_SIZE);
20189 			return (EIO);
20190 		}
20191 
20192 		/*
20193 		 * Read capacity and block size from the READ CAPACITY 10 data.
20194 		 * This data may be adjusted later due to device specific
20195 		 * issues.
20196 		 *
20197 		 * According to the SCSI spec, the READ CAPACITY 10
20198 		 * command returns the following:
20199 		 *
20200 		 *  bytes 0-7: Maximum logical block address available.
20201 		 *		(MSB in byte:0 & LSB in byte:7)
20202 		 *
20203 		 *  bytes 8-11: Block length in bytes
20204 		 *		(MSB in byte:8 & LSB in byte:11)
20205 		 *
20206 		 *  byte 13: LOGICAL BLOCKS PER PHYSICAL BLOCK EXPONENT
20207 		 */
20208 		capacity = BE_64(capacity16_buf[0]);
20209 		lbasize = BE_32(*(uint32_t *)&capacity16_buf[1]);
20210 		lbpb_exp = (BE_64(capacity16_buf[1]) >> 40) & 0x0f;
20211 
20212 		pbsize = lbasize << lbpb_exp;
20213 
20214 		/*
20215 		 * Done with capacity16_buf
20216 		 */
20217 		kmem_free(capacity16_buf, SD_CAPACITY_16_SIZE);
20218 
20219 		/*
20220 		 * if the reported capacity is set to all 0xf's, then
20221 		 * this disk is too large.  This could only happen with
20222 		 * a device that supports LBAs larger than 64 bits which
20223 		 * are not defined by any current T10 standards.
20224 		 */
20225 		if (capacity == 0xffffffffffffffff) {
20226 			sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
20227 			    "disk is too large");
20228 			return (EIO);
20229 		}
20230 		break;	/* Success! */
20231 	case EIO:
20232 		switch (ucmd_buf.uscsi_status) {
20233 		case STATUS_RESERVATION_CONFLICT:
20234 			status = EACCES;
20235 			break;
20236 		case STATUS_CHECK:
20237 			/*
20238 			 * Check condition; look for ASC/ASCQ of 0x04/0x01
20239 			 * (LOGICAL UNIT IS IN PROCESS OF BECOMING READY)
20240 			 */
20241 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20242 			    (scsi_sense_asc((uint8_t *)&sense_buf) == 0x04) &&
20243 			    (scsi_sense_ascq((uint8_t *)&sense_buf) == 0x01)) {
20244 				kmem_free(capacity16_buf, SD_CAPACITY_16_SIZE);
20245 				return (EAGAIN);
20246 			}
20247 			break;
20248 		default:
20249 			break;
20250 		}
20251 		/* FALLTHRU */
20252 	default:
20253 		kmem_free(capacity16_buf, SD_CAPACITY_16_SIZE);
20254 		return (status);
20255 	}
20256 
20257 	*capp = capacity;
20258 	*lbap = lbasize;
20259 	*psp = pbsize;
20260 
20261 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_READ_CAPACITY_16: "
20262 	    "capacity:0x%llx  lbasize:0x%x, pbsize: 0x%x\n",
20263 	    capacity, lbasize, pbsize);
20264 
20265 	return (0);
20266 }
20267 
20268 
20269 /*
20270  *    Function: sd_send_scsi_START_STOP_UNIT
20271  *
20272  * Description: Issue a scsi START STOP UNIT command to the target.
20273  *
20274  *   Arguments: ssc    - ssc contatins pointer to driver soft state (unit)
20275  *                       structure for this target.
20276  *      pc_flag - SD_POWER_CONDITION
20277  *                SD_START_STOP
20278  *		flag  - SD_TARGET_START
20279  *			SD_TARGET_STOP
20280  *			SD_TARGET_EJECT
20281  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
20282  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
20283  *			to use the USCSI "direct" chain and bypass the normal
20284  *			command waitq. SD_PATH_DIRECT_PRIORITY is used when this
20285  *			command is issued as part of an error recovery action.
20286  *
20287  * Return Code: 0   - Success
20288  *		EIO - IO error
20289  *		EACCES - Reservation conflict detected
20290  *		ENXIO  - Not Ready, medium not present
20291  *		errno return code from sd_ssc_send()
20292  *
20293  *     Context: Can sleep.
20294  */
20295 
20296 static int
20297 sd_send_scsi_START_STOP_UNIT(sd_ssc_t *ssc, int pc_flag, int flag,
20298     int path_flag)
20299 {
20300 	struct	scsi_extended_sense	sense_buf;
20301 	union scsi_cdb		cdb;
20302 	struct uscsi_cmd	ucmd_buf;
20303 	int			status;
20304 	struct sd_lun		*un;
20305 
20306 	ASSERT(ssc != NULL);
20307 	un = ssc->ssc_un;
20308 	ASSERT(un != NULL);
20309 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20310 
20311 	SD_TRACE(SD_LOG_IO, un,
20312 	    "sd_send_scsi_START_STOP_UNIT: entry: un:0x%p\n", un);
20313 
20314 	if (un->un_f_check_start_stop &&
20315 	    ((pc_flag == SD_START_STOP) && (flag != SD_TARGET_EJECT)) &&
20316 	    (un->un_f_start_stop_supported != TRUE)) {
20317 		return (0);
20318 	}
20319 
20320 	/*
20321 	 * If we are performing an eject operation and
20322 	 * we receive any command other than SD_TARGET_EJECT
20323 	 * we should immediately return.
20324 	 */
20325 	if (flag != SD_TARGET_EJECT) {
20326 		mutex_enter(SD_MUTEX(un));
20327 		if (un->un_f_ejecting == TRUE) {
20328 			mutex_exit(SD_MUTEX(un));
20329 			return (EAGAIN);
20330 		}
20331 		mutex_exit(SD_MUTEX(un));
20332 	}
20333 
20334 	bzero(&cdb, sizeof (cdb));
20335 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20336 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
20337 
20338 	cdb.scc_cmd = SCMD_START_STOP;
20339 	cdb.cdb_opaque[4] = (pc_flag == SD_POWER_CONDITION) ?
20340 	    (uchar_t)(flag << 4) : (uchar_t)flag;
20341 
20342 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20343 	ucmd_buf.uscsi_cdblen	= CDB_GROUP0;
20344 	ucmd_buf.uscsi_bufaddr	= NULL;
20345 	ucmd_buf.uscsi_buflen	= 0;
20346 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20347 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
20348 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_SILENT;
20349 	ucmd_buf.uscsi_timeout	= 200;
20350 
20351 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20352 	    UIO_SYSSPACE, path_flag);
20353 
20354 	switch (status) {
20355 	case 0:
20356 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20357 		break;	/* Success! */
20358 	case EIO:
20359 		switch (ucmd_buf.uscsi_status) {
20360 		case STATUS_RESERVATION_CONFLICT:
20361 			status = EACCES;
20362 			break;
20363 		case STATUS_CHECK:
20364 			if (ucmd_buf.uscsi_rqstatus == STATUS_GOOD) {
20365 				switch (scsi_sense_key(
20366 				    (uint8_t *)&sense_buf)) {
20367 				case KEY_ILLEGAL_REQUEST:
20368 					status = ENOTSUP;
20369 					break;
20370 				case KEY_NOT_READY:
20371 					if (scsi_sense_asc(
20372 					    (uint8_t *)&sense_buf)
20373 					    == 0x3A) {
20374 						status = ENXIO;
20375 					}
20376 					break;
20377 				default:
20378 					break;
20379 				}
20380 			}
20381 			break;
20382 		default:
20383 			break;
20384 		}
20385 		break;
20386 	default:
20387 		break;
20388 	}
20389 
20390 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_START_STOP_UNIT: exit\n");
20391 
20392 	return (status);
20393 }
20394 
20395 
20396 /*
20397  *    Function: sd_start_stop_unit_callback
20398  *
20399  * Description: timeout(9F) callback to begin recovery process for a
20400  *		device that has spun down.
20401  *
20402  *   Arguments: arg - pointer to associated softstate struct.
20403  *
20404  *     Context: Executes in a timeout(9F) thread context
20405  */
20406 
20407 static void
20408 sd_start_stop_unit_callback(void *arg)
20409 {
20410 	struct sd_lun	*un = arg;
20411 	ASSERT(un != NULL);
20412 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20413 
20414 	SD_TRACE(SD_LOG_IO, un, "sd_start_stop_unit_callback: entry\n");
20415 
20416 	(void) taskq_dispatch(sd_tq, sd_start_stop_unit_task, un, KM_NOSLEEP);
20417 }
20418 
20419 
20420 /*
20421  *    Function: sd_start_stop_unit_task
20422  *
20423  * Description: Recovery procedure when a drive is spun down.
20424  *
20425  *   Arguments: arg - pointer to associated softstate struct.
20426  *
20427  *     Context: Executes in a taskq() thread context
20428  */
20429 
20430 static void
20431 sd_start_stop_unit_task(void *arg)
20432 {
20433 	struct sd_lun	*un = arg;
20434 	sd_ssc_t	*ssc;
20435 	int		power_level;
20436 	int		rval;
20437 
20438 	ASSERT(un != NULL);
20439 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20440 
20441 	SD_TRACE(SD_LOG_IO, un, "sd_start_stop_unit_task: entry\n");
20442 
20443 	/*
20444 	 * Some unformatted drives report not ready error, no need to
20445 	 * restart if format has been initiated.
20446 	 */
20447 	mutex_enter(SD_MUTEX(un));
20448 	if (un->un_f_format_in_progress == TRUE) {
20449 		mutex_exit(SD_MUTEX(un));
20450 		return;
20451 	}
20452 	mutex_exit(SD_MUTEX(un));
20453 
20454 	ssc = sd_ssc_init(un);
20455 	/*
20456 	 * When a START STOP command is issued from here, it is part of a
20457 	 * failure recovery operation and must be issued before any other
20458 	 * commands, including any pending retries. Thus it must be sent
20459 	 * using SD_PATH_DIRECT_PRIORITY. It doesn't matter if the spin up
20460 	 * succeeds or not, we will start I/O after the attempt.
20461 	 * If power condition is supported and the current power level
20462 	 * is capable of performing I/O, we should set the power condition
20463 	 * to that level. Otherwise, set the power condition to ACTIVE.
20464 	 */
20465 	if (un->un_f_power_condition_supported) {
20466 		mutex_enter(SD_MUTEX(un));
20467 		ASSERT(SD_PM_IS_LEVEL_VALID(un, un->un_power_level));
20468 		power_level = sd_pwr_pc.ran_perf[un->un_power_level]
20469 		    > 0 ? un->un_power_level : SD_SPINDLE_ACTIVE;
20470 		mutex_exit(SD_MUTEX(un));
20471 		rval = sd_send_scsi_START_STOP_UNIT(ssc, SD_POWER_CONDITION,
20472 		    sd_pl2pc[power_level], SD_PATH_DIRECT_PRIORITY);
20473 	} else {
20474 		rval = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
20475 		    SD_TARGET_START, SD_PATH_DIRECT_PRIORITY);
20476 	}
20477 
20478 	if (rval != 0)
20479 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
20480 	sd_ssc_fini(ssc);
20481 	/*
20482 	 * The above call blocks until the START_STOP_UNIT command completes.
20483 	 * Now that it has completed, we must re-try the original IO that
20484 	 * received the NOT READY condition in the first place. There are
20485 	 * three possible conditions here:
20486 	 *
20487 	 *  (1) The original IO is on un_retry_bp.
20488 	 *  (2) The original IO is on the regular wait queue, and un_retry_bp
20489 	 *	is NULL.
20490 	 *  (3) The original IO is on the regular wait queue, and un_retry_bp
20491 	 *	points to some other, unrelated bp.
20492 	 *
20493 	 * For each case, we must call sd_start_cmds() with un_retry_bp
20494 	 * as the argument. If un_retry_bp is NULL, this will initiate
20495 	 * processing of the regular wait queue.  If un_retry_bp is not NULL,
20496 	 * then this will process the bp on un_retry_bp. That may or may not
20497 	 * be the original IO, but that does not matter: the important thing
20498 	 * is to keep the IO processing going at this point.
20499 	 *
20500 	 * Note: This is a very specific error recovery sequence associated
20501 	 * with a drive that is not spun up. We attempt a START_STOP_UNIT and
20502 	 * serialize the I/O with completion of the spin-up.
20503 	 */
20504 	mutex_enter(SD_MUTEX(un));
20505 	SD_TRACE(SD_LOG_IO_CORE | SD_LOG_ERROR, un,
20506 	    "sd_start_stop_unit_task: un:0x%p starting bp:0x%p\n",
20507 	    un, un->un_retry_bp);
20508 	un->un_startstop_timeid = NULL;	/* Timeout is no longer pending */
20509 	sd_start_cmds(un, un->un_retry_bp);
20510 	mutex_exit(SD_MUTEX(un));
20511 
20512 	SD_TRACE(SD_LOG_IO, un, "sd_start_stop_unit_task: exit\n");
20513 }
20514 
20515 
20516 /*
20517  *    Function: sd_send_scsi_INQUIRY
20518  *
20519  * Description: Issue the scsi INQUIRY command.
20520  *
20521  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
20522  *                      structure for this target.
20523  *		bufaddr
20524  *		buflen
20525  *		evpd
20526  *		page_code
20527  *		page_length
20528  *
20529  * Return Code: 0   - Success
20530  *		errno return code from sd_ssc_send()
20531  *
20532  *     Context: Can sleep. Does not return until command is completed.
20533  */
20534 
20535 static int
20536 sd_send_scsi_INQUIRY(sd_ssc_t *ssc, uchar_t *bufaddr, size_t buflen,
20537 	uchar_t evpd, uchar_t page_code, size_t *residp)
20538 {
20539 	union scsi_cdb		cdb;
20540 	struct uscsi_cmd	ucmd_buf;
20541 	int			status;
20542 	struct sd_lun		*un;
20543 
20544 	ASSERT(ssc != NULL);
20545 	un = ssc->ssc_un;
20546 	ASSERT(un != NULL);
20547 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20548 	ASSERT(bufaddr != NULL);
20549 
20550 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_INQUIRY: entry: un:0x%p\n", un);
20551 
20552 	bzero(&cdb, sizeof (cdb));
20553 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20554 	bzero(bufaddr, buflen);
20555 
20556 	cdb.scc_cmd = SCMD_INQUIRY;
20557 	cdb.cdb_opaque[1] = evpd;
20558 	cdb.cdb_opaque[2] = page_code;
20559 	FORMG0COUNT(&cdb, buflen);
20560 
20561 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20562 	ucmd_buf.uscsi_cdblen	= CDB_GROUP0;
20563 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
20564 	ucmd_buf.uscsi_buflen	= buflen;
20565 	ucmd_buf.uscsi_rqbuf	= NULL;
20566 	ucmd_buf.uscsi_rqlen	= 0;
20567 	ucmd_buf.uscsi_flags	= USCSI_READ | USCSI_SILENT;
20568 	ucmd_buf.uscsi_timeout	= 200;	/* Excessive legacy value */
20569 
20570 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20571 	    UIO_SYSSPACE, SD_PATH_DIRECT);
20572 
20573 	/*
20574 	 * Only handle status == 0, the upper-level caller
20575 	 * will put different assessment based on the context.
20576 	 */
20577 	if (status == 0)
20578 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20579 
20580 	if ((status == 0) && (residp != NULL)) {
20581 		*residp = ucmd_buf.uscsi_resid;
20582 	}
20583 
20584 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_INQUIRY: exit\n");
20585 
20586 	return (status);
20587 }
20588 
20589 
20590 /*
20591  *    Function: sd_send_scsi_TEST_UNIT_READY
20592  *
20593  * Description: Issue the scsi TEST UNIT READY command.
20594  *		This routine can be told to set the flag USCSI_DIAGNOSE to
20595  *		prevent retrying failed commands. Use this when the intent
20596  *		is either to check for device readiness, to clear a Unit
20597  *		Attention, or to clear any outstanding sense data.
20598  *		However under specific conditions the expected behavior
20599  *		is for retries to bring a device ready, so use the flag
20600  *		with caution.
20601  *
20602  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
20603  *                      structure for this target.
20604  *		flag:   SD_CHECK_FOR_MEDIA: return ENXIO if no media present
20605  *			SD_DONT_RETRY_TUR: include uscsi flag USCSI_DIAGNOSE.
20606  *			0: dont check for media present, do retries on cmd.
20607  *
20608  * Return Code: 0   - Success
20609  *		EIO - IO error
20610  *		EACCES - Reservation conflict detected
20611  *		ENXIO  - Not Ready, medium not present
20612  *		errno return code from sd_ssc_send()
20613  *
20614  *     Context: Can sleep. Does not return until command is completed.
20615  */
20616 
20617 static int
20618 sd_send_scsi_TEST_UNIT_READY(sd_ssc_t *ssc, int flag)
20619 {
20620 	struct	scsi_extended_sense	sense_buf;
20621 	union scsi_cdb		cdb;
20622 	struct uscsi_cmd	ucmd_buf;
20623 	int			status;
20624 	struct sd_lun		*un;
20625 
20626 	ASSERT(ssc != NULL);
20627 	un = ssc->ssc_un;
20628 	ASSERT(un != NULL);
20629 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20630 
20631 	SD_TRACE(SD_LOG_IO, un,
20632 	    "sd_send_scsi_TEST_UNIT_READY: entry: un:0x%p\n", un);
20633 
20634 	/*
20635 	 * Some Seagate elite1 TQ devices get hung with disconnect/reconnect
20636 	 * timeouts when they receive a TUR and the queue is not empty. Check
20637 	 * the configuration flag set during attach (indicating the drive has
20638 	 * this firmware bug) and un_ncmds_in_transport before issuing the
20639 	 * TUR. If there are
20640 	 * pending commands return success, this is a bit arbitrary but is ok
20641 	 * for non-removables (i.e. the eliteI disks) and non-clustering
20642 	 * configurations.
20643 	 */
20644 	if (un->un_f_cfg_tur_check == TRUE) {
20645 		mutex_enter(SD_MUTEX(un));
20646 		if (un->un_ncmds_in_transport != 0) {
20647 			mutex_exit(SD_MUTEX(un));
20648 			return (0);
20649 		}
20650 		mutex_exit(SD_MUTEX(un));
20651 	}
20652 
20653 	bzero(&cdb, sizeof (cdb));
20654 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20655 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
20656 
20657 	cdb.scc_cmd = SCMD_TEST_UNIT_READY;
20658 
20659 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20660 	ucmd_buf.uscsi_cdblen	= CDB_GROUP0;
20661 	ucmd_buf.uscsi_bufaddr	= NULL;
20662 	ucmd_buf.uscsi_buflen	= 0;
20663 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20664 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
20665 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_SILENT;
20666 
20667 	/* Use flag USCSI_DIAGNOSE to prevent retries if it fails. */
20668 	if ((flag & SD_DONT_RETRY_TUR) != 0) {
20669 		ucmd_buf.uscsi_flags |= USCSI_DIAGNOSE;
20670 	}
20671 	ucmd_buf.uscsi_timeout	= 60;
20672 
20673 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20674 	    UIO_SYSSPACE, ((flag & SD_BYPASS_PM) ? SD_PATH_DIRECT :
20675 	    SD_PATH_STANDARD));
20676 
20677 	switch (status) {
20678 	case 0:
20679 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20680 		break;	/* Success! */
20681 	case EIO:
20682 		switch (ucmd_buf.uscsi_status) {
20683 		case STATUS_RESERVATION_CONFLICT:
20684 			status = EACCES;
20685 			break;
20686 		case STATUS_CHECK:
20687 			if ((flag & SD_CHECK_FOR_MEDIA) == 0) {
20688 				break;
20689 			}
20690 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20691 			    (scsi_sense_key((uint8_t *)&sense_buf) ==
20692 			    KEY_NOT_READY) &&
20693 			    (scsi_sense_asc((uint8_t *)&sense_buf) == 0x3A)) {
20694 				status = ENXIO;
20695 			}
20696 			break;
20697 		default:
20698 			break;
20699 		}
20700 		break;
20701 	default:
20702 		break;
20703 	}
20704 
20705 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_TEST_UNIT_READY: exit\n");
20706 
20707 	return (status);
20708 }
20709 
20710 /*
20711  *    Function: sd_send_scsi_PERSISTENT_RESERVE_IN
20712  *
20713  * Description: Issue the scsi PERSISTENT RESERVE IN command.
20714  *
20715  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
20716  *                      structure for this target.
20717  *
20718  * Return Code: 0   - Success
20719  *		EACCES
20720  *		ENOTSUP
20721  *		errno return code from sd_ssc_send()
20722  *
20723  *     Context: Can sleep. Does not return until command is completed.
20724  */
20725 
20726 static int
20727 sd_send_scsi_PERSISTENT_RESERVE_IN(sd_ssc_t *ssc, uchar_t  usr_cmd,
20728 	uint16_t data_len, uchar_t *data_bufp)
20729 {
20730 	struct scsi_extended_sense	sense_buf;
20731 	union scsi_cdb		cdb;
20732 	struct uscsi_cmd	ucmd_buf;
20733 	int			status;
20734 	int			no_caller_buf = FALSE;
20735 	struct sd_lun		*un;
20736 
20737 	ASSERT(ssc != NULL);
20738 	un = ssc->ssc_un;
20739 	ASSERT(un != NULL);
20740 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20741 	ASSERT((usr_cmd == SD_READ_KEYS) || (usr_cmd == SD_READ_RESV));
20742 
20743 	SD_TRACE(SD_LOG_IO, un,
20744 	    "sd_send_scsi_PERSISTENT_RESERVE_IN: entry: un:0x%p\n", un);
20745 
20746 	bzero(&cdb, sizeof (cdb));
20747 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20748 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
20749 	if (data_bufp == NULL) {
20750 		/* Allocate a default buf if the caller did not give one */
20751 		ASSERT(data_len == 0);
20752 		data_len  = MHIOC_RESV_KEY_SIZE;
20753 		data_bufp = kmem_zalloc(MHIOC_RESV_KEY_SIZE, KM_SLEEP);
20754 		no_caller_buf = TRUE;
20755 	}
20756 
20757 	cdb.scc_cmd = SCMD_PERSISTENT_RESERVE_IN;
20758 	cdb.cdb_opaque[1] = usr_cmd;
20759 	FORMG1COUNT(&cdb, data_len);
20760 
20761 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20762 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
20763 	ucmd_buf.uscsi_bufaddr	= (caddr_t)data_bufp;
20764 	ucmd_buf.uscsi_buflen	= data_len;
20765 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20766 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
20767 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
20768 	ucmd_buf.uscsi_timeout	= 60;
20769 
20770 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20771 	    UIO_SYSSPACE, SD_PATH_STANDARD);
20772 
20773 	switch (status) {
20774 	case 0:
20775 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20776 
20777 		break;	/* Success! */
20778 	case EIO:
20779 		switch (ucmd_buf.uscsi_status) {
20780 		case STATUS_RESERVATION_CONFLICT:
20781 			status = EACCES;
20782 			break;
20783 		case STATUS_CHECK:
20784 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20785 			    (scsi_sense_key((uint8_t *)&sense_buf) ==
20786 			    KEY_ILLEGAL_REQUEST)) {
20787 				status = ENOTSUP;
20788 			}
20789 			break;
20790 		default:
20791 			break;
20792 		}
20793 		break;
20794 	default:
20795 		break;
20796 	}
20797 
20798 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_PERSISTENT_RESERVE_IN: exit\n");
20799 
20800 	if (no_caller_buf == TRUE) {
20801 		kmem_free(data_bufp, data_len);
20802 	}
20803 
20804 	return (status);
20805 }
20806 
20807 
20808 /*
20809  *    Function: sd_send_scsi_PERSISTENT_RESERVE_OUT
20810  *
20811  * Description: This routine is the driver entry point for handling CD-ROM
20812  *		multi-host persistent reservation requests (MHIOCGRP_INKEYS,
20813  *		MHIOCGRP_INRESV) by sending the SCSI-3 PROUT commands to the
20814  *		device.
20815  *
20816  *   Arguments: ssc  -  ssc contains un - pointer to soft state struct
20817  *                      for the target.
20818  *		usr_cmd SCSI-3 reservation facility command (one of
20819  *			SD_SCSI3_REGISTER, SD_SCSI3_RESERVE, SD_SCSI3_RELEASE,
20820  *			SD_SCSI3_PREEMPTANDABORT)
20821  *		usr_bufp - user provided pointer register, reserve descriptor or
20822  *			preempt and abort structure (mhioc_register_t,
20823  *                      mhioc_resv_desc_t, mhioc_preemptandabort_t)
20824  *
20825  * Return Code: 0   - Success
20826  *		EACCES
20827  *		ENOTSUP
20828  *		errno return code from sd_ssc_send()
20829  *
20830  *     Context: Can sleep. Does not return until command is completed.
20831  */
20832 
20833 static int
20834 sd_send_scsi_PERSISTENT_RESERVE_OUT(sd_ssc_t *ssc, uchar_t usr_cmd,
20835 	uchar_t	*usr_bufp)
20836 {
20837 	struct scsi_extended_sense	sense_buf;
20838 	union scsi_cdb		cdb;
20839 	struct uscsi_cmd	ucmd_buf;
20840 	int			status;
20841 	uchar_t			data_len = sizeof (sd_prout_t);
20842 	sd_prout_t		*prp;
20843 	struct sd_lun		*un;
20844 
20845 	ASSERT(ssc != NULL);
20846 	un = ssc->ssc_un;
20847 	ASSERT(un != NULL);
20848 	ASSERT(!mutex_owned(SD_MUTEX(un)));
20849 	ASSERT(data_len == 24);	/* required by scsi spec */
20850 
20851 	SD_TRACE(SD_LOG_IO, un,
20852 	    "sd_send_scsi_PERSISTENT_RESERVE_OUT: entry: un:0x%p\n", un);
20853 
20854 	if (usr_bufp == NULL) {
20855 		return (EINVAL);
20856 	}
20857 
20858 	bzero(&cdb, sizeof (cdb));
20859 	bzero(&ucmd_buf, sizeof (ucmd_buf));
20860 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
20861 	prp = kmem_zalloc(data_len, KM_SLEEP);
20862 
20863 	cdb.scc_cmd = SCMD_PERSISTENT_RESERVE_OUT;
20864 	cdb.cdb_opaque[1] = usr_cmd;
20865 	FORMG1COUNT(&cdb, data_len);
20866 
20867 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
20868 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
20869 	ucmd_buf.uscsi_bufaddr	= (caddr_t)prp;
20870 	ucmd_buf.uscsi_buflen	= data_len;
20871 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
20872 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
20873 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_WRITE | USCSI_SILENT;
20874 	ucmd_buf.uscsi_timeout	= 60;
20875 
20876 	switch (usr_cmd) {
20877 	case SD_SCSI3_REGISTER: {
20878 		mhioc_register_t *ptr = (mhioc_register_t *)usr_bufp;
20879 
20880 		bcopy(ptr->oldkey.key, prp->res_key, MHIOC_RESV_KEY_SIZE);
20881 		bcopy(ptr->newkey.key, prp->service_key,
20882 		    MHIOC_RESV_KEY_SIZE);
20883 		prp->aptpl = ptr->aptpl;
20884 		break;
20885 	}
20886 	case SD_SCSI3_RESERVE:
20887 	case SD_SCSI3_RELEASE: {
20888 		mhioc_resv_desc_t *ptr = (mhioc_resv_desc_t *)usr_bufp;
20889 
20890 		bcopy(ptr->key.key, prp->res_key, MHIOC_RESV_KEY_SIZE);
20891 		prp->scope_address = BE_32(ptr->scope_specific_addr);
20892 		cdb.cdb_opaque[2] = ptr->type;
20893 		break;
20894 	}
20895 	case SD_SCSI3_PREEMPTANDABORT: {
20896 		mhioc_preemptandabort_t *ptr =
20897 		    (mhioc_preemptandabort_t *)usr_bufp;
20898 
20899 		bcopy(ptr->resvdesc.key.key, prp->res_key, MHIOC_RESV_KEY_SIZE);
20900 		bcopy(ptr->victim_key.key, prp->service_key,
20901 		    MHIOC_RESV_KEY_SIZE);
20902 		prp->scope_address = BE_32(ptr->resvdesc.scope_specific_addr);
20903 		cdb.cdb_opaque[2] = ptr->resvdesc.type;
20904 		ucmd_buf.uscsi_flags |= USCSI_HEAD;
20905 		break;
20906 	}
20907 	case SD_SCSI3_REGISTERANDIGNOREKEY:
20908 	{
20909 		mhioc_registerandignorekey_t *ptr;
20910 		ptr = (mhioc_registerandignorekey_t *)usr_bufp;
20911 		bcopy(ptr->newkey.key,
20912 		    prp->service_key, MHIOC_RESV_KEY_SIZE);
20913 		prp->aptpl = ptr->aptpl;
20914 		break;
20915 	}
20916 	default:
20917 		ASSERT(FALSE);
20918 		break;
20919 	}
20920 
20921 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
20922 	    UIO_SYSSPACE, SD_PATH_STANDARD);
20923 
20924 	switch (status) {
20925 	case 0:
20926 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
20927 		break;	/* Success! */
20928 	case EIO:
20929 		switch (ucmd_buf.uscsi_status) {
20930 		case STATUS_RESERVATION_CONFLICT:
20931 			status = EACCES;
20932 			break;
20933 		case STATUS_CHECK:
20934 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
20935 			    (scsi_sense_key((uint8_t *)&sense_buf) ==
20936 			    KEY_ILLEGAL_REQUEST)) {
20937 				status = ENOTSUP;
20938 			}
20939 			break;
20940 		default:
20941 			break;
20942 		}
20943 		break;
20944 	default:
20945 		break;
20946 	}
20947 
20948 	kmem_free(prp, data_len);
20949 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_PERSISTENT_RESERVE_OUT: exit\n");
20950 	return (status);
20951 }
20952 
20953 
20954 /*
20955  *    Function: sd_send_scsi_SYNCHRONIZE_CACHE
20956  *
20957  * Description: Issues a scsi SYNCHRONIZE CACHE command to the target
20958  *
20959  *   Arguments: un - pointer to the target's soft state struct
20960  *              dkc - pointer to the callback structure
20961  *
20962  * Return Code: 0 - success
20963  *		errno-type error code
20964  *
20965  *     Context: kernel thread context only.
20966  *
20967  *  _______________________________________________________________
20968  * | dkc_flag &   | dkc_callback | DKIOCFLUSHWRITECACHE            |
20969  * |FLUSH_VOLATILE|              | operation                       |
20970  * |______________|______________|_________________________________|
20971  * | 0            | NULL         | Synchronous flush on both       |
20972  * |              |              | volatile and non-volatile cache |
20973  * |______________|______________|_________________________________|
20974  * | 1            | NULL         | Synchronous flush on volatile   |
20975  * |              |              | cache; disk drivers may suppress|
20976  * |              |              | flush if disk table indicates   |
20977  * |              |              | non-volatile cache              |
20978  * |______________|______________|_________________________________|
20979  * | 0            | !NULL        | Asynchronous flush on both      |
20980  * |              |              | volatile and non-volatile cache;|
20981  * |______________|______________|_________________________________|
20982  * | 1            | !NULL        | Asynchronous flush on volatile  |
20983  * |              |              | cache; disk drivers may suppress|
20984  * |              |              | flush if disk table indicates   |
20985  * |              |              | non-volatile cache              |
20986  * |______________|______________|_________________________________|
20987  *
20988  */
20989 
20990 static int
20991 sd_send_scsi_SYNCHRONIZE_CACHE(struct sd_lun *un, struct dk_callback *dkc)
20992 {
20993 	struct sd_uscsi_info	*uip;
20994 	struct uscsi_cmd	*uscmd;
20995 	union scsi_cdb		*cdb;
20996 	struct buf		*bp;
20997 	int			rval = 0;
20998 	int			is_async;
20999 
21000 	SD_TRACE(SD_LOG_IO, un,
21001 	    "sd_send_scsi_SYNCHRONIZE_CACHE: entry: un:0x%p\n", un);
21002 
21003 	ASSERT(un != NULL);
21004 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21005 
21006 	if (dkc == NULL || dkc->dkc_callback == NULL) {
21007 		is_async = FALSE;
21008 	} else {
21009 		is_async = TRUE;
21010 	}
21011 
21012 	mutex_enter(SD_MUTEX(un));
21013 	/* check whether cache flush should be suppressed */
21014 	if (un->un_f_suppress_cache_flush == TRUE) {
21015 		mutex_exit(SD_MUTEX(un));
21016 		/*
21017 		 * suppress the cache flush if the device is told to do
21018 		 * so by sd.conf or disk table
21019 		 */
21020 		SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_SYNCHRONIZE_CACHE: \
21021 		    skip the cache flush since suppress_cache_flush is %d!\n",
21022 		    un->un_f_suppress_cache_flush);
21023 
21024 		if (is_async == TRUE) {
21025 			/* invoke callback for asynchronous flush */
21026 			(*dkc->dkc_callback)(dkc->dkc_cookie, 0);
21027 		}
21028 		return (rval);
21029 	}
21030 	mutex_exit(SD_MUTEX(un));
21031 
21032 	/*
21033 	 * check dkc_flag & FLUSH_VOLATILE so SYNC_NV bit can be
21034 	 * set properly
21035 	 */
21036 	cdb = kmem_zalloc(CDB_GROUP1, KM_SLEEP);
21037 	cdb->scc_cmd = SCMD_SYNCHRONIZE_CACHE;
21038 
21039 	mutex_enter(SD_MUTEX(un));
21040 	if (dkc != NULL && un->un_f_sync_nv_supported &&
21041 	    (dkc->dkc_flag & FLUSH_VOLATILE)) {
21042 		/*
21043 		 * if the device supports SYNC_NV bit, turn on
21044 		 * the SYNC_NV bit to only flush volatile cache
21045 		 */
21046 		cdb->cdb_un.tag |= SD_SYNC_NV_BIT;
21047 	}
21048 	mutex_exit(SD_MUTEX(un));
21049 
21050 	/*
21051 	 * First get some memory for the uscsi_cmd struct and cdb
21052 	 * and initialize for SYNCHRONIZE_CACHE cmd.
21053 	 */
21054 	uscmd = kmem_zalloc(sizeof (struct uscsi_cmd), KM_SLEEP);
21055 	uscmd->uscsi_cdblen = CDB_GROUP1;
21056 	uscmd->uscsi_cdb = (caddr_t)cdb;
21057 	uscmd->uscsi_bufaddr = NULL;
21058 	uscmd->uscsi_buflen = 0;
21059 	uscmd->uscsi_rqbuf = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
21060 	uscmd->uscsi_rqlen = SENSE_LENGTH;
21061 	uscmd->uscsi_rqresid = SENSE_LENGTH;
21062 	uscmd->uscsi_flags = USCSI_RQENABLE | USCSI_SILENT;
21063 	uscmd->uscsi_timeout = sd_io_time;
21064 
21065 	/*
21066 	 * Allocate an sd_uscsi_info struct and fill it with the info
21067 	 * needed by sd_initpkt_for_uscsi().  Then put the pointer into
21068 	 * b_private in the buf for sd_initpkt_for_uscsi().  Note that
21069 	 * since we allocate the buf here in this function, we do not
21070 	 * need to preserve the prior contents of b_private.
21071 	 * The sd_uscsi_info struct is also used by sd_uscsi_strategy()
21072 	 */
21073 	uip = kmem_zalloc(sizeof (struct sd_uscsi_info), KM_SLEEP);
21074 	uip->ui_flags = SD_PATH_DIRECT;
21075 	uip->ui_cmdp  = uscmd;
21076 
21077 	bp = getrbuf(KM_SLEEP);
21078 	bp->b_private = uip;
21079 
21080 	/*
21081 	 * Setup buffer to carry uscsi request.
21082 	 */
21083 	bp->b_flags  = B_BUSY;
21084 	bp->b_bcount = 0;
21085 	bp->b_blkno  = 0;
21086 
21087 	if (is_async == TRUE) {
21088 		bp->b_iodone = sd_send_scsi_SYNCHRONIZE_CACHE_biodone;
21089 		uip->ui_dkc = *dkc;
21090 	}
21091 
21092 	bp->b_edev = SD_GET_DEV(un);
21093 	bp->b_dev = cmpdev(bp->b_edev);	/* maybe unnecessary? */
21094 
21095 	/*
21096 	 * Unset un_f_sync_cache_required flag
21097 	 */
21098 	mutex_enter(SD_MUTEX(un));
21099 	un->un_f_sync_cache_required = FALSE;
21100 	mutex_exit(SD_MUTEX(un));
21101 
21102 	(void) sd_uscsi_strategy(bp);
21103 
21104 	/*
21105 	 * If synchronous request, wait for completion
21106 	 * If async just return and let b_iodone callback
21107 	 * cleanup.
21108 	 * NOTE: On return, u_ncmds_in_driver will be decremented,
21109 	 * but it was also incremented in sd_uscsi_strategy(), so
21110 	 * we should be ok.
21111 	 */
21112 	if (is_async == FALSE) {
21113 		(void) biowait(bp);
21114 		rval = sd_send_scsi_SYNCHRONIZE_CACHE_biodone(bp);
21115 	}
21116 
21117 	return (rval);
21118 }
21119 
21120 
21121 static int
21122 sd_send_scsi_SYNCHRONIZE_CACHE_biodone(struct buf *bp)
21123 {
21124 	struct sd_uscsi_info *uip;
21125 	struct uscsi_cmd *uscmd;
21126 	uint8_t *sense_buf;
21127 	struct sd_lun *un;
21128 	int status;
21129 	union scsi_cdb *cdb;
21130 
21131 	uip = (struct sd_uscsi_info *)(bp->b_private);
21132 	ASSERT(uip != NULL);
21133 
21134 	uscmd = uip->ui_cmdp;
21135 	ASSERT(uscmd != NULL);
21136 
21137 	sense_buf = (uint8_t *)uscmd->uscsi_rqbuf;
21138 	ASSERT(sense_buf != NULL);
21139 
21140 	un = ddi_get_soft_state(sd_state, SD_GET_INSTANCE_FROM_BUF(bp));
21141 	ASSERT(un != NULL);
21142 
21143 	cdb = (union scsi_cdb *)uscmd->uscsi_cdb;
21144 
21145 	status = geterror(bp);
21146 	switch (status) {
21147 	case 0:
21148 		break;	/* Success! */
21149 	case EIO:
21150 		switch (uscmd->uscsi_status) {
21151 		case STATUS_RESERVATION_CONFLICT:
21152 			/* Ignore reservation conflict */
21153 			status = 0;
21154 			goto done;
21155 
21156 		case STATUS_CHECK:
21157 			if ((uscmd->uscsi_rqstatus == STATUS_GOOD) &&
21158 			    (scsi_sense_key(sense_buf) ==
21159 			    KEY_ILLEGAL_REQUEST)) {
21160 				/* Ignore Illegal Request error */
21161 				if (cdb->cdb_un.tag&SD_SYNC_NV_BIT) {
21162 					mutex_enter(SD_MUTEX(un));
21163 					un->un_f_sync_nv_supported = FALSE;
21164 					mutex_exit(SD_MUTEX(un));
21165 					status = 0;
21166 					SD_TRACE(SD_LOG_IO, un,
21167 					    "un_f_sync_nv_supported \
21168 					    is set to false.\n");
21169 					goto done;
21170 				}
21171 
21172 				mutex_enter(SD_MUTEX(un));
21173 				un->un_f_sync_cache_supported = FALSE;
21174 				mutex_exit(SD_MUTEX(un));
21175 				SD_TRACE(SD_LOG_IO, un,
21176 				    "sd_send_scsi_SYNCHRONIZE_CACHE_biodone: \
21177 				    un_f_sync_cache_supported set to false \
21178 				    with asc = %x, ascq = %x\n",
21179 				    scsi_sense_asc(sense_buf),
21180 				    scsi_sense_ascq(sense_buf));
21181 				status = ENOTSUP;
21182 				goto done;
21183 			}
21184 			break;
21185 		default:
21186 			break;
21187 		}
21188 		/* FALLTHRU */
21189 	default:
21190 		/*
21191 		 * Turn on the un_f_sync_cache_required flag
21192 		 * since the SYNC CACHE command failed
21193 		 */
21194 		mutex_enter(SD_MUTEX(un));
21195 		un->un_f_sync_cache_required = TRUE;
21196 		mutex_exit(SD_MUTEX(un));
21197 
21198 		/*
21199 		 * Don't log an error message if this device
21200 		 * has removable media.
21201 		 */
21202 		if (!un->un_f_has_removable_media) {
21203 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
21204 			    "SYNCHRONIZE CACHE command failed (%d)\n", status);
21205 		}
21206 		break;
21207 	}
21208 
21209 done:
21210 	if (uip->ui_dkc.dkc_callback != NULL) {
21211 		(*uip->ui_dkc.dkc_callback)(uip->ui_dkc.dkc_cookie, status);
21212 	}
21213 
21214 	ASSERT((bp->b_flags & B_REMAPPED) == 0);
21215 	freerbuf(bp);
21216 	kmem_free(uip, sizeof (struct sd_uscsi_info));
21217 	kmem_free(uscmd->uscsi_rqbuf, SENSE_LENGTH);
21218 	kmem_free(uscmd->uscsi_cdb, (size_t)uscmd->uscsi_cdblen);
21219 	kmem_free(uscmd, sizeof (struct uscsi_cmd));
21220 
21221 	return (status);
21222 }
21223 
21224 
21225 /*
21226  *    Function: sd_send_scsi_GET_CONFIGURATION
21227  *
21228  * Description: Issues the get configuration command to the device.
21229  *		Called from sd_check_for_writable_cd & sd_get_media_info
21230  *		caller needs to ensure that buflen = SD_PROFILE_HEADER_LEN
21231  *   Arguments: ssc
21232  *		ucmdbuf
21233  *		rqbuf
21234  *		rqbuflen
21235  *		bufaddr
21236  *		buflen
21237  *		path_flag
21238  *
21239  * Return Code: 0   - Success
21240  *		errno return code from sd_ssc_send()
21241  *
21242  *     Context: Can sleep. Does not return until command is completed.
21243  *
21244  */
21245 
21246 static int
21247 sd_send_scsi_GET_CONFIGURATION(sd_ssc_t *ssc, struct uscsi_cmd *ucmdbuf,
21248 	uchar_t *rqbuf, uint_t rqbuflen, uchar_t *bufaddr, uint_t buflen,
21249 	int path_flag)
21250 {
21251 	char	cdb[CDB_GROUP1];
21252 	int	status;
21253 	struct sd_lun	*un;
21254 
21255 	ASSERT(ssc != NULL);
21256 	un = ssc->ssc_un;
21257 	ASSERT(un != NULL);
21258 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21259 	ASSERT(bufaddr != NULL);
21260 	ASSERT(ucmdbuf != NULL);
21261 	ASSERT(rqbuf != NULL);
21262 
21263 	SD_TRACE(SD_LOG_IO, un,
21264 	    "sd_send_scsi_GET_CONFIGURATION: entry: un:0x%p\n", un);
21265 
21266 	bzero(cdb, sizeof (cdb));
21267 	bzero(ucmdbuf, sizeof (struct uscsi_cmd));
21268 	bzero(rqbuf, rqbuflen);
21269 	bzero(bufaddr, buflen);
21270 
21271 	/*
21272 	 * Set up cdb field for the get configuration command.
21273 	 */
21274 	cdb[0] = SCMD_GET_CONFIGURATION;
21275 	cdb[1] = 0x02;  /* Requested Type */
21276 	cdb[8] = SD_PROFILE_HEADER_LEN;
21277 	ucmdbuf->uscsi_cdb = cdb;
21278 	ucmdbuf->uscsi_cdblen = CDB_GROUP1;
21279 	ucmdbuf->uscsi_bufaddr = (caddr_t)bufaddr;
21280 	ucmdbuf->uscsi_buflen = buflen;
21281 	ucmdbuf->uscsi_timeout = sd_io_time;
21282 	ucmdbuf->uscsi_rqbuf = (caddr_t)rqbuf;
21283 	ucmdbuf->uscsi_rqlen = rqbuflen;
21284 	ucmdbuf->uscsi_flags = USCSI_RQENABLE|USCSI_SILENT|USCSI_READ;
21285 
21286 	status = sd_ssc_send(ssc, ucmdbuf, FKIOCTL,
21287 	    UIO_SYSSPACE, path_flag);
21288 
21289 	switch (status) {
21290 	case 0:
21291 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21292 		break;  /* Success! */
21293 	case EIO:
21294 		switch (ucmdbuf->uscsi_status) {
21295 		case STATUS_RESERVATION_CONFLICT:
21296 			status = EACCES;
21297 			break;
21298 		default:
21299 			break;
21300 		}
21301 		break;
21302 	default:
21303 		break;
21304 	}
21305 
21306 	if (status == 0) {
21307 		SD_DUMP_MEMORY(un, SD_LOG_IO,
21308 		    "sd_send_scsi_GET_CONFIGURATION: data",
21309 		    (uchar_t *)bufaddr, SD_PROFILE_HEADER_LEN, SD_LOG_HEX);
21310 	}
21311 
21312 	SD_TRACE(SD_LOG_IO, un,
21313 	    "sd_send_scsi_GET_CONFIGURATION: exit\n");
21314 
21315 	return (status);
21316 }
21317 
21318 /*
21319  *    Function: sd_send_scsi_feature_GET_CONFIGURATION
21320  *
21321  * Description: Issues the get configuration command to the device to
21322  *              retrieve a specific feature. Called from
21323  *		sd_check_for_writable_cd & sd_set_mmc_caps.
21324  *   Arguments: ssc
21325  *              ucmdbuf
21326  *              rqbuf
21327  *              rqbuflen
21328  *              bufaddr
21329  *              buflen
21330  *		feature
21331  *
21332  * Return Code: 0   - Success
21333  *              errno return code from sd_ssc_send()
21334  *
21335  *     Context: Can sleep. Does not return until command is completed.
21336  *
21337  */
21338 static int
21339 sd_send_scsi_feature_GET_CONFIGURATION(sd_ssc_t *ssc,
21340 	struct uscsi_cmd *ucmdbuf, uchar_t *rqbuf, uint_t rqbuflen,
21341 	uchar_t *bufaddr, uint_t buflen, char feature, int path_flag)
21342 {
21343 	char    cdb[CDB_GROUP1];
21344 	int	status;
21345 	struct sd_lun	*un;
21346 
21347 	ASSERT(ssc != NULL);
21348 	un = ssc->ssc_un;
21349 	ASSERT(un != NULL);
21350 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21351 	ASSERT(bufaddr != NULL);
21352 	ASSERT(ucmdbuf != NULL);
21353 	ASSERT(rqbuf != NULL);
21354 
21355 	SD_TRACE(SD_LOG_IO, un,
21356 	    "sd_send_scsi_feature_GET_CONFIGURATION: entry: un:0x%p\n", un);
21357 
21358 	bzero(cdb, sizeof (cdb));
21359 	bzero(ucmdbuf, sizeof (struct uscsi_cmd));
21360 	bzero(rqbuf, rqbuflen);
21361 	bzero(bufaddr, buflen);
21362 
21363 	/*
21364 	 * Set up cdb field for the get configuration command.
21365 	 */
21366 	cdb[0] = SCMD_GET_CONFIGURATION;
21367 	cdb[1] = 0x02;  /* Requested Type */
21368 	cdb[3] = feature;
21369 	cdb[8] = buflen;
21370 	ucmdbuf->uscsi_cdb = cdb;
21371 	ucmdbuf->uscsi_cdblen = CDB_GROUP1;
21372 	ucmdbuf->uscsi_bufaddr = (caddr_t)bufaddr;
21373 	ucmdbuf->uscsi_buflen = buflen;
21374 	ucmdbuf->uscsi_timeout = sd_io_time;
21375 	ucmdbuf->uscsi_rqbuf = (caddr_t)rqbuf;
21376 	ucmdbuf->uscsi_rqlen = rqbuflen;
21377 	ucmdbuf->uscsi_flags = USCSI_RQENABLE|USCSI_SILENT|USCSI_READ;
21378 
21379 	status = sd_ssc_send(ssc, ucmdbuf, FKIOCTL,
21380 	    UIO_SYSSPACE, path_flag);
21381 
21382 	switch (status) {
21383 	case 0:
21384 
21385 		break;  /* Success! */
21386 	case EIO:
21387 		switch (ucmdbuf->uscsi_status) {
21388 		case STATUS_RESERVATION_CONFLICT:
21389 			status = EACCES;
21390 			break;
21391 		default:
21392 			break;
21393 		}
21394 		break;
21395 	default:
21396 		break;
21397 	}
21398 
21399 	if (status == 0) {
21400 		SD_DUMP_MEMORY(un, SD_LOG_IO,
21401 		    "sd_send_scsi_feature_GET_CONFIGURATION: data",
21402 		    (uchar_t *)bufaddr, SD_PROFILE_HEADER_LEN, SD_LOG_HEX);
21403 	}
21404 
21405 	SD_TRACE(SD_LOG_IO, un,
21406 	    "sd_send_scsi_feature_GET_CONFIGURATION: exit\n");
21407 
21408 	return (status);
21409 }
21410 
21411 
21412 /*
21413  *    Function: sd_send_scsi_MODE_SENSE
21414  *
21415  * Description: Utility function for issuing a scsi MODE SENSE command.
21416  *		Note: This routine uses a consistent implementation for Group0,
21417  *		Group1, and Group2 commands across all platforms. ATAPI devices
21418  *		use Group 1 Read/Write commands and Group 2 Mode Sense/Select
21419  *
21420  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
21421  *                      structure for this target.
21422  *		cdbsize - size CDB to be used (CDB_GROUP0 (6 byte), or
21423  *			  CDB_GROUP[1|2] (10 byte).
21424  *		bufaddr - buffer for page data retrieved from the target.
21425  *		buflen - size of page to be retrieved.
21426  *		page_code - page code of data to be retrieved from the target.
21427  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
21428  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
21429  *			to use the USCSI "direct" chain and bypass the normal
21430  *			command waitq.
21431  *
21432  * Return Code: 0   - Success
21433  *		errno return code from sd_ssc_send()
21434  *
21435  *     Context: Can sleep. Does not return until command is completed.
21436  */
21437 
21438 static int
21439 sd_send_scsi_MODE_SENSE(sd_ssc_t *ssc, int cdbsize, uchar_t *bufaddr,
21440 	size_t buflen,  uchar_t page_code, int path_flag)
21441 {
21442 	struct	scsi_extended_sense	sense_buf;
21443 	union scsi_cdb		cdb;
21444 	struct uscsi_cmd	ucmd_buf;
21445 	int			status;
21446 	int			headlen;
21447 	struct sd_lun		*un;
21448 
21449 	ASSERT(ssc != NULL);
21450 	un = ssc->ssc_un;
21451 	ASSERT(un != NULL);
21452 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21453 	ASSERT(bufaddr != NULL);
21454 	ASSERT((cdbsize == CDB_GROUP0) || (cdbsize == CDB_GROUP1) ||
21455 	    (cdbsize == CDB_GROUP2));
21456 
21457 	SD_TRACE(SD_LOG_IO, un,
21458 	    "sd_send_scsi_MODE_SENSE: entry: un:0x%p\n", un);
21459 
21460 	bzero(&cdb, sizeof (cdb));
21461 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21462 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
21463 	bzero(bufaddr, buflen);
21464 
21465 	if (cdbsize == CDB_GROUP0) {
21466 		cdb.scc_cmd = SCMD_MODE_SENSE;
21467 		cdb.cdb_opaque[2] = page_code;
21468 		FORMG0COUNT(&cdb, buflen);
21469 		headlen = MODE_HEADER_LENGTH;
21470 	} else {
21471 		cdb.scc_cmd = SCMD_MODE_SENSE_G1;
21472 		cdb.cdb_opaque[2] = page_code;
21473 		FORMG1COUNT(&cdb, buflen);
21474 		headlen = MODE_HEADER_LENGTH_GRP2;
21475 	}
21476 
21477 	ASSERT(headlen <= buflen);
21478 	SD_FILL_SCSI1_LUN_CDB(un, &cdb);
21479 
21480 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
21481 	ucmd_buf.uscsi_cdblen	= (uchar_t)cdbsize;
21482 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
21483 	ucmd_buf.uscsi_buflen	= buflen;
21484 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
21485 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
21486 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
21487 	ucmd_buf.uscsi_timeout	= 60;
21488 
21489 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
21490 	    UIO_SYSSPACE, path_flag);
21491 
21492 	switch (status) {
21493 	case 0:
21494 		/*
21495 		 * sr_check_wp() uses 0x3f page code and check the header of
21496 		 * mode page to determine if target device is write-protected.
21497 		 * But some USB devices return 0 bytes for 0x3f page code. For
21498 		 * this case, make sure that mode page header is returned at
21499 		 * least.
21500 		 */
21501 		if (buflen - ucmd_buf.uscsi_resid <  headlen) {
21502 			status = EIO;
21503 			sd_ssc_set_info(ssc, SSC_FLAGS_INVALID_DATA, -1,
21504 			    "mode page header is not returned");
21505 		}
21506 		break;	/* Success! */
21507 	case EIO:
21508 		switch (ucmd_buf.uscsi_status) {
21509 		case STATUS_RESERVATION_CONFLICT:
21510 			status = EACCES;
21511 			break;
21512 		default:
21513 			break;
21514 		}
21515 		break;
21516 	default:
21517 		break;
21518 	}
21519 
21520 	if (status == 0) {
21521 		SD_DUMP_MEMORY(un, SD_LOG_IO, "sd_send_scsi_MODE_SENSE: data",
21522 		    (uchar_t *)bufaddr, buflen, SD_LOG_HEX);
21523 	}
21524 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_MODE_SENSE: exit\n");
21525 
21526 	return (status);
21527 }
21528 
21529 
21530 /*
21531  *    Function: sd_send_scsi_MODE_SELECT
21532  *
21533  * Description: Utility function for issuing a scsi MODE SELECT command.
21534  *		Note: This routine uses a consistent implementation for Group0,
21535  *		Group1, and Group2 commands across all platforms. ATAPI devices
21536  *		use Group 1 Read/Write commands and Group 2 Mode Sense/Select
21537  *
21538  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
21539  *                      structure for this target.
21540  *		cdbsize - size CDB to be used (CDB_GROUP0 (6 byte), or
21541  *			  CDB_GROUP[1|2] (10 byte).
21542  *		bufaddr - buffer for page data retrieved from the target.
21543  *		buflen - size of page to be retrieved.
21544  *		save_page - boolean to determin if SP bit should be set.
21545  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
21546  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
21547  *			to use the USCSI "direct" chain and bypass the normal
21548  *			command waitq.
21549  *
21550  * Return Code: 0   - Success
21551  *		errno return code from sd_ssc_send()
21552  *
21553  *     Context: Can sleep. Does not return until command is completed.
21554  */
21555 
21556 static int
21557 sd_send_scsi_MODE_SELECT(sd_ssc_t *ssc, int cdbsize, uchar_t *bufaddr,
21558 	size_t buflen,  uchar_t save_page, int path_flag)
21559 {
21560 	struct	scsi_extended_sense	sense_buf;
21561 	union scsi_cdb		cdb;
21562 	struct uscsi_cmd	ucmd_buf;
21563 	int			status;
21564 	struct sd_lun		*un;
21565 
21566 	ASSERT(ssc != NULL);
21567 	un = ssc->ssc_un;
21568 	ASSERT(un != NULL);
21569 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21570 	ASSERT(bufaddr != NULL);
21571 	ASSERT((cdbsize == CDB_GROUP0) || (cdbsize == CDB_GROUP1) ||
21572 	    (cdbsize == CDB_GROUP2));
21573 
21574 	SD_TRACE(SD_LOG_IO, un,
21575 	    "sd_send_scsi_MODE_SELECT: entry: un:0x%p\n", un);
21576 
21577 	bzero(&cdb, sizeof (cdb));
21578 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21579 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
21580 
21581 	/* Set the PF bit for many third party drives */
21582 	cdb.cdb_opaque[1] = 0x10;
21583 
21584 	/* Set the savepage(SP) bit if given */
21585 	if (save_page == SD_SAVE_PAGE) {
21586 		cdb.cdb_opaque[1] |= 0x01;
21587 	}
21588 
21589 	if (cdbsize == CDB_GROUP0) {
21590 		cdb.scc_cmd = SCMD_MODE_SELECT;
21591 		FORMG0COUNT(&cdb, buflen);
21592 	} else {
21593 		cdb.scc_cmd = SCMD_MODE_SELECT_G1;
21594 		FORMG1COUNT(&cdb, buflen);
21595 	}
21596 
21597 	SD_FILL_SCSI1_LUN_CDB(un, &cdb);
21598 
21599 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
21600 	ucmd_buf.uscsi_cdblen	= (uchar_t)cdbsize;
21601 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
21602 	ucmd_buf.uscsi_buflen	= buflen;
21603 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
21604 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
21605 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_WRITE | USCSI_SILENT;
21606 	ucmd_buf.uscsi_timeout	= 60;
21607 
21608 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
21609 	    UIO_SYSSPACE, path_flag);
21610 
21611 	switch (status) {
21612 	case 0:
21613 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21614 		break;	/* Success! */
21615 	case EIO:
21616 		switch (ucmd_buf.uscsi_status) {
21617 		case STATUS_RESERVATION_CONFLICT:
21618 			status = EACCES;
21619 			break;
21620 		default:
21621 			break;
21622 		}
21623 		break;
21624 	default:
21625 		break;
21626 	}
21627 
21628 	if (status == 0) {
21629 		SD_DUMP_MEMORY(un, SD_LOG_IO, "sd_send_scsi_MODE_SELECT: data",
21630 		    (uchar_t *)bufaddr, buflen, SD_LOG_HEX);
21631 	}
21632 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_MODE_SELECT: exit\n");
21633 
21634 	return (status);
21635 }
21636 
21637 
21638 /*
21639  *    Function: sd_send_scsi_RDWR
21640  *
21641  * Description: Issue a scsi READ or WRITE command with the given parameters.
21642  *
21643  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
21644  *                      structure for this target.
21645  *		cmd:	 SCMD_READ or SCMD_WRITE
21646  *		bufaddr: Address of caller's buffer to receive the RDWR data
21647  *		buflen:  Length of caller's buffer receive the RDWR data.
21648  *		start_block: Block number for the start of the RDWR operation.
21649  *			 (Assumes target-native block size.)
21650  *		residp:  Pointer to variable to receive the redisual of the
21651  *			 RDWR operation (may be NULL of no residual requested).
21652  *		path_flag - SD_PATH_DIRECT to use the USCSI "direct" chain and
21653  *			the normal command waitq, or SD_PATH_DIRECT_PRIORITY
21654  *			to use the USCSI "direct" chain and bypass the normal
21655  *			command waitq.
21656  *
21657  * Return Code: 0   - Success
21658  *		errno return code from sd_ssc_send()
21659  *
21660  *     Context: Can sleep. Does not return until command is completed.
21661  */
21662 
21663 static int
21664 sd_send_scsi_RDWR(sd_ssc_t *ssc, uchar_t cmd, void *bufaddr,
21665 	size_t buflen, daddr_t start_block, int path_flag)
21666 {
21667 	struct	scsi_extended_sense	sense_buf;
21668 	union scsi_cdb		cdb;
21669 	struct uscsi_cmd	ucmd_buf;
21670 	uint32_t		block_count;
21671 	int			status;
21672 	int			cdbsize;
21673 	uchar_t			flag;
21674 	struct sd_lun		*un;
21675 
21676 	ASSERT(ssc != NULL);
21677 	un = ssc->ssc_un;
21678 	ASSERT(un != NULL);
21679 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21680 	ASSERT(bufaddr != NULL);
21681 	ASSERT((cmd == SCMD_READ) || (cmd == SCMD_WRITE));
21682 
21683 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_RDWR: entry: un:0x%p\n", un);
21684 
21685 	if (un->un_f_tgt_blocksize_is_valid != TRUE) {
21686 		return (EINVAL);
21687 	}
21688 
21689 	mutex_enter(SD_MUTEX(un));
21690 	block_count = SD_BYTES2TGTBLOCKS(un, buflen);
21691 	mutex_exit(SD_MUTEX(un));
21692 
21693 	flag = (cmd == SCMD_READ) ? USCSI_READ : USCSI_WRITE;
21694 
21695 	SD_INFO(SD_LOG_IO, un, "sd_send_scsi_RDWR: "
21696 	    "bufaddr:0x%p buflen:0x%x start_block:0x%p block_count:0x%x\n",
21697 	    bufaddr, buflen, start_block, block_count);
21698 
21699 	bzero(&cdb, sizeof (cdb));
21700 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21701 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
21702 
21703 	/* Compute CDB size to use */
21704 	if (start_block > 0xffffffff)
21705 		cdbsize = CDB_GROUP4;
21706 	else if ((start_block & 0xFFE00000) ||
21707 	    (un->un_f_cfg_is_atapi == TRUE))
21708 		cdbsize = CDB_GROUP1;
21709 	else
21710 		cdbsize = CDB_GROUP0;
21711 
21712 	switch (cdbsize) {
21713 	case CDB_GROUP0:	/* 6-byte CDBs */
21714 		cdb.scc_cmd = cmd;
21715 		FORMG0ADDR(&cdb, start_block);
21716 		FORMG0COUNT(&cdb, block_count);
21717 		break;
21718 	case CDB_GROUP1:	/* 10-byte CDBs */
21719 		cdb.scc_cmd = cmd | SCMD_GROUP1;
21720 		FORMG1ADDR(&cdb, start_block);
21721 		FORMG1COUNT(&cdb, block_count);
21722 		break;
21723 	case CDB_GROUP4:	/* 16-byte CDBs */
21724 		cdb.scc_cmd = cmd | SCMD_GROUP4;
21725 		FORMG4LONGADDR(&cdb, (uint64_t)start_block);
21726 		FORMG4COUNT(&cdb, block_count);
21727 		break;
21728 	case CDB_GROUP5:	/* 12-byte CDBs (currently unsupported) */
21729 	default:
21730 		/* All others reserved */
21731 		return (EINVAL);
21732 	}
21733 
21734 	/* Set LUN bit(s) in CDB if this is a SCSI-1 device */
21735 	SD_FILL_SCSI1_LUN_CDB(un, &cdb);
21736 
21737 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
21738 	ucmd_buf.uscsi_cdblen	= (uchar_t)cdbsize;
21739 	ucmd_buf.uscsi_bufaddr	= bufaddr;
21740 	ucmd_buf.uscsi_buflen	= buflen;
21741 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
21742 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
21743 	ucmd_buf.uscsi_flags	= flag | USCSI_RQENABLE | USCSI_SILENT;
21744 	ucmd_buf.uscsi_timeout	= 60;
21745 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
21746 	    UIO_SYSSPACE, path_flag);
21747 
21748 	switch (status) {
21749 	case 0:
21750 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21751 		break;	/* Success! */
21752 	case EIO:
21753 		switch (ucmd_buf.uscsi_status) {
21754 		case STATUS_RESERVATION_CONFLICT:
21755 			status = EACCES;
21756 			break;
21757 		default:
21758 			break;
21759 		}
21760 		break;
21761 	default:
21762 		break;
21763 	}
21764 
21765 	if (status == 0) {
21766 		SD_DUMP_MEMORY(un, SD_LOG_IO, "sd_send_scsi_RDWR: data",
21767 		    (uchar_t *)bufaddr, buflen, SD_LOG_HEX);
21768 	}
21769 
21770 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_RDWR: exit\n");
21771 
21772 	return (status);
21773 }
21774 
21775 
21776 /*
21777  *    Function: sd_send_scsi_LOG_SENSE
21778  *
21779  * Description: Issue a scsi LOG_SENSE command with the given parameters.
21780  *
21781  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
21782  *                      structure for this target.
21783  *
21784  * Return Code: 0   - Success
21785  *		errno return code from sd_ssc_send()
21786  *
21787  *     Context: Can sleep. Does not return until command is completed.
21788  */
21789 
21790 static int
21791 sd_send_scsi_LOG_SENSE(sd_ssc_t *ssc, uchar_t *bufaddr, uint16_t buflen,
21792 	uchar_t page_code, uchar_t page_control, uint16_t param_ptr,
21793 	int path_flag)
21794 
21795 {
21796 	struct scsi_extended_sense	sense_buf;
21797 	union scsi_cdb		cdb;
21798 	struct uscsi_cmd	ucmd_buf;
21799 	int			status;
21800 	struct sd_lun		*un;
21801 
21802 	ASSERT(ssc != NULL);
21803 	un = ssc->ssc_un;
21804 	ASSERT(un != NULL);
21805 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21806 
21807 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_LOG_SENSE: entry: un:0x%p\n", un);
21808 
21809 	bzero(&cdb, sizeof (cdb));
21810 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21811 	bzero(&sense_buf, sizeof (struct scsi_extended_sense));
21812 
21813 	cdb.scc_cmd = SCMD_LOG_SENSE_G1;
21814 	cdb.cdb_opaque[2] = (page_control << 6) | page_code;
21815 	cdb.cdb_opaque[5] = (uchar_t)((param_ptr & 0xFF00) >> 8);
21816 	cdb.cdb_opaque[6] = (uchar_t)(param_ptr  & 0x00FF);
21817 	FORMG1COUNT(&cdb, buflen);
21818 
21819 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
21820 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
21821 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
21822 	ucmd_buf.uscsi_buflen	= buflen;
21823 	ucmd_buf.uscsi_rqbuf	= (caddr_t)&sense_buf;
21824 	ucmd_buf.uscsi_rqlen	= sizeof (struct scsi_extended_sense);
21825 	ucmd_buf.uscsi_flags	= USCSI_RQENABLE | USCSI_READ | USCSI_SILENT;
21826 	ucmd_buf.uscsi_timeout	= 60;
21827 
21828 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
21829 	    UIO_SYSSPACE, path_flag);
21830 
21831 	switch (status) {
21832 	case 0:
21833 		break;
21834 	case EIO:
21835 		switch (ucmd_buf.uscsi_status) {
21836 		case STATUS_RESERVATION_CONFLICT:
21837 			status = EACCES;
21838 			break;
21839 		case STATUS_CHECK:
21840 			if ((ucmd_buf.uscsi_rqstatus == STATUS_GOOD) &&
21841 			    (scsi_sense_key((uint8_t *)&sense_buf) ==
21842 				KEY_ILLEGAL_REQUEST) &&
21843 			    (scsi_sense_asc((uint8_t *)&sense_buf) == 0x24)) {
21844 				/*
21845 				 * ASC 0x24: INVALID FIELD IN CDB
21846 				 */
21847 				switch (page_code) {
21848 				case START_STOP_CYCLE_PAGE:
21849 					/*
21850 					 * The start stop cycle counter is
21851 					 * implemented as page 0x31 in earlier
21852 					 * generation disks. In new generation
21853 					 * disks the start stop cycle counter is
21854 					 * implemented as page 0xE. To properly
21855 					 * handle this case if an attempt for
21856 					 * log page 0xE is made and fails we
21857 					 * will try again using page 0x31.
21858 					 *
21859 					 * Network storage BU committed to
21860 					 * maintain the page 0x31 for this
21861 					 * purpose and will not have any other
21862 					 * page implemented with page code 0x31
21863 					 * until all disks transition to the
21864 					 * standard page.
21865 					 */
21866 					mutex_enter(SD_MUTEX(un));
21867 					un->un_start_stop_cycle_page =
21868 					    START_STOP_CYCLE_VU_PAGE;
21869 					cdb.cdb_opaque[2] =
21870 					    (char)(page_control << 6) |
21871 					    un->un_start_stop_cycle_page;
21872 					mutex_exit(SD_MUTEX(un));
21873 					sd_ssc_assessment(ssc, SD_FMT_IGNORE);
21874 					status = sd_ssc_send(
21875 					    ssc, &ucmd_buf, FKIOCTL,
21876 					    UIO_SYSSPACE, path_flag);
21877 
21878 					break;
21879 				case TEMPERATURE_PAGE:
21880 					status = ENOTTY;
21881 					break;
21882 				default:
21883 					break;
21884 				}
21885 			}
21886 			break;
21887 		default:
21888 			break;
21889 		}
21890 		break;
21891 	default:
21892 		break;
21893 	}
21894 
21895 	if (status == 0) {
21896 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21897 		SD_DUMP_MEMORY(un, SD_LOG_IO, "sd_send_scsi_LOG_SENSE: data",
21898 		    (uchar_t *)bufaddr, buflen, SD_LOG_HEX);
21899 	}
21900 
21901 	SD_TRACE(SD_LOG_IO, un, "sd_send_scsi_LOG_SENSE: exit\n");
21902 
21903 	return (status);
21904 }
21905 
21906 
21907 /*
21908  *    Function: sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION
21909  *
21910  * Description: Issue the scsi GET EVENT STATUS NOTIFICATION command.
21911  *
21912  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
21913  *                      structure for this target.
21914  *		bufaddr
21915  *		buflen
21916  *		class_req
21917  *
21918  * Return Code: 0   - Success
21919  *		errno return code from sd_ssc_send()
21920  *
21921  *     Context: Can sleep. Does not return until command is completed.
21922  */
21923 
21924 static int
21925 sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION(sd_ssc_t *ssc, uchar_t *bufaddr,
21926 	size_t buflen, uchar_t class_req)
21927 {
21928 	union scsi_cdb		cdb;
21929 	struct uscsi_cmd	ucmd_buf;
21930 	int			status;
21931 	struct sd_lun		*un;
21932 
21933 	ASSERT(ssc != NULL);
21934 	un = ssc->ssc_un;
21935 	ASSERT(un != NULL);
21936 	ASSERT(!mutex_owned(SD_MUTEX(un)));
21937 	ASSERT(bufaddr != NULL);
21938 
21939 	SD_TRACE(SD_LOG_IO, un,
21940 	    "sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION: entry: un:0x%p\n", un);
21941 
21942 	bzero(&cdb, sizeof (cdb));
21943 	bzero(&ucmd_buf, sizeof (ucmd_buf));
21944 	bzero(bufaddr, buflen);
21945 
21946 	cdb.scc_cmd = SCMD_GET_EVENT_STATUS_NOTIFICATION;
21947 	cdb.cdb_opaque[1] = 1; /* polled */
21948 	cdb.cdb_opaque[4] = class_req;
21949 	FORMG1COUNT(&cdb, buflen);
21950 
21951 	ucmd_buf.uscsi_cdb	= (char *)&cdb;
21952 	ucmd_buf.uscsi_cdblen	= CDB_GROUP1;
21953 	ucmd_buf.uscsi_bufaddr	= (caddr_t)bufaddr;
21954 	ucmd_buf.uscsi_buflen	= buflen;
21955 	ucmd_buf.uscsi_rqbuf	= NULL;
21956 	ucmd_buf.uscsi_rqlen	= 0;
21957 	ucmd_buf.uscsi_flags	= USCSI_READ | USCSI_SILENT;
21958 	ucmd_buf.uscsi_timeout	= 60;
21959 
21960 	status = sd_ssc_send(ssc, &ucmd_buf, FKIOCTL,
21961 	    UIO_SYSSPACE, SD_PATH_DIRECT);
21962 
21963 	/*
21964 	 * Only handle status == 0, the upper-level caller
21965 	 * will put different assessment based on the context.
21966 	 */
21967 	if (status == 0) {
21968 		sd_ssc_assessment(ssc, SD_FMT_STANDARD);
21969 
21970 		if (ucmd_buf.uscsi_resid != 0) {
21971 			status = EIO;
21972 		}
21973 	}
21974 
21975 	SD_TRACE(SD_LOG_IO, un,
21976 	    "sd_send_scsi_GET_EVENT_STATUS_NOTIFICATION: exit\n");
21977 
21978 	return (status);
21979 }
21980 
21981 
21982 static boolean_t
21983 sd_gesn_media_data_valid(uchar_t *data)
21984 {
21985 	uint16_t			len;
21986 
21987 	len = (data[1] << 8) | data[0];
21988 	return ((len >= 6) &&
21989 	    ((data[2] & SD_GESN_HEADER_NEA) == 0) &&
21990 	    ((data[2] & SD_GESN_HEADER_CLASS) == SD_GESN_MEDIA_CLASS) &&
21991 	    ((data[3] & (1 << SD_GESN_MEDIA_CLASS)) != 0));
21992 }
21993 
21994 
21995 /*
21996  *    Function: sdioctl
21997  *
21998  * Description: Driver's ioctl(9e) entry point function.
21999  *
22000  *   Arguments: dev     - device number
22001  *		cmd     - ioctl operation to be performed
22002  *		arg     - user argument, contains data to be set or reference
22003  *			  parameter for get
22004  *		flag    - bit flag, indicating open settings, 32/64 bit type
22005  *		cred_p  - user credential pointer
22006  *		rval_p  - calling process return value (OPT)
22007  *
22008  * Return Code: EINVAL
22009  *		ENOTTY
22010  *		ENXIO
22011  *		EIO
22012  *		EFAULT
22013  *		ENOTSUP
22014  *		EPERM
22015  *
22016  *     Context: Called from the device switch at normal priority.
22017  */
22018 
22019 static int
22020 sdioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cred_p, int *rval_p)
22021 {
22022 	struct sd_lun	*un = NULL;
22023 	int		err = 0;
22024 	int		i = 0;
22025 	cred_t		*cr;
22026 	int		tmprval = EINVAL;
22027 	boolean_t	is_valid;
22028 	sd_ssc_t	*ssc;
22029 
22030 	/*
22031 	 * All device accesses go thru sdstrategy where we check on suspend
22032 	 * status
22033 	 */
22034 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
22035 		return (ENXIO);
22036 	}
22037 
22038 	ASSERT(!mutex_owned(SD_MUTEX(un)));
22039 
22040 	/* Initialize sd_ssc_t for internal uscsi commands */
22041 	ssc = sd_ssc_init(un);
22042 
22043 	is_valid = SD_IS_VALID_LABEL(un);
22044 
22045 	/*
22046 	 * Moved this wait from sd_uscsi_strategy to here for
22047 	 * reasons of deadlock prevention. Internal driver commands,
22048 	 * specifically those to change a devices power level, result
22049 	 * in a call to sd_uscsi_strategy.
22050 	 */
22051 	mutex_enter(SD_MUTEX(un));
22052 	while ((un->un_state == SD_STATE_SUSPENDED) ||
22053 	    (un->un_state == SD_STATE_PM_CHANGING)) {
22054 		cv_wait(&un->un_suspend_cv, SD_MUTEX(un));
22055 	}
22056 	/*
22057 	 * Twiddling the counter here protects commands from now
22058 	 * through to the top of sd_uscsi_strategy. Without the
22059 	 * counter inc. a power down, for example, could get in
22060 	 * after the above check for state is made and before
22061 	 * execution gets to the top of sd_uscsi_strategy.
22062 	 * That would cause problems.
22063 	 */
22064 	un->un_ncmds_in_driver++;
22065 
22066 	if (!is_valid &&
22067 	    (flag & (FNDELAY | FNONBLOCK))) {
22068 		switch (cmd) {
22069 		case DKIOCGGEOM:	/* SD_PATH_DIRECT */
22070 		case DKIOCGVTOC:
22071 		case DKIOCGEXTVTOC:
22072 		case DKIOCGAPART:
22073 		case DKIOCPARTINFO:
22074 		case DKIOCEXTPARTINFO:
22075 		case DKIOCSGEOM:
22076 		case DKIOCSAPART:
22077 		case DKIOCGETEFI:
22078 		case DKIOCPARTITION:
22079 		case DKIOCSVTOC:
22080 		case DKIOCSEXTVTOC:
22081 		case DKIOCSETEFI:
22082 		case DKIOCGMBOOT:
22083 		case DKIOCSMBOOT:
22084 		case DKIOCG_PHYGEOM:
22085 		case DKIOCG_VIRTGEOM:
22086 #if defined(__i386) || defined(__amd64)
22087 		case DKIOCSETEXTPART:
22088 #endif
22089 			/* let cmlb handle it */
22090 			goto skip_ready_valid;
22091 
22092 		case CDROMPAUSE:
22093 		case CDROMRESUME:
22094 		case CDROMPLAYMSF:
22095 		case CDROMPLAYTRKIND:
22096 		case CDROMREADTOCHDR:
22097 		case CDROMREADTOCENTRY:
22098 		case CDROMSTOP:
22099 		case CDROMSTART:
22100 		case CDROMVOLCTRL:
22101 		case CDROMSUBCHNL:
22102 		case CDROMREADMODE2:
22103 		case CDROMREADMODE1:
22104 		case CDROMREADOFFSET:
22105 		case CDROMSBLKMODE:
22106 		case CDROMGBLKMODE:
22107 		case CDROMGDRVSPEED:
22108 		case CDROMSDRVSPEED:
22109 		case CDROMCDDA:
22110 		case CDROMCDXA:
22111 		case CDROMSUBCODE:
22112 			if (!ISCD(un)) {
22113 				un->un_ncmds_in_driver--;
22114 				ASSERT(un->un_ncmds_in_driver >= 0);
22115 				mutex_exit(SD_MUTEX(un));
22116 				err = ENOTTY;
22117 				goto done_without_assess;
22118 			}
22119 			break;
22120 		case FDEJECT:
22121 		case DKIOCEJECT:
22122 		case CDROMEJECT:
22123 			if (!un->un_f_eject_media_supported) {
22124 				un->un_ncmds_in_driver--;
22125 				ASSERT(un->un_ncmds_in_driver >= 0);
22126 				mutex_exit(SD_MUTEX(un));
22127 				err = ENOTTY;
22128 				goto done_without_assess;
22129 			}
22130 			break;
22131 		case DKIOCFLUSHWRITECACHE:
22132 			mutex_exit(SD_MUTEX(un));
22133 			err = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
22134 			if (err != 0) {
22135 				mutex_enter(SD_MUTEX(un));
22136 				un->un_ncmds_in_driver--;
22137 				ASSERT(un->un_ncmds_in_driver >= 0);
22138 				mutex_exit(SD_MUTEX(un));
22139 				err = EIO;
22140 				goto done_quick_assess;
22141 			}
22142 			mutex_enter(SD_MUTEX(un));
22143 			/* FALLTHROUGH */
22144 		case DKIOCREMOVABLE:
22145 		case DKIOCHOTPLUGGABLE:
22146 		case DKIOCINFO:
22147 		case DKIOCGMEDIAINFO:
22148 		case DKIOCGMEDIAINFOEXT:
22149 		case MHIOCENFAILFAST:
22150 		case MHIOCSTATUS:
22151 		case MHIOCTKOWN:
22152 		case MHIOCRELEASE:
22153 		case MHIOCGRP_INKEYS:
22154 		case MHIOCGRP_INRESV:
22155 		case MHIOCGRP_REGISTER:
22156 		case MHIOCGRP_RESERVE:
22157 		case MHIOCGRP_PREEMPTANDABORT:
22158 		case MHIOCGRP_REGISTERANDIGNOREKEY:
22159 		case CDROMCLOSETRAY:
22160 		case USCSICMD:
22161 			goto skip_ready_valid;
22162 		default:
22163 			break;
22164 		}
22165 
22166 		mutex_exit(SD_MUTEX(un));
22167 		err = sd_ready_and_valid(ssc, SDPART(dev));
22168 		mutex_enter(SD_MUTEX(un));
22169 
22170 		if (err != SD_READY_VALID) {
22171 			switch (cmd) {
22172 			case DKIOCSTATE:
22173 			case CDROMGDRVSPEED:
22174 			case CDROMSDRVSPEED:
22175 			case FDEJECT:	/* for eject command */
22176 			case DKIOCEJECT:
22177 			case CDROMEJECT:
22178 			case DKIOCREMOVABLE:
22179 			case DKIOCHOTPLUGGABLE:
22180 				break;
22181 			default:
22182 				if (un->un_f_has_removable_media) {
22183 					err = ENXIO;
22184 				} else {
22185 				/* Do not map SD_RESERVED_BY_OTHERS to EIO */
22186 					if (err == SD_RESERVED_BY_OTHERS) {
22187 						err = EACCES;
22188 					} else {
22189 						err = EIO;
22190 					}
22191 				}
22192 				un->un_ncmds_in_driver--;
22193 				ASSERT(un->un_ncmds_in_driver >= 0);
22194 				mutex_exit(SD_MUTEX(un));
22195 
22196 				goto done_without_assess;
22197 			}
22198 		}
22199 	}
22200 
22201 skip_ready_valid:
22202 	mutex_exit(SD_MUTEX(un));
22203 
22204 	switch (cmd) {
22205 	case DKIOCINFO:
22206 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCINFO\n");
22207 		err = sd_dkio_ctrl_info(dev, (caddr_t)arg, flag);
22208 		break;
22209 
22210 	case DKIOCGMEDIAINFO:
22211 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCGMEDIAINFO\n");
22212 		err = sd_get_media_info(dev, (caddr_t)arg, flag);
22213 		break;
22214 
22215 	case DKIOCGMEDIAINFOEXT:
22216 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCGMEDIAINFOEXT\n");
22217 		err = sd_get_media_info_ext(dev, (caddr_t)arg, flag);
22218 		break;
22219 
22220 	case DKIOCGGEOM:
22221 	case DKIOCGVTOC:
22222 	case DKIOCGEXTVTOC:
22223 	case DKIOCGAPART:
22224 	case DKIOCPARTINFO:
22225 	case DKIOCEXTPARTINFO:
22226 	case DKIOCSGEOM:
22227 	case DKIOCSAPART:
22228 	case DKIOCGETEFI:
22229 	case DKIOCPARTITION:
22230 	case DKIOCSVTOC:
22231 	case DKIOCSEXTVTOC:
22232 	case DKIOCSETEFI:
22233 	case DKIOCGMBOOT:
22234 	case DKIOCSMBOOT:
22235 	case DKIOCG_PHYGEOM:
22236 	case DKIOCG_VIRTGEOM:
22237 #if defined(__i386) || defined(__amd64)
22238 	case DKIOCSETEXTPART:
22239 #endif
22240 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOC %d\n", cmd);
22241 
22242 		/* TUR should spin up */
22243 
22244 		if (un->un_f_has_removable_media)
22245 			err = sd_send_scsi_TEST_UNIT_READY(ssc,
22246 			    SD_CHECK_FOR_MEDIA);
22247 
22248 		else
22249 			err = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
22250 
22251 		if (err != 0)
22252 			goto done_with_assess;
22253 
22254 		err = cmlb_ioctl(un->un_cmlbhandle, dev,
22255 		    cmd, arg, flag, cred_p, rval_p, (void *)SD_PATH_DIRECT);
22256 
22257 		if ((err == 0) &&
22258 		    ((cmd == DKIOCSETEFI) ||
22259 		    (un->un_f_pkstats_enabled) &&
22260 		    (cmd == DKIOCSAPART || cmd == DKIOCSVTOC ||
22261 		    cmd == DKIOCSEXTVTOC))) {
22262 
22263 			tmprval = cmlb_validate(un->un_cmlbhandle, CMLB_SILENT,
22264 			    (void *)SD_PATH_DIRECT);
22265 			if ((tmprval == 0) && un->un_f_pkstats_enabled) {
22266 				sd_set_pstats(un);
22267 				SD_TRACE(SD_LOG_IO_PARTITION, un,
22268 				    "sd_ioctl: un:0x%p pstats created and "
22269 				    "set\n", un);
22270 			}
22271 		}
22272 
22273 		if ((cmd == DKIOCSVTOC || cmd == DKIOCSEXTVTOC) ||
22274 		    ((cmd == DKIOCSETEFI) && (tmprval == 0))) {
22275 
22276 			mutex_enter(SD_MUTEX(un));
22277 			if (un->un_f_devid_supported &&
22278 			    (un->un_f_opt_fab_devid == TRUE)) {
22279 				if (un->un_devid == NULL) {
22280 					sd_register_devid(ssc, SD_DEVINFO(un),
22281 					    SD_TARGET_IS_UNRESERVED);
22282 				} else {
22283 					/*
22284 					 * The device id for this disk
22285 					 * has been fabricated. The
22286 					 * device id must be preserved
22287 					 * by writing it back out to
22288 					 * disk.
22289 					 */
22290 					if (sd_write_deviceid(ssc) != 0) {
22291 						ddi_devid_free(un->un_devid);
22292 						un->un_devid = NULL;
22293 					}
22294 				}
22295 			}
22296 			mutex_exit(SD_MUTEX(un));
22297 		}
22298 
22299 		break;
22300 
22301 	case DKIOCLOCK:
22302 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCLOCK\n");
22303 		err = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_PREVENT,
22304 		    SD_PATH_STANDARD);
22305 		goto done_with_assess;
22306 
22307 	case DKIOCUNLOCK:
22308 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCUNLOCK\n");
22309 		err = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_ALLOW,
22310 		    SD_PATH_STANDARD);
22311 		goto done_with_assess;
22312 
22313 	case DKIOCSTATE: {
22314 		enum dkio_state		state;
22315 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCSTATE\n");
22316 
22317 		if (ddi_copyin((void *)arg, &state, sizeof (int), flag) != 0) {
22318 			err = EFAULT;
22319 		} else {
22320 			err = sd_check_media(dev, state);
22321 			if (err == 0) {
22322 				if (ddi_copyout(&un->un_mediastate, (void *)arg,
22323 				    sizeof (int), flag) != 0)
22324 					err = EFAULT;
22325 			}
22326 		}
22327 		break;
22328 	}
22329 
22330 	case DKIOCREMOVABLE:
22331 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCREMOVABLE\n");
22332 		i = un->un_f_has_removable_media ? 1 : 0;
22333 		if (ddi_copyout(&i, (void *)arg, sizeof (int), flag) != 0) {
22334 			err = EFAULT;
22335 		} else {
22336 			err = 0;
22337 		}
22338 		break;
22339 
22340 	case DKIOCHOTPLUGGABLE:
22341 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCHOTPLUGGABLE\n");
22342 		i = un->un_f_is_hotpluggable ? 1 : 0;
22343 		if (ddi_copyout(&i, (void *)arg, sizeof (int), flag) != 0) {
22344 			err = EFAULT;
22345 		} else {
22346 			err = 0;
22347 		}
22348 		break;
22349 
22350 	case DKIOCREADONLY:
22351 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCREADONLY\n");
22352 		i = 0;
22353 		if ((ISCD(un) && !un->un_f_mmc_writable_media) ||
22354 		    (sr_check_wp(dev) != 0)) {
22355 			i = 1;
22356 		}
22357 		if (ddi_copyout(&i, (void *)arg, sizeof (int), flag) != 0) {
22358 			err = EFAULT;
22359 		} else {
22360 			err = 0;
22361 		}
22362 		break;
22363 
22364 	case DKIOCGTEMPERATURE:
22365 		SD_TRACE(SD_LOG_IOCTL, un, "DKIOCGTEMPERATURE\n");
22366 		err = sd_dkio_get_temp(dev, (caddr_t)arg, flag);
22367 		break;
22368 
22369 	case MHIOCENFAILFAST:
22370 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCENFAILFAST\n");
22371 		if ((err = drv_priv(cred_p)) == 0) {
22372 			err = sd_mhdioc_failfast(dev, (caddr_t)arg, flag);
22373 		}
22374 		break;
22375 
22376 	case MHIOCTKOWN:
22377 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCTKOWN\n");
22378 		if ((err = drv_priv(cred_p)) == 0) {
22379 			err = sd_mhdioc_takeown(dev, (caddr_t)arg, flag);
22380 		}
22381 		break;
22382 
22383 	case MHIOCRELEASE:
22384 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCRELEASE\n");
22385 		if ((err = drv_priv(cred_p)) == 0) {
22386 			err = sd_mhdioc_release(dev);
22387 		}
22388 		break;
22389 
22390 	case MHIOCSTATUS:
22391 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCSTATUS\n");
22392 		if ((err = drv_priv(cred_p)) == 0) {
22393 			switch (sd_send_scsi_TEST_UNIT_READY(ssc, 0)) {
22394 			case 0:
22395 				err = 0;
22396 				break;
22397 			case EACCES:
22398 				*rval_p = 1;
22399 				err = 0;
22400 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
22401 				break;
22402 			default:
22403 				err = EIO;
22404 				goto done_with_assess;
22405 			}
22406 		}
22407 		break;
22408 
22409 	case MHIOCQRESERVE:
22410 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCQRESERVE\n");
22411 		if ((err = drv_priv(cred_p)) == 0) {
22412 			err = sd_reserve_release(dev, SD_RESERVE);
22413 		}
22414 		break;
22415 
22416 	case MHIOCREREGISTERDEVID:
22417 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCREREGISTERDEVID\n");
22418 		if (drv_priv(cred_p) == EPERM) {
22419 			err = EPERM;
22420 		} else if (!un->un_f_devid_supported) {
22421 			err = ENOTTY;
22422 		} else {
22423 			err = sd_mhdioc_register_devid(dev);
22424 		}
22425 		break;
22426 
22427 	case MHIOCGRP_INKEYS:
22428 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_INKEYS\n");
22429 		if (((err = drv_priv(cred_p)) != EPERM) && arg != NULL) {
22430 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22431 				err = ENOTSUP;
22432 			} else {
22433 				err = sd_mhdioc_inkeys(dev, (caddr_t)arg,
22434 				    flag);
22435 			}
22436 		}
22437 		break;
22438 
22439 	case MHIOCGRP_INRESV:
22440 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_INRESV\n");
22441 		if (((err = drv_priv(cred_p)) != EPERM) && arg != NULL) {
22442 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22443 				err = ENOTSUP;
22444 			} else {
22445 				err = sd_mhdioc_inresv(dev, (caddr_t)arg, flag);
22446 			}
22447 		}
22448 		break;
22449 
22450 	case MHIOCGRP_REGISTER:
22451 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_REGISTER\n");
22452 		if ((err = drv_priv(cred_p)) != EPERM) {
22453 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22454 				err = ENOTSUP;
22455 			} else if (arg != NULL) {
22456 				mhioc_register_t reg;
22457 				if (ddi_copyin((void *)arg, &reg,
22458 				    sizeof (mhioc_register_t), flag) != 0) {
22459 					err = EFAULT;
22460 				} else {
22461 					err =
22462 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
22463 					    ssc, SD_SCSI3_REGISTER,
22464 					    (uchar_t *)&reg);
22465 					if (err != 0)
22466 						goto done_with_assess;
22467 				}
22468 			}
22469 		}
22470 		break;
22471 
22472 	case MHIOCGRP_RESERVE:
22473 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_RESERVE\n");
22474 		if ((err = drv_priv(cred_p)) != EPERM) {
22475 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22476 				err = ENOTSUP;
22477 			} else if (arg != NULL) {
22478 				mhioc_resv_desc_t resv_desc;
22479 				if (ddi_copyin((void *)arg, &resv_desc,
22480 				    sizeof (mhioc_resv_desc_t), flag) != 0) {
22481 					err = EFAULT;
22482 				} else {
22483 					err =
22484 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
22485 					    ssc, SD_SCSI3_RESERVE,
22486 					    (uchar_t *)&resv_desc);
22487 					if (err != 0)
22488 						goto done_with_assess;
22489 				}
22490 			}
22491 		}
22492 		break;
22493 
22494 	case MHIOCGRP_PREEMPTANDABORT:
22495 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_PREEMPTANDABORT\n");
22496 		if ((err = drv_priv(cred_p)) != EPERM) {
22497 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22498 				err = ENOTSUP;
22499 			} else if (arg != NULL) {
22500 				mhioc_preemptandabort_t preempt_abort;
22501 				if (ddi_copyin((void *)arg, &preempt_abort,
22502 				    sizeof (mhioc_preemptandabort_t),
22503 				    flag) != 0) {
22504 					err = EFAULT;
22505 				} else {
22506 					err =
22507 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
22508 					    ssc, SD_SCSI3_PREEMPTANDABORT,
22509 					    (uchar_t *)&preempt_abort);
22510 					if (err != 0)
22511 						goto done_with_assess;
22512 				}
22513 			}
22514 		}
22515 		break;
22516 
22517 	case MHIOCGRP_REGISTERANDIGNOREKEY:
22518 		SD_TRACE(SD_LOG_IOCTL, un, "MHIOCGRP_REGISTERANDIGNOREKEY\n");
22519 		if ((err = drv_priv(cred_p)) != EPERM) {
22520 			if (un->un_reservation_type == SD_SCSI2_RESERVATION) {
22521 				err = ENOTSUP;
22522 			} else if (arg != NULL) {
22523 				mhioc_registerandignorekey_t r_and_i;
22524 				if (ddi_copyin((void *)arg, (void *)&r_and_i,
22525 				    sizeof (mhioc_registerandignorekey_t),
22526 				    flag) != 0) {
22527 					err = EFAULT;
22528 				} else {
22529 					err =
22530 					    sd_send_scsi_PERSISTENT_RESERVE_OUT(
22531 					    ssc, SD_SCSI3_REGISTERANDIGNOREKEY,
22532 					    (uchar_t *)&r_and_i);
22533 					if (err != 0)
22534 						goto done_with_assess;
22535 				}
22536 			}
22537 		}
22538 		break;
22539 
22540 	case USCSICMD:
22541 		SD_TRACE(SD_LOG_IOCTL, un, "USCSICMD\n");
22542 		cr = ddi_get_cred();
22543 		if ((drv_priv(cred_p) != 0) && (drv_priv(cr) != 0)) {
22544 			err = EPERM;
22545 		} else {
22546 			enum uio_seg	uioseg;
22547 
22548 			uioseg = (flag & FKIOCTL) ? UIO_SYSSPACE :
22549 			    UIO_USERSPACE;
22550 			if (un->un_f_format_in_progress == TRUE) {
22551 				err = EAGAIN;
22552 				break;
22553 			}
22554 
22555 			err = sd_ssc_send(ssc,
22556 			    (struct uscsi_cmd *)arg,
22557 			    flag, uioseg, SD_PATH_STANDARD);
22558 			if (err != 0)
22559 				goto done_with_assess;
22560 			else
22561 				sd_ssc_assessment(ssc, SD_FMT_STANDARD);
22562 		}
22563 		break;
22564 
22565 	case CDROMPAUSE:
22566 	case CDROMRESUME:
22567 		SD_TRACE(SD_LOG_IOCTL, un, "PAUSE-RESUME\n");
22568 		if (!ISCD(un)) {
22569 			err = ENOTTY;
22570 		} else {
22571 			err = sr_pause_resume(dev, cmd);
22572 		}
22573 		break;
22574 
22575 	case CDROMPLAYMSF:
22576 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMPLAYMSF\n");
22577 		if (!ISCD(un)) {
22578 			err = ENOTTY;
22579 		} else {
22580 			err = sr_play_msf(dev, (caddr_t)arg, flag);
22581 		}
22582 		break;
22583 
22584 	case CDROMPLAYTRKIND:
22585 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMPLAYTRKIND\n");
22586 #if defined(__i386) || defined(__amd64)
22587 		/*
22588 		 * not supported on ATAPI CD drives, use CDROMPLAYMSF instead
22589 		 */
22590 		if (!ISCD(un) || (un->un_f_cfg_is_atapi == TRUE)) {
22591 #else
22592 		if (!ISCD(un)) {
22593 #endif
22594 			err = ENOTTY;
22595 		} else {
22596 			err = sr_play_trkind(dev, (caddr_t)arg, flag);
22597 		}
22598 		break;
22599 
22600 	case CDROMREADTOCHDR:
22601 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADTOCHDR\n");
22602 		if (!ISCD(un)) {
22603 			err = ENOTTY;
22604 		} else {
22605 			err = sr_read_tochdr(dev, (caddr_t)arg, flag);
22606 		}
22607 		break;
22608 
22609 	case CDROMREADTOCENTRY:
22610 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADTOCENTRY\n");
22611 		if (!ISCD(un)) {
22612 			err = ENOTTY;
22613 		} else {
22614 			err = sr_read_tocentry(dev, (caddr_t)arg, flag);
22615 		}
22616 		break;
22617 
22618 	case CDROMSTOP:
22619 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSTOP\n");
22620 		if (!ISCD(un)) {
22621 			err = ENOTTY;
22622 		} else {
22623 			err = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
22624 			    SD_TARGET_STOP, SD_PATH_STANDARD);
22625 			goto done_with_assess;
22626 		}
22627 		break;
22628 
22629 	case CDROMSTART:
22630 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSTART\n");
22631 		if (!ISCD(un)) {
22632 			err = ENOTTY;
22633 		} else {
22634 			err = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
22635 			    SD_TARGET_START, SD_PATH_STANDARD);
22636 			goto done_with_assess;
22637 		}
22638 		break;
22639 
22640 	case CDROMCLOSETRAY:
22641 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMCLOSETRAY\n");
22642 		if (!ISCD(un)) {
22643 			err = ENOTTY;
22644 		} else {
22645 			err = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
22646 			    SD_TARGET_CLOSE, SD_PATH_STANDARD);
22647 			goto done_with_assess;
22648 		}
22649 		break;
22650 
22651 	case FDEJECT:	/* for eject command */
22652 	case DKIOCEJECT:
22653 	case CDROMEJECT:
22654 		SD_TRACE(SD_LOG_IOCTL, un, "EJECT\n");
22655 		if (!un->un_f_eject_media_supported) {
22656 			err = ENOTTY;
22657 		} else {
22658 			err = sr_eject(dev);
22659 		}
22660 		break;
22661 
22662 	case CDROMVOLCTRL:
22663 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMVOLCTRL\n");
22664 		if (!ISCD(un)) {
22665 			err = ENOTTY;
22666 		} else {
22667 			err = sr_volume_ctrl(dev, (caddr_t)arg, flag);
22668 		}
22669 		break;
22670 
22671 	case CDROMSUBCHNL:
22672 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSUBCHNL\n");
22673 		if (!ISCD(un)) {
22674 			err = ENOTTY;
22675 		} else {
22676 			err = sr_read_subchannel(dev, (caddr_t)arg, flag);
22677 		}
22678 		break;
22679 
22680 	case CDROMREADMODE2:
22681 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADMODE2\n");
22682 		if (!ISCD(un)) {
22683 			err = ENOTTY;
22684 		} else if (un->un_f_cfg_is_atapi == TRUE) {
22685 			/*
22686 			 * If the drive supports READ CD, use that instead of
22687 			 * switching the LBA size via a MODE SELECT
22688 			 * Block Descriptor
22689 			 */
22690 			err = sr_read_cd_mode2(dev, (caddr_t)arg, flag);
22691 		} else {
22692 			err = sr_read_mode2(dev, (caddr_t)arg, flag);
22693 		}
22694 		break;
22695 
22696 	case CDROMREADMODE1:
22697 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADMODE1\n");
22698 		if (!ISCD(un)) {
22699 			err = ENOTTY;
22700 		} else {
22701 			err = sr_read_mode1(dev, (caddr_t)arg, flag);
22702 		}
22703 		break;
22704 
22705 	case CDROMREADOFFSET:
22706 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMREADOFFSET\n");
22707 		if (!ISCD(un)) {
22708 			err = ENOTTY;
22709 		} else {
22710 			err = sr_read_sony_session_offset(dev, (caddr_t)arg,
22711 			    flag);
22712 		}
22713 		break;
22714 
22715 	case CDROMSBLKMODE:
22716 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSBLKMODE\n");
22717 		/*
22718 		 * There is no means of changing block size in case of atapi
22719 		 * drives, thus return ENOTTY if drive type is atapi
22720 		 */
22721 		if (!ISCD(un) || (un->un_f_cfg_is_atapi == TRUE)) {
22722 			err = ENOTTY;
22723 		} else if (un->un_f_mmc_cap == TRUE) {
22724 
22725 			/*
22726 			 * MMC Devices do not support changing the
22727 			 * logical block size
22728 			 *
22729 			 * Note: EINVAL is being returned instead of ENOTTY to
22730 			 * maintain consistancy with the original mmc
22731 			 * driver update.
22732 			 */
22733 			err = EINVAL;
22734 		} else {
22735 			mutex_enter(SD_MUTEX(un));
22736 			if ((!(un->un_exclopen & (1<<SDPART(dev)))) ||
22737 			    (un->un_ncmds_in_transport > 0)) {
22738 				mutex_exit(SD_MUTEX(un));
22739 				err = EINVAL;
22740 			} else {
22741 				mutex_exit(SD_MUTEX(un));
22742 				err = sr_change_blkmode(dev, cmd, arg, flag);
22743 			}
22744 		}
22745 		break;
22746 
22747 	case CDROMGBLKMODE:
22748 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMGBLKMODE\n");
22749 		if (!ISCD(un)) {
22750 			err = ENOTTY;
22751 		} else if ((un->un_f_cfg_is_atapi != FALSE) &&
22752 		    (un->un_f_blockcount_is_valid != FALSE)) {
22753 			/*
22754 			 * Drive is an ATAPI drive so return target block
22755 			 * size for ATAPI drives since we cannot change the
22756 			 * blocksize on ATAPI drives. Used primarily to detect
22757 			 * if an ATAPI cdrom is present.
22758 			 */
22759 			if (ddi_copyout(&un->un_tgt_blocksize, (void *)arg,
22760 			    sizeof (int), flag) != 0) {
22761 				err = EFAULT;
22762 			} else {
22763 				err = 0;
22764 			}
22765 
22766 		} else {
22767 			/*
22768 			 * Drive supports changing block sizes via a Mode
22769 			 * Select.
22770 			 */
22771 			err = sr_change_blkmode(dev, cmd, arg, flag);
22772 		}
22773 		break;
22774 
22775 	case CDROMGDRVSPEED:
22776 	case CDROMSDRVSPEED:
22777 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMXDRVSPEED\n");
22778 		if (!ISCD(un)) {
22779 			err = ENOTTY;
22780 		} else if (un->un_f_mmc_cap == TRUE) {
22781 			/*
22782 			 * Note: In the future the driver implementation
22783 			 * for getting and
22784 			 * setting cd speed should entail:
22785 			 * 1) If non-mmc try the Toshiba mode page
22786 			 *    (sr_change_speed)
22787 			 * 2) If mmc but no support for Real Time Streaming try
22788 			 *    the SET CD SPEED (0xBB) command
22789 			 *   (sr_atapi_change_speed)
22790 			 * 3) If mmc and support for Real Time Streaming
22791 			 *    try the GET PERFORMANCE and SET STREAMING
22792 			 *    commands (not yet implemented, 4380808)
22793 			 */
22794 			/*
22795 			 * As per recent MMC spec, CD-ROM speed is variable
22796 			 * and changes with LBA. Since there is no such
22797 			 * things as drive speed now, fail this ioctl.
22798 			 *
22799 			 * Note: EINVAL is returned for consistancy of original
22800 			 * implementation which included support for getting
22801 			 * the drive speed of mmc devices but not setting
22802 			 * the drive speed. Thus EINVAL would be returned
22803 			 * if a set request was made for an mmc device.
22804 			 * We no longer support get or set speed for
22805 			 * mmc but need to remain consistent with regard
22806 			 * to the error code returned.
22807 			 */
22808 			err = EINVAL;
22809 		} else if (un->un_f_cfg_is_atapi == TRUE) {
22810 			err = sr_atapi_change_speed(dev, cmd, arg, flag);
22811 		} else {
22812 			err = sr_change_speed(dev, cmd, arg, flag);
22813 		}
22814 		break;
22815 
22816 	case CDROMCDDA:
22817 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMCDDA\n");
22818 		if (!ISCD(un)) {
22819 			err = ENOTTY;
22820 		} else {
22821 			err = sr_read_cdda(dev, (void *)arg, flag);
22822 		}
22823 		break;
22824 
22825 	case CDROMCDXA:
22826 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMCDXA\n");
22827 		if (!ISCD(un)) {
22828 			err = ENOTTY;
22829 		} else {
22830 			err = sr_read_cdxa(dev, (caddr_t)arg, flag);
22831 		}
22832 		break;
22833 
22834 	case CDROMSUBCODE:
22835 		SD_TRACE(SD_LOG_IOCTL, un, "CDROMSUBCODE\n");
22836 		if (!ISCD(un)) {
22837 			err = ENOTTY;
22838 		} else {
22839 			err = sr_read_all_subcodes(dev, (caddr_t)arg, flag);
22840 		}
22841 		break;
22842 
22843 
22844 #ifdef SDDEBUG
22845 /* RESET/ABORTS testing ioctls */
22846 	case DKIOCRESET: {
22847 		int	reset_level;
22848 
22849 		if (ddi_copyin((void *)arg, &reset_level, sizeof (int), flag)) {
22850 			err = EFAULT;
22851 		} else {
22852 			SD_INFO(SD_LOG_IOCTL, un, "sdioctl: DKIOCRESET: "
22853 			    "reset_level = 0x%lx\n", reset_level);
22854 			if (scsi_reset(SD_ADDRESS(un), reset_level)) {
22855 				err = 0;
22856 			} else {
22857 				err = EIO;
22858 			}
22859 		}
22860 		break;
22861 	}
22862 
22863 	case DKIOCABORT:
22864 		SD_INFO(SD_LOG_IOCTL, un, "sdioctl: DKIOCABORT:\n");
22865 		if (scsi_abort(SD_ADDRESS(un), NULL)) {
22866 			err = 0;
22867 		} else {
22868 			err = EIO;
22869 		}
22870 		break;
22871 #endif
22872 
22873 #ifdef SD_FAULT_INJECTION
22874 /* SDIOC FaultInjection testing ioctls */
22875 	case SDIOCSTART:
22876 	case SDIOCSTOP:
22877 	case SDIOCINSERTPKT:
22878 	case SDIOCINSERTXB:
22879 	case SDIOCINSERTUN:
22880 	case SDIOCINSERTARQ:
22881 	case SDIOCPUSH:
22882 	case SDIOCRETRIEVE:
22883 	case SDIOCRUN:
22884 		SD_INFO(SD_LOG_SDTEST, un, "sdioctl:"
22885 		    "SDIOC detected cmd:0x%X:\n", cmd);
22886 		/* call error generator */
22887 		sd_faultinjection_ioctl(cmd, arg, un);
22888 		err = 0;
22889 		break;
22890 
22891 #endif /* SD_FAULT_INJECTION */
22892 
22893 	case DKIOCFLUSHWRITECACHE:
22894 		{
22895 			struct dk_callback *dkc = (struct dk_callback *)arg;
22896 
22897 			mutex_enter(SD_MUTEX(un));
22898 			if (!un->un_f_sync_cache_supported ||
22899 			    !un->un_f_write_cache_enabled) {
22900 				err = un->un_f_sync_cache_supported ?
22901 				    0 : ENOTSUP;
22902 				mutex_exit(SD_MUTEX(un));
22903 				if ((flag & FKIOCTL) && dkc != NULL &&
22904 				    dkc->dkc_callback != NULL) {
22905 					(*dkc->dkc_callback)(dkc->dkc_cookie,
22906 					    err);
22907 					/*
22908 					 * Did callback and reported error.
22909 					 * Since we did a callback, ioctl
22910 					 * should return 0.
22911 					 */
22912 					err = 0;
22913 				}
22914 				break;
22915 			}
22916 			mutex_exit(SD_MUTEX(un));
22917 
22918 			if ((flag & FKIOCTL) && dkc != NULL &&
22919 			    dkc->dkc_callback != NULL) {
22920 				/* async SYNC CACHE request */
22921 				err = sd_send_scsi_SYNCHRONIZE_CACHE(un, dkc);
22922 			} else {
22923 				/* synchronous SYNC CACHE request */
22924 				err = sd_send_scsi_SYNCHRONIZE_CACHE(un, NULL);
22925 			}
22926 		}
22927 		break;
22928 
22929 	case DKIOCGETWCE: {
22930 
22931 		int wce;
22932 
22933 		if ((err = sd_get_write_cache_enabled(ssc, &wce)) != 0) {
22934 			break;
22935 		}
22936 
22937 		if (ddi_copyout(&wce, (void *)arg, sizeof (wce), flag)) {
22938 			err = EFAULT;
22939 		}
22940 		break;
22941 	}
22942 
22943 	case DKIOCSETWCE: {
22944 
22945 		int wce, sync_supported;
22946 		int cur_wce = 0;
22947 
22948 		if (ddi_copyin((void *)arg, &wce, sizeof (wce), flag)) {
22949 			err = EFAULT;
22950 			break;
22951 		}
22952 
22953 		/*
22954 		 * Synchronize multiple threads trying to enable
22955 		 * or disable the cache via the un_f_wcc_cv
22956 		 * condition variable.
22957 		 */
22958 		mutex_enter(SD_MUTEX(un));
22959 
22960 		/*
22961 		 * Don't allow the cache to be enabled if the
22962 		 * config file has it disabled.
22963 		 */
22964 		if (un->un_f_opt_disable_cache && wce) {
22965 			mutex_exit(SD_MUTEX(un));
22966 			err = EINVAL;
22967 			break;
22968 		}
22969 
22970 		/*
22971 		 * Wait for write cache change in progress
22972 		 * bit to be clear before proceeding.
22973 		 */
22974 		while (un->un_f_wcc_inprog)
22975 			cv_wait(&un->un_wcc_cv, SD_MUTEX(un));
22976 
22977 		un->un_f_wcc_inprog = 1;
22978 
22979 		mutex_exit(SD_MUTEX(un));
22980 
22981 		/*
22982 		 * Get the current write cache state
22983 		 */
22984 		if ((err = sd_get_write_cache_enabled(ssc, &cur_wce)) != 0) {
22985 			mutex_enter(SD_MUTEX(un));
22986 			un->un_f_wcc_inprog = 0;
22987 			cv_broadcast(&un->un_wcc_cv);
22988 			mutex_exit(SD_MUTEX(un));
22989 			break;
22990 		}
22991 
22992 		mutex_enter(SD_MUTEX(un));
22993 		un->un_f_write_cache_enabled = (cur_wce != 0);
22994 
22995 		if (un->un_f_write_cache_enabled && wce == 0) {
22996 			/*
22997 			 * Disable the write cache.  Don't clear
22998 			 * un_f_write_cache_enabled until after
22999 			 * the mode select and flush are complete.
23000 			 */
23001 			sync_supported = un->un_f_sync_cache_supported;
23002 
23003 			/*
23004 			 * If cache flush is suppressed, we assume that the
23005 			 * controller firmware will take care of managing the
23006 			 * write cache for us: no need to explicitly
23007 			 * disable it.
23008 			 */
23009 			if (!un->un_f_suppress_cache_flush) {
23010 				mutex_exit(SD_MUTEX(un));
23011 				if ((err = sd_cache_control(ssc,
23012 				    SD_CACHE_NOCHANGE,
23013 				    SD_CACHE_DISABLE)) == 0 &&
23014 				    sync_supported) {
23015 					err = sd_send_scsi_SYNCHRONIZE_CACHE(un,
23016 					    NULL);
23017 				}
23018 			} else {
23019 				mutex_exit(SD_MUTEX(un));
23020 			}
23021 
23022 			mutex_enter(SD_MUTEX(un));
23023 			if (err == 0) {
23024 				un->un_f_write_cache_enabled = 0;
23025 			}
23026 
23027 		} else if (!un->un_f_write_cache_enabled && wce != 0) {
23028 			/*
23029 			 * Set un_f_write_cache_enabled first, so there is
23030 			 * no window where the cache is enabled, but the
23031 			 * bit says it isn't.
23032 			 */
23033 			un->un_f_write_cache_enabled = 1;
23034 
23035 			/*
23036 			 * If cache flush is suppressed, we assume that the
23037 			 * controller firmware will take care of managing the
23038 			 * write cache for us: no need to explicitly
23039 			 * enable it.
23040 			 */
23041 			if (!un->un_f_suppress_cache_flush) {
23042 				mutex_exit(SD_MUTEX(un));
23043 				err = sd_cache_control(ssc, SD_CACHE_NOCHANGE,
23044 				    SD_CACHE_ENABLE);
23045 			} else {
23046 				mutex_exit(SD_MUTEX(un));
23047 			}
23048 
23049 			mutex_enter(SD_MUTEX(un));
23050 
23051 			if (err) {
23052 				un->un_f_write_cache_enabled = 0;
23053 			}
23054 		}
23055 
23056 		un->un_f_wcc_inprog = 0;
23057 		cv_broadcast(&un->un_wcc_cv);
23058 		mutex_exit(SD_MUTEX(un));
23059 		break;
23060 	}
23061 
23062 	default:
23063 		err = ENOTTY;
23064 		break;
23065 	}
23066 	mutex_enter(SD_MUTEX(un));
23067 	un->un_ncmds_in_driver--;
23068 	ASSERT(un->un_ncmds_in_driver >= 0);
23069 	mutex_exit(SD_MUTEX(un));
23070 
23071 
23072 done_without_assess:
23073 	sd_ssc_fini(ssc);
23074 
23075 	SD_TRACE(SD_LOG_IOCTL, un, "sdioctl: exit: %d\n", err);
23076 	return (err);
23077 
23078 done_with_assess:
23079 	mutex_enter(SD_MUTEX(un));
23080 	un->un_ncmds_in_driver--;
23081 	ASSERT(un->un_ncmds_in_driver >= 0);
23082 	mutex_exit(SD_MUTEX(un));
23083 
23084 done_quick_assess:
23085 	if (err != 0)
23086 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23087 	/* Uninitialize sd_ssc_t pointer */
23088 	sd_ssc_fini(ssc);
23089 
23090 	SD_TRACE(SD_LOG_IOCTL, un, "sdioctl: exit: %d\n", err);
23091 	return (err);
23092 }
23093 
23094 
23095 /*
23096  *    Function: sd_dkio_ctrl_info
23097  *
23098  * Description: This routine is the driver entry point for handling controller
23099  *		information ioctl requests (DKIOCINFO).
23100  *
23101  *   Arguments: dev  - the device number
23102  *		arg  - pointer to user provided dk_cinfo structure
23103  *		       specifying the controller type and attributes.
23104  *		flag - this argument is a pass through to ddi_copyxxx()
23105  *		       directly from the mode argument of ioctl().
23106  *
23107  * Return Code: 0
23108  *		EFAULT
23109  *		ENXIO
23110  */
23111 
23112 static int
23113 sd_dkio_ctrl_info(dev_t dev, caddr_t arg, int flag)
23114 {
23115 	struct sd_lun	*un = NULL;
23116 	struct dk_cinfo	*info;
23117 	dev_info_t	*pdip;
23118 	int		lun, tgt;
23119 
23120 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
23121 		return (ENXIO);
23122 	}
23123 
23124 	info = (struct dk_cinfo *)
23125 	    kmem_zalloc(sizeof (struct dk_cinfo), KM_SLEEP);
23126 
23127 	switch (un->un_ctype) {
23128 	case CTYPE_CDROM:
23129 		info->dki_ctype = DKC_CDROM;
23130 		break;
23131 	default:
23132 		info->dki_ctype = DKC_SCSI_CCS;
23133 		break;
23134 	}
23135 	pdip = ddi_get_parent(SD_DEVINFO(un));
23136 	info->dki_cnum = ddi_get_instance(pdip);
23137 	if (strlen(ddi_get_name(pdip)) < DK_DEVLEN) {
23138 		(void) strcpy(info->dki_cname, ddi_get_name(pdip));
23139 	} else {
23140 		(void) strncpy(info->dki_cname, ddi_node_name(pdip),
23141 		    DK_DEVLEN - 1);
23142 	}
23143 
23144 	lun = ddi_prop_get_int(DDI_DEV_T_ANY, SD_DEVINFO(un),
23145 	    DDI_PROP_DONTPASS, SCSI_ADDR_PROP_LUN, 0);
23146 	tgt = ddi_prop_get_int(DDI_DEV_T_ANY, SD_DEVINFO(un),
23147 	    DDI_PROP_DONTPASS, SCSI_ADDR_PROP_TARGET, 0);
23148 
23149 	/* Unit Information */
23150 	info->dki_unit = ddi_get_instance(SD_DEVINFO(un));
23151 	info->dki_slave = ((tgt << 3) | lun);
23152 	(void) strncpy(info->dki_dname, ddi_driver_name(SD_DEVINFO(un)),
23153 	    DK_DEVLEN - 1);
23154 	info->dki_flags = DKI_FMTVOL;
23155 	info->dki_partition = SDPART(dev);
23156 
23157 	/* Max Transfer size of this device in blocks */
23158 	info->dki_maxtransfer = un->un_max_xfer_size / un->un_sys_blocksize;
23159 	info->dki_addr = 0;
23160 	info->dki_space = 0;
23161 	info->dki_prio = 0;
23162 	info->dki_vec = 0;
23163 
23164 	if (ddi_copyout(info, arg, sizeof (struct dk_cinfo), flag) != 0) {
23165 		kmem_free(info, sizeof (struct dk_cinfo));
23166 		return (EFAULT);
23167 	} else {
23168 		kmem_free(info, sizeof (struct dk_cinfo));
23169 		return (0);
23170 	}
23171 }
23172 
23173 
23174 /*
23175  *    Function: sd_get_media_info
23176  *
23177  * Description: This routine is the driver entry point for handling ioctl
23178  *		requests for the media type or command set profile used by the
23179  *		drive to operate on the media (DKIOCGMEDIAINFO).
23180  *
23181  *   Arguments: dev	- the device number
23182  *		arg	- pointer to user provided dk_minfo structure
23183  *			  specifying the media type, logical block size and
23184  *			  drive capacity.
23185  *		flag	- this argument is a pass through to ddi_copyxxx()
23186  *			  directly from the mode argument of ioctl().
23187  *
23188  * Return Code: 0
23189  *		EACCESS
23190  *		EFAULT
23191  *		ENXIO
23192  *		EIO
23193  */
23194 
23195 static int
23196 sd_get_media_info(dev_t dev, caddr_t arg, int flag)
23197 {
23198 	struct sd_lun		*un = NULL;
23199 	struct uscsi_cmd	com;
23200 	struct scsi_inquiry	*sinq;
23201 	struct dk_minfo		media_info;
23202 	u_longlong_t		media_capacity;
23203 	uint64_t		capacity;
23204 	uint_t			lbasize;
23205 	uchar_t			*out_data;
23206 	uchar_t			*rqbuf;
23207 	int			rval = 0;
23208 	int			rtn;
23209 	sd_ssc_t		*ssc;
23210 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
23211 	    (un->un_state == SD_STATE_OFFLINE)) {
23212 		return (ENXIO);
23213 	}
23214 
23215 	SD_TRACE(SD_LOG_IOCTL_DKIO, un, "sd_get_media_info: entry\n");
23216 
23217 	out_data = kmem_zalloc(SD_PROFILE_HEADER_LEN, KM_SLEEP);
23218 	rqbuf = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
23219 
23220 	/* Issue a TUR to determine if the drive is ready with media present */
23221 	ssc = sd_ssc_init(un);
23222 	rval = sd_send_scsi_TEST_UNIT_READY(ssc, SD_CHECK_FOR_MEDIA);
23223 	if (rval == ENXIO) {
23224 		goto done;
23225 	} else if (rval != 0) {
23226 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23227 	}
23228 
23229 	/* Now get configuration data */
23230 	if (ISCD(un)) {
23231 		media_info.dki_media_type = DK_CDROM;
23232 
23233 		/* Allow SCMD_GET_CONFIGURATION to MMC devices only */
23234 		if (un->un_f_mmc_cap == TRUE) {
23235 			rtn = sd_send_scsi_GET_CONFIGURATION(ssc, &com, rqbuf,
23236 			    SENSE_LENGTH, out_data, SD_PROFILE_HEADER_LEN,
23237 			    SD_PATH_STANDARD);
23238 
23239 			if (rtn) {
23240 				/*
23241 				 * We ignore all failures for CD and need to
23242 				 * put the assessment before processing code
23243 				 * to avoid missing assessment for FMA.
23244 				 */
23245 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23246 				/*
23247 				 * Failed for other than an illegal request
23248 				 * or command not supported
23249 				 */
23250 				if ((com.uscsi_status == STATUS_CHECK) &&
23251 				    (com.uscsi_rqstatus == STATUS_GOOD)) {
23252 					if ((rqbuf[2] != KEY_ILLEGAL_REQUEST) ||
23253 					    (rqbuf[12] != 0x20)) {
23254 						rval = EIO;
23255 						goto no_assessment;
23256 					}
23257 				}
23258 			} else {
23259 				/*
23260 				 * The GET CONFIGURATION command succeeded
23261 				 * so set the media type according to the
23262 				 * returned data
23263 				 */
23264 				media_info.dki_media_type = out_data[6];
23265 				media_info.dki_media_type <<= 8;
23266 				media_info.dki_media_type |= out_data[7];
23267 			}
23268 		}
23269 	} else {
23270 		/*
23271 		 * The profile list is not available, so we attempt to identify
23272 		 * the media type based on the inquiry data
23273 		 */
23274 		sinq = un->un_sd->sd_inq;
23275 		if ((sinq->inq_dtype == DTYPE_DIRECT) ||
23276 		    (sinq->inq_dtype == DTYPE_OPTICAL)) {
23277 			/* This is a direct access device  or optical disk */
23278 			media_info.dki_media_type = DK_FIXED_DISK;
23279 
23280 			if ((bcmp(sinq->inq_vid, "IOMEGA", 6) == 0) ||
23281 			    (bcmp(sinq->inq_vid, "iomega", 6) == 0)) {
23282 				if ((bcmp(sinq->inq_pid, "ZIP", 3) == 0)) {
23283 					media_info.dki_media_type = DK_ZIP;
23284 				} else if (
23285 				    (bcmp(sinq->inq_pid, "jaz", 3) == 0)) {
23286 					media_info.dki_media_type = DK_JAZ;
23287 				}
23288 			}
23289 		} else {
23290 			/*
23291 			 * Not a CD, direct access or optical disk so return
23292 			 * unknown media
23293 			 */
23294 			media_info.dki_media_type = DK_UNKNOWN;
23295 		}
23296 	}
23297 
23298 	/* Now read the capacity so we can provide the lbasize and capacity */
23299 	rval = sd_send_scsi_READ_CAPACITY(ssc, &capacity, &lbasize,
23300 	    SD_PATH_DIRECT);
23301 	switch (rval) {
23302 	case 0:
23303 		break;
23304 	case EACCES:
23305 		rval = EACCES;
23306 		goto done;
23307 	default:
23308 		rval = EIO;
23309 		goto done;
23310 	}
23311 
23312 	/*
23313 	 * If lun is expanded dynamically, update the un structure.
23314 	 */
23315 	mutex_enter(SD_MUTEX(un));
23316 	if ((un->un_f_blockcount_is_valid == TRUE) &&
23317 	    (un->un_f_tgt_blocksize_is_valid == TRUE) &&
23318 	    (capacity > un->un_blockcount)) {
23319 		sd_update_block_info(un, lbasize, capacity);
23320 	}
23321 	mutex_exit(SD_MUTEX(un));
23322 
23323 	media_info.dki_lbsize = lbasize;
23324 	media_capacity = capacity;
23325 
23326 	/*
23327 	 * sd_send_scsi_READ_CAPACITY() reports capacity in
23328 	 * un->un_sys_blocksize chunks. So we need to convert it into
23329 	 * cap.lbasize chunks.
23330 	 */
23331 	media_capacity *= un->un_sys_blocksize;
23332 	media_capacity /= lbasize;
23333 	media_info.dki_capacity = media_capacity;
23334 
23335 	if (ddi_copyout(&media_info, arg, sizeof (struct dk_minfo), flag)) {
23336 		rval = EFAULT;
23337 		/* Put goto. Anybody might add some code below in future */
23338 		goto no_assessment;
23339 	}
23340 done:
23341 	if (rval != 0) {
23342 		if (rval == EIO)
23343 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
23344 		else
23345 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23346 	}
23347 no_assessment:
23348 	sd_ssc_fini(ssc);
23349 	kmem_free(out_data, SD_PROFILE_HEADER_LEN);
23350 	kmem_free(rqbuf, SENSE_LENGTH);
23351 	return (rval);
23352 }
23353 
23354 /*
23355  *    Function: sd_get_media_info_ext
23356  *
23357  * Description: This routine is the driver entry point for handling ioctl
23358  *		requests for the media type or command set profile used by the
23359  *		drive to operate on the media (DKIOCGMEDIAINFOEXT). The
23360  *		difference this ioctl and DKIOCGMEDIAINFO is the return value
23361  *		of this ioctl contains both logical block size and physical
23362  *		block size.
23363  *
23364  *
23365  *   Arguments: dev	- the device number
23366  *		arg	- pointer to user provided dk_minfo_ext structure
23367  *			  specifying the media type, logical block size,
23368  *			  physical block size and disk capacity.
23369  *		flag	- this argument is a pass through to ddi_copyxxx()
23370  *			  directly from the mode argument of ioctl().
23371  *
23372  * Return Code: 0
23373  *		EACCESS
23374  *		EFAULT
23375  *		ENXIO
23376  *		EIO
23377  */
23378 
23379 static int
23380 sd_get_media_info_ext(dev_t dev, caddr_t arg, int flag)
23381 {
23382 	struct sd_lun		*un = NULL;
23383 	struct uscsi_cmd	com;
23384 	struct scsi_inquiry	*sinq;
23385 	struct dk_minfo_ext	media_info_ext;
23386 	u_longlong_t		media_capacity;
23387 	uint64_t		capacity;
23388 	uint_t			lbasize;
23389 	uint_t			pbsize;
23390 	uchar_t			*out_data;
23391 	uchar_t			*rqbuf;
23392 	int			rval = 0;
23393 	int			rtn;
23394 	sd_ssc_t		*ssc;
23395 
23396 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
23397 	    (un->un_state == SD_STATE_OFFLINE)) {
23398 		return (ENXIO);
23399 	}
23400 
23401 	SD_TRACE(SD_LOG_IOCTL_DKIO, un, "sd_get_media_info_ext: entry\n");
23402 
23403 	out_data = kmem_zalloc(SD_PROFILE_HEADER_LEN, KM_SLEEP);
23404 	rqbuf = kmem_zalloc(SENSE_LENGTH, KM_SLEEP);
23405 	ssc = sd_ssc_init(un);
23406 
23407 	/* Issue a TUR to determine if the drive is ready with media present */
23408 	rval = sd_send_scsi_TEST_UNIT_READY(ssc, SD_CHECK_FOR_MEDIA);
23409 	if (rval == ENXIO) {
23410 		goto done;
23411 	} else if (rval != 0) {
23412 		sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23413 	}
23414 
23415 	/* Now get configuration data */
23416 	if (ISCD(un)) {
23417 		media_info_ext.dki_media_type = DK_CDROM;
23418 
23419 		/* Allow SCMD_GET_CONFIGURATION to MMC devices only */
23420 		if (un->un_f_mmc_cap == TRUE) {
23421 			rtn = sd_send_scsi_GET_CONFIGURATION(ssc, &com, rqbuf,
23422 			    SENSE_LENGTH, out_data, SD_PROFILE_HEADER_LEN,
23423 			    SD_PATH_STANDARD);
23424 
23425 			if (rtn) {
23426 				/*
23427 				 * We ignore all failures for CD and need to
23428 				 * put the assessment before processing code
23429 				 * to avoid missing assessment for FMA.
23430 				 */
23431 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23432 				/*
23433 				 * Failed for other than an illegal request
23434 				 * or command not supported
23435 				 */
23436 				if ((com.uscsi_status == STATUS_CHECK) &&
23437 				    (com.uscsi_rqstatus == STATUS_GOOD)) {
23438 					if ((rqbuf[2] != KEY_ILLEGAL_REQUEST) ||
23439 					    (rqbuf[12] != 0x20)) {
23440 						rval = EIO;
23441 						goto no_assessment;
23442 					}
23443 				}
23444 			} else {
23445 				/*
23446 				 * The GET CONFIGURATION command succeeded
23447 				 * so set the media type according to the
23448 				 * returned data
23449 				 */
23450 				media_info_ext.dki_media_type = out_data[6];
23451 				media_info_ext.dki_media_type <<= 8;
23452 				media_info_ext.dki_media_type |= out_data[7];
23453 			}
23454 		}
23455 	} else {
23456 		/*
23457 		 * The profile list is not available, so we attempt to identify
23458 		 * the media type based on the inquiry data
23459 		 */
23460 		sinq = un->un_sd->sd_inq;
23461 		if ((sinq->inq_dtype == DTYPE_DIRECT) ||
23462 		    (sinq->inq_dtype == DTYPE_OPTICAL)) {
23463 			/* This is a direct access device  or optical disk */
23464 			media_info_ext.dki_media_type = DK_FIXED_DISK;
23465 
23466 			if ((bcmp(sinq->inq_vid, "IOMEGA", 6) == 0) ||
23467 			    (bcmp(sinq->inq_vid, "iomega", 6) == 0)) {
23468 				if ((bcmp(sinq->inq_pid, "ZIP", 3) == 0)) {
23469 					media_info_ext.dki_media_type = DK_ZIP;
23470 				} else if (
23471 				    (bcmp(sinq->inq_pid, "jaz", 3) == 0)) {
23472 					media_info_ext.dki_media_type = DK_JAZ;
23473 				}
23474 			}
23475 		} else {
23476 			/*
23477 			 * Not a CD, direct access or optical disk so return
23478 			 * unknown media
23479 			 */
23480 			media_info_ext.dki_media_type = DK_UNKNOWN;
23481 		}
23482 	}
23483 
23484 	/*
23485 	 * Now read the capacity so we can provide the lbasize,
23486 	 * pbsize and capacity.
23487 	 */
23488 	rval = sd_send_scsi_READ_CAPACITY_16(ssc, &capacity, &lbasize, &pbsize,
23489 	    SD_PATH_DIRECT);
23490 
23491 	if (rval != 0) {
23492 		rval = sd_send_scsi_READ_CAPACITY(ssc, &capacity, &lbasize,
23493 		    SD_PATH_DIRECT);
23494 
23495 		switch (rval) {
23496 		case 0:
23497 			pbsize = lbasize;
23498 			media_capacity = capacity;
23499 			/*
23500 			 * sd_send_scsi_READ_CAPACITY() reports capacity in
23501 			 * un->un_sys_blocksize chunks. So we need to convert
23502 			 * it into cap.lbsize chunks.
23503 			 */
23504 			if (un->un_f_has_removable_media) {
23505 				media_capacity *= un->un_sys_blocksize;
23506 				media_capacity /= lbasize;
23507 			}
23508 			break;
23509 		case EACCES:
23510 			rval = EACCES;
23511 			goto done;
23512 		default:
23513 			rval = EIO;
23514 			goto done;
23515 		}
23516 	} else {
23517 		media_capacity = capacity;
23518 	}
23519 
23520 	/*
23521 	 * If lun is expanded dynamically, update the un structure.
23522 	 */
23523 	mutex_enter(SD_MUTEX(un));
23524 	if ((un->un_f_blockcount_is_valid == TRUE) &&
23525 	    (un->un_f_tgt_blocksize_is_valid == TRUE) &&
23526 	    (capacity > un->un_blockcount)) {
23527 		sd_update_block_info(un, lbasize, capacity);
23528 	}
23529 	mutex_exit(SD_MUTEX(un));
23530 
23531 	media_info_ext.dki_lbsize = lbasize;
23532 	media_info_ext.dki_capacity = media_capacity;
23533 	media_info_ext.dki_pbsize = pbsize;
23534 
23535 	if (ddi_copyout(&media_info_ext, arg, sizeof (struct dk_minfo_ext),
23536 	    flag)) {
23537 		rval = EFAULT;
23538 		goto no_assessment;
23539 	}
23540 done:
23541 	if (rval != 0) {
23542 		if (rval == EIO)
23543 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
23544 		else
23545 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23546 	}
23547 no_assessment:
23548 	sd_ssc_fini(ssc);
23549 	kmem_free(out_data, SD_PROFILE_HEADER_LEN);
23550 	kmem_free(rqbuf, SENSE_LENGTH);
23551 	return (rval);
23552 }
23553 
23554 /*
23555  *    Function: sd_watch_request_submit
23556  *
23557  * Description: Call scsi_watch_request_submit or scsi_mmc_watch_request_submit
23558  *		depending on which is supported by device.
23559  */
23560 static opaque_t
23561 sd_watch_request_submit(struct sd_lun *un)
23562 {
23563 	dev_t			dev;
23564 
23565 	/* All submissions are unified to use same device number */
23566 	dev = sd_make_device(SD_DEVINFO(un));
23567 
23568 	if (un->un_f_mmc_cap && un->un_f_mmc_gesn_polling) {
23569 		return (scsi_mmc_watch_request_submit(SD_SCSI_DEVP(un),
23570 		    sd_check_media_time, SENSE_LENGTH, sd_media_watch_cb,
23571 		    (caddr_t)dev));
23572 	} else {
23573 		return (scsi_watch_request_submit(SD_SCSI_DEVP(un),
23574 		    sd_check_media_time, SENSE_LENGTH, sd_media_watch_cb,
23575 		    (caddr_t)dev));
23576 	}
23577 }
23578 
23579 
23580 /*
23581  *    Function: sd_check_media
23582  *
23583  * Description: This utility routine implements the functionality for the
23584  *		DKIOCSTATE ioctl. This ioctl blocks the user thread until the
23585  *		driver state changes from that specified by the user
23586  *		(inserted or ejected). For example, if the user specifies
23587  *		DKIO_EJECTED and the current media state is inserted this
23588  *		routine will immediately return DKIO_INSERTED. However, if the
23589  *		current media state is not inserted the user thread will be
23590  *		blocked until the drive state changes. If DKIO_NONE is specified
23591  *		the user thread will block until a drive state change occurs.
23592  *
23593  *   Arguments: dev  - the device number
23594  *		state  - user pointer to a dkio_state, updated with the current
23595  *			drive state at return.
23596  *
23597  * Return Code: ENXIO
23598  *		EIO
23599  *		EAGAIN
23600  *		EINTR
23601  */
23602 
23603 static int
23604 sd_check_media(dev_t dev, enum dkio_state state)
23605 {
23606 	struct sd_lun		*un = NULL;
23607 	enum dkio_state		prev_state;
23608 	opaque_t		token = NULL;
23609 	int			rval = 0;
23610 	sd_ssc_t		*ssc;
23611 
23612 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
23613 		return (ENXIO);
23614 	}
23615 
23616 	SD_TRACE(SD_LOG_COMMON, un, "sd_check_media: entry\n");
23617 
23618 	ssc = sd_ssc_init(un);
23619 
23620 	mutex_enter(SD_MUTEX(un));
23621 
23622 	SD_TRACE(SD_LOG_COMMON, un, "sd_check_media: "
23623 	    "state=%x, mediastate=%x\n", state, un->un_mediastate);
23624 
23625 	prev_state = un->un_mediastate;
23626 
23627 	/* is there anything to do? */
23628 	if (state == un->un_mediastate || un->un_mediastate == DKIO_NONE) {
23629 		/*
23630 		 * submit the request to the scsi_watch service;
23631 		 * scsi_media_watch_cb() does the real work
23632 		 */
23633 		mutex_exit(SD_MUTEX(un));
23634 
23635 		/*
23636 		 * This change handles the case where a scsi watch request is
23637 		 * added to a device that is powered down. To accomplish this
23638 		 * we power up the device before adding the scsi watch request,
23639 		 * since the scsi watch sends a TUR directly to the device
23640 		 * which the device cannot handle if it is powered down.
23641 		 */
23642 		if (sd_pm_entry(un) != DDI_SUCCESS) {
23643 			mutex_enter(SD_MUTEX(un));
23644 			goto done;
23645 		}
23646 
23647 		token = sd_watch_request_submit(un);
23648 
23649 		sd_pm_exit(un);
23650 
23651 		mutex_enter(SD_MUTEX(un));
23652 		if (token == NULL) {
23653 			rval = EAGAIN;
23654 			goto done;
23655 		}
23656 
23657 		/*
23658 		 * This is a special case IOCTL that doesn't return
23659 		 * until the media state changes. Routine sdpower
23660 		 * knows about and handles this so don't count it
23661 		 * as an active cmd in the driver, which would
23662 		 * keep the device busy to the pm framework.
23663 		 * If the count isn't decremented the device can't
23664 		 * be powered down.
23665 		 */
23666 		un->un_ncmds_in_driver--;
23667 		ASSERT(un->un_ncmds_in_driver >= 0);
23668 
23669 		/*
23670 		 * if a prior request had been made, this will be the same
23671 		 * token, as scsi_watch was designed that way.
23672 		 */
23673 		un->un_swr_token = token;
23674 		un->un_specified_mediastate = state;
23675 
23676 		/*
23677 		 * now wait for media change
23678 		 * we will not be signalled unless mediastate == state but it is
23679 		 * still better to test for this condition, since there is a
23680 		 * 2 sec cv_broadcast delay when mediastate == DKIO_INSERTED
23681 		 */
23682 		SD_TRACE(SD_LOG_COMMON, un,
23683 		    "sd_check_media: waiting for media state change\n");
23684 		while (un->un_mediastate == state) {
23685 			if (cv_wait_sig(&un->un_state_cv, SD_MUTEX(un)) == 0) {
23686 				SD_TRACE(SD_LOG_COMMON, un,
23687 				    "sd_check_media: waiting for media state "
23688 				    "was interrupted\n");
23689 				un->un_ncmds_in_driver++;
23690 				rval = EINTR;
23691 				goto done;
23692 			}
23693 			SD_TRACE(SD_LOG_COMMON, un,
23694 			    "sd_check_media: received signal, state=%x\n",
23695 			    un->un_mediastate);
23696 		}
23697 		/*
23698 		 * Inc the counter to indicate the device once again
23699 		 * has an active outstanding cmd.
23700 		 */
23701 		un->un_ncmds_in_driver++;
23702 	}
23703 
23704 	/* invalidate geometry */
23705 	if (prev_state == DKIO_INSERTED && un->un_mediastate == DKIO_EJECTED) {
23706 		sr_ejected(un);
23707 	}
23708 
23709 	if (un->un_mediastate == DKIO_INSERTED && prev_state != DKIO_INSERTED) {
23710 		uint64_t	capacity;
23711 		uint_t		lbasize;
23712 
23713 		SD_TRACE(SD_LOG_COMMON, un, "sd_check_media: media inserted\n");
23714 		mutex_exit(SD_MUTEX(un));
23715 		/*
23716 		 * Since the following routines use SD_PATH_DIRECT, we must
23717 		 * call PM directly before the upcoming disk accesses. This
23718 		 * may cause the disk to be power/spin up.
23719 		 */
23720 
23721 		if (sd_pm_entry(un) == DDI_SUCCESS) {
23722 			rval = sd_send_scsi_READ_CAPACITY(ssc,
23723 			    &capacity, &lbasize, SD_PATH_DIRECT);
23724 			if (rval != 0) {
23725 				sd_pm_exit(un);
23726 				if (rval == EIO)
23727 					sd_ssc_assessment(ssc,
23728 					    SD_FMT_STATUS_CHECK);
23729 				else
23730 					sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23731 				mutex_enter(SD_MUTEX(un));
23732 				goto done;
23733 			}
23734 		} else {
23735 			rval = EIO;
23736 			mutex_enter(SD_MUTEX(un));
23737 			goto done;
23738 		}
23739 		mutex_enter(SD_MUTEX(un));
23740 
23741 		sd_update_block_info(un, lbasize, capacity);
23742 
23743 		/*
23744 		 *  Check if the media in the device is writable or not
23745 		 */
23746 		if (ISCD(un)) {
23747 			sd_check_for_writable_cd(ssc, SD_PATH_DIRECT);
23748 		}
23749 
23750 		mutex_exit(SD_MUTEX(un));
23751 		cmlb_invalidate(un->un_cmlbhandle, (void *)SD_PATH_DIRECT);
23752 		if ((cmlb_validate(un->un_cmlbhandle, 0,
23753 		    (void *)SD_PATH_DIRECT) == 0) && un->un_f_pkstats_enabled) {
23754 			sd_set_pstats(un);
23755 			SD_TRACE(SD_LOG_IO_PARTITION, un,
23756 			    "sd_check_media: un:0x%p pstats created and "
23757 			    "set\n", un);
23758 		}
23759 
23760 		rval = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_PREVENT,
23761 		    SD_PATH_DIRECT);
23762 
23763 		sd_pm_exit(un);
23764 
23765 		if (rval != 0) {
23766 			if (rval == EIO)
23767 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
23768 			else
23769 				sd_ssc_assessment(ssc, SD_FMT_IGNORE);
23770 		}
23771 
23772 		mutex_enter(SD_MUTEX(un));
23773 	}
23774 done:
23775 	sd_ssc_fini(ssc);
23776 	un->un_f_watcht_stopped = FALSE;
23777 	if (token != NULL && un->un_swr_token != NULL) {
23778 		/*
23779 		 * Use of this local token and the mutex ensures that we avoid
23780 		 * some race conditions associated with terminating the
23781 		 * scsi watch.
23782 		 */
23783 		token = un->un_swr_token;
23784 		mutex_exit(SD_MUTEX(un));
23785 		(void) scsi_watch_request_terminate(token,
23786 		    SCSI_WATCH_TERMINATE_WAIT);
23787 		if (scsi_watch_get_ref_count(token) == 0) {
23788 			mutex_enter(SD_MUTEX(un));
23789 			un->un_swr_token = (opaque_t)NULL;
23790 		} else {
23791 			mutex_enter(SD_MUTEX(un));
23792 		}
23793 	}
23794 
23795 	/*
23796 	 * Update the capacity kstat value, if no media previously
23797 	 * (capacity kstat is 0) and a media has been inserted
23798 	 * (un_f_blockcount_is_valid == TRUE)
23799 	 */
23800 	if (un->un_errstats) {
23801 		struct sd_errstats	*stp = NULL;
23802 
23803 		stp = (struct sd_errstats *)un->un_errstats->ks_data;
23804 		if ((stp->sd_capacity.value.ui64 == 0) &&
23805 		    (un->un_f_blockcount_is_valid == TRUE)) {
23806 			stp->sd_capacity.value.ui64 =
23807 			    (uint64_t)((uint64_t)un->un_blockcount *
23808 			    un->un_sys_blocksize);
23809 		}
23810 	}
23811 	mutex_exit(SD_MUTEX(un));
23812 	SD_TRACE(SD_LOG_COMMON, un, "sd_check_media: done\n");
23813 	return (rval);
23814 }
23815 
23816 
23817 /*
23818  *    Function: sd_delayed_cv_broadcast
23819  *
23820  * Description: Delayed cv_broadcast to allow for target to recover from media
23821  *		insertion.
23822  *
23823  *   Arguments: arg - driver soft state (unit) structure
23824  */
23825 
23826 static void
23827 sd_delayed_cv_broadcast(void *arg)
23828 {
23829 	struct sd_lun *un = arg;
23830 
23831 	SD_TRACE(SD_LOG_COMMON, un, "sd_delayed_cv_broadcast\n");
23832 
23833 	mutex_enter(SD_MUTEX(un));
23834 	un->un_dcvb_timeid = NULL;
23835 	cv_broadcast(&un->un_state_cv);
23836 	mutex_exit(SD_MUTEX(un));
23837 }
23838 
23839 
23840 /*
23841  *    Function: sd_media_watch_cb
23842  *
23843  * Description: Callback routine used for support of the DKIOCSTATE ioctl. This
23844  *		routine processes the TUR sense data and updates the driver
23845  *		state if a transition has occurred. The user thread
23846  *		(sd_check_media) is then signalled.
23847  *
23848  *   Arguments: arg -   the device 'dev_t' is used for context to discriminate
23849  *			among multiple watches that share this callback function
23850  *		resultp - scsi watch facility result packet containing scsi
23851  *			  packet, status byte and sense data
23852  *
23853  * Return Code: 0 for success, -1 for failure
23854  */
23855 
23856 static int
23857 sd_media_watch_cb(caddr_t arg, struct scsi_watch_result *resultp)
23858 {
23859 	struct sd_lun			*un;
23860 	struct scsi_status		*statusp = resultp->statusp;
23861 	uint8_t				*sensep = (uint8_t *)resultp->sensep;
23862 	enum dkio_state			state = DKIO_NONE;
23863 	dev_t				dev = (dev_t)arg;
23864 	uchar_t				actual_sense_length;
23865 	uint8_t				skey, asc, ascq;
23866 
23867 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
23868 		return (-1);
23869 	}
23870 	actual_sense_length = resultp->actual_sense_length;
23871 
23872 	mutex_enter(SD_MUTEX(un));
23873 	SD_TRACE(SD_LOG_COMMON, un,
23874 	    "sd_media_watch_cb: status=%x, sensep=%p, len=%x\n",
23875 	    *((char *)statusp), (void *)sensep, actual_sense_length);
23876 
23877 	if (resultp->pkt->pkt_reason == CMD_DEV_GONE) {
23878 		un->un_mediastate = DKIO_DEV_GONE;
23879 		cv_broadcast(&un->un_state_cv);
23880 		mutex_exit(SD_MUTEX(un));
23881 
23882 		return (0);
23883 	}
23884 
23885 	if (un->un_f_mmc_cap && un->un_f_mmc_gesn_polling) {
23886 		if (sd_gesn_media_data_valid(resultp->mmc_data)) {
23887 			if ((resultp->mmc_data[5] &
23888 			    SD_GESN_MEDIA_EVENT_STATUS_PRESENT) != 0) {
23889 				state = DKIO_INSERTED;
23890 			} else {
23891 				state = DKIO_EJECTED;
23892 			}
23893 			if ((resultp->mmc_data[4] & SD_GESN_MEDIA_EVENT_CODE) ==
23894 			    SD_GESN_MEDIA_EVENT_EJECTREQUEST) {
23895 				sd_log_eject_request_event(un, KM_NOSLEEP);
23896 			}
23897 		}
23898 	} else if (sensep != NULL) {
23899 		/*
23900 		 * If there was a check condition then sensep points to valid
23901 		 * sense data. If status was not a check condition but a
23902 		 * reservation or busy status then the new state is DKIO_NONE.
23903 		 */
23904 		skey = scsi_sense_key(sensep);
23905 		asc = scsi_sense_asc(sensep);
23906 		ascq = scsi_sense_ascq(sensep);
23907 
23908 		SD_INFO(SD_LOG_COMMON, un,
23909 		    "sd_media_watch_cb: sense KEY=%x, ASC=%x, ASCQ=%x\n",
23910 		    skey, asc, ascq);
23911 		/* This routine only uses up to 13 bytes of sense data. */
23912 		if (actual_sense_length >= 13) {
23913 			if (skey == KEY_UNIT_ATTENTION) {
23914 				if (asc == 0x28) {
23915 					state = DKIO_INSERTED;
23916 				}
23917 			} else if (skey == KEY_NOT_READY) {
23918 				/*
23919 				 * Sense data of 02/06/00 means that the
23920 				 * drive could not read the media (No
23921 				 * reference position found). In this case
23922 				 * to prevent a hang on the DKIOCSTATE IOCTL
23923 				 * we set the media state to DKIO_INSERTED.
23924 				 */
23925 				if (asc == 0x06 && ascq == 0x00)
23926 					state = DKIO_INSERTED;
23927 
23928 				/*
23929 				 * if 02/04/02  means that the host
23930 				 * should send start command. Explicitly
23931 				 * leave the media state as is
23932 				 * (inserted) as the media is inserted
23933 				 * and host has stopped device for PM
23934 				 * reasons. Upon next true read/write
23935 				 * to this media will bring the
23936 				 * device to the right state good for
23937 				 * media access.
23938 				 */
23939 				if (asc == 0x3a) {
23940 					state = DKIO_EJECTED;
23941 				} else {
23942 					/*
23943 					 * If the drive is busy with an
23944 					 * operation or long write, keep the
23945 					 * media in an inserted state.
23946 					 */
23947 
23948 					if ((asc == 0x04) &&
23949 					    ((ascq == 0x02) ||
23950 					    (ascq == 0x07) ||
23951 					    (ascq == 0x08))) {
23952 						state = DKIO_INSERTED;
23953 					}
23954 				}
23955 			} else if (skey == KEY_NO_SENSE) {
23956 				if ((asc == 0x00) && (ascq == 0x00)) {
23957 					/*
23958 					 * Sense Data 00/00/00 does not provide
23959 					 * any information about the state of
23960 					 * the media. Ignore it.
23961 					 */
23962 					mutex_exit(SD_MUTEX(un));
23963 					return (0);
23964 				}
23965 			}
23966 		}
23967 	} else if ((*((char *)statusp) == STATUS_GOOD) &&
23968 	    (resultp->pkt->pkt_reason == CMD_CMPLT)) {
23969 		state = DKIO_INSERTED;
23970 	}
23971 
23972 	SD_TRACE(SD_LOG_COMMON, un,
23973 	    "sd_media_watch_cb: state=%x, specified=%x\n",
23974 	    state, un->un_specified_mediastate);
23975 
23976 	/*
23977 	 * now signal the waiting thread if this is *not* the specified state;
23978 	 * delay the signal if the state is DKIO_INSERTED to allow the target
23979 	 * to recover
23980 	 */
23981 	if (state != un->un_specified_mediastate) {
23982 		un->un_mediastate = state;
23983 		if (state == DKIO_INSERTED) {
23984 			/*
23985 			 * delay the signal to give the drive a chance
23986 			 * to do what it apparently needs to do
23987 			 */
23988 			SD_TRACE(SD_LOG_COMMON, un,
23989 			    "sd_media_watch_cb: delayed cv_broadcast\n");
23990 			if (un->un_dcvb_timeid == NULL) {
23991 				un->un_dcvb_timeid =
23992 				    timeout(sd_delayed_cv_broadcast, un,
23993 				    drv_usectohz((clock_t)MEDIA_ACCESS_DELAY));
23994 			}
23995 		} else {
23996 			SD_TRACE(SD_LOG_COMMON, un,
23997 			    "sd_media_watch_cb: immediate cv_broadcast\n");
23998 			cv_broadcast(&un->un_state_cv);
23999 		}
24000 	}
24001 	mutex_exit(SD_MUTEX(un));
24002 	return (0);
24003 }
24004 
24005 
24006 /*
24007  *    Function: sd_dkio_get_temp
24008  *
24009  * Description: This routine is the driver entry point for handling ioctl
24010  *		requests to get the disk temperature.
24011  *
24012  *   Arguments: dev  - the device number
24013  *		arg  - pointer to user provided dk_temperature structure.
24014  *		flag - this argument is a pass through to ddi_copyxxx()
24015  *		       directly from the mode argument of ioctl().
24016  *
24017  * Return Code: 0
24018  *		EFAULT
24019  *		ENXIO
24020  *		EAGAIN
24021  */
24022 
24023 static int
24024 sd_dkio_get_temp(dev_t dev, caddr_t arg, int flag)
24025 {
24026 	struct sd_lun		*un = NULL;
24027 	struct dk_temperature	*dktemp = NULL;
24028 	uchar_t			*temperature_page;
24029 	int			rval = 0;
24030 	int			path_flag = SD_PATH_STANDARD;
24031 	sd_ssc_t		*ssc;
24032 
24033 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24034 		return (ENXIO);
24035 	}
24036 
24037 	ssc = sd_ssc_init(un);
24038 	dktemp = kmem_zalloc(sizeof (struct dk_temperature), KM_SLEEP);
24039 
24040 	/* copyin the disk temp argument to get the user flags */
24041 	if (ddi_copyin((void *)arg, dktemp,
24042 	    sizeof (struct dk_temperature), flag) != 0) {
24043 		rval = EFAULT;
24044 		goto done;
24045 	}
24046 
24047 	/* Initialize the temperature to invalid. */
24048 	dktemp->dkt_cur_temp = (short)DKT_INVALID_TEMP;
24049 	dktemp->dkt_ref_temp = (short)DKT_INVALID_TEMP;
24050 
24051 	/*
24052 	 * Note: Investigate removing the "bypass pm" semantic.
24053 	 * Can we just bypass PM always?
24054 	 */
24055 	if (dktemp->dkt_flags & DKT_BYPASS_PM) {
24056 		path_flag = SD_PATH_DIRECT;
24057 		ASSERT(!mutex_owned(&un->un_pm_mutex));
24058 		mutex_enter(&un->un_pm_mutex);
24059 		if (SD_DEVICE_IS_IN_LOW_POWER(un)) {
24060 			/*
24061 			 * If DKT_BYPASS_PM is set, and the drive happens to be
24062 			 * in low power mode, we can not wake it up, Need to
24063 			 * return EAGAIN.
24064 			 */
24065 			mutex_exit(&un->un_pm_mutex);
24066 			rval = EAGAIN;
24067 			goto done;
24068 		} else {
24069 			/*
24070 			 * Indicate to PM the device is busy. This is required
24071 			 * to avoid a race - i.e. the ioctl is issuing a
24072 			 * command and the pm framework brings down the device
24073 			 * to low power mode (possible power cut-off on some
24074 			 * platforms).
24075 			 */
24076 			mutex_exit(&un->un_pm_mutex);
24077 			if (sd_pm_entry(un) != DDI_SUCCESS) {
24078 				rval = EAGAIN;
24079 				goto done;
24080 			}
24081 		}
24082 	}
24083 
24084 	temperature_page = kmem_zalloc(TEMPERATURE_PAGE_SIZE, KM_SLEEP);
24085 
24086 	rval = sd_send_scsi_LOG_SENSE(ssc, temperature_page,
24087 	    TEMPERATURE_PAGE_SIZE, TEMPERATURE_PAGE, 1, 0, path_flag);
24088 	if (rval != 0)
24089 		goto done2;
24090 
24091 	/*
24092 	 * For the current temperature verify that the parameter length is 0x02
24093 	 * and the parameter code is 0x00
24094 	 */
24095 	if ((temperature_page[7] == 0x02) && (temperature_page[4] == 0x00) &&
24096 	    (temperature_page[5] == 0x00)) {
24097 		if (temperature_page[9] == 0xFF) {
24098 			dktemp->dkt_cur_temp = (short)DKT_INVALID_TEMP;
24099 		} else {
24100 			dktemp->dkt_cur_temp = (short)(temperature_page[9]);
24101 		}
24102 	}
24103 
24104 	/*
24105 	 * For the reference temperature verify that the parameter
24106 	 * length is 0x02 and the parameter code is 0x01
24107 	 */
24108 	if ((temperature_page[13] == 0x02) && (temperature_page[10] == 0x00) &&
24109 	    (temperature_page[11] == 0x01)) {
24110 		if (temperature_page[15] == 0xFF) {
24111 			dktemp->dkt_ref_temp = (short)DKT_INVALID_TEMP;
24112 		} else {
24113 			dktemp->dkt_ref_temp = (short)(temperature_page[15]);
24114 		}
24115 	}
24116 
24117 	/* Do the copyout regardless of the temperature commands status. */
24118 	if (ddi_copyout(dktemp, (void *)arg, sizeof (struct dk_temperature),
24119 	    flag) != 0) {
24120 		rval = EFAULT;
24121 		goto done1;
24122 	}
24123 
24124 done2:
24125 	if (rval != 0) {
24126 		if (rval == EIO)
24127 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
24128 		else
24129 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
24130 	}
24131 done1:
24132 	if (path_flag == SD_PATH_DIRECT) {
24133 		sd_pm_exit(un);
24134 	}
24135 
24136 	kmem_free(temperature_page, TEMPERATURE_PAGE_SIZE);
24137 done:
24138 	sd_ssc_fini(ssc);
24139 	if (dktemp != NULL) {
24140 		kmem_free(dktemp, sizeof (struct dk_temperature));
24141 	}
24142 
24143 	return (rval);
24144 }
24145 
24146 
24147 /*
24148  *    Function: sd_log_page_supported
24149  *
24150  * Description: This routine uses sd_send_scsi_LOG_SENSE to find the list of
24151  *		supported log pages.
24152  *
24153  *   Arguments: ssc   - ssc contains pointer to driver soft state (unit)
24154  *                      structure for this target.
24155  *		log_page -
24156  *
24157  * Return Code: -1 - on error (log sense is optional and may not be supported).
24158  *		0  - log page not found.
24159  *  		1  - log page found.
24160  */
24161 
24162 static int
24163 sd_log_page_supported(sd_ssc_t *ssc, int log_page)
24164 {
24165 	uchar_t *log_page_data;
24166 	int	i;
24167 	int	match = 0;
24168 	int	log_size;
24169 	int	status = 0;
24170 	struct sd_lun	*un;
24171 
24172 	ASSERT(ssc != NULL);
24173 	un = ssc->ssc_un;
24174 	ASSERT(un != NULL);
24175 
24176 	log_page_data = kmem_zalloc(0xFF, KM_SLEEP);
24177 
24178 	status = sd_send_scsi_LOG_SENSE(ssc, log_page_data, 0xFF, 0, 0x01, 0,
24179 	    SD_PATH_DIRECT);
24180 
24181 	if (status != 0) {
24182 		if (status == EIO) {
24183 			/*
24184 			 * Some disks do not support log sense, we
24185 			 * should ignore this kind of error(sense key is
24186 			 * 0x5 - illegal request).
24187 			 */
24188 			uint8_t *sensep;
24189 			int senlen;
24190 
24191 			sensep = (uint8_t *)ssc->ssc_uscsi_cmd->uscsi_rqbuf;
24192 			senlen = (int)(ssc->ssc_uscsi_cmd->uscsi_rqlen -
24193 			    ssc->ssc_uscsi_cmd->uscsi_rqresid);
24194 
24195 			if (senlen > 0 &&
24196 			    scsi_sense_key(sensep) == KEY_ILLEGAL_REQUEST) {
24197 				sd_ssc_assessment(ssc,
24198 				    SD_FMT_IGNORE_COMPROMISE);
24199 			} else {
24200 				sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
24201 			}
24202 		} else {
24203 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
24204 		}
24205 
24206 		SD_ERROR(SD_LOG_COMMON, un,
24207 		    "sd_log_page_supported: failed log page retrieval\n");
24208 		kmem_free(log_page_data, 0xFF);
24209 		return (-1);
24210 	}
24211 
24212 	log_size = log_page_data[3];
24213 
24214 	/*
24215 	 * The list of supported log pages start from the fourth byte. Check
24216 	 * until we run out of log pages or a match is found.
24217 	 */
24218 	for (i = 4; (i < (log_size + 4)) && !match; i++) {
24219 		if (log_page_data[i] == log_page) {
24220 			match++;
24221 		}
24222 	}
24223 	kmem_free(log_page_data, 0xFF);
24224 	return (match);
24225 }
24226 
24227 
24228 /*
24229  *    Function: sd_mhdioc_failfast
24230  *
24231  * Description: This routine is the driver entry point for handling ioctl
24232  *		requests to enable/disable the multihost failfast option.
24233  *		(MHIOCENFAILFAST)
24234  *
24235  *   Arguments: dev	- the device number
24236  *		arg	- user specified probing interval.
24237  *		flag	- this argument is a pass through to ddi_copyxxx()
24238  *			  directly from the mode argument of ioctl().
24239  *
24240  * Return Code: 0
24241  *		EFAULT
24242  *		ENXIO
24243  */
24244 
24245 static int
24246 sd_mhdioc_failfast(dev_t dev, caddr_t arg, int flag)
24247 {
24248 	struct sd_lun	*un = NULL;
24249 	int		mh_time;
24250 	int		rval = 0;
24251 
24252 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24253 		return (ENXIO);
24254 	}
24255 
24256 	if (ddi_copyin((void *)arg, &mh_time, sizeof (int), flag))
24257 		return (EFAULT);
24258 
24259 	if (mh_time) {
24260 		mutex_enter(SD_MUTEX(un));
24261 		un->un_resvd_status |= SD_FAILFAST;
24262 		mutex_exit(SD_MUTEX(un));
24263 		/*
24264 		 * If mh_time is INT_MAX, then this ioctl is being used for
24265 		 * SCSI-3 PGR purposes, and we don't need to spawn watch thread.
24266 		 */
24267 		if (mh_time != INT_MAX) {
24268 			rval = sd_check_mhd(dev, mh_time);
24269 		}
24270 	} else {
24271 		(void) sd_check_mhd(dev, 0);
24272 		mutex_enter(SD_MUTEX(un));
24273 		un->un_resvd_status &= ~SD_FAILFAST;
24274 		mutex_exit(SD_MUTEX(un));
24275 	}
24276 	return (rval);
24277 }
24278 
24279 
24280 /*
24281  *    Function: sd_mhdioc_takeown
24282  *
24283  * Description: This routine is the driver entry point for handling ioctl
24284  *		requests to forcefully acquire exclusive access rights to the
24285  *		multihost disk (MHIOCTKOWN).
24286  *
24287  *   Arguments: dev	- the device number
24288  *		arg	- user provided structure specifying the delay
24289  *			  parameters in milliseconds
24290  *		flag	- this argument is a pass through to ddi_copyxxx()
24291  *			  directly from the mode argument of ioctl().
24292  *
24293  * Return Code: 0
24294  *		EFAULT
24295  *		ENXIO
24296  */
24297 
24298 static int
24299 sd_mhdioc_takeown(dev_t dev, caddr_t arg, int flag)
24300 {
24301 	struct sd_lun		*un = NULL;
24302 	struct mhioctkown	*tkown = NULL;
24303 	int			rval = 0;
24304 
24305 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24306 		return (ENXIO);
24307 	}
24308 
24309 	if (arg != NULL) {
24310 		tkown = (struct mhioctkown *)
24311 		    kmem_zalloc(sizeof (struct mhioctkown), KM_SLEEP);
24312 		rval = ddi_copyin(arg, tkown, sizeof (struct mhioctkown), flag);
24313 		if (rval != 0) {
24314 			rval = EFAULT;
24315 			goto error;
24316 		}
24317 	}
24318 
24319 	rval = sd_take_ownership(dev, tkown);
24320 	mutex_enter(SD_MUTEX(un));
24321 	if (rval == 0) {
24322 		un->un_resvd_status |= SD_RESERVE;
24323 		if (tkown != NULL && tkown->reinstate_resv_delay != 0) {
24324 			sd_reinstate_resv_delay =
24325 			    tkown->reinstate_resv_delay * 1000;
24326 		} else {
24327 			sd_reinstate_resv_delay = SD_REINSTATE_RESV_DELAY;
24328 		}
24329 		/*
24330 		 * Give the scsi_watch routine interval set by
24331 		 * the MHIOCENFAILFAST ioctl precedence here.
24332 		 */
24333 		if ((un->un_resvd_status & SD_FAILFAST) == 0) {
24334 			mutex_exit(SD_MUTEX(un));
24335 			(void) sd_check_mhd(dev, sd_reinstate_resv_delay/1000);
24336 			SD_TRACE(SD_LOG_IOCTL_MHD, un,
24337 			    "sd_mhdioc_takeown : %d\n",
24338 			    sd_reinstate_resv_delay);
24339 		} else {
24340 			mutex_exit(SD_MUTEX(un));
24341 		}
24342 		(void) scsi_reset_notify(SD_ADDRESS(un), SCSI_RESET_NOTIFY,
24343 		    sd_mhd_reset_notify_cb, (caddr_t)un);
24344 	} else {
24345 		un->un_resvd_status &= ~SD_RESERVE;
24346 		mutex_exit(SD_MUTEX(un));
24347 	}
24348 
24349 error:
24350 	if (tkown != NULL) {
24351 		kmem_free(tkown, sizeof (struct mhioctkown));
24352 	}
24353 	return (rval);
24354 }
24355 
24356 
24357 /*
24358  *    Function: sd_mhdioc_release
24359  *
24360  * Description: This routine is the driver entry point for handling ioctl
24361  *		requests to release exclusive access rights to the multihost
24362  *		disk (MHIOCRELEASE).
24363  *
24364  *   Arguments: dev	- the device number
24365  *
24366  * Return Code: 0
24367  *		ENXIO
24368  */
24369 
24370 static int
24371 sd_mhdioc_release(dev_t dev)
24372 {
24373 	struct sd_lun		*un = NULL;
24374 	timeout_id_t		resvd_timeid_save;
24375 	int			resvd_status_save;
24376 	int			rval = 0;
24377 
24378 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24379 		return (ENXIO);
24380 	}
24381 
24382 	mutex_enter(SD_MUTEX(un));
24383 	resvd_status_save = un->un_resvd_status;
24384 	un->un_resvd_status &=
24385 	    ~(SD_RESERVE | SD_LOST_RESERVE | SD_WANT_RESERVE);
24386 	if (un->un_resvd_timeid) {
24387 		resvd_timeid_save = un->un_resvd_timeid;
24388 		un->un_resvd_timeid = NULL;
24389 		mutex_exit(SD_MUTEX(un));
24390 		(void) untimeout(resvd_timeid_save);
24391 	} else {
24392 		mutex_exit(SD_MUTEX(un));
24393 	}
24394 
24395 	/*
24396 	 * destroy any pending timeout thread that may be attempting to
24397 	 * reinstate reservation on this device.
24398 	 */
24399 	sd_rmv_resv_reclaim_req(dev);
24400 
24401 	if ((rval = sd_reserve_release(dev, SD_RELEASE)) == 0) {
24402 		mutex_enter(SD_MUTEX(un));
24403 		if ((un->un_mhd_token) &&
24404 		    ((un->un_resvd_status & SD_FAILFAST) == 0)) {
24405 			mutex_exit(SD_MUTEX(un));
24406 			(void) sd_check_mhd(dev, 0);
24407 		} else {
24408 			mutex_exit(SD_MUTEX(un));
24409 		}
24410 		(void) scsi_reset_notify(SD_ADDRESS(un), SCSI_RESET_CANCEL,
24411 		    sd_mhd_reset_notify_cb, (caddr_t)un);
24412 	} else {
24413 		/*
24414 		 * sd_mhd_watch_cb will restart the resvd recover timeout thread
24415 		 */
24416 		mutex_enter(SD_MUTEX(un));
24417 		un->un_resvd_status = resvd_status_save;
24418 		mutex_exit(SD_MUTEX(un));
24419 	}
24420 	return (rval);
24421 }
24422 
24423 
24424 /*
24425  *    Function: sd_mhdioc_register_devid
24426  *
24427  * Description: This routine is the driver entry point for handling ioctl
24428  *		requests to register the device id (MHIOCREREGISTERDEVID).
24429  *
24430  *		Note: The implementation for this ioctl has been updated to
24431  *		be consistent with the original PSARC case (1999/357)
24432  *		(4375899, 4241671, 4220005)
24433  *
24434  *   Arguments: dev	- the device number
24435  *
24436  * Return Code: 0
24437  *		ENXIO
24438  */
24439 
24440 static int
24441 sd_mhdioc_register_devid(dev_t dev)
24442 {
24443 	struct sd_lun	*un = NULL;
24444 	int		rval = 0;
24445 	sd_ssc_t	*ssc;
24446 
24447 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24448 		return (ENXIO);
24449 	}
24450 
24451 	ASSERT(!mutex_owned(SD_MUTEX(un)));
24452 
24453 	mutex_enter(SD_MUTEX(un));
24454 
24455 	/* If a devid already exists, de-register it */
24456 	if (un->un_devid != NULL) {
24457 		ddi_devid_unregister(SD_DEVINFO(un));
24458 		/*
24459 		 * After unregister devid, needs to free devid memory
24460 		 */
24461 		ddi_devid_free(un->un_devid);
24462 		un->un_devid = NULL;
24463 	}
24464 
24465 	/* Check for reservation conflict */
24466 	mutex_exit(SD_MUTEX(un));
24467 	ssc = sd_ssc_init(un);
24468 	rval = sd_send_scsi_TEST_UNIT_READY(ssc, 0);
24469 	mutex_enter(SD_MUTEX(un));
24470 
24471 	switch (rval) {
24472 	case 0:
24473 		sd_register_devid(ssc, SD_DEVINFO(un), SD_TARGET_IS_UNRESERVED);
24474 		break;
24475 	case EACCES:
24476 		break;
24477 	default:
24478 		rval = EIO;
24479 	}
24480 
24481 	mutex_exit(SD_MUTEX(un));
24482 	if (rval != 0) {
24483 		if (rval == EIO)
24484 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
24485 		else
24486 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
24487 	}
24488 	sd_ssc_fini(ssc);
24489 	return (rval);
24490 }
24491 
24492 
24493 /*
24494  *    Function: sd_mhdioc_inkeys
24495  *
24496  * Description: This routine is the driver entry point for handling ioctl
24497  *		requests to issue the SCSI-3 Persistent In Read Keys command
24498  *		to the device (MHIOCGRP_INKEYS).
24499  *
24500  *   Arguments: dev	- the device number
24501  *		arg	- user provided in_keys structure
24502  *		flag	- this argument is a pass through to ddi_copyxxx()
24503  *			  directly from the mode argument of ioctl().
24504  *
24505  * Return Code: code returned by sd_persistent_reservation_in_read_keys()
24506  *		ENXIO
24507  *		EFAULT
24508  */
24509 
24510 static int
24511 sd_mhdioc_inkeys(dev_t dev, caddr_t arg, int flag)
24512 {
24513 	struct sd_lun		*un;
24514 	mhioc_inkeys_t		inkeys;
24515 	int			rval = 0;
24516 
24517 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24518 		return (ENXIO);
24519 	}
24520 
24521 #ifdef _MULTI_DATAMODEL
24522 	switch (ddi_model_convert_from(flag & FMODELS)) {
24523 	case DDI_MODEL_ILP32: {
24524 		struct mhioc_inkeys32	inkeys32;
24525 
24526 		if (ddi_copyin(arg, &inkeys32,
24527 		    sizeof (struct mhioc_inkeys32), flag) != 0) {
24528 			return (EFAULT);
24529 		}
24530 		inkeys.li = (mhioc_key_list_t *)(uintptr_t)inkeys32.li;
24531 		if ((rval = sd_persistent_reservation_in_read_keys(un,
24532 		    &inkeys, flag)) != 0) {
24533 			return (rval);
24534 		}
24535 		inkeys32.generation = inkeys.generation;
24536 		if (ddi_copyout(&inkeys32, arg, sizeof (struct mhioc_inkeys32),
24537 		    flag) != 0) {
24538 			return (EFAULT);
24539 		}
24540 		break;
24541 	}
24542 	case DDI_MODEL_NONE:
24543 		if (ddi_copyin(arg, &inkeys, sizeof (mhioc_inkeys_t),
24544 		    flag) != 0) {
24545 			return (EFAULT);
24546 		}
24547 		if ((rval = sd_persistent_reservation_in_read_keys(un,
24548 		    &inkeys, flag)) != 0) {
24549 			return (rval);
24550 		}
24551 		if (ddi_copyout(&inkeys, arg, sizeof (mhioc_inkeys_t),
24552 		    flag) != 0) {
24553 			return (EFAULT);
24554 		}
24555 		break;
24556 	}
24557 
24558 #else /* ! _MULTI_DATAMODEL */
24559 
24560 	if (ddi_copyin(arg, &inkeys, sizeof (mhioc_inkeys_t), flag) != 0) {
24561 		return (EFAULT);
24562 	}
24563 	rval = sd_persistent_reservation_in_read_keys(un, &inkeys, flag);
24564 	if (rval != 0) {
24565 		return (rval);
24566 	}
24567 	if (ddi_copyout(&inkeys, arg, sizeof (mhioc_inkeys_t), flag) != 0) {
24568 		return (EFAULT);
24569 	}
24570 
24571 #endif /* _MULTI_DATAMODEL */
24572 
24573 	return (rval);
24574 }
24575 
24576 
24577 /*
24578  *    Function: sd_mhdioc_inresv
24579  *
24580  * Description: This routine is the driver entry point for handling ioctl
24581  *		requests to issue the SCSI-3 Persistent In Read Reservations
24582  *		command to the device (MHIOCGRP_INKEYS).
24583  *
24584  *   Arguments: dev	- the device number
24585  *		arg	- user provided in_resv structure
24586  *		flag	- this argument is a pass through to ddi_copyxxx()
24587  *			  directly from the mode argument of ioctl().
24588  *
24589  * Return Code: code returned by sd_persistent_reservation_in_read_resv()
24590  *		ENXIO
24591  *		EFAULT
24592  */
24593 
24594 static int
24595 sd_mhdioc_inresv(dev_t dev, caddr_t arg, int flag)
24596 {
24597 	struct sd_lun		*un;
24598 	mhioc_inresvs_t		inresvs;
24599 	int			rval = 0;
24600 
24601 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24602 		return (ENXIO);
24603 	}
24604 
24605 #ifdef _MULTI_DATAMODEL
24606 
24607 	switch (ddi_model_convert_from(flag & FMODELS)) {
24608 	case DDI_MODEL_ILP32: {
24609 		struct mhioc_inresvs32	inresvs32;
24610 
24611 		if (ddi_copyin(arg, &inresvs32,
24612 		    sizeof (struct mhioc_inresvs32), flag) != 0) {
24613 			return (EFAULT);
24614 		}
24615 		inresvs.li = (mhioc_resv_desc_list_t *)(uintptr_t)inresvs32.li;
24616 		if ((rval = sd_persistent_reservation_in_read_resv(un,
24617 		    &inresvs, flag)) != 0) {
24618 			return (rval);
24619 		}
24620 		inresvs32.generation = inresvs.generation;
24621 		if (ddi_copyout(&inresvs32, arg,
24622 		    sizeof (struct mhioc_inresvs32), flag) != 0) {
24623 			return (EFAULT);
24624 		}
24625 		break;
24626 	}
24627 	case DDI_MODEL_NONE:
24628 		if (ddi_copyin(arg, &inresvs,
24629 		    sizeof (mhioc_inresvs_t), flag) != 0) {
24630 			return (EFAULT);
24631 		}
24632 		if ((rval = sd_persistent_reservation_in_read_resv(un,
24633 		    &inresvs, flag)) != 0) {
24634 			return (rval);
24635 		}
24636 		if (ddi_copyout(&inresvs, arg,
24637 		    sizeof (mhioc_inresvs_t), flag) != 0) {
24638 			return (EFAULT);
24639 		}
24640 		break;
24641 	}
24642 
24643 #else /* ! _MULTI_DATAMODEL */
24644 
24645 	if (ddi_copyin(arg, &inresvs, sizeof (mhioc_inresvs_t), flag) != 0) {
24646 		return (EFAULT);
24647 	}
24648 	rval = sd_persistent_reservation_in_read_resv(un, &inresvs, flag);
24649 	if (rval != 0) {
24650 		return (rval);
24651 	}
24652 	if (ddi_copyout(&inresvs, arg, sizeof (mhioc_inresvs_t), flag)) {
24653 		return (EFAULT);
24654 	}
24655 
24656 #endif /* ! _MULTI_DATAMODEL */
24657 
24658 	return (rval);
24659 }
24660 
24661 
24662 /*
24663  * The following routines support the clustering functionality described below
24664  * and implement lost reservation reclaim functionality.
24665  *
24666  * Clustering
24667  * ----------
24668  * The clustering code uses two different, independent forms of SCSI
24669  * reservation. Traditional SCSI-2 Reserve/Release and the newer SCSI-3
24670  * Persistent Group Reservations. For any particular disk, it will use either
24671  * SCSI-2 or SCSI-3 PGR but never both at the same time for the same disk.
24672  *
24673  * SCSI-2
24674  * The cluster software takes ownership of a multi-hosted disk by issuing the
24675  * MHIOCTKOWN ioctl to the disk driver. It releases ownership by issuing the
24676  * MHIOCRELEASE ioctl.  Closely related is the MHIOCENFAILFAST ioctl -- a
24677  * cluster, just after taking ownership of the disk with the MHIOCTKOWN ioctl
24678  * then issues the MHIOCENFAILFAST ioctl.  This ioctl "enables failfast" in the
24679  * driver. The meaning of failfast is that if the driver (on this host) ever
24680  * encounters the scsi error return code RESERVATION_CONFLICT from the device,
24681  * it should immediately panic the host. The motivation for this ioctl is that
24682  * if this host does encounter reservation conflict, the underlying cause is
24683  * that some other host of the cluster has decided that this host is no longer
24684  * in the cluster and has seized control of the disks for itself. Since this
24685  * host is no longer in the cluster, it ought to panic itself. The
24686  * MHIOCENFAILFAST ioctl does two things:
24687  *	(a) it sets a flag that will cause any returned RESERVATION_CONFLICT
24688  *      error to panic the host
24689  *      (b) it sets up a periodic timer to test whether this host still has
24690  *      "access" (in that no other host has reserved the device):  if the
24691  *      periodic timer gets RESERVATION_CONFLICT, the host is panicked. The
24692  *      purpose of that periodic timer is to handle scenarios where the host is
24693  *      otherwise temporarily quiescent, temporarily doing no real i/o.
24694  * The MHIOCTKOWN ioctl will "break" a reservation that is held by another host,
24695  * by issuing a SCSI Bus Device Reset.  It will then issue a SCSI Reserve for
24696  * the device itself.
24697  *
24698  * SCSI-3 PGR
24699  * A direct semantic implementation of the SCSI-3 Persistent Reservation
24700  * facility is supported through the shared multihost disk ioctls
24701  * (MHIOCGRP_INKEYS, MHIOCGRP_INRESV, MHIOCGRP_REGISTER, MHIOCGRP_RESERVE,
24702  * MHIOCGRP_PREEMPTANDABORT)
24703  *
24704  * Reservation Reclaim:
24705  * --------------------
24706  * To support the lost reservation reclaim operations this driver creates a
24707  * single thread to handle reinstating reservations on all devices that have
24708  * lost reservations sd_resv_reclaim_requests are logged for all devices that
24709  * have LOST RESERVATIONS when the scsi watch facility callsback sd_mhd_watch_cb
24710  * and the reservation reclaim thread loops through the requests to regain the
24711  * lost reservations.
24712  */
24713 
24714 /*
24715  *    Function: sd_check_mhd()
24716  *
24717  * Description: This function sets up and submits a scsi watch request or
24718  *		terminates an existing watch request. This routine is used in
24719  *		support of reservation reclaim.
24720  *
24721  *   Arguments: dev    - the device 'dev_t' is used for context to discriminate
24722  *			 among multiple watches that share the callback function
24723  *		interval - the number of microseconds specifying the watch
24724  *			   interval for issuing TEST UNIT READY commands. If
24725  *			   set to 0 the watch should be terminated. If the
24726  *			   interval is set to 0 and if the device is required
24727  *			   to hold reservation while disabling failfast, the
24728  *			   watch is restarted with an interval of
24729  *			   reinstate_resv_delay.
24730  *
24731  * Return Code: 0	   - Successful submit/terminate of scsi watch request
24732  *		ENXIO      - Indicates an invalid device was specified
24733  *		EAGAIN     - Unable to submit the scsi watch request
24734  */
24735 
24736 static int
24737 sd_check_mhd(dev_t dev, int interval)
24738 {
24739 	struct sd_lun	*un;
24740 	opaque_t	token;
24741 
24742 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24743 		return (ENXIO);
24744 	}
24745 
24746 	/* is this a watch termination request? */
24747 	if (interval == 0) {
24748 		mutex_enter(SD_MUTEX(un));
24749 		/* if there is an existing watch task then terminate it */
24750 		if (un->un_mhd_token) {
24751 			token = un->un_mhd_token;
24752 			un->un_mhd_token = NULL;
24753 			mutex_exit(SD_MUTEX(un));
24754 			(void) scsi_watch_request_terminate(token,
24755 			    SCSI_WATCH_TERMINATE_ALL_WAIT);
24756 			mutex_enter(SD_MUTEX(un));
24757 		} else {
24758 			mutex_exit(SD_MUTEX(un));
24759 			/*
24760 			 * Note: If we return here we don't check for the
24761 			 * failfast case. This is the original legacy
24762 			 * implementation but perhaps we should be checking
24763 			 * the failfast case.
24764 			 */
24765 			return (0);
24766 		}
24767 		/*
24768 		 * If the device is required to hold reservation while
24769 		 * disabling failfast, we need to restart the scsi_watch
24770 		 * routine with an interval of reinstate_resv_delay.
24771 		 */
24772 		if (un->un_resvd_status & SD_RESERVE) {
24773 			interval = sd_reinstate_resv_delay/1000;
24774 		} else {
24775 			/* no failfast so bail */
24776 			mutex_exit(SD_MUTEX(un));
24777 			return (0);
24778 		}
24779 		mutex_exit(SD_MUTEX(un));
24780 	}
24781 
24782 	/*
24783 	 * adjust minimum time interval to 1 second,
24784 	 * and convert from msecs to usecs
24785 	 */
24786 	if (interval > 0 && interval < 1000) {
24787 		interval = 1000;
24788 	}
24789 	interval *= 1000;
24790 
24791 	/*
24792 	 * submit the request to the scsi_watch service
24793 	 */
24794 	token = scsi_watch_request_submit(SD_SCSI_DEVP(un), interval,
24795 	    SENSE_LENGTH, sd_mhd_watch_cb, (caddr_t)dev);
24796 	if (token == NULL) {
24797 		return (EAGAIN);
24798 	}
24799 
24800 	/*
24801 	 * save token for termination later on
24802 	 */
24803 	mutex_enter(SD_MUTEX(un));
24804 	un->un_mhd_token = token;
24805 	mutex_exit(SD_MUTEX(un));
24806 	return (0);
24807 }
24808 
24809 
24810 /*
24811  *    Function: sd_mhd_watch_cb()
24812  *
24813  * Description: This function is the call back function used by the scsi watch
24814  *		facility. The scsi watch facility sends the "Test Unit Ready"
24815  *		and processes the status. If applicable (i.e. a "Unit Attention"
24816  *		status and automatic "Request Sense" not used) the scsi watch
24817  *		facility will send a "Request Sense" and retrieve the sense data
24818  *		to be passed to this callback function. In either case the
24819  *		automatic "Request Sense" or the facility submitting one, this
24820  *		callback is passed the status and sense data.
24821  *
24822  *   Arguments: arg -   the device 'dev_t' is used for context to discriminate
24823  *			among multiple watches that share this callback function
24824  *		resultp - scsi watch facility result packet containing scsi
24825  *			  packet, status byte and sense data
24826  *
24827  * Return Code: 0 - continue the watch task
24828  *		non-zero - terminate the watch task
24829  */
24830 
24831 static int
24832 sd_mhd_watch_cb(caddr_t arg, struct scsi_watch_result *resultp)
24833 {
24834 	struct sd_lun			*un;
24835 	struct scsi_status		*statusp;
24836 	uint8_t				*sensep;
24837 	struct scsi_pkt			*pkt;
24838 	uchar_t				actual_sense_length;
24839 	dev_t  				dev = (dev_t)arg;
24840 
24841 	ASSERT(resultp != NULL);
24842 	statusp			= resultp->statusp;
24843 	sensep			= (uint8_t *)resultp->sensep;
24844 	pkt			= resultp->pkt;
24845 	actual_sense_length	= resultp->actual_sense_length;
24846 
24847 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
24848 		return (ENXIO);
24849 	}
24850 
24851 	SD_TRACE(SD_LOG_IOCTL_MHD, un,
24852 	    "sd_mhd_watch_cb: reason '%s', status '%s'\n",
24853 	    scsi_rname(pkt->pkt_reason), sd_sname(*((unsigned char *)statusp)));
24854 
24855 	/* Begin processing of the status and/or sense data */
24856 	if (pkt->pkt_reason != CMD_CMPLT) {
24857 		/* Handle the incomplete packet */
24858 		sd_mhd_watch_incomplete(un, pkt);
24859 		return (0);
24860 	} else if (*((unsigned char *)statusp) != STATUS_GOOD) {
24861 		if (*((unsigned char *)statusp)
24862 		    == STATUS_RESERVATION_CONFLICT) {
24863 			/*
24864 			 * Handle a reservation conflict by panicking if
24865 			 * configured for failfast or by logging the conflict
24866 			 * and updating the reservation status
24867 			 */
24868 			mutex_enter(SD_MUTEX(un));
24869 			if ((un->un_resvd_status & SD_FAILFAST) &&
24870 			    (sd_failfast_enable)) {
24871 				sd_panic_for_res_conflict(un);
24872 				/*NOTREACHED*/
24873 			}
24874 			SD_INFO(SD_LOG_IOCTL_MHD, un,
24875 			    "sd_mhd_watch_cb: Reservation Conflict\n");
24876 			un->un_resvd_status |= SD_RESERVATION_CONFLICT;
24877 			mutex_exit(SD_MUTEX(un));
24878 		}
24879 	}
24880 
24881 	if (sensep != NULL) {
24882 		if (actual_sense_length >= (SENSE_LENGTH - 2)) {
24883 			mutex_enter(SD_MUTEX(un));
24884 			if ((scsi_sense_asc(sensep) ==
24885 			    SD_SCSI_RESET_SENSE_CODE) &&
24886 			    (un->un_resvd_status & SD_RESERVE)) {
24887 				/*
24888 				 * The additional sense code indicates a power
24889 				 * on or bus device reset has occurred; update
24890 				 * the reservation status.
24891 				 */
24892 				un->un_resvd_status |=
24893 				    (SD_LOST_RESERVE | SD_WANT_RESERVE);
24894 				SD_INFO(SD_LOG_IOCTL_MHD, un,
24895 				    "sd_mhd_watch_cb: Lost Reservation\n");
24896 			}
24897 		} else {
24898 			return (0);
24899 		}
24900 	} else {
24901 		mutex_enter(SD_MUTEX(un));
24902 	}
24903 
24904 	if ((un->un_resvd_status & SD_RESERVE) &&
24905 	    (un->un_resvd_status & SD_LOST_RESERVE)) {
24906 		if (un->un_resvd_status & SD_WANT_RESERVE) {
24907 			/*
24908 			 * A reset occurred in between the last probe and this
24909 			 * one so if a timeout is pending cancel it.
24910 			 */
24911 			if (un->un_resvd_timeid) {
24912 				timeout_id_t temp_id = un->un_resvd_timeid;
24913 				un->un_resvd_timeid = NULL;
24914 				mutex_exit(SD_MUTEX(un));
24915 				(void) untimeout(temp_id);
24916 				mutex_enter(SD_MUTEX(un));
24917 			}
24918 			un->un_resvd_status &= ~SD_WANT_RESERVE;
24919 		}
24920 		if (un->un_resvd_timeid == 0) {
24921 			/* Schedule a timeout to handle the lost reservation */
24922 			un->un_resvd_timeid = timeout(sd_mhd_resvd_recover,
24923 			    (void *)dev,
24924 			    drv_usectohz(sd_reinstate_resv_delay));
24925 		}
24926 	}
24927 	mutex_exit(SD_MUTEX(un));
24928 	return (0);
24929 }
24930 
24931 
24932 /*
24933  *    Function: sd_mhd_watch_incomplete()
24934  *
24935  * Description: This function is used to find out why a scsi pkt sent by the
24936  *		scsi watch facility was not completed. Under some scenarios this
24937  *		routine will return. Otherwise it will send a bus reset to see
24938  *		if the drive is still online.
24939  *
24940  *   Arguments: un  - driver soft state (unit) structure
24941  *		pkt - incomplete scsi pkt
24942  */
24943 
24944 static void
24945 sd_mhd_watch_incomplete(struct sd_lun *un, struct scsi_pkt *pkt)
24946 {
24947 	int	be_chatty;
24948 	int	perr;
24949 
24950 	ASSERT(pkt != NULL);
24951 	ASSERT(un != NULL);
24952 	be_chatty	= (!(pkt->pkt_flags & FLAG_SILENT));
24953 	perr		= (pkt->pkt_statistics & STAT_PERR);
24954 
24955 	mutex_enter(SD_MUTEX(un));
24956 	if (un->un_state == SD_STATE_DUMPING) {
24957 		mutex_exit(SD_MUTEX(un));
24958 		return;
24959 	}
24960 
24961 	switch (pkt->pkt_reason) {
24962 	case CMD_UNX_BUS_FREE:
24963 		/*
24964 		 * If we had a parity error that caused the target to drop BSY*,
24965 		 * don't be chatty about it.
24966 		 */
24967 		if (perr && be_chatty) {
24968 			be_chatty = 0;
24969 		}
24970 		break;
24971 	case CMD_TAG_REJECT:
24972 		/*
24973 		 * The SCSI-2 spec states that a tag reject will be sent by the
24974 		 * target if tagged queuing is not supported. A tag reject may
24975 		 * also be sent during certain initialization periods or to
24976 		 * control internal resources. For the latter case the target
24977 		 * may also return Queue Full.
24978 		 *
24979 		 * If this driver receives a tag reject from a target that is
24980 		 * going through an init period or controlling internal
24981 		 * resources tagged queuing will be disabled. This is a less
24982 		 * than optimal behavior but the driver is unable to determine
24983 		 * the target state and assumes tagged queueing is not supported
24984 		 */
24985 		pkt->pkt_flags = 0;
24986 		un->un_tagflags = 0;
24987 
24988 		if (un->un_f_opt_queueing == TRUE) {
24989 			un->un_throttle = min(un->un_throttle, 3);
24990 		} else {
24991 			un->un_throttle = 1;
24992 		}
24993 		mutex_exit(SD_MUTEX(un));
24994 		(void) scsi_ifsetcap(SD_ADDRESS(un), "tagged-qing", 0, 1);
24995 		mutex_enter(SD_MUTEX(un));
24996 		break;
24997 	case CMD_INCOMPLETE:
24998 		/*
24999 		 * The transport stopped with an abnormal state, fallthrough and
25000 		 * reset the target and/or bus unless selection did not complete
25001 		 * (indicated by STATE_GOT_BUS) in which case we don't want to
25002 		 * go through a target/bus reset
25003 		 */
25004 		if (pkt->pkt_state == STATE_GOT_BUS) {
25005 			break;
25006 		}
25007 		/*FALLTHROUGH*/
25008 
25009 	case CMD_TIMEOUT:
25010 	default:
25011 		/*
25012 		 * The lun may still be running the command, so a lun reset
25013 		 * should be attempted. If the lun reset fails or cannot be
25014 		 * issued, than try a target reset. Lastly try a bus reset.
25015 		 */
25016 		if ((pkt->pkt_statistics &
25017 		    (STAT_BUS_RESET|STAT_DEV_RESET|STAT_ABORTED)) == 0) {
25018 			int reset_retval = 0;
25019 			mutex_exit(SD_MUTEX(un));
25020 			if (un->un_f_allow_bus_device_reset == TRUE) {
25021 				if (un->un_f_lun_reset_enabled == TRUE) {
25022 					reset_retval =
25023 					    scsi_reset(SD_ADDRESS(un),
25024 					    RESET_LUN);
25025 				}
25026 				if (reset_retval == 0) {
25027 					reset_retval =
25028 					    scsi_reset(SD_ADDRESS(un),
25029 					    RESET_TARGET);
25030 				}
25031 			}
25032 			if (reset_retval == 0) {
25033 				(void) scsi_reset(SD_ADDRESS(un), RESET_ALL);
25034 			}
25035 			mutex_enter(SD_MUTEX(un));
25036 		}
25037 		break;
25038 	}
25039 
25040 	/* A device/bus reset has occurred; update the reservation status. */
25041 	if ((pkt->pkt_reason == CMD_RESET) || (pkt->pkt_statistics &
25042 	    (STAT_BUS_RESET | STAT_DEV_RESET))) {
25043 		if ((un->un_resvd_status & SD_RESERVE) == SD_RESERVE) {
25044 			un->un_resvd_status |=
25045 			    (SD_LOST_RESERVE | SD_WANT_RESERVE);
25046 			SD_INFO(SD_LOG_IOCTL_MHD, un,
25047 			    "sd_mhd_watch_incomplete: Lost Reservation\n");
25048 		}
25049 	}
25050 
25051 	/*
25052 	 * The disk has been turned off; Update the device state.
25053 	 *
25054 	 * Note: Should we be offlining the disk here?
25055 	 */
25056 	if (pkt->pkt_state == STATE_GOT_BUS) {
25057 		SD_INFO(SD_LOG_IOCTL_MHD, un, "sd_mhd_watch_incomplete: "
25058 		    "Disk not responding to selection\n");
25059 		if (un->un_state != SD_STATE_OFFLINE) {
25060 			New_state(un, SD_STATE_OFFLINE);
25061 		}
25062 	} else if (be_chatty) {
25063 		/*
25064 		 * suppress messages if they are all the same pkt reason;
25065 		 * with TQ, many (up to 256) are returned with the same
25066 		 * pkt_reason
25067 		 */
25068 		if (pkt->pkt_reason != un->un_last_pkt_reason) {
25069 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
25070 			    "sd_mhd_watch_incomplete: "
25071 			    "SCSI transport failed: reason '%s'\n",
25072 			    scsi_rname(pkt->pkt_reason));
25073 		}
25074 	}
25075 	un->un_last_pkt_reason = pkt->pkt_reason;
25076 	mutex_exit(SD_MUTEX(un));
25077 }
25078 
25079 
25080 /*
25081  *    Function: sd_sname()
25082  *
25083  * Description: This is a simple little routine to return a string containing
25084  *		a printable description of command status byte for use in
25085  *		logging.
25086  *
25087  *   Arguments: status - pointer to a status byte
25088  *
25089  * Return Code: char * - string containing status description.
25090  */
25091 
25092 static char *
25093 sd_sname(uchar_t status)
25094 {
25095 	switch (status & STATUS_MASK) {
25096 	case STATUS_GOOD:
25097 		return ("good status");
25098 	case STATUS_CHECK:
25099 		return ("check condition");
25100 	case STATUS_MET:
25101 		return ("condition met");
25102 	case STATUS_BUSY:
25103 		return ("busy");
25104 	case STATUS_INTERMEDIATE:
25105 		return ("intermediate");
25106 	case STATUS_INTERMEDIATE_MET:
25107 		return ("intermediate - condition met");
25108 	case STATUS_RESERVATION_CONFLICT:
25109 		return ("reservation_conflict");
25110 	case STATUS_TERMINATED:
25111 		return ("command terminated");
25112 	case STATUS_QFULL:
25113 		return ("queue full");
25114 	default:
25115 		return ("<unknown status>");
25116 	}
25117 }
25118 
25119 
25120 /*
25121  *    Function: sd_mhd_resvd_recover()
25122  *
25123  * Description: This function adds a reservation entry to the
25124  *		sd_resv_reclaim_request list and signals the reservation
25125  *		reclaim thread that there is work pending. If the reservation
25126  *		reclaim thread has not been previously created this function
25127  *		will kick it off.
25128  *
25129  *   Arguments: arg -   the device 'dev_t' is used for context to discriminate
25130  *			among multiple watches that share this callback function
25131  *
25132  *     Context: This routine is called by timeout() and is run in interrupt
25133  *		context. It must not sleep or call other functions which may
25134  *		sleep.
25135  */
25136 
25137 static void
25138 sd_mhd_resvd_recover(void *arg)
25139 {
25140 	dev_t			dev = (dev_t)arg;
25141 	struct sd_lun		*un;
25142 	struct sd_thr_request	*sd_treq = NULL;
25143 	struct sd_thr_request	*sd_cur = NULL;
25144 	struct sd_thr_request	*sd_prev = NULL;
25145 	int			already_there = 0;
25146 
25147 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25148 		return;
25149 	}
25150 
25151 	mutex_enter(SD_MUTEX(un));
25152 	un->un_resvd_timeid = NULL;
25153 	if (un->un_resvd_status & SD_WANT_RESERVE) {
25154 		/*
25155 		 * There was a reset so don't issue the reserve, allow the
25156 		 * sd_mhd_watch_cb callback function to notice this and
25157 		 * reschedule the timeout for reservation.
25158 		 */
25159 		mutex_exit(SD_MUTEX(un));
25160 		return;
25161 	}
25162 	mutex_exit(SD_MUTEX(un));
25163 
25164 	/*
25165 	 * Add this device to the sd_resv_reclaim_request list and the
25166 	 * sd_resv_reclaim_thread should take care of the rest.
25167 	 *
25168 	 * Note: We can't sleep in this context so if the memory allocation
25169 	 * fails allow the sd_mhd_watch_cb callback function to notice this and
25170 	 * reschedule the timeout for reservation.  (4378460)
25171 	 */
25172 	sd_treq = (struct sd_thr_request *)
25173 	    kmem_zalloc(sizeof (struct sd_thr_request), KM_NOSLEEP);
25174 	if (sd_treq == NULL) {
25175 		return;
25176 	}
25177 
25178 	sd_treq->sd_thr_req_next = NULL;
25179 	sd_treq->dev = dev;
25180 	mutex_enter(&sd_tr.srq_resv_reclaim_mutex);
25181 	if (sd_tr.srq_thr_req_head == NULL) {
25182 		sd_tr.srq_thr_req_head = sd_treq;
25183 	} else {
25184 		sd_cur = sd_prev = sd_tr.srq_thr_req_head;
25185 		for (; sd_cur != NULL; sd_cur = sd_cur->sd_thr_req_next) {
25186 			if (sd_cur->dev == dev) {
25187 				/*
25188 				 * already in Queue so don't log
25189 				 * another request for the device
25190 				 */
25191 				already_there = 1;
25192 				break;
25193 			}
25194 			sd_prev = sd_cur;
25195 		}
25196 		if (!already_there) {
25197 			SD_INFO(SD_LOG_IOCTL_MHD, un, "sd_mhd_resvd_recover: "
25198 			    "logging request for %lx\n", dev);
25199 			sd_prev->sd_thr_req_next = sd_treq;
25200 		} else {
25201 			kmem_free(sd_treq, sizeof (struct sd_thr_request));
25202 		}
25203 	}
25204 
25205 	/*
25206 	 * Create a kernel thread to do the reservation reclaim and free up this
25207 	 * thread. We cannot block this thread while we go away to do the
25208 	 * reservation reclaim
25209 	 */
25210 	if (sd_tr.srq_resv_reclaim_thread == NULL)
25211 		sd_tr.srq_resv_reclaim_thread = thread_create(NULL, 0,
25212 		    sd_resv_reclaim_thread, NULL,
25213 		    0, &p0, TS_RUN, v.v_maxsyspri - 2);
25214 
25215 	/* Tell the reservation reclaim thread that it has work to do */
25216 	cv_signal(&sd_tr.srq_resv_reclaim_cv);
25217 	mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25218 }
25219 
25220 /*
25221  *    Function: sd_resv_reclaim_thread()
25222  *
25223  * Description: This function implements the reservation reclaim operations
25224  *
25225  *   Arguments: arg - the device 'dev_t' is used for context to discriminate
25226  *		      among multiple watches that share this callback function
25227  */
25228 
25229 static void
25230 sd_resv_reclaim_thread()
25231 {
25232 	struct sd_lun		*un;
25233 	struct sd_thr_request	*sd_mhreq;
25234 
25235 	/* Wait for work */
25236 	mutex_enter(&sd_tr.srq_resv_reclaim_mutex);
25237 	if (sd_tr.srq_thr_req_head == NULL) {
25238 		cv_wait(&sd_tr.srq_resv_reclaim_cv,
25239 		    &sd_tr.srq_resv_reclaim_mutex);
25240 	}
25241 
25242 	/* Loop while we have work */
25243 	while ((sd_tr.srq_thr_cur_req = sd_tr.srq_thr_req_head) != NULL) {
25244 		un = ddi_get_soft_state(sd_state,
25245 		    SDUNIT(sd_tr.srq_thr_cur_req->dev));
25246 		if (un == NULL) {
25247 			/*
25248 			 * softstate structure is NULL so just
25249 			 * dequeue the request and continue
25250 			 */
25251 			sd_tr.srq_thr_req_head =
25252 			    sd_tr.srq_thr_cur_req->sd_thr_req_next;
25253 			kmem_free(sd_tr.srq_thr_cur_req,
25254 			    sizeof (struct sd_thr_request));
25255 			continue;
25256 		}
25257 
25258 		/* dequeue the request */
25259 		sd_mhreq = sd_tr.srq_thr_cur_req;
25260 		sd_tr.srq_thr_req_head =
25261 		    sd_tr.srq_thr_cur_req->sd_thr_req_next;
25262 		mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25263 
25264 		/*
25265 		 * Reclaim reservation only if SD_RESERVE is still set. There
25266 		 * may have been a call to MHIOCRELEASE before we got here.
25267 		 */
25268 		mutex_enter(SD_MUTEX(un));
25269 		if ((un->un_resvd_status & SD_RESERVE) == SD_RESERVE) {
25270 			/*
25271 			 * Note: The SD_LOST_RESERVE flag is cleared before
25272 			 * reclaiming the reservation. If this is done after the
25273 			 * call to sd_reserve_release a reservation loss in the
25274 			 * window between pkt completion of reserve cmd and
25275 			 * mutex_enter below may not be recognized
25276 			 */
25277 			un->un_resvd_status &= ~SD_LOST_RESERVE;
25278 			mutex_exit(SD_MUTEX(un));
25279 
25280 			if (sd_reserve_release(sd_mhreq->dev,
25281 			    SD_RESERVE) == 0) {
25282 				mutex_enter(SD_MUTEX(un));
25283 				un->un_resvd_status |= SD_RESERVE;
25284 				mutex_exit(SD_MUTEX(un));
25285 				SD_INFO(SD_LOG_IOCTL_MHD, un,
25286 				    "sd_resv_reclaim_thread: "
25287 				    "Reservation Recovered\n");
25288 			} else {
25289 				mutex_enter(SD_MUTEX(un));
25290 				un->un_resvd_status |= SD_LOST_RESERVE;
25291 				mutex_exit(SD_MUTEX(un));
25292 				SD_INFO(SD_LOG_IOCTL_MHD, un,
25293 				    "sd_resv_reclaim_thread: Failed "
25294 				    "Reservation Recovery\n");
25295 			}
25296 		} else {
25297 			mutex_exit(SD_MUTEX(un));
25298 		}
25299 		mutex_enter(&sd_tr.srq_resv_reclaim_mutex);
25300 		ASSERT(sd_mhreq == sd_tr.srq_thr_cur_req);
25301 		kmem_free(sd_mhreq, sizeof (struct sd_thr_request));
25302 		sd_mhreq = sd_tr.srq_thr_cur_req = NULL;
25303 		/*
25304 		 * wakeup the destroy thread if anyone is waiting on
25305 		 * us to complete.
25306 		 */
25307 		cv_signal(&sd_tr.srq_inprocess_cv);
25308 		SD_TRACE(SD_LOG_IOCTL_MHD, un,
25309 		    "sd_resv_reclaim_thread: cv_signalling current request \n");
25310 	}
25311 
25312 	/*
25313 	 * cleanup the sd_tr structure now that this thread will not exist
25314 	 */
25315 	ASSERT(sd_tr.srq_thr_req_head == NULL);
25316 	ASSERT(sd_tr.srq_thr_cur_req == NULL);
25317 	sd_tr.srq_resv_reclaim_thread = NULL;
25318 	mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25319 	thread_exit();
25320 }
25321 
25322 
25323 /*
25324  *    Function: sd_rmv_resv_reclaim_req()
25325  *
25326  * Description: This function removes any pending reservation reclaim requests
25327  *		for the specified device.
25328  *
25329  *   Arguments: dev - the device 'dev_t'
25330  */
25331 
25332 static void
25333 sd_rmv_resv_reclaim_req(dev_t dev)
25334 {
25335 	struct sd_thr_request *sd_mhreq;
25336 	struct sd_thr_request *sd_prev;
25337 
25338 	/* Remove a reservation reclaim request from the list */
25339 	mutex_enter(&sd_tr.srq_resv_reclaim_mutex);
25340 	if (sd_tr.srq_thr_cur_req && sd_tr.srq_thr_cur_req->dev == dev) {
25341 		/*
25342 		 * We are attempting to reinstate reservation for
25343 		 * this device. We wait for sd_reserve_release()
25344 		 * to return before we return.
25345 		 */
25346 		cv_wait(&sd_tr.srq_inprocess_cv,
25347 		    &sd_tr.srq_resv_reclaim_mutex);
25348 	} else {
25349 		sd_prev = sd_mhreq = sd_tr.srq_thr_req_head;
25350 		if (sd_mhreq && sd_mhreq->dev == dev) {
25351 			sd_tr.srq_thr_req_head = sd_mhreq->sd_thr_req_next;
25352 			kmem_free(sd_mhreq, sizeof (struct sd_thr_request));
25353 			mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25354 			return;
25355 		}
25356 		for (; sd_mhreq != NULL; sd_mhreq = sd_mhreq->sd_thr_req_next) {
25357 			if (sd_mhreq && sd_mhreq->dev == dev) {
25358 				break;
25359 			}
25360 			sd_prev = sd_mhreq;
25361 		}
25362 		if (sd_mhreq != NULL) {
25363 			sd_prev->sd_thr_req_next = sd_mhreq->sd_thr_req_next;
25364 			kmem_free(sd_mhreq, sizeof (struct sd_thr_request));
25365 		}
25366 	}
25367 	mutex_exit(&sd_tr.srq_resv_reclaim_mutex);
25368 }
25369 
25370 
25371 /*
25372  *    Function: sd_mhd_reset_notify_cb()
25373  *
25374  * Description: This is a call back function for scsi_reset_notify. This
25375  *		function updates the softstate reserved status and logs the
25376  *		reset. The driver scsi watch facility callback function
25377  *		(sd_mhd_watch_cb) and reservation reclaim thread functionality
25378  *		will reclaim the reservation.
25379  *
25380  *   Arguments: arg  - driver soft state (unit) structure
25381  */
25382 
25383 static void
25384 sd_mhd_reset_notify_cb(caddr_t arg)
25385 {
25386 	struct sd_lun *un = (struct sd_lun *)arg;
25387 
25388 	mutex_enter(SD_MUTEX(un));
25389 	if ((un->un_resvd_status & SD_RESERVE) == SD_RESERVE) {
25390 		un->un_resvd_status |= (SD_LOST_RESERVE | SD_WANT_RESERVE);
25391 		SD_INFO(SD_LOG_IOCTL_MHD, un,
25392 		    "sd_mhd_reset_notify_cb: Lost Reservation\n");
25393 	}
25394 	mutex_exit(SD_MUTEX(un));
25395 }
25396 
25397 
25398 /*
25399  *    Function: sd_take_ownership()
25400  *
25401  * Description: This routine implements an algorithm to achieve a stable
25402  *		reservation on disks which don't implement priority reserve,
25403  *		and makes sure that other host lose re-reservation attempts.
25404  *		This algorithm contains of a loop that keeps issuing the RESERVE
25405  *		for some period of time (min_ownership_delay, default 6 seconds)
25406  *		During that loop, it looks to see if there has been a bus device
25407  *		reset or bus reset (both of which cause an existing reservation
25408  *		to be lost). If the reservation is lost issue RESERVE until a
25409  *		period of min_ownership_delay with no resets has gone by, or
25410  *		until max_ownership_delay has expired. This loop ensures that
25411  *		the host really did manage to reserve the device, in spite of
25412  *		resets. The looping for min_ownership_delay (default six
25413  *		seconds) is important to early generation clustering products,
25414  *		Solstice HA 1.x and Sun Cluster 2.x. Those products use an
25415  *		MHIOCENFAILFAST periodic timer of two seconds. By having
25416  *		MHIOCTKOWN issue Reserves in a loop for six seconds, and having
25417  *		MHIOCENFAILFAST poll every two seconds, the idea is that by the
25418  *		time the MHIOCTKOWN ioctl returns, the other host (if any) will
25419  *		have already noticed, via the MHIOCENFAILFAST polling, that it
25420  *		no longer "owns" the disk and will have panicked itself.  Thus,
25421  *		the host issuing the MHIOCTKOWN is assured (with timing
25422  *		dependencies) that by the time it actually starts to use the
25423  *		disk for real work, the old owner is no longer accessing it.
25424  *
25425  *		min_ownership_delay is the minimum amount of time for which the
25426  *		disk must be reserved continuously devoid of resets before the
25427  *		MHIOCTKOWN ioctl will return success.
25428  *
25429  *		max_ownership_delay indicates the amount of time by which the
25430  *		take ownership should succeed or timeout with an error.
25431  *
25432  *   Arguments: dev - the device 'dev_t'
25433  *		*p  - struct containing timing info.
25434  *
25435  * Return Code: 0 for success or error code
25436  */
25437 
25438 static int
25439 sd_take_ownership(dev_t dev, struct mhioctkown *p)
25440 {
25441 	struct sd_lun	*un;
25442 	int		rval;
25443 	int		err;
25444 	int		reservation_count   = 0;
25445 	int		min_ownership_delay =  6000000; /* in usec */
25446 	int		max_ownership_delay = 30000000; /* in usec */
25447 	clock_t		start_time;	/* starting time of this algorithm */
25448 	clock_t		end_time;	/* time limit for giving up */
25449 	clock_t		ownership_time;	/* time limit for stable ownership */
25450 	clock_t		current_time;
25451 	clock_t		previous_current_time;
25452 
25453 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25454 		return (ENXIO);
25455 	}
25456 
25457 	/*
25458 	 * Attempt a device reservation. A priority reservation is requested.
25459 	 */
25460 	if ((rval = sd_reserve_release(dev, SD_PRIORITY_RESERVE))
25461 	    != SD_SUCCESS) {
25462 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
25463 		    "sd_take_ownership: return(1)=%d\n", rval);
25464 		return (rval);
25465 	}
25466 
25467 	/* Update the softstate reserved status to indicate the reservation */
25468 	mutex_enter(SD_MUTEX(un));
25469 	un->un_resvd_status |= SD_RESERVE;
25470 	un->un_resvd_status &=
25471 	    ~(SD_LOST_RESERVE | SD_WANT_RESERVE | SD_RESERVATION_CONFLICT);
25472 	mutex_exit(SD_MUTEX(un));
25473 
25474 	if (p != NULL) {
25475 		if (p->min_ownership_delay != 0) {
25476 			min_ownership_delay = p->min_ownership_delay * 1000;
25477 		}
25478 		if (p->max_ownership_delay != 0) {
25479 			max_ownership_delay = p->max_ownership_delay * 1000;
25480 		}
25481 	}
25482 	SD_INFO(SD_LOG_IOCTL_MHD, un,
25483 	    "sd_take_ownership: min, max delays: %d, %d\n",
25484 	    min_ownership_delay, max_ownership_delay);
25485 
25486 	start_time = ddi_get_lbolt();
25487 	current_time	= start_time;
25488 	ownership_time	= current_time + drv_usectohz(min_ownership_delay);
25489 	end_time	= start_time + drv_usectohz(max_ownership_delay);
25490 
25491 	while (current_time - end_time < 0) {
25492 		delay(drv_usectohz(500000));
25493 
25494 		if ((err = sd_reserve_release(dev, SD_RESERVE)) != 0) {
25495 			if ((sd_reserve_release(dev, SD_RESERVE)) != 0) {
25496 				mutex_enter(SD_MUTEX(un));
25497 				rval = (un->un_resvd_status &
25498 				    SD_RESERVATION_CONFLICT) ? EACCES : EIO;
25499 				mutex_exit(SD_MUTEX(un));
25500 				break;
25501 			}
25502 		}
25503 		previous_current_time = current_time;
25504 		current_time = ddi_get_lbolt();
25505 		mutex_enter(SD_MUTEX(un));
25506 		if (err || (un->un_resvd_status & SD_LOST_RESERVE)) {
25507 			ownership_time = ddi_get_lbolt() +
25508 			    drv_usectohz(min_ownership_delay);
25509 			reservation_count = 0;
25510 		} else {
25511 			reservation_count++;
25512 		}
25513 		un->un_resvd_status |= SD_RESERVE;
25514 		un->un_resvd_status &= ~(SD_LOST_RESERVE | SD_WANT_RESERVE);
25515 		mutex_exit(SD_MUTEX(un));
25516 
25517 		SD_INFO(SD_LOG_IOCTL_MHD, un,
25518 		    "sd_take_ownership: ticks for loop iteration=%ld, "
25519 		    "reservation=%s\n", (current_time - previous_current_time),
25520 		    reservation_count ? "ok" : "reclaimed");
25521 
25522 		if (current_time - ownership_time >= 0 &&
25523 		    reservation_count >= 4) {
25524 			rval = 0; /* Achieved a stable ownership */
25525 			break;
25526 		}
25527 		if (current_time - end_time >= 0) {
25528 			rval = EACCES; /* No ownership in max possible time */
25529 			break;
25530 		}
25531 	}
25532 	SD_TRACE(SD_LOG_IOCTL_MHD, un,
25533 	    "sd_take_ownership: return(2)=%d\n", rval);
25534 	return (rval);
25535 }
25536 
25537 
25538 /*
25539  *    Function: sd_reserve_release()
25540  *
25541  * Description: This function builds and sends scsi RESERVE, RELEASE, and
25542  *		PRIORITY RESERVE commands based on a user specified command type
25543  *
25544  *   Arguments: dev - the device 'dev_t'
25545  *		cmd - user specified command type; one of SD_PRIORITY_RESERVE,
25546  *		      SD_RESERVE, SD_RELEASE
25547  *
25548  * Return Code: 0 or Error Code
25549  */
25550 
25551 static int
25552 sd_reserve_release(dev_t dev, int cmd)
25553 {
25554 	struct uscsi_cmd	*com = NULL;
25555 	struct sd_lun		*un = NULL;
25556 	char			cdb[CDB_GROUP0];
25557 	int			rval;
25558 
25559 	ASSERT((cmd == SD_RELEASE) || (cmd == SD_RESERVE) ||
25560 	    (cmd == SD_PRIORITY_RESERVE));
25561 
25562 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
25563 		return (ENXIO);
25564 	}
25565 
25566 	/* instantiate and initialize the command and cdb */
25567 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
25568 	bzero(cdb, CDB_GROUP0);
25569 	com->uscsi_flags   = USCSI_SILENT;
25570 	com->uscsi_timeout = un->un_reserve_release_time;
25571 	com->uscsi_cdblen  = CDB_GROUP0;
25572 	com->uscsi_cdb	   = cdb;
25573 	if (cmd == SD_RELEASE) {
25574 		cdb[0] = SCMD_RELEASE;
25575 	} else {
25576 		cdb[0] = SCMD_RESERVE;
25577 	}
25578 
25579 	/* Send the command. */
25580 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
25581 	    SD_PATH_STANDARD);
25582 
25583 	/*
25584 	 * "break" a reservation that is held by another host, by issuing a
25585 	 * reset if priority reserve is desired, and we could not get the
25586 	 * device.
25587 	 */
25588 	if ((cmd == SD_PRIORITY_RESERVE) &&
25589 	    (rval != 0) && (com->uscsi_status == STATUS_RESERVATION_CONFLICT)) {
25590 		/*
25591 		 * First try to reset the LUN. If we cannot, then try a target
25592 		 * reset, followed by a bus reset if the target reset fails.
25593 		 */
25594 		int reset_retval = 0;
25595 		if (un->un_f_lun_reset_enabled == TRUE) {
25596 			reset_retval = scsi_reset(SD_ADDRESS(un), RESET_LUN);
25597 		}
25598 		if (reset_retval == 0) {
25599 			/* The LUN reset either failed or was not issued */
25600 			reset_retval = scsi_reset(SD_ADDRESS(un), RESET_TARGET);
25601 		}
25602 		if ((reset_retval == 0) &&
25603 		    (scsi_reset(SD_ADDRESS(un), RESET_ALL) == 0)) {
25604 			rval = EIO;
25605 			kmem_free(com, sizeof (*com));
25606 			return (rval);
25607 		}
25608 
25609 		bzero(com, sizeof (struct uscsi_cmd));
25610 		com->uscsi_flags   = USCSI_SILENT;
25611 		com->uscsi_cdb	   = cdb;
25612 		com->uscsi_cdblen  = CDB_GROUP0;
25613 		com->uscsi_timeout = 5;
25614 
25615 		/*
25616 		 * Reissue the last reserve command, this time without request
25617 		 * sense.  Assume that it is just a regular reserve command.
25618 		 */
25619 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
25620 		    SD_PATH_STANDARD);
25621 	}
25622 
25623 	/* Return an error if still getting a reservation conflict. */
25624 	if ((rval != 0) && (com->uscsi_status == STATUS_RESERVATION_CONFLICT)) {
25625 		rval = EACCES;
25626 	}
25627 
25628 	kmem_free(com, sizeof (*com));
25629 	return (rval);
25630 }
25631 
25632 
25633 #define	SD_NDUMP_RETRIES	12
25634 /*
25635  *	System Crash Dump routine
25636  */
25637 
25638 static int
25639 sddump(dev_t dev, caddr_t addr, daddr_t blkno, int nblk)
25640 {
25641 	int		instance;
25642 	int		partition;
25643 	int		i;
25644 	int		err;
25645 	struct sd_lun	*un;
25646 	struct scsi_pkt *wr_pktp;
25647 	struct buf	*wr_bp;
25648 	struct buf	wr_buf;
25649 	daddr_t		tgt_byte_offset; /* rmw - byte offset for target */
25650 	daddr_t		tgt_blkno;	/* rmw - blkno for target */
25651 	size_t		tgt_byte_count; /* rmw -  # of bytes to xfer */
25652 	size_t		tgt_nblk; /* rmw -  # of tgt blks to xfer */
25653 	size_t		io_start_offset;
25654 	int		doing_rmw = FALSE;
25655 	int		rval;
25656 	ssize_t		dma_resid;
25657 	daddr_t		oblkno;
25658 	diskaddr_t	nblks = 0;
25659 	diskaddr_t	start_block;
25660 
25661 	instance = SDUNIT(dev);
25662 	if (((un = ddi_get_soft_state(sd_state, instance)) == NULL) ||
25663 	    !SD_IS_VALID_LABEL(un) || ISCD(un)) {
25664 		return (ENXIO);
25665 	}
25666 
25667 	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*un))
25668 
25669 	SD_TRACE(SD_LOG_DUMP, un, "sddump: entry\n");
25670 
25671 	partition = SDPART(dev);
25672 	SD_INFO(SD_LOG_DUMP, un, "sddump: partition = %d\n", partition);
25673 
25674 	if (!(NOT_DEVBSIZE(un))) {
25675 		int secmask = 0;
25676 		int blknomask = 0;
25677 
25678 		blknomask = (un->un_tgt_blocksize / DEV_BSIZE) - 1;
25679 		secmask = un->un_tgt_blocksize - 1;
25680 
25681 		if (blkno & blknomask) {
25682 			SD_TRACE(SD_LOG_DUMP, un,
25683 			    "sddump: dump start block not modulo %d\n",
25684 			    un->un_tgt_blocksize);
25685 			return (EINVAL);
25686 		}
25687 
25688 		if ((nblk * DEV_BSIZE) & secmask) {
25689 			SD_TRACE(SD_LOG_DUMP, un,
25690 			    "sddump: dump length not modulo %d\n",
25691 			    un->un_tgt_blocksize);
25692 			return (EINVAL);
25693 		}
25694 
25695 	}
25696 
25697 	/* Validate blocks to dump at against partition size. */
25698 
25699 	(void) cmlb_partinfo(un->un_cmlbhandle, partition,
25700 	    &nblks, &start_block, NULL, NULL, (void *)SD_PATH_DIRECT);
25701 
25702 	if (NOT_DEVBSIZE(un)) {
25703 		if ((blkno + nblk) > nblks) {
25704 			SD_TRACE(SD_LOG_DUMP, un,
25705 			    "sddump: dump range larger than partition: "
25706 			    "blkno = 0x%x, nblk = 0x%x, dkl_nblk = 0x%x\n",
25707 			    blkno, nblk, nblks);
25708 			return (EINVAL);
25709 		}
25710 	} else {
25711 		if (((blkno / (un->un_tgt_blocksize / DEV_BSIZE)) +
25712 		    (nblk / (un->un_tgt_blocksize / DEV_BSIZE))) > nblks) {
25713 			SD_TRACE(SD_LOG_DUMP, un,
25714 			    "sddump: dump range larger than partition: "
25715 			    "blkno = 0x%x, nblk = 0x%x, dkl_nblk = 0x%x\n",
25716 			    blkno, nblk, nblks);
25717 			return (EINVAL);
25718 		}
25719 	}
25720 
25721 	mutex_enter(&un->un_pm_mutex);
25722 	if (SD_DEVICE_IS_IN_LOW_POWER(un)) {
25723 		struct scsi_pkt *start_pktp;
25724 
25725 		mutex_exit(&un->un_pm_mutex);
25726 
25727 		/*
25728 		 * use pm framework to power on HBA 1st
25729 		 */
25730 		(void) pm_raise_power(SD_DEVINFO(un), 0,
25731 		    SD_PM_STATE_ACTIVE(un));
25732 
25733 		/*
25734 		 * Dump no long uses sdpower to power on a device, it's
25735 		 * in-line here so it can be done in polled mode.
25736 		 */
25737 
25738 		SD_INFO(SD_LOG_DUMP, un, "sddump: starting device\n");
25739 
25740 		start_pktp = scsi_init_pkt(SD_ADDRESS(un), NULL, NULL,
25741 		    CDB_GROUP0, un->un_status_len, 0, 0, NULL_FUNC, NULL);
25742 
25743 		if (start_pktp == NULL) {
25744 			/* We were not given a SCSI packet, fail. */
25745 			return (EIO);
25746 		}
25747 		bzero(start_pktp->pkt_cdbp, CDB_GROUP0);
25748 		start_pktp->pkt_cdbp[0] = SCMD_START_STOP;
25749 		start_pktp->pkt_cdbp[4] = SD_TARGET_START;
25750 		start_pktp->pkt_flags = FLAG_NOINTR;
25751 
25752 		mutex_enter(SD_MUTEX(un));
25753 		SD_FILL_SCSI1_LUN(un, start_pktp);
25754 		mutex_exit(SD_MUTEX(un));
25755 		/*
25756 		 * Scsi_poll returns 0 (success) if the command completes and
25757 		 * the status block is STATUS_GOOD.
25758 		 */
25759 		if (sd_scsi_poll(un, start_pktp) != 0) {
25760 			scsi_destroy_pkt(start_pktp);
25761 			return (EIO);
25762 		}
25763 		scsi_destroy_pkt(start_pktp);
25764 		(void) sd_pm_state_change(un, SD_PM_STATE_ACTIVE(un),
25765 		    SD_PM_STATE_CHANGE);
25766 	} else {
25767 		mutex_exit(&un->un_pm_mutex);
25768 	}
25769 
25770 	mutex_enter(SD_MUTEX(un));
25771 	un->un_throttle = 0;
25772 
25773 	/*
25774 	 * The first time through, reset the specific target device.
25775 	 * However, when cpr calls sddump we know that sd is in a
25776 	 * a good state so no bus reset is required.
25777 	 * Clear sense data via Request Sense cmd.
25778 	 * In sddump we don't care about allow_bus_device_reset anymore
25779 	 */
25780 
25781 	if ((un->un_state != SD_STATE_SUSPENDED) &&
25782 	    (un->un_state != SD_STATE_DUMPING)) {
25783 
25784 		New_state(un, SD_STATE_DUMPING);
25785 
25786 		if (un->un_f_is_fibre == FALSE) {
25787 			mutex_exit(SD_MUTEX(un));
25788 			/*
25789 			 * Attempt a bus reset for parallel scsi.
25790 			 *
25791 			 * Note: A bus reset is required because on some host
25792 			 * systems (i.e. E420R) a bus device reset is
25793 			 * insufficient to reset the state of the target.
25794 			 *
25795 			 * Note: Don't issue the reset for fibre-channel,
25796 			 * because this tends to hang the bus (loop) for
25797 			 * too long while everyone is logging out and in
25798 			 * and the deadman timer for dumping will fire
25799 			 * before the dump is complete.
25800 			 */
25801 			if (scsi_reset(SD_ADDRESS(un), RESET_ALL) == 0) {
25802 				mutex_enter(SD_MUTEX(un));
25803 				Restore_state(un);
25804 				mutex_exit(SD_MUTEX(un));
25805 				return (EIO);
25806 			}
25807 
25808 			/* Delay to give the device some recovery time. */
25809 			drv_usecwait(10000);
25810 
25811 			if (sd_send_polled_RQS(un) == SD_FAILURE) {
25812 				SD_INFO(SD_LOG_DUMP, un,
25813 				    "sddump: sd_send_polled_RQS failed\n");
25814 			}
25815 			mutex_enter(SD_MUTEX(un));
25816 		}
25817 	}
25818 
25819 	/*
25820 	 * Convert the partition-relative block number to a
25821 	 * disk physical block number.
25822 	 */
25823 	if (NOT_DEVBSIZE(un)) {
25824 		blkno += start_block;
25825 	} else {
25826 		blkno = blkno / (un->un_tgt_blocksize / DEV_BSIZE);
25827 		blkno += start_block;
25828 	}
25829 
25830 	SD_INFO(SD_LOG_DUMP, un, "sddump: disk blkno = 0x%x\n", blkno);
25831 
25832 
25833 	/*
25834 	 * Check if the device has a non-512 block size.
25835 	 */
25836 	wr_bp = NULL;
25837 	if (NOT_DEVBSIZE(un)) {
25838 		tgt_byte_offset = blkno * un->un_sys_blocksize;
25839 		tgt_byte_count = nblk * un->un_sys_blocksize;
25840 		if ((tgt_byte_offset % un->un_tgt_blocksize) ||
25841 		    (tgt_byte_count % un->un_tgt_blocksize)) {
25842 			doing_rmw = TRUE;
25843 			/*
25844 			 * Calculate the block number and number of block
25845 			 * in terms of the media block size.
25846 			 */
25847 			tgt_blkno = tgt_byte_offset / un->un_tgt_blocksize;
25848 			tgt_nblk =
25849 			    ((tgt_byte_offset + tgt_byte_count +
25850 			    (un->un_tgt_blocksize - 1)) /
25851 			    un->un_tgt_blocksize) - tgt_blkno;
25852 
25853 			/*
25854 			 * Invoke the routine which is going to do read part
25855 			 * of read-modify-write.
25856 			 * Note that this routine returns a pointer to
25857 			 * a valid bp in wr_bp.
25858 			 */
25859 			err = sddump_do_read_of_rmw(un, tgt_blkno, tgt_nblk,
25860 			    &wr_bp);
25861 			if (err) {
25862 				mutex_exit(SD_MUTEX(un));
25863 				return (err);
25864 			}
25865 			/*
25866 			 * Offset is being calculated as -
25867 			 * (original block # * system block size) -
25868 			 * (new block # * target block size)
25869 			 */
25870 			io_start_offset =
25871 			    ((uint64_t)(blkno * un->un_sys_blocksize)) -
25872 			    ((uint64_t)(tgt_blkno * un->un_tgt_blocksize));
25873 
25874 			ASSERT((io_start_offset >= 0) &&
25875 			    (io_start_offset < un->un_tgt_blocksize));
25876 			/*
25877 			 * Do the modify portion of read modify write.
25878 			 */
25879 			bcopy(addr, &wr_bp->b_un.b_addr[io_start_offset],
25880 			    (size_t)nblk * un->un_sys_blocksize);
25881 		} else {
25882 			doing_rmw = FALSE;
25883 			tgt_blkno = tgt_byte_offset / un->un_tgt_blocksize;
25884 			tgt_nblk = tgt_byte_count / un->un_tgt_blocksize;
25885 		}
25886 
25887 		/* Convert blkno and nblk to target blocks */
25888 		blkno = tgt_blkno;
25889 		nblk = tgt_nblk;
25890 	} else {
25891 		wr_bp = &wr_buf;
25892 		bzero(wr_bp, sizeof (struct buf));
25893 		wr_bp->b_flags		= B_BUSY;
25894 		wr_bp->b_un.b_addr	= addr;
25895 		wr_bp->b_bcount		= nblk << DEV_BSHIFT;
25896 		wr_bp->b_resid		= 0;
25897 	}
25898 
25899 	mutex_exit(SD_MUTEX(un));
25900 
25901 	/*
25902 	 * Obtain a SCSI packet for the write command.
25903 	 * It should be safe to call the allocator here without
25904 	 * worrying about being locked for DVMA mapping because
25905 	 * the address we're passed is already a DVMA mapping
25906 	 *
25907 	 * We are also not going to worry about semaphore ownership
25908 	 * in the dump buffer. Dumping is single threaded at present.
25909 	 */
25910 
25911 	wr_pktp = NULL;
25912 
25913 	dma_resid = wr_bp->b_bcount;
25914 	oblkno = blkno;
25915 
25916 	if (!(NOT_DEVBSIZE(un))) {
25917 		nblk = nblk / (un->un_tgt_blocksize / DEV_BSIZE);
25918 	}
25919 
25920 	while (dma_resid != 0) {
25921 
25922 	for (i = 0; i < SD_NDUMP_RETRIES; i++) {
25923 		wr_bp->b_flags &= ~B_ERROR;
25924 
25925 		if (un->un_partial_dma_supported == 1) {
25926 			blkno = oblkno +
25927 			    ((wr_bp->b_bcount - dma_resid) /
25928 			    un->un_tgt_blocksize);
25929 			nblk = dma_resid / un->un_tgt_blocksize;
25930 
25931 			if (wr_pktp) {
25932 				/*
25933 				 * Partial DMA transfers after initial transfer
25934 				 */
25935 				rval = sd_setup_next_rw_pkt(un, wr_pktp, wr_bp,
25936 				    blkno, nblk);
25937 			} else {
25938 				/* Initial transfer */
25939 				rval = sd_setup_rw_pkt(un, &wr_pktp, wr_bp,
25940 				    un->un_pkt_flags, NULL_FUNC, NULL,
25941 				    blkno, nblk);
25942 			}
25943 		} else {
25944 			rval = sd_setup_rw_pkt(un, &wr_pktp, wr_bp,
25945 			    0, NULL_FUNC, NULL, blkno, nblk);
25946 		}
25947 
25948 		if (rval == 0) {
25949 			/* We were given a SCSI packet, continue. */
25950 			break;
25951 		}
25952 
25953 		if (i == 0) {
25954 			if (wr_bp->b_flags & B_ERROR) {
25955 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
25956 				    "no resources for dumping; "
25957 				    "error code: 0x%x, retrying",
25958 				    geterror(wr_bp));
25959 			} else {
25960 				scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
25961 				    "no resources for dumping; retrying");
25962 			}
25963 		} else if (i != (SD_NDUMP_RETRIES - 1)) {
25964 			if (wr_bp->b_flags & B_ERROR) {
25965 				scsi_log(SD_DEVINFO(un), sd_label, CE_CONT,
25966 				    "no resources for dumping; error code: "
25967 				    "0x%x, retrying\n", geterror(wr_bp));
25968 			}
25969 		} else {
25970 			if (wr_bp->b_flags & B_ERROR) {
25971 				scsi_log(SD_DEVINFO(un), sd_label, CE_CONT,
25972 				    "no resources for dumping; "
25973 				    "error code: 0x%x, retries failed, "
25974 				    "giving up.\n", geterror(wr_bp));
25975 			} else {
25976 				scsi_log(SD_DEVINFO(un), sd_label, CE_CONT,
25977 				    "no resources for dumping; "
25978 				    "retries failed, giving up.\n");
25979 			}
25980 			mutex_enter(SD_MUTEX(un));
25981 			Restore_state(un);
25982 			if (NOT_DEVBSIZE(un) && (doing_rmw == TRUE)) {
25983 				mutex_exit(SD_MUTEX(un));
25984 				scsi_free_consistent_buf(wr_bp);
25985 			} else {
25986 				mutex_exit(SD_MUTEX(un));
25987 			}
25988 			return (EIO);
25989 		}
25990 		drv_usecwait(10000);
25991 	}
25992 
25993 	if (un->un_partial_dma_supported == 1) {
25994 		/*
25995 		 * save the resid from PARTIAL_DMA
25996 		 */
25997 		dma_resid = wr_pktp->pkt_resid;
25998 		if (dma_resid != 0)
25999 			nblk -= SD_BYTES2TGTBLOCKS(un, dma_resid);
26000 		wr_pktp->pkt_resid = 0;
26001 	} else {
26002 		dma_resid = 0;
26003 	}
26004 
26005 	/* SunBug 1222170 */
26006 	wr_pktp->pkt_flags = FLAG_NOINTR;
26007 
26008 	err = EIO;
26009 	for (i = 0; i < SD_NDUMP_RETRIES; i++) {
26010 
26011 		/*
26012 		 * Scsi_poll returns 0 (success) if the command completes and
26013 		 * the status block is STATUS_GOOD.  We should only check
26014 		 * errors if this condition is not true.  Even then we should
26015 		 * send our own request sense packet only if we have a check
26016 		 * condition and auto request sense has not been performed by
26017 		 * the hba.
26018 		 */
26019 		SD_TRACE(SD_LOG_DUMP, un, "sddump: sending write\n");
26020 
26021 		if ((sd_scsi_poll(un, wr_pktp) == 0) &&
26022 		    (wr_pktp->pkt_resid == 0)) {
26023 			err = SD_SUCCESS;
26024 			break;
26025 		}
26026 
26027 		/*
26028 		 * Check CMD_DEV_GONE 1st, give up if device is gone.
26029 		 */
26030 		if (wr_pktp->pkt_reason == CMD_DEV_GONE) {
26031 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26032 			    "Error while dumping state...Device is gone\n");
26033 			break;
26034 		}
26035 
26036 		if (SD_GET_PKT_STATUS(wr_pktp) == STATUS_CHECK) {
26037 			SD_INFO(SD_LOG_DUMP, un,
26038 			    "sddump: write failed with CHECK, try # %d\n", i);
26039 			if (((wr_pktp->pkt_state & STATE_ARQ_DONE) == 0)) {
26040 				(void) sd_send_polled_RQS(un);
26041 			}
26042 
26043 			continue;
26044 		}
26045 
26046 		if (SD_GET_PKT_STATUS(wr_pktp) == STATUS_BUSY) {
26047 			int reset_retval = 0;
26048 
26049 			SD_INFO(SD_LOG_DUMP, un,
26050 			    "sddump: write failed with BUSY, try # %d\n", i);
26051 
26052 			if (un->un_f_lun_reset_enabled == TRUE) {
26053 				reset_retval = scsi_reset(SD_ADDRESS(un),
26054 				    RESET_LUN);
26055 			}
26056 			if (reset_retval == 0) {
26057 				(void) scsi_reset(SD_ADDRESS(un), RESET_TARGET);
26058 			}
26059 			(void) sd_send_polled_RQS(un);
26060 
26061 		} else {
26062 			SD_INFO(SD_LOG_DUMP, un,
26063 			    "sddump: write failed with 0x%x, try # %d\n",
26064 			    SD_GET_PKT_STATUS(wr_pktp), i);
26065 			mutex_enter(SD_MUTEX(un));
26066 			sd_reset_target(un, wr_pktp);
26067 			mutex_exit(SD_MUTEX(un));
26068 		}
26069 
26070 		/*
26071 		 * If we are not getting anywhere with lun/target resets,
26072 		 * let's reset the bus.
26073 		 */
26074 		if (i == SD_NDUMP_RETRIES/2) {
26075 			(void) scsi_reset(SD_ADDRESS(un), RESET_ALL);
26076 			(void) sd_send_polled_RQS(un);
26077 		}
26078 	}
26079 	}
26080 
26081 	scsi_destroy_pkt(wr_pktp);
26082 	mutex_enter(SD_MUTEX(un));
26083 	if ((NOT_DEVBSIZE(un)) && (doing_rmw == TRUE)) {
26084 		mutex_exit(SD_MUTEX(un));
26085 		scsi_free_consistent_buf(wr_bp);
26086 	} else {
26087 		mutex_exit(SD_MUTEX(un));
26088 	}
26089 	SD_TRACE(SD_LOG_DUMP, un, "sddump: exit: err = %d\n", err);
26090 	return (err);
26091 }
26092 
26093 /*
26094  *    Function: sd_scsi_poll()
26095  *
26096  * Description: This is a wrapper for the scsi_poll call.
26097  *
26098  *   Arguments: sd_lun - The unit structure
26099  *              scsi_pkt - The scsi packet being sent to the device.
26100  *
26101  * Return Code: 0 - Command completed successfully with good status
26102  *             -1 - Command failed.  This could indicate a check condition
26103  *                  or other status value requiring recovery action.
26104  *
26105  * NOTE: This code is only called off sddump().
26106  */
26107 
26108 static int
26109 sd_scsi_poll(struct sd_lun *un, struct scsi_pkt *pktp)
26110 {
26111 	int status;
26112 
26113 	ASSERT(un != NULL);
26114 	ASSERT(!mutex_owned(SD_MUTEX(un)));
26115 	ASSERT(pktp != NULL);
26116 
26117 	status = SD_SUCCESS;
26118 
26119 	if (scsi_ifgetcap(&pktp->pkt_address, "tagged-qing", 1) == 1) {
26120 		pktp->pkt_flags |= un->un_tagflags;
26121 		pktp->pkt_flags &= ~FLAG_NODISCON;
26122 	}
26123 
26124 	status = sd_ddi_scsi_poll(pktp);
26125 	/*
26126 	 * Scsi_poll returns 0 (success) if the command completes and the
26127 	 * status block is STATUS_GOOD.  We should only check errors if this
26128 	 * condition is not true.  Even then we should send our own request
26129 	 * sense packet only if we have a check condition and auto
26130 	 * request sense has not been performed by the hba.
26131 	 * Don't get RQS data if pkt_reason is CMD_DEV_GONE.
26132 	 */
26133 	if ((status != SD_SUCCESS) &&
26134 	    (SD_GET_PKT_STATUS(pktp) == STATUS_CHECK) &&
26135 	    (pktp->pkt_state & STATE_ARQ_DONE) == 0 &&
26136 	    (pktp->pkt_reason != CMD_DEV_GONE))
26137 		(void) sd_send_polled_RQS(un);
26138 
26139 	return (status);
26140 }
26141 
26142 /*
26143  *    Function: sd_send_polled_RQS()
26144  *
26145  * Description: This sends the request sense command to a device.
26146  *
26147  *   Arguments: sd_lun - The unit structure
26148  *
26149  * Return Code: 0 - Command completed successfully with good status
26150  *             -1 - Command failed.
26151  *
26152  */
26153 
26154 static int
26155 sd_send_polled_RQS(struct sd_lun *un)
26156 {
26157 	int	ret_val;
26158 	struct	scsi_pkt	*rqs_pktp;
26159 	struct	buf		*rqs_bp;
26160 
26161 	ASSERT(un != NULL);
26162 	ASSERT(!mutex_owned(SD_MUTEX(un)));
26163 
26164 	ret_val = SD_SUCCESS;
26165 
26166 	rqs_pktp = un->un_rqs_pktp;
26167 	rqs_bp	 = un->un_rqs_bp;
26168 
26169 	mutex_enter(SD_MUTEX(un));
26170 
26171 	if (un->un_sense_isbusy) {
26172 		ret_val = SD_FAILURE;
26173 		mutex_exit(SD_MUTEX(un));
26174 		return (ret_val);
26175 	}
26176 
26177 	/*
26178 	 * If the request sense buffer (and packet) is not in use,
26179 	 * let's set the un_sense_isbusy and send our packet
26180 	 */
26181 	un->un_sense_isbusy 	= 1;
26182 	rqs_pktp->pkt_resid  	= 0;
26183 	rqs_pktp->pkt_reason 	= 0;
26184 	rqs_pktp->pkt_flags |= FLAG_NOINTR;
26185 	bzero(rqs_bp->b_un.b_addr, SENSE_LENGTH);
26186 
26187 	mutex_exit(SD_MUTEX(un));
26188 
26189 	SD_INFO(SD_LOG_COMMON, un, "sd_send_polled_RQS: req sense buf at"
26190 	    " 0x%p\n", rqs_bp->b_un.b_addr);
26191 
26192 	/*
26193 	 * Can't send this to sd_scsi_poll, we wrap ourselves around the
26194 	 * axle - it has a call into us!
26195 	 */
26196 	if ((ret_val = sd_ddi_scsi_poll(rqs_pktp)) != 0) {
26197 		SD_INFO(SD_LOG_COMMON, un,
26198 		    "sd_send_polled_RQS: RQS failed\n");
26199 	}
26200 
26201 	SD_DUMP_MEMORY(un, SD_LOG_COMMON, "sd_send_polled_RQS:",
26202 	    (uchar_t *)rqs_bp->b_un.b_addr, SENSE_LENGTH, SD_LOG_HEX);
26203 
26204 	mutex_enter(SD_MUTEX(un));
26205 	un->un_sense_isbusy = 0;
26206 	mutex_exit(SD_MUTEX(un));
26207 
26208 	return (ret_val);
26209 }
26210 
26211 /*
26212  * Defines needed for localized version of the scsi_poll routine.
26213  */
26214 #define	CSEC		10000			/* usecs */
26215 #define	SEC_TO_CSEC	(1000000/CSEC)
26216 
26217 /*
26218  *    Function: sd_ddi_scsi_poll()
26219  *
26220  * Description: Localized version of the scsi_poll routine.  The purpose is to
26221  *		send a scsi_pkt to a device as a polled command.  This version
26222  *		is to ensure more robust handling of transport errors.
26223  *		Specifically this routine cures not ready, coming ready
26224  *		transition for power up and reset of sonoma's.  This can take
26225  *		up to 45 seconds for power-on and 20 seconds for reset of a
26226  * 		sonoma lun.
26227  *
26228  *   Arguments: scsi_pkt - The scsi_pkt being sent to a device
26229  *
26230  * Return Code: 0 - Command completed successfully with good status
26231  *             -1 - Command failed.
26232  *
26233  * NOTE: This code is almost identical to scsi_poll, however before 6668774 can
26234  * be fixed (removing this code), we need to determine how to handle the
26235  * KEY_UNIT_ATTENTION condition below in conditions not as limited as sddump().
26236  *
26237  * NOTE: This code is only called off sddump().
26238  */
26239 static int
26240 sd_ddi_scsi_poll(struct scsi_pkt *pkt)
26241 {
26242 	int			rval = -1;
26243 	int			savef;
26244 	long			savet;
26245 	void			(*savec)();
26246 	int			timeout;
26247 	int			busy_count;
26248 	int			poll_delay;
26249 	int			rc;
26250 	uint8_t			*sensep;
26251 	struct scsi_arq_status	*arqstat;
26252 	extern int		do_polled_io;
26253 
26254 	ASSERT(pkt->pkt_scbp);
26255 
26256 	/*
26257 	 * save old flags..
26258 	 */
26259 	savef = pkt->pkt_flags;
26260 	savec = pkt->pkt_comp;
26261 	savet = pkt->pkt_time;
26262 
26263 	pkt->pkt_flags |= FLAG_NOINTR;
26264 
26265 	/*
26266 	 * XXX there is nothing in the SCSA spec that states that we should not
26267 	 * do a callback for polled cmds; however, removing this will break sd
26268 	 * and probably other target drivers
26269 	 */
26270 	pkt->pkt_comp = NULL;
26271 
26272 	/*
26273 	 * we don't like a polled command without timeout.
26274 	 * 60 seconds seems long enough.
26275 	 */
26276 	if (pkt->pkt_time == 0)
26277 		pkt->pkt_time = SCSI_POLL_TIMEOUT;
26278 
26279 	/*
26280 	 * Send polled cmd.
26281 	 *
26282 	 * We do some error recovery for various errors.  Tran_busy,
26283 	 * queue full, and non-dispatched commands are retried every 10 msec.
26284 	 * as they are typically transient failures.  Busy status and Not
26285 	 * Ready are retried every second as this status takes a while to
26286 	 * change.
26287 	 */
26288 	timeout = pkt->pkt_time * SEC_TO_CSEC;
26289 
26290 	for (busy_count = 0; busy_count < timeout; busy_count++) {
26291 		/*
26292 		 * Initialize pkt status variables.
26293 		 */
26294 		*pkt->pkt_scbp = pkt->pkt_reason = pkt->pkt_state = 0;
26295 
26296 		if ((rc = scsi_transport(pkt)) != TRAN_ACCEPT) {
26297 			if (rc != TRAN_BUSY) {
26298 				/* Transport failed - give up. */
26299 				break;
26300 			} else {
26301 				/* Transport busy - try again. */
26302 				poll_delay = 1 * CSEC;		/* 10 msec. */
26303 			}
26304 		} else {
26305 			/*
26306 			 * Transport accepted - check pkt status.
26307 			 */
26308 			rc = (*pkt->pkt_scbp) & STATUS_MASK;
26309 			if ((pkt->pkt_reason == CMD_CMPLT) &&
26310 			    (rc == STATUS_CHECK) &&
26311 			    (pkt->pkt_state & STATE_ARQ_DONE)) {
26312 				arqstat =
26313 				    (struct scsi_arq_status *)(pkt->pkt_scbp);
26314 				sensep = (uint8_t *)&arqstat->sts_sensedata;
26315 			} else {
26316 				sensep = NULL;
26317 			}
26318 
26319 			if ((pkt->pkt_reason == CMD_CMPLT) &&
26320 			    (rc == STATUS_GOOD)) {
26321 				/* No error - we're done */
26322 				rval = 0;
26323 				break;
26324 
26325 			} else if (pkt->pkt_reason == CMD_DEV_GONE) {
26326 				/* Lost connection - give up */
26327 				break;
26328 
26329 			} else if ((pkt->pkt_reason == CMD_INCOMPLETE) &&
26330 			    (pkt->pkt_state == 0)) {
26331 				/* Pkt not dispatched - try again. */
26332 				poll_delay = 1 * CSEC;		/* 10 msec. */
26333 
26334 			} else if ((pkt->pkt_reason == CMD_CMPLT) &&
26335 			    (rc == STATUS_QFULL)) {
26336 				/* Queue full - try again. */
26337 				poll_delay = 1 * CSEC;		/* 10 msec. */
26338 
26339 			} else if ((pkt->pkt_reason == CMD_CMPLT) &&
26340 			    (rc == STATUS_BUSY)) {
26341 				/* Busy - try again. */
26342 				poll_delay = 100 * CSEC;	/* 1 sec. */
26343 				busy_count += (SEC_TO_CSEC - 1);
26344 
26345 			} else if ((sensep != NULL) &&
26346 			    (scsi_sense_key(sensep) == KEY_UNIT_ATTENTION)) {
26347 				/*
26348 				 * Unit Attention - try again.
26349 				 * Pretend it took 1 sec.
26350 				 * NOTE: 'continue' avoids poll_delay
26351 				 */
26352 				busy_count += (SEC_TO_CSEC - 1);
26353 				continue;
26354 
26355 			} else if ((sensep != NULL) &&
26356 			    (scsi_sense_key(sensep) == KEY_NOT_READY) &&
26357 			    (scsi_sense_asc(sensep) == 0x04) &&
26358 			    (scsi_sense_ascq(sensep) == 0x01)) {
26359 				/*
26360 				 * Not ready -> ready - try again.
26361 				 * 04h/01h: LUN IS IN PROCESS OF BECOMING READY
26362 				 * ...same as STATUS_BUSY
26363 				 */
26364 				poll_delay = 100 * CSEC;	/* 1 sec. */
26365 				busy_count += (SEC_TO_CSEC - 1);
26366 
26367 			} else {
26368 				/* BAD status - give up. */
26369 				break;
26370 			}
26371 		}
26372 
26373 		if (((curthread->t_flag & T_INTR_THREAD) == 0) &&
26374 		    !do_polled_io) {
26375 			delay(drv_usectohz(poll_delay));
26376 		} else {
26377 			/* we busy wait during cpr_dump or interrupt threads */
26378 			drv_usecwait(poll_delay);
26379 		}
26380 	}
26381 
26382 	pkt->pkt_flags = savef;
26383 	pkt->pkt_comp = savec;
26384 	pkt->pkt_time = savet;
26385 
26386 	/* return on error */
26387 	if (rval)
26388 		return (rval);
26389 
26390 	/*
26391 	 * This is not a performance critical code path.
26392 	 *
26393 	 * As an accommodation for scsi_poll callers, to avoid ddi_dma_sync()
26394 	 * issues associated with looking at DMA memory prior to
26395 	 * scsi_pkt_destroy(), we scsi_sync_pkt() prior to return.
26396 	 */
26397 	scsi_sync_pkt(pkt);
26398 	return (0);
26399 }
26400 
26401 
26402 
26403 /*
26404  *    Function: sd_persistent_reservation_in_read_keys
26405  *
26406  * Description: This routine is the driver entry point for handling CD-ROM
26407  *		multi-host persistent reservation requests (MHIOCGRP_INKEYS)
26408  *		by sending the SCSI-3 PRIN commands to the device.
26409  *		Processes the read keys command response by copying the
26410  *		reservation key information into the user provided buffer.
26411  *		Support for the 32/64 bit _MULTI_DATAMODEL is implemented.
26412  *
26413  *   Arguments: un   -  Pointer to soft state struct for the target.
26414  *		usrp -	user provided pointer to multihost Persistent In Read
26415  *			Keys structure (mhioc_inkeys_t)
26416  *		flag -	this argument is a pass through to ddi_copyxxx()
26417  *			directly from the mode argument of ioctl().
26418  *
26419  * Return Code: 0   - Success
26420  *		EACCES
26421  *		ENOTSUP
26422  *		errno return code from sd_send_scsi_cmd()
26423  *
26424  *     Context: Can sleep. Does not return until command is completed.
26425  */
26426 
26427 static int
26428 sd_persistent_reservation_in_read_keys(struct sd_lun *un,
26429     mhioc_inkeys_t *usrp, int flag)
26430 {
26431 #ifdef _MULTI_DATAMODEL
26432 	struct mhioc_key_list32	li32;
26433 #endif
26434 	sd_prin_readkeys_t	*in;
26435 	mhioc_inkeys_t		*ptr;
26436 	mhioc_key_list_t	li;
26437 	uchar_t			*data_bufp;
26438 	int 			data_len;
26439 	int			rval = 0;
26440 	size_t			copysz;
26441 	sd_ssc_t		*ssc;
26442 
26443 	if ((ptr = (mhioc_inkeys_t *)usrp) == NULL) {
26444 		return (EINVAL);
26445 	}
26446 	bzero(&li, sizeof (mhioc_key_list_t));
26447 
26448 	ssc = sd_ssc_init(un);
26449 
26450 	/*
26451 	 * Get the listsize from user
26452 	 */
26453 #ifdef _MULTI_DATAMODEL
26454 
26455 	switch (ddi_model_convert_from(flag & FMODELS)) {
26456 	case DDI_MODEL_ILP32:
26457 		copysz = sizeof (struct mhioc_key_list32);
26458 		if (ddi_copyin(ptr->li, &li32, copysz, flag)) {
26459 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26460 			    "sd_persistent_reservation_in_read_keys: "
26461 			    "failed ddi_copyin: mhioc_key_list32_t\n");
26462 			rval = EFAULT;
26463 			goto done;
26464 		}
26465 		li.listsize = li32.listsize;
26466 		li.list = (mhioc_resv_key_t *)(uintptr_t)li32.list;
26467 		break;
26468 
26469 	case DDI_MODEL_NONE:
26470 		copysz = sizeof (mhioc_key_list_t);
26471 		if (ddi_copyin(ptr->li, &li, copysz, flag)) {
26472 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26473 			    "sd_persistent_reservation_in_read_keys: "
26474 			    "failed ddi_copyin: mhioc_key_list_t\n");
26475 			rval = EFAULT;
26476 			goto done;
26477 		}
26478 		break;
26479 	}
26480 
26481 #else /* ! _MULTI_DATAMODEL */
26482 	copysz = sizeof (mhioc_key_list_t);
26483 	if (ddi_copyin(ptr->li, &li, copysz, flag)) {
26484 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
26485 		    "sd_persistent_reservation_in_read_keys: "
26486 		    "failed ddi_copyin: mhioc_key_list_t\n");
26487 		rval = EFAULT;
26488 		goto done;
26489 	}
26490 #endif
26491 
26492 	data_len  = li.listsize * MHIOC_RESV_KEY_SIZE;
26493 	data_len += (sizeof (sd_prin_readkeys_t) - sizeof (caddr_t));
26494 	data_bufp = kmem_zalloc(data_len, KM_SLEEP);
26495 
26496 	rval = sd_send_scsi_PERSISTENT_RESERVE_IN(ssc, SD_READ_KEYS,
26497 	    data_len, data_bufp);
26498 	if (rval != 0) {
26499 		if (rval == EIO)
26500 			sd_ssc_assessment(ssc, SD_FMT_IGNORE_COMPROMISE);
26501 		else
26502 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
26503 		goto done;
26504 	}
26505 	in = (sd_prin_readkeys_t *)data_bufp;
26506 	ptr->generation = BE_32(in->generation);
26507 	li.listlen = BE_32(in->len) / MHIOC_RESV_KEY_SIZE;
26508 
26509 	/*
26510 	 * Return the min(listsize, listlen) keys
26511 	 */
26512 #ifdef _MULTI_DATAMODEL
26513 
26514 	switch (ddi_model_convert_from(flag & FMODELS)) {
26515 	case DDI_MODEL_ILP32:
26516 		li32.listlen = li.listlen;
26517 		if (ddi_copyout(&li32, ptr->li, copysz, flag)) {
26518 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26519 			    "sd_persistent_reservation_in_read_keys: "
26520 			    "failed ddi_copyout: mhioc_key_list32_t\n");
26521 			rval = EFAULT;
26522 			goto done;
26523 		}
26524 		break;
26525 
26526 	case DDI_MODEL_NONE:
26527 		if (ddi_copyout(&li, ptr->li, copysz, flag)) {
26528 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26529 			    "sd_persistent_reservation_in_read_keys: "
26530 			    "failed ddi_copyout: mhioc_key_list_t\n");
26531 			rval = EFAULT;
26532 			goto done;
26533 		}
26534 		break;
26535 	}
26536 
26537 #else /* ! _MULTI_DATAMODEL */
26538 
26539 	if (ddi_copyout(&li, ptr->li, copysz, flag)) {
26540 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
26541 		    "sd_persistent_reservation_in_read_keys: "
26542 		    "failed ddi_copyout: mhioc_key_list_t\n");
26543 		rval = EFAULT;
26544 		goto done;
26545 	}
26546 
26547 #endif /* _MULTI_DATAMODEL */
26548 
26549 	copysz = min(li.listlen * MHIOC_RESV_KEY_SIZE,
26550 	    li.listsize * MHIOC_RESV_KEY_SIZE);
26551 	if (ddi_copyout(&in->keylist, li.list, copysz, flag)) {
26552 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
26553 		    "sd_persistent_reservation_in_read_keys: "
26554 		    "failed ddi_copyout: keylist\n");
26555 		rval = EFAULT;
26556 	}
26557 done:
26558 	sd_ssc_fini(ssc);
26559 	kmem_free(data_bufp, data_len);
26560 	return (rval);
26561 }
26562 
26563 
26564 /*
26565  *    Function: sd_persistent_reservation_in_read_resv
26566  *
26567  * Description: This routine is the driver entry point for handling CD-ROM
26568  *		multi-host persistent reservation requests (MHIOCGRP_INRESV)
26569  *		by sending the SCSI-3 PRIN commands to the device.
26570  *		Process the read persistent reservations command response by
26571  *		copying the reservation information into the user provided
26572  *		buffer. Support for the 32/64 _MULTI_DATAMODEL is implemented.
26573  *
26574  *   Arguments: un   -  Pointer to soft state struct for the target.
26575  *		usrp -	user provided pointer to multihost Persistent In Read
26576  *			Keys structure (mhioc_inkeys_t)
26577  *		flag -	this argument is a pass through to ddi_copyxxx()
26578  *			directly from the mode argument of ioctl().
26579  *
26580  * Return Code: 0   - Success
26581  *		EACCES
26582  *		ENOTSUP
26583  *		errno return code from sd_send_scsi_cmd()
26584  *
26585  *     Context: Can sleep. Does not return until command is completed.
26586  */
26587 
26588 static int
26589 sd_persistent_reservation_in_read_resv(struct sd_lun *un,
26590     mhioc_inresvs_t *usrp, int flag)
26591 {
26592 #ifdef _MULTI_DATAMODEL
26593 	struct mhioc_resv_desc_list32 resvlist32;
26594 #endif
26595 	sd_prin_readresv_t	*in;
26596 	mhioc_inresvs_t		*ptr;
26597 	sd_readresv_desc_t	*readresv_ptr;
26598 	mhioc_resv_desc_list_t	resvlist;
26599 	mhioc_resv_desc_t 	resvdesc;
26600 	uchar_t			*data_bufp = NULL;
26601 	int 			data_len;
26602 	int			rval = 0;
26603 	int			i;
26604 	size_t			copysz;
26605 	mhioc_resv_desc_t	*bufp;
26606 	sd_ssc_t		*ssc;
26607 
26608 	if ((ptr = usrp) == NULL) {
26609 		return (EINVAL);
26610 	}
26611 
26612 	ssc = sd_ssc_init(un);
26613 
26614 	/*
26615 	 * Get the listsize from user
26616 	 */
26617 #ifdef _MULTI_DATAMODEL
26618 	switch (ddi_model_convert_from(flag & FMODELS)) {
26619 	case DDI_MODEL_ILP32:
26620 		copysz = sizeof (struct mhioc_resv_desc_list32);
26621 		if (ddi_copyin(ptr->li, &resvlist32, copysz, flag)) {
26622 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26623 			    "sd_persistent_reservation_in_read_resv: "
26624 			    "failed ddi_copyin: mhioc_resv_desc_list_t\n");
26625 			rval = EFAULT;
26626 			goto done;
26627 		}
26628 		resvlist.listsize = resvlist32.listsize;
26629 		resvlist.list = (mhioc_resv_desc_t *)(uintptr_t)resvlist32.list;
26630 		break;
26631 
26632 	case DDI_MODEL_NONE:
26633 		copysz = sizeof (mhioc_resv_desc_list_t);
26634 		if (ddi_copyin(ptr->li, &resvlist, copysz, flag)) {
26635 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26636 			    "sd_persistent_reservation_in_read_resv: "
26637 			    "failed ddi_copyin: mhioc_resv_desc_list_t\n");
26638 			rval = EFAULT;
26639 			goto done;
26640 		}
26641 		break;
26642 	}
26643 #else /* ! _MULTI_DATAMODEL */
26644 	copysz = sizeof (mhioc_resv_desc_list_t);
26645 	if (ddi_copyin(ptr->li, &resvlist, copysz, flag)) {
26646 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
26647 		    "sd_persistent_reservation_in_read_resv: "
26648 		    "failed ddi_copyin: mhioc_resv_desc_list_t\n");
26649 		rval = EFAULT;
26650 		goto done;
26651 	}
26652 #endif /* ! _MULTI_DATAMODEL */
26653 
26654 	data_len  = resvlist.listsize * SCSI3_RESV_DESC_LEN;
26655 	data_len += (sizeof (sd_prin_readresv_t) - sizeof (caddr_t));
26656 	data_bufp = kmem_zalloc(data_len, KM_SLEEP);
26657 
26658 	rval = sd_send_scsi_PERSISTENT_RESERVE_IN(ssc, SD_READ_RESV,
26659 	    data_len, data_bufp);
26660 	if (rval != 0) {
26661 		if (rval == EIO)
26662 			sd_ssc_assessment(ssc, SD_FMT_IGNORE_COMPROMISE);
26663 		else
26664 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
26665 		goto done;
26666 	}
26667 	in = (sd_prin_readresv_t *)data_bufp;
26668 	ptr->generation = BE_32(in->generation);
26669 	resvlist.listlen = BE_32(in->len) / SCSI3_RESV_DESC_LEN;
26670 
26671 	/*
26672 	 * Return the min(listsize, listlen( keys
26673 	 */
26674 #ifdef _MULTI_DATAMODEL
26675 
26676 	switch (ddi_model_convert_from(flag & FMODELS)) {
26677 	case DDI_MODEL_ILP32:
26678 		resvlist32.listlen = resvlist.listlen;
26679 		if (ddi_copyout(&resvlist32, ptr->li, copysz, flag)) {
26680 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26681 			    "sd_persistent_reservation_in_read_resv: "
26682 			    "failed ddi_copyout: mhioc_resv_desc_list_t\n");
26683 			rval = EFAULT;
26684 			goto done;
26685 		}
26686 		break;
26687 
26688 	case DDI_MODEL_NONE:
26689 		if (ddi_copyout(&resvlist, ptr->li, copysz, flag)) {
26690 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26691 			    "sd_persistent_reservation_in_read_resv: "
26692 			    "failed ddi_copyout: mhioc_resv_desc_list_t\n");
26693 			rval = EFAULT;
26694 			goto done;
26695 		}
26696 		break;
26697 	}
26698 
26699 #else /* ! _MULTI_DATAMODEL */
26700 
26701 	if (ddi_copyout(&resvlist, ptr->li, copysz, flag)) {
26702 		SD_ERROR(SD_LOG_IOCTL_MHD, un,
26703 		    "sd_persistent_reservation_in_read_resv: "
26704 		    "failed ddi_copyout: mhioc_resv_desc_list_t\n");
26705 		rval = EFAULT;
26706 		goto done;
26707 	}
26708 
26709 #endif /* ! _MULTI_DATAMODEL */
26710 
26711 	readresv_ptr = (sd_readresv_desc_t *)&in->readresv_desc;
26712 	bufp = resvlist.list;
26713 	copysz = sizeof (mhioc_resv_desc_t);
26714 	for (i = 0; i < min(resvlist.listlen, resvlist.listsize);
26715 	    i++, readresv_ptr++, bufp++) {
26716 
26717 		bcopy(&readresv_ptr->resvkey, &resvdesc.key,
26718 		    MHIOC_RESV_KEY_SIZE);
26719 		resvdesc.type  = readresv_ptr->type;
26720 		resvdesc.scope = readresv_ptr->scope;
26721 		resvdesc.scope_specific_addr =
26722 		    BE_32(readresv_ptr->scope_specific_addr);
26723 
26724 		if (ddi_copyout(&resvdesc, bufp, copysz, flag)) {
26725 			SD_ERROR(SD_LOG_IOCTL_MHD, un,
26726 			    "sd_persistent_reservation_in_read_resv: "
26727 			    "failed ddi_copyout: resvlist\n");
26728 			rval = EFAULT;
26729 			goto done;
26730 		}
26731 	}
26732 done:
26733 	sd_ssc_fini(ssc);
26734 	/* only if data_bufp is allocated, we need to free it */
26735 	if (data_bufp) {
26736 		kmem_free(data_bufp, data_len);
26737 	}
26738 	return (rval);
26739 }
26740 
26741 
26742 /*
26743  *    Function: sr_change_blkmode()
26744  *
26745  * Description: This routine is the driver entry point for handling CD-ROM
26746  *		block mode ioctl requests. Support for returning and changing
26747  *		the current block size in use by the device is implemented. The
26748  *		LBA size is changed via a MODE SELECT Block Descriptor.
26749  *
26750  *		This routine issues a mode sense with an allocation length of
26751  *		12 bytes for the mode page header and a single block descriptor.
26752  *
26753  *   Arguments: dev - the device 'dev_t'
26754  *		cmd - the request type; one of CDROMGBLKMODE (get) or
26755  *		      CDROMSBLKMODE (set)
26756  *		data - current block size or requested block size
26757  *		flag - this argument is a pass through to ddi_copyxxx() directly
26758  *		       from the mode argument of ioctl().
26759  *
26760  * Return Code: the code returned by sd_send_scsi_cmd()
26761  *		EINVAL if invalid arguments are provided
26762  *		EFAULT if ddi_copyxxx() fails
26763  *		ENXIO if fail ddi_get_soft_state
26764  *		EIO if invalid mode sense block descriptor length
26765  *
26766  */
26767 
26768 static int
26769 sr_change_blkmode(dev_t dev, int cmd, intptr_t data, int flag)
26770 {
26771 	struct sd_lun			*un = NULL;
26772 	struct mode_header		*sense_mhp, *select_mhp;
26773 	struct block_descriptor		*sense_desc, *select_desc;
26774 	int				current_bsize;
26775 	int				rval = EINVAL;
26776 	uchar_t				*sense = NULL;
26777 	uchar_t				*select = NULL;
26778 	sd_ssc_t			*ssc;
26779 
26780 	ASSERT((cmd == CDROMGBLKMODE) || (cmd == CDROMSBLKMODE));
26781 
26782 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
26783 		return (ENXIO);
26784 	}
26785 
26786 	/*
26787 	 * The block length is changed via the Mode Select block descriptor, the
26788 	 * "Read/Write Error Recovery" mode page (0x1) contents are not actually
26789 	 * required as part of this routine. Therefore the mode sense allocation
26790 	 * length is specified to be the length of a mode page header and a
26791 	 * block descriptor.
26792 	 */
26793 	sense = kmem_zalloc(BUFLEN_CHG_BLK_MODE, KM_SLEEP);
26794 
26795 	ssc = sd_ssc_init(un);
26796 	rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense,
26797 	    BUFLEN_CHG_BLK_MODE, MODEPAGE_ERR_RECOV, SD_PATH_STANDARD);
26798 	sd_ssc_fini(ssc);
26799 	if (rval != 0) {
26800 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26801 		    "sr_change_blkmode: Mode Sense Failed\n");
26802 		kmem_free(sense, BUFLEN_CHG_BLK_MODE);
26803 		return (rval);
26804 	}
26805 
26806 	/* Check the block descriptor len to handle only 1 block descriptor */
26807 	sense_mhp = (struct mode_header *)sense;
26808 	if ((sense_mhp->bdesc_length == 0) ||
26809 	    (sense_mhp->bdesc_length > MODE_BLK_DESC_LENGTH)) {
26810 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26811 		    "sr_change_blkmode: Mode Sense returned invalid block"
26812 		    " descriptor length\n");
26813 		kmem_free(sense, BUFLEN_CHG_BLK_MODE);
26814 		return (EIO);
26815 	}
26816 	sense_desc = (struct block_descriptor *)(sense + MODE_HEADER_LENGTH);
26817 	current_bsize = ((sense_desc->blksize_hi << 16) |
26818 	    (sense_desc->blksize_mid << 8) | sense_desc->blksize_lo);
26819 
26820 	/* Process command */
26821 	switch (cmd) {
26822 	case CDROMGBLKMODE:
26823 		/* Return the block size obtained during the mode sense */
26824 		if (ddi_copyout(&current_bsize, (void *)data,
26825 		    sizeof (int), flag) != 0)
26826 			rval = EFAULT;
26827 		break;
26828 	case CDROMSBLKMODE:
26829 		/* Validate the requested block size */
26830 		switch (data) {
26831 		case CDROM_BLK_512:
26832 		case CDROM_BLK_1024:
26833 		case CDROM_BLK_2048:
26834 		case CDROM_BLK_2056:
26835 		case CDROM_BLK_2336:
26836 		case CDROM_BLK_2340:
26837 		case CDROM_BLK_2352:
26838 		case CDROM_BLK_2368:
26839 		case CDROM_BLK_2448:
26840 		case CDROM_BLK_2646:
26841 		case CDROM_BLK_2647:
26842 			break;
26843 		default:
26844 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26845 			    "sr_change_blkmode: "
26846 			    "Block Size '%ld' Not Supported\n", data);
26847 			kmem_free(sense, BUFLEN_CHG_BLK_MODE);
26848 			return (EINVAL);
26849 		}
26850 
26851 		/*
26852 		 * The current block size matches the requested block size so
26853 		 * there is no need to send the mode select to change the size
26854 		 */
26855 		if (current_bsize == data) {
26856 			break;
26857 		}
26858 
26859 		/* Build the select data for the requested block size */
26860 		select = kmem_zalloc(BUFLEN_CHG_BLK_MODE, KM_SLEEP);
26861 		select_mhp = (struct mode_header *)select;
26862 		select_desc =
26863 		    (struct block_descriptor *)(select + MODE_HEADER_LENGTH);
26864 		/*
26865 		 * The LBA size is changed via the block descriptor, so the
26866 		 * descriptor is built according to the user data
26867 		 */
26868 		select_mhp->bdesc_length = MODE_BLK_DESC_LENGTH;
26869 		select_desc->blksize_hi  = (char)(((data) & 0x00ff0000) >> 16);
26870 		select_desc->blksize_mid = (char)(((data) & 0x0000ff00) >> 8);
26871 		select_desc->blksize_lo  = (char)((data) & 0x000000ff);
26872 
26873 		/* Send the mode select for the requested block size */
26874 		ssc = sd_ssc_init(un);
26875 		rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0,
26876 		    select, BUFLEN_CHG_BLK_MODE, SD_DONTSAVE_PAGE,
26877 		    SD_PATH_STANDARD);
26878 		sd_ssc_fini(ssc);
26879 		if (rval != 0) {
26880 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26881 			    "sr_change_blkmode: Mode Select Failed\n");
26882 			/*
26883 			 * The mode select failed for the requested block size,
26884 			 * so reset the data for the original block size and
26885 			 * send it to the target. The error is indicated by the
26886 			 * return value for the failed mode select.
26887 			 */
26888 			select_desc->blksize_hi  = sense_desc->blksize_hi;
26889 			select_desc->blksize_mid = sense_desc->blksize_mid;
26890 			select_desc->blksize_lo  = sense_desc->blksize_lo;
26891 			ssc = sd_ssc_init(un);
26892 			(void) sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0,
26893 			    select, BUFLEN_CHG_BLK_MODE, SD_DONTSAVE_PAGE,
26894 			    SD_PATH_STANDARD);
26895 			sd_ssc_fini(ssc);
26896 		} else {
26897 			ASSERT(!mutex_owned(SD_MUTEX(un)));
26898 			mutex_enter(SD_MUTEX(un));
26899 			sd_update_block_info(un, (uint32_t)data, 0);
26900 			mutex_exit(SD_MUTEX(un));
26901 		}
26902 		break;
26903 	default:
26904 		/* should not reach here, but check anyway */
26905 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26906 		    "sr_change_blkmode: Command '%x' Not Supported\n", cmd);
26907 		rval = EINVAL;
26908 		break;
26909 	}
26910 
26911 	if (select) {
26912 		kmem_free(select, BUFLEN_CHG_BLK_MODE);
26913 	}
26914 	if (sense) {
26915 		kmem_free(sense, BUFLEN_CHG_BLK_MODE);
26916 	}
26917 	return (rval);
26918 }
26919 
26920 
26921 /*
26922  * Note: The following sr_change_speed() and sr_atapi_change_speed() routines
26923  * implement driver support for getting and setting the CD speed. The command
26924  * set used will be based on the device type. If the device has not been
26925  * identified as MMC the Toshiba vendor specific mode page will be used. If
26926  * the device is MMC but does not support the Real Time Streaming feature
26927  * the SET CD SPEED command will be used to set speed and mode page 0x2A will
26928  * be used to read the speed.
26929  */
26930 
26931 /*
26932  *    Function: sr_change_speed()
26933  *
26934  * Description: This routine is the driver entry point for handling CD-ROM
26935  *		drive speed ioctl requests for devices supporting the Toshiba
26936  *		vendor specific drive speed mode page. Support for returning
26937  *		and changing the current drive speed in use by the device is
26938  *		implemented.
26939  *
26940  *   Arguments: dev - the device 'dev_t'
26941  *		cmd - the request type; one of CDROMGDRVSPEED (get) or
26942  *		      CDROMSDRVSPEED (set)
26943  *		data - current drive speed or requested drive speed
26944  *		flag - this argument is a pass through to ddi_copyxxx() directly
26945  *		       from the mode argument of ioctl().
26946  *
26947  * Return Code: the code returned by sd_send_scsi_cmd()
26948  *		EINVAL if invalid arguments are provided
26949  *		EFAULT if ddi_copyxxx() fails
26950  *		ENXIO if fail ddi_get_soft_state
26951  *		EIO if invalid mode sense block descriptor length
26952  */
26953 
26954 static int
26955 sr_change_speed(dev_t dev, int cmd, intptr_t data, int flag)
26956 {
26957 	struct sd_lun			*un = NULL;
26958 	struct mode_header		*sense_mhp, *select_mhp;
26959 	struct mode_speed		*sense_page, *select_page;
26960 	int				current_speed;
26961 	int				rval = EINVAL;
26962 	int				bd_len;
26963 	uchar_t				*sense = NULL;
26964 	uchar_t				*select = NULL;
26965 	sd_ssc_t			*ssc;
26966 
26967 	ASSERT((cmd == CDROMGDRVSPEED) || (cmd == CDROMSDRVSPEED));
26968 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
26969 		return (ENXIO);
26970 	}
26971 
26972 	/*
26973 	 * Note: The drive speed is being modified here according to a Toshiba
26974 	 * vendor specific mode page (0x31).
26975 	 */
26976 	sense = kmem_zalloc(BUFLEN_MODE_CDROM_SPEED, KM_SLEEP);
26977 
26978 	ssc = sd_ssc_init(un);
26979 	rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense,
26980 	    BUFLEN_MODE_CDROM_SPEED, CDROM_MODE_SPEED,
26981 	    SD_PATH_STANDARD);
26982 	sd_ssc_fini(ssc);
26983 	if (rval != 0) {
26984 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26985 		    "sr_change_speed: Mode Sense Failed\n");
26986 		kmem_free(sense, BUFLEN_MODE_CDROM_SPEED);
26987 		return (rval);
26988 	}
26989 	sense_mhp  = (struct mode_header *)sense;
26990 
26991 	/* Check the block descriptor len to handle only 1 block descriptor */
26992 	bd_len = sense_mhp->bdesc_length;
26993 	if (bd_len > MODE_BLK_DESC_LENGTH) {
26994 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
26995 		    "sr_change_speed: Mode Sense returned invalid block "
26996 		    "descriptor length\n");
26997 		kmem_free(sense, BUFLEN_MODE_CDROM_SPEED);
26998 		return (EIO);
26999 	}
27000 
27001 	sense_page = (struct mode_speed *)
27002 	    (sense + MODE_HEADER_LENGTH + sense_mhp->bdesc_length);
27003 	current_speed = sense_page->speed;
27004 
27005 	/* Process command */
27006 	switch (cmd) {
27007 	case CDROMGDRVSPEED:
27008 		/* Return the drive speed obtained during the mode sense */
27009 		if (current_speed == 0x2) {
27010 			current_speed = CDROM_TWELVE_SPEED;
27011 		}
27012 		if (ddi_copyout(&current_speed, (void *)data,
27013 		    sizeof (int), flag) != 0) {
27014 			rval = EFAULT;
27015 		}
27016 		break;
27017 	case CDROMSDRVSPEED:
27018 		/* Validate the requested drive speed */
27019 		switch ((uchar_t)data) {
27020 		case CDROM_TWELVE_SPEED:
27021 			data = 0x2;
27022 			/*FALLTHROUGH*/
27023 		case CDROM_NORMAL_SPEED:
27024 		case CDROM_DOUBLE_SPEED:
27025 		case CDROM_QUAD_SPEED:
27026 		case CDROM_MAXIMUM_SPEED:
27027 			break;
27028 		default:
27029 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27030 			    "sr_change_speed: "
27031 			    "Drive Speed '%d' Not Supported\n", (uchar_t)data);
27032 			kmem_free(sense, BUFLEN_MODE_CDROM_SPEED);
27033 			return (EINVAL);
27034 		}
27035 
27036 		/*
27037 		 * The current drive speed matches the requested drive speed so
27038 		 * there is no need to send the mode select to change the speed
27039 		 */
27040 		if (current_speed == data) {
27041 			break;
27042 		}
27043 
27044 		/* Build the select data for the requested drive speed */
27045 		select = kmem_zalloc(BUFLEN_MODE_CDROM_SPEED, KM_SLEEP);
27046 		select_mhp = (struct mode_header *)select;
27047 		select_mhp->bdesc_length = 0;
27048 		select_page =
27049 		    (struct mode_speed *)(select + MODE_HEADER_LENGTH);
27050 		select_page =
27051 		    (struct mode_speed *)(select + MODE_HEADER_LENGTH);
27052 		select_page->mode_page.code = CDROM_MODE_SPEED;
27053 		select_page->mode_page.length = 2;
27054 		select_page->speed = (uchar_t)data;
27055 
27056 		/* Send the mode select for the requested block size */
27057 		ssc = sd_ssc_init(un);
27058 		rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, select,
27059 		    MODEPAGE_CDROM_SPEED_LEN + MODE_HEADER_LENGTH,
27060 		    SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
27061 		sd_ssc_fini(ssc);
27062 		if (rval != 0) {
27063 			/*
27064 			 * The mode select failed for the requested drive speed,
27065 			 * so reset the data for the original drive speed and
27066 			 * send it to the target. The error is indicated by the
27067 			 * return value for the failed mode select.
27068 			 */
27069 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27070 			    "sr_drive_speed: Mode Select Failed\n");
27071 			select_page->speed = sense_page->speed;
27072 			ssc = sd_ssc_init(un);
27073 			(void) sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, select,
27074 			    MODEPAGE_CDROM_SPEED_LEN + MODE_HEADER_LENGTH,
27075 			    SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
27076 			sd_ssc_fini(ssc);
27077 		}
27078 		break;
27079 	default:
27080 		/* should not reach here, but check anyway */
27081 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27082 		    "sr_change_speed: Command '%x' Not Supported\n", cmd);
27083 		rval = EINVAL;
27084 		break;
27085 	}
27086 
27087 	if (select) {
27088 		kmem_free(select, BUFLEN_MODE_CDROM_SPEED);
27089 	}
27090 	if (sense) {
27091 		kmem_free(sense, BUFLEN_MODE_CDROM_SPEED);
27092 	}
27093 
27094 	return (rval);
27095 }
27096 
27097 
27098 /*
27099  *    Function: sr_atapi_change_speed()
27100  *
27101  * Description: This routine is the driver entry point for handling CD-ROM
27102  *		drive speed ioctl requests for MMC devices that do not support
27103  *		the Real Time Streaming feature (0x107).
27104  *
27105  *		Note: This routine will use the SET SPEED command which may not
27106  *		be supported by all devices.
27107  *
27108  *   Arguments: dev- the device 'dev_t'
27109  *		cmd- the request type; one of CDROMGDRVSPEED (get) or
27110  *		     CDROMSDRVSPEED (set)
27111  *		data- current drive speed or requested drive speed
27112  *		flag- this argument is a pass through to ddi_copyxxx() directly
27113  *		      from the mode argument of ioctl().
27114  *
27115  * Return Code: the code returned by sd_send_scsi_cmd()
27116  *		EINVAL if invalid arguments are provided
27117  *		EFAULT if ddi_copyxxx() fails
27118  *		ENXIO if fail ddi_get_soft_state
27119  *		EIO if invalid mode sense block descriptor length
27120  */
27121 
27122 static int
27123 sr_atapi_change_speed(dev_t dev, int cmd, intptr_t data, int flag)
27124 {
27125 	struct sd_lun			*un;
27126 	struct uscsi_cmd		*com = NULL;
27127 	struct mode_header_grp2		*sense_mhp;
27128 	uchar_t				*sense_page;
27129 	uchar_t				*sense = NULL;
27130 	char				cdb[CDB_GROUP5];
27131 	int				bd_len;
27132 	int				current_speed = 0;
27133 	int				max_speed = 0;
27134 	int				rval;
27135 	sd_ssc_t			*ssc;
27136 
27137 	ASSERT((cmd == CDROMGDRVSPEED) || (cmd == CDROMSDRVSPEED));
27138 
27139 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27140 		return (ENXIO);
27141 	}
27142 
27143 	sense = kmem_zalloc(BUFLEN_MODE_CDROM_CAP, KM_SLEEP);
27144 
27145 	ssc = sd_ssc_init(un);
27146 	rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, sense,
27147 	    BUFLEN_MODE_CDROM_CAP, MODEPAGE_CDROM_CAP,
27148 	    SD_PATH_STANDARD);
27149 	sd_ssc_fini(ssc);
27150 	if (rval != 0) {
27151 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27152 		    "sr_atapi_change_speed: Mode Sense Failed\n");
27153 		kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27154 		return (rval);
27155 	}
27156 
27157 	/* Check the block descriptor len to handle only 1 block descriptor */
27158 	sense_mhp = (struct mode_header_grp2 *)sense;
27159 	bd_len = (sense_mhp->bdesc_length_hi << 8) | sense_mhp->bdesc_length_lo;
27160 	if (bd_len > MODE_BLK_DESC_LENGTH) {
27161 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27162 		    "sr_atapi_change_speed: Mode Sense returned invalid "
27163 		    "block descriptor length\n");
27164 		kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27165 		return (EIO);
27166 	}
27167 
27168 	/* Calculate the current and maximum drive speeds */
27169 	sense_page = (uchar_t *)(sense + MODE_HEADER_LENGTH_GRP2 + bd_len);
27170 	current_speed = (sense_page[14] << 8) | sense_page[15];
27171 	max_speed = (sense_page[8] << 8) | sense_page[9];
27172 
27173 	/* Process the command */
27174 	switch (cmd) {
27175 	case CDROMGDRVSPEED:
27176 		current_speed /= SD_SPEED_1X;
27177 		if (ddi_copyout(&current_speed, (void *)data,
27178 		    sizeof (int), flag) != 0)
27179 			rval = EFAULT;
27180 		break;
27181 	case CDROMSDRVSPEED:
27182 		/* Convert the speed code to KB/sec */
27183 		switch ((uchar_t)data) {
27184 		case CDROM_NORMAL_SPEED:
27185 			current_speed = SD_SPEED_1X;
27186 			break;
27187 		case CDROM_DOUBLE_SPEED:
27188 			current_speed = 2 * SD_SPEED_1X;
27189 			break;
27190 		case CDROM_QUAD_SPEED:
27191 			current_speed = 4 * SD_SPEED_1X;
27192 			break;
27193 		case CDROM_TWELVE_SPEED:
27194 			current_speed = 12 * SD_SPEED_1X;
27195 			break;
27196 		case CDROM_MAXIMUM_SPEED:
27197 			current_speed = 0xffff;
27198 			break;
27199 		default:
27200 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27201 			    "sr_atapi_change_speed: invalid drive speed %d\n",
27202 			    (uchar_t)data);
27203 			kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27204 			return (EINVAL);
27205 		}
27206 
27207 		/* Check the request against the drive's max speed. */
27208 		if (current_speed != 0xffff) {
27209 			if (current_speed > max_speed) {
27210 				kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27211 				return (EINVAL);
27212 			}
27213 		}
27214 
27215 		/*
27216 		 * Build and send the SET SPEED command
27217 		 *
27218 		 * Note: The SET SPEED (0xBB) command used in this routine is
27219 		 * obsolete per the SCSI MMC spec but still supported in the
27220 		 * MT FUJI vendor spec. Most equipment is adhereing to MT FUJI
27221 		 * therefore the command is still implemented in this routine.
27222 		 */
27223 		bzero(cdb, sizeof (cdb));
27224 		cdb[0] = (char)SCMD_SET_CDROM_SPEED;
27225 		cdb[2] = (uchar_t)(current_speed >> 8);
27226 		cdb[3] = (uchar_t)current_speed;
27227 		com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27228 		com->uscsi_cdb	   = (caddr_t)cdb;
27229 		com->uscsi_cdblen  = CDB_GROUP5;
27230 		com->uscsi_bufaddr = NULL;
27231 		com->uscsi_buflen  = 0;
27232 		com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT;
27233 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, 0, SD_PATH_STANDARD);
27234 		break;
27235 	default:
27236 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27237 		    "sr_atapi_change_speed: Command '%x' Not Supported\n", cmd);
27238 		rval = EINVAL;
27239 	}
27240 
27241 	if (sense) {
27242 		kmem_free(sense, BUFLEN_MODE_CDROM_CAP);
27243 	}
27244 	if (com) {
27245 		kmem_free(com, sizeof (*com));
27246 	}
27247 	return (rval);
27248 }
27249 
27250 
27251 /*
27252  *    Function: sr_pause_resume()
27253  *
27254  * Description: This routine is the driver entry point for handling CD-ROM
27255  *		pause/resume ioctl requests. This only affects the audio play
27256  *		operation.
27257  *
27258  *   Arguments: dev - the device 'dev_t'
27259  *		cmd - the request type; one of CDROMPAUSE or CDROMRESUME, used
27260  *		      for setting the resume bit of the cdb.
27261  *
27262  * Return Code: the code returned by sd_send_scsi_cmd()
27263  *		EINVAL if invalid mode specified
27264  *
27265  */
27266 
27267 static int
27268 sr_pause_resume(dev_t dev, int cmd)
27269 {
27270 	struct sd_lun		*un;
27271 	struct uscsi_cmd	*com;
27272 	char			cdb[CDB_GROUP1];
27273 	int			rval;
27274 
27275 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27276 		return (ENXIO);
27277 	}
27278 
27279 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27280 	bzero(cdb, CDB_GROUP1);
27281 	cdb[0] = SCMD_PAUSE_RESUME;
27282 	switch (cmd) {
27283 	case CDROMRESUME:
27284 		cdb[8] = 1;
27285 		break;
27286 	case CDROMPAUSE:
27287 		cdb[8] = 0;
27288 		break;
27289 	default:
27290 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN, "sr_pause_resume:"
27291 		    " Command '%x' Not Supported\n", cmd);
27292 		rval = EINVAL;
27293 		goto done;
27294 	}
27295 
27296 	com->uscsi_cdb    = cdb;
27297 	com->uscsi_cdblen = CDB_GROUP1;
27298 	com->uscsi_flags  = USCSI_DIAGNOSE|USCSI_SILENT;
27299 
27300 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27301 	    SD_PATH_STANDARD);
27302 
27303 done:
27304 	kmem_free(com, sizeof (*com));
27305 	return (rval);
27306 }
27307 
27308 
27309 /*
27310  *    Function: sr_play_msf()
27311  *
27312  * Description: This routine is the driver entry point for handling CD-ROM
27313  *		ioctl requests to output the audio signals at the specified
27314  *		starting address and continue the audio play until the specified
27315  *		ending address (CDROMPLAYMSF) The address is in Minute Second
27316  *		Frame (MSF) format.
27317  *
27318  *   Arguments: dev	- the device 'dev_t'
27319  *		data	- pointer to user provided audio msf structure,
27320  *		          specifying start/end addresses.
27321  *		flag	- this argument is a pass through to ddi_copyxxx()
27322  *		          directly from the mode argument of ioctl().
27323  *
27324  * Return Code: the code returned by sd_send_scsi_cmd()
27325  *		EFAULT if ddi_copyxxx() fails
27326  *		ENXIO if fail ddi_get_soft_state
27327  *		EINVAL if data pointer is NULL
27328  */
27329 
27330 static int
27331 sr_play_msf(dev_t dev, caddr_t data, int flag)
27332 {
27333 	struct sd_lun		*un;
27334 	struct uscsi_cmd	*com;
27335 	struct cdrom_msf	msf_struct;
27336 	struct cdrom_msf	*msf = &msf_struct;
27337 	char			cdb[CDB_GROUP1];
27338 	int			rval;
27339 
27340 	if (data == NULL) {
27341 		return (EINVAL);
27342 	}
27343 
27344 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27345 		return (ENXIO);
27346 	}
27347 
27348 	if (ddi_copyin(data, msf, sizeof (struct cdrom_msf), flag)) {
27349 		return (EFAULT);
27350 	}
27351 
27352 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27353 	bzero(cdb, CDB_GROUP1);
27354 	cdb[0] = SCMD_PLAYAUDIO_MSF;
27355 	if (un->un_f_cfg_playmsf_bcd == TRUE) {
27356 		cdb[3] = BYTE_TO_BCD(msf->cdmsf_min0);
27357 		cdb[4] = BYTE_TO_BCD(msf->cdmsf_sec0);
27358 		cdb[5] = BYTE_TO_BCD(msf->cdmsf_frame0);
27359 		cdb[6] = BYTE_TO_BCD(msf->cdmsf_min1);
27360 		cdb[7] = BYTE_TO_BCD(msf->cdmsf_sec1);
27361 		cdb[8] = BYTE_TO_BCD(msf->cdmsf_frame1);
27362 	} else {
27363 		cdb[3] = msf->cdmsf_min0;
27364 		cdb[4] = msf->cdmsf_sec0;
27365 		cdb[5] = msf->cdmsf_frame0;
27366 		cdb[6] = msf->cdmsf_min1;
27367 		cdb[7] = msf->cdmsf_sec1;
27368 		cdb[8] = msf->cdmsf_frame1;
27369 	}
27370 	com->uscsi_cdb    = cdb;
27371 	com->uscsi_cdblen = CDB_GROUP1;
27372 	com->uscsi_flags  = USCSI_DIAGNOSE|USCSI_SILENT;
27373 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27374 	    SD_PATH_STANDARD);
27375 	kmem_free(com, sizeof (*com));
27376 	return (rval);
27377 }
27378 
27379 
27380 /*
27381  *    Function: sr_play_trkind()
27382  *
27383  * Description: This routine is the driver entry point for handling CD-ROM
27384  *		ioctl requests to output the audio signals at the specified
27385  *		starting address and continue the audio play until the specified
27386  *		ending address (CDROMPLAYTRKIND). The address is in Track Index
27387  *		format.
27388  *
27389  *   Arguments: dev	- the device 'dev_t'
27390  *		data	- pointer to user provided audio track/index structure,
27391  *		          specifying start/end addresses.
27392  *		flag	- this argument is a pass through to ddi_copyxxx()
27393  *		          directly from the mode argument of ioctl().
27394  *
27395  * Return Code: the code returned by sd_send_scsi_cmd()
27396  *		EFAULT if ddi_copyxxx() fails
27397  *		ENXIO if fail ddi_get_soft_state
27398  *		EINVAL if data pointer is NULL
27399  */
27400 
27401 static int
27402 sr_play_trkind(dev_t dev, caddr_t data, int flag)
27403 {
27404 	struct cdrom_ti		ti_struct;
27405 	struct cdrom_ti		*ti = &ti_struct;
27406 	struct uscsi_cmd	*com = NULL;
27407 	char			cdb[CDB_GROUP1];
27408 	int			rval;
27409 
27410 	if (data == NULL) {
27411 		return (EINVAL);
27412 	}
27413 
27414 	if (ddi_copyin(data, ti, sizeof (struct cdrom_ti), flag)) {
27415 		return (EFAULT);
27416 	}
27417 
27418 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27419 	bzero(cdb, CDB_GROUP1);
27420 	cdb[0] = SCMD_PLAYAUDIO_TI;
27421 	cdb[4] = ti->cdti_trk0;
27422 	cdb[5] = ti->cdti_ind0;
27423 	cdb[7] = ti->cdti_trk1;
27424 	cdb[8] = ti->cdti_ind1;
27425 	com->uscsi_cdb    = cdb;
27426 	com->uscsi_cdblen = CDB_GROUP1;
27427 	com->uscsi_flags  = USCSI_DIAGNOSE|USCSI_SILENT;
27428 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27429 	    SD_PATH_STANDARD);
27430 	kmem_free(com, sizeof (*com));
27431 	return (rval);
27432 }
27433 
27434 
27435 /*
27436  *    Function: sr_read_all_subcodes()
27437  *
27438  * Description: This routine is the driver entry point for handling CD-ROM
27439  *		ioctl requests to return raw subcode data while the target is
27440  *		playing audio (CDROMSUBCODE).
27441  *
27442  *   Arguments: dev	- the device 'dev_t'
27443  *		data	- pointer to user provided cdrom subcode structure,
27444  *		          specifying the transfer length and address.
27445  *		flag	- this argument is a pass through to ddi_copyxxx()
27446  *		          directly from the mode argument of ioctl().
27447  *
27448  * Return Code: the code returned by sd_send_scsi_cmd()
27449  *		EFAULT if ddi_copyxxx() fails
27450  *		ENXIO if fail ddi_get_soft_state
27451  *		EINVAL if data pointer is NULL
27452  */
27453 
27454 static int
27455 sr_read_all_subcodes(dev_t dev, caddr_t data, int flag)
27456 {
27457 	struct sd_lun		*un = NULL;
27458 	struct uscsi_cmd	*com = NULL;
27459 	struct cdrom_subcode	*subcode = NULL;
27460 	int			rval;
27461 	size_t			buflen;
27462 	char			cdb[CDB_GROUP5];
27463 
27464 #ifdef _MULTI_DATAMODEL
27465 	/* To support ILP32 applications in an LP64 world */
27466 	struct cdrom_subcode32		cdrom_subcode32;
27467 	struct cdrom_subcode32		*cdsc32 = &cdrom_subcode32;
27468 #endif
27469 	if (data == NULL) {
27470 		return (EINVAL);
27471 	}
27472 
27473 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
27474 		return (ENXIO);
27475 	}
27476 
27477 	subcode = kmem_zalloc(sizeof (struct cdrom_subcode), KM_SLEEP);
27478 
27479 #ifdef _MULTI_DATAMODEL
27480 	switch (ddi_model_convert_from(flag & FMODELS)) {
27481 	case DDI_MODEL_ILP32:
27482 		if (ddi_copyin(data, cdsc32, sizeof (*cdsc32), flag)) {
27483 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27484 			    "sr_read_all_subcodes: ddi_copyin Failed\n");
27485 			kmem_free(subcode, sizeof (struct cdrom_subcode));
27486 			return (EFAULT);
27487 		}
27488 		/* Convert the ILP32 uscsi data from the application to LP64 */
27489 		cdrom_subcode32tocdrom_subcode(cdsc32, subcode);
27490 		break;
27491 	case DDI_MODEL_NONE:
27492 		if (ddi_copyin(data, subcode,
27493 		    sizeof (struct cdrom_subcode), flag)) {
27494 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27495 			    "sr_read_all_subcodes: ddi_copyin Failed\n");
27496 			kmem_free(subcode, sizeof (struct cdrom_subcode));
27497 			return (EFAULT);
27498 		}
27499 		break;
27500 	}
27501 #else /* ! _MULTI_DATAMODEL */
27502 	if (ddi_copyin(data, subcode, sizeof (struct cdrom_subcode), flag)) {
27503 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27504 		    "sr_read_all_subcodes: ddi_copyin Failed\n");
27505 		kmem_free(subcode, sizeof (struct cdrom_subcode));
27506 		return (EFAULT);
27507 	}
27508 #endif /* _MULTI_DATAMODEL */
27509 
27510 	/*
27511 	 * Since MMC-2 expects max 3 bytes for length, check if the
27512 	 * length input is greater than 3 bytes
27513 	 */
27514 	if ((subcode->cdsc_length & 0xFF000000) != 0) {
27515 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
27516 		    "sr_read_all_subcodes: "
27517 		    "cdrom transfer length too large: %d (limit %d)\n",
27518 		    subcode->cdsc_length, 0xFFFFFF);
27519 		kmem_free(subcode, sizeof (struct cdrom_subcode));
27520 		return (EINVAL);
27521 	}
27522 
27523 	buflen = CDROM_BLK_SUBCODE * subcode->cdsc_length;
27524 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27525 	bzero(cdb, CDB_GROUP5);
27526 
27527 	if (un->un_f_mmc_cap == TRUE) {
27528 		cdb[0] = (char)SCMD_READ_CD;
27529 		cdb[2] = (char)0xff;
27530 		cdb[3] = (char)0xff;
27531 		cdb[4] = (char)0xff;
27532 		cdb[5] = (char)0xff;
27533 		cdb[6] = (((subcode->cdsc_length) & 0x00ff0000) >> 16);
27534 		cdb[7] = (((subcode->cdsc_length) & 0x0000ff00) >> 8);
27535 		cdb[8] = ((subcode->cdsc_length) & 0x000000ff);
27536 		cdb[10] = 1;
27537 	} else {
27538 		/*
27539 		 * Note: A vendor specific command (0xDF) is being used her to
27540 		 * request a read of all subcodes.
27541 		 */
27542 		cdb[0] = (char)SCMD_READ_ALL_SUBCODES;
27543 		cdb[6] = (((subcode->cdsc_length) & 0xff000000) >> 24);
27544 		cdb[7] = (((subcode->cdsc_length) & 0x00ff0000) >> 16);
27545 		cdb[8] = (((subcode->cdsc_length) & 0x0000ff00) >> 8);
27546 		cdb[9] = ((subcode->cdsc_length) & 0x000000ff);
27547 	}
27548 	com->uscsi_cdb	   = cdb;
27549 	com->uscsi_cdblen  = CDB_GROUP5;
27550 	com->uscsi_bufaddr = (caddr_t)subcode->cdsc_addr;
27551 	com->uscsi_buflen  = buflen;
27552 	com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
27553 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
27554 	    SD_PATH_STANDARD);
27555 	kmem_free(subcode, sizeof (struct cdrom_subcode));
27556 	kmem_free(com, sizeof (*com));
27557 	return (rval);
27558 }
27559 
27560 
27561 /*
27562  *    Function: sr_read_subchannel()
27563  *
27564  * Description: This routine is the driver entry point for handling CD-ROM
27565  *		ioctl requests to return the Q sub-channel data of the CD
27566  *		current position block. (CDROMSUBCHNL) The data includes the
27567  *		track number, index number, absolute CD-ROM address (LBA or MSF
27568  *		format per the user) , track relative CD-ROM address (LBA or MSF
27569  *		format per the user), control data and audio status.
27570  *
27571  *   Arguments: dev	- the device 'dev_t'
27572  *		data	- pointer to user provided cdrom sub-channel structure
27573  *		flag	- this argument is a pass through to ddi_copyxxx()
27574  *		          directly from the mode argument of ioctl().
27575  *
27576  * Return Code: the code returned by sd_send_scsi_cmd()
27577  *		EFAULT if ddi_copyxxx() fails
27578  *		ENXIO if fail ddi_get_soft_state
27579  *		EINVAL if data pointer is NULL
27580  */
27581 
27582 static int
27583 sr_read_subchannel(dev_t dev, caddr_t data, int flag)
27584 {
27585 	struct sd_lun		*un;
27586 	struct uscsi_cmd	*com;
27587 	struct cdrom_subchnl	subchanel;
27588 	struct cdrom_subchnl	*subchnl = &subchanel;
27589 	char			cdb[CDB_GROUP1];
27590 	caddr_t			buffer;
27591 	int			rval;
27592 
27593 	if (data == NULL) {
27594 		return (EINVAL);
27595 	}
27596 
27597 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
27598 	    (un->un_state == SD_STATE_OFFLINE)) {
27599 		return (ENXIO);
27600 	}
27601 
27602 	if (ddi_copyin(data, subchnl, sizeof (struct cdrom_subchnl), flag)) {
27603 		return (EFAULT);
27604 	}
27605 
27606 	buffer = kmem_zalloc((size_t)16, KM_SLEEP);
27607 	bzero(cdb, CDB_GROUP1);
27608 	cdb[0] = SCMD_READ_SUBCHANNEL;
27609 	/* Set the MSF bit based on the user requested address format */
27610 	cdb[1] = (subchnl->cdsc_format & CDROM_LBA) ? 0 : 0x02;
27611 	/*
27612 	 * Set the Q bit in byte 2 to indicate that Q sub-channel data be
27613 	 * returned
27614 	 */
27615 	cdb[2] = 0x40;
27616 	/*
27617 	 * Set byte 3 to specify the return data format. A value of 0x01
27618 	 * indicates that the CD-ROM current position should be returned.
27619 	 */
27620 	cdb[3] = 0x01;
27621 	cdb[8] = 0x10;
27622 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27623 	com->uscsi_cdb	   = cdb;
27624 	com->uscsi_cdblen  = CDB_GROUP1;
27625 	com->uscsi_bufaddr = buffer;
27626 	com->uscsi_buflen  = 16;
27627 	com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
27628 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27629 	    SD_PATH_STANDARD);
27630 	if (rval != 0) {
27631 		kmem_free(buffer, 16);
27632 		kmem_free(com, sizeof (*com));
27633 		return (rval);
27634 	}
27635 
27636 	/* Process the returned Q sub-channel data */
27637 	subchnl->cdsc_audiostatus = buffer[1];
27638 	subchnl->cdsc_adr	= (buffer[5] & 0xF0);
27639 	subchnl->cdsc_ctrl	= (buffer[5] & 0x0F);
27640 	subchnl->cdsc_trk	= buffer[6];
27641 	subchnl->cdsc_ind	= buffer[7];
27642 	if (subchnl->cdsc_format & CDROM_LBA) {
27643 		subchnl->cdsc_absaddr.lba =
27644 		    ((uchar_t)buffer[8] << 24) + ((uchar_t)buffer[9] << 16) +
27645 		    ((uchar_t)buffer[10] << 8) + ((uchar_t)buffer[11]);
27646 		subchnl->cdsc_reladdr.lba =
27647 		    ((uchar_t)buffer[12] << 24) + ((uchar_t)buffer[13] << 16) +
27648 		    ((uchar_t)buffer[14] << 8) + ((uchar_t)buffer[15]);
27649 	} else if (un->un_f_cfg_readsub_bcd == TRUE) {
27650 		subchnl->cdsc_absaddr.msf.minute = BCD_TO_BYTE(buffer[9]);
27651 		subchnl->cdsc_absaddr.msf.second = BCD_TO_BYTE(buffer[10]);
27652 		subchnl->cdsc_absaddr.msf.frame  = BCD_TO_BYTE(buffer[11]);
27653 		subchnl->cdsc_reladdr.msf.minute = BCD_TO_BYTE(buffer[13]);
27654 		subchnl->cdsc_reladdr.msf.second = BCD_TO_BYTE(buffer[14]);
27655 		subchnl->cdsc_reladdr.msf.frame  = BCD_TO_BYTE(buffer[15]);
27656 	} else {
27657 		subchnl->cdsc_absaddr.msf.minute = buffer[9];
27658 		subchnl->cdsc_absaddr.msf.second = buffer[10];
27659 		subchnl->cdsc_absaddr.msf.frame  = buffer[11];
27660 		subchnl->cdsc_reladdr.msf.minute = buffer[13];
27661 		subchnl->cdsc_reladdr.msf.second = buffer[14];
27662 		subchnl->cdsc_reladdr.msf.frame  = buffer[15];
27663 	}
27664 	kmem_free(buffer, 16);
27665 	kmem_free(com, sizeof (*com));
27666 	if (ddi_copyout(subchnl, data, sizeof (struct cdrom_subchnl), flag)
27667 	    != 0) {
27668 		return (EFAULT);
27669 	}
27670 	return (rval);
27671 }
27672 
27673 
27674 /*
27675  *    Function: sr_read_tocentry()
27676  *
27677  * Description: This routine is the driver entry point for handling CD-ROM
27678  *		ioctl requests to read from the Table of Contents (TOC)
27679  *		(CDROMREADTOCENTRY). This routine provides the ADR and CTRL
27680  *		fields, the starting address (LBA or MSF format per the user)
27681  *		and the data mode if the user specified track is a data track.
27682  *
27683  *		Note: The READ HEADER (0x44) command used in this routine is
27684  *		obsolete per the SCSI MMC spec but still supported in the
27685  *		MT FUJI vendor spec. Most equipment is adhereing to MT FUJI
27686  *		therefore the command is still implemented in this routine.
27687  *
27688  *   Arguments: dev	- the device 'dev_t'
27689  *		data	- pointer to user provided toc entry structure,
27690  *			  specifying the track # and the address format
27691  *			  (LBA or MSF).
27692  *		flag	- this argument is a pass through to ddi_copyxxx()
27693  *		          directly from the mode argument of ioctl().
27694  *
27695  * Return Code: the code returned by sd_send_scsi_cmd()
27696  *		EFAULT if ddi_copyxxx() fails
27697  *		ENXIO if fail ddi_get_soft_state
27698  *		EINVAL if data pointer is NULL
27699  */
27700 
27701 static int
27702 sr_read_tocentry(dev_t dev, caddr_t data, int flag)
27703 {
27704 	struct sd_lun		*un = NULL;
27705 	struct uscsi_cmd	*com;
27706 	struct cdrom_tocentry	toc_entry;
27707 	struct cdrom_tocentry	*entry = &toc_entry;
27708 	caddr_t			buffer;
27709 	int			rval;
27710 	char			cdb[CDB_GROUP1];
27711 
27712 	if (data == NULL) {
27713 		return (EINVAL);
27714 	}
27715 
27716 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
27717 	    (un->un_state == SD_STATE_OFFLINE)) {
27718 		return (ENXIO);
27719 	}
27720 
27721 	if (ddi_copyin(data, entry, sizeof (struct cdrom_tocentry), flag)) {
27722 		return (EFAULT);
27723 	}
27724 
27725 	/* Validate the requested track and address format */
27726 	if (!(entry->cdte_format & (CDROM_LBA | CDROM_MSF))) {
27727 		return (EINVAL);
27728 	}
27729 
27730 	if (entry->cdte_track == 0) {
27731 		return (EINVAL);
27732 	}
27733 
27734 	buffer = kmem_zalloc((size_t)12, KM_SLEEP);
27735 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27736 	bzero(cdb, CDB_GROUP1);
27737 
27738 	cdb[0] = SCMD_READ_TOC;
27739 	/* Set the MSF bit based on the user requested address format  */
27740 	cdb[1] = ((entry->cdte_format & CDROM_LBA) ? 0 : 2);
27741 	if (un->un_f_cfg_read_toc_trk_bcd == TRUE) {
27742 		cdb[6] = BYTE_TO_BCD(entry->cdte_track);
27743 	} else {
27744 		cdb[6] = entry->cdte_track;
27745 	}
27746 
27747 	/*
27748 	 * Bytes 7 & 8 are the 12 byte allocation length for a single entry.
27749 	 * (4 byte TOC response header + 8 byte track descriptor)
27750 	 */
27751 	cdb[8] = 12;
27752 	com->uscsi_cdb	   = cdb;
27753 	com->uscsi_cdblen  = CDB_GROUP1;
27754 	com->uscsi_bufaddr = buffer;
27755 	com->uscsi_buflen  = 0x0C;
27756 	com->uscsi_flags   = (USCSI_DIAGNOSE | USCSI_SILENT | USCSI_READ);
27757 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27758 	    SD_PATH_STANDARD);
27759 	if (rval != 0) {
27760 		kmem_free(buffer, 12);
27761 		kmem_free(com, sizeof (*com));
27762 		return (rval);
27763 	}
27764 
27765 	/* Process the toc entry */
27766 	entry->cdte_adr		= (buffer[5] & 0xF0) >> 4;
27767 	entry->cdte_ctrl	= (buffer[5] & 0x0F);
27768 	if (entry->cdte_format & CDROM_LBA) {
27769 		entry->cdte_addr.lba =
27770 		    ((uchar_t)buffer[8] << 24) + ((uchar_t)buffer[9] << 16) +
27771 		    ((uchar_t)buffer[10] << 8) + ((uchar_t)buffer[11]);
27772 	} else if (un->un_f_cfg_read_toc_addr_bcd == TRUE) {
27773 		entry->cdte_addr.msf.minute	= BCD_TO_BYTE(buffer[9]);
27774 		entry->cdte_addr.msf.second	= BCD_TO_BYTE(buffer[10]);
27775 		entry->cdte_addr.msf.frame	= BCD_TO_BYTE(buffer[11]);
27776 		/*
27777 		 * Send a READ TOC command using the LBA address format to get
27778 		 * the LBA for the track requested so it can be used in the
27779 		 * READ HEADER request
27780 		 *
27781 		 * Note: The MSF bit of the READ HEADER command specifies the
27782 		 * output format. The block address specified in that command
27783 		 * must be in LBA format.
27784 		 */
27785 		cdb[1] = 0;
27786 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27787 		    SD_PATH_STANDARD);
27788 		if (rval != 0) {
27789 			kmem_free(buffer, 12);
27790 			kmem_free(com, sizeof (*com));
27791 			return (rval);
27792 		}
27793 	} else {
27794 		entry->cdte_addr.msf.minute	= buffer[9];
27795 		entry->cdte_addr.msf.second	= buffer[10];
27796 		entry->cdte_addr.msf.frame	= buffer[11];
27797 		/*
27798 		 * Send a READ TOC command using the LBA address format to get
27799 		 * the LBA for the track requested so it can be used in the
27800 		 * READ HEADER request
27801 		 *
27802 		 * Note: The MSF bit of the READ HEADER command specifies the
27803 		 * output format. The block address specified in that command
27804 		 * must be in LBA format.
27805 		 */
27806 		cdb[1] = 0;
27807 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27808 		    SD_PATH_STANDARD);
27809 		if (rval != 0) {
27810 			kmem_free(buffer, 12);
27811 			kmem_free(com, sizeof (*com));
27812 			return (rval);
27813 		}
27814 	}
27815 
27816 	/*
27817 	 * Build and send the READ HEADER command to determine the data mode of
27818 	 * the user specified track.
27819 	 */
27820 	if ((entry->cdte_ctrl & CDROM_DATA_TRACK) &&
27821 	    (entry->cdte_track != CDROM_LEADOUT)) {
27822 		bzero(cdb, CDB_GROUP1);
27823 		cdb[0] = SCMD_READ_HEADER;
27824 		cdb[2] = buffer[8];
27825 		cdb[3] = buffer[9];
27826 		cdb[4] = buffer[10];
27827 		cdb[5] = buffer[11];
27828 		cdb[8] = 0x08;
27829 		com->uscsi_buflen = 0x08;
27830 		rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27831 		    SD_PATH_STANDARD);
27832 		if (rval == 0) {
27833 			entry->cdte_datamode = buffer[0];
27834 		} else {
27835 			/*
27836 			 * READ HEADER command failed, since this is
27837 			 * obsoleted in one spec, its better to return
27838 			 * -1 for an invlid track so that we can still
27839 			 * receive the rest of the TOC data.
27840 			 */
27841 			entry->cdte_datamode = (uchar_t)-1;
27842 		}
27843 	} else {
27844 		entry->cdte_datamode = (uchar_t)-1;
27845 	}
27846 
27847 	kmem_free(buffer, 12);
27848 	kmem_free(com, sizeof (*com));
27849 	if (ddi_copyout(entry, data, sizeof (struct cdrom_tocentry), flag) != 0)
27850 		return (EFAULT);
27851 
27852 	return (rval);
27853 }
27854 
27855 
27856 /*
27857  *    Function: sr_read_tochdr()
27858  *
27859  * Description: This routine is the driver entry point for handling CD-ROM
27860  * 		ioctl requests to read the Table of Contents (TOC) header
27861  *		(CDROMREADTOHDR). The TOC header consists of the disk starting
27862  *		and ending track numbers
27863  *
27864  *   Arguments: dev	- the device 'dev_t'
27865  *		data	- pointer to user provided toc header structure,
27866  *			  specifying the starting and ending track numbers.
27867  *		flag	- this argument is a pass through to ddi_copyxxx()
27868  *			  directly from the mode argument of ioctl().
27869  *
27870  * Return Code: the code returned by sd_send_scsi_cmd()
27871  *		EFAULT if ddi_copyxxx() fails
27872  *		ENXIO if fail ddi_get_soft_state
27873  *		EINVAL if data pointer is NULL
27874  */
27875 
27876 static int
27877 sr_read_tochdr(dev_t dev, caddr_t data, int flag)
27878 {
27879 	struct sd_lun		*un;
27880 	struct uscsi_cmd	*com;
27881 	struct cdrom_tochdr	toc_header;
27882 	struct cdrom_tochdr	*hdr = &toc_header;
27883 	char			cdb[CDB_GROUP1];
27884 	int			rval;
27885 	caddr_t			buffer;
27886 
27887 	if (data == NULL) {
27888 		return (EINVAL);
27889 	}
27890 
27891 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
27892 	    (un->un_state == SD_STATE_OFFLINE)) {
27893 		return (ENXIO);
27894 	}
27895 
27896 	buffer = kmem_zalloc(4, KM_SLEEP);
27897 	bzero(cdb, CDB_GROUP1);
27898 	cdb[0] = SCMD_READ_TOC;
27899 	/*
27900 	 * Specifying a track number of 0x00 in the READ TOC command indicates
27901 	 * that the TOC header should be returned
27902 	 */
27903 	cdb[6] = 0x00;
27904 	/*
27905 	 * Bytes 7 & 8 are the 4 byte allocation length for TOC header.
27906 	 * (2 byte data len + 1 byte starting track # + 1 byte ending track #)
27907 	 */
27908 	cdb[8] = 0x04;
27909 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
27910 	com->uscsi_cdb	   = cdb;
27911 	com->uscsi_cdblen  = CDB_GROUP1;
27912 	com->uscsi_bufaddr = buffer;
27913 	com->uscsi_buflen  = 0x04;
27914 	com->uscsi_timeout = 300;
27915 	com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
27916 
27917 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
27918 	    SD_PATH_STANDARD);
27919 	if (un->un_f_cfg_read_toc_trk_bcd == TRUE) {
27920 		hdr->cdth_trk0 = BCD_TO_BYTE(buffer[2]);
27921 		hdr->cdth_trk1 = BCD_TO_BYTE(buffer[3]);
27922 	} else {
27923 		hdr->cdth_trk0 = buffer[2];
27924 		hdr->cdth_trk1 = buffer[3];
27925 	}
27926 	kmem_free(buffer, 4);
27927 	kmem_free(com, sizeof (*com));
27928 	if (ddi_copyout(hdr, data, sizeof (struct cdrom_tochdr), flag) != 0) {
27929 		return (EFAULT);
27930 	}
27931 	return (rval);
27932 }
27933 
27934 
27935 /*
27936  * Note: The following sr_read_mode1(), sr_read_cd_mode2(), sr_read_mode2(),
27937  * sr_read_cdda(), sr_read_cdxa(), routines implement driver support for
27938  * handling CDROMREAD ioctl requests for mode 1 user data, mode 2 user data,
27939  * digital audio and extended architecture digital audio. These modes are
27940  * defined in the IEC908 (Red Book), ISO10149 (Yellow Book), and the SCSI3
27941  * MMC specs.
27942  *
27943  * In addition to support for the various data formats these routines also
27944  * include support for devices that implement only the direct access READ
27945  * commands (0x08, 0x28), devices that implement the READ_CD commands
27946  * (0xBE, 0xD4), and devices that implement the vendor unique READ CDDA and
27947  * READ CDXA commands (0xD8, 0xDB)
27948  */
27949 
27950 /*
27951  *    Function: sr_read_mode1()
27952  *
27953  * Description: This routine is the driver entry point for handling CD-ROM
27954  *		ioctl read mode1 requests (CDROMREADMODE1).
27955  *
27956  *   Arguments: dev	- the device 'dev_t'
27957  *		data	- pointer to user provided cd read structure specifying
27958  *			  the lba buffer address and length.
27959  *		flag	- this argument is a pass through to ddi_copyxxx()
27960  *			  directly from the mode argument of ioctl().
27961  *
27962  * Return Code: the code returned by sd_send_scsi_cmd()
27963  *		EFAULT if ddi_copyxxx() fails
27964  *		ENXIO if fail ddi_get_soft_state
27965  *		EINVAL if data pointer is NULL
27966  */
27967 
27968 static int
27969 sr_read_mode1(dev_t dev, caddr_t data, int flag)
27970 {
27971 	struct sd_lun		*un;
27972 	struct cdrom_read	mode1_struct;
27973 	struct cdrom_read	*mode1 = &mode1_struct;
27974 	int			rval;
27975 	sd_ssc_t		*ssc;
27976 
27977 #ifdef _MULTI_DATAMODEL
27978 	/* To support ILP32 applications in an LP64 world */
27979 	struct cdrom_read32	cdrom_read32;
27980 	struct cdrom_read32	*cdrd32 = &cdrom_read32;
27981 #endif /* _MULTI_DATAMODEL */
27982 
27983 	if (data == NULL) {
27984 		return (EINVAL);
27985 	}
27986 
27987 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
27988 	    (un->un_state == SD_STATE_OFFLINE)) {
27989 		return (ENXIO);
27990 	}
27991 
27992 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
27993 	    "sd_read_mode1: entry: un:0x%p\n", un);
27994 
27995 #ifdef _MULTI_DATAMODEL
27996 	switch (ddi_model_convert_from(flag & FMODELS)) {
27997 	case DDI_MODEL_ILP32:
27998 		if (ddi_copyin(data, cdrd32, sizeof (*cdrd32), flag) != 0) {
27999 			return (EFAULT);
28000 		}
28001 		/* Convert the ILP32 uscsi data from the application to LP64 */
28002 		cdrom_read32tocdrom_read(cdrd32, mode1);
28003 		break;
28004 	case DDI_MODEL_NONE:
28005 		if (ddi_copyin(data, mode1, sizeof (struct cdrom_read), flag)) {
28006 			return (EFAULT);
28007 		}
28008 	}
28009 #else /* ! _MULTI_DATAMODEL */
28010 	if (ddi_copyin(data, mode1, sizeof (struct cdrom_read), flag)) {
28011 		return (EFAULT);
28012 	}
28013 #endif /* _MULTI_DATAMODEL */
28014 
28015 	ssc = sd_ssc_init(un);
28016 	rval = sd_send_scsi_READ(ssc, mode1->cdread_bufaddr,
28017 	    mode1->cdread_buflen, mode1->cdread_lba, SD_PATH_STANDARD);
28018 	sd_ssc_fini(ssc);
28019 
28020 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
28021 	    "sd_read_mode1: exit: un:0x%p\n", un);
28022 
28023 	return (rval);
28024 }
28025 
28026 
28027 /*
28028  *    Function: sr_read_cd_mode2()
28029  *
28030  * Description: This routine is the driver entry point for handling CD-ROM
28031  *		ioctl read mode2 requests (CDROMREADMODE2) for devices that
28032  *		support the READ CD (0xBE) command or the 1st generation
28033  *		READ CD (0xD4) command.
28034  *
28035  *   Arguments: dev	- the device 'dev_t'
28036  *		data	- pointer to user provided cd read structure specifying
28037  *			  the lba buffer address and length.
28038  *		flag	- this argument is a pass through to ddi_copyxxx()
28039  *			  directly from the mode argument of ioctl().
28040  *
28041  * Return Code: the code returned by sd_send_scsi_cmd()
28042  *		EFAULT if ddi_copyxxx() fails
28043  *		ENXIO if fail ddi_get_soft_state
28044  *		EINVAL if data pointer is NULL
28045  */
28046 
28047 static int
28048 sr_read_cd_mode2(dev_t dev, caddr_t data, int flag)
28049 {
28050 	struct sd_lun		*un;
28051 	struct uscsi_cmd	*com;
28052 	struct cdrom_read	mode2_struct;
28053 	struct cdrom_read	*mode2 = &mode2_struct;
28054 	uchar_t			cdb[CDB_GROUP5];
28055 	int			nblocks;
28056 	int			rval;
28057 #ifdef _MULTI_DATAMODEL
28058 	/*  To support ILP32 applications in an LP64 world */
28059 	struct cdrom_read32	cdrom_read32;
28060 	struct cdrom_read32	*cdrd32 = &cdrom_read32;
28061 #endif /* _MULTI_DATAMODEL */
28062 
28063 	if (data == NULL) {
28064 		return (EINVAL);
28065 	}
28066 
28067 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28068 	    (un->un_state == SD_STATE_OFFLINE)) {
28069 		return (ENXIO);
28070 	}
28071 
28072 #ifdef _MULTI_DATAMODEL
28073 	switch (ddi_model_convert_from(flag & FMODELS)) {
28074 	case DDI_MODEL_ILP32:
28075 		if (ddi_copyin(data, cdrd32, sizeof (*cdrd32), flag) != 0) {
28076 			return (EFAULT);
28077 		}
28078 		/* Convert the ILP32 uscsi data from the application to LP64 */
28079 		cdrom_read32tocdrom_read(cdrd32, mode2);
28080 		break;
28081 	case DDI_MODEL_NONE:
28082 		if (ddi_copyin(data, mode2, sizeof (*mode2), flag) != 0) {
28083 			return (EFAULT);
28084 		}
28085 		break;
28086 	}
28087 
28088 #else /* ! _MULTI_DATAMODEL */
28089 	if (ddi_copyin(data, mode2, sizeof (*mode2), flag) != 0) {
28090 		return (EFAULT);
28091 	}
28092 #endif /* _MULTI_DATAMODEL */
28093 
28094 	bzero(cdb, sizeof (cdb));
28095 	if (un->un_f_cfg_read_cd_xd4 == TRUE) {
28096 		/* Read command supported by 1st generation atapi drives */
28097 		cdb[0] = SCMD_READ_CDD4;
28098 	} else {
28099 		/* Universal CD Access Command */
28100 		cdb[0] = SCMD_READ_CD;
28101 	}
28102 
28103 	/*
28104 	 * Set expected sector type to: 2336s byte, Mode 2 Yellow Book
28105 	 */
28106 	cdb[1] = CDROM_SECTOR_TYPE_MODE2;
28107 
28108 	/* set the start address */
28109 	cdb[2] = (uchar_t)((mode2->cdread_lba >> 24) & 0XFF);
28110 	cdb[3] = (uchar_t)((mode2->cdread_lba >> 16) & 0XFF);
28111 	cdb[4] = (uchar_t)((mode2->cdread_lba >> 8) & 0xFF);
28112 	cdb[5] = (uchar_t)(mode2->cdread_lba & 0xFF);
28113 
28114 	/* set the transfer length */
28115 	nblocks = mode2->cdread_buflen / 2336;
28116 	cdb[6] = (uchar_t)(nblocks >> 16);
28117 	cdb[7] = (uchar_t)(nblocks >> 8);
28118 	cdb[8] = (uchar_t)nblocks;
28119 
28120 	/* set the filter bits */
28121 	cdb[9] = CDROM_READ_CD_USERDATA;
28122 
28123 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28124 	com->uscsi_cdb = (caddr_t)cdb;
28125 	com->uscsi_cdblen = sizeof (cdb);
28126 	com->uscsi_bufaddr = mode2->cdread_bufaddr;
28127 	com->uscsi_buflen = mode2->cdread_buflen;
28128 	com->uscsi_flags = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28129 
28130 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
28131 	    SD_PATH_STANDARD);
28132 	kmem_free(com, sizeof (*com));
28133 	return (rval);
28134 }
28135 
28136 
28137 /*
28138  *    Function: sr_read_mode2()
28139  *
28140  * Description: This routine is the driver entry point for handling CD-ROM
28141  *		ioctl read mode2 requests (CDROMREADMODE2) for devices that
28142  *		do not support the READ CD (0xBE) command.
28143  *
28144  *   Arguments: dev	- the device 'dev_t'
28145  *		data	- pointer to user provided cd read structure specifying
28146  *			  the lba buffer address and length.
28147  *		flag	- this argument is a pass through to ddi_copyxxx()
28148  *			  directly from the mode argument of ioctl().
28149  *
28150  * Return Code: the code returned by sd_send_scsi_cmd()
28151  *		EFAULT if ddi_copyxxx() fails
28152  *		ENXIO if fail ddi_get_soft_state
28153  *		EINVAL if data pointer is NULL
28154  *		EIO if fail to reset block size
28155  *		EAGAIN if commands are in progress in the driver
28156  */
28157 
28158 static int
28159 sr_read_mode2(dev_t dev, caddr_t data, int flag)
28160 {
28161 	struct sd_lun		*un;
28162 	struct cdrom_read	mode2_struct;
28163 	struct cdrom_read	*mode2 = &mode2_struct;
28164 	int			rval;
28165 	uint32_t		restore_blksize;
28166 	struct uscsi_cmd	*com;
28167 	uchar_t			cdb[CDB_GROUP0];
28168 	int			nblocks;
28169 
28170 #ifdef _MULTI_DATAMODEL
28171 	/* To support ILP32 applications in an LP64 world */
28172 	struct cdrom_read32	cdrom_read32;
28173 	struct cdrom_read32	*cdrd32 = &cdrom_read32;
28174 #endif /* _MULTI_DATAMODEL */
28175 
28176 	if (data == NULL) {
28177 		return (EINVAL);
28178 	}
28179 
28180 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28181 	    (un->un_state == SD_STATE_OFFLINE)) {
28182 		return (ENXIO);
28183 	}
28184 
28185 	/*
28186 	 * Because this routine will update the device and driver block size
28187 	 * being used we want to make sure there are no commands in progress.
28188 	 * If commands are in progress the user will have to try again.
28189 	 *
28190 	 * We check for 1 instead of 0 because we increment un_ncmds_in_driver
28191 	 * in sdioctl to protect commands from sdioctl through to the top of
28192 	 * sd_uscsi_strategy. See sdioctl for details.
28193 	 */
28194 	mutex_enter(SD_MUTEX(un));
28195 	if (un->un_ncmds_in_driver != 1) {
28196 		mutex_exit(SD_MUTEX(un));
28197 		return (EAGAIN);
28198 	}
28199 	mutex_exit(SD_MUTEX(un));
28200 
28201 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
28202 	    "sd_read_mode2: entry: un:0x%p\n", un);
28203 
28204 #ifdef _MULTI_DATAMODEL
28205 	switch (ddi_model_convert_from(flag & FMODELS)) {
28206 	case DDI_MODEL_ILP32:
28207 		if (ddi_copyin(data, cdrd32, sizeof (*cdrd32), flag) != 0) {
28208 			return (EFAULT);
28209 		}
28210 		/* Convert the ILP32 uscsi data from the application to LP64 */
28211 		cdrom_read32tocdrom_read(cdrd32, mode2);
28212 		break;
28213 	case DDI_MODEL_NONE:
28214 		if (ddi_copyin(data, mode2, sizeof (*mode2), flag) != 0) {
28215 			return (EFAULT);
28216 		}
28217 		break;
28218 	}
28219 #else /* ! _MULTI_DATAMODEL */
28220 	if (ddi_copyin(data, mode2, sizeof (*mode2), flag)) {
28221 		return (EFAULT);
28222 	}
28223 #endif /* _MULTI_DATAMODEL */
28224 
28225 	/* Store the current target block size for restoration later */
28226 	restore_blksize = un->un_tgt_blocksize;
28227 
28228 	/* Change the device and soft state target block size to 2336 */
28229 	if (sr_sector_mode(dev, SD_MODE2_BLKSIZE) != 0) {
28230 		rval = EIO;
28231 		goto done;
28232 	}
28233 
28234 
28235 	bzero(cdb, sizeof (cdb));
28236 
28237 	/* set READ operation */
28238 	cdb[0] = SCMD_READ;
28239 
28240 	/* adjust lba for 2kbyte blocks from 512 byte blocks */
28241 	mode2->cdread_lba >>= 2;
28242 
28243 	/* set the start address */
28244 	cdb[1] = (uchar_t)((mode2->cdread_lba >> 16) & 0X1F);
28245 	cdb[2] = (uchar_t)((mode2->cdread_lba >> 8) & 0xFF);
28246 	cdb[3] = (uchar_t)(mode2->cdread_lba & 0xFF);
28247 
28248 	/* set the transfer length */
28249 	nblocks = mode2->cdread_buflen / 2336;
28250 	cdb[4] = (uchar_t)nblocks & 0xFF;
28251 
28252 	/* build command */
28253 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28254 	com->uscsi_cdb = (caddr_t)cdb;
28255 	com->uscsi_cdblen = sizeof (cdb);
28256 	com->uscsi_bufaddr = mode2->cdread_bufaddr;
28257 	com->uscsi_buflen = mode2->cdread_buflen;
28258 	com->uscsi_flags = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28259 
28260 	/*
28261 	 * Issue SCSI command with user space address for read buffer.
28262 	 *
28263 	 * This sends the command through main channel in the driver.
28264 	 *
28265 	 * Since this is accessed via an IOCTL call, we go through the
28266 	 * standard path, so that if the device was powered down, then
28267 	 * it would be 'awakened' to handle the command.
28268 	 */
28269 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
28270 	    SD_PATH_STANDARD);
28271 
28272 	kmem_free(com, sizeof (*com));
28273 
28274 	/* Restore the device and soft state target block size */
28275 	if (sr_sector_mode(dev, restore_blksize) != 0) {
28276 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28277 		    "can't do switch back to mode 1\n");
28278 		/*
28279 		 * If sd_send_scsi_READ succeeded we still need to report
28280 		 * an error because we failed to reset the block size
28281 		 */
28282 		if (rval == 0) {
28283 			rval = EIO;
28284 		}
28285 	}
28286 
28287 done:
28288 	SD_TRACE(SD_LOG_ATTACH_DETACH, un,
28289 	    "sd_read_mode2: exit: un:0x%p\n", un);
28290 
28291 	return (rval);
28292 }
28293 
28294 
28295 /*
28296  *    Function: sr_sector_mode()
28297  *
28298  * Description: This utility function is used by sr_read_mode2 to set the target
28299  *		block size based on the user specified size. This is a legacy
28300  *		implementation based upon a vendor specific mode page
28301  *
28302  *   Arguments: dev	- the device 'dev_t'
28303  *		data	- flag indicating if block size is being set to 2336 or
28304  *			  512.
28305  *
28306  * Return Code: the code returned by sd_send_scsi_cmd()
28307  *		EFAULT if ddi_copyxxx() fails
28308  *		ENXIO if fail ddi_get_soft_state
28309  *		EINVAL if data pointer is NULL
28310  */
28311 
28312 static int
28313 sr_sector_mode(dev_t dev, uint32_t blksize)
28314 {
28315 	struct sd_lun	*un;
28316 	uchar_t		*sense;
28317 	uchar_t		*select;
28318 	int		rval;
28319 	sd_ssc_t	*ssc;
28320 
28321 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28322 	    (un->un_state == SD_STATE_OFFLINE)) {
28323 		return (ENXIO);
28324 	}
28325 
28326 	sense = kmem_zalloc(20, KM_SLEEP);
28327 
28328 	/* Note: This is a vendor specific mode page (0x81) */
28329 	ssc = sd_ssc_init(un);
28330 	rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense, 20, 0x81,
28331 	    SD_PATH_STANDARD);
28332 	sd_ssc_fini(ssc);
28333 	if (rval != 0) {
28334 		SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un,
28335 		    "sr_sector_mode: Mode Sense failed\n");
28336 		kmem_free(sense, 20);
28337 		return (rval);
28338 	}
28339 	select = kmem_zalloc(20, KM_SLEEP);
28340 	select[3] = 0x08;
28341 	select[10] = ((blksize >> 8) & 0xff);
28342 	select[11] = (blksize & 0xff);
28343 	select[12] = 0x01;
28344 	select[13] = 0x06;
28345 	select[14] = sense[14];
28346 	select[15] = sense[15];
28347 	if (blksize == SD_MODE2_BLKSIZE) {
28348 		select[14] |= 0x01;
28349 	}
28350 
28351 	ssc = sd_ssc_init(un);
28352 	rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, select, 20,
28353 	    SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
28354 	sd_ssc_fini(ssc);
28355 	if (rval != 0) {
28356 		SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un,
28357 		    "sr_sector_mode: Mode Select failed\n");
28358 	} else {
28359 		/*
28360 		 * Only update the softstate block size if we successfully
28361 		 * changed the device block mode.
28362 		 */
28363 		mutex_enter(SD_MUTEX(un));
28364 		sd_update_block_info(un, blksize, 0);
28365 		mutex_exit(SD_MUTEX(un));
28366 	}
28367 	kmem_free(sense, 20);
28368 	kmem_free(select, 20);
28369 	return (rval);
28370 }
28371 
28372 
28373 /*
28374  *    Function: sr_read_cdda()
28375  *
28376  * Description: This routine is the driver entry point for handling CD-ROM
28377  *		ioctl requests to return CD-DA or subcode data. (CDROMCDDA) If
28378  *		the target supports CDDA these requests are handled via a vendor
28379  *		specific command (0xD8) If the target does not support CDDA
28380  *		these requests are handled via the READ CD command (0xBE).
28381  *
28382  *   Arguments: dev	- the device 'dev_t'
28383  *		data	- pointer to user provided CD-DA structure specifying
28384  *			  the track starting address, transfer length, and
28385  *			  subcode options.
28386  *		flag	- this argument is a pass through to ddi_copyxxx()
28387  *			  directly from the mode argument of ioctl().
28388  *
28389  * Return Code: the code returned by sd_send_scsi_cmd()
28390  *		EFAULT if ddi_copyxxx() fails
28391  *		ENXIO if fail ddi_get_soft_state
28392  *		EINVAL if invalid arguments are provided
28393  *		ENOTTY
28394  */
28395 
28396 static int
28397 sr_read_cdda(dev_t dev, caddr_t data, int flag)
28398 {
28399 	struct sd_lun			*un;
28400 	struct uscsi_cmd		*com;
28401 	struct cdrom_cdda		*cdda;
28402 	int				rval;
28403 	size_t				buflen;
28404 	char				cdb[CDB_GROUP5];
28405 
28406 #ifdef _MULTI_DATAMODEL
28407 	/* To support ILP32 applications in an LP64 world */
28408 	struct cdrom_cdda32	cdrom_cdda32;
28409 	struct cdrom_cdda32	*cdda32 = &cdrom_cdda32;
28410 #endif /* _MULTI_DATAMODEL */
28411 
28412 	if (data == NULL) {
28413 		return (EINVAL);
28414 	}
28415 
28416 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
28417 		return (ENXIO);
28418 	}
28419 
28420 	cdda = kmem_zalloc(sizeof (struct cdrom_cdda), KM_SLEEP);
28421 
28422 #ifdef _MULTI_DATAMODEL
28423 	switch (ddi_model_convert_from(flag & FMODELS)) {
28424 	case DDI_MODEL_ILP32:
28425 		if (ddi_copyin(data, cdda32, sizeof (*cdda32), flag)) {
28426 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28427 			    "sr_read_cdda: ddi_copyin Failed\n");
28428 			kmem_free(cdda, sizeof (struct cdrom_cdda));
28429 			return (EFAULT);
28430 		}
28431 		/* Convert the ILP32 uscsi data from the application to LP64 */
28432 		cdrom_cdda32tocdrom_cdda(cdda32, cdda);
28433 		break;
28434 	case DDI_MODEL_NONE:
28435 		if (ddi_copyin(data, cdda, sizeof (struct cdrom_cdda), flag)) {
28436 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28437 			    "sr_read_cdda: ddi_copyin Failed\n");
28438 			kmem_free(cdda, sizeof (struct cdrom_cdda));
28439 			return (EFAULT);
28440 		}
28441 		break;
28442 	}
28443 #else /* ! _MULTI_DATAMODEL */
28444 	if (ddi_copyin(data, cdda, sizeof (struct cdrom_cdda), flag)) {
28445 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28446 		    "sr_read_cdda: ddi_copyin Failed\n");
28447 		kmem_free(cdda, sizeof (struct cdrom_cdda));
28448 		return (EFAULT);
28449 	}
28450 #endif /* _MULTI_DATAMODEL */
28451 
28452 	/*
28453 	 * Since MMC-2 expects max 3 bytes for length, check if the
28454 	 * length input is greater than 3 bytes
28455 	 */
28456 	if ((cdda->cdda_length & 0xFF000000) != 0) {
28457 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN, "sr_read_cdda: "
28458 		    "cdrom transfer length too large: %d (limit %d)\n",
28459 		    cdda->cdda_length, 0xFFFFFF);
28460 		kmem_free(cdda, sizeof (struct cdrom_cdda));
28461 		return (EINVAL);
28462 	}
28463 
28464 	switch (cdda->cdda_subcode) {
28465 	case CDROM_DA_NO_SUBCODE:
28466 		buflen = CDROM_BLK_2352 * cdda->cdda_length;
28467 		break;
28468 	case CDROM_DA_SUBQ:
28469 		buflen = CDROM_BLK_2368 * cdda->cdda_length;
28470 		break;
28471 	case CDROM_DA_ALL_SUBCODE:
28472 		buflen = CDROM_BLK_2448 * cdda->cdda_length;
28473 		break;
28474 	case CDROM_DA_SUBCODE_ONLY:
28475 		buflen = CDROM_BLK_SUBCODE * cdda->cdda_length;
28476 		break;
28477 	default:
28478 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28479 		    "sr_read_cdda: Subcode '0x%x' Not Supported\n",
28480 		    cdda->cdda_subcode);
28481 		kmem_free(cdda, sizeof (struct cdrom_cdda));
28482 		return (EINVAL);
28483 	}
28484 
28485 	/* Build and send the command */
28486 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28487 	bzero(cdb, CDB_GROUP5);
28488 
28489 	if (un->un_f_cfg_cdda == TRUE) {
28490 		cdb[0] = (char)SCMD_READ_CD;
28491 		cdb[1] = 0x04;
28492 		cdb[2] = (((cdda->cdda_addr) & 0xff000000) >> 24);
28493 		cdb[3] = (((cdda->cdda_addr) & 0x00ff0000) >> 16);
28494 		cdb[4] = (((cdda->cdda_addr) & 0x0000ff00) >> 8);
28495 		cdb[5] = ((cdda->cdda_addr) & 0x000000ff);
28496 		cdb[6] = (((cdda->cdda_length) & 0x00ff0000) >> 16);
28497 		cdb[7] = (((cdda->cdda_length) & 0x0000ff00) >> 8);
28498 		cdb[8] = ((cdda->cdda_length) & 0x000000ff);
28499 		cdb[9] = 0x10;
28500 		switch (cdda->cdda_subcode) {
28501 		case CDROM_DA_NO_SUBCODE :
28502 			cdb[10] = 0x0;
28503 			break;
28504 		case CDROM_DA_SUBQ :
28505 			cdb[10] = 0x2;
28506 			break;
28507 		case CDROM_DA_ALL_SUBCODE :
28508 			cdb[10] = 0x1;
28509 			break;
28510 		case CDROM_DA_SUBCODE_ONLY :
28511 			/* FALLTHROUGH */
28512 		default :
28513 			kmem_free(cdda, sizeof (struct cdrom_cdda));
28514 			kmem_free(com, sizeof (*com));
28515 			return (ENOTTY);
28516 		}
28517 	} else {
28518 		cdb[0] = (char)SCMD_READ_CDDA;
28519 		cdb[2] = (((cdda->cdda_addr) & 0xff000000) >> 24);
28520 		cdb[3] = (((cdda->cdda_addr) & 0x00ff0000) >> 16);
28521 		cdb[4] = (((cdda->cdda_addr) & 0x0000ff00) >> 8);
28522 		cdb[5] = ((cdda->cdda_addr) & 0x000000ff);
28523 		cdb[6] = (((cdda->cdda_length) & 0xff000000) >> 24);
28524 		cdb[7] = (((cdda->cdda_length) & 0x00ff0000) >> 16);
28525 		cdb[8] = (((cdda->cdda_length) & 0x0000ff00) >> 8);
28526 		cdb[9] = ((cdda->cdda_length) & 0x000000ff);
28527 		cdb[10] = cdda->cdda_subcode;
28528 	}
28529 
28530 	com->uscsi_cdb = cdb;
28531 	com->uscsi_cdblen = CDB_GROUP5;
28532 	com->uscsi_bufaddr = (caddr_t)cdda->cdda_data;
28533 	com->uscsi_buflen = buflen;
28534 	com->uscsi_flags = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28535 
28536 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
28537 	    SD_PATH_STANDARD);
28538 
28539 	kmem_free(cdda, sizeof (struct cdrom_cdda));
28540 	kmem_free(com, sizeof (*com));
28541 	return (rval);
28542 }
28543 
28544 
28545 /*
28546  *    Function: sr_read_cdxa()
28547  *
28548  * Description: This routine is the driver entry point for handling CD-ROM
28549  *		ioctl requests to return CD-XA (Extended Architecture) data.
28550  *		(CDROMCDXA).
28551  *
28552  *   Arguments: dev	- the device 'dev_t'
28553  *		data	- pointer to user provided CD-XA structure specifying
28554  *			  the data starting address, transfer length, and format
28555  *		flag	- this argument is a pass through to ddi_copyxxx()
28556  *			  directly from the mode argument of ioctl().
28557  *
28558  * Return Code: the code returned by sd_send_scsi_cmd()
28559  *		EFAULT if ddi_copyxxx() fails
28560  *		ENXIO if fail ddi_get_soft_state
28561  *		EINVAL if data pointer is NULL
28562  */
28563 
28564 static int
28565 sr_read_cdxa(dev_t dev, caddr_t data, int flag)
28566 {
28567 	struct sd_lun		*un;
28568 	struct uscsi_cmd	*com;
28569 	struct cdrom_cdxa	*cdxa;
28570 	int			rval;
28571 	size_t			buflen;
28572 	char			cdb[CDB_GROUP5];
28573 	uchar_t			read_flags;
28574 
28575 #ifdef _MULTI_DATAMODEL
28576 	/* To support ILP32 applications in an LP64 world */
28577 	struct cdrom_cdxa32		cdrom_cdxa32;
28578 	struct cdrom_cdxa32		*cdxa32 = &cdrom_cdxa32;
28579 #endif /* _MULTI_DATAMODEL */
28580 
28581 	if (data == NULL) {
28582 		return (EINVAL);
28583 	}
28584 
28585 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
28586 		return (ENXIO);
28587 	}
28588 
28589 	cdxa = kmem_zalloc(sizeof (struct cdrom_cdxa), KM_SLEEP);
28590 
28591 #ifdef _MULTI_DATAMODEL
28592 	switch (ddi_model_convert_from(flag & FMODELS)) {
28593 	case DDI_MODEL_ILP32:
28594 		if (ddi_copyin(data, cdxa32, sizeof (*cdxa32), flag)) {
28595 			kmem_free(cdxa, sizeof (struct cdrom_cdxa));
28596 			return (EFAULT);
28597 		}
28598 		/*
28599 		 * Convert the ILP32 uscsi data from the
28600 		 * application to LP64 for internal use.
28601 		 */
28602 		cdrom_cdxa32tocdrom_cdxa(cdxa32, cdxa);
28603 		break;
28604 	case DDI_MODEL_NONE:
28605 		if (ddi_copyin(data, cdxa, sizeof (struct cdrom_cdxa), flag)) {
28606 			kmem_free(cdxa, sizeof (struct cdrom_cdxa));
28607 			return (EFAULT);
28608 		}
28609 		break;
28610 	}
28611 #else /* ! _MULTI_DATAMODEL */
28612 	if (ddi_copyin(data, cdxa, sizeof (struct cdrom_cdxa), flag)) {
28613 		kmem_free(cdxa, sizeof (struct cdrom_cdxa));
28614 		return (EFAULT);
28615 	}
28616 #endif /* _MULTI_DATAMODEL */
28617 
28618 	/*
28619 	 * Since MMC-2 expects max 3 bytes for length, check if the
28620 	 * length input is greater than 3 bytes
28621 	 */
28622 	if ((cdxa->cdxa_length & 0xFF000000) != 0) {
28623 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN, "sr_read_cdxa: "
28624 		    "cdrom transfer length too large: %d (limit %d)\n",
28625 		    cdxa->cdxa_length, 0xFFFFFF);
28626 		kmem_free(cdxa, sizeof (struct cdrom_cdxa));
28627 		return (EINVAL);
28628 	}
28629 
28630 	switch (cdxa->cdxa_format) {
28631 	case CDROM_XA_DATA:
28632 		buflen = CDROM_BLK_2048 * cdxa->cdxa_length;
28633 		read_flags = 0x10;
28634 		break;
28635 	case CDROM_XA_SECTOR_DATA:
28636 		buflen = CDROM_BLK_2352 * cdxa->cdxa_length;
28637 		read_flags = 0xf8;
28638 		break;
28639 	case CDROM_XA_DATA_W_ERROR:
28640 		buflen = CDROM_BLK_2646 * cdxa->cdxa_length;
28641 		read_flags = 0xfc;
28642 		break;
28643 	default:
28644 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28645 		    "sr_read_cdxa: Format '0x%x' Not Supported\n",
28646 		    cdxa->cdxa_format);
28647 		kmem_free(cdxa, sizeof (struct cdrom_cdxa));
28648 		return (EINVAL);
28649 	}
28650 
28651 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
28652 	bzero(cdb, CDB_GROUP5);
28653 	if (un->un_f_mmc_cap == TRUE) {
28654 		cdb[0] = (char)SCMD_READ_CD;
28655 		cdb[2] = (((cdxa->cdxa_addr) & 0xff000000) >> 24);
28656 		cdb[3] = (((cdxa->cdxa_addr) & 0x00ff0000) >> 16);
28657 		cdb[4] = (((cdxa->cdxa_addr) & 0x0000ff00) >> 8);
28658 		cdb[5] = ((cdxa->cdxa_addr) & 0x000000ff);
28659 		cdb[6] = (((cdxa->cdxa_length) & 0x00ff0000) >> 16);
28660 		cdb[7] = (((cdxa->cdxa_length) & 0x0000ff00) >> 8);
28661 		cdb[8] = ((cdxa->cdxa_length) & 0x000000ff);
28662 		cdb[9] = (char)read_flags;
28663 	} else {
28664 		/*
28665 		 * Note: A vendor specific command (0xDB) is being used her to
28666 		 * request a read of all subcodes.
28667 		 */
28668 		cdb[0] = (char)SCMD_READ_CDXA;
28669 		cdb[2] = (((cdxa->cdxa_addr) & 0xff000000) >> 24);
28670 		cdb[3] = (((cdxa->cdxa_addr) & 0x00ff0000) >> 16);
28671 		cdb[4] = (((cdxa->cdxa_addr) & 0x0000ff00) >> 8);
28672 		cdb[5] = ((cdxa->cdxa_addr) & 0x000000ff);
28673 		cdb[6] = (((cdxa->cdxa_length) & 0xff000000) >> 24);
28674 		cdb[7] = (((cdxa->cdxa_length) & 0x00ff0000) >> 16);
28675 		cdb[8] = (((cdxa->cdxa_length) & 0x0000ff00) >> 8);
28676 		cdb[9] = ((cdxa->cdxa_length) & 0x000000ff);
28677 		cdb[10] = cdxa->cdxa_format;
28678 	}
28679 	com->uscsi_cdb	   = cdb;
28680 	com->uscsi_cdblen  = CDB_GROUP5;
28681 	com->uscsi_bufaddr = (caddr_t)cdxa->cdxa_data;
28682 	com->uscsi_buflen  = buflen;
28683 	com->uscsi_flags   = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
28684 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_USERSPACE,
28685 	    SD_PATH_STANDARD);
28686 	kmem_free(cdxa, sizeof (struct cdrom_cdxa));
28687 	kmem_free(com, sizeof (*com));
28688 	return (rval);
28689 }
28690 
28691 
28692 /*
28693  *    Function: sr_eject()
28694  *
28695  * Description: This routine is the driver entry point for handling CD-ROM
28696  *		eject ioctl requests (FDEJECT, DKIOCEJECT, CDROMEJECT)
28697  *
28698  *   Arguments: dev	- the device 'dev_t'
28699  *
28700  * Return Code: the code returned by sd_send_scsi_cmd()
28701  */
28702 
28703 static int
28704 sr_eject(dev_t dev)
28705 {
28706 	struct sd_lun	*un;
28707 	int		rval;
28708 	sd_ssc_t	*ssc;
28709 
28710 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28711 	    (un->un_state == SD_STATE_OFFLINE)) {
28712 		return (ENXIO);
28713 	}
28714 
28715 	/*
28716 	 * To prevent race conditions with the eject
28717 	 * command, keep track of an eject command as
28718 	 * it progresses. If we are already handling
28719 	 * an eject command in the driver for the given
28720 	 * unit and another request to eject is received
28721 	 * immediately return EAGAIN so we don't lose
28722 	 * the command if the current eject command fails.
28723 	 */
28724 	mutex_enter(SD_MUTEX(un));
28725 	if (un->un_f_ejecting == TRUE) {
28726 		mutex_exit(SD_MUTEX(un));
28727 		return (EAGAIN);
28728 	}
28729 	un->un_f_ejecting = TRUE;
28730 	mutex_exit(SD_MUTEX(un));
28731 
28732 	ssc = sd_ssc_init(un);
28733 	rval = sd_send_scsi_DOORLOCK(ssc, SD_REMOVAL_ALLOW,
28734 	    SD_PATH_STANDARD);
28735 	sd_ssc_fini(ssc);
28736 
28737 	if (rval != 0) {
28738 		mutex_enter(SD_MUTEX(un));
28739 		un->un_f_ejecting = FALSE;
28740 		mutex_exit(SD_MUTEX(un));
28741 		return (rval);
28742 	}
28743 
28744 	ssc = sd_ssc_init(un);
28745 	rval = sd_send_scsi_START_STOP_UNIT(ssc, SD_START_STOP,
28746 	    SD_TARGET_EJECT, SD_PATH_STANDARD);
28747 	sd_ssc_fini(ssc);
28748 
28749 	if (rval == 0) {
28750 		mutex_enter(SD_MUTEX(un));
28751 		sr_ejected(un);
28752 		un->un_mediastate = DKIO_EJECTED;
28753 		un->un_f_ejecting = FALSE;
28754 		cv_broadcast(&un->un_state_cv);
28755 		mutex_exit(SD_MUTEX(un));
28756 	} else {
28757 		mutex_enter(SD_MUTEX(un));
28758 		un->un_f_ejecting = FALSE;
28759 		mutex_exit(SD_MUTEX(un));
28760 	}
28761 	return (rval);
28762 }
28763 
28764 
28765 /*
28766  *    Function: sr_ejected()
28767  *
28768  * Description: This routine updates the soft state structure to invalidate the
28769  *		geometry information after the media has been ejected or a
28770  *		media eject has been detected.
28771  *
28772  *   Arguments: un - driver soft state (unit) structure
28773  */
28774 
28775 static void
28776 sr_ejected(struct sd_lun *un)
28777 {
28778 	struct sd_errstats *stp;
28779 
28780 	ASSERT(un != NULL);
28781 	ASSERT(mutex_owned(SD_MUTEX(un)));
28782 
28783 	un->un_f_blockcount_is_valid	= FALSE;
28784 	un->un_f_tgt_blocksize_is_valid	= FALSE;
28785 	mutex_exit(SD_MUTEX(un));
28786 	cmlb_invalidate(un->un_cmlbhandle, (void *)SD_PATH_DIRECT_PRIORITY);
28787 	mutex_enter(SD_MUTEX(un));
28788 
28789 	if (un->un_errstats != NULL) {
28790 		stp = (struct sd_errstats *)un->un_errstats->ks_data;
28791 		stp->sd_capacity.value.ui64 = 0;
28792 	}
28793 }
28794 
28795 
28796 /*
28797  *    Function: sr_check_wp()
28798  *
28799  * Description: This routine checks the write protection of a removable
28800  *      media disk and hotpluggable devices via the write protect bit of
28801  *      the Mode Page Header device specific field. Some devices choke
28802  *      on unsupported mode page. In order to workaround this issue,
28803  *      this routine has been implemented to use 0x3f mode page(request
28804  *      for all pages) for all device types.
28805  *
28806  *   Arguments: dev             - the device 'dev_t'
28807  *
28808  * Return Code: int indicating if the device is write protected (1) or not (0)
28809  *
28810  *     Context: Kernel thread.
28811  *
28812  */
28813 
28814 static int
28815 sr_check_wp(dev_t dev)
28816 {
28817 	struct sd_lun	*un;
28818 	uchar_t		device_specific;
28819 	uchar_t		*sense;
28820 	int		hdrlen;
28821 	int		rval = FALSE;
28822 	int		status;
28823 	sd_ssc_t	*ssc;
28824 
28825 	/*
28826 	 * Note: The return codes for this routine should be reworked to
28827 	 * properly handle the case of a NULL softstate.
28828 	 */
28829 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL) {
28830 		return (FALSE);
28831 	}
28832 
28833 	if (un->un_f_cfg_is_atapi == TRUE) {
28834 		/*
28835 		 * The mode page contents are not required; set the allocation
28836 		 * length for the mode page header only
28837 		 */
28838 		hdrlen = MODE_HEADER_LENGTH_GRP2;
28839 		sense = kmem_zalloc(hdrlen, KM_SLEEP);
28840 		ssc = sd_ssc_init(un);
28841 		status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, sense, hdrlen,
28842 		    MODEPAGE_ALLPAGES, SD_PATH_STANDARD);
28843 		sd_ssc_fini(ssc);
28844 		if (status != 0)
28845 			goto err_exit;
28846 		device_specific =
28847 		    ((struct mode_header_grp2 *)sense)->device_specific;
28848 	} else {
28849 		hdrlen = MODE_HEADER_LENGTH;
28850 		sense = kmem_zalloc(hdrlen, KM_SLEEP);
28851 		ssc = sd_ssc_init(un);
28852 		status = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense, hdrlen,
28853 		    MODEPAGE_ALLPAGES, SD_PATH_STANDARD);
28854 		sd_ssc_fini(ssc);
28855 		if (status != 0)
28856 			goto err_exit;
28857 		device_specific =
28858 		    ((struct mode_header *)sense)->device_specific;
28859 	}
28860 
28861 
28862 	/*
28863 	 * Write protect mode sense failed; not all disks
28864 	 * understand this query. Return FALSE assuming that
28865 	 * these devices are not writable.
28866 	 */
28867 	if (device_specific & WRITE_PROTECT) {
28868 		rval = TRUE;
28869 	}
28870 
28871 err_exit:
28872 	kmem_free(sense, hdrlen);
28873 	return (rval);
28874 }
28875 
28876 /*
28877  *    Function: sr_volume_ctrl()
28878  *
28879  * Description: This routine is the driver entry point for handling CD-ROM
28880  *		audio output volume ioctl requests. (CDROMVOLCTRL)
28881  *
28882  *   Arguments: dev	- the device 'dev_t'
28883  *		data	- pointer to user audio volume control structure
28884  *		flag	- this argument is a pass through to ddi_copyxxx()
28885  *			  directly from the mode argument of ioctl().
28886  *
28887  * Return Code: the code returned by sd_send_scsi_cmd()
28888  *		EFAULT if ddi_copyxxx() fails
28889  *		ENXIO if fail ddi_get_soft_state
28890  *		EINVAL if data pointer is NULL
28891  *
28892  */
28893 
28894 static int
28895 sr_volume_ctrl(dev_t dev, caddr_t data, int flag)
28896 {
28897 	struct sd_lun		*un;
28898 	struct cdrom_volctrl    volume;
28899 	struct cdrom_volctrl    *vol = &volume;
28900 	uchar_t			*sense_page;
28901 	uchar_t			*select_page;
28902 	uchar_t			*sense;
28903 	uchar_t			*select;
28904 	int			sense_buflen;
28905 	int			select_buflen;
28906 	int			rval;
28907 	sd_ssc_t		*ssc;
28908 
28909 	if (data == NULL) {
28910 		return (EINVAL);
28911 	}
28912 
28913 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
28914 	    (un->un_state == SD_STATE_OFFLINE)) {
28915 		return (ENXIO);
28916 	}
28917 
28918 	if (ddi_copyin(data, vol, sizeof (struct cdrom_volctrl), flag)) {
28919 		return (EFAULT);
28920 	}
28921 
28922 	if ((un->un_f_cfg_is_atapi == TRUE) || (un->un_f_mmc_cap == TRUE)) {
28923 		struct mode_header_grp2		*sense_mhp;
28924 		struct mode_header_grp2		*select_mhp;
28925 		int				bd_len;
28926 
28927 		sense_buflen = MODE_PARAM_LENGTH_GRP2 + MODEPAGE_AUDIO_CTRL_LEN;
28928 		select_buflen = MODE_HEADER_LENGTH_GRP2 +
28929 		    MODEPAGE_AUDIO_CTRL_LEN;
28930 		sense  = kmem_zalloc(sense_buflen, KM_SLEEP);
28931 		select = kmem_zalloc(select_buflen, KM_SLEEP);
28932 		ssc = sd_ssc_init(un);
28933 		rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP1, sense,
28934 		    sense_buflen, MODEPAGE_AUDIO_CTRL,
28935 		    SD_PATH_STANDARD);
28936 		sd_ssc_fini(ssc);
28937 
28938 		if (rval != 0) {
28939 			SD_ERROR(SD_LOG_IOCTL_RMMEDIA, un,
28940 			    "sr_volume_ctrl: Mode Sense Failed\n");
28941 			kmem_free(sense, sense_buflen);
28942 			kmem_free(select, select_buflen);
28943 			return (rval);
28944 		}
28945 		sense_mhp = (struct mode_header_grp2 *)sense;
28946 		select_mhp = (struct mode_header_grp2 *)select;
28947 		bd_len = (sense_mhp->bdesc_length_hi << 8) |
28948 		    sense_mhp->bdesc_length_lo;
28949 		if (bd_len > MODE_BLK_DESC_LENGTH) {
28950 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28951 			    "sr_volume_ctrl: Mode Sense returned invalid "
28952 			    "block descriptor length\n");
28953 			kmem_free(sense, sense_buflen);
28954 			kmem_free(select, select_buflen);
28955 			return (EIO);
28956 		}
28957 		sense_page = (uchar_t *)
28958 		    (sense + MODE_HEADER_LENGTH_GRP2 + bd_len);
28959 		select_page = (uchar_t *)(select + MODE_HEADER_LENGTH_GRP2);
28960 		select_mhp->length_msb = 0;
28961 		select_mhp->length_lsb = 0;
28962 		select_mhp->bdesc_length_hi = 0;
28963 		select_mhp->bdesc_length_lo = 0;
28964 	} else {
28965 		struct mode_header		*sense_mhp, *select_mhp;
28966 
28967 		sense_buflen = MODE_PARAM_LENGTH + MODEPAGE_AUDIO_CTRL_LEN;
28968 		select_buflen = MODE_HEADER_LENGTH + MODEPAGE_AUDIO_CTRL_LEN;
28969 		sense  = kmem_zalloc(sense_buflen, KM_SLEEP);
28970 		select = kmem_zalloc(select_buflen, KM_SLEEP);
28971 		ssc = sd_ssc_init(un);
28972 		rval = sd_send_scsi_MODE_SENSE(ssc, CDB_GROUP0, sense,
28973 		    sense_buflen, MODEPAGE_AUDIO_CTRL,
28974 		    SD_PATH_STANDARD);
28975 		sd_ssc_fini(ssc);
28976 
28977 		if (rval != 0) {
28978 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28979 			    "sr_volume_ctrl: Mode Sense Failed\n");
28980 			kmem_free(sense, sense_buflen);
28981 			kmem_free(select, select_buflen);
28982 			return (rval);
28983 		}
28984 		sense_mhp  = (struct mode_header *)sense;
28985 		select_mhp = (struct mode_header *)select;
28986 		if (sense_mhp->bdesc_length > MODE_BLK_DESC_LENGTH) {
28987 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
28988 			    "sr_volume_ctrl: Mode Sense returned invalid "
28989 			    "block descriptor length\n");
28990 			kmem_free(sense, sense_buflen);
28991 			kmem_free(select, select_buflen);
28992 			return (EIO);
28993 		}
28994 		sense_page = (uchar_t *)
28995 		    (sense + MODE_HEADER_LENGTH + sense_mhp->bdesc_length);
28996 		select_page = (uchar_t *)(select + MODE_HEADER_LENGTH);
28997 		select_mhp->length = 0;
28998 		select_mhp->bdesc_length = 0;
28999 	}
29000 	/*
29001 	 * Note: An audio control data structure could be created and overlayed
29002 	 * on the following in place of the array indexing method implemented.
29003 	 */
29004 
29005 	/* Build the select data for the user volume data */
29006 	select_page[0] = MODEPAGE_AUDIO_CTRL;
29007 	select_page[1] = 0xE;
29008 	/* Set the immediate bit */
29009 	select_page[2] = 0x04;
29010 	/* Zero out reserved fields */
29011 	select_page[3] = 0x00;
29012 	select_page[4] = 0x00;
29013 	/* Return sense data for fields not to be modified */
29014 	select_page[5] = sense_page[5];
29015 	select_page[6] = sense_page[6];
29016 	select_page[7] = sense_page[7];
29017 	/* Set the user specified volume levels for channel 0 and 1 */
29018 	select_page[8] = 0x01;
29019 	select_page[9] = vol->channel0;
29020 	select_page[10] = 0x02;
29021 	select_page[11] = vol->channel1;
29022 	/* Channel 2 and 3 are currently unsupported so return the sense data */
29023 	select_page[12] = sense_page[12];
29024 	select_page[13] = sense_page[13];
29025 	select_page[14] = sense_page[14];
29026 	select_page[15] = sense_page[15];
29027 
29028 	ssc = sd_ssc_init(un);
29029 	if ((un->un_f_cfg_is_atapi == TRUE) || (un->un_f_mmc_cap == TRUE)) {
29030 		rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP1, select,
29031 		    select_buflen, SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
29032 	} else {
29033 		rval = sd_send_scsi_MODE_SELECT(ssc, CDB_GROUP0, select,
29034 		    select_buflen, SD_DONTSAVE_PAGE, SD_PATH_STANDARD);
29035 	}
29036 	sd_ssc_fini(ssc);
29037 
29038 	kmem_free(sense, sense_buflen);
29039 	kmem_free(select, select_buflen);
29040 	return (rval);
29041 }
29042 
29043 
29044 /*
29045  *    Function: sr_read_sony_session_offset()
29046  *
29047  * Description: This routine is the driver entry point for handling CD-ROM
29048  *		ioctl requests for session offset information. (CDROMREADOFFSET)
29049  *		The address of the first track in the last session of a
29050  *		multi-session CD-ROM is returned
29051  *
29052  *		Note: This routine uses a vendor specific key value in the
29053  *		command control field without implementing any vendor check here
29054  *		or in the ioctl routine.
29055  *
29056  *   Arguments: dev	- the device 'dev_t'
29057  *		data	- pointer to an int to hold the requested address
29058  *		flag	- this argument is a pass through to ddi_copyxxx()
29059  *			  directly from the mode argument of ioctl().
29060  *
29061  * Return Code: the code returned by sd_send_scsi_cmd()
29062  *		EFAULT if ddi_copyxxx() fails
29063  *		ENXIO if fail ddi_get_soft_state
29064  *		EINVAL if data pointer is NULL
29065  */
29066 
29067 static int
29068 sr_read_sony_session_offset(dev_t dev, caddr_t data, int flag)
29069 {
29070 	struct sd_lun		*un;
29071 	struct uscsi_cmd	*com;
29072 	caddr_t			buffer;
29073 	char			cdb[CDB_GROUP1];
29074 	int			session_offset = 0;
29075 	int			rval;
29076 
29077 	if (data == NULL) {
29078 		return (EINVAL);
29079 	}
29080 
29081 	if ((un = ddi_get_soft_state(sd_state, SDUNIT(dev))) == NULL ||
29082 	    (un->un_state == SD_STATE_OFFLINE)) {
29083 		return (ENXIO);
29084 	}
29085 
29086 	buffer = kmem_zalloc((size_t)SONY_SESSION_OFFSET_LEN, KM_SLEEP);
29087 	bzero(cdb, CDB_GROUP1);
29088 	cdb[0] = SCMD_READ_TOC;
29089 	/*
29090 	 * Bytes 7 & 8 are the 12 byte allocation length for a single entry.
29091 	 * (4 byte TOC response header + 8 byte response data)
29092 	 */
29093 	cdb[8] = SONY_SESSION_OFFSET_LEN;
29094 	/* Byte 9 is the control byte. A vendor specific value is used */
29095 	cdb[9] = SONY_SESSION_OFFSET_KEY;
29096 	com = kmem_zalloc(sizeof (*com), KM_SLEEP);
29097 	com->uscsi_cdb = cdb;
29098 	com->uscsi_cdblen = CDB_GROUP1;
29099 	com->uscsi_bufaddr = buffer;
29100 	com->uscsi_buflen = SONY_SESSION_OFFSET_LEN;
29101 	com->uscsi_flags = USCSI_DIAGNOSE|USCSI_SILENT|USCSI_READ;
29102 
29103 	rval = sd_send_scsi_cmd(dev, com, FKIOCTL, UIO_SYSSPACE,
29104 	    SD_PATH_STANDARD);
29105 	if (rval != 0) {
29106 		kmem_free(buffer, SONY_SESSION_OFFSET_LEN);
29107 		kmem_free(com, sizeof (*com));
29108 		return (rval);
29109 	}
29110 	if (buffer[1] == SONY_SESSION_OFFSET_VALID) {
29111 		session_offset =
29112 		    ((uchar_t)buffer[8] << 24) + ((uchar_t)buffer[9] << 16) +
29113 		    ((uchar_t)buffer[10] << 8) + ((uchar_t)buffer[11]);
29114 		/*
29115 		 * Offset returned offset in current lbasize block's. Convert to
29116 		 * 2k block's to return to the user
29117 		 */
29118 		if (un->un_tgt_blocksize == CDROM_BLK_512) {
29119 			session_offset >>= 2;
29120 		} else if (un->un_tgt_blocksize == CDROM_BLK_1024) {
29121 			session_offset >>= 1;
29122 		}
29123 	}
29124 
29125 	if (ddi_copyout(&session_offset, data, sizeof (int), flag) != 0) {
29126 		rval = EFAULT;
29127 	}
29128 
29129 	kmem_free(buffer, SONY_SESSION_OFFSET_LEN);
29130 	kmem_free(com, sizeof (*com));
29131 	return (rval);
29132 }
29133 
29134 
29135 /*
29136  *    Function: sd_wm_cache_constructor()
29137  *
29138  * Description: Cache Constructor for the wmap cache for the read/modify/write
29139  * 		devices.
29140  *
29141  *   Arguments: wm      - A pointer to the sd_w_map to be initialized.
29142  *		un	- sd_lun structure for the device.
29143  *		flag	- the km flags passed to constructor
29144  *
29145  * Return Code: 0 on success.
29146  *		-1 on failure.
29147  */
29148 
29149 /*ARGSUSED*/
29150 static int
29151 sd_wm_cache_constructor(void *wm, void *un, int flags)
29152 {
29153 	bzero(wm, sizeof (struct sd_w_map));
29154 	cv_init(&((struct sd_w_map *)wm)->wm_avail, NULL, CV_DRIVER, NULL);
29155 	return (0);
29156 }
29157 
29158 
29159 /*
29160  *    Function: sd_wm_cache_destructor()
29161  *
29162  * Description: Cache destructor for the wmap cache for the read/modify/write
29163  * 		devices.
29164  *
29165  *   Arguments: wm      - A pointer to the sd_w_map to be initialized.
29166  *		un	- sd_lun structure for the device.
29167  */
29168 /*ARGSUSED*/
29169 static void
29170 sd_wm_cache_destructor(void *wm, void *un)
29171 {
29172 	cv_destroy(&((struct sd_w_map *)wm)->wm_avail);
29173 }
29174 
29175 
29176 /*
29177  *    Function: sd_range_lock()
29178  *
29179  * Description: Lock the range of blocks specified as parameter to ensure
29180  *		that read, modify write is atomic and no other i/o writes
29181  *		to the same location. The range is specified in terms
29182  *		of start and end blocks. Block numbers are the actual
29183  *		media block numbers and not system.
29184  *
29185  *   Arguments: un	- sd_lun structure for the device.
29186  *		startb - The starting block number
29187  *		endb - The end block number
29188  *		typ - type of i/o - simple/read_modify_write
29189  *
29190  * Return Code: wm  - pointer to the wmap structure.
29191  *
29192  *     Context: This routine can sleep.
29193  */
29194 
29195 static struct sd_w_map *
29196 sd_range_lock(struct sd_lun *un, daddr_t startb, daddr_t endb, ushort_t typ)
29197 {
29198 	struct sd_w_map *wmp = NULL;
29199 	struct sd_w_map *sl_wmp = NULL;
29200 	struct sd_w_map *tmp_wmp;
29201 	wm_state state = SD_WM_CHK_LIST;
29202 
29203 
29204 	ASSERT(un != NULL);
29205 	ASSERT(!mutex_owned(SD_MUTEX(un)));
29206 
29207 	mutex_enter(SD_MUTEX(un));
29208 
29209 	while (state != SD_WM_DONE) {
29210 
29211 		switch (state) {
29212 		case SD_WM_CHK_LIST:
29213 			/*
29214 			 * This is the starting state. Check the wmap list
29215 			 * to see if the range is currently available.
29216 			 */
29217 			if (!(typ & SD_WTYPE_RMW) && !(un->un_rmw_count)) {
29218 				/*
29219 				 * If this is a simple write and no rmw
29220 				 * i/o is pending then try to lock the
29221 				 * range as the range should be available.
29222 				 */
29223 				state = SD_WM_LOCK_RANGE;
29224 			} else {
29225 				tmp_wmp = sd_get_range(un, startb, endb);
29226 				if (tmp_wmp != NULL) {
29227 					if ((wmp != NULL) && ONLIST(un, wmp)) {
29228 						/*
29229 						 * Should not keep onlist wmps
29230 						 * while waiting this macro
29231 						 * will also do wmp = NULL;
29232 						 */
29233 						FREE_ONLIST_WMAP(un, wmp);
29234 					}
29235 					/*
29236 					 * sl_wmp is the wmap on which wait
29237 					 * is done, since the tmp_wmp points
29238 					 * to the inuse wmap, set sl_wmp to
29239 					 * tmp_wmp and change the state to sleep
29240 					 */
29241 					sl_wmp = tmp_wmp;
29242 					state = SD_WM_WAIT_MAP;
29243 				} else {
29244 					state = SD_WM_LOCK_RANGE;
29245 				}
29246 
29247 			}
29248 			break;
29249 
29250 		case SD_WM_LOCK_RANGE:
29251 			ASSERT(un->un_wm_cache);
29252 			/*
29253 			 * The range need to be locked, try to get a wmap.
29254 			 * First attempt it with NO_SLEEP, want to avoid a sleep
29255 			 * if possible as we will have to release the sd mutex
29256 			 * if we have to sleep.
29257 			 */
29258 			if (wmp == NULL)
29259 				wmp = kmem_cache_alloc(un->un_wm_cache,
29260 				    KM_NOSLEEP);
29261 			if (wmp == NULL) {
29262 				mutex_exit(SD_MUTEX(un));
29263 				_NOTE(DATA_READABLE_WITHOUT_LOCK
29264 				    (sd_lun::un_wm_cache))
29265 				wmp = kmem_cache_alloc(un->un_wm_cache,
29266 				    KM_SLEEP);
29267 				mutex_enter(SD_MUTEX(un));
29268 				/*
29269 				 * we released the mutex so recheck and go to
29270 				 * check list state.
29271 				 */
29272 				state = SD_WM_CHK_LIST;
29273 			} else {
29274 				/*
29275 				 * We exit out of state machine since we
29276 				 * have the wmap. Do the housekeeping first.
29277 				 * place the wmap on the wmap list if it is not
29278 				 * on it already and then set the state to done.
29279 				 */
29280 				wmp->wm_start = startb;
29281 				wmp->wm_end = endb;
29282 				wmp->wm_flags = typ | SD_WM_BUSY;
29283 				if (typ & SD_WTYPE_RMW) {
29284 					un->un_rmw_count++;
29285 				}
29286 				/*
29287 				 * If not already on the list then link
29288 				 */
29289 				if (!ONLIST(un, wmp)) {
29290 					wmp->wm_next = un->un_wm;
29291 					wmp->wm_prev = NULL;
29292 					if (wmp->wm_next)
29293 						wmp->wm_next->wm_prev = wmp;
29294 					un->un_wm = wmp;
29295 				}
29296 				state = SD_WM_DONE;
29297 			}
29298 			break;
29299 
29300 		case SD_WM_WAIT_MAP:
29301 			ASSERT(sl_wmp->wm_flags & SD_WM_BUSY);
29302 			/*
29303 			 * Wait is done on sl_wmp, which is set in the
29304 			 * check_list state.
29305 			 */
29306 			sl_wmp->wm_wanted_count++;
29307 			cv_wait(&sl_wmp->wm_avail, SD_MUTEX(un));
29308 			sl_wmp->wm_wanted_count--;
29309 			/*
29310 			 * We can reuse the memory from the completed sl_wmp
29311 			 * lock range for our new lock, but only if noone is
29312 			 * waiting for it.
29313 			 */
29314 			ASSERT(!(sl_wmp->wm_flags & SD_WM_BUSY));
29315 			if (sl_wmp->wm_wanted_count == 0) {
29316 				if (wmp != NULL)
29317 					CHK_N_FREEWMP(un, wmp);
29318 				wmp = sl_wmp;
29319 			}
29320 			sl_wmp = NULL;
29321 			/*
29322 			 * After waking up, need to recheck for availability of
29323 			 * range.
29324 			 */
29325 			state = SD_WM_CHK_LIST;
29326 			break;
29327 
29328 		default:
29329 			panic("sd_range_lock: "
29330 			    "Unknown state %d in sd_range_lock", state);
29331 			/*NOTREACHED*/
29332 		} /* switch(state) */
29333 
29334 	} /* while(state != SD_WM_DONE) */
29335 
29336 	mutex_exit(SD_MUTEX(un));
29337 
29338 	ASSERT(wmp != NULL);
29339 
29340 	return (wmp);
29341 }
29342 
29343 
29344 /*
29345  *    Function: sd_get_range()
29346  *
29347  * Description: Find if there any overlapping I/O to this one
29348  *		Returns the write-map of 1st such I/O, NULL otherwise.
29349  *
29350  *   Arguments: un	- sd_lun structure for the device.
29351  *		startb - The starting block number
29352  *		endb - The end block number
29353  *
29354  * Return Code: wm  - pointer to the wmap structure.
29355  */
29356 
29357 static struct sd_w_map *
29358 sd_get_range(struct sd_lun *un, daddr_t startb, daddr_t endb)
29359 {
29360 	struct sd_w_map *wmp;
29361 
29362 	ASSERT(un != NULL);
29363 
29364 	for (wmp = un->un_wm; wmp != NULL; wmp = wmp->wm_next) {
29365 		if (!(wmp->wm_flags & SD_WM_BUSY)) {
29366 			continue;
29367 		}
29368 		if ((startb >= wmp->wm_start) && (startb <= wmp->wm_end)) {
29369 			break;
29370 		}
29371 		if ((endb >= wmp->wm_start) && (endb <= wmp->wm_end)) {
29372 			break;
29373 		}
29374 	}
29375 
29376 	return (wmp);
29377 }
29378 
29379 
29380 /*
29381  *    Function: sd_free_inlist_wmap()
29382  *
29383  * Description: Unlink and free a write map struct.
29384  *
29385  *   Arguments: un      - sd_lun structure for the device.
29386  *		wmp	- sd_w_map which needs to be unlinked.
29387  */
29388 
29389 static void
29390 sd_free_inlist_wmap(struct sd_lun *un, struct sd_w_map *wmp)
29391 {
29392 	ASSERT(un != NULL);
29393 
29394 	if (un->un_wm == wmp) {
29395 		un->un_wm = wmp->wm_next;
29396 	} else {
29397 		wmp->wm_prev->wm_next = wmp->wm_next;
29398 	}
29399 
29400 	if (wmp->wm_next) {
29401 		wmp->wm_next->wm_prev = wmp->wm_prev;
29402 	}
29403 
29404 	wmp->wm_next = wmp->wm_prev = NULL;
29405 
29406 	kmem_cache_free(un->un_wm_cache, wmp);
29407 }
29408 
29409 
29410 /*
29411  *    Function: sd_range_unlock()
29412  *
29413  * Description: Unlock the range locked by wm.
29414  *		Free write map if nobody else is waiting on it.
29415  *
29416  *   Arguments: un      - sd_lun structure for the device.
29417  *              wmp     - sd_w_map which needs to be unlinked.
29418  */
29419 
29420 static void
29421 sd_range_unlock(struct sd_lun *un, struct sd_w_map *wm)
29422 {
29423 	ASSERT(un != NULL);
29424 	ASSERT(wm != NULL);
29425 	ASSERT(!mutex_owned(SD_MUTEX(un)));
29426 
29427 	mutex_enter(SD_MUTEX(un));
29428 
29429 	if (wm->wm_flags & SD_WTYPE_RMW) {
29430 		un->un_rmw_count--;
29431 	}
29432 
29433 	if (wm->wm_wanted_count) {
29434 		wm->wm_flags = 0;
29435 		/*
29436 		 * Broadcast that the wmap is available now.
29437 		 */
29438 		cv_broadcast(&wm->wm_avail);
29439 	} else {
29440 		/*
29441 		 * If no one is waiting on the map, it should be free'ed.
29442 		 */
29443 		sd_free_inlist_wmap(un, wm);
29444 	}
29445 
29446 	mutex_exit(SD_MUTEX(un));
29447 }
29448 
29449 
29450 /*
29451  *    Function: sd_read_modify_write_task
29452  *
29453  * Description: Called from a taskq thread to initiate the write phase of
29454  *		a read-modify-write request.  This is used for targets where
29455  *		un->un_sys_blocksize != un->un_tgt_blocksize.
29456  *
29457  *   Arguments: arg - a pointer to the buf(9S) struct for the write command.
29458  *
29459  *     Context: Called under taskq thread context.
29460  */
29461 
29462 static void
29463 sd_read_modify_write_task(void *arg)
29464 {
29465 	struct sd_mapblocksize_info	*bsp;
29466 	struct buf	*bp;
29467 	struct sd_xbuf	*xp;
29468 	struct sd_lun	*un;
29469 
29470 	bp = arg;	/* The bp is given in arg */
29471 	ASSERT(bp != NULL);
29472 
29473 	/* Get the pointer to the layer-private data struct */
29474 	xp = SD_GET_XBUF(bp);
29475 	ASSERT(xp != NULL);
29476 	bsp = xp->xb_private;
29477 	ASSERT(bsp != NULL);
29478 
29479 	un = SD_GET_UN(bp);
29480 	ASSERT(un != NULL);
29481 	ASSERT(!mutex_owned(SD_MUTEX(un)));
29482 
29483 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
29484 	    "sd_read_modify_write_task: entry: buf:0x%p\n", bp);
29485 
29486 	/*
29487 	 * This is the write phase of a read-modify-write request, called
29488 	 * under the context of a taskq thread in response to the completion
29489 	 * of the read portion of the rmw request completing under interrupt
29490 	 * context. The write request must be sent from here down the iostart
29491 	 * chain as if it were being sent from sd_mapblocksize_iostart(), so
29492 	 * we use the layer index saved in the layer-private data area.
29493 	 */
29494 	SD_NEXT_IOSTART(bsp->mbs_layer_index, un, bp);
29495 
29496 	SD_TRACE(SD_LOG_IO_RMMEDIA, un,
29497 	    "sd_read_modify_write_task: exit: buf:0x%p\n", bp);
29498 }
29499 
29500 
29501 /*
29502  *    Function: sddump_do_read_of_rmw()
29503  *
29504  * Description: This routine will be called from sddump, If sddump is called
29505  *		with an I/O which not aligned on device blocksize boundary
29506  *		then the write has to be converted to read-modify-write.
29507  *		Do the read part here in order to keep sddump simple.
29508  *		Note - That the sd_mutex is held across the call to this
29509  *		routine.
29510  *
29511  *   Arguments: un	- sd_lun
29512  *		blkno	- block number in terms of media block size.
29513  *		nblk	- number of blocks.
29514  *		bpp	- pointer to pointer to the buf structure. On return
29515  *			from this function, *bpp points to the valid buffer
29516  *			to which the write has to be done.
29517  *
29518  * Return Code: 0 for success or errno-type return code
29519  */
29520 
29521 static int
29522 sddump_do_read_of_rmw(struct sd_lun *un, uint64_t blkno, uint64_t nblk,
29523 	struct buf **bpp)
29524 {
29525 	int err;
29526 	int i;
29527 	int rval;
29528 	struct buf *bp;
29529 	struct scsi_pkt *pkt = NULL;
29530 	uint32_t target_blocksize;
29531 
29532 	ASSERT(un != NULL);
29533 	ASSERT(mutex_owned(SD_MUTEX(un)));
29534 
29535 	target_blocksize = un->un_tgt_blocksize;
29536 
29537 	mutex_exit(SD_MUTEX(un));
29538 
29539 	bp = scsi_alloc_consistent_buf(SD_ADDRESS(un), (struct buf *)NULL,
29540 	    (size_t)(nblk * target_blocksize), B_READ, NULL_FUNC, NULL);
29541 	if (bp == NULL) {
29542 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
29543 		    "no resources for dumping; giving up");
29544 		err = ENOMEM;
29545 		goto done;
29546 	}
29547 
29548 	rval = sd_setup_rw_pkt(un, &pkt, bp, 0, NULL_FUNC, NULL,
29549 	    blkno, nblk);
29550 	if (rval != 0) {
29551 		scsi_free_consistent_buf(bp);
29552 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
29553 		    "no resources for dumping; giving up");
29554 		err = ENOMEM;
29555 		goto done;
29556 	}
29557 
29558 	pkt->pkt_flags |= FLAG_NOINTR;
29559 
29560 	err = EIO;
29561 	for (i = 0; i < SD_NDUMP_RETRIES; i++) {
29562 
29563 		/*
29564 		 * Scsi_poll returns 0 (success) if the command completes and
29565 		 * the status block is STATUS_GOOD.  We should only check
29566 		 * errors if this condition is not true.  Even then we should
29567 		 * send our own request sense packet only if we have a check
29568 		 * condition and auto request sense has not been performed by
29569 		 * the hba.
29570 		 */
29571 		SD_TRACE(SD_LOG_DUMP, un, "sddump: sending read\n");
29572 
29573 		if ((sd_scsi_poll(un, pkt) == 0) && (pkt->pkt_resid == 0)) {
29574 			err = 0;
29575 			break;
29576 		}
29577 
29578 		/*
29579 		 * Check CMD_DEV_GONE 1st, give up if device is gone,
29580 		 * no need to read RQS data.
29581 		 */
29582 		if (pkt->pkt_reason == CMD_DEV_GONE) {
29583 			scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
29584 			    "Error while dumping state with rmw..."
29585 			    "Device is gone\n");
29586 			break;
29587 		}
29588 
29589 		if (SD_GET_PKT_STATUS(pkt) == STATUS_CHECK) {
29590 			SD_INFO(SD_LOG_DUMP, un,
29591 			    "sddump: read failed with CHECK, try # %d\n", i);
29592 			if (((pkt->pkt_state & STATE_ARQ_DONE) == 0)) {
29593 				(void) sd_send_polled_RQS(un);
29594 			}
29595 
29596 			continue;
29597 		}
29598 
29599 		if (SD_GET_PKT_STATUS(pkt) == STATUS_BUSY) {
29600 			int reset_retval = 0;
29601 
29602 			SD_INFO(SD_LOG_DUMP, un,
29603 			    "sddump: read failed with BUSY, try # %d\n", i);
29604 
29605 			if (un->un_f_lun_reset_enabled == TRUE) {
29606 				reset_retval = scsi_reset(SD_ADDRESS(un),
29607 				    RESET_LUN);
29608 			}
29609 			if (reset_retval == 0) {
29610 				(void) scsi_reset(SD_ADDRESS(un), RESET_TARGET);
29611 			}
29612 			(void) sd_send_polled_RQS(un);
29613 
29614 		} else {
29615 			SD_INFO(SD_LOG_DUMP, un,
29616 			    "sddump: read failed with 0x%x, try # %d\n",
29617 			    SD_GET_PKT_STATUS(pkt), i);
29618 			mutex_enter(SD_MUTEX(un));
29619 			sd_reset_target(un, pkt);
29620 			mutex_exit(SD_MUTEX(un));
29621 		}
29622 
29623 		/*
29624 		 * If we are not getting anywhere with lun/target resets,
29625 		 * let's reset the bus.
29626 		 */
29627 		if (i > SD_NDUMP_RETRIES/2) {
29628 			(void) scsi_reset(SD_ADDRESS(un), RESET_ALL);
29629 			(void) sd_send_polled_RQS(un);
29630 		}
29631 
29632 	}
29633 	scsi_destroy_pkt(pkt);
29634 
29635 	if (err != 0) {
29636 		scsi_free_consistent_buf(bp);
29637 		*bpp = NULL;
29638 	} else {
29639 		*bpp = bp;
29640 	}
29641 
29642 done:
29643 	mutex_enter(SD_MUTEX(un));
29644 	return (err);
29645 }
29646 
29647 
29648 /*
29649  *    Function: sd_failfast_flushq
29650  *
29651  * Description: Take all bp's on the wait queue that have B_FAILFAST set
29652  *		in b_flags and move them onto the failfast queue, then kick
29653  *		off a thread to return all bp's on the failfast queue to
29654  *		their owners with an error set.
29655  *
29656  *   Arguments: un - pointer to the soft state struct for the instance.
29657  *
29658  *     Context: may execute in interrupt context.
29659  */
29660 
29661 static void
29662 sd_failfast_flushq(struct sd_lun *un)
29663 {
29664 	struct buf *bp;
29665 	struct buf *next_waitq_bp;
29666 	struct buf *prev_waitq_bp = NULL;
29667 
29668 	ASSERT(un != NULL);
29669 	ASSERT(mutex_owned(SD_MUTEX(un)));
29670 	ASSERT(un->un_failfast_state == SD_FAILFAST_ACTIVE);
29671 	ASSERT(un->un_failfast_bp == NULL);
29672 
29673 	SD_TRACE(SD_LOG_IO_FAILFAST, un,
29674 	    "sd_failfast_flushq: entry: un:0x%p\n", un);
29675 
29676 	/*
29677 	 * Check if we should flush all bufs when entering failfast state, or
29678 	 * just those with B_FAILFAST set.
29679 	 */
29680 	if (sd_failfast_flushctl & SD_FAILFAST_FLUSH_ALL_BUFS) {
29681 		/*
29682 		 * Move *all* bp's on the wait queue to the failfast flush
29683 		 * queue, including those that do NOT have B_FAILFAST set.
29684 		 */
29685 		if (un->un_failfast_headp == NULL) {
29686 			ASSERT(un->un_failfast_tailp == NULL);
29687 			un->un_failfast_headp = un->un_waitq_headp;
29688 		} else {
29689 			ASSERT(un->un_failfast_tailp != NULL);
29690 			un->un_failfast_tailp->av_forw = un->un_waitq_headp;
29691 		}
29692 
29693 		un->un_failfast_tailp = un->un_waitq_tailp;
29694 
29695 		/* update kstat for each bp moved out of the waitq */
29696 		for (bp = un->un_waitq_headp; bp != NULL; bp = bp->av_forw) {
29697 			SD_UPDATE_KSTATS(un, kstat_waitq_exit, bp);
29698 		}
29699 
29700 		/* empty the waitq */
29701 		un->un_waitq_headp = un->un_waitq_tailp = NULL;
29702 
29703 	} else {
29704 		/*
29705 		 * Go thru the wait queue, pick off all entries with
29706 		 * B_FAILFAST set, and move these onto the failfast queue.
29707 		 */
29708 		for (bp = un->un_waitq_headp; bp != NULL; bp = next_waitq_bp) {
29709 			/*
29710 			 * Save the pointer to the next bp on the wait queue,
29711 			 * so we get to it on the next iteration of this loop.
29712 			 */
29713 			next_waitq_bp = bp->av_forw;
29714 
29715 			/*
29716 			 * If this bp from the wait queue does NOT have
29717 			 * B_FAILFAST set, just move on to the next element
29718 			 * in the wait queue. Note, this is the only place
29719 			 * where it is correct to set prev_waitq_bp.
29720 			 */
29721 			if ((bp->b_flags & B_FAILFAST) == 0) {
29722 				prev_waitq_bp = bp;
29723 				continue;
29724 			}
29725 
29726 			/*
29727 			 * Remove the bp from the wait queue.
29728 			 */
29729 			if (bp == un->un_waitq_headp) {
29730 				/* The bp is the first element of the waitq. */
29731 				un->un_waitq_headp = next_waitq_bp;
29732 				if (un->un_waitq_headp == NULL) {
29733 					/* The wait queue is now empty */
29734 					un->un_waitq_tailp = NULL;
29735 				}
29736 			} else {
29737 				/*
29738 				 * The bp is either somewhere in the middle
29739 				 * or at the end of the wait queue.
29740 				 */
29741 				ASSERT(un->un_waitq_headp != NULL);
29742 				ASSERT(prev_waitq_bp != NULL);
29743 				ASSERT((prev_waitq_bp->b_flags & B_FAILFAST)
29744 				    == 0);
29745 				if (bp == un->un_waitq_tailp) {
29746 					/* bp is the last entry on the waitq. */
29747 					ASSERT(next_waitq_bp == NULL);
29748 					un->un_waitq_tailp = prev_waitq_bp;
29749 				}
29750 				prev_waitq_bp->av_forw = next_waitq_bp;
29751 			}
29752 			bp->av_forw = NULL;
29753 
29754 			/*
29755 			 * update kstat since the bp is moved out of
29756 			 * the waitq
29757 			 */
29758 			SD_UPDATE_KSTATS(un, kstat_waitq_exit, bp);
29759 
29760 			/*
29761 			 * Now put the bp onto the failfast queue.
29762 			 */
29763 			if (un->un_failfast_headp == NULL) {
29764 				/* failfast queue is currently empty */
29765 				ASSERT(un->un_failfast_tailp == NULL);
29766 				un->un_failfast_headp =
29767 				    un->un_failfast_tailp = bp;
29768 			} else {
29769 				/* Add the bp to the end of the failfast q */
29770 				ASSERT(un->un_failfast_tailp != NULL);
29771 				ASSERT(un->un_failfast_tailp->b_flags &
29772 				    B_FAILFAST);
29773 				un->un_failfast_tailp->av_forw = bp;
29774 				un->un_failfast_tailp = bp;
29775 			}
29776 		}
29777 	}
29778 
29779 	/*
29780 	 * Now return all bp's on the failfast queue to their owners.
29781 	 */
29782 	while ((bp = un->un_failfast_headp) != NULL) {
29783 
29784 		un->un_failfast_headp = bp->av_forw;
29785 		if (un->un_failfast_headp == NULL) {
29786 			un->un_failfast_tailp = NULL;
29787 		}
29788 
29789 		/*
29790 		 * We want to return the bp with a failure error code, but
29791 		 * we do not want a call to sd_start_cmds() to occur here,
29792 		 * so use sd_return_failed_command_no_restart() instead of
29793 		 * sd_return_failed_command().
29794 		 */
29795 		sd_return_failed_command_no_restart(un, bp, EIO);
29796 	}
29797 
29798 	/* Flush the xbuf queues if required. */
29799 	if (sd_failfast_flushctl & SD_FAILFAST_FLUSH_ALL_QUEUES) {
29800 		ddi_xbuf_flushq(un->un_xbuf_attr, sd_failfast_flushq_callback);
29801 	}
29802 
29803 	SD_TRACE(SD_LOG_IO_FAILFAST, un,
29804 	    "sd_failfast_flushq: exit: un:0x%p\n", un);
29805 }
29806 
29807 
29808 /*
29809  *    Function: sd_failfast_flushq_callback
29810  *
29811  * Description: Return TRUE if the given bp meets the criteria for failfast
29812  *		flushing. Used with ddi_xbuf_flushq(9F).
29813  *
29814  *   Arguments: bp - ptr to buf struct to be examined.
29815  *
29816  *     Context: Any
29817  */
29818 
29819 static int
29820 sd_failfast_flushq_callback(struct buf *bp)
29821 {
29822 	/*
29823 	 * Return TRUE if (1) we want to flush ALL bufs when the failfast
29824 	 * state is entered; OR (2) the given bp has B_FAILFAST set.
29825 	 */
29826 	return (((sd_failfast_flushctl & SD_FAILFAST_FLUSH_ALL_BUFS) ||
29827 	    (bp->b_flags & B_FAILFAST)) ? TRUE : FALSE);
29828 }
29829 
29830 
29831 
29832 /*
29833  * Function: sd_setup_next_xfer
29834  *
29835  * Description: Prepare next I/O operation using DMA_PARTIAL
29836  *
29837  */
29838 
29839 static int
29840 sd_setup_next_xfer(struct sd_lun *un, struct buf *bp,
29841     struct scsi_pkt *pkt, struct sd_xbuf *xp)
29842 {
29843 	ssize_t	num_blks_not_xfered;
29844 	daddr_t	strt_blk_num;
29845 	ssize_t	bytes_not_xfered;
29846 	int	rval;
29847 
29848 	ASSERT(pkt->pkt_resid == 0);
29849 
29850 	/*
29851 	 * Calculate next block number and amount to be transferred.
29852 	 *
29853 	 * How much data NOT transfered to the HBA yet.
29854 	 */
29855 	bytes_not_xfered = xp->xb_dma_resid;
29856 
29857 	/*
29858 	 * figure how many blocks NOT transfered to the HBA yet.
29859 	 */
29860 	num_blks_not_xfered = SD_BYTES2TGTBLOCKS(un, bytes_not_xfered);
29861 
29862 	/*
29863 	 * set starting block number to the end of what WAS transfered.
29864 	 */
29865 	strt_blk_num = xp->xb_blkno +
29866 	    SD_BYTES2TGTBLOCKS(un, bp->b_bcount - bytes_not_xfered);
29867 
29868 	/*
29869 	 * Move pkt to the next portion of the xfer.  sd_setup_next_rw_pkt
29870 	 * will call scsi_initpkt with NULL_FUNC so we do not have to release
29871 	 * the disk mutex here.
29872 	 */
29873 	rval = sd_setup_next_rw_pkt(un, pkt, bp,
29874 	    strt_blk_num, num_blks_not_xfered);
29875 
29876 	if (rval == 0) {
29877 
29878 		/*
29879 		 * Success.
29880 		 *
29881 		 * Adjust things if there are still more blocks to be
29882 		 * transfered.
29883 		 */
29884 		xp->xb_dma_resid = pkt->pkt_resid;
29885 		pkt->pkt_resid = 0;
29886 
29887 		return (1);
29888 	}
29889 
29890 	/*
29891 	 * There's really only one possible return value from
29892 	 * sd_setup_next_rw_pkt which occurs when scsi_init_pkt
29893 	 * returns NULL.
29894 	 */
29895 	ASSERT(rval == SD_PKT_ALLOC_FAILURE);
29896 
29897 	bp->b_resid = bp->b_bcount;
29898 	bp->b_flags |= B_ERROR;
29899 
29900 	scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
29901 	    "Error setting up next portion of DMA transfer\n");
29902 
29903 	return (0);
29904 }
29905 
29906 /*
29907  *    Function: sd_panic_for_res_conflict
29908  *
29909  * Description: Call panic with a string formatted with "Reservation Conflict"
29910  *		and a human readable identifier indicating the SD instance
29911  *		that experienced the reservation conflict.
29912  *
29913  *   Arguments: un - pointer to the soft state struct for the instance.
29914  *
29915  *     Context: may execute in interrupt context.
29916  */
29917 
29918 #define	SD_RESV_CONFLICT_FMT_LEN 40
29919 void
29920 sd_panic_for_res_conflict(struct sd_lun *un)
29921 {
29922 	char panic_str[SD_RESV_CONFLICT_FMT_LEN+MAXPATHLEN];
29923 	char path_str[MAXPATHLEN];
29924 
29925 	(void) snprintf(panic_str, sizeof (panic_str),
29926 	    "Reservation Conflict\nDisk: %s",
29927 	    ddi_pathname(SD_DEVINFO(un), path_str));
29928 
29929 	panic(panic_str);
29930 }
29931 
29932 /*
29933  * Note: The following sd_faultinjection_ioctl( ) routines implement
29934  * driver support for handling fault injection for error analysis
29935  * causing faults in multiple layers of the driver.
29936  *
29937  */
29938 
29939 #ifdef SD_FAULT_INJECTION
29940 static uint_t   sd_fault_injection_on = 0;
29941 
29942 /*
29943  *    Function: sd_faultinjection_ioctl()
29944  *
29945  * Description: This routine is the driver entry point for handling
29946  *              faultinjection ioctls to inject errors into the
29947  *              layer model
29948  *
29949  *   Arguments: cmd	- the ioctl cmd received
29950  *		arg	- the arguments from user and returns
29951  */
29952 
29953 static void
29954 sd_faultinjection_ioctl(int cmd, intptr_t arg,  struct sd_lun *un) {
29955 
29956 	uint_t i = 0;
29957 	uint_t rval;
29958 
29959 	SD_TRACE(SD_LOG_IOERR, un, "sd_faultinjection_ioctl: entry\n");
29960 
29961 	mutex_enter(SD_MUTEX(un));
29962 
29963 	switch (cmd) {
29964 	case SDIOCRUN:
29965 		/* Allow pushed faults to be injected */
29966 		SD_INFO(SD_LOG_SDTEST, un,
29967 		    "sd_faultinjection_ioctl: Injecting Fault Run\n");
29968 
29969 		sd_fault_injection_on = 1;
29970 
29971 		SD_INFO(SD_LOG_IOERR, un,
29972 		    "sd_faultinjection_ioctl: run finished\n");
29973 		break;
29974 
29975 	case SDIOCSTART:
29976 		/* Start Injection Session */
29977 		SD_INFO(SD_LOG_SDTEST, un,
29978 		    "sd_faultinjection_ioctl: Injecting Fault Start\n");
29979 
29980 		sd_fault_injection_on = 0;
29981 		un->sd_injection_mask = 0xFFFFFFFF;
29982 		for (i = 0; i < SD_FI_MAX_ERROR; i++) {
29983 			un->sd_fi_fifo_pkt[i] = NULL;
29984 			un->sd_fi_fifo_xb[i] = NULL;
29985 			un->sd_fi_fifo_un[i] = NULL;
29986 			un->sd_fi_fifo_arq[i] = NULL;
29987 		}
29988 		un->sd_fi_fifo_start = 0;
29989 		un->sd_fi_fifo_end = 0;
29990 
29991 		mutex_enter(&(un->un_fi_mutex));
29992 		un->sd_fi_log[0] = '\0';
29993 		un->sd_fi_buf_len = 0;
29994 		mutex_exit(&(un->un_fi_mutex));
29995 
29996 		SD_INFO(SD_LOG_IOERR, un,
29997 		    "sd_faultinjection_ioctl: start finished\n");
29998 		break;
29999 
30000 	case SDIOCSTOP:
30001 		/* Stop Injection Session */
30002 		SD_INFO(SD_LOG_SDTEST, un,
30003 		    "sd_faultinjection_ioctl: Injecting Fault Stop\n");
30004 		sd_fault_injection_on = 0;
30005 		un->sd_injection_mask = 0x0;
30006 
30007 		/* Empty stray or unuseds structs from fifo */
30008 		for (i = 0; i < SD_FI_MAX_ERROR; i++) {
30009 			if (un->sd_fi_fifo_pkt[i] != NULL) {
30010 				kmem_free(un->sd_fi_fifo_pkt[i],
30011 				    sizeof (struct sd_fi_pkt));
30012 			}
30013 			if (un->sd_fi_fifo_xb[i] != NULL) {
30014 				kmem_free(un->sd_fi_fifo_xb[i],
30015 				    sizeof (struct sd_fi_xb));
30016 			}
30017 			if (un->sd_fi_fifo_un[i] != NULL) {
30018 				kmem_free(un->sd_fi_fifo_un[i],
30019 				    sizeof (struct sd_fi_un));
30020 			}
30021 			if (un->sd_fi_fifo_arq[i] != NULL) {
30022 				kmem_free(un->sd_fi_fifo_arq[i],
30023 				    sizeof (struct sd_fi_arq));
30024 			}
30025 			un->sd_fi_fifo_pkt[i] = NULL;
30026 			un->sd_fi_fifo_un[i] = NULL;
30027 			un->sd_fi_fifo_xb[i] = NULL;
30028 			un->sd_fi_fifo_arq[i] = NULL;
30029 		}
30030 		un->sd_fi_fifo_start = 0;
30031 		un->sd_fi_fifo_end = 0;
30032 
30033 		SD_INFO(SD_LOG_IOERR, un,
30034 		    "sd_faultinjection_ioctl: stop finished\n");
30035 		break;
30036 
30037 	case SDIOCINSERTPKT:
30038 		/* Store a packet struct to be pushed onto fifo */
30039 		SD_INFO(SD_LOG_SDTEST, un,
30040 		    "sd_faultinjection_ioctl: Injecting Fault Insert Pkt\n");
30041 
30042 		i = un->sd_fi_fifo_end % SD_FI_MAX_ERROR;
30043 
30044 		sd_fault_injection_on = 0;
30045 
30046 		/* No more that SD_FI_MAX_ERROR allowed in Queue */
30047 		if (un->sd_fi_fifo_pkt[i] != NULL) {
30048 			kmem_free(un->sd_fi_fifo_pkt[i],
30049 			    sizeof (struct sd_fi_pkt));
30050 		}
30051 		if (arg != NULL) {
30052 			un->sd_fi_fifo_pkt[i] =
30053 			    kmem_alloc(sizeof (struct sd_fi_pkt), KM_NOSLEEP);
30054 			if (un->sd_fi_fifo_pkt[i] == NULL) {
30055 				/* Alloc failed don't store anything */
30056 				break;
30057 			}
30058 			rval = ddi_copyin((void *)arg, un->sd_fi_fifo_pkt[i],
30059 			    sizeof (struct sd_fi_pkt), 0);
30060 			if (rval == -1) {
30061 				kmem_free(un->sd_fi_fifo_pkt[i],
30062 				    sizeof (struct sd_fi_pkt));
30063 				un->sd_fi_fifo_pkt[i] = NULL;
30064 			}
30065 		} else {
30066 			SD_INFO(SD_LOG_IOERR, un,
30067 			    "sd_faultinjection_ioctl: pkt null\n");
30068 		}
30069 		break;
30070 
30071 	case SDIOCINSERTXB:
30072 		/* Store a xb struct to be pushed onto fifo */
30073 		SD_INFO(SD_LOG_SDTEST, un,
30074 		    "sd_faultinjection_ioctl: Injecting Fault Insert XB\n");
30075 
30076 		i = un->sd_fi_fifo_end % SD_FI_MAX_ERROR;
30077 
30078 		sd_fault_injection_on = 0;
30079 
30080 		if (un->sd_fi_fifo_xb[i] != NULL) {
30081 			kmem_free(un->sd_fi_fifo_xb[i],
30082 			    sizeof (struct sd_fi_xb));
30083 			un->sd_fi_fifo_xb[i] = NULL;
30084 		}
30085 		if (arg != NULL) {
30086 			un->sd_fi_fifo_xb[i] =
30087 			    kmem_alloc(sizeof (struct sd_fi_xb), KM_NOSLEEP);
30088 			if (un->sd_fi_fifo_xb[i] == NULL) {
30089 				/* Alloc failed don't store anything */
30090 				break;
30091 			}
30092 			rval = ddi_copyin((void *)arg, un->sd_fi_fifo_xb[i],
30093 			    sizeof (struct sd_fi_xb), 0);
30094 
30095 			if (rval == -1) {
30096 				kmem_free(un->sd_fi_fifo_xb[i],
30097 				    sizeof (struct sd_fi_xb));
30098 				un->sd_fi_fifo_xb[i] = NULL;
30099 			}
30100 		} else {
30101 			SD_INFO(SD_LOG_IOERR, un,
30102 			    "sd_faultinjection_ioctl: xb null\n");
30103 		}
30104 		break;
30105 
30106 	case SDIOCINSERTUN:
30107 		/* Store a un struct to be pushed onto fifo */
30108 		SD_INFO(SD_LOG_SDTEST, un,
30109 		    "sd_faultinjection_ioctl: Injecting Fault Insert UN\n");
30110 
30111 		i = un->sd_fi_fifo_end % SD_FI_MAX_ERROR;
30112 
30113 		sd_fault_injection_on = 0;
30114 
30115 		if (un->sd_fi_fifo_un[i] != NULL) {
30116 			kmem_free(un->sd_fi_fifo_un[i],
30117 			    sizeof (struct sd_fi_un));
30118 			un->sd_fi_fifo_un[i] = NULL;
30119 		}
30120 		if (arg != NULL) {
30121 			un->sd_fi_fifo_un[i] =
30122 			    kmem_alloc(sizeof (struct sd_fi_un), KM_NOSLEEP);
30123 			if (un->sd_fi_fifo_un[i] == NULL) {
30124 				/* Alloc failed don't store anything */
30125 				break;
30126 			}
30127 			rval = ddi_copyin((void *)arg, un->sd_fi_fifo_un[i],
30128 			    sizeof (struct sd_fi_un), 0);
30129 			if (rval == -1) {
30130 				kmem_free(un->sd_fi_fifo_un[i],
30131 				    sizeof (struct sd_fi_un));
30132 				un->sd_fi_fifo_un[i] = NULL;
30133 			}
30134 
30135 		} else {
30136 			SD_INFO(SD_LOG_IOERR, un,
30137 			    "sd_faultinjection_ioctl: un null\n");
30138 		}
30139 
30140 		break;
30141 
30142 	case SDIOCINSERTARQ:
30143 		/* Store a arq struct to be pushed onto fifo */
30144 		SD_INFO(SD_LOG_SDTEST, un,
30145 		    "sd_faultinjection_ioctl: Injecting Fault Insert ARQ\n");
30146 		i = un->sd_fi_fifo_end % SD_FI_MAX_ERROR;
30147 
30148 		sd_fault_injection_on = 0;
30149 
30150 		if (un->sd_fi_fifo_arq[i] != NULL) {
30151 			kmem_free(un->sd_fi_fifo_arq[i],
30152 			    sizeof (struct sd_fi_arq));
30153 			un->sd_fi_fifo_arq[i] = NULL;
30154 		}
30155 		if (arg != NULL) {
30156 			un->sd_fi_fifo_arq[i] =
30157 			    kmem_alloc(sizeof (struct sd_fi_arq), KM_NOSLEEP);
30158 			if (un->sd_fi_fifo_arq[i] == NULL) {
30159 				/* Alloc failed don't store anything */
30160 				break;
30161 			}
30162 			rval = ddi_copyin((void *)arg, un->sd_fi_fifo_arq[i],
30163 			    sizeof (struct sd_fi_arq), 0);
30164 			if (rval == -1) {
30165 				kmem_free(un->sd_fi_fifo_arq[i],
30166 				    sizeof (struct sd_fi_arq));
30167 				un->sd_fi_fifo_arq[i] = NULL;
30168 			}
30169 
30170 		} else {
30171 			SD_INFO(SD_LOG_IOERR, un,
30172 			    "sd_faultinjection_ioctl: arq null\n");
30173 		}
30174 
30175 		break;
30176 
30177 	case SDIOCPUSH:
30178 		/* Push stored xb, pkt, un, and arq onto fifo */
30179 		sd_fault_injection_on = 0;
30180 
30181 		if (arg != NULL) {
30182 			rval = ddi_copyin((void *)arg, &i, sizeof (uint_t), 0);
30183 			if (rval != -1 &&
30184 			    un->sd_fi_fifo_end + i < SD_FI_MAX_ERROR) {
30185 				un->sd_fi_fifo_end += i;
30186 			}
30187 		} else {
30188 			SD_INFO(SD_LOG_IOERR, un,
30189 			    "sd_faultinjection_ioctl: push arg null\n");
30190 			if (un->sd_fi_fifo_end + i < SD_FI_MAX_ERROR) {
30191 				un->sd_fi_fifo_end++;
30192 			}
30193 		}
30194 		SD_INFO(SD_LOG_IOERR, un,
30195 		    "sd_faultinjection_ioctl: push to end=%d\n",
30196 		    un->sd_fi_fifo_end);
30197 		break;
30198 
30199 	case SDIOCRETRIEVE:
30200 		/* Return buffer of log from Injection session */
30201 		SD_INFO(SD_LOG_SDTEST, un,
30202 		    "sd_faultinjection_ioctl: Injecting Fault Retreive");
30203 
30204 		sd_fault_injection_on = 0;
30205 
30206 		mutex_enter(&(un->un_fi_mutex));
30207 		rval = ddi_copyout(un->sd_fi_log, (void *)arg,
30208 		    un->sd_fi_buf_len+1, 0);
30209 		mutex_exit(&(un->un_fi_mutex));
30210 
30211 		if (rval == -1) {
30212 			/*
30213 			 * arg is possibly invalid setting
30214 			 * it to NULL for return
30215 			 */
30216 			arg = NULL;
30217 		}
30218 		break;
30219 	}
30220 
30221 	mutex_exit(SD_MUTEX(un));
30222 	SD_TRACE(SD_LOG_IOERR, un, "sd_faultinjection_ioctl:"
30223 			    " exit\n");
30224 }
30225 
30226 
30227 /*
30228  *    Function: sd_injection_log()
30229  *
30230  * Description: This routine adds buff to the already existing injection log
30231  *              for retrieval via faultinjection_ioctl for use in fault
30232  *              detection and recovery
30233  *
30234  *   Arguments: buf - the string to add to the log
30235  */
30236 
30237 static void
30238 sd_injection_log(char *buf, struct sd_lun *un)
30239 {
30240 	uint_t len;
30241 
30242 	ASSERT(un != NULL);
30243 	ASSERT(buf != NULL);
30244 
30245 	mutex_enter(&(un->un_fi_mutex));
30246 
30247 	len = min(strlen(buf), 255);
30248 	/* Add logged value to Injection log to be returned later */
30249 	if (len + un->sd_fi_buf_len < SD_FI_MAX_BUF) {
30250 		uint_t	offset = strlen((char *)un->sd_fi_log);
30251 		char *destp = (char *)un->sd_fi_log + offset;
30252 		int i;
30253 		for (i = 0; i < len; i++) {
30254 			*destp++ = *buf++;
30255 		}
30256 		un->sd_fi_buf_len += len;
30257 		un->sd_fi_log[un->sd_fi_buf_len] = '\0';
30258 	}
30259 
30260 	mutex_exit(&(un->un_fi_mutex));
30261 }
30262 
30263 
30264 /*
30265  *    Function: sd_faultinjection()
30266  *
30267  * Description: This routine takes the pkt and changes its
30268  *		content based on error injection scenerio.
30269  *
30270  *   Arguments: pktp	- packet to be changed
30271  */
30272 
30273 static void
30274 sd_faultinjection(struct scsi_pkt *pktp)
30275 {
30276 	uint_t i;
30277 	struct sd_fi_pkt *fi_pkt;
30278 	struct sd_fi_xb *fi_xb;
30279 	struct sd_fi_un *fi_un;
30280 	struct sd_fi_arq *fi_arq;
30281 	struct buf *bp;
30282 	struct sd_xbuf *xb;
30283 	struct sd_lun *un;
30284 
30285 	ASSERT(pktp != NULL);
30286 
30287 	/* pull bp xb and un from pktp */
30288 	bp = (struct buf *)pktp->pkt_private;
30289 	xb = SD_GET_XBUF(bp);
30290 	un = SD_GET_UN(bp);
30291 
30292 	ASSERT(un != NULL);
30293 
30294 	mutex_enter(SD_MUTEX(un));
30295 
30296 	SD_TRACE(SD_LOG_SDTEST, un,
30297 	    "sd_faultinjection: entry Injection from sdintr\n");
30298 
30299 	/* if injection is off return */
30300 	if (sd_fault_injection_on == 0 ||
30301 	    un->sd_fi_fifo_start == un->sd_fi_fifo_end) {
30302 		mutex_exit(SD_MUTEX(un));
30303 		return;
30304 	}
30305 
30306 	SD_INFO(SD_LOG_SDTEST, un,
30307 	    "sd_faultinjection: is working for copying\n");
30308 
30309 	/* take next set off fifo */
30310 	i = un->sd_fi_fifo_start % SD_FI_MAX_ERROR;
30311 
30312 	fi_pkt = un->sd_fi_fifo_pkt[i];
30313 	fi_xb = un->sd_fi_fifo_xb[i];
30314 	fi_un = un->sd_fi_fifo_un[i];
30315 	fi_arq = un->sd_fi_fifo_arq[i];
30316 
30317 
30318 	/* set variables accordingly */
30319 	/* set pkt if it was on fifo */
30320 	if (fi_pkt != NULL) {
30321 		SD_CONDSET(pktp, pkt, pkt_flags, "pkt_flags");
30322 		SD_CONDSET(*pktp, pkt, pkt_scbp, "pkt_scbp");
30323 		if (fi_pkt->pkt_cdbp != 0xff)
30324 			SD_CONDSET(*pktp, pkt, pkt_cdbp, "pkt_cdbp");
30325 		SD_CONDSET(pktp, pkt, pkt_state, "pkt_state");
30326 		SD_CONDSET(pktp, pkt, pkt_statistics, "pkt_statistics");
30327 		SD_CONDSET(pktp, pkt, pkt_reason, "pkt_reason");
30328 
30329 	}
30330 	/* set xb if it was on fifo */
30331 	if (fi_xb != NULL) {
30332 		SD_CONDSET(xb, xb, xb_blkno, "xb_blkno");
30333 		SD_CONDSET(xb, xb, xb_dma_resid, "xb_dma_resid");
30334 		if (fi_xb->xb_retry_count != 0)
30335 			SD_CONDSET(xb, xb, xb_retry_count, "xb_retry_count");
30336 		SD_CONDSET(xb, xb, xb_victim_retry_count,
30337 		    "xb_victim_retry_count");
30338 		SD_CONDSET(xb, xb, xb_sense_status, "xb_sense_status");
30339 		SD_CONDSET(xb, xb, xb_sense_state, "xb_sense_state");
30340 		SD_CONDSET(xb, xb, xb_sense_resid, "xb_sense_resid");
30341 
30342 		/* copy in block data from sense */
30343 		/*
30344 		 * if (fi_xb->xb_sense_data[0] != -1) {
30345 		 *	bcopy(fi_xb->xb_sense_data, xb->xb_sense_data,
30346 		 *	SENSE_LENGTH);
30347 		 * }
30348 		 */
30349 		bcopy(fi_xb->xb_sense_data, xb->xb_sense_data, SENSE_LENGTH);
30350 
30351 		/* copy in extended sense codes */
30352 		SD_CONDSET(((struct scsi_extended_sense *)xb->xb_sense_data),
30353 		    xb, es_code, "es_code");
30354 		SD_CONDSET(((struct scsi_extended_sense *)xb->xb_sense_data),
30355 		    xb, es_key, "es_key");
30356 		SD_CONDSET(((struct scsi_extended_sense *)xb->xb_sense_data),
30357 		    xb, es_add_code, "es_add_code");
30358 		SD_CONDSET(((struct scsi_extended_sense *)xb->xb_sense_data),
30359 		    xb, es_qual_code, "es_qual_code");
30360 		struct scsi_extended_sense *esp;
30361 		esp = (struct scsi_extended_sense *)xb->xb_sense_data;
30362 		esp->es_class = CLASS_EXTENDED_SENSE;
30363 	}
30364 
30365 	/* set un if it was on fifo */
30366 	if (fi_un != NULL) {
30367 		SD_CONDSET(un->un_sd->sd_inq, un, inq_rmb, "inq_rmb");
30368 		SD_CONDSET(un, un, un_ctype, "un_ctype");
30369 		SD_CONDSET(un, un, un_reset_retry_count,
30370 		    "un_reset_retry_count");
30371 		SD_CONDSET(un, un, un_reservation_type, "un_reservation_type");
30372 		SD_CONDSET(un, un, un_resvd_status, "un_resvd_status");
30373 		SD_CONDSET(un, un, un_f_arq_enabled, "un_f_arq_enabled");
30374 		SD_CONDSET(un, un, un_f_allow_bus_device_reset,
30375 		    "un_f_allow_bus_device_reset");
30376 		SD_CONDSET(un, un, un_f_opt_queueing, "un_f_opt_queueing");
30377 
30378 	}
30379 
30380 	/* copy in auto request sense if it was on fifo */
30381 	if (fi_arq != NULL) {
30382 		bcopy(fi_arq, pktp->pkt_scbp, sizeof (struct sd_fi_arq));
30383 	}
30384 
30385 	/* free structs */
30386 	if (un->sd_fi_fifo_pkt[i] != NULL) {
30387 		kmem_free(un->sd_fi_fifo_pkt[i], sizeof (struct sd_fi_pkt));
30388 	}
30389 	if (un->sd_fi_fifo_xb[i] != NULL) {
30390 		kmem_free(un->sd_fi_fifo_xb[i], sizeof (struct sd_fi_xb));
30391 	}
30392 	if (un->sd_fi_fifo_un[i] != NULL) {
30393 		kmem_free(un->sd_fi_fifo_un[i], sizeof (struct sd_fi_un));
30394 	}
30395 	if (un->sd_fi_fifo_arq[i] != NULL) {
30396 		kmem_free(un->sd_fi_fifo_arq[i], sizeof (struct sd_fi_arq));
30397 	}
30398 
30399 	/*
30400 	 * kmem_free does not gurantee to set to NULL
30401 	 * since we uses these to determine if we set
30402 	 * values or not lets confirm they are always
30403 	 * NULL after free
30404 	 */
30405 	un->sd_fi_fifo_pkt[i] = NULL;
30406 	un->sd_fi_fifo_un[i] = NULL;
30407 	un->sd_fi_fifo_xb[i] = NULL;
30408 	un->sd_fi_fifo_arq[i] = NULL;
30409 
30410 	un->sd_fi_fifo_start++;
30411 
30412 	mutex_exit(SD_MUTEX(un));
30413 
30414 	SD_INFO(SD_LOG_SDTEST, un, "sd_faultinjection: exit\n");
30415 }
30416 
30417 #endif /* SD_FAULT_INJECTION */
30418 
30419 /*
30420  * This routine is invoked in sd_unit_attach(). Before calling it, the
30421  * properties in conf file should be processed already, and "hotpluggable"
30422  * property was processed also.
30423  *
30424  * The sd driver distinguishes 3 different type of devices: removable media,
30425  * non-removable media, and hotpluggable. Below the differences are defined:
30426  *
30427  * 1. Device ID
30428  *
30429  *     The device ID of a device is used to identify this device. Refer to
30430  *     ddi_devid_register(9F).
30431  *
30432  *     For a non-removable media disk device which can provide 0x80 or 0x83
30433  *     VPD page (refer to INQUIRY command of SCSI SPC specification), a unique
30434  *     device ID is created to identify this device. For other non-removable
30435  *     media devices, a default device ID is created only if this device has
30436  *     at least 2 alter cylinders. Otherwise, this device has no devid.
30437  *
30438  *     -------------------------------------------------------
30439  *     removable media   hotpluggable  | Can Have Device ID
30440  *     -------------------------------------------------------
30441  *         false             false     |     Yes
30442  *         false             true      |     Yes
30443  *         true                x       |     No
30444  *     ------------------------------------------------------
30445  *
30446  *
30447  * 2. SCSI group 4 commands
30448  *
30449  *     In SCSI specs, only some commands in group 4 command set can use
30450  *     8-byte addresses that can be used to access >2TB storage spaces.
30451  *     Other commands have no such capability. Without supporting group4,
30452  *     it is impossible to make full use of storage spaces of a disk with
30453  *     capacity larger than 2TB.
30454  *
30455  *     -----------------------------------------------
30456  *     removable media   hotpluggable   LP64  |  Group
30457  *     -----------------------------------------------
30458  *           false          false       false |   1
30459  *           false          false       true  |   4
30460  *           false          true        false |   1
30461  *           false          true        true  |   4
30462  *           true             x           x   |   5
30463  *     -----------------------------------------------
30464  *
30465  *
30466  * 3. Check for VTOC Label
30467  *
30468  *     If a direct-access disk has no EFI label, sd will check if it has a
30469  *     valid VTOC label. Now, sd also does that check for removable media
30470  *     and hotpluggable devices.
30471  *
30472  *     --------------------------------------------------------------
30473  *     Direct-Access   removable media    hotpluggable |  Check Label
30474  *     -------------------------------------------------------------
30475  *         false          false           false        |   No
30476  *         false          false           true         |   No
30477  *         false          true            false        |   Yes
30478  *         false          true            true         |   Yes
30479  *         true            x                x          |   Yes
30480  *     --------------------------------------------------------------
30481  *
30482  *
30483  * 4. Building default VTOC label
30484  *
30485  *     As section 3 says, sd checks if some kinds of devices have VTOC label.
30486  *     If those devices have no valid VTOC label, sd(7d) will attempt to
30487  *     create default VTOC for them. Currently sd creates default VTOC label
30488  *     for all devices on x86 platform (VTOC_16), but only for removable
30489  *     media devices on SPARC (VTOC_8).
30490  *
30491  *     -----------------------------------------------------------
30492  *       removable media hotpluggable platform   |   Default Label
30493  *     -----------------------------------------------------------
30494  *             false          false    sparc     |     No
30495  *             false          true      x86      |     Yes
30496  *             false          true     sparc     |     Yes
30497  *             true             x        x       |     Yes
30498  *     ----------------------------------------------------------
30499  *
30500  *
30501  * 5. Supported blocksizes of target devices
30502  *
30503  *     Sd supports non-512-byte blocksize for removable media devices only.
30504  *     For other devices, only 512-byte blocksize is supported. This may be
30505  *     changed in near future because some RAID devices require non-512-byte
30506  *     blocksize
30507  *
30508  *     -----------------------------------------------------------
30509  *     removable media    hotpluggable    | non-512-byte blocksize
30510  *     -----------------------------------------------------------
30511  *           false          false         |   No
30512  *           false          true          |   No
30513  *           true             x           |   Yes
30514  *     -----------------------------------------------------------
30515  *
30516  *
30517  * 6. Automatic mount & unmount
30518  *
30519  *     Sd(7d) driver provides DKIOCREMOVABLE ioctl. This ioctl is used to query
30520  *     if a device is removable media device. It return 1 for removable media
30521  *     devices, and 0 for others.
30522  *
30523  *     The automatic mounting subsystem should distinguish between the types
30524  *     of devices and apply automounting policies to each.
30525  *
30526  *
30527  * 7. fdisk partition management
30528  *
30529  *     Fdisk is traditional partition method on x86 platform. Sd(7d) driver
30530  *     just supports fdisk partitions on x86 platform. On sparc platform, sd
30531  *     doesn't support fdisk partitions at all. Note: pcfs(7fs) can recognize
30532  *     fdisk partitions on both x86 and SPARC platform.
30533  *
30534  *     -----------------------------------------------------------
30535  *       platform   removable media  USB/1394  |  fdisk supported
30536  *     -----------------------------------------------------------
30537  *        x86         X               X        |       true
30538  *     ------------------------------------------------------------
30539  *        sparc       X               X        |       false
30540  *     ------------------------------------------------------------
30541  *
30542  *
30543  * 8. MBOOT/MBR
30544  *
30545  *     Although sd(7d) doesn't support fdisk on SPARC platform, it does support
30546  *     read/write mboot for removable media devices on sparc platform.
30547  *
30548  *     -----------------------------------------------------------
30549  *       platform   removable media  USB/1394  |  mboot supported
30550  *     -----------------------------------------------------------
30551  *        x86         X               X        |       true
30552  *     ------------------------------------------------------------
30553  *        sparc      false           false     |       false
30554  *        sparc      false           true      |       true
30555  *        sparc      true            false     |       true
30556  *        sparc      true            true      |       true
30557  *     ------------------------------------------------------------
30558  *
30559  *
30560  * 9.  error handling during opening device
30561  *
30562  *     If failed to open a disk device, an errno is returned. For some kinds
30563  *     of errors, different errno is returned depending on if this device is
30564  *     a removable media device. This brings USB/1394 hard disks in line with
30565  *     expected hard disk behavior. It is not expected that this breaks any
30566  *     application.
30567  *
30568  *     ------------------------------------------------------
30569  *       removable media    hotpluggable   |  errno
30570  *     ------------------------------------------------------
30571  *             false          false        |   EIO
30572  *             false          true         |   EIO
30573  *             true             x          |   ENXIO
30574  *     ------------------------------------------------------
30575  *
30576  *
30577  * 11. ioctls: DKIOCEJECT, CDROMEJECT
30578  *
30579  *     These IOCTLs are applicable only to removable media devices.
30580  *
30581  *     -----------------------------------------------------------
30582  *       removable media    hotpluggable   |DKIOCEJECT, CDROMEJECT
30583  *     -----------------------------------------------------------
30584  *             false          false        |     No
30585  *             false          true         |     No
30586  *             true            x           |     Yes
30587  *     -----------------------------------------------------------
30588  *
30589  *
30590  * 12. Kstats for partitions
30591  *
30592  *     sd creates partition kstat for non-removable media devices. USB and
30593  *     Firewire hard disks now have partition kstats
30594  *
30595  *      ------------------------------------------------------
30596  *       removable media    hotpluggable   |   kstat
30597  *      ------------------------------------------------------
30598  *             false          false        |    Yes
30599  *             false          true         |    Yes
30600  *             true             x          |    No
30601  *       ------------------------------------------------------
30602  *
30603  *
30604  * 13. Removable media & hotpluggable properties
30605  *
30606  *     Sd driver creates a "removable-media" property for removable media
30607  *     devices. Parent nexus drivers create a "hotpluggable" property if
30608  *     it supports hotplugging.
30609  *
30610  *     ---------------------------------------------------------------------
30611  *     removable media   hotpluggable |  "removable-media"   " hotpluggable"
30612  *     ---------------------------------------------------------------------
30613  *       false            false       |    No                   No
30614  *       false            true        |    No                   Yes
30615  *       true             false       |    Yes                  No
30616  *       true             true        |    Yes                  Yes
30617  *     ---------------------------------------------------------------------
30618  *
30619  *
30620  * 14. Power Management
30621  *
30622  *     sd only power manages removable media devices or devices that support
30623  *     LOG_SENSE or have a "pm-capable" property  (PSARC/2002/250)
30624  *
30625  *     A parent nexus that supports hotplugging can also set "pm-capable"
30626  *     if the disk can be power managed.
30627  *
30628  *     ------------------------------------------------------------
30629  *       removable media hotpluggable pm-capable  |   power manage
30630  *     ------------------------------------------------------------
30631  *             false          false     false     |     No
30632  *             false          false     true      |     Yes
30633  *             false          true      false     |     No
30634  *             false          true      true      |     Yes
30635  *             true             x        x        |     Yes
30636  *     ------------------------------------------------------------
30637  *
30638  *      USB and firewire hard disks can now be power managed independently
30639  *      of the framebuffer
30640  *
30641  *
30642  * 15. Support for USB disks with capacity larger than 1TB
30643  *
30644  *     Currently, sd doesn't permit a fixed disk device with capacity
30645  *     larger than 1TB to be used in a 32-bit operating system environment.
30646  *     However, sd doesn't do that for removable media devices. Instead, it
30647  *     assumes that removable media devices cannot have a capacity larger
30648  *     than 1TB. Therefore, using those devices on 32-bit system is partially
30649  *     supported, which can cause some unexpected results.
30650  *
30651  *     ---------------------------------------------------------------------
30652  *       removable media    USB/1394 | Capacity > 1TB |   Used in 32-bit env
30653  *     ---------------------------------------------------------------------
30654  *             false          false  |   true         |     no
30655  *             false          true   |   true         |     no
30656  *             true           false  |   true         |     Yes
30657  *             true           true   |   true         |     Yes
30658  *     ---------------------------------------------------------------------
30659  *
30660  *
30661  * 16. Check write-protection at open time
30662  *
30663  *     When a removable media device is being opened for writing without NDELAY
30664  *     flag, sd will check if this device is writable. If attempting to open
30665  *     without NDELAY flag a write-protected device, this operation will abort.
30666  *
30667  *     ------------------------------------------------------------
30668  *       removable media    USB/1394   |   WP Check
30669  *     ------------------------------------------------------------
30670  *             false          false    |     No
30671  *             false          true     |     No
30672  *             true           false    |     Yes
30673  *             true           true     |     Yes
30674  *     ------------------------------------------------------------
30675  *
30676  *
30677  * 17. syslog when corrupted VTOC is encountered
30678  *
30679  *      Currently, if an invalid VTOC is encountered, sd only print syslog
30680  *      for fixed SCSI disks.
30681  *     ------------------------------------------------------------
30682  *       removable media    USB/1394   |   print syslog
30683  *     ------------------------------------------------------------
30684  *             false          false    |     Yes
30685  *             false          true     |     No
30686  *             true           false    |     No
30687  *             true           true     |     No
30688  *     ------------------------------------------------------------
30689  */
30690 static void
30691 sd_set_unit_attributes(struct sd_lun *un, dev_info_t *devi)
30692 {
30693 	int	pm_cap;
30694 
30695 	ASSERT(un->un_sd);
30696 	ASSERT(un->un_sd->sd_inq);
30697 
30698 	/*
30699 	 * Enable SYNC CACHE support for all devices.
30700 	 */
30701 	un->un_f_sync_cache_supported = TRUE;
30702 
30703 	/*
30704 	 * Set the sync cache required flag to false.
30705 	 * This would ensure that there is no SYNC CACHE
30706 	 * sent when there are no writes
30707 	 */
30708 	un->un_f_sync_cache_required = FALSE;
30709 
30710 	if (un->un_sd->sd_inq->inq_rmb) {
30711 		/*
30712 		 * The media of this device is removable. And for this kind
30713 		 * of devices, it is possible to change medium after opening
30714 		 * devices. Thus we should support this operation.
30715 		 */
30716 		un->un_f_has_removable_media = TRUE;
30717 
30718 		/*
30719 		 * support non-512-byte blocksize of removable media devices
30720 		 */
30721 		un->un_f_non_devbsize_supported = TRUE;
30722 
30723 		/*
30724 		 * Assume that all removable media devices support DOOR_LOCK
30725 		 */
30726 		un->un_f_doorlock_supported = TRUE;
30727 
30728 		/*
30729 		 * For a removable media device, it is possible to be opened
30730 		 * with NDELAY flag when there is no media in drive, in this
30731 		 * case we don't care if device is writable. But if without
30732 		 * NDELAY flag, we need to check if media is write-protected.
30733 		 */
30734 		un->un_f_chk_wp_open = TRUE;
30735 
30736 		/*
30737 		 * need to start a SCSI watch thread to monitor media state,
30738 		 * when media is being inserted or ejected, notify syseventd.
30739 		 */
30740 		un->un_f_monitor_media_state = TRUE;
30741 
30742 		/*
30743 		 * Some devices don't support START_STOP_UNIT command.
30744 		 * Therefore, we'd better check if a device supports it
30745 		 * before sending it.
30746 		 */
30747 		un->un_f_check_start_stop = TRUE;
30748 
30749 		/*
30750 		 * support eject media ioctl:
30751 		 *		FDEJECT, DKIOCEJECT, CDROMEJECT
30752 		 */
30753 		un->un_f_eject_media_supported = TRUE;
30754 
30755 		/*
30756 		 * Because many removable-media devices don't support
30757 		 * LOG_SENSE, we couldn't use this command to check if
30758 		 * a removable media device support power-management.
30759 		 * We assume that they support power-management via
30760 		 * START_STOP_UNIT command and can be spun up and down
30761 		 * without limitations.
30762 		 */
30763 		un->un_f_pm_supported = TRUE;
30764 
30765 		/*
30766 		 * Need to create a zero length (Boolean) property
30767 		 * removable-media for the removable media devices.
30768 		 * Note that the return value of the property is not being
30769 		 * checked, since if unable to create the property
30770 		 * then do not want the attach to fail altogether. Consistent
30771 		 * with other property creation in attach.
30772 		 */
30773 		(void) ddi_prop_create(DDI_DEV_T_NONE, devi,
30774 		    DDI_PROP_CANSLEEP, "removable-media", NULL, 0);
30775 
30776 	} else {
30777 		/*
30778 		 * create device ID for device
30779 		 */
30780 		un->un_f_devid_supported = TRUE;
30781 
30782 		/*
30783 		 * Spin up non-removable-media devices once it is attached
30784 		 */
30785 		un->un_f_attach_spinup = TRUE;
30786 
30787 		/*
30788 		 * According to SCSI specification, Sense data has two kinds of
30789 		 * format: fixed format, and descriptor format. At present, we
30790 		 * don't support descriptor format sense data for removable
30791 		 * media.
30792 		 */
30793 		if (SD_INQUIRY(un)->inq_dtype == DTYPE_DIRECT) {
30794 			un->un_f_descr_format_supported = TRUE;
30795 		}
30796 
30797 		/*
30798 		 * kstats are created only for non-removable media devices.
30799 		 *
30800 		 * Set this in sd.conf to 0 in order to disable kstats.  The
30801 		 * default is 1, so they are enabled by default.
30802 		 */
30803 		un->un_f_pkstats_enabled = (ddi_prop_get_int(DDI_DEV_T_ANY,
30804 		    SD_DEVINFO(un), DDI_PROP_DONTPASS,
30805 		    "enable-partition-kstats", 1));
30806 
30807 		/*
30808 		 * Check if HBA has set the "pm-capable" property.
30809 		 * If "pm-capable" exists and is non-zero then we can
30810 		 * power manage the device without checking the start/stop
30811 		 * cycle count log sense page.
30812 		 *
30813 		 * If "pm-capable" exists and is set to be false (0),
30814 		 * then we should not power manage the device.
30815 		 *
30816 		 * If "pm-capable" doesn't exist then pm_cap will
30817 		 * be set to SD_PM_CAPABLE_UNDEFINED (-1).  In this case,
30818 		 * sd will check the start/stop cycle count log sense page
30819 		 * and power manage the device if the cycle count limit has
30820 		 * not been exceeded.
30821 		 */
30822 		pm_cap = ddi_prop_get_int(DDI_DEV_T_ANY, devi,
30823 		    DDI_PROP_DONTPASS, "pm-capable", SD_PM_CAPABLE_UNDEFINED);
30824 		if (SD_PM_CAPABLE_IS_UNDEFINED(pm_cap)) {
30825 			un->un_f_log_sense_supported = TRUE;
30826 			if (!un->un_f_power_condition_disabled &&
30827 			    SD_INQUIRY(un)->inq_ansi == 6) {
30828 				un->un_f_power_condition_supported = TRUE;
30829 			}
30830 		} else {
30831 			/*
30832 			 * pm-capable property exists.
30833 			 *
30834 			 * Convert "TRUE" values for pm_cap to
30835 			 * SD_PM_CAPABLE_IS_TRUE to make it easier to check
30836 			 * later. "TRUE" values are any values defined in
30837 			 * inquiry.h.
30838 			 */
30839 			if (SD_PM_CAPABLE_IS_FALSE(pm_cap)) {
30840 				un->un_f_log_sense_supported = FALSE;
30841 			} else {
30842 				/* SD_PM_CAPABLE_IS_TRUE case */
30843 				un->un_f_pm_supported = TRUE;
30844 				if (!un->un_f_power_condition_disabled &&
30845 				    SD_PM_CAPABLE_IS_SPC_4(pm_cap)) {
30846 					un->un_f_power_condition_supported =
30847 					    TRUE;
30848 				}
30849 				if (SD_PM_CAP_LOG_SUPPORTED(pm_cap)) {
30850 					un->un_f_log_sense_supported = TRUE;
30851 					un->un_f_pm_log_sense_smart =
30852 					    SD_PM_CAP_SMART_LOG(pm_cap);
30853 				}
30854 			}
30855 
30856 			SD_INFO(SD_LOG_ATTACH_DETACH, un,
30857 			    "sd_unit_attach: un:0x%p pm-capable "
30858 			    "property set to %d.\n", un, un->un_f_pm_supported);
30859 		}
30860 	}
30861 
30862 	if (un->un_f_is_hotpluggable) {
30863 
30864 		/*
30865 		 * Have to watch hotpluggable devices as well, since
30866 		 * that's the only way for userland applications to
30867 		 * detect hot removal while device is busy/mounted.
30868 		 */
30869 		un->un_f_monitor_media_state = TRUE;
30870 
30871 		un->un_f_check_start_stop = TRUE;
30872 
30873 	}
30874 }
30875 
30876 /*
30877  * sd_tg_rdwr:
30878  * Provides rdwr access for cmlb via sd_tgops. The start_block is
30879  * in sys block size, req_length in bytes.
30880  *
30881  */
30882 static int
30883 sd_tg_rdwr(dev_info_t *devi, uchar_t cmd, void *bufaddr,
30884     diskaddr_t start_block, size_t reqlength, void *tg_cookie)
30885 {
30886 	struct sd_lun *un;
30887 	int path_flag = (int)(uintptr_t)tg_cookie;
30888 	char *dkl = NULL;
30889 	diskaddr_t real_addr = start_block;
30890 	diskaddr_t first_byte, end_block;
30891 
30892 	size_t	buffer_size = reqlength;
30893 	int rval = 0;
30894 	diskaddr_t	cap;
30895 	uint32_t	lbasize;
30896 	sd_ssc_t	*ssc;
30897 
30898 	un = ddi_get_soft_state(sd_state, ddi_get_instance(devi));
30899 	if (un == NULL)
30900 		return (ENXIO);
30901 
30902 	if (cmd != TG_READ && cmd != TG_WRITE)
30903 		return (EINVAL);
30904 
30905 	ssc = sd_ssc_init(un);
30906 	mutex_enter(SD_MUTEX(un));
30907 	if (un->un_f_tgt_blocksize_is_valid == FALSE) {
30908 		mutex_exit(SD_MUTEX(un));
30909 		rval = sd_send_scsi_READ_CAPACITY(ssc, (uint64_t *)&cap,
30910 		    &lbasize, path_flag);
30911 		if (rval != 0)
30912 			goto done1;
30913 		mutex_enter(SD_MUTEX(un));
30914 		sd_update_block_info(un, lbasize, cap);
30915 		if ((un->un_f_tgt_blocksize_is_valid == FALSE)) {
30916 			mutex_exit(SD_MUTEX(un));
30917 			rval = EIO;
30918 			goto done;
30919 		}
30920 	}
30921 
30922 	if (NOT_DEVBSIZE(un)) {
30923 		/*
30924 		 * sys_blocksize != tgt_blocksize, need to re-adjust
30925 		 * blkno and save the index to beginning of dk_label
30926 		 */
30927 		first_byte  = SD_SYSBLOCKS2BYTES(start_block);
30928 		real_addr = first_byte / un->un_tgt_blocksize;
30929 
30930 		end_block = (first_byte + reqlength +
30931 		    un->un_tgt_blocksize - 1) / un->un_tgt_blocksize;
30932 
30933 		/* round up buffer size to multiple of target block size */
30934 		buffer_size = (end_block - real_addr) * un->un_tgt_blocksize;
30935 
30936 		SD_TRACE(SD_LOG_IO_PARTITION, un, "sd_tg_rdwr",
30937 		    "label_addr: 0x%x allocation size: 0x%x\n",
30938 		    real_addr, buffer_size);
30939 
30940 		if (((first_byte % un->un_tgt_blocksize) != 0) ||
30941 		    (reqlength % un->un_tgt_blocksize) != 0)
30942 			/* the request is not aligned */
30943 			dkl = kmem_zalloc(buffer_size, KM_SLEEP);
30944 	}
30945 
30946 	/*
30947 	 * The MMC standard allows READ CAPACITY to be
30948 	 * inaccurate by a bounded amount (in the interest of
30949 	 * response latency).  As a result, failed READs are
30950 	 * commonplace (due to the reading of metadata and not
30951 	 * data). Depending on the per-Vendor/drive Sense data,
30952 	 * the failed READ can cause many (unnecessary) retries.
30953 	 */
30954 
30955 	if (ISCD(un) && (cmd == TG_READ) &&
30956 	    (un->un_f_blockcount_is_valid == TRUE) &&
30957 	    ((start_block == (un->un_blockcount - 1))||
30958 	    (start_block == (un->un_blockcount - 2)))) {
30959 			path_flag = SD_PATH_DIRECT_PRIORITY;
30960 	}
30961 
30962 	mutex_exit(SD_MUTEX(un));
30963 	if (cmd == TG_READ) {
30964 		rval = sd_send_scsi_READ(ssc, (dkl != NULL)? dkl: bufaddr,
30965 		    buffer_size, real_addr, path_flag);
30966 		if (dkl != NULL)
30967 			bcopy(dkl + SD_TGTBYTEOFFSET(un, start_block,
30968 			    real_addr), bufaddr, reqlength);
30969 	} else {
30970 		if (dkl) {
30971 			rval = sd_send_scsi_READ(ssc, dkl, buffer_size,
30972 			    real_addr, path_flag);
30973 			if (rval) {
30974 				goto done1;
30975 			}
30976 			bcopy(bufaddr, dkl + SD_TGTBYTEOFFSET(un, start_block,
30977 			    real_addr), reqlength);
30978 		}
30979 		rval = sd_send_scsi_WRITE(ssc, (dkl != NULL)? dkl: bufaddr,
30980 		    buffer_size, real_addr, path_flag);
30981 	}
30982 
30983 done1:
30984 	if (dkl != NULL)
30985 		kmem_free(dkl, buffer_size);
30986 
30987 	if (rval != 0) {
30988 		if (rval == EIO)
30989 			sd_ssc_assessment(ssc, SD_FMT_STATUS_CHECK);
30990 		else
30991 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
30992 	}
30993 done:
30994 	sd_ssc_fini(ssc);
30995 	return (rval);
30996 }
30997 
30998 
30999 static int
31000 sd_tg_getinfo(dev_info_t *devi, int cmd, void *arg, void *tg_cookie)
31001 {
31002 
31003 	struct sd_lun *un;
31004 	diskaddr_t	cap;
31005 	uint32_t	lbasize;
31006 	int		path_flag = (int)(uintptr_t)tg_cookie;
31007 	int		ret = 0;
31008 
31009 	un = ddi_get_soft_state(sd_state, ddi_get_instance(devi));
31010 	if (un == NULL)
31011 		return (ENXIO);
31012 
31013 	switch (cmd) {
31014 	case TG_GETPHYGEOM:
31015 	case TG_GETVIRTGEOM:
31016 	case TG_GETCAPACITY:
31017 	case TG_GETBLOCKSIZE:
31018 		mutex_enter(SD_MUTEX(un));
31019 
31020 		if ((un->un_f_blockcount_is_valid == TRUE) &&
31021 		    (un->un_f_tgt_blocksize_is_valid == TRUE)) {
31022 			cap = un->un_blockcount;
31023 			lbasize = un->un_tgt_blocksize;
31024 			mutex_exit(SD_MUTEX(un));
31025 		} else {
31026 			sd_ssc_t	*ssc;
31027 			mutex_exit(SD_MUTEX(un));
31028 			ssc = sd_ssc_init(un);
31029 			ret = sd_send_scsi_READ_CAPACITY(ssc, (uint64_t *)&cap,
31030 			    &lbasize, path_flag);
31031 			if (ret != 0) {
31032 				if (ret == EIO)
31033 					sd_ssc_assessment(ssc,
31034 					    SD_FMT_STATUS_CHECK);
31035 				else
31036 					sd_ssc_assessment(ssc,
31037 					    SD_FMT_IGNORE);
31038 				sd_ssc_fini(ssc);
31039 				return (ret);
31040 			}
31041 			sd_ssc_fini(ssc);
31042 			mutex_enter(SD_MUTEX(un));
31043 			sd_update_block_info(un, lbasize, cap);
31044 			if ((un->un_f_blockcount_is_valid == FALSE) ||
31045 			    (un->un_f_tgt_blocksize_is_valid == FALSE)) {
31046 				mutex_exit(SD_MUTEX(un));
31047 				return (EIO);
31048 			}
31049 			mutex_exit(SD_MUTEX(un));
31050 		}
31051 
31052 		if (cmd == TG_GETCAPACITY) {
31053 			*(diskaddr_t *)arg = cap;
31054 			return (0);
31055 		}
31056 
31057 		if (cmd == TG_GETBLOCKSIZE) {
31058 			*(uint32_t *)arg = lbasize;
31059 			return (0);
31060 		}
31061 
31062 		if (cmd == TG_GETPHYGEOM)
31063 			ret = sd_get_physical_geometry(un, (cmlb_geom_t *)arg,
31064 			    cap, lbasize, path_flag);
31065 		else
31066 			/* TG_GETVIRTGEOM */
31067 			ret = sd_get_virtual_geometry(un,
31068 			    (cmlb_geom_t *)arg, cap, lbasize);
31069 
31070 		return (ret);
31071 
31072 	case TG_GETATTR:
31073 		mutex_enter(SD_MUTEX(un));
31074 		((tg_attribute_t *)arg)->media_is_writable =
31075 		    un->un_f_mmc_writable_media;
31076 		((tg_attribute_t *)arg)->media_is_solid_state =
31077 		    un->un_f_is_solid_state;
31078 		mutex_exit(SD_MUTEX(un));
31079 		return (0);
31080 	default:
31081 		return (ENOTTY);
31082 
31083 	}
31084 }
31085 
31086 /*
31087  *    Function: sd_ssc_ereport_post
31088  *
31089  * Description: Will be called when SD driver need to post an ereport.
31090  *
31091  *    Context: Kernel thread or interrupt context.
31092  */
31093 static void
31094 sd_ssc_ereport_post(sd_ssc_t *ssc, enum sd_driver_assessment drv_assess)
31095 {
31096 	int uscsi_path_instance = 0;
31097 	uchar_t	uscsi_pkt_reason;
31098 	uint32_t uscsi_pkt_state;
31099 	uint32_t uscsi_pkt_statistics;
31100 	uint64_t uscsi_ena;
31101 	uchar_t op_code;
31102 	uint8_t *sensep;
31103 	union scsi_cdb *cdbp;
31104 	uint_t cdblen = 0;
31105 	uint_t senlen = 0;
31106 	struct sd_lun *un;
31107 	dev_info_t *dip;
31108 	char *devid;
31109 	int ssc_invalid_flags = SSC_FLAGS_INVALID_PKT_REASON |
31110 	    SSC_FLAGS_INVALID_STATUS |
31111 	    SSC_FLAGS_INVALID_SENSE |
31112 	    SSC_FLAGS_INVALID_DATA;
31113 	char assessment[16];
31114 
31115 	ASSERT(ssc != NULL);
31116 	ASSERT(ssc->ssc_uscsi_cmd != NULL);
31117 	ASSERT(ssc->ssc_uscsi_info != NULL);
31118 
31119 	un = ssc->ssc_un;
31120 	ASSERT(un != NULL);
31121 
31122 	dip = un->un_sd->sd_dev;
31123 
31124 	/*
31125 	 * Get the devid:
31126 	 *	devid will only be passed to non-transport error reports.
31127 	 */
31128 	devid = DEVI(dip)->devi_devid_str;
31129 
31130 	/*
31131 	 * If we are syncing or dumping, the command will not be executed
31132 	 * so we bypass this situation.
31133 	 */
31134 	if (ddi_in_panic() || (un->un_state == SD_STATE_SUSPENDED) ||
31135 	    (un->un_state == SD_STATE_DUMPING))
31136 		return;
31137 
31138 	uscsi_pkt_reason = ssc->ssc_uscsi_info->ui_pkt_reason;
31139 	uscsi_path_instance = ssc->ssc_uscsi_cmd->uscsi_path_instance;
31140 	uscsi_pkt_state = ssc->ssc_uscsi_info->ui_pkt_state;
31141 	uscsi_pkt_statistics = ssc->ssc_uscsi_info->ui_pkt_statistics;
31142 	uscsi_ena = ssc->ssc_uscsi_info->ui_ena;
31143 
31144 	sensep = (uint8_t *)ssc->ssc_uscsi_cmd->uscsi_rqbuf;
31145 	cdbp = (union scsi_cdb *)ssc->ssc_uscsi_cmd->uscsi_cdb;
31146 
31147 	/* In rare cases, EG:DOORLOCK, the cdb could be NULL */
31148 	if (cdbp == NULL) {
31149 		scsi_log(SD_DEVINFO(un), sd_label, CE_WARN,
31150 		    "sd_ssc_ereport_post meet empty cdb\n");
31151 		return;
31152 	}
31153 
31154 	op_code = cdbp->scc_cmd;
31155 
31156 	cdblen = (int)ssc->ssc_uscsi_cmd->uscsi_cdblen;
31157 	senlen = (int)(ssc->ssc_uscsi_cmd->uscsi_rqlen -
31158 	    ssc->ssc_uscsi_cmd->uscsi_rqresid);
31159 
31160 	if (senlen > 0)
31161 		ASSERT(sensep != NULL);
31162 
31163 	/*
31164 	 * Initialize drv_assess to corresponding values.
31165 	 * SD_FM_DRV_FATAL will be mapped to "fail" or "fatal" depending
31166 	 * on the sense-key returned back.
31167 	 */
31168 	switch (drv_assess) {
31169 		case SD_FM_DRV_RECOVERY:
31170 			(void) sprintf(assessment, "%s", "recovered");
31171 			break;
31172 		case SD_FM_DRV_RETRY:
31173 			(void) sprintf(assessment, "%s", "retry");
31174 			break;
31175 		case SD_FM_DRV_NOTICE:
31176 			(void) sprintf(assessment, "%s", "info");
31177 			break;
31178 		case SD_FM_DRV_FATAL:
31179 		default:
31180 			(void) sprintf(assessment, "%s", "unknown");
31181 	}
31182 	/*
31183 	 * If drv_assess == SD_FM_DRV_RECOVERY, this should be a recovered
31184 	 * command, we will post ereport.io.scsi.cmd.disk.recovered.
31185 	 * driver-assessment will always be "recovered" here.
31186 	 */
31187 	if (drv_assess == SD_FM_DRV_RECOVERY) {
31188 		scsi_fm_ereport_post(un->un_sd, uscsi_path_instance,
31189 		    "cmd.disk.recovered", uscsi_ena, devid, DDI_NOSLEEP,
31190 		    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31191 		    "driver-assessment", DATA_TYPE_STRING, assessment,
31192 		    "op-code", DATA_TYPE_UINT8, op_code,
31193 		    "cdb", DATA_TYPE_UINT8_ARRAY,
31194 		    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31195 		    "pkt-reason", DATA_TYPE_UINT8, uscsi_pkt_reason,
31196 		    "pkt-state", DATA_TYPE_UINT32, uscsi_pkt_state,
31197 		    "pkt-stats", DATA_TYPE_UINT32, uscsi_pkt_statistics,
31198 		    NULL);
31199 		return;
31200 	}
31201 
31202 	/*
31203 	 * If there is un-expected/un-decodable data, we should post
31204 	 * ereport.io.scsi.cmd.disk.dev.uderr.
31205 	 * driver-assessment will be set based on parameter drv_assess.
31206 	 * SSC_FLAGS_INVALID_SENSE - invalid sense data sent back.
31207 	 * SSC_FLAGS_INVALID_PKT_REASON - invalid pkt-reason encountered.
31208 	 * SSC_FLAGS_INVALID_STATUS - invalid stat-code encountered.
31209 	 * SSC_FLAGS_INVALID_DATA - invalid data sent back.
31210 	 */
31211 	if (ssc->ssc_flags & ssc_invalid_flags) {
31212 		if (ssc->ssc_flags & SSC_FLAGS_INVALID_SENSE) {
31213 			scsi_fm_ereport_post(un->un_sd, uscsi_path_instance,
31214 			    "cmd.disk.dev.uderr", uscsi_ena, devid, DDI_NOSLEEP,
31215 			    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31216 			    "driver-assessment", DATA_TYPE_STRING,
31217 			    drv_assess == SD_FM_DRV_FATAL ?
31218 			    "fail" : assessment,
31219 			    "op-code", DATA_TYPE_UINT8, op_code,
31220 			    "cdb", DATA_TYPE_UINT8_ARRAY,
31221 			    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31222 			    "pkt-reason", DATA_TYPE_UINT8, uscsi_pkt_reason,
31223 			    "pkt-state", DATA_TYPE_UINT32, uscsi_pkt_state,
31224 			    "pkt-stats", DATA_TYPE_UINT32,
31225 			    uscsi_pkt_statistics,
31226 			    "stat-code", DATA_TYPE_UINT8,
31227 			    ssc->ssc_uscsi_cmd->uscsi_status,
31228 			    "un-decode-info", DATA_TYPE_STRING,
31229 			    ssc->ssc_info,
31230 			    "un-decode-value", DATA_TYPE_UINT8_ARRAY,
31231 			    senlen, sensep,
31232 			    NULL);
31233 		} else {
31234 			/*
31235 			 * For other type of invalid data, the
31236 			 * un-decode-value field would be empty because the
31237 			 * un-decodable content could be seen from upper
31238 			 * level payload or inside un-decode-info.
31239 			 */
31240 			scsi_fm_ereport_post(un->un_sd, uscsi_path_instance,
31241 			    "cmd.disk.dev.uderr", uscsi_ena, devid, DDI_NOSLEEP,
31242 			    FM_VERSION, DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31243 			    "driver-assessment", DATA_TYPE_STRING,
31244 			    drv_assess == SD_FM_DRV_FATAL ?
31245 			    "fail" : assessment,
31246 			    "op-code", DATA_TYPE_UINT8, op_code,
31247 			    "cdb", DATA_TYPE_UINT8_ARRAY,
31248 			    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31249 			    "pkt-reason", DATA_TYPE_UINT8, uscsi_pkt_reason,
31250 			    "pkt-state", DATA_TYPE_UINT32, uscsi_pkt_state,
31251 			    "pkt-stats", DATA_TYPE_UINT32,
31252 			    uscsi_pkt_statistics,
31253 			    "stat-code", DATA_TYPE_UINT8,
31254 			    ssc->ssc_uscsi_cmd->uscsi_status,
31255 			    "un-decode-info", DATA_TYPE_STRING,
31256 			    ssc->ssc_info,
31257 			    "un-decode-value", DATA_TYPE_UINT8_ARRAY,
31258 			    0, NULL,
31259 			    NULL);
31260 		}
31261 		ssc->ssc_flags &= ~ssc_invalid_flags;
31262 		return;
31263 	}
31264 
31265 	if (uscsi_pkt_reason != CMD_CMPLT ||
31266 	    (ssc->ssc_flags & SSC_FLAGS_TRAN_ABORT)) {
31267 		/*
31268 		 * pkt-reason != CMD_CMPLT or SSC_FLAGS_TRAN_ABORT was
31269 		 * set inside sd_start_cmds due to errors(bad packet or
31270 		 * fatal transport error), we should take it as a
31271 		 * transport error, so we post ereport.io.scsi.cmd.disk.tran.
31272 		 * driver-assessment will be set based on drv_assess.
31273 		 * We will set devid to NULL because it is a transport
31274 		 * error.
31275 		 */
31276 		if (ssc->ssc_flags & SSC_FLAGS_TRAN_ABORT)
31277 			ssc->ssc_flags &= ~SSC_FLAGS_TRAN_ABORT;
31278 
31279 		scsi_fm_ereport_post(un->un_sd, uscsi_path_instance,
31280 		    "cmd.disk.tran", uscsi_ena, NULL, DDI_NOSLEEP, FM_VERSION,
31281 		    DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31282 		    "driver-assessment", DATA_TYPE_STRING,
31283 		    drv_assess == SD_FM_DRV_FATAL ? "fail" : assessment,
31284 		    "op-code", DATA_TYPE_UINT8, op_code,
31285 		    "cdb", DATA_TYPE_UINT8_ARRAY,
31286 		    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31287 		    "pkt-reason", DATA_TYPE_UINT8, uscsi_pkt_reason,
31288 		    "pkt-state", DATA_TYPE_UINT8, uscsi_pkt_state,
31289 		    "pkt-stats", DATA_TYPE_UINT32, uscsi_pkt_statistics,
31290 		    NULL);
31291 	} else {
31292 		/*
31293 		 * If we got here, we have a completed command, and we need
31294 		 * to further investigate the sense data to see what kind
31295 		 * of ereport we should post.
31296 		 * Post ereport.io.scsi.cmd.disk.dev.rqs.merr
31297 		 * if sense-key == 0x3.
31298 		 * Post ereport.io.scsi.cmd.disk.dev.rqs.derr otherwise.
31299 		 * driver-assessment will be set based on the parameter
31300 		 * drv_assess.
31301 		 */
31302 		if (senlen > 0) {
31303 			/*
31304 			 * Here we have sense data available.
31305 			 */
31306 			uint8_t sense_key;
31307 			sense_key = scsi_sense_key(sensep);
31308 			if (sense_key == 0x3) {
31309 				/*
31310 				 * sense-key == 0x3(medium error),
31311 				 * driver-assessment should be "fatal" if
31312 				 * drv_assess is SD_FM_DRV_FATAL.
31313 				 */
31314 				scsi_fm_ereport_post(un->un_sd,
31315 				    uscsi_path_instance,
31316 				    "cmd.disk.dev.rqs.merr",
31317 				    uscsi_ena, devid, DDI_NOSLEEP, FM_VERSION,
31318 				    DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31319 				    "driver-assessment",
31320 				    DATA_TYPE_STRING,
31321 				    drv_assess == SD_FM_DRV_FATAL ?
31322 				    "fatal" : assessment,
31323 				    "op-code",
31324 				    DATA_TYPE_UINT8, op_code,
31325 				    "cdb",
31326 				    DATA_TYPE_UINT8_ARRAY, cdblen,
31327 				    ssc->ssc_uscsi_cmd->uscsi_cdb,
31328 				    "pkt-reason",
31329 				    DATA_TYPE_UINT8, uscsi_pkt_reason,
31330 				    "pkt-state",
31331 				    DATA_TYPE_UINT8, uscsi_pkt_state,
31332 				    "pkt-stats",
31333 				    DATA_TYPE_UINT32,
31334 				    uscsi_pkt_statistics,
31335 				    "stat-code",
31336 				    DATA_TYPE_UINT8,
31337 				    ssc->ssc_uscsi_cmd->uscsi_status,
31338 				    "key",
31339 				    DATA_TYPE_UINT8,
31340 				    scsi_sense_key(sensep),
31341 				    "asc",
31342 				    DATA_TYPE_UINT8,
31343 				    scsi_sense_asc(sensep),
31344 				    "ascq",
31345 				    DATA_TYPE_UINT8,
31346 				    scsi_sense_ascq(sensep),
31347 				    "sense-data",
31348 				    DATA_TYPE_UINT8_ARRAY,
31349 				    senlen, sensep,
31350 				    "lba",
31351 				    DATA_TYPE_UINT64,
31352 				    ssc->ssc_uscsi_info->ui_lba,
31353 				    NULL);
31354 				} else {
31355 					/*
31356 					 * if sense-key == 0x4(hardware
31357 					 * error), driver-assessment should
31358 					 * be "fatal" if drv_assess is
31359 					 * SD_FM_DRV_FATAL.
31360 					 */
31361 					scsi_fm_ereport_post(un->un_sd,
31362 					    uscsi_path_instance,
31363 					    "cmd.disk.dev.rqs.derr",
31364 					    uscsi_ena, devid, DDI_NOSLEEP,
31365 					    FM_VERSION,
31366 					    DATA_TYPE_UINT8, FM_EREPORT_VERS0,
31367 					    "driver-assessment",
31368 					    DATA_TYPE_STRING,
31369 					    drv_assess == SD_FM_DRV_FATAL ?
31370 					    (sense_key == 0x4 ?
31371 					    "fatal" : "fail") : assessment,
31372 					    "op-code",
31373 					    DATA_TYPE_UINT8, op_code,
31374 					    "cdb",
31375 					    DATA_TYPE_UINT8_ARRAY, cdblen,
31376 					    ssc->ssc_uscsi_cmd->uscsi_cdb,
31377 					    "pkt-reason",
31378 					    DATA_TYPE_UINT8, uscsi_pkt_reason,
31379 					    "pkt-state",
31380 					    DATA_TYPE_UINT8, uscsi_pkt_state,
31381 					    "pkt-stats",
31382 					    DATA_TYPE_UINT32,
31383 					    uscsi_pkt_statistics,
31384 					    "stat-code",
31385 					    DATA_TYPE_UINT8,
31386 					    ssc->ssc_uscsi_cmd->uscsi_status,
31387 					    "key",
31388 					    DATA_TYPE_UINT8,
31389 					    scsi_sense_key(sensep),
31390 					    "asc",
31391 					    DATA_TYPE_UINT8,
31392 					    scsi_sense_asc(sensep),
31393 					    "ascq",
31394 					    DATA_TYPE_UINT8,
31395 					    scsi_sense_ascq(sensep),
31396 					    "sense-data",
31397 					    DATA_TYPE_UINT8_ARRAY,
31398 					    senlen, sensep,
31399 					    NULL);
31400 				}
31401 		} else {
31402 			/*
31403 			 * For stat_code == STATUS_GOOD, this is not a
31404 			 * hardware error.
31405 			 */
31406 			if (ssc->ssc_uscsi_cmd->uscsi_status == STATUS_GOOD)
31407 				return;
31408 
31409 			/*
31410 			 * Post ereport.io.scsi.cmd.disk.dev.serr if we got the
31411 			 * stat-code but with sense data unavailable.
31412 			 * driver-assessment will be set based on parameter
31413 			 * drv_assess.
31414 			 */
31415 			scsi_fm_ereport_post(un->un_sd,
31416 			    uscsi_path_instance, "cmd.disk.dev.serr", uscsi_ena,
31417 			    devid, DDI_NOSLEEP, FM_VERSION, DATA_TYPE_UINT8,
31418 			    FM_EREPORT_VERS0,
31419 			    "driver-assessment", DATA_TYPE_STRING,
31420 			    drv_assess == SD_FM_DRV_FATAL ? "fail" : assessment,
31421 			    "op-code", DATA_TYPE_UINT8, op_code,
31422 			    "cdb",
31423 			    DATA_TYPE_UINT8_ARRAY,
31424 			    cdblen, ssc->ssc_uscsi_cmd->uscsi_cdb,
31425 			    "pkt-reason",
31426 			    DATA_TYPE_UINT8, uscsi_pkt_reason,
31427 			    "pkt-state",
31428 			    DATA_TYPE_UINT8, uscsi_pkt_state,
31429 			    "pkt-stats",
31430 			    DATA_TYPE_UINT32, uscsi_pkt_statistics,
31431 			    "stat-code",
31432 			    DATA_TYPE_UINT8,
31433 			    ssc->ssc_uscsi_cmd->uscsi_status,
31434 			    NULL);
31435 		}
31436 	}
31437 }
31438 
31439 /*
31440  *     Function: sd_ssc_extract_info
31441  *
31442  * Description: Extract information available to help generate ereport.
31443  *
31444  *     Context: Kernel thread or interrupt context.
31445  */
31446 static void
31447 sd_ssc_extract_info(sd_ssc_t *ssc, struct sd_lun *un, struct scsi_pkt *pktp,
31448     struct buf *bp, struct sd_xbuf *xp)
31449 {
31450 	size_t senlen = 0;
31451 	union scsi_cdb *cdbp;
31452 	int path_instance;
31453 	/*
31454 	 * Need scsi_cdb_size array to determine the cdb length.
31455 	 */
31456 	extern uchar_t	scsi_cdb_size[];
31457 
31458 	ASSERT(un != NULL);
31459 	ASSERT(pktp != NULL);
31460 	ASSERT(bp != NULL);
31461 	ASSERT(xp != NULL);
31462 	ASSERT(ssc != NULL);
31463 	ASSERT(mutex_owned(SD_MUTEX(un)));
31464 
31465 	/*
31466 	 * Transfer the cdb buffer pointer here.
31467 	 */
31468 	cdbp = (union scsi_cdb *)pktp->pkt_cdbp;
31469 
31470 	ssc->ssc_uscsi_cmd->uscsi_cdblen = scsi_cdb_size[GETGROUP(cdbp)];
31471 	ssc->ssc_uscsi_cmd->uscsi_cdb = (caddr_t)cdbp;
31472 
31473 	/*
31474 	 * Transfer the sense data buffer pointer if sense data is available,
31475 	 * calculate the sense data length first.
31476 	 */
31477 	if ((xp->xb_sense_state & STATE_XARQ_DONE) ||
31478 	    (xp->xb_sense_state & STATE_ARQ_DONE)) {
31479 		/*
31480 		 * For arq case, we will enter here.
31481 		 */
31482 		if (xp->xb_sense_state & STATE_XARQ_DONE) {
31483 			senlen = MAX_SENSE_LENGTH - xp->xb_sense_resid;
31484 		} else {
31485 			senlen = SENSE_LENGTH;
31486 		}
31487 	} else {
31488 		/*
31489 		 * For non-arq case, we will enter this branch.
31490 		 */
31491 		if (SD_GET_PKT_STATUS(pktp) == STATUS_CHECK &&
31492 		    (xp->xb_sense_state & STATE_XFERRED_DATA)) {
31493 			senlen = SENSE_LENGTH - xp->xb_sense_resid;
31494 		}
31495 
31496 	}
31497 
31498 	ssc->ssc_uscsi_cmd->uscsi_rqlen = (senlen & 0xff);
31499 	ssc->ssc_uscsi_cmd->uscsi_rqresid = 0;
31500 	ssc->ssc_uscsi_cmd->uscsi_rqbuf = (caddr_t)xp->xb_sense_data;
31501 
31502 	ssc->ssc_uscsi_cmd->uscsi_status = ((*(pktp)->pkt_scbp) & STATUS_MASK);
31503 
31504 	/*
31505 	 * Only transfer path_instance when scsi_pkt was properly allocated.
31506 	 */
31507 	path_instance = pktp->pkt_path_instance;
31508 	if (scsi_pkt_allocated_correctly(pktp) && path_instance)
31509 		ssc->ssc_uscsi_cmd->uscsi_path_instance = path_instance;
31510 	else
31511 		ssc->ssc_uscsi_cmd->uscsi_path_instance = 0;
31512 
31513 	/*
31514 	 * Copy in the other fields we may need when posting ereport.
31515 	 */
31516 	ssc->ssc_uscsi_info->ui_pkt_reason = pktp->pkt_reason;
31517 	ssc->ssc_uscsi_info->ui_pkt_state = pktp->pkt_state;
31518 	ssc->ssc_uscsi_info->ui_pkt_statistics = pktp->pkt_statistics;
31519 	ssc->ssc_uscsi_info->ui_lba = (uint64_t)SD_GET_BLKNO(bp);
31520 
31521 	/*
31522 	 * For partially read/write command, we will not create ena
31523 	 * in case of a successful command be reconized as recovered.
31524 	 */
31525 	if ((pktp->pkt_reason == CMD_CMPLT) &&
31526 	    (ssc->ssc_uscsi_cmd->uscsi_status == STATUS_GOOD) &&
31527 	    (senlen == 0)) {
31528 		return;
31529 	}
31530 
31531 	/*
31532 	 * To associate ereports of a single command execution flow, we
31533 	 * need a shared ena for a specific command.
31534 	 */
31535 	if (xp->xb_ena == 0)
31536 		xp->xb_ena = fm_ena_generate(0, FM_ENA_FMT1);
31537 	ssc->ssc_uscsi_info->ui_ena = xp->xb_ena;
31538 }
31539 
31540 
31541 /*
31542  *     Function: sd_check_solid_state
31543  *
31544  * Description: Query the optional INQUIRY VPD page 0xb1. If the device
31545  *              supports VPD page 0xb1, sd examines the MEDIUM ROTATION
31546  *              RATE. If the MEDIUM ROTATION RATE is 1, sd assumes the
31547  *              device is a solid state drive.
31548  *
31549  *     Context: Kernel thread or interrupt context.
31550  */
31551 
31552 static void
31553 sd_check_solid_state(sd_ssc_t *ssc)
31554 {
31555 	int		rval		= 0;
31556 	uchar_t		*inqb1		= NULL;
31557 	size_t		inqb1_len	= MAX_INQUIRY_SIZE;
31558 	size_t		inqb1_resid	= 0;
31559 	struct sd_lun	*un;
31560 
31561 	ASSERT(ssc != NULL);
31562 	un = ssc->ssc_un;
31563 	ASSERT(un != NULL);
31564 	ASSERT(!mutex_owned(SD_MUTEX(un)));
31565 
31566 	mutex_enter(SD_MUTEX(un));
31567 	un->un_f_is_solid_state = FALSE;
31568 
31569 	if (ISCD(un)) {
31570 		mutex_exit(SD_MUTEX(un));
31571 		return;
31572 	}
31573 
31574 	if (sd_check_vpd_page_support(ssc) == 0 &&
31575 	    un->un_vpd_page_mask & SD_VPD_DEV_CHARACTER_PG) {
31576 		mutex_exit(SD_MUTEX(un));
31577 		/* collect page b1 data */
31578 		inqb1 = kmem_zalloc(inqb1_len, KM_SLEEP);
31579 
31580 		rval = sd_send_scsi_INQUIRY(ssc, inqb1, inqb1_len,
31581 		    0x01, 0xB1, &inqb1_resid);
31582 
31583 		if (rval == 0 && (inqb1_len - inqb1_resid > 5)) {
31584 			SD_TRACE(SD_LOG_COMMON, un,
31585 			    "sd_check_solid_state: \
31586 			    successfully get VPD page: %x \
31587 			    PAGE LENGTH: %x BYTE 4: %x \
31588 			    BYTE 5: %x", inqb1[1], inqb1[3], inqb1[4],
31589 			    inqb1[5]);
31590 
31591 			mutex_enter(SD_MUTEX(un));
31592 			/*
31593 			 * Check the MEDIUM ROTATION RATE. If it is set
31594 			 * to 1, the device is a solid state drive.
31595 			 */
31596 			if (inqb1[4] == 0 && inqb1[5] == 1) {
31597 				un->un_f_is_solid_state = TRUE;
31598 			}
31599 			mutex_exit(SD_MUTEX(un));
31600 		} else if (rval != 0) {
31601 			sd_ssc_assessment(ssc, SD_FMT_IGNORE);
31602 		}
31603 
31604 		kmem_free(inqb1, inqb1_len);
31605 	} else {
31606 		mutex_exit(SD_MUTEX(un));
31607 	}
31608 }
31609