ses: Add error checking for copyout() calls

This is in preparation for annotating copyin() and related functions
with __result_use_check.

Reviewed by: mav, imp, asomers
Tested by: asomers
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D43130

CAM: Replace random sbuf_printf() with cheaper cat/putc.

cam: Remove left-over sys/cdefs.h in sys/cam

These weren't removed when $FreeBSD$ was removed. They aren't needed and
now are a style(9) nonconformity.

Sponsored by: Netflix

sys: Remove $FreeBSD$: one-line .c pattern

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.

Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix

cam: Properly mask out the status bits to get completion code

ccb_h.status has two parts: the actual status and some addition bits to
indicate additional information. It must be masked before comparing
against completion codes. Add new inline function cam_ccb_success to
simplify this to test whether or not the request succeeded. Most of the
code already does this, but a few places don't (the rest likely should
be converted to use cam_ccb_status and/or cam_ccb_success, but that's
for another day). This caused at least one bug in recognizing devices
behind a SATA port multiplexer, though some of these checks were
fine with the special knowledge of the code paths involved.

PR: 270459
Sponsored by: Netflix
MFC After: 1 week (and maybe a EN requst)
Reviewed by: ken, mav
Differential Revision: https://reviews.freebsd.org/D39572

ses: minor cleanup

* Prefer variables of small scope rather than large scope
* Remove a magic number
* style(9) for return statements
* Remove the get_enc_status method, which never did anything
* Fix a variable type in the handle_string method
* Proofread some comments

MFC after: 2 weeks
Sponsored by: Spectra Logic, Axcient
Reviewed by: ken, mav
Differential Revision: https://reviews.freebsd.org/D31686

cam: Remove all the write-only variables

Delete all the write only variables in CAM. At worst, the only behavior
change would be to prevent core dumps from chasing NULL pointers (though
I think in all these cases the pointers can't be NULL).

Sponsored by: Netflix

cam(4): Limit search for disks in SES enclosure by single bus

At least for SAS that we only support now disks are typically
connected to the same bus as the enclosure. Limiting the search
scope makes it much faster on systems with multiple buses and
thousands of disks.

Reviewed by: imp
MFC after: 2 weeks
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D32305

Fix some common typos in comments

- s/configuraiton/configuration/
- s/specifed/specified/
- s/compatiblity/compatibility/

MFC after: 5 days

cam: make sure to clear even more CCBs allocated on the stack

This is my second pass, this time over all of CAM except
for the SCSI target bits. There should be no functional
changes.

Reviewed By: imp
Sponsored by: NetApp, Inc.
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D29549

cam: clean up empty lines in .c and .h files

Extend EIIOE field handling according to ses4r5 draft.

It should not affect any existing systems.

MFC after: 2 weeks

Fix a memory leak for ENCIOC_GETSTRING I introduced in r360171.

MFC after: 1 week
Sponsored by: DARPA

Don't access a user buffer directly from the kernel.

The handle_string callback for the ENCIOC_SETSTRING ioctl was passing
a user pointer to memcpy(). Fix by using copyin() instead.

For ENCIOC_GETSTRING ioctls, the handler was storing the user pointer
in a CCB's data_ptr field where it was indirected by other code. Fix
this by allocating a temporary buffer (which ENCIOC_SETSTRING already
did) and copying the result out to the user buffer after the CCB has
been processed.

Reviewed by: kib
Obtained from: CheriBSD
MFC after: 1 week
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D24487

Don't try to copyout() to a kernel buffer.

The handle_string callback for the ENCIOC_GET_ENCNAME and
ENCIOC_GETENCID ioctls tries to copy the size of the generated string
out to userland. However, the callback only has access to the kernel
copy of the structure populated by copyin(). The copyout() call
simply overwrites the value in the kernel's copy preventing the
subsequent overflow prevention logic from working.

Fix this by instead doing a copyout() of the updated length in the
caller after the callback returns.

Reviewed by: kib
Obtained from: CheriBSD
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D24456

Relax too strict SES element descriptors check in r355430.

SES specifications allows the string to be NULL-terminated, while previous
code was considering it as invalid due to incorrectly ordered conditions.

MFC after: 1 week
Sponsored by: iXsystem, Inc.

Fix SES on device slots without phys after r349321.

Broadcom 9400-8i8e HBAs report virtual SES device, where slots representing
external connectors are reported having no phys. Since sasdev_phys is NULL
there and proto_hdr is a union, ses_paths_iter() misinterpreted them as ATA.
Add explicit protocol check to properly differentiate them.

MFC after: 1 week
Sponsored by: iXsystems, Inc.

ses: sanitize illegal strings in SES element descriptors

The SES4r3 standard requires that element descriptors may only contain ASCII
characters in the range 0x20 to 0x7e. Some SuperMicro expanders violate
that rule. This patch adds a sanity check to ses(4). Descriptors in
violation will be replaced by "<invalid>".

This patch fixes "sesutil --libxo xml" on such systems. Previously it would
generate non-well-formed XML output.

PR: 241929
Reviewed by: allanjude
MFC after: 2 weeks
Sponsored by: Axcient

Fix assumptions of only one device per SES slot.

It is typical to have one, but no longer true for multi-actuator HDDs
with separate LUN for each actuator.

MFC after: 4 days
Sponsored by: iXsystems, Inc.

Take proper lock in ses_setphyspath_callback().

XPT_DEV_ADVINFO call should be protected by the lock of the specific
device it is addressed to, not the lock of SES device. In some weird
case, probably with hardware violating standards, it sometimes caused
NULL dereference due to race.

To protect from it further, add lock assertion to *_dev_advinfo().

MFC after: 1 week
Sponsored by: iXsystems, Inc.

Improve AHCI Enclosure Management and SES interoperation.

Since SES specs do not define mechanism to map enclosure slots to SATA
disks, AHCI EM code I written many years ago appeared quite useless,
that always bugged me. I was thinking whether it was a good idea, but
if LSI HBAs do that, why I shouldn't?

This change introduces simple non-standard mechanism for the mapping
into both AHCI EM and SES code, that makes AHCI EM on capable controllers
(most of Intel's) a first-class SES citizen, allowing it to report disk
physical path to GEOM, show devices inserted into each enclosure slot in
`sesutil map` and `getencstat`, control locate and fault LEDs for specific
devices with `sesutil locate adaX on` and `sesutil fault adaX on`, etc.

I've successfully tested this on Supermicro X10DRH-i motherboard connected
with sideband cable of its S-SATA Mini-SAS connector to SAS815TQ backplane.
It can indicate with LEDs Locate, Fault and Rebuild/Remap SES statuses for
each disk identical to real SES of Supermicro SAS2 backplanes.

MFC after: 2 weeks

Make ELEMENT INDEX validation more strict.

SES specifications tell: "The Additional Element Status descriptors shall
be in the same order as the status elements in the Enclosure Status
diagnostic page". It allows us to question ELEMENT INDEX that is lower
then values we already processed. There are many SAS2 enclosures with
this kind of problem.

While there, add more specific error messages for cases when ELEMENT INDEX
is obviously wrong. Also skip elements with INVALID bit set.

MFC after: 2 weeks

Fix individual_element_index when some type has 0 elements.

When some type has 0 elements, saved_individual_element_index was set
to -1 on second type bump, since individual_element_index was not
restored after the first. To me it looks easier just to increment
saved_individual_element_index separately than think when to save it.

MFC after: 2 weeks

Use switch instead of chained if/else to improve readability.

Submitted by: Ryan Moeller <ryan@freqlabs.com>
MFC after: 1 week
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D19051

sys/cam: further adoption of SPDX licensing ID tags.

Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Fix a memory leak in ses_get_elm_devnames().

After r307132 the sbuf buffer is malloc()ed, but corresponding
sbuf_delete() call was missing.

Fix a nearby whitespace bug.

MFC after: 3 days
Sponsored by: Dell EMC Isilon

Make SES status updates more aggressive.

- On control request update all status pages, since they may also be
affected if user enables/disables enclosure slots.
- Periodically update element descriptors too, since there is some
hardware where they are changed dynamically.

MFC after: 2 weeks
Sponsored by: iXsystems, Inc.

Explicitly initialize cdai.flags.

In SES driver uninitialized value caused unreliable physpath reporting.

MFC after: 1 week
Sponsored by: iXsystems, Inc.

Add support for EIIOE flag in Additional Element Status.

It was added in SES-3 spec, and its support required to properly link
the Additional Element Status page data to the original elements.

MFC after: 2 weeks
Sponsored by: iXsystems, Inc.

Use copyout() instead of pointing sbuf to user-space buffer.

MFC after: 2 weeks

Allow sleepable allocations in enclosure daemon threads.

There were at least two places where M_NOWAIT was used without NULL check.
This change should fix NULL-dereference panic there and possibly improve
operation in other ways under memory pressure.

MFC after: 2 weeks

Add API to obtain primary enclosure name and ID for /dev/sesX devices.

sesX device number may change between reboots, so to properly identify
the instance we need more data. Name and ID reported here may mach ones
reported by SCSI device, but that is not really required by specs.

MFC after: 1 week
Sponsored by: iXsystems, Inc.

Make sure that the flags for the XPT_DEV_ADVINFO CCB are initialized
properly.

If there is garbage in the flags field, it can sometimes include a
set CDAI_FLAG_STORE flag, which may cause either an error or
perhaps result in overwriting the field that was intended to be
read.

sys/cam/cam_ccb.h:
Add a new flag to the XPT_DEV_ADVINFO CCB, CDAI_FLAG_NONE,
that callers can use to set the flags field when no store
is desired.

sys/cam/scsi/scsi_enc_ses.c:
In ses_setphyspath_callback(), explicitly set the
XPT_DEV_ADVINFO flags to CDAI_FLAG_NONE when fetching the
physical path information. Instead of ORing in the
CDAI_FLAG_STORE flag when storing the physical path, set
the flags field to CDAI_FLAG_STORE.

sys/cam/scsi/scsi_sa.c:
Set the XPT_DEV_ADVINFO flags field to CDAI_FLAG_NONE when
fetching extended inquiry information.

sys/cam/scsi/scsi_da.c:
When storing extended READ CAPACITY information, set the
XPT_DEV_ADVINFO flags field to CDAI_FLAG_STORE instead of
ORing it into a field that isn't initialized.

sys/dev/mpr/mpr_sas.c,
sys/dev/mps/mps_sas.c:
When fetching extended READ CAPACITY information, set the
XPT_DEV_ADVINFO flags field to CDAI_FLAG_NONE instead of
setting it to 0.

sbin/camcontrol/camcontrol.c:
When fetching a device ID, set the XPT_DEV_ADVINFO flags
field to CDAI_FLAG_NONE instead of 0.

sys/sys/param.h:
Bump __FreeBSD_version to 1100061 for the new XPT_DEV_ADVINFO
CCB flag, CDAI_FLAG_NONE.

Sponsored by: Spectra Logic
MFC after: 1 week

Remove instances of variables that were set, but never used. gcc 4.9
warns about these by default.

Merge CAM locking changes from the projects/camlock branch to radically
reduce lock congestion and improve SMP scalability of the SCSI/ATA stack,
preparing the ground for the coming next GEOM direct dispatch support.

Replace big per-SIM locks with bunch of smaller ones:
- per-LUN locks to protect device and peripheral drivers state;
- per-target locks to protect list of LUNs on target;
- per-bus locks to protect reference counting;
- per-send queue locks to protect queue of CCBs to be sent;
- per-done queue locks to protect queue of completed CCBs;
- remaining per-SIM locks now protect only HBA driver internals.

While holding LUN lock it is allowed (while not recommended for performance
reasons) to take SIM lock. The opposite acquisition order is forbidden.
All the other locks are leaf locks, that can be taken anywhere, but should
not be cascaded. Many functions, such as: xpt_action(), xpt_done(),
xpt_async(), xpt_create_path(), etc. are no longer require (but allow) SIM
lock to be held.

To keep compatibility and solve cases where SIM lock can't be dropped, all
xpt_async() calls in addition to xpt_done() calls are queued to completion
threads for async processing in clean environment without SIM lock held.

Instead of single CAM SWI thread, used for commands completion processing
before, use multiple (depending on number of CPUs) threads. Load balanced
between them using "hash" of the device B:T:L address.

HBA drivers that can drop SIM lock during completion processing and have
sufficient number of completion threads to efficiently scale to multiple
CPUs can use new function xpt_done_direct() to avoid extra context switch.
Make ahci(4) driver to use this mechanism depending on hardware setup.

Sponsored by: iXsystems, Inc.
MFC after: 2 months

Make SES driver adequately react on simple enclosure devices -- read Short
Enclosure status to enclosure status field, clear previous state and exit.

Fix kernel panic if cache->nelms is zero.

MFC after: 2 weeks

Make CAM return and GEOM DISK pass through new GEOM::lunid attribute.

SPC-4 specification states that serial number may be property of device,
but not a specific logical unit. People reported about FC storages using
serial number in that way, making it unusable for purposes of LUN multipath
detection. SPC-4 states that designators associated with logical unit from
the VPD page 83h "Device Identification" should be used for that purpose.
Report first of them in the new attribute in such preference order: NAA,
EUI-64, T10 and SCSI name string.

While there, make GEOM DISK properly report GEOM::ident in XML output also
using d_getattr() method, if available. This fixes serial numbers reporting
for SCSI disks in `geom disk list` output and confxml.

Discussed with: gibbs, ken
Sponsored by: iXsystems, Inc.
MFC after: 2 weeks

Sanitize the element descriptor string before using it as a device name.

Reported and tested by: Vitalij Satanivskij
Reviewed by: gibbs, mav

Make SES driver to not fall out on some errors in Additional Status page.
This allows CAM devices still get their physical paths even if status of
later elements it corrupted.

Sponsored by: iXsystems, Inc.

Fix bug in r242720, that caused additional status page to not be used if
descriptor page is supported.

Use information about suported diagnostic pages to avoid reading optional
Element Descriptor page if it is not supported. This removes one error
message from verbose logs during boot on systems with some enclosures.

Sponsored by: iXsystems, Inc.

remove duplicate semicolons where possible.

Approved by: cperciva
MFC after: 1 week

XPT_DEV_MATCH is probably the only xpt_action() method that is called
without holding SIM lock. It really doesn't need that lock, but adding it
removes that specific exception, allowing to assert locking there later.

Submitted by: ken@ (earlier version)

Get SIM lock in several places while calling CAM functions.
This fixes several use-after-free panics on systems with SAS enclosures.

Submitted by: ken@, mav@

1. Remove SEN support. I doubt there are any working examples
of this hardware still running (close to twenty years now).

2. Quiesece and use ENC_VLOG instead of ENC_LOG for most
complaints. That is, they're visible with bootverbose, but
otherwise quiesced and not repeatedly spamming messages
with constant reminders that hardware in this space is
rarely fully compliant.

MFC after: 1 month

Remove opt_enc.h from files committed with r235911. enc(4) is the
'encapsulating interface' used with IPsec and has nothing to do with
storage 'enclosure' services.

MFC after: 3 days
Noticed while: debugging why enc(4) is no longer automatically created

Do not call ses_softc_cleanup() in case of configuration read failure.
Just free inclomplete daemon cache instead to let it retry next time.
Premature ses_softc_cleanup() caused NULL dereference when freed softc
was accessed later.

MFprojects/zfsd:
Revamp the CAM enclosure services driver.
This updated driver uses an in-kernel daemon to track state changes and
publishes physical path location information\for disk elements into the
CAM device database.

Sponsored by: Spectra Logic Corporation
Sponsored by: iXsystems, Inc.
Submitted by: gibbs, will, mav

Add workaround for broken Supermicro backplanes, reporting wrong value in
ELEMENT INDEX field. If index of element for which additional status is
not supported is detected, ignore this and further indexes, trying to
assign elements sequentially.

- Do not report error if index found in next Additional Status descriptor
is less then expected. Theoretically it may happen if Additional Status will
be used for some new type in later spec.
- Rephrase some error messages to make them a bit more informative.

Tune destruction sequence, including aborting queued control requests.
Cover for some edge cases is still ongoing.

Fix/Implement I/O errors handling:
- make done() method called even after I/O errors to handle them,
- pass error argument to done() method,
- return error code to user-level.

Report proper zero length when no descriptor available for element.

Reread SES enclosure status after writing it.

Remove some strange lock operations.

First part of SAF-TE driver refactoring to the new fsm-based model:
- make configuration and status reading asynchronous.

Fetch list of supported diagnostic pages for SES to find whether optional
Additional Element Status page is supported. If it's not, do not try to
query it.

Add support for SATA Enclosure Management Bridge (SEMB).

Revamp the CAM enclosure services driver, renaming it to "enc" from "ses" in
the process. This updated driver uses an in-kernel daemon to track state
changes and publishes physical path location information for disk elements
into the CAM device database.

share/examples/ses/Makefile.inc:
share/examples/ses/srcs/eltsub.c:
share/examples/ses/srcs/sesd.c:
share/examples/ses/srcs/getencstat.c:
share/examples/ses/srcs/setobjstat.c:
share/examples/ses/srcs/inienc.c:
share/examples/ses/srcs/getobjstat.c:
share/examples/ses/srcs/getnobj.c:
share/examples/ses/srcs/getobjmap.c:
share/examples/ses/srcs/setencstat.c:
Update for changes in driver name and API. The ioctl interface
is largely unchanged and could use additional refinement. It
would be nice to be able to fetch the status of all elements in
a single ioctl call and to have the ioctls that return variable
length data allow you to query the necessary allocation size
by passing in a zero length buffer.

sys/sparc64/conf/GENERIC:
sys/ia64/conf/GENERIC:
sys/mips/conf/OCTEON1:
sys/pc98/conf/GENERIC:
sys/i386/conf/GENERIC:
sys/amd64/conf/GENERIC:
ses -> enc

sys/conf/files:
sys/modules/cam/Makefile:
sys/cam/scsi/scsi_enc_internal.h
sys/cam/scsi/scsi_enc_ses.c
sys/cam/scsi/scsi_enc_safte.c
sys/cam/scsi/scsi_ses.c
sys/cam/scsi/scsi_enc.c
Split the enc driver into a generic driver file and one file
each for the SES and SAF-TE personalities.

sys/cam/scsi/scsi_ses.h:
o Retain this header, but use it to only hold structures derived
from the T10 SES spec. The driver interface can be found in
scsi_enc.h.
o Add definitions for most SES pages.

sys/cam/scsi/scsi_enc.c
sys/cam/scsi/scsi_enc.h
o Use a function vector table to allow interaction between the
generic and protocol specific portions of this driver.
o Provide a generic mechanism allowing personalities to define a
finite state machine that is executed from a daemon thread context.
o Track CAM device arrival events and pass these on to personalities
that have registered an interest in them. These notifications are
used to trigger physical path updates in the CAM EDT.

sys/cam/scsi/scsi_enc_safte.c:
The SAF-TE personality. This module is largely untouched by this
update. To achieve the same level of support as we have for SES,
it will need to define an FSM and code to determine the physical
paths of elements within the enclosure.

sys/cam/scsi/scsi_enc_ses.c:
o Implement a state machine to fetch configuration, status, element
descriptors, and additional element status.
o Build a "element map" that indexes into the config and status
data retrieved from a SES device. Use this to simplify our
responses to ioctls.
o Add support for using SAS domain/phy WWN data to determine the
physical path (ence@<enc WWN>/type@<elm type>/slot@<slot #>)
of an element. Stubs are in place for FC, but both FC and SPI
will need additional work in order to be supported.

Sponsored by: Spectra Logic Corporation
Submitted by: gibbs, will