scsi_cmds.c revision 121184
1/*
2 * SCSI Disk Emulator
3 *
4 * Copyright (c) 2002 Nate Lawson.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions, and the following disclaimer,
12 *    without modification, immediately at the beginning of the file.
13 * 2. The name of the author may not be used to endorse or promote products
14 *    derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
20 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * $FreeBSD: head/share/examples/scsi_target/scsi_cmds.c 121184 2003-10-18 04:54:08Z simokawa $
29 */
30
31#include <stdio.h>
32#include <stddef.h>
33#include <stdarg.h>
34#include <stdlib.h>
35#include <string.h>
36#include <err.h>
37#include <aio.h>
38#include <assert.h>
39#include <sys/param.h>
40#include <sys/types.h>
41
42#include <cam/cam.h>
43#include <cam/cam_ccb.h>
44#include <cam/scsi/scsi_all.h>
45#include <cam/scsi/scsi_targetio.h>
46#include "scsi_target.h"
47
48typedef int targ_start_func(struct ccb_accept_tio *, struct ccb_scsiio *);
49typedef void targ_done_func(struct ccb_accept_tio *, struct ccb_scsiio *,
50			      io_ops);
51
52struct targ_cdb_handlers {
53	u_int8_t	  cmd;
54	targ_start_func  *start;
55	targ_done_func	 *done;
56#define ILLEGAL_CDB	  0xFF
57};
58
59static targ_start_func		tcmd_inquiry;
60static targ_start_func		tcmd_req_sense;
61static targ_start_func		tcmd_rd_cap;
62#ifdef READ_16
63static targ_start_func		tcmd_rd_cap16;
64#endif
65static targ_start_func		tcmd_rdwr;
66static targ_start_func		tcmd_rdwr_decode;
67static targ_done_func		tcmd_rdwr_done;
68static targ_start_func		tcmd_null_ok;
69static targ_start_func		tcmd_illegal_req;
70static int			start_io(struct ccb_accept_tio *atio,
71					 struct ccb_scsiio *ctio, int dir);
72static int init_inquiry(u_int16_t req_flags, u_int16_t sim_flags);
73static struct initiator_state *
74			tcmd_get_istate(u_int init_id);
75static void cdb_debug(u_int8_t *cdb, const char *msg, ...);
76
77static struct targ_cdb_handlers cdb_handlers[] = {
78	{ READ_10,		tcmd_rdwr,		tcmd_rdwr_done },
79	{ WRITE_10,		tcmd_rdwr,		tcmd_rdwr_done },
80	{ READ_6,		tcmd_rdwr,		tcmd_rdwr_done },
81	{ WRITE_6,		tcmd_rdwr,		tcmd_rdwr_done },
82	{ INQUIRY,		tcmd_inquiry,		NULL },
83	{ REQUEST_SENSE,	tcmd_req_sense,		NULL },
84	{ READ_CAPACITY,	tcmd_rd_cap,		NULL },
85	{ TEST_UNIT_READY,	tcmd_null_ok,		NULL },
86	{ START_STOP_UNIT,	tcmd_null_ok,		NULL },
87	{ SYNCHRONIZE_CACHE,	tcmd_null_ok,		NULL },
88	{ MODE_SENSE_6,		tcmd_illegal_req,	NULL },
89	{ MODE_SELECT_6,	tcmd_illegal_req,	NULL },
90#ifdef READ_16
91	{ READ_16,		tcmd_rdwr,		tcmd_rdwr_done },
92	{ WRITE_16,		tcmd_rdwr,		tcmd_rdwr_done },
93	{ SERVICE_ACTION_IN,	tcmd_rd_cap16,		NULL },
94#endif
95	{ ILLEGAL_CDB,		NULL,			NULL }
96};
97
98static struct scsi_inquiry_data inq_data;
99static struct initiator_state istates[MAX_INITIATORS];
100extern int		debug;
101extern uint64_t		volume_size;
102extern size_t		sector_size;
103extern size_t		buf_size;
104
105cam_status
106tcmd_init(u_int16_t req_inq_flags, u_int16_t sim_inq_flags)
107{
108	struct initiator_state *istate;
109	int i, ret;
110
111	/* Initialize our inquiry data */
112	ret = init_inquiry(req_inq_flags, sim_inq_flags);
113	if (ret != 0)
114        	return (ret);
115
116	/* We start out life with a UA to indicate power-on/reset. */
117	for (i = 0; i < MAX_INITIATORS; i++) {
118		istate = tcmd_get_istate(i);
119		bzero(istate, sizeof(*istate));
120		istate->pending_ua = UA_POWER_ON;
121	}
122
123	return (0);
124}
125
126/* Caller allocates CTIO, sets its init_id
127return 0 if done, 1 if more processing needed
128on 0, caller sets SEND_STATUS */
129int
130tcmd_handle(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio, io_ops event)
131{
132	static struct targ_cdb_handlers *last_cmd;
133	struct initiator_state *istate;
134	struct atio_descr *a_descr;
135	int ret;
136
137	if (debug) {
138		warnx("tcmd_handle atio %p ctio %p atioflags %#x", atio, ctio,
139		      atio->ccb_h.flags);
140	}
141	ret = 0;
142	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
143
144	/* Do a full lookup if one-behind cache failed */
145	if (last_cmd == NULL || last_cmd->cmd != a_descr->cdb[0]) {
146		struct targ_cdb_handlers *h;
147
148		for (h = cdb_handlers; h->cmd != ILLEGAL_CDB; h++) {
149			if (a_descr->cdb[0] == h->cmd)
150				break;
151		}
152		last_cmd = h;
153	}
154	if (last_cmd->cmd == ILLEGAL_CDB) {
155		if (event != ATIO_WORK) {
156			warnx("no done func for %#x???", a_descr->cdb[0]);
157			abort();
158		}
159		/* Not found, return illegal request */
160		warnx("cdb %#x not handled", a_descr->cdb[0]);
161		tcmd_illegal_req(atio, ctio);
162		send_ccb((union ccb *)ctio, /*priority*/1);
163		return (0);
164	}
165
166	/* call completion and exit */
167	if (event != ATIO_WORK) {
168		if (last_cmd->done != NULL)
169			last_cmd->done(atio, ctio, event);
170		else
171			free_ccb((union ccb *)ctio);
172		return (1);
173	}
174
175	istate = tcmd_get_istate(ctio->init_id);
176	if (istate == NULL) {
177		tcmd_illegal_req(atio, ctio);
178		send_ccb((union ccb *)ctio, /*priority*/1);
179		return (0);
180	}
181
182	if (istate->pending_ca == 0 && istate->pending_ua != 0 &&
183	    a_descr->cdb[0] != INQUIRY) {
184		tcmd_sense(ctio->init_id, ctio, SSD_KEY_UNIT_ATTENTION,
185			   0x29, istate->pending_ua == UA_POWER_ON ? 1 : 2);
186		istate->pending_ca = CA_UNIT_ATTN;
187		if (debug) {
188			cdb_debug(a_descr->cdb, "UA active for %u: ",
189				  atio->init_id);
190		}
191		send_ccb((union ccb *)ctio, /*priority*/1);
192		return (0);
193	}
194
195	/* Store current CA and UA for later */
196	istate->orig_ua = istate->pending_ua;
197	istate->orig_ca = istate->pending_ca;
198
199	/*
200	 * As per SAM2, any command that occurs
201	 * after a CA is reported, clears the CA.  We must
202	 * also clear the UA condition, if any, that caused
203	 * the CA to occur assuming the UA is not for a
204	 * persistent condition.
205	 */
206	istate->pending_ca = CA_NONE;
207	if (istate->orig_ca == CA_UNIT_ATTN)
208		istate->pending_ua = UA_NONE;
209
210	/* If we have a valid handler, call start or completion function */
211	if (last_cmd->cmd != ILLEGAL_CDB) {
212		ret = last_cmd->start(atio, ctio);
213		/* XXX hack */
214		if (last_cmd->start != tcmd_rdwr) {
215			a_descr->init_req += ctio->dxfer_len;
216			send_ccb((union ccb *)ctio, /*priority*/1);
217		}
218	}
219
220	return (ret);
221}
222
223static struct initiator_state *
224tcmd_get_istate(u_int init_id)
225{
226	if (init_id >= MAX_INITIATORS) {
227		warnx("illegal init_id %d, max %d", init_id, MAX_INITIATORS - 1);
228		return (NULL);
229	} else {
230		return (&istates[init_id]);
231	}
232}
233
234void
235tcmd_sense(u_int init_id, struct ccb_scsiio *ctio, u_int8_t flags,
236	       u_int8_t asc, u_int8_t ascq)
237{
238	struct initiator_state *istate;
239	struct scsi_sense_data *sense;
240
241	/* Set our initiator's istate */
242	istate = tcmd_get_istate(init_id);
243	if (istate == NULL)
244		return;
245	istate->pending_ca |= CA_CMD_SENSE; /* XXX set instead of or? */
246	sense = &istate->sense_data;
247	bzero(sense, sizeof(*sense));
248	sense->error_code = SSD_CURRENT_ERROR;
249	sense->flags = flags;
250	sense->add_sense_code = asc;
251	sense->add_sense_code_qual = ascq;
252	sense->extra_len =
253		offsetof(struct scsi_sense_data, sense_key_spec[2]) -
254		offsetof(struct scsi_sense_data, extra_len);
255
256	/* Fill out the supplied CTIO */
257	if (ctio != NULL) {
258		bcopy(sense, &ctio->sense_data, sizeof(*sense));
259		ctio->sense_len = sizeof(*sense);  /* XXX */
260		ctio->ccb_h.flags &= ~CAM_DIR_MASK;
261		ctio->ccb_h.flags |= CAM_DIR_NONE | /* CAM_SEND_SENSE | */
262				     CAM_SEND_STATUS;
263		ctio->dxfer_len = 0;
264		ctio->scsi_status = SCSI_STATUS_CHECK_COND;
265	}
266}
267
268void
269tcmd_ua(u_int init_id, ua_types new_ua)
270{
271	struct initiator_state *istate;
272	u_int start, end;
273
274	if (init_id == CAM_TARGET_WILDCARD) {
275		start = 0;
276		end = MAX_INITIATORS - 1;
277	} else {
278		start = end = init_id;
279	}
280
281	for (; start <= end; start++) {
282		istate = tcmd_get_istate(start);
283		if (istate == NULL)
284			break;
285		istate->pending_ua = new_ua;
286	}
287}
288
289static int
290tcmd_inquiry(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio)
291{
292	struct scsi_inquiry *inq;
293	struct atio_descr *a_descr;
294	struct initiator_state *istate;
295	struct scsi_sense_data *sense;
296
297	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
298	inq = (struct scsi_inquiry *)a_descr->cdb;
299
300	if (debug)
301		cdb_debug(a_descr->cdb, "INQUIRY from %u: ", atio->init_id);
302	/*
303	 * Validate the command.  We don't support any VPD pages, so
304	 * complain if EVPD or CMDDT is set.
305	 */
306	istate = tcmd_get_istate(ctio->init_id);
307	sense = &istate->sense_data;
308	if ((inq->byte2 & SI_EVPD) != 0) {
309		tcmd_illegal_req(atio, ctio);
310		sense->sense_key_spec[0] = SSD_SCS_VALID | SSD_FIELDPTR_CMD |
311			SSD_BITPTR_VALID | /*bit value*/1;
312		sense->sense_key_spec[1] = 0;
313		sense->sense_key_spec[2] =
314			offsetof(struct scsi_inquiry, byte2);
315	} else if (inq->page_code != 0) {
316		tcmd_illegal_req(atio, ctio);
317		sense->sense_key_spec[0] = SSD_SCS_VALID | SSD_FIELDPTR_CMD;
318		sense->sense_key_spec[1] = 0;
319		sense->sense_key_spec[2] =
320			offsetof(struct scsi_inquiry, page_code);
321	} else {
322		bcopy(&inq_data, ctio->data_ptr, sizeof(inq_data));
323		ctio->dxfer_len = inq_data.additional_length + 4;
324		ctio->dxfer_len = min(ctio->dxfer_len,
325				      SCSI_CDB6_LEN(inq->length));
326		ctio->ccb_h.flags |= CAM_DIR_IN | CAM_SEND_STATUS;
327		ctio->scsi_status = SCSI_STATUS_OK;
328	}
329	return (0);
330}
331
332/* Initialize the inquiry response structure with the requested flags */
333static int
334init_inquiry(u_int16_t req_flags, u_int16_t sim_flags)
335{
336	struct scsi_inquiry_data *inq;
337
338	inq = &inq_data;
339	bzero(inq, sizeof(*inq));
340	inq->device = T_DIRECT | (SID_QUAL_LU_CONNECTED << 5);
341#ifdef SCSI_REV_SPC
342	inq->version = SCSI_REV_SPC; /* was 2 */
343#else
344	inq->version = SCSI_REV_3; /* was 2 */
345#endif
346
347	/*
348	 * XXX cpi.hba_inquiry doesn't support Addr16 so we give the
349	 * user what they want if they ask for it.
350	 */
351	if ((req_flags & SID_Addr16) != 0) {
352		sim_flags |= SID_Addr16;
353		warnx("Not sure SIM supports Addr16 but enabling it anyway");
354	}
355
356	/* Advertise only what the SIM can actually support */
357	req_flags &= sim_flags;
358	scsi_ulto2b(req_flags, &inq->reserved[1]);
359
360	inq->response_format = 2; /* SCSI2 Inquiry Format */
361	inq->additional_length = SHORT_INQUIRY_LENGTH -
362		offsetof(struct scsi_inquiry_data, additional_length);
363	bcopy("FreeBSD ", inq->vendor, SID_VENDOR_SIZE);
364	bcopy("Emulated Disk   ", inq->product, SID_PRODUCT_SIZE);
365	bcopy("0.1 ", inq->revision, SID_REVISION_SIZE);
366	return (0);
367}
368
369static int
370tcmd_req_sense(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio)
371{
372	struct scsi_request_sense *rsense;
373	struct scsi_sense_data *sense;
374	struct initiator_state *istate;
375	size_t dlen;
376	struct atio_descr *a_descr;
377
378	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
379	rsense = (struct scsi_request_sense *)a_descr->cdb;
380
381	istate = tcmd_get_istate(ctio->init_id);
382	sense = &istate->sense_data;
383
384	if (debug) {
385		cdb_debug(a_descr->cdb, "REQ SENSE from %u: ", atio->init_id);
386		warnx("Sending sense: %#x %#x %#x", sense->flags,
387		      sense->add_sense_code, sense->add_sense_code_qual);
388	}
389
390	if (istate->orig_ca == 0) {
391		tcmd_sense(ctio->init_id, NULL, SSD_KEY_NO_SENSE, 0, 0);
392		warnx("REQUEST SENSE from %u but no pending CA!",
393		      ctio->init_id);
394	}
395
396	bcopy(sense, ctio->data_ptr, sizeof(struct scsi_sense_data));
397	dlen = offsetof(struct scsi_sense_data, extra_len) +
398			sense->extra_len + 1;
399	ctio->dxfer_len = min(dlen, SCSI_CDB6_LEN(rsense->length));
400	ctio->ccb_h.flags |= CAM_DIR_IN | CAM_SEND_STATUS;
401	ctio->scsi_status = SCSI_STATUS_OK;
402	return (0);
403}
404
405static int
406tcmd_rd_cap(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio)
407{
408	struct scsi_read_capacity_data *srp;
409	struct atio_descr *a_descr;
410	uint32_t vsize;
411
412	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
413	srp = (struct scsi_read_capacity_data *)ctio->data_ptr;
414
415	if (volume_size > 0xffffffff)
416		vsize = 0xffffffff;
417	else
418		vsize = (uint32_t)(volume_size - 1);
419
420	if (debug) {
421		cdb_debug(a_descr->cdb, "READ CAP from %u (%u, %u): ",
422			  atio->init_id, vsize, sector_size);
423	}
424
425	bzero(srp, sizeof(*srp));
426	scsi_ulto4b(vsize, srp->addr);
427	scsi_ulto4b(sector_size, srp->length);
428
429	ctio->dxfer_len = sizeof(*srp);
430	ctio->ccb_h.flags |= CAM_DIR_IN | CAM_SEND_STATUS;
431	ctio->scsi_status = SCSI_STATUS_OK;
432	return (0);
433}
434
435#ifdef READ_16
436static int
437tcmd_rd_cap16(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio)
438{
439	struct scsi_read_capacity_16 *scsi_cmd;
440	struct scsi_read_capacity_data_long *srp;
441	struct atio_descr *a_descr;
442
443	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
444	scsi_cmd = (struct scsi_read_capacity_16 *)a_descr->cdb;
445	srp = (struct scsi_read_capacity_data_long *)ctio->data_ptr;
446
447	if (scsi_cmd->service_action != SRC16_SERVICE_ACTION) {
448		tcmd_illegal_req(atio, ctio);
449		return (0);
450	}
451
452	if (debug) {
453		cdb_debug(a_descr->cdb, "READ CAP16 from %u (%u, %u): ",
454			  atio->init_id, volume_size - 1, sector_size);
455	}
456
457	bzero(srp, sizeof(*srp));
458	scsi_u64to8b(volume_size - 1, srp->addr);
459	scsi_ulto4b(sector_size, srp->length);
460
461	ctio->dxfer_len = sizeof(*srp);
462	ctio->ccb_h.flags |= CAM_DIR_IN | CAM_SEND_STATUS;
463	ctio->scsi_status = SCSI_STATUS_OK;
464	return (0);
465}
466#endif
467
468static int
469tcmd_rdwr(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio)
470{
471	struct atio_descr *a_descr;
472	struct ctio_descr *c_descr;
473	int ret;
474
475	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
476	c_descr = (struct ctio_descr *)ctio->ccb_h.targ_descr;
477
478	/* Command needs to be decoded */
479	if ((a_descr->flags & CAM_DIR_MASK) == CAM_DIR_RESV) {
480		if (debug)
481			warnx("Calling rdwr_decode");
482		ret = tcmd_rdwr_decode(atio, ctio);
483		if (ret == 0) {
484			send_ccb((union ccb *)ctio, /*priority*/1);
485			return (0);
486		}
487	}
488	ctio->ccb_h.flags |= a_descr->flags;
489
490	/* Call appropriate work function */
491	if ((a_descr->flags & CAM_DIR_IN) != 0) {
492		ret = start_io(atio, ctio, CAM_DIR_IN);
493		if (debug)
494#if __FreeBSD_version >= 500000
495			warnx("Starting DIR_IN @%jd:%u",
496#else
497			warnx("Starting DIR_IN @%lld:%u",
498#endif
499			    c_descr->offset, a_descr->targ_req);
500	} else {
501		ret = start_io(atio, ctio, CAM_DIR_OUT);
502		if (debug)
503#if __FreeBSD_version >= 500000
504			warnx("Starting DIR_OUT @%jd:%u",
505#else
506			warnx("Starting DIR_OUT @%lld:%u",
507#endif
508			    c_descr->offset, a_descr->init_req);
509	}
510
511	return (ret);
512}
513
514static int
515tcmd_rdwr_decode(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio)
516{
517	uint64_t blkno;
518	uint32_t count;
519	struct atio_descr *a_descr;
520	u_int8_t *cdb;
521
522	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
523	cdb = a_descr->cdb;
524	if (debug)
525		cdb_debug(cdb, "R/W from %u: ", atio->init_id);
526
527	switch (cdb[0]) {
528	case READ_6:
529	case WRITE_6:
530	{
531		struct scsi_rw_6 *rw_6 = (struct scsi_rw_6 *)cdb;
532		blkno = scsi_3btoul(rw_6->addr);
533		count = rw_6->length;
534		break;
535	}
536	case READ_10:
537	case WRITE_10:
538	{
539		struct scsi_rw_10 *rw_10 = (struct scsi_rw_10 *)cdb;
540		blkno = scsi_4btoul(rw_10->addr);
541		count = scsi_2btoul(rw_10->length);
542		break;
543	}
544#ifdef READ_16
545	case READ_16:
546	case WRITE_16:
547	{
548		struct scsi_rw_16 *rw_16 = (struct scsi_rw_16 *)cdb;
549		blkno = scsi_8btou64(rw_16->addr);
550		count = scsi_4btoul(rw_16->length);
551		break;
552	}
553#endif
554	default:
555		tcmd_illegal_req(atio, ctio);
556		return (0);
557	}
558	if (blkno + count > volume_size) {
559		warnx("Attempt to access past end of volume");
560		tcmd_sense(ctio->init_id, ctio,
561			   SSD_KEY_ILLEGAL_REQUEST, 0x21, 0);
562		return (0);
563	}
564
565	/* Get an (overall) data length and set direction */
566	a_descr->base_off = ((off_t)blkno) * sector_size;
567	a_descr->total_len = count * sector_size;
568	if (a_descr->total_len == 0) {
569		if (debug)
570#if __FreeBSD_version >= 500000
571			warnx("r/w 0 blocks @ blkno %ju", blkno);
572#else
573			warnx("r/w 0 blocks @ blkno %llu", blkno);
574#endif
575		tcmd_null_ok(atio, ctio);
576		return (0);
577	} else if (cdb[0] == WRITE_6 || cdb[0] == WRITE_10) {
578		a_descr->flags |= CAM_DIR_OUT;
579		if (debug)
580#if __FreeBSD_version >= 500000
581			warnx("write %u blocks @ blkno %ju", count, blkno);
582#else
583			warnx("write %u blocks @ blkno %llu", count, blkno);
584#endif
585	} else {
586		a_descr->flags |= CAM_DIR_IN;
587		if (debug)
588#if __FreeBSD_version >= 500000
589			warnx("read %u blocks @ blkno %ju", count, blkno);
590#else
591			warnx("read %u blocks @ blkno %llu", count, blkno);
592#endif
593	}
594	return (1);
595}
596
597static int
598start_io(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio, int dir)
599{
600	struct atio_descr *a_descr;
601	struct ctio_descr *c_descr;
602	int ret;
603
604	/* Set up common structures */
605	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
606	c_descr = (struct ctio_descr *)ctio->ccb_h.targ_descr;
607
608	if (dir == CAM_DIR_IN) {
609		c_descr->offset = a_descr->base_off + a_descr->targ_req;
610		ctio->dxfer_len = a_descr->total_len - a_descr->targ_req;
611	} else {
612		c_descr->offset = a_descr->base_off + a_descr->init_req;
613		ctio->dxfer_len = a_descr->total_len - a_descr->init_req;
614	}
615	ctio->dxfer_len = min(ctio->dxfer_len, buf_size);
616	assert(ctio->dxfer_len >= 0);
617
618	c_descr->aiocb.aio_offset = c_descr->offset;
619	c_descr->aiocb.aio_nbytes = ctio->dxfer_len;
620
621	/* If DIR_IN, start read from target, otherwise begin CTIO xfer. */
622	ret = 1;
623	if (dir == CAM_DIR_IN) {
624		if (aio_read(&c_descr->aiocb) < 0)
625			err(1, "aio_read"); /* XXX */
626		a_descr->targ_req += ctio->dxfer_len;
627		if (a_descr->targ_req == a_descr->total_len) {
628			ctio->ccb_h.flags |= CAM_SEND_STATUS;
629			ctio->scsi_status = SCSI_STATUS_OK;
630			ret = 0;
631		}
632	} else {
633		if (a_descr->targ_ack == a_descr->total_len)
634			tcmd_null_ok(atio, ctio);
635		a_descr->init_req += ctio->dxfer_len;
636		if (a_descr->init_req == a_descr->total_len &&
637		    ctio->dxfer_len > 0) {
638			/*
639			 * If data phase done, remove atio from workq.
640			 * The completion handler will call work_atio to
641			 * send the final status.
642			 */
643			ret = 0;
644		}
645		send_ccb((union ccb *)ctio, /*priority*/1);
646	}
647
648	return (ret);
649}
650
651static void
652tcmd_rdwr_done(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio,
653	       io_ops event)
654{
655	struct atio_descr *a_descr;
656	struct ctio_descr *c_descr;
657
658	a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
659	c_descr = (struct ctio_descr *)ctio->ccb_h.targ_descr;
660
661	switch (event) {
662	case AIO_DONE:
663		if (aio_return(&c_descr->aiocb) < 0) {
664			warn("aio_return error");
665			/* XXX */
666			tcmd_sense(ctio->init_id, ctio,
667				   SSD_KEY_MEDIUM_ERROR, 0, 0);
668			send_ccb((union ccb *)ctio, /*priority*/1);
669			break;
670		}
671		a_descr->targ_ack += ctio->dxfer_len;
672		if ((a_descr->flags & CAM_DIR_IN) != 0) {
673			if (debug)
674				warnx("sending CTIO for AIO read");
675			a_descr->init_req += ctio->dxfer_len;
676			send_ccb((union ccb *)ctio, /*priority*/1);
677		} else {
678			/* Use work function to send final status */
679			if (a_descr->init_req == a_descr->total_len)
680				work_atio(atio);
681			if (debug)
682				warnx("AIO done freeing CTIO");
683			free_ccb((union ccb *)ctio);
684		}
685		break;
686	case CTIO_DONE:
687		if (ctio->ccb_h.status != CAM_REQ_CMP) {
688			/* XXX */
689			errx(1, "CTIO failed, status %#x", ctio->ccb_h.status);
690		}
691		a_descr->init_ack += ctio->dxfer_len;
692		if ((a_descr->flags & CAM_DIR_MASK) == CAM_DIR_OUT &&
693		    ctio->dxfer_len > 0) {
694			if (debug)
695				warnx("sending AIO for CTIO write");
696			a_descr->targ_req += ctio->dxfer_len;
697			if (aio_write(&c_descr->aiocb) < 0)
698				err(1, "aio_write"); /* XXX */
699		} else {
700			if (debug)
701				warnx("CTIO done freeing CTIO");
702			free_ccb((union ccb *)ctio);
703		}
704		break;
705	default:
706		warnx("Unknown completion code %d", event);
707		abort();
708		/* NOTREACHED */
709	}
710}
711
712/* Simple ok message used by TUR, SYNC_CACHE, etc. */
713static int
714tcmd_null_ok(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio)
715{
716	if (debug) {
717		struct atio_descr *a_descr;
718
719		a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
720		cdb_debug(a_descr->cdb, "Sending null ok to %u : ", atio->init_id);
721	}
722
723	ctio->dxfer_len = 0;
724	ctio->ccb_h.flags &= ~CAM_DIR_MASK;
725	ctio->ccb_h.flags |= CAM_DIR_NONE | CAM_SEND_STATUS;
726	ctio->scsi_status = SCSI_STATUS_OK;
727	return (0);
728}
729
730/* Simple illegal request message used by MODE SENSE, etc. */
731static int
732tcmd_illegal_req(struct ccb_accept_tio *atio, struct ccb_scsiio *ctio)
733{
734	if (debug) {
735		struct atio_descr *a_descr;
736
737		a_descr = (struct atio_descr *)atio->ccb_h.targ_descr;
738		cdb_debug(a_descr->cdb, "Sending ill req to %u: ", atio->init_id);
739	}
740
741	tcmd_sense(atio->init_id, ctio, SSD_KEY_ILLEGAL_REQUEST,
742		   /*asc*/0x24, /*ascq*/0);
743	return (0);
744}
745
746static void
747cdb_debug(u_int8_t *cdb, const char *msg, ...)
748{
749	char msg_buf[512];
750	int len;
751	va_list ap;
752
753	va_start(ap, msg);
754	vsnprintf(msg_buf, sizeof(msg_buf), msg, ap);
755	va_end(ap);
756	len = strlen(msg_buf);
757	scsi_cdb_string(cdb, msg_buf + len, sizeof(msg_buf) - len);
758	warnx("%s", msg_buf);
759}
760