Home | History | Annotate | Download | only in iscsitgtd
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 
     22 /*
     23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
     24  * Use is subject to license terms.
     25  */
     26 
     27 /*
     28  * []------------------------------------------------------------------[]
     29  * | Implementation of SBC-2 emulation					|
     30  * []------------------------------------------------------------------[]
     31  */
     32 #include <sys/types.h>
     33 #include <aio.h>
     34 #include <sys/asynch.h>
     35 #include <sys/mman.h>
     36 #include <stddef.h>
     37 #include <strings.h>
     38 #include <unistd.h>
     39 #include <assert.h>
     40 
     41 #include <sys/scsi/generic/sense.h>
     42 #include <sys/scsi/generic/status.h>
     43 #include <sys/scsi/generic/inquiry.h>
     44 #include <sys/scsi/generic/commands.h>
     45 #include <sys/scsi/generic/mode.h>
     46 #include <sys/scsi/generic/dad_mode.h>
     47 
     48 #include "t10.h"
     49 #include "t10_spc.h"
     50 #include "t10_spc_pr.h"
     51 #include "t10_sbc.h"
     52 #include "utility.h"
     53 
     54 /*
     55  * External declarations
     56  */
     57 void sbc_cmd(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len);
     58 void spc_cmd_reserve6(t10_cmd_t *, uint8_t *, size_t);
     59 void spc_cmd_release6(t10_cmd_t *, uint8_t *, size_t);
     60 void spc_cmd_pr_in(t10_cmd_t *, uint8_t *, size_t);
     61 void spc_cmd_pr_out(t10_cmd_t *, uint8_t *, size_t);
     62 void spc_cmd_pr_out_data(t10_cmd_t *, emul_handle_t, size_t, char *, size_t);
     63 void spc_pr_read(t10_cmd_t *);
     64 Boolean_t spc_pgr_check(t10_cmd_t *, uint8_t *);
     65 Boolean_t spc_npr_check(t10_cmd_t *, uint8_t *);
     66 
     67 /*
     68  * Forward declarations
     69  */
     70 static int sbc_mmap_overlap(const void *v1, const void *v2);
     71 static void sbc_overlap_store(disk_io_t *io);
     72 static void sbc_overlap_free(disk_io_t *io);
     73 static void sbc_overlap_check(disk_io_t *io);
     74 static void sbc_overlap_flush(disk_params_t *d);
     75 static void sbc_data(t10_cmd_t *cmd, emul_handle_t e, size_t offset,
     76     char *data, size_t data_len);
     77 static disk_io_t *sbc_io_alloc(t10_cmd_t *c);
     78 static void sbc_io_free(emul_handle_t e);
     79 static void sbc_read_cmplt(emul_handle_t e);
     80 static void sbc_write_cmplt(emul_handle_t e);
     81 static void sbc_read_capacity16(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len);
     82 static char *sense_page3(disk_params_t *d, char *buf, uint8_t pc);
     83 static char *sense_page4(disk_params_t *d, char *buf, uint8_t pc);
     84 static char *sense_cache(disk_params_t *d, char *buf, uint8_t pc);
     85 static char *sense_mode_control(t10_lu_impl_t *lu, char *buf, uint8_t pc);
     86 static char *sense_info_ctrl(char *buf, uint8_t pc);
     87 static scsi_cmd_table_t lba_table[];
     88 
     89 static long sbc_page_size;
     90 /*
     91  * []----
     92  * | sbc_init_common -- Initialize LU data which is common to all I_T_Ls
     93  * []----
     94  */
     95 Boolean_t
     96 sbc_common_init(t10_lu_common_t *lu)
     97 {
     98 	disk_params_t	*d;
     99 	tgt_node_t	*node	= lu->l_root;
    100 
    101 	sbc_page_size = sysconf(_SC_PAGESIZE);
    102 
    103 	if ((d = (disk_params_t *)calloc(1, sizeof (*d))) == NULL)
    104 		return (False);
    105 
    106 	(void) tgt_find_value_int(node, XML_ELEMENT_BPS,
    107 	    (int *)&d->d_bytes_sect);
    108 	(void) tgt_find_value_int(node, XML_ELEMENT_HEADS,
    109 	    (int *)&d->d_heads);
    110 	(void) tgt_find_value_int(node, XML_ELEMENT_SPT,
    111 	    (int *)&d->d_spt);
    112 	(void) tgt_find_value_int(node, XML_ELEMENT_CYLINDERS,
    113 	    (int *)&d->d_cyl);
    114 	(void) tgt_find_value_int(node, XML_ELEMENT_RPM,
    115 	    (int *)&d->d_rpm);
    116 	(void) tgt_find_value_int(node, XML_ELEMENT_INTERLEAVE,
    117 	    (int *)&d->d_interleave);
    118 	d->d_fast_write	= lu->l_fast_write_ack;
    119 	d->d_size	= lu->l_size / (uint64_t)d->d_bytes_sect;
    120 	d->d_state	= lu->l_state;
    121 
    122 	avl_create(&d->d_mmap_overlaps, sbc_mmap_overlap,
    123 	    sizeof (disk_io_t), offsetof(disk_io_t, da_mmap_overlap));
    124 	(void) pthread_mutex_init(&d->d_mutex, NULL);
    125 	(void) pthread_cond_init(&d->d_mmap_cond, NULL);
    126 	(void) pthread_cond_init(&d->d_io_cond, NULL);
    127 	if ((d->d_io_reserved = (disk_io_t *)calloc(1, sizeof (disk_io_t))) ==
    128 	    NULL) {
    129 		free(d);
    130 		return (False);
    131 	}
    132 
    133 	lu->l_dtype_params = (void *)d;
    134 	return (True);
    135 }
    136 
    137 void
    138 sbc_common_fini(t10_lu_common_t *lu)
    139 {
    140 	disk_params_t	*d = lu->l_dtype_params;
    141 
    142 	sbc_overlap_flush(d);
    143 	avl_destroy(&d->d_mmap_overlaps);
    144 	free(d->d_io_reserved);
    145 	free(lu->l_dtype_params);
    146 }
    147 
    148 void
    149 sbc_task_mgmt(t10_lu_common_t *lu, TaskOp_t op)
    150 {
    151 	disk_params_t	*d = (disk_params_t *)lu->l_dtype_params;
    152 
    153 	switch (op) {
    154 	case CapacityChange:
    155 		d->d_size = lu->l_size / (uint64_t)d->d_bytes_sect;
    156 		break;
    157 
    158 	case DeviceOnline:
    159 		d->d_state = lu->l_state;
    160 		break;
    161 	}
    162 }
    163 
    164 /*
    165  * []----
    166  * | sbc_init_per -- Initialize per I_T_L information
    167  * []----
    168  */
    169 void
    170 sbc_per_init(t10_lu_impl_t *itl)
    171 {
    172 	disk_params_t	*d = (disk_params_t *)itl->l_common->l_dtype_params;
    173 
    174 	if (d->d_state == lu_online) {
    175 		itl->l_cmd	= sbc_cmd;
    176 		itl->l_pgr_read = False;	/* Look for PGR data */
    177 	}
    178 	else
    179 		itl->l_cmd	= spc_cmd_offline;
    180 	itl->l_data	= sbc_data;
    181 	itl->l_cmd_table = lba_table;
    182 }
    183 
    184 void
    185 sbc_per_fini(t10_lu_impl_t *itl)
    186 {
    187 }
    188 
    189 /*
    190  * []----
    191  * | sbc_cmd -- start a SCSI command
    192  * |
    193  * | This routine is called from within the SAM-3 Task router.
    194  * []----
    195  */
    196 void
    197 sbc_cmd(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
    198 {
    199 	scsi_cmd_table_t	*e;
    200 
    201 	/*
    202 	 * Determine if there is persistent data for this I_T_L Nexus
    203 	 */
    204 	if (cmd->c_lu->l_pgr_read == False) {
    205 		spc_pr_read(cmd);
    206 		cmd->c_lu->l_pgr_read = True;
    207 	}
    208 
    209 	e = &cmd->c_lu->l_cmd_table[cdb[0]];
    210 #ifdef FULL_DEBUG
    211 	queue_prt(mgmtq, Q_STE_IO, "SBC%x  LUN%d Cmd %s id=%p\n",
    212 	    cmd->c_lu->l_targ->s_targ_num, cmd->c_lu->l_common->l_num,
    213 	    e->cmd_name == NULL ? "(no name)" : e->cmd_name, cmd->c_trans_id);
    214 #endif
    215 	(*e->cmd_start)(cmd, cdb, cdb_len);
    216 }
    217 
    218 /*
    219  * []----
    220  * | sbc_cmd_reserve -- Run commands when another I_T_L has a reservation
    221  * []----
    222  */
    223 void
    224 sbc_cmd_reserved(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
    225 {
    226 	disk_params_t		*p = (disk_params_t *)T10_PARAMS_AREA(cmd);
    227 	sbc_reserve_t		*res = &p->d_sbc_reserve;
    228 	Boolean_t		conflict = False;
    229 
    230 	/*
    231 	 * SPC-3, revision 23, Table 31
    232 	 * SPC commands that are allowed in the presence of various reservations
    233 	 */
    234 	switch (cdb[0]) {
    235 	case SCMD_INQUIRY:
    236 	case SCMD_LOG_SENSE_G1:
    237 	case SCMD_REPORT_LUNS:
    238 	case SCMD_REQUEST_SENSE:
    239 	case SCMD_MAINTENANCE_IN: /* REPORT TARGET PORT GROUPS (A3h/0Ah) */
    240 	case SCMD_SVC_ACTION_IN_G5: /* READ MEDIA SERIAL NUMBER (ABh) */
    241 		break;
    242 	default:
    243 		(void) pthread_rwlock_rdlock(&res->res_rwlock);
    244 		switch (res->res_type) {
    245 		case RT_NONE:
    246 			/* conflict = False; */
    247 			break;
    248 		case RT_PGR:
    249 			conflict = spc_pgr_check(cmd, cdb);
    250 			break;
    251 		case RT_NPR:
    252 			conflict = spc_npr_check(cmd, cdb);
    253 			break;
    254 		default:
    255 			conflict = True;
    256 			break;
    257 		}
    258 		(void) pthread_rwlock_unlock(&res->res_rwlock);
    259 	}
    260 
    261 	queue_prt(mgmtq, Q_PR_IO,
    262 	    "PGR%x LUN%d CDB:%s - sbc_cmd_reserved(%s:%s)\n",
    263 	    cmd->c_lu->l_targ->s_targ_num,
    264 	    cmd->c_lu->l_common->l_num,
    265 	    cmd->c_lu->l_cmd_table[cmd->c_cdb[0]].cmd_name == NULL
    266 	    ? "(no name)"
    267 	    : cmd->c_lu->l_cmd_table[cmd->c_cdb[0]].cmd_name,
    268 	    res->res_type == RT_PGR ? "PGR" :
    269 	    res->res_type == RT_NPR ? "NPR" :
    270 	    res->res_type == RT_NONE ? "" : "unknown",
    271 	    conflict ? "Conflict" : "Allowed");
    272 
    273 	/*
    274 	 * If no conflict at this point, allow command
    275 	 */
    276 	if (conflict == False) {
    277 		sbc_cmd(cmd, cdb, cdb_len);
    278 	} else {
    279 		trans_send_complete(cmd, STATUS_RESERVATION_CONFLICT);
    280 	}
    281 }
    282 
    283 /*
    284  * []----
    285  * | sbc_data -- Data phase for command.
    286  * |
    287  * | Normally this is only called for the WRITE command. Other commands
    288  * | that have a data in phase will probably be short circuited when
    289  * | we call trans_rqst_dataout() and the data is already available.
    290  * | At least this is true for iSCSI. FC however will need a DataIn phase
    291  * | for commands like MODE SELECT and PGROUT.
    292  * []----
    293  */
    294 static void
    295 sbc_data(t10_cmd_t *cmd, emul_handle_t id, size_t offset, char *data,
    296     size_t data_len)
    297 {
    298 	scsi_cmd_table_t	*e;
    299 
    300 	e = &cmd->c_lu->l_cmd_table[cmd->c_cdb[0]];
    301 #ifdef FULL_DEBUG
    302 	queue_prt(mgmtq, Q_STE_IO, "SBC%x  LUN%d Data %s id=%p\n",
    303 	    cmd->c_lu->l_targ->s_targ_num, cmd->c_lu->l_common->l_num,
    304 	    e->cmd_name, cmd->c_trans_id);
    305 #endif
    306 	if (*e->cmd_data != NULL)
    307 		(*e->cmd_data)(cmd, id, offset, data, data_len);
    308 }
    309 
    310 /*
    311  * []------------------------------------------------------------------[]
    312  * | SCSI Block Commands - 2						|
    313  * | T10/1417-D								|
    314  * | The following functions implement the emulation of SBC-2 type	|
    315  * | commands.								|
    316  * []------------------------------------------------------------------[]
    317  */
    318 
    319 /*
    320  * []----
    321  * | sbc_read -- emulation of SCSI READ command
    322  * []----
    323  */
    324 /*ARGSUSED*/
    325 static void
    326 sbc_read(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
    327 {
    328 	/*LINTED*/
    329 	union scsi_cdb	*u		= (union scsi_cdb *)cdb;
    330 	diskaddr_t	addr;
    331 	off_t		offset		= 0;
    332 	uint32_t	cnt;
    333 	uint32_t	min;
    334 	disk_io_t	*io;
    335 	void		*mmap_data	= T10_MMAP_AREA(cmd);
    336 	uint64_t	err_blkno;
    337 	disk_params_t	*d;
    338 	uchar_t		addl_sense_len;
    339 	t10_cmd_t	*c;
    340 	iscsi_cmd_t	*iscsi = (iscsi_cmd_t *)T10_TRANS_ID(cmd);
    341 
    342 	if ((d = (disk_params_t *)T10_PARAMS_AREA(cmd)) == NULL) {
    343 		trans_send_complete(cmd, STATUS_BUSY);
    344 		return;
    345 	}
    346 
    347 	switch (u->scc_cmd) {
    348 	case SCMD_READ:
    349 		/*
    350 		 * SBC-2 Revision 16, section 5.5
    351 		 * Reserve bit checks
    352 		 */
    353 		if ((cdb[1] & 0xe0) || SAM_CONTROL_BYTE_RESERVED(cdb[5])) {
    354 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    355 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    356 			trans_send_complete(cmd, STATUS_CHECK);
    357 			return;
    358 		}
    359 
    360 		addr = (diskaddr_t)(uint32_t)GETG0ADDR(u);
    361 		cnt = GETG0COUNT(u);
    362 
    363 		/*
    364 		 * SBC-2 Revision 16
    365 		 * Section: 5.5 READ(6) command
    366 		 *	A TRANSFER LENGTH field set to zero specifies
    367 		 *	that 256 logical blocks shall be read.
    368 		 */
    369 		if (cnt == 0)
    370 			cnt = 256;
    371 		break;
    372 
    373 	case SCMD_READ_G1:
    374 		/*
    375 		 * SBC-2 Revision 16, section 5.6
    376 		 * Reserve bit checks.
    377 		 */
    378 		if ((cdb[1] & 6) || cdb[6] ||
    379 		    SAM_CONTROL_BYTE_RESERVED(cdb[9])) {
    380 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    381 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    382 			trans_send_complete(cmd, STATUS_CHECK);
    383 			return;
    384 		}
    385 
    386 		addr = (diskaddr_t)(uint32_t)GETG1ADDR(u);
    387 		cnt = GETG1COUNT(u);
    388 		break;
    389 
    390 	case SCMD_READ_G4:
    391 		/*
    392 		 * SBC-2 Revision 16, section 5.8
    393 		 * Reserve bit checks
    394 		 */
    395 		if ((cdb[1] & 0x6) || cdb[14] ||
    396 		    SAM_CONTROL_BYTE_RESERVED(cdb[15])) {
    397 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    398 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    399 			trans_send_complete(cmd, STATUS_CHECK);
    400 			return;
    401 		}
    402 
    403 		addr = GETG4LONGADDR(u);
    404 		cnt = GETG4COUNT(u);
    405 		break;
    406 
    407 	default:
    408 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    409 		trans_send_complete(cmd, STATUS_CHECK);
    410 		return;
    411 	}
    412 
    413 	if ((addr + cnt) > d->d_size) {
    414 
    415 		if (addr > d->d_size)
    416 			err_blkno = addr;
    417 		else
    418 			err_blkno = d->d_size;
    419 
    420 		if (err_blkno > FIXED_SENSE_ADDL_INFO_LEN)
    421 			addl_sense_len = INFORMATION_SENSE_DESCR;
    422 		else
    423 			addl_sense_len = 0;
    424 
    425 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, addl_sense_len);
    426 		spc_sense_info(cmd, err_blkno);
    427 		spc_sense_ascq(cmd, SPC_ASC_BLOCK_RANGE, SPC_ASCQ_BLOCK_RANGE);
    428 		trans_send_complete(cmd, STATUS_CHECK);
    429 
    430 		queue_prt(mgmtq, Q_STE_ERRS,
    431 		    "SBC%x  LUN%d READ Illegal sector "
    432 		    "(0x%llx + 0x%x) > 0x%ullx\n",
    433 		    cmd->c_lu->l_targ->s_targ_num, cmd->c_lu->l_common->l_num,
    434 		    addr, cnt, d->d_size);
    435 		return;
    436 	}
    437 
    438 	cmd->c_lu->l_cmds_read++;
    439 	cmd->c_lu->l_sects_read += cnt;
    440 
    441 	if (cnt == 0) {
    442 		trans_send_complete(cmd, STATUS_GOOD);
    443 		return;
    444 	}
    445 
    446 	do {
    447 		min = MIN((cnt * 512) - offset, T10_MAX_OUT(cmd));
    448 		if ((offset + min) < (cnt * 512LL)) {
    449 			c = trans_cmd_dup(cmd);
    450 			/* dup failed, just finish the original command */
    451 			if (c == NULL) {
    452 				c = cmd;
    453 				offset = (cnt * 512);
    454 			}
    455 		} else {
    456 			c = cmd;
    457 		}
    458 
    459 		(void) pthread_mutex_lock(&cmd->c_lu->l_cmd_mutex);
    460 		/* dup count include the original cmd */
    461 		iscsi->c_t10_dup++;
    462 
    463 		/*
    464 		 * Add the cmd to the list of t10 cmds for this iscsi cmd.
    465 		 * But don't add the original t10 cmd twice.
    466 		 */
    467 		if (c != cmd) {
    468 			c->c_cmd_next = iscsi->c_t10_cmd;
    469 			iscsi->c_t10_cmd = c;
    470 		}
    471 		(void) pthread_mutex_unlock(&cmd->c_lu->l_cmd_mutex);
    472 
    473 		io = sbc_io_alloc(c);
    474 
    475 		io->da_lba	= addr;
    476 		io->da_lba_cnt	= cnt;
    477 		io->da_offset	= offset;
    478 		io->da_data_len	= min;
    479 
    480 #ifdef FULL_DEBUG
    481 		queue_prt(mgmtq, Q_STE_IO,
    482 		    "SBC%x  LUN%d blk 0x%llx, cnt %d, offset 0x%llx, size %d\n",
    483 		    c->c_lu->l_targ->s_targ_num, c->c_lu->l_common->l_num,
    484 		    addr, cnt, io->da_offset, min);
    485 #endif
    486 		if (mmap_data != MAP_FAILED) {
    487 
    488 			io->da_clear_overlap		= True;
    489 			io->da_data_alloc		= False;
    490 			io->da_aio.a_aio.aio_return	= min;
    491 			io->da_data = (char *)mmap_data + (addr * 512LL) +
    492 			    io->da_offset;
    493 			sbc_overlap_store(io);
    494 			sbc_read_cmplt((emul_handle_t)io);
    495 
    496 		} else {
    497 			if ((io->da_data = (char *)malloc(min)) == NULL) {
    498 				trans_send_complete(c, STATUS_BUSY);
    499 				return;
    500 			}
    501 			io->da_clear_overlap	= False;
    502 			io->da_data_alloc	= True;
    503 			io->da_aio.a_aio_cmplt	= sbc_read_cmplt;
    504 			io->da_aio.a_id		= io;
    505 			trans_aioread(c, io->da_data, min, (addr * 512LL) +
    506 			    (off_t)io->da_offset, &io->da_aio);
    507 		}
    508 		offset += min;
    509 	} while (offset < (off_t)(cnt * 512));
    510 }
    511 
    512 /*
    513  * []----
    514  * | sbc_read_cmplt -- Once we have the data, need to send it along.
    515  * []----
    516  */
    517 static void
    518 sbc_read_cmplt(emul_handle_t id)
    519 {
    520 	disk_io_t	*io		= (disk_io_t *)id;
    521 	int		sense_len;
    522 	uint64_t	err_blkno;
    523 	t10_cmd_t	*cmd		= io->da_cmd;
    524 	Boolean_t	last;
    525 
    526 	last = (io->da_offset + io->da_data_len) < (io->da_lba_cnt * 512LL) ?
    527 	    False : True;
    528 
    529 	if (io->da_aio.a_aio.aio_return != io->da_data_len) {
    530 		err_blkno = io->da_lba + ((io->da_offset + 511) / 512);
    531 		cmd->c_resid = (io->da_lba_cnt * 512) - io->da_offset;
    532 		if (err_blkno > FIXED_SENSE_ADDL_INFO_LEN)
    533 			sense_len = INFORMATION_SENSE_DESCR;
    534 		else
    535 			sense_len = 0;
    536 		spc_sense_create(cmd, KEY_HARDWARE_ERROR, sense_len);
    537 		spc_sense_info(cmd, err_blkno);
    538 		if (last == True) {
    539 			trans_send_complete(cmd, STATUS_CHECK);
    540 			sbc_io_free(io);
    541 		} else {
    542 			t10_cmd_done(cmd);
    543 		}
    544 		return;
    545 	}
    546 
    547 	if (trans_send_datain(cmd, io->da_data, io->da_data_len, io->da_offset,
    548 	    sbc_io_free, last, io) == False) {
    549 		trans_send_complete(cmd, STATUS_BUSY);
    550 	}
    551 }
    552 
    553 /*
    554  * []----
    555  * | sbc_write -- implement a SCSI write command.
    556  * []----
    557  */
    558 /*ARGSUSED*/
    559 static void
    560 sbc_write(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
    561 {
    562 	union scsi_cdb	*u;
    563 	diskaddr_t	addr;
    564 	uint64_t	err_blkno;
    565 	uint32_t	cnt;
    566 	uchar_t		addl_sense_len;
    567 	disk_params_t	*d;
    568 	disk_io_t	*io;
    569 	size_t		max_out;
    570 	void		*mmap_area;
    571 
    572 	if ((d = (disk_params_t *)T10_PARAMS_AREA(cmd)) == NULL) {
    573 		trans_send_complete(cmd, STATUS_BUSY);
    574 		return;
    575 	}
    576 
    577 	/*LINTED*/
    578 	u = (union scsi_cdb *)cdb;
    579 
    580 	switch (u->scc_cmd) {
    581 	case SCMD_WRITE:
    582 		/*
    583 		 * SBC-2 revision 16, section 5.24
    584 		 * Reserve bit checks.
    585 		 */
    586 		if ((cdb[1] & 0xe0) || SAM_CONTROL_BYTE_RESERVED(cdb[5])) {
    587 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    588 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    589 			trans_send_complete(cmd, STATUS_CHECK);
    590 			return;
    591 		}
    592 		addr = (diskaddr_t)(uint32_t)GETG0ADDR(u);
    593 		cnt = GETG0COUNT(u);
    594 		/*
    595 		 * SBC-2 Revision 16/Section 5.24 WRITE(6)
    596 		 * A TRANSFER LENGHT of 0 indicates that 256 logical blocks
    597 		 * shall be written.
    598 		 */
    599 		if (cnt == 0)
    600 			cnt = 256;
    601 		break;
    602 
    603 	case SCMD_WRITE_G1:
    604 		/*
    605 		 * SBC-2 revision 16, section 5.25
    606 		 * Reserve bit checks.
    607 		 */
    608 		if ((cdb[1] & 0x6) || cdb[6] ||
    609 		    SAM_CONTROL_BYTE_RESERVED(cdb[9])) {
    610 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    611 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    612 			trans_send_complete(cmd, STATUS_CHECK);
    613 			return;
    614 		}
    615 		addr = (diskaddr_t)(uint32_t)GETG1ADDR(u);
    616 		cnt = GETG1COUNT(u);
    617 		break;
    618 
    619 	case SCMD_WRITE_G4:
    620 		/*
    621 		 * SBC-2 revision 16, section 5.27
    622 		 * Reserve bit checks.
    623 		 */
    624 		if ((cdb[1] & 0x6) || cdb[14] ||
    625 		    SAM_CONTROL_BYTE_RESERVED(cdb[15])) {
    626 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    627 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    628 			trans_send_complete(cmd, STATUS_CHECK);
    629 			return;
    630 		}
    631 		addr = (diskaddr_t)GETG4LONGADDR(u);
    632 		cnt = GETG4COUNT(u);
    633 		break;
    634 
    635 	default:
    636 		queue_prt(mgmtq, Q_STE_ERRS, "Unprocessed WRITE type\n");
    637 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    638 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    639 		trans_send_complete(cmd, STATUS_CHECK);
    640 		return;
    641 
    642 	}
    643 
    644 	if ((addr + cnt) > d->d_size) {
    645 
    646 		if (addr > d->d_size)
    647 			err_blkno = addr;
    648 		else
    649 			err_blkno = d->d_size;
    650 
    651 		if (err_blkno > FIXED_SENSE_ADDL_INFO_LEN)
    652 			addl_sense_len = INFORMATION_SENSE_DESCR;
    653 		else
    654 			addl_sense_len = 0;
    655 
    656 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, addl_sense_len);
    657 		spc_sense_info(cmd, err_blkno);
    658 		spc_sense_ascq(cmd, SPC_ASC_BLOCK_RANGE, SPC_ASCQ_BLOCK_RANGE);
    659 		trans_send_complete(cmd, STATUS_CHECK);
    660 
    661 		queue_prt(mgmtq, Q_STE_ERRS,
    662 		    "SBC%x  LUN%d WRITE Illegal sector "
    663 		    "(0x%llx + 0x%x) > 0x%ullx\n",
    664 		    cmd->c_lu->l_targ->s_targ_num, cmd->c_lu->l_common->l_num,
    665 		    addr, cnt, d->d_size);
    666 		return;
    667 	}
    668 
    669 	if (cnt == 0) {
    670 		queue_prt(mgmtq, Q_STE_NONIO,
    671 		    "SBC%x  LUN%d WRITE zero block count for addr 0x%x\n",
    672 		    cmd->c_lu->l_targ->s_targ_num, cmd->c_lu->l_common->l_num,
    673 		    addr);
    674 		trans_send_complete(cmd, STATUS_GOOD);
    675 		return;
    676 	}
    677 
    678 	io = (disk_io_t *)cmd->c_emul_id;
    679 	if (io == NULL) {
    680 		io = sbc_io_alloc(cmd);
    681 		io->da_lba		= addr;
    682 		io->da_lba_cnt		= cnt;
    683 		io->da_clear_overlap	= False;
    684 		io->da_aio.a_aio_cmplt	= sbc_write_cmplt;
    685 		io->da_aio.a_id		= io;
    686 
    687 		/*
    688 		 * Only update the statistics the first time through
    689 		 * for this particular command. If the requested transfer
    690 		 * is larger than the transport can handle this routine
    691 		 * will be called many times.
    692 		 */
    693 		cmd->c_lu->l_cmds_write++;
    694 		cmd->c_lu->l_sects_write += cnt;
    695 
    696 #ifdef FULL_DEBUG
    697 		queue_prt(mgmtq, Q_STE_IO,
    698 		    "SBC%x  LUN%d blk 0x%llx, cnt 0x%x\n",
    699 		    cmd->c_lu->l_targ->s_targ_num, cmd->c_lu->l_common->l_num,
    700 		    addr, cnt);
    701 #endif
    702 	}
    703 
    704 	/*
    705 	 * If a transport sets the maximum output value to zero we'll
    706 	 * just request the entire amount. Otherwise, transfer no more
    707 	 * than the maximum output or the reminder, whichever is less.
    708 	 */
    709 	max_out = cmd->c_lu->l_targ->s_maxout;
    710 	io->da_data_len = max_out ? MIN(max_out,
    711 	    (cnt * 512) - io->da_offset) : (cnt * 512);
    712 
    713 	mmap_area = T10_MMAP_AREA(cmd);
    714 	if (mmap_area != MAP_FAILED) {
    715 
    716 		io->da_data_alloc	= False;
    717 		io->da_data		= (char *)mmap_area + (addr * 512LL) +
    718 		    io->da_offset;
    719 		sbc_overlap_check(io);
    720 
    721 	} else if ((io->da_data = (char *)malloc(io->da_data_len)) == NULL) {
    722 
    723 		trans_send_complete(cmd, STATUS_BUSY);
    724 		return;
    725 
    726 	} else {
    727 
    728 		io->da_data_alloc	= True;
    729 	}
    730 	if (trans_rqst_dataout(cmd, io->da_data, io->da_data_len,
    731 	    io->da_offset, io, sbc_io_free) == False) {
    732 		trans_send_complete(cmd, STATUS_BUSY);
    733 	}
    734 }
    735 
    736 /*
    737  * []----
    738  * | sbc_write_data -- store a chunk of data from the transport
    739  * []----
    740  */
    741 /*ARGSUSED*/
    742 void
    743 sbc_write_data(t10_cmd_t *cmd, emul_handle_t id, size_t offset, char *data,
    744     size_t data_len)
    745 {
    746 	disk_io_t	*io = (disk_io_t *)id;
    747 	disk_params_t	*d;
    748 
    749 	if (cmd->c_lu->l_common->l_mmap == MAP_FAILED) {
    750 		trans_aiowrite(cmd, data, data_len, (io->da_lba * 512) +
    751 		    (off_t)io->da_offset, &io->da_aio);
    752 	} else {
    753 		if ((d = (disk_params_t *)T10_PARAMS_AREA(cmd)) == NULL)
    754 			return;
    755 
    756 		if (d->d_fast_write == False) {
    757 			uint64_t	sa;
    758 			size_t		len;
    759 
    760 			/*
    761 			 * msync requires the address to be page aligned.
    762 			 * That means we need to account for any alignment
    763 			 * loss in the len field and access the full page.
    764 			 */
    765 			sa = (uint64_t)(intptr_t)data & ~(sbc_page_size - 1);
    766 			len = (((size_t)data & (sbc_page_size - 1)) +
    767 			    data_len + sbc_page_size - 1) &
    768 			    ~(sbc_page_size -1);
    769 
    770 			/*
    771 			 * We only need to worry about sync'ing the blocks
    772 			 * in the mmap case because if the fast cache isn't
    773 			 * enabled for AIO the file will be opened with F_SYNC
    774 			 * which performs the correct action.
    775 			 */
    776 			if (msync((char *)(intptr_t)sa, len, MS_SYNC) == -1) {
    777 				perror("msync");
    778 				spc_sense_create(cmd, KEY_HARDWARE_ERROR, 0);
    779 				trans_send_complete(cmd, STATUS_CHECK);
    780 				return;
    781 			}
    782 		}
    783 
    784 		/*
    785 		 * Since the data has already been transfered from the
    786 		 * transport to the mmap area we just need to call
    787 		 * the complete routine.
    788 		 */
    789 		sbc_write_cmplt(id);
    790 	}
    791 }
    792 
    793 /*
    794  * []----
    795  * | sbc_write_cmplt -- deal with end game of write
    796  * |
    797  * | See if all of the data for this write operation has been dealt
    798  * | with. If so, send a final acknowledgement back to the transport.
    799  * | If not, update the offset, calculate the next transfer size, and
    800  * | start the process again.
    801  * []---
    802  */
    803 static void
    804 sbc_write_cmplt(emul_handle_t e)
    805 {
    806 	disk_io_t	*io	= (disk_io_t *)e;
    807 	t10_cmd_t	*cmd	= io->da_cmd;
    808 	int		sense_len;
    809 	uint64_t	err_blkno;
    810 
    811 	if ((cmd->c_lu->l_common->l_mmap == MAP_FAILED) &&
    812 	    (io->da_aio.a_aio.aio_return != io->da_data_len)) {
    813 		err_blkno = io->da_lba + ((io->da_offset + 511) / 512);
    814 		cmd->c_resid = (io->da_lba_cnt * 512) - io->da_offset;
    815 		if (err_blkno > FIXED_SENSE_ADDL_INFO_LEN)
    816 			sense_len = INFORMATION_SENSE_DESCR;
    817 		else
    818 			sense_len = 0;
    819 
    820 		spc_sense_create(cmd, KEY_HARDWARE_ERROR, sense_len);
    821 		spc_sense_info(cmd, err_blkno);
    822 		trans_send_complete(cmd, STATUS_CHECK);
    823 		return;
    824 	}
    825 
    826 	if ((io->da_offset + io->da_data_len) < (io->da_lba_cnt * 512)) {
    827 		if (io->da_data_alloc == True) {
    828 			io->da_data_alloc = False;
    829 			free(io->da_data);
    830 		}
    831 
    832 		io->da_offset	+= io->da_data_len;
    833 		io->da_data_len	= MIN(cmd->c_lu->l_targ->s_maxout,
    834 		    (io->da_lba_cnt * 512) - io->da_offset);
    835 		sbc_write(cmd, cmd->c_cdb, cmd->c_cdb_len);
    836 		return;
    837 	}
    838 	trans_send_complete(cmd, STATUS_GOOD);
    839 }
    840 
    841 /*ARGSUSED*/
    842 void
    843 sbc_startstop(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
    844 {
    845 	/*
    846 	 * SBC-2 revision 16, section 5.17
    847 	 * Reserve bit checks
    848 	 */
    849 	if ((cdb[1] & 0xfe) || cdb[2] || cdb[3] ||
    850 	    (cdb[4] & ~(SBC_PWR_MASK|SBC_PWR_LOEJ|SBC_PWR_START)) ||
    851 	    SAM_CONTROL_BYTE_RESERVED(cdb[5])) {
    852 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    853 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    854 		trans_send_complete(cmd, STATUS_CHECK);
    855 		return;
    856 	}
    857 
    858 	/*
    859 	 * More reserve bit checks
    860 	 */
    861 	switch ((cdb[4] & SBC_PWR_MASK) >> SBC_PWR_SHFT) {
    862 		case SBC_PWR_START_VALID:
    863 			/*
    864 			 * It's an error to ask that the media be ejected.
    865 			 *
    866 			 * NOTE: Look for method to pass the START bit
    867 			 * along to underlying storage. If we're asked to
    868 			 * stop the drive there's not much that we can do
    869 			 * for the virtual storage, but maybe everything else
    870 			 * has been requested to stop as well.
    871 			 */
    872 			if (cdb[4] & SBC_PWR_LOEJ) {
    873 				goto send_error;
    874 			}
    875 			break;
    876 
    877 		case SBC_PWR_ACTIVE:
    878 		case SBC_PWR_IDLE:
    879 		case SBC_PWR_STANDBY:
    880 		case SBC_PWR_OBSOLETE:
    881 			break;
    882 
    883 		case SBC_PWR_LU_CONTROL:
    884 		case SBC_PWR_FORCE_IDLE_0:
    885 		case SBC_PWR_FORCE_STANDBY_0:
    886 			break;
    887 
    888 		default:
    889 send_error:
    890 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    891 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    892 			trans_send_complete(cmd, STATUS_CHECK);
    893 			return;
    894 	}
    895 
    896 	if ((cdb[1] & 1) == 0) {
    897 		/*
    898 		 * Immediate bit is not set, so go ahead a flush things.
    899 		 */
    900 		if (cmd->c_lu->l_common->l_mmap == MAP_FAILED) {
    901 			if (fsync(cmd->c_lu->l_common->l_fd) != 0) {
    902 				spc_sense_create(cmd, KEY_MEDIUM_ERROR, 0);
    903 				trans_send_complete(cmd, STATUS_CHECK);
    904 				return;
    905 			}
    906 		} else {
    907 			if (msync(cmd->c_lu->l_common->l_mmap,
    908 			    cmd->c_lu->l_common->l_size, MS_SYNC) == -1) {
    909 				spc_sense_create(cmd, KEY_MEDIUM_ERROR, 0);
    910 				trans_send_complete(cmd, STATUS_CHECK);
    911 				return;
    912 			}
    913 		}
    914 	}
    915 	trans_send_complete(cmd, STATUS_GOOD);
    916 }
    917 
    918 /*
    919  * []----
    920  * | sbc_recap -- read capacity of device being emulated.
    921  * []----
    922  */
    923 /*ARGSUSED*/
    924 void
    925 sbc_recap(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
    926 {
    927 	uint64_t			capacity;
    928 	int				len;
    929 	uint32_t			lba;
    930 	struct scsi_capacity *cap;
    931 	disk_params_t			*d;
    932 	disk_io_t			*io;
    933 
    934 	if ((d = (disk_params_t *)T10_PARAMS_AREA(cmd)) == NULL)
    935 		return;
    936 
    937 	capacity = d->d_size;
    938 
    939 	len = sizeof (struct scsi_capacity);
    940 
    941 	/*
    942 	 * SBC-2 Revision 16, section 5.10.1
    943 	 * Any of the following conditions will generate an error.
    944 	 *    (1) PMI bit is zero and LOGICAL block address is non-zero
    945 	 *    (2) Rserved bytes are not zero
    946 	 *    (3) Reseved bits are not zero
    947 	 *    (4) Reserved CONTROL bits are not zero
    948 	 */
    949 	if ((((cdb[8] & SBC_CAPACITY_PMI) == 0) &&
    950 	    (cdb[2] || cdb[3] || cdb[4] || cdb[5])) ||
    951 	    cdb[1] || cdb[6] || cdb[7] || (cdb[8] & ~SBC_CAPACITY_PMI) ||
    952 	    SAM_CONTROL_BYTE_RESERVED(cdb[9])) {
    953 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
    954 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
    955 		trans_send_complete(cmd, STATUS_CHECK);
    956 		return;
    957 	}
    958 
    959 	/*
    960 	 * if the device capacity larger than 32 bits then set
    961 	 * the capacity of the device to all 0xf's.
    962 	 * a device that supports LBAs larger than 32 bits which
    963 	 * should be used read_capacity(16) comand to get the capacity.
    964 	 * NOTE: the adjustment to subject one from the capacity is
    965 	 * done below.
    966 	 */
    967 	if (capacity & 0xFFFFFFFF00000000ULL)
    968 		capacity = 0xFFFFFFFF;
    969 
    970 	io = sbc_io_alloc(cmd);
    971 
    972 	if ((cap = (struct scsi_capacity *)calloc(1, len)) == NULL) {
    973 		sbc_io_free(io);
    974 		trans_send_complete(cmd, STATUS_BUSY);
    975 		return;
    976 	}
    977 	io->da_data		= (char *)cap;
    978 	io->da_data_alloc	= True;
    979 	io->da_clear_overlap	= False;
    980 	io->da_data_len		= len;
    981 
    982 	if (capacity != 0xFFFFFFFF) {
    983 		/*
    984 		 * Look at the PMI information
    985 		 */
    986 		if (cdb[8] & SBC_CAPACITY_PMI) {
    987 			lba = cdb[2] << 24 | cdb[3] << 16 |
    988 			    cdb[4] << 8 | cdb[5];
    989 			if (lba >= capacity)
    990 				cap->capacity = htonl(0xffffffff);
    991 			else
    992 				cap->capacity = (capacity - 1);
    993 		} else {
    994 			cap->capacity = htonl(capacity - 1);
    995 		}
    996 	} else {
    997 		cap->capacity = htonl(capacity);
    998 	}
    999 	cap->lbasize = htonl(d->d_bytes_sect);
   1000 
   1001 	if (trans_send_datain(cmd, io->da_data, io->da_data_len, 0,
   1002 	    sbc_io_free, True, io) == False) {
   1003 		trans_send_complete(cmd, STATUS_BUSY);
   1004 	}
   1005 }
   1006 
   1007 /*ARGSUSED*/
   1008 void
   1009 sbc_msense(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
   1010 {
   1011 	struct mode_header	*mode_hdr;
   1012 	char			*np;
   1013 	disk_params_t		*d;
   1014 	disk_io_t		*io;
   1015 	int			rtn_len;
   1016 	uint8_t			pc;
   1017 	struct block_descriptor	bd;
   1018 
   1019 	if ((d = (disk_params_t *)T10_PARAMS_AREA(cmd)) == NULL)
   1020 		return;
   1021 
   1022 	/*
   1023 	 * SPC-3 Revision 21c section 6.8
   1024 	 * Reserve bit checks
   1025 	 */
   1026 	if ((cdb[1] & ~SPC_MODE_SENSE_DBD) ||
   1027 	    SAM_CONTROL_BYTE_RESERVED(cdb[5])) {
   1028 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1029 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1030 		trans_send_complete(cmd, STATUS_CHECK);
   1031 		return;
   1032 	}
   1033 
   1034 	/*
   1035 	 * Zero length causes a simple ack to occur.
   1036 	 */
   1037 	if (cdb[4] == 0) {
   1038 		trans_send_complete(cmd, STATUS_GOOD);
   1039 		return;
   1040 	}
   1041 
   1042 	io = sbc_io_alloc(cmd);
   1043 
   1044 	/*
   1045 	 * Make sure that we have enough room in the data buffer. We'll
   1046 	 * only send back the amount requested though
   1047 	 */
   1048 	io->da_data_len = MAX(cdb[4], sizeof (struct mode_format) +
   1049 	    sizeof (struct mode_geometry) +
   1050 	    sizeof (struct mode_control_scsi3) +
   1051 	    sizeof (struct mode_cache_scsi3) +
   1052 	    sizeof (struct mode_info_ctrl) + (MODE_BLK_DESC_LENGTH * 5));
   1053 	if ((io->da_data = (char *)calloc(1, io->da_data_len)) == NULL) {
   1054 		sbc_io_free(io);
   1055 		trans_send_complete(cmd, STATUS_BUSY);
   1056 		return;
   1057 	}
   1058 	io->da_clear_overlap	= False;
   1059 	io->da_data_alloc	= True;
   1060 	mode_hdr		= (struct mode_header *)io->da_data;
   1061 
   1062 	/*
   1063 	 * If DBD flag is set, then we should not send back the block
   1064 	 * descriptor details
   1065 	 */
   1066 	if (cdb[1] & SPC_MODE_SENSE_DBD) {
   1067 		mode_hdr->length = sizeof (struct mode_header) - 1;
   1068 		mode_hdr->bdesc_length  = 0;
   1069 	}
   1070 	/*
   1071 	 * If DBD flag is zero, then we should add block descriptor details
   1072 	 */
   1073 	else {
   1074 		/*
   1075 		 * We subtract one from the length because this value is not
   1076 		 * supposed to contain it's size.
   1077 		 */
   1078 
   1079 		mode_hdr->length = sizeof (struct mode_header) - 1 +
   1080 		    MODE_BLK_DESC_LENGTH;
   1081 		mode_hdr->bdesc_length	= MODE_BLK_DESC_LENGTH;
   1082 
   1083 		/*
   1084 		 * Need to fill in the block size. Some initiators are starting
   1085 		 * to use this value, which is correct, instead of looking at
   1086 		 * the page3 data which is starting to become obsolete.
   1087 		 *
   1088 		 * We define the space for the structure on the stack and then
   1089 		 * copy it into the return area to avoid structure alignment
   1090 		 * issues.
   1091 		 */
   1092 		bzero(&bd, sizeof (bd));
   1093 		bd.blksize_hi	= lobyte(hiword(d->d_bytes_sect));
   1094 		bd.blksize_mid	= hibyte(loword(d->d_bytes_sect));
   1095 		bd.blksize_lo	= lobyte(loword(d->d_bytes_sect));
   1096 		bcopy(&bd, io->da_data + sizeof (*mode_hdr), sizeof (bd));
   1097 	}
   1098 
   1099 	/*
   1100 	 * cdb[2] contains page code, and page control field.  So, we need
   1101 	 * to mask page control field,  while checking for the page code.
   1102 	 *
   1103 	 * Page control specifies whether to report the current, changeable
   1104 	 * default or saved values.  This parameter only applies to the
   1105 	 * mode page data itself.  From spc-3 section 6.9.1:
   1106 	 *
   1107 	 * "The PC field only affects the mode parameters within the mode
   1108 	 * pages, however the PS, SPF, PAGE CODE field, SUBPAGE CODE field,
   1109 	 * and PAGE LENGTH field should return current values (i.e. as if
   1110 	 * PC is set to 00b).  The mode parameter header and mode parameter
   1111 	 * block descriptor should return current values."
   1112 	 *
   1113 	 * Also:  "Some SCSI target devices may not distinguish between
   1114 	 * current and saved mode parameters and report identical values
   1115 	 * in response to a PC field of either 0 or 3."  Our implementation
   1116 	 * will treat 0 and 3 the same.
   1117 	 */
   1118 	pc  = (cdb[2] & SPC_MODE_SENSE_PC_MASK) >> SPC_MODE_SENSE_PC_SHIFT;
   1119 
   1120 	switch (cdb[2] & SPC_MODE_SENSE_PAGE_CODE_MASK) {
   1121 
   1122 	case MODE_SENSE_PAGE3_CODE:
   1123 		if ((d->d_heads == 0) && (d->d_cyl == 0) && (d->d_spt == 0)) {
   1124 			sbc_io_free(io);
   1125 			spc_unsupported(cmd, cdb, cdb_len);
   1126 			return;
   1127 		}
   1128 		mode_hdr->length += sizeof (struct mode_format);
   1129 		(void) sense_page3(d,
   1130 		    io->da_data + sizeof (*mode_hdr) + mode_hdr->bdesc_length,
   1131 		    pc);
   1132 		break;
   1133 
   1134 	case MODE_SENSE_PAGE4_CODE:
   1135 		if ((d->d_heads == 0) && (d->d_cyl == 0) && (d->d_spt == 0)) {
   1136 			sbc_io_free(io);
   1137 			spc_unsupported(cmd, cdb, cdb_len);
   1138 			return;
   1139 		}
   1140 		mode_hdr->length += sizeof (struct mode_geometry);
   1141 		(void) sense_page4(d,
   1142 		    io->da_data + sizeof (*mode_hdr) + mode_hdr->bdesc_length,
   1143 		    pc);
   1144 		break;
   1145 
   1146 	case MODE_SENSE_CACHE:
   1147 		mode_hdr->length += sizeof (struct mode_cache_scsi3);
   1148 		(void) sense_cache(d,
   1149 		    io->da_data + sizeof (*mode_hdr) + mode_hdr->bdesc_length,
   1150 		    pc);
   1151 		break;
   1152 
   1153 	case MODE_SENSE_CONTROL:
   1154 		mode_hdr->length += sizeof (struct mode_control_scsi3);
   1155 		(void) sense_mode_control(cmd->c_lu,
   1156 		    io->da_data + sizeof (*mode_hdr) + mode_hdr->bdesc_length,
   1157 		    pc);
   1158 		break;
   1159 
   1160 	case MODE_SENSE_INFO_CTRL:
   1161 		mode_hdr->length += sizeof (struct mode_info_ctrl);
   1162 		(void) sense_info_ctrl(io->da_data + sizeof (*mode_hdr) +
   1163 		    mode_hdr->bdesc_length, pc);
   1164 		break;
   1165 
   1166 	case MODE_SENSE_SEND_ALL:
   1167 		/*
   1168 		 * SPC-3 revision 21c
   1169 		 * Section 6.9.1 Table 97
   1170 		 * "Return all subpage 00h mode pages in page_0 format"
   1171 		 */
   1172 		mode_hdr->length += sizeof (struct mode_cache_scsi3) +
   1173 		    sizeof (struct mode_control_scsi3) +
   1174 		    sizeof (struct mode_info_ctrl);
   1175 
   1176 		if (d->d_heads && d->d_cyl && d->d_spt)
   1177 			mode_hdr->length += sizeof (struct mode_format) +
   1178 			    sizeof (struct mode_geometry);
   1179 
   1180 		np = io->da_data + sizeof (*mode_hdr) +
   1181 		    mode_hdr->bdesc_length;
   1182 		if (io->da_data_len < (sizeof (struct mode_format) +
   1183 		    sizeof (struct mode_geometry) +
   1184 		    sizeof (struct mode_cache_scsi3) +
   1185 		    sizeof (struct mode_control_scsi3) +
   1186 		    sizeof (struct mode_info_ctrl))) {
   1187 
   1188 			/*
   1189 			 * Believe it or not, there's an initiator out
   1190 			 * there which sends a mode sense request for all
   1191 			 * of the pages, without always sending a data-in
   1192 			 * size which is large enough.
   1193 			 * NOTE: Need to check the error key returned
   1194 			 * here and see if something else should be used.
   1195 			 */
   1196 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1197 			trans_send_complete(cmd, STATUS_CHECK);
   1198 
   1199 		} else {
   1200 
   1201 			/*
   1202 			 * If we don't have geometry then don't attempt
   1203 			 * report that information.
   1204 			 */
   1205 			rtn_len = sizeof (*mode_hdr) + mode_hdr->bdesc_length;
   1206 			if (d->d_heads && d->d_cyl && d->d_spt) {
   1207 				np = sense_page3(d, np, pc);
   1208 				np = sense_page4(d, np, pc);
   1209 			}
   1210 			np = sense_cache(d, np, pc);
   1211 			np = sense_mode_control(cmd->c_lu, np, pc);
   1212 			(void) sense_info_ctrl(np, pc);
   1213 		}
   1214 		break;
   1215 
   1216 	case 0x00:
   1217 		/*
   1218 		 * SPC-3 Revision 21c, section 6.9.1
   1219 		 * Table 97 -- Mode page code usage for all devices
   1220 		 * Page Code 00 == Vendor specific. We are going to return
   1221 		 *    zeros.
   1222 		 */
   1223 		break;
   1224 
   1225 	default:
   1226 		queue_prt(mgmtq, Q_STE_ERRS,
   1227 		    "SBC%x  LUN%d Unsupported mode_sense request 0x%x\n",
   1228 		    cmd->c_lu->l_targ->s_targ_num, cmd->c_lu->l_common->l_num,
   1229 		    cdb[2]);
   1230 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1231 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1232 		trans_send_complete(cmd, STATUS_CHECK);
   1233 		return;
   1234 		break;
   1235 	}
   1236 
   1237 	rtn_len = mode_hdr->length + 1;
   1238 	rtn_len = MIN(rtn_len, cdb[4]);
   1239 	if (trans_send_datain(cmd, io->da_data, rtn_len, 0, sbc_io_free,
   1240 	    True, io) == False) {
   1241 		trans_send_complete(cmd, STATUS_BUSY);
   1242 	}
   1243 }
   1244 
   1245 /*ARGSUSED*/
   1246 void
   1247 sbc_synccache(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
   1248 {
   1249 	/*
   1250 	 * SBC-2 revision 16, section 5.18
   1251 	 * Reserve bit checks
   1252 	 */
   1253 	if ((cdb[1] & ~(SBC_SYNC_CACHE_IMMED|SBC_SYNC_CACHE_NV)) || cdb[6] ||
   1254 	    SAM_CONTROL_BYTE_RESERVED(cdb[9])) {
   1255 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1256 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1257 		trans_send_complete(cmd, STATUS_CHECK);
   1258 	} else {
   1259 		/*
   1260 		 * SBC-3, revision 16, section 5.18
   1261 		 * An IMMED bit set to one specifies that the device server
   1262 		 * shall return status as soon as the CDB has been validated.
   1263 		 */
   1264 		if (cdb[1] & SBC_SYNC_CACHE_IMMED) {
   1265 
   1266 			/*
   1267 			 * Immediately return a status of GOOD. If an error
   1268 			 * occurs with the fsync/msync the next command will
   1269 			 * pick up an error.
   1270 			 */
   1271 			trans_send_complete(cmd, STATUS_GOOD);
   1272 			if (cmd->c_lu->l_common->l_mmap == MAP_FAILED) {
   1273 				if (fsync(cmd->c_lu->l_common->l_fd) == -1) {
   1274 					cmd->c_lu->l_status =
   1275 					    KEY_HARDWARE_ERROR;
   1276 					cmd->c_lu->l_asc = 0x00;
   1277 					cmd->c_lu->l_ascq = 0x00;
   1278 				}
   1279 			} else {
   1280 				if (msync(cmd->c_lu->l_common->l_mmap,
   1281 				    cmd->c_lu->l_common->l_size, MS_SYNC) ==
   1282 				    -1) {
   1283 					cmd->c_lu->l_status =
   1284 					    KEY_HARDWARE_ERROR;
   1285 					cmd->c_lu->l_asc = 0x00;
   1286 					cmd->c_lu->l_ascq = 0x00;
   1287 				}
   1288 			}
   1289 		} else {
   1290 			if (cmd->c_lu->l_common->l_mmap == MAP_FAILED) {
   1291 				if (fsync(cmd->c_lu->l_common->l_fd) == -1) {
   1292 					spc_sense_create(cmd,
   1293 					    KEY_HARDWARE_ERROR, 0);
   1294 					trans_send_complete(cmd, STATUS_CHECK);
   1295 				} else
   1296 					trans_send_complete(cmd, STATUS_GOOD);
   1297 			} else {
   1298 				if (msync(cmd->c_lu->l_common->l_mmap,
   1299 				    cmd->c_lu->l_common->l_size, MS_SYNC) ==
   1300 				    -1) {
   1301 					spc_sense_create(cmd,
   1302 					    KEY_HARDWARE_ERROR, 0);
   1303 					trans_send_complete(cmd, STATUS_CHECK);
   1304 				} else
   1305 					trans_send_complete(cmd, STATUS_GOOD);
   1306 			}
   1307 		}
   1308 	}
   1309 }
   1310 
   1311 /*ARGSUSED*/
   1312 void
   1313 sbc_service_actiong4(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
   1314 {
   1315 	switch (cdb[1] & SPC_GROUP4_SERVICE_ACTION_MASK) {
   1316 	case SSVC_ACTION_READ_CAPACITY_G4:
   1317 		sbc_read_capacity16(cmd, cdb, cdb_len);
   1318 		break;
   1319 	default:
   1320 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1321 		spc_sense_ascq(cmd, 0x20, 0x00);
   1322 		trans_send_complete(cmd, STATUS_CHECK);
   1323 		break;
   1324 	}
   1325 }
   1326 
   1327 /*ARGSUSED*/
   1328 static void
   1329 sbc_read_capacity16(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
   1330 {
   1331 	uint64_t		capacity;
   1332 	uint64_t		lba;
   1333 	int			rep_size;	/* response data size */
   1334 	struct scsi_capacity_16	*cap16;
   1335 	disk_params_t		*d;
   1336 	disk_io_t		*io;
   1337 
   1338 	if ((d = (disk_params_t *)T10_PARAMS_AREA(cmd)) == NULL)
   1339 		return;
   1340 
   1341 	capacity = d->d_size;
   1342 	/*
   1343 	 * READ_CAPACITY(16) command
   1344 	 */
   1345 	rep_size = cdb[10] << 24 | cdb[11] << 16 | cdb[12] << 8 | cdb[13];
   1346 	if (rep_size == 0) {
   1347 
   1348 		/*
   1349 		 * A zero length field means we're done.
   1350 		 */
   1351 		trans_send_complete(cmd, STATUS_GOOD);
   1352 		return;
   1353 	}
   1354 	rep_size = MIN(rep_size, sizeof (*cap16));
   1355 
   1356 	/*
   1357 	 * Reserve bit checks.
   1358 	 */
   1359 	if ((cdb[1] & ~SPC_GROUP4_SERVICE_ACTION_MASK) ||
   1360 	    (cdb[14] & ~SBC_CAPACITY_PMI) ||
   1361 	    SAM_CONTROL_BYTE_RESERVED(cdb[15])) {
   1362 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1363 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1364 		trans_send_complete(cmd, STATUS_CHECK);
   1365 		return;
   1366 	}
   1367 
   1368 	lba = (uint64_t)cdb[2] << 56 | (uint64_t)cdb[3] << 48 |
   1369 	    (uint64_t)cdb[4] << 40 | (uint64_t)cdb[5] << 32 |
   1370 	    (uint64_t)cdb[6] << 24 | (uint64_t)cdb[7] << 16 |
   1371 	    (uint64_t)cdb[8] << 8 | (uint64_t)cdb[9];
   1372 
   1373 	io = sbc_io_alloc(cmd);
   1374 
   1375 	/*
   1376 	 * We'll malloc enough space for the structure so that we can
   1377 	 * set the values as we place. However, we'll set the transfer
   1378 	 * length to the minimum of the requested size and our structure.
   1379 	 * This is per SBC-2 revision 16, section 5.11.1 regarding
   1380 	 * ALLOCATION LENGTH.
   1381 	 */
   1382 	if ((cap16 = (struct scsi_capacity_16 *)calloc(1, sizeof (*cap16))) ==
   1383 	    NULL) {
   1384 		trans_send_complete(cmd, STATUS_BUSY);
   1385 		return;
   1386 	}
   1387 	io->da_data		= (char *)cap16;
   1388 	io->da_data_len		= rep_size;
   1389 	io->da_data_alloc	= True;
   1390 	io->da_clear_overlap	= False;
   1391 
   1392 	if (cdb[14] & SBC_CAPACITY_PMI) {
   1393 		if (lba >= capacity)
   1394 			cap16->sc_capacity = htonll(0xffffffffffffffffULL);
   1395 		else
   1396 			cap16->sc_capacity = htonll(capacity - 1);
   1397 	} else {
   1398 		cap16->sc_capacity	= htonll(capacity - 1);
   1399 	}
   1400 	cap16->sc_lbasize	= htonl(d->d_bytes_sect);
   1401 
   1402 	if (trans_send_datain(cmd, io->da_data, io->da_data_len, 0,
   1403 	    sbc_io_free, True, io) == False) {
   1404 		trans_send_complete(cmd, STATUS_BUSY);
   1405 	}
   1406 }
   1407 
   1408 /*ARGSUSED*/
   1409 static void
   1410 sbc_verify(t10_cmd_t *cmd, uint8_t *cdb, size_t cdb_len)
   1411 {
   1412 	/*LINTED*/
   1413 	union scsi_cdb	*u		= (union scsi_cdb *)cdb;
   1414 	diskaddr_t	addr;
   1415 	uint32_t	cnt;
   1416 	uint32_t	chk_size;
   1417 	uint64_t	sz;
   1418 	uint64_t	err_blkno;
   1419 	Boolean_t	bytchk;
   1420 	char		*chk_block;
   1421 	disk_io_t	*io;
   1422 	disk_params_t	*d;
   1423 	uchar_t		addl_sense_len;
   1424 
   1425 	if ((d = (disk_params_t *)T10_PARAMS_AREA(cmd)) == NULL) {
   1426 		trans_send_complete(cmd, STATUS_BUSY);
   1427 		return;
   1428 	}
   1429 
   1430 	/*
   1431 	 * Check the common reserved bits here and check the CONTROL byte
   1432 	 * in each specific section for the different CDB sizes.
   1433 	 * NOTE: If the VRPROTECT is non-zero we're required by SBC-3
   1434 	 * to return an error since our emulation code doesn't have
   1435 	 * any protection information stored on the media that we can
   1436 	 * access.
   1437 	 */
   1438 	if ((cdb[1] & ~(SBC_VRPROTECT_MASK|SBC_DPO|SBC_BYTCHK)) ||
   1439 	    (cdb[1] & SBC_VRPROTECT_MASK)) {
   1440 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1441 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1442 		trans_send_complete(cmd, STATUS_CHECK);
   1443 		return;
   1444 	}
   1445 
   1446 	bytchk = cdb[1] & SBC_BYTCHK ? True : False;
   1447 
   1448 	switch (u->scc_cmd) {
   1449 	case SCMD_VERIFY:
   1450 		/*
   1451 		 * BYTE 6 of the VERIFY(10) contains bits:
   1452 		 * 0-4: Group number -- not supported must be zero
   1453 		 * 5-6: Reserved
   1454 		 * 7  : Restricted for MMC-4
   1455 		 */
   1456 		if (cdb[6] || SAM_CONTROL_BYTE_RESERVED(cdb[9])) {
   1457 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1458 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1459 			trans_send_complete(cmd, STATUS_CHECK);
   1460 			return;
   1461 		}
   1462 		addr	= (diskaddr_t)(uint32_t)GETG1ADDR(u);
   1463 		cnt	= GETG1COUNT(u);
   1464 		break;
   1465 
   1466 	case SCMD_VERIFY_G4:
   1467 		/*
   1468 		 * See VERIFY(10) above for definitions of what byte 14
   1469 		 * contains.
   1470 		 */
   1471 		if (cdb[14] || SAM_CONTROL_BYTE_RESERVED(cdb[15])) {
   1472 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1473 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1474 			trans_send_complete(cmd, STATUS_CHECK);
   1475 			return;
   1476 		}
   1477 		addr	= GETG4LONGADDR(u);
   1478 		cnt	= GETG4COUNT(u);
   1479 		break;
   1480 
   1481 	case SCMD_VERIFY_G5:
   1482 		/*
   1483 		 * See VERIFY(10) above for definitions of what byte 10
   1484 		 * contains.
   1485 		 */
   1486 		if (cdb[10] || SAM_CONTROL_BYTE_RESERVED(cdb[11])) {
   1487 			spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1488 			spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1489 			trans_send_complete(cmd, STATUS_CHECK);
   1490 			return;
   1491 		}
   1492 		addr	= (diskaddr_t)GETG5ADDR(u);
   1493 		cnt	= GETG5COUNT(u);
   1494 		break;
   1495 
   1496 	default:
   1497 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, 0);
   1498 		spc_sense_ascq(cmd, SPC_ASC_INVALID_CDB, 0x00);
   1499 		trans_send_complete(cmd, STATUS_CHECK);
   1500 		return;
   1501 	}
   1502 
   1503 	if ((addr + cnt) > d->d_size) {
   1504 
   1505 		if (addr > d->d_size)
   1506 			err_blkno = addr;
   1507 		else
   1508 			err_blkno = d->d_size;
   1509 
   1510 		if (err_blkno > FIXED_SENSE_ADDL_INFO_LEN)
   1511 			addl_sense_len = INFORMATION_SENSE_DESCR;
   1512 		else
   1513 			addl_sense_len = 0;
   1514 
   1515 		spc_sense_create(cmd, KEY_ILLEGAL_REQUEST, addl_sense_len);
   1516 		spc_sense_info(cmd, err_blkno);
   1517 		spc_sense_ascq(cmd, SPC_ASC_BLOCK_RANGE, SPC_ASCQ_BLOCK_RANGE);
   1518 		trans_send_complete(cmd, STATUS_CHECK);
   1519 
   1520 		queue_prt(mgmtq, Q_STE_ERRS,
   1521 		    "SBC%x  LUN%d WRITE Illegal sector "
   1522 		    "(0x%llx + 0x%x) > 0x%ullx\n",
   1523 		    cmd->c_lu->l_targ->s_targ_num, cmd->c_lu->l_common->l_num,
   1524 		    addr, cnt, d->d_size);
   1525 		return;
   1526 	}
   1527 
   1528 	if (bytchk == False) {
   1529 		/*
   1530 		 * With Byte Check being false all we need to do
   1531 		 * is make sure that we can read the data off of the
   1532 		 * media.
   1533 		 */
   1534 		chk_size = 1024 * 1024;
   1535 		if ((chk_block = malloc(chk_size)) == NULL) {
   1536 			trans_send_complete(cmd, STATUS_BUSY);
   1537 			return;
   1538 		}
   1539 		while (cnt) {
   1540 			sz = MIN(chk_size, cnt * 512);
   1541 			/*
   1542 			 * Even if the device is mmap'd in use pread. This
   1543 			 * way we know directly if a read of the data has
   1544 			 * failed.
   1545 			 */
   1546 			if (pread(cmd->c_lu->l_common->l_fd, chk_block, sz,
   1547 			    addr * 512LL) != sz) {
   1548 				spc_sense_create(cmd, KEY_MEDIUM_ERROR, 0);
   1549 				spc_sense_ascq(cmd, SPC_ASC_DATA_PATH,
   1550 				    SPC_ASCQ_DATA_PATH);
   1551 				trans_send_complete(cmd, STATUS_CHECK);
   1552 				free(chk_block);
   1553 				return;
   1554 			}
   1555 			addr += sz / 512LL;
   1556 			cnt -= sz / 512;
   1557 		}
   1558 		free(chk_block);
   1559 		trans_send_complete(cmd, STATUS_GOOD);
   1560 	} else {
   1561 
   1562 		io = cmd->c_emul_id;
   1563 		if (io == NULL) {
   1564 			io			= sbc_io_alloc(cmd);
   1565 			io->da_lba		= addr;
   1566 			io->da_lba_cnt		= cnt;
   1567 			io->da_clear_overlap	= False;
   1568 			io->da_aio.a_aio_cmplt	= sbc_write_cmplt;
   1569 			io->da_aio.a_id		= io;
   1570 		}
   1571 
   1572 		sz = cmd->c_lu->l_targ->s_maxout;
   1573 		io->da_data_alloc = True;
   1574 		io->da_data_len = sz ? MIN(sz, (cnt * 512) - io->da_offset) :
   1575 		    (cnt * 512);
   1576 
   1577 		/*
   1578 		 * Since we're going to just check the data we don't wish
   1579 		 * to possibly change the on disk data. Therefore, even if
   1580 		 * the backing store is mmap'd in we allocate space for the
   1581 		 * data out buffer.
   1582 		 */
   1583 		if ((io->da_data = malloc(io->da_data_len)) == NULL) {
   1584 			trans_send_complete(cmd, STATUS_BUSY);
   1585 			return;
   1586 		}
   1587 
   1588 		if (trans_rqst_dataout(cmd, io->da_data, io->da_data_len,
   1589 		    io->da_offset, io, sbc_io_free) == False)
   1590 			trans_send_complete(cmd, STATUS_BUSY);
   1591 	}
   1592 }
   1593 
   1594 /*ARGSUSED*/
   1595 static void
   1596 sbc_verify_data(t10_cmd_t *cmd, emul_handle_t id, size_t offset, char *data,
   1597     size_t data_len)
   1598 {
   1599 	disk_io_t	*io = (disk_io_t *)id;
   1600 	char		*on_disk_buf;
   1601 
   1602 	if ((on_disk_buf = malloc(io->da_data_len)) == NULL) {
   1603 		trans_send_complete(cmd, STATUS_BUSY);
   1604 	}
   1605 
   1606 	if (pread(cmd->c_lu->l_common->l_fd, on_disk_buf, io->da_data_len,
   1607 	    io->da_offset + (io->da_lba * 512LL)) != io->da_data_len) {
   1608 		spc_sense_create(cmd, KEY_MISCOMPARE, 0);
   1609 		spc_sense_ascq(cmd, SPC_ASC_DATA_PATH, SPC_ASCQ_DATA_PATH);
   1610 		trans_send_complete(cmd, STATUS_CHECK);
   1611 		free(on_disk_buf);
   1612 		sbc_io_free(io);
   1613 		return;
   1614 	}
   1615 	if (bcmp(on_disk_buf, io->da_data, io->da_data_len) != 0) {
   1616 		spc_sense_create(cmd, KEY_MISCOMPARE, 0);
   1617 		spc_sense_ascq(cmd, SPC_ASC_MISCOMPARE, SPC_ASCQ_MISCOMPARE);
   1618 		trans_send_complete(cmd, STATUS_CHECK);
   1619 		free(on_disk_buf);
   1620 		sbc_io_free(io);
   1621 		return;
   1622 	}
   1623 	free(on_disk_buf);
   1624 	io->da_offset += io->da_data_len;
   1625 	if (io->da_offset < (io->da_lba_cnt * 512)) {
   1626 		if (io->da_data_alloc == True) {
   1627 			io->da_data_alloc = False;
   1628 			free(io->da_data);
   1629 		}
   1630 		sbc_verify(cmd, cmd->c_cdb, cmd->c_cdb_len);
   1631 		return;
   1632 	}
   1633 	trans_send_complete(cmd, STATUS_GOOD);
   1634 }
   1635 
   1636 /*
   1637  * []------------------------------------------------------------------[]
   1638  * | Support related functions for SBC-2				|
   1639  * []------------------------------------------------------------------[]
   1640  */
   1641 
   1642 /*
   1643  * []----
   1644  * | sense_page3 -- Create page3 sense code for Disk.
   1645  * |
   1646  * | This is a separate routine because this is called in two different
   1647  * | locations.
   1648  * []----
   1649  */
   1650 static char *
   1651 sense_page3(disk_params_t *d, char *buf, uint8_t pc)
   1652 {
   1653 	struct mode_format		mode_fmt;
   1654 
   1655 	bzero(&mode_fmt, sizeof (mode_fmt));
   1656 
   1657 	/* Page code and page length are always set */
   1658 	mode_fmt.mode_page.code		= MODE_SENSE_PAGE3_CODE;
   1659 	mode_fmt.mode_page.length	= sizeof (struct mode_format) -
   1660 	    sizeof (struct mode_page);
   1661 
   1662 	/*
   1663 	 * No modifiable values so we report all zeros for
   1664 	 * SPC_PC_MODIFIABLE_VALUES and all other page control values
   1665 	 * result in the same values as SPC_PC_CURRENT_VALUES.
   1666 	 */
   1667 	switch (pc) {
   1668 	case SPC_PC_MODIFIABLE_VALUES:
   1669 		/* Leave it blank */
   1670 		break;
   1671 	case SPC_PC_CURRENT_VALUES:
   1672 	case SPC_PC_DEFAULT_VALUES:
   1673 	case SPC_PC_SAVED_VALUES:
   1674 		mode_fmt.data_bytes_sect	= htons(d->d_bytes_sect);
   1675 		mode_fmt.sect_track		= htons(d->d_spt);
   1676 		mode_fmt.interleave		= htons(d->d_interleave);
   1677 		break;
   1678 	}
   1679 
   1680 	bcopy(&mode_fmt, buf, sizeof (mode_fmt));
   1681 
   1682 	return (buf + sizeof (mode_fmt));
   1683 }
   1684 
   1685 /*
   1686  * []----
   1687  * | sense_page4 -- Create page4 sense code for Disk.
   1688  * |
   1689  * | This is a separate routine because this is called in two different
   1690  * | locations.
   1691  * []----
   1692  */
   1693 static char *
   1694 sense_page4(disk_params_t *d, char *buf, uint8_t pc)
   1695 {
   1696 	struct mode_geometry	mode_geom;
   1697 
   1698 	bzero(&mode_geom, sizeof (mode_geom));
   1699 
   1700 	/* Page code and page length are always set */
   1701 	mode_geom.mode_page.code	= MODE_SENSE_PAGE4_CODE;
   1702 	mode_geom.mode_page.length	=
   1703 	    sizeof (struct mode_geometry) - sizeof (struct mode_page);
   1704 
   1705 	/*
   1706 	 * No modifiable values so we report all zeros for
   1707 	 * SPC_PC_MODIFIABLE_VALUES and all other page control values
   1708 	 * result in the same values as SPC_PC_CURRENT_VALUES.
   1709 	 */
   1710 	switch (pc) {
   1711 	case SPC_PC_MODIFIABLE_VALUES:
   1712 		/* Leave it blank */
   1713 		break;
   1714 	case SPC_PC_CURRENT_VALUES:
   1715 	case SPC_PC_DEFAULT_VALUES:
   1716 	case SPC_PC_SAVED_VALUES:
   1717 		mode_geom.heads			= d->d_heads;
   1718 		mode_geom.cyl_ub		= d->d_cyl >> 16;
   1719 		mode_geom.cyl_mb		= d->d_cyl >> 8;
   1720 		mode_geom.cyl_lb		= d->d_cyl;
   1721 		mode_geom.rpm			= htons(d->d_rpm);
   1722 		break;
   1723 	}
   1724 
   1725 	bcopy(&mode_geom, buf, sizeof (mode_geom));
   1726 
   1727 	return (buf + sizeof (mode_geom));
   1728 }
   1729 
   1730 static char *
   1731 sense_cache(disk_params_t *d, char *buf, uint8_t pc)
   1732 {
   1733 	struct mode_cache_scsi3		mode_cache;
   1734 
   1735 	bzero(&mode_cache, sizeof (mode_cache));
   1736 
   1737 	/* Page code and page length are always set */
   1738 	mode_cache.mode_page.code	= MODE_SENSE_CACHE;
   1739 	mode_cache.mode_page.length	= sizeof (mode_cache) -
   1740 	    sizeof (struct mode_page);
   1741 
   1742 	/*
   1743 	 * No modifiable values so we report all zeros for
   1744 	 * SPC_PC_MODIFIABLE_VALUES and all other page control values
   1745 	 * result in the same values as SPC_PC_CURRENT_VALUES.
   1746 	 *
   1747 	 * Technically wce is modifiable but not by using a mode
   1748 	 * select command.
   1749 	 */
   1750 	switch (pc) {
   1751 	case SPC_PC_MODIFIABLE_VALUES:
   1752 		/* Leave it blank */
   1753 		break;
   1754 	case SPC_PC_CURRENT_VALUES:
   1755 	case SPC_PC_DEFAULT_VALUES:
   1756 	case SPC_PC_SAVED_VALUES:
   1757 		mode_cache.wce = d->d_fast_write == True ? 1 : 0;
   1758 		break;
   1759 	}
   1760 
   1761 	bcopy(&mode_cache, buf, sizeof (mode_cache));
   1762 
   1763 	return (buf + sizeof (mode_cache));
   1764 }
   1765 
   1766 /*
   1767  * []----
   1768  * | sense_mode_control -- Create mode control page for disk
   1769  * []----
   1770  */
   1771 static char *
   1772 sense_mode_control(t10_lu_impl_t *lu, char *buf, uint8_t pc)
   1773 {
   1774 	struct mode_control_scsi3	m;
   1775 
   1776 	bzero(&m, sizeof (m));
   1777 
   1778 	/* Page code and page length are always set */
   1779 	m.mode_page.code	= MODE_SENSE_CONTROL;
   1780 	m.mode_page.length	= sizeof (struct mode_control_scsi3) -
   1781 	    sizeof (struct mode_page);
   1782 
   1783 	/*
   1784 	 * D_SENSE is modifiable so we need to reflect this in the
   1785 	 * SPC_PC_MODIFIABLE_VALUES page as well as report the default
   1786 	 * value of '0' in SPC_PC_DEFAULT_VALUES.
   1787 	 */
   1788 	switch (pc) {
   1789 	case SPC_PC_MODIFIABLE_VALUES:
   1790 		m.d_sense	= 1; /* Modifiable */
   1791 		break;
   1792 	case SPC_PC_DEFAULT_VALUES:
   1793 		m.d_sense	= 0; /* Default is disabled */
   1794 		m.que_mod	= SPC_QUEUE_UNRESTRICTED;
   1795 		break;
   1796 	case SPC_PC_CURRENT_VALUES:
   1797 	case SPC_PC_SAVED_VALUES:
   1798 		m.d_sense	= (lu->l_dsense_enabled == True) ? 1 : 0;
   1799 		m.que_mod	= SPC_QUEUE_UNRESTRICTED;
   1800 		break;
   1801 	}
   1802 
   1803 	bcopy(&m, buf, sizeof (m));
   1804 
   1805 	return (buf + sizeof (m));
   1806 }
   1807 
   1808 /*
   1809  * []----
   1810  * | sense_info_ctrl -- Create mode information control page
   1811  * []----
   1812  */
   1813 static char *
   1814 sense_info_ctrl(char *buf, uint8_t pc)
   1815 {
   1816 	struct mode_info_ctrl	info;
   1817 
   1818 	bzero(&info, sizeof (info));
   1819 
   1820 	/* Page code and page length are always set */
   1821 	info.mode_page.code	= MODE_SENSE_INFO_CTRL;
   1822 	info.mode_page.length	= sizeof (struct mode_info_ctrl) -
   1823 	    sizeof (struct mode_page);
   1824 
   1825 	/*
   1826 	 * No modifiable values so we report all zeros for
   1827 	 * SPC_PC_MODIFIABLE_VALUES and all other page control values
   1828 	 * result in the same values as SPC_PC_CURRENT_VALUES.
   1829 	 */
   1830 	switch (pc) {
   1831 	case SPC_PC_MODIFIABLE_VALUES:
   1832 		/* Leave it blank */
   1833 		break;
   1834 	case SPC_PC_CURRENT_VALUES:
   1835 	case SPC_PC_DEFAULT_VALUES:
   1836 	case SPC_PC_SAVED_VALUES:
   1837 		break;
   1838 	}
   1839 
   1840 	bcopy(&info, buf, sizeof (info));
   1841 
   1842 	return (buf + sizeof (info));
   1843 }
   1844 
   1845 /*
   1846  * []----
   1847  * | sbc_io_alloc -- return a disk_io_t structure
   1848  * |
   1849  * | If the call to calloc fails we use the structure that was allocate
   1850  * | during the initial common initialization call. This will allow the
   1851  * | daemon to at least make progress.
   1852  * []----
   1853  */
   1854 static disk_io_t *
   1855 sbc_io_alloc(t10_cmd_t *c)
   1856 {
   1857 	disk_io_t	*io;
   1858 	disk_params_t	*d = T10_PARAMS_AREA(c);
   1859 
   1860 	if ((io = (disk_io_t *)calloc(1, sizeof (*io))) == NULL) {
   1861 		(void) pthread_mutex_lock(&d->d_mutex);
   1862 		if (d->d_io_used == True) {
   1863 			d->d_io_need = True;
   1864 			while (d->d_io_used == True)
   1865 			(void) pthread_cond_wait(&d->d_io_cond, &d->d_mutex);
   1866 			d->d_io_need = False;
   1867 		}
   1868 		d->d_io_used	= True;
   1869 		io		= d->d_io_reserved;
   1870 		(void) pthread_mutex_unlock(&d->d_mutex);
   1871 	}
   1872 
   1873 	io->da_cmd	= c;
   1874 	io->da_params	= d;
   1875 	/* Enable detecting a change in state of the aio operation */
   1876 	io->da_aio.a_aio.aio_return = AIO_INPROGRESS;
   1877 	/*
   1878 	 * Save the io pointer in the t10 cmd now rather than later. It's
   1879 	 * needed during session shutdown processing to find the aio results
   1880 	 * for determining if libaio has canceled the cmd, in which case
   1881 	 * the cmd needs to be freed.
   1882 	 */
   1883 	c->c_emul_id	= io;
   1884 
   1885 	return (io);
   1886 }
   1887 
   1888 /*
   1889  * []----
   1890  * | sbc_io_free -- free local i/o buffers when transport is finished
   1891  * |
   1892  * | If the io structure being free is the preallocated buffer see if
   1893  * | anyone is waiting for the buffer. If so, wake them up.
   1894  * []----
   1895  */
   1896 static void
   1897 sbc_io_free(emul_handle_t e)
   1898 {
   1899 	disk_io_t	*io = (disk_io_t *)e;
   1900 
   1901 	if (io->da_clear_overlap == True)
   1902 		sbc_overlap_free(io);
   1903 
   1904 	if (io->da_data_alloc == True)
   1905 		free(io->da_data);
   1906 
   1907 	if (io == io->da_params->d_io_reserved) {
   1908 		(void) pthread_mutex_lock(&io->da_params->d_mutex);
   1909 		io->da_params->d_io_used = False;
   1910 		if (io->da_params->d_io_need == True)
   1911 			(void) pthread_cond_signal(&io->da_params->d_io_cond);
   1912 			(void) pthread_mutex_unlock(&io->da_params->d_mutex);
   1913 	} else {
   1914 		free(io);
   1915 	}
   1916 }
   1917 
   1918 static int
   1919 sbc_mmap_overlap(const void *v1, const void *v2)
   1920 {
   1921 	disk_io_t	*d1	= (disk_io_t *)v1;
   1922 	disk_io_t	*d2	= (disk_io_t *)v2;
   1923 
   1924 	if ((d1->da_data + d1->da_data_len) < d2->da_data)
   1925 		return (-1);
   1926 	if (d1->da_data > (d2->da_data + d2->da_data_len))
   1927 		return (1);
   1928 	return (0);
   1929 }
   1930 
   1931 static void
   1932 sbc_overlap_store(disk_io_t *io)
   1933 {
   1934 	disk_params_t	*d	= io->da_params;
   1935 	avl_index_t	where	= 0;
   1936 
   1937 	assert(d != NULL);
   1938 
   1939 	(void) pthread_mutex_lock(&d->d_mutex);
   1940 	(void) avl_find(&d->d_mmap_overlaps, (void *)io, &where);
   1941 	avl_insert(&d->d_mmap_overlaps, (void *)io, where);
   1942 	(void) pthread_mutex_unlock(&d->d_mutex);
   1943 }
   1944 
   1945 static void
   1946 sbc_overlap_free(disk_io_t *io)
   1947 {
   1948 	disk_params_t	*d = io->da_params;
   1949 
   1950 	assert(d != NULL);
   1951 
   1952 	(void) pthread_mutex_lock(&d->d_mutex);
   1953 	avl_remove(&d->d_mmap_overlaps, (void *)io);
   1954 	if (d->d_mmap_paused == True) {
   1955 		d->d_mmap_paused = False;
   1956 		(void) pthread_cond_signal(&d->d_mmap_cond);
   1957 	}
   1958 	(void) pthread_mutex_unlock(&d->d_mutex);
   1959 }
   1960 
   1961 static void
   1962 sbc_overlap_check(disk_io_t *io)
   1963 {
   1964 	disk_params_t	*d = io->da_params;
   1965 
   1966 	assert(d != NULL);
   1967 recheck:
   1968 	(void) pthread_mutex_lock(&d->d_mutex);
   1969 	if (avl_find(&d->d_mmap_overlaps, (void *)io, NULL) != NULL) {
   1970 		d->d_mmap_paused = True;
   1971 		while (d->d_mmap_paused == True)
   1972 			(void) pthread_cond_wait(&d->d_mmap_cond,
   1973 			    &d->d_mutex);
   1974 
   1975 		/*
   1976 		 * After waiting on the condition variable the link
   1977 		 * list has changed because someone removed a command.
   1978 		 * So, drop the lock and reexamine the list.
   1979 		 */
   1980 		(void) pthread_mutex_unlock(&d->d_mutex);
   1981 		goto recheck;
   1982 	}
   1983 	(void) pthread_mutex_unlock(&d->d_mutex);
   1984 }
   1985 
   1986 /*
   1987  * []----
   1988  * | sbc_overlap_flush -- wait until everyone has reported in
   1989  * []----
   1990  */
   1991 static void
   1992 sbc_overlap_flush(disk_params_t *d)
   1993 {
   1994 	assert(d != NULL);
   1995 recheck:
   1996 	(void) pthread_mutex_lock(&d->d_mutex);
   1997 	if (avl_numnodes(&d->d_mmap_overlaps) != 0) {
   1998 		d->d_mmap_paused = True;
   1999 		while (d->d_mmap_paused == True)
   2000 			(void) pthread_cond_wait(&d->d_mmap_cond,
   2001 			    &d->d_mutex);
   2002 
   2003 		/*
   2004 		 * After waiting on the condition variable the link
   2005 		 * list has changed because someone removed a command.
   2006 		 * So, drop the lock and reexamine the list.
   2007 		 */
   2008 		(void) pthread_mutex_unlock(&d->d_mutex);
   2009 		goto recheck;
   2010 	}
   2011 	(void) pthread_mutex_unlock(&d->d_mutex);
   2012 }
   2013 
   2014 /*
   2015  * []----
   2016  * | Command table for LBA emulation. This is at the end of the file because
   2017  * | it's big and ugly. ;-) To make for fast translation to the appropriate
   2018  * | emulation routine we just have a big command table with all 256 possible
   2019  * | entries. Most will report STATUS_CHECK, unsupport operation. By doing
   2020  * | this we can avoid error checking for command range.
   2021  * []----
   2022  */
   2023 static scsi_cmd_table_t lba_table[] = {
   2024 	/* 0x00 -- 0x0f */
   2025 	{ spc_tur,		NULL,	NULL,		"TEST_UNIT_READY" },
   2026 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2027 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2028 	{ spc_request_sense,	NULL,	NULL,		"REQUEST_SENSE" },
   2029 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2030 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2031 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2032 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2033 	{ sbc_read, NULL, sbc_read_cmplt,		"READ" },
   2034 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2035 	{ sbc_write, sbc_write_data, sbc_write_cmplt,	"WRITE" },
   2036 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2037 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2038 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2039 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2040 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2041 
   2042 	/* 0x10 -- 0x1f */
   2043 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2044 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2045 	{ spc_inquiry, NULL, NULL,			"INQUIRY" },
   2046 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2047 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2048 	{ spc_mselect, spc_mselect_data, NULL,		"MODE_SELECT" },
   2049 	{ spc_cmd_reserve6,	NULL,	NULL,		"RESERVE(6)" },
   2050 	{ spc_cmd_release6,	NULL,	NULL,		"RELEASE(6)" },
   2051 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2052 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2053 	{ sbc_msense,		NULL,	NULL,		"MODE_SENSE" },
   2054 	{ sbc_startstop,	NULL,	NULL,		"START_STOP" },
   2055 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2056 	{ spc_send_diag,	NULL,	NULL,		"SEND_DIAG" },
   2057 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2058 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2059 
   2060 	/* 0x20 -- 0x2f */
   2061 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2062 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2063 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2064 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2065 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2066 	{ sbc_recap,		NULL,	NULL,		"READ_CAPACITY" },
   2067 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2068 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2069 	{ sbc_read, NULL, sbc_read_cmplt,		"READ_G1" },
   2070 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2071 	{ sbc_write, sbc_write_data, sbc_write_cmplt,	"WRITE_G1" },
   2072 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2073 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2074 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2075 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2076 	{ sbc_verify,	sbc_verify_data,	NULL,	"VERIFY_G1" },
   2077 
   2078 	/* 0x30 -- 0x3f */
   2079 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2080 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2081 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2082 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2083 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2084 	{ sbc_synccache,	NULL,	NULL,		"SYNC_CACHE" },
   2085 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2086 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2087 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2088 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2089 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2090 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2091 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2092 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2093 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2094 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2095 
   2096 	/* 0x40 -- 0x4f */
   2097 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2098 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2099 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2100 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2101 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2102 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2103 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2104 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2105 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2106 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2107 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2108 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2109 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2110 	{ spc_unsupported,	NULL,	NULL,	"LOG_SENSE" },
   2111 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2112 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2113 
   2114 	/* 0x50 -- 0x5f */
   2115 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2116 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2117 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2118 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2119 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2120 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2121 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2122 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2123 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2124 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2125 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2126 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2127 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2128 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2129 	{ spc_cmd_pr_in,	NULL,	NULL,	"PERSISTENT_RESERVE_IN" },
   2130 	{ spc_cmd_pr_out, spc_cmd_pr_out_data, NULL, "PERSISTENT_RESERVE_OUT" },
   2131 
   2132 	/* 0x60 -- 0x6f */
   2133 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2134 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2135 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2136 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2137 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2138 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2139 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2140 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2141 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2142 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2143 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2144 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2145 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2146 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2147 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2148 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2149 
   2150 	/* 0x70 -- 0x7f */
   2151 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2152 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2153 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2154 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2155 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2156 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2157 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2158 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2159 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2160 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2161 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2162 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2163 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2164 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2165 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2166 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2167 
   2168 	/* 0x80 -- 0x8f */
   2169 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2170 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2171 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2172 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2173 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2174 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2175 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2176 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2177 	{ sbc_read, NULL, sbc_read_cmplt,		"READ_G4" },
   2178 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2179 	{ sbc_write, sbc_write_data, sbc_write_cmplt,	"WRITE_G4" },
   2180 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2181 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2182 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2183 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2184 	{ sbc_verify,	sbc_verify_data,	NULL,	"VERIFY_G4" },
   2185 
   2186 	/* 0x90 -- 0x9f */
   2187 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2188 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2189 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2190 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2191 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2192 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2193 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2194 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2195 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2196 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2197 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2198 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2199 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2200 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2201 	{ sbc_service_actiong4,	NULL,	NULL,		"SVC_ACTION_G4" },
   2202 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2203 
   2204 	/* 0xa0 - 0xaf */
   2205 	{ spc_report_luns,	NULL,	NULL,		"REPORT_LUNS" },
   2206 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2207 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2208 	{ spc_report_tpgs,	NULL,	NULL,		"REPORT_TPGS" },
   2209 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2210 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2211 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2212 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2213 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2214 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2215 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2216 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2217 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2218 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2219 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2220 	{ sbc_verify,	sbc_verify_data,	NULL,	"VERIFY_G5" },
   2221 
   2222 	/* 0xb0 -- 0xbf */
   2223 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2224 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2225 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2226 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2227 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2228 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2229 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2230 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2231 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2232 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2233 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2234 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2235 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2236 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2237 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2238 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2239 
   2240 	/* 0xc0 -- 0xcf */
   2241 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2242 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2243 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2244 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2245 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2246 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2247 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2248 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2249 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2250 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2251 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2252 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2253 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2254 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2255 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2256 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2257 
   2258 	/* 0xd0 -- 0xdf */
   2259 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2260 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2261 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2262 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2263 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2264 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2265 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2266 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2267 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2268 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2269 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2270 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2271 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2272 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2273 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2274 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2275 
   2276 	/* 0xe0 -- 0xef */
   2277 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2278 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2279 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2280 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2281 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2282 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2283 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2284 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2285 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2286 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2287 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2288 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2289 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2290 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2291 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2292 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2293 
   2294 	/* 0xf0 -- 0xff */
   2295 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2296 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2297 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2298 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2299 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2300 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2301 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2302 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2303 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2304 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2305 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2306 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2307 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2308 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2309 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2310 	{ spc_unsupported,	NULL,	NULL,	NULL },
   2311 };
   2312