Writing Device Drivers

Chapter 13 SCSI Target Drivers

This chapter describes how to write a SCSI target driver using the interfaces provided by the Sun Common SCSI Architecture (SCSA). Overviews of SCSI and SCSA are presented, followed by the details of implementing a target driver.

Note -

For information on SCSI HBA drivers, see Chapter 14, SCSI Host Bus Adapter Drivers.

SCSI Target Driver Overview

The Solaris DDI/DKI divides the software interface to SCSI devices into two major parts: target drivers and host bus adapter (HBA) drivers. Target refers to a driver for a device on a SCSI bus, such as a disk or a tape drive. host bus adapter refers to the driver for the SCSI controller on the host machine, such as the "esp" driver on a SPARCstation. SCSA defines the interface between these two components. This chapter discusses target drivers only. See Chapter 14, SCSI Host Bus Adapter Drivers for information on host bus adapter drivers.

Note -

The terms "host bus adapter" or "HBA" used in this manual are equivalent to the phrase "host adapter" defined in SCSI specifications.

Target drivers can be either character or block device drivers, depending on the device. Drivers for tape drives are usually character device drivers, while disks are handled by block device drivers. This chapter describes how to write a SCSI target driver and discusses the additional requirements that SCSA places on block and character drivers for SCSI target devices.

Reference Documents

The following reference documents provide supplemental information needed by the designers of target drivers and host bus adapter drivers.

Small Computer System Interface (SCSI) Standard, ANSI X3.131-1986 American National Standards Institute Sales Department 1430 Broadway, New York, NY 10018 Phone 212 642-4900

Small Computer System Interface 2 (SCSI-2) Standard, document X3.131-1994 Global Engineering Documents 15 Inverness Way, East Englewood, CO 80112-5704 Phone: 800 854-7179 or 303 792-2181 FAX: 303 792-2192

Basics of SCSI ANCOT Corporation Menlo Park, California 94025 Phone 415 322-5322 FAX: 415 322-0455

Also refer to the SCSI command specification for the target device, provided by the hardware vendor.

For a pointer to SCSI driver sample code, see Appendix D, Sample Driver Source Code . For information on setting global SCSI options, see Appendix G, Advanced Topics.

Sun Common SCSI Architecture Overview

The Sun Common SCSI Architecture (SCSA) is the Solaris 2.7 SPARC DDI/DKI programming interface for the transmission of SCSI commands from a target driver to a host bus adapter driver. This interface is independent of the type of host bus adapter hardware, the platform, the processor architecture, and the SCSI command being transported across the interface.

By conforming to the SCSA, the target driver can pass any SCSI command to a target device without knowledge of the hardware implementation of the host bus adapter.

The SCSA conceptually separates building the SCSI command (by the target driver) from transporting the SCSI command and data across the SCSI bus. The architecture defines the software interface between high-level and low-level software components. The higher-level software component consists of one or more SCSI target drivers, which translate I/O requests into SCSI commands appropriate for the peripheral device. Figure 13-1 illustrates the SCSI architecture.

Figure 13-1 SCSA Block Diagram


The lower-level software component consists of a SCSA interface layer and one or more host bus adapter drivers. The host bus adapter driver has several responsibilities. It must:

See Chapter 14, SCSI Host Bus Adapter Driversfor more information.

The target driver is completely responsible for the generation of the proper SCSI commands required to execute the desired function.

General Flow of Control

Before transferring data, ensure that the disk is spun up. When transferring data to or from a user address space (using the read(9E) or write(9E) entry points), SCSI target character device drivers must use physio(9F), which locks down memory, prepares a buf(9S) structure, and calls the driver's strategy(9E) routine.

physio(9F) locks down the user buffer into memory before issuing a SCSI command. The file system locks down memory for block device drivers. See Chapter 9, "Drivers for Block Devices", for more information on writing a strategy(9E) entry point and Chapter 8, "Drivers for Character Devices", for more information on using physio(9F).

Assuming no transport errors occur, the following steps describe the general flow of control for a read or write request, starting from the call to the target driver's strategy routine.

  1. The target driver's strategy(9E) routine checks the request and allocates a scsi_pkt(9S) using scsi_init_pkt(9F). The target driver initializes the packet and sets the SCSI command descriptor block (CDB) using the scsi_setup_cbd(9F) function. The target driver also specifies a timeout and provides a pointer to a callback function, which is called by the host bus adapter driver on completion of the command. The buf(9S) pointer should be saved in the SCSI packet's target-private space.

  2. The target driver submits the packet to the host bus adapter driver using scsi_transport(9F). The target driver is then free to accept other requests. The target driver should not access the packet while it is in transport. If either the host bus adapter driver or the target supports queueing, new requests can be submitted while the packet is in transport.

  3. As soon as the SCSI bus is free and the target not busy, the host bus adapter driver selects the target and passes the CDB. The target executes the command and performs the requested data transfers. The target controls the SCSI bus phase transitions. The host bus adapter just responds to these transitions until the command is completed.

  4. After the target sends completion status and disconnects, the host bus adapter driver notifies the target driver by calling the completion function that was specified in the SCSI packet. At this time the host bus adapter driver is no longer responsible for the packet, and the target driver has regained ownership of the packet.

  5. The SCSI packet's completion routine analyzes the returned information and determines whether the SCSI operation was successful. If a failure has occurred, the target driver may retry the command by calling scsi_transport(9F) again. If the host bus adapter driver does not support auto request sense, the target driver must submit a request sense packet to retrieve the sense data in the event of a check condition.

  6. If either the command was completed successfully or cannot be retried, the target driver calls scsi_destroy_pkt(9F), which synchronizes the data and frees the packet. If the target driver needs to access the data before freeing the packet, it calls scsi_sync_pkt(9F).

  7. Finally, the target driver notifies the application program that originally requested the read or write that the transaction is complete, either by returning from the read(9E) entry point in the driver (for a character device) or indirectly through biodone(9F).

The SCSA allows the execution of many of such operations, both overlapped and queued at various points in the process. The model places the management of system resources on the host bus adapter driver. The software interface enables the execution of target driver functions on host bus adapter drivers using SCSI bus adapters of varying degrees of intelligence.

SCSA Functions

SCSA defines functions to manage the allocation and freeing of resources, the sensing and setting of control states, and the transport of SCSI commands. These functions listed in Table 13-1.

Table 13-1 Standard SCSA Functions

Function Name  



Resource management 












Command transport 


Transport information and control 




Error handling 




Polled I/O 


Probe functions 




CDB initialization function 

Note that if a driver needs to work with a SCSI-1 device, it should use the makecom(9F) functions listed in Table 13-2.

SCSA Compatibility Functions

The functions listed in Table 13-2 are maintained for source and binary compatibility with previous releases. However, new drivers should use the new functions listed in Table 13-1.

Table 13-2 SCSA Compatibility Functions

Function Name 



Resource management 














Probe functions 




CDB initialization functions 




SCSI Target Drivers

Hardware Configuration File

Because SCSI devices are not self-identifying, a hardware configuration file is required for a target driver (see driver.conf(4) and scsi(4) for details). A typical configuration file looks like this:

	name="xx" class="scsi" target=2 lun=0;

The system reads the file during autoconfiguration and uses the class property to identify the driver's possible parent. The system then attempts to attach the driver to any parent driver that is of class scsi. All host bus adapter drivers are of this class. Using the class property rather than the parent property enables the target driver to be attached to any host bus adapter driver that finds the expected device at the specified target and lun ids. The target driver is responsible for verifying this in its probe(9E) routine.

Declarations and Data Structures

Target drivers must include the header file <sys/scsi/scsi.h>.

SCSI target drivers must also include this declaration:

	char _depends_on[] = "misc/scsi";

scsi_device Structure

The host bus adapter driver allocates and initializes a scsi_device(9S) structure for the target driver before either the probe(9E) or attach(9E) routine is called. This structure stores information about each SCSI logical unit, including pointers to information areas that contain both generic and device- specific information. There is one scsi_device(9S) structure for each logical unit attached to the system. The target driver can retrieve a pointer to this structure by calling ddi_get_driver_private(9F).

Caution - Caution -

Because the host bus adapter driver uses the private field in the target device's dev_info structure, target drivers should not use ddi_set_driver_private(9F).

The scsi_device(9S) structure contains the following fields:

		struct scsi_address 				sd_address;			
 	dev_info_t								*sd_dev;			
 	kmutex_t									sd_mutex;
 	struct scsi_inquiry					*sd_inq;
 	struct scsi_extended_sense 		*sd_sense;
 	caddr_t									sd_private;						

sd_address is a data structure that is passed to the SCSI resource allocation routines.

sd_dev is a pointer to the target's dev_info structure.

sd_mutex is a mutex for use by the target driver. This is initialized by the host bus adapter driver and can be used by the target driver as a per-device mutex. Do not hold this mutex across a call to scsi_transport(9F) or scsi_poll(9F). See Chapter 4, Multithreading, for more information on mutexes.

sd_inq is a pointer for the target device's SCSI inquiry data. The scsi_probe(9F) routine allocates a buffer, fills it in, and attaches it to this field.

sd_sense is a pointer to a buffer to contain SCSI request sense data from the device. The target driver must allocate and manage this buffer itself; see "attach(9E)".

sd_private is a pointer field for use by the target driver. It is commonly used to store a pointer to a private target driver state structure.

scsi_pkt Structure

This structure contains the following fields:

		struct scsi_address		pkt_address;
 	opaque_t						pkt_private;
 	void							(*pkt_comp)(struct scsi_pkt *pkt);
 	u_int							pkt_flags;
 	int							pkt_time;
 	u_char						*pkt_scbp;
 	u_char						*pkt_cdbp;
 	ssize_t						pkt_resid;
 	u_int							pkt_state;
 	u_int							pkt_statistics;
 	u_char						pkt_reason;

pkt_address is the target device's address set by scsi_init_pkt(9F)

pkt_private is a place to store private data for the target driver. It is commonly used to save the buf(9S) pointer for the command.

pkt_comp is the address of the completion routine. The host bus adapter driver calls this routine when it has transported the command. This does not mean that the command succeeded; the target might have been busy or might not have responded before the time-out time elapsed (see the description for pkt_time field). The target driver must supply a valid value in this field, though it can be NULL if the driver does not want to be notified.

Note -

There are two different SCSI callback routines. The pkt_comp field identifies a completion callback routine, which is called when the host bus adapter completes its processing. There is also a resource callback routine, called when currently unavailable resources are likely to be available (as in scsi_init_pkt(9F)).

pkt_flags provides additional control information, for example, to transport the command without disconnect privileges (FLAG_NODISCON) or to disable callbacks (FLAG_NOINTR). See scsi_pkt(9S) for details.

pkt_time is a time-out value (in seconds). If the command is not completed within this time, the host bus adapter calls the completion routine with pkt_reason set to CMD_TIMEOUT. The target driver should set this field to longer than the maximum time the command might take. If the timeout is zero, no timeout is requested. Timeout starts when the command is transmitted on the SCSI bus.

pkt_scbp is a pointer to the SCSI status completion block; this is filled in by the host bus adapter driver.

pkt_cdbp is a pointer to the SCSI command descriptor block, the actual command to be sent to the target device. The host bus adapter driver does not interpret this field. The target driver must fill it in with a command that the target device can process.

pkt_resid is the residual of the operation. When allocating DMA resources for a command scsi_init_pkt(9F), pkt_resid indicates the number of bytes for which DMA resources could not be allocated because of DMA hardware scatter-gather or other device limitations. After command transport, pkt_resid indicates the number of data bytes not transferred; this is filled in by the host bus adapter driver before the completion routine is called.

pkt_state indicates the state of the command. The host bus adapter driver fills in this field as the command progresses. One bit is set in this field for each of the five following command states:

pkt_statistics contains transport-related statistics set by the host bus adapter driver.

pkt_reason gives the reason the completion routine was called. The main function of the completion routine is to decode this field and take the appropriate action. If the command completed--in other words, if there were no transport errors--this field is set to CMD_CMPLT; other values in this field indicate an error. After a command is completed, the target driver should examine the pkt_scbp field for a check condition status. See scsi_pkt(9S) for more information.

SCSI Additions to the State Structure

This section adds the following fields to the state structure. See "Software State Structure" for more information.

struct scsi_pkt					*rqs;			/* Request Sense packet */
struct buf							*rqsbuf;		/* buf for Request Sense */
struct scsi_pkt					*pkt;			/* packet for current command */
struct scsi_device				*sdp;			/* pointer to device's */
 														/* scsi_device(9S) structure. */

rqs is a pointer to a SCSI request sense command scsi_pkt(9S) structure, allocated in the attach(9E) routine. This packet is preallocated because the request sense command is small and may be used in time-critical areas of the driver (such as when handling errors).


SCSI target drivers must implement the standard autoconfiguration routines _init(9E), _fini(9E), and _info(9E). See Chapter 5, Autoconfiguration, for more information.

probe(9E), attach(9E), and getinfo(9E) are also required, but they must perform SCSI (and SCSA) specific processing.


SCSI target devices are not self-identifying, so target drivers must have a probe(9E) routine. This routine must determine whether the expected type of device is present and responding.

The general structure and return codes of the probe(9E) routine are the same as those of other device drivers. SCSI target drivers must use the scsi_probe(9F) routine in their probe(9E) entry point. scsi_probe(9F) sends a SCSI inquiry command to the device and returns a code indicating the result. If the SCSI inquiry command is successful, scsi_probe(9F) allocates a scsi_inquiry(9S) structure and fills it in with the device's inquiry data. Upon return from scsi_probe(9F), the sd_inq field of the scsi_device(9S) structure points to this scsi_inquiry(9S) structure.

Because probe(9E) must be stateless, the target driver must call scsi_unprobe(9F) before probe(9E) returns, even if scsi_probe(9F) fails.

Example 13-1 shows a typical probe(9E) routine. It retrieves its scsi_device(9S) structure from the private field of its dev_info structure. It also retrieves the device's SCSI target and logical unit numbers so that it can print them in messages. The probe(9E) routine then calls scsi_probe(9F) to verify that the expected device (a printer in this case) is present.

If scsi_probe(9F) succeeds, it has attached the device's SCSI inquiry data in a scsi_inquiry(9S) structure to the sd_inq field of the scsi_device(9S) structure. The driver can then determine if the device type is a printer (reported in the inq_dtype field). If it is, the type is reported with scsi_log(9F), using scsi_dname(9F) to convert the device type into a string.

Example 13-1 SCSI Target Driver probe(9E) Routine

static int
xxprobe(dev_info_t *dip)
	struct scsi_device *sdp;
	int rval, target, lun;
	 * Get a pointer to the scsi_device(9S) structure
	sdp = (struct scsi_device *)ddi_get_driver_private(dip);

	target = sdp->sd_address.a_target;
	lun = sdp->sd_address.a_lun;
	 * Call scsi_probe(9F) to send the Inquiry command. It will
	 * fill in the sd_inq field of the scsi_device structure.
	switch (scsi_probe(sdp, NULL_FUNC)) {
		    * In these cases, device may be powered off,
		    * in which case we may be able to successfully
		    * probe it at some future time - referred to
		    * as `deferred attach'.
	    	rval = DDI_PROBE_PARTIAL;
		     * Device isn't of the type we can deal with,
		     * and/or it will never be usable.
	    	rval = DDI_PROBE_FAILURE;
		     * There is a device at the target/lun address. Check
		     * inq_dtype to make sure that it is the right device
		     * type. See scsi_inquiry(9S)for possible device types.
	    	switch (sdp->sd_inq->inq_dtype) {
		    case DTYPE_PRINTER:
			    scsi_log(sdp, "xx", SCSI_DEBUG,
				   "found %s device at target%d, lun%d\n",
				    target, lun);
			    rval = DDI_PROBE_SUCCESS;
			    rval = DDI_PROBE_FAILURE;
	return (rval);

A more thorough probe(9E) routine could also check other fields of the scsi_inquiry(9S) structure as necessary to make sure that the device is of the type expected by a particular driver.


After the probe(9E) routine has verified that the expected device is present, attach(9E) is called. This routine allocates and initializes any per-instance data, creates minor device node information, and restores the hardware state of a device when the device or the system has been suspended. See "attach()" for details of this. In addition to these steps, a SCSI target driver again calls scsi_probe(9F) to retrieve the device's inquiry data and also creates a SCSI request sense packet. If the attach is successful, the attach function should not call scsi_unprobe(9F).

Three routines are used to create the request sense packet: scsi_alloc_consistent_buf(9F), scsi_init_pkt(9F), and scsi_setup_cdb(9F). scsi_alloc_consistent_buf(9F) allocates a buffer suitable for consistent DMA and returns a pointer to a buf(9S) structure. The advantage of a consistent buffer is that no explicit synchronization of the data is required. In other words, the target driver can access the data after the callback. The sd_sense element of the device's scsi_device(9S) structure must be initialized with the address of the sense buffer. scsi_init_pkt(9F) creates and partially initializes a scsi_pkt(9S) structure. scsi_setup_cdb(9F) creates a SCSI command descriptor block, in this case creating a SCSI request sense command.

Note that since a SCSI device is not self-identifying and does not have a reg property, the driver must set the pm-hardware-state property to inform the framework that this device needs to be suspended and resumed.

Example 13-2 shows the SCSI target driver's attach(9E) routine.

Example 13-2 SCSI Target Driver attach(9E) Routine

static int
xxattach(dev_info_t *dip, ddi_attach_cmd_t cmd)
	struct xxstate					*xsp;
	struct scsi_pkt					*rqpkt = NULL;
	struct scsi_device					*sdp;
	struct buf					*bp = NULL;
	int		instance;
	instance = ddi_get_instance(dip);
	switch (cmd) {
		   case DDI_ATTACH:
	   	case DDI_PM_RESUME:
			  For information, see Chapter 8, Power Management	   	case DDI_RESUME:
			  For information, see Chapter 8, Power Management	   	default:
			  return (DDI_FAILURE);
	allocate a state structure and initialize it
	xsp = ddi_get_soft_state(statep, instance);
	sdp = (struct scsi_device *)ddi_get_driver_private(dip);
	 * Cross-link the state and scsi_device(9S) structures.
	sdp->sd_private = (caddr_t)xsp;
	xsp->sdp = sdp;
	call scsi_probe(9F) again to get and validate inquiry data
	 * Allocate a request sense buffer. The buf(9S) structure
	 * is set to NULL to tell the routine to allocate a new
	 * one. The callback function is set to NULL_FUNC to tell
	 * the routine to return failure immediately if no
	 * resources are available.
	bp = scsi_alloc_consistent_buf(&sdp->sd_address, NULL,
	if (bp == NULL)
	    	goto failed;
	 * Create a Request Sense scsi_pkt(9S) structure.
	rqpkt = scsi_init_pkt(&sdp->sd_address, NULL, bp,
	if (rqpkt == NULL)
	    	goto failed;
	 * scsi_alloc_consistent_buf(9F) returned a buf(9S)
	 * The actual buffer address is in b_un.b_addr.
	sdp->sd_sense = (struct scsi_extended_sense *)bp-
	 * Create a Group0 CDB for the Request Sense command
	if (scsi_setup_cdb((union scsi_cdb *)rqpkt->pkt_cdbp,
	     	goto failed;;
	 * Fill in the rest of the scsi_pkt structure.
	 * xxcallback() is the private command completion routine.
	rqpkt->pkt_comp = xxcallback;
	rqpkt->pkt_time = 30; /* 30 second command timeout */
	rqpkt->pkt_flags |= FLAG_SENSING;
	xsp->rqs = rqpkt;
	xsp->rqsbuf = bp;
	create minor nodes, report device, and do any other initialization
	 * Since the device does not have the 'reg' property,
	 * cpr will not call its DDI_SUSPEND/DDI_RESUME entries.
	 * The following code is to tell cpr that this device
	 * needs to be suspended and resumed.
    (void) ddi_prop_create(device, dip, DDI_PROP_CANSLEEP,
	 	"pm-hardware-state", (caddr_t)"needs-suspend-resume",
		strlen("needs-suspend-resume") + 1);
	xsp->open = 0;
	return (DDI_SUCCESS);
	if (bp)
	if (rqpkt)
	sdp->sd_private = (caddr_t)NULL;
	sdp->sd_sense = NULL;
    free any other resources, such as the state structure
	return (DDI_FAILURE);


The detach(9E) entry point is the inverse of attach(9E); it must free all resources that were allocated in attach(9E). If successful, the detach should call scsi_unprobe(9F). Example 13-3 shows a target driver detach(9E) routine.

Example 13-3 SCSI Target Driver detach(9E) Routine

static int
xxdetach(dev_info_t *dip, ddi_detach_cmd_t cmd)
	struct xxstate *xsp;
	switch (cmd) {
	  	normal detach(9E) operations, such as getting a 
		pointer to the state structure
	  	xsp->sdp->sd_private = (caddr_t)NULL;
	  	xsp->sdp->sd_sense = NULL;
	   	remove minor nodes
	   	free resources, such as the state structure and properties
	   	remove power managed components
 	  	return (DDI_SUCCESS);
	  	For information, see Chapter 8, Power Management	case DDI_PM_SUSPEND:
		For information, see Chapter 8, Power Management	default:
		return (DDI_FAILURE);


The getinfo(9E) routine for SCSI target drivers is much the same as for other drivers; see "getinfo()" for more information on DDI_INFO_DEVT2INSTANCE case. However, in the DDI_INFO_DEVT2DEVINFO case of the getinfo(9E) routine, the target driver must return a pointer to its dev_info node. This pointer can be saved in the driver state structure or can be retrieved from the sd_dev field of the scsi_device(9S) structure. Example 13-4shows an alternative SCSI target driver getinfo(9E) code fragment.

Example 13-4 Alternative SCSI Target Driver getinfo(9E) Code Fragment

		dev = (dev_t)arg;
		instance = getminor(dev);
		xsp = ddi_get_soft_state(statep, instance);
		if (xsp == NULL)
			return (DDI_FAILURE);
		*result = (void *)xsp->sdp->sd_dev;
		return (DDI_SUCCESS);

Resource Allocation

To send a SCSI command to the device, the target driver must create and initialize a scsi_pkt(9S) structure and pass it to the host bus adapter driver.


The scsi_init_pkt(9F) routine allocates and zeros a scsi_pkt(9S) structure; it also sets pointers to pkt_private, *pkt_scbp, and *pkt_cdbp. Additionally, it provides a callback mechanism to handle the case where resources are not available. This structure contains the following fields:

	struct scsi_pkt *scsi_init_pkt(struct scsi_address *ap,
 		struct scsi_pkt *pktp, struct buf *bp, int cmdlen,
 		int statuslen, int privatelen, int flags,
 		int (*callback)(caddr_t), caddr_t arg)

ap is a pointer to a scsi_address structure. This is the sd_address field of the device's scsi_device(9S) structure.

pktp is a pointer to the scsi_pkt(9S) structure to be initialized. If this is set to NULL, a new packet is allocated.

bp is a pointer to a buf(9S) structure. If this is non-NULL and contains a valid byte count, DMA resources are allocated.

cmdlen is the length of the SCSI command descriptor block in bytes.

statuslen is the required length of the SCSI status completion block in bytes.

privatelen is the number of bytes to allocate for the pkt_private field. To store a pointer, specify the size of the pointer here (such as sizeof(struct xxstate *) when storing a pointer to the state structure).

flags is a set of flags. Possible bits include:

callback specifies the action to take if resources are not available. If set to NULL_FUNC, scsi_init_pkt(9F) returns immediately (returning NULL). If set to SLEEP_FUNC, it does not return until resources are available. Any other valid kernel address is interpreted as the address of a function to be called when resources are likely to be available.

arg is the parameter to pass to the callback function.

The scsi_init_pkt(9F) routine synchronizes the data prior to transport. If the driver needs to access the data after transport, the scsi_sync_pkt(9F) routine can be used to synchronize any cached data.

The scsi_destroy_pkt(9F) routine synchronizes any remaining cached data associated with the packet, if necessary, and then frees the packet and associated command, status, and target driver-private data areas. This routine should be called in the command completion routine.

If the target driver needs to resubmit the packet after changing the data, scsi_sync_pkt(9F) must be called before calling scsi_transport(9F). However, if the target driver does not need to access the data, there is no need to call scsi_sync_pkt(9F) after the transport.


For most I/O requests, the data buffer passed to the driver entry points is not accessed directly by the driver, it is just passed on to scsi_init_pkt(9F). If a driver sends SCSI commands that operate on buffers the driver examines itself (such as the SCSI request sense command), the buffers should be DMA consistent. The scsi_alloc_consistent_buf(9F) routine allocates a buf(9S) structure and a data buffer suitable for DMA-consistent operations. The HBA will perform any necessary synchronization of the buffer before performing the command completion callback.

Caution - Caution -

scsi_alloc_consistent_buf(9F) uses scarce system resources; it should be used sparingly.

scsi_free_consistent_buf(9F) releases a buf(9S) structure and the associated data buffer allocated with scsi_alloc_consistent_buf(9F). See "attach(9E)" and "detach(9E)"for examples.

Building and Transporting a Command

The host bus adapter driver is responsible for transmitting the command to the device and handling the low-level SCSI protocol. The scsi_transport(9F) routine hands a packet to the host bus adapter driver for transmission. It is the target driver's responsibility to create a valid scsi_pkt(9S) structure.

Building a Command

The routine scsi_init_pkt(9F) allocates space for a SCSI CDB, allocates DMA resources if necessary, and sets the pkt_flags field:

	pkt = scsi_init_pkt(&sdp->sd_address, NULL, bp,
 		CDB_GROUP0, 1, 0, 0, SLEEP_FUNC, NULL);

This example creates a new packet and allocates DMA resources as specified in the passed buf(9S) structure pointer. A SCSI CDB is allocated for a Group 0 (6-byte) command, the pkt_flags field is set to zero, but no space is allocated for the pkt_private field. This call to scsi_init_pkt(9F), because of the SLEEP_FUNC parameter, waits indefinitely for resources if none are currently available.

The next step is to initialize the SCSI CDB, using the scsi_setup_cdb(9F) function:

	if (scsi_setup_cdb((union scsi_cdb *)pkt->pkt_cdbp,
 		SCMD_READ, bp->b_blkno, bp->b_bcount >> DEV_BSHIFT, 0) == 0)
 		goto failed;

This example builds a Group 0 command descriptor block and fills in the pkt_cdbp field as follows:

Note -

scsi_setup_cdb(9F) does not support setting a target device's logical unit number (LUN) in bits 5-7 of byte 1 of the SCSI command block, as defined by SCSI-1. For SCSI-1 devices requiring the LUN bits set in the command block, use makecom_g0(9F) (or equivalent) rather than scsi_setup_cdb(9F).

After initializing the SCSI CDB, initialize three other fields in the packet and store as a pointer to the packet in the state structure.

	pkt->pkt_private = (opaque_t)bp;
 	pkt->pkt_comp = xxcallback;
 	pkt->pkt_time = 30;
 	xsp->pkt = pkt;

The buf(9S) pointer is saved in the pkt_private field for later use in the completion routine.

Setting Target Capabilities

The target drivers use scsi_ifsetcap(9F) to set the capabilities of the host adapter driver. A cap is a name-value pair whose name is a null terminated character string and whose value is an integer. The current value of a capability can be retrieved using scsi_ifgetcap(9F). scsi_ifsetcap(9F) allows capabilities to be set for all targets on the bus.

In general, however, setting capabilities of targets that are not owned by the target driver is not recommended and is not universally supported by HBA drivers. Some capabilities (such as disconnect and synchronous) may be set by default by the HBA driver but others may need to be explicitly set by the target driver (wide-xfer or tagged-queing, for example).

Transporting a Command

After creating and filling in the scsi_pkt(9S) structure, the final step is to hand it to the host bus adapter driver using scsi_transport(9F):

	if (scsi_transport(pkt) != TRAN_ACCEPT) {
 		bp->b_resid = bp->b_bcount;
 		bioerror(bp, EIO);

The other return values from scsi_transport(9F) are:

Caution - Caution -

The mutex sd_mutex in the scsi_device(9S) structure must not be held across a call to scsi_transport(9F).

If scsi_transport(9F) returns TRAN_ACCEPT, the packet is the responsibility of the host bus adapter driver and should not be accessed by the target driver until the command completion routine is called.

Synchronous scsi_transport(9F)

If FLAG_NOINTR is set in the packet, then scsi_transport(9F) will not return until the command is complete, and no callback will be performed.

Note -

FLAG_NOINTR should never be used in interrupt context.

Command Completion

Once the host bus adapter driver has done all it can with the command, it invokes the packet's completion callback routine, passing a pointer to the scsi_pkt(9S) structure as a parameter. The completion routine decodes the packet and takes the appropriate action.

Example 13-5 presents a very simple completion callback routine. This code checks for transport failures and gives up rather than retry the command. If the target is busy, extra code is required to resubmit the command at a later time.

If the command results in a check condition, the target driver needs to send a request sense command, unless auto request sense has not been enabled.

Note -

Normally, the target driver's callback function is called in interrupt context. Consequently, the callback function should never sleep.

Example 13-5 SCSI Driver Completion Routine

static void
xxcallback(struct scsi_pkt *pkt)
	struct buf				*bp;
	struct xxstate				*xsp;
	minor_t				instance;
	struct scsi_status *ssp;
	 * Get a pointer to the buf(9S) structure for the command
	 * and to the per-instance data structure.
	bp = (struct buf *)pkt->pkt_private;
	instance = getminor(bp->b_edev);
	xsp = ddi_get_soft_state(statep, instance);
	 * Figure out why this callback routine was called
	if (pkt->pkt_reason != CMP_CMPLT) {
	   	bp->b_resid = bp->b_bcount;
	   	bioerror(bp, EIO);
	   	scsi_destroy_pkt(pkt);						/* release resources */
	   	biodone(bp);						/* notify waiting threads */ ;
	} else {
		    * Command completed, check status.
		    * See scsi_status(9S)
	   	ssp = (struct scsi_status *)pkt->pkt_scbp;
	   	if (ssp->sts_busy) {
			   error, target busy or reserved
	   	} else if (ssp->sts_chk) {
			   send a request sense command 
	   	} else {
			    bp->b_resid = pkt->pkt_resid; /*packet completed OK */

Otherwise, the command succeeded. If this is the end of processing for the command, it destroys the packet and calls biodone(9F).

In the event of a transport error (such as a bus reset or parity problem), the target driver may resubmit the packet using scsi_transport(9E). There is no need to change any values in the packet prior to resubmitting.

This example does not attempt to retry incomplete commands. See Appendix G, Advanced Topics, for further information.

Reuse of Packets

A target driver may reuse packets in the following ways:

Auto-Request Sense Mode

Auto-request sense mode is most desirable if tagged or untagged queuing is used. A contingent allegiance condition is cleared by any subsequent command and, consequently, the sense data is lost. Most HBA drivers will start the next command before performing the target driver callback. Other HBA drivers may use a separate and lower-priority thread to perform the callbacks, which may increase the time it takes to notify the target driver that the packet completed with a check condition. In this case, the target driver may not be able to submit a request sense command in time to retrieve the sense data.

To avoid this loss of sense data, the HBA driver, or controller, should issue a request sense command as soon as a check condition has been detected; this mode is known as auto-request sense mode. Note that not all HBA drivers are capable of auto-request sense mode, and some can only operate with auto-request-sense mode enabled.

A target driver enables auto-request-sense mode by using scsi_ifsetcap(9F). Example 13-6 shows enabling auto request sense.

Example 13-6 Enabling Auto Request Sense

static int
xxattach(dev_info_t *dip, ddi_attach_cmd_t cmd)
	struct xxstate *xsp;
	struct scsi_device *sdp = (struct scsi_device *)
	 * enable auto-request-sense; an auto-request-sense cmd may
	 * due to a BUSY condition or transport error. Therefore, it is
	 * recommended to allocate a separate request sense packet as
	 * well.
	 * Note that scsi_ifsetcap(9F) may return -1, 0, or 1
	xsp->sdp_arq_enabled =
	    ((scsi_ifsetcap(ROUTE, "auto-rqsense", 1, 1) == 1) ? 1 :
	 * if the HBA driver supports auto request sense then the
	 * status blocks should be sizeof (struct scsi_arq_status);
	 * one byte is sufficient
	xsp->sdp_cmd_stat_size =  (xsp->sdp_arq_enabled ?
	    sizeof (struct scsi_arq_status) : 1);

When a packet is allocated using scsi_init_pkt(9F) and auto request sense is desired on this packet then the target driver must request additional space for the status block to hold the auto request sense structure (as Example 13-7 illustrates). The sense length used in the request sense command is sizeof (struct scsi_extended_sense).

The scsi_arq_status structure contains the following members:

	struct scsi_status					sts_status;
 	struct scsi_status					sts_rqpkt_status;
 	u_char					sts_rqpkt_reason;	/* reason completion */
 	u_char					sts_rqpkt_resid;	/* residue */
 	u_int					sts_rqpkt_state;	/* state of command */
 	u_int					sts_rqpkt_statistics;	/* statistics */
 	struct scsi_extended_sense sts_sensedata;

Auto request sense can be disabled per individual packet by just allocating sizeof (struct scsi_status) for the status block.

Example 13-7 Allocating a Packet With Auto Request Sense

	pkt = scsi_init_pkt(ROUTE, NULL, bp, CDB_GROUP1,
	    xsp->sdp_cmd_stat_size, PP_LEN, 0, func, (caddr_t) xsp);

The packet is submitted using scsi_transport(9F) as usual. When a check condition occurs on this packet, the host adapter driver:

The target driver's callback routine should verify that sense data is available by checking the STATE_ARQ_DONE bit in pkt_state, which implies that a check condition has occurred and a request sense has been performed. If auto-request-sense has been temporarily disabled in a packet, there is no guarantee that the sense data can be retrieved at a later time.

The target driver should then verify whether the auto request sense command completed successfully and decode the sense data.

Example 13-8 Checking for Auto Request Sense

static void
xxcallback(struct scsi_pkt *pkt)
	if (pkt->pkt_state & STATE_ARQ_DONE) {
		    * The transport layer successfully completed an
		    * auto-request-sense.
		    * Decode the auto request sense data here

Dump Handling


The dump(9E) entry point is used to copy a portion of virtual address space directly to the specified device in the case of system failure or checkpoint operation. See cpr(7) and dump(9E). The dump(9E) entry point must be capable of performing this operation without the use of interrupts.

dev is the device number of the dump device, addr is the kernel virtual address at which to start the dump, blkno is the first destination block on the device and nblk is the number of blocks to dump.

Example 13-9 dump(9E) Routine

static int
xxdump(dev_t dev, caddr_t addr, daddr_t blkno, int nblk)
	struct xxstate	*xsp;
	struct buf	*bp;
	struct scsi_pkt	*pkt;
	int		rval;
	int		instance;

	instance = getminor(dev);
	xsp = ddi_get_soft_state(statep, instance);

	if (tgt->suspended || tgt->pm_suspended) {
		(void) ddi_dev_is_needed(DEVINFO(tgt), 0, 1);

	bp = getrbuf(KM_NOSLEEP);
	if (bp == NULL) {
		return (EIO);

Calculate block number relative to partition
bp->b_un.b_addr = addr;
	bp->b_edev = dev;
	bp->b_bcount = nblk * DEV_BSIZE;
	bp->b_flags = B_WRITE | B_BUSY;
	bp->b_blkno = blkno;

	pkt = scsi_init_pkt(ROUTE(tgt), NULL, bp, CDB_GROUP1,
	    sizeof (struct scsi_arq_status),
	    sizeof (struct bst_pkt_private), 0, NULL_FUNC, NULL);

	if (pkt == NULL) {
		return (EIO);
	(void) scsi_setup_cdb((union scsi_cdb *)pkt->pkt_cdbp,
			SCMD_WRITE_G1, blkno, nblk, 0);

	 * while dumping in polled mode, other cmds might complete
	 * and these should not be resubmitted. we set the
	 * dumping flag here which prevents requeuing cmds.
	tgt->dumping = 1;
	rval = scsi_poll(pkt);
	tgt->dumping = 0;


	if (rval != DDI_SUCCESS) {
		rval = EIO;

	return (rval);