?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
scsi: add free_request callback
[qemu-kvm.git] / hw / scsi-bus.c
blobdc7406389db4d2d9b0009201e71118dd8bae85e1
1 #include "hw.h"
2 #include "qemu-error.h"
3 #include "scsi.h"
4 #include "scsi-defs.h"
5 #include "qdev.h"
6 #include "blockdev.h"
7 #include "trace.h"
8 #include "dma.h"
9
10 static char *scsibus_get_dev_path(DeviceState *dev);
11 static char *scsibus_get_fw_dev_path(DeviceState *dev);
12 static int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf);
13 static void scsi_req_dequeue(SCSIRequest *req);
14
15 static Property scsi_props[] = {
16 DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0),
17 DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1),
18 DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1),
19 DEFINE_PROP_END_OF_LIST(),
20 };
21
22 static void scsi_bus_class_init(ObjectClass *klass, void *data)
23 {
24 BusClass *k = BUS_CLASS(klass);
25
26 k->get_dev_path = scsibus_get_dev_path;
27 k->get_fw_dev_path = scsibus_get_fw_dev_path;
28 }
29
30 static const TypeInfo scsi_bus_info = {
31 .name = TYPE_SCSI_BUS,
32 .parent = TYPE_BUS,
33 .instance_size = sizeof(SCSIBus),
34 .class_init = scsi_bus_class_init,
35 };
36 static int next_scsi_bus;
37
38 static int scsi_device_init(SCSIDevice *s)
39 {
40 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
41 if (sc->init) {
42 return sc->init(s);
43 }
44 return 0;
45 }
46
47 static void scsi_device_destroy(SCSIDevice *s)
48 {
49 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
50 if (sc->destroy) {
51 sc->destroy(s);
52 }
53 }
54
55 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun,
56 uint8_t *buf, void *hba_private)
57 {
58 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
59 if (sc->alloc_req) {
60 return sc->alloc_req(s, tag, lun, buf, hba_private);
61 }
62
63 return NULL;
64 }
65
66 static void scsi_device_unit_attention_reported(SCSIDevice *s)
67 {
68 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
69 if (sc->unit_attention_reported) {
70 sc->unit_attention_reported(s);
71 }
72 }
73
74 /* Create a scsi bus, and attach devices to it. */
75 void scsi_bus_new(SCSIBus *bus, DeviceState *host, const SCSIBusInfo *info)
76 {
77 qbus_create_inplace(&bus->qbus, TYPE_SCSI_BUS, host, NULL);
78 bus->busnr = next_scsi_bus++;
79 bus->info = info;
80 bus->qbus.allow_hotplug = 1;
81 }
82
83 static void scsi_dma_restart_bh(void *opaque)
84 {
85 SCSIDevice *s = opaque;
86 SCSIRequest *req, *next;
87
88 qemu_bh_delete(s->bh);
89 s->bh = NULL;
90
91 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
92 scsi_req_ref(req);
93 if (req->retry) {
94 req->retry = false;
95 switch (req->cmd.mode) {
96 case SCSI_XFER_FROM_DEV:
97 case SCSI_XFER_TO_DEV:
98 scsi_req_continue(req);
99 break;
100 case SCSI_XFER_NONE:
101 assert(!req->sg);
102 scsi_req_dequeue(req);
103 scsi_req_enqueue(req);
104 break;
105 }
106 }
107 scsi_req_unref(req);
108 }
109 }
110
111 void scsi_req_retry(SCSIRequest *req)
112 {
113 /* No need to save a reference, because scsi_dma_restart_bh just
114 * looks at the request list. */
115 req->retry = true;
116 }
117
118 static void scsi_dma_restart_cb(void *opaque, int running, RunState state)
119 {
120 SCSIDevice *s = opaque;
121
122 if (!running) {
123 return;
124 }
125 if (!s->bh) {
126 s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
127 qemu_bh_schedule(s->bh);
128 }
129 }
130
131 static int scsi_qdev_init(DeviceState *qdev)
132 {
133 SCSIDevice *dev = SCSI_DEVICE(qdev);
134 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
135 SCSIDevice *d;
136 int rc = -1;
137
138 if (dev->channel > bus->info->max_channel) {
139 error_report("bad scsi channel id: %d", dev->channel);
140 goto err;
141 }
142 if (dev->id != -1 && dev->id > bus->info->max_target) {
143 error_report("bad scsi device id: %d", dev->id);
144 goto err;
145 }
146 if (dev->lun != -1 && dev->lun > bus->info->max_lun) {
147 error_report("bad scsi device lun: %d", dev->lun);
148 goto err;
149 }
150
151 if (dev->id == -1) {
152 int id = -1;
153 if (dev->lun == -1) {
154 dev->lun = 0;
155 }
156 do {
157 d = scsi_device_find(bus, dev->channel, ++id, dev->lun);
158 } while (d && d->lun == dev->lun && id < bus->info->max_target);
159 if (d && d->lun == dev->lun) {
160 error_report("no free target");
161 goto err;
162 }
163 dev->id = id;
164 } else if (dev->lun == -1) {
165 int lun = -1;
166 do {
167 d = scsi_device_find(bus, dev->channel, dev->id, ++lun);
168 } while (d && d->lun == lun && lun < bus->info->max_lun);
169 if (d && d->lun == lun) {
170 error_report("no free lun");
171 goto err;
172 }
173 dev->lun = lun;
174 } else {
175 d = scsi_device_find(bus, dev->channel, dev->id, dev->lun);
176 assert(d);
177 if (d->lun == dev->lun && dev != d) {
178 qdev_free(&d->qdev);
179 }
180 }
181
182 QTAILQ_INIT(&dev->requests);
183 rc = scsi_device_init(dev);
184 if (rc == 0) {
185 dev->vmsentry = qemu_add_vm_change_state_handler(scsi_dma_restart_cb,
186 dev);
187 }
188
189 err:
190 return rc;
191 }
192
193 static int scsi_qdev_exit(DeviceState *qdev)
194 {
195 SCSIDevice *dev = SCSI_DEVICE(qdev);
196
197 if (dev->vmsentry) {
198 qemu_del_vm_change_state_handler(dev->vmsentry);
199 }
200 scsi_device_destroy(dev);
201 return 0;
202 }
203
204 /* handle legacy '-drive if=scsi,...' cmd line args */
205 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
206 int unit, bool removable, int bootindex)
207 {
208 const char *driver;
209 DeviceState *dev;
210
211 driver = bdrv_is_sg(bdrv) ? "scsi-generic" : "scsi-disk";
212 dev = qdev_create(&bus->qbus, driver);
213 qdev_prop_set_uint32(dev, "scsi-id", unit);
214 if (bootindex >= 0) {
215 qdev_prop_set_int32(dev, "bootindex", bootindex);
216 }
217 if (object_property_find(OBJECT(dev), "removable", NULL)) {
218 qdev_prop_set_bit(dev, "removable", removable);
219 }
220 if (qdev_prop_set_drive(dev, "drive", bdrv) < 0) {
221 qdev_free(dev);
222 return NULL;
223 }
224 if (qdev_init(dev) < 0)
225 return NULL;
226 return SCSI_DEVICE(dev);
227 }
228
229 int scsi_bus_legacy_handle_cmdline(SCSIBus *bus)
230 {
231 Location loc;
232 DriveInfo *dinfo;
233 int res = 0, unit;
234
235 loc_push_none(&loc);
236 for (unit = 0; unit <= bus->info->max_target; unit++) {
237 dinfo = drive_get(IF_SCSI, bus->busnr, unit);
238 if (dinfo == NULL) {
239 continue;
240 }
241 qemu_opts_loc_restore(dinfo->opts);
242 if (!scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit, false, -1)) {
243 res = -1;
244 break;
245 }
246 }
247 loc_pop(&loc);
248 return res;
249 }
250
251 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf)
252 {
253 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
254 scsi_req_complete(req, CHECK_CONDITION);
255 return 0;
256 }
257
258 static const struct SCSIReqOps reqops_invalid_field = {
259 .size = sizeof(SCSIRequest),
260 .send_command = scsi_invalid_field
261 };
262
263 /* SCSIReqOps implementation for invalid commands. */
264
265 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf)
266 {
267 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE));
268 scsi_req_complete(req, CHECK_CONDITION);
269 return 0;
270 }
271
272 static const struct SCSIReqOps reqops_invalid_opcode = {
273 .size = sizeof(SCSIRequest),
274 .send_command = scsi_invalid_command
275 };
276
277 /* SCSIReqOps implementation for unit attention conditions. */
278
279 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
280 {
281 if (req->dev && req->dev->unit_attention.key == UNIT_ATTENTION) {
282 scsi_req_build_sense(req, req->dev->unit_attention);
283 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
284 scsi_req_build_sense(req, req->bus->unit_attention);
285 }
286 scsi_req_complete(req, CHECK_CONDITION);
287 return 0;
288 }
289
290 static const struct SCSIReqOps reqops_unit_attention = {
291 .size = sizeof(SCSIRequest),
292 .send_command = scsi_unit_attention
293 };
294
295 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to
296 an invalid LUN. */
297
298 typedef struct SCSITargetReq SCSITargetReq;
299
300 struct SCSITargetReq {
301 SCSIRequest req;
302 int len;
303 uint8_t buf[2056];
304 };
305
306 static void store_lun(uint8_t *outbuf, int lun)
307 {
308 if (lun < 256) {
309 outbuf[1] = lun;
310 return;
311 }
312 outbuf[1] = (lun & 255);
313 outbuf[0] = (lun >> 8) | 0x40;
314 }
315
316 static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
317 {
318 BusChild *kid;
319 int i, len, n;
320 int channel, id;
321 bool found_lun0;
322
323 if (r->req.cmd.xfer < 16) {
324 return false;
325 }
326 if (r->req.cmd.buf[2] > 2) {
327 return false;
328 }
329 channel = r->req.dev->channel;
330 id = r->req.dev->id;
331 found_lun0 = false;
332 n = 0;
333 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) {
334 DeviceState *qdev = kid->child;
335 SCSIDevice *dev = SCSI_DEVICE(qdev);
336
337 if (dev->channel == channel && dev->id == id) {
338 if (dev->lun == 0) {
339 found_lun0 = true;
340 }
341 n += 8;
342 }
343 }
344 if (!found_lun0) {
345 n += 8;
346 }
347 len = MIN(n + 8, r->req.cmd.xfer & ~7);
348 if (len > sizeof(r->buf)) {
349 /* TODO: > 256 LUNs? */
350 return false;
351 }
352
353 memset(r->buf, 0, len);
354 stl_be_p(&r->buf, n);
355 i = found_lun0 ? 8 : 16;
356 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) {
357 DeviceState *qdev = kid->child;
358 SCSIDevice *dev = SCSI_DEVICE(qdev);
359
360 if (dev->channel == channel && dev->id == id) {
361 store_lun(&r->buf[i], dev->lun);
362 i += 8;
363 }
364 }
365 assert(i == n + 8);
366 r->len = len;
367 return true;
368 }
369
370 static bool scsi_target_emulate_inquiry(SCSITargetReq *r)
371 {
372 assert(r->req.dev->lun != r->req.lun);
373 if (r->req.cmd.buf[1] & 0x2) {
374 /* Command support data - optional, not implemented */
375 return false;
376 }
377
378 if (r->req.cmd.buf[1] & 0x1) {
379 /* Vital product data */
380 uint8_t page_code = r->req.cmd.buf[2];
381 r->buf[r->len++] = page_code ; /* this page */
382 r->buf[r->len++] = 0x00;
383
384 switch (page_code) {
385 case 0x00: /* Supported page codes, mandatory */
386 {
387 int pages;
388 pages = r->len++;
389 r->buf[r->len++] = 0x00; /* list of supported pages (this page) */
390 r->buf[pages] = r->len - pages - 1; /* number of pages */
391 break;
392 }
393 default:
394 return false;
395 }
396 /* done with EVPD */
397 assert(r->len < sizeof(r->buf));
398 r->len = MIN(r->req.cmd.xfer, r->len);
399 return true;
400 }
401
402 /* Standard INQUIRY data */
403 if (r->req.cmd.buf[2] != 0) {
404 return false;
405 }
406
407 /* PAGE CODE == 0 */
408 r->len = MIN(r->req.cmd.xfer, 36);
409 memset(r->buf, 0, r->len);
410 if (r->req.lun != 0) {
411 r->buf[0] = TYPE_NO_LUN;
412 } else {
413 r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE;
414 r->buf[2] = 5; /* Version */
415 r->buf[3] = 2 | 0x10; /* HiSup, response data format */
416 r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */
417 r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ. */
418 memcpy(&r->buf[8], "QEMU ", 8);
419 memcpy(&r->buf[16], "QEMU TARGET ", 16);
420 pstrcpy((char *) &r->buf[32], 4, qemu_get_version());
421 }
422 return true;
423 }
424
425 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf)
426 {
427 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
428
429 switch (buf[0]) {
430 case REPORT_LUNS:
431 if (!scsi_target_emulate_report_luns(r)) {
432 goto illegal_request;
433 }
434 break;
435 case INQUIRY:
436 if (!scsi_target_emulate_inquiry(r)) {
437 goto illegal_request;
438 }
439 break;
440 case REQUEST_SENSE:
441 r->len = scsi_device_get_sense(r->req.dev, r->buf,
442 MIN(req->cmd.xfer, sizeof r->buf),
443 (req->cmd.buf[1] & 1) == 0);
444 if (r->req.dev->sense_is_ua) {
445 scsi_device_unit_attention_reported(req->dev);
446 r->req.dev->sense_len = 0;
447 r->req.dev->sense_is_ua = false;
448 }
449 break;
450 default:
451 scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED));
452 scsi_req_complete(req, CHECK_CONDITION);
453 return 0;
454 illegal_request:
455 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
456 scsi_req_complete(req, CHECK_CONDITION);
457 return 0;
458 }
459
460 if (!r->len) {
461 scsi_req_complete(req, GOOD);
462 }
463 return r->len;
464 }
465
466 static void scsi_target_read_data(SCSIRequest *req)
467 {
468 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
469 uint32_t n;
470
471 n = r->len;
472 if (n > 0) {
473 r->len = 0;
474 scsi_req_data(&r->req, n);
475 } else {
476 scsi_req_complete(&r->req, GOOD);
477 }
478 }
479
480 static uint8_t *scsi_target_get_buf(SCSIRequest *req)
481 {
482 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
483
484 return r->buf;
485 }
486
487 static const struct SCSIReqOps reqops_target_command = {
488 .size = sizeof(SCSITargetReq),
489 .send_command = scsi_target_send_command,
490 .read_data = scsi_target_read_data,
491 .get_buf = scsi_target_get_buf,
492 };
493
494
495 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
496 uint32_t tag, uint32_t lun, void *hba_private)
497 {
498 SCSIRequest *req;
499
500 req = g_malloc0(reqops->size);
501 req->refcount = 1;
502 req->bus = scsi_bus_from_device(d);
503 req->dev = d;
504 req->tag = tag;
505 req->lun = lun;
506 req->hba_private = hba_private;
507 req->status = -1;
508 req->sense_len = 0;
509 req->ops = reqops;
510 trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
511 return req;
512 }
513
514 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,
515 uint8_t *buf, void *hba_private)
516 {
517 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus);
518 SCSIRequest *req;
519 SCSICommand cmd;
520
521 if (scsi_req_parse(&cmd, d, buf) != 0) {
522 trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]);
523 req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private);
524 } else {
525 trace_scsi_req_parsed(d->id, lun, tag, buf[0],
526 cmd.mode, cmd.xfer);
527 if (cmd.lba != -1) {
528 trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0],
529 cmd.lba);
530 }
531
532 if (cmd.xfer > INT32_MAX) {
533 req = scsi_req_alloc(&reqops_invalid_field, d, tag, lun, hba_private);
534 } else if ((d->unit_attention.key == UNIT_ATTENTION ||
535 bus->unit_attention.key == UNIT_ATTENTION) &&
536 (buf[0] != INQUIRY &&
537 buf[0] != REPORT_LUNS &&
538 buf[0] != GET_CONFIGURATION &&
539 buf[0] != GET_EVENT_STATUS_NOTIFICATION &&
540
541 /*
542 * If we already have a pending unit attention condition,
543 * report this one before triggering another one.
544 */
545 !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) {
546 req = scsi_req_alloc(&reqops_unit_attention, d, tag, lun,
547 hba_private);
548 } else if (lun != d->lun ||
549 buf[0] == REPORT_LUNS ||
550 (buf[0] == REQUEST_SENSE && d->sense_len)) {
551 req = scsi_req_alloc(&reqops_target_command, d, tag, lun,
552 hba_private);
553 } else {
554 req = scsi_device_alloc_req(d, tag, lun, buf, hba_private);
555 }
556 }
557
558 req->cmd = cmd;
559 req->resid = req->cmd.xfer;
560
561 switch (buf[0]) {
562 case INQUIRY:
563 trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]);
564 break;
565 case TEST_UNIT_READY:
566 trace_scsi_test_unit_ready(d->id, lun, tag);
567 break;
568 case REPORT_LUNS:
569 trace_scsi_report_luns(d->id, lun, tag);
570 break;
571 case REQUEST_SENSE:
572 trace_scsi_request_sense(d->id, lun, tag);
573 break;
574 default:
575 break;
576 }
577
578 return req;
579 }
580
581 uint8_t *scsi_req_get_buf(SCSIRequest *req)
582 {
583 return req->ops->get_buf(req);
584 }
585
586 static void scsi_clear_unit_attention(SCSIRequest *req)
587 {
588 SCSISense *ua;
589 if (req->dev->unit_attention.key != UNIT_ATTENTION &&
590 req->bus->unit_attention.key != UNIT_ATTENTION) {
591 return;
592 }
593
594 /*
595 * If an INQUIRY command enters the enabled command state,
596 * the device server shall [not] clear any unit attention condition;
597 * See also MMC-6, paragraphs 6.5 and 6.6.2.
598 */
599 if (req->cmd.buf[0] == INQUIRY ||
600 req->cmd.buf[0] == GET_CONFIGURATION ||
601 req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) {
602 return;
603 }
604
605 if (req->dev->unit_attention.key == UNIT_ATTENTION) {
606 ua = &req->dev->unit_attention;
607 } else {
608 ua = &req->bus->unit_attention;
609 }
610
611 /*
612 * If a REPORT LUNS command enters the enabled command state, [...]
613 * the device server shall clear any pending unit attention condition
614 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
615 */
616 if (req->cmd.buf[0] == REPORT_LUNS &&
617 !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
618 ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) {
619 return;
620 }
621
622 *ua = SENSE_CODE(NO_SENSE);
623 }
624
625 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len)
626 {
627 int ret;
628
629 assert(len >= 14);
630 if (!req->sense_len) {
631 return 0;
632 }
633
634 ret = scsi_build_sense(req->sense, req->sense_len, buf, len, true);
635
636 /*
637 * FIXME: clearing unit attention conditions upon autosense should be done
638 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
639 * (SAM-5, 5.14).
640 *
641 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
642 * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
643 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
644 */
645 if (req->dev->sense_is_ua) {
646 scsi_device_unit_attention_reported(req->dev);
647 req->dev->sense_len = 0;
648 req->dev->sense_is_ua = false;
649 }
650 return ret;
651 }
652
653 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed)
654 {
655 return scsi_build_sense(dev->sense, dev->sense_len, buf, len, fixed);
656 }
657
658 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense)
659 {
660 trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag,
661 sense.key, sense.asc, sense.ascq);
662 memset(req->sense, 0, 18);
663 req->sense[0] = 0x70;
664 req->sense[2] = sense.key;
665 req->sense[7] = 10;
666 req->sense[12] = sense.asc;
667 req->sense[13] = sense.ascq;
668 req->sense_len = 18;
669 }
670
671 static void scsi_req_enqueue_internal(SCSIRequest *req)
672 {
673 assert(!req->enqueued);
674 scsi_req_ref(req);
675 if (req->bus->info->get_sg_list) {
676 req->sg = req->bus->info->get_sg_list(req);
677 } else {
678 req->sg = NULL;
679 }
680 req->enqueued = true;
681 QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
682 }
683
684 int32_t scsi_req_enqueue(SCSIRequest *req)
685 {
686 int32_t rc;
687
688 assert(!req->retry);
689 scsi_req_enqueue_internal(req);
690 scsi_req_ref(req);
691 rc = req->ops->send_command(req, req->cmd.buf);
692 scsi_req_unref(req);
693 return rc;
694 }
695
696 static void scsi_req_dequeue(SCSIRequest *req)
697 {
698 trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
699 req->retry = false;
700 if (req->enqueued) {
701 QTAILQ_REMOVE(&req->dev->requests, req, next);
702 req->enqueued = false;
703 scsi_req_unref(req);
704 }
705 }
706
707 static int scsi_get_performance_length(int num_desc, int type, int data_type)
708 {
709 /* MMC-6, paragraph 6.7. */
710 switch (type) {
711 case 0:
712 if ((data_type & 3) == 0) {
713 /* Each descriptor is as in Table 295 - Nominal performance. */
714 return 16 * num_desc + 8;
715 } else {
716 /* Each descriptor is as in Table 296 - Exceptions. */
717 return 6 * num_desc + 8;
718 }
719 case 1:
720 case 4:
721 case 5:
722 return 8 * num_desc + 8;
723 case 2:
724 return 2048 * num_desc + 8;
725 case 3:
726 return 16 * num_desc + 8;
727 default:
728 return 8;
729 }
730 }
731
732 static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
733 {
734 switch (buf[0] >> 5) {
735 case 0:
736 cmd->xfer = buf[4];
737 break;
738 case 1:
739 case 2:
740 cmd->xfer = lduw_be_p(&buf[7]);
741 break;
742 case 4:
743 cmd->xfer = ldl_be_p(&buf[10]) & 0xffffffffULL;
744 break;
745 case 5:
746 cmd->xfer = ldl_be_p(&buf[6]) & 0xffffffffULL;
747 break;
748 default:
749 return -1;
750 }
751
752 switch (buf[0]) {
753 case TEST_UNIT_READY:
754 case REWIND:
755 case START_STOP:
756 case SET_CAPACITY:
757 case WRITE_FILEMARKS:
758 case WRITE_FILEMARKS_16:
759 case SPACE:
760 case RESERVE:
761 case RELEASE:
762 case ERASE:
763 case ALLOW_MEDIUM_REMOVAL:
764 case VERIFY_10:
765 case SEEK_10:
766 case SYNCHRONIZE_CACHE:
767 case SYNCHRONIZE_CACHE_16:
768 case LOCATE_16:
769 case LOCK_UNLOCK_CACHE:
770 case SET_CD_SPEED:
771 case SET_LIMITS:
772 case WRITE_LONG_10:
773 case UPDATE_BLOCK:
774 case RESERVE_TRACK:
775 case SET_READ_AHEAD:
776 case PRE_FETCH:
777 case PRE_FETCH_16:
778 case ALLOW_OVERWRITE:
779 cmd->xfer = 0;
780 break;
781 case MODE_SENSE:
782 break;
783 case WRITE_SAME_10:
784 case WRITE_SAME_16:
785 cmd->xfer = dev->blocksize;
786 break;
787 case READ_CAPACITY_10:
788 cmd->xfer = 8;
789 break;
790 case READ_BLOCK_LIMITS:
791 cmd->xfer = 6;
792 break;
793 case SEND_VOLUME_TAG:
794 /* GPCMD_SET_STREAMING from multimedia commands. */
795 if (dev->type == TYPE_ROM) {
796 cmd->xfer = buf[10] | (buf[9] << 8);
797 } else {
798 cmd->xfer = buf[9] | (buf[8] << 8);
799 }
800 break;
801 case WRITE_6:
802 /* length 0 means 256 blocks */
803 if (cmd->xfer == 0) {
804 cmd->xfer = 256;
805 }
806 case WRITE_10:
807 case WRITE_VERIFY_10:
808 case WRITE_12:
809 case WRITE_VERIFY_12:
810 case WRITE_16:
811 case WRITE_VERIFY_16:
812 cmd->xfer *= dev->blocksize;
813 break;
814 case READ_6:
815 case READ_REVERSE:
816 /* length 0 means 256 blocks */
817 if (cmd->xfer == 0) {
818 cmd->xfer = 256;
819 }
820 case READ_10:
821 case RECOVER_BUFFERED_DATA:
822 case READ_12:
823 case READ_16:
824 cmd->xfer *= dev->blocksize;
825 break;
826 case FORMAT_UNIT:
827 /* MMC mandates the parameter list to be 12-bytes long. Parameters
828 * for block devices are restricted to the header right now. */
829 if (dev->type == TYPE_ROM && (buf[1] & 16)) {
830 cmd->xfer = 12;
831 } else {
832 cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4);
833 }
834 break;
835 case INQUIRY:
836 case RECEIVE_DIAGNOSTIC:
837 case SEND_DIAGNOSTIC:
838 cmd->xfer = buf[4] | (buf[3] << 8);
839 break;
840 case READ_CD:
841 case READ_BUFFER:
842 case WRITE_BUFFER:
843 case SEND_CUE_SHEET:
844 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16);
845 break;
846 case PERSISTENT_RESERVE_OUT:
847 cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL;
848 break;
849 case ERASE_12:
850 if (dev->type == TYPE_ROM) {
851 /* MMC command GET PERFORMANCE. */
852 cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8),
853 buf[10], buf[1] & 0x1f);
854 }
855 break;
856 case MECHANISM_STATUS:
857 case READ_DVD_STRUCTURE:
858 case SEND_DVD_STRUCTURE:
859 case MAINTENANCE_OUT:
860 case MAINTENANCE_IN:
861 if (dev->type == TYPE_ROM) {
862 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
863 cmd->xfer = buf[9] | (buf[8] << 8);
864 }
865 break;
866 }
867 return 0;
868 }
869
870 static int scsi_req_stream_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
871 {
872 switch (buf[0]) {
873 /* stream commands */
874 case ERASE_12:
875 case ERASE_16:
876 cmd->xfer = 0;
877 break;
878 case READ_6:
879 case READ_REVERSE:
880 case RECOVER_BUFFERED_DATA:
881 case WRITE_6:
882 cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16);
883 if (buf[1] & 0x01) { /* fixed */
884 cmd->xfer *= dev->blocksize;
885 }
886 break;
887 case READ_16:
888 case READ_REVERSE_16:
889 case VERIFY_16:
890 case WRITE_16:
891 cmd->xfer = buf[14] | (buf[13] << 8) | (buf[12] << 16);
892 if (buf[1] & 0x01) { /* fixed */
893 cmd->xfer *= dev->blocksize;
894 }
895 break;
896 case REWIND:
897 case LOAD_UNLOAD:
898 cmd->xfer = 0;
899 break;
900 case SPACE_16:
901 cmd->xfer = buf[13] | (buf[12] << 8);
902 break;
903 case READ_POSITION:
904 switch (buf[1] & 0x1f) /* operation code */ {
905 case SHORT_FORM_BLOCK_ID:
906 case SHORT_FORM_VENDOR_SPECIFIC:
907 cmd->xfer = 20;
908 break;
909 case LONG_FORM:
910 cmd->xfer = 32;
911 break;
912 case EXTENDED_FORM:
913 cmd->xfer = buf[8] | (buf[7] << 8);
914 break;
915 default:
916 return -1;
917 }
918
919 break;
920 case FORMAT_UNIT:
921 cmd->xfer = buf[4] | (buf[3] << 8);
922 break;
923 /* generic commands */
924 default:
925 return scsi_req_length(cmd, dev, buf);
926 }
927 return 0;
928 }
929
930 static int scsi_req_medium_changer_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
931 {
932 switch (buf[0]) {
933 /* medium changer commands */
934 case EXCHANGE_MEDIUM:
935 case INITIALIZE_ELEMENT_STATUS:
936 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE:
937 case MOVE_MEDIUM:
938 case POSITION_TO_ELEMENT:
939 cmd->xfer = 0;
940 break;
941 case READ_ELEMENT_STATUS:
942 cmd->xfer = buf[9] | (buf[8] << 8) | (buf[7] << 16);
943 break;
944
945 /* generic commands */
946 default:
947 return scsi_req_length(cmd, dev, buf);
948 }
949 return 0;
950 }
951
952
953 static void scsi_cmd_xfer_mode(SCSICommand *cmd)
954 {
955 if (!cmd->xfer) {
956 cmd->mode = SCSI_XFER_NONE;
957 return;
958 }
959 switch (cmd->buf[0]) {
960 case WRITE_6:
961 case WRITE_10:
962 case WRITE_VERIFY_10:
963 case WRITE_12:
964 case WRITE_VERIFY_12:
965 case WRITE_16:
966 case WRITE_VERIFY_16:
967 case COPY:
968 case COPY_VERIFY:
969 case COMPARE:
970 case CHANGE_DEFINITION:
971 case LOG_SELECT:
972 case MODE_SELECT:
973 case MODE_SELECT_10:
974 case SEND_DIAGNOSTIC:
975 case WRITE_BUFFER:
976 case FORMAT_UNIT:
977 case REASSIGN_BLOCKS:
978 case SEARCH_EQUAL:
979 case SEARCH_HIGH:
980 case SEARCH_LOW:
981 case UPDATE_BLOCK:
982 case WRITE_LONG_10:
983 case WRITE_SAME_10:
984 case WRITE_SAME_16:
985 case UNMAP:
986 case SEARCH_HIGH_12:
987 case SEARCH_EQUAL_12:
988 case SEARCH_LOW_12:
989 case MEDIUM_SCAN:
990 case SEND_VOLUME_TAG:
991 case SEND_CUE_SHEET:
992 case SEND_DVD_STRUCTURE:
993 case PERSISTENT_RESERVE_OUT:
994 case MAINTENANCE_OUT:
995 case ATA_PASSTHROUGH:
996 cmd->mode = SCSI_XFER_TO_DEV;
997 break;
998 default:
999 cmd->mode = SCSI_XFER_FROM_DEV;
1000 break;
1001 }
1002 }
1003
1004 static uint64_t scsi_cmd_lba(SCSICommand *cmd)
1005 {
1006 uint8_t *buf = cmd->buf;
1007 uint64_t lba;
1008
1009 switch (buf[0] >> 5) {
1010 case 0:
1011 lba = ldl_be_p(&buf[0]) & 0x1fffff;
1012 break;
1013 case 1:
1014 case 2:
1015 case 5:
1016 lba = ldl_be_p(&buf[2]) & 0xffffffffULL;
1017 break;
1018 case 4:
1019 lba = ldq_be_p(&buf[2]);
1020 break;
1021 default:
1022 lba = -1;
1023
1024 }
1025 return lba;
1026 }
1027
1028 int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
1029 {
1030 int rc;
1031
1032 switch (buf[0] >> 5) {
1033 case 0:
1034 cmd->len = 6;
1035 break;
1036 case 1:
1037 case 2:
1038 cmd->len = 10;
1039 break;
1040 case 4:
1041 cmd->len = 16;
1042 break;
1043 case 5:
1044 cmd->len = 12;
1045 break;
1046 default:
1047 return -1;
1048 }
1049
1050 switch (dev->type) {
1051 case TYPE_TAPE:
1052 rc = scsi_req_stream_length(cmd, dev, buf);
1053 break;
1054 case TYPE_MEDIUM_CHANGER:
1055 rc = scsi_req_medium_changer_length(cmd, dev, buf);
1056 break;
1057 default:
1058 rc = scsi_req_length(cmd, dev, buf);
1059 break;
1060 }
1061
1062 if (rc != 0)
1063 return rc;
1064
1065 memcpy(cmd->buf, buf, cmd->len);
1066 scsi_cmd_xfer_mode(cmd);
1067 cmd->lba = scsi_cmd_lba(cmd);
1068 return 0;
1069 }
1070
1071 /*
1072 * Predefined sense codes
1073 */
1074
1075 /* No sense data available */
1076 const struct SCSISense sense_code_NO_SENSE = {
1077 .key = NO_SENSE , .asc = 0x00 , .ascq = 0x00
1078 };
1079
1080 /* LUN not ready, Manual intervention required */
1081 const struct SCSISense sense_code_LUN_NOT_READY = {
1082 .key = NOT_READY, .asc = 0x04, .ascq = 0x03
1083 };
1084
1085 /* LUN not ready, Medium not present */
1086 const struct SCSISense sense_code_NO_MEDIUM = {
1087 .key = NOT_READY, .asc = 0x3a, .ascq = 0x00
1088 };
1089
1090 /* LUN not ready, medium removal prevented */
1091 const struct SCSISense sense_code_NOT_READY_REMOVAL_PREVENTED = {
1092 .key = NOT_READY, .asc = 0x53, .ascq = 0x00
1093 };
1094
1095 /* Hardware error, internal target failure */
1096 const struct SCSISense sense_code_TARGET_FAILURE = {
1097 .key = HARDWARE_ERROR, .asc = 0x44, .ascq = 0x00
1098 };
1099
1100 /* Illegal request, invalid command operation code */
1101 const struct SCSISense sense_code_INVALID_OPCODE = {
1102 .key = ILLEGAL_REQUEST, .asc = 0x20, .ascq = 0x00
1103 };
1104
1105 /* Illegal request, LBA out of range */
1106 const struct SCSISense sense_code_LBA_OUT_OF_RANGE = {
1107 .key = ILLEGAL_REQUEST, .asc = 0x21, .ascq = 0x00
1108 };
1109
1110 /* Illegal request, Invalid field in CDB */
1111 const struct SCSISense sense_code_INVALID_FIELD = {
1112 .key = ILLEGAL_REQUEST, .asc = 0x24, .ascq = 0x00
1113 };
1114
1115 /* Illegal request, LUN not supported */
1116 const struct SCSISense sense_code_LUN_NOT_SUPPORTED = {
1117 .key = ILLEGAL_REQUEST, .asc = 0x25, .ascq = 0x00
1118 };
1119
1120 /* Illegal request, Saving parameters not supported */
1121 const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED = {
1122 .key = ILLEGAL_REQUEST, .asc = 0x39, .ascq = 0x00
1123 };
1124
1125 /* Illegal request, Incompatible medium installed */
1126 const struct SCSISense sense_code_INCOMPATIBLE_FORMAT = {
1127 .key = ILLEGAL_REQUEST, .asc = 0x30, .ascq = 0x00
1128 };
1129
1130 /* Illegal request, medium removal prevented */
1131 const struct SCSISense sense_code_ILLEGAL_REQ_REMOVAL_PREVENTED = {
1132 .key = ILLEGAL_REQUEST, .asc = 0x53, .ascq = 0x00
1133 };
1134
1135 /* Command aborted, I/O process terminated */
1136 const struct SCSISense sense_code_IO_ERROR = {
1137 .key = ABORTED_COMMAND, .asc = 0x00, .ascq = 0x06
1138 };
1139
1140 /* Command aborted, I_T Nexus loss occurred */
1141 const struct SCSISense sense_code_I_T_NEXUS_LOSS = {
1142 .key = ABORTED_COMMAND, .asc = 0x29, .ascq = 0x07
1143 };
1144
1145 /* Command aborted, Logical Unit failure */
1146 const struct SCSISense sense_code_LUN_FAILURE = {
1147 .key = ABORTED_COMMAND, .asc = 0x3e, .ascq = 0x01
1148 };
1149
1150 /* Unit attention, Power on, reset or bus device reset occurred */
1151 const struct SCSISense sense_code_RESET = {
1152 .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x00
1153 };
1154
1155 /* Unit attention, No medium */
1156 const struct SCSISense sense_code_UNIT_ATTENTION_NO_MEDIUM = {
1157 .key = UNIT_ATTENTION, .asc = 0x3a, .ascq = 0x00
1158 };
1159
1160 /* Unit attention, Medium may have changed */
1161 const struct SCSISense sense_code_MEDIUM_CHANGED = {
1162 .key = UNIT_ATTENTION, .asc = 0x28, .ascq = 0x00
1163 };
1164
1165 /* Unit attention, Reported LUNs data has changed */
1166 const struct SCSISense sense_code_REPORTED_LUNS_CHANGED = {
1167 .key = UNIT_ATTENTION, .asc = 0x3f, .ascq = 0x0e
1168 };
1169
1170 /* Unit attention, Device internal reset */
1171 const struct SCSISense sense_code_DEVICE_INTERNAL_RESET = {
1172 .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x04
1173 };
1174
1175 /*
1176 * scsi_build_sense
1177 *
1178 * Convert between fixed and descriptor sense buffers
1179 */
1180 int scsi_build_sense(uint8_t *in_buf, int in_len,
1181 uint8_t *buf, int len, bool fixed)
1182 {
1183 bool fixed_in;
1184 SCSISense sense;
1185 if (!fixed && len < 8) {
1186 return 0;
1187 }
1188
1189 if (in_len == 0) {
1190 sense.key = NO_SENSE;
1191 sense.asc = 0;
1192 sense.ascq = 0;
1193 } else {
1194 fixed_in = (in_buf[0] & 2) == 0;
1195
1196 if (fixed == fixed_in) {
1197 memcpy(buf, in_buf, MIN(len, in_len));
1198 return MIN(len, in_len);
1199 }
1200
1201 if (fixed_in) {
1202 sense.key = in_buf[2];
1203 sense.asc = in_buf[12];
1204 sense.ascq = in_buf[13];
1205 } else {
1206 sense.key = in_buf[1];
1207 sense.asc = in_buf[2];
1208 sense.ascq = in_buf[3];
1209 }
1210 }
1211
1212 memset(buf, 0, len);
1213 if (fixed) {
1214 /* Return fixed format sense buffer */
1215 buf[0] = 0x70;
1216 buf[2] = sense.key;
1217 buf[7] = 10;
1218 buf[12] = sense.asc;
1219 buf[13] = sense.ascq;
1220 return MIN(len, 18);
1221 } else {
1222 /* Return descriptor format sense buffer */
1223 buf[0] = 0x72;
1224 buf[1] = sense.key;
1225 buf[2] = sense.asc;
1226 buf[3] = sense.ascq;
1227 return 8;
1228 }
1229 }
1230
1231 static const char *scsi_command_name(uint8_t cmd)
1232 {
1233 static const char *names[] = {
1234 [ TEST_UNIT_READY ] = "TEST_UNIT_READY",
1235 [ REWIND ] = "REWIND",
1236 [ REQUEST_SENSE ] = "REQUEST_SENSE",
1237 [ FORMAT_UNIT ] = "FORMAT_UNIT",
1238 [ READ_BLOCK_LIMITS ] = "READ_BLOCK_LIMITS",
1239 [ REASSIGN_BLOCKS ] = "REASSIGN_BLOCKS/INITIALIZE ELEMENT STATUS",
1240 /* LOAD_UNLOAD and INITIALIZE_ELEMENT_STATUS use the same operation code */
1241 [ READ_6 ] = "READ_6",
1242 [ WRITE_6 ] = "WRITE_6",
1243 [ SET_CAPACITY ] = "SET_CAPACITY",
1244 [ READ_REVERSE ] = "READ_REVERSE",
1245 [ WRITE_FILEMARKS ] = "WRITE_FILEMARKS",
1246 [ SPACE ] = "SPACE",
1247 [ INQUIRY ] = "INQUIRY",
1248 [ RECOVER_BUFFERED_DATA ] = "RECOVER_BUFFERED_DATA",
1249 [ MAINTENANCE_IN ] = "MAINTENANCE_IN",
1250 [ MAINTENANCE_OUT ] = "MAINTENANCE_OUT",
1251 [ MODE_SELECT ] = "MODE_SELECT",
1252 [ RESERVE ] = "RESERVE",
1253 [ RELEASE ] = "RELEASE",
1254 [ COPY ] = "COPY",
1255 [ ERASE ] = "ERASE",
1256 [ MODE_SENSE ] = "MODE_SENSE",
1257 [ START_STOP ] = "START_STOP/LOAD_UNLOAD",
1258 /* LOAD_UNLOAD and START_STOP use the same operation code */
1259 [ RECEIVE_DIAGNOSTIC ] = "RECEIVE_DIAGNOSTIC",
1260 [ SEND_DIAGNOSTIC ] = "SEND_DIAGNOSTIC",
1261 [ ALLOW_MEDIUM_REMOVAL ] = "ALLOW_MEDIUM_REMOVAL",
1262 [ READ_CAPACITY_10 ] = "READ_CAPACITY_10",
1263 [ READ_10 ] = "READ_10",
1264 [ WRITE_10 ] = "WRITE_10",
1265 [ SEEK_10 ] = "SEEK_10/POSITION_TO_ELEMENT",
1266 /* SEEK_10 and POSITION_TO_ELEMENT use the same operation code */
1267 [ WRITE_VERIFY_10 ] = "WRITE_VERIFY_10",
1268 [ VERIFY_10 ] = "VERIFY_10",
1269 [ SEARCH_HIGH ] = "SEARCH_HIGH",
1270 [ SEARCH_EQUAL ] = "SEARCH_EQUAL",
1271 [ SEARCH_LOW ] = "SEARCH_LOW",
1272 [ SET_LIMITS ] = "SET_LIMITS",
1273 [ PRE_FETCH ] = "PRE_FETCH/READ_POSITION",
1274 /* READ_POSITION and PRE_FETCH use the same operation code */
1275 [ SYNCHRONIZE_CACHE ] = "SYNCHRONIZE_CACHE",
1276 [ LOCK_UNLOCK_CACHE ] = "LOCK_UNLOCK_CACHE",
1277 [ READ_DEFECT_DATA ] = "READ_DEFECT_DATA/INITIALIZE_ELEMENT_STATUS_WITH_RANGE",
1278 /* READ_DEFECT_DATA and INITIALIZE_ELEMENT_STATUS_WITH_RANGE use the same operation code */
1279 [ MEDIUM_SCAN ] = "MEDIUM_SCAN",
1280 [ COMPARE ] = "COMPARE",
1281 [ COPY_VERIFY ] = "COPY_VERIFY",
1282 [ WRITE_BUFFER ] = "WRITE_BUFFER",
1283 [ READ_BUFFER ] = "READ_BUFFER",
1284 [ UPDATE_BLOCK ] = "UPDATE_BLOCK",
1285 [ READ_LONG_10 ] = "READ_LONG_10",
1286 [ WRITE_LONG_10 ] = "WRITE_LONG_10",
1287 [ CHANGE_DEFINITION ] = "CHANGE_DEFINITION",
1288 [ WRITE_SAME_10 ] = "WRITE_SAME_10",
1289 [ UNMAP ] = "UNMAP",
1290 [ READ_TOC ] = "READ_TOC",
1291 [ REPORT_DENSITY_SUPPORT ] = "REPORT_DENSITY_SUPPORT",
1292 [ SANITIZE ] = "SANITIZE",
1293 [ GET_CONFIGURATION ] = "GET_CONFIGURATION",
1294 [ LOG_SELECT ] = "LOG_SELECT",
1295 [ LOG_SENSE ] = "LOG_SENSE",
1296 [ MODE_SELECT_10 ] = "MODE_SELECT_10",
1297 [ RESERVE_10 ] = "RESERVE_10",
1298 [ RELEASE_10 ] = "RELEASE_10",
1299 [ MODE_SENSE_10 ] = "MODE_SENSE_10",
1300 [ PERSISTENT_RESERVE_IN ] = "PERSISTENT_RESERVE_IN",
1301 [ PERSISTENT_RESERVE_OUT ] = "PERSISTENT_RESERVE_OUT",
1302 [ WRITE_FILEMARKS_16 ] = "WRITE_FILEMARKS_16",
1303 [ EXTENDED_COPY ] = "EXTENDED_COPY",
1304 [ ATA_PASSTHROUGH ] = "ATA_PASSTHROUGH",
1305 [ ACCESS_CONTROL_IN ] = "ACCESS_CONTROL_IN",
1306 [ ACCESS_CONTROL_OUT ] = "ACCESS_CONTROL_OUT",
1307 [ READ_16 ] = "READ_16",
1308 [ COMPARE_AND_WRITE ] = "COMPARE_AND_WRITE",
1309 [ WRITE_16 ] = "WRITE_16",
1310 [ WRITE_VERIFY_16 ] = "WRITE_VERIFY_16",
1311 [ VERIFY_16 ] = "VERIFY_16",
1312 [ PRE_FETCH_16 ] = "PRE_FETCH_16",
1313 [ SYNCHRONIZE_CACHE_16 ] = "SPACE_16/SYNCHRONIZE_CACHE_16",
1314 /* SPACE_16 and SYNCHRONIZE_CACHE_16 use the same operation code */
1315 [ LOCATE_16 ] = "LOCATE_16",
1316 [ WRITE_SAME_16 ] = "ERASE_16/WRITE_SAME_16",
1317 /* ERASE_16 and WRITE_SAME_16 use the same operation code */
1318 [ SERVICE_ACTION_IN_16 ] = "SERVICE_ACTION_IN_16",
1319 [ WRITE_LONG_16 ] = "WRITE_LONG_16",
1320 [ REPORT_LUNS ] = "REPORT_LUNS",
1321 [ BLANK ] = "BLANK",
1322 [ MOVE_MEDIUM ] = "MOVE_MEDIUM",
1323 [ EXCHANGE_MEDIUM ] = "EXCHANGE MEDIUM",
1324 [ LOAD_UNLOAD ] = "LOAD_UNLOAD",
1325 [ READ_12 ] = "READ_12",
1326 [ WRITE_12 ] = "WRITE_12",
1327 [ ERASE_12 ] = "ERASE_12/GET_PERFORMANCE",
1328 /* ERASE_12 and GET_PERFORMANCE use the same operation code */
1329 [ SERVICE_ACTION_IN_12 ] = "SERVICE_ACTION_IN_12",
1330 [ WRITE_VERIFY_12 ] = "WRITE_VERIFY_12",
1331 [ VERIFY_12 ] = "VERIFY_12",
1332 [ SEARCH_HIGH_12 ] = "SEARCH_HIGH_12",
1333 [ SEARCH_EQUAL_12 ] = "SEARCH_EQUAL_12",
1334 [ SEARCH_LOW_12 ] = "SEARCH_LOW_12",
1335 [ READ_ELEMENT_STATUS ] = "READ_ELEMENT_STATUS",
1336 [ SEND_VOLUME_TAG ] = "SEND_VOLUME_TAG/SET_STREAMING",
1337 /* SEND_VOLUME_TAG and SET_STREAMING use the same operation code */
1338 [ READ_CD ] = "READ_CD",
1339 [ READ_DEFECT_DATA_12 ] = "READ_DEFECT_DATA_12",
1340 [ READ_DVD_STRUCTURE ] = "READ_DVD_STRUCTURE",
1341 [ RESERVE_TRACK ] = "RESERVE_TRACK",
1342 [ SEND_CUE_SHEET ] = "SEND_CUE_SHEET",
1343 [ SEND_DVD_STRUCTURE ] = "SEND_DVD_STRUCTURE",
1344 [ SET_CD_SPEED ] = "SET_CD_SPEED",
1345 [ SET_READ_AHEAD ] = "SET_READ_AHEAD",
1346 [ ALLOW_OVERWRITE ] = "ALLOW_OVERWRITE",
1347 [ MECHANISM_STATUS ] = "MECHANISM_STATUS",
1348 };
1349
1350 if (cmd >= ARRAY_SIZE(names) || names[cmd] == NULL)
1351 return "*UNKNOWN*";
1352 return names[cmd];
1353 }
1354
1355 SCSIRequest *scsi_req_ref(SCSIRequest *req)
1356 {
1357 assert(req->refcount > 0);
1358 req->refcount++;
1359 return req;
1360 }
1361
1362 void scsi_req_unref(SCSIRequest *req)
1363 {
1364 assert(req->refcount > 0);
1365 if (--req->refcount == 0) {
1366 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, req->dev->qdev.parent_bus);
1367 if (bus->info->free_request && req->hba_private) {
1368 bus->info->free_request(bus, req->hba_private);
1369 }
1370 if (req->ops->free_req) {
1371 req->ops->free_req(req);
1372 }
1373 g_free(req);
1374 }
1375 }
1376
1377 /* Tell the device that we finished processing this chunk of I/O. It
1378 will start the next chunk or complete the command. */
1379 void scsi_req_continue(SCSIRequest *req)
1380 {
1381 trace_scsi_req_continue(req->dev->id, req->lun, req->tag);
1382 if (req->cmd.mode == SCSI_XFER_TO_DEV) {
1383 req->ops->write_data(req);
1384 } else {
1385 req->ops->read_data(req);
1386 }
1387 }
1388
1389 /* Called by the devices when data is ready for the HBA. The HBA should
1390 start a DMA operation to read or fill the device's data buffer.
1391 Once it completes, calling scsi_req_continue will restart I/O. */
1392 void scsi_req_data(SCSIRequest *req, int len)
1393 {
1394 uint8_t *buf;
1395 if (req->io_canceled) {
1396 trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len);
1397 return;
1398 }
1399 trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);
1400 assert(req->cmd.mode != SCSI_XFER_NONE);
1401 if (!req->sg) {
1402 req->resid -= len;
1403 req->bus->info->transfer_data(req, len);
1404 return;
1405 }
1406
1407 /* If the device calls scsi_req_data and the HBA specified a
1408 * scatter/gather list, the transfer has to happen in a single
1409 * step. */
1410 assert(!req->dma_started);
1411 req->dma_started = true;
1412
1413 buf = scsi_req_get_buf(req);
1414 if (req->cmd.mode == SCSI_XFER_FROM_DEV) {
1415 req->resid = dma_buf_read(buf, len, req->sg);
1416 } else {
1417 req->resid = dma_buf_write(buf, len, req->sg);
1418 }
1419 scsi_req_continue(req);
1420 }
1421
1422 void scsi_req_print(SCSIRequest *req)
1423 {
1424 FILE *fp = stderr;
1425 int i;
1426
1427 fprintf(fp, "[%s id=%d] %s",
1428 req->dev->qdev.parent_bus->name,
1429 req->dev->id,
1430 scsi_command_name(req->cmd.buf[0]));
1431 for (i = 1; i < req->cmd.len; i++) {
1432 fprintf(fp, " 0x%02x", req->cmd.buf[i]);
1433 }
1434 switch (req->cmd.mode) {
1435 case SCSI_XFER_NONE:
1436 fprintf(fp, " - none\n");
1437 break;
1438 case SCSI_XFER_FROM_DEV:
1439 fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer);
1440 break;
1441 case SCSI_XFER_TO_DEV:
1442 fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer);
1443 break;
1444 default:
1445 fprintf(fp, " - Oops\n");
1446 break;
1447 }
1448 }
1449
1450 void scsi_req_complete(SCSIRequest *req, int status)
1451 {
1452 assert(req->status == -1);
1453 req->status = status;
1454
1455 assert(req->sense_len <= sizeof(req->sense));
1456 if (status == GOOD) {
1457 req->sense_len = 0;
1458 }
1459
1460 if (req->sense_len) {
1461 memcpy(req->dev->sense, req->sense, req->sense_len);
1462 req->dev->sense_len = req->sense_len;
1463 req->dev->sense_is_ua = (req->ops == &reqops_unit_attention);
1464 } else {
1465 req->dev->sense_len = 0;
1466 req->dev->sense_is_ua = false;
1467 }
1468
1469 /*
1470 * Unit attention state is now stored in the device's sense buffer
1471 * if the HBA didn't do autosense. Clear the pending unit attention
1472 * flags.
1473 */
1474 scsi_clear_unit_attention(req);
1475
1476 scsi_req_ref(req);
1477 scsi_req_dequeue(req);
1478 req->bus->info->complete(req, req->status, req->resid);
1479 scsi_req_unref(req);
1480 }
1481
1482 void scsi_req_cancel(SCSIRequest *req)
1483 {
1484 if (!req->enqueued) {
1485 return;
1486 }
1487 scsi_req_ref(req);
1488 scsi_req_dequeue(req);
1489 req->io_canceled = true;
1490 if (req->ops->cancel_io) {
1491 req->ops->cancel_io(req);
1492 }
1493 if (req->bus->info->cancel) {
1494 req->bus->info->cancel(req);
1495 }
1496 scsi_req_unref(req);
1497 }
1498
1499 void scsi_req_abort(SCSIRequest *req, int status)
1500 {
1501 if (!req->enqueued) {
1502 return;
1503 }
1504 scsi_req_ref(req);
1505 scsi_req_dequeue(req);
1506 req->io_canceled = true;
1507 if (req->ops->cancel_io) {
1508 req->ops->cancel_io(req);
1509 }
1510 scsi_req_complete(req, status);
1511 scsi_req_unref(req);
1512 }
1513
1514 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
1515 {
1516 SCSIRequest *req;
1517
1518 while (!QTAILQ_EMPTY(&sdev->requests)) {
1519 req = QTAILQ_FIRST(&sdev->requests);
1520 scsi_req_cancel(req);
1521 }
1522 sdev->unit_attention = sense;
1523 }
1524
1525 static char *scsibus_get_dev_path(DeviceState *dev)
1526 {
1527 SCSIDevice *d = DO_UPCAST(SCSIDevice, qdev, dev);
1528 DeviceState *hba = dev->parent_bus->parent;
1529 char *id;
1530 char *path;
1531
1532 id = qdev_get_dev_path(hba);
1533 if (id) {
1534 path = g_strdup_printf("%s/%d:%d:%d", id, d->channel, d->id, d->lun);
1535 } else {
1536 path = g_strdup_printf("%d:%d:%d", d->channel, d->id, d->lun);
1537 }
1538 g_free(id);
1539 return path;
1540 }
1541
1542 static char *scsibus_get_fw_dev_path(DeviceState *dev)
1543 {
1544 SCSIDevice *d = SCSI_DEVICE(dev);
1545 char path[100];
1546
1547 snprintf(path, sizeof(path), "channel@%x/%s@%x,%x", d->channel,
1548 qdev_fw_name(dev), d->id, d->lun);
1549
1550 return strdup(path);
1551 }
1552
1553 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
1554 {
1555 BusChild *kid;
1556 SCSIDevice *target_dev = NULL;
1557
1558 QTAILQ_FOREACH_REVERSE(kid, &bus->qbus.children, ChildrenHead, sibling) {
1559 DeviceState *qdev = kid->child;
1560 SCSIDevice *dev = SCSI_DEVICE(qdev);
1561
1562 if (dev->channel == channel && dev->id == id) {
1563 if (dev->lun == lun) {
1564 return dev;
1565 }
1566 target_dev = dev;
1567 }
1568 }
1569 return target_dev;
1570 }
1571
1572 /* SCSI request list. For simplicity, pv points to the whole device */
1573
1574 static void put_scsi_requests(QEMUFile *f, void *pv, size_t size)
1575 {
1576 SCSIDevice *s = pv;
1577 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
1578 SCSIRequest *req;
1579
1580 QTAILQ_FOREACH(req, &s->requests, next) {
1581 assert(!req->io_canceled);
1582 assert(req->status == -1);
1583 assert(req->enqueued);
1584
1585 qemu_put_sbyte(f, req->retry ? 1 : 2);
1586 qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf));
1587 qemu_put_be32s(f, &req->tag);
1588 qemu_put_be32s(f, &req->lun);
1589 if (bus->info->save_request) {
1590 bus->info->save_request(f, req);
1591 }
1592 if (req->ops->save_request) {
1593 req->ops->save_request(f, req);
1594 }
1595 }
1596 qemu_put_sbyte(f, 0);
1597 }
1598
1599 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size)
1600 {
1601 SCSIDevice *s = pv;
1602 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
1603 int8_t sbyte;
1604
1605 while ((sbyte = qemu_get_sbyte(f)) > 0) {
1606 uint8_t buf[SCSI_CMD_BUF_SIZE];
1607 uint32_t tag;
1608 uint32_t lun;
1609 SCSIRequest *req;
1610
1611 qemu_get_buffer(f, buf, sizeof(buf));
1612 qemu_get_be32s(f, &tag);
1613 qemu_get_be32s(f, &lun);
1614 req = scsi_req_new(s, tag, lun, buf, NULL);
1615 req->retry = (sbyte == 1);
1616 if (bus->info->load_request) {
1617 req->hba_private = bus->info->load_request(f, req);
1618 }
1619 if (req->ops->load_request) {
1620 req->ops->load_request(f, req);
1621 }
1622
1623 /* Just restart it later. */
1624 scsi_req_enqueue_internal(req);
1625
1626 /* At this point, the request will be kept alive by the reference
1627 * added by scsi_req_enqueue_internal, so we can release our reference.
1628 * The HBA of course will add its own reference in the load_request
1629 * callback if it needs to hold on the SCSIRequest.
1630 */
1631 scsi_req_unref(req);
1632 }
1633
1634 return 0;
1635 }
1636
1637 static const VMStateInfo vmstate_info_scsi_requests = {
1638 .name = "scsi-requests",
1639 .get = get_scsi_requests,
1640 .put = put_scsi_requests,
1641 };
1642
1643 const VMStateDescription vmstate_scsi_device = {
1644 .name = "SCSIDevice",
1645 .version_id = 1,
1646 .minimum_version_id = 1,
1647 .minimum_version_id_old = 1,
1648 .fields = (VMStateField[]) {
1649 VMSTATE_UINT8(unit_attention.key, SCSIDevice),
1650 VMSTATE_UINT8(unit_attention.asc, SCSIDevice),
1651 VMSTATE_UINT8(unit_attention.ascq, SCSIDevice),
1652 VMSTATE_BOOL(sense_is_ua, SCSIDevice),
1653 VMSTATE_UINT8_ARRAY(sense, SCSIDevice, SCSI_SENSE_BUF_SIZE),
1654 VMSTATE_UINT32(sense_len, SCSIDevice),
1655 {
1656 .name = "requests",
1657 .version_id = 0,
1658 .field_exists = NULL,
1659 .size = 0, /* ouch */
1660 .info = &vmstate_info_scsi_requests,
1661 .flags = VMS_SINGLE,
1662 .offset = 0,
1663 },
1664 VMSTATE_END_OF_LIST()
1665 }
1666 };
1667
1668 static void scsi_device_class_init(ObjectClass *klass, void *data)
1669 {
1670 DeviceClass *k = DEVICE_CLASS(klass);
1671 k->bus_type = TYPE_SCSI_BUS;
1672 k->init = scsi_qdev_init;
1673 k->unplug = qdev_simple_unplug_cb;
1674 k->exit = scsi_qdev_exit;
1675 k->props = scsi_props;
1676 }
1677
1678 static TypeInfo scsi_device_type_info = {
1679 .name = TYPE_SCSI_DEVICE,
1680 .parent = TYPE_DEVICE,
1681 .instance_size = sizeof(SCSIDevice),
1682 .abstract = true,
1683 .class_size = sizeof(SCSIDeviceClass),
1684 .class_init = scsi_device_class_init,
1685 };
1686
1687 static void scsi_register_types(void)
1688 {
1689 type_register_static(&scsi_bus_info);
1690 type_register_static(&scsi_device_type_info);
1691 }
1692
1693 type_init(scsi_register_types)
QEMU modified to work with kvm