?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
pseries: Correctly create ibm,segment-page-sizes property
[qemu.git] / hw / scsi-bus.c
blob14e2f730b827880b488f4ffc5ac9c1380b660686
1 #include "hw.h"
2 #include "qemu-error.h"
3 #include "scsi.h"
4 #include "scsi-defs.h"
5 #include "qdev.h"
6 #include "blockdev.h"
7 #include "trace.h"
8 #include "dma.h"
9
10 static char *scsibus_get_dev_path(DeviceState *dev);
11 static char *scsibus_get_fw_dev_path(DeviceState *dev);
12 static int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf);
13 static void scsi_req_dequeue(SCSIRequest *req);
14
15 static Property scsi_props[] = {
16 DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0),
17 DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1),
18 DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1),
19 DEFINE_PROP_END_OF_LIST(),
20 };
21
22 static void scsi_bus_class_init(ObjectClass *klass, void *data)
23 {
24 BusClass *k = BUS_CLASS(klass);
25
26 k->get_dev_path = scsibus_get_dev_path;
27 k->get_fw_dev_path = scsibus_get_fw_dev_path;
28 }
29
30 static const TypeInfo scsi_bus_info = {
31 .name = TYPE_SCSI_BUS,
32 .parent = TYPE_BUS,
33 .instance_size = sizeof(SCSIBus),
34 .class_init = scsi_bus_class_init,
35 };
36 static int next_scsi_bus;
37
38 static int scsi_device_init(SCSIDevice *s)
39 {
40 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
41 if (sc->init) {
42 return sc->init(s);
43 }
44 return 0;
45 }
46
47 static void scsi_device_destroy(SCSIDevice *s)
48 {
49 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
50 if (sc->destroy) {
51 sc->destroy(s);
52 }
53 }
54
55 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun,
56 uint8_t *buf, void *hba_private)
57 {
58 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
59 if (sc->alloc_req) {
60 return sc->alloc_req(s, tag, lun, buf, hba_private);
61 }
62
63 return NULL;
64 }
65
66 static void scsi_device_unit_attention_reported(SCSIDevice *s)
67 {
68 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
69 if (sc->unit_attention_reported) {
70 sc->unit_attention_reported(s);
71 }
72 }
73
74 /* Create a scsi bus, and attach devices to it. */
75 void scsi_bus_new(SCSIBus *bus, DeviceState *host, const SCSIBusInfo *info)
76 {
77 qbus_create_inplace(&bus->qbus, TYPE_SCSI_BUS, host, NULL);
78 bus->busnr = next_scsi_bus++;
79 bus->info = info;
80 bus->qbus.allow_hotplug = 1;
81 }
82
83 static void scsi_dma_restart_bh(void *opaque)
84 {
85 SCSIDevice *s = opaque;
86 SCSIRequest *req, *next;
87
88 qemu_bh_delete(s->bh);
89 s->bh = NULL;
90
91 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
92 scsi_req_ref(req);
93 if (req->retry) {
94 req->retry = false;
95 switch (req->cmd.mode) {
96 case SCSI_XFER_FROM_DEV:
97 case SCSI_XFER_TO_DEV:
98 scsi_req_continue(req);
99 break;
100 case SCSI_XFER_NONE:
101 assert(!req->sg);
102 scsi_req_dequeue(req);
103 scsi_req_enqueue(req);
104 break;
105 }
106 }
107 scsi_req_unref(req);
108 }
109 }
110
111 void scsi_req_retry(SCSIRequest *req)
112 {
113 /* No need to save a reference, because scsi_dma_restart_bh just
114 * looks at the request list. */
115 req->retry = true;
116 }
117
118 static void scsi_dma_restart_cb(void *opaque, int running, RunState state)
119 {
120 SCSIDevice *s = opaque;
121
122 if (!running) {
123 return;
124 }
125 if (!s->bh) {
126 s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
127 qemu_bh_schedule(s->bh);
128 }
129 }
130
131 static int scsi_qdev_init(DeviceState *qdev)
132 {
133 SCSIDevice *dev = SCSI_DEVICE(qdev);
134 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
135 SCSIDevice *d;
136 int rc = -1;
137
138 if (dev->channel > bus->info->max_channel) {
139 error_report("bad scsi channel id: %d", dev->channel);
140 goto err;
141 }
142 if (dev->id != -1 && dev->id > bus->info->max_target) {
143 error_report("bad scsi device id: %d", dev->id);
144 goto err;
145 }
146 if (dev->lun != -1 && dev->lun > bus->info->max_lun) {
147 error_report("bad scsi device lun: %d", dev->lun);
148 goto err;
149 }
150
151 if (dev->id == -1) {
152 int id = -1;
153 if (dev->lun == -1) {
154 dev->lun = 0;
155 }
156 do {
157 d = scsi_device_find(bus, dev->channel, ++id, dev->lun);
158 } while (d && d->lun == dev->lun && id < bus->info->max_target);
159 if (d && d->lun == dev->lun) {
160 error_report("no free target");
161 goto err;
162 }
163 dev->id = id;
164 } else if (dev->lun == -1) {
165 int lun = -1;
166 do {
167 d = scsi_device_find(bus, dev->channel, dev->id, ++lun);
168 } while (d && d->lun == lun && lun < bus->info->max_lun);
169 if (d && d->lun == lun) {
170 error_report("no free lun");
171 goto err;
172 }
173 dev->lun = lun;
174 } else {
175 d = scsi_device_find(bus, dev->channel, dev->id, dev->lun);
176 assert(d);
177 if (d->lun == dev->lun && dev != d) {
178 qdev_free(&d->qdev);
179 }
180 }
181
182 QTAILQ_INIT(&dev->requests);
183 rc = scsi_device_init(dev);
184 if (rc == 0) {
185 dev->vmsentry = qemu_add_vm_change_state_handler(scsi_dma_restart_cb,
186 dev);
187 }
188
189 err:
190 return rc;
191 }
192
193 static int scsi_qdev_exit(DeviceState *qdev)
194 {
195 SCSIDevice *dev = SCSI_DEVICE(qdev);
196
197 if (dev->vmsentry) {
198 qemu_del_vm_change_state_handler(dev->vmsentry);
199 }
200 scsi_device_destroy(dev);
201 return 0;
202 }
203
204 /* handle legacy '-drive if=scsi,...' cmd line args */
205 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
206 int unit, bool removable, int bootindex)
207 {
208 const char *driver;
209 DeviceState *dev;
210
211 driver = bdrv_is_sg(bdrv) ? "scsi-generic" : "scsi-disk";
212 dev = qdev_create(&bus->qbus, driver);
213 qdev_prop_set_uint32(dev, "scsi-id", unit);
214 if (bootindex >= 0) {
215 qdev_prop_set_int32(dev, "bootindex", bootindex);
216 }
217 if (object_property_find(OBJECT(dev), "removable", NULL)) {
218 qdev_prop_set_bit(dev, "removable", removable);
219 }
220 if (qdev_prop_set_drive(dev, "drive", bdrv) < 0) {
221 qdev_free(dev);
222 return NULL;
223 }
224 if (qdev_init(dev) < 0)
225 return NULL;
226 return SCSI_DEVICE(dev);
227 }
228
229 int scsi_bus_legacy_handle_cmdline(SCSIBus *bus)
230 {
231 Location loc;
232 DriveInfo *dinfo;
233 int res = 0, unit;
234
235 loc_push_none(&loc);
236 for (unit = 0; unit <= bus->info->max_target; unit++) {
237 dinfo = drive_get(IF_SCSI, bus->busnr, unit);
238 if (dinfo == NULL) {
239 continue;
240 }
241 qemu_opts_loc_restore(dinfo->opts);
242 if (!scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit, false, -1)) {
243 res = -1;
244 break;
245 }
246 }
247 loc_pop(&loc);
248 return res;
249 }
250
251 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf)
252 {
253 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
254 scsi_req_complete(req, CHECK_CONDITION);
255 return 0;
256 }
257
258 static const struct SCSIReqOps reqops_invalid_field = {
259 .size = sizeof(SCSIRequest),
260 .send_command = scsi_invalid_field
261 };
262
263 /* SCSIReqOps implementation for invalid commands. */
264
265 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf)
266 {
267 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE));
268 scsi_req_complete(req, CHECK_CONDITION);
269 return 0;
270 }
271
272 static const struct SCSIReqOps reqops_invalid_opcode = {
273 .size = sizeof(SCSIRequest),
274 .send_command = scsi_invalid_command
275 };
276
277 /* SCSIReqOps implementation for unit attention conditions. */
278
279 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
280 {
281 if (req->dev && req->dev->unit_attention.key == UNIT_ATTENTION) {
282 scsi_req_build_sense(req, req->dev->unit_attention);
283 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
284 scsi_req_build_sense(req, req->bus->unit_attention);
285 }
286 scsi_req_complete(req, CHECK_CONDITION);
287 return 0;
288 }
289
290 static const struct SCSIReqOps reqops_unit_attention = {
291 .size = sizeof(SCSIRequest),
292 .send_command = scsi_unit_attention
293 };
294
295 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to
296 an invalid LUN. */
297
298 typedef struct SCSITargetReq SCSITargetReq;
299
300 struct SCSITargetReq {
301 SCSIRequest req;
302 int len;
303 uint8_t buf[2056];
304 };
305
306 static void store_lun(uint8_t *outbuf, int lun)
307 {
308 if (lun < 256) {
309 outbuf[1] = lun;
310 return;
311 }
312 outbuf[1] = (lun & 255);
313 outbuf[0] = (lun >> 8) | 0x40;
314 }
315
316 static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
317 {
318 BusChild *kid;
319 int i, len, n;
320 int channel, id;
321 bool found_lun0;
322
323 if (r->req.cmd.xfer < 16) {
324 return false;
325 }
326 if (r->req.cmd.buf[2] > 2) {
327 return false;
328 }
329 channel = r->req.dev->channel;
330 id = r->req.dev->id;
331 found_lun0 = false;
332 n = 0;
333 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) {
334 DeviceState *qdev = kid->child;
335 SCSIDevice *dev = SCSI_DEVICE(qdev);
336
337 if (dev->channel == channel && dev->id == id) {
338 if (dev->lun == 0) {
339 found_lun0 = true;
340 }
341 n += 8;
342 }
343 }
344 if (!found_lun0) {
345 n += 8;
346 }
347 len = MIN(n + 8, r->req.cmd.xfer & ~7);
348 if (len > sizeof(r->buf)) {
349 /* TODO: > 256 LUNs? */
350 return false;
351 }
352
353 memset(r->buf, 0, len);
354 stl_be_p(&r->buf, n);
355 i = found_lun0 ? 8 : 16;
356 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) {
357 DeviceState *qdev = kid->child;
358 SCSIDevice *dev = SCSI_DEVICE(qdev);
359
360 if (dev->channel == channel && dev->id == id) {
361 store_lun(&r->buf[i], dev->lun);
362 i += 8;
363 }
364 }
365 assert(i == n + 8);
366 r->len = len;
367 return true;
368 }
369
370 static bool scsi_target_emulate_inquiry(SCSITargetReq *r)
371 {
372 assert(r->req.dev->lun != r->req.lun);
373 if (r->req.cmd.buf[1] & 0x2) {
374 /* Command support data - optional, not implemented */
375 return false;
376 }
377
378 if (r->req.cmd.buf[1] & 0x1) {
379 /* Vital product data */
380 uint8_t page_code = r->req.cmd.buf[2];
381 r->buf[r->len++] = page_code ; /* this page */
382 r->buf[r->len++] = 0x00;
383
384 switch (page_code) {
385 case 0x00: /* Supported page codes, mandatory */
386 {
387 int pages;
388 pages = r->len++;
389 r->buf[r->len++] = 0x00; /* list of supported pages (this page) */
390 r->buf[pages] = r->len - pages - 1; /* number of pages */
391 break;
392 }
393 default:
394 return false;
395 }
396 /* done with EVPD */
397 assert(r->len < sizeof(r->buf));
398 r->len = MIN(r->req.cmd.xfer, r->len);
399 return true;
400 }
401
402 /* Standard INQUIRY data */
403 if (r->req.cmd.buf[2] != 0) {
404 return false;
405 }
406
407 /* PAGE CODE == 0 */
408 r->len = MIN(r->req.cmd.xfer, 36);
409 memset(r->buf, 0, r->len);
410 if (r->req.lun != 0) {
411 r->buf[0] = TYPE_NO_LUN;
412 } else {
413 r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE;
414 r->buf[2] = 5; /* Version */
415 r->buf[3] = 2 | 0x10; /* HiSup, response data format */
416 r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */
417 r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ. */
418 memcpy(&r->buf[8], "QEMU ", 8);
419 memcpy(&r->buf[16], "QEMU TARGET ", 16);
420 pstrcpy((char *) &r->buf[32], 4, qemu_get_version());
421 }
422 return true;
423 }
424
425 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf)
426 {
427 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
428
429 switch (buf[0]) {
430 case REPORT_LUNS:
431 if (!scsi_target_emulate_report_luns(r)) {
432 goto illegal_request;
433 }
434 break;
435 case INQUIRY:
436 if (!scsi_target_emulate_inquiry(r)) {
437 goto illegal_request;
438 }
439 break;
440 case REQUEST_SENSE:
441 r->len = scsi_device_get_sense(r->req.dev, r->buf,
442 MIN(req->cmd.xfer, sizeof r->buf),
443 (req->cmd.buf[1] & 1) == 0);
444 if (r->req.dev->sense_is_ua) {
445 scsi_device_unit_attention_reported(req->dev);
446 r->req.dev->sense_len = 0;
447 r->req.dev->sense_is_ua = false;
448 }
449 break;
450 default:
451 scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED));
452 scsi_req_complete(req, CHECK_CONDITION);
453 return 0;
454 illegal_request:
455 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
456 scsi_req_complete(req, CHECK_CONDITION);
457 return 0;
458 }
459
460 if (!r->len) {
461 scsi_req_complete(req, GOOD);
462 }
463 return r->len;
464 }
465
466 static void scsi_target_read_data(SCSIRequest *req)
467 {
468 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
469 uint32_t n;
470
471 n = r->len;
472 if (n > 0) {
473 r->len = 0;
474 scsi_req_data(&r->req, n);
475 } else {
476 scsi_req_complete(&r->req, GOOD);
477 }
478 }
479
480 static uint8_t *scsi_target_get_buf(SCSIRequest *req)
481 {
482 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
483
484 return r->buf;
485 }
486
487 static const struct SCSIReqOps reqops_target_command = {
488 .size = sizeof(SCSITargetReq),
489 .send_command = scsi_target_send_command,
490 .read_data = scsi_target_read_data,
491 .get_buf = scsi_target_get_buf,
492 };
493
494
495 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
496 uint32_t tag, uint32_t lun, void *hba_private)
497 {
498 SCSIRequest *req;
499
500 req = g_malloc0(reqops->size);
501 req->refcount = 1;
502 req->bus = scsi_bus_from_device(d);
503 req->dev = d;
504 req->tag = tag;
505 req->lun = lun;
506 req->hba_private = hba_private;
507 req->status = -1;
508 req->sense_len = 0;
509 req->ops = reqops;
510 trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
511 return req;
512 }
513
514 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,
515 uint8_t *buf, void *hba_private)
516 {
517 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus);
518 SCSIRequest *req;
519 SCSICommand cmd;
520
521 if (scsi_req_parse(&cmd, d, buf) != 0) {
522 trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]);
523 req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private);
524 } else {
525 trace_scsi_req_parsed(d->id, lun, tag, buf[0],
526 cmd.mode, cmd.xfer);
527 if (cmd.lba != -1) {
528 trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0],
529 cmd.lba);
530 }
531
532 if (cmd.xfer > INT32_MAX) {
533 req = scsi_req_alloc(&reqops_invalid_field, d, tag, lun, hba_private);
534 } else if ((d->unit_attention.key == UNIT_ATTENTION ||
535 bus->unit_attention.key == UNIT_ATTENTION) &&
536 (buf[0] != INQUIRY &&
537 buf[0] != REPORT_LUNS &&
538 buf[0] != GET_CONFIGURATION &&
539 buf[0] != GET_EVENT_STATUS_NOTIFICATION &&
540
541 /*
542 * If we already have a pending unit attention condition,
543 * report this one before triggering another one.
544 */
545 !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) {
546 req = scsi_req_alloc(&reqops_unit_attention, d, tag, lun,
547 hba_private);
548 } else if (lun != d->lun ||
549 buf[0] == REPORT_LUNS ||
550 (buf[0] == REQUEST_SENSE && d->sense_len)) {
551 req = scsi_req_alloc(&reqops_target_command, d, tag, lun,
552 hba_private);
553 } else {
554 req = scsi_device_alloc_req(d, tag, lun, buf, hba_private);
555 }
556 }
557
558 req->cmd = cmd;
559 req->resid = req->cmd.xfer;
560
561 switch (buf[0]) {
562 case INQUIRY:
563 trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]);
564 break;
565 case TEST_UNIT_READY:
566 trace_scsi_test_unit_ready(d->id, lun, tag);
567 break;
568 case REPORT_LUNS:
569 trace_scsi_report_luns(d->id, lun, tag);
570 break;
571 case REQUEST_SENSE:
572 trace_scsi_request_sense(d->id, lun, tag);
573 break;
574 default:
575 break;
576 }
577
578 return req;
579 }
580
581 uint8_t *scsi_req_get_buf(SCSIRequest *req)
582 {
583 return req->ops->get_buf(req);
584 }
585
586 static void scsi_clear_unit_attention(SCSIRequest *req)
587 {
588 SCSISense *ua;
589 if (req->dev->unit_attention.key != UNIT_ATTENTION &&
590 req->bus->unit_attention.key != UNIT_ATTENTION) {
591 return;
592 }
593
594 /*
595 * If an INQUIRY command enters the enabled command state,
596 * the device server shall [not] clear any unit attention condition;
597 * See also MMC-6, paragraphs 6.5 and 6.6.2.
598 */
599 if (req->cmd.buf[0] == INQUIRY ||
600 req->cmd.buf[0] == GET_CONFIGURATION ||
601 req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) {
602 return;
603 }
604
605 if (req->dev->unit_attention.key == UNIT_ATTENTION) {
606 ua = &req->dev->unit_attention;
607 } else {
608 ua = &req->bus->unit_attention;
609 }
610
611 /*
612 * If a REPORT LUNS command enters the enabled command state, [...]
613 * the device server shall clear any pending unit attention condition
614 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
615 */
616 if (req->cmd.buf[0] == REPORT_LUNS &&
617 !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
618 ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) {
619 return;
620 }
621
622 *ua = SENSE_CODE(NO_SENSE);
623 }
624
625 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len)
626 {
627 int ret;
628
629 assert(len >= 14);
630 if (!req->sense_len) {
631 return 0;
632 }
633
634 ret = scsi_build_sense(req->sense, req->sense_len, buf, len, true);
635
636 /*
637 * FIXME: clearing unit attention conditions upon autosense should be done
638 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
639 * (SAM-5, 5.14).
640 *
641 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
642 * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
643 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
644 */
645 if (req->dev->sense_is_ua) {
646 scsi_device_unit_attention_reported(req->dev);
647 req->dev->sense_len = 0;
648 req->dev->sense_is_ua = false;
649 }
650 return ret;
651 }
652
653 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed)
654 {
655 return scsi_build_sense(dev->sense, dev->sense_len, buf, len, fixed);
656 }
657
658 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense)
659 {
660 trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag,
661 sense.key, sense.asc, sense.ascq);
662 memset(req->sense, 0, 18);
663 req->sense[0] = 0x70;
664 req->sense[2] = sense.key;
665 req->sense[7] = 10;
666 req->sense[12] = sense.asc;
667 req->sense[13] = sense.ascq;
668 req->sense_len = 18;
669 }
670
671 static void scsi_req_enqueue_internal(SCSIRequest *req)
672 {
673 assert(!req->enqueued);
674 scsi_req_ref(req);
675 if (req->bus->info->get_sg_list) {
676 req->sg = req->bus->info->get_sg_list(req);
677 } else {
678 req->sg = NULL;
679 }
680 req->enqueued = true;
681 QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
682 }
683
684 int32_t scsi_req_enqueue(SCSIRequest *req)
685 {
686 int32_t rc;
687
688 assert(!req->retry);
689 scsi_req_enqueue_internal(req);
690 scsi_req_ref(req);
691 rc = req->ops->send_command(req, req->cmd.buf);
692 scsi_req_unref(req);
693 return rc;
694 }
695
696 static void scsi_req_dequeue(SCSIRequest *req)
697 {
698 trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
699 req->retry = false;
700 if (req->enqueued) {
701 QTAILQ_REMOVE(&req->dev->requests, req, next);
702 req->enqueued = false;
703 scsi_req_unref(req);
704 }
705 }
706
707 static int scsi_get_performance_length(int num_desc, int type, int data_type)
708 {
709 /* MMC-6, paragraph 6.7. */
710 switch (type) {
711 case 0:
712 if ((data_type & 3) == 0) {
713 /* Each descriptor is as in Table 295 - Nominal performance. */
714 return 16 * num_desc + 8;
715 } else {
716 /* Each descriptor is as in Table 296 - Exceptions. */
717 return 6 * num_desc + 8;
718 }
719 case 1:
720 case 4:
721 case 5:
722 return 8 * num_desc + 8;
723 case 2:
724 return 2048 * num_desc + 8;
725 case 3:
726 return 16 * num_desc + 8;
727 default:
728 return 8;
729 }
730 }
731
732 static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
733 {
734 switch (buf[0] >> 5) {
735 case 0:
736 cmd->xfer = buf[4];
737 cmd->len = 6;
738 break;
739 case 1:
740 case 2:
741 cmd->xfer = lduw_be_p(&buf[7]);
742 cmd->len = 10;
743 break;
744 case 4:
745 cmd->xfer = ldl_be_p(&buf[10]) & 0xffffffffULL;
746 cmd->len = 16;
747 break;
748 case 5:
749 cmd->xfer = ldl_be_p(&buf[6]) & 0xffffffffULL;
750 cmd->len = 12;
751 break;
752 default:
753 return -1;
754 }
755
756 switch (buf[0]) {
757 case TEST_UNIT_READY:
758 case REWIND:
759 case START_STOP:
760 case SET_CAPACITY:
761 case WRITE_FILEMARKS:
762 case WRITE_FILEMARKS_16:
763 case SPACE:
764 case RESERVE:
765 case RELEASE:
766 case ERASE:
767 case ALLOW_MEDIUM_REMOVAL:
768 case VERIFY_10:
769 case SEEK_10:
770 case SYNCHRONIZE_CACHE:
771 case SYNCHRONIZE_CACHE_16:
772 case LOCATE_16:
773 case LOCK_UNLOCK_CACHE:
774 case LOAD_UNLOAD:
775 case SET_CD_SPEED:
776 case SET_LIMITS:
777 case WRITE_LONG_10:
778 case MOVE_MEDIUM:
779 case UPDATE_BLOCK:
780 case RESERVE_TRACK:
781 case SET_READ_AHEAD:
782 case PRE_FETCH:
783 case PRE_FETCH_16:
784 case ALLOW_OVERWRITE:
785 cmd->xfer = 0;
786 break;
787 case MODE_SENSE:
788 break;
789 case WRITE_SAME_10:
790 case WRITE_SAME_16:
791 cmd->xfer = dev->blocksize;
792 break;
793 case READ_CAPACITY_10:
794 cmd->xfer = 8;
795 break;
796 case READ_BLOCK_LIMITS:
797 cmd->xfer = 6;
798 break;
799 case SEND_VOLUME_TAG:
800 /* GPCMD_SET_STREAMING from multimedia commands. */
801 if (dev->type == TYPE_ROM) {
802 cmd->xfer = buf[10] | (buf[9] << 8);
803 } else {
804 cmd->xfer = buf[9] | (buf[8] << 8);
805 }
806 break;
807 case WRITE_6:
808 /* length 0 means 256 blocks */
809 if (cmd->xfer == 0) {
810 cmd->xfer = 256;
811 }
812 case WRITE_10:
813 case WRITE_VERIFY_10:
814 case WRITE_12:
815 case WRITE_VERIFY_12:
816 case WRITE_16:
817 case WRITE_VERIFY_16:
818 cmd->xfer *= dev->blocksize;
819 break;
820 case READ_6:
821 case READ_REVERSE:
822 /* length 0 means 256 blocks */
823 if (cmd->xfer == 0) {
824 cmd->xfer = 256;
825 }
826 case READ_10:
827 case RECOVER_BUFFERED_DATA:
828 case READ_12:
829 case READ_16:
830 cmd->xfer *= dev->blocksize;
831 break;
832 case FORMAT_UNIT:
833 /* MMC mandates the parameter list to be 12-bytes long. Parameters
834 * for block devices are restricted to the header right now. */
835 if (dev->type == TYPE_ROM && (buf[1] & 16)) {
836 cmd->xfer = 12;
837 } else {
838 cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4);
839 }
840 break;
841 case INQUIRY:
842 case RECEIVE_DIAGNOSTIC:
843 case SEND_DIAGNOSTIC:
844 cmd->xfer = buf[4] | (buf[3] << 8);
845 break;
846 case READ_CD:
847 case READ_BUFFER:
848 case WRITE_BUFFER:
849 case SEND_CUE_SHEET:
850 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16);
851 break;
852 case PERSISTENT_RESERVE_OUT:
853 cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL;
854 break;
855 case ERASE_12:
856 if (dev->type == TYPE_ROM) {
857 /* MMC command GET PERFORMANCE. */
858 cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8),
859 buf[10], buf[1] & 0x1f);
860 }
861 break;
862 case MECHANISM_STATUS:
863 case READ_DVD_STRUCTURE:
864 case SEND_DVD_STRUCTURE:
865 case MAINTENANCE_OUT:
866 case MAINTENANCE_IN:
867 if (dev->type == TYPE_ROM) {
868 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
869 cmd->xfer = buf[9] | (buf[8] << 8);
870 }
871 break;
872 }
873 return 0;
874 }
875
876 static int scsi_req_stream_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
877 {
878 switch (buf[0]) {
879 /* stream commands */
880 case ERASE_12:
881 case ERASE_16:
882 cmd->xfer = 0;
883 break;
884 case READ_6:
885 case READ_REVERSE:
886 case RECOVER_BUFFERED_DATA:
887 case WRITE_6:
888 cmd->len = 6;
889 cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16);
890 if (buf[1] & 0x01) { /* fixed */
891 cmd->xfer *= dev->blocksize;
892 }
893 break;
894 case READ_16:
895 case READ_REVERSE_16:
896 case VERIFY_16:
897 case WRITE_16:
898 cmd->len = 16;
899 cmd->xfer = buf[14] | (buf[13] << 8) | (buf[12] << 16);
900 if (buf[1] & 0x01) { /* fixed */
901 cmd->xfer *= dev->blocksize;
902 }
903 break;
904 case REWIND:
905 case START_STOP:
906 cmd->len = 6;
907 cmd->xfer = 0;
908 break;
909 case SPACE_16:
910 cmd->xfer = buf[13] | (buf[12] << 8);
911 break;
912 case READ_POSITION:
913 cmd->xfer = buf[8] | (buf[7] << 8);
914 break;
915 case FORMAT_UNIT:
916 cmd->xfer = buf[4] | (buf[3] << 8);
917 break;
918 /* generic commands */
919 default:
920 return scsi_req_length(cmd, dev, buf);
921 }
922 return 0;
923 }
924
925 static void scsi_cmd_xfer_mode(SCSICommand *cmd)
926 {
927 if (!cmd->xfer) {
928 cmd->mode = SCSI_XFER_NONE;
929 return;
930 }
931 switch (cmd->buf[0]) {
932 case WRITE_6:
933 case WRITE_10:
934 case WRITE_VERIFY_10:
935 case WRITE_12:
936 case WRITE_VERIFY_12:
937 case WRITE_16:
938 case WRITE_VERIFY_16:
939 case COPY:
940 case COPY_VERIFY:
941 case COMPARE:
942 case CHANGE_DEFINITION:
943 case LOG_SELECT:
944 case MODE_SELECT:
945 case MODE_SELECT_10:
946 case SEND_DIAGNOSTIC:
947 case WRITE_BUFFER:
948 case FORMAT_UNIT:
949 case REASSIGN_BLOCKS:
950 case SEARCH_EQUAL:
951 case SEARCH_HIGH:
952 case SEARCH_LOW:
953 case UPDATE_BLOCK:
954 case WRITE_LONG_10:
955 case WRITE_SAME_10:
956 case WRITE_SAME_16:
957 case UNMAP:
958 case SEARCH_HIGH_12:
959 case SEARCH_EQUAL_12:
960 case SEARCH_LOW_12:
961 case MEDIUM_SCAN:
962 case SEND_VOLUME_TAG:
963 case SEND_CUE_SHEET:
964 case SEND_DVD_STRUCTURE:
965 case PERSISTENT_RESERVE_OUT:
966 case MAINTENANCE_OUT:
967 case ATA_PASSTHROUGH:
968 cmd->mode = SCSI_XFER_TO_DEV;
969 break;
970 default:
971 cmd->mode = SCSI_XFER_FROM_DEV;
972 break;
973 }
974 }
975
976 static uint64_t scsi_cmd_lba(SCSICommand *cmd)
977 {
978 uint8_t *buf = cmd->buf;
979 uint64_t lba;
980
981 switch (buf[0] >> 5) {
982 case 0:
983 lba = ldl_be_p(&buf[0]) & 0x1fffff;
984 break;
985 case 1:
986 case 2:
987 case 5:
988 lba = ldl_be_p(&buf[2]) & 0xffffffffULL;
989 break;
990 case 4:
991 lba = ldq_be_p(&buf[2]);
992 break;
993 default:
994 lba = -1;
995
996 }
997 return lba;
998 }
999
1000 int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
1001 {
1002 int rc;
1003
1004 if (dev->type == TYPE_TAPE) {
1005 rc = scsi_req_stream_length(cmd, dev, buf);
1006 } else {
1007 rc = scsi_req_length(cmd, dev, buf);
1008 }
1009 if (rc != 0)
1010 return rc;
1011
1012 memcpy(cmd->buf, buf, cmd->len);
1013 scsi_cmd_xfer_mode(cmd);
1014 cmd->lba = scsi_cmd_lba(cmd);
1015 return 0;
1016 }
1017
1018 /*
1019 * Predefined sense codes
1020 */
1021
1022 /* No sense data available */
1023 const struct SCSISense sense_code_NO_SENSE = {
1024 .key = NO_SENSE , .asc = 0x00 , .ascq = 0x00
1025 };
1026
1027 /* LUN not ready, Manual intervention required */
1028 const struct SCSISense sense_code_LUN_NOT_READY = {
1029 .key = NOT_READY, .asc = 0x04, .ascq = 0x03
1030 };
1031
1032 /* LUN not ready, Medium not present */
1033 const struct SCSISense sense_code_NO_MEDIUM = {
1034 .key = NOT_READY, .asc = 0x3a, .ascq = 0x00
1035 };
1036
1037 /* LUN not ready, medium removal prevented */
1038 const struct SCSISense sense_code_NOT_READY_REMOVAL_PREVENTED = {
1039 .key = NOT_READY, .asc = 0x53, .ascq = 0x00
1040 };
1041
1042 /* Hardware error, internal target failure */
1043 const struct SCSISense sense_code_TARGET_FAILURE = {
1044 .key = HARDWARE_ERROR, .asc = 0x44, .ascq = 0x00
1045 };
1046
1047 /* Illegal request, invalid command operation code */
1048 const struct SCSISense sense_code_INVALID_OPCODE = {
1049 .key = ILLEGAL_REQUEST, .asc = 0x20, .ascq = 0x00
1050 };
1051
1052 /* Illegal request, LBA out of range */
1053 const struct SCSISense sense_code_LBA_OUT_OF_RANGE = {
1054 .key = ILLEGAL_REQUEST, .asc = 0x21, .ascq = 0x00
1055 };
1056
1057 /* Illegal request, Invalid field in CDB */
1058 const struct SCSISense sense_code_INVALID_FIELD = {
1059 .key = ILLEGAL_REQUEST, .asc = 0x24, .ascq = 0x00
1060 };
1061
1062 /* Illegal request, LUN not supported */
1063 const struct SCSISense sense_code_LUN_NOT_SUPPORTED = {
1064 .key = ILLEGAL_REQUEST, .asc = 0x25, .ascq = 0x00
1065 };
1066
1067 /* Illegal request, Saving parameters not supported */
1068 const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED = {
1069 .key = ILLEGAL_REQUEST, .asc = 0x39, .ascq = 0x00
1070 };
1071
1072 /* Illegal request, Incompatible medium installed */
1073 const struct SCSISense sense_code_INCOMPATIBLE_FORMAT = {
1074 .key = ILLEGAL_REQUEST, .asc = 0x30, .ascq = 0x00
1075 };
1076
1077 /* Illegal request, medium removal prevented */
1078 const struct SCSISense sense_code_ILLEGAL_REQ_REMOVAL_PREVENTED = {
1079 .key = ILLEGAL_REQUEST, .asc = 0x53, .ascq = 0x00
1080 };
1081
1082 /* Command aborted, I/O process terminated */
1083 const struct SCSISense sense_code_IO_ERROR = {
1084 .key = ABORTED_COMMAND, .asc = 0x00, .ascq = 0x06
1085 };
1086
1087 /* Command aborted, I_T Nexus loss occurred */
1088 const struct SCSISense sense_code_I_T_NEXUS_LOSS = {
1089 .key = ABORTED_COMMAND, .asc = 0x29, .ascq = 0x07
1090 };
1091
1092 /* Command aborted, Logical Unit failure */
1093 const struct SCSISense sense_code_LUN_FAILURE = {
1094 .key = ABORTED_COMMAND, .asc = 0x3e, .ascq = 0x01
1095 };
1096
1097 /* Unit attention, Power on, reset or bus device reset occurred */
1098 const struct SCSISense sense_code_RESET = {
1099 .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x00
1100 };
1101
1102 /* Unit attention, No medium */
1103 const struct SCSISense sense_code_UNIT_ATTENTION_NO_MEDIUM = {
1104 .key = UNIT_ATTENTION, .asc = 0x3a, .ascq = 0x00
1105 };
1106
1107 /* Unit attention, Medium may have changed */
1108 const struct SCSISense sense_code_MEDIUM_CHANGED = {
1109 .key = UNIT_ATTENTION, .asc = 0x28, .ascq = 0x00
1110 };
1111
1112 /* Unit attention, Reported LUNs data has changed */
1113 const struct SCSISense sense_code_REPORTED_LUNS_CHANGED = {
1114 .key = UNIT_ATTENTION, .asc = 0x3f, .ascq = 0x0e
1115 };
1116
1117 /* Unit attention, Device internal reset */
1118 const struct SCSISense sense_code_DEVICE_INTERNAL_RESET = {
1119 .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x04
1120 };
1121
1122 /*
1123 * scsi_build_sense
1124 *
1125 * Convert between fixed and descriptor sense buffers
1126 */
1127 int scsi_build_sense(uint8_t *in_buf, int in_len,
1128 uint8_t *buf, int len, bool fixed)
1129 {
1130 bool fixed_in;
1131 SCSISense sense;
1132 if (!fixed && len < 8) {
1133 return 0;
1134 }
1135
1136 if (in_len == 0) {
1137 sense.key = NO_SENSE;
1138 sense.asc = 0;
1139 sense.ascq = 0;
1140 } else {
1141 fixed_in = (in_buf[0] & 2) == 0;
1142
1143 if (fixed == fixed_in) {
1144 memcpy(buf, in_buf, MIN(len, in_len));
1145 return MIN(len, in_len);
1146 }
1147
1148 if (fixed_in) {
1149 sense.key = in_buf[2];
1150 sense.asc = in_buf[12];
1151 sense.ascq = in_buf[13];
1152 } else {
1153 sense.key = in_buf[1];
1154 sense.asc = in_buf[2];
1155 sense.ascq = in_buf[3];
1156 }
1157 }
1158
1159 memset(buf, 0, len);
1160 if (fixed) {
1161 /* Return fixed format sense buffer */
1162 buf[0] = 0x70;
1163 buf[2] = sense.key;
1164 buf[7] = 10;
1165 buf[12] = sense.asc;
1166 buf[13] = sense.ascq;
1167 return MIN(len, 18);
1168 } else {
1169 /* Return descriptor format sense buffer */
1170 buf[0] = 0x72;
1171 buf[1] = sense.key;
1172 buf[2] = sense.asc;
1173 buf[3] = sense.ascq;
1174 return 8;
1175 }
1176 }
1177
1178 static const char *scsi_command_name(uint8_t cmd)
1179 {
1180 static const char *names[] = {
1181 [ TEST_UNIT_READY ] = "TEST_UNIT_READY",
1182 [ REWIND ] = "REWIND",
1183 [ REQUEST_SENSE ] = "REQUEST_SENSE",
1184 [ FORMAT_UNIT ] = "FORMAT_UNIT",
1185 [ READ_BLOCK_LIMITS ] = "READ_BLOCK_LIMITS",
1186 [ REASSIGN_BLOCKS ] = "REASSIGN_BLOCKS",
1187 [ READ_6 ] = "READ_6",
1188 [ WRITE_6 ] = "WRITE_6",
1189 [ SET_CAPACITY ] = "SET_CAPACITY",
1190 [ READ_REVERSE ] = "READ_REVERSE",
1191 [ WRITE_FILEMARKS ] = "WRITE_FILEMARKS",
1192 [ SPACE ] = "SPACE",
1193 [ INQUIRY ] = "INQUIRY",
1194 [ RECOVER_BUFFERED_DATA ] = "RECOVER_BUFFERED_DATA",
1195 [ MAINTENANCE_IN ] = "MAINTENANCE_IN",
1196 [ MAINTENANCE_OUT ] = "MAINTENANCE_OUT",
1197 [ MODE_SELECT ] = "MODE_SELECT",
1198 [ RESERVE ] = "RESERVE",
1199 [ RELEASE ] = "RELEASE",
1200 [ COPY ] = "COPY",
1201 [ ERASE ] = "ERASE",
1202 [ MODE_SENSE ] = "MODE_SENSE",
1203 [ START_STOP ] = "START_STOP",
1204 [ RECEIVE_DIAGNOSTIC ] = "RECEIVE_DIAGNOSTIC",
1205 [ SEND_DIAGNOSTIC ] = "SEND_DIAGNOSTIC",
1206 [ ALLOW_MEDIUM_REMOVAL ] = "ALLOW_MEDIUM_REMOVAL",
1207 [ READ_CAPACITY_10 ] = "READ_CAPACITY_10",
1208 [ READ_10 ] = "READ_10",
1209 [ WRITE_10 ] = "WRITE_10",
1210 [ SEEK_10 ] = "SEEK_10",
1211 [ WRITE_VERIFY_10 ] = "WRITE_VERIFY_10",
1212 [ VERIFY_10 ] = "VERIFY_10",
1213 [ SEARCH_HIGH ] = "SEARCH_HIGH",
1214 [ SEARCH_EQUAL ] = "SEARCH_EQUAL",
1215 [ SEARCH_LOW ] = "SEARCH_LOW",
1216 [ SET_LIMITS ] = "SET_LIMITS",
1217 [ PRE_FETCH ] = "PRE_FETCH/READ_POSITION",
1218 /* READ_POSITION and PRE_FETCH use the same operation code */
1219 [ SYNCHRONIZE_CACHE ] = "SYNCHRONIZE_CACHE",
1220 [ LOCK_UNLOCK_CACHE ] = "LOCK_UNLOCK_CACHE",
1221 [ READ_DEFECT_DATA ] = "READ_DEFECT_DATA",
1222 [ MEDIUM_SCAN ] = "MEDIUM_SCAN",
1223 [ COMPARE ] = "COMPARE",
1224 [ COPY_VERIFY ] = "COPY_VERIFY",
1225 [ WRITE_BUFFER ] = "WRITE_BUFFER",
1226 [ READ_BUFFER ] = "READ_BUFFER",
1227 [ UPDATE_BLOCK ] = "UPDATE_BLOCK",
1228 [ READ_LONG_10 ] = "READ_LONG_10",
1229 [ WRITE_LONG_10 ] = "WRITE_LONG_10",
1230 [ CHANGE_DEFINITION ] = "CHANGE_DEFINITION",
1231 [ WRITE_SAME_10 ] = "WRITE_SAME_10",
1232 [ UNMAP ] = "UNMAP",
1233 [ READ_TOC ] = "READ_TOC",
1234 [ REPORT_DENSITY_SUPPORT ] = "REPORT_DENSITY_SUPPORT",
1235 [ SANITIZE ] = "SANITIZE",
1236 [ GET_CONFIGURATION ] = "GET_CONFIGURATION",
1237 [ LOG_SELECT ] = "LOG_SELECT",
1238 [ LOG_SENSE ] = "LOG_SENSE",
1239 [ MODE_SELECT_10 ] = "MODE_SELECT_10",
1240 [ RESERVE_10 ] = "RESERVE_10",
1241 [ RELEASE_10 ] = "RELEASE_10",
1242 [ MODE_SENSE_10 ] = "MODE_SENSE_10",
1243 [ PERSISTENT_RESERVE_IN ] = "PERSISTENT_RESERVE_IN",
1244 [ PERSISTENT_RESERVE_OUT ] = "PERSISTENT_RESERVE_OUT",
1245 [ WRITE_FILEMARKS_16 ] = "WRITE_FILEMARKS_16",
1246 [ EXTENDED_COPY ] = "EXTENDED_COPY",
1247 [ ATA_PASSTHROUGH ] = "ATA_PASSTHROUGH",
1248 [ ACCESS_CONTROL_IN ] = "ACCESS_CONTROL_IN",
1249 [ ACCESS_CONTROL_OUT ] = "ACCESS_CONTROL_OUT",
1250 [ READ_16 ] = "READ_16",
1251 [ COMPARE_AND_WRITE ] = "COMPARE_AND_WRITE",
1252 [ WRITE_16 ] = "WRITE_16",
1253 [ WRITE_VERIFY_16 ] = "WRITE_VERIFY_16",
1254 [ VERIFY_16 ] = "VERIFY_16",
1255 [ PRE_FETCH_16 ] = "PRE_FETCH_16",
1256 [ SYNCHRONIZE_CACHE_16 ] = "SPACE_16/SYNCHRONIZE_CACHE_16",
1257 /* SPACE_16 and SYNCHRONIZE_CACHE_16 use the same operation code */
1258 [ LOCATE_16 ] = "LOCATE_16",
1259 [ WRITE_SAME_16 ] = "ERASE_16/WRITE_SAME_16",
1260 /* ERASE_16 and WRITE_SAME_16 use the same operation code */
1261 [ SERVICE_ACTION_IN_16 ] = "SERVICE_ACTION_IN_16",
1262 [ WRITE_LONG_16 ] = "WRITE_LONG_16",
1263 [ REPORT_LUNS ] = "REPORT_LUNS",
1264 [ BLANK ] = "BLANK",
1265 [ MOVE_MEDIUM ] = "MOVE_MEDIUM",
1266 [ LOAD_UNLOAD ] = "LOAD_UNLOAD",
1267 [ READ_12 ] = "READ_12",
1268 [ WRITE_12 ] = "WRITE_12",
1269 [ ERASE_12 ] = "ERASE_12/GET_PERFORMANCE",
1270 /* ERASE_12 and GET_PERFORMANCE use the same operation code */
1271 [ SERVICE_ACTION_IN_12 ] = "SERVICE_ACTION_IN_12",
1272 [ WRITE_VERIFY_12 ] = "WRITE_VERIFY_12",
1273 [ VERIFY_12 ] = "VERIFY_12",
1274 [ SEARCH_HIGH_12 ] = "SEARCH_HIGH_12",
1275 [ SEARCH_EQUAL_12 ] = "SEARCH_EQUAL_12",
1276 [ SEARCH_LOW_12 ] = "SEARCH_LOW_12",
1277 [ READ_ELEMENT_STATUS ] = "READ_ELEMENT_STATUS",
1278 [ SEND_VOLUME_TAG ] = "SEND_VOLUME_TAG/SET_STREAMING",
1279 /* SEND_VOLUME_TAG and SET_STREAMING use the same operation code */
1280 [ READ_CD ] = "READ_CD",
1281 [ READ_DEFECT_DATA_12 ] = "READ_DEFECT_DATA_12",
1282 [ READ_DVD_STRUCTURE ] = "READ_DVD_STRUCTURE",
1283 [ RESERVE_TRACK ] = "RESERVE_TRACK",
1284 [ SEND_CUE_SHEET ] = "SEND_CUE_SHEET",
1285 [ SEND_DVD_STRUCTURE ] = "SEND_DVD_STRUCTURE",
1286 [ SET_CD_SPEED ] = "SET_CD_SPEED",
1287 [ SET_READ_AHEAD ] = "SET_READ_AHEAD",
1288 [ ALLOW_OVERWRITE ] = "ALLOW_OVERWRITE",
1289 [ MECHANISM_STATUS ] = "MECHANISM_STATUS",
1290 };
1291
1292 if (cmd >= ARRAY_SIZE(names) || names[cmd] == NULL)
1293 return "*UNKNOWN*";
1294 return names[cmd];
1295 }
1296
1297 SCSIRequest *scsi_req_ref(SCSIRequest *req)
1298 {
1299 req->refcount++;
1300 return req;
1301 }
1302
1303 void scsi_req_unref(SCSIRequest *req)
1304 {
1305 assert(req->refcount > 0);
1306 if (--req->refcount == 0) {
1307 if (req->ops->free_req) {
1308 req->ops->free_req(req);
1309 }
1310 g_free(req);
1311 }
1312 }
1313
1314 /* Tell the device that we finished processing this chunk of I/O. It
1315 will start the next chunk or complete the command. */
1316 void scsi_req_continue(SCSIRequest *req)
1317 {
1318 trace_scsi_req_continue(req->dev->id, req->lun, req->tag);
1319 if (req->cmd.mode == SCSI_XFER_TO_DEV) {
1320 req->ops->write_data(req);
1321 } else {
1322 req->ops->read_data(req);
1323 }
1324 }
1325
1326 /* Called by the devices when data is ready for the HBA. The HBA should
1327 start a DMA operation to read or fill the device's data buffer.
1328 Once it completes, calling scsi_req_continue will restart I/O. */
1329 void scsi_req_data(SCSIRequest *req, int len)
1330 {
1331 uint8_t *buf;
1332 if (req->io_canceled) {
1333 trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len);
1334 return;
1335 }
1336 trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);
1337 assert(req->cmd.mode != SCSI_XFER_NONE);
1338 if (!req->sg) {
1339 req->resid -= len;
1340 req->bus->info->transfer_data(req, len);
1341 return;
1342 }
1343
1344 /* If the device calls scsi_req_data and the HBA specified a
1345 * scatter/gather list, the transfer has to happen in a single
1346 * step. */
1347 assert(!req->dma_started);
1348 req->dma_started = true;
1349
1350 buf = scsi_req_get_buf(req);
1351 if (req->cmd.mode == SCSI_XFER_FROM_DEV) {
1352 req->resid = dma_buf_read(buf, len, req->sg);
1353 } else {
1354 req->resid = dma_buf_write(buf, len, req->sg);
1355 }
1356 scsi_req_continue(req);
1357 }
1358
1359 void scsi_req_print(SCSIRequest *req)
1360 {
1361 FILE *fp = stderr;
1362 int i;
1363
1364 fprintf(fp, "[%s id=%d] %s",
1365 req->dev->qdev.parent_bus->name,
1366 req->dev->id,
1367 scsi_command_name(req->cmd.buf[0]));
1368 for (i = 1; i < req->cmd.len; i++) {
1369 fprintf(fp, " 0x%02x", req->cmd.buf[i]);
1370 }
1371 switch (req->cmd.mode) {
1372 case SCSI_XFER_NONE:
1373 fprintf(fp, " - none\n");
1374 break;
1375 case SCSI_XFER_FROM_DEV:
1376 fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer);
1377 break;
1378 case SCSI_XFER_TO_DEV:
1379 fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer);
1380 break;
1381 default:
1382 fprintf(fp, " - Oops\n");
1383 break;
1384 }
1385 }
1386
1387 void scsi_req_complete(SCSIRequest *req, int status)
1388 {
1389 assert(req->status == -1);
1390 req->status = status;
1391
1392 assert(req->sense_len < sizeof(req->sense));
1393 if (status == GOOD) {
1394 req->sense_len = 0;
1395 }
1396
1397 if (req->sense_len) {
1398 memcpy(req->dev->sense, req->sense, req->sense_len);
1399 req->dev->sense_len = req->sense_len;
1400 req->dev->sense_is_ua = (req->ops == &reqops_unit_attention);
1401 } else {
1402 req->dev->sense_len = 0;
1403 req->dev->sense_is_ua = false;
1404 }
1405
1406 /*
1407 * Unit attention state is now stored in the device's sense buffer
1408 * if the HBA didn't do autosense. Clear the pending unit attention
1409 * flags.
1410 */
1411 scsi_clear_unit_attention(req);
1412
1413 scsi_req_ref(req);
1414 scsi_req_dequeue(req);
1415 req->bus->info->complete(req, req->status, req->resid);
1416 scsi_req_unref(req);
1417 }
1418
1419 void scsi_req_cancel(SCSIRequest *req)
1420 {
1421 if (!req->enqueued) {
1422 return;
1423 }
1424 scsi_req_ref(req);
1425 scsi_req_dequeue(req);
1426 req->io_canceled = true;
1427 if (req->ops->cancel_io) {
1428 req->ops->cancel_io(req);
1429 }
1430 if (req->bus->info->cancel) {
1431 req->bus->info->cancel(req);
1432 }
1433 scsi_req_unref(req);
1434 }
1435
1436 void scsi_req_abort(SCSIRequest *req, int status)
1437 {
1438 if (!req->enqueued) {
1439 return;
1440 }
1441 scsi_req_ref(req);
1442 scsi_req_dequeue(req);
1443 req->io_canceled = true;
1444 if (req->ops->cancel_io) {
1445 req->ops->cancel_io(req);
1446 }
1447 scsi_req_complete(req, status);
1448 scsi_req_unref(req);
1449 }
1450
1451 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
1452 {
1453 SCSIRequest *req;
1454
1455 while (!QTAILQ_EMPTY(&sdev->requests)) {
1456 req = QTAILQ_FIRST(&sdev->requests);
1457 scsi_req_cancel(req);
1458 }
1459 sdev->unit_attention = sense;
1460 }
1461
1462 static char *scsibus_get_dev_path(DeviceState *dev)
1463 {
1464 SCSIDevice *d = DO_UPCAST(SCSIDevice, qdev, dev);
1465 DeviceState *hba = dev->parent_bus->parent;
1466 char *id;
1467 char *path;
1468
1469 id = qdev_get_dev_path(hba);
1470 if (id) {
1471 path = g_strdup_printf("%s/%d:%d:%d", id, d->channel, d->id, d->lun);
1472 } else {
1473 path = g_strdup_printf("%d:%d:%d", d->channel, d->id, d->lun);
1474 }
1475 g_free(id);
1476 return path;
1477 }
1478
1479 static char *scsibus_get_fw_dev_path(DeviceState *dev)
1480 {
1481 SCSIDevice *d = SCSI_DEVICE(dev);
1482 char path[100];
1483
1484 snprintf(path, sizeof(path), "channel@%x/%s@%x,%x", d->channel,
1485 qdev_fw_name(dev), d->id, d->lun);
1486
1487 return strdup(path);
1488 }
1489
1490 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
1491 {
1492 BusChild *kid;
1493 SCSIDevice *target_dev = NULL;
1494
1495 QTAILQ_FOREACH_REVERSE(kid, &bus->qbus.children, ChildrenHead, sibling) {
1496 DeviceState *qdev = kid->child;
1497 SCSIDevice *dev = SCSI_DEVICE(qdev);
1498
1499 if (dev->channel == channel && dev->id == id) {
1500 if (dev->lun == lun) {
1501 return dev;
1502 }
1503 target_dev = dev;
1504 }
1505 }
1506 return target_dev;
1507 }
1508
1509 /* SCSI request list. For simplicity, pv points to the whole device */
1510
1511 static void put_scsi_requests(QEMUFile *f, void *pv, size_t size)
1512 {
1513 SCSIDevice *s = pv;
1514 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
1515 SCSIRequest *req;
1516
1517 QTAILQ_FOREACH(req, &s->requests, next) {
1518 assert(!req->io_canceled);
1519 assert(req->status == -1);
1520 assert(req->enqueued);
1521
1522 qemu_put_sbyte(f, req->retry ? 1 : 2);
1523 qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf));
1524 qemu_put_be32s(f, &req->tag);
1525 qemu_put_be32s(f, &req->lun);
1526 if (bus->info->save_request) {
1527 bus->info->save_request(f, req);
1528 }
1529 if (req->ops->save_request) {
1530 req->ops->save_request(f, req);
1531 }
1532 }
1533 qemu_put_sbyte(f, 0);
1534 }
1535
1536 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size)
1537 {
1538 SCSIDevice *s = pv;
1539 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
1540 int8_t sbyte;
1541
1542 while ((sbyte = qemu_get_sbyte(f)) > 0) {
1543 uint8_t buf[SCSI_CMD_BUF_SIZE];
1544 uint32_t tag;
1545 uint32_t lun;
1546 SCSIRequest *req;
1547
1548 qemu_get_buffer(f, buf, sizeof(buf));
1549 qemu_get_be32s(f, &tag);
1550 qemu_get_be32s(f, &lun);
1551 req = scsi_req_new(s, tag, lun, buf, NULL);
1552 req->retry = (sbyte == 1);
1553 if (bus->info->load_request) {
1554 req->hba_private = bus->info->load_request(f, req);
1555 }
1556 if (req->ops->load_request) {
1557 req->ops->load_request(f, req);
1558 }
1559
1560 /* Just restart it later. */
1561 scsi_req_enqueue_internal(req);
1562
1563 /* At this point, the request will be kept alive by the reference
1564 * added by scsi_req_enqueue_internal, so we can release our reference.
1565 * The HBA of course will add its own reference in the load_request
1566 * callback if it needs to hold on the SCSIRequest.
1567 */
1568 scsi_req_unref(req);
1569 }
1570
1571 return 0;
1572 }
1573
1574 static const VMStateInfo vmstate_info_scsi_requests = {
1575 .name = "scsi-requests",
1576 .get = get_scsi_requests,
1577 .put = put_scsi_requests,
1578 };
1579
1580 const VMStateDescription vmstate_scsi_device = {
1581 .name = "SCSIDevice",
1582 .version_id = 1,
1583 .minimum_version_id = 1,
1584 .minimum_version_id_old = 1,
1585 .fields = (VMStateField[]) {
1586 VMSTATE_UINT8(unit_attention.key, SCSIDevice),
1587 VMSTATE_UINT8(unit_attention.asc, SCSIDevice),
1588 VMSTATE_UINT8(unit_attention.ascq, SCSIDevice),
1589 VMSTATE_BOOL(sense_is_ua, SCSIDevice),
1590 VMSTATE_UINT8_ARRAY(sense, SCSIDevice, SCSI_SENSE_BUF_SIZE),
1591 VMSTATE_UINT32(sense_len, SCSIDevice),
1592 {
1593 .name = "requests",
1594 .version_id = 0,
1595 .field_exists = NULL,
1596 .size = 0, /* ouch */
1597 .info = &vmstate_info_scsi_requests,
1598 .flags = VMS_SINGLE,
1599 .offset = 0,
1600 },
1601 VMSTATE_END_OF_LIST()
1602 }
1603 };
1604
1605 static void scsi_device_class_init(ObjectClass *klass, void *data)
1606 {
1607 DeviceClass *k = DEVICE_CLASS(klass);
1608 k->bus_type = TYPE_SCSI_BUS;
1609 k->init = scsi_qdev_init;
1610 k->unplug = qdev_simple_unplug_cb;
1611 k->exit = scsi_qdev_exit;
1612 k->props = scsi_props;
1613 }
1614
1615 static TypeInfo scsi_device_type_info = {
1616 .name = TYPE_SCSI_DEVICE,
1617 .parent = TYPE_DEVICE,
1618 .instance_size = sizeof(SCSIDevice),
1619 .abstract = true,
1620 .class_size = sizeof(SCSIDeviceClass),
1621 .class_init = scsi_device_class_init,
1622 };
1623
1624 static void scsi_register_types(void)
1625 {
1626 type_register_static(&scsi_bus_info);
1627 type_register_static(&scsi_device_type_info);
1628 }
1629
1630 type_init(scsi_register_types)
QEmu