?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
block: remove bootindex property from qdev to qom
[qemu.git] / hw / scsi / scsi-bus.c
blobe7b1cf67302577c38cb7cc31a05e4e77af3b290b
1 #include "hw/hw.h"
2 #include "qemu/error-report.h"
3 #include "hw/scsi/scsi.h"
4 #include "block/scsi.h"
5 #include "hw/qdev.h"
6 #include "sysemu/blockdev.h"
7 #include "trace.h"
8 #include "sysemu/dma.h"
9
10 static char *scsibus_get_dev_path(DeviceState *dev);
11 static char *scsibus_get_fw_dev_path(DeviceState *dev);
12 static void scsi_req_dequeue(SCSIRequest *req);
13 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len);
14 static void scsi_target_free_buf(SCSIRequest *req);
15
16 static Property scsi_props[] = {
17 DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0),
18 DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1),
19 DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1),
20 DEFINE_PROP_END_OF_LIST(),
21 };
22
23 static void scsi_bus_class_init(ObjectClass *klass, void *data)
24 {
25 BusClass *k = BUS_CLASS(klass);
26
27 k->get_dev_path = scsibus_get_dev_path;
28 k->get_fw_dev_path = scsibus_get_fw_dev_path;
29 }
30
31 static const TypeInfo scsi_bus_info = {
32 .name = TYPE_SCSI_BUS,
33 .parent = TYPE_BUS,
34 .instance_size = sizeof(SCSIBus),
35 .class_init = scsi_bus_class_init,
36 };
37 static int next_scsi_bus;
38
39 static void scsi_device_realize(SCSIDevice *s, Error **errp)
40 {
41 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
42 if (sc->realize) {
43 sc->realize(s, errp);
44 }
45 }
46
47 static void scsi_device_unrealize(SCSIDevice *s, Error **errp)
48 {
49 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
50 if (sc->unrealize) {
51 sc->unrealize(s, errp);
52 }
53 }
54
55 int scsi_bus_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf,
56 void *hba_private)
57 {
58 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
59 int rc;
60
61 assert(cmd->len == 0);
62 rc = scsi_req_parse_cdb(dev, cmd, buf);
63 if (bus->info->parse_cdb) {
64 rc = bus->info->parse_cdb(dev, cmd, buf, hba_private);
65 }
66 return rc;
67 }
68
69 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun,
70 uint8_t *buf, void *hba_private)
71 {
72 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
73 if (sc->alloc_req) {
74 return sc->alloc_req(s, tag, lun, buf, hba_private);
75 }
76
77 return NULL;
78 }
79
80 static void scsi_device_unit_attention_reported(SCSIDevice *s)
81 {
82 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
83 if (sc->unit_attention_reported) {
84 sc->unit_attention_reported(s);
85 }
86 }
87
88 /* Create a scsi bus, and attach devices to it. */
89 void scsi_bus_new(SCSIBus *bus, size_t bus_size, DeviceState *host,
90 const SCSIBusInfo *info, const char *bus_name)
91 {
92 qbus_create_inplace(bus, bus_size, TYPE_SCSI_BUS, host, bus_name);
93 bus->busnr = next_scsi_bus++;
94 bus->info = info;
95 bus->qbus.allow_hotplug = 1;
96 }
97
98 static void scsi_dma_restart_bh(void *opaque)
99 {
100 SCSIDevice *s = opaque;
101 SCSIRequest *req, *next;
102
103 qemu_bh_delete(s->bh);
104 s->bh = NULL;
105
106 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
107 scsi_req_ref(req);
108 if (req->retry) {
109 req->retry = false;
110 switch (req->cmd.mode) {
111 case SCSI_XFER_FROM_DEV:
112 case SCSI_XFER_TO_DEV:
113 scsi_req_continue(req);
114 break;
115 case SCSI_XFER_NONE:
116 scsi_req_dequeue(req);
117 scsi_req_enqueue(req);
118 break;
119 }
120 }
121 scsi_req_unref(req);
122 }
123 }
124
125 void scsi_req_retry(SCSIRequest *req)
126 {
127 /* No need to save a reference, because scsi_dma_restart_bh just
128 * looks at the request list. */
129 req->retry = true;
130 }
131
132 static void scsi_dma_restart_cb(void *opaque, int running, RunState state)
133 {
134 SCSIDevice *s = opaque;
135
136 if (!running) {
137 return;
138 }
139 if (!s->bh) {
140 s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
141 qemu_bh_schedule(s->bh);
142 }
143 }
144
145 static void scsi_qdev_realize(DeviceState *qdev, Error **errp)
146 {
147 SCSIDevice *dev = SCSI_DEVICE(qdev);
148 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
149 SCSIDevice *d;
150 Error *local_err = NULL;
151
152 if (dev->channel > bus->info->max_channel) {
153 error_setg(errp, "bad scsi channel id: %d", dev->channel);
154 return;
155 }
156 if (dev->id != -1 && dev->id > bus->info->max_target) {
157 error_setg(errp, "bad scsi device id: %d", dev->id);
158 return;
159 }
160 if (dev->lun != -1 && dev->lun > bus->info->max_lun) {
161 error_setg(errp, "bad scsi device lun: %d", dev->lun);
162 return;
163 }
164
165 if (dev->id == -1) {
166 int id = -1;
167 if (dev->lun == -1) {
168 dev->lun = 0;
169 }
170 do {
171 d = scsi_device_find(bus, dev->channel, ++id, dev->lun);
172 } while (d && d->lun == dev->lun && id < bus->info->max_target);
173 if (d && d->lun == dev->lun) {
174 error_setg(errp, "no free target");
175 return;
176 }
177 dev->id = id;
178 } else if (dev->lun == -1) {
179 int lun = -1;
180 do {
181 d = scsi_device_find(bus, dev->channel, dev->id, ++lun);
182 } while (d && d->lun == lun && lun < bus->info->max_lun);
183 if (d && d->lun == lun) {
184 error_setg(errp, "no free lun");
185 return;
186 }
187 dev->lun = lun;
188 } else {
189 d = scsi_device_find(bus, dev->channel, dev->id, dev->lun);
190 assert(d);
191 if (d->lun == dev->lun && dev != d) {
192 error_setg(errp, "lun already used by '%s'", d->qdev.id);
193 return;
194 }
195 }
196
197 QTAILQ_INIT(&dev->requests);
198 scsi_device_realize(dev, &local_err);
199 if (local_err) {
200 error_propagate(errp, local_err);
201 return;
202 }
203 dev->vmsentry = qemu_add_vm_change_state_handler(scsi_dma_restart_cb,
204 dev);
205
206 if (bus->info->hotplug) {
207 bus->info->hotplug(bus, dev);
208 }
209 }
210
211 static void scsi_qdev_unrealize(DeviceState *qdev, Error **errp)
212 {
213 SCSIDevice *dev = SCSI_DEVICE(qdev);
214
215 if (dev->vmsentry) {
216 qemu_del_vm_change_state_handler(dev->vmsentry);
217 }
218 scsi_device_unrealize(dev, errp);
219 }
220
221 /* handle legacy '-drive if=scsi,...' cmd line args */
222 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
223 int unit, bool removable, int bootindex,
224 const char *serial, Error **errp)
225 {
226 const char *driver;
227 DeviceState *dev;
228 Error *err = NULL;
229
230 driver = bdrv_is_sg(bdrv) ? "scsi-generic" : "scsi-disk";
231 dev = qdev_create(&bus->qbus, driver);
232 qdev_prop_set_uint32(dev, "scsi-id", unit);
233 if (bootindex >= 0) {
234 object_property_set_int(OBJECT(dev), bootindex, "bootindex",
235 &error_abort);
236 }
237 if (object_property_find(OBJECT(dev), "removable", NULL)) {
238 qdev_prop_set_bit(dev, "removable", removable);
239 }
240 if (serial && object_property_find(OBJECT(dev), "serial", NULL)) {
241 qdev_prop_set_string(dev, "serial", serial);
242 }
243 if (qdev_prop_set_drive(dev, "drive", bdrv) < 0) {
244 error_setg(errp, "Setting drive property failed");
245 object_unparent(OBJECT(dev));
246 return NULL;
247 }
248 object_property_set_bool(OBJECT(dev), true, "realized", &err);
249 if (err != NULL) {
250 error_propagate(errp, err);
251 object_unparent(OBJECT(dev));
252 return NULL;
253 }
254 return SCSI_DEVICE(dev);
255 }
256
257 void scsi_bus_legacy_handle_cmdline(SCSIBus *bus, Error **errp)
258 {
259 Location loc;
260 DriveInfo *dinfo;
261 int unit;
262 Error *err = NULL;
263
264 loc_push_none(&loc);
265 for (unit = 0; unit <= bus->info->max_target; unit++) {
266 dinfo = drive_get(IF_SCSI, bus->busnr, unit);
267 if (dinfo == NULL) {
268 continue;
269 }
270 qemu_opts_loc_restore(dinfo->opts);
271 scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit, false, -1, NULL,
272 &err);
273 if (err != NULL) {
274 error_report("%s", error_get_pretty(err));
275 error_propagate(errp, err);
276 break;
277 }
278 }
279 loc_pop(&loc);
280 }
281
282 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf)
283 {
284 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
285 scsi_req_complete(req, CHECK_CONDITION);
286 return 0;
287 }
288
289 static const struct SCSIReqOps reqops_invalid_field = {
290 .size = sizeof(SCSIRequest),
291 .send_command = scsi_invalid_field
292 };
293
294 /* SCSIReqOps implementation for invalid commands. */
295
296 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf)
297 {
298 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE));
299 scsi_req_complete(req, CHECK_CONDITION);
300 return 0;
301 }
302
303 static const struct SCSIReqOps reqops_invalid_opcode = {
304 .size = sizeof(SCSIRequest),
305 .send_command = scsi_invalid_command
306 };
307
308 /* SCSIReqOps implementation for unit attention conditions. */
309
310 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
311 {
312 if (req->dev->unit_attention.key == UNIT_ATTENTION) {
313 scsi_req_build_sense(req, req->dev->unit_attention);
314 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
315 scsi_req_build_sense(req, req->bus->unit_attention);
316 }
317 scsi_req_complete(req, CHECK_CONDITION);
318 return 0;
319 }
320
321 static const struct SCSIReqOps reqops_unit_attention = {
322 .size = sizeof(SCSIRequest),
323 .send_command = scsi_unit_attention
324 };
325
326 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to
327 an invalid LUN. */
328
329 typedef struct SCSITargetReq SCSITargetReq;
330
331 struct SCSITargetReq {
332 SCSIRequest req;
333 int len;
334 uint8_t *buf;
335 int buf_len;
336 };
337
338 static void store_lun(uint8_t *outbuf, int lun)
339 {
340 if (lun < 256) {
341 outbuf[1] = lun;
342 return;
343 }
344 outbuf[1] = (lun & 255);
345 outbuf[0] = (lun >> 8) | 0x40;
346 }
347
348 static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
349 {
350 BusChild *kid;
351 int i, len, n;
352 int channel, id;
353 bool found_lun0;
354
355 if (r->req.cmd.xfer < 16) {
356 return false;
357 }
358 if (r->req.cmd.buf[2] > 2) {
359 return false;
360 }
361 channel = r->req.dev->channel;
362 id = r->req.dev->id;
363 found_lun0 = false;
364 n = 0;
365 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) {
366 DeviceState *qdev = kid->child;
367 SCSIDevice *dev = SCSI_DEVICE(qdev);
368
369 if (dev->channel == channel && dev->id == id) {
370 if (dev->lun == 0) {
371 found_lun0 = true;
372 }
373 n += 8;
374 }
375 }
376 if (!found_lun0) {
377 n += 8;
378 }
379
380 scsi_target_alloc_buf(&r->req, n + 8);
381
382 len = MIN(n + 8, r->req.cmd.xfer & ~7);
383 memset(r->buf, 0, len);
384 stl_be_p(&r->buf[0], n);
385 i = found_lun0 ? 8 : 16;
386 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) {
387 DeviceState *qdev = kid->child;
388 SCSIDevice *dev = SCSI_DEVICE(qdev);
389
390 if (dev->channel == channel && dev->id == id) {
391 store_lun(&r->buf[i], dev->lun);
392 i += 8;
393 }
394 }
395 assert(i == n + 8);
396 r->len = len;
397 return true;
398 }
399
400 static bool scsi_target_emulate_inquiry(SCSITargetReq *r)
401 {
402 assert(r->req.dev->lun != r->req.lun);
403
404 scsi_target_alloc_buf(&r->req, SCSI_INQUIRY_LEN);
405
406 if (r->req.cmd.buf[1] & 0x2) {
407 /* Command support data - optional, not implemented */
408 return false;
409 }
410
411 if (r->req.cmd.buf[1] & 0x1) {
412 /* Vital product data */
413 uint8_t page_code = r->req.cmd.buf[2];
414 r->buf[r->len++] = page_code ; /* this page */
415 r->buf[r->len++] = 0x00;
416
417 switch (page_code) {
418 case 0x00: /* Supported page codes, mandatory */
419 {
420 int pages;
421 pages = r->len++;
422 r->buf[r->len++] = 0x00; /* list of supported pages (this page) */
423 r->buf[pages] = r->len - pages - 1; /* number of pages */
424 break;
425 }
426 default:
427 return false;
428 }
429 /* done with EVPD */
430 assert(r->len < r->buf_len);
431 r->len = MIN(r->req.cmd.xfer, r->len);
432 return true;
433 }
434
435 /* Standard INQUIRY data */
436 if (r->req.cmd.buf[2] != 0) {
437 return false;
438 }
439
440 /* PAGE CODE == 0 */
441 r->len = MIN(r->req.cmd.xfer, SCSI_INQUIRY_LEN);
442 memset(r->buf, 0, r->len);
443 if (r->req.lun != 0) {
444 r->buf[0] = TYPE_NO_LUN;
445 } else {
446 r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE;
447 r->buf[2] = 5; /* Version */
448 r->buf[3] = 2 | 0x10; /* HiSup, response data format */
449 r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */
450 r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ. */
451 memcpy(&r->buf[8], "QEMU ", 8);
452 memcpy(&r->buf[16], "QEMU TARGET ", 16);
453 pstrcpy((char *) &r->buf[32], 4, qemu_get_version());
454 }
455 return true;
456 }
457
458 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf)
459 {
460 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
461
462 switch (buf[0]) {
463 case REPORT_LUNS:
464 if (!scsi_target_emulate_report_luns(r)) {
465 goto illegal_request;
466 }
467 break;
468 case INQUIRY:
469 if (!scsi_target_emulate_inquiry(r)) {
470 goto illegal_request;
471 }
472 break;
473 case REQUEST_SENSE:
474 scsi_target_alloc_buf(&r->req, SCSI_SENSE_LEN);
475 r->len = scsi_device_get_sense(r->req.dev, r->buf,
476 MIN(req->cmd.xfer, r->buf_len),
477 (req->cmd.buf[1] & 1) == 0);
478 if (r->req.dev->sense_is_ua) {
479 scsi_device_unit_attention_reported(req->dev);
480 r->req.dev->sense_len = 0;
481 r->req.dev->sense_is_ua = false;
482 }
483 break;
484 case TEST_UNIT_READY:
485 break;
486 default:
487 scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED));
488 scsi_req_complete(req, CHECK_CONDITION);
489 return 0;
490 illegal_request:
491 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
492 scsi_req_complete(req, CHECK_CONDITION);
493 return 0;
494 }
495
496 if (!r->len) {
497 scsi_req_complete(req, GOOD);
498 }
499 return r->len;
500 }
501
502 static void scsi_target_read_data(SCSIRequest *req)
503 {
504 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
505 uint32_t n;
506
507 n = r->len;
508 if (n > 0) {
509 r->len = 0;
510 scsi_req_data(&r->req, n);
511 } else {
512 scsi_req_complete(&r->req, GOOD);
513 }
514 }
515
516 static uint8_t *scsi_target_get_buf(SCSIRequest *req)
517 {
518 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
519
520 return r->buf;
521 }
522
523 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len)
524 {
525 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
526
527 r->buf = g_malloc(len);
528 r->buf_len = len;
529
530 return r->buf;
531 }
532
533 static void scsi_target_free_buf(SCSIRequest *req)
534 {
535 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
536
537 g_free(r->buf);
538 }
539
540 static const struct SCSIReqOps reqops_target_command = {
541 .size = sizeof(SCSITargetReq),
542 .send_command = scsi_target_send_command,
543 .read_data = scsi_target_read_data,
544 .get_buf = scsi_target_get_buf,
545 .free_req = scsi_target_free_buf,
546 };
547
548
549 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
550 uint32_t tag, uint32_t lun, void *hba_private)
551 {
552 SCSIRequest *req;
553 SCSIBus *bus = scsi_bus_from_device(d);
554 BusState *qbus = BUS(bus);
555 const int memset_off = offsetof(SCSIRequest, sense)
556 + sizeof(req->sense);
557
558 req = g_slice_alloc(reqops->size);
559 memset((uint8_t *)req + memset_off, 0, reqops->size - memset_off);
560 req->refcount = 1;
561 req->bus = bus;
562 req->dev = d;
563 req->tag = tag;
564 req->lun = lun;
565 req->hba_private = hba_private;
566 req->status = -1;
567 req->ops = reqops;
568 object_ref(OBJECT(d));
569 object_ref(OBJECT(qbus->parent));
570 notifier_list_init(&req->cancel_notifiers);
571 trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
572 return req;
573 }
574
575 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,
576 uint8_t *buf, void *hba_private)
577 {
578 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus);
579 const SCSIReqOps *ops;
580 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(d);
581 SCSIRequest *req;
582 SCSICommand cmd = { .len = 0 };
583 int ret;
584
585 if ((d->unit_attention.key == UNIT_ATTENTION ||
586 bus->unit_attention.key == UNIT_ATTENTION) &&
587 (buf[0] != INQUIRY &&
588 buf[0] != REPORT_LUNS &&
589 buf[0] != GET_CONFIGURATION &&
590 buf[0] != GET_EVENT_STATUS_NOTIFICATION &&
591
592 /*
593 * If we already have a pending unit attention condition,
594 * report this one before triggering another one.
595 */
596 !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) {
597 ops = &reqops_unit_attention;
598 } else if (lun != d->lun ||
599 buf[0] == REPORT_LUNS ||
600 (buf[0] == REQUEST_SENSE && d->sense_len)) {
601 ops = &reqops_target_command;
602 } else {
603 ops = NULL;
604 }
605
606 if (ops != NULL || !sc->parse_cdb) {
607 ret = scsi_req_parse_cdb(d, &cmd, buf);
608 } else {
609 ret = sc->parse_cdb(d, &cmd, buf, hba_private);
610 }
611
612 if (ret != 0) {
613 trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]);
614 req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private);
615 } else {
616 assert(cmd.len != 0);
617 trace_scsi_req_parsed(d->id, lun, tag, buf[0],
618 cmd.mode, cmd.xfer);
619 if (cmd.lba != -1) {
620 trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0],
621 cmd.lba);
622 }
623
624 if (cmd.xfer > INT32_MAX) {
625 req = scsi_req_alloc(&reqops_invalid_field, d, tag, lun, hba_private);
626 } else if (ops) {
627 req = scsi_req_alloc(ops, d, tag, lun, hba_private);
628 } else {
629 req = scsi_device_alloc_req(d, tag, lun, buf, hba_private);
630 }
631 }
632
633 req->cmd = cmd;
634 req->resid = req->cmd.xfer;
635
636 switch (buf[0]) {
637 case INQUIRY:
638 trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]);
639 break;
640 case TEST_UNIT_READY:
641 trace_scsi_test_unit_ready(d->id, lun, tag);
642 break;
643 case REPORT_LUNS:
644 trace_scsi_report_luns(d->id, lun, tag);
645 break;
646 case REQUEST_SENSE:
647 trace_scsi_request_sense(d->id, lun, tag);
648 break;
649 default:
650 break;
651 }
652
653 return req;
654 }
655
656 uint8_t *scsi_req_get_buf(SCSIRequest *req)
657 {
658 return req->ops->get_buf(req);
659 }
660
661 static void scsi_clear_unit_attention(SCSIRequest *req)
662 {
663 SCSISense *ua;
664 if (req->dev->unit_attention.key != UNIT_ATTENTION &&
665 req->bus->unit_attention.key != UNIT_ATTENTION) {
666 return;
667 }
668
669 /*
670 * If an INQUIRY command enters the enabled command state,
671 * the device server shall [not] clear any unit attention condition;
672 * See also MMC-6, paragraphs 6.5 and 6.6.2.
673 */
674 if (req->cmd.buf[0] == INQUIRY ||
675 req->cmd.buf[0] == GET_CONFIGURATION ||
676 req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) {
677 return;
678 }
679
680 if (req->dev->unit_attention.key == UNIT_ATTENTION) {
681 ua = &req->dev->unit_attention;
682 } else {
683 ua = &req->bus->unit_attention;
684 }
685
686 /*
687 * If a REPORT LUNS command enters the enabled command state, [...]
688 * the device server shall clear any pending unit attention condition
689 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
690 */
691 if (req->cmd.buf[0] == REPORT_LUNS &&
692 !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
693 ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) {
694 return;
695 }
696
697 *ua = SENSE_CODE(NO_SENSE);
698 }
699
700 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len)
701 {
702 int ret;
703
704 assert(len >= 14);
705 if (!req->sense_len) {
706 return 0;
707 }
708
709 ret = scsi_build_sense(req->sense, req->sense_len, buf, len, true);
710
711 /*
712 * FIXME: clearing unit attention conditions upon autosense should be done
713 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
714 * (SAM-5, 5.14).
715 *
716 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
717 * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
718 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
719 */
720 if (req->dev->sense_is_ua) {
721 scsi_device_unit_attention_reported(req->dev);
722 req->dev->sense_len = 0;
723 req->dev->sense_is_ua = false;
724 }
725 return ret;
726 }
727
728 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed)
729 {
730 return scsi_build_sense(dev->sense, dev->sense_len, buf, len, fixed);
731 }
732
733 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense)
734 {
735 trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag,
736 sense.key, sense.asc, sense.ascq);
737 memset(req->sense, 0, 18);
738 req->sense[0] = 0x70;
739 req->sense[2] = sense.key;
740 req->sense[7] = 10;
741 req->sense[12] = sense.asc;
742 req->sense[13] = sense.ascq;
743 req->sense_len = 18;
744 }
745
746 static void scsi_req_enqueue_internal(SCSIRequest *req)
747 {
748 assert(!req->enqueued);
749 scsi_req_ref(req);
750 if (req->bus->info->get_sg_list) {
751 req->sg = req->bus->info->get_sg_list(req);
752 } else {
753 req->sg = NULL;
754 }
755 req->enqueued = true;
756 QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
757 }
758
759 int32_t scsi_req_enqueue(SCSIRequest *req)
760 {
761 int32_t rc;
762
763 assert(!req->retry);
764 scsi_req_enqueue_internal(req);
765 scsi_req_ref(req);
766 rc = req->ops->send_command(req, req->cmd.buf);
767 scsi_req_unref(req);
768 return rc;
769 }
770
771 static void scsi_req_dequeue(SCSIRequest *req)
772 {
773 trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
774 req->retry = false;
775 if (req->enqueued) {
776 QTAILQ_REMOVE(&req->dev->requests, req, next);
777 req->enqueued = false;
778 scsi_req_unref(req);
779 }
780 }
781
782 static int scsi_get_performance_length(int num_desc, int type, int data_type)
783 {
784 /* MMC-6, paragraph 6.7. */
785 switch (type) {
786 case 0:
787 if ((data_type & 3) == 0) {
788 /* Each descriptor is as in Table 295 - Nominal performance. */
789 return 16 * num_desc + 8;
790 } else {
791 /* Each descriptor is as in Table 296 - Exceptions. */
792 return 6 * num_desc + 8;
793 }
794 case 1:
795 case 4:
796 case 5:
797 return 8 * num_desc + 8;
798 case 2:
799 return 2048 * num_desc + 8;
800 case 3:
801 return 16 * num_desc + 8;
802 default:
803 return 8;
804 }
805 }
806
807 static int ata_passthrough_xfer_unit(SCSIDevice *dev, uint8_t *buf)
808 {
809 int byte_block = (buf[2] >> 2) & 0x1;
810 int type = (buf[2] >> 4) & 0x1;
811 int xfer_unit;
812
813 if (byte_block) {
814 if (type) {
815 xfer_unit = dev->blocksize;
816 } else {
817 xfer_unit = 512;
818 }
819 } else {
820 xfer_unit = 1;
821 }
822
823 return xfer_unit;
824 }
825
826 static int ata_passthrough_12_xfer_size(SCSIDevice *dev, uint8_t *buf)
827 {
828 int length = buf[2] & 0x3;
829 int xfer;
830 int unit = ata_passthrough_xfer_unit(dev, buf);
831
832 switch (length) {
833 case 0:
834 case 3: /* USB-specific. */
835 default:
836 xfer = 0;
837 break;
838 case 1:
839 xfer = buf[3];
840 break;
841 case 2:
842 xfer = buf[4];
843 break;
844 }
845
846 return xfer * unit;
847 }
848
849 static int ata_passthrough_16_xfer_size(SCSIDevice *dev, uint8_t *buf)
850 {
851 int extend = buf[1] & 0x1;
852 int length = buf[2] & 0x3;
853 int xfer;
854 int unit = ata_passthrough_xfer_unit(dev, buf);
855
856 switch (length) {
857 case 0:
858 case 3: /* USB-specific. */
859 default:
860 xfer = 0;
861 break;
862 case 1:
863 xfer = buf[4];
864 xfer |= (extend ? buf[3] << 8 : 0);
865 break;
866 case 2:
867 xfer = buf[6];
868 xfer |= (extend ? buf[5] << 8 : 0);
869 break;
870 }
871
872 return xfer * unit;
873 }
874
875 uint32_t scsi_data_cdb_length(uint8_t *buf)
876 {
877 if ((buf[0] >> 5) == 0 && buf[4] == 0) {
878 return 256;
879 } else {
880 return scsi_cdb_length(buf);
881 }
882 }
883
884 uint32_t scsi_cdb_length(uint8_t *buf)
885 {
886 switch (buf[0] >> 5) {
887 case 0:
888 return buf[4];
889 break;
890 case 1:
891 case 2:
892 return lduw_be_p(&buf[7]);
893 break;
894 case 4:
895 return ldl_be_p(&buf[10]) & 0xffffffffULL;
896 break;
897 case 5:
898 return ldl_be_p(&buf[6]) & 0xffffffffULL;
899 break;
900 default:
901 return -1;
902 }
903 }
904
905 static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
906 {
907 cmd->xfer = scsi_cdb_length(buf);
908 switch (buf[0]) {
909 case TEST_UNIT_READY:
910 case REWIND:
911 case START_STOP:
912 case SET_CAPACITY:
913 case WRITE_FILEMARKS:
914 case WRITE_FILEMARKS_16:
915 case SPACE:
916 case RESERVE:
917 case RELEASE:
918 case ERASE:
919 case ALLOW_MEDIUM_REMOVAL:
920 case SEEK_10:
921 case SYNCHRONIZE_CACHE:
922 case SYNCHRONIZE_CACHE_16:
923 case LOCATE_16:
924 case LOCK_UNLOCK_CACHE:
925 case SET_CD_SPEED:
926 case SET_LIMITS:
927 case WRITE_LONG_10:
928 case UPDATE_BLOCK:
929 case RESERVE_TRACK:
930 case SET_READ_AHEAD:
931 case PRE_FETCH:
932 case PRE_FETCH_16:
933 case ALLOW_OVERWRITE:
934 cmd->xfer = 0;
935 break;
936 case VERIFY_10:
937 case VERIFY_12:
938 case VERIFY_16:
939 if ((buf[1] & 2) == 0) {
940 cmd->xfer = 0;
941 } else if ((buf[1] & 4) != 0) {
942 cmd->xfer = 1;
943 }
944 cmd->xfer *= dev->blocksize;
945 break;
946 case MODE_SENSE:
947 break;
948 case WRITE_SAME_10:
949 case WRITE_SAME_16:
950 cmd->xfer = dev->blocksize;
951 break;
952 case READ_CAPACITY_10:
953 cmd->xfer = 8;
954 break;
955 case READ_BLOCK_LIMITS:
956 cmd->xfer = 6;
957 break;
958 case SEND_VOLUME_TAG:
959 /* GPCMD_SET_STREAMING from multimedia commands. */
960 if (dev->type == TYPE_ROM) {
961 cmd->xfer = buf[10] | (buf[9] << 8);
962 } else {
963 cmd->xfer = buf[9] | (buf[8] << 8);
964 }
965 break;
966 case WRITE_6:
967 /* length 0 means 256 blocks */
968 if (cmd->xfer == 0) {
969 cmd->xfer = 256;
970 }
971 /* fall through */
972 case WRITE_10:
973 case WRITE_VERIFY_10:
974 case WRITE_12:
975 case WRITE_VERIFY_12:
976 case WRITE_16:
977 case WRITE_VERIFY_16:
978 cmd->xfer *= dev->blocksize;
979 break;
980 case READ_6:
981 case READ_REVERSE:
982 /* length 0 means 256 blocks */
983 if (cmd->xfer == 0) {
984 cmd->xfer = 256;
985 }
986 /* fall through */
987 case READ_10:
988 case RECOVER_BUFFERED_DATA:
989 case READ_12:
990 case READ_16:
991 cmd->xfer *= dev->blocksize;
992 break;
993 case FORMAT_UNIT:
994 /* MMC mandates the parameter list to be 12-bytes long. Parameters
995 * for block devices are restricted to the header right now. */
996 if (dev->type == TYPE_ROM && (buf[1] & 16)) {
997 cmd->xfer = 12;
998 } else {
999 cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4);
1000 }
1001 break;
1002 case INQUIRY:
1003 case RECEIVE_DIAGNOSTIC:
1004 case SEND_DIAGNOSTIC:
1005 cmd->xfer = buf[4] | (buf[3] << 8);
1006 break;
1007 case READ_CD:
1008 case READ_BUFFER:
1009 case WRITE_BUFFER:
1010 case SEND_CUE_SHEET:
1011 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16);
1012 break;
1013 case PERSISTENT_RESERVE_OUT:
1014 cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL;
1015 break;
1016 case ERASE_12:
1017 if (dev->type == TYPE_ROM) {
1018 /* MMC command GET PERFORMANCE. */
1019 cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8),
1020 buf[10], buf[1] & 0x1f);
1021 }
1022 break;
1023 case MECHANISM_STATUS:
1024 case READ_DVD_STRUCTURE:
1025 case SEND_DVD_STRUCTURE:
1026 case MAINTENANCE_OUT:
1027 case MAINTENANCE_IN:
1028 if (dev->type == TYPE_ROM) {
1029 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
1030 cmd->xfer = buf[9] | (buf[8] << 8);
1031 }
1032 break;
1033 case ATA_PASSTHROUGH_12:
1034 if (dev->type == TYPE_ROM) {
1035 /* BLANK command of MMC */
1036 cmd->xfer = 0;
1037 } else {
1038 cmd->xfer = ata_passthrough_12_xfer_size(dev, buf);
1039 }
1040 break;
1041 case ATA_PASSTHROUGH_16:
1042 cmd->xfer = ata_passthrough_16_xfer_size(dev, buf);
1043 break;
1044 }
1045 return 0;
1046 }
1047
1048 static int scsi_req_stream_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
1049 {
1050 switch (buf[0]) {
1051 /* stream commands */
1052 case ERASE_12:
1053 case ERASE_16:
1054 cmd->xfer = 0;
1055 break;
1056 case READ_6:
1057 case READ_REVERSE:
1058 case RECOVER_BUFFERED_DATA:
1059 case WRITE_6:
1060 cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16);
1061 if (buf[1] & 0x01) { /* fixed */
1062 cmd->xfer *= dev->blocksize;
1063 }
1064 break;
1065 case READ_16:
1066 case READ_REVERSE_16:
1067 case VERIFY_16:
1068 case WRITE_16:
1069 cmd->xfer = buf[14] | (buf[13] << 8) | (buf[12] << 16);
1070 if (buf[1] & 0x01) { /* fixed */
1071 cmd->xfer *= dev->blocksize;
1072 }
1073 break;
1074 case REWIND:
1075 case LOAD_UNLOAD:
1076 cmd->xfer = 0;
1077 break;
1078 case SPACE_16:
1079 cmd->xfer = buf[13] | (buf[12] << 8);
1080 break;
1081 case READ_POSITION:
1082 switch (buf[1] & 0x1f) /* operation code */ {
1083 case SHORT_FORM_BLOCK_ID:
1084 case SHORT_FORM_VENDOR_SPECIFIC:
1085 cmd->xfer = 20;
1086 break;
1087 case LONG_FORM:
1088 cmd->xfer = 32;
1089 break;
1090 case EXTENDED_FORM:
1091 cmd->xfer = buf[8] | (buf[7] << 8);
1092 break;
1093 default:
1094 return -1;
1095 }
1096
1097 break;
1098 case FORMAT_UNIT:
1099 cmd->xfer = buf[4] | (buf[3] << 8);
1100 break;
1101 /* generic commands */
1102 default:
1103 return scsi_req_length(cmd, dev, buf);
1104 }
1105 return 0;
1106 }
1107
1108 static int scsi_req_medium_changer_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
1109 {
1110 switch (buf[0]) {
1111 /* medium changer commands */
1112 case EXCHANGE_MEDIUM:
1113 case INITIALIZE_ELEMENT_STATUS:
1114 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE:
1115 case MOVE_MEDIUM:
1116 case POSITION_TO_ELEMENT:
1117 cmd->xfer = 0;
1118 break;
1119 case READ_ELEMENT_STATUS:
1120 cmd->xfer = buf[9] | (buf[8] << 8) | (buf[7] << 16);
1121 break;
1122
1123 /* generic commands */
1124 default:
1125 return scsi_req_length(cmd, dev, buf);
1126 }
1127 return 0;
1128 }
1129
1130
1131 static void scsi_cmd_xfer_mode(SCSICommand *cmd)
1132 {
1133 if (!cmd->xfer) {
1134 cmd->mode = SCSI_XFER_NONE;
1135 return;
1136 }
1137 switch (cmd->buf[0]) {
1138 case WRITE_6:
1139 case WRITE_10:
1140 case WRITE_VERIFY_10:
1141 case WRITE_12:
1142 case WRITE_VERIFY_12:
1143 case WRITE_16:
1144 case WRITE_VERIFY_16:
1145 case VERIFY_10:
1146 case VERIFY_12:
1147 case VERIFY_16:
1148 case COPY:
1149 case COPY_VERIFY:
1150 case COMPARE:
1151 case CHANGE_DEFINITION:
1152 case LOG_SELECT:
1153 case MODE_SELECT:
1154 case MODE_SELECT_10:
1155 case SEND_DIAGNOSTIC:
1156 case WRITE_BUFFER:
1157 case FORMAT_UNIT:
1158 case REASSIGN_BLOCKS:
1159 case SEARCH_EQUAL:
1160 case SEARCH_HIGH:
1161 case SEARCH_LOW:
1162 case UPDATE_BLOCK:
1163 case WRITE_LONG_10:
1164 case WRITE_SAME_10:
1165 case WRITE_SAME_16:
1166 case UNMAP:
1167 case SEARCH_HIGH_12:
1168 case SEARCH_EQUAL_12:
1169 case SEARCH_LOW_12:
1170 case MEDIUM_SCAN:
1171 case SEND_VOLUME_TAG:
1172 case SEND_CUE_SHEET:
1173 case SEND_DVD_STRUCTURE:
1174 case PERSISTENT_RESERVE_OUT:
1175 case MAINTENANCE_OUT:
1176 cmd->mode = SCSI_XFER_TO_DEV;
1177 break;
1178 case ATA_PASSTHROUGH_12:
1179 case ATA_PASSTHROUGH_16:
1180 /* T_DIR */
1181 cmd->mode = (cmd->buf[2] & 0x8) ?
1182 SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV;
1183 break;
1184 default:
1185 cmd->mode = SCSI_XFER_FROM_DEV;
1186 break;
1187 }
1188 }
1189
1190 static uint64_t scsi_cmd_lba(SCSICommand *cmd)
1191 {
1192 uint8_t *buf = cmd->buf;
1193 uint64_t lba;
1194
1195 switch (buf[0] >> 5) {
1196 case 0:
1197 lba = ldl_be_p(&buf[0]) & 0x1fffff;
1198 break;
1199 case 1:
1200 case 2:
1201 case 5:
1202 lba = ldl_be_p(&buf[2]) & 0xffffffffULL;
1203 break;
1204 case 4:
1205 lba = ldq_be_p(&buf[2]);
1206 break;
1207 default:
1208 lba = -1;
1209
1210 }
1211 return lba;
1212 }
1213
1214 int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf)
1215 {
1216 int rc;
1217
1218 cmd->lba = -1;
1219 switch (buf[0] >> 5) {
1220 case 0:
1221 cmd->len = 6;
1222 break;
1223 case 1:
1224 case 2:
1225 cmd->len = 10;
1226 break;
1227 case 4:
1228 cmd->len = 16;
1229 break;
1230 case 5:
1231 cmd->len = 12;
1232 break;
1233 default:
1234 return -1;
1235 }
1236
1237 switch (dev->type) {
1238 case TYPE_TAPE:
1239 rc = scsi_req_stream_length(cmd, dev, buf);
1240 break;
1241 case TYPE_MEDIUM_CHANGER:
1242 rc = scsi_req_medium_changer_length(cmd, dev, buf);
1243 break;
1244 default:
1245 rc = scsi_req_length(cmd, dev, buf);
1246 break;
1247 }
1248
1249 if (rc != 0)
1250 return rc;
1251
1252 memcpy(cmd->buf, buf, cmd->len);
1253 scsi_cmd_xfer_mode(cmd);
1254 cmd->lba = scsi_cmd_lba(cmd);
1255 return 0;
1256 }
1257
1258 void scsi_device_report_change(SCSIDevice *dev, SCSISense sense)
1259 {
1260 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
1261
1262 scsi_device_set_ua(dev, sense);
1263 if (bus->info->change) {
1264 bus->info->change(bus, dev, sense);
1265 }
1266 }
1267
1268 /*
1269 * Predefined sense codes
1270 */
1271
1272 /* No sense data available */
1273 const struct SCSISense sense_code_NO_SENSE = {
1274 .key = NO_SENSE , .asc = 0x00 , .ascq = 0x00
1275 };
1276
1277 /* LUN not ready, Manual intervention required */
1278 const struct SCSISense sense_code_LUN_NOT_READY = {
1279 .key = NOT_READY, .asc = 0x04, .ascq = 0x03
1280 };
1281
1282 /* LUN not ready, Medium not present */
1283 const struct SCSISense sense_code_NO_MEDIUM = {
1284 .key = NOT_READY, .asc = 0x3a, .ascq = 0x00
1285 };
1286
1287 /* LUN not ready, medium removal prevented */
1288 const struct SCSISense sense_code_NOT_READY_REMOVAL_PREVENTED = {
1289 .key = NOT_READY, .asc = 0x53, .ascq = 0x02
1290 };
1291
1292 /* Hardware error, internal target failure */
1293 const struct SCSISense sense_code_TARGET_FAILURE = {
1294 .key = HARDWARE_ERROR, .asc = 0x44, .ascq = 0x00
1295 };
1296
1297 /* Illegal request, invalid command operation code */
1298 const struct SCSISense sense_code_INVALID_OPCODE = {
1299 .key = ILLEGAL_REQUEST, .asc = 0x20, .ascq = 0x00
1300 };
1301
1302 /* Illegal request, LBA out of range */
1303 const struct SCSISense sense_code_LBA_OUT_OF_RANGE = {
1304 .key = ILLEGAL_REQUEST, .asc = 0x21, .ascq = 0x00
1305 };
1306
1307 /* Illegal request, Invalid field in CDB */
1308 const struct SCSISense sense_code_INVALID_FIELD = {
1309 .key = ILLEGAL_REQUEST, .asc = 0x24, .ascq = 0x00
1310 };
1311
1312 /* Illegal request, Invalid field in parameter list */
1313 const struct SCSISense sense_code_INVALID_PARAM = {
1314 .key = ILLEGAL_REQUEST, .asc = 0x26, .ascq = 0x00
1315 };
1316
1317 /* Illegal request, Parameter list length error */
1318 const struct SCSISense sense_code_INVALID_PARAM_LEN = {
1319 .key = ILLEGAL_REQUEST, .asc = 0x1a, .ascq = 0x00
1320 };
1321
1322 /* Illegal request, LUN not supported */
1323 const struct SCSISense sense_code_LUN_NOT_SUPPORTED = {
1324 .key = ILLEGAL_REQUEST, .asc = 0x25, .ascq = 0x00
1325 };
1326
1327 /* Illegal request, Saving parameters not supported */
1328 const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED = {
1329 .key = ILLEGAL_REQUEST, .asc = 0x39, .ascq = 0x00
1330 };
1331
1332 /* Illegal request, Incompatible medium installed */
1333 const struct SCSISense sense_code_INCOMPATIBLE_FORMAT = {
1334 .key = ILLEGAL_REQUEST, .asc = 0x30, .ascq = 0x00
1335 };
1336
1337 /* Illegal request, medium removal prevented */
1338 const struct SCSISense sense_code_ILLEGAL_REQ_REMOVAL_PREVENTED = {
1339 .key = ILLEGAL_REQUEST, .asc = 0x53, .ascq = 0x02
1340 };
1341
1342 /* Illegal request, Invalid Transfer Tag */
1343 const struct SCSISense sense_code_INVALID_TAG = {
1344 .key = ILLEGAL_REQUEST, .asc = 0x4b, .ascq = 0x01
1345 };
1346
1347 /* Command aborted, I/O process terminated */
1348 const struct SCSISense sense_code_IO_ERROR = {
1349 .key = ABORTED_COMMAND, .asc = 0x00, .ascq = 0x06
1350 };
1351
1352 /* Command aborted, I_T Nexus loss occurred */
1353 const struct SCSISense sense_code_I_T_NEXUS_LOSS = {
1354 .key = ABORTED_COMMAND, .asc = 0x29, .ascq = 0x07
1355 };
1356
1357 /* Command aborted, Logical Unit failure */
1358 const struct SCSISense sense_code_LUN_FAILURE = {
1359 .key = ABORTED_COMMAND, .asc = 0x3e, .ascq = 0x01
1360 };
1361
1362 /* Command aborted, Overlapped Commands Attempted */
1363 const struct SCSISense sense_code_OVERLAPPED_COMMANDS = {
1364 .key = ABORTED_COMMAND, .asc = 0x4e, .ascq = 0x00
1365 };
1366
1367 /* Unit attention, Capacity data has changed */
1368 const struct SCSISense sense_code_CAPACITY_CHANGED = {
1369 .key = UNIT_ATTENTION, .asc = 0x2a, .ascq = 0x09
1370 };
1371
1372 /* Unit attention, Power on, reset or bus device reset occurred */
1373 const struct SCSISense sense_code_RESET = {
1374 .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x00
1375 };
1376
1377 /* Unit attention, No medium */
1378 const struct SCSISense sense_code_UNIT_ATTENTION_NO_MEDIUM = {
1379 .key = UNIT_ATTENTION, .asc = 0x3a, .ascq = 0x00
1380 };
1381
1382 /* Unit attention, Medium may have changed */
1383 const struct SCSISense sense_code_MEDIUM_CHANGED = {
1384 .key = UNIT_ATTENTION, .asc = 0x28, .ascq = 0x00
1385 };
1386
1387 /* Unit attention, Reported LUNs data has changed */
1388 const struct SCSISense sense_code_REPORTED_LUNS_CHANGED = {
1389 .key = UNIT_ATTENTION, .asc = 0x3f, .ascq = 0x0e
1390 };
1391
1392 /* Unit attention, Device internal reset */
1393 const struct SCSISense sense_code_DEVICE_INTERNAL_RESET = {
1394 .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x04
1395 };
1396
1397 /* Data Protection, Write Protected */
1398 const struct SCSISense sense_code_WRITE_PROTECTED = {
1399 .key = DATA_PROTECT, .asc = 0x27, .ascq = 0x00
1400 };
1401
1402 /* Data Protection, Space Allocation Failed Write Protect */
1403 const struct SCSISense sense_code_SPACE_ALLOC_FAILED = {
1404 .key = DATA_PROTECT, .asc = 0x27, .ascq = 0x07
1405 };
1406
1407 /*
1408 * scsi_build_sense
1409 *
1410 * Convert between fixed and descriptor sense buffers
1411 */
1412 int scsi_build_sense(uint8_t *in_buf, int in_len,
1413 uint8_t *buf, int len, bool fixed)
1414 {
1415 bool fixed_in;
1416 SCSISense sense;
1417 if (!fixed && len < 8) {
1418 return 0;
1419 }
1420
1421 if (in_len == 0) {
1422 sense.key = NO_SENSE;
1423 sense.asc = 0;
1424 sense.ascq = 0;
1425 } else {
1426 fixed_in = (in_buf[0] & 2) == 0;
1427
1428 if (fixed == fixed_in) {
1429 memcpy(buf, in_buf, MIN(len, in_len));
1430 return MIN(len, in_len);
1431 }
1432
1433 if (fixed_in) {
1434 sense.key = in_buf[2];
1435 sense.asc = in_buf[12];
1436 sense.ascq = in_buf[13];
1437 } else {
1438 sense.key = in_buf[1];
1439 sense.asc = in_buf[2];
1440 sense.ascq = in_buf[3];
1441 }
1442 }
1443
1444 memset(buf, 0, len);
1445 if (fixed) {
1446 /* Return fixed format sense buffer */
1447 buf[0] = 0x70;
1448 buf[2] = sense.key;
1449 buf[7] = 10;
1450 buf[12] = sense.asc;
1451 buf[13] = sense.ascq;
1452 return MIN(len, SCSI_SENSE_LEN);
1453 } else {
1454 /* Return descriptor format sense buffer */
1455 buf[0] = 0x72;
1456 buf[1] = sense.key;
1457 buf[2] = sense.asc;
1458 buf[3] = sense.ascq;
1459 return 8;
1460 }
1461 }
1462
1463 const char *scsi_command_name(uint8_t cmd)
1464 {
1465 static const char *names[] = {
1466 [ TEST_UNIT_READY ] = "TEST_UNIT_READY",
1467 [ REWIND ] = "REWIND",
1468 [ REQUEST_SENSE ] = "REQUEST_SENSE",
1469 [ FORMAT_UNIT ] = "FORMAT_UNIT",
1470 [ READ_BLOCK_LIMITS ] = "READ_BLOCK_LIMITS",
1471 [ REASSIGN_BLOCKS ] = "REASSIGN_BLOCKS/INITIALIZE ELEMENT STATUS",
1472 /* LOAD_UNLOAD and INITIALIZE_ELEMENT_STATUS use the same operation code */
1473 [ READ_6 ] = "READ_6",
1474 [ WRITE_6 ] = "WRITE_6",
1475 [ SET_CAPACITY ] = "SET_CAPACITY",
1476 [ READ_REVERSE ] = "READ_REVERSE",
1477 [ WRITE_FILEMARKS ] = "WRITE_FILEMARKS",
1478 [ SPACE ] = "SPACE",
1479 [ INQUIRY ] = "INQUIRY",
1480 [ RECOVER_BUFFERED_DATA ] = "RECOVER_BUFFERED_DATA",
1481 [ MAINTENANCE_IN ] = "MAINTENANCE_IN",
1482 [ MAINTENANCE_OUT ] = "MAINTENANCE_OUT",
1483 [ MODE_SELECT ] = "MODE_SELECT",
1484 [ RESERVE ] = "RESERVE",
1485 [ RELEASE ] = "RELEASE",
1486 [ COPY ] = "COPY",
1487 [ ERASE ] = "ERASE",
1488 [ MODE_SENSE ] = "MODE_SENSE",
1489 [ START_STOP ] = "START_STOP/LOAD_UNLOAD",
1490 /* LOAD_UNLOAD and START_STOP use the same operation code */
1491 [ RECEIVE_DIAGNOSTIC ] = "RECEIVE_DIAGNOSTIC",
1492 [ SEND_DIAGNOSTIC ] = "SEND_DIAGNOSTIC",
1493 [ ALLOW_MEDIUM_REMOVAL ] = "ALLOW_MEDIUM_REMOVAL",
1494 [ READ_CAPACITY_10 ] = "READ_CAPACITY_10",
1495 [ READ_10 ] = "READ_10",
1496 [ WRITE_10 ] = "WRITE_10",
1497 [ SEEK_10 ] = "SEEK_10/POSITION_TO_ELEMENT",
1498 /* SEEK_10 and POSITION_TO_ELEMENT use the same operation code */
1499 [ WRITE_VERIFY_10 ] = "WRITE_VERIFY_10",
1500 [ VERIFY_10 ] = "VERIFY_10",
1501 [ SEARCH_HIGH ] = "SEARCH_HIGH",
1502 [ SEARCH_EQUAL ] = "SEARCH_EQUAL",
1503 [ SEARCH_LOW ] = "SEARCH_LOW",
1504 [ SET_LIMITS ] = "SET_LIMITS",
1505 [ PRE_FETCH ] = "PRE_FETCH/READ_POSITION",
1506 /* READ_POSITION and PRE_FETCH use the same operation code */
1507 [ SYNCHRONIZE_CACHE ] = "SYNCHRONIZE_CACHE",
1508 [ LOCK_UNLOCK_CACHE ] = "LOCK_UNLOCK_CACHE",
1509 [ READ_DEFECT_DATA ] = "READ_DEFECT_DATA/INITIALIZE_ELEMENT_STATUS_WITH_RANGE",
1510 /* READ_DEFECT_DATA and INITIALIZE_ELEMENT_STATUS_WITH_RANGE use the same operation code */
1511 [ MEDIUM_SCAN ] = "MEDIUM_SCAN",
1512 [ COMPARE ] = "COMPARE",
1513 [ COPY_VERIFY ] = "COPY_VERIFY",
1514 [ WRITE_BUFFER ] = "WRITE_BUFFER",
1515 [ READ_BUFFER ] = "READ_BUFFER",
1516 [ UPDATE_BLOCK ] = "UPDATE_BLOCK",
1517 [ READ_LONG_10 ] = "READ_LONG_10",
1518 [ WRITE_LONG_10 ] = "WRITE_LONG_10",
1519 [ CHANGE_DEFINITION ] = "CHANGE_DEFINITION",
1520 [ WRITE_SAME_10 ] = "WRITE_SAME_10",
1521 [ UNMAP ] = "UNMAP",
1522 [ READ_TOC ] = "READ_TOC",
1523 [ REPORT_DENSITY_SUPPORT ] = "REPORT_DENSITY_SUPPORT",
1524 [ SANITIZE ] = "SANITIZE",
1525 [ GET_CONFIGURATION ] = "GET_CONFIGURATION",
1526 [ LOG_SELECT ] = "LOG_SELECT",
1527 [ LOG_SENSE ] = "LOG_SENSE",
1528 [ MODE_SELECT_10 ] = "MODE_SELECT_10",
1529 [ RESERVE_10 ] = "RESERVE_10",
1530 [ RELEASE_10 ] = "RELEASE_10",
1531 [ MODE_SENSE_10 ] = "MODE_SENSE_10",
1532 [ PERSISTENT_RESERVE_IN ] = "PERSISTENT_RESERVE_IN",
1533 [ PERSISTENT_RESERVE_OUT ] = "PERSISTENT_RESERVE_OUT",
1534 [ WRITE_FILEMARKS_16 ] = "WRITE_FILEMARKS_16",
1535 [ EXTENDED_COPY ] = "EXTENDED_COPY",
1536 [ ATA_PASSTHROUGH_16 ] = "ATA_PASSTHROUGH_16",
1537 [ ACCESS_CONTROL_IN ] = "ACCESS_CONTROL_IN",
1538 [ ACCESS_CONTROL_OUT ] = "ACCESS_CONTROL_OUT",
1539 [ READ_16 ] = "READ_16",
1540 [ COMPARE_AND_WRITE ] = "COMPARE_AND_WRITE",
1541 [ WRITE_16 ] = "WRITE_16",
1542 [ WRITE_VERIFY_16 ] = "WRITE_VERIFY_16",
1543 [ VERIFY_16 ] = "VERIFY_16",
1544 [ PRE_FETCH_16 ] = "PRE_FETCH_16",
1545 [ SYNCHRONIZE_CACHE_16 ] = "SPACE_16/SYNCHRONIZE_CACHE_16",
1546 /* SPACE_16 and SYNCHRONIZE_CACHE_16 use the same operation code */
1547 [ LOCATE_16 ] = "LOCATE_16",
1548 [ WRITE_SAME_16 ] = "ERASE_16/WRITE_SAME_16",
1549 /* ERASE_16 and WRITE_SAME_16 use the same operation code */
1550 [ SERVICE_ACTION_IN_16 ] = "SERVICE_ACTION_IN_16",
1551 [ WRITE_LONG_16 ] = "WRITE_LONG_16",
1552 [ REPORT_LUNS ] = "REPORT_LUNS",
1553 [ ATA_PASSTHROUGH_12 ] = "BLANK/ATA_PASSTHROUGH_12",
1554 [ MOVE_MEDIUM ] = "MOVE_MEDIUM",
1555 [ EXCHANGE_MEDIUM ] = "EXCHANGE MEDIUM",
1556 [ READ_12 ] = "READ_12",
1557 [ WRITE_12 ] = "WRITE_12",
1558 [ ERASE_12 ] = "ERASE_12/GET_PERFORMANCE",
1559 /* ERASE_12 and GET_PERFORMANCE use the same operation code */
1560 [ SERVICE_ACTION_IN_12 ] = "SERVICE_ACTION_IN_12",
1561 [ WRITE_VERIFY_12 ] = "WRITE_VERIFY_12",
1562 [ VERIFY_12 ] = "VERIFY_12",
1563 [ SEARCH_HIGH_12 ] = "SEARCH_HIGH_12",
1564 [ SEARCH_EQUAL_12 ] = "SEARCH_EQUAL_12",
1565 [ SEARCH_LOW_12 ] = "SEARCH_LOW_12",
1566 [ READ_ELEMENT_STATUS ] = "READ_ELEMENT_STATUS",
1567 [ SEND_VOLUME_TAG ] = "SEND_VOLUME_TAG/SET_STREAMING",
1568 /* SEND_VOLUME_TAG and SET_STREAMING use the same operation code */
1569 [ READ_CD ] = "READ_CD",
1570 [ READ_DEFECT_DATA_12 ] = "READ_DEFECT_DATA_12",
1571 [ READ_DVD_STRUCTURE ] = "READ_DVD_STRUCTURE",
1572 [ RESERVE_TRACK ] = "RESERVE_TRACK",
1573 [ SEND_CUE_SHEET ] = "SEND_CUE_SHEET",
1574 [ SEND_DVD_STRUCTURE ] = "SEND_DVD_STRUCTURE",
1575 [ SET_CD_SPEED ] = "SET_CD_SPEED",
1576 [ SET_READ_AHEAD ] = "SET_READ_AHEAD",
1577 [ ALLOW_OVERWRITE ] = "ALLOW_OVERWRITE",
1578 [ MECHANISM_STATUS ] = "MECHANISM_STATUS",
1579 [ GET_EVENT_STATUS_NOTIFICATION ] = "GET_EVENT_STATUS_NOTIFICATION",
1580 [ READ_DISC_INFORMATION ] = "READ_DISC_INFORMATION",
1581 };
1582
1583 if (cmd >= ARRAY_SIZE(names) || names[cmd] == NULL)
1584 return "*UNKNOWN*";
1585 return names[cmd];
1586 }
1587
1588 SCSIRequest *scsi_req_ref(SCSIRequest *req)
1589 {
1590 assert(req->refcount > 0);
1591 req->refcount++;
1592 return req;
1593 }
1594
1595 void scsi_req_unref(SCSIRequest *req)
1596 {
1597 assert(req->refcount > 0);
1598 if (--req->refcount == 0) {
1599 BusState *qbus = req->dev->qdev.parent_bus;
1600 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus);
1601
1602 if (bus->info->free_request && req->hba_private) {
1603 bus->info->free_request(bus, req->hba_private);
1604 }
1605 if (req->ops->free_req) {
1606 req->ops->free_req(req);
1607 }
1608 object_unref(OBJECT(req->dev));
1609 object_unref(OBJECT(qbus->parent));
1610 g_slice_free1(req->ops->size, req);
1611 }
1612 }
1613
1614 /* Tell the device that we finished processing this chunk of I/O. It
1615 will start the next chunk or complete the command. */
1616 void scsi_req_continue(SCSIRequest *req)
1617 {
1618 if (req->io_canceled) {
1619 trace_scsi_req_continue_canceled(req->dev->id, req->lun, req->tag);
1620 return;
1621 }
1622 trace_scsi_req_continue(req->dev->id, req->lun, req->tag);
1623 if (req->cmd.mode == SCSI_XFER_TO_DEV) {
1624 req->ops->write_data(req);
1625 } else {
1626 req->ops->read_data(req);
1627 }
1628 }
1629
1630 /* Called by the devices when data is ready for the HBA. The HBA should
1631 start a DMA operation to read or fill the device's data buffer.
1632 Once it completes, calling scsi_req_continue will restart I/O. */
1633 void scsi_req_data(SCSIRequest *req, int len)
1634 {
1635 uint8_t *buf;
1636 if (req->io_canceled) {
1637 trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len);
1638 return;
1639 }
1640 trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);
1641 assert(req->cmd.mode != SCSI_XFER_NONE);
1642 if (!req->sg) {
1643 req->resid -= len;
1644 req->bus->info->transfer_data(req, len);
1645 return;
1646 }
1647
1648 /* If the device calls scsi_req_data and the HBA specified a
1649 * scatter/gather list, the transfer has to happen in a single
1650 * step. */
1651 assert(!req->dma_started);
1652 req->dma_started = true;
1653
1654 buf = scsi_req_get_buf(req);
1655 if (req->cmd.mode == SCSI_XFER_FROM_DEV) {
1656 req->resid = dma_buf_read(buf, len, req->sg);
1657 } else {
1658 req->resid = dma_buf_write(buf, len, req->sg);
1659 }
1660 scsi_req_continue(req);
1661 }
1662
1663 void scsi_req_print(SCSIRequest *req)
1664 {
1665 FILE *fp = stderr;
1666 int i;
1667
1668 fprintf(fp, "[%s id=%d] %s",
1669 req->dev->qdev.parent_bus->name,
1670 req->dev->id,
1671 scsi_command_name(req->cmd.buf[0]));
1672 for (i = 1; i < req->cmd.len; i++) {
1673 fprintf(fp, " 0x%02x", req->cmd.buf[i]);
1674 }
1675 switch (req->cmd.mode) {
1676 case SCSI_XFER_NONE:
1677 fprintf(fp, " - none\n");
1678 break;
1679 case SCSI_XFER_FROM_DEV:
1680 fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer);
1681 break;
1682 case SCSI_XFER_TO_DEV:
1683 fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer);
1684 break;
1685 default:
1686 fprintf(fp, " - Oops\n");
1687 break;
1688 }
1689 }
1690
1691 void scsi_req_complete(SCSIRequest *req, int status)
1692 {
1693 assert(req->status == -1);
1694 req->status = status;
1695
1696 assert(req->sense_len <= sizeof(req->sense));
1697 if (status == GOOD) {
1698 req->sense_len = 0;
1699 }
1700
1701 if (req->sense_len) {
1702 memcpy(req->dev->sense, req->sense, req->sense_len);
1703 req->dev->sense_len = req->sense_len;
1704 req->dev->sense_is_ua = (req->ops == &reqops_unit_attention);
1705 } else {
1706 req->dev->sense_len = 0;
1707 req->dev->sense_is_ua = false;
1708 }
1709
1710 /*
1711 * Unit attention state is now stored in the device's sense buffer
1712 * if the HBA didn't do autosense. Clear the pending unit attention
1713 * flags.
1714 */
1715 scsi_clear_unit_attention(req);
1716
1717 scsi_req_ref(req);
1718 scsi_req_dequeue(req);
1719 req->bus->info->complete(req, req->status, req->resid);
1720
1721 /* Cancelled requests might end up being completed instead of cancelled */
1722 notifier_list_notify(&req->cancel_notifiers, req);
1723 scsi_req_unref(req);
1724 }
1725
1726 /* Called by the devices when the request is canceled. */
1727 void scsi_req_cancel_complete(SCSIRequest *req)
1728 {
1729 assert(req->io_canceled);
1730 if (req->bus->info->cancel) {
1731 req->bus->info->cancel(req);
1732 }
1733 notifier_list_notify(&req->cancel_notifiers, req);
1734 scsi_req_unref(req);
1735 }
1736
1737 /* Cancel @req asynchronously. @notifier is added to @req's cancellation
1738 * notifier list, the bus will be notified the requests cancellation is
1739 * completed.
1740 * */
1741 void scsi_req_cancel_async(SCSIRequest *req, Notifier *notifier)
1742 {
1743 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag);
1744 if (notifier) {
1745 notifier_list_add(&req->cancel_notifiers, notifier);
1746 }
1747 if (req->io_canceled) {
1748 return;
1749 }
1750 scsi_req_ref(req);
1751 scsi_req_dequeue(req);
1752 req->io_canceled = true;
1753 if (req->aiocb) {
1754 bdrv_aio_cancel_async(req->aiocb);
1755 }
1756 }
1757
1758 void scsi_req_cancel(SCSIRequest *req)
1759 {
1760 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag);
1761 if (!req->enqueued) {
1762 return;
1763 }
1764 scsi_req_ref(req);
1765 scsi_req_dequeue(req);
1766 req->io_canceled = true;
1767 if (req->aiocb) {
1768 bdrv_aio_cancel(req->aiocb);
1769 }
1770 }
1771
1772 static int scsi_ua_precedence(SCSISense sense)
1773 {
1774 if (sense.key != UNIT_ATTENTION) {
1775 return INT_MAX;
1776 }
1777 if (sense.asc == 0x29 && sense.ascq == 0x04) {
1778 /* DEVICE INTERNAL RESET goes with POWER ON OCCURRED */
1779 return 1;
1780 } else if (sense.asc == 0x3F && sense.ascq == 0x01) {
1781 /* MICROCODE HAS BEEN CHANGED goes with SCSI BUS RESET OCCURRED */
1782 return 2;
1783 } else if (sense.asc == 0x29 && (sense.ascq == 0x05 || sense.ascq == 0x06)) {
1784 /* These two go with "all others". */
1785 ;
1786 } else if (sense.asc == 0x29 && sense.ascq <= 0x07) {
1787 /* POWER ON, RESET OR BUS DEVICE RESET OCCURRED = 0
1788 * POWER ON OCCURRED = 1
1789 * SCSI BUS RESET OCCURRED = 2
1790 * BUS DEVICE RESET FUNCTION OCCURRED = 3
1791 * I_T NEXUS LOSS OCCURRED = 7
1792 */
1793 return sense.ascq;
1794 } else if (sense.asc == 0x2F && sense.ascq == 0x01) {
1795 /* COMMANDS CLEARED BY POWER LOSS NOTIFICATION */
1796 return 8;
1797 }
1798 return (sense.asc << 8) | sense.ascq;
1799 }
1800
1801 void scsi_device_set_ua(SCSIDevice *sdev, SCSISense sense)
1802 {
1803 int prec1, prec2;
1804 if (sense.key != UNIT_ATTENTION) {
1805 return;
1806 }
1807 trace_scsi_device_set_ua(sdev->id, sdev->lun, sense.key,
1808 sense.asc, sense.ascq);
1809
1810 /*
1811 * Override a pre-existing unit attention condition, except for a more
1812 * important reset condition.
1813 */
1814 prec1 = scsi_ua_precedence(sdev->unit_attention);
1815 prec2 = scsi_ua_precedence(sense);
1816 if (prec2 < prec1) {
1817 sdev->unit_attention = sense;
1818 }
1819 }
1820
1821 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
1822 {
1823 SCSIRequest *req;
1824
1825 while (!QTAILQ_EMPTY(&sdev->requests)) {
1826 req = QTAILQ_FIRST(&sdev->requests);
1827 scsi_req_cancel(req);
1828 }
1829
1830 scsi_device_set_ua(sdev, sense);
1831 }
1832
1833 static char *scsibus_get_dev_path(DeviceState *dev)
1834 {
1835 SCSIDevice *d = DO_UPCAST(SCSIDevice, qdev, dev);
1836 DeviceState *hba = dev->parent_bus->parent;
1837 char *id;
1838 char *path;
1839
1840 id = qdev_get_dev_path(hba);
1841 if (id) {
1842 path = g_strdup_printf("%s/%d:%d:%d", id, d->channel, d->id, d->lun);
1843 } else {
1844 path = g_strdup_printf("%d:%d:%d", d->channel, d->id, d->lun);
1845 }
1846 g_free(id);
1847 return path;
1848 }
1849
1850 static char *scsibus_get_fw_dev_path(DeviceState *dev)
1851 {
1852 SCSIDevice *d = SCSI_DEVICE(dev);
1853 return g_strdup_printf("channel@%x/%s@%x,%x", d->channel,
1854 qdev_fw_name(dev), d->id, d->lun);
1855 }
1856
1857 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
1858 {
1859 BusChild *kid;
1860 SCSIDevice *target_dev = NULL;
1861
1862 QTAILQ_FOREACH_REVERSE(kid, &bus->qbus.children, ChildrenHead, sibling) {
1863 DeviceState *qdev = kid->child;
1864 SCSIDevice *dev = SCSI_DEVICE(qdev);
1865
1866 if (dev->channel == channel && dev->id == id) {
1867 if (dev->lun == lun) {
1868 return dev;
1869 }
1870 target_dev = dev;
1871 }
1872 }
1873 return target_dev;
1874 }
1875
1876 /* SCSI request list. For simplicity, pv points to the whole device */
1877
1878 static void put_scsi_requests(QEMUFile *f, void *pv, size_t size)
1879 {
1880 SCSIDevice *s = pv;
1881 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
1882 SCSIRequest *req;
1883
1884 QTAILQ_FOREACH(req, &s->requests, next) {
1885 assert(!req->io_canceled);
1886 assert(req->status == -1);
1887 assert(req->enqueued);
1888
1889 qemu_put_sbyte(f, req->retry ? 1 : 2);
1890 qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf));
1891 qemu_put_be32s(f, &req->tag);
1892 qemu_put_be32s(f, &req->lun);
1893 if (bus->info->save_request) {
1894 bus->info->save_request(f, req);
1895 }
1896 if (req->ops->save_request) {
1897 req->ops->save_request(f, req);
1898 }
1899 }
1900 qemu_put_sbyte(f, 0);
1901 }
1902
1903 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size)
1904 {
1905 SCSIDevice *s = pv;
1906 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
1907 int8_t sbyte;
1908
1909 while ((sbyte = qemu_get_sbyte(f)) > 0) {
1910 uint8_t buf[SCSI_CMD_BUF_SIZE];
1911 uint32_t tag;
1912 uint32_t lun;
1913 SCSIRequest *req;
1914
1915 qemu_get_buffer(f, buf, sizeof(buf));
1916 qemu_get_be32s(f, &tag);
1917 qemu_get_be32s(f, &lun);
1918 req = scsi_req_new(s, tag, lun, buf, NULL);
1919 req->retry = (sbyte == 1);
1920 if (bus->info->load_request) {
1921 req->hba_private = bus->info->load_request(f, req);
1922 }
1923 if (req->ops->load_request) {
1924 req->ops->load_request(f, req);
1925 }
1926
1927 /* Just restart it later. */
1928 scsi_req_enqueue_internal(req);
1929
1930 /* At this point, the request will be kept alive by the reference
1931 * added by scsi_req_enqueue_internal, so we can release our reference.
1932 * The HBA of course will add its own reference in the load_request
1933 * callback if it needs to hold on the SCSIRequest.
1934 */
1935 scsi_req_unref(req);
1936 }
1937
1938 return 0;
1939 }
1940
1941 static int scsi_qdev_unplug(DeviceState *qdev)
1942 {
1943 SCSIDevice *dev = SCSI_DEVICE(qdev);
1944 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
1945
1946 if (bus->info->hot_unplug) {
1947 bus->info->hot_unplug(bus, dev);
1948 }
1949 return qdev_simple_unplug_cb(qdev);
1950 }
1951
1952 static const VMStateInfo vmstate_info_scsi_requests = {
1953 .name = "scsi-requests",
1954 .get = get_scsi_requests,
1955 .put = put_scsi_requests,
1956 };
1957
1958 static bool scsi_sense_state_needed(void *opaque)
1959 {
1960 SCSIDevice *s = opaque;
1961
1962 return s->sense_len > SCSI_SENSE_BUF_SIZE_OLD;
1963 }
1964
1965 static const VMStateDescription vmstate_scsi_sense_state = {
1966 .name = "SCSIDevice/sense",
1967 .version_id = 1,
1968 .minimum_version_id = 1,
1969 .fields = (VMStateField[]) {
1970 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice,
1971 SCSI_SENSE_BUF_SIZE_OLD,
1972 SCSI_SENSE_BUF_SIZE - SCSI_SENSE_BUF_SIZE_OLD),
1973 VMSTATE_END_OF_LIST()
1974 }
1975 };
1976
1977 const VMStateDescription vmstate_scsi_device = {
1978 .name = "SCSIDevice",
1979 .version_id = 1,
1980 .minimum_version_id = 1,
1981 .fields = (VMStateField[]) {
1982 VMSTATE_UINT8(unit_attention.key, SCSIDevice),
1983 VMSTATE_UINT8(unit_attention.asc, SCSIDevice),
1984 VMSTATE_UINT8(unit_attention.ascq, SCSIDevice),
1985 VMSTATE_BOOL(sense_is_ua, SCSIDevice),
1986 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 0, SCSI_SENSE_BUF_SIZE_OLD),
1987 VMSTATE_UINT32(sense_len, SCSIDevice),
1988 {
1989 .name = "requests",
1990 .version_id = 0,
1991 .field_exists = NULL,
1992 .size = 0, /* ouch */
1993 .info = &vmstate_info_scsi_requests,
1994 .flags = VMS_SINGLE,
1995 .offset = 0,
1996 },
1997 VMSTATE_END_OF_LIST()
1998 },
1999 .subsections = (VMStateSubsection []) {
2000 {
2001 .vmsd = &vmstate_scsi_sense_state,
2002 .needed = scsi_sense_state_needed,
2003 }, {
2004 /* empty */
2005 }
2006 }
2007 };
2008
2009 static void scsi_device_class_init(ObjectClass *klass, void *data)
2010 {
2011 DeviceClass *k = DEVICE_CLASS(klass);
2012 set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
2013 k->bus_type = TYPE_SCSI_BUS;
2014 k->realize = scsi_qdev_realize;
2015 k->unplug = scsi_qdev_unplug;
2016 k->unrealize = scsi_qdev_unrealize;
2017 k->props = scsi_props;
2018 }
2019
2020 static void scsi_dev_instance_init(Object *obj)
2021 {
2022 DeviceState *dev = DEVICE(obj);
2023 SCSIDevice *s = DO_UPCAST(SCSIDevice, qdev, dev);
2024
2025 device_add_bootindex_property(obj, &s->conf.bootindex,
2026 "bootindex", NULL,
2027 &s->qdev, NULL);
2028 }
2029
2030 static const TypeInfo scsi_device_type_info = {
2031 .name = TYPE_SCSI_DEVICE,
2032 .parent = TYPE_DEVICE,
2033 .instance_size = sizeof(SCSIDevice),
2034 .abstract = true,
2035 .class_size = sizeof(SCSIDeviceClass),
2036 .class_init = scsi_device_class_init,
2037 .instance_init = scsi_dev_instance_init,
2038 };
2039
2040 static void scsi_register_types(void)
2041 {
2042 type_register_static(&scsi_bus_info);
2043 type_register_static(&scsi_device_type_info);
2044 }
2045
2046 type_init(scsi_register_types)
QEmu