2 #include "qemu-error.h"
9 static char *scsibus_get_fw_dev_path(DeviceState
*dev
);
10 static int scsi_req_parse(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
);
11 static int scsi_build_sense(uint8_t *in_buf
, int in_len
,
12 uint8_t *buf
, int len
, bool fixed
);
14 static struct BusInfo scsi_bus_info
= {
16 .size
= sizeof(SCSIBus
),
17 .get_fw_dev_path
= scsibus_get_fw_dev_path
,
18 .props
= (Property
[]) {
19 DEFINE_PROP_UINT32("scsi-id", SCSIDevice
, id
, -1),
20 DEFINE_PROP_UINT32("lun", SCSIDevice
, lun
, 0),
21 DEFINE_PROP_END_OF_LIST(),
24 static int next_scsi_bus
;
26 /* Create a scsi bus, and attach devices to it. */
27 void scsi_bus_new(SCSIBus
*bus
, DeviceState
*host
, const SCSIBusInfo
*info
)
29 qbus_create_inplace(&bus
->qbus
, &scsi_bus_info
, host
, NULL
);
30 bus
->busnr
= next_scsi_bus
++;
32 bus
->qbus
.allow_hotplug
= 1;
35 static int scsi_qdev_init(DeviceState
*qdev
, DeviceInfo
*base
)
37 SCSIDevice
*dev
= DO_UPCAST(SCSIDevice
, qdev
, qdev
);
38 SCSIDeviceInfo
*info
= DO_UPCAST(SCSIDeviceInfo
, qdev
, base
);
39 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, dev
->qdev
.parent_bus
);
45 for (id
= 0; id
< bus
->info
->ndev
; id
++) {
46 if (!scsi_device_find(bus
, id
, 0)) {
52 if (dev
->id
>= bus
->info
->ndev
) {
53 error_report("bad scsi device id: %d", dev
->id
);
57 olddev
= scsi_device_find(bus
, dev
->id
, dev
->lun
);
58 if (olddev
&& dev
->lun
== olddev
->lun
) {
59 qdev_free(&olddev
->qdev
);
63 QTAILQ_INIT(&dev
->requests
);
64 rc
= dev
->info
->init(dev
);
70 static int scsi_qdev_exit(DeviceState
*qdev
)
72 SCSIDevice
*dev
= DO_UPCAST(SCSIDevice
, qdev
, qdev
);
74 if (dev
->info
->destroy
) {
75 dev
->info
->destroy(dev
);
80 void scsi_qdev_register(SCSIDeviceInfo
*info
)
82 info
->qdev
.bus_info
= &scsi_bus_info
;
83 info
->qdev
.init
= scsi_qdev_init
;
84 info
->qdev
.unplug
= qdev_simple_unplug_cb
;
85 info
->qdev
.exit
= scsi_qdev_exit
;
86 qdev_register(&info
->qdev
);
89 /* handle legacy '-drive if=scsi,...' cmd line args */
90 SCSIDevice
*scsi_bus_legacy_add_drive(SCSIBus
*bus
, BlockDriverState
*bdrv
,
91 int unit
, bool removable
)
96 driver
= bdrv_is_sg(bdrv
) ? "scsi-generic" : "scsi-disk";
97 dev
= qdev_create(&bus
->qbus
, driver
);
98 qdev_prop_set_uint32(dev
, "scsi-id", unit
);
99 if (qdev_prop_exists(dev
, "removable")) {
100 qdev_prop_set_bit(dev
, "removable", removable
);
102 if (qdev_prop_set_drive(dev
, "drive", bdrv
) < 0) {
106 if (qdev_init(dev
) < 0)
108 return DO_UPCAST(SCSIDevice
, qdev
, dev
);
111 int scsi_bus_legacy_handle_cmdline(SCSIBus
*bus
)
118 for (unit
= 0; unit
< bus
->info
->ndev
; unit
++) {
119 dinfo
= drive_get(IF_SCSI
, bus
->busnr
, unit
);
123 qemu_opts_loc_restore(dinfo
->opts
);
124 if (!scsi_bus_legacy_add_drive(bus
, dinfo
->bdrv
, unit
, false)) {
133 /* SCSIReqOps implementation for invalid commands. */
135 static int32_t scsi_invalid_command(SCSIRequest
*req
, uint8_t *buf
)
137 scsi_req_build_sense(req
, SENSE_CODE(INVALID_OPCODE
));
138 scsi_req_complete(req
, CHECK_CONDITION
);
142 struct SCSIReqOps reqops_invalid_opcode
= {
143 .size
= sizeof(SCSIRequest
),
144 .send_command
= scsi_invalid_command
147 /* SCSIReqOps implementation for unit attention conditions. */
149 static int32_t scsi_unit_attention(SCSIRequest
*req
, uint8_t *buf
)
151 if (req
->dev
&& req
->dev
->unit_attention
.key
== UNIT_ATTENTION
) {
152 scsi_req_build_sense(req
, req
->dev
->unit_attention
);
153 } else if (req
->bus
->unit_attention
.key
== UNIT_ATTENTION
) {
154 scsi_req_build_sense(req
, req
->bus
->unit_attention
);
156 scsi_req_complete(req
, CHECK_CONDITION
);
160 struct SCSIReqOps reqops_unit_attention
= {
161 .size
= sizeof(SCSIRequest
),
162 .send_command
= scsi_unit_attention
165 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to
168 typedef struct SCSITargetReq SCSITargetReq
;
170 struct SCSITargetReq
{
176 static void store_lun(uint8_t *outbuf
, int lun
)
182 outbuf
[1] = (lun
& 255);
183 outbuf
[0] = (lun
>> 8) | 0x40;
186 static bool scsi_target_emulate_report_luns(SCSITargetReq
*r
)
193 if (r
->req
.cmd
.xfer
< 16) {
196 if (r
->req
.cmd
.buf
[2] > 2) {
202 QTAILQ_FOREACH(qdev
, &r
->req
.bus
->qbus
.children
, sibling
) {
203 SCSIDevice
*dev
= DO_UPCAST(SCSIDevice
, qdev
, qdev
);
215 len
= MIN(n
+ 8, r
->req
.cmd
.xfer
& ~7);
216 if (len
> sizeof(r
->buf
)) {
217 /* TODO: > 256 LUNs? */
221 memset(r
->buf
, 0, len
);
222 stl_be_p(&r
->buf
, n
);
223 i
= found_lun0
? 8 : 16;
224 QTAILQ_FOREACH(qdev
, &r
->req
.bus
->qbus
.children
, sibling
) {
225 SCSIDevice
*dev
= DO_UPCAST(SCSIDevice
, qdev
, qdev
);
228 store_lun(&r
->buf
[i
], dev
->lun
);
237 static bool scsi_target_emulate_inquiry(SCSITargetReq
*r
)
239 assert(r
->req
.dev
->lun
!= r
->req
.lun
);
240 if (r
->req
.cmd
.buf
[1] & 0x2) {
241 /* Command support data - optional, not implemented */
245 if (r
->req
.cmd
.buf
[1] & 0x1) {
246 /* Vital product data */
247 uint8_t page_code
= r
->req
.cmd
.buf
[2];
248 if (r
->req
.cmd
.xfer
< 4) {
252 r
->buf
[r
->len
++] = page_code
; /* this page */
253 r
->buf
[r
->len
++] = 0x00;
256 case 0x00: /* Supported page codes, mandatory */
260 r
->buf
[r
->len
++] = 0x00; /* list of supported pages (this page) */
261 r
->buf
[pages
] = r
->len
- pages
- 1; /* number of pages */
268 assert(r
->len
< sizeof(r
->buf
));
269 r
->len
= MIN(r
->req
.cmd
.xfer
, r
->len
);
273 /* Standard INQUIRY data */
274 if (r
->req
.cmd
.buf
[2] != 0) {
279 if (r
->req
.cmd
.xfer
< 5) {
283 r
->len
= MIN(r
->req
.cmd
.xfer
, 36);
284 memset(r
->buf
, 0, r
->len
);
285 if (r
->req
.lun
!= 0) {
286 r
->buf
[0] = TYPE_NO_LUN
;
288 r
->buf
[0] = TYPE_NOT_PRESENT
| TYPE_INACTIVE
;
289 r
->buf
[2] = 5; /* Version */
290 r
->buf
[3] = 2 | 0x10; /* HiSup, response data format */
291 r
->buf
[4] = r
->len
- 5; /* Additional Length = (Len - 1) - 4 */
292 r
->buf
[7] = 0x10 | (r
->req
.bus
->info
->tcq
? 0x02 : 0); /* Sync, TCQ. */
293 memcpy(&r
->buf
[8], "QEMU ", 8);
294 memcpy(&r
->buf
[16], "QEMU TARGET ", 16);
295 strncpy((char *) &r
->buf
[32], QEMU_VERSION
, 4);
300 static int32_t scsi_target_send_command(SCSIRequest
*req
, uint8_t *buf
)
302 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
306 if (!scsi_target_emulate_report_luns(r
)) {
307 goto illegal_request
;
311 if (!scsi_target_emulate_inquiry(r
)) {
312 goto illegal_request
;
316 if (req
->cmd
.xfer
< 4) {
317 goto illegal_request
;
319 r
->len
= scsi_device_get_sense(r
->req
.dev
, r
->buf
,
320 MIN(req
->cmd
.xfer
, sizeof r
->buf
),
321 (req
->cmd
.buf
[1] & 1) == 0);
322 if (r
->req
.dev
->sense_is_ua
) {
323 if (r
->req
.dev
->info
->unit_attention_reported
) {
324 r
->req
.dev
->info
->unit_attention_reported(req
->dev
);
326 r
->req
.dev
->sense_len
= 0;
327 r
->req
.dev
->sense_is_ua
= false;
331 scsi_req_build_sense(req
, SENSE_CODE(LUN_NOT_SUPPORTED
));
332 scsi_req_complete(req
, CHECK_CONDITION
);
335 scsi_req_build_sense(req
, SENSE_CODE(INVALID_FIELD
));
336 scsi_req_complete(req
, CHECK_CONDITION
);
341 scsi_req_complete(req
, GOOD
);
346 static void scsi_target_read_data(SCSIRequest
*req
)
348 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
354 scsi_req_data(&r
->req
, n
);
356 scsi_req_complete(&r
->req
, GOOD
);
360 static uint8_t *scsi_target_get_buf(SCSIRequest
*req
)
362 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
367 struct SCSIReqOps reqops_target_command
= {
368 .size
= sizeof(SCSITargetReq
),
369 .send_command
= scsi_target_send_command
,
370 .read_data
= scsi_target_read_data
,
371 .get_buf
= scsi_target_get_buf
,
375 SCSIRequest
*scsi_req_alloc(SCSIReqOps
*reqops
, SCSIDevice
*d
, uint32_t tag
,
376 uint32_t lun
, void *hba_private
)
380 req
= g_malloc0(reqops
->size
);
382 req
->bus
= scsi_bus_from_device(d
);
386 req
->hba_private
= hba_private
;
390 trace_scsi_req_alloc(req
->dev
->id
, req
->lun
, req
->tag
);
394 SCSIRequest
*scsi_req_new(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
,
395 uint8_t *buf
, void *hba_private
)
397 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, d
->qdev
.parent_bus
);
401 if (scsi_req_parse(&cmd
, d
, buf
) != 0) {
402 trace_scsi_req_parse_bad(d
->id
, lun
, tag
, buf
[0]);
403 req
= scsi_req_alloc(&reqops_invalid_opcode
, d
, tag
, lun
, hba_private
);
405 trace_scsi_req_parsed(d
->id
, lun
, tag
, buf
[0],
408 trace_scsi_req_parsed_lba(d
->id
, lun
, tag
, buf
[0],
412 if ((d
->unit_attention
.key
== UNIT_ATTENTION
||
413 bus
->unit_attention
.key
== UNIT_ATTENTION
) &&
414 (buf
[0] != INQUIRY
&&
415 buf
[0] != REPORT_LUNS
&&
416 buf
[0] != GET_CONFIGURATION
&&
417 buf
[0] != GET_EVENT_STATUS_NOTIFICATION
&&
420 * If we already have a pending unit attention condition,
421 * report this one before triggering another one.
423 !(buf
[0] == REQUEST_SENSE
&& d
->sense_is_ua
))) {
424 req
= scsi_req_alloc(&reqops_unit_attention
, d
, tag
, lun
,
426 } else if (lun
!= d
->lun
||
427 buf
[0] == REPORT_LUNS
||
428 buf
[0] == REQUEST_SENSE
) {
429 req
= scsi_req_alloc(&reqops_target_command
, d
, tag
, lun
,
432 req
= d
->info
->alloc_req(d
, tag
, lun
, hba_private
);
439 trace_scsi_inquiry(d
->id
, lun
, tag
, cmd
.buf
[1], cmd
.buf
[2]);
441 case TEST_UNIT_READY
:
442 trace_scsi_test_unit_ready(d
->id
, lun
, tag
);
445 trace_scsi_report_luns(d
->id
, lun
, tag
);
448 trace_scsi_request_sense(d
->id
, lun
, tag
);
457 uint8_t *scsi_req_get_buf(SCSIRequest
*req
)
459 return req
->ops
->get_buf(req
);
462 static void scsi_clear_unit_attention(SCSIRequest
*req
)
465 if (req
->dev
->unit_attention
.key
!= UNIT_ATTENTION
&&
466 req
->bus
->unit_attention
.key
!= UNIT_ATTENTION
) {
471 * If an INQUIRY command enters the enabled command state,
472 * the device server shall [not] clear any unit attention condition;
473 * See also MMC-6, paragraphs 6.5 and 6.6.2.
475 if (req
->cmd
.buf
[0] == INQUIRY
||
476 req
->cmd
.buf
[0] == GET_CONFIGURATION
||
477 req
->cmd
.buf
[0] == GET_EVENT_STATUS_NOTIFICATION
) {
481 if (req
->dev
->unit_attention
.key
== UNIT_ATTENTION
) {
482 ua
= &req
->dev
->unit_attention
;
484 ua
= &req
->bus
->unit_attention
;
488 * If a REPORT LUNS command enters the enabled command state, [...]
489 * the device server shall clear any pending unit attention condition
490 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
492 if (req
->cmd
.buf
[0] == REPORT_LUNS
&&
493 !(ua
->asc
== SENSE_CODE(REPORTED_LUNS_CHANGED
).asc
&&
494 ua
->ascq
== SENSE_CODE(REPORTED_LUNS_CHANGED
).ascq
)) {
498 *ua
= SENSE_CODE(NO_SENSE
);
501 int scsi_req_get_sense(SCSIRequest
*req
, uint8_t *buf
, int len
)
506 if (!req
->sense_len
) {
510 ret
= scsi_build_sense(req
->sense
, req
->sense_len
, buf
, len
, true);
513 * FIXME: clearing unit attention conditions upon autosense should be done
514 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
517 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
518 * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
519 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
521 if (req
->dev
->sense_is_ua
) {
522 if (req
->dev
->info
->unit_attention_reported
) {
523 req
->dev
->info
->unit_attention_reported(req
->dev
);
525 req
->dev
->sense_len
= 0;
526 req
->dev
->sense_is_ua
= false;
531 int scsi_device_get_sense(SCSIDevice
*dev
, uint8_t *buf
, int len
, bool fixed
)
533 return scsi_build_sense(dev
->sense
, dev
->sense_len
, buf
, len
, fixed
);
536 void scsi_req_build_sense(SCSIRequest
*req
, SCSISense sense
)
538 trace_scsi_req_build_sense(req
->dev
->id
, req
->lun
, req
->tag
,
539 sense
.key
, sense
.asc
, sense
.ascq
);
540 memset(req
->sense
, 0, 18);
541 req
->sense
[0] = 0xf0;
542 req
->sense
[2] = sense
.key
;
544 req
->sense
[12] = sense
.asc
;
545 req
->sense
[13] = sense
.ascq
;
549 int32_t scsi_req_enqueue(SCSIRequest
*req
)
553 assert(!req
->enqueued
);
555 req
->enqueued
= true;
556 QTAILQ_INSERT_TAIL(&req
->dev
->requests
, req
, next
);
559 rc
= req
->ops
->send_command(req
, req
->cmd
.buf
);
564 static void scsi_req_dequeue(SCSIRequest
*req
)
566 trace_scsi_req_dequeue(req
->dev
->id
, req
->lun
, req
->tag
);
568 QTAILQ_REMOVE(&req
->dev
->requests
, req
, next
);
569 req
->enqueued
= false;
574 static int scsi_req_length(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
576 switch (buf
[0] >> 5) {
580 /* length 0 means 256 blocks */
581 if (cmd
->xfer
== 0) {
587 cmd
->xfer
= lduw_be_p(&buf
[7]);
591 cmd
->xfer
= ldl_be_p(&buf
[10]);
595 cmd
->xfer
= ldl_be_p(&buf
[6]);
603 case TEST_UNIT_READY
:
607 case WRITE_FILEMARKS
:
612 case ALLOW_MEDIUM_REMOVAL
:
615 case SYNCHRONIZE_CACHE
:
616 case LOCK_UNLOCK_CACHE
:
630 case READ_CAPACITY_10
:
633 case READ_BLOCK_LIMITS
:
639 case SEND_VOLUME_TAG
:
646 case WRITE_VERIFY_10
:
649 case WRITE_VERIFY_12
:
651 case WRITE_VERIFY_16
:
652 cmd
->xfer
*= dev
->blocksize
;
657 case RECOVER_BUFFERED_DATA
:
660 cmd
->xfer
*= dev
->blocksize
;
663 cmd
->xfer
= buf
[4] | (buf
[3] << 8);
665 case MAINTENANCE_OUT
:
667 if (dev
->type
== TYPE_ROM
) {
668 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
669 cmd
->xfer
= buf
[9] | (buf
[8] << 8);
676 static int scsi_req_stream_length(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
679 /* stream commands */
682 case RECOVER_BUFFERED_DATA
:
685 cmd
->xfer
= buf
[4] | (buf
[3] << 8) | (buf
[2] << 16);
686 if (buf
[1] & 0x01) { /* fixed */
687 cmd
->xfer
*= dev
->blocksize
;
695 /* generic commands */
697 return scsi_req_length(cmd
, dev
, buf
);
702 static void scsi_cmd_xfer_mode(SCSICommand
*cmd
)
704 switch (cmd
->buf
[0]) {
707 case WRITE_VERIFY_10
:
709 case WRITE_VERIFY_12
:
711 case WRITE_VERIFY_16
:
715 case CHANGE_DEFINITION
:
719 case SEND_DIAGNOSTIC
:
722 case REASSIGN_BLOCKS
:
730 case SEARCH_EQUAL_12
:
733 case SEND_VOLUME_TAG
:
734 case PERSISTENT_RESERVE_OUT
:
735 case MAINTENANCE_OUT
:
736 cmd
->mode
= SCSI_XFER_TO_DEV
;
740 cmd
->mode
= SCSI_XFER_FROM_DEV
;
742 cmd
->mode
= SCSI_XFER_NONE
;
748 static uint64_t scsi_cmd_lba(SCSICommand
*cmd
)
750 uint8_t *buf
= cmd
->buf
;
753 switch (buf
[0] >> 5) {
755 lba
= ldl_be_p(&buf
[0]) & 0x1fffff;
760 lba
= ldl_be_p(&buf
[2]);
763 lba
= ldq_be_p(&buf
[2]);
772 int scsi_req_parse(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
776 if (dev
->type
== TYPE_TAPE
) {
777 rc
= scsi_req_stream_length(cmd
, dev
, buf
);
779 rc
= scsi_req_length(cmd
, dev
, buf
);
784 memcpy(cmd
->buf
, buf
, cmd
->len
);
785 scsi_cmd_xfer_mode(cmd
);
786 cmd
->lba
= scsi_cmd_lba(cmd
);
791 * Predefined sense codes
794 /* No sense data available */
795 const struct SCSISense sense_code_NO_SENSE
= {
796 .key
= NO_SENSE
, .asc
= 0x00 , .ascq
= 0x00
799 /* LUN not ready, Manual intervention required */
800 const struct SCSISense sense_code_LUN_NOT_READY
= {
801 .key
= NOT_READY
, .asc
= 0x04, .ascq
= 0x03
804 /* LUN not ready, Medium not present */
805 const struct SCSISense sense_code_NO_MEDIUM
= {
806 .key
= NOT_READY
, .asc
= 0x3a, .ascq
= 0x00
809 /* LUN not ready, medium removal prevented */
810 const struct SCSISense sense_code_NOT_READY_REMOVAL_PREVENTED
= {
811 .key
= NOT_READY
, .asc
= 0x53, .ascq
= 0x00
814 /* Hardware error, internal target failure */
815 const struct SCSISense sense_code_TARGET_FAILURE
= {
816 .key
= HARDWARE_ERROR
, .asc
= 0x44, .ascq
= 0x00
819 /* Illegal request, invalid command operation code */
820 const struct SCSISense sense_code_INVALID_OPCODE
= {
821 .key
= ILLEGAL_REQUEST
, .asc
= 0x20, .ascq
= 0x00
824 /* Illegal request, LBA out of range */
825 const struct SCSISense sense_code_LBA_OUT_OF_RANGE
= {
826 .key
= ILLEGAL_REQUEST
, .asc
= 0x21, .ascq
= 0x00
829 /* Illegal request, Invalid field in CDB */
830 const struct SCSISense sense_code_INVALID_FIELD
= {
831 .key
= ILLEGAL_REQUEST
, .asc
= 0x24, .ascq
= 0x00
834 /* Illegal request, LUN not supported */
835 const struct SCSISense sense_code_LUN_NOT_SUPPORTED
= {
836 .key
= ILLEGAL_REQUEST
, .asc
= 0x25, .ascq
= 0x00
839 /* Illegal request, Saving parameters not supported */
840 const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED
= {
841 .key
= ILLEGAL_REQUEST
, .asc
= 0x39, .ascq
= 0x00
844 /* Illegal request, Incompatible medium installed */
845 const struct SCSISense sense_code_INCOMPATIBLE_FORMAT
= {
846 .key
= ILLEGAL_REQUEST
, .asc
= 0x30, .ascq
= 0x00
849 /* Illegal request, medium removal prevented */
850 const struct SCSISense sense_code_ILLEGAL_REQ_REMOVAL_PREVENTED
= {
851 .key
= ILLEGAL_REQUEST
, .asc
= 0x53, .ascq
= 0x00
854 /* Command aborted, I/O process terminated */
855 const struct SCSISense sense_code_IO_ERROR
= {
856 .key
= ABORTED_COMMAND
, .asc
= 0x00, .ascq
= 0x06
859 /* Command aborted, I_T Nexus loss occurred */
860 const struct SCSISense sense_code_I_T_NEXUS_LOSS
= {
861 .key
= ABORTED_COMMAND
, .asc
= 0x29, .ascq
= 0x07
864 /* Command aborted, Logical Unit failure */
865 const struct SCSISense sense_code_LUN_FAILURE
= {
866 .key
= ABORTED_COMMAND
, .asc
= 0x3e, .ascq
= 0x01
869 /* Unit attention, Power on, reset or bus device reset occurred */
870 const struct SCSISense sense_code_RESET
= {
871 .key
= UNIT_ATTENTION
, .asc
= 0x29, .ascq
= 0x00
874 /* Unit attention, No medium */
875 const struct SCSISense sense_code_UNIT_ATTENTION_NO_MEDIUM
= {
876 .key
= UNIT_ATTENTION
, .asc
= 0x3a, .ascq
= 0x00
879 /* Unit attention, Medium may have changed */
880 const struct SCSISense sense_code_MEDIUM_CHANGED
= {
881 .key
= UNIT_ATTENTION
, .asc
= 0x28, .ascq
= 0x00
884 /* Unit attention, Reported LUNs data has changed */
885 const struct SCSISense sense_code_REPORTED_LUNS_CHANGED
= {
886 .key
= UNIT_ATTENTION
, .asc
= 0x3f, .ascq
= 0x0e
889 /* Unit attention, Device internal reset */
890 const struct SCSISense sense_code_DEVICE_INTERNAL_RESET
= {
891 .key
= UNIT_ATTENTION
, .asc
= 0x29, .ascq
= 0x04
897 * Convert between fixed and descriptor sense buffers
899 int scsi_build_sense(uint8_t *in_buf
, int in_len
,
900 uint8_t *buf
, int len
, bool fixed
)
904 if (!fixed
&& len
< 8) {
909 sense
.key
= NO_SENSE
;
913 fixed_in
= (in_buf
[0] & 2) == 0;
915 if (fixed
== fixed_in
) {
916 memcpy(buf
, in_buf
, MIN(len
, in_len
));
917 return MIN(len
, in_len
);
921 sense
.key
= in_buf
[2];
922 sense
.asc
= in_buf
[12];
923 sense
.ascq
= in_buf
[13];
925 sense
.key
= in_buf
[1];
926 sense
.asc
= in_buf
[2];
927 sense
.ascq
= in_buf
[3];
933 /* Return fixed format sense buffer */
938 buf
[13] = sense
.ascq
;
941 /* Return descriptor format sense buffer */
950 static const char *scsi_command_name(uint8_t cmd
)
952 static const char *names
[] = {
953 [ TEST_UNIT_READY
] = "TEST_UNIT_READY",
954 [ REWIND
] = "REWIND",
955 [ REQUEST_SENSE
] = "REQUEST_SENSE",
956 [ FORMAT_UNIT
] = "FORMAT_UNIT",
957 [ READ_BLOCK_LIMITS
] = "READ_BLOCK_LIMITS",
958 [ REASSIGN_BLOCKS
] = "REASSIGN_BLOCKS",
959 [ READ_6
] = "READ_6",
960 [ WRITE_6
] = "WRITE_6",
961 [ SEEK_6
] = "SEEK_6",
962 [ READ_REVERSE
] = "READ_REVERSE",
963 [ WRITE_FILEMARKS
] = "WRITE_FILEMARKS",
965 [ INQUIRY
] = "INQUIRY",
966 [ RECOVER_BUFFERED_DATA
] = "RECOVER_BUFFERED_DATA",
967 [ MAINTENANCE_IN
] = "MAINTENANCE_IN",
968 [ MAINTENANCE_OUT
] = "MAINTENANCE_OUT",
969 [ MODE_SELECT
] = "MODE_SELECT",
970 [ RESERVE
] = "RESERVE",
971 [ RELEASE
] = "RELEASE",
974 [ MODE_SENSE
] = "MODE_SENSE",
975 [ START_STOP
] = "START_STOP",
976 [ RECEIVE_DIAGNOSTIC
] = "RECEIVE_DIAGNOSTIC",
977 [ SEND_DIAGNOSTIC
] = "SEND_DIAGNOSTIC",
978 [ ALLOW_MEDIUM_REMOVAL
] = "ALLOW_MEDIUM_REMOVAL",
979 [ READ_CAPACITY_10
] = "READ_CAPACITY_10",
980 [ READ_10
] = "READ_10",
981 [ WRITE_10
] = "WRITE_10",
982 [ SEEK_10
] = "SEEK_10",
983 [ WRITE_VERIFY_10
] = "WRITE_VERIFY_10",
984 [ VERIFY_10
] = "VERIFY_10",
985 [ SEARCH_HIGH
] = "SEARCH_HIGH",
986 [ SEARCH_EQUAL
] = "SEARCH_EQUAL",
987 [ SEARCH_LOW
] = "SEARCH_LOW",
988 [ SET_LIMITS
] = "SET_LIMITS",
989 [ PRE_FETCH
] = "PRE_FETCH",
990 /* READ_POSITION and PRE_FETCH use the same operation code */
991 [ SYNCHRONIZE_CACHE
] = "SYNCHRONIZE_CACHE",
992 [ LOCK_UNLOCK_CACHE
] = "LOCK_UNLOCK_CACHE",
993 [ READ_DEFECT_DATA
] = "READ_DEFECT_DATA",
994 [ MEDIUM_SCAN
] = "MEDIUM_SCAN",
995 [ COMPARE
] = "COMPARE",
996 [ COPY_VERIFY
] = "COPY_VERIFY",
997 [ WRITE_BUFFER
] = "WRITE_BUFFER",
998 [ READ_BUFFER
] = "READ_BUFFER",
999 [ UPDATE_BLOCK
] = "UPDATE_BLOCK",
1000 [ READ_LONG_10
] = "READ_LONG_10",
1001 [ WRITE_LONG_10
] = "WRITE_LONG_10",
1002 [ CHANGE_DEFINITION
] = "CHANGE_DEFINITION",
1003 [ WRITE_SAME_10
] = "WRITE_SAME_10",
1004 [ UNMAP
] = "UNMAP",
1005 [ READ_TOC
] = "READ_TOC",
1006 [ REPORT_DENSITY_SUPPORT
] = "REPORT_DENSITY_SUPPORT",
1007 [ GET_CONFIGURATION
] = "GET_CONFIGURATION",
1008 [ LOG_SELECT
] = "LOG_SELECT",
1009 [ LOG_SENSE
] = "LOG_SENSE",
1010 [ MODE_SELECT_10
] = "MODE_SELECT_10",
1011 [ RESERVE_10
] = "RESERVE_10",
1012 [ RELEASE_10
] = "RELEASE_10",
1013 [ MODE_SENSE_10
] = "MODE_SENSE_10",
1014 [ PERSISTENT_RESERVE_IN
] = "PERSISTENT_RESERVE_IN",
1015 [ PERSISTENT_RESERVE_OUT
] = "PERSISTENT_RESERVE_OUT",
1016 [ WRITE_FILEMARKS_16
] = "WRITE_FILEMARKS_16",
1017 [ EXTENDED_COPY
] = "EXTENDED_COPY",
1018 [ ATA_PASSTHROUGH
] = "ATA_PASSTHROUGH",
1019 [ ACCESS_CONTROL_IN
] = "ACCESS_CONTROL_IN",
1020 [ ACCESS_CONTROL_OUT
] = "ACCESS_CONTROL_OUT",
1021 [ READ_16
] = "READ_16",
1022 [ COMPARE_AND_WRITE
] = "COMPARE_AND_WRITE",
1023 [ WRITE_16
] = "WRITE_16",
1024 [ WRITE_VERIFY_16
] = "WRITE_VERIFY_16",
1025 [ VERIFY_16
] = "VERIFY_16",
1026 [ SYNCHRONIZE_CACHE_16
] = "SYNCHRONIZE_CACHE_16",
1027 [ LOCATE_16
] = "LOCATE_16",
1028 [ WRITE_SAME_16
] = "WRITE_SAME_16",
1029 /* ERASE_16 and WRITE_SAME_16 use the same operation code */
1030 [ SERVICE_ACTION_IN_16
] = "SERVICE_ACTION_IN_16",
1031 [ WRITE_LONG_16
] = "WRITE_LONG_16",
1032 [ REPORT_LUNS
] = "REPORT_LUNS",
1033 [ BLANK
] = "BLANK",
1034 [ MOVE_MEDIUM
] = "MOVE_MEDIUM",
1035 [ LOAD_UNLOAD
] = "LOAD_UNLOAD",
1036 [ READ_12
] = "READ_12",
1037 [ WRITE_12
] = "WRITE_12",
1038 [ SERVICE_ACTION_IN_12
] = "SERVICE_ACTION_IN_12",
1039 [ WRITE_VERIFY_12
] = "WRITE_VERIFY_12",
1040 [ VERIFY_12
] = "VERIFY_12",
1041 [ SEARCH_HIGH_12
] = "SEARCH_HIGH_12",
1042 [ SEARCH_EQUAL_12
] = "SEARCH_EQUAL_12",
1043 [ SEARCH_LOW_12
] = "SEARCH_LOW_12",
1044 [ READ_ELEMENT_STATUS
] = "READ_ELEMENT_STATUS",
1045 [ SEND_VOLUME_TAG
] = "SEND_VOLUME_TAG",
1046 [ READ_DEFECT_DATA_12
] = "READ_DEFECT_DATA_12",
1047 [ SET_CD_SPEED
] = "SET_CD_SPEED",
1050 if (cmd
>= ARRAY_SIZE(names
) || names
[cmd
] == NULL
)
1055 SCSIRequest
*scsi_req_ref(SCSIRequest
*req
)
1061 void scsi_req_unref(SCSIRequest
*req
)
1063 if (--req
->refcount
== 0) {
1064 if (req
->ops
->free_req
) {
1065 req
->ops
->free_req(req
);
1071 /* Tell the device that we finished processing this chunk of I/O. It
1072 will start the next chunk or complete the command. */
1073 void scsi_req_continue(SCSIRequest
*req
)
1075 trace_scsi_req_continue(req
->dev
->id
, req
->lun
, req
->tag
);
1076 if (req
->cmd
.mode
== SCSI_XFER_TO_DEV
) {
1077 req
->ops
->write_data(req
);
1079 req
->ops
->read_data(req
);
1083 /* Called by the devices when data is ready for the HBA. The HBA should
1084 start a DMA operation to read or fill the device's data buffer.
1085 Once it completes, calling scsi_req_continue will restart I/O. */
1086 void scsi_req_data(SCSIRequest
*req
, int len
)
1088 trace_scsi_req_data(req
->dev
->id
, req
->lun
, req
->tag
, len
);
1089 req
->bus
->info
->transfer_data(req
, len
);
1092 void scsi_req_print(SCSIRequest
*req
)
1097 fprintf(fp
, "[%s id=%d] %s",
1098 req
->dev
->qdev
.parent_bus
->name
,
1100 scsi_command_name(req
->cmd
.buf
[0]));
1101 for (i
= 1; i
< req
->cmd
.len
; i
++) {
1102 fprintf(fp
, " 0x%02x", req
->cmd
.buf
[i
]);
1104 switch (req
->cmd
.mode
) {
1105 case SCSI_XFER_NONE
:
1106 fprintf(fp
, " - none\n");
1108 case SCSI_XFER_FROM_DEV
:
1109 fprintf(fp
, " - from-dev len=%zd\n", req
->cmd
.xfer
);
1111 case SCSI_XFER_TO_DEV
:
1112 fprintf(fp
, " - to-dev len=%zd\n", req
->cmd
.xfer
);
1115 fprintf(fp
, " - Oops\n");
1120 void scsi_req_complete(SCSIRequest
*req
, int status
)
1122 assert(req
->status
== -1);
1123 req
->status
= status
;
1125 assert(req
->sense_len
< sizeof(req
->sense
));
1126 if (status
== GOOD
) {
1130 if (req
->sense_len
) {
1131 memcpy(req
->dev
->sense
, req
->sense
, req
->sense_len
);
1132 req
->dev
->sense_len
= req
->sense_len
;
1133 req
->dev
->sense_is_ua
= (req
->ops
== &reqops_unit_attention
);
1135 req
->dev
->sense_len
= 0;
1136 req
->dev
->sense_is_ua
= false;
1140 * Unit attention state is now stored in the device's sense buffer
1141 * if the HBA didn't do autosense. Clear the pending unit attention
1144 scsi_clear_unit_attention(req
);
1147 scsi_req_dequeue(req
);
1148 req
->bus
->info
->complete(req
, req
->status
);
1149 scsi_req_unref(req
);
1152 void scsi_req_cancel(SCSIRequest
*req
)
1154 if (req
->ops
->cancel_io
) {
1155 req
->ops
->cancel_io(req
);
1158 scsi_req_dequeue(req
);
1159 if (req
->bus
->info
->cancel
) {
1160 req
->bus
->info
->cancel(req
);
1162 scsi_req_unref(req
);
1165 void scsi_req_abort(SCSIRequest
*req
, int status
)
1167 if (req
->ops
->cancel_io
) {
1168 req
->ops
->cancel_io(req
);
1170 scsi_req_complete(req
, status
);
1173 void scsi_device_purge_requests(SCSIDevice
*sdev
, SCSISense sense
)
1177 while (!QTAILQ_EMPTY(&sdev
->requests
)) {
1178 req
= QTAILQ_FIRST(&sdev
->requests
);
1179 scsi_req_cancel(req
);
1181 sdev
->unit_attention
= sense
;
1184 static char *scsibus_get_fw_dev_path(DeviceState
*dev
)
1186 SCSIDevice
*d
= DO_UPCAST(SCSIDevice
, qdev
, dev
);
1189 snprintf(path
, sizeof(path
), "%s@%d:%d:%d", qdev_fw_name(dev
),
1192 return strdup(path
);
1195 SCSIDevice
*scsi_device_find(SCSIBus
*bus
, int id
, int lun
)
1198 SCSIDevice
*target_dev
= NULL
;
1200 QTAILQ_FOREACH_REVERSE(qdev
, &bus
->qbus
.children
, ChildrenHead
, sibling
) {
1201 SCSIDevice
*dev
= DO_UPCAST(SCSIDevice
, qdev
, qdev
);
1203 if (dev
->id
== id
) {
1204 if (dev
->lun
== lun
) {