?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
scsi-bus: correct responses for INQUIRY and REQUEST SENSE
[qemu/kevin.git] / hw / scsi / scsi-bus.c
blobade31c11f536439374b77e1dd9c887c917f71d92
1 #include "qemu/osdep.h"
2 #include "hw/hw.h"
3 #include "qapi/error.h"
4 #include "qemu/error-report.h"
5 #include "hw/scsi/scsi.h"
6 #include "block/scsi.h"
7 #include "hw/qdev.h"
8 #include "sysemu/block-backend.h"
9 #include "sysemu/blockdev.h"
10 #include "trace.h"
11 #include "sysemu/dma.h"
12 #include "qemu/cutils.h"
13
14 static char *scsibus_get_dev_path(DeviceState *dev);
15 static char *scsibus_get_fw_dev_path(DeviceState *dev);
16 static void scsi_req_dequeue(SCSIRequest *req);
17 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len);
18 static void scsi_target_free_buf(SCSIRequest *req);
19
20 static Property scsi_props[] = {
21 DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0),
22 DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1),
23 DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1),
24 DEFINE_PROP_END_OF_LIST(),
25 };
26
27 static void scsi_bus_class_init(ObjectClass *klass, void *data)
28 {
29 BusClass *k = BUS_CLASS(klass);
30 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
31
32 k->get_dev_path = scsibus_get_dev_path;
33 k->get_fw_dev_path = scsibus_get_fw_dev_path;
34 hc->unplug = qdev_simple_device_unplug_cb;
35 }
36
37 static const TypeInfo scsi_bus_info = {
38 .name = TYPE_SCSI_BUS,
39 .parent = TYPE_BUS,
40 .instance_size = sizeof(SCSIBus),
41 .class_init = scsi_bus_class_init,
42 .interfaces = (InterfaceInfo[]) {
43 { TYPE_HOTPLUG_HANDLER },
44 { }
45 }
46 };
47 static int next_scsi_bus;
48
49 static void scsi_device_realize(SCSIDevice *s, Error **errp)
50 {
51 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
52 if (sc->realize) {
53 sc->realize(s, errp);
54 }
55 }
56
57 int scsi_bus_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf,
58 void *hba_private)
59 {
60 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
61 int rc;
62
63 assert(cmd->len == 0);
64 rc = scsi_req_parse_cdb(dev, cmd, buf);
65 if (bus->info->parse_cdb) {
66 rc = bus->info->parse_cdb(dev, cmd, buf, hba_private);
67 }
68 return rc;
69 }
70
71 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun,
72 uint8_t *buf, void *hba_private)
73 {
74 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
75 if (sc->alloc_req) {
76 return sc->alloc_req(s, tag, lun, buf, hba_private);
77 }
78
79 return NULL;
80 }
81
82 void scsi_device_unit_attention_reported(SCSIDevice *s)
83 {
84 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
85 if (sc->unit_attention_reported) {
86 sc->unit_attention_reported(s);
87 }
88 }
89
90 /* Create a scsi bus, and attach devices to it. */
91 void scsi_bus_new(SCSIBus *bus, size_t bus_size, DeviceState *host,
92 const SCSIBusInfo *info, const char *bus_name)
93 {
94 qbus_create_inplace(bus, bus_size, TYPE_SCSI_BUS, host, bus_name);
95 bus->busnr = next_scsi_bus++;
96 bus->info = info;
97 qbus_set_bus_hotplug_handler(BUS(bus), &error_abort);
98 }
99
100 static void scsi_dma_restart_bh(void *opaque)
101 {
102 SCSIDevice *s = opaque;
103 SCSIRequest *req, *next;
104
105 qemu_bh_delete(s->bh);
106 s->bh = NULL;
107
108 aio_context_acquire(blk_get_aio_context(s->conf.blk));
109 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
110 scsi_req_ref(req);
111 if (req->retry) {
112 req->retry = false;
113 switch (req->cmd.mode) {
114 case SCSI_XFER_FROM_DEV:
115 case SCSI_XFER_TO_DEV:
116 scsi_req_continue(req);
117 break;
118 case SCSI_XFER_NONE:
119 scsi_req_dequeue(req);
120 scsi_req_enqueue(req);
121 break;
122 }
123 }
124 scsi_req_unref(req);
125 }
126 aio_context_release(blk_get_aio_context(s->conf.blk));
127 }
128
129 void scsi_req_retry(SCSIRequest *req)
130 {
131 /* No need to save a reference, because scsi_dma_restart_bh just
132 * looks at the request list. */
133 req->retry = true;
134 }
135
136 static void scsi_dma_restart_cb(void *opaque, int running, RunState state)
137 {
138 SCSIDevice *s = opaque;
139
140 if (!running) {
141 return;
142 }
143 if (!s->bh) {
144 AioContext *ctx = blk_get_aio_context(s->conf.blk);
145 s->bh = aio_bh_new(ctx, scsi_dma_restart_bh, s);
146 qemu_bh_schedule(s->bh);
147 }
148 }
149
150 static void scsi_qdev_realize(DeviceState *qdev, Error **errp)
151 {
152 SCSIDevice *dev = SCSI_DEVICE(qdev);
153 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
154 SCSIDevice *d;
155 Error *local_err = NULL;
156
157 if (dev->channel > bus->info->max_channel) {
158 error_setg(errp, "bad scsi channel id: %d", dev->channel);
159 return;
160 }
161 if (dev->id != -1 && dev->id > bus->info->max_target) {
162 error_setg(errp, "bad scsi device id: %d", dev->id);
163 return;
164 }
165 if (dev->lun != -1 && dev->lun > bus->info->max_lun) {
166 error_setg(errp, "bad scsi device lun: %d", dev->lun);
167 return;
168 }
169
170 if (dev->id == -1) {
171 int id = -1;
172 if (dev->lun == -1) {
173 dev->lun = 0;
174 }
175 do {
176 d = scsi_device_find(bus, dev->channel, ++id, dev->lun);
177 } while (d && d->lun == dev->lun && id < bus->info->max_target);
178 if (d && d->lun == dev->lun) {
179 error_setg(errp, "no free target");
180 return;
181 }
182 dev->id = id;
183 } else if (dev->lun == -1) {
184 int lun = -1;
185 do {
186 d = scsi_device_find(bus, dev->channel, dev->id, ++lun);
187 } while (d && d->lun == lun && lun < bus->info->max_lun);
188 if (d && d->lun == lun) {
189 error_setg(errp, "no free lun");
190 return;
191 }
192 dev->lun = lun;
193 } else {
194 d = scsi_device_find(bus, dev->channel, dev->id, dev->lun);
195 assert(d);
196 if (d->lun == dev->lun && dev != d) {
197 error_setg(errp, "lun already used by '%s'", d->qdev.id);
198 return;
199 }
200 }
201
202 QTAILQ_INIT(&dev->requests);
203 scsi_device_realize(dev, &local_err);
204 if (local_err) {
205 error_propagate(errp, local_err);
206 return;
207 }
208 dev->vmsentry = qemu_add_vm_change_state_handler(scsi_dma_restart_cb,
209 dev);
210 }
211
212 static void scsi_qdev_unrealize(DeviceState *qdev, Error **errp)
213 {
214 SCSIDevice *dev = SCSI_DEVICE(qdev);
215
216 if (dev->vmsentry) {
217 qemu_del_vm_change_state_handler(dev->vmsentry);
218 }
219
220 scsi_device_purge_requests(dev, SENSE_CODE(NO_SENSE));
221 blockdev_mark_auto_del(dev->conf.blk);
222 }
223
224 /* handle legacy '-drive if=scsi,...' cmd line args */
225 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockBackend *blk,
226 int unit, bool removable, int bootindex,
227 const char *serial, Error **errp)
228 {
229 const char *driver;
230 char *name;
231 DeviceState *dev;
232 Error *err = NULL;
233
234 driver = blk_is_sg(blk) ? "scsi-generic" : "scsi-disk";
235 dev = qdev_create(&bus->qbus, driver);
236 name = g_strdup_printf("legacy[%d]", unit);
237 object_property_add_child(OBJECT(bus), name, OBJECT(dev), NULL);
238 g_free(name);
239
240 qdev_prop_set_uint32(dev, "scsi-id", unit);
241 if (bootindex >= 0) {
242 object_property_set_int(OBJECT(dev), bootindex, "bootindex",
243 &error_abort);
244 }
245 if (object_property_find(OBJECT(dev), "removable", NULL)) {
246 qdev_prop_set_bit(dev, "removable", removable);
247 }
248 if (serial && object_property_find(OBJECT(dev), "serial", NULL)) {
249 qdev_prop_set_string(dev, "serial", serial);
250 }
251 qdev_prop_set_drive(dev, "drive", blk, &err);
252 if (err) {
253 error_propagate(errp, err);
254 object_unparent(OBJECT(dev));
255 return NULL;
256 }
257 object_property_set_bool(OBJECT(dev), true, "realized", &err);
258 if (err != NULL) {
259 error_propagate(errp, err);
260 object_unparent(OBJECT(dev));
261 return NULL;
262 }
263 return SCSI_DEVICE(dev);
264 }
265
266 void scsi_bus_legacy_handle_cmdline(SCSIBus *bus, bool deprecated)
267 {
268 Location loc;
269 DriveInfo *dinfo;
270 int unit;
271
272 loc_push_none(&loc);
273 for (unit = 0; unit <= bus->info->max_target; unit++) {
274 dinfo = drive_get(IF_SCSI, bus->busnr, unit);
275 if (dinfo == NULL) {
276 continue;
277 }
278 qemu_opts_loc_restore(dinfo->opts);
279 if (deprecated) {
280 /* Handling -drive not claimed by machine initialization */
281 if (blk_get_attached_dev(blk_by_legacy_dinfo(dinfo))) {
282 continue; /* claimed */
283 }
284 if (!dinfo->is_default) {
285 warn_report("bus=%d,unit=%d is deprecated with this"
286 " machine type",
287 bus->busnr, unit);
288 }
289 }
290 scsi_bus_legacy_add_drive(bus, blk_by_legacy_dinfo(dinfo),
291 unit, false, -1, NULL, &error_fatal);
292 }
293 loc_pop(&loc);
294 }
295
296 static bool is_scsi_hba_with_legacy_magic(Object *obj)
297 {
298 static const char *magic[] = {
299 "am53c974", "dc390", "esp", "lsi53c810", "lsi53c895a",
300 "megasas", "megasas-gen2", "mptsas1068", "spapr-vscsi",
301 "virtio-scsi-device",
302 NULL
303 };
304 const char *typename = object_get_typename(obj);
305 int i;
306
307 for (i = 0; magic[i]; i++)
308 if (!strcmp(typename, magic[i])) {
309 return true;
310 }
311
312 return false;
313 }
314
315 static int scsi_legacy_handle_cmdline_cb(Object *obj, void *opaque)
316 {
317 SCSIBus *bus = (SCSIBus *)object_dynamic_cast(obj, TYPE_SCSI_BUS);
318
319 if (bus && is_scsi_hba_with_legacy_magic(OBJECT(bus->qbus.parent))) {
320 scsi_bus_legacy_handle_cmdline(bus, true);
321 }
322
323 return 0;
324 }
325
326 void scsi_legacy_handle_cmdline(void)
327 {
328 object_child_foreach_recursive(object_get_root(),
329 scsi_legacy_handle_cmdline_cb, NULL);
330 }
331
332 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf)
333 {
334 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
335 scsi_req_complete(req, CHECK_CONDITION);
336 return 0;
337 }
338
339 static const struct SCSIReqOps reqops_invalid_field = {
340 .size = sizeof(SCSIRequest),
341 .send_command = scsi_invalid_field
342 };
343
344 /* SCSIReqOps implementation for invalid commands. */
345
346 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf)
347 {
348 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE));
349 scsi_req_complete(req, CHECK_CONDITION);
350 return 0;
351 }
352
353 static const struct SCSIReqOps reqops_invalid_opcode = {
354 .size = sizeof(SCSIRequest),
355 .send_command = scsi_invalid_command
356 };
357
358 /* SCSIReqOps implementation for unit attention conditions. */
359
360 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
361 {
362 if (req->dev->unit_attention.key == UNIT_ATTENTION) {
363 scsi_req_build_sense(req, req->dev->unit_attention);
364 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
365 scsi_req_build_sense(req, req->bus->unit_attention);
366 }
367 scsi_req_complete(req, CHECK_CONDITION);
368 return 0;
369 }
370
371 static const struct SCSIReqOps reqops_unit_attention = {
372 .size = sizeof(SCSIRequest),
373 .send_command = scsi_unit_attention
374 };
375
376 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to
377 an invalid LUN. */
378
379 typedef struct SCSITargetReq SCSITargetReq;
380
381 struct SCSITargetReq {
382 SCSIRequest req;
383 int len;
384 uint8_t *buf;
385 int buf_len;
386 };
387
388 static void store_lun(uint8_t *outbuf, int lun)
389 {
390 if (lun < 256) {
391 outbuf[1] = lun;
392 return;
393 }
394 outbuf[1] = (lun & 255);
395 outbuf[0] = (lun >> 8) | 0x40;
396 }
397
398 static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
399 {
400 BusChild *kid;
401 int i, len, n;
402 int channel, id;
403 bool found_lun0;
404
405 if (r->req.cmd.xfer < 16) {
406 return false;
407 }
408 if (r->req.cmd.buf[2] > 2) {
409 return false;
410 }
411 channel = r->req.dev->channel;
412 id = r->req.dev->id;
413 found_lun0 = false;
414 n = 0;
415 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) {
416 DeviceState *qdev = kid->child;
417 SCSIDevice *dev = SCSI_DEVICE(qdev);
418
419 if (dev->channel == channel && dev->id == id) {
420 if (dev->lun == 0) {
421 found_lun0 = true;
422 }
423 n += 8;
424 }
425 }
426 if (!found_lun0) {
427 n += 8;
428 }
429
430 scsi_target_alloc_buf(&r->req, n + 8);
431
432 len = MIN(n + 8, r->req.cmd.xfer & ~7);
433 memset(r->buf, 0, len);
434 stl_be_p(&r->buf[0], n);
435 i = found_lun0 ? 8 : 16;
436 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) {
437 DeviceState *qdev = kid->child;
438 SCSIDevice *dev = SCSI_DEVICE(qdev);
439
440 if (dev->channel == channel && dev->id == id) {
441 store_lun(&r->buf[i], dev->lun);
442 i += 8;
443 }
444 }
445 assert(i == n + 8);
446 r->len = len;
447 return true;
448 }
449
450 static bool scsi_target_emulate_inquiry(SCSITargetReq *r)
451 {
452 assert(r->req.dev->lun != r->req.lun);
453
454 scsi_target_alloc_buf(&r->req, SCSI_INQUIRY_LEN);
455
456 if (r->req.cmd.buf[1] & 0x2) {
457 /* Command support data - optional, not implemented */
458 return false;
459 }
460
461 if (r->req.cmd.buf[1] & 0x1) {
462 /* Vital product data */
463 uint8_t page_code = r->req.cmd.buf[2];
464 r->buf[r->len++] = page_code ; /* this page */
465 r->buf[r->len++] = 0x00;
466
467 switch (page_code) {
468 case 0x00: /* Supported page codes, mandatory */
469 {
470 int pages;
471 pages = r->len++;
472 r->buf[r->len++] = 0x00; /* list of supported pages (this page) */
473 r->buf[pages] = r->len - pages - 1; /* number of pages */
474 break;
475 }
476 default:
477 return false;
478 }
479 /* done with EVPD */
480 assert(r->len < r->buf_len);
481 r->len = MIN(r->req.cmd.xfer, r->len);
482 return true;
483 }
484
485 /* Standard INQUIRY data */
486 if (r->req.cmd.buf[2] != 0) {
487 return false;
488 }
489
490 /* PAGE CODE == 0 */
491 r->len = MIN(r->req.cmd.xfer, SCSI_INQUIRY_LEN);
492 memset(r->buf, 0, r->len);
493 if (r->req.lun != 0) {
494 r->buf[0] = TYPE_NO_LUN;
495 } else {
496 r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE;
497 r->buf[2] = 5; /* Version */
498 r->buf[3] = 2 | 0x10; /* HiSup, response data format */
499 r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */
500 r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ. */
501 memcpy(&r->buf[8], "QEMU ", 8);
502 memcpy(&r->buf[16], "QEMU TARGET ", 16);
503 pstrcpy((char *) &r->buf[32], 4, qemu_hw_version());
504 }
505 return true;
506 }
507
508 static size_t scsi_sense_len(SCSIRequest *req)
509 {
510 if (req->dev->type == TYPE_SCANNER)
511 return SCSI_SENSE_LEN_SCANNER;
512 else
513 return SCSI_SENSE_LEN;
514 }
515
516 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf)
517 {
518 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
519 int fixed_sense = (req->cmd.buf[1] & 1) == 0;
520
521 if (req->lun != 0 &&
522 buf[0] != INQUIRY && buf[0] != REQUEST_SENSE) {
523 scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED));
524 scsi_req_complete(req, CHECK_CONDITION);
525 return 0;
526 }
527 switch (buf[0]) {
528 case REPORT_LUNS:
529 if (!scsi_target_emulate_report_luns(r)) {
530 goto illegal_request;
531 }
532 break;
533 case INQUIRY:
534 if (!scsi_target_emulate_inquiry(r)) {
535 goto illegal_request;
536 }
537 break;
538 case REQUEST_SENSE:
539 scsi_target_alloc_buf(&r->req, scsi_sense_len(req));
540 if (req->lun != 0) {
541 const struct SCSISense sense = SENSE_CODE(LUN_NOT_SUPPORTED);
542
543 if (fixed_sense) {
544 r->buf[0] = 0x70;
545 r->buf[2] = sense.key;
546 r->buf[10] = 10;
547 r->buf[12] = sense.asc;
548 r->buf[13] = sense.ascq;
549 r->len = MIN(req->cmd.xfer, SCSI_SENSE_LEN);
550 } else {
551 r->buf[0] = 0x72;
552 r->buf[1] = sense.key;
553 r->buf[2] = sense.asc;
554 r->buf[3] = sense.ascq;
555 r->len = 8;
556 }
557 } else {
558 r->len = scsi_device_get_sense(r->req.dev, r->buf,
559 MIN(req->cmd.xfer, r->buf_len),
560 fixed_sense);
561 }
562 if (r->req.dev->sense_is_ua) {
563 scsi_device_unit_attention_reported(req->dev);
564 r->req.dev->sense_len = 0;
565 r->req.dev->sense_is_ua = false;
566 }
567 break;
568 case TEST_UNIT_READY:
569 break;
570 default:
571 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE));
572 scsi_req_complete(req, CHECK_CONDITION);
573 return 0;
574 illegal_request:
575 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
576 scsi_req_complete(req, CHECK_CONDITION);
577 return 0;
578 }
579
580 if (!r->len) {
581 scsi_req_complete(req, GOOD);
582 }
583 return r->len;
584 }
585
586 static void scsi_target_read_data(SCSIRequest *req)
587 {
588 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
589 uint32_t n;
590
591 n = r->len;
592 if (n > 0) {
593 r->len = 0;
594 scsi_req_data(&r->req, n);
595 } else {
596 scsi_req_complete(&r->req, GOOD);
597 }
598 }
599
600 static uint8_t *scsi_target_get_buf(SCSIRequest *req)
601 {
602 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
603
604 return r->buf;
605 }
606
607 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len)
608 {
609 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
610
611 r->buf = g_malloc(len);
612 r->buf_len = len;
613
614 return r->buf;
615 }
616
617 static void scsi_target_free_buf(SCSIRequest *req)
618 {
619 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
620
621 g_free(r->buf);
622 }
623
624 static const struct SCSIReqOps reqops_target_command = {
625 .size = sizeof(SCSITargetReq),
626 .send_command = scsi_target_send_command,
627 .read_data = scsi_target_read_data,
628 .get_buf = scsi_target_get_buf,
629 .free_req = scsi_target_free_buf,
630 };
631
632
633 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
634 uint32_t tag, uint32_t lun, void *hba_private)
635 {
636 SCSIRequest *req;
637 SCSIBus *bus = scsi_bus_from_device(d);
638 BusState *qbus = BUS(bus);
639 const int memset_off = offsetof(SCSIRequest, sense)
640 + sizeof(req->sense);
641
642 req = g_malloc(reqops->size);
643 memset((uint8_t *)req + memset_off, 0, reqops->size - memset_off);
644 req->refcount = 1;
645 req->bus = bus;
646 req->dev = d;
647 req->tag = tag;
648 req->lun = lun;
649 req->hba_private = hba_private;
650 req->status = -1;
651 req->ops = reqops;
652 object_ref(OBJECT(d));
653 object_ref(OBJECT(qbus->parent));
654 notifier_list_init(&req->cancel_notifiers);
655 trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
656 return req;
657 }
658
659 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,
660 uint8_t *buf, void *hba_private)
661 {
662 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus);
663 const SCSIReqOps *ops;
664 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(d);
665 SCSIRequest *req;
666 SCSICommand cmd = { .len = 0 };
667 int ret;
668
669 if ((d->unit_attention.key == UNIT_ATTENTION ||
670 bus->unit_attention.key == UNIT_ATTENTION) &&
671 (buf[0] != INQUIRY &&
672 buf[0] != REPORT_LUNS &&
673 buf[0] != GET_CONFIGURATION &&
674 buf[0] != GET_EVENT_STATUS_NOTIFICATION &&
675
676 /*
677 * If we already have a pending unit attention condition,
678 * report this one before triggering another one.
679 */
680 !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) {
681 ops = &reqops_unit_attention;
682 } else if (lun != d->lun ||
683 buf[0] == REPORT_LUNS ||
684 (buf[0] == REQUEST_SENSE && d->sense_len)) {
685 ops = &reqops_target_command;
686 } else {
687 ops = NULL;
688 }
689
690 if (ops != NULL || !sc->parse_cdb) {
691 ret = scsi_req_parse_cdb(d, &cmd, buf);
692 } else {
693 ret = sc->parse_cdb(d, &cmd, buf, hba_private);
694 }
695
696 if (ret != 0) {
697 trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]);
698 req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private);
699 } else {
700 assert(cmd.len != 0);
701 trace_scsi_req_parsed(d->id, lun, tag, buf[0],
702 cmd.mode, cmd.xfer);
703 if (cmd.lba != -1) {
704 trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0],
705 cmd.lba);
706 }
707
708 if (cmd.xfer > INT32_MAX) {
709 req = scsi_req_alloc(&reqops_invalid_field, d, tag, lun, hba_private);
710 } else if (ops) {
711 req = scsi_req_alloc(ops, d, tag, lun, hba_private);
712 } else {
713 req = scsi_device_alloc_req(d, tag, lun, buf, hba_private);
714 }
715 }
716
717 req->cmd = cmd;
718 req->resid = req->cmd.xfer;
719
720 switch (buf[0]) {
721 case INQUIRY:
722 trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]);
723 break;
724 case TEST_UNIT_READY:
725 trace_scsi_test_unit_ready(d->id, lun, tag);
726 break;
727 case REPORT_LUNS:
728 trace_scsi_report_luns(d->id, lun, tag);
729 break;
730 case REQUEST_SENSE:
731 trace_scsi_request_sense(d->id, lun, tag);
732 break;
733 default:
734 break;
735 }
736
737 return req;
738 }
739
740 uint8_t *scsi_req_get_buf(SCSIRequest *req)
741 {
742 return req->ops->get_buf(req);
743 }
744
745 static void scsi_clear_unit_attention(SCSIRequest *req)
746 {
747 SCSISense *ua;
748 if (req->dev->unit_attention.key != UNIT_ATTENTION &&
749 req->bus->unit_attention.key != UNIT_ATTENTION) {
750 return;
751 }
752
753 /*
754 * If an INQUIRY command enters the enabled command state,
755 * the device server shall [not] clear any unit attention condition;
756 * See also MMC-6, paragraphs 6.5 and 6.6.2.
757 */
758 if (req->cmd.buf[0] == INQUIRY ||
759 req->cmd.buf[0] == GET_CONFIGURATION ||
760 req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) {
761 return;
762 }
763
764 if (req->dev->unit_attention.key == UNIT_ATTENTION) {
765 ua = &req->dev->unit_attention;
766 } else {
767 ua = &req->bus->unit_attention;
768 }
769
770 /*
771 * If a REPORT LUNS command enters the enabled command state, [...]
772 * the device server shall clear any pending unit attention condition
773 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
774 */
775 if (req->cmd.buf[0] == REPORT_LUNS &&
776 !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
777 ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) {
778 return;
779 }
780
781 *ua = SENSE_CODE(NO_SENSE);
782 }
783
784 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len)
785 {
786 int ret;
787
788 assert(len >= 14);
789 if (!req->sense_len) {
790 return 0;
791 }
792
793 ret = scsi_build_sense(req->sense, req->sense_len, buf, len, true);
794
795 /*
796 * FIXME: clearing unit attention conditions upon autosense should be done
797 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
798 * (SAM-5, 5.14).
799 *
800 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
801 * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
802 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
803 */
804 if (req->dev->sense_is_ua) {
805 scsi_device_unit_attention_reported(req->dev);
806 req->dev->sense_len = 0;
807 req->dev->sense_is_ua = false;
808 }
809 return ret;
810 }
811
812 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed)
813 {
814 return scsi_build_sense(dev->sense, dev->sense_len, buf, len, fixed);
815 }
816
817 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense)
818 {
819 trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag,
820 sense.key, sense.asc, sense.ascq);
821 memset(req->sense, 0, 18);
822 req->sense[0] = 0x70;
823 req->sense[2] = sense.key;
824 req->sense[7] = 10;
825 req->sense[12] = sense.asc;
826 req->sense[13] = sense.ascq;
827 req->sense_len = 18;
828 }
829
830 static void scsi_req_enqueue_internal(SCSIRequest *req)
831 {
832 assert(!req->enqueued);
833 scsi_req_ref(req);
834 if (req->bus->info->get_sg_list) {
835 req->sg = req->bus->info->get_sg_list(req);
836 } else {
837 req->sg = NULL;
838 }
839 req->enqueued = true;
840 QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
841 }
842
843 int32_t scsi_req_enqueue(SCSIRequest *req)
844 {
845 int32_t rc;
846
847 assert(!req->retry);
848 scsi_req_enqueue_internal(req);
849 scsi_req_ref(req);
850 rc = req->ops->send_command(req, req->cmd.buf);
851 scsi_req_unref(req);
852 return rc;
853 }
854
855 static void scsi_req_dequeue(SCSIRequest *req)
856 {
857 trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
858 req->retry = false;
859 if (req->enqueued) {
860 QTAILQ_REMOVE(&req->dev->requests, req, next);
861 req->enqueued = false;
862 scsi_req_unref(req);
863 }
864 }
865
866 static int scsi_get_performance_length(int num_desc, int type, int data_type)
867 {
868 /* MMC-6, paragraph 6.7. */
869 switch (type) {
870 case 0:
871 if ((data_type & 3) == 0) {
872 /* Each descriptor is as in Table 295 - Nominal performance. */
873 return 16 * num_desc + 8;
874 } else {
875 /* Each descriptor is as in Table 296 - Exceptions. */
876 return 6 * num_desc + 8;
877 }
878 case 1:
879 case 4:
880 case 5:
881 return 8 * num_desc + 8;
882 case 2:
883 return 2048 * num_desc + 8;
884 case 3:
885 return 16 * num_desc + 8;
886 default:
887 return 8;
888 }
889 }
890
891 static int ata_passthrough_xfer_unit(SCSIDevice *dev, uint8_t *buf)
892 {
893 int byte_block = (buf[2] >> 2) & 0x1;
894 int type = (buf[2] >> 4) & 0x1;
895 int xfer_unit;
896
897 if (byte_block) {
898 if (type) {
899 xfer_unit = dev->blocksize;
900 } else {
901 xfer_unit = 512;
902 }
903 } else {
904 xfer_unit = 1;
905 }
906
907 return xfer_unit;
908 }
909
910 static int ata_passthrough_12_xfer(SCSIDevice *dev, uint8_t *buf)
911 {
912 int length = buf[2] & 0x3;
913 int xfer;
914 int unit = ata_passthrough_xfer_unit(dev, buf);
915
916 switch (length) {
917 case 0:
918 case 3: /* USB-specific. */
919 default:
920 xfer = 0;
921 break;
922 case 1:
923 xfer = buf[3];
924 break;
925 case 2:
926 xfer = buf[4];
927 break;
928 }
929
930 return xfer * unit;
931 }
932
933 static int ata_passthrough_16_xfer(SCSIDevice *dev, uint8_t *buf)
934 {
935 int extend = buf[1] & 0x1;
936 int length = buf[2] & 0x3;
937 int xfer;
938 int unit = ata_passthrough_xfer_unit(dev, buf);
939
940 switch (length) {
941 case 0:
942 case 3: /* USB-specific. */
943 default:
944 xfer = 0;
945 break;
946 case 1:
947 xfer = buf[4];
948 xfer |= (extend ? buf[3] << 8 : 0);
949 break;
950 case 2:
951 xfer = buf[6];
952 xfer |= (extend ? buf[5] << 8 : 0);
953 break;
954 }
955
956 return xfer * unit;
957 }
958
959 uint32_t scsi_data_cdb_xfer(uint8_t *buf)
960 {
961 if ((buf[0] >> 5) == 0 && buf[4] == 0) {
962 return 256;
963 } else {
964 return scsi_cdb_xfer(buf);
965 }
966 }
967
968 uint32_t scsi_cdb_xfer(uint8_t *buf)
969 {
970 switch (buf[0] >> 5) {
971 case 0:
972 return buf[4];
973 break;
974 case 1:
975 case 2:
976 return lduw_be_p(&buf[7]);
977 break;
978 case 4:
979 return ldl_be_p(&buf[10]) & 0xffffffffULL;
980 break;
981 case 5:
982 return ldl_be_p(&buf[6]) & 0xffffffffULL;
983 break;
984 default:
985 return -1;
986 }
987 }
988
989 static int scsi_req_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
990 {
991 cmd->xfer = scsi_cdb_xfer(buf);
992 switch (buf[0]) {
993 case TEST_UNIT_READY:
994 case REWIND:
995 case START_STOP:
996 case SET_CAPACITY:
997 case WRITE_FILEMARKS:
998 case WRITE_FILEMARKS_16:
999 case SPACE:
1000 case RESERVE:
1001 case RELEASE:
1002 case ERASE:
1003 case ALLOW_MEDIUM_REMOVAL:
1004 case SEEK_10:
1005 case SYNCHRONIZE_CACHE:
1006 case SYNCHRONIZE_CACHE_16:
1007 case LOCATE_16:
1008 case LOCK_UNLOCK_CACHE:
1009 case SET_CD_SPEED:
1010 case SET_LIMITS:
1011 case WRITE_LONG_10:
1012 case UPDATE_BLOCK:
1013 case RESERVE_TRACK:
1014 case SET_READ_AHEAD:
1015 case PRE_FETCH:
1016 case PRE_FETCH_16:
1017 case ALLOW_OVERWRITE:
1018 cmd->xfer = 0;
1019 break;
1020 case VERIFY_10:
1021 case VERIFY_12:
1022 case VERIFY_16:
1023 if ((buf[1] & 2) == 0) {
1024 cmd->xfer = 0;
1025 } else if ((buf[1] & 4) != 0) {
1026 cmd->xfer = 1;
1027 }
1028 cmd->xfer *= dev->blocksize;
1029 break;
1030 case MODE_SENSE:
1031 break;
1032 case WRITE_SAME_10:
1033 case WRITE_SAME_16:
1034 cmd->xfer = dev->blocksize;
1035 break;
1036 case READ_CAPACITY_10:
1037 cmd->xfer = 8;
1038 break;
1039 case READ_BLOCK_LIMITS:
1040 cmd->xfer = 6;
1041 break;
1042 case SEND_VOLUME_TAG:
1043 /* GPCMD_SET_STREAMING from multimedia commands. */
1044 if (dev->type == TYPE_ROM) {
1045 cmd->xfer = buf[10] | (buf[9] << 8);
1046 } else {
1047 cmd->xfer = buf[9] | (buf[8] << 8);
1048 }
1049 break;
1050 case WRITE_6:
1051 /* length 0 means 256 blocks */
1052 if (cmd->xfer == 0) {
1053 cmd->xfer = 256;
1054 }
1055 /* fall through */
1056 case WRITE_10:
1057 case WRITE_VERIFY_10:
1058 case WRITE_12:
1059 case WRITE_VERIFY_12:
1060 case WRITE_16:
1061 case WRITE_VERIFY_16:
1062 cmd->xfer *= dev->blocksize;
1063 break;
1064 case READ_6:
1065 case READ_REVERSE:
1066 /* length 0 means 256 blocks */
1067 if (cmd->xfer == 0) {
1068 cmd->xfer = 256;
1069 }
1070 /* fall through */
1071 case READ_10:
1072 case READ_12:
1073 case READ_16:
1074 cmd->xfer *= dev->blocksize;
1075 break;
1076 case FORMAT_UNIT:
1077 /* MMC mandates the parameter list to be 12-bytes long. Parameters
1078 * for block devices are restricted to the header right now. */
1079 if (dev->type == TYPE_ROM && (buf[1] & 16)) {
1080 cmd->xfer = 12;
1081 } else {
1082 cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4);
1083 }
1084 break;
1085 case INQUIRY:
1086 case RECEIVE_DIAGNOSTIC:
1087 case SEND_DIAGNOSTIC:
1088 cmd->xfer = buf[4] | (buf[3] << 8);
1089 break;
1090 case READ_CD:
1091 case READ_BUFFER:
1092 case WRITE_BUFFER:
1093 case SEND_CUE_SHEET:
1094 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16);
1095 break;
1096 case PERSISTENT_RESERVE_OUT:
1097 cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL;
1098 break;
1099 case ERASE_12:
1100 if (dev->type == TYPE_ROM) {
1101 /* MMC command GET PERFORMANCE. */
1102 cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8),
1103 buf[10], buf[1] & 0x1f);
1104 }
1105 break;
1106 case MECHANISM_STATUS:
1107 case READ_DVD_STRUCTURE:
1108 case SEND_DVD_STRUCTURE:
1109 case MAINTENANCE_OUT:
1110 case MAINTENANCE_IN:
1111 if (dev->type == TYPE_ROM) {
1112 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
1113 cmd->xfer = buf[9] | (buf[8] << 8);
1114 }
1115 break;
1116 case ATA_PASSTHROUGH_12:
1117 if (dev->type == TYPE_ROM) {
1118 /* BLANK command of MMC */
1119 cmd->xfer = 0;
1120 } else {
1121 cmd->xfer = ata_passthrough_12_xfer(dev, buf);
1122 }
1123 break;
1124 case ATA_PASSTHROUGH_16:
1125 cmd->xfer = ata_passthrough_16_xfer(dev, buf);
1126 break;
1127 }
1128 return 0;
1129 }
1130
1131 static int scsi_req_stream_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
1132 {
1133 switch (buf[0]) {
1134 /* stream commands */
1135 case ERASE_12:
1136 case ERASE_16:
1137 cmd->xfer = 0;
1138 break;
1139 case READ_6:
1140 case READ_REVERSE:
1141 case RECOVER_BUFFERED_DATA:
1142 case WRITE_6:
1143 cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16);
1144 if (buf[1] & 0x01) { /* fixed */
1145 cmd->xfer *= dev->blocksize;
1146 }
1147 break;
1148 case READ_16:
1149 case READ_REVERSE_16:
1150 case VERIFY_16:
1151 case WRITE_16:
1152 cmd->xfer = buf[14] | (buf[13] << 8) | (buf[12] << 16);
1153 if (buf[1] & 0x01) { /* fixed */
1154 cmd->xfer *= dev->blocksize;
1155 }
1156 break;
1157 case REWIND:
1158 case LOAD_UNLOAD:
1159 cmd->xfer = 0;
1160 break;
1161 case SPACE_16:
1162 cmd->xfer = buf[13] | (buf[12] << 8);
1163 break;
1164 case READ_POSITION:
1165 switch (buf[1] & 0x1f) /* operation code */ {
1166 case SHORT_FORM_BLOCK_ID:
1167 case SHORT_FORM_VENDOR_SPECIFIC:
1168 cmd->xfer = 20;
1169 break;
1170 case LONG_FORM:
1171 cmd->xfer = 32;
1172 break;
1173 case EXTENDED_FORM:
1174 cmd->xfer = buf[8] | (buf[7] << 8);
1175 break;
1176 default:
1177 return -1;
1178 }
1179
1180 break;
1181 case FORMAT_UNIT:
1182 cmd->xfer = buf[4] | (buf[3] << 8);
1183 break;
1184 /* generic commands */
1185 default:
1186 return scsi_req_xfer(cmd, dev, buf);
1187 }
1188 return 0;
1189 }
1190
1191 static int scsi_req_medium_changer_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
1192 {
1193 switch (buf[0]) {
1194 /* medium changer commands */
1195 case EXCHANGE_MEDIUM:
1196 case INITIALIZE_ELEMENT_STATUS:
1197 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE:
1198 case MOVE_MEDIUM:
1199 case POSITION_TO_ELEMENT:
1200 cmd->xfer = 0;
1201 break;
1202 case READ_ELEMENT_STATUS:
1203 cmd->xfer = buf[9] | (buf[8] << 8) | (buf[7] << 16);
1204 break;
1205
1206 /* generic commands */
1207 default:
1208 return scsi_req_xfer(cmd, dev, buf);
1209 }
1210 return 0;
1211 }
1212
1213 static int scsi_req_scanner_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
1214 {
1215 switch (buf[0]) {
1216 /* Scanner commands */
1217 case OBJECT_POSITION:
1218 cmd->xfer = 0;
1219 break;
1220 case SCAN:
1221 cmd->xfer = buf[4];
1222 break;
1223 case READ_10:
1224 case SEND:
1225 case GET_WINDOW:
1226 case SET_WINDOW:
1227 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16);
1228 break;
1229 default:
1230 /* GET_DATA_BUFFER_STATUS xfer handled by scsi_req_xfer */
1231 return scsi_req_xfer(cmd, dev, buf);
1232 }
1233
1234 return 0;
1235 }
1236
1237 static void scsi_cmd_xfer_mode(SCSICommand *cmd)
1238 {
1239 if (!cmd->xfer) {
1240 cmd->mode = SCSI_XFER_NONE;
1241 return;
1242 }
1243 switch (cmd->buf[0]) {
1244 case WRITE_6:
1245 case WRITE_10:
1246 case WRITE_VERIFY_10:
1247 case WRITE_12:
1248 case WRITE_VERIFY_12:
1249 case WRITE_16:
1250 case WRITE_VERIFY_16:
1251 case VERIFY_10:
1252 case VERIFY_12:
1253 case VERIFY_16:
1254 case COPY:
1255 case COPY_VERIFY:
1256 case COMPARE:
1257 case CHANGE_DEFINITION:
1258 case LOG_SELECT:
1259 case MODE_SELECT:
1260 case MODE_SELECT_10:
1261 case SEND_DIAGNOSTIC:
1262 case WRITE_BUFFER:
1263 case FORMAT_UNIT:
1264 case REASSIGN_BLOCKS:
1265 case SEARCH_EQUAL:
1266 case SEARCH_HIGH:
1267 case SEARCH_LOW:
1268 case UPDATE_BLOCK:
1269 case WRITE_LONG_10:
1270 case WRITE_SAME_10:
1271 case WRITE_SAME_16:
1272 case UNMAP:
1273 case SEARCH_HIGH_12:
1274 case SEARCH_EQUAL_12:
1275 case SEARCH_LOW_12:
1276 case MEDIUM_SCAN:
1277 case SEND_VOLUME_TAG:
1278 case SEND_CUE_SHEET:
1279 case SEND_DVD_STRUCTURE:
1280 case PERSISTENT_RESERVE_OUT:
1281 case MAINTENANCE_OUT:
1282 case SET_WINDOW:
1283 case SCAN:
1284 /* SCAN conflicts with START_STOP. START_STOP has cmd->xfer set to 0 for
1285 * non-scanner devices, so we only get here for SCAN and not for START_STOP.
1286 */
1287 cmd->mode = SCSI_XFER_TO_DEV;
1288 break;
1289 case ATA_PASSTHROUGH_12:
1290 case ATA_PASSTHROUGH_16:
1291 /* T_DIR */
1292 cmd->mode = (cmd->buf[2] & 0x8) ?
1293 SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV;
1294 break;
1295 default:
1296 cmd->mode = SCSI_XFER_FROM_DEV;
1297 break;
1298 }
1299 }
1300
1301 static uint64_t scsi_cmd_lba(SCSICommand *cmd)
1302 {
1303 uint8_t *buf = cmd->buf;
1304 uint64_t lba;
1305
1306 switch (buf[0] >> 5) {
1307 case 0:
1308 lba = ldl_be_p(&buf[0]) & 0x1fffff;
1309 break;
1310 case 1:
1311 case 2:
1312 case 5:
1313 lba = ldl_be_p(&buf[2]) & 0xffffffffULL;
1314 break;
1315 case 4:
1316 lba = ldq_be_p(&buf[2]);
1317 break;
1318 default:
1319 lba = -1;
1320
1321 }
1322 return lba;
1323 }
1324
1325 int scsi_cdb_length(uint8_t *buf) {
1326 int cdb_len;
1327
1328 switch (buf[0] >> 5) {
1329 case 0:
1330 cdb_len = 6;
1331 break;
1332 case 1:
1333 case 2:
1334 cdb_len = 10;
1335 break;
1336 case 4:
1337 cdb_len = 16;
1338 break;
1339 case 5:
1340 cdb_len = 12;
1341 break;
1342 default:
1343 cdb_len = -1;
1344 }
1345 return cdb_len;
1346 }
1347
1348 int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf)
1349 {
1350 int rc;
1351 int len;
1352
1353 cmd->lba = -1;
1354 len = scsi_cdb_length(buf);
1355 if (len < 0) {
1356 return -1;
1357 }
1358
1359 cmd->len = len;
1360 switch (dev->type) {
1361 case TYPE_TAPE:
1362 rc = scsi_req_stream_xfer(cmd, dev, buf);
1363 break;
1364 case TYPE_MEDIUM_CHANGER:
1365 rc = scsi_req_medium_changer_xfer(cmd, dev, buf);
1366 break;
1367 case TYPE_SCANNER:
1368 rc = scsi_req_scanner_length(cmd, dev, buf);
1369 break;
1370 default:
1371 rc = scsi_req_xfer(cmd, dev, buf);
1372 break;
1373 }
1374
1375 if (rc != 0)
1376 return rc;
1377
1378 memcpy(cmd->buf, buf, cmd->len);
1379 scsi_cmd_xfer_mode(cmd);
1380 cmd->lba = scsi_cmd_lba(cmd);
1381 return 0;
1382 }
1383
1384 void scsi_device_report_change(SCSIDevice *dev, SCSISense sense)
1385 {
1386 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
1387
1388 scsi_device_set_ua(dev, sense);
1389 if (bus->info->change) {
1390 bus->info->change(bus, dev, sense);
1391 }
1392 }
1393
1394 /*
1395 * Predefined sense codes
1396 */
1397
1398 /* No sense data available */
1399 const struct SCSISense sense_code_NO_SENSE = {
1400 .key = NO_SENSE , .asc = 0x00 , .ascq = 0x00
1401 };
1402
1403 /* LUN not ready, Manual intervention required */
1404 const struct SCSISense sense_code_LUN_NOT_READY = {
1405 .key = NOT_READY, .asc = 0x04, .ascq = 0x03
1406 };
1407
1408 /* LUN not ready, Medium not present */
1409 const struct SCSISense sense_code_NO_MEDIUM = {
1410 .key = NOT_READY, .asc = 0x3a, .ascq = 0x00
1411 };
1412
1413 /* LUN not ready, medium removal prevented */
1414 const struct SCSISense sense_code_NOT_READY_REMOVAL_PREVENTED = {
1415 .key = NOT_READY, .asc = 0x53, .ascq = 0x02
1416 };
1417
1418 /* Hardware error, internal target failure */
1419 const struct SCSISense sense_code_TARGET_FAILURE = {
1420 .key = HARDWARE_ERROR, .asc = 0x44, .ascq = 0x00
1421 };
1422
1423 /* Illegal request, invalid command operation code */
1424 const struct SCSISense sense_code_INVALID_OPCODE = {
1425 .key = ILLEGAL_REQUEST, .asc = 0x20, .ascq = 0x00
1426 };
1427
1428 /* Illegal request, LBA out of range */
1429 const struct SCSISense sense_code_LBA_OUT_OF_RANGE = {
1430 .key = ILLEGAL_REQUEST, .asc = 0x21, .ascq = 0x00
1431 };
1432
1433 /* Illegal request, Invalid field in CDB */
1434 const struct SCSISense sense_code_INVALID_FIELD = {
1435 .key = ILLEGAL_REQUEST, .asc = 0x24, .ascq = 0x00
1436 };
1437
1438 /* Illegal request, Invalid field in parameter list */
1439 const struct SCSISense sense_code_INVALID_PARAM = {
1440 .key = ILLEGAL_REQUEST, .asc = 0x26, .ascq = 0x00
1441 };
1442
1443 /* Illegal request, Parameter list length error */
1444 const struct SCSISense sense_code_INVALID_PARAM_LEN = {
1445 .key = ILLEGAL_REQUEST, .asc = 0x1a, .ascq = 0x00
1446 };
1447
1448 /* Illegal request, LUN not supported */
1449 const struct SCSISense sense_code_LUN_NOT_SUPPORTED = {
1450 .key = ILLEGAL_REQUEST, .asc = 0x25, .ascq = 0x00
1451 };
1452
1453 /* Illegal request, Saving parameters not supported */
1454 const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED = {
1455 .key = ILLEGAL_REQUEST, .asc = 0x39, .ascq = 0x00
1456 };
1457
1458 /* Illegal request, Incompatible medium installed */
1459 const struct SCSISense sense_code_INCOMPATIBLE_FORMAT = {
1460 .key = ILLEGAL_REQUEST, .asc = 0x30, .ascq = 0x00
1461 };
1462
1463 /* Illegal request, medium removal prevented */
1464 const struct SCSISense sense_code_ILLEGAL_REQ_REMOVAL_PREVENTED = {
1465 .key = ILLEGAL_REQUEST, .asc = 0x53, .ascq = 0x02
1466 };
1467
1468 /* Illegal request, Invalid Transfer Tag */
1469 const struct SCSISense sense_code_INVALID_TAG = {
1470 .key = ILLEGAL_REQUEST, .asc = 0x4b, .ascq = 0x01
1471 };
1472
1473 /* Command aborted, I/O process terminated */
1474 const struct SCSISense sense_code_IO_ERROR = {
1475 .key = ABORTED_COMMAND, .asc = 0x00, .ascq = 0x06
1476 };
1477
1478 /* Command aborted, I_T Nexus loss occurred */
1479 const struct SCSISense sense_code_I_T_NEXUS_LOSS = {
1480 .key = ABORTED_COMMAND, .asc = 0x29, .ascq = 0x07
1481 };
1482
1483 /* Command aborted, Logical Unit failure */
1484 const struct SCSISense sense_code_LUN_FAILURE = {
1485 .key = ABORTED_COMMAND, .asc = 0x3e, .ascq = 0x01
1486 };
1487
1488 /* Command aborted, Overlapped Commands Attempted */
1489 const struct SCSISense sense_code_OVERLAPPED_COMMANDS = {
1490 .key = ABORTED_COMMAND, .asc = 0x4e, .ascq = 0x00
1491 };
1492
1493 /* Unit attention, Capacity data has changed */
1494 const struct SCSISense sense_code_CAPACITY_CHANGED = {
1495 .key = UNIT_ATTENTION, .asc = 0x2a, .ascq = 0x09
1496 };
1497
1498 /* Unit attention, Power on, reset or bus device reset occurred */
1499 const struct SCSISense sense_code_RESET = {
1500 .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x00
1501 };
1502
1503 /* Unit attention, No medium */
1504 const struct SCSISense sense_code_UNIT_ATTENTION_NO_MEDIUM = {
1505 .key = UNIT_ATTENTION, .asc = 0x3a, .ascq = 0x00
1506 };
1507
1508 /* Unit attention, Medium may have changed */
1509 const struct SCSISense sense_code_MEDIUM_CHANGED = {
1510 .key = UNIT_ATTENTION, .asc = 0x28, .ascq = 0x00
1511 };
1512
1513 /* Unit attention, Reported LUNs data has changed */
1514 const struct SCSISense sense_code_REPORTED_LUNS_CHANGED = {
1515 .key = UNIT_ATTENTION, .asc = 0x3f, .ascq = 0x0e
1516 };
1517
1518 /* Unit attention, Device internal reset */
1519 const struct SCSISense sense_code_DEVICE_INTERNAL_RESET = {
1520 .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x04
1521 };
1522
1523 /* Data Protection, Write Protected */
1524 const struct SCSISense sense_code_WRITE_PROTECTED = {
1525 .key = DATA_PROTECT, .asc = 0x27, .ascq = 0x00
1526 };
1527
1528 /* Data Protection, Space Allocation Failed Write Protect */
1529 const struct SCSISense sense_code_SPACE_ALLOC_FAILED = {
1530 .key = DATA_PROTECT, .asc = 0x27, .ascq = 0x07
1531 };
1532
1533 /*
1534 * scsi_build_sense
1535 *
1536 * Convert between fixed and descriptor sense buffers
1537 */
1538 int scsi_build_sense(uint8_t *in_buf, int in_len,
1539 uint8_t *buf, int len, bool fixed)
1540 {
1541 bool fixed_in;
1542 SCSISense sense;
1543 if (!fixed && len < 8) {
1544 return 0;
1545 }
1546
1547 if (in_len == 0) {
1548 sense.key = NO_SENSE;
1549 sense.asc = 0;
1550 sense.ascq = 0;
1551 } else {
1552 fixed_in = (in_buf[0] & 2) == 0;
1553
1554 if (fixed == fixed_in) {
1555 memcpy(buf, in_buf, MIN(len, in_len));
1556 return MIN(len, in_len);
1557 }
1558
1559 if (fixed_in) {
1560 sense.key = in_buf[2];
1561 sense.asc = in_buf[12];
1562 sense.ascq = in_buf[13];
1563 } else {
1564 sense.key = in_buf[1];
1565 sense.asc = in_buf[2];
1566 sense.ascq = in_buf[3];
1567 }
1568 }
1569
1570 memset(buf, 0, len);
1571 if (fixed) {
1572 /* Return fixed format sense buffer */
1573 buf[0] = 0x70;
1574 buf[2] = sense.key;
1575 buf[7] = 10;
1576 buf[12] = sense.asc;
1577 buf[13] = sense.ascq;
1578 return MIN(len, SCSI_SENSE_LEN);
1579 } else {
1580 /* Return descriptor format sense buffer */
1581 buf[0] = 0x72;
1582 buf[1] = sense.key;
1583 buf[2] = sense.asc;
1584 buf[3] = sense.ascq;
1585 return 8;
1586 }
1587 }
1588
1589 const char *scsi_command_name(uint8_t cmd)
1590 {
1591 static const char *names[] = {
1592 [ TEST_UNIT_READY ] = "TEST_UNIT_READY",
1593 [ REWIND ] = "REWIND",
1594 [ REQUEST_SENSE ] = "REQUEST_SENSE",
1595 [ FORMAT_UNIT ] = "FORMAT_UNIT",
1596 [ READ_BLOCK_LIMITS ] = "READ_BLOCK_LIMITS",
1597 [ REASSIGN_BLOCKS ] = "REASSIGN_BLOCKS/INITIALIZE ELEMENT STATUS",
1598 /* LOAD_UNLOAD and INITIALIZE_ELEMENT_STATUS use the same operation code */
1599 [ READ_6 ] = "READ_6",
1600 [ WRITE_6 ] = "WRITE_6",
1601 [ SET_CAPACITY ] = "SET_CAPACITY",
1602 [ READ_REVERSE ] = "READ_REVERSE",
1603 [ WRITE_FILEMARKS ] = "WRITE_FILEMARKS",
1604 [ SPACE ] = "SPACE",
1605 [ INQUIRY ] = "INQUIRY",
1606 [ RECOVER_BUFFERED_DATA ] = "RECOVER_BUFFERED_DATA",
1607 [ MAINTENANCE_IN ] = "MAINTENANCE_IN",
1608 [ MAINTENANCE_OUT ] = "MAINTENANCE_OUT",
1609 [ MODE_SELECT ] = "MODE_SELECT",
1610 [ RESERVE ] = "RESERVE",
1611 [ RELEASE ] = "RELEASE",
1612 [ COPY ] = "COPY",
1613 [ ERASE ] = "ERASE",
1614 [ MODE_SENSE ] = "MODE_SENSE",
1615 [ START_STOP ] = "START_STOP/LOAD_UNLOAD",
1616 /* LOAD_UNLOAD and START_STOP use the same operation code */
1617 [ RECEIVE_DIAGNOSTIC ] = "RECEIVE_DIAGNOSTIC",
1618 [ SEND_DIAGNOSTIC ] = "SEND_DIAGNOSTIC",
1619 [ ALLOW_MEDIUM_REMOVAL ] = "ALLOW_MEDIUM_REMOVAL",
1620 [ READ_CAPACITY_10 ] = "READ_CAPACITY_10",
1621 [ READ_10 ] = "READ_10",
1622 [ WRITE_10 ] = "WRITE_10",
1623 [ SEEK_10 ] = "SEEK_10/POSITION_TO_ELEMENT",
1624 /* SEEK_10 and POSITION_TO_ELEMENT use the same operation code */
1625 [ WRITE_VERIFY_10 ] = "WRITE_VERIFY_10",
1626 [ VERIFY_10 ] = "VERIFY_10",
1627 [ SEARCH_HIGH ] = "SEARCH_HIGH",
1628 [ SEARCH_EQUAL ] = "SEARCH_EQUAL",
1629 [ SEARCH_LOW ] = "SEARCH_LOW",
1630 [ SET_LIMITS ] = "SET_LIMITS",
1631 [ PRE_FETCH ] = "PRE_FETCH/READ_POSITION",
1632 /* READ_POSITION and PRE_FETCH use the same operation code */
1633 [ SYNCHRONIZE_CACHE ] = "SYNCHRONIZE_CACHE",
1634 [ LOCK_UNLOCK_CACHE ] = "LOCK_UNLOCK_CACHE",
1635 [ READ_DEFECT_DATA ] = "READ_DEFECT_DATA/INITIALIZE_ELEMENT_STATUS_WITH_RANGE",
1636 /* READ_DEFECT_DATA and INITIALIZE_ELEMENT_STATUS_WITH_RANGE use the same operation code */
1637 [ MEDIUM_SCAN ] = "MEDIUM_SCAN",
1638 [ COMPARE ] = "COMPARE",
1639 [ COPY_VERIFY ] = "COPY_VERIFY",
1640 [ WRITE_BUFFER ] = "WRITE_BUFFER",
1641 [ READ_BUFFER ] = "READ_BUFFER",
1642 [ UPDATE_BLOCK ] = "UPDATE_BLOCK",
1643 [ READ_LONG_10 ] = "READ_LONG_10",
1644 [ WRITE_LONG_10 ] = "WRITE_LONG_10",
1645 [ CHANGE_DEFINITION ] = "CHANGE_DEFINITION",
1646 [ WRITE_SAME_10 ] = "WRITE_SAME_10",
1647 [ UNMAP ] = "UNMAP",
1648 [ READ_TOC ] = "READ_TOC",
1649 [ REPORT_DENSITY_SUPPORT ] = "REPORT_DENSITY_SUPPORT",
1650 [ SANITIZE ] = "SANITIZE",
1651 [ GET_CONFIGURATION ] = "GET_CONFIGURATION",
1652 [ LOG_SELECT ] = "LOG_SELECT",
1653 [ LOG_SENSE ] = "LOG_SENSE",
1654 [ MODE_SELECT_10 ] = "MODE_SELECT_10",
1655 [ RESERVE_10 ] = "RESERVE_10",
1656 [ RELEASE_10 ] = "RELEASE_10",
1657 [ MODE_SENSE_10 ] = "MODE_SENSE_10",
1658 [ PERSISTENT_RESERVE_IN ] = "PERSISTENT_RESERVE_IN",
1659 [ PERSISTENT_RESERVE_OUT ] = "PERSISTENT_RESERVE_OUT",
1660 [ WRITE_FILEMARKS_16 ] = "WRITE_FILEMARKS_16",
1661 [ EXTENDED_COPY ] = "EXTENDED_COPY",
1662 [ ATA_PASSTHROUGH_16 ] = "ATA_PASSTHROUGH_16",
1663 [ ACCESS_CONTROL_IN ] = "ACCESS_CONTROL_IN",
1664 [ ACCESS_CONTROL_OUT ] = "ACCESS_CONTROL_OUT",
1665 [ READ_16 ] = "READ_16",
1666 [ COMPARE_AND_WRITE ] = "COMPARE_AND_WRITE",
1667 [ WRITE_16 ] = "WRITE_16",
1668 [ WRITE_VERIFY_16 ] = "WRITE_VERIFY_16",
1669 [ VERIFY_16 ] = "VERIFY_16",
1670 [ PRE_FETCH_16 ] = "PRE_FETCH_16",
1671 [ SYNCHRONIZE_CACHE_16 ] = "SPACE_16/SYNCHRONIZE_CACHE_16",
1672 /* SPACE_16 and SYNCHRONIZE_CACHE_16 use the same operation code */
1673 [ LOCATE_16 ] = "LOCATE_16",
1674 [ WRITE_SAME_16 ] = "ERASE_16/WRITE_SAME_16",
1675 /* ERASE_16 and WRITE_SAME_16 use the same operation code */
1676 [ SERVICE_ACTION_IN_16 ] = "SERVICE_ACTION_IN_16",
1677 [ WRITE_LONG_16 ] = "WRITE_LONG_16",
1678 [ REPORT_LUNS ] = "REPORT_LUNS",
1679 [ ATA_PASSTHROUGH_12 ] = "BLANK/ATA_PASSTHROUGH_12",
1680 [ MOVE_MEDIUM ] = "MOVE_MEDIUM",
1681 [ EXCHANGE_MEDIUM ] = "EXCHANGE MEDIUM",
1682 [ READ_12 ] = "READ_12",
1683 [ WRITE_12 ] = "WRITE_12",
1684 [ ERASE_12 ] = "ERASE_12/GET_PERFORMANCE",
1685 /* ERASE_12 and GET_PERFORMANCE use the same operation code */
1686 [ SERVICE_ACTION_IN_12 ] = "SERVICE_ACTION_IN_12",
1687 [ WRITE_VERIFY_12 ] = "WRITE_VERIFY_12",
1688 [ VERIFY_12 ] = "VERIFY_12",
1689 [ SEARCH_HIGH_12 ] = "SEARCH_HIGH_12",
1690 [ SEARCH_EQUAL_12 ] = "SEARCH_EQUAL_12",
1691 [ SEARCH_LOW_12 ] = "SEARCH_LOW_12",
1692 [ READ_ELEMENT_STATUS ] = "READ_ELEMENT_STATUS",
1693 [ SEND_VOLUME_TAG ] = "SEND_VOLUME_TAG/SET_STREAMING",
1694 /* SEND_VOLUME_TAG and SET_STREAMING use the same operation code */
1695 [ READ_CD ] = "READ_CD",
1696 [ READ_DEFECT_DATA_12 ] = "READ_DEFECT_DATA_12",
1697 [ READ_DVD_STRUCTURE ] = "READ_DVD_STRUCTURE",
1698 [ RESERVE_TRACK ] = "RESERVE_TRACK",
1699 [ SEND_CUE_SHEET ] = "SEND_CUE_SHEET",
1700 [ SEND_DVD_STRUCTURE ] = "SEND_DVD_STRUCTURE",
1701 [ SET_CD_SPEED ] = "SET_CD_SPEED",
1702 [ SET_READ_AHEAD ] = "SET_READ_AHEAD",
1703 [ ALLOW_OVERWRITE ] = "ALLOW_OVERWRITE",
1704 [ MECHANISM_STATUS ] = "MECHANISM_STATUS",
1705 [ GET_EVENT_STATUS_NOTIFICATION ] = "GET_EVENT_STATUS_NOTIFICATION",
1706 [ READ_DISC_INFORMATION ] = "READ_DISC_INFORMATION",
1707 };
1708
1709 if (cmd >= ARRAY_SIZE(names) || names[cmd] == NULL)
1710 return "*UNKNOWN*";
1711 return names[cmd];
1712 }
1713
1714 SCSIRequest *scsi_req_ref(SCSIRequest *req)
1715 {
1716 assert(req->refcount > 0);
1717 req->refcount++;
1718 return req;
1719 }
1720
1721 void scsi_req_unref(SCSIRequest *req)
1722 {
1723 assert(req->refcount > 0);
1724 if (--req->refcount == 0) {
1725 BusState *qbus = req->dev->qdev.parent_bus;
1726 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus);
1727
1728 if (bus->info->free_request && req->hba_private) {
1729 bus->info->free_request(bus, req->hba_private);
1730 }
1731 if (req->ops->free_req) {
1732 req->ops->free_req(req);
1733 }
1734 object_unref(OBJECT(req->dev));
1735 object_unref(OBJECT(qbus->parent));
1736 g_free(req);
1737 }
1738 }
1739
1740 /* Tell the device that we finished processing this chunk of I/O. It
1741 will start the next chunk or complete the command. */
1742 void scsi_req_continue(SCSIRequest *req)
1743 {
1744 if (req->io_canceled) {
1745 trace_scsi_req_continue_canceled(req->dev->id, req->lun, req->tag);
1746 return;
1747 }
1748 trace_scsi_req_continue(req->dev->id, req->lun, req->tag);
1749 if (req->cmd.mode == SCSI_XFER_TO_DEV) {
1750 req->ops->write_data(req);
1751 } else {
1752 req->ops->read_data(req);
1753 }
1754 }
1755
1756 /* Called by the devices when data is ready for the HBA. The HBA should
1757 start a DMA operation to read or fill the device's data buffer.
1758 Once it completes, calling scsi_req_continue will restart I/O. */
1759 void scsi_req_data(SCSIRequest *req, int len)
1760 {
1761 uint8_t *buf;
1762 if (req->io_canceled) {
1763 trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len);
1764 return;
1765 }
1766 trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);
1767 assert(req->cmd.mode != SCSI_XFER_NONE);
1768 if (!req->sg) {
1769 req->resid -= len;
1770 req->bus->info->transfer_data(req, len);
1771 return;
1772 }
1773
1774 /* If the device calls scsi_req_data and the HBA specified a
1775 * scatter/gather list, the transfer has to happen in a single
1776 * step. */
1777 assert(!req->dma_started);
1778 req->dma_started = true;
1779
1780 buf = scsi_req_get_buf(req);
1781 if (req->cmd.mode == SCSI_XFER_FROM_DEV) {
1782 req->resid = dma_buf_read(buf, len, req->sg);
1783 } else {
1784 req->resid = dma_buf_write(buf, len, req->sg);
1785 }
1786 scsi_req_continue(req);
1787 }
1788
1789 void scsi_req_print(SCSIRequest *req)
1790 {
1791 FILE *fp = stderr;
1792 int i;
1793
1794 fprintf(fp, "[%s id=%d] %s",
1795 req->dev->qdev.parent_bus->name,
1796 req->dev->id,
1797 scsi_command_name(req->cmd.buf[0]));
1798 for (i = 1; i < req->cmd.len; i++) {
1799 fprintf(fp, " 0x%02x", req->cmd.buf[i]);
1800 }
1801 switch (req->cmd.mode) {
1802 case SCSI_XFER_NONE:
1803 fprintf(fp, " - none\n");
1804 break;
1805 case SCSI_XFER_FROM_DEV:
1806 fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer);
1807 break;
1808 case SCSI_XFER_TO_DEV:
1809 fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer);
1810 break;
1811 default:
1812 fprintf(fp, " - Oops\n");
1813 break;
1814 }
1815 }
1816
1817 void scsi_req_complete(SCSIRequest *req, int status)
1818 {
1819 assert(req->status == -1);
1820 req->status = status;
1821
1822 assert(req->sense_len <= sizeof(req->sense));
1823 if (status == GOOD) {
1824 req->sense_len = 0;
1825 }
1826
1827 if (req->sense_len) {
1828 memcpy(req->dev->sense, req->sense, req->sense_len);
1829 req->dev->sense_len = req->sense_len;
1830 req->dev->sense_is_ua = (req->ops == &reqops_unit_attention);
1831 } else {
1832 req->dev->sense_len = 0;
1833 req->dev->sense_is_ua = false;
1834 }
1835
1836 /*
1837 * Unit attention state is now stored in the device's sense buffer
1838 * if the HBA didn't do autosense. Clear the pending unit attention
1839 * flags.
1840 */
1841 scsi_clear_unit_attention(req);
1842
1843 scsi_req_ref(req);
1844 scsi_req_dequeue(req);
1845 req->bus->info->complete(req, req->status, req->resid);
1846
1847 /* Cancelled requests might end up being completed instead of cancelled */
1848 notifier_list_notify(&req->cancel_notifiers, req);
1849 scsi_req_unref(req);
1850 }
1851
1852 /* Called by the devices when the request is canceled. */
1853 void scsi_req_cancel_complete(SCSIRequest *req)
1854 {
1855 assert(req->io_canceled);
1856 if (req->bus->info->cancel) {
1857 req->bus->info->cancel(req);
1858 }
1859 notifier_list_notify(&req->cancel_notifiers, req);
1860 scsi_req_unref(req);
1861 }
1862
1863 /* Cancel @req asynchronously. @notifier is added to @req's cancellation
1864 * notifier list, the bus will be notified the requests cancellation is
1865 * completed.
1866 * */
1867 void scsi_req_cancel_async(SCSIRequest *req, Notifier *notifier)
1868 {
1869 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag);
1870 if (notifier) {
1871 notifier_list_add(&req->cancel_notifiers, notifier);
1872 }
1873 if (req->io_canceled) {
1874 /* A blk_aio_cancel_async is pending; when it finishes,
1875 * scsi_req_cancel_complete will be called and will
1876 * call the notifier we just added. Just wait for that.
1877 */
1878 assert(req->aiocb);
1879 return;
1880 }
1881 /* Dropped in scsi_req_cancel_complete. */
1882 scsi_req_ref(req);
1883 scsi_req_dequeue(req);
1884 req->io_canceled = true;
1885 if (req->aiocb) {
1886 blk_aio_cancel_async(req->aiocb);
1887 } else {
1888 scsi_req_cancel_complete(req);
1889 }
1890 }
1891
1892 void scsi_req_cancel(SCSIRequest *req)
1893 {
1894 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag);
1895 if (!req->enqueued) {
1896 return;
1897 }
1898 assert(!req->io_canceled);
1899 /* Dropped in scsi_req_cancel_complete. */
1900 scsi_req_ref(req);
1901 scsi_req_dequeue(req);
1902 req->io_canceled = true;
1903 if (req->aiocb) {
1904 blk_aio_cancel(req->aiocb);
1905 } else {
1906 scsi_req_cancel_complete(req);
1907 }
1908 }
1909
1910 static int scsi_ua_precedence(SCSISense sense)
1911 {
1912 if (sense.key != UNIT_ATTENTION) {
1913 return INT_MAX;
1914 }
1915 if (sense.asc == 0x29 && sense.ascq == 0x04) {
1916 /* DEVICE INTERNAL RESET goes with POWER ON OCCURRED */
1917 return 1;
1918 } else if (sense.asc == 0x3F && sense.ascq == 0x01) {
1919 /* MICROCODE HAS BEEN CHANGED goes with SCSI BUS RESET OCCURRED */
1920 return 2;
1921 } else if (sense.asc == 0x29 && (sense.ascq == 0x05 || sense.ascq == 0x06)) {
1922 /* These two go with "all others". */
1923 ;
1924 } else if (sense.asc == 0x29 && sense.ascq <= 0x07) {
1925 /* POWER ON, RESET OR BUS DEVICE RESET OCCURRED = 0
1926 * POWER ON OCCURRED = 1
1927 * SCSI BUS RESET OCCURRED = 2
1928 * BUS DEVICE RESET FUNCTION OCCURRED = 3
1929 * I_T NEXUS LOSS OCCURRED = 7
1930 */
1931 return sense.ascq;
1932 } else if (sense.asc == 0x2F && sense.ascq == 0x01) {
1933 /* COMMANDS CLEARED BY POWER LOSS NOTIFICATION */
1934 return 8;
1935 }
1936 return (sense.asc << 8) | sense.ascq;
1937 }
1938
1939 void scsi_device_set_ua(SCSIDevice *sdev, SCSISense sense)
1940 {
1941 int prec1, prec2;
1942 if (sense.key != UNIT_ATTENTION) {
1943 return;
1944 }
1945 trace_scsi_device_set_ua(sdev->id, sdev->lun, sense.key,
1946 sense.asc, sense.ascq);
1947
1948 /*
1949 * Override a pre-existing unit attention condition, except for a more
1950 * important reset condition.
1951 */
1952 prec1 = scsi_ua_precedence(sdev->unit_attention);
1953 prec2 = scsi_ua_precedence(sense);
1954 if (prec2 < prec1) {
1955 sdev->unit_attention = sense;
1956 }
1957 }
1958
1959 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
1960 {
1961 SCSIRequest *req;
1962
1963 aio_context_acquire(blk_get_aio_context(sdev->conf.blk));
1964 while (!QTAILQ_EMPTY(&sdev->requests)) {
1965 req = QTAILQ_FIRST(&sdev->requests);
1966 scsi_req_cancel_async(req, NULL);
1967 }
1968 blk_drain(sdev->conf.blk);
1969 aio_context_release(blk_get_aio_context(sdev->conf.blk));
1970 scsi_device_set_ua(sdev, sense);
1971 }
1972
1973 static char *scsibus_get_dev_path(DeviceState *dev)
1974 {
1975 SCSIDevice *d = SCSI_DEVICE(dev);
1976 DeviceState *hba = dev->parent_bus->parent;
1977 char *id;
1978 char *path;
1979
1980 id = qdev_get_dev_path(hba);
1981 if (id) {
1982 path = g_strdup_printf("%s/%d:%d:%d", id, d->channel, d->id, d->lun);
1983 } else {
1984 path = g_strdup_printf("%d:%d:%d", d->channel, d->id, d->lun);
1985 }
1986 g_free(id);
1987 return path;
1988 }
1989
1990 static char *scsibus_get_fw_dev_path(DeviceState *dev)
1991 {
1992 SCSIDevice *d = SCSI_DEVICE(dev);
1993 return g_strdup_printf("channel@%x/%s@%x,%x", d->channel,
1994 qdev_fw_name(dev), d->id, d->lun);
1995 }
1996
1997 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
1998 {
1999 BusChild *kid;
2000 SCSIDevice *target_dev = NULL;
2001
2002 QTAILQ_FOREACH_REVERSE(kid, &bus->qbus.children, ChildrenHead, sibling) {
2003 DeviceState *qdev = kid->child;
2004 SCSIDevice *dev = SCSI_DEVICE(qdev);
2005
2006 if (dev->channel == channel && dev->id == id) {
2007 if (dev->lun == lun) {
2008 return dev;
2009 }
2010 target_dev = dev;
2011 }
2012 }
2013 return target_dev;
2014 }
2015
2016 /* SCSI request list. For simplicity, pv points to the whole device */
2017
2018 static int put_scsi_requests(QEMUFile *f, void *pv, size_t size,
2019 VMStateField *field, QJSON *vmdesc)
2020 {
2021 SCSIDevice *s = pv;
2022 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
2023 SCSIRequest *req;
2024
2025 QTAILQ_FOREACH(req, &s->requests, next) {
2026 assert(!req->io_canceled);
2027 assert(req->status == -1);
2028 assert(req->enqueued);
2029
2030 qemu_put_sbyte(f, req->retry ? 1 : 2);
2031 qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf));
2032 qemu_put_be32s(f, &req->tag);
2033 qemu_put_be32s(f, &req->lun);
2034 if (bus->info->save_request) {
2035 bus->info->save_request(f, req);
2036 }
2037 if (req->ops->save_request) {
2038 req->ops->save_request(f, req);
2039 }
2040 }
2041 qemu_put_sbyte(f, 0);
2042
2043 return 0;
2044 }
2045
2046 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size,
2047 VMStateField *field)
2048 {
2049 SCSIDevice *s = pv;
2050 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
2051 int8_t sbyte;
2052
2053 while ((sbyte = qemu_get_sbyte(f)) > 0) {
2054 uint8_t buf[SCSI_CMD_BUF_SIZE];
2055 uint32_t tag;
2056 uint32_t lun;
2057 SCSIRequest *req;
2058
2059 qemu_get_buffer(f, buf, sizeof(buf));
2060 qemu_get_be32s(f, &tag);
2061 qemu_get_be32s(f, &lun);
2062 req = scsi_req_new(s, tag, lun, buf, NULL);
2063 req->retry = (sbyte == 1);
2064 if (bus->info->load_request) {
2065 req->hba_private = bus->info->load_request(f, req);
2066 }
2067 if (req->ops->load_request) {
2068 req->ops->load_request(f, req);
2069 }
2070
2071 /* Just restart it later. */
2072 scsi_req_enqueue_internal(req);
2073
2074 /* At this point, the request will be kept alive by the reference
2075 * added by scsi_req_enqueue_internal, so we can release our reference.
2076 * The HBA of course will add its own reference in the load_request
2077 * callback if it needs to hold on the SCSIRequest.
2078 */
2079 scsi_req_unref(req);
2080 }
2081
2082 return 0;
2083 }
2084
2085 static const VMStateInfo vmstate_info_scsi_requests = {
2086 .name = "scsi-requests",
2087 .get = get_scsi_requests,
2088 .put = put_scsi_requests,
2089 };
2090
2091 static bool scsi_sense_state_needed(void *opaque)
2092 {
2093 SCSIDevice *s = opaque;
2094
2095 return s->sense_len > SCSI_SENSE_BUF_SIZE_OLD;
2096 }
2097
2098 static const VMStateDescription vmstate_scsi_sense_state = {
2099 .name = "SCSIDevice/sense",
2100 .version_id = 1,
2101 .minimum_version_id = 1,
2102 .needed = scsi_sense_state_needed,
2103 .fields = (VMStateField[]) {
2104 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice,
2105 SCSI_SENSE_BUF_SIZE_OLD,
2106 SCSI_SENSE_BUF_SIZE - SCSI_SENSE_BUF_SIZE_OLD),
2107 VMSTATE_END_OF_LIST()
2108 }
2109 };
2110
2111 const VMStateDescription vmstate_scsi_device = {
2112 .name = "SCSIDevice",
2113 .version_id = 1,
2114 .minimum_version_id = 1,
2115 .fields = (VMStateField[]) {
2116 VMSTATE_UINT8(unit_attention.key, SCSIDevice),
2117 VMSTATE_UINT8(unit_attention.asc, SCSIDevice),
2118 VMSTATE_UINT8(unit_attention.ascq, SCSIDevice),
2119 VMSTATE_BOOL(sense_is_ua, SCSIDevice),
2120 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 0, SCSI_SENSE_BUF_SIZE_OLD),
2121 VMSTATE_UINT32(sense_len, SCSIDevice),
2122 {
2123 .name = "requests",
2124 .version_id = 0,
2125 .field_exists = NULL,
2126 .size = 0, /* ouch */
2127 .info = &vmstate_info_scsi_requests,
2128 .flags = VMS_SINGLE,
2129 .offset = 0,
2130 },
2131 VMSTATE_END_OF_LIST()
2132 },
2133 .subsections = (const VMStateDescription*[]) {
2134 &vmstate_scsi_sense_state,
2135 NULL
2136 }
2137 };
2138
2139 static void scsi_device_class_init(ObjectClass *klass, void *data)
2140 {
2141 DeviceClass *k = DEVICE_CLASS(klass);
2142 set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
2143 k->bus_type = TYPE_SCSI_BUS;
2144 k->realize = scsi_qdev_realize;
2145 k->unrealize = scsi_qdev_unrealize;
2146 k->props = scsi_props;
2147 }
2148
2149 static void scsi_dev_instance_init(Object *obj)
2150 {
2151 DeviceState *dev = DEVICE(obj);
2152 SCSIDevice *s = SCSI_DEVICE(dev);
2153
2154 device_add_bootindex_property(obj, &s->conf.bootindex,
2155 "bootindex", NULL,
2156 &s->qdev, NULL);
2157 }
2158
2159 static const TypeInfo scsi_device_type_info = {
2160 .name = TYPE_SCSI_DEVICE,
2161 .parent = TYPE_DEVICE,
2162 .instance_size = sizeof(SCSIDevice),
2163 .abstract = true,
2164 .class_size = sizeof(SCSIDeviceClass),
2165 .class_init = scsi_device_class_init,
2166 .instance_init = scsi_dev_instance_init,
2167 };
2168
2169 static void scsi_register_types(void)
2170 {
2171 type_register_static(&scsi_bus_info);
2172 type_register_static(&scsi_device_type_info);
2173 }
2174
2175 type_init(scsi_register_types)
Random patches