1 #include "qemu/osdep.h"
2 #include "qapi/error.h"
3 #include "qemu/error-report.h"
4 #include "qemu/module.h"
5 #include "qemu/option.h"
6 #include "qemu/hw-version.h"
7 #include "hw/qdev-properties.h"
8 #include "hw/scsi/scsi.h"
9 #include "migration/qemu-file-types.h"
10 #include "migration/vmstate.h"
11 #include "scsi/constants.h"
12 #include "sysemu/block-backend.h"
13 #include "sysemu/blockdev.h"
14 #include "sysemu/sysemu.h"
15 #include "sysemu/runstate.h"
17 #include "sysemu/dma.h"
18 #include "qemu/cutils.h"
20 static char *scsibus_get_dev_path(DeviceState
*dev
);
21 static char *scsibus_get_fw_dev_path(DeviceState
*dev
);
22 static void scsi_req_dequeue(SCSIRequest
*req
);
23 static uint8_t *scsi_target_alloc_buf(SCSIRequest
*req
, size_t len
);
24 static void scsi_target_free_buf(SCSIRequest
*req
);
26 static int next_scsi_bus
;
28 static SCSIDevice
*do_scsi_device_find(SCSIBus
*bus
,
29 int channel
, int id
, int lun
,
30 bool include_unrealized
)
33 SCSIDevice
*retval
= NULL
;
35 QTAILQ_FOREACH_RCU(kid
, &bus
->qbus
.children
, sibling
) {
36 DeviceState
*qdev
= kid
->child
;
37 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
39 if (dev
->channel
== channel
&& dev
->id
== id
) {
40 if (dev
->lun
== lun
) {
46 * If we don't find exact match (channel/bus/lun),
47 * we will return the first device which matches channel/bus
57 * This function might run on the IO thread and we might race against
58 * main thread hot-plugging the device.
59 * We assume that as soon as .realized is set to true we can let
60 * the user access the device.
63 if (retval
&& !include_unrealized
&&
64 !qatomic_load_acquire(&retval
->qdev
.realized
)) {
71 SCSIDevice
*scsi_device_find(SCSIBus
*bus
, int channel
, int id
, int lun
)
73 RCU_READ_LOCK_GUARD();
74 return do_scsi_device_find(bus
, channel
, id
, lun
, false);
77 SCSIDevice
*scsi_device_get(SCSIBus
*bus
, int channel
, int id
, int lun
)
80 RCU_READ_LOCK_GUARD();
81 d
= do_scsi_device_find(bus
, channel
, id
, lun
, false);
88 static void scsi_device_realize(SCSIDevice
*s
, Error
**errp
)
90 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(s
);
96 static void scsi_device_unrealize(SCSIDevice
*s
)
98 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(s
);
104 int scsi_bus_parse_cdb(SCSIDevice
*dev
, SCSICommand
*cmd
, uint8_t *buf
,
105 size_t buf_len
, void *hba_private
)
107 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, dev
->qdev
.parent_bus
);
110 assert(cmd
->len
== 0);
111 rc
= scsi_req_parse_cdb(dev
, cmd
, buf
, buf_len
);
112 if (bus
->info
->parse_cdb
) {
113 rc
= bus
->info
->parse_cdb(dev
, cmd
, buf
, buf_len
, hba_private
);
118 static SCSIRequest
*scsi_device_alloc_req(SCSIDevice
*s
, uint32_t tag
, uint32_t lun
,
119 uint8_t *buf
, void *hba_private
)
121 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(s
);
123 return sc
->alloc_req(s
, tag
, lun
, buf
, hba_private
);
129 void scsi_device_unit_attention_reported(SCSIDevice
*s
)
131 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(s
);
132 if (sc
->unit_attention_reported
) {
133 sc
->unit_attention_reported(s
);
137 /* Create a scsi bus, and attach devices to it. */
138 void scsi_bus_init_named(SCSIBus
*bus
, size_t bus_size
, DeviceState
*host
,
139 const SCSIBusInfo
*info
, const char *bus_name
)
141 qbus_init(bus
, bus_size
, TYPE_SCSI_BUS
, host
, bus_name
);
142 bus
->busnr
= next_scsi_bus
++;
144 qbus_set_bus_hotplug_handler(BUS(bus
));
147 static void scsi_dma_restart_bh(void *opaque
)
149 SCSIDevice
*s
= opaque
;
150 SCSIRequest
*req
, *next
;
152 qemu_bh_delete(s
->bh
);
155 aio_context_acquire(blk_get_aio_context(s
->conf
.blk
));
156 QTAILQ_FOREACH_SAFE(req
, &s
->requests
, next
, next
) {
160 switch (req
->cmd
.mode
) {
161 case SCSI_XFER_FROM_DEV
:
162 case SCSI_XFER_TO_DEV
:
163 scsi_req_continue(req
);
166 scsi_req_dequeue(req
);
167 scsi_req_enqueue(req
);
173 aio_context_release(blk_get_aio_context(s
->conf
.blk
));
174 /* Drop the reference that was acquired in scsi_dma_restart_cb */
175 object_unref(OBJECT(s
));
178 void scsi_req_retry(SCSIRequest
*req
)
180 /* No need to save a reference, because scsi_dma_restart_bh just
181 * looks at the request list. */
185 static void scsi_dma_restart_cb(void *opaque
, bool running
, RunState state
)
187 SCSIDevice
*s
= opaque
;
193 AioContext
*ctx
= blk_get_aio_context(s
->conf
.blk
);
194 /* The reference is dropped in scsi_dma_restart_bh.*/
195 object_ref(OBJECT(s
));
196 s
->bh
= aio_bh_new_guarded(ctx
, scsi_dma_restart_bh
, s
,
197 &DEVICE(s
)->mem_reentrancy_guard
);
198 qemu_bh_schedule(s
->bh
);
202 static bool scsi_bus_is_address_free(SCSIBus
*bus
,
203 int channel
, int target
, int lun
,
208 RCU_READ_LOCK_GUARD();
209 d
= do_scsi_device_find(bus
, channel
, target
, lun
, true);
210 if (d
&& d
->lun
== lun
) {
222 static bool scsi_bus_check_address(BusState
*qbus
, DeviceState
*qdev
, Error
**errp
)
224 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
225 SCSIBus
*bus
= SCSI_BUS(qbus
);
227 if (dev
->channel
> bus
->info
->max_channel
) {
228 error_setg(errp
, "bad scsi channel id: %d", dev
->channel
);
231 if (dev
->id
!= -1 && dev
->id
> bus
->info
->max_target
) {
232 error_setg(errp
, "bad scsi device id: %d", dev
->id
);
235 if (dev
->lun
!= -1 && dev
->lun
> bus
->info
->max_lun
) {
236 error_setg(errp
, "bad scsi device lun: %d", dev
->lun
);
240 if (dev
->id
!= -1 && dev
->lun
!= -1) {
242 if (!scsi_bus_is_address_free(bus
, dev
->channel
, dev
->id
, dev
->lun
, &d
)) {
243 error_setg(errp
, "lun already used by '%s'", d
->qdev
.id
);
251 static void scsi_qdev_realize(DeviceState
*qdev
, Error
**errp
)
253 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
254 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, dev
->qdev
.parent_bus
);
256 Error
*local_err
= NULL
;
260 if (dev
->lun
== -1) {
264 is_free
= scsi_bus_is_address_free(bus
, dev
->channel
, ++id
, dev
->lun
, NULL
);
265 } while (!is_free
&& id
< bus
->info
->max_target
);
267 error_setg(errp
, "no free target");
271 } else if (dev
->lun
== -1) {
274 is_free
= scsi_bus_is_address_free(bus
, dev
->channel
, dev
->id
, ++lun
, NULL
);
275 } while (!is_free
&& lun
< bus
->info
->max_lun
);
277 error_setg(errp
, "no free lun");
283 QTAILQ_INIT(&dev
->requests
);
284 scsi_device_realize(dev
, &local_err
);
286 error_propagate(errp
, local_err
);
289 dev
->vmsentry
= qdev_add_vm_change_state_handler(DEVICE(dev
),
290 scsi_dma_restart_cb
, dev
);
293 static void scsi_qdev_unrealize(DeviceState
*qdev
)
295 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
298 qemu_del_vm_change_state_handler(dev
->vmsentry
);
301 scsi_device_purge_requests(dev
, SENSE_CODE(NO_SENSE
));
303 scsi_device_unrealize(dev
);
305 blockdev_mark_auto_del(dev
->conf
.blk
);
308 /* handle legacy '-drive if=scsi,...' cmd line args */
309 SCSIDevice
*scsi_bus_legacy_add_drive(SCSIBus
*bus
, BlockBackend
*blk
,
310 int unit
, bool removable
, int bootindex
,
312 BlockdevOnError rerror
,
313 BlockdevOnError werror
,
314 const char *serial
, Error
**errp
)
321 if (blk_is_sg(blk
)) {
322 driver
= "scsi-generic";
324 dinfo
= blk_legacy_dinfo(blk
);
325 if (dinfo
&& dinfo
->media_cd
) {
331 dev
= qdev_new(driver
);
332 name
= g_strdup_printf("legacy[%d]", unit
);
333 object_property_add_child(OBJECT(bus
), name
, OBJECT(dev
));
336 qdev_prop_set_uint32(dev
, "scsi-id", unit
);
337 if (bootindex
>= 0) {
338 object_property_set_int(OBJECT(dev
), "bootindex", bootindex
,
341 if (object_property_find(OBJECT(dev
), "removable")) {
342 qdev_prop_set_bit(dev
, "removable", removable
);
344 if (serial
&& object_property_find(OBJECT(dev
), "serial")) {
345 qdev_prop_set_string(dev
, "serial", serial
);
347 if (!qdev_prop_set_drive_err(dev
, "drive", blk
, errp
)) {
348 object_unparent(OBJECT(dev
));
351 if (!object_property_set_bool(OBJECT(dev
), "share-rw", share_rw
, errp
)) {
352 object_unparent(OBJECT(dev
));
356 qdev_prop_set_enum(dev
, "rerror", rerror
);
357 qdev_prop_set_enum(dev
, "werror", werror
);
359 if (!qdev_realize_and_unref(dev
, &bus
->qbus
, errp
)) {
360 object_unparent(OBJECT(dev
));
363 return SCSI_DEVICE(dev
);
366 void scsi_bus_legacy_handle_cmdline(SCSIBus
*bus
)
373 for (unit
= 0; unit
<= bus
->info
->max_target
; unit
++) {
374 dinfo
= drive_get(IF_SCSI
, bus
->busnr
, unit
);
378 qemu_opts_loc_restore(dinfo
->opts
);
379 scsi_bus_legacy_add_drive(bus
, blk_by_legacy_dinfo(dinfo
),
380 unit
, false, -1, false,
381 BLOCKDEV_ON_ERROR_AUTO
,
382 BLOCKDEV_ON_ERROR_AUTO
,
388 static int32_t scsi_invalid_field(SCSIRequest
*req
, uint8_t *buf
)
390 scsi_req_build_sense(req
, SENSE_CODE(INVALID_FIELD
));
391 scsi_req_complete(req
, CHECK_CONDITION
);
395 static const struct SCSIReqOps reqops_invalid_field
= {
396 .size
= sizeof(SCSIRequest
),
397 .send_command
= scsi_invalid_field
400 /* SCSIReqOps implementation for invalid commands. */
402 static int32_t scsi_invalid_command(SCSIRequest
*req
, uint8_t *buf
)
404 scsi_req_build_sense(req
, SENSE_CODE(INVALID_OPCODE
));
405 scsi_req_complete(req
, CHECK_CONDITION
);
409 static const struct SCSIReqOps reqops_invalid_opcode
= {
410 .size
= sizeof(SCSIRequest
),
411 .send_command
= scsi_invalid_command
414 /* SCSIReqOps implementation for unit attention conditions. */
416 static int32_t scsi_unit_attention(SCSIRequest
*req
, uint8_t *buf
)
418 if (req
->dev
->unit_attention
.key
== UNIT_ATTENTION
) {
419 scsi_req_build_sense(req
, req
->dev
->unit_attention
);
420 } else if (req
->bus
->unit_attention
.key
== UNIT_ATTENTION
) {
421 scsi_req_build_sense(req
, req
->bus
->unit_attention
);
423 scsi_req_complete(req
, CHECK_CONDITION
);
427 static const struct SCSIReqOps reqops_unit_attention
= {
428 .size
= sizeof(SCSIRequest
),
429 .send_command
= scsi_unit_attention
432 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to
435 typedef struct SCSITargetReq SCSITargetReq
;
437 struct SCSITargetReq
{
444 static void store_lun(uint8_t *outbuf
, int lun
)
447 /* Simple logical unit addressing method*/
451 /* Flat space addressing method */
452 outbuf
[0] = 0x40 | (lun
>> 8);
453 outbuf
[1] = (lun
& 255);
457 static bool scsi_target_emulate_report_luns(SCSITargetReq
*r
)
461 uint8_t tmp
[8] = {0};
465 if (r
->req
.cmd
.xfer
< 16) {
468 if (r
->req
.cmd
.buf
[2] > 2) {
472 /* reserve space for 63 LUNs*/
473 buf
= g_byte_array_sized_new(512);
475 channel
= r
->req
.dev
->channel
;
478 /* add size (will be updated later to correct value */
479 g_byte_array_append(buf
, tmp
, 8);
483 g_byte_array_append(buf
, tmp
, 8);
486 WITH_RCU_READ_LOCK_GUARD() {
487 QTAILQ_FOREACH_RCU(kid
, &r
->req
.bus
->qbus
.children
, sibling
) {
488 DeviceState
*qdev
= kid
->child
;
489 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
491 if (dev
->channel
== channel
&& dev
->id
== id
&& dev
->lun
!= 0) {
492 store_lun(tmp
, dev
->lun
);
493 g_byte_array_append(buf
, tmp
, 8);
500 r
->buf
= g_byte_array_free(buf
, FALSE
);
501 r
->len
= MIN(len
, r
->req
.cmd
.xfer
& ~7);
503 /* store the LUN list length */
504 stl_be_p(&r
->buf
[0], len
- 8);
508 static bool scsi_target_emulate_inquiry(SCSITargetReq
*r
)
510 assert(r
->req
.dev
->lun
!= r
->req
.lun
);
512 scsi_target_alloc_buf(&r
->req
, SCSI_INQUIRY_LEN
);
514 if (r
->req
.cmd
.buf
[1] & 0x2) {
515 /* Command support data - optional, not implemented */
519 if (r
->req
.cmd
.buf
[1] & 0x1) {
520 /* Vital product data */
521 uint8_t page_code
= r
->req
.cmd
.buf
[2];
522 r
->buf
[r
->len
++] = page_code
; /* this page */
523 r
->buf
[r
->len
++] = 0x00;
526 case 0x00: /* Supported page codes, mandatory */
530 r
->buf
[r
->len
++] = 0x00; /* list of supported pages (this page) */
531 r
->buf
[pages
] = r
->len
- pages
- 1; /* number of pages */
538 assert(r
->len
< r
->buf_len
);
539 r
->len
= MIN(r
->req
.cmd
.xfer
, r
->len
);
543 /* Standard INQUIRY data */
544 if (r
->req
.cmd
.buf
[2] != 0) {
549 r
->len
= MIN(r
->req
.cmd
.xfer
, SCSI_INQUIRY_LEN
);
550 memset(r
->buf
, 0, r
->len
);
551 if (r
->req
.lun
!= 0) {
552 r
->buf
[0] = TYPE_NO_LUN
;
554 r
->buf
[0] = TYPE_NOT_PRESENT
| TYPE_INACTIVE
;
555 r
->buf
[2] = 5; /* Version */
556 r
->buf
[3] = 2 | 0x10; /* HiSup, response data format */
557 r
->buf
[4] = r
->len
- 5; /* Additional Length = (Len - 1) - 4 */
558 r
->buf
[7] = 0x10 | (r
->req
.bus
->info
->tcq
? 0x02 : 0); /* Sync, TCQ. */
559 memcpy(&r
->buf
[8], "QEMU ", 8);
560 memcpy(&r
->buf
[16], "QEMU TARGET ", 16);
561 pstrcpy((char *) &r
->buf
[32], 4, qemu_hw_version());
566 static size_t scsi_sense_len(SCSIRequest
*req
)
568 if (req
->dev
->type
== TYPE_SCANNER
)
569 return SCSI_SENSE_LEN_SCANNER
;
571 return SCSI_SENSE_LEN
;
574 static int32_t scsi_target_send_command(SCSIRequest
*req
, uint8_t *buf
)
576 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
577 int fixed_sense
= (req
->cmd
.buf
[1] & 1) == 0;
580 buf
[0] != INQUIRY
&& buf
[0] != REQUEST_SENSE
) {
581 scsi_req_build_sense(req
, SENSE_CODE(LUN_NOT_SUPPORTED
));
582 scsi_req_complete(req
, CHECK_CONDITION
);
587 if (!scsi_target_emulate_report_luns(r
)) {
588 goto illegal_request
;
592 if (!scsi_target_emulate_inquiry(r
)) {
593 goto illegal_request
;
597 scsi_target_alloc_buf(&r
->req
, scsi_sense_len(req
));
599 const struct SCSISense sense
= SENSE_CODE(LUN_NOT_SUPPORTED
);
601 r
->len
= scsi_build_sense_buf(r
->buf
, req
->cmd
.xfer
,
604 r
->len
= scsi_device_get_sense(r
->req
.dev
, r
->buf
,
605 MIN(req
->cmd
.xfer
, r
->buf_len
),
608 if (r
->req
.dev
->sense_is_ua
) {
609 scsi_device_unit_attention_reported(req
->dev
);
610 r
->req
.dev
->sense_len
= 0;
611 r
->req
.dev
->sense_is_ua
= false;
614 case TEST_UNIT_READY
:
617 scsi_req_build_sense(req
, SENSE_CODE(INVALID_OPCODE
));
618 scsi_req_complete(req
, CHECK_CONDITION
);
621 scsi_req_build_sense(req
, SENSE_CODE(INVALID_FIELD
));
622 scsi_req_complete(req
, CHECK_CONDITION
);
627 scsi_req_complete(req
, GOOD
);
632 static void scsi_target_read_data(SCSIRequest
*req
)
634 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
640 scsi_req_data(&r
->req
, n
);
642 scsi_req_complete(&r
->req
, GOOD
);
646 static uint8_t *scsi_target_get_buf(SCSIRequest
*req
)
648 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
653 static uint8_t *scsi_target_alloc_buf(SCSIRequest
*req
, size_t len
)
655 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
657 r
->buf
= g_malloc(len
);
663 static void scsi_target_free_buf(SCSIRequest
*req
)
665 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
670 static const struct SCSIReqOps reqops_target_command
= {
671 .size
= sizeof(SCSITargetReq
),
672 .send_command
= scsi_target_send_command
,
673 .read_data
= scsi_target_read_data
,
674 .get_buf
= scsi_target_get_buf
,
675 .free_req
= scsi_target_free_buf
,
679 SCSIRequest
*scsi_req_alloc(const SCSIReqOps
*reqops
, SCSIDevice
*d
,
680 uint32_t tag
, uint32_t lun
, void *hba_private
)
683 SCSIBus
*bus
= scsi_bus_from_device(d
);
684 BusState
*qbus
= BUS(bus
);
685 const int memset_off
= offsetof(SCSIRequest
, sense
)
686 + sizeof(req
->sense
);
688 req
= g_malloc(reqops
->size
);
689 memset((uint8_t *)req
+ memset_off
, 0, reqops
->size
- memset_off
);
695 req
->hba_private
= hba_private
;
697 req
->host_status
= -1;
699 object_ref(OBJECT(d
));
700 object_ref(OBJECT(qbus
->parent
));
701 notifier_list_init(&req
->cancel_notifiers
);
702 trace_scsi_req_alloc(req
->dev
->id
, req
->lun
, req
->tag
);
706 SCSIRequest
*scsi_req_new(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
,
707 uint8_t *buf
, size_t buf_len
, void *hba_private
)
709 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, d
->qdev
.parent_bus
);
710 const SCSIReqOps
*ops
;
711 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(d
);
713 SCSICommand cmd
= { .len
= 0 };
717 trace_scsi_req_parse_bad(d
->id
, lun
, tag
, 0);
721 if ((d
->unit_attention
.key
== UNIT_ATTENTION
||
722 bus
->unit_attention
.key
== UNIT_ATTENTION
) &&
723 (buf
[0] != INQUIRY
&&
724 buf
[0] != REPORT_LUNS
&&
725 buf
[0] != GET_CONFIGURATION
&&
726 buf
[0] != GET_EVENT_STATUS_NOTIFICATION
&&
729 * If we already have a pending unit attention condition,
730 * report this one before triggering another one.
732 !(buf
[0] == REQUEST_SENSE
&& d
->sense_is_ua
))) {
733 ops
= &reqops_unit_attention
;
734 } else if (lun
!= d
->lun
||
735 buf
[0] == REPORT_LUNS
||
736 (buf
[0] == REQUEST_SENSE
&& d
->sense_len
)) {
737 ops
= &reqops_target_command
;
742 if (ops
!= NULL
|| !sc
->parse_cdb
) {
743 ret
= scsi_req_parse_cdb(d
, &cmd
, buf
, buf_len
);
745 ret
= sc
->parse_cdb(d
, &cmd
, buf
, buf_len
, hba_private
);
749 trace_scsi_req_parse_bad(d
->id
, lun
, tag
, buf
[0]);
751 req
= scsi_req_alloc(&reqops_invalid_opcode
, d
, tag
, lun
, hba_private
);
753 assert(cmd
.len
!= 0);
754 trace_scsi_req_parsed(d
->id
, lun
, tag
, buf
[0],
757 trace_scsi_req_parsed_lba(d
->id
, lun
, tag
, buf
[0],
761 if (cmd
.xfer
> INT32_MAX
) {
762 req
= scsi_req_alloc(&reqops_invalid_field
, d
, tag
, lun
, hba_private
);
764 req
= scsi_req_alloc(ops
, d
, tag
, lun
, hba_private
);
766 req
= scsi_device_alloc_req(d
, tag
, lun
, buf
, hba_private
);
771 req
->residual
= req
->cmd
.xfer
;
775 trace_scsi_inquiry(d
->id
, lun
, tag
, cmd
.buf
[1], cmd
.buf
[2]);
777 case TEST_UNIT_READY
:
778 trace_scsi_test_unit_ready(d
->id
, lun
, tag
);
781 trace_scsi_report_luns(d
->id
, lun
, tag
);
784 trace_scsi_request_sense(d
->id
, lun
, tag
);
793 uint8_t *scsi_req_get_buf(SCSIRequest
*req
)
795 return req
->ops
->get_buf(req
);
798 static void scsi_clear_unit_attention(SCSIRequest
*req
)
801 if (req
->dev
->unit_attention
.key
!= UNIT_ATTENTION
&&
802 req
->bus
->unit_attention
.key
!= UNIT_ATTENTION
) {
807 * If an INQUIRY command enters the enabled command state,
808 * the device server shall [not] clear any unit attention condition;
809 * See also MMC-6, paragraphs 6.5 and 6.6.2.
811 if (req
->cmd
.buf
[0] == INQUIRY
||
812 req
->cmd
.buf
[0] == GET_CONFIGURATION
||
813 req
->cmd
.buf
[0] == GET_EVENT_STATUS_NOTIFICATION
) {
817 if (req
->dev
->unit_attention
.key
== UNIT_ATTENTION
) {
818 ua
= &req
->dev
->unit_attention
;
820 ua
= &req
->bus
->unit_attention
;
824 * If a REPORT LUNS command enters the enabled command state, [...]
825 * the device server shall clear any pending unit attention condition
826 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
828 if (req
->cmd
.buf
[0] == REPORT_LUNS
&&
829 !(ua
->asc
== SENSE_CODE(REPORTED_LUNS_CHANGED
).asc
&&
830 ua
->ascq
== SENSE_CODE(REPORTED_LUNS_CHANGED
).ascq
)) {
834 *ua
= SENSE_CODE(NO_SENSE
);
837 int scsi_req_get_sense(SCSIRequest
*req
, uint8_t *buf
, int len
)
842 if (!req
->sense_len
) {
846 ret
= scsi_convert_sense(req
->sense
, req
->sense_len
, buf
, len
, true);
849 * FIXME: clearing unit attention conditions upon autosense should be done
850 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
853 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
854 * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
855 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
857 if (req
->dev
->sense_is_ua
) {
858 scsi_device_unit_attention_reported(req
->dev
);
859 req
->dev
->sense_len
= 0;
860 req
->dev
->sense_is_ua
= false;
865 int scsi_device_get_sense(SCSIDevice
*dev
, uint8_t *buf
, int len
, bool fixed
)
867 return scsi_convert_sense(dev
->sense
, dev
->sense_len
, buf
, len
, fixed
);
870 void scsi_req_build_sense(SCSIRequest
*req
, SCSISense sense
)
872 trace_scsi_req_build_sense(req
->dev
->id
, req
->lun
, req
->tag
,
873 sense
.key
, sense
.asc
, sense
.ascq
);
874 req
->sense_len
= scsi_build_sense(req
->sense
, sense
);
877 static void scsi_req_enqueue_internal(SCSIRequest
*req
)
879 assert(!req
->enqueued
);
881 if (req
->bus
->info
->get_sg_list
) {
882 req
->sg
= req
->bus
->info
->get_sg_list(req
);
886 req
->enqueued
= true;
887 QTAILQ_INSERT_TAIL(&req
->dev
->requests
, req
, next
);
890 int32_t scsi_req_enqueue(SCSIRequest
*req
)
895 scsi_req_enqueue_internal(req
);
897 rc
= req
->ops
->send_command(req
, req
->cmd
.buf
);
902 static void scsi_req_dequeue(SCSIRequest
*req
)
904 trace_scsi_req_dequeue(req
->dev
->id
, req
->lun
, req
->tag
);
907 QTAILQ_REMOVE(&req
->dev
->requests
, req
, next
);
908 req
->enqueued
= false;
913 static int scsi_get_performance_length(int num_desc
, int type
, int data_type
)
915 /* MMC-6, paragraph 6.7. */
918 if ((data_type
& 3) == 0) {
919 /* Each descriptor is as in Table 295 - Nominal performance. */
920 return 16 * num_desc
+ 8;
922 /* Each descriptor is as in Table 296 - Exceptions. */
923 return 6 * num_desc
+ 8;
928 return 8 * num_desc
+ 8;
930 return 2048 * num_desc
+ 8;
932 return 16 * num_desc
+ 8;
938 static int ata_passthrough_xfer_unit(SCSIDevice
*dev
, uint8_t *buf
)
940 int byte_block
= (buf
[2] >> 2) & 0x1;
941 int type
= (buf
[2] >> 4) & 0x1;
946 xfer_unit
= dev
->blocksize
;
957 static int ata_passthrough_12_xfer(SCSIDevice
*dev
, uint8_t *buf
)
959 int length
= buf
[2] & 0x3;
961 int unit
= ata_passthrough_xfer_unit(dev
, buf
);
965 case 3: /* USB-specific. */
980 static int ata_passthrough_16_xfer(SCSIDevice
*dev
, uint8_t *buf
)
982 int extend
= buf
[1] & 0x1;
983 int length
= buf
[2] & 0x3;
985 int unit
= ata_passthrough_xfer_unit(dev
, buf
);
989 case 3: /* USB-specific. */
995 xfer
|= (extend
? buf
[3] << 8 : 0);
999 xfer
|= (extend
? buf
[5] << 8 : 0);
1006 static int scsi_req_xfer(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
1008 cmd
->xfer
= scsi_cdb_xfer(buf
);
1010 case TEST_UNIT_READY
:
1014 case WRITE_FILEMARKS
:
1015 case WRITE_FILEMARKS_16
:
1020 case ALLOW_MEDIUM_REMOVAL
:
1022 case SYNCHRONIZE_CACHE
:
1023 case SYNCHRONIZE_CACHE_16
:
1025 case LOCK_UNLOCK_CACHE
:
1031 case SET_READ_AHEAD
:
1034 case ALLOW_OVERWRITE
:
1040 if ((buf
[1] & 2) == 0) {
1042 } else if ((buf
[1] & 4) != 0) {
1045 cmd
->xfer
*= dev
->blocksize
;
1051 cmd
->xfer
= buf
[1] & 1 ? 0 : dev
->blocksize
;
1053 case READ_CAPACITY_10
:
1056 case READ_BLOCK_LIMITS
:
1059 case SEND_VOLUME_TAG
:
1060 /* GPCMD_SET_STREAMING from multimedia commands. */
1061 if (dev
->type
== TYPE_ROM
) {
1062 cmd
->xfer
= buf
[10] | (buf
[9] << 8);
1064 cmd
->xfer
= buf
[9] | (buf
[8] << 8);
1068 /* length 0 means 256 blocks */
1069 if (cmd
->xfer
== 0) {
1074 case WRITE_VERIFY_10
:
1076 case WRITE_VERIFY_12
:
1078 case WRITE_VERIFY_16
:
1079 cmd
->xfer
*= dev
->blocksize
;
1083 /* length 0 means 256 blocks */
1084 if (cmd
->xfer
== 0) {
1091 cmd
->xfer
*= dev
->blocksize
;
1094 /* MMC mandates the parameter list to be 12-bytes long. Parameters
1095 * for block devices are restricted to the header right now. */
1096 if (dev
->type
== TYPE_ROM
&& (buf
[1] & 16)) {
1099 cmd
->xfer
= (buf
[1] & 16) == 0 ? 0 : (buf
[1] & 32 ? 8 : 4);
1103 case RECEIVE_DIAGNOSTIC
:
1104 case SEND_DIAGNOSTIC
:
1105 cmd
->xfer
= buf
[4] | (buf
[3] << 8);
1110 case SEND_CUE_SHEET
:
1111 cmd
->xfer
= buf
[8] | (buf
[7] << 8) | (buf
[6] << 16);
1113 case PERSISTENT_RESERVE_OUT
:
1114 cmd
->xfer
= ldl_be_p(&buf
[5]) & 0xffffffffULL
;
1117 if (dev
->type
== TYPE_ROM
) {
1118 /* MMC command GET PERFORMANCE. */
1119 cmd
->xfer
= scsi_get_performance_length(buf
[9] | (buf
[8] << 8),
1120 buf
[10], buf
[1] & 0x1f);
1123 case MECHANISM_STATUS
:
1124 case READ_DVD_STRUCTURE
:
1125 case SEND_DVD_STRUCTURE
:
1126 case MAINTENANCE_OUT
:
1127 case MAINTENANCE_IN
:
1128 if (dev
->type
== TYPE_ROM
) {
1129 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
1130 cmd
->xfer
= buf
[9] | (buf
[8] << 8);
1133 case ATA_PASSTHROUGH_12
:
1134 if (dev
->type
== TYPE_ROM
) {
1135 /* BLANK command of MMC */
1138 cmd
->xfer
= ata_passthrough_12_xfer(dev
, buf
);
1141 case ATA_PASSTHROUGH_16
:
1142 cmd
->xfer
= ata_passthrough_16_xfer(dev
, buf
);
1148 static int scsi_req_stream_xfer(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
1151 /* stream commands */
1158 case RECOVER_BUFFERED_DATA
:
1160 cmd
->xfer
= buf
[4] | (buf
[3] << 8) | (buf
[2] << 16);
1161 if (buf
[1] & 0x01) { /* fixed */
1162 cmd
->xfer
*= dev
->blocksize
;
1166 case READ_REVERSE_16
:
1169 cmd
->xfer
= buf
[14] | (buf
[13] << 8) | (buf
[12] << 16);
1170 if (buf
[1] & 0x01) { /* fixed */
1171 cmd
->xfer
*= dev
->blocksize
;
1179 cmd
->xfer
= buf
[13] | (buf
[12] << 8);
1182 switch (buf
[1] & 0x1f) /* operation code */ {
1183 case SHORT_FORM_BLOCK_ID
:
1184 case SHORT_FORM_VENDOR_SPECIFIC
:
1191 cmd
->xfer
= buf
[8] | (buf
[7] << 8);
1199 cmd
->xfer
= buf
[4] | (buf
[3] << 8);
1201 /* generic commands */
1203 return scsi_req_xfer(cmd
, dev
, buf
);
1208 static int scsi_req_medium_changer_xfer(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
1211 /* medium changer commands */
1212 case EXCHANGE_MEDIUM
:
1213 case INITIALIZE_ELEMENT_STATUS
:
1214 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE
:
1216 case POSITION_TO_ELEMENT
:
1219 case READ_ELEMENT_STATUS
:
1220 cmd
->xfer
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16);
1223 /* generic commands */
1225 return scsi_req_xfer(cmd
, dev
, buf
);
1230 static int scsi_req_scanner_length(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
1233 /* Scanner commands */
1234 case OBJECT_POSITION
:
1244 cmd
->xfer
= buf
[8] | (buf
[7] << 8) | (buf
[6] << 16);
1247 /* GET_DATA_BUFFER_STATUS xfer handled by scsi_req_xfer */
1248 return scsi_req_xfer(cmd
, dev
, buf
);
1254 static void scsi_cmd_xfer_mode(SCSICommand
*cmd
)
1257 cmd
->mode
= SCSI_XFER_NONE
;
1260 switch (cmd
->buf
[0]) {
1263 case WRITE_VERIFY_10
:
1265 case WRITE_VERIFY_12
:
1267 case WRITE_VERIFY_16
:
1274 case CHANGE_DEFINITION
:
1277 case MODE_SELECT_10
:
1278 case SEND_DIAGNOSTIC
:
1281 case REASSIGN_BLOCKS
:
1290 case SEARCH_HIGH_12
:
1291 case SEARCH_EQUAL_12
:
1294 case SEND_VOLUME_TAG
:
1295 case SEND_CUE_SHEET
:
1296 case SEND_DVD_STRUCTURE
:
1297 case PERSISTENT_RESERVE_OUT
:
1298 case MAINTENANCE_OUT
:
1301 /* SCAN conflicts with START_STOP. START_STOP has cmd->xfer set to 0 for
1302 * non-scanner devices, so we only get here for SCAN and not for START_STOP.
1304 cmd
->mode
= SCSI_XFER_TO_DEV
;
1306 case ATA_PASSTHROUGH_12
:
1307 case ATA_PASSTHROUGH_16
:
1309 cmd
->mode
= (cmd
->buf
[2] & 0x8) ?
1310 SCSI_XFER_FROM_DEV
: SCSI_XFER_TO_DEV
;
1313 cmd
->mode
= SCSI_XFER_FROM_DEV
;
1318 int scsi_req_parse_cdb(SCSIDevice
*dev
, SCSICommand
*cmd
, uint8_t *buf
,
1325 len
= scsi_cdb_length(buf
);
1326 if (len
< 0 || len
> buf_len
) {
1331 switch (dev
->type
) {
1333 rc
= scsi_req_stream_xfer(cmd
, dev
, buf
);
1335 case TYPE_MEDIUM_CHANGER
:
1336 rc
= scsi_req_medium_changer_xfer(cmd
, dev
, buf
);
1339 rc
= scsi_req_scanner_length(cmd
, dev
, buf
);
1342 rc
= scsi_req_xfer(cmd
, dev
, buf
);
1349 memcpy(cmd
->buf
, buf
, cmd
->len
);
1350 scsi_cmd_xfer_mode(cmd
);
1351 cmd
->lba
= scsi_cmd_lba(cmd
);
1355 void scsi_device_report_change(SCSIDevice
*dev
, SCSISense sense
)
1357 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, dev
->qdev
.parent_bus
);
1359 scsi_device_set_ua(dev
, sense
);
1360 if (bus
->info
->change
) {
1361 bus
->info
->change(bus
, dev
, sense
);
1365 SCSIRequest
*scsi_req_ref(SCSIRequest
*req
)
1367 assert(req
->refcount
> 0);
1372 void scsi_req_unref(SCSIRequest
*req
)
1374 assert(req
->refcount
> 0);
1375 if (--req
->refcount
== 0) {
1376 BusState
*qbus
= req
->dev
->qdev
.parent_bus
;
1377 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, qbus
);
1379 if (bus
->info
->free_request
&& req
->hba_private
) {
1380 bus
->info
->free_request(bus
, req
->hba_private
);
1382 if (req
->ops
->free_req
) {
1383 req
->ops
->free_req(req
);
1385 object_unref(OBJECT(req
->dev
));
1386 object_unref(OBJECT(qbus
->parent
));
1391 /* Tell the device that we finished processing this chunk of I/O. It
1392 will start the next chunk or complete the command. */
1393 void scsi_req_continue(SCSIRequest
*req
)
1395 if (req
->io_canceled
) {
1396 trace_scsi_req_continue_canceled(req
->dev
->id
, req
->lun
, req
->tag
);
1399 trace_scsi_req_continue(req
->dev
->id
, req
->lun
, req
->tag
);
1400 if (req
->cmd
.mode
== SCSI_XFER_TO_DEV
) {
1401 req
->ops
->write_data(req
);
1403 req
->ops
->read_data(req
);
1407 /* Called by the devices when data is ready for the HBA. The HBA should
1408 start a DMA operation to read or fill the device's data buffer.
1409 Once it completes, calling scsi_req_continue will restart I/O. */
1410 void scsi_req_data(SCSIRequest
*req
, int len
)
1413 if (req
->io_canceled
) {
1414 trace_scsi_req_data_canceled(req
->dev
->id
, req
->lun
, req
->tag
, len
);
1417 trace_scsi_req_data(req
->dev
->id
, req
->lun
, req
->tag
, len
);
1418 assert(req
->cmd
.mode
!= SCSI_XFER_NONE
);
1420 req
->residual
-= len
;
1421 req
->bus
->info
->transfer_data(req
, len
);
1425 /* If the device calls scsi_req_data and the HBA specified a
1426 * scatter/gather list, the transfer has to happen in a single
1428 assert(!req
->dma_started
);
1429 req
->dma_started
= true;
1431 buf
= scsi_req_get_buf(req
);
1432 if (req
->cmd
.mode
== SCSI_XFER_FROM_DEV
) {
1433 dma_buf_read(buf
, len
, &req
->residual
, req
->sg
,
1434 MEMTXATTRS_UNSPECIFIED
);
1436 dma_buf_write(buf
, len
, &req
->residual
, req
->sg
,
1437 MEMTXATTRS_UNSPECIFIED
);
1439 scsi_req_continue(req
);
1442 void scsi_req_print(SCSIRequest
*req
)
1447 fprintf(fp
, "[%s id=%d] %s",
1448 req
->dev
->qdev
.parent_bus
->name
,
1450 scsi_command_name(req
->cmd
.buf
[0]));
1451 for (i
= 1; i
< req
->cmd
.len
; i
++) {
1452 fprintf(fp
, " 0x%02x", req
->cmd
.buf
[i
]);
1454 switch (req
->cmd
.mode
) {
1455 case SCSI_XFER_NONE
:
1456 fprintf(fp
, " - none\n");
1458 case SCSI_XFER_FROM_DEV
:
1459 fprintf(fp
, " - from-dev len=%zd\n", req
->cmd
.xfer
);
1461 case SCSI_XFER_TO_DEV
:
1462 fprintf(fp
, " - to-dev len=%zd\n", req
->cmd
.xfer
);
1465 fprintf(fp
, " - Oops\n");
1470 void scsi_req_complete_failed(SCSIRequest
*req
, int host_status
)
1475 assert(req
->status
== -1 && req
->host_status
== -1);
1476 assert(req
->ops
!= &reqops_unit_attention
);
1478 if (!req
->bus
->info
->fail
) {
1479 status
= scsi_sense_from_host_status(req
->host_status
, &sense
);
1480 if (status
== CHECK_CONDITION
) {
1481 scsi_req_build_sense(req
, sense
);
1483 scsi_req_complete(req
, status
);
1487 req
->host_status
= host_status
;
1489 scsi_req_dequeue(req
);
1490 req
->bus
->info
->fail(req
);
1492 /* Cancelled requests might end up being completed instead of cancelled */
1493 notifier_list_notify(&req
->cancel_notifiers
, req
);
1494 scsi_req_unref(req
);
1497 void scsi_req_complete(SCSIRequest
*req
, int status
)
1499 assert(req
->status
== -1 && req
->host_status
== -1);
1500 req
->status
= status
;
1501 req
->host_status
= SCSI_HOST_OK
;
1503 assert(req
->sense_len
<= sizeof(req
->sense
));
1504 if (status
== GOOD
) {
1508 if (req
->sense_len
) {
1509 memcpy(req
->dev
->sense
, req
->sense
, req
->sense_len
);
1510 req
->dev
->sense_len
= req
->sense_len
;
1511 req
->dev
->sense_is_ua
= (req
->ops
== &reqops_unit_attention
);
1513 req
->dev
->sense_len
= 0;
1514 req
->dev
->sense_is_ua
= false;
1518 * Unit attention state is now stored in the device's sense buffer
1519 * if the HBA didn't do autosense. Clear the pending unit attention
1522 scsi_clear_unit_attention(req
);
1525 scsi_req_dequeue(req
);
1526 req
->bus
->info
->complete(req
, req
->residual
);
1528 /* Cancelled requests might end up being completed instead of cancelled */
1529 notifier_list_notify(&req
->cancel_notifiers
, req
);
1530 scsi_req_unref(req
);
1533 /* Called by the devices when the request is canceled. */
1534 void scsi_req_cancel_complete(SCSIRequest
*req
)
1536 assert(req
->io_canceled
);
1537 if (req
->bus
->info
->cancel
) {
1538 req
->bus
->info
->cancel(req
);
1540 notifier_list_notify(&req
->cancel_notifiers
, req
);
1541 scsi_req_unref(req
);
1544 /* Cancel @req asynchronously. @notifier is added to @req's cancellation
1545 * notifier list, the bus will be notified the requests cancellation is
1548 void scsi_req_cancel_async(SCSIRequest
*req
, Notifier
*notifier
)
1550 trace_scsi_req_cancel(req
->dev
->id
, req
->lun
, req
->tag
);
1552 notifier_list_add(&req
->cancel_notifiers
, notifier
);
1554 if (req
->io_canceled
) {
1555 /* A blk_aio_cancel_async is pending; when it finishes,
1556 * scsi_req_cancel_complete will be called and will
1557 * call the notifier we just added. Just wait for that.
1562 /* Dropped in scsi_req_cancel_complete. */
1564 scsi_req_dequeue(req
);
1565 req
->io_canceled
= true;
1567 blk_aio_cancel_async(req
->aiocb
);
1569 scsi_req_cancel_complete(req
);
1573 void scsi_req_cancel(SCSIRequest
*req
)
1575 trace_scsi_req_cancel(req
->dev
->id
, req
->lun
, req
->tag
);
1576 if (!req
->enqueued
) {
1579 assert(!req
->io_canceled
);
1580 /* Dropped in scsi_req_cancel_complete. */
1582 scsi_req_dequeue(req
);
1583 req
->io_canceled
= true;
1585 blk_aio_cancel(req
->aiocb
);
1587 scsi_req_cancel_complete(req
);
1591 static int scsi_ua_precedence(SCSISense sense
)
1593 if (sense
.key
!= UNIT_ATTENTION
) {
1596 if (sense
.asc
== 0x29 && sense
.ascq
== 0x04) {
1597 /* DEVICE INTERNAL RESET goes with POWER ON OCCURRED */
1599 } else if (sense
.asc
== 0x3F && sense
.ascq
== 0x01) {
1600 /* MICROCODE HAS BEEN CHANGED goes with SCSI BUS RESET OCCURRED */
1602 } else if (sense
.asc
== 0x29 && (sense
.ascq
== 0x05 || sense
.ascq
== 0x06)) {
1603 /* These two go with "all others". */
1605 } else if (sense
.asc
== 0x29 && sense
.ascq
<= 0x07) {
1606 /* POWER ON, RESET OR BUS DEVICE RESET OCCURRED = 0
1607 * POWER ON OCCURRED = 1
1608 * SCSI BUS RESET OCCURRED = 2
1609 * BUS DEVICE RESET FUNCTION OCCURRED = 3
1610 * I_T NEXUS LOSS OCCURRED = 7
1613 } else if (sense
.asc
== 0x2F && sense
.ascq
== 0x01) {
1614 /* COMMANDS CLEARED BY POWER LOSS NOTIFICATION */
1617 return (sense
.asc
<< 8) | sense
.ascq
;
1620 void scsi_bus_set_ua(SCSIBus
*bus
, SCSISense sense
)
1623 if (sense
.key
!= UNIT_ATTENTION
) {
1628 * Override a pre-existing unit attention condition, except for a more
1629 * important reset condition.
1631 prec1
= scsi_ua_precedence(bus
->unit_attention
);
1632 prec2
= scsi_ua_precedence(sense
);
1633 if (prec2
< prec1
) {
1634 bus
->unit_attention
= sense
;
1638 void scsi_device_set_ua(SCSIDevice
*sdev
, SCSISense sense
)
1641 if (sense
.key
!= UNIT_ATTENTION
) {
1644 trace_scsi_device_set_ua(sdev
->id
, sdev
->lun
, sense
.key
,
1645 sense
.asc
, sense
.ascq
);
1648 * Override a pre-existing unit attention condition, except for a more
1649 * important reset condition.
1651 prec1
= scsi_ua_precedence(sdev
->unit_attention
);
1652 prec2
= scsi_ua_precedence(sense
);
1653 if (prec2
< prec1
) {
1654 sdev
->unit_attention
= sense
;
1658 void scsi_device_purge_requests(SCSIDevice
*sdev
, SCSISense sense
)
1662 aio_context_acquire(blk_get_aio_context(sdev
->conf
.blk
));
1663 while (!QTAILQ_EMPTY(&sdev
->requests
)) {
1664 req
= QTAILQ_FIRST(&sdev
->requests
);
1665 scsi_req_cancel_async(req
, NULL
);
1667 blk_drain(sdev
->conf
.blk
);
1668 aio_context_release(blk_get_aio_context(sdev
->conf
.blk
));
1669 scsi_device_set_ua(sdev
, sense
);
1672 static char *scsibus_get_dev_path(DeviceState
*dev
)
1674 SCSIDevice
*d
= SCSI_DEVICE(dev
);
1675 DeviceState
*hba
= dev
->parent_bus
->parent
;
1679 id
= qdev_get_dev_path(hba
);
1681 path
= g_strdup_printf("%s/%d:%d:%d", id
, d
->channel
, d
->id
, d
->lun
);
1683 path
= g_strdup_printf("%d:%d:%d", d
->channel
, d
->id
, d
->lun
);
1689 static char *scsibus_get_fw_dev_path(DeviceState
*dev
)
1691 SCSIDevice
*d
= SCSI_DEVICE(dev
);
1692 return g_strdup_printf("channel@%x/%s@%x,%x", d
->channel
,
1693 qdev_fw_name(dev
), d
->id
, d
->lun
);
1696 /* SCSI request list. For simplicity, pv points to the whole device */
1698 static int put_scsi_requests(QEMUFile
*f
, void *pv
, size_t size
,
1699 const VMStateField
*field
, JSONWriter
*vmdesc
)
1702 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, s
->qdev
.parent_bus
);
1705 QTAILQ_FOREACH(req
, &s
->requests
, next
) {
1706 assert(!req
->io_canceled
);
1707 assert(req
->status
== -1 && req
->host_status
== -1);
1708 assert(req
->enqueued
);
1710 qemu_put_sbyte(f
, req
->retry
? 1 : 2);
1711 qemu_put_buffer(f
, req
->cmd
.buf
, sizeof(req
->cmd
.buf
));
1712 qemu_put_be32s(f
, &req
->tag
);
1713 qemu_put_be32s(f
, &req
->lun
);
1714 if (bus
->info
->save_request
) {
1715 bus
->info
->save_request(f
, req
);
1717 if (req
->ops
->save_request
) {
1718 req
->ops
->save_request(f
, req
);
1721 qemu_put_sbyte(f
, 0);
1726 static int get_scsi_requests(QEMUFile
*f
, void *pv
, size_t size
,
1727 const VMStateField
*field
)
1730 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, s
->qdev
.parent_bus
);
1733 while ((sbyte
= qemu_get_sbyte(f
)) > 0) {
1734 uint8_t buf
[SCSI_CMD_BUF_SIZE
];
1739 qemu_get_buffer(f
, buf
, sizeof(buf
));
1740 qemu_get_be32s(f
, &tag
);
1741 qemu_get_be32s(f
, &lun
);
1743 * A too-short CDB would have been rejected by scsi_req_new, so just use
1744 * SCSI_CMD_BUF_SIZE as the CDB length.
1746 req
= scsi_req_new(s
, tag
, lun
, buf
, sizeof(buf
), NULL
);
1747 req
->retry
= (sbyte
== 1);
1748 if (bus
->info
->load_request
) {
1749 req
->hba_private
= bus
->info
->load_request(f
, req
);
1751 if (req
->ops
->load_request
) {
1752 req
->ops
->load_request(f
, req
);
1755 /* Just restart it later. */
1756 scsi_req_enqueue_internal(req
);
1758 /* At this point, the request will be kept alive by the reference
1759 * added by scsi_req_enqueue_internal, so we can release our reference.
1760 * The HBA of course will add its own reference in the load_request
1761 * callback if it needs to hold on the SCSIRequest.
1763 scsi_req_unref(req
);
1769 static const VMStateInfo vmstate_info_scsi_requests
= {
1770 .name
= "scsi-requests",
1771 .get
= get_scsi_requests
,
1772 .put
= put_scsi_requests
,
1775 static bool scsi_sense_state_needed(void *opaque
)
1777 SCSIDevice
*s
= opaque
;
1779 return s
->sense_len
> SCSI_SENSE_BUF_SIZE_OLD
;
1782 static const VMStateDescription vmstate_scsi_sense_state
= {
1783 .name
= "SCSIDevice/sense",
1785 .minimum_version_id
= 1,
1786 .needed
= scsi_sense_state_needed
,
1787 .fields
= (VMStateField
[]) {
1788 VMSTATE_UINT8_SUB_ARRAY(sense
, SCSIDevice
,
1789 SCSI_SENSE_BUF_SIZE_OLD
,
1790 SCSI_SENSE_BUF_SIZE
- SCSI_SENSE_BUF_SIZE_OLD
),
1791 VMSTATE_END_OF_LIST()
1795 const VMStateDescription vmstate_scsi_device
= {
1796 .name
= "SCSIDevice",
1798 .minimum_version_id
= 1,
1799 .fields
= (VMStateField
[]) {
1800 VMSTATE_UINT8(unit_attention
.key
, SCSIDevice
),
1801 VMSTATE_UINT8(unit_attention
.asc
, SCSIDevice
),
1802 VMSTATE_UINT8(unit_attention
.ascq
, SCSIDevice
),
1803 VMSTATE_BOOL(sense_is_ua
, SCSIDevice
),
1804 VMSTATE_UINT8_SUB_ARRAY(sense
, SCSIDevice
, 0, SCSI_SENSE_BUF_SIZE_OLD
),
1805 VMSTATE_UINT32(sense_len
, SCSIDevice
),
1809 .field_exists
= NULL
,
1810 .size
= 0, /* ouch */
1811 .info
= &vmstate_info_scsi_requests
,
1812 .flags
= VMS_SINGLE
,
1815 VMSTATE_END_OF_LIST()
1817 .subsections
= (const VMStateDescription
*[]) {
1818 &vmstate_scsi_sense_state
,
1823 static Property scsi_props
[] = {
1824 DEFINE_PROP_UINT32("channel", SCSIDevice
, channel
, 0),
1825 DEFINE_PROP_UINT32("scsi-id", SCSIDevice
, id
, -1),
1826 DEFINE_PROP_UINT32("lun", SCSIDevice
, lun
, -1),
1827 DEFINE_PROP_END_OF_LIST(),
1830 static void scsi_device_class_init(ObjectClass
*klass
, void *data
)
1832 DeviceClass
*k
= DEVICE_CLASS(klass
);
1833 set_bit(DEVICE_CATEGORY_STORAGE
, k
->categories
);
1834 k
->bus_type
= TYPE_SCSI_BUS
;
1835 k
->realize
= scsi_qdev_realize
;
1836 k
->unrealize
= scsi_qdev_unrealize
;
1837 device_class_set_props(k
, scsi_props
);
1840 static void scsi_dev_instance_init(Object
*obj
)
1842 DeviceState
*dev
= DEVICE(obj
);
1843 SCSIDevice
*s
= SCSI_DEVICE(dev
);
1845 device_add_bootindex_property(obj
, &s
->conf
.bootindex
,
1850 static const TypeInfo scsi_device_type_info
= {
1851 .name
= TYPE_SCSI_DEVICE
,
1852 .parent
= TYPE_DEVICE
,
1853 .instance_size
= sizeof(SCSIDevice
),
1855 .class_size
= sizeof(SCSIDeviceClass
),
1856 .class_init
= scsi_device_class_init
,
1857 .instance_init
= scsi_dev_instance_init
,
1860 static void scsi_bus_class_init(ObjectClass
*klass
, void *data
)
1862 BusClass
*k
= BUS_CLASS(klass
);
1863 HotplugHandlerClass
*hc
= HOTPLUG_HANDLER_CLASS(klass
);
1865 k
->get_dev_path
= scsibus_get_dev_path
;
1866 k
->get_fw_dev_path
= scsibus_get_fw_dev_path
;
1867 k
->check_address
= scsi_bus_check_address
;
1868 hc
->unplug
= qdev_simple_device_unplug_cb
;
1871 static const TypeInfo scsi_bus_info
= {
1872 .name
= TYPE_SCSI_BUS
,
1874 .instance_size
= sizeof(SCSIBus
),
1875 .class_init
= scsi_bus_class_init
,
1876 .interfaces
= (InterfaceInfo
[]) {
1877 { TYPE_HOTPLUG_HANDLER
},
1882 static void scsi_register_types(void)
1884 type_register_static(&scsi_bus_info
);
1885 type_register_static(&scsi_device_type_info
);
1888 type_init(scsi_register_types
)