hw/scsi-bus.c

   1 #include "hw.h"
   2 #include "qemu-error.h"
   3 #include "scsi.h"
   4 #include "scsi-defs.h"
   5 #include "qdev.h"
   6 #include "blockdev.h"
   7 #include "trace.h"
   8 #include "dma.h"
   9
  10 static char *scsibus_get_fw_dev_path(DeviceState *dev);
  11 static int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf);
  12 static void scsi_req_dequeue(SCSIRequest *req);
  13
  14 static struct BusInfo scsi_bus_info = {
  15     .name  = "SCSI",
  16     .size  = sizeof(SCSIBus),
  17     .get_fw_dev_path = scsibus_get_fw_dev_path,
  18     .props = (Property[]) {
  19         DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0),
  20         DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1),
  21         DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1),
  22         DEFINE_PROP_END_OF_LIST(),
  23     },
  24 };
  25 static int next_scsi_bus;
  26
  27 static int scsi_device_init(SCSIDevice *s)
  28 {
  29     SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
  30     if (sc->init) {
  31         return sc->init(s);
  32     }
  33     return 0;
  34 }
  35
  36 static void scsi_device_destroy(SCSIDevice *s)
  37 {
  38     SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
  39     if (sc->destroy) {
  40         sc->destroy(s);
  41     }
  42 }
  43
  44 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun,
  45                                           uint8_t *buf, void *hba_private)
  46 {
  47     SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
  48     if (sc->alloc_req) {
  49         return sc->alloc_req(s, tag, lun, buf, hba_private);
  50     }
  51
  52     return NULL;
  53 }
  54
  55 static void scsi_device_unit_attention_reported(SCSIDevice *s)
  56 {
  57     SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
  58     if (sc->unit_attention_reported) {
  59         sc->unit_attention_reported(s);
  60     }
  61 }
  62
  63 /* Create a scsi bus, and attach devices to it.  */
  64 void scsi_bus_new(SCSIBus *bus, DeviceState *host, const SCSIBusInfo *info)
  65 {
  66     qbus_create_inplace(&bus->qbus, &scsi_bus_info, host, NULL);
  67     bus->busnr = next_scsi_bus++;
  68     bus->info = info;
  69     bus->qbus.allow_hotplug = 1;
  70 }
  71
  72 static void scsi_dma_restart_bh(void *opaque)
  73 {
  74     SCSIDevice *s = opaque;
  75     SCSIRequest *req, *next;
  76
  77     qemu_bh_delete(s->bh);
  78     s->bh = NULL;
  79
  80     QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
  81         scsi_req_ref(req);
  82         if (req->retry) {
  83             req->retry = false;
  84             switch (req->cmd.mode) {
  85             case SCSI_XFER_FROM_DEV:
  86             case SCSI_XFER_TO_DEV:
  87                 scsi_req_continue(req);
  88                 break;
  89             case SCSI_XFER_NONE:
  90                 assert(!req->sg);
  91                 scsi_req_dequeue(req);
  92                 scsi_req_enqueue(req);
  93                 break;
  94             }
  95         }
  96         scsi_req_unref(req);
  97     }
  98 }
  99
 100 void scsi_req_retry(SCSIRequest *req)
 101 {
 102     /* No need to save a reference, because scsi_dma_restart_bh just
 103      * looks at the request list.  */
 104     req->retry = true;
 105 }
 106
 107 static void scsi_dma_restart_cb(void *opaque, int running, RunState state)
 108 {
 109     SCSIDevice *s = opaque;
 110
 111     if (!running) {
 112         return;
 113     }
 114     if (!s->bh) {
 115         s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
 116         qemu_bh_schedule(s->bh);
 117     }
 118 }
 119
 120 static int scsi_qdev_init(DeviceState *qdev)
 121 {
 122     SCSIDevice *dev = SCSI_DEVICE(qdev);
 123     SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
 124     SCSIDevice *d;
 125     int rc = -1;
 126
 127     if (dev->channel > bus->info->max_channel) {
 128         error_report("bad scsi channel id: %d", dev->channel);
 129         goto err;
 130     }
 131     if (dev->id != -1 && dev->id > bus->info->max_target) {
 132         error_report("bad scsi device id: %d", dev->id);
 133         goto err;
 134     }
 135     if (dev->lun != -1 && dev->lun > bus->info->max_lun) {
 136         error_report("bad scsi device lun: %d", dev->lun);
 137         goto err;
 138     }
 139
 140     if (dev->id == -1) {
 141         int id = -1;
 142         if (dev->lun == -1) {
 143             dev->lun = 0;
 144         }
 145         do {
 146             d = scsi_device_find(bus, dev->channel, ++id, dev->lun);
 147         } while (d && d->lun == dev->lun && id < bus->info->max_target);
 148         if (d && d->lun == dev->lun) {
 149             error_report("no free target");
 150             goto err;
 151         }
 152         dev->id = id;
 153     } else if (dev->lun == -1) {
 154         int lun = -1;
 155         do {
 156             d = scsi_device_find(bus, dev->channel, dev->id, ++lun);
 157         } while (d && d->lun == lun && lun < bus->info->max_lun);
 158         if (d && d->lun == lun) {
 159             error_report("no free lun");
 160             goto err;
 161         }
 162         dev->lun = lun;
 163     } else {
 164         d = scsi_device_find(bus, dev->channel, dev->id, dev->lun);
 165         assert(d);
 166         if (d->lun == dev->lun && dev != d) {
 167             qdev_free(&d->qdev);
 168         }
 169     }
 170
 171     QTAILQ_INIT(&dev->requests);
 172     rc = scsi_device_init(dev);
 173     if (rc == 0) {
 174         dev->vmsentry = qemu_add_vm_change_state_handler(scsi_dma_restart_cb,
 175                                                          dev);
 176     }
 177
 178 err:
 179     return rc;
 180 }
 181
 182 static int scsi_qdev_exit(DeviceState *qdev)
 183 {
 184     SCSIDevice *dev = SCSI_DEVICE(qdev);
 185
 186     if (dev->vmsentry) {
 187         qemu_del_vm_change_state_handler(dev->vmsentry);
 188     }
 189     scsi_device_destroy(dev);
 190     return 0;
 191 }
 192
 193 /* handle legacy '-drive if=scsi,...' cmd line args */
 194 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
 195                                       int unit, bool removable, int bootindex)
 196 {
 197     const char *driver;
 198     DeviceState *dev;
 199
 200     driver = bdrv_is_sg(bdrv) ? "scsi-generic" : "scsi-disk";
 201     dev = qdev_create(&bus->qbus, driver);
 202     qdev_prop_set_uint32(dev, "scsi-id", unit);
 203     if (bootindex >= 0) {
 204         qdev_prop_set_int32(dev, "bootindex", bootindex);
 205     }
 206     if (qdev_prop_exists(dev, "removable")) {
 207         qdev_prop_set_bit(dev, "removable", removable);
 208     }
 209     if (qdev_prop_set_drive(dev, "drive", bdrv) < 0) {
 210         qdev_free(dev);
 211         return NULL;
 212     }
 213     if (qdev_init(dev) < 0)
 214         return NULL;
 215     return SCSI_DEVICE(dev);
 216 }
 217
 218 int scsi_bus_legacy_handle_cmdline(SCSIBus *bus)
 219 {
 220     Location loc;
 221     DriveInfo *dinfo;
 222     int res = 0, unit;
 223
 224     loc_push_none(&loc);
 225     for (unit = 0; unit <= bus->info->max_target; unit++) {
 226         dinfo = drive_get(IF_SCSI, bus->busnr, unit);
 227         if (dinfo == NULL) {
 228             continue;
 229         }
 230         qemu_opts_loc_restore(dinfo->opts);
 231         if (!scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit, false, -1)) {
 232             res = -1;
 233             break;
 234         }
 235     }
 236     loc_pop(&loc);
 237     return res;
 238 }
 239
 240 /* SCSIReqOps implementation for invalid commands.  */
 241
 242 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf)
 243 {
 244     scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE));
 245     scsi_req_complete(req, CHECK_CONDITION);
 246     return 0;
 247 }
 248
 249 static const struct SCSIReqOps reqops_invalid_opcode = {
 250     .size         = sizeof(SCSIRequest),
 251     .send_command = scsi_invalid_command
 252 };
 253
 254 /* SCSIReqOps implementation for unit attention conditions.  */
 255
 256 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
 257 {
 258     if (req->dev && req->dev->unit_attention.key == UNIT_ATTENTION) {
 259         scsi_req_build_sense(req, req->dev->unit_attention);
 260     } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
 261         scsi_req_build_sense(req, req->bus->unit_attention);
 262     }
 263     scsi_req_complete(req, CHECK_CONDITION);
 264     return 0;
 265 }
 266
 267 static const struct SCSIReqOps reqops_unit_attention = {
 268     .size         = sizeof(SCSIRequest),
 269     .send_command = scsi_unit_attention
 270 };
 271
 272 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to
 273    an invalid LUN.  */
 274
 275 typedef struct SCSITargetReq SCSITargetReq;
 276
 277 struct SCSITargetReq {
 278     SCSIRequest req;
 279     int len;
 280     uint8_t buf[2056];
 281 };
 282
 283 static void store_lun(uint8_t *outbuf, int lun)
 284 {
 285     if (lun < 256) {
 286         outbuf[1] = lun;
 287         return;
 288     }
 289     outbuf[1] = (lun & 255);
 290     outbuf[0] = (lun >> 8) | 0x40;
 291 }
 292
 293 static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
 294 {
 295     DeviceState *qdev;
 296     int i, len, n;
 297     int channel, id;
 298     bool found_lun0;
 299
 300     if (r->req.cmd.xfer < 16) {
 301         return false;
 302     }
 303     if (r->req.cmd.buf[2] > 2) {
 304         return false;
 305     }
 306     channel = r->req.dev->channel;
 307     id = r->req.dev->id;
 308     found_lun0 = false;
 309     n = 0;
 310     QTAILQ_FOREACH(qdev, &r->req.bus->qbus.children, sibling) {
 311         SCSIDevice *dev = SCSI_DEVICE(qdev);
 312
 313         if (dev->channel == channel && dev->id == id) {
 314             if (dev->lun == 0) {
 315                 found_lun0 = true;
 316             }
 317             n += 8;
 318         }
 319     }
 320     if (!found_lun0) {
 321         n += 8;
 322     }
 323     len = MIN(n + 8, r->req.cmd.xfer & ~7);
 324     if (len > sizeof(r->buf)) {
 325         /* TODO: > 256 LUNs? */
 326         return false;
 327     }
 328
 329     memset(r->buf, 0, len);
 330     stl_be_p(&r->buf, n);
 331     i = found_lun0 ? 8 : 16;
 332     QTAILQ_FOREACH(qdev, &r->req.bus->qbus.children, sibling) {
 333         SCSIDevice *dev = SCSI_DEVICE(qdev);
 334
 335         if (dev->channel == channel && dev->id == id) {
 336             store_lun(&r->buf[i], dev->lun);
 337             i += 8;
 338         }
 339     }
 340     assert(i == n + 8);
 341     r->len = len;
 342     return true;
 343 }
 344
 345 static bool scsi_target_emulate_inquiry(SCSITargetReq *r)
 346 {
 347     assert(r->req.dev->lun != r->req.lun);
 348     if (r->req.cmd.buf[1] & 0x2) {
 349         /* Command support data - optional, not implemented */
 350         return false;
 351     }
 352
 353     if (r->req.cmd.buf[1] & 0x1) {
 354         /* Vital product data */
 355         uint8_t page_code = r->req.cmd.buf[2];
 356         if (r->req.cmd.xfer < 4) {
 357             return false;
 358         }
 359
 360         r->buf[r->len++] = page_code ; /* this page */
 361         r->buf[r->len++] = 0x00;
 362
 363         switch (page_code) {
 364         case 0x00: /* Supported page codes, mandatory */
 365         {
 366             int pages;
 367             pages = r->len++;
 368             r->buf[r->len++] = 0x00; /* list of supported pages (this page) */
 369             r->buf[pages] = r->len - pages - 1; /* number of pages */
 370             break;
 371         }
 372         default:
 373             return false;
 374         }
 375         /* done with EVPD */
 376         assert(r->len < sizeof(r->buf));
 377         r->len = MIN(r->req.cmd.xfer, r->len);
 378         return true;
 379     }
 380
 381     /* Standard INQUIRY data */
 382     if (r->req.cmd.buf[2] != 0) {
 383         return false;
 384     }
 385
 386     /* PAGE CODE == 0 */
 387     if (r->req.cmd.xfer < 5) {
 388         return false;
 389     }
 390
 391     r->len = MIN(r->req.cmd.xfer, 36);
 392     memset(r->buf, 0, r->len);
 393     if (r->req.lun != 0) {
 394         r->buf[0] = TYPE_NO_LUN;
 395     } else {
 396         r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE;
 397         r->buf[2] = 5; /* Version */
 398         r->buf[3] = 2 | 0x10; /* HiSup, response data format */
 399         r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */
 400         r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ.  */
 401         memcpy(&r->buf[8], "QEMU    ", 8);
 402         memcpy(&r->buf[16], "QEMU TARGET     ", 16);
 403         strncpy((char *) &r->buf[32], QEMU_VERSION, 4);
 404     }
 405     return true;
 406 }
 407
 408 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf)
 409 {
 410     SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
 411
 412     switch (buf[0]) {
 413     case REPORT_LUNS:
 414         if (!scsi_target_emulate_report_luns(r)) {
 415             goto illegal_request;
 416         }
 417         break;
 418     case INQUIRY:
 419         if (!scsi_target_emulate_inquiry(r)) {
 420             goto illegal_request;
 421         }
 422         break;
 423     case REQUEST_SENSE:
 424         if (req->cmd.xfer < 4) {
 425             goto illegal_request;
 426         }
 427         r->len = scsi_device_get_sense(r->req.dev, r->buf,
 428                                        MIN(req->cmd.xfer, sizeof r->buf),
 429                                        (req->cmd.buf[1] & 1) == 0);
 430         if (r->req.dev->sense_is_ua) {
 431             scsi_device_unit_attention_reported(req->dev);
 432             r->req.dev->sense_len = 0;
 433             r->req.dev->sense_is_ua = false;
 434         }
 435         break;
 436     default:
 437         scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED));
 438         scsi_req_complete(req, CHECK_CONDITION);
 439         return 0;
 440     illegal_request:
 441         scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
 442         scsi_req_complete(req, CHECK_CONDITION);
 443         return 0;
 444     }
 445
 446     if (!r->len) {
 447         scsi_req_complete(req, GOOD);
 448     }
 449     return r->len;
 450 }
 451
 452 static void scsi_target_read_data(SCSIRequest *req)
 453 {
 454     SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
 455     uint32_t n;
 456
 457     n = r->len;
 458     if (n > 0) {
 459         r->len = 0;
 460         scsi_req_data(&r->req, n);
 461     } else {
 462         scsi_req_complete(&r->req, GOOD);
 463     }
 464 }
 465
 466 static uint8_t *scsi_target_get_buf(SCSIRequest *req)
 467 {
 468     SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
 469
 470     return r->buf;
 471 }
 472
 473 static const struct SCSIReqOps reqops_target_command = {
 474     .size         = sizeof(SCSITargetReq),
 475     .send_command = scsi_target_send_command,
 476     .read_data    = scsi_target_read_data,
 477     .get_buf      = scsi_target_get_buf,
 478 };
 479
 480
 481 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
 482                             uint32_t tag, uint32_t lun, void *hba_private)
 483 {
 484     SCSIRequest *req;
 485
 486     req = g_malloc0(reqops->size);
 487     req->refcount = 1;
 488     req->bus = scsi_bus_from_device(d);
 489     req->dev = d;
 490     req->tag = tag;
 491     req->lun = lun;
 492     req->hba_private = hba_private;
 493     req->status = -1;
 494     req->sense_len = 0;
 495     req->ops = reqops;
 496     trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
 497     return req;
 498 }
 499
 500 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,
 501                           uint8_t *buf, void *hba_private)
 502 {
 503     SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus);
 504     SCSIRequest *req;
 505     SCSICommand cmd;
 506
 507     if (scsi_req_parse(&cmd, d, buf) != 0) {
 508         trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]);
 509         req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private);
 510     } else {
 511         trace_scsi_req_parsed(d->id, lun, tag, buf[0],
 512                               cmd.mode, cmd.xfer);
 513         if (cmd.lba != -1) {
 514             trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0],
 515                                       cmd.lba);
 516         }
 517
 518         if ((d->unit_attention.key == UNIT_ATTENTION ||
 519              bus->unit_attention.key == UNIT_ATTENTION) &&
 520             (buf[0] != INQUIRY &&
 521              buf[0] != REPORT_LUNS &&
 522              buf[0] != GET_CONFIGURATION &&
 523              buf[0] != GET_EVENT_STATUS_NOTIFICATION &&
 524
 525              /*
 526               * If we already have a pending unit attention condition,
 527               * report this one before triggering another one.
 528               */
 529              !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) {
 530             req = scsi_req_alloc(&reqops_unit_attention, d, tag, lun,
 531                                  hba_private);
 532         } else if (lun != d->lun ||
 533             buf[0] == REPORT_LUNS ||
 534             (buf[0] == REQUEST_SENSE && (d->sense_len || cmd.xfer < 4))) {
 535             req = scsi_req_alloc(&reqops_target_command, d, tag, lun,
 536                                  hba_private);
 537         } else {
 538             req = scsi_device_alloc_req(d, tag, lun, buf, hba_private);
 539         }
 540     }
 541
 542     req->cmd = cmd;
 543     req->resid = req->cmd.xfer;
 544
 545     switch (buf[0]) {
 546     case INQUIRY:
 547         trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]);
 548         break;
 549     case TEST_UNIT_READY:
 550         trace_scsi_test_unit_ready(d->id, lun, tag);
 551         break;
 552     case REPORT_LUNS:
 553         trace_scsi_report_luns(d->id, lun, tag);
 554         break;
 555     case REQUEST_SENSE:
 556         trace_scsi_request_sense(d->id, lun, tag);
 557         break;
 558     default:
 559         break;
 560     }
 561
 562     return req;
 563 }
 564
 565 uint8_t *scsi_req_get_buf(SCSIRequest *req)
 566 {
 567     return req->ops->get_buf(req);
 568 }
 569
 570 static void scsi_clear_unit_attention(SCSIRequest *req)
 571 {
 572     SCSISense *ua;
 573     if (req->dev->unit_attention.key != UNIT_ATTENTION &&
 574         req->bus->unit_attention.key != UNIT_ATTENTION) {
 575         return;
 576     }
 577
 578     /*
 579      * If an INQUIRY command enters the enabled command state,
 580      * the device server shall [not] clear any unit attention condition;
 581      * See also MMC-6, paragraphs 6.5 and 6.6.2.
 582      */
 583     if (req->cmd.buf[0] == INQUIRY ||
 584         req->cmd.buf[0] == GET_CONFIGURATION ||
 585         req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) {
 586         return;
 587     }
 588
 589     if (req->dev->unit_attention.key == UNIT_ATTENTION) {
 590         ua = &req->dev->unit_attention;
 591     } else {
 592         ua = &req->bus->unit_attention;
 593     }
 594
 595     /*
 596      * If a REPORT LUNS command enters the enabled command state, [...]
 597      * the device server shall clear any pending unit attention condition
 598      * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
 599      */
 600     if (req->cmd.buf[0] == REPORT_LUNS &&
 601         !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
 602           ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) {
 603         return;
 604     }
 605
 606     *ua = SENSE_CODE(NO_SENSE);
 607 }
 608
 609 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len)
 610 {
 611     int ret;
 612
 613     assert(len >= 14);
 614     if (!req->sense_len) {
 615         return 0;
 616     }
 617
 618     ret = scsi_build_sense(req->sense, req->sense_len, buf, len, true);
 619
 620     /*
 621      * FIXME: clearing unit attention conditions upon autosense should be done
 622      * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
 623      * (SAM-5, 5.14).
 624      *
 625      * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
 626      * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
 627      * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
 628      */
 629     if (req->dev->sense_is_ua) {
 630         scsi_device_unit_attention_reported(req->dev);
 631         req->dev->sense_len = 0;
 632         req->dev->sense_is_ua = false;
 633     }
 634     return ret;
 635 }
 636
 637 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed)
 638 {
 639     return scsi_build_sense(dev->sense, dev->sense_len, buf, len, fixed);
 640 }
 641
 642 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense)
 643 {
 644     trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag,
 645                                sense.key, sense.asc, sense.ascq);
 646     memset(req->sense, 0, 18);
 647     req->sense[0] = 0xf0;
 648     req->sense[2] = sense.key;
 649     req->sense[7] = 10;
 650     req->sense[12] = sense.asc;
 651     req->sense[13] = sense.ascq;
 652     req->sense_len = 18;
 653 }
 654
 655 static void scsi_req_enqueue_internal(SCSIRequest *req)
 656 {
 657     assert(!req->enqueued);
 658     scsi_req_ref(req);
 659     if (req->bus->info->get_sg_list) {
 660         req->sg = req->bus->info->get_sg_list(req);
 661     } else {
 662         req->sg = NULL;
 663     }
 664     req->enqueued = true;
 665     QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
 666 }
 667
 668 int32_t scsi_req_enqueue(SCSIRequest *req)
 669 {
 670     int32_t rc;
 671
 672     assert(!req->retry);
 673     scsi_req_enqueue_internal(req);
 674     scsi_req_ref(req);
 675     rc = req->ops->send_command(req, req->cmd.buf);
 676     scsi_req_unref(req);
 677     return rc;
 678 }
 679
 680 static void scsi_req_dequeue(SCSIRequest *req)
 681 {
 682     trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
 683     req->retry = false;
 684     if (req->enqueued) {
 685         QTAILQ_REMOVE(&req->dev->requests, req, next);
 686         req->enqueued = false;
 687         scsi_req_unref(req);
 688     }
 689 }
 690
 691 static int scsi_get_performance_length(int num_desc, int type, int data_type)
 692 {
 693     /* MMC-6, paragraph 6.7.  */
 694     switch (type) {
 695     case 0:
 696         if ((data_type & 3) == 0) {
 697             /* Each descriptor is as in Table 295 - Nominal performance.  */
 698             return 16 * num_desc + 8;
 699         } else {
 700             /* Each descriptor is as in Table 296 - Exceptions.  */
 701             return 6 * num_desc + 8;
 702         }
 703     case 1:
 704     case 4:
 705     case 5:
 706         return 8 * num_desc + 8;
 707     case 2:
 708         return 2048 * num_desc + 8;
 709     case 3:
 710         return 16 * num_desc + 8;
 711     default:
 712         return 8;
 713     }
 714 }
 715
 716 static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
 717 {
 718     switch (buf[0] >> 5) {
 719     case 0:
 720         cmd->xfer = buf[4];
 721         cmd->len = 6;
 722         /* length 0 means 256 blocks */
 723         if (cmd->xfer == 0) {
 724             cmd->xfer = 256;
 725         }
 726         break;
 727     case 1:
 728     case 2:
 729         cmd->xfer = lduw_be_p(&buf[7]);
 730         cmd->len = 10;
 731         break;
 732     case 4:
 733         cmd->xfer = ldl_be_p(&buf[10]) & 0xffffffffULL;
 734         cmd->len = 16;
 735         break;
 736     case 5:
 737         cmd->xfer = ldl_be_p(&buf[6]) & 0xffffffffULL;
 738         cmd->len = 12;
 739         break;
 740     default:
 741         return -1;
 742     }
 743
 744     switch (buf[0]) {
 745     case TEST_UNIT_READY:
 746     case REWIND:
 747     case START_STOP:
 748     case SET_CAPACITY:
 749     case WRITE_FILEMARKS:
 750     case WRITE_FILEMARKS_16:
 751     case SPACE:
 752     case RESERVE:
 753     case RELEASE:
 754     case ERASE:
 755     case ALLOW_MEDIUM_REMOVAL:
 756     case VERIFY_10:
 757     case SEEK_10:
 758     case SYNCHRONIZE_CACHE:
 759     case SYNCHRONIZE_CACHE_16:
 760     case LOCATE_16:
 761     case LOCK_UNLOCK_CACHE:
 762     case LOAD_UNLOAD:
 763     case SET_CD_SPEED:
 764     case SET_LIMITS:
 765     case WRITE_LONG_10:
 766     case MOVE_MEDIUM:
 767     case UPDATE_BLOCK:
 768     case RESERVE_TRACK:
 769     case SET_READ_AHEAD:
 770     case PRE_FETCH:
 771     case PRE_FETCH_16:
 772     case ALLOW_OVERWRITE:
 773         cmd->xfer = 0;
 774         break;
 775     case MODE_SENSE:
 776         break;
 777     case WRITE_SAME_10:
 778         cmd->xfer = 1;
 779         break;
 780     case READ_CAPACITY_10:
 781         cmd->xfer = 8;
 782         break;
 783     case READ_BLOCK_LIMITS:
 784         cmd->xfer = 6;
 785         break;
 786     case SEND_VOLUME_TAG:
 787         /* GPCMD_SET_STREAMING from multimedia commands.  */
 788         if (dev->type == TYPE_ROM) {
 789             cmd->xfer = buf[10] | (buf[9] << 8);
 790         } else {
 791             cmd->xfer = buf[9] | (buf[8] << 8);
 792         }
 793         break;
 794     case WRITE_10:
 795     case WRITE_VERIFY_10:
 796     case WRITE_6:
 797     case WRITE_12:
 798     case WRITE_VERIFY_12:
 799     case WRITE_16:
 800     case WRITE_VERIFY_16:
 801         cmd->xfer *= dev->blocksize;
 802         break;
 803     case READ_10:
 804     case READ_6:
 805     case READ_REVERSE:
 806     case RECOVER_BUFFERED_DATA:
 807     case READ_12:
 808     case READ_16:
 809         cmd->xfer *= dev->blocksize;
 810         break;
 811     case FORMAT_UNIT:
 812         /* MMC mandates the parameter list to be 12-bytes long.  Parameters
 813          * for block devices are restricted to the header right now.  */
 814         if (dev->type == TYPE_ROM && (buf[1] & 16)) {
 815             cmd->xfer = 12;
 816         } else {
 817             cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4);
 818         }
 819         break;
 820     case INQUIRY:
 821     case RECEIVE_DIAGNOSTIC:
 822     case SEND_DIAGNOSTIC:
 823         cmd->xfer = buf[4] | (buf[3] << 8);
 824         break;
 825     case READ_CD:
 826     case READ_BUFFER:
 827     case WRITE_BUFFER:
 828     case SEND_CUE_SHEET:
 829         cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16);
 830         break;
 831     case PERSISTENT_RESERVE_OUT:
 832         cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL;
 833         break;
 834     case ERASE_12:
 835         if (dev->type == TYPE_ROM) {
 836             /* MMC command GET PERFORMANCE.  */
 837             cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8),
 838                                                     buf[10], buf[1] & 0x1f);
 839         }
 840         break;
 841     case MECHANISM_STATUS:
 842     case READ_DVD_STRUCTURE:
 843     case SEND_DVD_STRUCTURE:
 844     case MAINTENANCE_OUT:
 845     case MAINTENANCE_IN:
 846         if (dev->type == TYPE_ROM) {
 847             /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
 848             cmd->xfer = buf[9] | (buf[8] << 8);
 849         }
 850         break;
 851     }
 852     return 0;
 853 }
 854
 855 static int scsi_req_stream_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
 856 {
 857     switch (buf[0]) {
 858     /* stream commands */
 859     case ERASE_12:
 860     case ERASE_16:
 861         cmd->xfer = 0;
 862         break;
 863     case READ_6:
 864     case READ_REVERSE:
 865     case RECOVER_BUFFERED_DATA:
 866     case WRITE_6:
 867         cmd->len = 6;
 868         cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16);
 869         if (buf[1] & 0x01) { /* fixed */
 870             cmd->xfer *= dev->blocksize;
 871         }
 872         break;
 873     case REWIND:
 874     case START_STOP:
 875         cmd->len = 6;
 876         cmd->xfer = 0;
 877         break;
 878     case SPACE_16:
 879         cmd->xfer = buf[13] | (buf[12] << 8);
 880         break;
 881     case READ_POSITION:
 882         cmd->xfer = buf[8] | (buf[7] << 8);
 883         break;
 884     case FORMAT_UNIT:
 885         cmd->xfer = buf[4] | (buf[3] << 8);
 886         break;
 887     /* generic commands */
 888     default:
 889         return scsi_req_length(cmd, dev, buf);
 890     }
 891     return 0;
 892 }
 893
 894 static void scsi_cmd_xfer_mode(SCSICommand *cmd)
 895 {
 896     switch (cmd->buf[0]) {
 897     case WRITE_6:
 898     case WRITE_10:
 899     case WRITE_VERIFY_10:
 900     case WRITE_12:
 901     case WRITE_VERIFY_12:
 902     case WRITE_16:
 903     case WRITE_VERIFY_16:
 904     case COPY:
 905     case COPY_VERIFY:
 906     case COMPARE:
 907     case CHANGE_DEFINITION:
 908     case LOG_SELECT:
 909     case MODE_SELECT:
 910     case MODE_SELECT_10:
 911     case SEND_DIAGNOSTIC:
 912     case WRITE_BUFFER:
 913     case FORMAT_UNIT:
 914     case REASSIGN_BLOCKS:
 915     case SEARCH_EQUAL:
 916     case SEARCH_HIGH:
 917     case SEARCH_LOW:
 918     case UPDATE_BLOCK:
 919     case WRITE_LONG_10:
 920     case WRITE_SAME_10:
 921     case SEARCH_HIGH_12:
 922     case SEARCH_EQUAL_12:
 923     case SEARCH_LOW_12:
 924     case MEDIUM_SCAN:
 925     case SEND_VOLUME_TAG:
 926     case SEND_CUE_SHEET:
 927     case SEND_DVD_STRUCTURE:
 928     case PERSISTENT_RESERVE_OUT:
 929     case MAINTENANCE_OUT:
 930         cmd->mode = SCSI_XFER_TO_DEV;
 931         break;
 932     default:
 933         if (cmd->xfer)
 934             cmd->mode = SCSI_XFER_FROM_DEV;
 935         else {
 936             cmd->mode = SCSI_XFER_NONE;
 937         }
 938         break;
 939     }
 940 }
 941
 942 static uint64_t scsi_cmd_lba(SCSICommand *cmd)
 943 {
 944     uint8_t *buf = cmd->buf;
 945     uint64_t lba;
 946
 947     switch (buf[0] >> 5) {
 948     case 0:
 949         lba = ldl_be_p(&buf[0]) & 0x1fffff;
 950         break;
 951     case 1:
 952     case 2:
 953     case 5:
 954         lba = ldl_be_p(&buf[2]) & 0xffffffffULL;
 955         break;
 956     case 4:
 957         lba = ldq_be_p(&buf[2]);
 958         break;
 959     default:
 960         lba = -1;
 961
 962     }
 963     return lba;
 964 }
 965
 966 int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
 967 {
 968     int rc;
 969
 970     if (dev->type == TYPE_TAPE) {
 971         rc = scsi_req_stream_length(cmd, dev, buf);
 972     } else {
 973         rc = scsi_req_length(cmd, dev, buf);
 974     }
 975     if (rc != 0)
 976         return rc;
 977
 978     memcpy(cmd->buf, buf, cmd->len);
 979     scsi_cmd_xfer_mode(cmd);
 980     cmd->lba = scsi_cmd_lba(cmd);
 981     return 0;
 982 }
 983
 984 /*
 985  * Predefined sense codes
 986  */
 987
 988 /* No sense data available */
 989 const struct SCSISense sense_code_NO_SENSE = {
 990     .key = NO_SENSE , .asc = 0x00 , .ascq = 0x00
 991 };
 992
 993 /* LUN not ready, Manual intervention required */
 994 const struct SCSISense sense_code_LUN_NOT_READY = {
 995     .key = NOT_READY, .asc = 0x04, .ascq = 0x03
 996 };
 997
 998 /* LUN not ready, Medium not present */
 999 const struct SCSISense sense_code_NO_MEDIUM = {
1000     .key = NOT_READY, .asc = 0x3a, .ascq = 0x00
1001 };
1002
1003 /* LUN not ready, medium removal prevented */
1004 const struct SCSISense sense_code_NOT_READY_REMOVAL_PREVENTED = {
1005     .key = NOT_READY, .asc = 0x53, .ascq = 0x00
1006 };
1007
1008 /* Hardware error, internal target failure */
1009 const struct SCSISense sense_code_TARGET_FAILURE = {
1010     .key = HARDWARE_ERROR, .asc = 0x44, .ascq = 0x00
1011 };
1012
1013 /* Illegal request, invalid command operation code */
1014 const struct SCSISense sense_code_INVALID_OPCODE = {
1015     .key = ILLEGAL_REQUEST, .asc = 0x20, .ascq = 0x00
1016 };
1017
1018 /* Illegal request, LBA out of range */
1019 const struct SCSISense sense_code_LBA_OUT_OF_RANGE = {
1020     .key = ILLEGAL_REQUEST, .asc = 0x21, .ascq = 0x00
1021 };
1022
1023 /* Illegal request, Invalid field in CDB */
1024 const struct SCSISense sense_code_INVALID_FIELD = {
1025     .key = ILLEGAL_REQUEST, .asc = 0x24, .ascq = 0x00
1026 };
1027
1028 /* Illegal request, LUN not supported */
1029 const struct SCSISense sense_code_LUN_NOT_SUPPORTED = {
1030     .key = ILLEGAL_REQUEST, .asc = 0x25, .ascq = 0x00
1031 };
1032
1033 /* Illegal request, Saving parameters not supported */
1034 const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED = {
1035     .key = ILLEGAL_REQUEST, .asc = 0x39, .ascq = 0x00
1036 };
1037
1038 /* Illegal request, Incompatible medium installed */
1039 const struct SCSISense sense_code_INCOMPATIBLE_FORMAT = {
1040     .key = ILLEGAL_REQUEST, .asc = 0x30, .ascq = 0x00
1041 };
1042
1043 /* Illegal request, medium removal prevented */
1044 const struct SCSISense sense_code_ILLEGAL_REQ_REMOVAL_PREVENTED = {
1045     .key = ILLEGAL_REQUEST, .asc = 0x53, .ascq = 0x00
1046 };
1047
1048 /* Command aborted, I/O process terminated */
1049 const struct SCSISense sense_code_IO_ERROR = {
1050     .key = ABORTED_COMMAND, .asc = 0x00, .ascq = 0x06
1051 };
1052
1053 /* Command aborted, I_T Nexus loss occurred */
1054 const struct SCSISense sense_code_I_T_NEXUS_LOSS = {
1055     .key = ABORTED_COMMAND, .asc = 0x29, .ascq = 0x07
1056 };
1057
1058 /* Command aborted, Logical Unit failure */
1059 const struct SCSISense sense_code_LUN_FAILURE = {
1060     .key = ABORTED_COMMAND, .asc = 0x3e, .ascq = 0x01
1061 };
1062
1063 /* Unit attention, Power on, reset or bus device reset occurred */
1064 const struct SCSISense sense_code_RESET = {
1065     .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x00
1066 };
1067
1068 /* Unit attention, No medium */
1069 const struct SCSISense sense_code_UNIT_ATTENTION_NO_MEDIUM = {
1070     .key = UNIT_ATTENTION, .asc = 0x3a, .ascq = 0x00
1071 };
1072
1073 /* Unit attention, Medium may have changed */
1074 const struct SCSISense sense_code_MEDIUM_CHANGED = {
1075     .key = UNIT_ATTENTION, .asc = 0x28, .ascq = 0x00
1076 };
1077
1078 /* Unit attention, Reported LUNs data has changed */
1079 const struct SCSISense sense_code_REPORTED_LUNS_CHANGED = {
1080     .key = UNIT_ATTENTION, .asc = 0x3f, .ascq = 0x0e
1081 };
1082
1083 /* Unit attention, Device internal reset */
1084 const struct SCSISense sense_code_DEVICE_INTERNAL_RESET = {
1085     .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x04
1086 };
1087
1088 /*
1089  * scsi_build_sense
1090  *
1091  * Convert between fixed and descriptor sense buffers
1092  */
1093 int scsi_build_sense(uint8_t *in_buf, int in_len,
1094                      uint8_t *buf, int len, bool fixed)
1095 {
1096     bool fixed_in;
1097     SCSISense sense;
1098     if (!fixed && len < 8) {
1099         return 0;
1100     }
1101
1102     if (in_len == 0) {
1103         sense.key = NO_SENSE;
1104         sense.asc = 0;
1105         sense.ascq = 0;
1106     } else {
1107         fixed_in = (in_buf[0] & 2) == 0;
1108
1109         if (fixed == fixed_in) {
1110             memcpy(buf, in_buf, MIN(len, in_len));
1111             return MIN(len, in_len);
1112         }
1113
1114         if (fixed_in) {
1115             sense.key = in_buf[2];
1116             sense.asc = in_buf[12];
1117             sense.ascq = in_buf[13];
1118         } else {
1119             sense.key = in_buf[1];
1120             sense.asc = in_buf[2];
1121             sense.ascq = in_buf[3];
1122         }
1123     }
1124
1125     memset(buf, 0, len);
1126     if (fixed) {
1127         /* Return fixed format sense buffer */
1128         buf[0] = 0xf0;
1129         buf[2] = sense.key;
1130         buf[7] = 10;
1131         buf[12] = sense.asc;
1132         buf[13] = sense.ascq;
1133         return MIN(len, 18);
1134     } else {
1135         /* Return descriptor format sense buffer */
1136         buf[0] = 0x72;
1137         buf[1] = sense.key;
1138         buf[2] = sense.asc;
1139         buf[3] = sense.ascq;
1140         return 8;
1141     }
1142 }
1143
1144 static const char *scsi_command_name(uint8_t cmd)
1145 {
1146     static const char *names[] = {
1147         [ TEST_UNIT_READY          ] = "TEST_UNIT_READY",
1148         [ REWIND                   ] = "REWIND",
1149         [ REQUEST_SENSE            ] = "REQUEST_SENSE",
1150         [ FORMAT_UNIT              ] = "FORMAT_UNIT",
1151         [ READ_BLOCK_LIMITS        ] = "READ_BLOCK_LIMITS",
1152         [ REASSIGN_BLOCKS          ] = "REASSIGN_BLOCKS",
1153         [ READ_6                   ] = "READ_6",
1154         [ WRITE_6                  ] = "WRITE_6",
1155         [ SET_CAPACITY             ] = "SET_CAPACITY",
1156         [ READ_REVERSE             ] = "READ_REVERSE",
1157         [ WRITE_FILEMARKS          ] = "WRITE_FILEMARKS",
1158         [ SPACE                    ] = "SPACE",
1159         [ INQUIRY                  ] = "INQUIRY",
1160         [ RECOVER_BUFFERED_DATA    ] = "RECOVER_BUFFERED_DATA",
1161         [ MAINTENANCE_IN           ] = "MAINTENANCE_IN",
1162         [ MAINTENANCE_OUT          ] = "MAINTENANCE_OUT",
1163         [ MODE_SELECT              ] = "MODE_SELECT",
1164         [ RESERVE                  ] = "RESERVE",
1165         [ RELEASE                  ] = "RELEASE",
1166         [ COPY                     ] = "COPY",
1167         [ ERASE                    ] = "ERASE",
1168         [ MODE_SENSE               ] = "MODE_SENSE",
1169         [ START_STOP               ] = "START_STOP",
1170         [ RECEIVE_DIAGNOSTIC       ] = "RECEIVE_DIAGNOSTIC",
1171         [ SEND_DIAGNOSTIC          ] = "SEND_DIAGNOSTIC",
1172         [ ALLOW_MEDIUM_REMOVAL     ] = "ALLOW_MEDIUM_REMOVAL",
1173         [ READ_CAPACITY_10         ] = "READ_CAPACITY_10",
1174         [ READ_10                  ] = "READ_10",
1175         [ WRITE_10                 ] = "WRITE_10",
1176         [ SEEK_10                  ] = "SEEK_10",
1177         [ WRITE_VERIFY_10          ] = "WRITE_VERIFY_10",
1178         [ VERIFY_10                ] = "VERIFY_10",
1179         [ SEARCH_HIGH              ] = "SEARCH_HIGH",
1180         [ SEARCH_EQUAL             ] = "SEARCH_EQUAL",
1181         [ SEARCH_LOW               ] = "SEARCH_LOW",
1182         [ SET_LIMITS               ] = "SET_LIMITS",
1183         [ PRE_FETCH                ] = "PRE_FETCH/READ_POSITION",
1184         /* READ_POSITION and PRE_FETCH use the same operation code */
1185         [ SYNCHRONIZE_CACHE        ] = "SYNCHRONIZE_CACHE",
1186         [ LOCK_UNLOCK_CACHE        ] = "LOCK_UNLOCK_CACHE",
1187         [ READ_DEFECT_DATA         ] = "READ_DEFECT_DATA",
1188         [ MEDIUM_SCAN              ] = "MEDIUM_SCAN",
1189         [ COMPARE                  ] = "COMPARE",
1190         [ COPY_VERIFY              ] = "COPY_VERIFY",
1191         [ WRITE_BUFFER             ] = "WRITE_BUFFER",
1192         [ READ_BUFFER              ] = "READ_BUFFER",
1193         [ UPDATE_BLOCK             ] = "UPDATE_BLOCK",
1194         [ READ_LONG_10             ] = "READ_LONG_10",
1195         [ WRITE_LONG_10            ] = "WRITE_LONG_10",
1196         [ CHANGE_DEFINITION        ] = "CHANGE_DEFINITION",
1197         [ WRITE_SAME_10            ] = "WRITE_SAME_10",
1198         [ UNMAP                    ] = "UNMAP",
1199         [ READ_TOC                 ] = "READ_TOC",
1200         [ REPORT_DENSITY_SUPPORT   ] = "REPORT_DENSITY_SUPPORT",
1201         [ GET_CONFIGURATION        ] = "GET_CONFIGURATION",
1202         [ LOG_SELECT               ] = "LOG_SELECT",
1203         [ LOG_SENSE                ] = "LOG_SENSE",
1204         [ MODE_SELECT_10           ] = "MODE_SELECT_10",
1205         [ RESERVE_10               ] = "RESERVE_10",
1206         [ RELEASE_10               ] = "RELEASE_10",
1207         [ MODE_SENSE_10            ] = "MODE_SENSE_10",
1208         [ PERSISTENT_RESERVE_IN    ] = "PERSISTENT_RESERVE_IN",
1209         [ PERSISTENT_RESERVE_OUT   ] = "PERSISTENT_RESERVE_OUT",
1210         [ WRITE_FILEMARKS_16       ] = "WRITE_FILEMARKS_16",
1211         [ EXTENDED_COPY            ] = "EXTENDED_COPY",
1212         [ ATA_PASSTHROUGH          ] = "ATA_PASSTHROUGH",
1213         [ ACCESS_CONTROL_IN        ] = "ACCESS_CONTROL_IN",
1214         [ ACCESS_CONTROL_OUT       ] = "ACCESS_CONTROL_OUT",
1215         [ READ_16                  ] = "READ_16",
1216         [ COMPARE_AND_WRITE        ] = "COMPARE_AND_WRITE",
1217         [ WRITE_16                 ] = "WRITE_16",
1218         [ WRITE_VERIFY_16          ] = "WRITE_VERIFY_16",
1219         [ VERIFY_16                ] = "VERIFY_16",
1220         [ PRE_FETCH_16             ] = "PRE_FETCH_16",
1221         [ SYNCHRONIZE_CACHE_16     ] = "SPACE_16/SYNCHRONIZE_CACHE_16",
1222         /* SPACE_16 and SYNCHRONIZE_CACHE_16 use the same operation code */
1223         [ LOCATE_16                ] = "LOCATE_16",
1224         [ WRITE_SAME_16            ] = "ERASE_16/WRITE_SAME_16",
1225         /* ERASE_16 and WRITE_SAME_16 use the same operation code */
1226         [ SERVICE_ACTION_IN_16     ] = "SERVICE_ACTION_IN_16",
1227         [ WRITE_LONG_16            ] = "WRITE_LONG_16",
1228         [ REPORT_LUNS              ] = "REPORT_LUNS",
1229         [ BLANK                    ] = "BLANK",
1230         [ MOVE_MEDIUM              ] = "MOVE_MEDIUM",
1231         [ LOAD_UNLOAD              ] = "LOAD_UNLOAD",
1232         [ READ_12                  ] = "READ_12",
1233         [ WRITE_12                 ] = "WRITE_12",
1234         [ ERASE_12                 ] = "ERASE_12/GET_PERFORMANCE",
1235         /* ERASE_12 and GET_PERFORMANCE use the same operation code */
1236         [ SERVICE_ACTION_IN_12     ] = "SERVICE_ACTION_IN_12",
1237         [ WRITE_VERIFY_12          ] = "WRITE_VERIFY_12",
1238         [ VERIFY_12                ] = "VERIFY_12",
1239         [ SEARCH_HIGH_12           ] = "SEARCH_HIGH_12",
1240         [ SEARCH_EQUAL_12          ] = "SEARCH_EQUAL_12",
1241         [ SEARCH_LOW_12            ] = "SEARCH_LOW_12",
1242         [ READ_ELEMENT_STATUS      ] = "READ_ELEMENT_STATUS",
1243         [ SEND_VOLUME_TAG          ] = "SEND_VOLUME_TAG/SET_STREAMING",
1244         /* SEND_VOLUME_TAG and SET_STREAMING use the same operation code */
1245         [ READ_CD                  ] = "READ_CD",
1246         [ READ_DEFECT_DATA_12      ] = "READ_DEFECT_DATA_12",
1247         [ READ_DVD_STRUCTURE       ] = "READ_DVD_STRUCTURE",
1248         [ RESERVE_TRACK            ] = "RESERVE_TRACK",
1249         [ SEND_CUE_SHEET           ] = "SEND_CUE_SHEET",
1250         [ SEND_DVD_STRUCTURE       ] = "SEND_DVD_STRUCTURE",
1251         [ SET_CD_SPEED             ] = "SET_CD_SPEED",
1252         [ SET_READ_AHEAD           ] = "SET_READ_AHEAD",
1253         [ ALLOW_OVERWRITE          ] = "ALLOW_OVERWRITE",
1254         [ MECHANISM_STATUS         ] = "MECHANISM_STATUS",
1255     };
1256
1257     if (cmd >= ARRAY_SIZE(names) || names[cmd] == NULL)
1258         return "*UNKNOWN*";
1259     return names[cmd];
1260 }
1261
1262 SCSIRequest *scsi_req_ref(SCSIRequest *req)
1263 {
1264     req->refcount++;
1265     return req;
1266 }
1267
1268 void scsi_req_unref(SCSIRequest *req)
1269 {
1270     if (--req->refcount == 0) {
1271         if (req->ops->free_req) {
1272             req->ops->free_req(req);
1273         }
1274         g_free(req);
1275     }
1276 }
1277
1278 /* Tell the device that we finished processing this chunk of I/O.  It
1279    will start the next chunk or complete the command.  */
1280 void scsi_req_continue(SCSIRequest *req)
1281 {
1282     trace_scsi_req_continue(req->dev->id, req->lun, req->tag);
1283     if (req->cmd.mode == SCSI_XFER_TO_DEV) {
1284         req->ops->write_data(req);
1285     } else {
1286         req->ops->read_data(req);
1287     }
1288 }
1289
1290 /* Called by the devices when data is ready for the HBA.  The HBA should
1291    start a DMA operation to read or fill the device's data buffer.
1292    Once it completes, calling scsi_req_continue will restart I/O.  */
1293 void scsi_req_data(SCSIRequest *req, int len)
1294 {
1295     uint8_t *buf;
1296     if (req->io_canceled) {
1297         trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len);
1298         return;
1299     }
1300     trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);
1301     assert(req->cmd.mode != SCSI_XFER_NONE);
1302     if (!req->sg) {
1303         req->resid -= len;
1304         req->bus->info->transfer_data(req, len);
1305         return;
1306     }
1307
1308     /* If the device calls scsi_req_data and the HBA specified a
1309      * scatter/gather list, the transfer has to happen in a single
1310      * step.  */
1311     assert(!req->dma_started);
1312     req->dma_started = true;
1313
1314     buf = scsi_req_get_buf(req);
1315     if (req->cmd.mode == SCSI_XFER_FROM_DEV) {
1316         req->resid = dma_buf_read(buf, len, req->sg);
1317     } else {
1318         req->resid = dma_buf_write(buf, len, req->sg);
1319     }
1320     scsi_req_continue(req);
1321 }
1322
1323 void scsi_req_print(SCSIRequest *req)
1324 {
1325     FILE *fp = stderr;
1326     int i;
1327
1328     fprintf(fp, "[%s id=%d] %s",
1329             req->dev->qdev.parent_bus->name,
1330             req->dev->id,
1331             scsi_command_name(req->cmd.buf[0]));
1332     for (i = 1; i < req->cmd.len; i++) {
1333         fprintf(fp, " 0x%02x", req->cmd.buf[i]);
1334     }
1335     switch (req->cmd.mode) {
1336     case SCSI_XFER_NONE:
1337         fprintf(fp, " - none\n");
1338         break;
1339     case SCSI_XFER_FROM_DEV:
1340         fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer);
1341         break;
1342     case SCSI_XFER_TO_DEV:
1343         fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer);
1344         break;
1345     default:
1346         fprintf(fp, " - Oops\n");
1347         break;
1348     }
1349 }
1350
1351 void scsi_req_complete(SCSIRequest *req, int status)
1352 {
1353     assert(req->status == -1);
1354     req->status = status;
1355
1356     assert(req->sense_len < sizeof(req->sense));
1357     if (status == GOOD) {
1358         req->sense_len = 0;
1359     }
1360
1361     if (req->sense_len) {
1362         memcpy(req->dev->sense, req->sense, req->sense_len);
1363         req->dev->sense_len = req->sense_len;
1364         req->dev->sense_is_ua = (req->ops == &reqops_unit_attention);
1365     } else {
1366         req->dev->sense_len = 0;
1367         req->dev->sense_is_ua = false;
1368     }
1369
1370     /*
1371      * Unit attention state is now stored in the device's sense buffer
1372      * if the HBA didn't do autosense.  Clear the pending unit attention
1373      * flags.
1374      */
1375     scsi_clear_unit_attention(req);
1376
1377     scsi_req_ref(req);
1378     scsi_req_dequeue(req);
1379     req->bus->info->complete(req, req->status, req->resid);
1380     scsi_req_unref(req);
1381 }
1382
1383 void scsi_req_cancel(SCSIRequest *req)
1384 {
1385     if (!req->enqueued) {
1386         return;
1387     }
1388     scsi_req_ref(req);
1389     scsi_req_dequeue(req);
1390     req->io_canceled = true;
1391     if (req->ops->cancel_io) {
1392         req->ops->cancel_io(req);
1393     }
1394     if (req->bus->info->cancel) {
1395         req->bus->info->cancel(req);
1396     }
1397     scsi_req_unref(req);
1398 }
1399
1400 void scsi_req_abort(SCSIRequest *req, int status)
1401 {
1402     if (!req->enqueued) {
1403         return;
1404     }
1405     scsi_req_ref(req);
1406     scsi_req_dequeue(req);
1407     req->io_canceled = true;
1408     if (req->ops->cancel_io) {
1409         req->ops->cancel_io(req);
1410     }
1411     scsi_req_complete(req, status);
1412     scsi_req_unref(req);
1413 }
1414
1415 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
1416 {
1417     SCSIRequest *req;
1418
1419     while (!QTAILQ_EMPTY(&sdev->requests)) {
1420         req = QTAILQ_FIRST(&sdev->requests);
1421         scsi_req_cancel(req);
1422     }
1423     sdev->unit_attention = sense;
1424 }
1425
1426 static char *scsibus_get_fw_dev_path(DeviceState *dev)
1427 {
1428     SCSIDevice *d = SCSI_DEVICE(dev);
1429     char path[100];
1430
1431     snprintf(path, sizeof(path), "channel@%x/%s@%x,%x", d->channel,
1432              qdev_fw_name(dev), d->id, d->lun);
1433
1434     return strdup(path);
1435 }
1436
1437 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
1438 {
1439     DeviceState *qdev;
1440     SCSIDevice *target_dev = NULL;
1441
1442     QTAILQ_FOREACH_REVERSE(qdev, &bus->qbus.children, ChildrenHead, sibling) {
1443         SCSIDevice *dev = SCSI_DEVICE(qdev);
1444
1445         if (dev->channel == channel && dev->id == id) {
1446             if (dev->lun == lun) {
1447                 return dev;
1448             }
1449             target_dev = dev;
1450         }
1451     }
1452     return target_dev;
1453 }
1454
1455 /* SCSI request list.  For simplicity, pv points to the whole device */
1456
1457 static void put_scsi_requests(QEMUFile *f, void *pv, size_t size)
1458 {
1459     SCSIDevice *s = pv;
1460     SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
1461     SCSIRequest *req;
1462
1463     QTAILQ_FOREACH(req, &s->requests, next) {
1464         assert(!req->io_canceled);
1465         assert(req->status == -1);
1466         assert(req->retry);
1467         assert(req->enqueued);
1468
1469         qemu_put_sbyte(f, 1);
1470         qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf));
1471         qemu_put_be32s(f, &req->tag);
1472         qemu_put_be32s(f, &req->lun);
1473         if (bus->info->save_request) {
1474             bus->info->save_request(f, req);
1475         }
1476         if (req->ops->save_request) {
1477             req->ops->save_request(f, req);
1478         }
1479     }
1480     qemu_put_sbyte(f, 0);
1481 }
1482
1483 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size)
1484 {
1485     SCSIDevice *s = pv;
1486     SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
1487
1488     while (qemu_get_sbyte(f)) {
1489         uint8_t buf[SCSI_CMD_BUF_SIZE];
1490         uint32_t tag;
1491         uint32_t lun;
1492         SCSIRequest *req;
1493
1494         qemu_get_buffer(f, buf, sizeof(buf));
1495         qemu_get_be32s(f, &tag);
1496         qemu_get_be32s(f, &lun);
1497         req = scsi_req_new(s, tag, lun, buf, NULL);
1498         if (bus->info->load_request) {
1499             req->hba_private = bus->info->load_request(f, req);
1500         }
1501         if (req->ops->load_request) {
1502             req->ops->load_request(f, req);
1503         }
1504
1505         /* Just restart it later.  */
1506         req->retry = true;
1507         scsi_req_enqueue_internal(req);
1508
1509         /* At this point, the request will be kept alive by the reference
1510          * added by scsi_req_enqueue_internal, so we can release our reference.
1511          * The HBA of course will add its own reference in the load_request
1512          * callback if it needs to hold on the SCSIRequest.
1513          */
1514         scsi_req_unref(req);
1515     }
1516
1517     return 0;
1518 }
1519
1520 const VMStateInfo vmstate_info_scsi_requests = {
1521     .name = "scsi-requests",
1522     .get  = get_scsi_requests,
1523     .put  = put_scsi_requests,
1524 };
1525
1526 const VMStateDescription vmstate_scsi_device = {
1527     .name = "SCSIDevice",
1528     .version_id = 1,
1529     .minimum_version_id = 1,
1530     .minimum_version_id_old = 1,
1531     .fields = (VMStateField[]) {
1532         VMSTATE_UINT8(unit_attention.key, SCSIDevice),
1533         VMSTATE_UINT8(unit_attention.asc, SCSIDevice),
1534         VMSTATE_UINT8(unit_attention.ascq, SCSIDevice),
1535         VMSTATE_BOOL(sense_is_ua, SCSIDevice),
1536         VMSTATE_UINT8_ARRAY(sense, SCSIDevice, SCSI_SENSE_BUF_SIZE),
1537         VMSTATE_UINT32(sense_len, SCSIDevice),
1538         {
1539             .name         = "requests",
1540             .version_id   = 0,
1541             .field_exists = NULL,
1542             .size         = 0,   /* ouch */
1543             .info         = &vmstate_info_scsi_requests,
1544             .flags        = VMS_SINGLE,
1545             .offset       = 0,
1546         },
1547         VMSTATE_END_OF_LIST()
1548     }
1549 };
1550
1551 static void scsi_device_class_init(ObjectClass *klass, void *data)
1552 {
1553     DeviceClass *k = DEVICE_CLASS(klass);
1554     k->bus_info = &scsi_bus_info;
1555     k->init     = scsi_qdev_init;
1556     k->unplug   = qdev_simple_unplug_cb;
1557     k->exit     = scsi_qdev_exit;
1558 }
1559
1560 static TypeInfo scsi_device_type_info = {
1561     .name = TYPE_SCSI_DEVICE,
1562     .parent = TYPE_DEVICE,
1563     .instance_size = sizeof(SCSIDevice),
1564     .abstract = true,
1565     .class_size = sizeof(SCSIDeviceClass),
1566     .class_init = scsi_device_class_init,
1567 };
1568
1569 static void scsi_register_types(void)
1570 {
1571     type_register_static(&scsi_device_type_info);
1572 }
1573
1574 type_init(scsi_register_types)