1 #include "qemu/osdep.h" 2 #include "hw/hw.h" 3 #include "qapi/error.h" 4 #include "qemu/error-report.h" 5 #include "qemu/option.h" 6 #include "hw/scsi/scsi.h" 7 #include "scsi/constants.h" 8 #include "hw/qdev.h" 9 #include "sysemu/block-backend.h" 10 #include "sysemu/blockdev.h" 11 #include "trace.h" 12 #include "sysemu/dma.h" 13 #include "qemu/cutils.h" 14 15 static char *scsibus_get_dev_path(DeviceState *dev); 16 static char *scsibus_get_fw_dev_path(DeviceState *dev); 17 static void scsi_req_dequeue(SCSIRequest *req); 18 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len); 19 static void scsi_target_free_buf(SCSIRequest *req); 20 21 static Property scsi_props[] = { 22 DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0), 23 DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1), 24 DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1), 25 DEFINE_PROP_END_OF_LIST(), 26 }; 27 28 static void scsi_bus_class_init(ObjectClass *klass, void *data) 29 { 30 BusClass *k = BUS_CLASS(klass); 31 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass); 32 33 k->get_dev_path = scsibus_get_dev_path; 34 k->get_fw_dev_path = scsibus_get_fw_dev_path; 35 hc->unplug = qdev_simple_device_unplug_cb; 36 } 37 38 static const TypeInfo scsi_bus_info = { 39 .name = TYPE_SCSI_BUS, 40 .parent = TYPE_BUS, 41 .instance_size = sizeof(SCSIBus), 42 .class_init = scsi_bus_class_init, 43 .interfaces = (InterfaceInfo[]) { 44 { TYPE_HOTPLUG_HANDLER }, 45 { } 46 } 47 }; 48 static int next_scsi_bus; 49 50 static void scsi_device_realize(SCSIDevice *s, Error **errp) 51 { 52 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 53 if (sc->realize) { 54 sc->realize(s, errp); 55 } 56 } 57 58 int scsi_bus_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf, 59 void *hba_private) 60 { 61 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 62 int rc; 63 64 assert(cmd->len == 0); 65 rc = scsi_req_parse_cdb(dev, cmd, buf); 66 if (bus->info->parse_cdb) { 67 rc = bus->info->parse_cdb(dev, cmd, buf, hba_private); 68 } 69 return rc; 70 } 71 72 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun, 73 uint8_t *buf, void *hba_private) 74 { 75 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 76 if (sc->alloc_req) { 77 return sc->alloc_req(s, tag, lun, buf, hba_private); 78 } 79 80 return NULL; 81 } 82 83 void scsi_device_unit_attention_reported(SCSIDevice *s) 84 { 85 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 86 if (sc->unit_attention_reported) { 87 sc->unit_attention_reported(s); 88 } 89 } 90 91 /* Create a scsi bus, and attach devices to it. */ 92 void scsi_bus_new(SCSIBus *bus, size_t bus_size, DeviceState *host, 93 const SCSIBusInfo *info, const char *bus_name) 94 { 95 qbus_create_inplace(bus, bus_size, TYPE_SCSI_BUS, host, bus_name); 96 bus->busnr = next_scsi_bus++; 97 bus->info = info; 98 qbus_set_bus_hotplug_handler(BUS(bus), &error_abort); 99 } 100 101 static void scsi_dma_restart_bh(void *opaque) 102 { 103 SCSIDevice *s = opaque; 104 SCSIRequest *req, *next; 105 106 qemu_bh_delete(s->bh); 107 s->bh = NULL; 108 109 aio_context_acquire(blk_get_aio_context(s->conf.blk)); 110 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) { 111 scsi_req_ref(req); 112 if (req->retry) { 113 req->retry = false; 114 switch (req->cmd.mode) { 115 case SCSI_XFER_FROM_DEV: 116 case SCSI_XFER_TO_DEV: 117 scsi_req_continue(req); 118 break; 119 case SCSI_XFER_NONE: 120 scsi_req_dequeue(req); 121 scsi_req_enqueue(req); 122 break; 123 } 124 } 125 scsi_req_unref(req); 126 } 127 aio_context_release(blk_get_aio_context(s->conf.blk)); 128 } 129 130 void scsi_req_retry(SCSIRequest *req) 131 { 132 /* No need to save a reference, because scsi_dma_restart_bh just 133 * looks at the request list. */ 134 req->retry = true; 135 } 136 137 static void scsi_dma_restart_cb(void *opaque, int running, RunState state) 138 { 139 SCSIDevice *s = opaque; 140 141 if (!running) { 142 return; 143 } 144 if (!s->bh) { 145 AioContext *ctx = blk_get_aio_context(s->conf.blk); 146 s->bh = aio_bh_new(ctx, scsi_dma_restart_bh, s); 147 qemu_bh_schedule(s->bh); 148 } 149 } 150 151 static void scsi_qdev_realize(DeviceState *qdev, Error **errp) 152 { 153 SCSIDevice *dev = SCSI_DEVICE(qdev); 154 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 155 SCSIDevice *d; 156 Error *local_err = NULL; 157 158 if (dev->channel > bus->info->max_channel) { 159 error_setg(errp, "bad scsi channel id: %d", dev->channel); 160 return; 161 } 162 if (dev->id != -1 && dev->id > bus->info->max_target) { 163 error_setg(errp, "bad scsi device id: %d", dev->id); 164 return; 165 } 166 if (dev->lun != -1 && dev->lun > bus->info->max_lun) { 167 error_setg(errp, "bad scsi device lun: %d", dev->lun); 168 return; 169 } 170 171 if (dev->id == -1) { 172 int id = -1; 173 if (dev->lun == -1) { 174 dev->lun = 0; 175 } 176 do { 177 d = scsi_device_find(bus, dev->channel, ++id, dev->lun); 178 } while (d && d->lun == dev->lun && id < bus->info->max_target); 179 if (d && d->lun == dev->lun) { 180 error_setg(errp, "no free target"); 181 return; 182 } 183 dev->id = id; 184 } else if (dev->lun == -1) { 185 int lun = -1; 186 do { 187 d = scsi_device_find(bus, dev->channel, dev->id, ++lun); 188 } while (d && d->lun == lun && lun < bus->info->max_lun); 189 if (d && d->lun == lun) { 190 error_setg(errp, "no free lun"); 191 return; 192 } 193 dev->lun = lun; 194 } else { 195 d = scsi_device_find(bus, dev->channel, dev->id, dev->lun); 196 assert(d); 197 if (d->lun == dev->lun && dev != d) { 198 error_setg(errp, "lun already used by '%s'", d->qdev.id); 199 return; 200 } 201 } 202 203 QTAILQ_INIT(&dev->requests); 204 scsi_device_realize(dev, &local_err); 205 if (local_err) { 206 error_propagate(errp, local_err); 207 return; 208 } 209 dev->vmsentry = qemu_add_vm_change_state_handler(scsi_dma_restart_cb, 210 dev); 211 } 212 213 static void scsi_qdev_unrealize(DeviceState *qdev, Error **errp) 214 { 215 SCSIDevice *dev = SCSI_DEVICE(qdev); 216 217 if (dev->vmsentry) { 218 qemu_del_vm_change_state_handler(dev->vmsentry); 219 } 220 221 scsi_device_purge_requests(dev, SENSE_CODE(NO_SENSE)); 222 blockdev_mark_auto_del(dev->conf.blk); 223 } 224 225 /* handle legacy '-drive if=scsi,...' cmd line args */ 226 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockBackend *blk, 227 int unit, bool removable, int bootindex, 228 bool share_rw, 229 const char *serial, Error **errp) 230 { 231 const char *driver; 232 char *name; 233 DeviceState *dev; 234 Error *err = NULL; 235 236 driver = blk_is_sg(blk) ? "scsi-generic" : "scsi-disk"; 237 dev = qdev_create(&bus->qbus, driver); 238 name = g_strdup_printf("legacy[%d]", unit); 239 object_property_add_child(OBJECT(bus), name, OBJECT(dev), NULL); 240 g_free(name); 241 242 qdev_prop_set_uint32(dev, "scsi-id", unit); 243 if (bootindex >= 0) { 244 object_property_set_int(OBJECT(dev), bootindex, "bootindex", 245 &error_abort); 246 } 247 if (object_property_find(OBJECT(dev), "removable", NULL)) { 248 qdev_prop_set_bit(dev, "removable", removable); 249 } 250 if (serial && object_property_find(OBJECT(dev), "serial", NULL)) { 251 qdev_prop_set_string(dev, "serial", serial); 252 } 253 qdev_prop_set_drive(dev, "drive", blk, &err); 254 if (err) { 255 error_propagate(errp, err); 256 object_unparent(OBJECT(dev)); 257 return NULL; 258 } 259 object_property_set_bool(OBJECT(dev), share_rw, "share-rw", &err); 260 if (err != NULL) { 261 error_propagate(errp, err); 262 object_unparent(OBJECT(dev)); 263 return NULL; 264 } 265 object_property_set_bool(OBJECT(dev), true, "realized", &err); 266 if (err != NULL) { 267 error_propagate(errp, err); 268 object_unparent(OBJECT(dev)); 269 return NULL; 270 } 271 return SCSI_DEVICE(dev); 272 } 273 274 void scsi_bus_legacy_handle_cmdline(SCSIBus *bus, bool deprecated) 275 { 276 Location loc; 277 DriveInfo *dinfo; 278 int unit; 279 280 loc_push_none(&loc); 281 for (unit = 0; unit <= bus->info->max_target; unit++) { 282 dinfo = drive_get(IF_SCSI, bus->busnr, unit); 283 if (dinfo == NULL) { 284 continue; 285 } 286 qemu_opts_loc_restore(dinfo->opts); 287 if (deprecated) { 288 /* Handling -drive not claimed by machine initialization */ 289 if (blk_get_attached_dev(blk_by_legacy_dinfo(dinfo))) { 290 continue; /* claimed */ 291 } 292 if (!dinfo->is_default) { 293 warn_report("bus=%d,unit=%d is deprecated with this" 294 " machine type", 295 bus->busnr, unit); 296 } 297 } 298 scsi_bus_legacy_add_drive(bus, blk_by_legacy_dinfo(dinfo), 299 unit, false, -1, false, NULL, &error_fatal); 300 } 301 loc_pop(&loc); 302 } 303 304 static bool is_scsi_hba_with_legacy_magic(Object *obj) 305 { 306 static const char *magic[] = { 307 "am53c974", "dc390", "esp", "lsi53c810", "lsi53c895a", 308 "megasas", "megasas-gen2", "mptsas1068", "spapr-vscsi", 309 "virtio-scsi-device", 310 NULL 311 }; 312 const char *typename = object_get_typename(obj); 313 int i; 314 315 for (i = 0; magic[i]; i++) 316 if (!strcmp(typename, magic[i])) { 317 return true; 318 } 319 320 return false; 321 } 322 323 static int scsi_legacy_handle_cmdline_cb(Object *obj, void *opaque) 324 { 325 SCSIBus *bus = (SCSIBus *)object_dynamic_cast(obj, TYPE_SCSI_BUS); 326 327 if (bus && is_scsi_hba_with_legacy_magic(OBJECT(bus->qbus.parent))) { 328 scsi_bus_legacy_handle_cmdline(bus, true); 329 } 330 331 return 0; 332 } 333 334 void scsi_legacy_handle_cmdline(void) 335 { 336 object_child_foreach_recursive(object_get_root(), 337 scsi_legacy_handle_cmdline_cb, NULL); 338 } 339 340 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf) 341 { 342 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD)); 343 scsi_req_complete(req, CHECK_CONDITION); 344 return 0; 345 } 346 347 static const struct SCSIReqOps reqops_invalid_field = { 348 .size = sizeof(SCSIRequest), 349 .send_command = scsi_invalid_field 350 }; 351 352 /* SCSIReqOps implementation for invalid commands. */ 353 354 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf) 355 { 356 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE)); 357 scsi_req_complete(req, CHECK_CONDITION); 358 return 0; 359 } 360 361 static const struct SCSIReqOps reqops_invalid_opcode = { 362 .size = sizeof(SCSIRequest), 363 .send_command = scsi_invalid_command 364 }; 365 366 /* SCSIReqOps implementation for unit attention conditions. */ 367 368 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf) 369 { 370 if (req->dev->unit_attention.key == UNIT_ATTENTION) { 371 scsi_req_build_sense(req, req->dev->unit_attention); 372 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) { 373 scsi_req_build_sense(req, req->bus->unit_attention); 374 } 375 scsi_req_complete(req, CHECK_CONDITION); 376 return 0; 377 } 378 379 static const struct SCSIReqOps reqops_unit_attention = { 380 .size = sizeof(SCSIRequest), 381 .send_command = scsi_unit_attention 382 }; 383 384 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to 385 an invalid LUN. */ 386 387 typedef struct SCSITargetReq SCSITargetReq; 388 389 struct SCSITargetReq { 390 SCSIRequest req; 391 int len; 392 uint8_t *buf; 393 int buf_len; 394 }; 395 396 static void store_lun(uint8_t *outbuf, int lun) 397 { 398 if (lun < 256) { 399 outbuf[1] = lun; 400 return; 401 } 402 outbuf[1] = (lun & 255); 403 outbuf[0] = (lun >> 8) | 0x40; 404 } 405 406 static bool scsi_target_emulate_report_luns(SCSITargetReq *r) 407 { 408 BusChild *kid; 409 int i, len, n; 410 int channel, id; 411 bool found_lun0; 412 413 if (r->req.cmd.xfer < 16) { 414 return false; 415 } 416 if (r->req.cmd.buf[2] > 2) { 417 return false; 418 } 419 channel = r->req.dev->channel; 420 id = r->req.dev->id; 421 found_lun0 = false; 422 n = 0; 423 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) { 424 DeviceState *qdev = kid->child; 425 SCSIDevice *dev = SCSI_DEVICE(qdev); 426 427 if (dev->channel == channel && dev->id == id) { 428 if (dev->lun == 0) { 429 found_lun0 = true; 430 } 431 n += 8; 432 } 433 } 434 if (!found_lun0) { 435 n += 8; 436 } 437 438 scsi_target_alloc_buf(&r->req, n + 8); 439 440 len = MIN(n + 8, r->req.cmd.xfer & ~7); 441 memset(r->buf, 0, len); 442 stl_be_p(&r->buf[0], n); 443 i = found_lun0 ? 8 : 16; 444 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) { 445 DeviceState *qdev = kid->child; 446 SCSIDevice *dev = SCSI_DEVICE(qdev); 447 448 if (dev->channel == channel && dev->id == id) { 449 store_lun(&r->buf[i], dev->lun); 450 i += 8; 451 } 452 } 453 assert(i == n + 8); 454 r->len = len; 455 return true; 456 } 457 458 static bool scsi_target_emulate_inquiry(SCSITargetReq *r) 459 { 460 assert(r->req.dev->lun != r->req.lun); 461 462 scsi_target_alloc_buf(&r->req, SCSI_INQUIRY_LEN); 463 464 if (r->req.cmd.buf[1] & 0x2) { 465 /* Command support data - optional, not implemented */ 466 return false; 467 } 468 469 if (r->req.cmd.buf[1] & 0x1) { 470 /* Vital product data */ 471 uint8_t page_code = r->req.cmd.buf[2]; 472 r->buf[r->len++] = page_code ; /* this page */ 473 r->buf[r->len++] = 0x00; 474 475 switch (page_code) { 476 case 0x00: /* Supported page codes, mandatory */ 477 { 478 int pages; 479 pages = r->len++; 480 r->buf[r->len++] = 0x00; /* list of supported pages (this page) */ 481 r->buf[pages] = r->len - pages - 1; /* number of pages */ 482 break; 483 } 484 default: 485 return false; 486 } 487 /* done with EVPD */ 488 assert(r->len < r->buf_len); 489 r->len = MIN(r->req.cmd.xfer, r->len); 490 return true; 491 } 492 493 /* Standard INQUIRY data */ 494 if (r->req.cmd.buf[2] != 0) { 495 return false; 496 } 497 498 /* PAGE CODE == 0 */ 499 r->len = MIN(r->req.cmd.xfer, SCSI_INQUIRY_LEN); 500 memset(r->buf, 0, r->len); 501 if (r->req.lun != 0) { 502 r->buf[0] = TYPE_NO_LUN; 503 } else { 504 r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE; 505 r->buf[2] = 5; /* Version */ 506 r->buf[3] = 2 | 0x10; /* HiSup, response data format */ 507 r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */ 508 r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ. */ 509 memcpy(&r->buf[8], "QEMU ", 8); 510 memcpy(&r->buf[16], "QEMU TARGET ", 16); 511 pstrcpy((char *) &r->buf[32], 4, qemu_hw_version()); 512 } 513 return true; 514 } 515 516 static size_t scsi_sense_len(SCSIRequest *req) 517 { 518 if (req->dev->type == TYPE_SCANNER) 519 return SCSI_SENSE_LEN_SCANNER; 520 else 521 return SCSI_SENSE_LEN; 522 } 523 524 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf) 525 { 526 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 527 int fixed_sense = (req->cmd.buf[1] & 1) == 0; 528 529 if (req->lun != 0 && 530 buf[0] != INQUIRY && buf[0] != REQUEST_SENSE) { 531 scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED)); 532 scsi_req_complete(req, CHECK_CONDITION); 533 return 0; 534 } 535 switch (buf[0]) { 536 case REPORT_LUNS: 537 if (!scsi_target_emulate_report_luns(r)) { 538 goto illegal_request; 539 } 540 break; 541 case INQUIRY: 542 if (!scsi_target_emulate_inquiry(r)) { 543 goto illegal_request; 544 } 545 break; 546 case REQUEST_SENSE: 547 scsi_target_alloc_buf(&r->req, scsi_sense_len(req)); 548 if (req->lun != 0) { 549 const struct SCSISense sense = SENSE_CODE(LUN_NOT_SUPPORTED); 550 551 r->len = scsi_build_sense_buf(r->buf, req->cmd.xfer, 552 sense, fixed_sense); 553 } else { 554 r->len = scsi_device_get_sense(r->req.dev, r->buf, 555 MIN(req->cmd.xfer, r->buf_len), 556 fixed_sense); 557 } 558 if (r->req.dev->sense_is_ua) { 559 scsi_device_unit_attention_reported(req->dev); 560 r->req.dev->sense_len = 0; 561 r->req.dev->sense_is_ua = false; 562 } 563 break; 564 case TEST_UNIT_READY: 565 break; 566 default: 567 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE)); 568 scsi_req_complete(req, CHECK_CONDITION); 569 return 0; 570 illegal_request: 571 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD)); 572 scsi_req_complete(req, CHECK_CONDITION); 573 return 0; 574 } 575 576 if (!r->len) { 577 scsi_req_complete(req, GOOD); 578 } 579 return r->len; 580 } 581 582 static void scsi_target_read_data(SCSIRequest *req) 583 { 584 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 585 uint32_t n; 586 587 n = r->len; 588 if (n > 0) { 589 r->len = 0; 590 scsi_req_data(&r->req, n); 591 } else { 592 scsi_req_complete(&r->req, GOOD); 593 } 594 } 595 596 static uint8_t *scsi_target_get_buf(SCSIRequest *req) 597 { 598 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 599 600 return r->buf; 601 } 602 603 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len) 604 { 605 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 606 607 r->buf = g_malloc(len); 608 r->buf_len = len; 609 610 return r->buf; 611 } 612 613 static void scsi_target_free_buf(SCSIRequest *req) 614 { 615 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 616 617 g_free(r->buf); 618 } 619 620 static const struct SCSIReqOps reqops_target_command = { 621 .size = sizeof(SCSITargetReq), 622 .send_command = scsi_target_send_command, 623 .read_data = scsi_target_read_data, 624 .get_buf = scsi_target_get_buf, 625 .free_req = scsi_target_free_buf, 626 }; 627 628 629 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d, 630 uint32_t tag, uint32_t lun, void *hba_private) 631 { 632 SCSIRequest *req; 633 SCSIBus *bus = scsi_bus_from_device(d); 634 BusState *qbus = BUS(bus); 635 const int memset_off = offsetof(SCSIRequest, sense) 636 + sizeof(req->sense); 637 638 req = g_malloc(reqops->size); 639 memset((uint8_t *)req + memset_off, 0, reqops->size - memset_off); 640 req->refcount = 1; 641 req->bus = bus; 642 req->dev = d; 643 req->tag = tag; 644 req->lun = lun; 645 req->hba_private = hba_private; 646 req->status = -1; 647 req->ops = reqops; 648 object_ref(OBJECT(d)); 649 object_ref(OBJECT(qbus->parent)); 650 notifier_list_init(&req->cancel_notifiers); 651 trace_scsi_req_alloc(req->dev->id, req->lun, req->tag); 652 return req; 653 } 654 655 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun, 656 uint8_t *buf, void *hba_private) 657 { 658 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus); 659 const SCSIReqOps *ops; 660 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(d); 661 SCSIRequest *req; 662 SCSICommand cmd = { .len = 0 }; 663 int ret; 664 665 if ((d->unit_attention.key == UNIT_ATTENTION || 666 bus->unit_attention.key == UNIT_ATTENTION) && 667 (buf[0] != INQUIRY && 668 buf[0] != REPORT_LUNS && 669 buf[0] != GET_CONFIGURATION && 670 buf[0] != GET_EVENT_STATUS_NOTIFICATION && 671 672 /* 673 * If we already have a pending unit attention condition, 674 * report this one before triggering another one. 675 */ 676 !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) { 677 ops = &reqops_unit_attention; 678 } else if (lun != d->lun || 679 buf[0] == REPORT_LUNS || 680 (buf[0] == REQUEST_SENSE && d->sense_len)) { 681 ops = &reqops_target_command; 682 } else { 683 ops = NULL; 684 } 685 686 if (ops != NULL || !sc->parse_cdb) { 687 ret = scsi_req_parse_cdb(d, &cmd, buf); 688 } else { 689 ret = sc->parse_cdb(d, &cmd, buf, hba_private); 690 } 691 692 if (ret != 0) { 693 trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]); 694 req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private); 695 } else { 696 assert(cmd.len != 0); 697 trace_scsi_req_parsed(d->id, lun, tag, buf[0], 698 cmd.mode, cmd.xfer); 699 if (cmd.lba != -1) { 700 trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0], 701 cmd.lba); 702 } 703 704 if (cmd.xfer > INT32_MAX) { 705 req = scsi_req_alloc(&reqops_invalid_field, d, tag, lun, hba_private); 706 } else if (ops) { 707 req = scsi_req_alloc(ops, d, tag, lun, hba_private); 708 } else { 709 req = scsi_device_alloc_req(d, tag, lun, buf, hba_private); 710 } 711 } 712 713 req->cmd = cmd; 714 req->resid = req->cmd.xfer; 715 716 switch (buf[0]) { 717 case INQUIRY: 718 trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]); 719 break; 720 case TEST_UNIT_READY: 721 trace_scsi_test_unit_ready(d->id, lun, tag); 722 break; 723 case REPORT_LUNS: 724 trace_scsi_report_luns(d->id, lun, tag); 725 break; 726 case REQUEST_SENSE: 727 trace_scsi_request_sense(d->id, lun, tag); 728 break; 729 default: 730 break; 731 } 732 733 return req; 734 } 735 736 uint8_t *scsi_req_get_buf(SCSIRequest *req) 737 { 738 return req->ops->get_buf(req); 739 } 740 741 static void scsi_clear_unit_attention(SCSIRequest *req) 742 { 743 SCSISense *ua; 744 if (req->dev->unit_attention.key != UNIT_ATTENTION && 745 req->bus->unit_attention.key != UNIT_ATTENTION) { 746 return; 747 } 748 749 /* 750 * If an INQUIRY command enters the enabled command state, 751 * the device server shall [not] clear any unit attention condition; 752 * See also MMC-6, paragraphs 6.5 and 6.6.2. 753 */ 754 if (req->cmd.buf[0] == INQUIRY || 755 req->cmd.buf[0] == GET_CONFIGURATION || 756 req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) { 757 return; 758 } 759 760 if (req->dev->unit_attention.key == UNIT_ATTENTION) { 761 ua = &req->dev->unit_attention; 762 } else { 763 ua = &req->bus->unit_attention; 764 } 765 766 /* 767 * If a REPORT LUNS command enters the enabled command state, [...] 768 * the device server shall clear any pending unit attention condition 769 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED. 770 */ 771 if (req->cmd.buf[0] == REPORT_LUNS && 772 !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc && 773 ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) { 774 return; 775 } 776 777 *ua = SENSE_CODE(NO_SENSE); 778 } 779 780 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len) 781 { 782 int ret; 783 784 assert(len >= 14); 785 if (!req->sense_len) { 786 return 0; 787 } 788 789 ret = scsi_convert_sense(req->sense, req->sense_len, buf, len, true); 790 791 /* 792 * FIXME: clearing unit attention conditions upon autosense should be done 793 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b 794 * (SAM-5, 5.14). 795 * 796 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and 797 * 10b for HBAs that do not support it (do not call scsi_req_get_sense). 798 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b. 799 */ 800 if (req->dev->sense_is_ua) { 801 scsi_device_unit_attention_reported(req->dev); 802 req->dev->sense_len = 0; 803 req->dev->sense_is_ua = false; 804 } 805 return ret; 806 } 807 808 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed) 809 { 810 return scsi_convert_sense(dev->sense, dev->sense_len, buf, len, fixed); 811 } 812 813 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense) 814 { 815 trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag, 816 sense.key, sense.asc, sense.ascq); 817 req->sense_len = scsi_build_sense(req->sense, sense); 818 } 819 820 static void scsi_req_enqueue_internal(SCSIRequest *req) 821 { 822 assert(!req->enqueued); 823 scsi_req_ref(req); 824 if (req->bus->info->get_sg_list) { 825 req->sg = req->bus->info->get_sg_list(req); 826 } else { 827 req->sg = NULL; 828 } 829 req->enqueued = true; 830 QTAILQ_INSERT_TAIL(&req->dev->requests, req, next); 831 } 832 833 int32_t scsi_req_enqueue(SCSIRequest *req) 834 { 835 int32_t rc; 836 837 assert(!req->retry); 838 scsi_req_enqueue_internal(req); 839 scsi_req_ref(req); 840 rc = req->ops->send_command(req, req->cmd.buf); 841 scsi_req_unref(req); 842 return rc; 843 } 844 845 static void scsi_req_dequeue(SCSIRequest *req) 846 { 847 trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag); 848 req->retry = false; 849 if (req->enqueued) { 850 QTAILQ_REMOVE(&req->dev->requests, req, next); 851 req->enqueued = false; 852 scsi_req_unref(req); 853 } 854 } 855 856 static int scsi_get_performance_length(int num_desc, int type, int data_type) 857 { 858 /* MMC-6, paragraph 6.7. */ 859 switch (type) { 860 case 0: 861 if ((data_type & 3) == 0) { 862 /* Each descriptor is as in Table 295 - Nominal performance. */ 863 return 16 * num_desc + 8; 864 } else { 865 /* Each descriptor is as in Table 296 - Exceptions. */ 866 return 6 * num_desc + 8; 867 } 868 case 1: 869 case 4: 870 case 5: 871 return 8 * num_desc + 8; 872 case 2: 873 return 2048 * num_desc + 8; 874 case 3: 875 return 16 * num_desc + 8; 876 default: 877 return 8; 878 } 879 } 880 881 static int ata_passthrough_xfer_unit(SCSIDevice *dev, uint8_t *buf) 882 { 883 int byte_block = (buf[2] >> 2) & 0x1; 884 int type = (buf[2] >> 4) & 0x1; 885 int xfer_unit; 886 887 if (byte_block) { 888 if (type) { 889 xfer_unit = dev->blocksize; 890 } else { 891 xfer_unit = 512; 892 } 893 } else { 894 xfer_unit = 1; 895 } 896 897 return xfer_unit; 898 } 899 900 static int ata_passthrough_12_xfer(SCSIDevice *dev, uint8_t *buf) 901 { 902 int length = buf[2] & 0x3; 903 int xfer; 904 int unit = ata_passthrough_xfer_unit(dev, buf); 905 906 switch (length) { 907 case 0: 908 case 3: /* USB-specific. */ 909 default: 910 xfer = 0; 911 break; 912 case 1: 913 xfer = buf[3]; 914 break; 915 case 2: 916 xfer = buf[4]; 917 break; 918 } 919 920 return xfer * unit; 921 } 922 923 static int ata_passthrough_16_xfer(SCSIDevice *dev, uint8_t *buf) 924 { 925 int extend = buf[1] & 0x1; 926 int length = buf[2] & 0x3; 927 int xfer; 928 int unit = ata_passthrough_xfer_unit(dev, buf); 929 930 switch (length) { 931 case 0: 932 case 3: /* USB-specific. */ 933 default: 934 xfer = 0; 935 break; 936 case 1: 937 xfer = buf[4]; 938 xfer |= (extend ? buf[3] << 8 : 0); 939 break; 940 case 2: 941 xfer = buf[6]; 942 xfer |= (extend ? buf[5] << 8 : 0); 943 break; 944 } 945 946 return xfer * unit; 947 } 948 949 static int scsi_req_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 950 { 951 cmd->xfer = scsi_cdb_xfer(buf); 952 switch (buf[0]) { 953 case TEST_UNIT_READY: 954 case REWIND: 955 case START_STOP: 956 case SET_CAPACITY: 957 case WRITE_FILEMARKS: 958 case WRITE_FILEMARKS_16: 959 case SPACE: 960 case RESERVE: 961 case RELEASE: 962 case ERASE: 963 case ALLOW_MEDIUM_REMOVAL: 964 case SEEK_10: 965 case SYNCHRONIZE_CACHE: 966 case SYNCHRONIZE_CACHE_16: 967 case LOCATE_16: 968 case LOCK_UNLOCK_CACHE: 969 case SET_CD_SPEED: 970 case SET_LIMITS: 971 case WRITE_LONG_10: 972 case UPDATE_BLOCK: 973 case RESERVE_TRACK: 974 case SET_READ_AHEAD: 975 case PRE_FETCH: 976 case PRE_FETCH_16: 977 case ALLOW_OVERWRITE: 978 cmd->xfer = 0; 979 break; 980 case VERIFY_10: 981 case VERIFY_12: 982 case VERIFY_16: 983 if ((buf[1] & 2) == 0) { 984 cmd->xfer = 0; 985 } else if ((buf[1] & 4) != 0) { 986 cmd->xfer = 1; 987 } 988 cmd->xfer *= dev->blocksize; 989 break; 990 case MODE_SENSE: 991 break; 992 case WRITE_SAME_10: 993 case WRITE_SAME_16: 994 cmd->xfer = dev->blocksize; 995 break; 996 case READ_CAPACITY_10: 997 cmd->xfer = 8; 998 break; 999 case READ_BLOCK_LIMITS: 1000 cmd->xfer = 6; 1001 break; 1002 case SEND_VOLUME_TAG: 1003 /* GPCMD_SET_STREAMING from multimedia commands. */ 1004 if (dev->type == TYPE_ROM) { 1005 cmd->xfer = buf[10] | (buf[9] << 8); 1006 } else { 1007 cmd->xfer = buf[9] | (buf[8] << 8); 1008 } 1009 break; 1010 case WRITE_6: 1011 /* length 0 means 256 blocks */ 1012 if (cmd->xfer == 0) { 1013 cmd->xfer = 256; 1014 } 1015 /* fall through */ 1016 case WRITE_10: 1017 case WRITE_VERIFY_10: 1018 case WRITE_12: 1019 case WRITE_VERIFY_12: 1020 case WRITE_16: 1021 case WRITE_VERIFY_16: 1022 cmd->xfer *= dev->blocksize; 1023 break; 1024 case READ_6: 1025 case READ_REVERSE: 1026 /* length 0 means 256 blocks */ 1027 if (cmd->xfer == 0) { 1028 cmd->xfer = 256; 1029 } 1030 /* fall through */ 1031 case READ_10: 1032 case READ_12: 1033 case READ_16: 1034 cmd->xfer *= dev->blocksize; 1035 break; 1036 case FORMAT_UNIT: 1037 /* MMC mandates the parameter list to be 12-bytes long. Parameters 1038 * for block devices are restricted to the header right now. */ 1039 if (dev->type == TYPE_ROM && (buf[1] & 16)) { 1040 cmd->xfer = 12; 1041 } else { 1042 cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4); 1043 } 1044 break; 1045 case INQUIRY: 1046 case RECEIVE_DIAGNOSTIC: 1047 case SEND_DIAGNOSTIC: 1048 cmd->xfer = buf[4] | (buf[3] << 8); 1049 break; 1050 case READ_CD: 1051 case READ_BUFFER: 1052 case WRITE_BUFFER: 1053 case SEND_CUE_SHEET: 1054 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16); 1055 break; 1056 case PERSISTENT_RESERVE_OUT: 1057 cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL; 1058 break; 1059 case ERASE_12: 1060 if (dev->type == TYPE_ROM) { 1061 /* MMC command GET PERFORMANCE. */ 1062 cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8), 1063 buf[10], buf[1] & 0x1f); 1064 } 1065 break; 1066 case MECHANISM_STATUS: 1067 case READ_DVD_STRUCTURE: 1068 case SEND_DVD_STRUCTURE: 1069 case MAINTENANCE_OUT: 1070 case MAINTENANCE_IN: 1071 if (dev->type == TYPE_ROM) { 1072 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */ 1073 cmd->xfer = buf[9] | (buf[8] << 8); 1074 } 1075 break; 1076 case ATA_PASSTHROUGH_12: 1077 if (dev->type == TYPE_ROM) { 1078 /* BLANK command of MMC */ 1079 cmd->xfer = 0; 1080 } else { 1081 cmd->xfer = ata_passthrough_12_xfer(dev, buf); 1082 } 1083 break; 1084 case ATA_PASSTHROUGH_16: 1085 cmd->xfer = ata_passthrough_16_xfer(dev, buf); 1086 break; 1087 } 1088 return 0; 1089 } 1090 1091 static int scsi_req_stream_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1092 { 1093 switch (buf[0]) { 1094 /* stream commands */ 1095 case ERASE_12: 1096 case ERASE_16: 1097 cmd->xfer = 0; 1098 break; 1099 case READ_6: 1100 case READ_REVERSE: 1101 case RECOVER_BUFFERED_DATA: 1102 case WRITE_6: 1103 cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16); 1104 if (buf[1] & 0x01) { /* fixed */ 1105 cmd->xfer *= dev->blocksize; 1106 } 1107 break; 1108 case READ_16: 1109 case READ_REVERSE_16: 1110 case VERIFY_16: 1111 case WRITE_16: 1112 cmd->xfer = buf[14] | (buf[13] << 8) | (buf[12] << 16); 1113 if (buf[1] & 0x01) { /* fixed */ 1114 cmd->xfer *= dev->blocksize; 1115 } 1116 break; 1117 case REWIND: 1118 case LOAD_UNLOAD: 1119 cmd->xfer = 0; 1120 break; 1121 case SPACE_16: 1122 cmd->xfer = buf[13] | (buf[12] << 8); 1123 break; 1124 case READ_POSITION: 1125 switch (buf[1] & 0x1f) /* operation code */ { 1126 case SHORT_FORM_BLOCK_ID: 1127 case SHORT_FORM_VENDOR_SPECIFIC: 1128 cmd->xfer = 20; 1129 break; 1130 case LONG_FORM: 1131 cmd->xfer = 32; 1132 break; 1133 case EXTENDED_FORM: 1134 cmd->xfer = buf[8] | (buf[7] << 8); 1135 break; 1136 default: 1137 return -1; 1138 } 1139 1140 break; 1141 case FORMAT_UNIT: 1142 cmd->xfer = buf[4] | (buf[3] << 8); 1143 break; 1144 /* generic commands */ 1145 default: 1146 return scsi_req_xfer(cmd, dev, buf); 1147 } 1148 return 0; 1149 } 1150 1151 static int scsi_req_medium_changer_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1152 { 1153 switch (buf[0]) { 1154 /* medium changer commands */ 1155 case EXCHANGE_MEDIUM: 1156 case INITIALIZE_ELEMENT_STATUS: 1157 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE: 1158 case MOVE_MEDIUM: 1159 case POSITION_TO_ELEMENT: 1160 cmd->xfer = 0; 1161 break; 1162 case READ_ELEMENT_STATUS: 1163 cmd->xfer = buf[9] | (buf[8] << 8) | (buf[7] << 16); 1164 break; 1165 1166 /* generic commands */ 1167 default: 1168 return scsi_req_xfer(cmd, dev, buf); 1169 } 1170 return 0; 1171 } 1172 1173 static int scsi_req_scanner_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1174 { 1175 switch (buf[0]) { 1176 /* Scanner commands */ 1177 case OBJECT_POSITION: 1178 cmd->xfer = 0; 1179 break; 1180 case SCAN: 1181 cmd->xfer = buf[4]; 1182 break; 1183 case READ_10: 1184 case SEND: 1185 case GET_WINDOW: 1186 case SET_WINDOW: 1187 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16); 1188 break; 1189 default: 1190 /* GET_DATA_BUFFER_STATUS xfer handled by scsi_req_xfer */ 1191 return scsi_req_xfer(cmd, dev, buf); 1192 } 1193 1194 return 0; 1195 } 1196 1197 static void scsi_cmd_xfer_mode(SCSICommand *cmd) 1198 { 1199 if (!cmd->xfer) { 1200 cmd->mode = SCSI_XFER_NONE; 1201 return; 1202 } 1203 switch (cmd->buf[0]) { 1204 case WRITE_6: 1205 case WRITE_10: 1206 case WRITE_VERIFY_10: 1207 case WRITE_12: 1208 case WRITE_VERIFY_12: 1209 case WRITE_16: 1210 case WRITE_VERIFY_16: 1211 case VERIFY_10: 1212 case VERIFY_12: 1213 case VERIFY_16: 1214 case COPY: 1215 case COPY_VERIFY: 1216 case COMPARE: 1217 case CHANGE_DEFINITION: 1218 case LOG_SELECT: 1219 case MODE_SELECT: 1220 case MODE_SELECT_10: 1221 case SEND_DIAGNOSTIC: 1222 case WRITE_BUFFER: 1223 case FORMAT_UNIT: 1224 case REASSIGN_BLOCKS: 1225 case SEARCH_EQUAL: 1226 case SEARCH_HIGH: 1227 case SEARCH_LOW: 1228 case UPDATE_BLOCK: 1229 case WRITE_LONG_10: 1230 case WRITE_SAME_10: 1231 case WRITE_SAME_16: 1232 case UNMAP: 1233 case SEARCH_HIGH_12: 1234 case SEARCH_EQUAL_12: 1235 case SEARCH_LOW_12: 1236 case MEDIUM_SCAN: 1237 case SEND_VOLUME_TAG: 1238 case SEND_CUE_SHEET: 1239 case SEND_DVD_STRUCTURE: 1240 case PERSISTENT_RESERVE_OUT: 1241 case MAINTENANCE_OUT: 1242 case SET_WINDOW: 1243 case SCAN: 1244 /* SCAN conflicts with START_STOP. START_STOP has cmd->xfer set to 0 for 1245 * non-scanner devices, so we only get here for SCAN and not for START_STOP. 1246 */ 1247 cmd->mode = SCSI_XFER_TO_DEV; 1248 break; 1249 case ATA_PASSTHROUGH_12: 1250 case ATA_PASSTHROUGH_16: 1251 /* T_DIR */ 1252 cmd->mode = (cmd->buf[2] & 0x8) ? 1253 SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV; 1254 break; 1255 default: 1256 cmd->mode = SCSI_XFER_FROM_DEV; 1257 break; 1258 } 1259 } 1260 1261 int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf) 1262 { 1263 int rc; 1264 int len; 1265 1266 cmd->lba = -1; 1267 len = scsi_cdb_length(buf); 1268 if (len < 0) { 1269 return -1; 1270 } 1271 1272 cmd->len = len; 1273 switch (dev->type) { 1274 case TYPE_TAPE: 1275 rc = scsi_req_stream_xfer(cmd, dev, buf); 1276 break; 1277 case TYPE_MEDIUM_CHANGER: 1278 rc = scsi_req_medium_changer_xfer(cmd, dev, buf); 1279 break; 1280 case TYPE_SCANNER: 1281 rc = scsi_req_scanner_length(cmd, dev, buf); 1282 break; 1283 default: 1284 rc = scsi_req_xfer(cmd, dev, buf); 1285 break; 1286 } 1287 1288 if (rc != 0) 1289 return rc; 1290 1291 memcpy(cmd->buf, buf, cmd->len); 1292 scsi_cmd_xfer_mode(cmd); 1293 cmd->lba = scsi_cmd_lba(cmd); 1294 return 0; 1295 } 1296 1297 void scsi_device_report_change(SCSIDevice *dev, SCSISense sense) 1298 { 1299 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 1300 1301 scsi_device_set_ua(dev, sense); 1302 if (bus->info->change) { 1303 bus->info->change(bus, dev, sense); 1304 } 1305 } 1306 1307 SCSIRequest *scsi_req_ref(SCSIRequest *req) 1308 { 1309 assert(req->refcount > 0); 1310 req->refcount++; 1311 return req; 1312 } 1313 1314 void scsi_req_unref(SCSIRequest *req) 1315 { 1316 assert(req->refcount > 0); 1317 if (--req->refcount == 0) { 1318 BusState *qbus = req->dev->qdev.parent_bus; 1319 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus); 1320 1321 if (bus->info->free_request && req->hba_private) { 1322 bus->info->free_request(bus, req->hba_private); 1323 } 1324 if (req->ops->free_req) { 1325 req->ops->free_req(req); 1326 } 1327 object_unref(OBJECT(req->dev)); 1328 object_unref(OBJECT(qbus->parent)); 1329 g_free(req); 1330 } 1331 } 1332 1333 /* Tell the device that we finished processing this chunk of I/O. It 1334 will start the next chunk or complete the command. */ 1335 void scsi_req_continue(SCSIRequest *req) 1336 { 1337 if (req->io_canceled) { 1338 trace_scsi_req_continue_canceled(req->dev->id, req->lun, req->tag); 1339 return; 1340 } 1341 trace_scsi_req_continue(req->dev->id, req->lun, req->tag); 1342 if (req->cmd.mode == SCSI_XFER_TO_DEV) { 1343 req->ops->write_data(req); 1344 } else { 1345 req->ops->read_data(req); 1346 } 1347 } 1348 1349 /* Called by the devices when data is ready for the HBA. The HBA should 1350 start a DMA operation to read or fill the device's data buffer. 1351 Once it completes, calling scsi_req_continue will restart I/O. */ 1352 void scsi_req_data(SCSIRequest *req, int len) 1353 { 1354 uint8_t *buf; 1355 if (req->io_canceled) { 1356 trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len); 1357 return; 1358 } 1359 trace_scsi_req_data(req->dev->id, req->lun, req->tag, len); 1360 assert(req->cmd.mode != SCSI_XFER_NONE); 1361 if (!req->sg) { 1362 req->resid -= len; 1363 req->bus->info->transfer_data(req, len); 1364 return; 1365 } 1366 1367 /* If the device calls scsi_req_data and the HBA specified a 1368 * scatter/gather list, the transfer has to happen in a single 1369 * step. */ 1370 assert(!req->dma_started); 1371 req->dma_started = true; 1372 1373 buf = scsi_req_get_buf(req); 1374 if (req->cmd.mode == SCSI_XFER_FROM_DEV) { 1375 req->resid = dma_buf_read(buf, len, req->sg); 1376 } else { 1377 req->resid = dma_buf_write(buf, len, req->sg); 1378 } 1379 scsi_req_continue(req); 1380 } 1381 1382 void scsi_req_print(SCSIRequest *req) 1383 { 1384 FILE *fp = stderr; 1385 int i; 1386 1387 fprintf(fp, "[%s id=%d] %s", 1388 req->dev->qdev.parent_bus->name, 1389 req->dev->id, 1390 scsi_command_name(req->cmd.buf[0])); 1391 for (i = 1; i < req->cmd.len; i++) { 1392 fprintf(fp, " 0x%02x", req->cmd.buf[i]); 1393 } 1394 switch (req->cmd.mode) { 1395 case SCSI_XFER_NONE: 1396 fprintf(fp, " - none\n"); 1397 break; 1398 case SCSI_XFER_FROM_DEV: 1399 fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer); 1400 break; 1401 case SCSI_XFER_TO_DEV: 1402 fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer); 1403 break; 1404 default: 1405 fprintf(fp, " - Oops\n"); 1406 break; 1407 } 1408 } 1409 1410 void scsi_req_complete(SCSIRequest *req, int status) 1411 { 1412 assert(req->status == -1); 1413 req->status = status; 1414 1415 assert(req->sense_len <= sizeof(req->sense)); 1416 if (status == GOOD) { 1417 req->sense_len = 0; 1418 } 1419 1420 if (req->sense_len) { 1421 memcpy(req->dev->sense, req->sense, req->sense_len); 1422 req->dev->sense_len = req->sense_len; 1423 req->dev->sense_is_ua = (req->ops == &reqops_unit_attention); 1424 } else { 1425 req->dev->sense_len = 0; 1426 req->dev->sense_is_ua = false; 1427 } 1428 1429 /* 1430 * Unit attention state is now stored in the device's sense buffer 1431 * if the HBA didn't do autosense. Clear the pending unit attention 1432 * flags. 1433 */ 1434 scsi_clear_unit_attention(req); 1435 1436 scsi_req_ref(req); 1437 scsi_req_dequeue(req); 1438 req->bus->info->complete(req, req->status, req->resid); 1439 1440 /* Cancelled requests might end up being completed instead of cancelled */ 1441 notifier_list_notify(&req->cancel_notifiers, req); 1442 scsi_req_unref(req); 1443 } 1444 1445 /* Called by the devices when the request is canceled. */ 1446 void scsi_req_cancel_complete(SCSIRequest *req) 1447 { 1448 assert(req->io_canceled); 1449 if (req->bus->info->cancel) { 1450 req->bus->info->cancel(req); 1451 } 1452 notifier_list_notify(&req->cancel_notifiers, req); 1453 scsi_req_unref(req); 1454 } 1455 1456 /* Cancel @req asynchronously. @notifier is added to @req's cancellation 1457 * notifier list, the bus will be notified the requests cancellation is 1458 * completed. 1459 * */ 1460 void scsi_req_cancel_async(SCSIRequest *req, Notifier *notifier) 1461 { 1462 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag); 1463 if (notifier) { 1464 notifier_list_add(&req->cancel_notifiers, notifier); 1465 } 1466 if (req->io_canceled) { 1467 /* A blk_aio_cancel_async is pending; when it finishes, 1468 * scsi_req_cancel_complete will be called and will 1469 * call the notifier we just added. Just wait for that. 1470 */ 1471 assert(req->aiocb); 1472 return; 1473 } 1474 /* Dropped in scsi_req_cancel_complete. */ 1475 scsi_req_ref(req); 1476 scsi_req_dequeue(req); 1477 req->io_canceled = true; 1478 if (req->aiocb) { 1479 blk_aio_cancel_async(req->aiocb); 1480 } else { 1481 scsi_req_cancel_complete(req); 1482 } 1483 } 1484 1485 void scsi_req_cancel(SCSIRequest *req) 1486 { 1487 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag); 1488 if (!req->enqueued) { 1489 return; 1490 } 1491 assert(!req->io_canceled); 1492 /* Dropped in scsi_req_cancel_complete. */ 1493 scsi_req_ref(req); 1494 scsi_req_dequeue(req); 1495 req->io_canceled = true; 1496 if (req->aiocb) { 1497 blk_aio_cancel(req->aiocb); 1498 } else { 1499 scsi_req_cancel_complete(req); 1500 } 1501 } 1502 1503 static int scsi_ua_precedence(SCSISense sense) 1504 { 1505 if (sense.key != UNIT_ATTENTION) { 1506 return INT_MAX; 1507 } 1508 if (sense.asc == 0x29 && sense.ascq == 0x04) { 1509 /* DEVICE INTERNAL RESET goes with POWER ON OCCURRED */ 1510 return 1; 1511 } else if (sense.asc == 0x3F && sense.ascq == 0x01) { 1512 /* MICROCODE HAS BEEN CHANGED goes with SCSI BUS RESET OCCURRED */ 1513 return 2; 1514 } else if (sense.asc == 0x29 && (sense.ascq == 0x05 || sense.ascq == 0x06)) { 1515 /* These two go with "all others". */ 1516 ; 1517 } else if (sense.asc == 0x29 && sense.ascq <= 0x07) { 1518 /* POWER ON, RESET OR BUS DEVICE RESET OCCURRED = 0 1519 * POWER ON OCCURRED = 1 1520 * SCSI BUS RESET OCCURRED = 2 1521 * BUS DEVICE RESET FUNCTION OCCURRED = 3 1522 * I_T NEXUS LOSS OCCURRED = 7 1523 */ 1524 return sense.ascq; 1525 } else if (sense.asc == 0x2F && sense.ascq == 0x01) { 1526 /* COMMANDS CLEARED BY POWER LOSS NOTIFICATION */ 1527 return 8; 1528 } 1529 return (sense.asc << 8) | sense.ascq; 1530 } 1531 1532 void scsi_device_set_ua(SCSIDevice *sdev, SCSISense sense) 1533 { 1534 int prec1, prec2; 1535 if (sense.key != UNIT_ATTENTION) { 1536 return; 1537 } 1538 trace_scsi_device_set_ua(sdev->id, sdev->lun, sense.key, 1539 sense.asc, sense.ascq); 1540 1541 /* 1542 * Override a pre-existing unit attention condition, except for a more 1543 * important reset condition. 1544 */ 1545 prec1 = scsi_ua_precedence(sdev->unit_attention); 1546 prec2 = scsi_ua_precedence(sense); 1547 if (prec2 < prec1) { 1548 sdev->unit_attention = sense; 1549 } 1550 } 1551 1552 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense) 1553 { 1554 SCSIRequest *req; 1555 1556 aio_context_acquire(blk_get_aio_context(sdev->conf.blk)); 1557 while (!QTAILQ_EMPTY(&sdev->requests)) { 1558 req = QTAILQ_FIRST(&sdev->requests); 1559 scsi_req_cancel_async(req, NULL); 1560 } 1561 blk_drain(sdev->conf.blk); 1562 aio_context_release(blk_get_aio_context(sdev->conf.blk)); 1563 scsi_device_set_ua(sdev, sense); 1564 } 1565 1566 static char *scsibus_get_dev_path(DeviceState *dev) 1567 { 1568 SCSIDevice *d = SCSI_DEVICE(dev); 1569 DeviceState *hba = dev->parent_bus->parent; 1570 char *id; 1571 char *path; 1572 1573 id = qdev_get_dev_path(hba); 1574 if (id) { 1575 path = g_strdup_printf("%s/%d:%d:%d", id, d->channel, d->id, d->lun); 1576 } else { 1577 path = g_strdup_printf("%d:%d:%d", d->channel, d->id, d->lun); 1578 } 1579 g_free(id); 1580 return path; 1581 } 1582 1583 static char *scsibus_get_fw_dev_path(DeviceState *dev) 1584 { 1585 SCSIDevice *d = SCSI_DEVICE(dev); 1586 return g_strdup_printf("channel@%x/%s@%x,%x", d->channel, 1587 qdev_fw_name(dev), d->id, d->lun); 1588 } 1589 1590 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun) 1591 { 1592 BusChild *kid; 1593 SCSIDevice *target_dev = NULL; 1594 1595 QTAILQ_FOREACH_REVERSE(kid, &bus->qbus.children, ChildrenHead, sibling) { 1596 DeviceState *qdev = kid->child; 1597 SCSIDevice *dev = SCSI_DEVICE(qdev); 1598 1599 if (dev->channel == channel && dev->id == id) { 1600 if (dev->lun == lun) { 1601 return dev; 1602 } 1603 target_dev = dev; 1604 } 1605 } 1606 return target_dev; 1607 } 1608 1609 /* SCSI request list. For simplicity, pv points to the whole device */ 1610 1611 static int put_scsi_requests(QEMUFile *f, void *pv, size_t size, 1612 VMStateField *field, QJSON *vmdesc) 1613 { 1614 SCSIDevice *s = pv; 1615 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus); 1616 SCSIRequest *req; 1617 1618 QTAILQ_FOREACH(req, &s->requests, next) { 1619 assert(!req->io_canceled); 1620 assert(req->status == -1); 1621 assert(req->enqueued); 1622 1623 qemu_put_sbyte(f, req->retry ? 1 : 2); 1624 qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf)); 1625 qemu_put_be32s(f, &req->tag); 1626 qemu_put_be32s(f, &req->lun); 1627 if (bus->info->save_request) { 1628 bus->info->save_request(f, req); 1629 } 1630 if (req->ops->save_request) { 1631 req->ops->save_request(f, req); 1632 } 1633 } 1634 qemu_put_sbyte(f, 0); 1635 1636 return 0; 1637 } 1638 1639 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size, 1640 VMStateField *field) 1641 { 1642 SCSIDevice *s = pv; 1643 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus); 1644 int8_t sbyte; 1645 1646 while ((sbyte = qemu_get_sbyte(f)) > 0) { 1647 uint8_t buf[SCSI_CMD_BUF_SIZE]; 1648 uint32_t tag; 1649 uint32_t lun; 1650 SCSIRequest *req; 1651 1652 qemu_get_buffer(f, buf, sizeof(buf)); 1653 qemu_get_be32s(f, &tag); 1654 qemu_get_be32s(f, &lun); 1655 req = scsi_req_new(s, tag, lun, buf, NULL); 1656 req->retry = (sbyte == 1); 1657 if (bus->info->load_request) { 1658 req->hba_private = bus->info->load_request(f, req); 1659 } 1660 if (req->ops->load_request) { 1661 req->ops->load_request(f, req); 1662 } 1663 1664 /* Just restart it later. */ 1665 scsi_req_enqueue_internal(req); 1666 1667 /* At this point, the request will be kept alive by the reference 1668 * added by scsi_req_enqueue_internal, so we can release our reference. 1669 * The HBA of course will add its own reference in the load_request 1670 * callback if it needs to hold on the SCSIRequest. 1671 */ 1672 scsi_req_unref(req); 1673 } 1674 1675 return 0; 1676 } 1677 1678 static const VMStateInfo vmstate_info_scsi_requests = { 1679 .name = "scsi-requests", 1680 .get = get_scsi_requests, 1681 .put = put_scsi_requests, 1682 }; 1683 1684 static bool scsi_sense_state_needed(void *opaque) 1685 { 1686 SCSIDevice *s = opaque; 1687 1688 return s->sense_len > SCSI_SENSE_BUF_SIZE_OLD; 1689 } 1690 1691 static const VMStateDescription vmstate_scsi_sense_state = { 1692 .name = "SCSIDevice/sense", 1693 .version_id = 1, 1694 .minimum_version_id = 1, 1695 .needed = scsi_sense_state_needed, 1696 .fields = (VMStateField[]) { 1697 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 1698 SCSI_SENSE_BUF_SIZE_OLD, 1699 SCSI_SENSE_BUF_SIZE - SCSI_SENSE_BUF_SIZE_OLD), 1700 VMSTATE_END_OF_LIST() 1701 } 1702 }; 1703 1704 const VMStateDescription vmstate_scsi_device = { 1705 .name = "SCSIDevice", 1706 .version_id = 1, 1707 .minimum_version_id = 1, 1708 .fields = (VMStateField[]) { 1709 VMSTATE_UINT8(unit_attention.key, SCSIDevice), 1710 VMSTATE_UINT8(unit_attention.asc, SCSIDevice), 1711 VMSTATE_UINT8(unit_attention.ascq, SCSIDevice), 1712 VMSTATE_BOOL(sense_is_ua, SCSIDevice), 1713 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 0, SCSI_SENSE_BUF_SIZE_OLD), 1714 VMSTATE_UINT32(sense_len, SCSIDevice), 1715 { 1716 .name = "requests", 1717 .version_id = 0, 1718 .field_exists = NULL, 1719 .size = 0, /* ouch */ 1720 .info = &vmstate_info_scsi_requests, 1721 .flags = VMS_SINGLE, 1722 .offset = 0, 1723 }, 1724 VMSTATE_END_OF_LIST() 1725 }, 1726 .subsections = (const VMStateDescription*[]) { 1727 &vmstate_scsi_sense_state, 1728 NULL 1729 } 1730 }; 1731 1732 static void scsi_device_class_init(ObjectClass *klass, void *data) 1733 { 1734 DeviceClass *k = DEVICE_CLASS(klass); 1735 set_bit(DEVICE_CATEGORY_STORAGE, k->categories); 1736 k->bus_type = TYPE_SCSI_BUS; 1737 k->realize = scsi_qdev_realize; 1738 k->unrealize = scsi_qdev_unrealize; 1739 k->props = scsi_props; 1740 } 1741 1742 static void scsi_dev_instance_init(Object *obj) 1743 { 1744 DeviceState *dev = DEVICE(obj); 1745 SCSIDevice *s = SCSI_DEVICE(dev); 1746 1747 device_add_bootindex_property(obj, &s->conf.bootindex, 1748 "bootindex", NULL, 1749 &s->qdev, NULL); 1750 } 1751 1752 static const TypeInfo scsi_device_type_info = { 1753 .name = TYPE_SCSI_DEVICE, 1754 .parent = TYPE_DEVICE, 1755 .instance_size = sizeof(SCSIDevice), 1756 .abstract = true, 1757 .class_size = sizeof(SCSIDeviceClass), 1758 .class_init = scsi_device_class_init, 1759 .instance_init = scsi_dev_instance_init, 1760 }; 1761 1762 static void scsi_register_types(void) 1763 { 1764 type_register_static(&scsi_bus_info); 1765 type_register_static(&scsi_device_type_info); 1766 } 1767 1768 type_init(scsi_register_types) 1769