1 #include "qemu/osdep.h" 2 #include "qapi/error.h" 3 #include "qemu/error-report.h" 4 #include "qemu/module.h" 5 #include "qemu/option.h" 6 #include "hw/qdev-properties.h" 7 #include "hw/scsi/scsi.h" 8 #include "migration/qemu-file-types.h" 9 #include "migration/vmstate.h" 10 #include "scsi/constants.h" 11 #include "sysemu/block-backend.h" 12 #include "sysemu/blockdev.h" 13 #include "sysemu/sysemu.h" 14 #include "sysemu/runstate.h" 15 #include "trace.h" 16 #include "sysemu/dma.h" 17 #include "qemu/cutils.h" 18 19 static char *scsibus_get_dev_path(DeviceState *dev); 20 static char *scsibus_get_fw_dev_path(DeviceState *dev); 21 static void scsi_req_dequeue(SCSIRequest *req); 22 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len); 23 static void scsi_target_free_buf(SCSIRequest *req); 24 25 static Property scsi_props[] = { 26 DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0), 27 DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1), 28 DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1), 29 DEFINE_PROP_END_OF_LIST(), 30 }; 31 32 static void scsi_bus_class_init(ObjectClass *klass, void *data) 33 { 34 BusClass *k = BUS_CLASS(klass); 35 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass); 36 37 k->get_dev_path = scsibus_get_dev_path; 38 k->get_fw_dev_path = scsibus_get_fw_dev_path; 39 hc->unplug = qdev_simple_device_unplug_cb; 40 } 41 42 static const TypeInfo scsi_bus_info = { 43 .name = TYPE_SCSI_BUS, 44 .parent = TYPE_BUS, 45 .instance_size = sizeof(SCSIBus), 46 .class_init = scsi_bus_class_init, 47 .interfaces = (InterfaceInfo[]) { 48 { TYPE_HOTPLUG_HANDLER }, 49 { } 50 } 51 }; 52 static int next_scsi_bus; 53 54 static void scsi_device_realize(SCSIDevice *s, Error **errp) 55 { 56 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 57 if (sc->realize) { 58 sc->realize(s, errp); 59 } 60 } 61 62 static void scsi_device_unrealize(SCSIDevice *s) 63 { 64 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 65 if (sc->unrealize) { 66 sc->unrealize(s); 67 } 68 } 69 70 int scsi_bus_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf, 71 void *hba_private) 72 { 73 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 74 int rc; 75 76 assert(cmd->len == 0); 77 rc = scsi_req_parse_cdb(dev, cmd, buf); 78 if (bus->info->parse_cdb) { 79 rc = bus->info->parse_cdb(dev, cmd, buf, hba_private); 80 } 81 return rc; 82 } 83 84 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun, 85 uint8_t *buf, void *hba_private) 86 { 87 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 88 if (sc->alloc_req) { 89 return sc->alloc_req(s, tag, lun, buf, hba_private); 90 } 91 92 return NULL; 93 } 94 95 void scsi_device_unit_attention_reported(SCSIDevice *s) 96 { 97 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 98 if (sc->unit_attention_reported) { 99 sc->unit_attention_reported(s); 100 } 101 } 102 103 /* Create a scsi bus, and attach devices to it. */ 104 void scsi_bus_new(SCSIBus *bus, size_t bus_size, DeviceState *host, 105 const SCSIBusInfo *info, const char *bus_name) 106 { 107 qbus_create_inplace(bus, bus_size, TYPE_SCSI_BUS, host, bus_name); 108 bus->busnr = next_scsi_bus++; 109 bus->info = info; 110 qbus_set_bus_hotplug_handler(BUS(bus), &error_abort); 111 } 112 113 static void scsi_dma_restart_bh(void *opaque) 114 { 115 SCSIDevice *s = opaque; 116 SCSIRequest *req, *next; 117 118 qemu_bh_delete(s->bh); 119 s->bh = NULL; 120 121 aio_context_acquire(blk_get_aio_context(s->conf.blk)); 122 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) { 123 scsi_req_ref(req); 124 if (req->retry) { 125 req->retry = false; 126 switch (req->cmd.mode) { 127 case SCSI_XFER_FROM_DEV: 128 case SCSI_XFER_TO_DEV: 129 scsi_req_continue(req); 130 break; 131 case SCSI_XFER_NONE: 132 scsi_req_dequeue(req); 133 scsi_req_enqueue(req); 134 break; 135 } 136 } 137 scsi_req_unref(req); 138 } 139 aio_context_release(blk_get_aio_context(s->conf.blk)); 140 } 141 142 void scsi_req_retry(SCSIRequest *req) 143 { 144 /* No need to save a reference, because scsi_dma_restart_bh just 145 * looks at the request list. */ 146 req->retry = true; 147 } 148 149 static void scsi_dma_restart_cb(void *opaque, int running, RunState state) 150 { 151 SCSIDevice *s = opaque; 152 153 if (!running) { 154 return; 155 } 156 if (!s->bh) { 157 AioContext *ctx = blk_get_aio_context(s->conf.blk); 158 s->bh = aio_bh_new(ctx, scsi_dma_restart_bh, s); 159 qemu_bh_schedule(s->bh); 160 } 161 } 162 163 static void scsi_qdev_realize(DeviceState *qdev, Error **errp) 164 { 165 SCSIDevice *dev = SCSI_DEVICE(qdev); 166 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 167 SCSIDevice *d; 168 Error *local_err = NULL; 169 170 if (dev->channel > bus->info->max_channel) { 171 error_setg(errp, "bad scsi channel id: %d", dev->channel); 172 return; 173 } 174 if (dev->id != -1 && dev->id > bus->info->max_target) { 175 error_setg(errp, "bad scsi device id: %d", dev->id); 176 return; 177 } 178 if (dev->lun != -1 && dev->lun > bus->info->max_lun) { 179 error_setg(errp, "bad scsi device lun: %d", dev->lun); 180 return; 181 } 182 183 if (dev->id == -1) { 184 int id = -1; 185 if (dev->lun == -1) { 186 dev->lun = 0; 187 } 188 do { 189 d = scsi_device_find(bus, dev->channel, ++id, dev->lun); 190 } while (d && d->lun == dev->lun && id < bus->info->max_target); 191 if (d && d->lun == dev->lun) { 192 error_setg(errp, "no free target"); 193 return; 194 } 195 dev->id = id; 196 } else if (dev->lun == -1) { 197 int lun = -1; 198 do { 199 d = scsi_device_find(bus, dev->channel, dev->id, ++lun); 200 } while (d && d->lun == lun && lun < bus->info->max_lun); 201 if (d && d->lun == lun) { 202 error_setg(errp, "no free lun"); 203 return; 204 } 205 dev->lun = lun; 206 } else { 207 d = scsi_device_find(bus, dev->channel, dev->id, dev->lun); 208 assert(d); 209 if (d->lun == dev->lun && dev != d) { 210 error_setg(errp, "lun already used by '%s'", d->qdev.id); 211 return; 212 } 213 } 214 215 QTAILQ_INIT(&dev->requests); 216 scsi_device_realize(dev, &local_err); 217 if (local_err) { 218 error_propagate(errp, local_err); 219 return; 220 } 221 dev->vmsentry = qdev_add_vm_change_state_handler(DEVICE(dev), 222 scsi_dma_restart_cb, dev); 223 } 224 225 static void scsi_qdev_unrealize(DeviceState *qdev) 226 { 227 SCSIDevice *dev = SCSI_DEVICE(qdev); 228 229 if (dev->vmsentry) { 230 qemu_del_vm_change_state_handler(dev->vmsentry); 231 } 232 233 scsi_device_purge_requests(dev, SENSE_CODE(NO_SENSE)); 234 235 scsi_device_unrealize(dev); 236 237 blockdev_mark_auto_del(dev->conf.blk); 238 } 239 240 /* handle legacy '-drive if=scsi,...' cmd line args */ 241 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockBackend *blk, 242 int unit, bool removable, int bootindex, 243 bool share_rw, 244 BlockdevOnError rerror, 245 BlockdevOnError werror, 246 const char *serial, Error **errp) 247 { 248 const char *driver; 249 char *name; 250 DeviceState *dev; 251 Error *err = NULL; 252 DriveInfo *dinfo; 253 254 if (blk_is_sg(blk)) { 255 driver = "scsi-generic"; 256 } else { 257 dinfo = blk_legacy_dinfo(blk); 258 if (dinfo && dinfo->media_cd) { 259 driver = "scsi-cd"; 260 } else { 261 driver = "scsi-hd"; 262 } 263 } 264 dev = qdev_create(&bus->qbus, driver); 265 name = g_strdup_printf("legacy[%d]", unit); 266 object_property_add_child(OBJECT(bus), name, OBJECT(dev)); 267 g_free(name); 268 269 qdev_prop_set_uint32(dev, "scsi-id", unit); 270 if (bootindex >= 0) { 271 object_property_set_int(OBJECT(dev), bootindex, "bootindex", 272 &error_abort); 273 } 274 if (object_property_find(OBJECT(dev), "removable", NULL)) { 275 qdev_prop_set_bit(dev, "removable", removable); 276 } 277 if (serial && object_property_find(OBJECT(dev), "serial", NULL)) { 278 qdev_prop_set_string(dev, "serial", serial); 279 } 280 qdev_prop_set_drive(dev, "drive", blk, &err); 281 if (err) { 282 error_propagate(errp, err); 283 object_unparent(OBJECT(dev)); 284 return NULL; 285 } 286 object_property_set_bool(OBJECT(dev), share_rw, "share-rw", &err); 287 if (err != NULL) { 288 error_propagate(errp, err); 289 object_unparent(OBJECT(dev)); 290 return NULL; 291 } 292 293 qdev_prop_set_enum(dev, "rerror", rerror); 294 qdev_prop_set_enum(dev, "werror", werror); 295 296 object_property_set_bool(OBJECT(dev), true, "realized", &err); 297 if (err != NULL) { 298 error_propagate(errp, err); 299 object_unparent(OBJECT(dev)); 300 return NULL; 301 } 302 return SCSI_DEVICE(dev); 303 } 304 305 void scsi_bus_legacy_handle_cmdline(SCSIBus *bus) 306 { 307 Location loc; 308 DriveInfo *dinfo; 309 int unit; 310 311 loc_push_none(&loc); 312 for (unit = 0; unit <= bus->info->max_target; unit++) { 313 dinfo = drive_get(IF_SCSI, bus->busnr, unit); 314 if (dinfo == NULL) { 315 continue; 316 } 317 qemu_opts_loc_restore(dinfo->opts); 318 scsi_bus_legacy_add_drive(bus, blk_by_legacy_dinfo(dinfo), 319 unit, false, -1, false, 320 BLOCKDEV_ON_ERROR_AUTO, 321 BLOCKDEV_ON_ERROR_AUTO, 322 NULL, &error_fatal); 323 } 324 loc_pop(&loc); 325 } 326 327 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf) 328 { 329 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD)); 330 scsi_req_complete(req, CHECK_CONDITION); 331 return 0; 332 } 333 334 static const struct SCSIReqOps reqops_invalid_field = { 335 .size = sizeof(SCSIRequest), 336 .send_command = scsi_invalid_field 337 }; 338 339 /* SCSIReqOps implementation for invalid commands. */ 340 341 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf) 342 { 343 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE)); 344 scsi_req_complete(req, CHECK_CONDITION); 345 return 0; 346 } 347 348 static const struct SCSIReqOps reqops_invalid_opcode = { 349 .size = sizeof(SCSIRequest), 350 .send_command = scsi_invalid_command 351 }; 352 353 /* SCSIReqOps implementation for unit attention conditions. */ 354 355 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf) 356 { 357 if (req->dev->unit_attention.key == UNIT_ATTENTION) { 358 scsi_req_build_sense(req, req->dev->unit_attention); 359 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) { 360 scsi_req_build_sense(req, req->bus->unit_attention); 361 } 362 scsi_req_complete(req, CHECK_CONDITION); 363 return 0; 364 } 365 366 static const struct SCSIReqOps reqops_unit_attention = { 367 .size = sizeof(SCSIRequest), 368 .send_command = scsi_unit_attention 369 }; 370 371 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to 372 an invalid LUN. */ 373 374 typedef struct SCSITargetReq SCSITargetReq; 375 376 struct SCSITargetReq { 377 SCSIRequest req; 378 int len; 379 uint8_t *buf; 380 int buf_len; 381 }; 382 383 static void store_lun(uint8_t *outbuf, int lun) 384 { 385 if (lun < 256) { 386 outbuf[1] = lun; 387 return; 388 } 389 outbuf[1] = (lun & 255); 390 outbuf[0] = (lun >> 8) | 0x40; 391 } 392 393 static bool scsi_target_emulate_report_luns(SCSITargetReq *r) 394 { 395 BusChild *kid; 396 int i, len, n; 397 int channel, id; 398 bool found_lun0; 399 400 if (r->req.cmd.xfer < 16) { 401 return false; 402 } 403 if (r->req.cmd.buf[2] > 2) { 404 return false; 405 } 406 channel = r->req.dev->channel; 407 id = r->req.dev->id; 408 found_lun0 = false; 409 n = 0; 410 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) { 411 DeviceState *qdev = kid->child; 412 SCSIDevice *dev = SCSI_DEVICE(qdev); 413 414 if (dev->channel == channel && dev->id == id) { 415 if (dev->lun == 0) { 416 found_lun0 = true; 417 } 418 n += 8; 419 } 420 } 421 if (!found_lun0) { 422 n += 8; 423 } 424 425 scsi_target_alloc_buf(&r->req, n + 8); 426 427 len = MIN(n + 8, r->req.cmd.xfer & ~7); 428 memset(r->buf, 0, len); 429 stl_be_p(&r->buf[0], n); 430 i = found_lun0 ? 8 : 16; 431 QTAILQ_FOREACH(kid, &r->req.bus->qbus.children, sibling) { 432 DeviceState *qdev = kid->child; 433 SCSIDevice *dev = SCSI_DEVICE(qdev); 434 435 if (dev->channel == channel && dev->id == id) { 436 store_lun(&r->buf[i], dev->lun); 437 i += 8; 438 } 439 } 440 assert(i == n + 8); 441 r->len = len; 442 return true; 443 } 444 445 static bool scsi_target_emulate_inquiry(SCSITargetReq *r) 446 { 447 assert(r->req.dev->lun != r->req.lun); 448 449 scsi_target_alloc_buf(&r->req, SCSI_INQUIRY_LEN); 450 451 if (r->req.cmd.buf[1] & 0x2) { 452 /* Command support data - optional, not implemented */ 453 return false; 454 } 455 456 if (r->req.cmd.buf[1] & 0x1) { 457 /* Vital product data */ 458 uint8_t page_code = r->req.cmd.buf[2]; 459 r->buf[r->len++] = page_code ; /* this page */ 460 r->buf[r->len++] = 0x00; 461 462 switch (page_code) { 463 case 0x00: /* Supported page codes, mandatory */ 464 { 465 int pages; 466 pages = r->len++; 467 r->buf[r->len++] = 0x00; /* list of supported pages (this page) */ 468 r->buf[pages] = r->len - pages - 1; /* number of pages */ 469 break; 470 } 471 default: 472 return false; 473 } 474 /* done with EVPD */ 475 assert(r->len < r->buf_len); 476 r->len = MIN(r->req.cmd.xfer, r->len); 477 return true; 478 } 479 480 /* Standard INQUIRY data */ 481 if (r->req.cmd.buf[2] != 0) { 482 return false; 483 } 484 485 /* PAGE CODE == 0 */ 486 r->len = MIN(r->req.cmd.xfer, SCSI_INQUIRY_LEN); 487 memset(r->buf, 0, r->len); 488 if (r->req.lun != 0) { 489 r->buf[0] = TYPE_NO_LUN; 490 } else { 491 r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE; 492 r->buf[2] = 5; /* Version */ 493 r->buf[3] = 2 | 0x10; /* HiSup, response data format */ 494 r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */ 495 r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ. */ 496 memcpy(&r->buf[8], "QEMU ", 8); 497 memcpy(&r->buf[16], "QEMU TARGET ", 16); 498 pstrcpy((char *) &r->buf[32], 4, qemu_hw_version()); 499 } 500 return true; 501 } 502 503 static size_t scsi_sense_len(SCSIRequest *req) 504 { 505 if (req->dev->type == TYPE_SCANNER) 506 return SCSI_SENSE_LEN_SCANNER; 507 else 508 return SCSI_SENSE_LEN; 509 } 510 511 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf) 512 { 513 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 514 int fixed_sense = (req->cmd.buf[1] & 1) == 0; 515 516 if (req->lun != 0 && 517 buf[0] != INQUIRY && buf[0] != REQUEST_SENSE) { 518 scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED)); 519 scsi_req_complete(req, CHECK_CONDITION); 520 return 0; 521 } 522 switch (buf[0]) { 523 case REPORT_LUNS: 524 if (!scsi_target_emulate_report_luns(r)) { 525 goto illegal_request; 526 } 527 break; 528 case INQUIRY: 529 if (!scsi_target_emulate_inquiry(r)) { 530 goto illegal_request; 531 } 532 break; 533 case REQUEST_SENSE: 534 scsi_target_alloc_buf(&r->req, scsi_sense_len(req)); 535 if (req->lun != 0) { 536 const struct SCSISense sense = SENSE_CODE(LUN_NOT_SUPPORTED); 537 538 r->len = scsi_build_sense_buf(r->buf, req->cmd.xfer, 539 sense, fixed_sense); 540 } else { 541 r->len = scsi_device_get_sense(r->req.dev, r->buf, 542 MIN(req->cmd.xfer, r->buf_len), 543 fixed_sense); 544 } 545 if (r->req.dev->sense_is_ua) { 546 scsi_device_unit_attention_reported(req->dev); 547 r->req.dev->sense_len = 0; 548 r->req.dev->sense_is_ua = false; 549 } 550 break; 551 case TEST_UNIT_READY: 552 break; 553 default: 554 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE)); 555 scsi_req_complete(req, CHECK_CONDITION); 556 return 0; 557 illegal_request: 558 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD)); 559 scsi_req_complete(req, CHECK_CONDITION); 560 return 0; 561 } 562 563 if (!r->len) { 564 scsi_req_complete(req, GOOD); 565 } 566 return r->len; 567 } 568 569 static void scsi_target_read_data(SCSIRequest *req) 570 { 571 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 572 uint32_t n; 573 574 n = r->len; 575 if (n > 0) { 576 r->len = 0; 577 scsi_req_data(&r->req, n); 578 } else { 579 scsi_req_complete(&r->req, GOOD); 580 } 581 } 582 583 static uint8_t *scsi_target_get_buf(SCSIRequest *req) 584 { 585 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 586 587 return r->buf; 588 } 589 590 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len) 591 { 592 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 593 594 r->buf = g_malloc(len); 595 r->buf_len = len; 596 597 return r->buf; 598 } 599 600 static void scsi_target_free_buf(SCSIRequest *req) 601 { 602 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 603 604 g_free(r->buf); 605 } 606 607 static const struct SCSIReqOps reqops_target_command = { 608 .size = sizeof(SCSITargetReq), 609 .send_command = scsi_target_send_command, 610 .read_data = scsi_target_read_data, 611 .get_buf = scsi_target_get_buf, 612 .free_req = scsi_target_free_buf, 613 }; 614 615 616 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d, 617 uint32_t tag, uint32_t lun, void *hba_private) 618 { 619 SCSIRequest *req; 620 SCSIBus *bus = scsi_bus_from_device(d); 621 BusState *qbus = BUS(bus); 622 const int memset_off = offsetof(SCSIRequest, sense) 623 + sizeof(req->sense); 624 625 req = g_malloc(reqops->size); 626 memset((uint8_t *)req + memset_off, 0, reqops->size - memset_off); 627 req->refcount = 1; 628 req->bus = bus; 629 req->dev = d; 630 req->tag = tag; 631 req->lun = lun; 632 req->hba_private = hba_private; 633 req->status = -1; 634 req->ops = reqops; 635 object_ref(OBJECT(d)); 636 object_ref(OBJECT(qbus->parent)); 637 notifier_list_init(&req->cancel_notifiers); 638 trace_scsi_req_alloc(req->dev->id, req->lun, req->tag); 639 return req; 640 } 641 642 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun, 643 uint8_t *buf, void *hba_private) 644 { 645 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus); 646 const SCSIReqOps *ops; 647 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(d); 648 SCSIRequest *req; 649 SCSICommand cmd = { .len = 0 }; 650 int ret; 651 652 if ((d->unit_attention.key == UNIT_ATTENTION || 653 bus->unit_attention.key == UNIT_ATTENTION) && 654 (buf[0] != INQUIRY && 655 buf[0] != REPORT_LUNS && 656 buf[0] != GET_CONFIGURATION && 657 buf[0] != GET_EVENT_STATUS_NOTIFICATION && 658 659 /* 660 * If we already have a pending unit attention condition, 661 * report this one before triggering another one. 662 */ 663 !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) { 664 ops = &reqops_unit_attention; 665 } else if (lun != d->lun || 666 buf[0] == REPORT_LUNS || 667 (buf[0] == REQUEST_SENSE && d->sense_len)) { 668 ops = &reqops_target_command; 669 } else { 670 ops = NULL; 671 } 672 673 if (ops != NULL || !sc->parse_cdb) { 674 ret = scsi_req_parse_cdb(d, &cmd, buf); 675 } else { 676 ret = sc->parse_cdb(d, &cmd, buf, hba_private); 677 } 678 679 if (ret != 0) { 680 trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]); 681 req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private); 682 } else { 683 assert(cmd.len != 0); 684 trace_scsi_req_parsed(d->id, lun, tag, buf[0], 685 cmd.mode, cmd.xfer); 686 if (cmd.lba != -1) { 687 trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0], 688 cmd.lba); 689 } 690 691 if (cmd.xfer > INT32_MAX) { 692 req = scsi_req_alloc(&reqops_invalid_field, d, tag, lun, hba_private); 693 } else if (ops) { 694 req = scsi_req_alloc(ops, d, tag, lun, hba_private); 695 } else { 696 req = scsi_device_alloc_req(d, tag, lun, buf, hba_private); 697 } 698 } 699 700 req->cmd = cmd; 701 req->resid = req->cmd.xfer; 702 703 switch (buf[0]) { 704 case INQUIRY: 705 trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]); 706 break; 707 case TEST_UNIT_READY: 708 trace_scsi_test_unit_ready(d->id, lun, tag); 709 break; 710 case REPORT_LUNS: 711 trace_scsi_report_luns(d->id, lun, tag); 712 break; 713 case REQUEST_SENSE: 714 trace_scsi_request_sense(d->id, lun, tag); 715 break; 716 default: 717 break; 718 } 719 720 return req; 721 } 722 723 uint8_t *scsi_req_get_buf(SCSIRequest *req) 724 { 725 return req->ops->get_buf(req); 726 } 727 728 static void scsi_clear_unit_attention(SCSIRequest *req) 729 { 730 SCSISense *ua; 731 if (req->dev->unit_attention.key != UNIT_ATTENTION && 732 req->bus->unit_attention.key != UNIT_ATTENTION) { 733 return; 734 } 735 736 /* 737 * If an INQUIRY command enters the enabled command state, 738 * the device server shall [not] clear any unit attention condition; 739 * See also MMC-6, paragraphs 6.5 and 6.6.2. 740 */ 741 if (req->cmd.buf[0] == INQUIRY || 742 req->cmd.buf[0] == GET_CONFIGURATION || 743 req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) { 744 return; 745 } 746 747 if (req->dev->unit_attention.key == UNIT_ATTENTION) { 748 ua = &req->dev->unit_attention; 749 } else { 750 ua = &req->bus->unit_attention; 751 } 752 753 /* 754 * If a REPORT LUNS command enters the enabled command state, [...] 755 * the device server shall clear any pending unit attention condition 756 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED. 757 */ 758 if (req->cmd.buf[0] == REPORT_LUNS && 759 !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc && 760 ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) { 761 return; 762 } 763 764 *ua = SENSE_CODE(NO_SENSE); 765 } 766 767 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len) 768 { 769 int ret; 770 771 assert(len >= 14); 772 if (!req->sense_len) { 773 return 0; 774 } 775 776 ret = scsi_convert_sense(req->sense, req->sense_len, buf, len, true); 777 778 /* 779 * FIXME: clearing unit attention conditions upon autosense should be done 780 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b 781 * (SAM-5, 5.14). 782 * 783 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and 784 * 10b for HBAs that do not support it (do not call scsi_req_get_sense). 785 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b. 786 */ 787 if (req->dev->sense_is_ua) { 788 scsi_device_unit_attention_reported(req->dev); 789 req->dev->sense_len = 0; 790 req->dev->sense_is_ua = false; 791 } 792 return ret; 793 } 794 795 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed) 796 { 797 return scsi_convert_sense(dev->sense, dev->sense_len, buf, len, fixed); 798 } 799 800 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense) 801 { 802 trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag, 803 sense.key, sense.asc, sense.ascq); 804 req->sense_len = scsi_build_sense(req->sense, sense); 805 } 806 807 static void scsi_req_enqueue_internal(SCSIRequest *req) 808 { 809 assert(!req->enqueued); 810 scsi_req_ref(req); 811 if (req->bus->info->get_sg_list) { 812 req->sg = req->bus->info->get_sg_list(req); 813 } else { 814 req->sg = NULL; 815 } 816 req->enqueued = true; 817 QTAILQ_INSERT_TAIL(&req->dev->requests, req, next); 818 } 819 820 int32_t scsi_req_enqueue(SCSIRequest *req) 821 { 822 int32_t rc; 823 824 assert(!req->retry); 825 scsi_req_enqueue_internal(req); 826 scsi_req_ref(req); 827 rc = req->ops->send_command(req, req->cmd.buf); 828 scsi_req_unref(req); 829 return rc; 830 } 831 832 static void scsi_req_dequeue(SCSIRequest *req) 833 { 834 trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag); 835 req->retry = false; 836 if (req->enqueued) { 837 QTAILQ_REMOVE(&req->dev->requests, req, next); 838 req->enqueued = false; 839 scsi_req_unref(req); 840 } 841 } 842 843 static int scsi_get_performance_length(int num_desc, int type, int data_type) 844 { 845 /* MMC-6, paragraph 6.7. */ 846 switch (type) { 847 case 0: 848 if ((data_type & 3) == 0) { 849 /* Each descriptor is as in Table 295 - Nominal performance. */ 850 return 16 * num_desc + 8; 851 } else { 852 /* Each descriptor is as in Table 296 - Exceptions. */ 853 return 6 * num_desc + 8; 854 } 855 case 1: 856 case 4: 857 case 5: 858 return 8 * num_desc + 8; 859 case 2: 860 return 2048 * num_desc + 8; 861 case 3: 862 return 16 * num_desc + 8; 863 default: 864 return 8; 865 } 866 } 867 868 static int ata_passthrough_xfer_unit(SCSIDevice *dev, uint8_t *buf) 869 { 870 int byte_block = (buf[2] >> 2) & 0x1; 871 int type = (buf[2] >> 4) & 0x1; 872 int xfer_unit; 873 874 if (byte_block) { 875 if (type) { 876 xfer_unit = dev->blocksize; 877 } else { 878 xfer_unit = 512; 879 } 880 } else { 881 xfer_unit = 1; 882 } 883 884 return xfer_unit; 885 } 886 887 static int ata_passthrough_12_xfer(SCSIDevice *dev, uint8_t *buf) 888 { 889 int length = buf[2] & 0x3; 890 int xfer; 891 int unit = ata_passthrough_xfer_unit(dev, buf); 892 893 switch (length) { 894 case 0: 895 case 3: /* USB-specific. */ 896 default: 897 xfer = 0; 898 break; 899 case 1: 900 xfer = buf[3]; 901 break; 902 case 2: 903 xfer = buf[4]; 904 break; 905 } 906 907 return xfer * unit; 908 } 909 910 static int ata_passthrough_16_xfer(SCSIDevice *dev, uint8_t *buf) 911 { 912 int extend = buf[1] & 0x1; 913 int length = buf[2] & 0x3; 914 int xfer; 915 int unit = ata_passthrough_xfer_unit(dev, buf); 916 917 switch (length) { 918 case 0: 919 case 3: /* USB-specific. */ 920 default: 921 xfer = 0; 922 break; 923 case 1: 924 xfer = buf[4]; 925 xfer |= (extend ? buf[3] << 8 : 0); 926 break; 927 case 2: 928 xfer = buf[6]; 929 xfer |= (extend ? buf[5] << 8 : 0); 930 break; 931 } 932 933 return xfer * unit; 934 } 935 936 static int scsi_req_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 937 { 938 cmd->xfer = scsi_cdb_xfer(buf); 939 switch (buf[0]) { 940 case TEST_UNIT_READY: 941 case REWIND: 942 case START_STOP: 943 case SET_CAPACITY: 944 case WRITE_FILEMARKS: 945 case WRITE_FILEMARKS_16: 946 case SPACE: 947 case RESERVE: 948 case RELEASE: 949 case ERASE: 950 case ALLOW_MEDIUM_REMOVAL: 951 case SEEK_10: 952 case SYNCHRONIZE_CACHE: 953 case SYNCHRONIZE_CACHE_16: 954 case LOCATE_16: 955 case LOCK_UNLOCK_CACHE: 956 case SET_CD_SPEED: 957 case SET_LIMITS: 958 case WRITE_LONG_10: 959 case UPDATE_BLOCK: 960 case RESERVE_TRACK: 961 case SET_READ_AHEAD: 962 case PRE_FETCH: 963 case PRE_FETCH_16: 964 case ALLOW_OVERWRITE: 965 cmd->xfer = 0; 966 break; 967 case VERIFY_10: 968 case VERIFY_12: 969 case VERIFY_16: 970 if ((buf[1] & 2) == 0) { 971 cmd->xfer = 0; 972 } else if ((buf[1] & 4) != 0) { 973 cmd->xfer = 1; 974 } 975 cmd->xfer *= dev->blocksize; 976 break; 977 case MODE_SENSE: 978 break; 979 case WRITE_SAME_10: 980 case WRITE_SAME_16: 981 cmd->xfer = buf[1] & 1 ? 0 : dev->blocksize; 982 break; 983 case READ_CAPACITY_10: 984 cmd->xfer = 8; 985 break; 986 case READ_BLOCK_LIMITS: 987 cmd->xfer = 6; 988 break; 989 case SEND_VOLUME_TAG: 990 /* GPCMD_SET_STREAMING from multimedia commands. */ 991 if (dev->type == TYPE_ROM) { 992 cmd->xfer = buf[10] | (buf[9] << 8); 993 } else { 994 cmd->xfer = buf[9] | (buf[8] << 8); 995 } 996 break; 997 case WRITE_6: 998 /* length 0 means 256 blocks */ 999 if (cmd->xfer == 0) { 1000 cmd->xfer = 256; 1001 } 1002 /* fall through */ 1003 case WRITE_10: 1004 case WRITE_VERIFY_10: 1005 case WRITE_12: 1006 case WRITE_VERIFY_12: 1007 case WRITE_16: 1008 case WRITE_VERIFY_16: 1009 cmd->xfer *= dev->blocksize; 1010 break; 1011 case READ_6: 1012 case READ_REVERSE: 1013 /* length 0 means 256 blocks */ 1014 if (cmd->xfer == 0) { 1015 cmd->xfer = 256; 1016 } 1017 /* fall through */ 1018 case READ_10: 1019 case READ_12: 1020 case READ_16: 1021 cmd->xfer *= dev->blocksize; 1022 break; 1023 case FORMAT_UNIT: 1024 /* MMC mandates the parameter list to be 12-bytes long. Parameters 1025 * for block devices are restricted to the header right now. */ 1026 if (dev->type == TYPE_ROM && (buf[1] & 16)) { 1027 cmd->xfer = 12; 1028 } else { 1029 cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4); 1030 } 1031 break; 1032 case INQUIRY: 1033 case RECEIVE_DIAGNOSTIC: 1034 case SEND_DIAGNOSTIC: 1035 cmd->xfer = buf[4] | (buf[3] << 8); 1036 break; 1037 case READ_CD: 1038 case READ_BUFFER: 1039 case WRITE_BUFFER: 1040 case SEND_CUE_SHEET: 1041 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16); 1042 break; 1043 case PERSISTENT_RESERVE_OUT: 1044 cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL; 1045 break; 1046 case ERASE_12: 1047 if (dev->type == TYPE_ROM) { 1048 /* MMC command GET PERFORMANCE. */ 1049 cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8), 1050 buf[10], buf[1] & 0x1f); 1051 } 1052 break; 1053 case MECHANISM_STATUS: 1054 case READ_DVD_STRUCTURE: 1055 case SEND_DVD_STRUCTURE: 1056 case MAINTENANCE_OUT: 1057 case MAINTENANCE_IN: 1058 if (dev->type == TYPE_ROM) { 1059 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */ 1060 cmd->xfer = buf[9] | (buf[8] << 8); 1061 } 1062 break; 1063 case ATA_PASSTHROUGH_12: 1064 if (dev->type == TYPE_ROM) { 1065 /* BLANK command of MMC */ 1066 cmd->xfer = 0; 1067 } else { 1068 cmd->xfer = ata_passthrough_12_xfer(dev, buf); 1069 } 1070 break; 1071 case ATA_PASSTHROUGH_16: 1072 cmd->xfer = ata_passthrough_16_xfer(dev, buf); 1073 break; 1074 } 1075 return 0; 1076 } 1077 1078 static int scsi_req_stream_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1079 { 1080 switch (buf[0]) { 1081 /* stream commands */ 1082 case ERASE_12: 1083 case ERASE_16: 1084 cmd->xfer = 0; 1085 break; 1086 case READ_6: 1087 case READ_REVERSE: 1088 case RECOVER_BUFFERED_DATA: 1089 case WRITE_6: 1090 cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16); 1091 if (buf[1] & 0x01) { /* fixed */ 1092 cmd->xfer *= dev->blocksize; 1093 } 1094 break; 1095 case READ_16: 1096 case READ_REVERSE_16: 1097 case VERIFY_16: 1098 case WRITE_16: 1099 cmd->xfer = buf[14] | (buf[13] << 8) | (buf[12] << 16); 1100 if (buf[1] & 0x01) { /* fixed */ 1101 cmd->xfer *= dev->blocksize; 1102 } 1103 break; 1104 case REWIND: 1105 case LOAD_UNLOAD: 1106 cmd->xfer = 0; 1107 break; 1108 case SPACE_16: 1109 cmd->xfer = buf[13] | (buf[12] << 8); 1110 break; 1111 case READ_POSITION: 1112 switch (buf[1] & 0x1f) /* operation code */ { 1113 case SHORT_FORM_BLOCK_ID: 1114 case SHORT_FORM_VENDOR_SPECIFIC: 1115 cmd->xfer = 20; 1116 break; 1117 case LONG_FORM: 1118 cmd->xfer = 32; 1119 break; 1120 case EXTENDED_FORM: 1121 cmd->xfer = buf[8] | (buf[7] << 8); 1122 break; 1123 default: 1124 return -1; 1125 } 1126 1127 break; 1128 case FORMAT_UNIT: 1129 cmd->xfer = buf[4] | (buf[3] << 8); 1130 break; 1131 /* generic commands */ 1132 default: 1133 return scsi_req_xfer(cmd, dev, buf); 1134 } 1135 return 0; 1136 } 1137 1138 static int scsi_req_medium_changer_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1139 { 1140 switch (buf[0]) { 1141 /* medium changer commands */ 1142 case EXCHANGE_MEDIUM: 1143 case INITIALIZE_ELEMENT_STATUS: 1144 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE: 1145 case MOVE_MEDIUM: 1146 case POSITION_TO_ELEMENT: 1147 cmd->xfer = 0; 1148 break; 1149 case READ_ELEMENT_STATUS: 1150 cmd->xfer = buf[9] | (buf[8] << 8) | (buf[7] << 16); 1151 break; 1152 1153 /* generic commands */ 1154 default: 1155 return scsi_req_xfer(cmd, dev, buf); 1156 } 1157 return 0; 1158 } 1159 1160 static int scsi_req_scanner_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1161 { 1162 switch (buf[0]) { 1163 /* Scanner commands */ 1164 case OBJECT_POSITION: 1165 cmd->xfer = 0; 1166 break; 1167 case SCAN: 1168 cmd->xfer = buf[4]; 1169 break; 1170 case READ_10: 1171 case SEND: 1172 case GET_WINDOW: 1173 case SET_WINDOW: 1174 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16); 1175 break; 1176 default: 1177 /* GET_DATA_BUFFER_STATUS xfer handled by scsi_req_xfer */ 1178 return scsi_req_xfer(cmd, dev, buf); 1179 } 1180 1181 return 0; 1182 } 1183 1184 static void scsi_cmd_xfer_mode(SCSICommand *cmd) 1185 { 1186 if (!cmd->xfer) { 1187 cmd->mode = SCSI_XFER_NONE; 1188 return; 1189 } 1190 switch (cmd->buf[0]) { 1191 case WRITE_6: 1192 case WRITE_10: 1193 case WRITE_VERIFY_10: 1194 case WRITE_12: 1195 case WRITE_VERIFY_12: 1196 case WRITE_16: 1197 case WRITE_VERIFY_16: 1198 case VERIFY_10: 1199 case VERIFY_12: 1200 case VERIFY_16: 1201 case COPY: 1202 case COPY_VERIFY: 1203 case COMPARE: 1204 case CHANGE_DEFINITION: 1205 case LOG_SELECT: 1206 case MODE_SELECT: 1207 case MODE_SELECT_10: 1208 case SEND_DIAGNOSTIC: 1209 case WRITE_BUFFER: 1210 case FORMAT_UNIT: 1211 case REASSIGN_BLOCKS: 1212 case SEARCH_EQUAL: 1213 case SEARCH_HIGH: 1214 case SEARCH_LOW: 1215 case UPDATE_BLOCK: 1216 case WRITE_LONG_10: 1217 case WRITE_SAME_10: 1218 case WRITE_SAME_16: 1219 case UNMAP: 1220 case SEARCH_HIGH_12: 1221 case SEARCH_EQUAL_12: 1222 case SEARCH_LOW_12: 1223 case MEDIUM_SCAN: 1224 case SEND_VOLUME_TAG: 1225 case SEND_CUE_SHEET: 1226 case SEND_DVD_STRUCTURE: 1227 case PERSISTENT_RESERVE_OUT: 1228 case MAINTENANCE_OUT: 1229 case SET_WINDOW: 1230 case SCAN: 1231 /* SCAN conflicts with START_STOP. START_STOP has cmd->xfer set to 0 for 1232 * non-scanner devices, so we only get here for SCAN and not for START_STOP. 1233 */ 1234 cmd->mode = SCSI_XFER_TO_DEV; 1235 break; 1236 case ATA_PASSTHROUGH_12: 1237 case ATA_PASSTHROUGH_16: 1238 /* T_DIR */ 1239 cmd->mode = (cmd->buf[2] & 0x8) ? 1240 SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV; 1241 break; 1242 default: 1243 cmd->mode = SCSI_XFER_FROM_DEV; 1244 break; 1245 } 1246 } 1247 1248 int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf) 1249 { 1250 int rc; 1251 int len; 1252 1253 cmd->lba = -1; 1254 len = scsi_cdb_length(buf); 1255 if (len < 0) { 1256 return -1; 1257 } 1258 1259 cmd->len = len; 1260 switch (dev->type) { 1261 case TYPE_TAPE: 1262 rc = scsi_req_stream_xfer(cmd, dev, buf); 1263 break; 1264 case TYPE_MEDIUM_CHANGER: 1265 rc = scsi_req_medium_changer_xfer(cmd, dev, buf); 1266 break; 1267 case TYPE_SCANNER: 1268 rc = scsi_req_scanner_length(cmd, dev, buf); 1269 break; 1270 default: 1271 rc = scsi_req_xfer(cmd, dev, buf); 1272 break; 1273 } 1274 1275 if (rc != 0) 1276 return rc; 1277 1278 memcpy(cmd->buf, buf, cmd->len); 1279 scsi_cmd_xfer_mode(cmd); 1280 cmd->lba = scsi_cmd_lba(cmd); 1281 return 0; 1282 } 1283 1284 void scsi_device_report_change(SCSIDevice *dev, SCSISense sense) 1285 { 1286 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 1287 1288 scsi_device_set_ua(dev, sense); 1289 if (bus->info->change) { 1290 bus->info->change(bus, dev, sense); 1291 } 1292 } 1293 1294 SCSIRequest *scsi_req_ref(SCSIRequest *req) 1295 { 1296 assert(req->refcount > 0); 1297 req->refcount++; 1298 return req; 1299 } 1300 1301 void scsi_req_unref(SCSIRequest *req) 1302 { 1303 assert(req->refcount > 0); 1304 if (--req->refcount == 0) { 1305 BusState *qbus = req->dev->qdev.parent_bus; 1306 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus); 1307 1308 if (bus->info->free_request && req->hba_private) { 1309 bus->info->free_request(bus, req->hba_private); 1310 } 1311 if (req->ops->free_req) { 1312 req->ops->free_req(req); 1313 } 1314 object_unref(OBJECT(req->dev)); 1315 object_unref(OBJECT(qbus->parent)); 1316 g_free(req); 1317 } 1318 } 1319 1320 /* Tell the device that we finished processing this chunk of I/O. It 1321 will start the next chunk or complete the command. */ 1322 void scsi_req_continue(SCSIRequest *req) 1323 { 1324 if (req->io_canceled) { 1325 trace_scsi_req_continue_canceled(req->dev->id, req->lun, req->tag); 1326 return; 1327 } 1328 trace_scsi_req_continue(req->dev->id, req->lun, req->tag); 1329 if (req->cmd.mode == SCSI_XFER_TO_DEV) { 1330 req->ops->write_data(req); 1331 } else { 1332 req->ops->read_data(req); 1333 } 1334 } 1335 1336 /* Called by the devices when data is ready for the HBA. The HBA should 1337 start a DMA operation to read or fill the device's data buffer. 1338 Once it completes, calling scsi_req_continue will restart I/O. */ 1339 void scsi_req_data(SCSIRequest *req, int len) 1340 { 1341 uint8_t *buf; 1342 if (req->io_canceled) { 1343 trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len); 1344 return; 1345 } 1346 trace_scsi_req_data(req->dev->id, req->lun, req->tag, len); 1347 assert(req->cmd.mode != SCSI_XFER_NONE); 1348 if (!req->sg) { 1349 req->resid -= len; 1350 req->bus->info->transfer_data(req, len); 1351 return; 1352 } 1353 1354 /* If the device calls scsi_req_data and the HBA specified a 1355 * scatter/gather list, the transfer has to happen in a single 1356 * step. */ 1357 assert(!req->dma_started); 1358 req->dma_started = true; 1359 1360 buf = scsi_req_get_buf(req); 1361 if (req->cmd.mode == SCSI_XFER_FROM_DEV) { 1362 req->resid = dma_buf_read(buf, len, req->sg); 1363 } else { 1364 req->resid = dma_buf_write(buf, len, req->sg); 1365 } 1366 scsi_req_continue(req); 1367 } 1368 1369 void scsi_req_print(SCSIRequest *req) 1370 { 1371 FILE *fp = stderr; 1372 int i; 1373 1374 fprintf(fp, "[%s id=%d] %s", 1375 req->dev->qdev.parent_bus->name, 1376 req->dev->id, 1377 scsi_command_name(req->cmd.buf[0])); 1378 for (i = 1; i < req->cmd.len; i++) { 1379 fprintf(fp, " 0x%02x", req->cmd.buf[i]); 1380 } 1381 switch (req->cmd.mode) { 1382 case SCSI_XFER_NONE: 1383 fprintf(fp, " - none\n"); 1384 break; 1385 case SCSI_XFER_FROM_DEV: 1386 fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer); 1387 break; 1388 case SCSI_XFER_TO_DEV: 1389 fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer); 1390 break; 1391 default: 1392 fprintf(fp, " - Oops\n"); 1393 break; 1394 } 1395 } 1396 1397 void scsi_req_complete(SCSIRequest *req, int status) 1398 { 1399 assert(req->status == -1); 1400 req->status = status; 1401 1402 assert(req->sense_len <= sizeof(req->sense)); 1403 if (status == GOOD) { 1404 req->sense_len = 0; 1405 } 1406 1407 if (req->sense_len) { 1408 memcpy(req->dev->sense, req->sense, req->sense_len); 1409 req->dev->sense_len = req->sense_len; 1410 req->dev->sense_is_ua = (req->ops == &reqops_unit_attention); 1411 } else { 1412 req->dev->sense_len = 0; 1413 req->dev->sense_is_ua = false; 1414 } 1415 1416 /* 1417 * Unit attention state is now stored in the device's sense buffer 1418 * if the HBA didn't do autosense. Clear the pending unit attention 1419 * flags. 1420 */ 1421 scsi_clear_unit_attention(req); 1422 1423 scsi_req_ref(req); 1424 scsi_req_dequeue(req); 1425 req->bus->info->complete(req, req->status, req->resid); 1426 1427 /* Cancelled requests might end up being completed instead of cancelled */ 1428 notifier_list_notify(&req->cancel_notifiers, req); 1429 scsi_req_unref(req); 1430 } 1431 1432 /* Called by the devices when the request is canceled. */ 1433 void scsi_req_cancel_complete(SCSIRequest *req) 1434 { 1435 assert(req->io_canceled); 1436 if (req->bus->info->cancel) { 1437 req->bus->info->cancel(req); 1438 } 1439 notifier_list_notify(&req->cancel_notifiers, req); 1440 scsi_req_unref(req); 1441 } 1442 1443 /* Cancel @req asynchronously. @notifier is added to @req's cancellation 1444 * notifier list, the bus will be notified the requests cancellation is 1445 * completed. 1446 * */ 1447 void scsi_req_cancel_async(SCSIRequest *req, Notifier *notifier) 1448 { 1449 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag); 1450 if (notifier) { 1451 notifier_list_add(&req->cancel_notifiers, notifier); 1452 } 1453 if (req->io_canceled) { 1454 /* A blk_aio_cancel_async is pending; when it finishes, 1455 * scsi_req_cancel_complete will be called and will 1456 * call the notifier we just added. Just wait for that. 1457 */ 1458 assert(req->aiocb); 1459 return; 1460 } 1461 /* Dropped in scsi_req_cancel_complete. */ 1462 scsi_req_ref(req); 1463 scsi_req_dequeue(req); 1464 req->io_canceled = true; 1465 if (req->aiocb) { 1466 blk_aio_cancel_async(req->aiocb); 1467 } else { 1468 scsi_req_cancel_complete(req); 1469 } 1470 } 1471 1472 void scsi_req_cancel(SCSIRequest *req) 1473 { 1474 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag); 1475 if (!req->enqueued) { 1476 return; 1477 } 1478 assert(!req->io_canceled); 1479 /* Dropped in scsi_req_cancel_complete. */ 1480 scsi_req_ref(req); 1481 scsi_req_dequeue(req); 1482 req->io_canceled = true; 1483 if (req->aiocb) { 1484 blk_aio_cancel(req->aiocb); 1485 } else { 1486 scsi_req_cancel_complete(req); 1487 } 1488 } 1489 1490 static int scsi_ua_precedence(SCSISense sense) 1491 { 1492 if (sense.key != UNIT_ATTENTION) { 1493 return INT_MAX; 1494 } 1495 if (sense.asc == 0x29 && sense.ascq == 0x04) { 1496 /* DEVICE INTERNAL RESET goes with POWER ON OCCURRED */ 1497 return 1; 1498 } else if (sense.asc == 0x3F && sense.ascq == 0x01) { 1499 /* MICROCODE HAS BEEN CHANGED goes with SCSI BUS RESET OCCURRED */ 1500 return 2; 1501 } else if (sense.asc == 0x29 && (sense.ascq == 0x05 || sense.ascq == 0x06)) { 1502 /* These two go with "all others". */ 1503 ; 1504 } else if (sense.asc == 0x29 && sense.ascq <= 0x07) { 1505 /* POWER ON, RESET OR BUS DEVICE RESET OCCURRED = 0 1506 * POWER ON OCCURRED = 1 1507 * SCSI BUS RESET OCCURRED = 2 1508 * BUS DEVICE RESET FUNCTION OCCURRED = 3 1509 * I_T NEXUS LOSS OCCURRED = 7 1510 */ 1511 return sense.ascq; 1512 } else if (sense.asc == 0x2F && sense.ascq == 0x01) { 1513 /* COMMANDS CLEARED BY POWER LOSS NOTIFICATION */ 1514 return 8; 1515 } 1516 return (sense.asc << 8) | sense.ascq; 1517 } 1518 1519 void scsi_device_set_ua(SCSIDevice *sdev, SCSISense sense) 1520 { 1521 int prec1, prec2; 1522 if (sense.key != UNIT_ATTENTION) { 1523 return; 1524 } 1525 trace_scsi_device_set_ua(sdev->id, sdev->lun, sense.key, 1526 sense.asc, sense.ascq); 1527 1528 /* 1529 * Override a pre-existing unit attention condition, except for a more 1530 * important reset condition. 1531 */ 1532 prec1 = scsi_ua_precedence(sdev->unit_attention); 1533 prec2 = scsi_ua_precedence(sense); 1534 if (prec2 < prec1) { 1535 sdev->unit_attention = sense; 1536 } 1537 } 1538 1539 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense) 1540 { 1541 SCSIRequest *req; 1542 1543 aio_context_acquire(blk_get_aio_context(sdev->conf.blk)); 1544 while (!QTAILQ_EMPTY(&sdev->requests)) { 1545 req = QTAILQ_FIRST(&sdev->requests); 1546 scsi_req_cancel_async(req, NULL); 1547 } 1548 blk_drain(sdev->conf.blk); 1549 aio_context_release(blk_get_aio_context(sdev->conf.blk)); 1550 scsi_device_set_ua(sdev, sense); 1551 } 1552 1553 static char *scsibus_get_dev_path(DeviceState *dev) 1554 { 1555 SCSIDevice *d = SCSI_DEVICE(dev); 1556 DeviceState *hba = dev->parent_bus->parent; 1557 char *id; 1558 char *path; 1559 1560 id = qdev_get_dev_path(hba); 1561 if (id) { 1562 path = g_strdup_printf("%s/%d:%d:%d", id, d->channel, d->id, d->lun); 1563 } else { 1564 path = g_strdup_printf("%d:%d:%d", d->channel, d->id, d->lun); 1565 } 1566 g_free(id); 1567 return path; 1568 } 1569 1570 static char *scsibus_get_fw_dev_path(DeviceState *dev) 1571 { 1572 SCSIDevice *d = SCSI_DEVICE(dev); 1573 return g_strdup_printf("channel@%x/%s@%x,%x", d->channel, 1574 qdev_fw_name(dev), d->id, d->lun); 1575 } 1576 1577 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun) 1578 { 1579 BusChild *kid; 1580 SCSIDevice *target_dev = NULL; 1581 1582 QTAILQ_FOREACH_REVERSE(kid, &bus->qbus.children, sibling) { 1583 DeviceState *qdev = kid->child; 1584 SCSIDevice *dev = SCSI_DEVICE(qdev); 1585 1586 if (dev->channel == channel && dev->id == id) { 1587 if (dev->lun == lun) { 1588 return dev; 1589 } 1590 target_dev = dev; 1591 } 1592 } 1593 return target_dev; 1594 } 1595 1596 /* SCSI request list. For simplicity, pv points to the whole device */ 1597 1598 static int put_scsi_requests(QEMUFile *f, void *pv, size_t size, 1599 const VMStateField *field, QJSON *vmdesc) 1600 { 1601 SCSIDevice *s = pv; 1602 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus); 1603 SCSIRequest *req; 1604 1605 QTAILQ_FOREACH(req, &s->requests, next) { 1606 assert(!req->io_canceled); 1607 assert(req->status == -1); 1608 assert(req->enqueued); 1609 1610 qemu_put_sbyte(f, req->retry ? 1 : 2); 1611 qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf)); 1612 qemu_put_be32s(f, &req->tag); 1613 qemu_put_be32s(f, &req->lun); 1614 if (bus->info->save_request) { 1615 bus->info->save_request(f, req); 1616 } 1617 if (req->ops->save_request) { 1618 req->ops->save_request(f, req); 1619 } 1620 } 1621 qemu_put_sbyte(f, 0); 1622 1623 return 0; 1624 } 1625 1626 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size, 1627 const VMStateField *field) 1628 { 1629 SCSIDevice *s = pv; 1630 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus); 1631 int8_t sbyte; 1632 1633 while ((sbyte = qemu_get_sbyte(f)) > 0) { 1634 uint8_t buf[SCSI_CMD_BUF_SIZE]; 1635 uint32_t tag; 1636 uint32_t lun; 1637 SCSIRequest *req; 1638 1639 qemu_get_buffer(f, buf, sizeof(buf)); 1640 qemu_get_be32s(f, &tag); 1641 qemu_get_be32s(f, &lun); 1642 req = scsi_req_new(s, tag, lun, buf, NULL); 1643 req->retry = (sbyte == 1); 1644 if (bus->info->load_request) { 1645 req->hba_private = bus->info->load_request(f, req); 1646 } 1647 if (req->ops->load_request) { 1648 req->ops->load_request(f, req); 1649 } 1650 1651 /* Just restart it later. */ 1652 scsi_req_enqueue_internal(req); 1653 1654 /* At this point, the request will be kept alive by the reference 1655 * added by scsi_req_enqueue_internal, so we can release our reference. 1656 * The HBA of course will add its own reference in the load_request 1657 * callback if it needs to hold on the SCSIRequest. 1658 */ 1659 scsi_req_unref(req); 1660 } 1661 1662 return 0; 1663 } 1664 1665 static const VMStateInfo vmstate_info_scsi_requests = { 1666 .name = "scsi-requests", 1667 .get = get_scsi_requests, 1668 .put = put_scsi_requests, 1669 }; 1670 1671 static bool scsi_sense_state_needed(void *opaque) 1672 { 1673 SCSIDevice *s = opaque; 1674 1675 return s->sense_len > SCSI_SENSE_BUF_SIZE_OLD; 1676 } 1677 1678 static const VMStateDescription vmstate_scsi_sense_state = { 1679 .name = "SCSIDevice/sense", 1680 .version_id = 1, 1681 .minimum_version_id = 1, 1682 .needed = scsi_sense_state_needed, 1683 .fields = (VMStateField[]) { 1684 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 1685 SCSI_SENSE_BUF_SIZE_OLD, 1686 SCSI_SENSE_BUF_SIZE - SCSI_SENSE_BUF_SIZE_OLD), 1687 VMSTATE_END_OF_LIST() 1688 } 1689 }; 1690 1691 const VMStateDescription vmstate_scsi_device = { 1692 .name = "SCSIDevice", 1693 .version_id = 1, 1694 .minimum_version_id = 1, 1695 .fields = (VMStateField[]) { 1696 VMSTATE_UINT8(unit_attention.key, SCSIDevice), 1697 VMSTATE_UINT8(unit_attention.asc, SCSIDevice), 1698 VMSTATE_UINT8(unit_attention.ascq, SCSIDevice), 1699 VMSTATE_BOOL(sense_is_ua, SCSIDevice), 1700 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 0, SCSI_SENSE_BUF_SIZE_OLD), 1701 VMSTATE_UINT32(sense_len, SCSIDevice), 1702 { 1703 .name = "requests", 1704 .version_id = 0, 1705 .field_exists = NULL, 1706 .size = 0, /* ouch */ 1707 .info = &vmstate_info_scsi_requests, 1708 .flags = VMS_SINGLE, 1709 .offset = 0, 1710 }, 1711 VMSTATE_END_OF_LIST() 1712 }, 1713 .subsections = (const VMStateDescription*[]) { 1714 &vmstate_scsi_sense_state, 1715 NULL 1716 } 1717 }; 1718 1719 static void scsi_device_class_init(ObjectClass *klass, void *data) 1720 { 1721 DeviceClass *k = DEVICE_CLASS(klass); 1722 set_bit(DEVICE_CATEGORY_STORAGE, k->categories); 1723 k->bus_type = TYPE_SCSI_BUS; 1724 k->realize = scsi_qdev_realize; 1725 k->unrealize = scsi_qdev_unrealize; 1726 device_class_set_props(k, scsi_props); 1727 } 1728 1729 static void scsi_dev_instance_init(Object *obj) 1730 { 1731 DeviceState *dev = DEVICE(obj); 1732 SCSIDevice *s = SCSI_DEVICE(dev); 1733 1734 device_add_bootindex_property(obj, &s->conf.bootindex, 1735 "bootindex", NULL, 1736 &s->qdev); 1737 } 1738 1739 static const TypeInfo scsi_device_type_info = { 1740 .name = TYPE_SCSI_DEVICE, 1741 .parent = TYPE_DEVICE, 1742 .instance_size = sizeof(SCSIDevice), 1743 .abstract = true, 1744 .class_size = sizeof(SCSIDeviceClass), 1745 .class_init = scsi_device_class_init, 1746 .instance_init = scsi_dev_instance_init, 1747 }; 1748 1749 static void scsi_register_types(void) 1750 { 1751 type_register_static(&scsi_bus_info); 1752 type_register_static(&scsi_device_type_info); 1753 } 1754 1755 type_init(scsi_register_types) 1756