1 #include "qemu/osdep.h" 2 #include "qapi/error.h" 3 #include "qemu/error-report.h" 4 #include "qemu/module.h" 5 #include "qemu/option.h" 6 #include "qemu/hw-version.h" 7 #include "hw/qdev-properties.h" 8 #include "hw/scsi/scsi.h" 9 #include "migration/qemu-file-types.h" 10 #include "migration/vmstate.h" 11 #include "scsi/constants.h" 12 #include "sysemu/block-backend.h" 13 #include "sysemu/blockdev.h" 14 #include "sysemu/sysemu.h" 15 #include "sysemu/runstate.h" 16 #include "trace.h" 17 #include "sysemu/dma.h" 18 #include "qemu/cutils.h" 19 20 static char *scsibus_get_dev_path(DeviceState *dev); 21 static char *scsibus_get_fw_dev_path(DeviceState *dev); 22 static void scsi_req_dequeue(SCSIRequest *req); 23 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len); 24 static void scsi_target_free_buf(SCSIRequest *req); 25 static void scsi_clear_reported_luns_changed(SCSIRequest *req); 26 27 static int next_scsi_bus; 28 29 static SCSIDevice *do_scsi_device_find(SCSIBus *bus, 30 int channel, int id, int lun, 31 bool include_unrealized) 32 { 33 BusChild *kid; 34 SCSIDevice *retval = NULL; 35 36 QTAILQ_FOREACH_RCU(kid, &bus->qbus.children, sibling) { 37 DeviceState *qdev = kid->child; 38 SCSIDevice *dev = SCSI_DEVICE(qdev); 39 40 if (dev->channel == channel && dev->id == id) { 41 if (dev->lun == lun) { 42 retval = dev; 43 break; 44 } 45 46 /* 47 * If we don't find exact match (channel/bus/lun), 48 * we will return the first device which matches channel/bus 49 */ 50 51 if (!retval) { 52 retval = dev; 53 } 54 } 55 } 56 57 /* 58 * This function might run on the IO thread and we might race against 59 * main thread hot-plugging the device. 60 * We assume that as soon as .realized is set to true we can let 61 * the user access the device. 62 */ 63 64 if (retval && !include_unrealized && !qdev_is_realized(&retval->qdev)) { 65 retval = NULL; 66 } 67 68 return retval; 69 } 70 71 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun) 72 { 73 RCU_READ_LOCK_GUARD(); 74 return do_scsi_device_find(bus, channel, id, lun, false); 75 } 76 77 SCSIDevice *scsi_device_get(SCSIBus *bus, int channel, int id, int lun) 78 { 79 SCSIDevice *d; 80 RCU_READ_LOCK_GUARD(); 81 d = do_scsi_device_find(bus, channel, id, lun, false); 82 if (d) { 83 object_ref(d); 84 } 85 return d; 86 } 87 88 /* 89 * Invoke @fn() for each enqueued request in device @s. Must be called from the 90 * main loop thread while the guest is stopped. This is only suitable for 91 * vmstate ->put(), use scsi_device_for_each_req_async() for other cases. 92 */ 93 static void scsi_device_for_each_req_sync(SCSIDevice *s, 94 void (*fn)(SCSIRequest *, void *), 95 void *opaque) 96 { 97 SCSIRequest *req; 98 SCSIRequest *next_req; 99 100 assert(!runstate_is_running()); 101 assert(qemu_in_main_thread()); 102 103 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next_req) { 104 fn(req, opaque); 105 } 106 } 107 108 typedef struct { 109 SCSIDevice *s; 110 void (*fn)(SCSIRequest *, void *); 111 void *fn_opaque; 112 } SCSIDeviceForEachReqAsyncData; 113 114 static void scsi_device_for_each_req_async_bh(void *opaque) 115 { 116 g_autofree SCSIDeviceForEachReqAsyncData *data = opaque; 117 SCSIDevice *s = data->s; 118 AioContext *ctx; 119 SCSIRequest *req; 120 SCSIRequest *next; 121 122 /* 123 * The BB cannot have changed contexts between this BH being scheduled and 124 * now: BBs' AioContexts, when they have a node attached, can only be 125 * changed via bdrv_try_change_aio_context(), in a drained section. While 126 * we have the in-flight counter incremented, that drain must block. 127 */ 128 ctx = blk_get_aio_context(s->conf.blk); 129 assert(ctx == qemu_get_current_aio_context()); 130 131 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) { 132 data->fn(req, data->fn_opaque); 133 } 134 135 /* Drop the reference taken by scsi_device_for_each_req_async() */ 136 object_unref(OBJECT(s)); 137 138 /* Paired with blk_inc_in_flight() in scsi_device_for_each_req_async() */ 139 blk_dec_in_flight(s->conf.blk); 140 } 141 142 /* 143 * Schedule @fn() to be invoked for each enqueued request in device @s. @fn() 144 * runs in the AioContext that is executing the request. 145 * Keeps the BlockBackend's in-flight counter incremented until everything is 146 * done, so draining it will settle all scheduled @fn() calls. 147 */ 148 static void scsi_device_for_each_req_async(SCSIDevice *s, 149 void (*fn)(SCSIRequest *, void *), 150 void *opaque) 151 { 152 assert(qemu_in_main_thread()); 153 154 SCSIDeviceForEachReqAsyncData *data = 155 g_new(SCSIDeviceForEachReqAsyncData, 1); 156 157 data->s = s; 158 data->fn = fn; 159 data->fn_opaque = opaque; 160 161 /* 162 * Hold a reference to the SCSIDevice until 163 * scsi_device_for_each_req_async_bh() finishes. 164 */ 165 object_ref(OBJECT(s)); 166 167 /* Paired with blk_dec_in_flight() in scsi_device_for_each_req_async_bh() */ 168 blk_inc_in_flight(s->conf.blk); 169 aio_bh_schedule_oneshot(blk_get_aio_context(s->conf.blk), 170 scsi_device_for_each_req_async_bh, 171 data); 172 } 173 174 static void scsi_device_realize(SCSIDevice *s, Error **errp) 175 { 176 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 177 if (sc->realize) { 178 sc->realize(s, errp); 179 } 180 } 181 182 static void scsi_device_unrealize(SCSIDevice *s) 183 { 184 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 185 if (sc->unrealize) { 186 sc->unrealize(s); 187 } 188 } 189 190 int scsi_bus_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf, 191 size_t buf_len, void *hba_private) 192 { 193 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 194 int rc; 195 196 assert(cmd->len == 0); 197 rc = scsi_req_parse_cdb(dev, cmd, buf, buf_len); 198 if (bus->info->parse_cdb) { 199 rc = bus->info->parse_cdb(dev, cmd, buf, buf_len, hba_private); 200 } 201 return rc; 202 } 203 204 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun, 205 uint8_t *buf, void *hba_private) 206 { 207 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 208 if (sc->alloc_req) { 209 return sc->alloc_req(s, tag, lun, buf, hba_private); 210 } 211 212 return NULL; 213 } 214 215 void scsi_device_unit_attention_reported(SCSIDevice *s) 216 { 217 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 218 if (sc->unit_attention_reported) { 219 sc->unit_attention_reported(s); 220 } 221 } 222 223 /* Create a scsi bus, and attach devices to it. */ 224 void scsi_bus_init_named(SCSIBus *bus, size_t bus_size, DeviceState *host, 225 const SCSIBusInfo *info, const char *bus_name) 226 { 227 qbus_init(bus, bus_size, TYPE_SCSI_BUS, host, bus_name); 228 bus->busnr = next_scsi_bus++; 229 bus->info = info; 230 qbus_set_bus_hotplug_handler(BUS(bus)); 231 } 232 233 void scsi_req_retry(SCSIRequest *req) 234 { 235 req->retry = true; 236 } 237 238 /* Called in the AioContext that is executing the request */ 239 static void scsi_dma_restart_req(SCSIRequest *req, void *opaque) 240 { 241 scsi_req_ref(req); 242 if (req->retry) { 243 req->retry = false; 244 switch (req->cmd.mode) { 245 case SCSI_XFER_FROM_DEV: 246 case SCSI_XFER_TO_DEV: 247 scsi_req_continue(req); 248 break; 249 case SCSI_XFER_NONE: 250 scsi_req_dequeue(req); 251 scsi_req_enqueue(req); 252 break; 253 } 254 } 255 scsi_req_unref(req); 256 } 257 258 static void scsi_dma_restart_cb(void *opaque, bool running, RunState state) 259 { 260 SCSIDevice *s = opaque; 261 262 assert(qemu_in_main_thread()); 263 264 if (!running) { 265 return; 266 } 267 268 scsi_device_for_each_req_async(s, scsi_dma_restart_req, NULL); 269 } 270 271 static bool scsi_bus_is_address_free(SCSIBus *bus, 272 int channel, int target, int lun, 273 SCSIDevice **p_dev) 274 { 275 SCSIDevice *d; 276 277 RCU_READ_LOCK_GUARD(); 278 d = do_scsi_device_find(bus, channel, target, lun, true); 279 if (d && d->lun == lun) { 280 if (p_dev) { 281 *p_dev = d; 282 } 283 return false; 284 } 285 if (p_dev) { 286 *p_dev = NULL; 287 } 288 return true; 289 } 290 291 static bool scsi_bus_check_address(BusState *qbus, DeviceState *qdev, Error **errp) 292 { 293 SCSIDevice *dev = SCSI_DEVICE(qdev); 294 SCSIBus *bus = SCSI_BUS(qbus); 295 296 if (dev->channel > bus->info->max_channel) { 297 error_setg(errp, "bad scsi channel id: %d", dev->channel); 298 return false; 299 } 300 if (dev->id != -1 && dev->id > bus->info->max_target) { 301 error_setg(errp, "bad scsi device id: %d", dev->id); 302 return false; 303 } 304 if (dev->lun != -1 && dev->lun > bus->info->max_lun) { 305 error_setg(errp, "bad scsi device lun: %d", dev->lun); 306 return false; 307 } 308 309 if (dev->id != -1 && dev->lun != -1) { 310 SCSIDevice *d; 311 if (!scsi_bus_is_address_free(bus, dev->channel, dev->id, dev->lun, &d)) { 312 error_setg(errp, "lun already used by '%s'", d->qdev.id); 313 return false; 314 } 315 } 316 317 return true; 318 } 319 320 static void scsi_qdev_realize(DeviceState *qdev, Error **errp) 321 { 322 SCSIDevice *dev = SCSI_DEVICE(qdev); 323 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 324 bool is_free; 325 Error *local_err = NULL; 326 327 if (dev->id == -1) { 328 int id = -1; 329 if (dev->lun == -1) { 330 dev->lun = 0; 331 } 332 do { 333 is_free = scsi_bus_is_address_free(bus, dev->channel, ++id, dev->lun, NULL); 334 } while (!is_free && id < bus->info->max_target); 335 if (!is_free) { 336 error_setg(errp, "no free target"); 337 return; 338 } 339 dev->id = id; 340 } else if (dev->lun == -1) { 341 int lun = -1; 342 do { 343 is_free = scsi_bus_is_address_free(bus, dev->channel, dev->id, ++lun, NULL); 344 } while (!is_free && lun < bus->info->max_lun); 345 if (!is_free) { 346 error_setg(errp, "no free lun"); 347 return; 348 } 349 dev->lun = lun; 350 } 351 352 QTAILQ_INIT(&dev->requests); 353 scsi_device_realize(dev, &local_err); 354 if (local_err) { 355 error_propagate(errp, local_err); 356 return; 357 } 358 dev->vmsentry = qdev_add_vm_change_state_handler(DEVICE(dev), 359 scsi_dma_restart_cb, dev); 360 } 361 362 static void scsi_qdev_unrealize(DeviceState *qdev) 363 { 364 SCSIDevice *dev = SCSI_DEVICE(qdev); 365 366 if (dev->vmsentry) { 367 qemu_del_vm_change_state_handler(dev->vmsentry); 368 } 369 370 scsi_device_purge_requests(dev, SENSE_CODE(NO_SENSE)); 371 372 scsi_device_unrealize(dev); 373 374 blockdev_mark_auto_del(dev->conf.blk); 375 } 376 377 /* handle legacy '-drive if=scsi,...' cmd line args */ 378 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockBackend *blk, 379 int unit, bool removable, BlockConf *conf, 380 const char *serial, Error **errp) 381 { 382 const char *driver; 383 char *name; 384 DeviceState *dev; 385 SCSIDevice *s; 386 DriveInfo *dinfo; 387 Error *local_err = NULL; 388 389 if (blk_is_sg(blk)) { 390 driver = "scsi-generic"; 391 } else { 392 dinfo = blk_legacy_dinfo(blk); 393 if (dinfo && dinfo->media_cd) { 394 driver = "scsi-cd"; 395 } else { 396 driver = "scsi-hd"; 397 } 398 } 399 dev = qdev_new(driver); 400 name = g_strdup_printf("legacy[%d]", unit); 401 object_property_add_child(OBJECT(bus), name, OBJECT(dev)); 402 g_free(name); 403 404 s = SCSI_DEVICE(dev); 405 s->conf = *conf; 406 407 check_boot_index(conf->bootindex, &local_err); 408 if (local_err) { 409 object_unparent(OBJECT(dev)); 410 error_propagate(errp, local_err); 411 return NULL; 412 } 413 add_boot_device_path(conf->bootindex, dev, NULL); 414 415 qdev_prop_set_uint32(dev, "scsi-id", unit); 416 if (object_property_find(OBJECT(dev), "removable")) { 417 qdev_prop_set_bit(dev, "removable", removable); 418 } 419 if (serial && object_property_find(OBJECT(dev), "serial")) { 420 qdev_prop_set_string(dev, "serial", serial); 421 } 422 if (!qdev_prop_set_drive_err(dev, "drive", blk, errp)) { 423 object_unparent(OBJECT(dev)); 424 return NULL; 425 } 426 427 if (!qdev_realize_and_unref(dev, &bus->qbus, errp)) { 428 object_unparent(OBJECT(dev)); 429 return NULL; 430 } 431 return s; 432 } 433 434 void scsi_bus_legacy_handle_cmdline(SCSIBus *bus) 435 { 436 Location loc; 437 DriveInfo *dinfo; 438 int unit; 439 BlockConf conf = { 440 .bootindex = -1, 441 .share_rw = false, 442 .rerror = BLOCKDEV_ON_ERROR_AUTO, 443 .werror = BLOCKDEV_ON_ERROR_AUTO, 444 }; 445 446 loc_push_none(&loc); 447 for (unit = 0; unit <= bus->info->max_target; unit++) { 448 dinfo = drive_get(IF_SCSI, bus->busnr, unit); 449 if (dinfo == NULL) { 450 continue; 451 } 452 qemu_opts_loc_restore(dinfo->opts); 453 scsi_bus_legacy_add_drive(bus, blk_by_legacy_dinfo(dinfo), 454 unit, false, &conf, NULL, &error_fatal); 455 } 456 loc_pop(&loc); 457 } 458 459 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf) 460 { 461 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD)); 462 scsi_req_complete(req, CHECK_CONDITION); 463 return 0; 464 } 465 466 static const struct SCSIReqOps reqops_invalid_field = { 467 .size = sizeof(SCSIRequest), 468 .send_command = scsi_invalid_field 469 }; 470 471 /* SCSIReqOps implementation for invalid commands. */ 472 473 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf) 474 { 475 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE)); 476 scsi_req_complete(req, CHECK_CONDITION); 477 return 0; 478 } 479 480 static const struct SCSIReqOps reqops_invalid_opcode = { 481 .size = sizeof(SCSIRequest), 482 .send_command = scsi_invalid_command 483 }; 484 485 /* SCSIReqOps implementation for unit attention conditions. */ 486 487 static void scsi_fetch_unit_attention_sense(SCSIRequest *req) 488 { 489 SCSISense *ua = NULL; 490 491 if (req->dev->unit_attention.key == UNIT_ATTENTION) { 492 ua = &req->dev->unit_attention; 493 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) { 494 ua = &req->bus->unit_attention; 495 } 496 497 /* 498 * Fetch the unit attention sense immediately so that another 499 * scsi_req_new does not use reqops_unit_attention. 500 */ 501 if (ua) { 502 scsi_req_build_sense(req, *ua); 503 *ua = SENSE_CODE(NO_SENSE); 504 } 505 } 506 507 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf) 508 { 509 scsi_req_complete(req, CHECK_CONDITION); 510 return 0; 511 } 512 513 static const struct SCSIReqOps reqops_unit_attention = { 514 .size = sizeof(SCSIRequest), 515 .init_req = scsi_fetch_unit_attention_sense, 516 .send_command = scsi_unit_attention 517 }; 518 519 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to 520 an invalid LUN. */ 521 522 typedef struct SCSITargetReq SCSITargetReq; 523 524 struct SCSITargetReq { 525 SCSIRequest req; 526 int len; 527 uint8_t *buf; 528 int buf_len; 529 }; 530 531 static void store_lun(uint8_t *outbuf, int lun) 532 { 533 if (lun < 256) { 534 /* Simple logical unit addressing method*/ 535 outbuf[0] = 0; 536 outbuf[1] = lun; 537 } else { 538 /* Flat space addressing method */ 539 outbuf[0] = 0x40 | (lun >> 8); 540 outbuf[1] = (lun & 255); 541 } 542 } 543 544 static bool scsi_target_emulate_report_luns(SCSITargetReq *r) 545 { 546 BusChild *kid; 547 int channel, id; 548 uint8_t tmp[8] = {0}; 549 int len = 0; 550 GByteArray *buf; 551 552 if (r->req.cmd.xfer < 16) { 553 return false; 554 } 555 if (r->req.cmd.buf[2] > 2) { 556 return false; 557 } 558 559 /* reserve space for 63 LUNs*/ 560 buf = g_byte_array_sized_new(512); 561 562 channel = r->req.dev->channel; 563 id = r->req.dev->id; 564 565 /* add size (will be updated later to correct value */ 566 g_byte_array_append(buf, tmp, 8); 567 len += 8; 568 569 /* add LUN0 */ 570 g_byte_array_append(buf, tmp, 8); 571 len += 8; 572 573 WITH_RCU_READ_LOCK_GUARD() { 574 QTAILQ_FOREACH_RCU(kid, &r->req.bus->qbus.children, sibling) { 575 DeviceState *qdev = kid->child; 576 SCSIDevice *dev = SCSI_DEVICE(qdev); 577 578 if (dev->channel == channel && dev->id == id && dev->lun != 0 && 579 qdev_is_realized(&dev->qdev)) { 580 store_lun(tmp, dev->lun); 581 g_byte_array_append(buf, tmp, 8); 582 len += 8; 583 } 584 } 585 } 586 587 r->buf_len = len; 588 r->buf = g_byte_array_free(buf, FALSE); 589 r->len = MIN(len, r->req.cmd.xfer & ~7); 590 591 /* store the LUN list length */ 592 stl_be_p(&r->buf[0], len - 8); 593 594 /* 595 * If a REPORT LUNS command enters the enabled command state, [...] 596 * the device server shall clear any pending unit attention condition 597 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED. 598 */ 599 scsi_clear_reported_luns_changed(&r->req); 600 601 return true; 602 } 603 604 static bool scsi_target_emulate_inquiry(SCSITargetReq *r) 605 { 606 assert(r->req.dev->lun != r->req.lun); 607 608 scsi_target_alloc_buf(&r->req, SCSI_INQUIRY_LEN); 609 610 if (r->req.cmd.buf[1] & 0x2) { 611 /* Command support data - optional, not implemented */ 612 return false; 613 } 614 615 if (r->req.cmd.buf[1] & 0x1) { 616 /* Vital product data */ 617 uint8_t page_code = r->req.cmd.buf[2]; 618 r->buf[r->len++] = page_code ; /* this page */ 619 r->buf[r->len++] = 0x00; 620 621 switch (page_code) { 622 case 0x00: /* Supported page codes, mandatory */ 623 { 624 int pages; 625 pages = r->len++; 626 r->buf[r->len++] = 0x00; /* list of supported pages (this page) */ 627 r->buf[pages] = r->len - pages - 1; /* number of pages */ 628 break; 629 } 630 default: 631 return false; 632 } 633 /* done with EVPD */ 634 assert(r->len < r->buf_len); 635 r->len = MIN(r->req.cmd.xfer, r->len); 636 return true; 637 } 638 639 /* Standard INQUIRY data */ 640 if (r->req.cmd.buf[2] != 0) { 641 return false; 642 } 643 644 /* PAGE CODE == 0 */ 645 r->len = MIN(r->req.cmd.xfer, SCSI_INQUIRY_LEN); 646 memset(r->buf, 0, r->len); 647 if (r->req.lun != 0) { 648 r->buf[0] = TYPE_NO_LUN; 649 } else { 650 r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE; 651 r->buf[2] = 5; /* Version */ 652 r->buf[3] = 2 | 0x10; /* HiSup, response data format */ 653 r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */ 654 r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ. */ 655 memcpy(&r->buf[8], "QEMU ", 8); 656 memcpy(&r->buf[16], "QEMU TARGET ", 16); 657 pstrcpy((char *) &r->buf[32], 4, qemu_hw_version()); 658 } 659 return true; 660 } 661 662 static size_t scsi_sense_len(SCSIRequest *req) 663 { 664 if (req->dev->type == TYPE_SCANNER) 665 return SCSI_SENSE_LEN_SCANNER; 666 else 667 return SCSI_SENSE_LEN; 668 } 669 670 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf) 671 { 672 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 673 int fixed_sense = (req->cmd.buf[1] & 1) == 0; 674 675 if (req->lun != 0 && 676 buf[0] != INQUIRY && buf[0] != REQUEST_SENSE) { 677 scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED)); 678 scsi_req_complete(req, CHECK_CONDITION); 679 return 0; 680 } 681 switch (buf[0]) { 682 case REPORT_LUNS: 683 if (!scsi_target_emulate_report_luns(r)) { 684 goto illegal_request; 685 } 686 break; 687 case INQUIRY: 688 if (!scsi_target_emulate_inquiry(r)) { 689 goto illegal_request; 690 } 691 break; 692 case REQUEST_SENSE: 693 scsi_target_alloc_buf(&r->req, scsi_sense_len(req)); 694 if (req->lun != 0) { 695 const struct SCSISense sense = SENSE_CODE(LUN_NOT_SUPPORTED); 696 697 r->len = scsi_build_sense_buf(r->buf, req->cmd.xfer, 698 sense, fixed_sense); 699 } else { 700 r->len = scsi_device_get_sense(r->req.dev, r->buf, 701 MIN(req->cmd.xfer, r->buf_len), 702 fixed_sense); 703 } 704 if (r->req.dev->sense_is_ua) { 705 scsi_device_unit_attention_reported(req->dev); 706 r->req.dev->sense_len = 0; 707 r->req.dev->sense_is_ua = false; 708 } 709 break; 710 case TEST_UNIT_READY: 711 break; 712 default: 713 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE)); 714 scsi_req_complete(req, CHECK_CONDITION); 715 return 0; 716 illegal_request: 717 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD)); 718 scsi_req_complete(req, CHECK_CONDITION); 719 return 0; 720 } 721 722 if (!r->len) { 723 scsi_req_complete(req, GOOD); 724 } 725 return r->len; 726 } 727 728 static void scsi_target_read_data(SCSIRequest *req) 729 { 730 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 731 uint32_t n; 732 733 n = r->len; 734 if (n > 0) { 735 r->len = 0; 736 scsi_req_data(&r->req, n); 737 } else { 738 scsi_req_complete(&r->req, GOOD); 739 } 740 } 741 742 static uint8_t *scsi_target_get_buf(SCSIRequest *req) 743 { 744 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 745 746 return r->buf; 747 } 748 749 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len) 750 { 751 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 752 753 r->buf = g_malloc(len); 754 r->buf_len = len; 755 756 return r->buf; 757 } 758 759 static void scsi_target_free_buf(SCSIRequest *req) 760 { 761 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 762 763 g_free(r->buf); 764 } 765 766 static const struct SCSIReqOps reqops_target_command = { 767 .size = sizeof(SCSITargetReq), 768 .send_command = scsi_target_send_command, 769 .read_data = scsi_target_read_data, 770 .get_buf = scsi_target_get_buf, 771 .free_req = scsi_target_free_buf, 772 }; 773 774 775 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d, 776 uint32_t tag, uint32_t lun, void *hba_private) 777 { 778 SCSIRequest *req; 779 SCSIBus *bus = scsi_bus_from_device(d); 780 BusState *qbus = BUS(bus); 781 const int memset_off = offsetof(SCSIRequest, sense) 782 + sizeof(req->sense); 783 784 req = g_malloc(reqops->size); 785 memset((uint8_t *)req + memset_off, 0, reqops->size - memset_off); 786 req->refcount = 1; 787 req->bus = bus; 788 req->dev = d; 789 req->tag = tag; 790 req->lun = lun; 791 req->hba_private = hba_private; 792 req->status = -1; 793 req->host_status = -1; 794 req->ops = reqops; 795 object_ref(OBJECT(d)); 796 object_ref(OBJECT(qbus->parent)); 797 notifier_list_init(&req->cancel_notifiers); 798 799 if (reqops->init_req) { 800 reqops->init_req(req); 801 } 802 803 trace_scsi_req_alloc(req->dev->id, req->lun, req->tag); 804 return req; 805 } 806 807 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun, 808 uint8_t *buf, size_t buf_len, void *hba_private) 809 { 810 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus); 811 const SCSIReqOps *ops; 812 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(d); 813 SCSIRequest *req; 814 SCSICommand cmd = { .len = 0 }; 815 int ret; 816 817 if (buf_len == 0) { 818 trace_scsi_req_parse_bad(d->id, lun, tag, 0); 819 goto invalid_opcode; 820 } 821 822 if ((d->unit_attention.key == UNIT_ATTENTION || 823 bus->unit_attention.key == UNIT_ATTENTION) && 824 (buf[0] != INQUIRY && 825 buf[0] != REPORT_LUNS && 826 buf[0] != GET_CONFIGURATION && 827 buf[0] != GET_EVENT_STATUS_NOTIFICATION && 828 829 /* 830 * If we already have a pending unit attention condition, 831 * report this one before triggering another one. 832 */ 833 !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) { 834 ops = &reqops_unit_attention; 835 } else if (lun != d->lun || 836 buf[0] == REPORT_LUNS || 837 (buf[0] == REQUEST_SENSE && d->sense_len)) { 838 ops = &reqops_target_command; 839 } else { 840 ops = NULL; 841 } 842 843 if (ops != NULL || !sc->parse_cdb) { 844 ret = scsi_req_parse_cdb(d, &cmd, buf, buf_len); 845 } else { 846 ret = sc->parse_cdb(d, &cmd, buf, buf_len, hba_private); 847 } 848 849 if (ret != 0) { 850 trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]); 851 invalid_opcode: 852 req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private); 853 } else { 854 assert(cmd.len != 0); 855 trace_scsi_req_parsed(d->id, lun, tag, buf[0], 856 cmd.mode, cmd.xfer); 857 if (cmd.lba != -1) { 858 trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0], 859 cmd.lba); 860 } 861 862 if (cmd.xfer > INT32_MAX) { 863 req = scsi_req_alloc(&reqops_invalid_field, d, tag, lun, hba_private); 864 } else if (ops) { 865 req = scsi_req_alloc(ops, d, tag, lun, hba_private); 866 } else { 867 req = scsi_device_alloc_req(d, tag, lun, buf, hba_private); 868 } 869 } 870 871 req->cmd = cmd; 872 req->residual = req->cmd.xfer; 873 874 switch (buf[0]) { 875 case INQUIRY: 876 trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]); 877 break; 878 case TEST_UNIT_READY: 879 trace_scsi_test_unit_ready(d->id, lun, tag); 880 break; 881 case REPORT_LUNS: 882 trace_scsi_report_luns(d->id, lun, tag); 883 break; 884 case REQUEST_SENSE: 885 trace_scsi_request_sense(d->id, lun, tag); 886 break; 887 default: 888 break; 889 } 890 891 return req; 892 } 893 894 uint8_t *scsi_req_get_buf(SCSIRequest *req) 895 { 896 return req->ops->get_buf(req); 897 } 898 899 static void scsi_clear_reported_luns_changed(SCSIRequest *req) 900 { 901 SCSISense *ua; 902 903 if (req->dev->unit_attention.key == UNIT_ATTENTION) { 904 ua = &req->dev->unit_attention; 905 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) { 906 ua = &req->bus->unit_attention; 907 } else { 908 return; 909 } 910 911 if (ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc && 912 ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq) { 913 *ua = SENSE_CODE(NO_SENSE); 914 } 915 } 916 917 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len) 918 { 919 int ret; 920 921 assert(len >= 14); 922 if (!req->sense_len) { 923 return 0; 924 } 925 926 ret = scsi_convert_sense(req->sense, req->sense_len, buf, len, true); 927 928 /* 929 * FIXME: clearing unit attention conditions upon autosense should be done 930 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b 931 * (SAM-5, 5.14). 932 * 933 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and 934 * 10b for HBAs that do not support it (do not call scsi_req_get_sense). 935 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b. 936 */ 937 if (req->dev->sense_is_ua) { 938 scsi_device_unit_attention_reported(req->dev); 939 req->dev->sense_len = 0; 940 req->dev->sense_is_ua = false; 941 } 942 return ret; 943 } 944 945 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed) 946 { 947 return scsi_convert_sense(dev->sense, dev->sense_len, buf, len, fixed); 948 } 949 950 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense) 951 { 952 trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag, 953 sense.key, sense.asc, sense.ascq); 954 req->sense_len = scsi_build_sense(req->sense, sense); 955 } 956 957 static void scsi_req_enqueue_internal(SCSIRequest *req) 958 { 959 assert(!req->enqueued); 960 scsi_req_ref(req); 961 if (req->bus->info->get_sg_list) { 962 req->sg = req->bus->info->get_sg_list(req); 963 } else { 964 req->sg = NULL; 965 } 966 req->enqueued = true; 967 QTAILQ_INSERT_TAIL(&req->dev->requests, req, next); 968 } 969 970 int32_t scsi_req_enqueue(SCSIRequest *req) 971 { 972 int32_t rc; 973 974 assert(!req->retry); 975 scsi_req_enqueue_internal(req); 976 scsi_req_ref(req); 977 rc = req->ops->send_command(req, req->cmd.buf); 978 scsi_req_unref(req); 979 return rc; 980 } 981 982 static void scsi_req_dequeue(SCSIRequest *req) 983 { 984 trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag); 985 req->retry = false; 986 if (req->enqueued) { 987 QTAILQ_REMOVE(&req->dev->requests, req, next); 988 req->enqueued = false; 989 scsi_req_unref(req); 990 } 991 } 992 993 static int scsi_get_performance_length(int num_desc, int type, int data_type) 994 { 995 /* MMC-6, paragraph 6.7. */ 996 switch (type) { 997 case 0: 998 if ((data_type & 3) == 0) { 999 /* Each descriptor is as in Table 295 - Nominal performance. */ 1000 return 16 * num_desc + 8; 1001 } else { 1002 /* Each descriptor is as in Table 296 - Exceptions. */ 1003 return 6 * num_desc + 8; 1004 } 1005 case 1: 1006 case 4: 1007 case 5: 1008 return 8 * num_desc + 8; 1009 case 2: 1010 return 2048 * num_desc + 8; 1011 case 3: 1012 return 16 * num_desc + 8; 1013 default: 1014 return 8; 1015 } 1016 } 1017 1018 static int ata_passthrough_xfer_unit(SCSIDevice *dev, uint8_t *buf) 1019 { 1020 int byte_block = (buf[2] >> 2) & 0x1; 1021 int type = (buf[2] >> 4) & 0x1; 1022 int xfer_unit; 1023 1024 if (byte_block) { 1025 if (type) { 1026 xfer_unit = dev->blocksize; 1027 } else { 1028 xfer_unit = 512; 1029 } 1030 } else { 1031 xfer_unit = 1; 1032 } 1033 1034 return xfer_unit; 1035 } 1036 1037 static int ata_passthrough_12_xfer(SCSIDevice *dev, uint8_t *buf) 1038 { 1039 int length = buf[2] & 0x3; 1040 int xfer; 1041 int unit = ata_passthrough_xfer_unit(dev, buf); 1042 1043 switch (length) { 1044 case 0: 1045 case 3: /* USB-specific. */ 1046 default: 1047 xfer = 0; 1048 break; 1049 case 1: 1050 xfer = buf[3]; 1051 break; 1052 case 2: 1053 xfer = buf[4]; 1054 break; 1055 } 1056 1057 return xfer * unit; 1058 } 1059 1060 static int ata_passthrough_16_xfer(SCSIDevice *dev, uint8_t *buf) 1061 { 1062 int extend = buf[1] & 0x1; 1063 int length = buf[2] & 0x3; 1064 int xfer; 1065 int unit = ata_passthrough_xfer_unit(dev, buf); 1066 1067 switch (length) { 1068 case 0: 1069 case 3: /* USB-specific. */ 1070 default: 1071 xfer = 0; 1072 break; 1073 case 1: 1074 xfer = buf[4]; 1075 xfer |= (extend ? buf[3] << 8 : 0); 1076 break; 1077 case 2: 1078 xfer = buf[6]; 1079 xfer |= (extend ? buf[5] << 8 : 0); 1080 break; 1081 } 1082 1083 return xfer * unit; 1084 } 1085 1086 static int scsi_req_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1087 { 1088 cmd->xfer = scsi_cdb_xfer(buf); 1089 switch (buf[0]) { 1090 case TEST_UNIT_READY: 1091 case REWIND: 1092 case START_STOP: 1093 case SET_CAPACITY: 1094 case WRITE_FILEMARKS: 1095 case WRITE_FILEMARKS_16: 1096 case SPACE: 1097 case RESERVE: 1098 case RELEASE: 1099 case ERASE: 1100 case ALLOW_MEDIUM_REMOVAL: 1101 case SEEK_10: 1102 case SYNCHRONIZE_CACHE: 1103 case SYNCHRONIZE_CACHE_16: 1104 case LOCATE_16: 1105 case LOCK_UNLOCK_CACHE: 1106 case SET_CD_SPEED: 1107 case SET_LIMITS: 1108 case WRITE_LONG_10: 1109 case UPDATE_BLOCK: 1110 case RESERVE_TRACK: 1111 case SET_READ_AHEAD: 1112 case PRE_FETCH: 1113 case PRE_FETCH_16: 1114 case ALLOW_OVERWRITE: 1115 cmd->xfer = 0; 1116 break; 1117 case VERIFY_10: 1118 case VERIFY_12: 1119 case VERIFY_16: 1120 if ((buf[1] & 2) == 0) { 1121 cmd->xfer = 0; 1122 } else if ((buf[1] & 4) != 0) { 1123 cmd->xfer = 1; 1124 } 1125 cmd->xfer *= dev->blocksize; 1126 break; 1127 case MODE_SENSE: 1128 break; 1129 case WRITE_SAME_10: 1130 case WRITE_SAME_16: 1131 cmd->xfer = buf[1] & 1 ? 0 : dev->blocksize; 1132 break; 1133 case READ_CAPACITY_10: 1134 cmd->xfer = 8; 1135 break; 1136 case READ_BLOCK_LIMITS: 1137 cmd->xfer = 6; 1138 break; 1139 case SEND_VOLUME_TAG: 1140 /* GPCMD_SET_STREAMING from multimedia commands. */ 1141 if (dev->type == TYPE_ROM) { 1142 cmd->xfer = buf[10] | (buf[9] << 8); 1143 } else { 1144 cmd->xfer = buf[9] | (buf[8] << 8); 1145 } 1146 break; 1147 case WRITE_6: 1148 /* length 0 means 256 blocks */ 1149 if (cmd->xfer == 0) { 1150 cmd->xfer = 256; 1151 } 1152 /* fall through */ 1153 case WRITE_10: 1154 case WRITE_VERIFY_10: 1155 case WRITE_12: 1156 case WRITE_VERIFY_12: 1157 case WRITE_16: 1158 case WRITE_VERIFY_16: 1159 cmd->xfer *= dev->blocksize; 1160 break; 1161 case READ_6: 1162 case READ_REVERSE: 1163 /* length 0 means 256 blocks */ 1164 if (cmd->xfer == 0) { 1165 cmd->xfer = 256; 1166 } 1167 /* fall through */ 1168 case READ_10: 1169 case READ_12: 1170 case READ_16: 1171 cmd->xfer *= dev->blocksize; 1172 break; 1173 case FORMAT_UNIT: 1174 /* MMC mandates the parameter list to be 12-bytes long. Parameters 1175 * for block devices are restricted to the header right now. */ 1176 if (dev->type == TYPE_ROM && (buf[1] & 16)) { 1177 cmd->xfer = 12; 1178 } else { 1179 cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4); 1180 } 1181 break; 1182 case INQUIRY: 1183 case RECEIVE_DIAGNOSTIC: 1184 case SEND_DIAGNOSTIC: 1185 cmd->xfer = buf[4] | (buf[3] << 8); 1186 break; 1187 case READ_CD: 1188 case READ_BUFFER: 1189 case WRITE_BUFFER: 1190 case SEND_CUE_SHEET: 1191 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16); 1192 break; 1193 case PERSISTENT_RESERVE_OUT: 1194 cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL; 1195 break; 1196 case ERASE_12: 1197 if (dev->type == TYPE_ROM) { 1198 /* MMC command GET PERFORMANCE. */ 1199 cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8), 1200 buf[10], buf[1] & 0x1f); 1201 } 1202 break; 1203 case MECHANISM_STATUS: 1204 case READ_DVD_STRUCTURE: 1205 case SEND_DVD_STRUCTURE: 1206 case MAINTENANCE_OUT: 1207 case MAINTENANCE_IN: 1208 if (dev->type == TYPE_ROM) { 1209 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */ 1210 cmd->xfer = buf[9] | (buf[8] << 8); 1211 } 1212 break; 1213 case ATA_PASSTHROUGH_12: 1214 if (dev->type == TYPE_ROM) { 1215 /* BLANK command of MMC */ 1216 cmd->xfer = 0; 1217 } else { 1218 cmd->xfer = ata_passthrough_12_xfer(dev, buf); 1219 } 1220 break; 1221 case ATA_PASSTHROUGH_16: 1222 cmd->xfer = ata_passthrough_16_xfer(dev, buf); 1223 break; 1224 } 1225 return 0; 1226 } 1227 1228 static int scsi_req_stream_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1229 { 1230 switch (buf[0]) { 1231 /* stream commands */ 1232 case ERASE_12: 1233 case ERASE_16: 1234 cmd->xfer = 0; 1235 break; 1236 case READ_6: 1237 case READ_REVERSE: 1238 case RECOVER_BUFFERED_DATA: 1239 case WRITE_6: 1240 cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16); 1241 if (buf[1] & 0x01) { /* fixed */ 1242 cmd->xfer *= dev->blocksize; 1243 } 1244 break; 1245 case READ_16: 1246 case READ_REVERSE_16: 1247 case VERIFY_16: 1248 case WRITE_16: 1249 cmd->xfer = buf[14] | (buf[13] << 8) | (buf[12] << 16); 1250 if (buf[1] & 0x01) { /* fixed */ 1251 cmd->xfer *= dev->blocksize; 1252 } 1253 break; 1254 case REWIND: 1255 case LOAD_UNLOAD: 1256 cmd->xfer = 0; 1257 break; 1258 case SPACE_16: 1259 cmd->xfer = buf[13] | (buf[12] << 8); 1260 break; 1261 case READ_POSITION: 1262 switch (buf[1] & 0x1f) /* operation code */ { 1263 case SHORT_FORM_BLOCK_ID: 1264 case SHORT_FORM_VENDOR_SPECIFIC: 1265 cmd->xfer = 20; 1266 break; 1267 case LONG_FORM: 1268 cmd->xfer = 32; 1269 break; 1270 case EXTENDED_FORM: 1271 cmd->xfer = buf[8] | (buf[7] << 8); 1272 break; 1273 default: 1274 return -1; 1275 } 1276 1277 break; 1278 case FORMAT_UNIT: 1279 cmd->xfer = buf[4] | (buf[3] << 8); 1280 break; 1281 /* generic commands */ 1282 default: 1283 return scsi_req_xfer(cmd, dev, buf); 1284 } 1285 return 0; 1286 } 1287 1288 static int scsi_req_medium_changer_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1289 { 1290 switch (buf[0]) { 1291 /* medium changer commands */ 1292 case EXCHANGE_MEDIUM: 1293 case INITIALIZE_ELEMENT_STATUS: 1294 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE: 1295 case MOVE_MEDIUM: 1296 case POSITION_TO_ELEMENT: 1297 cmd->xfer = 0; 1298 break; 1299 case READ_ELEMENT_STATUS: 1300 cmd->xfer = buf[9] | (buf[8] << 8) | (buf[7] << 16); 1301 break; 1302 1303 /* generic commands */ 1304 default: 1305 return scsi_req_xfer(cmd, dev, buf); 1306 } 1307 return 0; 1308 } 1309 1310 static int scsi_req_scanner_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1311 { 1312 switch (buf[0]) { 1313 /* Scanner commands */ 1314 case OBJECT_POSITION: 1315 cmd->xfer = 0; 1316 break; 1317 case SCAN: 1318 cmd->xfer = buf[4]; 1319 break; 1320 case READ_10: 1321 case SEND: 1322 case GET_WINDOW: 1323 case SET_WINDOW: 1324 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16); 1325 break; 1326 default: 1327 /* GET_DATA_BUFFER_STATUS xfer handled by scsi_req_xfer */ 1328 return scsi_req_xfer(cmd, dev, buf); 1329 } 1330 1331 return 0; 1332 } 1333 1334 static void scsi_cmd_xfer_mode(SCSICommand *cmd) 1335 { 1336 if (!cmd->xfer) { 1337 cmd->mode = SCSI_XFER_NONE; 1338 return; 1339 } 1340 switch (cmd->buf[0]) { 1341 case WRITE_6: 1342 case WRITE_10: 1343 case WRITE_VERIFY_10: 1344 case WRITE_12: 1345 case WRITE_VERIFY_12: 1346 case WRITE_16: 1347 case WRITE_VERIFY_16: 1348 case VERIFY_10: 1349 case VERIFY_12: 1350 case VERIFY_16: 1351 case COPY: 1352 case COPY_VERIFY: 1353 case COMPARE: 1354 case CHANGE_DEFINITION: 1355 case LOG_SELECT: 1356 case MODE_SELECT: 1357 case MODE_SELECT_10: 1358 case SEND_DIAGNOSTIC: 1359 case WRITE_BUFFER: 1360 case FORMAT_UNIT: 1361 case REASSIGN_BLOCKS: 1362 case SEARCH_EQUAL: 1363 case SEARCH_HIGH: 1364 case SEARCH_LOW: 1365 case UPDATE_BLOCK: 1366 case WRITE_LONG_10: 1367 case WRITE_SAME_10: 1368 case WRITE_SAME_16: 1369 case UNMAP: 1370 case SEARCH_HIGH_12: 1371 case SEARCH_EQUAL_12: 1372 case SEARCH_LOW_12: 1373 case MEDIUM_SCAN: 1374 case SEND_VOLUME_TAG: 1375 case SEND_CUE_SHEET: 1376 case SEND_DVD_STRUCTURE: 1377 case PERSISTENT_RESERVE_OUT: 1378 case MAINTENANCE_OUT: 1379 case SET_WINDOW: 1380 case SCAN: 1381 /* SCAN conflicts with START_STOP. START_STOP has cmd->xfer set to 0 for 1382 * non-scanner devices, so we only get here for SCAN and not for START_STOP. 1383 */ 1384 cmd->mode = SCSI_XFER_TO_DEV; 1385 break; 1386 case ATA_PASSTHROUGH_12: 1387 case ATA_PASSTHROUGH_16: 1388 /* T_DIR */ 1389 cmd->mode = (cmd->buf[2] & 0x8) ? 1390 SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV; 1391 break; 1392 default: 1393 cmd->mode = SCSI_XFER_FROM_DEV; 1394 break; 1395 } 1396 } 1397 1398 int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf, 1399 size_t buf_len) 1400 { 1401 int rc; 1402 int len; 1403 1404 cmd->lba = -1; 1405 len = scsi_cdb_length(buf); 1406 if (len < 0 || len > buf_len) { 1407 return -1; 1408 } 1409 1410 cmd->len = len; 1411 switch (dev->type) { 1412 case TYPE_TAPE: 1413 rc = scsi_req_stream_xfer(cmd, dev, buf); 1414 break; 1415 case TYPE_MEDIUM_CHANGER: 1416 rc = scsi_req_medium_changer_xfer(cmd, dev, buf); 1417 break; 1418 case TYPE_SCANNER: 1419 rc = scsi_req_scanner_length(cmd, dev, buf); 1420 break; 1421 default: 1422 rc = scsi_req_xfer(cmd, dev, buf); 1423 break; 1424 } 1425 1426 if (rc != 0) 1427 return rc; 1428 1429 memcpy(cmd->buf, buf, cmd->len); 1430 scsi_cmd_xfer_mode(cmd); 1431 cmd->lba = scsi_cmd_lba(cmd); 1432 return 0; 1433 } 1434 1435 void scsi_device_report_change(SCSIDevice *dev, SCSISense sense) 1436 { 1437 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 1438 1439 scsi_device_set_ua(dev, sense); 1440 if (bus->info->change) { 1441 bus->info->change(bus, dev, sense); 1442 } 1443 } 1444 1445 SCSIRequest *scsi_req_ref(SCSIRequest *req) 1446 { 1447 assert(req->refcount > 0); 1448 req->refcount++; 1449 return req; 1450 } 1451 1452 void scsi_req_unref(SCSIRequest *req) 1453 { 1454 assert(req->refcount > 0); 1455 if (--req->refcount == 0) { 1456 BusState *qbus = req->dev->qdev.parent_bus; 1457 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus); 1458 1459 if (bus->info->free_request && req->hba_private) { 1460 bus->info->free_request(bus, req->hba_private); 1461 } 1462 if (req->ops->free_req) { 1463 req->ops->free_req(req); 1464 } 1465 object_unref(OBJECT(req->dev)); 1466 object_unref(OBJECT(qbus->parent)); 1467 g_free(req); 1468 } 1469 } 1470 1471 /* Tell the device that we finished processing this chunk of I/O. It 1472 will start the next chunk or complete the command. */ 1473 void scsi_req_continue(SCSIRequest *req) 1474 { 1475 if (req->io_canceled) { 1476 trace_scsi_req_continue_canceled(req->dev->id, req->lun, req->tag); 1477 return; 1478 } 1479 trace_scsi_req_continue(req->dev->id, req->lun, req->tag); 1480 if (req->cmd.mode == SCSI_XFER_TO_DEV) { 1481 req->ops->write_data(req); 1482 } else { 1483 req->ops->read_data(req); 1484 } 1485 } 1486 1487 /* Called by the devices when data is ready for the HBA. The HBA should 1488 start a DMA operation to read or fill the device's data buffer. 1489 Once it completes, calling scsi_req_continue will restart I/O. */ 1490 void scsi_req_data(SCSIRequest *req, int len) 1491 { 1492 uint8_t *buf; 1493 if (req->io_canceled) { 1494 trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len); 1495 return; 1496 } 1497 trace_scsi_req_data(req->dev->id, req->lun, req->tag, len); 1498 assert(req->cmd.mode != SCSI_XFER_NONE); 1499 if (!req->sg) { 1500 req->residual -= len; 1501 req->bus->info->transfer_data(req, len); 1502 return; 1503 } 1504 1505 /* If the device calls scsi_req_data and the HBA specified a 1506 * scatter/gather list, the transfer has to happen in a single 1507 * step. */ 1508 assert(!req->dma_started); 1509 req->dma_started = true; 1510 1511 buf = scsi_req_get_buf(req); 1512 if (req->cmd.mode == SCSI_XFER_FROM_DEV) { 1513 dma_buf_read(buf, len, &req->residual, req->sg, 1514 MEMTXATTRS_UNSPECIFIED); 1515 } else { 1516 dma_buf_write(buf, len, &req->residual, req->sg, 1517 MEMTXATTRS_UNSPECIFIED); 1518 } 1519 scsi_req_continue(req); 1520 } 1521 1522 void scsi_req_print(SCSIRequest *req) 1523 { 1524 FILE *fp = stderr; 1525 int i; 1526 1527 fprintf(fp, "[%s id=%d] %s", 1528 req->dev->qdev.parent_bus->name, 1529 req->dev->id, 1530 scsi_command_name(req->cmd.buf[0])); 1531 for (i = 1; i < req->cmd.len; i++) { 1532 fprintf(fp, " 0x%02x", req->cmd.buf[i]); 1533 } 1534 switch (req->cmd.mode) { 1535 case SCSI_XFER_NONE: 1536 fprintf(fp, " - none\n"); 1537 break; 1538 case SCSI_XFER_FROM_DEV: 1539 fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer); 1540 break; 1541 case SCSI_XFER_TO_DEV: 1542 fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer); 1543 break; 1544 default: 1545 fprintf(fp, " - Oops\n"); 1546 break; 1547 } 1548 } 1549 1550 void scsi_req_complete_failed(SCSIRequest *req, int host_status) 1551 { 1552 SCSISense sense; 1553 int status; 1554 1555 assert(req->status == -1 && req->host_status == -1); 1556 assert(req->ops != &reqops_unit_attention); 1557 1558 if (!req->bus->info->fail) { 1559 status = scsi_sense_from_host_status(req->host_status, &sense); 1560 if (status == CHECK_CONDITION) { 1561 scsi_req_build_sense(req, sense); 1562 } 1563 scsi_req_complete(req, status); 1564 return; 1565 } 1566 1567 req->host_status = host_status; 1568 scsi_req_ref(req); 1569 scsi_req_dequeue(req); 1570 req->bus->info->fail(req); 1571 1572 /* Cancelled requests might end up being completed instead of cancelled */ 1573 notifier_list_notify(&req->cancel_notifiers, req); 1574 scsi_req_unref(req); 1575 } 1576 1577 void scsi_req_complete(SCSIRequest *req, int status) 1578 { 1579 assert(req->status == -1 && req->host_status == -1); 1580 req->status = status; 1581 req->host_status = SCSI_HOST_OK; 1582 1583 assert(req->sense_len <= sizeof(req->sense)); 1584 if (status == GOOD) { 1585 req->sense_len = 0; 1586 } 1587 1588 if (req->sense_len) { 1589 memcpy(req->dev->sense, req->sense, req->sense_len); 1590 req->dev->sense_len = req->sense_len; 1591 req->dev->sense_is_ua = (req->ops == &reqops_unit_attention); 1592 } else { 1593 req->dev->sense_len = 0; 1594 req->dev->sense_is_ua = false; 1595 } 1596 1597 scsi_req_ref(req); 1598 scsi_req_dequeue(req); 1599 req->bus->info->complete(req, req->residual); 1600 1601 /* Cancelled requests might end up being completed instead of cancelled */ 1602 notifier_list_notify(&req->cancel_notifiers, req); 1603 scsi_req_unref(req); 1604 } 1605 1606 /* Called by the devices when the request is canceled. */ 1607 void scsi_req_cancel_complete(SCSIRequest *req) 1608 { 1609 assert(req->io_canceled); 1610 if (req->bus->info->cancel) { 1611 req->bus->info->cancel(req); 1612 } 1613 notifier_list_notify(&req->cancel_notifiers, req); 1614 scsi_req_unref(req); 1615 } 1616 1617 /* Cancel @req asynchronously. @notifier is added to @req's cancellation 1618 * notifier list, the bus will be notified the requests cancellation is 1619 * completed. 1620 * */ 1621 void scsi_req_cancel_async(SCSIRequest *req, Notifier *notifier) 1622 { 1623 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag); 1624 if (notifier) { 1625 notifier_list_add(&req->cancel_notifiers, notifier); 1626 } 1627 if (req->io_canceled) { 1628 /* A blk_aio_cancel_async is pending; when it finishes, 1629 * scsi_req_cancel_complete will be called and will 1630 * call the notifier we just added. Just wait for that. 1631 */ 1632 assert(req->aiocb); 1633 return; 1634 } 1635 /* Dropped in scsi_req_cancel_complete. */ 1636 scsi_req_ref(req); 1637 scsi_req_dequeue(req); 1638 req->io_canceled = true; 1639 if (req->aiocb) { 1640 blk_aio_cancel_async(req->aiocb); 1641 } else { 1642 scsi_req_cancel_complete(req); 1643 } 1644 } 1645 1646 void scsi_req_cancel(SCSIRequest *req) 1647 { 1648 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag); 1649 if (!req->enqueued) { 1650 return; 1651 } 1652 assert(!req->io_canceled); 1653 /* Dropped in scsi_req_cancel_complete. */ 1654 scsi_req_ref(req); 1655 scsi_req_dequeue(req); 1656 req->io_canceled = true; 1657 if (req->aiocb) { 1658 blk_aio_cancel(req->aiocb); 1659 } else { 1660 scsi_req_cancel_complete(req); 1661 } 1662 } 1663 1664 static int scsi_ua_precedence(SCSISense sense) 1665 { 1666 if (sense.key != UNIT_ATTENTION) { 1667 return INT_MAX; 1668 } 1669 if (sense.asc == 0x29 && sense.ascq == 0x04) { 1670 /* DEVICE INTERNAL RESET goes with POWER ON OCCURRED */ 1671 return 1; 1672 } else if (sense.asc == 0x3F && sense.ascq == 0x01) { 1673 /* MICROCODE HAS BEEN CHANGED goes with SCSI BUS RESET OCCURRED */ 1674 return 2; 1675 } else if (sense.asc == 0x29 && (sense.ascq == 0x05 || sense.ascq == 0x06)) { 1676 /* These two go with "all others". */ 1677 ; 1678 } else if (sense.asc == 0x29 && sense.ascq <= 0x07) { 1679 /* POWER ON, RESET OR BUS DEVICE RESET OCCURRED = 0 1680 * POWER ON OCCURRED = 1 1681 * SCSI BUS RESET OCCURRED = 2 1682 * BUS DEVICE RESET FUNCTION OCCURRED = 3 1683 * I_T NEXUS LOSS OCCURRED = 7 1684 */ 1685 return sense.ascq; 1686 } else if (sense.asc == 0x2F && sense.ascq == 0x01) { 1687 /* COMMANDS CLEARED BY POWER LOSS NOTIFICATION */ 1688 return 8; 1689 } 1690 return (sense.asc << 8) | sense.ascq; 1691 } 1692 1693 void scsi_bus_set_ua(SCSIBus *bus, SCSISense sense) 1694 { 1695 int prec1, prec2; 1696 if (sense.key != UNIT_ATTENTION) { 1697 return; 1698 } 1699 1700 /* 1701 * Override a pre-existing unit attention condition, except for a more 1702 * important reset condition. 1703 */ 1704 prec1 = scsi_ua_precedence(bus->unit_attention); 1705 prec2 = scsi_ua_precedence(sense); 1706 if (prec2 < prec1) { 1707 bus->unit_attention = sense; 1708 } 1709 } 1710 1711 void scsi_device_set_ua(SCSIDevice *sdev, SCSISense sense) 1712 { 1713 int prec1, prec2; 1714 if (sense.key != UNIT_ATTENTION) { 1715 return; 1716 } 1717 trace_scsi_device_set_ua(sdev->id, sdev->lun, sense.key, 1718 sense.asc, sense.ascq); 1719 1720 /* 1721 * Override a pre-existing unit attention condition, except for a more 1722 * important reset condition. 1723 */ 1724 prec1 = scsi_ua_precedence(sdev->unit_attention); 1725 prec2 = scsi_ua_precedence(sense); 1726 if (prec2 < prec1) { 1727 sdev->unit_attention = sense; 1728 } 1729 } 1730 1731 static void scsi_device_purge_one_req(SCSIRequest *req, void *opaque) 1732 { 1733 scsi_req_cancel_async(req, NULL); 1734 } 1735 1736 /** 1737 * Cancel all requests, and block until they are deleted. 1738 */ 1739 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense) 1740 { 1741 scsi_device_for_each_req_async(sdev, scsi_device_purge_one_req, NULL); 1742 1743 /* 1744 * Await all the scsi_device_purge_one_req() calls scheduled by 1745 * scsi_device_for_each_req_async(), and all I/O requests that were 1746 * cancelled this way, but may still take a bit of time to settle. 1747 */ 1748 blk_drain(sdev->conf.blk); 1749 1750 scsi_device_set_ua(sdev, sense); 1751 } 1752 1753 void scsi_device_drained_begin(SCSIDevice *sdev) 1754 { 1755 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, sdev->qdev.parent_bus); 1756 if (!bus) { 1757 return; 1758 } 1759 1760 assert(qemu_get_current_aio_context() == qemu_get_aio_context()); 1761 assert(bus->drain_count < INT_MAX); 1762 1763 /* 1764 * Multiple BlockBackends can be on a SCSIBus and each may begin/end 1765 * draining at any time. Keep a counter so HBAs only see begin/end once. 1766 */ 1767 if (bus->drain_count++ == 0) { 1768 trace_scsi_bus_drained_begin(bus, sdev); 1769 if (bus->info->drained_begin) { 1770 bus->info->drained_begin(bus); 1771 } 1772 } 1773 } 1774 1775 void scsi_device_drained_end(SCSIDevice *sdev) 1776 { 1777 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, sdev->qdev.parent_bus); 1778 if (!bus) { 1779 return; 1780 } 1781 1782 assert(qemu_get_current_aio_context() == qemu_get_aio_context()); 1783 assert(bus->drain_count > 0); 1784 1785 if (bus->drain_count-- == 1) { 1786 trace_scsi_bus_drained_end(bus, sdev); 1787 if (bus->info->drained_end) { 1788 bus->info->drained_end(bus); 1789 } 1790 } 1791 } 1792 1793 static char *scsibus_get_dev_path(DeviceState *dev) 1794 { 1795 SCSIDevice *d = SCSI_DEVICE(dev); 1796 DeviceState *hba = dev->parent_bus->parent; 1797 char *id; 1798 char *path; 1799 1800 id = qdev_get_dev_path(hba); 1801 if (id) { 1802 path = g_strdup_printf("%s/%d:%d:%d", id, d->channel, d->id, d->lun); 1803 } else { 1804 path = g_strdup_printf("%d:%d:%d", d->channel, d->id, d->lun); 1805 } 1806 g_free(id); 1807 return path; 1808 } 1809 1810 static char *scsibus_get_fw_dev_path(DeviceState *dev) 1811 { 1812 SCSIDevice *d = SCSI_DEVICE(dev); 1813 return g_strdup_printf("channel@%x/%s@%x,%x", d->channel, 1814 qdev_fw_name(dev), d->id, d->lun); 1815 } 1816 1817 /* SCSI request list. For simplicity, pv points to the whole device */ 1818 1819 static void put_scsi_req(SCSIRequest *req, void *opaque) 1820 { 1821 QEMUFile *f = opaque; 1822 1823 assert(!req->io_canceled); 1824 assert(req->status == -1 && req->host_status == -1); 1825 assert(req->enqueued); 1826 1827 qemu_put_sbyte(f, req->retry ? 1 : 2); 1828 qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf)); 1829 qemu_put_be32s(f, &req->tag); 1830 qemu_put_be32s(f, &req->lun); 1831 if (req->bus->info->save_request) { 1832 req->bus->info->save_request(f, req); 1833 } 1834 if (req->ops->save_request) { 1835 req->ops->save_request(f, req); 1836 } 1837 } 1838 1839 static int put_scsi_requests(QEMUFile *f, void *pv, size_t size, 1840 const VMStateField *field, JSONWriter *vmdesc) 1841 { 1842 SCSIDevice *s = pv; 1843 1844 scsi_device_for_each_req_sync(s, put_scsi_req, f); 1845 qemu_put_sbyte(f, 0); 1846 return 0; 1847 } 1848 1849 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size, 1850 const VMStateField *field) 1851 { 1852 SCSIDevice *s = pv; 1853 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus); 1854 int8_t sbyte; 1855 1856 while ((sbyte = qemu_get_sbyte(f)) > 0) { 1857 uint8_t buf[SCSI_CMD_BUF_SIZE]; 1858 uint32_t tag; 1859 uint32_t lun; 1860 SCSIRequest *req; 1861 1862 qemu_get_buffer(f, buf, sizeof(buf)); 1863 qemu_get_be32s(f, &tag); 1864 qemu_get_be32s(f, &lun); 1865 /* 1866 * A too-short CDB would have been rejected by scsi_req_new, so just use 1867 * SCSI_CMD_BUF_SIZE as the CDB length. 1868 */ 1869 req = scsi_req_new(s, tag, lun, buf, sizeof(buf), NULL); 1870 req->retry = (sbyte == 1); 1871 if (bus->info->load_request) { 1872 req->hba_private = bus->info->load_request(f, req); 1873 } 1874 if (req->ops->load_request) { 1875 req->ops->load_request(f, req); 1876 } 1877 1878 /* Just restart it later. */ 1879 scsi_req_enqueue_internal(req); 1880 1881 /* At this point, the request will be kept alive by the reference 1882 * added by scsi_req_enqueue_internal, so we can release our reference. 1883 * The HBA of course will add its own reference in the load_request 1884 * callback if it needs to hold on the SCSIRequest. 1885 */ 1886 scsi_req_unref(req); 1887 } 1888 1889 return 0; 1890 } 1891 1892 static const VMStateInfo vmstate_info_scsi_requests = { 1893 .name = "scsi-requests", 1894 .get = get_scsi_requests, 1895 .put = put_scsi_requests, 1896 }; 1897 1898 static bool scsi_sense_state_needed(void *opaque) 1899 { 1900 SCSIDevice *s = opaque; 1901 1902 return s->sense_len > SCSI_SENSE_BUF_SIZE_OLD; 1903 } 1904 1905 static const VMStateDescription vmstate_scsi_sense_state = { 1906 .name = "SCSIDevice/sense", 1907 .version_id = 1, 1908 .minimum_version_id = 1, 1909 .needed = scsi_sense_state_needed, 1910 .fields = (const VMStateField[]) { 1911 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 1912 SCSI_SENSE_BUF_SIZE_OLD, 1913 SCSI_SENSE_BUF_SIZE - SCSI_SENSE_BUF_SIZE_OLD), 1914 VMSTATE_END_OF_LIST() 1915 } 1916 }; 1917 1918 const VMStateDescription vmstate_scsi_device = { 1919 .name = "SCSIDevice", 1920 .version_id = 1, 1921 .minimum_version_id = 1, 1922 .fields = (const VMStateField[]) { 1923 VMSTATE_UINT8(unit_attention.key, SCSIDevice), 1924 VMSTATE_UINT8(unit_attention.asc, SCSIDevice), 1925 VMSTATE_UINT8(unit_attention.ascq, SCSIDevice), 1926 VMSTATE_BOOL(sense_is_ua, SCSIDevice), 1927 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 0, SCSI_SENSE_BUF_SIZE_OLD), 1928 VMSTATE_UINT32(sense_len, SCSIDevice), 1929 { 1930 .name = "requests", 1931 .version_id = 0, 1932 .field_exists = NULL, 1933 .size = 0, /* ouch */ 1934 .info = &vmstate_info_scsi_requests, 1935 .flags = VMS_SINGLE, 1936 .offset = 0, 1937 }, 1938 VMSTATE_END_OF_LIST() 1939 }, 1940 .subsections = (const VMStateDescription * const []) { 1941 &vmstate_scsi_sense_state, 1942 NULL 1943 } 1944 }; 1945 1946 static Property scsi_props[] = { 1947 DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0), 1948 DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1), 1949 DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1), 1950 DEFINE_PROP_END_OF_LIST(), 1951 }; 1952 1953 static void scsi_device_class_init(ObjectClass *klass, void *data) 1954 { 1955 DeviceClass *k = DEVICE_CLASS(klass); 1956 set_bit(DEVICE_CATEGORY_STORAGE, k->categories); 1957 k->bus_type = TYPE_SCSI_BUS; 1958 k->realize = scsi_qdev_realize; 1959 k->unrealize = scsi_qdev_unrealize; 1960 device_class_set_props(k, scsi_props); 1961 } 1962 1963 static void scsi_dev_instance_init(Object *obj) 1964 { 1965 DeviceState *dev = DEVICE(obj); 1966 SCSIDevice *s = SCSI_DEVICE(dev); 1967 1968 device_add_bootindex_property(obj, &s->conf.bootindex, 1969 "bootindex", NULL, 1970 &s->qdev); 1971 } 1972 1973 static const TypeInfo scsi_device_type_info = { 1974 .name = TYPE_SCSI_DEVICE, 1975 .parent = TYPE_DEVICE, 1976 .instance_size = sizeof(SCSIDevice), 1977 .abstract = true, 1978 .class_size = sizeof(SCSIDeviceClass), 1979 .class_init = scsi_device_class_init, 1980 .instance_init = scsi_dev_instance_init, 1981 }; 1982 1983 static void scsi_bus_class_init(ObjectClass *klass, void *data) 1984 { 1985 BusClass *k = BUS_CLASS(klass); 1986 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass); 1987 1988 k->get_dev_path = scsibus_get_dev_path; 1989 k->get_fw_dev_path = scsibus_get_fw_dev_path; 1990 k->check_address = scsi_bus_check_address; 1991 hc->unplug = qdev_simple_device_unplug_cb; 1992 } 1993 1994 static const TypeInfo scsi_bus_info = { 1995 .name = TYPE_SCSI_BUS, 1996 .parent = TYPE_BUS, 1997 .instance_size = sizeof(SCSIBus), 1998 .class_init = scsi_bus_class_init, 1999 .interfaces = (InterfaceInfo[]) { 2000 { TYPE_HOTPLUG_HANDLER }, 2001 { } 2002 } 2003 }; 2004 2005 static void scsi_register_types(void) 2006 { 2007 type_register_static(&scsi_bus_info); 2008 type_register_static(&scsi_device_type_info); 2009 } 2010 2011 type_init(scsi_register_types) 2012