1 #include "qemu/osdep.h" 2 #include "qapi/error.h" 3 #include "qemu/error-report.h" 4 #include "qemu/module.h" 5 #include "qemu/option.h" 6 #include "qemu/hw-version.h" 7 #include "hw/qdev-properties.h" 8 #include "hw/scsi/scsi.h" 9 #include "migration/qemu-file-types.h" 10 #include "migration/vmstate.h" 11 #include "scsi/constants.h" 12 #include "sysemu/block-backend.h" 13 #include "sysemu/blockdev.h" 14 #include "sysemu/sysemu.h" 15 #include "sysemu/runstate.h" 16 #include "trace.h" 17 #include "sysemu/dma.h" 18 #include "qemu/cutils.h" 19 20 static char *scsibus_get_dev_path(DeviceState *dev); 21 static char *scsibus_get_fw_dev_path(DeviceState *dev); 22 static void scsi_req_dequeue(SCSIRequest *req); 23 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len); 24 static void scsi_target_free_buf(SCSIRequest *req); 25 static void scsi_clear_reported_luns_changed(SCSIRequest *req); 26 27 static int next_scsi_bus; 28 29 static SCSIDevice *do_scsi_device_find(SCSIBus *bus, 30 int channel, int id, int lun, 31 bool include_unrealized) 32 { 33 BusChild *kid; 34 SCSIDevice *retval = NULL; 35 36 QTAILQ_FOREACH_RCU(kid, &bus->qbus.children, sibling) { 37 DeviceState *qdev = kid->child; 38 SCSIDevice *dev = SCSI_DEVICE(qdev); 39 40 if (dev->channel == channel && dev->id == id) { 41 if (dev->lun == lun) { 42 retval = dev; 43 break; 44 } 45 46 /* 47 * If we don't find exact match (channel/bus/lun), 48 * we will return the first device which matches channel/bus 49 */ 50 51 if (!retval) { 52 retval = dev; 53 } 54 } 55 } 56 57 /* 58 * This function might run on the IO thread and we might race against 59 * main thread hot-plugging the device. 60 * We assume that as soon as .realized is set to true we can let 61 * the user access the device. 62 */ 63 64 if (retval && !include_unrealized && !qdev_is_realized(&retval->qdev)) { 65 retval = NULL; 66 } 67 68 return retval; 69 } 70 71 SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun) 72 { 73 RCU_READ_LOCK_GUARD(); 74 return do_scsi_device_find(bus, channel, id, lun, false); 75 } 76 77 SCSIDevice *scsi_device_get(SCSIBus *bus, int channel, int id, int lun) 78 { 79 SCSIDevice *d; 80 RCU_READ_LOCK_GUARD(); 81 d = do_scsi_device_find(bus, channel, id, lun, false); 82 if (d) { 83 object_ref(d); 84 } 85 return d; 86 } 87 88 static void scsi_device_realize(SCSIDevice *s, Error **errp) 89 { 90 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 91 if (sc->realize) { 92 sc->realize(s, errp); 93 } 94 } 95 96 static void scsi_device_unrealize(SCSIDevice *s) 97 { 98 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 99 if (sc->unrealize) { 100 sc->unrealize(s); 101 } 102 } 103 104 int scsi_bus_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf, 105 size_t buf_len, void *hba_private) 106 { 107 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 108 int rc; 109 110 assert(cmd->len == 0); 111 rc = scsi_req_parse_cdb(dev, cmd, buf, buf_len); 112 if (bus->info->parse_cdb) { 113 rc = bus->info->parse_cdb(dev, cmd, buf, buf_len, hba_private); 114 } 115 return rc; 116 } 117 118 static SCSIRequest *scsi_device_alloc_req(SCSIDevice *s, uint32_t tag, uint32_t lun, 119 uint8_t *buf, void *hba_private) 120 { 121 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 122 if (sc->alloc_req) { 123 return sc->alloc_req(s, tag, lun, buf, hba_private); 124 } 125 126 return NULL; 127 } 128 129 void scsi_device_unit_attention_reported(SCSIDevice *s) 130 { 131 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s); 132 if (sc->unit_attention_reported) { 133 sc->unit_attention_reported(s); 134 } 135 } 136 137 /* Create a scsi bus, and attach devices to it. */ 138 void scsi_bus_init_named(SCSIBus *bus, size_t bus_size, DeviceState *host, 139 const SCSIBusInfo *info, const char *bus_name) 140 { 141 qbus_init(bus, bus_size, TYPE_SCSI_BUS, host, bus_name); 142 bus->busnr = next_scsi_bus++; 143 bus->info = info; 144 qbus_set_bus_hotplug_handler(BUS(bus)); 145 } 146 147 static void scsi_dma_restart_bh(void *opaque) 148 { 149 SCSIDevice *s = opaque; 150 SCSIRequest *req, *next; 151 152 qemu_bh_delete(s->bh); 153 s->bh = NULL; 154 155 aio_context_acquire(blk_get_aio_context(s->conf.blk)); 156 QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) { 157 scsi_req_ref(req); 158 if (req->retry) { 159 req->retry = false; 160 switch (req->cmd.mode) { 161 case SCSI_XFER_FROM_DEV: 162 case SCSI_XFER_TO_DEV: 163 scsi_req_continue(req); 164 break; 165 case SCSI_XFER_NONE: 166 scsi_req_dequeue(req); 167 scsi_req_enqueue(req); 168 break; 169 } 170 } 171 scsi_req_unref(req); 172 } 173 aio_context_release(blk_get_aio_context(s->conf.blk)); 174 /* Drop the reference that was acquired in scsi_dma_restart_cb */ 175 object_unref(OBJECT(s)); 176 } 177 178 void scsi_req_retry(SCSIRequest *req) 179 { 180 /* No need to save a reference, because scsi_dma_restart_bh just 181 * looks at the request list. */ 182 req->retry = true; 183 } 184 185 static void scsi_dma_restart_cb(void *opaque, bool running, RunState state) 186 { 187 SCSIDevice *s = opaque; 188 189 if (!running) { 190 return; 191 } 192 if (!s->bh) { 193 AioContext *ctx = blk_get_aio_context(s->conf.blk); 194 /* The reference is dropped in scsi_dma_restart_bh.*/ 195 object_ref(OBJECT(s)); 196 s->bh = aio_bh_new_guarded(ctx, scsi_dma_restart_bh, s, 197 &DEVICE(s)->mem_reentrancy_guard); 198 qemu_bh_schedule(s->bh); 199 } 200 } 201 202 static bool scsi_bus_is_address_free(SCSIBus *bus, 203 int channel, int target, int lun, 204 SCSIDevice **p_dev) 205 { 206 SCSIDevice *d; 207 208 RCU_READ_LOCK_GUARD(); 209 d = do_scsi_device_find(bus, channel, target, lun, true); 210 if (d && d->lun == lun) { 211 if (p_dev) { 212 *p_dev = d; 213 } 214 return false; 215 } 216 if (p_dev) { 217 *p_dev = NULL; 218 } 219 return true; 220 } 221 222 static bool scsi_bus_check_address(BusState *qbus, DeviceState *qdev, Error **errp) 223 { 224 SCSIDevice *dev = SCSI_DEVICE(qdev); 225 SCSIBus *bus = SCSI_BUS(qbus); 226 227 if (dev->channel > bus->info->max_channel) { 228 error_setg(errp, "bad scsi channel id: %d", dev->channel); 229 return false; 230 } 231 if (dev->id != -1 && dev->id > bus->info->max_target) { 232 error_setg(errp, "bad scsi device id: %d", dev->id); 233 return false; 234 } 235 if (dev->lun != -1 && dev->lun > bus->info->max_lun) { 236 error_setg(errp, "bad scsi device lun: %d", dev->lun); 237 return false; 238 } 239 240 if (dev->id != -1 && dev->lun != -1) { 241 SCSIDevice *d; 242 if (!scsi_bus_is_address_free(bus, dev->channel, dev->id, dev->lun, &d)) { 243 error_setg(errp, "lun already used by '%s'", d->qdev.id); 244 return false; 245 } 246 } 247 248 return true; 249 } 250 251 static void scsi_qdev_realize(DeviceState *qdev, Error **errp) 252 { 253 SCSIDevice *dev = SCSI_DEVICE(qdev); 254 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 255 bool is_free; 256 Error *local_err = NULL; 257 258 if (dev->id == -1) { 259 int id = -1; 260 if (dev->lun == -1) { 261 dev->lun = 0; 262 } 263 do { 264 is_free = scsi_bus_is_address_free(bus, dev->channel, ++id, dev->lun, NULL); 265 } while (!is_free && id < bus->info->max_target); 266 if (!is_free) { 267 error_setg(errp, "no free target"); 268 return; 269 } 270 dev->id = id; 271 } else if (dev->lun == -1) { 272 int lun = -1; 273 do { 274 is_free = scsi_bus_is_address_free(bus, dev->channel, dev->id, ++lun, NULL); 275 } while (!is_free && lun < bus->info->max_lun); 276 if (!is_free) { 277 error_setg(errp, "no free lun"); 278 return; 279 } 280 dev->lun = lun; 281 } 282 283 QTAILQ_INIT(&dev->requests); 284 scsi_device_realize(dev, &local_err); 285 if (local_err) { 286 error_propagate(errp, local_err); 287 return; 288 } 289 dev->vmsentry = qdev_add_vm_change_state_handler(DEVICE(dev), 290 scsi_dma_restart_cb, dev); 291 } 292 293 static void scsi_qdev_unrealize(DeviceState *qdev) 294 { 295 SCSIDevice *dev = SCSI_DEVICE(qdev); 296 297 if (dev->vmsentry) { 298 qemu_del_vm_change_state_handler(dev->vmsentry); 299 } 300 301 scsi_device_purge_requests(dev, SENSE_CODE(NO_SENSE)); 302 303 scsi_device_unrealize(dev); 304 305 blockdev_mark_auto_del(dev->conf.blk); 306 } 307 308 /* handle legacy '-drive if=scsi,...' cmd line args */ 309 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockBackend *blk, 310 int unit, bool removable, int bootindex, 311 bool share_rw, 312 BlockdevOnError rerror, 313 BlockdevOnError werror, 314 const char *serial, Error **errp) 315 { 316 const char *driver; 317 char *name; 318 DeviceState *dev; 319 DriveInfo *dinfo; 320 321 if (blk_is_sg(blk)) { 322 driver = "scsi-generic"; 323 } else { 324 dinfo = blk_legacy_dinfo(blk); 325 if (dinfo && dinfo->media_cd) { 326 driver = "scsi-cd"; 327 } else { 328 driver = "scsi-hd"; 329 } 330 } 331 dev = qdev_new(driver); 332 name = g_strdup_printf("legacy[%d]", unit); 333 object_property_add_child(OBJECT(bus), name, OBJECT(dev)); 334 g_free(name); 335 336 qdev_prop_set_uint32(dev, "scsi-id", unit); 337 if (bootindex >= 0) { 338 object_property_set_int(OBJECT(dev), "bootindex", bootindex, 339 &error_abort); 340 } 341 if (object_property_find(OBJECT(dev), "removable")) { 342 qdev_prop_set_bit(dev, "removable", removable); 343 } 344 if (serial && object_property_find(OBJECT(dev), "serial")) { 345 qdev_prop_set_string(dev, "serial", serial); 346 } 347 if (!qdev_prop_set_drive_err(dev, "drive", blk, errp)) { 348 object_unparent(OBJECT(dev)); 349 return NULL; 350 } 351 if (!object_property_set_bool(OBJECT(dev), "share-rw", share_rw, errp)) { 352 object_unparent(OBJECT(dev)); 353 return NULL; 354 } 355 356 qdev_prop_set_enum(dev, "rerror", rerror); 357 qdev_prop_set_enum(dev, "werror", werror); 358 359 if (!qdev_realize_and_unref(dev, &bus->qbus, errp)) { 360 object_unparent(OBJECT(dev)); 361 return NULL; 362 } 363 return SCSI_DEVICE(dev); 364 } 365 366 void scsi_bus_legacy_handle_cmdline(SCSIBus *bus) 367 { 368 Location loc; 369 DriveInfo *dinfo; 370 int unit; 371 372 loc_push_none(&loc); 373 for (unit = 0; unit <= bus->info->max_target; unit++) { 374 dinfo = drive_get(IF_SCSI, bus->busnr, unit); 375 if (dinfo == NULL) { 376 continue; 377 } 378 qemu_opts_loc_restore(dinfo->opts); 379 scsi_bus_legacy_add_drive(bus, blk_by_legacy_dinfo(dinfo), 380 unit, false, -1, false, 381 BLOCKDEV_ON_ERROR_AUTO, 382 BLOCKDEV_ON_ERROR_AUTO, 383 NULL, &error_fatal); 384 } 385 loc_pop(&loc); 386 } 387 388 static int32_t scsi_invalid_field(SCSIRequest *req, uint8_t *buf) 389 { 390 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD)); 391 scsi_req_complete(req, CHECK_CONDITION); 392 return 0; 393 } 394 395 static const struct SCSIReqOps reqops_invalid_field = { 396 .size = sizeof(SCSIRequest), 397 .send_command = scsi_invalid_field 398 }; 399 400 /* SCSIReqOps implementation for invalid commands. */ 401 402 static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf) 403 { 404 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE)); 405 scsi_req_complete(req, CHECK_CONDITION); 406 return 0; 407 } 408 409 static const struct SCSIReqOps reqops_invalid_opcode = { 410 .size = sizeof(SCSIRequest), 411 .send_command = scsi_invalid_command 412 }; 413 414 /* SCSIReqOps implementation for unit attention conditions. */ 415 416 static void scsi_fetch_unit_attention_sense(SCSIRequest *req) 417 { 418 SCSISense *ua = NULL; 419 420 if (req->dev->unit_attention.key == UNIT_ATTENTION) { 421 ua = &req->dev->unit_attention; 422 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) { 423 ua = &req->bus->unit_attention; 424 } 425 426 /* 427 * Fetch the unit attention sense immediately so that another 428 * scsi_req_new does not use reqops_unit_attention. 429 */ 430 if (ua) { 431 scsi_req_build_sense(req, *ua); 432 *ua = SENSE_CODE(NO_SENSE); 433 } 434 } 435 436 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf) 437 { 438 scsi_req_complete(req, CHECK_CONDITION); 439 return 0; 440 } 441 442 static const struct SCSIReqOps reqops_unit_attention = { 443 .size = sizeof(SCSIRequest), 444 .init_req = scsi_fetch_unit_attention_sense, 445 .send_command = scsi_unit_attention 446 }; 447 448 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to 449 an invalid LUN. */ 450 451 typedef struct SCSITargetReq SCSITargetReq; 452 453 struct SCSITargetReq { 454 SCSIRequest req; 455 int len; 456 uint8_t *buf; 457 int buf_len; 458 }; 459 460 static void store_lun(uint8_t *outbuf, int lun) 461 { 462 if (lun < 256) { 463 /* Simple logical unit addressing method*/ 464 outbuf[0] = 0; 465 outbuf[1] = lun; 466 } else { 467 /* Flat space addressing method */ 468 outbuf[0] = 0x40 | (lun >> 8); 469 outbuf[1] = (lun & 255); 470 } 471 } 472 473 static bool scsi_target_emulate_report_luns(SCSITargetReq *r) 474 { 475 BusChild *kid; 476 int channel, id; 477 uint8_t tmp[8] = {0}; 478 int len = 0; 479 GByteArray *buf; 480 481 if (r->req.cmd.xfer < 16) { 482 return false; 483 } 484 if (r->req.cmd.buf[2] > 2) { 485 return false; 486 } 487 488 /* reserve space for 63 LUNs*/ 489 buf = g_byte_array_sized_new(512); 490 491 channel = r->req.dev->channel; 492 id = r->req.dev->id; 493 494 /* add size (will be updated later to correct value */ 495 g_byte_array_append(buf, tmp, 8); 496 len += 8; 497 498 /* add LUN0 */ 499 g_byte_array_append(buf, tmp, 8); 500 len += 8; 501 502 WITH_RCU_READ_LOCK_GUARD() { 503 QTAILQ_FOREACH_RCU(kid, &r->req.bus->qbus.children, sibling) { 504 DeviceState *qdev = kid->child; 505 SCSIDevice *dev = SCSI_DEVICE(qdev); 506 507 if (dev->channel == channel && dev->id == id && dev->lun != 0 && 508 qdev_is_realized(&dev->qdev)) { 509 store_lun(tmp, dev->lun); 510 g_byte_array_append(buf, tmp, 8); 511 len += 8; 512 } 513 } 514 } 515 516 r->buf_len = len; 517 r->buf = g_byte_array_free(buf, FALSE); 518 r->len = MIN(len, r->req.cmd.xfer & ~7); 519 520 /* store the LUN list length */ 521 stl_be_p(&r->buf[0], len - 8); 522 523 /* 524 * If a REPORT LUNS command enters the enabled command state, [...] 525 * the device server shall clear any pending unit attention condition 526 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED. 527 */ 528 scsi_clear_reported_luns_changed(&r->req); 529 530 return true; 531 } 532 533 static bool scsi_target_emulate_inquiry(SCSITargetReq *r) 534 { 535 assert(r->req.dev->lun != r->req.lun); 536 537 scsi_target_alloc_buf(&r->req, SCSI_INQUIRY_LEN); 538 539 if (r->req.cmd.buf[1] & 0x2) { 540 /* Command support data - optional, not implemented */ 541 return false; 542 } 543 544 if (r->req.cmd.buf[1] & 0x1) { 545 /* Vital product data */ 546 uint8_t page_code = r->req.cmd.buf[2]; 547 r->buf[r->len++] = page_code ; /* this page */ 548 r->buf[r->len++] = 0x00; 549 550 switch (page_code) { 551 case 0x00: /* Supported page codes, mandatory */ 552 { 553 int pages; 554 pages = r->len++; 555 r->buf[r->len++] = 0x00; /* list of supported pages (this page) */ 556 r->buf[pages] = r->len - pages - 1; /* number of pages */ 557 break; 558 } 559 default: 560 return false; 561 } 562 /* done with EVPD */ 563 assert(r->len < r->buf_len); 564 r->len = MIN(r->req.cmd.xfer, r->len); 565 return true; 566 } 567 568 /* Standard INQUIRY data */ 569 if (r->req.cmd.buf[2] != 0) { 570 return false; 571 } 572 573 /* PAGE CODE == 0 */ 574 r->len = MIN(r->req.cmd.xfer, SCSI_INQUIRY_LEN); 575 memset(r->buf, 0, r->len); 576 if (r->req.lun != 0) { 577 r->buf[0] = TYPE_NO_LUN; 578 } else { 579 r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE; 580 r->buf[2] = 5; /* Version */ 581 r->buf[3] = 2 | 0x10; /* HiSup, response data format */ 582 r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */ 583 r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ. */ 584 memcpy(&r->buf[8], "QEMU ", 8); 585 memcpy(&r->buf[16], "QEMU TARGET ", 16); 586 pstrcpy((char *) &r->buf[32], 4, qemu_hw_version()); 587 } 588 return true; 589 } 590 591 static size_t scsi_sense_len(SCSIRequest *req) 592 { 593 if (req->dev->type == TYPE_SCANNER) 594 return SCSI_SENSE_LEN_SCANNER; 595 else 596 return SCSI_SENSE_LEN; 597 } 598 599 static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf) 600 { 601 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 602 int fixed_sense = (req->cmd.buf[1] & 1) == 0; 603 604 if (req->lun != 0 && 605 buf[0] != INQUIRY && buf[0] != REQUEST_SENSE) { 606 scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED)); 607 scsi_req_complete(req, CHECK_CONDITION); 608 return 0; 609 } 610 switch (buf[0]) { 611 case REPORT_LUNS: 612 if (!scsi_target_emulate_report_luns(r)) { 613 goto illegal_request; 614 } 615 break; 616 case INQUIRY: 617 if (!scsi_target_emulate_inquiry(r)) { 618 goto illegal_request; 619 } 620 break; 621 case REQUEST_SENSE: 622 scsi_target_alloc_buf(&r->req, scsi_sense_len(req)); 623 if (req->lun != 0) { 624 const struct SCSISense sense = SENSE_CODE(LUN_NOT_SUPPORTED); 625 626 r->len = scsi_build_sense_buf(r->buf, req->cmd.xfer, 627 sense, fixed_sense); 628 } else { 629 r->len = scsi_device_get_sense(r->req.dev, r->buf, 630 MIN(req->cmd.xfer, r->buf_len), 631 fixed_sense); 632 } 633 if (r->req.dev->sense_is_ua) { 634 scsi_device_unit_attention_reported(req->dev); 635 r->req.dev->sense_len = 0; 636 r->req.dev->sense_is_ua = false; 637 } 638 break; 639 case TEST_UNIT_READY: 640 break; 641 default: 642 scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE)); 643 scsi_req_complete(req, CHECK_CONDITION); 644 return 0; 645 illegal_request: 646 scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD)); 647 scsi_req_complete(req, CHECK_CONDITION); 648 return 0; 649 } 650 651 if (!r->len) { 652 scsi_req_complete(req, GOOD); 653 } 654 return r->len; 655 } 656 657 static void scsi_target_read_data(SCSIRequest *req) 658 { 659 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 660 uint32_t n; 661 662 n = r->len; 663 if (n > 0) { 664 r->len = 0; 665 scsi_req_data(&r->req, n); 666 } else { 667 scsi_req_complete(&r->req, GOOD); 668 } 669 } 670 671 static uint8_t *scsi_target_get_buf(SCSIRequest *req) 672 { 673 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 674 675 return r->buf; 676 } 677 678 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len) 679 { 680 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 681 682 r->buf = g_malloc(len); 683 r->buf_len = len; 684 685 return r->buf; 686 } 687 688 static void scsi_target_free_buf(SCSIRequest *req) 689 { 690 SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req); 691 692 g_free(r->buf); 693 } 694 695 static const struct SCSIReqOps reqops_target_command = { 696 .size = sizeof(SCSITargetReq), 697 .send_command = scsi_target_send_command, 698 .read_data = scsi_target_read_data, 699 .get_buf = scsi_target_get_buf, 700 .free_req = scsi_target_free_buf, 701 }; 702 703 704 SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d, 705 uint32_t tag, uint32_t lun, void *hba_private) 706 { 707 SCSIRequest *req; 708 SCSIBus *bus = scsi_bus_from_device(d); 709 BusState *qbus = BUS(bus); 710 const int memset_off = offsetof(SCSIRequest, sense) 711 + sizeof(req->sense); 712 713 req = g_malloc(reqops->size); 714 memset((uint8_t *)req + memset_off, 0, reqops->size - memset_off); 715 req->refcount = 1; 716 req->bus = bus; 717 req->dev = d; 718 req->tag = tag; 719 req->lun = lun; 720 req->hba_private = hba_private; 721 req->status = -1; 722 req->host_status = -1; 723 req->ops = reqops; 724 object_ref(OBJECT(d)); 725 object_ref(OBJECT(qbus->parent)); 726 notifier_list_init(&req->cancel_notifiers); 727 728 if (reqops->init_req) { 729 reqops->init_req(req); 730 } 731 732 trace_scsi_req_alloc(req->dev->id, req->lun, req->tag); 733 return req; 734 } 735 736 SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun, 737 uint8_t *buf, size_t buf_len, void *hba_private) 738 { 739 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus); 740 const SCSIReqOps *ops; 741 SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(d); 742 SCSIRequest *req; 743 SCSICommand cmd = { .len = 0 }; 744 int ret; 745 746 if (buf_len == 0) { 747 trace_scsi_req_parse_bad(d->id, lun, tag, 0); 748 goto invalid_opcode; 749 } 750 751 if ((d->unit_attention.key == UNIT_ATTENTION || 752 bus->unit_attention.key == UNIT_ATTENTION) && 753 (buf[0] != INQUIRY && 754 buf[0] != REPORT_LUNS && 755 buf[0] != GET_CONFIGURATION && 756 buf[0] != GET_EVENT_STATUS_NOTIFICATION && 757 758 /* 759 * If we already have a pending unit attention condition, 760 * report this one before triggering another one. 761 */ 762 !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) { 763 ops = &reqops_unit_attention; 764 } else if (lun != d->lun || 765 buf[0] == REPORT_LUNS || 766 (buf[0] == REQUEST_SENSE && d->sense_len)) { 767 ops = &reqops_target_command; 768 } else { 769 ops = NULL; 770 } 771 772 if (ops != NULL || !sc->parse_cdb) { 773 ret = scsi_req_parse_cdb(d, &cmd, buf, buf_len); 774 } else { 775 ret = sc->parse_cdb(d, &cmd, buf, buf_len, hba_private); 776 } 777 778 if (ret != 0) { 779 trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]); 780 invalid_opcode: 781 req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private); 782 } else { 783 assert(cmd.len != 0); 784 trace_scsi_req_parsed(d->id, lun, tag, buf[0], 785 cmd.mode, cmd.xfer); 786 if (cmd.lba != -1) { 787 trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0], 788 cmd.lba); 789 } 790 791 if (cmd.xfer > INT32_MAX) { 792 req = scsi_req_alloc(&reqops_invalid_field, d, tag, lun, hba_private); 793 } else if (ops) { 794 req = scsi_req_alloc(ops, d, tag, lun, hba_private); 795 } else { 796 req = scsi_device_alloc_req(d, tag, lun, buf, hba_private); 797 } 798 } 799 800 req->cmd = cmd; 801 req->residual = req->cmd.xfer; 802 803 switch (buf[0]) { 804 case INQUIRY: 805 trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]); 806 break; 807 case TEST_UNIT_READY: 808 trace_scsi_test_unit_ready(d->id, lun, tag); 809 break; 810 case REPORT_LUNS: 811 trace_scsi_report_luns(d->id, lun, tag); 812 break; 813 case REQUEST_SENSE: 814 trace_scsi_request_sense(d->id, lun, tag); 815 break; 816 default: 817 break; 818 } 819 820 return req; 821 } 822 823 uint8_t *scsi_req_get_buf(SCSIRequest *req) 824 { 825 return req->ops->get_buf(req); 826 } 827 828 static void scsi_clear_reported_luns_changed(SCSIRequest *req) 829 { 830 SCSISense *ua; 831 832 if (req->dev->unit_attention.key == UNIT_ATTENTION) { 833 ua = &req->dev->unit_attention; 834 } else if (req->bus->unit_attention.key == UNIT_ATTENTION) { 835 ua = &req->bus->unit_attention; 836 } else { 837 return; 838 } 839 840 if (ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc && 841 ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq) { 842 *ua = SENSE_CODE(NO_SENSE); 843 } 844 } 845 846 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len) 847 { 848 int ret; 849 850 assert(len >= 14); 851 if (!req->sense_len) { 852 return 0; 853 } 854 855 ret = scsi_convert_sense(req->sense, req->sense_len, buf, len, true); 856 857 /* 858 * FIXME: clearing unit attention conditions upon autosense should be done 859 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b 860 * (SAM-5, 5.14). 861 * 862 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and 863 * 10b for HBAs that do not support it (do not call scsi_req_get_sense). 864 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b. 865 */ 866 if (req->dev->sense_is_ua) { 867 scsi_device_unit_attention_reported(req->dev); 868 req->dev->sense_len = 0; 869 req->dev->sense_is_ua = false; 870 } 871 return ret; 872 } 873 874 int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed) 875 { 876 return scsi_convert_sense(dev->sense, dev->sense_len, buf, len, fixed); 877 } 878 879 void scsi_req_build_sense(SCSIRequest *req, SCSISense sense) 880 { 881 trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag, 882 sense.key, sense.asc, sense.ascq); 883 req->sense_len = scsi_build_sense(req->sense, sense); 884 } 885 886 static void scsi_req_enqueue_internal(SCSIRequest *req) 887 { 888 assert(!req->enqueued); 889 scsi_req_ref(req); 890 if (req->bus->info->get_sg_list) { 891 req->sg = req->bus->info->get_sg_list(req); 892 } else { 893 req->sg = NULL; 894 } 895 req->enqueued = true; 896 QTAILQ_INSERT_TAIL(&req->dev->requests, req, next); 897 } 898 899 int32_t scsi_req_enqueue(SCSIRequest *req) 900 { 901 int32_t rc; 902 903 assert(!req->retry); 904 scsi_req_enqueue_internal(req); 905 scsi_req_ref(req); 906 rc = req->ops->send_command(req, req->cmd.buf); 907 scsi_req_unref(req); 908 return rc; 909 } 910 911 static void scsi_req_dequeue(SCSIRequest *req) 912 { 913 trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag); 914 req->retry = false; 915 if (req->enqueued) { 916 QTAILQ_REMOVE(&req->dev->requests, req, next); 917 req->enqueued = false; 918 scsi_req_unref(req); 919 } 920 } 921 922 static int scsi_get_performance_length(int num_desc, int type, int data_type) 923 { 924 /* MMC-6, paragraph 6.7. */ 925 switch (type) { 926 case 0: 927 if ((data_type & 3) == 0) { 928 /* Each descriptor is as in Table 295 - Nominal performance. */ 929 return 16 * num_desc + 8; 930 } else { 931 /* Each descriptor is as in Table 296 - Exceptions. */ 932 return 6 * num_desc + 8; 933 } 934 case 1: 935 case 4: 936 case 5: 937 return 8 * num_desc + 8; 938 case 2: 939 return 2048 * num_desc + 8; 940 case 3: 941 return 16 * num_desc + 8; 942 default: 943 return 8; 944 } 945 } 946 947 static int ata_passthrough_xfer_unit(SCSIDevice *dev, uint8_t *buf) 948 { 949 int byte_block = (buf[2] >> 2) & 0x1; 950 int type = (buf[2] >> 4) & 0x1; 951 int xfer_unit; 952 953 if (byte_block) { 954 if (type) { 955 xfer_unit = dev->blocksize; 956 } else { 957 xfer_unit = 512; 958 } 959 } else { 960 xfer_unit = 1; 961 } 962 963 return xfer_unit; 964 } 965 966 static int ata_passthrough_12_xfer(SCSIDevice *dev, uint8_t *buf) 967 { 968 int length = buf[2] & 0x3; 969 int xfer; 970 int unit = ata_passthrough_xfer_unit(dev, buf); 971 972 switch (length) { 973 case 0: 974 case 3: /* USB-specific. */ 975 default: 976 xfer = 0; 977 break; 978 case 1: 979 xfer = buf[3]; 980 break; 981 case 2: 982 xfer = buf[4]; 983 break; 984 } 985 986 return xfer * unit; 987 } 988 989 static int ata_passthrough_16_xfer(SCSIDevice *dev, uint8_t *buf) 990 { 991 int extend = buf[1] & 0x1; 992 int length = buf[2] & 0x3; 993 int xfer; 994 int unit = ata_passthrough_xfer_unit(dev, buf); 995 996 switch (length) { 997 case 0: 998 case 3: /* USB-specific. */ 999 default: 1000 xfer = 0; 1001 break; 1002 case 1: 1003 xfer = buf[4]; 1004 xfer |= (extend ? buf[3] << 8 : 0); 1005 break; 1006 case 2: 1007 xfer = buf[6]; 1008 xfer |= (extend ? buf[5] << 8 : 0); 1009 break; 1010 } 1011 1012 return xfer * unit; 1013 } 1014 1015 static int scsi_req_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1016 { 1017 cmd->xfer = scsi_cdb_xfer(buf); 1018 switch (buf[0]) { 1019 case TEST_UNIT_READY: 1020 case REWIND: 1021 case START_STOP: 1022 case SET_CAPACITY: 1023 case WRITE_FILEMARKS: 1024 case WRITE_FILEMARKS_16: 1025 case SPACE: 1026 case RESERVE: 1027 case RELEASE: 1028 case ERASE: 1029 case ALLOW_MEDIUM_REMOVAL: 1030 case SEEK_10: 1031 case SYNCHRONIZE_CACHE: 1032 case SYNCHRONIZE_CACHE_16: 1033 case LOCATE_16: 1034 case LOCK_UNLOCK_CACHE: 1035 case SET_CD_SPEED: 1036 case SET_LIMITS: 1037 case WRITE_LONG_10: 1038 case UPDATE_BLOCK: 1039 case RESERVE_TRACK: 1040 case SET_READ_AHEAD: 1041 case PRE_FETCH: 1042 case PRE_FETCH_16: 1043 case ALLOW_OVERWRITE: 1044 cmd->xfer = 0; 1045 break; 1046 case VERIFY_10: 1047 case VERIFY_12: 1048 case VERIFY_16: 1049 if ((buf[1] & 2) == 0) { 1050 cmd->xfer = 0; 1051 } else if ((buf[1] & 4) != 0) { 1052 cmd->xfer = 1; 1053 } 1054 cmd->xfer *= dev->blocksize; 1055 break; 1056 case MODE_SENSE: 1057 break; 1058 case WRITE_SAME_10: 1059 case WRITE_SAME_16: 1060 cmd->xfer = buf[1] & 1 ? 0 : dev->blocksize; 1061 break; 1062 case READ_CAPACITY_10: 1063 cmd->xfer = 8; 1064 break; 1065 case READ_BLOCK_LIMITS: 1066 cmd->xfer = 6; 1067 break; 1068 case SEND_VOLUME_TAG: 1069 /* GPCMD_SET_STREAMING from multimedia commands. */ 1070 if (dev->type == TYPE_ROM) { 1071 cmd->xfer = buf[10] | (buf[9] << 8); 1072 } else { 1073 cmd->xfer = buf[9] | (buf[8] << 8); 1074 } 1075 break; 1076 case WRITE_6: 1077 /* length 0 means 256 blocks */ 1078 if (cmd->xfer == 0) { 1079 cmd->xfer = 256; 1080 } 1081 /* fall through */ 1082 case WRITE_10: 1083 case WRITE_VERIFY_10: 1084 case WRITE_12: 1085 case WRITE_VERIFY_12: 1086 case WRITE_16: 1087 case WRITE_VERIFY_16: 1088 cmd->xfer *= dev->blocksize; 1089 break; 1090 case READ_6: 1091 case READ_REVERSE: 1092 /* length 0 means 256 blocks */ 1093 if (cmd->xfer == 0) { 1094 cmd->xfer = 256; 1095 } 1096 /* fall through */ 1097 case READ_10: 1098 case READ_12: 1099 case READ_16: 1100 cmd->xfer *= dev->blocksize; 1101 break; 1102 case FORMAT_UNIT: 1103 /* MMC mandates the parameter list to be 12-bytes long. Parameters 1104 * for block devices are restricted to the header right now. */ 1105 if (dev->type == TYPE_ROM && (buf[1] & 16)) { 1106 cmd->xfer = 12; 1107 } else { 1108 cmd->xfer = (buf[1] & 16) == 0 ? 0 : (buf[1] & 32 ? 8 : 4); 1109 } 1110 break; 1111 case INQUIRY: 1112 case RECEIVE_DIAGNOSTIC: 1113 case SEND_DIAGNOSTIC: 1114 cmd->xfer = buf[4] | (buf[3] << 8); 1115 break; 1116 case READ_CD: 1117 case READ_BUFFER: 1118 case WRITE_BUFFER: 1119 case SEND_CUE_SHEET: 1120 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16); 1121 break; 1122 case PERSISTENT_RESERVE_OUT: 1123 cmd->xfer = ldl_be_p(&buf[5]) & 0xffffffffULL; 1124 break; 1125 case ERASE_12: 1126 if (dev->type == TYPE_ROM) { 1127 /* MMC command GET PERFORMANCE. */ 1128 cmd->xfer = scsi_get_performance_length(buf[9] | (buf[8] << 8), 1129 buf[10], buf[1] & 0x1f); 1130 } 1131 break; 1132 case MECHANISM_STATUS: 1133 case READ_DVD_STRUCTURE: 1134 case SEND_DVD_STRUCTURE: 1135 case MAINTENANCE_OUT: 1136 case MAINTENANCE_IN: 1137 if (dev->type == TYPE_ROM) { 1138 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */ 1139 cmd->xfer = buf[9] | (buf[8] << 8); 1140 } 1141 break; 1142 case ATA_PASSTHROUGH_12: 1143 if (dev->type == TYPE_ROM) { 1144 /* BLANK command of MMC */ 1145 cmd->xfer = 0; 1146 } else { 1147 cmd->xfer = ata_passthrough_12_xfer(dev, buf); 1148 } 1149 break; 1150 case ATA_PASSTHROUGH_16: 1151 cmd->xfer = ata_passthrough_16_xfer(dev, buf); 1152 break; 1153 } 1154 return 0; 1155 } 1156 1157 static int scsi_req_stream_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1158 { 1159 switch (buf[0]) { 1160 /* stream commands */ 1161 case ERASE_12: 1162 case ERASE_16: 1163 cmd->xfer = 0; 1164 break; 1165 case READ_6: 1166 case READ_REVERSE: 1167 case RECOVER_BUFFERED_DATA: 1168 case WRITE_6: 1169 cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16); 1170 if (buf[1] & 0x01) { /* fixed */ 1171 cmd->xfer *= dev->blocksize; 1172 } 1173 break; 1174 case READ_16: 1175 case READ_REVERSE_16: 1176 case VERIFY_16: 1177 case WRITE_16: 1178 cmd->xfer = buf[14] | (buf[13] << 8) | (buf[12] << 16); 1179 if (buf[1] & 0x01) { /* fixed */ 1180 cmd->xfer *= dev->blocksize; 1181 } 1182 break; 1183 case REWIND: 1184 case LOAD_UNLOAD: 1185 cmd->xfer = 0; 1186 break; 1187 case SPACE_16: 1188 cmd->xfer = buf[13] | (buf[12] << 8); 1189 break; 1190 case READ_POSITION: 1191 switch (buf[1] & 0x1f) /* operation code */ { 1192 case SHORT_FORM_BLOCK_ID: 1193 case SHORT_FORM_VENDOR_SPECIFIC: 1194 cmd->xfer = 20; 1195 break; 1196 case LONG_FORM: 1197 cmd->xfer = 32; 1198 break; 1199 case EXTENDED_FORM: 1200 cmd->xfer = buf[8] | (buf[7] << 8); 1201 break; 1202 default: 1203 return -1; 1204 } 1205 1206 break; 1207 case FORMAT_UNIT: 1208 cmd->xfer = buf[4] | (buf[3] << 8); 1209 break; 1210 /* generic commands */ 1211 default: 1212 return scsi_req_xfer(cmd, dev, buf); 1213 } 1214 return 0; 1215 } 1216 1217 static int scsi_req_medium_changer_xfer(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1218 { 1219 switch (buf[0]) { 1220 /* medium changer commands */ 1221 case EXCHANGE_MEDIUM: 1222 case INITIALIZE_ELEMENT_STATUS: 1223 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE: 1224 case MOVE_MEDIUM: 1225 case POSITION_TO_ELEMENT: 1226 cmd->xfer = 0; 1227 break; 1228 case READ_ELEMENT_STATUS: 1229 cmd->xfer = buf[9] | (buf[8] << 8) | (buf[7] << 16); 1230 break; 1231 1232 /* generic commands */ 1233 default: 1234 return scsi_req_xfer(cmd, dev, buf); 1235 } 1236 return 0; 1237 } 1238 1239 static int scsi_req_scanner_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) 1240 { 1241 switch (buf[0]) { 1242 /* Scanner commands */ 1243 case OBJECT_POSITION: 1244 cmd->xfer = 0; 1245 break; 1246 case SCAN: 1247 cmd->xfer = buf[4]; 1248 break; 1249 case READ_10: 1250 case SEND: 1251 case GET_WINDOW: 1252 case SET_WINDOW: 1253 cmd->xfer = buf[8] | (buf[7] << 8) | (buf[6] << 16); 1254 break; 1255 default: 1256 /* GET_DATA_BUFFER_STATUS xfer handled by scsi_req_xfer */ 1257 return scsi_req_xfer(cmd, dev, buf); 1258 } 1259 1260 return 0; 1261 } 1262 1263 static void scsi_cmd_xfer_mode(SCSICommand *cmd) 1264 { 1265 if (!cmd->xfer) { 1266 cmd->mode = SCSI_XFER_NONE; 1267 return; 1268 } 1269 switch (cmd->buf[0]) { 1270 case WRITE_6: 1271 case WRITE_10: 1272 case WRITE_VERIFY_10: 1273 case WRITE_12: 1274 case WRITE_VERIFY_12: 1275 case WRITE_16: 1276 case WRITE_VERIFY_16: 1277 case VERIFY_10: 1278 case VERIFY_12: 1279 case VERIFY_16: 1280 case COPY: 1281 case COPY_VERIFY: 1282 case COMPARE: 1283 case CHANGE_DEFINITION: 1284 case LOG_SELECT: 1285 case MODE_SELECT: 1286 case MODE_SELECT_10: 1287 case SEND_DIAGNOSTIC: 1288 case WRITE_BUFFER: 1289 case FORMAT_UNIT: 1290 case REASSIGN_BLOCKS: 1291 case SEARCH_EQUAL: 1292 case SEARCH_HIGH: 1293 case SEARCH_LOW: 1294 case UPDATE_BLOCK: 1295 case WRITE_LONG_10: 1296 case WRITE_SAME_10: 1297 case WRITE_SAME_16: 1298 case UNMAP: 1299 case SEARCH_HIGH_12: 1300 case SEARCH_EQUAL_12: 1301 case SEARCH_LOW_12: 1302 case MEDIUM_SCAN: 1303 case SEND_VOLUME_TAG: 1304 case SEND_CUE_SHEET: 1305 case SEND_DVD_STRUCTURE: 1306 case PERSISTENT_RESERVE_OUT: 1307 case MAINTENANCE_OUT: 1308 case SET_WINDOW: 1309 case SCAN: 1310 /* SCAN conflicts with START_STOP. START_STOP has cmd->xfer set to 0 for 1311 * non-scanner devices, so we only get here for SCAN and not for START_STOP. 1312 */ 1313 cmd->mode = SCSI_XFER_TO_DEV; 1314 break; 1315 case ATA_PASSTHROUGH_12: 1316 case ATA_PASSTHROUGH_16: 1317 /* T_DIR */ 1318 cmd->mode = (cmd->buf[2] & 0x8) ? 1319 SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV; 1320 break; 1321 default: 1322 cmd->mode = SCSI_XFER_FROM_DEV; 1323 break; 1324 } 1325 } 1326 1327 int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf, 1328 size_t buf_len) 1329 { 1330 int rc; 1331 int len; 1332 1333 cmd->lba = -1; 1334 len = scsi_cdb_length(buf); 1335 if (len < 0 || len > buf_len) { 1336 return -1; 1337 } 1338 1339 cmd->len = len; 1340 switch (dev->type) { 1341 case TYPE_TAPE: 1342 rc = scsi_req_stream_xfer(cmd, dev, buf); 1343 break; 1344 case TYPE_MEDIUM_CHANGER: 1345 rc = scsi_req_medium_changer_xfer(cmd, dev, buf); 1346 break; 1347 case TYPE_SCANNER: 1348 rc = scsi_req_scanner_length(cmd, dev, buf); 1349 break; 1350 default: 1351 rc = scsi_req_xfer(cmd, dev, buf); 1352 break; 1353 } 1354 1355 if (rc != 0) 1356 return rc; 1357 1358 memcpy(cmd->buf, buf, cmd->len); 1359 scsi_cmd_xfer_mode(cmd); 1360 cmd->lba = scsi_cmd_lba(cmd); 1361 return 0; 1362 } 1363 1364 void scsi_device_report_change(SCSIDevice *dev, SCSISense sense) 1365 { 1366 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus); 1367 1368 scsi_device_set_ua(dev, sense); 1369 if (bus->info->change) { 1370 bus->info->change(bus, dev, sense); 1371 } 1372 } 1373 1374 SCSIRequest *scsi_req_ref(SCSIRequest *req) 1375 { 1376 assert(req->refcount > 0); 1377 req->refcount++; 1378 return req; 1379 } 1380 1381 void scsi_req_unref(SCSIRequest *req) 1382 { 1383 assert(req->refcount > 0); 1384 if (--req->refcount == 0) { 1385 BusState *qbus = req->dev->qdev.parent_bus; 1386 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus); 1387 1388 if (bus->info->free_request && req->hba_private) { 1389 bus->info->free_request(bus, req->hba_private); 1390 } 1391 if (req->ops->free_req) { 1392 req->ops->free_req(req); 1393 } 1394 object_unref(OBJECT(req->dev)); 1395 object_unref(OBJECT(qbus->parent)); 1396 g_free(req); 1397 } 1398 } 1399 1400 /* Tell the device that we finished processing this chunk of I/O. It 1401 will start the next chunk or complete the command. */ 1402 void scsi_req_continue(SCSIRequest *req) 1403 { 1404 if (req->io_canceled) { 1405 trace_scsi_req_continue_canceled(req->dev->id, req->lun, req->tag); 1406 return; 1407 } 1408 trace_scsi_req_continue(req->dev->id, req->lun, req->tag); 1409 if (req->cmd.mode == SCSI_XFER_TO_DEV) { 1410 req->ops->write_data(req); 1411 } else { 1412 req->ops->read_data(req); 1413 } 1414 } 1415 1416 /* Called by the devices when data is ready for the HBA. The HBA should 1417 start a DMA operation to read or fill the device's data buffer. 1418 Once it completes, calling scsi_req_continue will restart I/O. */ 1419 void scsi_req_data(SCSIRequest *req, int len) 1420 { 1421 uint8_t *buf; 1422 if (req->io_canceled) { 1423 trace_scsi_req_data_canceled(req->dev->id, req->lun, req->tag, len); 1424 return; 1425 } 1426 trace_scsi_req_data(req->dev->id, req->lun, req->tag, len); 1427 assert(req->cmd.mode != SCSI_XFER_NONE); 1428 if (!req->sg) { 1429 req->residual -= len; 1430 req->bus->info->transfer_data(req, len); 1431 return; 1432 } 1433 1434 /* If the device calls scsi_req_data and the HBA specified a 1435 * scatter/gather list, the transfer has to happen in a single 1436 * step. */ 1437 assert(!req->dma_started); 1438 req->dma_started = true; 1439 1440 buf = scsi_req_get_buf(req); 1441 if (req->cmd.mode == SCSI_XFER_FROM_DEV) { 1442 dma_buf_read(buf, len, &req->residual, req->sg, 1443 MEMTXATTRS_UNSPECIFIED); 1444 } else { 1445 dma_buf_write(buf, len, &req->residual, req->sg, 1446 MEMTXATTRS_UNSPECIFIED); 1447 } 1448 scsi_req_continue(req); 1449 } 1450 1451 void scsi_req_print(SCSIRequest *req) 1452 { 1453 FILE *fp = stderr; 1454 int i; 1455 1456 fprintf(fp, "[%s id=%d] %s", 1457 req->dev->qdev.parent_bus->name, 1458 req->dev->id, 1459 scsi_command_name(req->cmd.buf[0])); 1460 for (i = 1; i < req->cmd.len; i++) { 1461 fprintf(fp, " 0x%02x", req->cmd.buf[i]); 1462 } 1463 switch (req->cmd.mode) { 1464 case SCSI_XFER_NONE: 1465 fprintf(fp, " - none\n"); 1466 break; 1467 case SCSI_XFER_FROM_DEV: 1468 fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer); 1469 break; 1470 case SCSI_XFER_TO_DEV: 1471 fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer); 1472 break; 1473 default: 1474 fprintf(fp, " - Oops\n"); 1475 break; 1476 } 1477 } 1478 1479 void scsi_req_complete_failed(SCSIRequest *req, int host_status) 1480 { 1481 SCSISense sense; 1482 int status; 1483 1484 assert(req->status == -1 && req->host_status == -1); 1485 assert(req->ops != &reqops_unit_attention); 1486 1487 if (!req->bus->info->fail) { 1488 status = scsi_sense_from_host_status(req->host_status, &sense); 1489 if (status == CHECK_CONDITION) { 1490 scsi_req_build_sense(req, sense); 1491 } 1492 scsi_req_complete(req, status); 1493 return; 1494 } 1495 1496 req->host_status = host_status; 1497 scsi_req_ref(req); 1498 scsi_req_dequeue(req); 1499 req->bus->info->fail(req); 1500 1501 /* Cancelled requests might end up being completed instead of cancelled */ 1502 notifier_list_notify(&req->cancel_notifiers, req); 1503 scsi_req_unref(req); 1504 } 1505 1506 void scsi_req_complete(SCSIRequest *req, int status) 1507 { 1508 assert(req->status == -1 && req->host_status == -1); 1509 req->status = status; 1510 req->host_status = SCSI_HOST_OK; 1511 1512 assert(req->sense_len <= sizeof(req->sense)); 1513 if (status == GOOD) { 1514 req->sense_len = 0; 1515 } 1516 1517 if (req->sense_len) { 1518 memcpy(req->dev->sense, req->sense, req->sense_len); 1519 req->dev->sense_len = req->sense_len; 1520 req->dev->sense_is_ua = (req->ops == &reqops_unit_attention); 1521 } else { 1522 req->dev->sense_len = 0; 1523 req->dev->sense_is_ua = false; 1524 } 1525 1526 scsi_req_ref(req); 1527 scsi_req_dequeue(req); 1528 req->bus->info->complete(req, req->residual); 1529 1530 /* Cancelled requests might end up being completed instead of cancelled */ 1531 notifier_list_notify(&req->cancel_notifiers, req); 1532 scsi_req_unref(req); 1533 } 1534 1535 /* Called by the devices when the request is canceled. */ 1536 void scsi_req_cancel_complete(SCSIRequest *req) 1537 { 1538 assert(req->io_canceled); 1539 if (req->bus->info->cancel) { 1540 req->bus->info->cancel(req); 1541 } 1542 notifier_list_notify(&req->cancel_notifiers, req); 1543 scsi_req_unref(req); 1544 } 1545 1546 /* Cancel @req asynchronously. @notifier is added to @req's cancellation 1547 * notifier list, the bus will be notified the requests cancellation is 1548 * completed. 1549 * */ 1550 void scsi_req_cancel_async(SCSIRequest *req, Notifier *notifier) 1551 { 1552 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag); 1553 if (notifier) { 1554 notifier_list_add(&req->cancel_notifiers, notifier); 1555 } 1556 if (req->io_canceled) { 1557 /* A blk_aio_cancel_async is pending; when it finishes, 1558 * scsi_req_cancel_complete will be called and will 1559 * call the notifier we just added. Just wait for that. 1560 */ 1561 assert(req->aiocb); 1562 return; 1563 } 1564 /* Dropped in scsi_req_cancel_complete. */ 1565 scsi_req_ref(req); 1566 scsi_req_dequeue(req); 1567 req->io_canceled = true; 1568 if (req->aiocb) { 1569 blk_aio_cancel_async(req->aiocb); 1570 } else { 1571 scsi_req_cancel_complete(req); 1572 } 1573 } 1574 1575 void scsi_req_cancel(SCSIRequest *req) 1576 { 1577 trace_scsi_req_cancel(req->dev->id, req->lun, req->tag); 1578 if (!req->enqueued) { 1579 return; 1580 } 1581 assert(!req->io_canceled); 1582 /* Dropped in scsi_req_cancel_complete. */ 1583 scsi_req_ref(req); 1584 scsi_req_dequeue(req); 1585 req->io_canceled = true; 1586 if (req->aiocb) { 1587 blk_aio_cancel(req->aiocb); 1588 } else { 1589 scsi_req_cancel_complete(req); 1590 } 1591 } 1592 1593 static int scsi_ua_precedence(SCSISense sense) 1594 { 1595 if (sense.key != UNIT_ATTENTION) { 1596 return INT_MAX; 1597 } 1598 if (sense.asc == 0x29 && sense.ascq == 0x04) { 1599 /* DEVICE INTERNAL RESET goes with POWER ON OCCURRED */ 1600 return 1; 1601 } else if (sense.asc == 0x3F && sense.ascq == 0x01) { 1602 /* MICROCODE HAS BEEN CHANGED goes with SCSI BUS RESET OCCURRED */ 1603 return 2; 1604 } else if (sense.asc == 0x29 && (sense.ascq == 0x05 || sense.ascq == 0x06)) { 1605 /* These two go with "all others". */ 1606 ; 1607 } else if (sense.asc == 0x29 && sense.ascq <= 0x07) { 1608 /* POWER ON, RESET OR BUS DEVICE RESET OCCURRED = 0 1609 * POWER ON OCCURRED = 1 1610 * SCSI BUS RESET OCCURRED = 2 1611 * BUS DEVICE RESET FUNCTION OCCURRED = 3 1612 * I_T NEXUS LOSS OCCURRED = 7 1613 */ 1614 return sense.ascq; 1615 } else if (sense.asc == 0x2F && sense.ascq == 0x01) { 1616 /* COMMANDS CLEARED BY POWER LOSS NOTIFICATION */ 1617 return 8; 1618 } 1619 return (sense.asc << 8) | sense.ascq; 1620 } 1621 1622 void scsi_bus_set_ua(SCSIBus *bus, SCSISense sense) 1623 { 1624 int prec1, prec2; 1625 if (sense.key != UNIT_ATTENTION) { 1626 return; 1627 } 1628 1629 /* 1630 * Override a pre-existing unit attention condition, except for a more 1631 * important reset condition. 1632 */ 1633 prec1 = scsi_ua_precedence(bus->unit_attention); 1634 prec2 = scsi_ua_precedence(sense); 1635 if (prec2 < prec1) { 1636 bus->unit_attention = sense; 1637 } 1638 } 1639 1640 void scsi_device_set_ua(SCSIDevice *sdev, SCSISense sense) 1641 { 1642 int prec1, prec2; 1643 if (sense.key != UNIT_ATTENTION) { 1644 return; 1645 } 1646 trace_scsi_device_set_ua(sdev->id, sdev->lun, sense.key, 1647 sense.asc, sense.ascq); 1648 1649 /* 1650 * Override a pre-existing unit attention condition, except for a more 1651 * important reset condition. 1652 */ 1653 prec1 = scsi_ua_precedence(sdev->unit_attention); 1654 prec2 = scsi_ua_precedence(sense); 1655 if (prec2 < prec1) { 1656 sdev->unit_attention = sense; 1657 } 1658 } 1659 1660 void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense) 1661 { 1662 SCSIRequest *req; 1663 1664 aio_context_acquire(blk_get_aio_context(sdev->conf.blk)); 1665 while (!QTAILQ_EMPTY(&sdev->requests)) { 1666 req = QTAILQ_FIRST(&sdev->requests); 1667 scsi_req_cancel_async(req, NULL); 1668 } 1669 blk_drain(sdev->conf.blk); 1670 aio_context_release(blk_get_aio_context(sdev->conf.blk)); 1671 scsi_device_set_ua(sdev, sense); 1672 } 1673 1674 void scsi_device_drained_begin(SCSIDevice *sdev) 1675 { 1676 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, sdev->qdev.parent_bus); 1677 if (!bus) { 1678 return; 1679 } 1680 1681 assert(qemu_get_current_aio_context() == qemu_get_aio_context()); 1682 assert(bus->drain_count < INT_MAX); 1683 1684 /* 1685 * Multiple BlockBackends can be on a SCSIBus and each may begin/end 1686 * draining at any time. Keep a counter so HBAs only see begin/end once. 1687 */ 1688 if (bus->drain_count++ == 0) { 1689 trace_scsi_bus_drained_begin(bus, sdev); 1690 if (bus->info->drained_begin) { 1691 bus->info->drained_begin(bus); 1692 } 1693 } 1694 } 1695 1696 void scsi_device_drained_end(SCSIDevice *sdev) 1697 { 1698 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, sdev->qdev.parent_bus); 1699 if (!bus) { 1700 return; 1701 } 1702 1703 assert(qemu_get_current_aio_context() == qemu_get_aio_context()); 1704 assert(bus->drain_count > 0); 1705 1706 if (bus->drain_count-- == 1) { 1707 trace_scsi_bus_drained_end(bus, sdev); 1708 if (bus->info->drained_end) { 1709 bus->info->drained_end(bus); 1710 } 1711 } 1712 } 1713 1714 static char *scsibus_get_dev_path(DeviceState *dev) 1715 { 1716 SCSIDevice *d = SCSI_DEVICE(dev); 1717 DeviceState *hba = dev->parent_bus->parent; 1718 char *id; 1719 char *path; 1720 1721 id = qdev_get_dev_path(hba); 1722 if (id) { 1723 path = g_strdup_printf("%s/%d:%d:%d", id, d->channel, d->id, d->lun); 1724 } else { 1725 path = g_strdup_printf("%d:%d:%d", d->channel, d->id, d->lun); 1726 } 1727 g_free(id); 1728 return path; 1729 } 1730 1731 static char *scsibus_get_fw_dev_path(DeviceState *dev) 1732 { 1733 SCSIDevice *d = SCSI_DEVICE(dev); 1734 return g_strdup_printf("channel@%x/%s@%x,%x", d->channel, 1735 qdev_fw_name(dev), d->id, d->lun); 1736 } 1737 1738 /* SCSI request list. For simplicity, pv points to the whole device */ 1739 1740 static int put_scsi_requests(QEMUFile *f, void *pv, size_t size, 1741 const VMStateField *field, JSONWriter *vmdesc) 1742 { 1743 SCSIDevice *s = pv; 1744 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus); 1745 SCSIRequest *req; 1746 1747 QTAILQ_FOREACH(req, &s->requests, next) { 1748 assert(!req->io_canceled); 1749 assert(req->status == -1 && req->host_status == -1); 1750 assert(req->enqueued); 1751 1752 qemu_put_sbyte(f, req->retry ? 1 : 2); 1753 qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf)); 1754 qemu_put_be32s(f, &req->tag); 1755 qemu_put_be32s(f, &req->lun); 1756 if (bus->info->save_request) { 1757 bus->info->save_request(f, req); 1758 } 1759 if (req->ops->save_request) { 1760 req->ops->save_request(f, req); 1761 } 1762 } 1763 qemu_put_sbyte(f, 0); 1764 1765 return 0; 1766 } 1767 1768 static int get_scsi_requests(QEMUFile *f, void *pv, size_t size, 1769 const VMStateField *field) 1770 { 1771 SCSIDevice *s = pv; 1772 SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus); 1773 int8_t sbyte; 1774 1775 while ((sbyte = qemu_get_sbyte(f)) > 0) { 1776 uint8_t buf[SCSI_CMD_BUF_SIZE]; 1777 uint32_t tag; 1778 uint32_t lun; 1779 SCSIRequest *req; 1780 1781 qemu_get_buffer(f, buf, sizeof(buf)); 1782 qemu_get_be32s(f, &tag); 1783 qemu_get_be32s(f, &lun); 1784 /* 1785 * A too-short CDB would have been rejected by scsi_req_new, so just use 1786 * SCSI_CMD_BUF_SIZE as the CDB length. 1787 */ 1788 req = scsi_req_new(s, tag, lun, buf, sizeof(buf), NULL); 1789 req->retry = (sbyte == 1); 1790 if (bus->info->load_request) { 1791 req->hba_private = bus->info->load_request(f, req); 1792 } 1793 if (req->ops->load_request) { 1794 req->ops->load_request(f, req); 1795 } 1796 1797 /* Just restart it later. */ 1798 scsi_req_enqueue_internal(req); 1799 1800 /* At this point, the request will be kept alive by the reference 1801 * added by scsi_req_enqueue_internal, so we can release our reference. 1802 * The HBA of course will add its own reference in the load_request 1803 * callback if it needs to hold on the SCSIRequest. 1804 */ 1805 scsi_req_unref(req); 1806 } 1807 1808 return 0; 1809 } 1810 1811 static const VMStateInfo vmstate_info_scsi_requests = { 1812 .name = "scsi-requests", 1813 .get = get_scsi_requests, 1814 .put = put_scsi_requests, 1815 }; 1816 1817 static bool scsi_sense_state_needed(void *opaque) 1818 { 1819 SCSIDevice *s = opaque; 1820 1821 return s->sense_len > SCSI_SENSE_BUF_SIZE_OLD; 1822 } 1823 1824 static const VMStateDescription vmstate_scsi_sense_state = { 1825 .name = "SCSIDevice/sense", 1826 .version_id = 1, 1827 .minimum_version_id = 1, 1828 .needed = scsi_sense_state_needed, 1829 .fields = (VMStateField[]) { 1830 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 1831 SCSI_SENSE_BUF_SIZE_OLD, 1832 SCSI_SENSE_BUF_SIZE - SCSI_SENSE_BUF_SIZE_OLD), 1833 VMSTATE_END_OF_LIST() 1834 } 1835 }; 1836 1837 const VMStateDescription vmstate_scsi_device = { 1838 .name = "SCSIDevice", 1839 .version_id = 1, 1840 .minimum_version_id = 1, 1841 .fields = (VMStateField[]) { 1842 VMSTATE_UINT8(unit_attention.key, SCSIDevice), 1843 VMSTATE_UINT8(unit_attention.asc, SCSIDevice), 1844 VMSTATE_UINT8(unit_attention.ascq, SCSIDevice), 1845 VMSTATE_BOOL(sense_is_ua, SCSIDevice), 1846 VMSTATE_UINT8_SUB_ARRAY(sense, SCSIDevice, 0, SCSI_SENSE_BUF_SIZE_OLD), 1847 VMSTATE_UINT32(sense_len, SCSIDevice), 1848 { 1849 .name = "requests", 1850 .version_id = 0, 1851 .field_exists = NULL, 1852 .size = 0, /* ouch */ 1853 .info = &vmstate_info_scsi_requests, 1854 .flags = VMS_SINGLE, 1855 .offset = 0, 1856 }, 1857 VMSTATE_END_OF_LIST() 1858 }, 1859 .subsections = (const VMStateDescription*[]) { 1860 &vmstate_scsi_sense_state, 1861 NULL 1862 } 1863 }; 1864 1865 static Property scsi_props[] = { 1866 DEFINE_PROP_UINT32("channel", SCSIDevice, channel, 0), 1867 DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1), 1868 DEFINE_PROP_UINT32("lun", SCSIDevice, lun, -1), 1869 DEFINE_PROP_END_OF_LIST(), 1870 }; 1871 1872 static void scsi_device_class_init(ObjectClass *klass, void *data) 1873 { 1874 DeviceClass *k = DEVICE_CLASS(klass); 1875 set_bit(DEVICE_CATEGORY_STORAGE, k->categories); 1876 k->bus_type = TYPE_SCSI_BUS; 1877 k->realize = scsi_qdev_realize; 1878 k->unrealize = scsi_qdev_unrealize; 1879 device_class_set_props(k, scsi_props); 1880 } 1881 1882 static void scsi_dev_instance_init(Object *obj) 1883 { 1884 DeviceState *dev = DEVICE(obj); 1885 SCSIDevice *s = SCSI_DEVICE(dev); 1886 1887 device_add_bootindex_property(obj, &s->conf.bootindex, 1888 "bootindex", NULL, 1889 &s->qdev); 1890 } 1891 1892 static const TypeInfo scsi_device_type_info = { 1893 .name = TYPE_SCSI_DEVICE, 1894 .parent = TYPE_DEVICE, 1895 .instance_size = sizeof(SCSIDevice), 1896 .abstract = true, 1897 .class_size = sizeof(SCSIDeviceClass), 1898 .class_init = scsi_device_class_init, 1899 .instance_init = scsi_dev_instance_init, 1900 }; 1901 1902 static void scsi_bus_class_init(ObjectClass *klass, void *data) 1903 { 1904 BusClass *k = BUS_CLASS(klass); 1905 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass); 1906 1907 k->get_dev_path = scsibus_get_dev_path; 1908 k->get_fw_dev_path = scsibus_get_fw_dev_path; 1909 k->check_address = scsi_bus_check_address; 1910 hc->unplug = qdev_simple_device_unplug_cb; 1911 } 1912 1913 static const TypeInfo scsi_bus_info = { 1914 .name = TYPE_SCSI_BUS, 1915 .parent = TYPE_BUS, 1916 .instance_size = sizeof(SCSIBus), 1917 .class_init = scsi_bus_class_init, 1918 .interfaces = (InterfaceInfo[]) { 1919 { TYPE_HOTPLUG_HANDLER }, 1920 { } 1921 } 1922 }; 1923 1924 static void scsi_register_types(void) 1925 { 1926 type_register_static(&scsi_bus_info); 1927 type_register_static(&scsi_device_type_info); 1928 } 1929 1930 type_init(scsi_register_types) 1931