1 #include "qemu/osdep.h"
3 #include "qapi/error.h"
4 #include "qemu/error-report.h"
5 #include "hw/scsi/scsi.h"
6 #include "block/scsi.h"
8 #include "sysemu/block-backend.h"
9 #include "sysemu/blockdev.h"
11 #include "sysemu/dma.h"
12 #include "qemu/cutils.h"
14 static char *scsibus_get_dev_path(DeviceState
*dev
);
15 static char *scsibus_get_fw_dev_path(DeviceState
*dev
);
16 static void scsi_req_dequeue(SCSIRequest
*req
);
17 static uint8_t *scsi_target_alloc_buf(SCSIRequest
*req
, size_t len
);
18 static void scsi_target_free_buf(SCSIRequest
*req
);
20 static Property scsi_props
[] = {
21 DEFINE_PROP_UINT32("channel", SCSIDevice
, channel
, 0),
22 DEFINE_PROP_UINT32("scsi-id", SCSIDevice
, id
, -1),
23 DEFINE_PROP_UINT32("lun", SCSIDevice
, lun
, -1),
24 DEFINE_PROP_END_OF_LIST(),
27 static void scsi_bus_class_init(ObjectClass
*klass
, void *data
)
29 BusClass
*k
= BUS_CLASS(klass
);
30 HotplugHandlerClass
*hc
= HOTPLUG_HANDLER_CLASS(klass
);
32 k
->get_dev_path
= scsibus_get_dev_path
;
33 k
->get_fw_dev_path
= scsibus_get_fw_dev_path
;
34 hc
->unplug
= qdev_simple_device_unplug_cb
;
37 static const TypeInfo scsi_bus_info
= {
38 .name
= TYPE_SCSI_BUS
,
40 .instance_size
= sizeof(SCSIBus
),
41 .class_init
= scsi_bus_class_init
,
42 .interfaces
= (InterfaceInfo
[]) {
43 { TYPE_HOTPLUG_HANDLER
},
47 static int next_scsi_bus
;
49 static void scsi_device_realize(SCSIDevice
*s
, Error
**errp
)
51 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(s
);
57 int scsi_bus_parse_cdb(SCSIDevice
*dev
, SCSICommand
*cmd
, uint8_t *buf
,
60 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, dev
->qdev
.parent_bus
);
63 assert(cmd
->len
== 0);
64 rc
= scsi_req_parse_cdb(dev
, cmd
, buf
);
65 if (bus
->info
->parse_cdb
) {
66 rc
= bus
->info
->parse_cdb(dev
, cmd
, buf
, hba_private
);
71 static SCSIRequest
*scsi_device_alloc_req(SCSIDevice
*s
, uint32_t tag
, uint32_t lun
,
72 uint8_t *buf
, void *hba_private
)
74 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(s
);
76 return sc
->alloc_req(s
, tag
, lun
, buf
, hba_private
);
82 void scsi_device_unit_attention_reported(SCSIDevice
*s
)
84 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(s
);
85 if (sc
->unit_attention_reported
) {
86 sc
->unit_attention_reported(s
);
90 /* Create a scsi bus, and attach devices to it. */
91 void scsi_bus_new(SCSIBus
*bus
, size_t bus_size
, DeviceState
*host
,
92 const SCSIBusInfo
*info
, const char *bus_name
)
94 qbus_create_inplace(bus
, bus_size
, TYPE_SCSI_BUS
, host
, bus_name
);
95 bus
->busnr
= next_scsi_bus
++;
97 qbus_set_bus_hotplug_handler(BUS(bus
), &error_abort
);
100 static void scsi_dma_restart_bh(void *opaque
)
102 SCSIDevice
*s
= opaque
;
103 SCSIRequest
*req
, *next
;
105 qemu_bh_delete(s
->bh
);
108 QTAILQ_FOREACH_SAFE(req
, &s
->requests
, next
, next
) {
112 switch (req
->cmd
.mode
) {
113 case SCSI_XFER_FROM_DEV
:
114 case SCSI_XFER_TO_DEV
:
115 scsi_req_continue(req
);
118 scsi_req_dequeue(req
);
119 scsi_req_enqueue(req
);
127 void scsi_req_retry(SCSIRequest
*req
)
129 /* No need to save a reference, because scsi_dma_restart_bh just
130 * looks at the request list. */
134 static void scsi_dma_restart_cb(void *opaque
, int running
, RunState state
)
136 SCSIDevice
*s
= opaque
;
142 AioContext
*ctx
= blk_get_aio_context(s
->conf
.blk
);
143 s
->bh
= aio_bh_new(ctx
, scsi_dma_restart_bh
, s
);
144 qemu_bh_schedule(s
->bh
);
148 static void scsi_qdev_realize(DeviceState
*qdev
, Error
**errp
)
150 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
151 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, dev
->qdev
.parent_bus
);
153 Error
*local_err
= NULL
;
155 if (dev
->channel
> bus
->info
->max_channel
) {
156 error_setg(errp
, "bad scsi channel id: %d", dev
->channel
);
159 if (dev
->id
!= -1 && dev
->id
> bus
->info
->max_target
) {
160 error_setg(errp
, "bad scsi device id: %d", dev
->id
);
163 if (dev
->lun
!= -1 && dev
->lun
> bus
->info
->max_lun
) {
164 error_setg(errp
, "bad scsi device lun: %d", dev
->lun
);
170 if (dev
->lun
== -1) {
174 d
= scsi_device_find(bus
, dev
->channel
, ++id
, dev
->lun
);
175 } while (d
&& d
->lun
== dev
->lun
&& id
< bus
->info
->max_target
);
176 if (d
&& d
->lun
== dev
->lun
) {
177 error_setg(errp
, "no free target");
181 } else if (dev
->lun
== -1) {
184 d
= scsi_device_find(bus
, dev
->channel
, dev
->id
, ++lun
);
185 } while (d
&& d
->lun
== lun
&& lun
< bus
->info
->max_lun
);
186 if (d
&& d
->lun
== lun
) {
187 error_setg(errp
, "no free lun");
192 d
= scsi_device_find(bus
, dev
->channel
, dev
->id
, dev
->lun
);
194 if (d
->lun
== dev
->lun
&& dev
!= d
) {
195 error_setg(errp
, "lun already used by '%s'", d
->qdev
.id
);
200 QTAILQ_INIT(&dev
->requests
);
201 scsi_device_realize(dev
, &local_err
);
203 error_propagate(errp
, local_err
);
206 dev
->vmsentry
= qemu_add_vm_change_state_handler(scsi_dma_restart_cb
,
210 static void scsi_qdev_unrealize(DeviceState
*qdev
, Error
**errp
)
212 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
215 qemu_del_vm_change_state_handler(dev
->vmsentry
);
218 scsi_device_purge_requests(dev
, SENSE_CODE(NO_SENSE
));
219 blockdev_mark_auto_del(dev
->conf
.blk
);
222 /* handle legacy '-drive if=scsi,...' cmd line args */
223 SCSIDevice
*scsi_bus_legacy_add_drive(SCSIBus
*bus
, BlockBackend
*blk
,
224 int unit
, bool removable
, int bootindex
,
225 const char *serial
, Error
**errp
)
232 driver
= blk_is_sg(blk
) ? "scsi-generic" : "scsi-disk";
233 dev
= qdev_create(&bus
->qbus
, driver
);
234 name
= g_strdup_printf("legacy[%d]", unit
);
235 object_property_add_child(OBJECT(bus
), name
, OBJECT(dev
), NULL
);
238 qdev_prop_set_uint32(dev
, "scsi-id", unit
);
239 if (bootindex
>= 0) {
240 object_property_set_int(OBJECT(dev
), bootindex
, "bootindex",
243 if (object_property_find(OBJECT(dev
), "removable", NULL
)) {
244 qdev_prop_set_bit(dev
, "removable", removable
);
246 if (serial
&& object_property_find(OBJECT(dev
), "serial", NULL
)) {
247 qdev_prop_set_string(dev
, "serial", serial
);
249 qdev_prop_set_drive(dev
, "drive", blk
, &err
);
251 error_propagate(errp
, err
);
252 object_unparent(OBJECT(dev
));
255 object_property_set_bool(OBJECT(dev
), true, "realized", &err
);
257 error_propagate(errp
, err
);
258 object_unparent(OBJECT(dev
));
261 return SCSI_DEVICE(dev
);
264 void scsi_bus_legacy_handle_cmdline(SCSIBus
*bus
)
271 for (unit
= 0; unit
<= bus
->info
->max_target
; unit
++) {
272 dinfo
= drive_get(IF_SCSI
, bus
->busnr
, unit
);
276 qemu_opts_loc_restore(dinfo
->opts
);
277 scsi_bus_legacy_add_drive(bus
, blk_by_legacy_dinfo(dinfo
),
278 unit
, false, -1, NULL
, &error_fatal
);
283 static bool is_scsi_hba_with_legacy_magic(Object
*obj
)
285 static const char *magic
[] = {
286 "am53c974", "dc390", "esp", "lsi53c810", "lsi53c895a",
287 "megasas", "megasas-gen2", "mptsas1068", "spapr-vscsi",
288 "virtio-scsi-device",
291 const char *typename
= object_get_typename(obj
);
294 for (i
= 0; magic
[i
]; i
++)
295 if (!strcmp(typename
, magic
[i
])) {
302 static int scsi_legacy_handle_cmdline_cb(Object
*obj
, void *opaque
)
304 SCSIBus
*bus
= (SCSIBus
*)object_dynamic_cast(obj
, TYPE_SCSI_BUS
);
306 if (bus
&& is_scsi_hba_with_legacy_magic(OBJECT(bus
->qbus
.parent
))) {
307 scsi_bus_legacy_handle_cmdline(bus
);
313 void scsi_legacy_handle_cmdline(void)
315 object_child_foreach_recursive(object_get_root(),
316 scsi_legacy_handle_cmdline_cb
, NULL
);
319 static int32_t scsi_invalid_field(SCSIRequest
*req
, uint8_t *buf
)
321 scsi_req_build_sense(req
, SENSE_CODE(INVALID_FIELD
));
322 scsi_req_complete(req
, CHECK_CONDITION
);
326 static const struct SCSIReqOps reqops_invalid_field
= {
327 .size
= sizeof(SCSIRequest
),
328 .send_command
= scsi_invalid_field
331 /* SCSIReqOps implementation for invalid commands. */
333 static int32_t scsi_invalid_command(SCSIRequest
*req
, uint8_t *buf
)
335 scsi_req_build_sense(req
, SENSE_CODE(INVALID_OPCODE
));
336 scsi_req_complete(req
, CHECK_CONDITION
);
340 static const struct SCSIReqOps reqops_invalid_opcode
= {
341 .size
= sizeof(SCSIRequest
),
342 .send_command
= scsi_invalid_command
345 /* SCSIReqOps implementation for unit attention conditions. */
347 static int32_t scsi_unit_attention(SCSIRequest
*req
, uint8_t *buf
)
349 if (req
->dev
->unit_attention
.key
== UNIT_ATTENTION
) {
350 scsi_req_build_sense(req
, req
->dev
->unit_attention
);
351 } else if (req
->bus
->unit_attention
.key
== UNIT_ATTENTION
) {
352 scsi_req_build_sense(req
, req
->bus
->unit_attention
);
354 scsi_req_complete(req
, CHECK_CONDITION
);
358 static const struct SCSIReqOps reqops_unit_attention
= {
359 .size
= sizeof(SCSIRequest
),
360 .send_command
= scsi_unit_attention
363 /* SCSIReqOps implementation for REPORT LUNS and for commands sent to
366 typedef struct SCSITargetReq SCSITargetReq
;
368 struct SCSITargetReq
{
375 static void store_lun(uint8_t *outbuf
, int lun
)
381 outbuf
[1] = (lun
& 255);
382 outbuf
[0] = (lun
>> 8) | 0x40;
385 static bool scsi_target_emulate_report_luns(SCSITargetReq
*r
)
392 if (r
->req
.cmd
.xfer
< 16) {
395 if (r
->req
.cmd
.buf
[2] > 2) {
398 channel
= r
->req
.dev
->channel
;
402 QTAILQ_FOREACH(kid
, &r
->req
.bus
->qbus
.children
, sibling
) {
403 DeviceState
*qdev
= kid
->child
;
404 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
406 if (dev
->channel
== channel
&& dev
->id
== id
) {
417 scsi_target_alloc_buf(&r
->req
, n
+ 8);
419 len
= MIN(n
+ 8, r
->req
.cmd
.xfer
& ~7);
420 memset(r
->buf
, 0, len
);
421 stl_be_p(&r
->buf
[0], n
);
422 i
= found_lun0
? 8 : 16;
423 QTAILQ_FOREACH(kid
, &r
->req
.bus
->qbus
.children
, sibling
) {
424 DeviceState
*qdev
= kid
->child
;
425 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
427 if (dev
->channel
== channel
&& dev
->id
== id
) {
428 store_lun(&r
->buf
[i
], dev
->lun
);
437 static bool scsi_target_emulate_inquiry(SCSITargetReq
*r
)
439 assert(r
->req
.dev
->lun
!= r
->req
.lun
);
441 scsi_target_alloc_buf(&r
->req
, SCSI_INQUIRY_LEN
);
443 if (r
->req
.cmd
.buf
[1] & 0x2) {
444 /* Command support data - optional, not implemented */
448 if (r
->req
.cmd
.buf
[1] & 0x1) {
449 /* Vital product data */
450 uint8_t page_code
= r
->req
.cmd
.buf
[2];
451 r
->buf
[r
->len
++] = page_code
; /* this page */
452 r
->buf
[r
->len
++] = 0x00;
455 case 0x00: /* Supported page codes, mandatory */
459 r
->buf
[r
->len
++] = 0x00; /* list of supported pages (this page) */
460 r
->buf
[pages
] = r
->len
- pages
- 1; /* number of pages */
467 assert(r
->len
< r
->buf_len
);
468 r
->len
= MIN(r
->req
.cmd
.xfer
, r
->len
);
472 /* Standard INQUIRY data */
473 if (r
->req
.cmd
.buf
[2] != 0) {
478 r
->len
= MIN(r
->req
.cmd
.xfer
, SCSI_INQUIRY_LEN
);
479 memset(r
->buf
, 0, r
->len
);
480 if (r
->req
.lun
!= 0) {
481 r
->buf
[0] = TYPE_NO_LUN
;
483 r
->buf
[0] = TYPE_NOT_PRESENT
| TYPE_INACTIVE
;
484 r
->buf
[2] = 5; /* Version */
485 r
->buf
[3] = 2 | 0x10; /* HiSup, response data format */
486 r
->buf
[4] = r
->len
- 5; /* Additional Length = (Len - 1) - 4 */
487 r
->buf
[7] = 0x10 | (r
->req
.bus
->info
->tcq
? 0x02 : 0); /* Sync, TCQ. */
488 memcpy(&r
->buf
[8], "QEMU ", 8);
489 memcpy(&r
->buf
[16], "QEMU TARGET ", 16);
490 pstrcpy((char *) &r
->buf
[32], 4, qemu_hw_version());
495 static size_t scsi_sense_len(SCSIRequest
*req
)
497 if (req
->dev
->type
== TYPE_SCANNER
)
498 return SCSI_SENSE_LEN_SCANNER
;
500 return SCSI_SENSE_LEN
;
503 static int32_t scsi_target_send_command(SCSIRequest
*req
, uint8_t *buf
)
505 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
509 if (!scsi_target_emulate_report_luns(r
)) {
510 goto illegal_request
;
514 if (!scsi_target_emulate_inquiry(r
)) {
515 goto illegal_request
;
519 scsi_target_alloc_buf(&r
->req
, scsi_sense_len(req
));
520 r
->len
= scsi_device_get_sense(r
->req
.dev
, r
->buf
,
521 MIN(req
->cmd
.xfer
, r
->buf_len
),
522 (req
->cmd
.buf
[1] & 1) == 0);
523 if (r
->req
.dev
->sense_is_ua
) {
524 scsi_device_unit_attention_reported(req
->dev
);
525 r
->req
.dev
->sense_len
= 0;
526 r
->req
.dev
->sense_is_ua
= false;
529 case TEST_UNIT_READY
:
532 scsi_req_build_sense(req
, SENSE_CODE(LUN_NOT_SUPPORTED
));
533 scsi_req_complete(req
, CHECK_CONDITION
);
536 scsi_req_build_sense(req
, SENSE_CODE(INVALID_FIELD
));
537 scsi_req_complete(req
, CHECK_CONDITION
);
542 scsi_req_complete(req
, GOOD
);
547 static void scsi_target_read_data(SCSIRequest
*req
)
549 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
555 scsi_req_data(&r
->req
, n
);
557 scsi_req_complete(&r
->req
, GOOD
);
561 static uint8_t *scsi_target_get_buf(SCSIRequest
*req
)
563 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
568 static uint8_t *scsi_target_alloc_buf(SCSIRequest
*req
, size_t len
)
570 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
572 r
->buf
= g_malloc(len
);
578 static void scsi_target_free_buf(SCSIRequest
*req
)
580 SCSITargetReq
*r
= DO_UPCAST(SCSITargetReq
, req
, req
);
585 static const struct SCSIReqOps reqops_target_command
= {
586 .size
= sizeof(SCSITargetReq
),
587 .send_command
= scsi_target_send_command
,
588 .read_data
= scsi_target_read_data
,
589 .get_buf
= scsi_target_get_buf
,
590 .free_req
= scsi_target_free_buf
,
594 SCSIRequest
*scsi_req_alloc(const SCSIReqOps
*reqops
, SCSIDevice
*d
,
595 uint32_t tag
, uint32_t lun
, void *hba_private
)
598 SCSIBus
*bus
= scsi_bus_from_device(d
);
599 BusState
*qbus
= BUS(bus
);
600 const int memset_off
= offsetof(SCSIRequest
, sense
)
601 + sizeof(req
->sense
);
603 req
= g_malloc(reqops
->size
);
604 memset((uint8_t *)req
+ memset_off
, 0, reqops
->size
- memset_off
);
610 req
->hba_private
= hba_private
;
613 object_ref(OBJECT(d
));
614 object_ref(OBJECT(qbus
->parent
));
615 notifier_list_init(&req
->cancel_notifiers
);
616 trace_scsi_req_alloc(req
->dev
->id
, req
->lun
, req
->tag
);
620 SCSIRequest
*scsi_req_new(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
,
621 uint8_t *buf
, void *hba_private
)
623 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, d
->qdev
.parent_bus
);
624 const SCSIReqOps
*ops
;
625 SCSIDeviceClass
*sc
= SCSI_DEVICE_GET_CLASS(d
);
627 SCSICommand cmd
= { .len
= 0 };
630 if ((d
->unit_attention
.key
== UNIT_ATTENTION
||
631 bus
->unit_attention
.key
== UNIT_ATTENTION
) &&
632 (buf
[0] != INQUIRY
&&
633 buf
[0] != REPORT_LUNS
&&
634 buf
[0] != GET_CONFIGURATION
&&
635 buf
[0] != GET_EVENT_STATUS_NOTIFICATION
&&
638 * If we already have a pending unit attention condition,
639 * report this one before triggering another one.
641 !(buf
[0] == REQUEST_SENSE
&& d
->sense_is_ua
))) {
642 ops
= &reqops_unit_attention
;
643 } else if (lun
!= d
->lun
||
644 buf
[0] == REPORT_LUNS
||
645 (buf
[0] == REQUEST_SENSE
&& d
->sense_len
)) {
646 ops
= &reqops_target_command
;
651 if (ops
!= NULL
|| !sc
->parse_cdb
) {
652 ret
= scsi_req_parse_cdb(d
, &cmd
, buf
);
654 ret
= sc
->parse_cdb(d
, &cmd
, buf
, hba_private
);
658 trace_scsi_req_parse_bad(d
->id
, lun
, tag
, buf
[0]);
659 req
= scsi_req_alloc(&reqops_invalid_opcode
, d
, tag
, lun
, hba_private
);
661 assert(cmd
.len
!= 0);
662 trace_scsi_req_parsed(d
->id
, lun
, tag
, buf
[0],
665 trace_scsi_req_parsed_lba(d
->id
, lun
, tag
, buf
[0],
669 if (cmd
.xfer
> INT32_MAX
) {
670 req
= scsi_req_alloc(&reqops_invalid_field
, d
, tag
, lun
, hba_private
);
672 req
= scsi_req_alloc(ops
, d
, tag
, lun
, hba_private
);
674 req
= scsi_device_alloc_req(d
, tag
, lun
, buf
, hba_private
);
679 req
->resid
= req
->cmd
.xfer
;
683 trace_scsi_inquiry(d
->id
, lun
, tag
, cmd
.buf
[1], cmd
.buf
[2]);
685 case TEST_UNIT_READY
:
686 trace_scsi_test_unit_ready(d
->id
, lun
, tag
);
689 trace_scsi_report_luns(d
->id
, lun
, tag
);
692 trace_scsi_request_sense(d
->id
, lun
, tag
);
701 uint8_t *scsi_req_get_buf(SCSIRequest
*req
)
703 return req
->ops
->get_buf(req
);
706 static void scsi_clear_unit_attention(SCSIRequest
*req
)
709 if (req
->dev
->unit_attention
.key
!= UNIT_ATTENTION
&&
710 req
->bus
->unit_attention
.key
!= UNIT_ATTENTION
) {
715 * If an INQUIRY command enters the enabled command state,
716 * the device server shall [not] clear any unit attention condition;
717 * See also MMC-6, paragraphs 6.5 and 6.6.2.
719 if (req
->cmd
.buf
[0] == INQUIRY
||
720 req
->cmd
.buf
[0] == GET_CONFIGURATION
||
721 req
->cmd
.buf
[0] == GET_EVENT_STATUS_NOTIFICATION
) {
725 if (req
->dev
->unit_attention
.key
== UNIT_ATTENTION
) {
726 ua
= &req
->dev
->unit_attention
;
728 ua
= &req
->bus
->unit_attention
;
732 * If a REPORT LUNS command enters the enabled command state, [...]
733 * the device server shall clear any pending unit attention condition
734 * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
736 if (req
->cmd
.buf
[0] == REPORT_LUNS
&&
737 !(ua
->asc
== SENSE_CODE(REPORTED_LUNS_CHANGED
).asc
&&
738 ua
->ascq
== SENSE_CODE(REPORTED_LUNS_CHANGED
).ascq
)) {
742 *ua
= SENSE_CODE(NO_SENSE
);
745 int scsi_req_get_sense(SCSIRequest
*req
, uint8_t *buf
, int len
)
750 if (!req
->sense_len
) {
754 ret
= scsi_build_sense(req
->sense
, req
->sense_len
, buf
, len
, true);
757 * FIXME: clearing unit attention conditions upon autosense should be done
758 * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
761 * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
762 * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
763 * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
765 if (req
->dev
->sense_is_ua
) {
766 scsi_device_unit_attention_reported(req
->dev
);
767 req
->dev
->sense_len
= 0;
768 req
->dev
->sense_is_ua
= false;
773 int scsi_device_get_sense(SCSIDevice
*dev
, uint8_t *buf
, int len
, bool fixed
)
775 return scsi_build_sense(dev
->sense
, dev
->sense_len
, buf
, len
, fixed
);
778 void scsi_req_build_sense(SCSIRequest
*req
, SCSISense sense
)
780 trace_scsi_req_build_sense(req
->dev
->id
, req
->lun
, req
->tag
,
781 sense
.key
, sense
.asc
, sense
.ascq
);
782 memset(req
->sense
, 0, 18);
783 req
->sense
[0] = 0x70;
784 req
->sense
[2] = sense
.key
;
786 req
->sense
[12] = sense
.asc
;
787 req
->sense
[13] = sense
.ascq
;
791 static void scsi_req_enqueue_internal(SCSIRequest
*req
)
793 assert(!req
->enqueued
);
795 if (req
->bus
->info
->get_sg_list
) {
796 req
->sg
= req
->bus
->info
->get_sg_list(req
);
800 req
->enqueued
= true;
801 QTAILQ_INSERT_TAIL(&req
->dev
->requests
, req
, next
);
804 int32_t scsi_req_enqueue(SCSIRequest
*req
)
809 scsi_req_enqueue_internal(req
);
811 rc
= req
->ops
->send_command(req
, req
->cmd
.buf
);
816 static void scsi_req_dequeue(SCSIRequest
*req
)
818 trace_scsi_req_dequeue(req
->dev
->id
, req
->lun
, req
->tag
);
821 QTAILQ_REMOVE(&req
->dev
->requests
, req
, next
);
822 req
->enqueued
= false;
827 static int scsi_get_performance_length(int num_desc
, int type
, int data_type
)
829 /* MMC-6, paragraph 6.7. */
832 if ((data_type
& 3) == 0) {
833 /* Each descriptor is as in Table 295 - Nominal performance. */
834 return 16 * num_desc
+ 8;
836 /* Each descriptor is as in Table 296 - Exceptions. */
837 return 6 * num_desc
+ 8;
842 return 8 * num_desc
+ 8;
844 return 2048 * num_desc
+ 8;
846 return 16 * num_desc
+ 8;
852 static int ata_passthrough_xfer_unit(SCSIDevice
*dev
, uint8_t *buf
)
854 int byte_block
= (buf
[2] >> 2) & 0x1;
855 int type
= (buf
[2] >> 4) & 0x1;
860 xfer_unit
= dev
->blocksize
;
871 static int ata_passthrough_12_xfer(SCSIDevice
*dev
, uint8_t *buf
)
873 int length
= buf
[2] & 0x3;
875 int unit
= ata_passthrough_xfer_unit(dev
, buf
);
879 case 3: /* USB-specific. */
894 static int ata_passthrough_16_xfer(SCSIDevice
*dev
, uint8_t *buf
)
896 int extend
= buf
[1] & 0x1;
897 int length
= buf
[2] & 0x3;
899 int unit
= ata_passthrough_xfer_unit(dev
, buf
);
903 case 3: /* USB-specific. */
909 xfer
|= (extend
? buf
[3] << 8 : 0);
913 xfer
|= (extend
? buf
[5] << 8 : 0);
920 uint32_t scsi_data_cdb_xfer(uint8_t *buf
)
922 if ((buf
[0] >> 5) == 0 && buf
[4] == 0) {
925 return scsi_cdb_xfer(buf
);
929 uint32_t scsi_cdb_xfer(uint8_t *buf
)
931 switch (buf
[0] >> 5) {
937 return lduw_be_p(&buf
[7]);
940 return ldl_be_p(&buf
[10]) & 0xffffffffULL
;
943 return ldl_be_p(&buf
[6]) & 0xffffffffULL
;
950 static int scsi_req_xfer(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
952 cmd
->xfer
= scsi_cdb_xfer(buf
);
954 case TEST_UNIT_READY
:
958 case WRITE_FILEMARKS
:
959 case WRITE_FILEMARKS_16
:
964 case ALLOW_MEDIUM_REMOVAL
:
966 case SYNCHRONIZE_CACHE
:
967 case SYNCHRONIZE_CACHE_16
:
969 case LOCK_UNLOCK_CACHE
:
978 case ALLOW_OVERWRITE
:
984 if ((buf
[1] & 2) == 0) {
986 } else if ((buf
[1] & 4) != 0) {
989 cmd
->xfer
*= dev
->blocksize
;
995 cmd
->xfer
= dev
->blocksize
;
997 case READ_CAPACITY_10
:
1000 case READ_BLOCK_LIMITS
:
1003 case SEND_VOLUME_TAG
:
1004 /* GPCMD_SET_STREAMING from multimedia commands. */
1005 if (dev
->type
== TYPE_ROM
) {
1006 cmd
->xfer
= buf
[10] | (buf
[9] << 8);
1008 cmd
->xfer
= buf
[9] | (buf
[8] << 8);
1012 /* length 0 means 256 blocks */
1013 if (cmd
->xfer
== 0) {
1018 case WRITE_VERIFY_10
:
1020 case WRITE_VERIFY_12
:
1022 case WRITE_VERIFY_16
:
1023 cmd
->xfer
*= dev
->blocksize
;
1027 /* length 0 means 256 blocks */
1028 if (cmd
->xfer
== 0) {
1035 cmd
->xfer
*= dev
->blocksize
;
1038 /* MMC mandates the parameter list to be 12-bytes long. Parameters
1039 * for block devices are restricted to the header right now. */
1040 if (dev
->type
== TYPE_ROM
&& (buf
[1] & 16)) {
1043 cmd
->xfer
= (buf
[1] & 16) == 0 ? 0 : (buf
[1] & 32 ? 8 : 4);
1047 case RECEIVE_DIAGNOSTIC
:
1048 case SEND_DIAGNOSTIC
:
1049 cmd
->xfer
= buf
[4] | (buf
[3] << 8);
1054 case SEND_CUE_SHEET
:
1055 cmd
->xfer
= buf
[8] | (buf
[7] << 8) | (buf
[6] << 16);
1057 case PERSISTENT_RESERVE_OUT
:
1058 cmd
->xfer
= ldl_be_p(&buf
[5]) & 0xffffffffULL
;
1061 if (dev
->type
== TYPE_ROM
) {
1062 /* MMC command GET PERFORMANCE. */
1063 cmd
->xfer
= scsi_get_performance_length(buf
[9] | (buf
[8] << 8),
1064 buf
[10], buf
[1] & 0x1f);
1067 case MECHANISM_STATUS
:
1068 case READ_DVD_STRUCTURE
:
1069 case SEND_DVD_STRUCTURE
:
1070 case MAINTENANCE_OUT
:
1071 case MAINTENANCE_IN
:
1072 if (dev
->type
== TYPE_ROM
) {
1073 /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
1074 cmd
->xfer
= buf
[9] | (buf
[8] << 8);
1077 case ATA_PASSTHROUGH_12
:
1078 if (dev
->type
== TYPE_ROM
) {
1079 /* BLANK command of MMC */
1082 cmd
->xfer
= ata_passthrough_12_xfer(dev
, buf
);
1085 case ATA_PASSTHROUGH_16
:
1086 cmd
->xfer
= ata_passthrough_16_xfer(dev
, buf
);
1092 static int scsi_req_stream_xfer(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
1095 /* stream commands */
1102 case RECOVER_BUFFERED_DATA
:
1104 cmd
->xfer
= buf
[4] | (buf
[3] << 8) | (buf
[2] << 16);
1105 if (buf
[1] & 0x01) { /* fixed */
1106 cmd
->xfer
*= dev
->blocksize
;
1110 case READ_REVERSE_16
:
1113 cmd
->xfer
= buf
[14] | (buf
[13] << 8) | (buf
[12] << 16);
1114 if (buf
[1] & 0x01) { /* fixed */
1115 cmd
->xfer
*= dev
->blocksize
;
1123 cmd
->xfer
= buf
[13] | (buf
[12] << 8);
1126 switch (buf
[1] & 0x1f) /* operation code */ {
1127 case SHORT_FORM_BLOCK_ID
:
1128 case SHORT_FORM_VENDOR_SPECIFIC
:
1135 cmd
->xfer
= buf
[8] | (buf
[7] << 8);
1143 cmd
->xfer
= buf
[4] | (buf
[3] << 8);
1145 /* generic commands */
1147 return scsi_req_xfer(cmd
, dev
, buf
);
1152 static int scsi_req_medium_changer_xfer(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
1155 /* medium changer commands */
1156 case EXCHANGE_MEDIUM
:
1157 case INITIALIZE_ELEMENT_STATUS
:
1158 case INITIALIZE_ELEMENT_STATUS_WITH_RANGE
:
1160 case POSITION_TO_ELEMENT
:
1163 case READ_ELEMENT_STATUS
:
1164 cmd
->xfer
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16);
1167 /* generic commands */
1169 return scsi_req_xfer(cmd
, dev
, buf
);
1174 static int scsi_req_scanner_length(SCSICommand
*cmd
, SCSIDevice
*dev
, uint8_t *buf
)
1177 /* Scanner commands */
1178 case OBJECT_POSITION
:
1188 cmd
->xfer
= buf
[8] | (buf
[7] << 8) | (buf
[6] << 16);
1191 /* GET_DATA_BUFFER_STATUS xfer handled by scsi_req_xfer */
1192 return scsi_req_xfer(cmd
, dev
, buf
);
1198 static void scsi_cmd_xfer_mode(SCSICommand
*cmd
)
1201 cmd
->mode
= SCSI_XFER_NONE
;
1204 switch (cmd
->buf
[0]) {
1207 case WRITE_VERIFY_10
:
1209 case WRITE_VERIFY_12
:
1211 case WRITE_VERIFY_16
:
1218 case CHANGE_DEFINITION
:
1221 case MODE_SELECT_10
:
1222 case SEND_DIAGNOSTIC
:
1225 case REASSIGN_BLOCKS
:
1234 case SEARCH_HIGH_12
:
1235 case SEARCH_EQUAL_12
:
1238 case SEND_VOLUME_TAG
:
1239 case SEND_CUE_SHEET
:
1240 case SEND_DVD_STRUCTURE
:
1241 case PERSISTENT_RESERVE_OUT
:
1242 case MAINTENANCE_OUT
:
1245 /* SCAN conflicts with START_STOP. START_STOP has cmd->xfer set to 0 for
1246 * non-scanner devices, so we only get here for SCAN and not for START_STOP.
1248 cmd
->mode
= SCSI_XFER_TO_DEV
;
1250 case ATA_PASSTHROUGH_12
:
1251 case ATA_PASSTHROUGH_16
:
1253 cmd
->mode
= (cmd
->buf
[2] & 0x8) ?
1254 SCSI_XFER_FROM_DEV
: SCSI_XFER_TO_DEV
;
1257 cmd
->mode
= SCSI_XFER_FROM_DEV
;
1262 static uint64_t scsi_cmd_lba(SCSICommand
*cmd
)
1264 uint8_t *buf
= cmd
->buf
;
1267 switch (buf
[0] >> 5) {
1269 lba
= ldl_be_p(&buf
[0]) & 0x1fffff;
1274 lba
= ldl_be_p(&buf
[2]) & 0xffffffffULL
;
1277 lba
= ldq_be_p(&buf
[2]);
1286 int scsi_cdb_length(uint8_t *buf
) {
1289 switch (buf
[0] >> 5) {
1309 int scsi_req_parse_cdb(SCSIDevice
*dev
, SCSICommand
*cmd
, uint8_t *buf
)
1315 len
= scsi_cdb_length(buf
);
1321 switch (dev
->type
) {
1323 rc
= scsi_req_stream_xfer(cmd
, dev
, buf
);
1325 case TYPE_MEDIUM_CHANGER
:
1326 rc
= scsi_req_medium_changer_xfer(cmd
, dev
, buf
);
1329 rc
= scsi_req_scanner_length(cmd
, dev
, buf
);
1332 rc
= scsi_req_xfer(cmd
, dev
, buf
);
1339 memcpy(cmd
->buf
, buf
, cmd
->len
);
1340 scsi_cmd_xfer_mode(cmd
);
1341 cmd
->lba
= scsi_cmd_lba(cmd
);
1345 void scsi_device_report_change(SCSIDevice
*dev
, SCSISense sense
)
1347 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, dev
->qdev
.parent_bus
);
1349 scsi_device_set_ua(dev
, sense
);
1350 if (bus
->info
->change
) {
1351 bus
->info
->change(bus
, dev
, sense
);
1356 * Predefined sense codes
1359 /* No sense data available */
1360 const struct SCSISense sense_code_NO_SENSE
= {
1361 .key
= NO_SENSE
, .asc
= 0x00 , .ascq
= 0x00
1364 /* LUN not ready, Manual intervention required */
1365 const struct SCSISense sense_code_LUN_NOT_READY
= {
1366 .key
= NOT_READY
, .asc
= 0x04, .ascq
= 0x03
1369 /* LUN not ready, Medium not present */
1370 const struct SCSISense sense_code_NO_MEDIUM
= {
1371 .key
= NOT_READY
, .asc
= 0x3a, .ascq
= 0x00
1374 /* LUN not ready, medium removal prevented */
1375 const struct SCSISense sense_code_NOT_READY_REMOVAL_PREVENTED
= {
1376 .key
= NOT_READY
, .asc
= 0x53, .ascq
= 0x02
1379 /* Hardware error, internal target failure */
1380 const struct SCSISense sense_code_TARGET_FAILURE
= {
1381 .key
= HARDWARE_ERROR
, .asc
= 0x44, .ascq
= 0x00
1384 /* Illegal request, invalid command operation code */
1385 const struct SCSISense sense_code_INVALID_OPCODE
= {
1386 .key
= ILLEGAL_REQUEST
, .asc
= 0x20, .ascq
= 0x00
1389 /* Illegal request, LBA out of range */
1390 const struct SCSISense sense_code_LBA_OUT_OF_RANGE
= {
1391 .key
= ILLEGAL_REQUEST
, .asc
= 0x21, .ascq
= 0x00
1394 /* Illegal request, Invalid field in CDB */
1395 const struct SCSISense sense_code_INVALID_FIELD
= {
1396 .key
= ILLEGAL_REQUEST
, .asc
= 0x24, .ascq
= 0x00
1399 /* Illegal request, Invalid field in parameter list */
1400 const struct SCSISense sense_code_INVALID_PARAM
= {
1401 .key
= ILLEGAL_REQUEST
, .asc
= 0x26, .ascq
= 0x00
1404 /* Illegal request, Parameter list length error */
1405 const struct SCSISense sense_code_INVALID_PARAM_LEN
= {
1406 .key
= ILLEGAL_REQUEST
, .asc
= 0x1a, .ascq
= 0x00
1409 /* Illegal request, LUN not supported */
1410 const struct SCSISense sense_code_LUN_NOT_SUPPORTED
= {
1411 .key
= ILLEGAL_REQUEST
, .asc
= 0x25, .ascq
= 0x00
1414 /* Illegal request, Saving parameters not supported */
1415 const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED
= {
1416 .key
= ILLEGAL_REQUEST
, .asc
= 0x39, .ascq
= 0x00
1419 /* Illegal request, Incompatible medium installed */
1420 const struct SCSISense sense_code_INCOMPATIBLE_FORMAT
= {
1421 .key
= ILLEGAL_REQUEST
, .asc
= 0x30, .ascq
= 0x00
1424 /* Illegal request, medium removal prevented */
1425 const struct SCSISense sense_code_ILLEGAL_REQ_REMOVAL_PREVENTED
= {
1426 .key
= ILLEGAL_REQUEST
, .asc
= 0x53, .ascq
= 0x02
1429 /* Illegal request, Invalid Transfer Tag */
1430 const struct SCSISense sense_code_INVALID_TAG
= {
1431 .key
= ILLEGAL_REQUEST
, .asc
= 0x4b, .ascq
= 0x01
1434 /* Command aborted, I/O process terminated */
1435 const struct SCSISense sense_code_IO_ERROR
= {
1436 .key
= ABORTED_COMMAND
, .asc
= 0x00, .ascq
= 0x06
1439 /* Command aborted, I_T Nexus loss occurred */
1440 const struct SCSISense sense_code_I_T_NEXUS_LOSS
= {
1441 .key
= ABORTED_COMMAND
, .asc
= 0x29, .ascq
= 0x07
1444 /* Command aborted, Logical Unit failure */
1445 const struct SCSISense sense_code_LUN_FAILURE
= {
1446 .key
= ABORTED_COMMAND
, .asc
= 0x3e, .ascq
= 0x01
1449 /* Command aborted, Overlapped Commands Attempted */
1450 const struct SCSISense sense_code_OVERLAPPED_COMMANDS
= {
1451 .key
= ABORTED_COMMAND
, .asc
= 0x4e, .ascq
= 0x00
1454 /* Unit attention, Capacity data has changed */
1455 const struct SCSISense sense_code_CAPACITY_CHANGED
= {
1456 .key
= UNIT_ATTENTION
, .asc
= 0x2a, .ascq
= 0x09
1459 /* Unit attention, Power on, reset or bus device reset occurred */
1460 const struct SCSISense sense_code_RESET
= {
1461 .key
= UNIT_ATTENTION
, .asc
= 0x29, .ascq
= 0x00
1464 /* Unit attention, No medium */
1465 const struct SCSISense sense_code_UNIT_ATTENTION_NO_MEDIUM
= {
1466 .key
= UNIT_ATTENTION
, .asc
= 0x3a, .ascq
= 0x00
1469 /* Unit attention, Medium may have changed */
1470 const struct SCSISense sense_code_MEDIUM_CHANGED
= {
1471 .key
= UNIT_ATTENTION
, .asc
= 0x28, .ascq
= 0x00
1474 /* Unit attention, Reported LUNs data has changed */
1475 const struct SCSISense sense_code_REPORTED_LUNS_CHANGED
= {
1476 .key
= UNIT_ATTENTION
, .asc
= 0x3f, .ascq
= 0x0e
1479 /* Unit attention, Device internal reset */
1480 const struct SCSISense sense_code_DEVICE_INTERNAL_RESET
= {
1481 .key
= UNIT_ATTENTION
, .asc
= 0x29, .ascq
= 0x04
1484 /* Data Protection, Write Protected */
1485 const struct SCSISense sense_code_WRITE_PROTECTED
= {
1486 .key
= DATA_PROTECT
, .asc
= 0x27, .ascq
= 0x00
1489 /* Data Protection, Space Allocation Failed Write Protect */
1490 const struct SCSISense sense_code_SPACE_ALLOC_FAILED
= {
1491 .key
= DATA_PROTECT
, .asc
= 0x27, .ascq
= 0x07
1497 * Convert between fixed and descriptor sense buffers
1499 int scsi_build_sense(uint8_t *in_buf
, int in_len
,
1500 uint8_t *buf
, int len
, bool fixed
)
1504 if (!fixed
&& len
< 8) {
1509 sense
.key
= NO_SENSE
;
1513 fixed_in
= (in_buf
[0] & 2) == 0;
1515 if (fixed
== fixed_in
) {
1516 memcpy(buf
, in_buf
, MIN(len
, in_len
));
1517 return MIN(len
, in_len
);
1521 sense
.key
= in_buf
[2];
1522 sense
.asc
= in_buf
[12];
1523 sense
.ascq
= in_buf
[13];
1525 sense
.key
= in_buf
[1];
1526 sense
.asc
= in_buf
[2];
1527 sense
.ascq
= in_buf
[3];
1531 memset(buf
, 0, len
);
1533 /* Return fixed format sense buffer */
1537 buf
[12] = sense
.asc
;
1538 buf
[13] = sense
.ascq
;
1539 return MIN(len
, SCSI_SENSE_LEN
);
1541 /* Return descriptor format sense buffer */
1545 buf
[3] = sense
.ascq
;
1550 const char *scsi_command_name(uint8_t cmd
)
1552 static const char *names
[] = {
1553 [ TEST_UNIT_READY
] = "TEST_UNIT_READY",
1554 [ REWIND
] = "REWIND",
1555 [ REQUEST_SENSE
] = "REQUEST_SENSE",
1556 [ FORMAT_UNIT
] = "FORMAT_UNIT",
1557 [ READ_BLOCK_LIMITS
] = "READ_BLOCK_LIMITS",
1558 [ REASSIGN_BLOCKS
] = "REASSIGN_BLOCKS/INITIALIZE ELEMENT STATUS",
1559 /* LOAD_UNLOAD and INITIALIZE_ELEMENT_STATUS use the same operation code */
1560 [ READ_6
] = "READ_6",
1561 [ WRITE_6
] = "WRITE_6",
1562 [ SET_CAPACITY
] = "SET_CAPACITY",
1563 [ READ_REVERSE
] = "READ_REVERSE",
1564 [ WRITE_FILEMARKS
] = "WRITE_FILEMARKS",
1565 [ SPACE
] = "SPACE",
1566 [ INQUIRY
] = "INQUIRY",
1567 [ RECOVER_BUFFERED_DATA
] = "RECOVER_BUFFERED_DATA",
1568 [ MAINTENANCE_IN
] = "MAINTENANCE_IN",
1569 [ MAINTENANCE_OUT
] = "MAINTENANCE_OUT",
1570 [ MODE_SELECT
] = "MODE_SELECT",
1571 [ RESERVE
] = "RESERVE",
1572 [ RELEASE
] = "RELEASE",
1574 [ ERASE
] = "ERASE",
1575 [ MODE_SENSE
] = "MODE_SENSE",
1576 [ START_STOP
] = "START_STOP/LOAD_UNLOAD",
1577 /* LOAD_UNLOAD and START_STOP use the same operation code */
1578 [ RECEIVE_DIAGNOSTIC
] = "RECEIVE_DIAGNOSTIC",
1579 [ SEND_DIAGNOSTIC
] = "SEND_DIAGNOSTIC",
1580 [ ALLOW_MEDIUM_REMOVAL
] = "ALLOW_MEDIUM_REMOVAL",
1581 [ READ_CAPACITY_10
] = "READ_CAPACITY_10",
1582 [ READ_10
] = "READ_10",
1583 [ WRITE_10
] = "WRITE_10",
1584 [ SEEK_10
] = "SEEK_10/POSITION_TO_ELEMENT",
1585 /* SEEK_10 and POSITION_TO_ELEMENT use the same operation code */
1586 [ WRITE_VERIFY_10
] = "WRITE_VERIFY_10",
1587 [ VERIFY_10
] = "VERIFY_10",
1588 [ SEARCH_HIGH
] = "SEARCH_HIGH",
1589 [ SEARCH_EQUAL
] = "SEARCH_EQUAL",
1590 [ SEARCH_LOW
] = "SEARCH_LOW",
1591 [ SET_LIMITS
] = "SET_LIMITS",
1592 [ PRE_FETCH
] = "PRE_FETCH/READ_POSITION",
1593 /* READ_POSITION and PRE_FETCH use the same operation code */
1594 [ SYNCHRONIZE_CACHE
] = "SYNCHRONIZE_CACHE",
1595 [ LOCK_UNLOCK_CACHE
] = "LOCK_UNLOCK_CACHE",
1596 [ READ_DEFECT_DATA
] = "READ_DEFECT_DATA/INITIALIZE_ELEMENT_STATUS_WITH_RANGE",
1597 /* READ_DEFECT_DATA and INITIALIZE_ELEMENT_STATUS_WITH_RANGE use the same operation code */
1598 [ MEDIUM_SCAN
] = "MEDIUM_SCAN",
1599 [ COMPARE
] = "COMPARE",
1600 [ COPY_VERIFY
] = "COPY_VERIFY",
1601 [ WRITE_BUFFER
] = "WRITE_BUFFER",
1602 [ READ_BUFFER
] = "READ_BUFFER",
1603 [ UPDATE_BLOCK
] = "UPDATE_BLOCK",
1604 [ READ_LONG_10
] = "READ_LONG_10",
1605 [ WRITE_LONG_10
] = "WRITE_LONG_10",
1606 [ CHANGE_DEFINITION
] = "CHANGE_DEFINITION",
1607 [ WRITE_SAME_10
] = "WRITE_SAME_10",
1608 [ UNMAP
] = "UNMAP",
1609 [ READ_TOC
] = "READ_TOC",
1610 [ REPORT_DENSITY_SUPPORT
] = "REPORT_DENSITY_SUPPORT",
1611 [ SANITIZE
] = "SANITIZE",
1612 [ GET_CONFIGURATION
] = "GET_CONFIGURATION",
1613 [ LOG_SELECT
] = "LOG_SELECT",
1614 [ LOG_SENSE
] = "LOG_SENSE",
1615 [ MODE_SELECT_10
] = "MODE_SELECT_10",
1616 [ RESERVE_10
] = "RESERVE_10",
1617 [ RELEASE_10
] = "RELEASE_10",
1618 [ MODE_SENSE_10
] = "MODE_SENSE_10",
1619 [ PERSISTENT_RESERVE_IN
] = "PERSISTENT_RESERVE_IN",
1620 [ PERSISTENT_RESERVE_OUT
] = "PERSISTENT_RESERVE_OUT",
1621 [ WRITE_FILEMARKS_16
] = "WRITE_FILEMARKS_16",
1622 [ EXTENDED_COPY
] = "EXTENDED_COPY",
1623 [ ATA_PASSTHROUGH_16
] = "ATA_PASSTHROUGH_16",
1624 [ ACCESS_CONTROL_IN
] = "ACCESS_CONTROL_IN",
1625 [ ACCESS_CONTROL_OUT
] = "ACCESS_CONTROL_OUT",
1626 [ READ_16
] = "READ_16",
1627 [ COMPARE_AND_WRITE
] = "COMPARE_AND_WRITE",
1628 [ WRITE_16
] = "WRITE_16",
1629 [ WRITE_VERIFY_16
] = "WRITE_VERIFY_16",
1630 [ VERIFY_16
] = "VERIFY_16",
1631 [ PRE_FETCH_16
] = "PRE_FETCH_16",
1632 [ SYNCHRONIZE_CACHE_16
] = "SPACE_16/SYNCHRONIZE_CACHE_16",
1633 /* SPACE_16 and SYNCHRONIZE_CACHE_16 use the same operation code */
1634 [ LOCATE_16
] = "LOCATE_16",
1635 [ WRITE_SAME_16
] = "ERASE_16/WRITE_SAME_16",
1636 /* ERASE_16 and WRITE_SAME_16 use the same operation code */
1637 [ SERVICE_ACTION_IN_16
] = "SERVICE_ACTION_IN_16",
1638 [ WRITE_LONG_16
] = "WRITE_LONG_16",
1639 [ REPORT_LUNS
] = "REPORT_LUNS",
1640 [ ATA_PASSTHROUGH_12
] = "BLANK/ATA_PASSTHROUGH_12",
1641 [ MOVE_MEDIUM
] = "MOVE_MEDIUM",
1642 [ EXCHANGE_MEDIUM
] = "EXCHANGE MEDIUM",
1643 [ READ_12
] = "READ_12",
1644 [ WRITE_12
] = "WRITE_12",
1645 [ ERASE_12
] = "ERASE_12/GET_PERFORMANCE",
1646 /* ERASE_12 and GET_PERFORMANCE use the same operation code */
1647 [ SERVICE_ACTION_IN_12
] = "SERVICE_ACTION_IN_12",
1648 [ WRITE_VERIFY_12
] = "WRITE_VERIFY_12",
1649 [ VERIFY_12
] = "VERIFY_12",
1650 [ SEARCH_HIGH_12
] = "SEARCH_HIGH_12",
1651 [ SEARCH_EQUAL_12
] = "SEARCH_EQUAL_12",
1652 [ SEARCH_LOW_12
] = "SEARCH_LOW_12",
1653 [ READ_ELEMENT_STATUS
] = "READ_ELEMENT_STATUS",
1654 [ SEND_VOLUME_TAG
] = "SEND_VOLUME_TAG/SET_STREAMING",
1655 /* SEND_VOLUME_TAG and SET_STREAMING use the same operation code */
1656 [ READ_CD
] = "READ_CD",
1657 [ READ_DEFECT_DATA_12
] = "READ_DEFECT_DATA_12",
1658 [ READ_DVD_STRUCTURE
] = "READ_DVD_STRUCTURE",
1659 [ RESERVE_TRACK
] = "RESERVE_TRACK",
1660 [ SEND_CUE_SHEET
] = "SEND_CUE_SHEET",
1661 [ SEND_DVD_STRUCTURE
] = "SEND_DVD_STRUCTURE",
1662 [ SET_CD_SPEED
] = "SET_CD_SPEED",
1663 [ SET_READ_AHEAD
] = "SET_READ_AHEAD",
1664 [ ALLOW_OVERWRITE
] = "ALLOW_OVERWRITE",
1665 [ MECHANISM_STATUS
] = "MECHANISM_STATUS",
1666 [ GET_EVENT_STATUS_NOTIFICATION
] = "GET_EVENT_STATUS_NOTIFICATION",
1667 [ READ_DISC_INFORMATION
] = "READ_DISC_INFORMATION",
1670 if (cmd
>= ARRAY_SIZE(names
) || names
[cmd
] == NULL
)
1675 SCSIRequest
*scsi_req_ref(SCSIRequest
*req
)
1677 assert(req
->refcount
> 0);
1682 void scsi_req_unref(SCSIRequest
*req
)
1684 assert(req
->refcount
> 0);
1685 if (--req
->refcount
== 0) {
1686 BusState
*qbus
= req
->dev
->qdev
.parent_bus
;
1687 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, qbus
);
1689 if (bus
->info
->free_request
&& req
->hba_private
) {
1690 bus
->info
->free_request(bus
, req
->hba_private
);
1692 if (req
->ops
->free_req
) {
1693 req
->ops
->free_req(req
);
1695 object_unref(OBJECT(req
->dev
));
1696 object_unref(OBJECT(qbus
->parent
));
1701 /* Tell the device that we finished processing this chunk of I/O. It
1702 will start the next chunk or complete the command. */
1703 void scsi_req_continue(SCSIRequest
*req
)
1705 if (req
->io_canceled
) {
1706 trace_scsi_req_continue_canceled(req
->dev
->id
, req
->lun
, req
->tag
);
1709 trace_scsi_req_continue(req
->dev
->id
, req
->lun
, req
->tag
);
1710 if (req
->cmd
.mode
== SCSI_XFER_TO_DEV
) {
1711 req
->ops
->write_data(req
);
1713 req
->ops
->read_data(req
);
1717 /* Called by the devices when data is ready for the HBA. The HBA should
1718 start a DMA operation to read or fill the device's data buffer.
1719 Once it completes, calling scsi_req_continue will restart I/O. */
1720 void scsi_req_data(SCSIRequest
*req
, int len
)
1723 if (req
->io_canceled
) {
1724 trace_scsi_req_data_canceled(req
->dev
->id
, req
->lun
, req
->tag
, len
);
1727 trace_scsi_req_data(req
->dev
->id
, req
->lun
, req
->tag
, len
);
1728 assert(req
->cmd
.mode
!= SCSI_XFER_NONE
);
1731 req
->bus
->info
->transfer_data(req
, len
);
1735 /* If the device calls scsi_req_data and the HBA specified a
1736 * scatter/gather list, the transfer has to happen in a single
1738 assert(!req
->dma_started
);
1739 req
->dma_started
= true;
1741 buf
= scsi_req_get_buf(req
);
1742 if (req
->cmd
.mode
== SCSI_XFER_FROM_DEV
) {
1743 req
->resid
= dma_buf_read(buf
, len
, req
->sg
);
1745 req
->resid
= dma_buf_write(buf
, len
, req
->sg
);
1747 scsi_req_continue(req
);
1750 void scsi_req_print(SCSIRequest
*req
)
1755 fprintf(fp
, "[%s id=%d] %s",
1756 req
->dev
->qdev
.parent_bus
->name
,
1758 scsi_command_name(req
->cmd
.buf
[0]));
1759 for (i
= 1; i
< req
->cmd
.len
; i
++) {
1760 fprintf(fp
, " 0x%02x", req
->cmd
.buf
[i
]);
1762 switch (req
->cmd
.mode
) {
1763 case SCSI_XFER_NONE
:
1764 fprintf(fp
, " - none\n");
1766 case SCSI_XFER_FROM_DEV
:
1767 fprintf(fp
, " - from-dev len=%zd\n", req
->cmd
.xfer
);
1769 case SCSI_XFER_TO_DEV
:
1770 fprintf(fp
, " - to-dev len=%zd\n", req
->cmd
.xfer
);
1773 fprintf(fp
, " - Oops\n");
1778 void scsi_req_complete(SCSIRequest
*req
, int status
)
1780 assert(req
->status
== -1);
1781 req
->status
= status
;
1783 assert(req
->sense_len
<= sizeof(req
->sense
));
1784 if (status
== GOOD
) {
1788 if (req
->sense_len
) {
1789 memcpy(req
->dev
->sense
, req
->sense
, req
->sense_len
);
1790 req
->dev
->sense_len
= req
->sense_len
;
1791 req
->dev
->sense_is_ua
= (req
->ops
== &reqops_unit_attention
);
1793 req
->dev
->sense_len
= 0;
1794 req
->dev
->sense_is_ua
= false;
1798 * Unit attention state is now stored in the device's sense buffer
1799 * if the HBA didn't do autosense. Clear the pending unit attention
1802 scsi_clear_unit_attention(req
);
1805 scsi_req_dequeue(req
);
1806 req
->bus
->info
->complete(req
, req
->status
, req
->resid
);
1808 /* Cancelled requests might end up being completed instead of cancelled */
1809 notifier_list_notify(&req
->cancel_notifiers
, req
);
1810 scsi_req_unref(req
);
1813 /* Called by the devices when the request is canceled. */
1814 void scsi_req_cancel_complete(SCSIRequest
*req
)
1816 assert(req
->io_canceled
);
1817 if (req
->bus
->info
->cancel
) {
1818 req
->bus
->info
->cancel(req
);
1820 notifier_list_notify(&req
->cancel_notifiers
, req
);
1821 scsi_req_unref(req
);
1824 /* Cancel @req asynchronously. @notifier is added to @req's cancellation
1825 * notifier list, the bus will be notified the requests cancellation is
1828 void scsi_req_cancel_async(SCSIRequest
*req
, Notifier
*notifier
)
1830 trace_scsi_req_cancel(req
->dev
->id
, req
->lun
, req
->tag
);
1832 notifier_list_add(&req
->cancel_notifiers
, notifier
);
1834 if (req
->io_canceled
) {
1835 /* A blk_aio_cancel_async is pending; when it finishes,
1836 * scsi_req_cancel_complete will be called and will
1837 * call the notifier we just added. Just wait for that.
1842 /* Dropped in scsi_req_cancel_complete. */
1844 scsi_req_dequeue(req
);
1845 req
->io_canceled
= true;
1847 blk_aio_cancel_async(req
->aiocb
);
1849 scsi_req_cancel_complete(req
);
1853 void scsi_req_cancel(SCSIRequest
*req
)
1855 trace_scsi_req_cancel(req
->dev
->id
, req
->lun
, req
->tag
);
1856 if (!req
->enqueued
) {
1859 assert(!req
->io_canceled
);
1860 /* Dropped in scsi_req_cancel_complete. */
1862 scsi_req_dequeue(req
);
1863 req
->io_canceled
= true;
1865 blk_aio_cancel(req
->aiocb
);
1867 scsi_req_cancel_complete(req
);
1871 static int scsi_ua_precedence(SCSISense sense
)
1873 if (sense
.key
!= UNIT_ATTENTION
) {
1876 if (sense
.asc
== 0x29 && sense
.ascq
== 0x04) {
1877 /* DEVICE INTERNAL RESET goes with POWER ON OCCURRED */
1879 } else if (sense
.asc
== 0x3F && sense
.ascq
== 0x01) {
1880 /* MICROCODE HAS BEEN CHANGED goes with SCSI BUS RESET OCCURRED */
1882 } else if (sense
.asc
== 0x29 && (sense
.ascq
== 0x05 || sense
.ascq
== 0x06)) {
1883 /* These two go with "all others". */
1885 } else if (sense
.asc
== 0x29 && sense
.ascq
<= 0x07) {
1886 /* POWER ON, RESET OR BUS DEVICE RESET OCCURRED = 0
1887 * POWER ON OCCURRED = 1
1888 * SCSI BUS RESET OCCURRED = 2
1889 * BUS DEVICE RESET FUNCTION OCCURRED = 3
1890 * I_T NEXUS LOSS OCCURRED = 7
1893 } else if (sense
.asc
== 0x2F && sense
.ascq
== 0x01) {
1894 /* COMMANDS CLEARED BY POWER LOSS NOTIFICATION */
1897 return (sense
.asc
<< 8) | sense
.ascq
;
1900 void scsi_device_set_ua(SCSIDevice
*sdev
, SCSISense sense
)
1903 if (sense
.key
!= UNIT_ATTENTION
) {
1906 trace_scsi_device_set_ua(sdev
->id
, sdev
->lun
, sense
.key
,
1907 sense
.asc
, sense
.ascq
);
1910 * Override a pre-existing unit attention condition, except for a more
1911 * important reset condition.
1913 prec1
= scsi_ua_precedence(sdev
->unit_attention
);
1914 prec2
= scsi_ua_precedence(sense
);
1915 if (prec2
< prec1
) {
1916 sdev
->unit_attention
= sense
;
1920 void scsi_device_purge_requests(SCSIDevice
*sdev
, SCSISense sense
)
1924 aio_context_acquire(blk_get_aio_context(sdev
->conf
.blk
));
1925 while (!QTAILQ_EMPTY(&sdev
->requests
)) {
1926 req
= QTAILQ_FIRST(&sdev
->requests
);
1927 scsi_req_cancel_async(req
, NULL
);
1929 blk_drain(sdev
->conf
.blk
);
1930 aio_context_release(blk_get_aio_context(sdev
->conf
.blk
));
1931 scsi_device_set_ua(sdev
, sense
);
1934 static char *scsibus_get_dev_path(DeviceState
*dev
)
1936 SCSIDevice
*d
= SCSI_DEVICE(dev
);
1937 DeviceState
*hba
= dev
->parent_bus
->parent
;
1941 id
= qdev_get_dev_path(hba
);
1943 path
= g_strdup_printf("%s/%d:%d:%d", id
, d
->channel
, d
->id
, d
->lun
);
1945 path
= g_strdup_printf("%d:%d:%d", d
->channel
, d
->id
, d
->lun
);
1951 static char *scsibus_get_fw_dev_path(DeviceState
*dev
)
1953 SCSIDevice
*d
= SCSI_DEVICE(dev
);
1954 return g_strdup_printf("channel@%x/%s@%x,%x", d
->channel
,
1955 qdev_fw_name(dev
), d
->id
, d
->lun
);
1958 SCSIDevice
*scsi_device_find(SCSIBus
*bus
, int channel
, int id
, int lun
)
1961 SCSIDevice
*target_dev
= NULL
;
1963 QTAILQ_FOREACH_REVERSE(kid
, &bus
->qbus
.children
, ChildrenHead
, sibling
) {
1964 DeviceState
*qdev
= kid
->child
;
1965 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
1967 if (dev
->channel
== channel
&& dev
->id
== id
) {
1968 if (dev
->lun
== lun
) {
1977 /* SCSI request list. For simplicity, pv points to the whole device */
1979 static int put_scsi_requests(QEMUFile
*f
, void *pv
, size_t size
,
1980 VMStateField
*field
, QJSON
*vmdesc
)
1983 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, s
->qdev
.parent_bus
);
1986 QTAILQ_FOREACH(req
, &s
->requests
, next
) {
1987 assert(!req
->io_canceled
);
1988 assert(req
->status
== -1);
1989 assert(req
->enqueued
);
1991 qemu_put_sbyte(f
, req
->retry
? 1 : 2);
1992 qemu_put_buffer(f
, req
->cmd
.buf
, sizeof(req
->cmd
.buf
));
1993 qemu_put_be32s(f
, &req
->tag
);
1994 qemu_put_be32s(f
, &req
->lun
);
1995 if (bus
->info
->save_request
) {
1996 bus
->info
->save_request(f
, req
);
1998 if (req
->ops
->save_request
) {
1999 req
->ops
->save_request(f
, req
);
2002 qemu_put_sbyte(f
, 0);
2007 static int get_scsi_requests(QEMUFile
*f
, void *pv
, size_t size
,
2008 VMStateField
*field
)
2011 SCSIBus
*bus
= DO_UPCAST(SCSIBus
, qbus
, s
->qdev
.parent_bus
);
2014 while ((sbyte
= qemu_get_sbyte(f
)) > 0) {
2015 uint8_t buf
[SCSI_CMD_BUF_SIZE
];
2020 qemu_get_buffer(f
, buf
, sizeof(buf
));
2021 qemu_get_be32s(f
, &tag
);
2022 qemu_get_be32s(f
, &lun
);
2023 req
= scsi_req_new(s
, tag
, lun
, buf
, NULL
);
2024 req
->retry
= (sbyte
== 1);
2025 if (bus
->info
->load_request
) {
2026 req
->hba_private
= bus
->info
->load_request(f
, req
);
2028 if (req
->ops
->load_request
) {
2029 req
->ops
->load_request(f
, req
);
2032 /* Just restart it later. */
2033 scsi_req_enqueue_internal(req
);
2035 /* At this point, the request will be kept alive by the reference
2036 * added by scsi_req_enqueue_internal, so we can release our reference.
2037 * The HBA of course will add its own reference in the load_request
2038 * callback if it needs to hold on the SCSIRequest.
2040 scsi_req_unref(req
);
2046 static const VMStateInfo vmstate_info_scsi_requests
= {
2047 .name
= "scsi-requests",
2048 .get
= get_scsi_requests
,
2049 .put
= put_scsi_requests
,
2052 static bool scsi_sense_state_needed(void *opaque
)
2054 SCSIDevice
*s
= opaque
;
2056 return s
->sense_len
> SCSI_SENSE_BUF_SIZE_OLD
;
2059 static const VMStateDescription vmstate_scsi_sense_state
= {
2060 .name
= "SCSIDevice/sense",
2062 .minimum_version_id
= 1,
2063 .needed
= scsi_sense_state_needed
,
2064 .fields
= (VMStateField
[]) {
2065 VMSTATE_UINT8_SUB_ARRAY(sense
, SCSIDevice
,
2066 SCSI_SENSE_BUF_SIZE_OLD
,
2067 SCSI_SENSE_BUF_SIZE
- SCSI_SENSE_BUF_SIZE_OLD
),
2068 VMSTATE_END_OF_LIST()
2072 const VMStateDescription vmstate_scsi_device
= {
2073 .name
= "SCSIDevice",
2075 .minimum_version_id
= 1,
2076 .fields
= (VMStateField
[]) {
2077 VMSTATE_UINT8(unit_attention
.key
, SCSIDevice
),
2078 VMSTATE_UINT8(unit_attention
.asc
, SCSIDevice
),
2079 VMSTATE_UINT8(unit_attention
.ascq
, SCSIDevice
),
2080 VMSTATE_BOOL(sense_is_ua
, SCSIDevice
),
2081 VMSTATE_UINT8_SUB_ARRAY(sense
, SCSIDevice
, 0, SCSI_SENSE_BUF_SIZE_OLD
),
2082 VMSTATE_UINT32(sense_len
, SCSIDevice
),
2086 .field_exists
= NULL
,
2087 .size
= 0, /* ouch */
2088 .info
= &vmstate_info_scsi_requests
,
2089 .flags
= VMS_SINGLE
,
2092 VMSTATE_END_OF_LIST()
2094 .subsections
= (const VMStateDescription
*[]) {
2095 &vmstate_scsi_sense_state
,
2100 static void scsi_device_class_init(ObjectClass
*klass
, void *data
)
2102 DeviceClass
*k
= DEVICE_CLASS(klass
);
2103 set_bit(DEVICE_CATEGORY_STORAGE
, k
->categories
);
2104 k
->bus_type
= TYPE_SCSI_BUS
;
2105 k
->realize
= scsi_qdev_realize
;
2106 k
->unrealize
= scsi_qdev_unrealize
;
2107 k
->props
= scsi_props
;
2110 static void scsi_dev_instance_init(Object
*obj
)
2112 DeviceState
*dev
= DEVICE(obj
);
2113 SCSIDevice
*s
= SCSI_DEVICE(dev
);
2115 device_add_bootindex_property(obj
, &s
->conf
.bootindex
,
2120 static const TypeInfo scsi_device_type_info
= {
2121 .name
= TYPE_SCSI_DEVICE
,
2122 .parent
= TYPE_DEVICE
,
2123 .instance_size
= sizeof(SCSIDevice
),
2125 .class_size
= sizeof(SCSIDeviceClass
),
2126 .class_init
= scsi_device_class_init
,
2127 .instance_init
= scsi_dev_instance_init
,
2130 static void scsi_register_types(void)
2132 type_register_static(&scsi_bus_info
);
2133 type_register_static(&scsi_device_type_info
);
2136 type_init(scsi_register_types
)