Revision 5c6c0e51

b/hw/esp.c
65 65
    uint32_t dma;
66 66
    SCSIBus bus;
67 67
    SCSIDevice *current_dev;
68
    SCSIRequest *current_req;
68 69
    uint8_t cmdbuf[TI_BUFSZ];
69 70
    uint32_t cmdlen;
70 71
    uint32_t do_cmd;
......
209 210

  
210 211
    if (s->current_dev) {
211 212
        /* Started a new command before the old one finished.  Cancel it.  */
212
        s->current_dev->info->cancel_io(s->current_dev, 0);
213
        s->current_dev->info->cancel_io(s->current_req);
213 214
        s->async_len = 0;
214 215
    }
215 216

  
......
232 233

  
233 234
    DPRINTF("do_busid_cmd: busid 0x%x\n", busid);
234 235
    lun = busid & 7;
235
    datalen = s->current_dev->info->send_command(s->current_dev, 0, buf, lun);
236
    s->current_req = s->current_dev->info->alloc_req(s->current_dev, 0, lun);
237
    datalen = s->current_dev->info->send_command(s->current_req, buf);
236 238
    s->ti_size = datalen;
237 239
    if (datalen != 0) {
238 240
        s->rregs[ESP_RSTAT] = STAT_TC;
......
240 242
        s->dma_counter = 0;
241 243
        if (datalen > 0) {
242 244
            s->rregs[ESP_RSTAT] |= STAT_DI;
243
            s->current_dev->info->read_data(s->current_dev, 0);
245
            s->current_dev->info->read_data(s->current_req);
244 246
        } else {
245 247
            s->rregs[ESP_RSTAT] |= STAT_DO;
246
            s->current_dev->info->write_data(s->current_dev, 0);
248
            s->current_dev->info->write_data(s->current_req);
247 249
        }
248 250
    }
249 251
    s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
......
372 374
    if (s->async_len == 0) {
373 375
        if (to_device) {
374 376
            // ti_size is negative
375
            s->current_dev->info->write_data(s->current_dev, 0);
377
            s->current_dev->info->write_data(s->current_req);
376 378
        } else {
377
            s->current_dev->info->read_data(s->current_dev, 0);
379
            s->current_dev->info->read_data(s->current_req);
378 380
            /* If there is still data to be read from the device then
379 381
               complete the DMA operation immediately.  Otherwise defer
380 382
               until the scsi layer has completed.  */
......
388 390
    }
389 391
}
390 392

  
391
static void esp_command_complete(SCSIBus *bus, int reason, uint32_t tag,
392
                                 uint32_t arg)
393
static void esp_command_complete(SCSIRequest *req, int reason, uint32_t arg)
393 394
{
394
    ESPState *s = DO_UPCAST(ESPState, busdev.qdev, bus->qbus.parent);
395
    ESPState *s = DO_UPCAST(ESPState, busdev.qdev, req->bus->qbus.parent);
395 396

  
396 397
    if (reason == SCSI_REASON_DONE) {
397 398
        DPRINTF("SCSI Command complete\n");
......
405 406
        s->sense = arg;
406 407
        s->rregs[ESP_RSTAT] = STAT_ST;
407 408
        esp_dma_done(s);
408
        s->current_dev = NULL;
409
        if (s->current_req) {
410
            scsi_req_unref(s->current_req);
411
            s->current_req = NULL;
412
            s->current_dev = NULL;
413
        }
409 414
    } else {
410 415
        DPRINTF("transfer %d/%d\n", s->dma_left, s->ti_size);
411 416
        s->async_len = arg;
412
        s->async_buf = s->current_dev->info->get_buf(s->current_dev, 0);
417
        s->async_buf = s->current_dev->info->get_buf(req);
413 418
        if (s->dma_left) {
414 419
            esp_do_dma(s);
415 420
        } else if (s->dma_counter != 0 && s->ti_size <= 0) {
b/hw/lsi53c895a.c
174 174
#define LSI_TAG_VALID     (1 << 16)
175 175

  
176 176
typedef struct lsi_request {
177
    SCSIRequest *req;
177 178
    uint32_t tag;
178 179
    uint32_t dma_len;
179 180
    uint8_t *dma_buf;
......
567 568
    s->csbc += count;
568 569
    s->dnad += count;
569 570
    s->dbc -= count;
570

  
571
    if (s->current->dma_buf == NULL) {
572
        s->current->dma_buf = dev->info->get_buf(dev, s->current->tag);
571
     if (s->current->dma_buf == NULL) {
572
        s->current->dma_buf = dev->info->get_buf(s->current->req);
573 573
    }
574

  
575 574
    /* ??? Set SFBR to first data byte.  */
576 575
    if (out) {
577 576
        cpu_physical_memory_read(addr, s->current->dma_buf, count);
......
583 582
        s->current->dma_buf = NULL;
584 583
        if (out) {
585 584
            /* Write the data.  */
586
            dev->info->write_data(dev, s->current->tag);
585
            dev->info->write_data(s->current->req);
587 586
        } else {
588 587
            /* Request any remaining data.  */
589
            dev->info->read_data(dev, s->current->tag);
588
            dev->info->read_data(s->current->req);
590 589
        }
591 590
    } else {
592 591
        s->current->dma_buf += count;
......
698 697
        return 1;
699 698
    }
700 699
}
701

  
702
/* Callback to indicate that the SCSI layer has completed a transfer.  */
703
static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
704
                                 uint32_t arg)
700
 /* Callback to indicate that the SCSI layer has completed a transfer.  */
701
static void lsi_command_complete(SCSIRequest *req, int reason, uint32_t arg)
705 702
{
706
    LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
703
    LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
707 704
    int out;
708 705

  
709 706
    out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
......
718 715
            lsi_set_phase(s, PHASE_ST);
719 716
        }
720 717

  
721
        qemu_free(s->current);
722
        s->current = NULL;
723

  
718
        if (s->current && req == s->current->req) {
719
            scsi_req_unref(s->current->req);
720
            qemu_free(s->current);
721
            s->current = NULL;
722
        }
724 723
        lsi_resume_script(s);
725 724
        return;
726 725
    }
727 726

  
728
    if (s->waiting == 1 || !s->current || tag != s->current->tag ||
727
    if (s->waiting == 1 || !s->current || req->tag != s->current->tag ||
729 728
        (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
730
        if (lsi_queue_tag(s, tag, arg))
729
        if (lsi_queue_tag(s, req->tag, arg)) {
731 730
            return;
731
        }
732 732
    }
733 733

  
734 734
    /* host adapter (re)connected */
735
    DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
735
    DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, arg);
736 736
    s->current->dma_len = arg;
737 737
    s->command_complete = 1;
738 738
    if (!s->waiting)
......
768 768
    assert(s->current == NULL);
769 769
    s->current = qemu_mallocz(sizeof(lsi_request));
770 770
    s->current->tag = s->select_tag;
771
    s->current->req = dev->info->alloc_req(dev, s->current->tag,
772
                                           s->current_lun);
771 773

  
772
    n = dev->info->send_command(dev, s->current->tag, buf, s->current_lun);
774
    n = dev->info->send_command(s->current->req, buf);
773 775
    if (n > 0) {
774 776
        lsi_set_phase(s, PHASE_DI);
775
        dev->info->read_data(dev, s->current->tag);
777
        dev->info->read_data(s->current->req);
776 778
    } else if (n < 0) {
777 779
        lsi_set_phase(s, PHASE_DO);
778
        dev->info->write_data(dev, s->current->tag);
780
        dev->info->write_data(s->current->req);
779 781
    }
780 782

  
781 783
    if (!s->command_complete) {
......
868 870
    int len;
869 871
    uint32_t current_tag;
870 872
    SCSIDevice *current_dev;
871
    lsi_request *p, *p_next;
873
    lsi_request *current_req, *p, *p_next;
872 874
    int id;
873 875

  
874 876
    if (s->current) {
875 877
        current_tag = s->current->tag;
878
        current_req = s->current;
876 879
    } else {
877 880
        current_tag = s->select_tag;
881
        current_req = lsi_find_by_tag(s, current_tag);
878 882
    }
879 883
    id = (current_tag >> 8) & 0xf;
880 884
    current_dev = s->bus.devs[id];
......
926 930
        case 0x0d:
927 931
            /* The ABORT TAG message clears the current I/O process only. */
928 932
            DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
929
            current_dev->info->cancel_io(current_dev, current_tag);
933
            if (current_req) {
934
                current_dev->info->cancel_io(current_req->req);
935
            }
930 936
            lsi_disconnect(s);
931 937
            break;
932 938
        case 0x06:
......
949 955
            }
950 956

  
951 957
            /* clear the current I/O process */
952
            current_dev->info->cancel_io(current_dev, current_tag);
958
            if (s->current) {
959
                current_dev->info->cancel_io(s->current->req);
960
            }
953 961

  
954 962
            /* As the current implemented devices scsi_disk and scsi_generic
955 963
               only support one LUN, we don't need to keep track of LUNs.
......
961 969
            id = current_tag & 0x0000ff00;
962 970
            QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
963 971
                if ((p->tag & 0x0000ff00) == id) {
964
                    current_dev->info->cancel_io(current_dev, p->tag);
972
                    current_dev->info->cancel_io(p->req);
965 973
                    QTAILQ_REMOVE(&s->queue, p, next);
966 974
                }
967 975
            }
b/hw/scsi-bus.c
136 136
    SCSIRequest *req;
137 137

  
138 138
    req = qemu_mallocz(size);
139
    /* Two references: one is passed back to the HBA, one is in d->requests.  */
140
    req->refcount = 2;
139
    req->refcount = 1;
141 140
    req->bus = scsi_bus_from_device(d);
142 141
    req->dev = d;
143 142
    req->tag = tag;
144 143
    req->lun = lun;
145 144
    req->status = -1;
146
    req->enqueued = true;
147 145
    trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
148
    QTAILQ_INSERT_TAIL(&d->requests, req, next);
149 146
    return req;
150 147
}
151 148

  
152
SCSIRequest *scsi_req_find(SCSIDevice *d, uint32_t tag)
149
void scsi_req_enqueue(SCSIRequest *req)
153 150
{
154
    SCSIRequest *req;
155

  
156
    QTAILQ_FOREACH(req, &d->requests, next) {
157
        if (req->tag == tag) {
158
            return req;
159
        }
160
    }
161
    return NULL;
151
    assert(!req->enqueued);
152
    scsi_req_ref(req);
153
    req->enqueued = true;
154
    QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
162 155
}
163 156

  
164 157
void scsi_req_dequeue(SCSIRequest *req)
......
516 509
void scsi_req_data(SCSIRequest *req, int len)
517 510
{
518 511
    trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);
519
    req->bus->ops->complete(req->bus, SCSI_REASON_DATA, req->tag, len);
512
    req->bus->ops->complete(req, SCSI_REASON_DATA, len);
520 513
}
521 514

  
522 515
void scsi_req_print(SCSIRequest *req)
......
552 545
    assert(req->status != -1);
553 546
    scsi_req_ref(req);
554 547
    scsi_req_dequeue(req);
555
    req->bus->ops->complete(req->bus, SCSI_REASON_DONE,
556
                            req->tag,
557
                            req->status);
548
    req->bus->ops->complete(req, SCSI_REASON_DONE, req->status);
558 549
    scsi_req_unref(req);
559 550
}
560 551

  
b/hw/scsi-disk.c
86 86
static int scsi_handle_rw_error(SCSIDiskReq *r, int error, int type);
87 87
static int scsi_disk_emulate_command(SCSIDiskReq *r, uint8_t *outbuf);
88 88

  
89
static SCSIDiskReq *scsi_new_request(SCSIDiskState *s, uint32_t tag,
89
static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag,
90 90
        uint32_t lun)
91 91
{
92
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
92 93
    SCSIRequest *req;
93 94
    SCSIDiskReq *r;
94 95

  
95 96
    req = scsi_req_alloc(sizeof(SCSIDiskReq), &s->qdev, tag, lun);
96 97
    r = DO_UPCAST(SCSIDiskReq, req, req);
97 98
    r->iov.iov_base = qemu_blockalign(s->bs, SCSI_DMA_BUF_SIZE);
98
    return r;
99
    return req;
99 100
}
100 101

  
101 102
static void scsi_free_request(SCSIRequest *req)
......
105 106
    qemu_vfree(r->iov.iov_base);
106 107
}
107 108

  
108
static SCSIDiskReq *scsi_find_request(SCSIDiskState *s, uint32_t tag)
109
{
110
    return DO_UPCAST(SCSIDiskReq, req, scsi_req_find(&s->qdev, tag));
111
}
112

  
113 109
static void scsi_disk_clear_sense(SCSIDiskState *s)
114 110
{
115 111
    memset(&s->sense, 0, sizeof(s->sense));
......
138 134
}
139 135

  
140 136
/* Cancel a pending data transfer.  */
141
static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
137
static void scsi_cancel_io(SCSIRequest *req)
142 138
{
143
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
144
    SCSIDiskReq *r;
145
    DPRINTF("Cancel tag=0x%x\n", tag);
146
    r = scsi_find_request(s, tag);
147
    if (r) {
148
        if (r->req.aiocb)
149
            bdrv_aio_cancel(r->req.aiocb);
150
        r->req.aiocb = NULL;
151
        scsi_req_dequeue(&r->req);
139
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
140

  
141
    DPRINTF("Cancel tag=0x%x\n", req->tag);
142
    if (r->req.aiocb) {
143
        bdrv_aio_cancel(r->req.aiocb);
152 144
    }
145
    r->req.aiocb = NULL;
146
    scsi_req_dequeue(&r->req);
153 147
}
154 148

  
155 149
static void scsi_read_complete(void * opaque, int ret)
......
174 168
}
175 169

  
176 170

  
177
static void scsi_read_request(SCSIDiskReq *r)
171
/* Read more data from scsi device into buffer.  */
172
static void scsi_read_data(SCSIRequest *req)
178 173
{
174
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
179 175
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
180 176
    uint32_t n;
181 177

  
......
207 203
    }
208 204
}
209 205

  
210
/* Read more data from scsi device into buffer.  */
211
static void scsi_read_data(SCSIDevice *d, uint32_t tag)
212
{
213
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
214
    SCSIDiskReq *r;
215

  
216
    r = scsi_find_request(s, tag);
217
    if (!r) {
218
        BADF("Bad read tag 0x%x\n", tag);
219
        /* ??? This is the wrong error.  */
220
        scsi_command_complete(r, CHECK_CONDITION, HARDWARE_ERROR);
221
        return;
222
    }
223

  
224
    scsi_read_request(r);
225
}
226

  
227 206
static int scsi_handle_rw_error(SCSIDiskReq *r, int error, int type)
228 207
{
229 208
    int is_read = (type == SCSI_REQ_STATUS_RETRY_READ);
......
285 264
    }
286 265
}
287 266

  
288
static void scsi_write_request(SCSIDiskReq *r)
267
static int scsi_write_data(SCSIRequest *req)
289 268
{
269
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
290 270
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
291 271
    uint32_t n;
292 272

  
......
305 285
        /* Invoke completion routine to fetch data from host.  */
306 286
        scsi_write_complete(r, 0);
307 287
    }
308
}
309

  
310
/* Write data to a scsi device.  Returns nonzero on failure.
311
   The transfer may complete asynchronously.  */
312
static int scsi_write_data(SCSIDevice *d, uint32_t tag)
313
{
314
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
315
    SCSIDiskReq *r;
316

  
317
    DPRINTF("Write data tag=0x%x\n", tag);
318
    r = scsi_find_request(s, tag);
319
    if (!r) {
320
        BADF("Bad write tag 0x%x\n", tag);
321
        scsi_command_complete(r, CHECK_CONDITION, HARDWARE_ERROR);
322
        return 1;
323
    }
324

  
325
    scsi_write_request(r);
326 288

  
327 289
    return 0;
328 290
}
......
347 309

  
348 310
            switch (status & SCSI_REQ_STATUS_RETRY_TYPE_MASK) {
349 311
            case SCSI_REQ_STATUS_RETRY_READ:
350
                scsi_read_request(r);
312
                scsi_read_data(&r->req);
351 313
                break;
352 314
            case SCSI_REQ_STATUS_RETRY_WRITE:
353
                scsi_write_request(r);
315
                scsi_write_data(&r->req);
354 316
                break;
355 317
            case SCSI_REQ_STATUS_RETRY_FLUSH:
356 318
                ret = scsi_disk_emulate_command(r, r->iov.iov_base);
......
376 338
}
377 339

  
378 340
/* Return a pointer to the data buffer.  */
379
static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
341
static uint8_t *scsi_get_buf(SCSIRequest *req)
380 342
{
381
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
382
    SCSIDiskReq *r;
343
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
383 344

  
384
    r = scsi_find_request(s, tag);
385
    if (!r) {
386
        BADF("Bad buffer tag 0x%x\n", tag);
387
        return NULL;
388
    }
389 345
    return (uint8_t *)r->iov.iov_base;
390 346
}
391 347

  
......
1029 985
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
1030 986
   and zero if the command does not transfer any data.  */
1031 987

  
1032
static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
1033
                                 uint8_t *buf, int lun)
988
static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf)
1034 989
{
1035
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
990
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
991
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1036 992
    int32_t len;
1037 993
    int is_write;
1038 994
    uint8_t command;
1039 995
    uint8_t *outbuf;
1040
    SCSIDiskReq *r;
1041 996
    int rc;
1042 997

  
998
    scsi_req_enqueue(req);
1043 999
    command = buf[0];
1044
    r = scsi_find_request(s, tag);
1045
    if (r) {
1046
        BADF("Tag 0x%x already in use\n", tag);
1047
        scsi_cancel_io(d, tag);
1048
    }
1049
    /* ??? Tags are not unique for different luns.  We only implement a
1050
       single lun, so this should not matter.  */
1051
    r = scsi_new_request(s, tag, lun);
1052 1000
    outbuf = (uint8_t *)r->iov.iov_base;
1053 1001
    is_write = 0;
1054 1002
    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
......
1067 1015
    }
1068 1016
#endif
1069 1017

  
1070
    if (lun || buf[1] >> 5) {
1018
    if (req->lun || buf[1] >> 5) {
1071 1019
        /* Only LUN 0 supported.  */
1072
        DPRINTF("Unimplemented LUN %d\n", lun ? lun : buf[1] >> 5);
1020
        DPRINTF("Unimplemented LUN %d\n", req->lun ? req->lun : buf[1] >> 5);
1073 1021
        if (command != REQUEST_SENSE && command != INQUIRY)
1074 1022
            goto fail;
1075 1023
    }
......
1095 1043
    case REZERO_UNIT:
1096 1044
        rc = scsi_disk_emulate_command(r, outbuf);
1097 1045
        if (rc < 0) {
1098
            scsi_req_unref(&r->req);
1099 1046
            return 0;
1100 1047
        }
1101 1048

  
......
1105 1052
    case READ_10:
1106 1053
    case READ_12:
1107 1054
    case READ_16:
1108
        len = r->req.cmd.xfer / d->blocksize;
1055
        len = r->req.cmd.xfer / s->qdev.blocksize;
1109 1056
        DPRINTF("Read (sector %" PRId64 ", count %d)\n", r->req.cmd.lba, len);
1110 1057
        if (r->req.cmd.lba > s->max_lba)
1111 1058
            goto illegal_lba;
......
1119 1066
    case WRITE_VERIFY:
1120 1067
    case WRITE_VERIFY_12:
1121 1068
    case WRITE_VERIFY_16:
1122
        len = r->req.cmd.xfer / d->blocksize;
1069
        len = r->req.cmd.xfer / s->qdev.blocksize;
1123 1070
        DPRINTF("Write %s(sector %" PRId64 ", count %d)\n",
1124 1071
                (command & 0xe) == 0xe ? "And Verify " : "",
1125 1072
                r->req.cmd.lba, len);
......
1154 1101
        }
1155 1102
        break;
1156 1103
    case WRITE_SAME_16:
1157
        len = r->req.cmd.xfer / d->blocksize;
1104
        len = r->req.cmd.xfer / s->qdev.blocksize;
1158 1105

  
1159 1106
        DPRINTF("WRITE SAME(16) (sector %" PRId64 ", count %d)\n",
1160 1107
                r->req.cmd.lba, len);
......
1182 1129
        DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
1183 1130
    fail:
1184 1131
        scsi_command_complete(r, CHECK_CONDITION, ILLEGAL_REQUEST);
1185
        scsi_req_unref(&r->req);
1186 1132
        return 0;
1187 1133
    illegal_lba:
1188 1134
        scsi_command_complete(r, CHECK_CONDITION, HARDWARE_ERROR);
1189
        scsi_req_unref(&r->req);
1190 1135
        return 0;
1191 1136
    }
1192 1137
    if (r->sector_count == 0 && r->iov.iov_len == 0) {
......
1199 1144
        if (!r->sector_count)
1200 1145
            r->sector_count = -1;
1201 1146
    }
1202
    scsi_req_unref(&r->req);
1203 1147
    return len;
1204 1148
}
1205 1149

  
......
1213 1157
            bdrv_aio_cancel(r->req.aiocb);
1214 1158
        }
1215 1159
        scsi_req_dequeue(&r->req);
1160
        scsi_req_unref(&r->req);
1216 1161
    }
1217 1162
}
1218 1163

  
......
1325 1270
        .qdev.reset   = scsi_disk_reset,
1326 1271
        .init         = scsi_hd_initfn,
1327 1272
        .destroy      = scsi_destroy,
1273
        .alloc_req    = scsi_new_request,
1328 1274
        .free_req     = scsi_free_request,
1329 1275
        .send_command = scsi_send_command,
1330 1276
        .read_data    = scsi_read_data,
......
1344 1290
        .qdev.reset   = scsi_disk_reset,
1345 1291
        .init         = scsi_cd_initfn,
1346 1292
        .destroy      = scsi_destroy,
1293
        .alloc_req    = scsi_new_request,
1347 1294
        .free_req     = scsi_free_request,
1348 1295
        .send_command = scsi_send_command,
1349 1296
        .read_data    = scsi_read_data,
......
1362 1309
        .qdev.reset   = scsi_disk_reset,
1363 1310
        .init         = scsi_disk_initfn,
1364 1311
        .destroy      = scsi_destroy,
1312
        .alloc_req    = scsi_new_request,
1365 1313
        .free_req     = scsi_free_request,
1366 1314
        .send_command = scsi_send_command,
1367 1315
        .read_data    = scsi_read_data,
b/hw/scsi-generic.c
66 66
    uint8_t senselen;
67 67
};
68 68

  
69
static SCSIGenericReq *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun)
69
static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun)
70 70
{
71 71
    SCSIRequest *req;
72 72

  
73 73
    req = scsi_req_alloc(sizeof(SCSIGenericReq), d, tag, lun);
74
    return DO_UPCAST(SCSIGenericReq, req, req);
74
    return req;
75 75
}
76 76

  
77 77
static void scsi_free_request(SCSIRequest *req)
......
81 81
    qemu_free(r->buf);
82 82
}
83 83

  
84
static SCSIGenericReq *scsi_find_request(SCSIGenericState *s, uint32_t tag)
85
{
86
    return DO_UPCAST(SCSIGenericReq, req, scsi_req_find(&s->qdev, tag));
87
}
88

  
89 84
/* Helper function for command completion.  */
90 85
static void scsi_command_complete(void *opaque, int ret)
91 86
{
......
117 112
}
118 113

  
119 114
/* Cancel a pending data transfer.  */
120
static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
115
static void scsi_cancel_io(SCSIRequest *req)
121 116
{
122
    DPRINTF("scsi_cancel_io 0x%x\n", tag);
123
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
124
    SCSIGenericReq *r;
125
    DPRINTF("Cancel tag=0x%x\n", tag);
126
    r = scsi_find_request(s, tag);
127
    if (r) {
128
        if (r->req.aiocb)
129
            bdrv_aio_cancel(r->req.aiocb);
130
        r->req.aiocb = NULL;
131
        scsi_req_dequeue(&r->req);
117
    SCSIGenericReq *r = DO_UPCAST(SCSIGenericReq, req, req);
118

  
119
    DPRINTF("Cancel tag=0x%x\n", req->tag);
120
    if (r->req.aiocb) {
121
        bdrv_aio_cancel(r->req.aiocb);
132 122
    }
123
    r->req.aiocb = NULL;
124
    scsi_req_dequeue(&r->req);
133 125
}
134 126

  
135 127
static int execute_command(BlockDriverState *bdrv,
......
182 174
}
183 175

  
184 176
/* Read more data from scsi device into buffer.  */
185
static void scsi_read_data(SCSIDevice *d, uint32_t tag)
177
static void scsi_read_data(SCSIRequest *req)
186 178
{
187
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
188
    SCSIGenericReq *r;
179
    SCSIGenericReq *r = DO_UPCAST(SCSIGenericReq, req, req);
180
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev);
189 181
    int ret;
190 182

  
191
    DPRINTF("scsi_read_data 0x%x\n", tag);
192
    r = scsi_find_request(s, tag);
193
    if (!r) {
194
        BADF("Bad read tag 0x%x\n", tag);
195
        /* ??? This is the wrong error.  */
196
        scsi_command_complete(r, -EINVAL);
197
        return;
198
    }
199

  
183
    DPRINTF("scsi_read_data 0x%x\n", req->tag);
200 184
    if (r->len == -1) {
201 185
        scsi_command_complete(r, 0);
202 186
        return;
......
249 233

  
250 234
/* Write data to a scsi device.  Returns nonzero on failure.
251 235
   The transfer may complete asynchronously.  */
252
static int scsi_write_data(SCSIDevice *d, uint32_t tag)
236
static int scsi_write_data(SCSIRequest *req)
253 237
{
254
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
255
    SCSIGenericReq *r;
238
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, req->dev);
239
    SCSIGenericReq *r = DO_UPCAST(SCSIGenericReq, req, req);
256 240
    int ret;
257 241

  
258
    DPRINTF("scsi_write_data 0x%x\n", tag);
259
    r = scsi_find_request(s, tag);
260
    if (!r) {
261
        BADF("Bad write tag 0x%x\n", tag);
262
        /* ??? This is the wrong error.  */
263
        scsi_command_complete(r, -EINVAL);
264
        return 0;
265
    }
266

  
242
    DPRINTF("scsi_write_data 0x%x\n", req->tag);
267 243
    if (r->len == 0) {
268 244
        r->len = r->buflen;
269 245
        scsi_req_data(&r->req, r->len);
......
280 256
}
281 257

  
282 258
/* Return a pointer to the data buffer.  */
283
static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
259
static uint8_t *scsi_get_buf(SCSIRequest *req)
284 260
{
285
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
286
    SCSIGenericReq *r;
287
    r = scsi_find_request(s, tag);
288
    if (!r) {
289
        BADF("Bad buffer tag 0x%x\n", tag);
290
        return NULL;
291
    }
261
    SCSIGenericReq *r = DO_UPCAST(SCSIGenericReq, req, req);
262

  
292 263
    return r->buf;
293 264
}
294 265

  
......
316 287
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
317 288
   and zero if the command does not transfer any data.  */
318 289

  
319
static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
320
                                 uint8_t *cmd, int lun)
290
static int32_t scsi_send_command(SCSIRequest *req, uint8_t *cmd)
321 291
{
322
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
323
    SCSIGenericReq *r;
292
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, req->dev);
293
    SCSIGenericReq *r = DO_UPCAST(SCSIGenericReq, req, req);
324 294
    SCSIBus *bus;
325 295
    int ret;
326
    int32_t len;
327 296

  
297
    scsi_req_enqueue(req);
328 298
    if (cmd[0] != REQUEST_SENSE &&
329
        (lun != s->lun || (cmd[1] >> 5) != s->lun)) {
330
        DPRINTF("Unimplemented LUN %d\n", lun ? lun : cmd[1] >> 5);
299
        (req->lun != s->lun || (cmd[1] >> 5) != s->lun)) {
300
        DPRINTF("Unimplemented LUN %d\n", req->lun ? req->lun : cmd[1] >> 5);
331 301

  
332 302
        s->sensebuf[0] = 0x70;
333 303
        s->sensebuf[1] = 0x00;
......
338 308
        s->sensebuf[6] = 0x00;
339 309
        s->senselen = 7;
340 310
        s->driver_status = SG_ERR_DRIVER_SENSE;
341
        bus = scsi_bus_from_device(d);
342
        bus->ops->complete(bus, SCSI_REASON_DONE, tag, CHECK_CONDITION);
311
        bus = scsi_bus_from_device(&s->qdev);
312
        bus->ops->complete(req, SCSI_REASON_DONE, CHECK_CONDITION);
343 313
        return 0;
344 314
    }
345 315

  
346
    r = scsi_find_request(s, tag);
347
    if (r) {
348
        BADF("Tag 0x%x already in use %p\n", tag, r);
349
        scsi_cancel_io(d, tag);
350
    }
351
    r = scsi_new_request(d, tag, lun);
352

  
353 316
    if (-1 == scsi_req_parse(&r->req, cmd)) {
354 317
        BADF("Unsupported command length, command %x\n", cmd[0]);
355 318
        scsi_req_dequeue(&r->req);
......
379 342
        ret = execute_command(s->bs, r, SG_DXFER_NONE, scsi_command_complete);
380 343
        if (ret == -1) {
381 344
            scsi_command_complete(r, -EINVAL);
382
            scsi_req_unref(&r->req);
383
            return 0;
384 345
        }
385
        scsi_req_unref(&r->req);
386 346
        return 0;
387 347
    }
388 348

  
......
397 357
    r->len = r->req.cmd.xfer;
398 358
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
399 359
        r->len = 0;
400
        len = -r->req.cmd.xfer;
360
        return -r->req.cmd.xfer;
401 361
    } else {
402
        len = r->req.cmd.xfer;
362
        return r->req.cmd.xfer;
403 363
    }
404

  
405
    scsi_req_unref(&r->req);
406
    return len;
407 364
}
408 365

  
409 366
static int get_blocksize(BlockDriverState *bdrv)
......
477 434
            bdrv_aio_cancel(r->req.aiocb);
478 435
        }
479 436
        scsi_req_dequeue(&r->req);
437
        scsi_req_unref(&r->req);
480 438
    }
481 439
}
482 440

  
......
568 526
    .qdev.reset   = scsi_generic_reset,
569 527
    .init         = scsi_generic_initfn,
570 528
    .destroy      = scsi_destroy,
529
    .alloc_req    = scsi_new_request,
571 530
    .free_req     = scsi_free_request,
572 531
    .send_command = scsi_send_command,
573 532
    .read_data    = scsi_read_data,
b/hw/scsi.h
19 19
typedef struct SCSIBusOps SCSIBusOps;
20 20
typedef struct SCSIDevice SCSIDevice;
21 21
typedef struct SCSIDeviceInfo SCSIDeviceInfo;
22
typedef struct SCSIRequest SCSIRequest;
22 23

  
23 24
enum SCSIXferMode {
24 25
    SCSI_XFER_NONE,      /*  TEST_UNIT_READY, ...            */
......
26 27
    SCSI_XFER_TO_DEV,    /*  WRITE, MODE_SELECT, ...         */
27 28
};
28 29

  
29
typedef struct SCSIRequest {
30
struct SCSIRequest {
30 31
    SCSIBus           *bus;
31 32
    SCSIDevice        *dev;
32 33
    uint32_t          refcount;
......
43 44
    BlockDriverAIOCB  *aiocb;
44 45
    bool enqueued;
45 46
    QTAILQ_ENTRY(SCSIRequest) next;
46
} SCSIRequest;
47
};
47 48

  
48 49
struct SCSIDevice
49 50
{
......
66 67
    DeviceInfo qdev;
67 68
    scsi_qdev_initfn init;
68 69
    void (*destroy)(SCSIDevice *s);
70
    SCSIRequest *(*alloc_req)(SCSIDevice *s, uint32_t tag, uint32_t lun);
69 71
    void (*free_req)(SCSIRequest *req);
70
    int32_t (*send_command)(SCSIDevice *s, uint32_t tag, uint8_t *buf,
71
                            int lun);
72
    void (*read_data)(SCSIDevice *s, uint32_t tag);
73
    int (*write_data)(SCSIDevice *s, uint32_t tag);
74
    void (*cancel_io)(SCSIDevice *s, uint32_t tag);
75
    uint8_t *(*get_buf)(SCSIDevice *s, uint32_t tag);
72
    int32_t (*send_command)(SCSIRequest *req, uint8_t *buf);
73
    void (*read_data)(SCSIRequest *req);
74
    int (*write_data)(SCSIRequest *req);
75
    void (*cancel_io)(SCSIRequest *req);
76
    uint8_t *(*get_buf)(SCSIRequest *req);
76 77
};
77 78

  
78 79
struct SCSIBusOps {
79
    void (*complete)(SCSIBus *bus, int reason, uint32_t tag, uint32_t arg);
80
    void (*complete)(SCSIRequest *req, int reason, uint32_t arg);
80 81
};
81 82

  
82 83
struct SCSIBus {
......
103 104
int scsi_bus_legacy_handle_cmdline(SCSIBus *bus);
104 105

  
105 106
SCSIRequest *scsi_req_alloc(size_t size, SCSIDevice *d, uint32_t tag, uint32_t lun);
106
SCSIRequest *scsi_req_find(SCSIDevice *d, uint32_t tag);
107
void scsi_req_enqueue(SCSIRequest *req);
107 108
void scsi_req_free(SCSIRequest *req);
108 109
void scsi_req_dequeue(SCSIRequest *req);
109 110
SCSIRequest *scsi_req_ref(SCSIRequest *req);
b/hw/spapr_vscsi.c
75 75

  
76 76
    /* SCSI request tracking */
77 77
    SCSIDevice              *sdev;
78
    SCSIRequest             *sreq;
78 79
    uint32_t                qtag; /* qemu tag != srp tag */
79 80
    int                     lun;
80 81
    int                     active;
......
123 124

  
124 125
static void vscsi_put_req(VSCSIState *s, vscsi_req *req)
125 126
{
127
    if (req->sreq != NULL) {
128
        scsi_req_unref(req->sreq);
129
    }
130
    req->sreq = NULL;
126 131
    req->active = 0;
127 132
}
128 133

  
129
static vscsi_req *vscsi_find_req(VSCSIState *s, uint32_t tag)
134
static vscsi_req *vscsi_find_req(VSCSIState *s, SCSIRequest *req)
130 135
{
136
    uint32_t tag = req->tag;
131 137
    if (tag >= VSCSI_REQ_LIMIT || !s->reqs[tag].active) {
132 138
        return NULL;
133 139
    }
......
453 459
    cdb[4] = 96;
454 460
    cdb[5] = 0;
455 461
    req->sensing = 1;
456
    n = sdev->info->send_command(sdev, req->qtag, cdb, req->lun);
462
    n = sdev->info->send_command(req->sreq, cdb);
457 463
    dprintf("VSCSI: Queued request sense tag 0x%x\n", req->qtag);
458 464
    if (n < 0) {
459 465
        fprintf(stderr, "VSCSI: REQUEST_SENSE wants write data !?!?!?\n");
460
        sdev->info->cancel_io(sdev, req->qtag);
466
        sdev->info->cancel_io(req->sreq);
461 467
        vscsi_makeup_sense(s, req, HARDWARE_ERROR, 0, 0);
462 468
        vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0);
463 469
        vscsi_put_req(s, req);
......
465 471
    } else if (n == 0) {
466 472
        return;
467 473
    }
468
    sdev->info->read_data(sdev, req->qtag);
474
    sdev->info->read_data(req->sreq);
469 475
}
470 476

  
471 477
/* Callback to indicate that the SCSI layer has completed a transfer.  */
472
static void vscsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
473
                                   uint32_t arg)
478
static void vscsi_command_complete(SCSIRequest *sreq, int reason, uint32_t arg)
474 479
{
475
    VSCSIState *s = DO_UPCAST(VSCSIState, vdev.qdev, bus->qbus.parent);
476
    vscsi_req *req = vscsi_find_req(s, tag);
480
    VSCSIState *s = DO_UPCAST(VSCSIState, vdev.qdev, sreq->bus->qbus.parent);
481
    vscsi_req *req = vscsi_find_req(s, sreq);
477 482
    SCSIDevice *sdev;
478 483
    uint8_t *buf;
479 484
    int32_t res_in = 0, res_out = 0;
480 485
    int len, rc = 0;
481 486

  
482 487
    dprintf("VSCSI: SCSI cmd complete, r=0x%x tag=0x%x arg=0x%x, req=%p\n",
483
            reason, tag, arg, req);
488
            reason, sreq->tag, arg, req);
484 489
    if (req == NULL) {
485
        fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", tag);
490
        fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
486 491
        return;
487 492
    }
488 493
    sdev = req->sdev;
......
493 498
            vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0);
494 499
            vscsi_put_req(s, req);
495 500
        } else {
496
            uint8_t *buf = sdev->info->get_buf(sdev, tag);
501
            uint8_t *buf = sdev->info->get_buf(sreq);
497 502

  
498 503
            len = MIN(arg, SCSI_SENSE_BUF_SIZE);
499 504
            dprintf("VSCSI: Sense data, %d bytes:\n", len);
......
505 510
                    buf[12], buf[13], buf[14], buf[15]);
506 511
            memcpy(req->sense, buf, len);
507 512
            req->senselen = len;
508
            sdev->info->read_data(sdev, req->qtag);
513
            sdev->info->read_data(sreq);
509 514
        }
510 515
        return;
511 516
    }
......
537 542
     * to write for writes (ie, how much is to be DMA'd)
538 543
     */
539 544
    if (arg) {
540
        buf = sdev->info->get_buf(sdev, tag);
545
        buf = sdev->info->get_buf(sreq);
541 546
        rc = vscsi_srp_transfer_data(s, req, req->writing, buf, arg);
542 547
    }
543 548
    if (rc < 0) {
544 549
        fprintf(stderr, "VSCSI: RDMA error rc=%d!\n", rc);
545
        sdev->info->cancel_io(sdev, req->qtag);
550
        sdev->info->cancel_io(sreq);
546 551
        vscsi_makeup_sense(s, req, HARDWARE_ERROR, 0, 0);
547 552
        vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0);
548 553
        vscsi_put_req(s, req);
......
552 557
    /* Start next chunk */
553 558
    req->data_len -= rc;
554 559
    if (req->writing) {
555
        sdev->info->write_data(sdev, req->qtag);
560
        sdev->info->write_data(sreq);
556 561
    } else {
557
        sdev->info->read_data(sdev, req->qtag);
562
        sdev->info->read_data(sreq);
558 563
    }
559 564
}
560 565

  
......
644 649

  
645 650
    req->sdev = sdev;
646 651
    req->lun = lun;
647
    n = sdev->info->send_command(sdev, req->qtag, srp->cmd.cdb, lun);
652
    req->sreq = sdev->info->alloc_req(sdev, req->qtag, lun);
653
    n = sdev->info->send_command(req->sreq, srp->cmd.cdb);
648 654

  
649 655
    dprintf("VSCSI: Queued command tag 0x%x CMD 0x%x ID %d LUN %d ret: %d\n",
650 656
            req->qtag, srp->cmd.cdb[0], id, lun, n);
......
662 668
    /* Get transfer direction and initiate transfer */
663 669
    if (n > 0) {
664 670
        req->data_len = n;
665
        sdev->info->read_data(sdev, req->qtag);
671
        sdev->info->read_data(req->sreq);
666 672
    } else if (n < 0) {
667 673
        req->data_len = -n;
668
        sdev->info->write_data(sdev, req->qtag);
674
        sdev->info->write_data(req->sreq);
669 675
    }
670 676
    /* Don't touch req here, it may have been recycled already */
671 677

  
b/hw/usb-msd.c
48 48
    uint32_t data_len;
49 49
    uint32_t residue;
50 50
    uint32_t tag;
51
    SCSIRequest *req;
51 52
    SCSIBus bus;
52 53
    BlockConf conf;
53 54
    SCSIDevice *scsi_dev;
......
190 191
    s->data_len -= len;
191 192
    if (s->scsi_len == 0 || s->data_len == 0) {
192 193
        if (s->mode == USB_MSDM_DATAIN) {
193
            s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
194
            s->scsi_dev->info->read_data(s->req);
194 195
        } else if (s->mode == USB_MSDM_DATAOUT) {
195
            s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
196
            s->scsi_dev->info->write_data(s->req);
196 197
        }
197 198
    }
198 199
}
......
211 212
    memcpy(p->data, &csw, len);
212 213
}
213 214

  
214
static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
215
                                     uint32_t arg)
215
static void usb_msd_command_complete(SCSIRequest *req, int reason, uint32_t arg)
216 216
{
217
    MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
217
    MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
218 218
    USBPacket *p = s->packet;
219 219

  
220
    if (tag != s->tag) {
221
        fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
220
    if (req->tag != s->tag) {
221
        fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", req->tag);
222 222
    }
223 223
    if (reason == SCSI_REASON_DONE) {
224 224
        DPRINTF("Command complete %d\n", arg);
......
245 245
        } else if (s->data_len == 0) {
246 246
            s->mode = USB_MSDM_CSW;
247 247
        }
248
        scsi_req_unref(req);
249
        s->req = NULL;
248 250
        return;
249 251
    }
250 252
    s->scsi_len = arg;
251
    s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
253
    s->scsi_buf = s->scsi_dev->info->get_buf(req);
252 254
    if (p) {
253 255
        usb_msd_copy_data(s);
254 256
        if (s->usb_len == 0) {
......
316 318
static void usb_msd_cancel_io(USBPacket *p, void *opaque)
317 319
{
318 320
    MSDState *s = opaque;
319
    s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
321
    s->scsi_dev->info->cancel_io(s->req);
320 322
    s->packet = NULL;
321 323
    s->scsi_len = 0;
322 324
}
......
365 367
                    s->tag, cbw.flags, cbw.cmd_len, s->data_len);
366 368
            s->residue = 0;
367 369
            s->scsi_len = 0;
368
            s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
370
            s->req = s->scsi_dev->info->alloc_req(s->scsi_dev, s->tag, 0);
371
            s->scsi_dev->info->send_command(s->req, cbw.cmd);
369 372
            /* ??? Should check that USB and SCSI data transfer
370 373
               directions match.  */
371 374
            if (s->residue == 0) {
372 375
                if (s->mode == USB_MSDM_DATAIN) {
373
                    s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
376
                    s->scsi_dev->info->read_data(s->req);
374 377
                } else if (s->mode == USB_MSDM_DATAOUT) {
375
                    s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
378
                    s->scsi_dev->info->write_data(s->req);
376 379
                }
377 380
            }
378 381
            ret = len;

Also available in: Unified diff