Statistics
| Branch: | Revision:

root / hw / scsi-bus.c @ 6dc06f08

History | View | Annotate | Download (31.8 kB)

1
#include "hw.h"
2
#include "qemu-error.h"
3
#include "scsi.h"
4
#include "scsi-defs.h"
5
#include "qdev.h"
6
#include "blockdev.h"
7
#include "trace.h"
8

    
9
static char *scsibus_get_fw_dev_path(DeviceState *dev);
10
static int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf);
11
static int scsi_build_sense(uint8_t *in_buf, int in_len,
12
                            uint8_t *buf, int len, bool fixed);
13

    
14
static struct BusInfo scsi_bus_info = {
15
    .name  = "SCSI",
16
    .size  = sizeof(SCSIBus),
17
    .get_fw_dev_path = scsibus_get_fw_dev_path,
18
    .props = (Property[]) {
19
        DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1),
20
        DEFINE_PROP_UINT32("lun", SCSIDevice, lun, 0),
21
        DEFINE_PROP_END_OF_LIST(),
22
    },
23
};
24
static int next_scsi_bus;
25

    
26
/* Create a scsi bus, and attach devices to it.  */
27
void scsi_bus_new(SCSIBus *bus, DeviceState *host, int tcq, int ndev,
28
                  const SCSIBusOps *ops)
29
{
30
    qbus_create_inplace(&bus->qbus, &scsi_bus_info, host, NULL);
31
    bus->busnr = next_scsi_bus++;
32
    bus->tcq = tcq;
33
    bus->ndev = ndev;
34
    bus->ops = ops;
35
    bus->qbus.allow_hotplug = 1;
36
}
37

    
38
static int scsi_qdev_init(DeviceState *qdev, DeviceInfo *base)
39
{
40
    SCSIDevice *dev = DO_UPCAST(SCSIDevice, qdev, qdev);
41
    SCSIDeviceInfo *info = DO_UPCAST(SCSIDeviceInfo, qdev, base);
42
    SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
43
    int rc = -1;
44

    
45
    if (dev->id == -1) {
46
        for (dev->id = 0; dev->id < bus->ndev; dev->id++) {
47
            if (bus->devs[dev->id] == NULL)
48
                break;
49
        }
50
    }
51
    if (dev->id >= bus->ndev) {
52
        error_report("bad scsi device id: %d", dev->id);
53
        goto err;
54
    }
55

    
56
    if (bus->devs[dev->id]) {
57
        qdev_free(&bus->devs[dev->id]->qdev);
58
    }
59
    bus->devs[dev->id] = dev;
60

    
61
    dev->info = info;
62
    QTAILQ_INIT(&dev->requests);
63
    rc = dev->info->init(dev);
64
    if (rc != 0) {
65
        bus->devs[dev->id] = NULL;
66
    }
67

    
68
err:
69
    return rc;
70
}
71

    
72
static int scsi_qdev_exit(DeviceState *qdev)
73
{
74
    SCSIDevice *dev = DO_UPCAST(SCSIDevice, qdev, qdev);
75
    SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
76

    
77
    assert(bus->devs[dev->id] != NULL);
78
    if (bus->devs[dev->id]->info->destroy) {
79
        bus->devs[dev->id]->info->destroy(bus->devs[dev->id]);
80
    }
81
    bus->devs[dev->id] = NULL;
82
    return 0;
83
}
84

    
85
void scsi_qdev_register(SCSIDeviceInfo *info)
86
{
87
    info->qdev.bus_info = &scsi_bus_info;
88
    info->qdev.init     = scsi_qdev_init;
89
    info->qdev.unplug   = qdev_simple_unplug_cb;
90
    info->qdev.exit     = scsi_qdev_exit;
91
    qdev_register(&info->qdev);
92
}
93

    
94
/* handle legacy '-drive if=scsi,...' cmd line args */
95
SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
96
                                      int unit, bool removable)
97
{
98
    const char *driver;
99
    DeviceState *dev;
100

    
101
    driver = bdrv_is_sg(bdrv) ? "scsi-generic" : "scsi-disk";
102
    dev = qdev_create(&bus->qbus, driver);
103
    qdev_prop_set_uint32(dev, "scsi-id", unit);
104
    if (qdev_prop_exists(dev, "removable")) {
105
        qdev_prop_set_bit(dev, "removable", removable);
106
    }
107
    if (qdev_prop_set_drive(dev, "drive", bdrv) < 0) {
108
        qdev_free(dev);
109
        return NULL;
110
    }
111
    if (qdev_init(dev) < 0)
112
        return NULL;
113
    return DO_UPCAST(SCSIDevice, qdev, dev);
114
}
115

    
116
int scsi_bus_legacy_handle_cmdline(SCSIBus *bus)
117
{
118
    Location loc;
119
    DriveInfo *dinfo;
120
    int res = 0, unit;
121

    
122
    loc_push_none(&loc);
123
    for (unit = 0; unit < bus->ndev; unit++) {
124
        dinfo = drive_get(IF_SCSI, bus->busnr, unit);
125
        if (dinfo == NULL) {
126
            continue;
127
        }
128
        qemu_opts_loc_restore(dinfo->opts);
129
        if (!scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit, false)) {
130
            res = -1;
131
            break;
132
        }
133
    }
134
    loc_pop(&loc);
135
    return res;
136
}
137

    
138
/* SCSIReqOps implementation for invalid commands.  */
139

    
140
static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf)
141
{
142
    scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE));
143
    scsi_req_complete(req, CHECK_CONDITION);
144
    return 0;
145
}
146

    
147
struct SCSIReqOps reqops_invalid_opcode = {
148
    .size         = sizeof(SCSIRequest),
149
    .send_command = scsi_invalid_command
150
};
151

    
152
/* SCSIReqOps implementation for unit attention conditions.  */
153

    
154
static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
155
{
156
    if (req->dev && req->dev->unit_attention.key == UNIT_ATTENTION) {
157
        scsi_req_build_sense(req, req->dev->unit_attention);
158
    } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
159
        scsi_req_build_sense(req, req->bus->unit_attention);
160
    }
161
    scsi_req_complete(req, CHECK_CONDITION);
162
    return 0;
163
}
164

    
165
struct SCSIReqOps reqops_unit_attention = {
166
    .size         = sizeof(SCSIRequest),
167
    .send_command = scsi_unit_attention
168
};
169

    
170
/* SCSIReqOps implementation for REPORT LUNS and for commands sent to
171
   an invalid LUN.  */
172

    
173
typedef struct SCSITargetReq SCSITargetReq;
174

    
175
struct SCSITargetReq {
176
    SCSIRequest req;
177
    int len;
178
    uint8_t buf[64];
179
};
180

    
181
static void store_lun(uint8_t *outbuf, int lun)
182
{
183
    if (lun < 256) {
184
        outbuf[1] = lun;
185
        return;
186
    }
187
    outbuf[1] = (lun & 255);
188
    outbuf[0] = (lun >> 8) | 0x40;
189
}
190

    
191
static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
192
{
193
    int len;
194
    if (r->req.cmd.xfer < 16) {
195
        return false;
196
    }
197
    if (r->req.cmd.buf[2] > 2) {
198
        return false;
199
    }
200
    len = MIN(sizeof r->buf, r->req.cmd.xfer);
201
    memset(r->buf, 0, len);
202
    if (r->req.dev->lun != 0) {
203
        r->buf[3] = 16;
204
        r->len = 24;
205
        store_lun(&r->buf[16], r->req.dev->lun);
206
    } else {
207
        r->buf[3] = 8;
208
        r->len = 16;
209
    }
210
    return true;
211
}
212

    
213
static bool scsi_target_emulate_inquiry(SCSITargetReq *r)
214
{
215
    assert(r->req.dev->lun != r->req.lun);
216
    if (r->req.cmd.buf[1] & 0x2) {
217
        /* Command support data - optional, not implemented */
218
        return false;
219
    }
220

    
221
    if (r->req.cmd.buf[1] & 0x1) {
222
        /* Vital product data */
223
        uint8_t page_code = r->req.cmd.buf[2];
224
        if (r->req.cmd.xfer < 4) {
225
            return false;
226
        }
227

    
228
        r->buf[r->len++] = page_code ; /* this page */
229
        r->buf[r->len++] = 0x00;
230

    
231
        switch (page_code) {
232
        case 0x00: /* Supported page codes, mandatory */
233
        {
234
            int pages;
235
            pages = r->len++;
236
            r->buf[r->len++] = 0x00; /* list of supported pages (this page) */
237
            r->buf[pages] = r->len - pages - 1; /* number of pages */
238
            break;
239
        }
240
        default:
241
            return false;
242
        }
243
        /* done with EVPD */
244
        assert(r->len < sizeof(r->buf));
245
        r->len = MIN(r->req.cmd.xfer, r->len);
246
        return true;
247
    }
248

    
249
    /* Standard INQUIRY data */
250
    if (r->req.cmd.buf[2] != 0) {
251
        return false;
252
    }
253

    
254
    /* PAGE CODE == 0 */
255
    if (r->req.cmd.xfer < 5) {
256
        return -1;
257
    }
258

    
259
    r->len = MIN(r->req.cmd.xfer, 36);
260
    memset(r->buf, 0, r->len);
261
    if (r->req.lun != 0) {
262
        r->buf[0] = TYPE_NO_LUN;
263
    } else {
264
        r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE;
265
        r->buf[2] = 5; /* Version */
266
        r->buf[3] = 2 | 0x10; /* HiSup, response data format */
267
        r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */
268
        r->buf[7] = 0x10 | (r->req.bus->tcq ? 0x02 : 0); /* Sync, TCQ.  */
269
        memcpy(&r->buf[8], "QEMU    ", 8);
270
        memcpy(&r->buf[16], "QEMU TARGET     ", 16);
271
        strncpy((char *) &r->buf[32], QEMU_VERSION, 4);
272
    }
273
    return true;
274
}
275

    
276
static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf)
277
{
278
    SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
279

    
280
    switch (buf[0]) {
281
    case REPORT_LUNS:
282
        if (!scsi_target_emulate_report_luns(r)) {
283
            goto illegal_request;
284
        }
285
        break;
286
    case INQUIRY:
287
        if (!scsi_target_emulate_inquiry(r)) {
288
            goto illegal_request;
289
        }
290
        break;
291
    case REQUEST_SENSE:
292
        if (req->cmd.xfer < 4) {
293
            goto illegal_request;
294
        }
295
        r->len = scsi_device_get_sense(r->req.dev, r->buf, req->cmd.xfer,
296
                                       (req->cmd.buf[1] & 1) == 0);
297
        break;
298
    default:
299
        scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED));
300
        scsi_req_complete(req, CHECK_CONDITION);
301
        return 0;
302
    illegal_request:
303
        scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
304
        scsi_req_complete(req, CHECK_CONDITION);
305
        return 0;
306
    }
307

    
308
    if (!r->len) {
309
        scsi_req_complete(req, GOOD);
310
    }
311
    return r->len;
312
}
313

    
314
static void scsi_target_read_data(SCSIRequest *req)
315
{
316
    SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
317
    uint32_t n;
318

    
319
    n = r->len;
320
    if (n > 0) {
321
        r->len = 0;
322
        scsi_req_data(&r->req, n);
323
    } else {
324
        scsi_req_complete(&r->req, GOOD);
325
    }
326
}
327

    
328
static uint8_t *scsi_target_get_buf(SCSIRequest *req)
329
{
330
    SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
331

    
332
    return r->buf;
333
}
334

    
335
struct SCSIReqOps reqops_target_command = {
336
    .size         = sizeof(SCSITargetReq),
337
    .send_command = scsi_target_send_command,
338
    .read_data    = scsi_target_read_data,
339
    .get_buf      = scsi_target_get_buf,
340
};
341

    
342

    
343
SCSIRequest *scsi_req_alloc(SCSIReqOps *reqops, SCSIDevice *d, uint32_t tag,
344
                            uint32_t lun, void *hba_private)
345
{
346
    SCSIRequest *req;
347

    
348
    req = qemu_mallocz(reqops->size);
349
    req->refcount = 1;
350
    req->bus = scsi_bus_from_device(d);
351
    req->dev = d;
352
    req->tag = tag;
353
    req->lun = lun;
354
    req->hba_private = hba_private;
355
    req->status = -1;
356
    req->sense_len = 0;
357
    req->ops = reqops;
358
    trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
359
    return req;
360
}
361

    
362
SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,
363
                          uint8_t *buf, void *hba_private)
364
{
365
    SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus);
366
    SCSIRequest *req;
367
    SCSICommand cmd;
368

    
369
    if (scsi_req_parse(&cmd, d, buf) != 0) {
370
        trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]);
371
        req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private);
372
    } else {
373
        trace_scsi_req_parsed(d->id, lun, tag, buf[0],
374
                              cmd.mode, cmd.xfer);
375
        if (req->cmd.lba != -1) {
376
            trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0],
377
                                      cmd.lba);
378
        }
379

    
380
        if ((d->unit_attention.key == UNIT_ATTENTION ||
381
             bus->unit_attention.key == UNIT_ATTENTION) &&
382
            (buf[0] != INQUIRY &&
383
             buf[0] != REPORT_LUNS &&
384
             buf[0] != GET_CONFIGURATION &&
385
             buf[0] != GET_EVENT_STATUS_NOTIFICATION)) {
386
            req = scsi_req_alloc(&reqops_unit_attention, d, tag, lun,
387
                                 hba_private);
388
        } else if (lun != d->lun ||
389
            buf[0] == REPORT_LUNS ||
390
            buf[0] == REQUEST_SENSE) {
391
            req = scsi_req_alloc(&reqops_target_command, d, tag, lun,
392
                                 hba_private);
393
        } else {
394
            req = d->info->alloc_req(d, tag, lun, hba_private);
395
        }
396
    }
397

    
398
    req->cmd = cmd;
399
    return req;
400
}
401

    
402
uint8_t *scsi_req_get_buf(SCSIRequest *req)
403
{
404
    return req->ops->get_buf(req);
405
}
406

    
407
static void scsi_clear_unit_attention(SCSIRequest *req)
408
{
409
    SCSISense *ua;
410
    if (req->dev->unit_attention.key != UNIT_ATTENTION &&
411
        req->bus->unit_attention.key != UNIT_ATTENTION) {
412
        return;
413
    }
414

    
415
    /*
416
     * If an INQUIRY command enters the enabled command state,
417
     * the device server shall [not] clear any unit attention condition;
418
     * See also MMC-6, paragraphs 6.5 and 6.6.2.
419
     */
420
    if (req->cmd.buf[0] == INQUIRY ||
421
        req->cmd.buf[0] == GET_CONFIGURATION ||
422
        req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) {
423
        return;
424
    }
425

    
426
    if (req->dev->unit_attention.key == UNIT_ATTENTION) {
427
        ua = &req->dev->unit_attention;
428
    } else {
429
        ua = &req->bus->unit_attention;
430
    }
431

    
432
    /*
433
     * If a REPORT LUNS command enters the enabled command state, [...]
434
     * the device server shall clear any pending unit attention condition
435
     * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
436
     */
437
    if (req->cmd.buf[0] == REPORT_LUNS &&
438
        !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
439
          ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) {
440
        return;
441
    }
442

    
443
    *ua = SENSE_CODE(NO_SENSE);
444
}
445

    
446
int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len)
447
{
448
    int ret;
449

    
450
    assert(len >= 14);
451
    if (!req->sense_len) {
452
        return 0;
453
    }
454

    
455
    ret = scsi_build_sense(req->sense, req->sense_len, buf, len, true);
456

    
457
    /*
458
     * FIXME: clearing unit attention conditions upon autosense should be done
459
     * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
460
     * (SAM-5, 5.14).
461
     *
462
     * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
463
     * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
464
     * In the latter case, scsi_req_complete clears unit attention conditions
465
     * after moving them to the device's sense buffer.
466
     */
467
    scsi_clear_unit_attention(req);
468
    return ret;
469
}
470

    
471
int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed)
472
{
473
    return scsi_build_sense(dev->sense, dev->sense_len, buf, len, fixed);
474
}
475

    
476
void scsi_req_build_sense(SCSIRequest *req, SCSISense sense)
477
{
478
    trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag,
479
                               sense.key, sense.asc, sense.ascq);
480
    memset(req->sense, 0, 18);
481
    req->sense[0] = 0xf0;
482
    req->sense[2] = sense.key;
483
    req->sense[12] = sense.asc;
484
    req->sense[13] = sense.ascq;
485
    req->sense_len = 18;
486
}
487

    
488
int32_t scsi_req_enqueue(SCSIRequest *req)
489
{
490
    int32_t rc;
491

    
492
    assert(!req->enqueued);
493
    scsi_req_ref(req);
494
    req->enqueued = true;
495
    QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
496

    
497
    scsi_req_ref(req);
498
    rc = req->ops->send_command(req, req->cmd.buf);
499
    scsi_req_unref(req);
500
    return rc;
501
}
502

    
503
static void scsi_req_dequeue(SCSIRequest *req)
504
{
505
    trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
506
    if (req->enqueued) {
507
        QTAILQ_REMOVE(&req->dev->requests, req, next);
508
        req->enqueued = false;
509
        scsi_req_unref(req);
510
    }
511
}
512

    
513
static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
514
{
515
    switch (buf[0] >> 5) {
516
    case 0:
517
        cmd->xfer = buf[4];
518
        cmd->len = 6;
519
        /* length 0 means 256 blocks */
520
        if (cmd->xfer == 0) {
521
            cmd->xfer = 256;
522
        }
523
        break;
524
    case 1:
525
    case 2:
526
        cmd->xfer = buf[8] | (buf[7] << 8);
527
        cmd->len = 10;
528
        break;
529
    case 4:
530
        cmd->xfer = buf[13] | (buf[12] << 8) | (buf[11] << 16) | (buf[10] << 24);
531
        cmd->len = 16;
532
        break;
533
    case 5:
534
        cmd->xfer = buf[9] | (buf[8] << 8) | (buf[7] << 16) | (buf[6] << 24);
535
        cmd->len = 12;
536
        break;
537
    default:
538
        return -1;
539
    }
540

    
541
    switch (buf[0]) {
542
    case TEST_UNIT_READY:
543
    case REWIND:
544
    case START_STOP:
545
    case SEEK_6:
546
    case WRITE_FILEMARKS:
547
    case SPACE:
548
    case RESERVE:
549
    case RELEASE:
550
    case ERASE:
551
    case ALLOW_MEDIUM_REMOVAL:
552
    case VERIFY_10:
553
    case SEEK_10:
554
    case SYNCHRONIZE_CACHE:
555
    case LOCK_UNLOCK_CACHE:
556
    case LOAD_UNLOAD:
557
    case SET_CD_SPEED:
558
    case SET_LIMITS:
559
    case WRITE_LONG_10:
560
    case MOVE_MEDIUM:
561
    case UPDATE_BLOCK:
562
        cmd->xfer = 0;
563
        break;
564
    case MODE_SENSE:
565
        break;
566
    case WRITE_SAME_10:
567
        cmd->xfer = 1;
568
        break;
569
    case READ_CAPACITY_10:
570
        cmd->xfer = 8;
571
        break;
572
    case READ_BLOCK_LIMITS:
573
        cmd->xfer = 6;
574
        break;
575
    case READ_POSITION:
576
        cmd->xfer = 20;
577
        break;
578
    case SEND_VOLUME_TAG:
579
        cmd->xfer *= 40;
580
        break;
581
    case MEDIUM_SCAN:
582
        cmd->xfer *= 8;
583
        break;
584
    case WRITE_10:
585
    case WRITE_VERIFY_10:
586
    case WRITE_6:
587
    case WRITE_12:
588
    case WRITE_VERIFY_12:
589
    case WRITE_16:
590
    case WRITE_VERIFY_16:
591
        cmd->xfer *= dev->blocksize;
592
        break;
593
    case READ_10:
594
    case READ_6:
595
    case READ_REVERSE:
596
    case RECOVER_BUFFERED_DATA:
597
    case READ_12:
598
    case READ_16:
599
        cmd->xfer *= dev->blocksize;
600
        break;
601
    case INQUIRY:
602
        cmd->xfer = buf[4] | (buf[3] << 8);
603
        break;
604
    case MAINTENANCE_OUT:
605
    case MAINTENANCE_IN:
606
        if (dev->type == TYPE_ROM) {
607
            /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
608
            cmd->xfer = buf[9] | (buf[8] << 8);
609
        }
610
        break;
611
    }
612
    return 0;
613
}
614

    
615
static int scsi_req_stream_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
616
{
617
    switch (buf[0]) {
618
    /* stream commands */
619
    case READ_6:
620
    case READ_REVERSE:
621
    case RECOVER_BUFFERED_DATA:
622
    case WRITE_6:
623
        cmd->len = 6;
624
        cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16);
625
        if (buf[1] & 0x01) { /* fixed */
626
            cmd->xfer *= dev->blocksize;
627
        }
628
        break;
629
    case REWIND:
630
    case START_STOP:
631
        cmd->len = 6;
632
        cmd->xfer = 0;
633
        break;
634
    /* generic commands */
635
    default:
636
        return scsi_req_length(cmd, dev, buf);
637
    }
638
    return 0;
639
}
640

    
641
static void scsi_cmd_xfer_mode(SCSICommand *cmd)
642
{
643
    switch (cmd->buf[0]) {
644
    case WRITE_6:
645
    case WRITE_10:
646
    case WRITE_VERIFY_10:
647
    case WRITE_12:
648
    case WRITE_VERIFY_12:
649
    case WRITE_16:
650
    case WRITE_VERIFY_16:
651
    case COPY:
652
    case COPY_VERIFY:
653
    case COMPARE:
654
    case CHANGE_DEFINITION:
655
    case LOG_SELECT:
656
    case MODE_SELECT:
657
    case MODE_SELECT_10:
658
    case SEND_DIAGNOSTIC:
659
    case WRITE_BUFFER:
660
    case FORMAT_UNIT:
661
    case REASSIGN_BLOCKS:
662
    case SEARCH_EQUAL:
663
    case SEARCH_HIGH:
664
    case SEARCH_LOW:
665
    case UPDATE_BLOCK:
666
    case WRITE_LONG_10:
667
    case WRITE_SAME_10:
668
    case SEARCH_HIGH_12:
669
    case SEARCH_EQUAL_12:
670
    case SEARCH_LOW_12:
671
    case MEDIUM_SCAN:
672
    case SEND_VOLUME_TAG:
673
    case PERSISTENT_RESERVE_OUT:
674
    case MAINTENANCE_OUT:
675
        cmd->mode = SCSI_XFER_TO_DEV;
676
        break;
677
    default:
678
        if (cmd->xfer)
679
            cmd->mode = SCSI_XFER_FROM_DEV;
680
        else {
681
            cmd->mode = SCSI_XFER_NONE;
682
        }
683
        break;
684
    }
685
}
686

    
687
static uint64_t scsi_cmd_lba(SCSICommand *cmd)
688
{
689
    uint8_t *buf = cmd->buf;
690
    uint64_t lba;
691

    
692
    switch (buf[0] >> 5) {
693
    case 0:
694
        lba = (uint64_t) buf[3] | ((uint64_t) buf[2] << 8) |
695
              (((uint64_t) buf[1] & 0x1f) << 16);
696
        break;
697
    case 1:
698
    case 2:
699
        lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
700
              ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
701
        break;
702
    case 4:
703
        lba = (uint64_t) buf[9] | ((uint64_t) buf[8] << 8) |
704
              ((uint64_t) buf[7] << 16) | ((uint64_t) buf[6] << 24) |
705
              ((uint64_t) buf[5] << 32) | ((uint64_t) buf[4] << 40) |
706
              ((uint64_t) buf[3] << 48) | ((uint64_t) buf[2] << 56);
707
        break;
708
    case 5:
709
        lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
710
              ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
711
        break;
712
    default:
713
        lba = -1;
714

    
715
    }
716
    return lba;
717
}
718

    
719
int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
720
{
721
    int rc;
722

    
723
    if (dev->type == TYPE_TAPE) {
724
        rc = scsi_req_stream_length(cmd, dev, buf);
725
    } else {
726
        rc = scsi_req_length(cmd, dev, buf);
727
    }
728
    if (rc != 0)
729
        return rc;
730

    
731
    memcpy(cmd->buf, buf, cmd->len);
732
    scsi_cmd_xfer_mode(cmd);
733
    cmd->lba = scsi_cmd_lba(cmd);
734
    return 0;
735
}
736

    
737
/*
738
 * Predefined sense codes
739
 */
740

    
741
/* No sense data available */
742
const struct SCSISense sense_code_NO_SENSE = {
743
    .key = NO_SENSE , .asc = 0x00 , .ascq = 0x00
744
};
745

    
746
/* LUN not ready, Manual intervention required */
747
const struct SCSISense sense_code_LUN_NOT_READY = {
748
    .key = NOT_READY, .asc = 0x04, .ascq = 0x03
749
};
750

    
751
/* LUN not ready, Medium not present */
752
const struct SCSISense sense_code_NO_MEDIUM = {
753
    .key = NOT_READY, .asc = 0x3a, .ascq = 0x00
754
};
755

    
756
/* Hardware error, internal target failure */
757
const struct SCSISense sense_code_TARGET_FAILURE = {
758
    .key = HARDWARE_ERROR, .asc = 0x44, .ascq = 0x00
759
};
760

    
761
/* Illegal request, invalid command operation code */
762
const struct SCSISense sense_code_INVALID_OPCODE = {
763
    .key = ILLEGAL_REQUEST, .asc = 0x20, .ascq = 0x00
764
};
765

    
766
/* Illegal request, LBA out of range */
767
const struct SCSISense sense_code_LBA_OUT_OF_RANGE = {
768
    .key = ILLEGAL_REQUEST, .asc = 0x21, .ascq = 0x00
769
};
770

    
771
/* Illegal request, Invalid field in CDB */
772
const struct SCSISense sense_code_INVALID_FIELD = {
773
    .key = ILLEGAL_REQUEST, .asc = 0x24, .ascq = 0x00
774
};
775

    
776
/* Illegal request, LUN not supported */
777
const struct SCSISense sense_code_LUN_NOT_SUPPORTED = {
778
    .key = ILLEGAL_REQUEST, .asc = 0x25, .ascq = 0x00
779
};
780

    
781
/* Illegal request, Saving parameters not supported */
782
const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED = {
783
    .key = ILLEGAL_REQUEST, .asc = 0x39, .ascq = 0x00
784
};
785

    
786
/* Illegal request, Incompatible medium installed */
787
const struct SCSISense sense_code_INCOMPATIBLE_MEDIUM = {
788
    .key = ILLEGAL_REQUEST, .asc = 0x30, .ascq = 0x00
789
};
790

    
791
/* Command aborted, I/O process terminated */
792
const struct SCSISense sense_code_IO_ERROR = {
793
    .key = ABORTED_COMMAND, .asc = 0x00, .ascq = 0x06
794
};
795

    
796
/* Command aborted, I_T Nexus loss occurred */
797
const struct SCSISense sense_code_I_T_NEXUS_LOSS = {
798
    .key = ABORTED_COMMAND, .asc = 0x29, .ascq = 0x07
799
};
800

    
801
/* Command aborted, Logical Unit failure */
802
const struct SCSISense sense_code_LUN_FAILURE = {
803
    .key = ABORTED_COMMAND, .asc = 0x3e, .ascq = 0x01
804
};
805

    
806
/* Unit attention, Power on, reset or bus device reset occurred */
807
const struct SCSISense sense_code_RESET = {
808
    .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x00
809
};
810

    
811
/* Unit attention, Medium may have changed */
812
const struct SCSISense sense_code_MEDIUM_CHANGED = {
813
    .key = UNIT_ATTENTION, .asc = 0x28, .ascq = 0x00
814
};
815

    
816
/* Unit attention, Reported LUNs data has changed */
817
const struct SCSISense sense_code_REPORTED_LUNS_CHANGED = {
818
    .key = UNIT_ATTENTION, .asc = 0x3f, .ascq = 0x0e
819
};
820

    
821
/* Unit attention, Device internal reset */
822
const struct SCSISense sense_code_DEVICE_INTERNAL_RESET = {
823
    .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x04
824
};
825

    
826
/*
827
 * scsi_build_sense
828
 *
829
 * Convert between fixed and descriptor sense buffers
830
 */
831
int scsi_build_sense(uint8_t *in_buf, int in_len,
832
                     uint8_t *buf, int len, bool fixed)
833
{
834
    bool fixed_in;
835
    SCSISense sense;
836
    if (!fixed && len < 8) {
837
        return 0;
838
    }
839

    
840
    if (in_len == 0) {
841
        sense.key = NO_SENSE;
842
        sense.asc = 0;
843
        sense.ascq = 0;
844
    } else {
845
        fixed_in = (in_buf[0] & 2) == 0;
846

    
847
        if (fixed == fixed_in) {
848
            memcpy(buf, in_buf, MIN(len, in_len));
849
            return MIN(len, in_len);
850
        }
851

    
852
        if (fixed_in) {
853
            sense.key = in_buf[2];
854
            sense.asc = in_buf[12];
855
            sense.ascq = in_buf[13];
856
        } else {
857
            sense.key = in_buf[1];
858
            sense.asc = in_buf[2];
859
            sense.ascq = in_buf[3];
860
        }
861
    }
862

    
863
    memset(buf, 0, len);
864
    if (fixed) {
865
        /* Return fixed format sense buffer */
866
        buf[0] = 0xf0;
867
        buf[2] = sense.key;
868
        buf[7] = 7;
869
        buf[12] = sense.asc;
870
        buf[13] = sense.ascq;
871
        return MIN(len, 18);
872
    } else {
873
        /* Return descriptor format sense buffer */
874
        buf[0] = 0x72;
875
        buf[1] = sense.key;
876
        buf[2] = sense.asc;
877
        buf[3] = sense.ascq;
878
        return 8;
879
    }
880
}
881

    
882
static const char *scsi_command_name(uint8_t cmd)
883
{
884
    static const char *names[] = {
885
        [ TEST_UNIT_READY          ] = "TEST_UNIT_READY",
886
        [ REWIND                   ] = "REWIND",
887
        [ REQUEST_SENSE            ] = "REQUEST_SENSE",
888
        [ FORMAT_UNIT              ] = "FORMAT_UNIT",
889
        [ READ_BLOCK_LIMITS        ] = "READ_BLOCK_LIMITS",
890
        [ REASSIGN_BLOCKS          ] = "REASSIGN_BLOCKS",
891
        [ READ_6                   ] = "READ_6",
892
        [ WRITE_6                  ] = "WRITE_6",
893
        [ SEEK_6                   ] = "SEEK_6",
894
        [ READ_REVERSE             ] = "READ_REVERSE",
895
        [ WRITE_FILEMARKS          ] = "WRITE_FILEMARKS",
896
        [ SPACE                    ] = "SPACE",
897
        [ INQUIRY                  ] = "INQUIRY",
898
        [ RECOVER_BUFFERED_DATA    ] = "RECOVER_BUFFERED_DATA",
899
        [ MAINTENANCE_IN           ] = "MAINTENANCE_IN",
900
        [ MAINTENANCE_OUT          ] = "MAINTENANCE_OUT",
901
        [ MODE_SELECT              ] = "MODE_SELECT",
902
        [ RESERVE                  ] = "RESERVE",
903
        [ RELEASE                  ] = "RELEASE",
904
        [ COPY                     ] = "COPY",
905
        [ ERASE                    ] = "ERASE",
906
        [ MODE_SENSE               ] = "MODE_SENSE",
907
        [ START_STOP               ] = "START_STOP",
908
        [ RECEIVE_DIAGNOSTIC       ] = "RECEIVE_DIAGNOSTIC",
909
        [ SEND_DIAGNOSTIC          ] = "SEND_DIAGNOSTIC",
910
        [ ALLOW_MEDIUM_REMOVAL     ] = "ALLOW_MEDIUM_REMOVAL",
911
        [ READ_CAPACITY_10         ] = "READ_CAPACITY_10",
912
        [ READ_10                  ] = "READ_10",
913
        [ WRITE_10                 ] = "WRITE_10",
914
        [ SEEK_10                  ] = "SEEK_10",
915
        [ WRITE_VERIFY_10          ] = "WRITE_VERIFY_10",
916
        [ VERIFY_10                ] = "VERIFY_10",
917
        [ SEARCH_HIGH              ] = "SEARCH_HIGH",
918
        [ SEARCH_EQUAL             ] = "SEARCH_EQUAL",
919
        [ SEARCH_LOW               ] = "SEARCH_LOW",
920
        [ SET_LIMITS               ] = "SET_LIMITS",
921
        [ PRE_FETCH                ] = "PRE_FETCH",
922
        /* READ_POSITION and PRE_FETCH use the same operation code */
923
        [ SYNCHRONIZE_CACHE        ] = "SYNCHRONIZE_CACHE",
924
        [ LOCK_UNLOCK_CACHE        ] = "LOCK_UNLOCK_CACHE",
925
        [ READ_DEFECT_DATA         ] = "READ_DEFECT_DATA",
926
        [ MEDIUM_SCAN              ] = "MEDIUM_SCAN",
927
        [ COMPARE                  ] = "COMPARE",
928
        [ COPY_VERIFY              ] = "COPY_VERIFY",
929
        [ WRITE_BUFFER             ] = "WRITE_BUFFER",
930
        [ READ_BUFFER              ] = "READ_BUFFER",
931
        [ UPDATE_BLOCK             ] = "UPDATE_BLOCK",
932
        [ READ_LONG_10             ] = "READ_LONG_10",
933
        [ WRITE_LONG_10            ] = "WRITE_LONG_10",
934
        [ CHANGE_DEFINITION        ] = "CHANGE_DEFINITION",
935
        [ WRITE_SAME_10            ] = "WRITE_SAME_10",
936
        [ UNMAP                    ] = "UNMAP",
937
        [ READ_TOC                 ] = "READ_TOC",
938
        [ REPORT_DENSITY_SUPPORT   ] = "REPORT_DENSITY_SUPPORT",
939
        [ GET_CONFIGURATION        ] = "GET_CONFIGURATION",
940
        [ LOG_SELECT               ] = "LOG_SELECT",
941
        [ LOG_SENSE                ] = "LOG_SENSE",
942
        [ MODE_SELECT_10           ] = "MODE_SELECT_10",
943
        [ RESERVE_10               ] = "RESERVE_10",
944
        [ RELEASE_10               ] = "RELEASE_10",
945
        [ MODE_SENSE_10            ] = "MODE_SENSE_10",
946
        [ PERSISTENT_RESERVE_IN    ] = "PERSISTENT_RESERVE_IN",
947
        [ PERSISTENT_RESERVE_OUT   ] = "PERSISTENT_RESERVE_OUT",
948
        [ WRITE_FILEMARKS_16       ] = "WRITE_FILEMARKS_16",
949
        [ EXTENDED_COPY            ] = "EXTENDED_COPY",
950
        [ ATA_PASSTHROUGH          ] = "ATA_PASSTHROUGH",
951
        [ ACCESS_CONTROL_IN        ] = "ACCESS_CONTROL_IN",
952
        [ ACCESS_CONTROL_OUT       ] = "ACCESS_CONTROL_OUT",
953
        [ READ_16                  ] = "READ_16",
954
        [ COMPARE_AND_WRITE        ] = "COMPARE_AND_WRITE",
955
        [ WRITE_16                 ] = "WRITE_16",
956
        [ WRITE_VERIFY_16          ] = "WRITE_VERIFY_16",
957
        [ VERIFY_16                ] = "VERIFY_16",
958
        [ SYNCHRONIZE_CACHE_16     ] = "SYNCHRONIZE_CACHE_16",
959
        [ LOCATE_16                ] = "LOCATE_16",
960
        [ WRITE_SAME_16            ] = "WRITE_SAME_16",
961
        [ ERASE_16                 ] = "ERASE_16",
962
        [ SERVICE_ACTION_IN        ] = "SERVICE_ACTION_IN",
963
        [ WRITE_LONG_16            ] = "WRITE_LONG_16",
964
        [ REPORT_LUNS              ] = "REPORT_LUNS",
965
        [ BLANK                    ] = "BLANK",
966
        [ MAINTENANCE_IN           ] = "MAINTENANCE_IN",
967
        [ MAINTENANCE_OUT          ] = "MAINTENANCE_OUT",
968
        [ MOVE_MEDIUM              ] = "MOVE_MEDIUM",
969
        [ LOAD_UNLOAD              ] = "LOAD_UNLOAD",
970
        [ READ_12                  ] = "READ_12",
971
        [ WRITE_12                 ] = "WRITE_12",
972
        [ WRITE_VERIFY_12          ] = "WRITE_VERIFY_12",
973
        [ VERIFY_12                ] = "VERIFY_12",
974
        [ SEARCH_HIGH_12           ] = "SEARCH_HIGH_12",
975
        [ SEARCH_EQUAL_12          ] = "SEARCH_EQUAL_12",
976
        [ SEARCH_LOW_12            ] = "SEARCH_LOW_12",
977
        [ READ_ELEMENT_STATUS      ] = "READ_ELEMENT_STATUS",
978
        [ SEND_VOLUME_TAG          ] = "SEND_VOLUME_TAG",
979
        [ READ_DEFECT_DATA_12      ] = "READ_DEFECT_DATA_12",
980
        [ SET_CD_SPEED             ] = "SET_CD_SPEED",
981
    };
982

    
983
    if (cmd >= ARRAY_SIZE(names) || names[cmd] == NULL)
984
        return "*UNKNOWN*";
985
    return names[cmd];
986
}
987

    
988
SCSIRequest *scsi_req_ref(SCSIRequest *req)
989
{
990
    req->refcount++;
991
    return req;
992
}
993

    
994
void scsi_req_unref(SCSIRequest *req)
995
{
996
    if (--req->refcount == 0) {
997
        if (req->ops->free_req) {
998
            req->ops->free_req(req);
999
        }
1000
        qemu_free(req);
1001
    }
1002
}
1003

    
1004
/* Tell the device that we finished processing this chunk of I/O.  It
1005
   will start the next chunk or complete the command.  */
1006
void scsi_req_continue(SCSIRequest *req)
1007
{
1008
    trace_scsi_req_continue(req->dev->id, req->lun, req->tag);
1009
    if (req->cmd.mode == SCSI_XFER_TO_DEV) {
1010
        req->ops->write_data(req);
1011
    } else {
1012
        req->ops->read_data(req);
1013
    }
1014
}
1015

    
1016
/* Called by the devices when data is ready for the HBA.  The HBA should
1017
   start a DMA operation to read or fill the device's data buffer.
1018
   Once it completes, calling scsi_req_continue will restart I/O.  */
1019
void scsi_req_data(SCSIRequest *req, int len)
1020
{
1021
    trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);
1022
    req->bus->ops->transfer_data(req, len);
1023
}
1024

    
1025
void scsi_req_print(SCSIRequest *req)
1026
{
1027
    FILE *fp = stderr;
1028
    int i;
1029

    
1030
    fprintf(fp, "[%s id=%d] %s",
1031
            req->dev->qdev.parent_bus->name,
1032
            req->dev->id,
1033
            scsi_command_name(req->cmd.buf[0]));
1034
    for (i = 1; i < req->cmd.len; i++) {
1035
        fprintf(fp, " 0x%02x", req->cmd.buf[i]);
1036
    }
1037
    switch (req->cmd.mode) {
1038
    case SCSI_XFER_NONE:
1039
        fprintf(fp, " - none\n");
1040
        break;
1041
    case SCSI_XFER_FROM_DEV:
1042
        fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer);
1043
        break;
1044
    case SCSI_XFER_TO_DEV:
1045
        fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer);
1046
        break;
1047
    default:
1048
        fprintf(fp, " - Oops\n");
1049
        break;
1050
    }
1051
}
1052

    
1053
void scsi_req_complete(SCSIRequest *req, int status)
1054
{
1055
    assert(req->status == -1);
1056
    req->status = status;
1057

    
1058
    assert(req->sense_len < sizeof(req->sense));
1059
    if (status == GOOD) {
1060
        req->sense_len = 0;
1061
    }
1062

    
1063
    if (req->sense_len) {
1064
        memcpy(req->dev->sense, req->sense, req->sense_len);
1065
    }
1066
    req->dev->sense_len = req->sense_len;
1067

    
1068
    /*
1069
     * Unit attention state is now stored in the device's sense buffer
1070
     * if the HBA didn't do autosense.  Clear the pending unit attention
1071
     * flags.
1072
     */
1073
    scsi_clear_unit_attention(req);
1074

    
1075
    scsi_req_ref(req);
1076
    scsi_req_dequeue(req);
1077
    req->bus->ops->complete(req, req->status);
1078
    scsi_req_unref(req);
1079
}
1080

    
1081
void scsi_req_cancel(SCSIRequest *req)
1082
{
1083
    if (req->ops->cancel_io) {
1084
        req->ops->cancel_io(req);
1085
    }
1086
    scsi_req_ref(req);
1087
    scsi_req_dequeue(req);
1088
    if (req->bus->ops->cancel) {
1089
        req->bus->ops->cancel(req);
1090
    }
1091
    scsi_req_unref(req);
1092
}
1093

    
1094
void scsi_req_abort(SCSIRequest *req, int status)
1095
{
1096
    if (req->ops->cancel_io) {
1097
        req->ops->cancel_io(req);
1098
    }
1099
    scsi_req_complete(req, status);
1100
}
1101

    
1102
void scsi_device_purge_requests(SCSIDevice *sdev)
1103
{
1104
    SCSIRequest *req;
1105

    
1106
    while (!QTAILQ_EMPTY(&sdev->requests)) {
1107
        req = QTAILQ_FIRST(&sdev->requests);
1108
        scsi_req_cancel(req);
1109
    }
1110
}
1111

    
1112
static char *scsibus_get_fw_dev_path(DeviceState *dev)
1113
{
1114
    SCSIDevice *d = DO_UPCAST(SCSIDevice, qdev, dev);
1115
    SCSIBus *bus = scsi_bus_from_device(d);
1116
    char path[100];
1117
    int i;
1118

    
1119
    for (i = 0; i < bus->ndev; i++) {
1120
        if (bus->devs[i] == d) {
1121
            break;
1122
        }
1123
    }
1124

    
1125
    assert(i != bus->ndev);
1126

    
1127
    snprintf(path, sizeof(path), "%s@%x", qdev_fw_name(dev), i);
1128

    
1129
    return strdup(path);
1130
}