Statistics
| Branch: | Revision:

root / hw / scsi-bus.c @ f48a7a6e

History | View | Annotate | Download (33.1 kB)

1
#include "hw.h"
2
#include "qemu-error.h"
3
#include "scsi.h"
4
#include "scsi-defs.h"
5
#include "qdev.h"
6
#include "blockdev.h"
7
#include "trace.h"
8

    
9
static char *scsibus_get_fw_dev_path(DeviceState *dev);
10
static int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf);
11
static int scsi_build_sense(uint8_t *in_buf, int in_len,
12
                            uint8_t *buf, int len, bool fixed);
13

    
14
static struct BusInfo scsi_bus_info = {
15
    .name  = "SCSI",
16
    .size  = sizeof(SCSIBus),
17
    .get_fw_dev_path = scsibus_get_fw_dev_path,
18
    .props = (Property[]) {
19
        DEFINE_PROP_UINT32("scsi-id", SCSIDevice, id, -1),
20
        DEFINE_PROP_UINT32("lun", SCSIDevice, lun, 0),
21
        DEFINE_PROP_END_OF_LIST(),
22
    },
23
};
24
static int next_scsi_bus;
25

    
26
/* Create a scsi bus, and attach devices to it.  */
27
void scsi_bus_new(SCSIBus *bus, DeviceState *host, const SCSIBusInfo *info)
28
{
29
    qbus_create_inplace(&bus->qbus, &scsi_bus_info, host, NULL);
30
    bus->busnr = next_scsi_bus++;
31
    bus->info = info;
32
    bus->qbus.allow_hotplug = 1;
33
}
34

    
35
static int scsi_qdev_init(DeviceState *qdev, DeviceInfo *base)
36
{
37
    SCSIDevice *dev = DO_UPCAST(SCSIDevice, qdev, qdev);
38
    SCSIDeviceInfo *info = DO_UPCAST(SCSIDeviceInfo, qdev, base);
39
    SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, dev->qdev.parent_bus);
40
    SCSIDevice *olddev;
41
    int rc = -1;
42

    
43
    if (dev->id == -1) {
44
        int id;
45
        for (id = 0; id < bus->info->ndev; id++) {
46
            if (!scsi_device_find(bus, id, 0)) {
47
                dev->id = id;
48
                break;
49
            }
50
        }
51
    }
52
    if (dev->id >= bus->info->ndev) {
53
        error_report("bad scsi device id: %d", dev->id);
54
        goto err;
55
    }
56

    
57
    olddev = scsi_device_find(bus, dev->id, dev->lun);
58
    if (olddev && dev->lun == olddev->lun) {
59
        qdev_free(&olddev->qdev);
60
    }
61

    
62
    dev->info = info;
63
    QTAILQ_INIT(&dev->requests);
64
    rc = dev->info->init(dev);
65

    
66
err:
67
    return rc;
68
}
69

    
70
static int scsi_qdev_exit(DeviceState *qdev)
71
{
72
    SCSIDevice *dev = DO_UPCAST(SCSIDevice, qdev, qdev);
73

    
74
    if (dev->info->destroy) {
75
        dev->info->destroy(dev);
76
    }
77
    return 0;
78
}
79

    
80
void scsi_qdev_register(SCSIDeviceInfo *info)
81
{
82
    info->qdev.bus_info = &scsi_bus_info;
83
    info->qdev.init     = scsi_qdev_init;
84
    info->qdev.unplug   = qdev_simple_unplug_cb;
85
    info->qdev.exit     = scsi_qdev_exit;
86
    qdev_register(&info->qdev);
87
}
88

    
89
/* handle legacy '-drive if=scsi,...' cmd line args */
90
SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,
91
                                      int unit, bool removable)
92
{
93
    const char *driver;
94
    DeviceState *dev;
95

    
96
    driver = bdrv_is_sg(bdrv) ? "scsi-generic" : "scsi-disk";
97
    dev = qdev_create(&bus->qbus, driver);
98
    qdev_prop_set_uint32(dev, "scsi-id", unit);
99
    if (qdev_prop_exists(dev, "removable")) {
100
        qdev_prop_set_bit(dev, "removable", removable);
101
    }
102
    if (qdev_prop_set_drive(dev, "drive", bdrv) < 0) {
103
        qdev_free(dev);
104
        return NULL;
105
    }
106
    if (qdev_init(dev) < 0)
107
        return NULL;
108
    return DO_UPCAST(SCSIDevice, qdev, dev);
109
}
110

    
111
int scsi_bus_legacy_handle_cmdline(SCSIBus *bus)
112
{
113
    Location loc;
114
    DriveInfo *dinfo;
115
    int res = 0, unit;
116

    
117
    loc_push_none(&loc);
118
    for (unit = 0; unit < bus->info->ndev; unit++) {
119
        dinfo = drive_get(IF_SCSI, bus->busnr, unit);
120
        if (dinfo == NULL) {
121
            continue;
122
        }
123
        qemu_opts_loc_restore(dinfo->opts);
124
        if (!scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit, false)) {
125
            res = -1;
126
            break;
127
        }
128
    }
129
    loc_pop(&loc);
130
    return res;
131
}
132

    
133
/* SCSIReqOps implementation for invalid commands.  */
134

    
135
static int32_t scsi_invalid_command(SCSIRequest *req, uint8_t *buf)
136
{
137
    scsi_req_build_sense(req, SENSE_CODE(INVALID_OPCODE));
138
    scsi_req_complete(req, CHECK_CONDITION);
139
    return 0;
140
}
141

    
142
struct SCSIReqOps reqops_invalid_opcode = {
143
    .size         = sizeof(SCSIRequest),
144
    .send_command = scsi_invalid_command
145
};
146

    
147
/* SCSIReqOps implementation for unit attention conditions.  */
148

    
149
static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
150
{
151
    if (req->dev && req->dev->unit_attention.key == UNIT_ATTENTION) {
152
        scsi_req_build_sense(req, req->dev->unit_attention);
153
    } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
154
        scsi_req_build_sense(req, req->bus->unit_attention);
155
    }
156
    scsi_req_complete(req, CHECK_CONDITION);
157
    return 0;
158
}
159

    
160
struct SCSIReqOps reqops_unit_attention = {
161
    .size         = sizeof(SCSIRequest),
162
    .send_command = scsi_unit_attention
163
};
164

    
165
/* SCSIReqOps implementation for REPORT LUNS and for commands sent to
166
   an invalid LUN.  */
167

    
168
typedef struct SCSITargetReq SCSITargetReq;
169

    
170
struct SCSITargetReq {
171
    SCSIRequest req;
172
    int len;
173
    uint8_t buf[64];
174
};
175

    
176
static void store_lun(uint8_t *outbuf, int lun)
177
{
178
    if (lun < 256) {
179
        outbuf[1] = lun;
180
        return;
181
    }
182
    outbuf[1] = (lun & 255);
183
    outbuf[0] = (lun >> 8) | 0x40;
184
}
185

    
186
static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
187
{
188
    int len;
189
    if (r->req.cmd.xfer < 16) {
190
        return false;
191
    }
192
    if (r->req.cmd.buf[2] > 2) {
193
        return false;
194
    }
195
    len = MIN(sizeof r->buf, r->req.cmd.xfer);
196
    memset(r->buf, 0, len);
197
    if (r->req.dev->lun != 0) {
198
        r->buf[3] = 16;
199
        r->len = 24;
200
        store_lun(&r->buf[16], r->req.dev->lun);
201
    } else {
202
        r->buf[3] = 8;
203
        r->len = 16;
204
    }
205
    return true;
206
}
207

    
208
static bool scsi_target_emulate_inquiry(SCSITargetReq *r)
209
{
210
    assert(r->req.dev->lun != r->req.lun);
211
    if (r->req.cmd.buf[1] & 0x2) {
212
        /* Command support data - optional, not implemented */
213
        return false;
214
    }
215

    
216
    if (r->req.cmd.buf[1] & 0x1) {
217
        /* Vital product data */
218
        uint8_t page_code = r->req.cmd.buf[2];
219
        if (r->req.cmd.xfer < 4) {
220
            return false;
221
        }
222

    
223
        r->buf[r->len++] = page_code ; /* this page */
224
        r->buf[r->len++] = 0x00;
225

    
226
        switch (page_code) {
227
        case 0x00: /* Supported page codes, mandatory */
228
        {
229
            int pages;
230
            pages = r->len++;
231
            r->buf[r->len++] = 0x00; /* list of supported pages (this page) */
232
            r->buf[pages] = r->len - pages - 1; /* number of pages */
233
            break;
234
        }
235
        default:
236
            return false;
237
        }
238
        /* done with EVPD */
239
        assert(r->len < sizeof(r->buf));
240
        r->len = MIN(r->req.cmd.xfer, r->len);
241
        return true;
242
    }
243

    
244
    /* Standard INQUIRY data */
245
    if (r->req.cmd.buf[2] != 0) {
246
        return false;
247
    }
248

    
249
    /* PAGE CODE == 0 */
250
    if (r->req.cmd.xfer < 5) {
251
        return -1;
252
    }
253

    
254
    r->len = MIN(r->req.cmd.xfer, 36);
255
    memset(r->buf, 0, r->len);
256
    if (r->req.lun != 0) {
257
        r->buf[0] = TYPE_NO_LUN;
258
    } else {
259
        r->buf[0] = TYPE_NOT_PRESENT | TYPE_INACTIVE;
260
        r->buf[2] = 5; /* Version */
261
        r->buf[3] = 2 | 0x10; /* HiSup, response data format */
262
        r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */
263
        r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ.  */
264
        memcpy(&r->buf[8], "QEMU    ", 8);
265
        memcpy(&r->buf[16], "QEMU TARGET     ", 16);
266
        strncpy((char *) &r->buf[32], QEMU_VERSION, 4);
267
    }
268
    return true;
269
}
270

    
271
static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf)
272
{
273
    SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
274

    
275
    switch (buf[0]) {
276
    case REPORT_LUNS:
277
        if (!scsi_target_emulate_report_luns(r)) {
278
            goto illegal_request;
279
        }
280
        break;
281
    case INQUIRY:
282
        if (!scsi_target_emulate_inquiry(r)) {
283
            goto illegal_request;
284
        }
285
        break;
286
    case REQUEST_SENSE:
287
        if (req->cmd.xfer < 4) {
288
            goto illegal_request;
289
        }
290
        r->len = scsi_device_get_sense(r->req.dev, r->buf,
291
                                       MIN(req->cmd.xfer, sizeof r->buf),
292
                                       (req->cmd.buf[1] & 1) == 0);
293
        if (r->req.dev->sense_is_ua) {
294
            if (r->req.dev->info->unit_attention_reported) {
295
                r->req.dev->info->unit_attention_reported(req->dev);
296
            }
297
            r->req.dev->sense_len = 0;
298
            r->req.dev->sense_is_ua = false;
299
        }
300
        break;
301
    default:
302
        scsi_req_build_sense(req, SENSE_CODE(LUN_NOT_SUPPORTED));
303
        scsi_req_complete(req, CHECK_CONDITION);
304
        return 0;
305
    illegal_request:
306
        scsi_req_build_sense(req, SENSE_CODE(INVALID_FIELD));
307
        scsi_req_complete(req, CHECK_CONDITION);
308
        return 0;
309
    }
310

    
311
    if (!r->len) {
312
        scsi_req_complete(req, GOOD);
313
    }
314
    return r->len;
315
}
316

    
317
static void scsi_target_read_data(SCSIRequest *req)
318
{
319
    SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
320
    uint32_t n;
321

    
322
    n = r->len;
323
    if (n > 0) {
324
        r->len = 0;
325
        scsi_req_data(&r->req, n);
326
    } else {
327
        scsi_req_complete(&r->req, GOOD);
328
    }
329
}
330

    
331
static uint8_t *scsi_target_get_buf(SCSIRequest *req)
332
{
333
    SCSITargetReq *r = DO_UPCAST(SCSITargetReq, req, req);
334

    
335
    return r->buf;
336
}
337

    
338
struct SCSIReqOps reqops_target_command = {
339
    .size         = sizeof(SCSITargetReq),
340
    .send_command = scsi_target_send_command,
341
    .read_data    = scsi_target_read_data,
342
    .get_buf      = scsi_target_get_buf,
343
};
344

    
345

    
346
SCSIRequest *scsi_req_alloc(SCSIReqOps *reqops, SCSIDevice *d, uint32_t tag,
347
                            uint32_t lun, void *hba_private)
348
{
349
    SCSIRequest *req;
350

    
351
    req = g_malloc0(reqops->size);
352
    req->refcount = 1;
353
    req->bus = scsi_bus_from_device(d);
354
    req->dev = d;
355
    req->tag = tag;
356
    req->lun = lun;
357
    req->hba_private = hba_private;
358
    req->status = -1;
359
    req->sense_len = 0;
360
    req->ops = reqops;
361
    trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
362
    return req;
363
}
364

    
365
SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,
366
                          uint8_t *buf, void *hba_private)
367
{
368
    SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, d->qdev.parent_bus);
369
    SCSIRequest *req;
370
    SCSICommand cmd;
371

    
372
    if (scsi_req_parse(&cmd, d, buf) != 0) {
373
        trace_scsi_req_parse_bad(d->id, lun, tag, buf[0]);
374
        req = scsi_req_alloc(&reqops_invalid_opcode, d, tag, lun, hba_private);
375
    } else {
376
        trace_scsi_req_parsed(d->id, lun, tag, buf[0],
377
                              cmd.mode, cmd.xfer);
378
        if (cmd.lba != -1) {
379
            trace_scsi_req_parsed_lba(d->id, lun, tag, buf[0],
380
                                      cmd.lba);
381
        }
382

    
383
        if ((d->unit_attention.key == UNIT_ATTENTION ||
384
             bus->unit_attention.key == UNIT_ATTENTION) &&
385
            (buf[0] != INQUIRY &&
386
             buf[0] != REPORT_LUNS &&
387
             buf[0] != GET_CONFIGURATION &&
388
             buf[0] != GET_EVENT_STATUS_NOTIFICATION &&
389

    
390
             /*
391
              * If we already have a pending unit attention condition,
392
              * report this one before triggering another one.
393
              */
394
             !(buf[0] == REQUEST_SENSE && d->sense_is_ua))) {
395
            req = scsi_req_alloc(&reqops_unit_attention, d, tag, lun,
396
                                 hba_private);
397
        } else if (lun != d->lun ||
398
            buf[0] == REPORT_LUNS ||
399
            buf[0] == REQUEST_SENSE) {
400
            req = scsi_req_alloc(&reqops_target_command, d, tag, lun,
401
                                 hba_private);
402
        } else {
403
            req = d->info->alloc_req(d, tag, lun, hba_private);
404
        }
405
    }
406

    
407
    req->cmd = cmd;
408
    switch (buf[0]) {
409
    case INQUIRY:
410
        trace_scsi_inquiry(d->id, lun, tag, cmd.buf[1], cmd.buf[2]);
411
        break;
412
    case TEST_UNIT_READY:
413
        trace_scsi_test_unit_ready(d->id, lun, tag);
414
        break;
415
    case REPORT_LUNS:
416
        trace_scsi_report_luns(d->id, lun, tag);
417
        break;
418
    case REQUEST_SENSE:
419
        trace_scsi_request_sense(d->id, lun, tag);
420
        break;
421
    default:
422
        break;
423
    }
424

    
425
    return req;
426
}
427

    
428
uint8_t *scsi_req_get_buf(SCSIRequest *req)
429
{
430
    return req->ops->get_buf(req);
431
}
432

    
433
static void scsi_clear_unit_attention(SCSIRequest *req)
434
{
435
    SCSISense *ua;
436
    if (req->dev->unit_attention.key != UNIT_ATTENTION &&
437
        req->bus->unit_attention.key != UNIT_ATTENTION) {
438
        return;
439
    }
440

    
441
    /*
442
     * If an INQUIRY command enters the enabled command state,
443
     * the device server shall [not] clear any unit attention condition;
444
     * See also MMC-6, paragraphs 6.5 and 6.6.2.
445
     */
446
    if (req->cmd.buf[0] == INQUIRY ||
447
        req->cmd.buf[0] == GET_CONFIGURATION ||
448
        req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) {
449
        return;
450
    }
451

    
452
    if (req->dev->unit_attention.key == UNIT_ATTENTION) {
453
        ua = &req->dev->unit_attention;
454
    } else {
455
        ua = &req->bus->unit_attention;
456
    }
457

    
458
    /*
459
     * If a REPORT LUNS command enters the enabled command state, [...]
460
     * the device server shall clear any pending unit attention condition
461
     * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
462
     */
463
    if (req->cmd.buf[0] == REPORT_LUNS &&
464
        !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
465
          ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) {
466
        return;
467
    }
468

    
469
    *ua = SENSE_CODE(NO_SENSE);
470
}
471

    
472
int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len)
473
{
474
    int ret;
475

    
476
    assert(len >= 14);
477
    if (!req->sense_len) {
478
        return 0;
479
    }
480

    
481
    ret = scsi_build_sense(req->sense, req->sense_len, buf, len, true);
482

    
483
    /*
484
     * FIXME: clearing unit attention conditions upon autosense should be done
485
     * only if the UA_INTLCK_CTRL field in the Control mode page is set to 00b
486
     * (SAM-5, 5.14).
487
     *
488
     * We assume UA_INTLCK_CTRL to be 00b for HBAs that support autosense, and
489
     * 10b for HBAs that do not support it (do not call scsi_req_get_sense).
490
     * Here we handle unit attention clearing for UA_INTLCK_CTRL == 00b.
491
     */
492
    if (req->dev->sense_is_ua) {
493
        if (req->dev->info->unit_attention_reported) {
494
            req->dev->info->unit_attention_reported(req->dev);
495
        }
496
        req->dev->sense_len = 0;
497
        req->dev->sense_is_ua = false;
498
    }
499
    return ret;
500
}
501

    
502
int scsi_device_get_sense(SCSIDevice *dev, uint8_t *buf, int len, bool fixed)
503
{
504
    return scsi_build_sense(dev->sense, dev->sense_len, buf, len, fixed);
505
}
506

    
507
void scsi_req_build_sense(SCSIRequest *req, SCSISense sense)
508
{
509
    trace_scsi_req_build_sense(req->dev->id, req->lun, req->tag,
510
                               sense.key, sense.asc, sense.ascq);
511
    memset(req->sense, 0, 18);
512
    req->sense[0] = 0xf0;
513
    req->sense[2] = sense.key;
514
    req->sense[7] = 10;
515
    req->sense[12] = sense.asc;
516
    req->sense[13] = sense.ascq;
517
    req->sense_len = 18;
518
}
519

    
520
int32_t scsi_req_enqueue(SCSIRequest *req)
521
{
522
    int32_t rc;
523

    
524
    assert(!req->enqueued);
525
    scsi_req_ref(req);
526
    req->enqueued = true;
527
    QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
528

    
529
    scsi_req_ref(req);
530
    rc = req->ops->send_command(req, req->cmd.buf);
531
    scsi_req_unref(req);
532
    return rc;
533
}
534

    
535
static void scsi_req_dequeue(SCSIRequest *req)
536
{
537
    trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
538
    if (req->enqueued) {
539
        QTAILQ_REMOVE(&req->dev->requests, req, next);
540
        req->enqueued = false;
541
        scsi_req_unref(req);
542
    }
543
}
544

    
545
static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
546
{
547
    switch (buf[0] >> 5) {
548
    case 0:
549
        cmd->xfer = buf[4];
550
        cmd->len = 6;
551
        /* length 0 means 256 blocks */
552
        if (cmd->xfer == 0) {
553
            cmd->xfer = 256;
554
        }
555
        break;
556
    case 1:
557
    case 2:
558
        cmd->xfer = lduw_be_p(&buf[7]);
559
        cmd->len = 10;
560
        break;
561
    case 4:
562
        cmd->xfer = ldl_be_p(&buf[10]);
563
        cmd->len = 16;
564
        break;
565
    case 5:
566
        cmd->xfer = ldl_be_p(&buf[6]);
567
        cmd->len = 12;
568
        break;
569
    default:
570
        return -1;
571
    }
572

    
573
    switch (buf[0]) {
574
    case TEST_UNIT_READY:
575
    case REWIND:
576
    case START_STOP:
577
    case SEEK_6:
578
    case WRITE_FILEMARKS:
579
    case SPACE:
580
    case RESERVE:
581
    case RELEASE:
582
    case ERASE:
583
    case ALLOW_MEDIUM_REMOVAL:
584
    case VERIFY_10:
585
    case SEEK_10:
586
    case SYNCHRONIZE_CACHE:
587
    case LOCK_UNLOCK_CACHE:
588
    case LOAD_UNLOAD:
589
    case SET_CD_SPEED:
590
    case SET_LIMITS:
591
    case WRITE_LONG_10:
592
    case MOVE_MEDIUM:
593
    case UPDATE_BLOCK:
594
        cmd->xfer = 0;
595
        break;
596
    case MODE_SENSE:
597
        break;
598
    case WRITE_SAME_10:
599
        cmd->xfer = 1;
600
        break;
601
    case READ_CAPACITY_10:
602
        cmd->xfer = 8;
603
        break;
604
    case READ_BLOCK_LIMITS:
605
        cmd->xfer = 6;
606
        break;
607
    case READ_POSITION:
608
        cmd->xfer = 20;
609
        break;
610
    case SEND_VOLUME_TAG:
611
        cmd->xfer *= 40;
612
        break;
613
    case MEDIUM_SCAN:
614
        cmd->xfer *= 8;
615
        break;
616
    case WRITE_10:
617
    case WRITE_VERIFY_10:
618
    case WRITE_6:
619
    case WRITE_12:
620
    case WRITE_VERIFY_12:
621
    case WRITE_16:
622
    case WRITE_VERIFY_16:
623
        cmd->xfer *= dev->blocksize;
624
        break;
625
    case READ_10:
626
    case READ_6:
627
    case READ_REVERSE:
628
    case RECOVER_BUFFERED_DATA:
629
    case READ_12:
630
    case READ_16:
631
        cmd->xfer *= dev->blocksize;
632
        break;
633
    case INQUIRY:
634
        cmd->xfer = buf[4] | (buf[3] << 8);
635
        break;
636
    case MAINTENANCE_OUT:
637
    case MAINTENANCE_IN:
638
        if (dev->type == TYPE_ROM) {
639
            /* GPCMD_REPORT_KEY and GPCMD_SEND_KEY from multi media commands */
640
            cmd->xfer = buf[9] | (buf[8] << 8);
641
        }
642
        break;
643
    }
644
    return 0;
645
}
646

    
647
static int scsi_req_stream_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
648
{
649
    switch (buf[0]) {
650
    /* stream commands */
651
    case READ_6:
652
    case READ_REVERSE:
653
    case RECOVER_BUFFERED_DATA:
654
    case WRITE_6:
655
        cmd->len = 6;
656
        cmd->xfer = buf[4] | (buf[3] << 8) | (buf[2] << 16);
657
        if (buf[1] & 0x01) { /* fixed */
658
            cmd->xfer *= dev->blocksize;
659
        }
660
        break;
661
    case REWIND:
662
    case START_STOP:
663
        cmd->len = 6;
664
        cmd->xfer = 0;
665
        break;
666
    /* generic commands */
667
    default:
668
        return scsi_req_length(cmd, dev, buf);
669
    }
670
    return 0;
671
}
672

    
673
static void scsi_cmd_xfer_mode(SCSICommand *cmd)
674
{
675
    switch (cmd->buf[0]) {
676
    case WRITE_6:
677
    case WRITE_10:
678
    case WRITE_VERIFY_10:
679
    case WRITE_12:
680
    case WRITE_VERIFY_12:
681
    case WRITE_16:
682
    case WRITE_VERIFY_16:
683
    case COPY:
684
    case COPY_VERIFY:
685
    case COMPARE:
686
    case CHANGE_DEFINITION:
687
    case LOG_SELECT:
688
    case MODE_SELECT:
689
    case MODE_SELECT_10:
690
    case SEND_DIAGNOSTIC:
691
    case WRITE_BUFFER:
692
    case FORMAT_UNIT:
693
    case REASSIGN_BLOCKS:
694
    case SEARCH_EQUAL:
695
    case SEARCH_HIGH:
696
    case SEARCH_LOW:
697
    case UPDATE_BLOCK:
698
    case WRITE_LONG_10:
699
    case WRITE_SAME_10:
700
    case SEARCH_HIGH_12:
701
    case SEARCH_EQUAL_12:
702
    case SEARCH_LOW_12:
703
    case MEDIUM_SCAN:
704
    case SEND_VOLUME_TAG:
705
    case PERSISTENT_RESERVE_OUT:
706
    case MAINTENANCE_OUT:
707
        cmd->mode = SCSI_XFER_TO_DEV;
708
        break;
709
    default:
710
        if (cmd->xfer)
711
            cmd->mode = SCSI_XFER_FROM_DEV;
712
        else {
713
            cmd->mode = SCSI_XFER_NONE;
714
        }
715
        break;
716
    }
717
}
718

    
719
static uint64_t scsi_cmd_lba(SCSICommand *cmd)
720
{
721
    uint8_t *buf = cmd->buf;
722
    uint64_t lba;
723

    
724
    switch (buf[0] >> 5) {
725
    case 0:
726
        lba = ldl_be_p(&buf[0]) & 0x1fffff;
727
        break;
728
    case 1:
729
    case 2:
730
    case 5:
731
        lba = ldl_be_p(&buf[2]);
732
        break;
733
    case 4:
734
        lba = ldq_be_p(&buf[2]);
735
        break;
736
    default:
737
        lba = -1;
738

    
739
    }
740
    return lba;
741
}
742

    
743
int scsi_req_parse(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf)
744
{
745
    int rc;
746

    
747
    if (dev->type == TYPE_TAPE) {
748
        rc = scsi_req_stream_length(cmd, dev, buf);
749
    } else {
750
        rc = scsi_req_length(cmd, dev, buf);
751
    }
752
    if (rc != 0)
753
        return rc;
754

    
755
    memcpy(cmd->buf, buf, cmd->len);
756
    scsi_cmd_xfer_mode(cmd);
757
    cmd->lba = scsi_cmd_lba(cmd);
758
    return 0;
759
}
760

    
761
/*
762
 * Predefined sense codes
763
 */
764

    
765
/* No sense data available */
766
const struct SCSISense sense_code_NO_SENSE = {
767
    .key = NO_SENSE , .asc = 0x00 , .ascq = 0x00
768
};
769

    
770
/* LUN not ready, Manual intervention required */
771
const struct SCSISense sense_code_LUN_NOT_READY = {
772
    .key = NOT_READY, .asc = 0x04, .ascq = 0x03
773
};
774

    
775
/* LUN not ready, Medium not present */
776
const struct SCSISense sense_code_NO_MEDIUM = {
777
    .key = NOT_READY, .asc = 0x3a, .ascq = 0x00
778
};
779

    
780
/* LUN not ready, medium removal prevented */
781
const struct SCSISense sense_code_NOT_READY_REMOVAL_PREVENTED = {
782
    .key = NOT_READY, .asc = 0x53, .ascq = 0x00
783
};
784

    
785
/* Hardware error, internal target failure */
786
const struct SCSISense sense_code_TARGET_FAILURE = {
787
    .key = HARDWARE_ERROR, .asc = 0x44, .ascq = 0x00
788
};
789

    
790
/* Illegal request, invalid command operation code */
791
const struct SCSISense sense_code_INVALID_OPCODE = {
792
    .key = ILLEGAL_REQUEST, .asc = 0x20, .ascq = 0x00
793
};
794

    
795
/* Illegal request, LBA out of range */
796
const struct SCSISense sense_code_LBA_OUT_OF_RANGE = {
797
    .key = ILLEGAL_REQUEST, .asc = 0x21, .ascq = 0x00
798
};
799

    
800
/* Illegal request, Invalid field in CDB */
801
const struct SCSISense sense_code_INVALID_FIELD = {
802
    .key = ILLEGAL_REQUEST, .asc = 0x24, .ascq = 0x00
803
};
804

    
805
/* Illegal request, LUN not supported */
806
const struct SCSISense sense_code_LUN_NOT_SUPPORTED = {
807
    .key = ILLEGAL_REQUEST, .asc = 0x25, .ascq = 0x00
808
};
809

    
810
/* Illegal request, Saving parameters not supported */
811
const struct SCSISense sense_code_SAVING_PARAMS_NOT_SUPPORTED = {
812
    .key = ILLEGAL_REQUEST, .asc = 0x39, .ascq = 0x00
813
};
814

    
815
/* Illegal request, Incompatible medium installed */
816
const struct SCSISense sense_code_INCOMPATIBLE_FORMAT = {
817
    .key = ILLEGAL_REQUEST, .asc = 0x30, .ascq = 0x00
818
};
819

    
820
/* Illegal request, medium removal prevented */
821
const struct SCSISense sense_code_ILLEGAL_REQ_REMOVAL_PREVENTED = {
822
    .key = ILLEGAL_REQUEST, .asc = 0x53, .ascq = 0x00
823
};
824

    
825
/* Command aborted, I/O process terminated */
826
const struct SCSISense sense_code_IO_ERROR = {
827
    .key = ABORTED_COMMAND, .asc = 0x00, .ascq = 0x06
828
};
829

    
830
/* Command aborted, I_T Nexus loss occurred */
831
const struct SCSISense sense_code_I_T_NEXUS_LOSS = {
832
    .key = ABORTED_COMMAND, .asc = 0x29, .ascq = 0x07
833
};
834

    
835
/* Command aborted, Logical Unit failure */
836
const struct SCSISense sense_code_LUN_FAILURE = {
837
    .key = ABORTED_COMMAND, .asc = 0x3e, .ascq = 0x01
838
};
839

    
840
/* Unit attention, Power on, reset or bus device reset occurred */
841
const struct SCSISense sense_code_RESET = {
842
    .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x00
843
};
844

    
845
/* Unit attention, No medium */
846
const struct SCSISense sense_code_UNIT_ATTENTION_NO_MEDIUM = {
847
    .key = UNIT_ATTENTION, .asc = 0x3a, .ascq = 0x00
848
};
849

    
850
/* Unit attention, Medium may have changed */
851
const struct SCSISense sense_code_MEDIUM_CHANGED = {
852
    .key = UNIT_ATTENTION, .asc = 0x28, .ascq = 0x00
853
};
854

    
855
/* Unit attention, Reported LUNs data has changed */
856
const struct SCSISense sense_code_REPORTED_LUNS_CHANGED = {
857
    .key = UNIT_ATTENTION, .asc = 0x3f, .ascq = 0x0e
858
};
859

    
860
/* Unit attention, Device internal reset */
861
const struct SCSISense sense_code_DEVICE_INTERNAL_RESET = {
862
    .key = UNIT_ATTENTION, .asc = 0x29, .ascq = 0x04
863
};
864

    
865
/*
866
 * scsi_build_sense
867
 *
868
 * Convert between fixed and descriptor sense buffers
869
 */
870
int scsi_build_sense(uint8_t *in_buf, int in_len,
871
                     uint8_t *buf, int len, bool fixed)
872
{
873
    bool fixed_in;
874
    SCSISense sense;
875
    if (!fixed && len < 8) {
876
        return 0;
877
    }
878

    
879
    if (in_len == 0) {
880
        sense.key = NO_SENSE;
881
        sense.asc = 0;
882
        sense.ascq = 0;
883
    } else {
884
        fixed_in = (in_buf[0] & 2) == 0;
885

    
886
        if (fixed == fixed_in) {
887
            memcpy(buf, in_buf, MIN(len, in_len));
888
            return MIN(len, in_len);
889
        }
890

    
891
        if (fixed_in) {
892
            sense.key = in_buf[2];
893
            sense.asc = in_buf[12];
894
            sense.ascq = in_buf[13];
895
        } else {
896
            sense.key = in_buf[1];
897
            sense.asc = in_buf[2];
898
            sense.ascq = in_buf[3];
899
        }
900
    }
901

    
902
    memset(buf, 0, len);
903
    if (fixed) {
904
        /* Return fixed format sense buffer */
905
        buf[0] = 0xf0;
906
        buf[2] = sense.key;
907
        buf[7] = 10;
908
        buf[12] = sense.asc;
909
        buf[13] = sense.ascq;
910
        return MIN(len, 18);
911
    } else {
912
        /* Return descriptor format sense buffer */
913
        buf[0] = 0x72;
914
        buf[1] = sense.key;
915
        buf[2] = sense.asc;
916
        buf[3] = sense.ascq;
917
        return 8;
918
    }
919
}
920

    
921
static const char *scsi_command_name(uint8_t cmd)
922
{
923
    static const char *names[] = {
924
        [ TEST_UNIT_READY          ] = "TEST_UNIT_READY",
925
        [ REWIND                   ] = "REWIND",
926
        [ REQUEST_SENSE            ] = "REQUEST_SENSE",
927
        [ FORMAT_UNIT              ] = "FORMAT_UNIT",
928
        [ READ_BLOCK_LIMITS        ] = "READ_BLOCK_LIMITS",
929
        [ REASSIGN_BLOCKS          ] = "REASSIGN_BLOCKS",
930
        [ READ_6                   ] = "READ_6",
931
        [ WRITE_6                  ] = "WRITE_6",
932
        [ SEEK_6                   ] = "SEEK_6",
933
        [ READ_REVERSE             ] = "READ_REVERSE",
934
        [ WRITE_FILEMARKS          ] = "WRITE_FILEMARKS",
935
        [ SPACE                    ] = "SPACE",
936
        [ INQUIRY                  ] = "INQUIRY",
937
        [ RECOVER_BUFFERED_DATA    ] = "RECOVER_BUFFERED_DATA",
938
        [ MAINTENANCE_IN           ] = "MAINTENANCE_IN",
939
        [ MAINTENANCE_OUT          ] = "MAINTENANCE_OUT",
940
        [ MODE_SELECT              ] = "MODE_SELECT",
941
        [ RESERVE                  ] = "RESERVE",
942
        [ RELEASE                  ] = "RELEASE",
943
        [ COPY                     ] = "COPY",
944
        [ ERASE                    ] = "ERASE",
945
        [ MODE_SENSE               ] = "MODE_SENSE",
946
        [ START_STOP               ] = "START_STOP",
947
        [ RECEIVE_DIAGNOSTIC       ] = "RECEIVE_DIAGNOSTIC",
948
        [ SEND_DIAGNOSTIC          ] = "SEND_DIAGNOSTIC",
949
        [ ALLOW_MEDIUM_REMOVAL     ] = "ALLOW_MEDIUM_REMOVAL",
950
        [ READ_CAPACITY_10         ] = "READ_CAPACITY_10",
951
        [ READ_10                  ] = "READ_10",
952
        [ WRITE_10                 ] = "WRITE_10",
953
        [ SEEK_10                  ] = "SEEK_10",
954
        [ WRITE_VERIFY_10          ] = "WRITE_VERIFY_10",
955
        [ VERIFY_10                ] = "VERIFY_10",
956
        [ SEARCH_HIGH              ] = "SEARCH_HIGH",
957
        [ SEARCH_EQUAL             ] = "SEARCH_EQUAL",
958
        [ SEARCH_LOW               ] = "SEARCH_LOW",
959
        [ SET_LIMITS               ] = "SET_LIMITS",
960
        [ PRE_FETCH                ] = "PRE_FETCH",
961
        /* READ_POSITION and PRE_FETCH use the same operation code */
962
        [ SYNCHRONIZE_CACHE        ] = "SYNCHRONIZE_CACHE",
963
        [ LOCK_UNLOCK_CACHE        ] = "LOCK_UNLOCK_CACHE",
964
        [ READ_DEFECT_DATA         ] = "READ_DEFECT_DATA",
965
        [ MEDIUM_SCAN              ] = "MEDIUM_SCAN",
966
        [ COMPARE                  ] = "COMPARE",
967
        [ COPY_VERIFY              ] = "COPY_VERIFY",
968
        [ WRITE_BUFFER             ] = "WRITE_BUFFER",
969
        [ READ_BUFFER              ] = "READ_BUFFER",
970
        [ UPDATE_BLOCK             ] = "UPDATE_BLOCK",
971
        [ READ_LONG_10             ] = "READ_LONG_10",
972
        [ WRITE_LONG_10            ] = "WRITE_LONG_10",
973
        [ CHANGE_DEFINITION        ] = "CHANGE_DEFINITION",
974
        [ WRITE_SAME_10            ] = "WRITE_SAME_10",
975
        [ UNMAP                    ] = "UNMAP",
976
        [ READ_TOC                 ] = "READ_TOC",
977
        [ REPORT_DENSITY_SUPPORT   ] = "REPORT_DENSITY_SUPPORT",
978
        [ GET_CONFIGURATION        ] = "GET_CONFIGURATION",
979
        [ LOG_SELECT               ] = "LOG_SELECT",
980
        [ LOG_SENSE                ] = "LOG_SENSE",
981
        [ MODE_SELECT_10           ] = "MODE_SELECT_10",
982
        [ RESERVE_10               ] = "RESERVE_10",
983
        [ RELEASE_10               ] = "RELEASE_10",
984
        [ MODE_SENSE_10            ] = "MODE_SENSE_10",
985
        [ PERSISTENT_RESERVE_IN    ] = "PERSISTENT_RESERVE_IN",
986
        [ PERSISTENT_RESERVE_OUT   ] = "PERSISTENT_RESERVE_OUT",
987
        [ WRITE_FILEMARKS_16       ] = "WRITE_FILEMARKS_16",
988
        [ EXTENDED_COPY            ] = "EXTENDED_COPY",
989
        [ ATA_PASSTHROUGH          ] = "ATA_PASSTHROUGH",
990
        [ ACCESS_CONTROL_IN        ] = "ACCESS_CONTROL_IN",
991
        [ ACCESS_CONTROL_OUT       ] = "ACCESS_CONTROL_OUT",
992
        [ READ_16                  ] = "READ_16",
993
        [ COMPARE_AND_WRITE        ] = "COMPARE_AND_WRITE",
994
        [ WRITE_16                 ] = "WRITE_16",
995
        [ WRITE_VERIFY_16          ] = "WRITE_VERIFY_16",
996
        [ VERIFY_16                ] = "VERIFY_16",
997
        [ SYNCHRONIZE_CACHE_16     ] = "SYNCHRONIZE_CACHE_16",
998
        [ LOCATE_16                ] = "LOCATE_16",
999
        [ WRITE_SAME_16            ] = "WRITE_SAME_16",
1000
        /* ERASE_16 and WRITE_SAME_16 use the same operation code */
1001
        [ SERVICE_ACTION_IN_16     ] = "SERVICE_ACTION_IN_16",
1002
        [ WRITE_LONG_16            ] = "WRITE_LONG_16",
1003
        [ REPORT_LUNS              ] = "REPORT_LUNS",
1004
        [ BLANK                    ] = "BLANK",
1005
        [ MOVE_MEDIUM              ] = "MOVE_MEDIUM",
1006
        [ LOAD_UNLOAD              ] = "LOAD_UNLOAD",
1007
        [ READ_12                  ] = "READ_12",
1008
        [ WRITE_12                 ] = "WRITE_12",
1009
        [ SERVICE_ACTION_IN_12     ] = "SERVICE_ACTION_IN_12",
1010
        [ WRITE_VERIFY_12          ] = "WRITE_VERIFY_12",
1011
        [ VERIFY_12                ] = "VERIFY_12",
1012
        [ SEARCH_HIGH_12           ] = "SEARCH_HIGH_12",
1013
        [ SEARCH_EQUAL_12          ] = "SEARCH_EQUAL_12",
1014
        [ SEARCH_LOW_12            ] = "SEARCH_LOW_12",
1015
        [ READ_ELEMENT_STATUS      ] = "READ_ELEMENT_STATUS",
1016
        [ SEND_VOLUME_TAG          ] = "SEND_VOLUME_TAG",
1017
        [ READ_DEFECT_DATA_12      ] = "READ_DEFECT_DATA_12",
1018
        [ SET_CD_SPEED             ] = "SET_CD_SPEED",
1019
    };
1020

    
1021
    if (cmd >= ARRAY_SIZE(names) || names[cmd] == NULL)
1022
        return "*UNKNOWN*";
1023
    return names[cmd];
1024
}
1025

    
1026
SCSIRequest *scsi_req_ref(SCSIRequest *req)
1027
{
1028
    req->refcount++;
1029
    return req;
1030
}
1031

    
1032
void scsi_req_unref(SCSIRequest *req)
1033
{
1034
    if (--req->refcount == 0) {
1035
        if (req->ops->free_req) {
1036
            req->ops->free_req(req);
1037
        }
1038
        g_free(req);
1039
    }
1040
}
1041

    
1042
/* Tell the device that we finished processing this chunk of I/O.  It
1043
   will start the next chunk or complete the command.  */
1044
void scsi_req_continue(SCSIRequest *req)
1045
{
1046
    trace_scsi_req_continue(req->dev->id, req->lun, req->tag);
1047
    if (req->cmd.mode == SCSI_XFER_TO_DEV) {
1048
        req->ops->write_data(req);
1049
    } else {
1050
        req->ops->read_data(req);
1051
    }
1052
}
1053

    
1054
/* Called by the devices when data is ready for the HBA.  The HBA should
1055
   start a DMA operation to read or fill the device's data buffer.
1056
   Once it completes, calling scsi_req_continue will restart I/O.  */
1057
void scsi_req_data(SCSIRequest *req, int len)
1058
{
1059
    trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);
1060
    req->bus->info->transfer_data(req, len);
1061
}
1062

    
1063
void scsi_req_print(SCSIRequest *req)
1064
{
1065
    FILE *fp = stderr;
1066
    int i;
1067

    
1068
    fprintf(fp, "[%s id=%d] %s",
1069
            req->dev->qdev.parent_bus->name,
1070
            req->dev->id,
1071
            scsi_command_name(req->cmd.buf[0]));
1072
    for (i = 1; i < req->cmd.len; i++) {
1073
        fprintf(fp, " 0x%02x", req->cmd.buf[i]);
1074
    }
1075
    switch (req->cmd.mode) {
1076
    case SCSI_XFER_NONE:
1077
        fprintf(fp, " - none\n");
1078
        break;
1079
    case SCSI_XFER_FROM_DEV:
1080
        fprintf(fp, " - from-dev len=%zd\n", req->cmd.xfer);
1081
        break;
1082
    case SCSI_XFER_TO_DEV:
1083
        fprintf(fp, " - to-dev len=%zd\n", req->cmd.xfer);
1084
        break;
1085
    default:
1086
        fprintf(fp, " - Oops\n");
1087
        break;
1088
    }
1089
}
1090

    
1091
void scsi_req_complete(SCSIRequest *req, int status)
1092
{
1093
    assert(req->status == -1);
1094
    req->status = status;
1095

    
1096
    assert(req->sense_len < sizeof(req->sense));
1097
    if (status == GOOD) {
1098
        req->sense_len = 0;
1099
    }
1100

    
1101
    if (req->sense_len) {
1102
        memcpy(req->dev->sense, req->sense, req->sense_len);
1103
        req->dev->sense_len = req->sense_len;
1104
        req->dev->sense_is_ua = (req->ops == &reqops_unit_attention);
1105
    } else {
1106
        req->dev->sense_len = 0;
1107
        req->dev->sense_is_ua = false;
1108
    }
1109

    
1110
    /*
1111
     * Unit attention state is now stored in the device's sense buffer
1112
     * if the HBA didn't do autosense.  Clear the pending unit attention
1113
     * flags.
1114
     */
1115
    scsi_clear_unit_attention(req);
1116

    
1117
    scsi_req_ref(req);
1118
    scsi_req_dequeue(req);
1119
    req->bus->info->complete(req, req->status);
1120
    scsi_req_unref(req);
1121
}
1122

    
1123
void scsi_req_cancel(SCSIRequest *req)
1124
{
1125
    if (req->ops->cancel_io) {
1126
        req->ops->cancel_io(req);
1127
    }
1128
    scsi_req_ref(req);
1129
    scsi_req_dequeue(req);
1130
    if (req->bus->info->cancel) {
1131
        req->bus->info->cancel(req);
1132
    }
1133
    scsi_req_unref(req);
1134
}
1135

    
1136
void scsi_req_abort(SCSIRequest *req, int status)
1137
{
1138
    if (req->ops->cancel_io) {
1139
        req->ops->cancel_io(req);
1140
    }
1141
    scsi_req_complete(req, status);
1142
}
1143

    
1144
void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
1145
{
1146
    SCSIRequest *req;
1147

    
1148
    while (!QTAILQ_EMPTY(&sdev->requests)) {
1149
        req = QTAILQ_FIRST(&sdev->requests);
1150
        scsi_req_cancel(req);
1151
    }
1152
    sdev->unit_attention = sense;
1153
}
1154

    
1155
static char *scsibus_get_fw_dev_path(DeviceState *dev)
1156
{
1157
    SCSIDevice *d = DO_UPCAST(SCSIDevice, qdev, dev);
1158
    char path[100];
1159

    
1160
    snprintf(path, sizeof(path), "%s@%d:%d:%d", qdev_fw_name(dev),
1161
             0, d->id, d->lun);
1162

    
1163
    return strdup(path);
1164
}
1165

    
1166
SCSIDevice *scsi_device_find(SCSIBus *bus, int id, int lun)
1167
{
1168
    DeviceState *qdev;
1169
    SCSIDevice *target_dev = NULL;
1170

    
1171
    QTAILQ_FOREACH_REVERSE(qdev, &bus->qbus.children, ChildrenHead, sibling) {
1172
        SCSIDevice *dev = DO_UPCAST(SCSIDevice, qdev, qdev);
1173

    
1174
        if (dev->id == id) {
1175
            if (dev->lun == lun) {
1176
                return dev;
1177
            }
1178
            target_dev = dev;
1179
        }
1180
    }
1181
    return target_dev;
1182
}