Merge ~paelzer/ubuntu/+source/qemu:lp-1967814-scsi-error-handling into ubuntu/+source/qemu:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~paelzer/+archive/ubuntu/lp-1967814-scsi-error-handling

[Bryce Harrington (bryce)]

Quite a few patches, so my review is not as in depth as normal: I've not checked tests or build, but instead code review on each patch, verifying DEP3, review LP and upstream bug reports, and checked packaging work.

It seems the changelog entry might be good to include a mention that it's improving and refactoring handling of sense codes and SCSI status. But you know better what the appropriate level of detail is for qemu so will leave to your prerogative.

LGTM, +1

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks, I enhanced the changelog entry accordingly.

[Christian Ehrhardt  (paelzer)]

Uploaded

diff --git a/debian/changelog b/debian/changelog
index 556e73f..429ed96 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+qemu (1:4.2-3ubuntu6.22) focal; urgency=medium
+
+  * d/p/u/lp-1967814-*: avoid interpreting failed scsi requests as
+    good which could lead to silent data corruption (LP: #1967814)
+    This refactors handling of sense codes and SCSI status to be able
+    detect, handle and pass that information to the guest as needed.
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 06 Apr 2022 14:24:56 +0200
+
 qemu (1:4.2-3ubuntu6.21) focal-security; urgency=medium
 
   * SECURITY UPDATE: crash or code exec in USB redirector device emulation
diff --git a/debian/patches/series b/debian/patches/series
index 39c9d00..8f525ba 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -324,3 +324,11 @@ CVE-2021-3930.patch
 CVE-2021-20196-1.patch
 CVE-2021-20196-2.patch
 CVE-2021-20203.patch
+ubuntu/lp-1967814-scsi-disk-convert-more-errno-values-back-to-SCSI-sta.patch
+ubuntu/lp-1967814-scsi-disk-move-scsi_handle_rw_error-earlier.patch
+ubuntu/lp-1967814-scsi-introduce-scsi_sense_from_errno.patch
+ubuntu/lp-1967814-scsi-disk-pass-SCSI-status-to-scsi_handle_rw_error.patch
+ubuntu/lp-1967814-scsi-Rename-linux-specific-SG_ERR-codes-to-generic-S.patch
+ubuntu/lp-1967814-scsi-Add-mapping-for-generic-SCSI_HOST-status-to-sen.patch
+ubuntu/lp-1967814-scsi-inline-sg_io_sense_from_errno-into-the-callers.patch
+ubuntu/lp-1967814-scsi-fix-sense-code-for-EREMOTEIO.patch
diff --git a/debian/patches/ubuntu/lp-1967814-scsi-Add-mapping-for-generic-SCSI_HOST-status-to-sen.patch b/debian/patches/ubuntu/lp-1967814-scsi-Add-mapping-for-generic-SCSI_HOST-status-to-sen.patch
new file mode 100644
index 0000000..aa7fb8a
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1967814-scsi-Add-mapping-for-generic-SCSI_HOST-status-to-sen.patch
@@ -0,0 +1,126 @@
+From db66a15cb80f09da24a5311a3f3b8f0c1835bf71 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <[e-mail]>
+Date: Mon, 16 Nov 2020 19:40:39 +0100
+Subject: [PATCH] scsi: Add mapping for generic SCSI_HOST status to sense codes
+
+As we don't have a driver-specific mapping (yet) we should provide
+for a detailed mapping from host_status to SCSI sense codes.
+
+Signed-off-by: Hannes Reinecke <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=db66a15cb80f09da24a5311a3f3b8f0c1835bf71
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1967814
+Last-Update: 2022-04-06
+
+---
+ include/scsi/utils.h |  1 +
+ scsi/utils.c         | 65 +++++++++++++++++++++++++++++++++++++++-----
+ 2 files changed, 59 insertions(+), 7 deletions(-)
+
+diff --git a/include/scsi/utils.h b/include/scsi/utils.h
+index ddb22b56df..9080d65e27 100644
+--- a/include/scsi/utils.h
++++ b/include/scsi/utils.h
+@@ -145,5 +145,6 @@ int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+ #endif
+ 
+ int scsi_sense_from_errno(int errno_value, SCSISense *sense);
++int scsi_sense_from_host_status(uint8_t host_status, SCSISense *sense);
+ 
+ #endif
+diff --git a/scsi/utils.c b/scsi/utils.c
+index 4d994b6d56..28eb32746e 100644
+--- a/scsi/utils.c
++++ b/scsi/utils.c
+@@ -257,6 +257,21 @@ const struct SCSISense sense_code_LUN_COMM_FAILURE = {
+     .key = ABORTED_COMMAND, .asc = 0x08, .ascq = 0x00
+ };
+ 
++/* Command aborted, LUN does not respond to selection */
++const struct SCSISense sense_code_LUN_NOT_RESPONDING = {
++    .key = ABORTED_COMMAND, .asc = 0x05, .ascq = 0x00
++};
++
++/* Command aborted, Command Timeout during processing */
++const struct SCSISense sense_code_COMMAND_TIMEOUT = {
++    .key = ABORTED_COMMAND, .asc = 0x2e, .ascq = 0x02
++};
++
++/* Command aborted, Commands cleared by device server */
++const struct SCSISense sense_code_COMMAND_ABORTED = {
++    .key = ABORTED_COMMAND, .asc = 0x2f, .ascq = 0x02
++};
++
+ /* Medium Error, Unrecovered read error */
+ const struct SCSISense sense_code_READ_ERROR = {
+     .key = MEDIUM_ERROR, .asc = 0x11, .ascq = 0x00
+@@ -605,6 +620,45 @@ int scsi_sense_from_errno(int errno_value, SCSISense *sense)
+     }
+ }
+ 
++int scsi_sense_from_host_status(uint8_t host_status,
++                                SCSISense *sense)
++{
++    switch (host_status) {
++    case SCSI_HOST_NO_LUN:
++        *sense = SENSE_CODE(LUN_NOT_RESPONDING);
++        return CHECK_CONDITION;
++    case SCSI_HOST_BUSY:
++        return BUSY;
++    case SCSI_HOST_TIME_OUT:
++        *sense = SENSE_CODE(COMMAND_TIMEOUT);
++        return CHECK_CONDITION;
++    case SCSI_HOST_BAD_RESPONSE:
++        *sense = SENSE_CODE(LUN_COMM_FAILURE);
++        return CHECK_CONDITION;
++    case SCSI_HOST_ABORTED:
++        *sense = SENSE_CODE(COMMAND_ABORTED);
++        return CHECK_CONDITION;
++    case SCSI_HOST_RESET:
++        *sense = SENSE_CODE(RESET);
++        return CHECK_CONDITION;
++    case SCSI_HOST_TRANSPORT_DISRUPTED:
++        *sense = SENSE_CODE(I_T_NEXUS_LOSS);
++        return CHECK_CONDITION;
++    case SCSI_HOST_TARGET_FAILURE:
++        *sense = SENSE_CODE(TARGET_FAILURE);
++        return CHECK_CONDITION;
++    case SCSI_HOST_RESERVATION_ERROR:
++        return RESERVATION_CONFLICT;
++    case SCSI_HOST_ALLOCATION_FAILURE:
++        *sense = SENSE_CODE(SPACE_ALLOC_FAILED);
++        return CHECK_CONDITION;
++    case SCSI_HOST_MEDIUM_ERROR:
++        *sense = SENSE_CODE(READ_ERROR);
++        return CHECK_CONDITION;
++    }
++    return GOOD;
++}
++
+ #ifdef CONFIG_LINUX
+ int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+                            SCSISense *sense)
+@@ -612,14 +666,11 @@ int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+     if (errno_value != 0) {
+         return scsi_sense_from_errno(errno_value, sense);
+     } else {
+-        if (io_hdr->host_status == SCSI_HOST_NO_LUN ||
+-            io_hdr->host_status == SCSI_HOST_BUSY ||
+-            io_hdr->host_status == SCSI_HOST_TIME_OUT ||
+-            (io_hdr->driver_status & SG_ERR_DRIVER_TIMEOUT)) {
++        int status = scsi_sense_from_host_status(io_hdr->host_status, sense);
++        if (status) {
++            return status;
++        } else if (io_hdr->driver_status & SG_ERR_DRIVER_TIMEOUT) {
+             return BUSY;
+-        } else if (io_hdr->host_status) {
+-            *sense = SENSE_CODE(I_T_NEXUS_LOSS);
+-            return CHECK_CONDITION;
+         } else if (io_hdr->status) {
+             return io_hdr->status;
+         } else if (io_hdr->driver_status & SG_ERR_DRIVER_SENSE) {
+-- 
+2.35.1
+
diff --git a/debian/patches/ubuntu/lp-1967814-scsi-Rename-linux-specific-SG_ERR-codes-to-generic-S.patch b/debian/patches/ubuntu/lp-1967814-scsi-Rename-linux-specific-SG_ERR-codes-to-generic-S.patch
new file mode 100644
index 0000000..f0d1533
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1967814-scsi-Rename-linux-specific-SG_ERR-codes-to-generic-S.patch
@@ -0,0 +1,90 @@
+From 41af878b96582fc8c83303ab8921e40468403702 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <[e-mail]>
+Date: Mon, 16 Nov 2020 19:40:38 +0100
+Subject: [PATCH] scsi: Rename linux-specific SG_ERR codes to generic SCSI_HOST
+ error codes
+
+We really should make a distinction between legitimate sense codes
+(ie if one is running against an emulated block device or for
+pass-through sense codes), and the intermediate errors generated
+during processing of the command, which really are not sense codes
+but refer to some specific internal status. And this internal
+state is not necessarily linux-specific, but rather can refer to
+the qemu implementation itself.
+So rename the linux-only SG_ERR codes to SCSI_HOST codes and make
+them available generally.
+
+Signed-off-by: Hannes Reinecke <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=41af878b96582fc8c83303ab8921e40468403702
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1967814
+Last-Update: 2022-04-06
+
+---
+ include/scsi/utils.h | 23 ++++++++++++++++-------
+ scsi/utils.c         |  6 +++---
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/include/scsi/utils.h b/include/scsi/utils.h
+index ff7c7091b6..ddb22b56df 100644
+--- a/include/scsi/utils.h
++++ b/include/scsi/utils.h
+@@ -16,6 +16,22 @@ enum SCSIXferMode {
+     SCSI_XFER_TO_DEV,    /*  WRITE, MODE_SELECT, ...         */
+ };
+ 
++enum SCSIHostStatus {
++    SCSI_HOST_OK,
++    SCSI_HOST_NO_LUN,
++    SCSI_HOST_BUSY,
++    SCSI_HOST_TIME_OUT,
++    SCSI_HOST_BAD_RESPONSE,
++    SCSI_HOST_ABORTED,
++    SCSI_HOST_ERROR = 0x07,
++    SCSI_HOST_RESET = 0x08,
++    SCSI_HOST_TRANSPORT_DISRUPTED = 0xe,
++    SCSI_HOST_TARGET_FAILURE = 0x10,
++    SCSI_HOST_RESERVATION_ERROR = 0x11,
++    SCSI_HOST_ALLOCATION_FAILURE = 0x12,
++    SCSI_HOST_MEDIUM_ERROR = 0x13,
++};
++
+ typedef struct SCSICommand {
+     uint8_t buf[SCSI_CMD_BUF_SIZE];
+     int len;
+@@ -124,13 +140,6 @@ int scsi_cdb_length(uint8_t *buf);
+ #define SG_ERR_DRIVER_TIMEOUT  0x06
+ #define SG_ERR_DRIVER_SENSE    0x08
+ 
+-#define SG_ERR_DID_OK          0x00
+-#define SG_ERR_DID_NO_CONNECT  0x01
+-#define SG_ERR_DID_BUS_BUSY    0x02
+-#define SG_ERR_DID_TIME_OUT    0x03
+-
+-#define SG_ERR_DRIVER_SENSE    0x08
+-
+ int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+                            SCSISense *sense);
+ #endif
+diff --git a/scsi/utils.c b/scsi/utils.c
+index 6b56e01002..4d994b6d56 100644
+--- a/scsi/utils.c
++++ b/scsi/utils.c
+@@ -612,9 +612,9 @@ int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+     if (errno_value != 0) {
+         return scsi_sense_from_errno(errno_value, sense);
+     } else {
+-        if (io_hdr->host_status == SG_ERR_DID_NO_CONNECT ||
+-            io_hdr->host_status == SG_ERR_DID_BUS_BUSY ||
+-            io_hdr->host_status == SG_ERR_DID_TIME_OUT ||
++        if (io_hdr->host_status == SCSI_HOST_NO_LUN ||
++            io_hdr->host_status == SCSI_HOST_BUSY ||
++            io_hdr->host_status == SCSI_HOST_TIME_OUT ||
+             (io_hdr->driver_status & SG_ERR_DRIVER_TIMEOUT)) {
+             return BUSY;
+         } else if (io_hdr->host_status) {
+-- 
+2.35.1
+
diff --git a/debian/patches/ubuntu/lp-1967814-scsi-disk-convert-more-errno-values-back-to-SCSI-sta.patch b/debian/patches/ubuntu/lp-1967814-scsi-disk-convert-more-errno-values-back-to-SCSI-sta.patch
new file mode 100644
index 0000000..cb5e293
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1967814-scsi-disk-convert-more-errno-values-back-to-SCSI-sta.patch
@@ -0,0 +1,54 @@
+From 3b12a7fd39307017c8968b8d05986a63b33752b5 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Thu, 12 Nov 2020 10:52:04 +0100
+Subject: [PATCH] scsi-disk: convert more errno values back to SCSI statuses
+
+Linux has some OS-specific (and sometimes weird) mappings for various SCSI
+statuses and sense codes.  The most important is probably RESERVATION
+CONFLICT.  Add them so that they can be reported back to the guest
+kernel.
+
+Cc: Hannes Reinecke <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=3b12a7fd39307017c8968b8d05986a63b33752b5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1967814
+Last-Update: 2022-04-06
+
+---
+ hw/scsi/scsi-disk.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index e859534eaf..90841ad791 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -461,6 +461,25 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
+             }
+             error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
+             break;
++#ifdef CONFIG_LINUX
++            /* These errno mapping are specific to Linux.  For more information:
++             * - scsi_decide_disposition in drivers/scsi/scsi_error.c
++             * - scsi_result_to_blk_status in drivers/scsi/scsi_lib.c
++             * - blk_errors[] in block/blk-core.c
++             */
++        case EBADE:
++            /* DID_NEXUS_FAILURE -> BLK_STS_NEXUS.  */
++            scsi_req_complete(&r->req, RESERVATION_CONFLICT);
++            break;
++        case ENODATA:
++            /* DID_MEDIUM_ERROR -> BLK_STS_MEDIUM.  */
++            scsi_check_condition(r, SENSE_CODE(READ_ERROR));
++            break;
++        case EREMOTEIO:
++            /* DID_TARGET_FAILURE -> BLK_STS_TARGET.  */
++            scsi_req_complete(&r->req, HARDWARE_ERROR);
++            break;
++#endif
+         case ENOMEDIUM:
+             scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
+             break;
+-- 
+2.35.1
+
diff --git a/debian/patches/ubuntu/lp-1967814-scsi-disk-move-scsi_handle_rw_error-earlier.patch b/debian/patches/ubuntu/lp-1967814-scsi-disk-move-scsi_handle_rw_error-earlier.patch
new file mode 100644
index 0000000..882d532
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1967814-scsi-disk-move-scsi_handle_rw_error-earlier.patch
@@ -0,0 +1,213 @@
+From f95f61c2c9618fae7d8ea4c1d63e7416884bad52 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Wed, 24 Feb 2021 13:14:07 +0100
+Subject: [PATCH] scsi-disk: move scsi_handle_rw_error earlier
+
+Remove the forward declaration.
+
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=f95f61c2c9618fae7d8ea4c1d63e7416884bad52
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1967814
+Last-Update: 2022-04-06
+
+---
+ hw/scsi/scsi-disk.c | 168 ++++++++++++++++++++++----------------------
+ 1 file changed, 83 insertions(+), 85 deletions(-)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index 5916bdd71d..bfe4162fdf 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -115,8 +115,6 @@ typedef struct SCSIDiskState
+     uint16_t rotation_rate;
+ } SCSIDiskState;
+ 
+-static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed);
+-
+ static void scsi_free_request(SCSIRequest *req)
+ {
+     SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
+@@ -186,6 +184,89 @@ static void scsi_disk_load_request(QEMUFile *f, SCSIRequest *req)
+     qemu_iovec_init_external(&r->qiov, &r->iov, 1);
+ }
+ 
++/*
++ * scsi_handle_rw_error has two return values.  False means that the error
++ * must be ignored, true means that the error has been processed and the
++ * caller should not do anything else for this request.  Note that
++ * scsi_handle_rw_error always manages its reference counts, independent
++ * of the return value.
++ */
++static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
++{
++    bool is_read = (r->req.cmd.mode == SCSI_XFER_FROM_DEV);
++    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
++    SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
++    BlockErrorAction action = blk_get_error_action(s->qdev.conf.blk,
++                                                   is_read, error);
++
++    if (action == BLOCK_ERROR_ACTION_REPORT) {
++        if (acct_failed) {
++            block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
++        }
++        switch (error) {
++        case 0:
++            /* A passthrough command has run and has produced sense data; check
++             * whether the error has to be handled by the guest or should rather
++             * pause the host.
++             */
++            assert(r->status && *r->status);
++            if (scsi_sense_buf_is_guest_recoverable(r->req.sense, sizeof(r->req.sense))) {
++                /* These errors are handled by guest. */
++                sdc->update_sense(&r->req);
++                scsi_req_complete(&r->req, *r->status);
++                return true;
++            }
++            error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
++            break;
++#ifdef CONFIG_LINUX
++            /* These errno mapping are specific to Linux.  For more information:
++             * - scsi_decide_disposition in drivers/scsi/scsi_error.c
++             * - scsi_result_to_blk_status in drivers/scsi/scsi_lib.c
++             * - blk_errors[] in block/blk-core.c
++             */
++        case EBADE:
++            /* DID_NEXUS_FAILURE -> BLK_STS_NEXUS.  */
++            scsi_req_complete(&r->req, RESERVATION_CONFLICT);
++            break;
++        case ENODATA:
++            /* DID_MEDIUM_ERROR -> BLK_STS_MEDIUM.  */
++            scsi_check_condition(r, SENSE_CODE(READ_ERROR));
++            break;
++        case EREMOTEIO:
++            /* DID_TARGET_FAILURE -> BLK_STS_TARGET.  */
++            scsi_req_complete(&r->req, HARDWARE_ERROR);
++            break;
++#endif
++        case ENOMEDIUM:
++            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
++            break;
++        case ENOMEM:
++            scsi_check_condition(r, SENSE_CODE(TARGET_FAILURE));
++            break;
++        case EINVAL:
++            scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
++            break;
++        case ENOSPC:
++            scsi_check_condition(r, SENSE_CODE(SPACE_ALLOC_FAILED));
++            break;
++        default:
++            scsi_check_condition(r, SENSE_CODE(IO_ERROR));
++            break;
++        }
++    }
++
++    blk_error_action(s->qdev.conf.blk, action, is_read, error);
++    if (action == BLOCK_ERROR_ACTION_IGNORE) {
++        scsi_req_complete(&r->req, 0);
++        return true;
++    }
++
++    if (action == BLOCK_ERROR_ACTION_STOP) {
++        scsi_req_retry(&r->req);
++    }
++    return true;
++}
++
+ static bool scsi_disk_req_check_error(SCSIDiskReq *r, int ret, bool acct_failed)
+ {
+     if (r->req.io_canceled) {
+@@ -432,89 +513,6 @@ static void scsi_read_data(SCSIRequest *req)
+     }
+ }
+ 
+-/*
+- * scsi_handle_rw_error has two return values.  False means that the error
+- * must be ignored, true means that the error has been processed and the
+- * caller should not do anything else for this request.  Note that
+- * scsi_handle_rw_error always manages its reference counts, independent
+- * of the return value.
+- */
+-static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
+-{
+-    bool is_read = (r->req.cmd.mode == SCSI_XFER_FROM_DEV);
+-    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
+-    SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
+-    BlockErrorAction action = blk_get_error_action(s->qdev.conf.blk,
+-                                                   is_read, error);
+-
+-    if (action == BLOCK_ERROR_ACTION_REPORT) {
+-        if (acct_failed) {
+-            block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
+-        }
+-        switch (error) {
+-        case 0:
+-            /* A passthrough command has run and has produced sense data; check
+-             * whether the error has to be handled by the guest or should rather
+-             * pause the host.
+-             */
+-            assert(r->status && *r->status);
+-            if (scsi_sense_buf_is_guest_recoverable(r->req.sense, sizeof(r->req.sense))) {
+-                /* These errors are handled by guest. */
+-                sdc->update_sense(&r->req);
+-                scsi_req_complete(&r->req, *r->status);
+-                return true;
+-            }
+-            error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
+-            break;
+-#ifdef CONFIG_LINUX
+-            /* These errno mapping are specific to Linux.  For more information:
+-             * - scsi_decide_disposition in drivers/scsi/scsi_error.c
+-             * - scsi_result_to_blk_status in drivers/scsi/scsi_lib.c
+-             * - blk_errors[] in block/blk-core.c
+-             */
+-        case EBADE:
+-            /* DID_NEXUS_FAILURE -> BLK_STS_NEXUS.  */
+-            scsi_req_complete(&r->req, RESERVATION_CONFLICT);
+-            break;
+-        case ENODATA:
+-            /* DID_MEDIUM_ERROR -> BLK_STS_MEDIUM.  */
+-            scsi_check_condition(r, SENSE_CODE(READ_ERROR));
+-            break;
+-        case EREMOTEIO:
+-            /* DID_TARGET_FAILURE -> BLK_STS_TARGET.  */
+-            scsi_req_complete(&r->req, HARDWARE_ERROR);
+-            break;
+-#endif
+-        case ENOMEDIUM:
+-            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
+-            break;
+-        case ENOMEM:
+-            scsi_check_condition(r, SENSE_CODE(TARGET_FAILURE));
+-            break;
+-        case EINVAL:
+-            scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
+-            break;
+-        case ENOSPC:
+-            scsi_check_condition(r, SENSE_CODE(SPACE_ALLOC_FAILED));
+-            break;
+-        default:
+-            scsi_check_condition(r, SENSE_CODE(IO_ERROR));
+-            break;
+-        }
+-    }
+-
+-    blk_error_action(s->qdev.conf.blk, action, is_read, error);
+-    if (action == BLOCK_ERROR_ACTION_IGNORE) {
+-        scsi_req_complete(&r->req, 0);
+-        return true;
+-    }
+-
+-    if (action == BLOCK_ERROR_ACTION_STOP) {
+-        scsi_req_retry(&r->req);
+-    }
+-    return true;
+-}
+-
+ static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
+ {
+     uint32_t n;
+-- 
+2.31.1
+
diff --git a/debian/patches/ubuntu/lp-1967814-scsi-disk-pass-SCSI-status-to-scsi_handle_rw_error.patch b/debian/patches/ubuntu/lp-1967814-scsi-disk-pass-SCSI-status-to-scsi_handle_rw_error.patch
new file mode 100644
index 0000000..d82ddd7
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1967814-scsi-disk-pass-SCSI-status-to-scsi_handle_rw_error.patch
@@ -0,0 +1,97 @@
+From f63c68bc0f514694a958b2e84a204b7792d28b17 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Wed, 24 Feb 2021 18:59:36 +0100
+Subject: [PATCH] scsi-disk: pass SCSI status to scsi_handle_rw_error
+
+Instead of fishing it from *r->status, just pass the SCSI status
+as a positive value of the second parameter and an errno as a
+negative value.
+
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=f63c68bc0f514694a958b2e84a204b7792d28b17
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1967814
+Last-Update: 2022-04-06
+
+---
+ hw/scsi/scsi-disk.c | 38 +++++++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 11 deletions(-)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index 9c6099ffc4..548a5297fa 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -187,34 +187,48 @@ static void scsi_disk_load_request(QEMUFile *f, SCSIRequest *req)
+  * scsi_handle_rw_error always manages its reference counts, independent
+  * of the return value.
+  */
+-static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
++static bool scsi_handle_rw_error(SCSIDiskReq *r, int ret, bool acct_failed)
+ {
+     bool is_read = (r->req.cmd.mode == SCSI_XFER_FROM_DEV);
+     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
+     SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
+-    BlockErrorAction action = blk_get_error_action(s->qdev.conf.blk,
+-                                                   is_read, error);
+-    SCSISense sense;
++    SCSISense sense = SENSE_CODE(NO_SENSE);
++    int error = 0;
++    bool req_has_sense = false;
++    BlockErrorAction action;
++    int status;
+ 
++    if (ret < 0) {
++        status = scsi_sense_from_errno(-ret, &sense);
++        error = -ret;
++    } else {
++        /* A passthrough command has completed with nonzero status.  */
++        status = ret;
++        if (status == CHECK_CONDITION) {
++            req_has_sense = true;
++            error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
++        } else {
++            error = EINVAL;
++        }
++    }
++
++    action = blk_get_error_action(s->qdev.conf.blk, is_read, error);
+     if (action == BLOCK_ERROR_ACTION_REPORT) {
+         if (acct_failed) {
+             block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
+         }
+-        if (error == 0) {
++        if (req_has_sense) {
+             /* A passthrough command has run and has produced sense data; check
+              * whether the error has to be handled by the guest or should rather
+              * pause the host.
+              */
+-            assert(r->status && *r->status);
+             if (scsi_sense_buf_is_guest_recoverable(r->req.sense, sizeof(r->req.sense))) {
+                 /* These errors are handled by guest. */
+                 sdc->update_sense(&r->req);
+-                scsi_req_complete(&r->req, *r->status);
++                scsi_req_complete(&r->req, status);
+                 return true;
+             }
+-            error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
+         } else {
+-            int status = scsi_sense_from_errno(error, &sense);
+             if (status == CHECK_CONDITION) {
+                 scsi_req_build_sense(&r->req, sense);
+             }
+@@ -240,8 +254,10 @@ static bool scsi_disk_req_check_error(SCSIDiskReq *r, int ret, bool acct_failed)
+         return true;
+     }
+ 
+-    if (ret < 0 || (r->status && *r->status)) {
+-        return scsi_handle_rw_error(r, -ret, acct_failed);
++    if (ret < 0) {
++        return scsi_handle_rw_error(r, ret, acct_failed);
++    } else if (r->status && *r->status) {
++        return scsi_handle_rw_error(r, *r->status, acct_failed);
+     }
+ 
+     return false;
+-- 
+2.35.1
+
diff --git a/debian/patches/ubuntu/lp-1967814-scsi-fix-sense-code-for-EREMOTEIO.patch b/debian/patches/ubuntu/lp-1967814-scsi-fix-sense-code-for-EREMOTEIO.patch
new file mode 100644
index 0000000..ec85439
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1967814-scsi-fix-sense-code-for-EREMOTEIO.patch
@@ -0,0 +1,51 @@
+From dc293f60b02ff9a4d51ccae153b1685cc8a34d79 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Tue, 9 Mar 2021 14:56:42 +0100
+Subject: [PATCH] scsi: fix sense code for EREMOTEIO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+SENSE_CODE(LUN_COMM_FAILURE) has an ABORTED COMMAND sense key,
+so it results in a retry in Linux.  To ensure that EREMOTEIO
+is forwarded to the guest, use a HARDWARE ERROR sense key
+instead.  Note that the code before commit d7a84021d was incorrect
+because it used HARDWARE_ERROR as a SCSI status, not as a sense
+key.
+
+Reported-by: Marc-André Lureau <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=dc293f60b02ff9a4d51ccae153b1685cc8a34d79
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1967814
+Last-Update: 2022-04-06
+
+---
+ scsi/utils.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scsi/utils.c b/scsi/utils.c
+index 873e05aeaf..357b036671 100644
+--- a/scsi/utils.c
++++ b/scsi/utils.c
+@@ -589,7 +589,7 @@ int scsi_sense_from_errno(int errno_value, SCSISense *sense)
+         return TASK_SET_FULL;
+ #ifdef CONFIG_LINUX
+         /* These errno mapping are specific to Linux.  For more information:
+-         * - scsi_decide_disposition in drivers/scsi/scsi_error.c
++         * - scsi_check_sense and scsi_decide_disposition in drivers/scsi/scsi_error.c
+          * - scsi_result_to_blk_status in drivers/scsi/scsi_lib.c
+          * - blk_errors[] in block/blk-core.c
+          */
+@@ -599,7 +599,7 @@ int scsi_sense_from_errno(int errno_value, SCSISense *sense)
+         *sense = SENSE_CODE(READ_ERROR);
+         return CHECK_CONDITION;
+     case EREMOTEIO:
+-        *sense = SENSE_CODE(LUN_COMM_FAILURE);
++        *sense = SENSE_CODE(TARGET_FAILURE);
+         return CHECK_CONDITION;
+ #endif
+     case ENOMEDIUM:
+-- 
+2.35.1
+
diff --git a/debian/patches/ubuntu/lp-1967814-scsi-inline-sg_io_sense_from_errno-into-the-callers.patch b/debian/patches/ubuntu/lp-1967814-scsi-inline-sg_io_sense_from_errno-into-the-callers.patch
new file mode 100644
index 0000000..8dc5b2d
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1967814-scsi-inline-sg_io_sense_from_errno-into-the-callers.patch
@@ -0,0 +1,251 @@
+From a108557bbff8a3f44233982f015f996426411be8 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <[e-mail]>
+Date: Mon, 16 Nov 2020 19:40:40 +0100
+Subject: [PATCH] scsi: inline sg_io_sense_from_errno() into the callers.
+
+Currently sg_io_sense_from_errno() converts the two input parameters
+'errno' and 'io_hdr' into sense code and SCSI status. Having
+split the function off into scsi_sense_from_errno() and
+scsi_sense_from_host_status(), both of which are available generically,
+we now inline the logic in the callers so that scsi-disk and
+scsi-generic will be able to pass host_status to the HBA.
+
+Signed-off-by: Hannes Reinecke <[e-mail]>
+Message-Id: <[e-mail]>
+[Put together from "scsi-disk: Add sg_io callback to evaluate status"
+ and what remains of "scsi: split sg_io_sense_from_errno() in two functions",
+ with many other fixes. - Paolo]
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=a108557bbff8a3f44233982f015f996426411be8
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1967814
+Last-Update: 2022-04-06
+
+---
+ hw/scsi/scsi-disk.c    | 47 +++++++++++++++++++++++++++++++++++++-----
+ hw/scsi/scsi-generic.c | 22 ++++++++++++++------
+ include/scsi/utils.h   |  3 ---
+ scsi/qemu-pr-helper.c  | 24 ++++++++++++++-------
+ scsi/utils.c           | 23 ---------------------
+ 5 files changed, 75 insertions(+), 44 deletions(-)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index f14c435a38..d6c2a28ac2 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -80,7 +80,6 @@ typedef struct SCSIDiskReq {
+     struct iovec iov;
+     QEMUIOVector qiov;
+     BlockAcctCookie acct;
+-    unsigned char *status;
+ } SCSIDiskReq;
+ 
+ #define SCSI_DISK_F_REMOVABLE             0
+@@ -261,8 +260,6 @@ static bool scsi_disk_req_check_error(SCSIDiskReq *r, int ret, bool acct_failed)
+ 
+     if (ret < 0) {
+         return scsi_handle_rw_error(r, ret, acct_failed);
+-    } else if (r->status && *r->status) {
+-        return scsi_handle_rw_error(r, *r->status, acct_failed);
+     }
+ 
+     return false;
+@@ -2698,8 +2695,47 @@ typedef struct SCSIBlockReq {
+ 
+     /* CDB passed to SG_IO.  */
+     uint8_t cdb[16];
++    BlockCompletionFunc *cb;
++    void *cb_opaque;
+ } SCSIBlockReq;
+ 
++static void scsi_block_sgio_complete(void *opaque, int ret)
++{
++    SCSIBlockReq *req = (SCSIBlockReq *)opaque;
++    SCSIDiskReq *r = &req->req;
++    SCSIDevice *s = r->req.dev;
++    sg_io_hdr_t *io_hdr = &req->io_header;
++    SCSISense sense;
++
++    if (ret == 0) {
++        if (io_hdr->host_status != SCSI_HOST_OK) {
++            ret = scsi_sense_from_host_status(io_hdr->host_status, &sense);
++            if (ret == CHECK_CONDITION) {
++                scsi_req_build_sense(&r->req, sense);
++            }
++        } else if (io_hdr->driver_status & SG_ERR_DRIVER_TIMEOUT) {
++            ret = BUSY;
++        } else {
++            ret = io_hdr->status;
++        }
++
++        if (ret > 0) {
++            aio_context_acquire(blk_get_aio_context(s->conf.blk));
++            if (scsi_handle_rw_error(r, ret, true)) {
++                aio_context_release(blk_get_aio_context(s->conf.blk));
++                scsi_req_unref(&r->req);
++                return;
++            }
++            aio_context_release(blk_get_aio_context(s->conf.blk));
++
++            /* Ignore error.  */
++            ret = 0;
++        }
++    }
++
++    req->cb(req->cb_opaque, ret);
++}
++
+ static BlockAIOCB *scsi_block_do_sgio(SCSIBlockReq *req,
+                                       int64_t offset, QEMUIOVector *iov,
+                                       int direction,
+@@ -2779,7 +2815,9 @@ static BlockAIOCB *scsi_block_do_sgio(SCSIBlockReq *req,
+     io_header->usr_ptr = r;
+     io_header->flags |= SG_FLAG_DIRECT_IO;
+ 
+-    aiocb = blk_aio_ioctl(s->qdev.conf.blk, SG_IO, io_header, cb, opaque);
++    req->cb = cb;
++    req->cb_opaque = opaque;
++    aiocb = blk_aio_ioctl(s->qdev.conf.blk, SG_IO, io_header, scsi_block_sgio_complete, req);
+     assert(aiocb != NULL);
+     return aiocb;
+ }
+@@ -2893,7 +2931,6 @@ static int32_t scsi_block_dma_command(SCSIRequest *req, uint8_t *buf)
+         return 0;
+     }
+ 
+-    r->req.status = &r->io_header.status;
+     return scsi_disk_dma_command(req, buf);
+ }
+ 
+diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
+index e7798ebcd0..740f601b51 100644
+--- a/hw/scsi/scsi-generic.c
++++ b/hw/scsi/scsi-generic.c
+@@ -74,6 +74,7 @@ static void scsi_command_complete_noio(SCSIGenericReq *r, int ret)
+ {
+     int status;
+     SCSISense sense;
++    sg_io_hdr_t *io_hdr = &r->io_header;
+ 
+     assert(r->req.aiocb == NULL);
+ 
+@@ -81,15 +82,24 @@ static void scsi_command_complete_noio(SCSIGenericReq *r, int ret)
+         scsi_req_cancel_complete(&r->req);
+         goto done;
+     }
+-    status = sg_io_sense_from_errno(-ret, &r->io_header, &sense);
+-    if (status == CHECK_CONDITION) {
+-        if (r->io_header.driver_status & SG_ERR_DRIVER_SENSE) {
+-            r->req.sense_len = r->io_header.sb_len_wr;
+-        } else {
++    if (ret < 0) {
++        status = scsi_sense_from_errno(-ret, &sense);
++        if (status == CHECK_CONDITION) {
++            scsi_req_build_sense(&r->req, sense);
++        }
++    } else if (io_hdr->host_status != SCSI_HOST_OK) {
++        status = scsi_sense_from_host_status(io_hdr->host_status, &sense);
++        if (status == CHECK_CONDITION) {
+             scsi_req_build_sense(&r->req, sense);
+         }
++    } else if (io_hdr->driver_status & SG_ERR_DRIVER_TIMEOUT) {
++        status = BUSY;
++    } else {
++        status = io_hdr->status;
++        if (io_hdr->driver_status & SG_ERR_DRIVER_SENSE) {
++            r->req.sense_len = io_hdr->sb_len_wr;
++        }
+     }
+-
+     trace_scsi_generic_command_complete_noio(r, r->req.tag, status);
+ 
+     scsi_req_complete(&r->req, status);
+diff --git a/include/scsi/utils.h b/include/scsi/utils.h
+index 490d783e44..581caf15e0 100644
+--- a/include/scsi/utils.h
++++ b/include/scsi/utils.h
+@@ -137,9 +137,6 @@ int scsi_cdb_length(uint8_t *buf);
+ #ifdef CONFIG_LINUX
+ #define SG_ERR_DRIVER_TIMEOUT  0x06
+ #define SG_ERR_DRIVER_SENSE    0x08
+-
+-int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+-                           SCSISense *sense);
+ #endif
+ 
+ int scsi_sense_from_errno(int errno_value, SCSISense *sense);
+diff --git a/scsi/qemu-pr-helper.c b/scsi/qemu-pr-helper.c
+index debb18f4aa..7796bb19ac 100644
+--- a/scsi/qemu-pr-helper.c
++++ b/scsi/qemu-pr-helper.c
+@@ -149,19 +149,29 @@ static int do_sgio_worker(void *opaque)
+     io_hdr.dxferp = (char *)data->buf;
+     io_hdr.dxfer_len = data->sz;
+     ret = ioctl(data->fd, SG_IO, &io_hdr);
+-    status = sg_io_sense_from_errno(ret < 0 ? errno : 0, &io_hdr,
+-                                    &sense_code);
++
++    if (ret < 0) {
++        status = scsi_sense_from_errno(errno, &sense_code);
++        if (status == CHECK_CONDITION) {
++            scsi_build_sense(data->sense, sense_code);
++        }
++    } else if (io_hdr.host_status != SCSI_HOST_OK) {
++        status = scsi_sense_from_host_status(io_hdr.host_status, &sense_code);
++        if (status == CHECK_CONDITION) {
++            scsi_build_sense(data->sense, sense_code);
++        }
++    } else if (io_hdr.driver_status & SG_ERR_DRIVER_TIMEOUT) {
++        status = BUSY;
++    } else {
++        status = io_hdr.status;
++    }
++
+     if (status == GOOD) {
+         data->sz -= io_hdr.resid;
+     } else {
+         data->sz = 0;
+     }
+ 
+-    if (status == CHECK_CONDITION &&
+-        !(io_hdr.driver_status & SG_ERR_DRIVER_SENSE)) {
+-        scsi_build_sense(data->sense, sense_code);
+-    }
+-
+     return status;
+ }
+ 
+diff --git a/scsi/utils.c b/scsi/utils.c
+index 2d843c884a..1cb2507149 100644
+--- a/scsi/utils.c
++++ b/scsi/utils.c
+@@ -657,26 +657,3 @@ int scsi_sense_from_host_status(uint8_t host_status,
+     }
+     return GOOD;
+ }
+-
+-#ifdef CONFIG_LINUX
+-int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+-                           SCSISense *sense)
+-{
+-    if (errno_value != 0) {
+-        return scsi_sense_from_errno(errno_value, sense);
+-    } else {
+-        int status = scsi_sense_from_host_status(io_hdr->host_status, sense);
+-        if (status) {
+-            return status;
+-        } else if (io_hdr->driver_status & SG_ERR_DRIVER_TIMEOUT) {
+-            return BUSY;
+-        } else if (io_hdr->status) {
+-            return io_hdr->status;
+-        } else if (io_hdr->driver_status & SG_ERR_DRIVER_SENSE) {
+-            return CHECK_CONDITION;
+-        } else {
+-            return GOOD;
+-        }
+-    }
+-}
+-#endif
+-- 
+2.31.1
+
diff --git a/debian/patches/ubuntu/lp-1967814-scsi-introduce-scsi_sense_from_errno.patch b/debian/patches/ubuntu/lp-1967814-scsi-introduce-scsi_sense_from_errno.patch
new file mode 100644
index 0000000..a319280
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1967814-scsi-introduce-scsi_sense_from_errno.patch
@@ -0,0 +1,172 @@
+From d7a84021db8eeddcd5d24ab591a1434763caff6c Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Wed, 24 Feb 2021 16:30:09 +0100
+Subject: [PATCH] scsi: introduce scsi_sense_from_errno()
+
+The new function is an extension of the switch statement in scsi-disk.c
+which also includes the errno cases only found in sg_io_sense_from_errno.
+This allows us to consolidate the errno handling.
+
+Extracted from a patch by Hannes Reinecke <[e-mail]>.
+
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d7a84021db8eeddcd5d24ab591a1434763caff6c
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1967814
+Last-Update: 2022-04-06
+
+---
+ hw/scsi/scsi-disk.c  | 45 +++++++-------------------------------
+ include/scsi/utils.h |  2 ++
+ scsi/utils.c         | 51 +++++++++++++++++++++++++++++++++++---------
+ 3 files changed, 51 insertions(+), 47 deletions(-)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index 36aa872445..9c6099ffc4 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -194,13 +194,13 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
+     SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
+     BlockErrorAction action = blk_get_error_action(s->qdev.conf.blk,
+                                                    is_read, error);
++    SCSISense sense;
+ 
+     if (action == BLOCK_ERROR_ACTION_REPORT) {
+         if (acct_failed) {
+             block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
+         }
+-        switch (error) {
+-        case 0:
++        if (error == 0) {
+             /* A passthrough command has run and has produced sense data; check
+              * whether the error has to be handled by the guest or should rather
+              * pause the host.
+@@ -213,41 +213,12 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
+                 return true;
+             }
+             error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
+-            break;
+-#ifdef CONFIG_LINUX
+-            /* These errno mapping are specific to Linux.  For more information:
+-             * - scsi_decide_disposition in drivers/scsi/scsi_error.c
+-             * - scsi_result_to_blk_status in drivers/scsi/scsi_lib.c
+-             * - blk_errors[] in block/blk-core.c
+-             */
+-        case EBADE:
+-            /* DID_NEXUS_FAILURE -> BLK_STS_NEXUS.  */
+-            scsi_req_complete(&r->req, RESERVATION_CONFLICT);
+-            break;
+-        case ENODATA:
+-            /* DID_MEDIUM_ERROR -> BLK_STS_MEDIUM.  */
+-            scsi_check_condition(r, SENSE_CODE(READ_ERROR));
+-            break;
+-        case EREMOTEIO:
+-            /* DID_TARGET_FAILURE -> BLK_STS_TARGET.  */
+-            scsi_req_complete(&r->req, HARDWARE_ERROR);
+-            break;
+-#endif
+-        case ENOMEDIUM:
+-            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
+-            break;
+-        case ENOMEM:
+-            scsi_check_condition(r, SENSE_CODE(TARGET_FAILURE));
+-            break;
+-        case EINVAL:
+-            scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
+-            break;
+-        case ENOSPC:
+-            scsi_check_condition(r, SENSE_CODE(SPACE_ALLOC_FAILED));
+-            break;
+-        default:
+-            scsi_check_condition(r, SENSE_CODE(IO_ERROR));
+-            break;
++        } else {
++            int status = scsi_sense_from_errno(error, &sense);
++            if (status == CHECK_CONDITION) {
++                scsi_req_build_sense(&r->req, sense);
++            }
++            scsi_req_complete(&r->req, status);
+         }
+     }
+ 
+diff --git a/include/scsi/utils.h b/include/scsi/utils.h
+index 096489c6cd..ff7c7091b6 100644
+--- a/include/scsi/utils.h
++++ b/include/scsi/utils.h
+@@ -135,4 +135,6 @@ int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+                            SCSISense *sense);
+ #endif
+ 
++int scsi_sense_from_errno(int errno_value, SCSISense *sense);
++
+ #endif
+diff --git a/scsi/utils.c b/scsi/utils.c
+index 793c3a6b9c..6b56e01002 100644
+--- a/scsi/utils.c
++++ b/scsi/utils.c
+@@ -565,21 +565,52 @@ const char *scsi_command_name(uint8_t cmd)
+     return names[cmd];
+ }
+ 
++int scsi_sense_from_errno(int errno_value, SCSISense *sense)
++{
++    switch (errno_value) {
++    case 0:
++        return GOOD;
++    case EDOM:
++        return TASK_SET_FULL;
++#ifdef CONFIG_LINUX
++        /* These errno mapping are specific to Linux.  For more information:
++         * - scsi_decide_disposition in drivers/scsi/scsi_error.c
++         * - scsi_result_to_blk_status in drivers/scsi/scsi_lib.c
++         * - blk_errors[] in block/blk-core.c
++         */
++    case EBADE:
++        return RESERVATION_CONFLICT;
++    case ENODATA:
++        *sense = SENSE_CODE(READ_ERROR);
++        return CHECK_CONDITION;
++    case EREMOTEIO:
++        *sense = SENSE_CODE(LUN_COMM_FAILURE);
++        return CHECK_CONDITION;
++#endif
++    case ENOMEDIUM:
++        *sense = SENSE_CODE(NO_MEDIUM);
++        return CHECK_CONDITION;
++    case ENOMEM:
++        *sense = SENSE_CODE(TARGET_FAILURE);
++        return CHECK_CONDITION;
++    case EINVAL:
++        *sense = SENSE_CODE(INVALID_FIELD);
++        return CHECK_CONDITION;
++    case ENOSPC:
++        *sense = SENSE_CODE(SPACE_ALLOC_FAILED);
++        return CHECK_CONDITION;
++    default:
++        *sense = SENSE_CODE(IO_ERROR);
++        return CHECK_CONDITION;
++    }
++}
++
+ #ifdef CONFIG_LINUX
+ int sg_io_sense_from_errno(int errno_value, struct sg_io_hdr *io_hdr,
+                            SCSISense *sense)
+ {
+     if (errno_value != 0) {
+-        switch (errno_value) {
+-        case EDOM:
+-            return TASK_SET_FULL;
+-        case ENOMEM:
+-            *sense = SENSE_CODE(TARGET_FAILURE);
+-            return CHECK_CONDITION;
+-        default:
+-            *sense = SENSE_CODE(IO_ERROR);
+-            return CHECK_CONDITION;
+-        }
++        return scsi_sense_from_errno(errno_value, sense);
+     } else {
+         if (io_hdr->host_status == SG_ERR_DID_NO_CONNECT ||
+             io_hdr->host_status == SG_ERR_DID_BUS_BUSY ||
+-- 
+2.35.1
+