2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
48 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSIDiskReq
{
54 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
56 uint32_t sector_count
;
67 /* The qemu block layer uses a fixed 512 byte sector size.
68 This is the number of 512 byte blocks in a single scsi sector. */
79 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
80 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
);
82 static void scsi_free_request(SCSIRequest
*req
)
84 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
86 qemu_vfree(r
->iov
.iov_base
);
89 /* Helper function for command completion with sense. */
90 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
92 DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
93 r
->req
.tag
, sense
.key
, sense
.asc
, sense
.ascq
);
94 scsi_req_build_sense(&r
->req
, sense
);
95 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
98 /* Cancel a pending data transfer. */
99 static void scsi_cancel_io(SCSIRequest
*req
)
101 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
103 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
105 bdrv_aio_cancel(r
->req
.aiocb
);
110 static void scsi_read_complete(void * opaque
, int ret
)
112 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
113 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
116 if (r
->req
.aiocb
!= NULL
) {
118 bdrv_acct_done(s
->bs
, &r
->acct
);
122 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
127 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
129 n
= r
->iov
.iov_len
/ 512;
131 r
->sector_count
-= n
;
132 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
135 static void scsi_flush_complete(void * opaque
, int ret
)
137 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
138 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
140 if (r
->req
.aiocb
!= NULL
) {
142 bdrv_acct_done(s
->bs
, &r
->acct
);
146 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
151 scsi_req_complete(&r
->req
, GOOD
);
154 /* Read more data from scsi device into buffer. */
155 static void scsi_read_data(SCSIRequest
*req
)
157 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
158 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
161 if (r
->sector_count
== (uint32_t)-1) {
162 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
164 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
167 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
168 if (r
->sector_count
== 0) {
169 /* This also clears the sense buffer for REQUEST SENSE. */
170 scsi_req_complete(&r
->req
, GOOD
);
174 /* No data transfer may already be in progress */
175 assert(r
->req
.aiocb
== NULL
);
177 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
178 DPRINTF("Data transfer direction invalid\n");
179 scsi_read_complete(r
, -EINVAL
);
184 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
185 n
= SCSI_DMA_BUF_SIZE
/ 512;
188 scsi_read_complete(r
, -ENOMEDIUM
);
190 r
->iov
.iov_len
= n
* 512;
191 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
193 bdrv_acct_start(s
->bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_READ
);
194 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
195 scsi_read_complete
, r
);
196 if (r
->req
.aiocb
== NULL
) {
197 scsi_read_complete(r
, -EIO
);
201 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
203 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
204 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
205 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
207 if (action
== BLOCK_ERR_IGNORE
) {
208 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
212 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
213 || action
== BLOCK_ERR_STOP_ANY
) {
215 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
216 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
218 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
219 vm_stop(VMSTOP_DISKFULL
);
223 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
226 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
229 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
232 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
237 static void scsi_write_complete(void * opaque
, int ret
)
239 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
240 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
244 if (r
->req
.aiocb
!= NULL
) {
246 bdrv_acct_done(s
->bs
, &r
->acct
);
250 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
255 n
= r
->iov
.iov_len
/ 512;
257 r
->sector_count
-= n
;
258 if (r
->sector_count
== 0) {
259 scsi_req_complete(&r
->req
, GOOD
);
261 len
= r
->sector_count
* 512;
262 if (len
> SCSI_DMA_BUF_SIZE
) {
263 len
= SCSI_DMA_BUF_SIZE
;
265 r
->iov
.iov_len
= len
;
266 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
267 scsi_req_data(&r
->req
, len
);
271 static void scsi_write_data(SCSIRequest
*req
)
273 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
274 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
277 /* No data transfer may already be in progress */
278 assert(r
->req
.aiocb
== NULL
);
280 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
281 DPRINTF("Data transfer direction invalid\n");
282 scsi_write_complete(r
, -EINVAL
);
286 n
= r
->iov
.iov_len
/ 512;
289 scsi_write_complete(r
, -ENOMEDIUM
);
291 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
293 bdrv_acct_start(s
->bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_WRITE
);
294 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
295 scsi_write_complete
, r
);
296 if (r
->req
.aiocb
== NULL
) {
297 scsi_write_complete(r
, -ENOMEM
);
300 /* Invoke completion routine to fetch data from host. */
301 scsi_write_complete(r
, 0);
305 static void scsi_dma_restart_bh(void *opaque
)
307 SCSIDiskState
*s
= opaque
;
311 qemu_bh_delete(s
->bh
);
314 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
315 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
316 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
317 int status
= r
->status
;
321 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
323 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
324 case SCSI_REQ_STATUS_RETRY_READ
:
325 scsi_read_data(&r
->req
);
327 case SCSI_REQ_STATUS_RETRY_WRITE
:
328 scsi_write_data(&r
->req
);
330 case SCSI_REQ_STATUS_RETRY_FLUSH
:
331 ret
= scsi_disk_emulate_command(r
, r
->iov
.iov_base
);
333 scsi_req_complete(&r
->req
, GOOD
);
340 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
342 SCSIDiskState
*s
= opaque
;
348 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
349 qemu_bh_schedule(s
->bh
);
353 /* Return a pointer to the data buffer. */
354 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
356 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
358 return (uint8_t *)r
->iov
.iov_base
;
361 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
363 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
366 if (req
->cmd
.buf
[1] & 0x2) {
367 /* Command support data - optional, not implemented */
368 BADF("optional INQUIRY command support request not implemented\n");
372 if (req
->cmd
.buf
[1] & 0x1) {
373 /* Vital product data */
374 uint8_t page_code
= req
->cmd
.buf
[2];
375 if (req
->cmd
.xfer
< 4) {
376 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
377 "less than 4\n", page_code
, req
->cmd
.xfer
);
381 if (s
->qdev
.type
== TYPE_ROM
) {
382 outbuf
[buflen
++] = 5;
384 outbuf
[buflen
++] = 0;
386 outbuf
[buflen
++] = page_code
; // this page
387 outbuf
[buflen
++] = 0x00;
390 case 0x00: /* Supported page codes, mandatory */
393 DPRINTF("Inquiry EVPD[Supported pages] "
394 "buffer size %zd\n", req
->cmd
.xfer
);
396 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
398 outbuf
[buflen
++] = 0x80; // unit serial number
399 outbuf
[buflen
++] = 0x83; // device identification
400 if (s
->qdev
.type
== TYPE_DISK
) {
401 outbuf
[buflen
++] = 0xb0; // block limits
402 outbuf
[buflen
++] = 0xb2; // thin provisioning
404 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
407 case 0x80: /* Device serial number, optional */
412 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
416 l
= strlen(s
->serial
);
417 if (l
> req
->cmd
.xfer
)
422 DPRINTF("Inquiry EVPD[Serial number] "
423 "buffer size %zd\n", req
->cmd
.xfer
);
424 outbuf
[buflen
++] = l
;
425 memcpy(outbuf
+buflen
, s
->serial
, l
);
430 case 0x83: /* Device identification page, mandatory */
432 int max_len
= 255 - 8;
433 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
435 if (id_len
> max_len
)
437 DPRINTF("Inquiry EVPD[Device identification] "
438 "buffer size %zd\n", req
->cmd
.xfer
);
440 outbuf
[buflen
++] = 4 + id_len
;
441 outbuf
[buflen
++] = 0x2; // ASCII
442 outbuf
[buflen
++] = 0; // not officially assigned
443 outbuf
[buflen
++] = 0; // reserved
444 outbuf
[buflen
++] = id_len
; // length of data following
446 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
450 case 0xb0: /* block limits */
452 unsigned int unmap_sectors
=
453 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
454 unsigned int min_io_size
=
455 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
456 unsigned int opt_io_size
=
457 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
459 if (s
->qdev
.type
== TYPE_ROM
) {
460 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
464 /* required VPD size with unmap support */
465 outbuf
[3] = buflen
= 0x3c;
467 memset(outbuf
+ 4, 0, buflen
- 4);
469 /* optimal transfer length granularity */
470 outbuf
[6] = (min_io_size
>> 8) & 0xff;
471 outbuf
[7] = min_io_size
& 0xff;
473 /* optimal transfer length */
474 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
475 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
476 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
477 outbuf
[15] = opt_io_size
& 0xff;
479 /* optimal unmap granularity */
480 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
481 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
482 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
483 outbuf
[31] = unmap_sectors
& 0xff;
486 case 0xb2: /* thin provisioning */
488 outbuf
[3] = buflen
= 8;
490 outbuf
[5] = 0x40; /* write same with unmap supported */
496 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
497 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
504 /* Standard INQUIRY data */
505 if (req
->cmd
.buf
[2] != 0) {
506 BADF("Error: Inquiry (STANDARD) page or code "
507 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
512 if (req
->cmd
.xfer
< 5) {
513 BADF("Error: Inquiry (STANDARD) buffer size %zd "
514 "is less than 5\n", req
->cmd
.xfer
);
518 buflen
= req
->cmd
.xfer
;
519 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
520 buflen
= SCSI_MAX_INQUIRY_LEN
;
522 memset(outbuf
, 0, buflen
);
524 outbuf
[0] = s
->qdev
.type
& 0x1f;
525 if (s
->qdev
.type
== TYPE_ROM
) {
527 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
529 outbuf
[1] = s
->removable
? 0x80 : 0;
530 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
532 memcpy(&outbuf
[8], "QEMU ", 8);
533 memset(&outbuf
[32], 0, 4);
534 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
536 * We claim conformance to SPC-3, which is required for guests
537 * to ask for modern features like READ CAPACITY(16) or the
538 * block characteristics VPD page by default. Not all of SPC-3
539 * is actually implemented, but we're good enough.
542 outbuf
[3] = 2; /* Format 2 */
545 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
547 /* If the allocation length of CDB is too small,
548 the additional length is not adjusted */
552 /* Sync data transfer and TCQ. */
553 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
557 static int mode_sense_page(SCSIDiskState
*s
, int page
, uint8_t **p_outbuf
,
560 BlockDriverState
*bdrv
= s
->bs
;
561 int cylinders
, heads
, secs
;
562 uint8_t *p
= *p_outbuf
;
565 * If Changeable Values are requested, a mask denoting those mode parameters
566 * that are changeable shall be returned. As we currently don't support
567 * parameter changes via MODE_SELECT all bits are returned set to zero.
568 * The buffer was already menset to zero by the caller of this function.
571 case 4: /* Rigid disk device geometry page. */
572 if (s
->qdev
.type
== TYPE_ROM
) {
577 if (page_control
== 1) { /* Changeable Values */
580 /* if a geometry hint is available, use it */
581 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
582 p
[2] = (cylinders
>> 16) & 0xff;
583 p
[3] = (cylinders
>> 8) & 0xff;
584 p
[4] = cylinders
& 0xff;
586 /* Write precomp start cylinder, disabled */
587 p
[6] = (cylinders
>> 16) & 0xff;
588 p
[7] = (cylinders
>> 8) & 0xff;
589 p
[8] = cylinders
& 0xff;
590 /* Reduced current start cylinder, disabled */
591 p
[9] = (cylinders
>> 16) & 0xff;
592 p
[10] = (cylinders
>> 8) & 0xff;
593 p
[11] = cylinders
& 0xff;
594 /* Device step rate [ns], 200ns */
597 /* Landing zone cylinder */
601 /* Medium rotation rate [rpm], 5400 rpm */
602 p
[20] = (5400 >> 8) & 0xff;
606 case 5: /* Flexible disk device geometry page. */
607 if (s
->qdev
.type
== TYPE_ROM
) {
612 if (page_control
== 1) { /* Changeable Values */
615 /* Transfer rate [kbit/s], 5Mbit/s */
618 /* if a geometry hint is available, use it */
619 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
622 p
[6] = s
->cluster_size
* 2;
623 p
[8] = (cylinders
>> 8) & 0xff;
624 p
[9] = cylinders
& 0xff;
625 /* Write precomp start cylinder, disabled */
626 p
[10] = (cylinders
>> 8) & 0xff;
627 p
[11] = cylinders
& 0xff;
628 /* Reduced current start cylinder, disabled */
629 p
[12] = (cylinders
>> 8) & 0xff;
630 p
[13] = cylinders
& 0xff;
631 /* Device step rate [100us], 100us */
634 /* Device step pulse width [us], 1us */
636 /* Device head settle delay [100us], 100us */
639 /* Motor on delay [0.1s], 0.1s */
641 /* Motor off delay [0.1s], 0.1s */
643 /* Medium rotation rate [rpm], 5400 rpm */
644 p
[28] = (5400 >> 8) & 0xff;
648 case 8: /* Caching page. */
651 if (page_control
== 1) { /* Changeable Values */
654 if (bdrv_enable_write_cache(s
->bs
)) {
659 case 0x2a: /* CD Capabilities and Mechanical Status page. */
660 if (s
->qdev
.type
!= TYPE_ROM
) {
665 if (page_control
== 1) { /* Changeable Values */
668 p
[2] = 3; // CD-R & CD-RW read
669 p
[3] = 0; // Writing not supported
670 p
[4] = 0x7f; /* Audio, composite, digital out,
671 mode 2 form 1&2, multi session */
672 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
673 RW corrected, C2 errors, ISRC,
675 p
[6] = 0x2d | (s
->tray_locked
? 2 : 0);
676 /* Locking supported, jumper present, eject, tray */
677 p
[7] = 0; /* no volume & mute control, no
679 p
[8] = (50 * 176) >> 8; // 50x read speed
680 p
[9] = (50 * 176) & 0xff;
681 p
[10] = 0 >> 8; // No volume
683 p
[12] = 2048 >> 8; // 2M buffer
685 p
[14] = (16 * 176) >> 8; // 16x read speed current
686 p
[15] = (16 * 176) & 0xff;
687 p
[18] = (16 * 176) >> 8; // 16x write speed
688 p
[19] = (16 * 176) & 0xff;
689 p
[20] = (16 * 176) >> 8; // 16x write speed current
690 p
[21] = (16 * 176) & 0xff;
697 *p_outbuf
+= p
[1] + 2;
701 static int scsi_disk_emulate_mode_sense(SCSIDiskReq
*r
, uint8_t *outbuf
)
703 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
705 int page
, dbd
, buflen
, ret
, page_control
;
707 uint8_t dev_specific_param
;
709 dbd
= r
->req
.cmd
.buf
[1] & 0x8;
710 page
= r
->req
.cmd
.buf
[2] & 0x3f;
711 page_control
= (r
->req
.cmd
.buf
[2] & 0xc0) >> 6;
712 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
713 (r
->req
.cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, r
->req
.cmd
.xfer
, page_control
);
714 memset(outbuf
, 0, r
->req
.cmd
.xfer
);
717 if (bdrv_is_read_only(s
->bs
)) {
718 dev_specific_param
= 0x80; /* Readonly. */
720 dev_specific_param
= 0x00;
723 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
724 p
[1] = 0; /* Default media type. */
725 p
[2] = dev_specific_param
;
726 p
[3] = 0; /* Block descriptor length. */
728 } else { /* MODE_SENSE_10 */
729 p
[2] = 0; /* Default media type. */
730 p
[3] = dev_specific_param
;
731 p
[6] = p
[7] = 0; /* Block descriptor length. */
735 bdrv_get_geometry(s
->bs
, &nb_sectors
);
736 if (!dbd
&& nb_sectors
) {
737 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
738 outbuf
[3] = 8; /* Block descriptor length */
739 } else { /* MODE_SENSE_10 */
740 outbuf
[7] = 8; /* Block descriptor length */
742 nb_sectors
/= s
->cluster_size
;
743 if (nb_sectors
> 0xffffff)
745 p
[0] = 0; /* media density code */
746 p
[1] = (nb_sectors
>> 16) & 0xff;
747 p
[2] = (nb_sectors
>> 8) & 0xff;
748 p
[3] = nb_sectors
& 0xff;
749 p
[4] = 0; /* reserved */
750 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
751 p
[6] = s
->cluster_size
* 2;
756 if (page_control
== 3) {
758 scsi_check_condition(r
, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED
));
763 for (page
= 0; page
<= 0x3e; page
++) {
764 mode_sense_page(s
, page
, &p
, page_control
);
767 ret
= mode_sense_page(s
, page
, &p
, page_control
);
775 * The mode data length field specifies the length in bytes of the
776 * following data that is available to be transferred. The mode data
777 * length does not include itself.
779 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
780 outbuf
[0] = buflen
- 1;
781 } else { /* MODE_SENSE_10 */
782 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
783 outbuf
[1] = (buflen
- 2) & 0xff;
785 if (buflen
> r
->req
.cmd
.xfer
)
786 buflen
= r
->req
.cmd
.xfer
;
790 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
792 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
793 int start_track
, format
, msf
, toclen
;
796 msf
= req
->cmd
.buf
[1] & 2;
797 format
= req
->cmd
.buf
[2] & 0xf;
798 start_track
= req
->cmd
.buf
[6];
799 bdrv_get_geometry(s
->bs
, &nb_sectors
);
800 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
801 nb_sectors
/= s
->cluster_size
;
804 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
807 /* multi session : only a single session defined */
809 memset(outbuf
, 0, 12);
815 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
820 if (toclen
> req
->cmd
.xfer
)
821 toclen
= req
->cmd
.xfer
;
825 static int scsi_disk_emulate_start_stop(SCSIDiskReq
*r
)
827 SCSIRequest
*req
= &r
->req
;
828 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
829 bool start
= req
->cmd
.buf
[4] & 1;
830 bool loej
= req
->cmd
.buf
[4] & 2; /* load on start, eject on !start */
832 if (s
->qdev
.type
== TYPE_ROM
&& loej
) {
833 if (!start
&& !s
->tray_open
&& s
->tray_locked
) {
834 scsi_check_condition(r
,
835 bdrv_is_inserted(s
->bs
)
836 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED
)
837 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED
));
840 bdrv_eject(s
->bs
, !start
);
841 s
->tray_open
= !start
;
846 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
848 SCSIRequest
*req
= &r
->req
;
849 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
853 switch (req
->cmd
.buf
[0]) {
854 case TEST_UNIT_READY
:
855 if (s
->tray_open
|| !bdrv_is_inserted(s
->bs
))
859 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
861 goto illegal_request
;
865 buflen
= scsi_disk_emulate_mode_sense(r
, outbuf
);
867 goto illegal_request
;
870 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
872 goto illegal_request
;
875 if (req
->cmd
.buf
[1] & 1)
876 goto illegal_request
;
879 if (req
->cmd
.buf
[1] & 3)
880 goto illegal_request
;
883 if (req
->cmd
.buf
[1] & 1)
884 goto illegal_request
;
887 if (req
->cmd
.buf
[1] & 3)
888 goto illegal_request
;
891 if (scsi_disk_emulate_start_stop(r
) < 0) {
895 case ALLOW_MEDIUM_REMOVAL
:
896 s
->tray_locked
= req
->cmd
.buf
[4] & 1;
897 bdrv_lock_medium(s
->bs
, req
->cmd
.buf
[4] & 1);
899 case READ_CAPACITY_10
:
900 /* The normal LEN field for this command is zero. */
901 memset(outbuf
, 0, 8);
902 bdrv_get_geometry(s
->bs
, &nb_sectors
);
905 nb_sectors
/= s
->cluster_size
;
906 /* Returned value is the address of the last sector. */
908 /* Remember the new size for read/write sanity checking. */
909 s
->max_lba
= nb_sectors
;
910 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
911 if (nb_sectors
> UINT32_MAX
)
912 nb_sectors
= UINT32_MAX
;
913 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
914 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
915 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
916 outbuf
[3] = nb_sectors
& 0xff;
919 outbuf
[6] = s
->cluster_size
* 2;
923 case GET_CONFIGURATION
:
924 memset(outbuf
, 0, 8);
925 /* ??? This should probably return much more information. For now
926 just return the basic header indicating the CD-ROM profile. */
927 outbuf
[7] = 8; // CD-ROM
930 case SERVICE_ACTION_IN_16
:
931 /* Service Action In subcommands. */
932 if ((req
->cmd
.buf
[1] & 31) == SAI_READ_CAPACITY_16
) {
933 DPRINTF("SAI READ CAPACITY(16)\n");
934 memset(outbuf
, 0, req
->cmd
.xfer
);
935 bdrv_get_geometry(s
->bs
, &nb_sectors
);
938 nb_sectors
/= s
->cluster_size
;
939 /* Returned value is the address of the last sector. */
941 /* Remember the new size for read/write sanity checking. */
942 s
->max_lba
= nb_sectors
;
943 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
944 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
945 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
946 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
947 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
948 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
949 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
950 outbuf
[7] = nb_sectors
& 0xff;
953 outbuf
[10] = s
->cluster_size
* 2;
956 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
958 /* set TPE bit if the format supports discard */
959 if (s
->qdev
.conf
.discard_granularity
) {
963 /* Protection, exponent and lowest lba field left blank. */
964 buflen
= req
->cmd
.xfer
;
967 DPRINTF("Unsupported Service Action In\n");
968 goto illegal_request
;
972 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
978 if (s
->tray_open
|| !bdrv_is_inserted(s
->bs
)) {
979 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
981 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
986 if (r
->req
.status
== -1) {
987 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
992 /* Execute a scsi command. Returns the length of the data expected by the
993 command. This will be Positive for data transfers from the device
994 (eg. disk reads), negative for transfers to the device (eg. disk writes),
995 and zero if the command does not transfer any data. */
997 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
999 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1000 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1007 outbuf
= (uint8_t *)r
->iov
.iov_base
;
1008 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req
->lun
, req
->tag
, buf
[0]);
1013 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
1014 printf(" 0x%02x", buf
[i
]);
1021 case TEST_UNIT_READY
:
1030 case ALLOW_MEDIUM_REMOVAL
:
1031 case READ_CAPACITY_10
:
1033 case GET_CONFIGURATION
:
1034 case SERVICE_ACTION_IN_16
:
1036 rc
= scsi_disk_emulate_command(r
, outbuf
);
1041 r
->iov
.iov_len
= rc
;
1043 case SYNCHRONIZE_CACHE
:
1044 bdrv_acct_start(s
->bs
, &r
->acct
, 0, BDRV_ACCT_FLUSH
);
1045 r
->req
.aiocb
= bdrv_aio_flush(s
->bs
, scsi_flush_complete
, r
);
1046 if (r
->req
.aiocb
== NULL
) {
1047 scsi_flush_complete(r
, -EIO
);
1054 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1055 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1056 if (r
->req
.cmd
.lba
> s
->max_lba
)
1058 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1059 r
->sector_count
= len
* s
->cluster_size
;
1065 case WRITE_VERIFY_10
:
1066 case WRITE_VERIFY_12
:
1067 case WRITE_VERIFY_16
:
1068 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1069 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1070 (command
& 0xe) == 0xe ? "And Verify " : "",
1071 r
->req
.cmd
.lba
, len
);
1072 if (r
->req
.cmd
.lba
> s
->max_lba
)
1074 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1075 r
->sector_count
= len
* s
->cluster_size
;
1078 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1079 /* We don't support mode parameter changes.
1080 Allow the mode parameter header + block descriptors only. */
1081 if (r
->req
.cmd
.xfer
> 12) {
1085 case MODE_SELECT_10
:
1086 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1087 /* We don't support mode parameter changes.
1088 Allow the mode parameter header + block descriptors only. */
1089 if (r
->req
.cmd
.xfer
> 16) {
1095 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1097 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1102 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1104 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1105 r
->req
.cmd
.lba
, len
);
1107 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1112 * We only support WRITE SAME with the unmap bit set for now.
1114 if (!(buf
[1] & 0x8)) {
1118 rc
= bdrv_discard(s
->bs
, r
->req
.cmd
.lba
* s
->cluster_size
,
1119 len
* s
->cluster_size
);
1121 /* XXX: better error code ?*/
1129 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1130 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1133 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1136 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1139 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1140 scsi_req_complete(&r
->req
, GOOD
);
1142 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1143 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
1146 if (!r
->sector_count
)
1147 r
->sector_count
= -1;
1152 static void scsi_disk_reset(DeviceState
*dev
)
1154 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1155 uint64_t nb_sectors
;
1157 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(RESET
));
1159 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1160 nb_sectors
/= s
->cluster_size
;
1164 s
->max_lba
= nb_sectors
;
1167 static void scsi_destroy(SCSIDevice
*dev
)
1169 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1171 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(NO_SENSE
));
1172 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1175 static bool scsi_cd_is_medium_locked(void *opaque
)
1177 return ((SCSIDiskState
*)opaque
)->tray_locked
;
1180 static const BlockDevOps scsi_cd_block_ops
= {
1181 .is_medium_locked
= scsi_cd_is_medium_locked
,
1184 static int scsi_initfn(SCSIDevice
*dev
, uint8_t scsi_type
)
1186 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1189 if (!s
->qdev
.conf
.bs
) {
1190 error_report("scsi-disk: drive property not set");
1193 s
->bs
= s
->qdev
.conf
.bs
;
1195 if (scsi_type
== TYPE_DISK
&& !bdrv_is_inserted(s
->bs
)) {
1196 error_report("Device needs media, but drive is empty");
1201 /* try to fall back to value set with legacy -drive serial=... */
1202 dinfo
= drive_get_by_blockdev(s
->bs
);
1203 if (*dinfo
->serial
) {
1204 s
->serial
= g_strdup(dinfo
->serial
);
1209 s
->version
= g_strdup(QEMU_VERSION
);
1212 if (bdrv_is_sg(s
->bs
)) {
1213 error_report("scsi-disk: unwanted /dev/sg*");
1217 if (scsi_type
== TYPE_ROM
) {
1218 bdrv_set_dev_ops(s
->bs
, &scsi_cd_block_ops
, s
);
1219 s
->qdev
.blocksize
= 2048;
1220 } else if (scsi_type
== TYPE_DISK
) {
1221 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1223 error_report("scsi-disk: Unhandled SCSI type %02x", scsi_type
);
1226 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1227 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1229 s
->qdev
.type
= scsi_type
;
1230 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1231 bdrv_set_removable(s
->bs
, scsi_type
== TYPE_ROM
);
1232 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1236 static int scsi_hd_initfn(SCSIDevice
*dev
)
1238 return scsi_initfn(dev
, TYPE_DISK
);
1241 static int scsi_cd_initfn(SCSIDevice
*dev
)
1243 return scsi_initfn(dev
, TYPE_ROM
);
1246 static int scsi_disk_initfn(SCSIDevice
*dev
)
1251 if (!dev
->conf
.bs
) {
1252 scsi_type
= TYPE_DISK
; /* will die in scsi_initfn() */
1254 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1255 scsi_type
= dinfo
->media_cd
? TYPE_ROM
: TYPE_DISK
;
1258 return scsi_initfn(dev
, scsi_type
);
1261 static SCSIReqOps scsi_disk_reqops
= {
1262 .size
= sizeof(SCSIDiskReq
),
1263 .free_req
= scsi_free_request
,
1264 .send_command
= scsi_send_command
,
1265 .read_data
= scsi_read_data
,
1266 .write_data
= scsi_write_data
,
1267 .cancel_io
= scsi_cancel_io
,
1268 .get_buf
= scsi_get_buf
,
1271 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
,
1272 uint32_t lun
, void *hba_private
)
1274 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1278 req
= scsi_req_alloc(&scsi_disk_reqops
, &s
->qdev
, tag
, lun
, hba_private
);
1279 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1280 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
1284 #define DEFINE_SCSI_DISK_PROPERTIES() \
1285 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1286 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1287 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1289 static SCSIDeviceInfo scsi_disk_info
[] = {
1291 .qdev
.name
= "scsi-hd",
1292 .qdev
.fw_name
= "disk",
1293 .qdev
.desc
= "virtual SCSI disk",
1294 .qdev
.size
= sizeof(SCSIDiskState
),
1295 .qdev
.reset
= scsi_disk_reset
,
1296 .init
= scsi_hd_initfn
,
1297 .destroy
= scsi_destroy
,
1298 .alloc_req
= scsi_new_request
,
1299 .qdev
.props
= (Property
[]) {
1300 DEFINE_SCSI_DISK_PROPERTIES(),
1301 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1302 DEFINE_PROP_END_OF_LIST(),
1305 .qdev
.name
= "scsi-cd",
1306 .qdev
.fw_name
= "disk",
1307 .qdev
.desc
= "virtual SCSI CD-ROM",
1308 .qdev
.size
= sizeof(SCSIDiskState
),
1309 .qdev
.reset
= scsi_disk_reset
,
1310 .init
= scsi_cd_initfn
,
1311 .destroy
= scsi_destroy
,
1312 .alloc_req
= scsi_new_request
,
1313 .qdev
.props
= (Property
[]) {
1314 DEFINE_SCSI_DISK_PROPERTIES(),
1315 DEFINE_PROP_END_OF_LIST(),
1318 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1319 .qdev
.fw_name
= "disk",
1320 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1321 .qdev
.size
= sizeof(SCSIDiskState
),
1322 .qdev
.reset
= scsi_disk_reset
,
1323 .init
= scsi_disk_initfn
,
1324 .destroy
= scsi_destroy
,
1325 .alloc_req
= scsi_new_request
,
1326 .qdev
.props
= (Property
[]) {
1327 DEFINE_SCSI_DISK_PROPERTIES(),
1328 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1329 DEFINE_PROP_END_OF_LIST(),
1334 static void scsi_disk_register_devices(void)
1338 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1339 scsi_qdev_register(&scsi_disk_info
[i
]);
1342 device_init(scsi_disk_register_devices
)