2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
48 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSIDiskReq
{
54 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
56 uint32_t sector_count
;
66 /* The qemu block layer uses a fixed 512 byte sector size.
67 This is the number of 512 byte blocks in a single scsi sector. */
76 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
77 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
);
79 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
,
80 uint32_t lun
, void *hba_private
)
82 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
86 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), &s
->qdev
, tag
, lun
, hba_private
);
87 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
88 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
92 static void scsi_free_request(SCSIRequest
*req
)
94 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
96 qemu_vfree(r
->iov
.iov_base
);
99 /* Helper function for command completion with sense. */
100 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
102 DPRINTF("Command complete tag=0x%x status=%d sense=%d/%d/%d\n",
103 r
->req
.tag
, status
, sense
.key
, sense
.asc
, sense
.ascq
);
104 scsi_req_build_sense(&r
->req
, sense
);
105 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
108 /* Cancel a pending data transfer. */
109 static void scsi_cancel_io(SCSIRequest
*req
)
111 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
113 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
115 bdrv_aio_cancel(r
->req
.aiocb
);
120 static void scsi_read_complete(void * opaque
, int ret
)
122 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
128 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
133 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
135 n
= r
->iov
.iov_len
/ 512;
137 r
->sector_count
-= n
;
138 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
142 /* Read more data from scsi device into buffer. */
143 static void scsi_read_data(SCSIRequest
*req
)
145 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
146 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
149 if (r
->sector_count
== (uint32_t)-1) {
150 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
152 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
155 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
156 if (r
->sector_count
== 0) {
157 /* This also clears the sense buffer for REQUEST SENSE. */
158 scsi_req_complete(&r
->req
, GOOD
);
162 /* No data transfer may already be in progress */
163 assert(r
->req
.aiocb
== NULL
);
165 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
166 DPRINTF("Data transfer direction invalid\n");
167 scsi_read_complete(r
, -EINVAL
);
172 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
173 n
= SCSI_DMA_BUF_SIZE
/ 512;
175 r
->iov
.iov_len
= n
* 512;
176 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
177 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
178 scsi_read_complete
, r
);
179 if (r
->req
.aiocb
== NULL
) {
180 scsi_read_complete(r
, -EIO
);
184 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
186 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
187 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
188 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
190 if (action
== BLOCK_ERR_IGNORE
) {
191 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
195 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
196 || action
== BLOCK_ERR_STOP_ANY
) {
198 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
199 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
201 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
202 vm_stop(VMSTOP_DISKFULL
);
206 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
209 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
212 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
215 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
220 static void scsi_write_complete(void * opaque
, int ret
)
222 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
229 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
234 n
= r
->iov
.iov_len
/ 512;
236 r
->sector_count
-= n
;
237 if (r
->sector_count
== 0) {
238 scsi_req_complete(&r
->req
, GOOD
);
240 len
= r
->sector_count
* 512;
241 if (len
> SCSI_DMA_BUF_SIZE
) {
242 len
= SCSI_DMA_BUF_SIZE
;
244 r
->iov
.iov_len
= len
;
245 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
246 scsi_req_data(&r
->req
, len
);
250 static void scsi_write_data(SCSIRequest
*req
)
252 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
253 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
256 /* No data transfer may already be in progress */
257 assert(r
->req
.aiocb
== NULL
);
259 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
260 DPRINTF("Data transfer direction invalid\n");
261 scsi_write_complete(r
, -EINVAL
);
265 n
= r
->iov
.iov_len
/ 512;
267 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
268 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
269 scsi_write_complete
, r
);
270 if (r
->req
.aiocb
== NULL
) {
271 scsi_write_complete(r
, -ENOMEM
);
274 /* Invoke completion routine to fetch data from host. */
275 scsi_write_complete(r
, 0);
279 static void scsi_dma_restart_bh(void *opaque
)
281 SCSIDiskState
*s
= opaque
;
285 qemu_bh_delete(s
->bh
);
288 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
289 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
290 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
291 int status
= r
->status
;
295 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
297 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
298 case SCSI_REQ_STATUS_RETRY_READ
:
299 scsi_read_data(&r
->req
);
301 case SCSI_REQ_STATUS_RETRY_WRITE
:
302 scsi_write_data(&r
->req
);
304 case SCSI_REQ_STATUS_RETRY_FLUSH
:
305 ret
= scsi_disk_emulate_command(r
, r
->iov
.iov_base
);
307 scsi_req_complete(&r
->req
, GOOD
);
314 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
316 SCSIDiskState
*s
= opaque
;
322 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
323 qemu_bh_schedule(s
->bh
);
327 /* Return a pointer to the data buffer. */
328 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
330 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
332 return (uint8_t *)r
->iov
.iov_base
;
335 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
337 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
340 if (req
->cmd
.buf
[1] & 0x2) {
341 /* Command support data - optional, not implemented */
342 BADF("optional INQUIRY command support request not implemented\n");
346 if (req
->cmd
.buf
[1] & 0x1) {
347 /* Vital product data */
348 uint8_t page_code
= req
->cmd
.buf
[2];
349 if (req
->cmd
.xfer
< 4) {
350 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
351 "less than 4\n", page_code
, req
->cmd
.xfer
);
355 if (s
->qdev
.type
== TYPE_ROM
) {
356 outbuf
[buflen
++] = 5;
358 outbuf
[buflen
++] = 0;
360 outbuf
[buflen
++] = page_code
; // this page
361 outbuf
[buflen
++] = 0x00;
364 case 0x00: /* Supported page codes, mandatory */
367 DPRINTF("Inquiry EVPD[Supported pages] "
368 "buffer size %zd\n", req
->cmd
.xfer
);
370 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
372 outbuf
[buflen
++] = 0x80; // unit serial number
373 outbuf
[buflen
++] = 0x83; // device identification
374 if (s
->qdev
.type
== TYPE_DISK
) {
375 outbuf
[buflen
++] = 0xb0; // block limits
376 outbuf
[buflen
++] = 0xb2; // thin provisioning
378 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
381 case 0x80: /* Device serial number, optional */
386 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
390 l
= strlen(s
->serial
);
391 if (l
> req
->cmd
.xfer
)
396 DPRINTF("Inquiry EVPD[Serial number] "
397 "buffer size %zd\n", req
->cmd
.xfer
);
398 outbuf
[buflen
++] = l
;
399 memcpy(outbuf
+buflen
, s
->serial
, l
);
404 case 0x83: /* Device identification page, mandatory */
406 int max_len
= 255 - 8;
407 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
409 if (id_len
> max_len
)
411 DPRINTF("Inquiry EVPD[Device identification] "
412 "buffer size %zd\n", req
->cmd
.xfer
);
414 outbuf
[buflen
++] = 4 + id_len
;
415 outbuf
[buflen
++] = 0x2; // ASCII
416 outbuf
[buflen
++] = 0; // not officially assigned
417 outbuf
[buflen
++] = 0; // reserved
418 outbuf
[buflen
++] = id_len
; // length of data following
420 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
424 case 0xb0: /* block limits */
426 unsigned int unmap_sectors
=
427 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
428 unsigned int min_io_size
=
429 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
430 unsigned int opt_io_size
=
431 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
433 if (s
->qdev
.type
== TYPE_ROM
) {
434 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
438 /* required VPD size with unmap support */
439 outbuf
[3] = buflen
= 0x3c;
441 memset(outbuf
+ 4, 0, buflen
- 4);
443 /* optimal transfer length granularity */
444 outbuf
[6] = (min_io_size
>> 8) & 0xff;
445 outbuf
[7] = min_io_size
& 0xff;
447 /* optimal transfer length */
448 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
449 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
450 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
451 outbuf
[15] = opt_io_size
& 0xff;
453 /* optimal unmap granularity */
454 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
455 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
456 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
457 outbuf
[31] = unmap_sectors
& 0xff;
460 case 0xb2: /* thin provisioning */
462 outbuf
[3] = buflen
= 8;
464 outbuf
[5] = 0x40; /* write same with unmap supported */
470 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
471 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
478 /* Standard INQUIRY data */
479 if (req
->cmd
.buf
[2] != 0) {
480 BADF("Error: Inquiry (STANDARD) page or code "
481 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
486 if (req
->cmd
.xfer
< 5) {
487 BADF("Error: Inquiry (STANDARD) buffer size %zd "
488 "is less than 5\n", req
->cmd
.xfer
);
492 buflen
= req
->cmd
.xfer
;
493 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
494 buflen
= SCSI_MAX_INQUIRY_LEN
;
496 memset(outbuf
, 0, buflen
);
499 outbuf
[0] = 0x7f; /* LUN not supported */
503 outbuf
[0] = s
->qdev
.type
& 0x1f;
504 if (s
->qdev
.type
== TYPE_ROM
) {
506 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
508 outbuf
[1] = s
->removable
? 0x80 : 0;
509 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
511 memcpy(&outbuf
[8], "QEMU ", 8);
512 memset(&outbuf
[32], 0, 4);
513 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
515 * We claim conformance to SPC-3, which is required for guests
516 * to ask for modern features like READ CAPACITY(16) or the
517 * block characteristics VPD page by default. Not all of SPC-3
518 * is actually implemented, but we're good enough.
521 outbuf
[3] = 2; /* Format 2 */
524 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
526 /* If the allocation length of CDB is too small,
527 the additional length is not adjusted */
531 /* Sync data transfer and TCQ. */
532 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
536 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
,
539 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
540 BlockDriverState
*bdrv
= s
->bs
;
541 int cylinders
, heads
, secs
;
544 * If Changeable Values are requested, a mask denoting those mode parameters
545 * that are changeable shall be returned. As we currently don't support
546 * parameter changes via MODE_SELECT all bits are returned set to zero.
547 * The buffer was already menset to zero by the caller of this function.
550 case 4: /* Rigid disk device geometry page. */
553 if (page_control
== 1) { /* Changeable Values */
556 /* if a geometry hint is available, use it */
557 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
558 p
[2] = (cylinders
>> 16) & 0xff;
559 p
[3] = (cylinders
>> 8) & 0xff;
560 p
[4] = cylinders
& 0xff;
562 /* Write precomp start cylinder, disabled */
563 p
[6] = (cylinders
>> 16) & 0xff;
564 p
[7] = (cylinders
>> 8) & 0xff;
565 p
[8] = cylinders
& 0xff;
566 /* Reduced current start cylinder, disabled */
567 p
[9] = (cylinders
>> 16) & 0xff;
568 p
[10] = (cylinders
>> 8) & 0xff;
569 p
[11] = cylinders
& 0xff;
570 /* Device step rate [ns], 200ns */
573 /* Landing zone cylinder */
577 /* Medium rotation rate [rpm], 5400 rpm */
578 p
[20] = (5400 >> 8) & 0xff;
582 case 5: /* Flexible disk device geometry page. */
585 if (page_control
== 1) { /* Changeable Values */
588 /* Transfer rate [kbit/s], 5Mbit/s */
591 /* if a geometry hint is available, use it */
592 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
595 p
[6] = s
->cluster_size
* 2;
596 p
[8] = (cylinders
>> 8) & 0xff;
597 p
[9] = cylinders
& 0xff;
598 /* Write precomp start cylinder, disabled */
599 p
[10] = (cylinders
>> 8) & 0xff;
600 p
[11] = cylinders
& 0xff;
601 /* Reduced current start cylinder, disabled */
602 p
[12] = (cylinders
>> 8) & 0xff;
603 p
[13] = cylinders
& 0xff;
604 /* Device step rate [100us], 100us */
607 /* Device step pulse width [us], 1us */
609 /* Device head settle delay [100us], 100us */
612 /* Motor on delay [0.1s], 0.1s */
614 /* Motor off delay [0.1s], 0.1s */
616 /* Medium rotation rate [rpm], 5400 rpm */
617 p
[28] = (5400 >> 8) & 0xff;
621 case 8: /* Caching page. */
624 if (page_control
== 1) { /* Changeable Values */
627 if (bdrv_enable_write_cache(s
->bs
)) {
632 case 0x2a: /* CD Capabilities and Mechanical Status page. */
633 if (s
->qdev
.type
!= TYPE_ROM
)
637 if (page_control
== 1) { /* Changeable Values */
640 p
[2] = 3; // CD-R & CD-RW read
641 p
[3] = 0; // Writing not supported
642 p
[4] = 0x7f; /* Audio, composite, digital out,
643 mode 2 form 1&2, multi session */
644 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
645 RW corrected, C2 errors, ISRC,
647 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
648 /* Locking supported, jumper present, eject, tray */
649 p
[7] = 0; /* no volume & mute control, no
651 p
[8] = (50 * 176) >> 8; // 50x read speed
652 p
[9] = (50 * 176) & 0xff;
653 p
[10] = 0 >> 8; // No volume
655 p
[12] = 2048 >> 8; // 2M buffer
657 p
[14] = (16 * 176) >> 8; // 16x read speed current
658 p
[15] = (16 * 176) & 0xff;
659 p
[18] = (16 * 176) >> 8; // 16x write speed
660 p
[19] = (16 * 176) & 0xff;
661 p
[20] = (16 * 176) >> 8; // 16x write speed current
662 p
[21] = (16 * 176) & 0xff;
670 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
672 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
674 int page
, dbd
, buflen
, page_control
;
676 uint8_t dev_specific_param
;
678 dbd
= req
->cmd
.buf
[1] & 0x8;
679 page
= req
->cmd
.buf
[2] & 0x3f;
680 page_control
= (req
->cmd
.buf
[2] & 0xc0) >> 6;
681 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
682 (req
->cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, req
->cmd
.xfer
, page_control
);
683 memset(outbuf
, 0, req
->cmd
.xfer
);
686 if (bdrv_is_read_only(s
->bs
)) {
687 dev_specific_param
= 0x80; /* Readonly. */
689 dev_specific_param
= 0x00;
692 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
693 p
[1] = 0; /* Default media type. */
694 p
[2] = dev_specific_param
;
695 p
[3] = 0; /* Block descriptor length. */
697 } else { /* MODE_SENSE_10 */
698 p
[2] = 0; /* Default media type. */
699 p
[3] = dev_specific_param
;
700 p
[6] = p
[7] = 0; /* Block descriptor length. */
704 bdrv_get_geometry(s
->bs
, &nb_sectors
);
705 if (!dbd
&& nb_sectors
) {
706 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
707 outbuf
[3] = 8; /* Block descriptor length */
708 } else { /* MODE_SENSE_10 */
709 outbuf
[7] = 8; /* Block descriptor length */
711 nb_sectors
/= s
->cluster_size
;
712 if (nb_sectors
> 0xffffff)
714 p
[0] = 0; /* media density code */
715 p
[1] = (nb_sectors
>> 16) & 0xff;
716 p
[2] = (nb_sectors
>> 8) & 0xff;
717 p
[3] = nb_sectors
& 0xff;
718 p
[4] = 0; /* reserved */
719 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
720 p
[6] = s
->cluster_size
* 2;
725 if (page_control
== 3) { /* Saved Values */
726 return -1; /* ILLEGAL_REQUEST */
734 p
+= mode_sense_page(req
, page
, p
, page_control
);
737 p
+= mode_sense_page(req
, 0x08, p
, page_control
);
738 p
+= mode_sense_page(req
, 0x2a, p
, page_control
);
741 return -1; /* ILLEGAL_REQUEST */
746 * The mode data length field specifies the length in bytes of the
747 * following data that is available to be transferred. The mode data
748 * length does not include itself.
750 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
751 outbuf
[0] = buflen
- 1;
752 } else { /* MODE_SENSE_10 */
753 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
754 outbuf
[1] = (buflen
- 2) & 0xff;
756 if (buflen
> req
->cmd
.xfer
)
757 buflen
= req
->cmd
.xfer
;
761 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
763 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
764 int start_track
, format
, msf
, toclen
;
767 msf
= req
->cmd
.buf
[1] & 2;
768 format
= req
->cmd
.buf
[2] & 0xf;
769 start_track
= req
->cmd
.buf
[6];
770 bdrv_get_geometry(s
->bs
, &nb_sectors
);
771 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
772 nb_sectors
/= s
->cluster_size
;
775 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
778 /* multi session : only a single session defined */
780 memset(outbuf
, 0, 12);
786 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
791 if (toclen
> req
->cmd
.xfer
)
792 toclen
= req
->cmd
.xfer
;
796 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
798 SCSIRequest
*req
= &r
->req
;
799 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
804 switch (req
->cmd
.buf
[0]) {
805 case TEST_UNIT_READY
:
806 if (!bdrv_is_inserted(s
->bs
))
810 if (req
->cmd
.xfer
< 4)
811 goto illegal_request
;
812 buflen
= scsi_device_get_sense(&s
->qdev
, outbuf
, req
->cmd
.xfer
,
813 (req
->cmd
.buf
[1] & 1) == 0);
816 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
818 goto illegal_request
;
822 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
824 goto illegal_request
;
827 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
829 goto illegal_request
;
832 if (req
->cmd
.buf
[1] & 1)
833 goto illegal_request
;
836 if (req
->cmd
.buf
[1] & 3)
837 goto illegal_request
;
840 if (req
->cmd
.buf
[1] & 1)
841 goto illegal_request
;
844 if (req
->cmd
.buf
[1] & 3)
845 goto illegal_request
;
848 if (s
->qdev
.type
== TYPE_ROM
&& (req
->cmd
.buf
[4] & 2)) {
849 /* load/eject medium */
850 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
853 case ALLOW_MEDIUM_REMOVAL
:
854 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
856 case READ_CAPACITY_10
:
857 /* The normal LEN field for this command is zero. */
858 memset(outbuf
, 0, 8);
859 bdrv_get_geometry(s
->bs
, &nb_sectors
);
862 nb_sectors
/= s
->cluster_size
;
863 /* Returned value is the address of the last sector. */
865 /* Remember the new size for read/write sanity checking. */
866 s
->max_lba
= nb_sectors
;
867 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
868 if (nb_sectors
> UINT32_MAX
)
869 nb_sectors
= UINT32_MAX
;
870 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
871 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
872 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
873 outbuf
[3] = nb_sectors
& 0xff;
876 outbuf
[6] = s
->cluster_size
* 2;
880 case SYNCHRONIZE_CACHE
:
881 ret
= bdrv_flush(s
->bs
);
883 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
888 case GET_CONFIGURATION
:
889 memset(outbuf
, 0, 8);
890 /* ??? This should probably return much more information. For now
891 just return the basic header indicating the CD-ROM profile. */
892 outbuf
[7] = 8; // CD-ROM
895 case SERVICE_ACTION_IN
:
896 /* Service Action In subcommands. */
897 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
898 DPRINTF("SAI READ CAPACITY(16)\n");
899 memset(outbuf
, 0, req
->cmd
.xfer
);
900 bdrv_get_geometry(s
->bs
, &nb_sectors
);
903 nb_sectors
/= s
->cluster_size
;
904 /* Returned value is the address of the last sector. */
906 /* Remember the new size for read/write sanity checking. */
907 s
->max_lba
= nb_sectors
;
908 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
909 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
910 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
911 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
912 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
913 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
914 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
915 outbuf
[7] = nb_sectors
& 0xff;
918 outbuf
[10] = s
->cluster_size
* 2;
921 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
923 /* set TPE bit if the format supports discard */
924 if (s
->qdev
.conf
.discard_granularity
) {
928 /* Protection, exponent and lowest lba field left blank. */
929 buflen
= req
->cmd
.xfer
;
932 DPRINTF("Unsupported Service Action In\n");
933 goto illegal_request
;
935 if (req
->cmd
.xfer
< 16)
936 goto illegal_request
;
937 memset(outbuf
, 0, 16);
944 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
950 if (!bdrv_is_inserted(s
->bs
)) {
951 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
953 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
958 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
962 /* Execute a scsi command. Returns the length of the data expected by the
963 command. This will be Positive for data transfers from the device
964 (eg. disk reads), negative for transfers to the device (eg. disk writes),
965 and zero if the command does not transfer any data. */
967 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
969 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
970 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
977 outbuf
= (uint8_t *)r
->iov
.iov_base
;
978 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req
->lun
, req
->tag
, buf
[0]);
980 if (scsi_req_parse(&r
->req
, buf
) != 0) {
981 BADF("Unsupported command length, command %x\n", command
);
982 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
988 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
989 printf(" 0x%02x", buf
[i
]);
996 /* Only LUN 0 supported. */
997 DPRINTF("Unimplemented LUN %d\n", req
->lun
);
998 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
) {
999 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_SUPPORTED
));
1004 case TEST_UNIT_READY
:
1014 case ALLOW_MEDIUM_REMOVAL
:
1015 case READ_CAPACITY_10
:
1016 case SYNCHRONIZE_CACHE
:
1018 case GET_CONFIGURATION
:
1019 case SERVICE_ACTION_IN
:
1022 rc
= scsi_disk_emulate_command(r
, outbuf
);
1027 r
->iov
.iov_len
= rc
;
1033 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1034 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1035 if (r
->req
.cmd
.lba
> s
->max_lba
)
1037 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1038 r
->sector_count
= len
* s
->cluster_size
;
1044 case WRITE_VERIFY_10
:
1045 case WRITE_VERIFY_12
:
1046 case WRITE_VERIFY_16
:
1047 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1048 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1049 (command
& 0xe) == 0xe ? "And Verify " : "",
1050 r
->req
.cmd
.lba
, len
);
1051 if (r
->req
.cmd
.lba
> s
->max_lba
)
1053 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1054 r
->sector_count
= len
* s
->cluster_size
;
1057 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1058 /* We don't support mode parameter changes.
1059 Allow the mode parameter header + block descriptors only. */
1060 if (r
->req
.cmd
.xfer
> 12) {
1064 case MODE_SELECT_10
:
1065 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1066 /* We don't support mode parameter changes.
1067 Allow the mode parameter header + block descriptors only. */
1068 if (r
->req
.cmd
.xfer
> 16) {
1074 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1076 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1081 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1083 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1084 r
->req
.cmd
.lba
, len
);
1086 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1091 * We only support WRITE SAME with the unmap bit set for now.
1093 if (!(buf
[1] & 0x8)) {
1097 rc
= bdrv_discard(s
->bs
, r
->req
.cmd
.lba
* s
->cluster_size
,
1098 len
* s
->cluster_size
);
1100 /* XXX: better error code ?*/
1106 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1107 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1110 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1113 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1116 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1117 scsi_req_complete(&r
->req
, GOOD
);
1119 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1120 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
1123 if (!r
->sector_count
)
1124 r
->sector_count
= -1;
1129 static void scsi_disk_reset(DeviceState
*dev
)
1131 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1132 uint64_t nb_sectors
;
1134 scsi_device_purge_requests(&s
->qdev
);
1136 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1137 nb_sectors
/= s
->cluster_size
;
1141 s
->max_lba
= nb_sectors
;
1144 static void scsi_destroy(SCSIDevice
*dev
)
1146 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1148 scsi_device_purge_requests(&s
->qdev
);
1149 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1152 static int scsi_initfn(SCSIDevice
*dev
, uint8_t scsi_type
)
1154 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1157 if (!s
->qdev
.conf
.bs
) {
1158 error_report("scsi-disk: drive property not set");
1161 s
->bs
= s
->qdev
.conf
.bs
;
1163 if (scsi_type
== TYPE_DISK
&& !bdrv_is_inserted(s
->bs
)) {
1164 error_report("Device needs media, but drive is empty");
1169 /* try to fall back to value set with legacy -drive serial=... */
1170 dinfo
= drive_get_by_blockdev(s
->bs
);
1171 if (*dinfo
->serial
) {
1172 s
->serial
= qemu_strdup(dinfo
->serial
);
1177 s
->version
= qemu_strdup(QEMU_VERSION
);
1180 if (bdrv_is_sg(s
->bs
)) {
1181 error_report("scsi-disk: unwanted /dev/sg*");
1185 if (scsi_type
== TYPE_ROM
) {
1186 s
->qdev
.blocksize
= 2048;
1187 } else if (scsi_type
== TYPE_DISK
) {
1188 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1190 error_report("scsi-disk: Unhandled SCSI type %02x", scsi_type
);
1193 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1194 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1196 s
->qdev
.type
= scsi_type
;
1197 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1198 bdrv_set_removable(s
->bs
, scsi_type
== TYPE_ROM
);
1199 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1203 static int scsi_hd_initfn(SCSIDevice
*dev
)
1205 return scsi_initfn(dev
, TYPE_DISK
);
1208 static int scsi_cd_initfn(SCSIDevice
*dev
)
1210 return scsi_initfn(dev
, TYPE_ROM
);
1213 static int scsi_disk_initfn(SCSIDevice
*dev
)
1218 if (!dev
->conf
.bs
) {
1219 scsi_type
= TYPE_DISK
; /* will die in scsi_initfn() */
1221 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1222 scsi_type
= dinfo
->media_cd
? TYPE_ROM
: TYPE_DISK
;
1225 return scsi_initfn(dev
, scsi_type
);
1228 #define DEFINE_SCSI_DISK_PROPERTIES() \
1229 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1230 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1231 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1233 static SCSIDeviceInfo scsi_disk_info
[] = {
1235 .qdev
.name
= "scsi-hd",
1236 .qdev
.fw_name
= "disk",
1237 .qdev
.desc
= "virtual SCSI disk",
1238 .qdev
.size
= sizeof(SCSIDiskState
),
1239 .qdev
.reset
= scsi_disk_reset
,
1240 .init
= scsi_hd_initfn
,
1241 .destroy
= scsi_destroy
,
1242 .alloc_req
= scsi_new_request
,
1243 .free_req
= scsi_free_request
,
1244 .send_command
= scsi_send_command
,
1245 .read_data
= scsi_read_data
,
1246 .write_data
= scsi_write_data
,
1247 .cancel_io
= scsi_cancel_io
,
1248 .get_buf
= scsi_get_buf
,
1249 .qdev
.props
= (Property
[]) {
1250 DEFINE_SCSI_DISK_PROPERTIES(),
1251 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1252 DEFINE_PROP_END_OF_LIST(),
1255 .qdev
.name
= "scsi-cd",
1256 .qdev
.fw_name
= "disk",
1257 .qdev
.desc
= "virtual SCSI CD-ROM",
1258 .qdev
.size
= sizeof(SCSIDiskState
),
1259 .qdev
.reset
= scsi_disk_reset
,
1260 .init
= scsi_cd_initfn
,
1261 .destroy
= scsi_destroy
,
1262 .alloc_req
= scsi_new_request
,
1263 .free_req
= scsi_free_request
,
1264 .send_command
= scsi_send_command
,
1265 .read_data
= scsi_read_data
,
1266 .write_data
= scsi_write_data
,
1267 .cancel_io
= scsi_cancel_io
,
1268 .get_buf
= scsi_get_buf
,
1269 .qdev
.props
= (Property
[]) {
1270 DEFINE_SCSI_DISK_PROPERTIES(),
1271 DEFINE_PROP_END_OF_LIST(),
1274 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1275 .qdev
.fw_name
= "disk",
1276 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1277 .qdev
.size
= sizeof(SCSIDiskState
),
1278 .qdev
.reset
= scsi_disk_reset
,
1279 .init
= scsi_disk_initfn
,
1280 .destroy
= scsi_destroy
,
1281 .alloc_req
= scsi_new_request
,
1282 .free_req
= scsi_free_request
,
1283 .send_command
= scsi_send_command
,
1284 .read_data
= scsi_read_data
,
1285 .write_data
= scsi_write_data
,
1286 .cancel_io
= scsi_cancel_io
,
1287 .get_buf
= scsi_get_buf
,
1288 .qdev
.props
= (Property
[]) {
1289 DEFINE_SCSI_DISK_PROPERTIES(),
1290 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1291 DEFINE_PROP_END_OF_LIST(),
1296 static void scsi_disk_register_devices(void)
1300 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1301 scsi_qdev_register(&scsi_disk_info
[i
]);
1304 device_init(scsi_disk_register_devices
)