2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #include "qemu-common.h"
32 #include "qemu/error-report.h"
33 #include "hw/scsi/scsi.h"
34 #include "block/scsi.h"
35 #include "sysemu/sysemu.h"
36 #include "sysemu/block-backend.h"
37 #include "sysemu/blockdev.h"
38 #include "hw/block/block.h"
39 #include "sysemu/dma.h"
45 #define SCSI_WRITE_SAME_MAX 524288
46 #define SCSI_DMA_BUF_SIZE 131072
47 #define SCSI_MAX_INQUIRY_LEN 256
48 #define SCSI_MAX_MODE_LEN 256
50 #define DEFAULT_DISCARD_GRANULARITY 4096
51 #define DEFAULT_MAX_UNMAP_SIZE (1 << 30) /* 1 GB */
53 typedef struct SCSIDiskState SCSIDiskState
;
55 typedef struct SCSIDiskReq
{
57 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
59 uint32_t sector_count
;
67 #define SCSI_DISK_F_REMOVABLE 0
68 #define SCSI_DISK_F_DPOFUA 1
69 #define SCSI_DISK_F_NO_REMOVABLE_DEVOPS 2
81 uint64_t max_unmap_size
;
91 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
);
93 static void scsi_free_request(SCSIRequest
*req
)
95 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
97 qemu_vfree(r
->iov
.iov_base
);
100 /* Helper function for command completion with sense. */
101 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
103 DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
104 r
->req
.tag
, sense
.key
, sense
.asc
, sense
.ascq
);
105 scsi_req_build_sense(&r
->req
, sense
);
106 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
109 static uint32_t scsi_init_iovec(SCSIDiskReq
*r
, size_t size
)
111 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
113 if (!r
->iov
.iov_base
) {
115 r
->iov
.iov_base
= blk_blockalign(s
->qdev
.conf
.blk
, r
->buflen
);
117 r
->iov
.iov_len
= MIN(r
->sector_count
* 512, r
->buflen
);
118 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
119 return r
->qiov
.size
/ 512;
122 static void scsi_disk_save_request(QEMUFile
*f
, SCSIRequest
*req
)
124 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
126 qemu_put_be64s(f
, &r
->sector
);
127 qemu_put_be32s(f
, &r
->sector_count
);
128 qemu_put_be32s(f
, &r
->buflen
);
130 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
131 qemu_put_buffer(f
, r
->iov
.iov_base
, r
->iov
.iov_len
);
132 } else if (!req
->retry
) {
133 uint32_t len
= r
->iov
.iov_len
;
134 qemu_put_be32s(f
, &len
);
135 qemu_put_buffer(f
, r
->iov
.iov_base
, r
->iov
.iov_len
);
140 static void scsi_disk_load_request(QEMUFile
*f
, SCSIRequest
*req
)
142 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
144 qemu_get_be64s(f
, &r
->sector
);
145 qemu_get_be32s(f
, &r
->sector_count
);
146 qemu_get_be32s(f
, &r
->buflen
);
148 scsi_init_iovec(r
, r
->buflen
);
149 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
150 qemu_get_buffer(f
, r
->iov
.iov_base
, r
->iov
.iov_len
);
151 } else if (!r
->req
.retry
) {
153 qemu_get_be32s(f
, &len
);
154 r
->iov
.iov_len
= len
;
155 assert(r
->iov
.iov_len
<= r
->buflen
);
156 qemu_get_buffer(f
, r
->iov
.iov_base
, r
->iov
.iov_len
);
160 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
163 static void scsi_aio_complete(void *opaque
, int ret
)
165 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
166 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
168 assert(r
->req
.aiocb
!= NULL
);
170 block_acct_done(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
);
171 if (r
->req
.io_canceled
) {
172 scsi_req_cancel_complete(&r
->req
);
177 if (scsi_handle_rw_error(r
, -ret
)) {
182 scsi_req_complete(&r
->req
, GOOD
);
185 scsi_req_unref(&r
->req
);
188 static bool scsi_is_cmd_fua(SCSICommand
*cmd
)
190 switch (cmd
->buf
[0]) {
197 return (cmd
->buf
[1] & 8) != 0;
202 case WRITE_VERIFY_10
:
203 case WRITE_VERIFY_12
:
204 case WRITE_VERIFY_16
:
214 static void scsi_write_do_fua(SCSIDiskReq
*r
)
216 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
218 if (r
->req
.io_canceled
) {
219 scsi_req_cancel_complete(&r
->req
);
223 if (scsi_is_cmd_fua(&r
->req
.cmd
)) {
224 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
, 0,
226 r
->req
.aiocb
= blk_aio_flush(s
->qdev
.conf
.blk
, scsi_aio_complete
, r
);
230 scsi_req_complete(&r
->req
, GOOD
);
233 scsi_req_unref(&r
->req
);
236 static void scsi_dma_complete_noio(void *opaque
, int ret
)
238 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
239 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
241 if (r
->req
.aiocb
!= NULL
) {
243 block_acct_done(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
);
245 if (r
->req
.io_canceled
) {
246 scsi_req_cancel_complete(&r
->req
);
251 if (scsi_handle_rw_error(r
, -ret
)) {
256 r
->sector
+= r
->sector_count
;
258 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
259 scsi_write_do_fua(r
);
262 scsi_req_complete(&r
->req
, GOOD
);
266 scsi_req_unref(&r
->req
);
269 static void scsi_dma_complete(void *opaque
, int ret
)
271 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
273 assert(r
->req
.aiocb
!= NULL
);
274 scsi_dma_complete_noio(opaque
, ret
);
277 static void scsi_read_complete(void * opaque
, int ret
)
279 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
280 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
283 assert(r
->req
.aiocb
!= NULL
);
285 block_acct_done(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
);
286 if (r
->req
.io_canceled
) {
287 scsi_req_cancel_complete(&r
->req
);
292 if (scsi_handle_rw_error(r
, -ret
)) {
297 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->qiov
.size
);
299 n
= r
->qiov
.size
/ 512;
301 r
->sector_count
-= n
;
302 scsi_req_data(&r
->req
, r
->qiov
.size
);
305 scsi_req_unref(&r
->req
);
308 /* Actually issue a read to the block device. */
309 static void scsi_do_read(void *opaque
, int ret
)
311 SCSIDiskReq
*r
= opaque
;
312 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
315 if (r
->req
.aiocb
!= NULL
) {
317 block_acct_done(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
);
319 if (r
->req
.io_canceled
) {
320 scsi_req_cancel_complete(&r
->req
);
325 if (scsi_handle_rw_error(r
, -ret
)) {
330 /* The request is used as the AIO opaque value, so add a ref. */
331 scsi_req_ref(&r
->req
);
334 dma_acct_start(s
->qdev
.conf
.blk
, &r
->acct
, r
->req
.sg
, BLOCK_ACCT_READ
);
335 r
->req
.resid
-= r
->req
.sg
->size
;
336 r
->req
.aiocb
= dma_blk_read(s
->qdev
.conf
.blk
, r
->req
.sg
, r
->sector
,
337 scsi_dma_complete
, r
);
339 n
= scsi_init_iovec(r
, SCSI_DMA_BUF_SIZE
);
340 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
,
341 n
* BDRV_SECTOR_SIZE
, BLOCK_ACCT_READ
);
342 r
->req
.aiocb
= blk_aio_readv(s
->qdev
.conf
.blk
, r
->sector
, &r
->qiov
, n
,
343 scsi_read_complete
, r
);
347 scsi_req_unref(&r
->req
);
350 /* Read more data from scsi device into buffer. */
351 static void scsi_read_data(SCSIRequest
*req
)
353 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
354 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
357 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
358 if (r
->sector_count
== 0) {
359 /* This also clears the sense buffer for REQUEST SENSE. */
360 scsi_req_complete(&r
->req
, GOOD
);
364 /* No data transfer may already be in progress */
365 assert(r
->req
.aiocb
== NULL
);
367 /* The request is used as the AIO opaque value, so add a ref. */
368 scsi_req_ref(&r
->req
);
369 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
370 DPRINTF("Data transfer direction invalid\n");
371 scsi_read_complete(r
, -EINVAL
);
376 scsi_read_complete(r
, -ENOMEDIUM
);
382 if (first
&& scsi_is_cmd_fua(&r
->req
.cmd
)) {
383 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
, 0,
385 r
->req
.aiocb
= blk_aio_flush(s
->qdev
.conf
.blk
, scsi_do_read
, r
);
392 * scsi_handle_rw_error has two return values. 0 means that the error
393 * must be ignored, 1 means that the error has been processed and the
394 * caller should not do anything else for this request. Note that
395 * scsi_handle_rw_error always manages its reference counts, independent
396 * of the return value.
398 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
)
400 bool is_read
= (r
->req
.cmd
.xfer
== SCSI_XFER_FROM_DEV
);
401 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
402 BlockErrorAction action
= blk_get_error_action(s
->qdev
.conf
.blk
,
405 if (action
== BLOCK_ERROR_ACTION_REPORT
) {
408 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
411 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
414 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
417 scsi_check_condition(r
, SENSE_CODE(SPACE_ALLOC_FAILED
));
420 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
424 blk_error_action(s
->qdev
.conf
.blk
, action
, is_read
, error
);
425 if (action
== BLOCK_ERROR_ACTION_STOP
) {
426 scsi_req_retry(&r
->req
);
428 return action
!= BLOCK_ERROR_ACTION_IGNORE
;
431 static void scsi_write_complete(void * opaque
, int ret
)
433 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
434 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
437 if (r
->req
.aiocb
!= NULL
) {
439 block_acct_done(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
);
441 if (r
->req
.io_canceled
) {
442 scsi_req_cancel_complete(&r
->req
);
447 if (scsi_handle_rw_error(r
, -ret
)) {
452 n
= r
->qiov
.size
/ 512;
454 r
->sector_count
-= n
;
455 if (r
->sector_count
== 0) {
456 scsi_write_do_fua(r
);
459 scsi_init_iovec(r
, SCSI_DMA_BUF_SIZE
);
460 DPRINTF("Write complete tag=0x%x more=%zd\n", r
->req
.tag
, r
->qiov
.size
);
461 scsi_req_data(&r
->req
, r
->qiov
.size
);
465 scsi_req_unref(&r
->req
);
468 static void scsi_write_data(SCSIRequest
*req
)
470 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
471 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
474 /* No data transfer may already be in progress */
475 assert(r
->req
.aiocb
== NULL
);
477 /* The request is used as the AIO opaque value, so add a ref. */
478 scsi_req_ref(&r
->req
);
479 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
480 DPRINTF("Data transfer direction invalid\n");
481 scsi_write_complete(r
, -EINVAL
);
485 if (!r
->req
.sg
&& !r
->qiov
.size
) {
486 /* Called for the first time. Ask the driver to send us more data. */
488 scsi_write_complete(r
, 0);
492 scsi_write_complete(r
, -ENOMEDIUM
);
496 if (r
->req
.cmd
.buf
[0] == VERIFY_10
|| r
->req
.cmd
.buf
[0] == VERIFY_12
||
497 r
->req
.cmd
.buf
[0] == VERIFY_16
) {
499 scsi_dma_complete_noio(r
, 0);
501 scsi_write_complete(r
, 0);
507 dma_acct_start(s
->qdev
.conf
.blk
, &r
->acct
, r
->req
.sg
, BLOCK_ACCT_WRITE
);
508 r
->req
.resid
-= r
->req
.sg
->size
;
509 r
->req
.aiocb
= dma_blk_write(s
->qdev
.conf
.blk
, r
->req
.sg
, r
->sector
,
510 scsi_dma_complete
, r
);
512 n
= r
->qiov
.size
/ 512;
513 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
,
514 n
* BDRV_SECTOR_SIZE
, BLOCK_ACCT_WRITE
);
515 r
->req
.aiocb
= blk_aio_writev(s
->qdev
.conf
.blk
, r
->sector
, &r
->qiov
, n
,
516 scsi_write_complete
, r
);
520 /* Return a pointer to the data buffer. */
521 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
523 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
525 return (uint8_t *)r
->iov
.iov_base
;
528 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
530 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
534 if (req
->cmd
.buf
[1] & 0x1) {
535 /* Vital product data */
536 uint8_t page_code
= req
->cmd
.buf
[2];
538 outbuf
[buflen
++] = s
->qdev
.type
& 0x1f;
539 outbuf
[buflen
++] = page_code
; // this page
540 outbuf
[buflen
++] = 0x00;
541 outbuf
[buflen
++] = 0x00;
545 case 0x00: /* Supported page codes, mandatory */
547 DPRINTF("Inquiry EVPD[Supported pages] "
548 "buffer size %zd\n", req
->cmd
.xfer
);
549 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
551 outbuf
[buflen
++] = 0x80; // unit serial number
553 outbuf
[buflen
++] = 0x83; // device identification
554 if (s
->qdev
.type
== TYPE_DISK
) {
555 outbuf
[buflen
++] = 0xb0; // block limits
556 outbuf
[buflen
++] = 0xb2; // thin provisioning
560 case 0x80: /* Device serial number, optional */
565 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
569 l
= strlen(s
->serial
);
574 DPRINTF("Inquiry EVPD[Serial number] "
575 "buffer size %zd\n", req
->cmd
.xfer
);
576 memcpy(outbuf
+buflen
, s
->serial
, l
);
581 case 0x83: /* Device identification page, mandatory */
583 const char *str
= s
->serial
?: blk_name(s
->qdev
.conf
.blk
);
584 int max_len
= s
->serial
? 20 : 255 - 8;
585 int id_len
= strlen(str
);
587 if (id_len
> max_len
) {
590 DPRINTF("Inquiry EVPD[Device identification] "
591 "buffer size %zd\n", req
->cmd
.xfer
);
593 outbuf
[buflen
++] = 0x2; // ASCII
594 outbuf
[buflen
++] = 0; // not officially assigned
595 outbuf
[buflen
++] = 0; // reserved
596 outbuf
[buflen
++] = id_len
; // length of data following
597 memcpy(outbuf
+buflen
, str
, id_len
);
601 outbuf
[buflen
++] = 0x1; // Binary
602 outbuf
[buflen
++] = 0x3; // NAA
603 outbuf
[buflen
++] = 0; // reserved
604 outbuf
[buflen
++] = 8;
605 stq_be_p(&outbuf
[buflen
], s
->wwn
);
610 outbuf
[buflen
++] = 0x61; // SAS / Binary
611 outbuf
[buflen
++] = 0x93; // PIV / Target port / NAA
612 outbuf
[buflen
++] = 0; // reserved
613 outbuf
[buflen
++] = 8;
614 stq_be_p(&outbuf
[buflen
], s
->port_wwn
);
619 outbuf
[buflen
++] = 0x61; // SAS / Binary
620 outbuf
[buflen
++] = 0x94; // PIV / Target port / relative target port
621 outbuf
[buflen
++] = 0; // reserved
622 outbuf
[buflen
++] = 4;
623 stw_be_p(&outbuf
[buflen
+ 2], s
->port_index
);
628 case 0xb0: /* block limits */
630 unsigned int unmap_sectors
=
631 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
632 unsigned int min_io_size
=
633 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
634 unsigned int opt_io_size
=
635 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
636 unsigned int max_unmap_sectors
=
637 s
->max_unmap_size
/ s
->qdev
.blocksize
;
639 if (s
->qdev
.type
== TYPE_ROM
) {
640 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
644 /* required VPD size with unmap support */
646 memset(outbuf
+ 4, 0, buflen
- 4);
648 outbuf
[4] = 0x1; /* wsnz */
650 /* optimal transfer length granularity */
651 outbuf
[6] = (min_io_size
>> 8) & 0xff;
652 outbuf
[7] = min_io_size
& 0xff;
654 /* optimal transfer length */
655 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
656 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
657 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
658 outbuf
[15] = opt_io_size
& 0xff;
660 /* max unmap LBA count, default is 1GB */
661 outbuf
[20] = (max_unmap_sectors
>> 24) & 0xff;
662 outbuf
[21] = (max_unmap_sectors
>> 16) & 0xff;
663 outbuf
[22] = (max_unmap_sectors
>> 8) & 0xff;
664 outbuf
[23] = max_unmap_sectors
& 0xff;
666 /* max unmap descriptors, 255 fit in 4 kb with an 8-byte header. */
672 /* optimal unmap granularity */
673 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
674 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
675 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
676 outbuf
[31] = unmap_sectors
& 0xff;
679 case 0xb2: /* thin provisioning */
683 outbuf
[5] = 0xe0; /* unmap & write_same 10/16 all supported */
684 outbuf
[6] = s
->qdev
.conf
.discard_granularity
? 2 : 1;
692 assert(buflen
- start
<= 255);
693 outbuf
[start
- 1] = buflen
- start
;
697 /* Standard INQUIRY data */
698 if (req
->cmd
.buf
[2] != 0) {
703 buflen
= req
->cmd
.xfer
;
704 if (buflen
> SCSI_MAX_INQUIRY_LEN
) {
705 buflen
= SCSI_MAX_INQUIRY_LEN
;
708 outbuf
[0] = s
->qdev
.type
& 0x1f;
709 outbuf
[1] = (s
->features
& (1 << SCSI_DISK_F_REMOVABLE
)) ? 0x80 : 0;
711 strpadcpy((char *) &outbuf
[16], 16, s
->product
, ' ');
712 strpadcpy((char *) &outbuf
[8], 8, s
->vendor
, ' ');
714 memset(&outbuf
[32], 0, 4);
715 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
717 * We claim conformance to SPC-3, which is required for guests
718 * to ask for modern features like READ CAPACITY(16) or the
719 * block characteristics VPD page by default. Not all of SPC-3
720 * is actually implemented, but we're good enough.
723 outbuf
[3] = 2 | 0x10; /* Format 2, HiSup */
726 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
728 /* If the allocation length of CDB is too small,
729 the additional length is not adjusted */
733 /* Sync data transfer and TCQ. */
734 outbuf
[7] = 0x10 | (req
->bus
->info
->tcq
? 0x02 : 0);
738 static inline bool media_is_dvd(SCSIDiskState
*s
)
741 if (s
->qdev
.type
!= TYPE_ROM
) {
744 if (!blk_is_inserted(s
->qdev
.conf
.blk
)) {
747 blk_get_geometry(s
->qdev
.conf
.blk
, &nb_sectors
);
748 return nb_sectors
> CD_MAX_SECTORS
;
751 static inline bool media_is_cd(SCSIDiskState
*s
)
754 if (s
->qdev
.type
!= TYPE_ROM
) {
757 if (!blk_is_inserted(s
->qdev
.conf
.blk
)) {
760 blk_get_geometry(s
->qdev
.conf
.blk
, &nb_sectors
);
761 return nb_sectors
<= CD_MAX_SECTORS
;
764 static int scsi_read_disc_information(SCSIDiskState
*s
, SCSIDiskReq
*r
,
767 uint8_t type
= r
->req
.cmd
.buf
[1] & 7;
769 if (s
->qdev
.type
!= TYPE_ROM
) {
773 /* Types 1/2 are only defined for Blu-Ray. */
775 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
779 memset(outbuf
, 0, 34);
781 outbuf
[2] = 0xe; /* last session complete, disc finalized */
782 outbuf
[3] = 1; /* first track on disc */
783 outbuf
[4] = 1; /* # of sessions */
784 outbuf
[5] = 1; /* first track of last session */
785 outbuf
[6] = 1; /* last track of last session */
786 outbuf
[7] = 0x20; /* unrestricted use */
787 outbuf
[8] = 0x00; /* CD-ROM or DVD-ROM */
788 /* 9-10-11: most significant byte corresponding bytes 4-5-6 */
789 /* 12-23: not meaningful for CD-ROM or DVD-ROM */
790 /* 24-31: disc bar code */
791 /* 32: disc application code */
792 /* 33: number of OPC tables */
797 static int scsi_read_dvd_structure(SCSIDiskState
*s
, SCSIDiskReq
*r
,
800 static const int rds_caps_size
[5] = {
807 uint8_t media
= r
->req
.cmd
.buf
[1];
808 uint8_t layer
= r
->req
.cmd
.buf
[6];
809 uint8_t format
= r
->req
.cmd
.buf
[7];
812 if (s
->qdev
.type
!= TYPE_ROM
) {
816 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
820 if (format
!= 0xff) {
821 if (s
->tray_open
|| !blk_is_inserted(s
->qdev
.conf
.blk
)) {
822 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
825 if (media_is_cd(s
)) {
826 scsi_check_condition(r
, SENSE_CODE(INCOMPATIBLE_FORMAT
));
829 if (format
>= ARRAY_SIZE(rds_caps_size
)) {
832 size
= rds_caps_size
[format
];
833 memset(outbuf
, 0, size
);
838 /* Physical format information */
843 blk_get_geometry(s
->qdev
.conf
.blk
, &nb_sectors
);
845 outbuf
[4] = 1; /* DVD-ROM, part version 1 */
846 outbuf
[5] = 0xf; /* 120mm disc, minimum rate unspecified */
847 outbuf
[6] = 1; /* one layer, read-only (per MMC-2 spec) */
848 outbuf
[7] = 0; /* default densities */
850 stl_be_p(&outbuf
[12], (nb_sectors
>> 2) - 1); /* end sector */
851 stl_be_p(&outbuf
[16], (nb_sectors
>> 2) - 1); /* l0 end sector */
855 case 0x01: /* DVD copyright information, all zeros */
858 case 0x03: /* BCA information - invalid field for no BCA info */
861 case 0x04: /* DVD disc manufacturing information, all zeros */
864 case 0xff: { /* List capabilities */
867 for (i
= 0; i
< ARRAY_SIZE(rds_caps_size
); i
++) {
868 if (!rds_caps_size
[i
]) {
872 outbuf
[size
+ 1] = 0x40; /* Not writable, readable */
873 stw_be_p(&outbuf
[size
+ 2], rds_caps_size
[i
]);
883 /* Size of buffer, not including 2 byte size field */
884 stw_be_p(outbuf
, size
- 2);
891 static int scsi_event_status_media(SCSIDiskState
*s
, uint8_t *outbuf
)
893 uint8_t event_code
, media_status
;
897 media_status
= MS_TRAY_OPEN
;
898 } else if (blk_is_inserted(s
->qdev
.conf
.blk
)) {
899 media_status
= MS_MEDIA_PRESENT
;
902 /* Event notification descriptor */
903 event_code
= MEC_NO_CHANGE
;
904 if (media_status
!= MS_TRAY_OPEN
) {
905 if (s
->media_event
) {
906 event_code
= MEC_NEW_MEDIA
;
907 s
->media_event
= false;
908 } else if (s
->eject_request
) {
909 event_code
= MEC_EJECT_REQUESTED
;
910 s
->eject_request
= false;
914 outbuf
[0] = event_code
;
915 outbuf
[1] = media_status
;
917 /* These fields are reserved, just clear them. */
923 static int scsi_get_event_status_notification(SCSIDiskState
*s
, SCSIDiskReq
*r
,
927 uint8_t *buf
= r
->req
.cmd
.buf
;
928 uint8_t notification_class_request
= buf
[4];
929 if (s
->qdev
.type
!= TYPE_ROM
) {
932 if ((buf
[1] & 1) == 0) {
938 outbuf
[0] = outbuf
[1] = 0;
939 outbuf
[3] = 1 << GESN_MEDIA
; /* supported events */
940 if (notification_class_request
& (1 << GESN_MEDIA
)) {
941 outbuf
[2] = GESN_MEDIA
;
942 size
+= scsi_event_status_media(s
, &outbuf
[size
]);
946 stw_be_p(outbuf
, size
- 4);
950 static int scsi_get_configuration(SCSIDiskState
*s
, uint8_t *outbuf
)
954 if (s
->qdev
.type
!= TYPE_ROM
) {
957 current
= media_is_dvd(s
) ? MMC_PROFILE_DVD_ROM
: MMC_PROFILE_CD_ROM
;
958 memset(outbuf
, 0, 40);
959 stl_be_p(&outbuf
[0], 36); /* Bytes after the data length field */
960 stw_be_p(&outbuf
[6], current
);
961 /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
962 outbuf
[10] = 0x03; /* persistent, current */
963 outbuf
[11] = 8; /* two profiles */
964 stw_be_p(&outbuf
[12], MMC_PROFILE_DVD_ROM
);
965 outbuf
[14] = (current
== MMC_PROFILE_DVD_ROM
);
966 stw_be_p(&outbuf
[16], MMC_PROFILE_CD_ROM
);
967 outbuf
[18] = (current
== MMC_PROFILE_CD_ROM
);
968 /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
969 stw_be_p(&outbuf
[20], 1);
970 outbuf
[22] = 0x08 | 0x03; /* version 2, persistent, current */
972 stl_be_p(&outbuf
[24], 1); /* SCSI */
973 outbuf
[28] = 1; /* DBE = 1, mandatory */
974 /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
975 stw_be_p(&outbuf
[32], 3);
976 outbuf
[34] = 0x08 | 0x03; /* version 2, persistent, current */
978 outbuf
[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
979 /* TODO: Random readable, CD read, DVD read, drive serial number,
984 static int scsi_emulate_mechanism_status(SCSIDiskState
*s
, uint8_t *outbuf
)
986 if (s
->qdev
.type
!= TYPE_ROM
) {
989 memset(outbuf
, 0, 8);
990 outbuf
[5] = 1; /* CD-ROM */
994 static int mode_sense_page(SCSIDiskState
*s
, int page
, uint8_t **p_outbuf
,
997 static const int mode_sense_valid
[0x3f] = {
998 [MODE_PAGE_HD_GEOMETRY
] = (1 << TYPE_DISK
),
999 [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY
] = (1 << TYPE_DISK
),
1000 [MODE_PAGE_CACHING
] = (1 << TYPE_DISK
) | (1 << TYPE_ROM
),
1001 [MODE_PAGE_R_W_ERROR
] = (1 << TYPE_DISK
) | (1 << TYPE_ROM
),
1002 [MODE_PAGE_AUDIO_CTL
] = (1 << TYPE_ROM
),
1003 [MODE_PAGE_CAPABILITIES
] = (1 << TYPE_ROM
),
1006 uint8_t *p
= *p_outbuf
+ 2;
1009 if ((mode_sense_valid
[page
] & (1 << s
->qdev
.type
)) == 0) {
1014 * If Changeable Values are requested, a mask denoting those mode parameters
1015 * that are changeable shall be returned. As we currently don't support
1016 * parameter changes via MODE_SELECT all bits are returned set to zero.
1017 * The buffer was already menset to zero by the caller of this function.
1019 * The offsets here are off by two compared to the descriptions in the
1020 * SCSI specs, because those include a 2-byte header. This is unfortunate,
1021 * but it is done so that offsets are consistent within our implementation
1022 * of MODE SENSE and MODE SELECT. MODE SELECT has to deal with both
1023 * 2-byte and 4-byte headers.
1026 case MODE_PAGE_HD_GEOMETRY
:
1028 if (page_control
== 1) { /* Changeable Values */
1031 /* if a geometry hint is available, use it */
1032 p
[0] = (s
->qdev
.conf
.cyls
>> 16) & 0xff;
1033 p
[1] = (s
->qdev
.conf
.cyls
>> 8) & 0xff;
1034 p
[2] = s
->qdev
.conf
.cyls
& 0xff;
1035 p
[3] = s
->qdev
.conf
.heads
& 0xff;
1036 /* Write precomp start cylinder, disabled */
1037 p
[4] = (s
->qdev
.conf
.cyls
>> 16) & 0xff;
1038 p
[5] = (s
->qdev
.conf
.cyls
>> 8) & 0xff;
1039 p
[6] = s
->qdev
.conf
.cyls
& 0xff;
1040 /* Reduced current start cylinder, disabled */
1041 p
[7] = (s
->qdev
.conf
.cyls
>> 16) & 0xff;
1042 p
[8] = (s
->qdev
.conf
.cyls
>> 8) & 0xff;
1043 p
[9] = s
->qdev
.conf
.cyls
& 0xff;
1044 /* Device step rate [ns], 200ns */
1047 /* Landing zone cylinder */
1051 /* Medium rotation rate [rpm], 5400 rpm */
1052 p
[18] = (5400 >> 8) & 0xff;
1053 p
[19] = 5400 & 0xff;
1056 case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY
:
1058 if (page_control
== 1) { /* Changeable Values */
1061 /* Transfer rate [kbit/s], 5Mbit/s */
1064 /* if a geometry hint is available, use it */
1065 p
[2] = s
->qdev
.conf
.heads
& 0xff;
1066 p
[3] = s
->qdev
.conf
.secs
& 0xff;
1067 p
[4] = s
->qdev
.blocksize
>> 8;
1068 p
[6] = (s
->qdev
.conf
.cyls
>> 8) & 0xff;
1069 p
[7] = s
->qdev
.conf
.cyls
& 0xff;
1070 /* Write precomp start cylinder, disabled */
1071 p
[8] = (s
->qdev
.conf
.cyls
>> 8) & 0xff;
1072 p
[9] = s
->qdev
.conf
.cyls
& 0xff;
1073 /* Reduced current start cylinder, disabled */
1074 p
[10] = (s
->qdev
.conf
.cyls
>> 8) & 0xff;
1075 p
[11] = s
->qdev
.conf
.cyls
& 0xff;
1076 /* Device step rate [100us], 100us */
1079 /* Device step pulse width [us], 1us */
1081 /* Device head settle delay [100us], 100us */
1084 /* Motor on delay [0.1s], 0.1s */
1086 /* Motor off delay [0.1s], 0.1s */
1088 /* Medium rotation rate [rpm], 5400 rpm */
1089 p
[26] = (5400 >> 8) & 0xff;
1090 p
[27] = 5400 & 0xff;
1093 case MODE_PAGE_CACHING
:
1095 if (page_control
== 1 || /* Changeable Values */
1096 blk_enable_write_cache(s
->qdev
.conf
.blk
)) {
1101 case MODE_PAGE_R_W_ERROR
:
1103 if (page_control
== 1) { /* Changeable Values */
1106 p
[0] = 0x80; /* Automatic Write Reallocation Enabled */
1107 if (s
->qdev
.type
== TYPE_ROM
) {
1108 p
[1] = 0x20; /* Read Retry Count */
1112 case MODE_PAGE_AUDIO_CTL
:
1116 case MODE_PAGE_CAPABILITIES
:
1118 if (page_control
== 1) { /* Changeable Values */
1122 p
[0] = 0x3b; /* CD-R & CD-RW read */
1123 p
[1] = 0; /* Writing not supported */
1124 p
[2] = 0x7f; /* Audio, composite, digital out,
1125 mode 2 form 1&2, multi session */
1126 p
[3] = 0xff; /* CD DA, DA accurate, RW supported,
1127 RW corrected, C2 errors, ISRC,
1129 p
[4] = 0x2d | (s
->tray_locked
? 2 : 0);
1130 /* Locking supported, jumper present, eject, tray */
1131 p
[5] = 0; /* no volume & mute control, no
1133 p
[6] = (50 * 176) >> 8; /* 50x read speed */
1134 p
[7] = (50 * 176) & 0xff;
1135 p
[8] = 2 >> 8; /* Two volume levels */
1137 p
[10] = 2048 >> 8; /* 2M buffer */
1138 p
[11] = 2048 & 0xff;
1139 p
[12] = (16 * 176) >> 8; /* 16x read speed current */
1140 p
[13] = (16 * 176) & 0xff;
1141 p
[16] = (16 * 176) >> 8; /* 16x write speed */
1142 p
[17] = (16 * 176) & 0xff;
1143 p
[18] = (16 * 176) >> 8; /* 16x write speed current */
1144 p
[19] = (16 * 176) & 0xff;
1151 assert(length
< 256);
1152 (*p_outbuf
)[0] = page
;
1153 (*p_outbuf
)[1] = length
;
1154 *p_outbuf
+= length
+ 2;
1158 static int scsi_disk_emulate_mode_sense(SCSIDiskReq
*r
, uint8_t *outbuf
)
1160 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
1161 uint64_t nb_sectors
;
1163 int page
, buflen
, ret
, page_control
;
1165 uint8_t dev_specific_param
;
1167 dbd
= (r
->req
.cmd
.buf
[1] & 0x8) != 0;
1168 page
= r
->req
.cmd
.buf
[2] & 0x3f;
1169 page_control
= (r
->req
.cmd
.buf
[2] & 0xc0) >> 6;
1170 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
1171 (r
->req
.cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, r
->req
.cmd
.xfer
, page_control
);
1172 memset(outbuf
, 0, r
->req
.cmd
.xfer
);
1175 if (s
->qdev
.type
== TYPE_DISK
) {
1176 dev_specific_param
= s
->features
& (1 << SCSI_DISK_F_DPOFUA
) ? 0x10 : 0;
1177 if (blk_is_read_only(s
->qdev
.conf
.blk
)) {
1178 dev_specific_param
|= 0x80; /* Readonly. */
1181 /* MMC prescribes that CD/DVD drives have no block descriptors,
1182 * and defines no device-specific parameter. */
1183 dev_specific_param
= 0x00;
1187 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
1188 p
[1] = 0; /* Default media type. */
1189 p
[2] = dev_specific_param
;
1190 p
[3] = 0; /* Block descriptor length. */
1192 } else { /* MODE_SENSE_10 */
1193 p
[2] = 0; /* Default media type. */
1194 p
[3] = dev_specific_param
;
1195 p
[6] = p
[7] = 0; /* Block descriptor length. */
1199 blk_get_geometry(s
->qdev
.conf
.blk
, &nb_sectors
);
1200 if (!dbd
&& nb_sectors
) {
1201 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
1202 outbuf
[3] = 8; /* Block descriptor length */
1203 } else { /* MODE_SENSE_10 */
1204 outbuf
[7] = 8; /* Block descriptor length */
1206 nb_sectors
/= (s
->qdev
.blocksize
/ 512);
1207 if (nb_sectors
> 0xffffff) {
1210 p
[0] = 0; /* media density code */
1211 p
[1] = (nb_sectors
>> 16) & 0xff;
1212 p
[2] = (nb_sectors
>> 8) & 0xff;
1213 p
[3] = nb_sectors
& 0xff;
1214 p
[4] = 0; /* reserved */
1215 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
1216 p
[6] = s
->qdev
.blocksize
>> 8;
1221 if (page_control
== 3) {
1223 scsi_check_condition(r
, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED
));
1228 for (page
= 0; page
<= 0x3e; page
++) {
1229 mode_sense_page(s
, page
, &p
, page_control
);
1232 ret
= mode_sense_page(s
, page
, &p
, page_control
);
1238 buflen
= p
- outbuf
;
1240 * The mode data length field specifies the length in bytes of the
1241 * following data that is available to be transferred. The mode data
1242 * length does not include itself.
1244 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
1245 outbuf
[0] = buflen
- 1;
1246 } else { /* MODE_SENSE_10 */
1247 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
1248 outbuf
[1] = (buflen
- 2) & 0xff;
1253 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
1255 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1256 int start_track
, format
, msf
, toclen
;
1257 uint64_t nb_sectors
;
1259 msf
= req
->cmd
.buf
[1] & 2;
1260 format
= req
->cmd
.buf
[2] & 0xf;
1261 start_track
= req
->cmd
.buf
[6];
1262 blk_get_geometry(s
->qdev
.conf
.blk
, &nb_sectors
);
1263 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
1264 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1267 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
1270 /* multi session : only a single session defined */
1272 memset(outbuf
, 0, 12);
1278 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
1286 static int scsi_disk_emulate_start_stop(SCSIDiskReq
*r
)
1288 SCSIRequest
*req
= &r
->req
;
1289 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1290 bool start
= req
->cmd
.buf
[4] & 1;
1291 bool loej
= req
->cmd
.buf
[4] & 2; /* load on start, eject on !start */
1292 int pwrcnd
= req
->cmd
.buf
[4] & 0xf0;
1295 /* eject/load only happens for power condition == 0 */
1299 if ((s
->features
& (1 << SCSI_DISK_F_REMOVABLE
)) && loej
) {
1300 if (!start
&& !s
->tray_open
&& s
->tray_locked
) {
1301 scsi_check_condition(r
,
1302 blk_is_inserted(s
->qdev
.conf
.blk
)
1303 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED
)
1304 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED
));
1308 if (s
->tray_open
!= !start
) {
1309 blk_eject(s
->qdev
.conf
.blk
, !start
);
1310 s
->tray_open
= !start
;
1316 static void scsi_disk_emulate_read_data(SCSIRequest
*req
)
1318 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1319 int buflen
= r
->iov
.iov_len
;
1322 DPRINTF("Read buf_len=%d\n", buflen
);
1325 scsi_req_data(&r
->req
, buflen
);
1329 /* This also clears the sense buffer for REQUEST SENSE. */
1330 scsi_req_complete(&r
->req
, GOOD
);
1333 static int scsi_disk_check_mode_select(SCSIDiskState
*s
, int page
,
1334 uint8_t *inbuf
, int inlen
)
1336 uint8_t mode_current
[SCSI_MAX_MODE_LEN
];
1337 uint8_t mode_changeable
[SCSI_MAX_MODE_LEN
];
1339 int len
, expected_len
, changeable_len
, i
;
1341 /* The input buffer does not include the page header, so it is
1344 expected_len
= inlen
+ 2;
1345 if (expected_len
> SCSI_MAX_MODE_LEN
) {
1350 memset(mode_current
, 0, inlen
+ 2);
1351 len
= mode_sense_page(s
, page
, &p
, 0);
1352 if (len
< 0 || len
!= expected_len
) {
1356 p
= mode_changeable
;
1357 memset(mode_changeable
, 0, inlen
+ 2);
1358 changeable_len
= mode_sense_page(s
, page
, &p
, 1);
1359 assert(changeable_len
== len
);
1361 /* Check that unchangeable bits are the same as what MODE SENSE
1364 for (i
= 2; i
< len
; i
++) {
1365 if (((mode_current
[i
] ^ inbuf
[i
- 2]) & ~mode_changeable
[i
]) != 0) {
1372 static void scsi_disk_apply_mode_select(SCSIDiskState
*s
, int page
, uint8_t *p
)
1375 case MODE_PAGE_CACHING
:
1376 blk_set_enable_write_cache(s
->qdev
.conf
.blk
, (p
[0] & 4) != 0);
1384 static int mode_select_pages(SCSIDiskReq
*r
, uint8_t *p
, int len
, bool change
)
1386 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
1389 int page
, subpage
, page_len
;
1391 /* Parse both possible formats for the mode page headers. */
1395 goto invalid_param_len
;
1398 page_len
= lduw_be_p(&p
[2]);
1403 goto invalid_param_len
;
1414 if (page_len
> len
) {
1415 goto invalid_param_len
;
1419 if (scsi_disk_check_mode_select(s
, page
, p
, page_len
) < 0) {
1423 scsi_disk_apply_mode_select(s
, page
, p
);
1432 scsi_check_condition(r
, SENSE_CODE(INVALID_PARAM
));
1436 scsi_check_condition(r
, SENSE_CODE(INVALID_PARAM_LEN
));
1440 static void scsi_disk_emulate_mode_select(SCSIDiskReq
*r
, uint8_t *inbuf
)
1442 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
1444 int cmd
= r
->req
.cmd
.buf
[0];
1445 int len
= r
->req
.cmd
.xfer
;
1446 int hdr_len
= (cmd
== MODE_SELECT
? 4 : 8);
1450 /* We only support PF=1, SP=0. */
1451 if ((r
->req
.cmd
.buf
[1] & 0x11) != 0x10) {
1455 if (len
< hdr_len
) {
1456 goto invalid_param_len
;
1459 bd_len
= (cmd
== MODE_SELECT
? p
[3] : lduw_be_p(&p
[6]));
1463 goto invalid_param_len
;
1465 if (bd_len
!= 0 && bd_len
!= 8) {
1472 /* Ensure no change is made if there is an error! */
1473 for (pass
= 0; pass
< 2; pass
++) {
1474 if (mode_select_pages(r
, p
, len
, pass
== 1) < 0) {
1479 if (!blk_enable_write_cache(s
->qdev
.conf
.blk
)) {
1480 /* The request is used as the AIO opaque value, so add a ref. */
1481 scsi_req_ref(&r
->req
);
1482 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
, 0,
1484 r
->req
.aiocb
= blk_aio_flush(s
->qdev
.conf
.blk
, scsi_aio_complete
, r
);
1488 scsi_req_complete(&r
->req
, GOOD
);
1492 scsi_check_condition(r
, SENSE_CODE(INVALID_PARAM
));
1496 scsi_check_condition(r
, SENSE_CODE(INVALID_PARAM_LEN
));
1500 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1503 static inline bool check_lba_range(SCSIDiskState
*s
,
1504 uint64_t sector_num
, uint32_t nb_sectors
)
1507 * The first line tests that no overflow happens when computing the last
1508 * sector. The second line tests that the last accessed sector is in
1511 * Careful, the computations should not underflow for nb_sectors == 0,
1512 * and a 0-block read to the first LBA beyond the end of device is
1515 return (sector_num
<= sector_num
+ nb_sectors
&&
1516 sector_num
+ nb_sectors
<= s
->qdev
.max_lba
+ 1);
1519 typedef struct UnmapCBData
{
1525 static void scsi_unmap_complete(void *opaque
, int ret
)
1527 UnmapCBData
*data
= opaque
;
1528 SCSIDiskReq
*r
= data
->r
;
1529 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
1530 uint64_t sector_num
;
1531 uint32_t nb_sectors
;
1533 r
->req
.aiocb
= NULL
;
1534 if (r
->req
.io_canceled
) {
1535 scsi_req_cancel_complete(&r
->req
);
1540 if (scsi_handle_rw_error(r
, -ret
)) {
1545 if (data
->count
> 0) {
1546 sector_num
= ldq_be_p(&data
->inbuf
[0]);
1547 nb_sectors
= ldl_be_p(&data
->inbuf
[8]) & 0xffffffffULL
;
1548 if (!check_lba_range(s
, sector_num
, nb_sectors
)) {
1549 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1553 r
->req
.aiocb
= blk_aio_discard(s
->qdev
.conf
.blk
,
1554 sector_num
* (s
->qdev
.blocksize
/ 512),
1555 nb_sectors
* (s
->qdev
.blocksize
/ 512),
1556 scsi_unmap_complete
, data
);
1562 scsi_req_complete(&r
->req
, GOOD
);
1565 scsi_req_unref(&r
->req
);
1569 static void scsi_disk_emulate_unmap(SCSIDiskReq
*r
, uint8_t *inbuf
)
1571 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
1573 int len
= r
->req
.cmd
.xfer
;
1576 /* Reject ANCHOR=1. */
1577 if (r
->req
.cmd
.buf
[1] & 0x1) {
1582 goto invalid_param_len
;
1584 if (len
< lduw_be_p(&p
[0]) + 2) {
1585 goto invalid_param_len
;
1587 if (len
< lduw_be_p(&p
[2]) + 8) {
1588 goto invalid_param_len
;
1590 if (lduw_be_p(&p
[2]) & 15) {
1591 goto invalid_param_len
;
1594 if (blk_is_read_only(s
->qdev
.conf
.blk
)) {
1595 scsi_check_condition(r
, SENSE_CODE(WRITE_PROTECTED
));
1599 data
= g_new0(UnmapCBData
, 1);
1601 data
->inbuf
= &p
[8];
1602 data
->count
= lduw_be_p(&p
[2]) >> 4;
1604 /* The matching unref is in scsi_unmap_complete, before data is freed. */
1605 scsi_req_ref(&r
->req
);
1606 scsi_unmap_complete(data
, 0);
1610 scsi_check_condition(r
, SENSE_CODE(INVALID_PARAM_LEN
));
1614 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1617 typedef struct WriteSameCBData
{
1625 static void scsi_write_same_complete(void *opaque
, int ret
)
1627 WriteSameCBData
*data
= opaque
;
1628 SCSIDiskReq
*r
= data
->r
;
1629 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
1631 assert(r
->req
.aiocb
!= NULL
);
1632 r
->req
.aiocb
= NULL
;
1633 block_acct_done(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
);
1634 if (r
->req
.io_canceled
) {
1635 scsi_req_cancel_complete(&r
->req
);
1640 if (scsi_handle_rw_error(r
, -ret
)) {
1645 data
->nb_sectors
-= data
->iov
.iov_len
/ 512;
1646 data
->sector
+= data
->iov
.iov_len
/ 512;
1647 data
->iov
.iov_len
= MIN(data
->nb_sectors
* 512, data
->iov
.iov_len
);
1648 if (data
->iov
.iov_len
) {
1649 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
,
1650 data
->iov
.iov_len
, BLOCK_ACCT_WRITE
);
1651 r
->req
.aiocb
= blk_aio_writev(s
->qdev
.conf
.blk
, data
->sector
,
1652 &data
->qiov
, data
->iov
.iov_len
/ 512,
1653 scsi_write_same_complete
, data
);
1657 scsi_req_complete(&r
->req
, GOOD
);
1660 scsi_req_unref(&r
->req
);
1661 qemu_vfree(data
->iov
.iov_base
);
1665 static void scsi_disk_emulate_write_same(SCSIDiskReq
*r
, uint8_t *inbuf
)
1667 SCSIRequest
*req
= &r
->req
;
1668 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1669 uint32_t nb_sectors
= scsi_data_cdb_xfer(r
->req
.cmd
.buf
);
1670 WriteSameCBData
*data
;
1674 /* Fail if PBDATA=1 or LBDATA=1 or ANCHOR=1. */
1675 if (nb_sectors
== 0 || (req
->cmd
.buf
[1] & 0x16)) {
1676 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1680 if (blk_is_read_only(s
->qdev
.conf
.blk
)) {
1681 scsi_check_condition(r
, SENSE_CODE(WRITE_PROTECTED
));
1684 if (!check_lba_range(s
, r
->req
.cmd
.lba
, nb_sectors
)) {
1685 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1689 if (buffer_is_zero(inbuf
, s
->qdev
.blocksize
)) {
1690 int flags
= (req
->cmd
.buf
[1] & 0x8) ? BDRV_REQ_MAY_UNMAP
: 0;
1692 /* The request is used as the AIO opaque value, so add a ref. */
1693 scsi_req_ref(&r
->req
);
1694 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
,
1695 nb_sectors
* s
->qdev
.blocksize
,
1697 r
->req
.aiocb
= blk_aio_write_zeroes(s
->qdev
.conf
.blk
,
1698 r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512),
1699 nb_sectors
* (s
->qdev
.blocksize
/ 512),
1700 flags
, scsi_aio_complete
, r
);
1704 data
= g_new0(WriteSameCBData
, 1);
1706 data
->sector
= r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512);
1707 data
->nb_sectors
= nb_sectors
* (s
->qdev
.blocksize
/ 512);
1708 data
->iov
.iov_len
= MIN(data
->nb_sectors
* 512, SCSI_WRITE_SAME_MAX
);
1709 data
->iov
.iov_base
= buf
= blk_blockalign(s
->qdev
.conf
.blk
,
1711 qemu_iovec_init_external(&data
->qiov
, &data
->iov
, 1);
1713 for (i
= 0; i
< data
->iov
.iov_len
; i
+= s
->qdev
.blocksize
) {
1714 memcpy(&buf
[i
], inbuf
, s
->qdev
.blocksize
);
1717 scsi_req_ref(&r
->req
);
1718 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
,
1719 data
->iov
.iov_len
, BLOCK_ACCT_WRITE
);
1720 r
->req
.aiocb
= blk_aio_writev(s
->qdev
.conf
.blk
, data
->sector
,
1721 &data
->qiov
, data
->iov
.iov_len
/ 512,
1722 scsi_write_same_complete
, data
);
1725 static void scsi_disk_emulate_write_data(SCSIRequest
*req
)
1727 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1729 if (r
->iov
.iov_len
) {
1730 int buflen
= r
->iov
.iov_len
;
1731 DPRINTF("Write buf_len=%d\n", buflen
);
1733 scsi_req_data(&r
->req
, buflen
);
1737 switch (req
->cmd
.buf
[0]) {
1739 case MODE_SELECT_10
:
1740 /* This also clears the sense buffer for REQUEST SENSE. */
1741 scsi_disk_emulate_mode_select(r
, r
->iov
.iov_base
);
1745 scsi_disk_emulate_unmap(r
, r
->iov
.iov_base
);
1751 if (r
->req
.status
== -1) {
1752 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1758 scsi_disk_emulate_write_same(r
, r
->iov
.iov_base
);
1766 static int32_t scsi_disk_emulate_command(SCSIRequest
*req
, uint8_t *buf
)
1768 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1769 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1770 uint64_t nb_sectors
;
1774 switch (req
->cmd
.buf
[0]) {
1783 case ALLOW_MEDIUM_REMOVAL
:
1784 case GET_CONFIGURATION
:
1785 case GET_EVENT_STATUS_NOTIFICATION
:
1786 case MECHANISM_STATUS
:
1791 if (s
->tray_open
|| !blk_is_inserted(s
->qdev
.conf
.blk
)) {
1792 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
1799 * FIXME: we shouldn't return anything bigger than 4k, but the code
1800 * requires the buffer to be as big as req->cmd.xfer in several
1801 * places. So, do not allow CDBs with a very large ALLOCATION
1802 * LENGTH. The real fix would be to modify scsi_read_data and
1803 * dma_buf_read, so that they return data beyond the buflen
1806 if (req
->cmd
.xfer
> 65536) {
1807 goto illegal_request
;
1809 r
->buflen
= MAX(4096, req
->cmd
.xfer
);
1811 if (!r
->iov
.iov_base
) {
1812 r
->iov
.iov_base
= blk_blockalign(s
->qdev
.conf
.blk
, r
->buflen
);
1815 buflen
= req
->cmd
.xfer
;
1816 outbuf
= r
->iov
.iov_base
;
1817 memset(outbuf
, 0, r
->buflen
);
1818 switch (req
->cmd
.buf
[0]) {
1819 case TEST_UNIT_READY
:
1820 assert(!s
->tray_open
&& blk_is_inserted(s
->qdev
.conf
.blk
));
1823 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
1825 goto illegal_request
;
1830 buflen
= scsi_disk_emulate_mode_sense(r
, outbuf
);
1832 goto illegal_request
;
1836 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
1838 goto illegal_request
;
1842 if (req
->cmd
.buf
[1] & 1) {
1843 goto illegal_request
;
1847 if (req
->cmd
.buf
[1] & 3) {
1848 goto illegal_request
;
1852 if (req
->cmd
.buf
[1] & 1) {
1853 goto illegal_request
;
1857 if (req
->cmd
.buf
[1] & 3) {
1858 goto illegal_request
;
1862 if (scsi_disk_emulate_start_stop(r
) < 0) {
1866 case ALLOW_MEDIUM_REMOVAL
:
1867 s
->tray_locked
= req
->cmd
.buf
[4] & 1;
1868 blk_lock_medium(s
->qdev
.conf
.blk
, req
->cmd
.buf
[4] & 1);
1870 case READ_CAPACITY_10
:
1871 /* The normal LEN field for this command is zero. */
1872 memset(outbuf
, 0, 8);
1873 blk_get_geometry(s
->qdev
.conf
.blk
, &nb_sectors
);
1875 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
1878 if ((req
->cmd
.buf
[8] & 1) == 0 && req
->cmd
.lba
) {
1879 goto illegal_request
;
1881 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1882 /* Returned value is the address of the last sector. */
1884 /* Remember the new size for read/write sanity checking. */
1885 s
->qdev
.max_lba
= nb_sectors
;
1886 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
1887 if (nb_sectors
> UINT32_MAX
) {
1888 nb_sectors
= UINT32_MAX
;
1890 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
1891 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
1892 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
1893 outbuf
[3] = nb_sectors
& 0xff;
1896 outbuf
[6] = s
->qdev
.blocksize
>> 8;
1900 /* Just return "NO SENSE". */
1901 buflen
= scsi_build_sense(NULL
, 0, outbuf
, r
->buflen
,
1902 (req
->cmd
.buf
[1] & 1) == 0);
1904 goto illegal_request
;
1907 case MECHANISM_STATUS
:
1908 buflen
= scsi_emulate_mechanism_status(s
, outbuf
);
1910 goto illegal_request
;
1913 case GET_CONFIGURATION
:
1914 buflen
= scsi_get_configuration(s
, outbuf
);
1916 goto illegal_request
;
1919 case GET_EVENT_STATUS_NOTIFICATION
:
1920 buflen
= scsi_get_event_status_notification(s
, r
, outbuf
);
1922 goto illegal_request
;
1925 case READ_DISC_INFORMATION
:
1926 buflen
= scsi_read_disc_information(s
, r
, outbuf
);
1928 goto illegal_request
;
1931 case READ_DVD_STRUCTURE
:
1932 buflen
= scsi_read_dvd_structure(s
, r
, outbuf
);
1934 goto illegal_request
;
1937 case SERVICE_ACTION_IN_16
:
1938 /* Service Action In subcommands. */
1939 if ((req
->cmd
.buf
[1] & 31) == SAI_READ_CAPACITY_16
) {
1940 DPRINTF("SAI READ CAPACITY(16)\n");
1941 memset(outbuf
, 0, req
->cmd
.xfer
);
1942 blk_get_geometry(s
->qdev
.conf
.blk
, &nb_sectors
);
1944 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
1947 if ((req
->cmd
.buf
[14] & 1) == 0 && req
->cmd
.lba
) {
1948 goto illegal_request
;
1950 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1951 /* Returned value is the address of the last sector. */
1953 /* Remember the new size for read/write sanity checking. */
1954 s
->qdev
.max_lba
= nb_sectors
;
1955 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
1956 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
1957 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
1958 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
1959 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
1960 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
1961 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
1962 outbuf
[7] = nb_sectors
& 0xff;
1965 outbuf
[10] = s
->qdev
.blocksize
>> 8;
1968 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
1970 /* set TPE bit if the format supports discard */
1971 if (s
->qdev
.conf
.discard_granularity
) {
1975 /* Protection, exponent and lowest lba field left blank. */
1978 DPRINTF("Unsupported Service Action In\n");
1979 goto illegal_request
;
1980 case SYNCHRONIZE_CACHE
:
1981 /* The request is used as the AIO opaque value, so add a ref. */
1982 scsi_req_ref(&r
->req
);
1983 block_acct_start(blk_get_stats(s
->qdev
.conf
.blk
), &r
->acct
, 0,
1985 r
->req
.aiocb
= blk_aio_flush(s
->qdev
.conf
.blk
, scsi_aio_complete
, r
);
1988 DPRINTF("Seek(10) (sector %" PRId64
")\n", r
->req
.cmd
.lba
);
1989 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1994 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1996 case MODE_SELECT_10
:
1997 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
2000 DPRINTF("Unmap (len %lu)\n", (long)r
->req
.cmd
.xfer
);
2005 DPRINTF("Verify (bytchk %d)\n", (req
->cmd
.buf
[1] >> 1) & 3);
2006 if (req
->cmd
.buf
[1] & 6) {
2007 goto illegal_request
;
2012 DPRINTF("WRITE SAME %d (len %lu)\n",
2013 req
->cmd
.buf
[0] == WRITE_SAME_10
? 10 : 16,
2014 (long)r
->req
.cmd
.xfer
);
2017 DPRINTF("Unknown SCSI command (%2.2x=%s)\n", buf
[0],
2018 scsi_command_name(buf
[0]));
2019 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
2022 assert(!r
->req
.aiocb
);
2023 r
->iov
.iov_len
= MIN(r
->buflen
, req
->cmd
.xfer
);
2024 if (r
->iov
.iov_len
== 0) {
2025 scsi_req_complete(&r
->req
, GOOD
);
2027 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
2028 assert(r
->iov
.iov_len
== req
->cmd
.xfer
);
2029 return -r
->iov
.iov_len
;
2031 return r
->iov
.iov_len
;
2035 if (r
->req
.status
== -1) {
2036 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
2041 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
2045 /* Execute a scsi command. Returns the length of the data expected by the
2046 command. This will be Positive for data transfers from the device
2047 (eg. disk reads), negative for transfers to the device (eg. disk writes),
2048 and zero if the command does not transfer any data. */
2050 static int32_t scsi_disk_dma_command(SCSIRequest
*req
, uint8_t *buf
)
2052 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
2053 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
2059 if (s
->tray_open
|| !blk_is_inserted(s
->qdev
.conf
.blk
)) {
2060 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
2064 len
= scsi_data_cdb_xfer(r
->req
.cmd
.buf
);
2070 DPRINTF("Read (sector %" PRId64
", count %u)\n", r
->req
.cmd
.lba
, len
);
2071 if (r
->req
.cmd
.buf
[1] & 0xe0) {
2072 goto illegal_request
;
2074 if (!check_lba_range(s
, r
->req
.cmd
.lba
, len
)) {
2077 r
->sector
= r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512);
2078 r
->sector_count
= len
* (s
->qdev
.blocksize
/ 512);
2084 case WRITE_VERIFY_10
:
2085 case WRITE_VERIFY_12
:
2086 case WRITE_VERIFY_16
:
2087 if (blk_is_read_only(s
->qdev
.conf
.blk
)) {
2088 scsi_check_condition(r
, SENSE_CODE(WRITE_PROTECTED
));
2091 DPRINTF("Write %s(sector %" PRId64
", count %u)\n",
2092 (command
& 0xe) == 0xe ? "And Verify " : "",
2093 r
->req
.cmd
.lba
, len
);
2094 if (r
->req
.cmd
.buf
[1] & 0xe0) {
2095 goto illegal_request
;
2097 if (!check_lba_range(s
, r
->req
.cmd
.lba
, len
)) {
2100 r
->sector
= r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512);
2101 r
->sector_count
= len
* (s
->qdev
.blocksize
/ 512);
2106 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
2109 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
2112 if (r
->sector_count
== 0) {
2113 scsi_req_complete(&r
->req
, GOOD
);
2115 assert(r
->iov
.iov_len
== 0);
2116 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
2117 return -r
->sector_count
* 512;
2119 return r
->sector_count
* 512;
2123 static void scsi_disk_reset(DeviceState
*dev
)
2125 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
2126 uint64_t nb_sectors
;
2128 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(RESET
));
2130 blk_get_geometry(s
->qdev
.conf
.blk
, &nb_sectors
);
2131 nb_sectors
/= s
->qdev
.blocksize
/ 512;
2135 s
->qdev
.max_lba
= nb_sectors
;
2136 /* reset tray statuses */
2141 static void scsi_disk_resize_cb(void *opaque
)
2143 SCSIDiskState
*s
= opaque
;
2145 /* SPC lists this sense code as available only for
2146 * direct-access devices.
2148 if (s
->qdev
.type
== TYPE_DISK
) {
2149 scsi_device_report_change(&s
->qdev
, SENSE_CODE(CAPACITY_CHANGED
));
2153 static void scsi_cd_change_media_cb(void *opaque
, bool load
)
2155 SCSIDiskState
*s
= opaque
;
2158 * When a CD gets changed, we have to report an ejected state and
2159 * then a loaded state to guests so that they detect tray
2160 * open/close and media change events. Guests that do not use
2161 * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
2162 * states rely on this behavior.
2164 * media_changed governs the state machine used for unit attention
2165 * report. media_event is used by GET EVENT STATUS NOTIFICATION.
2167 s
->media_changed
= load
;
2168 s
->tray_open
= !load
;
2169 scsi_device_set_ua(&s
->qdev
, SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM
));
2170 s
->media_event
= true;
2171 s
->eject_request
= false;
2174 static void scsi_cd_eject_request_cb(void *opaque
, bool force
)
2176 SCSIDiskState
*s
= opaque
;
2178 s
->eject_request
= true;
2180 s
->tray_locked
= false;
2184 static bool scsi_cd_is_tray_open(void *opaque
)
2186 return ((SCSIDiskState
*)opaque
)->tray_open
;
2189 static bool scsi_cd_is_medium_locked(void *opaque
)
2191 return ((SCSIDiskState
*)opaque
)->tray_locked
;
2194 static const BlockDevOps scsi_disk_removable_block_ops
= {
2195 .change_media_cb
= scsi_cd_change_media_cb
,
2196 .eject_request_cb
= scsi_cd_eject_request_cb
,
2197 .is_tray_open
= scsi_cd_is_tray_open
,
2198 .is_medium_locked
= scsi_cd_is_medium_locked
,
2200 .resize_cb
= scsi_disk_resize_cb
,
2203 static const BlockDevOps scsi_disk_block_ops
= {
2204 .resize_cb
= scsi_disk_resize_cb
,
2207 static void scsi_disk_unit_attention_reported(SCSIDevice
*dev
)
2209 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
2210 if (s
->media_changed
) {
2211 s
->media_changed
= false;
2212 scsi_device_set_ua(&s
->qdev
, SENSE_CODE(MEDIUM_CHANGED
));
2216 static void scsi_realize(SCSIDevice
*dev
, Error
**errp
)
2218 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
2221 if (!s
->qdev
.conf
.blk
) {
2222 error_setg(errp
, "drive property not set");
2226 if (!(s
->features
& (1 << SCSI_DISK_F_REMOVABLE
)) &&
2227 !blk_is_inserted(s
->qdev
.conf
.blk
)) {
2228 error_setg(errp
, "Device needs media, but drive is empty");
2232 blkconf_serial(&s
->qdev
.conf
, &s
->serial
);
2233 if (dev
->type
== TYPE_DISK
) {
2234 blkconf_geometry(&dev
->conf
, NULL
, 65535, 255, 255, &err
);
2236 error_propagate(errp
, err
);
2241 if (s
->qdev
.conf
.discard_granularity
== -1) {
2242 s
->qdev
.conf
.discard_granularity
=
2243 MAX(s
->qdev
.conf
.logical_block_size
, DEFAULT_DISCARD_GRANULARITY
);
2247 s
->version
= g_strdup(qemu_get_version());
2250 s
->vendor
= g_strdup("QEMU");
2253 if (blk_is_sg(s
->qdev
.conf
.blk
)) {
2254 error_setg(errp
, "unwanted /dev/sg*");
2258 if ((s
->features
& (1 << SCSI_DISK_F_REMOVABLE
)) &&
2259 !(s
->features
& (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS
))) {
2260 blk_set_dev_ops(s
->qdev
.conf
.blk
, &scsi_disk_removable_block_ops
, s
);
2262 blk_set_dev_ops(s
->qdev
.conf
.blk
, &scsi_disk_block_ops
, s
);
2264 blk_set_guest_block_size(s
->qdev
.conf
.blk
, s
->qdev
.blocksize
);
2266 blk_iostatus_enable(s
->qdev
.conf
.blk
);
2269 static void scsi_hd_realize(SCSIDevice
*dev
, Error
**errp
)
2271 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
2272 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
2273 s
->qdev
.type
= TYPE_DISK
;
2275 s
->product
= g_strdup("QEMU HARDDISK");
2277 scsi_realize(&s
->qdev
, errp
);
2280 static void scsi_cd_realize(SCSIDevice
*dev
, Error
**errp
)
2282 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
2283 s
->qdev
.blocksize
= 2048;
2284 s
->qdev
.type
= TYPE_ROM
;
2285 s
->features
|= 1 << SCSI_DISK_F_REMOVABLE
;
2287 s
->product
= g_strdup("QEMU CD-ROM");
2289 scsi_realize(&s
->qdev
, errp
);
2292 static void scsi_disk_realize(SCSIDevice
*dev
, Error
**errp
)
2295 Error
*local_err
= NULL
;
2297 if (!dev
->conf
.blk
) {
2298 scsi_realize(dev
, &local_err
);
2300 error_propagate(errp
, local_err
);
2304 dinfo
= blk_legacy_dinfo(dev
->conf
.blk
);
2305 if (dinfo
&& dinfo
->media_cd
) {
2306 scsi_cd_realize(dev
, errp
);
2308 scsi_hd_realize(dev
, errp
);
2312 static const SCSIReqOps scsi_disk_emulate_reqops
= {
2313 .size
= sizeof(SCSIDiskReq
),
2314 .free_req
= scsi_free_request
,
2315 .send_command
= scsi_disk_emulate_command
,
2316 .read_data
= scsi_disk_emulate_read_data
,
2317 .write_data
= scsi_disk_emulate_write_data
,
2318 .get_buf
= scsi_get_buf
,
2321 static const SCSIReqOps scsi_disk_dma_reqops
= {
2322 .size
= sizeof(SCSIDiskReq
),
2323 .free_req
= scsi_free_request
,
2324 .send_command
= scsi_disk_dma_command
,
2325 .read_data
= scsi_read_data
,
2326 .write_data
= scsi_write_data
,
2327 .get_buf
= scsi_get_buf
,
2328 .load_request
= scsi_disk_load_request
,
2329 .save_request
= scsi_disk_save_request
,
2332 static const SCSIReqOps
*const scsi_disk_reqops_dispatch
[256] = {
2333 [TEST_UNIT_READY
] = &scsi_disk_emulate_reqops
,
2334 [INQUIRY
] = &scsi_disk_emulate_reqops
,
2335 [MODE_SENSE
] = &scsi_disk_emulate_reqops
,
2336 [MODE_SENSE_10
] = &scsi_disk_emulate_reqops
,
2337 [START_STOP
] = &scsi_disk_emulate_reqops
,
2338 [ALLOW_MEDIUM_REMOVAL
] = &scsi_disk_emulate_reqops
,
2339 [READ_CAPACITY_10
] = &scsi_disk_emulate_reqops
,
2340 [READ_TOC
] = &scsi_disk_emulate_reqops
,
2341 [READ_DVD_STRUCTURE
] = &scsi_disk_emulate_reqops
,
2342 [READ_DISC_INFORMATION
] = &scsi_disk_emulate_reqops
,
2343 [GET_CONFIGURATION
] = &scsi_disk_emulate_reqops
,
2344 [GET_EVENT_STATUS_NOTIFICATION
] = &scsi_disk_emulate_reqops
,
2345 [MECHANISM_STATUS
] = &scsi_disk_emulate_reqops
,
2346 [SERVICE_ACTION_IN_16
] = &scsi_disk_emulate_reqops
,
2347 [REQUEST_SENSE
] = &scsi_disk_emulate_reqops
,
2348 [SYNCHRONIZE_CACHE
] = &scsi_disk_emulate_reqops
,
2349 [SEEK_10
] = &scsi_disk_emulate_reqops
,
2350 [MODE_SELECT
] = &scsi_disk_emulate_reqops
,
2351 [MODE_SELECT_10
] = &scsi_disk_emulate_reqops
,
2352 [UNMAP
] = &scsi_disk_emulate_reqops
,
2353 [WRITE_SAME_10
] = &scsi_disk_emulate_reqops
,
2354 [WRITE_SAME_16
] = &scsi_disk_emulate_reqops
,
2355 [VERIFY_10
] = &scsi_disk_emulate_reqops
,
2356 [VERIFY_12
] = &scsi_disk_emulate_reqops
,
2357 [VERIFY_16
] = &scsi_disk_emulate_reqops
,
2359 [READ_6
] = &scsi_disk_dma_reqops
,
2360 [READ_10
] = &scsi_disk_dma_reqops
,
2361 [READ_12
] = &scsi_disk_dma_reqops
,
2362 [READ_16
] = &scsi_disk_dma_reqops
,
2363 [WRITE_6
] = &scsi_disk_dma_reqops
,
2364 [WRITE_10
] = &scsi_disk_dma_reqops
,
2365 [WRITE_12
] = &scsi_disk_dma_reqops
,
2366 [WRITE_16
] = &scsi_disk_dma_reqops
,
2367 [WRITE_VERIFY_10
] = &scsi_disk_dma_reqops
,
2368 [WRITE_VERIFY_12
] = &scsi_disk_dma_reqops
,
2369 [WRITE_VERIFY_16
] = &scsi_disk_dma_reqops
,
2372 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
,
2373 uint8_t *buf
, void *hba_private
)
2375 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
2377 const SCSIReqOps
*ops
;
2381 ops
= scsi_disk_reqops_dispatch
[command
];
2383 ops
= &scsi_disk_emulate_reqops
;
2385 req
= scsi_req_alloc(ops
, &s
->qdev
, tag
, lun
, hba_private
);
2388 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
2391 for (i
= 1; i
< scsi_cdb_length(buf
); i
++) {
2392 printf(" 0x%02x", buf
[i
]);
2402 static int get_device_type(SCSIDiskState
*s
)
2406 uint8_t sensebuf
[8];
2407 sg_io_hdr_t io_header
;
2410 memset(cmd
, 0, sizeof(cmd
));
2411 memset(buf
, 0, sizeof(buf
));
2413 cmd
[4] = sizeof(buf
);
2415 memset(&io_header
, 0, sizeof(io_header
));
2416 io_header
.interface_id
= 'S';
2417 io_header
.dxfer_direction
= SG_DXFER_FROM_DEV
;
2418 io_header
.dxfer_len
= sizeof(buf
);
2419 io_header
.dxferp
= buf
;
2420 io_header
.cmdp
= cmd
;
2421 io_header
.cmd_len
= sizeof(cmd
);
2422 io_header
.mx_sb_len
= sizeof(sensebuf
);
2423 io_header
.sbp
= sensebuf
;
2424 io_header
.timeout
= 6000; /* XXX */
2426 ret
= blk_ioctl(s
->qdev
.conf
.blk
, SG_IO
, &io_header
);
2427 if (ret
< 0 || io_header
.driver_status
|| io_header
.host_status
) {
2430 s
->qdev
.type
= buf
[0];
2431 if (buf
[1] & 0x80) {
2432 s
->features
|= 1 << SCSI_DISK_F_REMOVABLE
;
2437 static void scsi_block_realize(SCSIDevice
*dev
, Error
**errp
)
2439 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
2443 if (!s
->qdev
.conf
.blk
) {
2444 error_setg(errp
, "drive property not set");
2448 /* check we are using a driver managing SG_IO (version 3 and after) */
2449 rc
= blk_ioctl(s
->qdev
.conf
.blk
, SG_GET_VERSION_NUM
, &sg_version
);
2451 error_setg(errp
, "cannot get SG_IO version number: %s. "
2452 "Is this a SCSI device?",
2456 if (sg_version
< 30000) {
2457 error_setg(errp
, "scsi generic interface too old");
2461 /* get device type from INQUIRY data */
2462 rc
= get_device_type(s
);
2464 error_setg(errp
, "INQUIRY failed");
2468 /* Make a guess for the block size, we'll fix it when the guest sends.
2469 * READ CAPACITY. If they don't, they likely would assume these sizes
2470 * anyway. (TODO: check in /sys).
2472 if (s
->qdev
.type
== TYPE_ROM
|| s
->qdev
.type
== TYPE_WORM
) {
2473 s
->qdev
.blocksize
= 2048;
2475 s
->qdev
.blocksize
= 512;
2478 /* Makes the scsi-block device not removable by using HMP and QMP eject
2481 s
->features
|= (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS
);
2483 scsi_realize(&s
->qdev
, errp
);
2486 static bool scsi_block_is_passthrough(SCSIDiskState
*s
, uint8_t *buf
)
2500 case WRITE_VERIFY_10
:
2501 case WRITE_VERIFY_12
:
2502 case WRITE_VERIFY_16
:
2503 /* If we are not using O_DIRECT, we might read stale data from the
2504 * host cache if writes were made using other commands than these
2505 * ones (such as WRITE SAME or EXTENDED COPY, etc.). So, without
2506 * O_DIRECT everything must go through SG_IO.
2508 if (!(blk_get_flags(s
->qdev
.conf
.blk
) & BDRV_O_NOCACHE
)) {
2512 /* MMC writing cannot be done via pread/pwrite, because it sometimes
2513 * involves writing beyond the maximum LBA or to negative LBA (lead-in).
2514 * And once you do these writes, reading from the block device is
2515 * unreliable, too. It is even possible that reads deliver random data
2516 * from the host page cache (this is probably a Linux bug).
2518 * We might use scsi_disk_dma_reqops as long as no writing commands are
2519 * seen, but performance usually isn't paramount on optical media. So,
2520 * just make scsi-block operate the same as scsi-generic for them.
2522 if (s
->qdev
.type
!= TYPE_ROM
) {
2535 static SCSIRequest
*scsi_block_new_request(SCSIDevice
*d
, uint32_t tag
,
2536 uint32_t lun
, uint8_t *buf
,
2539 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
2541 if (scsi_block_is_passthrough(s
, buf
)) {
2542 return scsi_req_alloc(&scsi_generic_req_ops
, &s
->qdev
, tag
, lun
,
2545 return scsi_req_alloc(&scsi_disk_dma_reqops
, &s
->qdev
, tag
, lun
,
2550 static int scsi_block_parse_cdb(SCSIDevice
*d
, SCSICommand
*cmd
,
2551 uint8_t *buf
, void *hba_private
)
2553 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
2555 if (scsi_block_is_passthrough(s
, buf
)) {
2556 return scsi_bus_parse_cdb(&s
->qdev
, cmd
, buf
, hba_private
);
2558 return scsi_req_parse_cdb(&s
->qdev
, cmd
, buf
);
2564 #define DEFINE_SCSI_DISK_PROPERTIES() \
2565 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
2566 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
2567 DEFINE_PROP_STRING("serial", SCSIDiskState, serial), \
2568 DEFINE_PROP_STRING("vendor", SCSIDiskState, vendor), \
2569 DEFINE_PROP_STRING("product", SCSIDiskState, product)
2571 static Property scsi_hd_properties
[] = {
2572 DEFINE_SCSI_DISK_PROPERTIES(),
2573 DEFINE_PROP_BIT("removable", SCSIDiskState
, features
,
2574 SCSI_DISK_F_REMOVABLE
, false),
2575 DEFINE_PROP_BIT("dpofua", SCSIDiskState
, features
,
2576 SCSI_DISK_F_DPOFUA
, false),
2577 DEFINE_PROP_UINT64("wwn", SCSIDiskState
, wwn
, 0),
2578 DEFINE_PROP_UINT64("port_wwn", SCSIDiskState
, port_wwn
, 0),
2579 DEFINE_PROP_UINT16("port_index", SCSIDiskState
, port_index
, 0),
2580 DEFINE_PROP_UINT64("max_unmap_size", SCSIDiskState
, max_unmap_size
,
2581 DEFAULT_MAX_UNMAP_SIZE
),
2582 DEFINE_BLOCK_CHS_PROPERTIES(SCSIDiskState
, qdev
.conf
),
2583 DEFINE_PROP_END_OF_LIST(),
2586 static const VMStateDescription vmstate_scsi_disk_state
= {
2587 .name
= "scsi-disk",
2589 .minimum_version_id
= 1,
2590 .fields
= (VMStateField
[]) {
2591 VMSTATE_SCSI_DEVICE(qdev
, SCSIDiskState
),
2592 VMSTATE_BOOL(media_changed
, SCSIDiskState
),
2593 VMSTATE_BOOL(media_event
, SCSIDiskState
),
2594 VMSTATE_BOOL(eject_request
, SCSIDiskState
),
2595 VMSTATE_BOOL(tray_open
, SCSIDiskState
),
2596 VMSTATE_BOOL(tray_locked
, SCSIDiskState
),
2597 VMSTATE_END_OF_LIST()
2601 static void scsi_hd_class_initfn(ObjectClass
*klass
, void *data
)
2603 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2604 SCSIDeviceClass
*sc
= SCSI_DEVICE_CLASS(klass
);
2606 sc
->realize
= scsi_hd_realize
;
2607 sc
->alloc_req
= scsi_new_request
;
2608 sc
->unit_attention_reported
= scsi_disk_unit_attention_reported
;
2609 dc
->fw_name
= "disk";
2610 dc
->desc
= "virtual SCSI disk";
2611 dc
->reset
= scsi_disk_reset
;
2612 dc
->props
= scsi_hd_properties
;
2613 dc
->vmsd
= &vmstate_scsi_disk_state
;
2616 static const TypeInfo scsi_hd_info
= {
2618 .parent
= TYPE_SCSI_DEVICE
,
2619 .instance_size
= sizeof(SCSIDiskState
),
2620 .class_init
= scsi_hd_class_initfn
,
2623 static Property scsi_cd_properties
[] = {
2624 DEFINE_SCSI_DISK_PROPERTIES(),
2625 DEFINE_PROP_UINT64("wwn", SCSIDiskState
, wwn
, 0),
2626 DEFINE_PROP_UINT64("port_wwn", SCSIDiskState
, port_wwn
, 0),
2627 DEFINE_PROP_UINT16("port_index", SCSIDiskState
, port_index
, 0),
2628 DEFINE_PROP_END_OF_LIST(),
2631 static void scsi_cd_class_initfn(ObjectClass
*klass
, void *data
)
2633 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2634 SCSIDeviceClass
*sc
= SCSI_DEVICE_CLASS(klass
);
2636 sc
->realize
= scsi_cd_realize
;
2637 sc
->alloc_req
= scsi_new_request
;
2638 sc
->unit_attention_reported
= scsi_disk_unit_attention_reported
;
2639 dc
->fw_name
= "disk";
2640 dc
->desc
= "virtual SCSI CD-ROM";
2641 dc
->reset
= scsi_disk_reset
;
2642 dc
->props
= scsi_cd_properties
;
2643 dc
->vmsd
= &vmstate_scsi_disk_state
;
2646 static const TypeInfo scsi_cd_info
= {
2648 .parent
= TYPE_SCSI_DEVICE
,
2649 .instance_size
= sizeof(SCSIDiskState
),
2650 .class_init
= scsi_cd_class_initfn
,
2654 static Property scsi_block_properties
[] = {
2655 DEFINE_PROP_DRIVE("drive", SCSIDiskState
, qdev
.conf
.blk
),
2656 DEFINE_PROP_END_OF_LIST(),
2659 static void scsi_block_class_initfn(ObjectClass
*klass
, void *data
)
2661 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2662 SCSIDeviceClass
*sc
= SCSI_DEVICE_CLASS(klass
);
2664 sc
->realize
= scsi_block_realize
;
2665 sc
->alloc_req
= scsi_block_new_request
;
2666 sc
->parse_cdb
= scsi_block_parse_cdb
;
2667 dc
->fw_name
= "disk";
2668 dc
->desc
= "SCSI block device passthrough";
2669 dc
->reset
= scsi_disk_reset
;
2670 dc
->props
= scsi_block_properties
;
2671 dc
->vmsd
= &vmstate_scsi_disk_state
;
2674 static const TypeInfo scsi_block_info
= {
2675 .name
= "scsi-block",
2676 .parent
= TYPE_SCSI_DEVICE
,
2677 .instance_size
= sizeof(SCSIDiskState
),
2678 .class_init
= scsi_block_class_initfn
,
2682 static Property scsi_disk_properties
[] = {
2683 DEFINE_SCSI_DISK_PROPERTIES(),
2684 DEFINE_PROP_BIT("removable", SCSIDiskState
, features
,
2685 SCSI_DISK_F_REMOVABLE
, false),
2686 DEFINE_PROP_BIT("dpofua", SCSIDiskState
, features
,
2687 SCSI_DISK_F_DPOFUA
, false),
2688 DEFINE_PROP_UINT64("wwn", SCSIDiskState
, wwn
, 0),
2689 DEFINE_PROP_UINT64("port_wwn", SCSIDiskState
, port_wwn
, 0),
2690 DEFINE_PROP_UINT16("port_index", SCSIDiskState
, port_index
, 0),
2691 DEFINE_PROP_UINT64("max_unmap_size", SCSIDiskState
, max_unmap_size
,
2692 DEFAULT_MAX_UNMAP_SIZE
),
2693 DEFINE_PROP_END_OF_LIST(),
2696 static void scsi_disk_class_initfn(ObjectClass
*klass
, void *data
)
2698 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2699 SCSIDeviceClass
*sc
= SCSI_DEVICE_CLASS(klass
);
2701 sc
->realize
= scsi_disk_realize
;
2702 sc
->alloc_req
= scsi_new_request
;
2703 sc
->unit_attention_reported
= scsi_disk_unit_attention_reported
;
2704 dc
->fw_name
= "disk";
2705 dc
->desc
= "virtual SCSI disk or CD-ROM (legacy)";
2706 dc
->reset
= scsi_disk_reset
;
2707 dc
->props
= scsi_disk_properties
;
2708 dc
->vmsd
= &vmstate_scsi_disk_state
;
2711 static const TypeInfo scsi_disk_info
= {
2712 .name
= "scsi-disk",
2713 .parent
= TYPE_SCSI_DEVICE
,
2714 .instance_size
= sizeof(SCSIDiskState
),
2715 .class_init
= scsi_disk_class_initfn
,
2718 static void scsi_disk_register_types(void)
2720 type_register_static(&scsi_hd_info
);
2721 type_register_static(&scsi_cd_info
);
2723 type_register_static(&scsi_block_info
);
2725 type_register_static(&scsi_disk_info
);
2728 type_init(scsi_disk_register_types
)