2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
48 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSIDiskReq
{
54 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
56 uint32_t sector_count
;
66 /* The qemu block layer uses a fixed 512 byte sector size.
67 This is the number of 512 byte blocks in a single scsi sector. */
76 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
77 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
);
79 static void scsi_free_request(SCSIRequest
*req
)
81 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
83 qemu_vfree(r
->iov
.iov_base
);
86 /* Helper function for command completion with sense. */
87 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
89 DPRINTF("Command complete tag=0x%x status=%d sense=%d/%d/%d\n",
90 r
->req
.tag
, status
, sense
.key
, sense
.asc
, sense
.ascq
);
91 scsi_req_build_sense(&r
->req
, sense
);
92 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
95 /* Cancel a pending data transfer. */
96 static void scsi_cancel_io(SCSIRequest
*req
)
98 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
100 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
102 bdrv_aio_cancel(r
->req
.aiocb
);
107 static void scsi_read_complete(void * opaque
, int ret
)
109 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
115 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
120 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
122 n
= r
->iov
.iov_len
/ 512;
124 r
->sector_count
-= n
;
125 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
129 /* Read more data from scsi device into buffer. */
130 static void scsi_read_data(SCSIRequest
*req
)
132 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
133 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
136 if (r
->sector_count
== (uint32_t)-1) {
137 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
139 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
142 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
143 if (r
->sector_count
== 0) {
144 /* This also clears the sense buffer for REQUEST SENSE. */
145 scsi_req_complete(&r
->req
, GOOD
);
149 /* No data transfer may already be in progress */
150 assert(r
->req
.aiocb
== NULL
);
152 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
153 DPRINTF("Data transfer direction invalid\n");
154 scsi_read_complete(r
, -EINVAL
);
159 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
160 n
= SCSI_DMA_BUF_SIZE
/ 512;
162 r
->iov
.iov_len
= n
* 512;
163 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
164 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
165 scsi_read_complete
, r
);
166 if (r
->req
.aiocb
== NULL
) {
167 scsi_read_complete(r
, -EIO
);
171 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
173 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
174 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
175 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
177 if (action
== BLOCK_ERR_IGNORE
) {
178 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
182 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
183 || action
== BLOCK_ERR_STOP_ANY
) {
185 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
186 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
188 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
189 vm_stop(VMSTOP_DISKFULL
);
193 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
196 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
199 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
202 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
207 static void scsi_write_complete(void * opaque
, int ret
)
209 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
216 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
221 n
= r
->iov
.iov_len
/ 512;
223 r
->sector_count
-= n
;
224 if (r
->sector_count
== 0) {
225 scsi_req_complete(&r
->req
, GOOD
);
227 len
= r
->sector_count
* 512;
228 if (len
> SCSI_DMA_BUF_SIZE
) {
229 len
= SCSI_DMA_BUF_SIZE
;
231 r
->iov
.iov_len
= len
;
232 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
233 scsi_req_data(&r
->req
, len
);
237 static void scsi_write_data(SCSIRequest
*req
)
239 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
240 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
243 /* No data transfer may already be in progress */
244 assert(r
->req
.aiocb
== NULL
);
246 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
247 DPRINTF("Data transfer direction invalid\n");
248 scsi_write_complete(r
, -EINVAL
);
252 n
= r
->iov
.iov_len
/ 512;
254 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
255 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
256 scsi_write_complete
, r
);
257 if (r
->req
.aiocb
== NULL
) {
258 scsi_write_complete(r
, -ENOMEM
);
261 /* Invoke completion routine to fetch data from host. */
262 scsi_write_complete(r
, 0);
266 static void scsi_dma_restart_bh(void *opaque
)
268 SCSIDiskState
*s
= opaque
;
272 qemu_bh_delete(s
->bh
);
275 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
276 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
277 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
278 int status
= r
->status
;
282 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
284 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
285 case SCSI_REQ_STATUS_RETRY_READ
:
286 scsi_read_data(&r
->req
);
288 case SCSI_REQ_STATUS_RETRY_WRITE
:
289 scsi_write_data(&r
->req
);
291 case SCSI_REQ_STATUS_RETRY_FLUSH
:
292 ret
= scsi_disk_emulate_command(r
, r
->iov
.iov_base
);
294 scsi_req_complete(&r
->req
, GOOD
);
301 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
303 SCSIDiskState
*s
= opaque
;
309 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
310 qemu_bh_schedule(s
->bh
);
314 /* Return a pointer to the data buffer. */
315 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
317 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
319 return (uint8_t *)r
->iov
.iov_base
;
322 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
324 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
327 if (req
->cmd
.buf
[1] & 0x2) {
328 /* Command support data - optional, not implemented */
329 BADF("optional INQUIRY command support request not implemented\n");
333 if (req
->cmd
.buf
[1] & 0x1) {
334 /* Vital product data */
335 uint8_t page_code
= req
->cmd
.buf
[2];
336 if (req
->cmd
.xfer
< 4) {
337 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
338 "less than 4\n", page_code
, req
->cmd
.xfer
);
342 if (s
->qdev
.type
== TYPE_ROM
) {
343 outbuf
[buflen
++] = 5;
345 outbuf
[buflen
++] = 0;
347 outbuf
[buflen
++] = page_code
; // this page
348 outbuf
[buflen
++] = 0x00;
351 case 0x00: /* Supported page codes, mandatory */
354 DPRINTF("Inquiry EVPD[Supported pages] "
355 "buffer size %zd\n", req
->cmd
.xfer
);
357 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
359 outbuf
[buflen
++] = 0x80; // unit serial number
360 outbuf
[buflen
++] = 0x83; // device identification
361 if (s
->qdev
.type
== TYPE_DISK
) {
362 outbuf
[buflen
++] = 0xb0; // block limits
363 outbuf
[buflen
++] = 0xb2; // thin provisioning
365 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
368 case 0x80: /* Device serial number, optional */
373 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
377 l
= strlen(s
->serial
);
378 if (l
> req
->cmd
.xfer
)
383 DPRINTF("Inquiry EVPD[Serial number] "
384 "buffer size %zd\n", req
->cmd
.xfer
);
385 outbuf
[buflen
++] = l
;
386 memcpy(outbuf
+buflen
, s
->serial
, l
);
391 case 0x83: /* Device identification page, mandatory */
393 int max_len
= 255 - 8;
394 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
396 if (id_len
> max_len
)
398 DPRINTF("Inquiry EVPD[Device identification] "
399 "buffer size %zd\n", req
->cmd
.xfer
);
401 outbuf
[buflen
++] = 4 + id_len
;
402 outbuf
[buflen
++] = 0x2; // ASCII
403 outbuf
[buflen
++] = 0; // not officially assigned
404 outbuf
[buflen
++] = 0; // reserved
405 outbuf
[buflen
++] = id_len
; // length of data following
407 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
411 case 0xb0: /* block limits */
413 unsigned int unmap_sectors
=
414 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
415 unsigned int min_io_size
=
416 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
417 unsigned int opt_io_size
=
418 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
420 if (s
->qdev
.type
== TYPE_ROM
) {
421 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
425 /* required VPD size with unmap support */
426 outbuf
[3] = buflen
= 0x3c;
428 memset(outbuf
+ 4, 0, buflen
- 4);
430 /* optimal transfer length granularity */
431 outbuf
[6] = (min_io_size
>> 8) & 0xff;
432 outbuf
[7] = min_io_size
& 0xff;
434 /* optimal transfer length */
435 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
436 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
437 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
438 outbuf
[15] = opt_io_size
& 0xff;
440 /* optimal unmap granularity */
441 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
442 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
443 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
444 outbuf
[31] = unmap_sectors
& 0xff;
447 case 0xb2: /* thin provisioning */
449 outbuf
[3] = buflen
= 8;
451 outbuf
[5] = 0x40; /* write same with unmap supported */
457 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
458 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
465 /* Standard INQUIRY data */
466 if (req
->cmd
.buf
[2] != 0) {
467 BADF("Error: Inquiry (STANDARD) page or code "
468 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
473 if (req
->cmd
.xfer
< 5) {
474 BADF("Error: Inquiry (STANDARD) buffer size %zd "
475 "is less than 5\n", req
->cmd
.xfer
);
479 buflen
= req
->cmd
.xfer
;
480 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
481 buflen
= SCSI_MAX_INQUIRY_LEN
;
483 memset(outbuf
, 0, buflen
);
485 outbuf
[0] = s
->qdev
.type
& 0x1f;
486 if (s
->qdev
.type
== TYPE_ROM
) {
488 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
490 outbuf
[1] = s
->removable
? 0x80 : 0;
491 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
493 memcpy(&outbuf
[8], "QEMU ", 8);
494 memset(&outbuf
[32], 0, 4);
495 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
497 * We claim conformance to SPC-3, which is required for guests
498 * to ask for modern features like READ CAPACITY(16) or the
499 * block characteristics VPD page by default. Not all of SPC-3
500 * is actually implemented, but we're good enough.
503 outbuf
[3] = 2; /* Format 2 */
506 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
508 /* If the allocation length of CDB is too small,
509 the additional length is not adjusted */
513 /* Sync data transfer and TCQ. */
514 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
518 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
,
521 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
522 BlockDriverState
*bdrv
= s
->bs
;
523 int cylinders
, heads
, secs
;
526 * If Changeable Values are requested, a mask denoting those mode parameters
527 * that are changeable shall be returned. As we currently don't support
528 * parameter changes via MODE_SELECT all bits are returned set to zero.
529 * The buffer was already menset to zero by the caller of this function.
532 case 4: /* Rigid disk device geometry page. */
535 if (page_control
== 1) { /* Changeable Values */
538 /* if a geometry hint is available, use it */
539 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
540 p
[2] = (cylinders
>> 16) & 0xff;
541 p
[3] = (cylinders
>> 8) & 0xff;
542 p
[4] = cylinders
& 0xff;
544 /* Write precomp start cylinder, disabled */
545 p
[6] = (cylinders
>> 16) & 0xff;
546 p
[7] = (cylinders
>> 8) & 0xff;
547 p
[8] = cylinders
& 0xff;
548 /* Reduced current start cylinder, disabled */
549 p
[9] = (cylinders
>> 16) & 0xff;
550 p
[10] = (cylinders
>> 8) & 0xff;
551 p
[11] = cylinders
& 0xff;
552 /* Device step rate [ns], 200ns */
555 /* Landing zone cylinder */
559 /* Medium rotation rate [rpm], 5400 rpm */
560 p
[20] = (5400 >> 8) & 0xff;
564 case 5: /* Flexible disk device geometry page. */
567 if (page_control
== 1) { /* Changeable Values */
570 /* Transfer rate [kbit/s], 5Mbit/s */
573 /* if a geometry hint is available, use it */
574 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
577 p
[6] = s
->cluster_size
* 2;
578 p
[8] = (cylinders
>> 8) & 0xff;
579 p
[9] = cylinders
& 0xff;
580 /* Write precomp start cylinder, disabled */
581 p
[10] = (cylinders
>> 8) & 0xff;
582 p
[11] = cylinders
& 0xff;
583 /* Reduced current start cylinder, disabled */
584 p
[12] = (cylinders
>> 8) & 0xff;
585 p
[13] = cylinders
& 0xff;
586 /* Device step rate [100us], 100us */
589 /* Device step pulse width [us], 1us */
591 /* Device head settle delay [100us], 100us */
594 /* Motor on delay [0.1s], 0.1s */
596 /* Motor off delay [0.1s], 0.1s */
598 /* Medium rotation rate [rpm], 5400 rpm */
599 p
[28] = (5400 >> 8) & 0xff;
603 case 8: /* Caching page. */
606 if (page_control
== 1) { /* Changeable Values */
609 if (bdrv_enable_write_cache(s
->bs
)) {
614 case 0x2a: /* CD Capabilities and Mechanical Status page. */
615 if (s
->qdev
.type
!= TYPE_ROM
)
619 if (page_control
== 1) { /* Changeable Values */
622 p
[2] = 3; // CD-R & CD-RW read
623 p
[3] = 0; // Writing not supported
624 p
[4] = 0x7f; /* Audio, composite, digital out,
625 mode 2 form 1&2, multi session */
626 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
627 RW corrected, C2 errors, ISRC,
629 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
630 /* Locking supported, jumper present, eject, tray */
631 p
[7] = 0; /* no volume & mute control, no
633 p
[8] = (50 * 176) >> 8; // 50x read speed
634 p
[9] = (50 * 176) & 0xff;
635 p
[10] = 0 >> 8; // No volume
637 p
[12] = 2048 >> 8; // 2M buffer
639 p
[14] = (16 * 176) >> 8; // 16x read speed current
640 p
[15] = (16 * 176) & 0xff;
641 p
[18] = (16 * 176) >> 8; // 16x write speed
642 p
[19] = (16 * 176) & 0xff;
643 p
[20] = (16 * 176) >> 8; // 16x write speed current
644 p
[21] = (16 * 176) & 0xff;
652 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
654 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
656 int page
, dbd
, buflen
, page_control
;
658 uint8_t dev_specific_param
;
660 dbd
= req
->cmd
.buf
[1] & 0x8;
661 page
= req
->cmd
.buf
[2] & 0x3f;
662 page_control
= (req
->cmd
.buf
[2] & 0xc0) >> 6;
663 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
664 (req
->cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, req
->cmd
.xfer
, page_control
);
665 memset(outbuf
, 0, req
->cmd
.xfer
);
668 if (bdrv_is_read_only(s
->bs
)) {
669 dev_specific_param
= 0x80; /* Readonly. */
671 dev_specific_param
= 0x00;
674 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
675 p
[1] = 0; /* Default media type. */
676 p
[2] = dev_specific_param
;
677 p
[3] = 0; /* Block descriptor length. */
679 } else { /* MODE_SENSE_10 */
680 p
[2] = 0; /* Default media type. */
681 p
[3] = dev_specific_param
;
682 p
[6] = p
[7] = 0; /* Block descriptor length. */
686 bdrv_get_geometry(s
->bs
, &nb_sectors
);
687 if (!dbd
&& nb_sectors
) {
688 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
689 outbuf
[3] = 8; /* Block descriptor length */
690 } else { /* MODE_SENSE_10 */
691 outbuf
[7] = 8; /* Block descriptor length */
693 nb_sectors
/= s
->cluster_size
;
694 if (nb_sectors
> 0xffffff)
696 p
[0] = 0; /* media density code */
697 p
[1] = (nb_sectors
>> 16) & 0xff;
698 p
[2] = (nb_sectors
>> 8) & 0xff;
699 p
[3] = nb_sectors
& 0xff;
700 p
[4] = 0; /* reserved */
701 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
702 p
[6] = s
->cluster_size
* 2;
707 if (page_control
== 3) { /* Saved Values */
708 return -1; /* ILLEGAL_REQUEST */
716 p
+= mode_sense_page(req
, page
, p
, page_control
);
719 p
+= mode_sense_page(req
, 0x08, p
, page_control
);
720 p
+= mode_sense_page(req
, 0x2a, p
, page_control
);
723 return -1; /* ILLEGAL_REQUEST */
728 * The mode data length field specifies the length in bytes of the
729 * following data that is available to be transferred. The mode data
730 * length does not include itself.
732 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
733 outbuf
[0] = buflen
- 1;
734 } else { /* MODE_SENSE_10 */
735 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
736 outbuf
[1] = (buflen
- 2) & 0xff;
738 if (buflen
> req
->cmd
.xfer
)
739 buflen
= req
->cmd
.xfer
;
743 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
745 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
746 int start_track
, format
, msf
, toclen
;
749 msf
= req
->cmd
.buf
[1] & 2;
750 format
= req
->cmd
.buf
[2] & 0xf;
751 start_track
= req
->cmd
.buf
[6];
752 bdrv_get_geometry(s
->bs
, &nb_sectors
);
753 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
754 nb_sectors
/= s
->cluster_size
;
757 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
760 /* multi session : only a single session defined */
762 memset(outbuf
, 0, 12);
768 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
773 if (toclen
> req
->cmd
.xfer
)
774 toclen
= req
->cmd
.xfer
;
778 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
780 SCSIRequest
*req
= &r
->req
;
781 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
786 switch (req
->cmd
.buf
[0]) {
787 case TEST_UNIT_READY
:
788 if (!bdrv_is_inserted(s
->bs
))
792 if (req
->cmd
.xfer
< 4)
793 goto illegal_request
;
794 buflen
= scsi_device_get_sense(&s
->qdev
, outbuf
, req
->cmd
.xfer
,
795 (req
->cmd
.buf
[1] & 1) == 0);
798 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
800 goto illegal_request
;
804 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
806 goto illegal_request
;
809 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
811 goto illegal_request
;
814 if (req
->cmd
.buf
[1] & 1)
815 goto illegal_request
;
818 if (req
->cmd
.buf
[1] & 3)
819 goto illegal_request
;
822 if (req
->cmd
.buf
[1] & 1)
823 goto illegal_request
;
826 if (req
->cmd
.buf
[1] & 3)
827 goto illegal_request
;
830 if (s
->qdev
.type
== TYPE_ROM
&& (req
->cmd
.buf
[4] & 2)) {
831 /* load/eject medium */
832 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
835 case ALLOW_MEDIUM_REMOVAL
:
836 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
838 case READ_CAPACITY_10
:
839 /* The normal LEN field for this command is zero. */
840 memset(outbuf
, 0, 8);
841 bdrv_get_geometry(s
->bs
, &nb_sectors
);
844 nb_sectors
/= s
->cluster_size
;
845 /* Returned value is the address of the last sector. */
847 /* Remember the new size for read/write sanity checking. */
848 s
->max_lba
= nb_sectors
;
849 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
850 if (nb_sectors
> UINT32_MAX
)
851 nb_sectors
= UINT32_MAX
;
852 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
853 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
854 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
855 outbuf
[3] = nb_sectors
& 0xff;
858 outbuf
[6] = s
->cluster_size
* 2;
862 case SYNCHRONIZE_CACHE
:
863 ret
= bdrv_flush(s
->bs
);
865 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
870 case GET_CONFIGURATION
:
871 memset(outbuf
, 0, 8);
872 /* ??? This should probably return much more information. For now
873 just return the basic header indicating the CD-ROM profile. */
874 outbuf
[7] = 8; // CD-ROM
877 case SERVICE_ACTION_IN
:
878 /* Service Action In subcommands. */
879 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
880 DPRINTF("SAI READ CAPACITY(16)\n");
881 memset(outbuf
, 0, req
->cmd
.xfer
);
882 bdrv_get_geometry(s
->bs
, &nb_sectors
);
885 nb_sectors
/= s
->cluster_size
;
886 /* Returned value is the address of the last sector. */
888 /* Remember the new size for read/write sanity checking. */
889 s
->max_lba
= nb_sectors
;
890 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
891 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
892 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
893 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
894 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
895 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
896 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
897 outbuf
[7] = nb_sectors
& 0xff;
900 outbuf
[10] = s
->cluster_size
* 2;
903 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
905 /* set TPE bit if the format supports discard */
906 if (s
->qdev
.conf
.discard_granularity
) {
910 /* Protection, exponent and lowest lba field left blank. */
911 buflen
= req
->cmd
.xfer
;
914 DPRINTF("Unsupported Service Action In\n");
915 goto illegal_request
;
919 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
925 if (!bdrv_is_inserted(s
->bs
)) {
926 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
928 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
933 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
937 /* Execute a scsi command. Returns the length of the data expected by the
938 command. This will be Positive for data transfers from the device
939 (eg. disk reads), negative for transfers to the device (eg. disk writes),
940 and zero if the command does not transfer any data. */
942 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
944 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
945 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
952 outbuf
= (uint8_t *)r
->iov
.iov_base
;
953 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req
->lun
, req
->tag
, buf
[0]);
958 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
959 printf(" 0x%02x", buf
[i
]);
966 case TEST_UNIT_READY
:
976 case ALLOW_MEDIUM_REMOVAL
:
977 case READ_CAPACITY_10
:
978 case SYNCHRONIZE_CACHE
:
980 case GET_CONFIGURATION
:
981 case SERVICE_ACTION_IN
:
983 rc
= scsi_disk_emulate_command(r
, outbuf
);
994 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
995 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
996 if (r
->req
.cmd
.lba
> s
->max_lba
)
998 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
999 r
->sector_count
= len
* s
->cluster_size
;
1005 case WRITE_VERIFY_10
:
1006 case WRITE_VERIFY_12
:
1007 case WRITE_VERIFY_16
:
1008 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1009 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1010 (command
& 0xe) == 0xe ? "And Verify " : "",
1011 r
->req
.cmd
.lba
, len
);
1012 if (r
->req
.cmd
.lba
> s
->max_lba
)
1014 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1015 r
->sector_count
= len
* s
->cluster_size
;
1018 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1019 /* We don't support mode parameter changes.
1020 Allow the mode parameter header + block descriptors only. */
1021 if (r
->req
.cmd
.xfer
> 12) {
1025 case MODE_SELECT_10
:
1026 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1027 /* We don't support mode parameter changes.
1028 Allow the mode parameter header + block descriptors only. */
1029 if (r
->req
.cmd
.xfer
> 16) {
1035 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1037 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1042 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1044 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1045 r
->req
.cmd
.lba
, len
);
1047 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1052 * We only support WRITE SAME with the unmap bit set for now.
1054 if (!(buf
[1] & 0x8)) {
1058 rc
= bdrv_discard(s
->bs
, r
->req
.cmd
.lba
* s
->cluster_size
,
1059 len
* s
->cluster_size
);
1061 /* XXX: better error code ?*/
1067 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1068 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1071 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1074 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1077 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1078 scsi_req_complete(&r
->req
, GOOD
);
1080 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1081 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
1084 if (!r
->sector_count
)
1085 r
->sector_count
= -1;
1090 static void scsi_disk_reset(DeviceState
*dev
)
1092 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1093 uint64_t nb_sectors
;
1095 scsi_device_purge_requests(&s
->qdev
);
1097 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1098 nb_sectors
/= s
->cluster_size
;
1102 s
->max_lba
= nb_sectors
;
1105 static void scsi_destroy(SCSIDevice
*dev
)
1107 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1109 scsi_device_purge_requests(&s
->qdev
);
1110 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1113 static int scsi_initfn(SCSIDevice
*dev
, uint8_t scsi_type
)
1115 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1118 if (!s
->qdev
.conf
.bs
) {
1119 error_report("scsi-disk: drive property not set");
1122 s
->bs
= s
->qdev
.conf
.bs
;
1124 if (scsi_type
== TYPE_DISK
&& !bdrv_is_inserted(s
->bs
)) {
1125 error_report("Device needs media, but drive is empty");
1130 /* try to fall back to value set with legacy -drive serial=... */
1131 dinfo
= drive_get_by_blockdev(s
->bs
);
1132 if (*dinfo
->serial
) {
1133 s
->serial
= qemu_strdup(dinfo
->serial
);
1138 s
->version
= qemu_strdup(QEMU_VERSION
);
1141 if (bdrv_is_sg(s
->bs
)) {
1142 error_report("scsi-disk: unwanted /dev/sg*");
1146 if (scsi_type
== TYPE_ROM
) {
1147 s
->qdev
.blocksize
= 2048;
1148 } else if (scsi_type
== TYPE_DISK
) {
1149 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1151 error_report("scsi-disk: Unhandled SCSI type %02x", scsi_type
);
1154 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1155 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1157 s
->qdev
.type
= scsi_type
;
1158 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1159 bdrv_set_removable(s
->bs
, scsi_type
== TYPE_ROM
);
1160 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1164 static int scsi_hd_initfn(SCSIDevice
*dev
)
1166 return scsi_initfn(dev
, TYPE_DISK
);
1169 static int scsi_cd_initfn(SCSIDevice
*dev
)
1171 return scsi_initfn(dev
, TYPE_ROM
);
1174 static int scsi_disk_initfn(SCSIDevice
*dev
)
1179 if (!dev
->conf
.bs
) {
1180 scsi_type
= TYPE_DISK
; /* will die in scsi_initfn() */
1182 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1183 scsi_type
= dinfo
->media_cd
? TYPE_ROM
: TYPE_DISK
;
1186 return scsi_initfn(dev
, scsi_type
);
1189 static SCSIReqOps scsi_disk_reqops
= {
1190 .size
= sizeof(SCSIDiskReq
),
1191 .free_req
= scsi_free_request
,
1192 .send_command
= scsi_send_command
,
1193 .read_data
= scsi_read_data
,
1194 .write_data
= scsi_write_data
,
1195 .cancel_io
= scsi_cancel_io
,
1196 .get_buf
= scsi_get_buf
,
1199 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
,
1200 uint32_t lun
, void *hba_private
)
1202 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1206 req
= scsi_req_alloc(&scsi_disk_reqops
, &s
->qdev
, tag
, lun
, hba_private
);
1207 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1208 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
1212 #define DEFINE_SCSI_DISK_PROPERTIES() \
1213 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1214 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1215 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1217 static SCSIDeviceInfo scsi_disk_info
[] = {
1219 .qdev
.name
= "scsi-hd",
1220 .qdev
.fw_name
= "disk",
1221 .qdev
.desc
= "virtual SCSI disk",
1222 .qdev
.size
= sizeof(SCSIDiskState
),
1223 .qdev
.reset
= scsi_disk_reset
,
1224 .init
= scsi_hd_initfn
,
1225 .destroy
= scsi_destroy
,
1226 .alloc_req
= scsi_new_request
,
1227 .qdev
.props
= (Property
[]) {
1228 DEFINE_SCSI_DISK_PROPERTIES(),
1229 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1230 DEFINE_PROP_END_OF_LIST(),
1233 .qdev
.name
= "scsi-cd",
1234 .qdev
.fw_name
= "disk",
1235 .qdev
.desc
= "virtual SCSI CD-ROM",
1236 .qdev
.size
= sizeof(SCSIDiskState
),
1237 .qdev
.reset
= scsi_disk_reset
,
1238 .init
= scsi_cd_initfn
,
1239 .destroy
= scsi_destroy
,
1240 .alloc_req
= scsi_new_request
,
1241 .qdev
.props
= (Property
[]) {
1242 DEFINE_SCSI_DISK_PROPERTIES(),
1243 DEFINE_PROP_END_OF_LIST(),
1246 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1247 .qdev
.fw_name
= "disk",
1248 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1249 .qdev
.size
= sizeof(SCSIDiskState
),
1250 .qdev
.reset
= scsi_disk_reset
,
1251 .init
= scsi_disk_initfn
,
1252 .destroy
= scsi_destroy
,
1253 .alloc_req
= scsi_new_request
,
1254 .qdev
.props
= (Property
[]) {
1255 DEFINE_SCSI_DISK_PROPERTIES(),
1256 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1257 DEFINE_PROP_END_OF_LIST(),
1262 static void scsi_disk_register_devices(void)
1266 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1267 scsi_qdev_register(&scsi_disk_info
[i
]);
1270 device_init(scsi_disk_register_devices
)