2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
48 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSIDiskReq
{
54 /* ??? We should probably keep track of whether the data transfer is
55 a read or a write. Currently we rely on the host getting it right. */
56 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
58 uint32_t sector_count
;
68 /* The qemu block layer uses a fixed 512 byte sector size.
69 This is the number of 512 byte blocks in a single scsi sector. */
77 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
78 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
);
80 static SCSIDiskReq
*scsi_new_request(SCSIDiskState
*s
, uint32_t tag
,
86 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), &s
->qdev
, tag
, lun
);
87 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
88 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
92 static void scsi_remove_request(SCSIDiskReq
*r
)
94 qemu_vfree(r
->iov
.iov_base
);
95 scsi_req_free(&r
->req
);
98 static SCSIDiskReq
*scsi_find_request(SCSIDiskState
*s
, uint32_t tag
)
100 return DO_UPCAST(SCSIDiskReq
, req
, scsi_req_find(&s
->qdev
, tag
));
103 static void scsi_req_set_status(SCSIRequest
*req
, int status
, int sense_code
)
105 req
->status
= status
;
106 scsi_dev_set_sense(req
->dev
, sense_code
);
109 /* Helper function for command completion. */
110 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, int sense
)
112 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
113 r
->req
.tag
, status
, sense
);
114 scsi_req_set_status(&r
->req
, status
, sense
);
115 scsi_req_complete(&r
->req
);
116 scsi_remove_request(r
);
119 /* Cancel a pending data transfer. */
120 static void scsi_cancel_io(SCSIDevice
*d
, uint32_t tag
)
122 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
124 DPRINTF("Cancel tag=0x%x\n", tag
);
125 r
= scsi_find_request(s
, tag
);
128 bdrv_aio_cancel(r
->req
.aiocb
);
130 scsi_remove_request(r
);
134 static void scsi_read_complete(void * opaque
, int ret
)
136 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
142 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
147 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
149 n
= r
->iov
.iov_len
/ 512;
151 r
->sector_count
-= n
;
152 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
156 static void scsi_read_request(SCSIDiskReq
*r
)
158 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
161 if (r
->sector_count
== (uint32_t)-1) {
162 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
164 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
167 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
168 if (r
->sector_count
== 0) {
169 scsi_command_complete(r
, GOOD
, NO_SENSE
);
173 /* No data transfer may already be in progress */
174 assert(r
->req
.aiocb
== NULL
);
177 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
178 n
= SCSI_DMA_BUF_SIZE
/ 512;
180 r
->iov
.iov_len
= n
* 512;
181 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
182 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
183 scsi_read_complete
, r
);
184 if (r
->req
.aiocb
== NULL
) {
185 scsi_read_complete(r
, -EIO
);
189 /* Read more data from scsi device into buffer. */
190 static void scsi_read_data(SCSIDevice
*d
, uint32_t tag
)
192 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
195 r
= scsi_find_request(s
, tag
);
197 BADF("Bad read tag 0x%x\n", tag
);
198 /* ??? This is the wrong error. */
199 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
203 scsi_read_request(r
);
206 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
208 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
209 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
210 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
212 if (action
== BLOCK_ERR_IGNORE
) {
213 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
217 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
218 || action
== BLOCK_ERR_STOP_ANY
) {
220 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
221 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
223 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
226 if (type
== SCSI_REQ_STATUS_RETRY_READ
) {
227 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, 0);
229 scsi_command_complete(r
, CHECK_CONDITION
,
231 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
237 static void scsi_write_complete(void * opaque
, int ret
)
239 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
246 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
251 n
= r
->iov
.iov_len
/ 512;
253 r
->sector_count
-= n
;
254 if (r
->sector_count
== 0) {
255 scsi_command_complete(r
, GOOD
, NO_SENSE
);
257 len
= r
->sector_count
* 512;
258 if (len
> SCSI_DMA_BUF_SIZE
) {
259 len
= SCSI_DMA_BUF_SIZE
;
261 r
->iov
.iov_len
= len
;
262 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
263 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, len
);
267 static void scsi_write_request(SCSIDiskReq
*r
)
269 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
272 /* No data transfer may already be in progress */
273 assert(r
->req
.aiocb
== NULL
);
275 n
= r
->iov
.iov_len
/ 512;
277 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
278 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
279 scsi_write_complete
, r
);
280 if (r
->req
.aiocb
== NULL
) {
281 scsi_write_complete(r
, -EIO
);
284 /* Invoke completion routine to fetch data from host. */
285 scsi_write_complete(r
, 0);
289 /* Write data to a scsi device. Returns nonzero on failure.
290 The transfer may complete asynchronously. */
291 static int scsi_write_data(SCSIDevice
*d
, uint32_t tag
)
293 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
296 DPRINTF("Write data tag=0x%x\n", tag
);
297 r
= scsi_find_request(s
, tag
);
299 BADF("Bad write tag 0x%x\n", tag
);
300 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
304 scsi_write_request(r
);
309 static void scsi_dma_restart_bh(void *opaque
)
311 SCSIDiskState
*s
= opaque
;
315 qemu_bh_delete(s
->bh
);
318 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
319 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
320 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
321 int status
= r
->status
;
325 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
327 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
328 case SCSI_REQ_STATUS_RETRY_READ
:
329 scsi_read_request(r
);
331 case SCSI_REQ_STATUS_RETRY_WRITE
:
332 scsi_write_request(r
);
334 case SCSI_REQ_STATUS_RETRY_FLUSH
:
335 ret
= scsi_disk_emulate_command(r
, r
->iov
.iov_base
);
337 scsi_command_complete(r
, GOOD
, NO_SENSE
);
344 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
346 SCSIDiskState
*s
= opaque
;
352 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
353 qemu_bh_schedule(s
->bh
);
357 /* Return a pointer to the data buffer. */
358 static uint8_t *scsi_get_buf(SCSIDevice
*d
, uint32_t tag
)
360 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
363 r
= scsi_find_request(s
, tag
);
365 BADF("Bad buffer tag 0x%x\n", tag
);
368 return (uint8_t *)r
->iov
.iov_base
;
371 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
373 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
376 if (req
->cmd
.buf
[1] & 0x2) {
377 /* Command support data - optional, not implemented */
378 BADF("optional INQUIRY command support request not implemented\n");
382 if (req
->cmd
.buf
[1] & 0x1) {
383 /* Vital product data */
384 uint8_t page_code
= req
->cmd
.buf
[2];
385 if (req
->cmd
.xfer
< 4) {
386 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
387 "less than 4\n", page_code
, req
->cmd
.xfer
);
391 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
392 outbuf
[buflen
++] = 5;
394 outbuf
[buflen
++] = 0;
396 outbuf
[buflen
++] = page_code
; // this page
397 outbuf
[buflen
++] = 0x00;
400 case 0x00: /* Supported page codes, mandatory */
403 DPRINTF("Inquiry EVPD[Supported pages] "
404 "buffer size %zd\n", req
->cmd
.xfer
);
406 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
407 outbuf
[buflen
++] = 0x80; // unit serial number
408 outbuf
[buflen
++] = 0x83; // device identification
409 if (bdrv_get_type_hint(s
->bs
) != BDRV_TYPE_CDROM
) {
410 outbuf
[buflen
++] = 0xb0; // block device characteristics
412 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
415 case 0x80: /* Device serial number, optional */
417 int l
= strlen(s
->serial
);
419 if (l
> req
->cmd
.xfer
)
424 DPRINTF("Inquiry EVPD[Serial number] "
425 "buffer size %zd\n", req
->cmd
.xfer
);
426 outbuf
[buflen
++] = l
;
427 memcpy(outbuf
+buflen
, s
->serial
, l
);
432 case 0x83: /* Device identification page, mandatory */
434 int max_len
= 255 - 8;
435 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
437 if (id_len
> max_len
)
439 DPRINTF("Inquiry EVPD[Device identification] "
440 "buffer size %zd\n", req
->cmd
.xfer
);
442 outbuf
[buflen
++] = 4 + id_len
;
443 outbuf
[buflen
++] = 0x2; // ASCII
444 outbuf
[buflen
++] = 0; // not officially assigned
445 outbuf
[buflen
++] = 0; // reserved
446 outbuf
[buflen
++] = id_len
; // length of data following
448 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
452 case 0xb0: /* block device characteristics */
454 unsigned int min_io_size
=
455 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
456 unsigned int opt_io_size
=
457 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
459 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
460 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
464 /* required VPD size with unmap support */
465 outbuf
[3] = buflen
= 0x3c;
467 memset(outbuf
+ 4, 0, buflen
- 4);
469 /* optimal transfer length granularity */
470 outbuf
[6] = (min_io_size
>> 8) & 0xff;
471 outbuf
[7] = min_io_size
& 0xff;
473 /* optimal transfer length */
474 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
475 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
476 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
477 outbuf
[15] = opt_io_size
& 0xff;
481 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
482 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
489 /* Standard INQUIRY data */
490 if (req
->cmd
.buf
[2] != 0) {
491 BADF("Error: Inquiry (STANDARD) page or code "
492 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
497 if (req
->cmd
.xfer
< 5) {
498 BADF("Error: Inquiry (STANDARD) buffer size %zd "
499 "is less than 5\n", req
->cmd
.xfer
);
503 buflen
= req
->cmd
.xfer
;
504 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
505 buflen
= SCSI_MAX_INQUIRY_LEN
;
507 memset(outbuf
, 0, buflen
);
509 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
510 outbuf
[0] = 0x7f; /* LUN not supported */
514 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
517 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
520 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
522 memcpy(&outbuf
[8], "QEMU ", 8);
523 memset(&outbuf
[32], 0, 4);
524 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
526 * We claim conformance to SPC-3, which is required for guests
527 * to ask for modern features like READ CAPACITY(16) or the
528 * block characteristics VPD page by default. Not all of SPC-3
529 * is actually implemented, but we're good enough.
532 outbuf
[3] = 2; /* Format 2 */
535 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
537 /* If the allocation length of CDB is too small,
538 the additional length is not adjusted */
542 /* Sync data transfer and TCQ. */
543 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
547 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
,
550 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
551 BlockDriverState
*bdrv
= s
->bs
;
552 int cylinders
, heads
, secs
;
555 * If Changeable Values are requested, a mask denoting those mode parameters
556 * that are changeable shall be returned. As we currently don't support
557 * parameter changes via MODE_SELECT all bits are returned set to zero.
558 * The buffer was already menset to zero by the caller of this function.
561 case 4: /* Rigid disk device geometry page. */
564 if (page_control
== 1) { /* Changeable Values */
567 /* if a geometry hint is available, use it */
568 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
569 p
[2] = (cylinders
>> 16) & 0xff;
570 p
[3] = (cylinders
>> 8) & 0xff;
571 p
[4] = cylinders
& 0xff;
573 /* Write precomp start cylinder, disabled */
574 p
[6] = (cylinders
>> 16) & 0xff;
575 p
[7] = (cylinders
>> 8) & 0xff;
576 p
[8] = cylinders
& 0xff;
577 /* Reduced current start cylinder, disabled */
578 p
[9] = (cylinders
>> 16) & 0xff;
579 p
[10] = (cylinders
>> 8) & 0xff;
580 p
[11] = cylinders
& 0xff;
581 /* Device step rate [ns], 200ns */
584 /* Landing zone cylinder */
588 /* Medium rotation rate [rpm], 5400 rpm */
589 p
[20] = (5400 >> 8) & 0xff;
593 case 5: /* Flexible disk device geometry page. */
596 if (page_control
== 1) { /* Changeable Values */
599 /* Transfer rate [kbit/s], 5Mbit/s */
602 /* if a geometry hint is available, use it */
603 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
606 p
[6] = s
->cluster_size
* 2;
607 p
[8] = (cylinders
>> 8) & 0xff;
608 p
[9] = cylinders
& 0xff;
609 /* Write precomp start cylinder, disabled */
610 p
[10] = (cylinders
>> 8) & 0xff;
611 p
[11] = cylinders
& 0xff;
612 /* Reduced current start cylinder, disabled */
613 p
[12] = (cylinders
>> 8) & 0xff;
614 p
[13] = cylinders
& 0xff;
615 /* Device step rate [100us], 100us */
618 /* Device step pulse width [us], 1us */
620 /* Device head settle delay [100us], 100us */
623 /* Motor on delay [0.1s], 0.1s */
625 /* Motor off delay [0.1s], 0.1s */
627 /* Medium rotation rate [rpm], 5400 rpm */
628 p
[28] = (5400 >> 8) & 0xff;
632 case 8: /* Caching page. */
635 if (page_control
== 1) { /* Changeable Values */
638 if (bdrv_enable_write_cache(s
->bs
)) {
643 case 0x2a: /* CD Capabilities and Mechanical Status page. */
644 if (bdrv_get_type_hint(bdrv
) != BDRV_TYPE_CDROM
)
648 if (page_control
== 1) { /* Changeable Values */
651 p
[2] = 3; // CD-R & CD-RW read
652 p
[3] = 0; // Writing not supported
653 p
[4] = 0x7f; /* Audio, composite, digital out,
654 mode 2 form 1&2, multi session */
655 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
656 RW corrected, C2 errors, ISRC,
658 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
659 /* Locking supported, jumper present, eject, tray */
660 p
[7] = 0; /* no volume & mute control, no
662 p
[8] = (50 * 176) >> 8; // 50x read speed
663 p
[9] = (50 * 176) & 0xff;
664 p
[10] = 0 >> 8; // No volume
666 p
[12] = 2048 >> 8; // 2M buffer
668 p
[14] = (16 * 176) >> 8; // 16x read speed current
669 p
[15] = (16 * 176) & 0xff;
670 p
[18] = (16 * 176) >> 8; // 16x write speed
671 p
[19] = (16 * 176) & 0xff;
672 p
[20] = (16 * 176) >> 8; // 16x write speed current
673 p
[21] = (16 * 176) & 0xff;
681 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
683 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
685 int page
, dbd
, buflen
, page_control
;
687 uint8_t dev_specific_param
;
689 dbd
= req
->cmd
.buf
[1] & 0x8;
690 page
= req
->cmd
.buf
[2] & 0x3f;
691 page_control
= (req
->cmd
.buf
[2] & 0xc0) >> 6;
692 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
693 (req
->cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, req
->cmd
.xfer
, page_control
);
694 memset(outbuf
, 0, req
->cmd
.xfer
);
697 if (bdrv_is_read_only(s
->bs
)) {
698 dev_specific_param
= 0x80; /* Readonly. */
700 dev_specific_param
= 0x00;
703 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
704 p
[1] = 0; /* Default media type. */
705 p
[2] = dev_specific_param
;
706 p
[3] = 0; /* Block descriptor length. */
708 } else { /* MODE_SENSE_10 */
709 p
[2] = 0; /* Default media type. */
710 p
[3] = dev_specific_param
;
711 p
[6] = p
[7] = 0; /* Block descriptor length. */
715 bdrv_get_geometry(s
->bs
, &nb_sectors
);
716 if (!dbd
&& nb_sectors
) {
717 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
718 outbuf
[3] = 8; /* Block descriptor length */
719 } else { /* MODE_SENSE_10 */
720 outbuf
[7] = 8; /* Block descriptor length */
722 nb_sectors
/= s
->cluster_size
;
723 if (nb_sectors
> 0xffffff)
725 p
[0] = 0; /* media density code */
726 p
[1] = (nb_sectors
>> 16) & 0xff;
727 p
[2] = (nb_sectors
>> 8) & 0xff;
728 p
[3] = nb_sectors
& 0xff;
729 p
[4] = 0; /* reserved */
730 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
731 p
[6] = s
->cluster_size
* 2;
736 if (page_control
== 3) { /* Saved Values */
737 return -1; /* ILLEGAL_REQUEST */
745 p
+= mode_sense_page(req
, page
, p
, page_control
);
748 p
+= mode_sense_page(req
, 0x08, p
, page_control
);
749 p
+= mode_sense_page(req
, 0x2a, p
, page_control
);
752 return -1; /* ILLEGAL_REQUEST */
757 * The mode data length field specifies the length in bytes of the
758 * following data that is available to be transferred. The mode data
759 * length does not include itself.
761 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
762 outbuf
[0] = buflen
- 1;
763 } else { /* MODE_SENSE_10 */
764 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
765 outbuf
[1] = (buflen
- 2) & 0xff;
767 if (buflen
> req
->cmd
.xfer
)
768 buflen
= req
->cmd
.xfer
;
772 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
774 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
775 int start_track
, format
, msf
, toclen
;
778 msf
= req
->cmd
.buf
[1] & 2;
779 format
= req
->cmd
.buf
[2] & 0xf;
780 start_track
= req
->cmd
.buf
[6];
781 bdrv_get_geometry(s
->bs
, &nb_sectors
);
782 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
783 nb_sectors
/= s
->cluster_size
;
786 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
789 /* multi session : only a single session defined */
791 memset(outbuf
, 0, 12);
797 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
802 if (toclen
> req
->cmd
.xfer
)
803 toclen
= req
->cmd
.xfer
;
807 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
809 SCSIRequest
*req
= &r
->req
;
810 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
815 switch (req
->cmd
.buf
[0]) {
816 case TEST_UNIT_READY
:
817 if (!bdrv_is_inserted(s
->bs
))
821 if (req
->cmd
.xfer
< 4)
822 goto illegal_request
;
823 memset(outbuf
, 0, 4);
825 if (req
->dev
->sense
.key
== NOT_READY
&& req
->cmd
.xfer
>= 18) {
826 memset(outbuf
, 0, 18);
829 /* asc 0x3a, ascq 0: Medium not present */
835 outbuf
[2] = req
->dev
->sense
.key
;
836 scsi_dev_clear_sense(req
->dev
);
839 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
841 goto illegal_request
;
845 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
847 goto illegal_request
;
850 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
852 goto illegal_request
;
855 if (req
->cmd
.buf
[1] & 1)
856 goto illegal_request
;
859 if (req
->cmd
.buf
[1] & 3)
860 goto illegal_request
;
863 if (req
->cmd
.buf
[1] & 1)
864 goto illegal_request
;
867 if (req
->cmd
.buf
[1] & 3)
868 goto illegal_request
;
871 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
&& (req
->cmd
.buf
[4] & 2)) {
872 /* load/eject medium */
873 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
876 case ALLOW_MEDIUM_REMOVAL
:
877 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
880 /* The normal LEN field for this command is zero. */
881 memset(outbuf
, 0, 8);
882 bdrv_get_geometry(s
->bs
, &nb_sectors
);
885 nb_sectors
/= s
->cluster_size
;
886 /* Returned value is the address of the last sector. */
888 /* Remember the new size for read/write sanity checking. */
889 s
->max_lba
= nb_sectors
;
890 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
891 if (nb_sectors
> UINT32_MAX
)
892 nb_sectors
= UINT32_MAX
;
893 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
894 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
895 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
896 outbuf
[3] = nb_sectors
& 0xff;
899 outbuf
[6] = s
->cluster_size
* 2;
903 case SYNCHRONIZE_CACHE
:
904 ret
= bdrv_flush(s
->bs
);
906 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
911 case GET_CONFIGURATION
:
912 memset(outbuf
, 0, 8);
913 /* ??? This should probably return much more information. For now
914 just return the basic header indicating the CD-ROM profile. */
915 outbuf
[7] = 8; // CD-ROM
918 case SERVICE_ACTION_IN
:
919 /* Service Action In subcommands. */
920 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
921 DPRINTF("SAI READ CAPACITY(16)\n");
922 memset(outbuf
, 0, req
->cmd
.xfer
);
923 bdrv_get_geometry(s
->bs
, &nb_sectors
);
926 nb_sectors
/= s
->cluster_size
;
927 /* Returned value is the address of the last sector. */
929 /* Remember the new size for read/write sanity checking. */
930 s
->max_lba
= nb_sectors
;
931 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
932 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
933 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
934 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
935 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
936 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
937 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
938 outbuf
[7] = nb_sectors
& 0xff;
941 outbuf
[10] = s
->cluster_size
* 2;
944 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
945 /* Protection, exponent and lowest lba field left blank. */
946 buflen
= req
->cmd
.xfer
;
949 DPRINTF("Unsupported Service Action In\n");
950 goto illegal_request
;
952 if (req
->cmd
.xfer
< 16)
953 goto illegal_request
;
954 memset(outbuf
, 0, 16);
961 DPRINTF("Rezero Unit\n");
962 if (!bdrv_is_inserted(s
->bs
)) {
967 goto illegal_request
;
969 scsi_req_set_status(req
, GOOD
, NO_SENSE
);
973 scsi_command_complete(r
, CHECK_CONDITION
, NOT_READY
);
977 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
981 /* Execute a scsi command. Returns the length of the data expected by the
982 command. This will be Positive for data transfers from the device
983 (eg. disk reads), negative for transfers to the device (eg. disk writes),
984 and zero if the command does not transfer any data. */
986 static int32_t scsi_send_command(SCSIDevice
*d
, uint32_t tag
,
987 uint8_t *buf
, int lun
)
989 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1000 r
= scsi_find_request(s
, tag
);
1002 BADF("Tag 0x%x already in use\n", tag
);
1003 scsi_cancel_io(d
, tag
);
1005 /* ??? Tags are not unique for different luns. We only implement a
1006 single lun, so this should not matter. */
1007 r
= scsi_new_request(s
, tag
, lun
);
1008 outbuf
= (uint8_t *)r
->iov
.iov_base
;
1010 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
1011 switch (command
>> 5) {
1013 lba
= (uint64_t) buf
[3] | ((uint64_t) buf
[2] << 8) |
1014 (((uint64_t) buf
[1] & 0x1f) << 16);
1020 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
1021 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
1022 len
= buf
[8] | (buf
[7] << 8);
1026 lba
= (uint64_t) buf
[9] | ((uint64_t) buf
[8] << 8) |
1027 ((uint64_t) buf
[7] << 16) | ((uint64_t) buf
[6] << 24) |
1028 ((uint64_t) buf
[5] << 32) | ((uint64_t) buf
[4] << 40) |
1029 ((uint64_t) buf
[3] << 48) | ((uint64_t) buf
[2] << 56);
1030 len
= buf
[13] | (buf
[12] << 8) | (buf
[11] << 16) | (buf
[10] << 24);
1034 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
1035 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
1036 len
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16) | (buf
[6] << 24);
1040 BADF("Unsupported command length, command %x\n", command
);
1046 for (i
= 1; i
< cmdlen
; i
++) {
1047 printf(" 0x%02x", buf
[i
]);
1053 if (scsi_req_parse(&r
->req
, buf
) != 0) {
1054 BADF("Unsupported command length, command %x\n", command
);
1057 assert(r
->req
.cmd
.len
== cmdlen
);
1058 assert(r
->req
.cmd
.lba
== lba
);
1060 if (lun
|| buf
[1] >> 5) {
1061 /* Only LUN 0 supported. */
1062 DPRINTF("Unimplemented LUN %d\n", lun
? lun
: buf
[1] >> 5);
1063 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
)
1067 case TEST_UNIT_READY
:
1077 case ALLOW_MEDIUM_REMOVAL
:
1079 case SYNCHRONIZE_CACHE
:
1081 case GET_CONFIGURATION
:
1082 case SERVICE_ACTION_IN
:
1086 rc
= scsi_disk_emulate_command(r
, outbuf
);
1091 r
->iov
.iov_len
= rc
;
1097 DPRINTF("Read (sector %" PRId64
", count %d)\n", lba
, len
);
1098 if (lba
> s
->max_lba
)
1100 r
->sector
= lba
* s
->cluster_size
;
1101 r
->sector_count
= len
* s
->cluster_size
;
1108 case WRITE_VERIFY_12
:
1109 case WRITE_VERIFY_16
:
1110 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1111 (command
& 0xe) == 0xe ? "And Verify " : "", lba
, len
);
1112 if (lba
> s
->max_lba
)
1114 r
->sector
= lba
* s
->cluster_size
;
1115 r
->sector_count
= len
* s
->cluster_size
;
1119 DPRINTF("Mode Select(6) (len %d)\n", len
);
1120 /* We don't support mode parameter changes.
1121 Allow the mode parameter header + block descriptors only. */
1126 case MODE_SELECT_10
:
1127 DPRINTF("Mode Select(10) (len %d)\n", len
);
1128 /* We don't support mode parameter changes.
1129 Allow the mode parameter header + block descriptors only. */
1136 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10, lba
);
1137 if (lba
> s
->max_lba
) {
1142 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1144 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
1147 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
1150 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1151 scsi_command_complete(r
, GOOD
, NO_SENSE
);
1153 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1157 if (!r
->sector_count
)
1158 r
->sector_count
= -1;
1163 static void scsi_disk_purge_requests(SCSIDiskState
*s
)
1167 while (!QTAILQ_EMPTY(&s
->qdev
.requests
)) {
1168 r
= DO_UPCAST(SCSIDiskReq
, req
, QTAILQ_FIRST(&s
->qdev
.requests
));
1170 bdrv_aio_cancel(r
->req
.aiocb
);
1172 scsi_remove_request(r
);
1176 static void scsi_disk_reset(DeviceState
*dev
)
1178 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1179 uint64_t nb_sectors
;
1181 scsi_disk_purge_requests(s
);
1183 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1184 nb_sectors
/= s
->cluster_size
;
1188 s
->max_lba
= nb_sectors
;
1191 static void scsi_destroy(SCSIDevice
*dev
)
1193 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1195 scsi_disk_purge_requests(s
);
1196 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1199 static int scsi_disk_initfn(SCSIDevice
*dev
)
1201 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1205 if (!s
->qdev
.conf
.bs
) {
1206 error_report("scsi-disk: drive property not set");
1209 s
->bs
= s
->qdev
.conf
.bs
;
1210 is_cd
= bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
;
1212 if (!is_cd
&& !bdrv_is_inserted(s
->bs
)) {
1213 error_report("Device needs media, but drive is empty");
1218 /* try to fall back to value set with legacy -drive serial=... */
1219 dinfo
= drive_get_by_blockdev(s
->bs
);
1220 s
->serial
= qemu_strdup(*dinfo
->serial
? dinfo
->serial
: "0");
1224 s
->version
= qemu_strdup(QEMU_VERSION
);
1227 if (bdrv_is_sg(s
->bs
)) {
1228 error_report("scsi-disk: unwanted /dev/sg*");
1233 s
->qdev
.blocksize
= 2048;
1235 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1237 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1238 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1240 s
->qdev
.type
= TYPE_DISK
;
1241 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1242 bdrv_set_removable(s
->bs
, is_cd
);
1246 static SCSIDeviceInfo scsi_disk_info
= {
1247 .qdev
.name
= "scsi-disk",
1248 .qdev
.desc
= "virtual scsi disk or cdrom",
1249 .qdev
.size
= sizeof(SCSIDiskState
),
1250 .qdev
.reset
= scsi_disk_reset
,
1251 .init
= scsi_disk_initfn
,
1252 .destroy
= scsi_destroy
,
1253 .send_command
= scsi_send_command
,
1254 .read_data
= scsi_read_data
,
1255 .write_data
= scsi_write_data
,
1256 .cancel_io
= scsi_cancel_io
,
1257 .get_buf
= scsi_get_buf
,
1258 .qdev
.props
= (Property
[]) {
1259 DEFINE_BLOCK_PROPERTIES(SCSIDiskState
, qdev
.conf
),
1260 DEFINE_PROP_STRING("ver", SCSIDiskState
, version
),
1261 DEFINE_PROP_STRING("serial", SCSIDiskState
, serial
),
1262 DEFINE_PROP_END_OF_LIST(),
1266 static void scsi_disk_register_devices(void)
1268 scsi_qdev_register(&scsi_disk_info
);
1270 device_init(scsi_disk_register_devices
)