?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
throttle: refuse bps_max/iops_max without bps/iops
[qemu/ar7.git] / hw / scsi / scsi-disk.c
blob64f069473467255bba13ce1259463e667a999328
1 /*
2 * SCSI Device emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
6 *
7 * Written by Paul Brook
8 * Modifications:
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
11 * than 36.
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
14 *
15 * This code is licensed under the LGPL.
16 *
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
20 */
21
22 //#define DEBUG_SCSI
23
24 #ifdef DEBUG_SCSI
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
27 #else
28 #define DPRINTF(fmt, ...) do {} while(0)
29 #endif
30
31 #include "qemu-common.h"
32 #include "qemu/error-report.h"
33 #include "hw/scsi/scsi.h"
34 #include "block/scsi.h"
35 #include "sysemu/sysemu.h"
36 #include "sysemu/block-backend.h"
37 #include "sysemu/blockdev.h"
38 #include "hw/block/block.h"
39 #include "sysemu/dma.h"
40
41 #ifdef __linux
42 #include <scsi/sg.h>
43 #endif
44
45 #define SCSI_WRITE_SAME_MAX 524288
46 #define SCSI_DMA_BUF_SIZE 131072
47 #define SCSI_MAX_INQUIRY_LEN 256
48 #define SCSI_MAX_MODE_LEN 256
49
50 #define DEFAULT_DISCARD_GRANULARITY 4096
51 #define DEFAULT_MAX_UNMAP_SIZE (1 << 30) /* 1 GB */
52 #define DEFAULT_MAX_IO_SIZE INT_MAX /* 2 GB - 1 block */
53
54 typedef struct SCSIDiskState SCSIDiskState;
55
56 typedef struct SCSIDiskReq {
57 SCSIRequest req;
58 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
59 uint64_t sector;
60 uint32_t sector_count;
61 uint32_t buflen;
62 bool started;
63 struct iovec iov;
64 QEMUIOVector qiov;
65 BlockAcctCookie acct;
66 } SCSIDiskReq;
67
68 #define SCSI_DISK_F_REMOVABLE 0
69 #define SCSI_DISK_F_DPOFUA 1
70 #define SCSI_DISK_F_NO_REMOVABLE_DEVOPS 2
71
72 struct SCSIDiskState
73 {
74 SCSIDevice qdev;
75 uint32_t features;
76 bool media_changed;
77 bool media_event;
78 bool eject_request;
79 uint64_t wwn;
80 uint64_t port_wwn;
81 uint16_t port_index;
82 uint64_t max_unmap_size;
83 uint64_t max_io_size;
84 QEMUBH *bh;
85 char *version;
86 char *serial;
87 char *vendor;
88 char *product;
89 bool tray_open;
90 bool tray_locked;
91 };
92
93 static int scsi_handle_rw_error(SCSIDiskReq *r, int error);
94
95 static void scsi_free_request(SCSIRequest *req)
96 {
97 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
98
99 qemu_vfree(r->iov.iov_base);
100 }
101
102 /* Helper function for command completion with sense. */
103 static void scsi_check_condition(SCSIDiskReq *r, SCSISense sense)
104 {
105 DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
106 r->req.tag, sense.key, sense.asc, sense.ascq);
107 scsi_req_build_sense(&r->req, sense);
108 scsi_req_complete(&r->req, CHECK_CONDITION);
109 }
110
111 static uint32_t scsi_init_iovec(SCSIDiskReq *r, size_t size)
112 {
113 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
114
115 if (!r->iov.iov_base) {
116 r->buflen = size;
117 r->iov.iov_base = blk_blockalign(s->qdev.conf.blk, r->buflen);
118 }
119 r->iov.iov_len = MIN(r->sector_count * 512, r->buflen);
120 qemu_iovec_init_external(&r->qiov, &r->iov, 1);
121 return r->qiov.size / 512;
122 }
123
124 static void scsi_disk_save_request(QEMUFile *f, SCSIRequest *req)
125 {
126 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
127
128 qemu_put_be64s(f, &r->sector);
129 qemu_put_be32s(f, &r->sector_count);
130 qemu_put_be32s(f, &r->buflen);
131 if (r->buflen) {
132 if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
133 qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
134 } else if (!req->retry) {
135 uint32_t len = r->iov.iov_len;
136 qemu_put_be32s(f, &len);
137 qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
138 }
139 }
140 }
141
142 static void scsi_disk_load_request(QEMUFile *f, SCSIRequest *req)
143 {
144 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
145
146 qemu_get_be64s(f, &r->sector);
147 qemu_get_be32s(f, &r->sector_count);
148 qemu_get_be32s(f, &r->buflen);
149 if (r->buflen) {
150 scsi_init_iovec(r, r->buflen);
151 if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
152 qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
153 } else if (!r->req.retry) {
154 uint32_t len;
155 qemu_get_be32s(f, &len);
156 r->iov.iov_len = len;
157 assert(r->iov.iov_len <= r->buflen);
158 qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
159 }
160 }
161
162 qemu_iovec_init_external(&r->qiov, &r->iov, 1);
163 }
164
165 static void scsi_aio_complete(void *opaque, int ret)
166 {
167 SCSIDiskReq *r = (SCSIDiskReq *)opaque;
168 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
169
170 assert(r->req.aiocb != NULL);
171 r->req.aiocb = NULL;
172 block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
173 if (r->req.io_canceled) {
174 scsi_req_cancel_complete(&r->req);
175 goto done;
176 }
177
178 if (ret < 0) {
179 if (scsi_handle_rw_error(r, -ret)) {
180 goto done;
181 }
182 }
183
184 scsi_req_complete(&r->req, GOOD);
185
186 done:
187 scsi_req_unref(&r->req);
188 }
189
190 static bool scsi_is_cmd_fua(SCSICommand *cmd)
191 {
192 switch (cmd->buf[0]) {
193 case READ_10:
194 case READ_12:
195 case READ_16:
196 case WRITE_10:
197 case WRITE_12:
198 case WRITE_16:
199 return (cmd->buf[1] & 8) != 0;
200
201 case VERIFY_10:
202 case VERIFY_12:
203 case VERIFY_16:
204 case WRITE_VERIFY_10:
205 case WRITE_VERIFY_12:
206 case WRITE_VERIFY_16:
207 return true;
208
209 case READ_6:
210 case WRITE_6:
211 default:
212 return false;
213 }
214 }
215
216 static void scsi_write_do_fua(SCSIDiskReq *r)
217 {
218 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
219
220 if (r->req.io_canceled) {
221 scsi_req_cancel_complete(&r->req);
222 goto done;
223 }
224
225 if (scsi_is_cmd_fua(&r->req.cmd)) {
226 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
227 BLOCK_ACCT_FLUSH);
228 r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
229 return;
230 }
231
232 scsi_req_complete(&r->req, GOOD);
233
234 done:
235 scsi_req_unref(&r->req);
236 }
237
238 static void scsi_dma_complete_noio(void *opaque, int ret)
239 {
240 SCSIDiskReq *r = (SCSIDiskReq *)opaque;
241 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
242
243 if (r->req.aiocb != NULL) {
244 r->req.aiocb = NULL;
245 block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
246 }
247 if (r->req.io_canceled) {
248 scsi_req_cancel_complete(&r->req);
249 goto done;
250 }
251
252 if (ret < 0) {
253 if (scsi_handle_rw_error(r, -ret)) {
254 goto done;
255 }
256 }
257
258 r->sector += r->sector_count;
259 r->sector_count = 0;
260 if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
261 scsi_write_do_fua(r);
262 return;
263 } else {
264 scsi_req_complete(&r->req, GOOD);
265 }
266
267 done:
268 scsi_req_unref(&r->req);
269 }
270
271 static void scsi_dma_complete(void *opaque, int ret)
272 {
273 SCSIDiskReq *r = (SCSIDiskReq *)opaque;
274
275 assert(r->req.aiocb != NULL);
276 scsi_dma_complete_noio(opaque, ret);
277 }
278
279 static void scsi_read_complete(void * opaque, int ret)
280 {
281 SCSIDiskReq *r = (SCSIDiskReq *)opaque;
282 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
283 int n;
284
285 assert(r->req.aiocb != NULL);
286 r->req.aiocb = NULL;
287 block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
288 if (r->req.io_canceled) {
289 scsi_req_cancel_complete(&r->req);
290 goto done;
291 }
292
293 if (ret < 0) {
294 if (scsi_handle_rw_error(r, -ret)) {
295 goto done;
296 }
297 }
298
299 DPRINTF("Data ready tag=0x%x len=%zd\n", r->req.tag, r->qiov.size);
300
301 n = r->qiov.size / 512;
302 r->sector += n;
303 r->sector_count -= n;
304 scsi_req_data(&r->req, r->qiov.size);
305
306 done:
307 scsi_req_unref(&r->req);
308 }
309
310 /* Actually issue a read to the block device. */
311 static void scsi_do_read(void *opaque, int ret)
312 {
313 SCSIDiskReq *r = opaque;
314 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
315 uint32_t n;
316
317 if (r->req.aiocb != NULL) {
318 r->req.aiocb = NULL;
319 block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
320 }
321 if (r->req.io_canceled) {
322 scsi_req_cancel_complete(&r->req);
323 goto done;
324 }
325
326 if (ret < 0) {
327 if (scsi_handle_rw_error(r, -ret)) {
328 goto done;
329 }
330 }
331
332 /* The request is used as the AIO opaque value, so add a ref. */
333 scsi_req_ref(&r->req);
334
335 if (r->req.sg) {
336 dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_READ);
337 r->req.resid -= r->req.sg->size;
338 r->req.aiocb = dma_blk_read(s->qdev.conf.blk, r->req.sg, r->sector,
339 scsi_dma_complete, r);
340 } else {
341 n = scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
342 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
343 n * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);
344 r->req.aiocb = blk_aio_readv(s->qdev.conf.blk, r->sector, &r->qiov, n,
345 scsi_read_complete, r);
346 }
347
348 done:
349 scsi_req_unref(&r->req);
350 }
351
352 /* Read more data from scsi device into buffer. */
353 static void scsi_read_data(SCSIRequest *req)
354 {
355 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
356 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
357 bool first;
358
359 DPRINTF("Read sector_count=%d\n", r->sector_count);
360 if (r->sector_count == 0) {
361 /* This also clears the sense buffer for REQUEST SENSE. */
362 scsi_req_complete(&r->req, GOOD);
363 return;
364 }
365
366 /* No data transfer may already be in progress */
367 assert(r->req.aiocb == NULL);
368
369 /* The request is used as the AIO opaque value, so add a ref. */
370 scsi_req_ref(&r->req);
371 if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
372 DPRINTF("Data transfer direction invalid\n");
373 scsi_read_complete(r, -EINVAL);
374 return;
375 }
376
377 if (s->tray_open) {
378 scsi_read_complete(r, -ENOMEDIUM);
379 return;
380 }
381
382 first = !r->started;
383 r->started = true;
384 if (first && scsi_is_cmd_fua(&r->req.cmd)) {
385 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
386 BLOCK_ACCT_FLUSH);
387 r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_do_read, r);
388 } else {
389 scsi_do_read(r, 0);
390 }
391 }
392
393 /*
394 * scsi_handle_rw_error has two return values. 0 means that the error
395 * must be ignored, 1 means that the error has been processed and the
396 * caller should not do anything else for this request. Note that
397 * scsi_handle_rw_error always manages its reference counts, independent
398 * of the return value.
399 */
400 static int scsi_handle_rw_error(SCSIDiskReq *r, int error)
401 {
402 bool is_read = (r->req.cmd.xfer == SCSI_XFER_FROM_DEV);
403 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
404 BlockErrorAction action = blk_get_error_action(s->qdev.conf.blk,
405 is_read, error);
406
407 if (action == BLOCK_ERROR_ACTION_REPORT) {
408 switch (error) {
409 case ENOMEDIUM:
410 scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
411 break;
412 case ENOMEM:
413 scsi_check_condition(r, SENSE_CODE(TARGET_FAILURE));
414 break;
415 case EINVAL:
416 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
417 break;
418 case ENOSPC:
419 scsi_check_condition(r, SENSE_CODE(SPACE_ALLOC_FAILED));
420 break;
421 default:
422 scsi_check_condition(r, SENSE_CODE(IO_ERROR));
423 break;
424 }
425 }
426 blk_error_action(s->qdev.conf.blk, action, is_read, error);
427 if (action == BLOCK_ERROR_ACTION_STOP) {
428 scsi_req_retry(&r->req);
429 }
430 return action != BLOCK_ERROR_ACTION_IGNORE;
431 }
432
433 static void scsi_write_complete(void * opaque, int ret)
434 {
435 SCSIDiskReq *r = (SCSIDiskReq *)opaque;
436 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
437 uint32_t n;
438
439 if (r->req.aiocb != NULL) {
440 r->req.aiocb = NULL;
441 block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
442 }
443 if (r->req.io_canceled) {
444 scsi_req_cancel_complete(&r->req);
445 goto done;
446 }
447
448 if (ret < 0) {
449 if (scsi_handle_rw_error(r, -ret)) {
450 goto done;
451 }
452 }
453
454 n = r->qiov.size / 512;
455 r->sector += n;
456 r->sector_count -= n;
457 if (r->sector_count == 0) {
458 scsi_write_do_fua(r);
459 return;
460 } else {
461 scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
462 DPRINTF("Write complete tag=0x%x more=%zd\n", r->req.tag, r->qiov.size);
463 scsi_req_data(&r->req, r->qiov.size);
464 }
465
466 done:
467 scsi_req_unref(&r->req);
468 }
469
470 static void scsi_write_data(SCSIRequest *req)
471 {
472 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
473 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
474 uint32_t n;
475
476 /* No data transfer may already be in progress */
477 assert(r->req.aiocb == NULL);
478
479 /* The request is used as the AIO opaque value, so add a ref. */
480 scsi_req_ref(&r->req);
481 if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {
482 DPRINTF("Data transfer direction invalid\n");
483 scsi_write_complete(r, -EINVAL);
484 return;
485 }
486
487 if (!r->req.sg && !r->qiov.size) {
488 /* Called for the first time. Ask the driver to send us more data. */
489 r->started = true;
490 scsi_write_complete(r, 0);
491 return;
492 }
493 if (s->tray_open) {
494 scsi_write_complete(r, -ENOMEDIUM);
495 return;
496 }
497
498 if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
499 r->req.cmd.buf[0] == VERIFY_16) {
500 if (r->req.sg) {
501 scsi_dma_complete_noio(r, 0);
502 } else {
503 scsi_write_complete(r, 0);
504 }
505 return;
506 }
507
508 if (r->req.sg) {
509 dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_WRITE);
510 r->req.resid -= r->req.sg->size;
511 r->req.aiocb = dma_blk_write(s->qdev.conf.blk, r->req.sg, r->sector,
512 scsi_dma_complete, r);
513 } else {
514 n = r->qiov.size / 512;
515 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
516 n * BDRV_SECTOR_SIZE, BLOCK_ACCT_WRITE);
517 r->req.aiocb = blk_aio_writev(s->qdev.conf.blk, r->sector, &r->qiov, n,
518 scsi_write_complete, r);
519 }
520 }
521
522 /* Return a pointer to the data buffer. */
523 static uint8_t *scsi_get_buf(SCSIRequest *req)
524 {
525 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
526
527 return (uint8_t *)r->iov.iov_base;
528 }
529
530 static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
531 {
532 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
533 int buflen = 0;
534 int start;
535
536 if (req->cmd.buf[1] & 0x1) {
537 /* Vital product data */
538 uint8_t page_code = req->cmd.buf[2];
539
540 outbuf[buflen++] = s->qdev.type & 0x1f;
541 outbuf[buflen++] = page_code ; // this page
542 outbuf[buflen++] = 0x00;
543 outbuf[buflen++] = 0x00;
544 start = buflen;
545
546 switch (page_code) {
547 case 0x00: /* Supported page codes, mandatory */
548 {
549 DPRINTF("Inquiry EVPD[Supported pages] "
550 "buffer size %zd\n", req->cmd.xfer);
551 outbuf[buflen++] = 0x00; // list of supported pages (this page)
552 if (s->serial) {
553 outbuf[buflen++] = 0x80; // unit serial number
554 }
555 outbuf[buflen++] = 0x83; // device identification
556 if (s->qdev.type == TYPE_DISK) {
557 outbuf[buflen++] = 0xb0; // block limits
558 outbuf[buflen++] = 0xb2; // thin provisioning
559 }
560 break;
561 }
562 case 0x80: /* Device serial number, optional */
563 {
564 int l;
565
566 if (!s->serial) {
567 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
568 return -1;
569 }
570
571 l = strlen(s->serial);
572 if (l > 20) {
573 l = 20;
574 }
575
576 DPRINTF("Inquiry EVPD[Serial number] "
577 "buffer size %zd\n", req->cmd.xfer);
578 memcpy(outbuf+buflen, s->serial, l);
579 buflen += l;
580 break;
581 }
582
583 case 0x83: /* Device identification page, mandatory */
584 {
585 const char *str = s->serial ?: blk_name(s->qdev.conf.blk);
586 int max_len = s->serial ? 20 : 255 - 8;
587 int id_len = strlen(str);
588
589 if (id_len > max_len) {
590 id_len = max_len;
591 }
592 DPRINTF("Inquiry EVPD[Device identification] "
593 "buffer size %zd\n", req->cmd.xfer);
594
595 outbuf[buflen++] = 0x2; // ASCII
596 outbuf[buflen++] = 0; // not officially assigned
597 outbuf[buflen++] = 0; // reserved
598 outbuf[buflen++] = id_len; // length of data following
599 memcpy(outbuf+buflen, str, id_len);
600 buflen += id_len;
601
602 if (s->wwn) {
603 outbuf[buflen++] = 0x1; // Binary
604 outbuf[buflen++] = 0x3; // NAA
605 outbuf[buflen++] = 0; // reserved
606 outbuf[buflen++] = 8;
607 stq_be_p(&outbuf[buflen], s->wwn);
608 buflen += 8;
609 }
610
611 if (s->port_wwn) {
612 outbuf[buflen++] = 0x61; // SAS / Binary
613 outbuf[buflen++] = 0x93; // PIV / Target port / NAA
614 outbuf[buflen++] = 0; // reserved
615 outbuf[buflen++] = 8;
616 stq_be_p(&outbuf[buflen], s->port_wwn);
617 buflen += 8;
618 }
619
620 if (s->port_index) {
621 outbuf[buflen++] = 0x61; // SAS / Binary
622 outbuf[buflen++] = 0x94; // PIV / Target port / relative target port
623 outbuf[buflen++] = 0; // reserved
624 outbuf[buflen++] = 4;
625 stw_be_p(&outbuf[buflen + 2], s->port_index);
626 buflen += 4;
627 }
628 break;
629 }
630 case 0xb0: /* block limits */
631 {
632 unsigned int unmap_sectors =
633 s->qdev.conf.discard_granularity / s->qdev.blocksize;
634 unsigned int min_io_size =
635 s->qdev.conf.min_io_size / s->qdev.blocksize;
636 unsigned int opt_io_size =
637 s->qdev.conf.opt_io_size / s->qdev.blocksize;
638 unsigned int max_unmap_sectors =
639 s->max_unmap_size / s->qdev.blocksize;
640 unsigned int max_io_sectors =
641 s->max_io_size / s->qdev.blocksize;
642
643 if (s->qdev.type == TYPE_ROM) {
644 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
645 page_code);
646 return -1;
647 }
648 /* required VPD size with unmap support */
649 buflen = 0x40;
650 memset(outbuf + 4, 0, buflen - 4);
651
652 outbuf[4] = 0x1; /* wsnz */
653
654 /* optimal transfer length granularity */
655 outbuf[6] = (min_io_size >> 8) & 0xff;
656 outbuf[7] = min_io_size & 0xff;
657
658 /* maximum transfer length */
659 outbuf[8] = (max_io_sectors >> 24) & 0xff;
660 outbuf[9] = (max_io_sectors >> 16) & 0xff;
661 outbuf[10] = (max_io_sectors >> 8) & 0xff;
662 outbuf[11] = max_io_sectors & 0xff;
663
664 /* optimal transfer length */
665 outbuf[12] = (opt_io_size >> 24) & 0xff;
666 outbuf[13] = (opt_io_size >> 16) & 0xff;
667 outbuf[14] = (opt_io_size >> 8) & 0xff;
668 outbuf[15] = opt_io_size & 0xff;
669
670 /* max unmap LBA count, default is 1GB */
671 outbuf[20] = (max_unmap_sectors >> 24) & 0xff;
672 outbuf[21] = (max_unmap_sectors >> 16) & 0xff;
673 outbuf[22] = (max_unmap_sectors >> 8) & 0xff;
674 outbuf[23] = max_unmap_sectors & 0xff;
675
676 /* max unmap descriptors, 255 fit in 4 kb with an 8-byte header. */
677 outbuf[24] = 0;
678 outbuf[25] = 0;
679 outbuf[26] = 0;
680 outbuf[27] = 255;
681
682 /* optimal unmap granularity */
683 outbuf[28] = (unmap_sectors >> 24) & 0xff;
684 outbuf[29] = (unmap_sectors >> 16) & 0xff;
685 outbuf[30] = (unmap_sectors >> 8) & 0xff;
686 outbuf[31] = unmap_sectors & 0xff;
687
688 /* max write same size */
689 outbuf[36] = 0;
690 outbuf[37] = 0;
691 outbuf[38] = 0;
692 outbuf[39] = 0;
693
694 outbuf[40] = (max_io_sectors >> 24) & 0xff;
695 outbuf[41] = (max_io_sectors >> 16) & 0xff;
696 outbuf[42] = (max_io_sectors >> 8) & 0xff;
697 outbuf[43] = max_io_sectors & 0xff;
698 break;
699 }
700 case 0xb2: /* thin provisioning */
701 {
702 buflen = 8;
703 outbuf[4] = 0;
704 outbuf[5] = 0xe0; /* unmap & write_same 10/16 all supported */
705 outbuf[6] = s->qdev.conf.discard_granularity ? 2 : 1;
706 outbuf[7] = 0;
707 break;
708 }
709 default:
710 return -1;
711 }
712 /* done with EVPD */
713 assert(buflen - start <= 255);
714 outbuf[start - 1] = buflen - start;
715 return buflen;
716 }
717
718 /* Standard INQUIRY data */
719 if (req->cmd.buf[2] != 0) {
720 return -1;
721 }
722
723 /* PAGE CODE == 0 */
724 buflen = req->cmd.xfer;
725 if (buflen > SCSI_MAX_INQUIRY_LEN) {
726 buflen = SCSI_MAX_INQUIRY_LEN;
727 }
728
729 outbuf[0] = s->qdev.type & 0x1f;
730 outbuf[1] = (s->features & (1 << SCSI_DISK_F_REMOVABLE)) ? 0x80 : 0;
731
732 strpadcpy((char *) &outbuf[16], 16, s->product, ' ');
733 strpadcpy((char *) &outbuf[8], 8, s->vendor, ' ');
734
735 memset(&outbuf[32], 0, 4);
736 memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version)));
737 /*
738 * We claim conformance to SPC-3, which is required for guests
739 * to ask for modern features like READ CAPACITY(16) or the
740 * block characteristics VPD page by default. Not all of SPC-3
741 * is actually implemented, but we're good enough.
742 */
743 outbuf[2] = 5;
744 outbuf[3] = 2 | 0x10; /* Format 2, HiSup */
745
746 if (buflen > 36) {
747 outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
748 } else {
749 /* If the allocation length of CDB is too small,
750 the additional length is not adjusted */
751 outbuf[4] = 36 - 5;
752 }
753
754 /* Sync data transfer and TCQ. */
755 outbuf[7] = 0x10 | (req->bus->info->tcq ? 0x02 : 0);
756 return buflen;
757 }
758
759 static inline bool media_is_dvd(SCSIDiskState *s)
760 {
761 uint64_t nb_sectors;
762 if (s->qdev.type != TYPE_ROM) {
763 return false;
764 }
765 if (!blk_is_inserted(s->qdev.conf.blk)) {
766 return false;
767 }
768 if (s->tray_open) {
769 return false;
770 }
771 blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
772 return nb_sectors > CD_MAX_SECTORS;
773 }
774
775 static inline bool media_is_cd(SCSIDiskState *s)
776 {
777 uint64_t nb_sectors;
778 if (s->qdev.type != TYPE_ROM) {
779 return false;
780 }
781 if (!blk_is_inserted(s->qdev.conf.blk)) {
782 return false;
783 }
784 if (s->tray_open) {
785 return false;
786 }
787 blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
788 return nb_sectors <= CD_MAX_SECTORS;
789 }
790
791 static int scsi_read_disc_information(SCSIDiskState *s, SCSIDiskReq *r,
792 uint8_t *outbuf)
793 {
794 uint8_t type = r->req.cmd.buf[1] & 7;
795
796 if (s->qdev.type != TYPE_ROM) {
797 return -1;
798 }
799
800 /* Types 1/2 are only defined for Blu-Ray. */
801 if (type != 0) {
802 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
803 return -1;
804 }
805
806 memset(outbuf, 0, 34);
807 outbuf[1] = 32;
808 outbuf[2] = 0xe; /* last session complete, disc finalized */
809 outbuf[3] = 1; /* first track on disc */
810 outbuf[4] = 1; /* # of sessions */
811 outbuf[5] = 1; /* first track of last session */
812 outbuf[6] = 1; /* last track of last session */
813 outbuf[7] = 0x20; /* unrestricted use */
814 outbuf[8] = 0x00; /* CD-ROM or DVD-ROM */
815 /* 9-10-11: most significant byte corresponding bytes 4-5-6 */
816 /* 12-23: not meaningful for CD-ROM or DVD-ROM */
817 /* 24-31: disc bar code */
818 /* 32: disc application code */
819 /* 33: number of OPC tables */
820
821 return 34;
822 }
823
824 static int scsi_read_dvd_structure(SCSIDiskState *s, SCSIDiskReq *r,
825 uint8_t *outbuf)
826 {
827 static const int rds_caps_size[5] = {
828 [0] = 2048 + 4,
829 [1] = 4 + 4,
830 [3] = 188 + 4,
831 [4] = 2048 + 4,
832 };
833
834 uint8_t media = r->req.cmd.buf[1];
835 uint8_t layer = r->req.cmd.buf[6];
836 uint8_t format = r->req.cmd.buf[7];
837 int size = -1;
838
839 if (s->qdev.type != TYPE_ROM) {
840 return -1;
841 }
842 if (media != 0) {
843 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
844 return -1;
845 }
846
847 if (format != 0xff) {
848 if (s->tray_open || !blk_is_inserted(s->qdev.conf.blk)) {
849 scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
850 return -1;
851 }
852 if (media_is_cd(s)) {
853 scsi_check_condition(r, SENSE_CODE(INCOMPATIBLE_FORMAT));
854 return -1;
855 }
856 if (format >= ARRAY_SIZE(rds_caps_size)) {
857 return -1;
858 }
859 size = rds_caps_size[format];
860 memset(outbuf, 0, size);
861 }
862
863 switch (format) {
864 case 0x00: {
865 /* Physical format information */
866 uint64_t nb_sectors;
867 if (layer != 0) {
868 goto fail;
869 }
870 blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
871
872 outbuf[4] = 1; /* DVD-ROM, part version 1 */
873 outbuf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
874 outbuf[6] = 1; /* one layer, read-only (per MMC-2 spec) */
875 outbuf[7] = 0; /* default densities */
876
877 stl_be_p(&outbuf[12], (nb_sectors >> 2) - 1); /* end sector */
878 stl_be_p(&outbuf[16], (nb_sectors >> 2) - 1); /* l0 end sector */
879 break;
880 }
881
882 case 0x01: /* DVD copyright information, all zeros */
883 break;
884
885 case 0x03: /* BCA information - invalid field for no BCA info */
886 return -1;
887
888 case 0x04: /* DVD disc manufacturing information, all zeros */
889 break;
890
891 case 0xff: { /* List capabilities */
892 int i;
893 size = 4;
894 for (i = 0; i < ARRAY_SIZE(rds_caps_size); i++) {
895 if (!rds_caps_size[i]) {
896 continue;
897 }
898 outbuf[size] = i;
899 outbuf[size + 1] = 0x40; /* Not writable, readable */
900 stw_be_p(&outbuf[size + 2], rds_caps_size[i]);
901 size += 4;
902 }
903 break;
904 }
905
906 default:
907 return -1;
908 }
909
910 /* Size of buffer, not including 2 byte size field */
911 stw_be_p(outbuf, size - 2);
912 return size;
913
914 fail:
915 return -1;
916 }
917
918 static int scsi_event_status_media(SCSIDiskState *s, uint8_t *outbuf)
919 {
920 uint8_t event_code, media_status;
921
922 media_status = 0;
923 if (s->tray_open) {
924 media_status = MS_TRAY_OPEN;
925 } else if (blk_is_inserted(s->qdev.conf.blk)) {
926 media_status = MS_MEDIA_PRESENT;
927 }
928
929 /* Event notification descriptor */
930 event_code = MEC_NO_CHANGE;
931 if (media_status != MS_TRAY_OPEN) {
932 if (s->media_event) {
933 event_code = MEC_NEW_MEDIA;
934 s->media_event = false;
935 } else if (s->eject_request) {
936 event_code = MEC_EJECT_REQUESTED;
937 s->eject_request = false;
938 }
939 }
940
941 outbuf[0] = event_code;
942 outbuf[1] = media_status;
943
944 /* These fields are reserved, just clear them. */
945 outbuf[2] = 0;
946 outbuf[3] = 0;
947 return 4;
948 }
949
950 static int scsi_get_event_status_notification(SCSIDiskState *s, SCSIDiskReq *r,
951 uint8_t *outbuf)
952 {
953 int size;
954 uint8_t *buf = r->req.cmd.buf;
955 uint8_t notification_class_request = buf[4];
956 if (s->qdev.type != TYPE_ROM) {
957 return -1;
958 }
959 if ((buf[1] & 1) == 0) {
960 /* asynchronous */
961 return -1;
962 }
963
964 size = 4;
965 outbuf[0] = outbuf[1] = 0;
966 outbuf[3] = 1 << GESN_MEDIA; /* supported events */
967 if (notification_class_request & (1 << GESN_MEDIA)) {
968 outbuf[2] = GESN_MEDIA;
969 size += scsi_event_status_media(s, &outbuf[size]);
970 } else {
971 outbuf[2] = 0x80;
972 }
973 stw_be_p(outbuf, size - 4);
974 return size;
975 }
976
977 static int scsi_get_configuration(SCSIDiskState *s, uint8_t *outbuf)
978 {
979 int current;
980
981 if (s->qdev.type != TYPE_ROM) {
982 return -1;
983 }
984
985 if (media_is_dvd(s)) {
986 current = MMC_PROFILE_DVD_ROM;
987 } else if (media_is_cd(s)) {
988 current = MMC_PROFILE_CD_ROM;
989 } else {
990 current = MMC_PROFILE_NONE;
991 }
992
993 memset(outbuf, 0, 40);
994 stl_be_p(&outbuf[0], 36); /* Bytes after the data length field */
995 stw_be_p(&outbuf[6], current);
996 /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
997 outbuf[10] = 0x03; /* persistent, current */
998 outbuf[11] = 8; /* two profiles */
999 stw_be_p(&outbuf[12], MMC_PROFILE_DVD_ROM);
1000 outbuf[14] = (current == MMC_PROFILE_DVD_ROM);
1001 stw_be_p(&outbuf[16], MMC_PROFILE_CD_ROM);
1002 outbuf[18] = (current == MMC_PROFILE_CD_ROM);
1003 /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
1004 stw_be_p(&outbuf[20], 1);
1005 outbuf[22] = 0x08 | 0x03; /* version 2, persistent, current */
1006 outbuf[23] = 8;
1007 stl_be_p(&outbuf[24], 1); /* SCSI */
1008 outbuf[28] = 1; /* DBE = 1, mandatory */
1009 /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
1010 stw_be_p(&outbuf[32], 3);
1011 outbuf[34] = 0x08 | 0x03; /* version 2, persistent, current */
1012 outbuf[35] = 4;
1013 outbuf[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
1014 /* TODO: Random readable, CD read, DVD read, drive serial number,
1015 power management */
1016 return 40;
1017 }
1018
1019 static int scsi_emulate_mechanism_status(SCSIDiskState *s, uint8_t *outbuf)
1020 {
1021 if (s->qdev.type != TYPE_ROM) {
1022 return -1;
1023 }
1024 memset(outbuf, 0, 8);
1025 outbuf[5] = 1; /* CD-ROM */
1026 return 8;
1027 }
1028
1029 static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
1030 int page_control)
1031 {
1032 static const int mode_sense_valid[0x3f] = {
1033 [MODE_PAGE_HD_GEOMETRY] = (1 << TYPE_DISK),
1034 [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY] = (1 << TYPE_DISK),
1035 [MODE_PAGE_CACHING] = (1 << TYPE_DISK) | (1 << TYPE_ROM),
1036 [MODE_PAGE_R_W_ERROR] = (1 << TYPE_DISK) | (1 << TYPE_ROM),
1037 [MODE_PAGE_AUDIO_CTL] = (1 << TYPE_ROM),
1038 [MODE_PAGE_CAPABILITIES] = (1 << TYPE_ROM),
1039 };
1040
1041 uint8_t *p = *p_outbuf + 2;
1042 int length;
1043
1044 if ((mode_sense_valid[page] & (1 << s->qdev.type)) == 0) {
1045 return -1;
1046 }
1047
1048 /*
1049 * If Changeable Values are requested, a mask denoting those mode parameters
1050 * that are changeable shall be returned. As we currently don't support
1051 * parameter changes via MODE_SELECT all bits are returned set to zero.
1052 * The buffer was already menset to zero by the caller of this function.
1053 *
1054 * The offsets here are off by two compared to the descriptions in the
1055 * SCSI specs, because those include a 2-byte header. This is unfortunate,
1056 * but it is done so that offsets are consistent within our implementation
1057 * of MODE SENSE and MODE SELECT. MODE SELECT has to deal with both
1058 * 2-byte and 4-byte headers.
1059 */
1060 switch (page) {
1061 case MODE_PAGE_HD_GEOMETRY:
1062 length = 0x16;
1063 if (page_control == 1) { /* Changeable Values */
1064 break;
1065 }
1066 /* if a geometry hint is available, use it */
1067 p[0] = (s->qdev.conf.cyls >> 16) & 0xff;
1068 p[1] = (s->qdev.conf.cyls >> 8) & 0xff;
1069 p[2] = s->qdev.conf.cyls & 0xff;
1070 p[3] = s->qdev.conf.heads & 0xff;
1071 /* Write precomp start cylinder, disabled */
1072 p[4] = (s->qdev.conf.cyls >> 16) & 0xff;
1073 p[5] = (s->qdev.conf.cyls >> 8) & 0xff;
1074 p[6] = s->qdev.conf.cyls & 0xff;
1075 /* Reduced current start cylinder, disabled */
1076 p[7] = (s->qdev.conf.cyls >> 16) & 0xff;
1077 p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
1078 p[9] = s->qdev.conf.cyls & 0xff;
1079 /* Device step rate [ns], 200ns */
1080 p[10] = 0;
1081 p[11] = 200;
1082 /* Landing zone cylinder */
1083 p[12] = 0xff;
1084 p[13] = 0xff;
1085 p[14] = 0xff;
1086 /* Medium rotation rate [rpm], 5400 rpm */
1087 p[18] = (5400 >> 8) & 0xff;
1088 p[19] = 5400 & 0xff;
1089 break;
1090
1091 case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY:
1092 length = 0x1e;
1093 if (page_control == 1) { /* Changeable Values */
1094 break;
1095 }
1096 /* Transfer rate [kbit/s], 5Mbit/s */
1097 p[0] = 5000 >> 8;
1098 p[1] = 5000 & 0xff;
1099 /* if a geometry hint is available, use it */
1100 p[2] = s->qdev.conf.heads & 0xff;
1101 p[3] = s->qdev.conf.secs & 0xff;
1102 p[4] = s->qdev.blocksize >> 8;
1103 p[6] = (s->qdev.conf.cyls >> 8) & 0xff;
1104 p[7] = s->qdev.conf.cyls & 0xff;
1105 /* Write precomp start cylinder, disabled */
1106 p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
1107 p[9] = s->qdev.conf.cyls & 0xff;
1108 /* Reduced current start cylinder, disabled */
1109 p[10] = (s->qdev.conf.cyls >> 8) & 0xff;
1110 p[11] = s->qdev.conf.cyls & 0xff;
1111 /* Device step rate [100us], 100us */
1112 p[12] = 0;
1113 p[13] = 1;
1114 /* Device step pulse width [us], 1us */
1115 p[14] = 1;
1116 /* Device head settle delay [100us], 100us */
1117 p[15] = 0;
1118 p[16] = 1;
1119 /* Motor on delay [0.1s], 0.1s */
1120 p[17] = 1;
1121 /* Motor off delay [0.1s], 0.1s */
1122 p[18] = 1;
1123 /* Medium rotation rate [rpm], 5400 rpm */
1124 p[26] = (5400 >> 8) & 0xff;
1125 p[27] = 5400 & 0xff;
1126 break;
1127
1128 case MODE_PAGE_CACHING:
1129 length = 0x12;
1130 if (page_control == 1 || /* Changeable Values */
1131 blk_enable_write_cache(s->qdev.conf.blk)) {
1132 p[0] = 4; /* WCE */
1133 }
1134 break;
1135
1136 case MODE_PAGE_R_W_ERROR:
1137 length = 10;
1138 if (page_control == 1) { /* Changeable Values */
1139 break;
1140 }
1141 p[0] = 0x80; /* Automatic Write Reallocation Enabled */
1142 if (s->qdev.type == TYPE_ROM) {
1143 p[1] = 0x20; /* Read Retry Count */
1144 }
1145 break;
1146
1147 case MODE_PAGE_AUDIO_CTL:
1148 length = 14;
1149 break;
1150
1151 case MODE_PAGE_CAPABILITIES:
1152 length = 0x14;
1153 if (page_control == 1) { /* Changeable Values */
1154 break;
1155 }
1156
1157 p[0] = 0x3b; /* CD-R & CD-RW read */
1158 p[1] = 0; /* Writing not supported */
1159 p[2] = 0x7f; /* Audio, composite, digital out,
1160 mode 2 form 1&2, multi session */
1161 p[3] = 0xff; /* CD DA, DA accurate, RW supported,
1162 RW corrected, C2 errors, ISRC,
1163 UPC, Bar code */
1164 p[4] = 0x2d | (s->tray_locked ? 2 : 0);
1165 /* Locking supported, jumper present, eject, tray */
1166 p[5] = 0; /* no volume & mute control, no
1167 changer */
1168 p[6] = (50 * 176) >> 8; /* 50x read speed */
1169 p[7] = (50 * 176) & 0xff;
1170 p[8] = 2 >> 8; /* Two volume levels */
1171 p[9] = 2 & 0xff;
1172 p[10] = 2048 >> 8; /* 2M buffer */
1173 p[11] = 2048 & 0xff;
1174 p[12] = (16 * 176) >> 8; /* 16x read speed current */
1175 p[13] = (16 * 176) & 0xff;
1176 p[16] = (16 * 176) >> 8; /* 16x write speed */
1177 p[17] = (16 * 176) & 0xff;
1178 p[18] = (16 * 176) >> 8; /* 16x write speed current */
1179 p[19] = (16 * 176) & 0xff;
1180 break;
1181
1182 default:
1183 return -1;
1184 }
1185
1186 assert(length < 256);
1187 (*p_outbuf)[0] = page;
1188 (*p_outbuf)[1] = length;
1189 *p_outbuf += length + 2;
1190 return length + 2;
1191 }
1192
1193 static int scsi_disk_emulate_mode_sense(SCSIDiskReq *r, uint8_t *outbuf)
1194 {
1195 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1196 uint64_t nb_sectors;
1197 bool dbd;
1198 int page, buflen, ret, page_control;
1199 uint8_t *p;
1200 uint8_t dev_specific_param;
1201
1202 dbd = (r->req.cmd.buf[1] & 0x8) != 0;
1203 page = r->req.cmd.buf[2] & 0x3f;
1204 page_control = (r->req.cmd.buf[2] & 0xc0) >> 6;
1205 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
1206 (r->req.cmd.buf[0] == MODE_SENSE) ? 6 : 10, page, r->req.cmd.xfer, page_control);
1207 memset(outbuf, 0, r->req.cmd.xfer);
1208 p = outbuf;
1209
1210 if (s->qdev.type == TYPE_DISK) {
1211 dev_specific_param = s->features & (1 << SCSI_DISK_F_DPOFUA) ? 0x10 : 0;
1212 if (blk_is_read_only(s->qdev.conf.blk)) {
1213 dev_specific_param |= 0x80; /* Readonly. */
1214 }
1215 } else {
1216 /* MMC prescribes that CD/DVD drives have no block descriptors,
1217 * and defines no device-specific parameter. */
1218 dev_specific_param = 0x00;
1219 dbd = true;
1220 }
1221
1222 if (r->req.cmd.buf[0] == MODE_SENSE) {
1223 p[1] = 0; /* Default media type. */
1224 p[2] = dev_specific_param;
1225 p[3] = 0; /* Block descriptor length. */
1226 p += 4;
1227 } else { /* MODE_SENSE_10 */
1228 p[2] = 0; /* Default media type. */
1229 p[3] = dev_specific_param;
1230 p[6] = p[7] = 0; /* Block descriptor length. */
1231 p += 8;
1232 }
1233
1234 blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
1235 if (!dbd && nb_sectors) {
1236 if (r->req.cmd.buf[0] == MODE_SENSE) {
1237 outbuf[3] = 8; /* Block descriptor length */
1238 } else { /* MODE_SENSE_10 */
1239 outbuf[7] = 8; /* Block descriptor length */
1240 }
1241 nb_sectors /= (s->qdev.blocksize / 512);
1242 if (nb_sectors > 0xffffff) {
1243 nb_sectors = 0;
1244 }
1245 p[0] = 0; /* media density code */
1246 p[1] = (nb_sectors >> 16) & 0xff;
1247 p[2] = (nb_sectors >> 8) & 0xff;
1248 p[3] = nb_sectors & 0xff;
1249 p[4] = 0; /* reserved */
1250 p[5] = 0; /* bytes 5-7 are the sector size in bytes */
1251 p[6] = s->qdev.blocksize >> 8;
1252 p[7] = 0;
1253 p += 8;
1254 }
1255
1256 if (page_control == 3) {
1257 /* Saved Values */
1258 scsi_check_condition(r, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED));
1259 return -1;
1260 }
1261
1262 if (page == 0x3f) {
1263 for (page = 0; page <= 0x3e; page++) {
1264 mode_sense_page(s, page, &p, page_control);
1265 }
1266 } else {
1267 ret = mode_sense_page(s, page, &p, page_control);
1268 if (ret == -1) {
1269 return -1;
1270 }
1271 }
1272
1273 buflen = p - outbuf;
1274 /*
1275 * The mode data length field specifies the length in bytes of the
1276 * following data that is available to be transferred. The mode data
1277 * length does not include itself.
1278 */
1279 if (r->req.cmd.buf[0] == MODE_SENSE) {
1280 outbuf[0] = buflen - 1;
1281 } else { /* MODE_SENSE_10 */
1282 outbuf[0] = ((buflen - 2) >> 8) & 0xff;
1283 outbuf[1] = (buflen - 2) & 0xff;
1284 }
1285 return buflen;
1286 }
1287
1288 static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)
1289 {
1290 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1291 int start_track, format, msf, toclen;
1292 uint64_t nb_sectors;
1293
1294 msf = req->cmd.buf[1] & 2;
1295 format = req->cmd.buf[2] & 0xf;
1296 start_track = req->cmd.buf[6];
1297 blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
1298 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
1299 nb_sectors /= s->qdev.blocksize / 512;
1300 switch (format) {
1301 case 0:
1302 toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
1303 break;
1304 case 1:
1305 /* multi session : only a single session defined */
1306 toclen = 12;
1307 memset(outbuf, 0, 12);
1308 outbuf[1] = 0x0a;
1309 outbuf[2] = 0x01;
1310 outbuf[3] = 0x01;
1311 break;
1312 case 2:
1313 toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
1314 break;
1315 default:
1316 return -1;
1317 }
1318 return toclen;
1319 }
1320
1321 static int scsi_disk_emulate_start_stop(SCSIDiskReq *r)
1322 {
1323 SCSIRequest *req = &r->req;
1324 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1325 bool start = req->cmd.buf[4] & 1;
1326 bool loej = req->cmd.buf[4] & 2; /* load on start, eject on !start */
1327 int pwrcnd = req->cmd.buf[4] & 0xf0;
1328
1329 if (pwrcnd) {
1330 /* eject/load only happens for power condition == 0 */
1331 return 0;
1332 }
1333
1334 if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) && loej) {
1335 if (!start && !s->tray_open && s->tray_locked) {
1336 scsi_check_condition(r,
1337 blk_is_inserted(s->qdev.conf.blk)
1338 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED)
1339 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED));
1340 return -1;
1341 }
1342
1343 if (s->tray_open != !start) {
1344 blk_eject(s->qdev.conf.blk, !start);
1345 s->tray_open = !start;
1346 }
1347 }
1348 return 0;
1349 }
1350
1351 static void scsi_disk_emulate_read_data(SCSIRequest *req)
1352 {
1353 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1354 int buflen = r->iov.iov_len;
1355
1356 if (buflen) {
1357 DPRINTF("Read buf_len=%d\n", buflen);
1358 r->iov.iov_len = 0;
1359 r->started = true;
1360 scsi_req_data(&r->req, buflen);
1361 return;
1362 }
1363
1364 /* This also clears the sense buffer for REQUEST SENSE. */
1365 scsi_req_complete(&r->req, GOOD);
1366 }
1367
1368 static int scsi_disk_check_mode_select(SCSIDiskState *s, int page,
1369 uint8_t *inbuf, int inlen)
1370 {
1371 uint8_t mode_current[SCSI_MAX_MODE_LEN];
1372 uint8_t mode_changeable[SCSI_MAX_MODE_LEN];
1373 uint8_t *p;
1374 int len, expected_len, changeable_len, i;
1375
1376 /* The input buffer does not include the page header, so it is
1377 * off by 2 bytes.
1378 */
1379 expected_len = inlen + 2;
1380 if (expected_len > SCSI_MAX_MODE_LEN) {
1381 return -1;
1382 }
1383
1384 p = mode_current;
1385 memset(mode_current, 0, inlen + 2);
1386 len = mode_sense_page(s, page, &p, 0);
1387 if (len < 0 || len != expected_len) {
1388 return -1;
1389 }
1390
1391 p = mode_changeable;
1392 memset(mode_changeable, 0, inlen + 2);
1393 changeable_len = mode_sense_page(s, page, &p, 1);
1394 assert(changeable_len == len);
1395
1396 /* Check that unchangeable bits are the same as what MODE SENSE
1397 * would return.
1398 */
1399 for (i = 2; i < len; i++) {
1400 if (((mode_current[i] ^ inbuf[i - 2]) & ~mode_changeable[i]) != 0) {
1401 return -1;
1402 }
1403 }
1404 return 0;
1405 }
1406
1407 static void scsi_disk_apply_mode_select(SCSIDiskState *s, int page, uint8_t *p)
1408 {
1409 switch (page) {
1410 case MODE_PAGE_CACHING:
1411 blk_set_enable_write_cache(s->qdev.conf.blk, (p[0] & 4) != 0);
1412 break;
1413
1414 default:
1415 break;
1416 }
1417 }
1418
1419 static int mode_select_pages(SCSIDiskReq *r, uint8_t *p, int len, bool change)
1420 {
1421 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1422
1423 while (len > 0) {
1424 int page, subpage, page_len;
1425
1426 /* Parse both possible formats for the mode page headers. */
1427 page = p[0] & 0x3f;
1428 if (p[0] & 0x40) {
1429 if (len < 4) {
1430 goto invalid_param_len;
1431 }
1432 subpage = p[1];
1433 page_len = lduw_be_p(&p[2]);
1434 p += 4;
1435 len -= 4;
1436 } else {
1437 if (len < 2) {
1438 goto invalid_param_len;
1439 }
1440 subpage = 0;
1441 page_len = p[1];
1442 p += 2;
1443 len -= 2;
1444 }
1445
1446 if (subpage) {
1447 goto invalid_param;
1448 }
1449 if (page_len > len) {
1450 goto invalid_param_len;
1451 }
1452
1453 if (!change) {
1454 if (scsi_disk_check_mode_select(s, page, p, page_len) < 0) {
1455 goto invalid_param;
1456 }
1457 } else {
1458 scsi_disk_apply_mode_select(s, page, p);
1459 }
1460
1461 p += page_len;
1462 len -= page_len;
1463 }
1464 return 0;
1465
1466 invalid_param:
1467 scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1468 return -1;
1469
1470 invalid_param_len:
1471 scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1472 return -1;
1473 }
1474
1475 static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf)
1476 {
1477 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1478 uint8_t *p = inbuf;
1479 int cmd = r->req.cmd.buf[0];
1480 int len = r->req.cmd.xfer;
1481 int hdr_len = (cmd == MODE_SELECT ? 4 : 8);
1482 int bd_len;
1483 int pass;
1484
1485 /* We only support PF=1, SP=0. */
1486 if ((r->req.cmd.buf[1] & 0x11) != 0x10) {
1487 goto invalid_field;
1488 }
1489
1490 if (len < hdr_len) {
1491 goto invalid_param_len;
1492 }
1493
1494 bd_len = (cmd == MODE_SELECT ? p[3] : lduw_be_p(&p[6]));
1495 len -= hdr_len;
1496 p += hdr_len;
1497 if (len < bd_len) {
1498 goto invalid_param_len;
1499 }
1500 if (bd_len != 0 && bd_len != 8) {
1501 goto invalid_param;
1502 }
1503
1504 len -= bd_len;
1505 p += bd_len;
1506
1507 /* Ensure no change is made if there is an error! */
1508 for (pass = 0; pass < 2; pass++) {
1509 if (mode_select_pages(r, p, len, pass == 1) < 0) {
1510 assert(pass == 0);
1511 return;
1512 }
1513 }
1514 if (!blk_enable_write_cache(s->qdev.conf.blk)) {
1515 /* The request is used as the AIO opaque value, so add a ref. */
1516 scsi_req_ref(&r->req);
1517 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
1518 BLOCK_ACCT_FLUSH);
1519 r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
1520 return;
1521 }
1522
1523 scsi_req_complete(&r->req, GOOD);
1524 return;
1525
1526 invalid_param:
1527 scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1528 return;
1529
1530 invalid_param_len:
1531 scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1532 return;
1533
1534 invalid_field:
1535 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1536 }
1537
1538 static inline bool check_lba_range(SCSIDiskState *s,
1539 uint64_t sector_num, uint32_t nb_sectors)
1540 {
1541 /*
1542 * The first line tests that no overflow happens when computing the last
1543 * sector. The second line tests that the last accessed sector is in
1544 * range.
1545 *
1546 * Careful, the computations should not underflow for nb_sectors == 0,
1547 * and a 0-block read to the first LBA beyond the end of device is
1548 * valid.
1549 */
1550 return (sector_num <= sector_num + nb_sectors &&
1551 sector_num + nb_sectors <= s->qdev.max_lba + 1);
1552 }
1553
1554 typedef struct UnmapCBData {
1555 SCSIDiskReq *r;
1556 uint8_t *inbuf;
1557 int count;
1558 } UnmapCBData;
1559
1560 static void scsi_unmap_complete(void *opaque, int ret)
1561 {
1562 UnmapCBData *data = opaque;
1563 SCSIDiskReq *r = data->r;
1564 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1565 uint64_t sector_num;
1566 uint32_t nb_sectors;
1567
1568 r->req.aiocb = NULL;
1569 if (r->req.io_canceled) {
1570 scsi_req_cancel_complete(&r->req);
1571 goto done;
1572 }
1573
1574 if (ret < 0) {
1575 if (scsi_handle_rw_error(r, -ret)) {
1576 goto done;
1577 }
1578 }
1579
1580 if (data->count > 0) {
1581 sector_num = ldq_be_p(&data->inbuf[0]);
1582 nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
1583 if (!check_lba_range(s, sector_num, nb_sectors)) {
1584 scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1585 goto done;
1586 }
1587
1588 r->req.aiocb = blk_aio_discard(s->qdev.conf.blk,
1589 sector_num * (s->qdev.blocksize / 512),
1590 nb_sectors * (s->qdev.blocksize / 512),
1591 scsi_unmap_complete, data);
1592 data->count--;
1593 data->inbuf += 16;
1594 return;
1595 }
1596
1597 scsi_req_complete(&r->req, GOOD);
1598
1599 done:
1600 scsi_req_unref(&r->req);
1601 g_free(data);
1602 }
1603
1604 static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf)
1605 {
1606 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1607 uint8_t *p = inbuf;
1608 int len = r->req.cmd.xfer;
1609 UnmapCBData *data;
1610
1611 /* Reject ANCHOR=1. */
1612 if (r->req.cmd.buf[1] & 0x1) {
1613 goto invalid_field;
1614 }
1615
1616 if (len < 8) {
1617 goto invalid_param_len;
1618 }
1619 if (len < lduw_be_p(&p[0]) + 2) {
1620 goto invalid_param_len;
1621 }
1622 if (len < lduw_be_p(&p[2]) + 8) {
1623 goto invalid_param_len;
1624 }
1625 if (lduw_be_p(&p[2]) & 15) {
1626 goto invalid_param_len;
1627 }
1628
1629 if (blk_is_read_only(s->qdev.conf.blk)) {
1630 scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1631 return;
1632 }
1633
1634 data = g_new0(UnmapCBData, 1);
1635 data->r = r;
1636 data->inbuf = &p[8];
1637 data->count = lduw_be_p(&p[2]) >> 4;
1638
1639 /* The matching unref is in scsi_unmap_complete, before data is freed. */
1640 scsi_req_ref(&r->req);
1641 scsi_unmap_complete(data, 0);
1642 return;
1643
1644 invalid_param_len:
1645 scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1646 return;
1647
1648 invalid_field:
1649 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1650 }
1651
1652 typedef struct WriteSameCBData {
1653 SCSIDiskReq *r;
1654 int64_t sector;
1655 int nb_sectors;
1656 QEMUIOVector qiov;
1657 struct iovec iov;
1658 } WriteSameCBData;
1659
1660 static void scsi_write_same_complete(void *opaque, int ret)
1661 {
1662 WriteSameCBData *data = opaque;
1663 SCSIDiskReq *r = data->r;
1664 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1665
1666 assert(r->req.aiocb != NULL);
1667 r->req.aiocb = NULL;
1668 block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
1669 if (r->req.io_canceled) {
1670 scsi_req_cancel_complete(&r->req);
1671 goto done;
1672 }
1673
1674 if (ret < 0) {
1675 if (scsi_handle_rw_error(r, -ret)) {
1676 goto done;
1677 }
1678 }
1679
1680 data->nb_sectors -= data->iov.iov_len / 512;
1681 data->sector += data->iov.iov_len / 512;
1682 data->iov.iov_len = MIN(data->nb_sectors * 512, data->iov.iov_len);
1683 if (data->iov.iov_len) {
1684 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1685 data->iov.iov_len, BLOCK_ACCT_WRITE);
1686 r->req.aiocb = blk_aio_writev(s->qdev.conf.blk, data->sector,
1687 &data->qiov, data->iov.iov_len / 512,
1688 scsi_write_same_complete, data);
1689 return;
1690 }
1691
1692 scsi_req_complete(&r->req, GOOD);
1693
1694 done:
1695 scsi_req_unref(&r->req);
1696 qemu_vfree(data->iov.iov_base);
1697 g_free(data);
1698 }
1699
1700 static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf)
1701 {
1702 SCSIRequest *req = &r->req;
1703 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1704 uint32_t nb_sectors = scsi_data_cdb_xfer(r->req.cmd.buf);
1705 WriteSameCBData *data;
1706 uint8_t *buf;
1707 int i;
1708
1709 /* Fail if PBDATA=1 or LBDATA=1 or ANCHOR=1. */
1710 if (nb_sectors == 0 || (req->cmd.buf[1] & 0x16)) {
1711 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1712 return;
1713 }
1714
1715 if (blk_is_read_only(s->qdev.conf.blk)) {
1716 scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1717 return;
1718 }
1719 if (!check_lba_range(s, r->req.cmd.lba, nb_sectors)) {
1720 scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1721 return;
1722 }
1723
1724 if (buffer_is_zero(inbuf, s->qdev.blocksize)) {
1725 int flags = (req->cmd.buf[1] & 0x8) ? BDRV_REQ_MAY_UNMAP : 0;
1726
1727 /* The request is used as the AIO opaque value, so add a ref. */
1728 scsi_req_ref(&r->req);
1729 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1730 nb_sectors * s->qdev.blocksize,
1731 BLOCK_ACCT_WRITE);
1732 r->req.aiocb = blk_aio_write_zeroes(s->qdev.conf.blk,
1733 r->req.cmd.lba * (s->qdev.blocksize / 512),
1734 nb_sectors * (s->qdev.blocksize / 512),
1735 flags, scsi_aio_complete, r);
1736 return;
1737 }
1738
1739 data = g_new0(WriteSameCBData, 1);
1740 data->r = r;
1741 data->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
1742 data->nb_sectors = nb_sectors * (s->qdev.blocksize / 512);
1743 data->iov.iov_len = MIN(data->nb_sectors * 512, SCSI_WRITE_SAME_MAX);
1744 data->iov.iov_base = buf = blk_blockalign(s->qdev.conf.blk,
1745 data->iov.iov_len);
1746 qemu_iovec_init_external(&data->qiov, &data->iov, 1);
1747
1748 for (i = 0; i < data->iov.iov_len; i += s->qdev.blocksize) {
1749 memcpy(&buf[i], inbuf, s->qdev.blocksize);
1750 }
1751
1752 scsi_req_ref(&r->req);
1753 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1754 data->iov.iov_len, BLOCK_ACCT_WRITE);
1755 r->req.aiocb = blk_aio_writev(s->qdev.conf.blk, data->sector,
1756 &data->qiov, data->iov.iov_len / 512,
1757 scsi_write_same_complete, data);
1758 }
1759
1760 static void scsi_disk_emulate_write_data(SCSIRequest *req)
1761 {
1762 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1763
1764 if (r->iov.iov_len) {
1765 int buflen = r->iov.iov_len;
1766 DPRINTF("Write buf_len=%d\n", buflen);
1767 r->iov.iov_len = 0;
1768 scsi_req_data(&r->req, buflen);
1769 return;
1770 }
1771
1772 switch (req->cmd.buf[0]) {
1773 case MODE_SELECT:
1774 case MODE_SELECT_10:
1775 /* This also clears the sense buffer for REQUEST SENSE. */
1776 scsi_disk_emulate_mode_select(r, r->iov.iov_base);
1777 break;
1778
1779 case UNMAP:
1780 scsi_disk_emulate_unmap(r, r->iov.iov_base);
1781 break;
1782
1783 case VERIFY_10:
1784 case VERIFY_12:
1785 case VERIFY_16:
1786 if (r->req.status == -1) {
1787 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1788 }
1789 break;
1790
1791 case WRITE_SAME_10:
1792 case WRITE_SAME_16:
1793 scsi_disk_emulate_write_same(r, r->iov.iov_base);
1794 break;
1795
1796 default:
1797 abort();
1798 }
1799 }
1800
1801 static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf)
1802 {
1803 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1804 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1805 uint64_t nb_sectors;
1806 uint8_t *outbuf;
1807 int buflen;
1808
1809 switch (req->cmd.buf[0]) {
1810 case INQUIRY:
1811 case MODE_SENSE:
1812 case MODE_SENSE_10:
1813 case RESERVE:
1814 case RESERVE_10:
1815 case RELEASE:
1816 case RELEASE_10:
1817 case START_STOP:
1818 case ALLOW_MEDIUM_REMOVAL:
1819 case GET_CONFIGURATION:
1820 case GET_EVENT_STATUS_NOTIFICATION:
1821 case MECHANISM_STATUS:
1822 case REQUEST_SENSE:
1823 break;
1824
1825 default:
1826 if (s->tray_open || !blk_is_inserted(s->qdev.conf.blk)) {
1827 scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
1828 return 0;
1829 }
1830 break;
1831 }
1832
1833 /*
1834 * FIXME: we shouldn't return anything bigger than 4k, but the code
1835 * requires the buffer to be as big as req->cmd.xfer in several
1836 * places. So, do not allow CDBs with a very large ALLOCATION
1837 * LENGTH. The real fix would be to modify scsi_read_data and
1838 * dma_buf_read, so that they return data beyond the buflen
1839 * as all zeros.
1840 */
1841 if (req->cmd.xfer > 65536) {
1842 goto illegal_request;
1843 }
1844 r->buflen = MAX(4096, req->cmd.xfer);
1845
1846 if (!r->iov.iov_base) {
1847 r->iov.iov_base = blk_blockalign(s->qdev.conf.blk, r->buflen);
1848 }
1849
1850 buflen = req->cmd.xfer;
1851 outbuf = r->iov.iov_base;
1852 memset(outbuf, 0, r->buflen);
1853 switch (req->cmd.buf[0]) {
1854 case TEST_UNIT_READY:
1855 assert(!s->tray_open && blk_is_inserted(s->qdev.conf.blk));
1856 break;
1857 case INQUIRY:
1858 buflen = scsi_disk_emulate_inquiry(req, outbuf);
1859 if (buflen < 0) {
1860 goto illegal_request;
1861 }
1862 break;
1863 case MODE_SENSE:
1864 case MODE_SENSE_10:
1865 buflen = scsi_disk_emulate_mode_sense(r, outbuf);
1866 if (buflen < 0) {
1867 goto illegal_request;
1868 }
1869 break;
1870 case READ_TOC:
1871 buflen = scsi_disk_emulate_read_toc(req, outbuf);
1872 if (buflen < 0) {
1873 goto illegal_request;
1874 }
1875 break;
1876 case RESERVE:
1877 if (req->cmd.buf[1] & 1) {
1878 goto illegal_request;
1879 }
1880 break;
1881 case RESERVE_10:
1882 if (req->cmd.buf[1] & 3) {
1883 goto illegal_request;
1884 }
1885 break;
1886 case RELEASE:
1887 if (req->cmd.buf[1] & 1) {
1888 goto illegal_request;
1889 }
1890 break;
1891 case RELEASE_10:
1892 if (req->cmd.buf[1] & 3) {
1893 goto illegal_request;
1894 }
1895 break;
1896 case START_STOP:
1897 if (scsi_disk_emulate_start_stop(r) < 0) {
1898 return 0;
1899 }
1900 break;
1901 case ALLOW_MEDIUM_REMOVAL:
1902 s->tray_locked = req->cmd.buf[4] & 1;
1903 blk_lock_medium(s->qdev.conf.blk, req->cmd.buf[4] & 1);
1904 break;
1905 case READ_CAPACITY_10:
1906 /* The normal LEN field for this command is zero. */
1907 memset(outbuf, 0, 8);
1908 blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
1909 if (!nb_sectors) {
1910 scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
1911 return 0;
1912 }
1913 if ((req->cmd.buf[8] & 1) == 0 && req->cmd.lba) {
1914 goto illegal_request;
1915 }
1916 nb_sectors /= s->qdev.blocksize / 512;
1917 /* Returned value is the address of the last sector. */
1918 nb_sectors--;
1919 /* Remember the new size for read/write sanity checking. */
1920 s->qdev.max_lba = nb_sectors;
1921 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
1922 if (nb_sectors > UINT32_MAX) {
1923 nb_sectors = UINT32_MAX;
1924 }
1925 outbuf[0] = (nb_sectors >> 24) & 0xff;
1926 outbuf[1] = (nb_sectors >> 16) & 0xff;
1927 outbuf[2] = (nb_sectors >> 8) & 0xff;
1928 outbuf[3] = nb_sectors & 0xff;
1929 outbuf[4] = 0;
1930 outbuf[5] = 0;
1931 outbuf[6] = s->qdev.blocksize >> 8;
1932 outbuf[7] = 0;
1933 break;
1934 case REQUEST_SENSE:
1935 /* Just return "NO SENSE". */
1936 buflen = scsi_build_sense(NULL, 0, outbuf, r->buflen,
1937 (req->cmd.buf[1] & 1) == 0);
1938 if (buflen < 0) {
1939 goto illegal_request;
1940 }
1941 break;
1942 case MECHANISM_STATUS:
1943 buflen = scsi_emulate_mechanism_status(s, outbuf);
1944 if (buflen < 0) {
1945 goto illegal_request;
1946 }
1947 break;
1948 case GET_CONFIGURATION:
1949 buflen = scsi_get_configuration(s, outbuf);
1950 if (buflen < 0) {
1951 goto illegal_request;
1952 }
1953 break;
1954 case GET_EVENT_STATUS_NOTIFICATION:
1955 buflen = scsi_get_event_status_notification(s, r, outbuf);
1956 if (buflen < 0) {
1957 goto illegal_request;
1958 }
1959 break;
1960 case READ_DISC_INFORMATION:
1961 buflen = scsi_read_disc_information(s, r, outbuf);
1962 if (buflen < 0) {
1963 goto illegal_request;
1964 }
1965 break;
1966 case READ_DVD_STRUCTURE:
1967 buflen = scsi_read_dvd_structure(s, r, outbuf);
1968 if (buflen < 0) {
1969 goto illegal_request;
1970 }
1971 break;
1972 case SERVICE_ACTION_IN_16:
1973 /* Service Action In subcommands. */
1974 if ((req->cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) {
1975 DPRINTF("SAI READ CAPACITY(16)\n");
1976 memset(outbuf, 0, req->cmd.xfer);
1977 blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
1978 if (!nb_sectors) {
1979 scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
1980 return 0;
1981 }
1982 if ((req->cmd.buf[14] & 1) == 0 && req->cmd.lba) {
1983 goto illegal_request;
1984 }
1985 nb_sectors /= s->qdev.blocksize / 512;
1986 /* Returned value is the address of the last sector. */
1987 nb_sectors--;
1988 /* Remember the new size for read/write sanity checking. */
1989 s->qdev.max_lba = nb_sectors;
1990 outbuf[0] = (nb_sectors >> 56) & 0xff;
1991 outbuf[1] = (nb_sectors >> 48) & 0xff;
1992 outbuf[2] = (nb_sectors >> 40) & 0xff;
1993 outbuf[3] = (nb_sectors >> 32) & 0xff;
1994 outbuf[4] = (nb_sectors >> 24) & 0xff;
1995 outbuf[5] = (nb_sectors >> 16) & 0xff;
1996 outbuf[6] = (nb_sectors >> 8) & 0xff;
1997 outbuf[7] = nb_sectors & 0xff;
1998 outbuf[8] = 0;
1999 outbuf[9] = 0;
2000 outbuf[10] = s->qdev.blocksize >> 8;
2001 outbuf[11] = 0;
2002 outbuf[12] = 0;
2003 outbuf[13] = get_physical_block_exp(&s->qdev.conf);
2004
2005 /* set TPE bit if the format supports discard */
2006 if (s->qdev.conf.discard_granularity) {
2007 outbuf[14] = 0x80;
2008 }
2009
2010 /* Protection, exponent and lowest lba field left blank. */
2011 break;
2012 }
2013 DPRINTF("Unsupported Service Action In\n");
2014 goto illegal_request;
2015 case SYNCHRONIZE_CACHE:
2016 /* The request is used as the AIO opaque value, so add a ref. */
2017 scsi_req_ref(&r->req);
2018 block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
2019 BLOCK_ACCT_FLUSH);
2020 r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
2021 return 0;
2022 case SEEK_10:
2023 DPRINTF("Seek(10) (sector %" PRId64 ")\n", r->req.cmd.lba);
2024 if (r->req.cmd.lba > s->qdev.max_lba) {
2025 goto illegal_lba;
2026 }
2027 break;
2028 case MODE_SELECT:
2029 DPRINTF("Mode Select(6) (len %lu)\n", (long)r->req.cmd.xfer);
2030 break;
2031 case MODE_SELECT_10:
2032 DPRINTF("Mode Select(10) (len %lu)\n", (long)r->req.cmd.xfer);
2033 break;
2034 case UNMAP:
2035 DPRINTF("Unmap (len %lu)\n", (long)r->req.cmd.xfer);
2036 break;
2037 case VERIFY_10:
2038 case VERIFY_12:
2039 case VERIFY_16:
2040 DPRINTF("Verify (bytchk %d)\n", (req->cmd.buf[1] >> 1) & 3);
2041 if (req->cmd.buf[1] & 6) {
2042 goto illegal_request;
2043 }
2044 break;
2045 case WRITE_SAME_10:
2046 case WRITE_SAME_16:
2047 DPRINTF("WRITE SAME %d (len %lu)\n",
2048 req->cmd.buf[0] == WRITE_SAME_10 ? 10 : 16,
2049 (long)r->req.cmd.xfer);
2050 break;
2051 default:
2052 DPRINTF("Unknown SCSI command (%2.2x=%s)\n", buf[0],
2053 scsi_command_name(buf[0]));
2054 scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE));
2055 return 0;
2056 }
2057 assert(!r->req.aiocb);
2058 r->iov.iov_len = MIN(r->buflen, req->cmd.xfer);
2059 if (r->iov.iov_len == 0) {
2060 scsi_req_complete(&r->req, GOOD);
2061 }
2062 if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
2063 assert(r->iov.iov_len == req->cmd.xfer);
2064 return -r->iov.iov_len;
2065 } else {
2066 return r->iov.iov_len;
2067 }
2068
2069 illegal_request:
2070 if (r->req.status == -1) {
2071 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
2072 }
2073 return 0;
2074
2075 illegal_lba:
2076 scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
2077 return 0;
2078 }
2079
2080 /* Execute a scsi command. Returns the length of the data expected by the
2081 command. This will be Positive for data transfers from the device
2082 (eg. disk reads), negative for transfers to the device (eg. disk writes),
2083 and zero if the command does not transfer any data. */
2084
2085 static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
2086 {
2087 SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
2088 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
2089 uint32_t len;
2090 uint8_t command;
2091
2092 command = buf[0];
2093
2094 if (s->tray_open || !blk_is_inserted(s->qdev.conf.blk)) {
2095 scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
2096 return 0;
2097 }
2098
2099 len = scsi_data_cdb_xfer(r->req.cmd.buf);
2100 switch (command) {
2101 case READ_6:
2102 case READ_10:
2103 case READ_12:
2104 case READ_16:
2105 DPRINTF("Read (sector %" PRId64 ", count %u)\n", r->req.cmd.lba, len);
2106 if (r->req.cmd.buf[1] & 0xe0) {
2107 goto illegal_request;
2108 }
2109 if (!check_lba_range(s, r->req.cmd.lba, len)) {
2110 goto illegal_lba;
2111 }
2112 r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
2113 r->sector_count = len * (s->qdev.blocksize / 512);
2114 break;
2115 case WRITE_6:
2116 case WRITE_10:
2117 case WRITE_12:
2118 case WRITE_16:
2119 case WRITE_VERIFY_10:
2120 case WRITE_VERIFY_12:
2121 case WRITE_VERIFY_16:
2122 if (blk_is_read_only(s->qdev.conf.blk)) {
2123 scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
2124 return 0;
2125 }
2126 DPRINTF("Write %s(sector %" PRId64 ", count %u)\n",
2127 (command & 0xe) == 0xe ? "And Verify " : "",
2128 r->req.cmd.lba, len);
2129 if (r->req.cmd.buf[1] & 0xe0) {
2130 goto illegal_request;
2131 }
2132 if (!check_lba_range(s, r->req.cmd.lba, len)) {
2133 goto illegal_lba;
2134 }
2135 r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
2136 r->sector_count = len * (s->qdev.blocksize / 512);
2137 break;
2138 default:
2139 abort();
2140 illegal_request:
2141 scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
2142 return 0;
2143 illegal_lba:
2144 scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
2145 return 0;
2146 }
2147 if (r->sector_count == 0) {
2148 scsi_req_complete(&r->req, GOOD);
2149 }
2150 assert(r->iov.iov_len == 0);
2151 if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
2152 return -r->sector_count * 512;
2153 } else {
2154 return r->sector_count * 512;
2155 }
2156 }
2157
2158 static void scsi_disk_reset(DeviceState *dev)
2159 {
2160 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev.qdev, dev);
2161 uint64_t nb_sectors;
2162
2163 scsi_device_purge_requests(&s->qdev, SENSE_CODE(RESET));
2164
2165 blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
2166 nb_sectors /= s->qdev.blocksize / 512;
2167 if (nb_sectors) {
2168 nb_sectors--;
2169 }
2170 s->qdev.max_lba = nb_sectors;
2171 /* reset tray statuses */
2172 s->tray_locked = 0;
2173 s->tray_open = 0;
2174 }
2175
2176 static void scsi_disk_resize_cb(void *opaque)
2177 {
2178 SCSIDiskState *s = opaque;
2179
2180 /* SPC lists this sense code as available only for
2181 * direct-access devices.
2182 */
2183 if (s->qdev.type == TYPE_DISK) {
2184 scsi_device_report_change(&s->qdev, SENSE_CODE(CAPACITY_CHANGED));
2185 }
2186 }
2187
2188 static void scsi_cd_change_media_cb(void *opaque, bool load)
2189 {
2190 SCSIDiskState *s = opaque;
2191
2192 /*
2193 * When a CD gets changed, we have to report an ejected state and
2194 * then a loaded state to guests so that they detect tray
2195 * open/close and media change events. Guests that do not use
2196 * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
2197 * states rely on this behavior.
2198 *
2199 * media_changed governs the state machine used for unit attention
2200 * report. media_event is used by GET EVENT STATUS NOTIFICATION.
2201 */
2202 s->media_changed = load;
2203 s->tray_open = !load;
2204 scsi_device_set_ua(&s->qdev, SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM));
2205 s->media_event = true;
2206 s->eject_request = false;
2207 }
2208
2209 static void scsi_cd_eject_request_cb(void *opaque, bool force)
2210 {
2211 SCSIDiskState *s = opaque;
2212
2213 s->eject_request = true;
2214 if (force) {
2215 s->tray_locked = false;
2216 }
2217 }
2218
2219 static bool scsi_cd_is_tray_open(void *opaque)
2220 {
2221 return ((SCSIDiskState *)opaque)->tray_open;
2222 }
2223
2224 static bool scsi_cd_is_medium_locked(void *opaque)
2225 {
2226 return ((SCSIDiskState *)opaque)->tray_locked;
2227 }
2228
2229 static const BlockDevOps scsi_disk_removable_block_ops = {
2230 .change_media_cb = scsi_cd_change_media_cb,
2231 .eject_request_cb = scsi_cd_eject_request_cb,
2232 .is_tray_open = scsi_cd_is_tray_open,
2233 .is_medium_locked = scsi_cd_is_medium_locked,
2234
2235 .resize_cb = scsi_disk_resize_cb,
2236 };
2237
2238 static const BlockDevOps scsi_disk_block_ops = {
2239 .resize_cb = scsi_disk_resize_cb,
2240 };
2241
2242 static void scsi_disk_unit_attention_reported(SCSIDevice *dev)
2243 {
2244 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2245 if (s->media_changed) {
2246 s->media_changed = false;
2247 scsi_device_set_ua(&s->qdev, SENSE_CODE(MEDIUM_CHANGED));
2248 }
2249 }
2250
2251 static void scsi_realize(SCSIDevice *dev, Error **errp)
2252 {
2253 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2254 Error *err = NULL;
2255
2256 if (!s->qdev.conf.blk) {
2257 error_setg(errp, "drive property not set");
2258 return;
2259 }
2260
2261 if (!(s->features & (1 << SCSI_DISK_F_REMOVABLE)) &&
2262 !blk_is_inserted(s->qdev.conf.blk)) {
2263 error_setg(errp, "Device needs media, but drive is empty");
2264 return;
2265 }
2266
2267 blkconf_serial(&s->qdev.conf, &s->serial);
2268 blkconf_blocksizes(&s->qdev.conf);
2269 if (dev->type == TYPE_DISK) {
2270 blkconf_geometry(&dev->conf, NULL, 65535, 255, 255, &err);
2271 if (err) {
2272 error_propagate(errp, err);
2273 return;
2274 }
2275 }
2276
2277 if (s->qdev.conf.discard_granularity == -1) {
2278 s->qdev.conf.discard_granularity =
2279 MAX(s->qdev.conf.logical_block_size, DEFAULT_DISCARD_GRANULARITY);
2280 }
2281
2282 if (!s->version) {
2283 s->version = g_strdup(qemu_get_version());
2284 }
2285 if (!s->vendor) {
2286 s->vendor = g_strdup("QEMU");
2287 }
2288
2289 if (blk_is_sg(s->qdev.conf.blk)) {
2290 error_setg(errp, "unwanted /dev/sg*");
2291 return;
2292 }
2293
2294 if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) &&
2295 !(s->features & (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS))) {
2296 blk_set_dev_ops(s->qdev.conf.blk, &scsi_disk_removable_block_ops, s);
2297 } else {
2298 blk_set_dev_ops(s->qdev.conf.blk, &scsi_disk_block_ops, s);
2299 }
2300 blk_set_guest_block_size(s->qdev.conf.blk, s->qdev.blocksize);
2301
2302 blk_iostatus_enable(s->qdev.conf.blk);
2303 }
2304
2305 static void scsi_hd_realize(SCSIDevice *dev, Error **errp)
2306 {
2307 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2308 /* can happen for devices without drive. The error message for missing
2309 * backend will be issued in scsi_realize
2310 */
2311 if (s->qdev.conf.blk) {
2312 blkconf_blocksizes(&s->qdev.conf);
2313 }
2314 s->qdev.blocksize = s->qdev.conf.logical_block_size;
2315 s->qdev.type = TYPE_DISK;
2316 if (!s->product) {
2317 s->product = g_strdup("QEMU HARDDISK");
2318 }
2319 scsi_realize(&s->qdev, errp);
2320 }
2321
2322 static void scsi_cd_realize(SCSIDevice *dev, Error **errp)
2323 {
2324 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2325 s->qdev.blocksize = 2048;
2326 s->qdev.type = TYPE_ROM;
2327 s->features |= 1 << SCSI_DISK_F_REMOVABLE;
2328 if (!s->product) {
2329 s->product = g_strdup("QEMU CD-ROM");
2330 }
2331 scsi_realize(&s->qdev, errp);
2332 }
2333
2334 static void scsi_disk_realize(SCSIDevice *dev, Error **errp)
2335 {
2336 DriveInfo *dinfo;
2337 Error *local_err = NULL;
2338
2339 if (!dev->conf.blk) {
2340 scsi_realize(dev, &local_err);
2341 assert(local_err);
2342 error_propagate(errp, local_err);
2343 return;
2344 }
2345
2346 dinfo = blk_legacy_dinfo(dev->conf.blk);
2347 if (dinfo && dinfo->media_cd) {
2348 scsi_cd_realize(dev, errp);
2349 } else {
2350 scsi_hd_realize(dev, errp);
2351 }
2352 }
2353
2354 static const SCSIReqOps scsi_disk_emulate_reqops = {
2355 .size = sizeof(SCSIDiskReq),
2356 .free_req = scsi_free_request,
2357 .send_command = scsi_disk_emulate_command,
2358 .read_data = scsi_disk_emulate_read_data,
2359 .write_data = scsi_disk_emulate_write_data,
2360 .get_buf = scsi_get_buf,
2361 };
2362
2363 static const SCSIReqOps scsi_disk_dma_reqops = {
2364 .size = sizeof(SCSIDiskReq),
2365 .free_req = scsi_free_request,
2366 .send_command = scsi_disk_dma_command,
2367 .read_data = scsi_read_data,
2368 .write_data = scsi_write_data,
2369 .get_buf = scsi_get_buf,
2370 .load_request = scsi_disk_load_request,
2371 .save_request = scsi_disk_save_request,
2372 };
2373
2374 static const SCSIReqOps *const scsi_disk_reqops_dispatch[256] = {
2375 [TEST_UNIT_READY] = &scsi_disk_emulate_reqops,
2376 [INQUIRY] = &scsi_disk_emulate_reqops,
2377 [MODE_SENSE] = &scsi_disk_emulate_reqops,
2378 [MODE_SENSE_10] = &scsi_disk_emulate_reqops,
2379 [START_STOP] = &scsi_disk_emulate_reqops,
2380 [ALLOW_MEDIUM_REMOVAL] = &scsi_disk_emulate_reqops,
2381 [READ_CAPACITY_10] = &scsi_disk_emulate_reqops,
2382 [READ_TOC] = &scsi_disk_emulate_reqops,
2383 [READ_DVD_STRUCTURE] = &scsi_disk_emulate_reqops,
2384 [READ_DISC_INFORMATION] = &scsi_disk_emulate_reqops,
2385 [GET_CONFIGURATION] = &scsi_disk_emulate_reqops,
2386 [GET_EVENT_STATUS_NOTIFICATION] = &scsi_disk_emulate_reqops,
2387 [MECHANISM_STATUS] = &scsi_disk_emulate_reqops,
2388 [SERVICE_ACTION_IN_16] = &scsi_disk_emulate_reqops,
2389 [REQUEST_SENSE] = &scsi_disk_emulate_reqops,
2390 [SYNCHRONIZE_CACHE] = &scsi_disk_emulate_reqops,
2391 [SEEK_10] = &scsi_disk_emulate_reqops,
2392 [MODE_SELECT] = &scsi_disk_emulate_reqops,
2393 [MODE_SELECT_10] = &scsi_disk_emulate_reqops,
2394 [UNMAP] = &scsi_disk_emulate_reqops,
2395 [WRITE_SAME_10] = &scsi_disk_emulate_reqops,
2396 [WRITE_SAME_16] = &scsi_disk_emulate_reqops,
2397 [VERIFY_10] = &scsi_disk_emulate_reqops,
2398 [VERIFY_12] = &scsi_disk_emulate_reqops,
2399 [VERIFY_16] = &scsi_disk_emulate_reqops,
2400
2401 [READ_6] = &scsi_disk_dma_reqops,
2402 [READ_10] = &scsi_disk_dma_reqops,
2403 [READ_12] = &scsi_disk_dma_reqops,
2404 [READ_16] = &scsi_disk_dma_reqops,
2405 [WRITE_6] = &scsi_disk_dma_reqops,
2406 [WRITE_10] = &scsi_disk_dma_reqops,
2407 [WRITE_12] = &scsi_disk_dma_reqops,
2408 [WRITE_16] = &scsi_disk_dma_reqops,
2409 [WRITE_VERIFY_10] = &scsi_disk_dma_reqops,
2410 [WRITE_VERIFY_12] = &scsi_disk_dma_reqops,
2411 [WRITE_VERIFY_16] = &scsi_disk_dma_reqops,
2412 };
2413
2414 static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun,
2415 uint8_t *buf, void *hba_private)
2416 {
2417 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2418 SCSIRequest *req;
2419 const SCSIReqOps *ops;
2420 uint8_t command;
2421
2422 command = buf[0];
2423 ops = scsi_disk_reqops_dispatch[command];
2424 if (!ops) {
2425 ops = &scsi_disk_emulate_reqops;
2426 }
2427 req = scsi_req_alloc(ops, &s->qdev, tag, lun, hba_private);
2428
2429 #ifdef DEBUG_SCSI
2430 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
2431 {
2432 int i;
2433 for (i = 1; i < scsi_cdb_length(buf); i++) {
2434 printf(" 0x%02x", buf[i]);
2435 }
2436 printf("\n");
2437 }
2438 #endif
2439
2440 return req;
2441 }
2442
2443 #ifdef __linux__
2444 static int get_device_type(SCSIDiskState *s)
2445 {
2446 uint8_t cmd[16];
2447 uint8_t buf[36];
2448 uint8_t sensebuf[8];
2449 sg_io_hdr_t io_header;
2450 int ret;
2451
2452 memset(cmd, 0, sizeof(cmd));
2453 memset(buf, 0, sizeof(buf));
2454 cmd[0] = INQUIRY;
2455 cmd[4] = sizeof(buf);
2456
2457 memset(&io_header, 0, sizeof(io_header));
2458 io_header.interface_id = 'S';
2459 io_header.dxfer_direction = SG_DXFER_FROM_DEV;
2460 io_header.dxfer_len = sizeof(buf);
2461 io_header.dxferp = buf;
2462 io_header.cmdp = cmd;
2463 io_header.cmd_len = sizeof(cmd);
2464 io_header.mx_sb_len = sizeof(sensebuf);
2465 io_header.sbp = sensebuf;
2466 io_header.timeout = 6000; /* XXX */
2467
2468 ret = blk_ioctl(s->qdev.conf.blk, SG_IO, &io_header);
2469 if (ret < 0 || io_header.driver_status || io_header.host_status) {
2470 return -1;
2471 }
2472 s->qdev.type = buf[0];
2473 if (buf[1] & 0x80) {
2474 s->features |= 1 << SCSI_DISK_F_REMOVABLE;
2475 }
2476 return 0;
2477 }
2478
2479 static void scsi_block_realize(SCSIDevice *dev, Error **errp)
2480 {
2481 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2482 int sg_version;
2483 int rc;
2484
2485 if (!s->qdev.conf.blk) {
2486 error_setg(errp, "drive property not set");
2487 return;
2488 }
2489
2490 /* check we are using a driver managing SG_IO (version 3 and after) */
2491 rc = blk_ioctl(s->qdev.conf.blk, SG_GET_VERSION_NUM, &sg_version);
2492 if (rc < 0) {
2493 error_setg(errp, "cannot get SG_IO version number: %s. "
2494 "Is this a SCSI device?",
2495 strerror(-rc));
2496 return;
2497 }
2498 if (sg_version < 30000) {
2499 error_setg(errp, "scsi generic interface too old");
2500 return;
2501 }
2502
2503 /* get device type from INQUIRY data */
2504 rc = get_device_type(s);
2505 if (rc < 0) {
2506 error_setg(errp, "INQUIRY failed");
2507 return;
2508 }
2509
2510 /* Make a guess for the block size, we'll fix it when the guest sends.
2511 * READ CAPACITY. If they don't, they likely would assume these sizes
2512 * anyway. (TODO: check in /sys).
2513 */
2514 if (s->qdev.type == TYPE_ROM || s->qdev.type == TYPE_WORM) {
2515 s->qdev.blocksize = 2048;
2516 } else {
2517 s->qdev.blocksize = 512;
2518 }
2519
2520 /* Makes the scsi-block device not removable by using HMP and QMP eject
2521 * command.
2522 */
2523 s->features |= (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS);
2524
2525 scsi_realize(&s->qdev, errp);
2526 }
2527
2528 static bool scsi_block_is_passthrough(SCSIDiskState *s, uint8_t *buf)
2529 {
2530 switch (buf[0]) {
2531 case READ_6:
2532 case READ_10:
2533 case READ_12:
2534 case READ_16:
2535 case VERIFY_10:
2536 case VERIFY_12:
2537 case VERIFY_16:
2538 case WRITE_6:
2539 case WRITE_10:
2540 case WRITE_12:
2541 case WRITE_16:
2542 case WRITE_VERIFY_10:
2543 case WRITE_VERIFY_12:
2544 case WRITE_VERIFY_16:
2545 /* If we are not using O_DIRECT, we might read stale data from the
2546 * host cache if writes were made using other commands than these
2547 * ones (such as WRITE SAME or EXTENDED COPY, etc.). So, without
2548 * O_DIRECT everything must go through SG_IO.
2549 */
2550 if (!(blk_get_flags(s->qdev.conf.blk) & BDRV_O_NOCACHE)) {
2551 break;
2552 }
2553
2554 /* MMC writing cannot be done via pread/pwrite, because it sometimes
2555 * involves writing beyond the maximum LBA or to negative LBA (lead-in).
2556 * And once you do these writes, reading from the block device is
2557 * unreliable, too. It is even possible that reads deliver random data
2558 * from the host page cache (this is probably a Linux bug).
2559 *
2560 * We might use scsi_disk_dma_reqops as long as no writing commands are
2561 * seen, but performance usually isn't paramount on optical media. So,
2562 * just make scsi-block operate the same as scsi-generic for them.
2563 */
2564 if (s->qdev.type != TYPE_ROM) {
2565 return false;
2566 }
2567 break;
2568
2569 default:
2570 break;
2571 }
2572
2573 return true;
2574 }
2575
2576
2577 static SCSIRequest *scsi_block_new_request(SCSIDevice *d, uint32_t tag,
2578 uint32_t lun, uint8_t *buf,
2579 void *hba_private)
2580 {
2581 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2582
2583 if (scsi_block_is_passthrough(s, buf)) {
2584 return scsi_req_alloc(&scsi_generic_req_ops, &s->qdev, tag, lun,
2585 hba_private);
2586 } else {
2587 return scsi_req_alloc(&scsi_disk_dma_reqops, &s->qdev, tag, lun,
2588 hba_private);
2589 }
2590 }
2591
2592 static int scsi_block_parse_cdb(SCSIDevice *d, SCSICommand *cmd,
2593 uint8_t *buf, void *hba_private)
2594 {
2595 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2596
2597 if (scsi_block_is_passthrough(s, buf)) {
2598 return scsi_bus_parse_cdb(&s->qdev, cmd, buf, hba_private);
2599 } else {
2600 return scsi_req_parse_cdb(&s->qdev, cmd, buf);
2601 }
2602 }
2603
2604 #endif
2605
2606 #define DEFINE_SCSI_DISK_PROPERTIES() \
2607 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
2608 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
2609 DEFINE_PROP_STRING("serial", SCSIDiskState, serial), \
2610 DEFINE_PROP_STRING("vendor", SCSIDiskState, vendor), \
2611 DEFINE_PROP_STRING("product", SCSIDiskState, product)
2612
2613 static Property scsi_hd_properties[] = {
2614 DEFINE_SCSI_DISK_PROPERTIES(),
2615 DEFINE_PROP_BIT("removable", SCSIDiskState, features,
2616 SCSI_DISK_F_REMOVABLE, false),
2617 DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
2618 SCSI_DISK_F_DPOFUA, false),
2619 DEFINE_PROP_UINT64("wwn", SCSIDiskState, wwn, 0),
2620 DEFINE_PROP_UINT64("port_wwn", SCSIDiskState, port_wwn, 0),
2621 DEFINE_PROP_UINT16("port_index", SCSIDiskState, port_index, 0),
2622 DEFINE_PROP_UINT64("max_unmap_size", SCSIDiskState, max_unmap_size,
2623 DEFAULT_MAX_UNMAP_SIZE),
2624 DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
2625 DEFAULT_MAX_IO_SIZE),
2626 DEFINE_BLOCK_CHS_PROPERTIES(SCSIDiskState, qdev.conf),
2627 DEFINE_PROP_END_OF_LIST(),
2628 };
2629
2630 static const VMStateDescription vmstate_scsi_disk_state = {
2631 .name = "scsi-disk",
2632 .version_id = 1,
2633 .minimum_version_id = 1,
2634 .fields = (VMStateField[]) {
2635 VMSTATE_SCSI_DEVICE(qdev, SCSIDiskState),
2636 VMSTATE_BOOL(media_changed, SCSIDiskState),
2637 VMSTATE_BOOL(media_event, SCSIDiskState),
2638 VMSTATE_BOOL(eject_request, SCSIDiskState),
2639 VMSTATE_BOOL(tray_open, SCSIDiskState),
2640 VMSTATE_BOOL(tray_locked, SCSIDiskState),
2641 VMSTATE_END_OF_LIST()
2642 }
2643 };
2644
2645 static void scsi_hd_class_initfn(ObjectClass *klass, void *data)
2646 {
2647 DeviceClass *dc = DEVICE_CLASS(klass);
2648 SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2649
2650 sc->realize = scsi_hd_realize;
2651 sc->alloc_req = scsi_new_request;
2652 sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2653 dc->fw_name = "disk";
2654 dc->desc = "virtual SCSI disk";
2655 dc->reset = scsi_disk_reset;
2656 dc->props = scsi_hd_properties;
2657 dc->vmsd = &vmstate_scsi_disk_state;
2658 }
2659
2660 static const TypeInfo scsi_hd_info = {
2661 .name = "scsi-hd",
2662 .parent = TYPE_SCSI_DEVICE,
2663 .instance_size = sizeof(SCSIDiskState),
2664 .class_init = scsi_hd_class_initfn,
2665 };
2666
2667 static Property scsi_cd_properties[] = {
2668 DEFINE_SCSI_DISK_PROPERTIES(),
2669 DEFINE_PROP_UINT64("wwn", SCSIDiskState, wwn, 0),
2670 DEFINE_PROP_UINT64("port_wwn", SCSIDiskState, port_wwn, 0),
2671 DEFINE_PROP_UINT16("port_index", SCSIDiskState, port_index, 0),
2672 DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
2673 DEFAULT_MAX_IO_SIZE),
2674 DEFINE_PROP_END_OF_LIST(),
2675 };
2676
2677 static void scsi_cd_class_initfn(ObjectClass *klass, void *data)
2678 {
2679 DeviceClass *dc = DEVICE_CLASS(klass);
2680 SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2681
2682 sc->realize = scsi_cd_realize;
2683 sc->alloc_req = scsi_new_request;
2684 sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2685 dc->fw_name = "disk";
2686 dc->desc = "virtual SCSI CD-ROM";
2687 dc->reset = scsi_disk_reset;
2688 dc->props = scsi_cd_properties;
2689 dc->vmsd = &vmstate_scsi_disk_state;
2690 }
2691
2692 static const TypeInfo scsi_cd_info = {
2693 .name = "scsi-cd",
2694 .parent = TYPE_SCSI_DEVICE,
2695 .instance_size = sizeof(SCSIDiskState),
2696 .class_init = scsi_cd_class_initfn,
2697 };
2698
2699 #ifdef __linux__
2700 static Property scsi_block_properties[] = {
2701 DEFINE_PROP_DRIVE("drive", SCSIDiskState, qdev.conf.blk),
2702 DEFINE_PROP_END_OF_LIST(),
2703 };
2704
2705 static void scsi_block_class_initfn(ObjectClass *klass, void *data)
2706 {
2707 DeviceClass *dc = DEVICE_CLASS(klass);
2708 SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2709
2710 sc->realize = scsi_block_realize;
2711 sc->alloc_req = scsi_block_new_request;
2712 sc->parse_cdb = scsi_block_parse_cdb;
2713 dc->fw_name = "disk";
2714 dc->desc = "SCSI block device passthrough";
2715 dc->reset = scsi_disk_reset;
2716 dc->props = scsi_block_properties;
2717 dc->vmsd = &vmstate_scsi_disk_state;
2718 }
2719
2720 static const TypeInfo scsi_block_info = {
2721 .name = "scsi-block",
2722 .parent = TYPE_SCSI_DEVICE,
2723 .instance_size = sizeof(SCSIDiskState),
2724 .class_init = scsi_block_class_initfn,
2725 };
2726 #endif
2727
2728 static Property scsi_disk_properties[] = {
2729 DEFINE_SCSI_DISK_PROPERTIES(),
2730 DEFINE_PROP_BIT("removable", SCSIDiskState, features,
2731 SCSI_DISK_F_REMOVABLE, false),
2732 DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
2733 SCSI_DISK_F_DPOFUA, false),
2734 DEFINE_PROP_UINT64("wwn", SCSIDiskState, wwn, 0),
2735 DEFINE_PROP_UINT64("port_wwn", SCSIDiskState, port_wwn, 0),
2736 DEFINE_PROP_UINT16("port_index", SCSIDiskState, port_index, 0),
2737 DEFINE_PROP_UINT64("max_unmap_size", SCSIDiskState, max_unmap_size,
2738 DEFAULT_MAX_UNMAP_SIZE),
2739 DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
2740 DEFAULT_MAX_IO_SIZE),
2741 DEFINE_PROP_END_OF_LIST(),
2742 };
2743
2744 static void scsi_disk_class_initfn(ObjectClass *klass, void *data)
2745 {
2746 DeviceClass *dc = DEVICE_CLASS(klass);
2747 SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2748
2749 sc->realize = scsi_disk_realize;
2750 sc->alloc_req = scsi_new_request;
2751 sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2752 dc->fw_name = "disk";
2753 dc->desc = "virtual SCSI disk or CD-ROM (legacy)";
2754 dc->reset = scsi_disk_reset;
2755 dc->props = scsi_disk_properties;
2756 dc->vmsd = &vmstate_scsi_disk_state;
2757 }
2758
2759 static const TypeInfo scsi_disk_info = {
2760 .name = "scsi-disk",
2761 .parent = TYPE_SCSI_DEVICE,
2762 .instance_size = sizeof(SCSIDiskState),
2763 .class_init = scsi_disk_class_initfn,
2764 };
2765
2766 static void scsi_disk_register_types(void)
2767 {
2768 type_register_static(&scsi_hd_info);
2769 type_register_static(&scsi_cd_info);
2770 #ifdef __linux__
2771 type_register_static(&scsi_block_info);
2772 #endif
2773 type_register_static(&scsi_disk_info);
2774 }
2775
2776 type_init(scsi_disk_register_types)
AR7 emulation for QEMU