2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
40 #include "block_int.h"
42 #define SCSI_DMA_BUF_SIZE 131072
43 #define SCSI_MAX_INQUIRY_LEN 256
45 #define SCSI_REQ_STATUS_RETRY 0x01
46 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
47 #define SCSI_REQ_STATUS_RETRY_READ 0x00
48 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
49 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
51 typedef struct SCSIDiskState SCSIDiskState
;
53 typedef struct SCSIDiskReq
{
55 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
57 uint32_t sector_count
;
69 /* The qemu block layer uses a fixed 512 byte sector size.
70 This is the number of 512 byte blocks in a single scsi sector. */
82 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
83 static int scsi_disk_emulate_command(SCSIDiskReq
*r
);
85 static void scsi_free_request(SCSIRequest
*req
)
87 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
89 if (r
->iov
.iov_base
) {
90 qemu_vfree(r
->iov
.iov_base
);
94 /* Helper function for command completion with sense. */
95 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
97 DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
98 r
->req
.tag
, sense
.key
, sense
.asc
, sense
.ascq
);
99 scsi_req_build_sense(&r
->req
, sense
);
100 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
103 /* Cancel a pending data transfer. */
104 static void scsi_cancel_io(SCSIRequest
*req
)
106 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
108 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
110 bdrv_aio_cancel(r
->req
.aiocb
);
115 static uint32_t scsi_init_iovec(SCSIDiskReq
*r
)
117 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
119 if (!r
->iov
.iov_base
) {
120 r
->buflen
= SCSI_DMA_BUF_SIZE
;
121 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, r
->buflen
);
123 r
->iov
.iov_len
= MIN(r
->sector_count
* 512, r
->buflen
);
124 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
125 return r
->qiov
.size
/ 512;
128 static void scsi_read_complete(void * opaque
, int ret
)
130 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
131 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
134 if (r
->req
.aiocb
!= NULL
) {
136 bdrv_acct_done(s
->bs
, &r
->acct
);
140 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
145 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->qiov
.size
);
147 n
= r
->qiov
.size
/ 512;
149 r
->sector_count
-= n
;
150 scsi_req_data(&r
->req
, r
->qiov
.size
);
153 static void scsi_flush_complete(void * opaque
, int ret
)
155 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
156 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
158 if (r
->req
.aiocb
!= NULL
) {
160 bdrv_acct_done(s
->bs
, &r
->acct
);
164 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
169 scsi_req_complete(&r
->req
, GOOD
);
172 /* Read more data from scsi device into buffer. */
173 static void scsi_read_data(SCSIRequest
*req
)
175 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
176 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
179 if (r
->sector_count
== (uint32_t)-1) {
180 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
182 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
185 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
186 if (r
->sector_count
== 0) {
187 /* This also clears the sense buffer for REQUEST SENSE. */
188 scsi_req_complete(&r
->req
, GOOD
);
192 /* No data transfer may already be in progress */
193 assert(r
->req
.aiocb
== NULL
);
195 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
196 DPRINTF("Data transfer direction invalid\n");
197 scsi_read_complete(r
, -EINVAL
);
202 scsi_read_complete(r
, -ENOMEDIUM
);
204 n
= scsi_init_iovec(r
);
205 bdrv_acct_start(s
->bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_READ
);
206 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
207 scsi_read_complete
, r
);
208 if (r
->req
.aiocb
== NULL
) {
209 scsi_read_complete(r
, -EIO
);
213 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
215 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
216 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
217 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
219 if (action
== BLOCK_ERR_IGNORE
) {
220 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
224 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
225 || action
== BLOCK_ERR_STOP_ANY
) {
227 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
228 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
230 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
231 vm_stop(RUN_STATE_IO_ERROR
);
232 bdrv_iostatus_set_err(s
->bs
, error
);
236 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
239 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
242 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
245 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
248 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
253 static void scsi_write_complete(void * opaque
, int ret
)
255 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
256 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
259 if (r
->req
.aiocb
!= NULL
) {
261 bdrv_acct_done(s
->bs
, &r
->acct
);
265 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
270 n
= r
->qiov
.size
/ 512;
272 r
->sector_count
-= n
;
273 if (r
->sector_count
== 0) {
274 scsi_req_complete(&r
->req
, GOOD
);
277 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, r
->qiov
.size
);
278 scsi_req_data(&r
->req
, r
->qiov
.size
);
282 static void scsi_write_data(SCSIRequest
*req
)
284 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
285 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
288 /* No data transfer may already be in progress */
289 assert(r
->req
.aiocb
== NULL
);
291 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
292 DPRINTF("Data transfer direction invalid\n");
293 scsi_write_complete(r
, -EINVAL
);
297 n
= r
->qiov
.size
/ 512;
300 scsi_write_complete(r
, -ENOMEDIUM
);
302 bdrv_acct_start(s
->bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_WRITE
);
303 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
304 scsi_write_complete
, r
);
305 if (r
->req
.aiocb
== NULL
) {
306 scsi_write_complete(r
, -ENOMEM
);
309 /* Called for the first time. Ask the driver to send us more data. */
310 scsi_write_complete(r
, 0);
314 static void scsi_dma_restart_bh(void *opaque
)
316 SCSIDiskState
*s
= opaque
;
320 qemu_bh_delete(s
->bh
);
323 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
324 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
325 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
326 int status
= r
->status
;
330 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
332 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
333 case SCSI_REQ_STATUS_RETRY_READ
:
334 scsi_read_data(&r
->req
);
336 case SCSI_REQ_STATUS_RETRY_WRITE
:
337 scsi_write_data(&r
->req
);
339 case SCSI_REQ_STATUS_RETRY_FLUSH
:
340 ret
= scsi_disk_emulate_command(r
);
342 scsi_req_complete(&r
->req
, GOOD
);
349 static void scsi_dma_restart_cb(void *opaque
, int running
, RunState state
)
351 SCSIDiskState
*s
= opaque
;
357 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
358 qemu_bh_schedule(s
->bh
);
362 /* Return a pointer to the data buffer. */
363 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
365 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
367 return (uint8_t *)r
->iov
.iov_base
;
370 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
372 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
375 if (req
->cmd
.buf
[1] & 0x2) {
376 /* Command support data - optional, not implemented */
377 BADF("optional INQUIRY command support request not implemented\n");
381 if (req
->cmd
.buf
[1] & 0x1) {
382 /* Vital product data */
383 uint8_t page_code
= req
->cmd
.buf
[2];
384 if (req
->cmd
.xfer
< 4) {
385 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
386 "less than 4\n", page_code
, req
->cmd
.xfer
);
390 if (s
->qdev
.type
== TYPE_ROM
) {
391 outbuf
[buflen
++] = 5;
393 outbuf
[buflen
++] = 0;
395 outbuf
[buflen
++] = page_code
; // this page
396 outbuf
[buflen
++] = 0x00;
399 case 0x00: /* Supported page codes, mandatory */
402 DPRINTF("Inquiry EVPD[Supported pages] "
403 "buffer size %zd\n", req
->cmd
.xfer
);
405 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
407 outbuf
[buflen
++] = 0x80; // unit serial number
409 outbuf
[buflen
++] = 0x83; // device identification
410 if (s
->qdev
.type
== TYPE_DISK
) {
411 outbuf
[buflen
++] = 0xb0; // block limits
412 outbuf
[buflen
++] = 0xb2; // thin provisioning
414 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
417 case 0x80: /* Device serial number, optional */
422 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
426 l
= strlen(s
->serial
);
427 if (l
> req
->cmd
.xfer
) {
434 DPRINTF("Inquiry EVPD[Serial number] "
435 "buffer size %zd\n", req
->cmd
.xfer
);
436 outbuf
[buflen
++] = l
;
437 memcpy(outbuf
+buflen
, s
->serial
, l
);
442 case 0x83: /* Device identification page, mandatory */
444 int max_len
= 255 - 8;
445 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
447 if (id_len
> max_len
) {
450 DPRINTF("Inquiry EVPD[Device identification] "
451 "buffer size %zd\n", req
->cmd
.xfer
);
453 outbuf
[buflen
++] = 4 + id_len
;
454 outbuf
[buflen
++] = 0x2; // ASCII
455 outbuf
[buflen
++] = 0; // not officially assigned
456 outbuf
[buflen
++] = 0; // reserved
457 outbuf
[buflen
++] = id_len
; // length of data following
459 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
463 case 0xb0: /* block limits */
465 unsigned int unmap_sectors
=
466 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
467 unsigned int min_io_size
=
468 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
469 unsigned int opt_io_size
=
470 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
472 if (s
->qdev
.type
== TYPE_ROM
) {
473 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
477 /* required VPD size with unmap support */
478 outbuf
[3] = buflen
= 0x3c;
480 memset(outbuf
+ 4, 0, buflen
- 4);
482 /* optimal transfer length granularity */
483 outbuf
[6] = (min_io_size
>> 8) & 0xff;
484 outbuf
[7] = min_io_size
& 0xff;
486 /* optimal transfer length */
487 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
488 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
489 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
490 outbuf
[15] = opt_io_size
& 0xff;
492 /* optimal unmap granularity */
493 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
494 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
495 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
496 outbuf
[31] = unmap_sectors
& 0xff;
499 case 0xb2: /* thin provisioning */
501 outbuf
[3] = buflen
= 8;
503 outbuf
[5] = 0x40; /* write same with unmap supported */
509 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
510 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
517 /* Standard INQUIRY data */
518 if (req
->cmd
.buf
[2] != 0) {
519 BADF("Error: Inquiry (STANDARD) page or code "
520 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
525 if (req
->cmd
.xfer
< 5) {
526 BADF("Error: Inquiry (STANDARD) buffer size %zd "
527 "is less than 5\n", req
->cmd
.xfer
);
531 buflen
= req
->cmd
.xfer
;
532 if (buflen
> SCSI_MAX_INQUIRY_LEN
) {
533 buflen
= SCSI_MAX_INQUIRY_LEN
;
535 memset(outbuf
, 0, buflen
);
537 outbuf
[0] = s
->qdev
.type
& 0x1f;
538 if (s
->qdev
.type
== TYPE_ROM
) {
540 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
542 outbuf
[1] = s
->removable
? 0x80 : 0;
543 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
545 memcpy(&outbuf
[8], "QEMU ", 8);
546 memset(&outbuf
[32], 0, 4);
547 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
549 * We claim conformance to SPC-3, which is required for guests
550 * to ask for modern features like READ CAPACITY(16) or the
551 * block characteristics VPD page by default. Not all of SPC-3
552 * is actually implemented, but we're good enough.
555 outbuf
[3] = 2; /* Format 2 */
558 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
560 /* If the allocation length of CDB is too small,
561 the additional length is not adjusted */
565 /* Sync data transfer and TCQ. */
566 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
570 static int mode_sense_page(SCSIDiskState
*s
, int page
, uint8_t **p_outbuf
,
573 BlockDriverState
*bdrv
= s
->bs
;
574 int cylinders
, heads
, secs
;
575 uint8_t *p
= *p_outbuf
;
578 * If Changeable Values are requested, a mask denoting those mode parameters
579 * that are changeable shall be returned. As we currently don't support
580 * parameter changes via MODE_SELECT all bits are returned set to zero.
581 * The buffer was already menset to zero by the caller of this function.
584 case MODE_PAGE_HD_GEOMETRY
:
585 if (s
->qdev
.type
== TYPE_ROM
) {
590 if (page_control
== 1) { /* Changeable Values */
593 /* if a geometry hint is available, use it */
594 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
595 p
[2] = (cylinders
>> 16) & 0xff;
596 p
[3] = (cylinders
>> 8) & 0xff;
597 p
[4] = cylinders
& 0xff;
599 /* Write precomp start cylinder, disabled */
600 p
[6] = (cylinders
>> 16) & 0xff;
601 p
[7] = (cylinders
>> 8) & 0xff;
602 p
[8] = cylinders
& 0xff;
603 /* Reduced current start cylinder, disabled */
604 p
[9] = (cylinders
>> 16) & 0xff;
605 p
[10] = (cylinders
>> 8) & 0xff;
606 p
[11] = cylinders
& 0xff;
607 /* Device step rate [ns], 200ns */
610 /* Landing zone cylinder */
614 /* Medium rotation rate [rpm], 5400 rpm */
615 p
[20] = (5400 >> 8) & 0xff;
619 case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY
:
620 if (s
->qdev
.type
== TYPE_ROM
) {
625 if (page_control
== 1) { /* Changeable Values */
628 /* Transfer rate [kbit/s], 5Mbit/s */
631 /* if a geometry hint is available, use it */
632 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
635 p
[6] = s
->cluster_size
* 2;
636 p
[8] = (cylinders
>> 8) & 0xff;
637 p
[9] = cylinders
& 0xff;
638 /* Write precomp start cylinder, disabled */
639 p
[10] = (cylinders
>> 8) & 0xff;
640 p
[11] = cylinders
& 0xff;
641 /* Reduced current start cylinder, disabled */
642 p
[12] = (cylinders
>> 8) & 0xff;
643 p
[13] = cylinders
& 0xff;
644 /* Device step rate [100us], 100us */
647 /* Device step pulse width [us], 1us */
649 /* Device head settle delay [100us], 100us */
652 /* Motor on delay [0.1s], 0.1s */
654 /* Motor off delay [0.1s], 0.1s */
656 /* Medium rotation rate [rpm], 5400 rpm */
657 p
[28] = (5400 >> 8) & 0xff;
661 case MODE_PAGE_CACHING
:
664 if (page_control
== 1) { /* Changeable Values */
667 if (bdrv_enable_write_cache(s
->bs
)) {
672 case MODE_PAGE_CAPABILITIES
:
673 if (s
->qdev
.type
!= TYPE_ROM
) {
678 if (page_control
== 1) { /* Changeable Values */
681 p
[2] = 3; // CD-R & CD-RW read
682 p
[3] = 0; // Writing not supported
683 p
[4] = 0x7f; /* Audio, composite, digital out,
684 mode 2 form 1&2, multi session */
685 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
686 RW corrected, C2 errors, ISRC,
688 p
[6] = 0x2d | (s
->tray_locked
? 2 : 0);
689 /* Locking supported, jumper present, eject, tray */
690 p
[7] = 0; /* no volume & mute control, no
692 p
[8] = (50 * 176) >> 8; // 50x read speed
693 p
[9] = (50 * 176) & 0xff;
694 p
[10] = 0 >> 8; // No volume
696 p
[12] = 2048 >> 8; // 2M buffer
698 p
[14] = (16 * 176) >> 8; // 16x read speed current
699 p
[15] = (16 * 176) & 0xff;
700 p
[18] = (16 * 176) >> 8; // 16x write speed
701 p
[19] = (16 * 176) & 0xff;
702 p
[20] = (16 * 176) >> 8; // 16x write speed current
703 p
[21] = (16 * 176) & 0xff;
710 *p_outbuf
+= p
[1] + 2;
714 static int scsi_disk_emulate_mode_sense(SCSIDiskReq
*r
, uint8_t *outbuf
)
716 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
718 int page
, dbd
, buflen
, ret
, page_control
;
720 uint8_t dev_specific_param
;
722 dbd
= r
->req
.cmd
.buf
[1] & 0x8;
723 page
= r
->req
.cmd
.buf
[2] & 0x3f;
724 page_control
= (r
->req
.cmd
.buf
[2] & 0xc0) >> 6;
725 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
726 (r
->req
.cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, r
->req
.cmd
.xfer
, page_control
);
727 memset(outbuf
, 0, r
->req
.cmd
.xfer
);
730 if (bdrv_is_read_only(s
->bs
)) {
731 dev_specific_param
= 0x80; /* Readonly. */
733 dev_specific_param
= 0x00;
736 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
737 p
[1] = 0; /* Default media type. */
738 p
[2] = dev_specific_param
;
739 p
[3] = 0; /* Block descriptor length. */
741 } else { /* MODE_SENSE_10 */
742 p
[2] = 0; /* Default media type. */
743 p
[3] = dev_specific_param
;
744 p
[6] = p
[7] = 0; /* Block descriptor length. */
748 bdrv_get_geometry(s
->bs
, &nb_sectors
);
749 if (!dbd
&& nb_sectors
) {
750 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
751 outbuf
[3] = 8; /* Block descriptor length */
752 } else { /* MODE_SENSE_10 */
753 outbuf
[7] = 8; /* Block descriptor length */
755 nb_sectors
/= s
->cluster_size
;
756 if (nb_sectors
> 0xffffff) {
759 p
[0] = 0; /* media density code */
760 p
[1] = (nb_sectors
>> 16) & 0xff;
761 p
[2] = (nb_sectors
>> 8) & 0xff;
762 p
[3] = nb_sectors
& 0xff;
763 p
[4] = 0; /* reserved */
764 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
765 p
[6] = s
->cluster_size
* 2;
770 if (page_control
== 3) {
772 scsi_check_condition(r
, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED
));
777 for (page
= 0; page
<= 0x3e; page
++) {
778 mode_sense_page(s
, page
, &p
, page_control
);
781 ret
= mode_sense_page(s
, page
, &p
, page_control
);
789 * The mode data length field specifies the length in bytes of the
790 * following data that is available to be transferred. The mode data
791 * length does not include itself.
793 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
794 outbuf
[0] = buflen
- 1;
795 } else { /* MODE_SENSE_10 */
796 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
797 outbuf
[1] = (buflen
- 2) & 0xff;
799 if (buflen
> r
->req
.cmd
.xfer
) {
800 buflen
= r
->req
.cmd
.xfer
;
805 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
807 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
808 int start_track
, format
, msf
, toclen
;
811 msf
= req
->cmd
.buf
[1] & 2;
812 format
= req
->cmd
.buf
[2] & 0xf;
813 start_track
= req
->cmd
.buf
[6];
814 bdrv_get_geometry(s
->bs
, &nb_sectors
);
815 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
816 nb_sectors
/= s
->cluster_size
;
819 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
822 /* multi session : only a single session defined */
824 memset(outbuf
, 0, 12);
830 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
835 if (toclen
> req
->cmd
.xfer
) {
836 toclen
= req
->cmd
.xfer
;
841 static int scsi_disk_emulate_start_stop(SCSIDiskReq
*r
)
843 SCSIRequest
*req
= &r
->req
;
844 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
845 bool start
= req
->cmd
.buf
[4] & 1;
846 bool loej
= req
->cmd
.buf
[4] & 2; /* load on start, eject on !start */
848 if (s
->qdev
.type
== TYPE_ROM
&& loej
) {
849 if (!start
&& !s
->tray_open
&& s
->tray_locked
) {
850 scsi_check_condition(r
,
851 bdrv_is_inserted(s
->bs
)
852 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED
)
853 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED
));
856 bdrv_eject(s
->bs
, !start
);
857 s
->tray_open
= !start
;
862 static int scsi_disk_emulate_command(SCSIDiskReq
*r
)
864 SCSIRequest
*req
= &r
->req
;
865 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
870 if (!r
->iov
.iov_base
) {
872 * FIXME: we shouldn't return anything bigger than 4k, but the code
873 * requires the buffer to be as big as req->cmd.xfer in several
874 * places. So, do not allow CDBs with a very large ALLOCATION
875 * LENGTH. The real fix would be to modify scsi_read_data and
876 * dma_buf_read, so that they return data beyond the buflen
879 if (req
->cmd
.xfer
> 65536) {
880 goto illegal_request
;
882 r
->buflen
= MAX(4096, req
->cmd
.xfer
);
883 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, r
->buflen
);
886 outbuf
= r
->iov
.iov_base
;
887 switch (req
->cmd
.buf
[0]) {
888 case TEST_UNIT_READY
:
889 if (s
->tray_open
|| !bdrv_is_inserted(s
->bs
)) {
894 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
896 goto illegal_request
;
901 buflen
= scsi_disk_emulate_mode_sense(r
, outbuf
);
903 goto illegal_request
;
907 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
909 goto illegal_request
;
913 if (req
->cmd
.buf
[1] & 1) {
914 goto illegal_request
;
918 if (req
->cmd
.buf
[1] & 3) {
919 goto illegal_request
;
923 if (req
->cmd
.buf
[1] & 1) {
924 goto illegal_request
;
928 if (req
->cmd
.buf
[1] & 3) {
929 goto illegal_request
;
933 if (scsi_disk_emulate_start_stop(r
) < 0) {
937 case ALLOW_MEDIUM_REMOVAL
:
938 s
->tray_locked
= req
->cmd
.buf
[4] & 1;
939 bdrv_lock_medium(s
->bs
, req
->cmd
.buf
[4] & 1);
941 case READ_CAPACITY_10
:
942 /* The normal LEN field for this command is zero. */
943 memset(outbuf
, 0, 8);
944 bdrv_get_geometry(s
->bs
, &nb_sectors
);
948 nb_sectors
/= s
->cluster_size
;
949 /* Returned value is the address of the last sector. */
951 /* Remember the new size for read/write sanity checking. */
952 s
->max_lba
= nb_sectors
;
953 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
954 if (nb_sectors
> UINT32_MAX
) {
955 nb_sectors
= UINT32_MAX
;
957 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
958 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
959 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
960 outbuf
[3] = nb_sectors
& 0xff;
963 outbuf
[6] = s
->cluster_size
* 2;
967 case GET_CONFIGURATION
:
968 memset(outbuf
, 0, 8);
969 /* ??? This should probably return much more information. For now
970 just return the basic header indicating the CD-ROM profile. */
971 outbuf
[7] = 8; // CD-ROM
974 case SERVICE_ACTION_IN_16
:
975 /* Service Action In subcommands. */
976 if ((req
->cmd
.buf
[1] & 31) == SAI_READ_CAPACITY_16
) {
977 DPRINTF("SAI READ CAPACITY(16)\n");
978 memset(outbuf
, 0, req
->cmd
.xfer
);
979 bdrv_get_geometry(s
->bs
, &nb_sectors
);
983 nb_sectors
/= s
->cluster_size
;
984 /* Returned value is the address of the last sector. */
986 /* Remember the new size for read/write sanity checking. */
987 s
->max_lba
= nb_sectors
;
988 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
989 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
990 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
991 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
992 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
993 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
994 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
995 outbuf
[7] = nb_sectors
& 0xff;
998 outbuf
[10] = s
->cluster_size
* 2;
1001 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
1003 /* set TPE bit if the format supports discard */
1004 if (s
->qdev
.conf
.discard_granularity
) {
1008 /* Protection, exponent and lowest lba field left blank. */
1009 buflen
= req
->cmd
.xfer
;
1012 DPRINTF("Unsupported Service Action In\n");
1013 goto illegal_request
;
1017 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1023 if (s
->tray_open
|| !bdrv_is_inserted(s
->bs
)) {
1024 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
1026 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
1031 if (r
->req
.status
== -1) {
1032 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1037 /* Execute a scsi command. Returns the length of the data expected by the
1038 command. This will be Positive for data transfers from the device
1039 (eg. disk reads), negative for transfers to the device (eg. disk writes),
1040 and zero if the command does not transfer any data. */
1042 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
1044 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1045 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1051 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req
->lun
, req
->tag
, buf
[0]);
1056 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
1057 printf(" 0x%02x", buf
[i
]);
1064 case TEST_UNIT_READY
:
1073 case ALLOW_MEDIUM_REMOVAL
:
1074 case READ_CAPACITY_10
:
1076 case GET_CONFIGURATION
:
1077 case SERVICE_ACTION_IN_16
:
1079 rc
= scsi_disk_emulate_command(r
);
1084 r
->iov
.iov_len
= rc
;
1086 case SYNCHRONIZE_CACHE
:
1087 bdrv_acct_start(s
->bs
, &r
->acct
, 0, BDRV_ACCT_FLUSH
);
1088 r
->req
.aiocb
= bdrv_aio_flush(s
->bs
, scsi_flush_complete
, r
);
1089 if (r
->req
.aiocb
== NULL
) {
1090 scsi_flush_complete(r
, -EIO
);
1097 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1098 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1099 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1102 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1103 r
->sector_count
= len
* s
->cluster_size
;
1109 case WRITE_VERIFY_10
:
1110 case WRITE_VERIFY_12
:
1111 case WRITE_VERIFY_16
:
1112 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1113 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1114 (command
& 0xe) == 0xe ? "And Verify " : "",
1115 r
->req
.cmd
.lba
, len
);
1116 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1119 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1120 r
->sector_count
= len
* s
->cluster_size
;
1123 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1124 /* We don't support mode parameter changes.
1125 Allow the mode parameter header + block descriptors only. */
1126 if (r
->req
.cmd
.xfer
> 12) {
1130 case MODE_SELECT_10
:
1131 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1132 /* We don't support mode parameter changes.
1133 Allow the mode parameter header + block descriptors only. */
1134 if (r
->req
.cmd
.xfer
> 16) {
1140 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1142 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1147 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1149 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1150 r
->req
.cmd
.lba
, len
);
1152 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1157 * We only support WRITE SAME with the unmap bit set for now.
1159 if (!(buf
[1] & 0x8)) {
1163 rc
= bdrv_discard(s
->bs
, r
->req
.cmd
.lba
* s
->cluster_size
,
1164 len
* s
->cluster_size
);
1166 /* XXX: better error code ?*/
1174 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1175 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1178 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1181 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1184 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1185 scsi_req_complete(&r
->req
, GOOD
);
1187 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1188 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
1191 if (!r
->sector_count
) {
1192 r
->sector_count
= -1;
1198 static void scsi_disk_reset(DeviceState
*dev
)
1200 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1201 uint64_t nb_sectors
;
1203 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(RESET
));
1205 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1206 nb_sectors
/= s
->cluster_size
;
1210 s
->max_lba
= nb_sectors
;
1213 static void scsi_destroy(SCSIDevice
*dev
)
1215 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1217 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(NO_SENSE
));
1218 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1221 static void scsi_cd_change_media_cb(void *opaque
, bool load
)
1223 SCSIDiskState
*s
= opaque
;
1226 * When a CD gets changed, we have to report an ejected state and
1227 * then a loaded state to guests so that they detect tray
1228 * open/close and media change events. Guests that do not use
1229 * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
1230 * states rely on this behavior.
1232 * media_changed governs the state machine used for unit attention
1233 * report. media_event is used by GET EVENT STATUS NOTIFICATION.
1235 s
->media_changed
= load
;
1236 s
->tray_open
= !load
;
1237 s
->qdev
.unit_attention
= SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM
);
1240 static bool scsi_cd_is_tray_open(void *opaque
)
1242 return ((SCSIDiskState
*)opaque
)->tray_open
;
1245 static bool scsi_cd_is_medium_locked(void *opaque
)
1247 return ((SCSIDiskState
*)opaque
)->tray_locked
;
1250 static const BlockDevOps scsi_cd_block_ops
= {
1251 .change_media_cb
= scsi_cd_change_media_cb
,
1252 .is_tray_open
= scsi_cd_is_tray_open
,
1253 .is_medium_locked
= scsi_cd_is_medium_locked
,
1256 static void scsi_disk_unit_attention_reported(SCSIDevice
*dev
)
1258 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1259 if (s
->media_changed
) {
1260 s
->media_changed
= false;
1261 s
->qdev
.unit_attention
= SENSE_CODE(MEDIUM_CHANGED
);
1265 static int scsi_initfn(SCSIDevice
*dev
, uint8_t scsi_type
)
1267 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1270 if (!s
->qdev
.conf
.bs
) {
1271 error_report("scsi-disk: drive property not set");
1274 s
->bs
= s
->qdev
.conf
.bs
;
1276 if (scsi_type
== TYPE_DISK
&& !bdrv_is_inserted(s
->bs
)) {
1277 error_report("Device needs media, but drive is empty");
1282 /* try to fall back to value set with legacy -drive serial=... */
1283 dinfo
= drive_get_by_blockdev(s
->bs
);
1284 if (*dinfo
->serial
) {
1285 s
->serial
= g_strdup(dinfo
->serial
);
1290 s
->version
= g_strdup(QEMU_VERSION
);
1293 if (bdrv_is_sg(s
->bs
)) {
1294 error_report("scsi-disk: unwanted /dev/sg*");
1298 if (scsi_type
== TYPE_ROM
) {
1299 bdrv_set_dev_ops(s
->bs
, &scsi_cd_block_ops
, s
);
1300 s
->qdev
.blocksize
= 2048;
1301 } else if (scsi_type
== TYPE_DISK
) {
1302 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1304 error_report("scsi-disk: Unhandled SCSI type %02x", scsi_type
);
1307 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1308 bdrv_set_buffer_alignment(s
->bs
, s
->qdev
.blocksize
);
1310 s
->qdev
.type
= scsi_type
;
1311 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1312 bdrv_iostatus_enable(s
->bs
);
1313 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1317 static int scsi_hd_initfn(SCSIDevice
*dev
)
1319 return scsi_initfn(dev
, TYPE_DISK
);
1322 static int scsi_cd_initfn(SCSIDevice
*dev
)
1324 return scsi_initfn(dev
, TYPE_ROM
);
1327 static int scsi_disk_initfn(SCSIDevice
*dev
)
1332 if (!dev
->conf
.bs
) {
1333 scsi_type
= TYPE_DISK
; /* will die in scsi_initfn() */
1335 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1336 scsi_type
= dinfo
->media_cd
? TYPE_ROM
: TYPE_DISK
;
1339 return scsi_initfn(dev
, scsi_type
);
1342 static SCSIReqOps scsi_disk_reqops
= {
1343 .size
= sizeof(SCSIDiskReq
),
1344 .free_req
= scsi_free_request
,
1345 .send_command
= scsi_send_command
,
1346 .read_data
= scsi_read_data
,
1347 .write_data
= scsi_write_data
,
1348 .cancel_io
= scsi_cancel_io
,
1349 .get_buf
= scsi_get_buf
,
1352 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
,
1353 uint32_t lun
, void *hba_private
)
1355 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1358 req
= scsi_req_alloc(&scsi_disk_reqops
, &s
->qdev
, tag
, lun
, hba_private
);
1362 #define DEFINE_SCSI_DISK_PROPERTIES() \
1363 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1364 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1365 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1367 static SCSIDeviceInfo scsi_disk_info
[] = {
1369 .qdev
.name
= "scsi-hd",
1370 .qdev
.fw_name
= "disk",
1371 .qdev
.desc
= "virtual SCSI disk",
1372 .qdev
.size
= sizeof(SCSIDiskState
),
1373 .qdev
.reset
= scsi_disk_reset
,
1374 .init
= scsi_hd_initfn
,
1375 .destroy
= scsi_destroy
,
1376 .alloc_req
= scsi_new_request
,
1377 .unit_attention_reported
= scsi_disk_unit_attention_reported
,
1378 .qdev
.props
= (Property
[]) {
1379 DEFINE_SCSI_DISK_PROPERTIES(),
1380 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1381 DEFINE_PROP_END_OF_LIST(),
1384 .qdev
.name
= "scsi-cd",
1385 .qdev
.fw_name
= "disk",
1386 .qdev
.desc
= "virtual SCSI CD-ROM",
1387 .qdev
.size
= sizeof(SCSIDiskState
),
1388 .qdev
.reset
= scsi_disk_reset
,
1389 .init
= scsi_cd_initfn
,
1390 .destroy
= scsi_destroy
,
1391 .alloc_req
= scsi_new_request
,
1392 .unit_attention_reported
= scsi_disk_unit_attention_reported
,
1393 .qdev
.props
= (Property
[]) {
1394 DEFINE_SCSI_DISK_PROPERTIES(),
1395 DEFINE_PROP_END_OF_LIST(),
1398 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1399 .qdev
.fw_name
= "disk",
1400 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1401 .qdev
.size
= sizeof(SCSIDiskState
),
1402 .qdev
.reset
= scsi_disk_reset
,
1403 .init
= scsi_disk_initfn
,
1404 .destroy
= scsi_destroy
,
1405 .alloc_req
= scsi_new_request
,
1406 .unit_attention_reported
= scsi_disk_unit_attention_reported
,
1407 .qdev
.props
= (Property
[]) {
1408 DEFINE_SCSI_DISK_PROPERTIES(),
1409 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1410 DEFINE_PROP_END_OF_LIST(),
1415 static void scsi_disk_register_devices(void)
1419 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1420 scsi_qdev_register(&scsi_disk_info
[i
]);
1423 device_init(scsi_disk_register_devices
)