2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
48 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSIDiskReq
{
54 /* ??? We should probably keep track of whether the data transfer is
55 a read or a write. Currently we rely on the host getting it right. */
56 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
58 uint32_t sector_count
;
64 typedef enum { SCSI_HD
, SCSI_CD
} SCSIDriveKind
;
70 /* The qemu block layer uses a fixed 512 byte sector size.
71 This is the number of 512 byte blocks in a single scsi sector. */
79 SCSIDriveKind drive_kind
;
82 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
83 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
);
85 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
,
88 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
92 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), &s
->qdev
, tag
, lun
);
93 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
94 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
98 static void scsi_free_request(SCSIRequest
*req
)
100 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
102 qemu_vfree(r
->iov
.iov_base
);
105 static void scsi_disk_clear_sense(SCSIDiskState
*s
)
107 memset(&s
->sense
, 0, sizeof(s
->sense
));
110 static void scsi_req_set_status(SCSIDiskReq
*r
, int status
, SCSISense sense
)
112 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
114 r
->req
.status
= status
;
118 /* Helper function for command completion. */
119 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, SCSISense sense
)
121 DPRINTF("Command complete tag=0x%x status=%d sense=%d/%d/%d\n",
122 r
->req
.tag
, status
, sense
.key
, sense
.asc
, sense
.ascq
);
123 scsi_req_set_status(r
, status
, sense
);
124 scsi_req_complete(&r
->req
);
127 /* Cancel a pending data transfer. */
128 static void scsi_cancel_io(SCSIRequest
*req
)
130 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
132 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
134 bdrv_aio_cancel(r
->req
.aiocb
);
139 static void scsi_read_complete(void * opaque
, int ret
)
141 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
147 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
152 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
154 n
= r
->iov
.iov_len
/ 512;
156 r
->sector_count
-= n
;
157 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
161 /* Read more data from scsi device into buffer. */
162 static void scsi_read_data(SCSIRequest
*req
)
164 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
165 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
168 if (r
->sector_count
== (uint32_t)-1) {
169 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
171 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
174 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
175 if (r
->sector_count
== 0) {
176 scsi_command_complete(r
, GOOD
, SENSE_CODE(NO_SENSE
));
180 /* No data transfer may already be in progress */
181 assert(r
->req
.aiocb
== NULL
);
184 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
185 n
= SCSI_DMA_BUF_SIZE
/ 512;
187 r
->iov
.iov_len
= n
* 512;
188 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
189 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
190 scsi_read_complete
, r
);
191 if (r
->req
.aiocb
== NULL
) {
192 scsi_read_complete(r
, -EIO
);
196 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
198 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
199 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
200 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
202 if (action
== BLOCK_ERR_IGNORE
) {
203 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
207 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
208 || action
== BLOCK_ERR_STOP_ANY
) {
210 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
211 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
213 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
214 vm_stop(VMSTOP_DISKFULL
);
216 if (type
== SCSI_REQ_STATUS_RETRY_READ
) {
217 scsi_req_data(&r
->req
, 0);
219 if (error
== ENOMEM
) {
220 scsi_command_complete(r
, CHECK_CONDITION
,
221 SENSE_CODE(TARGET_FAILURE
));
223 scsi_command_complete(r
, CHECK_CONDITION
,
224 SENSE_CODE(IO_ERROR
));
226 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
232 static void scsi_write_complete(void * opaque
, int ret
)
234 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
241 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
246 n
= r
->iov
.iov_len
/ 512;
248 r
->sector_count
-= n
;
249 if (r
->sector_count
== 0) {
250 scsi_command_complete(r
, GOOD
, SENSE_CODE(NO_SENSE
));
252 len
= r
->sector_count
* 512;
253 if (len
> SCSI_DMA_BUF_SIZE
) {
254 len
= SCSI_DMA_BUF_SIZE
;
256 r
->iov
.iov_len
= len
;
257 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
258 scsi_req_data(&r
->req
, len
);
262 static int scsi_write_data(SCSIRequest
*req
)
264 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
265 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
268 /* No data transfer may already be in progress */
269 assert(r
->req
.aiocb
== NULL
);
271 n
= r
->iov
.iov_len
/ 512;
273 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
274 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
275 scsi_write_complete
, r
);
276 if (r
->req
.aiocb
== NULL
) {
277 scsi_write_complete(r
, -ENOMEM
);
280 /* Invoke completion routine to fetch data from host. */
281 scsi_write_complete(r
, 0);
287 static void scsi_dma_restart_bh(void *opaque
)
289 SCSIDiskState
*s
= opaque
;
293 qemu_bh_delete(s
->bh
);
296 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
297 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
298 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
299 int status
= r
->status
;
303 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
305 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
306 case SCSI_REQ_STATUS_RETRY_READ
:
307 scsi_read_data(&r
->req
);
309 case SCSI_REQ_STATUS_RETRY_WRITE
:
310 scsi_write_data(&r
->req
);
312 case SCSI_REQ_STATUS_RETRY_FLUSH
:
313 ret
= scsi_disk_emulate_command(r
, r
->iov
.iov_base
);
315 scsi_command_complete(r
, GOOD
, SENSE_CODE(NO_SENSE
));
322 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
324 SCSIDiskState
*s
= opaque
;
330 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
331 qemu_bh_schedule(s
->bh
);
335 /* Return a pointer to the data buffer. */
336 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
338 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
340 return (uint8_t *)r
->iov
.iov_base
;
343 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
345 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
348 if (req
->cmd
.buf
[1] & 0x2) {
349 /* Command support data - optional, not implemented */
350 BADF("optional INQUIRY command support request not implemented\n");
354 if (req
->cmd
.buf
[1] & 0x1) {
355 /* Vital product data */
356 uint8_t page_code
= req
->cmd
.buf
[2];
357 if (req
->cmd
.xfer
< 4) {
358 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
359 "less than 4\n", page_code
, req
->cmd
.xfer
);
363 if (s
->drive_kind
== SCSI_CD
) {
364 outbuf
[buflen
++] = 5;
366 outbuf
[buflen
++] = 0;
368 outbuf
[buflen
++] = page_code
; // this page
369 outbuf
[buflen
++] = 0x00;
372 case 0x00: /* Supported page codes, mandatory */
375 DPRINTF("Inquiry EVPD[Supported pages] "
376 "buffer size %zd\n", req
->cmd
.xfer
);
378 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
379 outbuf
[buflen
++] = 0x80; // unit serial number
380 outbuf
[buflen
++] = 0x83; // device identification
381 if (s
->drive_kind
== SCSI_HD
) {
382 outbuf
[buflen
++] = 0xb0; // block limits
383 outbuf
[buflen
++] = 0xb2; // thin provisioning
385 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
388 case 0x80: /* Device serial number, optional */
390 int l
= strlen(s
->serial
);
392 if (l
> req
->cmd
.xfer
)
397 DPRINTF("Inquiry EVPD[Serial number] "
398 "buffer size %zd\n", req
->cmd
.xfer
);
399 outbuf
[buflen
++] = l
;
400 memcpy(outbuf
+buflen
, s
->serial
, l
);
405 case 0x83: /* Device identification page, mandatory */
407 int max_len
= 255 - 8;
408 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
410 if (id_len
> max_len
)
412 DPRINTF("Inquiry EVPD[Device identification] "
413 "buffer size %zd\n", req
->cmd
.xfer
);
415 outbuf
[buflen
++] = 4 + id_len
;
416 outbuf
[buflen
++] = 0x2; // ASCII
417 outbuf
[buflen
++] = 0; // not officially assigned
418 outbuf
[buflen
++] = 0; // reserved
419 outbuf
[buflen
++] = id_len
; // length of data following
421 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
425 case 0xb0: /* block limits */
427 unsigned int unmap_sectors
=
428 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
429 unsigned int min_io_size
=
430 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
431 unsigned int opt_io_size
=
432 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
434 if (s
->drive_kind
== SCSI_CD
) {
435 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
439 /* required VPD size with unmap support */
440 outbuf
[3] = buflen
= 0x3c;
442 memset(outbuf
+ 4, 0, buflen
- 4);
444 /* optimal transfer length granularity */
445 outbuf
[6] = (min_io_size
>> 8) & 0xff;
446 outbuf
[7] = min_io_size
& 0xff;
448 /* optimal transfer length */
449 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
450 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
451 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
452 outbuf
[15] = opt_io_size
& 0xff;
454 /* optimal unmap granularity */
455 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
456 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
457 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
458 outbuf
[31] = unmap_sectors
& 0xff;
461 case 0xb2: /* thin provisioning */
463 outbuf
[3] = buflen
= 8;
465 outbuf
[5] = 0x40; /* write same with unmap supported */
471 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
472 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
479 /* Standard INQUIRY data */
480 if (req
->cmd
.buf
[2] != 0) {
481 BADF("Error: Inquiry (STANDARD) page or code "
482 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
487 if (req
->cmd
.xfer
< 5) {
488 BADF("Error: Inquiry (STANDARD) buffer size %zd "
489 "is less than 5\n", req
->cmd
.xfer
);
493 buflen
= req
->cmd
.xfer
;
494 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
495 buflen
= SCSI_MAX_INQUIRY_LEN
;
497 memset(outbuf
, 0, buflen
);
499 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
500 outbuf
[0] = 0x7f; /* LUN not supported */
504 if (s
->drive_kind
== SCSI_CD
) {
507 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
510 outbuf
[1] = s
->removable
? 0x80 : 0;
511 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
513 memcpy(&outbuf
[8], "QEMU ", 8);
514 memset(&outbuf
[32], 0, 4);
515 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
517 * We claim conformance to SPC-3, which is required for guests
518 * to ask for modern features like READ CAPACITY(16) or the
519 * block characteristics VPD page by default. Not all of SPC-3
520 * is actually implemented, but we're good enough.
523 outbuf
[3] = 2; /* Format 2 */
526 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
528 /* If the allocation length of CDB is too small,
529 the additional length is not adjusted */
533 /* Sync data transfer and TCQ. */
534 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
538 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
,
541 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
542 BlockDriverState
*bdrv
= s
->bs
;
543 int cylinders
, heads
, secs
;
546 * If Changeable Values are requested, a mask denoting those mode parameters
547 * that are changeable shall be returned. As we currently don't support
548 * parameter changes via MODE_SELECT all bits are returned set to zero.
549 * The buffer was already menset to zero by the caller of this function.
552 case 4: /* Rigid disk device geometry page. */
555 if (page_control
== 1) { /* Changeable Values */
558 /* if a geometry hint is available, use it */
559 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
560 p
[2] = (cylinders
>> 16) & 0xff;
561 p
[3] = (cylinders
>> 8) & 0xff;
562 p
[4] = cylinders
& 0xff;
564 /* Write precomp start cylinder, disabled */
565 p
[6] = (cylinders
>> 16) & 0xff;
566 p
[7] = (cylinders
>> 8) & 0xff;
567 p
[8] = cylinders
& 0xff;
568 /* Reduced current start cylinder, disabled */
569 p
[9] = (cylinders
>> 16) & 0xff;
570 p
[10] = (cylinders
>> 8) & 0xff;
571 p
[11] = cylinders
& 0xff;
572 /* Device step rate [ns], 200ns */
575 /* Landing zone cylinder */
579 /* Medium rotation rate [rpm], 5400 rpm */
580 p
[20] = (5400 >> 8) & 0xff;
584 case 5: /* Flexible disk device geometry page. */
587 if (page_control
== 1) { /* Changeable Values */
590 /* Transfer rate [kbit/s], 5Mbit/s */
593 /* if a geometry hint is available, use it */
594 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
597 p
[6] = s
->cluster_size
* 2;
598 p
[8] = (cylinders
>> 8) & 0xff;
599 p
[9] = cylinders
& 0xff;
600 /* Write precomp start cylinder, disabled */
601 p
[10] = (cylinders
>> 8) & 0xff;
602 p
[11] = cylinders
& 0xff;
603 /* Reduced current start cylinder, disabled */
604 p
[12] = (cylinders
>> 8) & 0xff;
605 p
[13] = cylinders
& 0xff;
606 /* Device step rate [100us], 100us */
609 /* Device step pulse width [us], 1us */
611 /* Device head settle delay [100us], 100us */
614 /* Motor on delay [0.1s], 0.1s */
616 /* Motor off delay [0.1s], 0.1s */
618 /* Medium rotation rate [rpm], 5400 rpm */
619 p
[28] = (5400 >> 8) & 0xff;
623 case 8: /* Caching page. */
626 if (page_control
== 1) { /* Changeable Values */
629 if (bdrv_enable_write_cache(s
->bs
)) {
634 case 0x2a: /* CD Capabilities and Mechanical Status page. */
635 if (s
->drive_kind
!= SCSI_CD
)
639 if (page_control
== 1) { /* Changeable Values */
642 p
[2] = 3; // CD-R & CD-RW read
643 p
[3] = 0; // Writing not supported
644 p
[4] = 0x7f; /* Audio, composite, digital out,
645 mode 2 form 1&2, multi session */
646 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
647 RW corrected, C2 errors, ISRC,
649 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
650 /* Locking supported, jumper present, eject, tray */
651 p
[7] = 0; /* no volume & mute control, no
653 p
[8] = (50 * 176) >> 8; // 50x read speed
654 p
[9] = (50 * 176) & 0xff;
655 p
[10] = 0 >> 8; // No volume
657 p
[12] = 2048 >> 8; // 2M buffer
659 p
[14] = (16 * 176) >> 8; // 16x read speed current
660 p
[15] = (16 * 176) & 0xff;
661 p
[18] = (16 * 176) >> 8; // 16x write speed
662 p
[19] = (16 * 176) & 0xff;
663 p
[20] = (16 * 176) >> 8; // 16x write speed current
664 p
[21] = (16 * 176) & 0xff;
672 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
674 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
676 int page
, dbd
, buflen
, page_control
;
678 uint8_t dev_specific_param
;
680 dbd
= req
->cmd
.buf
[1] & 0x8;
681 page
= req
->cmd
.buf
[2] & 0x3f;
682 page_control
= (req
->cmd
.buf
[2] & 0xc0) >> 6;
683 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
684 (req
->cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, req
->cmd
.xfer
, page_control
);
685 memset(outbuf
, 0, req
->cmd
.xfer
);
688 if (bdrv_is_read_only(s
->bs
)) {
689 dev_specific_param
= 0x80; /* Readonly. */
691 dev_specific_param
= 0x00;
694 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
695 p
[1] = 0; /* Default media type. */
696 p
[2] = dev_specific_param
;
697 p
[3] = 0; /* Block descriptor length. */
699 } else { /* MODE_SENSE_10 */
700 p
[2] = 0; /* Default media type. */
701 p
[3] = dev_specific_param
;
702 p
[6] = p
[7] = 0; /* Block descriptor length. */
706 bdrv_get_geometry(s
->bs
, &nb_sectors
);
707 if (!dbd
&& nb_sectors
) {
708 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
709 outbuf
[3] = 8; /* Block descriptor length */
710 } else { /* MODE_SENSE_10 */
711 outbuf
[7] = 8; /* Block descriptor length */
713 nb_sectors
/= s
->cluster_size
;
714 if (nb_sectors
> 0xffffff)
716 p
[0] = 0; /* media density code */
717 p
[1] = (nb_sectors
>> 16) & 0xff;
718 p
[2] = (nb_sectors
>> 8) & 0xff;
719 p
[3] = nb_sectors
& 0xff;
720 p
[4] = 0; /* reserved */
721 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
722 p
[6] = s
->cluster_size
* 2;
727 if (page_control
== 3) { /* Saved Values */
728 return -1; /* ILLEGAL_REQUEST */
736 p
+= mode_sense_page(req
, page
, p
, page_control
);
739 p
+= mode_sense_page(req
, 0x08, p
, page_control
);
740 p
+= mode_sense_page(req
, 0x2a, p
, page_control
);
743 return -1; /* ILLEGAL_REQUEST */
748 * The mode data length field specifies the length in bytes of the
749 * following data that is available to be transferred. The mode data
750 * length does not include itself.
752 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
753 outbuf
[0] = buflen
- 1;
754 } else { /* MODE_SENSE_10 */
755 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
756 outbuf
[1] = (buflen
- 2) & 0xff;
758 if (buflen
> req
->cmd
.xfer
)
759 buflen
= req
->cmd
.xfer
;
763 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
765 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
766 int start_track
, format
, msf
, toclen
;
769 msf
= req
->cmd
.buf
[1] & 2;
770 format
= req
->cmd
.buf
[2] & 0xf;
771 start_track
= req
->cmd
.buf
[6];
772 bdrv_get_geometry(s
->bs
, &nb_sectors
);
773 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
774 nb_sectors
/= s
->cluster_size
;
777 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
780 /* multi session : only a single session defined */
782 memset(outbuf
, 0, 12);
788 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
793 if (toclen
> req
->cmd
.xfer
)
794 toclen
= req
->cmd
.xfer
;
798 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
800 SCSIRequest
*req
= &r
->req
;
801 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
806 switch (req
->cmd
.buf
[0]) {
807 case TEST_UNIT_READY
:
808 if (!bdrv_is_inserted(s
->bs
))
812 if (req
->cmd
.xfer
< 4)
813 goto illegal_request
;
814 buflen
= scsi_build_sense(s
->sense
, outbuf
, req
->cmd
.xfer
,
816 scsi_disk_clear_sense(s
);
819 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
821 goto illegal_request
;
825 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
827 goto illegal_request
;
830 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
832 goto illegal_request
;
835 if (req
->cmd
.buf
[1] & 1)
836 goto illegal_request
;
839 if (req
->cmd
.buf
[1] & 3)
840 goto illegal_request
;
843 if (req
->cmd
.buf
[1] & 1)
844 goto illegal_request
;
847 if (req
->cmd
.buf
[1] & 3)
848 goto illegal_request
;
851 if (s
->drive_kind
== SCSI_CD
&& (req
->cmd
.buf
[4] & 2)) {
852 /* load/eject medium */
853 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
856 case ALLOW_MEDIUM_REMOVAL
:
857 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
860 /* The normal LEN field for this command is zero. */
861 memset(outbuf
, 0, 8);
862 bdrv_get_geometry(s
->bs
, &nb_sectors
);
865 nb_sectors
/= s
->cluster_size
;
866 /* Returned value is the address of the last sector. */
868 /* Remember the new size for read/write sanity checking. */
869 s
->max_lba
= nb_sectors
;
870 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
871 if (nb_sectors
> UINT32_MAX
)
872 nb_sectors
= UINT32_MAX
;
873 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
874 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
875 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
876 outbuf
[3] = nb_sectors
& 0xff;
879 outbuf
[6] = s
->cluster_size
* 2;
883 case SYNCHRONIZE_CACHE
:
884 ret
= bdrv_flush(s
->bs
);
886 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
891 case GET_CONFIGURATION
:
892 memset(outbuf
, 0, 8);
893 /* ??? This should probably return much more information. For now
894 just return the basic header indicating the CD-ROM profile. */
895 outbuf
[7] = 8; // CD-ROM
898 case SERVICE_ACTION_IN
:
899 /* Service Action In subcommands. */
900 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
901 DPRINTF("SAI READ CAPACITY(16)\n");
902 memset(outbuf
, 0, req
->cmd
.xfer
);
903 bdrv_get_geometry(s
->bs
, &nb_sectors
);
906 nb_sectors
/= s
->cluster_size
;
907 /* Returned value is the address of the last sector. */
909 /* Remember the new size for read/write sanity checking. */
910 s
->max_lba
= nb_sectors
;
911 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
912 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
913 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
914 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
915 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
916 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
917 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
918 outbuf
[7] = nb_sectors
& 0xff;
921 outbuf
[10] = s
->cluster_size
* 2;
924 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
926 /* set TPE bit if the format supports discard */
927 if (s
->qdev
.conf
.discard_granularity
) {
931 /* Protection, exponent and lowest lba field left blank. */
932 buflen
= req
->cmd
.xfer
;
935 DPRINTF("Unsupported Service Action In\n");
936 goto illegal_request
;
938 if (req
->cmd
.xfer
< 16)
939 goto illegal_request
;
940 memset(outbuf
, 0, 16);
947 DPRINTF("Rezero Unit\n");
948 if (!bdrv_is_inserted(s
->bs
)) {
953 scsi_command_complete(r
, CHECK_CONDITION
, SENSE_CODE(INVALID_OPCODE
));
956 scsi_req_set_status(r
, GOOD
, SENSE_CODE(NO_SENSE
));
960 if (!bdrv_is_inserted(s
->bs
)) {
961 scsi_command_complete(r
, CHECK_CONDITION
, SENSE_CODE(NO_MEDIUM
));
963 scsi_command_complete(r
, CHECK_CONDITION
, SENSE_CODE(LUN_NOT_READY
));
968 scsi_command_complete(r
, CHECK_CONDITION
, SENSE_CODE(INVALID_FIELD
));
972 /* Execute a scsi command. Returns the length of the data expected by the
973 command. This will be Positive for data transfers from the device
974 (eg. disk reads), negative for transfers to the device (eg. disk writes),
975 and zero if the command does not transfer any data. */
977 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
979 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
980 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
987 scsi_req_enqueue(req
);
989 outbuf
= (uint8_t *)r
->iov
.iov_base
;
991 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
993 if (scsi_req_parse(&r
->req
, buf
) != 0) {
994 BADF("Unsupported command length, command %x\n", command
);
995 scsi_command_complete(r
, CHECK_CONDITION
, SENSE_CODE(INVALID_OPCODE
));
1001 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
1002 printf(" 0x%02x", buf
[i
]);
1008 if (req
->lun
|| buf
[1] >> 5) {
1009 /* Only LUN 0 supported. */
1010 DPRINTF("Unimplemented LUN %d\n", req
->lun
? req
->lun
: buf
[1] >> 5);
1011 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
) {
1012 scsi_command_complete(r
, CHECK_CONDITION
,
1013 SENSE_CODE(LUN_NOT_SUPPORTED
));
1018 case TEST_UNIT_READY
:
1028 case ALLOW_MEDIUM_REMOVAL
:
1030 case SYNCHRONIZE_CACHE
:
1032 case GET_CONFIGURATION
:
1033 case SERVICE_ACTION_IN
:
1037 rc
= scsi_disk_emulate_command(r
, outbuf
);
1042 r
->iov
.iov_len
= rc
;
1048 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1049 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1050 if (r
->req
.cmd
.lba
> s
->max_lba
)
1052 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1053 r
->sector_count
= len
* s
->cluster_size
;
1060 case WRITE_VERIFY_12
:
1061 case WRITE_VERIFY_16
:
1062 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1063 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1064 (command
& 0xe) == 0xe ? "And Verify " : "",
1065 r
->req
.cmd
.lba
, len
);
1066 if (r
->req
.cmd
.lba
> s
->max_lba
)
1068 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1069 r
->sector_count
= len
* s
->cluster_size
;
1073 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1074 /* We don't support mode parameter changes.
1075 Allow the mode parameter header + block descriptors only. */
1076 if (r
->req
.cmd
.xfer
> 12) {
1080 case MODE_SELECT_10
:
1081 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1082 /* We don't support mode parameter changes.
1083 Allow the mode parameter header + block descriptors only. */
1084 if (r
->req
.cmd
.xfer
> 16) {
1090 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1092 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1097 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1099 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1100 r
->req
.cmd
.lba
, len
);
1102 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1107 * We only support WRITE SAME with the unmap bit set for now.
1109 if (!(buf
[1] & 0x8)) {
1113 rc
= bdrv_discard(s
->bs
, r
->req
.cmd
.lba
* s
->cluster_size
,
1114 len
* s
->cluster_size
);
1116 /* XXX: better error code ?*/
1122 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1123 scsi_command_complete(r
, CHECK_CONDITION
, SENSE_CODE(INVALID_OPCODE
));
1126 scsi_command_complete(r
, CHECK_CONDITION
, SENSE_CODE(INVALID_FIELD
));
1129 scsi_command_complete(r
, CHECK_CONDITION
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1132 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1133 scsi_command_complete(r
, GOOD
, SENSE_CODE(NO_SENSE
));
1135 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1139 if (!r
->sector_count
)
1140 r
->sector_count
= -1;
1145 static void scsi_disk_reset(DeviceState
*dev
)
1147 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1148 uint64_t nb_sectors
;
1150 scsi_device_purge_requests(&s
->qdev
);
1152 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1153 nb_sectors
/= s
->cluster_size
;
1157 s
->max_lba
= nb_sectors
;
1160 static void scsi_destroy(SCSIDevice
*dev
)
1162 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1164 scsi_device_purge_requests(&s
->qdev
);
1165 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1168 static int scsi_initfn(SCSIDevice
*dev
, SCSIDriveKind kind
)
1170 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1173 if (!s
->qdev
.conf
.bs
) {
1174 error_report("scsi-disk: drive property not set");
1177 s
->bs
= s
->qdev
.conf
.bs
;
1178 s
->drive_kind
= kind
;
1180 if (kind
== SCSI_HD
&& !bdrv_is_inserted(s
->bs
)) {
1181 error_report("Device needs media, but drive is empty");
1186 /* try to fall back to value set with legacy -drive serial=... */
1187 dinfo
= drive_get_by_blockdev(s
->bs
);
1188 s
->serial
= qemu_strdup(*dinfo
->serial
? dinfo
->serial
: "0");
1192 s
->version
= qemu_strdup(QEMU_VERSION
);
1195 if (bdrv_is_sg(s
->bs
)) {
1196 error_report("scsi-disk: unwanted /dev/sg*");
1200 if (kind
== SCSI_CD
) {
1201 s
->qdev
.blocksize
= 2048;
1203 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1205 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1206 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1208 s
->qdev
.type
= TYPE_DISK
;
1209 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1210 bdrv_set_removable(s
->bs
, kind
== SCSI_CD
);
1211 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1215 static int scsi_hd_initfn(SCSIDevice
*dev
)
1217 return scsi_initfn(dev
, SCSI_HD
);
1220 static int scsi_cd_initfn(SCSIDevice
*dev
)
1222 return scsi_initfn(dev
, SCSI_CD
);
1225 static int scsi_disk_initfn(SCSIDevice
*dev
)
1230 if (!dev
->conf
.bs
) {
1231 kind
= SCSI_HD
; /* will die in scsi_initfn() */
1233 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1234 kind
= dinfo
->media_cd
? SCSI_CD
: SCSI_HD
;
1237 return scsi_initfn(dev
, kind
);
1240 #define DEFINE_SCSI_DISK_PROPERTIES() \
1241 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1242 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1243 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1245 static SCSIDeviceInfo scsi_disk_info
[] = {
1247 .qdev
.name
= "scsi-hd",
1248 .qdev
.fw_name
= "disk",
1249 .qdev
.desc
= "virtual SCSI disk",
1250 .qdev
.size
= sizeof(SCSIDiskState
),
1251 .qdev
.reset
= scsi_disk_reset
,
1252 .init
= scsi_hd_initfn
,
1253 .destroy
= scsi_destroy
,
1254 .alloc_req
= scsi_new_request
,
1255 .free_req
= scsi_free_request
,
1256 .send_command
= scsi_send_command
,
1257 .read_data
= scsi_read_data
,
1258 .write_data
= scsi_write_data
,
1259 .cancel_io
= scsi_cancel_io
,
1260 .get_buf
= scsi_get_buf
,
1261 .qdev
.props
= (Property
[]) {
1262 DEFINE_SCSI_DISK_PROPERTIES(),
1263 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1264 DEFINE_PROP_END_OF_LIST(),
1267 .qdev
.name
= "scsi-cd",
1268 .qdev
.fw_name
= "disk",
1269 .qdev
.desc
= "virtual SCSI CD-ROM",
1270 .qdev
.size
= sizeof(SCSIDiskState
),
1271 .qdev
.reset
= scsi_disk_reset
,
1272 .init
= scsi_cd_initfn
,
1273 .destroy
= scsi_destroy
,
1274 .alloc_req
= scsi_new_request
,
1275 .free_req
= scsi_free_request
,
1276 .send_command
= scsi_send_command
,
1277 .read_data
= scsi_read_data
,
1278 .write_data
= scsi_write_data
,
1279 .cancel_io
= scsi_cancel_io
,
1280 .get_buf
= scsi_get_buf
,
1281 .qdev
.props
= (Property
[]) {
1282 DEFINE_SCSI_DISK_PROPERTIES(),
1283 DEFINE_PROP_END_OF_LIST(),
1286 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1287 .qdev
.fw_name
= "disk",
1288 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1289 .qdev
.size
= sizeof(SCSIDiskState
),
1290 .qdev
.reset
= scsi_disk_reset
,
1291 .init
= scsi_disk_initfn
,
1292 .destroy
= scsi_destroy
,
1293 .alloc_req
= scsi_new_request
,
1294 .free_req
= scsi_free_request
,
1295 .send_command
= scsi_send_command
,
1296 .read_data
= scsi_read_data
,
1297 .write_data
= scsi_write_data
,
1298 .cancel_io
= scsi_cancel_io
,
1299 .get_buf
= scsi_get_buf
,
1300 .qdev
.props
= (Property
[]) {
1301 DEFINE_SCSI_DISK_PROPERTIES(),
1302 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1303 DEFINE_PROP_END_OF_LIST(),
1308 static void scsi_disk_register_devices(void)
1312 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1313 scsi_qdev_register(&scsi_disk_info
[i
]);
1316 device_init(scsi_disk_register_devices
)