2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
46 typedef struct SCSIDiskState SCSIDiskState
;
48 typedef struct SCSIDiskReq
{
50 /* ??? We should probably keep track of whether the data transfer is
51 a read or a write. Currently we rely on the host getting it right. */
52 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
54 uint32_t sector_count
;
64 /* The qemu block layer uses a fixed 512 byte sector size.
65 This is the number of 512 byte blocks in a single scsi sector. */
73 static SCSIDiskReq
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
)
78 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), d
, tag
, lun
);
79 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
80 r
->iov
.iov_base
= qemu_memalign(512, SCSI_DMA_BUF_SIZE
);
84 static void scsi_remove_request(SCSIDiskReq
*r
)
86 qemu_vfree(r
->iov
.iov_base
);
87 scsi_req_free(&r
->req
);
90 static SCSIDiskReq
*scsi_find_request(SCSIDiskState
*s
, uint32_t tag
)
92 return DO_UPCAST(SCSIDiskReq
, req
, scsi_req_find(&s
->qdev
, tag
));
95 static void scsi_req_set_status(SCSIRequest
*req
, int status
, int sense_code
)
98 scsi_dev_set_sense(req
->dev
, sense_code
);
101 /* Helper function for command completion. */
102 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, int sense
)
104 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
105 r
->req
.tag
, status
, sense
);
106 scsi_req_set_status(&r
->req
, status
, sense
);
107 scsi_req_complete(&r
->req
);
108 scsi_remove_request(r
);
111 /* Cancel a pending data transfer. */
112 static void scsi_cancel_io(SCSIDevice
*d
, uint32_t tag
)
114 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
116 DPRINTF("Cancel tag=0x%x\n", tag
);
117 r
= scsi_find_request(s
, tag
);
120 bdrv_aio_cancel(r
->req
.aiocb
);
122 scsi_remove_request(r
);
126 static void scsi_read_complete(void * opaque
, int ret
)
128 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
133 DPRINTF("IO error\n");
134 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, 0);
135 scsi_command_complete(r
, CHECK_CONDITION
, NO_SENSE
);
138 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
140 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
143 /* Read more data from scsi device into buffer. */
144 static void scsi_read_data(SCSIDevice
*d
, uint32_t tag
)
146 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
150 r
= scsi_find_request(s
, tag
);
152 BADF("Bad read tag 0x%x\n", tag
);
153 /* ??? This is the wrong error. */
154 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
157 if (r
->sector_count
== (uint32_t)-1) {
158 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
160 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
163 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
164 if (r
->sector_count
== 0) {
165 scsi_command_complete(r
, GOOD
, NO_SENSE
);
170 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
171 n
= SCSI_DMA_BUF_SIZE
/ 512;
173 r
->iov
.iov_len
= n
* 512;
174 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
175 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
176 scsi_read_complete
, r
);
177 if (r
->req
.aiocb
== NULL
)
178 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
180 r
->sector_count
-= n
;
183 static int scsi_handle_write_error(SCSIDiskReq
*r
, int error
)
185 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
186 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, 0);
188 if (action
== BLOCK_ERR_IGNORE
) {
189 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, 0);
193 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
194 || action
== BLOCK_ERR_STOP_ANY
) {
195 r
->status
|= SCSI_REQ_STATUS_RETRY
;
196 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, 0);
199 scsi_command_complete(r
, CHECK_CONDITION
,
201 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, 0);
207 static void scsi_write_complete(void * opaque
, int ret
)
209 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
216 if (scsi_handle_write_error(r
, -ret
))
220 n
= r
->iov
.iov_len
/ 512;
222 r
->sector_count
-= n
;
223 if (r
->sector_count
== 0) {
224 scsi_command_complete(r
, GOOD
, NO_SENSE
);
226 len
= r
->sector_count
* 512;
227 if (len
> SCSI_DMA_BUF_SIZE
) {
228 len
= SCSI_DMA_BUF_SIZE
;
230 r
->iov
.iov_len
= len
;
231 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
232 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, len
);
236 static void scsi_write_request(SCSIDiskReq
*r
)
238 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
241 n
= r
->iov
.iov_len
/ 512;
243 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
244 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
245 scsi_write_complete
, r
);
246 if (r
->req
.aiocb
== NULL
)
247 scsi_command_complete(r
, CHECK_CONDITION
,
250 /* Invoke completion routine to fetch data from host. */
251 scsi_write_complete(r
, 0);
255 /* Write data to a scsi device. Returns nonzero on failure.
256 The transfer may complete asynchronously. */
257 static int scsi_write_data(SCSIDevice
*d
, uint32_t tag
)
259 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
262 DPRINTF("Write data tag=0x%x\n", tag
);
263 r
= scsi_find_request(s
, tag
);
265 BADF("Bad write tag 0x%x\n", tag
);
266 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
271 BADF("Data transfer already in progress\n");
273 scsi_write_request(r
);
278 static void scsi_dma_restart_bh(void *opaque
)
280 SCSIDiskState
*s
= opaque
;
284 qemu_bh_delete(s
->bh
);
287 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
288 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
289 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
290 r
->status
&= ~SCSI_REQ_STATUS_RETRY
;
291 scsi_write_request(r
);
296 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
298 SCSIDiskState
*s
= opaque
;
304 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
305 qemu_bh_schedule(s
->bh
);
309 /* Return a pointer to the data buffer. */
310 static uint8_t *scsi_get_buf(SCSIDevice
*d
, uint32_t tag
)
312 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
315 r
= scsi_find_request(s
, tag
);
317 BADF("Bad buffer tag 0x%x\n", tag
);
320 return (uint8_t *)r
->iov
.iov_base
;
323 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
325 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
328 if (req
->cmd
.buf
[1] & 0x2) {
329 /* Command support data - optional, not implemented */
330 BADF("optional INQUIRY command support request not implemented\n");
334 if (req
->cmd
.buf
[1] & 0x1) {
335 /* Vital product data */
336 uint8_t page_code
= req
->cmd
.buf
[2];
337 if (req
->cmd
.xfer
< 4) {
338 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
339 "less than 4\n", page_code
, req
->cmd
.xfer
);
343 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
344 outbuf
[buflen
++] = 5;
346 outbuf
[buflen
++] = 0;
348 outbuf
[buflen
++] = page_code
; // this page
349 outbuf
[buflen
++] = 0x00;
352 case 0x00: /* Supported page codes, mandatory */
353 DPRINTF("Inquiry EVPD[Supported pages] "
354 "buffer size %zd\n", req
->cmd
.xfer
);
355 outbuf
[buflen
++] = 4; // number of pages
356 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
357 outbuf
[buflen
++] = 0x80; // unit serial number
358 outbuf
[buflen
++] = 0x83; // device identification
359 outbuf
[buflen
++] = 0xb0; // block device characteristics
362 case 0x80: /* Device serial number, optional */
364 int l
= strlen(s
->serial
);
366 if (l
> req
->cmd
.xfer
)
371 DPRINTF("Inquiry EVPD[Serial number] "
372 "buffer size %zd\n", req
->cmd
.xfer
);
373 outbuf
[buflen
++] = l
;
374 memcpy(outbuf
+buflen
, s
->serial
, l
);
379 case 0x83: /* Device identification page, mandatory */
381 int max_len
= 255 - 8;
382 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
384 if (id_len
> max_len
)
386 DPRINTF("Inquiry EVPD[Device identification] "
387 "buffer size %zd\n", req
->cmd
.xfer
);
389 outbuf
[buflen
++] = 3 + id_len
;
390 outbuf
[buflen
++] = 0x2; // ASCII
391 outbuf
[buflen
++] = 0; // not officially assigned
392 outbuf
[buflen
++] = 0; // reserved
393 outbuf
[buflen
++] = id_len
; // length of data following
395 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
399 case 0xb0: /* block device characteristics */
401 unsigned int min_io_size
=
402 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
403 unsigned int opt_io_size
=
404 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
406 /* required VPD size with unmap support */
407 outbuf
[3] = buflen
= 0x3c;
409 memset(outbuf
+ 4, 0, buflen
- 4);
411 /* optimal transfer length granularity */
412 outbuf
[6] = (min_io_size
>> 8) & 0xff;
413 outbuf
[7] = min_io_size
& 0xff;
415 /* optimal transfer length */
416 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
417 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
418 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
419 outbuf
[15] = opt_io_size
& 0xff;
423 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
424 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
431 /* Standard INQUIRY data */
432 if (req
->cmd
.buf
[2] != 0) {
433 BADF("Error: Inquiry (STANDARD) page or code "
434 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
439 if (req
->cmd
.xfer
< 5) {
440 BADF("Error: Inquiry (STANDARD) buffer size %zd "
441 "is less than 5\n", req
->cmd
.xfer
);
445 buflen
= req
->cmd
.xfer
;
446 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
447 buflen
= SCSI_MAX_INQUIRY_LEN
;
449 memset(outbuf
, 0, buflen
);
451 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
452 outbuf
[0] = 0x7f; /* LUN not supported */
456 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
459 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
462 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
464 memcpy(&outbuf
[8], "QEMU ", 8);
465 memset(&outbuf
[32], 0, 4);
466 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
468 * We claim conformance to SPC-3, which is required for guests
469 * to ask for modern features like READ CAPACITY(16) or the
470 * block characteristics VPD page by default. Not all of SPC-3
471 * is actually implemented, but we're good enough.
474 outbuf
[3] = 2; /* Format 2 */
477 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
479 /* If the allocation length of CDB is too small,
480 the additional length is not adjusted */
484 /* Sync data transfer and TCQ. */
485 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
489 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
,
492 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
493 BlockDriverState
*bdrv
= s
->bs
;
494 int cylinders
, heads
, secs
;
497 * If Changeable Values are requested, a mask denoting those mode parameters
498 * that are changeable shall be returned. As we currently don't support
499 * parameter changes via MODE_SELECT all bits are returned set to zero.
500 * The buffer was already menset to zero by the caller of this function.
503 case 4: /* Rigid disk device geometry page. */
506 if (page_control
== 1) { /* Changeable Values */
509 /* if a geometry hint is available, use it */
510 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
511 p
[2] = (cylinders
>> 16) & 0xff;
512 p
[3] = (cylinders
>> 8) & 0xff;
513 p
[4] = cylinders
& 0xff;
515 /* Write precomp start cylinder, disabled */
516 p
[6] = (cylinders
>> 16) & 0xff;
517 p
[7] = (cylinders
>> 8) & 0xff;
518 p
[8] = cylinders
& 0xff;
519 /* Reduced current start cylinder, disabled */
520 p
[9] = (cylinders
>> 16) & 0xff;
521 p
[10] = (cylinders
>> 8) & 0xff;
522 p
[11] = cylinders
& 0xff;
523 /* Device step rate [ns], 200ns */
526 /* Landing zone cylinder */
530 /* Medium rotation rate [rpm], 5400 rpm */
531 p
[20] = (5400 >> 8) & 0xff;
535 case 5: /* Flexible disk device geometry page. */
538 if (page_control
== 1) { /* Changeable Values */
541 /* Transfer rate [kbit/s], 5Mbit/s */
544 /* if a geometry hint is available, use it */
545 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
548 p
[6] = s
->cluster_size
* 2;
549 p
[8] = (cylinders
>> 8) & 0xff;
550 p
[9] = cylinders
& 0xff;
551 /* Write precomp start cylinder, disabled */
552 p
[10] = (cylinders
>> 8) & 0xff;
553 p
[11] = cylinders
& 0xff;
554 /* Reduced current start cylinder, disabled */
555 p
[12] = (cylinders
>> 8) & 0xff;
556 p
[13] = cylinders
& 0xff;
557 /* Device step rate [100us], 100us */
560 /* Device step pulse width [us], 1us */
562 /* Device head settle delay [100us], 100us */
565 /* Motor on delay [0.1s], 0.1s */
567 /* Motor off delay [0.1s], 0.1s */
569 /* Medium rotation rate [rpm], 5400 rpm */
570 p
[28] = (5400 >> 8) & 0xff;
574 case 8: /* Caching page. */
577 if (page_control
== 1) { /* Changeable Values */
580 if (bdrv_enable_write_cache(s
->bs
)) {
585 case 0x2a: /* CD Capabilities and Mechanical Status page. */
586 if (bdrv_get_type_hint(bdrv
) != BDRV_TYPE_CDROM
)
590 if (page_control
== 1) { /* Changeable Values */
593 p
[2] = 3; // CD-R & CD-RW read
594 p
[3] = 0; // Writing not supported
595 p
[4] = 0x7f; /* Audio, composite, digital out,
596 mode 2 form 1&2, multi session */
597 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
598 RW corrected, C2 errors, ISRC,
600 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
601 /* Locking supported, jumper present, eject, tray */
602 p
[7] = 0; /* no volume & mute control, no
604 p
[8] = (50 * 176) >> 8; // 50x read speed
605 p
[9] = (50 * 176) & 0xff;
606 p
[10] = 0 >> 8; // No volume
608 p
[12] = 2048 >> 8; // 2M buffer
610 p
[14] = (16 * 176) >> 8; // 16x read speed current
611 p
[15] = (16 * 176) & 0xff;
612 p
[18] = (16 * 176) >> 8; // 16x write speed
613 p
[19] = (16 * 176) & 0xff;
614 p
[20] = (16 * 176) >> 8; // 16x write speed current
615 p
[21] = (16 * 176) & 0xff;
623 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
625 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
627 int page
, dbd
, buflen
, page_control
;
629 uint8_t dev_specific_param
;
631 dbd
= req
->cmd
.buf
[1] & 0x8;
632 page
= req
->cmd
.buf
[2] & 0x3f;
633 page_control
= (req
->cmd
.buf
[2] & 0xc0) >> 6;
634 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
635 (req
->cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, req
->cmd
.xfer
, page_control
);
636 memset(outbuf
, 0, req
->cmd
.xfer
);
639 if (bdrv_is_read_only(s
->bs
)) {
640 dev_specific_param
= 0x80; /* Readonly. */
642 dev_specific_param
= 0x00;
645 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
646 p
[1] = 0; /* Default media type. */
647 p
[2] = dev_specific_param
;
648 p
[3] = 0; /* Block descriptor length. */
650 } else { /* MODE_SENSE_10 */
651 p
[2] = 0; /* Default media type. */
652 p
[3] = dev_specific_param
;
653 p
[6] = p
[7] = 0; /* Block descriptor length. */
657 bdrv_get_geometry(s
->bs
, &nb_sectors
);
658 if (!dbd
&& nb_sectors
) {
659 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
660 outbuf
[3] = 8; /* Block descriptor length */
661 } else { /* MODE_SENSE_10 */
662 outbuf
[7] = 8; /* Block descriptor length */
664 nb_sectors
/= s
->cluster_size
;
665 if (nb_sectors
> 0xffffff)
667 p
[0] = 0; /* media density code */
668 p
[1] = (nb_sectors
>> 16) & 0xff;
669 p
[2] = (nb_sectors
>> 8) & 0xff;
670 p
[3] = nb_sectors
& 0xff;
671 p
[4] = 0; /* reserved */
672 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
673 p
[6] = s
->cluster_size
* 2;
678 if (page_control
== 3) { /* Saved Values */
679 return -1; /* ILLEGAL_REQUEST */
687 p
+= mode_sense_page(req
, page
, p
, page_control
);
690 p
+= mode_sense_page(req
, 0x08, p
, page_control
);
691 p
+= mode_sense_page(req
, 0x2a, p
, page_control
);
694 return -1; /* ILLEGAL_REQUEST */
699 * The mode data length field specifies the length in bytes of the
700 * following data that is available to be transferred. The mode data
701 * length does not include itself.
703 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
704 outbuf
[0] = buflen
- 1;
705 } else { /* MODE_SENSE_10 */
706 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
707 outbuf
[1] = (buflen
- 2) & 0xff;
709 if (buflen
> req
->cmd
.xfer
)
710 buflen
= req
->cmd
.xfer
;
714 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
716 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
717 int start_track
, format
, msf
, toclen
;
720 msf
= req
->cmd
.buf
[1] & 2;
721 format
= req
->cmd
.buf
[2] & 0xf;
722 start_track
= req
->cmd
.buf
[6];
723 bdrv_get_geometry(s
->bs
, &nb_sectors
);
724 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
725 nb_sectors
/= s
->cluster_size
;
728 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
731 /* multi session : only a single session defined */
733 memset(outbuf
, 0, 12);
739 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
744 if (toclen
> req
->cmd
.xfer
)
745 toclen
= req
->cmd
.xfer
;
749 static int scsi_disk_emulate_command(SCSIRequest
*req
, uint8_t *outbuf
)
751 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
755 switch (req
->cmd
.buf
[0]) {
756 case TEST_UNIT_READY
:
757 if (!bdrv_is_inserted(s
->bs
))
761 if (req
->cmd
.xfer
< 4)
762 goto illegal_request
;
763 memset(outbuf
, 0, 4);
765 if (req
->dev
->sense
.key
== NOT_READY
&& req
->cmd
.xfer
>= 18) {
766 memset(outbuf
, 0, 18);
769 /* asc 0x3a, ascq 0: Medium not present */
775 outbuf
[2] = req
->dev
->sense
.key
;
776 scsi_dev_clear_sense(req
->dev
);
779 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
781 goto illegal_request
;
785 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
787 goto illegal_request
;
790 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
792 goto illegal_request
;
795 if (req
->cmd
.buf
[1] & 1)
796 goto illegal_request
;
799 if (req
->cmd
.buf
[1] & 3)
800 goto illegal_request
;
803 if (req
->cmd
.buf
[1] & 1)
804 goto illegal_request
;
807 if (req
->cmd
.buf
[1] & 3)
808 goto illegal_request
;
811 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
&& (req
->cmd
.buf
[4] & 2)) {
812 /* load/eject medium */
813 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
816 case ALLOW_MEDIUM_REMOVAL
:
817 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
820 /* The normal LEN field for this command is zero. */
821 memset(outbuf
, 0, 8);
822 bdrv_get_geometry(s
->bs
, &nb_sectors
);
825 nb_sectors
/= s
->cluster_size
;
826 /* Returned value is the address of the last sector. */
828 /* Remember the new size for read/write sanity checking. */
829 s
->max_lba
= nb_sectors
;
830 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
831 if (nb_sectors
> UINT32_MAX
)
832 nb_sectors
= UINT32_MAX
;
833 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
834 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
835 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
836 outbuf
[3] = nb_sectors
& 0xff;
839 outbuf
[6] = s
->cluster_size
* 2;
843 case SYNCHRONIZE_CACHE
:
846 case GET_CONFIGURATION
:
847 memset(outbuf
, 0, 8);
848 /* ??? This should probably return much more information. For now
849 just return the basic header indicating the CD-ROM profile. */
850 outbuf
[7] = 8; // CD-ROM
853 case SERVICE_ACTION_IN
:
854 /* Service Action In subcommands. */
855 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
856 DPRINTF("SAI READ CAPACITY(16)\n");
857 memset(outbuf
, 0, req
->cmd
.xfer
);
858 bdrv_get_geometry(s
->bs
, &nb_sectors
);
861 nb_sectors
/= s
->cluster_size
;
862 /* Returned value is the address of the last sector. */
864 /* Remember the new size for read/write sanity checking. */
865 s
->max_lba
= nb_sectors
;
866 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
867 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
868 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
869 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
870 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
871 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
872 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
873 outbuf
[7] = nb_sectors
& 0xff;
876 outbuf
[10] = s
->cluster_size
* 2;
879 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
880 /* Protection, exponent and lowest lba field left blank. */
881 buflen
= req
->cmd
.xfer
;
884 DPRINTF("Unsupported Service Action In\n");
885 goto illegal_request
;
887 if (req
->cmd
.xfer
< 16)
888 goto illegal_request
;
889 memset(outbuf
, 0, 16);
896 DPRINTF("Rezero Unit\n");
897 if (!bdrv_is_inserted(s
->bs
)) {
902 goto illegal_request
;
904 scsi_req_set_status(req
, GOOD
, NO_SENSE
);
908 scsi_req_set_status(req
, CHECK_CONDITION
, NOT_READY
);
912 scsi_req_set_status(req
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
916 /* Execute a scsi command. Returns the length of the data expected by the
917 command. This will be Positive for data transfers from the device
918 (eg. disk reads), negative for transfers to the device (eg. disk writes),
919 and zero if the command does not transfer any data. */
921 static int32_t scsi_send_command(SCSIDevice
*d
, uint32_t tag
,
922 uint8_t *buf
, int lun
)
924 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
935 r
= scsi_find_request(s
, tag
);
937 BADF("Tag 0x%x already in use\n", tag
);
938 scsi_cancel_io(d
, tag
);
940 /* ??? Tags are not unique for different luns. We only implement a
941 single lun, so this should not matter. */
942 r
= scsi_new_request(d
, tag
, lun
);
943 outbuf
= (uint8_t *)r
->iov
.iov_base
;
945 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
946 switch (command
>> 5) {
948 lba
= (uint64_t) buf
[3] | ((uint64_t) buf
[2] << 8) |
949 (((uint64_t) buf
[1] & 0x1f) << 16);
955 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
956 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
957 len
= buf
[8] | (buf
[7] << 8);
961 lba
= (uint64_t) buf
[9] | ((uint64_t) buf
[8] << 8) |
962 ((uint64_t) buf
[7] << 16) | ((uint64_t) buf
[6] << 24) |
963 ((uint64_t) buf
[5] << 32) | ((uint64_t) buf
[4] << 40) |
964 ((uint64_t) buf
[3] << 48) | ((uint64_t) buf
[2] << 56);
965 len
= buf
[13] | (buf
[12] << 8) | (buf
[11] << 16) | (buf
[10] << 24);
969 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
970 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
971 len
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16) | (buf
[6] << 24);
975 BADF("Unsupported command length, command %x\n", command
);
981 for (i
= 1; i
< cmdlen
; i
++) {
982 printf(" 0x%02x", buf
[i
]);
988 if (scsi_req_parse(&r
->req
, buf
) != 0) {
989 BADF("Unsupported command length, command %x\n", command
);
992 assert(r
->req
.cmd
.len
== cmdlen
);
993 assert(r
->req
.cmd
.lba
== lba
);
995 if (lun
|| buf
[1] >> 5) {
996 /* Only LUN 0 supported. */
997 DPRINTF("Unimplemented LUN %d\n", lun
? lun
: buf
[1] >> 5);
998 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
)
1002 case TEST_UNIT_READY
:
1012 case ALLOW_MEDIUM_REMOVAL
:
1014 case SYNCHRONIZE_CACHE
:
1016 case GET_CONFIGURATION
:
1017 case SERVICE_ACTION_IN
:
1021 rc
= scsi_disk_emulate_command(&r
->req
, outbuf
);
1023 r
->iov
.iov_len
= rc
;
1025 scsi_req_complete(&r
->req
);
1026 scsi_remove_request(r
);
1034 DPRINTF("Read (sector %" PRId64
", count %d)\n", lba
, len
);
1035 if (lba
> s
->max_lba
)
1037 r
->sector
= lba
* s
->cluster_size
;
1038 r
->sector_count
= len
* s
->cluster_size
;
1045 case WRITE_VERIFY_12
:
1046 case WRITE_VERIFY_16
:
1047 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1048 (command
& 0xe) == 0xe ? "And Verify " : "", lba
, len
);
1049 if (lba
> s
->max_lba
)
1051 r
->sector
= lba
* s
->cluster_size
;
1052 r
->sector_count
= len
* s
->cluster_size
;
1056 DPRINTF("Mode Select(6) (len %d)\n", len
);
1057 /* We don't support mode parameter changes.
1058 Allow the mode parameter header + block descriptors only. */
1063 case MODE_SELECT_10
:
1064 DPRINTF("Mode Select(10) (len %d)\n", len
);
1065 /* We don't support mode parameter changes.
1066 Allow the mode parameter header + block descriptors only. */
1073 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10, lba
);
1074 if (lba
> s
->max_lba
) {
1079 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1081 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
1084 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
1087 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1088 scsi_command_complete(r
, GOOD
, NO_SENSE
);
1090 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1094 if (!r
->sector_count
)
1095 r
->sector_count
= -1;
1100 static void scsi_disk_purge_requests(SCSIDiskState
*s
)
1104 while (!QTAILQ_EMPTY(&s
->qdev
.requests
)) {
1105 r
= DO_UPCAST(SCSIDiskReq
, req
, QTAILQ_FIRST(&s
->qdev
.requests
));
1107 bdrv_aio_cancel(r
->req
.aiocb
);
1109 scsi_remove_request(r
);
1113 static void scsi_disk_reset(DeviceState
*dev
)
1115 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1116 uint64_t nb_sectors
;
1118 scsi_disk_purge_requests(s
);
1120 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1121 nb_sectors
/= s
->cluster_size
;
1125 s
->max_lba
= nb_sectors
;
1128 static void scsi_destroy(SCSIDevice
*dev
)
1130 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1132 scsi_disk_purge_requests(s
);
1133 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1136 static int scsi_disk_initfn(SCSIDevice
*dev
)
1138 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1142 if (!s
->qdev
.conf
.bs
) {
1143 error_report("scsi-disk: drive property not set");
1146 s
->bs
= s
->qdev
.conf
.bs
;
1147 is_cd
= bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
;
1149 if (!is_cd
&& !bdrv_is_inserted(s
->bs
)) {
1150 error_report("Device needs media, but drive is empty");
1154 if (bdrv_get_on_error(s
->bs
, 1) != BLOCK_ERR_REPORT
) {
1155 error_report("Device doesn't support drive option rerror");
1160 /* try to fall back to value set with legacy -drive serial=... */
1161 dinfo
= drive_get_by_blockdev(s
->bs
);
1162 s
->serial
= qemu_strdup(*dinfo
->serial
? dinfo
->serial
: "0");
1166 s
->version
= qemu_strdup(QEMU_VERSION
);
1169 if (bdrv_is_sg(s
->bs
)) {
1170 error_report("scsi-disk: unwanted /dev/sg*");
1175 s
->qdev
.blocksize
= 2048;
1177 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1179 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1181 s
->qdev
.type
= TYPE_DISK
;
1182 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1183 bdrv_set_removable(s
->bs
, is_cd
);
1187 static SCSIDeviceInfo scsi_disk_info
= {
1188 .qdev
.name
= "scsi-disk",
1189 .qdev
.desc
= "virtual scsi disk or cdrom",
1190 .qdev
.size
= sizeof(SCSIDiskState
),
1191 .qdev
.reset
= scsi_disk_reset
,
1192 .init
= scsi_disk_initfn
,
1193 .destroy
= scsi_destroy
,
1194 .send_command
= scsi_send_command
,
1195 .read_data
= scsi_read_data
,
1196 .write_data
= scsi_write_data
,
1197 .cancel_io
= scsi_cancel_io
,
1198 .get_buf
= scsi_get_buf
,
1199 .qdev
.props
= (Property
[]) {
1200 DEFINE_BLOCK_PROPERTIES(SCSIDiskState
, qdev
.conf
),
1201 DEFINE_PROP_STRING("ver", SCSIDiskState
, version
),
1202 DEFINE_PROP_STRING("serial", SCSIDiskState
, serial
),
1203 DEFINE_PROP_END_OF_LIST(),
1207 static void scsi_disk_register_devices(void)
1209 scsi_qdev_register(&scsi_disk_info
);
1211 device_init(scsi_disk_register_devices
)