2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
48 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSISense
{
56 typedef struct SCSIDiskReq
{
58 /* ??? We should probably keep track of whether the data transfer is
59 a read or a write. Currently we rely on the host getting it right. */
60 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
62 uint32_t sector_count
;
68 typedef enum { SCSI_HD
, SCSI_CD
} SCSIDriveKind
;
74 /* The qemu block layer uses a fixed 512 byte sector size.
75 This is the number of 512 byte blocks in a single scsi sector. */
83 SCSIDriveKind drive_kind
;
86 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
87 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
);
89 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
,
92 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
96 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), &s
->qdev
, tag
, lun
);
97 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
98 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
102 static void scsi_free_request(SCSIRequest
*req
)
104 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
106 qemu_vfree(r
->iov
.iov_base
);
109 static void scsi_disk_clear_sense(SCSIDiskState
*s
)
111 memset(&s
->sense
, 0, sizeof(s
->sense
));
114 static void scsi_disk_set_sense(SCSIDiskState
*s
, uint8_t key
)
119 static void scsi_req_set_status(SCSIDiskReq
*r
, int status
, int sense_code
)
121 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
123 r
->req
.status
= status
;
124 scsi_disk_set_sense(s
, sense_code
);
127 /* Helper function for command completion. */
128 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, int sense
)
130 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
131 r
->req
.tag
, status
, sense
);
132 scsi_req_set_status(r
, status
, sense
);
133 scsi_req_complete(&r
->req
);
136 /* Cancel a pending data transfer. */
137 static void scsi_cancel_io(SCSIRequest
*req
)
139 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
141 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
143 bdrv_aio_cancel(r
->req
.aiocb
);
146 scsi_req_dequeue(&r
->req
);
149 static void scsi_read_complete(void * opaque
, int ret
)
151 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
157 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
162 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
164 n
= r
->iov
.iov_len
/ 512;
166 r
->sector_count
-= n
;
167 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
171 /* Read more data from scsi device into buffer. */
172 static void scsi_read_data(SCSIRequest
*req
)
174 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
175 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
178 if (r
->sector_count
== (uint32_t)-1) {
179 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
181 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
184 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
185 if (r
->sector_count
== 0) {
186 scsi_command_complete(r
, GOOD
, NO_SENSE
);
190 /* No data transfer may already be in progress */
191 assert(r
->req
.aiocb
== NULL
);
194 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
195 n
= SCSI_DMA_BUF_SIZE
/ 512;
197 r
->iov
.iov_len
= n
* 512;
198 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
199 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
200 scsi_read_complete
, r
);
201 if (r
->req
.aiocb
== NULL
) {
202 scsi_read_complete(r
, -EIO
);
206 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
208 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
209 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
210 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
212 if (action
== BLOCK_ERR_IGNORE
) {
213 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
217 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
218 || action
== BLOCK_ERR_STOP_ANY
) {
220 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
221 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
223 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
224 vm_stop(VMSTOP_DISKFULL
);
226 if (type
== SCSI_REQ_STATUS_RETRY_READ
) {
227 scsi_req_data(&r
->req
, 0);
229 scsi_command_complete(r
, CHECK_CONDITION
,
231 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
237 static void scsi_write_complete(void * opaque
, int ret
)
239 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
246 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
251 n
= r
->iov
.iov_len
/ 512;
253 r
->sector_count
-= n
;
254 if (r
->sector_count
== 0) {
255 scsi_command_complete(r
, GOOD
, NO_SENSE
);
257 len
= r
->sector_count
* 512;
258 if (len
> SCSI_DMA_BUF_SIZE
) {
259 len
= SCSI_DMA_BUF_SIZE
;
261 r
->iov
.iov_len
= len
;
262 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
263 scsi_req_data(&r
->req
, len
);
267 static int scsi_write_data(SCSIRequest
*req
)
269 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
270 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
273 /* No data transfer may already be in progress */
274 assert(r
->req
.aiocb
== NULL
);
276 n
= r
->iov
.iov_len
/ 512;
278 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
279 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
280 scsi_write_complete
, r
);
281 if (r
->req
.aiocb
== NULL
) {
282 scsi_write_complete(r
, -EIO
);
285 /* Invoke completion routine to fetch data from host. */
286 scsi_write_complete(r
, 0);
292 static void scsi_dma_restart_bh(void *opaque
)
294 SCSIDiskState
*s
= opaque
;
298 qemu_bh_delete(s
->bh
);
301 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
302 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
303 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
304 int status
= r
->status
;
308 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
310 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
311 case SCSI_REQ_STATUS_RETRY_READ
:
312 scsi_read_data(&r
->req
);
314 case SCSI_REQ_STATUS_RETRY_WRITE
:
315 scsi_write_data(&r
->req
);
317 case SCSI_REQ_STATUS_RETRY_FLUSH
:
318 ret
= scsi_disk_emulate_command(r
, r
->iov
.iov_base
);
320 scsi_command_complete(r
, GOOD
, NO_SENSE
);
327 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
329 SCSIDiskState
*s
= opaque
;
335 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
336 qemu_bh_schedule(s
->bh
);
340 /* Return a pointer to the data buffer. */
341 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
343 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
345 return (uint8_t *)r
->iov
.iov_base
;
348 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
350 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
353 if (req
->cmd
.buf
[1] & 0x2) {
354 /* Command support data - optional, not implemented */
355 BADF("optional INQUIRY command support request not implemented\n");
359 if (req
->cmd
.buf
[1] & 0x1) {
360 /* Vital product data */
361 uint8_t page_code
= req
->cmd
.buf
[2];
362 if (req
->cmd
.xfer
< 4) {
363 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
364 "less than 4\n", page_code
, req
->cmd
.xfer
);
368 if (s
->drive_kind
== SCSI_CD
) {
369 outbuf
[buflen
++] = 5;
371 outbuf
[buflen
++] = 0;
373 outbuf
[buflen
++] = page_code
; // this page
374 outbuf
[buflen
++] = 0x00;
377 case 0x00: /* Supported page codes, mandatory */
380 DPRINTF("Inquiry EVPD[Supported pages] "
381 "buffer size %zd\n", req
->cmd
.xfer
);
383 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
384 outbuf
[buflen
++] = 0x80; // unit serial number
385 outbuf
[buflen
++] = 0x83; // device identification
386 if (s
->drive_kind
== SCSI_HD
) {
387 outbuf
[buflen
++] = 0xb0; // block limits
388 outbuf
[buflen
++] = 0xb2; // thin provisioning
390 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
393 case 0x80: /* Device serial number, optional */
395 int l
= strlen(s
->serial
);
397 if (l
> req
->cmd
.xfer
)
402 DPRINTF("Inquiry EVPD[Serial number] "
403 "buffer size %zd\n", req
->cmd
.xfer
);
404 outbuf
[buflen
++] = l
;
405 memcpy(outbuf
+buflen
, s
->serial
, l
);
410 case 0x83: /* Device identification page, mandatory */
412 int max_len
= 255 - 8;
413 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
415 if (id_len
> max_len
)
417 DPRINTF("Inquiry EVPD[Device identification] "
418 "buffer size %zd\n", req
->cmd
.xfer
);
420 outbuf
[buflen
++] = 4 + id_len
;
421 outbuf
[buflen
++] = 0x2; // ASCII
422 outbuf
[buflen
++] = 0; // not officially assigned
423 outbuf
[buflen
++] = 0; // reserved
424 outbuf
[buflen
++] = id_len
; // length of data following
426 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
430 case 0xb0: /* block limits */
432 unsigned int unmap_sectors
=
433 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
434 unsigned int min_io_size
=
435 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
436 unsigned int opt_io_size
=
437 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
439 if (s
->drive_kind
== SCSI_CD
) {
440 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
444 /* required VPD size with unmap support */
445 outbuf
[3] = buflen
= 0x3c;
447 memset(outbuf
+ 4, 0, buflen
- 4);
449 /* optimal transfer length granularity */
450 outbuf
[6] = (min_io_size
>> 8) & 0xff;
451 outbuf
[7] = min_io_size
& 0xff;
453 /* optimal transfer length */
454 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
455 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
456 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
457 outbuf
[15] = opt_io_size
& 0xff;
459 /* optimal unmap granularity */
460 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
461 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
462 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
463 outbuf
[31] = unmap_sectors
& 0xff;
466 case 0xb2: /* thin provisioning */
468 outbuf
[3] = buflen
= 8;
470 outbuf
[5] = 0x40; /* write same with unmap supported */
476 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
477 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
484 /* Standard INQUIRY data */
485 if (req
->cmd
.buf
[2] != 0) {
486 BADF("Error: Inquiry (STANDARD) page or code "
487 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
492 if (req
->cmd
.xfer
< 5) {
493 BADF("Error: Inquiry (STANDARD) buffer size %zd "
494 "is less than 5\n", req
->cmd
.xfer
);
498 buflen
= req
->cmd
.xfer
;
499 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
500 buflen
= SCSI_MAX_INQUIRY_LEN
;
502 memset(outbuf
, 0, buflen
);
504 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
505 outbuf
[0] = 0x7f; /* LUN not supported */
509 if (s
->drive_kind
== SCSI_CD
) {
512 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
515 outbuf
[1] = s
->removable
? 0x80 : 0;
516 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
518 memcpy(&outbuf
[8], "QEMU ", 8);
519 memset(&outbuf
[32], 0, 4);
520 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
522 * We claim conformance to SPC-3, which is required for guests
523 * to ask for modern features like READ CAPACITY(16) or the
524 * block characteristics VPD page by default. Not all of SPC-3
525 * is actually implemented, but we're good enough.
528 outbuf
[3] = 2; /* Format 2 */
531 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
533 /* If the allocation length of CDB is too small,
534 the additional length is not adjusted */
538 /* Sync data transfer and TCQ. */
539 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
543 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
,
546 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
547 BlockDriverState
*bdrv
= s
->bs
;
548 int cylinders
, heads
, secs
;
551 * If Changeable Values are requested, a mask denoting those mode parameters
552 * that are changeable shall be returned. As we currently don't support
553 * parameter changes via MODE_SELECT all bits are returned set to zero.
554 * The buffer was already menset to zero by the caller of this function.
557 case 4: /* Rigid disk device geometry page. */
560 if (page_control
== 1) { /* Changeable Values */
563 /* if a geometry hint is available, use it */
564 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
565 p
[2] = (cylinders
>> 16) & 0xff;
566 p
[3] = (cylinders
>> 8) & 0xff;
567 p
[4] = cylinders
& 0xff;
569 /* Write precomp start cylinder, disabled */
570 p
[6] = (cylinders
>> 16) & 0xff;
571 p
[7] = (cylinders
>> 8) & 0xff;
572 p
[8] = cylinders
& 0xff;
573 /* Reduced current start cylinder, disabled */
574 p
[9] = (cylinders
>> 16) & 0xff;
575 p
[10] = (cylinders
>> 8) & 0xff;
576 p
[11] = cylinders
& 0xff;
577 /* Device step rate [ns], 200ns */
580 /* Landing zone cylinder */
584 /* Medium rotation rate [rpm], 5400 rpm */
585 p
[20] = (5400 >> 8) & 0xff;
589 case 5: /* Flexible disk device geometry page. */
592 if (page_control
== 1) { /* Changeable Values */
595 /* Transfer rate [kbit/s], 5Mbit/s */
598 /* if a geometry hint is available, use it */
599 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
602 p
[6] = s
->cluster_size
* 2;
603 p
[8] = (cylinders
>> 8) & 0xff;
604 p
[9] = cylinders
& 0xff;
605 /* Write precomp start cylinder, disabled */
606 p
[10] = (cylinders
>> 8) & 0xff;
607 p
[11] = cylinders
& 0xff;
608 /* Reduced current start cylinder, disabled */
609 p
[12] = (cylinders
>> 8) & 0xff;
610 p
[13] = cylinders
& 0xff;
611 /* Device step rate [100us], 100us */
614 /* Device step pulse width [us], 1us */
616 /* Device head settle delay [100us], 100us */
619 /* Motor on delay [0.1s], 0.1s */
621 /* Motor off delay [0.1s], 0.1s */
623 /* Medium rotation rate [rpm], 5400 rpm */
624 p
[28] = (5400 >> 8) & 0xff;
628 case 8: /* Caching page. */
631 if (page_control
== 1) { /* Changeable Values */
634 if (bdrv_enable_write_cache(s
->bs
)) {
639 case 0x2a: /* CD Capabilities and Mechanical Status page. */
640 if (s
->drive_kind
!= SCSI_CD
)
644 if (page_control
== 1) { /* Changeable Values */
647 p
[2] = 3; // CD-R & CD-RW read
648 p
[3] = 0; // Writing not supported
649 p
[4] = 0x7f; /* Audio, composite, digital out,
650 mode 2 form 1&2, multi session */
651 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
652 RW corrected, C2 errors, ISRC,
654 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
655 /* Locking supported, jumper present, eject, tray */
656 p
[7] = 0; /* no volume & mute control, no
658 p
[8] = (50 * 176) >> 8; // 50x read speed
659 p
[9] = (50 * 176) & 0xff;
660 p
[10] = 0 >> 8; // No volume
662 p
[12] = 2048 >> 8; // 2M buffer
664 p
[14] = (16 * 176) >> 8; // 16x read speed current
665 p
[15] = (16 * 176) & 0xff;
666 p
[18] = (16 * 176) >> 8; // 16x write speed
667 p
[19] = (16 * 176) & 0xff;
668 p
[20] = (16 * 176) >> 8; // 16x write speed current
669 p
[21] = (16 * 176) & 0xff;
677 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
679 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
681 int page
, dbd
, buflen
, page_control
;
683 uint8_t dev_specific_param
;
685 dbd
= req
->cmd
.buf
[1] & 0x8;
686 page
= req
->cmd
.buf
[2] & 0x3f;
687 page_control
= (req
->cmd
.buf
[2] & 0xc0) >> 6;
688 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
689 (req
->cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, req
->cmd
.xfer
, page_control
);
690 memset(outbuf
, 0, req
->cmd
.xfer
);
693 if (bdrv_is_read_only(s
->bs
)) {
694 dev_specific_param
= 0x80; /* Readonly. */
696 dev_specific_param
= 0x00;
699 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
700 p
[1] = 0; /* Default media type. */
701 p
[2] = dev_specific_param
;
702 p
[3] = 0; /* Block descriptor length. */
704 } else { /* MODE_SENSE_10 */
705 p
[2] = 0; /* Default media type. */
706 p
[3] = dev_specific_param
;
707 p
[6] = p
[7] = 0; /* Block descriptor length. */
711 bdrv_get_geometry(s
->bs
, &nb_sectors
);
712 if (!dbd
&& nb_sectors
) {
713 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
714 outbuf
[3] = 8; /* Block descriptor length */
715 } else { /* MODE_SENSE_10 */
716 outbuf
[7] = 8; /* Block descriptor length */
718 nb_sectors
/= s
->cluster_size
;
719 if (nb_sectors
> 0xffffff)
721 p
[0] = 0; /* media density code */
722 p
[1] = (nb_sectors
>> 16) & 0xff;
723 p
[2] = (nb_sectors
>> 8) & 0xff;
724 p
[3] = nb_sectors
& 0xff;
725 p
[4] = 0; /* reserved */
726 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
727 p
[6] = s
->cluster_size
* 2;
732 if (page_control
== 3) { /* Saved Values */
733 return -1; /* ILLEGAL_REQUEST */
741 p
+= mode_sense_page(req
, page
, p
, page_control
);
744 p
+= mode_sense_page(req
, 0x08, p
, page_control
);
745 p
+= mode_sense_page(req
, 0x2a, p
, page_control
);
748 return -1; /* ILLEGAL_REQUEST */
753 * The mode data length field specifies the length in bytes of the
754 * following data that is available to be transferred. The mode data
755 * length does not include itself.
757 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
758 outbuf
[0] = buflen
- 1;
759 } else { /* MODE_SENSE_10 */
760 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
761 outbuf
[1] = (buflen
- 2) & 0xff;
763 if (buflen
> req
->cmd
.xfer
)
764 buflen
= req
->cmd
.xfer
;
768 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
770 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
771 int start_track
, format
, msf
, toclen
;
774 msf
= req
->cmd
.buf
[1] & 2;
775 format
= req
->cmd
.buf
[2] & 0xf;
776 start_track
= req
->cmd
.buf
[6];
777 bdrv_get_geometry(s
->bs
, &nb_sectors
);
778 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
779 nb_sectors
/= s
->cluster_size
;
782 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
785 /* multi session : only a single session defined */
787 memset(outbuf
, 0, 12);
793 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
798 if (toclen
> req
->cmd
.xfer
)
799 toclen
= req
->cmd
.xfer
;
803 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
805 SCSIRequest
*req
= &r
->req
;
806 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
811 switch (req
->cmd
.buf
[0]) {
812 case TEST_UNIT_READY
:
813 if (!bdrv_is_inserted(s
->bs
))
817 if (req
->cmd
.xfer
< 4)
818 goto illegal_request
;
819 memset(outbuf
, 0, 4);
821 if (s
->sense
.key
== NOT_READY
&& req
->cmd
.xfer
>= 18) {
822 memset(outbuf
, 0, 18);
825 /* asc 0x3a, ascq 0: Medium not present */
831 outbuf
[2] = s
->sense
.key
;
832 scsi_disk_clear_sense(s
);
835 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
837 goto illegal_request
;
841 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
843 goto illegal_request
;
846 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
848 goto illegal_request
;
851 if (req
->cmd
.buf
[1] & 1)
852 goto illegal_request
;
855 if (req
->cmd
.buf
[1] & 3)
856 goto illegal_request
;
859 if (req
->cmd
.buf
[1] & 1)
860 goto illegal_request
;
863 if (req
->cmd
.buf
[1] & 3)
864 goto illegal_request
;
867 if (s
->drive_kind
== SCSI_CD
&& (req
->cmd
.buf
[4] & 2)) {
868 /* load/eject medium */
869 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
872 case ALLOW_MEDIUM_REMOVAL
:
873 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
876 /* The normal LEN field for this command is zero. */
877 memset(outbuf
, 0, 8);
878 bdrv_get_geometry(s
->bs
, &nb_sectors
);
881 nb_sectors
/= s
->cluster_size
;
882 /* Returned value is the address of the last sector. */
884 /* Remember the new size for read/write sanity checking. */
885 s
->max_lba
= nb_sectors
;
886 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
887 if (nb_sectors
> UINT32_MAX
)
888 nb_sectors
= UINT32_MAX
;
889 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
890 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
891 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
892 outbuf
[3] = nb_sectors
& 0xff;
895 outbuf
[6] = s
->cluster_size
* 2;
899 case SYNCHRONIZE_CACHE
:
900 ret
= bdrv_flush(s
->bs
);
902 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
907 case GET_CONFIGURATION
:
908 memset(outbuf
, 0, 8);
909 /* ??? This should probably return much more information. For now
910 just return the basic header indicating the CD-ROM profile. */
911 outbuf
[7] = 8; // CD-ROM
914 case SERVICE_ACTION_IN
:
915 /* Service Action In subcommands. */
916 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
917 DPRINTF("SAI READ CAPACITY(16)\n");
918 memset(outbuf
, 0, req
->cmd
.xfer
);
919 bdrv_get_geometry(s
->bs
, &nb_sectors
);
922 nb_sectors
/= s
->cluster_size
;
923 /* Returned value is the address of the last sector. */
925 /* Remember the new size for read/write sanity checking. */
926 s
->max_lba
= nb_sectors
;
927 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
928 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
929 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
930 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
931 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
932 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
933 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
934 outbuf
[7] = nb_sectors
& 0xff;
937 outbuf
[10] = s
->cluster_size
* 2;
940 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
942 /* set TPE bit if the format supports discard */
943 if (s
->qdev
.conf
.discard_granularity
) {
947 /* Protection, exponent and lowest lba field left blank. */
948 buflen
= req
->cmd
.xfer
;
951 DPRINTF("Unsupported Service Action In\n");
952 goto illegal_request
;
954 if (req
->cmd
.xfer
< 16)
955 goto illegal_request
;
956 memset(outbuf
, 0, 16);
963 DPRINTF("Rezero Unit\n");
964 if (!bdrv_is_inserted(s
->bs
)) {
969 goto illegal_request
;
971 scsi_req_set_status(r
, GOOD
, NO_SENSE
);
975 scsi_command_complete(r
, CHECK_CONDITION
, NOT_READY
);
979 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
983 /* Execute a scsi command. Returns the length of the data expected by the
984 command. This will be Positive for data transfers from the device
985 (eg. disk reads), negative for transfers to the device (eg. disk writes),
986 and zero if the command does not transfer any data. */
988 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
990 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
991 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
998 scsi_req_enqueue(req
);
1000 outbuf
= (uint8_t *)r
->iov
.iov_base
;
1002 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
1004 if (scsi_req_parse(&r
->req
, buf
) != 0) {
1005 BADF("Unsupported command length, command %x\n", command
);
1011 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
1012 printf(" 0x%02x", buf
[i
]);
1018 if (req
->lun
|| buf
[1] >> 5) {
1019 /* Only LUN 0 supported. */
1020 DPRINTF("Unimplemented LUN %d\n", req
->lun
? req
->lun
: buf
[1] >> 5);
1021 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
)
1025 case TEST_UNIT_READY
:
1035 case ALLOW_MEDIUM_REMOVAL
:
1037 case SYNCHRONIZE_CACHE
:
1039 case GET_CONFIGURATION
:
1040 case SERVICE_ACTION_IN
:
1044 rc
= scsi_disk_emulate_command(r
, outbuf
);
1049 r
->iov
.iov_len
= rc
;
1055 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1056 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1057 if (r
->req
.cmd
.lba
> s
->max_lba
)
1059 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1060 r
->sector_count
= len
* s
->cluster_size
;
1067 case WRITE_VERIFY_12
:
1068 case WRITE_VERIFY_16
:
1069 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1070 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1071 (command
& 0xe) == 0xe ? "And Verify " : "",
1072 r
->req
.cmd
.lba
, len
);
1073 if (r
->req
.cmd
.lba
> s
->max_lba
)
1075 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1076 r
->sector_count
= len
* s
->cluster_size
;
1080 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1081 /* We don't support mode parameter changes.
1082 Allow the mode parameter header + block descriptors only. */
1083 if (r
->req
.cmd
.xfer
> 12) {
1087 case MODE_SELECT_10
:
1088 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1089 /* We don't support mode parameter changes.
1090 Allow the mode parameter header + block descriptors only. */
1091 if (r
->req
.cmd
.xfer
> 16) {
1097 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1099 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1104 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1106 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1107 r
->req
.cmd
.lba
, len
);
1109 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1114 * We only support WRITE SAME with the unmap bit set for now.
1116 if (!(buf
[1] & 0x8)) {
1120 rc
= bdrv_discard(s
->bs
, r
->req
.cmd
.lba
* s
->cluster_size
,
1121 len
* s
->cluster_size
);
1123 /* XXX: better error code ?*/
1129 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1131 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
1134 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
1137 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1138 scsi_command_complete(r
, GOOD
, NO_SENSE
);
1140 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1144 if (!r
->sector_count
)
1145 r
->sector_count
= -1;
1150 static void scsi_disk_reset(DeviceState
*dev
)
1152 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1153 uint64_t nb_sectors
;
1155 scsi_device_purge_requests(&s
->qdev
);
1157 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1158 nb_sectors
/= s
->cluster_size
;
1162 s
->max_lba
= nb_sectors
;
1165 static void scsi_destroy(SCSIDevice
*dev
)
1167 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1169 scsi_device_purge_requests(&s
->qdev
);
1170 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1173 static int scsi_initfn(SCSIDevice
*dev
, SCSIDriveKind kind
)
1175 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1178 if (!s
->qdev
.conf
.bs
) {
1179 error_report("scsi-disk: drive property not set");
1182 s
->bs
= s
->qdev
.conf
.bs
;
1183 s
->drive_kind
= kind
;
1185 if (kind
== SCSI_HD
&& !bdrv_is_inserted(s
->bs
)) {
1186 error_report("Device needs media, but drive is empty");
1191 /* try to fall back to value set with legacy -drive serial=... */
1192 dinfo
= drive_get_by_blockdev(s
->bs
);
1193 s
->serial
= qemu_strdup(*dinfo
->serial
? dinfo
->serial
: "0");
1197 s
->version
= qemu_strdup(QEMU_VERSION
);
1200 if (bdrv_is_sg(s
->bs
)) {
1201 error_report("scsi-disk: unwanted /dev/sg*");
1205 if (kind
== SCSI_CD
) {
1206 s
->qdev
.blocksize
= 2048;
1208 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1210 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1211 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1213 s
->qdev
.type
= TYPE_DISK
;
1214 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1215 bdrv_set_removable(s
->bs
, kind
== SCSI_CD
);
1216 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1220 static int scsi_hd_initfn(SCSIDevice
*dev
)
1222 return scsi_initfn(dev
, SCSI_HD
);
1225 static int scsi_cd_initfn(SCSIDevice
*dev
)
1227 return scsi_initfn(dev
, SCSI_CD
);
1230 static int scsi_disk_initfn(SCSIDevice
*dev
)
1235 if (!dev
->conf
.bs
) {
1236 kind
= SCSI_HD
; /* will die in scsi_initfn() */
1238 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1239 kind
= dinfo
->media_cd
? SCSI_CD
: SCSI_HD
;
1242 return scsi_initfn(dev
, kind
);
1245 #define DEFINE_SCSI_DISK_PROPERTIES() \
1246 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1247 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1248 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1250 static SCSIDeviceInfo scsi_disk_info
[] = {
1252 .qdev
.name
= "scsi-hd",
1253 .qdev
.fw_name
= "disk",
1254 .qdev
.desc
= "virtual SCSI disk",
1255 .qdev
.size
= sizeof(SCSIDiskState
),
1256 .qdev
.reset
= scsi_disk_reset
,
1257 .init
= scsi_hd_initfn
,
1258 .destroy
= scsi_destroy
,
1259 .alloc_req
= scsi_new_request
,
1260 .free_req
= scsi_free_request
,
1261 .send_command
= scsi_send_command
,
1262 .read_data
= scsi_read_data
,
1263 .write_data
= scsi_write_data
,
1264 .cancel_io
= scsi_cancel_io
,
1265 .get_buf
= scsi_get_buf
,
1266 .qdev
.props
= (Property
[]) {
1267 DEFINE_SCSI_DISK_PROPERTIES(),
1268 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1269 DEFINE_PROP_END_OF_LIST(),
1272 .qdev
.name
= "scsi-cd",
1273 .qdev
.fw_name
= "disk",
1274 .qdev
.desc
= "virtual SCSI CD-ROM",
1275 .qdev
.size
= sizeof(SCSIDiskState
),
1276 .qdev
.reset
= scsi_disk_reset
,
1277 .init
= scsi_cd_initfn
,
1278 .destroy
= scsi_destroy
,
1279 .alloc_req
= scsi_new_request
,
1280 .free_req
= scsi_free_request
,
1281 .send_command
= scsi_send_command
,
1282 .read_data
= scsi_read_data
,
1283 .write_data
= scsi_write_data
,
1284 .cancel_io
= scsi_cancel_io
,
1285 .get_buf
= scsi_get_buf
,
1286 .qdev
.props
= (Property
[]) {
1287 DEFINE_SCSI_DISK_PROPERTIES(),
1288 DEFINE_PROP_END_OF_LIST(),
1291 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1292 .qdev
.fw_name
= "disk",
1293 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1294 .qdev
.size
= sizeof(SCSIDiskState
),
1295 .qdev
.reset
= scsi_disk_reset
,
1296 .init
= scsi_disk_initfn
,
1297 .destroy
= scsi_destroy
,
1298 .alloc_req
= scsi_new_request
,
1299 .free_req
= scsi_free_request
,
1300 .send_command
= scsi_send_command
,
1301 .read_data
= scsi_read_data
,
1302 .write_data
= scsi_write_data
,
1303 .cancel_io
= scsi_cancel_io
,
1304 .get_buf
= scsi_get_buf
,
1305 .qdev
.props
= (Property
[]) {
1306 DEFINE_SCSI_DISK_PROPERTIES(),
1307 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1308 DEFINE_PROP_END_OF_LIST(),
1313 static void scsi_disk_register_devices(void)
1317 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1318 scsi_qdev_register(&scsi_disk_info
[i
]);
1321 device_init(scsi_disk_register_devices
)