2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
48 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSIDiskReq
{
54 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
56 uint32_t sector_count
;
67 /* The qemu block layer uses a fixed 512 byte sector size.
68 This is the number of 512 byte blocks in a single scsi sector. */
79 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
80 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
);
82 static void scsi_free_request(SCSIRequest
*req
)
84 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
86 qemu_vfree(r
->iov
.iov_base
);
89 /* Helper function for command completion with sense. */
90 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
92 DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
93 r
->req
.tag
, sense
.key
, sense
.asc
, sense
.ascq
);
94 scsi_req_build_sense(&r
->req
, sense
);
95 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
98 /* Cancel a pending data transfer. */
99 static void scsi_cancel_io(SCSIRequest
*req
)
101 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
103 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
105 bdrv_aio_cancel(r
->req
.aiocb
);
110 static void scsi_read_complete(void * opaque
, int ret
)
112 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
113 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
116 if (r
->req
.aiocb
!= NULL
) {
118 bdrv_acct_done(s
->bs
, &r
->acct
);
122 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
127 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
129 n
= r
->iov
.iov_len
/ 512;
131 r
->sector_count
-= n
;
132 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
135 static void scsi_flush_complete(void * opaque
, int ret
)
137 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
138 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
140 if (r
->req
.aiocb
!= NULL
) {
142 bdrv_acct_done(s
->bs
, &r
->acct
);
146 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
151 scsi_req_complete(&r
->req
, GOOD
);
154 /* Read more data from scsi device into buffer. */
155 static void scsi_read_data(SCSIRequest
*req
)
157 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
158 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
161 if (r
->sector_count
== (uint32_t)-1) {
162 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
164 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
167 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
168 if (r
->sector_count
== 0) {
169 /* This also clears the sense buffer for REQUEST SENSE. */
170 scsi_req_complete(&r
->req
, GOOD
);
174 /* No data transfer may already be in progress */
175 assert(r
->req
.aiocb
== NULL
);
177 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
178 DPRINTF("Data transfer direction invalid\n");
179 scsi_read_complete(r
, -EINVAL
);
184 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
185 n
= SCSI_DMA_BUF_SIZE
/ 512;
188 scsi_read_complete(r
, -ENOMEDIUM
);
190 r
->iov
.iov_len
= n
* 512;
191 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
193 bdrv_acct_start(s
->bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_READ
);
194 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
195 scsi_read_complete
, r
);
196 if (r
->req
.aiocb
== NULL
) {
197 scsi_read_complete(r
, -EIO
);
201 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
203 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
204 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
205 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
207 if (action
== BLOCK_ERR_IGNORE
) {
208 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
212 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
213 || action
== BLOCK_ERR_STOP_ANY
) {
215 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
216 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
218 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
219 vm_stop(VMSTOP_DISKFULL
);
223 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
226 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
229 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
232 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
237 static void scsi_write_complete(void * opaque
, int ret
)
239 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
240 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
244 if (r
->req
.aiocb
!= NULL
) {
246 bdrv_acct_done(s
->bs
, &r
->acct
);
250 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
255 n
= r
->iov
.iov_len
/ 512;
257 r
->sector_count
-= n
;
258 if (r
->sector_count
== 0) {
259 scsi_req_complete(&r
->req
, GOOD
);
261 len
= r
->sector_count
* 512;
262 if (len
> SCSI_DMA_BUF_SIZE
) {
263 len
= SCSI_DMA_BUF_SIZE
;
265 r
->iov
.iov_len
= len
;
266 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
267 scsi_req_data(&r
->req
, len
);
271 static void scsi_write_data(SCSIRequest
*req
)
273 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
274 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
277 /* No data transfer may already be in progress */
278 assert(r
->req
.aiocb
== NULL
);
280 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
281 DPRINTF("Data transfer direction invalid\n");
282 scsi_write_complete(r
, -EINVAL
);
286 n
= r
->iov
.iov_len
/ 512;
289 scsi_write_complete(r
, -ENOMEDIUM
);
291 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
293 bdrv_acct_start(s
->bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_WRITE
);
294 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
295 scsi_write_complete
, r
);
296 if (r
->req
.aiocb
== NULL
) {
297 scsi_write_complete(r
, -ENOMEM
);
300 /* Invoke completion routine to fetch data from host. */
301 scsi_write_complete(r
, 0);
305 static void scsi_dma_restart_bh(void *opaque
)
307 SCSIDiskState
*s
= opaque
;
311 qemu_bh_delete(s
->bh
);
314 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
315 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
316 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
317 int status
= r
->status
;
321 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
323 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
324 case SCSI_REQ_STATUS_RETRY_READ
:
325 scsi_read_data(&r
->req
);
327 case SCSI_REQ_STATUS_RETRY_WRITE
:
328 scsi_write_data(&r
->req
);
330 case SCSI_REQ_STATUS_RETRY_FLUSH
:
331 ret
= scsi_disk_emulate_command(r
, r
->iov
.iov_base
);
333 scsi_req_complete(&r
->req
, GOOD
);
340 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
342 SCSIDiskState
*s
= opaque
;
348 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
349 qemu_bh_schedule(s
->bh
);
353 /* Return a pointer to the data buffer. */
354 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
356 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
358 return (uint8_t *)r
->iov
.iov_base
;
361 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
363 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
366 if (req
->cmd
.buf
[1] & 0x2) {
367 /* Command support data - optional, not implemented */
368 BADF("optional INQUIRY command support request not implemented\n");
372 if (req
->cmd
.buf
[1] & 0x1) {
373 /* Vital product data */
374 uint8_t page_code
= req
->cmd
.buf
[2];
375 if (req
->cmd
.xfer
< 4) {
376 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
377 "less than 4\n", page_code
, req
->cmd
.xfer
);
381 if (s
->qdev
.type
== TYPE_ROM
) {
382 outbuf
[buflen
++] = 5;
384 outbuf
[buflen
++] = 0;
386 outbuf
[buflen
++] = page_code
; // this page
387 outbuf
[buflen
++] = 0x00;
390 case 0x00: /* Supported page codes, mandatory */
393 DPRINTF("Inquiry EVPD[Supported pages] "
394 "buffer size %zd\n", req
->cmd
.xfer
);
396 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
398 outbuf
[buflen
++] = 0x80; // unit serial number
399 outbuf
[buflen
++] = 0x83; // device identification
400 if (s
->qdev
.type
== TYPE_DISK
) {
401 outbuf
[buflen
++] = 0xb0; // block limits
402 outbuf
[buflen
++] = 0xb2; // thin provisioning
404 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
407 case 0x80: /* Device serial number, optional */
412 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
416 l
= strlen(s
->serial
);
417 if (l
> req
->cmd
.xfer
)
422 DPRINTF("Inquiry EVPD[Serial number] "
423 "buffer size %zd\n", req
->cmd
.xfer
);
424 outbuf
[buflen
++] = l
;
425 memcpy(outbuf
+buflen
, s
->serial
, l
);
430 case 0x83: /* Device identification page, mandatory */
432 int max_len
= 255 - 8;
433 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
435 if (id_len
> max_len
)
437 DPRINTF("Inquiry EVPD[Device identification] "
438 "buffer size %zd\n", req
->cmd
.xfer
);
440 outbuf
[buflen
++] = 4 + id_len
;
441 outbuf
[buflen
++] = 0x2; // ASCII
442 outbuf
[buflen
++] = 0; // not officially assigned
443 outbuf
[buflen
++] = 0; // reserved
444 outbuf
[buflen
++] = id_len
; // length of data following
446 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
450 case 0xb0: /* block limits */
452 unsigned int unmap_sectors
=
453 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
454 unsigned int min_io_size
=
455 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
456 unsigned int opt_io_size
=
457 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
459 if (s
->qdev
.type
== TYPE_ROM
) {
460 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
464 /* required VPD size with unmap support */
465 outbuf
[3] = buflen
= 0x3c;
467 memset(outbuf
+ 4, 0, buflen
- 4);
469 /* optimal transfer length granularity */
470 outbuf
[6] = (min_io_size
>> 8) & 0xff;
471 outbuf
[7] = min_io_size
& 0xff;
473 /* optimal transfer length */
474 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
475 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
476 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
477 outbuf
[15] = opt_io_size
& 0xff;
479 /* optimal unmap granularity */
480 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
481 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
482 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
483 outbuf
[31] = unmap_sectors
& 0xff;
486 case 0xb2: /* thin provisioning */
488 outbuf
[3] = buflen
= 8;
490 outbuf
[5] = 0x40; /* write same with unmap supported */
496 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
497 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
504 /* Standard INQUIRY data */
505 if (req
->cmd
.buf
[2] != 0) {
506 BADF("Error: Inquiry (STANDARD) page or code "
507 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
512 if (req
->cmd
.xfer
< 5) {
513 BADF("Error: Inquiry (STANDARD) buffer size %zd "
514 "is less than 5\n", req
->cmd
.xfer
);
518 buflen
= req
->cmd
.xfer
;
519 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
520 buflen
= SCSI_MAX_INQUIRY_LEN
;
522 memset(outbuf
, 0, buflen
);
524 outbuf
[0] = s
->qdev
.type
& 0x1f;
525 if (s
->qdev
.type
== TYPE_ROM
) {
527 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
529 outbuf
[1] = s
->removable
? 0x80 : 0;
530 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
532 memcpy(&outbuf
[8], "QEMU ", 8);
533 memset(&outbuf
[32], 0, 4);
534 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
536 * We claim conformance to SPC-3, which is required for guests
537 * to ask for modern features like READ CAPACITY(16) or the
538 * block characteristics VPD page by default. Not all of SPC-3
539 * is actually implemented, but we're good enough.
542 outbuf
[3] = 2; /* Format 2 */
545 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
547 /* If the allocation length of CDB is too small,
548 the additional length is not adjusted */
552 /* Sync data transfer and TCQ. */
553 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
557 static int mode_sense_page(SCSIDiskState
*s
, int page
, uint8_t **p_outbuf
,
560 BlockDriverState
*bdrv
= s
->bs
;
561 int cylinders
, heads
, secs
;
562 uint8_t *p
= *p_outbuf
;
565 * If Changeable Values are requested, a mask denoting those mode parameters
566 * that are changeable shall be returned. As we currently don't support
567 * parameter changes via MODE_SELECT all bits are returned set to zero.
568 * The buffer was already menset to zero by the caller of this function.
571 case 4: /* Rigid disk device geometry page. */
572 if (s
->qdev
.type
== TYPE_ROM
) {
577 if (page_control
== 1) { /* Changeable Values */
580 /* if a geometry hint is available, use it */
581 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
582 p
[2] = (cylinders
>> 16) & 0xff;
583 p
[3] = (cylinders
>> 8) & 0xff;
584 p
[4] = cylinders
& 0xff;
586 /* Write precomp start cylinder, disabled */
587 p
[6] = (cylinders
>> 16) & 0xff;
588 p
[7] = (cylinders
>> 8) & 0xff;
589 p
[8] = cylinders
& 0xff;
590 /* Reduced current start cylinder, disabled */
591 p
[9] = (cylinders
>> 16) & 0xff;
592 p
[10] = (cylinders
>> 8) & 0xff;
593 p
[11] = cylinders
& 0xff;
594 /* Device step rate [ns], 200ns */
597 /* Landing zone cylinder */
601 /* Medium rotation rate [rpm], 5400 rpm */
602 p
[20] = (5400 >> 8) & 0xff;
606 case 5: /* Flexible disk device geometry page. */
607 if (s
->qdev
.type
== TYPE_ROM
) {
612 if (page_control
== 1) { /* Changeable Values */
615 /* Transfer rate [kbit/s], 5Mbit/s */
618 /* if a geometry hint is available, use it */
619 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
622 p
[6] = s
->cluster_size
* 2;
623 p
[8] = (cylinders
>> 8) & 0xff;
624 p
[9] = cylinders
& 0xff;
625 /* Write precomp start cylinder, disabled */
626 p
[10] = (cylinders
>> 8) & 0xff;
627 p
[11] = cylinders
& 0xff;
628 /* Reduced current start cylinder, disabled */
629 p
[12] = (cylinders
>> 8) & 0xff;
630 p
[13] = cylinders
& 0xff;
631 /* Device step rate [100us], 100us */
634 /* Device step pulse width [us], 1us */
636 /* Device head settle delay [100us], 100us */
639 /* Motor on delay [0.1s], 0.1s */
641 /* Motor off delay [0.1s], 0.1s */
643 /* Medium rotation rate [rpm], 5400 rpm */
644 p
[28] = (5400 >> 8) & 0xff;
648 case 8: /* Caching page. */
651 if (page_control
== 1) { /* Changeable Values */
654 if (bdrv_enable_write_cache(s
->bs
)) {
659 case 0x2a: /* CD Capabilities and Mechanical Status page. */
660 if (s
->qdev
.type
!= TYPE_ROM
) {
665 if (page_control
== 1) { /* Changeable Values */
668 p
[2] = 3; // CD-R & CD-RW read
669 p
[3] = 0; // Writing not supported
670 p
[4] = 0x7f; /* Audio, composite, digital out,
671 mode 2 form 1&2, multi session */
672 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
673 RW corrected, C2 errors, ISRC,
675 p
[6] = 0x2d | (s
->tray_locked
? 2 : 0);
676 /* Locking supported, jumper present, eject, tray */
677 p
[7] = 0; /* no volume & mute control, no
679 p
[8] = (50 * 176) >> 8; // 50x read speed
680 p
[9] = (50 * 176) & 0xff;
681 p
[10] = 0 >> 8; // No volume
683 p
[12] = 2048 >> 8; // 2M buffer
685 p
[14] = (16 * 176) >> 8; // 16x read speed current
686 p
[15] = (16 * 176) & 0xff;
687 p
[18] = (16 * 176) >> 8; // 16x write speed
688 p
[19] = (16 * 176) & 0xff;
689 p
[20] = (16 * 176) >> 8; // 16x write speed current
690 p
[21] = (16 * 176) & 0xff;
697 *p_outbuf
+= p
[1] + 2;
701 static int scsi_disk_emulate_mode_sense(SCSIDiskReq
*r
, uint8_t *outbuf
)
703 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
705 int page
, dbd
, buflen
, ret
, page_control
;
707 uint8_t dev_specific_param
;
709 dbd
= r
->req
.cmd
.buf
[1] & 0x8;
710 page
= r
->req
.cmd
.buf
[2] & 0x3f;
711 page_control
= (r
->req
.cmd
.buf
[2] & 0xc0) >> 6;
712 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
713 (r
->req
.cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, r
->req
.cmd
.xfer
, page_control
);
714 memset(outbuf
, 0, r
->req
.cmd
.xfer
);
717 if (bdrv_is_read_only(s
->bs
)) {
718 dev_specific_param
= 0x80; /* Readonly. */
720 dev_specific_param
= 0x00;
723 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
724 p
[1] = 0; /* Default media type. */
725 p
[2] = dev_specific_param
;
726 p
[3] = 0; /* Block descriptor length. */
728 } else { /* MODE_SENSE_10 */
729 p
[2] = 0; /* Default media type. */
730 p
[3] = dev_specific_param
;
731 p
[6] = p
[7] = 0; /* Block descriptor length. */
735 bdrv_get_geometry(s
->bs
, &nb_sectors
);
736 if (!dbd
&& nb_sectors
) {
737 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
738 outbuf
[3] = 8; /* Block descriptor length */
739 } else { /* MODE_SENSE_10 */
740 outbuf
[7] = 8; /* Block descriptor length */
742 nb_sectors
/= s
->cluster_size
;
743 if (nb_sectors
> 0xffffff)
745 p
[0] = 0; /* media density code */
746 p
[1] = (nb_sectors
>> 16) & 0xff;
747 p
[2] = (nb_sectors
>> 8) & 0xff;
748 p
[3] = nb_sectors
& 0xff;
749 p
[4] = 0; /* reserved */
750 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
751 p
[6] = s
->cluster_size
* 2;
756 if (page_control
== 3) {
758 scsi_check_condition(r
, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED
));
763 for (page
= 0; page
<= 0x3e; page
++) {
764 mode_sense_page(s
, page
, &p
, page_control
);
767 ret
= mode_sense_page(s
, page
, &p
, page_control
);
775 * The mode data length field specifies the length in bytes of the
776 * following data that is available to be transferred. The mode data
777 * length does not include itself.
779 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
780 outbuf
[0] = buflen
- 1;
781 } else { /* MODE_SENSE_10 */
782 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
783 outbuf
[1] = (buflen
- 2) & 0xff;
785 if (buflen
> r
->req
.cmd
.xfer
)
786 buflen
= r
->req
.cmd
.xfer
;
790 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
792 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
793 int start_track
, format
, msf
, toclen
;
796 msf
= req
->cmd
.buf
[1] & 2;
797 format
= req
->cmd
.buf
[2] & 0xf;
798 start_track
= req
->cmd
.buf
[6];
799 bdrv_get_geometry(s
->bs
, &nb_sectors
);
800 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
801 nb_sectors
/= s
->cluster_size
;
804 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
807 /* multi session : only a single session defined */
809 memset(outbuf
, 0, 12);
815 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
820 if (toclen
> req
->cmd
.xfer
)
821 toclen
= req
->cmd
.xfer
;
825 static void scsi_disk_emulate_start_stop(SCSIDiskReq
*r
)
827 SCSIRequest
*req
= &r
->req
;
828 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
829 bool start
= req
->cmd
.buf
[4] & 1;
830 bool loej
= req
->cmd
.buf
[4] & 2; /* load on start, eject on !start */
832 if (s
->qdev
.type
== TYPE_ROM
&& loej
) {
833 if (!start
&& s
->tray_locked
) {
836 bdrv_eject(s
->bs
, !start
);
837 s
->tray_open
= !start
;
841 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
843 SCSIRequest
*req
= &r
->req
;
844 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
848 switch (req
->cmd
.buf
[0]) {
849 case TEST_UNIT_READY
:
850 if (s
->tray_open
|| !bdrv_is_inserted(s
->bs
))
854 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
856 goto illegal_request
;
860 buflen
= scsi_disk_emulate_mode_sense(r
, outbuf
);
862 goto illegal_request
;
865 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
867 goto illegal_request
;
870 if (req
->cmd
.buf
[1] & 1)
871 goto illegal_request
;
874 if (req
->cmd
.buf
[1] & 3)
875 goto illegal_request
;
878 if (req
->cmd
.buf
[1] & 1)
879 goto illegal_request
;
882 if (req
->cmd
.buf
[1] & 3)
883 goto illegal_request
;
886 scsi_disk_emulate_start_stop(r
);
888 case ALLOW_MEDIUM_REMOVAL
:
889 s
->tray_locked
= req
->cmd
.buf
[4] & 1;
890 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
892 case READ_CAPACITY_10
:
893 /* The normal LEN field for this command is zero. */
894 memset(outbuf
, 0, 8);
895 bdrv_get_geometry(s
->bs
, &nb_sectors
);
898 nb_sectors
/= s
->cluster_size
;
899 /* Returned value is the address of the last sector. */
901 /* Remember the new size for read/write sanity checking. */
902 s
->max_lba
= nb_sectors
;
903 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
904 if (nb_sectors
> UINT32_MAX
)
905 nb_sectors
= UINT32_MAX
;
906 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
907 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
908 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
909 outbuf
[3] = nb_sectors
& 0xff;
912 outbuf
[6] = s
->cluster_size
* 2;
916 case GET_CONFIGURATION
:
917 memset(outbuf
, 0, 8);
918 /* ??? This should probably return much more information. For now
919 just return the basic header indicating the CD-ROM profile. */
920 outbuf
[7] = 8; // CD-ROM
923 case SERVICE_ACTION_IN_16
:
924 /* Service Action In subcommands. */
925 if ((req
->cmd
.buf
[1] & 31) == SAI_READ_CAPACITY_16
) {
926 DPRINTF("SAI READ CAPACITY(16)\n");
927 memset(outbuf
, 0, req
->cmd
.xfer
);
928 bdrv_get_geometry(s
->bs
, &nb_sectors
);
931 nb_sectors
/= s
->cluster_size
;
932 /* Returned value is the address of the last sector. */
934 /* Remember the new size for read/write sanity checking. */
935 s
->max_lba
= nb_sectors
;
936 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
937 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
938 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
939 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
940 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
941 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
942 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
943 outbuf
[7] = nb_sectors
& 0xff;
946 outbuf
[10] = s
->cluster_size
* 2;
949 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
951 /* set TPE bit if the format supports discard */
952 if (s
->qdev
.conf
.discard_granularity
) {
956 /* Protection, exponent and lowest lba field left blank. */
957 buflen
= req
->cmd
.xfer
;
960 DPRINTF("Unsupported Service Action In\n");
961 goto illegal_request
;
965 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
971 if (s
->tray_open
|| !bdrv_is_inserted(s
->bs
)) {
972 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
974 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
979 if (r
->req
.status
== -1) {
980 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
985 /* Execute a scsi command. Returns the length of the data expected by the
986 command. This will be Positive for data transfers from the device
987 (eg. disk reads), negative for transfers to the device (eg. disk writes),
988 and zero if the command does not transfer any data. */
990 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
992 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
993 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1000 outbuf
= (uint8_t *)r
->iov
.iov_base
;
1001 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req
->lun
, req
->tag
, buf
[0]);
1006 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
1007 printf(" 0x%02x", buf
[i
]);
1014 case TEST_UNIT_READY
:
1023 case ALLOW_MEDIUM_REMOVAL
:
1024 case READ_CAPACITY_10
:
1026 case GET_CONFIGURATION
:
1027 case SERVICE_ACTION_IN_16
:
1029 rc
= scsi_disk_emulate_command(r
, outbuf
);
1034 r
->iov
.iov_len
= rc
;
1036 case SYNCHRONIZE_CACHE
:
1037 bdrv_acct_start(s
->bs
, &r
->acct
, 0, BDRV_ACCT_FLUSH
);
1038 r
->req
.aiocb
= bdrv_aio_flush(s
->bs
, scsi_flush_complete
, r
);
1039 if (r
->req
.aiocb
== NULL
) {
1040 scsi_flush_complete(r
, -EIO
);
1047 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1048 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1049 if (r
->req
.cmd
.lba
> s
->max_lba
)
1051 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1052 r
->sector_count
= len
* s
->cluster_size
;
1058 case WRITE_VERIFY_10
:
1059 case WRITE_VERIFY_12
:
1060 case WRITE_VERIFY_16
:
1061 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1062 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1063 (command
& 0xe) == 0xe ? "And Verify " : "",
1064 r
->req
.cmd
.lba
, len
);
1065 if (r
->req
.cmd
.lba
> s
->max_lba
)
1067 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1068 r
->sector_count
= len
* s
->cluster_size
;
1071 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1072 /* We don't support mode parameter changes.
1073 Allow the mode parameter header + block descriptors only. */
1074 if (r
->req
.cmd
.xfer
> 12) {
1078 case MODE_SELECT_10
:
1079 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1080 /* We don't support mode parameter changes.
1081 Allow the mode parameter header + block descriptors only. */
1082 if (r
->req
.cmd
.xfer
> 16) {
1088 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1090 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1095 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1097 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1098 r
->req
.cmd
.lba
, len
);
1100 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1105 * We only support WRITE SAME with the unmap bit set for now.
1107 if (!(buf
[1] & 0x8)) {
1111 rc
= bdrv_discard(s
->bs
, r
->req
.cmd
.lba
* s
->cluster_size
,
1112 len
* s
->cluster_size
);
1114 /* XXX: better error code ?*/
1122 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1123 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1126 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1129 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1132 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1133 scsi_req_complete(&r
->req
, GOOD
);
1135 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1136 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
1139 if (!r
->sector_count
)
1140 r
->sector_count
= -1;
1145 static void scsi_disk_reset(DeviceState
*dev
)
1147 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1148 uint64_t nb_sectors
;
1150 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(RESET
));
1152 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1153 nb_sectors
/= s
->cluster_size
;
1157 s
->max_lba
= nb_sectors
;
1160 static void scsi_destroy(SCSIDevice
*dev
)
1162 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1164 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(NO_SENSE
));
1165 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1168 static bool scsi_cd_is_medium_locked(void *opaque
)
1170 return ((SCSIDiskState
*)opaque
)->tray_locked
;
1173 static const BlockDevOps scsi_cd_block_ops
= {
1174 .is_medium_locked
= scsi_cd_is_medium_locked
,
1177 static int scsi_initfn(SCSIDevice
*dev
, uint8_t scsi_type
)
1179 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1182 if (!s
->qdev
.conf
.bs
) {
1183 error_report("scsi-disk: drive property not set");
1186 s
->bs
= s
->qdev
.conf
.bs
;
1188 if (scsi_type
== TYPE_DISK
&& !bdrv_is_inserted(s
->bs
)) {
1189 error_report("Device needs media, but drive is empty");
1194 /* try to fall back to value set with legacy -drive serial=... */
1195 dinfo
= drive_get_by_blockdev(s
->bs
);
1196 if (*dinfo
->serial
) {
1197 s
->serial
= g_strdup(dinfo
->serial
);
1202 s
->version
= g_strdup(QEMU_VERSION
);
1205 if (bdrv_is_sg(s
->bs
)) {
1206 error_report("scsi-disk: unwanted /dev/sg*");
1210 if (scsi_type
== TYPE_ROM
) {
1211 bdrv_set_dev_ops(s
->bs
, &scsi_cd_block_ops
, s
);
1212 s
->qdev
.blocksize
= 2048;
1213 } else if (scsi_type
== TYPE_DISK
) {
1214 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1216 error_report("scsi-disk: Unhandled SCSI type %02x", scsi_type
);
1219 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1220 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1222 s
->qdev
.type
= scsi_type
;
1223 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1224 bdrv_set_removable(s
->bs
, scsi_type
== TYPE_ROM
);
1225 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1229 static int scsi_hd_initfn(SCSIDevice
*dev
)
1231 return scsi_initfn(dev
, TYPE_DISK
);
1234 static int scsi_cd_initfn(SCSIDevice
*dev
)
1236 return scsi_initfn(dev
, TYPE_ROM
);
1239 static int scsi_disk_initfn(SCSIDevice
*dev
)
1244 if (!dev
->conf
.bs
) {
1245 scsi_type
= TYPE_DISK
; /* will die in scsi_initfn() */
1247 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1248 scsi_type
= dinfo
->media_cd
? TYPE_ROM
: TYPE_DISK
;
1251 return scsi_initfn(dev
, scsi_type
);
1254 static SCSIReqOps scsi_disk_reqops
= {
1255 .size
= sizeof(SCSIDiskReq
),
1256 .free_req
= scsi_free_request
,
1257 .send_command
= scsi_send_command
,
1258 .read_data
= scsi_read_data
,
1259 .write_data
= scsi_write_data
,
1260 .cancel_io
= scsi_cancel_io
,
1261 .get_buf
= scsi_get_buf
,
1264 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
,
1265 uint32_t lun
, void *hba_private
)
1267 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1271 req
= scsi_req_alloc(&scsi_disk_reqops
, &s
->qdev
, tag
, lun
, hba_private
);
1272 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1273 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
1277 #define DEFINE_SCSI_DISK_PROPERTIES() \
1278 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1279 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1280 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1282 static SCSIDeviceInfo scsi_disk_info
[] = {
1284 .qdev
.name
= "scsi-hd",
1285 .qdev
.fw_name
= "disk",
1286 .qdev
.desc
= "virtual SCSI disk",
1287 .qdev
.size
= sizeof(SCSIDiskState
),
1288 .qdev
.reset
= scsi_disk_reset
,
1289 .init
= scsi_hd_initfn
,
1290 .destroy
= scsi_destroy
,
1291 .alloc_req
= scsi_new_request
,
1292 .qdev
.props
= (Property
[]) {
1293 DEFINE_SCSI_DISK_PROPERTIES(),
1294 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1295 DEFINE_PROP_END_OF_LIST(),
1298 .qdev
.name
= "scsi-cd",
1299 .qdev
.fw_name
= "disk",
1300 .qdev
.desc
= "virtual SCSI CD-ROM",
1301 .qdev
.size
= sizeof(SCSIDiskState
),
1302 .qdev
.reset
= scsi_disk_reset
,
1303 .init
= scsi_cd_initfn
,
1304 .destroy
= scsi_destroy
,
1305 .alloc_req
= scsi_new_request
,
1306 .qdev
.props
= (Property
[]) {
1307 DEFINE_SCSI_DISK_PROPERTIES(),
1308 DEFINE_PROP_END_OF_LIST(),
1311 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1312 .qdev
.fw_name
= "disk",
1313 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1314 .qdev
.size
= sizeof(SCSIDiskState
),
1315 .qdev
.reset
= scsi_disk_reset
,
1316 .init
= scsi_disk_initfn
,
1317 .destroy
= scsi_destroy
,
1318 .alloc_req
= scsi_new_request
,
1319 .qdev
.props
= (Property
[]) {
1320 DEFINE_SCSI_DISK_PROPERTIES(),
1321 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1322 DEFINE_PROP_END_OF_LIST(),
1327 static void scsi_disk_register_devices(void)
1331 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1332 scsi_qdev_register(&scsi_disk_info
[i
]);
1335 device_init(scsi_disk_register_devices
)