2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
38 #include "scsi-defs.h"
40 #define SCSI_DMA_BUF_SIZE 131072
41 #define SCSI_MAX_INQUIRY_LEN 256
43 #define SCSI_REQ_STATUS_RETRY 0x01
45 typedef struct SCSIDiskState SCSIDiskState
;
47 typedef struct SCSIDiskReq
{
49 /* ??? We should probably keep track of whether the data transfer is
50 a read or a write. Currently we rely on the host getting it right. */
51 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
53 uint32_t sector_count
;
63 /* The qemu block layer uses a fixed 512 byte sector size.
64 This is the number of 512 byte blocks in a single scsi sector. */
71 static SCSIDiskReq
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
)
76 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), d
, tag
, lun
);
77 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
78 r
->iov
.iov_base
= qemu_memalign(512, SCSI_DMA_BUF_SIZE
);
82 static void scsi_remove_request(SCSIDiskReq
*r
)
84 qemu_vfree(r
->iov
.iov_base
);
85 scsi_req_free(&r
->req
);
88 static SCSIDiskReq
*scsi_find_request(SCSIDiskState
*s
, uint32_t tag
)
90 return DO_UPCAST(SCSIDiskReq
, req
, scsi_req_find(&s
->qdev
, tag
));
93 static void scsi_req_set_status(SCSIRequest
*req
, int status
, int sense_code
)
96 scsi_dev_set_sense(req
->dev
, sense_code
);
99 /* Helper function for command completion. */
100 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, int sense
)
102 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
103 r
->req
.tag
, status
, sense
);
104 scsi_req_set_status(&r
->req
, status
, sense
);
105 scsi_req_complete(&r
->req
);
106 scsi_remove_request(r
);
109 /* Cancel a pending data transfer. */
110 static void scsi_cancel_io(SCSIDevice
*d
, uint32_t tag
)
112 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
114 DPRINTF("Cancel tag=0x%x\n", tag
);
115 r
= scsi_find_request(s
, tag
);
118 bdrv_aio_cancel(r
->req
.aiocb
);
120 scsi_remove_request(r
);
124 static void scsi_read_complete(void * opaque
, int ret
)
126 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
129 DPRINTF("IO error\n");
130 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, 0);
131 scsi_command_complete(r
, CHECK_CONDITION
, NO_SENSE
);
134 DPRINTF("Data ready tag=0x%x len=%" PRId64
"\n", r
->req
.tag
, r
->iov
.iov_len
);
136 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
139 /* Read more data from scsi device into buffer. */
140 static void scsi_read_data(SCSIDevice
*d
, uint32_t tag
)
142 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
146 r
= scsi_find_request(s
, tag
);
148 BADF("Bad read tag 0x%x\n", tag
);
149 /* ??? This is the wrong error. */
150 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
153 if (r
->sector_count
== (uint32_t)-1) {
154 DPRINTF("Read buf_len=%" PRId64
"\n", r
->iov
.iov_len
);
156 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
159 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
160 if (r
->sector_count
== 0) {
161 scsi_command_complete(r
, GOOD
, NO_SENSE
);
166 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
167 n
= SCSI_DMA_BUF_SIZE
/ 512;
169 r
->iov
.iov_len
= n
* 512;
170 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
171 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
172 scsi_read_complete
, r
);
173 if (r
->req
.aiocb
== NULL
)
174 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
176 r
->sector_count
-= n
;
179 static int scsi_handle_write_error(SCSIDiskReq
*r
, int error
)
181 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
182 BlockInterfaceErrorAction action
= drive_get_on_error(s
->bs
, 0);
184 if (action
== BLOCK_ERR_IGNORE
) {
185 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, 0);
189 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
190 || action
== BLOCK_ERR_STOP_ANY
) {
191 r
->status
|= SCSI_REQ_STATUS_RETRY
;
192 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, 0);
195 scsi_command_complete(r
, CHECK_CONDITION
,
197 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, 0);
203 static void scsi_write_complete(void * opaque
, int ret
)
205 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
212 if (scsi_handle_write_error(r
, -ret
))
216 n
= r
->iov
.iov_len
/ 512;
218 r
->sector_count
-= n
;
219 if (r
->sector_count
== 0) {
220 scsi_command_complete(r
, GOOD
, NO_SENSE
);
222 len
= r
->sector_count
* 512;
223 if (len
> SCSI_DMA_BUF_SIZE
) {
224 len
= SCSI_DMA_BUF_SIZE
;
226 r
->iov
.iov_len
= len
;
227 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
228 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, len
);
232 static void scsi_write_request(SCSIDiskReq
*r
)
234 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
237 n
= r
->iov
.iov_len
/ 512;
239 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
240 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
241 scsi_write_complete
, r
);
242 if (r
->req
.aiocb
== NULL
)
243 scsi_command_complete(r
, CHECK_CONDITION
,
246 /* Invoke completion routine to fetch data from host. */
247 scsi_write_complete(r
, 0);
251 /* Write data to a scsi device. Returns nonzero on failure.
252 The transfer may complete asynchronously. */
253 static int scsi_write_data(SCSIDevice
*d
, uint32_t tag
)
255 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
258 DPRINTF("Write data tag=0x%x\n", tag
);
259 r
= scsi_find_request(s
, tag
);
261 BADF("Bad write tag 0x%x\n", tag
);
262 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
267 BADF("Data transfer already in progress\n");
269 scsi_write_request(r
);
274 static void scsi_dma_restart_bh(void *opaque
)
276 SCSIDiskState
*s
= opaque
;
280 qemu_bh_delete(s
->bh
);
283 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
284 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
285 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
286 r
->status
&= ~SCSI_REQ_STATUS_RETRY
;
287 scsi_write_request(r
);
292 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
294 SCSIDiskState
*s
= opaque
;
300 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
301 qemu_bh_schedule(s
->bh
);
305 /* Return a pointer to the data buffer. */
306 static uint8_t *scsi_get_buf(SCSIDevice
*d
, uint32_t tag
)
308 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
311 r
= scsi_find_request(s
, tag
);
313 BADF("Bad buffer tag 0x%x\n", tag
);
316 return (uint8_t *)r
->iov
.iov_base
;
319 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
321 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
324 if (req
->cmd
.buf
[1] & 0x2) {
325 /* Command support data - optional, not implemented */
326 BADF("optional INQUIRY command support request not implemented\n");
330 if (req
->cmd
.buf
[1] & 0x1) {
331 /* Vital product data */
332 uint8_t page_code
= req
->cmd
.buf
[2];
333 if (req
->cmd
.xfer
< 4) {
334 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
335 "less than 4\n", page_code
, req
->cmd
.xfer
);
339 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
340 outbuf
[buflen
++] = 5;
342 outbuf
[buflen
++] = 0;
344 outbuf
[buflen
++] = page_code
; // this page
345 outbuf
[buflen
++] = 0x00;
348 case 0x00: /* Supported page codes, mandatory */
349 DPRINTF("Inquiry EVPD[Supported pages] "
350 "buffer size %zd\n", req
->cmd
.xfer
);
351 outbuf
[buflen
++] = 4; // number of pages
352 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
353 outbuf
[buflen
++] = 0x80; // unit serial number
354 outbuf
[buflen
++] = 0x83; // device identification
355 outbuf
[buflen
++] = 0xb0; // block device characteristics
358 case 0x80: /* Device serial number, optional */
360 const char *serial
= req
->dev
->conf
.dinfo
->serial
?
361 req
->dev
->conf
.dinfo
->serial
: "0";
362 int l
= strlen(serial
);
364 if (l
> req
->cmd
.xfer
)
369 DPRINTF("Inquiry EVPD[Serial number] "
370 "buffer size %zd\n", req
->cmd
.xfer
);
371 outbuf
[buflen
++] = l
;
372 memcpy(outbuf
+buflen
, serial
, l
);
377 case 0x83: /* Device identification page, mandatory */
379 int max_len
= 255 - 8;
380 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
382 if (id_len
> max_len
)
384 DPRINTF("Inquiry EVPD[Device identification] "
385 "buffer size %zd\n", req
->cmd
.xfer
);
387 outbuf
[buflen
++] = 3 + id_len
;
388 outbuf
[buflen
++] = 0x2; // ASCII
389 outbuf
[buflen
++] = 0; // not officially assigned
390 outbuf
[buflen
++] = 0; // reserved
391 outbuf
[buflen
++] = id_len
; // length of data following
393 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
397 case 0xb0: /* block device characteristics */
399 unsigned int min_io_size
= s
->qdev
.conf
.min_io_size
>> 9;
400 unsigned int opt_io_size
= s
->qdev
.conf
.opt_io_size
>> 9;
402 /* required VPD size with unmap support */
403 outbuf
[3] = buflen
= 0x3c;
405 memset(outbuf
+ 4, 0, buflen
- 4);
407 /* optimal transfer length granularity */
408 outbuf
[6] = (min_io_size
>> 8) & 0xff;
409 outbuf
[7] = min_io_size
& 0xff;
411 /* optimal transfer length */
412 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
413 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
414 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
415 outbuf
[15] = opt_io_size
& 0xff;
419 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
420 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
427 /* Standard INQUIRY data */
428 if (req
->cmd
.buf
[2] != 0) {
429 BADF("Error: Inquiry (STANDARD) page or code "
430 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
435 if (req
->cmd
.xfer
< 5) {
436 BADF("Error: Inquiry (STANDARD) buffer size %zd "
437 "is less than 5\n", req
->cmd
.xfer
);
441 buflen
= req
->cmd
.xfer
;
442 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
443 buflen
= SCSI_MAX_INQUIRY_LEN
;
445 memset(outbuf
, 0, buflen
);
447 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
448 outbuf
[0] = 0x7f; /* LUN not supported */
452 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
455 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
458 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
460 memcpy(&outbuf
[8], "QEMU ", 8);
461 memcpy(&outbuf
[32], s
->version
? s
->version
: QEMU_VERSION
, 4);
463 * We claim conformance to SPC-3, which is required for guests
464 * to ask for modern features like READ CAPACITY(16) or the
465 * block characteristics VPD page by default. Not all of SPC-3
466 * is actually implemented, but we're good enough.
469 outbuf
[3] = 2; /* Format 2 */
472 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
474 /* If the allocation length of CDB is too small,
475 the additional length is not adjusted */
479 /* Sync data transfer and TCQ. */
480 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
484 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
)
486 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
487 BlockDriverState
*bdrv
= s
->bs
;
488 int cylinders
, heads
, secs
;
491 case 4: /* Rigid disk device geometry page. */
494 /* if a geometry hint is available, use it */
495 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
496 p
[2] = (cylinders
>> 16) & 0xff;
497 p
[3] = (cylinders
>> 8) & 0xff;
498 p
[4] = cylinders
& 0xff;
500 /* Write precomp start cylinder, disabled */
501 p
[6] = (cylinders
>> 16) & 0xff;
502 p
[7] = (cylinders
>> 8) & 0xff;
503 p
[8] = cylinders
& 0xff;
504 /* Reduced current start cylinder, disabled */
505 p
[9] = (cylinders
>> 16) & 0xff;
506 p
[10] = (cylinders
>> 8) & 0xff;
507 p
[11] = cylinders
& 0xff;
508 /* Device step rate [ns], 200ns */
511 /* Landing zone cylinder */
515 /* Medium rotation rate [rpm], 5400 rpm */
516 p
[20] = (5400 >> 8) & 0xff;
520 case 5: /* Flexible disk device geometry page. */
523 /* Transfer rate [kbit/s], 5Mbit/s */
526 /* if a geometry hint is available, use it */
527 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
530 p
[6] = s
->cluster_size
* 2;
531 p
[8] = (cylinders
>> 8) & 0xff;
532 p
[9] = cylinders
& 0xff;
533 /* Write precomp start cylinder, disabled */
534 p
[10] = (cylinders
>> 8) & 0xff;
535 p
[11] = cylinders
& 0xff;
536 /* Reduced current start cylinder, disabled */
537 p
[12] = (cylinders
>> 8) & 0xff;
538 p
[13] = cylinders
& 0xff;
539 /* Device step rate [100us], 100us */
542 /* Device step pulse width [us], 1us */
544 /* Device head settle delay [100us], 100us */
547 /* Motor on delay [0.1s], 0.1s */
549 /* Motor off delay [0.1s], 0.1s */
551 /* Medium rotation rate [rpm], 5400 rpm */
552 p
[28] = (5400 >> 8) & 0xff;
556 case 8: /* Caching page. */
559 if (bdrv_enable_write_cache(s
->bs
)) {
564 case 0x2a: /* CD Capabilities and Mechanical Status page. */
565 if (bdrv_get_type_hint(bdrv
) != BDRV_TYPE_CDROM
)
569 p
[2] = 3; // CD-R & CD-RW read
570 p
[3] = 0; // Writing not supported
571 p
[4] = 0x7f; /* Audio, composite, digital out,
572 mode 2 form 1&2, multi session */
573 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
574 RW corrected, C2 errors, ISRC,
576 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
577 /* Locking supported, jumper present, eject, tray */
578 p
[7] = 0; /* no volume & mute control, no
580 p
[8] = (50 * 176) >> 8; // 50x read speed
581 p
[9] = (50 * 176) & 0xff;
582 p
[10] = 0 >> 8; // No volume
584 p
[12] = 2048 >> 8; // 2M buffer
586 p
[14] = (16 * 176) >> 8; // 16x read speed current
587 p
[15] = (16 * 176) & 0xff;
588 p
[18] = (16 * 176) >> 8; // 16x write speed
589 p
[19] = (16 * 176) & 0xff;
590 p
[20] = (16 * 176) >> 8; // 16x write speed current
591 p
[21] = (16 * 176) & 0xff;
599 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
601 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
603 int page
, dbd
, buflen
;
606 dbd
= req
->cmd
.buf
[1] & 0x8;
607 page
= req
->cmd
.buf
[2] & 0x3f;
608 DPRINTF("Mode Sense (page %d, len %zd)\n", page
, req
->cmd
.xfer
);
609 memset(outbuf
, 0, req
->cmd
.xfer
);
612 p
[1] = 0; /* Default media type. */
613 p
[3] = 0; /* Block descriptor length. */
614 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
||
615 bdrv_is_read_only(s
->bs
)) {
616 p
[2] = 0x80; /* Readonly. */
620 bdrv_get_geometry(s
->bs
, &nb_sectors
);
621 if ((~dbd
) & nb_sectors
) {
622 outbuf
[3] = 8; /* Block descriptor length */
623 nb_sectors
/= s
->cluster_size
;
625 if (nb_sectors
> 0xffffff)
626 nb_sectors
= 0xffffff;
627 p
[0] = 0; /* media density code */
628 p
[1] = (nb_sectors
>> 16) & 0xff;
629 p
[2] = (nb_sectors
>> 8) & 0xff;
630 p
[3] = nb_sectors
& 0xff;
631 p
[4] = 0; /* reserved */
632 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
633 p
[6] = s
->cluster_size
* 2;
643 p
+= mode_sense_page(req
, page
, p
);
646 p
+= mode_sense_page(req
, 0x08, p
);
647 p
+= mode_sense_page(req
, 0x2a, p
);
652 outbuf
[0] = buflen
- 4;
653 if (buflen
> req
->cmd
.xfer
)
654 buflen
= req
->cmd
.xfer
;
658 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
660 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
661 int start_track
, format
, msf
, toclen
;
664 msf
= req
->cmd
.buf
[1] & 2;
665 format
= req
->cmd
.buf
[2] & 0xf;
666 start_track
= req
->cmd
.buf
[6];
667 bdrv_get_geometry(s
->bs
, &nb_sectors
);
668 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
669 nb_sectors
/= s
->cluster_size
;
672 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
675 /* multi session : only a single session defined */
677 memset(outbuf
, 0, 12);
683 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
688 if (toclen
> req
->cmd
.xfer
)
689 toclen
= req
->cmd
.xfer
;
693 static int scsi_disk_emulate_command(SCSIRequest
*req
, uint8_t *outbuf
)
695 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
699 switch (req
->cmd
.buf
[0]) {
700 case TEST_UNIT_READY
:
701 if (!bdrv_is_inserted(s
->bs
))
705 if (req
->cmd
.xfer
< 4)
706 goto illegal_request
;
707 memset(outbuf
, 0, 4);
709 if (req
->dev
->sense
.key
== NOT_READY
&& req
->cmd
.xfer
>= 18) {
710 memset(outbuf
, 0, 18);
713 /* asc 0x3a, ascq 0: Medium not present */
719 outbuf
[2] = req
->dev
->sense
.key
;
720 scsi_dev_clear_sense(req
->dev
);
723 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
725 goto illegal_request
;
729 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
731 goto illegal_request
;
734 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
736 goto illegal_request
;
739 if (req
->cmd
.buf
[1] & 1)
740 goto illegal_request
;
743 if (req
->cmd
.buf
[1] & 3)
744 goto illegal_request
;
747 if (req
->cmd
.buf
[1] & 1)
748 goto illegal_request
;
751 if (req
->cmd
.buf
[1] & 3)
752 goto illegal_request
;
755 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
&& (req
->cmd
.buf
[4] & 2)) {
756 /* load/eject medium */
757 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
760 case ALLOW_MEDIUM_REMOVAL
:
761 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
764 /* The normal LEN field for this command is zero. */
765 memset(outbuf
, 0, 8);
766 bdrv_get_geometry(s
->bs
, &nb_sectors
);
769 nb_sectors
/= s
->cluster_size
;
770 /* Returned value is the address of the last sector. */
772 /* Remember the new size for read/write sanity checking. */
773 s
->max_lba
= nb_sectors
;
774 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
775 if (nb_sectors
> UINT32_MAX
)
776 nb_sectors
= UINT32_MAX
;
777 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
778 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
779 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
780 outbuf
[3] = nb_sectors
& 0xff;
783 outbuf
[6] = s
->cluster_size
* 2;
787 case SYNCHRONIZE_CACHE
:
790 case GET_CONFIGURATION
:
791 memset(outbuf
, 0, 8);
792 /* ??? This should probably return much more information. For now
793 just return the basic header indicating the CD-ROM profile. */
794 outbuf
[7] = 8; // CD-ROM
797 case SERVICE_ACTION_IN
:
798 /* Service Action In subcommands. */
799 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
800 DPRINTF("SAI READ CAPACITY(16)\n");
801 memset(outbuf
, 0, req
->cmd
.xfer
);
802 bdrv_get_geometry(s
->bs
, &nb_sectors
);
805 nb_sectors
/= s
->cluster_size
;
806 /* Returned value is the address of the last sector. */
808 /* Remember the new size for read/write sanity checking. */
809 s
->max_lba
= nb_sectors
;
810 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
811 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
812 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
813 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
814 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
815 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
816 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
817 outbuf
[7] = nb_sectors
& 0xff;
820 outbuf
[10] = s
->cluster_size
* 2;
823 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
824 /* Protection, exponent and lowest lba field left blank. */
825 buflen
= req
->cmd
.xfer
;
828 DPRINTF("Unsupported Service Action In\n");
829 goto illegal_request
;
831 if (req
->cmd
.xfer
< 16)
832 goto illegal_request
;
833 memset(outbuf
, 0, 16);
840 goto illegal_request
;
842 scsi_req_set_status(req
, GOOD
, NO_SENSE
);
846 scsi_req_set_status(req
, CHECK_CONDITION
, NOT_READY
);
850 scsi_req_set_status(req
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
854 /* Execute a scsi command. Returns the length of the data expected by the
855 command. This will be Positive for data transfers from the device
856 (eg. disk reads), negative for transfers to the device (eg. disk writes),
857 and zero if the command does not transfer any data. */
859 static int32_t scsi_send_command(SCSIDevice
*d
, uint32_t tag
,
860 uint8_t *buf
, int lun
)
862 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
873 r
= scsi_find_request(s
, tag
);
875 BADF("Tag 0x%x already in use\n", tag
);
876 scsi_cancel_io(d
, tag
);
878 /* ??? Tags are not unique for different luns. We only implement a
879 single lun, so this should not matter. */
880 r
= scsi_new_request(d
, tag
, lun
);
881 outbuf
= (uint8_t *)r
->iov
.iov_base
;
883 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
884 switch (command
>> 5) {
886 lba
= (uint64_t) buf
[3] | ((uint64_t) buf
[2] << 8) |
887 (((uint64_t) buf
[1] & 0x1f) << 16);
893 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
894 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
895 len
= buf
[8] | (buf
[7] << 8);
899 lba
= (uint64_t) buf
[9] | ((uint64_t) buf
[8] << 8) |
900 ((uint64_t) buf
[7] << 16) | ((uint64_t) buf
[6] << 24) |
901 ((uint64_t) buf
[5] << 32) | ((uint64_t) buf
[4] << 40) |
902 ((uint64_t) buf
[3] << 48) | ((uint64_t) buf
[2] << 56);
903 len
= buf
[13] | (buf
[12] << 8) | (buf
[11] << 16) | (buf
[10] << 24);
907 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
908 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
909 len
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16) | (buf
[6] << 24);
913 BADF("Unsupported command length, command %x\n", command
);
919 for (i
= 1; i
< cmdlen
; i
++) {
920 printf(" 0x%02x", buf
[i
]);
926 if (scsi_req_parse(&r
->req
, buf
) != 0) {
927 BADF("Unsupported command length, command %x\n", command
);
930 assert(r
->req
.cmd
.len
== cmdlen
);
931 assert(r
->req
.cmd
.lba
== lba
);
933 if (lun
|| buf
[1] >> 5) {
934 /* Only LUN 0 supported. */
935 DPRINTF("Unimplemented LUN %d\n", lun
? lun
: buf
[1] >> 5);
936 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
)
940 case TEST_UNIT_READY
:
950 case ALLOW_MEDIUM_REMOVAL
:
952 case SYNCHRONIZE_CACHE
:
954 case GET_CONFIGURATION
:
955 case SERVICE_ACTION_IN
:
958 rc
= scsi_disk_emulate_command(&r
->req
, outbuf
);
962 scsi_req_complete(&r
->req
);
963 scsi_remove_request(r
);
971 DPRINTF("Read (sector %" PRId64
", count %d)\n", lba
, len
);
972 if (lba
> s
->max_lba
)
974 r
->sector
= lba
* s
->cluster_size
;
975 r
->sector_count
= len
* s
->cluster_size
;
981 DPRINTF("Write (sector %" PRId64
", count %d)\n", lba
, len
);
982 if (lba
> s
->max_lba
)
984 r
->sector
= lba
* s
->cluster_size
;
985 r
->sector_count
= len
* s
->cluster_size
;
989 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
991 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
994 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
997 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
998 scsi_command_complete(r
, GOOD
, NO_SENSE
);
1000 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1004 if (!r
->sector_count
)
1005 r
->sector_count
= -1;
1010 static void scsi_destroy(SCSIDevice
*dev
)
1012 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1015 while (!QTAILQ_EMPTY(&s
->qdev
.requests
)) {
1016 r
= DO_UPCAST(SCSIDiskReq
, req
, QTAILQ_FIRST(&s
->qdev
.requests
));
1017 scsi_remove_request(r
);
1019 drive_uninit(s
->qdev
.conf
.dinfo
);
1022 static int scsi_disk_initfn(SCSIDevice
*dev
)
1024 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1025 uint64_t nb_sectors
;
1027 if (!s
->qdev
.conf
.dinfo
|| !s
->qdev
.conf
.dinfo
->bdrv
) {
1028 qemu_error("scsi-disk: drive property not set\n");
1031 s
->bs
= s
->qdev
.conf
.dinfo
->bdrv
;
1033 if (bdrv_is_sg(s
->bs
)) {
1034 qemu_error("scsi-disk: unwanted /dev/sg*\n");
1038 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
1039 s
->cluster_size
= 4;
1041 s
->cluster_size
= 1;
1043 s
->qdev
.blocksize
= 512 * s
->cluster_size
;
1044 s
->qdev
.type
= TYPE_DISK
;
1045 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1046 nb_sectors
/= s
->cluster_size
;
1049 s
->max_lba
= nb_sectors
;
1050 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1054 static SCSIDeviceInfo scsi_disk_info
= {
1055 .qdev
.name
= "scsi-disk",
1056 .qdev
.desc
= "virtual scsi disk or cdrom",
1057 .qdev
.size
= sizeof(SCSIDiskState
),
1058 .init
= scsi_disk_initfn
,
1059 .destroy
= scsi_destroy
,
1060 .send_command
= scsi_send_command
,
1061 .read_data
= scsi_read_data
,
1062 .write_data
= scsi_write_data
,
1063 .cancel_io
= scsi_cancel_io
,
1064 .get_buf
= scsi_get_buf
,
1065 .qdev
.props
= (Property
[]) {
1066 DEFINE_BLOCK_PROPERTIES(SCSIDiskState
, qdev
.conf
),
1067 DEFINE_PROP_STRING("ver", SCSIDiskState
, version
),
1068 DEFINE_PROP_END_OF_LIST(),
1072 static void scsi_disk_register_devices(void)
1074 scsi_qdev_register(&scsi_disk_info
);
1076 device_init(scsi_disk_register_devices
)