2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
48 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSIDiskReq
{
54 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
56 uint32_t sector_count
;
67 /* The qemu block layer uses a fixed 512 byte sector size.
68 This is the number of 512 byte blocks in a single scsi sector. */
78 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
79 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
);
81 static void scsi_free_request(SCSIRequest
*req
)
83 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
85 qemu_vfree(r
->iov
.iov_base
);
88 /* Helper function for command completion with sense. */
89 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
91 DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
92 r
->req
.tag
, sense
.key
, sense
.asc
, sense
.ascq
);
93 scsi_req_build_sense(&r
->req
, sense
);
94 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
97 /* Cancel a pending data transfer. */
98 static void scsi_cancel_io(SCSIRequest
*req
)
100 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
102 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
104 bdrv_aio_cancel(r
->req
.aiocb
);
109 static void scsi_read_complete(void * opaque
, int ret
)
111 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
112 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
115 if (r
->req
.aiocb
!= NULL
) {
117 bdrv_acct_done(s
->bs
, &r
->acct
);
121 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
126 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
128 n
= r
->iov
.iov_len
/ 512;
130 r
->sector_count
-= n
;
131 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
134 static void scsi_flush_complete(void * opaque
, int ret
)
136 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
137 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
139 if (r
->req
.aiocb
!= NULL
) {
141 bdrv_acct_done(s
->bs
, &r
->acct
);
145 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
150 scsi_req_complete(&r
->req
, GOOD
);
153 /* Read more data from scsi device into buffer. */
154 static void scsi_read_data(SCSIRequest
*req
)
156 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
157 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
160 if (r
->sector_count
== (uint32_t)-1) {
161 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
163 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
166 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
167 if (r
->sector_count
== 0) {
168 /* This also clears the sense buffer for REQUEST SENSE. */
169 scsi_req_complete(&r
->req
, GOOD
);
173 /* No data transfer may already be in progress */
174 assert(r
->req
.aiocb
== NULL
);
176 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
177 DPRINTF("Data transfer direction invalid\n");
178 scsi_read_complete(r
, -EINVAL
);
183 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
184 n
= SCSI_DMA_BUF_SIZE
/ 512;
187 scsi_read_complete(r
, -ENOMEDIUM
);
189 r
->iov
.iov_len
= n
* 512;
190 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
192 bdrv_acct_start(s
->bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_READ
);
193 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
194 scsi_read_complete
, r
);
195 if (r
->req
.aiocb
== NULL
) {
196 scsi_read_complete(r
, -EIO
);
200 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
202 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
203 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
204 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
206 if (action
== BLOCK_ERR_IGNORE
) {
207 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
211 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
212 || action
== BLOCK_ERR_STOP_ANY
) {
214 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
215 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
217 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
218 vm_stop(VMSTOP_DISKFULL
);
222 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
225 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
228 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
231 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
236 static void scsi_write_complete(void * opaque
, int ret
)
238 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
239 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
243 if (r
->req
.aiocb
!= NULL
) {
245 bdrv_acct_done(s
->bs
, &r
->acct
);
249 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
254 n
= r
->iov
.iov_len
/ 512;
256 r
->sector_count
-= n
;
257 if (r
->sector_count
== 0) {
258 scsi_req_complete(&r
->req
, GOOD
);
260 len
= r
->sector_count
* 512;
261 if (len
> SCSI_DMA_BUF_SIZE
) {
262 len
= SCSI_DMA_BUF_SIZE
;
264 r
->iov
.iov_len
= len
;
265 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
266 scsi_req_data(&r
->req
, len
);
270 static void scsi_write_data(SCSIRequest
*req
)
272 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
273 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
276 /* No data transfer may already be in progress */
277 assert(r
->req
.aiocb
== NULL
);
279 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
280 DPRINTF("Data transfer direction invalid\n");
281 scsi_write_complete(r
, -EINVAL
);
285 n
= r
->iov
.iov_len
/ 512;
288 scsi_write_complete(r
, -ENOMEDIUM
);
290 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
292 bdrv_acct_start(s
->bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_WRITE
);
293 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
294 scsi_write_complete
, r
);
295 if (r
->req
.aiocb
== NULL
) {
296 scsi_write_complete(r
, -ENOMEM
);
299 /* Invoke completion routine to fetch data from host. */
300 scsi_write_complete(r
, 0);
304 static void scsi_dma_restart_bh(void *opaque
)
306 SCSIDiskState
*s
= opaque
;
310 qemu_bh_delete(s
->bh
);
313 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
314 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
315 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
316 int status
= r
->status
;
320 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
322 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
323 case SCSI_REQ_STATUS_RETRY_READ
:
324 scsi_read_data(&r
->req
);
326 case SCSI_REQ_STATUS_RETRY_WRITE
:
327 scsi_write_data(&r
->req
);
329 case SCSI_REQ_STATUS_RETRY_FLUSH
:
330 ret
= scsi_disk_emulate_command(r
, r
->iov
.iov_base
);
332 scsi_req_complete(&r
->req
, GOOD
);
339 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
341 SCSIDiskState
*s
= opaque
;
347 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
348 qemu_bh_schedule(s
->bh
);
352 /* Return a pointer to the data buffer. */
353 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
355 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
357 return (uint8_t *)r
->iov
.iov_base
;
360 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
362 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
365 if (req
->cmd
.buf
[1] & 0x2) {
366 /* Command support data - optional, not implemented */
367 BADF("optional INQUIRY command support request not implemented\n");
371 if (req
->cmd
.buf
[1] & 0x1) {
372 /* Vital product data */
373 uint8_t page_code
= req
->cmd
.buf
[2];
374 if (req
->cmd
.xfer
< 4) {
375 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
376 "less than 4\n", page_code
, req
->cmd
.xfer
);
380 if (s
->qdev
.type
== TYPE_ROM
) {
381 outbuf
[buflen
++] = 5;
383 outbuf
[buflen
++] = 0;
385 outbuf
[buflen
++] = page_code
; // this page
386 outbuf
[buflen
++] = 0x00;
389 case 0x00: /* Supported page codes, mandatory */
392 DPRINTF("Inquiry EVPD[Supported pages] "
393 "buffer size %zd\n", req
->cmd
.xfer
);
395 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
397 outbuf
[buflen
++] = 0x80; // unit serial number
398 outbuf
[buflen
++] = 0x83; // device identification
399 if (s
->qdev
.type
== TYPE_DISK
) {
400 outbuf
[buflen
++] = 0xb0; // block limits
401 outbuf
[buflen
++] = 0xb2; // thin provisioning
403 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
406 case 0x80: /* Device serial number, optional */
411 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
415 l
= strlen(s
->serial
);
416 if (l
> req
->cmd
.xfer
)
421 DPRINTF("Inquiry EVPD[Serial number] "
422 "buffer size %zd\n", req
->cmd
.xfer
);
423 outbuf
[buflen
++] = l
;
424 memcpy(outbuf
+buflen
, s
->serial
, l
);
429 case 0x83: /* Device identification page, mandatory */
431 int max_len
= 255 - 8;
432 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
434 if (id_len
> max_len
)
436 DPRINTF("Inquiry EVPD[Device identification] "
437 "buffer size %zd\n", req
->cmd
.xfer
);
439 outbuf
[buflen
++] = 4 + id_len
;
440 outbuf
[buflen
++] = 0x2; // ASCII
441 outbuf
[buflen
++] = 0; // not officially assigned
442 outbuf
[buflen
++] = 0; // reserved
443 outbuf
[buflen
++] = id_len
; // length of data following
445 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
449 case 0xb0: /* block limits */
451 unsigned int unmap_sectors
=
452 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
453 unsigned int min_io_size
=
454 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
455 unsigned int opt_io_size
=
456 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
458 if (s
->qdev
.type
== TYPE_ROM
) {
459 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
463 /* required VPD size with unmap support */
464 outbuf
[3] = buflen
= 0x3c;
466 memset(outbuf
+ 4, 0, buflen
- 4);
468 /* optimal transfer length granularity */
469 outbuf
[6] = (min_io_size
>> 8) & 0xff;
470 outbuf
[7] = min_io_size
& 0xff;
472 /* optimal transfer length */
473 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
474 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
475 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
476 outbuf
[15] = opt_io_size
& 0xff;
478 /* optimal unmap granularity */
479 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
480 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
481 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
482 outbuf
[31] = unmap_sectors
& 0xff;
485 case 0xb2: /* thin provisioning */
487 outbuf
[3] = buflen
= 8;
489 outbuf
[5] = 0x40; /* write same with unmap supported */
495 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
496 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
503 /* Standard INQUIRY data */
504 if (req
->cmd
.buf
[2] != 0) {
505 BADF("Error: Inquiry (STANDARD) page or code "
506 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
511 if (req
->cmd
.xfer
< 5) {
512 BADF("Error: Inquiry (STANDARD) buffer size %zd "
513 "is less than 5\n", req
->cmd
.xfer
);
517 buflen
= req
->cmd
.xfer
;
518 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
519 buflen
= SCSI_MAX_INQUIRY_LEN
;
521 memset(outbuf
, 0, buflen
);
523 outbuf
[0] = s
->qdev
.type
& 0x1f;
524 if (s
->qdev
.type
== TYPE_ROM
) {
526 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
528 outbuf
[1] = s
->removable
? 0x80 : 0;
529 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
531 memcpy(&outbuf
[8], "QEMU ", 8);
532 memset(&outbuf
[32], 0, 4);
533 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
535 * We claim conformance to SPC-3, which is required for guests
536 * to ask for modern features like READ CAPACITY(16) or the
537 * block characteristics VPD page by default. Not all of SPC-3
538 * is actually implemented, but we're good enough.
541 outbuf
[3] = 2; /* Format 2 */
544 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
546 /* If the allocation length of CDB is too small,
547 the additional length is not adjusted */
551 /* Sync data transfer and TCQ. */
552 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
556 static int mode_sense_page(SCSIDiskState
*s
, int page
, uint8_t **p_outbuf
,
559 BlockDriverState
*bdrv
= s
->bs
;
560 int cylinders
, heads
, secs
;
561 uint8_t *p
= *p_outbuf
;
564 * If Changeable Values are requested, a mask denoting those mode parameters
565 * that are changeable shall be returned. As we currently don't support
566 * parameter changes via MODE_SELECT all bits are returned set to zero.
567 * The buffer was already menset to zero by the caller of this function.
570 case 4: /* Rigid disk device geometry page. */
571 if (s
->qdev
.type
== TYPE_ROM
) {
576 if (page_control
== 1) { /* Changeable Values */
579 /* if a geometry hint is available, use it */
580 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
581 p
[2] = (cylinders
>> 16) & 0xff;
582 p
[3] = (cylinders
>> 8) & 0xff;
583 p
[4] = cylinders
& 0xff;
585 /* Write precomp start cylinder, disabled */
586 p
[6] = (cylinders
>> 16) & 0xff;
587 p
[7] = (cylinders
>> 8) & 0xff;
588 p
[8] = cylinders
& 0xff;
589 /* Reduced current start cylinder, disabled */
590 p
[9] = (cylinders
>> 16) & 0xff;
591 p
[10] = (cylinders
>> 8) & 0xff;
592 p
[11] = cylinders
& 0xff;
593 /* Device step rate [ns], 200ns */
596 /* Landing zone cylinder */
600 /* Medium rotation rate [rpm], 5400 rpm */
601 p
[20] = (5400 >> 8) & 0xff;
605 case 5: /* Flexible disk device geometry page. */
606 if (s
->qdev
.type
== TYPE_ROM
) {
611 if (page_control
== 1) { /* Changeable Values */
614 /* Transfer rate [kbit/s], 5Mbit/s */
617 /* if a geometry hint is available, use it */
618 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
621 p
[6] = s
->cluster_size
* 2;
622 p
[8] = (cylinders
>> 8) & 0xff;
623 p
[9] = cylinders
& 0xff;
624 /* Write precomp start cylinder, disabled */
625 p
[10] = (cylinders
>> 8) & 0xff;
626 p
[11] = cylinders
& 0xff;
627 /* Reduced current start cylinder, disabled */
628 p
[12] = (cylinders
>> 8) & 0xff;
629 p
[13] = cylinders
& 0xff;
630 /* Device step rate [100us], 100us */
633 /* Device step pulse width [us], 1us */
635 /* Device head settle delay [100us], 100us */
638 /* Motor on delay [0.1s], 0.1s */
640 /* Motor off delay [0.1s], 0.1s */
642 /* Medium rotation rate [rpm], 5400 rpm */
643 p
[28] = (5400 >> 8) & 0xff;
647 case 8: /* Caching page. */
650 if (page_control
== 1) { /* Changeable Values */
653 if (bdrv_enable_write_cache(s
->bs
)) {
658 case 0x2a: /* CD Capabilities and Mechanical Status page. */
659 if (s
->qdev
.type
!= TYPE_ROM
) {
664 if (page_control
== 1) { /* Changeable Values */
667 p
[2] = 3; // CD-R & CD-RW read
668 p
[3] = 0; // Writing not supported
669 p
[4] = 0x7f; /* Audio, composite, digital out,
670 mode 2 form 1&2, multi session */
671 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
672 RW corrected, C2 errors, ISRC,
674 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
675 /* Locking supported, jumper present, eject, tray */
676 p
[7] = 0; /* no volume & mute control, no
678 p
[8] = (50 * 176) >> 8; // 50x read speed
679 p
[9] = (50 * 176) & 0xff;
680 p
[10] = 0 >> 8; // No volume
682 p
[12] = 2048 >> 8; // 2M buffer
684 p
[14] = (16 * 176) >> 8; // 16x read speed current
685 p
[15] = (16 * 176) & 0xff;
686 p
[18] = (16 * 176) >> 8; // 16x write speed
687 p
[19] = (16 * 176) & 0xff;
688 p
[20] = (16 * 176) >> 8; // 16x write speed current
689 p
[21] = (16 * 176) & 0xff;
696 *p_outbuf
+= p
[1] + 2;
700 static int scsi_disk_emulate_mode_sense(SCSIDiskReq
*r
, uint8_t *outbuf
)
702 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
704 int page
, dbd
, buflen
, ret
, page_control
;
706 uint8_t dev_specific_param
;
708 dbd
= r
->req
.cmd
.buf
[1] & 0x8;
709 page
= r
->req
.cmd
.buf
[2] & 0x3f;
710 page_control
= (r
->req
.cmd
.buf
[2] & 0xc0) >> 6;
711 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
712 (r
->req
.cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, r
->req
.cmd
.xfer
, page_control
);
713 memset(outbuf
, 0, r
->req
.cmd
.xfer
);
716 if (bdrv_is_read_only(s
->bs
)) {
717 dev_specific_param
= 0x80; /* Readonly. */
719 dev_specific_param
= 0x00;
722 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
723 p
[1] = 0; /* Default media type. */
724 p
[2] = dev_specific_param
;
725 p
[3] = 0; /* Block descriptor length. */
727 } else { /* MODE_SENSE_10 */
728 p
[2] = 0; /* Default media type. */
729 p
[3] = dev_specific_param
;
730 p
[6] = p
[7] = 0; /* Block descriptor length. */
734 bdrv_get_geometry(s
->bs
, &nb_sectors
);
735 if (!dbd
&& nb_sectors
) {
736 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
737 outbuf
[3] = 8; /* Block descriptor length */
738 } else { /* MODE_SENSE_10 */
739 outbuf
[7] = 8; /* Block descriptor length */
741 nb_sectors
/= s
->cluster_size
;
742 if (nb_sectors
> 0xffffff)
744 p
[0] = 0; /* media density code */
745 p
[1] = (nb_sectors
>> 16) & 0xff;
746 p
[2] = (nb_sectors
>> 8) & 0xff;
747 p
[3] = nb_sectors
& 0xff;
748 p
[4] = 0; /* reserved */
749 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
750 p
[6] = s
->cluster_size
* 2;
755 if (page_control
== 3) {
757 scsi_check_condition(r
, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED
));
762 for (page
= 0; page
<= 0x3e; page
++) {
763 mode_sense_page(s
, page
, &p
, page_control
);
766 ret
= mode_sense_page(s
, page
, &p
, page_control
);
774 * The mode data length field specifies the length in bytes of the
775 * following data that is available to be transferred. The mode data
776 * length does not include itself.
778 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
779 outbuf
[0] = buflen
- 1;
780 } else { /* MODE_SENSE_10 */
781 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
782 outbuf
[1] = (buflen
- 2) & 0xff;
784 if (buflen
> r
->req
.cmd
.xfer
)
785 buflen
= r
->req
.cmd
.xfer
;
789 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
791 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
792 int start_track
, format
, msf
, toclen
;
795 msf
= req
->cmd
.buf
[1] & 2;
796 format
= req
->cmd
.buf
[2] & 0xf;
797 start_track
= req
->cmd
.buf
[6];
798 bdrv_get_geometry(s
->bs
, &nb_sectors
);
799 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
800 nb_sectors
/= s
->cluster_size
;
803 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
806 /* multi session : only a single session defined */
808 memset(outbuf
, 0, 12);
814 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
819 if (toclen
> req
->cmd
.xfer
)
820 toclen
= req
->cmd
.xfer
;
824 static void scsi_disk_emulate_start_stop(SCSIDiskReq
*r
)
826 SCSIRequest
*req
= &r
->req
;
827 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
828 bool start
= req
->cmd
.buf
[4] & 1;
829 bool loej
= req
->cmd
.buf
[4] & 2; /* load on start, eject on !start */
831 if (s
->qdev
.type
== TYPE_ROM
&& loej
) {
832 bdrv_eject(s
->bs
, !start
);
833 s
->tray_open
= !start
;
837 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
839 SCSIRequest
*req
= &r
->req
;
840 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
844 switch (req
->cmd
.buf
[0]) {
845 case TEST_UNIT_READY
:
846 if (s
->tray_open
|| !bdrv_is_inserted(s
->bs
))
850 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
852 goto illegal_request
;
856 buflen
= scsi_disk_emulate_mode_sense(r
, outbuf
);
858 goto illegal_request
;
861 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
863 goto illegal_request
;
866 if (req
->cmd
.buf
[1] & 1)
867 goto illegal_request
;
870 if (req
->cmd
.buf
[1] & 3)
871 goto illegal_request
;
874 if (req
->cmd
.buf
[1] & 1)
875 goto illegal_request
;
878 if (req
->cmd
.buf
[1] & 3)
879 goto illegal_request
;
882 scsi_disk_emulate_start_stop(r
);
884 case ALLOW_MEDIUM_REMOVAL
:
885 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
887 case READ_CAPACITY_10
:
888 /* The normal LEN field for this command is zero. */
889 memset(outbuf
, 0, 8);
890 bdrv_get_geometry(s
->bs
, &nb_sectors
);
893 nb_sectors
/= s
->cluster_size
;
894 /* Returned value is the address of the last sector. */
896 /* Remember the new size for read/write sanity checking. */
897 s
->max_lba
= nb_sectors
;
898 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
899 if (nb_sectors
> UINT32_MAX
)
900 nb_sectors
= UINT32_MAX
;
901 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
902 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
903 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
904 outbuf
[3] = nb_sectors
& 0xff;
907 outbuf
[6] = s
->cluster_size
* 2;
911 case GET_CONFIGURATION
:
912 memset(outbuf
, 0, 8);
913 /* ??? This should probably return much more information. For now
914 just return the basic header indicating the CD-ROM profile. */
915 outbuf
[7] = 8; // CD-ROM
918 case SERVICE_ACTION_IN_16
:
919 /* Service Action In subcommands. */
920 if ((req
->cmd
.buf
[1] & 31) == SAI_READ_CAPACITY_16
) {
921 DPRINTF("SAI READ CAPACITY(16)\n");
922 memset(outbuf
, 0, req
->cmd
.xfer
);
923 bdrv_get_geometry(s
->bs
, &nb_sectors
);
926 nb_sectors
/= s
->cluster_size
;
927 /* Returned value is the address of the last sector. */
929 /* Remember the new size for read/write sanity checking. */
930 s
->max_lba
= nb_sectors
;
931 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
932 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
933 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
934 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
935 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
936 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
937 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
938 outbuf
[7] = nb_sectors
& 0xff;
941 outbuf
[10] = s
->cluster_size
* 2;
944 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
946 /* set TPE bit if the format supports discard */
947 if (s
->qdev
.conf
.discard_granularity
) {
951 /* Protection, exponent and lowest lba field left blank. */
952 buflen
= req
->cmd
.xfer
;
955 DPRINTF("Unsupported Service Action In\n");
956 goto illegal_request
;
960 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
966 if (s
->tray_open
|| !bdrv_is_inserted(s
->bs
)) {
967 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
969 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
974 if (r
->req
.status
== -1) {
975 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
980 /* Execute a scsi command. Returns the length of the data expected by the
981 command. This will be Positive for data transfers from the device
982 (eg. disk reads), negative for transfers to the device (eg. disk writes),
983 and zero if the command does not transfer any data. */
985 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
987 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
988 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
995 outbuf
= (uint8_t *)r
->iov
.iov_base
;
996 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req
->lun
, req
->tag
, buf
[0]);
1001 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
1002 printf(" 0x%02x", buf
[i
]);
1009 case TEST_UNIT_READY
:
1018 case ALLOW_MEDIUM_REMOVAL
:
1019 case READ_CAPACITY_10
:
1021 case GET_CONFIGURATION
:
1022 case SERVICE_ACTION_IN_16
:
1024 rc
= scsi_disk_emulate_command(r
, outbuf
);
1029 r
->iov
.iov_len
= rc
;
1031 case SYNCHRONIZE_CACHE
:
1032 bdrv_acct_start(s
->bs
, &r
->acct
, 0, BDRV_ACCT_FLUSH
);
1033 r
->req
.aiocb
= bdrv_aio_flush(s
->bs
, scsi_flush_complete
, r
);
1034 if (r
->req
.aiocb
== NULL
) {
1035 scsi_flush_complete(r
, -EIO
);
1042 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1043 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1044 if (r
->req
.cmd
.lba
> s
->max_lba
)
1046 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1047 r
->sector_count
= len
* s
->cluster_size
;
1053 case WRITE_VERIFY_10
:
1054 case WRITE_VERIFY_12
:
1055 case WRITE_VERIFY_16
:
1056 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1057 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1058 (command
& 0xe) == 0xe ? "And Verify " : "",
1059 r
->req
.cmd
.lba
, len
);
1060 if (r
->req
.cmd
.lba
> s
->max_lba
)
1062 r
->sector
= r
->req
.cmd
.lba
* s
->cluster_size
;
1063 r
->sector_count
= len
* s
->cluster_size
;
1066 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1067 /* We don't support mode parameter changes.
1068 Allow the mode parameter header + block descriptors only. */
1069 if (r
->req
.cmd
.xfer
> 12) {
1073 case MODE_SELECT_10
:
1074 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1075 /* We don't support mode parameter changes.
1076 Allow the mode parameter header + block descriptors only. */
1077 if (r
->req
.cmd
.xfer
> 16) {
1083 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1085 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1090 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1092 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1093 r
->req
.cmd
.lba
, len
);
1095 if (r
->req
.cmd
.lba
> s
->max_lba
) {
1100 * We only support WRITE SAME with the unmap bit set for now.
1102 if (!(buf
[1] & 0x8)) {
1106 rc
= bdrv_discard(s
->bs
, r
->req
.cmd
.lba
* s
->cluster_size
,
1107 len
* s
->cluster_size
);
1109 /* XXX: better error code ?*/
1117 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1118 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1121 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1124 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1127 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1128 scsi_req_complete(&r
->req
, GOOD
);
1130 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1131 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
1134 if (!r
->sector_count
)
1135 r
->sector_count
= -1;
1140 static void scsi_disk_reset(DeviceState
*dev
)
1142 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1143 uint64_t nb_sectors
;
1145 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(RESET
));
1147 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1148 nb_sectors
/= s
->cluster_size
;
1152 s
->max_lba
= nb_sectors
;
1155 static void scsi_destroy(SCSIDevice
*dev
)
1157 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1159 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(NO_SENSE
));
1160 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1163 static int scsi_initfn(SCSIDevice
*dev
, uint8_t scsi_type
)
1165 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1168 if (!s
->qdev
.conf
.bs
) {
1169 error_report("scsi-disk: drive property not set");
1172 s
->bs
= s
->qdev
.conf
.bs
;
1174 if (scsi_type
== TYPE_DISK
&& !bdrv_is_inserted(s
->bs
)) {
1175 error_report("Device needs media, but drive is empty");
1180 /* try to fall back to value set with legacy -drive serial=... */
1181 dinfo
= drive_get_by_blockdev(s
->bs
);
1182 if (*dinfo
->serial
) {
1183 s
->serial
= g_strdup(dinfo
->serial
);
1188 s
->version
= g_strdup(QEMU_VERSION
);
1191 if (bdrv_is_sg(s
->bs
)) {
1192 error_report("scsi-disk: unwanted /dev/sg*");
1196 if (scsi_type
== TYPE_ROM
) {
1197 s
->qdev
.blocksize
= 2048;
1198 } else if (scsi_type
== TYPE_DISK
) {
1199 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1201 error_report("scsi-disk: Unhandled SCSI type %02x", scsi_type
);
1204 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1205 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1207 s
->qdev
.type
= scsi_type
;
1208 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1209 bdrv_set_removable(s
->bs
, scsi_type
== TYPE_ROM
);
1210 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1214 static int scsi_hd_initfn(SCSIDevice
*dev
)
1216 return scsi_initfn(dev
, TYPE_DISK
);
1219 static int scsi_cd_initfn(SCSIDevice
*dev
)
1221 return scsi_initfn(dev
, TYPE_ROM
);
1224 static int scsi_disk_initfn(SCSIDevice
*dev
)
1229 if (!dev
->conf
.bs
) {
1230 scsi_type
= TYPE_DISK
; /* will die in scsi_initfn() */
1232 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1233 scsi_type
= dinfo
->media_cd
? TYPE_ROM
: TYPE_DISK
;
1236 return scsi_initfn(dev
, scsi_type
);
1239 static SCSIReqOps scsi_disk_reqops
= {
1240 .size
= sizeof(SCSIDiskReq
),
1241 .free_req
= scsi_free_request
,
1242 .send_command
= scsi_send_command
,
1243 .read_data
= scsi_read_data
,
1244 .write_data
= scsi_write_data
,
1245 .cancel_io
= scsi_cancel_io
,
1246 .get_buf
= scsi_get_buf
,
1249 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
,
1250 uint32_t lun
, void *hba_private
)
1252 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1256 req
= scsi_req_alloc(&scsi_disk_reqops
, &s
->qdev
, tag
, lun
, hba_private
);
1257 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1258 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
1262 #define DEFINE_SCSI_DISK_PROPERTIES() \
1263 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1264 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1265 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1267 static SCSIDeviceInfo scsi_disk_info
[] = {
1269 .qdev
.name
= "scsi-hd",
1270 .qdev
.fw_name
= "disk",
1271 .qdev
.desc
= "virtual SCSI disk",
1272 .qdev
.size
= sizeof(SCSIDiskState
),
1273 .qdev
.reset
= scsi_disk_reset
,
1274 .init
= scsi_hd_initfn
,
1275 .destroy
= scsi_destroy
,
1276 .alloc_req
= scsi_new_request
,
1277 .qdev
.props
= (Property
[]) {
1278 DEFINE_SCSI_DISK_PROPERTIES(),
1279 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1280 DEFINE_PROP_END_OF_LIST(),
1283 .qdev
.name
= "scsi-cd",
1284 .qdev
.fw_name
= "disk",
1285 .qdev
.desc
= "virtual SCSI CD-ROM",
1286 .qdev
.size
= sizeof(SCSIDiskState
),
1287 .qdev
.reset
= scsi_disk_reset
,
1288 .init
= scsi_cd_initfn
,
1289 .destroy
= scsi_destroy
,
1290 .alloc_req
= scsi_new_request
,
1291 .qdev
.props
= (Property
[]) {
1292 DEFINE_SCSI_DISK_PROPERTIES(),
1293 DEFINE_PROP_END_OF_LIST(),
1296 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1297 .qdev
.fw_name
= "disk",
1298 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1299 .qdev
.size
= sizeof(SCSIDiskState
),
1300 .qdev
.reset
= scsi_disk_reset
,
1301 .init
= scsi_disk_initfn
,
1302 .destroy
= scsi_destroy
,
1303 .alloc_req
= scsi_new_request
,
1304 .qdev
.props
= (Property
[]) {
1305 DEFINE_SCSI_DISK_PROPERTIES(),
1306 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1307 DEFINE_PROP_END_OF_LIST(),
1312 static void scsi_disk_register_devices(void)
1316 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1317 scsi_qdev_register(&scsi_disk_info
[i
]);
1320 device_init(scsi_disk_register_devices
)