2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
38 #include "scsi-defs.h"
40 #define SCSI_DMA_BUF_SIZE 131072
41 #define SCSI_MAX_INQUIRY_LEN 256
43 #define SCSI_REQ_STATUS_RETRY 0x01
45 typedef struct SCSIDiskState SCSIDiskState
;
47 typedef struct SCSIDiskReq
{
49 /* ??? We should probably keep track of whether the data transfer is
50 a read or a write. Currently we rely on the host getting it right. */
51 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
53 uint32_t sector_count
;
63 /* The qemu block layer uses a fixed 512 byte sector size.
64 This is the number of 512 byte blocks in a single scsi sector. */
71 static SCSIDiskReq
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
)
76 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), d
, tag
, lun
);
77 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
78 r
->iov
.iov_base
= qemu_memalign(512, SCSI_DMA_BUF_SIZE
);
82 static void scsi_remove_request(SCSIDiskReq
*r
)
84 qemu_vfree(r
->iov
.iov_base
);
85 scsi_req_free(&r
->req
);
88 static SCSIDiskReq
*scsi_find_request(SCSIDiskState
*s
, uint32_t tag
)
90 return DO_UPCAST(SCSIDiskReq
, req
, scsi_req_find(&s
->qdev
, tag
));
93 static void scsi_req_set_status(SCSIRequest
*req
, int status
, int sense_code
)
96 scsi_dev_set_sense(req
->dev
, sense_code
);
99 /* Helper function for command completion. */
100 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, int sense
)
102 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
103 r
->req
.tag
, status
, sense
);
104 scsi_req_set_status(&r
->req
, status
, sense
);
105 scsi_req_complete(&r
->req
);
106 scsi_remove_request(r
);
109 /* Cancel a pending data transfer. */
110 static void scsi_cancel_io(SCSIDevice
*d
, uint32_t tag
)
112 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
114 DPRINTF("Cancel tag=0x%x\n", tag
);
115 r
= scsi_find_request(s
, tag
);
118 bdrv_aio_cancel(r
->req
.aiocb
);
120 scsi_remove_request(r
);
124 static void scsi_read_complete(void * opaque
, int ret
)
126 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
129 DPRINTF("IO error\n");
130 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, 0);
131 scsi_command_complete(r
, CHECK_CONDITION
, NO_SENSE
);
134 DPRINTF("Data ready tag=0x%x len=%" PRId64
"\n", r
->req
.tag
, r
->iov
.iov_len
);
136 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
139 /* Read more data from scsi device into buffer. */
140 static void scsi_read_data(SCSIDevice
*d
, uint32_t tag
)
142 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
146 r
= scsi_find_request(s
, tag
);
148 BADF("Bad read tag 0x%x\n", tag
);
149 /* ??? This is the wrong error. */
150 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
153 if (r
->sector_count
== (uint32_t)-1) {
154 DPRINTF("Read buf_len=%" PRId64
"\n", r
->iov
.iov_len
);
156 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
159 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
160 if (r
->sector_count
== 0) {
161 scsi_command_complete(r
, GOOD
, NO_SENSE
);
166 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
167 n
= SCSI_DMA_BUF_SIZE
/ 512;
169 r
->iov
.iov_len
= n
* 512;
170 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
171 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
172 scsi_read_complete
, r
);
173 if (r
->req
.aiocb
== NULL
)
174 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
176 r
->sector_count
-= n
;
179 static int scsi_handle_write_error(SCSIDiskReq
*r
, int error
)
181 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
182 BlockInterfaceErrorAction action
= drive_get_on_error(s
->bs
, 0);
184 if (action
== BLOCK_ERR_IGNORE
) {
185 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, 0);
189 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
190 || action
== BLOCK_ERR_STOP_ANY
) {
191 r
->status
|= SCSI_REQ_STATUS_RETRY
;
192 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, 0);
195 scsi_command_complete(r
, CHECK_CONDITION
,
197 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, 0);
203 static void scsi_write_complete(void * opaque
, int ret
)
205 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
212 if (scsi_handle_write_error(r
, -ret
))
216 n
= r
->iov
.iov_len
/ 512;
218 r
->sector_count
-= n
;
219 if (r
->sector_count
== 0) {
220 scsi_command_complete(r
, GOOD
, NO_SENSE
);
222 len
= r
->sector_count
* 512;
223 if (len
> SCSI_DMA_BUF_SIZE
) {
224 len
= SCSI_DMA_BUF_SIZE
;
226 r
->iov
.iov_len
= len
;
227 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
228 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, len
);
232 static void scsi_write_request(SCSIDiskReq
*r
)
234 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
237 n
= r
->iov
.iov_len
/ 512;
239 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
240 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
241 scsi_write_complete
, r
);
242 if (r
->req
.aiocb
== NULL
)
243 scsi_command_complete(r
, CHECK_CONDITION
,
246 /* Invoke completion routine to fetch data from host. */
247 scsi_write_complete(r
, 0);
251 /* Write data to a scsi device. Returns nonzero on failure.
252 The transfer may complete asynchronously. */
253 static int scsi_write_data(SCSIDevice
*d
, uint32_t tag
)
255 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
258 DPRINTF("Write data tag=0x%x\n", tag
);
259 r
= scsi_find_request(s
, tag
);
261 BADF("Bad write tag 0x%x\n", tag
);
262 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
267 BADF("Data transfer already in progress\n");
269 scsi_write_request(r
);
274 static void scsi_dma_restart_bh(void *opaque
)
276 SCSIDiskState
*s
= opaque
;
280 qemu_bh_delete(s
->bh
);
283 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
284 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
285 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
286 r
->status
&= ~SCSI_REQ_STATUS_RETRY
;
287 scsi_write_request(r
);
292 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
294 SCSIDiskState
*s
= opaque
;
300 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
301 qemu_bh_schedule(s
->bh
);
305 /* Return a pointer to the data buffer. */
306 static uint8_t *scsi_get_buf(SCSIDevice
*d
, uint32_t tag
)
308 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
311 r
= scsi_find_request(s
, tag
);
313 BADF("Bad buffer tag 0x%x\n", tag
);
316 return (uint8_t *)r
->iov
.iov_base
;
319 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
321 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
324 if (req
->cmd
.buf
[1] & 0x2) {
325 /* Command support data - optional, not implemented */
326 BADF("optional INQUIRY command support request not implemented\n");
330 if (req
->cmd
.buf
[1] & 0x1) {
331 /* Vital product data */
332 uint8_t page_code
= req
->cmd
.buf
[2];
333 if (req
->cmd
.xfer
< 4) {
334 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
335 "less than 4\n", page_code
, req
->cmd
.xfer
);
339 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
340 outbuf
[buflen
++] = 5;
342 outbuf
[buflen
++] = 0;
344 outbuf
[buflen
++] = page_code
; // this page
345 outbuf
[buflen
++] = 0x00;
348 case 0x00: /* Supported page codes, mandatory */
349 DPRINTF("Inquiry EVPD[Supported pages] "
350 "buffer size %zd\n", req
->cmd
.xfer
);
351 outbuf
[buflen
++] = 4; // number of pages
352 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
353 outbuf
[buflen
++] = 0x80; // unit serial number
354 outbuf
[buflen
++] = 0x83; // device identification
355 outbuf
[buflen
++] = 0xb0; // block device characteristics
358 case 0x80: /* Device serial number, optional */
360 const char *serial
= req
->dev
->conf
.dinfo
->serial
?
361 req
->dev
->conf
.dinfo
->serial
: "0";
362 int l
= strlen(serial
);
364 if (l
> req
->cmd
.xfer
)
369 DPRINTF("Inquiry EVPD[Serial number] "
370 "buffer size %zd\n", req
->cmd
.xfer
);
371 outbuf
[buflen
++] = l
;
372 memcpy(outbuf
+buflen
, serial
, l
);
377 case 0x83: /* Device identification page, mandatory */
379 int max_len
= 255 - 8;
380 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
382 if (id_len
> max_len
)
384 DPRINTF("Inquiry EVPD[Device identification] "
385 "buffer size %zd\n", req
->cmd
.xfer
);
387 outbuf
[buflen
++] = 3 + id_len
;
388 outbuf
[buflen
++] = 0x2; // ASCII
389 outbuf
[buflen
++] = 0; // not officially assigned
390 outbuf
[buflen
++] = 0; // reserved
391 outbuf
[buflen
++] = id_len
; // length of data following
393 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
397 case 0xb0: /* block device characteristics */
399 unsigned int min_io_size
=
400 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
401 unsigned int opt_io_size
=
402 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
404 /* required VPD size with unmap support */
405 outbuf
[3] = buflen
= 0x3c;
407 memset(outbuf
+ 4, 0, buflen
- 4);
409 /* optimal transfer length granularity */
410 outbuf
[6] = (min_io_size
>> 8) & 0xff;
411 outbuf
[7] = min_io_size
& 0xff;
413 /* optimal transfer length */
414 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
415 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
416 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
417 outbuf
[15] = opt_io_size
& 0xff;
421 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
422 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
429 /* Standard INQUIRY data */
430 if (req
->cmd
.buf
[2] != 0) {
431 BADF("Error: Inquiry (STANDARD) page or code "
432 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
437 if (req
->cmd
.xfer
< 5) {
438 BADF("Error: Inquiry (STANDARD) buffer size %zd "
439 "is less than 5\n", req
->cmd
.xfer
);
443 buflen
= req
->cmd
.xfer
;
444 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
445 buflen
= SCSI_MAX_INQUIRY_LEN
;
447 memset(outbuf
, 0, buflen
);
449 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
450 outbuf
[0] = 0x7f; /* LUN not supported */
454 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
457 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
460 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
462 memcpy(&outbuf
[8], "QEMU ", 8);
463 memcpy(&outbuf
[32], s
->version
? s
->version
: QEMU_VERSION
, 4);
465 * We claim conformance to SPC-3, which is required for guests
466 * to ask for modern features like READ CAPACITY(16) or the
467 * block characteristics VPD page by default. Not all of SPC-3
468 * is actually implemented, but we're good enough.
471 outbuf
[3] = 2; /* Format 2 */
474 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
476 /* If the allocation length of CDB is too small,
477 the additional length is not adjusted */
481 /* Sync data transfer and TCQ. */
482 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
486 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
)
488 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
489 BlockDriverState
*bdrv
= s
->bs
;
490 int cylinders
, heads
, secs
;
493 case 4: /* Rigid disk device geometry page. */
496 /* if a geometry hint is available, use it */
497 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
498 p
[2] = (cylinders
>> 16) & 0xff;
499 p
[3] = (cylinders
>> 8) & 0xff;
500 p
[4] = cylinders
& 0xff;
502 /* Write precomp start cylinder, disabled */
503 p
[6] = (cylinders
>> 16) & 0xff;
504 p
[7] = (cylinders
>> 8) & 0xff;
505 p
[8] = cylinders
& 0xff;
506 /* Reduced current start cylinder, disabled */
507 p
[9] = (cylinders
>> 16) & 0xff;
508 p
[10] = (cylinders
>> 8) & 0xff;
509 p
[11] = cylinders
& 0xff;
510 /* Device step rate [ns], 200ns */
513 /* Landing zone cylinder */
517 /* Medium rotation rate [rpm], 5400 rpm */
518 p
[20] = (5400 >> 8) & 0xff;
522 case 5: /* Flexible disk device geometry page. */
525 /* Transfer rate [kbit/s], 5Mbit/s */
528 /* if a geometry hint is available, use it */
529 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
532 p
[6] = s
->cluster_size
* 2;
533 p
[8] = (cylinders
>> 8) & 0xff;
534 p
[9] = cylinders
& 0xff;
535 /* Write precomp start cylinder, disabled */
536 p
[10] = (cylinders
>> 8) & 0xff;
537 p
[11] = cylinders
& 0xff;
538 /* Reduced current start cylinder, disabled */
539 p
[12] = (cylinders
>> 8) & 0xff;
540 p
[13] = cylinders
& 0xff;
541 /* Device step rate [100us], 100us */
544 /* Device step pulse width [us], 1us */
546 /* Device head settle delay [100us], 100us */
549 /* Motor on delay [0.1s], 0.1s */
551 /* Motor off delay [0.1s], 0.1s */
553 /* Medium rotation rate [rpm], 5400 rpm */
554 p
[28] = (5400 >> 8) & 0xff;
558 case 8: /* Caching page. */
561 if (bdrv_enable_write_cache(s
->bs
)) {
566 case 0x2a: /* CD Capabilities and Mechanical Status page. */
567 if (bdrv_get_type_hint(bdrv
) != BDRV_TYPE_CDROM
)
571 p
[2] = 3; // CD-R & CD-RW read
572 p
[3] = 0; // Writing not supported
573 p
[4] = 0x7f; /* Audio, composite, digital out,
574 mode 2 form 1&2, multi session */
575 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
576 RW corrected, C2 errors, ISRC,
578 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
579 /* Locking supported, jumper present, eject, tray */
580 p
[7] = 0; /* no volume & mute control, no
582 p
[8] = (50 * 176) >> 8; // 50x read speed
583 p
[9] = (50 * 176) & 0xff;
584 p
[10] = 0 >> 8; // No volume
586 p
[12] = 2048 >> 8; // 2M buffer
588 p
[14] = (16 * 176) >> 8; // 16x read speed current
589 p
[15] = (16 * 176) & 0xff;
590 p
[18] = (16 * 176) >> 8; // 16x write speed
591 p
[19] = (16 * 176) & 0xff;
592 p
[20] = (16 * 176) >> 8; // 16x write speed current
593 p
[21] = (16 * 176) & 0xff;
601 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
603 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
605 int page
, dbd
, buflen
;
608 dbd
= req
->cmd
.buf
[1] & 0x8;
609 page
= req
->cmd
.buf
[2] & 0x3f;
610 DPRINTF("Mode Sense (page %d, len %zd)\n", page
, req
->cmd
.xfer
);
611 memset(outbuf
, 0, req
->cmd
.xfer
);
614 p
[1] = 0; /* Default media type. */
615 p
[3] = 0; /* Block descriptor length. */
616 if (bdrv_is_read_only(s
->bs
)) {
617 p
[2] = 0x80; /* Readonly. */
621 bdrv_get_geometry(s
->bs
, &nb_sectors
);
622 if ((~dbd
) & nb_sectors
) {
623 outbuf
[3] = 8; /* Block descriptor length */
624 nb_sectors
/= s
->cluster_size
;
626 if (nb_sectors
> 0xffffff)
627 nb_sectors
= 0xffffff;
628 p
[0] = 0; /* media density code */
629 p
[1] = (nb_sectors
>> 16) & 0xff;
630 p
[2] = (nb_sectors
>> 8) & 0xff;
631 p
[3] = nb_sectors
& 0xff;
632 p
[4] = 0; /* reserved */
633 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
634 p
[6] = s
->cluster_size
* 2;
644 p
+= mode_sense_page(req
, page
, p
);
647 p
+= mode_sense_page(req
, 0x08, p
);
648 p
+= mode_sense_page(req
, 0x2a, p
);
653 outbuf
[0] = buflen
- 4;
654 if (buflen
> req
->cmd
.xfer
)
655 buflen
= req
->cmd
.xfer
;
659 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
661 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
662 int start_track
, format
, msf
, toclen
;
665 msf
= req
->cmd
.buf
[1] & 2;
666 format
= req
->cmd
.buf
[2] & 0xf;
667 start_track
= req
->cmd
.buf
[6];
668 bdrv_get_geometry(s
->bs
, &nb_sectors
);
669 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
670 nb_sectors
/= s
->cluster_size
;
673 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
676 /* multi session : only a single session defined */
678 memset(outbuf
, 0, 12);
684 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
689 if (toclen
> req
->cmd
.xfer
)
690 toclen
= req
->cmd
.xfer
;
694 static int scsi_disk_emulate_command(SCSIRequest
*req
, uint8_t *outbuf
)
696 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
700 switch (req
->cmd
.buf
[0]) {
701 case TEST_UNIT_READY
:
702 if (!bdrv_is_inserted(s
->bs
))
706 if (req
->cmd
.xfer
< 4)
707 goto illegal_request
;
708 memset(outbuf
, 0, 4);
710 if (req
->dev
->sense
.key
== NOT_READY
&& req
->cmd
.xfer
>= 18) {
711 memset(outbuf
, 0, 18);
714 /* asc 0x3a, ascq 0: Medium not present */
720 outbuf
[2] = req
->dev
->sense
.key
;
721 scsi_dev_clear_sense(req
->dev
);
724 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
726 goto illegal_request
;
730 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
732 goto illegal_request
;
735 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
737 goto illegal_request
;
740 if (req
->cmd
.buf
[1] & 1)
741 goto illegal_request
;
744 if (req
->cmd
.buf
[1] & 3)
745 goto illegal_request
;
748 if (req
->cmd
.buf
[1] & 1)
749 goto illegal_request
;
752 if (req
->cmd
.buf
[1] & 3)
753 goto illegal_request
;
756 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
&& (req
->cmd
.buf
[4] & 2)) {
757 /* load/eject medium */
758 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
761 case ALLOW_MEDIUM_REMOVAL
:
762 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
765 /* The normal LEN field for this command is zero. */
766 memset(outbuf
, 0, 8);
767 bdrv_get_geometry(s
->bs
, &nb_sectors
);
770 nb_sectors
/= s
->cluster_size
;
771 /* Returned value is the address of the last sector. */
773 /* Remember the new size for read/write sanity checking. */
774 s
->max_lba
= nb_sectors
;
775 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
776 if (nb_sectors
> UINT32_MAX
)
777 nb_sectors
= UINT32_MAX
;
778 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
779 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
780 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
781 outbuf
[3] = nb_sectors
& 0xff;
784 outbuf
[6] = s
->cluster_size
* 2;
788 case SYNCHRONIZE_CACHE
:
791 case GET_CONFIGURATION
:
792 memset(outbuf
, 0, 8);
793 /* ??? This should probably return much more information. For now
794 just return the basic header indicating the CD-ROM profile. */
795 outbuf
[7] = 8; // CD-ROM
798 case SERVICE_ACTION_IN
:
799 /* Service Action In subcommands. */
800 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
801 DPRINTF("SAI READ CAPACITY(16)\n");
802 memset(outbuf
, 0, req
->cmd
.xfer
);
803 bdrv_get_geometry(s
->bs
, &nb_sectors
);
806 nb_sectors
/= s
->cluster_size
;
807 /* Returned value is the address of the last sector. */
809 /* Remember the new size for read/write sanity checking. */
810 s
->max_lba
= nb_sectors
;
811 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
812 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
813 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
814 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
815 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
816 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
817 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
818 outbuf
[7] = nb_sectors
& 0xff;
821 outbuf
[10] = s
->cluster_size
* 2;
824 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
825 /* Protection, exponent and lowest lba field left blank. */
826 buflen
= req
->cmd
.xfer
;
829 DPRINTF("Unsupported Service Action In\n");
830 goto illegal_request
;
832 if (req
->cmd
.xfer
< 16)
833 goto illegal_request
;
834 memset(outbuf
, 0, 16);
841 goto illegal_request
;
843 scsi_req_set_status(req
, GOOD
, NO_SENSE
);
847 scsi_req_set_status(req
, CHECK_CONDITION
, NOT_READY
);
851 scsi_req_set_status(req
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
855 /* Execute a scsi command. Returns the length of the data expected by the
856 command. This will be Positive for data transfers from the device
857 (eg. disk reads), negative for transfers to the device (eg. disk writes),
858 and zero if the command does not transfer any data. */
860 static int32_t scsi_send_command(SCSIDevice
*d
, uint32_t tag
,
861 uint8_t *buf
, int lun
)
863 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
874 r
= scsi_find_request(s
, tag
);
876 BADF("Tag 0x%x already in use\n", tag
);
877 scsi_cancel_io(d
, tag
);
879 /* ??? Tags are not unique for different luns. We only implement a
880 single lun, so this should not matter. */
881 r
= scsi_new_request(d
, tag
, lun
);
882 outbuf
= (uint8_t *)r
->iov
.iov_base
;
884 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
885 switch (command
>> 5) {
887 lba
= (uint64_t) buf
[3] | ((uint64_t) buf
[2] << 8) |
888 (((uint64_t) buf
[1] & 0x1f) << 16);
894 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
895 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
896 len
= buf
[8] | (buf
[7] << 8);
900 lba
= (uint64_t) buf
[9] | ((uint64_t) buf
[8] << 8) |
901 ((uint64_t) buf
[7] << 16) | ((uint64_t) buf
[6] << 24) |
902 ((uint64_t) buf
[5] << 32) | ((uint64_t) buf
[4] << 40) |
903 ((uint64_t) buf
[3] << 48) | ((uint64_t) buf
[2] << 56);
904 len
= buf
[13] | (buf
[12] << 8) | (buf
[11] << 16) | (buf
[10] << 24);
908 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
909 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
910 len
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16) | (buf
[6] << 24);
914 BADF("Unsupported command length, command %x\n", command
);
920 for (i
= 1; i
< cmdlen
; i
++) {
921 printf(" 0x%02x", buf
[i
]);
927 if (scsi_req_parse(&r
->req
, buf
) != 0) {
928 BADF("Unsupported command length, command %x\n", command
);
931 assert(r
->req
.cmd
.len
== cmdlen
);
932 assert(r
->req
.cmd
.lba
== lba
);
934 if (lun
|| buf
[1] >> 5) {
935 /* Only LUN 0 supported. */
936 DPRINTF("Unimplemented LUN %d\n", lun
? lun
: buf
[1] >> 5);
937 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
)
941 case TEST_UNIT_READY
:
951 case ALLOW_MEDIUM_REMOVAL
:
953 case SYNCHRONIZE_CACHE
:
955 case GET_CONFIGURATION
:
956 case SERVICE_ACTION_IN
:
959 rc
= scsi_disk_emulate_command(&r
->req
, outbuf
);
963 scsi_req_complete(&r
->req
);
964 scsi_remove_request(r
);
972 DPRINTF("Read (sector %" PRId64
", count %d)\n", lba
, len
);
973 if (lba
> s
->max_lba
)
975 r
->sector
= lba
* s
->cluster_size
;
976 r
->sector_count
= len
* s
->cluster_size
;
982 DPRINTF("Write (sector %" PRId64
", count %d)\n", lba
, len
);
983 if (lba
> s
->max_lba
)
985 r
->sector
= lba
* s
->cluster_size
;
986 r
->sector_count
= len
* s
->cluster_size
;
990 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
992 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
995 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
998 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
999 scsi_command_complete(r
, GOOD
, NO_SENSE
);
1001 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1005 if (!r
->sector_count
)
1006 r
->sector_count
= -1;
1011 static void scsi_destroy(SCSIDevice
*dev
)
1013 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1016 while (!QTAILQ_EMPTY(&s
->qdev
.requests
)) {
1017 r
= DO_UPCAST(SCSIDiskReq
, req
, QTAILQ_FIRST(&s
->qdev
.requests
));
1018 scsi_remove_request(r
);
1020 drive_uninit(s
->qdev
.conf
.dinfo
);
1023 static int scsi_disk_initfn(SCSIDevice
*dev
)
1025 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1026 uint64_t nb_sectors
;
1028 if (!s
->qdev
.conf
.dinfo
|| !s
->qdev
.conf
.dinfo
->bdrv
) {
1029 error_report("scsi-disk: drive property not set");
1032 s
->bs
= s
->qdev
.conf
.dinfo
->bdrv
;
1034 if (bdrv_is_sg(s
->bs
)) {
1035 error_report("scsi-disk: unwanted /dev/sg*");
1039 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
1040 s
->qdev
.blocksize
= 2048;
1042 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1044 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1046 s
->qdev
.type
= TYPE_DISK
;
1047 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1048 nb_sectors
/= s
->cluster_size
;
1051 s
->max_lba
= nb_sectors
;
1052 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1056 static SCSIDeviceInfo scsi_disk_info
= {
1057 .qdev
.name
= "scsi-disk",
1058 .qdev
.desc
= "virtual scsi disk or cdrom",
1059 .qdev
.size
= sizeof(SCSIDiskState
),
1060 .init
= scsi_disk_initfn
,
1061 .destroy
= scsi_destroy
,
1062 .send_command
= scsi_send_command
,
1063 .read_data
= scsi_read_data
,
1064 .write_data
= scsi_write_data
,
1065 .cancel_io
= scsi_cancel_io
,
1066 .get_buf
= scsi_get_buf
,
1067 .qdev
.props
= (Property
[]) {
1068 DEFINE_BLOCK_PROPERTIES(SCSIDiskState
, qdev
.conf
),
1069 DEFINE_PROP_STRING("ver", SCSIDiskState
, version
),
1070 DEFINE_PROP_END_OF_LIST(),
1074 static void scsi_disk_register_devices(void)
1076 scsi_qdev_register(&scsi_disk_info
);
1078 device_init(scsi_disk_register_devices
)