2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
38 #include "scsi-defs.h"
40 #define SCSI_DMA_BUF_SIZE 131072
41 #define SCSI_MAX_INQUIRY_LEN 256
43 #define SCSI_REQ_STATUS_RETRY 0x01
45 typedef struct SCSIDiskState SCSIDiskState
;
47 typedef struct SCSIDiskReq
{
49 /* ??? We should probably keep track of whether the data transfer is
50 a read or a write. Currently we rely on the host getting it right. */
51 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
53 uint32_t sector_count
;
63 /* The qemu block layer uses a fixed 512 byte sector size.
64 This is the number of 512 byte blocks in a single scsi sector. */
71 static SCSIDiskReq
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
)
76 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), d
, tag
, lun
);
77 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
78 r
->iov
.iov_base
= qemu_memalign(512, SCSI_DMA_BUF_SIZE
);
82 static void scsi_remove_request(SCSIDiskReq
*r
)
84 qemu_vfree(r
->iov
.iov_base
);
85 scsi_req_free(&r
->req
);
88 static SCSIDiskReq
*scsi_find_request(SCSIDiskState
*s
, uint32_t tag
)
90 return DO_UPCAST(SCSIDiskReq
, req
, scsi_req_find(&s
->qdev
, tag
));
93 static void scsi_req_set_status(SCSIRequest
*req
, int status
, int sense_code
)
96 scsi_dev_set_sense(req
->dev
, sense_code
);
99 /* Helper function for command completion. */
100 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, int sense
)
102 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
103 r
->req
.tag
, status
, sense
);
104 scsi_req_set_status(&r
->req
, status
, sense
);
105 scsi_req_complete(&r
->req
);
106 scsi_remove_request(r
);
109 /* Cancel a pending data transfer. */
110 static void scsi_cancel_io(SCSIDevice
*d
, uint32_t tag
)
112 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
114 DPRINTF("Cancel tag=0x%x\n", tag
);
115 r
= scsi_find_request(s
, tag
);
118 bdrv_aio_cancel(r
->req
.aiocb
);
120 scsi_remove_request(r
);
124 static void scsi_read_complete(void * opaque
, int ret
)
126 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
129 DPRINTF("IO error\n");
130 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, 0);
131 scsi_command_complete(r
, CHECK_CONDITION
, NO_SENSE
);
134 DPRINTF("Data ready tag=0x%x len=%" PRId64
"\n", r
->req
.tag
, r
->iov
.iov_len
);
136 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
139 /* Read more data from scsi device into buffer. */
140 static void scsi_read_data(SCSIDevice
*d
, uint32_t tag
)
142 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
146 r
= scsi_find_request(s
, tag
);
148 BADF("Bad read tag 0x%x\n", tag
);
149 /* ??? This is the wrong error. */
150 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
153 if (r
->sector_count
== (uint32_t)-1) {
154 DPRINTF("Read buf_len=%" PRId64
"\n", r
->iov
.iov_len
);
156 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
159 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
160 if (r
->sector_count
== 0) {
161 scsi_command_complete(r
, GOOD
, NO_SENSE
);
166 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
167 n
= SCSI_DMA_BUF_SIZE
/ 512;
169 r
->iov
.iov_len
= n
* 512;
170 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
171 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
172 scsi_read_complete
, r
);
173 if (r
->req
.aiocb
== NULL
)
174 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
176 r
->sector_count
-= n
;
179 static int scsi_handle_write_error(SCSIDiskReq
*r
, int error
)
181 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
182 BlockInterfaceErrorAction action
= drive_get_on_error(s
->bs
, 0);
184 if (action
== BLOCK_ERR_IGNORE
) {
185 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, 0);
189 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
190 || action
== BLOCK_ERR_STOP_ANY
) {
191 r
->status
|= SCSI_REQ_STATUS_RETRY
;
192 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, 0);
195 scsi_command_complete(r
, CHECK_CONDITION
,
197 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, 0);
203 static void scsi_write_complete(void * opaque
, int ret
)
205 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
212 if (scsi_handle_write_error(r
, -ret
))
216 n
= r
->iov
.iov_len
/ 512;
218 r
->sector_count
-= n
;
219 if (r
->sector_count
== 0) {
220 scsi_command_complete(r
, GOOD
, NO_SENSE
);
222 len
= r
->sector_count
* 512;
223 if (len
> SCSI_DMA_BUF_SIZE
) {
224 len
= SCSI_DMA_BUF_SIZE
;
226 r
->iov
.iov_len
= len
;
227 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
228 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, len
);
232 static void scsi_write_request(SCSIDiskReq
*r
)
234 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
237 n
= r
->iov
.iov_len
/ 512;
239 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
240 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
241 scsi_write_complete
, r
);
242 if (r
->req
.aiocb
== NULL
)
243 scsi_command_complete(r
, CHECK_CONDITION
,
246 /* Invoke completion routine to fetch data from host. */
247 scsi_write_complete(r
, 0);
251 /* Write data to a scsi device. Returns nonzero on failure.
252 The transfer may complete asynchronously. */
253 static int scsi_write_data(SCSIDevice
*d
, uint32_t tag
)
255 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
258 DPRINTF("Write data tag=0x%x\n", tag
);
259 r
= scsi_find_request(s
, tag
);
261 BADF("Bad write tag 0x%x\n", tag
);
262 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
267 BADF("Data transfer already in progress\n");
269 scsi_write_request(r
);
274 static void scsi_dma_restart_bh(void *opaque
)
276 SCSIDiskState
*s
= opaque
;
280 qemu_bh_delete(s
->bh
);
283 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
284 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
285 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
286 r
->status
&= ~SCSI_REQ_STATUS_RETRY
;
287 scsi_write_request(r
);
292 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
294 SCSIDiskState
*s
= opaque
;
300 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
301 qemu_bh_schedule(s
->bh
);
305 /* Return a pointer to the data buffer. */
306 static uint8_t *scsi_get_buf(SCSIDevice
*d
, uint32_t tag
)
308 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
311 r
= scsi_find_request(s
, tag
);
313 BADF("Bad buffer tag 0x%x\n", tag
);
316 return (uint8_t *)r
->iov
.iov_base
;
319 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
321 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
324 if (req
->cmd
.buf
[1] & 0x2) {
325 /* Command support data - optional, not implemented */
326 BADF("optional INQUIRY command support request not implemented\n");
330 if (req
->cmd
.buf
[1] & 0x1) {
331 /* Vital product data */
332 uint8_t page_code
= req
->cmd
.buf
[2];
333 if (req
->cmd
.xfer
< 4) {
334 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
335 "less than 4\n", page_code
, req
->cmd
.xfer
);
339 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
340 outbuf
[buflen
++] = 5;
342 outbuf
[buflen
++] = 0;
344 outbuf
[buflen
++] = page_code
; // this page
345 outbuf
[buflen
++] = 0x00;
348 case 0x00: /* Supported page codes, mandatory */
349 DPRINTF("Inquiry EVPD[Supported pages] "
350 "buffer size %zd\n", req
->cmd
.xfer
);
351 outbuf
[buflen
++] = 4; // number of pages
352 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
353 outbuf
[buflen
++] = 0x80; // unit serial number
354 outbuf
[buflen
++] = 0x83; // device identification
355 outbuf
[buflen
++] = 0xb0; // block device characteristics
358 case 0x80: /* Device serial number, optional */
360 const char *serial
= req
->dev
->conf
.dinfo
->serial
?
361 req
->dev
->conf
.dinfo
->serial
: "0";
362 int l
= strlen(serial
);
364 if (l
> req
->cmd
.xfer
)
369 DPRINTF("Inquiry EVPD[Serial number] "
370 "buffer size %zd\n", req
->cmd
.xfer
);
371 outbuf
[buflen
++] = l
;
372 memcpy(outbuf
+buflen
, serial
, l
);
377 case 0x83: /* Device identification page, mandatory */
379 int max_len
= 255 - 8;
380 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
382 if (id_len
> max_len
)
384 DPRINTF("Inquiry EVPD[Device identification] "
385 "buffer size %zd\n", req
->cmd
.xfer
);
387 outbuf
[buflen
++] = 3 + id_len
;
388 outbuf
[buflen
++] = 0x2; // ASCII
389 outbuf
[buflen
++] = 0; // not officially assigned
390 outbuf
[buflen
++] = 0; // reserved
391 outbuf
[buflen
++] = id_len
; // length of data following
393 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
397 case 0xb0: /* block device characteristics */
399 unsigned int min_io_size
=
400 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
401 unsigned int opt_io_size
=
402 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
404 /* required VPD size with unmap support */
405 outbuf
[3] = buflen
= 0x3c;
407 memset(outbuf
+ 4, 0, buflen
- 4);
409 /* optimal transfer length granularity */
410 outbuf
[6] = (min_io_size
>> 8) & 0xff;
411 outbuf
[7] = min_io_size
& 0xff;
413 /* optimal transfer length */
414 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
415 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
416 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
417 outbuf
[15] = opt_io_size
& 0xff;
421 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
422 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
429 /* Standard INQUIRY data */
430 if (req
->cmd
.buf
[2] != 0) {
431 BADF("Error: Inquiry (STANDARD) page or code "
432 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
437 if (req
->cmd
.xfer
< 5) {
438 BADF("Error: Inquiry (STANDARD) buffer size %zd "
439 "is less than 5\n", req
->cmd
.xfer
);
443 buflen
= req
->cmd
.xfer
;
444 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
445 buflen
= SCSI_MAX_INQUIRY_LEN
;
447 memset(outbuf
, 0, buflen
);
449 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
450 outbuf
[0] = 0x7f; /* LUN not supported */
454 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
457 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
460 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
462 memcpy(&outbuf
[8], "QEMU ", 8);
463 memcpy(&outbuf
[32], s
->version
? s
->version
: QEMU_VERSION
, 4);
465 * We claim conformance to SPC-3, which is required for guests
466 * to ask for modern features like READ CAPACITY(16) or the
467 * block characteristics VPD page by default. Not all of SPC-3
468 * is actually implemented, but we're good enough.
471 outbuf
[3] = 2; /* Format 2 */
474 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
476 /* If the allocation length of CDB is too small,
477 the additional length is not adjusted */
481 /* Sync data transfer and TCQ. */
482 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
486 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
)
488 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
489 BlockDriverState
*bdrv
= s
->bs
;
490 int cylinders
, heads
, secs
;
493 case 4: /* Rigid disk device geometry page. */
496 /* if a geometry hint is available, use it */
497 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
498 p
[2] = (cylinders
>> 16) & 0xff;
499 p
[3] = (cylinders
>> 8) & 0xff;
500 p
[4] = cylinders
& 0xff;
502 /* Write precomp start cylinder, disabled */
503 p
[6] = (cylinders
>> 16) & 0xff;
504 p
[7] = (cylinders
>> 8) & 0xff;
505 p
[8] = cylinders
& 0xff;
506 /* Reduced current start cylinder, disabled */
507 p
[9] = (cylinders
>> 16) & 0xff;
508 p
[10] = (cylinders
>> 8) & 0xff;
509 p
[11] = cylinders
& 0xff;
510 /* Device step rate [ns], 200ns */
513 /* Landing zone cylinder */
517 /* Medium rotation rate [rpm], 5400 rpm */
518 p
[20] = (5400 >> 8) & 0xff;
522 case 5: /* Flexible disk device geometry page. */
525 /* Transfer rate [kbit/s], 5Mbit/s */
528 /* if a geometry hint is available, use it */
529 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
532 p
[6] = s
->cluster_size
* 2;
533 p
[8] = (cylinders
>> 8) & 0xff;
534 p
[9] = cylinders
& 0xff;
535 /* Write precomp start cylinder, disabled */
536 p
[10] = (cylinders
>> 8) & 0xff;
537 p
[11] = cylinders
& 0xff;
538 /* Reduced current start cylinder, disabled */
539 p
[12] = (cylinders
>> 8) & 0xff;
540 p
[13] = cylinders
& 0xff;
541 /* Device step rate [100us], 100us */
544 /* Device step pulse width [us], 1us */
546 /* Device head settle delay [100us], 100us */
549 /* Motor on delay [0.1s], 0.1s */
551 /* Motor off delay [0.1s], 0.1s */
553 /* Medium rotation rate [rpm], 5400 rpm */
554 p
[28] = (5400 >> 8) & 0xff;
558 case 8: /* Caching page. */
561 if (bdrv_enable_write_cache(s
->bs
)) {
566 case 0x2a: /* CD Capabilities and Mechanical Status page. */
567 if (bdrv_get_type_hint(bdrv
) != BDRV_TYPE_CDROM
)
571 p
[2] = 3; // CD-R & CD-RW read
572 p
[3] = 0; // Writing not supported
573 p
[4] = 0x7f; /* Audio, composite, digital out,
574 mode 2 form 1&2, multi session */
575 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
576 RW corrected, C2 errors, ISRC,
578 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
579 /* Locking supported, jumper present, eject, tray */
580 p
[7] = 0; /* no volume & mute control, no
582 p
[8] = (50 * 176) >> 8; // 50x read speed
583 p
[9] = (50 * 176) & 0xff;
584 p
[10] = 0 >> 8; // No volume
586 p
[12] = 2048 >> 8; // 2M buffer
588 p
[14] = (16 * 176) >> 8; // 16x read speed current
589 p
[15] = (16 * 176) & 0xff;
590 p
[18] = (16 * 176) >> 8; // 16x write speed
591 p
[19] = (16 * 176) & 0xff;
592 p
[20] = (16 * 176) >> 8; // 16x write speed current
593 p
[21] = (16 * 176) & 0xff;
601 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
603 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
605 int page
, dbd
, buflen
;
608 dbd
= req
->cmd
.buf
[1] & 0x8;
609 page
= req
->cmd
.buf
[2] & 0x3f;
610 DPRINTF("Mode Sense (page %d, len %zd)\n", page
, req
->cmd
.xfer
);
611 memset(outbuf
, 0, req
->cmd
.xfer
);
614 p
[1] = 0; /* Default media type. */
615 p
[3] = 0; /* Block descriptor length. */
616 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
||
617 bdrv_is_read_only(s
->bs
)) {
618 p
[2] = 0x80; /* Readonly. */
622 bdrv_get_geometry(s
->bs
, &nb_sectors
);
623 if ((~dbd
) & nb_sectors
) {
624 outbuf
[3] = 8; /* Block descriptor length */
625 nb_sectors
/= s
->cluster_size
;
627 if (nb_sectors
> 0xffffff)
628 nb_sectors
= 0xffffff;
629 p
[0] = 0; /* media density code */
630 p
[1] = (nb_sectors
>> 16) & 0xff;
631 p
[2] = (nb_sectors
>> 8) & 0xff;
632 p
[3] = nb_sectors
& 0xff;
633 p
[4] = 0; /* reserved */
634 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
635 p
[6] = s
->cluster_size
* 2;
645 p
+= mode_sense_page(req
, page
, p
);
648 p
+= mode_sense_page(req
, 0x08, p
);
649 p
+= mode_sense_page(req
, 0x2a, p
);
654 outbuf
[0] = buflen
- 4;
655 if (buflen
> req
->cmd
.xfer
)
656 buflen
= req
->cmd
.xfer
;
660 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
662 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
663 int start_track
, format
, msf
, toclen
;
666 msf
= req
->cmd
.buf
[1] & 2;
667 format
= req
->cmd
.buf
[2] & 0xf;
668 start_track
= req
->cmd
.buf
[6];
669 bdrv_get_geometry(s
->bs
, &nb_sectors
);
670 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
671 nb_sectors
/= s
->cluster_size
;
674 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
677 /* multi session : only a single session defined */
679 memset(outbuf
, 0, 12);
685 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
690 if (toclen
> req
->cmd
.xfer
)
691 toclen
= req
->cmd
.xfer
;
695 static int scsi_disk_emulate_command(SCSIRequest
*req
, uint8_t *outbuf
)
697 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
701 switch (req
->cmd
.buf
[0]) {
702 case TEST_UNIT_READY
:
703 if (!bdrv_is_inserted(s
->bs
))
707 if (req
->cmd
.xfer
< 4)
708 goto illegal_request
;
709 memset(outbuf
, 0, 4);
711 if (req
->dev
->sense
.key
== NOT_READY
&& req
->cmd
.xfer
>= 18) {
712 memset(outbuf
, 0, 18);
715 /* asc 0x3a, ascq 0: Medium not present */
721 outbuf
[2] = req
->dev
->sense
.key
;
722 scsi_dev_clear_sense(req
->dev
);
725 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
727 goto illegal_request
;
731 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
733 goto illegal_request
;
736 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
738 goto illegal_request
;
741 if (req
->cmd
.buf
[1] & 1)
742 goto illegal_request
;
745 if (req
->cmd
.buf
[1] & 3)
746 goto illegal_request
;
749 if (req
->cmd
.buf
[1] & 1)
750 goto illegal_request
;
753 if (req
->cmd
.buf
[1] & 3)
754 goto illegal_request
;
757 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
&& (req
->cmd
.buf
[4] & 2)) {
758 /* load/eject medium */
759 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
762 case ALLOW_MEDIUM_REMOVAL
:
763 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
766 /* The normal LEN field for this command is zero. */
767 memset(outbuf
, 0, 8);
768 bdrv_get_geometry(s
->bs
, &nb_sectors
);
771 nb_sectors
/= s
->cluster_size
;
772 /* Returned value is the address of the last sector. */
774 /* Remember the new size for read/write sanity checking. */
775 s
->max_lba
= nb_sectors
;
776 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
777 if (nb_sectors
> UINT32_MAX
)
778 nb_sectors
= UINT32_MAX
;
779 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
780 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
781 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
782 outbuf
[3] = nb_sectors
& 0xff;
785 outbuf
[6] = s
->cluster_size
* 2;
789 case SYNCHRONIZE_CACHE
:
792 case GET_CONFIGURATION
:
793 memset(outbuf
, 0, 8);
794 /* ??? This should probably return much more information. For now
795 just return the basic header indicating the CD-ROM profile. */
796 outbuf
[7] = 8; // CD-ROM
799 case SERVICE_ACTION_IN
:
800 /* Service Action In subcommands. */
801 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
802 DPRINTF("SAI READ CAPACITY(16)\n");
803 memset(outbuf
, 0, req
->cmd
.xfer
);
804 bdrv_get_geometry(s
->bs
, &nb_sectors
);
807 nb_sectors
/= s
->cluster_size
;
808 /* Returned value is the address of the last sector. */
810 /* Remember the new size for read/write sanity checking. */
811 s
->max_lba
= nb_sectors
;
812 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
813 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
814 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
815 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
816 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
817 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
818 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
819 outbuf
[7] = nb_sectors
& 0xff;
822 outbuf
[10] = s
->cluster_size
* 2;
825 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
826 /* Protection, exponent and lowest lba field left blank. */
827 buflen
= req
->cmd
.xfer
;
830 DPRINTF("Unsupported Service Action In\n");
831 goto illegal_request
;
833 if (req
->cmd
.xfer
< 16)
834 goto illegal_request
;
835 memset(outbuf
, 0, 16);
842 goto illegal_request
;
844 scsi_req_set_status(req
, GOOD
, NO_SENSE
);
848 scsi_req_set_status(req
, CHECK_CONDITION
, NOT_READY
);
852 scsi_req_set_status(req
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
856 /* Execute a scsi command. Returns the length of the data expected by the
857 command. This will be Positive for data transfers from the device
858 (eg. disk reads), negative for transfers to the device (eg. disk writes),
859 and zero if the command does not transfer any data. */
861 static int32_t scsi_send_command(SCSIDevice
*d
, uint32_t tag
,
862 uint8_t *buf
, int lun
)
864 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
875 r
= scsi_find_request(s
, tag
);
877 BADF("Tag 0x%x already in use\n", tag
);
878 scsi_cancel_io(d
, tag
);
880 /* ??? Tags are not unique for different luns. We only implement a
881 single lun, so this should not matter. */
882 r
= scsi_new_request(d
, tag
, lun
);
883 outbuf
= (uint8_t *)r
->iov
.iov_base
;
885 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
886 switch (command
>> 5) {
888 lba
= (uint64_t) buf
[3] | ((uint64_t) buf
[2] << 8) |
889 (((uint64_t) buf
[1] & 0x1f) << 16);
895 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
896 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
897 len
= buf
[8] | (buf
[7] << 8);
901 lba
= (uint64_t) buf
[9] | ((uint64_t) buf
[8] << 8) |
902 ((uint64_t) buf
[7] << 16) | ((uint64_t) buf
[6] << 24) |
903 ((uint64_t) buf
[5] << 32) | ((uint64_t) buf
[4] << 40) |
904 ((uint64_t) buf
[3] << 48) | ((uint64_t) buf
[2] << 56);
905 len
= buf
[13] | (buf
[12] << 8) | (buf
[11] << 16) | (buf
[10] << 24);
909 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
910 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
911 len
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16) | (buf
[6] << 24);
915 BADF("Unsupported command length, command %x\n", command
);
921 for (i
= 1; i
< cmdlen
; i
++) {
922 printf(" 0x%02x", buf
[i
]);
928 if (scsi_req_parse(&r
->req
, buf
) != 0) {
929 BADF("Unsupported command length, command %x\n", command
);
932 assert(r
->req
.cmd
.len
== cmdlen
);
933 assert(r
->req
.cmd
.lba
== lba
);
935 if (lun
|| buf
[1] >> 5) {
936 /* Only LUN 0 supported. */
937 DPRINTF("Unimplemented LUN %d\n", lun
? lun
: buf
[1] >> 5);
938 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
)
942 case TEST_UNIT_READY
:
952 case ALLOW_MEDIUM_REMOVAL
:
954 case SYNCHRONIZE_CACHE
:
956 case GET_CONFIGURATION
:
957 case SERVICE_ACTION_IN
:
960 rc
= scsi_disk_emulate_command(&r
->req
, outbuf
);
964 scsi_req_complete(&r
->req
);
965 scsi_remove_request(r
);
973 DPRINTF("Read (sector %" PRId64
", count %d)\n", lba
, len
);
974 if (lba
> s
->max_lba
)
976 r
->sector
= lba
* s
->cluster_size
;
977 r
->sector_count
= len
* s
->cluster_size
;
983 DPRINTF("Write (sector %" PRId64
", count %d)\n", lba
, len
);
984 if (lba
> s
->max_lba
)
986 r
->sector
= lba
* s
->cluster_size
;
987 r
->sector_count
= len
* s
->cluster_size
;
991 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
993 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
996 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
999 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1000 scsi_command_complete(r
, GOOD
, NO_SENSE
);
1002 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1006 if (!r
->sector_count
)
1007 r
->sector_count
= -1;
1012 static void scsi_destroy(SCSIDevice
*dev
)
1014 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1017 while (!QTAILQ_EMPTY(&s
->qdev
.requests
)) {
1018 r
= DO_UPCAST(SCSIDiskReq
, req
, QTAILQ_FIRST(&s
->qdev
.requests
));
1019 scsi_remove_request(r
);
1021 drive_uninit(s
->qdev
.conf
.dinfo
);
1024 static int scsi_disk_initfn(SCSIDevice
*dev
)
1026 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1027 uint64_t nb_sectors
;
1029 if (!s
->qdev
.conf
.dinfo
|| !s
->qdev
.conf
.dinfo
->bdrv
) {
1030 error_report("scsi-disk: drive property not set");
1033 s
->bs
= s
->qdev
.conf
.dinfo
->bdrv
;
1035 if (bdrv_is_sg(s
->bs
)) {
1036 error_report("scsi-disk: unwanted /dev/sg*");
1040 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
1041 s
->qdev
.blocksize
= 2048;
1043 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1045 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1047 s
->qdev
.type
= TYPE_DISK
;
1048 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1049 nb_sectors
/= s
->cluster_size
;
1052 s
->max_lba
= nb_sectors
;
1053 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1057 static SCSIDeviceInfo scsi_disk_info
= {
1058 .qdev
.name
= "scsi-disk",
1059 .qdev
.desc
= "virtual scsi disk or cdrom",
1060 .qdev
.size
= sizeof(SCSIDiskState
),
1061 .init
= scsi_disk_initfn
,
1062 .destroy
= scsi_destroy
,
1063 .send_command
= scsi_send_command
,
1064 .read_data
= scsi_read_data
,
1065 .write_data
= scsi_write_data
,
1066 .cancel_io
= scsi_cancel_io
,
1067 .get_buf
= scsi_get_buf
,
1068 .qdev
.props
= (Property
[]) {
1069 DEFINE_BLOCK_PROPERTIES(SCSIDiskState
, qdev
.conf
),
1070 DEFINE_PROP_STRING("ver", SCSIDiskState
, version
),
1071 DEFINE_PROP_END_OF_LIST(),
1075 static void scsi_disk_register_devices(void)
1077 scsi_qdev_register(&scsi_disk_info
);
1079 device_init(scsi_disk_register_devices
)