2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
49 typedef struct SCSIDiskState SCSIDiskState
;
51 typedef struct SCSIDiskReq
{
53 /* ??? We should probably keep track of whether the data transfer is
54 a read or a write. Currently we rely on the host getting it right. */
55 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
57 uint32_t sector_count
;
67 /* The qemu block layer uses a fixed 512 byte sector size.
68 This is the number of 512 byte blocks in a single scsi sector. */
76 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
78 static SCSIDiskReq
*scsi_new_request(SCSIDiskState
*s
, uint32_t tag
,
84 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), &s
->qdev
, tag
, lun
);
85 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
86 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
90 static void scsi_remove_request(SCSIDiskReq
*r
)
92 qemu_vfree(r
->iov
.iov_base
);
93 scsi_req_free(&r
->req
);
96 static SCSIDiskReq
*scsi_find_request(SCSIDiskState
*s
, uint32_t tag
)
98 return DO_UPCAST(SCSIDiskReq
, req
, scsi_req_find(&s
->qdev
, tag
));
101 static void scsi_req_set_status(SCSIRequest
*req
, int status
, int sense_code
)
103 req
->status
= status
;
104 scsi_dev_set_sense(req
->dev
, sense_code
);
107 /* Helper function for command completion. */
108 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, int sense
)
110 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
111 r
->req
.tag
, status
, sense
);
112 scsi_req_set_status(&r
->req
, status
, sense
);
113 scsi_req_complete(&r
->req
);
114 scsi_remove_request(r
);
117 /* Cancel a pending data transfer. */
118 static void scsi_cancel_io(SCSIDevice
*d
, uint32_t tag
)
120 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
122 DPRINTF("Cancel tag=0x%x\n", tag
);
123 r
= scsi_find_request(s
, tag
);
126 bdrv_aio_cancel(r
->req
.aiocb
);
128 scsi_remove_request(r
);
132 static void scsi_read_complete(void * opaque
, int ret
)
134 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
140 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
145 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
147 n
= r
->iov
.iov_len
/ 512;
149 r
->sector_count
-= n
;
150 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
154 static void scsi_read_request(SCSIDiskReq
*r
)
156 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
159 if (r
->sector_count
== (uint32_t)-1) {
160 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
162 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
165 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
166 if (r
->sector_count
== 0) {
167 scsi_command_complete(r
, GOOD
, NO_SENSE
);
172 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
173 n
= SCSI_DMA_BUF_SIZE
/ 512;
175 r
->iov
.iov_len
= n
* 512;
176 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
177 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
178 scsi_read_complete
, r
);
179 if (r
->req
.aiocb
== NULL
)
180 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
183 /* Read more data from scsi device into buffer. */
184 static void scsi_read_data(SCSIDevice
*d
, uint32_t tag
)
186 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
189 r
= scsi_find_request(s
, tag
);
191 BADF("Bad read tag 0x%x\n", tag
);
192 /* ??? This is the wrong error. */
193 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
197 /* No data transfer may already be in progress */
198 assert(r
->req
.aiocb
== NULL
);
200 scsi_read_request(r
);
203 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
205 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
206 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
207 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
209 if (action
== BLOCK_ERR_IGNORE
) {
210 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
214 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
215 || action
== BLOCK_ERR_STOP_ANY
) {
217 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
218 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
220 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
223 if (type
== SCSI_REQ_STATUS_RETRY_READ
) {
224 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, 0);
226 scsi_command_complete(r
, CHECK_CONDITION
,
228 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
234 static void scsi_write_complete(void * opaque
, int ret
)
236 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
243 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
248 n
= r
->iov
.iov_len
/ 512;
250 r
->sector_count
-= n
;
251 if (r
->sector_count
== 0) {
252 scsi_command_complete(r
, GOOD
, NO_SENSE
);
254 len
= r
->sector_count
* 512;
255 if (len
> SCSI_DMA_BUF_SIZE
) {
256 len
= SCSI_DMA_BUF_SIZE
;
258 r
->iov
.iov_len
= len
;
259 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
260 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, len
);
264 static void scsi_write_request(SCSIDiskReq
*r
)
266 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
269 n
= r
->iov
.iov_len
/ 512;
271 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
272 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
273 scsi_write_complete
, r
);
274 if (r
->req
.aiocb
== NULL
)
275 scsi_command_complete(r
, CHECK_CONDITION
,
278 /* Invoke completion routine to fetch data from host. */
279 scsi_write_complete(r
, 0);
283 /* Write data to a scsi device. Returns nonzero on failure.
284 The transfer may complete asynchronously. */
285 static int scsi_write_data(SCSIDevice
*d
, uint32_t tag
)
287 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
290 DPRINTF("Write data tag=0x%x\n", tag
);
291 r
= scsi_find_request(s
, tag
);
293 BADF("Bad write tag 0x%x\n", tag
);
294 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
298 /* No data transfer may already be in progress */
299 assert(r
->req
.aiocb
== NULL
);
301 scsi_write_request(r
);
306 static void scsi_dma_restart_bh(void *opaque
)
308 SCSIDiskState
*s
= opaque
;
312 qemu_bh_delete(s
->bh
);
315 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
316 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
317 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
318 int status
= r
->status
;
320 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
322 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
323 case SCSI_REQ_STATUS_RETRY_READ
:
324 scsi_read_request(r
);
326 case SCSI_REQ_STATUS_RETRY_WRITE
:
327 scsi_write_request(r
);
334 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
336 SCSIDiskState
*s
= opaque
;
342 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
343 qemu_bh_schedule(s
->bh
);
347 /* Return a pointer to the data buffer. */
348 static uint8_t *scsi_get_buf(SCSIDevice
*d
, uint32_t tag
)
350 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
353 r
= scsi_find_request(s
, tag
);
355 BADF("Bad buffer tag 0x%x\n", tag
);
358 return (uint8_t *)r
->iov
.iov_base
;
361 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
363 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
366 if (req
->cmd
.buf
[1] & 0x2) {
367 /* Command support data - optional, not implemented */
368 BADF("optional INQUIRY command support request not implemented\n");
372 if (req
->cmd
.buf
[1] & 0x1) {
373 /* Vital product data */
374 uint8_t page_code
= req
->cmd
.buf
[2];
375 if (req
->cmd
.xfer
< 4) {
376 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
377 "less than 4\n", page_code
, req
->cmd
.xfer
);
381 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
382 outbuf
[buflen
++] = 5;
384 outbuf
[buflen
++] = 0;
386 outbuf
[buflen
++] = page_code
; // this page
387 outbuf
[buflen
++] = 0x00;
390 case 0x00: /* Supported page codes, mandatory */
391 DPRINTF("Inquiry EVPD[Supported pages] "
392 "buffer size %zd\n", req
->cmd
.xfer
);
393 outbuf
[buflen
++] = 4; // number of pages
394 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
395 outbuf
[buflen
++] = 0x80; // unit serial number
396 outbuf
[buflen
++] = 0x83; // device identification
397 outbuf
[buflen
++] = 0xb0; // block device characteristics
400 case 0x80: /* Device serial number, optional */
402 int l
= strlen(s
->serial
);
404 if (l
> req
->cmd
.xfer
)
409 DPRINTF("Inquiry EVPD[Serial number] "
410 "buffer size %zd\n", req
->cmd
.xfer
);
411 outbuf
[buflen
++] = l
;
412 memcpy(outbuf
+buflen
, s
->serial
, l
);
417 case 0x83: /* Device identification page, mandatory */
419 int max_len
= 255 - 8;
420 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
422 if (id_len
> max_len
)
424 DPRINTF("Inquiry EVPD[Device identification] "
425 "buffer size %zd\n", req
->cmd
.xfer
);
427 outbuf
[buflen
++] = 3 + id_len
;
428 outbuf
[buflen
++] = 0x2; // ASCII
429 outbuf
[buflen
++] = 0; // not officially assigned
430 outbuf
[buflen
++] = 0; // reserved
431 outbuf
[buflen
++] = id_len
; // length of data following
433 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
437 case 0xb0: /* block device characteristics */
439 unsigned int min_io_size
=
440 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
441 unsigned int opt_io_size
=
442 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
444 /* required VPD size with unmap support */
445 outbuf
[3] = buflen
= 0x3c;
447 memset(outbuf
+ 4, 0, buflen
- 4);
449 /* optimal transfer length granularity */
450 outbuf
[6] = (min_io_size
>> 8) & 0xff;
451 outbuf
[7] = min_io_size
& 0xff;
453 /* optimal transfer length */
454 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
455 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
456 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
457 outbuf
[15] = opt_io_size
& 0xff;
461 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
462 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
469 /* Standard INQUIRY data */
470 if (req
->cmd
.buf
[2] != 0) {
471 BADF("Error: Inquiry (STANDARD) page or code "
472 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
477 if (req
->cmd
.xfer
< 5) {
478 BADF("Error: Inquiry (STANDARD) buffer size %zd "
479 "is less than 5\n", req
->cmd
.xfer
);
483 buflen
= req
->cmd
.xfer
;
484 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
485 buflen
= SCSI_MAX_INQUIRY_LEN
;
487 memset(outbuf
, 0, buflen
);
489 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
490 outbuf
[0] = 0x7f; /* LUN not supported */
494 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
497 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
500 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
502 memcpy(&outbuf
[8], "QEMU ", 8);
503 memset(&outbuf
[32], 0, 4);
504 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
506 * We claim conformance to SPC-3, which is required for guests
507 * to ask for modern features like READ CAPACITY(16) or the
508 * block characteristics VPD page by default. Not all of SPC-3
509 * is actually implemented, but we're good enough.
512 outbuf
[3] = 2; /* Format 2 */
515 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
517 /* If the allocation length of CDB is too small,
518 the additional length is not adjusted */
522 /* Sync data transfer and TCQ. */
523 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
527 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
,
530 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
531 BlockDriverState
*bdrv
= s
->bs
;
532 int cylinders
, heads
, secs
;
535 * If Changeable Values are requested, a mask denoting those mode parameters
536 * that are changeable shall be returned. As we currently don't support
537 * parameter changes via MODE_SELECT all bits are returned set to zero.
538 * The buffer was already menset to zero by the caller of this function.
541 case 4: /* Rigid disk device geometry page. */
544 if (page_control
== 1) { /* Changeable Values */
547 /* if a geometry hint is available, use it */
548 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
549 p
[2] = (cylinders
>> 16) & 0xff;
550 p
[3] = (cylinders
>> 8) & 0xff;
551 p
[4] = cylinders
& 0xff;
553 /* Write precomp start cylinder, disabled */
554 p
[6] = (cylinders
>> 16) & 0xff;
555 p
[7] = (cylinders
>> 8) & 0xff;
556 p
[8] = cylinders
& 0xff;
557 /* Reduced current start cylinder, disabled */
558 p
[9] = (cylinders
>> 16) & 0xff;
559 p
[10] = (cylinders
>> 8) & 0xff;
560 p
[11] = cylinders
& 0xff;
561 /* Device step rate [ns], 200ns */
564 /* Landing zone cylinder */
568 /* Medium rotation rate [rpm], 5400 rpm */
569 p
[20] = (5400 >> 8) & 0xff;
573 case 5: /* Flexible disk device geometry page. */
576 if (page_control
== 1) { /* Changeable Values */
579 /* Transfer rate [kbit/s], 5Mbit/s */
582 /* if a geometry hint is available, use it */
583 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
586 p
[6] = s
->cluster_size
* 2;
587 p
[8] = (cylinders
>> 8) & 0xff;
588 p
[9] = cylinders
& 0xff;
589 /* Write precomp start cylinder, disabled */
590 p
[10] = (cylinders
>> 8) & 0xff;
591 p
[11] = cylinders
& 0xff;
592 /* Reduced current start cylinder, disabled */
593 p
[12] = (cylinders
>> 8) & 0xff;
594 p
[13] = cylinders
& 0xff;
595 /* Device step rate [100us], 100us */
598 /* Device step pulse width [us], 1us */
600 /* Device head settle delay [100us], 100us */
603 /* Motor on delay [0.1s], 0.1s */
605 /* Motor off delay [0.1s], 0.1s */
607 /* Medium rotation rate [rpm], 5400 rpm */
608 p
[28] = (5400 >> 8) & 0xff;
612 case 8: /* Caching page. */
615 if (page_control
== 1) { /* Changeable Values */
618 if (bdrv_enable_write_cache(s
->bs
)) {
623 case 0x2a: /* CD Capabilities and Mechanical Status page. */
624 if (bdrv_get_type_hint(bdrv
) != BDRV_TYPE_CDROM
)
628 if (page_control
== 1) { /* Changeable Values */
631 p
[2] = 3; // CD-R & CD-RW read
632 p
[3] = 0; // Writing not supported
633 p
[4] = 0x7f; /* Audio, composite, digital out,
634 mode 2 form 1&2, multi session */
635 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
636 RW corrected, C2 errors, ISRC,
638 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
639 /* Locking supported, jumper present, eject, tray */
640 p
[7] = 0; /* no volume & mute control, no
642 p
[8] = (50 * 176) >> 8; // 50x read speed
643 p
[9] = (50 * 176) & 0xff;
644 p
[10] = 0 >> 8; // No volume
646 p
[12] = 2048 >> 8; // 2M buffer
648 p
[14] = (16 * 176) >> 8; // 16x read speed current
649 p
[15] = (16 * 176) & 0xff;
650 p
[18] = (16 * 176) >> 8; // 16x write speed
651 p
[19] = (16 * 176) & 0xff;
652 p
[20] = (16 * 176) >> 8; // 16x write speed current
653 p
[21] = (16 * 176) & 0xff;
661 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
663 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
665 int page
, dbd
, buflen
, page_control
;
667 uint8_t dev_specific_param
;
669 dbd
= req
->cmd
.buf
[1] & 0x8;
670 page
= req
->cmd
.buf
[2] & 0x3f;
671 page_control
= (req
->cmd
.buf
[2] & 0xc0) >> 6;
672 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
673 (req
->cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, req
->cmd
.xfer
, page_control
);
674 memset(outbuf
, 0, req
->cmd
.xfer
);
677 if (bdrv_is_read_only(s
->bs
)) {
678 dev_specific_param
= 0x80; /* Readonly. */
680 dev_specific_param
= 0x00;
683 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
684 p
[1] = 0; /* Default media type. */
685 p
[2] = dev_specific_param
;
686 p
[3] = 0; /* Block descriptor length. */
688 } else { /* MODE_SENSE_10 */
689 p
[2] = 0; /* Default media type. */
690 p
[3] = dev_specific_param
;
691 p
[6] = p
[7] = 0; /* Block descriptor length. */
695 bdrv_get_geometry(s
->bs
, &nb_sectors
);
696 if (!dbd
&& nb_sectors
) {
697 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
698 outbuf
[3] = 8; /* Block descriptor length */
699 } else { /* MODE_SENSE_10 */
700 outbuf
[7] = 8; /* Block descriptor length */
702 nb_sectors
/= s
->cluster_size
;
703 if (nb_sectors
> 0xffffff)
705 p
[0] = 0; /* media density code */
706 p
[1] = (nb_sectors
>> 16) & 0xff;
707 p
[2] = (nb_sectors
>> 8) & 0xff;
708 p
[3] = nb_sectors
& 0xff;
709 p
[4] = 0; /* reserved */
710 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
711 p
[6] = s
->cluster_size
* 2;
716 if (page_control
== 3) { /* Saved Values */
717 return -1; /* ILLEGAL_REQUEST */
725 p
+= mode_sense_page(req
, page
, p
, page_control
);
728 p
+= mode_sense_page(req
, 0x08, p
, page_control
);
729 p
+= mode_sense_page(req
, 0x2a, p
, page_control
);
732 return -1; /* ILLEGAL_REQUEST */
737 * The mode data length field specifies the length in bytes of the
738 * following data that is available to be transferred. The mode data
739 * length does not include itself.
741 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
742 outbuf
[0] = buflen
- 1;
743 } else { /* MODE_SENSE_10 */
744 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
745 outbuf
[1] = (buflen
- 2) & 0xff;
747 if (buflen
> req
->cmd
.xfer
)
748 buflen
= req
->cmd
.xfer
;
752 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
754 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
755 int start_track
, format
, msf
, toclen
;
758 msf
= req
->cmd
.buf
[1] & 2;
759 format
= req
->cmd
.buf
[2] & 0xf;
760 start_track
= req
->cmd
.buf
[6];
761 bdrv_get_geometry(s
->bs
, &nb_sectors
);
762 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
763 nb_sectors
/= s
->cluster_size
;
766 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
769 /* multi session : only a single session defined */
771 memset(outbuf
, 0, 12);
777 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
782 if (toclen
> req
->cmd
.xfer
)
783 toclen
= req
->cmd
.xfer
;
787 static int scsi_disk_emulate_command(SCSIRequest
*req
, uint8_t *outbuf
)
789 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
793 switch (req
->cmd
.buf
[0]) {
794 case TEST_UNIT_READY
:
795 if (!bdrv_is_inserted(s
->bs
))
799 if (req
->cmd
.xfer
< 4)
800 goto illegal_request
;
801 memset(outbuf
, 0, 4);
803 if (req
->dev
->sense
.key
== NOT_READY
&& req
->cmd
.xfer
>= 18) {
804 memset(outbuf
, 0, 18);
807 /* asc 0x3a, ascq 0: Medium not present */
813 outbuf
[2] = req
->dev
->sense
.key
;
814 scsi_dev_clear_sense(req
->dev
);
817 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
819 goto illegal_request
;
823 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
825 goto illegal_request
;
828 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
830 goto illegal_request
;
833 if (req
->cmd
.buf
[1] & 1)
834 goto illegal_request
;
837 if (req
->cmd
.buf
[1] & 3)
838 goto illegal_request
;
841 if (req
->cmd
.buf
[1] & 1)
842 goto illegal_request
;
845 if (req
->cmd
.buf
[1] & 3)
846 goto illegal_request
;
849 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
&& (req
->cmd
.buf
[4] & 2)) {
850 /* load/eject medium */
851 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
854 case ALLOW_MEDIUM_REMOVAL
:
855 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
858 /* The normal LEN field for this command is zero. */
859 memset(outbuf
, 0, 8);
860 bdrv_get_geometry(s
->bs
, &nb_sectors
);
863 nb_sectors
/= s
->cluster_size
;
864 /* Returned value is the address of the last sector. */
866 /* Remember the new size for read/write sanity checking. */
867 s
->max_lba
= nb_sectors
;
868 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
869 if (nb_sectors
> UINT32_MAX
)
870 nb_sectors
= UINT32_MAX
;
871 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
872 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
873 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
874 outbuf
[3] = nb_sectors
& 0xff;
877 outbuf
[6] = s
->cluster_size
* 2;
881 case SYNCHRONIZE_CACHE
:
884 case GET_CONFIGURATION
:
885 memset(outbuf
, 0, 8);
886 /* ??? This should probably return much more information. For now
887 just return the basic header indicating the CD-ROM profile. */
888 outbuf
[7] = 8; // CD-ROM
891 case SERVICE_ACTION_IN
:
892 /* Service Action In subcommands. */
893 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
894 DPRINTF("SAI READ CAPACITY(16)\n");
895 memset(outbuf
, 0, req
->cmd
.xfer
);
896 bdrv_get_geometry(s
->bs
, &nb_sectors
);
899 nb_sectors
/= s
->cluster_size
;
900 /* Returned value is the address of the last sector. */
902 /* Remember the new size for read/write sanity checking. */
903 s
->max_lba
= nb_sectors
;
904 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
905 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
906 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
907 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
908 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
909 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
910 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
911 outbuf
[7] = nb_sectors
& 0xff;
914 outbuf
[10] = s
->cluster_size
* 2;
917 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
918 /* Protection, exponent and lowest lba field left blank. */
919 buflen
= req
->cmd
.xfer
;
922 DPRINTF("Unsupported Service Action In\n");
923 goto illegal_request
;
925 if (req
->cmd
.xfer
< 16)
926 goto illegal_request
;
927 memset(outbuf
, 0, 16);
934 DPRINTF("Rezero Unit\n");
935 if (!bdrv_is_inserted(s
->bs
)) {
940 goto illegal_request
;
942 scsi_req_set_status(req
, GOOD
, NO_SENSE
);
946 scsi_req_set_status(req
, CHECK_CONDITION
, NOT_READY
);
950 scsi_req_set_status(req
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
954 /* Execute a scsi command. Returns the length of the data expected by the
955 command. This will be Positive for data transfers from the device
956 (eg. disk reads), negative for transfers to the device (eg. disk writes),
957 and zero if the command does not transfer any data. */
959 static int32_t scsi_send_command(SCSIDevice
*d
, uint32_t tag
,
960 uint8_t *buf
, int lun
)
962 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
973 r
= scsi_find_request(s
, tag
);
975 BADF("Tag 0x%x already in use\n", tag
);
976 scsi_cancel_io(d
, tag
);
978 /* ??? Tags are not unique for different luns. We only implement a
979 single lun, so this should not matter. */
980 r
= scsi_new_request(s
, tag
, lun
);
981 outbuf
= (uint8_t *)r
->iov
.iov_base
;
983 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
984 switch (command
>> 5) {
986 lba
= (uint64_t) buf
[3] | ((uint64_t) buf
[2] << 8) |
987 (((uint64_t) buf
[1] & 0x1f) << 16);
993 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
994 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
995 len
= buf
[8] | (buf
[7] << 8);
999 lba
= (uint64_t) buf
[9] | ((uint64_t) buf
[8] << 8) |
1000 ((uint64_t) buf
[7] << 16) | ((uint64_t) buf
[6] << 24) |
1001 ((uint64_t) buf
[5] << 32) | ((uint64_t) buf
[4] << 40) |
1002 ((uint64_t) buf
[3] << 48) | ((uint64_t) buf
[2] << 56);
1003 len
= buf
[13] | (buf
[12] << 8) | (buf
[11] << 16) | (buf
[10] << 24);
1007 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
1008 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
1009 len
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16) | (buf
[6] << 24);
1013 BADF("Unsupported command length, command %x\n", command
);
1019 for (i
= 1; i
< cmdlen
; i
++) {
1020 printf(" 0x%02x", buf
[i
]);
1026 if (scsi_req_parse(&r
->req
, buf
) != 0) {
1027 BADF("Unsupported command length, command %x\n", command
);
1030 assert(r
->req
.cmd
.len
== cmdlen
);
1031 assert(r
->req
.cmd
.lba
== lba
);
1033 if (lun
|| buf
[1] >> 5) {
1034 /* Only LUN 0 supported. */
1035 DPRINTF("Unimplemented LUN %d\n", lun
? lun
: buf
[1] >> 5);
1036 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
)
1040 case TEST_UNIT_READY
:
1050 case ALLOW_MEDIUM_REMOVAL
:
1052 case SYNCHRONIZE_CACHE
:
1054 case GET_CONFIGURATION
:
1055 case SERVICE_ACTION_IN
:
1059 rc
= scsi_disk_emulate_command(&r
->req
, outbuf
);
1061 r
->iov
.iov_len
= rc
;
1063 scsi_req_complete(&r
->req
);
1064 scsi_remove_request(r
);
1072 DPRINTF("Read (sector %" PRId64
", count %d)\n", lba
, len
);
1073 if (lba
> s
->max_lba
)
1075 r
->sector
= lba
* s
->cluster_size
;
1076 r
->sector_count
= len
* s
->cluster_size
;
1083 case WRITE_VERIFY_12
:
1084 case WRITE_VERIFY_16
:
1085 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1086 (command
& 0xe) == 0xe ? "And Verify " : "", lba
, len
);
1087 if (lba
> s
->max_lba
)
1089 r
->sector
= lba
* s
->cluster_size
;
1090 r
->sector_count
= len
* s
->cluster_size
;
1094 DPRINTF("Mode Select(6) (len %d)\n", len
);
1095 /* We don't support mode parameter changes.
1096 Allow the mode parameter header + block descriptors only. */
1101 case MODE_SELECT_10
:
1102 DPRINTF("Mode Select(10) (len %d)\n", len
);
1103 /* We don't support mode parameter changes.
1104 Allow the mode parameter header + block descriptors only. */
1111 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10, lba
);
1112 if (lba
> s
->max_lba
) {
1117 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1119 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
1122 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
1125 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1126 scsi_command_complete(r
, GOOD
, NO_SENSE
);
1128 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1132 if (!r
->sector_count
)
1133 r
->sector_count
= -1;
1138 static void scsi_disk_purge_requests(SCSIDiskState
*s
)
1142 while (!QTAILQ_EMPTY(&s
->qdev
.requests
)) {
1143 r
= DO_UPCAST(SCSIDiskReq
, req
, QTAILQ_FIRST(&s
->qdev
.requests
));
1145 bdrv_aio_cancel(r
->req
.aiocb
);
1147 scsi_remove_request(r
);
1151 static void scsi_disk_reset(DeviceState
*dev
)
1153 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1154 uint64_t nb_sectors
;
1156 scsi_disk_purge_requests(s
);
1158 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1159 nb_sectors
/= s
->cluster_size
;
1163 s
->max_lba
= nb_sectors
;
1166 static void scsi_destroy(SCSIDevice
*dev
)
1168 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1170 scsi_disk_purge_requests(s
);
1171 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1174 static int scsi_disk_initfn(SCSIDevice
*dev
)
1176 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1180 if (!s
->qdev
.conf
.bs
) {
1181 error_report("scsi-disk: drive property not set");
1184 s
->bs
= s
->qdev
.conf
.bs
;
1185 is_cd
= bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
;
1187 if (!is_cd
&& !bdrv_is_inserted(s
->bs
)) {
1188 error_report("Device needs media, but drive is empty");
1193 /* try to fall back to value set with legacy -drive serial=... */
1194 dinfo
= drive_get_by_blockdev(s
->bs
);
1195 s
->serial
= qemu_strdup(*dinfo
->serial
? dinfo
->serial
: "0");
1199 s
->version
= qemu_strdup(QEMU_VERSION
);
1202 if (bdrv_is_sg(s
->bs
)) {
1203 error_report("scsi-disk: unwanted /dev/sg*");
1208 s
->qdev
.blocksize
= 2048;
1210 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1212 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1213 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1215 s
->qdev
.type
= TYPE_DISK
;
1216 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1217 bdrv_set_removable(s
->bs
, is_cd
);
1221 static SCSIDeviceInfo scsi_disk_info
= {
1222 .qdev
.name
= "scsi-disk",
1223 .qdev
.desc
= "virtual scsi disk or cdrom",
1224 .qdev
.size
= sizeof(SCSIDiskState
),
1225 .qdev
.reset
= scsi_disk_reset
,
1226 .init
= scsi_disk_initfn
,
1227 .destroy
= scsi_destroy
,
1228 .send_command
= scsi_send_command
,
1229 .read_data
= scsi_read_data
,
1230 .write_data
= scsi_write_data
,
1231 .cancel_io
= scsi_cancel_io
,
1232 .get_buf
= scsi_get_buf
,
1233 .qdev
.props
= (Property
[]) {
1234 DEFINE_BLOCK_PROPERTIES(SCSIDiskState
, qdev
.conf
),
1235 DEFINE_PROP_STRING("ver", SCSIDiskState
, version
),
1236 DEFINE_PROP_STRING("serial", SCSIDiskState
, serial
),
1237 DEFINE_PROP_END_OF_LIST(),
1241 static void scsi_disk_register_devices(void)
1243 scsi_qdev_register(&scsi_disk_info
);
1245 device_init(scsi_disk_register_devices
)