2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
40 #include "block_int.h"
47 #define SCSI_DMA_BUF_SIZE 131072
48 #define SCSI_MAX_INQUIRY_LEN 256
50 typedef struct SCSIDiskState SCSIDiskState
;
52 typedef struct SCSIDiskReq
{
54 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
56 uint32_t sector_count
;
77 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
);
79 static void scsi_free_request(SCSIRequest
*req
)
81 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
83 if (r
->iov
.iov_base
) {
84 qemu_vfree(r
->iov
.iov_base
);
88 /* Helper function for command completion with sense. */
89 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
91 DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
92 r
->req
.tag
, sense
.key
, sense
.asc
, sense
.ascq
);
93 scsi_req_build_sense(&r
->req
, sense
);
94 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
97 /* Cancel a pending data transfer. */
98 static void scsi_cancel_io(SCSIRequest
*req
)
100 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
102 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
104 bdrv_aio_cancel(r
->req
.aiocb
);
106 /* This reference was left in by scsi_*_data. We take ownership of
107 * it the moment scsi_req_cancel is called, independent of whether
108 * bdrv_aio_cancel completes the request or not. */
109 scsi_req_unref(&r
->req
);
114 static uint32_t scsi_init_iovec(SCSIDiskReq
*r
, size_t size
)
116 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
118 if (!r
->iov
.iov_base
) {
120 r
->iov
.iov_base
= qemu_blockalign(s
->qdev
.conf
.bs
, r
->buflen
);
122 r
->iov
.iov_len
= MIN(r
->sector_count
* 512, r
->buflen
);
123 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
124 return r
->qiov
.size
/ 512;
127 static void scsi_disk_save_request(QEMUFile
*f
, SCSIRequest
*req
)
129 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
131 qemu_put_be64s(f
, &r
->sector
);
132 qemu_put_be32s(f
, &r
->sector_count
);
133 qemu_put_be32s(f
, &r
->buflen
);
134 if (r
->buflen
&& r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
135 qemu_put_buffer(f
, r
->iov
.iov_base
, r
->iov
.iov_len
);
139 static void scsi_disk_load_request(QEMUFile
*f
, SCSIRequest
*req
)
141 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
143 qemu_get_be64s(f
, &r
->sector
);
144 qemu_get_be32s(f
, &r
->sector_count
);
145 qemu_get_be32s(f
, &r
->buflen
);
147 scsi_init_iovec(r
, r
->buflen
);
148 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
149 qemu_get_buffer(f
, r
->iov
.iov_base
, r
->iov
.iov_len
);
153 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
156 static void scsi_flush_complete(void * opaque
, int ret
)
158 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
159 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
161 bdrv_acct_done(s
->qdev
.conf
.bs
, &r
->acct
);
164 if (scsi_handle_rw_error(r
, -ret
)) {
169 scsi_req_complete(&r
->req
, GOOD
);
172 if (!r
->req
.io_canceled
) {
173 scsi_req_unref(&r
->req
);
177 static bool scsi_is_cmd_fua(SCSICommand
*cmd
)
179 switch (cmd
->buf
[0]) {
186 return (cmd
->buf
[1] & 8) != 0;
191 case WRITE_VERIFY_10
:
192 case WRITE_VERIFY_12
:
193 case WRITE_VERIFY_16
:
203 static void scsi_write_do_fua(SCSIDiskReq
*r
)
205 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
207 if (scsi_is_cmd_fua(&r
->req
.cmd
)) {
208 bdrv_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, 0, BDRV_ACCT_FLUSH
);
209 r
->req
.aiocb
= bdrv_aio_flush(s
->qdev
.conf
.bs
, scsi_flush_complete
, r
);
213 scsi_req_complete(&r
->req
, GOOD
);
214 if (!r
->req
.io_canceled
) {
215 scsi_req_unref(&r
->req
);
219 static void scsi_dma_complete(void *opaque
, int ret
)
221 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
222 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
224 if (r
->req
.aiocb
!= NULL
) {
226 bdrv_acct_done(s
->qdev
.conf
.bs
, &r
->acct
);
230 if (scsi_handle_rw_error(r
, -ret
)) {
235 r
->sector
+= r
->sector_count
;
237 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
238 scsi_write_do_fua(r
);
241 scsi_req_complete(&r
->req
, GOOD
);
245 if (!r
->req
.io_canceled
) {
246 scsi_req_unref(&r
->req
);
250 static void scsi_read_complete(void * opaque
, int ret
)
252 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
253 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
256 if (r
->req
.aiocb
!= NULL
) {
258 bdrv_acct_done(s
->qdev
.conf
.bs
, &r
->acct
);
262 if (scsi_handle_rw_error(r
, -ret
)) {
267 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->qiov
.size
);
269 n
= r
->qiov
.size
/ 512;
271 r
->sector_count
-= n
;
272 scsi_req_data(&r
->req
, r
->qiov
.size
);
275 if (!r
->req
.io_canceled
) {
276 scsi_req_unref(&r
->req
);
280 /* Read more data from scsi device into buffer. */
281 static void scsi_read_data(SCSIRequest
*req
)
283 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
284 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
287 if (r
->sector_count
== (uint32_t)-1) {
288 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
290 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
293 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
294 if (r
->sector_count
== 0) {
295 /* This also clears the sense buffer for REQUEST SENSE. */
296 scsi_req_complete(&r
->req
, GOOD
);
300 /* No data transfer may already be in progress */
301 assert(r
->req
.aiocb
== NULL
);
303 /* The request is used as the AIO opaque value, so add a ref. */
304 scsi_req_ref(&r
->req
);
305 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
306 DPRINTF("Data transfer direction invalid\n");
307 scsi_read_complete(r
, -EINVAL
);
312 scsi_read_complete(r
, -ENOMEDIUM
);
317 dma_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, r
->req
.sg
, BDRV_ACCT_READ
);
318 r
->req
.resid
-= r
->req
.sg
->size
;
319 r
->req
.aiocb
= dma_bdrv_read(s
->qdev
.conf
.bs
, r
->req
.sg
, r
->sector
,
320 scsi_dma_complete
, r
);
322 n
= scsi_init_iovec(r
, SCSI_DMA_BUF_SIZE
);
323 bdrv_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_READ
);
324 r
->req
.aiocb
= bdrv_aio_readv(s
->qdev
.conf
.bs
, r
->sector
, &r
->qiov
, n
,
325 scsi_read_complete
, r
);
330 * scsi_handle_rw_error has two return values. 0 means that the error
331 * must be ignored, 1 means that the error has been processed and the
332 * caller should not do anything else for this request. Note that
333 * scsi_handle_rw_error always manages its reference counts, independent
334 * of the return value.
336 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
)
338 int is_read
= (r
->req
.cmd
.xfer
== SCSI_XFER_FROM_DEV
);
339 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
340 BlockErrorAction action
= bdrv_get_on_error(s
->qdev
.conf
.bs
, is_read
);
342 if (action
== BLOCK_ERR_IGNORE
) {
343 bdrv_emit_qmp_error_event(s
->qdev
.conf
.bs
, BDRV_ACTION_IGNORE
, is_read
);
347 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
348 || action
== BLOCK_ERR_STOP_ANY
) {
350 bdrv_emit_qmp_error_event(s
->qdev
.conf
.bs
, BDRV_ACTION_STOP
, is_read
);
351 vm_stop(RUN_STATE_IO_ERROR
);
352 bdrv_iostatus_set_err(s
->qdev
.conf
.bs
, error
);
353 scsi_req_retry(&r
->req
);
357 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
360 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
363 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
366 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
369 bdrv_emit_qmp_error_event(s
->qdev
.conf
.bs
, BDRV_ACTION_REPORT
, is_read
);
374 static void scsi_write_complete(void * opaque
, int ret
)
376 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
377 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
380 if (r
->req
.aiocb
!= NULL
) {
382 bdrv_acct_done(s
->qdev
.conf
.bs
, &r
->acct
);
386 if (scsi_handle_rw_error(r
, -ret
)) {
391 n
= r
->qiov
.size
/ 512;
393 r
->sector_count
-= n
;
394 if (r
->sector_count
== 0) {
395 scsi_write_do_fua(r
);
398 scsi_init_iovec(r
, SCSI_DMA_BUF_SIZE
);
399 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, r
->qiov
.size
);
400 scsi_req_data(&r
->req
, r
->qiov
.size
);
404 if (!r
->req
.io_canceled
) {
405 scsi_req_unref(&r
->req
);
409 static void scsi_write_data(SCSIRequest
*req
)
411 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
412 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
415 /* No data transfer may already be in progress */
416 assert(r
->req
.aiocb
== NULL
);
418 /* The request is used as the AIO opaque value, so add a ref. */
419 scsi_req_ref(&r
->req
);
420 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
421 DPRINTF("Data transfer direction invalid\n");
422 scsi_write_complete(r
, -EINVAL
);
426 if (!r
->req
.sg
&& !r
->qiov
.size
) {
427 /* Called for the first time. Ask the driver to send us more data. */
428 scsi_write_complete(r
, 0);
432 scsi_write_complete(r
, -ENOMEDIUM
);
436 if (r
->req
.cmd
.buf
[0] == VERIFY_10
|| r
->req
.cmd
.buf
[0] == VERIFY_12
||
437 r
->req
.cmd
.buf
[0] == VERIFY_16
) {
439 scsi_dma_complete(r
, 0);
441 scsi_write_complete(r
, 0);
447 dma_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, r
->req
.sg
, BDRV_ACCT_WRITE
);
448 r
->req
.resid
-= r
->req
.sg
->size
;
449 r
->req
.aiocb
= dma_bdrv_write(s
->qdev
.conf
.bs
, r
->req
.sg
, r
->sector
,
450 scsi_dma_complete
, r
);
452 n
= r
->qiov
.size
/ 512;
453 bdrv_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_WRITE
);
454 r
->req
.aiocb
= bdrv_aio_writev(s
->qdev
.conf
.bs
, r
->sector
, &r
->qiov
, n
,
455 scsi_write_complete
, r
);
459 /* Return a pointer to the data buffer. */
460 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
462 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
464 return (uint8_t *)r
->iov
.iov_base
;
467 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
469 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
472 if (req
->cmd
.buf
[1] & 0x2) {
473 /* Command support data - optional, not implemented */
474 BADF("optional INQUIRY command support request not implemented\n");
478 if (req
->cmd
.buf
[1] & 0x1) {
479 /* Vital product data */
480 uint8_t page_code
= req
->cmd
.buf
[2];
481 if (req
->cmd
.xfer
< 4) {
482 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
483 "less than 4\n", page_code
, req
->cmd
.xfer
);
487 outbuf
[buflen
++] = s
->qdev
.type
& 0x1f;
488 outbuf
[buflen
++] = page_code
; // this page
489 outbuf
[buflen
++] = 0x00;
492 case 0x00: /* Supported page codes, mandatory */
495 DPRINTF("Inquiry EVPD[Supported pages] "
496 "buffer size %zd\n", req
->cmd
.xfer
);
498 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
500 outbuf
[buflen
++] = 0x80; // unit serial number
502 outbuf
[buflen
++] = 0x83; // device identification
503 if (s
->qdev
.type
== TYPE_DISK
) {
504 outbuf
[buflen
++] = 0xb0; // block limits
505 outbuf
[buflen
++] = 0xb2; // thin provisioning
507 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
510 case 0x80: /* Device serial number, optional */
515 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
519 l
= strlen(s
->serial
);
524 DPRINTF("Inquiry EVPD[Serial number] "
525 "buffer size %zd\n", req
->cmd
.xfer
);
526 outbuf
[buflen
++] = l
;
527 memcpy(outbuf
+buflen
, s
->serial
, l
);
532 case 0x83: /* Device identification page, mandatory */
534 const char *str
= s
->serial
?: bdrv_get_device_name(s
->qdev
.conf
.bs
);
535 int max_len
= s
->serial
? 20 : 255 - 8;
536 int id_len
= strlen(str
);
538 if (id_len
> max_len
) {
541 DPRINTF("Inquiry EVPD[Device identification] "
542 "buffer size %zd\n", req
->cmd
.xfer
);
544 outbuf
[buflen
++] = 4 + id_len
;
545 outbuf
[buflen
++] = 0x2; // ASCII
546 outbuf
[buflen
++] = 0; // not officially assigned
547 outbuf
[buflen
++] = 0; // reserved
548 outbuf
[buflen
++] = id_len
; // length of data following
550 memcpy(outbuf
+buflen
, str
, id_len
);
554 case 0xb0: /* block limits */
556 unsigned int unmap_sectors
=
557 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
558 unsigned int min_io_size
=
559 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
560 unsigned int opt_io_size
=
561 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
563 if (s
->qdev
.type
== TYPE_ROM
) {
564 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
568 /* required VPD size with unmap support */
569 outbuf
[3] = buflen
= 0x3c;
571 memset(outbuf
+ 4, 0, buflen
- 4);
573 /* optimal transfer length granularity */
574 outbuf
[6] = (min_io_size
>> 8) & 0xff;
575 outbuf
[7] = min_io_size
& 0xff;
577 /* optimal transfer length */
578 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
579 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
580 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
581 outbuf
[15] = opt_io_size
& 0xff;
583 /* optimal unmap granularity */
584 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
585 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
586 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
587 outbuf
[31] = unmap_sectors
& 0xff;
590 case 0xb2: /* thin provisioning */
592 outbuf
[3] = buflen
= 8;
594 outbuf
[5] = 0x40; /* write same with unmap supported */
600 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
601 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
608 /* Standard INQUIRY data */
609 if (req
->cmd
.buf
[2] != 0) {
610 BADF("Error: Inquiry (STANDARD) page or code "
611 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
616 if (req
->cmd
.xfer
< 5) {
617 BADF("Error: Inquiry (STANDARD) buffer size %zd "
618 "is less than 5\n", req
->cmd
.xfer
);
622 buflen
= req
->cmd
.xfer
;
623 if (buflen
> SCSI_MAX_INQUIRY_LEN
) {
624 buflen
= SCSI_MAX_INQUIRY_LEN
;
626 memset(outbuf
, 0, buflen
);
628 outbuf
[0] = s
->qdev
.type
& 0x1f;
629 outbuf
[1] = s
->removable
? 0x80 : 0;
630 if (s
->qdev
.type
== TYPE_ROM
) {
631 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
633 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
635 memcpy(&outbuf
[8], "QEMU ", 8);
636 memset(&outbuf
[32], 0, 4);
637 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
639 * We claim conformance to SPC-3, which is required for guests
640 * to ask for modern features like READ CAPACITY(16) or the
641 * block characteristics VPD page by default. Not all of SPC-3
642 * is actually implemented, but we're good enough.
645 outbuf
[3] = 2; /* Format 2 */
648 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
650 /* If the allocation length of CDB is too small,
651 the additional length is not adjusted */
655 /* Sync data transfer and TCQ. */
656 outbuf
[7] = 0x10 | (req
->bus
->info
->tcq
? 0x02 : 0);
660 static inline bool media_is_dvd(SCSIDiskState
*s
)
663 if (s
->qdev
.type
!= TYPE_ROM
) {
666 if (!bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
669 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
670 return nb_sectors
> CD_MAX_SECTORS
;
673 static inline bool media_is_cd(SCSIDiskState
*s
)
676 if (s
->qdev
.type
!= TYPE_ROM
) {
679 if (!bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
682 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
683 return nb_sectors
<= CD_MAX_SECTORS
;
686 static int scsi_read_dvd_structure(SCSIDiskState
*s
, SCSIDiskReq
*r
,
689 static const int rds_caps_size
[5] = {
696 uint8_t media
= r
->req
.cmd
.buf
[1];
697 uint8_t layer
= r
->req
.cmd
.buf
[6];
698 uint8_t format
= r
->req
.cmd
.buf
[7];
701 if (s
->qdev
.type
!= TYPE_ROM
) {
705 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
709 if (format
!= 0xff) {
710 if (s
->tray_open
|| !bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
711 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
714 if (media_is_cd(s
)) {
715 scsi_check_condition(r
, SENSE_CODE(INCOMPATIBLE_FORMAT
));
718 if (format
>= ARRAY_SIZE(rds_caps_size
)) {
721 size
= rds_caps_size
[format
];
722 memset(outbuf
, 0, size
);
727 /* Physical format information */
732 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
734 outbuf
[4] = 1; /* DVD-ROM, part version 1 */
735 outbuf
[5] = 0xf; /* 120mm disc, minimum rate unspecified */
736 outbuf
[6] = 1; /* one layer, read-only (per MMC-2 spec) */
737 outbuf
[7] = 0; /* default densities */
739 stl_be_p(&outbuf
[12], (nb_sectors
>> 2) - 1); /* end sector */
740 stl_be_p(&outbuf
[16], (nb_sectors
>> 2) - 1); /* l0 end sector */
744 case 0x01: /* DVD copyright information, all zeros */
747 case 0x03: /* BCA information - invalid field for no BCA info */
750 case 0x04: /* DVD disc manufacturing information, all zeros */
753 case 0xff: { /* List capabilities */
756 for (i
= 0; i
< ARRAY_SIZE(rds_caps_size
); i
++) {
757 if (!rds_caps_size
[i
]) {
761 outbuf
[size
+ 1] = 0x40; /* Not writable, readable */
762 stw_be_p(&outbuf
[size
+ 2], rds_caps_size
[i
]);
772 /* Size of buffer, not including 2 byte size field */
773 stw_be_p(outbuf
, size
- 2);
780 static int scsi_event_status_media(SCSIDiskState
*s
, uint8_t *outbuf
)
782 uint8_t event_code
, media_status
;
786 media_status
= MS_TRAY_OPEN
;
787 } else if (bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
788 media_status
= MS_MEDIA_PRESENT
;
791 /* Event notification descriptor */
792 event_code
= MEC_NO_CHANGE
;
793 if (media_status
!= MS_TRAY_OPEN
) {
794 if (s
->media_event
) {
795 event_code
= MEC_NEW_MEDIA
;
796 s
->media_event
= false;
797 } else if (s
->eject_request
) {
798 event_code
= MEC_EJECT_REQUESTED
;
799 s
->eject_request
= false;
803 outbuf
[0] = event_code
;
804 outbuf
[1] = media_status
;
806 /* These fields are reserved, just clear them. */
812 static int scsi_get_event_status_notification(SCSIDiskState
*s
, SCSIDiskReq
*r
,
816 uint8_t *buf
= r
->req
.cmd
.buf
;
817 uint8_t notification_class_request
= buf
[4];
818 if (s
->qdev
.type
!= TYPE_ROM
) {
821 if ((buf
[1] & 1) == 0) {
827 outbuf
[0] = outbuf
[1] = 0;
828 outbuf
[3] = 1 << GESN_MEDIA
; /* supported events */
829 if (notification_class_request
& (1 << GESN_MEDIA
)) {
830 outbuf
[2] = GESN_MEDIA
;
831 size
+= scsi_event_status_media(s
, &outbuf
[size
]);
835 stw_be_p(outbuf
, size
- 4);
839 static int scsi_get_configuration(SCSIDiskState
*s
, uint8_t *outbuf
)
843 if (s
->qdev
.type
!= TYPE_ROM
) {
846 current
= media_is_dvd(s
) ? MMC_PROFILE_DVD_ROM
: MMC_PROFILE_CD_ROM
;
847 memset(outbuf
, 0, 40);
848 stl_be_p(&outbuf
[0], 36); /* Bytes after the data length field */
849 stw_be_p(&outbuf
[6], current
);
850 /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
851 outbuf
[10] = 0x03; /* persistent, current */
852 outbuf
[11] = 8; /* two profiles */
853 stw_be_p(&outbuf
[12], MMC_PROFILE_DVD_ROM
);
854 outbuf
[14] = (current
== MMC_PROFILE_DVD_ROM
);
855 stw_be_p(&outbuf
[16], MMC_PROFILE_CD_ROM
);
856 outbuf
[18] = (current
== MMC_PROFILE_CD_ROM
);
857 /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
858 stw_be_p(&outbuf
[20], 1);
859 outbuf
[22] = 0x08 | 0x03; /* version 2, persistent, current */
861 stl_be_p(&outbuf
[24], 1); /* SCSI */
862 outbuf
[28] = 1; /* DBE = 1, mandatory */
863 /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
864 stw_be_p(&outbuf
[32], 3);
865 outbuf
[34] = 0x08 | 0x03; /* version 2, persistent, current */
867 outbuf
[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
868 /* TODO: Random readable, CD read, DVD read, drive serial number,
873 static int scsi_emulate_mechanism_status(SCSIDiskState
*s
, uint8_t *outbuf
)
875 if (s
->qdev
.type
!= TYPE_ROM
) {
878 memset(outbuf
, 0, 8);
879 outbuf
[5] = 1; /* CD-ROM */
883 static int mode_sense_page(SCSIDiskState
*s
, int page
, uint8_t **p_outbuf
,
886 static const int mode_sense_valid
[0x3f] = {
887 [MODE_PAGE_HD_GEOMETRY
] = (1 << TYPE_DISK
),
888 [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY
] = (1 << TYPE_DISK
),
889 [MODE_PAGE_CACHING
] = (1 << TYPE_DISK
) | (1 << TYPE_ROM
),
890 [MODE_PAGE_R_W_ERROR
] = (1 << TYPE_DISK
) | (1 << TYPE_ROM
),
891 [MODE_PAGE_AUDIO_CTL
] = (1 << TYPE_ROM
),
892 [MODE_PAGE_CAPABILITIES
] = (1 << TYPE_ROM
),
895 BlockDriverState
*bdrv
= s
->qdev
.conf
.bs
;
896 int cylinders
, heads
, secs
;
897 uint8_t *p
= *p_outbuf
;
899 if ((mode_sense_valid
[page
] & (1 << s
->qdev
.type
)) == 0) {
906 * If Changeable Values are requested, a mask denoting those mode parameters
907 * that are changeable shall be returned. As we currently don't support
908 * parameter changes via MODE_SELECT all bits are returned set to zero.
909 * The buffer was already menset to zero by the caller of this function.
912 case MODE_PAGE_HD_GEOMETRY
:
914 if (page_control
== 1) { /* Changeable Values */
917 /* if a geometry hint is available, use it */
918 bdrv_guess_geometry(bdrv
, &cylinders
, &heads
, &secs
);
919 p
[2] = (cylinders
>> 16) & 0xff;
920 p
[3] = (cylinders
>> 8) & 0xff;
921 p
[4] = cylinders
& 0xff;
923 /* Write precomp start cylinder, disabled */
924 p
[6] = (cylinders
>> 16) & 0xff;
925 p
[7] = (cylinders
>> 8) & 0xff;
926 p
[8] = cylinders
& 0xff;
927 /* Reduced current start cylinder, disabled */
928 p
[9] = (cylinders
>> 16) & 0xff;
929 p
[10] = (cylinders
>> 8) & 0xff;
930 p
[11] = cylinders
& 0xff;
931 /* Device step rate [ns], 200ns */
934 /* Landing zone cylinder */
938 /* Medium rotation rate [rpm], 5400 rpm */
939 p
[20] = (5400 >> 8) & 0xff;
943 case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY
:
945 if (page_control
== 1) { /* Changeable Values */
948 /* Transfer rate [kbit/s], 5Mbit/s */
951 /* if a geometry hint is available, use it */
952 bdrv_guess_geometry(bdrv
, &cylinders
, &heads
, &secs
);
955 p
[6] = s
->qdev
.blocksize
>> 8;
956 p
[8] = (cylinders
>> 8) & 0xff;
957 p
[9] = cylinders
& 0xff;
958 /* Write precomp start cylinder, disabled */
959 p
[10] = (cylinders
>> 8) & 0xff;
960 p
[11] = cylinders
& 0xff;
961 /* Reduced current start cylinder, disabled */
962 p
[12] = (cylinders
>> 8) & 0xff;
963 p
[13] = cylinders
& 0xff;
964 /* Device step rate [100us], 100us */
967 /* Device step pulse width [us], 1us */
969 /* Device head settle delay [100us], 100us */
972 /* Motor on delay [0.1s], 0.1s */
974 /* Motor off delay [0.1s], 0.1s */
976 /* Medium rotation rate [rpm], 5400 rpm */
977 p
[28] = (5400 >> 8) & 0xff;
981 case MODE_PAGE_CACHING
:
984 if (page_control
== 1) { /* Changeable Values */
987 if (bdrv_enable_write_cache(s
->qdev
.conf
.bs
)) {
992 case MODE_PAGE_R_W_ERROR
:
994 p
[2] = 0x80; /* Automatic Write Reallocation Enabled */
995 if (s
->qdev
.type
== TYPE_ROM
) {
996 p
[3] = 0x20; /* Read Retry Count */
1000 case MODE_PAGE_AUDIO_CTL
:
1004 case MODE_PAGE_CAPABILITIES
:
1006 if (page_control
== 1) { /* Changeable Values */
1010 p
[2] = 0x3b; /* CD-R & CD-RW read */
1011 p
[3] = 0; /* Writing not supported */
1012 p
[4] = 0x7f; /* Audio, composite, digital out,
1013 mode 2 form 1&2, multi session */
1014 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
1015 RW corrected, C2 errors, ISRC,
1017 p
[6] = 0x2d | (s
->tray_locked
? 2 : 0);
1018 /* Locking supported, jumper present, eject, tray */
1019 p
[7] = 0; /* no volume & mute control, no
1021 p
[8] = (50 * 176) >> 8; /* 50x read speed */
1022 p
[9] = (50 * 176) & 0xff;
1023 p
[10] = 2 >> 8; /* Two volume levels */
1025 p
[12] = 2048 >> 8; /* 2M buffer */
1026 p
[13] = 2048 & 0xff;
1027 p
[14] = (16 * 176) >> 8; /* 16x read speed current */
1028 p
[15] = (16 * 176) & 0xff;
1029 p
[18] = (16 * 176) >> 8; /* 16x write speed */
1030 p
[19] = (16 * 176) & 0xff;
1031 p
[20] = (16 * 176) >> 8; /* 16x write speed current */
1032 p
[21] = (16 * 176) & 0xff;
1039 *p_outbuf
+= p
[1] + 2;
1043 static int scsi_disk_emulate_mode_sense(SCSIDiskReq
*r
, uint8_t *outbuf
)
1045 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
1046 uint64_t nb_sectors
;
1047 int page
, dbd
, buflen
, ret
, page_control
;
1049 uint8_t dev_specific_param
;
1051 dbd
= r
->req
.cmd
.buf
[1] & 0x8;
1052 page
= r
->req
.cmd
.buf
[2] & 0x3f;
1053 page_control
= (r
->req
.cmd
.buf
[2] & 0xc0) >> 6;
1054 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
1055 (r
->req
.cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, r
->req
.cmd
.xfer
, page_control
);
1056 memset(outbuf
, 0, r
->req
.cmd
.xfer
);
1059 if (bdrv_is_read_only(s
->qdev
.conf
.bs
)) {
1060 dev_specific_param
= 0x80; /* Readonly. */
1062 dev_specific_param
= 0x00;
1065 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
1066 p
[1] = 0; /* Default media type. */
1067 p
[2] = dev_specific_param
;
1068 p
[3] = 0; /* Block descriptor length. */
1070 } else { /* MODE_SENSE_10 */
1071 p
[2] = 0; /* Default media type. */
1072 p
[3] = dev_specific_param
;
1073 p
[6] = p
[7] = 0; /* Block descriptor length. */
1077 /* MMC prescribes that CD/DVD drives have no block descriptors. */
1078 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1079 if (!dbd
&& s
->qdev
.type
== TYPE_DISK
&& nb_sectors
) {
1080 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
1081 outbuf
[3] = 8; /* Block descriptor length */
1082 } else { /* MODE_SENSE_10 */
1083 outbuf
[7] = 8; /* Block descriptor length */
1085 nb_sectors
/= (s
->qdev
.blocksize
/ 512);
1086 if (nb_sectors
> 0xffffff) {
1089 p
[0] = 0; /* media density code */
1090 p
[1] = (nb_sectors
>> 16) & 0xff;
1091 p
[2] = (nb_sectors
>> 8) & 0xff;
1092 p
[3] = nb_sectors
& 0xff;
1093 p
[4] = 0; /* reserved */
1094 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
1095 p
[6] = s
->qdev
.blocksize
>> 8;
1100 if (page_control
== 3) {
1102 scsi_check_condition(r
, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED
));
1107 for (page
= 0; page
<= 0x3e; page
++) {
1108 mode_sense_page(s
, page
, &p
, page_control
);
1111 ret
= mode_sense_page(s
, page
, &p
, page_control
);
1117 buflen
= p
- outbuf
;
1119 * The mode data length field specifies the length in bytes of the
1120 * following data that is available to be transferred. The mode data
1121 * length does not include itself.
1123 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
1124 outbuf
[0] = buflen
- 1;
1125 } else { /* MODE_SENSE_10 */
1126 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
1127 outbuf
[1] = (buflen
- 2) & 0xff;
1132 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
1134 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1135 int start_track
, format
, msf
, toclen
;
1136 uint64_t nb_sectors
;
1138 msf
= req
->cmd
.buf
[1] & 2;
1139 format
= req
->cmd
.buf
[2] & 0xf;
1140 start_track
= req
->cmd
.buf
[6];
1141 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1142 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
1143 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1146 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
1149 /* multi session : only a single session defined */
1151 memset(outbuf
, 0, 12);
1157 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
1165 static int scsi_disk_emulate_start_stop(SCSIDiskReq
*r
)
1167 SCSIRequest
*req
= &r
->req
;
1168 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1169 bool start
= req
->cmd
.buf
[4] & 1;
1170 bool loej
= req
->cmd
.buf
[4] & 2; /* load on start, eject on !start */
1172 if (s
->qdev
.type
== TYPE_ROM
&& loej
) {
1173 if (!start
&& !s
->tray_open
&& s
->tray_locked
) {
1174 scsi_check_condition(r
,
1175 bdrv_is_inserted(s
->qdev
.conf
.bs
)
1176 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED
)
1177 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED
));
1181 if (s
->tray_open
!= !start
) {
1182 bdrv_eject(s
->qdev
.conf
.bs
, !start
);
1183 s
->tray_open
= !start
;
1189 static int scsi_disk_emulate_command(SCSIDiskReq
*r
)
1191 SCSIRequest
*req
= &r
->req
;
1192 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1193 uint64_t nb_sectors
;
1197 if (!r
->iov
.iov_base
) {
1199 * FIXME: we shouldn't return anything bigger than 4k, but the code
1200 * requires the buffer to be as big as req->cmd.xfer in several
1201 * places. So, do not allow CDBs with a very large ALLOCATION
1202 * LENGTH. The real fix would be to modify scsi_read_data and
1203 * dma_buf_read, so that they return data beyond the buflen
1206 if (req
->cmd
.xfer
> 65536) {
1207 goto illegal_request
;
1209 r
->buflen
= MAX(4096, req
->cmd
.xfer
);
1210 r
->iov
.iov_base
= qemu_blockalign(s
->qdev
.conf
.bs
, r
->buflen
);
1213 outbuf
= r
->iov
.iov_base
;
1214 switch (req
->cmd
.buf
[0]) {
1215 case TEST_UNIT_READY
:
1216 assert(!s
->tray_open
&& bdrv_is_inserted(s
->qdev
.conf
.bs
));
1219 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
1221 goto illegal_request
;
1226 buflen
= scsi_disk_emulate_mode_sense(r
, outbuf
);
1228 goto illegal_request
;
1232 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
1234 goto illegal_request
;
1238 if (req
->cmd
.buf
[1] & 1) {
1239 goto illegal_request
;
1243 if (req
->cmd
.buf
[1] & 3) {
1244 goto illegal_request
;
1248 if (req
->cmd
.buf
[1] & 1) {
1249 goto illegal_request
;
1253 if (req
->cmd
.buf
[1] & 3) {
1254 goto illegal_request
;
1258 if (scsi_disk_emulate_start_stop(r
) < 0) {
1262 case ALLOW_MEDIUM_REMOVAL
:
1263 s
->tray_locked
= req
->cmd
.buf
[4] & 1;
1264 bdrv_lock_medium(s
->qdev
.conf
.bs
, req
->cmd
.buf
[4] & 1);
1266 case READ_CAPACITY_10
:
1267 /* The normal LEN field for this command is zero. */
1268 memset(outbuf
, 0, 8);
1269 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1271 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
1274 if ((req
->cmd
.buf
[8] & 1) == 0 && req
->cmd
.lba
) {
1275 goto illegal_request
;
1277 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1278 /* Returned value is the address of the last sector. */
1280 /* Remember the new size for read/write sanity checking. */
1281 s
->qdev
.max_lba
= nb_sectors
;
1282 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
1283 if (nb_sectors
> UINT32_MAX
) {
1284 nb_sectors
= UINT32_MAX
;
1286 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
1287 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
1288 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
1289 outbuf
[3] = nb_sectors
& 0xff;
1292 outbuf
[6] = s
->qdev
.blocksize
>> 8;
1297 /* Just return "NO SENSE". */
1298 buflen
= scsi_build_sense(NULL
, 0, outbuf
, r
->buflen
,
1299 (req
->cmd
.buf
[1] & 1) == 0);
1301 case MECHANISM_STATUS
:
1302 buflen
= scsi_emulate_mechanism_status(s
, outbuf
);
1304 goto illegal_request
;
1307 case GET_CONFIGURATION
:
1308 buflen
= scsi_get_configuration(s
, outbuf
);
1310 goto illegal_request
;
1313 case GET_EVENT_STATUS_NOTIFICATION
:
1314 buflen
= scsi_get_event_status_notification(s
, r
, outbuf
);
1316 goto illegal_request
;
1319 case READ_DVD_STRUCTURE
:
1320 buflen
= scsi_read_dvd_structure(s
, r
, outbuf
);
1322 goto illegal_request
;
1325 case SERVICE_ACTION_IN_16
:
1326 /* Service Action In subcommands. */
1327 if ((req
->cmd
.buf
[1] & 31) == SAI_READ_CAPACITY_16
) {
1328 DPRINTF("SAI READ CAPACITY(16)\n");
1329 memset(outbuf
, 0, req
->cmd
.xfer
);
1330 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1332 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
1335 if ((req
->cmd
.buf
[14] & 1) == 0 && req
->cmd
.lba
) {
1336 goto illegal_request
;
1338 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1339 /* Returned value is the address of the last sector. */
1341 /* Remember the new size for read/write sanity checking. */
1342 s
->qdev
.max_lba
= nb_sectors
;
1343 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
1344 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
1345 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
1346 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
1347 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
1348 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
1349 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
1350 outbuf
[7] = nb_sectors
& 0xff;
1353 outbuf
[10] = s
->qdev
.blocksize
>> 8;
1356 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
1358 /* set TPE bit if the format supports discard */
1359 if (s
->qdev
.conf
.discard_granularity
) {
1363 /* Protection, exponent and lowest lba field left blank. */
1364 buflen
= req
->cmd
.xfer
;
1367 DPRINTF("Unsupported Service Action In\n");
1368 goto illegal_request
;
1370 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1373 buflen
= MIN(buflen
, req
->cmd
.xfer
);
1377 if (r
->req
.status
== -1) {
1378 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1383 /* Execute a scsi command. Returns the length of the data expected by the
1384 command. This will be Positive for data transfers from the device
1385 (eg. disk reads), negative for transfers to the device (eg. disk writes),
1386 and zero if the command does not transfer any data. */
1388 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
1390 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1391 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1397 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req
->lun
, req
->tag
, buf
[0]);
1402 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
1403 printf(" 0x%02x", buf
[i
]);
1418 case ALLOW_MEDIUM_REMOVAL
:
1419 case GET_CONFIGURATION
:
1420 case GET_EVENT_STATUS_NOTIFICATION
:
1421 case MECHANISM_STATUS
:
1426 if (s
->tray_open
|| !bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
1427 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
1434 case TEST_UNIT_READY
:
1443 case ALLOW_MEDIUM_REMOVAL
:
1444 case READ_CAPACITY_10
:
1446 case READ_DVD_STRUCTURE
:
1447 case GET_CONFIGURATION
:
1448 case GET_EVENT_STATUS_NOTIFICATION
:
1449 case MECHANISM_STATUS
:
1450 case SERVICE_ACTION_IN_16
:
1452 rc
= scsi_disk_emulate_command(r
);
1457 r
->iov
.iov_len
= rc
;
1459 case SYNCHRONIZE_CACHE
:
1460 /* The request is used as the AIO opaque value, so add a ref. */
1461 scsi_req_ref(&r
->req
);
1462 bdrv_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, 0, BDRV_ACCT_FLUSH
);
1463 r
->req
.aiocb
= bdrv_aio_flush(s
->qdev
.conf
.bs
, scsi_flush_complete
, r
);
1469 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1470 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1471 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1474 r
->sector
= r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512);
1475 r
->sector_count
= len
* (s
->qdev
.blocksize
/ 512);
1484 case WRITE_VERIFY_10
:
1485 case WRITE_VERIFY_12
:
1486 case WRITE_VERIFY_16
:
1487 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1488 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1489 (command
& 0xe) == 0xe ? "And Verify " : "",
1490 r
->req
.cmd
.lba
, len
);
1491 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1494 r
->sector
= r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512);
1495 r
->sector_count
= len
* (s
->qdev
.blocksize
/ 512);
1498 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1499 /* We don't support mode parameter changes.
1500 Allow the mode parameter header + block descriptors only. */
1501 if (r
->req
.cmd
.xfer
> 12) {
1505 case MODE_SELECT_10
:
1506 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1507 /* We don't support mode parameter changes.
1508 Allow the mode parameter header + block descriptors only. */
1509 if (r
->req
.cmd
.xfer
> 16) {
1514 DPRINTF("Seek(10) (sector %" PRId64
")\n", r
->req
.cmd
.lba
);
1515 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1520 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1522 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1523 r
->req
.cmd
.lba
, len
);
1525 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1530 * We only support WRITE SAME with the unmap bit set for now.
1532 if (!(buf
[1] & 0x8)) {
1536 rc
= bdrv_discard(s
->qdev
.conf
.bs
,
1537 r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512),
1538 len
* (s
->qdev
.blocksize
/ 512));
1540 /* XXX: better error code ?*/
1546 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1547 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1550 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1553 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1556 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1557 scsi_req_complete(&r
->req
, GOOD
);
1559 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1560 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
1563 if (!r
->sector_count
) {
1564 r
->sector_count
= -1;
1570 static void scsi_disk_reset(DeviceState
*dev
)
1572 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1573 uint64_t nb_sectors
;
1575 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(RESET
));
1577 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1578 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1582 s
->qdev
.max_lba
= nb_sectors
;
1585 static void scsi_destroy(SCSIDevice
*dev
)
1587 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1589 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(NO_SENSE
));
1590 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1593 static void scsi_cd_change_media_cb(void *opaque
, bool load
)
1595 SCSIDiskState
*s
= opaque
;
1598 * When a CD gets changed, we have to report an ejected state and
1599 * then a loaded state to guests so that they detect tray
1600 * open/close and media change events. Guests that do not use
1601 * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
1602 * states rely on this behavior.
1604 * media_changed governs the state machine used for unit attention
1605 * report. media_event is used by GET EVENT STATUS NOTIFICATION.
1607 s
->media_changed
= load
;
1608 s
->tray_open
= !load
;
1609 s
->qdev
.unit_attention
= SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM
);
1610 s
->media_event
= true;
1611 s
->eject_request
= false;
1614 static void scsi_cd_eject_request_cb(void *opaque
, bool force
)
1616 SCSIDiskState
*s
= opaque
;
1618 s
->eject_request
= true;
1620 s
->tray_locked
= false;
1624 static bool scsi_cd_is_tray_open(void *opaque
)
1626 return ((SCSIDiskState
*)opaque
)->tray_open
;
1629 static bool scsi_cd_is_medium_locked(void *opaque
)
1631 return ((SCSIDiskState
*)opaque
)->tray_locked
;
1634 static const BlockDevOps scsi_cd_block_ops
= {
1635 .change_media_cb
= scsi_cd_change_media_cb
,
1636 .eject_request_cb
= scsi_cd_eject_request_cb
,
1637 .is_tray_open
= scsi_cd_is_tray_open
,
1638 .is_medium_locked
= scsi_cd_is_medium_locked
,
1641 static void scsi_disk_unit_attention_reported(SCSIDevice
*dev
)
1643 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1644 if (s
->media_changed
) {
1645 s
->media_changed
= false;
1646 s
->qdev
.unit_attention
= SENSE_CODE(MEDIUM_CHANGED
);
1650 static int scsi_initfn(SCSIDevice
*dev
)
1652 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1655 if (!s
->qdev
.conf
.bs
) {
1656 error_report("drive property not set");
1660 if (!s
->removable
&& !bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
1661 error_report("Device needs media, but drive is empty");
1666 /* try to fall back to value set with legacy -drive serial=... */
1667 dinfo
= drive_get_by_blockdev(s
->qdev
.conf
.bs
);
1668 if (*dinfo
->serial
) {
1669 s
->serial
= g_strdup(dinfo
->serial
);
1674 s
->version
= g_strdup(QEMU_VERSION
);
1677 if (bdrv_is_sg(s
->qdev
.conf
.bs
)) {
1678 error_report("unwanted /dev/sg*");
1683 bdrv_set_dev_ops(s
->qdev
.conf
.bs
, &scsi_cd_block_ops
, s
);
1685 bdrv_set_buffer_alignment(s
->qdev
.conf
.bs
, s
->qdev
.blocksize
);
1687 bdrv_iostatus_enable(s
->qdev
.conf
.bs
);
1688 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, NULL
);
1692 static int scsi_hd_initfn(SCSIDevice
*dev
)
1694 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1695 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1696 s
->qdev
.type
= TYPE_DISK
;
1697 return scsi_initfn(&s
->qdev
);
1700 static int scsi_cd_initfn(SCSIDevice
*dev
)
1702 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1703 s
->qdev
.blocksize
= 2048;
1704 s
->qdev
.type
= TYPE_ROM
;
1705 s
->removable
= true;
1706 return scsi_initfn(&s
->qdev
);
1709 static int scsi_disk_initfn(SCSIDevice
*dev
)
1713 if (!dev
->conf
.bs
) {
1714 return scsi_initfn(dev
); /* ... and die there */
1717 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1718 if (dinfo
->media_cd
) {
1719 return scsi_cd_initfn(dev
);
1721 return scsi_hd_initfn(dev
);
1725 static const SCSIReqOps scsi_disk_reqops
= {
1726 .size
= sizeof(SCSIDiskReq
),
1727 .free_req
= scsi_free_request
,
1728 .send_command
= scsi_send_command
,
1729 .read_data
= scsi_read_data
,
1730 .write_data
= scsi_write_data
,
1731 .cancel_io
= scsi_cancel_io
,
1732 .get_buf
= scsi_get_buf
,
1733 .load_request
= scsi_disk_load_request
,
1734 .save_request
= scsi_disk_save_request
,
1737 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
,
1738 uint8_t *buf
, void *hba_private
)
1740 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1743 req
= scsi_req_alloc(&scsi_disk_reqops
, &s
->qdev
, tag
, lun
, hba_private
);
1748 static int get_device_type(SCSIDiskState
*s
)
1750 BlockDriverState
*bdrv
= s
->qdev
.conf
.bs
;
1753 uint8_t sensebuf
[8];
1754 sg_io_hdr_t io_header
;
1757 memset(cmd
, 0, sizeof(cmd
));
1758 memset(buf
, 0, sizeof(buf
));
1760 cmd
[4] = sizeof(buf
);
1762 memset(&io_header
, 0, sizeof(io_header
));
1763 io_header
.interface_id
= 'S';
1764 io_header
.dxfer_direction
= SG_DXFER_FROM_DEV
;
1765 io_header
.dxfer_len
= sizeof(buf
);
1766 io_header
.dxferp
= buf
;
1767 io_header
.cmdp
= cmd
;
1768 io_header
.cmd_len
= sizeof(cmd
);
1769 io_header
.mx_sb_len
= sizeof(sensebuf
);
1770 io_header
.sbp
= sensebuf
;
1771 io_header
.timeout
= 6000; /* XXX */
1773 ret
= bdrv_ioctl(bdrv
, SG_IO
, &io_header
);
1774 if (ret
< 0 || io_header
.driver_status
|| io_header
.host_status
) {
1777 s
->qdev
.type
= buf
[0];
1778 s
->removable
= (buf
[1] & 0x80) != 0;
1782 static int scsi_block_initfn(SCSIDevice
*dev
)
1784 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1788 if (!s
->qdev
.conf
.bs
) {
1789 error_report("scsi-block: drive property not set");
1793 /* check we are using a driver managing SG_IO (version 3 and after) */
1794 if (bdrv_ioctl(s
->qdev
.conf
.bs
, SG_GET_VERSION_NUM
, &sg_version
) < 0 ||
1795 sg_version
< 30000) {
1796 error_report("scsi-block: scsi generic interface too old");
1800 /* get device type from INQUIRY data */
1801 rc
= get_device_type(s
);
1803 error_report("scsi-block: INQUIRY failed");
1807 /* Make a guess for the block size, we'll fix it when the guest sends.
1808 * READ CAPACITY. If they don't, they likely would assume these sizes
1809 * anyway. (TODO: check in /sys).
1811 if (s
->qdev
.type
== TYPE_ROM
|| s
->qdev
.type
== TYPE_WORM
) {
1812 s
->qdev
.blocksize
= 2048;
1814 s
->qdev
.blocksize
= 512;
1816 return scsi_initfn(&s
->qdev
);
1819 static SCSIRequest
*scsi_block_new_request(SCSIDevice
*d
, uint32_t tag
,
1820 uint32_t lun
, uint8_t *buf
,
1823 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1837 case WRITE_VERIFY_10
:
1838 case WRITE_VERIFY_12
:
1839 case WRITE_VERIFY_16
:
1840 /* If we are not using O_DIRECT, we might read stale data from the
1841 * host cache if writes were made using other commands than these
1842 * ones (such as WRITE SAME or EXTENDED COPY, etc.). So, without
1843 * O_DIRECT everything must go through SG_IO.
1845 if (!(s
->qdev
.conf
.bs
->open_flags
& BDRV_O_NOCACHE
)) {
1849 /* MMC writing cannot be done via pread/pwrite, because it sometimes
1850 * involves writing beyond the maximum LBA or to negative LBA (lead-in).
1851 * And once you do these writes, reading from the block device is
1852 * unreliable, too. It is even possible that reads deliver random data
1853 * from the host page cache (this is probably a Linux bug).
1855 * We might use scsi_disk_reqops as long as no writing commands are
1856 * seen, but performance usually isn't paramount on optical media. So,
1857 * just make scsi-block operate the same as scsi-generic for them.
1859 if (s
->qdev
.type
== TYPE_ROM
) {
1862 return scsi_req_alloc(&scsi_disk_reqops
, &s
->qdev
, tag
, lun
,
1866 return scsi_req_alloc(&scsi_generic_req_ops
, &s
->qdev
, tag
, lun
,
1871 #define DEFINE_SCSI_DISK_PROPERTIES() \
1872 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1873 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1874 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1876 static Property scsi_hd_properties
[] = {
1877 DEFINE_SCSI_DISK_PROPERTIES(),
1878 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1879 DEFINE_PROP_END_OF_LIST(),
1882 static const VMStateDescription vmstate_scsi_disk_state
= {
1883 .name
= "scsi-disk",
1885 .minimum_version_id
= 1,
1886 .minimum_version_id_old
= 1,
1887 .fields
= (VMStateField
[]) {
1888 VMSTATE_SCSI_DEVICE(qdev
, SCSIDiskState
),
1889 VMSTATE_BOOL(media_changed
, SCSIDiskState
),
1890 VMSTATE_BOOL(media_event
, SCSIDiskState
),
1891 VMSTATE_BOOL(eject_request
, SCSIDiskState
),
1892 VMSTATE_BOOL(tray_open
, SCSIDiskState
),
1893 VMSTATE_BOOL(tray_locked
, SCSIDiskState
),
1894 VMSTATE_END_OF_LIST()
1898 static void scsi_hd_class_initfn(ObjectClass
*klass
, void *data
)
1900 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1901 SCSIDeviceClass
*sc
= SCSI_DEVICE_CLASS(klass
);
1903 sc
->init
= scsi_hd_initfn
;
1904 sc
->destroy
= scsi_destroy
;
1905 sc
->alloc_req
= scsi_new_request
;
1906 sc
->unit_attention_reported
= scsi_disk_unit_attention_reported
;
1907 dc
->fw_name
= "disk";
1908 dc
->desc
= "virtual SCSI disk";
1909 dc
->reset
= scsi_disk_reset
;
1910 dc
->props
= scsi_hd_properties
;
1911 dc
->vmsd
= &vmstate_scsi_disk_state
;
1914 static TypeInfo scsi_hd_info
= {
1916 .parent
= TYPE_SCSI_DEVICE
,
1917 .instance_size
= sizeof(SCSIDiskState
),
1918 .class_init
= scsi_hd_class_initfn
,
1921 static Property scsi_cd_properties
[] = {
1922 DEFINE_SCSI_DISK_PROPERTIES(),
1923 DEFINE_PROP_END_OF_LIST(),
1926 static void scsi_cd_class_initfn(ObjectClass
*klass
, void *data
)
1928 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1929 SCSIDeviceClass
*sc
= SCSI_DEVICE_CLASS(klass
);
1931 sc
->init
= scsi_cd_initfn
;
1932 sc
->destroy
= scsi_destroy
;
1933 sc
->alloc_req
= scsi_new_request
;
1934 sc
->unit_attention_reported
= scsi_disk_unit_attention_reported
;
1935 dc
->fw_name
= "disk";
1936 dc
->desc
= "virtual SCSI CD-ROM";
1937 dc
->reset
= scsi_disk_reset
;
1938 dc
->props
= scsi_cd_properties
;
1939 dc
->vmsd
= &vmstate_scsi_disk_state
;
1942 static TypeInfo scsi_cd_info
= {
1944 .parent
= TYPE_SCSI_DEVICE
,
1945 .instance_size
= sizeof(SCSIDiskState
),
1946 .class_init
= scsi_cd_class_initfn
,
1950 static Property scsi_block_properties
[] = {
1951 DEFINE_SCSI_DISK_PROPERTIES(),
1952 DEFINE_PROP_END_OF_LIST(),
1955 static void scsi_block_class_initfn(ObjectClass
*klass
, void *data
)
1957 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1958 SCSIDeviceClass
*sc
= SCSI_DEVICE_CLASS(klass
);
1960 sc
->init
= scsi_block_initfn
;
1961 sc
->destroy
= scsi_destroy
;
1962 sc
->alloc_req
= scsi_block_new_request
;
1963 dc
->fw_name
= "disk";
1964 dc
->desc
= "SCSI block device passthrough";
1965 dc
->reset
= scsi_disk_reset
;
1966 dc
->props
= scsi_block_properties
;
1967 dc
->vmsd
= &vmstate_scsi_disk_state
;
1970 static TypeInfo scsi_block_info
= {
1971 .name
= "scsi-block",
1972 .parent
= TYPE_SCSI_DEVICE
,
1973 .instance_size
= sizeof(SCSIDiskState
),
1974 .class_init
= scsi_block_class_initfn
,
1978 static Property scsi_disk_properties
[] = {
1979 DEFINE_SCSI_DISK_PROPERTIES(),
1980 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1981 DEFINE_PROP_END_OF_LIST(),
1984 static void scsi_disk_class_initfn(ObjectClass
*klass
, void *data
)
1986 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1987 SCSIDeviceClass
*sc
= SCSI_DEVICE_CLASS(klass
);
1989 sc
->init
= scsi_disk_initfn
;
1990 sc
->destroy
= scsi_destroy
;
1991 sc
->alloc_req
= scsi_new_request
;
1992 sc
->unit_attention_reported
= scsi_disk_unit_attention_reported
;
1993 dc
->fw_name
= "disk";
1994 dc
->desc
= "virtual SCSI disk or CD-ROM (legacy)";
1995 dc
->reset
= scsi_disk_reset
;
1996 dc
->props
= scsi_disk_properties
;
1997 dc
->vmsd
= &vmstate_scsi_disk_state
;
2000 static TypeInfo scsi_disk_info
= {
2001 .name
= "scsi-disk",
2002 .parent
= TYPE_SCSI_DEVICE
,
2003 .instance_size
= sizeof(SCSIDiskState
),
2004 .class_init
= scsi_disk_class_initfn
,
2007 static void scsi_disk_register_types(void)
2009 type_register_static(&scsi_hd_info
);
2010 type_register_static(&scsi_cd_info
);
2012 type_register_static(&scsi_block_info
);
2014 type_register_static(&scsi_disk_info
);
2017 type_init(scsi_disk_register_types
)