2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licenced under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
41 #define SCSI_DMA_BUF_SIZE 131072
42 #define SCSI_MAX_INQUIRY_LEN 256
44 #define SCSI_REQ_STATUS_RETRY 0x01
45 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46 #define SCSI_REQ_STATUS_RETRY_READ 0x00
47 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
49 typedef struct SCSIDiskState SCSIDiskState
;
51 typedef struct SCSIDiskReq
{
53 /* ??? We should probably keep track of whether the data transfer is
54 a read or a write. Currently we rely on the host getting it right. */
55 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
57 uint32_t sector_count
;
67 /* The qemu block layer uses a fixed 512 byte sector size.
68 This is the number of 512 byte blocks in a single scsi sector. */
76 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
78 static SCSIDiskReq
*scsi_new_request(SCSIDiskState
*s
, uint32_t tag
,
84 req
= scsi_req_alloc(sizeof(SCSIDiskReq
), &s
->qdev
, tag
, lun
);
85 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
86 r
->iov
.iov_base
= qemu_blockalign(s
->bs
, SCSI_DMA_BUF_SIZE
);
90 static void scsi_remove_request(SCSIDiskReq
*r
)
92 qemu_vfree(r
->iov
.iov_base
);
93 scsi_req_free(&r
->req
);
96 static SCSIDiskReq
*scsi_find_request(SCSIDiskState
*s
, uint32_t tag
)
98 return DO_UPCAST(SCSIDiskReq
, req
, scsi_req_find(&s
->qdev
, tag
));
101 static void scsi_req_set_status(SCSIRequest
*req
, int status
, int sense_code
)
103 req
->status
= status
;
104 scsi_dev_set_sense(req
->dev
, sense_code
);
107 /* Helper function for command completion. */
108 static void scsi_command_complete(SCSIDiskReq
*r
, int status
, int sense
)
110 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
111 r
->req
.tag
, status
, sense
);
112 scsi_req_set_status(&r
->req
, status
, sense
);
113 scsi_req_complete(&r
->req
);
114 scsi_remove_request(r
);
117 /* Cancel a pending data transfer. */
118 static void scsi_cancel_io(SCSIDevice
*d
, uint32_t tag
)
120 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
122 DPRINTF("Cancel tag=0x%x\n", tag
);
123 r
= scsi_find_request(s
, tag
);
126 bdrv_aio_cancel(r
->req
.aiocb
);
128 scsi_remove_request(r
);
132 static void scsi_read_complete(void * opaque
, int ret
)
134 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
140 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
145 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->iov
.iov_len
);
147 n
= r
->iov
.iov_len
/ 512;
149 r
->sector_count
-= n
;
150 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
154 static void scsi_read_request(SCSIDiskReq
*r
)
156 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
159 if (r
->sector_count
== (uint32_t)-1) {
160 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
162 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, r
->iov
.iov_len
);
165 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
166 if (r
->sector_count
== 0) {
167 scsi_command_complete(r
, GOOD
, NO_SENSE
);
172 if (n
> SCSI_DMA_BUF_SIZE
/ 512)
173 n
= SCSI_DMA_BUF_SIZE
/ 512;
175 r
->iov
.iov_len
= n
* 512;
176 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
177 r
->req
.aiocb
= bdrv_aio_readv(s
->bs
, r
->sector
, &r
->qiov
, n
,
178 scsi_read_complete
, r
);
179 if (r
->req
.aiocb
== NULL
)
180 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
183 /* Read more data from scsi device into buffer. */
184 static void scsi_read_data(SCSIDevice
*d
, uint32_t tag
)
186 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
189 r
= scsi_find_request(s
, tag
);
191 BADF("Bad read tag 0x%x\n", tag
);
192 /* ??? This is the wrong error. */
193 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
197 /* No data transfer may already be in progress */
198 assert(r
->req
.aiocb
== NULL
);
200 scsi_read_request(r
);
203 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
205 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
206 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
207 BlockErrorAction action
= bdrv_get_on_error(s
->bs
, is_read
);
209 if (action
== BLOCK_ERR_IGNORE
) {
210 bdrv_mon_event(s
->bs
, BDRV_ACTION_IGNORE
, is_read
);
214 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
215 || action
== BLOCK_ERR_STOP_ANY
) {
217 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
218 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
220 bdrv_mon_event(s
->bs
, BDRV_ACTION_STOP
, is_read
);
223 if (type
== SCSI_REQ_STATUS_RETRY_READ
) {
224 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, 0);
226 scsi_command_complete(r
, CHECK_CONDITION
,
228 bdrv_mon_event(s
->bs
, BDRV_ACTION_REPORT
, is_read
);
234 static void scsi_write_complete(void * opaque
, int ret
)
236 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
243 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
248 n
= r
->iov
.iov_len
/ 512;
250 r
->sector_count
-= n
;
251 if (r
->sector_count
== 0) {
252 scsi_command_complete(r
, GOOD
, NO_SENSE
);
254 len
= r
->sector_count
* 512;
255 if (len
> SCSI_DMA_BUF_SIZE
) {
256 len
= SCSI_DMA_BUF_SIZE
;
258 r
->iov
.iov_len
= len
;
259 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, len
);
260 r
->req
.bus
->complete(r
->req
.bus
, SCSI_REASON_DATA
, r
->req
.tag
, len
);
264 static void scsi_write_request(SCSIDiskReq
*r
)
266 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
269 n
= r
->iov
.iov_len
/ 512;
271 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
272 r
->req
.aiocb
= bdrv_aio_writev(s
->bs
, r
->sector
, &r
->qiov
, n
,
273 scsi_write_complete
, r
);
274 if (r
->req
.aiocb
== NULL
)
275 scsi_command_complete(r
, CHECK_CONDITION
,
278 /* Invoke completion routine to fetch data from host. */
279 scsi_write_complete(r
, 0);
283 /* Write data to a scsi device. Returns nonzero on failure.
284 The transfer may complete asynchronously. */
285 static int scsi_write_data(SCSIDevice
*d
, uint32_t tag
)
287 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
290 DPRINTF("Write data tag=0x%x\n", tag
);
291 r
= scsi_find_request(s
, tag
);
293 BADF("Bad write tag 0x%x\n", tag
);
294 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
298 /* No data transfer may already be in progress */
299 assert(r
->req
.aiocb
== NULL
);
301 scsi_write_request(r
);
306 static void scsi_dma_restart_bh(void *opaque
)
308 SCSIDiskState
*s
= opaque
;
312 qemu_bh_delete(s
->bh
);
315 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
316 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
317 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
318 int status
= r
->status
;
320 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
322 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
323 case SCSI_REQ_STATUS_RETRY_READ
:
324 scsi_read_request(r
);
326 case SCSI_REQ_STATUS_RETRY_WRITE
:
327 scsi_write_request(r
);
334 static void scsi_dma_restart_cb(void *opaque
, int running
, int reason
)
336 SCSIDiskState
*s
= opaque
;
342 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
343 qemu_bh_schedule(s
->bh
);
347 /* Return a pointer to the data buffer. */
348 static uint8_t *scsi_get_buf(SCSIDevice
*d
, uint32_t tag
)
350 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
353 r
= scsi_find_request(s
, tag
);
355 BADF("Bad buffer tag 0x%x\n", tag
);
358 return (uint8_t *)r
->iov
.iov_base
;
361 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
363 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
366 if (req
->cmd
.buf
[1] & 0x2) {
367 /* Command support data - optional, not implemented */
368 BADF("optional INQUIRY command support request not implemented\n");
372 if (req
->cmd
.buf
[1] & 0x1) {
373 /* Vital product data */
374 uint8_t page_code
= req
->cmd
.buf
[2];
375 if (req
->cmd
.xfer
< 4) {
376 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
377 "less than 4\n", page_code
, req
->cmd
.xfer
);
381 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
382 outbuf
[buflen
++] = 5;
384 outbuf
[buflen
++] = 0;
386 outbuf
[buflen
++] = page_code
; // this page
387 outbuf
[buflen
++] = 0x00;
390 case 0x00: /* Supported page codes, mandatory */
391 DPRINTF("Inquiry EVPD[Supported pages] "
392 "buffer size %zd\n", req
->cmd
.xfer
);
393 outbuf
[buflen
++] = 4; // number of pages
394 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
395 outbuf
[buflen
++] = 0x80; // unit serial number
396 outbuf
[buflen
++] = 0x83; // device identification
397 outbuf
[buflen
++] = 0xb0; // block device characteristics
400 case 0x80: /* Device serial number, optional */
402 int l
= strlen(s
->serial
);
404 if (l
> req
->cmd
.xfer
)
409 DPRINTF("Inquiry EVPD[Serial number] "
410 "buffer size %zd\n", req
->cmd
.xfer
);
411 outbuf
[buflen
++] = l
;
412 memcpy(outbuf
+buflen
, s
->serial
, l
);
417 case 0x83: /* Device identification page, mandatory */
419 int max_len
= 255 - 8;
420 int id_len
= strlen(bdrv_get_device_name(s
->bs
));
422 if (id_len
> max_len
)
424 DPRINTF("Inquiry EVPD[Device identification] "
425 "buffer size %zd\n", req
->cmd
.xfer
);
427 outbuf
[buflen
++] = 3 + id_len
;
428 outbuf
[buflen
++] = 0x2; // ASCII
429 outbuf
[buflen
++] = 0; // not officially assigned
430 outbuf
[buflen
++] = 0; // reserved
431 outbuf
[buflen
++] = id_len
; // length of data following
433 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->bs
), id_len
);
437 case 0xb0: /* block device characteristics */
439 unsigned int min_io_size
=
440 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
441 unsigned int opt_io_size
=
442 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
444 /* required VPD size with unmap support */
445 outbuf
[3] = buflen
= 0x3c;
447 memset(outbuf
+ 4, 0, buflen
- 4);
449 /* optimal transfer length granularity */
450 outbuf
[6] = (min_io_size
>> 8) & 0xff;
451 outbuf
[7] = min_io_size
& 0xff;
453 /* optimal transfer length */
454 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
455 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
456 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
457 outbuf
[15] = opt_io_size
& 0xff;
461 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
462 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
469 /* Standard INQUIRY data */
470 if (req
->cmd
.buf
[2] != 0) {
471 BADF("Error: Inquiry (STANDARD) page or code "
472 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
477 if (req
->cmd
.xfer
< 5) {
478 BADF("Error: Inquiry (STANDARD) buffer size %zd "
479 "is less than 5\n", req
->cmd
.xfer
);
483 buflen
= req
->cmd
.xfer
;
484 if (buflen
> SCSI_MAX_INQUIRY_LEN
)
485 buflen
= SCSI_MAX_INQUIRY_LEN
;
487 memset(outbuf
, 0, buflen
);
489 if (req
->lun
|| req
->cmd
.buf
[1] >> 5) {
490 outbuf
[0] = 0x7f; /* LUN not supported */
494 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
) {
497 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
500 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
502 memcpy(&outbuf
[8], "QEMU ", 8);
503 memset(&outbuf
[32], 0, 4);
504 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
506 * We claim conformance to SPC-3, which is required for guests
507 * to ask for modern features like READ CAPACITY(16) or the
508 * block characteristics VPD page by default. Not all of SPC-3
509 * is actually implemented, but we're good enough.
512 outbuf
[3] = 2; /* Format 2 */
515 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
517 /* If the allocation length of CDB is too small,
518 the additional length is not adjusted */
522 /* Sync data transfer and TCQ. */
523 outbuf
[7] = 0x10 | (req
->bus
->tcq
? 0x02 : 0);
527 static int mode_sense_page(SCSIRequest
*req
, int page
, uint8_t *p
,
530 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
531 BlockDriverState
*bdrv
= s
->bs
;
532 int cylinders
, heads
, secs
;
535 * If Changeable Values are requested, a mask denoting those mode parameters
536 * that are changeable shall be returned. As we currently don't support
537 * parameter changes via MODE_SELECT all bits are returned set to zero.
538 * The buffer was already menset to zero by the caller of this function.
541 case 4: /* Rigid disk device geometry page. */
544 if (page_control
== 1) { /* Changeable Values */
547 /* if a geometry hint is available, use it */
548 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
549 p
[2] = (cylinders
>> 16) & 0xff;
550 p
[3] = (cylinders
>> 8) & 0xff;
551 p
[4] = cylinders
& 0xff;
553 /* Write precomp start cylinder, disabled */
554 p
[6] = (cylinders
>> 16) & 0xff;
555 p
[7] = (cylinders
>> 8) & 0xff;
556 p
[8] = cylinders
& 0xff;
557 /* Reduced current start cylinder, disabled */
558 p
[9] = (cylinders
>> 16) & 0xff;
559 p
[10] = (cylinders
>> 8) & 0xff;
560 p
[11] = cylinders
& 0xff;
561 /* Device step rate [ns], 200ns */
564 /* Landing zone cylinder */
568 /* Medium rotation rate [rpm], 5400 rpm */
569 p
[20] = (5400 >> 8) & 0xff;
573 case 5: /* Flexible disk device geometry page. */
576 if (page_control
== 1) { /* Changeable Values */
579 /* Transfer rate [kbit/s], 5Mbit/s */
582 /* if a geometry hint is available, use it */
583 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
586 p
[6] = s
->cluster_size
* 2;
587 p
[8] = (cylinders
>> 8) & 0xff;
588 p
[9] = cylinders
& 0xff;
589 /* Write precomp start cylinder, disabled */
590 p
[10] = (cylinders
>> 8) & 0xff;
591 p
[11] = cylinders
& 0xff;
592 /* Reduced current start cylinder, disabled */
593 p
[12] = (cylinders
>> 8) & 0xff;
594 p
[13] = cylinders
& 0xff;
595 /* Device step rate [100us], 100us */
598 /* Device step pulse width [us], 1us */
600 /* Device head settle delay [100us], 100us */
603 /* Motor on delay [0.1s], 0.1s */
605 /* Motor off delay [0.1s], 0.1s */
607 /* Medium rotation rate [rpm], 5400 rpm */
608 p
[28] = (5400 >> 8) & 0xff;
612 case 8: /* Caching page. */
615 if (page_control
== 1) { /* Changeable Values */
618 if (bdrv_enable_write_cache(s
->bs
)) {
623 case 0x2a: /* CD Capabilities and Mechanical Status page. */
624 if (bdrv_get_type_hint(bdrv
) != BDRV_TYPE_CDROM
)
628 if (page_control
== 1) { /* Changeable Values */
631 p
[2] = 3; // CD-R & CD-RW read
632 p
[3] = 0; // Writing not supported
633 p
[4] = 0x7f; /* Audio, composite, digital out,
634 mode 2 form 1&2, multi session */
635 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
636 RW corrected, C2 errors, ISRC,
638 p
[6] = 0x2d | (bdrv_is_locked(s
->bs
)? 2 : 0);
639 /* Locking supported, jumper present, eject, tray */
640 p
[7] = 0; /* no volume & mute control, no
642 p
[8] = (50 * 176) >> 8; // 50x read speed
643 p
[9] = (50 * 176) & 0xff;
644 p
[10] = 0 >> 8; // No volume
646 p
[12] = 2048 >> 8; // 2M buffer
648 p
[14] = (16 * 176) >> 8; // 16x read speed current
649 p
[15] = (16 * 176) & 0xff;
650 p
[18] = (16 * 176) >> 8; // 16x write speed
651 p
[19] = (16 * 176) & 0xff;
652 p
[20] = (16 * 176) >> 8; // 16x write speed current
653 p
[21] = (16 * 176) & 0xff;
661 static int scsi_disk_emulate_mode_sense(SCSIRequest
*req
, uint8_t *outbuf
)
663 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
665 int page
, dbd
, buflen
, page_control
;
667 uint8_t dev_specific_param
;
669 dbd
= req
->cmd
.buf
[1] & 0x8;
670 page
= req
->cmd
.buf
[2] & 0x3f;
671 page_control
= (req
->cmd
.buf
[2] & 0xc0) >> 6;
672 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
673 (req
->cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, req
->cmd
.xfer
, page_control
);
674 memset(outbuf
, 0, req
->cmd
.xfer
);
677 if (bdrv_is_read_only(s
->bs
)) {
678 dev_specific_param
= 0x80; /* Readonly. */
680 dev_specific_param
= 0x00;
683 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
684 p
[1] = 0; /* Default media type. */
685 p
[2] = dev_specific_param
;
686 p
[3] = 0; /* Block descriptor length. */
688 } else { /* MODE_SENSE_10 */
689 p
[2] = 0; /* Default media type. */
690 p
[3] = dev_specific_param
;
691 p
[6] = p
[7] = 0; /* Block descriptor length. */
695 bdrv_get_geometry(s
->bs
, &nb_sectors
);
696 if (!dbd
&& nb_sectors
) {
697 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
698 outbuf
[3] = 8; /* Block descriptor length */
699 } else { /* MODE_SENSE_10 */
700 outbuf
[7] = 8; /* Block descriptor length */
702 nb_sectors
/= s
->cluster_size
;
703 if (nb_sectors
> 0xffffff)
705 p
[0] = 0; /* media density code */
706 p
[1] = (nb_sectors
>> 16) & 0xff;
707 p
[2] = (nb_sectors
>> 8) & 0xff;
708 p
[3] = nb_sectors
& 0xff;
709 p
[4] = 0; /* reserved */
710 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
711 p
[6] = s
->cluster_size
* 2;
716 if (page_control
== 3) { /* Saved Values */
717 return -1; /* ILLEGAL_REQUEST */
725 p
+= mode_sense_page(req
, page
, p
, page_control
);
728 p
+= mode_sense_page(req
, 0x08, p
, page_control
);
729 p
+= mode_sense_page(req
, 0x2a, p
, page_control
);
732 return -1; /* ILLEGAL_REQUEST */
737 * The mode data length field specifies the length in bytes of the
738 * following data that is available to be transferred. The mode data
739 * length does not include itself.
741 if (req
->cmd
.buf
[0] == MODE_SENSE
) {
742 outbuf
[0] = buflen
- 1;
743 } else { /* MODE_SENSE_10 */
744 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
745 outbuf
[1] = (buflen
- 2) & 0xff;
747 if (buflen
> req
->cmd
.xfer
)
748 buflen
= req
->cmd
.xfer
;
752 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
754 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
755 int start_track
, format
, msf
, toclen
;
758 msf
= req
->cmd
.buf
[1] & 2;
759 format
= req
->cmd
.buf
[2] & 0xf;
760 start_track
= req
->cmd
.buf
[6];
761 bdrv_get_geometry(s
->bs
, &nb_sectors
);
762 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
763 nb_sectors
/= s
->cluster_size
;
766 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
769 /* multi session : only a single session defined */
771 memset(outbuf
, 0, 12);
777 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
782 if (toclen
> req
->cmd
.xfer
)
783 toclen
= req
->cmd
.xfer
;
787 static int scsi_disk_emulate_command(SCSIDiskReq
*r
, uint8_t *outbuf
)
789 SCSIRequest
*req
= &r
->req
;
790 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
794 switch (req
->cmd
.buf
[0]) {
795 case TEST_UNIT_READY
:
796 if (!bdrv_is_inserted(s
->bs
))
800 if (req
->cmd
.xfer
< 4)
801 goto illegal_request
;
802 memset(outbuf
, 0, 4);
804 if (req
->dev
->sense
.key
== NOT_READY
&& req
->cmd
.xfer
>= 18) {
805 memset(outbuf
, 0, 18);
808 /* asc 0x3a, ascq 0: Medium not present */
814 outbuf
[2] = req
->dev
->sense
.key
;
815 scsi_dev_clear_sense(req
->dev
);
818 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
820 goto illegal_request
;
824 buflen
= scsi_disk_emulate_mode_sense(req
, outbuf
);
826 goto illegal_request
;
829 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
831 goto illegal_request
;
834 if (req
->cmd
.buf
[1] & 1)
835 goto illegal_request
;
838 if (req
->cmd
.buf
[1] & 3)
839 goto illegal_request
;
842 if (req
->cmd
.buf
[1] & 1)
843 goto illegal_request
;
846 if (req
->cmd
.buf
[1] & 3)
847 goto illegal_request
;
850 if (bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
&& (req
->cmd
.buf
[4] & 2)) {
851 /* load/eject medium */
852 bdrv_eject(s
->bs
, !(req
->cmd
.buf
[4] & 1));
855 case ALLOW_MEDIUM_REMOVAL
:
856 bdrv_set_locked(s
->bs
, req
->cmd
.buf
[4] & 1);
859 /* The normal LEN field for this command is zero. */
860 memset(outbuf
, 0, 8);
861 bdrv_get_geometry(s
->bs
, &nb_sectors
);
864 nb_sectors
/= s
->cluster_size
;
865 /* Returned value is the address of the last sector. */
867 /* Remember the new size for read/write sanity checking. */
868 s
->max_lba
= nb_sectors
;
869 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
870 if (nb_sectors
> UINT32_MAX
)
871 nb_sectors
= UINT32_MAX
;
872 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
873 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
874 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
875 outbuf
[3] = nb_sectors
& 0xff;
878 outbuf
[6] = s
->cluster_size
* 2;
882 case SYNCHRONIZE_CACHE
:
885 case GET_CONFIGURATION
:
886 memset(outbuf
, 0, 8);
887 /* ??? This should probably return much more information. For now
888 just return the basic header indicating the CD-ROM profile. */
889 outbuf
[7] = 8; // CD-ROM
892 case SERVICE_ACTION_IN
:
893 /* Service Action In subcommands. */
894 if ((req
->cmd
.buf
[1] & 31) == 0x10) {
895 DPRINTF("SAI READ CAPACITY(16)\n");
896 memset(outbuf
, 0, req
->cmd
.xfer
);
897 bdrv_get_geometry(s
->bs
, &nb_sectors
);
900 nb_sectors
/= s
->cluster_size
;
901 /* Returned value is the address of the last sector. */
903 /* Remember the new size for read/write sanity checking. */
904 s
->max_lba
= nb_sectors
;
905 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
906 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
907 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
908 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
909 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
910 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
911 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
912 outbuf
[7] = nb_sectors
& 0xff;
915 outbuf
[10] = s
->cluster_size
* 2;
918 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
919 /* Protection, exponent and lowest lba field left blank. */
920 buflen
= req
->cmd
.xfer
;
923 DPRINTF("Unsupported Service Action In\n");
924 goto illegal_request
;
926 if (req
->cmd
.xfer
< 16)
927 goto illegal_request
;
928 memset(outbuf
, 0, 16);
935 DPRINTF("Rezero Unit\n");
936 if (!bdrv_is_inserted(s
->bs
)) {
941 goto illegal_request
;
943 scsi_req_set_status(req
, GOOD
, NO_SENSE
);
947 scsi_command_complete(r
, CHECK_CONDITION
, NOT_READY
);
951 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
955 /* Execute a scsi command. Returns the length of the data expected by the
956 command. This will be Positive for data transfers from the device
957 (eg. disk reads), negative for transfers to the device (eg. disk writes),
958 and zero if the command does not transfer any data. */
960 static int32_t scsi_send_command(SCSIDevice
*d
, uint32_t tag
,
961 uint8_t *buf
, int lun
)
963 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
974 r
= scsi_find_request(s
, tag
);
976 BADF("Tag 0x%x already in use\n", tag
);
977 scsi_cancel_io(d
, tag
);
979 /* ??? Tags are not unique for different luns. We only implement a
980 single lun, so this should not matter. */
981 r
= scsi_new_request(s
, tag
, lun
);
982 outbuf
= (uint8_t *)r
->iov
.iov_base
;
984 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun
, tag
, buf
[0]);
985 switch (command
>> 5) {
987 lba
= (uint64_t) buf
[3] | ((uint64_t) buf
[2] << 8) |
988 (((uint64_t) buf
[1] & 0x1f) << 16);
994 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
995 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
996 len
= buf
[8] | (buf
[7] << 8);
1000 lba
= (uint64_t) buf
[9] | ((uint64_t) buf
[8] << 8) |
1001 ((uint64_t) buf
[7] << 16) | ((uint64_t) buf
[6] << 24) |
1002 ((uint64_t) buf
[5] << 32) | ((uint64_t) buf
[4] << 40) |
1003 ((uint64_t) buf
[3] << 48) | ((uint64_t) buf
[2] << 56);
1004 len
= buf
[13] | (buf
[12] << 8) | (buf
[11] << 16) | (buf
[10] << 24);
1008 lba
= (uint64_t) buf
[5] | ((uint64_t) buf
[4] << 8) |
1009 ((uint64_t) buf
[3] << 16) | ((uint64_t) buf
[2] << 24);
1010 len
= buf
[9] | (buf
[8] << 8) | (buf
[7] << 16) | (buf
[6] << 24);
1014 BADF("Unsupported command length, command %x\n", command
);
1020 for (i
= 1; i
< cmdlen
; i
++) {
1021 printf(" 0x%02x", buf
[i
]);
1027 if (scsi_req_parse(&r
->req
, buf
) != 0) {
1028 BADF("Unsupported command length, command %x\n", command
);
1031 assert(r
->req
.cmd
.len
== cmdlen
);
1032 assert(r
->req
.cmd
.lba
== lba
);
1034 if (lun
|| buf
[1] >> 5) {
1035 /* Only LUN 0 supported. */
1036 DPRINTF("Unimplemented LUN %d\n", lun
? lun
: buf
[1] >> 5);
1037 if (command
!= REQUEST_SENSE
&& command
!= INQUIRY
)
1041 case TEST_UNIT_READY
:
1051 case ALLOW_MEDIUM_REMOVAL
:
1053 case SYNCHRONIZE_CACHE
:
1055 case GET_CONFIGURATION
:
1056 case SERVICE_ACTION_IN
:
1060 rc
= scsi_disk_emulate_command(r
, outbuf
);
1065 r
->iov
.iov_len
= rc
;
1071 DPRINTF("Read (sector %" PRId64
", count %d)\n", lba
, len
);
1072 if (lba
> s
->max_lba
)
1074 r
->sector
= lba
* s
->cluster_size
;
1075 r
->sector_count
= len
* s
->cluster_size
;
1082 case WRITE_VERIFY_12
:
1083 case WRITE_VERIFY_16
:
1084 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1085 (command
& 0xe) == 0xe ? "And Verify " : "", lba
, len
);
1086 if (lba
> s
->max_lba
)
1088 r
->sector
= lba
* s
->cluster_size
;
1089 r
->sector_count
= len
* s
->cluster_size
;
1093 DPRINTF("Mode Select(6) (len %d)\n", len
);
1094 /* We don't support mode parameter changes.
1095 Allow the mode parameter header + block descriptors only. */
1100 case MODE_SELECT_10
:
1101 DPRINTF("Mode Select(10) (len %d)\n", len
);
1102 /* We don't support mode parameter changes.
1103 Allow the mode parameter header + block descriptors only. */
1110 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10, lba
);
1111 if (lba
> s
->max_lba
) {
1116 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1118 scsi_command_complete(r
, CHECK_CONDITION
, ILLEGAL_REQUEST
);
1121 scsi_command_complete(r
, CHECK_CONDITION
, HARDWARE_ERROR
);
1124 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1125 scsi_command_complete(r
, GOOD
, NO_SENSE
);
1127 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1131 if (!r
->sector_count
)
1132 r
->sector_count
= -1;
1137 static void scsi_disk_purge_requests(SCSIDiskState
*s
)
1141 while (!QTAILQ_EMPTY(&s
->qdev
.requests
)) {
1142 r
= DO_UPCAST(SCSIDiskReq
, req
, QTAILQ_FIRST(&s
->qdev
.requests
));
1144 bdrv_aio_cancel(r
->req
.aiocb
);
1146 scsi_remove_request(r
);
1150 static void scsi_disk_reset(DeviceState
*dev
)
1152 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1153 uint64_t nb_sectors
;
1155 scsi_disk_purge_requests(s
);
1157 bdrv_get_geometry(s
->bs
, &nb_sectors
);
1158 nb_sectors
/= s
->cluster_size
;
1162 s
->max_lba
= nb_sectors
;
1165 static void scsi_destroy(SCSIDevice
*dev
)
1167 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1169 scsi_disk_purge_requests(s
);
1170 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1173 static int scsi_disk_initfn(SCSIDevice
*dev
)
1175 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1179 if (!s
->qdev
.conf
.bs
) {
1180 error_report("scsi-disk: drive property not set");
1183 s
->bs
= s
->qdev
.conf
.bs
;
1184 is_cd
= bdrv_get_type_hint(s
->bs
) == BDRV_TYPE_CDROM
;
1186 if (!is_cd
&& !bdrv_is_inserted(s
->bs
)) {
1187 error_report("Device needs media, but drive is empty");
1192 /* try to fall back to value set with legacy -drive serial=... */
1193 dinfo
= drive_get_by_blockdev(s
->bs
);
1194 s
->serial
= qemu_strdup(*dinfo
->serial
? dinfo
->serial
: "0");
1198 s
->version
= qemu_strdup(QEMU_VERSION
);
1201 if (bdrv_is_sg(s
->bs
)) {
1202 error_report("scsi-disk: unwanted /dev/sg*");
1207 s
->qdev
.blocksize
= 2048;
1209 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1211 s
->cluster_size
= s
->qdev
.blocksize
/ 512;
1212 s
->bs
->buffer_alignment
= s
->qdev
.blocksize
;
1214 s
->qdev
.type
= TYPE_DISK
;
1215 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1216 bdrv_set_removable(s
->bs
, is_cd
);
1220 static SCSIDeviceInfo scsi_disk_info
= {
1221 .qdev
.name
= "scsi-disk",
1222 .qdev
.desc
= "virtual scsi disk or cdrom",
1223 .qdev
.size
= sizeof(SCSIDiskState
),
1224 .qdev
.reset
= scsi_disk_reset
,
1225 .init
= scsi_disk_initfn
,
1226 .destroy
= scsi_destroy
,
1227 .send_command
= scsi_send_command
,
1228 .read_data
= scsi_read_data
,
1229 .write_data
= scsi_write_data
,
1230 .cancel_io
= scsi_cancel_io
,
1231 .get_buf
= scsi_get_buf
,
1232 .qdev
.props
= (Property
[]) {
1233 DEFINE_BLOCK_PROPERTIES(SCSIDiskState
, qdev
.conf
),
1234 DEFINE_PROP_STRING("ver", SCSIDiskState
, version
),
1235 DEFINE_PROP_STRING("serial", SCSIDiskState
, serial
),
1236 DEFINE_PROP_END_OF_LIST(),
1240 static void scsi_disk_register_devices(void)
1242 scsi_qdev_register(&scsi_disk_info
);
1244 device_init(scsi_disk_register_devices
)