2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10 * when the allocation length of CDB is smaller
12 * 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13 * MODE SENSE response.
15 * This code is licensed under the LGPL.
17 * Note that this file only handles the SCSI architecture model and device
18 * commands. Emulation of interface/link layer protocols is handled by
19 * the host adapter emulator.
25 #define DPRINTF(fmt, ...) \
26 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
28 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
34 #include "qemu-common.h"
35 #include "qemu-error.h"
37 #include "scsi-defs.h"
40 #include "block_int.h"
42 #define SCSI_DMA_BUF_SIZE 131072
43 #define SCSI_MAX_INQUIRY_LEN 256
45 #define SCSI_REQ_STATUS_RETRY 0x01
46 #define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
47 #define SCSI_REQ_STATUS_RETRY_READ 0x00
48 #define SCSI_REQ_STATUS_RETRY_WRITE 0x02
49 #define SCSI_REQ_STATUS_RETRY_FLUSH 0x04
51 typedef struct SCSIDiskState SCSIDiskState
;
53 typedef struct SCSIDiskReq
{
55 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
57 uint32_t sector_count
;
78 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
);
79 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
);
81 static void scsi_free_request(SCSIRequest
*req
)
83 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
85 if (r
->iov
.iov_base
) {
86 qemu_vfree(r
->iov
.iov_base
);
90 /* Helper function for command completion with sense. */
91 static void scsi_check_condition(SCSIDiskReq
*r
, SCSISense sense
)
93 DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
94 r
->req
.tag
, sense
.key
, sense
.asc
, sense
.ascq
);
95 scsi_req_build_sense(&r
->req
, sense
);
96 scsi_req_complete(&r
->req
, CHECK_CONDITION
);
99 /* Cancel a pending data transfer. */
100 static void scsi_cancel_io(SCSIRequest
*req
)
102 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
104 DPRINTF("Cancel tag=0x%x\n", req
->tag
);
105 r
->status
&= ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
107 bdrv_aio_cancel(r
->req
.aiocb
);
109 /* This reference was left in by scsi_*_data. We take ownership of
110 * it the moment scsi_req_cancel is called, independent of whether
111 * bdrv_aio_cancel completes the request or not. */
112 scsi_req_unref(&r
->req
);
117 static uint32_t scsi_init_iovec(SCSIDiskReq
*r
)
119 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
121 if (!r
->iov
.iov_base
) {
122 r
->buflen
= SCSI_DMA_BUF_SIZE
;
123 r
->iov
.iov_base
= qemu_blockalign(s
->qdev
.conf
.bs
, r
->buflen
);
125 r
->iov
.iov_len
= MIN(r
->sector_count
* 512, r
->buflen
);
126 qemu_iovec_init_external(&r
->qiov
, &r
->iov
, 1);
127 return r
->qiov
.size
/ 512;
130 static void scsi_read_complete(void * opaque
, int ret
)
132 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
133 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
136 if (r
->req
.aiocb
!= NULL
) {
138 bdrv_acct_done(s
->qdev
.conf
.bs
, &r
->acct
);
142 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_READ
)) {
147 DPRINTF("Data ready tag=0x%x len=%zd\n", r
->req
.tag
, r
->qiov
.size
);
149 n
= r
->qiov
.size
/ 512;
151 r
->sector_count
-= n
;
152 scsi_req_data(&r
->req
, r
->qiov
.size
);
155 if (!r
->req
.io_canceled
) {
156 scsi_req_unref(&r
->req
);
160 static void scsi_flush_complete(void * opaque
, int ret
)
162 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
163 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
165 if (r
->req
.aiocb
!= NULL
) {
167 bdrv_acct_done(s
->qdev
.conf
.bs
, &r
->acct
);
171 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_FLUSH
)) {
176 scsi_req_complete(&r
->req
, GOOD
);
179 if (!r
->req
.io_canceled
) {
180 scsi_req_unref(&r
->req
);
184 /* Read more data from scsi device into buffer. */
185 static void scsi_read_data(SCSIRequest
*req
)
187 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
188 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
191 if (r
->sector_count
== (uint32_t)-1) {
192 DPRINTF("Read buf_len=%zd\n", r
->iov
.iov_len
);
194 scsi_req_data(&r
->req
, r
->iov
.iov_len
);
197 DPRINTF("Read sector_count=%d\n", r
->sector_count
);
198 if (r
->sector_count
== 0) {
199 /* This also clears the sense buffer for REQUEST SENSE. */
200 scsi_req_complete(&r
->req
, GOOD
);
204 /* No data transfer may already be in progress */
205 assert(r
->req
.aiocb
== NULL
);
207 /* The request is used as the AIO opaque value, so add a ref. */
208 scsi_req_ref(&r
->req
);
209 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
210 DPRINTF("Data transfer direction invalid\n");
211 scsi_read_complete(r
, -EINVAL
);
216 scsi_read_complete(r
, -ENOMEDIUM
);
220 n
= scsi_init_iovec(r
);
221 bdrv_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_READ
);
222 r
->req
.aiocb
= bdrv_aio_readv(s
->qdev
.conf
.bs
, r
->sector
, &r
->qiov
, n
,
223 scsi_read_complete
, r
);
224 if (r
->req
.aiocb
== NULL
) {
225 scsi_read_complete(r
, -EIO
);
230 * scsi_handle_rw_error has two return values. 0 means that the error
231 * must be ignored, 1 means that the error has been processed and the
232 * caller should not do anything else for this request. Note that
233 * scsi_handle_rw_error always manages its reference counts, independent
234 * of the return value.
236 static int scsi_handle_rw_error(SCSIDiskReq
*r
, int error
, int type
)
238 int is_read
= (type
== SCSI_REQ_STATUS_RETRY_READ
);
239 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
240 BlockErrorAction action
= bdrv_get_on_error(s
->qdev
.conf
.bs
, is_read
);
242 if (action
== BLOCK_ERR_IGNORE
) {
243 bdrv_mon_event(s
->qdev
.conf
.bs
, BDRV_ACTION_IGNORE
, is_read
);
247 if ((error
== ENOSPC
&& action
== BLOCK_ERR_STOP_ENOSPC
)
248 || action
== BLOCK_ERR_STOP_ANY
) {
250 type
&= SCSI_REQ_STATUS_RETRY_TYPE_MASK
;
251 r
->status
|= SCSI_REQ_STATUS_RETRY
| type
;
253 bdrv_mon_event(s
->qdev
.conf
.bs
, BDRV_ACTION_STOP
, is_read
);
254 vm_stop(RUN_STATE_IO_ERROR
);
255 bdrv_iostatus_set_err(s
->qdev
.conf
.bs
, error
);
257 /* No need to save a reference, because scsi_dma_restart_bh just
258 * looks at the request list. If a request is canceled, the
259 * retry request is just dropped.
264 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
267 scsi_check_condition(r
, SENSE_CODE(TARGET_FAILURE
));
270 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
273 scsi_check_condition(r
, SENSE_CODE(IO_ERROR
));
276 bdrv_mon_event(s
->qdev
.conf
.bs
, BDRV_ACTION_REPORT
, is_read
);
281 static void scsi_write_complete(void * opaque
, int ret
)
283 SCSIDiskReq
*r
= (SCSIDiskReq
*)opaque
;
284 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
287 if (r
->req
.aiocb
!= NULL
) {
289 bdrv_acct_done(s
->qdev
.conf
.bs
, &r
->acct
);
293 if (scsi_handle_rw_error(r
, -ret
, SCSI_REQ_STATUS_RETRY_WRITE
)) {
298 n
= r
->qiov
.size
/ 512;
300 r
->sector_count
-= n
;
301 if (r
->sector_count
== 0) {
302 scsi_req_complete(&r
->req
, GOOD
);
305 DPRINTF("Write complete tag=0x%x more=%d\n", r
->req
.tag
, r
->qiov
.size
);
306 scsi_req_data(&r
->req
, r
->qiov
.size
);
310 if (!r
->req
.io_canceled
) {
311 scsi_req_unref(&r
->req
);
315 static void scsi_write_data(SCSIRequest
*req
)
317 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
318 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
321 /* No data transfer may already be in progress */
322 assert(r
->req
.aiocb
== NULL
);
324 /* The request is used as the AIO opaque value, so add a ref. */
325 scsi_req_ref(&r
->req
);
326 if (r
->req
.cmd
.mode
!= SCSI_XFER_TO_DEV
) {
327 DPRINTF("Data transfer direction invalid\n");
328 scsi_write_complete(r
, -EINVAL
);
332 n
= r
->qiov
.size
/ 512;
335 scsi_write_complete(r
, -ENOMEDIUM
);
338 bdrv_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, n
* BDRV_SECTOR_SIZE
, BDRV_ACCT_WRITE
);
339 r
->req
.aiocb
= bdrv_aio_writev(s
->qdev
.conf
.bs
, r
->sector
, &r
->qiov
, n
,
340 scsi_write_complete
, r
);
341 if (r
->req
.aiocb
== NULL
) {
342 scsi_write_complete(r
, -ENOMEM
);
345 /* Called for the first time. Ask the driver to send us more data. */
346 scsi_write_complete(r
, 0);
350 static void scsi_dma_restart_bh(void *opaque
)
352 SCSIDiskState
*s
= opaque
;
356 qemu_bh_delete(s
->bh
);
359 QTAILQ_FOREACH(req
, &s
->qdev
.requests
, next
) {
360 r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
361 if (r
->status
& SCSI_REQ_STATUS_RETRY
) {
362 int status
= r
->status
;
365 ~(SCSI_REQ_STATUS_RETRY
| SCSI_REQ_STATUS_RETRY_TYPE_MASK
);
367 switch (status
& SCSI_REQ_STATUS_RETRY_TYPE_MASK
) {
368 case SCSI_REQ_STATUS_RETRY_READ
:
369 scsi_read_data(&r
->req
);
371 case SCSI_REQ_STATUS_RETRY_WRITE
:
372 scsi_write_data(&r
->req
);
374 case SCSI_REQ_STATUS_RETRY_FLUSH
:
375 scsi_send_command(&r
->req
, r
->req
.cmd
.buf
);
382 static void scsi_dma_restart_cb(void *opaque
, int running
, RunState state
)
384 SCSIDiskState
*s
= opaque
;
390 s
->bh
= qemu_bh_new(scsi_dma_restart_bh
, s
);
391 qemu_bh_schedule(s
->bh
);
395 /* Return a pointer to the data buffer. */
396 static uint8_t *scsi_get_buf(SCSIRequest
*req
)
398 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
400 return (uint8_t *)r
->iov
.iov_base
;
403 static int scsi_disk_emulate_inquiry(SCSIRequest
*req
, uint8_t *outbuf
)
405 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
408 if (req
->cmd
.buf
[1] & 0x2) {
409 /* Command support data - optional, not implemented */
410 BADF("optional INQUIRY command support request not implemented\n");
414 if (req
->cmd
.buf
[1] & 0x1) {
415 /* Vital product data */
416 uint8_t page_code
= req
->cmd
.buf
[2];
417 if (req
->cmd
.xfer
< 4) {
418 BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
419 "less than 4\n", page_code
, req
->cmd
.xfer
);
423 outbuf
[buflen
++] = s
->qdev
.type
& 0x1f;
424 outbuf
[buflen
++] = page_code
; // this page
425 outbuf
[buflen
++] = 0x00;
428 case 0x00: /* Supported page codes, mandatory */
431 DPRINTF("Inquiry EVPD[Supported pages] "
432 "buffer size %zd\n", req
->cmd
.xfer
);
434 outbuf
[buflen
++] = 0x00; // list of supported pages (this page)
436 outbuf
[buflen
++] = 0x80; // unit serial number
438 outbuf
[buflen
++] = 0x83; // device identification
439 if (s
->qdev
.type
== TYPE_DISK
) {
440 outbuf
[buflen
++] = 0xb0; // block limits
441 outbuf
[buflen
++] = 0xb2; // thin provisioning
443 outbuf
[pages
] = buflen
- pages
- 1; // number of pages
446 case 0x80: /* Device serial number, optional */
451 DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
455 l
= strlen(s
->serial
);
456 if (l
> req
->cmd
.xfer
) {
463 DPRINTF("Inquiry EVPD[Serial number] "
464 "buffer size %zd\n", req
->cmd
.xfer
);
465 outbuf
[buflen
++] = l
;
466 memcpy(outbuf
+buflen
, s
->serial
, l
);
471 case 0x83: /* Device identification page, mandatory */
473 int max_len
= 255 - 8;
474 int id_len
= strlen(bdrv_get_device_name(s
->qdev
.conf
.bs
));
476 if (id_len
> max_len
) {
479 DPRINTF("Inquiry EVPD[Device identification] "
480 "buffer size %zd\n", req
->cmd
.xfer
);
482 outbuf
[buflen
++] = 4 + id_len
;
483 outbuf
[buflen
++] = 0x2; // ASCII
484 outbuf
[buflen
++] = 0; // not officially assigned
485 outbuf
[buflen
++] = 0; // reserved
486 outbuf
[buflen
++] = id_len
; // length of data following
488 memcpy(outbuf
+buflen
, bdrv_get_device_name(s
->qdev
.conf
.bs
), id_len
);
492 case 0xb0: /* block limits */
494 unsigned int unmap_sectors
=
495 s
->qdev
.conf
.discard_granularity
/ s
->qdev
.blocksize
;
496 unsigned int min_io_size
=
497 s
->qdev
.conf
.min_io_size
/ s
->qdev
.blocksize
;
498 unsigned int opt_io_size
=
499 s
->qdev
.conf
.opt_io_size
/ s
->qdev
.blocksize
;
501 if (s
->qdev
.type
== TYPE_ROM
) {
502 DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
506 /* required VPD size with unmap support */
507 outbuf
[3] = buflen
= 0x3c;
509 memset(outbuf
+ 4, 0, buflen
- 4);
511 /* optimal transfer length granularity */
512 outbuf
[6] = (min_io_size
>> 8) & 0xff;
513 outbuf
[7] = min_io_size
& 0xff;
515 /* optimal transfer length */
516 outbuf
[12] = (opt_io_size
>> 24) & 0xff;
517 outbuf
[13] = (opt_io_size
>> 16) & 0xff;
518 outbuf
[14] = (opt_io_size
>> 8) & 0xff;
519 outbuf
[15] = opt_io_size
& 0xff;
521 /* optimal unmap granularity */
522 outbuf
[28] = (unmap_sectors
>> 24) & 0xff;
523 outbuf
[29] = (unmap_sectors
>> 16) & 0xff;
524 outbuf
[30] = (unmap_sectors
>> 8) & 0xff;
525 outbuf
[31] = unmap_sectors
& 0xff;
528 case 0xb2: /* thin provisioning */
530 outbuf
[3] = buflen
= 8;
532 outbuf
[5] = 0x40; /* write same with unmap supported */
538 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
539 "buffer size %zd\n", page_code
, req
->cmd
.xfer
);
546 /* Standard INQUIRY data */
547 if (req
->cmd
.buf
[2] != 0) {
548 BADF("Error: Inquiry (STANDARD) page or code "
549 "is non-zero [%02X]\n", req
->cmd
.buf
[2]);
554 if (req
->cmd
.xfer
< 5) {
555 BADF("Error: Inquiry (STANDARD) buffer size %zd "
556 "is less than 5\n", req
->cmd
.xfer
);
560 buflen
= req
->cmd
.xfer
;
561 if (buflen
> SCSI_MAX_INQUIRY_LEN
) {
562 buflen
= SCSI_MAX_INQUIRY_LEN
;
564 memset(outbuf
, 0, buflen
);
566 outbuf
[0] = s
->qdev
.type
& 0x1f;
567 outbuf
[1] = s
->removable
? 0x80 : 0;
568 if (s
->qdev
.type
== TYPE_ROM
) {
569 memcpy(&outbuf
[16], "QEMU CD-ROM ", 16);
571 memcpy(&outbuf
[16], "QEMU HARDDISK ", 16);
573 memcpy(&outbuf
[8], "QEMU ", 8);
574 memset(&outbuf
[32], 0, 4);
575 memcpy(&outbuf
[32], s
->version
, MIN(4, strlen(s
->version
)));
577 * We claim conformance to SPC-3, which is required for guests
578 * to ask for modern features like READ CAPACITY(16) or the
579 * block characteristics VPD page by default. Not all of SPC-3
580 * is actually implemented, but we're good enough.
583 outbuf
[3] = 2; /* Format 2 */
586 outbuf
[4] = buflen
- 5; /* Additional Length = (Len - 1) - 4 */
588 /* If the allocation length of CDB is too small,
589 the additional length is not adjusted */
593 /* Sync data transfer and TCQ. */
594 outbuf
[7] = 0x10 | (req
->bus
->info
->tcq
? 0x02 : 0);
598 static inline bool media_is_dvd(SCSIDiskState
*s
)
601 if (s
->qdev
.type
!= TYPE_ROM
) {
604 if (!bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
607 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
608 return nb_sectors
> CD_MAX_SECTORS
;
611 static inline bool media_is_cd(SCSIDiskState
*s
)
614 if (s
->qdev
.type
!= TYPE_ROM
) {
617 if (!bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
620 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
621 return nb_sectors
<= CD_MAX_SECTORS
;
624 static int scsi_read_dvd_structure(SCSIDiskState
*s
, SCSIDiskReq
*r
,
627 static const int rds_caps_size
[5] = {
634 uint8_t media
= r
->req
.cmd
.buf
[1];
635 uint8_t layer
= r
->req
.cmd
.buf
[6];
636 uint8_t format
= r
->req
.cmd
.buf
[7];
639 if (s
->qdev
.type
!= TYPE_ROM
) {
643 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
647 if (format
!= 0xff) {
648 if (s
->tray_open
|| !bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
649 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
652 if (media_is_cd(s
)) {
653 scsi_check_condition(r
, SENSE_CODE(INCOMPATIBLE_FORMAT
));
656 if (format
>= ARRAY_SIZE(rds_caps_size
)) {
659 size
= rds_caps_size
[format
];
660 memset(outbuf
, 0, size
);
665 /* Physical format information */
670 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
672 outbuf
[4] = 1; /* DVD-ROM, part version 1 */
673 outbuf
[5] = 0xf; /* 120mm disc, minimum rate unspecified */
674 outbuf
[6] = 1; /* one layer, read-only (per MMC-2 spec) */
675 outbuf
[7] = 0; /* default densities */
677 stl_be_p(&outbuf
[12], (nb_sectors
>> 2) - 1); /* end sector */
678 stl_be_p(&outbuf
[16], (nb_sectors
>> 2) - 1); /* l0 end sector */
682 case 0x01: /* DVD copyright information, all zeros */
685 case 0x03: /* BCA information - invalid field for no BCA info */
688 case 0x04: /* DVD disc manufacturing information, all zeros */
691 case 0xff: { /* List capabilities */
694 for (i
= 0; i
< ARRAY_SIZE(rds_caps_size
); i
++) {
695 if (!rds_caps_size
[i
]) {
699 outbuf
[size
+ 1] = 0x40; /* Not writable, readable */
700 stw_be_p(&outbuf
[size
+ 2], rds_caps_size
[i
]);
710 /* Size of buffer, not including 2 byte size field */
711 stw_be_p(outbuf
, size
- 2);
718 static int scsi_event_status_media(SCSIDiskState
*s
, uint8_t *outbuf
)
720 uint8_t event_code
, media_status
;
724 media_status
= MS_TRAY_OPEN
;
725 } else if (bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
726 media_status
= MS_MEDIA_PRESENT
;
729 /* Event notification descriptor */
730 event_code
= MEC_NO_CHANGE
;
731 if (media_status
!= MS_TRAY_OPEN
&& s
->media_event
) {
732 event_code
= MEC_NEW_MEDIA
;
733 s
->media_event
= false;
736 outbuf
[0] = event_code
;
737 outbuf
[1] = media_status
;
739 /* These fields are reserved, just clear them. */
745 static int scsi_get_event_status_notification(SCSIDiskState
*s
, SCSIDiskReq
*r
,
749 uint8_t *buf
= r
->req
.cmd
.buf
;
750 uint8_t notification_class_request
= buf
[4];
751 if (s
->qdev
.type
!= TYPE_ROM
) {
754 if ((buf
[1] & 1) == 0) {
760 outbuf
[0] = outbuf
[1] = 0;
761 outbuf
[3] = 1 << GESN_MEDIA
; /* supported events */
762 if (notification_class_request
& (1 << GESN_MEDIA
)) {
763 outbuf
[2] = GESN_MEDIA
;
764 size
+= scsi_event_status_media(s
, &outbuf
[size
]);
768 stw_be_p(outbuf
, size
- 4);
772 static int scsi_get_configuration(SCSIDiskState
*s
, uint8_t *outbuf
)
776 if (s
->qdev
.type
!= TYPE_ROM
) {
779 current
= media_is_dvd(s
) ? MMC_PROFILE_DVD_ROM
: MMC_PROFILE_CD_ROM
;
780 memset(outbuf
, 0, 40);
781 stl_be_p(&outbuf
[0], 36); /* Bytes after the data length field */
782 stw_be_p(&outbuf
[6], current
);
783 /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
784 outbuf
[10] = 0x03; /* persistent, current */
785 outbuf
[11] = 8; /* two profiles */
786 stw_be_p(&outbuf
[12], MMC_PROFILE_DVD_ROM
);
787 outbuf
[14] = (current
== MMC_PROFILE_DVD_ROM
);
788 stw_be_p(&outbuf
[16], MMC_PROFILE_CD_ROM
);
789 outbuf
[18] = (current
== MMC_PROFILE_CD_ROM
);
790 /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
791 stw_be_p(&outbuf
[20], 1);
792 outbuf
[22] = 0x08 | 0x03; /* version 2, persistent, current */
794 stl_be_p(&outbuf
[24], 1); /* SCSI */
795 outbuf
[28] = 1; /* DBE = 1, mandatory */
796 /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
797 stw_be_p(&outbuf
[32], 3);
798 outbuf
[34] = 0x08 | 0x03; /* version 2, persistent, current */
800 outbuf
[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
801 /* TODO: Random readable, CD read, DVD read, drive serial number,
806 static int scsi_emulate_mechanism_status(SCSIDiskState
*s
, uint8_t *outbuf
)
808 if (s
->qdev
.type
!= TYPE_ROM
) {
811 memset(outbuf
, 0, 8);
812 outbuf
[5] = 1; /* CD-ROM */
816 static int mode_sense_page(SCSIDiskState
*s
, int page
, uint8_t **p_outbuf
,
819 static const int mode_sense_valid
[0x3f] = {
820 [MODE_PAGE_HD_GEOMETRY
] = (1 << TYPE_DISK
),
821 [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY
] = (1 << TYPE_DISK
),
822 [MODE_PAGE_CACHING
] = (1 << TYPE_DISK
) | (1 << TYPE_ROM
),
823 [MODE_PAGE_R_W_ERROR
] = (1 << TYPE_DISK
) | (1 << TYPE_ROM
),
824 [MODE_PAGE_AUDIO_CTL
] = (1 << TYPE_ROM
),
825 [MODE_PAGE_CAPABILITIES
] = (1 << TYPE_ROM
),
828 BlockDriverState
*bdrv
= s
->qdev
.conf
.bs
;
829 int cylinders
, heads
, secs
;
830 uint8_t *p
= *p_outbuf
;
832 if ((mode_sense_valid
[page
] & (1 << s
->qdev
.type
)) == 0) {
839 * If Changeable Values are requested, a mask denoting those mode parameters
840 * that are changeable shall be returned. As we currently don't support
841 * parameter changes via MODE_SELECT all bits are returned set to zero.
842 * The buffer was already menset to zero by the caller of this function.
845 case MODE_PAGE_HD_GEOMETRY
:
847 if (page_control
== 1) { /* Changeable Values */
850 /* if a geometry hint is available, use it */
851 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
852 p
[2] = (cylinders
>> 16) & 0xff;
853 p
[3] = (cylinders
>> 8) & 0xff;
854 p
[4] = cylinders
& 0xff;
856 /* Write precomp start cylinder, disabled */
857 p
[6] = (cylinders
>> 16) & 0xff;
858 p
[7] = (cylinders
>> 8) & 0xff;
859 p
[8] = cylinders
& 0xff;
860 /* Reduced current start cylinder, disabled */
861 p
[9] = (cylinders
>> 16) & 0xff;
862 p
[10] = (cylinders
>> 8) & 0xff;
863 p
[11] = cylinders
& 0xff;
864 /* Device step rate [ns], 200ns */
867 /* Landing zone cylinder */
871 /* Medium rotation rate [rpm], 5400 rpm */
872 p
[20] = (5400 >> 8) & 0xff;
876 case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY
:
878 if (page_control
== 1) { /* Changeable Values */
881 /* Transfer rate [kbit/s], 5Mbit/s */
884 /* if a geometry hint is available, use it */
885 bdrv_get_geometry_hint(bdrv
, &cylinders
, &heads
, &secs
);
888 p
[6] = s
->qdev
.blocksize
>> 8;
889 p
[8] = (cylinders
>> 8) & 0xff;
890 p
[9] = cylinders
& 0xff;
891 /* Write precomp start cylinder, disabled */
892 p
[10] = (cylinders
>> 8) & 0xff;
893 p
[11] = cylinders
& 0xff;
894 /* Reduced current start cylinder, disabled */
895 p
[12] = (cylinders
>> 8) & 0xff;
896 p
[13] = cylinders
& 0xff;
897 /* Device step rate [100us], 100us */
900 /* Device step pulse width [us], 1us */
902 /* Device head settle delay [100us], 100us */
905 /* Motor on delay [0.1s], 0.1s */
907 /* Motor off delay [0.1s], 0.1s */
909 /* Medium rotation rate [rpm], 5400 rpm */
910 p
[28] = (5400 >> 8) & 0xff;
914 case MODE_PAGE_CACHING
:
917 if (page_control
== 1) { /* Changeable Values */
920 if (bdrv_enable_write_cache(s
->qdev
.conf
.bs
)) {
925 case MODE_PAGE_R_W_ERROR
:
927 p
[2] = 0x80; /* Automatic Write Reallocation Enabled */
928 if (s
->qdev
.type
== TYPE_ROM
) {
929 p
[3] = 0x20; /* Read Retry Count */
933 case MODE_PAGE_AUDIO_CTL
:
937 case MODE_PAGE_CAPABILITIES
:
939 if (page_control
== 1) { /* Changeable Values */
943 p
[2] = 0x3b; /* CD-R & CD-RW read */
944 p
[3] = 0; /* Writing not supported */
945 p
[4] = 0x7f; /* Audio, composite, digital out,
946 mode 2 form 1&2, multi session */
947 p
[5] = 0xff; /* CD DA, DA accurate, RW supported,
948 RW corrected, C2 errors, ISRC,
950 p
[6] = 0x2d | (s
->tray_locked
? 2 : 0);
951 /* Locking supported, jumper present, eject, tray */
952 p
[7] = 0; /* no volume & mute control, no
954 p
[8] = (50 * 176) >> 8; /* 50x read speed */
955 p
[9] = (50 * 176) & 0xff;
956 p
[10] = 2 >> 8; /* Two volume levels */
958 p
[12] = 2048 >> 8; /* 2M buffer */
960 p
[14] = (16 * 176) >> 8; /* 16x read speed current */
961 p
[15] = (16 * 176) & 0xff;
962 p
[18] = (16 * 176) >> 8; /* 16x write speed */
963 p
[19] = (16 * 176) & 0xff;
964 p
[20] = (16 * 176) >> 8; /* 16x write speed current */
965 p
[21] = (16 * 176) & 0xff;
972 *p_outbuf
+= p
[1] + 2;
976 static int scsi_disk_emulate_mode_sense(SCSIDiskReq
*r
, uint8_t *outbuf
)
978 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, r
->req
.dev
);
980 int page
, dbd
, buflen
, ret
, page_control
;
982 uint8_t dev_specific_param
;
984 dbd
= r
->req
.cmd
.buf
[1] & 0x8;
985 page
= r
->req
.cmd
.buf
[2] & 0x3f;
986 page_control
= (r
->req
.cmd
.buf
[2] & 0xc0) >> 6;
987 DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
988 (r
->req
.cmd
.buf
[0] == MODE_SENSE
) ? 6 : 10, page
, r
->req
.cmd
.xfer
, page_control
);
989 memset(outbuf
, 0, r
->req
.cmd
.xfer
);
992 if (bdrv_is_read_only(s
->qdev
.conf
.bs
)) {
993 dev_specific_param
= 0x80; /* Readonly. */
995 dev_specific_param
= 0x00;
998 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
999 p
[1] = 0; /* Default media type. */
1000 p
[2] = dev_specific_param
;
1001 p
[3] = 0; /* Block descriptor length. */
1003 } else { /* MODE_SENSE_10 */
1004 p
[2] = 0; /* Default media type. */
1005 p
[3] = dev_specific_param
;
1006 p
[6] = p
[7] = 0; /* Block descriptor length. */
1010 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1011 if (!dbd
&& nb_sectors
) {
1012 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
1013 outbuf
[3] = 8; /* Block descriptor length */
1014 } else { /* MODE_SENSE_10 */
1015 outbuf
[7] = 8; /* Block descriptor length */
1017 nb_sectors
/= (s
->qdev
.blocksize
/ 512);
1018 if (nb_sectors
> 0xffffff) {
1021 p
[0] = 0; /* media density code */
1022 p
[1] = (nb_sectors
>> 16) & 0xff;
1023 p
[2] = (nb_sectors
>> 8) & 0xff;
1024 p
[3] = nb_sectors
& 0xff;
1025 p
[4] = 0; /* reserved */
1026 p
[5] = 0; /* bytes 5-7 are the sector size in bytes */
1027 p
[6] = s
->qdev
.blocksize
>> 8;
1032 if (page_control
== 3) {
1034 scsi_check_condition(r
, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED
));
1039 for (page
= 0; page
<= 0x3e; page
++) {
1040 mode_sense_page(s
, page
, &p
, page_control
);
1043 ret
= mode_sense_page(s
, page
, &p
, page_control
);
1049 buflen
= p
- outbuf
;
1051 * The mode data length field specifies the length in bytes of the
1052 * following data that is available to be transferred. The mode data
1053 * length does not include itself.
1055 if (r
->req
.cmd
.buf
[0] == MODE_SENSE
) {
1056 outbuf
[0] = buflen
- 1;
1057 } else { /* MODE_SENSE_10 */
1058 outbuf
[0] = ((buflen
- 2) >> 8) & 0xff;
1059 outbuf
[1] = (buflen
- 2) & 0xff;
1061 if (buflen
> r
->req
.cmd
.xfer
) {
1062 buflen
= r
->req
.cmd
.xfer
;
1067 static int scsi_disk_emulate_read_toc(SCSIRequest
*req
, uint8_t *outbuf
)
1069 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1070 int start_track
, format
, msf
, toclen
;
1071 uint64_t nb_sectors
;
1073 msf
= req
->cmd
.buf
[1] & 2;
1074 format
= req
->cmd
.buf
[2] & 0xf;
1075 start_track
= req
->cmd
.buf
[6];
1076 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1077 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track
, format
, msf
>> 1);
1078 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1081 toclen
= cdrom_read_toc(nb_sectors
, outbuf
, msf
, start_track
);
1084 /* multi session : only a single session defined */
1086 memset(outbuf
, 0, 12);
1092 toclen
= cdrom_read_toc_raw(nb_sectors
, outbuf
, msf
, start_track
);
1097 if (toclen
> req
->cmd
.xfer
) {
1098 toclen
= req
->cmd
.xfer
;
1103 static int scsi_disk_emulate_start_stop(SCSIDiskReq
*r
)
1105 SCSIRequest
*req
= &r
->req
;
1106 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1107 bool start
= req
->cmd
.buf
[4] & 1;
1108 bool loej
= req
->cmd
.buf
[4] & 2; /* load on start, eject on !start */
1110 if (s
->qdev
.type
== TYPE_ROM
&& loej
) {
1111 if (!start
&& !s
->tray_open
&& s
->tray_locked
) {
1112 scsi_check_condition(r
,
1113 bdrv_is_inserted(s
->qdev
.conf
.bs
)
1114 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED
)
1115 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED
));
1118 bdrv_eject(s
->qdev
.conf
.bs
, !start
);
1119 s
->tray_open
= !start
;
1124 static int scsi_disk_emulate_command(SCSIDiskReq
*r
)
1126 SCSIRequest
*req
= &r
->req
;
1127 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1128 uint64_t nb_sectors
;
1132 if (!r
->iov
.iov_base
) {
1134 * FIXME: we shouldn't return anything bigger than 4k, but the code
1135 * requires the buffer to be as big as req->cmd.xfer in several
1136 * places. So, do not allow CDBs with a very large ALLOCATION
1137 * LENGTH. The real fix would be to modify scsi_read_data and
1138 * dma_buf_read, so that they return data beyond the buflen
1141 if (req
->cmd
.xfer
> 65536) {
1142 goto illegal_request
;
1144 r
->buflen
= MAX(4096, req
->cmd
.xfer
);
1145 r
->iov
.iov_base
= qemu_blockalign(s
->qdev
.conf
.bs
, r
->buflen
);
1148 outbuf
= r
->iov
.iov_base
;
1149 switch (req
->cmd
.buf
[0]) {
1150 case TEST_UNIT_READY
:
1151 if (s
->tray_open
|| !bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
1156 buflen
= scsi_disk_emulate_inquiry(req
, outbuf
);
1158 goto illegal_request
;
1163 buflen
= scsi_disk_emulate_mode_sense(r
, outbuf
);
1165 goto illegal_request
;
1169 buflen
= scsi_disk_emulate_read_toc(req
, outbuf
);
1171 goto illegal_request
;
1175 if (req
->cmd
.buf
[1] & 1) {
1176 goto illegal_request
;
1180 if (req
->cmd
.buf
[1] & 3) {
1181 goto illegal_request
;
1185 if (req
->cmd
.buf
[1] & 1) {
1186 goto illegal_request
;
1190 if (req
->cmd
.buf
[1] & 3) {
1191 goto illegal_request
;
1195 if (scsi_disk_emulate_start_stop(r
) < 0) {
1199 case ALLOW_MEDIUM_REMOVAL
:
1200 s
->tray_locked
= req
->cmd
.buf
[4] & 1;
1201 bdrv_lock_medium(s
->qdev
.conf
.bs
, req
->cmd
.buf
[4] & 1);
1203 case READ_CAPACITY_10
:
1204 /* The normal LEN field for this command is zero. */
1205 memset(outbuf
, 0, 8);
1206 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1210 if ((req
->cmd
.buf
[8] & 1) == 0 && req
->cmd
.lba
) {
1211 goto illegal_request
;
1213 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1214 /* Returned value is the address of the last sector. */
1216 /* Remember the new size for read/write sanity checking. */
1217 s
->qdev
.max_lba
= nb_sectors
;
1218 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
1219 if (nb_sectors
> UINT32_MAX
) {
1220 nb_sectors
= UINT32_MAX
;
1222 outbuf
[0] = (nb_sectors
>> 24) & 0xff;
1223 outbuf
[1] = (nb_sectors
>> 16) & 0xff;
1224 outbuf
[2] = (nb_sectors
>> 8) & 0xff;
1225 outbuf
[3] = nb_sectors
& 0xff;
1228 outbuf
[6] = s
->qdev
.blocksize
>> 8;
1232 case MECHANISM_STATUS
:
1233 buflen
= scsi_emulate_mechanism_status(s
, outbuf
);
1235 goto illegal_request
;
1238 case GET_CONFIGURATION
:
1239 buflen
= scsi_get_configuration(s
, outbuf
);
1241 goto illegal_request
;
1244 case GET_EVENT_STATUS_NOTIFICATION
:
1245 buflen
= scsi_get_event_status_notification(s
, r
, outbuf
);
1247 goto illegal_request
;
1250 case READ_DVD_STRUCTURE
:
1251 buflen
= scsi_read_dvd_structure(s
, r
, outbuf
);
1253 goto illegal_request
;
1256 case SERVICE_ACTION_IN_16
:
1257 /* Service Action In subcommands. */
1258 if ((req
->cmd
.buf
[1] & 31) == SAI_READ_CAPACITY_16
) {
1259 DPRINTF("SAI READ CAPACITY(16)\n");
1260 memset(outbuf
, 0, req
->cmd
.xfer
);
1261 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1265 if ((req
->cmd
.buf
[14] & 1) == 0 && req
->cmd
.lba
) {
1266 goto illegal_request
;
1268 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1269 /* Returned value is the address of the last sector. */
1271 /* Remember the new size for read/write sanity checking. */
1272 s
->qdev
.max_lba
= nb_sectors
;
1273 outbuf
[0] = (nb_sectors
>> 56) & 0xff;
1274 outbuf
[1] = (nb_sectors
>> 48) & 0xff;
1275 outbuf
[2] = (nb_sectors
>> 40) & 0xff;
1276 outbuf
[3] = (nb_sectors
>> 32) & 0xff;
1277 outbuf
[4] = (nb_sectors
>> 24) & 0xff;
1278 outbuf
[5] = (nb_sectors
>> 16) & 0xff;
1279 outbuf
[6] = (nb_sectors
>> 8) & 0xff;
1280 outbuf
[7] = nb_sectors
& 0xff;
1283 outbuf
[10] = s
->qdev
.blocksize
>> 8;
1286 outbuf
[13] = get_physical_block_exp(&s
->qdev
.conf
);
1288 /* set TPE bit if the format supports discard */
1289 if (s
->qdev
.conf
.discard_granularity
) {
1293 /* Protection, exponent and lowest lba field left blank. */
1294 buflen
= req
->cmd
.xfer
;
1297 DPRINTF("Unsupported Service Action In\n");
1298 goto illegal_request
;
1302 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1308 if (s
->tray_open
|| !bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
1309 scsi_check_condition(r
, SENSE_CODE(NO_MEDIUM
));
1311 scsi_check_condition(r
, SENSE_CODE(LUN_NOT_READY
));
1316 if (r
->req
.status
== -1) {
1317 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1322 /* Execute a scsi command. Returns the length of the data expected by the
1323 command. This will be Positive for data transfers from the device
1324 (eg. disk reads), negative for transfers to the device (eg. disk writes),
1325 and zero if the command does not transfer any data. */
1327 static int32_t scsi_send_command(SCSIRequest
*req
, uint8_t *buf
)
1329 SCSIDiskReq
*r
= DO_UPCAST(SCSIDiskReq
, req
, req
);
1330 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, req
->dev
);
1336 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req
->lun
, req
->tag
, buf
[0]);
1341 for (i
= 1; i
< r
->req
.cmd
.len
; i
++) {
1342 printf(" 0x%02x", buf
[i
]);
1349 case TEST_UNIT_READY
:
1358 case ALLOW_MEDIUM_REMOVAL
:
1359 case READ_CAPACITY_10
:
1361 case READ_DVD_STRUCTURE
:
1362 case GET_CONFIGURATION
:
1363 case GET_EVENT_STATUS_NOTIFICATION
:
1364 case MECHANISM_STATUS
:
1365 case SERVICE_ACTION_IN_16
:
1367 rc
= scsi_disk_emulate_command(r
);
1372 r
->iov
.iov_len
= rc
;
1374 case SYNCHRONIZE_CACHE
:
1375 /* The request is used as the AIO opaque value, so add a ref. */
1376 scsi_req_ref(&r
->req
);
1377 bdrv_acct_start(s
->qdev
.conf
.bs
, &r
->acct
, 0, BDRV_ACCT_FLUSH
);
1378 r
->req
.aiocb
= bdrv_aio_flush(s
->qdev
.conf
.bs
, scsi_flush_complete
, r
);
1379 if (r
->req
.aiocb
== NULL
) {
1380 scsi_flush_complete(r
, -EIO
);
1387 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1388 DPRINTF("Read (sector %" PRId64
", count %d)\n", r
->req
.cmd
.lba
, len
);
1389 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1392 r
->sector
= r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512);
1393 r
->sector_count
= len
* (s
->qdev
.blocksize
/ 512);
1399 case WRITE_VERIFY_10
:
1400 case WRITE_VERIFY_12
:
1401 case WRITE_VERIFY_16
:
1402 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1403 DPRINTF("Write %s(sector %" PRId64
", count %d)\n",
1404 (command
& 0xe) == 0xe ? "And Verify " : "",
1405 r
->req
.cmd
.lba
, len
);
1406 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1409 r
->sector
= r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512);
1410 r
->sector_count
= len
* (s
->qdev
.blocksize
/ 512);
1413 DPRINTF("Mode Select(6) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1414 /* We don't support mode parameter changes.
1415 Allow the mode parameter header + block descriptors only. */
1416 if (r
->req
.cmd
.xfer
> 12) {
1420 case MODE_SELECT_10
:
1421 DPRINTF("Mode Select(10) (len %lu)\n", (long)r
->req
.cmd
.xfer
);
1422 /* We don't support mode parameter changes.
1423 Allow the mode parameter header + block descriptors only. */
1424 if (r
->req
.cmd
.xfer
> 16) {
1430 DPRINTF("Seek(%d) (sector %" PRId64
")\n", command
== SEEK_6
? 6 : 10,
1432 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1437 len
= r
->req
.cmd
.xfer
/ s
->qdev
.blocksize
;
1439 DPRINTF("WRITE SAME(16) (sector %" PRId64
", count %d)\n",
1440 r
->req
.cmd
.lba
, len
);
1442 if (r
->req
.cmd
.lba
> s
->qdev
.max_lba
) {
1447 * We only support WRITE SAME with the unmap bit set for now.
1449 if (!(buf
[1] & 0x8)) {
1453 rc
= bdrv_discard(s
->qdev
.conf
.bs
,
1454 r
->req
.cmd
.lba
* (s
->qdev
.blocksize
/ 512),
1455 len
* (s
->qdev
.blocksize
/ 512));
1457 /* XXX: better error code ?*/
1465 DPRINTF("Unknown SCSI command (%2.2x)\n", buf
[0]);
1466 scsi_check_condition(r
, SENSE_CODE(INVALID_OPCODE
));
1469 scsi_check_condition(r
, SENSE_CODE(INVALID_FIELD
));
1472 scsi_check_condition(r
, SENSE_CODE(LBA_OUT_OF_RANGE
));
1475 if (r
->sector_count
== 0 && r
->iov
.iov_len
== 0) {
1476 scsi_req_complete(&r
->req
, GOOD
);
1478 len
= r
->sector_count
* 512 + r
->iov
.iov_len
;
1479 if (r
->req
.cmd
.mode
== SCSI_XFER_TO_DEV
) {
1482 if (!r
->sector_count
) {
1483 r
->sector_count
= -1;
1489 static void scsi_disk_reset(DeviceState
*dev
)
1491 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
.qdev
, dev
);
1492 uint64_t nb_sectors
;
1494 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(RESET
));
1496 bdrv_get_geometry(s
->qdev
.conf
.bs
, &nb_sectors
);
1497 nb_sectors
/= s
->qdev
.blocksize
/ 512;
1501 s
->qdev
.max_lba
= nb_sectors
;
1504 static void scsi_destroy(SCSIDevice
*dev
)
1506 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1508 scsi_device_purge_requests(&s
->qdev
, SENSE_CODE(NO_SENSE
));
1509 blockdev_mark_auto_del(s
->qdev
.conf
.bs
);
1512 static void scsi_cd_change_media_cb(void *opaque
, bool load
)
1514 SCSIDiskState
*s
= opaque
;
1517 * When a CD gets changed, we have to report an ejected state and
1518 * then a loaded state to guests so that they detect tray
1519 * open/close and media change events. Guests that do not use
1520 * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
1521 * states rely on this behavior.
1523 * media_changed governs the state machine used for unit attention
1524 * report. media_event is used by GET EVENT STATUS NOTIFICATION.
1526 s
->media_changed
= load
;
1527 s
->tray_open
= !load
;
1528 s
->qdev
.unit_attention
= SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM
);
1529 s
->media_event
= true;
1532 static bool scsi_cd_is_tray_open(void *opaque
)
1534 return ((SCSIDiskState
*)opaque
)->tray_open
;
1537 static bool scsi_cd_is_medium_locked(void *opaque
)
1539 return ((SCSIDiskState
*)opaque
)->tray_locked
;
1542 static const BlockDevOps scsi_cd_block_ops
= {
1543 .change_media_cb
= scsi_cd_change_media_cb
,
1544 .is_tray_open
= scsi_cd_is_tray_open
,
1545 .is_medium_locked
= scsi_cd_is_medium_locked
,
1548 static void scsi_disk_unit_attention_reported(SCSIDevice
*dev
)
1550 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1551 if (s
->media_changed
) {
1552 s
->media_changed
= false;
1553 s
->qdev
.unit_attention
= SENSE_CODE(MEDIUM_CHANGED
);
1557 static int scsi_initfn(SCSIDevice
*dev
)
1559 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1562 if (!s
->qdev
.conf
.bs
) {
1563 error_report("scsi-disk: drive property not set");
1567 if (!s
->removable
&& !bdrv_is_inserted(s
->qdev
.conf
.bs
)) {
1568 error_report("Device needs media, but drive is empty");
1573 /* try to fall back to value set with legacy -drive serial=... */
1574 dinfo
= drive_get_by_blockdev(s
->qdev
.conf
.bs
);
1575 if (*dinfo
->serial
) {
1576 s
->serial
= g_strdup(dinfo
->serial
);
1581 s
->version
= g_strdup(QEMU_VERSION
);
1584 if (bdrv_is_sg(s
->qdev
.conf
.bs
)) {
1585 error_report("scsi-disk: unwanted /dev/sg*");
1590 bdrv_set_dev_ops(s
->qdev
.conf
.bs
, &scsi_cd_block_ops
, s
);
1592 bdrv_set_buffer_alignment(s
->qdev
.conf
.bs
, s
->qdev
.blocksize
);
1594 qemu_add_vm_change_state_handler(scsi_dma_restart_cb
, s
);
1595 bdrv_iostatus_enable(s
->qdev
.conf
.bs
);
1596 add_boot_device_path(s
->qdev
.conf
.bootindex
, &dev
->qdev
, ",0");
1600 static int scsi_hd_initfn(SCSIDevice
*dev
)
1602 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1603 s
->qdev
.blocksize
= s
->qdev
.conf
.logical_block_size
;
1604 s
->qdev
.type
= TYPE_DISK
;
1605 return scsi_initfn(&s
->qdev
);
1608 static int scsi_cd_initfn(SCSIDevice
*dev
)
1610 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, dev
);
1611 s
->qdev
.blocksize
= 2048;
1612 s
->qdev
.type
= TYPE_ROM
;
1613 s
->removable
= true;
1614 return scsi_initfn(&s
->qdev
);
1617 static int scsi_disk_initfn(SCSIDevice
*dev
)
1621 if (!dev
->conf
.bs
) {
1622 return scsi_initfn(dev
); /* ... and die there */
1625 dinfo
= drive_get_by_blockdev(dev
->conf
.bs
);
1626 if (dinfo
->media_cd
) {
1627 return scsi_cd_initfn(dev
);
1629 return scsi_hd_initfn(dev
);
1633 static const SCSIReqOps scsi_disk_reqops
= {
1634 .size
= sizeof(SCSIDiskReq
),
1635 .free_req
= scsi_free_request
,
1636 .send_command
= scsi_send_command
,
1637 .read_data
= scsi_read_data
,
1638 .write_data
= scsi_write_data
,
1639 .cancel_io
= scsi_cancel_io
,
1640 .get_buf
= scsi_get_buf
,
1643 static SCSIRequest
*scsi_new_request(SCSIDevice
*d
, uint32_t tag
, uint32_t lun
,
1644 uint8_t *buf
, void *hba_private
)
1646 SCSIDiskState
*s
= DO_UPCAST(SCSIDiskState
, qdev
, d
);
1649 req
= scsi_req_alloc(&scsi_disk_reqops
, &s
->qdev
, tag
, lun
, hba_private
);
1653 #define DEFINE_SCSI_DISK_PROPERTIES() \
1654 DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf), \
1655 DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
1656 DEFINE_PROP_STRING("serial", SCSIDiskState, serial)
1658 static SCSIDeviceInfo scsi_disk_info
[] = {
1660 .qdev
.name
= "scsi-hd",
1661 .qdev
.fw_name
= "disk",
1662 .qdev
.desc
= "virtual SCSI disk",
1663 .qdev
.size
= sizeof(SCSIDiskState
),
1664 .qdev
.reset
= scsi_disk_reset
,
1665 .init
= scsi_hd_initfn
,
1666 .destroy
= scsi_destroy
,
1667 .alloc_req
= scsi_new_request
,
1668 .unit_attention_reported
= scsi_disk_unit_attention_reported
,
1669 .qdev
.props
= (Property
[]) {
1670 DEFINE_SCSI_DISK_PROPERTIES(),
1671 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1672 DEFINE_PROP_END_OF_LIST(),
1675 .qdev
.name
= "scsi-cd",
1676 .qdev
.fw_name
= "disk",
1677 .qdev
.desc
= "virtual SCSI CD-ROM",
1678 .qdev
.size
= sizeof(SCSIDiskState
),
1679 .qdev
.reset
= scsi_disk_reset
,
1680 .init
= scsi_cd_initfn
,
1681 .destroy
= scsi_destroy
,
1682 .alloc_req
= scsi_new_request
,
1683 .unit_attention_reported
= scsi_disk_unit_attention_reported
,
1684 .qdev
.props
= (Property
[]) {
1685 DEFINE_SCSI_DISK_PROPERTIES(),
1686 DEFINE_PROP_END_OF_LIST(),
1689 .qdev
.name
= "scsi-disk", /* legacy -device scsi-disk */
1690 .qdev
.fw_name
= "disk",
1691 .qdev
.desc
= "virtual SCSI disk or CD-ROM (legacy)",
1692 .qdev
.size
= sizeof(SCSIDiskState
),
1693 .qdev
.reset
= scsi_disk_reset
,
1694 .init
= scsi_disk_initfn
,
1695 .destroy
= scsi_destroy
,
1696 .alloc_req
= scsi_new_request
,
1697 .unit_attention_reported
= scsi_disk_unit_attention_reported
,
1698 .qdev
.props
= (Property
[]) {
1699 DEFINE_SCSI_DISK_PROPERTIES(),
1700 DEFINE_PROP_BIT("removable", SCSIDiskState
, removable
, 0, false),
1701 DEFINE_PROP_END_OF_LIST(),
1706 static void scsi_disk_register_devices(void)
1710 for (i
= 0; i
< ARRAY_SIZE(scsi_disk_info
); i
++) {
1711 scsi_qdev_register(&scsi_disk_info
[i
]);
1714 device_init(scsi_disk_register_devices
)