Statistics
| Branch: | Revision:

root / hw / scsi-disk.c @ 89b08ae1

History | View | Annotate | Download (32.3 kB)

1
/*
2
 * SCSI Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Based on code by Fabrice Bellard
6
 *
7
 * Written by Paul Brook
8
 *
9
 * This code is licenced under the LGPL.
10
 *
11
 * Note that this file only handles the SCSI architecture model and device
12
 * commands.  Emulation of interface/link layer protocols is handled by
13
 * the host adapter emulator.
14
 */
15

    
16
#include <qemu-common.h>
17
#include <sysemu.h>
18
//#define DEBUG_SCSI
19

    
20
#ifdef DEBUG_SCSI
21
#define DPRINTF(fmt, ...) \
22
do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
23
#else
24
#define DPRINTF(fmt, ...) do {} while(0)
25
#endif
26

    
27
#define BADF(fmt, ...) \
28
do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
29

    
30
#include "qemu-common.h"
31
#include "block.h"
32
#include "scsi.h"
33

    
34
#define SENSE_NO_SENSE        0
35
#define SENSE_NOT_READY       2
36
#define SENSE_HARDWARE_ERROR  4
37
#define SENSE_ILLEGAL_REQUEST 5
38

    
39
#define STATUS_GOOD            0
40
#define STATUS_CHECK_CONDITION 2
41

    
42
#define SCSI_DMA_BUF_SIZE    131072
43
#define SCSI_MAX_INQUIRY_LEN 256
44

    
45
#define SCSI_REQ_STATUS_RETRY 0x01
46

    
47
typedef struct SCSIDiskState SCSIDiskState;
48

    
49
typedef struct SCSIDiskReq {
50
    SCSIRequest req;
51
    /* ??? We should probably keep track of whether the data transfer is
52
       a read or a write.  Currently we rely on the host getting it right.  */
53
    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
54
    uint64_t sector;
55
    uint32_t sector_count;
56
    struct iovec iov;
57
    QEMUIOVector qiov;
58
    uint32_t status;
59
} SCSIDiskReq;
60

    
61
struct SCSIDiskState
62
{
63
    SCSIDevice qdev;
64
    DriveInfo *dinfo;
65
    /* The qemu block layer uses a fixed 512 byte sector size.
66
       This is the number of 512 byte blocks in a single scsi sector.  */
67
    int cluster_size;
68
    uint64_t max_lba;
69
    int sense;
70
    char drive_serial_str[21];
71
    QEMUBH *bh;
72
};
73

    
74
static SCSIDiskReq *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun)
75
{
76
    SCSIRequest *req;
77
    SCSIDiskReq *r;
78

    
79
    req = scsi_req_alloc(sizeof(SCSIDiskReq), d, tag, lun);
80
    r = DO_UPCAST(SCSIDiskReq, req, req);
81
    r->iov.iov_base = qemu_memalign(512, SCSI_DMA_BUF_SIZE);
82
    return r;
83
}
84

    
85
static void scsi_remove_request(SCSIDiskReq *r)
86
{
87
    qemu_free(r->iov.iov_base);
88
    scsi_req_free(&r->req);
89
}
90

    
91
static SCSIDiskReq *scsi_find_request(SCSIDiskState *s, uint32_t tag)
92
{
93
    return DO_UPCAST(SCSIDiskReq, req, scsi_req_find(&s->qdev, tag));
94
}
95

    
96
/* Helper function for command completion.  */
97
static void scsi_command_complete(SCSIDiskReq *r, int status, int sense)
98
{
99
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
100
    uint32_t tag;
101
    DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
102
            r->req.tag, status, sense);
103
    s->sense = sense;
104
    tag = r->req.tag;
105
    r->req.bus->complete(r->req.bus, SCSI_REASON_DONE, tag, status);
106
    scsi_remove_request(r);
107
}
108

    
109
/* Cancel a pending data transfer.  */
110
static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
111
{
112
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
113
    SCSIDiskReq *r;
114
    DPRINTF("Cancel tag=0x%x\n", tag);
115
    r = scsi_find_request(s, tag);
116
    if (r) {
117
        if (r->req.aiocb)
118
            bdrv_aio_cancel(r->req.aiocb);
119
        r->req.aiocb = NULL;
120
        scsi_remove_request(r);
121
    }
122
}
123

    
124
static void scsi_read_complete(void * opaque, int ret)
125
{
126
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
127

    
128
    if (ret) {
129
        DPRINTF("IO error\n");
130
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, 0);
131
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NO_SENSE);
132
        return;
133
    }
134
    DPRINTF("Data ready tag=0x%x len=%" PRId64 "\n", r->req.tag, r->iov.iov_len);
135

    
136
    r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, r->iov.iov_len);
137
}
138

    
139
/* Read more data from scsi device into buffer.  */
140
static void scsi_read_data(SCSIDevice *d, uint32_t tag)
141
{
142
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
143
    SCSIDiskReq *r;
144
    uint32_t n;
145

    
146
    r = scsi_find_request(s, tag);
147
    if (!r) {
148
        BADF("Bad read tag 0x%x\n", tag);
149
        /* ??? This is the wrong error.  */
150
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
151
        return;
152
    }
153
    if (r->sector_count == (uint32_t)-1) {
154
        DPRINTF("Read buf_len=%" PRId64 "\n", r->iov.iov_len);
155
        r->sector_count = 0;
156
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, r->iov.iov_len);
157
        return;
158
    }
159
    DPRINTF("Read sector_count=%d\n", r->sector_count);
160
    if (r->sector_count == 0) {
161
        scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
162
        return;
163
    }
164

    
165
    n = r->sector_count;
166
    if (n > SCSI_DMA_BUF_SIZE / 512)
167
        n = SCSI_DMA_BUF_SIZE / 512;
168

    
169
    r->iov.iov_len = n * 512;
170
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
171
    r->req.aiocb = bdrv_aio_readv(s->dinfo->bdrv, r->sector, &r->qiov, n,
172
                              scsi_read_complete, r);
173
    if (r->req.aiocb == NULL)
174
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
175
    r->sector += n;
176
    r->sector_count -= n;
177
}
178

    
179
static int scsi_handle_write_error(SCSIDiskReq *r, int error)
180
{
181
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
182
    BlockInterfaceErrorAction action = drive_get_onerror(s->dinfo->bdrv);
183

    
184
    if (action == BLOCK_ERR_IGNORE)
185
        return 0;
186

    
187
    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
188
            || action == BLOCK_ERR_STOP_ANY) {
189
        r->status |= SCSI_REQ_STATUS_RETRY;
190
        vm_stop(0);
191
    } else {
192
        scsi_command_complete(r, STATUS_CHECK_CONDITION,
193
                SENSE_HARDWARE_ERROR);
194
    }
195

    
196
    return 1;
197
}
198

    
199
static void scsi_write_complete(void * opaque, int ret)
200
{
201
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
202
    uint32_t len;
203
    uint32_t n;
204

    
205
    r->req.aiocb = NULL;
206

    
207
    if (ret) {
208
        if (scsi_handle_write_error(r, -ret))
209
            return;
210
    }
211

    
212
    n = r->iov.iov_len / 512;
213
    r->sector += n;
214
    r->sector_count -= n;
215
    if (r->sector_count == 0) {
216
        scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
217
    } else {
218
        len = r->sector_count * 512;
219
        if (len > SCSI_DMA_BUF_SIZE) {
220
            len = SCSI_DMA_BUF_SIZE;
221
        }
222
        r->iov.iov_len = len;
223
        DPRINTF("Write complete tag=0x%x more=%d\n", r->req.tag, len);
224
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);
225
    }
226
}
227

    
228
static void scsi_write_request(SCSIDiskReq *r)
229
{
230
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
231
    uint32_t n;
232

    
233
    n = r->iov.iov_len / 512;
234
    if (n) {
235
        qemu_iovec_init_external(&r->qiov, &r->iov, 1);
236
        r->req.aiocb = bdrv_aio_writev(s->dinfo->bdrv, r->sector, &r->qiov, n,
237
                                   scsi_write_complete, r);
238
        if (r->req.aiocb == NULL)
239
            scsi_command_complete(r, STATUS_CHECK_CONDITION,
240
                                  SENSE_HARDWARE_ERROR);
241
    } else {
242
        /* Invoke completion routine to fetch data from host.  */
243
        scsi_write_complete(r, 0);
244
    }
245
}
246

    
247
/* Write data to a scsi device.  Returns nonzero on failure.
248
   The transfer may complete asynchronously.  */
249
static int scsi_write_data(SCSIDevice *d, uint32_t tag)
250
{
251
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
252
    SCSIDiskReq *r;
253

    
254
    DPRINTF("Write data tag=0x%x\n", tag);
255
    r = scsi_find_request(s, tag);
256
    if (!r) {
257
        BADF("Bad write tag 0x%x\n", tag);
258
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
259
        return 1;
260
    }
261

    
262
    if (r->req.aiocb)
263
        BADF("Data transfer already in progress\n");
264

    
265
    scsi_write_request(r);
266

    
267
    return 0;
268
}
269

    
270
static void scsi_dma_restart_bh(void *opaque)
271
{
272
    SCSIDiskState *s = opaque;
273
    SCSIRequest *req;
274
    SCSIDiskReq *r;
275

    
276
    qemu_bh_delete(s->bh);
277
    s->bh = NULL;
278

    
279
    QTAILQ_FOREACH(req, &s->qdev.requests, next) {
280
        r = DO_UPCAST(SCSIDiskReq, req, req);
281
        if (r->status & SCSI_REQ_STATUS_RETRY) {
282
            r->status &= ~SCSI_REQ_STATUS_RETRY;
283
            scsi_write_request(r); 
284
        }
285
    }
286
}
287

    
288
static void scsi_dma_restart_cb(void *opaque, int running, int reason)
289
{
290
    SCSIDiskState *s = opaque;
291

    
292
    if (!running)
293
        return;
294

    
295
    if (!s->bh) {
296
        s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
297
        qemu_bh_schedule(s->bh);
298
    }
299
}
300

    
301
/* Return a pointer to the data buffer.  */
302
static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
303
{
304
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
305
    SCSIDiskReq *r;
306

    
307
    r = scsi_find_request(s, tag);
308
    if (!r) {
309
        BADF("Bad buffer tag 0x%x\n", tag);
310
        return NULL;
311
    }
312
    return (uint8_t *)r->iov.iov_base;
313
}
314

    
315
/* Execute a scsi command.  Returns the length of the data expected by the
316
   command.  This will be Positive for data transfers from the device
317
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
318
   and zero if the command does not transfer any data.  */
319

    
320
static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
321
                                 uint8_t *buf, int lun)
322
{
323
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
324
    uint64_t nb_sectors;
325
    uint64_t lba;
326
    uint32_t len;
327
    int cmdlen;
328
    int is_write;
329
    uint8_t command;
330
    uint8_t *outbuf;
331
    SCSIDiskReq *r;
332

    
333
    command = buf[0];
334
    r = scsi_find_request(s, tag);
335
    if (r) {
336
        BADF("Tag 0x%x already in use\n", tag);
337
        scsi_cancel_io(d, tag);
338
    }
339
    /* ??? Tags are not unique for different luns.  We only implement a
340
       single lun, so this should not matter.  */
341
    r = scsi_new_request(d, tag, lun);
342
    outbuf = (uint8_t *)r->iov.iov_base;
343
    is_write = 0;
344
    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
345
    switch (command >> 5) {
346
    case 0:
347
        lba = (uint64_t) buf[3] | ((uint64_t) buf[2] << 8) |
348
              (((uint64_t) buf[1] & 0x1f) << 16);
349
        len = buf[4];
350
        cmdlen = 6;
351
        break;
352
    case 1:
353
    case 2:
354
        lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
355
              ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
356
        len = buf[8] | (buf[7] << 8);
357
        cmdlen = 10;
358
        break;
359
    case 4:
360
        lba = (uint64_t) buf[9] | ((uint64_t) buf[8] << 8) |
361
              ((uint64_t) buf[7] << 16) | ((uint64_t) buf[6] << 24) |
362
              ((uint64_t) buf[5] << 32) | ((uint64_t) buf[4] << 40) |
363
              ((uint64_t) buf[3] << 48) | ((uint64_t) buf[2] << 56);
364
        len = buf[13] | (buf[12] << 8) | (buf[11] << 16) | (buf[10] << 24);
365
        cmdlen = 16;
366
        break;
367
    case 5:
368
        lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
369
              ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
370
        len = buf[9] | (buf[8] << 8) | (buf[7] << 16) | (buf[6] << 24);
371
        cmdlen = 12;
372
        break;
373
    default:
374
        BADF("Unsupported command length, command %x\n", command);
375
        goto fail;
376
    }
377
#ifdef DEBUG_SCSI
378
    {
379
        int i;
380
        for (i = 1; i < cmdlen; i++) {
381
            printf(" 0x%02x", buf[i]);
382
        }
383
        printf("\n");
384
    }
385
#endif
386
    if (lun || buf[1] >> 5) {
387
        /* Only LUN 0 supported.  */
388
        DPRINTF("Unimplemented LUN %d\n", lun ? lun : buf[1] >> 5);
389
        if (command != 0x03 && command != 0x12) /* REQUEST SENSE and INQUIRY */
390
            goto fail;
391
    }
392
    switch (command) {
393
    case 0x0:
394
        DPRINTF("Test Unit Ready\n");
395
        if (!bdrv_is_inserted(s->dinfo->bdrv))
396
            goto notready;
397
        break;
398
    case 0x03:
399
        DPRINTF("Request Sense (len %d)\n", len);
400
        if (len < 4)
401
            goto fail;
402
        memset(outbuf, 0, 4);
403
        r->iov.iov_len = 4;
404
        if (s->sense == SENSE_NOT_READY && len >= 18) {
405
            memset(outbuf, 0, 18);
406
            r->iov.iov_len = 18;
407
            outbuf[7] = 10;
408
            /* asc 0x3a, ascq 0: Medium not present */
409
            outbuf[12] = 0x3a;
410
            outbuf[13] = 0;
411
        }
412
        outbuf[0] = 0xf0;
413
        outbuf[1] = 0;
414
        outbuf[2] = s->sense;
415
        break;
416
    case 0x12:
417
        DPRINTF("Inquiry (len %d)\n", len);
418
        if (buf[1] & 0x2) {
419
            /* Command support data - optional, not implemented */
420
            BADF("optional INQUIRY command support request not implemented\n");
421
            goto fail;
422
        }
423
        else if (buf[1] & 0x1) {
424
            /* Vital product data */
425
            uint8_t page_code = buf[2];
426
            if (len < 4) {
427
                BADF("Error: Inquiry (EVPD[%02X]) buffer size %d is "
428
                     "less than 4\n", page_code, len);
429
                goto fail;
430
            }
431

    
432
            switch (page_code) {
433
                case 0x00:
434
                    {
435
                        /* Supported page codes, mandatory */
436
                        DPRINTF("Inquiry EVPD[Supported pages] "
437
                                "buffer size %d\n", len);
438

    
439
                        r->iov.iov_len = 0;
440

    
441
                        if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
442
                            outbuf[r->iov.iov_len++] = 5;
443
                        } else {
444
                            outbuf[r->iov.iov_len++] = 0;
445
                        }
446

    
447
                        outbuf[r->iov.iov_len++] = 0x00; // this page
448
                        outbuf[r->iov.iov_len++] = 0x00;
449
                        outbuf[r->iov.iov_len++] = 3;    // number of pages
450
                        outbuf[r->iov.iov_len++] = 0x00; // list of supported pages (this page)
451
                        outbuf[r->iov.iov_len++] = 0x80; // unit serial number
452
                        outbuf[r->iov.iov_len++] = 0x83; // device identification
453
                    }
454
                    break;
455
                case 0x80:
456
                    {
457
                        int l;
458

    
459
                        /* Device serial number, optional */
460
                        if (len < 4) {
461
                            BADF("Error: EVPD[Serial number] Inquiry buffer "
462
                                 "size %d too small, %d needed\n", len, 4);
463
                            goto fail;
464
                        }
465

    
466
                        DPRINTF("Inquiry EVPD[Serial number] buffer size %d\n", len);
467
                        l = MIN(len, strlen(s->drive_serial_str));
468

    
469
                        r->iov.iov_len = 0;
470

    
471
                        /* Supported page codes */
472
                        if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
473
                            outbuf[r->iov.iov_len++] = 5;
474
                        } else {
475
                            outbuf[r->iov.iov_len++] = 0;
476
                        }
477

    
478
                        outbuf[r->iov.iov_len++] = 0x80; // this page
479
                        outbuf[r->iov.iov_len++] = 0x00;
480
                        outbuf[r->iov.iov_len++] = l;
481
                        memcpy(&outbuf[r->iov.iov_len], s->drive_serial_str, l);
482
                        r->iov.iov_len += l;
483
                    }
484

    
485
                    break;
486
                case 0x83:
487
                    {
488
                        /* Device identification page, mandatory */
489
                        int max_len = 255 - 8;
490
                        int id_len = strlen(bdrv_get_device_name(s->dinfo->bdrv));
491
                        if (id_len > max_len)
492
                            id_len = max_len;
493

    
494
                        DPRINTF("Inquiry EVPD[Device identification] "
495
                                "buffer size %d\n", len);
496
                        r->iov.iov_len = 0;
497
                        if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
498
                            outbuf[r->iov.iov_len++] = 5;
499
                        } else {
500
                            outbuf[r->iov.iov_len++] = 0;
501
                        }
502

    
503
                        outbuf[r->iov.iov_len++] = 0x83; // this page
504
                        outbuf[r->iov.iov_len++] = 0x00;
505
                        outbuf[r->iov.iov_len++] = 3 + id_len;
506

    
507
                        outbuf[r->iov.iov_len++] = 0x2; // ASCII
508
                        outbuf[r->iov.iov_len++] = 0;   // not officially assigned
509
                        outbuf[r->iov.iov_len++] = 0;   // reserved
510
                        outbuf[r->iov.iov_len++] = id_len; // length of data following
511

    
512
                        memcpy(&outbuf[r->iov.iov_len],
513
                               bdrv_get_device_name(s->dinfo->bdrv), id_len);
514
                        r->iov.iov_len += id_len;
515
                    }
516
                    break;
517
                default:
518
                    BADF("Error: unsupported Inquiry (EVPD[%02X]) "
519
                         "buffer size %d\n", page_code, len);
520
                    goto fail;
521
            }
522
            /* done with EVPD */
523
            break;
524
        }
525
        else {
526
            /* Standard INQUIRY data */
527
            if (buf[2] != 0) {
528
                BADF("Error: Inquiry (STANDARD) page or code "
529
                     "is non-zero [%02X]\n", buf[2]);
530
                goto fail;
531
            }
532

    
533
            /* PAGE CODE == 0 */
534
            if (len < 5) {
535
                BADF("Error: Inquiry (STANDARD) buffer size %d "
536
                     "is less than 5\n", len);
537
                goto fail;
538
            }
539

    
540
            if (len < 36) {
541
                BADF("Error: Inquiry (STANDARD) buffer size %d "
542
                     "is less than 36 (TODO: only 5 required)\n", len);
543
            }
544
        }
545

    
546
        if(len > SCSI_MAX_INQUIRY_LEN)
547
            len = SCSI_MAX_INQUIRY_LEN;
548

    
549
        memset(outbuf, 0, len);
550

    
551
        if (lun || buf[1] >> 5) {
552
            outbuf[0] = 0x7f;        /* LUN not supported */
553
        } else if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
554
            outbuf[0] = 5;
555
            outbuf[1] = 0x80;
556
            memcpy(&outbuf[16], "QEMU CD-ROM    ", 16);
557
        } else {
558
            outbuf[0] = 0;
559
            memcpy(&outbuf[16], "QEMU HARDDISK  ", 16);
560
        }
561
        memcpy(&outbuf[8], "QEMU   ", 8);
562
        memcpy(&outbuf[32], QEMU_VERSION, 4);
563
        /* Identify device as SCSI-3 rev 1.
564
           Some later commands are also implemented. */
565
        outbuf[2] = 3;
566
        outbuf[3] = 2; /* Format 2 */
567
        outbuf[4] = len - 5; /* Additional Length = (Len - 1) - 4 */
568
        /* Sync data transfer and TCQ.  */
569
        outbuf[7] = 0x10 | (r->req.bus->tcq ? 0x02 : 0);
570
        r->iov.iov_len = len;
571
        break;
572
    case 0x16:
573
        DPRINTF("Reserve(6)\n");
574
        if (buf[1] & 1)
575
            goto fail;
576
        break;
577
    case 0x17:
578
        DPRINTF("Release(6)\n");
579
        if (buf[1] & 1)
580
            goto fail;
581
        break;
582
    case 0x1a:
583
    case 0x5a:
584
        {
585
            uint8_t *p;
586
            int page;
587
            int dbd;
588
            
589
            dbd = buf[1]  & 0x8;
590
            page = buf[2] & 0x3f;
591
            DPRINTF("Mode Sense (page %d, len %d)\n", page, len);
592
            p = outbuf;
593
            memset(p, 0, 4);
594
            outbuf[1] = 0; /* Default media type.  */
595
            outbuf[3] = 0; /* Block descriptor length.  */
596
            if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM ||
597
                bdrv_is_read_only(s->dinfo->bdrv)) {
598
                outbuf[2] = 0x80; /* Readonly.  */
599
            }
600
            p += 4;
601
            bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
602
            if ((~dbd) & nb_sectors) {
603
                nb_sectors /= s->cluster_size;
604
                nb_sectors--;
605
                if (nb_sectors > 0xffffff)
606
                    nb_sectors = 0xffffff;
607
                outbuf[3] = 8; /* Block descriptor length  */
608
                p[0] = 0; /* media density code */
609
                p[1] = (nb_sectors >> 16) & 0xff;
610
                p[2] = (nb_sectors >> 8) & 0xff;
611
                p[3] = nb_sectors & 0xff;
612
                p[4] = 0; /* reserved */
613
                p[5] = 0; /* bytes 5-7 are the sector size in bytes */
614
                p[6] = s->cluster_size * 2;
615
                p[7] = 0;
616
                p += 8;
617
            }
618

    
619
            if (page == 4) {
620
                int cylinders, heads, secs;
621

    
622
                /* Rigid disk device geometry page. */
623
                p[0] = 4;
624
                p[1] = 0x16;
625
                /* if a geometry hint is available, use it */
626
                bdrv_get_geometry_hint(s->dinfo->bdrv, &cylinders, &heads, &secs);
627
                p[2] = (cylinders >> 16) & 0xff;
628
                p[3] = (cylinders >> 8) & 0xff;
629
                p[4] = cylinders & 0xff;
630
                p[5] = heads & 0xff;
631
                /* Write precomp start cylinder, disabled */
632
                p[6] = (cylinders >> 16) & 0xff;
633
                p[7] = (cylinders >> 8) & 0xff;
634
                p[8] = cylinders & 0xff;
635
                /* Reduced current start cylinder, disabled */
636
                p[9] = (cylinders >> 16) & 0xff;
637
                p[10] = (cylinders >> 8) & 0xff;
638
                p[11] = cylinders & 0xff;
639
                /* Device step rate [ns], 200ns */
640
                p[12] = 0;
641
                p[13] = 200;
642
                /* Landing zone cylinder */
643
                p[14] = 0xff;
644
                p[15] =  0xff;
645
                p[16] = 0xff;
646
                /* Medium rotation rate [rpm], 5400 rpm */
647
                p[20] = (5400 >> 8) & 0xff;
648
                p[21] = 5400 & 0xff;
649
                p += 0x16;
650
            } else if (page == 5) {
651
                int cylinders, heads, secs;
652

    
653
                /* Flexible disk device geometry page. */
654
                p[0] = 5;
655
                p[1] = 0x1e;
656
                /* Transfer rate [kbit/s], 5Mbit/s */
657
                p[2] = 5000 >> 8;
658
                p[3] = 5000 & 0xff;
659
                /* if a geometry hint is available, use it */
660
                bdrv_get_geometry_hint(s->dinfo->bdrv, &cylinders, &heads, &secs);
661
                p[4] = heads & 0xff;
662
                p[5] = secs & 0xff;
663
                p[6] = s->cluster_size * 2;
664
                p[8] = (cylinders >> 8) & 0xff;
665
                p[9] = cylinders & 0xff;
666
                /* Write precomp start cylinder, disabled */
667
                p[10] = (cylinders >> 8) & 0xff;
668
                p[11] = cylinders & 0xff;
669
                /* Reduced current start cylinder, disabled */
670
                p[12] = (cylinders >> 8) & 0xff;
671
                p[13] = cylinders & 0xff;
672
                /* Device step rate [100us], 100us */
673
                p[14] = 0;
674
                p[15] = 1;
675
                /* Device step pulse width [us], 1us */
676
                p[16] = 1;
677
                /* Device head settle delay [100us], 100us */
678
                p[17] = 0;
679
                p[18] = 1;
680
                /* Motor on delay [0.1s], 0.1s */
681
                p[19] = 1;
682
                /* Motor off delay [0.1s], 0.1s */
683
                p[20] = 1;
684
                /* Medium rotation rate [rpm], 5400 rpm */
685
                p[28] = (5400 >> 8) & 0xff;
686
                p[29] = 5400 & 0xff;
687
                p += 0x1e;
688
            } else if ((page == 8 || page == 0x3f)) {
689
                /* Caching page.  */
690
                memset(p,0,20);
691
                p[0] = 8;
692
                p[1] = 0x12;
693
                if (bdrv_enable_write_cache(s->dinfo->bdrv)) {
694
                     p[2] = 4; /* WCE */
695
                }
696
                p += 20;
697
            }
698
            if ((page == 0x3f || page == 0x2a)
699
                    && (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM)) {
700
                /* CD Capabilities and Mechanical Status page. */
701
                p[0] = 0x2a;
702
                p[1] = 0x14;
703
                p[2] = 3; // CD-R & CD-RW read
704
                p[3] = 0; // Writing not supported
705
                p[4] = 0x7f; /* Audio, composite, digital out,
706
                                         mode 2 form 1&2, multi session */
707
                p[5] = 0xff; /* CD DA, DA accurate, RW supported,
708
                                         RW corrected, C2 errors, ISRC,
709
                                         UPC, Bar code */
710
                p[6] = 0x2d | (bdrv_is_locked(s->dinfo->bdrv)? 2 : 0);
711
                /* Locking supported, jumper present, eject, tray */
712
                p[7] = 0; /* no volume & mute control, no
713
                                      changer */
714
                p[8] = (50 * 176) >> 8; // 50x read speed
715
                p[9] = (50 * 176) & 0xff;
716
                p[10] = 0 >> 8; // No volume
717
                p[11] = 0 & 0xff;
718
                p[12] = 2048 >> 8; // 2M buffer
719
                p[13] = 2048 & 0xff;
720
                p[14] = (16 * 176) >> 8; // 16x read speed current
721
                p[15] = (16 * 176) & 0xff;
722
                p[18] = (16 * 176) >> 8; // 16x write speed
723
                p[19] = (16 * 176) & 0xff;
724
                p[20] = (16 * 176) >> 8; // 16x write speed current
725
                p[21] = (16 * 176) & 0xff;
726
                p += 22;
727
            }
728
            r->iov.iov_len = p - outbuf;
729
            outbuf[0] = r->iov.iov_len - 4;
730
            if (r->iov.iov_len > len)
731
                r->iov.iov_len = len;
732
        }
733
        break;
734
    case 0x1b:
735
        DPRINTF("Start Stop Unit\n");
736
        if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM &&
737
            (buf[4] & 2))
738
            /* load/eject medium */
739
            bdrv_eject(s->dinfo->bdrv, !(buf[4] & 1));
740
        break;
741
    case 0x1e:
742
        DPRINTF("Prevent Allow Medium Removal (prevent = %d)\n", buf[4] & 3);
743
        bdrv_set_locked(s->dinfo->bdrv, buf[4] & 1);
744
        break;
745
    case 0x25:
746
        DPRINTF("Read Capacity\n");
747
        /* The normal LEN field for this command is zero.  */
748
        memset(outbuf, 0, 8);
749
        bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
750
        nb_sectors /= s->cluster_size;
751
        /* Returned value is the address of the last sector.  */
752
        if (nb_sectors) {
753
            nb_sectors--;
754
            /* Remember the new size for read/write sanity checking. */
755
            s->max_lba = nb_sectors;
756
            /* Clip to 2TB, instead of returning capacity modulo 2TB. */
757
            if (nb_sectors > UINT32_MAX)
758
                nb_sectors = UINT32_MAX;
759
            outbuf[0] = (nb_sectors >> 24) & 0xff;
760
            outbuf[1] = (nb_sectors >> 16) & 0xff;
761
            outbuf[2] = (nb_sectors >> 8) & 0xff;
762
            outbuf[3] = nb_sectors & 0xff;
763
            outbuf[4] = 0;
764
            outbuf[5] = 0;
765
            outbuf[6] = s->cluster_size * 2;
766
            outbuf[7] = 0;
767
            r->iov.iov_len = 8;
768
        } else {
769
        notready:
770
            scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);
771
            return 0;
772
        }
773
        break;
774
    case 0x08:
775
    case 0x28:
776
    case 0x88:
777
        DPRINTF("Read (sector %" PRId64 ", count %d)\n", lba, len);
778
        if (lba > s->max_lba)
779
            goto illegal_lba;
780
        r->sector = lba * s->cluster_size;
781
        r->sector_count = len * s->cluster_size;
782
        break;
783
    case 0x0a:
784
    case 0x2a:
785
    case 0x8a:
786
        DPRINTF("Write (sector %" PRId64 ", count %d)\n", lba, len);
787
        if (lba > s->max_lba)
788
            goto illegal_lba;
789
        r->sector = lba * s->cluster_size;
790
        r->sector_count = len * s->cluster_size;
791
        is_write = 1;
792
        break;
793
    case 0x35:
794
        DPRINTF("Synchronise cache (sector %" PRId64 ", count %d)\n", lba, len);
795
        bdrv_flush(s->dinfo->bdrv);
796
        break;
797
    case 0x43:
798
        {
799
            int start_track, format, msf, toclen;
800

    
801
            msf = buf[1] & 2;
802
            format = buf[2] & 0xf;
803
            start_track = buf[6];
804
            bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
805
            DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
806
            nb_sectors /= s->cluster_size;
807
            switch(format) {
808
            case 0:
809
                toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
810
                break;
811
            case 1:
812
                /* multi session : only a single session defined */
813
                toclen = 12;
814
                memset(outbuf, 0, 12);
815
                outbuf[1] = 0x0a;
816
                outbuf[2] = 0x01;
817
                outbuf[3] = 0x01;
818
                break;
819
            case 2:
820
                toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
821
                break;
822
            default:
823
                goto error_cmd;
824
            }
825
            if (toclen > 0) {
826
                if (len > toclen)
827
                  len = toclen;
828
                r->iov.iov_len = len;
829
                break;
830
            }
831
        error_cmd:
832
            DPRINTF("Read TOC error\n");
833
            goto fail;
834
        }
835
    case 0x46:
836
        DPRINTF("Get Configuration (rt %d, maxlen %d)\n", buf[1] & 3, len);
837
        memset(outbuf, 0, 8);
838
        /* ??? This should probably return much more information.  For now
839
           just return the basic header indicating the CD-ROM profile.  */
840
        outbuf[7] = 8; // CD-ROM
841
        r->iov.iov_len = 8;
842
        break;
843
    case 0x56:
844
        DPRINTF("Reserve(10)\n");
845
        if (buf[1] & 3)
846
            goto fail;
847
        break;
848
    case 0x57:
849
        DPRINTF("Release(10)\n");
850
        if (buf[1] & 3)
851
            goto fail;
852
        break;
853
    case 0x9e:
854
        /* Service Action In subcommands. */
855
        if ((buf[1] & 31) == 0x10) {
856
            DPRINTF("SAI READ CAPACITY(16)\n");
857
            memset(outbuf, 0, len);
858
            bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
859
            nb_sectors /= s->cluster_size;
860
            /* Returned value is the address of the last sector.  */
861
            if (nb_sectors) {
862
                nb_sectors--;
863
                /* Remember the new size for read/write sanity checking. */
864
                s->max_lba = nb_sectors;
865
                outbuf[0] = (nb_sectors >> 56) & 0xff;
866
                outbuf[1] = (nb_sectors >> 48) & 0xff;
867
                outbuf[2] = (nb_sectors >> 40) & 0xff;
868
                outbuf[3] = (nb_sectors >> 32) & 0xff;
869
                outbuf[4] = (nb_sectors >> 24) & 0xff;
870
                outbuf[5] = (nb_sectors >> 16) & 0xff;
871
                outbuf[6] = (nb_sectors >> 8) & 0xff;
872
                outbuf[7] = nb_sectors & 0xff;
873
                outbuf[8] = 0;
874
                outbuf[9] = 0;
875
                outbuf[10] = s->cluster_size * 2;
876
                outbuf[11] = 0;
877
                /* Protection, exponent and lowest lba field left blank. */
878
                r->iov.iov_len = len;
879
            } else {
880
                scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);
881
                return 0;
882
            }
883
            break;
884
        }
885
        DPRINTF("Unsupported Service Action In\n");
886
        goto fail;
887
    case 0xa0:
888
        DPRINTF("Report LUNs (len %d)\n", len);
889
        if (len < 16)
890
            goto fail;
891
        memset(outbuf, 0, 16);
892
        outbuf[3] = 8;
893
        r->iov.iov_len = 16;
894
        break;
895
    case 0x2f:
896
        DPRINTF("Verify (sector %" PRId64 ", count %d)\n", lba, len);
897
        break;
898
    default:
899
        DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
900
    fail:
901
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_ILLEGAL_REQUEST);
902
        return 0;
903
    illegal_lba:
904
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
905
        return 0;
906
    }
907
    if (r->sector_count == 0 && r->iov.iov_len == 0) {
908
        scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
909
    }
910
    len = r->sector_count * 512 + r->iov.iov_len;
911
    if (is_write) {
912
        return -len;
913
    } else {
914
        if (!r->sector_count)
915
            r->sector_count = -1;
916
        return len;
917
    }
918
}
919

    
920
static void scsi_destroy(SCSIDevice *dev)
921
{
922
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
923
    SCSIDiskReq *r;
924

    
925
    while (!QTAILQ_EMPTY(&s->qdev.requests)) {
926
        r = DO_UPCAST(SCSIDiskReq, req, QTAILQ_FIRST(&s->qdev.requests));
927
        scsi_remove_request(r);
928
    }
929
    drive_uninit(s->dinfo);
930
}
931

    
932
static int scsi_disk_initfn(SCSIDevice *dev)
933
{
934
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
935
    uint64_t nb_sectors;
936

    
937
    if (!s->dinfo || !s->dinfo->bdrv) {
938
        qemu_error("scsi-disk: drive property not set\n");
939
        return -1;
940
    }
941

    
942
    if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
943
        s->cluster_size = 4;
944
    } else {
945
        s->cluster_size = 1;
946
    }
947
    bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
948
    nb_sectors /= s->cluster_size;
949
    if (nb_sectors)
950
        nb_sectors--;
951
    s->max_lba = nb_sectors;
952
    strncpy(s->drive_serial_str, drive_get_serial(s->dinfo->bdrv),
953
            sizeof(s->drive_serial_str));
954
    if (strlen(s->drive_serial_str) == 0)
955
        pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), "0");
956
    qemu_add_vm_change_state_handler(scsi_dma_restart_cb, s);
957
    return 0;
958
}
959

    
960
static SCSIDeviceInfo scsi_disk_info = {
961
    .qdev.name    = "scsi-disk",
962
    .qdev.desc    = "virtual scsi disk or cdrom",
963
    .qdev.size    = sizeof(SCSIDiskState),
964
    .init         = scsi_disk_initfn,
965
    .destroy      = scsi_destroy,
966
    .send_command = scsi_send_command,
967
    .read_data    = scsi_read_data,
968
    .write_data   = scsi_write_data,
969
    .cancel_io    = scsi_cancel_io,
970
    .get_buf      = scsi_get_buf,
971
    .qdev.props   = (Property[]) {
972
        DEFINE_PROP_DRIVE("drive", SCSIDiskState, dinfo),
973
        DEFINE_PROP_END_OF_LIST(),
974
    },
975
};
976

    
977
static void scsi_disk_register_devices(void)
978
{
979
    scsi_qdev_register(&scsi_disk_info);
980
}
981
device_init(scsi_disk_register_devices)