Statistics
| Branch: | Revision:

root / hw / scsi-disk.c @ 9af99d98

History | View | Annotate | Download (32.5 kB)

1
/*
2
 * SCSI Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Based on code by Fabrice Bellard
6
 *
7
 * Written by Paul Brook
8
 *
9
 * This code is licenced under the LGPL.
10
 *
11
 * Note that this file only handles the SCSI architecture model and device
12
 * commands.  Emulation of interface/link layer protocols is handled by
13
 * the host adapter emulator.
14
 */
15

    
16
#include <qemu-common.h>
17
#include <sysemu.h>
18
//#define DEBUG_SCSI
19

    
20
#ifdef DEBUG_SCSI
21
#define DPRINTF(fmt, ...) \
22
do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
23
#else
24
#define DPRINTF(fmt, ...) do {} while(0)
25
#endif
26

    
27
#define BADF(fmt, ...) \
28
do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
29

    
30
#include "qemu-common.h"
31
#include "block.h"
32
#include "scsi.h"
33

    
34
#define SENSE_NO_SENSE        0
35
#define SENSE_NOT_READY       2
36
#define SENSE_HARDWARE_ERROR  4
37
#define SENSE_ILLEGAL_REQUEST 5
38

    
39
#define STATUS_GOOD            0
40
#define STATUS_CHECK_CONDITION 2
41

    
42
#define SCSI_DMA_BUF_SIZE    131072
43
#define SCSI_MAX_INQUIRY_LEN 256
44

    
45
#define SCSI_REQ_STATUS_RETRY 0x01
46

    
47
typedef struct SCSIDiskState SCSIDiskState;
48

    
49
typedef struct SCSIDiskReq {
50
    SCSIRequest req;
51
    /* ??? We should probably keep track of whether the data transfer is
52
       a read or a write.  Currently we rely on the host getting it right.  */
53
    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
54
    uint64_t sector;
55
    uint32_t sector_count;
56
    struct iovec iov;
57
    QEMUIOVector qiov;
58
    uint32_t status;
59
} SCSIDiskReq;
60

    
61
struct SCSIDiskState
62
{
63
    SCSIDevice qdev;
64
    DriveInfo *dinfo;
65
    /* The qemu block layer uses a fixed 512 byte sector size.
66
       This is the number of 512 byte blocks in a single scsi sector.  */
67
    int cluster_size;
68
    uint64_t max_lba;
69
    int sense;
70
    char drive_serial_str[21];
71
    QEMUBH *bh;
72
};
73

    
74
static SCSIDiskReq *scsi_new_request(SCSIDevice *d, uint32_t tag)
75
{
76
    SCSIDiskReq *r;
77

    
78
    r = qemu_mallocz(sizeof(SCSIDiskReq));
79
    r->iov.iov_base = qemu_memalign(512, SCSI_DMA_BUF_SIZE);
80
    r->req.bus = scsi_bus_from_device(d);
81
    r->req.dev = d;
82
    r->req.tag = tag;
83

    
84
    QTAILQ_INSERT_TAIL(&d->requests, &r->req, next);
85
    return r;
86
}
87

    
88
static void scsi_remove_request(SCSIDiskReq *r)
89
{
90
    qemu_free(r->iov.iov_base);
91
    QTAILQ_REMOVE(&r->req.dev->requests, &r->req, next);
92
    qemu_free(r);
93
}
94

    
95
static SCSIDiskReq *scsi_find_request(SCSIDiskState *s, uint32_t tag)
96
{
97
    SCSIRequest *req;
98

    
99
    QTAILQ_FOREACH(req, &s->qdev.requests, next) {
100
        if (req->tag == tag) {
101
            return DO_UPCAST(SCSIDiskReq, req, req);
102
        }
103
    }
104
    return NULL;
105
}
106

    
107
/* Helper function for command completion.  */
108
static void scsi_command_complete(SCSIDiskReq *r, int status, int sense)
109
{
110
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
111
    uint32_t tag;
112
    DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
113
            r->req.tag, status, sense);
114
    s->sense = sense;
115
    tag = r->req.tag;
116
    scsi_remove_request(r);
117
    r->req.bus->complete(r->req.bus, SCSI_REASON_DONE, tag, status);
118
}
119

    
120
/* Cancel a pending data transfer.  */
121
static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
122
{
123
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
124
    SCSIDiskReq *r;
125
    DPRINTF("Cancel tag=0x%x\n", tag);
126
    r = scsi_find_request(s, tag);
127
    if (r) {
128
        if (r->req.aiocb)
129
            bdrv_aio_cancel(r->req.aiocb);
130
        r->req.aiocb = NULL;
131
        scsi_remove_request(r);
132
    }
133
}
134

    
135
static void scsi_read_complete(void * opaque, int ret)
136
{
137
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
138

    
139
    if (ret) {
140
        DPRINTF("IO error\n");
141
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, 0);
142
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NO_SENSE);
143
        return;
144
    }
145
    DPRINTF("Data ready tag=0x%x len=%" PRId64 "\n", r->req.tag, r->iov.iov_len);
146

    
147
    r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, r->iov.iov_len);
148
}
149

    
150
/* Read more data from scsi device into buffer.  */
151
static void scsi_read_data(SCSIDevice *d, uint32_t tag)
152
{
153
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
154
    SCSIDiskReq *r;
155
    uint32_t n;
156

    
157
    r = scsi_find_request(s, tag);
158
    if (!r) {
159
        BADF("Bad read tag 0x%x\n", tag);
160
        /* ??? This is the wrong error.  */
161
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
162
        return;
163
    }
164
    if (r->sector_count == (uint32_t)-1) {
165
        DPRINTF("Read buf_len=%" PRId64 "\n", r->iov.iov_len);
166
        r->sector_count = 0;
167
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, r->iov.iov_len);
168
        return;
169
    }
170
    DPRINTF("Read sector_count=%d\n", r->sector_count);
171
    if (r->sector_count == 0) {
172
        scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
173
        return;
174
    }
175

    
176
    n = r->sector_count;
177
    if (n > SCSI_DMA_BUF_SIZE / 512)
178
        n = SCSI_DMA_BUF_SIZE / 512;
179

    
180
    r->iov.iov_len = n * 512;
181
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
182
    r->req.aiocb = bdrv_aio_readv(s->dinfo->bdrv, r->sector, &r->qiov, n,
183
                              scsi_read_complete, r);
184
    if (r->req.aiocb == NULL)
185
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
186
    r->sector += n;
187
    r->sector_count -= n;
188
}
189

    
190
static int scsi_handle_write_error(SCSIDiskReq *r, int error)
191
{
192
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
193
    BlockInterfaceErrorAction action = drive_get_onerror(s->dinfo->bdrv);
194

    
195
    if (action == BLOCK_ERR_IGNORE)
196
        return 0;
197

    
198
    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
199
            || action == BLOCK_ERR_STOP_ANY) {
200
        r->status |= SCSI_REQ_STATUS_RETRY;
201
        vm_stop(0);
202
    } else {
203
        scsi_command_complete(r, STATUS_CHECK_CONDITION,
204
                SENSE_HARDWARE_ERROR);
205
    }
206

    
207
    return 1;
208
}
209

    
210
static void scsi_write_complete(void * opaque, int ret)
211
{
212
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
213
    uint32_t len;
214
    uint32_t n;
215

    
216
    r->req.aiocb = NULL;
217

    
218
    if (ret) {
219
        if (scsi_handle_write_error(r, -ret))
220
            return;
221
    }
222

    
223
    n = r->iov.iov_len / 512;
224
    r->sector += n;
225
    r->sector_count -= n;
226
    if (r->sector_count == 0) {
227
        scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
228
    } else {
229
        len = r->sector_count * 512;
230
        if (len > SCSI_DMA_BUF_SIZE) {
231
            len = SCSI_DMA_BUF_SIZE;
232
        }
233
        r->iov.iov_len = len;
234
        DPRINTF("Write complete tag=0x%x more=%d\n", r->req.tag, len);
235
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);
236
    }
237
}
238

    
239
static void scsi_write_request(SCSIDiskReq *r)
240
{
241
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
242
    uint32_t n;
243

    
244
    n = r->iov.iov_len / 512;
245
    if (n) {
246
        qemu_iovec_init_external(&r->qiov, &r->iov, 1);
247
        r->req.aiocb = bdrv_aio_writev(s->dinfo->bdrv, r->sector, &r->qiov, n,
248
                                   scsi_write_complete, r);
249
        if (r->req.aiocb == NULL)
250
            scsi_command_complete(r, STATUS_CHECK_CONDITION,
251
                                  SENSE_HARDWARE_ERROR);
252
    } else {
253
        /* Invoke completion routine to fetch data from host.  */
254
        scsi_write_complete(r, 0);
255
    }
256
}
257

    
258
/* Write data to a scsi device.  Returns nonzero on failure.
259
   The transfer may complete asynchronously.  */
260
static int scsi_write_data(SCSIDevice *d, uint32_t tag)
261
{
262
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
263
    SCSIDiskReq *r;
264

    
265
    DPRINTF("Write data tag=0x%x\n", tag);
266
    r = scsi_find_request(s, tag);
267
    if (!r) {
268
        BADF("Bad write tag 0x%x\n", tag);
269
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
270
        return 1;
271
    }
272

    
273
    if (r->req.aiocb)
274
        BADF("Data transfer already in progress\n");
275

    
276
    scsi_write_request(r);
277

    
278
    return 0;
279
}
280

    
281
static void scsi_dma_restart_bh(void *opaque)
282
{
283
    SCSIDiskState *s = opaque;
284
    SCSIRequest *req;
285
    SCSIDiskReq *r;
286

    
287
    qemu_bh_delete(s->bh);
288
    s->bh = NULL;
289

    
290
    QTAILQ_FOREACH(req, &s->qdev.requests, next) {
291
        r = DO_UPCAST(SCSIDiskReq, req, req);
292
        if (r->status & SCSI_REQ_STATUS_RETRY) {
293
            r->status &= ~SCSI_REQ_STATUS_RETRY;
294
            scsi_write_request(r); 
295
        }
296
    }
297
}
298

    
299
static void scsi_dma_restart_cb(void *opaque, int running, int reason)
300
{
301
    SCSIDiskState *s = opaque;
302

    
303
    if (!running)
304
        return;
305

    
306
    if (!s->bh) {
307
        s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
308
        qemu_bh_schedule(s->bh);
309
    }
310
}
311

    
312
/* Return a pointer to the data buffer.  */
313
static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
314
{
315
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
316
    SCSIDiskReq *r;
317

    
318
    r = scsi_find_request(s, tag);
319
    if (!r) {
320
        BADF("Bad buffer tag 0x%x\n", tag);
321
        return NULL;
322
    }
323
    return (uint8_t *)r->iov.iov_base;
324
}
325

    
326
/* Execute a scsi command.  Returns the length of the data expected by the
327
   command.  This will be Positive for data transfers from the device
328
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
329
   and zero if the command does not transfer any data.  */
330

    
331
static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
332
                                 uint8_t *buf, int lun)
333
{
334
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
335
    uint64_t nb_sectors;
336
    uint64_t lba;
337
    uint32_t len;
338
    int cmdlen;
339
    int is_write;
340
    uint8_t command;
341
    uint8_t *outbuf;
342
    SCSIDiskReq *r;
343

    
344
    command = buf[0];
345
    r = scsi_find_request(s, tag);
346
    if (r) {
347
        BADF("Tag 0x%x already in use\n", tag);
348
        scsi_cancel_io(d, tag);
349
    }
350
    /* ??? Tags are not unique for different luns.  We only implement a
351
       single lun, so this should not matter.  */
352
    r = scsi_new_request(d, tag);
353
    outbuf = (uint8_t *)r->iov.iov_base;
354
    is_write = 0;
355
    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
356
    switch (command >> 5) {
357
    case 0:
358
        lba = (uint64_t) buf[3] | ((uint64_t) buf[2] << 8) |
359
              (((uint64_t) buf[1] & 0x1f) << 16);
360
        len = buf[4];
361
        cmdlen = 6;
362
        break;
363
    case 1:
364
    case 2:
365
        lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
366
              ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
367
        len = buf[8] | (buf[7] << 8);
368
        cmdlen = 10;
369
        break;
370
    case 4:
371
        lba = (uint64_t) buf[9] | ((uint64_t) buf[8] << 8) |
372
              ((uint64_t) buf[7] << 16) | ((uint64_t) buf[6] << 24) |
373
              ((uint64_t) buf[5] << 32) | ((uint64_t) buf[4] << 40) |
374
              ((uint64_t) buf[3] << 48) | ((uint64_t) buf[2] << 56);
375
        len = buf[13] | (buf[12] << 8) | (buf[11] << 16) | (buf[10] << 24);
376
        cmdlen = 16;
377
        break;
378
    case 5:
379
        lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
380
              ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
381
        len = buf[9] | (buf[8] << 8) | (buf[7] << 16) | (buf[6] << 24);
382
        cmdlen = 12;
383
        break;
384
    default:
385
        BADF("Unsupported command length, command %x\n", command);
386
        goto fail;
387
    }
388
#ifdef DEBUG_SCSI
389
    {
390
        int i;
391
        for (i = 1; i < cmdlen; i++) {
392
            printf(" 0x%02x", buf[i]);
393
        }
394
        printf("\n");
395
    }
396
#endif
397
    if (lun || buf[1] >> 5) {
398
        /* Only LUN 0 supported.  */
399
        DPRINTF("Unimplemented LUN %d\n", lun ? lun : buf[1] >> 5);
400
        if (command != 0x03 && command != 0x12) /* REQUEST SENSE and INQUIRY */
401
            goto fail;
402
    }
403
    switch (command) {
404
    case 0x0:
405
        DPRINTF("Test Unit Ready\n");
406
        if (!bdrv_is_inserted(s->dinfo->bdrv))
407
            goto notready;
408
        break;
409
    case 0x03:
410
        DPRINTF("Request Sense (len %d)\n", len);
411
        if (len < 4)
412
            goto fail;
413
        memset(outbuf, 0, 4);
414
        r->iov.iov_len = 4;
415
        if (s->sense == SENSE_NOT_READY && len >= 18) {
416
            memset(outbuf, 0, 18);
417
            r->iov.iov_len = 18;
418
            outbuf[7] = 10;
419
            /* asc 0x3a, ascq 0: Medium not present */
420
            outbuf[12] = 0x3a;
421
            outbuf[13] = 0;
422
        }
423
        outbuf[0] = 0xf0;
424
        outbuf[1] = 0;
425
        outbuf[2] = s->sense;
426
        break;
427
    case 0x12:
428
        DPRINTF("Inquiry (len %d)\n", len);
429
        if (buf[1] & 0x2) {
430
            /* Command support data - optional, not implemented */
431
            BADF("optional INQUIRY command support request not implemented\n");
432
            goto fail;
433
        }
434
        else if (buf[1] & 0x1) {
435
            /* Vital product data */
436
            uint8_t page_code = buf[2];
437
            if (len < 4) {
438
                BADF("Error: Inquiry (EVPD[%02X]) buffer size %d is "
439
                     "less than 4\n", page_code, len);
440
                goto fail;
441
            }
442

    
443
            switch (page_code) {
444
                case 0x00:
445
                    {
446
                        /* Supported page codes, mandatory */
447
                        DPRINTF("Inquiry EVPD[Supported pages] "
448
                                "buffer size %d\n", len);
449

    
450
                        r->iov.iov_len = 0;
451

    
452
                        if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
453
                            outbuf[r->iov.iov_len++] = 5;
454
                        } else {
455
                            outbuf[r->iov.iov_len++] = 0;
456
                        }
457

    
458
                        outbuf[r->iov.iov_len++] = 0x00; // this page
459
                        outbuf[r->iov.iov_len++] = 0x00;
460
                        outbuf[r->iov.iov_len++] = 3;    // number of pages
461
                        outbuf[r->iov.iov_len++] = 0x00; // list of supported pages (this page)
462
                        outbuf[r->iov.iov_len++] = 0x80; // unit serial number
463
                        outbuf[r->iov.iov_len++] = 0x83; // device identification
464
                    }
465
                    break;
466
                case 0x80:
467
                    {
468
                        int l;
469

    
470
                        /* Device serial number, optional */
471
                        if (len < 4) {
472
                            BADF("Error: EVPD[Serial number] Inquiry buffer "
473
                                 "size %d too small, %d needed\n", len, 4);
474
                            goto fail;
475
                        }
476

    
477
                        DPRINTF("Inquiry EVPD[Serial number] buffer size %d\n", len);
478
                        l = MIN(len, strlen(s->drive_serial_str));
479

    
480
                        r->iov.iov_len = 0;
481

    
482
                        /* Supported page codes */
483
                        if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
484
                            outbuf[r->iov.iov_len++] = 5;
485
                        } else {
486
                            outbuf[r->iov.iov_len++] = 0;
487
                        }
488

    
489
                        outbuf[r->iov.iov_len++] = 0x80; // this page
490
                        outbuf[r->iov.iov_len++] = 0x00;
491
                        outbuf[r->iov.iov_len++] = l;
492
                        memcpy(&outbuf[r->iov.iov_len], s->drive_serial_str, l);
493
                        r->iov.iov_len += l;
494
                    }
495

    
496
                    break;
497
                case 0x83:
498
                    {
499
                        /* Device identification page, mandatory */
500
                        int max_len = 255 - 8;
501
                        int id_len = strlen(bdrv_get_device_name(s->dinfo->bdrv));
502
                        if (id_len > max_len)
503
                            id_len = max_len;
504

    
505
                        DPRINTF("Inquiry EVPD[Device identification] "
506
                                "buffer size %d\n", len);
507
                        r->iov.iov_len = 0;
508
                        if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
509
                            outbuf[r->iov.iov_len++] = 5;
510
                        } else {
511
                            outbuf[r->iov.iov_len++] = 0;
512
                        }
513

    
514
                        outbuf[r->iov.iov_len++] = 0x83; // this page
515
                        outbuf[r->iov.iov_len++] = 0x00;
516
                        outbuf[r->iov.iov_len++] = 3 + id_len;
517

    
518
                        outbuf[r->iov.iov_len++] = 0x2; // ASCII
519
                        outbuf[r->iov.iov_len++] = 0;   // not officially assigned
520
                        outbuf[r->iov.iov_len++] = 0;   // reserved
521
                        outbuf[r->iov.iov_len++] = id_len; // length of data following
522

    
523
                        memcpy(&outbuf[r->iov.iov_len],
524
                               bdrv_get_device_name(s->dinfo->bdrv), id_len);
525
                        r->iov.iov_len += id_len;
526
                    }
527
                    break;
528
                default:
529
                    BADF("Error: unsupported Inquiry (EVPD[%02X]) "
530
                         "buffer size %d\n", page_code, len);
531
                    goto fail;
532
            }
533
            /* done with EVPD */
534
            break;
535
        }
536
        else {
537
            /* Standard INQUIRY data */
538
            if (buf[2] != 0) {
539
                BADF("Error: Inquiry (STANDARD) page or code "
540
                     "is non-zero [%02X]\n", buf[2]);
541
                goto fail;
542
            }
543

    
544
            /* PAGE CODE == 0 */
545
            if (len < 5) {
546
                BADF("Error: Inquiry (STANDARD) buffer size %d "
547
                     "is less than 5\n", len);
548
                goto fail;
549
            }
550

    
551
            if (len < 36) {
552
                BADF("Error: Inquiry (STANDARD) buffer size %d "
553
                     "is less than 36 (TODO: only 5 required)\n", len);
554
            }
555
        }
556

    
557
        if(len > SCSI_MAX_INQUIRY_LEN)
558
            len = SCSI_MAX_INQUIRY_LEN;
559

    
560
        memset(outbuf, 0, len);
561

    
562
        if (lun || buf[1] >> 5) {
563
            outbuf[0] = 0x7f;        /* LUN not supported */
564
        } else if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
565
            outbuf[0] = 5;
566
            outbuf[1] = 0x80;
567
            memcpy(&outbuf[16], "QEMU CD-ROM    ", 16);
568
        } else {
569
            outbuf[0] = 0;
570
            memcpy(&outbuf[16], "QEMU HARDDISK  ", 16);
571
        }
572
        memcpy(&outbuf[8], "QEMU   ", 8);
573
        memcpy(&outbuf[32], QEMU_VERSION, 4);
574
        /* Identify device as SCSI-3 rev 1.
575
           Some later commands are also implemented. */
576
        outbuf[2] = 3;
577
        outbuf[3] = 2; /* Format 2 */
578
        outbuf[4] = len - 5; /* Additional Length = (Len - 1) - 4 */
579
        /* Sync data transfer and TCQ.  */
580
        outbuf[7] = 0x10 | (r->req.bus->tcq ? 0x02 : 0);
581
        r->iov.iov_len = len;
582
        break;
583
    case 0x16:
584
        DPRINTF("Reserve(6)\n");
585
        if (buf[1] & 1)
586
            goto fail;
587
        break;
588
    case 0x17:
589
        DPRINTF("Release(6)\n");
590
        if (buf[1] & 1)
591
            goto fail;
592
        break;
593
    case 0x1a:
594
    case 0x5a:
595
        {
596
            uint8_t *p;
597
            int page;
598
            int dbd;
599
            
600
            dbd = buf[1]  & 0x8;
601
            page = buf[2] & 0x3f;
602
            DPRINTF("Mode Sense (page %d, len %d)\n", page, len);
603
            p = outbuf;
604
            memset(p, 0, 4);
605
            outbuf[1] = 0; /* Default media type.  */
606
            outbuf[3] = 0; /* Block descriptor length.  */
607
            if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM ||
608
                bdrv_is_read_only(s->dinfo->bdrv)) {
609
                outbuf[2] = 0x80; /* Readonly.  */
610
            }
611
            p += 4;
612
            bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
613
            if ((~dbd) & nb_sectors) {
614
                nb_sectors /= s->cluster_size;
615
                nb_sectors--;
616
                if (nb_sectors > 0xffffff)
617
                    nb_sectors = 0xffffff;
618
                outbuf[3] = 8; /* Block descriptor length  */
619
                p[0] = 0; /* media density code */
620
                p[1] = (nb_sectors >> 16) & 0xff;
621
                p[2] = (nb_sectors >> 8) & 0xff;
622
                p[3] = nb_sectors & 0xff;
623
                p[4] = 0; /* reserved */
624
                p[5] = 0; /* bytes 5-7 are the sector size in bytes */
625
                p[6] = s->cluster_size * 2;
626
                p[7] = 0;
627
                p += 8;
628
            }
629

    
630
            if (page == 4) {
631
                int cylinders, heads, secs;
632

    
633
                /* Rigid disk device geometry page. */
634
                p[0] = 4;
635
                p[1] = 0x16;
636
                /* if a geometry hint is available, use it */
637
                bdrv_get_geometry_hint(s->dinfo->bdrv, &cylinders, &heads, &secs);
638
                p[2] = (cylinders >> 16) & 0xff;
639
                p[3] = (cylinders >> 8) & 0xff;
640
                p[4] = cylinders & 0xff;
641
                p[5] = heads & 0xff;
642
                /* Write precomp start cylinder, disabled */
643
                p[6] = (cylinders >> 16) & 0xff;
644
                p[7] = (cylinders >> 8) & 0xff;
645
                p[8] = cylinders & 0xff;
646
                /* Reduced current start cylinder, disabled */
647
                p[9] = (cylinders >> 16) & 0xff;
648
                p[10] = (cylinders >> 8) & 0xff;
649
                p[11] = cylinders & 0xff;
650
                /* Device step rate [ns], 200ns */
651
                p[12] = 0;
652
                p[13] = 200;
653
                /* Landing zone cylinder */
654
                p[14] = 0xff;
655
                p[15] =  0xff;
656
                p[16] = 0xff;
657
                /* Medium rotation rate [rpm], 5400 rpm */
658
                p[20] = (5400 >> 8) & 0xff;
659
                p[21] = 5400 & 0xff;
660
                p += 0x16;
661
            } else if (page == 5) {
662
                int cylinders, heads, secs;
663

    
664
                /* Flexible disk device geometry page. */
665
                p[0] = 5;
666
                p[1] = 0x1e;
667
                /* Transfer rate [kbit/s], 5Mbit/s */
668
                p[2] = 5000 >> 8;
669
                p[3] = 5000 & 0xff;
670
                /* if a geometry hint is available, use it */
671
                bdrv_get_geometry_hint(s->dinfo->bdrv, &cylinders, &heads, &secs);
672
                p[4] = heads & 0xff;
673
                p[5] = secs & 0xff;
674
                p[6] = s->cluster_size * 2;
675
                p[8] = (cylinders >> 8) & 0xff;
676
                p[9] = cylinders & 0xff;
677
                /* Write precomp start cylinder, disabled */
678
                p[10] = (cylinders >> 8) & 0xff;
679
                p[11] = cylinders & 0xff;
680
                /* Reduced current start cylinder, disabled */
681
                p[12] = (cylinders >> 8) & 0xff;
682
                p[13] = cylinders & 0xff;
683
                /* Device step rate [100us], 100us */
684
                p[14] = 0;
685
                p[15] = 1;
686
                /* Device step pulse width [us], 1us */
687
                p[16] = 1;
688
                /* Device head settle delay [100us], 100us */
689
                p[17] = 0;
690
                p[18] = 1;
691
                /* Motor on delay [0.1s], 0.1s */
692
                p[19] = 1;
693
                /* Motor off delay [0.1s], 0.1s */
694
                p[20] = 1;
695
                /* Medium rotation rate [rpm], 5400 rpm */
696
                p[28] = (5400 >> 8) & 0xff;
697
                p[29] = 5400 & 0xff;
698
                p += 0x1e;
699
            } else if ((page == 8 || page == 0x3f)) {
700
                /* Caching page.  */
701
                memset(p,0,20);
702
                p[0] = 8;
703
                p[1] = 0x12;
704
                if (bdrv_enable_write_cache(s->dinfo->bdrv)) {
705
                     p[2] = 4; /* WCE */
706
                }
707
                p += 20;
708
            }
709
            if ((page == 0x3f || page == 0x2a)
710
                    && (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM)) {
711
                /* CD Capabilities and Mechanical Status page. */
712
                p[0] = 0x2a;
713
                p[1] = 0x14;
714
                p[2] = 3; // CD-R & CD-RW read
715
                p[3] = 0; // Writing not supported
716
                p[4] = 0x7f; /* Audio, composite, digital out,
717
                                         mode 2 form 1&2, multi session */
718
                p[5] = 0xff; /* CD DA, DA accurate, RW supported,
719
                                         RW corrected, C2 errors, ISRC,
720
                                         UPC, Bar code */
721
                p[6] = 0x2d | (bdrv_is_locked(s->dinfo->bdrv)? 2 : 0);
722
                /* Locking supported, jumper present, eject, tray */
723
                p[7] = 0; /* no volume & mute control, no
724
                                      changer */
725
                p[8] = (50 * 176) >> 8; // 50x read speed
726
                p[9] = (50 * 176) & 0xff;
727
                p[10] = 0 >> 8; // No volume
728
                p[11] = 0 & 0xff;
729
                p[12] = 2048 >> 8; // 2M buffer
730
                p[13] = 2048 & 0xff;
731
                p[14] = (16 * 176) >> 8; // 16x read speed current
732
                p[15] = (16 * 176) & 0xff;
733
                p[18] = (16 * 176) >> 8; // 16x write speed
734
                p[19] = (16 * 176) & 0xff;
735
                p[20] = (16 * 176) >> 8; // 16x write speed current
736
                p[21] = (16 * 176) & 0xff;
737
                p += 22;
738
            }
739
            r->iov.iov_len = p - outbuf;
740
            outbuf[0] = r->iov.iov_len - 4;
741
            if (r->iov.iov_len > len)
742
                r->iov.iov_len = len;
743
        }
744
        break;
745
    case 0x1b:
746
        DPRINTF("Start Stop Unit\n");
747
        if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM &&
748
            (buf[4] & 2))
749
            /* load/eject medium */
750
            bdrv_eject(s->dinfo->bdrv, !(buf[4] & 1));
751
        break;
752
    case 0x1e:
753
        DPRINTF("Prevent Allow Medium Removal (prevent = %d)\n", buf[4] & 3);
754
        bdrv_set_locked(s->dinfo->bdrv, buf[4] & 1);
755
        break;
756
    case 0x25:
757
        DPRINTF("Read Capacity\n");
758
        /* The normal LEN field for this command is zero.  */
759
        memset(outbuf, 0, 8);
760
        bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
761
        nb_sectors /= s->cluster_size;
762
        /* Returned value is the address of the last sector.  */
763
        if (nb_sectors) {
764
            nb_sectors--;
765
            /* Remember the new size for read/write sanity checking. */
766
            s->max_lba = nb_sectors;
767
            /* Clip to 2TB, instead of returning capacity modulo 2TB. */
768
            if (nb_sectors > UINT32_MAX)
769
                nb_sectors = UINT32_MAX;
770
            outbuf[0] = (nb_sectors >> 24) & 0xff;
771
            outbuf[1] = (nb_sectors >> 16) & 0xff;
772
            outbuf[2] = (nb_sectors >> 8) & 0xff;
773
            outbuf[3] = nb_sectors & 0xff;
774
            outbuf[4] = 0;
775
            outbuf[5] = 0;
776
            outbuf[6] = s->cluster_size * 2;
777
            outbuf[7] = 0;
778
            r->iov.iov_len = 8;
779
        } else {
780
        notready:
781
            scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);
782
            return 0;
783
        }
784
        break;
785
    case 0x08:
786
    case 0x28:
787
    case 0x88:
788
        DPRINTF("Read (sector %" PRId64 ", count %d)\n", lba, len);
789
        if (lba > s->max_lba)
790
            goto illegal_lba;
791
        r->sector = lba * s->cluster_size;
792
        r->sector_count = len * s->cluster_size;
793
        break;
794
    case 0x0a:
795
    case 0x2a:
796
    case 0x8a:
797
        DPRINTF("Write (sector %" PRId64 ", count %d)\n", lba, len);
798
        if (lba > s->max_lba)
799
            goto illegal_lba;
800
        r->sector = lba * s->cluster_size;
801
        r->sector_count = len * s->cluster_size;
802
        is_write = 1;
803
        break;
804
    case 0x35:
805
        DPRINTF("Synchronise cache (sector %" PRId64 ", count %d)\n", lba, len);
806
        bdrv_flush(s->dinfo->bdrv);
807
        break;
808
    case 0x43:
809
        {
810
            int start_track, format, msf, toclen;
811

    
812
            msf = buf[1] & 2;
813
            format = buf[2] & 0xf;
814
            start_track = buf[6];
815
            bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
816
            DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
817
            nb_sectors /= s->cluster_size;
818
            switch(format) {
819
            case 0:
820
                toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
821
                break;
822
            case 1:
823
                /* multi session : only a single session defined */
824
                toclen = 12;
825
                memset(outbuf, 0, 12);
826
                outbuf[1] = 0x0a;
827
                outbuf[2] = 0x01;
828
                outbuf[3] = 0x01;
829
                break;
830
            case 2:
831
                toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
832
                break;
833
            default:
834
                goto error_cmd;
835
            }
836
            if (toclen > 0) {
837
                if (len > toclen)
838
                  len = toclen;
839
                r->iov.iov_len = len;
840
                break;
841
            }
842
        error_cmd:
843
            DPRINTF("Read TOC error\n");
844
            goto fail;
845
        }
846
    case 0x46:
847
        DPRINTF("Get Configuration (rt %d, maxlen %d)\n", buf[1] & 3, len);
848
        memset(outbuf, 0, 8);
849
        /* ??? This should probably return much more information.  For now
850
           just return the basic header indicating the CD-ROM profile.  */
851
        outbuf[7] = 8; // CD-ROM
852
        r->iov.iov_len = 8;
853
        break;
854
    case 0x56:
855
        DPRINTF("Reserve(10)\n");
856
        if (buf[1] & 3)
857
            goto fail;
858
        break;
859
    case 0x57:
860
        DPRINTF("Release(10)\n");
861
        if (buf[1] & 3)
862
            goto fail;
863
        break;
864
    case 0x9e:
865
        /* Service Action In subcommands. */
866
        if ((buf[1] & 31) == 0x10) {
867
            DPRINTF("SAI READ CAPACITY(16)\n");
868
            memset(outbuf, 0, len);
869
            bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
870
            nb_sectors /= s->cluster_size;
871
            /* Returned value is the address of the last sector.  */
872
            if (nb_sectors) {
873
                nb_sectors--;
874
                /* Remember the new size for read/write sanity checking. */
875
                s->max_lba = nb_sectors;
876
                outbuf[0] = (nb_sectors >> 56) & 0xff;
877
                outbuf[1] = (nb_sectors >> 48) & 0xff;
878
                outbuf[2] = (nb_sectors >> 40) & 0xff;
879
                outbuf[3] = (nb_sectors >> 32) & 0xff;
880
                outbuf[4] = (nb_sectors >> 24) & 0xff;
881
                outbuf[5] = (nb_sectors >> 16) & 0xff;
882
                outbuf[6] = (nb_sectors >> 8) & 0xff;
883
                outbuf[7] = nb_sectors & 0xff;
884
                outbuf[8] = 0;
885
                outbuf[9] = 0;
886
                outbuf[10] = s->cluster_size * 2;
887
                outbuf[11] = 0;
888
                /* Protection, exponent and lowest lba field left blank. */
889
                r->iov.iov_len = len;
890
            } else {
891
                scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);
892
                return 0;
893
            }
894
            break;
895
        }
896
        DPRINTF("Unsupported Service Action In\n");
897
        goto fail;
898
    case 0xa0:
899
        DPRINTF("Report LUNs (len %d)\n", len);
900
        if (len < 16)
901
            goto fail;
902
        memset(outbuf, 0, 16);
903
        outbuf[3] = 8;
904
        r->iov.iov_len = 16;
905
        break;
906
    case 0x2f:
907
        DPRINTF("Verify (sector %" PRId64 ", count %d)\n", lba, len);
908
        break;
909
    default:
910
        DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
911
    fail:
912
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_ILLEGAL_REQUEST);
913
        return 0;
914
    illegal_lba:
915
        scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
916
        return 0;
917
    }
918
    if (r->sector_count == 0 && r->iov.iov_len == 0) {
919
        scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
920
    }
921
    len = r->sector_count * 512 + r->iov.iov_len;
922
    if (is_write) {
923
        return -len;
924
    } else {
925
        if (!r->sector_count)
926
            r->sector_count = -1;
927
        return len;
928
    }
929
}
930

    
931
static void scsi_destroy(SCSIDevice *dev)
932
{
933
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
934
    SCSIDiskReq *r;
935

    
936
    while (!QTAILQ_EMPTY(&s->qdev.requests)) {
937
        r = DO_UPCAST(SCSIDiskReq, req, QTAILQ_FIRST(&s->qdev.requests));
938
        scsi_remove_request(r);
939
    }
940
    drive_uninit(s->dinfo);
941
}
942

    
943
static int scsi_disk_initfn(SCSIDevice *dev)
944
{
945
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
946
    uint64_t nb_sectors;
947

    
948
    if (!s->dinfo || !s->dinfo->bdrv) {
949
        qemu_error("scsi-disk: drive property not set\n");
950
        return -1;
951
    }
952

    
953
    if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
954
        s->cluster_size = 4;
955
    } else {
956
        s->cluster_size = 1;
957
    }
958
    bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
959
    nb_sectors /= s->cluster_size;
960
    if (nb_sectors)
961
        nb_sectors--;
962
    s->max_lba = nb_sectors;
963
    strncpy(s->drive_serial_str, drive_get_serial(s->dinfo->bdrv),
964
            sizeof(s->drive_serial_str));
965
    if (strlen(s->drive_serial_str) == 0)
966
        pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), "0");
967
    qemu_add_vm_change_state_handler(scsi_dma_restart_cb, s);
968
    return 0;
969
}
970

    
971
static SCSIDeviceInfo scsi_disk_info = {
972
    .qdev.name    = "scsi-disk",
973
    .qdev.desc    = "virtual scsi disk or cdrom",
974
    .qdev.size    = sizeof(SCSIDiskState),
975
    .init         = scsi_disk_initfn,
976
    .destroy      = scsi_destroy,
977
    .send_command = scsi_send_command,
978
    .read_data    = scsi_read_data,
979
    .write_data   = scsi_write_data,
980
    .cancel_io    = scsi_cancel_io,
981
    .get_buf      = scsi_get_buf,
982
    .qdev.props   = (Property[]) {
983
        DEFINE_PROP_DRIVE("drive", SCSIDiskState, dinfo),
984
        DEFINE_PROP_END_OF_LIST(),
985
    },
986
};
987

    
988
static void scsi_disk_register_devices(void)
989
{
990
    scsi_qdev_register(&scsi_disk_info);
991
}
992
device_init(scsi_disk_register_devices)