Statistics
| Branch: | Revision:

root / hw / scsi-disk.c @ f7850099

History | View | Annotate | Download (30.4 kB)

1
/*
2
 * SCSI Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Based on code by Fabrice Bellard
6
 *
7
 * Written by Paul Brook
8
 *
9
 * This code is licenced under the LGPL.
10
 *
11
 * Note that this file only handles the SCSI architecture model and device
12
 * commands.  Emulation of interface/link layer protocols is handled by
13
 * the host adapter emulator.
14
 */
15

    
16
#include <qemu-common.h>
17
#include <sysemu.h>
18
//#define DEBUG_SCSI
19

    
20
#ifdef DEBUG_SCSI
21
#define DPRINTF(fmt, ...) \
22
do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
23
#else
24
#define DPRINTF(fmt, ...) do {} while(0)
25
#endif
26

    
27
#define BADF(fmt, ...) \
28
do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
29

    
30
#include "qemu-common.h"
31
#include "block.h"
32
#include "scsi.h"
33
#include "scsi-defs.h"
34

    
35
#define SCSI_DMA_BUF_SIZE    131072
36
#define SCSI_MAX_INQUIRY_LEN 256
37

    
38
#define SCSI_REQ_STATUS_RETRY 0x01
39

    
40
typedef struct SCSIDiskState SCSIDiskState;
41

    
42
typedef struct SCSIDiskReq {
43
    SCSIRequest req;
44
    /* ??? We should probably keep track of whether the data transfer is
45
       a read or a write.  Currently we rely on the host getting it right.  */
46
    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
47
    uint64_t sector;
48
    uint32_t sector_count;
49
    struct iovec iov;
50
    QEMUIOVector qiov;
51
    uint32_t status;
52
} SCSIDiskReq;
53

    
54
struct SCSIDiskState
55
{
56
    SCSIDevice qdev;
57
    /* The qemu block layer uses a fixed 512 byte sector size.
58
       This is the number of 512 byte blocks in a single scsi sector.  */
59
    int cluster_size;
60
    uint64_t max_lba;
61
    QEMUBH *bh;
62
};
63

    
64
static SCSIDiskReq *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun)
65
{
66
    SCSIRequest *req;
67
    SCSIDiskReq *r;
68

    
69
    req = scsi_req_alloc(sizeof(SCSIDiskReq), d, tag, lun);
70
    r = DO_UPCAST(SCSIDiskReq, req, req);
71
    r->iov.iov_base = qemu_memalign(512, SCSI_DMA_BUF_SIZE);
72
    return r;
73
}
74

    
75
static void scsi_remove_request(SCSIDiskReq *r)
76
{
77
    qemu_free(r->iov.iov_base);
78
    scsi_req_free(&r->req);
79
}
80

    
81
static SCSIDiskReq *scsi_find_request(SCSIDiskState *s, uint32_t tag)
82
{
83
    return DO_UPCAST(SCSIDiskReq, req, scsi_req_find(&s->qdev, tag));
84
}
85

    
86
static void scsi_req_set_status(SCSIRequest *req, int status, int sense_code)
87
{
88
    req->status = status;
89
    scsi_dev_set_sense(req->dev, sense_code);
90
}
91

    
92
/* Helper function for command completion.  */
93
static void scsi_command_complete(SCSIDiskReq *r, int status, int sense)
94
{
95
    DPRINTF("Command complete tag=0x%x status=%d sense=%d\n",
96
            r->req.tag, status, sense);
97
    scsi_req_set_status(&r->req, status, sense);
98
    scsi_req_complete(&r->req);
99
    scsi_remove_request(r);
100
}
101

    
102
/* Cancel a pending data transfer.  */
103
static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
104
{
105
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
106
    SCSIDiskReq *r;
107
    DPRINTF("Cancel tag=0x%x\n", tag);
108
    r = scsi_find_request(s, tag);
109
    if (r) {
110
        if (r->req.aiocb)
111
            bdrv_aio_cancel(r->req.aiocb);
112
        r->req.aiocb = NULL;
113
        scsi_remove_request(r);
114
    }
115
}
116

    
117
static void scsi_read_complete(void * opaque, int ret)
118
{
119
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
120

    
121
    if (ret) {
122
        DPRINTF("IO error\n");
123
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, 0);
124
        scsi_command_complete(r, CHECK_CONDITION, NO_SENSE);
125
        return;
126
    }
127
    DPRINTF("Data ready tag=0x%x len=%" PRId64 "\n", r->req.tag, r->iov.iov_len);
128

    
129
    r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, r->iov.iov_len);
130
}
131

    
132
/* Read more data from scsi device into buffer.  */
133
static void scsi_read_data(SCSIDevice *d, uint32_t tag)
134
{
135
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
136
    SCSIDiskReq *r;
137
    uint32_t n;
138

    
139
    r = scsi_find_request(s, tag);
140
    if (!r) {
141
        BADF("Bad read tag 0x%x\n", tag);
142
        /* ??? This is the wrong error.  */
143
        scsi_command_complete(r, CHECK_CONDITION, HARDWARE_ERROR);
144
        return;
145
    }
146
    if (r->sector_count == (uint32_t)-1) {
147
        DPRINTF("Read buf_len=%" PRId64 "\n", r->iov.iov_len);
148
        r->sector_count = 0;
149
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, r->iov.iov_len);
150
        return;
151
    }
152
    DPRINTF("Read sector_count=%d\n", r->sector_count);
153
    if (r->sector_count == 0) {
154
        scsi_command_complete(r, GOOD, NO_SENSE);
155
        return;
156
    }
157

    
158
    n = r->sector_count;
159
    if (n > SCSI_DMA_BUF_SIZE / 512)
160
        n = SCSI_DMA_BUF_SIZE / 512;
161

    
162
    r->iov.iov_len = n * 512;
163
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
164
    r->req.aiocb = bdrv_aio_readv(s->qdev.dinfo->bdrv, r->sector, &r->qiov, n,
165
                              scsi_read_complete, r);
166
    if (r->req.aiocb == NULL)
167
        scsi_command_complete(r, CHECK_CONDITION, HARDWARE_ERROR);
168
    r->sector += n;
169
    r->sector_count -= n;
170
}
171

    
172
static int scsi_handle_write_error(SCSIDiskReq *r, int error)
173
{
174
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
175
    BlockInterfaceErrorAction action =
176
        drive_get_on_error(s->qdev.dinfo->bdrv, 0);
177

    
178
    if (action == BLOCK_ERR_IGNORE)
179
        return 0;
180

    
181
    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
182
            || action == BLOCK_ERR_STOP_ANY) {
183
        r->status |= SCSI_REQ_STATUS_RETRY;
184
        vm_stop(0);
185
    } else {
186
        scsi_command_complete(r, CHECK_CONDITION,
187
                HARDWARE_ERROR);
188
    }
189

    
190
    return 1;
191
}
192

    
193
static void scsi_write_complete(void * opaque, int ret)
194
{
195
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
196
    uint32_t len;
197
    uint32_t n;
198

    
199
    r->req.aiocb = NULL;
200

    
201
    if (ret) {
202
        if (scsi_handle_write_error(r, -ret))
203
            return;
204
    }
205

    
206
    n = r->iov.iov_len / 512;
207
    r->sector += n;
208
    r->sector_count -= n;
209
    if (r->sector_count == 0) {
210
        scsi_command_complete(r, GOOD, NO_SENSE);
211
    } else {
212
        len = r->sector_count * 512;
213
        if (len > SCSI_DMA_BUF_SIZE) {
214
            len = SCSI_DMA_BUF_SIZE;
215
        }
216
        r->iov.iov_len = len;
217
        DPRINTF("Write complete tag=0x%x more=%d\n", r->req.tag, len);
218
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);
219
    }
220
}
221

    
222
static void scsi_write_request(SCSIDiskReq *r)
223
{
224
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
225
    uint32_t n;
226

    
227
    n = r->iov.iov_len / 512;
228
    if (n) {
229
        qemu_iovec_init_external(&r->qiov, &r->iov, 1);
230
        r->req.aiocb = bdrv_aio_writev(s->qdev.dinfo->bdrv, r->sector, &r->qiov, n,
231
                                   scsi_write_complete, r);
232
        if (r->req.aiocb == NULL)
233
            scsi_command_complete(r, CHECK_CONDITION,
234
                                  HARDWARE_ERROR);
235
    } else {
236
        /* Invoke completion routine to fetch data from host.  */
237
        scsi_write_complete(r, 0);
238
    }
239
}
240

    
241
/* Write data to a scsi device.  Returns nonzero on failure.
242
   The transfer may complete asynchronously.  */
243
static int scsi_write_data(SCSIDevice *d, uint32_t tag)
244
{
245
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
246
    SCSIDiskReq *r;
247

    
248
    DPRINTF("Write data tag=0x%x\n", tag);
249
    r = scsi_find_request(s, tag);
250
    if (!r) {
251
        BADF("Bad write tag 0x%x\n", tag);
252
        scsi_command_complete(r, CHECK_CONDITION, HARDWARE_ERROR);
253
        return 1;
254
    }
255

    
256
    if (r->req.aiocb)
257
        BADF("Data transfer already in progress\n");
258

    
259
    scsi_write_request(r);
260

    
261
    return 0;
262
}
263

    
264
static void scsi_dma_restart_bh(void *opaque)
265
{
266
    SCSIDiskState *s = opaque;
267
    SCSIRequest *req;
268
    SCSIDiskReq *r;
269

    
270
    qemu_bh_delete(s->bh);
271
    s->bh = NULL;
272

    
273
    QTAILQ_FOREACH(req, &s->qdev.requests, next) {
274
        r = DO_UPCAST(SCSIDiskReq, req, req);
275
        if (r->status & SCSI_REQ_STATUS_RETRY) {
276
            r->status &= ~SCSI_REQ_STATUS_RETRY;
277
            scsi_write_request(r); 
278
        }
279
    }
280
}
281

    
282
static void scsi_dma_restart_cb(void *opaque, int running, int reason)
283
{
284
    SCSIDiskState *s = opaque;
285

    
286
    if (!running)
287
        return;
288

    
289
    if (!s->bh) {
290
        s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
291
        qemu_bh_schedule(s->bh);
292
    }
293
}
294

    
295
/* Return a pointer to the data buffer.  */
296
static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
297
{
298
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
299
    SCSIDiskReq *r;
300

    
301
    r = scsi_find_request(s, tag);
302
    if (!r) {
303
        BADF("Bad buffer tag 0x%x\n", tag);
304
        return NULL;
305
    }
306
    return (uint8_t *)r->iov.iov_base;
307
}
308

    
309
static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
310
{
311
    BlockDriverState *bdrv = req->dev->dinfo->bdrv;
312
    int buflen = 0;
313

    
314
    if (req->cmd.buf[1] & 0x2) {
315
        /* Command support data - optional, not implemented */
316
        BADF("optional INQUIRY command support request not implemented\n");
317
        return -1;
318
    }
319

    
320
    if (req->cmd.buf[1] & 0x1) {
321
        /* Vital product data */
322
        uint8_t page_code = req->cmd.buf[2];
323
        if (req->cmd.xfer < 4) {
324
            BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
325
                 "less than 4\n", page_code, req->cmd.xfer);
326
            return -1;
327
        }
328

    
329
        if (bdrv_get_type_hint(bdrv) == BDRV_TYPE_CDROM) {
330
            outbuf[buflen++] = 5;
331
        } else {
332
            outbuf[buflen++] = 0;
333
        }
334
        outbuf[buflen++] = page_code ; // this page
335
        outbuf[buflen++] = 0x00;
336

    
337
        switch (page_code) {
338
        case 0x00: /* Supported page codes, mandatory */
339
            DPRINTF("Inquiry EVPD[Supported pages] "
340
                    "buffer size %zd\n", req->cmd.xfer);
341
            outbuf[buflen++] = 3;    // number of pages
342
            outbuf[buflen++] = 0x00; // list of supported pages (this page)
343
            outbuf[buflen++] = 0x80; // unit serial number
344
            outbuf[buflen++] = 0x83; // device identification
345
            break;
346

    
347
        case 0x80: /* Device serial number, optional */
348
        {
349
            const char *serial = req->dev->dinfo->serial ?: "0";
350
            int l = strlen(serial);
351

    
352
            if (l > req->cmd.xfer)
353
                l = req->cmd.xfer;
354
            if (l > 20)
355
                l = 20;
356

    
357
            DPRINTF("Inquiry EVPD[Serial number] "
358
                    "buffer size %zd\n", req->cmd.xfer);
359
            outbuf[buflen++] = l;
360
            memcpy(outbuf+buflen, serial, l);
361
            buflen += l;
362
            break;
363
        }
364

    
365
        case 0x83: /* Device identification page, mandatory */
366
        {
367
            int max_len = 255 - 8;
368
            int id_len = strlen(bdrv_get_device_name(bdrv));
369

    
370
            if (id_len > max_len)
371
                id_len = max_len;
372
            DPRINTF("Inquiry EVPD[Device identification] "
373
                    "buffer size %zd\n", req->cmd.xfer);
374

    
375
            outbuf[buflen++] = 3 + id_len;
376
            outbuf[buflen++] = 0x2; // ASCII
377
            outbuf[buflen++] = 0;   // not officially assigned
378
            outbuf[buflen++] = 0;   // reserved
379
            outbuf[buflen++] = id_len; // length of data following
380

    
381
            memcpy(outbuf+buflen, bdrv_get_device_name(bdrv), id_len);
382
            buflen += id_len;
383
            break;
384
        }
385
        default:
386
            BADF("Error: unsupported Inquiry (EVPD[%02X]) "
387
                 "buffer size %zd\n", page_code, req->cmd.xfer);
388
            return -1;
389
        }
390
        /* done with EVPD */
391
        return buflen;
392
    }
393

    
394
    /* Standard INQUIRY data */
395
    if (req->cmd.buf[2] != 0) {
396
        BADF("Error: Inquiry (STANDARD) page or code "
397
             "is non-zero [%02X]\n", req->cmd.buf[2]);
398
        return -1;
399
    }
400

    
401
    /* PAGE CODE == 0 */
402
    if (req->cmd.xfer < 5) {
403
        BADF("Error: Inquiry (STANDARD) buffer size %zd "
404
             "is less than 5\n", req->cmd.xfer);
405
        return -1;
406
    }
407

    
408
    if (req->cmd.xfer < 36) {
409
        BADF("Error: Inquiry (STANDARD) buffer size %zd "
410
             "is less than 36 (TODO: only 5 required)\n", req->cmd.xfer);
411
    }
412

    
413
    buflen = req->cmd.xfer;
414
    if (buflen > SCSI_MAX_INQUIRY_LEN)
415
        buflen = SCSI_MAX_INQUIRY_LEN;
416

    
417
    memset(outbuf, 0, buflen);
418

    
419
    if (req->lun || req->cmd.buf[1] >> 5) {
420
        outbuf[0] = 0x7f;        /* LUN not supported */
421
        return buflen;
422
    }
423

    
424
    if (bdrv_get_type_hint(bdrv) == BDRV_TYPE_CDROM) {
425
        outbuf[0] = 5;
426
        outbuf[1] = 0x80;
427
        memcpy(&outbuf[16], "QEMU CD-ROM    ", 16);
428
    } else {
429
        outbuf[0] = 0;
430
        memcpy(&outbuf[16], "QEMU HARDDISK  ", 16);
431
    }
432
    memcpy(&outbuf[8], "QEMU   ", 8);
433
    memcpy(&outbuf[32], QEMU_VERSION, 4);
434
    /* Identify device as SCSI-3 rev 1.
435
       Some later commands are also implemented. */
436
    outbuf[2] = 3;
437
    outbuf[3] = 2; /* Format 2 */
438
    outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
439
    /* Sync data transfer and TCQ.  */
440
    outbuf[7] = 0x10 | (req->bus->tcq ? 0x02 : 0);
441
    return buflen;
442
}
443

    
444
static int mode_sense_page(SCSIRequest *req, int page, uint8_t *p)
445
{
446
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
447
    BlockDriverState *bdrv = req->dev->dinfo->bdrv;
448
    int cylinders, heads, secs;
449

    
450
    switch (page) {
451
    case 4: /* Rigid disk device geometry page. */
452
        p[0] = 4;
453
        p[1] = 0x16;
454
        /* if a geometry hint is available, use it */
455
        bdrv_get_geometry_hint(bdrv, &cylinders, &heads, &secs);
456
        p[2] = (cylinders >> 16) & 0xff;
457
        p[3] = (cylinders >> 8) & 0xff;
458
        p[4] = cylinders & 0xff;
459
        p[5] = heads & 0xff;
460
        /* Write precomp start cylinder, disabled */
461
        p[6] = (cylinders >> 16) & 0xff;
462
        p[7] = (cylinders >> 8) & 0xff;
463
        p[8] = cylinders & 0xff;
464
        /* Reduced current start cylinder, disabled */
465
        p[9] = (cylinders >> 16) & 0xff;
466
        p[10] = (cylinders >> 8) & 0xff;
467
        p[11] = cylinders & 0xff;
468
        /* Device step rate [ns], 200ns */
469
        p[12] = 0;
470
        p[13] = 200;
471
        /* Landing zone cylinder */
472
        p[14] = 0xff;
473
        p[15] =  0xff;
474
        p[16] = 0xff;
475
        /* Medium rotation rate [rpm], 5400 rpm */
476
        p[20] = (5400 >> 8) & 0xff;
477
        p[21] = 5400 & 0xff;
478
        return 0x16;
479

    
480
    case 5: /* Flexible disk device geometry page. */
481
        p[0] = 5;
482
        p[1] = 0x1e;
483
        /* Transfer rate [kbit/s], 5Mbit/s */
484
        p[2] = 5000 >> 8;
485
        p[3] = 5000 & 0xff;
486
        /* if a geometry hint is available, use it */
487
        bdrv_get_geometry_hint(bdrv, &cylinders, &heads, &secs);
488
        p[4] = heads & 0xff;
489
        p[5] = secs & 0xff;
490
        p[6] = s->cluster_size * 2;
491
        p[8] = (cylinders >> 8) & 0xff;
492
        p[9] = cylinders & 0xff;
493
        /* Write precomp start cylinder, disabled */
494
        p[10] = (cylinders >> 8) & 0xff;
495
        p[11] = cylinders & 0xff;
496
        /* Reduced current start cylinder, disabled */
497
        p[12] = (cylinders >> 8) & 0xff;
498
        p[13] = cylinders & 0xff;
499
        /* Device step rate [100us], 100us */
500
        p[14] = 0;
501
        p[15] = 1;
502
        /* Device step pulse width [us], 1us */
503
        p[16] = 1;
504
        /* Device head settle delay [100us], 100us */
505
        p[17] = 0;
506
        p[18] = 1;
507
        /* Motor on delay [0.1s], 0.1s */
508
        p[19] = 1;
509
        /* Motor off delay [0.1s], 0.1s */
510
        p[20] = 1;
511
        /* Medium rotation rate [rpm], 5400 rpm */
512
        p[28] = (5400 >> 8) & 0xff;
513
        p[29] = 5400 & 0xff;
514
        return 0x1e;
515

    
516
    case 8: /* Caching page.  */
517
        p[0] = 8;
518
        p[1] = 0x12;
519
        if (bdrv_enable_write_cache(s->qdev.dinfo->bdrv)) {
520
            p[2] = 4; /* WCE */
521
        }
522
        return 20;
523

    
524
    case 0x2a: /* CD Capabilities and Mechanical Status page. */
525
        if (bdrv_get_type_hint(bdrv) != BDRV_TYPE_CDROM)
526
            return 0;
527
        p[0] = 0x2a;
528
        p[1] = 0x14;
529
        p[2] = 3; // CD-R & CD-RW read
530
        p[3] = 0; // Writing not supported
531
        p[4] = 0x7f; /* Audio, composite, digital out,
532
                        mode 2 form 1&2, multi session */
533
        p[5] = 0xff; /* CD DA, DA accurate, RW supported,
534
                        RW corrected, C2 errors, ISRC,
535
                        UPC, Bar code */
536
        p[6] = 0x2d | (bdrv_is_locked(s->qdev.dinfo->bdrv)? 2 : 0);
537
        /* Locking supported, jumper present, eject, tray */
538
        p[7] = 0; /* no volume & mute control, no
539
                     changer */
540
        p[8] = (50 * 176) >> 8; // 50x read speed
541
        p[9] = (50 * 176) & 0xff;
542
        p[10] = 0 >> 8; // No volume
543
        p[11] = 0 & 0xff;
544
        p[12] = 2048 >> 8; // 2M buffer
545
        p[13] = 2048 & 0xff;
546
        p[14] = (16 * 176) >> 8; // 16x read speed current
547
        p[15] = (16 * 176) & 0xff;
548
        p[18] = (16 * 176) >> 8; // 16x write speed
549
        p[19] = (16 * 176) & 0xff;
550
        p[20] = (16 * 176) >> 8; // 16x write speed current
551
        p[21] = (16 * 176) & 0xff;
552
        return 22;
553

    
554
    default:
555
        return 0;
556
    }
557
}
558

    
559
static int scsi_disk_emulate_mode_sense(SCSIRequest *req, uint8_t *outbuf)
560
{
561
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
562
    BlockDriverState *bdrv = req->dev->dinfo->bdrv;
563
    uint64_t nb_sectors;
564
    int page, dbd, buflen;
565
    uint8_t *p;
566

    
567
    dbd = req->cmd.buf[1]  & 0x8;
568
    page = req->cmd.buf[2] & 0x3f;
569
    DPRINTF("Mode Sense (page %d, len %zd)\n", page, req->cmd.xfer);
570
    memset(outbuf, 0, req->cmd.xfer);
571
    p = outbuf;
572

    
573
    p[1] = 0; /* Default media type.  */
574
    p[3] = 0; /* Block descriptor length.  */
575
    if (bdrv_get_type_hint(bdrv) == BDRV_TYPE_CDROM ||
576
        bdrv_is_read_only(bdrv)) {
577
        p[2] = 0x80; /* Readonly.  */
578
    }
579
    p += 4;
580

    
581
    bdrv_get_geometry(bdrv, &nb_sectors);
582
    if ((~dbd) & nb_sectors) {
583
        outbuf[3] = 8; /* Block descriptor length  */
584
        nb_sectors /= s->cluster_size;
585
        nb_sectors--;
586
        if (nb_sectors > 0xffffff)
587
            nb_sectors = 0xffffff;
588
        p[0] = 0; /* media density code */
589
        p[1] = (nb_sectors >> 16) & 0xff;
590
        p[2] = (nb_sectors >> 8) & 0xff;
591
        p[3] = nb_sectors & 0xff;
592
        p[4] = 0; /* reserved */
593
        p[5] = 0; /* bytes 5-7 are the sector size in bytes */
594
        p[6] = s->cluster_size * 2;
595
        p[7] = 0;
596
        p += 8;
597
    }
598

    
599
    switch (page) {
600
    case 0x04:
601
    case 0x05:
602
    case 0x08:
603
    case 0x2a:
604
        p += mode_sense_page(req, page, p);
605
        break;
606
    case 0x3f:
607
        p += mode_sense_page(req, 0x08, p);
608
        p += mode_sense_page(req, 0x2a, p);
609
        break;
610
    }
611

    
612
    buflen = p - outbuf;
613
    outbuf[0] = buflen - 4;
614
    if (buflen > req->cmd.xfer)
615
        buflen = req->cmd.xfer;
616
    return buflen;
617
}
618

    
619
static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)
620
{
621
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
622
    BlockDriverState *bdrv = req->dev->dinfo->bdrv;
623
    int start_track, format, msf, toclen;
624
    uint64_t nb_sectors;
625

    
626
    msf = req->cmd.buf[1] & 2;
627
    format = req->cmd.buf[2] & 0xf;
628
    start_track = req->cmd.buf[6];
629
    bdrv_get_geometry(bdrv, &nb_sectors);
630
    DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
631
    nb_sectors /= s->cluster_size;
632
    switch (format) {
633
    case 0:
634
        toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
635
        break;
636
    case 1:
637
        /* multi session : only a single session defined */
638
        toclen = 12;
639
        memset(outbuf, 0, 12);
640
        outbuf[1] = 0x0a;
641
        outbuf[2] = 0x01;
642
        outbuf[3] = 0x01;
643
        break;
644
    case 2:
645
        toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
646
        break;
647
    default:
648
        return -1;
649
    }
650
    if (toclen > req->cmd.xfer)
651
        toclen = req->cmd.xfer;
652
    return toclen;
653
}
654

    
655
static int scsi_disk_emulate_command(SCSIRequest *req, uint8_t *outbuf)
656
{
657
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
658
    BlockDriverState *bdrv = req->dev->dinfo->bdrv;
659
    uint64_t nb_sectors;
660
    int buflen = 0;
661

    
662
    switch (req->cmd.buf[0]) {
663
    case TEST_UNIT_READY:
664
        if (!bdrv_is_inserted(bdrv))
665
            goto not_ready;
666
        break;
667
    case REQUEST_SENSE:
668
        if (req->cmd.xfer < 4)
669
            goto illegal_request;
670
        memset(outbuf, 0, 4);
671
        buflen = 4;
672
        if (req->dev->sense.key == NOT_READY && req->cmd.xfer >= 18) {
673
            memset(outbuf, 0, 18);
674
            buflen = 18;
675
            outbuf[7] = 10;
676
            /* asc 0x3a, ascq 0: Medium not present */
677
            outbuf[12] = 0x3a;
678
            outbuf[13] = 0;
679
        }
680
        outbuf[0] = 0xf0;
681
        outbuf[1] = 0;
682
        outbuf[2] = req->dev->sense.key;
683
        scsi_dev_clear_sense(req->dev);
684
        break;
685
    case INQUIRY:
686
        buflen = scsi_disk_emulate_inquiry(req, outbuf);
687
        if (buflen < 0)
688
            goto illegal_request;
689
        break;
690
    case MODE_SENSE:
691
    case MODE_SENSE_10:
692
        buflen = scsi_disk_emulate_mode_sense(req, outbuf);
693
        if (buflen < 0)
694
            goto illegal_request;
695
        break;
696
    case READ_TOC:
697
        buflen = scsi_disk_emulate_read_toc(req, outbuf);
698
        if (buflen < 0)
699
            goto illegal_request;
700
        break;
701
    case RESERVE:
702
        if (req->cmd.buf[1] & 1)
703
            goto illegal_request;
704
        break;
705
    case RESERVE_10:
706
        if (req->cmd.buf[1] & 3)
707
            goto illegal_request;
708
        break;
709
    case RELEASE:
710
        if (req->cmd.buf[1] & 1)
711
            goto illegal_request;
712
        break;
713
    case RELEASE_10:
714
        if (req->cmd.buf[1] & 3)
715
            goto illegal_request;
716
        break;
717
    case START_STOP:
718
        if (bdrv_get_type_hint(bdrv) == BDRV_TYPE_CDROM && (req->cmd.buf[4] & 2)) {
719
            /* load/eject medium */
720
            bdrv_eject(bdrv, !(req->cmd.buf[4] & 1));
721
        }
722
        break;
723
    case ALLOW_MEDIUM_REMOVAL:
724
        bdrv_set_locked(bdrv, req->cmd.buf[4] & 1);
725
        break;
726
    case READ_CAPACITY:
727
        /* The normal LEN field for this command is zero.  */
728
        memset(outbuf, 0, 8);
729
        bdrv_get_geometry(bdrv, &nb_sectors);
730
        if (!nb_sectors)
731
            goto not_ready;
732
        nb_sectors /= s->cluster_size;
733
        /* Returned value is the address of the last sector.  */
734
        nb_sectors--;
735
        /* Remember the new size for read/write sanity checking. */
736
        s->max_lba = nb_sectors;
737
        /* Clip to 2TB, instead of returning capacity modulo 2TB. */
738
        if (nb_sectors > UINT32_MAX)
739
            nb_sectors = UINT32_MAX;
740
        outbuf[0] = (nb_sectors >> 24) & 0xff;
741
        outbuf[1] = (nb_sectors >> 16) & 0xff;
742
        outbuf[2] = (nb_sectors >> 8) & 0xff;
743
        outbuf[3] = nb_sectors & 0xff;
744
        outbuf[4] = 0;
745
        outbuf[5] = 0;
746
        outbuf[6] = s->cluster_size * 2;
747
        outbuf[7] = 0;
748
        buflen = 8;
749
        break;
750
    case SYNCHRONIZE_CACHE:
751
        bdrv_flush(bdrv);
752
        break;
753
    case GET_CONFIGURATION:
754
        memset(outbuf, 0, 8);
755
        /* ??? This should probably return much more information.  For now
756
           just return the basic header indicating the CD-ROM profile.  */
757
        outbuf[7] = 8; // CD-ROM
758
        buflen = 8;
759
        break;
760
    case SERVICE_ACTION_IN:
761
        /* Service Action In subcommands. */
762
        if ((req->cmd.buf[1] & 31) == 0x10) {
763
            DPRINTF("SAI READ CAPACITY(16)\n");
764
            memset(outbuf, 0, req->cmd.xfer);
765
            bdrv_get_geometry(bdrv, &nb_sectors);
766
            if (!nb_sectors)
767
                goto not_ready;
768
            nb_sectors /= s->cluster_size;
769
            /* Returned value is the address of the last sector.  */
770
            nb_sectors--;
771
            /* Remember the new size for read/write sanity checking. */
772
            s->max_lba = nb_sectors;
773
            outbuf[0] = (nb_sectors >> 56) & 0xff;
774
            outbuf[1] = (nb_sectors >> 48) & 0xff;
775
            outbuf[2] = (nb_sectors >> 40) & 0xff;
776
            outbuf[3] = (nb_sectors >> 32) & 0xff;
777
            outbuf[4] = (nb_sectors >> 24) & 0xff;
778
            outbuf[5] = (nb_sectors >> 16) & 0xff;
779
            outbuf[6] = (nb_sectors >> 8) & 0xff;
780
            outbuf[7] = nb_sectors & 0xff;
781
            outbuf[8] = 0;
782
            outbuf[9] = 0;
783
            outbuf[10] = s->cluster_size * 2;
784
            outbuf[11] = 0;
785
            /* Protection, exponent and lowest lba field left blank. */
786
            buflen = req->cmd.xfer;
787
            break;
788
        }
789
        DPRINTF("Unsupported Service Action In\n");
790
        goto illegal_request;
791
    case REPORT_LUNS:
792
        if (req->cmd.xfer < 16)
793
            goto illegal_request;
794
        memset(outbuf, 0, 16);
795
        outbuf[3] = 8;
796
        buflen = 16;
797
        break;
798
    case VERIFY:
799
        break;
800
    default:
801
        goto illegal_request;
802
    }
803
    scsi_req_set_status(req, GOOD, NO_SENSE);
804
    return buflen;
805

    
806
not_ready:
807
    scsi_req_set_status(req, CHECK_CONDITION, NOT_READY);
808
    return 0;
809

    
810
illegal_request:
811
    scsi_req_set_status(req, CHECK_CONDITION, ILLEGAL_REQUEST);
812
    return 0;
813
}
814

    
815
/* Execute a scsi command.  Returns the length of the data expected by the
816
   command.  This will be Positive for data transfers from the device
817
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
818
   and zero if the command does not transfer any data.  */
819

    
820
static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
821
                                 uint8_t *buf, int lun)
822
{
823
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
824
    uint64_t lba;
825
    uint32_t len;
826
    int cmdlen;
827
    int is_write;
828
    uint8_t command;
829
    uint8_t *outbuf;
830
    SCSIDiskReq *r;
831
    int rc;
832

    
833
    command = buf[0];
834
    r = scsi_find_request(s, tag);
835
    if (r) {
836
        BADF("Tag 0x%x already in use\n", tag);
837
        scsi_cancel_io(d, tag);
838
    }
839
    /* ??? Tags are not unique for different luns.  We only implement a
840
       single lun, so this should not matter.  */
841
    r = scsi_new_request(d, tag, lun);
842
    outbuf = (uint8_t *)r->iov.iov_base;
843
    is_write = 0;
844
    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
845
    switch (command >> 5) {
846
    case 0:
847
        lba = (uint64_t) buf[3] | ((uint64_t) buf[2] << 8) |
848
              (((uint64_t) buf[1] & 0x1f) << 16);
849
        len = buf[4];
850
        cmdlen = 6;
851
        break;
852
    case 1:
853
    case 2:
854
        lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
855
              ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
856
        len = buf[8] | (buf[7] << 8);
857
        cmdlen = 10;
858
        break;
859
    case 4:
860
        lba = (uint64_t) buf[9] | ((uint64_t) buf[8] << 8) |
861
              ((uint64_t) buf[7] << 16) | ((uint64_t) buf[6] << 24) |
862
              ((uint64_t) buf[5] << 32) | ((uint64_t) buf[4] << 40) |
863
              ((uint64_t) buf[3] << 48) | ((uint64_t) buf[2] << 56);
864
        len = buf[13] | (buf[12] << 8) | (buf[11] << 16) | (buf[10] << 24);
865
        cmdlen = 16;
866
        break;
867
    case 5:
868
        lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
869
              ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
870
        len = buf[9] | (buf[8] << 8) | (buf[7] << 16) | (buf[6] << 24);
871
        cmdlen = 12;
872
        break;
873
    default:
874
        BADF("Unsupported command length, command %x\n", command);
875
        goto fail;
876
    }
877
#ifdef DEBUG_SCSI
878
    {
879
        int i;
880
        for (i = 1; i < cmdlen; i++) {
881
            printf(" 0x%02x", buf[i]);
882
        }
883
        printf("\n");
884
    }
885
#endif
886

    
887
    if (scsi_req_parse(&r->req, buf) != 0) {
888
        BADF("Unsupported command length, command %x\n", command);
889
        goto fail;
890
    }
891
    assert(r->req.cmd.len == cmdlen);
892
    assert(r->req.cmd.lba == lba);
893

    
894
    if (lun || buf[1] >> 5) {
895
        /* Only LUN 0 supported.  */
896
        DPRINTF("Unimplemented LUN %d\n", lun ? lun : buf[1] >> 5);
897
        if (command != REQUEST_SENSE && command != INQUIRY)
898
            goto fail;
899
    }
900
    switch (command) {
901
    case TEST_UNIT_READY:
902
    case REQUEST_SENSE:
903
    case INQUIRY:
904
    case MODE_SENSE:
905
    case MODE_SENSE_10:
906
    case RESERVE:
907
    case RESERVE_10:
908
    case RELEASE:
909
    case RELEASE_10:
910
    case START_STOP:
911
    case ALLOW_MEDIUM_REMOVAL:
912
    case READ_CAPACITY:
913
    case SYNCHRONIZE_CACHE:
914
    case READ_TOC:
915
    case GET_CONFIGURATION:
916
    case SERVICE_ACTION_IN:
917
    case REPORT_LUNS:
918
    case VERIFY:
919
        rc = scsi_disk_emulate_command(&r->req, outbuf);
920
        if (rc > 0) {
921
            r->iov.iov_len = rc;
922
        } else {
923
            scsi_req_complete(&r->req);
924
            scsi_remove_request(r);
925
            return 0;
926
        }
927
        break;
928
    case READ_6:
929
    case READ_10:
930
    case READ_12:
931
    case READ_16:
932
        DPRINTF("Read (sector %" PRId64 ", count %d)\n", lba, len);
933
        if (lba > s->max_lba)
934
            goto illegal_lba;
935
        r->sector = lba * s->cluster_size;
936
        r->sector_count = len * s->cluster_size;
937
        break;
938
    case WRITE_6:
939
    case WRITE_10:
940
    case WRITE_12:
941
    case WRITE_16:
942
        DPRINTF("Write (sector %" PRId64 ", count %d)\n", lba, len);
943
        if (lba > s->max_lba)
944
            goto illegal_lba;
945
        r->sector = lba * s->cluster_size;
946
        r->sector_count = len * s->cluster_size;
947
        is_write = 1;
948
        break;
949
    default:
950
        DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
951
    fail:
952
        scsi_command_complete(r, CHECK_CONDITION, ILLEGAL_REQUEST);
953
        return 0;
954
    illegal_lba:
955
        scsi_command_complete(r, CHECK_CONDITION, HARDWARE_ERROR);
956
        return 0;
957
    }
958
    if (r->sector_count == 0 && r->iov.iov_len == 0) {
959
        scsi_command_complete(r, GOOD, NO_SENSE);
960
    }
961
    len = r->sector_count * 512 + r->iov.iov_len;
962
    if (is_write) {
963
        return -len;
964
    } else {
965
        if (!r->sector_count)
966
            r->sector_count = -1;
967
        return len;
968
    }
969
}
970

    
971
static void scsi_destroy(SCSIDevice *dev)
972
{
973
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
974
    SCSIDiskReq *r;
975

    
976
    while (!QTAILQ_EMPTY(&s->qdev.requests)) {
977
        r = DO_UPCAST(SCSIDiskReq, req, QTAILQ_FIRST(&s->qdev.requests));
978
        scsi_remove_request(r);
979
    }
980
    drive_uninit(s->qdev.dinfo);
981
}
982

    
983
static int scsi_disk_initfn(SCSIDevice *dev)
984
{
985
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
986
    uint64_t nb_sectors;
987

    
988
    if (!s->qdev.dinfo || !s->qdev.dinfo->bdrv) {
989
        qemu_error("scsi-disk: drive property not set\n");
990
        return -1;
991
    }
992

    
993
    if (bdrv_get_type_hint(s->qdev.dinfo->bdrv) == BDRV_TYPE_CDROM) {
994
        s->cluster_size = 4;
995
    } else {
996
        s->cluster_size = 1;
997
    }
998
    s->qdev.blocksize = 512 * s->cluster_size;
999
    s->qdev.type = TYPE_DISK;
1000
    bdrv_get_geometry(s->qdev.dinfo->bdrv, &nb_sectors);
1001
    nb_sectors /= s->cluster_size;
1002
    if (nb_sectors)
1003
        nb_sectors--;
1004
    s->max_lba = nb_sectors;
1005
    qemu_add_vm_change_state_handler(scsi_dma_restart_cb, s);
1006
    return 0;
1007
}
1008

    
1009
static SCSIDeviceInfo scsi_disk_info = {
1010
    .qdev.name    = "scsi-disk",
1011
    .qdev.desc    = "virtual scsi disk or cdrom",
1012
    .qdev.size    = sizeof(SCSIDiskState),
1013
    .init         = scsi_disk_initfn,
1014
    .destroy      = scsi_destroy,
1015
    .send_command = scsi_send_command,
1016
    .read_data    = scsi_read_data,
1017
    .write_data   = scsi_write_data,
1018
    .cancel_io    = scsi_cancel_io,
1019
    .get_buf      = scsi_get_buf,
1020
    .qdev.props   = (Property[]) {
1021
        DEFINE_PROP_DRIVE("drive", SCSIDiskState, qdev.dinfo),
1022
        DEFINE_PROP_END_OF_LIST(),
1023
    },
1024
};
1025

    
1026
static void scsi_disk_register_devices(void)
1027
{
1028
    scsi_qdev_register(&scsi_disk_info);
1029
}
1030
device_init(scsi_disk_register_devices)