mv strdup to qemu_strdup in vl.c
[qemu/cris-port.git] / hw / scsi-disk.c
blobffc2654bf99c05951297abc45090af75ba0f5983
1 /*
2 * SCSI Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Based on code by Fabrice Bellard
7 * Written by Paul Brook
9 * This code is licenced under the LGPL.
11 * Note that this file only handles the SCSI architecture model and device
12 * commands. Emulation of interface/link layer protocols is handled by
13 * the host adapter emulator.
16 #include <qemu-common.h>
17 #include <sysemu.h>
18 //#define DEBUG_SCSI
20 #ifdef DEBUG_SCSI
21 #define DPRINTF(fmt, ...) \
22 do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
23 #else
24 #define DPRINTF(fmt, ...) do {} while(0)
25 #endif
27 #define BADF(fmt, ...) \
28 do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
30 #include "qemu-common.h"
31 #include "block.h"
32 #include "scsi-disk.h"
34 #define SENSE_NO_SENSE 0
35 #define SENSE_NOT_READY 2
36 #define SENSE_HARDWARE_ERROR 4
37 #define SENSE_ILLEGAL_REQUEST 5
39 #define STATUS_GOOD 0
40 #define STATUS_CHECK_CONDITION 2
42 #define SCSI_DMA_BUF_SIZE 131072
43 #define SCSI_MAX_INQUIRY_LEN 256
45 #define SCSI_REQ_STATUS_RETRY 0x01
47 typedef struct SCSIDiskState SCSIDiskState;
49 typedef struct SCSIRequest {
50 SCSIBus *bus;
51 SCSIDiskState *dev;
52 uint32_t tag;
53 /* ??? We should probably keep track of whether the data transfer is
54 a read or a write. Currently we rely on the host getting it right. */
55 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
56 uint64_t sector;
57 uint32_t sector_count;
58 struct iovec iov;
59 QEMUIOVector qiov;
60 BlockDriverAIOCB *aiocb;
61 struct SCSIRequest *next;
62 uint32_t status;
63 } SCSIRequest;
65 struct SCSIDiskState
67 SCSIDevice qdev;
68 DriveInfo *dinfo;
69 SCSIRequest *requests;
70 /* The qemu block layer uses a fixed 512 byte sector size.
71 This is the number of 512 byte blocks in a single scsi sector. */
72 int cluster_size;
73 uint64_t max_lba;
74 int sense;
75 char drive_serial_str[21];
76 QEMUBH *bh;
79 /* Global pool of SCSIRequest structures. */
80 static SCSIRequest *free_requests = NULL;
82 static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag)
84 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
85 SCSIRequest *r;
87 if (free_requests) {
88 r = free_requests;
89 free_requests = r->next;
90 } else {
91 r = qemu_malloc(sizeof(SCSIRequest));
92 r->iov.iov_base = qemu_memalign(512, SCSI_DMA_BUF_SIZE);
94 r->bus = scsi_bus_from_device(d);
95 r->dev = s;
96 r->tag = tag;
97 r->sector_count = 0;
98 r->iov.iov_len = 0;
99 r->aiocb = NULL;
100 r->status = 0;
102 r->next = s->requests;
103 s->requests = r;
104 return r;
107 static void scsi_remove_request(SCSIRequest *r)
109 SCSIRequest *last;
110 SCSIDiskState *s = r->dev;
112 if (s->requests == r) {
113 s->requests = r->next;
114 } else {
115 last = s->requests;
116 while (last && last->next != r)
117 last = last->next;
118 if (last) {
119 last->next = r->next;
120 } else {
121 BADF("Orphaned request\n");
124 r->next = free_requests;
125 free_requests = r;
128 static SCSIRequest *scsi_find_request(SCSIDiskState *s, uint32_t tag)
130 SCSIRequest *r;
132 r = s->requests;
133 while (r && r->tag != tag)
134 r = r->next;
136 return r;
139 /* Helper function for command completion. */
140 static void scsi_command_complete(SCSIRequest *r, int status, int sense)
142 SCSIDiskState *s = r->dev;
143 uint32_t tag;
144 DPRINTF("Command complete tag=0x%x status=%d sense=%d\n", r->tag, status, sense);
145 s->sense = sense;
146 tag = r->tag;
147 scsi_remove_request(r);
148 r->bus->complete(r->bus, SCSI_REASON_DONE, tag, status);
151 /* Cancel a pending data transfer. */
152 static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
154 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
155 SCSIRequest *r;
156 DPRINTF("Cancel tag=0x%x\n", tag);
157 r = scsi_find_request(s, tag);
158 if (r) {
159 if (r->aiocb)
160 bdrv_aio_cancel(r->aiocb);
161 r->aiocb = NULL;
162 scsi_remove_request(r);
166 static void scsi_read_complete(void * opaque, int ret)
168 SCSIRequest *r = (SCSIRequest *)opaque;
170 if (ret) {
171 DPRINTF("IO error\n");
172 r->bus->complete(r->bus, SCSI_REASON_DATA, r->tag, 0);
173 scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NO_SENSE);
174 return;
176 DPRINTF("Data ready tag=0x%x len=%" PRId64 "\n", r->tag, r->iov.iov_len);
178 r->bus->complete(r->bus, SCSI_REASON_DATA, r->tag, r->iov.iov_len);
181 /* Read more data from scsi device into buffer. */
182 static void scsi_read_data(SCSIDevice *d, uint32_t tag)
184 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
185 SCSIRequest *r;
186 uint32_t n;
188 r = scsi_find_request(s, tag);
189 if (!r) {
190 BADF("Bad read tag 0x%x\n", tag);
191 /* ??? This is the wrong error. */
192 scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
193 return;
195 if (r->sector_count == (uint32_t)-1) {
196 DPRINTF("Read buf_len=%" PRId64 "\n", r->iov.iov_len);
197 r->sector_count = 0;
198 r->bus->complete(r->bus, SCSI_REASON_DATA, r->tag, r->iov.iov_len);
199 return;
201 DPRINTF("Read sector_count=%d\n", r->sector_count);
202 if (r->sector_count == 0) {
203 scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
204 return;
207 n = r->sector_count;
208 if (n > SCSI_DMA_BUF_SIZE / 512)
209 n = SCSI_DMA_BUF_SIZE / 512;
211 r->iov.iov_len = n * 512;
212 qemu_iovec_init_external(&r->qiov, &r->iov, 1);
213 r->aiocb = bdrv_aio_readv(s->dinfo->bdrv, r->sector, &r->qiov, n,
214 scsi_read_complete, r);
215 if (r->aiocb == NULL)
216 scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
217 r->sector += n;
218 r->sector_count -= n;
221 static int scsi_handle_write_error(SCSIRequest *r, int error)
223 BlockInterfaceErrorAction action = drive_get_onerror(r->dev->dinfo->bdrv);
225 if (action == BLOCK_ERR_IGNORE)
226 return 0;
228 if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
229 || action == BLOCK_ERR_STOP_ANY) {
230 r->status |= SCSI_REQ_STATUS_RETRY;
231 vm_stop(0);
232 } else {
233 scsi_command_complete(r, STATUS_CHECK_CONDITION,
234 SENSE_HARDWARE_ERROR);
237 return 1;
240 static void scsi_write_complete(void * opaque, int ret)
242 SCSIRequest *r = (SCSIRequest *)opaque;
243 uint32_t len;
244 uint32_t n;
246 r->aiocb = NULL;
248 if (ret) {
249 if (scsi_handle_write_error(r, -ret))
250 return;
253 n = r->iov.iov_len / 512;
254 r->sector += n;
255 r->sector_count -= n;
256 if (r->sector_count == 0) {
257 scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
258 } else {
259 len = r->sector_count * 512;
260 if (len > SCSI_DMA_BUF_SIZE) {
261 len = SCSI_DMA_BUF_SIZE;
263 r->iov.iov_len = len;
264 DPRINTF("Write complete tag=0x%x more=%d\n", r->tag, len);
265 r->bus->complete(r->bus, SCSI_REASON_DATA, r->tag, len);
269 static void scsi_write_request(SCSIRequest *r)
271 SCSIDiskState *s = r->dev;
272 uint32_t n;
274 n = r->iov.iov_len / 512;
275 if (n) {
276 qemu_iovec_init_external(&r->qiov, &r->iov, 1);
277 r->aiocb = bdrv_aio_writev(s->dinfo->bdrv, r->sector, &r->qiov, n,
278 scsi_write_complete, r);
279 if (r->aiocb == NULL)
280 scsi_command_complete(r, STATUS_CHECK_CONDITION,
281 SENSE_HARDWARE_ERROR);
282 } else {
283 /* Invoke completion routine to fetch data from host. */
284 scsi_write_complete(r, 0);
288 /* Write data to a scsi device. Returns nonzero on failure.
289 The transfer may complete asynchronously. */
290 static int scsi_write_data(SCSIDevice *d, uint32_t tag)
292 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
293 SCSIRequest *r;
295 DPRINTF("Write data tag=0x%x\n", tag);
296 r = scsi_find_request(s, tag);
297 if (!r) {
298 BADF("Bad write tag 0x%x\n", tag);
299 scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
300 return 1;
303 if (r->aiocb)
304 BADF("Data transfer already in progress\n");
306 scsi_write_request(r);
308 return 0;
311 static void scsi_dma_restart_bh(void *opaque)
313 SCSIDiskState *s = opaque;
314 SCSIRequest *r = s->requests;
316 qemu_bh_delete(s->bh);
317 s->bh = NULL;
319 while (r) {
320 if (r->status & SCSI_REQ_STATUS_RETRY) {
321 r->status &= ~SCSI_REQ_STATUS_RETRY;
322 scsi_write_request(r);
324 r = r->next;
328 static void scsi_dma_restart_cb(void *opaque, int running, int reason)
330 SCSIDiskState *s = opaque;
332 if (!running)
333 return;
335 if (!s->bh) {
336 s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
337 qemu_bh_schedule(s->bh);
341 /* Return a pointer to the data buffer. */
342 static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
344 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
345 SCSIRequest *r;
347 r = scsi_find_request(s, tag);
348 if (!r) {
349 BADF("Bad buffer tag 0x%x\n", tag);
350 return NULL;
352 return (uint8_t *)r->iov.iov_base;
355 /* Execute a scsi command. Returns the length of the data expected by the
356 command. This will be Positive for data transfers from the device
357 (eg. disk reads), negative for transfers to the device (eg. disk writes),
358 and zero if the command does not transfer any data. */
360 static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
361 uint8_t *buf, int lun)
363 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
364 uint64_t nb_sectors;
365 uint64_t lba;
366 uint32_t len;
367 int cmdlen;
368 int is_write;
369 uint8_t command;
370 uint8_t *outbuf;
371 SCSIRequest *r;
373 command = buf[0];
374 r = scsi_find_request(s, tag);
375 if (r) {
376 BADF("Tag 0x%x already in use\n", tag);
377 scsi_cancel_io(d, tag);
379 /* ??? Tags are not unique for different luns. We only implement a
380 single lun, so this should not matter. */
381 r = scsi_new_request(d, tag);
382 outbuf = (uint8_t *)r->iov.iov_base;
383 is_write = 0;
384 DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
385 switch (command >> 5) {
386 case 0:
387 lba = (uint64_t) buf[3] | ((uint64_t) buf[2] << 8) |
388 (((uint64_t) buf[1] & 0x1f) << 16);
389 len = buf[4];
390 cmdlen = 6;
391 break;
392 case 1:
393 case 2:
394 lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
395 ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
396 len = buf[8] | (buf[7] << 8);
397 cmdlen = 10;
398 break;
399 case 4:
400 lba = (uint64_t) buf[9] | ((uint64_t) buf[8] << 8) |
401 ((uint64_t) buf[7] << 16) | ((uint64_t) buf[6] << 24) |
402 ((uint64_t) buf[5] << 32) | ((uint64_t) buf[4] << 40) |
403 ((uint64_t) buf[3] << 48) | ((uint64_t) buf[2] << 56);
404 len = buf[13] | (buf[12] << 8) | (buf[11] << 16) | (buf[10] << 24);
405 cmdlen = 16;
406 break;
407 case 5:
408 lba = (uint64_t) buf[5] | ((uint64_t) buf[4] << 8) |
409 ((uint64_t) buf[3] << 16) | ((uint64_t) buf[2] << 24);
410 len = buf[9] | (buf[8] << 8) | (buf[7] << 16) | (buf[6] << 24);
411 cmdlen = 12;
412 break;
413 default:
414 BADF("Unsupported command length, command %x\n", command);
415 goto fail;
417 #ifdef DEBUG_SCSI
419 int i;
420 for (i = 1; i < cmdlen; i++) {
421 printf(" 0x%02x", buf[i]);
423 printf("\n");
425 #endif
426 if (lun || buf[1] >> 5) {
427 /* Only LUN 0 supported. */
428 DPRINTF("Unimplemented LUN %d\n", lun ? lun : buf[1] >> 5);
429 if (command != 0x03 && command != 0x12) /* REQUEST SENSE and INQUIRY */
430 goto fail;
432 switch (command) {
433 case 0x0:
434 DPRINTF("Test Unit Ready\n");
435 if (!bdrv_is_inserted(s->dinfo->bdrv))
436 goto notready;
437 break;
438 case 0x03:
439 DPRINTF("Request Sense (len %d)\n", len);
440 if (len < 4)
441 goto fail;
442 memset(outbuf, 0, 4);
443 r->iov.iov_len = 4;
444 if (s->sense == SENSE_NOT_READY && len >= 18) {
445 memset(outbuf, 0, 18);
446 r->iov.iov_len = 18;
447 outbuf[7] = 10;
448 /* asc 0x3a, ascq 0: Medium not present */
449 outbuf[12] = 0x3a;
450 outbuf[13] = 0;
452 outbuf[0] = 0xf0;
453 outbuf[1] = 0;
454 outbuf[2] = s->sense;
455 break;
456 case 0x12:
457 DPRINTF("Inquiry (len %d)\n", len);
458 if (buf[1] & 0x2) {
459 /* Command support data - optional, not implemented */
460 BADF("optional INQUIRY command support request not implemented\n");
461 goto fail;
463 else if (buf[1] & 0x1) {
464 /* Vital product data */
465 uint8_t page_code = buf[2];
466 if (len < 4) {
467 BADF("Error: Inquiry (EVPD[%02X]) buffer size %d is "
468 "less than 4\n", page_code, len);
469 goto fail;
472 switch (page_code) {
473 case 0x00:
475 /* Supported page codes, mandatory */
476 DPRINTF("Inquiry EVPD[Supported pages] "
477 "buffer size %d\n", len);
479 r->iov.iov_len = 0;
481 if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
482 outbuf[r->iov.iov_len++] = 5;
483 } else {
484 outbuf[r->iov.iov_len++] = 0;
487 outbuf[r->iov.iov_len++] = 0x00; // this page
488 outbuf[r->iov.iov_len++] = 0x00;
489 outbuf[r->iov.iov_len++] = 3; // number of pages
490 outbuf[r->iov.iov_len++] = 0x00; // list of supported pages (this page)
491 outbuf[r->iov.iov_len++] = 0x80; // unit serial number
492 outbuf[r->iov.iov_len++] = 0x83; // device identification
494 break;
495 case 0x80:
497 int l;
499 /* Device serial number, optional */
500 if (len < 4) {
501 BADF("Error: EVPD[Serial number] Inquiry buffer "
502 "size %d too small, %d needed\n", len, 4);
503 goto fail;
506 DPRINTF("Inquiry EVPD[Serial number] buffer size %d\n", len);
507 l = MIN(len, strlen(s->drive_serial_str));
509 r->iov.iov_len = 0;
511 /* Supported page codes */
512 if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
513 outbuf[r->iov.iov_len++] = 5;
514 } else {
515 outbuf[r->iov.iov_len++] = 0;
518 outbuf[r->iov.iov_len++] = 0x80; // this page
519 outbuf[r->iov.iov_len++] = 0x00;
520 outbuf[r->iov.iov_len++] = l;
521 memcpy(&outbuf[r->iov.iov_len], s->drive_serial_str, l);
522 r->iov.iov_len += l;
525 break;
526 case 0x83:
528 /* Device identification page, mandatory */
529 int max_len = 255 - 8;
530 int id_len = strlen(bdrv_get_device_name(s->dinfo->bdrv));
531 if (id_len > max_len)
532 id_len = max_len;
534 DPRINTF("Inquiry EVPD[Device identification] "
535 "buffer size %d\n", len);
536 r->iov.iov_len = 0;
537 if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
538 outbuf[r->iov.iov_len++] = 5;
539 } else {
540 outbuf[r->iov.iov_len++] = 0;
543 outbuf[r->iov.iov_len++] = 0x83; // this page
544 outbuf[r->iov.iov_len++] = 0x00;
545 outbuf[r->iov.iov_len++] = 3 + id_len;
547 outbuf[r->iov.iov_len++] = 0x2; // ASCII
548 outbuf[r->iov.iov_len++] = 0; // not officially assigned
549 outbuf[r->iov.iov_len++] = 0; // reserved
550 outbuf[r->iov.iov_len++] = id_len; // length of data following
552 memcpy(&outbuf[r->iov.iov_len],
553 bdrv_get_device_name(s->dinfo->bdrv), id_len);
554 r->iov.iov_len += id_len;
556 break;
557 default:
558 BADF("Error: unsupported Inquiry (EVPD[%02X]) "
559 "buffer size %d\n", page_code, len);
560 goto fail;
562 /* done with EVPD */
563 break;
565 else {
566 /* Standard INQUIRY data */
567 if (buf[2] != 0) {
568 BADF("Error: Inquiry (STANDARD) page or code "
569 "is non-zero [%02X]\n", buf[2]);
570 goto fail;
573 /* PAGE CODE == 0 */
574 if (len < 5) {
575 BADF("Error: Inquiry (STANDARD) buffer size %d "
576 "is less than 5\n", len);
577 goto fail;
580 if (len < 36) {
581 BADF("Error: Inquiry (STANDARD) buffer size %d "
582 "is less than 36 (TODO: only 5 required)\n", len);
586 if(len > SCSI_MAX_INQUIRY_LEN)
587 len = SCSI_MAX_INQUIRY_LEN;
589 memset(outbuf, 0, len);
591 if (lun || buf[1] >> 5) {
592 outbuf[0] = 0x7f; /* LUN not supported */
593 } else if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
594 outbuf[0] = 5;
595 outbuf[1] = 0x80;
596 memcpy(&outbuf[16], "QEMU CD-ROM ", 16);
597 } else {
598 outbuf[0] = 0;
599 memcpy(&outbuf[16], "QEMU HARDDISK ", 16);
601 memcpy(&outbuf[8], "QEMU ", 8);
602 memcpy(&outbuf[32], QEMU_VERSION, 4);
603 /* Identify device as SCSI-3 rev 1.
604 Some later commands are also implemented. */
605 outbuf[2] = 3;
606 outbuf[3] = 2; /* Format 2 */
607 outbuf[4] = len - 5; /* Additional Length = (Len - 1) - 4 */
608 /* Sync data transfer and TCQ. */
609 outbuf[7] = 0x10 | (r->bus->tcq ? 0x02 : 0);
610 r->iov.iov_len = len;
611 break;
612 case 0x16:
613 DPRINTF("Reserve(6)\n");
614 if (buf[1] & 1)
615 goto fail;
616 break;
617 case 0x17:
618 DPRINTF("Release(6)\n");
619 if (buf[1] & 1)
620 goto fail;
621 break;
622 case 0x1a:
623 case 0x5a:
625 uint8_t *p;
626 int page;
628 page = buf[2] & 0x3f;
629 DPRINTF("Mode Sense (page %d, len %d)\n", page, len);
630 p = outbuf;
631 memset(p, 0, 4);
632 outbuf[1] = 0; /* Default media type. */
633 outbuf[3] = 0; /* Block descriptor length. */
634 if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
635 outbuf[2] = 0x80; /* Readonly. */
637 p += 4;
638 if (page == 4) {
639 int cylinders, heads, secs;
641 /* Rigid disk device geometry page. */
642 p[0] = 4;
643 p[1] = 0x16;
644 /* if a geometry hint is available, use it */
645 bdrv_get_geometry_hint(s->dinfo->bdrv, &cylinders, &heads, &secs);
646 p[2] = (cylinders >> 16) & 0xff;
647 p[3] = (cylinders >> 8) & 0xff;
648 p[4] = cylinders & 0xff;
649 p[5] = heads & 0xff;
650 /* Write precomp start cylinder, disabled */
651 p[6] = (cylinders >> 16) & 0xff;
652 p[7] = (cylinders >> 8) & 0xff;
653 p[8] = cylinders & 0xff;
654 /* Reduced current start cylinder, disabled */
655 p[9] = (cylinders >> 16) & 0xff;
656 p[10] = (cylinders >> 8) & 0xff;
657 p[11] = cylinders & 0xff;
658 /* Device step rate [ns], 200ns */
659 p[12] = 0;
660 p[13] = 200;
661 /* Landing zone cylinder */
662 p[14] = 0xff;
663 p[15] = 0xff;
664 p[16] = 0xff;
665 /* Medium rotation rate [rpm], 5400 rpm */
666 p[20] = (5400 >> 8) & 0xff;
667 p[21] = 5400 & 0xff;
668 p += 0x16;
669 } else if (page == 5) {
670 int cylinders, heads, secs;
672 /* Flexible disk device geometry page. */
673 p[0] = 5;
674 p[1] = 0x1e;
675 /* Transfer rate [kbit/s], 5Mbit/s */
676 p[2] = 5000 >> 8;
677 p[3] = 5000 & 0xff;
678 /* if a geometry hint is available, use it */
679 bdrv_get_geometry_hint(s->dinfo->bdrv, &cylinders, &heads, &secs);
680 p[4] = heads & 0xff;
681 p[5] = secs & 0xff;
682 p[6] = s->cluster_size * 2;
683 p[8] = (cylinders >> 8) & 0xff;
684 p[9] = cylinders & 0xff;
685 /* Write precomp start cylinder, disabled */
686 p[10] = (cylinders >> 8) & 0xff;
687 p[11] = cylinders & 0xff;
688 /* Reduced current start cylinder, disabled */
689 p[12] = (cylinders >> 8) & 0xff;
690 p[13] = cylinders & 0xff;
691 /* Device step rate [100us], 100us */
692 p[14] = 0;
693 p[15] = 1;
694 /* Device step pulse width [us], 1us */
695 p[16] = 1;
696 /* Device head settle delay [100us], 100us */
697 p[17] = 0;
698 p[18] = 1;
699 /* Motor on delay [0.1s], 0.1s */
700 p[19] = 1;
701 /* Motor off delay [0.1s], 0.1s */
702 p[20] = 1;
703 /* Medium rotation rate [rpm], 5400 rpm */
704 p[28] = (5400 >> 8) & 0xff;
705 p[29] = 5400 & 0xff;
706 p += 0x1e;
707 } else if ((page == 8 || page == 0x3f)) {
708 /* Caching page. */
709 memset(p,0,20);
710 p[0] = 8;
711 p[1] = 0x12;
712 p[2] = 4; /* WCE */
713 p += 20;
715 if ((page == 0x3f || page == 0x2a)
716 && (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM)) {
717 /* CD Capabilities and Mechanical Status page. */
718 p[0] = 0x2a;
719 p[1] = 0x14;
720 p[2] = 3; // CD-R & CD-RW read
721 p[3] = 0; // Writing not supported
722 p[4] = 0x7f; /* Audio, composite, digital out,
723 mode 2 form 1&2, multi session */
724 p[5] = 0xff; /* CD DA, DA accurate, RW supported,
725 RW corrected, C2 errors, ISRC,
726 UPC, Bar code */
727 p[6] = 0x2d | (bdrv_is_locked(s->dinfo->bdrv)? 2 : 0);
728 /* Locking supported, jumper present, eject, tray */
729 p[7] = 0; /* no volume & mute control, no
730 changer */
731 p[8] = (50 * 176) >> 8; // 50x read speed
732 p[9] = (50 * 176) & 0xff;
733 p[10] = 0 >> 8; // No volume
734 p[11] = 0 & 0xff;
735 p[12] = 2048 >> 8; // 2M buffer
736 p[13] = 2048 & 0xff;
737 p[14] = (16 * 176) >> 8; // 16x read speed current
738 p[15] = (16 * 176) & 0xff;
739 p[18] = (16 * 176) >> 8; // 16x write speed
740 p[19] = (16 * 176) & 0xff;
741 p[20] = (16 * 176) >> 8; // 16x write speed current
742 p[21] = (16 * 176) & 0xff;
743 p += 22;
745 r->iov.iov_len = p - outbuf;
746 outbuf[0] = r->iov.iov_len - 4;
747 if (r->iov.iov_len > len)
748 r->iov.iov_len = len;
750 break;
751 case 0x1b:
752 DPRINTF("Start Stop Unit\n");
753 if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM &&
754 (buf[4] & 2))
755 /* load/eject medium */
756 bdrv_eject(s->dinfo->bdrv, !(buf[4] & 1));
757 break;
758 case 0x1e:
759 DPRINTF("Prevent Allow Medium Removal (prevent = %d)\n", buf[4] & 3);
760 bdrv_set_locked(s->dinfo->bdrv, buf[4] & 1);
761 break;
762 case 0x25:
763 DPRINTF("Read Capacity\n");
764 /* The normal LEN field for this command is zero. */
765 memset(outbuf, 0, 8);
766 bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
767 nb_sectors /= s->cluster_size;
768 /* Returned value is the address of the last sector. */
769 if (nb_sectors) {
770 nb_sectors--;
771 /* Remember the new size for read/write sanity checking. */
772 s->max_lba = nb_sectors;
773 /* Clip to 2TB, instead of returning capacity modulo 2TB. */
774 if (nb_sectors > UINT32_MAX)
775 nb_sectors = UINT32_MAX;
776 outbuf[0] = (nb_sectors >> 24) & 0xff;
777 outbuf[1] = (nb_sectors >> 16) & 0xff;
778 outbuf[2] = (nb_sectors >> 8) & 0xff;
779 outbuf[3] = nb_sectors & 0xff;
780 outbuf[4] = 0;
781 outbuf[5] = 0;
782 outbuf[6] = s->cluster_size * 2;
783 outbuf[7] = 0;
784 r->iov.iov_len = 8;
785 } else {
786 notready:
787 scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);
788 return 0;
790 break;
791 case 0x08:
792 case 0x28:
793 case 0x88:
794 DPRINTF("Read (sector %" PRId64 ", count %d)\n", lba, len);
795 if (lba > s->max_lba)
796 goto illegal_lba;
797 r->sector = lba * s->cluster_size;
798 r->sector_count = len * s->cluster_size;
799 break;
800 case 0x0a:
801 case 0x2a:
802 case 0x8a:
803 DPRINTF("Write (sector %" PRId64 ", count %d)\n", lba, len);
804 if (lba > s->max_lba)
805 goto illegal_lba;
806 r->sector = lba * s->cluster_size;
807 r->sector_count = len * s->cluster_size;
808 is_write = 1;
809 break;
810 case 0x35:
811 DPRINTF("Synchronise cache (sector %" PRId64 ", count %d)\n", lba, len);
812 bdrv_flush(s->dinfo->bdrv);
813 break;
814 case 0x43:
816 int start_track, format, msf, toclen;
818 msf = buf[1] & 2;
819 format = buf[2] & 0xf;
820 start_track = buf[6];
821 bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
822 DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
823 nb_sectors /= s->cluster_size;
824 switch(format) {
825 case 0:
826 toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
827 break;
828 case 1:
829 /* multi session : only a single session defined */
830 toclen = 12;
831 memset(outbuf, 0, 12);
832 outbuf[1] = 0x0a;
833 outbuf[2] = 0x01;
834 outbuf[3] = 0x01;
835 break;
836 case 2:
837 toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
838 break;
839 default:
840 goto error_cmd;
842 if (toclen > 0) {
843 if (len > toclen)
844 len = toclen;
845 r->iov.iov_len = len;
846 break;
848 error_cmd:
849 DPRINTF("Read TOC error\n");
850 goto fail;
852 case 0x46:
853 DPRINTF("Get Configuration (rt %d, maxlen %d)\n", buf[1] & 3, len);
854 memset(outbuf, 0, 8);
855 /* ??? This should probably return much more information. For now
856 just return the basic header indicating the CD-ROM profile. */
857 outbuf[7] = 8; // CD-ROM
858 r->iov.iov_len = 8;
859 break;
860 case 0x56:
861 DPRINTF("Reserve(10)\n");
862 if (buf[1] & 3)
863 goto fail;
864 break;
865 case 0x57:
866 DPRINTF("Release(10)\n");
867 if (buf[1] & 3)
868 goto fail;
869 break;
870 case 0x9e:
871 /* Service Action In subcommands. */
872 if ((buf[1] & 31) == 0x10) {
873 DPRINTF("SAI READ CAPACITY(16)\n");
874 memset(outbuf, 0, len);
875 bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
876 nb_sectors /= s->cluster_size;
877 /* Returned value is the address of the last sector. */
878 if (nb_sectors) {
879 nb_sectors--;
880 /* Remember the new size for read/write sanity checking. */
881 s->max_lba = nb_sectors;
882 outbuf[0] = (nb_sectors >> 56) & 0xff;
883 outbuf[1] = (nb_sectors >> 48) & 0xff;
884 outbuf[2] = (nb_sectors >> 40) & 0xff;
885 outbuf[3] = (nb_sectors >> 32) & 0xff;
886 outbuf[4] = (nb_sectors >> 24) & 0xff;
887 outbuf[5] = (nb_sectors >> 16) & 0xff;
888 outbuf[6] = (nb_sectors >> 8) & 0xff;
889 outbuf[7] = nb_sectors & 0xff;
890 outbuf[8] = 0;
891 outbuf[9] = 0;
892 outbuf[10] = s->cluster_size * 2;
893 outbuf[11] = 0;
894 /* Protection, exponent and lowest lba field left blank. */
895 r->iov.iov_len = len;
896 } else {
897 scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);
898 return 0;
900 break;
902 DPRINTF("Unsupported Service Action In\n");
903 goto fail;
904 case 0xa0:
905 DPRINTF("Report LUNs (len %d)\n", len);
906 if (len < 16)
907 goto fail;
908 memset(outbuf, 0, 16);
909 outbuf[3] = 8;
910 r->iov.iov_len = 16;
911 break;
912 case 0x2f:
913 DPRINTF("Verify (sector %" PRId64 ", count %d)\n", lba, len);
914 break;
915 default:
916 DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
917 fail:
918 scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_ILLEGAL_REQUEST);
919 return 0;
920 illegal_lba:
921 scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);
922 return 0;
924 if (r->sector_count == 0 && r->iov.iov_len == 0) {
925 scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);
927 len = r->sector_count * 512 + r->iov.iov_len;
928 if (is_write) {
929 return -len;
930 } else {
931 if (!r->sector_count)
932 r->sector_count = -1;
933 return len;
937 static void scsi_destroy(SCSIDevice *d)
939 qemu_free(d);
942 static int scsi_disk_initfn(SCSIDevice *dev)
944 SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
945 uint64_t nb_sectors;
947 if (!s->dinfo || !s->dinfo->bdrv) {
948 qemu_error("scsi-disk: drive property not set\n");
949 return -1;
952 if (bdrv_get_type_hint(s->dinfo->bdrv) == BDRV_TYPE_CDROM) {
953 s->cluster_size = 4;
954 } else {
955 s->cluster_size = 1;
957 bdrv_get_geometry(s->dinfo->bdrv, &nb_sectors);
958 nb_sectors /= s->cluster_size;
959 if (nb_sectors)
960 nb_sectors--;
961 s->max_lba = nb_sectors;
962 strncpy(s->drive_serial_str, drive_get_serial(s->dinfo->bdrv),
963 sizeof(s->drive_serial_str));
964 if (strlen(s->drive_serial_str) == 0)
965 pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), "0");
966 qemu_add_vm_change_state_handler(scsi_dma_restart_cb, s);
967 return 0;
970 static SCSIDeviceInfo scsi_disk_info = {
971 .qdev.name = "scsi-disk",
972 .qdev.desc = "virtual scsi disk or cdrom",
973 .qdev.size = sizeof(SCSIDiskState),
974 .init = scsi_disk_initfn,
975 .destroy = scsi_destroy,
976 .send_command = scsi_send_command,
977 .read_data = scsi_read_data,
978 .write_data = scsi_write_data,
979 .cancel_io = scsi_cancel_io,
980 .get_buf = scsi_get_buf,
981 .qdev.props = (Property[]) {
982 DEFINE_PROP_DRIVE("drive", SCSIDiskState, dinfo),
983 DEFINE_PROP_END_OF_LIST(),
987 static void scsi_disk_register_devices(void)
989 scsi_qdev_register(&scsi_disk_info);
991 device_init(scsi_disk_register_devices)