1 /*

     2  * SCSI Device emulation

     3  *

     4  * Copyright (c) 2006 CodeSourcery.

     5  * Based on code by Fabrice Bellard

     6  *

     7  * Written by Paul Brook

     8  *

     9  * This code is licenced under the LGPL.

    10  *

    11  * Note that this file only handles the SCSI architecture model and device

    12  * commands.  Emulation of interface/link layer protocols is handled by

    13  * the host adapter emulator.

    14  */

    15 

    16 //#define DEBUG_SCSI

    17 

    18 #ifdef DEBUG_SCSI

    19 #define DPRINTF(fmt, args...) \

    20 do { printf("scsi-disk: " fmt , ##args); } while (0)

    21 #else

    22 #define DPRINTF(fmt, args...) do {} while(0)

    23 #endif

    24 

    25 #define BADF(fmt, args...) \

    26 do { fprintf(stderr, "scsi-disk: " fmt , ##args); } while (0)

    27 

    28 #include "qemu-common.h"

    29 #include "block.h"

    30 #include "scsi-disk.h"

    31 

    32 #define SENSE_NO_SENSE        0

    33 #define SENSE_NOT_READY       2

    34 #define SENSE_HARDWARE_ERROR  4

    35 #define SENSE_ILLEGAL_REQUEST 5

    36 

    37 #define STATUS_GOOD            0

    38 #define STATUS_CHECK_CONDITION 2

    39 

    40 #define SCSI_DMA_BUF_SIZE    131072

    41 #define SCSI_MAX_INQUIRY_LEN 256

    42 

    43 typedef struct SCSIRequest {

    44     SCSIDeviceState *dev;

    45     uint32_t tag;

    46     /* ??? We should probably keep track of whether the data trasfer is

    47        a read or a write.  Currently we rely on the host getting it right.  */

    48     /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */

    49     int sector;

    50     int sector_count;

    51     /* The amounnt of data in the buffer.  */

    52     int buf_len;

    53     uint8_t *dma_buf;

    54     BlockDriverAIOCB *aiocb;

    55     struct SCSIRequest *next;

    56 } SCSIRequest;

    57 

    58 struct SCSIDeviceState

    59 {

    60     BlockDriverState *bdrv;

    61     SCSIRequest *requests;

    62     /* The qemu block layer uses a fixed 512 byte sector size.

    63        This is the number of 512 byte blocks in a single scsi sector.  */

    64     int cluster_size;

    65     int sense;

    66     int tcq;

    67     /* Completion functions may be called from either scsi_{read,write}_data

    68        or from the AIO completion routines.  */

    69     scsi_completionfn completion;

    70     void *opaque;

    71 };

    72 

    73 /* Global pool of SCSIRequest structures.  */

    74 static SCSIRequest *free_requests = NULL;

    75 

    76 static SCSIRequest *scsi_new_request(SCSIDeviceState *s, uint32_t tag)

    77 {

    78     SCSIRequest *r;

    79 

    80     if (free_requests) {

    81         r = free_requests;

    82         free_requests = r->next;

    83     } else {

    84         r = qemu_malloc(sizeof(SCSIRequest));

    85         r->dma_buf = qemu_memalign(512, SCSI_DMA_BUF_SIZE);

    86     }

    87     r->dev = s;

    88     r->tag = tag;

    89     r->sector_count = 0;

    90     r->buf_len = 0;

    91     r->aiocb = NULL;

    92 

    93     r->next = s->requests;

    94     s->requests = r;

    95     return r;

    96 }

    97 

    98 static void scsi_remove_request(SCSIRequest *r)

    99 {

   100     SCSIRequest *last;

   101     SCSIDeviceState *s = r->dev;

   102 

   103     if (s->requests == r) {

   104         s->requests = r->next;

   105     } else {

   106         last = s->requests;

   107         while (last && last->next != r)

   108             last = last->next;

   109         if (last) {

   110             last->next = r->next;

   111         } else {

   112             BADF("Orphaned request\n");

   113         }

   114     }

   115     r->next = free_requests;

   116     free_requests = r;

   117 }

   118 

   119 static SCSIRequest *scsi_find_request(SCSIDeviceState *s, uint32_t tag)

   120 {

   121     SCSIRequest *r;

   122 

   123     r = s->requests;

   124     while (r && r->tag != tag)

   125         r = r->next;

   126 

   127     return r;

   128 }

   129 

   130 /* Helper function for command completion.  */

   131 static void scsi_command_complete(SCSIRequest *r, int status, int sense)

   132 {

   133     SCSIDeviceState *s = r->dev;

   134     uint32_t tag;

   135     DPRINTF("Command complete tag=0x%x status=%d sense=%d\n", r->tag, status, sense);

   136     s->sense = sense;

   137     tag = r->tag;

   138     scsi_remove_request(r);

   139     s->completion(s->opaque, SCSI_REASON_DONE, tag, status);

   140 }

   141 

   142 /* Cancel a pending data transfer.  */

   143 static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)

   144 {

   145     SCSIDeviceState *s = d->state;

   146     SCSIRequest *r;

   147     DPRINTF("Cancel tag=0x%x\n", tag);

   148     r = scsi_find_request(s, tag);

   149     if (r) {

   150         if (r->aiocb)

   151             bdrv_aio_cancel(r->aiocb);

   152         r->aiocb = NULL;

   153         scsi_remove_request(r);

   154     }

   155 }

   156 

   157 static void scsi_read_complete(void * opaque, int ret)

   158 {

   159     SCSIRequest *r = (SCSIRequest *)opaque;

   160     SCSIDeviceState *s = r->dev;

   161 

   162     if (ret) {

   163         DPRINTF("IO error\n");

   164         s->completion(s->opaque, SCSI_REASON_DATA, r->tag, 0);

   165         scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NO_SENSE);

   166         return;

   167     }

   168     DPRINTF("Data ready tag=0x%x len=%d\n", r->tag, r->buf_len);

   169 

   170     s->completion(s->opaque, SCSI_REASON_DATA, r->tag, r->buf_len);

   171 }

   172 

   173 /* Read more data from scsi device into buffer.  */

   174 static void scsi_read_data(SCSIDevice *d, uint32_t tag)

   175 {

   176     SCSIDeviceState *s = d->state;

   177     SCSIRequest *r;

   178     uint32_t n;

   179 

   180     r = scsi_find_request(s, tag);

   181     if (!r) {

   182         BADF("Bad read tag 0x%x\n", tag);

   183         /* ??? This is the wrong error.  */

   184         scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);

   185         return;

   186     }

   187     if (r->sector_count == (uint32_t)-1) {

   188         DPRINTF("Read buf_len=%d\n", r->buf_len);

   189         r->sector_count = 0;

   190         s->completion(s->opaque, SCSI_REASON_DATA, r->tag, r->buf_len);

   191         return;

   192     }

   193     DPRINTF("Read sector_count=%d\n", r->sector_count);

   194     if (r->sector_count == 0) {

   195         scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);

   196         return;

   197     }

   198 

   199     n = r->sector_count;

   200     if (n > SCSI_DMA_BUF_SIZE / 512)

   201         n = SCSI_DMA_BUF_SIZE / 512;

   202 

   203     r->buf_len = n * 512;

   204     r->aiocb = bdrv_aio_read(s->bdrv, r->sector, r->dma_buf, n,

   205                              scsi_read_complete, r);

   206     if (r->aiocb == NULL)

   207         scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);

   208     r->sector += n;

   209     r->sector_count -= n;

   210 }

   211 

   212 static void scsi_write_complete(void * opaque, int ret)

   213 {

   214     SCSIRequest *r = (SCSIRequest *)opaque;

   215     SCSIDeviceState *s = r->dev;

   216     uint32_t len;

   217 

   218     if (ret) {

   219         fprintf(stderr, "scsi-disc: IO write error\n");

   220         exit(1);

   221     }

   222 

   223     r->aiocb = NULL;

   224     if (r->sector_count == 0) {

   225         scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);

   226     } else {

   227         len = r->sector_count * 512;

   228         if (len > SCSI_DMA_BUF_SIZE) {

   229             len = SCSI_DMA_BUF_SIZE;

   230         }

   231         r->buf_len = len;

   232         DPRINTF("Write complete tag=0x%x more=%d\n", r->tag, len);

   233         s->completion(s->opaque, SCSI_REASON_DATA, r->tag, len);

   234     }

   235 }

   236 

   237 /* Write data to a scsi device.  Returns nonzero on failure.

   238    The transfer may complete asynchronously.  */

   239 static int scsi_write_data(SCSIDevice *d, uint32_t tag)

   240 {

   241     SCSIDeviceState *s = d->state;

   242     SCSIRequest *r;

   243     uint32_t n;

   244 

   245     DPRINTF("Write data tag=0x%x\n", tag);

   246     r = scsi_find_request(s, tag);

   247     if (!r) {

   248         BADF("Bad write tag 0x%x\n", tag);

   249         scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_HARDWARE_ERROR);

   250         return 1;

   251     }

   252     if (r->aiocb)

   253         BADF("Data transfer already in progress\n");

   254     n = r->buf_len / 512;

   255     if (n) {

   256         r->aiocb = bdrv_aio_write(s->bdrv, r->sector, r->dma_buf, n,

   257                                   scsi_write_complete, r);

   258         if (r->aiocb == NULL)

   259             scsi_command_complete(r, STATUS_CHECK_CONDITION,

   260                                   SENSE_HARDWARE_ERROR);

   261         r->sector += n;

   262         r->sector_count -= n;

   263     } else {

   264         /* Invoke completion routine to fetch data from host.  */

   265         scsi_write_complete(r, 0);

   266     }

   267 

   268     return 0;

   269 }

   270 

   271 /* Return a pointer to the data buffer.  */

   272 static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)

   273 {

   274     SCSIDeviceState *s = d->state;

   275     SCSIRequest *r;

   276 

   277     r = scsi_find_request(s, tag);

   278     if (!r) {

   279         BADF("Bad buffer tag 0x%x\n", tag);

   280         return NULL;

   281     }

   282     return r->dma_buf;

   283 }

   284 

   285 /* Execute a scsi command.  Returns the length of the data expected by the

   286    command.  This will be Positive for data transfers from the device

   287    (eg. disk reads), negative for transfers to the device (eg. disk writes),

   288    and zero if the command does not transfer any data.  */

   289 

   290 static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,

   291                                  uint8_t *buf, int lun)

   292 {

   293     SCSIDeviceState *s = d->state;

   294     uint64_t nb_sectors;

   295     uint32_t lba;

   296     uint32_t len;

   297     int cmdlen;

   298     int is_write;

   299     uint8_t command;

   300     uint8_t *outbuf;

   301     SCSIRequest *r;

   302 

   303     command = buf[0];

   304     r = scsi_find_request(s, tag);

   305     if (r) {

   306         BADF("Tag 0x%x already in use\n", tag);

   307         scsi_cancel_io(d, tag);

   308     }

   309     /* ??? Tags are not unique for different luns.  We only implement a

   310        single lun, so this should not matter.  */

   311     r = scsi_new_request(s, tag);

   312     outbuf = r->dma_buf;

   313     is_write = 0;

   314     DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);

   315     switch (command >> 5) {

   316     case 0:

   317         lba = buf[3] | (buf[2] << 8) | ((buf[1] & 0x1f) << 16);

   318         len = buf[4];

   319         cmdlen = 6;

   320         break;

   321     case 1:

   322     case 2:

   323         lba = buf[5] | (buf[4] << 8) | (buf[3] << 16) | (buf[2] << 24);

   324         len = buf[8] | (buf[7] << 8);

   325         cmdlen = 10;

   326         break;

   327     case 4:

   328         lba = buf[5] | (buf[4] << 8) | (buf[3] << 16) | (buf[2] << 24);

   329         len = buf[13] | (buf[12] << 8) | (buf[11] << 16) | (buf[10] << 24);

   330         cmdlen = 16;

   331         break;

   332     case 5:

   333         lba = buf[5] | (buf[4] << 8) | (buf[3] << 16) | (buf[2] << 24);

   334         len = buf[9] | (buf[8] << 8) | (buf[7] << 16) | (buf[6] << 24);

   335         cmdlen = 12;

   336         break;

   337     default:

   338         BADF("Unsupported command length, command %x\n", command);

   339         goto fail;

   340     }

   341 #ifdef DEBUG_SCSI

   342     {

   343         int i;

   344         for (i = 1; i < cmdlen; i++) {

   345             printf(" 0x%02x", buf[i]);

   346         }

   347         printf("\n");

   348     }

   349 #endif

   350     if (lun || buf[1] >> 5) {

   351         /* Only LUN 0 supported.  */

   352         DPRINTF("Unimplemented LUN %d\n", lun ? lun : buf[1] >> 5);

   353         if (command != 0x03 && command != 0x12) /* REQUEST SENSE and INQUIRY */

   354             goto fail;

   355     }

   356     switch (command) {

   357     case 0x0:

   358 	DPRINTF("Test Unit Ready\n");

   359 	break;

   360     case 0x03:

   361         DPRINTF("Request Sense (len %d)\n", len);

   362         if (len < 4)

   363             goto fail;

   364         memset(outbuf, 0, 4);

   365         outbuf[0] = 0xf0;

   366         outbuf[1] = 0;

   367         outbuf[2] = s->sense;

   368         r->buf_len = 4;

   369         break;

   370     case 0x12:

   371         DPRINTF("Inquiry (len %d)\n", len);

   372         if (buf[1] & 0x2) {

   373             /* Command support data - optional, not implemented */

   374             BADF("optional INQUIRY command support request not implemented\n");

   375             goto fail;

   376         }

   377         else if (buf[1] & 0x1) {

   378             /* Vital product data */

   379             uint8_t page_code = buf[2];

   380             if (len < 4) {

   381                 BADF("Error: Inquiry (EVPD[%02X]) buffer size %d is "

   382                      "less than 4\n", page_code, len);

   383                 goto fail;

   384             }

   385 

   386             switch (page_code) {

   387                 case 0x00:

   388                     {

   389                         /* Supported page codes, mandatory */

   390                         DPRINTF("Inquiry EVPD[Supported pages] "

   391                                 "buffer size %d\n", len);

   392 

   393                         r->buf_len = 0;

   394 

   395                         if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {

   396                             outbuf[r->buf_len++] = 5;

   397                         } else {

   398                             outbuf[r->buf_len++] = 0;

   399                         }

   400 

   401                         outbuf[r->buf_len++] = 0x00; // this page

   402                         outbuf[r->buf_len++] = 0x00;

   403                         outbuf[r->buf_len++] = 3;    // number of pages

   404                         outbuf[r->buf_len++] = 0x00; // list of supported pages (this page)

   405                         outbuf[r->buf_len++] = 0x80; // unit serial number

   406                         outbuf[r->buf_len++] = 0x83; // device identification

   407                     }

   408                     break;

   409                 case 0x80:

   410                     {

   411                         /* Device serial number, optional */

   412                         if (len < 4) {

   413                             BADF("Error: EVPD[Serial number] Inquiry buffer "

   414                                  "size %d too small, %d needed\n", len, 4);

   415                             goto fail;

   416                         }

   417 

   418                         DPRINTF("Inquiry EVPD[Serial number] buffer size %d\n", len);

   419 

   420                         r->buf_len = 0;

   421 

   422                         /* Supported page codes */

   423                         if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {

   424                             outbuf[r->buf_len++] = 5;

   425                         } else {

   426                             outbuf[r->buf_len++] = 0;

   427                         }

   428 

   429                         outbuf[r->buf_len++] = 0x80; // this page

   430                         outbuf[r->buf_len++] = 0x00;

   431                         outbuf[r->buf_len++] = 0x01; // 1 byte data follow

   432 

   433                         outbuf[r->buf_len++] = '0';  // 1 byte data follow 

   434                     }

   435 

   436                     break;

   437                 case 0x83:

   438                     {

   439                         /* Device identification page, mandatory */

   440                         int max_len = 255 - 8;

   441                         int id_len = strlen(bdrv_get_device_name(s->bdrv));

   442                         if (id_len > max_len)

   443                             id_len = max_len;

   444 

   445                         DPRINTF("Inquiry EVPD[Device identification] "

   446                                 "buffer size %d\n", len);

   447                         r->buf_len = 0;

   448                         if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {

   449                             outbuf[r->buf_len++] = 5;

   450                         } else {

   451                             outbuf[r->buf_len++] = 0;

   452                         }

   453 

   454                         outbuf[r->buf_len++] = 0x83; // this page

   455                         outbuf[r->buf_len++] = 0x00;

   456                         outbuf[r->buf_len++] = 3 + id_len;

   457 

   458                         outbuf[r->buf_len++] = 0x2; // ASCII

   459                         outbuf[r->buf_len++] = 0;   // not officially assigned

   460                         outbuf[r->buf_len++] = 0;   // reserved

   461                         outbuf[r->buf_len++] = id_len; // length of data following

   462 

   463                         memcpy(&outbuf[r->buf_len],

   464                                bdrv_get_device_name(s->bdrv), id_len);

   465                         r->buf_len += id_len;

   466                     }

   467                     break;

   468                 default:

   469                     BADF("Error: unsupported Inquiry (EVPD[%02X]) "

   470                          "buffer size %d\n", page_code, len);

   471                     goto fail;

   472             }

   473             /* done with EVPD */

   474             break;

   475         }

   476         else {

   477             /* Standard INQUIRY data */

   478             if (buf[2] != 0) {

   479                 BADF("Error: Inquiry (STANDARD) page or code "

   480                      "is non-zero [%02X]\n", buf[2]);

   481                 goto fail;

   482             }

   483 

   484             /* PAGE CODE == 0 */

   485             if (len < 5) {

   486                 BADF("Error: Inquiry (STANDARD) buffer size %d "

   487                      "is less than 5\n", len);

   488                 goto fail;

   489             }

   490 

   491             if (len < 36) {

   492                 BADF("Error: Inquiry (STANDARD) buffer size %d "

   493                      "is less than 36 (TODO: only 5 required)\n", len);

   494             }

   495         }

   496 

   497         if(len > SCSI_MAX_INQUIRY_LEN)

   498             len = SCSI_MAX_INQUIRY_LEN;

   499 

   500         memset(outbuf, 0, len);

   501 

   502         if (lun || buf[1] >> 5) {

   503             outbuf[0] = 0x7f;	/* LUN not supported */

   504 	} else if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {

   505 	    outbuf[0] = 5;

   506             outbuf[1] = 0x80;

   507 	    memcpy(&outbuf[16], "QEMU CD-ROM    ", 16);

   508 	} else {

   509 	    outbuf[0] = 0;

   510 	    memcpy(&outbuf[16], "QEMU HARDDISK  ", 16);

   511 	}

   512 	memcpy(&outbuf[8], "QEMU   ", 8);

   513         memcpy(&outbuf[32], QEMU_VERSION, 4);

   514         /* Identify device as SCSI-3 rev 1.

   515            Some later commands are also implemented. */

   516 	outbuf[2] = 3;

   517 	outbuf[3] = 2; /* Format 2 */

   518 	outbuf[4] = len - 5; /* Additional Length = (Len - 1) - 4 */

   519         /* Sync data transfer and TCQ.  */

   520         outbuf[7] = 0x10 | (s->tcq ? 0x02 : 0);

   521 	r->buf_len = len;

   522 	break;

   523     case 0x16:

   524         DPRINTF("Reserve(6)\n");

   525         if (buf[1] & 1)

   526             goto fail;

   527         break;

   528     case 0x17:

   529         DPRINTF("Release(6)\n");

   530         if (buf[1] & 1)

   531             goto fail;

   532         break;

   533     case 0x1a:

   534     case 0x5a:

   535         {

   536             uint8_t *p;

   537             int page;

   538 

   539             page = buf[2] & 0x3f;

   540             DPRINTF("Mode Sense (page %d, len %d)\n", page, len);

   541             p = outbuf;

   542             memset(p, 0, 4);

   543             outbuf[1] = 0; /* Default media type.  */

   544             outbuf[3] = 0; /* Block descriptor length.  */

   545             if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {

   546                 outbuf[2] = 0x80; /* Readonly.  */

   547             }

   548             p += 4;

   549             if (page == 4) {

   550                 int cylinders, heads, secs;

   551 

   552                 /* Rigid disk device geometry page. */

   553                 p[0] = 4;

   554                 p[1] = 0x16;

   555                 /* if a geometry hint is available, use it */

   556                 bdrv_get_geometry_hint(s->bdrv, &cylinders, &heads, &secs);

   557                 p[2] = (cylinders >> 16) & 0xff;

   558                 p[3] = (cylinders >> 8) & 0xff;

   559                 p[4] = cylinders & 0xff;

   560                 p[5] = heads & 0xff;

   561                 /* Write precomp start cylinder, disabled */

   562                 p[6] = (cylinders >> 16) & 0xff;

   563                 p[7] = (cylinders >> 8) & 0xff;

   564                 p[8] = cylinders & 0xff;

   565                 /* Reduced current start cylinder, disabled */

   566                 p[9] = (cylinders >> 16) & 0xff;

   567                 p[10] = (cylinders >> 8) & 0xff;

   568                 p[11] = cylinders & 0xff;

   569                 /* Device step rate [ns], 200ns */

   570                 p[12] = 0;

   571                 p[13] = 200;

   572                 /* Landing zone cylinder */

   573                 p[14] = 0xff;

   574                 p[15] =  0xff;

   575                 p[16] = 0xff;

   576                 /* Medium rotation rate [rpm], 5400 rpm */

   577                 p[20] = (5400 >> 8) & 0xff;

   578                 p[21] = 5400 & 0xff;

   579                 p += 0x16;

   580             } else if (page == 5) {

   581                 int cylinders, heads, secs;

   582 

   583                 /* Flexible disk device geometry page. */

   584                 p[0] = 5;

   585                 p[1] = 0x1e;

   586                 /* Transfer rate [kbit/s], 5Mbit/s */

   587                 p[2] = 5000 >> 8;

   588                 p[3] = 5000 & 0xff;

   589                 /* if a geometry hint is available, use it */

   590                 bdrv_get_geometry_hint(s->bdrv, &cylinders, &heads, &secs);

   591                 p[4] = heads & 0xff;

   592                 p[5] = secs & 0xff;

   593                 p[6] = s->cluster_size * 2;

   594                 p[8] = (cylinders >> 8) & 0xff;

   595                 p[9] = cylinders & 0xff;

   596                 /* Write precomp start cylinder, disabled */

   597                 p[10] = (cylinders >> 8) & 0xff;

   598                 p[11] = cylinders & 0xff;

   599                 /* Reduced current start cylinder, disabled */

   600                 p[12] = (cylinders >> 8) & 0xff;

   601                 p[13] = cylinders & 0xff;

   602                 /* Device step rate [100us], 100us */

   603                 p[14] = 0;

   604                 p[15] = 1;

   605                 /* Device step pulse width [us], 1us */

   606                 p[16] = 1;

   607                 /* Device head settle delay [100us], 100us */

   608                 p[17] = 0;

   609                 p[18] = 1;

   610                 /* Motor on delay [0.1s], 0.1s */

   611                 p[19] = 1;

   612                 /* Motor off delay [0.1s], 0.1s */

   613                 p[20] = 1;

   614                 /* Medium rotation rate [rpm], 5400 rpm */

   615                 p[28] = (5400 >> 8) & 0xff;

   616                 p[29] = 5400 & 0xff;

   617                 p += 0x1e;

   618             } else if ((page == 8 || page == 0x3f)) {

   619                 /* Caching page.  */

   620                 memset(p,0,20);

   621                 p[0] = 8;

   622                 p[1] = 0x12;

   623                 p[2] = 4; /* WCE */

   624                 p += 20;

   625             }

   626             if ((page == 0x3f || page == 0x2a)

   627                     && (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM)) {

   628                 /* CD Capabilities and Mechanical Status page. */

   629                 p[0] = 0x2a;

   630                 p[1] = 0x14;

   631                 p[2] = 3; // CD-R & CD-RW read

   632                 p[3] = 0; // Writing not supported

   633                 p[4] = 0x7f; /* Audio, composite, digital out,

   634                                          mode 2 form 1&2, multi session */

   635                 p[5] = 0xff; /* CD DA, DA accurate, RW supported,

   636                                          RW corrected, C2 errors, ISRC,

   637                                          UPC, Bar code */

   638                 p[6] = 0x2d | (bdrv_is_locked(s->bdrv)? 2 : 0);

   639                 /* Locking supported, jumper present, eject, tray */

   640                 p[7] = 0; /* no volume & mute control, no

   641                                       changer */

   642                 p[8] = (50 * 176) >> 8; // 50x read speed

   643                 p[9] = (50 * 176) & 0xff;

   644                 p[10] = 0 >> 8; // No volume

   645                 p[11] = 0 & 0xff;

   646                 p[12] = 2048 >> 8; // 2M buffer

   647                 p[13] = 2048 & 0xff;

   648                 p[14] = (16 * 176) >> 8; // 16x read speed current

   649                 p[15] = (16 * 176) & 0xff;

   650                 p[18] = (16 * 176) >> 8; // 16x write speed

   651                 p[19] = (16 * 176) & 0xff;

   652                 p[20] = (16 * 176) >> 8; // 16x write speed current

   653                 p[21] = (16 * 176) & 0xff;

   654                 p += 22;

   655             }

   656             r->buf_len = p - outbuf;

   657             outbuf[0] = r->buf_len - 4;

   658             if (r->buf_len > len)

   659                 r->buf_len = len;

   660         }

   661         break;

   662     case 0x1b:

   663         DPRINTF("Start Stop Unit\n");

   664 	break;

   665     case 0x1e:

   666         DPRINTF("Prevent Allow Medium Removal (prevent = %d)\n", buf[4] & 3);

   667         bdrv_set_locked(s->bdrv, buf[4] & 1);

   668 	break;

   669     case 0x25:

   670 	DPRINTF("Read Capacity\n");

   671         /* The normal LEN field for this command is zero.  */

   672 	memset(outbuf, 0, 8);

   673 	bdrv_get_geometry(s->bdrv, &nb_sectors);

   674         /* Returned value is the address of the last sector.  */

   675         if (nb_sectors) {

   676             nb_sectors--;

   677             outbuf[0] = (nb_sectors >> 24) & 0xff;

   678             outbuf[1] = (nb_sectors >> 16) & 0xff;

   679             outbuf[2] = (nb_sectors >> 8) & 0xff;

   680             outbuf[3] = nb_sectors & 0xff;

   681             outbuf[4] = 0;

   682             outbuf[5] = 0;

   683             outbuf[6] = s->cluster_size * 2;

   684             outbuf[7] = 0;

   685             r->buf_len = 8;

   686         } else {

   687             scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);

   688             return 0;

   689         }

   690 	break;

   691     case 0x08:

   692     case 0x28:

   693         DPRINTF("Read (sector %d, count %d)\n", lba, len);

   694         r->sector = lba * s->cluster_size;

   695         r->sector_count = len * s->cluster_size;

   696         break;

   697     case 0x0a:

   698     case 0x2a:

   699         DPRINTF("Write (sector %d, count %d)\n", lba, len);

   700         r->sector = lba * s->cluster_size;

   701         r->sector_count = len * s->cluster_size;

   702         is_write = 1;

   703         break;

   704     case 0x35:

   705         DPRINTF("Synchronise cache (sector %d, count %d)\n", lba, len);

   706         bdrv_flush(s->bdrv);

   707         break;

   708     case 0x43:

   709         {

   710             int start_track, format, msf, toclen;

   711 

   712             msf = buf[1] & 2;

   713             format = buf[2] & 0xf;

   714             start_track = buf[6];

   715             bdrv_get_geometry(s->bdrv, &nb_sectors);

   716             DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);

   717             switch(format) {

   718             case 0:

   719                 toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);

   720                 break;

   721             case 1:

   722                 /* multi session : only a single session defined */

   723                 toclen = 12;

   724                 memset(outbuf, 0, 12);

   725                 outbuf[1] = 0x0a;

   726                 outbuf[2] = 0x01;

   727                 outbuf[3] = 0x01;

   728                 break;

   729             case 2:

   730                 toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);

   731                 break;

   732             default:

   733                 goto error_cmd;

   734             }

   735             if (toclen > 0) {

   736                 if (len > toclen)

   737                   len = toclen;

   738                 r->buf_len = len;

   739                 break;

   740             }

   741         error_cmd:

   742             DPRINTF("Read TOC error\n");

   743             goto fail;

   744         }

   745     case 0x46:

   746         DPRINTF("Get Configuration (rt %d, maxlen %d)\n", buf[1] & 3, len);

   747         memset(outbuf, 0, 8);

   748         /* ??? This should probably return much more information.  For now

   749            just return the basic header indicating the CD-ROM profile.  */

   750         outbuf[7] = 8; // CD-ROM

   751         r->buf_len = 8;

   752         break;

   753     case 0x56:

   754         DPRINTF("Reserve(10)\n");

   755         if (buf[1] & 3)

   756             goto fail;

   757         break;

   758     case 0x57:

   759         DPRINTF("Release(10)\n");

   760         if (buf[1] & 3)

   761             goto fail;

   762         break;

   763     case 0xa0:

   764         DPRINTF("Report LUNs (len %d)\n", len);

   765         if (len < 16)

   766             goto fail;

   767         memset(outbuf, 0, 16);

   768         outbuf[3] = 8;

   769         r->buf_len = 16;

   770         break;

   771     case 0x2f:

   772         DPRINTF("Verify (sector %d, count %d)\n", lba, len);

   773         break;

   774     default:

   775 	DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);

   776     fail:

   777         scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_ILLEGAL_REQUEST);

   778 	return 0;

   779     }

   780     if (r->sector_count == 0 && r->buf_len == 0) {

   781         scsi_command_complete(r, STATUS_GOOD, SENSE_NO_SENSE);

   782     }

   783     len = r->sector_count * 512 + r->buf_len;

   784     if (is_write) {

   785         return -len;

   786     } else {

   787         if (!r->sector_count)

   788             r->sector_count = -1;

   789         return len;

   790     }

   791 }

   792 

   793 static void scsi_destroy(SCSIDevice *d)

   794 {

   795     qemu_free(d->state);

   796     qemu_free(d);

   797 }

   798 

   799 SCSIDevice *scsi_disk_init(BlockDriverState *bdrv, int tcq,

   800                            scsi_completionfn completion, void *opaque)

   801 {

   802     SCSIDevice *d;

   803     SCSIDeviceState *s;

   804 

   805     s = (SCSIDeviceState *)qemu_mallocz(sizeof(SCSIDeviceState));

   806     s->bdrv = bdrv;

   807     s->tcq = tcq;

   808     s->completion = completion;

   809     s->opaque = opaque;

   810     if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {

   811         s->cluster_size = 4;

   812     } else {

   813         s->cluster_size = 1;

   814     }

   815 

   816     d = (SCSIDevice *)qemu_mallocz(sizeof(SCSIDevice));

   817     d->state = s;

   818     d->destroy = scsi_destroy;

   819     d->send_command = scsi_send_command;

   820     d->read_data = scsi_read_data;

   821     d->write_data = scsi_write_data;

   822     d->cancel_io = scsi_cancel_io;

   823     d->get_buf = scsi_get_buf;

   824 

   825     return d;

   826 }