Statistics
| Branch: | Revision:

root / hw / scsi-disk.c @ 4d5b97da

History | View | Annotate | Download (73.9 kB)

1
/*
2
 * SCSI Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Based on code by Fabrice Bellard
6
 *
7
 * Written by Paul Brook
8
 * Modifications:
9
 *  2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10
 *                                 when the allocation length of CDB is smaller
11
 *                                 than 36.
12
 *  2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13
 *                                 MODE SENSE response.
14
 *
15
 * This code is licensed under the LGPL.
16
 *
17
 * Note that this file only handles the SCSI architecture model and device
18
 * commands.  Emulation of interface/link layer protocols is handled by
19
 * the host adapter emulator.
20
 */
21

    
22
//#define DEBUG_SCSI
23

    
24
#ifdef DEBUG_SCSI
25
#define DPRINTF(fmt, ...) \
26
do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
27
#else
28
#define DPRINTF(fmt, ...) do {} while(0)
29
#endif
30

    
31
#include "qemu-common.h"
32
#include "qemu-error.h"
33
#include "scsi.h"
34
#include "scsi-defs.h"
35
#include "sysemu.h"
36
#include "blockdev.h"
37
#include "hw/block-common.h"
38
#include "dma.h"
39

    
40
#ifdef __linux
41
#include <scsi/sg.h>
42
#endif
43

    
44
#define SCSI_DMA_BUF_SIZE    131072
45
#define SCSI_MAX_INQUIRY_LEN 256
46
#define SCSI_MAX_MODE_LEN    256
47

    
48
typedef struct SCSIDiskState SCSIDiskState;
49

    
50
typedef struct SCSIDiskReq {
51
    SCSIRequest req;
52
    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
53
    uint64_t sector;
54
    uint32_t sector_count;
55
    uint32_t buflen;
56
    bool started;
57
    struct iovec iov;
58
    QEMUIOVector qiov;
59
    BlockAcctCookie acct;
60
} SCSIDiskReq;
61

    
62
#define SCSI_DISK_F_REMOVABLE   0
63
#define SCSI_DISK_F_DPOFUA      1
64

    
65
struct SCSIDiskState
66
{
67
    SCSIDevice qdev;
68
    uint32_t features;
69
    bool media_changed;
70
    bool media_event;
71
    bool eject_request;
72
    uint64_t wwn;
73
    QEMUBH *bh;
74
    char *version;
75
    char *serial;
76
    char *vendor;
77
    char *product;
78
    bool tray_open;
79
    bool tray_locked;
80
};
81

    
82
static int scsi_handle_rw_error(SCSIDiskReq *r, int error);
83

    
84
static void scsi_free_request(SCSIRequest *req)
85
{
86
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
87

    
88
    if (r->iov.iov_base) {
89
        qemu_vfree(r->iov.iov_base);
90
    }
91
}
92

    
93
/* Helper function for command completion with sense.  */
94
static void scsi_check_condition(SCSIDiskReq *r, SCSISense sense)
95
{
96
    DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
97
            r->req.tag, sense.key, sense.asc, sense.ascq);
98
    scsi_req_build_sense(&r->req, sense);
99
    scsi_req_complete(&r->req, CHECK_CONDITION);
100
}
101

    
102
/* Cancel a pending data transfer.  */
103
static void scsi_cancel_io(SCSIRequest *req)
104
{
105
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
106

    
107
    DPRINTF("Cancel tag=0x%x\n", req->tag);
108
    if (r->req.aiocb) {
109
        bdrv_aio_cancel(r->req.aiocb);
110

    
111
        /* This reference was left in by scsi_*_data.  We take ownership of
112
         * it the moment scsi_req_cancel is called, independent of whether
113
         * bdrv_aio_cancel completes the request or not.  */
114
        scsi_req_unref(&r->req);
115
    }
116
    r->req.aiocb = NULL;
117
}
118

    
119
static uint32_t scsi_init_iovec(SCSIDiskReq *r, size_t size)
120
{
121
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
122

    
123
    if (!r->iov.iov_base) {
124
        r->buflen = size;
125
        r->iov.iov_base = qemu_blockalign(s->qdev.conf.bs, r->buflen);
126
    }
127
    r->iov.iov_len = MIN(r->sector_count * 512, r->buflen);
128
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
129
    return r->qiov.size / 512;
130
}
131

    
132
static void scsi_disk_save_request(QEMUFile *f, SCSIRequest *req)
133
{
134
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
135

    
136
    qemu_put_be64s(f, &r->sector);
137
    qemu_put_be32s(f, &r->sector_count);
138
    qemu_put_be32s(f, &r->buflen);
139
    if (r->buflen) {
140
        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
141
            qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
142
        } else if (!req->retry) {
143
            uint32_t len = r->iov.iov_len;
144
            qemu_put_be32s(f, &len);
145
            qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
146
        }
147
    }
148
}
149

    
150
static void scsi_disk_load_request(QEMUFile *f, SCSIRequest *req)
151
{
152
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
153

    
154
    qemu_get_be64s(f, &r->sector);
155
    qemu_get_be32s(f, &r->sector_count);
156
    qemu_get_be32s(f, &r->buflen);
157
    if (r->buflen) {
158
        scsi_init_iovec(r, r->buflen);
159
        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
160
            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
161
        } else if (!r->req.retry) {
162
            uint32_t len;
163
            qemu_get_be32s(f, &len);
164
            r->iov.iov_len = len;
165
            assert(r->iov.iov_len <= r->buflen);
166
            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
167
        }
168
    }
169

    
170
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
171
}
172

    
173
static void scsi_aio_complete(void *opaque, int ret)
174
{
175
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
176
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
177

    
178
    assert(r->req.aiocb != NULL);
179
    r->req.aiocb = NULL;
180
    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
181

    
182
    if (ret < 0) {
183
        if (scsi_handle_rw_error(r, -ret)) {
184
            goto done;
185
        }
186
    }
187

    
188
    scsi_req_complete(&r->req, GOOD);
189

    
190
done:
191
    if (!r->req.io_canceled) {
192
        scsi_req_unref(&r->req);
193
    }
194
}
195

    
196
static bool scsi_is_cmd_fua(SCSICommand *cmd)
197
{
198
    switch (cmd->buf[0]) {
199
    case READ_10:
200
    case READ_12:
201
    case READ_16:
202
    case WRITE_10:
203
    case WRITE_12:
204
    case WRITE_16:
205
        return (cmd->buf[1] & 8) != 0;
206

    
207
    case VERIFY_10:
208
    case VERIFY_12:
209
    case VERIFY_16:
210
    case WRITE_VERIFY_10:
211
    case WRITE_VERIFY_12:
212
    case WRITE_VERIFY_16:
213
        return true;
214

    
215
    case READ_6:
216
    case WRITE_6:
217
    default:
218
        return false;
219
    }
220
}
221

    
222
static void scsi_write_do_fua(SCSIDiskReq *r)
223
{
224
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
225

    
226
    if (scsi_is_cmd_fua(&r->req.cmd)) {
227
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
228
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_aio_complete, r);
229
        return;
230
    }
231

    
232
    scsi_req_complete(&r->req, GOOD);
233
    if (!r->req.io_canceled) {
234
        scsi_req_unref(&r->req);
235
    }
236
}
237

    
238
static void scsi_dma_complete(void *opaque, int ret)
239
{
240
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
241
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
242

    
243
    assert(r->req.aiocb != NULL);
244
    r->req.aiocb = NULL;
245
    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
246

    
247
    if (ret < 0) {
248
        if (scsi_handle_rw_error(r, -ret)) {
249
            goto done;
250
        }
251
    }
252

    
253
    r->sector += r->sector_count;
254
    r->sector_count = 0;
255
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
256
        scsi_write_do_fua(r);
257
        return;
258
    } else {
259
        scsi_req_complete(&r->req, GOOD);
260
    }
261

    
262
done:
263
    if (!r->req.io_canceled) {
264
        scsi_req_unref(&r->req);
265
    }
266
}
267

    
268
static void scsi_read_complete(void * opaque, int ret)
269
{
270
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
271
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
272
    int n;
273

    
274
    assert(r->req.aiocb != NULL);
275
    r->req.aiocb = NULL;
276
    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
277

    
278
    if (ret < 0) {
279
        if (scsi_handle_rw_error(r, -ret)) {
280
            goto done;
281
        }
282
    }
283

    
284
    DPRINTF("Data ready tag=0x%x len=%zd\n", r->req.tag, r->qiov.size);
285

    
286
    n = r->qiov.size / 512;
287
    r->sector += n;
288
    r->sector_count -= n;
289
    scsi_req_data(&r->req, r->qiov.size);
290

    
291
done:
292
    if (!r->req.io_canceled) {
293
        scsi_req_unref(&r->req);
294
    }
295
}
296

    
297
/* Actually issue a read to the block device.  */
298
static void scsi_do_read(void *opaque, int ret)
299
{
300
    SCSIDiskReq *r = opaque;
301
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
302
    uint32_t n;
303

    
304
    if (r->req.aiocb != NULL) {
305
        r->req.aiocb = NULL;
306
        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
307
    }
308

    
309
    if (ret < 0) {
310
        if (scsi_handle_rw_error(r, -ret)) {
311
            goto done;
312
        }
313
    }
314

    
315
    if (r->req.io_canceled) {
316
        return;
317
    }
318

    
319
    /* The request is used as the AIO opaque value, so add a ref.  */
320
    scsi_req_ref(&r->req);
321

    
322
    if (r->req.sg) {
323
        dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ);
324
        r->req.resid -= r->req.sg->size;
325
        r->req.aiocb = dma_bdrv_read(s->qdev.conf.bs, r->req.sg, r->sector,
326
                                     scsi_dma_complete, r);
327
    } else {
328
        n = scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
329
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
330
        r->req.aiocb = bdrv_aio_readv(s->qdev.conf.bs, r->sector, &r->qiov, n,
331
                                      scsi_read_complete, r);
332
    }
333

    
334
done:
335
    if (!r->req.io_canceled) {
336
        scsi_req_unref(&r->req);
337
    }
338
}
339

    
340
/* Read more data from scsi device into buffer.  */
341
static void scsi_read_data(SCSIRequest *req)
342
{
343
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
344
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
345
    bool first;
346

    
347
    DPRINTF("Read sector_count=%d\n", r->sector_count);
348
    if (r->sector_count == 0) {
349
        /* This also clears the sense buffer for REQUEST SENSE.  */
350
        scsi_req_complete(&r->req, GOOD);
351
        return;
352
    }
353

    
354
    /* No data transfer may already be in progress */
355
    assert(r->req.aiocb == NULL);
356

    
357
    /* The request is used as the AIO opaque value, so add a ref.  */
358
    scsi_req_ref(&r->req);
359
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
360
        DPRINTF("Data transfer direction invalid\n");
361
        scsi_read_complete(r, -EINVAL);
362
        return;
363
    }
364

    
365
    if (s->tray_open) {
366
        scsi_read_complete(r, -ENOMEDIUM);
367
        return;
368
    }
369

    
370
    first = !r->started;
371
    r->started = true;
372
    if (first && scsi_is_cmd_fua(&r->req.cmd)) {
373
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
374
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_do_read, r);
375
    } else {
376
        scsi_do_read(r, 0);
377
    }
378
}
379

    
380
/*
381
 * scsi_handle_rw_error has two return values.  0 means that the error
382
 * must be ignored, 1 means that the error has been processed and the
383
 * caller should not do anything else for this request.  Note that
384
 * scsi_handle_rw_error always manages its reference counts, independent
385
 * of the return value.
386
 */
387
static int scsi_handle_rw_error(SCSIDiskReq *r, int error)
388
{
389
    bool is_read = (r->req.cmd.xfer == SCSI_XFER_FROM_DEV);
390
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
391
    BlockErrorAction action = bdrv_get_error_action(s->qdev.conf.bs, is_read, error);
392

    
393
    if (action == BDRV_ACTION_REPORT) {
394
        switch (error) {
395
        case ENOMEDIUM:
396
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
397
            break;
398
        case ENOMEM:
399
            scsi_check_condition(r, SENSE_CODE(TARGET_FAILURE));
400
            break;
401
        case EINVAL:
402
            scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
403
            break;
404
        default:
405
            scsi_check_condition(r, SENSE_CODE(IO_ERROR));
406
            break;
407
        }
408
    }
409
    bdrv_error_action(s->qdev.conf.bs, action, is_read, error);
410
    if (action == BDRV_ACTION_STOP) {
411
        scsi_req_retry(&r->req);
412
    }
413
    return action != BDRV_ACTION_IGNORE;
414
}
415

    
416
static void scsi_write_complete(void * opaque, int ret)
417
{
418
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
419
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
420
    uint32_t n;
421

    
422
    if (r->req.aiocb != NULL) {
423
        r->req.aiocb = NULL;
424
        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
425
    }
426

    
427
    if (ret < 0) {
428
        if (scsi_handle_rw_error(r, -ret)) {
429
            goto done;
430
        }
431
    }
432

    
433
    n = r->qiov.size / 512;
434
    r->sector += n;
435
    r->sector_count -= n;
436
    if (r->sector_count == 0) {
437
        scsi_write_do_fua(r);
438
        return;
439
    } else {
440
        scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
441
        DPRINTF("Write complete tag=0x%x more=%zd\n", r->req.tag, r->qiov.size);
442
        scsi_req_data(&r->req, r->qiov.size);
443
    }
444

    
445
done:
446
    if (!r->req.io_canceled) {
447
        scsi_req_unref(&r->req);
448
    }
449
}
450

    
451
static void scsi_write_data(SCSIRequest *req)
452
{
453
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
454
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
455
    uint32_t n;
456

    
457
    /* No data transfer may already be in progress */
458
    assert(r->req.aiocb == NULL);
459

    
460
    /* The request is used as the AIO opaque value, so add a ref.  */
461
    scsi_req_ref(&r->req);
462
    if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {
463
        DPRINTF("Data transfer direction invalid\n");
464
        scsi_write_complete(r, -EINVAL);
465
        return;
466
    }
467

    
468
    if (!r->req.sg && !r->qiov.size) {
469
        /* Called for the first time.  Ask the driver to send us more data.  */
470
        r->started = true;
471
        scsi_write_complete(r, 0);
472
        return;
473
    }
474
    if (s->tray_open) {
475
        scsi_write_complete(r, -ENOMEDIUM);
476
        return;
477
    }
478

    
479
    if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
480
        r->req.cmd.buf[0] == VERIFY_16) {
481
        if (r->req.sg) {
482
            scsi_dma_complete(r, 0);
483
        } else {
484
            scsi_write_complete(r, 0);
485
        }
486
        return;
487
    }
488

    
489
    if (r->req.sg) {
490
        dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_WRITE);
491
        r->req.resid -= r->req.sg->size;
492
        r->req.aiocb = dma_bdrv_write(s->qdev.conf.bs, r->req.sg, r->sector,
493
                                      scsi_dma_complete, r);
494
    } else {
495
        n = r->qiov.size / 512;
496
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_WRITE);
497
        r->req.aiocb = bdrv_aio_writev(s->qdev.conf.bs, r->sector, &r->qiov, n,
498
                                       scsi_write_complete, r);
499
    }
500
}
501

    
502
/* Return a pointer to the data buffer.  */
503
static uint8_t *scsi_get_buf(SCSIRequest *req)
504
{
505
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
506

    
507
    return (uint8_t *)r->iov.iov_base;
508
}
509

    
510
static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
511
{
512
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
513
    int buflen = 0;
514
    int start;
515

    
516
    if (req->cmd.buf[1] & 0x1) {
517
        /* Vital product data */
518
        uint8_t page_code = req->cmd.buf[2];
519

    
520
        outbuf[buflen++] = s->qdev.type & 0x1f;
521
        outbuf[buflen++] = page_code ; // this page
522
        outbuf[buflen++] = 0x00;
523
        outbuf[buflen++] = 0x00;
524
        start = buflen;
525

    
526
        switch (page_code) {
527
        case 0x00: /* Supported page codes, mandatory */
528
        {
529
            DPRINTF("Inquiry EVPD[Supported pages] "
530
                    "buffer size %zd\n", req->cmd.xfer);
531
            outbuf[buflen++] = 0x00; // list of supported pages (this page)
532
            if (s->serial) {
533
                outbuf[buflen++] = 0x80; // unit serial number
534
            }
535
            outbuf[buflen++] = 0x83; // device identification
536
            if (s->qdev.type == TYPE_DISK) {
537
                outbuf[buflen++] = 0xb0; // block limits
538
                outbuf[buflen++] = 0xb2; // thin provisioning
539
            }
540
            break;
541
        }
542
        case 0x80: /* Device serial number, optional */
543
        {
544
            int l;
545

    
546
            if (!s->serial) {
547
                DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
548
                return -1;
549
            }
550

    
551
            l = strlen(s->serial);
552
            if (l > 20) {
553
                l = 20;
554
            }
555

    
556
            DPRINTF("Inquiry EVPD[Serial number] "
557
                    "buffer size %zd\n", req->cmd.xfer);
558
            memcpy(outbuf+buflen, s->serial, l);
559
            buflen += l;
560
            break;
561
        }
562

    
563
        case 0x83: /* Device identification page, mandatory */
564
        {
565
            const char *str = s->serial ?: bdrv_get_device_name(s->qdev.conf.bs);
566
            int max_len = s->serial ? 20 : 255 - 8;
567
            int id_len = strlen(str);
568

    
569
            if (id_len > max_len) {
570
                id_len = max_len;
571
            }
572
            DPRINTF("Inquiry EVPD[Device identification] "
573
                    "buffer size %zd\n", req->cmd.xfer);
574

    
575
            outbuf[buflen++] = 0x2; // ASCII
576
            outbuf[buflen++] = 0;   // not officially assigned
577
            outbuf[buflen++] = 0;   // reserved
578
            outbuf[buflen++] = id_len; // length of data following
579
            memcpy(outbuf+buflen, str, id_len);
580
            buflen += id_len;
581

    
582
            if (s->wwn) {
583
                outbuf[buflen++] = 0x1; // Binary
584
                outbuf[buflen++] = 0x3; // NAA
585
                outbuf[buflen++] = 0;   // reserved
586
                outbuf[buflen++] = 8;
587
                stq_be_p(&outbuf[buflen], s->wwn);
588
                buflen += 8;
589
            }
590
            break;
591
        }
592
        case 0xb0: /* block limits */
593
        {
594
            unsigned int unmap_sectors =
595
                    s->qdev.conf.discard_granularity / s->qdev.blocksize;
596
            unsigned int min_io_size =
597
                    s->qdev.conf.min_io_size / s->qdev.blocksize;
598
            unsigned int opt_io_size =
599
                    s->qdev.conf.opt_io_size / s->qdev.blocksize;
600

    
601
            if (s->qdev.type == TYPE_ROM) {
602
                DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
603
                        page_code);
604
                return -1;
605
            }
606
            /* required VPD size with unmap support */
607
            buflen = 0x40;
608
            memset(outbuf + 4, 0, buflen - 4);
609

    
610
            /* optimal transfer length granularity */
611
            outbuf[6] = (min_io_size >> 8) & 0xff;
612
            outbuf[7] = min_io_size & 0xff;
613

    
614
            /* optimal transfer length */
615
            outbuf[12] = (opt_io_size >> 24) & 0xff;
616
            outbuf[13] = (opt_io_size >> 16) & 0xff;
617
            outbuf[14] = (opt_io_size >> 8) & 0xff;
618
            outbuf[15] = opt_io_size & 0xff;
619

    
620
            /* optimal unmap granularity */
621
            outbuf[28] = (unmap_sectors >> 24) & 0xff;
622
            outbuf[29] = (unmap_sectors >> 16) & 0xff;
623
            outbuf[30] = (unmap_sectors >> 8) & 0xff;
624
            outbuf[31] = unmap_sectors & 0xff;
625
            break;
626
        }
627
        case 0xb2: /* thin provisioning */
628
        {
629
            buflen = 8;
630
            outbuf[4] = 0;
631
            outbuf[5] = 0xe0; /* unmap & write_same 10/16 all supported */
632
            outbuf[6] = s->qdev.conf.discard_granularity ? 2 : 1;
633
            outbuf[7] = 0;
634
            break;
635
        }
636
        default:
637
            return -1;
638
        }
639
        /* done with EVPD */
640
        assert(buflen - start <= 255);
641
        outbuf[start - 1] = buflen - start;
642
        return buflen;
643
    }
644

    
645
    /* Standard INQUIRY data */
646
    if (req->cmd.buf[2] != 0) {
647
        return -1;
648
    }
649

    
650
    /* PAGE CODE == 0 */
651
    buflen = req->cmd.xfer;
652
    if (buflen > SCSI_MAX_INQUIRY_LEN) {
653
        buflen = SCSI_MAX_INQUIRY_LEN;
654
    }
655
    memset(outbuf, 0, buflen);
656

    
657
    outbuf[0] = s->qdev.type & 0x1f;
658
    outbuf[1] = (s->features & (1 << SCSI_DISK_F_REMOVABLE)) ? 0x80 : 0;
659

    
660
    strpadcpy((char *) &outbuf[16], 16, s->product, ' ');
661
    strpadcpy((char *) &outbuf[8], 8, s->vendor, ' ');
662

    
663
    memset(&outbuf[32], 0, 4);
664
    memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version)));
665
    /*
666
     * We claim conformance to SPC-3, which is required for guests
667
     * to ask for modern features like READ CAPACITY(16) or the
668
     * block characteristics VPD page by default.  Not all of SPC-3
669
     * is actually implemented, but we're good enough.
670
     */
671
    outbuf[2] = 5;
672
    outbuf[3] = 2 | 0x10; /* Format 2, HiSup */
673

    
674
    if (buflen > 36) {
675
        outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
676
    } else {
677
        /* If the allocation length of CDB is too small,
678
               the additional length is not adjusted */
679
        outbuf[4] = 36 - 5;
680
    }
681

    
682
    /* Sync data transfer and TCQ.  */
683
    outbuf[7] = 0x10 | (req->bus->info->tcq ? 0x02 : 0);
684
    return buflen;
685
}
686

    
687
static inline bool media_is_dvd(SCSIDiskState *s)
688
{
689
    uint64_t nb_sectors;
690
    if (s->qdev.type != TYPE_ROM) {
691
        return false;
692
    }
693
    if (!bdrv_is_inserted(s->qdev.conf.bs)) {
694
        return false;
695
    }
696
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
697
    return nb_sectors > CD_MAX_SECTORS;
698
}
699

    
700
static inline bool media_is_cd(SCSIDiskState *s)
701
{
702
    uint64_t nb_sectors;
703
    if (s->qdev.type != TYPE_ROM) {
704
        return false;
705
    }
706
    if (!bdrv_is_inserted(s->qdev.conf.bs)) {
707
        return false;
708
    }
709
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
710
    return nb_sectors <= CD_MAX_SECTORS;
711
}
712

    
713
static int scsi_read_disc_information(SCSIDiskState *s, SCSIDiskReq *r,
714
                                      uint8_t *outbuf)
715
{
716
    uint8_t type = r->req.cmd.buf[1] & 7;
717

    
718
    if (s->qdev.type != TYPE_ROM) {
719
        return -1;
720
    }
721

    
722
    /* Types 1/2 are only defined for Blu-Ray.  */
723
    if (type != 0) {
724
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
725
        return -1;
726
    }
727

    
728
    memset(outbuf, 0, 34);
729
    outbuf[1] = 32;
730
    outbuf[2] = 0xe; /* last session complete, disc finalized */
731
    outbuf[3] = 1;   /* first track on disc */
732
    outbuf[4] = 1;   /* # of sessions */
733
    outbuf[5] = 1;   /* first track of last session */
734
    outbuf[6] = 1;   /* last track of last session */
735
    outbuf[7] = 0x20; /* unrestricted use */
736
    outbuf[8] = 0x00; /* CD-ROM or DVD-ROM */
737
    /* 9-10-11: most significant byte corresponding bytes 4-5-6 */
738
    /* 12-23: not meaningful for CD-ROM or DVD-ROM */
739
    /* 24-31: disc bar code */
740
    /* 32: disc application code */
741
    /* 33: number of OPC tables */
742

    
743
    return 34;
744
}
745

    
746
static int scsi_read_dvd_structure(SCSIDiskState *s, SCSIDiskReq *r,
747
                                   uint8_t *outbuf)
748
{
749
    static const int rds_caps_size[5] = {
750
        [0] = 2048 + 4,
751
        [1] = 4 + 4,
752
        [3] = 188 + 4,
753
        [4] = 2048 + 4,
754
    };
755

    
756
    uint8_t media = r->req.cmd.buf[1];
757
    uint8_t layer = r->req.cmd.buf[6];
758
    uint8_t format = r->req.cmd.buf[7];
759
    int size = -1;
760

    
761
    if (s->qdev.type != TYPE_ROM) {
762
        return -1;
763
    }
764
    if (media != 0) {
765
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
766
        return -1;
767
    }
768

    
769
    if (format != 0xff) {
770
        if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {
771
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
772
            return -1;
773
        }
774
        if (media_is_cd(s)) {
775
            scsi_check_condition(r, SENSE_CODE(INCOMPATIBLE_FORMAT));
776
            return -1;
777
        }
778
        if (format >= ARRAY_SIZE(rds_caps_size)) {
779
            return -1;
780
        }
781
        size = rds_caps_size[format];
782
        memset(outbuf, 0, size);
783
    }
784

    
785
    switch (format) {
786
    case 0x00: {
787
        /* Physical format information */
788
        uint64_t nb_sectors;
789
        if (layer != 0) {
790
            goto fail;
791
        }
792
        bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
793

    
794
        outbuf[4] = 1;   /* DVD-ROM, part version 1 */
795
        outbuf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
796
        outbuf[6] = 1;   /* one layer, read-only (per MMC-2 spec) */
797
        outbuf[7] = 0;   /* default densities */
798

    
799
        stl_be_p(&outbuf[12], (nb_sectors >> 2) - 1); /* end sector */
800
        stl_be_p(&outbuf[16], (nb_sectors >> 2) - 1); /* l0 end sector */
801
        break;
802
    }
803

    
804
    case 0x01: /* DVD copyright information, all zeros */
805
        break;
806

    
807
    case 0x03: /* BCA information - invalid field for no BCA info */
808
        return -1;
809

    
810
    case 0x04: /* DVD disc manufacturing information, all zeros */
811
        break;
812

    
813
    case 0xff: { /* List capabilities */
814
        int i;
815
        size = 4;
816
        for (i = 0; i < ARRAY_SIZE(rds_caps_size); i++) {
817
            if (!rds_caps_size[i]) {
818
                continue;
819
            }
820
            outbuf[size] = i;
821
            outbuf[size + 1] = 0x40; /* Not writable, readable */
822
            stw_be_p(&outbuf[size + 2], rds_caps_size[i]);
823
            size += 4;
824
        }
825
        break;
826
     }
827

    
828
    default:
829
        return -1;
830
    }
831

    
832
    /* Size of buffer, not including 2 byte size field */
833
    stw_be_p(outbuf, size - 2);
834
    return size;
835

    
836
fail:
837
    return -1;
838
}
839

    
840
static int scsi_event_status_media(SCSIDiskState *s, uint8_t *outbuf)
841
{
842
    uint8_t event_code, media_status;
843

    
844
    media_status = 0;
845
    if (s->tray_open) {
846
        media_status = MS_TRAY_OPEN;
847
    } else if (bdrv_is_inserted(s->qdev.conf.bs)) {
848
        media_status = MS_MEDIA_PRESENT;
849
    }
850

    
851
    /* Event notification descriptor */
852
    event_code = MEC_NO_CHANGE;
853
    if (media_status != MS_TRAY_OPEN) {
854
        if (s->media_event) {
855
            event_code = MEC_NEW_MEDIA;
856
            s->media_event = false;
857
        } else if (s->eject_request) {
858
            event_code = MEC_EJECT_REQUESTED;
859
            s->eject_request = false;
860
        }
861
    }
862

    
863
    outbuf[0] = event_code;
864
    outbuf[1] = media_status;
865

    
866
    /* These fields are reserved, just clear them. */
867
    outbuf[2] = 0;
868
    outbuf[3] = 0;
869
    return 4;
870
}
871

    
872
static int scsi_get_event_status_notification(SCSIDiskState *s, SCSIDiskReq *r,
873
                                              uint8_t *outbuf)
874
{
875
    int size;
876
    uint8_t *buf = r->req.cmd.buf;
877
    uint8_t notification_class_request = buf[4];
878
    if (s->qdev.type != TYPE_ROM) {
879
        return -1;
880
    }
881
    if ((buf[1] & 1) == 0) {
882
        /* asynchronous */
883
        return -1;
884
    }
885

    
886
    size = 4;
887
    outbuf[0] = outbuf[1] = 0;
888
    outbuf[3] = 1 << GESN_MEDIA; /* supported events */
889
    if (notification_class_request & (1 << GESN_MEDIA)) {
890
        outbuf[2] = GESN_MEDIA;
891
        size += scsi_event_status_media(s, &outbuf[size]);
892
    } else {
893
        outbuf[2] = 0x80;
894
    }
895
    stw_be_p(outbuf, size - 4);
896
    return size;
897
}
898

    
899
static int scsi_get_configuration(SCSIDiskState *s, uint8_t *outbuf)
900
{
901
    int current;
902

    
903
    if (s->qdev.type != TYPE_ROM) {
904
        return -1;
905
    }
906
    current = media_is_dvd(s) ? MMC_PROFILE_DVD_ROM : MMC_PROFILE_CD_ROM;
907
    memset(outbuf, 0, 40);
908
    stl_be_p(&outbuf[0], 36); /* Bytes after the data length field */
909
    stw_be_p(&outbuf[6], current);
910
    /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
911
    outbuf[10] = 0x03; /* persistent, current */
912
    outbuf[11] = 8; /* two profiles */
913
    stw_be_p(&outbuf[12], MMC_PROFILE_DVD_ROM);
914
    outbuf[14] = (current == MMC_PROFILE_DVD_ROM);
915
    stw_be_p(&outbuf[16], MMC_PROFILE_CD_ROM);
916
    outbuf[18] = (current == MMC_PROFILE_CD_ROM);
917
    /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
918
    stw_be_p(&outbuf[20], 1);
919
    outbuf[22] = 0x08 | 0x03; /* version 2, persistent, current */
920
    outbuf[23] = 8;
921
    stl_be_p(&outbuf[24], 1); /* SCSI */
922
    outbuf[28] = 1; /* DBE = 1, mandatory */
923
    /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
924
    stw_be_p(&outbuf[32], 3);
925
    outbuf[34] = 0x08 | 0x03; /* version 2, persistent, current */
926
    outbuf[35] = 4;
927
    outbuf[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
928
    /* TODO: Random readable, CD read, DVD read, drive serial number,
929
       power management */
930
    return 40;
931
}
932

    
933
static int scsi_emulate_mechanism_status(SCSIDiskState *s, uint8_t *outbuf)
934
{
935
    if (s->qdev.type != TYPE_ROM) {
936
        return -1;
937
    }
938
    memset(outbuf, 0, 8);
939
    outbuf[5] = 1; /* CD-ROM */
940
    return 8;
941
}
942

    
943
static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
944
                           int page_control)
945
{
946
    static const int mode_sense_valid[0x3f] = {
947
        [MODE_PAGE_HD_GEOMETRY]            = (1 << TYPE_DISK),
948
        [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY] = (1 << TYPE_DISK),
949
        [MODE_PAGE_CACHING]                = (1 << TYPE_DISK) | (1 << TYPE_ROM),
950
        [MODE_PAGE_R_W_ERROR]              = (1 << TYPE_DISK) | (1 << TYPE_ROM),
951
        [MODE_PAGE_AUDIO_CTL]              = (1 << TYPE_ROM),
952
        [MODE_PAGE_CAPABILITIES]           = (1 << TYPE_ROM),
953
    };
954

    
955
    uint8_t *p = *p_outbuf + 2;
956
    int length;
957

    
958
    if ((mode_sense_valid[page] & (1 << s->qdev.type)) == 0) {
959
        return -1;
960
    }
961

    
962
    /*
963
     * If Changeable Values are requested, a mask denoting those mode parameters
964
     * that are changeable shall be returned. As we currently don't support
965
     * parameter changes via MODE_SELECT all bits are returned set to zero.
966
     * The buffer was already menset to zero by the caller of this function.
967
     *
968
     * The offsets here are off by two compared to the descriptions in the
969
     * SCSI specs, because those include a 2-byte header.  This is unfortunate,
970
     * but it is done so that offsets are consistent within our implementation
971
     * of MODE SENSE and MODE SELECT.  MODE SELECT has to deal with both
972
     * 2-byte and 4-byte headers.
973
     */
974
    switch (page) {
975
    case MODE_PAGE_HD_GEOMETRY:
976
        length = 0x16;
977
        if (page_control == 1) { /* Changeable Values */
978
            break;
979
        }
980
        /* if a geometry hint is available, use it */
981
        p[0] = (s->qdev.conf.cyls >> 16) & 0xff;
982
        p[1] = (s->qdev.conf.cyls >> 8) & 0xff;
983
        p[2] = s->qdev.conf.cyls & 0xff;
984
        p[3] = s->qdev.conf.heads & 0xff;
985
        /* Write precomp start cylinder, disabled */
986
        p[4] = (s->qdev.conf.cyls >> 16) & 0xff;
987
        p[5] = (s->qdev.conf.cyls >> 8) & 0xff;
988
        p[6] = s->qdev.conf.cyls & 0xff;
989
        /* Reduced current start cylinder, disabled */
990
        p[7] = (s->qdev.conf.cyls >> 16) & 0xff;
991
        p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
992
        p[9] = s->qdev.conf.cyls & 0xff;
993
        /* Device step rate [ns], 200ns */
994
        p[10] = 0;
995
        p[11] = 200;
996
        /* Landing zone cylinder */
997
        p[12] = 0xff;
998
        p[13] =  0xff;
999
        p[14] = 0xff;
1000
        /* Medium rotation rate [rpm], 5400 rpm */
1001
        p[18] = (5400 >> 8) & 0xff;
1002
        p[19] = 5400 & 0xff;
1003
        break;
1004

    
1005
    case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY:
1006
        length = 0x1e;
1007
        if (page_control == 1) { /* Changeable Values */
1008
            break;
1009
        }
1010
        /* Transfer rate [kbit/s], 5Mbit/s */
1011
        p[0] = 5000 >> 8;
1012
        p[1] = 5000 & 0xff;
1013
        /* if a geometry hint is available, use it */
1014
        p[2] = s->qdev.conf.heads & 0xff;
1015
        p[3] = s->qdev.conf.secs & 0xff;
1016
        p[4] = s->qdev.blocksize >> 8;
1017
        p[6] = (s->qdev.conf.cyls >> 8) & 0xff;
1018
        p[7] = s->qdev.conf.cyls & 0xff;
1019
        /* Write precomp start cylinder, disabled */
1020
        p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
1021
        p[9] = s->qdev.conf.cyls & 0xff;
1022
        /* Reduced current start cylinder, disabled */
1023
        p[10] = (s->qdev.conf.cyls >> 8) & 0xff;
1024
        p[11] = s->qdev.conf.cyls & 0xff;
1025
        /* Device step rate [100us], 100us */
1026
        p[12] = 0;
1027
        p[13] = 1;
1028
        /* Device step pulse width [us], 1us */
1029
        p[14] = 1;
1030
        /* Device head settle delay [100us], 100us */
1031
        p[15] = 0;
1032
        p[16] = 1;
1033
        /* Motor on delay [0.1s], 0.1s */
1034
        p[17] = 1;
1035
        /* Motor off delay [0.1s], 0.1s */
1036
        p[18] = 1;
1037
        /* Medium rotation rate [rpm], 5400 rpm */
1038
        p[26] = (5400 >> 8) & 0xff;
1039
        p[27] = 5400 & 0xff;
1040
        break;
1041

    
1042
    case MODE_PAGE_CACHING:
1043
        length = 0x12;
1044
        if (page_control == 1 || /* Changeable Values */
1045
            bdrv_enable_write_cache(s->qdev.conf.bs)) {
1046
            p[0] = 4; /* WCE */
1047
        }
1048
        break;
1049

    
1050
    case MODE_PAGE_R_W_ERROR:
1051
        length = 10;
1052
        if (page_control == 1) { /* Changeable Values */
1053
            break;
1054
        }
1055
        p[0] = 0x80; /* Automatic Write Reallocation Enabled */
1056
        if (s->qdev.type == TYPE_ROM) {
1057
            p[1] = 0x20; /* Read Retry Count */
1058
        }
1059
        break;
1060

    
1061
    case MODE_PAGE_AUDIO_CTL:
1062
        length = 14;
1063
        break;
1064

    
1065
    case MODE_PAGE_CAPABILITIES:
1066
        length = 0x14;
1067
        if (page_control == 1) { /* Changeable Values */
1068
            break;
1069
        }
1070

    
1071
        p[0] = 0x3b; /* CD-R & CD-RW read */
1072
        p[1] = 0; /* Writing not supported */
1073
        p[2] = 0x7f; /* Audio, composite, digital out,
1074
                        mode 2 form 1&2, multi session */
1075
        p[3] = 0xff; /* CD DA, DA accurate, RW supported,
1076
                        RW corrected, C2 errors, ISRC,
1077
                        UPC, Bar code */
1078
        p[4] = 0x2d | (s->tray_locked ? 2 : 0);
1079
        /* Locking supported, jumper present, eject, tray */
1080
        p[5] = 0; /* no volume & mute control, no
1081
                     changer */
1082
        p[6] = (50 * 176) >> 8; /* 50x read speed */
1083
        p[7] = (50 * 176) & 0xff;
1084
        p[8] = 2 >> 8; /* Two volume levels */
1085
        p[9] = 2 & 0xff;
1086
        p[10] = 2048 >> 8; /* 2M buffer */
1087
        p[11] = 2048 & 0xff;
1088
        p[12] = (16 * 176) >> 8; /* 16x read speed current */
1089
        p[13] = (16 * 176) & 0xff;
1090
        p[16] = (16 * 176) >> 8; /* 16x write speed */
1091
        p[17] = (16 * 176) & 0xff;
1092
        p[18] = (16 * 176) >> 8; /* 16x write speed current */
1093
        p[19] = (16 * 176) & 0xff;
1094
        break;
1095

    
1096
    default:
1097
        return -1;
1098
    }
1099

    
1100
    assert(length < 256);
1101
    (*p_outbuf)[0] = page;
1102
    (*p_outbuf)[1] = length;
1103
    *p_outbuf += length + 2;
1104
    return length + 2;
1105
}
1106

    
1107
static int scsi_disk_emulate_mode_sense(SCSIDiskReq *r, uint8_t *outbuf)
1108
{
1109
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1110
    uint64_t nb_sectors;
1111
    bool dbd;
1112
    int page, buflen, ret, page_control;
1113
    uint8_t *p;
1114
    uint8_t dev_specific_param;
1115

    
1116
    dbd = (r->req.cmd.buf[1] & 0x8) != 0;
1117
    page = r->req.cmd.buf[2] & 0x3f;
1118
    page_control = (r->req.cmd.buf[2] & 0xc0) >> 6;
1119
    DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
1120
        (r->req.cmd.buf[0] == MODE_SENSE) ? 6 : 10, page, r->req.cmd.xfer, page_control);
1121
    memset(outbuf, 0, r->req.cmd.xfer);
1122
    p = outbuf;
1123

    
1124
    if (s->qdev.type == TYPE_DISK) {
1125
        dev_specific_param = s->features & (1 << SCSI_DISK_F_DPOFUA) ? 0x10 : 0;
1126
        if (bdrv_is_read_only(s->qdev.conf.bs)) {
1127
            dev_specific_param |= 0x80; /* Readonly.  */
1128
        }
1129
    } else {
1130
        /* MMC prescribes that CD/DVD drives have no block descriptors,
1131
         * and defines no device-specific parameter.  */
1132
        dev_specific_param = 0x00;
1133
        dbd = true;
1134
    }
1135

    
1136
    if (r->req.cmd.buf[0] == MODE_SENSE) {
1137
        p[1] = 0; /* Default media type.  */
1138
        p[2] = dev_specific_param;
1139
        p[3] = 0; /* Block descriptor length.  */
1140
        p += 4;
1141
    } else { /* MODE_SENSE_10 */
1142
        p[2] = 0; /* Default media type.  */
1143
        p[3] = dev_specific_param;
1144
        p[6] = p[7] = 0; /* Block descriptor length.  */
1145
        p += 8;
1146
    }
1147

    
1148
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1149
    if (!dbd && nb_sectors) {
1150
        if (r->req.cmd.buf[0] == MODE_SENSE) {
1151
            outbuf[3] = 8; /* Block descriptor length  */
1152
        } else { /* MODE_SENSE_10 */
1153
            outbuf[7] = 8; /* Block descriptor length  */
1154
        }
1155
        nb_sectors /= (s->qdev.blocksize / 512);
1156
        if (nb_sectors > 0xffffff) {
1157
            nb_sectors = 0;
1158
        }
1159
        p[0] = 0; /* media density code */
1160
        p[1] = (nb_sectors >> 16) & 0xff;
1161
        p[2] = (nb_sectors >> 8) & 0xff;
1162
        p[3] = nb_sectors & 0xff;
1163
        p[4] = 0; /* reserved */
1164
        p[5] = 0; /* bytes 5-7 are the sector size in bytes */
1165
        p[6] = s->qdev.blocksize >> 8;
1166
        p[7] = 0;
1167
        p += 8;
1168
    }
1169

    
1170
    if (page_control == 3) {
1171
        /* Saved Values */
1172
        scsi_check_condition(r, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED));
1173
        return -1;
1174
    }
1175

    
1176
    if (page == 0x3f) {
1177
        for (page = 0; page <= 0x3e; page++) {
1178
            mode_sense_page(s, page, &p, page_control);
1179
        }
1180
    } else {
1181
        ret = mode_sense_page(s, page, &p, page_control);
1182
        if (ret == -1) {
1183
            return -1;
1184
        }
1185
    }
1186

    
1187
    buflen = p - outbuf;
1188
    /*
1189
     * The mode data length field specifies the length in bytes of the
1190
     * following data that is available to be transferred. The mode data
1191
     * length does not include itself.
1192
     */
1193
    if (r->req.cmd.buf[0] == MODE_SENSE) {
1194
        outbuf[0] = buflen - 1;
1195
    } else { /* MODE_SENSE_10 */
1196
        outbuf[0] = ((buflen - 2) >> 8) & 0xff;
1197
        outbuf[1] = (buflen - 2) & 0xff;
1198
    }
1199
    return buflen;
1200
}
1201

    
1202
static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)
1203
{
1204
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1205
    int start_track, format, msf, toclen;
1206
    uint64_t nb_sectors;
1207

    
1208
    msf = req->cmd.buf[1] & 2;
1209
    format = req->cmd.buf[2] & 0xf;
1210
    start_track = req->cmd.buf[6];
1211
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1212
    DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
1213
    nb_sectors /= s->qdev.blocksize / 512;
1214
    switch (format) {
1215
    case 0:
1216
        toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
1217
        break;
1218
    case 1:
1219
        /* multi session : only a single session defined */
1220
        toclen = 12;
1221
        memset(outbuf, 0, 12);
1222
        outbuf[1] = 0x0a;
1223
        outbuf[2] = 0x01;
1224
        outbuf[3] = 0x01;
1225
        break;
1226
    case 2:
1227
        toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
1228
        break;
1229
    default:
1230
        return -1;
1231
    }
1232
    return toclen;
1233
}
1234

    
1235
static int scsi_disk_emulate_start_stop(SCSIDiskReq *r)
1236
{
1237
    SCSIRequest *req = &r->req;
1238
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1239
    bool start = req->cmd.buf[4] & 1;
1240
    bool loej = req->cmd.buf[4] & 2; /* load on start, eject on !start */
1241
    int pwrcnd = req->cmd.buf[4] & 0xf0;
1242

    
1243
    if (pwrcnd) {
1244
        /* eject/load only happens for power condition == 0 */
1245
        return 0;
1246
    }
1247

    
1248
    if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) && loej) {
1249
        if (!start && !s->tray_open && s->tray_locked) {
1250
            scsi_check_condition(r,
1251
                                 bdrv_is_inserted(s->qdev.conf.bs)
1252
                                 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED)
1253
                                 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED));
1254
            return -1;
1255
        }
1256

    
1257
        if (s->tray_open != !start) {
1258
            bdrv_eject(s->qdev.conf.bs, !start);
1259
            s->tray_open = !start;
1260
        }
1261
    }
1262
    return 0;
1263
}
1264

    
1265
static void scsi_disk_emulate_read_data(SCSIRequest *req)
1266
{
1267
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1268
    int buflen = r->iov.iov_len;
1269

    
1270
    if (buflen) {
1271
        DPRINTF("Read buf_len=%d\n", buflen);
1272
        r->iov.iov_len = 0;
1273
        r->started = true;
1274
        scsi_req_data(&r->req, buflen);
1275
        return;
1276
    }
1277

    
1278
    /* This also clears the sense buffer for REQUEST SENSE.  */
1279
    scsi_req_complete(&r->req, GOOD);
1280
}
1281

    
1282
static int scsi_disk_check_mode_select(SCSIDiskState *s, int page,
1283
                                       uint8_t *inbuf, int inlen)
1284
{
1285
    uint8_t mode_current[SCSI_MAX_MODE_LEN];
1286
    uint8_t mode_changeable[SCSI_MAX_MODE_LEN];
1287
    uint8_t *p;
1288
    int len, expected_len, changeable_len, i;
1289

    
1290
    /* The input buffer does not include the page header, so it is
1291
     * off by 2 bytes.
1292
     */
1293
    expected_len = inlen + 2;
1294
    if (expected_len > SCSI_MAX_MODE_LEN) {
1295
        return -1;
1296
    }
1297

    
1298
    p = mode_current;
1299
    memset(mode_current, 0, inlen + 2);
1300
    len = mode_sense_page(s, page, &p, 0);
1301
    if (len < 0 || len != expected_len) {
1302
        return -1;
1303
    }
1304

    
1305
    p = mode_changeable;
1306
    memset(mode_changeable, 0, inlen + 2);
1307
    changeable_len = mode_sense_page(s, page, &p, 1);
1308
    assert(changeable_len == len);
1309

    
1310
    /* Check that unchangeable bits are the same as what MODE SENSE
1311
     * would return.
1312
     */
1313
    for (i = 2; i < len; i++) {
1314
        if (((mode_current[i] ^ inbuf[i - 2]) & ~mode_changeable[i]) != 0) {
1315
            return -1;
1316
        }
1317
    }
1318
    return 0;
1319
}
1320

    
1321
static void scsi_disk_apply_mode_select(SCSIDiskState *s, int page, uint8_t *p)
1322
{
1323
    switch (page) {
1324
    case MODE_PAGE_CACHING:
1325
        bdrv_set_enable_write_cache(s->qdev.conf.bs, (p[0] & 4) != 0);
1326
        break;
1327

    
1328
    default:
1329
        break;
1330
    }
1331
}
1332

    
1333
static int mode_select_pages(SCSIDiskReq *r, uint8_t *p, int len, bool change)
1334
{
1335
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1336

    
1337
    while (len > 0) {
1338
        int page, subpage, page_len;
1339

    
1340
        /* Parse both possible formats for the mode page headers.  */
1341
        page = p[0] & 0x3f;
1342
        if (p[0] & 0x40) {
1343
            if (len < 4) {
1344
                goto invalid_param_len;
1345
            }
1346
            subpage = p[1];
1347
            page_len = lduw_be_p(&p[2]);
1348
            p += 4;
1349
            len -= 4;
1350
        } else {
1351
            if (len < 2) {
1352
                goto invalid_param_len;
1353
            }
1354
            subpage = 0;
1355
            page_len = p[1];
1356
            p += 2;
1357
            len -= 2;
1358
        }
1359

    
1360
        if (subpage) {
1361
            goto invalid_param;
1362
        }
1363
        if (page_len > len) {
1364
            goto invalid_param_len;
1365
        }
1366

    
1367
        if (!change) {
1368
            if (scsi_disk_check_mode_select(s, page, p, page_len) < 0) {
1369
                goto invalid_param;
1370
            }
1371
        } else {
1372
            scsi_disk_apply_mode_select(s, page, p);
1373
        }
1374

    
1375
        p += page_len;
1376
        len -= page_len;
1377
    }
1378
    return 0;
1379

    
1380
invalid_param:
1381
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1382
    return -1;
1383

    
1384
invalid_param_len:
1385
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1386
    return -1;
1387
}
1388

    
1389
static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf)
1390
{
1391
    uint8_t *p = inbuf;
1392
    int cmd = r->req.cmd.buf[0];
1393
    int len = r->req.cmd.xfer;
1394
    int hdr_len = (cmd == MODE_SELECT ? 4 : 8);
1395
    int bd_len;
1396
    int pass;
1397

    
1398
    /* We only support PF=1, SP=0.  */
1399
    if ((r->req.cmd.buf[1] & 0x11) != 0x10) {
1400
        goto invalid_field;
1401
    }
1402

    
1403
    if (len < hdr_len) {
1404
        goto invalid_param_len;
1405
    }
1406

    
1407
    bd_len = (cmd == MODE_SELECT ? p[3] : lduw_be_p(&p[6]));
1408
    len -= hdr_len;
1409
    p += hdr_len;
1410
    if (len < bd_len) {
1411
        goto invalid_param_len;
1412
    }
1413
    if (bd_len != 0 && bd_len != 8) {
1414
        goto invalid_param;
1415
    }
1416

    
1417
    len -= bd_len;
1418
    p += bd_len;
1419

    
1420
    /* Ensure no change is made if there is an error!  */
1421
    for (pass = 0; pass < 2; pass++) {
1422
        if (mode_select_pages(r, p, len, pass == 1) < 0) {
1423
            assert(pass == 0);
1424
            return;
1425
        }
1426
    }
1427
    scsi_req_complete(&r->req, GOOD);
1428
    return;
1429

    
1430
invalid_param:
1431
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1432
    return;
1433

    
1434
invalid_param_len:
1435
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1436
    return;
1437

    
1438
invalid_field:
1439
    scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1440
}
1441

    
1442
static inline bool check_lba_range(SCSIDiskState *s,
1443
                                   uint64_t sector_num, uint32_t nb_sectors)
1444
{
1445
    /*
1446
     * The first line tests that no overflow happens when computing the last
1447
     * sector.  The second line tests that the last accessed sector is in
1448
     * range.
1449
     *
1450
     * Careful, the computations should not underflow for nb_sectors == 0,
1451
     * and a 0-block read to the first LBA beyond the end of device is
1452
     * valid.
1453
     */
1454
    return (sector_num <= sector_num + nb_sectors &&
1455
            sector_num + nb_sectors <= s->qdev.max_lba + 1);
1456
}
1457

    
1458
typedef struct UnmapCBData {
1459
    SCSIDiskReq *r;
1460
    uint8_t *inbuf;
1461
    int count;
1462
} UnmapCBData;
1463

    
1464
static void scsi_unmap_complete(void *opaque, int ret)
1465
{
1466
    UnmapCBData *data = opaque;
1467
    SCSIDiskReq *r = data->r;
1468
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1469
    uint64_t sector_num;
1470
    uint32_t nb_sectors;
1471

    
1472
    r->req.aiocb = NULL;
1473
    if (ret < 0) {
1474
        if (scsi_handle_rw_error(r, -ret)) {
1475
            goto done;
1476
        }
1477
    }
1478

    
1479
    if (data->count > 0 && !r->req.io_canceled) {
1480
        sector_num = ldq_be_p(&data->inbuf[0]);
1481
        nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
1482
        if (!check_lba_range(s, sector_num, nb_sectors)) {
1483
            scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1484
            goto done;
1485
        }
1486

    
1487
        r->req.aiocb = bdrv_aio_discard(s->qdev.conf.bs,
1488
                                        sector_num * (s->qdev.blocksize / 512),
1489
                                        nb_sectors * (s->qdev.blocksize / 512),
1490
                                        scsi_unmap_complete, data);
1491
        data->count--;
1492
        data->inbuf += 16;
1493
        return;
1494
    }
1495

    
1496
done:
1497
    if (data->count == 0) {
1498
        scsi_req_complete(&r->req, GOOD);
1499
    }
1500
    if (!r->req.io_canceled) {
1501
        scsi_req_unref(&r->req);
1502
    }
1503
    g_free(data);
1504
}
1505

    
1506
static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf)
1507
{
1508
    uint8_t *p = inbuf;
1509
    int len = r->req.cmd.xfer;
1510
    UnmapCBData *data;
1511

    
1512
    if (len < 8) {
1513
        goto invalid_param_len;
1514
    }
1515
    if (len < lduw_be_p(&p[0]) + 2) {
1516
        goto invalid_param_len;
1517
    }
1518
    if (len < lduw_be_p(&p[2]) + 8) {
1519
        goto invalid_param_len;
1520
    }
1521
    if (lduw_be_p(&p[2]) & 15) {
1522
        goto invalid_param_len;
1523
    }
1524

    
1525
    data = g_new0(UnmapCBData, 1);
1526
    data->r = r;
1527
    data->inbuf = &p[8];
1528
    data->count = lduw_be_p(&p[2]) >> 4;
1529

    
1530
    /* The matching unref is in scsi_unmap_complete, before data is freed.  */
1531
    scsi_req_ref(&r->req);
1532
    scsi_unmap_complete(data, 0);
1533
    return;
1534

    
1535
invalid_param_len:
1536
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1537
}
1538

    
1539
static void scsi_disk_emulate_write_data(SCSIRequest *req)
1540
{
1541
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1542

    
1543
    if (r->iov.iov_len) {
1544
        int buflen = r->iov.iov_len;
1545
        DPRINTF("Write buf_len=%d\n", buflen);
1546
        r->iov.iov_len = 0;
1547
        scsi_req_data(&r->req, buflen);
1548
        return;
1549
    }
1550

    
1551
    switch (req->cmd.buf[0]) {
1552
    case MODE_SELECT:
1553
    case MODE_SELECT_10:
1554
        /* This also clears the sense buffer for REQUEST SENSE.  */
1555
        scsi_disk_emulate_mode_select(r, r->iov.iov_base);
1556
        break;
1557

    
1558
    case UNMAP:
1559
        scsi_disk_emulate_unmap(r, r->iov.iov_base);
1560
        break;
1561

    
1562
    default:
1563
        abort();
1564
    }
1565
}
1566

    
1567
static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf)
1568
{
1569
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1570
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1571
    uint64_t nb_sectors;
1572
    uint8_t *outbuf;
1573
    int buflen;
1574

    
1575
    switch (req->cmd.buf[0]) {
1576
    case INQUIRY:
1577
    case MODE_SENSE:
1578
    case MODE_SENSE_10:
1579
    case RESERVE:
1580
    case RESERVE_10:
1581
    case RELEASE:
1582
    case RELEASE_10:
1583
    case START_STOP:
1584
    case ALLOW_MEDIUM_REMOVAL:
1585
    case GET_CONFIGURATION:
1586
    case GET_EVENT_STATUS_NOTIFICATION:
1587
    case MECHANISM_STATUS:
1588
    case REQUEST_SENSE:
1589
        break;
1590

    
1591
    default:
1592
        if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {
1593
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
1594
            return 0;
1595
        }
1596
        break;
1597
    }
1598

    
1599
    if (!r->iov.iov_base) {
1600
        /*
1601
         * FIXME: we shouldn't return anything bigger than 4k, but the code
1602
         * requires the buffer to be as big as req->cmd.xfer in several
1603
         * places.  So, do not allow CDBs with a very large ALLOCATION
1604
         * LENGTH.  The real fix would be to modify scsi_read_data and
1605
         * dma_buf_read, so that they return data beyond the buflen
1606
         * as all zeros.
1607
         */
1608
        if (req->cmd.xfer > 65536) {
1609
            goto illegal_request;
1610
        }
1611
        r->buflen = MAX(4096, req->cmd.xfer);
1612
        r->iov.iov_base = qemu_blockalign(s->qdev.conf.bs, r->buflen);
1613
    }
1614

    
1615
    buflen = req->cmd.xfer;
1616
    outbuf = r->iov.iov_base;
1617
    switch (req->cmd.buf[0]) {
1618
    case TEST_UNIT_READY:
1619
        assert(!s->tray_open && bdrv_is_inserted(s->qdev.conf.bs));
1620
        break;
1621
    case INQUIRY:
1622
        buflen = scsi_disk_emulate_inquiry(req, outbuf);
1623
        if (buflen < 0) {
1624
            goto illegal_request;
1625
        }
1626
        break;
1627
    case MODE_SENSE:
1628
    case MODE_SENSE_10:
1629
        buflen = scsi_disk_emulate_mode_sense(r, outbuf);
1630
        if (buflen < 0) {
1631
            goto illegal_request;
1632
        }
1633
        break;
1634
    case READ_TOC:
1635
        buflen = scsi_disk_emulate_read_toc(req, outbuf);
1636
        if (buflen < 0) {
1637
            goto illegal_request;
1638
        }
1639
        break;
1640
    case RESERVE:
1641
        if (req->cmd.buf[1] & 1) {
1642
            goto illegal_request;
1643
        }
1644
        break;
1645
    case RESERVE_10:
1646
        if (req->cmd.buf[1] & 3) {
1647
            goto illegal_request;
1648
        }
1649
        break;
1650
    case RELEASE:
1651
        if (req->cmd.buf[1] & 1) {
1652
            goto illegal_request;
1653
        }
1654
        break;
1655
    case RELEASE_10:
1656
        if (req->cmd.buf[1] & 3) {
1657
            goto illegal_request;
1658
        }
1659
        break;
1660
    case START_STOP:
1661
        if (scsi_disk_emulate_start_stop(r) < 0) {
1662
            return 0;
1663
        }
1664
        break;
1665
    case ALLOW_MEDIUM_REMOVAL:
1666
        s->tray_locked = req->cmd.buf[4] & 1;
1667
        bdrv_lock_medium(s->qdev.conf.bs, req->cmd.buf[4] & 1);
1668
        break;
1669
    case READ_CAPACITY_10:
1670
        /* The normal LEN field for this command is zero.  */
1671
        memset(outbuf, 0, 8);
1672
        bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1673
        if (!nb_sectors) {
1674
            scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
1675
            return -1;
1676
        }
1677
        if ((req->cmd.buf[8] & 1) == 0 && req->cmd.lba) {
1678
            goto illegal_request;
1679
        }
1680
        nb_sectors /= s->qdev.blocksize / 512;
1681
        /* Returned value is the address of the last sector.  */
1682
        nb_sectors--;
1683
        /* Remember the new size for read/write sanity checking. */
1684
        s->qdev.max_lba = nb_sectors;
1685
        /* Clip to 2TB, instead of returning capacity modulo 2TB. */
1686
        if (nb_sectors > UINT32_MAX) {
1687
            nb_sectors = UINT32_MAX;
1688
        }
1689
        outbuf[0] = (nb_sectors >> 24) & 0xff;
1690
        outbuf[1] = (nb_sectors >> 16) & 0xff;
1691
        outbuf[2] = (nb_sectors >> 8) & 0xff;
1692
        outbuf[3] = nb_sectors & 0xff;
1693
        outbuf[4] = 0;
1694
        outbuf[5] = 0;
1695
        outbuf[6] = s->qdev.blocksize >> 8;
1696
        outbuf[7] = 0;
1697
        buflen = 8;
1698
        break;
1699
    case REQUEST_SENSE:
1700
        /* Just return "NO SENSE".  */
1701
        buflen = scsi_build_sense(NULL, 0, outbuf, r->buflen,
1702
                                  (req->cmd.buf[1] & 1) == 0);
1703
        break;
1704
    case MECHANISM_STATUS:
1705
        buflen = scsi_emulate_mechanism_status(s, outbuf);
1706
        if (buflen < 0) {
1707
            goto illegal_request;
1708
        }
1709
        break;
1710
    case GET_CONFIGURATION:
1711
        buflen = scsi_get_configuration(s, outbuf);
1712
        if (buflen < 0) {
1713
            goto illegal_request;
1714
        }
1715
        break;
1716
    case GET_EVENT_STATUS_NOTIFICATION:
1717
        buflen = scsi_get_event_status_notification(s, r, outbuf);
1718
        if (buflen < 0) {
1719
            goto illegal_request;
1720
        }
1721
        break;
1722
    case READ_DISC_INFORMATION:
1723
        buflen = scsi_read_disc_information(s, r, outbuf);
1724
        if (buflen < 0) {
1725
            goto illegal_request;
1726
        }
1727
        break;
1728
    case READ_DVD_STRUCTURE:
1729
        buflen = scsi_read_dvd_structure(s, r, outbuf);
1730
        if (buflen < 0) {
1731
            goto illegal_request;
1732
        }
1733
        break;
1734
    case SERVICE_ACTION_IN_16:
1735
        /* Service Action In subcommands. */
1736
        if ((req->cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) {
1737
            DPRINTF("SAI READ CAPACITY(16)\n");
1738
            memset(outbuf, 0, req->cmd.xfer);
1739
            bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1740
            if (!nb_sectors) {
1741
                scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
1742
                return -1;
1743
            }
1744
            if ((req->cmd.buf[14] & 1) == 0 && req->cmd.lba) {
1745
                goto illegal_request;
1746
            }
1747
            nb_sectors /= s->qdev.blocksize / 512;
1748
            /* Returned value is the address of the last sector.  */
1749
            nb_sectors--;
1750
            /* Remember the new size for read/write sanity checking. */
1751
            s->qdev.max_lba = nb_sectors;
1752
            outbuf[0] = (nb_sectors >> 56) & 0xff;
1753
            outbuf[1] = (nb_sectors >> 48) & 0xff;
1754
            outbuf[2] = (nb_sectors >> 40) & 0xff;
1755
            outbuf[3] = (nb_sectors >> 32) & 0xff;
1756
            outbuf[4] = (nb_sectors >> 24) & 0xff;
1757
            outbuf[5] = (nb_sectors >> 16) & 0xff;
1758
            outbuf[6] = (nb_sectors >> 8) & 0xff;
1759
            outbuf[7] = nb_sectors & 0xff;
1760
            outbuf[8] = 0;
1761
            outbuf[9] = 0;
1762
            outbuf[10] = s->qdev.blocksize >> 8;
1763
            outbuf[11] = 0;
1764
            outbuf[12] = 0;
1765
            outbuf[13] = get_physical_block_exp(&s->qdev.conf);
1766

    
1767
            /* set TPE bit if the format supports discard */
1768
            if (s->qdev.conf.discard_granularity) {
1769
                outbuf[14] = 0x80;
1770
            }
1771

    
1772
            /* Protection, exponent and lowest lba field left blank. */
1773
            buflen = req->cmd.xfer;
1774
            break;
1775
        }
1776
        DPRINTF("Unsupported Service Action In\n");
1777
        goto illegal_request;
1778
    case SYNCHRONIZE_CACHE:
1779
        /* The request is used as the AIO opaque value, so add a ref.  */
1780
        scsi_req_ref(&r->req);
1781
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
1782
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_aio_complete, r);
1783
        return 0;
1784
    case SEEK_10:
1785
        DPRINTF("Seek(10) (sector %" PRId64 ")\n", r->req.cmd.lba);
1786
        if (r->req.cmd.lba > s->qdev.max_lba) {
1787
            goto illegal_lba;
1788
        }
1789
        break;
1790
    case MODE_SELECT:
1791
        DPRINTF("Mode Select(6) (len %lu)\n", (long)r->req.cmd.xfer);
1792
        break;
1793
    case MODE_SELECT_10:
1794
        DPRINTF("Mode Select(10) (len %lu)\n", (long)r->req.cmd.xfer);
1795
        break;
1796
    case UNMAP:
1797
        DPRINTF("Unmap (len %lu)\n", (long)r->req.cmd.xfer);
1798
        break;
1799
    case WRITE_SAME_10:
1800
    case WRITE_SAME_16:
1801
        nb_sectors = scsi_data_cdb_length(r->req.cmd.buf);
1802
        if (bdrv_is_read_only(s->qdev.conf.bs)) {
1803
            scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1804
            return 0;
1805
        }
1806
        if (!check_lba_range(s, r->req.cmd.lba, nb_sectors)) {
1807
            goto illegal_lba;
1808
        }
1809

    
1810
        /*
1811
         * We only support WRITE SAME with the unmap bit set for now.
1812
         */
1813
        if (!(req->cmd.buf[1] & 0x8)) {
1814
            goto illegal_request;
1815
        }
1816

    
1817
        /* The request is used as the AIO opaque value, so add a ref.  */
1818
        scsi_req_ref(&r->req);
1819
        r->req.aiocb = bdrv_aio_discard(s->qdev.conf.bs,
1820
                                        r->req.cmd.lba * (s->qdev.blocksize / 512),
1821
                                        nb_sectors * (s->qdev.blocksize / 512),
1822
                                        scsi_aio_complete, r);
1823
        return 0;
1824
    default:
1825
        DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
1826
        scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE));
1827
        return 0;
1828
    }
1829
    assert(!r->req.aiocb);
1830
    r->iov.iov_len = MIN(buflen, req->cmd.xfer);
1831
    if (r->iov.iov_len == 0) {
1832
        scsi_req_complete(&r->req, GOOD);
1833
    }
1834
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
1835
        assert(r->iov.iov_len == req->cmd.xfer);
1836
        return -r->iov.iov_len;
1837
    } else {
1838
        return r->iov.iov_len;
1839
    }
1840

    
1841
illegal_request:
1842
    if (r->req.status == -1) {
1843
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1844
    }
1845
    return 0;
1846

    
1847
illegal_lba:
1848
    scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1849
    return 0;
1850
}
1851

    
1852
/* Execute a scsi command.  Returns the length of the data expected by the
1853
   command.  This will be Positive for data transfers from the device
1854
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
1855
   and zero if the command does not transfer any data.  */
1856

    
1857
static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
1858
{
1859
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1860
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1861
    uint32_t len;
1862
    uint8_t command;
1863

    
1864
    command = buf[0];
1865

    
1866
    if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {
1867
        scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
1868
        return 0;
1869
    }
1870

    
1871
    len = scsi_data_cdb_length(r->req.cmd.buf);
1872
    switch (command) {
1873
    case READ_6:
1874
    case READ_10:
1875
    case READ_12:
1876
    case READ_16:
1877
        DPRINTF("Read (sector %" PRId64 ", count %u)\n", r->req.cmd.lba, len);
1878
        if (r->req.cmd.buf[1] & 0xe0) {
1879
            goto illegal_request;
1880
        }
1881
        if (!check_lba_range(s, r->req.cmd.lba, len)) {
1882
            goto illegal_lba;
1883
        }
1884
        r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
1885
        r->sector_count = len * (s->qdev.blocksize / 512);
1886
        break;
1887
    case WRITE_6:
1888
    case WRITE_10:
1889
    case WRITE_12:
1890
    case WRITE_16:
1891
    case WRITE_VERIFY_10:
1892
    case WRITE_VERIFY_12:
1893
    case WRITE_VERIFY_16:
1894
        if (bdrv_is_read_only(s->qdev.conf.bs)) {
1895
            scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1896
            return 0;
1897
        }
1898
        /* fallthrough */
1899
    case VERIFY_10:
1900
    case VERIFY_12:
1901
    case VERIFY_16:
1902
        DPRINTF("Write %s(sector %" PRId64 ", count %u)\n",
1903
                (command & 0xe) == 0xe ? "And Verify " : "",
1904
                r->req.cmd.lba, len);
1905
        if (r->req.cmd.buf[1] & 0xe0) {
1906
            goto illegal_request;
1907
        }
1908
        if (!check_lba_range(s, r->req.cmd.lba, len)) {
1909
            goto illegal_lba;
1910
        }
1911
        r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
1912
        r->sector_count = len * (s->qdev.blocksize / 512);
1913
        break;
1914
    default:
1915
        abort();
1916
    illegal_request:
1917
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1918
        return 0;
1919
    illegal_lba:
1920
        scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1921
        return 0;
1922
    }
1923
    if (r->sector_count == 0) {
1924
        scsi_req_complete(&r->req, GOOD);
1925
    }
1926
    assert(r->iov.iov_len == 0);
1927
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
1928
        return -r->sector_count * 512;
1929
    } else {
1930
        return r->sector_count * 512;
1931
    }
1932
}
1933

    
1934
static void scsi_disk_reset(DeviceState *dev)
1935
{
1936
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev.qdev, dev);
1937
    uint64_t nb_sectors;
1938

    
1939
    scsi_device_purge_requests(&s->qdev, SENSE_CODE(RESET));
1940

    
1941
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1942
    nb_sectors /= s->qdev.blocksize / 512;
1943
    if (nb_sectors) {
1944
        nb_sectors--;
1945
    }
1946
    s->qdev.max_lba = nb_sectors;
1947
}
1948

    
1949
static void scsi_destroy(SCSIDevice *dev)
1950
{
1951
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1952

    
1953
    scsi_device_purge_requests(&s->qdev, SENSE_CODE(NO_SENSE));
1954
    blockdev_mark_auto_del(s->qdev.conf.bs);
1955
}
1956

    
1957
static void scsi_disk_resize_cb(void *opaque)
1958
{
1959
    SCSIDiskState *s = opaque;
1960

    
1961
    /* SPC lists this sense code as available only for
1962
     * direct-access devices.
1963
     */
1964
    if (s->qdev.type == TYPE_DISK) {
1965
        scsi_device_set_ua(&s->qdev, SENSE_CODE(CAPACITY_CHANGED));
1966
        scsi_device_report_change(&s->qdev, SENSE_CODE(CAPACITY_CHANGED));
1967
    }
1968
}
1969

    
1970
static void scsi_cd_change_media_cb(void *opaque, bool load)
1971
{
1972
    SCSIDiskState *s = opaque;
1973

    
1974
    /*
1975
     * When a CD gets changed, we have to report an ejected state and
1976
     * then a loaded state to guests so that they detect tray
1977
     * open/close and media change events.  Guests that do not use
1978
     * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
1979
     * states rely on this behavior.
1980
     *
1981
     * media_changed governs the state machine used for unit attention
1982
     * report.  media_event is used by GET EVENT STATUS NOTIFICATION.
1983
     */
1984
    s->media_changed = load;
1985
    s->tray_open = !load;
1986
    scsi_device_set_ua(&s->qdev, SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM));
1987
    s->media_event = true;
1988
    s->eject_request = false;
1989
}
1990

    
1991
static void scsi_cd_eject_request_cb(void *opaque, bool force)
1992
{
1993
    SCSIDiskState *s = opaque;
1994

    
1995
    s->eject_request = true;
1996
    if (force) {
1997
        s->tray_locked = false;
1998
    }
1999
}
2000

    
2001
static bool scsi_cd_is_tray_open(void *opaque)
2002
{
2003
    return ((SCSIDiskState *)opaque)->tray_open;
2004
}
2005

    
2006
static bool scsi_cd_is_medium_locked(void *opaque)
2007
{
2008
    return ((SCSIDiskState *)opaque)->tray_locked;
2009
}
2010

    
2011
static const BlockDevOps scsi_disk_removable_block_ops = {
2012
    .change_media_cb = scsi_cd_change_media_cb,
2013
    .eject_request_cb = scsi_cd_eject_request_cb,
2014
    .is_tray_open = scsi_cd_is_tray_open,
2015
    .is_medium_locked = scsi_cd_is_medium_locked,
2016

    
2017
    .resize_cb = scsi_disk_resize_cb,
2018
};
2019

    
2020
static const BlockDevOps scsi_disk_block_ops = {
2021
    .resize_cb = scsi_disk_resize_cb,
2022
};
2023

    
2024
static void scsi_disk_unit_attention_reported(SCSIDevice *dev)
2025
{
2026
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2027
    if (s->media_changed) {
2028
        s->media_changed = false;
2029
        scsi_device_set_ua(&s->qdev, SENSE_CODE(MEDIUM_CHANGED));
2030
    }
2031
}
2032

    
2033
static int scsi_initfn(SCSIDevice *dev)
2034
{
2035
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2036

    
2037
    if (!s->qdev.conf.bs) {
2038
        error_report("drive property not set");
2039
        return -1;
2040
    }
2041

    
2042
    if (!(s->features & (1 << SCSI_DISK_F_REMOVABLE)) &&
2043
        !bdrv_is_inserted(s->qdev.conf.bs)) {
2044
        error_report("Device needs media, but drive is empty");
2045
        return -1;
2046
    }
2047

    
2048
    blkconf_serial(&s->qdev.conf, &s->serial);
2049
    if (dev->type == TYPE_DISK
2050
        && blkconf_geometry(&dev->conf, NULL, 65535, 255, 255) < 0) {
2051
        return -1;
2052
    }
2053

    
2054
    if (!s->version) {
2055
        s->version = g_strdup(qemu_get_version());
2056
    }
2057
    if (!s->vendor) {
2058
        s->vendor = g_strdup("QEMU");
2059
    }
2060

    
2061
    if (bdrv_is_sg(s->qdev.conf.bs)) {
2062
        error_report("unwanted /dev/sg*");
2063
        return -1;
2064
    }
2065

    
2066
    if (s->features & (1 << SCSI_DISK_F_REMOVABLE)) {
2067
        bdrv_set_dev_ops(s->qdev.conf.bs, &scsi_disk_removable_block_ops, s);
2068
    } else {
2069
        bdrv_set_dev_ops(s->qdev.conf.bs, &scsi_disk_block_ops, s);
2070
    }
2071
    bdrv_set_buffer_alignment(s->qdev.conf.bs, s->qdev.blocksize);
2072

    
2073
    bdrv_iostatus_enable(s->qdev.conf.bs);
2074
    add_boot_device_path(s->qdev.conf.bootindex, &dev->qdev, NULL);
2075
    return 0;
2076
}
2077

    
2078
static int scsi_hd_initfn(SCSIDevice *dev)
2079
{
2080
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2081
    s->qdev.blocksize = s->qdev.conf.logical_block_size;
2082
    s->qdev.type = TYPE_DISK;
2083
    if (!s->product) {
2084
        s->product = g_strdup("QEMU HARDDISK");
2085
    }
2086
    return scsi_initfn(&s->qdev);
2087
}
2088

    
2089
static int scsi_cd_initfn(SCSIDevice *dev)
2090
{
2091
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2092
    s->qdev.blocksize = 2048;
2093
    s->qdev.type = TYPE_ROM;
2094
    s->features |= 1 << SCSI_DISK_F_REMOVABLE;
2095
    if (!s->product) {
2096
        s->product = g_strdup("QEMU CD-ROM");
2097
    }
2098
    return scsi_initfn(&s->qdev);
2099
}
2100

    
2101
static int scsi_disk_initfn(SCSIDevice *dev)
2102
{
2103
    DriveInfo *dinfo;
2104

    
2105
    if (!dev->conf.bs) {
2106
        return scsi_initfn(dev);  /* ... and die there */
2107
    }
2108

    
2109
    dinfo = drive_get_by_blockdev(dev->conf.bs);
2110
    if (dinfo->media_cd) {
2111
        return scsi_cd_initfn(dev);
2112
    } else {
2113
        return scsi_hd_initfn(dev);
2114
    }
2115
}
2116

    
2117
static const SCSIReqOps scsi_disk_emulate_reqops = {
2118
    .size         = sizeof(SCSIDiskReq),
2119
    .free_req     = scsi_free_request,
2120
    .send_command = scsi_disk_emulate_command,
2121
    .read_data    = scsi_disk_emulate_read_data,
2122
    .write_data   = scsi_disk_emulate_write_data,
2123
    .get_buf      = scsi_get_buf,
2124
};
2125

    
2126
static const SCSIReqOps scsi_disk_dma_reqops = {
2127
    .size         = sizeof(SCSIDiskReq),
2128
    .free_req     = scsi_free_request,
2129
    .send_command = scsi_disk_dma_command,
2130
    .read_data    = scsi_read_data,
2131
    .write_data   = scsi_write_data,
2132
    .cancel_io    = scsi_cancel_io,
2133
    .get_buf      = scsi_get_buf,
2134
    .load_request = scsi_disk_load_request,
2135
    .save_request = scsi_disk_save_request,
2136
};
2137

    
2138
static const SCSIReqOps *const scsi_disk_reqops_dispatch[256] = {
2139
    [TEST_UNIT_READY]                 = &scsi_disk_emulate_reqops,
2140
    [INQUIRY]                         = &scsi_disk_emulate_reqops,
2141
    [MODE_SENSE]                      = &scsi_disk_emulate_reqops,
2142
    [MODE_SENSE_10]                   = &scsi_disk_emulate_reqops,
2143
    [START_STOP]                      = &scsi_disk_emulate_reqops,
2144
    [ALLOW_MEDIUM_REMOVAL]            = &scsi_disk_emulate_reqops,
2145
    [READ_CAPACITY_10]                = &scsi_disk_emulate_reqops,
2146
    [READ_TOC]                        = &scsi_disk_emulate_reqops,
2147
    [READ_DVD_STRUCTURE]              = &scsi_disk_emulate_reqops,
2148
    [READ_DISC_INFORMATION]           = &scsi_disk_emulate_reqops,
2149
    [GET_CONFIGURATION]               = &scsi_disk_emulate_reqops,
2150
    [GET_EVENT_STATUS_NOTIFICATION]   = &scsi_disk_emulate_reqops,
2151
    [MECHANISM_STATUS]                = &scsi_disk_emulate_reqops,
2152
    [SERVICE_ACTION_IN_16]            = &scsi_disk_emulate_reqops,
2153
    [REQUEST_SENSE]                   = &scsi_disk_emulate_reqops,
2154
    [SYNCHRONIZE_CACHE]               = &scsi_disk_emulate_reqops,
2155
    [SEEK_10]                         = &scsi_disk_emulate_reqops,
2156
    [MODE_SELECT]                     = &scsi_disk_emulate_reqops,
2157
    [MODE_SELECT_10]                  = &scsi_disk_emulate_reqops,
2158
    [UNMAP]                           = &scsi_disk_emulate_reqops,
2159
    [WRITE_SAME_10]                   = &scsi_disk_emulate_reqops,
2160
    [WRITE_SAME_16]                   = &scsi_disk_emulate_reqops,
2161

    
2162
    [READ_6]                          = &scsi_disk_dma_reqops,
2163
    [READ_10]                         = &scsi_disk_dma_reqops,
2164
    [READ_12]                         = &scsi_disk_dma_reqops,
2165
    [READ_16]                         = &scsi_disk_dma_reqops,
2166
    [VERIFY_10]                       = &scsi_disk_dma_reqops,
2167
    [VERIFY_12]                       = &scsi_disk_dma_reqops,
2168
    [VERIFY_16]                       = &scsi_disk_dma_reqops,
2169
    [WRITE_6]                         = &scsi_disk_dma_reqops,
2170
    [WRITE_10]                        = &scsi_disk_dma_reqops,
2171
    [WRITE_12]                        = &scsi_disk_dma_reqops,
2172
    [WRITE_16]                        = &scsi_disk_dma_reqops,
2173
    [WRITE_VERIFY_10]                 = &scsi_disk_dma_reqops,
2174
    [WRITE_VERIFY_12]                 = &scsi_disk_dma_reqops,
2175
    [WRITE_VERIFY_16]                 = &scsi_disk_dma_reqops,
2176
};
2177

    
2178
static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun,
2179
                                     uint8_t *buf, void *hba_private)
2180
{
2181
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2182
    SCSIRequest *req;
2183
    const SCSIReqOps *ops;
2184
    uint8_t command;
2185

    
2186
    command = buf[0];
2187
    ops = scsi_disk_reqops_dispatch[command];
2188
    if (!ops) {
2189
        ops = &scsi_disk_emulate_reqops;
2190
    }
2191
    req = scsi_req_alloc(ops, &s->qdev, tag, lun, hba_private);
2192

    
2193
#ifdef DEBUG_SCSI
2194
    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
2195
    {
2196
        int i;
2197
        for (i = 1; i < req->cmd.len; i++) {
2198
            printf(" 0x%02x", buf[i]);
2199
        }
2200
        printf("\n");
2201
    }
2202
#endif
2203

    
2204
    return req;
2205
}
2206

    
2207
#ifdef __linux__
2208
static int get_device_type(SCSIDiskState *s)
2209
{
2210
    BlockDriverState *bdrv = s->qdev.conf.bs;
2211
    uint8_t cmd[16];
2212
    uint8_t buf[36];
2213
    uint8_t sensebuf[8];
2214
    sg_io_hdr_t io_header;
2215
    int ret;
2216

    
2217
    memset(cmd, 0, sizeof(cmd));
2218
    memset(buf, 0, sizeof(buf));
2219
    cmd[0] = INQUIRY;
2220
    cmd[4] = sizeof(buf);
2221

    
2222
    memset(&io_header, 0, sizeof(io_header));
2223
    io_header.interface_id = 'S';
2224
    io_header.dxfer_direction = SG_DXFER_FROM_DEV;
2225
    io_header.dxfer_len = sizeof(buf);
2226
    io_header.dxferp = buf;
2227
    io_header.cmdp = cmd;
2228
    io_header.cmd_len = sizeof(cmd);
2229
    io_header.mx_sb_len = sizeof(sensebuf);
2230
    io_header.sbp = sensebuf;
2231
    io_header.timeout = 6000; /* XXX */
2232

    
2233
    ret = bdrv_ioctl(bdrv, SG_IO, &io_header);
2234
    if (ret < 0 || io_header.driver_status || io_header.host_status) {
2235
        return -1;
2236
    }
2237
    s->qdev.type = buf[0];
2238
    if (buf[1] & 0x80) {
2239
        s->features |= 1 << SCSI_DISK_F_REMOVABLE;
2240
    }
2241
    return 0;
2242
}
2243

    
2244
static int scsi_block_initfn(SCSIDevice *dev)
2245
{
2246
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2247
    int sg_version;
2248
    int rc;
2249

    
2250
    if (!s->qdev.conf.bs) {
2251
        error_report("scsi-block: drive property not set");
2252
        return -1;
2253
    }
2254

    
2255
    /* check we are using a driver managing SG_IO (version 3 and after) */
2256
    if (bdrv_ioctl(s->qdev.conf.bs, SG_GET_VERSION_NUM, &sg_version) < 0 ||
2257
        sg_version < 30000) {
2258
        error_report("scsi-block: scsi generic interface too old");
2259
        return -1;
2260
    }
2261

    
2262
    /* get device type from INQUIRY data */
2263
    rc = get_device_type(s);
2264
    if (rc < 0) {
2265
        error_report("scsi-block: INQUIRY failed");
2266
        return -1;
2267
    }
2268

    
2269
    /* Make a guess for the block size, we'll fix it when the guest sends.
2270
     * READ CAPACITY.  If they don't, they likely would assume these sizes
2271
     * anyway. (TODO: check in /sys).
2272
     */
2273
    if (s->qdev.type == TYPE_ROM || s->qdev.type == TYPE_WORM) {
2274
        s->qdev.blocksize = 2048;
2275
    } else {
2276
        s->qdev.blocksize = 512;
2277
    }
2278
    return scsi_initfn(&s->qdev);
2279
}
2280

    
2281
static SCSIRequest *scsi_block_new_request(SCSIDevice *d, uint32_t tag,
2282
                                           uint32_t lun, uint8_t *buf,
2283
                                           void *hba_private)
2284
{
2285
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2286

    
2287
    switch (buf[0]) {
2288
    case READ_6:
2289
    case READ_10:
2290
    case READ_12:
2291
    case READ_16:
2292
    case VERIFY_10:
2293
    case VERIFY_12:
2294
    case VERIFY_16:
2295
    case WRITE_6:
2296
    case WRITE_10:
2297
    case WRITE_12:
2298
    case WRITE_16:
2299
    case WRITE_VERIFY_10:
2300
    case WRITE_VERIFY_12:
2301
    case WRITE_VERIFY_16:
2302
        /* If we are not using O_DIRECT, we might read stale data from the
2303
         * host cache if writes were made using other commands than these
2304
         * ones (such as WRITE SAME or EXTENDED COPY, etc.).  So, without
2305
         * O_DIRECT everything must go through SG_IO.
2306
         */
2307
        if (bdrv_get_flags(s->qdev.conf.bs) & BDRV_O_NOCACHE) {
2308
            break;
2309
        }
2310

    
2311
        /* MMC writing cannot be done via pread/pwrite, because it sometimes
2312
         * involves writing beyond the maximum LBA or to negative LBA (lead-in).
2313
         * And once you do these writes, reading from the block device is
2314
         * unreliable, too.  It is even possible that reads deliver random data
2315
         * from the host page cache (this is probably a Linux bug).
2316
         *
2317
         * We might use scsi_disk_dma_reqops as long as no writing commands are
2318
         * seen, but performance usually isn't paramount on optical media.  So,
2319
         * just make scsi-block operate the same as scsi-generic for them.
2320
         */
2321
        if (s->qdev.type != TYPE_ROM) {
2322
            return scsi_req_alloc(&scsi_disk_dma_reqops, &s->qdev, tag, lun,
2323
                                  hba_private);
2324
        }
2325
    }
2326

    
2327
    return scsi_req_alloc(&scsi_generic_req_ops, &s->qdev, tag, lun,
2328
                          hba_private);
2329
}
2330
#endif
2331

    
2332
#define DEFINE_SCSI_DISK_PROPERTIES()                                \
2333
    DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf),               \
2334
    DEFINE_PROP_STRING("ver", SCSIDiskState, version),               \
2335
    DEFINE_PROP_STRING("serial", SCSIDiskState, serial),             \
2336
    DEFINE_PROP_STRING("vendor", SCSIDiskState, vendor),             \
2337
    DEFINE_PROP_STRING("product", SCSIDiskState, product)
2338

    
2339
static Property scsi_hd_properties[] = {
2340
    DEFINE_SCSI_DISK_PROPERTIES(),
2341
    DEFINE_PROP_BIT("removable", SCSIDiskState, features,
2342
                    SCSI_DISK_F_REMOVABLE, false),
2343
    DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
2344
                    SCSI_DISK_F_DPOFUA, false),
2345
    DEFINE_PROP_HEX64("wwn", SCSIDiskState, wwn, 0),
2346
    DEFINE_BLOCK_CHS_PROPERTIES(SCSIDiskState, qdev.conf),
2347
    DEFINE_PROP_END_OF_LIST(),
2348
};
2349

    
2350
static const VMStateDescription vmstate_scsi_disk_state = {
2351
    .name = "scsi-disk",
2352
    .version_id = 1,
2353
    .minimum_version_id = 1,
2354
    .minimum_version_id_old = 1,
2355
    .fields = (VMStateField[]) {
2356
        VMSTATE_SCSI_DEVICE(qdev, SCSIDiskState),
2357
        VMSTATE_BOOL(media_changed, SCSIDiskState),
2358
        VMSTATE_BOOL(media_event, SCSIDiskState),
2359
        VMSTATE_BOOL(eject_request, SCSIDiskState),
2360
        VMSTATE_BOOL(tray_open, SCSIDiskState),
2361
        VMSTATE_BOOL(tray_locked, SCSIDiskState),
2362
        VMSTATE_END_OF_LIST()
2363
    }
2364
};
2365

    
2366
static void scsi_hd_class_initfn(ObjectClass *klass, void *data)
2367
{
2368
    DeviceClass *dc = DEVICE_CLASS(klass);
2369
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2370

    
2371
    sc->init         = scsi_hd_initfn;
2372
    sc->destroy      = scsi_destroy;
2373
    sc->alloc_req    = scsi_new_request;
2374
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2375
    dc->fw_name = "disk";
2376
    dc->desc = "virtual SCSI disk";
2377
    dc->reset = scsi_disk_reset;
2378
    dc->props = scsi_hd_properties;
2379
    dc->vmsd  = &vmstate_scsi_disk_state;
2380
}
2381

    
2382
static TypeInfo scsi_hd_info = {
2383
    .name          = "scsi-hd",
2384
    .parent        = TYPE_SCSI_DEVICE,
2385
    .instance_size = sizeof(SCSIDiskState),
2386
    .class_init    = scsi_hd_class_initfn,
2387
};
2388

    
2389
static Property scsi_cd_properties[] = {
2390
    DEFINE_SCSI_DISK_PROPERTIES(),
2391
    DEFINE_PROP_HEX64("wwn", SCSIDiskState, wwn, 0),
2392
    DEFINE_PROP_END_OF_LIST(),
2393
};
2394

    
2395
static void scsi_cd_class_initfn(ObjectClass *klass, void *data)
2396
{
2397
    DeviceClass *dc = DEVICE_CLASS(klass);
2398
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2399

    
2400
    sc->init         = scsi_cd_initfn;
2401
    sc->destroy      = scsi_destroy;
2402
    sc->alloc_req    = scsi_new_request;
2403
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2404
    dc->fw_name = "disk";
2405
    dc->desc = "virtual SCSI CD-ROM";
2406
    dc->reset = scsi_disk_reset;
2407
    dc->props = scsi_cd_properties;
2408
    dc->vmsd  = &vmstate_scsi_disk_state;
2409
}
2410

    
2411
static TypeInfo scsi_cd_info = {
2412
    .name          = "scsi-cd",
2413
    .parent        = TYPE_SCSI_DEVICE,
2414
    .instance_size = sizeof(SCSIDiskState),
2415
    .class_init    = scsi_cd_class_initfn,
2416
};
2417

    
2418
#ifdef __linux__
2419
static Property scsi_block_properties[] = {
2420
    DEFINE_PROP_DRIVE("drive", SCSIDiskState, qdev.conf.bs),
2421
    DEFINE_PROP_INT32("bootindex", SCSIDiskState, qdev.conf.bootindex, -1),
2422
    DEFINE_PROP_END_OF_LIST(),
2423
};
2424

    
2425
static void scsi_block_class_initfn(ObjectClass *klass, void *data)
2426
{
2427
    DeviceClass *dc = DEVICE_CLASS(klass);
2428
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2429

    
2430
    sc->init         = scsi_block_initfn;
2431
    sc->destroy      = scsi_destroy;
2432
    sc->alloc_req    = scsi_block_new_request;
2433
    dc->fw_name = "disk";
2434
    dc->desc = "SCSI block device passthrough";
2435
    dc->reset = scsi_disk_reset;
2436
    dc->props = scsi_block_properties;
2437
    dc->vmsd  = &vmstate_scsi_disk_state;
2438
}
2439

    
2440
static TypeInfo scsi_block_info = {
2441
    .name          = "scsi-block",
2442
    .parent        = TYPE_SCSI_DEVICE,
2443
    .instance_size = sizeof(SCSIDiskState),
2444
    .class_init    = scsi_block_class_initfn,
2445
};
2446
#endif
2447

    
2448
static Property scsi_disk_properties[] = {
2449
    DEFINE_SCSI_DISK_PROPERTIES(),
2450
    DEFINE_PROP_BIT("removable", SCSIDiskState, features,
2451
                    SCSI_DISK_F_REMOVABLE, false),
2452
    DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
2453
                    SCSI_DISK_F_DPOFUA, false),
2454
    DEFINE_PROP_HEX64("wwn", SCSIDiskState, wwn, 0),
2455
    DEFINE_PROP_END_OF_LIST(),
2456
};
2457

    
2458
static void scsi_disk_class_initfn(ObjectClass *klass, void *data)
2459
{
2460
    DeviceClass *dc = DEVICE_CLASS(klass);
2461
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2462

    
2463
    sc->init         = scsi_disk_initfn;
2464
    sc->destroy      = scsi_destroy;
2465
    sc->alloc_req    = scsi_new_request;
2466
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2467
    dc->fw_name = "disk";
2468
    dc->desc = "virtual SCSI disk or CD-ROM (legacy)";
2469
    dc->reset = scsi_disk_reset;
2470
    dc->props = scsi_disk_properties;
2471
    dc->vmsd  = &vmstate_scsi_disk_state;
2472
}
2473

    
2474
static TypeInfo scsi_disk_info = {
2475
    .name          = "scsi-disk",
2476
    .parent        = TYPE_SCSI_DEVICE,
2477
    .instance_size = sizeof(SCSIDiskState),
2478
    .class_init    = scsi_disk_class_initfn,
2479
};
2480

    
2481
static void scsi_disk_register_types(void)
2482
{
2483
    type_register_static(&scsi_hd_info);
2484
    type_register_static(&scsi_cd_info);
2485
#ifdef __linux__
2486
    type_register_static(&scsi_block_info);
2487
#endif
2488
    type_register_static(&scsi_disk_info);
2489
}
2490

    
2491
type_init(scsi_disk_register_types)