Statistics
| Branch: | Revision:

root / hw / scsi-disk.c @ 9c17d615

History | View | Annotate | Download (74.2 kB)

1
/*
2
 * SCSI Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Based on code by Fabrice Bellard
6
 *
7
 * Written by Paul Brook
8
 * Modifications:
9
 *  2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10
 *                                 when the allocation length of CDB is smaller
11
 *                                 than 36.
12
 *  2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13
 *                                 MODE SENSE response.
14
 *
15
 * This code is licensed under the LGPL.
16
 *
17
 * Note that this file only handles the SCSI architecture model and device
18
 * commands.  Emulation of interface/link layer protocols is handled by
19
 * the host adapter emulator.
20
 */
21

    
22
//#define DEBUG_SCSI
23

    
24
#ifdef DEBUG_SCSI
25
#define DPRINTF(fmt, ...) \
26
do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
27
#else
28
#define DPRINTF(fmt, ...) do {} while(0)
29
#endif
30

    
31
#include "qemu-common.h"
32
#include "qemu/error-report.h"
33
#include "scsi.h"
34
#include "scsi-defs.h"
35
#include "sysemu/sysemu.h"
36
#include "sysemu/blockdev.h"
37
#include "hw/block-common.h"
38
#include "sysemu/dma.h"
39

    
40
#ifdef __linux
41
#include <scsi/sg.h>
42
#endif
43

    
44
#define SCSI_DMA_BUF_SIZE    131072
45
#define SCSI_MAX_INQUIRY_LEN 256
46
#define SCSI_MAX_MODE_LEN    256
47

    
48
typedef struct SCSIDiskState SCSIDiskState;
49

    
50
typedef struct SCSIDiskReq {
51
    SCSIRequest req;
52
    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
53
    uint64_t sector;
54
    uint32_t sector_count;
55
    uint32_t buflen;
56
    bool started;
57
    struct iovec iov;
58
    QEMUIOVector qiov;
59
    BlockAcctCookie acct;
60
} SCSIDiskReq;
61

    
62
#define SCSI_DISK_F_REMOVABLE   0
63
#define SCSI_DISK_F_DPOFUA      1
64

    
65
struct SCSIDiskState
66
{
67
    SCSIDevice qdev;
68
    uint32_t features;
69
    bool media_changed;
70
    bool media_event;
71
    bool eject_request;
72
    uint64_t wwn;
73
    QEMUBH *bh;
74
    char *version;
75
    char *serial;
76
    char *vendor;
77
    char *product;
78
    bool tray_open;
79
    bool tray_locked;
80
};
81

    
82
static int scsi_handle_rw_error(SCSIDiskReq *r, int error);
83

    
84
static void scsi_free_request(SCSIRequest *req)
85
{
86
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
87

    
88
    if (r->iov.iov_base) {
89
        qemu_vfree(r->iov.iov_base);
90
    }
91
}
92

    
93
/* Helper function for command completion with sense.  */
94
static void scsi_check_condition(SCSIDiskReq *r, SCSISense sense)
95
{
96
    DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
97
            r->req.tag, sense.key, sense.asc, sense.ascq);
98
    scsi_req_build_sense(&r->req, sense);
99
    scsi_req_complete(&r->req, CHECK_CONDITION);
100
}
101

    
102
/* Cancel a pending data transfer.  */
103
static void scsi_cancel_io(SCSIRequest *req)
104
{
105
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
106

    
107
    DPRINTF("Cancel tag=0x%x\n", req->tag);
108
    if (r->req.aiocb) {
109
        bdrv_aio_cancel(r->req.aiocb);
110

    
111
        /* This reference was left in by scsi_*_data.  We take ownership of
112
         * it the moment scsi_req_cancel is called, independent of whether
113
         * bdrv_aio_cancel completes the request or not.  */
114
        scsi_req_unref(&r->req);
115
    }
116
    r->req.aiocb = NULL;
117
}
118

    
119
static uint32_t scsi_init_iovec(SCSIDiskReq *r, size_t size)
120
{
121
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
122

    
123
    if (!r->iov.iov_base) {
124
        r->buflen = size;
125
        r->iov.iov_base = qemu_blockalign(s->qdev.conf.bs, r->buflen);
126
    }
127
    r->iov.iov_len = MIN(r->sector_count * 512, r->buflen);
128
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
129
    return r->qiov.size / 512;
130
}
131

    
132
static void scsi_disk_save_request(QEMUFile *f, SCSIRequest *req)
133
{
134
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
135

    
136
    qemu_put_be64s(f, &r->sector);
137
    qemu_put_be32s(f, &r->sector_count);
138
    qemu_put_be32s(f, &r->buflen);
139
    if (r->buflen) {
140
        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
141
            qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
142
        } else if (!req->retry) {
143
            uint32_t len = r->iov.iov_len;
144
            qemu_put_be32s(f, &len);
145
            qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
146
        }
147
    }
148
}
149

    
150
static void scsi_disk_load_request(QEMUFile *f, SCSIRequest *req)
151
{
152
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
153

    
154
    qemu_get_be64s(f, &r->sector);
155
    qemu_get_be32s(f, &r->sector_count);
156
    qemu_get_be32s(f, &r->buflen);
157
    if (r->buflen) {
158
        scsi_init_iovec(r, r->buflen);
159
        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
160
            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
161
        } else if (!r->req.retry) {
162
            uint32_t len;
163
            qemu_get_be32s(f, &len);
164
            r->iov.iov_len = len;
165
            assert(r->iov.iov_len <= r->buflen);
166
            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
167
        }
168
    }
169

    
170
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
171
}
172

    
173
static void scsi_aio_complete(void *opaque, int ret)
174
{
175
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
176
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
177

    
178
    assert(r->req.aiocb != NULL);
179
    r->req.aiocb = NULL;
180
    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
181

    
182
    if (ret < 0) {
183
        if (scsi_handle_rw_error(r, -ret)) {
184
            goto done;
185
        }
186
    }
187

    
188
    scsi_req_complete(&r->req, GOOD);
189

    
190
done:
191
    if (!r->req.io_canceled) {
192
        scsi_req_unref(&r->req);
193
    }
194
}
195

    
196
static bool scsi_is_cmd_fua(SCSICommand *cmd)
197
{
198
    switch (cmd->buf[0]) {
199
    case READ_10:
200
    case READ_12:
201
    case READ_16:
202
    case WRITE_10:
203
    case WRITE_12:
204
    case WRITE_16:
205
        return (cmd->buf[1] & 8) != 0;
206

    
207
    case VERIFY_10:
208
    case VERIFY_12:
209
    case VERIFY_16:
210
    case WRITE_VERIFY_10:
211
    case WRITE_VERIFY_12:
212
    case WRITE_VERIFY_16:
213
        return true;
214

    
215
    case READ_6:
216
    case WRITE_6:
217
    default:
218
        return false;
219
    }
220
}
221

    
222
static void scsi_write_do_fua(SCSIDiskReq *r)
223
{
224
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
225

    
226
    if (scsi_is_cmd_fua(&r->req.cmd)) {
227
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
228
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_aio_complete, r);
229
        return;
230
    }
231

    
232
    scsi_req_complete(&r->req, GOOD);
233
    if (!r->req.io_canceled) {
234
        scsi_req_unref(&r->req);
235
    }
236
}
237

    
238
static void scsi_dma_complete(void *opaque, int ret)
239
{
240
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
241
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
242

    
243
    assert(r->req.aiocb != NULL);
244
    r->req.aiocb = NULL;
245
    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
246

    
247
    if (ret < 0) {
248
        if (scsi_handle_rw_error(r, -ret)) {
249
            goto done;
250
        }
251
    }
252

    
253
    r->sector += r->sector_count;
254
    r->sector_count = 0;
255
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
256
        scsi_write_do_fua(r);
257
        return;
258
    } else {
259
        scsi_req_complete(&r->req, GOOD);
260
    }
261

    
262
done:
263
    if (!r->req.io_canceled) {
264
        scsi_req_unref(&r->req);
265
    }
266
}
267

    
268
static void scsi_read_complete(void * opaque, int ret)
269
{
270
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
271
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
272
    int n;
273

    
274
    assert(r->req.aiocb != NULL);
275
    r->req.aiocb = NULL;
276
    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
277

    
278
    if (ret < 0) {
279
        if (scsi_handle_rw_error(r, -ret)) {
280
            goto done;
281
        }
282
    }
283

    
284
    DPRINTF("Data ready tag=0x%x len=%zd\n", r->req.tag, r->qiov.size);
285

    
286
    n = r->qiov.size / 512;
287
    r->sector += n;
288
    r->sector_count -= n;
289
    scsi_req_data(&r->req, r->qiov.size);
290

    
291
done:
292
    if (!r->req.io_canceled) {
293
        scsi_req_unref(&r->req);
294
    }
295
}
296

    
297
/* Actually issue a read to the block device.  */
298
static void scsi_do_read(void *opaque, int ret)
299
{
300
    SCSIDiskReq *r = opaque;
301
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
302
    uint32_t n;
303

    
304
    if (r->req.aiocb != NULL) {
305
        r->req.aiocb = NULL;
306
        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
307
    }
308

    
309
    if (ret < 0) {
310
        if (scsi_handle_rw_error(r, -ret)) {
311
            goto done;
312
        }
313
    }
314

    
315
    if (r->req.io_canceled) {
316
        return;
317
    }
318

    
319
    /* The request is used as the AIO opaque value, so add a ref.  */
320
    scsi_req_ref(&r->req);
321

    
322
    if (r->req.sg) {
323
        dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ);
324
        r->req.resid -= r->req.sg->size;
325
        r->req.aiocb = dma_bdrv_read(s->qdev.conf.bs, r->req.sg, r->sector,
326
                                     scsi_dma_complete, r);
327
    } else {
328
        n = scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
329
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
330
        r->req.aiocb = bdrv_aio_readv(s->qdev.conf.bs, r->sector, &r->qiov, n,
331
                                      scsi_read_complete, r);
332
    }
333

    
334
done:
335
    if (!r->req.io_canceled) {
336
        scsi_req_unref(&r->req);
337
    }
338
}
339

    
340
/* Read more data from scsi device into buffer.  */
341
static void scsi_read_data(SCSIRequest *req)
342
{
343
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
344
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
345
    bool first;
346

    
347
    DPRINTF("Read sector_count=%d\n", r->sector_count);
348
    if (r->sector_count == 0) {
349
        /* This also clears the sense buffer for REQUEST SENSE.  */
350
        scsi_req_complete(&r->req, GOOD);
351
        return;
352
    }
353

    
354
    /* No data transfer may already be in progress */
355
    assert(r->req.aiocb == NULL);
356

    
357
    /* The request is used as the AIO opaque value, so add a ref.  */
358
    scsi_req_ref(&r->req);
359
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
360
        DPRINTF("Data transfer direction invalid\n");
361
        scsi_read_complete(r, -EINVAL);
362
        return;
363
    }
364

    
365
    if (s->tray_open) {
366
        scsi_read_complete(r, -ENOMEDIUM);
367
        return;
368
    }
369

    
370
    first = !r->started;
371
    r->started = true;
372
    if (first && scsi_is_cmd_fua(&r->req.cmd)) {
373
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
374
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_do_read, r);
375
    } else {
376
        scsi_do_read(r, 0);
377
    }
378
}
379

    
380
/*
381
 * scsi_handle_rw_error has two return values.  0 means that the error
382
 * must be ignored, 1 means that the error has been processed and the
383
 * caller should not do anything else for this request.  Note that
384
 * scsi_handle_rw_error always manages its reference counts, independent
385
 * of the return value.
386
 */
387
static int scsi_handle_rw_error(SCSIDiskReq *r, int error)
388
{
389
    bool is_read = (r->req.cmd.xfer == SCSI_XFER_FROM_DEV);
390
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
391
    BlockErrorAction action = bdrv_get_error_action(s->qdev.conf.bs, is_read, error);
392

    
393
    if (action == BDRV_ACTION_REPORT) {
394
        switch (error) {
395
        case ENOMEDIUM:
396
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
397
            break;
398
        case ENOMEM:
399
            scsi_check_condition(r, SENSE_CODE(TARGET_FAILURE));
400
            break;
401
        case EINVAL:
402
            scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
403
            break;
404
        default:
405
            scsi_check_condition(r, SENSE_CODE(IO_ERROR));
406
            break;
407
        }
408
    }
409
    bdrv_error_action(s->qdev.conf.bs, action, is_read, error);
410
    if (action == BDRV_ACTION_STOP) {
411
        scsi_req_retry(&r->req);
412
    }
413
    return action != BDRV_ACTION_IGNORE;
414
}
415

    
416
static void scsi_write_complete(void * opaque, int ret)
417
{
418
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
419
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
420
    uint32_t n;
421

    
422
    if (r->req.aiocb != NULL) {
423
        r->req.aiocb = NULL;
424
        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
425
    }
426

    
427
    if (ret < 0) {
428
        if (scsi_handle_rw_error(r, -ret)) {
429
            goto done;
430
        }
431
    }
432

    
433
    n = r->qiov.size / 512;
434
    r->sector += n;
435
    r->sector_count -= n;
436
    if (r->sector_count == 0) {
437
        scsi_write_do_fua(r);
438
        return;
439
    } else {
440
        scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
441
        DPRINTF("Write complete tag=0x%x more=%zd\n", r->req.tag, r->qiov.size);
442
        scsi_req_data(&r->req, r->qiov.size);
443
    }
444

    
445
done:
446
    if (!r->req.io_canceled) {
447
        scsi_req_unref(&r->req);
448
    }
449
}
450

    
451
static void scsi_write_data(SCSIRequest *req)
452
{
453
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
454
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
455
    uint32_t n;
456

    
457
    /* No data transfer may already be in progress */
458
    assert(r->req.aiocb == NULL);
459

    
460
    /* The request is used as the AIO opaque value, so add a ref.  */
461
    scsi_req_ref(&r->req);
462
    if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {
463
        DPRINTF("Data transfer direction invalid\n");
464
        scsi_write_complete(r, -EINVAL);
465
        return;
466
    }
467

    
468
    if (!r->req.sg && !r->qiov.size) {
469
        /* Called for the first time.  Ask the driver to send us more data.  */
470
        r->started = true;
471
        scsi_write_complete(r, 0);
472
        return;
473
    }
474
    if (s->tray_open) {
475
        scsi_write_complete(r, -ENOMEDIUM);
476
        return;
477
    }
478

    
479
    if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
480
        r->req.cmd.buf[0] == VERIFY_16) {
481
        if (r->req.sg) {
482
            scsi_dma_complete(r, 0);
483
        } else {
484
            scsi_write_complete(r, 0);
485
        }
486
        return;
487
    }
488

    
489
    if (r->req.sg) {
490
        dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_WRITE);
491
        r->req.resid -= r->req.sg->size;
492
        r->req.aiocb = dma_bdrv_write(s->qdev.conf.bs, r->req.sg, r->sector,
493
                                      scsi_dma_complete, r);
494
    } else {
495
        n = r->qiov.size / 512;
496
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_WRITE);
497
        r->req.aiocb = bdrv_aio_writev(s->qdev.conf.bs, r->sector, &r->qiov, n,
498
                                       scsi_write_complete, r);
499
    }
500
}
501

    
502
/* Return a pointer to the data buffer.  */
503
static uint8_t *scsi_get_buf(SCSIRequest *req)
504
{
505
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
506

    
507
    return (uint8_t *)r->iov.iov_base;
508
}
509

    
510
static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
511
{
512
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
513
    int buflen = 0;
514
    int start;
515

    
516
    if (req->cmd.buf[1] & 0x1) {
517
        /* Vital product data */
518
        uint8_t page_code = req->cmd.buf[2];
519

    
520
        outbuf[buflen++] = s->qdev.type & 0x1f;
521
        outbuf[buflen++] = page_code ; // this page
522
        outbuf[buflen++] = 0x00;
523
        outbuf[buflen++] = 0x00;
524
        start = buflen;
525

    
526
        switch (page_code) {
527
        case 0x00: /* Supported page codes, mandatory */
528
        {
529
            DPRINTF("Inquiry EVPD[Supported pages] "
530
                    "buffer size %zd\n", req->cmd.xfer);
531
            outbuf[buflen++] = 0x00; // list of supported pages (this page)
532
            if (s->serial) {
533
                outbuf[buflen++] = 0x80; // unit serial number
534
            }
535
            outbuf[buflen++] = 0x83; // device identification
536
            if (s->qdev.type == TYPE_DISK) {
537
                outbuf[buflen++] = 0xb0; // block limits
538
                outbuf[buflen++] = 0xb2; // thin provisioning
539
            }
540
            break;
541
        }
542
        case 0x80: /* Device serial number, optional */
543
        {
544
            int l;
545

    
546
            if (!s->serial) {
547
                DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
548
                return -1;
549
            }
550

    
551
            l = strlen(s->serial);
552
            if (l > 20) {
553
                l = 20;
554
            }
555

    
556
            DPRINTF("Inquiry EVPD[Serial number] "
557
                    "buffer size %zd\n", req->cmd.xfer);
558
            memcpy(outbuf+buflen, s->serial, l);
559
            buflen += l;
560
            break;
561
        }
562

    
563
        case 0x83: /* Device identification page, mandatory */
564
        {
565
            const char *str = s->serial ?: bdrv_get_device_name(s->qdev.conf.bs);
566
            int max_len = s->serial ? 20 : 255 - 8;
567
            int id_len = strlen(str);
568

    
569
            if (id_len > max_len) {
570
                id_len = max_len;
571
            }
572
            DPRINTF("Inquiry EVPD[Device identification] "
573
                    "buffer size %zd\n", req->cmd.xfer);
574

    
575
            outbuf[buflen++] = 0x2; // ASCII
576
            outbuf[buflen++] = 0;   // not officially assigned
577
            outbuf[buflen++] = 0;   // reserved
578
            outbuf[buflen++] = id_len; // length of data following
579
            memcpy(outbuf+buflen, str, id_len);
580
            buflen += id_len;
581

    
582
            if (s->wwn) {
583
                outbuf[buflen++] = 0x1; // Binary
584
                outbuf[buflen++] = 0x3; // NAA
585
                outbuf[buflen++] = 0;   // reserved
586
                outbuf[buflen++] = 8;
587
                stq_be_p(&outbuf[buflen], s->wwn);
588
                buflen += 8;
589
            }
590
            break;
591
        }
592
        case 0xb0: /* block limits */
593
        {
594
            unsigned int unmap_sectors =
595
                    s->qdev.conf.discard_granularity / s->qdev.blocksize;
596
            unsigned int min_io_size =
597
                    s->qdev.conf.min_io_size / s->qdev.blocksize;
598
            unsigned int opt_io_size =
599
                    s->qdev.conf.opt_io_size / s->qdev.blocksize;
600

    
601
            if (s->qdev.type == TYPE_ROM) {
602
                DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
603
                        page_code);
604
                return -1;
605
            }
606
            /* required VPD size with unmap support */
607
            buflen = 0x40;
608
            memset(outbuf + 4, 0, buflen - 4);
609

    
610
            /* optimal transfer length granularity */
611
            outbuf[6] = (min_io_size >> 8) & 0xff;
612
            outbuf[7] = min_io_size & 0xff;
613

    
614
            /* optimal transfer length */
615
            outbuf[12] = (opt_io_size >> 24) & 0xff;
616
            outbuf[13] = (opt_io_size >> 16) & 0xff;
617
            outbuf[14] = (opt_io_size >> 8) & 0xff;
618
            outbuf[15] = opt_io_size & 0xff;
619

    
620
            /* optimal unmap granularity */
621
            outbuf[28] = (unmap_sectors >> 24) & 0xff;
622
            outbuf[29] = (unmap_sectors >> 16) & 0xff;
623
            outbuf[30] = (unmap_sectors >> 8) & 0xff;
624
            outbuf[31] = unmap_sectors & 0xff;
625
            break;
626
        }
627
        case 0xb2: /* thin provisioning */
628
        {
629
            buflen = 8;
630
            outbuf[4] = 0;
631
            outbuf[5] = 0xe0; /* unmap & write_same 10/16 all supported */
632
            outbuf[6] = s->qdev.conf.discard_granularity ? 2 : 1;
633
            outbuf[7] = 0;
634
            break;
635
        }
636
        default:
637
            return -1;
638
        }
639
        /* done with EVPD */
640
        assert(buflen - start <= 255);
641
        outbuf[start - 1] = buflen - start;
642
        return buflen;
643
    }
644

    
645
    /* Standard INQUIRY data */
646
    if (req->cmd.buf[2] != 0) {
647
        return -1;
648
    }
649

    
650
    /* PAGE CODE == 0 */
651
    buflen = req->cmd.xfer;
652
    if (buflen > SCSI_MAX_INQUIRY_LEN) {
653
        buflen = SCSI_MAX_INQUIRY_LEN;
654
    }
655

    
656
    outbuf[0] = s->qdev.type & 0x1f;
657
    outbuf[1] = (s->features & (1 << SCSI_DISK_F_REMOVABLE)) ? 0x80 : 0;
658

    
659
    strpadcpy((char *) &outbuf[16], 16, s->product, ' ');
660
    strpadcpy((char *) &outbuf[8], 8, s->vendor, ' ');
661

    
662
    memset(&outbuf[32], 0, 4);
663
    memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version)));
664
    /*
665
     * We claim conformance to SPC-3, which is required for guests
666
     * to ask for modern features like READ CAPACITY(16) or the
667
     * block characteristics VPD page by default.  Not all of SPC-3
668
     * is actually implemented, but we're good enough.
669
     */
670
    outbuf[2] = 5;
671
    outbuf[3] = 2 | 0x10; /* Format 2, HiSup */
672

    
673
    if (buflen > 36) {
674
        outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
675
    } else {
676
        /* If the allocation length of CDB is too small,
677
               the additional length is not adjusted */
678
        outbuf[4] = 36 - 5;
679
    }
680

    
681
    /* Sync data transfer and TCQ.  */
682
    outbuf[7] = 0x10 | (req->bus->info->tcq ? 0x02 : 0);
683
    return buflen;
684
}
685

    
686
static inline bool media_is_dvd(SCSIDiskState *s)
687
{
688
    uint64_t nb_sectors;
689
    if (s->qdev.type != TYPE_ROM) {
690
        return false;
691
    }
692
    if (!bdrv_is_inserted(s->qdev.conf.bs)) {
693
        return false;
694
    }
695
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
696
    return nb_sectors > CD_MAX_SECTORS;
697
}
698

    
699
static inline bool media_is_cd(SCSIDiskState *s)
700
{
701
    uint64_t nb_sectors;
702
    if (s->qdev.type != TYPE_ROM) {
703
        return false;
704
    }
705
    if (!bdrv_is_inserted(s->qdev.conf.bs)) {
706
        return false;
707
    }
708
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
709
    return nb_sectors <= CD_MAX_SECTORS;
710
}
711

    
712
static int scsi_read_disc_information(SCSIDiskState *s, SCSIDiskReq *r,
713
                                      uint8_t *outbuf)
714
{
715
    uint8_t type = r->req.cmd.buf[1] & 7;
716

    
717
    if (s->qdev.type != TYPE_ROM) {
718
        return -1;
719
    }
720

    
721
    /* Types 1/2 are only defined for Blu-Ray.  */
722
    if (type != 0) {
723
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
724
        return -1;
725
    }
726

    
727
    memset(outbuf, 0, 34);
728
    outbuf[1] = 32;
729
    outbuf[2] = 0xe; /* last session complete, disc finalized */
730
    outbuf[3] = 1;   /* first track on disc */
731
    outbuf[4] = 1;   /* # of sessions */
732
    outbuf[5] = 1;   /* first track of last session */
733
    outbuf[6] = 1;   /* last track of last session */
734
    outbuf[7] = 0x20; /* unrestricted use */
735
    outbuf[8] = 0x00; /* CD-ROM or DVD-ROM */
736
    /* 9-10-11: most significant byte corresponding bytes 4-5-6 */
737
    /* 12-23: not meaningful for CD-ROM or DVD-ROM */
738
    /* 24-31: disc bar code */
739
    /* 32: disc application code */
740
    /* 33: number of OPC tables */
741

    
742
    return 34;
743
}
744

    
745
static int scsi_read_dvd_structure(SCSIDiskState *s, SCSIDiskReq *r,
746
                                   uint8_t *outbuf)
747
{
748
    static const int rds_caps_size[5] = {
749
        [0] = 2048 + 4,
750
        [1] = 4 + 4,
751
        [3] = 188 + 4,
752
        [4] = 2048 + 4,
753
    };
754

    
755
    uint8_t media = r->req.cmd.buf[1];
756
    uint8_t layer = r->req.cmd.buf[6];
757
    uint8_t format = r->req.cmd.buf[7];
758
    int size = -1;
759

    
760
    if (s->qdev.type != TYPE_ROM) {
761
        return -1;
762
    }
763
    if (media != 0) {
764
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
765
        return -1;
766
    }
767

    
768
    if (format != 0xff) {
769
        if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {
770
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
771
            return -1;
772
        }
773
        if (media_is_cd(s)) {
774
            scsi_check_condition(r, SENSE_CODE(INCOMPATIBLE_FORMAT));
775
            return -1;
776
        }
777
        if (format >= ARRAY_SIZE(rds_caps_size)) {
778
            return -1;
779
        }
780
        size = rds_caps_size[format];
781
        memset(outbuf, 0, size);
782
    }
783

    
784
    switch (format) {
785
    case 0x00: {
786
        /* Physical format information */
787
        uint64_t nb_sectors;
788
        if (layer != 0) {
789
            goto fail;
790
        }
791
        bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
792

    
793
        outbuf[4] = 1;   /* DVD-ROM, part version 1 */
794
        outbuf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
795
        outbuf[6] = 1;   /* one layer, read-only (per MMC-2 spec) */
796
        outbuf[7] = 0;   /* default densities */
797

    
798
        stl_be_p(&outbuf[12], (nb_sectors >> 2) - 1); /* end sector */
799
        stl_be_p(&outbuf[16], (nb_sectors >> 2) - 1); /* l0 end sector */
800
        break;
801
    }
802

    
803
    case 0x01: /* DVD copyright information, all zeros */
804
        break;
805

    
806
    case 0x03: /* BCA information - invalid field for no BCA info */
807
        return -1;
808

    
809
    case 0x04: /* DVD disc manufacturing information, all zeros */
810
        break;
811

    
812
    case 0xff: { /* List capabilities */
813
        int i;
814
        size = 4;
815
        for (i = 0; i < ARRAY_SIZE(rds_caps_size); i++) {
816
            if (!rds_caps_size[i]) {
817
                continue;
818
            }
819
            outbuf[size] = i;
820
            outbuf[size + 1] = 0x40; /* Not writable, readable */
821
            stw_be_p(&outbuf[size + 2], rds_caps_size[i]);
822
            size += 4;
823
        }
824
        break;
825
     }
826

    
827
    default:
828
        return -1;
829
    }
830

    
831
    /* Size of buffer, not including 2 byte size field */
832
    stw_be_p(outbuf, size - 2);
833
    return size;
834

    
835
fail:
836
    return -1;
837
}
838

    
839
static int scsi_event_status_media(SCSIDiskState *s, uint8_t *outbuf)
840
{
841
    uint8_t event_code, media_status;
842

    
843
    media_status = 0;
844
    if (s->tray_open) {
845
        media_status = MS_TRAY_OPEN;
846
    } else if (bdrv_is_inserted(s->qdev.conf.bs)) {
847
        media_status = MS_MEDIA_PRESENT;
848
    }
849

    
850
    /* Event notification descriptor */
851
    event_code = MEC_NO_CHANGE;
852
    if (media_status != MS_TRAY_OPEN) {
853
        if (s->media_event) {
854
            event_code = MEC_NEW_MEDIA;
855
            s->media_event = false;
856
        } else if (s->eject_request) {
857
            event_code = MEC_EJECT_REQUESTED;
858
            s->eject_request = false;
859
        }
860
    }
861

    
862
    outbuf[0] = event_code;
863
    outbuf[1] = media_status;
864

    
865
    /* These fields are reserved, just clear them. */
866
    outbuf[2] = 0;
867
    outbuf[3] = 0;
868
    return 4;
869
}
870

    
871
static int scsi_get_event_status_notification(SCSIDiskState *s, SCSIDiskReq *r,
872
                                              uint8_t *outbuf)
873
{
874
    int size;
875
    uint8_t *buf = r->req.cmd.buf;
876
    uint8_t notification_class_request = buf[4];
877
    if (s->qdev.type != TYPE_ROM) {
878
        return -1;
879
    }
880
    if ((buf[1] & 1) == 0) {
881
        /* asynchronous */
882
        return -1;
883
    }
884

    
885
    size = 4;
886
    outbuf[0] = outbuf[1] = 0;
887
    outbuf[3] = 1 << GESN_MEDIA; /* supported events */
888
    if (notification_class_request & (1 << GESN_MEDIA)) {
889
        outbuf[2] = GESN_MEDIA;
890
        size += scsi_event_status_media(s, &outbuf[size]);
891
    } else {
892
        outbuf[2] = 0x80;
893
    }
894
    stw_be_p(outbuf, size - 4);
895
    return size;
896
}
897

    
898
static int scsi_get_configuration(SCSIDiskState *s, uint8_t *outbuf)
899
{
900
    int current;
901

    
902
    if (s->qdev.type != TYPE_ROM) {
903
        return -1;
904
    }
905
    current = media_is_dvd(s) ? MMC_PROFILE_DVD_ROM : MMC_PROFILE_CD_ROM;
906
    memset(outbuf, 0, 40);
907
    stl_be_p(&outbuf[0], 36); /* Bytes after the data length field */
908
    stw_be_p(&outbuf[6], current);
909
    /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
910
    outbuf[10] = 0x03; /* persistent, current */
911
    outbuf[11] = 8; /* two profiles */
912
    stw_be_p(&outbuf[12], MMC_PROFILE_DVD_ROM);
913
    outbuf[14] = (current == MMC_PROFILE_DVD_ROM);
914
    stw_be_p(&outbuf[16], MMC_PROFILE_CD_ROM);
915
    outbuf[18] = (current == MMC_PROFILE_CD_ROM);
916
    /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
917
    stw_be_p(&outbuf[20], 1);
918
    outbuf[22] = 0x08 | 0x03; /* version 2, persistent, current */
919
    outbuf[23] = 8;
920
    stl_be_p(&outbuf[24], 1); /* SCSI */
921
    outbuf[28] = 1; /* DBE = 1, mandatory */
922
    /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
923
    stw_be_p(&outbuf[32], 3);
924
    outbuf[34] = 0x08 | 0x03; /* version 2, persistent, current */
925
    outbuf[35] = 4;
926
    outbuf[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
927
    /* TODO: Random readable, CD read, DVD read, drive serial number,
928
       power management */
929
    return 40;
930
}
931

    
932
static int scsi_emulate_mechanism_status(SCSIDiskState *s, uint8_t *outbuf)
933
{
934
    if (s->qdev.type != TYPE_ROM) {
935
        return -1;
936
    }
937
    memset(outbuf, 0, 8);
938
    outbuf[5] = 1; /* CD-ROM */
939
    return 8;
940
}
941

    
942
static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
943
                           int page_control)
944
{
945
    static const int mode_sense_valid[0x3f] = {
946
        [MODE_PAGE_HD_GEOMETRY]            = (1 << TYPE_DISK),
947
        [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY] = (1 << TYPE_DISK),
948
        [MODE_PAGE_CACHING]                = (1 << TYPE_DISK) | (1 << TYPE_ROM),
949
        [MODE_PAGE_R_W_ERROR]              = (1 << TYPE_DISK) | (1 << TYPE_ROM),
950
        [MODE_PAGE_AUDIO_CTL]              = (1 << TYPE_ROM),
951
        [MODE_PAGE_CAPABILITIES]           = (1 << TYPE_ROM),
952
    };
953

    
954
    uint8_t *p = *p_outbuf + 2;
955
    int length;
956

    
957
    if ((mode_sense_valid[page] & (1 << s->qdev.type)) == 0) {
958
        return -1;
959
    }
960

    
961
    /*
962
     * If Changeable Values are requested, a mask denoting those mode parameters
963
     * that are changeable shall be returned. As we currently don't support
964
     * parameter changes via MODE_SELECT all bits are returned set to zero.
965
     * The buffer was already menset to zero by the caller of this function.
966
     *
967
     * The offsets here are off by two compared to the descriptions in the
968
     * SCSI specs, because those include a 2-byte header.  This is unfortunate,
969
     * but it is done so that offsets are consistent within our implementation
970
     * of MODE SENSE and MODE SELECT.  MODE SELECT has to deal with both
971
     * 2-byte and 4-byte headers.
972
     */
973
    switch (page) {
974
    case MODE_PAGE_HD_GEOMETRY:
975
        length = 0x16;
976
        if (page_control == 1) { /* Changeable Values */
977
            break;
978
        }
979
        /* if a geometry hint is available, use it */
980
        p[0] = (s->qdev.conf.cyls >> 16) & 0xff;
981
        p[1] = (s->qdev.conf.cyls >> 8) & 0xff;
982
        p[2] = s->qdev.conf.cyls & 0xff;
983
        p[3] = s->qdev.conf.heads & 0xff;
984
        /* Write precomp start cylinder, disabled */
985
        p[4] = (s->qdev.conf.cyls >> 16) & 0xff;
986
        p[5] = (s->qdev.conf.cyls >> 8) & 0xff;
987
        p[6] = s->qdev.conf.cyls & 0xff;
988
        /* Reduced current start cylinder, disabled */
989
        p[7] = (s->qdev.conf.cyls >> 16) & 0xff;
990
        p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
991
        p[9] = s->qdev.conf.cyls & 0xff;
992
        /* Device step rate [ns], 200ns */
993
        p[10] = 0;
994
        p[11] = 200;
995
        /* Landing zone cylinder */
996
        p[12] = 0xff;
997
        p[13] =  0xff;
998
        p[14] = 0xff;
999
        /* Medium rotation rate [rpm], 5400 rpm */
1000
        p[18] = (5400 >> 8) & 0xff;
1001
        p[19] = 5400 & 0xff;
1002
        break;
1003

    
1004
    case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY:
1005
        length = 0x1e;
1006
        if (page_control == 1) { /* Changeable Values */
1007
            break;
1008
        }
1009
        /* Transfer rate [kbit/s], 5Mbit/s */
1010
        p[0] = 5000 >> 8;
1011
        p[1] = 5000 & 0xff;
1012
        /* if a geometry hint is available, use it */
1013
        p[2] = s->qdev.conf.heads & 0xff;
1014
        p[3] = s->qdev.conf.secs & 0xff;
1015
        p[4] = s->qdev.blocksize >> 8;
1016
        p[6] = (s->qdev.conf.cyls >> 8) & 0xff;
1017
        p[7] = s->qdev.conf.cyls & 0xff;
1018
        /* Write precomp start cylinder, disabled */
1019
        p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
1020
        p[9] = s->qdev.conf.cyls & 0xff;
1021
        /* Reduced current start cylinder, disabled */
1022
        p[10] = (s->qdev.conf.cyls >> 8) & 0xff;
1023
        p[11] = s->qdev.conf.cyls & 0xff;
1024
        /* Device step rate [100us], 100us */
1025
        p[12] = 0;
1026
        p[13] = 1;
1027
        /* Device step pulse width [us], 1us */
1028
        p[14] = 1;
1029
        /* Device head settle delay [100us], 100us */
1030
        p[15] = 0;
1031
        p[16] = 1;
1032
        /* Motor on delay [0.1s], 0.1s */
1033
        p[17] = 1;
1034
        /* Motor off delay [0.1s], 0.1s */
1035
        p[18] = 1;
1036
        /* Medium rotation rate [rpm], 5400 rpm */
1037
        p[26] = (5400 >> 8) & 0xff;
1038
        p[27] = 5400 & 0xff;
1039
        break;
1040

    
1041
    case MODE_PAGE_CACHING:
1042
        length = 0x12;
1043
        if (page_control == 1 || /* Changeable Values */
1044
            bdrv_enable_write_cache(s->qdev.conf.bs)) {
1045
            p[0] = 4; /* WCE */
1046
        }
1047
        break;
1048

    
1049
    case MODE_PAGE_R_W_ERROR:
1050
        length = 10;
1051
        if (page_control == 1) { /* Changeable Values */
1052
            break;
1053
        }
1054
        p[0] = 0x80; /* Automatic Write Reallocation Enabled */
1055
        if (s->qdev.type == TYPE_ROM) {
1056
            p[1] = 0x20; /* Read Retry Count */
1057
        }
1058
        break;
1059

    
1060
    case MODE_PAGE_AUDIO_CTL:
1061
        length = 14;
1062
        break;
1063

    
1064
    case MODE_PAGE_CAPABILITIES:
1065
        length = 0x14;
1066
        if (page_control == 1) { /* Changeable Values */
1067
            break;
1068
        }
1069

    
1070
        p[0] = 0x3b; /* CD-R & CD-RW read */
1071
        p[1] = 0; /* Writing not supported */
1072
        p[2] = 0x7f; /* Audio, composite, digital out,
1073
                        mode 2 form 1&2, multi session */
1074
        p[3] = 0xff; /* CD DA, DA accurate, RW supported,
1075
                        RW corrected, C2 errors, ISRC,
1076
                        UPC, Bar code */
1077
        p[4] = 0x2d | (s->tray_locked ? 2 : 0);
1078
        /* Locking supported, jumper present, eject, tray */
1079
        p[5] = 0; /* no volume & mute control, no
1080
                     changer */
1081
        p[6] = (50 * 176) >> 8; /* 50x read speed */
1082
        p[7] = (50 * 176) & 0xff;
1083
        p[8] = 2 >> 8; /* Two volume levels */
1084
        p[9] = 2 & 0xff;
1085
        p[10] = 2048 >> 8; /* 2M buffer */
1086
        p[11] = 2048 & 0xff;
1087
        p[12] = (16 * 176) >> 8; /* 16x read speed current */
1088
        p[13] = (16 * 176) & 0xff;
1089
        p[16] = (16 * 176) >> 8; /* 16x write speed */
1090
        p[17] = (16 * 176) & 0xff;
1091
        p[18] = (16 * 176) >> 8; /* 16x write speed current */
1092
        p[19] = (16 * 176) & 0xff;
1093
        break;
1094

    
1095
    default:
1096
        return -1;
1097
    }
1098

    
1099
    assert(length < 256);
1100
    (*p_outbuf)[0] = page;
1101
    (*p_outbuf)[1] = length;
1102
    *p_outbuf += length + 2;
1103
    return length + 2;
1104
}
1105

    
1106
static int scsi_disk_emulate_mode_sense(SCSIDiskReq *r, uint8_t *outbuf)
1107
{
1108
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1109
    uint64_t nb_sectors;
1110
    bool dbd;
1111
    int page, buflen, ret, page_control;
1112
    uint8_t *p;
1113
    uint8_t dev_specific_param;
1114

    
1115
    dbd = (r->req.cmd.buf[1] & 0x8) != 0;
1116
    page = r->req.cmd.buf[2] & 0x3f;
1117
    page_control = (r->req.cmd.buf[2] & 0xc0) >> 6;
1118
    DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
1119
        (r->req.cmd.buf[0] == MODE_SENSE) ? 6 : 10, page, r->req.cmd.xfer, page_control);
1120
    memset(outbuf, 0, r->req.cmd.xfer);
1121
    p = outbuf;
1122

    
1123
    if (s->qdev.type == TYPE_DISK) {
1124
        dev_specific_param = s->features & (1 << SCSI_DISK_F_DPOFUA) ? 0x10 : 0;
1125
        if (bdrv_is_read_only(s->qdev.conf.bs)) {
1126
            dev_specific_param |= 0x80; /* Readonly.  */
1127
        }
1128
    } else {
1129
        /* MMC prescribes that CD/DVD drives have no block descriptors,
1130
         * and defines no device-specific parameter.  */
1131
        dev_specific_param = 0x00;
1132
        dbd = true;
1133
    }
1134

    
1135
    if (r->req.cmd.buf[0] == MODE_SENSE) {
1136
        p[1] = 0; /* Default media type.  */
1137
        p[2] = dev_specific_param;
1138
        p[3] = 0; /* Block descriptor length.  */
1139
        p += 4;
1140
    } else { /* MODE_SENSE_10 */
1141
        p[2] = 0; /* Default media type.  */
1142
        p[3] = dev_specific_param;
1143
        p[6] = p[7] = 0; /* Block descriptor length.  */
1144
        p += 8;
1145
    }
1146

    
1147
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1148
    if (!dbd && nb_sectors) {
1149
        if (r->req.cmd.buf[0] == MODE_SENSE) {
1150
            outbuf[3] = 8; /* Block descriptor length  */
1151
        } else { /* MODE_SENSE_10 */
1152
            outbuf[7] = 8; /* Block descriptor length  */
1153
        }
1154
        nb_sectors /= (s->qdev.blocksize / 512);
1155
        if (nb_sectors > 0xffffff) {
1156
            nb_sectors = 0;
1157
        }
1158
        p[0] = 0; /* media density code */
1159
        p[1] = (nb_sectors >> 16) & 0xff;
1160
        p[2] = (nb_sectors >> 8) & 0xff;
1161
        p[3] = nb_sectors & 0xff;
1162
        p[4] = 0; /* reserved */
1163
        p[5] = 0; /* bytes 5-7 are the sector size in bytes */
1164
        p[6] = s->qdev.blocksize >> 8;
1165
        p[7] = 0;
1166
        p += 8;
1167
    }
1168

    
1169
    if (page_control == 3) {
1170
        /* Saved Values */
1171
        scsi_check_condition(r, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED));
1172
        return -1;
1173
    }
1174

    
1175
    if (page == 0x3f) {
1176
        for (page = 0; page <= 0x3e; page++) {
1177
            mode_sense_page(s, page, &p, page_control);
1178
        }
1179
    } else {
1180
        ret = mode_sense_page(s, page, &p, page_control);
1181
        if (ret == -1) {
1182
            return -1;
1183
        }
1184
    }
1185

    
1186
    buflen = p - outbuf;
1187
    /*
1188
     * The mode data length field specifies the length in bytes of the
1189
     * following data that is available to be transferred. The mode data
1190
     * length does not include itself.
1191
     */
1192
    if (r->req.cmd.buf[0] == MODE_SENSE) {
1193
        outbuf[0] = buflen - 1;
1194
    } else { /* MODE_SENSE_10 */
1195
        outbuf[0] = ((buflen - 2) >> 8) & 0xff;
1196
        outbuf[1] = (buflen - 2) & 0xff;
1197
    }
1198
    return buflen;
1199
}
1200

    
1201
static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)
1202
{
1203
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1204
    int start_track, format, msf, toclen;
1205
    uint64_t nb_sectors;
1206

    
1207
    msf = req->cmd.buf[1] & 2;
1208
    format = req->cmd.buf[2] & 0xf;
1209
    start_track = req->cmd.buf[6];
1210
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1211
    DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
1212
    nb_sectors /= s->qdev.blocksize / 512;
1213
    switch (format) {
1214
    case 0:
1215
        toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
1216
        break;
1217
    case 1:
1218
        /* multi session : only a single session defined */
1219
        toclen = 12;
1220
        memset(outbuf, 0, 12);
1221
        outbuf[1] = 0x0a;
1222
        outbuf[2] = 0x01;
1223
        outbuf[3] = 0x01;
1224
        break;
1225
    case 2:
1226
        toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
1227
        break;
1228
    default:
1229
        return -1;
1230
    }
1231
    return toclen;
1232
}
1233

    
1234
static int scsi_disk_emulate_start_stop(SCSIDiskReq *r)
1235
{
1236
    SCSIRequest *req = &r->req;
1237
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1238
    bool start = req->cmd.buf[4] & 1;
1239
    bool loej = req->cmd.buf[4] & 2; /* load on start, eject on !start */
1240
    int pwrcnd = req->cmd.buf[4] & 0xf0;
1241

    
1242
    if (pwrcnd) {
1243
        /* eject/load only happens for power condition == 0 */
1244
        return 0;
1245
    }
1246

    
1247
    if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) && loej) {
1248
        if (!start && !s->tray_open && s->tray_locked) {
1249
            scsi_check_condition(r,
1250
                                 bdrv_is_inserted(s->qdev.conf.bs)
1251
                                 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED)
1252
                                 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED));
1253
            return -1;
1254
        }
1255

    
1256
        if (s->tray_open != !start) {
1257
            bdrv_eject(s->qdev.conf.bs, !start);
1258
            s->tray_open = !start;
1259
        }
1260
    }
1261
    return 0;
1262
}
1263

    
1264
static void scsi_disk_emulate_read_data(SCSIRequest *req)
1265
{
1266
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1267
    int buflen = r->iov.iov_len;
1268

    
1269
    if (buflen) {
1270
        DPRINTF("Read buf_len=%d\n", buflen);
1271
        r->iov.iov_len = 0;
1272
        r->started = true;
1273
        scsi_req_data(&r->req, buflen);
1274
        return;
1275
    }
1276

    
1277
    /* This also clears the sense buffer for REQUEST SENSE.  */
1278
    scsi_req_complete(&r->req, GOOD);
1279
}
1280

    
1281
static int scsi_disk_check_mode_select(SCSIDiskState *s, int page,
1282
                                       uint8_t *inbuf, int inlen)
1283
{
1284
    uint8_t mode_current[SCSI_MAX_MODE_LEN];
1285
    uint8_t mode_changeable[SCSI_MAX_MODE_LEN];
1286
    uint8_t *p;
1287
    int len, expected_len, changeable_len, i;
1288

    
1289
    /* The input buffer does not include the page header, so it is
1290
     * off by 2 bytes.
1291
     */
1292
    expected_len = inlen + 2;
1293
    if (expected_len > SCSI_MAX_MODE_LEN) {
1294
        return -1;
1295
    }
1296

    
1297
    p = mode_current;
1298
    memset(mode_current, 0, inlen + 2);
1299
    len = mode_sense_page(s, page, &p, 0);
1300
    if (len < 0 || len != expected_len) {
1301
        return -1;
1302
    }
1303

    
1304
    p = mode_changeable;
1305
    memset(mode_changeable, 0, inlen + 2);
1306
    changeable_len = mode_sense_page(s, page, &p, 1);
1307
    assert(changeable_len == len);
1308

    
1309
    /* Check that unchangeable bits are the same as what MODE SENSE
1310
     * would return.
1311
     */
1312
    for (i = 2; i < len; i++) {
1313
        if (((mode_current[i] ^ inbuf[i - 2]) & ~mode_changeable[i]) != 0) {
1314
            return -1;
1315
        }
1316
    }
1317
    return 0;
1318
}
1319

    
1320
static void scsi_disk_apply_mode_select(SCSIDiskState *s, int page, uint8_t *p)
1321
{
1322
    switch (page) {
1323
    case MODE_PAGE_CACHING:
1324
        bdrv_set_enable_write_cache(s->qdev.conf.bs, (p[0] & 4) != 0);
1325
        break;
1326

    
1327
    default:
1328
        break;
1329
    }
1330
}
1331

    
1332
static int mode_select_pages(SCSIDiskReq *r, uint8_t *p, int len, bool change)
1333
{
1334
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1335

    
1336
    while (len > 0) {
1337
        int page, subpage, page_len;
1338

    
1339
        /* Parse both possible formats for the mode page headers.  */
1340
        page = p[0] & 0x3f;
1341
        if (p[0] & 0x40) {
1342
            if (len < 4) {
1343
                goto invalid_param_len;
1344
            }
1345
            subpage = p[1];
1346
            page_len = lduw_be_p(&p[2]);
1347
            p += 4;
1348
            len -= 4;
1349
        } else {
1350
            if (len < 2) {
1351
                goto invalid_param_len;
1352
            }
1353
            subpage = 0;
1354
            page_len = p[1];
1355
            p += 2;
1356
            len -= 2;
1357
        }
1358

    
1359
        if (subpage) {
1360
            goto invalid_param;
1361
        }
1362
        if (page_len > len) {
1363
            goto invalid_param_len;
1364
        }
1365

    
1366
        if (!change) {
1367
            if (scsi_disk_check_mode_select(s, page, p, page_len) < 0) {
1368
                goto invalid_param;
1369
            }
1370
        } else {
1371
            scsi_disk_apply_mode_select(s, page, p);
1372
        }
1373

    
1374
        p += page_len;
1375
        len -= page_len;
1376
    }
1377
    return 0;
1378

    
1379
invalid_param:
1380
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1381
    return -1;
1382

    
1383
invalid_param_len:
1384
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1385
    return -1;
1386
}
1387

    
1388
static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf)
1389
{
1390
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1391
    uint8_t *p = inbuf;
1392
    int cmd = r->req.cmd.buf[0];
1393
    int len = r->req.cmd.xfer;
1394
    int hdr_len = (cmd == MODE_SELECT ? 4 : 8);
1395
    int bd_len;
1396
    int pass;
1397

    
1398
    /* We only support PF=1, SP=0.  */
1399
    if ((r->req.cmd.buf[1] & 0x11) != 0x10) {
1400
        goto invalid_field;
1401
    }
1402

    
1403
    if (len < hdr_len) {
1404
        goto invalid_param_len;
1405
    }
1406

    
1407
    bd_len = (cmd == MODE_SELECT ? p[3] : lduw_be_p(&p[6]));
1408
    len -= hdr_len;
1409
    p += hdr_len;
1410
    if (len < bd_len) {
1411
        goto invalid_param_len;
1412
    }
1413
    if (bd_len != 0 && bd_len != 8) {
1414
        goto invalid_param;
1415
    }
1416

    
1417
    len -= bd_len;
1418
    p += bd_len;
1419

    
1420
    /* Ensure no change is made if there is an error!  */
1421
    for (pass = 0; pass < 2; pass++) {
1422
        if (mode_select_pages(r, p, len, pass == 1) < 0) {
1423
            assert(pass == 0);
1424
            return;
1425
        }
1426
    }
1427
    if (!bdrv_enable_write_cache(s->qdev.conf.bs)) {
1428
        /* The request is used as the AIO opaque value, so add a ref.  */
1429
        scsi_req_ref(&r->req);
1430
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
1431
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_aio_complete, r);
1432
        return;
1433
    }
1434

    
1435
    scsi_req_complete(&r->req, GOOD);
1436
    return;
1437

    
1438
invalid_param:
1439
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1440
    return;
1441

    
1442
invalid_param_len:
1443
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1444
    return;
1445

    
1446
invalid_field:
1447
    scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1448
}
1449

    
1450
static inline bool check_lba_range(SCSIDiskState *s,
1451
                                   uint64_t sector_num, uint32_t nb_sectors)
1452
{
1453
    /*
1454
     * The first line tests that no overflow happens when computing the last
1455
     * sector.  The second line tests that the last accessed sector is in
1456
     * range.
1457
     *
1458
     * Careful, the computations should not underflow for nb_sectors == 0,
1459
     * and a 0-block read to the first LBA beyond the end of device is
1460
     * valid.
1461
     */
1462
    return (sector_num <= sector_num + nb_sectors &&
1463
            sector_num + nb_sectors <= s->qdev.max_lba + 1);
1464
}
1465

    
1466
typedef struct UnmapCBData {
1467
    SCSIDiskReq *r;
1468
    uint8_t *inbuf;
1469
    int count;
1470
} UnmapCBData;
1471

    
1472
static void scsi_unmap_complete(void *opaque, int ret)
1473
{
1474
    UnmapCBData *data = opaque;
1475
    SCSIDiskReq *r = data->r;
1476
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1477
    uint64_t sector_num;
1478
    uint32_t nb_sectors;
1479

    
1480
    r->req.aiocb = NULL;
1481
    if (ret < 0) {
1482
        if (scsi_handle_rw_error(r, -ret)) {
1483
            goto done;
1484
        }
1485
    }
1486

    
1487
    if (data->count > 0 && !r->req.io_canceled) {
1488
        sector_num = ldq_be_p(&data->inbuf[0]);
1489
        nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
1490
        if (!check_lba_range(s, sector_num, nb_sectors)) {
1491
            scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1492
            goto done;
1493
        }
1494

    
1495
        r->req.aiocb = bdrv_aio_discard(s->qdev.conf.bs,
1496
                                        sector_num * (s->qdev.blocksize / 512),
1497
                                        nb_sectors * (s->qdev.blocksize / 512),
1498
                                        scsi_unmap_complete, data);
1499
        data->count--;
1500
        data->inbuf += 16;
1501
        return;
1502
    }
1503

    
1504
done:
1505
    if (data->count == 0) {
1506
        scsi_req_complete(&r->req, GOOD);
1507
    }
1508
    if (!r->req.io_canceled) {
1509
        scsi_req_unref(&r->req);
1510
    }
1511
    g_free(data);
1512
}
1513

    
1514
static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf)
1515
{
1516
    uint8_t *p = inbuf;
1517
    int len = r->req.cmd.xfer;
1518
    UnmapCBData *data;
1519

    
1520
    if (len < 8) {
1521
        goto invalid_param_len;
1522
    }
1523
    if (len < lduw_be_p(&p[0]) + 2) {
1524
        goto invalid_param_len;
1525
    }
1526
    if (len < lduw_be_p(&p[2]) + 8) {
1527
        goto invalid_param_len;
1528
    }
1529
    if (lduw_be_p(&p[2]) & 15) {
1530
        goto invalid_param_len;
1531
    }
1532

    
1533
    data = g_new0(UnmapCBData, 1);
1534
    data->r = r;
1535
    data->inbuf = &p[8];
1536
    data->count = lduw_be_p(&p[2]) >> 4;
1537

    
1538
    /* The matching unref is in scsi_unmap_complete, before data is freed.  */
1539
    scsi_req_ref(&r->req);
1540
    scsi_unmap_complete(data, 0);
1541
    return;
1542

    
1543
invalid_param_len:
1544
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1545
}
1546

    
1547
static void scsi_disk_emulate_write_data(SCSIRequest *req)
1548
{
1549
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1550

    
1551
    if (r->iov.iov_len) {
1552
        int buflen = r->iov.iov_len;
1553
        DPRINTF("Write buf_len=%d\n", buflen);
1554
        r->iov.iov_len = 0;
1555
        scsi_req_data(&r->req, buflen);
1556
        return;
1557
    }
1558

    
1559
    switch (req->cmd.buf[0]) {
1560
    case MODE_SELECT:
1561
    case MODE_SELECT_10:
1562
        /* This also clears the sense buffer for REQUEST SENSE.  */
1563
        scsi_disk_emulate_mode_select(r, r->iov.iov_base);
1564
        break;
1565

    
1566
    case UNMAP:
1567
        scsi_disk_emulate_unmap(r, r->iov.iov_base);
1568
        break;
1569

    
1570
    default:
1571
        abort();
1572
    }
1573
}
1574

    
1575
static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf)
1576
{
1577
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1578
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1579
    uint64_t nb_sectors;
1580
    uint8_t *outbuf;
1581
    int buflen;
1582

    
1583
    switch (req->cmd.buf[0]) {
1584
    case INQUIRY:
1585
    case MODE_SENSE:
1586
    case MODE_SENSE_10:
1587
    case RESERVE:
1588
    case RESERVE_10:
1589
    case RELEASE:
1590
    case RELEASE_10:
1591
    case START_STOP:
1592
    case ALLOW_MEDIUM_REMOVAL:
1593
    case GET_CONFIGURATION:
1594
    case GET_EVENT_STATUS_NOTIFICATION:
1595
    case MECHANISM_STATUS:
1596
    case REQUEST_SENSE:
1597
        break;
1598

    
1599
    default:
1600
        if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {
1601
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
1602
            return 0;
1603
        }
1604
        break;
1605
    }
1606

    
1607
    /*
1608
     * FIXME: we shouldn't return anything bigger than 4k, but the code
1609
     * requires the buffer to be as big as req->cmd.xfer in several
1610
     * places.  So, do not allow CDBs with a very large ALLOCATION
1611
     * LENGTH.  The real fix would be to modify scsi_read_data and
1612
     * dma_buf_read, so that they return data beyond the buflen
1613
     * as all zeros.
1614
     */
1615
    if (req->cmd.xfer > 65536) {
1616
        goto illegal_request;
1617
    }
1618
    r->buflen = MAX(4096, req->cmd.xfer);
1619

    
1620
    if (!r->iov.iov_base) {
1621
        r->iov.iov_base = qemu_blockalign(s->qdev.conf.bs, r->buflen);
1622
    }
1623

    
1624
    buflen = req->cmd.xfer;
1625
    outbuf = r->iov.iov_base;
1626
    memset(outbuf, 0, r->buflen);
1627
    switch (req->cmd.buf[0]) {
1628
    case TEST_UNIT_READY:
1629
        assert(!s->tray_open && bdrv_is_inserted(s->qdev.conf.bs));
1630
        break;
1631
    case INQUIRY:
1632
        buflen = scsi_disk_emulate_inquiry(req, outbuf);
1633
        if (buflen < 0) {
1634
            goto illegal_request;
1635
        }
1636
        break;
1637
    case MODE_SENSE:
1638
    case MODE_SENSE_10:
1639
        buflen = scsi_disk_emulate_mode_sense(r, outbuf);
1640
        if (buflen < 0) {
1641
            goto illegal_request;
1642
        }
1643
        break;
1644
    case READ_TOC:
1645
        buflen = scsi_disk_emulate_read_toc(req, outbuf);
1646
        if (buflen < 0) {
1647
            goto illegal_request;
1648
        }
1649
        break;
1650
    case RESERVE:
1651
        if (req->cmd.buf[1] & 1) {
1652
            goto illegal_request;
1653
        }
1654
        break;
1655
    case RESERVE_10:
1656
        if (req->cmd.buf[1] & 3) {
1657
            goto illegal_request;
1658
        }
1659
        break;
1660
    case RELEASE:
1661
        if (req->cmd.buf[1] & 1) {
1662
            goto illegal_request;
1663
        }
1664
        break;
1665
    case RELEASE_10:
1666
        if (req->cmd.buf[1] & 3) {
1667
            goto illegal_request;
1668
        }
1669
        break;
1670
    case START_STOP:
1671
        if (scsi_disk_emulate_start_stop(r) < 0) {
1672
            return 0;
1673
        }
1674
        break;
1675
    case ALLOW_MEDIUM_REMOVAL:
1676
        s->tray_locked = req->cmd.buf[4] & 1;
1677
        bdrv_lock_medium(s->qdev.conf.bs, req->cmd.buf[4] & 1);
1678
        break;
1679
    case READ_CAPACITY_10:
1680
        /* The normal LEN field for this command is zero.  */
1681
        memset(outbuf, 0, 8);
1682
        bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1683
        if (!nb_sectors) {
1684
            scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
1685
            return -1;
1686
        }
1687
        if ((req->cmd.buf[8] & 1) == 0 && req->cmd.lba) {
1688
            goto illegal_request;
1689
        }
1690
        nb_sectors /= s->qdev.blocksize / 512;
1691
        /* Returned value is the address of the last sector.  */
1692
        nb_sectors--;
1693
        /* Remember the new size for read/write sanity checking. */
1694
        s->qdev.max_lba = nb_sectors;
1695
        /* Clip to 2TB, instead of returning capacity modulo 2TB. */
1696
        if (nb_sectors > UINT32_MAX) {
1697
            nb_sectors = UINT32_MAX;
1698
        }
1699
        outbuf[0] = (nb_sectors >> 24) & 0xff;
1700
        outbuf[1] = (nb_sectors >> 16) & 0xff;
1701
        outbuf[2] = (nb_sectors >> 8) & 0xff;
1702
        outbuf[3] = nb_sectors & 0xff;
1703
        outbuf[4] = 0;
1704
        outbuf[5] = 0;
1705
        outbuf[6] = s->qdev.blocksize >> 8;
1706
        outbuf[7] = 0;
1707
        break;
1708
    case REQUEST_SENSE:
1709
        /* Just return "NO SENSE".  */
1710
        buflen = scsi_build_sense(NULL, 0, outbuf, r->buflen,
1711
                                  (req->cmd.buf[1] & 1) == 0);
1712
        if (buflen < 0) {
1713
            goto illegal_request;
1714
        }
1715
        break;
1716
    case MECHANISM_STATUS:
1717
        buflen = scsi_emulate_mechanism_status(s, outbuf);
1718
        if (buflen < 0) {
1719
            goto illegal_request;
1720
        }
1721
        break;
1722
    case GET_CONFIGURATION:
1723
        buflen = scsi_get_configuration(s, outbuf);
1724
        if (buflen < 0) {
1725
            goto illegal_request;
1726
        }
1727
        break;
1728
    case GET_EVENT_STATUS_NOTIFICATION:
1729
        buflen = scsi_get_event_status_notification(s, r, outbuf);
1730
        if (buflen < 0) {
1731
            goto illegal_request;
1732
        }
1733
        break;
1734
    case READ_DISC_INFORMATION:
1735
        buflen = scsi_read_disc_information(s, r, outbuf);
1736
        if (buflen < 0) {
1737
            goto illegal_request;
1738
        }
1739
        break;
1740
    case READ_DVD_STRUCTURE:
1741
        buflen = scsi_read_dvd_structure(s, r, outbuf);
1742
        if (buflen < 0) {
1743
            goto illegal_request;
1744
        }
1745
        break;
1746
    case SERVICE_ACTION_IN_16:
1747
        /* Service Action In subcommands. */
1748
        if ((req->cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) {
1749
            DPRINTF("SAI READ CAPACITY(16)\n");
1750
            memset(outbuf, 0, req->cmd.xfer);
1751
            bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1752
            if (!nb_sectors) {
1753
                scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
1754
                return -1;
1755
            }
1756
            if ((req->cmd.buf[14] & 1) == 0 && req->cmd.lba) {
1757
                goto illegal_request;
1758
            }
1759
            nb_sectors /= s->qdev.blocksize / 512;
1760
            /* Returned value is the address of the last sector.  */
1761
            nb_sectors--;
1762
            /* Remember the new size for read/write sanity checking. */
1763
            s->qdev.max_lba = nb_sectors;
1764
            outbuf[0] = (nb_sectors >> 56) & 0xff;
1765
            outbuf[1] = (nb_sectors >> 48) & 0xff;
1766
            outbuf[2] = (nb_sectors >> 40) & 0xff;
1767
            outbuf[3] = (nb_sectors >> 32) & 0xff;
1768
            outbuf[4] = (nb_sectors >> 24) & 0xff;
1769
            outbuf[5] = (nb_sectors >> 16) & 0xff;
1770
            outbuf[6] = (nb_sectors >> 8) & 0xff;
1771
            outbuf[7] = nb_sectors & 0xff;
1772
            outbuf[8] = 0;
1773
            outbuf[9] = 0;
1774
            outbuf[10] = s->qdev.blocksize >> 8;
1775
            outbuf[11] = 0;
1776
            outbuf[12] = 0;
1777
            outbuf[13] = get_physical_block_exp(&s->qdev.conf);
1778

    
1779
            /* set TPE bit if the format supports discard */
1780
            if (s->qdev.conf.discard_granularity) {
1781
                outbuf[14] = 0x80;
1782
            }
1783

    
1784
            /* Protection, exponent and lowest lba field left blank. */
1785
            break;
1786
        }
1787
        DPRINTF("Unsupported Service Action In\n");
1788
        goto illegal_request;
1789
    case SYNCHRONIZE_CACHE:
1790
        /* The request is used as the AIO opaque value, so add a ref.  */
1791
        scsi_req_ref(&r->req);
1792
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
1793
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_aio_complete, r);
1794
        return 0;
1795
    case SEEK_10:
1796
        DPRINTF("Seek(10) (sector %" PRId64 ")\n", r->req.cmd.lba);
1797
        if (r->req.cmd.lba > s->qdev.max_lba) {
1798
            goto illegal_lba;
1799
        }
1800
        break;
1801
    case MODE_SELECT:
1802
        DPRINTF("Mode Select(6) (len %lu)\n", (long)r->req.cmd.xfer);
1803
        break;
1804
    case MODE_SELECT_10:
1805
        DPRINTF("Mode Select(10) (len %lu)\n", (long)r->req.cmd.xfer);
1806
        break;
1807
    case UNMAP:
1808
        DPRINTF("Unmap (len %lu)\n", (long)r->req.cmd.xfer);
1809
        break;
1810
    case WRITE_SAME_10:
1811
    case WRITE_SAME_16:
1812
        nb_sectors = scsi_data_cdb_length(r->req.cmd.buf);
1813
        if (bdrv_is_read_only(s->qdev.conf.bs)) {
1814
            scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1815
            return 0;
1816
        }
1817
        if (!check_lba_range(s, r->req.cmd.lba, nb_sectors)) {
1818
            goto illegal_lba;
1819
        }
1820

    
1821
        /*
1822
         * We only support WRITE SAME with the unmap bit set for now.
1823
         */
1824
        if (!(req->cmd.buf[1] & 0x8)) {
1825
            goto illegal_request;
1826
        }
1827

    
1828
        /* The request is used as the AIO opaque value, so add a ref.  */
1829
        scsi_req_ref(&r->req);
1830
        r->req.aiocb = bdrv_aio_discard(s->qdev.conf.bs,
1831
                                        r->req.cmd.lba * (s->qdev.blocksize / 512),
1832
                                        nb_sectors * (s->qdev.blocksize / 512),
1833
                                        scsi_aio_complete, r);
1834
        return 0;
1835
    default:
1836
        DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
1837
        scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE));
1838
        return 0;
1839
    }
1840
    assert(!r->req.aiocb);
1841
    r->iov.iov_len = MIN(r->buflen, req->cmd.xfer);
1842
    if (r->iov.iov_len == 0) {
1843
        scsi_req_complete(&r->req, GOOD);
1844
    }
1845
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
1846
        assert(r->iov.iov_len == req->cmd.xfer);
1847
        return -r->iov.iov_len;
1848
    } else {
1849
        return r->iov.iov_len;
1850
    }
1851

    
1852
illegal_request:
1853
    if (r->req.status == -1) {
1854
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1855
    }
1856
    return 0;
1857

    
1858
illegal_lba:
1859
    scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1860
    return 0;
1861
}
1862

    
1863
/* Execute a scsi command.  Returns the length of the data expected by the
1864
   command.  This will be Positive for data transfers from the device
1865
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
1866
   and zero if the command does not transfer any data.  */
1867

    
1868
static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
1869
{
1870
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1871
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1872
    uint32_t len;
1873
    uint8_t command;
1874

    
1875
    command = buf[0];
1876

    
1877
    if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {
1878
        scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
1879
        return 0;
1880
    }
1881

    
1882
    len = scsi_data_cdb_length(r->req.cmd.buf);
1883
    switch (command) {
1884
    case READ_6:
1885
    case READ_10:
1886
    case READ_12:
1887
    case READ_16:
1888
        DPRINTF("Read (sector %" PRId64 ", count %u)\n", r->req.cmd.lba, len);
1889
        if (r->req.cmd.buf[1] & 0xe0) {
1890
            goto illegal_request;
1891
        }
1892
        if (!check_lba_range(s, r->req.cmd.lba, len)) {
1893
            goto illegal_lba;
1894
        }
1895
        r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
1896
        r->sector_count = len * (s->qdev.blocksize / 512);
1897
        break;
1898
    case WRITE_6:
1899
    case WRITE_10:
1900
    case WRITE_12:
1901
    case WRITE_16:
1902
    case WRITE_VERIFY_10:
1903
    case WRITE_VERIFY_12:
1904
    case WRITE_VERIFY_16:
1905
        if (bdrv_is_read_only(s->qdev.conf.bs)) {
1906
            scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1907
            return 0;
1908
        }
1909
        /* fallthrough */
1910
    case VERIFY_10:
1911
    case VERIFY_12:
1912
    case VERIFY_16:
1913
        DPRINTF("Write %s(sector %" PRId64 ", count %u)\n",
1914
                (command & 0xe) == 0xe ? "And Verify " : "",
1915
                r->req.cmd.lba, len);
1916
        if (r->req.cmd.buf[1] & 0xe0) {
1917
            goto illegal_request;
1918
        }
1919
        if (!check_lba_range(s, r->req.cmd.lba, len)) {
1920
            goto illegal_lba;
1921
        }
1922
        r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
1923
        r->sector_count = len * (s->qdev.blocksize / 512);
1924
        break;
1925
    default:
1926
        abort();
1927
    illegal_request:
1928
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1929
        return 0;
1930
    illegal_lba:
1931
        scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1932
        return 0;
1933
    }
1934
    if (r->sector_count == 0) {
1935
        scsi_req_complete(&r->req, GOOD);
1936
    }
1937
    assert(r->iov.iov_len == 0);
1938
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
1939
        return -r->sector_count * 512;
1940
    } else {
1941
        return r->sector_count * 512;
1942
    }
1943
}
1944

    
1945
static void scsi_disk_reset(DeviceState *dev)
1946
{
1947
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev.qdev, dev);
1948
    uint64_t nb_sectors;
1949

    
1950
    scsi_device_purge_requests(&s->qdev, SENSE_CODE(RESET));
1951

    
1952
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1953
    nb_sectors /= s->qdev.blocksize / 512;
1954
    if (nb_sectors) {
1955
        nb_sectors--;
1956
    }
1957
    s->qdev.max_lba = nb_sectors;
1958
}
1959

    
1960
static void scsi_destroy(SCSIDevice *dev)
1961
{
1962
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1963

    
1964
    scsi_device_purge_requests(&s->qdev, SENSE_CODE(NO_SENSE));
1965
    blockdev_mark_auto_del(s->qdev.conf.bs);
1966
}
1967

    
1968
static void scsi_disk_resize_cb(void *opaque)
1969
{
1970
    SCSIDiskState *s = opaque;
1971

    
1972
    /* SPC lists this sense code as available only for
1973
     * direct-access devices.
1974
     */
1975
    if (s->qdev.type == TYPE_DISK) {
1976
        scsi_device_report_change(&s->qdev, SENSE_CODE(CAPACITY_CHANGED));
1977
    }
1978
}
1979

    
1980
static void scsi_cd_change_media_cb(void *opaque, bool load)
1981
{
1982
    SCSIDiskState *s = opaque;
1983

    
1984
    /*
1985
     * When a CD gets changed, we have to report an ejected state and
1986
     * then a loaded state to guests so that they detect tray
1987
     * open/close and media change events.  Guests that do not use
1988
     * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
1989
     * states rely on this behavior.
1990
     *
1991
     * media_changed governs the state machine used for unit attention
1992
     * report.  media_event is used by GET EVENT STATUS NOTIFICATION.
1993
     */
1994
    s->media_changed = load;
1995
    s->tray_open = !load;
1996
    scsi_device_set_ua(&s->qdev, SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM));
1997
    s->media_event = true;
1998
    s->eject_request = false;
1999
}
2000

    
2001
static void scsi_cd_eject_request_cb(void *opaque, bool force)
2002
{
2003
    SCSIDiskState *s = opaque;
2004

    
2005
    s->eject_request = true;
2006
    if (force) {
2007
        s->tray_locked = false;
2008
    }
2009
}
2010

    
2011
static bool scsi_cd_is_tray_open(void *opaque)
2012
{
2013
    return ((SCSIDiskState *)opaque)->tray_open;
2014
}
2015

    
2016
static bool scsi_cd_is_medium_locked(void *opaque)
2017
{
2018
    return ((SCSIDiskState *)opaque)->tray_locked;
2019
}
2020

    
2021
static const BlockDevOps scsi_disk_removable_block_ops = {
2022
    .change_media_cb = scsi_cd_change_media_cb,
2023
    .eject_request_cb = scsi_cd_eject_request_cb,
2024
    .is_tray_open = scsi_cd_is_tray_open,
2025
    .is_medium_locked = scsi_cd_is_medium_locked,
2026

    
2027
    .resize_cb = scsi_disk_resize_cb,
2028
};
2029

    
2030
static const BlockDevOps scsi_disk_block_ops = {
2031
    .resize_cb = scsi_disk_resize_cb,
2032
};
2033

    
2034
static void scsi_disk_unit_attention_reported(SCSIDevice *dev)
2035
{
2036
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2037
    if (s->media_changed) {
2038
        s->media_changed = false;
2039
        scsi_device_set_ua(&s->qdev, SENSE_CODE(MEDIUM_CHANGED));
2040
    }
2041
}
2042

    
2043
static int scsi_initfn(SCSIDevice *dev)
2044
{
2045
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2046

    
2047
    if (!s->qdev.conf.bs) {
2048
        error_report("drive property not set");
2049
        return -1;
2050
    }
2051

    
2052
    if (!(s->features & (1 << SCSI_DISK_F_REMOVABLE)) &&
2053
        !bdrv_is_inserted(s->qdev.conf.bs)) {
2054
        error_report("Device needs media, but drive is empty");
2055
        return -1;
2056
    }
2057

    
2058
    blkconf_serial(&s->qdev.conf, &s->serial);
2059
    if (dev->type == TYPE_DISK
2060
        && blkconf_geometry(&dev->conf, NULL, 65535, 255, 255) < 0) {
2061
        return -1;
2062
    }
2063

    
2064
    if (!s->version) {
2065
        s->version = g_strdup(qemu_get_version());
2066
    }
2067
    if (!s->vendor) {
2068
        s->vendor = g_strdup("QEMU");
2069
    }
2070

    
2071
    if (bdrv_is_sg(s->qdev.conf.bs)) {
2072
        error_report("unwanted /dev/sg*");
2073
        return -1;
2074
    }
2075

    
2076
    if (s->features & (1 << SCSI_DISK_F_REMOVABLE)) {
2077
        bdrv_set_dev_ops(s->qdev.conf.bs, &scsi_disk_removable_block_ops, s);
2078
    } else {
2079
        bdrv_set_dev_ops(s->qdev.conf.bs, &scsi_disk_block_ops, s);
2080
    }
2081
    bdrv_set_buffer_alignment(s->qdev.conf.bs, s->qdev.blocksize);
2082

    
2083
    bdrv_iostatus_enable(s->qdev.conf.bs);
2084
    add_boot_device_path(s->qdev.conf.bootindex, &dev->qdev, NULL);
2085
    return 0;
2086
}
2087

    
2088
static int scsi_hd_initfn(SCSIDevice *dev)
2089
{
2090
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2091
    s->qdev.blocksize = s->qdev.conf.logical_block_size;
2092
    s->qdev.type = TYPE_DISK;
2093
    if (!s->product) {
2094
        s->product = g_strdup("QEMU HARDDISK");
2095
    }
2096
    return scsi_initfn(&s->qdev);
2097
}
2098

    
2099
static int scsi_cd_initfn(SCSIDevice *dev)
2100
{
2101
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2102
    s->qdev.blocksize = 2048;
2103
    s->qdev.type = TYPE_ROM;
2104
    s->features |= 1 << SCSI_DISK_F_REMOVABLE;
2105
    if (!s->product) {
2106
        s->product = g_strdup("QEMU CD-ROM");
2107
    }
2108
    return scsi_initfn(&s->qdev);
2109
}
2110

    
2111
static int scsi_disk_initfn(SCSIDevice *dev)
2112
{
2113
    DriveInfo *dinfo;
2114

    
2115
    if (!dev->conf.bs) {
2116
        return scsi_initfn(dev);  /* ... and die there */
2117
    }
2118

    
2119
    dinfo = drive_get_by_blockdev(dev->conf.bs);
2120
    if (dinfo->media_cd) {
2121
        return scsi_cd_initfn(dev);
2122
    } else {
2123
        return scsi_hd_initfn(dev);
2124
    }
2125
}
2126

    
2127
static const SCSIReqOps scsi_disk_emulate_reqops = {
2128
    .size         = sizeof(SCSIDiskReq),
2129
    .free_req     = scsi_free_request,
2130
    .send_command = scsi_disk_emulate_command,
2131
    .read_data    = scsi_disk_emulate_read_data,
2132
    .write_data   = scsi_disk_emulate_write_data,
2133
    .get_buf      = scsi_get_buf,
2134
};
2135

    
2136
static const SCSIReqOps scsi_disk_dma_reqops = {
2137
    .size         = sizeof(SCSIDiskReq),
2138
    .free_req     = scsi_free_request,
2139
    .send_command = scsi_disk_dma_command,
2140
    .read_data    = scsi_read_data,
2141
    .write_data   = scsi_write_data,
2142
    .cancel_io    = scsi_cancel_io,
2143
    .get_buf      = scsi_get_buf,
2144
    .load_request = scsi_disk_load_request,
2145
    .save_request = scsi_disk_save_request,
2146
};
2147

    
2148
static const SCSIReqOps *const scsi_disk_reqops_dispatch[256] = {
2149
    [TEST_UNIT_READY]                 = &scsi_disk_emulate_reqops,
2150
    [INQUIRY]                         = &scsi_disk_emulate_reqops,
2151
    [MODE_SENSE]                      = &scsi_disk_emulate_reqops,
2152
    [MODE_SENSE_10]                   = &scsi_disk_emulate_reqops,
2153
    [START_STOP]                      = &scsi_disk_emulate_reqops,
2154
    [ALLOW_MEDIUM_REMOVAL]            = &scsi_disk_emulate_reqops,
2155
    [READ_CAPACITY_10]                = &scsi_disk_emulate_reqops,
2156
    [READ_TOC]                        = &scsi_disk_emulate_reqops,
2157
    [READ_DVD_STRUCTURE]              = &scsi_disk_emulate_reqops,
2158
    [READ_DISC_INFORMATION]           = &scsi_disk_emulate_reqops,
2159
    [GET_CONFIGURATION]               = &scsi_disk_emulate_reqops,
2160
    [GET_EVENT_STATUS_NOTIFICATION]   = &scsi_disk_emulate_reqops,
2161
    [MECHANISM_STATUS]                = &scsi_disk_emulate_reqops,
2162
    [SERVICE_ACTION_IN_16]            = &scsi_disk_emulate_reqops,
2163
    [REQUEST_SENSE]                   = &scsi_disk_emulate_reqops,
2164
    [SYNCHRONIZE_CACHE]               = &scsi_disk_emulate_reqops,
2165
    [SEEK_10]                         = &scsi_disk_emulate_reqops,
2166
    [MODE_SELECT]                     = &scsi_disk_emulate_reqops,
2167
    [MODE_SELECT_10]                  = &scsi_disk_emulate_reqops,
2168
    [UNMAP]                           = &scsi_disk_emulate_reqops,
2169
    [WRITE_SAME_10]                   = &scsi_disk_emulate_reqops,
2170
    [WRITE_SAME_16]                   = &scsi_disk_emulate_reqops,
2171

    
2172
    [READ_6]                          = &scsi_disk_dma_reqops,
2173
    [READ_10]                         = &scsi_disk_dma_reqops,
2174
    [READ_12]                         = &scsi_disk_dma_reqops,
2175
    [READ_16]                         = &scsi_disk_dma_reqops,
2176
    [VERIFY_10]                       = &scsi_disk_dma_reqops,
2177
    [VERIFY_12]                       = &scsi_disk_dma_reqops,
2178
    [VERIFY_16]                       = &scsi_disk_dma_reqops,
2179
    [WRITE_6]                         = &scsi_disk_dma_reqops,
2180
    [WRITE_10]                        = &scsi_disk_dma_reqops,
2181
    [WRITE_12]                        = &scsi_disk_dma_reqops,
2182
    [WRITE_16]                        = &scsi_disk_dma_reqops,
2183
    [WRITE_VERIFY_10]                 = &scsi_disk_dma_reqops,
2184
    [WRITE_VERIFY_12]                 = &scsi_disk_dma_reqops,
2185
    [WRITE_VERIFY_16]                 = &scsi_disk_dma_reqops,
2186
};
2187

    
2188
static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun,
2189
                                     uint8_t *buf, void *hba_private)
2190
{
2191
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2192
    SCSIRequest *req;
2193
    const SCSIReqOps *ops;
2194
    uint8_t command;
2195

    
2196
    command = buf[0];
2197
    ops = scsi_disk_reqops_dispatch[command];
2198
    if (!ops) {
2199
        ops = &scsi_disk_emulate_reqops;
2200
    }
2201
    req = scsi_req_alloc(ops, &s->qdev, tag, lun, hba_private);
2202

    
2203
#ifdef DEBUG_SCSI
2204
    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
2205
    {
2206
        int i;
2207
        for (i = 1; i < req->cmd.len; i++) {
2208
            printf(" 0x%02x", buf[i]);
2209
        }
2210
        printf("\n");
2211
    }
2212
#endif
2213

    
2214
    return req;
2215
}
2216

    
2217
#ifdef __linux__
2218
static int get_device_type(SCSIDiskState *s)
2219
{
2220
    BlockDriverState *bdrv = s->qdev.conf.bs;
2221
    uint8_t cmd[16];
2222
    uint8_t buf[36];
2223
    uint8_t sensebuf[8];
2224
    sg_io_hdr_t io_header;
2225
    int ret;
2226

    
2227
    memset(cmd, 0, sizeof(cmd));
2228
    memset(buf, 0, sizeof(buf));
2229
    cmd[0] = INQUIRY;
2230
    cmd[4] = sizeof(buf);
2231

    
2232
    memset(&io_header, 0, sizeof(io_header));
2233
    io_header.interface_id = 'S';
2234
    io_header.dxfer_direction = SG_DXFER_FROM_DEV;
2235
    io_header.dxfer_len = sizeof(buf);
2236
    io_header.dxferp = buf;
2237
    io_header.cmdp = cmd;
2238
    io_header.cmd_len = sizeof(cmd);
2239
    io_header.mx_sb_len = sizeof(sensebuf);
2240
    io_header.sbp = sensebuf;
2241
    io_header.timeout = 6000; /* XXX */
2242

    
2243
    ret = bdrv_ioctl(bdrv, SG_IO, &io_header);
2244
    if (ret < 0 || io_header.driver_status || io_header.host_status) {
2245
        return -1;
2246
    }
2247
    s->qdev.type = buf[0];
2248
    if (buf[1] & 0x80) {
2249
        s->features |= 1 << SCSI_DISK_F_REMOVABLE;
2250
    }
2251
    return 0;
2252
}
2253

    
2254
static int scsi_block_initfn(SCSIDevice *dev)
2255
{
2256
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2257
    int sg_version;
2258
    int rc;
2259

    
2260
    if (!s->qdev.conf.bs) {
2261
        error_report("scsi-block: drive property not set");
2262
        return -1;
2263
    }
2264

    
2265
    /* check we are using a driver managing SG_IO (version 3 and after) */
2266
    if (bdrv_ioctl(s->qdev.conf.bs, SG_GET_VERSION_NUM, &sg_version) < 0 ||
2267
        sg_version < 30000) {
2268
        error_report("scsi-block: scsi generic interface too old");
2269
        return -1;
2270
    }
2271

    
2272
    /* get device type from INQUIRY data */
2273
    rc = get_device_type(s);
2274
    if (rc < 0) {
2275
        error_report("scsi-block: INQUIRY failed");
2276
        return -1;
2277
    }
2278

    
2279
    /* Make a guess for the block size, we'll fix it when the guest sends.
2280
     * READ CAPACITY.  If they don't, they likely would assume these sizes
2281
     * anyway. (TODO: check in /sys).
2282
     */
2283
    if (s->qdev.type == TYPE_ROM || s->qdev.type == TYPE_WORM) {
2284
        s->qdev.blocksize = 2048;
2285
    } else {
2286
        s->qdev.blocksize = 512;
2287
    }
2288
    return scsi_initfn(&s->qdev);
2289
}
2290

    
2291
static SCSIRequest *scsi_block_new_request(SCSIDevice *d, uint32_t tag,
2292
                                           uint32_t lun, uint8_t *buf,
2293
                                           void *hba_private)
2294
{
2295
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2296

    
2297
    switch (buf[0]) {
2298
    case READ_6:
2299
    case READ_10:
2300
    case READ_12:
2301
    case READ_16:
2302
    case VERIFY_10:
2303
    case VERIFY_12:
2304
    case VERIFY_16:
2305
    case WRITE_6:
2306
    case WRITE_10:
2307
    case WRITE_12:
2308
    case WRITE_16:
2309
    case WRITE_VERIFY_10:
2310
    case WRITE_VERIFY_12:
2311
    case WRITE_VERIFY_16:
2312
        /* If we are not using O_DIRECT, we might read stale data from the
2313
         * host cache if writes were made using other commands than these
2314
         * ones (such as WRITE SAME or EXTENDED COPY, etc.).  So, without
2315
         * O_DIRECT everything must go through SG_IO.
2316
         */
2317
        if (bdrv_get_flags(s->qdev.conf.bs) & BDRV_O_NOCACHE) {
2318
            break;
2319
        }
2320

    
2321
        /* MMC writing cannot be done via pread/pwrite, because it sometimes
2322
         * involves writing beyond the maximum LBA or to negative LBA (lead-in).
2323
         * And once you do these writes, reading from the block device is
2324
         * unreliable, too.  It is even possible that reads deliver random data
2325
         * from the host page cache (this is probably a Linux bug).
2326
         *
2327
         * We might use scsi_disk_dma_reqops as long as no writing commands are
2328
         * seen, but performance usually isn't paramount on optical media.  So,
2329
         * just make scsi-block operate the same as scsi-generic for them.
2330
         */
2331
        if (s->qdev.type != TYPE_ROM) {
2332
            return scsi_req_alloc(&scsi_disk_dma_reqops, &s->qdev, tag, lun,
2333
                                  hba_private);
2334
        }
2335
    }
2336

    
2337
    return scsi_req_alloc(&scsi_generic_req_ops, &s->qdev, tag, lun,
2338
                          hba_private);
2339
}
2340
#endif
2341

    
2342
#define DEFINE_SCSI_DISK_PROPERTIES()                                \
2343
    DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf),               \
2344
    DEFINE_PROP_STRING("ver", SCSIDiskState, version),               \
2345
    DEFINE_PROP_STRING("serial", SCSIDiskState, serial),             \
2346
    DEFINE_PROP_STRING("vendor", SCSIDiskState, vendor),             \
2347
    DEFINE_PROP_STRING("product", SCSIDiskState, product)
2348

    
2349
static Property scsi_hd_properties[] = {
2350
    DEFINE_SCSI_DISK_PROPERTIES(),
2351
    DEFINE_PROP_BIT("removable", SCSIDiskState, features,
2352
                    SCSI_DISK_F_REMOVABLE, false),
2353
    DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
2354
                    SCSI_DISK_F_DPOFUA, false),
2355
    DEFINE_PROP_HEX64("wwn", SCSIDiskState, wwn, 0),
2356
    DEFINE_BLOCK_CHS_PROPERTIES(SCSIDiskState, qdev.conf),
2357
    DEFINE_PROP_END_OF_LIST(),
2358
};
2359

    
2360
static const VMStateDescription vmstate_scsi_disk_state = {
2361
    .name = "scsi-disk",
2362
    .version_id = 1,
2363
    .minimum_version_id = 1,
2364
    .minimum_version_id_old = 1,
2365
    .fields = (VMStateField[]) {
2366
        VMSTATE_SCSI_DEVICE(qdev, SCSIDiskState),
2367
        VMSTATE_BOOL(media_changed, SCSIDiskState),
2368
        VMSTATE_BOOL(media_event, SCSIDiskState),
2369
        VMSTATE_BOOL(eject_request, SCSIDiskState),
2370
        VMSTATE_BOOL(tray_open, SCSIDiskState),
2371
        VMSTATE_BOOL(tray_locked, SCSIDiskState),
2372
        VMSTATE_END_OF_LIST()
2373
    }
2374
};
2375

    
2376
static void scsi_hd_class_initfn(ObjectClass *klass, void *data)
2377
{
2378
    DeviceClass *dc = DEVICE_CLASS(klass);
2379
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2380

    
2381
    sc->init         = scsi_hd_initfn;
2382
    sc->destroy      = scsi_destroy;
2383
    sc->alloc_req    = scsi_new_request;
2384
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2385
    dc->fw_name = "disk";
2386
    dc->desc = "virtual SCSI disk";
2387
    dc->reset = scsi_disk_reset;
2388
    dc->props = scsi_hd_properties;
2389
    dc->vmsd  = &vmstate_scsi_disk_state;
2390
}
2391

    
2392
static TypeInfo scsi_hd_info = {
2393
    .name          = "scsi-hd",
2394
    .parent        = TYPE_SCSI_DEVICE,
2395
    .instance_size = sizeof(SCSIDiskState),
2396
    .class_init    = scsi_hd_class_initfn,
2397
};
2398

    
2399
static Property scsi_cd_properties[] = {
2400
    DEFINE_SCSI_DISK_PROPERTIES(),
2401
    DEFINE_PROP_HEX64("wwn", SCSIDiskState, wwn, 0),
2402
    DEFINE_PROP_END_OF_LIST(),
2403
};
2404

    
2405
static void scsi_cd_class_initfn(ObjectClass *klass, void *data)
2406
{
2407
    DeviceClass *dc = DEVICE_CLASS(klass);
2408
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2409

    
2410
    sc->init         = scsi_cd_initfn;
2411
    sc->destroy      = scsi_destroy;
2412
    sc->alloc_req    = scsi_new_request;
2413
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2414
    dc->fw_name = "disk";
2415
    dc->desc = "virtual SCSI CD-ROM";
2416
    dc->reset = scsi_disk_reset;
2417
    dc->props = scsi_cd_properties;
2418
    dc->vmsd  = &vmstate_scsi_disk_state;
2419
}
2420

    
2421
static TypeInfo scsi_cd_info = {
2422
    .name          = "scsi-cd",
2423
    .parent        = TYPE_SCSI_DEVICE,
2424
    .instance_size = sizeof(SCSIDiskState),
2425
    .class_init    = scsi_cd_class_initfn,
2426
};
2427

    
2428
#ifdef __linux__
2429
static Property scsi_block_properties[] = {
2430
    DEFINE_PROP_DRIVE("drive", SCSIDiskState, qdev.conf.bs),
2431
    DEFINE_PROP_INT32("bootindex", SCSIDiskState, qdev.conf.bootindex, -1),
2432
    DEFINE_PROP_END_OF_LIST(),
2433
};
2434

    
2435
static void scsi_block_class_initfn(ObjectClass *klass, void *data)
2436
{
2437
    DeviceClass *dc = DEVICE_CLASS(klass);
2438
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2439

    
2440
    sc->init         = scsi_block_initfn;
2441
    sc->destroy      = scsi_destroy;
2442
    sc->alloc_req    = scsi_block_new_request;
2443
    dc->fw_name = "disk";
2444
    dc->desc = "SCSI block device passthrough";
2445
    dc->reset = scsi_disk_reset;
2446
    dc->props = scsi_block_properties;
2447
    dc->vmsd  = &vmstate_scsi_disk_state;
2448
}
2449

    
2450
static TypeInfo scsi_block_info = {
2451
    .name          = "scsi-block",
2452
    .parent        = TYPE_SCSI_DEVICE,
2453
    .instance_size = sizeof(SCSIDiskState),
2454
    .class_init    = scsi_block_class_initfn,
2455
};
2456
#endif
2457

    
2458
static Property scsi_disk_properties[] = {
2459
    DEFINE_SCSI_DISK_PROPERTIES(),
2460
    DEFINE_PROP_BIT("removable", SCSIDiskState, features,
2461
                    SCSI_DISK_F_REMOVABLE, false),
2462
    DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
2463
                    SCSI_DISK_F_DPOFUA, false),
2464
    DEFINE_PROP_HEX64("wwn", SCSIDiskState, wwn, 0),
2465
    DEFINE_PROP_END_OF_LIST(),
2466
};
2467

    
2468
static void scsi_disk_class_initfn(ObjectClass *klass, void *data)
2469
{
2470
    DeviceClass *dc = DEVICE_CLASS(klass);
2471
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2472

    
2473
    sc->init         = scsi_disk_initfn;
2474
    sc->destroy      = scsi_destroy;
2475
    sc->alloc_req    = scsi_new_request;
2476
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2477
    dc->fw_name = "disk";
2478
    dc->desc = "virtual SCSI disk or CD-ROM (legacy)";
2479
    dc->reset = scsi_disk_reset;
2480
    dc->props = scsi_disk_properties;
2481
    dc->vmsd  = &vmstate_scsi_disk_state;
2482
}
2483

    
2484
static TypeInfo scsi_disk_info = {
2485
    .name          = "scsi-disk",
2486
    .parent        = TYPE_SCSI_DEVICE,
2487
    .instance_size = sizeof(SCSIDiskState),
2488
    .class_init    = scsi_disk_class_initfn,
2489
};
2490

    
2491
static void scsi_disk_register_types(void)
2492
{
2493
    type_register_static(&scsi_hd_info);
2494
    type_register_static(&scsi_cd_info);
2495
#ifdef __linux__
2496
    type_register_static(&scsi_block_info);
2497
#endif
2498
    type_register_static(&scsi_disk_info);
2499
}
2500

    
2501
type_init(scsi_disk_register_types)