Archipelago » qemu

/*

 * SCSI Device emulation

 *

 * Copyright (c) 2006 CodeSourcery.

 * Based on code by Fabrice Bellard

 *

 * Written by Paul Brook

 * Modifications:

 *  2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case

 *                                 when the allocation length of CDB is smaller

 *                                 than 36.

 *  2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the

 *                                 MODE SENSE response.

 *

 * This code is licensed under the LGPL.

 *

 * Note that this file only handles the SCSI architecture model and device

 * commands.  Emulation of interface/link layer protocols is handled by

 * the host adapter emulator.

 */

//#define DEBUG_SCSI

#ifdef DEBUG_SCSI

#define DPRINTF(fmt, ...) \

do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)

#else

#define DPRINTF(fmt, ...) do {} while(0)

#endif

#include "qemu-common.h"

#include "qemu-error.h"

#include "scsi.h"

#include "scsi-defs.h"

#include "sysemu.h"

#include "blockdev.h"

#include "hw/block-common.h"

#include "dma.h"

#ifdef __linux

#include <scsi/sg.h>

#endif

#define SCSI_DMA_BUF_SIZE    131072

#define SCSI_MAX_INQUIRY_LEN 256

#define SCSI_MAX_MODE_LEN    256

typedef struct SCSIDiskState SCSIDiskState;

typedef struct SCSIDiskReq {

    SCSIRequest req;

    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */

    uint64_t sector;

    uint32_t sector_count;

    uint32_t buflen;

    bool started;

    struct iovec iov;

    QEMUIOVector qiov;

    BlockAcctCookie acct;

} SCSIDiskReq;

#define SCSI_DISK_F_REMOVABLE   0

#define SCSI_DISK_F_DPOFUA      1

struct SCSIDiskState

{

    SCSIDevice qdev;

    uint32_t features;

    bool media_changed;

    bool media_event;

    bool eject_request;

    uint64_t wwn;

    QEMUBH *bh;

    char *version;

    char *serial;

    char *vendor;

    char *product;

    bool tray_open;

    bool tray_locked;

};

static int scsi_handle_rw_error(SCSIDiskReq *r, int error);

static void scsi_free_request(SCSIRequest *req)

{

    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);

    if (r->iov.iov_base) {

        qemu_vfree(r->iov.iov_base);

    }

}

/* Helper function for command completion with sense.  */

static void scsi_check_condition(SCSIDiskReq *r, SCSISense sense)

{

    DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",

            r->req.tag, sense.key, sense.asc, sense.ascq);

    scsi_req_build_sense(&r->req, sense);

    scsi_req_complete(&r->req, CHECK_CONDITION);

}

/* Cancel a pending data transfer.  */

static void scsi_cancel_io(SCSIRequest *req)

{

    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);

    DPRINTF("Cancel tag=0x%x\n", req->tag);

    if (r->req.aiocb) {

        bdrv_aio_cancel(r->req.aiocb);

        /* This reference was left in by scsi_*_data.  We take ownership of

         * it the moment scsi_req_cancel is called, independent of whether

         * bdrv_aio_cancel completes the request or not.  */

        scsi_req_unref(&r->req);

    }

    r->req.aiocb = NULL;

}

static uint32_t scsi_init_iovec(SCSIDiskReq *r, size_t size)

{

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    if (!r->iov.iov_base) {

        r->buflen = size;

        r->iov.iov_base = qemu_blockalign(s->qdev.conf.bs, r->buflen);

    }

    r->iov.iov_len = MIN(r->sector_count * 512, r->buflen);

    qemu_iovec_init_external(&r->qiov, &r->iov, 1);

    return r->qiov.size / 512;

}

static void scsi_disk_save_request(QEMUFile *f, SCSIRequest *req)

{

    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);

    qemu_put_be64s(f, &r->sector);

    qemu_put_be32s(f, &r->sector_count);

    qemu_put_be32s(f, &r->buflen);

    if (r->buflen) {

        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {

            qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);

        } else if (!req->retry) {

            uint32_t len = r->iov.iov_len;

            qemu_put_be32s(f, &len);

            qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);

        }

    }

}

static void scsi_disk_load_request(QEMUFile *f, SCSIRequest *req)

{

    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);

    qemu_get_be64s(f, &r->sector);

    qemu_get_be32s(f, &r->sector_count);

    qemu_get_be32s(f, &r->buflen);

    if (r->buflen) {

        scsi_init_iovec(r, r->buflen);

        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {

            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);

        } else if (!r->req.retry) {

            uint32_t len;

            qemu_get_be32s(f, &len);

            r->iov.iov_len = len;

            assert(r->iov.iov_len <= r->buflen);

            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);

        }

    }

    qemu_iovec_init_external(&r->qiov, &r->iov, 1);

}

static void scsi_aio_complete(void *opaque, int ret)

{

    SCSIDiskReq *r = (SCSIDiskReq *)opaque;

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    assert(r->req.aiocb != NULL);

    r->req.aiocb = NULL;

    bdrv_acct_done(s->qdev.conf.bs, &r->acct);

    if (ret < 0) {

        if (scsi_handle_rw_error(r, -ret)) {

            goto done;

        }

    }

    scsi_req_complete(&r->req, GOOD);

done:

    if (!r->req.io_canceled) {

        scsi_req_unref(&r->req);

    }

}

static bool scsi_is_cmd_fua(SCSICommand *cmd)

{

    switch (cmd->buf[0]) {

    case READ_10:

    case READ_12:

    case READ_16:

    case WRITE_10:

    case WRITE_12:

    case WRITE_16:

        return (cmd->buf[1] & 8) != 0;

    case VERIFY_10:

    case VERIFY_12:

    case VERIFY_16:

    case WRITE_VERIFY_10:

    case WRITE_VERIFY_12:

    case WRITE_VERIFY_16:

        return true;

    case READ_6:

    case WRITE_6:

    default:

        return false;

    }

}

static void scsi_write_do_fua(SCSIDiskReq *r)

{

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    if (scsi_is_cmd_fua(&r->req.cmd)) {

        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);

        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_aio_complete, r);

        return;

    }

    scsi_req_complete(&r->req, GOOD);

    if (!r->req.io_canceled) {

        scsi_req_unref(&r->req);

    }

}

static void scsi_dma_complete(void *opaque, int ret)

{

    SCSIDiskReq *r = (SCSIDiskReq *)opaque;

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    assert(r->req.aiocb != NULL);

    r->req.aiocb = NULL;

    bdrv_acct_done(s->qdev.conf.bs, &r->acct);

    if (ret < 0) {

        if (scsi_handle_rw_error(r, -ret)) {

            goto done;

        }

    }

    r->sector += r->sector_count;

    r->sector_count = 0;

    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {

        scsi_write_do_fua(r);

        return;

    } else {

        scsi_req_complete(&r->req, GOOD);

    }

done:

    if (!r->req.io_canceled) {

        scsi_req_unref(&r->req);

    }

}

static void scsi_read_complete(void * opaque, int ret)

{

    SCSIDiskReq *r = (SCSIDiskReq *)opaque;

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    int n;

    assert(r->req.aiocb != NULL);

    r->req.aiocb = NULL;

    bdrv_acct_done(s->qdev.conf.bs, &r->acct);

    if (ret < 0) {

        if (scsi_handle_rw_error(r, -ret)) {

            goto done;

        }

    }

    DPRINTF("Data ready tag=0x%x len=%zd\n", r->req.tag, r->qiov.size);

    n = r->qiov.size / 512;

    r->sector += n;

    r->sector_count -= n;

    scsi_req_data(&r->req, r->qiov.size);

done:

    if (!r->req.io_canceled) {

        scsi_req_unref(&r->req);

    }

}

/* Actually issue a read to the block device.  */

static void scsi_do_read(void *opaque, int ret)

{

    SCSIDiskReq *r = opaque;

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    uint32_t n;

    if (r->req.aiocb != NULL) {

        r->req.aiocb = NULL;

        bdrv_acct_done(s->qdev.conf.bs, &r->acct);

    }

    if (ret < 0) {

        if (scsi_handle_rw_error(r, -ret)) {

            goto done;

        }

    }

    if (r->req.io_canceled) {

        return;

    }

    /* The request is used as the AIO opaque value, so add a ref.  */

    scsi_req_ref(&r->req);

    if (r->req.sg) {

        dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ);

        r->req.resid -= r->req.sg->size;

        r->req.aiocb = dma_bdrv_read(s->qdev.conf.bs, r->req.sg, r->sector,

                                     scsi_dma_complete, r);

    } else {

        n = scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);

        bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);

        r->req.aiocb = bdrv_aio_readv(s->qdev.conf.bs, r->sector, &r->qiov, n,

                                      scsi_read_complete, r);

    }

done:

    if (!r->req.io_canceled) {

        scsi_req_unref(&r->req);

    }

}

/* Read more data from scsi device into buffer.  */

static void scsi_read_data(SCSIRequest *req)

{

    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    bool first;

    DPRINTF("Read sector_count=%d\n", r->sector_count);

    if (r->sector_count == 0) {

        /* This also clears the sense buffer for REQUEST SENSE.  */

        scsi_req_complete(&r->req, GOOD);

        return;

    }

    /* No data transfer may already be in progress */

    assert(r->req.aiocb == NULL);

    /* The request is used as the AIO opaque value, so add a ref.  */

    scsi_req_ref(&r->req);

    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {

        DPRINTF("Data transfer direction invalid\n");

        scsi_read_complete(r, -EINVAL);

        return;

    }

    if (s->tray_open) {

        scsi_read_complete(r, -ENOMEDIUM);

        return;

    }

    first = !r->started;

    r->started = true;

    if (first && scsi_is_cmd_fua(&r->req.cmd)) {

        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);

        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_do_read, r);

    } else {

        scsi_do_read(r, 0);

    }

}

/*

 * scsi_handle_rw_error has two return values.  0 means that the error

 * must be ignored, 1 means that the error has been processed and the

 * caller should not do anything else for this request.  Note that

 * scsi_handle_rw_error always manages its reference counts, independent

 * of the return value.

 */

static int scsi_handle_rw_error(SCSIDiskReq *r, int error)

{

    bool is_read = (r->req.cmd.xfer == SCSI_XFER_FROM_DEV);

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    BlockErrorAction action = bdrv_get_error_action(s->qdev.conf.bs, is_read, error);

    if (action == BDRV_ACTION_REPORT) {

        switch (error) {

        case ENOMEDIUM:

            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));

            break;

        case ENOMEM:

            scsi_check_condition(r, SENSE_CODE(TARGET_FAILURE));

            break;

        case EINVAL:

            scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));

            break;

        default:

            scsi_check_condition(r, SENSE_CODE(IO_ERROR));

            break;

        }

    }

    bdrv_error_action(s->qdev.conf.bs, action, is_read, error);

    if (action == BDRV_ACTION_STOP) {

        scsi_req_retry(&r->req);

    }

    return action != BDRV_ACTION_IGNORE;

}

static void scsi_write_complete(void * opaque, int ret)

{

    SCSIDiskReq *r = (SCSIDiskReq *)opaque;

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    uint32_t n;

    if (r->req.aiocb != NULL) {

        r->req.aiocb = NULL;

        bdrv_acct_done(s->qdev.conf.bs, &r->acct);

    }

    if (ret < 0) {

        if (scsi_handle_rw_error(r, -ret)) {

            goto done;

        }

    }

    n = r->qiov.size / 512;

    r->sector += n;

    r->sector_count -= n;

    if (r->sector_count == 0) {

        scsi_write_do_fua(r);

        return;

    } else {

        scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);

        DPRINTF("Write complete tag=0x%x more=%zd\n", r->req.tag, r->qiov.size);

        scsi_req_data(&r->req, r->qiov.size);

    }

done:

    if (!r->req.io_canceled) {

        scsi_req_unref(&r->req);

    }

}

static void scsi_write_data(SCSIRequest *req)

{

    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);

    uint32_t n;

    /* No data transfer may already be in progress */

    assert(r->req.aiocb == NULL);

    /* The request is used as the AIO opaque value, so add a ref.  */

    scsi_req_ref(&r->req);

    if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {

        DPRINTF("Data transfer direction invalid\n");

        scsi_write_complete(r, -EINVAL);

        return;

    }

    if (!r->req.sg && !r->qiov.size) {

        /* Called for the first time.  Ask the driver to send us more data.  */

        r->started = true;

        scsi_write_complete(r, 0);

        return;

    }

    if (s->tray_open) {

        scsi_write_complete(r, -ENOMEDIUM);

        return;

    }

    if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||

        r->req.cmd.buf[0] == VERIFY_16) {

        if (r->req.sg) {

            scsi_dma_complete(r, 0);

        } else {

            scsi_write_complete(r, 0);

        }

        return;

    }

    if (r->req.sg) {

        dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_WRITE);

        r->req.resid -= r->req.sg->size;

        r->req.aiocb = dma_bdrv_write(s->qdev.conf.bs, r->req.sg, r->sector,

                                      scsi_dma_complete, r);

    } else {

        n = r->qiov.size / 512;

        bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_WRITE);

        r->req.aiocb = bdrv_aio_writev(s->qdev.conf.bs, r->sector, &r->qiov, n,

                                       scsi_write_complete, r);

    }

}

/* Return a pointer to the data buffer.  */

static uint8_t *scsi_get_buf(SCSIRequest *req)

{

    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);

    return (uint8_t *)r->iov.iov_base;

}

static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)

{

    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);

    int buflen = 0;

    int start;

    if (req->cmd.buf[1] & 0x1) {

        /* Vital product data */

        uint8_t page_code = req->cmd.buf[2];

        outbuf[buflen++] = s->qdev.type & 0x1f;

        outbuf[buflen++] = page_code ; // this page

        outbuf[buflen++] = 0x00;

        outbuf[buflen++] = 0x00;

        start = buflen;

        switch (page_code) {

        case 0x00: /* Supported page codes, mandatory */

        {

            DPRINTF("Inquiry EVPD[Supported pages] "

                    "buffer size %zd\n", req->cmd.xfer);

            outbuf[buflen++] = 0x00; // list of supported pages (this page)

            if (s->serial) {

                outbuf[buflen++] = 0x80; // unit serial number

            }

            outbuf[buflen++] = 0x83; // device identification

            if (s->qdev.type == TYPE_DISK) {

                outbuf[buflen++] = 0xb0; // block limits

                outbuf[buflen++] = 0xb2; // thin provisioning

            }

            break;

        }

        case 0x80: /* Device serial number, optional */

        {

            int l;

            if (!s->serial) {

                DPRINTF("Inquiry (EVPD[Serial number] not supported\n");

                return -1;

            }

            l = strlen(s->serial);

            if (l > 20) {

                l = 20;

            }

            DPRINTF("Inquiry EVPD[Serial number] "

                    "buffer size %zd\n", req->cmd.xfer);

            memcpy(outbuf+buflen, s->serial, l);

            buflen += l;

            break;

        }

        case 0x83: /* Device identification page, mandatory */

        {

            const char *str = s->serial ?: bdrv_get_device_name(s->qdev.conf.bs);

            int max_len = s->serial ? 20 : 255 - 8;

            int id_len = strlen(str);

            if (id_len > max_len) {

                id_len = max_len;

            }

            DPRINTF("Inquiry EVPD[Device identification] "

                    "buffer size %zd\n", req->cmd.xfer);

            outbuf[buflen++] = 0x2; // ASCII

            outbuf[buflen++] = 0;   // not officially assigned

            outbuf[buflen++] = 0;   // reserved

            outbuf[buflen++] = id_len; // length of data following

            memcpy(outbuf+buflen, str, id_len);

            buflen += id_len;

            if (s->wwn) {

                outbuf[buflen++] = 0x1; // Binary

                outbuf[buflen++] = 0x3; // NAA

                outbuf[buflen++] = 0;   // reserved

                outbuf[buflen++] = 8;

                stq_be_p(&outbuf[buflen], s->wwn);

                buflen += 8;

            }

            break;

        }

        case 0xb0: /* block limits */

        {

            unsigned int unmap_sectors =

                    s->qdev.conf.discard_granularity / s->qdev.blocksize;

            unsigned int min_io_size =

                    s->qdev.conf.min_io_size / s->qdev.blocksize;

            unsigned int opt_io_size =

                    s->qdev.conf.opt_io_size / s->qdev.blocksize;

            if (s->qdev.type == TYPE_ROM) {

                DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",

                        page_code);

                return -1;

            }

            /* required VPD size with unmap support */

            buflen = 0x40;

            memset(outbuf + 4, 0, buflen - 4);

            /* optimal transfer length granularity */

            outbuf[6] = (min_io_size >> 8) & 0xff;

            outbuf[7] = min_io_size & 0xff;

            /* optimal transfer length */

            outbuf[12] = (opt_io_size >> 24) & 0xff;

            outbuf[13] = (opt_io_size >> 16) & 0xff;

            outbuf[14] = (opt_io_size >> 8) & 0xff;

            outbuf[15] = opt_io_size & 0xff;

            /* optimal unmap granularity */

            outbuf[28] = (unmap_sectors >> 24) & 0xff;

            outbuf[29] = (unmap_sectors >> 16) & 0xff;

            outbuf[30] = (unmap_sectors >> 8) & 0xff;

            outbuf[31] = unmap_sectors & 0xff;

            break;

        }

        case 0xb2: /* thin provisioning */

        {

            buflen = 8;

            outbuf[4] = 0;

            outbuf[5] = 0xe0; /* unmap & write_same 10/16 all supported */

            outbuf[6] = s->qdev.conf.discard_granularity ? 2 : 1;

            outbuf[7] = 0;

            break;

        }

        default:

            return -1;

        }

        /* done with EVPD */

        assert(buflen - start <= 255);

        outbuf[start - 1] = buflen - start;

        return buflen;

    }

    /* Standard INQUIRY data */

    if (req->cmd.buf[2] != 0) {

        return -1;

    }

    /* PAGE CODE == 0 */

    buflen = req->cmd.xfer;

    if (buflen > SCSI_MAX_INQUIRY_LEN) {

        buflen = SCSI_MAX_INQUIRY_LEN;

    }

    memset(outbuf, 0, buflen);

    outbuf[0] = s->qdev.type & 0x1f;

    outbuf[1] = (s->features & (1 << SCSI_DISK_F_REMOVABLE)) ? 0x80 : 0;

    strpadcpy((char *) &outbuf[16], 16, s->product, ' ');

    strpadcpy((char *) &outbuf[8], 8, s->vendor, ' ');

    memset(&outbuf[32], 0, 4);

    memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version)));

    /*

     * We claim conformance to SPC-3, which is required for guests

     * to ask for modern features like READ CAPACITY(16) or the

     * block characteristics VPD page by default.  Not all of SPC-3

     * is actually implemented, but we're good enough.

     */

    outbuf[2] = 5;

    outbuf[3] = 2 | 0x10; /* Format 2, HiSup */

    if (buflen > 36) {

        outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */

    } else {

        /* If the allocation length of CDB is too small,

               the additional length is not adjusted */

        outbuf[4] = 36 - 5;

    }

    /* Sync data transfer and TCQ.  */

    outbuf[7] = 0x10 | (req->bus->info->tcq ? 0x02 : 0);

    return buflen;

}

static inline bool media_is_dvd(SCSIDiskState *s)

{

    uint64_t nb_sectors;

    if (s->qdev.type != TYPE_ROM) {

        return false;

    }

    if (!bdrv_is_inserted(s->qdev.conf.bs)) {

        return false;

    }

    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);

    return nb_sectors > CD_MAX_SECTORS;

}

static inline bool media_is_cd(SCSIDiskState *s)

{

    uint64_t nb_sectors;

    if (s->qdev.type != TYPE_ROM) {

        return false;

    }

    if (!bdrv_is_inserted(s->qdev.conf.bs)) {

        return false;

    }

    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);

    return nb_sectors <= CD_MAX_SECTORS;

}

static int scsi_read_disc_information(SCSIDiskState *s, SCSIDiskReq *r,

                                      uint8_t *outbuf)

{

    uint8_t type = r->req.cmd.buf[1] & 7;

    if (s->qdev.type != TYPE_ROM) {

        return -1;

    }

    /* Types 1/2 are only defined for Blu-Ray.  */

    if (type != 0) {

        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));

        return -1;

    }

    memset(outbuf, 0, 34);

    outbuf[1] = 32;

    outbuf[2] = 0xe; /* last session complete, disc finalized */

    outbuf[3] = 1;   /* first track on disc */

    outbuf[4] = 1;   /* # of sessions */

    outbuf[5] = 1;   /* first track of last session */

    outbuf[6] = 1;   /* last track of last session */

    outbuf[7] = 0x20; /* unrestricted use */

    outbuf[8] = 0x00; /* CD-ROM or DVD-ROM */

    /* 9-10-11: most significant byte corresponding bytes 4-5-6 */

    /* 12-23: not meaningful for CD-ROM or DVD-ROM */

    /* 24-31: disc bar code */

    /* 32: disc application code */

    /* 33: number of OPC tables */

    return 34;

}

static int scsi_read_dvd_structure(SCSIDiskState *s, SCSIDiskReq *r,

                                   uint8_t *outbuf)

{

    static const int rds_caps_size[5] = {

        [0] = 2048 + 4,

        [1] = 4 + 4,

        [3] = 188 + 4,

        [4] = 2048 + 4,

    };

    uint8_t media = r->req.cmd.buf[1];

    uint8_t layer = r->req.cmd.buf[6];

    uint8_t format = r->req.cmd.buf[7];

    int size = -1;

    if (s->qdev.type != TYPE_ROM) {

        return -1;

    }

    if (media != 0) {

        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));

        return -1;

    }

    if (format != 0xff) {

        if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {

            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));

            return -1;

        }

        if (media_is_cd(s)) {

            scsi_check_condition(r, SENSE_CODE(INCOMPATIBLE_FORMAT));

            return -1;

        }

        if (format >= ARRAY_SIZE(rds_caps_size)) {

            return -1;

        }

        size = rds_caps_size[format];

        memset(outbuf, 0, size);

    }

    switch (format) {

    case 0x00: {

        /* Physical format information */

        uint64_t nb_sectors;

        if (layer != 0) {

            goto fail;

        }

        bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);

        outbuf[4] = 1;   /* DVD-ROM, part version 1 */

        outbuf[5] = 0xf; /* 120mm disc, minimum rate unspecified */

        outbuf[6] = 1;   /* one layer, read-only (per MMC-2 spec) */

        outbuf[7] = 0;   /* default densities */

        stl_be_p(&outbuf[12], (nb_sectors >> 2) - 1); /* end sector */

        stl_be_p(&outbuf[16], (nb_sectors >> 2) - 1); /* l0 end sector */

        break;

    }

    case 0x01: /* DVD copyright information, all zeros */

        break;

    case 0x03: /* BCA information - invalid field for no BCA info */

        return -1;

    case 0x04: /* DVD disc manufacturing information, all zeros */

        break;

    case 0xff: { /* List capabilities */

        int i;

        size = 4;

        for (i = 0; i < ARRAY_SIZE(rds_caps_size); i++) {

            if (!rds_caps_size[i]) {

                continue;

            }

            outbuf[size] = i;

            outbuf[size + 1] = 0x40; /* Not writable, readable */

            stw_be_p(&outbuf[size + 2], rds_caps_size[i]);

            size += 4;

        }

        break;

     }

    default:

        return -1;

    }

    /* Size of buffer, not including 2 byte size field */

    stw_be_p(outbuf, size - 2);

    return size;

fail:

    return -1;

}

static int scsi_event_status_media(SCSIDiskState *s, uint8_t *outbuf)

{

    uint8_t event_code, media_status;

    media_status = 0;

    if (s->tray_open) {

        media_status = MS_TRAY_OPEN;

    } else if (bdrv_is_inserted(s->qdev.conf.bs)) {

        media_status = MS_MEDIA_PRESENT;

    }

    /* Event notification descriptor */

    event_code = MEC_NO_CHANGE;

    if (media_status != MS_TRAY_OPEN) {

        if (s->media_event) {

            event_code = MEC_NEW_MEDIA;

            s->media_event = false;

        } else if (s->eject_request) {

            event_code = MEC_EJECT_REQUESTED;

            s->eject_request = false;

        }

    }

    outbuf[0] = event_code;

    outbuf[1] = media_status;

    /* These fields are reserved, just clear them. */

    outbuf[2] = 0;

    outbuf[3] = 0;

    return 4;

}

static int scsi_get_event_status_notification(SCSIDiskState *s, SCSIDiskReq *r,

                                              uint8_t *outbuf)

{

    int size;

    uint8_t *buf = r->req.cmd.buf;

    uint8_t notification_class_request = buf[4];

    if (s->qdev.type != TYPE_ROM) {

        return -1;

    }

    if ((buf[1] & 1) == 0) {

        /* asynchronous */

        return -1;

    }

    size = 4;

    outbuf[0] = outbuf[1] = 0;

    outbuf[3] = 1 << GESN_MEDIA; /* supported events */

    if (notification_class_request & (1 << GESN_MEDIA)) {

        outbuf[2] = GESN_MEDIA;

        size += scsi_event_status_media(s, &outbuf[size]);

    } else {