Statistics
| Branch: | Revision:

root / hw / scsi-disk.c @ e590ecbe

History | View | Annotate | Download (60.4 kB)

1
/*
2
 * SCSI Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Based on code by Fabrice Bellard
6
 *
7
 * Written by Paul Brook
8
 * Modifications:
9
 *  2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10
 *                                 when the allocation length of CDB is smaller
11
 *                                 than 36.
12
 *  2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13
 *                                 MODE SENSE response.
14
 *
15
 * This code is licensed under the LGPL.
16
 *
17
 * Note that this file only handles the SCSI architecture model and device
18
 * commands.  Emulation of interface/link layer protocols is handled by
19
 * the host adapter emulator.
20
 */
21

    
22
//#define DEBUG_SCSI
23

    
24
#ifdef DEBUG_SCSI
25
#define DPRINTF(fmt, ...) \
26
do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
27
#else
28
#define DPRINTF(fmt, ...) do {} while(0)
29
#endif
30

    
31
#define BADF(fmt, ...) \
32
do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
33

    
34
#include "qemu-common.h"
35
#include "qemu-error.h"
36
#include "scsi.h"
37
#include "scsi-defs.h"
38
#include "sysemu.h"
39
#include "blockdev.h"
40
#include "block_int.h"
41
#include "dma.h"
42

    
43
#ifdef __linux
44
#include <scsi/sg.h>
45
#endif
46

    
47
#define SCSI_DMA_BUF_SIZE    131072
48
#define SCSI_MAX_INQUIRY_LEN 256
49

    
50
typedef struct SCSIDiskState SCSIDiskState;
51

    
52
typedef struct SCSIDiskReq {
53
    SCSIRequest req;
54
    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
55
    uint64_t sector;
56
    uint32_t sector_count;
57
    uint32_t buflen;
58
    bool started;
59
    struct iovec iov;
60
    QEMUIOVector qiov;
61
    BlockAcctCookie acct;
62
} SCSIDiskReq;
63

    
64
struct SCSIDiskState
65
{
66
    SCSIDevice qdev;
67
    uint32_t removable;
68
    bool media_changed;
69
    bool media_event;
70
    bool eject_request;
71
    QEMUBH *bh;
72
    char *version;
73
    char *serial;
74
    bool tray_open;
75
    bool tray_locked;
76
};
77

    
78
static int scsi_handle_rw_error(SCSIDiskReq *r, int error);
79

    
80
static void scsi_free_request(SCSIRequest *req)
81
{
82
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
83

    
84
    if (r->iov.iov_base) {
85
        qemu_vfree(r->iov.iov_base);
86
    }
87
}
88

    
89
/* Helper function for command completion with sense.  */
90
static void scsi_check_condition(SCSIDiskReq *r, SCSISense sense)
91
{
92
    DPRINTF("Command complete tag=0x%x sense=%d/%d/%d\n",
93
            r->req.tag, sense.key, sense.asc, sense.ascq);
94
    scsi_req_build_sense(&r->req, sense);
95
    scsi_req_complete(&r->req, CHECK_CONDITION);
96
}
97

    
98
/* Cancel a pending data transfer.  */
99
static void scsi_cancel_io(SCSIRequest *req)
100
{
101
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
102

    
103
    DPRINTF("Cancel tag=0x%x\n", req->tag);
104
    if (r->req.aiocb) {
105
        bdrv_aio_cancel(r->req.aiocb);
106

    
107
        /* This reference was left in by scsi_*_data.  We take ownership of
108
         * it the moment scsi_req_cancel is called, independent of whether
109
         * bdrv_aio_cancel completes the request or not.  */
110
        scsi_req_unref(&r->req);
111
    }
112
    r->req.aiocb = NULL;
113
}
114

    
115
static uint32_t scsi_init_iovec(SCSIDiskReq *r, size_t size)
116
{
117
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
118

    
119
    if (!r->iov.iov_base) {
120
        r->buflen = size;
121
        r->iov.iov_base = qemu_blockalign(s->qdev.conf.bs, r->buflen);
122
    }
123
    r->iov.iov_len = MIN(r->sector_count * 512, r->buflen);
124
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
125
    return r->qiov.size / 512;
126
}
127

    
128
static void scsi_disk_save_request(QEMUFile *f, SCSIRequest *req)
129
{
130
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
131

    
132
    qemu_put_be64s(f, &r->sector);
133
    qemu_put_be32s(f, &r->sector_count);
134
    qemu_put_be32s(f, &r->buflen);
135
    if (r->buflen && r->req.cmd.mode == SCSI_XFER_TO_DEV) {
136
        qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
137
    }
138
}
139

    
140
static void scsi_disk_load_request(QEMUFile *f, SCSIRequest *req)
141
{
142
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
143

    
144
    qemu_get_be64s(f, &r->sector);
145
    qemu_get_be32s(f, &r->sector_count);
146
    qemu_get_be32s(f, &r->buflen);
147
    if (r->buflen) {
148
        scsi_init_iovec(r, r->buflen);
149
        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
150
            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
151
        }
152
    }
153

    
154
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
155
}
156

    
157
static void scsi_flush_complete(void * opaque, int ret)
158
{
159
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
160
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
161

    
162
    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
163

    
164
    if (ret < 0) {
165
        if (scsi_handle_rw_error(r, -ret)) {
166
            goto done;
167
        }
168
    }
169

    
170
    scsi_req_complete(&r->req, GOOD);
171

    
172
done:
173
    if (!r->req.io_canceled) {
174
        scsi_req_unref(&r->req);
175
    }
176
}
177

    
178
static bool scsi_is_cmd_fua(SCSICommand *cmd)
179
{
180
    switch (cmd->buf[0]) {
181
    case READ_10:
182
    case READ_12:
183
    case READ_16:
184
    case WRITE_10:
185
    case WRITE_12:
186
    case WRITE_16:
187
        return (cmd->buf[1] & 8) != 0;
188

    
189
    case VERIFY_10:
190
    case VERIFY_12:
191
    case VERIFY_16:
192
    case WRITE_VERIFY_10:
193
    case WRITE_VERIFY_12:
194
    case WRITE_VERIFY_16:
195
        return true;
196

    
197
    case READ_6:
198
    case WRITE_6:
199
    default:
200
        return false;
201
    }
202
}
203

    
204
static void scsi_write_do_fua(SCSIDiskReq *r)
205
{
206
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
207

    
208
    if (scsi_is_cmd_fua(&r->req.cmd)) {
209
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
210
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_flush_complete, r);
211
        return;
212
    }
213

    
214
    scsi_req_complete(&r->req, GOOD);
215
    if (!r->req.io_canceled) {
216
        scsi_req_unref(&r->req);
217
    }
218
}
219

    
220
static void scsi_dma_complete(void *opaque, int ret)
221
{
222
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
223
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
224

    
225
    if (r->req.aiocb != NULL) {
226
        r->req.aiocb = NULL;
227
        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
228
    }
229

    
230
    if (ret < 0) {
231
        if (scsi_handle_rw_error(r, -ret)) {
232
            goto done;
233
        }
234
    }
235

    
236
    r->sector += r->sector_count;
237
    r->sector_count = 0;
238
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
239
        scsi_write_do_fua(r);
240
        return;
241
    } else {
242
        scsi_req_complete(&r->req, GOOD);
243
    }
244

    
245
done:
246
    if (!r->req.io_canceled) {
247
        scsi_req_unref(&r->req);
248
    }
249
}
250

    
251
static void scsi_read_complete(void * opaque, int ret)
252
{
253
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
254
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
255
    int n;
256

    
257
    if (r->req.aiocb != NULL) {
258
        r->req.aiocb = NULL;
259
        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
260
    }
261

    
262
    if (ret < 0) {
263
        if (scsi_handle_rw_error(r, -ret)) {
264
            goto done;
265
        }
266
    }
267

    
268
    DPRINTF("Data ready tag=0x%x len=%zd\n", r->req.tag, r->qiov.size);
269

    
270
    n = r->qiov.size / 512;
271
    r->sector += n;
272
    r->sector_count -= n;
273
    scsi_req_data(&r->req, r->qiov.size);
274

    
275
done:
276
    if (!r->req.io_canceled) {
277
        scsi_req_unref(&r->req);
278
    }
279
}
280

    
281
/* Actually issue a read to the block device.  */
282
static void scsi_do_read(void *opaque, int ret)
283
{
284
    SCSIDiskReq *r = opaque;
285
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
286
    uint32_t n;
287

    
288
    if (r->req.aiocb != NULL) {
289
        r->req.aiocb = NULL;
290
        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
291
    }
292

    
293
    if (ret < 0) {
294
        if (scsi_handle_rw_error(r, -ret)) {
295
            goto done;
296
        }
297
    }
298

    
299
    if (r->req.sg) {
300
        dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ);
301
        r->req.resid -= r->req.sg->size;
302
        r->req.aiocb = dma_bdrv_read(s->qdev.conf.bs, r->req.sg, r->sector,
303
                                     scsi_dma_complete, r);
304
    } else {
305
        n = scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
306
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
307
        r->req.aiocb = bdrv_aio_readv(s->qdev.conf.bs, r->sector, &r->qiov, n,
308
                                      scsi_read_complete, r);
309
    }
310

    
311
done:
312
    if (!r->req.io_canceled) {
313
        scsi_req_unref(&r->req);
314
    }
315
}
316

    
317
/* Read more data from scsi device into buffer.  */
318
static void scsi_read_data(SCSIRequest *req)
319
{
320
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
321
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
322
    bool first;
323

    
324
    if (r->sector_count == (uint32_t)-1) {
325
        DPRINTF("Read buf_len=%zd\n", r->iov.iov_len);
326
        r->sector_count = 0;
327
        r->started = true;
328
        scsi_req_data(&r->req, r->iov.iov_len);
329
        return;
330
    }
331
    DPRINTF("Read sector_count=%d\n", r->sector_count);
332
    if (r->sector_count == 0) {
333
        /* This also clears the sense buffer for REQUEST SENSE.  */
334
        scsi_req_complete(&r->req, GOOD);
335
        return;
336
    }
337

    
338
    /* No data transfer may already be in progress */
339
    assert(r->req.aiocb == NULL);
340

    
341
    /* The request is used as the AIO opaque value, so add a ref.  */
342
    scsi_req_ref(&r->req);
343
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
344
        DPRINTF("Data transfer direction invalid\n");
345
        scsi_read_complete(r, -EINVAL);
346
        return;
347
    }
348

    
349
    if (s->tray_open) {
350
        scsi_read_complete(r, -ENOMEDIUM);
351
        return;
352
    }
353

    
354
    first = !r->started;
355
    r->started = true;
356
    if (first && scsi_is_cmd_fua(&r->req.cmd)) {
357
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
358
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_do_read, r);
359
    } else {
360
        scsi_do_read(r, 0);
361
    }
362
}
363

    
364
/*
365
 * scsi_handle_rw_error has two return values.  0 means that the error
366
 * must be ignored, 1 means that the error has been processed and the
367
 * caller should not do anything else for this request.  Note that
368
 * scsi_handle_rw_error always manages its reference counts, independent
369
 * of the return value.
370
 */
371
static int scsi_handle_rw_error(SCSIDiskReq *r, int error)
372
{
373
    int is_read = (r->req.cmd.xfer == SCSI_XFER_FROM_DEV);
374
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
375
    BlockErrorAction action = bdrv_get_on_error(s->qdev.conf.bs, is_read);
376

    
377
    if (action == BLOCK_ERR_IGNORE) {
378
        bdrv_emit_qmp_error_event(s->qdev.conf.bs, BDRV_ACTION_IGNORE, is_read);
379
        return 0;
380
    }
381

    
382
    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
383
            || action == BLOCK_ERR_STOP_ANY) {
384

    
385
        bdrv_emit_qmp_error_event(s->qdev.conf.bs, BDRV_ACTION_STOP, is_read);
386
        vm_stop(RUN_STATE_IO_ERROR);
387
        bdrv_iostatus_set_err(s->qdev.conf.bs, error);
388
        scsi_req_retry(&r->req);
389
    } else {
390
        switch (error) {
391
        case ENOMEDIUM:
392
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
393
            break;
394
        case ENOMEM:
395
            scsi_check_condition(r, SENSE_CODE(TARGET_FAILURE));
396
            break;
397
        case EINVAL:
398
            scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
399
            break;
400
        default:
401
            scsi_check_condition(r, SENSE_CODE(IO_ERROR));
402
            break;
403
        }
404
        bdrv_emit_qmp_error_event(s->qdev.conf.bs, BDRV_ACTION_REPORT, is_read);
405
    }
406
    return 1;
407
}
408

    
409
static void scsi_write_complete(void * opaque, int ret)
410
{
411
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
412
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
413
    uint32_t n;
414

    
415
    if (r->req.aiocb != NULL) {
416
        r->req.aiocb = NULL;
417
        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
418
    }
419

    
420
    if (ret < 0) {
421
        if (scsi_handle_rw_error(r, -ret)) {
422
            goto done;
423
        }
424
    }
425

    
426
    n = r->qiov.size / 512;
427
    r->sector += n;
428
    r->sector_count -= n;
429
    if (r->sector_count == 0) {
430
        scsi_write_do_fua(r);
431
        return;
432
    } else {
433
        scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
434
        DPRINTF("Write complete tag=0x%x more=%d\n", r->req.tag, r->qiov.size);
435
        scsi_req_data(&r->req, r->qiov.size);
436
    }
437

    
438
done:
439
    if (!r->req.io_canceled) {
440
        scsi_req_unref(&r->req);
441
    }
442
}
443

    
444
static void scsi_write_data(SCSIRequest *req)
445
{
446
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
447
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
448
    uint32_t n;
449

    
450
    /* No data transfer may already be in progress */
451
    assert(r->req.aiocb == NULL);
452

    
453
    /* The request is used as the AIO opaque value, so add a ref.  */
454
    scsi_req_ref(&r->req);
455
    if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {
456
        DPRINTF("Data transfer direction invalid\n");
457
        scsi_write_complete(r, -EINVAL);
458
        return;
459
    }
460

    
461
    if (!r->req.sg && !r->qiov.size) {
462
        /* Called for the first time.  Ask the driver to send us more data.  */
463
        r->started = true;
464
        scsi_write_complete(r, 0);
465
        return;
466
    }
467
    if (s->tray_open) {
468
        scsi_write_complete(r, -ENOMEDIUM);
469
        return;
470
    }
471

    
472
    if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
473
        r->req.cmd.buf[0] == VERIFY_16) {
474
        if (r->req.sg) {
475
            scsi_dma_complete(r, 0);
476
        } else {
477
            scsi_write_complete(r, 0);
478
        }
479
        return;
480
    }
481

    
482
    if (r->req.sg) {
483
        dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_WRITE);
484
        r->req.resid -= r->req.sg->size;
485
        r->req.aiocb = dma_bdrv_write(s->qdev.conf.bs, r->req.sg, r->sector,
486
                                      scsi_dma_complete, r);
487
    } else {
488
        n = r->qiov.size / 512;
489
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_WRITE);
490
        r->req.aiocb = bdrv_aio_writev(s->qdev.conf.bs, r->sector, &r->qiov, n,
491
                                       scsi_write_complete, r);
492
    }
493
}
494

    
495
/* Return a pointer to the data buffer.  */
496
static uint8_t *scsi_get_buf(SCSIRequest *req)
497
{
498
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
499

    
500
    return (uint8_t *)r->iov.iov_base;
501
}
502

    
503
static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
504
{
505
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
506
    int buflen = 0;
507

    
508
    if (req->cmd.buf[1] & 0x2) {
509
        /* Command support data - optional, not implemented */
510
        BADF("optional INQUIRY command support request not implemented\n");
511
        return -1;
512
    }
513

    
514
    if (req->cmd.buf[1] & 0x1) {
515
        /* Vital product data */
516
        uint8_t page_code = req->cmd.buf[2];
517
        if (req->cmd.xfer < 4) {
518
            BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
519
                 "less than 4\n", page_code, req->cmd.xfer);
520
            return -1;
521
        }
522

    
523
        outbuf[buflen++] = s->qdev.type & 0x1f;
524
        outbuf[buflen++] = page_code ; // this page
525
        outbuf[buflen++] = 0x00;
526

    
527
        switch (page_code) {
528
        case 0x00: /* Supported page codes, mandatory */
529
        {
530
            int pages;
531
            DPRINTF("Inquiry EVPD[Supported pages] "
532
                    "buffer size %zd\n", req->cmd.xfer);
533
            pages = buflen++;
534
            outbuf[buflen++] = 0x00; // list of supported pages (this page)
535
            if (s->serial) {
536
                outbuf[buflen++] = 0x80; // unit serial number
537
            }
538
            outbuf[buflen++] = 0x83; // device identification
539
            if (s->qdev.type == TYPE_DISK) {
540
                outbuf[buflen++] = 0xb0; // block limits
541
                outbuf[buflen++] = 0xb2; // thin provisioning
542
            }
543
            outbuf[pages] = buflen - pages - 1; // number of pages
544
            break;
545
        }
546
        case 0x80: /* Device serial number, optional */
547
        {
548
            int l;
549

    
550
            if (!s->serial) {
551
                DPRINTF("Inquiry (EVPD[Serial number] not supported\n");
552
                return -1;
553
            }
554

    
555
            l = strlen(s->serial);
556
            if (l > 20) {
557
                l = 20;
558
            }
559

    
560
            DPRINTF("Inquiry EVPD[Serial number] "
561
                    "buffer size %zd\n", req->cmd.xfer);
562
            outbuf[buflen++] = l;
563
            memcpy(outbuf+buflen, s->serial, l);
564
            buflen += l;
565
            break;
566
        }
567

    
568
        case 0x83: /* Device identification page, mandatory */
569
        {
570
            const char *str = s->serial ?: bdrv_get_device_name(s->qdev.conf.bs);
571
            int max_len = s->serial ? 20 : 255 - 8;
572
            int id_len = strlen(str);
573

    
574
            if (id_len > max_len) {
575
                id_len = max_len;
576
            }
577
            DPRINTF("Inquiry EVPD[Device identification] "
578
                    "buffer size %zd\n", req->cmd.xfer);
579

    
580
            outbuf[buflen++] = 4 + id_len;
581
            outbuf[buflen++] = 0x2; // ASCII
582
            outbuf[buflen++] = 0;   // not officially assigned
583
            outbuf[buflen++] = 0;   // reserved
584
            outbuf[buflen++] = id_len; // length of data following
585

    
586
            memcpy(outbuf+buflen, str, id_len);
587
            buflen += id_len;
588
            break;
589
        }
590
        case 0xb0: /* block limits */
591
        {
592
            unsigned int unmap_sectors =
593
                    s->qdev.conf.discard_granularity / s->qdev.blocksize;
594
            unsigned int min_io_size =
595
                    s->qdev.conf.min_io_size / s->qdev.blocksize;
596
            unsigned int opt_io_size =
597
                    s->qdev.conf.opt_io_size / s->qdev.blocksize;
598

    
599
            if (s->qdev.type == TYPE_ROM) {
600
                DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
601
                        page_code);
602
                return -1;
603
            }
604
            /* required VPD size with unmap support */
605
            outbuf[3] = buflen = 0x3c;
606

    
607
            memset(outbuf + 4, 0, buflen - 4);
608

    
609
            /* optimal transfer length granularity */
610
            outbuf[6] = (min_io_size >> 8) & 0xff;
611
            outbuf[7] = min_io_size & 0xff;
612

    
613
            /* optimal transfer length */
614
            outbuf[12] = (opt_io_size >> 24) & 0xff;
615
            outbuf[13] = (opt_io_size >> 16) & 0xff;
616
            outbuf[14] = (opt_io_size >> 8) & 0xff;
617
            outbuf[15] = opt_io_size & 0xff;
618

    
619
            /* optimal unmap granularity */
620
            outbuf[28] = (unmap_sectors >> 24) & 0xff;
621
            outbuf[29] = (unmap_sectors >> 16) & 0xff;
622
            outbuf[30] = (unmap_sectors >> 8) & 0xff;
623
            outbuf[31] = unmap_sectors & 0xff;
624
            break;
625
        }
626
        case 0xb2: /* thin provisioning */
627
        {
628
            outbuf[3] = buflen = 8;
629
            outbuf[4] = 0;
630
            outbuf[5] = 0x40; /* write same with unmap supported */
631
            outbuf[6] = 0;
632
            outbuf[7] = 0;
633
            break;
634
        }
635
        default:
636
            BADF("Error: unsupported Inquiry (EVPD[%02X]) "
637
                 "buffer size %zd\n", page_code, req->cmd.xfer);
638
            return -1;
639
        }
640
        /* done with EVPD */
641
        return buflen;
642
    }
643

    
644
    /* Standard INQUIRY data */
645
    if (req->cmd.buf[2] != 0) {
646
        BADF("Error: Inquiry (STANDARD) page or code "
647
             "is non-zero [%02X]\n", req->cmd.buf[2]);
648
        return -1;
649
    }
650

    
651
    /* PAGE CODE == 0 */
652
    if (req->cmd.xfer < 5) {
653
        BADF("Error: Inquiry (STANDARD) buffer size %zd "
654
             "is less than 5\n", req->cmd.xfer);
655
        return -1;
656
    }
657

    
658
    buflen = req->cmd.xfer;
659
    if (buflen > SCSI_MAX_INQUIRY_LEN) {
660
        buflen = SCSI_MAX_INQUIRY_LEN;
661
    }
662
    memset(outbuf, 0, buflen);
663

    
664
    outbuf[0] = s->qdev.type & 0x1f;
665
    outbuf[1] = s->removable ? 0x80 : 0;
666
    if (s->qdev.type == TYPE_ROM) {
667
        memcpy(&outbuf[16], "QEMU CD-ROM     ", 16);
668
    } else {
669
        memcpy(&outbuf[16], "QEMU HARDDISK   ", 16);
670
    }
671
    memcpy(&outbuf[8], "QEMU    ", 8);
672
    memset(&outbuf[32], 0, 4);
673
    memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version)));
674
    /*
675
     * We claim conformance to SPC-3, which is required for guests
676
     * to ask for modern features like READ CAPACITY(16) or the
677
     * block characteristics VPD page by default.  Not all of SPC-3
678
     * is actually implemented, but we're good enough.
679
     */
680
    outbuf[2] = 5;
681
    outbuf[3] = 2; /* Format 2 */
682

    
683
    if (buflen > 36) {
684
        outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
685
    } else {
686
        /* If the allocation length of CDB is too small,
687
               the additional length is not adjusted */
688
        outbuf[4] = 36 - 5;
689
    }
690

    
691
    /* Sync data transfer and TCQ.  */
692
    outbuf[7] = 0x10 | (req->bus->info->tcq ? 0x02 : 0);
693
    return buflen;
694
}
695

    
696
static inline bool media_is_dvd(SCSIDiskState *s)
697
{
698
    uint64_t nb_sectors;
699
    if (s->qdev.type != TYPE_ROM) {
700
        return false;
701
    }
702
    if (!bdrv_is_inserted(s->qdev.conf.bs)) {
703
        return false;
704
    }
705
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
706
    return nb_sectors > CD_MAX_SECTORS;
707
}
708

    
709
static inline bool media_is_cd(SCSIDiskState *s)
710
{
711
    uint64_t nb_sectors;
712
    if (s->qdev.type != TYPE_ROM) {
713
        return false;
714
    }
715
    if (!bdrv_is_inserted(s->qdev.conf.bs)) {
716
        return false;
717
    }
718
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
719
    return nb_sectors <= CD_MAX_SECTORS;
720
}
721

    
722
static int scsi_read_dvd_structure(SCSIDiskState *s, SCSIDiskReq *r,
723
                                   uint8_t *outbuf)
724
{
725
    static const int rds_caps_size[5] = {
726
        [0] = 2048 + 4,
727
        [1] = 4 + 4,
728
        [3] = 188 + 4,
729
        [4] = 2048 + 4,
730
    };
731

    
732
    uint8_t media = r->req.cmd.buf[1];
733
    uint8_t layer = r->req.cmd.buf[6];
734
    uint8_t format = r->req.cmd.buf[7];
735
    int size = -1;
736

    
737
    if (s->qdev.type != TYPE_ROM) {
738
        return -1;
739
    }
740
    if (media != 0) {
741
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
742
        return -1;
743
    }
744

    
745
    if (format != 0xff) {
746
        if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {
747
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
748
            return -1;
749
        }
750
        if (media_is_cd(s)) {
751
            scsi_check_condition(r, SENSE_CODE(INCOMPATIBLE_FORMAT));
752
            return -1;
753
        }
754
        if (format >= ARRAY_SIZE(rds_caps_size)) {
755
            return -1;
756
        }
757
        size = rds_caps_size[format];
758
        memset(outbuf, 0, size);
759
    }
760

    
761
    switch (format) {
762
    case 0x00: {
763
        /* Physical format information */
764
        uint64_t nb_sectors;
765
        if (layer != 0) {
766
            goto fail;
767
        }
768
        bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
769

    
770
        outbuf[4] = 1;   /* DVD-ROM, part version 1 */
771
        outbuf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
772
        outbuf[6] = 1;   /* one layer, read-only (per MMC-2 spec) */
773
        outbuf[7] = 0;   /* default densities */
774

    
775
        stl_be_p(&outbuf[12], (nb_sectors >> 2) - 1); /* end sector */
776
        stl_be_p(&outbuf[16], (nb_sectors >> 2) - 1); /* l0 end sector */
777
        break;
778
    }
779

    
780
    case 0x01: /* DVD copyright information, all zeros */
781
        break;
782

    
783
    case 0x03: /* BCA information - invalid field for no BCA info */
784
        return -1;
785

    
786
    case 0x04: /* DVD disc manufacturing information, all zeros */
787
        break;
788

    
789
    case 0xff: { /* List capabilities */
790
        int i;
791
        size = 4;
792
        for (i = 0; i < ARRAY_SIZE(rds_caps_size); i++) {
793
            if (!rds_caps_size[i]) {
794
                continue;
795
            }
796
            outbuf[size] = i;
797
            outbuf[size + 1] = 0x40; /* Not writable, readable */
798
            stw_be_p(&outbuf[size + 2], rds_caps_size[i]);
799
            size += 4;
800
        }
801
        break;
802
     }
803

    
804
    default:
805
        return -1;
806
    }
807

    
808
    /* Size of buffer, not including 2 byte size field */
809
    stw_be_p(outbuf, size - 2);
810
    return size;
811

    
812
fail:
813
    return -1;
814
}
815

    
816
static int scsi_event_status_media(SCSIDiskState *s, uint8_t *outbuf)
817
{
818
    uint8_t event_code, media_status;
819

    
820
    media_status = 0;
821
    if (s->tray_open) {
822
        media_status = MS_TRAY_OPEN;
823
    } else if (bdrv_is_inserted(s->qdev.conf.bs)) {
824
        media_status = MS_MEDIA_PRESENT;
825
    }
826

    
827
    /* Event notification descriptor */
828
    event_code = MEC_NO_CHANGE;
829
    if (media_status != MS_TRAY_OPEN) {
830
        if (s->media_event) {
831
            event_code = MEC_NEW_MEDIA;
832
            s->media_event = false;
833
        } else if (s->eject_request) {
834
            event_code = MEC_EJECT_REQUESTED;
835
            s->eject_request = false;
836
        }
837
    }
838

    
839
    outbuf[0] = event_code;
840
    outbuf[1] = media_status;
841

    
842
    /* These fields are reserved, just clear them. */
843
    outbuf[2] = 0;
844
    outbuf[3] = 0;
845
    return 4;
846
}
847

    
848
static int scsi_get_event_status_notification(SCSIDiskState *s, SCSIDiskReq *r,
849
                                              uint8_t *outbuf)
850
{
851
    int size;
852
    uint8_t *buf = r->req.cmd.buf;
853
    uint8_t notification_class_request = buf[4];
854
    if (s->qdev.type != TYPE_ROM) {
855
        return -1;
856
    }
857
    if ((buf[1] & 1) == 0) {
858
        /* asynchronous */
859
        return -1;
860
    }
861

    
862
    size = 4;
863
    outbuf[0] = outbuf[1] = 0;
864
    outbuf[3] = 1 << GESN_MEDIA; /* supported events */
865
    if (notification_class_request & (1 << GESN_MEDIA)) {
866
        outbuf[2] = GESN_MEDIA;
867
        size += scsi_event_status_media(s, &outbuf[size]);
868
    } else {
869
        outbuf[2] = 0x80;
870
    }
871
    stw_be_p(outbuf, size - 4);
872
    return size;
873
}
874

    
875
static int scsi_get_configuration(SCSIDiskState *s, uint8_t *outbuf)
876
{
877
    int current;
878

    
879
    if (s->qdev.type != TYPE_ROM) {
880
        return -1;
881
    }
882
    current = media_is_dvd(s) ? MMC_PROFILE_DVD_ROM : MMC_PROFILE_CD_ROM;
883
    memset(outbuf, 0, 40);
884
    stl_be_p(&outbuf[0], 36); /* Bytes after the data length field */
885
    stw_be_p(&outbuf[6], current);
886
    /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
887
    outbuf[10] = 0x03; /* persistent, current */
888
    outbuf[11] = 8; /* two profiles */
889
    stw_be_p(&outbuf[12], MMC_PROFILE_DVD_ROM);
890
    outbuf[14] = (current == MMC_PROFILE_DVD_ROM);
891
    stw_be_p(&outbuf[16], MMC_PROFILE_CD_ROM);
892
    outbuf[18] = (current == MMC_PROFILE_CD_ROM);
893
    /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
894
    stw_be_p(&outbuf[20], 1);
895
    outbuf[22] = 0x08 | 0x03; /* version 2, persistent, current */
896
    outbuf[23] = 8;
897
    stl_be_p(&outbuf[24], 1); /* SCSI */
898
    outbuf[28] = 1; /* DBE = 1, mandatory */
899
    /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
900
    stw_be_p(&outbuf[32], 3);
901
    outbuf[34] = 0x08 | 0x03; /* version 2, persistent, current */
902
    outbuf[35] = 4;
903
    outbuf[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
904
    /* TODO: Random readable, CD read, DVD read, drive serial number,
905
       power management */
906
    return 40;
907
}
908

    
909
static int scsi_emulate_mechanism_status(SCSIDiskState *s, uint8_t *outbuf)
910
{
911
    if (s->qdev.type != TYPE_ROM) {
912
        return -1;
913
    }
914
    memset(outbuf, 0, 8);
915
    outbuf[5] = 1; /* CD-ROM */
916
    return 8;
917
}
918

    
919
static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
920
                           int page_control)
921
{
922
    static const int mode_sense_valid[0x3f] = {
923
        [MODE_PAGE_HD_GEOMETRY]            = (1 << TYPE_DISK),
924
        [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY] = (1 << TYPE_DISK),
925
        [MODE_PAGE_CACHING]                = (1 << TYPE_DISK) | (1 << TYPE_ROM),
926
        [MODE_PAGE_R_W_ERROR]              = (1 << TYPE_DISK) | (1 << TYPE_ROM),
927
        [MODE_PAGE_AUDIO_CTL]              = (1 << TYPE_ROM),
928
        [MODE_PAGE_CAPABILITIES]           = (1 << TYPE_ROM),
929
    };
930

    
931
    BlockDriverState *bdrv = s->qdev.conf.bs;
932
    int cylinders, heads, secs;
933
    uint8_t *p = *p_outbuf;
934

    
935
    if ((mode_sense_valid[page] & (1 << s->qdev.type)) == 0) {
936
        return -1;
937
    }
938

    
939
    p[0] = page;
940

    
941
    /*
942
     * If Changeable Values are requested, a mask denoting those mode parameters
943
     * that are changeable shall be returned. As we currently don't support
944
     * parameter changes via MODE_SELECT all bits are returned set to zero.
945
     * The buffer was already menset to zero by the caller of this function.
946
     */
947
    switch (page) {
948
    case MODE_PAGE_HD_GEOMETRY:
949
        p[1] = 0x16;
950
        if (page_control == 1) { /* Changeable Values */
951
            break;
952
        }
953
        /* if a geometry hint is available, use it */
954
        bdrv_guess_geometry(bdrv, &cylinders, &heads, &secs);
955
        p[2] = (cylinders >> 16) & 0xff;
956
        p[3] = (cylinders >> 8) & 0xff;
957
        p[4] = cylinders & 0xff;
958
        p[5] = heads & 0xff;
959
        /* Write precomp start cylinder, disabled */
960
        p[6] = (cylinders >> 16) & 0xff;
961
        p[7] = (cylinders >> 8) & 0xff;
962
        p[8] = cylinders & 0xff;
963
        /* Reduced current start cylinder, disabled */
964
        p[9] = (cylinders >> 16) & 0xff;
965
        p[10] = (cylinders >> 8) & 0xff;
966
        p[11] = cylinders & 0xff;
967
        /* Device step rate [ns], 200ns */
968
        p[12] = 0;
969
        p[13] = 200;
970
        /* Landing zone cylinder */
971
        p[14] = 0xff;
972
        p[15] =  0xff;
973
        p[16] = 0xff;
974
        /* Medium rotation rate [rpm], 5400 rpm */
975
        p[20] = (5400 >> 8) & 0xff;
976
        p[21] = 5400 & 0xff;
977
        break;
978

    
979
    case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY:
980
        p[1] = 0x1e;
981
        if (page_control == 1) { /* Changeable Values */
982
            break;
983
        }
984
        /* Transfer rate [kbit/s], 5Mbit/s */
985
        p[2] = 5000 >> 8;
986
        p[3] = 5000 & 0xff;
987
        /* if a geometry hint is available, use it */
988
        bdrv_guess_geometry(bdrv, &cylinders, &heads, &secs);
989
        p[4] = heads & 0xff;
990
        p[5] = secs & 0xff;
991
        p[6] = s->qdev.blocksize >> 8;
992
        p[8] = (cylinders >> 8) & 0xff;
993
        p[9] = cylinders & 0xff;
994
        /* Write precomp start cylinder, disabled */
995
        p[10] = (cylinders >> 8) & 0xff;
996
        p[11] = cylinders & 0xff;
997
        /* Reduced current start cylinder, disabled */
998
        p[12] = (cylinders >> 8) & 0xff;
999
        p[13] = cylinders & 0xff;
1000
        /* Device step rate [100us], 100us */
1001
        p[14] = 0;
1002
        p[15] = 1;
1003
        /* Device step pulse width [us], 1us */
1004
        p[16] = 1;
1005
        /* Device head settle delay [100us], 100us */
1006
        p[17] = 0;
1007
        p[18] = 1;
1008
        /* Motor on delay [0.1s], 0.1s */
1009
        p[19] = 1;
1010
        /* Motor off delay [0.1s], 0.1s */
1011
        p[20] = 1;
1012
        /* Medium rotation rate [rpm], 5400 rpm */
1013
        p[28] = (5400 >> 8) & 0xff;
1014
        p[29] = 5400 & 0xff;
1015
        break;
1016

    
1017
    case MODE_PAGE_CACHING:
1018
        p[0] = 8;
1019
        p[1] = 0x12;
1020
        if (page_control == 1) { /* Changeable Values */
1021
            break;
1022
        }
1023
        if (bdrv_enable_write_cache(s->qdev.conf.bs)) {
1024
            p[2] = 4; /* WCE */
1025
        }
1026
        break;
1027

    
1028
    case MODE_PAGE_R_W_ERROR:
1029
        p[1] = 10;
1030
        p[2] = 0x80; /* Automatic Write Reallocation Enabled */
1031
        if (s->qdev.type == TYPE_ROM) {
1032
            p[3] = 0x20; /* Read Retry Count */
1033
        }
1034
        break;
1035

    
1036
    case MODE_PAGE_AUDIO_CTL:
1037
        p[1] = 14;
1038
        break;
1039

    
1040
    case MODE_PAGE_CAPABILITIES:
1041
        p[1] = 0x14;
1042
        if (page_control == 1) { /* Changeable Values */
1043
            break;
1044
        }
1045

    
1046
        p[2] = 0x3b; /* CD-R & CD-RW read */
1047
        p[3] = 0; /* Writing not supported */
1048
        p[4] = 0x7f; /* Audio, composite, digital out,
1049
                        mode 2 form 1&2, multi session */
1050
        p[5] = 0xff; /* CD DA, DA accurate, RW supported,
1051
                        RW corrected, C2 errors, ISRC,
1052
                        UPC, Bar code */
1053
        p[6] = 0x2d | (s->tray_locked ? 2 : 0);
1054
        /* Locking supported, jumper present, eject, tray */
1055
        p[7] = 0; /* no volume & mute control, no
1056
                     changer */
1057
        p[8] = (50 * 176) >> 8; /* 50x read speed */
1058
        p[9] = (50 * 176) & 0xff;
1059
        p[10] = 2 >> 8; /* Two volume levels */
1060
        p[11] = 2 & 0xff;
1061
        p[12] = 2048 >> 8; /* 2M buffer */
1062
        p[13] = 2048 & 0xff;
1063
        p[14] = (16 * 176) >> 8; /* 16x read speed current */
1064
        p[15] = (16 * 176) & 0xff;
1065
        p[18] = (16 * 176) >> 8; /* 16x write speed */
1066
        p[19] = (16 * 176) & 0xff;
1067
        p[20] = (16 * 176) >> 8; /* 16x write speed current */
1068
        p[21] = (16 * 176) & 0xff;
1069
        break;
1070

    
1071
    default:
1072
        return -1;
1073
    }
1074

    
1075
    *p_outbuf += p[1] + 2;
1076
    return p[1] + 2;
1077
}
1078

    
1079
static int scsi_disk_emulate_mode_sense(SCSIDiskReq *r, uint8_t *outbuf)
1080
{
1081
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1082
    uint64_t nb_sectors;
1083
    bool dbd;
1084
    int page, buflen, ret, page_control;
1085
    uint8_t *p;
1086
    uint8_t dev_specific_param;
1087

    
1088
    dbd = (r->req.cmd.buf[1] & 0x8) != 0;
1089
    page = r->req.cmd.buf[2] & 0x3f;
1090
    page_control = (r->req.cmd.buf[2] & 0xc0) >> 6;
1091
    DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
1092
        (r->req.cmd.buf[0] == MODE_SENSE) ? 6 : 10, page, r->req.cmd.xfer, page_control);
1093
    memset(outbuf, 0, r->req.cmd.xfer);
1094
    p = outbuf;
1095

    
1096
    dev_specific_param = 0x00;
1097
    if (s->qdev.type == TYPE_DISK) {
1098
        if (bdrv_is_read_only(s->qdev.conf.bs)) {
1099
            dev_specific_param |= 0x80; /* Readonly.  */
1100
        }
1101
    } else {
1102
        /* MMC prescribes that CD/DVD drives have no block descriptors,
1103
         * and defines no device-specific parameter.  */
1104
        dbd = true;
1105
    }
1106

    
1107
    if (r->req.cmd.buf[0] == MODE_SENSE) {
1108
        p[1] = 0; /* Default media type.  */
1109
        p[2] = dev_specific_param;
1110
        p[3] = 0; /* Block descriptor length.  */
1111
        p += 4;
1112
    } else { /* MODE_SENSE_10 */
1113
        p[2] = 0; /* Default media type.  */
1114
        p[3] = dev_specific_param;
1115
        p[6] = p[7] = 0; /* Block descriptor length.  */
1116
        p += 8;
1117
    }
1118

    
1119
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1120
    if (!dbd && nb_sectors) {
1121
        if (r->req.cmd.buf[0] == MODE_SENSE) {
1122
            outbuf[3] = 8; /* Block descriptor length  */
1123
        } else { /* MODE_SENSE_10 */
1124
            outbuf[7] = 8; /* Block descriptor length  */
1125
        }
1126
        nb_sectors /= (s->qdev.blocksize / 512);
1127
        if (nb_sectors > 0xffffff) {
1128
            nb_sectors = 0;
1129
        }
1130
        p[0] = 0; /* media density code */
1131
        p[1] = (nb_sectors >> 16) & 0xff;
1132
        p[2] = (nb_sectors >> 8) & 0xff;
1133
        p[3] = nb_sectors & 0xff;
1134
        p[4] = 0; /* reserved */
1135
        p[5] = 0; /* bytes 5-7 are the sector size in bytes */
1136
        p[6] = s->qdev.blocksize >> 8;
1137
        p[7] = 0;
1138
        p += 8;
1139
    }
1140

    
1141
    if (page_control == 3) {
1142
        /* Saved Values */
1143
        scsi_check_condition(r, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED));
1144
        return -1;
1145
    }
1146

    
1147
    if (page == 0x3f) {
1148
        for (page = 0; page <= 0x3e; page++) {
1149
            mode_sense_page(s, page, &p, page_control);
1150
        }
1151
    } else {
1152
        ret = mode_sense_page(s, page, &p, page_control);
1153
        if (ret == -1) {
1154
            return -1;
1155
        }
1156
    }
1157

    
1158
    buflen = p - outbuf;
1159
    /*
1160
     * The mode data length field specifies the length in bytes of the
1161
     * following data that is available to be transferred. The mode data
1162
     * length does not include itself.
1163
     */
1164
    if (r->req.cmd.buf[0] == MODE_SENSE) {
1165
        outbuf[0] = buflen - 1;
1166
    } else { /* MODE_SENSE_10 */
1167
        outbuf[0] = ((buflen - 2) >> 8) & 0xff;
1168
        outbuf[1] = (buflen - 2) & 0xff;
1169
    }
1170
    return buflen;
1171
}
1172

    
1173
static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)
1174
{
1175
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1176
    int start_track, format, msf, toclen;
1177
    uint64_t nb_sectors;
1178

    
1179
    msf = req->cmd.buf[1] & 2;
1180
    format = req->cmd.buf[2] & 0xf;
1181
    start_track = req->cmd.buf[6];
1182
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1183
    DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
1184
    nb_sectors /= s->qdev.blocksize / 512;
1185
    switch (format) {
1186
    case 0:
1187
        toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
1188
        break;
1189
    case 1:
1190
        /* multi session : only a single session defined */
1191
        toclen = 12;
1192
        memset(outbuf, 0, 12);
1193
        outbuf[1] = 0x0a;
1194
        outbuf[2] = 0x01;
1195
        outbuf[3] = 0x01;
1196
        break;
1197
    case 2:
1198
        toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
1199
        break;
1200
    default:
1201
        return -1;
1202
    }
1203
    return toclen;
1204
}
1205

    
1206
static int scsi_disk_emulate_start_stop(SCSIDiskReq *r)
1207
{
1208
    SCSIRequest *req = &r->req;
1209
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1210
    bool start = req->cmd.buf[4] & 1;
1211
    bool loej = req->cmd.buf[4] & 2; /* load on start, eject on !start */
1212

    
1213
    if (s->qdev.type == TYPE_ROM && loej) {
1214
        if (!start && !s->tray_open && s->tray_locked) {
1215
            scsi_check_condition(r,
1216
                                 bdrv_is_inserted(s->qdev.conf.bs)
1217
                                 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED)
1218
                                 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED));
1219
            return -1;
1220
        }
1221

    
1222
        if (s->tray_open != !start) {
1223
            bdrv_eject(s->qdev.conf.bs, !start);
1224
            s->tray_open = !start;
1225
        }
1226
    }
1227
    return 0;
1228
}
1229

    
1230
static int scsi_disk_emulate_command(SCSIDiskReq *r)
1231
{
1232
    SCSIRequest *req = &r->req;
1233
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1234
    uint64_t nb_sectors;
1235
    uint8_t *outbuf;
1236
    int buflen = 0;
1237

    
1238
    if (!r->iov.iov_base) {
1239
        /*
1240
         * FIXME: we shouldn't return anything bigger than 4k, but the code
1241
         * requires the buffer to be as big as req->cmd.xfer in several
1242
         * places.  So, do not allow CDBs with a very large ALLOCATION
1243
         * LENGTH.  The real fix would be to modify scsi_read_data and
1244
         * dma_buf_read, so that they return data beyond the buflen
1245
         * as all zeros.
1246
         */
1247
        if (req->cmd.xfer > 65536) {
1248
            goto illegal_request;
1249
        }
1250
        r->buflen = MAX(4096, req->cmd.xfer);
1251
        r->iov.iov_base = qemu_blockalign(s->qdev.conf.bs, r->buflen);
1252
    }
1253

    
1254
    outbuf = r->iov.iov_base;
1255
    switch (req->cmd.buf[0]) {
1256
    case TEST_UNIT_READY:
1257
        assert(!s->tray_open && bdrv_is_inserted(s->qdev.conf.bs));
1258
        break;
1259
    case INQUIRY:
1260
        buflen = scsi_disk_emulate_inquiry(req, outbuf);
1261
        if (buflen < 0) {
1262
            goto illegal_request;
1263
        }
1264
        break;
1265
    case MODE_SENSE:
1266
    case MODE_SENSE_10:
1267
        buflen = scsi_disk_emulate_mode_sense(r, outbuf);
1268
        if (buflen < 0) {
1269
            goto illegal_request;
1270
        }
1271
        break;
1272
    case READ_TOC:
1273
        buflen = scsi_disk_emulate_read_toc(req, outbuf);
1274
        if (buflen < 0) {
1275
            goto illegal_request;
1276
        }
1277
        break;
1278
    case RESERVE:
1279
        if (req->cmd.buf[1] & 1) {
1280
            goto illegal_request;
1281
        }
1282
        break;
1283
    case RESERVE_10:
1284
        if (req->cmd.buf[1] & 3) {
1285
            goto illegal_request;
1286
        }
1287
        break;
1288
    case RELEASE:
1289
        if (req->cmd.buf[1] & 1) {
1290
            goto illegal_request;
1291
        }
1292
        break;
1293
    case RELEASE_10:
1294
        if (req->cmd.buf[1] & 3) {
1295
            goto illegal_request;
1296
        }
1297
        break;
1298
    case START_STOP:
1299
        if (scsi_disk_emulate_start_stop(r) < 0) {
1300
            return -1;
1301
        }
1302
        break;
1303
    case ALLOW_MEDIUM_REMOVAL:
1304
        s->tray_locked = req->cmd.buf[4] & 1;
1305
        bdrv_lock_medium(s->qdev.conf.bs, req->cmd.buf[4] & 1);
1306
        break;
1307
    case READ_CAPACITY_10:
1308
        /* The normal LEN field for this command is zero.  */
1309
        memset(outbuf, 0, 8);
1310
        bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1311
        if (!nb_sectors) {
1312
            scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
1313
            return -1;
1314
        }
1315
        if ((req->cmd.buf[8] & 1) == 0 && req->cmd.lba) {
1316
            goto illegal_request;
1317
        }
1318
        nb_sectors /= s->qdev.blocksize / 512;
1319
        /* Returned value is the address of the last sector.  */
1320
        nb_sectors--;
1321
        /* Remember the new size for read/write sanity checking. */
1322
        s->qdev.max_lba = nb_sectors;
1323
        /* Clip to 2TB, instead of returning capacity modulo 2TB. */
1324
        if (nb_sectors > UINT32_MAX) {
1325
            nb_sectors = UINT32_MAX;
1326
        }
1327
        outbuf[0] = (nb_sectors >> 24) & 0xff;
1328
        outbuf[1] = (nb_sectors >> 16) & 0xff;
1329
        outbuf[2] = (nb_sectors >> 8) & 0xff;
1330
        outbuf[3] = nb_sectors & 0xff;
1331
        outbuf[4] = 0;
1332
        outbuf[5] = 0;
1333
        outbuf[6] = s->qdev.blocksize >> 8;
1334
        outbuf[7] = 0;
1335
        buflen = 8;
1336
        break;
1337
    case REQUEST_SENSE:
1338
        /* Just return "NO SENSE".  */
1339
        buflen = scsi_build_sense(NULL, 0, outbuf, r->buflen,
1340
                                  (req->cmd.buf[1] & 1) == 0);
1341
        break;
1342
    case MECHANISM_STATUS:
1343
        buflen = scsi_emulate_mechanism_status(s, outbuf);
1344
        if (buflen < 0) {
1345
            goto illegal_request;
1346
        }
1347
        break;
1348
    case GET_CONFIGURATION:
1349
        buflen = scsi_get_configuration(s, outbuf);
1350
        if (buflen < 0) {
1351
            goto illegal_request;
1352
        }
1353
        break;
1354
    case GET_EVENT_STATUS_NOTIFICATION:
1355
        buflen = scsi_get_event_status_notification(s, r, outbuf);
1356
        if (buflen < 0) {
1357
            goto illegal_request;
1358
        }
1359
        break;
1360
    case READ_DVD_STRUCTURE:
1361
        buflen = scsi_read_dvd_structure(s, r, outbuf);
1362
        if (buflen < 0) {
1363
            goto illegal_request;
1364
        }
1365
        break;
1366
    case SERVICE_ACTION_IN_16:
1367
        /* Service Action In subcommands. */
1368
        if ((req->cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) {
1369
            DPRINTF("SAI READ CAPACITY(16)\n");
1370
            memset(outbuf, 0, req->cmd.xfer);
1371
            bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1372
            if (!nb_sectors) {
1373
                scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
1374
                return -1;
1375
            }
1376
            if ((req->cmd.buf[14] & 1) == 0 && req->cmd.lba) {
1377
                goto illegal_request;
1378
            }
1379
            nb_sectors /= s->qdev.blocksize / 512;
1380
            /* Returned value is the address of the last sector.  */
1381
            nb_sectors--;
1382
            /* Remember the new size for read/write sanity checking. */
1383
            s->qdev.max_lba = nb_sectors;
1384
            outbuf[0] = (nb_sectors >> 56) & 0xff;
1385
            outbuf[1] = (nb_sectors >> 48) & 0xff;
1386
            outbuf[2] = (nb_sectors >> 40) & 0xff;
1387
            outbuf[3] = (nb_sectors >> 32) & 0xff;
1388
            outbuf[4] = (nb_sectors >> 24) & 0xff;
1389
            outbuf[5] = (nb_sectors >> 16) & 0xff;
1390
            outbuf[6] = (nb_sectors >> 8) & 0xff;
1391
            outbuf[7] = nb_sectors & 0xff;
1392
            outbuf[8] = 0;
1393
            outbuf[9] = 0;
1394
            outbuf[10] = s->qdev.blocksize >> 8;
1395
            outbuf[11] = 0;
1396
            outbuf[12] = 0;
1397
            outbuf[13] = get_physical_block_exp(&s->qdev.conf);
1398

    
1399
            /* set TPE bit if the format supports discard */
1400
            if (s->qdev.conf.discard_granularity) {
1401
                outbuf[14] = 0x80;
1402
            }
1403

    
1404
            /* Protection, exponent and lowest lba field left blank. */
1405
            buflen = req->cmd.xfer;
1406
            break;
1407
        }
1408
        DPRINTF("Unsupported Service Action In\n");
1409
        goto illegal_request;
1410
    default:
1411
        scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE));
1412
        return -1;
1413
    }
1414
    buflen = MIN(buflen, req->cmd.xfer);
1415
    return buflen;
1416

    
1417
illegal_request:
1418
    if (r->req.status == -1) {
1419
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1420
    }
1421
    return -1;
1422
}
1423

    
1424
/* Execute a scsi command.  Returns the length of the data expected by the
1425
   command.  This will be Positive for data transfers from the device
1426
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
1427
   and zero if the command does not transfer any data.  */
1428

    
1429
static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf)
1430
{
1431
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1432
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1433
    int32_t len;
1434
    uint8_t command;
1435
    int rc;
1436

    
1437
    command = buf[0];
1438
    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", req->lun, req->tag, buf[0]);
1439

    
1440
#ifdef DEBUG_SCSI
1441
    {
1442
        int i;
1443
        for (i = 1; i < r->req.cmd.len; i++) {
1444
            printf(" 0x%02x", buf[i]);
1445
        }
1446
        printf("\n");
1447
    }
1448
#endif
1449

    
1450
    switch (command) {
1451
    case INQUIRY:
1452
    case MODE_SENSE:
1453
    case MODE_SENSE_10:
1454
    case RESERVE:
1455
    case RESERVE_10:
1456
    case RELEASE:
1457
    case RELEASE_10:
1458
    case START_STOP:
1459
    case ALLOW_MEDIUM_REMOVAL:
1460
    case GET_CONFIGURATION:
1461
    case GET_EVENT_STATUS_NOTIFICATION:
1462
    case MECHANISM_STATUS:
1463
    case REQUEST_SENSE:
1464
        break;
1465

    
1466
    default:
1467
        if (s->tray_open || !bdrv_is_inserted(s->qdev.conf.bs)) {
1468
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
1469
            return 0;
1470
        }
1471
        break;
1472
    }
1473

    
1474
    switch (command) {
1475
    case TEST_UNIT_READY:
1476
    case INQUIRY:
1477
    case MODE_SENSE:
1478
    case MODE_SENSE_10:
1479
    case RESERVE:
1480
    case RESERVE_10:
1481
    case RELEASE:
1482
    case RELEASE_10:
1483
    case START_STOP:
1484
    case ALLOW_MEDIUM_REMOVAL:
1485
    case READ_CAPACITY_10:
1486
    case READ_TOC:
1487
    case READ_DVD_STRUCTURE:
1488
    case GET_CONFIGURATION:
1489
    case GET_EVENT_STATUS_NOTIFICATION:
1490
    case MECHANISM_STATUS:
1491
    case SERVICE_ACTION_IN_16:
1492
    case REQUEST_SENSE:
1493
        rc = scsi_disk_emulate_command(r);
1494
        if (rc < 0) {
1495
            return 0;
1496
        }
1497

    
1498
        r->iov.iov_len = rc;
1499
        break;
1500
    case SYNCHRONIZE_CACHE:
1501
        /* The request is used as the AIO opaque value, so add a ref.  */
1502
        scsi_req_ref(&r->req);
1503
        bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
1504
        r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_flush_complete, r);
1505
        return 0;
1506
    case READ_6:
1507
    case READ_10:
1508
    case READ_12:
1509
    case READ_16:
1510
        len = r->req.cmd.xfer / s->qdev.blocksize;
1511
        DPRINTF("Read (sector %" PRId64 ", count %d)\n", r->req.cmd.lba, len);
1512
        if (r->req.cmd.lba > s->qdev.max_lba) {
1513
            goto illegal_lba;
1514
        }
1515
        r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
1516
        r->sector_count = len * (s->qdev.blocksize / 512);
1517
        break;
1518
    case VERIFY_10:
1519
    case VERIFY_12:
1520
    case VERIFY_16:
1521
    case WRITE_6:
1522
    case WRITE_10:
1523
    case WRITE_12:
1524
    case WRITE_16:
1525
    case WRITE_VERIFY_10:
1526
    case WRITE_VERIFY_12:
1527
    case WRITE_VERIFY_16:
1528
        len = r->req.cmd.xfer / s->qdev.blocksize;
1529
        DPRINTF("Write %s(sector %" PRId64 ", count %d)\n",
1530
                (command & 0xe) == 0xe ? "And Verify " : "",
1531
                r->req.cmd.lba, len);
1532
        if (r->req.cmd.lba > s->qdev.max_lba) {
1533
            goto illegal_lba;
1534
        }
1535
        r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
1536
        r->sector_count = len * (s->qdev.blocksize / 512);
1537
        break;
1538
    case MODE_SELECT:
1539
        DPRINTF("Mode Select(6) (len %lu)\n", (long)r->req.cmd.xfer);
1540
        /* We don't support mode parameter changes.
1541
           Allow the mode parameter header + block descriptors only. */
1542
        if (r->req.cmd.xfer > 12) {
1543
            goto fail;
1544
        }
1545
        break;
1546
    case MODE_SELECT_10:
1547
        DPRINTF("Mode Select(10) (len %lu)\n", (long)r->req.cmd.xfer);
1548
        /* We don't support mode parameter changes.
1549
           Allow the mode parameter header + block descriptors only. */
1550
        if (r->req.cmd.xfer > 16) {
1551
            goto fail;
1552
        }
1553
        break;
1554
    case SEEK_10:
1555
        DPRINTF("Seek(10) (sector %" PRId64 ")\n", r->req.cmd.lba);
1556
        if (r->req.cmd.lba > s->qdev.max_lba) {
1557
            goto illegal_lba;
1558
        }
1559
        break;
1560
    case WRITE_SAME_16:
1561
        len = r->req.cmd.xfer / s->qdev.blocksize;
1562

    
1563
        DPRINTF("WRITE SAME(16) (sector %" PRId64 ", count %d)\n",
1564
                r->req.cmd.lba, len);
1565

    
1566
        if (r->req.cmd.lba > s->qdev.max_lba) {
1567
            goto illegal_lba;
1568
        }
1569

    
1570
        /*
1571
         * We only support WRITE SAME with the unmap bit set for now.
1572
         */
1573
        if (!(buf[1] & 0x8)) {
1574
            goto fail;
1575
        }
1576

    
1577
        rc = bdrv_discard(s->qdev.conf.bs,
1578
                          r->req.cmd.lba * (s->qdev.blocksize / 512),
1579
                          len * (s->qdev.blocksize / 512));
1580
        if (rc < 0) {
1581
            /* XXX: better error code ?*/
1582
            goto fail;
1583
        }
1584

    
1585
        break;
1586
    default:
1587
        DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
1588
        scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE));
1589
        return 0;
1590
    fail:
1591
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1592
        return 0;
1593
    illegal_lba:
1594
        scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1595
        return 0;
1596
    }
1597
    if (r->sector_count == 0 && r->iov.iov_len == 0) {
1598
        scsi_req_complete(&r->req, GOOD);
1599
    }
1600
    len = r->sector_count * 512 + r->iov.iov_len;
1601
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
1602
        return -len;
1603
    } else {
1604
        if (!r->sector_count) {
1605
            r->sector_count = -1;
1606
        }
1607
        return len;
1608
    }
1609
}
1610

    
1611
static void scsi_disk_reset(DeviceState *dev)
1612
{
1613
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev.qdev, dev);
1614
    uint64_t nb_sectors;
1615

    
1616
    scsi_device_purge_requests(&s->qdev, SENSE_CODE(RESET));
1617

    
1618
    bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
1619
    nb_sectors /= s->qdev.blocksize / 512;
1620
    if (nb_sectors) {
1621
        nb_sectors--;
1622
    }
1623
    s->qdev.max_lba = nb_sectors;
1624
}
1625

    
1626
static void scsi_destroy(SCSIDevice *dev)
1627
{
1628
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1629

    
1630
    scsi_device_purge_requests(&s->qdev, SENSE_CODE(NO_SENSE));
1631
    blockdev_mark_auto_del(s->qdev.conf.bs);
1632
}
1633

    
1634
static void scsi_cd_change_media_cb(void *opaque, bool load)
1635
{
1636
    SCSIDiskState *s = opaque;
1637

    
1638
    /*
1639
     * When a CD gets changed, we have to report an ejected state and
1640
     * then a loaded state to guests so that they detect tray
1641
     * open/close and media change events.  Guests that do not use
1642
     * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
1643
     * states rely on this behavior.
1644
     *
1645
     * media_changed governs the state machine used for unit attention
1646
     * report.  media_event is used by GET EVENT STATUS NOTIFICATION.
1647
     */
1648
    s->media_changed = load;
1649
    s->tray_open = !load;
1650
    s->qdev.unit_attention = SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM);
1651
    s->media_event = true;
1652
    s->eject_request = false;
1653
}
1654

    
1655
static void scsi_cd_eject_request_cb(void *opaque, bool force)
1656
{
1657
    SCSIDiskState *s = opaque;
1658

    
1659
    s->eject_request = true;
1660
    if (force) {
1661
        s->tray_locked = false;
1662
    }
1663
}
1664

    
1665
static bool scsi_cd_is_tray_open(void *opaque)
1666
{
1667
    return ((SCSIDiskState *)opaque)->tray_open;
1668
}
1669

    
1670
static bool scsi_cd_is_medium_locked(void *opaque)
1671
{
1672
    return ((SCSIDiskState *)opaque)->tray_locked;
1673
}
1674

    
1675
static const BlockDevOps scsi_cd_block_ops = {
1676
    .change_media_cb = scsi_cd_change_media_cb,
1677
    .eject_request_cb = scsi_cd_eject_request_cb,
1678
    .is_tray_open = scsi_cd_is_tray_open,
1679
    .is_medium_locked = scsi_cd_is_medium_locked,
1680
};
1681

    
1682
static void scsi_disk_unit_attention_reported(SCSIDevice *dev)
1683
{
1684
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1685
    if (s->media_changed) {
1686
        s->media_changed = false;
1687
        s->qdev.unit_attention = SENSE_CODE(MEDIUM_CHANGED);
1688
    }
1689
}
1690

    
1691
static int scsi_initfn(SCSIDevice *dev)
1692
{
1693
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1694
    DriveInfo *dinfo;
1695

    
1696
    if (!s->qdev.conf.bs) {
1697
        error_report("drive property not set");
1698
        return -1;
1699
    }
1700

    
1701
    if (!s->removable && !bdrv_is_inserted(s->qdev.conf.bs)) {
1702
        error_report("Device needs media, but drive is empty");
1703
        return -1;
1704
    }
1705

    
1706
    if (!s->serial) {
1707
        /* try to fall back to value set with legacy -drive serial=... */
1708
        dinfo = drive_get_by_blockdev(s->qdev.conf.bs);
1709
        if (*dinfo->serial) {
1710
            s->serial = g_strdup(dinfo->serial);
1711
        }
1712
    }
1713

    
1714
    if (!s->version) {
1715
        s->version = g_strdup(QEMU_VERSION);
1716
    }
1717

    
1718
    if (bdrv_is_sg(s->qdev.conf.bs)) {
1719
        error_report("unwanted /dev/sg*");
1720
        return -1;
1721
    }
1722

    
1723
    if (s->removable) {
1724
        bdrv_set_dev_ops(s->qdev.conf.bs, &scsi_cd_block_ops, s);
1725
    }
1726
    bdrv_set_buffer_alignment(s->qdev.conf.bs, s->qdev.blocksize);
1727

    
1728
    bdrv_iostatus_enable(s->qdev.conf.bs);
1729
    add_boot_device_path(s->qdev.conf.bootindex, &dev->qdev, NULL);
1730
    return 0;
1731
}
1732

    
1733
static int scsi_hd_initfn(SCSIDevice *dev)
1734
{
1735
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1736
    s->qdev.blocksize = s->qdev.conf.logical_block_size;
1737
    s->qdev.type = TYPE_DISK;
1738
    return scsi_initfn(&s->qdev);
1739
}
1740

    
1741
static int scsi_cd_initfn(SCSIDevice *dev)
1742
{
1743
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1744
    s->qdev.blocksize = 2048;
1745
    s->qdev.type = TYPE_ROM;
1746
    s->removable = true;
1747
    return scsi_initfn(&s->qdev);
1748
}
1749

    
1750
static int scsi_disk_initfn(SCSIDevice *dev)
1751
{
1752
    DriveInfo *dinfo;
1753

    
1754
    if (!dev->conf.bs) {
1755
        return scsi_initfn(dev);  /* ... and die there */
1756
    }
1757

    
1758
    dinfo = drive_get_by_blockdev(dev->conf.bs);
1759
    if (dinfo->media_cd) {
1760
        return scsi_cd_initfn(dev);
1761
    } else {
1762
        return scsi_hd_initfn(dev);
1763
    }
1764
}
1765

    
1766
static const SCSIReqOps scsi_disk_reqops = {
1767
    .size         = sizeof(SCSIDiskReq),
1768
    .free_req     = scsi_free_request,
1769
    .send_command = scsi_send_command,
1770
    .read_data    = scsi_read_data,
1771
    .write_data   = scsi_write_data,
1772
    .cancel_io    = scsi_cancel_io,
1773
    .get_buf      = scsi_get_buf,
1774
    .load_request = scsi_disk_load_request,
1775
    .save_request = scsi_disk_save_request,
1776
};
1777

    
1778
static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun,
1779
                                     uint8_t *buf, void *hba_private)
1780
{
1781
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
1782
    SCSIRequest *req;
1783

    
1784
    req = scsi_req_alloc(&scsi_disk_reqops, &s->qdev, tag, lun, hba_private);
1785
    return req;
1786
}
1787

    
1788
#ifdef __linux__
1789
static int get_device_type(SCSIDiskState *s)
1790
{
1791
    BlockDriverState *bdrv = s->qdev.conf.bs;
1792
    uint8_t cmd[16];
1793
    uint8_t buf[36];
1794
    uint8_t sensebuf[8];
1795
    sg_io_hdr_t io_header;
1796
    int ret;
1797

    
1798
    memset(cmd, 0, sizeof(cmd));
1799
    memset(buf, 0, sizeof(buf));
1800
    cmd[0] = INQUIRY;
1801
    cmd[4] = sizeof(buf);
1802

    
1803
    memset(&io_header, 0, sizeof(io_header));
1804
    io_header.interface_id = 'S';
1805
    io_header.dxfer_direction = SG_DXFER_FROM_DEV;
1806
    io_header.dxfer_len = sizeof(buf);
1807
    io_header.dxferp = buf;
1808
    io_header.cmdp = cmd;
1809
    io_header.cmd_len = sizeof(cmd);
1810
    io_header.mx_sb_len = sizeof(sensebuf);
1811
    io_header.sbp = sensebuf;
1812
    io_header.timeout = 6000; /* XXX */
1813

    
1814
    ret = bdrv_ioctl(bdrv, SG_IO, &io_header);
1815
    if (ret < 0 || io_header.driver_status || io_header.host_status) {
1816
        return -1;
1817
    }
1818
    s->qdev.type = buf[0];
1819
    s->removable = (buf[1] & 0x80) != 0;
1820
    return 0;
1821
}
1822

    
1823
static int scsi_block_initfn(SCSIDevice *dev)
1824
{
1825
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1826
    int sg_version;
1827
    int rc;
1828

    
1829
    if (!s->qdev.conf.bs) {
1830
        error_report("scsi-block: drive property not set");
1831
        return -1;
1832
    }
1833

    
1834
    /* check we are using a driver managing SG_IO (version 3 and after) */
1835
    if (bdrv_ioctl(s->qdev.conf.bs, SG_GET_VERSION_NUM, &sg_version) < 0 ||
1836
        sg_version < 30000) {
1837
        error_report("scsi-block: scsi generic interface too old");
1838
        return -1;
1839
    }
1840

    
1841
    /* get device type from INQUIRY data */
1842
    rc = get_device_type(s);
1843
    if (rc < 0) {
1844
        error_report("scsi-block: INQUIRY failed");
1845
        return -1;
1846
    }
1847

    
1848
    /* Make a guess for the block size, we'll fix it when the guest sends.
1849
     * READ CAPACITY.  If they don't, they likely would assume these sizes
1850
     * anyway. (TODO: check in /sys).
1851
     */
1852
    if (s->qdev.type == TYPE_ROM || s->qdev.type == TYPE_WORM) {
1853
        s->qdev.blocksize = 2048;
1854
    } else {
1855
        s->qdev.blocksize = 512;
1856
    }
1857
    return scsi_initfn(&s->qdev);
1858
}
1859

    
1860
static SCSIRequest *scsi_block_new_request(SCSIDevice *d, uint32_t tag,
1861
                                           uint32_t lun, uint8_t *buf,
1862
                                           void *hba_private)
1863
{
1864
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
1865

    
1866
    switch (buf[0]) {
1867
    case READ_6:
1868
    case READ_10:
1869
    case READ_12:
1870
    case READ_16:
1871
    case VERIFY_10:
1872
    case VERIFY_12:
1873
    case VERIFY_16:
1874
    case WRITE_6:
1875
    case WRITE_10:
1876
    case WRITE_12:
1877
    case WRITE_16:
1878
    case WRITE_VERIFY_10:
1879
    case WRITE_VERIFY_12:
1880
    case WRITE_VERIFY_16:
1881
        /* If we are not using O_DIRECT, we might read stale data from the
1882
         * host cache if writes were made using other commands than these
1883
         * ones (such as WRITE SAME or EXTENDED COPY, etc.).  So, without
1884
         * O_DIRECT everything must go through SG_IO.
1885
         */
1886
        if (!(s->qdev.conf.bs->open_flags & BDRV_O_NOCACHE)) {
1887
            break;
1888
        }
1889

    
1890
        /* MMC writing cannot be done via pread/pwrite, because it sometimes
1891
         * involves writing beyond the maximum LBA or to negative LBA (lead-in).
1892
         * And once you do these writes, reading from the block device is
1893
         * unreliable, too.  It is even possible that reads deliver random data
1894
         * from the host page cache (this is probably a Linux bug).
1895
         *
1896
         * We might use scsi_disk_reqops as long as no writing commands are
1897
         * seen, but performance usually isn't paramount on optical media.  So,
1898
         * just make scsi-block operate the same as scsi-generic for them.
1899
         */
1900
        if (s->qdev.type == TYPE_ROM) {
1901
            break;
1902
        }
1903
        return scsi_req_alloc(&scsi_disk_reqops, &s->qdev, tag, lun,
1904
                              hba_private);
1905
    }
1906

    
1907
    return scsi_req_alloc(&scsi_generic_req_ops, &s->qdev, tag, lun,
1908
                          hba_private);
1909
}
1910
#endif
1911

    
1912
#define DEFINE_SCSI_DISK_PROPERTIES()                           \
1913
    DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf),          \
1914
    DEFINE_PROP_STRING("ver",  SCSIDiskState, version),         \
1915
    DEFINE_PROP_STRING("serial",  SCSIDiskState, serial)
1916

    
1917
static Property scsi_hd_properties[] = {
1918
    DEFINE_SCSI_DISK_PROPERTIES(),
1919
    DEFINE_PROP_BIT("removable", SCSIDiskState, removable, 0, false),
1920
    DEFINE_PROP_END_OF_LIST(),
1921
};
1922

    
1923
static const VMStateDescription vmstate_scsi_disk_state = {
1924
    .name = "scsi-disk",
1925
    .version_id = 1,
1926
    .minimum_version_id = 1,
1927
    .minimum_version_id_old = 1,
1928
    .fields = (VMStateField[]) {
1929
        VMSTATE_SCSI_DEVICE(qdev, SCSIDiskState),
1930
        VMSTATE_BOOL(media_changed, SCSIDiskState),
1931
        VMSTATE_BOOL(media_event, SCSIDiskState),
1932
        VMSTATE_BOOL(eject_request, SCSIDiskState),
1933
        VMSTATE_BOOL(tray_open, SCSIDiskState),
1934
        VMSTATE_BOOL(tray_locked, SCSIDiskState),
1935
        VMSTATE_END_OF_LIST()
1936
    }
1937
};
1938

    
1939
static void scsi_hd_class_initfn(ObjectClass *klass, void *data)
1940
{
1941
    DeviceClass *dc = DEVICE_CLASS(klass);
1942
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
1943

    
1944
    sc->init         = scsi_hd_initfn;
1945
    sc->destroy      = scsi_destroy;
1946
    sc->alloc_req    = scsi_new_request;
1947
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
1948
    dc->fw_name = "disk";
1949
    dc->desc = "virtual SCSI disk";
1950
    dc->reset = scsi_disk_reset;
1951
    dc->props = scsi_hd_properties;
1952
    dc->vmsd  = &vmstate_scsi_disk_state;
1953
}
1954

    
1955
static TypeInfo scsi_hd_info = {
1956
    .name          = "scsi-hd",
1957
    .parent        = TYPE_SCSI_DEVICE,
1958
    .instance_size = sizeof(SCSIDiskState),
1959
    .class_init    = scsi_hd_class_initfn,
1960
};
1961

    
1962
static Property scsi_cd_properties[] = {
1963
    DEFINE_SCSI_DISK_PROPERTIES(),
1964
    DEFINE_PROP_END_OF_LIST(),
1965
};
1966

    
1967
static void scsi_cd_class_initfn(ObjectClass *klass, void *data)
1968
{
1969
    DeviceClass *dc = DEVICE_CLASS(klass);
1970
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
1971

    
1972
    sc->init         = scsi_cd_initfn;
1973
    sc->destroy      = scsi_destroy;
1974
    sc->alloc_req    = scsi_new_request;
1975
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
1976
    dc->fw_name = "disk";
1977
    dc->desc = "virtual SCSI CD-ROM";
1978
    dc->reset = scsi_disk_reset;
1979
    dc->props = scsi_cd_properties;
1980
    dc->vmsd  = &vmstate_scsi_disk_state;
1981
}
1982

    
1983
static TypeInfo scsi_cd_info = {
1984
    .name          = "scsi-cd",
1985
    .parent        = TYPE_SCSI_DEVICE,
1986
    .instance_size = sizeof(SCSIDiskState),
1987
    .class_init    = scsi_cd_class_initfn,
1988
};
1989

    
1990
#ifdef __linux__
1991
static Property scsi_block_properties[] = {
1992
    DEFINE_SCSI_DISK_PROPERTIES(),
1993
    DEFINE_PROP_END_OF_LIST(),
1994
};
1995

    
1996
static void scsi_block_class_initfn(ObjectClass *klass, void *data)
1997
{
1998
    DeviceClass *dc = DEVICE_CLASS(klass);
1999
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2000

    
2001
    sc->init         = scsi_block_initfn;
2002
    sc->destroy      = scsi_destroy;
2003
    sc->alloc_req    = scsi_block_new_request;
2004
    dc->fw_name = "disk";
2005
    dc->desc = "SCSI block device passthrough";
2006
    dc->reset = scsi_disk_reset;
2007
    dc->props = scsi_block_properties;
2008
    dc->vmsd  = &vmstate_scsi_disk_state;
2009
}
2010

    
2011
static TypeInfo scsi_block_info = {
2012
    .name          = "scsi-block",
2013
    .parent        = TYPE_SCSI_DEVICE,
2014
    .instance_size = sizeof(SCSIDiskState),
2015
    .class_init    = scsi_block_class_initfn,
2016
};
2017
#endif
2018

    
2019
static Property scsi_disk_properties[] = {
2020
    DEFINE_SCSI_DISK_PROPERTIES(),
2021
    DEFINE_PROP_BIT("removable", SCSIDiskState, removable, 0, false),
2022
    DEFINE_PROP_END_OF_LIST(),
2023
};
2024

    
2025
static void scsi_disk_class_initfn(ObjectClass *klass, void *data)
2026
{
2027
    DeviceClass *dc = DEVICE_CLASS(klass);
2028
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
2029

    
2030
    sc->init         = scsi_disk_initfn;
2031
    sc->destroy      = scsi_destroy;
2032
    sc->alloc_req    = scsi_new_request;
2033
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
2034
    dc->fw_name = "disk";
2035
    dc->desc = "virtual SCSI disk or CD-ROM (legacy)";
2036
    dc->reset = scsi_disk_reset;
2037
    dc->props = scsi_disk_properties;
2038
    dc->vmsd  = &vmstate_scsi_disk_state;
2039
}
2040

    
2041
static TypeInfo scsi_disk_info = {
2042
    .name          = "scsi-disk",
2043
    .parent        = TYPE_SCSI_DEVICE,
2044
    .instance_size = sizeof(SCSIDiskState),
2045
    .class_init    = scsi_disk_class_initfn,
2046
};
2047

    
2048
static void scsi_disk_register_types(void)
2049
{
2050
    type_register_static(&scsi_hd_info);
2051
    type_register_static(&scsi_cd_info);
2052
#ifdef __linux__
2053
    type_register_static(&scsi_block_info);
2054
#endif
2055
    type_register_static(&scsi_disk_info);
2056
}
2057

    
2058
type_init(scsi_disk_register_types)