Statistics
| Branch: | Revision:

root / hw / scsi-disk.c @ efb9ee02

History | View | Annotate | Download (40.4 kB)

1
/*
2
 * SCSI Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Based on code by Fabrice Bellard
6
 *
7
 * Written by Paul Brook
8
 * Modifications:
9
 *  2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10
 *                                 when the allocation length of CDB is smaller
11
 *                                 than 36.
12
 *  2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13
 *                                 MODE SENSE response.
14
 *
15
 * This code is licenced under the LGPL.
16
 *
17
 * Note that this file only handles the SCSI architecture model and device
18
 * commands.  Emulation of interface/link layer protocols is handled by
19
 * the host adapter emulator.
20
 */
21

    
22
//#define DEBUG_SCSI
23

    
24
#ifdef DEBUG_SCSI
25
#define DPRINTF(fmt, ...) \
26
do { printf("scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
27
#else
28
#define DPRINTF(fmt, ...) do {} while(0)
29
#endif
30

    
31
#define BADF(fmt, ...) \
32
do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0)
33

    
34
#include "qemu-common.h"
35
#include "qemu-error.h"
36
#include "scsi.h"
37
#include "scsi-defs.h"
38
#include "sysemu.h"
39
#include "blockdev.h"
40

    
41
#define SCSI_DMA_BUF_SIZE    131072
42
#define SCSI_MAX_INQUIRY_LEN 256
43

    
44
#define SCSI_REQ_STATUS_RETRY           0x01
45
#define SCSI_REQ_STATUS_RETRY_TYPE_MASK 0x06
46
#define SCSI_REQ_STATUS_RETRY_READ      0x00
47
#define SCSI_REQ_STATUS_RETRY_WRITE     0x02
48
#define SCSI_REQ_STATUS_RETRY_FLUSH     0x04
49

    
50
typedef struct SCSIDiskState SCSIDiskState;
51

    
52
typedef struct SCSIDiskReq {
53
    SCSIRequest req;
54
    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
55
    uint64_t sector;
56
    uint32_t sector_count;
57
    struct iovec iov;
58
    QEMUIOVector qiov;
59
    uint32_t status;
60
} SCSIDiskReq;
61

    
62
typedef enum { SCSI_HD, SCSI_CD } SCSIDriveKind;
63

    
64
struct SCSIDiskState
65
{
66
    SCSIDevice qdev;
67
    BlockDriverState *bs;
68
    /* The qemu block layer uses a fixed 512 byte sector size.
69
       This is the number of 512 byte blocks in a single scsi sector.  */
70
    int cluster_size;
71
    uint32_t removable;
72
    uint64_t max_lba;
73
    QEMUBH *bh;
74
    char *version;
75
    char *serial;
76
    SCSISense sense;
77
    SCSIDriveKind drive_kind;
78
};
79

    
80
static int scsi_handle_rw_error(SCSIDiskReq *r, int error, int type);
81
static int scsi_disk_emulate_command(SCSIDiskReq *r, uint8_t *outbuf);
82

    
83
static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag,
84
        uint32_t lun)
85
{
86
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
87
    SCSIRequest *req;
88
    SCSIDiskReq *r;
89

    
90
    req = scsi_req_alloc(sizeof(SCSIDiskReq), &s->qdev, tag, lun);
91
    r = DO_UPCAST(SCSIDiskReq, req, req);
92
    r->iov.iov_base = qemu_blockalign(s->bs, SCSI_DMA_BUF_SIZE);
93
    return req;
94
}
95

    
96
static void scsi_free_request(SCSIRequest *req)
97
{
98
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
99

    
100
    qemu_vfree(r->iov.iov_base);
101
}
102

    
103
static void scsi_disk_clear_sense(SCSIDiskState *s)
104
{
105
    memset(&s->sense, 0, sizeof(s->sense));
106
}
107

    
108
static void scsi_req_set_status(SCSIDiskReq *r, int status, SCSISense sense)
109
{
110
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
111

    
112
    r->req.status = status;
113
    s->sense = sense;
114
}
115

    
116
/* Helper function for command completion.  */
117
static void scsi_command_complete(SCSIDiskReq *r, int status, SCSISense sense)
118
{
119
    DPRINTF("Command complete tag=0x%x status=%d sense=%d/%d/%d\n",
120
            r->req.tag, status, sense.key, sense.asc, sense.ascq);
121
    scsi_req_set_status(r, status, sense);
122
    scsi_req_complete(&r->req);
123
}
124

    
125
/* Cancel a pending data transfer.  */
126
static void scsi_cancel_io(SCSIRequest *req)
127
{
128
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
129

    
130
    DPRINTF("Cancel tag=0x%x\n", req->tag);
131
    if (r->req.aiocb) {
132
        bdrv_aio_cancel(r->req.aiocb);
133
    }
134
    r->req.aiocb = NULL;
135
}
136

    
137
static void scsi_read_complete(void * opaque, int ret)
138
{
139
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
140
    int n;
141

    
142
    r->req.aiocb = NULL;
143

    
144
    if (ret) {
145
        if (scsi_handle_rw_error(r, -ret, SCSI_REQ_STATUS_RETRY_READ)) {
146
            return;
147
        }
148
    }
149

    
150
    DPRINTF("Data ready tag=0x%x len=%zd\n", r->req.tag, r->iov.iov_len);
151

    
152
    n = r->iov.iov_len / 512;
153
    r->sector += n;
154
    r->sector_count -= n;
155
    scsi_req_data(&r->req, r->iov.iov_len);
156
}
157

    
158

    
159
/* Read more data from scsi device into buffer.  */
160
static void scsi_read_data(SCSIRequest *req)
161
{
162
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
163
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
164
    uint32_t n;
165

    
166
    if (r->sector_count == (uint32_t)-1) {
167
        DPRINTF("Read buf_len=%zd\n", r->iov.iov_len);
168
        r->sector_count = 0;
169
        scsi_req_data(&r->req, r->iov.iov_len);
170
        return;
171
    }
172
    DPRINTF("Read sector_count=%d\n", r->sector_count);
173
    if (r->sector_count == 0) {
174
        scsi_command_complete(r, GOOD, SENSE_CODE(NO_SENSE));
175
        return;
176
    }
177

    
178
    /* No data transfer may already be in progress */
179
    assert(r->req.aiocb == NULL);
180

    
181
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
182
        DPRINTF("Data transfer direction invalid\n");
183
        scsi_read_complete(r, -EINVAL);
184
        return;
185
    }
186

    
187
    n = r->sector_count;
188
    if (n > SCSI_DMA_BUF_SIZE / 512)
189
        n = SCSI_DMA_BUF_SIZE / 512;
190

    
191
    r->iov.iov_len = n * 512;
192
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
193
    r->req.aiocb = bdrv_aio_readv(s->bs, r->sector, &r->qiov, n,
194
                              scsi_read_complete, r);
195
    if (r->req.aiocb == NULL) {
196
        scsi_read_complete(r, -EIO);
197
    }
198
}
199

    
200
static int scsi_handle_rw_error(SCSIDiskReq *r, int error, int type)
201
{
202
    int is_read = (type == SCSI_REQ_STATUS_RETRY_READ);
203
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
204
    BlockErrorAction action = bdrv_get_on_error(s->bs, is_read);
205

    
206
    if (action == BLOCK_ERR_IGNORE) {
207
        bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read);
208
        return 0;
209
    }
210

    
211
    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
212
            || action == BLOCK_ERR_STOP_ANY) {
213

    
214
        type &= SCSI_REQ_STATUS_RETRY_TYPE_MASK;
215
        r->status |= SCSI_REQ_STATUS_RETRY | type;
216

    
217
        bdrv_mon_event(s->bs, BDRV_ACTION_STOP, is_read);
218
        vm_stop(VMSTOP_DISKFULL);
219
    } else {
220
        if (type == SCSI_REQ_STATUS_RETRY_READ) {
221
            scsi_req_data(&r->req, 0);
222
        }
223
        switch (error) {
224
        case ENOMEM:
225
            scsi_command_complete(r, CHECK_CONDITION,
226
                                  SENSE_CODE(TARGET_FAILURE));
227
            break;
228
        case EINVAL:
229
            scsi_command_complete(r, CHECK_CONDITION,
230
                                  SENSE_CODE(INVALID_FIELD));
231
            break;
232
        default:
233
            scsi_command_complete(r, CHECK_CONDITION,
234
                                  SENSE_CODE(IO_ERROR));
235
            break;
236
        }
237
        bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read);
238
    }
239
    return 1;
240
}
241

    
242
static void scsi_write_complete(void * opaque, int ret)
243
{
244
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
245
    uint32_t len;
246
    uint32_t n;
247

    
248
    r->req.aiocb = NULL;
249

    
250
    if (ret) {
251
        if (scsi_handle_rw_error(r, -ret, SCSI_REQ_STATUS_RETRY_WRITE)) {
252
            return;
253
        }
254
    }
255

    
256
    n = r->iov.iov_len / 512;
257
    r->sector += n;
258
    r->sector_count -= n;
259
    if (r->sector_count == 0) {
260
        scsi_command_complete(r, GOOD, SENSE_CODE(NO_SENSE));
261
    } else {
262
        len = r->sector_count * 512;
263
        if (len > SCSI_DMA_BUF_SIZE) {
264
            len = SCSI_DMA_BUF_SIZE;
265
        }
266
        r->iov.iov_len = len;
267
        DPRINTF("Write complete tag=0x%x more=%d\n", r->req.tag, len);
268
        scsi_req_data(&r->req, len);
269
    }
270
}
271

    
272
static int scsi_write_data(SCSIRequest *req)
273
{
274
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
275
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
276
    uint32_t n;
277

    
278
    /* No data transfer may already be in progress */
279
    assert(r->req.aiocb == NULL);
280

    
281
    if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {
282
        DPRINTF("Data transfer direction invalid\n");
283
        scsi_write_complete(r, -EINVAL);
284
        return 0;
285
    }
286

    
287
    n = r->iov.iov_len / 512;
288
    if (n) {
289
        qemu_iovec_init_external(&r->qiov, &r->iov, 1);
290
        r->req.aiocb = bdrv_aio_writev(s->bs, r->sector, &r->qiov, n,
291
                                   scsi_write_complete, r);
292
        if (r->req.aiocb == NULL) {
293
            scsi_write_complete(r, -ENOMEM);
294
        }
295
    } else {
296
        /* Invoke completion routine to fetch data from host.  */
297
        scsi_write_complete(r, 0);
298
    }
299

    
300
    return 0;
301
}
302

    
303
static void scsi_dma_restart_bh(void *opaque)
304
{
305
    SCSIDiskState *s = opaque;
306
    SCSIRequest *req;
307
    SCSIDiskReq *r;
308

    
309
    qemu_bh_delete(s->bh);
310
    s->bh = NULL;
311

    
312
    QTAILQ_FOREACH(req, &s->qdev.requests, next) {
313
        r = DO_UPCAST(SCSIDiskReq, req, req);
314
        if (r->status & SCSI_REQ_STATUS_RETRY) {
315
            int status = r->status;
316
            int ret;
317

    
318
            r->status &=
319
                ~(SCSI_REQ_STATUS_RETRY | SCSI_REQ_STATUS_RETRY_TYPE_MASK);
320

    
321
            switch (status & SCSI_REQ_STATUS_RETRY_TYPE_MASK) {
322
            case SCSI_REQ_STATUS_RETRY_READ:
323
                scsi_read_data(&r->req);
324
                break;
325
            case SCSI_REQ_STATUS_RETRY_WRITE:
326
                scsi_write_data(&r->req);
327
                break;
328
            case SCSI_REQ_STATUS_RETRY_FLUSH:
329
                ret = scsi_disk_emulate_command(r, r->iov.iov_base);
330
                if (ret == 0) {
331
                    scsi_command_complete(r, GOOD, SENSE_CODE(NO_SENSE));
332
                }
333
            }
334
        }
335
    }
336
}
337

    
338
static void scsi_dma_restart_cb(void *opaque, int running, int reason)
339
{
340
    SCSIDiskState *s = opaque;
341

    
342
    if (!running)
343
        return;
344

    
345
    if (!s->bh) {
346
        s->bh = qemu_bh_new(scsi_dma_restart_bh, s);
347
        qemu_bh_schedule(s->bh);
348
    }
349
}
350

    
351
/* Return a pointer to the data buffer.  */
352
static uint8_t *scsi_get_buf(SCSIRequest *req)
353
{
354
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
355

    
356
    return (uint8_t *)r->iov.iov_base;
357
}
358

    
359
/* Copy sense information into the provided buffer */
360
static int scsi_get_sense(SCSIRequest *req, uint8_t *outbuf, int len)
361
{
362
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
363

    
364
    return scsi_build_sense(s->sense, outbuf, len, len > 14);
365
}
366

    
367
static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
368
{
369
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
370
    int buflen = 0;
371

    
372
    if (req->cmd.buf[1] & 0x2) {
373
        /* Command support data - optional, not implemented */
374
        BADF("optional INQUIRY command support request not implemented\n");
375
        return -1;
376
    }
377

    
378
    if (req->cmd.buf[1] & 0x1) {
379
        /* Vital product data */
380
        uint8_t page_code = req->cmd.buf[2];
381
        if (req->cmd.xfer < 4) {
382
            BADF("Error: Inquiry (EVPD[%02X]) buffer size %zd is "
383
                 "less than 4\n", page_code, req->cmd.xfer);
384
            return -1;
385
        }
386

    
387
        if (s->drive_kind == SCSI_CD) {
388
            outbuf[buflen++] = 5;
389
        } else {
390
            outbuf[buflen++] = 0;
391
        }
392
        outbuf[buflen++] = page_code ; // this page
393
        outbuf[buflen++] = 0x00;
394

    
395
        switch (page_code) {
396
        case 0x00: /* Supported page codes, mandatory */
397
        {
398
            int pages;
399
            DPRINTF("Inquiry EVPD[Supported pages] "
400
                    "buffer size %zd\n", req->cmd.xfer);
401
            pages = buflen++;
402
            outbuf[buflen++] = 0x00; // list of supported pages (this page)
403
            outbuf[buflen++] = 0x80; // unit serial number
404
            outbuf[buflen++] = 0x83; // device identification
405
            if (s->drive_kind == SCSI_HD) {
406
                outbuf[buflen++] = 0xb0; // block limits
407
                outbuf[buflen++] = 0xb2; // thin provisioning
408
            }
409
            outbuf[pages] = buflen - pages - 1; // number of pages
410
            break;
411
        }
412
        case 0x80: /* Device serial number, optional */
413
        {
414
            int l = strlen(s->serial);
415

    
416
            if (l > req->cmd.xfer)
417
                l = req->cmd.xfer;
418
            if (l > 20)
419
                l = 20;
420

    
421
            DPRINTF("Inquiry EVPD[Serial number] "
422
                    "buffer size %zd\n", req->cmd.xfer);
423
            outbuf[buflen++] = l;
424
            memcpy(outbuf+buflen, s->serial, l);
425
            buflen += l;
426
            break;
427
        }
428

    
429
        case 0x83: /* Device identification page, mandatory */
430
        {
431
            int max_len = 255 - 8;
432
            int id_len = strlen(bdrv_get_device_name(s->bs));
433

    
434
            if (id_len > max_len)
435
                id_len = max_len;
436
            DPRINTF("Inquiry EVPD[Device identification] "
437
                    "buffer size %zd\n", req->cmd.xfer);
438

    
439
            outbuf[buflen++] = 4 + id_len;
440
            outbuf[buflen++] = 0x2; // ASCII
441
            outbuf[buflen++] = 0;   // not officially assigned
442
            outbuf[buflen++] = 0;   // reserved
443
            outbuf[buflen++] = id_len; // length of data following
444

    
445
            memcpy(outbuf+buflen, bdrv_get_device_name(s->bs), id_len);
446
            buflen += id_len;
447
            break;
448
        }
449
        case 0xb0: /* block limits */
450
        {
451
            unsigned int unmap_sectors =
452
                    s->qdev.conf.discard_granularity / s->qdev.blocksize;
453
            unsigned int min_io_size =
454
                    s->qdev.conf.min_io_size / s->qdev.blocksize;
455
            unsigned int opt_io_size =
456
                    s->qdev.conf.opt_io_size / s->qdev.blocksize;
457

    
458
            if (s->drive_kind == SCSI_CD) {
459
                DPRINTF("Inquiry (EVPD[%02X] not supported for CDROM\n",
460
                        page_code);
461
                return -1;
462
            }
463
            /* required VPD size with unmap support */
464
            outbuf[3] = buflen = 0x3c;
465

    
466
            memset(outbuf + 4, 0, buflen - 4);
467

    
468
            /* optimal transfer length granularity */
469
            outbuf[6] = (min_io_size >> 8) & 0xff;
470
            outbuf[7] = min_io_size & 0xff;
471

    
472
            /* optimal transfer length */
473
            outbuf[12] = (opt_io_size >> 24) & 0xff;
474
            outbuf[13] = (opt_io_size >> 16) & 0xff;
475
            outbuf[14] = (opt_io_size >> 8) & 0xff;
476
            outbuf[15] = opt_io_size & 0xff;
477

    
478
            /* optimal unmap granularity */
479
            outbuf[28] = (unmap_sectors >> 24) & 0xff;
480
            outbuf[29] = (unmap_sectors >> 16) & 0xff;
481
            outbuf[30] = (unmap_sectors >> 8) & 0xff;
482
            outbuf[31] = unmap_sectors & 0xff;
483
            break;
484
        }
485
        case 0xb2: /* thin provisioning */
486
        {
487
            outbuf[3] = buflen = 8;
488
            outbuf[4] = 0;
489
            outbuf[5] = 0x40; /* write same with unmap supported */
490
            outbuf[6] = 0;
491
            outbuf[7] = 0;
492
            break;
493
        }
494
        default:
495
            BADF("Error: unsupported Inquiry (EVPD[%02X]) "
496
                 "buffer size %zd\n", page_code, req->cmd.xfer);
497
            return -1;
498
        }
499
        /* done with EVPD */
500
        return buflen;
501
    }
502

    
503
    /* Standard INQUIRY data */
504
    if (req->cmd.buf[2] != 0) {
505
        BADF("Error: Inquiry (STANDARD) page or code "
506
             "is non-zero [%02X]\n", req->cmd.buf[2]);
507
        return -1;
508
    }
509

    
510
    /* PAGE CODE == 0 */
511
    if (req->cmd.xfer < 5) {
512
        BADF("Error: Inquiry (STANDARD) buffer size %zd "
513
             "is less than 5\n", req->cmd.xfer);
514
        return -1;
515
    }
516

    
517
    buflen = req->cmd.xfer;
518
    if (buflen > SCSI_MAX_INQUIRY_LEN)
519
        buflen = SCSI_MAX_INQUIRY_LEN;
520

    
521
    memset(outbuf, 0, buflen);
522

    
523
    if (req->lun || req->cmd.buf[1] >> 5) {
524
        outbuf[0] = 0x7f;        /* LUN not supported */
525
        return buflen;
526
    }
527

    
528
    if (s->drive_kind == SCSI_CD) {
529
        outbuf[0] = 5;
530
        outbuf[1] = 0x80;
531
        memcpy(&outbuf[16], "QEMU CD-ROM     ", 16);
532
    } else {
533
        outbuf[0] = 0;
534
        outbuf[1] = s->removable ? 0x80 : 0;
535
        memcpy(&outbuf[16], "QEMU HARDDISK   ", 16);
536
    }
537
    memcpy(&outbuf[8], "QEMU    ", 8);
538
    memset(&outbuf[32], 0, 4);
539
    memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version)));
540
    /*
541
     * We claim conformance to SPC-3, which is required for guests
542
     * to ask for modern features like READ CAPACITY(16) or the
543
     * block characteristics VPD page by default.  Not all of SPC-3
544
     * is actually implemented, but we're good enough.
545
     */
546
    outbuf[2] = 5;
547
    outbuf[3] = 2; /* Format 2 */
548

    
549
    if (buflen > 36) {
550
        outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
551
    } else {
552
        /* If the allocation length of CDB is too small,
553
               the additional length is not adjusted */
554
        outbuf[4] = 36 - 5;
555
    }
556

    
557
    /* Sync data transfer and TCQ.  */
558
    outbuf[7] = 0x10 | (req->bus->tcq ? 0x02 : 0);
559
    return buflen;
560
}
561

    
562
static int mode_sense_page(SCSIRequest *req, int page, uint8_t *p,
563
                           int page_control)
564
{
565
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
566
    BlockDriverState *bdrv = s->bs;
567
    int cylinders, heads, secs;
568

    
569
    /*
570
     * If Changeable Values are requested, a mask denoting those mode parameters
571
     * that are changeable shall be returned. As we currently don't support
572
     * parameter changes via MODE_SELECT all bits are returned set to zero.
573
     * The buffer was already menset to zero by the caller of this function.
574
     */
575
    switch (page) {
576
    case 4: /* Rigid disk device geometry page. */
577
        p[0] = 4;
578
        p[1] = 0x16;
579
        if (page_control == 1) { /* Changeable Values */
580
            return p[1] + 2;
581
        }
582
        /* if a geometry hint is available, use it */
583
        bdrv_get_geometry_hint(bdrv, &cylinders, &heads, &secs);
584
        p[2] = (cylinders >> 16) & 0xff;
585
        p[3] = (cylinders >> 8) & 0xff;
586
        p[4] = cylinders & 0xff;
587
        p[5] = heads & 0xff;
588
        /* Write precomp start cylinder, disabled */
589
        p[6] = (cylinders >> 16) & 0xff;
590
        p[7] = (cylinders >> 8) & 0xff;
591
        p[8] = cylinders & 0xff;
592
        /* Reduced current start cylinder, disabled */
593
        p[9] = (cylinders >> 16) & 0xff;
594
        p[10] = (cylinders >> 8) & 0xff;
595
        p[11] = cylinders & 0xff;
596
        /* Device step rate [ns], 200ns */
597
        p[12] = 0;
598
        p[13] = 200;
599
        /* Landing zone cylinder */
600
        p[14] = 0xff;
601
        p[15] =  0xff;
602
        p[16] = 0xff;
603
        /* Medium rotation rate [rpm], 5400 rpm */
604
        p[20] = (5400 >> 8) & 0xff;
605
        p[21] = 5400 & 0xff;
606
        return p[1] + 2;
607

    
608
    case 5: /* Flexible disk device geometry page. */
609
        p[0] = 5;
610
        p[1] = 0x1e;
611
        if (page_control == 1) { /* Changeable Values */
612
            return p[1] + 2;
613
        }
614
        /* Transfer rate [kbit/s], 5Mbit/s */
615
        p[2] = 5000 >> 8;
616
        p[3] = 5000 & 0xff;
617
        /* if a geometry hint is available, use it */
618
        bdrv_get_geometry_hint(bdrv, &cylinders, &heads, &secs);
619
        p[4] = heads & 0xff;
620
        p[5] = secs & 0xff;
621
        p[6] = s->cluster_size * 2;
622
        p[8] = (cylinders >> 8) & 0xff;
623
        p[9] = cylinders & 0xff;
624
        /* Write precomp start cylinder, disabled */
625
        p[10] = (cylinders >> 8) & 0xff;
626
        p[11] = cylinders & 0xff;
627
        /* Reduced current start cylinder, disabled */
628
        p[12] = (cylinders >> 8) & 0xff;
629
        p[13] = cylinders & 0xff;
630
        /* Device step rate [100us], 100us */
631
        p[14] = 0;
632
        p[15] = 1;
633
        /* Device step pulse width [us], 1us */
634
        p[16] = 1;
635
        /* Device head settle delay [100us], 100us */
636
        p[17] = 0;
637
        p[18] = 1;
638
        /* Motor on delay [0.1s], 0.1s */
639
        p[19] = 1;
640
        /* Motor off delay [0.1s], 0.1s */
641
        p[20] = 1;
642
        /* Medium rotation rate [rpm], 5400 rpm */
643
        p[28] = (5400 >> 8) & 0xff;
644
        p[29] = 5400 & 0xff;
645
        return p[1] + 2;
646

    
647
    case 8: /* Caching page.  */
648
        p[0] = 8;
649
        p[1] = 0x12;
650
        if (page_control == 1) { /* Changeable Values */
651
            return p[1] + 2;
652
        }
653
        if (bdrv_enable_write_cache(s->bs)) {
654
            p[2] = 4; /* WCE */
655
        }
656
        return p[1] + 2;
657

    
658
    case 0x2a: /* CD Capabilities and Mechanical Status page. */
659
        if (s->drive_kind != SCSI_CD)
660
            return 0;
661
        p[0] = 0x2a;
662
        p[1] = 0x14;
663
        if (page_control == 1) { /* Changeable Values */
664
            return p[1] + 2;
665
        }
666
        p[2] = 3; // CD-R & CD-RW read
667
        p[3] = 0; // Writing not supported
668
        p[4] = 0x7f; /* Audio, composite, digital out,
669
                        mode 2 form 1&2, multi session */
670
        p[5] = 0xff; /* CD DA, DA accurate, RW supported,
671
                        RW corrected, C2 errors, ISRC,
672
                        UPC, Bar code */
673
        p[6] = 0x2d | (bdrv_is_locked(s->bs)? 2 : 0);
674
        /* Locking supported, jumper present, eject, tray */
675
        p[7] = 0; /* no volume & mute control, no
676
                     changer */
677
        p[8] = (50 * 176) >> 8; // 50x read speed
678
        p[9] = (50 * 176) & 0xff;
679
        p[10] = 0 >> 8; // No volume
680
        p[11] = 0 & 0xff;
681
        p[12] = 2048 >> 8; // 2M buffer
682
        p[13] = 2048 & 0xff;
683
        p[14] = (16 * 176) >> 8; // 16x read speed current
684
        p[15] = (16 * 176) & 0xff;
685
        p[18] = (16 * 176) >> 8; // 16x write speed
686
        p[19] = (16 * 176) & 0xff;
687
        p[20] = (16 * 176) >> 8; // 16x write speed current
688
        p[21] = (16 * 176) & 0xff;
689
        return p[1] + 2;
690

    
691
    default:
692
        return 0;
693
    }
694
}
695

    
696
static int scsi_disk_emulate_mode_sense(SCSIRequest *req, uint8_t *outbuf)
697
{
698
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
699
    uint64_t nb_sectors;
700
    int page, dbd, buflen, page_control;
701
    uint8_t *p;
702
    uint8_t dev_specific_param;
703

    
704
    dbd = req->cmd.buf[1]  & 0x8;
705
    page = req->cmd.buf[2] & 0x3f;
706
    page_control = (req->cmd.buf[2] & 0xc0) >> 6;
707
    DPRINTF("Mode Sense(%d) (page %d, xfer %zd, page_control %d)\n",
708
        (req->cmd.buf[0] == MODE_SENSE) ? 6 : 10, page, req->cmd.xfer, page_control);
709
    memset(outbuf, 0, req->cmd.xfer);
710
    p = outbuf;
711

    
712
    if (bdrv_is_read_only(s->bs)) {
713
        dev_specific_param = 0x80; /* Readonly.  */
714
    } else {
715
        dev_specific_param = 0x00;
716
    }
717

    
718
    if (req->cmd.buf[0] == MODE_SENSE) {
719
        p[1] = 0; /* Default media type.  */
720
        p[2] = dev_specific_param;
721
        p[3] = 0; /* Block descriptor length.  */
722
        p += 4;
723
    } else { /* MODE_SENSE_10 */
724
        p[2] = 0; /* Default media type.  */
725
        p[3] = dev_specific_param;
726
        p[6] = p[7] = 0; /* Block descriptor length.  */
727
        p += 8;
728
    }
729

    
730
    bdrv_get_geometry(s->bs, &nb_sectors);
731
    if (!dbd && nb_sectors) {
732
        if (req->cmd.buf[0] == MODE_SENSE) {
733
            outbuf[3] = 8; /* Block descriptor length  */
734
        } else { /* MODE_SENSE_10 */
735
            outbuf[7] = 8; /* Block descriptor length  */
736
        }
737
        nb_sectors /= s->cluster_size;
738
        if (nb_sectors > 0xffffff)
739
            nb_sectors = 0;
740
        p[0] = 0; /* media density code */
741
        p[1] = (nb_sectors >> 16) & 0xff;
742
        p[2] = (nb_sectors >> 8) & 0xff;
743
        p[3] = nb_sectors & 0xff;
744
        p[4] = 0; /* reserved */
745
        p[5] = 0; /* bytes 5-7 are the sector size in bytes */
746
        p[6] = s->cluster_size * 2;
747
        p[7] = 0;
748
        p += 8;
749
    }
750

    
751
    if (page_control == 3) { /* Saved Values */
752
        return -1; /* ILLEGAL_REQUEST */
753
    }
754

    
755
    switch (page) {
756
    case 0x04:
757
    case 0x05:
758
    case 0x08:
759
    case 0x2a:
760
        p += mode_sense_page(req, page, p, page_control);
761
        break;
762
    case 0x3f:
763
        p += mode_sense_page(req, 0x08, p, page_control);
764
        p += mode_sense_page(req, 0x2a, p, page_control);
765
        break;
766
    default:
767
        return -1; /* ILLEGAL_REQUEST */
768
    }
769

    
770
    buflen = p - outbuf;
771
    /*
772
     * The mode data length field specifies the length in bytes of the
773
     * following data that is available to be transferred. The mode data
774
     * length does not include itself.
775
     */
776
    if (req->cmd.buf[0] == MODE_SENSE) {
777
        outbuf[0] = buflen - 1;
778
    } else { /* MODE_SENSE_10 */
779
        outbuf[0] = ((buflen - 2) >> 8) & 0xff;
780
        outbuf[1] = (buflen - 2) & 0xff;
781
    }
782
    if (buflen > req->cmd.xfer)
783
        buflen = req->cmd.xfer;
784
    return buflen;
785
}
786

    
787
static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)
788
{
789
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
790
    int start_track, format, msf, toclen;
791
    uint64_t nb_sectors;
792

    
793
    msf = req->cmd.buf[1] & 2;
794
    format = req->cmd.buf[2] & 0xf;
795
    start_track = req->cmd.buf[6];
796
    bdrv_get_geometry(s->bs, &nb_sectors);
797
    DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
798
    nb_sectors /= s->cluster_size;
799
    switch (format) {
800
    case 0:
801
        toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
802
        break;
803
    case 1:
804
        /* multi session : only a single session defined */
805
        toclen = 12;
806
        memset(outbuf, 0, 12);
807
        outbuf[1] = 0x0a;
808
        outbuf[2] = 0x01;
809
        outbuf[3] = 0x01;
810
        break;
811
    case 2:
812
        toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
813
        break;
814
    default:
815
        return -1;
816
    }
817
    if (toclen > req->cmd.xfer)
818
        toclen = req->cmd.xfer;
819
    return toclen;
820
}
821

    
822
static int scsi_disk_emulate_command(SCSIDiskReq *r, uint8_t *outbuf)
823
{
824
    SCSIRequest *req = &r->req;
825
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
826
    uint64_t nb_sectors;
827
    int buflen = 0;
828
    int ret;
829

    
830
    switch (req->cmd.buf[0]) {
831
    case TEST_UNIT_READY:
832
        if (!bdrv_is_inserted(s->bs))
833
            goto not_ready;
834
        break;
835
    case REQUEST_SENSE:
836
        if (req->cmd.xfer < 4)
837
            goto illegal_request;
838
        buflen = scsi_build_sense(s->sense, outbuf, req->cmd.xfer,
839
                                  req->cmd.xfer > 13);
840
        scsi_disk_clear_sense(s);
841
        break;
842
    case INQUIRY:
843
        buflen = scsi_disk_emulate_inquiry(req, outbuf);
844
        if (buflen < 0)
845
            goto illegal_request;
846
        break;
847
    case MODE_SENSE:
848
    case MODE_SENSE_10:
849
        buflen = scsi_disk_emulate_mode_sense(req, outbuf);
850
        if (buflen < 0)
851
            goto illegal_request;
852
        break;
853
    case READ_TOC:
854
        buflen = scsi_disk_emulate_read_toc(req, outbuf);
855
        if (buflen < 0)
856
            goto illegal_request;
857
        break;
858
    case RESERVE:
859
        if (req->cmd.buf[1] & 1)
860
            goto illegal_request;
861
        break;
862
    case RESERVE_10:
863
        if (req->cmd.buf[1] & 3)
864
            goto illegal_request;
865
        break;
866
    case RELEASE:
867
        if (req->cmd.buf[1] & 1)
868
            goto illegal_request;
869
        break;
870
    case RELEASE_10:
871
        if (req->cmd.buf[1] & 3)
872
            goto illegal_request;
873
        break;
874
    case START_STOP:
875
        if (s->drive_kind == SCSI_CD && (req->cmd.buf[4] & 2)) {
876
            /* load/eject medium */
877
            bdrv_eject(s->bs, !(req->cmd.buf[4] & 1));
878
        }
879
        break;
880
    case ALLOW_MEDIUM_REMOVAL:
881
        bdrv_set_locked(s->bs, req->cmd.buf[4] & 1);
882
        break;
883
    case READ_CAPACITY:
884
        /* The normal LEN field for this command is zero.  */
885
        memset(outbuf, 0, 8);
886
        bdrv_get_geometry(s->bs, &nb_sectors);
887
        if (!nb_sectors)
888
            goto not_ready;
889
        nb_sectors /= s->cluster_size;
890
        /* Returned value is the address of the last sector.  */
891
        nb_sectors--;
892
        /* Remember the new size for read/write sanity checking. */
893
        s->max_lba = nb_sectors;
894
        /* Clip to 2TB, instead of returning capacity modulo 2TB. */
895
        if (nb_sectors > UINT32_MAX)
896
            nb_sectors = UINT32_MAX;
897
        outbuf[0] = (nb_sectors >> 24) & 0xff;
898
        outbuf[1] = (nb_sectors >> 16) & 0xff;
899
        outbuf[2] = (nb_sectors >> 8) & 0xff;
900
        outbuf[3] = nb_sectors & 0xff;
901
        outbuf[4] = 0;
902
        outbuf[5] = 0;
903
        outbuf[6] = s->cluster_size * 2;
904
        outbuf[7] = 0;
905
        buflen = 8;
906
        break;
907
    case SYNCHRONIZE_CACHE:
908
        ret = bdrv_flush(s->bs);
909
        if (ret < 0) {
910
            if (scsi_handle_rw_error(r, -ret, SCSI_REQ_STATUS_RETRY_FLUSH)) {
911
                return -1;
912
            }
913
        }
914
        break;
915
    case GET_CONFIGURATION:
916
        memset(outbuf, 0, 8);
917
        /* ??? This should probably return much more information.  For now
918
           just return the basic header indicating the CD-ROM profile.  */
919
        outbuf[7] = 8; // CD-ROM
920
        buflen = 8;
921
        break;
922
    case SERVICE_ACTION_IN:
923
        /* Service Action In subcommands. */
924
        if ((req->cmd.buf[1] & 31) == 0x10) {
925
            DPRINTF("SAI READ CAPACITY(16)\n");
926
            memset(outbuf, 0, req->cmd.xfer);
927
            bdrv_get_geometry(s->bs, &nb_sectors);
928
            if (!nb_sectors)
929
                goto not_ready;
930
            nb_sectors /= s->cluster_size;
931
            /* Returned value is the address of the last sector.  */
932
            nb_sectors--;
933
            /* Remember the new size for read/write sanity checking. */
934
            s->max_lba = nb_sectors;
935
            outbuf[0] = (nb_sectors >> 56) & 0xff;
936
            outbuf[1] = (nb_sectors >> 48) & 0xff;
937
            outbuf[2] = (nb_sectors >> 40) & 0xff;
938
            outbuf[3] = (nb_sectors >> 32) & 0xff;
939
            outbuf[4] = (nb_sectors >> 24) & 0xff;
940
            outbuf[5] = (nb_sectors >> 16) & 0xff;
941
            outbuf[6] = (nb_sectors >> 8) & 0xff;
942
            outbuf[7] = nb_sectors & 0xff;
943
            outbuf[8] = 0;
944
            outbuf[9] = 0;
945
            outbuf[10] = s->cluster_size * 2;
946
            outbuf[11] = 0;
947
            outbuf[12] = 0;
948
            outbuf[13] = get_physical_block_exp(&s->qdev.conf);
949

    
950
            /* set TPE bit if the format supports discard */
951
            if (s->qdev.conf.discard_granularity) {
952
                outbuf[14] = 0x80;
953
            }
954

    
955
            /* Protection, exponent and lowest lba field left blank. */
956
            buflen = req->cmd.xfer;
957
            break;
958
        }
959
        DPRINTF("Unsupported Service Action In\n");
960
        goto illegal_request;
961
    case REPORT_LUNS:
962
        if (req->cmd.xfer < 16)
963
            goto illegal_request;
964
        memset(outbuf, 0, 16);
965
        outbuf[3] = 8;
966
        buflen = 16;
967
        break;
968
    case VERIFY:
969
        break;
970
    case REZERO_UNIT:
971
        DPRINTF("Rezero Unit\n");
972
        if (!bdrv_is_inserted(s->bs)) {
973
            goto not_ready;
974
        }
975
        break;
976
    default:
977
        scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(INVALID_OPCODE));
978
        return -1;
979
    }
980
    scsi_req_set_status(r, GOOD, SENSE_CODE(NO_SENSE));
981
    return buflen;
982

    
983
not_ready:
984
    if (!bdrv_is_inserted(s->bs)) {
985
        scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(NO_MEDIUM));
986
    } else {
987
        scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(LUN_NOT_READY));
988
    }
989
    return -1;
990

    
991
illegal_request:
992
    scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(INVALID_FIELD));
993
    return -1;
994
}
995

    
996
/* Execute a scsi command.  Returns the length of the data expected by the
997
   command.  This will be Positive for data transfers from the device
998
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
999
   and zero if the command does not transfer any data.  */
1000

    
1001
static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf)
1002
{
1003
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1004
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1005
    int32_t len;
1006
    uint8_t command;
1007
    uint8_t *outbuf;
1008
    int rc;
1009

    
1010
    command = buf[0];
1011
    outbuf = (uint8_t *)r->iov.iov_base;
1012
    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
1013

    
1014
    if (scsi_req_parse(&r->req, buf) != 0) {
1015
        BADF("Unsupported command length, command %x\n", command);
1016
        scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(INVALID_OPCODE));
1017
        return 0;
1018
    }
1019
#ifdef DEBUG_SCSI
1020
    {
1021
        int i;
1022
        for (i = 1; i < r->req.cmd.len; i++) {
1023
            printf(" 0x%02x", buf[i]);
1024
        }
1025
        printf("\n");
1026
    }
1027
#endif
1028

    
1029
    if (req->lun || buf[1] >> 5) {
1030
        /* Only LUN 0 supported.  */
1031
        DPRINTF("Unimplemented LUN %d\n", req->lun ? req->lun : buf[1] >> 5);
1032
        if (command != REQUEST_SENSE && command != INQUIRY) {
1033
            scsi_command_complete(r, CHECK_CONDITION,
1034
                                  SENSE_CODE(LUN_NOT_SUPPORTED));
1035
            return 0;
1036
        }
1037
    }
1038
    switch (command) {
1039
    case TEST_UNIT_READY:
1040
    case REQUEST_SENSE:
1041
    case INQUIRY:
1042
    case MODE_SENSE:
1043
    case MODE_SENSE_10:
1044
    case RESERVE:
1045
    case RESERVE_10:
1046
    case RELEASE:
1047
    case RELEASE_10:
1048
    case START_STOP:
1049
    case ALLOW_MEDIUM_REMOVAL:
1050
    case READ_CAPACITY:
1051
    case SYNCHRONIZE_CACHE:
1052
    case READ_TOC:
1053
    case GET_CONFIGURATION:
1054
    case SERVICE_ACTION_IN:
1055
    case REPORT_LUNS:
1056
    case VERIFY:
1057
    case REZERO_UNIT:
1058
        rc = scsi_disk_emulate_command(r, outbuf);
1059
        if (rc < 0) {
1060
            return 0;
1061
        }
1062

    
1063
        r->iov.iov_len = rc;
1064
        break;
1065
    case READ_6:
1066
    case READ_10:
1067
    case READ_12:
1068
    case READ_16:
1069
        len = r->req.cmd.xfer / s->qdev.blocksize;
1070
        DPRINTF("Read (sector %" PRId64 ", count %d)\n", r->req.cmd.lba, len);
1071
        if (r->req.cmd.lba > s->max_lba)
1072
            goto illegal_lba;
1073
        r->sector = r->req.cmd.lba * s->cluster_size;
1074
        r->sector_count = len * s->cluster_size;
1075
        break;
1076
    case WRITE_6:
1077
    case WRITE_10:
1078
    case WRITE_12:
1079
    case WRITE_16:
1080
    case WRITE_VERIFY:
1081
    case WRITE_VERIFY_12:
1082
    case WRITE_VERIFY_16:
1083
        len = r->req.cmd.xfer / s->qdev.blocksize;
1084
        DPRINTF("Write %s(sector %" PRId64 ", count %d)\n",
1085
                (command & 0xe) == 0xe ? "And Verify " : "",
1086
                r->req.cmd.lba, len);
1087
        if (r->req.cmd.lba > s->max_lba)
1088
            goto illegal_lba;
1089
        r->sector = r->req.cmd.lba * s->cluster_size;
1090
        r->sector_count = len * s->cluster_size;
1091
        break;
1092
    case MODE_SELECT:
1093
        DPRINTF("Mode Select(6) (len %lu)\n", (long)r->req.cmd.xfer);
1094
        /* We don't support mode parameter changes.
1095
           Allow the mode parameter header + block descriptors only. */
1096
        if (r->req.cmd.xfer > 12) {
1097
            goto fail;
1098
        }
1099
        break;
1100
    case MODE_SELECT_10:
1101
        DPRINTF("Mode Select(10) (len %lu)\n", (long)r->req.cmd.xfer);
1102
        /* We don't support mode parameter changes.
1103
           Allow the mode parameter header + block descriptors only. */
1104
        if (r->req.cmd.xfer > 16) {
1105
            goto fail;
1106
        }
1107
        break;
1108
    case SEEK_6:
1109
    case SEEK_10:
1110
        DPRINTF("Seek(%d) (sector %" PRId64 ")\n", command == SEEK_6 ? 6 : 10,
1111
                r->req.cmd.lba);
1112
        if (r->req.cmd.lba > s->max_lba) {
1113
            goto illegal_lba;
1114
        }
1115
        break;
1116
    case WRITE_SAME_16:
1117
        len = r->req.cmd.xfer / s->qdev.blocksize;
1118

    
1119
        DPRINTF("WRITE SAME(16) (sector %" PRId64 ", count %d)\n",
1120
                r->req.cmd.lba, len);
1121

    
1122
        if (r->req.cmd.lba > s->max_lba) {
1123
            goto illegal_lba;
1124
        }
1125

    
1126
        /*
1127
         * We only support WRITE SAME with the unmap bit set for now.
1128
         */
1129
        if (!(buf[1] & 0x8)) {
1130
            goto fail;
1131
        }
1132

    
1133
        rc = bdrv_discard(s->bs, r->req.cmd.lba * s->cluster_size,
1134
                          len * s->cluster_size);
1135
        if (rc < 0) {
1136
            /* XXX: better error code ?*/
1137
            goto fail;
1138
        }
1139

    
1140
        break;
1141
    default:
1142
        DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
1143
        scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(INVALID_OPCODE));
1144
        return 0;
1145
    fail:
1146
        scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(INVALID_FIELD));
1147
        return 0;
1148
    illegal_lba:
1149
        scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(LBA_OUT_OF_RANGE));
1150
        return 0;
1151
    }
1152
    if (r->sector_count == 0 && r->iov.iov_len == 0) {
1153
        scsi_command_complete(r, GOOD, SENSE_CODE(NO_SENSE));
1154
    }
1155
    len = r->sector_count * 512 + r->iov.iov_len;
1156
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
1157
        return -len;
1158
    } else {
1159
        if (!r->sector_count)
1160
            r->sector_count = -1;
1161
        return len;
1162
    }
1163
}
1164

    
1165
static void scsi_disk_reset(DeviceState *dev)
1166
{
1167
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev.qdev, dev);
1168
    uint64_t nb_sectors;
1169

    
1170
    scsi_device_purge_requests(&s->qdev);
1171

    
1172
    bdrv_get_geometry(s->bs, &nb_sectors);
1173
    nb_sectors /= s->cluster_size;
1174
    if (nb_sectors) {
1175
        nb_sectors--;
1176
    }
1177
    s->max_lba = nb_sectors;
1178
}
1179

    
1180
static void scsi_destroy(SCSIDevice *dev)
1181
{
1182
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1183

    
1184
    scsi_device_purge_requests(&s->qdev);
1185
    blockdev_mark_auto_del(s->qdev.conf.bs);
1186
}
1187

    
1188
static int scsi_initfn(SCSIDevice *dev, SCSIDriveKind kind)
1189
{
1190
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
1191
    DriveInfo *dinfo;
1192

    
1193
    if (!s->qdev.conf.bs) {
1194
        error_report("scsi-disk: drive property not set");
1195
        return -1;
1196
    }
1197
    s->bs = s->qdev.conf.bs;
1198
    s->drive_kind = kind;
1199

    
1200
    if (kind == SCSI_HD && !bdrv_is_inserted(s->bs)) {
1201
        error_report("Device needs media, but drive is empty");
1202
        return -1;
1203
    }
1204

    
1205
    if (!s->serial) {
1206
        /* try to fall back to value set with legacy -drive serial=... */
1207
        dinfo = drive_get_by_blockdev(s->bs);
1208
        s->serial = qemu_strdup(*dinfo->serial ? dinfo->serial : "0");
1209
    }
1210

    
1211
    if (!s->version) {
1212
        s->version = qemu_strdup(QEMU_VERSION);
1213
    }
1214

    
1215
    if (bdrv_is_sg(s->bs)) {
1216
        error_report("scsi-disk: unwanted /dev/sg*");
1217
        return -1;
1218
    }
1219

    
1220
    if (kind == SCSI_CD) {
1221
        s->qdev.blocksize = 2048;
1222
    } else {
1223
        s->qdev.blocksize = s->qdev.conf.logical_block_size;
1224
    }
1225
    s->cluster_size = s->qdev.blocksize / 512;
1226
    s->bs->buffer_alignment = s->qdev.blocksize;
1227

    
1228
    s->qdev.type = TYPE_DISK;
1229
    qemu_add_vm_change_state_handler(scsi_dma_restart_cb, s);
1230
    bdrv_set_removable(s->bs, kind == SCSI_CD);
1231
    add_boot_device_path(s->qdev.conf.bootindex, &dev->qdev, ",0");
1232
    return 0;
1233
}
1234

    
1235
static int scsi_hd_initfn(SCSIDevice *dev)
1236
{
1237
    return scsi_initfn(dev, SCSI_HD);
1238
}
1239

    
1240
static int scsi_cd_initfn(SCSIDevice *dev)
1241
{
1242
    return scsi_initfn(dev, SCSI_CD);
1243
}
1244

    
1245
static int scsi_disk_initfn(SCSIDevice *dev)
1246
{
1247
    SCSIDriveKind kind;
1248
    DriveInfo *dinfo;
1249

    
1250
    if (!dev->conf.bs) {
1251
        kind = SCSI_HD;         /* will die in scsi_initfn() */
1252
    } else {
1253
        dinfo = drive_get_by_blockdev(dev->conf.bs);
1254
        kind = dinfo->media_cd ? SCSI_CD : SCSI_HD;
1255
    }
1256

    
1257
    return scsi_initfn(dev, kind);
1258
}
1259

    
1260
#define DEFINE_SCSI_DISK_PROPERTIES()                           \
1261
    DEFINE_BLOCK_PROPERTIES(SCSIDiskState, qdev.conf),          \
1262
    DEFINE_PROP_STRING("ver",  SCSIDiskState, version),         \
1263
    DEFINE_PROP_STRING("serial",  SCSIDiskState, serial)
1264

    
1265
static SCSIDeviceInfo scsi_disk_info[] = {
1266
    {
1267
        .qdev.name    = "scsi-hd",
1268
        .qdev.fw_name = "disk",
1269
        .qdev.desc    = "virtual SCSI disk",
1270
        .qdev.size    = sizeof(SCSIDiskState),
1271
        .qdev.reset   = scsi_disk_reset,
1272
        .init         = scsi_hd_initfn,
1273
        .destroy      = scsi_destroy,
1274
        .alloc_req    = scsi_new_request,
1275
        .free_req     = scsi_free_request,
1276
        .send_command = scsi_send_command,
1277
        .read_data    = scsi_read_data,
1278
        .write_data   = scsi_write_data,
1279
        .cancel_io    = scsi_cancel_io,
1280
        .get_buf      = scsi_get_buf,
1281
        .get_sense    = scsi_get_sense,
1282
        .qdev.props   = (Property[]) {
1283
            DEFINE_SCSI_DISK_PROPERTIES(),
1284
            DEFINE_PROP_BIT("removable", SCSIDiskState, removable, 0, false),
1285
            DEFINE_PROP_END_OF_LIST(),
1286
        }
1287
    },{
1288
        .qdev.name    = "scsi-cd",
1289
        .qdev.fw_name = "disk",
1290
        .qdev.desc    = "virtual SCSI CD-ROM",
1291
        .qdev.size    = sizeof(SCSIDiskState),
1292
        .qdev.reset   = scsi_disk_reset,
1293
        .init         = scsi_cd_initfn,
1294
        .destroy      = scsi_destroy,
1295
        .alloc_req    = scsi_new_request,
1296
        .free_req     = scsi_free_request,
1297
        .send_command = scsi_send_command,
1298
        .read_data    = scsi_read_data,
1299
        .write_data   = scsi_write_data,
1300
        .cancel_io    = scsi_cancel_io,
1301
        .get_buf      = scsi_get_buf,
1302
        .get_sense    = scsi_get_sense,
1303
        .qdev.props   = (Property[]) {
1304
            DEFINE_SCSI_DISK_PROPERTIES(),
1305
            DEFINE_PROP_END_OF_LIST(),
1306
        },
1307
    },{
1308
        .qdev.name    = "scsi-disk", /* legacy -device scsi-disk */
1309
        .qdev.fw_name = "disk",
1310
        .qdev.desc    = "virtual SCSI disk or CD-ROM (legacy)",
1311
        .qdev.size    = sizeof(SCSIDiskState),
1312
        .qdev.reset   = scsi_disk_reset,
1313
        .init         = scsi_disk_initfn,
1314
        .destroy      = scsi_destroy,
1315
        .alloc_req    = scsi_new_request,
1316
        .free_req     = scsi_free_request,
1317
        .send_command = scsi_send_command,
1318
        .read_data    = scsi_read_data,
1319
        .write_data   = scsi_write_data,
1320
        .cancel_io    = scsi_cancel_io,
1321
        .get_buf      = scsi_get_buf,
1322
        .get_sense    = scsi_get_sense,
1323
        .qdev.props   = (Property[]) {
1324
            DEFINE_SCSI_DISK_PROPERTIES(),
1325
            DEFINE_PROP_BIT("removable", SCSIDiskState, removable, 0, false),
1326
            DEFINE_PROP_END_OF_LIST(),
1327
        }
1328
    }
1329
};
1330

    
1331
static void scsi_disk_register_devices(void)
1332
{
1333
    int i;
1334

    
1335
    for (i = 0; i < ARRAY_SIZE(scsi_disk_info); i++) {
1336
        scsi_qdev_register(&scsi_disk_info[i]);
1337
    }
1338
}
1339
device_init(scsi_disk_register_devices)