qemu

1
/*
2
 * SCSI Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Based on code by Fabrice Bellard
6
 *
7
 * Written by Paul Brook
8
 * Modifications:
9
 *  2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10
 *                                 when the allocation length of CDB is smaller
11
 *                                 than 36.
12
 *  2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13
 *                                 MODE SENSE response.
14
 *
15
 * This code is licensed under the LGPL.
16
 *
17
 * Note that this file only handles the SCSI architecture model and device
18
 * commands.  Emulation of interface/link layer protocols is handled by
19
 * the host adapter emulator.
20
 */
21

22
#include "qemu/osdep.h"
23
#include "qemu/units.h"
24
#include "qapi/error.h"
25
#include "qemu/error-report.h"
26
#include "qemu/main-loop.h"
27
#include "qemu/module.h"
28
#include "qemu/hw-version.h"
29
#include "qemu/memalign.h"
30
#include "hw/scsi/scsi.h"
31
#include "migration/qemu-file-types.h"
32
#include "migration/vmstate.h"
33
#include "hw/scsi/emulation.h"
34
#include "scsi/constants.h"
35
#include "sysemu/block-backend.h"
36
#include "sysemu/blockdev.h"
37
#include "hw/block/block.h"
38
#include "hw/qdev-properties.h"
39
#include "hw/qdev-properties-system.h"
40
#include "sysemu/dma.h"
41
#include "sysemu/sysemu.h"
42
#include "qemu/cutils.h"
43
#include "trace.h"
44
#include "qom/object.h"
45

46
#ifdef __linux
47
#include <scsi/sg.h>
48
#endif
49

50
#define SCSI_WRITE_SAME_MAX         (512 * KiB)
51
#define SCSI_DMA_BUF_SIZE           (128 * KiB)
52
#define SCSI_MAX_INQUIRY_LEN        256
53
#define SCSI_MAX_MODE_LEN           256
54

55
#define DEFAULT_DISCARD_GRANULARITY (4 * KiB)
56
#define DEFAULT_MAX_UNMAP_SIZE      (1 * GiB)
57
#define DEFAULT_MAX_IO_SIZE         INT_MAX     /* 2 GB - 1 block */
58

59
#define TYPE_SCSI_DISK_BASE         "scsi-disk-base"
60

61
#define MAX_SERIAL_LEN              36
62
#define MAX_SERIAL_LEN_FOR_DEVID    20
63

64
OBJECT_DECLARE_TYPE(SCSIDiskState, SCSIDiskClass, SCSI_DISK_BASE)
65

66
struct SCSIDiskClass {
67
    SCSIDeviceClass parent_class;
68
    /*
69
     * Callbacks receive ret == 0 for success. Errors are represented either as
70
     * negative errno values, or as positive SAM status codes.
71
     *
72
     * Beware: For errors returned in host_status, the function may directly
73
     * complete the request and never call the callback.
74
     */
75
    DMAIOFunc       *dma_readv;
76
    DMAIOFunc       *dma_writev;
77
    bool            (*need_fua_emulation)(SCSICommand *cmd);
78
    void            (*update_sense)(SCSIRequest *r);
79
};
80

81
typedef struct SCSIDiskReq {
82
    SCSIRequest req;
83
    /* Both sector and sector_count are in terms of BDRV_SECTOR_SIZE bytes.  */
84
    uint64_t sector;
85
    uint32_t sector_count;
86
    uint32_t buflen;
87
    bool started;
88
    bool need_fua_emulation;
89
    struct iovec iov;
90
    QEMUIOVector qiov;
91
    BlockAcctCookie acct;
92
} SCSIDiskReq;
93

94
#define SCSI_DISK_F_REMOVABLE             0
95
#define SCSI_DISK_F_DPOFUA                1
96
#define SCSI_DISK_F_NO_REMOVABLE_DEVOPS   2
97

98
struct SCSIDiskState {
99
    SCSIDevice qdev;
100
    uint32_t features;
101
    bool media_changed;
102
    bool media_event;
103
    bool eject_request;
104
    uint16_t port_index;
105
    uint64_t max_unmap_size;
106
    uint64_t max_io_size;
107
    uint32_t quirks;
108
    QEMUBH *bh;
109
    char *version;
110
    char *serial;
111
    char *vendor;
112
    char *product;
113
    char *device_id;
114
    bool tray_open;
115
    bool tray_locked;
116
    /*
117
     * 0x0000        - rotation rate not reported
118
     * 0x0001        - non-rotating medium (SSD)
119
     * 0x0002-0x0400 - reserved
120
     * 0x0401-0xffe  - rotations per minute
121
     * 0xffff        - reserved
122
     */
123
    uint16_t rotation_rate;
124
    bool migrate_emulated_scsi_request;
125
};
126

127
static void scsi_free_request(SCSIRequest *req)
128
{
129
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
130

131
    qemu_vfree(r->iov.iov_base);
132
}
133

134
/* Helper function for command completion with sense.  */
135
static void scsi_check_condition(SCSIDiskReq *r, SCSISense sense)
136
{
137
    trace_scsi_disk_check_condition(r->req.tag, sense.key, sense.asc,
138
                                    sense.ascq);
139
    scsi_req_build_sense(&r->req, sense);
140
    scsi_req_complete(&r->req, CHECK_CONDITION);
141
}
142

143
static void scsi_init_iovec(SCSIDiskReq *r, size_t size)
144
{
145
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
146

147
    if (!r->iov.iov_base) {
148
        r->buflen = size;
149
        r->iov.iov_base = blk_blockalign(s->qdev.conf.blk, r->buflen);
150
    }
151
    r->iov.iov_len = MIN(r->sector_count * BDRV_SECTOR_SIZE, r->buflen);
152
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
153
}
154

155
static void scsi_disk_save_request(QEMUFile *f, SCSIRequest *req)
156
{
157
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
158

159
    qemu_put_be64s(f, &r->sector);
160
    qemu_put_be32s(f, &r->sector_count);
161
    qemu_put_be32s(f, &r->buflen);
162
    if (r->buflen) {
163
        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
164
            qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
165
        } else if (!req->retry) {
166
            uint32_t len = r->iov.iov_len;
167
            qemu_put_be32s(f, &len);
168
            qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
169
        }
170
    }
171
}
172

173
static void scsi_disk_emulate_save_request(QEMUFile *f, SCSIRequest *req)
174
{
175
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
176

177
    if (s->migrate_emulated_scsi_request) {
178
        scsi_disk_save_request(f, req);
179
    }
180
}
181

182
static void scsi_disk_load_request(QEMUFile *f, SCSIRequest *req)
183
{
184
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
185

186
    qemu_get_be64s(f, &r->sector);
187
    qemu_get_be32s(f, &r->sector_count);
188
    qemu_get_be32s(f, &r->buflen);
189
    if (r->buflen) {
190
        scsi_init_iovec(r, r->buflen);
191
        if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
192
            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
193
        } else if (!r->req.retry) {
194
            uint32_t len;
195
            qemu_get_be32s(f, &len);
196
            r->iov.iov_len = len;
197
            assert(r->iov.iov_len <= r->buflen);
198
            qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
199
        }
200
    }
201

202
    qemu_iovec_init_external(&r->qiov, &r->iov, 1);
203
}
204

205
static void scsi_disk_emulate_load_request(QEMUFile *f, SCSIRequest *req)
206
{
207
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
208

209
    if (s->migrate_emulated_scsi_request) {
210
        scsi_disk_load_request(f, req);
211
    }
212
}
213

214
/*
215
 * scsi_handle_rw_error has two return values.  False means that the error
216
 * must be ignored, true means that the error has been processed and the
217
 * caller should not do anything else for this request.  Note that
218
 * scsi_handle_rw_error always manages its reference counts, independent
219
 * of the return value.
220
 */
221
static bool scsi_handle_rw_error(SCSIDiskReq *r, int ret, bool acct_failed)
222
{
223
    bool is_read = (r->req.cmd.mode == SCSI_XFER_FROM_DEV);
224
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
225
    SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
226
    SCSISense sense = SENSE_CODE(NO_SENSE);
227
    int error;
228
    bool req_has_sense = false;
229
    BlockErrorAction action;
230
    int status;
231

232
    if (ret < 0) {
233
        status = scsi_sense_from_errno(-ret, &sense);
234
        error = -ret;
235
    } else {
236
        /* A passthrough command has completed with nonzero status.  */
237
        status = ret;
238
        switch (status) {
239
        case CHECK_CONDITION:
240
            req_has_sense = true;
241
            error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
242
            break;
243
        case RESERVATION_CONFLICT:
244
            /*
245
             * Don't apply the error policy, always report to the guest.
246
             *
247
             * This is a passthrough code path, so it's not a backend error, but
248
             * a response to an invalid guest request.
249
             *
250
             * Windows Failover Cluster validation intentionally sends invalid
251
             * requests to verify that reservations work as intended. It is
252
             * crucial that it sees the resulting errors.
253
             *
254
             * Treating a reservation conflict as a guest-side error is obvious
255
             * when a pr-manager is in use. Without one, the situation is less
256
             * clear, but there might be nothing that can be fixed on the host
257
             * (like in the above example), and we don't want to be stuck in a
258
             * loop where resuming the VM and retrying the request immediately
259
             * stops it again. So always reporting is still the safer option in
260
             * this case, too.
261
             */
262
            error = 0;
263
            break;
264
        default:
265
            error = EINVAL;
266
            break;
267
        }
268
    }
269

270
    /*
271
     * Check whether the error has to be handled by the guest or should
272
     * rather follow the rerror=/werror= settings.  Guest-handled errors
273
     * are usually retried immediately, so do not post them to QMP and
274
     * do not account them as failed I/O.
275
     */
276
    if (!error || (req_has_sense &&
277
                   scsi_sense_buf_is_guest_recoverable(r->req.sense,
278
                                                       sizeof(r->req.sense)))) {
279
        action = BLOCK_ERROR_ACTION_REPORT;
280
        acct_failed = false;
281
    } else {
282
        action = blk_get_error_action(s->qdev.conf.blk, is_read, error);
283
        blk_error_action(s->qdev.conf.blk, action, is_read, error);
284
    }
285

286
    switch (action) {
287
    case BLOCK_ERROR_ACTION_REPORT:
288
        if (acct_failed) {
289
            block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
290
        }
291
        if (req_has_sense) {
292
            sdc->update_sense(&r->req);
293
        } else if (status == CHECK_CONDITION) {
294
            scsi_req_build_sense(&r->req, sense);
295
        }
296
        scsi_req_complete(&r->req, status);
297
        return true;
298

299
    case BLOCK_ERROR_ACTION_IGNORE:
300
        return false;
301

302
    case BLOCK_ERROR_ACTION_STOP:
303
        scsi_req_retry(&r->req);
304
        return true;
305

306
    default:
307
        g_assert_not_reached();
308
    }
309
}
310

311
static bool scsi_disk_req_check_error(SCSIDiskReq *r, int ret, bool acct_failed)
312
{
313
    if (r->req.io_canceled) {
314
        scsi_req_cancel_complete(&r->req);
315
        return true;
316
    }
317

318
    if (ret != 0) {
319
        return scsi_handle_rw_error(r, ret, acct_failed);
320
    }
321

322
    return false;
323
}
324

325
static void scsi_aio_complete(void *opaque, int ret)
326
{
327
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
328
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
329

330
    /* The request must only run in the BlockBackend's AioContext */
331
    assert(blk_get_aio_context(s->qdev.conf.blk) ==
332
           qemu_get_current_aio_context());
333

334
    assert(r->req.aiocb != NULL);
335
    r->req.aiocb = NULL;
336

337
    if (scsi_disk_req_check_error(r, ret, true)) {
338
        goto done;
339
    }
340

341
    block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
342
    scsi_req_complete(&r->req, GOOD);
343

344
done:
345
    scsi_req_unref(&r->req);
346
}
347

348
static bool scsi_is_cmd_fua(SCSICommand *cmd)
349
{
350
    switch (cmd->buf[0]) {
351
    case READ_10:
352
    case READ_12:
353
    case READ_16:
354
    case WRITE_10:
355
    case WRITE_12:
356
    case WRITE_16:
357
        return (cmd->buf[1] & 8) != 0;
358

359
    case VERIFY_10:
360
    case VERIFY_12:
361
    case VERIFY_16:
362
    case WRITE_VERIFY_10:
363
    case WRITE_VERIFY_12:
364
    case WRITE_VERIFY_16:
365
        return true;
366

367
    case READ_6:
368
    case WRITE_6:
369
    default:
370
        return false;
371
    }
372
}
373

374
static void scsi_write_do_fua(SCSIDiskReq *r)
375
{
376
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
377

378
    assert(r->req.aiocb == NULL);
379
    assert(!r->req.io_canceled);
380

381
    if (r->need_fua_emulation) {
382
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
383
                         BLOCK_ACCT_FLUSH);
384
        r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
385
        return;
386
    }
387

388
    scsi_req_complete(&r->req, GOOD);
389
    scsi_req_unref(&r->req);
390
}
391

392
static void scsi_dma_complete_noio(SCSIDiskReq *r, int ret)
393
{
394
    assert(r->req.aiocb == NULL);
395
    if (scsi_disk_req_check_error(r, ret, ret > 0)) {
396
        goto done;
397
    }
398

399
    r->sector += r->sector_count;
400
    r->sector_count = 0;
401
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
402
        scsi_write_do_fua(r);
403
        return;
404
    } else {
405
        scsi_req_complete(&r->req, GOOD);
406
    }
407

408
done:
409
    scsi_req_unref(&r->req);
410
}
411

412
/* May not be called in all error cases, don't rely on cleanup here */
413
static void scsi_dma_complete(void *opaque, int ret)
414
{
415
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
416
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
417

418
    assert(r->req.aiocb != NULL);
419
    r->req.aiocb = NULL;
420

421
    /* ret > 0 is accounted for in scsi_disk_req_check_error() */
422
    if (ret < 0) {
423
        block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
424
    } else if (ret == 0) {
425
        block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
426
    }
427
    scsi_dma_complete_noio(r, ret);
428
}
429

430
static void scsi_read_complete_noio(SCSIDiskReq *r, int ret)
431
{
432
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
433
    uint32_t n;
434

435
    /* The request must only run in the BlockBackend's AioContext */
436
    assert(blk_get_aio_context(s->qdev.conf.blk) ==
437
           qemu_get_current_aio_context());
438

439
    assert(r->req.aiocb == NULL);
440
    if (scsi_disk_req_check_error(r, ret, ret > 0)) {
441
        goto done;
442
    }
443

444
    n = r->qiov.size / BDRV_SECTOR_SIZE;
445
    r->sector += n;
446
    r->sector_count -= n;
447
    scsi_req_data(&r->req, r->qiov.size);
448

449
done:
450
    scsi_req_unref(&r->req);
451
}
452

453
/* May not be called in all error cases, don't rely on cleanup here */
454
static void scsi_read_complete(void *opaque, int ret)
455
{
456
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
457
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
458

459
    assert(r->req.aiocb != NULL);
460
    r->req.aiocb = NULL;
461

462
    /* ret > 0 is accounted for in scsi_disk_req_check_error() */
463
    if (ret < 0) {
464
        block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
465
    } else if (ret == 0) {
466
        block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
467
        trace_scsi_disk_read_complete(r->req.tag, r->qiov.size);
468
    }
469
    scsi_read_complete_noio(r, ret);
470
}
471

472
/* Actually issue a read to the block device.  */
473
static void scsi_do_read(SCSIDiskReq *r, int ret)
474
{
475
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
476
    SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
477

478
    assert (r->req.aiocb == NULL);
479
    if (scsi_disk_req_check_error(r, ret, false)) {
480
        goto done;
481
    }
482

483
    /* The request is used as the AIO opaque value, so add a ref.  */
484
    scsi_req_ref(&r->req);
485

486
    if (r->req.sg) {
487
        dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_READ);
488
        r->req.residual -= r->req.sg->size;
489
        r->req.aiocb = dma_blk_io(blk_get_aio_context(s->qdev.conf.blk),
490
                                  r->req.sg, r->sector << BDRV_SECTOR_BITS,
491
                                  BDRV_SECTOR_SIZE,
492
                                  sdc->dma_readv, r, scsi_dma_complete, r,
493
                                  DMA_DIRECTION_FROM_DEVICE);
494
    } else {
495
        scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
496
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
497
                         r->qiov.size, BLOCK_ACCT_READ);
498
        r->req.aiocb = sdc->dma_readv(r->sector << BDRV_SECTOR_BITS, &r->qiov,
499
                                      scsi_read_complete, r, r);
500
    }
501

502
done:
503
    scsi_req_unref(&r->req);
504
}
505

506
static void scsi_do_read_cb(void *opaque, int ret)
507
{
508
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
509
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
510

511
    assert (r->req.aiocb != NULL);
512
    r->req.aiocb = NULL;
513

514
    if (ret < 0) {
515
        block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
516
    } else {
517
        block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
518
    }
519
    scsi_do_read(opaque, ret);
520
}
521

522
/* Read more data from scsi device into buffer.  */
523
static void scsi_read_data(SCSIRequest *req)
524
{
525
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
526
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
527
    bool first;
528

529
    trace_scsi_disk_read_data_count(r->sector_count);
530
    if (r->sector_count == 0) {
531
        /* This also clears the sense buffer for REQUEST SENSE.  */
532
        scsi_req_complete(&r->req, GOOD);
533
        return;
534
    }
535

536
    /* No data transfer may already be in progress */
537
    assert(r->req.aiocb == NULL);
538

539
    /* The request is used as the AIO opaque value, so add a ref.  */
540
    scsi_req_ref(&r->req);
541
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
542
        trace_scsi_disk_read_data_invalid();
543
        scsi_read_complete_noio(r, -EINVAL);
544
        return;
545
    }
546

547
    if (!blk_is_available(req->dev->conf.blk)) {
548
        scsi_read_complete_noio(r, -ENOMEDIUM);
549
        return;
550
    }
551

552
    first = !r->started;
553
    r->started = true;
554
    if (first && r->need_fua_emulation) {
555
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
556
                         BLOCK_ACCT_FLUSH);
557
        r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_do_read_cb, r);
558
    } else {
559
        scsi_do_read(r, 0);
560
    }
561
}
562

563
static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
564
{
565
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
566
    uint32_t n;
567

568
    /* The request must only run in the BlockBackend's AioContext */
569
    assert(blk_get_aio_context(s->qdev.conf.blk) ==
570
           qemu_get_current_aio_context());
571

572
    assert (r->req.aiocb == NULL);
573
    if (scsi_disk_req_check_error(r, ret, ret > 0)) {
574
        goto done;
575
    }
576

577
    n = r->qiov.size / BDRV_SECTOR_SIZE;
578
    r->sector += n;
579
    r->sector_count -= n;
580
    if (r->sector_count == 0) {
581
        scsi_write_do_fua(r);
582
        return;
583
    } else {
584
        scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
585
        trace_scsi_disk_write_complete_noio(r->req.tag, r->qiov.size);
586
        scsi_req_data(&r->req, r->qiov.size);
587
    }
588

589
done:
590
    scsi_req_unref(&r->req);
591
}
592

593
/* May not be called in all error cases, don't rely on cleanup here */
594
static void scsi_write_complete(void * opaque, int ret)
595
{
596
    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
597
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
598

599
    assert (r->req.aiocb != NULL);
600
    r->req.aiocb = NULL;
601

602
    /* ret > 0 is accounted for in scsi_disk_req_check_error() */
603
    if (ret < 0) {
604
        block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
605
    } else if (ret == 0) {
606
        block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
607
    }
608
    scsi_write_complete_noio(r, ret);
609
}
610

611
static void scsi_write_data(SCSIRequest *req)
612
{
613
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
614
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
615
    SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
616

617
    /* No data transfer may already be in progress */
618
    assert(r->req.aiocb == NULL);
619

620
    /* The request is used as the AIO opaque value, so add a ref.  */
621
    scsi_req_ref(&r->req);
622
    if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {
623
        trace_scsi_disk_write_data_invalid();
624
        scsi_write_complete_noio(r, -EINVAL);
625
        return;
626
    }
627

628
    if (!r->req.sg && !r->qiov.size) {
629
        /* Called for the first time.  Ask the driver to send us more data.  */
630
        r->started = true;
631
        scsi_write_complete_noio(r, 0);
632
        return;
633
    }
634
    if (!blk_is_available(req->dev->conf.blk)) {
635
        scsi_write_complete_noio(r, -ENOMEDIUM);
636
        return;
637
    }
638

639
    if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
640
        r->req.cmd.buf[0] == VERIFY_16) {
641
        if (r->req.sg) {
642
            scsi_dma_complete_noio(r, 0);
643
        } else {
644
            scsi_write_complete_noio(r, 0);
645
        }
646
        return;
647
    }
648

649
    if (r->req.sg) {
650
        dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_WRITE);
651
        r->req.residual -= r->req.sg->size;
652
        r->req.aiocb = dma_blk_io(blk_get_aio_context(s->qdev.conf.blk),
653
                                  r->req.sg, r->sector << BDRV_SECTOR_BITS,
654
                                  BDRV_SECTOR_SIZE,
655
                                  sdc->dma_writev, r, scsi_dma_complete, r,
656
                                  DMA_DIRECTION_TO_DEVICE);
657
    } else {
658
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
659
                         r->qiov.size, BLOCK_ACCT_WRITE);
660
        r->req.aiocb = sdc->dma_writev(r->sector << BDRV_SECTOR_BITS, &r->qiov,
661
                                       scsi_write_complete, r, r);
662
    }
663
}
664

665
/* Return a pointer to the data buffer.  */
666
static uint8_t *scsi_get_buf(SCSIRequest *req)
667
{
668
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
669

670
    return (uint8_t *)r->iov.iov_base;
671
}
672

673
static int scsi_disk_emulate_vpd_page(SCSIRequest *req, uint8_t *outbuf)
674
{
675
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
676
    uint8_t page_code = req->cmd.buf[2];
677
    int start, buflen = 0;
678

679
    outbuf[buflen++] = s->qdev.type & 0x1f;
680
    outbuf[buflen++] = page_code;
681
    outbuf[buflen++] = 0x00;
682
    outbuf[buflen++] = 0x00;
683
    start = buflen;
684

685
    switch (page_code) {
686
    case 0x00: /* Supported page codes, mandatory */
687
    {
688
        trace_scsi_disk_emulate_vpd_page_00(req->cmd.xfer);
689
        outbuf[buflen++] = 0x00; /* list of supported pages (this page) */
690
        if (s->serial) {
691
            outbuf[buflen++] = 0x80; /* unit serial number */
692
        }
693
        outbuf[buflen++] = 0x83; /* device identification */
694
        if (s->qdev.type == TYPE_DISK) {
695
            outbuf[buflen++] = 0xb0; /* block limits */
696
            outbuf[buflen++] = 0xb1; /* block device characteristics */
697
            outbuf[buflen++] = 0xb2; /* thin provisioning */
698
        }
699
        break;
700
    }
701
    case 0x80: /* Device serial number, optional */
702
    {
703
        int l;
704

705
        if (!s->serial) {
706
            trace_scsi_disk_emulate_vpd_page_80_not_supported();
707
            return -1;
708
        }
709

710
        l = strlen(s->serial);
711
        if (l > MAX_SERIAL_LEN) {
712
            l = MAX_SERIAL_LEN;
713
        }
714

715
        trace_scsi_disk_emulate_vpd_page_80(req->cmd.xfer);
716
        memcpy(outbuf + buflen, s->serial, l);
717
        buflen += l;
718
        break;
719
    }
720

721
    case 0x83: /* Device identification page, mandatory */
722
    {
723
        int id_len = s->device_id ? MIN(strlen(s->device_id), 255 - 8) : 0;
724

725
        trace_scsi_disk_emulate_vpd_page_83(req->cmd.xfer);
726

727
        if (id_len) {
728
            outbuf[buflen++] = 0x2; /* ASCII */
729
            outbuf[buflen++] = 0;   /* not officially assigned */
730
            outbuf[buflen++] = 0;   /* reserved */
731
            outbuf[buflen++] = id_len; /* length of data following */
732
            memcpy(outbuf + buflen, s->device_id, id_len);
733
            buflen += id_len;
734
        }
735

736
        if (s->qdev.wwn) {
737
            outbuf[buflen++] = 0x1; /* Binary */
738
            outbuf[buflen++] = 0x3; /* NAA */
739
            outbuf[buflen++] = 0;   /* reserved */
740
            outbuf[buflen++] = 8;
741
            stq_be_p(&outbuf[buflen], s->qdev.wwn);
742
            buflen += 8;
743
        }
744

745
        if (s->qdev.port_wwn) {
746
            outbuf[buflen++] = 0x61; /* SAS / Binary */
747
            outbuf[buflen++] = 0x93; /* PIV / Target port / NAA */
748
            outbuf[buflen++] = 0;    /* reserved */
749
            outbuf[buflen++] = 8;
750
            stq_be_p(&outbuf[buflen], s->qdev.port_wwn);
751
            buflen += 8;
752
        }
753

754
        if (s->port_index) {
755
            outbuf[buflen++] = 0x61; /* SAS / Binary */
756

757
            /* PIV/Target port/relative target port */
758
            outbuf[buflen++] = 0x94;
759

760
            outbuf[buflen++] = 0;    /* reserved */
761
            outbuf[buflen++] = 4;
762
            stw_be_p(&outbuf[buflen + 2], s->port_index);
763
            buflen += 4;
764
        }
765
        break;
766
    }
767
    case 0xb0: /* block limits */
768
    {
769
        SCSIBlockLimits bl = {};
770

771
        if (s->qdev.type == TYPE_ROM) {
772
            trace_scsi_disk_emulate_vpd_page_b0_not_supported();
773
            return -1;
774
        }
775
        bl.wsnz = 1;
776
        bl.unmap_sectors =
777
            s->qdev.conf.discard_granularity / s->qdev.blocksize;
778
        bl.min_io_size =
779
            s->qdev.conf.min_io_size / s->qdev.blocksize;
780
        bl.opt_io_size =
781
            s->qdev.conf.opt_io_size / s->qdev.blocksize;
782
        bl.max_unmap_sectors =
783
            s->max_unmap_size / s->qdev.blocksize;
784
        bl.max_io_sectors =
785
            s->max_io_size / s->qdev.blocksize;
786
        /* 255 descriptors fit in 4 KiB with an 8-byte header */
787
        bl.max_unmap_descr = 255;
788

789
        if (s->qdev.type == TYPE_DISK) {
790
            int max_transfer_blk = blk_get_max_transfer(s->qdev.conf.blk);
791
            int max_io_sectors_blk =
792
                max_transfer_blk / s->qdev.blocksize;
793

794
            bl.max_io_sectors =
795
                MIN_NON_ZERO(max_io_sectors_blk, bl.max_io_sectors);
796
        }
797
        buflen += scsi_emulate_block_limits(outbuf + buflen, &bl);
798
        break;
799
    }
800
    case 0xb1: /* block device characteristics */
801
    {
802
        buflen = 0x40;
803
        outbuf[4] = (s->rotation_rate >> 8) & 0xff;
804
        outbuf[5] = s->rotation_rate & 0xff;
805
        outbuf[6] = 0; /* PRODUCT TYPE */
806
        outbuf[7] = 0; /* WABEREQ | WACEREQ | NOMINAL FORM FACTOR */
807
        outbuf[8] = 0; /* VBULS */
808
        break;
809
    }
810
    case 0xb2: /* thin provisioning */
811
    {
812
        buflen = 8;
813
        outbuf[4] = 0;
814
        outbuf[5] = 0xe0; /* unmap & write_same 10/16 all supported */
815
        outbuf[6] = s->qdev.conf.discard_granularity ? 2 : 1;
816
        outbuf[7] = 0;
817
        break;
818
    }
819
    default:
820
        return -1;
821
    }
822
    /* done with EVPD */
823
    assert(buflen - start <= 255);
824
    outbuf[start - 1] = buflen - start;
825
    return buflen;
826
}
827

828
static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
829
{
830
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
831
    int buflen = 0;
832

833
    if (req->cmd.buf[1] & 0x1) {
834
        /* Vital product data */
835
        return scsi_disk_emulate_vpd_page(req, outbuf);
836
    }
837

838
    /* Standard INQUIRY data */
839
    if (req->cmd.buf[2] != 0) {
840
        return -1;
841
    }
842

843
    /* PAGE CODE == 0 */
844
    buflen = req->cmd.xfer;
845
    if (buflen > SCSI_MAX_INQUIRY_LEN) {
846
        buflen = SCSI_MAX_INQUIRY_LEN;
847
    }
848

849
    outbuf[0] = s->qdev.type & 0x1f;
850
    outbuf[1] = (s->features & (1 << SCSI_DISK_F_REMOVABLE)) ? 0x80 : 0;
851

852
    strpadcpy((char *) &outbuf[16], 16, s->product, ' ');
853
    strpadcpy((char *) &outbuf[8], 8, s->vendor, ' ');
854

855
    memset(&outbuf[32], 0, 4);
856
    memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version)));
857
    /*
858
     * We claim conformance to SPC-3, which is required for guests
859
     * to ask for modern features like READ CAPACITY(16) or the
860
     * block characteristics VPD page by default.  Not all of SPC-3
861
     * is actually implemented, but we're good enough.
862
     */
863
    outbuf[2] = s->qdev.default_scsi_version;
864
    outbuf[3] = 2 | 0x10; /* Format 2, HiSup */
865

866
    if (buflen > 36) {
867
        outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
868
    } else {
869
        /* If the allocation length of CDB is too small,
870
               the additional length is not adjusted */
871
        outbuf[4] = 36 - 5;
872
    }
873

874
    /* Sync data transfer and TCQ.  */
875
    outbuf[7] = 0x10 | (req->bus->info->tcq ? 0x02 : 0);
876
    return buflen;
877
}
878

879
static inline bool media_is_dvd(SCSIDiskState *s)
880
{
881
    uint64_t nb_sectors;
882
    if (s->qdev.type != TYPE_ROM) {
883
        return false;
884
    }
885
    if (!blk_is_available(s->qdev.conf.blk)) {
886
        return false;
887
    }
888
    blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
889
    return nb_sectors > CD_MAX_SECTORS;
890
}
891

892
static inline bool media_is_cd(SCSIDiskState *s)
893
{
894
    uint64_t nb_sectors;
895
    if (s->qdev.type != TYPE_ROM) {
896
        return false;
897
    }
898
    if (!blk_is_available(s->qdev.conf.blk)) {
899
        return false;
900
    }
901
    blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
902
    return nb_sectors <= CD_MAX_SECTORS;
903
}
904

905
static int scsi_read_disc_information(SCSIDiskState *s, SCSIDiskReq *r,
906
                                      uint8_t *outbuf)
907
{
908
    uint8_t type = r->req.cmd.buf[1] & 7;
909

910
    if (s->qdev.type != TYPE_ROM) {
911
        return -1;
912
    }
913

914
    /* Types 1/2 are only defined for Blu-Ray.  */
915
    if (type != 0) {
916
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
917
        return -1;
918
    }
919

920
    memset(outbuf, 0, 34);
921
    outbuf[1] = 32;
922
    outbuf[2] = 0xe; /* last session complete, disc finalized */
923
    outbuf[3] = 1;   /* first track on disc */
924
    outbuf[4] = 1;   /* # of sessions */
925
    outbuf[5] = 1;   /* first track of last session */
926
    outbuf[6] = 1;   /* last track of last session */
927
    outbuf[7] = 0x20; /* unrestricted use */
928
    outbuf[8] = 0x00; /* CD-ROM or DVD-ROM */
929
    /* 9-10-11: most significant byte corresponding bytes 4-5-6 */
930
    /* 12-23: not meaningful for CD-ROM or DVD-ROM */
931
    /* 24-31: disc bar code */
932
    /* 32: disc application code */
933
    /* 33: number of OPC tables */
934

935
    return 34;
936
}
937

938
static int scsi_read_dvd_structure(SCSIDiskState *s, SCSIDiskReq *r,
939
                                   uint8_t *outbuf)
940
{
941
    static const int rds_caps_size[5] = {
942
        [0] = 2048 + 4,
943
        [1] = 4 + 4,
944
        [3] = 188 + 4,
945
        [4] = 2048 + 4,
946
    };
947

948
    uint8_t media = r->req.cmd.buf[1];
949
    uint8_t layer = r->req.cmd.buf[6];
950
    uint8_t format = r->req.cmd.buf[7];
951
    int size = -1;
952

953
    if (s->qdev.type != TYPE_ROM) {
954
        return -1;
955
    }
956
    if (media != 0) {
957
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
958
        return -1;
959
    }
960

961
    if (format != 0xff) {
962
        if (!blk_is_available(s->qdev.conf.blk)) {
963
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
964
            return -1;
965
        }
966
        if (media_is_cd(s)) {
967
            scsi_check_condition(r, SENSE_CODE(INCOMPATIBLE_FORMAT));
968
            return -1;
969
        }
970
        if (format >= ARRAY_SIZE(rds_caps_size)) {
971
            return -1;
972
        }
973
        size = rds_caps_size[format];
974
        memset(outbuf, 0, size);
975
    }
976

977
    switch (format) {
978
    case 0x00: {
979
        /* Physical format information */
980
        uint64_t nb_sectors;
981
        if (layer != 0) {
982
            goto fail;
983
        }
984
        blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
985

986
        outbuf[4] = 1;   /* DVD-ROM, part version 1 */
987
        outbuf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
988
        outbuf[6] = 1;   /* one layer, read-only (per MMC-2 spec) */
989
        outbuf[7] = 0;   /* default densities */
990

991
        stl_be_p(&outbuf[12], (nb_sectors >> 2) - 1); /* end sector */
992
        stl_be_p(&outbuf[16], (nb_sectors >> 2) - 1); /* l0 end sector */
993
        break;
994
    }
995

996
    case 0x01: /* DVD copyright information, all zeros */
997
        break;
998

999
    case 0x03: /* BCA information - invalid field for no BCA info */
1000
        return -1;
1001

1002
    case 0x04: /* DVD disc manufacturing information, all zeros */
1003
        break;
1004

1005
    case 0xff: { /* List capabilities */
1006
        int i;
1007
        size = 4;
1008
        for (i = 0; i < ARRAY_SIZE(rds_caps_size); i++) {
1009
            if (!rds_caps_size[i]) {
1010
                continue;
1011
            }
1012
            outbuf[size] = i;
1013
            outbuf[size + 1] = 0x40; /* Not writable, readable */
1014
            stw_be_p(&outbuf[size + 2], rds_caps_size[i]);
1015
            size += 4;
1016
        }
1017
        break;
1018
     }
1019

1020
    default:
1021
        return -1;
1022
    }
1023

1024
    /* Size of buffer, not including 2 byte size field */
1025
    stw_be_p(outbuf, size - 2);
1026
    return size;
1027

1028
fail:
1029
    return -1;
1030
}
1031

1032
static int scsi_event_status_media(SCSIDiskState *s, uint8_t *outbuf)
1033
{
1034
    uint8_t event_code, media_status;
1035

1036
    media_status = 0;
1037
    if (s->tray_open) {
1038
        media_status = MS_TRAY_OPEN;
1039
    } else if (blk_is_inserted(s->qdev.conf.blk)) {
1040
        media_status = MS_MEDIA_PRESENT;
1041
    }
1042

1043
    /* Event notification descriptor */
1044
    event_code = MEC_NO_CHANGE;
1045
    if (media_status != MS_TRAY_OPEN) {
1046
        if (s->media_event) {
1047
            event_code = MEC_NEW_MEDIA;
1048
            s->media_event = false;
1049
        } else if (s->eject_request) {
1050
            event_code = MEC_EJECT_REQUESTED;
1051
            s->eject_request = false;
1052
        }
1053
    }
1054

1055
    outbuf[0] = event_code;
1056
    outbuf[1] = media_status;
1057

1058
    /* These fields are reserved, just clear them. */
1059
    outbuf[2] = 0;
1060
    outbuf[3] = 0;
1061
    return 4;
1062
}
1063

1064
static int scsi_get_event_status_notification(SCSIDiskState *s, SCSIDiskReq *r,
1065
                                              uint8_t *outbuf)
1066
{
1067
    int size;
1068
    uint8_t *buf = r->req.cmd.buf;
1069
    uint8_t notification_class_request = buf[4];
1070
    if (s->qdev.type != TYPE_ROM) {
1071
        return -1;
1072
    }
1073
    if ((buf[1] & 1) == 0) {
1074
        /* asynchronous */
1075
        return -1;
1076
    }
1077

1078
    size = 4;
1079
    outbuf[0] = outbuf[1] = 0;
1080
    outbuf[3] = 1 << GESN_MEDIA; /* supported events */
1081
    if (notification_class_request & (1 << GESN_MEDIA)) {
1082
        outbuf[2] = GESN_MEDIA;
1083
        size += scsi_event_status_media(s, &outbuf[size]);
1084
    } else {
1085
        outbuf[2] = 0x80;
1086
    }
1087
    stw_be_p(outbuf, size - 4);
1088
    return size;
1089
}
1090

1091
static int scsi_get_configuration(SCSIDiskState *s, uint8_t *outbuf)
1092
{
1093
    int current;
1094

1095
    if (s->qdev.type != TYPE_ROM) {
1096
        return -1;
1097
    }
1098

1099
    if (media_is_dvd(s)) {
1100
        current = MMC_PROFILE_DVD_ROM;
1101
    } else if (media_is_cd(s)) {
1102
        current = MMC_PROFILE_CD_ROM;
1103
    } else {
1104
        current = MMC_PROFILE_NONE;
1105
    }
1106

1107
    memset(outbuf, 0, 40);
1108
    stl_be_p(&outbuf[0], 36); /* Bytes after the data length field */
1109
    stw_be_p(&outbuf[6], current);
1110
    /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
1111
    outbuf[10] = 0x03; /* persistent, current */
1112
    outbuf[11] = 8; /* two profiles */
1113
    stw_be_p(&outbuf[12], MMC_PROFILE_DVD_ROM);
1114
    outbuf[14] = (current == MMC_PROFILE_DVD_ROM);
1115
    stw_be_p(&outbuf[16], MMC_PROFILE_CD_ROM);
1116
    outbuf[18] = (current == MMC_PROFILE_CD_ROM);
1117
    /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
1118
    stw_be_p(&outbuf[20], 1);
1119
    outbuf[22] = 0x08 | 0x03; /* version 2, persistent, current */
1120
    outbuf[23] = 8;
1121
    stl_be_p(&outbuf[24], 1); /* SCSI */
1122
    outbuf[28] = 1; /* DBE = 1, mandatory */
1123
    /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
1124
    stw_be_p(&outbuf[32], 3);
1125
    outbuf[34] = 0x08 | 0x03; /* version 2, persistent, current */
1126
    outbuf[35] = 4;
1127
    outbuf[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
1128
    /* TODO: Random readable, CD read, DVD read, drive serial number,
1129
       power management */
1130
    return 40;
1131
}
1132

1133
static int scsi_emulate_mechanism_status(SCSIDiskState *s, uint8_t *outbuf)
1134
{
1135
    if (s->qdev.type != TYPE_ROM) {
1136
        return -1;
1137
    }
1138
    memset(outbuf, 0, 8);
1139
    outbuf[5] = 1; /* CD-ROM */
1140
    return 8;
1141
}
1142

1143
static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
1144
                           int page_control)
1145
{
1146
    static const int mode_sense_valid[0x3f] = {
1147
        [MODE_PAGE_VENDOR_SPECIFIC]        = (1 << TYPE_DISK) | (1 << TYPE_ROM),
1148
        [MODE_PAGE_HD_GEOMETRY]            = (1 << TYPE_DISK),
1149
        [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY] = (1 << TYPE_DISK),
1150
        [MODE_PAGE_CACHING]                = (1 << TYPE_DISK) | (1 << TYPE_ROM),
1151
        [MODE_PAGE_R_W_ERROR]              = (1 << TYPE_DISK) | (1 << TYPE_ROM),
1152
        [MODE_PAGE_AUDIO_CTL]              = (1 << TYPE_ROM),
1153
        [MODE_PAGE_CAPABILITIES]           = (1 << TYPE_ROM),
1154
        [MODE_PAGE_APPLE_VENDOR]           = (1 << TYPE_ROM),
1155
    };
1156

1157
    uint8_t *p = *p_outbuf + 2;
1158
    int length;
1159

1160
    assert(page < ARRAY_SIZE(mode_sense_valid));
1161
    if ((mode_sense_valid[page] & (1 << s->qdev.type)) == 0) {
1162
        return -1;
1163
    }
1164

1165
    /*
1166
     * If Changeable Values are requested, a mask denoting those mode parameters
1167
     * that are changeable shall be returned. As we currently don't support
1168
     * parameter changes via MODE_SELECT all bits are returned set to zero.
1169
     * The buffer was already menset to zero by the caller of this function.
1170
     *
1171
     * The offsets here are off by two compared to the descriptions in the
1172
     * SCSI specs, because those include a 2-byte header.  This is unfortunate,
1173
     * but it is done so that offsets are consistent within our implementation
1174
     * of MODE SENSE and MODE SELECT.  MODE SELECT has to deal with both
1175
     * 2-byte and 4-byte headers.
1176
     */
1177
    switch (page) {
1178
    case MODE_PAGE_HD_GEOMETRY:
1179
        length = 0x16;
1180
        if (page_control == 1) { /* Changeable Values */
1181
            break;
1182
        }
1183
        /* if a geometry hint is available, use it */
1184
        p[0] = (s->qdev.conf.cyls >> 16) & 0xff;
1185
        p[1] = (s->qdev.conf.cyls >> 8) & 0xff;
1186
        p[2] = s->qdev.conf.cyls & 0xff;
1187
        p[3] = s->qdev.conf.heads & 0xff;
1188
        /* Write precomp start cylinder, disabled */
1189
        p[4] = (s->qdev.conf.cyls >> 16) & 0xff;
1190
        p[5] = (s->qdev.conf.cyls >> 8) & 0xff;
1191
        p[6] = s->qdev.conf.cyls & 0xff;
1192
        /* Reduced current start cylinder, disabled */
1193
        p[7] = (s->qdev.conf.cyls >> 16) & 0xff;
1194
        p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
1195
        p[9] = s->qdev.conf.cyls & 0xff;
1196
        /* Device step rate [ns], 200ns */
1197
        p[10] = 0;
1198
        p[11] = 200;
1199
        /* Landing zone cylinder */
1200
        p[12] = 0xff;
1201
        p[13] =  0xff;
1202
        p[14] = 0xff;
1203
        /* Medium rotation rate [rpm], 5400 rpm */
1204
        p[18] = (5400 >> 8) & 0xff;
1205
        p[19] = 5400 & 0xff;
1206
        break;
1207

1208
    case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY:
1209
        length = 0x1e;
1210
        if (page_control == 1) { /* Changeable Values */
1211
            break;
1212
        }
1213
        /* Transfer rate [kbit/s], 5Mbit/s */
1214
        p[0] = 5000 >> 8;
1215
        p[1] = 5000 & 0xff;
1216
        /* if a geometry hint is available, use it */
1217
        p[2] = s->qdev.conf.heads & 0xff;
1218
        p[3] = s->qdev.conf.secs & 0xff;
1219
        p[4] = s->qdev.blocksize >> 8;
1220
        p[6] = (s->qdev.conf.cyls >> 8) & 0xff;
1221
        p[7] = s->qdev.conf.cyls & 0xff;
1222
        /* Write precomp start cylinder, disabled */
1223
        p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
1224
        p[9] = s->qdev.conf.cyls & 0xff;
1225
        /* Reduced current start cylinder, disabled */
1226
        p[10] = (s->qdev.conf.cyls >> 8) & 0xff;
1227
        p[11] = s->qdev.conf.cyls & 0xff;
1228
        /* Device step rate [100us], 100us */
1229
        p[12] = 0;
1230
        p[13] = 1;
1231
        /* Device step pulse width [us], 1us */
1232
        p[14] = 1;
1233
        /* Device head settle delay [100us], 100us */
1234
        p[15] = 0;
1235
        p[16] = 1;
1236
        /* Motor on delay [0.1s], 0.1s */
1237
        p[17] = 1;
1238
        /* Motor off delay [0.1s], 0.1s */
1239
        p[18] = 1;
1240
        /* Medium rotation rate [rpm], 5400 rpm */
1241
        p[26] = (5400 >> 8) & 0xff;
1242
        p[27] = 5400 & 0xff;
1243
        break;
1244

1245
    case MODE_PAGE_CACHING:
1246
        length = 0x12;
1247
        if (page_control == 1 || /* Changeable Values */
1248
            blk_enable_write_cache(s->qdev.conf.blk)) {
1249
            p[0] = 4; /* WCE */
1250
        }
1251
        break;
1252

1253
    case MODE_PAGE_R_W_ERROR:
1254
        length = 10;
1255
        if (page_control == 1) { /* Changeable Values */
1256
            if (s->qdev.type == TYPE_ROM) {
1257
                /* Automatic Write Reallocation Enabled */
1258
                p[0] = 0x80;
1259
            }
1260
            break;
1261
        }
1262
        p[0] = 0x80; /* Automatic Write Reallocation Enabled */
1263
        if (s->qdev.type == TYPE_ROM) {
1264
            p[1] = 0x20; /* Read Retry Count */
1265
        }
1266
        break;
1267

1268
    case MODE_PAGE_AUDIO_CTL:
1269
        length = 14;
1270
        break;
1271

1272
    case MODE_PAGE_CAPABILITIES:
1273
        length = 0x14;
1274
        if (page_control == 1) { /* Changeable Values */
1275
            break;
1276
        }
1277

1278
        p[0] = 0x3b; /* CD-R & CD-RW read */
1279
        p[1] = 0; /* Writing not supported */
1280
        p[2] = 0x7f; /* Audio, composite, digital out,
1281
                        mode 2 form 1&2, multi session */
1282
        p[3] = 0xff; /* CD DA, DA accurate, RW supported,
1283
                        RW corrected, C2 errors, ISRC,
1284
                        UPC, Bar code */
1285
        p[4] = 0x2d | (s->tray_locked ? 2 : 0);
1286
        /* Locking supported, jumper present, eject, tray */
1287
        p[5] = 0; /* no volume & mute control, no
1288
                     changer */
1289
        p[6] = (50 * 176) >> 8; /* 50x read speed */
1290
        p[7] = (50 * 176) & 0xff;
1291
        p[8] = 2 >> 8; /* Two volume levels */
1292
        p[9] = 2 & 0xff;
1293
        p[10] = 2048 >> 8; /* 2M buffer */
1294
        p[11] = 2048 & 0xff;
1295
        p[12] = (16 * 176) >> 8; /* 16x read speed current */
1296
        p[13] = (16 * 176) & 0xff;
1297
        p[16] = (16 * 176) >> 8; /* 16x write speed */
1298
        p[17] = (16 * 176) & 0xff;
1299
        p[18] = (16 * 176) >> 8; /* 16x write speed current */
1300
        p[19] = (16 * 176) & 0xff;
1301
        break;
1302

1303
     case MODE_PAGE_APPLE_VENDOR:
1304
        if (s->quirks & (1 << SCSI_DISK_QUIRK_MODE_PAGE_APPLE_VENDOR)) {
1305
            length = 0x1e;
1306
            if (page_control == 1) { /* Changeable Values */
1307
                break;
1308
            }
1309

1310
            memset(p, 0, length);
1311
            strcpy((char *)p + 8, "APPLE COMPUTER, INC   ");
1312
            break;
1313
        } else {
1314
            return -1;
1315
        }
1316

1317
    case MODE_PAGE_VENDOR_SPECIFIC:
1318
        if (s->qdev.type == TYPE_DISK && (s->quirks &
1319
            (1 << SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE))) {
1320
            length = 0x2;
1321
            if (page_control == 1) { /* Changeable Values */
1322
                p[0] = 0xff;
1323
                p[1] = 0xff;
1324
                break;
1325
            }
1326
            p[0] = 0;
1327
            p[1] = 0;
1328
            break;
1329
        } else {
1330
            return -1;
1331
        }
1332

1333
    default:
1334
        return -1;
1335
    }
1336

1337
    assert(length < 256);
1338
    (*p_outbuf)[0] = page;
1339
    (*p_outbuf)[1] = length;
1340
    *p_outbuf += length + 2;
1341
    return length + 2;
1342
}
1343

1344
static int scsi_disk_emulate_mode_sense(SCSIDiskReq *r, uint8_t *outbuf)
1345
{
1346
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1347
    uint64_t nb_sectors;
1348
    bool dbd;
1349
    int page, buflen, ret, page_control;
1350
    uint8_t *p;
1351
    uint8_t dev_specific_param;
1352

1353
    dbd = (r->req.cmd.buf[1] & 0x8) != 0;
1354
    page = r->req.cmd.buf[2] & 0x3f;
1355
    page_control = (r->req.cmd.buf[2] & 0xc0) >> 6;
1356

1357
    trace_scsi_disk_emulate_mode_sense((r->req.cmd.buf[0] == MODE_SENSE) ? 6 :
1358
                                       10, page, r->req.cmd.xfer, page_control);
1359
    memset(outbuf, 0, r->req.cmd.xfer);
1360
    p = outbuf;
1361

1362
    if (s->qdev.type == TYPE_DISK) {
1363
        dev_specific_param = s->features & (1 << SCSI_DISK_F_DPOFUA) ? 0x10 : 0;
1364
        if (!blk_is_writable(s->qdev.conf.blk)) {
1365
            dev_specific_param |= 0x80; /* Readonly.  */
1366
        }
1367
    } else {
1368
        if (s->quirks & (1 << SCSI_DISK_QUIRK_MODE_SENSE_ROM_USE_DBD)) {
1369
            /* Use DBD from the request... */
1370
            dev_specific_param = 0x00;
1371

1372
            /*
1373
             * ... unless we receive a request for MODE_PAGE_APPLE_VENDOR
1374
             * which should never return a block descriptor even though DBD is
1375
             * not set, otherwise CDROM detection fails in MacOS
1376
             */
1377
            if (s->quirks & (1 << SCSI_DISK_QUIRK_MODE_PAGE_APPLE_VENDOR) &&
1378
                page == MODE_PAGE_APPLE_VENDOR) {
1379
                dbd = true;
1380
            }
1381
        } else {
1382
            /*
1383
             * MMC prescribes that CD/DVD drives have no block descriptors,
1384
             * and defines no device-specific parameter.
1385
             */
1386
            dev_specific_param = 0x00;
1387
            dbd = true;
1388
        }
1389
    }
1390

1391
    if (r->req.cmd.buf[0] == MODE_SENSE) {
1392
        p[1] = 0; /* Default media type.  */
1393
        p[2] = dev_specific_param;
1394
        p[3] = 0; /* Block descriptor length.  */
1395
        p += 4;
1396
    } else { /* MODE_SENSE_10 */
1397
        p[2] = 0; /* Default media type.  */
1398
        p[3] = dev_specific_param;
1399
        p[6] = p[7] = 0; /* Block descriptor length.  */
1400
        p += 8;
1401
    }
1402

1403
    blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
1404
    if (!dbd && nb_sectors) {
1405
        if (r->req.cmd.buf[0] == MODE_SENSE) {
1406
            outbuf[3] = 8; /* Block descriptor length  */
1407
        } else { /* MODE_SENSE_10 */
1408
            outbuf[7] = 8; /* Block descriptor length  */
1409
        }
1410
        nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1411
        if (nb_sectors > 0xffffff) {
1412
            nb_sectors = 0;
1413
        }
1414
        p[0] = 0; /* media density code */
1415
        p[1] = (nb_sectors >> 16) & 0xff;
1416
        p[2] = (nb_sectors >> 8) & 0xff;
1417
        p[3] = nb_sectors & 0xff;
1418
        p[4] = 0; /* reserved */
1419
        p[5] = 0; /* bytes 5-7 are the sector size in bytes */
1420
        p[6] = s->qdev.blocksize >> 8;
1421
        p[7] = 0;
1422
        p += 8;
1423
    }
1424

1425
    if (page_control == 3) {
1426
        /* Saved Values */
1427
        scsi_check_condition(r, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED));
1428
        return -1;
1429
    }
1430

1431
    if (page == 0x3f) {
1432
        for (page = 0; page <= 0x3e; page++) {
1433
            mode_sense_page(s, page, &p, page_control);
1434
        }
1435
    } else {
1436
        ret = mode_sense_page(s, page, &p, page_control);
1437
        if (ret == -1) {
1438
            return -1;
1439
        }
1440
    }
1441

1442
    buflen = p - outbuf;
1443
    /*
1444
     * The mode data length field specifies the length in bytes of the
1445
     * following data that is available to be transferred. The mode data
1446
     * length does not include itself.
1447
     */
1448
    if (r->req.cmd.buf[0] == MODE_SENSE) {
1449
        outbuf[0] = buflen - 1;
1450
    } else { /* MODE_SENSE_10 */
1451
        outbuf[0] = ((buflen - 2) >> 8) & 0xff;
1452
        outbuf[1] = (buflen - 2) & 0xff;
1453
    }
1454
    return buflen;
1455
}
1456

1457
static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)
1458
{
1459
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1460
    int start_track, format, msf, toclen;
1461
    uint64_t nb_sectors;
1462

1463
    msf = req->cmd.buf[1] & 2;
1464
    format = req->cmd.buf[2] & 0xf;
1465
    start_track = req->cmd.buf[6];
1466
    blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
1467
    trace_scsi_disk_emulate_read_toc(start_track, format, msf >> 1);
1468
    nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
1469
    switch (format) {
1470
    case 0:
1471
        toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
1472
        break;
1473
    case 1:
1474
        /* multi session : only a single session defined */
1475
        toclen = 12;
1476
        memset(outbuf, 0, 12);
1477
        outbuf[1] = 0x0a;
1478
        outbuf[2] = 0x01;
1479
        outbuf[3] = 0x01;
1480
        break;
1481
    case 2:
1482
        toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
1483
        break;
1484
    default:
1485
        return -1;
1486
    }
1487
    return toclen;
1488
}
1489

1490
static int scsi_disk_emulate_start_stop(SCSIDiskReq *r)
1491
{
1492
    SCSIRequest *req = &r->req;
1493
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1494
    bool start = req->cmd.buf[4] & 1;
1495
    bool loej = req->cmd.buf[4] & 2; /* load on start, eject on !start */
1496
    int pwrcnd = req->cmd.buf[4] & 0xf0;
1497

1498
    if (pwrcnd) {
1499
        /* eject/load only happens for power condition == 0 */
1500
        return 0;
1501
    }
1502

1503
    if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) && loej) {
1504
        if (!start && !s->tray_open && s->tray_locked) {
1505
            scsi_check_condition(r,
1506
                                 blk_is_inserted(s->qdev.conf.blk)
1507
                                 ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED)
1508
                                 : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED));
1509
            return -1;
1510
        }
1511

1512
        if (s->tray_open != !start) {
1513
            blk_eject(s->qdev.conf.blk, !start);
1514
            s->tray_open = !start;
1515
        }
1516
    }
1517
    return 0;
1518
}
1519

1520
static void scsi_disk_emulate_read_data(SCSIRequest *req)
1521
{
1522
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1523
    int buflen = r->iov.iov_len;
1524

1525
    if (buflen) {
1526
        trace_scsi_disk_emulate_read_data(buflen);
1527
        r->iov.iov_len = 0;
1528
        r->started = true;
1529
        scsi_req_data(&r->req, buflen);
1530
        return;
1531
    }
1532

1533
    /* This also clears the sense buffer for REQUEST SENSE.  */
1534
    scsi_req_complete(&r->req, GOOD);
1535
}
1536

1537
static int scsi_disk_check_mode_select(SCSIDiskState *s, int page,
1538
                                       uint8_t *inbuf, int inlen)
1539
{
1540
    uint8_t mode_current[SCSI_MAX_MODE_LEN];
1541
    uint8_t mode_changeable[SCSI_MAX_MODE_LEN];
1542
    uint8_t *p;
1543
    int len, expected_len, changeable_len, i;
1544

1545
    /* The input buffer does not include the page header, so it is
1546
     * off by 2 bytes.
1547
     */
1548
    expected_len = inlen + 2;
1549
    if (expected_len > SCSI_MAX_MODE_LEN) {
1550
        return -1;
1551
    }
1552

1553
    /* MODE_PAGE_ALLS is only valid for MODE SENSE commands */
1554
    if (page == MODE_PAGE_ALLS) {
1555
        return -1;
1556
    }
1557

1558
    p = mode_current;
1559
    memset(mode_current, 0, inlen + 2);
1560
    len = mode_sense_page(s, page, &p, 0);
1561
    if (len < 0 || len != expected_len) {
1562
        return -1;
1563
    }
1564

1565
    p = mode_changeable;
1566
    memset(mode_changeable, 0, inlen + 2);
1567
    changeable_len = mode_sense_page(s, page, &p, 1);
1568
    assert(changeable_len == len);
1569

1570
    /* Check that unchangeable bits are the same as what MODE SENSE
1571
     * would return.
1572
     */
1573
    for (i = 2; i < len; i++) {
1574
        if (((mode_current[i] ^ inbuf[i - 2]) & ~mode_changeable[i]) != 0) {
1575
            return -1;
1576
        }
1577
    }
1578
    return 0;
1579
}
1580

1581
static void scsi_disk_apply_mode_select(SCSIDiskState *s, int page, uint8_t *p)
1582
{
1583
    switch (page) {
1584
    case MODE_PAGE_CACHING:
1585
        blk_set_enable_write_cache(s->qdev.conf.blk, (p[0] & 4) != 0);
1586
        break;
1587

1588
    default:
1589
        break;
1590
    }
1591
}
1592

1593
static int mode_select_pages(SCSIDiskReq *r, uint8_t *p, int len, bool change)
1594
{
1595
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1596

1597
    while (len > 0) {
1598
        int page, subpage, page_len;
1599

1600
        /* Parse both possible formats for the mode page headers.  */
1601
        page = p[0] & 0x3f;
1602
        if (p[0] & 0x40) {
1603
            if (len < 4) {
1604
                goto invalid_param_len;
1605
            }
1606
            subpage = p[1];
1607
            page_len = lduw_be_p(&p[2]);
1608
            p += 4;
1609
            len -= 4;
1610
        } else {
1611
            if (len < 2) {
1612
                goto invalid_param_len;
1613
            }
1614
            subpage = 0;
1615
            page_len = p[1];
1616
            p += 2;
1617
            len -= 2;
1618
        }
1619

1620
        if (subpage) {
1621
            goto invalid_param;
1622
        }
1623
        if (page_len > len) {
1624
            if (!(s->quirks & SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED)) {
1625
                goto invalid_param_len;
1626
            }
1627
            trace_scsi_disk_mode_select_page_truncated(page, page_len, len);
1628
        }
1629

1630
        if (!change) {
1631
            if (scsi_disk_check_mode_select(s, page, p, page_len) < 0) {
1632
                goto invalid_param;
1633
            }
1634
        } else {
1635
            scsi_disk_apply_mode_select(s, page, p);
1636
        }
1637

1638
        p += page_len;
1639
        len -= page_len;
1640
    }
1641
    return 0;
1642

1643
invalid_param:
1644
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1645
    return -1;
1646

1647
invalid_param_len:
1648
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1649
    return -1;
1650
}
1651

1652
static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf)
1653
{
1654
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1655
    uint8_t *p = inbuf;
1656
    int cmd = r->req.cmd.buf[0];
1657
    int len = r->req.cmd.xfer;
1658
    int hdr_len = (cmd == MODE_SELECT ? 4 : 8);
1659
    int bd_len, bs;
1660
    int pass;
1661

1662
    if ((r->req.cmd.buf[1] & 0x11) != 0x10) {
1663
        if (!(s->quirks &
1664
            (1 << SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE))) {
1665
            /* We only support PF=1, SP=0.  */
1666
            goto invalid_field;
1667
        }
1668
    }
1669

1670
    if (len < hdr_len) {
1671
        goto invalid_param_len;
1672
    }
1673

1674
    bd_len = (cmd == MODE_SELECT ? p[3] : lduw_be_p(&p[6]));
1675
    len -= hdr_len;
1676
    p += hdr_len;
1677
    if (len < bd_len) {
1678
        goto invalid_param_len;
1679
    }
1680
    if (bd_len != 0 && bd_len != 8) {
1681
        goto invalid_param;
1682
    }
1683

1684
    /* Allow changing the block size */
1685
    if (bd_len) {
1686
        bs = p[5] << 16 | p[6] << 8 | p[7];
1687

1688
        /*
1689
         * Since the existing code only checks/updates bits 8-15 of the block
1690
         * size, restrict ourselves to the same requirement for now to ensure
1691
         * that a block size set by a block descriptor and then read back by
1692
         * a subsequent SCSI command will be the same. Also disallow a block
1693
         * size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE.
1694
         */
1695
        if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) {
1696
            s->qdev.blocksize = bs;
1697
            trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize);
1698
        }
1699
    }
1700

1701
    len -= bd_len;
1702
    p += bd_len;
1703

1704
    /* Ensure no change is made if there is an error!  */
1705
    for (pass = 0; pass < 2; pass++) {
1706
        if (mode_select_pages(r, p, len, pass == 1) < 0) {
1707
            assert(pass == 0);
1708
            return;
1709
        }
1710
    }
1711
    if (!blk_enable_write_cache(s->qdev.conf.blk)) {
1712
        /* The request is used as the AIO opaque value, so add a ref.  */
1713
        scsi_req_ref(&r->req);
1714
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
1715
                         BLOCK_ACCT_FLUSH);
1716
        r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
1717
        return;
1718
    }
1719

1720
    scsi_req_complete(&r->req, GOOD);
1721
    return;
1722

1723
invalid_param:
1724
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1725
    return;
1726

1727
invalid_param_len:
1728
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1729
    return;
1730

1731
invalid_field:
1732
    scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1733
}
1734

1735
/* sector_num and nb_sectors expected to be in qdev blocksize */
1736
static inline bool check_lba_range(SCSIDiskState *s,
1737
                                   uint64_t sector_num, uint32_t nb_sectors)
1738
{
1739
    /*
1740
     * The first line tests that no overflow happens when computing the last
1741
     * sector.  The second line tests that the last accessed sector is in
1742
     * range.
1743
     *
1744
     * Careful, the computations should not underflow for nb_sectors == 0,
1745
     * and a 0-block read to the first LBA beyond the end of device is
1746
     * valid.
1747
     */
1748
    return (sector_num <= sector_num + nb_sectors &&
1749
            sector_num + nb_sectors <= s->qdev.max_lba + 1);
1750
}
1751

1752
typedef struct UnmapCBData {
1753
    SCSIDiskReq *r;
1754
    uint8_t *inbuf;
1755
    int count;
1756
} UnmapCBData;
1757

1758
static void scsi_unmap_complete(void *opaque, int ret);
1759

1760
static void scsi_unmap_complete_noio(UnmapCBData *data, int ret)
1761
{
1762
    SCSIDiskReq *r = data->r;
1763
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1764

1765
    assert(r->req.aiocb == NULL);
1766

1767
    if (data->count > 0) {
1768
        uint64_t sector_num = ldq_be_p(&data->inbuf[0]);
1769
        uint32_t nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
1770
        r->sector = sector_num * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1771
        r->sector_count = nb_sectors * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1772

1773
        if (!check_lba_range(s, sector_num, nb_sectors)) {
1774
            block_acct_invalid(blk_get_stats(s->qdev.conf.blk),
1775
                               BLOCK_ACCT_UNMAP);
1776
            scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1777
            goto done;
1778
        }
1779

1780
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1781
                         r->sector_count * BDRV_SECTOR_SIZE,
1782
                         BLOCK_ACCT_UNMAP);
1783

1784
        r->req.aiocb = blk_aio_pdiscard(s->qdev.conf.blk,
1785
                                        r->sector * BDRV_SECTOR_SIZE,
1786
                                        r->sector_count * BDRV_SECTOR_SIZE,
1787
                                        scsi_unmap_complete, data);
1788
        data->count--;
1789
        data->inbuf += 16;
1790
        return;
1791
    }
1792

1793
    scsi_req_complete(&r->req, GOOD);
1794

1795
done:
1796
    scsi_req_unref(&r->req);
1797
    g_free(data);
1798
}
1799

1800
static void scsi_unmap_complete(void *opaque, int ret)
1801
{
1802
    UnmapCBData *data = opaque;
1803
    SCSIDiskReq *r = data->r;
1804
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1805

1806
    assert(r->req.aiocb != NULL);
1807
    r->req.aiocb = NULL;
1808

1809
    if (scsi_disk_req_check_error(r, ret, true)) {
1810
        scsi_req_unref(&r->req);
1811
        g_free(data);
1812
    } else {
1813
        block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
1814
        scsi_unmap_complete_noio(data, ret);
1815
    }
1816
}
1817

1818
static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf)
1819
{
1820
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1821
    uint8_t *p = inbuf;
1822
    int len = r->req.cmd.xfer;
1823
    UnmapCBData *data;
1824

1825
    /* Reject ANCHOR=1.  */
1826
    if (r->req.cmd.buf[1] & 0x1) {
1827
        goto invalid_field;
1828
    }
1829

1830
    if (len < 8) {
1831
        goto invalid_param_len;
1832
    }
1833
    if (len < lduw_be_p(&p[0]) + 2) {
1834
        goto invalid_param_len;
1835
    }
1836
    if (len < lduw_be_p(&p[2]) + 8) {
1837
        goto invalid_param_len;
1838
    }
1839
    if (lduw_be_p(&p[2]) & 15) {
1840
        goto invalid_param_len;
1841
    }
1842

1843
    if (!blk_is_writable(s->qdev.conf.blk)) {
1844
        block_acct_invalid(blk_get_stats(s->qdev.conf.blk), BLOCK_ACCT_UNMAP);
1845
        scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1846
        return;
1847
    }
1848

1849
    data = g_new0(UnmapCBData, 1);
1850
    data->r = r;
1851
    data->inbuf = &p[8];
1852
    data->count = lduw_be_p(&p[2]) >> 4;
1853

1854
    /* The matching unref is in scsi_unmap_complete, before data is freed.  */
1855
    scsi_req_ref(&r->req);
1856
    scsi_unmap_complete_noio(data, 0);
1857
    return;
1858

1859
invalid_param_len:
1860
    block_acct_invalid(blk_get_stats(s->qdev.conf.blk), BLOCK_ACCT_UNMAP);
1861
    scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1862
    return;
1863

1864
invalid_field:
1865
    block_acct_invalid(blk_get_stats(s->qdev.conf.blk), BLOCK_ACCT_UNMAP);
1866
    scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1867
}
1868

1869
typedef struct WriteSameCBData {
1870
    SCSIDiskReq *r;
1871
    int64_t sector;
1872
    int nb_sectors;
1873
    QEMUIOVector qiov;
1874
    struct iovec iov;
1875
} WriteSameCBData;
1876

1877
static void scsi_write_same_complete(void *opaque, int ret)
1878
{
1879
    WriteSameCBData *data = opaque;
1880
    SCSIDiskReq *r = data->r;
1881
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1882

1883
    assert(r->req.aiocb != NULL);
1884
    r->req.aiocb = NULL;
1885

1886
    if (scsi_disk_req_check_error(r, ret, true)) {
1887
        goto done;
1888
    }
1889

1890
    block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
1891

1892
    data->nb_sectors -= data->iov.iov_len / BDRV_SECTOR_SIZE;
1893
    data->sector += data->iov.iov_len / BDRV_SECTOR_SIZE;
1894
    data->iov.iov_len = MIN(data->nb_sectors * BDRV_SECTOR_SIZE,
1895
                            data->iov.iov_len);
1896
    if (data->iov.iov_len) {
1897
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1898
                         data->iov.iov_len, BLOCK_ACCT_WRITE);
1899
        /* Reinitialize qiov, to handle unaligned WRITE SAME request
1900
         * where final qiov may need smaller size */
1901
        qemu_iovec_init_external(&data->qiov, &data->iov, 1);
1902
        r->req.aiocb = blk_aio_pwritev(s->qdev.conf.blk,
1903
                                       data->sector << BDRV_SECTOR_BITS,
1904
                                       &data->qiov, 0,
1905
                                       scsi_write_same_complete, data);
1906
        return;
1907
    }
1908

1909
    scsi_req_complete(&r->req, GOOD);
1910

1911
done:
1912
    scsi_req_unref(&r->req);
1913
    qemu_vfree(data->iov.iov_base);
1914
    g_free(data);
1915
}
1916

1917
static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf)
1918
{
1919
    SCSIRequest *req = &r->req;
1920
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1921
    uint32_t nb_sectors = scsi_data_cdb_xfer(r->req.cmd.buf);
1922
    WriteSameCBData *data;
1923
    uint8_t *buf;
1924
    int i, l;
1925

1926
    /* Fail if PBDATA=1 or LBDATA=1 or ANCHOR=1.  */
1927
    if (nb_sectors == 0 || (req->cmd.buf[1] & 0x16)) {
1928
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1929
        return;
1930
    }
1931

1932
    if (!blk_is_writable(s->qdev.conf.blk)) {
1933
        scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1934
        return;
1935
    }
1936
    if (!check_lba_range(s, r->req.cmd.lba, nb_sectors)) {
1937
        scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1938
        return;
1939
    }
1940

1941
    if ((req->cmd.buf[1] & 0x1) || buffer_is_zero(inbuf, s->qdev.blocksize)) {
1942
        int flags = (req->cmd.buf[1] & 0x8) ? BDRV_REQ_MAY_UNMAP : 0;
1943

1944
        /* The request is used as the AIO opaque value, so add a ref.  */
1945
        scsi_req_ref(&r->req);
1946
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1947
                         nb_sectors * s->qdev.blocksize,
1948
                        BLOCK_ACCT_WRITE);
1949
        r->req.aiocb = blk_aio_pwrite_zeroes(s->qdev.conf.blk,
1950
                                r->req.cmd.lba * s->qdev.blocksize,
1951
                                nb_sectors * s->qdev.blocksize,
1952
                                flags, scsi_aio_complete, r);
1953
        return;
1954
    }
1955

1956
    data = g_new0(WriteSameCBData, 1);
1957
    data->r = r;
1958
    data->sector = r->req.cmd.lba * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1959
    data->nb_sectors = nb_sectors * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1960
    data->iov.iov_len = MIN(data->nb_sectors * BDRV_SECTOR_SIZE,
1961
                            SCSI_WRITE_SAME_MAX);
1962
    data->iov.iov_base = buf = blk_blockalign(s->qdev.conf.blk,
1963
                                              data->iov.iov_len);
1964
    qemu_iovec_init_external(&data->qiov, &data->iov, 1);
1965

1966
    for (i = 0; i < data->iov.iov_len; i += l) {
1967
        l = MIN(s->qdev.blocksize, data->iov.iov_len - i);
1968
        memcpy(&buf[i], inbuf, l);
1969
    }
1970

1971
    scsi_req_ref(&r->req);
1972
    block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1973
                     data->iov.iov_len, BLOCK_ACCT_WRITE);
1974
    r->req.aiocb = blk_aio_pwritev(s->qdev.conf.blk,
1975
                                   data->sector << BDRV_SECTOR_BITS,
1976
                                   &data->qiov, 0,
1977
                                   scsi_write_same_complete, data);
1978
}
1979

1980
static void scsi_disk_emulate_write_data(SCSIRequest *req)
1981
{
1982
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1983

1984
    if (r->iov.iov_len) {
1985
        int buflen = r->iov.iov_len;
1986
        trace_scsi_disk_emulate_write_data(buflen);
1987
        r->iov.iov_len = 0;
1988
        scsi_req_data(&r->req, buflen);
1989
        return;
1990
    }
1991

1992
    switch (req->cmd.buf[0]) {
1993
    case MODE_SELECT:
1994
    case MODE_SELECT_10:
1995
        /* This also clears the sense buffer for REQUEST SENSE.  */
1996
        scsi_disk_emulate_mode_select(r, r->iov.iov_base);
1997
        break;
1998

1999
    case UNMAP:
2000
        scsi_disk_emulate_unmap(r, r->iov.iov_base);
2001
        break;
2002

2003
    case VERIFY_10:
2004
    case VERIFY_12:
2005
    case VERIFY_16:
2006
        if (r->req.status == -1) {
2007
            scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
2008
        }
2009
        break;
2010

2011
    case WRITE_SAME_10:
2012
    case WRITE_SAME_16:
2013
        scsi_disk_emulate_write_same(r, r->iov.iov_base);
2014
        break;
2015

2016
    case FORMAT_UNIT:
2017
        scsi_req_complete(&r->req, GOOD);
2018
        break;
2019

2020
    default:
2021
        abort();
2022
    }
2023
}
2024

2025
static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf)
2026
{
2027
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
2028
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
2029
    uint64_t nb_sectors;
2030
    uint8_t *outbuf;
2031
    int buflen;
2032

2033
    switch (req->cmd.buf[0]) {
2034
    case INQUIRY:
2035
    case MODE_SENSE:
2036
    case MODE_SENSE_10:
2037
    case RESERVE:
2038
    case RESERVE_10:
2039
    case RELEASE:
2040
    case RELEASE_10:
2041
    case START_STOP:
2042
    case ALLOW_MEDIUM_REMOVAL:
2043
    case GET_CONFIGURATION:
2044
    case GET_EVENT_STATUS_NOTIFICATION:
2045
    case MECHANISM_STATUS:
2046
    case REQUEST_SENSE:
2047
        break;
2048

2049
    default:
2050
        if (!blk_is_available(s->qdev.conf.blk)) {
2051
            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
2052
            return 0;
2053
        }
2054
        break;
2055
    }
2056

2057
    /*
2058
     * FIXME: we shouldn't return anything bigger than 4k, but the code
2059
     * requires the buffer to be as big as req->cmd.xfer in several
2060
     * places.  So, do not allow CDBs with a very large ALLOCATION
2061
     * LENGTH.  The real fix would be to modify scsi_read_data and
2062
     * dma_buf_read, so that they return data beyond the buflen
2063
     * as all zeros.
2064
     */
2065
    if (req->cmd.xfer > 65536) {
2066
        goto illegal_request;
2067
    }
2068
    r->buflen = MAX(4096, req->cmd.xfer);
2069

2070
    if (!r->iov.iov_base) {
2071
        r->iov.iov_base = blk_blockalign(s->qdev.conf.blk, r->buflen);
2072
    }
2073

2074
    outbuf = r->iov.iov_base;
2075
    memset(outbuf, 0, r->buflen);
2076
    switch (req->cmd.buf[0]) {
2077
    case TEST_UNIT_READY:
2078
        assert(blk_is_available(s->qdev.conf.blk));
2079
        break;
2080
    case INQUIRY:
2081
        buflen = scsi_disk_emulate_inquiry(req, outbuf);
2082
        if (buflen < 0) {
2083
            goto illegal_request;
2084
        }
2085
        break;
2086
    case MODE_SENSE:
2087
    case MODE_SENSE_10:
2088
        buflen = scsi_disk_emulate_mode_sense(r, outbuf);
2089
        if (buflen < 0) {
2090
            goto illegal_request;
2091
        }
2092
        break;
2093
    case READ_TOC:
2094
        buflen = scsi_disk_emulate_read_toc(req, outbuf);
2095
        if (buflen < 0) {
2096
            goto illegal_request;
2097
        }
2098
        break;
2099
    case RESERVE:
2100
        if (req->cmd.buf[1] & 1) {
2101
            goto illegal_request;
2102
        }
2103
        break;
2104
    case RESERVE_10:
2105
        if (req->cmd.buf[1] & 3) {
2106
            goto illegal_request;
2107
        }
2108
        break;
2109
    case RELEASE:
2110
        if (req->cmd.buf[1] & 1) {
2111
            goto illegal_request;
2112
        }
2113
        break;
2114
    case RELEASE_10:
2115
        if (req->cmd.buf[1] & 3) {
2116
            goto illegal_request;
2117
        }
2118
        break;
2119
    case START_STOP:
2120
        if (scsi_disk_emulate_start_stop(r) < 0) {
2121
            return 0;
2122
        }
2123
        break;
2124
    case ALLOW_MEDIUM_REMOVAL:
2125
        s->tray_locked = req->cmd.buf[4] & 1;
2126
        blk_lock_medium(s->qdev.conf.blk, req->cmd.buf[4] & 1);
2127
        break;
2128
    case READ_CAPACITY_10:
2129
        /* The normal LEN field for this command is zero.  */
2130
        memset(outbuf, 0, 8);
2131
        blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
2132
        if (!nb_sectors) {
2133
            scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
2134
            return 0;
2135
        }
2136
        if ((req->cmd.buf[8] & 1) == 0 && req->cmd.lba) {
2137
            goto illegal_request;
2138
        }
2139
        nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
2140
        /* Returned value is the address of the last sector.  */
2141
        nb_sectors--;
2142
        /* Remember the new size for read/write sanity checking. */
2143
        s->qdev.max_lba = nb_sectors;
2144
        /* Clip to 2TB, instead of returning capacity modulo 2TB. */
2145
        if (nb_sectors > UINT32_MAX) {
2146
            nb_sectors = UINT32_MAX;
2147
        }
2148
        outbuf[0] = (nb_sectors >> 24) & 0xff;
2149
        outbuf[1] = (nb_sectors >> 16) & 0xff;
2150
        outbuf[2] = (nb_sectors >> 8) & 0xff;
2151
        outbuf[3] = nb_sectors & 0xff;
2152
        outbuf[4] = 0;
2153
        outbuf[5] = 0;
2154
        outbuf[6] = s->qdev.blocksize >> 8;
2155
        outbuf[7] = 0;
2156
        break;
2157
    case REQUEST_SENSE:
2158
        /* Just return "NO SENSE".  */
2159
        buflen = scsi_convert_sense(NULL, 0, outbuf, r->buflen,
2160
                                    (req->cmd.buf[1] & 1) == 0);
2161
        if (buflen < 0) {
2162
            goto illegal_request;
2163
        }
2164
        break;
2165
    case MECHANISM_STATUS:
2166
        buflen = scsi_emulate_mechanism_status(s, outbuf);
2167
        if (buflen < 0) {
2168
            goto illegal_request;
2169
        }
2170
        break;
2171
    case GET_CONFIGURATION:
2172
        buflen = scsi_get_configuration(s, outbuf);
2173
        if (buflen < 0) {
2174
            goto illegal_request;
2175
        }
2176
        break;
2177
    case GET_EVENT_STATUS_NOTIFICATION:
2178
        buflen = scsi_get_event_status_notification(s, r, outbuf);
2179
        if (buflen < 0) {
2180
            goto illegal_request;
2181
        }
2182
        break;
2183
    case READ_DISC_INFORMATION:
2184
        buflen = scsi_read_disc_information(s, r, outbuf);
2185
        if (buflen < 0) {
2186
            goto illegal_request;
2187
        }
2188
        break;
2189
    case READ_DVD_STRUCTURE:
2190
        buflen = scsi_read_dvd_structure(s, r, outbuf);
2191
        if (buflen < 0) {
2192
            goto illegal_request;
2193
        }
2194
        break;
2195
    case SERVICE_ACTION_IN_16:
2196
        /* Service Action In subcommands. */
2197
        if ((req->cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) {
2198
            trace_scsi_disk_emulate_command_SAI_16();
2199
            memset(outbuf, 0, req->cmd.xfer);
2200
            blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
2201
            if (!nb_sectors) {
2202
                scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
2203
                return 0;
2204
            }
2205
            if ((req->cmd.buf[14] & 1) == 0 && req->cmd.lba) {
2206
                goto illegal_request;
2207
            }
2208
            nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
2209
            /* Returned value is the address of the last sector.  */
2210
            nb_sectors--;
2211
            /* Remember the new size for read/write sanity checking. */
2212
            s->qdev.max_lba = nb_sectors;
2213
            outbuf[0] = (nb_sectors >> 56) & 0xff;
2214
            outbuf[1] = (nb_sectors >> 48) & 0xff;
2215
            outbuf[2] = (nb_sectors >> 40) & 0xff;
2216
            outbuf[3] = (nb_sectors >> 32) & 0xff;
2217
            outbuf[4] = (nb_sectors >> 24) & 0xff;
2218
            outbuf[5] = (nb_sectors >> 16) & 0xff;
2219
            outbuf[6] = (nb_sectors >> 8) & 0xff;
2220
            outbuf[7] = nb_sectors & 0xff;
2221
            outbuf[8] = 0;
2222
            outbuf[9] = 0;
2223
            outbuf[10] = s->qdev.blocksize >> 8;
2224
            outbuf[11] = 0;
2225
            outbuf[12] = 0;
2226
            outbuf[13] = get_physical_block_exp(&s->qdev.conf);
2227

2228
            /* set TPE bit if the format supports discard */
2229
            if (s->qdev.conf.discard_granularity) {
2230
                outbuf[14] = 0x80;
2231
            }
2232

2233
            /* Protection, exponent and lowest lba field left blank. */
2234
            break;
2235
        }
2236
        trace_scsi_disk_emulate_command_SAI_unsupported();
2237
        goto illegal_request;
2238
    case SYNCHRONIZE_CACHE:
2239
        /* The request is used as the AIO opaque value, so add a ref.  */
2240
        scsi_req_ref(&r->req);
2241
        block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
2242
                         BLOCK_ACCT_FLUSH);
2243
        r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
2244
        return 0;
2245
    case SEEK_10:
2246
        trace_scsi_disk_emulate_command_SEEK_10(r->req.cmd.lba);
2247
        if (r->req.cmd.lba > s->qdev.max_lba) {
2248
            goto illegal_lba;
2249
        }
2250
        break;
2251
    case MODE_SELECT:
2252
        trace_scsi_disk_emulate_command_MODE_SELECT(r->req.cmd.xfer);
2253
        break;
2254
    case MODE_SELECT_10:
2255
        trace_scsi_disk_emulate_command_MODE_SELECT_10(r->req.cmd.xfer);
2256
        break;
2257
    case UNMAP:
2258
        trace_scsi_disk_emulate_command_UNMAP(r->req.cmd.xfer);
2259
        break;
2260
    case VERIFY_10:
2261
    case VERIFY_12:
2262
    case VERIFY_16:
2263
        trace_scsi_disk_emulate_command_VERIFY((req->cmd.buf[1] >> 1) & 3);
2264
        if (req->cmd.buf[1] & 6) {
2265
            goto illegal_request;
2266
        }
2267
        break;
2268
    case WRITE_SAME_10:
2269
    case WRITE_SAME_16:
2270
        trace_scsi_disk_emulate_command_WRITE_SAME(
2271
                req->cmd.buf[0] == WRITE_SAME_10 ? 10 : 16, r->req.cmd.xfer);
2272
        break;
2273
    case FORMAT_UNIT:
2274
        trace_scsi_disk_emulate_command_FORMAT_UNIT(r->req.cmd.xfer);
2275
        break;
2276
    default:
2277
        trace_scsi_disk_emulate_command_UNKNOWN(buf[0],
2278
                                                scsi_command_name(buf[0]));
2279
        scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE));
2280
        return 0;
2281
    }
2282
    assert(!r->req.aiocb);
2283
    r->iov.iov_len = MIN(r->buflen, req->cmd.xfer);
2284
    if (r->iov.iov_len == 0) {
2285
        scsi_req_complete(&r->req, GOOD);
2286
    }
2287
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
2288
        assert(r->iov.iov_len == req->cmd.xfer);
2289
        return -r->iov.iov_len;
2290
    } else {
2291
        return r->iov.iov_len;
2292
    }
2293

2294
illegal_request:
2295
    if (r->req.status == -1) {
2296
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
2297
    }
2298
    return 0;
2299

2300
illegal_lba:
2301
    scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
2302
    return 0;
2303
}
2304

2305
/* Execute a scsi command.  Returns the length of the data expected by the
2306
   command.  This will be Positive for data transfers from the device
2307
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
2308
   and zero if the command does not transfer any data.  */
2309

2310
static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
2311
{
2312
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
2313
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
2314
    SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
2315
    uint32_t len;
2316
    uint8_t command;
2317

2318
    command = buf[0];
2319

2320
    if (!blk_is_available(s->qdev.conf.blk)) {
2321
        scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
2322
        return 0;
2323
    }
2324

2325
    len = scsi_data_cdb_xfer(r->req.cmd.buf);
2326
    switch (command) {
2327
    case READ_6:
2328
    case READ_10:
2329
    case READ_12:
2330
    case READ_16:
2331
        trace_scsi_disk_dma_command_READ(r->req.cmd.lba, len);
2332
        /* Protection information is not supported.  For SCSI versions 2 and
2333
         * older (as determined by snooping the guest's INQUIRY commands),
2334
         * there is no RD/WR/VRPROTECT, so skip this check in these versions.
2335
         */
2336
        if (s->qdev.scsi_version > 2 && (r->req.cmd.buf[1] & 0xe0)) {
2337
            goto illegal_request;
2338
        }
2339
        if (!check_lba_range(s, r->req.cmd.lba, len)) {
2340
            goto illegal_lba;
2341
        }
2342
        r->sector = r->req.cmd.lba * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
2343
        r->sector_count = len * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
2344
        break;
2345
    case WRITE_6:
2346
    case WRITE_10:
2347
    case WRITE_12:
2348
    case WRITE_16:
2349
    case WRITE_VERIFY_10:
2350
    case WRITE_VERIFY_12:
2351
    case WRITE_VERIFY_16:
2352
        if (!blk_is_writable(s->qdev.conf.blk)) {
2353
            scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
2354
            return 0;
2355
        }
2356
        trace_scsi_disk_dma_command_WRITE(
2357
                (command & 0xe) == 0xe ? "And Verify " : "",
2358
                r->req.cmd.lba, len);
2359
        /* fall through */
2360
    case VERIFY_10:
2361
    case VERIFY_12:
2362
    case VERIFY_16:
2363
        /* We get here only for BYTCHK == 0x01 and only for scsi-block.
2364
         * As far as DMA is concerned, we can treat it the same as a write;
2365
         * scsi_block_do_sgio will send VERIFY commands.
2366
         */
2367
        if (s->qdev.scsi_version > 2 && (r->req.cmd.buf[1] & 0xe0)) {
2368
            goto illegal_request;
2369
        }
2370
        if (!check_lba_range(s, r->req.cmd.lba, len)) {
2371
            goto illegal_lba;
2372
        }
2373
        r->sector = r->req.cmd.lba * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
2374
        r->sector_count = len * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
2375
        break;
2376
    default:
2377
        abort();
2378
    illegal_request:
2379
        scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
2380
        return 0;
2381
    illegal_lba:
2382
        scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
2383
        return 0;
2384
    }
2385
    r->need_fua_emulation = sdc->need_fua_emulation(&r->req.cmd);
2386
    if (r->sector_count == 0) {
2387
        scsi_req_complete(&r->req, GOOD);
2388
    }
2389
    assert(r->iov.iov_len == 0);
2390
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
2391
        return -r->sector_count * BDRV_SECTOR_SIZE;
2392
    } else {
2393
        return r->sector_count * BDRV_SECTOR_SIZE;
2394
    }
2395
}
2396

2397
static void scsi_disk_reset(DeviceState *dev)
2398
{
2399
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev.qdev, dev);
2400
    uint64_t nb_sectors;
2401

2402
    scsi_device_purge_requests(&s->qdev, SENSE_CODE(RESET));
2403

2404
    blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
2405

2406
    nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
2407
    if (nb_sectors) {
2408
        nb_sectors--;
2409
    }
2410
    s->qdev.max_lba = nb_sectors;
2411
    /* reset tray statuses */
2412
    s->tray_locked = 0;
2413
    s->tray_open = 0;
2414

2415
    s->qdev.scsi_version = s->qdev.default_scsi_version;
2416
}
2417

2418
static void scsi_disk_drained_begin(void *opaque)
2419
{
2420
    SCSIDiskState *s = opaque;
2421

2422
    scsi_device_drained_begin(&s->qdev);
2423
}
2424

2425
static void scsi_disk_drained_end(void *opaque)
2426
{
2427
    SCSIDiskState *s = opaque;
2428

2429
    scsi_device_drained_end(&s->qdev);
2430
}
2431

2432
static void scsi_disk_resize_cb(void *opaque)
2433
{
2434
    SCSIDiskState *s = opaque;
2435

2436
    /* SPC lists this sense code as available only for
2437
     * direct-access devices.
2438
     */
2439
    if (s->qdev.type == TYPE_DISK) {
2440
        scsi_device_report_change(&s->qdev, SENSE_CODE(CAPACITY_CHANGED));
2441
    }
2442
}
2443

2444
static void scsi_cd_change_media_cb(void *opaque, bool load, Error **errp)
2445
{
2446
    SCSIDiskState *s = opaque;
2447

2448
    /*
2449
     * When a CD gets changed, we have to report an ejected state and
2450
     * then a loaded state to guests so that they detect tray
2451
     * open/close and media change events.  Guests that do not use
2452
     * GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
2453
     * states rely on this behavior.
2454
     *
2455
     * media_changed governs the state machine used for unit attention
2456
     * report.  media_event is used by GET EVENT STATUS NOTIFICATION.
2457
     */
2458
    s->media_changed = load;
2459
    s->tray_open = !load;
2460
    scsi_device_set_ua(&s->qdev, SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM));
2461
    s->media_event = true;
2462
    s->eject_request = false;
2463
}
2464

2465
static void scsi_cd_eject_request_cb(void *opaque, bool force)
2466
{
2467
    SCSIDiskState *s = opaque;
2468

2469
    s->eject_request = true;
2470
    if (force) {
2471
        s->tray_locked = false;
2472
    }
2473
}
2474

2475
static bool scsi_cd_is_tray_open(void *opaque)
2476
{
2477
    return ((SCSIDiskState *)opaque)->tray_open;
2478
}
2479

2480
static bool scsi_cd_is_medium_locked(void *opaque)
2481
{
2482
    return ((SCSIDiskState *)opaque)->tray_locked;
2483
}
2484

2485
static const BlockDevOps scsi_disk_removable_block_ops = {
2486
    .change_media_cb  = scsi_cd_change_media_cb,
2487
    .drained_begin    = scsi_disk_drained_begin,
2488
    .drained_end      = scsi_disk_drained_end,
2489
    .eject_request_cb = scsi_cd_eject_request_cb,
2490
    .is_medium_locked = scsi_cd_is_medium_locked,
2491
    .is_tray_open     = scsi_cd_is_tray_open,
2492
    .resize_cb        = scsi_disk_resize_cb,
2493
};
2494

2495
static const BlockDevOps scsi_disk_block_ops = {
2496
    .drained_begin = scsi_disk_drained_begin,
2497
    .drained_end   = scsi_disk_drained_end,
2498
    .resize_cb     = scsi_disk_resize_cb,
2499
};
2500

2501
static void scsi_disk_unit_attention_reported(SCSIDevice *dev)
2502
{
2503
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2504
    if (s->media_changed) {
2505
        s->media_changed = false;
2506
        scsi_device_set_ua(&s->qdev, SENSE_CODE(MEDIUM_CHANGED));
2507
    }
2508
}
2509

2510
static void scsi_realize(SCSIDevice *dev, Error **errp)
2511
{
2512
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2513
    bool read_only;
2514

2515
    if (!s->qdev.conf.blk) {
2516
        error_setg(errp, "drive property not set");
2517
        return;
2518
    }
2519

2520
    if (!(s->features & (1 << SCSI_DISK_F_REMOVABLE)) &&
2521
        !blk_is_inserted(s->qdev.conf.blk)) {
2522
        error_setg(errp, "Device needs media, but drive is empty");
2523
        return;
2524
    }
2525

2526
    if (!blkconf_blocksizes(&s->qdev.conf, errp)) {
2527
        return;
2528
    }
2529

2530
    if (blk_get_aio_context(s->qdev.conf.blk) != qemu_get_aio_context() &&
2531
        !s->qdev.hba_supports_iothread)
2532
    {
2533
        error_setg(errp, "HBA does not support iothreads");
2534
        return;
2535
    }
2536

2537
    if (dev->type == TYPE_DISK) {
2538
        if (!blkconf_geometry(&dev->conf, NULL, 65535, 255, 255, errp)) {
2539
            return;
2540
        }
2541
    }
2542

2543
    read_only = !blk_supports_write_perm(s->qdev.conf.blk);
2544
    if (dev->type == TYPE_ROM) {
2545
        read_only = true;
2546
    }
2547

2548
    if (!blkconf_apply_backend_options(&dev->conf, read_only,
2549
                                       dev->type == TYPE_DISK, errp)) {
2550
        return;
2551
    }
2552

2553
    if (s->qdev.conf.discard_granularity == -1) {
2554
        s->qdev.conf.discard_granularity =
2555
            MAX(s->qdev.conf.logical_block_size, DEFAULT_DISCARD_GRANULARITY);
2556
    }
2557

2558
    if (!s->version) {
2559
        s->version = g_strdup(qemu_hw_version());
2560
    }
2561
    if (!s->vendor) {
2562
        s->vendor = g_strdup("QEMU");
2563
    }
2564
    if (s->serial && strlen(s->serial) > MAX_SERIAL_LEN) {
2565
        error_setg(errp, "The serial number can't be longer than %d characters",
2566
                   MAX_SERIAL_LEN);
2567
        return;
2568
    }
2569
    if (!s->device_id) {
2570
        if (s->serial) {
2571
            if (strlen(s->serial) > MAX_SERIAL_LEN_FOR_DEVID) {
2572
                error_setg(errp, "The serial number can't be longer than %d "
2573
                           "characters when it is also used as the default for "
2574
                           "device_id", MAX_SERIAL_LEN_FOR_DEVID);
2575
                return;
2576
            }
2577
            s->device_id = g_strdup(s->serial);
2578
        } else {
2579
            const char *str = blk_name(s->qdev.conf.blk);
2580
            if (str && *str) {
2581
                s->device_id = g_strdup(str);
2582
            }
2583
        }
2584
    }
2585

2586
    if (blk_is_sg(s->qdev.conf.blk)) {
2587
        error_setg(errp, "unwanted /dev/sg*");
2588
        return;
2589
    }
2590

2591
    if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) &&
2592
            !(s->features & (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS))) {
2593
        blk_set_dev_ops(s->qdev.conf.blk, &scsi_disk_removable_block_ops, s);
2594
    } else {
2595
        blk_set_dev_ops(s->qdev.conf.blk, &scsi_disk_block_ops, s);
2596
    }
2597

2598
    blk_iostatus_enable(s->qdev.conf.blk);
2599

2600
    add_boot_device_lchs(&dev->qdev, NULL,
2601
                         dev->conf.lcyls,
2602
                         dev->conf.lheads,
2603
                         dev->conf.lsecs);
2604
}
2605

2606
static void scsi_unrealize(SCSIDevice *dev)
2607
{
2608
    del_boot_device_lchs(&dev->qdev, NULL);
2609
}
2610

2611
static void scsi_hd_realize(SCSIDevice *dev, Error **errp)
2612
{
2613
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2614

2615
    /* can happen for devices without drive. The error message for missing
2616
     * backend will be issued in scsi_realize
2617
     */
2618
    if (s->qdev.conf.blk) {
2619
        if (!blkconf_blocksizes(&s->qdev.conf, errp)) {
2620
            return;
2621
        }
2622
    }
2623
    s->qdev.blocksize = s->qdev.conf.logical_block_size;
2624
    s->qdev.type = TYPE_DISK;
2625
    if (!s->product) {
2626
        s->product = g_strdup("QEMU HARDDISK");
2627
    }
2628
    scsi_realize(&s->qdev, errp);
2629
}
2630

2631
static void scsi_cd_realize(SCSIDevice *dev, Error **errp)
2632
{
2633
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2634
    int ret;
2635
    uint32_t blocksize = 2048;
2636

2637
    if (!dev->conf.blk) {
2638
        /* Anonymous BlockBackend for an empty drive. As we put it into
2639
         * dev->conf, qdev takes care of detaching on unplug. */
2640
        dev->conf.blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
2641
        ret = blk_attach_dev(dev->conf.blk, &dev->qdev);
2642
        assert(ret == 0);
2643
    }
2644

2645
    if (dev->conf.physical_block_size != 0) {
2646
        blocksize = dev->conf.physical_block_size;
2647
    }
2648

2649
    s->qdev.blocksize = blocksize;
2650
    s->qdev.type = TYPE_ROM;
2651
    s->features |= 1 << SCSI_DISK_F_REMOVABLE;
2652
    if (!s->product) {
2653
        s->product = g_strdup("QEMU CD-ROM");
2654
    }
2655
    scsi_realize(&s->qdev, errp);
2656
}
2657

2658

2659
static const SCSIReqOps scsi_disk_emulate_reqops = {
2660
    .size         = sizeof(SCSIDiskReq),
2661
    .free_req     = scsi_free_request,
2662
    .send_command = scsi_disk_emulate_command,
2663
    .read_data    = scsi_disk_emulate_read_data,
2664
    .write_data   = scsi_disk_emulate_write_data,
2665
    .get_buf      = scsi_get_buf,
2666
    .load_request = scsi_disk_emulate_load_request,
2667
    .save_request = scsi_disk_emulate_save_request,
2668
};
2669

2670
static const SCSIReqOps scsi_disk_dma_reqops = {
2671
    .size         = sizeof(SCSIDiskReq),
2672
    .free_req     = scsi_free_request,
2673
    .send_command = scsi_disk_dma_command,
2674
    .read_data    = scsi_read_data,
2675
    .write_data   = scsi_write_data,
2676
    .get_buf      = scsi_get_buf,
2677
    .load_request = scsi_disk_load_request,
2678
    .save_request = scsi_disk_save_request,
2679
};
2680

2681
static const SCSIReqOps *const scsi_disk_reqops_dispatch[256] = {
2682
    [TEST_UNIT_READY]                 = &scsi_disk_emulate_reqops,
2683
    [INQUIRY]                         = &scsi_disk_emulate_reqops,
2684
    [MODE_SENSE]                      = &scsi_disk_emulate_reqops,
2685
    [MODE_SENSE_10]                   = &scsi_disk_emulate_reqops,
2686
    [START_STOP]                      = &scsi_disk_emulate_reqops,
2687
    [ALLOW_MEDIUM_REMOVAL]            = &scsi_disk_emulate_reqops,
2688
    [READ_CAPACITY_10]                = &scsi_disk_emulate_reqops,
2689
    [READ_TOC]                        = &scsi_disk_emulate_reqops,
2690
    [READ_DVD_STRUCTURE]              = &scsi_disk_emulate_reqops,
2691
    [READ_DISC_INFORMATION]           = &scsi_disk_emulate_reqops,
2692
    [GET_CONFIGURATION]               = &scsi_disk_emulate_reqops,
2693
    [GET_EVENT_STATUS_NOTIFICATION]   = &scsi_disk_emulate_reqops,
2694
    [MECHANISM_STATUS]                = &scsi_disk_emulate_reqops,
2695
    [SERVICE_ACTION_IN_16]            = &scsi_disk_emulate_reqops,
2696
    [REQUEST_SENSE]                   = &scsi_disk_emulate_reqops,
2697
    [SYNCHRONIZE_CACHE]               = &scsi_disk_emulate_reqops,
2698
    [SEEK_10]                         = &scsi_disk_emulate_reqops,
2699
    [MODE_SELECT]                     = &scsi_disk_emulate_reqops,
2700
    [MODE_SELECT_10]                  = &scsi_disk_emulate_reqops,
2701
    [UNMAP]                           = &scsi_disk_emulate_reqops,
2702
    [WRITE_SAME_10]                   = &scsi_disk_emulate_reqops,
2703
    [WRITE_SAME_16]                   = &scsi_disk_emulate_reqops,
2704
    [VERIFY_10]                       = &scsi_disk_emulate_reqops,
2705
    [VERIFY_12]                       = &scsi_disk_emulate_reqops,
2706
    [VERIFY_16]                       = &scsi_disk_emulate_reqops,
2707
    [FORMAT_UNIT]                     = &scsi_disk_emulate_reqops,
2708

2709
    [READ_6]                          = &scsi_disk_dma_reqops,
2710
    [READ_10]                         = &scsi_disk_dma_reqops,
2711
    [READ_12]                         = &scsi_disk_dma_reqops,
2712
    [READ_16]                         = &scsi_disk_dma_reqops,
2713
    [WRITE_6]                         = &scsi_disk_dma_reqops,
2714
    [WRITE_10]                        = &scsi_disk_dma_reqops,
2715
    [WRITE_12]                        = &scsi_disk_dma_reqops,
2716
    [WRITE_16]                        = &scsi_disk_dma_reqops,
2717
    [WRITE_VERIFY_10]                 = &scsi_disk_dma_reqops,
2718
    [WRITE_VERIFY_12]                 = &scsi_disk_dma_reqops,
2719
    [WRITE_VERIFY_16]                 = &scsi_disk_dma_reqops,
2720
};
2721

2722
static void scsi_disk_new_request_dump(uint32_t lun, uint32_t tag, uint8_t *buf)
2723
{
2724
    int len = scsi_cdb_length(buf);
2725
    g_autoptr(GString) str = NULL;
2726

2727
    assert(len > 0 && len <= 16);
2728
    str = qemu_hexdump_line(NULL, buf, len, 1, 0);
2729
    trace_scsi_disk_new_request(lun, tag, str->str);
2730
}
2731

2732
static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun,
2733
                                     uint8_t *buf, void *hba_private)
2734
{
2735
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2736
    SCSIRequest *req;
2737
    const SCSIReqOps *ops;
2738
    uint8_t command;
2739

2740
    command = buf[0];
2741
    ops = scsi_disk_reqops_dispatch[command];
2742
    if (!ops) {
2743
        ops = &scsi_disk_emulate_reqops;
2744
    }
2745
    req = scsi_req_alloc(ops, &s->qdev, tag, lun, hba_private);
2746

2747
    if (trace_event_get_state_backends(TRACE_SCSI_DISK_NEW_REQUEST)) {
2748
        scsi_disk_new_request_dump(lun, tag, buf);
2749
    }
2750

2751
    return req;
2752
}
2753

2754
#ifdef __linux__
2755
static int get_device_type(SCSIDiskState *s)
2756
{
2757
    uint8_t cmd[16];
2758
    uint8_t buf[36];
2759
    int ret;
2760

2761
    memset(cmd, 0, sizeof(cmd));
2762
    memset(buf, 0, sizeof(buf));
2763
    cmd[0] = INQUIRY;
2764
    cmd[4] = sizeof(buf);
2765

2766
    ret = scsi_SG_IO_FROM_DEV(s->qdev.conf.blk, cmd, sizeof(cmd),
2767
                              buf, sizeof(buf), s->qdev.io_timeout);
2768
    if (ret < 0) {
2769
        return -1;
2770
    }
2771
    s->qdev.type = buf[0];
2772
    if (buf[1] & 0x80) {
2773
        s->features |= 1 << SCSI_DISK_F_REMOVABLE;
2774
    }
2775
    return 0;
2776
}
2777

2778
static void scsi_block_realize(SCSIDevice *dev, Error **errp)
2779
{
2780
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2781
    int sg_version;
2782
    int rc;
2783

2784
    if (!s->qdev.conf.blk) {
2785
        error_setg(errp, "drive property not set");
2786
        return;
2787
    }
2788

2789
    if (s->rotation_rate) {
2790
        error_report_once("rotation_rate is specified for scsi-block but is "
2791
                          "not implemented. This option is deprecated and will "
2792
                          "be removed in a future version");
2793
    }
2794

2795
    /* check we are using a driver managing SG_IO (version 3 and after) */
2796
    rc = blk_ioctl(s->qdev.conf.blk, SG_GET_VERSION_NUM, &sg_version);
2797
    if (rc < 0) {
2798
        error_setg_errno(errp, -rc, "cannot get SG_IO version number");
2799
        if (rc != -EPERM) {
2800
            error_append_hint(errp, "Is this a SCSI device?\n");
2801
        }
2802
        return;
2803
    }
2804
    if (sg_version < 30000) {
2805
        error_setg(errp, "scsi generic interface too old");
2806
        return;
2807
    }
2808

2809
    /* get device type from INQUIRY data */
2810
    rc = get_device_type(s);
2811
    if (rc < 0) {
2812
        error_setg(errp, "INQUIRY failed");
2813
        return;
2814
    }
2815

2816
    /* Make a guess for the block size, we'll fix it when the guest sends.
2817
     * READ CAPACITY.  If they don't, they likely would assume these sizes
2818
     * anyway. (TODO: check in /sys).
2819
     */
2820
    if (s->qdev.type == TYPE_ROM || s->qdev.type == TYPE_WORM) {
2821
        s->qdev.blocksize = 2048;
2822
    } else {
2823
        s->qdev.blocksize = 512;
2824
    }
2825

2826
    /* Makes the scsi-block device not removable by using HMP and QMP eject
2827
     * command.
2828
     */
2829
    s->features |= (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS);
2830

2831
    scsi_realize(&s->qdev, errp);
2832
    scsi_generic_read_device_inquiry(&s->qdev);
2833
}
2834

2835
typedef struct SCSIBlockReq {
2836
    SCSIDiskReq req;
2837
    sg_io_hdr_t io_header;
2838

2839
    /* Selected bytes of the original CDB, copied into our own CDB.  */
2840
    uint8_t cmd, cdb1, group_number;
2841

2842
    /* CDB passed to SG_IO.  */
2843
    uint8_t cdb[16];
2844
    BlockCompletionFunc *cb;
2845
    void *cb_opaque;
2846
} SCSIBlockReq;
2847

2848
static void scsi_block_sgio_complete(void *opaque, int ret)
2849
{
2850
    SCSIBlockReq *req = (SCSIBlockReq *)opaque;
2851
    SCSIDiskReq *r = &req->req;
2852
    sg_io_hdr_t *io_hdr = &req->io_header;
2853

2854
    if (ret == 0) {
2855
        /* FIXME This skips calling req->cb() and any cleanup in it */
2856
        if (io_hdr->host_status != SCSI_HOST_OK) {
2857
            scsi_req_complete_failed(&r->req, io_hdr->host_status);
2858
            scsi_req_unref(&r->req);
2859
            return;
2860
        }
2861

2862
        if (io_hdr->driver_status & SG_ERR_DRIVER_TIMEOUT) {
2863
            ret = BUSY;
2864
        } else {
2865
            ret = io_hdr->status;
2866
        }
2867
    }
2868

2869
    req->cb(req->cb_opaque, ret);
2870
}
2871

2872
static BlockAIOCB *scsi_block_do_sgio(SCSIBlockReq *req,
2873
                                      int64_t offset, QEMUIOVector *iov,
2874
                                      int direction,
2875
                                      BlockCompletionFunc *cb, void *opaque)
2876
{
2877
    sg_io_hdr_t *io_header = &req->io_header;
2878
    SCSIDiskReq *r = &req->req;
2879
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
2880
    int nb_logical_blocks;
2881
    uint64_t lba;
2882
    BlockAIOCB *aiocb;
2883

2884
    /* This is not supported yet.  It can only happen if the guest does
2885
     * reads and writes that are not aligned to one logical sectors
2886
     * _and_ cover multiple MemoryRegions.
2887
     */
2888
    assert(offset % s->qdev.blocksize == 0);
2889
    assert(iov->size % s->qdev.blocksize == 0);
2890

2891
    io_header->interface_id = 'S';
2892

2893
    /* The data transfer comes from the QEMUIOVector.  */
2894
    io_header->dxfer_direction = direction;
2895
    io_header->dxfer_len = iov->size;
2896
    io_header->dxferp = (void *)iov->iov;
2897
    io_header->iovec_count = iov->niov;
2898
    assert(io_header->iovec_count == iov->niov); /* no overflow! */
2899

2900
    /* Build a new CDB with the LBA and length patched in, in case
2901
     * DMA helpers split the transfer in multiple segments.  Do not
2902
     * build a CDB smaller than what the guest wanted, and only build
2903
     * a larger one if strictly necessary.
2904
     */
2905
    io_header->cmdp = req->cdb;
2906
    lba = offset / s->qdev.blocksize;
2907
    nb_logical_blocks = io_header->dxfer_len / s->qdev.blocksize;
2908

2909
    if ((req->cmd >> 5) == 0 && lba <= 0x1ffff) {
2910
        /* 6-byte CDB */
2911
        stl_be_p(&req->cdb[0], lba | (req->cmd << 24));
2912
        req->cdb[4] = nb_logical_blocks;
2913
        req->cdb[5] = 0;
2914
        io_header->cmd_len = 6;
2915
    } else if ((req->cmd >> 5) <= 1 && lba <= 0xffffffffULL) {
2916
        /* 10-byte CDB */
2917
        req->cdb[0] = (req->cmd & 0x1f) | 0x20;
2918
        req->cdb[1] = req->cdb1;
2919
        stl_be_p(&req->cdb[2], lba);
2920
        req->cdb[6] = req->group_number;
2921
        stw_be_p(&req->cdb[7], nb_logical_blocks);
2922
        req->cdb[9] = 0;
2923
        io_header->cmd_len = 10;
2924
    } else if ((req->cmd >> 5) != 4 && lba <= 0xffffffffULL) {
2925
        /* 12-byte CDB */
2926
        req->cdb[0] = (req->cmd & 0x1f) | 0xA0;
2927
        req->cdb[1] = req->cdb1;
2928
        stl_be_p(&req->cdb[2], lba);
2929
        stl_be_p(&req->cdb[6], nb_logical_blocks);
2930
        req->cdb[10] = req->group_number;
2931
        req->cdb[11] = 0;
2932
        io_header->cmd_len = 12;
2933
    } else {
2934
        /* 16-byte CDB */
2935
        req->cdb[0] = (req->cmd & 0x1f) | 0x80;
2936
        req->cdb[1] = req->cdb1;
2937
        stq_be_p(&req->cdb[2], lba);
2938
        stl_be_p(&req->cdb[10], nb_logical_blocks);
2939
        req->cdb[14] = req->group_number;
2940
        req->cdb[15] = 0;
2941
        io_header->cmd_len = 16;
2942
    }
2943

2944
    /* The rest is as in scsi-generic.c.  */
2945
    io_header->mx_sb_len = sizeof(r->req.sense);
2946
    io_header->sbp = r->req.sense;
2947
    io_header->timeout = s->qdev.io_timeout * 1000;
2948
    io_header->usr_ptr = r;
2949
    io_header->flags |= SG_FLAG_DIRECT_IO;
2950
    req->cb = cb;
2951
    req->cb_opaque = opaque;
2952
    trace_scsi_disk_aio_sgio_command(r->req.tag, req->cdb[0], lba,
2953
                                     nb_logical_blocks, io_header->timeout);
2954
    aiocb = blk_aio_ioctl(s->qdev.conf.blk, SG_IO, io_header, scsi_block_sgio_complete, req);
2955
    assert(aiocb != NULL);
2956
    return aiocb;
2957
}
2958

2959
static bool scsi_block_no_fua(SCSICommand *cmd)
2960
{
2961
    return false;
2962
}
2963

2964
static BlockAIOCB *scsi_block_dma_readv(int64_t offset,
2965
                                        QEMUIOVector *iov,
2966
                                        BlockCompletionFunc *cb, void *cb_opaque,
2967
                                        void *opaque)
2968
{
2969
    SCSIBlockReq *r = opaque;
2970
    return scsi_block_do_sgio(r, offset, iov,
2971
                              SG_DXFER_FROM_DEV, cb, cb_opaque);
2972
}
2973

2974
static BlockAIOCB *scsi_block_dma_writev(int64_t offset,
2975
                                         QEMUIOVector *iov,
2976
                                         BlockCompletionFunc *cb, void *cb_opaque,
2977
                                         void *opaque)
2978
{
2979
    SCSIBlockReq *r = opaque;
2980
    return scsi_block_do_sgio(r, offset, iov,
2981
                              SG_DXFER_TO_DEV, cb, cb_opaque);
2982
}
2983

2984
static bool scsi_block_is_passthrough(SCSIDiskState *s, uint8_t *buf)
2985
{
2986
    switch (buf[0]) {
2987
    case VERIFY_10:
2988
    case VERIFY_12:
2989
    case VERIFY_16:
2990
        /* Check if BYTCHK == 0x01 (data-out buffer contains data
2991
         * for the number of logical blocks specified in the length
2992
         * field).  For other modes, do not use scatter/gather operation.
2993
         */
2994
        if ((buf[1] & 6) == 2) {
2995
            return false;
2996
        }
2997
        break;
2998

2999
    case READ_6:
3000
    case READ_10:
3001
    case READ_12:
3002
    case READ_16:
3003
    case WRITE_6:
3004
    case WRITE_10:
3005
    case WRITE_12:
3006
    case WRITE_16:
3007
    case WRITE_VERIFY_10:
3008
    case WRITE_VERIFY_12:
3009
    case WRITE_VERIFY_16:
3010
        /* MMC writing cannot be done via DMA helpers, because it sometimes
3011
         * involves writing beyond the maximum LBA or to negative LBA (lead-in).
3012
         * We might use scsi_block_dma_reqops as long as no writing commands are
3013
         * seen, but performance usually isn't paramount on optical media.  So,
3014
         * just make scsi-block operate the same as scsi-generic for them.
3015
         */
3016
        if (s->qdev.type != TYPE_ROM) {
3017
            return false;
3018
        }
3019
        break;
3020

3021
    default:
3022
        break;
3023
    }
3024

3025
    return true;
3026
}
3027

3028

3029
static int32_t scsi_block_dma_command(SCSIRequest *req, uint8_t *buf)
3030
{
3031
    SCSIBlockReq *r = (SCSIBlockReq *)req;
3032
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
3033

3034
    r->cmd = req->cmd.buf[0];
3035
    switch (r->cmd >> 5) {
3036
    case 0:
3037
        /* 6-byte CDB.  */
3038
        r->cdb1 = r->group_number = 0;
3039
        break;
3040
    case 1:
3041
        /* 10-byte CDB.  */
3042
        r->cdb1 = req->cmd.buf[1];
3043
        r->group_number = req->cmd.buf[6];
3044
        break;
3045
    case 4:
3046
        /* 12-byte CDB.  */
3047
        r->cdb1 = req->cmd.buf[1];
3048
        r->group_number = req->cmd.buf[10];
3049
        break;
3050
    case 5:
3051
        /* 16-byte CDB.  */
3052
        r->cdb1 = req->cmd.buf[1];
3053
        r->group_number = req->cmd.buf[14];
3054
        break;
3055
    default:
3056
        abort();
3057
    }
3058

3059
    /* Protection information is not supported.  For SCSI versions 2 and
3060
     * older (as determined by snooping the guest's INQUIRY commands),
3061
     * there is no RD/WR/VRPROTECT, so skip this check in these versions.
3062
     */
3063
    if (s->qdev.scsi_version > 2 && (req->cmd.buf[1] & 0xe0)) {
3064
        scsi_check_condition(&r->req, SENSE_CODE(INVALID_FIELD));
3065
        return 0;
3066
    }
3067

3068
    return scsi_disk_dma_command(req, buf);
3069
}
3070

3071
static const SCSIReqOps scsi_block_dma_reqops = {
3072
    .size         = sizeof(SCSIBlockReq),
3073
    .free_req     = scsi_free_request,
3074
    .send_command = scsi_block_dma_command,
3075
    .read_data    = scsi_read_data,
3076
    .write_data   = scsi_write_data,
3077
    .get_buf      = scsi_get_buf,
3078
    .load_request = scsi_disk_load_request,
3079
    .save_request = scsi_disk_save_request,
3080
};
3081

3082
static SCSIRequest *scsi_block_new_request(SCSIDevice *d, uint32_t tag,
3083
                                           uint32_t lun, uint8_t *buf,
3084
                                           void *hba_private)
3085
{
3086
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
3087

3088
    if (scsi_block_is_passthrough(s, buf)) {
3089
        return scsi_req_alloc(&scsi_generic_req_ops, &s->qdev, tag, lun,
3090
                              hba_private);
3091
    } else {
3092
        return scsi_req_alloc(&scsi_block_dma_reqops, &s->qdev, tag, lun,
3093
                              hba_private);
3094
    }
3095
}
3096

3097
static int scsi_block_parse_cdb(SCSIDevice *d, SCSICommand *cmd,
3098
                                  uint8_t *buf, size_t buf_len,
3099
                                  void *hba_private)
3100
{
3101
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
3102

3103
    if (scsi_block_is_passthrough(s, buf)) {
3104
        return scsi_bus_parse_cdb(&s->qdev, cmd, buf, buf_len, hba_private);
3105
    } else {
3106
        return scsi_req_parse_cdb(&s->qdev, cmd, buf, buf_len);
3107
    }
3108
}
3109

3110
static void scsi_block_update_sense(SCSIRequest *req)
3111
{
3112
    SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
3113
    SCSIBlockReq *br = DO_UPCAST(SCSIBlockReq, req, r);
3114
    r->req.sense_len = MIN(br->io_header.sb_len_wr, sizeof(r->req.sense));
3115
}
3116
#endif
3117

3118
static
3119
BlockAIOCB *scsi_dma_readv(int64_t offset, QEMUIOVector *iov,
3120
                           BlockCompletionFunc *cb, void *cb_opaque,
3121
                           void *opaque)
3122
{
3123
    SCSIDiskReq *r = opaque;
3124
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
3125
    return blk_aio_preadv(s->qdev.conf.blk, offset, iov, 0, cb, cb_opaque);
3126
}
3127

3128
static
3129
BlockAIOCB *scsi_dma_writev(int64_t offset, QEMUIOVector *iov,
3130
                            BlockCompletionFunc *cb, void *cb_opaque,
3131
                            void *opaque)
3132
{
3133
    SCSIDiskReq *r = opaque;
3134
    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
3135
    return blk_aio_pwritev(s->qdev.conf.blk, offset, iov, 0, cb, cb_opaque);
3136
}
3137

3138
static void scsi_disk_base_class_initfn(ObjectClass *klass, void *data)
3139
{
3140
    DeviceClass *dc = DEVICE_CLASS(klass);
3141
    SCSIDiskClass *sdc = SCSI_DISK_BASE_CLASS(klass);
3142

3143
    dc->fw_name = "disk";
3144
    dc->reset = scsi_disk_reset;
3145
    sdc->dma_readv = scsi_dma_readv;
3146
    sdc->dma_writev = scsi_dma_writev;
3147
    sdc->need_fua_emulation = scsi_is_cmd_fua;
3148
}
3149

3150
static const TypeInfo scsi_disk_base_info = {
3151
    .name          = TYPE_SCSI_DISK_BASE,
3152
    .parent        = TYPE_SCSI_DEVICE,
3153
    .class_init    = scsi_disk_base_class_initfn,
3154
    .instance_size = sizeof(SCSIDiskState),
3155
    .class_size    = sizeof(SCSIDiskClass),
3156
    .abstract      = true,
3157
};
3158

3159
#define DEFINE_SCSI_DISK_PROPERTIES()                                   \
3160
    DEFINE_PROP_DRIVE_IOTHREAD("drive", SCSIDiskState, qdev.conf.blk),  \
3161
    DEFINE_BLOCK_PROPERTIES_BASE(SCSIDiskState, qdev.conf),             \
3162
    DEFINE_BLOCK_ERROR_PROPERTIES(SCSIDiskState, qdev.conf),            \
3163
    DEFINE_PROP_STRING("ver", SCSIDiskState, version),                  \
3164
    DEFINE_PROP_STRING("serial", SCSIDiskState, serial),                \
3165
    DEFINE_PROP_STRING("vendor", SCSIDiskState, vendor),                \
3166
    DEFINE_PROP_STRING("product", SCSIDiskState, product),              \
3167
    DEFINE_PROP_STRING("device_id", SCSIDiskState, device_id),          \
3168
    DEFINE_PROP_BOOL("migrate-emulated-scsi-request", SCSIDiskState, migrate_emulated_scsi_request, true)
3169

3170

3171
static Property scsi_hd_properties[] = {
3172
    DEFINE_SCSI_DISK_PROPERTIES(),
3173
    DEFINE_PROP_BIT("removable", SCSIDiskState, features,
3174
                    SCSI_DISK_F_REMOVABLE, false),
3175
    DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
3176
                    SCSI_DISK_F_DPOFUA, false),
3177
    DEFINE_PROP_UINT64("wwn", SCSIDiskState, qdev.wwn, 0),
3178
    DEFINE_PROP_UINT64("port_wwn", SCSIDiskState, qdev.port_wwn, 0),
3179
    DEFINE_PROP_UINT16("port_index", SCSIDiskState, port_index, 0),
3180
    DEFINE_PROP_UINT64("max_unmap_size", SCSIDiskState, max_unmap_size,
3181
                       DEFAULT_MAX_UNMAP_SIZE),
3182
    DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
3183
                       DEFAULT_MAX_IO_SIZE),
3184
    DEFINE_PROP_UINT16("rotation_rate", SCSIDiskState, rotation_rate, 0),
3185
    DEFINE_PROP_INT32("scsi_version", SCSIDiskState, qdev.default_scsi_version,
3186
                      5),
3187
    DEFINE_PROP_BIT("quirk_mode_page_vendor_specific_apple", SCSIDiskState,
3188
                    quirks, SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE,
3189
                    0),
3190
    DEFINE_BLOCK_CHS_PROPERTIES(SCSIDiskState, qdev.conf),
3191
    DEFINE_PROP_END_OF_LIST(),
3192
};
3193

3194
static const VMStateDescription vmstate_scsi_disk_state = {
3195
    .name = "scsi-disk",
3196
    .version_id = 1,
3197
    .minimum_version_id = 1,
3198
    .fields = (const VMStateField[]) {
3199
        VMSTATE_SCSI_DEVICE(qdev, SCSIDiskState),
3200
        VMSTATE_BOOL(media_changed, SCSIDiskState),
3201
        VMSTATE_BOOL(media_event, SCSIDiskState),
3202
        VMSTATE_BOOL(eject_request, SCSIDiskState),
3203
        VMSTATE_BOOL(tray_open, SCSIDiskState),
3204
        VMSTATE_BOOL(tray_locked, SCSIDiskState),
3205
        VMSTATE_END_OF_LIST()
3206
    }
3207
};
3208

3209
static void scsi_hd_class_initfn(ObjectClass *klass, void *data)
3210
{
3211
    DeviceClass *dc = DEVICE_CLASS(klass);
3212
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
3213

3214
    sc->realize      = scsi_hd_realize;
3215
    sc->unrealize    = scsi_unrealize;
3216
    sc->alloc_req    = scsi_new_request;
3217
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
3218
    dc->desc = "virtual SCSI disk";
3219
    device_class_set_props(dc, scsi_hd_properties);
3220
    dc->vmsd  = &vmstate_scsi_disk_state;
3221
}
3222

3223
static const TypeInfo scsi_hd_info = {
3224
    .name          = "scsi-hd",
3225
    .parent        = TYPE_SCSI_DISK_BASE,
3226
    .class_init    = scsi_hd_class_initfn,
3227
};
3228

3229
static Property scsi_cd_properties[] = {
3230
    DEFINE_SCSI_DISK_PROPERTIES(),
3231
    DEFINE_PROP_UINT64("wwn", SCSIDiskState, qdev.wwn, 0),
3232
    DEFINE_PROP_UINT64("port_wwn", SCSIDiskState, qdev.port_wwn, 0),
3233
    DEFINE_PROP_UINT16("port_index", SCSIDiskState, port_index, 0),
3234
    DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
3235
                       DEFAULT_MAX_IO_SIZE),
3236
    DEFINE_PROP_INT32("scsi_version", SCSIDiskState, qdev.default_scsi_version,
3237
                      5),
3238
    DEFINE_PROP_BIT("quirk_mode_page_apple_vendor", SCSIDiskState, quirks,
3239
                    SCSI_DISK_QUIRK_MODE_PAGE_APPLE_VENDOR, 0),
3240
    DEFINE_PROP_BIT("quirk_mode_sense_rom_use_dbd", SCSIDiskState, quirks,
3241
                    SCSI_DISK_QUIRK_MODE_SENSE_ROM_USE_DBD, 0),
3242
    DEFINE_PROP_BIT("quirk_mode_page_vendor_specific_apple", SCSIDiskState,
3243
                    quirks, SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE,
3244
                    0),
3245
    DEFINE_PROP_BIT("quirk_mode_page_truncated", SCSIDiskState, quirks,
3246
                    SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED, 0),
3247
    DEFINE_PROP_END_OF_LIST(),
3248
};
3249

3250
static void scsi_cd_class_initfn(ObjectClass *klass, void *data)
3251
{
3252
    DeviceClass *dc = DEVICE_CLASS(klass);
3253
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
3254

3255
    sc->realize      = scsi_cd_realize;
3256
    sc->alloc_req    = scsi_new_request;
3257
    sc->unit_attention_reported = scsi_disk_unit_attention_reported;
3258
    dc->desc = "virtual SCSI CD-ROM";
3259
    device_class_set_props(dc, scsi_cd_properties);
3260
    dc->vmsd  = &vmstate_scsi_disk_state;
3261
}
3262

3263
static const TypeInfo scsi_cd_info = {
3264
    .name          = "scsi-cd",
3265
    .parent        = TYPE_SCSI_DISK_BASE,
3266
    .class_init    = scsi_cd_class_initfn,
3267
};
3268

3269
#ifdef __linux__
3270
static Property scsi_block_properties[] = {
3271
    DEFINE_BLOCK_ERROR_PROPERTIES(SCSIDiskState, qdev.conf),
3272
    DEFINE_PROP_DRIVE("drive", SCSIDiskState, qdev.conf.blk),
3273
    DEFINE_PROP_BOOL("share-rw", SCSIDiskState, qdev.conf.share_rw, false),
3274
    DEFINE_PROP_UINT16("rotation_rate", SCSIDiskState, rotation_rate, 0),
3275
    DEFINE_PROP_UINT64("max_unmap_size", SCSIDiskState, max_unmap_size,
3276
                       DEFAULT_MAX_UNMAP_SIZE),
3277
    DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
3278
                       DEFAULT_MAX_IO_SIZE),
3279
    DEFINE_PROP_INT32("scsi_version", SCSIDiskState, qdev.default_scsi_version,
3280
                      -1),
3281
    DEFINE_PROP_UINT32("io_timeout", SCSIDiskState, qdev.io_timeout,
3282
                       DEFAULT_IO_TIMEOUT),
3283
    DEFINE_PROP_END_OF_LIST(),
3284
};
3285

3286
static void scsi_block_class_initfn(ObjectClass *klass, void *data)
3287
{
3288
    DeviceClass *dc = DEVICE_CLASS(klass);
3289
    SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
3290
    SCSIDiskClass *sdc = SCSI_DISK_BASE_CLASS(klass);
3291

3292
    sc->realize      = scsi_block_realize;
3293
    sc->alloc_req    = scsi_block_new_request;
3294
    sc->parse_cdb    = scsi_block_parse_cdb;
3295
    sdc->dma_readv   = scsi_block_dma_readv;
3296
    sdc->dma_writev  = scsi_block_dma_writev;
3297
    sdc->update_sense = scsi_block_update_sense;
3298
    sdc->need_fua_emulation = scsi_block_no_fua;
3299
    dc->desc = "SCSI block device passthrough";
3300
    device_class_set_props(dc, scsi_block_properties);
3301
    dc->vmsd  = &vmstate_scsi_disk_state;
3302
}
3303

3304
static const TypeInfo scsi_block_info = {
3305
    .name          = "scsi-block",
3306
    .parent        = TYPE_SCSI_DISK_BASE,
3307
    .class_init    = scsi_block_class_initfn,
3308
};
3309
#endif
3310

3311
static void scsi_disk_register_types(void)
3312
{
3313
    type_register_static(&scsi_disk_base_info);
3314
    type_register_static(&scsi_hd_info);
3315
    type_register_static(&scsi_cd_info);
3316
#ifdef __linux__
3317
    type_register_static(&scsi_block_info);
3318
#endif
3319
}
3320

3321
type_init(scsi_disk_register_types)
3322