scsi-disk.c · samitouri/QOSamiQemu

Code Commits Issues Pulls Sessions CI/CD

master

c 3,439 lines 107 KB

Raw

1	/*
2	* SCSI Device emulation
3	*
4	* Copyright (c) 2006 CodeSourcery.
5	* Based on code by Fabrice Bellard
6	*
7	* Written by Paul Brook
8	* Modifications:
9	* 2009-Dec-12 Artyom Tarasenko : implemented stamdard inquiry for the case
10	* when the allocation length of CDB is smaller
11	* than 36.
12	* 2009-Oct-13 Artyom Tarasenko : implemented the block descriptor in the
13	* MODE SENSE response.
14	*
15	* This code is licensed under the LGPL.
16	*
17	* Note that this file only handles the SCSI architecture model and device
18	* commands. Emulation of interface/link layer protocols is handled by
19	* the host adapter emulator.
20	*/
21
22	#include "qemu/osdep.h"
23	#include "qemu/units.h"
24	#include "qapi/error.h"
25	#include "qemu/error-report.h"
26	#include "qemu/main-loop.h"
27	#include "qemu/module.h"
28	#include "qemu/hw-version.h"
29	#include "qemu/memalign.h"
30	#include "qemu/target-info.h"
31	#include "hw/scsi/scsi.h"
32	#include "migration/misc.h"
33	#include "migration/qemu-file-types.h"
34	#include "migration/vmstate.h"
35	#include "hw/scsi/emulation.h"
36	#include "scsi/constants.h"
37	#include "system/block-backend.h"
38	#include "system/blockdev.h"
39	#include "hw/block/block.h"
40	#include "hw/core/qdev-properties.h"
41	#include "hw/core/qdev-properties-system.h"
42	#include "system/dma.h"
43	#include "system/system.h"
44	#include "qemu/cutils.h"
45	#include "trace.h"
46	#include "qom/object.h"
47
48	#ifdef __linux
49	#include <scsi/sg.h>
50	#endif
51
52	#define SCSI_WRITE_SAME_MAX (512 * KiB)
53	#define SCSI_DMA_BUF_SIZE (128 * KiB)
54	#define SCSI_MAX_INQUIRY_LEN 256
55	#define SCSI_MAX_MODE_LEN 256
56
57	#define DEFAULT_DISCARD_GRANULARITY (4 * KiB)
58	#define DEFAULT_MAX_UNMAP_SIZE (1 * GiB)
59	#define DEFAULT_MAX_IO_SIZE INT_MAX /* 2 GB - 1 block */
60
61	#define TYPE_SCSI_DISK_BASE "scsi-disk-base"
62
63	#define MAX_SERIAL_LEN 36
64	#define MAX_SERIAL_LEN_FOR_DEVID 20
65
66	OBJECT_DECLARE_TYPE(SCSIDiskState, SCSIDiskClass, SCSI_DISK_BASE)
67
68	struct SCSIDiskClass {
69	SCSIDeviceClass parent_class;
70	/*
71	* Callbacks receive ret == 0 for success. Errors are represented either as
72	* negative errno values, or as positive SAM status codes. For host_status
73	* errors, the function passes ret == -ENODEV and sets the host_status field
74	* of the SCSIRequest.
75	*/
76	DMAIOFunc *dma_readv;
77	DMAIOFunc *dma_writev;
78	bool (need_fua)(SCSICommand cmd);
79	void (update_sense)(SCSIRequest r);
80	};
81
82	typedef struct SCSIDiskReq {
83	SCSIRequest req;
84	/* Both sector and sector_count are in terms of BDRV_SECTOR_SIZE bytes. */
85	uint64_t sector;
86	uint32_t sector_count;
87	uint32_t buflen;
88	bool started;
89	bool need_fua;
90	struct iovec iov;
91	QEMUIOVector qiov;
92	BlockAcctCookie acct;
93	} SCSIDiskReq;
94
95	#define SCSI_DISK_F_REMOVABLE 0
96	#define SCSI_DISK_F_DPOFUA 1
97	#define SCSI_DISK_F_NO_REMOVABLE_DEVOPS 2
98
99	struct SCSIDiskState {
100	SCSIDevice qdev;
101	uint32_t features;
102	bool media_changed;
103	bool media_event;
104	bool eject_request;
105	uint16_t port_index;
106	uint64_t max_unmap_size;
107	uint64_t max_io_size;
108	uint32_t quirks;
109	char *version;
110	char *serial;
111	char *vendor;
112	char *product;
113	char *device_id;
114	char loadparm; / only for s390x */
115	bool tray_open;
116	bool tray_locked;
117	/*
118	* 0x0000 - rotation rate not reported
119	* 0x0001 - non-rotating medium (SSD)
120	* 0x0002-0x0400 - reserved
121	* 0x0401-0xfffe - rotations per minute
122	* 0xffff - reserved
123	*/
124	uint16_t rotation_rate;
125	bool migrate_emulated_scsi_request;
126	NotifierWithReturn migration_notifier;
127	};
128
129	static void scsi_free_request(SCSIRequest *req)
130	{
131	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
132
133	qemu_vfree(r->iov.iov_base);
134	}
135
136	/* Helper function for command completion with sense. */
137	static void scsi_check_condition(SCSIDiskReq *r, SCSISense sense)
138	{
139	trace_scsi_disk_check_condition(r->req.tag, sense.key, sense.asc,
140	sense.ascq);
141	scsi_req_build_sense(&r->req, sense);
142	scsi_req_complete(&r->req, CHECK_CONDITION);
143	}
144
145	static void scsi_init_iovec(SCSIDiskReq *r, size_t size)
146	{
147	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
148
149	if (!r->iov.iov_base) {
150	r->buflen = size;
151	r->iov.iov_base = blk_blockalign(s->qdev.conf.blk, r->buflen);
152	}
153	r->iov.iov_len = MIN(r->sector_count * BDRV_SECTOR_SIZE, r->buflen);
154	qemu_iovec_init_external(&r->qiov, &r->iov, 1);
155	}
156
157	static void scsi_disk_save_request(QEMUFile f, SCSIRequest req)
158	{
159	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
160
161	qemu_put_be64s(f, &r->sector);
162	qemu_put_be32s(f, &r->sector_count);
163	qemu_put_be32s(f, &r->buflen);
164	if (r->buflen) {
165	if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
166	qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
167	} else if (!req->retry) {
168	uint32_t len = r->iov.iov_len;
169	qemu_put_be32s(f, &len);
170	qemu_put_buffer(f, r->iov.iov_base, r->iov.iov_len);
171	}
172	}
173	}
174
175	static void scsi_disk_emulate_save_request(QEMUFile f, SCSIRequest req)
176	{
177	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
178
179	if (s->migrate_emulated_scsi_request) {
180	scsi_disk_save_request(f, req);
181	}
182	}
183
184	static void scsi_disk_load_request(QEMUFile f, SCSIRequest req)
185	{
186	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
187
188	qemu_get_be64s(f, &r->sector);
189	qemu_get_be32s(f, &r->sector_count);
190	qemu_get_be32s(f, &r->buflen);
191	if (r->buflen) {
192	scsi_init_iovec(r, r->buflen);
193	if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
194	qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
195	} else if (!r->req.retry) {
196	uint32_t len;
197	qemu_get_be32s(f, &len);
198	r->iov.iov_len = len;
199	assert(r->iov.iov_len <= r->buflen);
200	qemu_get_buffer(f, r->iov.iov_base, r->iov.iov_len);
201	}
202	}
203
204	qemu_iovec_init_external(&r->qiov, &r->iov, 1);
205	}
206
207	static void scsi_disk_emulate_load_request(QEMUFile f, SCSIRequest req)
208	{
209	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
210
211	if (s->migrate_emulated_scsi_request) {
212	scsi_disk_load_request(f, req);
213	}
214	}
215
216	/*
217	* scsi_handle_rw_error has two return values. False means that the error
218	* must be ignored, true means that the error has been processed and the
219	* caller should not do anything else for this request. Note that
220	* scsi_handle_rw_error always manages its reference counts, independent
221	* of the return value.
222	*/
223	static bool scsi_handle_rw_error(SCSIDiskReq *r, int ret, bool acct_failed)
224	{
225	bool is_read = (r->req.cmd.mode == SCSI_XFER_FROM_DEV);
226	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
227	SCSIDiskClass sdc = (SCSIDiskClass ) object_get_class(OBJECT(s));
228	SCSISense sense = SENSE_CODE(NO_SENSE);
229	int16_t host_status;
230	int error;
231	bool req_has_sense = false;
232	BlockErrorAction action;
233	int status;
234
235	/*
236	* host_status should only be set for SG_IO requests that came back with a
237	* host_status error in scsi_block_sgio_complete(). This error path passes
238	* -ENODEV as the return value.
239	*
240	* Reset host_status in the request because we may still want to complete
241	* the request successfully with the 'stop' or 'ignore' error policy.
242	*/
243	host_status = r->req.host_status;
244	if (host_status != -1) {
245	assert(ret == -ENODEV);
246	r->req.host_status = -1;
247	}
248
249	if (ret < 0) {
250	status = scsi_sense_from_errno(-ret, &sense);
251	error = -ret;
252	} else {
253	/* A passthrough command has completed with nonzero status. */
254	status = ret;
255	switch (status) {
256	case CHECK_CONDITION:
257	req_has_sense = true;
258	error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
259	break;
260	case RESERVATION_CONFLICT:
261	/*
262	* Don't apply the error policy, always report to the guest.
263	*
264	* This is a passthrough code path, so it's not a backend error, but
265	* a response to an invalid guest request.
266	*
267	* Windows Failover Cluster validation intentionally sends invalid
268	* requests to verify that reservations work as intended. It is
269	* crucial that it sees the resulting errors.
270	*
271	* Treating a reservation conflict as a guest-side error is obvious
272	* when a pr-manager is in use. Without one, the situation is less
273	* clear, but there might be nothing that can be fixed on the host
274	* (like in the above example), and we don't want to be stuck in a
275	* loop where resuming the VM and retrying the request immediately
276	* stops it again. So always reporting is still the safer option in
277	* this case, too.
278	*/
279	error = 0;
280	break;
281	default:
282	error = EINVAL;
283	break;
284	}
285	}
286
287	/*
288	* Check whether the error has to be handled by the guest or should
289	* rather follow the rerror=/werror= settings. Guest-handled errors
290	* are usually retried immediately, so do not post them to QMP and
291	* do not account them as failed I/O.
292	*/
293	if (!error \|\| (req_has_sense &&
294	scsi_sense_buf_is_guest_recoverable(r->req.sense,
295	sizeof(r->req.sense)))) {
296	action = BLOCK_ERROR_ACTION_REPORT;
297	acct_failed = false;
298	} else {
299	action = blk_get_error_action(s->qdev.conf.blk, is_read, error);
300	blk_error_action(s->qdev.conf.blk, action, is_read, error);
301	}
302
303	switch (action) {
304	case BLOCK_ERROR_ACTION_REPORT:
305	if (acct_failed) {
306	block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
307	}
308	if (host_status != -1) {
309	scsi_req_complete_failed(&r->req, host_status);
310	return true;
311	}
312	if (req_has_sense) {
313	sdc->update_sense(&r->req);
314	} else if (status == CHECK_CONDITION) {
315	scsi_req_build_sense(&r->req, sense);
316	}
317	scsi_req_complete(&r->req, status);
318	return true;
319
320	case BLOCK_ERROR_ACTION_IGNORE:
321	return false;
322
323	case BLOCK_ERROR_ACTION_STOP:
324	scsi_req_retry(&r->req);
325	return true;
326
327	default:
328	g_assert_not_reached();
329	}
330	}
331
332	static bool scsi_disk_req_check_error(SCSIDiskReq *r, int ret, bool acct_failed)
333	{
334	if (r->req.io_canceled) {
335	scsi_req_cancel_complete(&r->req);
336	return true;
337	}
338
339	if (ret != 0) {
340	return scsi_handle_rw_error(r, ret, acct_failed);
341	}
342
343	return false;
344	}
345
346	static void scsi_aio_complete(void *opaque, int ret)
347	{
348	SCSIDiskReq r = (SCSIDiskReq )opaque;
349	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
350
351	/* The request must run in its AioContext */
352	assert(r->req.ctx == qemu_get_current_aio_context());
353
354	assert(r->req.aiocb != NULL);
355	r->req.aiocb = NULL;
356
357	if (scsi_disk_req_check_error(r, ret, true)) {
358	goto done;
359	}
360
361	block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
362	scsi_req_complete(&r->req, GOOD);
363
364	done:
365	scsi_req_unref(&r->req);
366	}
367
368	static bool scsi_is_cmd_fua(SCSICommand *cmd)
369	{
370	switch (cmd->buf[0]) {
371	case READ_10:
372	case READ_12:
373	case READ_16:
374	case WRITE_10:
375	case WRITE_12:
376	case WRITE_16:
377	return (cmd->buf[1] & 8) != 0;
378
379	case VERIFY_10:
380	case VERIFY_12:
381	case VERIFY_16:
382	case WRITE_VERIFY_10:
383	case WRITE_VERIFY_12:
384	case WRITE_VERIFY_16:
385	return true;
386
387	case READ_6:
388	case WRITE_6:
389	default:
390	return false;
391	}
392	}
393
394	static void scsi_dma_complete_noio(SCSIDiskReq *r, int ret)
395	{
396	assert(r->req.aiocb == NULL);
397	if (scsi_disk_req_check_error(r, ret, ret > 0)) {
398	goto done;
399	}
400
401	r->sector += r->sector_count;
402	r->sector_count = 0;
403	scsi_req_complete(&r->req, GOOD);
404
405	done:
406	scsi_req_unref(&r->req);
407	}
408
409	static void scsi_dma_complete(void *opaque, int ret)
410	{
411	SCSIDiskReq r = (SCSIDiskReq )opaque;
412	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
413
414	assert(r->req.aiocb != NULL);
415	r->req.aiocb = NULL;
416
417	/* ret > 0 is accounted for in scsi_disk_req_check_error() */
418	if (ret < 0) {
419	block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
420	} else if (ret == 0) {
421	block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
422	}
423	scsi_dma_complete_noio(r, ret);
424	}
425
426	static void scsi_read_complete_noio(SCSIDiskReq *r, int ret)
427	{
428	uint32_t n;
429
430	/* The request must run in its AioContext */
431	assert(r->req.ctx == qemu_get_current_aio_context());
432
433	assert(r->req.aiocb == NULL);
434	if (scsi_disk_req_check_error(r, ret, ret > 0)) {
435	goto done;
436	}
437
438	n = r->qiov.size / BDRV_SECTOR_SIZE;
439	r->sector += n;
440	r->sector_count -= n;
441	scsi_req_data(&r->req, r->qiov.size);
442
443	done:
444	scsi_req_unref(&r->req);
445	}
446
447	static void scsi_read_complete(void *opaque, int ret)
448	{
449	SCSIDiskReq r = (SCSIDiskReq )opaque;
450	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
451
452	assert(r->req.aiocb != NULL);
453	r->req.aiocb = NULL;
454
455	/* ret > 0 is accounted for in scsi_disk_req_check_error() */
456	if (ret < 0) {
457	block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
458	} else if (ret == 0) {
459	block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
460	trace_scsi_disk_read_complete(r->req.tag, r->qiov.size);
461	}
462	scsi_read_complete_noio(r, ret);
463	}
464
465	/* Actually issue a read to the block device. */
466	static void scsi_do_read(SCSIDiskReq *r, int ret)
467	{
468	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
469	SCSIDiskClass sdc = (SCSIDiskClass ) object_get_class(OBJECT(s));
470
471	assert (r->req.aiocb == NULL);
472	if (scsi_disk_req_check_error(r, ret, false)) {
473	goto done;
474	}
475
476	/* The request is used as the AIO opaque value, so add a ref. */
477	scsi_req_ref(&r->req);
478
479	if (r->req.sg) {
480	dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_READ);
481	r->req.residual -= r->req.sg->size;
482	r->req.aiocb = dma_blk_io(r->req.sg, r->sector << BDRV_SECTOR_BITS,
483	BDRV_SECTOR_SIZE,
484	sdc->dma_readv, r, scsi_dma_complete, r,
485	DMA_DIRECTION_FROM_DEVICE);
486	} else {
487	scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
488	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
489	r->qiov.size, BLOCK_ACCT_READ);
490	r->req.aiocb = sdc->dma_readv(r->sector << BDRV_SECTOR_BITS, &r->qiov,
491	scsi_read_complete, r, r);
492	}
493
494	done:
495	scsi_req_unref(&r->req);
496	}
497
498	static void scsi_do_read_cb(void *opaque, int ret)
499	{
500	SCSIDiskReq r = (SCSIDiskReq )opaque;
501	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
502
503	assert (r->req.aiocb != NULL);
504	r->req.aiocb = NULL;
505
506	if (ret < 0) {
507	block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
508	} else {
509	block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
510	}
511	scsi_do_read(opaque, ret);
512	}
513
514	/* Read more data from scsi device into buffer. */
515	static void scsi_read_data(SCSIRequest *req)
516	{
517	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
518	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
519	bool first;
520
521	trace_scsi_disk_read_data_count(r->sector_count);
522	if (r->sector_count == 0) {
523	/* This also clears the sense buffer for REQUEST SENSE. */
524	scsi_req_complete(&r->req, GOOD);
525	return;
526	}
527
528	/* No data transfer may already be in progress */
529	assert(r->req.aiocb == NULL);
530
531	/* The request is used as the AIO opaque value, so add a ref. */
532	scsi_req_ref(&r->req);
533	if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
534	trace_scsi_disk_read_data_invalid();
535	scsi_read_complete_noio(r, -EINVAL);
536	return;
537	}
538
539	if (!blk_is_available(req->dev->conf.blk)) {
540	scsi_read_complete_noio(r, -ENOMEDIUM);
541	return;
542	}
543
544	first = !r->started;
545	r->started = true;
546	if (first && r->need_fua) {
547	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
548	BLOCK_ACCT_FLUSH);
549	r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_do_read_cb, r);
550	} else {
551	scsi_do_read(r, 0);
552	}
553	}
554
555	static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
556	{
557	uint32_t n;
558
559	/* The request must run in its AioContext */
560	assert(r->req.ctx == qemu_get_current_aio_context());
561
562	assert (r->req.aiocb == NULL);
563	if (scsi_disk_req_check_error(r, ret, ret > 0)) {
564	goto done;
565	}
566
567	n = r->qiov.size / BDRV_SECTOR_SIZE;
568	r->sector += n;
569	r->sector_count -= n;
570	if (r->sector_count == 0) {
571	scsi_req_complete(&r->req, GOOD);
572	} else {
573	scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);
574	trace_scsi_disk_write_complete_noio(r->req.tag, r->qiov.size);
575	scsi_req_data(&r->req, r->qiov.size);
576	}
577
578	done:
579	scsi_req_unref(&r->req);
580	}
581
582	static void scsi_write_complete(void * opaque, int ret)
583	{
584	SCSIDiskReq r = (SCSIDiskReq )opaque;
585	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
586
587	assert (r->req.aiocb != NULL);
588	r->req.aiocb = NULL;
589
590	/* ret > 0 is accounted for in scsi_disk_req_check_error() */
591	if (ret < 0) {
592	block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
593	} else if (ret == 0) {
594	block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
595	}
596	scsi_write_complete_noio(r, ret);
597	}
598
599	static void scsi_write_data(SCSIRequest *req)
600	{
601	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
602	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
603	SCSIDiskClass sdc = (SCSIDiskClass ) object_get_class(OBJECT(s));
604	BlockCompletionFunc *cb;
605
606	/* No data transfer may already be in progress */
607	assert(r->req.aiocb == NULL);
608
609	/* The request is used as the AIO opaque value, so add a ref. */
610	scsi_req_ref(&r->req);
611	if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {
612	trace_scsi_disk_write_data_invalid();
613	scsi_write_complete_noio(r, -EINVAL);
614	return;
615	}
616
617	if (!r->req.sg && !r->qiov.size) {
618	/* Called for the first time. Ask the driver to send us more data. */
619	r->started = true;
620	scsi_write_complete_noio(r, 0);
621	return;
622	}
623	if (!blk_is_available(req->dev->conf.blk)) {
624	scsi_write_complete_noio(r, -ENOMEDIUM);
625	return;
626	}
627
628	if (r->req.cmd.buf[0] == VERIFY_10 \|\| r->req.cmd.buf[0] == VERIFY_12 \|\|
629	r->req.cmd.buf[0] == VERIFY_16) {
630	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
631	BLOCK_ACCT_FLUSH);
632	cb = r->req.sg ? scsi_dma_complete : scsi_write_complete;
633	r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, cb, r);
634	return;
635	}
636
637	if (r->req.sg) {
638	dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_WRITE);
639	r->req.residual -= r->req.sg->size;
640	r->req.aiocb = dma_blk_io(r->req.sg, r->sector << BDRV_SECTOR_BITS,
641	BDRV_SECTOR_SIZE,
642	sdc->dma_writev, r, scsi_dma_complete, r,
643	DMA_DIRECTION_TO_DEVICE);
644	} else {
645	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
646	r->qiov.size, BLOCK_ACCT_WRITE);
647	r->req.aiocb = sdc->dma_writev(r->sector << BDRV_SECTOR_BITS, &r->qiov,
648	scsi_write_complete, r, r);
649	}
650	}
651
652	/* Return a pointer to the data buffer. */
653	static uint8_t scsi_get_buf(SCSIRequest req)
654	{
655	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
656
657	return (uint8_t *)r->iov.iov_base;
658	}
659
660	static int scsi_disk_emulate_vpd_page(SCSIRequest req, uint8_t outbuf)
661	{
662	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
663	uint8_t page_code = req->cmd.buf[2];
664	int start, buflen = 0;
665
666	outbuf[buflen++] = s->qdev.type & 0x1f;
667	outbuf[buflen++] = page_code;
668	outbuf[buflen++] = 0x00;
669	outbuf[buflen++] = 0x00;
670	start = buflen;
671
672	switch (page_code) {
673	case 0x00: /* Supported page codes, mandatory */
674	{
675	trace_scsi_disk_emulate_vpd_page_00(req->cmd.xfer);
676	outbuf[buflen++] = 0x00; /* list of supported pages (this page) */
677	if (s->serial) {
678	outbuf[buflen++] = 0x80; /* unit serial number */
679	}
680	outbuf[buflen++] = 0x83; /* device identification */
681	if (s->qdev.type == TYPE_DISK) {
682	outbuf[buflen++] = 0xb0; /* block limits */
683	outbuf[buflen++] = 0xb1; /* block device characteristics */
684	outbuf[buflen++] = 0xb2; /* thin provisioning */
685	}
686	break;
687	}
688	case 0x80: /* Device serial number, optional */
689	{
690	int l;
691
692	if (!s->serial) {
693	trace_scsi_disk_emulate_vpd_page_80_not_supported();
694	return -1;
695	}
696
697	l = strlen(s->serial);
698	if (l > MAX_SERIAL_LEN) {
699	l = MAX_SERIAL_LEN;
700	}
701
702	trace_scsi_disk_emulate_vpd_page_80(req->cmd.xfer);
703	memcpy(outbuf + buflen, s->serial, l);
704	buflen += l;
705	break;
706	}
707
708	case 0x83: /* Device identification page, mandatory */
709	{
710	int id_len = s->device_id ? MIN(strlen(s->device_id), 255 - 8) : 0;
711
712	trace_scsi_disk_emulate_vpd_page_83(req->cmd.xfer);
713
714	if (id_len) {
715	outbuf[buflen++] = 0x2; /* ASCII */
716	outbuf[buflen++] = 0; /* not officially assigned */
717	outbuf[buflen++] = 0; /* reserved */
718	outbuf[buflen++] = id_len; /* length of data following */
719	memcpy(outbuf + buflen, s->device_id, id_len);
720	buflen += id_len;
721	}
722
723	if (s->qdev.wwn) {
724	outbuf[buflen++] = 0x1; /* Binary */
725	outbuf[buflen++] = 0x3; /* NAA */
726	outbuf[buflen++] = 0; /* reserved */
727	outbuf[buflen++] = 8;
728	stq_be_p(&outbuf[buflen], s->qdev.wwn);
729	buflen += 8;
730	}
731
732	if (s->qdev.port_wwn) {
733	outbuf[buflen++] = 0x61; /* SAS / Binary */
734	outbuf[buflen++] = 0x93; /* PIV / Target port / NAA */
735	outbuf[buflen++] = 0; /* reserved */
736	outbuf[buflen++] = 8;
737	stq_be_p(&outbuf[buflen], s->qdev.port_wwn);
738	buflen += 8;
739	}
740
741	if (s->port_index) {
742	outbuf[buflen++] = 0x61; /* SAS / Binary */
743
744	/* PIV/Target port/relative target port */
745	outbuf[buflen++] = 0x94;
746
747	outbuf[buflen++] = 0; /* reserved */
748	outbuf[buflen++] = 4;
749	stw_be_p(&outbuf[buflen + 2], s->port_index);
750	buflen += 4;
751	}
752	break;
753	}
754	case 0xb0: /* block limits */
755	{
756	SCSIBlockLimits bl = {};
757
758	if (s->qdev.type == TYPE_ROM) {
759	trace_scsi_disk_emulate_vpd_page_b0_not_supported();
760	return -1;
761	}
762	bl.wsnz = 1;
763	bl.unmap_sectors =
764	s->qdev.conf.discard_granularity / s->qdev.blocksize;
765	bl.min_io_size =
766	s->qdev.conf.min_io_size / s->qdev.blocksize;
767	bl.opt_io_size =
768	s->qdev.conf.opt_io_size / s->qdev.blocksize;
769	bl.max_unmap_sectors =
770	s->max_unmap_size / s->qdev.blocksize;
771	bl.max_io_sectors =
772	s->max_io_size / s->qdev.blocksize;
773	/* 255 descriptors fit in 4 KiB with an 8-byte header */
774	bl.max_unmap_descr = 255;
775
776	if (s->qdev.type == TYPE_DISK) {
777	int max_transfer_blk = blk_get_max_transfer(s->qdev.conf.blk);
778	int max_io_sectors_blk =
779	max_transfer_blk / s->qdev.blocksize;
780
781	bl.max_io_sectors =
782	MIN_NON_ZERO(max_io_sectors_blk, bl.max_io_sectors);
783	}
784	buflen += scsi_emulate_block_limits(outbuf + buflen, &bl);
785	break;
786	}
787	case 0xb1: /* block device characteristics */
788	{
789	buflen = 0x40;
790	outbuf[4] = (s->rotation_rate >> 8) & 0xff;
791	outbuf[5] = s->rotation_rate & 0xff;
792	outbuf[6] = 0; /* PRODUCT TYPE */
793	outbuf[7] = 0; /* WABEREQ \| WACEREQ \| NOMINAL FORM FACTOR */
794	outbuf[8] = 0; /* VBULS */
795	break;
796	}
797	case 0xb2: /* thin provisioning */
798	{
799	buflen = 8;
800	outbuf[4] = 0;
801	outbuf[5] = 0xe0; /* unmap & write_same 10/16 all supported */
802	outbuf[6] = s->qdev.conf.discard_granularity ? 2 : 1;
803	outbuf[7] = 0;
804	break;
805	}
806	default:
807	return -1;
808	}
809	/* done with EVPD */
810	assert(buflen - start <= 255);
811	outbuf[start - 1] = buflen - start;
812	return buflen;
813	}
814
815	static int scsi_disk_emulate_inquiry(SCSIRequest req, uint8_t outbuf)
816	{
817	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
818	int buflen = 0;
819
820	if (req->cmd.buf[1] & 0x1) {
821	/* Vital product data */
822	return scsi_disk_emulate_vpd_page(req, outbuf);
823	}
824
825	/* Standard INQUIRY data */
826	if (req->cmd.buf[2] != 0) {
827	return -1;
828	}
829
830	/* PAGE CODE == 0 */
831	buflen = req->cmd.xfer;
832	if (buflen > SCSI_MAX_INQUIRY_LEN) {
833	buflen = SCSI_MAX_INQUIRY_LEN;
834	}
835
836	outbuf[0] = s->qdev.type & 0x1f;
837	outbuf[1] = (s->features & (1 << SCSI_DISK_F_REMOVABLE)) ? 0x80 : 0;
838
839	strpadcpy((char *) &outbuf[16], 16, s->product, ' ');
840	strpadcpy((char *) &outbuf[8], 8, s->vendor, ' ');
841
842	memset(&outbuf[32], 0, 4);
843	memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version)));
844	/*
845	* We claim conformance to SPC-3, which is required for guests
846	* to ask for modern features like READ CAPACITY(16) or the
847	* block characteristics VPD page by default. Not all of SPC-3
848	* is actually implemented, but we're good enough.
849	*/
850	outbuf[2] = s->qdev.default_scsi_version;
851	outbuf[3] = 2 \| 0x10; /* Format 2, HiSup */
852
853	if (buflen > 36) {
854	outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */
855	} else {
856	/* If the allocation length of CDB is too small,
857	the additional length is not adjusted */
858	outbuf[4] = 36 - 5;
859	}
860
861	/* Sync data transfer and TCQ. */
862	outbuf[7] = 0x10 \| (req->bus->info->tcq ? 0x02 : 0);
863	return buflen;
864	}
865
866	static inline bool media_is_dvd(SCSIDiskState *s)
867	{
868	uint64_t nb_sectors;
869	if (s->qdev.type != TYPE_ROM) {
870	return false;
871	}
872	if (!blk_is_available(s->qdev.conf.blk)) {
873	return false;
874	}
875	blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
876	return nb_sectors > CD_MAX_SECTORS;
877	}
878
879	static inline bool media_is_cd(SCSIDiskState *s)
880	{
881	uint64_t nb_sectors;
882	if (s->qdev.type != TYPE_ROM) {
883	return false;
884	}
885	if (!blk_is_available(s->qdev.conf.blk)) {
886	return false;
887	}
888	blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
889	return nb_sectors <= CD_MAX_SECTORS;
890	}
891
892	static int scsi_read_disc_information(SCSIDiskState s, SCSIDiskReq r,
893	uint8_t *outbuf)
894	{
895	uint8_t type = r->req.cmd.buf[1] & 7;
896
897	if (s->qdev.type != TYPE_ROM) {
898	return -1;
899	}
900
901	/* Types 1/2 are only defined for Blu-Ray. */
902	if (type != 0) {
903	scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
904	return -1;
905	}
906
907	memset(outbuf, 0, 34);
908	outbuf[1] = 32;
909	outbuf[2] = 0xe; /* last session complete, disc finalized */
910	outbuf[3] = 1; /* first track on disc */
911	outbuf[4] = 1; /* # of sessions */
912	outbuf[5] = 1; /* first track of last session */
913	outbuf[6] = 1; /* last track of last session */
914	outbuf[7] = 0x20; /* unrestricted use */
915	outbuf[8] = 0x00; /* CD-ROM or DVD-ROM */
916	/* 9-10-11: most significant byte corresponding bytes 4-5-6 */
917	/* 12-23: not meaningful for CD-ROM or DVD-ROM */
918	/* 24-31: disc bar code */
919	/* 32: disc application code */
920	/* 33: number of OPC tables */
921
922	return 34;
923	}
924
925	static int scsi_read_dvd_structure(SCSIDiskState s, SCSIDiskReq r,
926	uint8_t *outbuf)
927	{
928	static const int rds_caps_size[5] = {
929	[0] = 2048 + 4,
930	[1] = 4 + 4,
931	[3] = 188 + 4,
932	[4] = 2048 + 4,
933	};
934
935	uint8_t media = r->req.cmd.buf[1];
936	uint8_t layer = r->req.cmd.buf[6];
937	uint8_t format = r->req.cmd.buf[7];
938	int size = -1;
939
940	if (s->qdev.type != TYPE_ROM) {
941	return -1;
942	}
943	if (media != 0) {
944	scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
945	return -1;
946	}
947
948	if (format != 0xff) {
949	if (!blk_is_available(s->qdev.conf.blk)) {
950	scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
951	return -1;
952	}
953	if (media_is_cd(s)) {
954	scsi_check_condition(r, SENSE_CODE(INCOMPATIBLE_FORMAT));
955	return -1;
956	}
957	if (format >= ARRAY_SIZE(rds_caps_size)) {
958	return -1;
959	}
960	size = rds_caps_size[format];
961	memset(outbuf, 0, size);
962	}
963
964	switch (format) {
965	case 0x00: {
966	/* Physical format information */
967	uint64_t nb_sectors;
968	if (layer != 0) {
969	goto fail;
970	}
971	blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
972
973	outbuf[4] = 1; /* DVD-ROM, part version 1 */
974	outbuf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
975	outbuf[6] = 1; /* one layer, read-only (per MMC-2 spec) */
976	outbuf[7] = 0; /* default densities */
977
978	stl_be_p(&outbuf[12], (nb_sectors >> 2) - 1); /* end sector */
979	stl_be_p(&outbuf[16], (nb_sectors >> 2) - 1); /* l0 end sector */
980	break;
981	}
982
983	case 0x01: /* DVD copyright information, all zeros */
984	break;
985
986	case 0x03: /* BCA information - invalid field for no BCA info */
987	return -1;
988
989	case 0x04: /* DVD disc manufacturing information, all zeros */
990	break;
991
992	case 0xff: { /* List capabilities */
993	int i;
994	size = 4;
995	for (i = 0; i < ARRAY_SIZE(rds_caps_size); i++) {
996	if (!rds_caps_size[i]) {
997	continue;
998	}
999	outbuf[size] = i;
1000	outbuf[size + 1] = 0x40; /* Not writable, readable */
1001	stw_be_p(&outbuf[size + 2], rds_caps_size[i]);
1002	size += 4;
1003	}
1004	break;
1005	}
1006
1007	default:
1008	return -1;
1009	}
1010
1011	/* Size of buffer, not including 2 byte size field */
1012	stw_be_p(outbuf, size - 2);
1013	return size;
1014
1015	fail:
1016	return -1;
1017	}
1018
1019	static int scsi_event_status_media(SCSIDiskState s, uint8_t outbuf)
1020	{
1021	uint8_t event_code, media_status;
1022
1023	media_status = 0;
1024	if (s->tray_open) {
1025	media_status = MS_TRAY_OPEN;
1026	} else if (blk_is_inserted(s->qdev.conf.blk)) {
1027	media_status = MS_MEDIA_PRESENT;
1028	}
1029
1030	/* Event notification descriptor */
1031	event_code = MEC_NO_CHANGE;
1032	if (media_status != MS_TRAY_OPEN) {
1033	if (s->media_event) {
1034	event_code = MEC_NEW_MEDIA;
1035	s->media_event = false;
1036	} else if (s->eject_request) {
1037	event_code = MEC_EJECT_REQUESTED;
1038	s->eject_request = false;
1039	}
1040	}
1041
1042	outbuf[0] = event_code;
1043	outbuf[1] = media_status;
1044
1045	/* These fields are reserved, just clear them. */
1046	outbuf[2] = 0;
1047	outbuf[3] = 0;
1048	return 4;
1049	}
1050
1051	static int scsi_get_event_status_notification(SCSIDiskState s, SCSIDiskReq r,
1052	uint8_t *outbuf)
1053	{
1054	int size;
1055	uint8_t *buf = r->req.cmd.buf;
1056	uint8_t notification_class_request = buf[4];
1057	if (s->qdev.type != TYPE_ROM) {
1058	return -1;
1059	}
1060	if ((buf[1] & 1) == 0) {
1061	/* asynchronous */
1062	return -1;
1063	}
1064
1065	size = 4;
1066	outbuf[0] = outbuf[1] = 0;
1067	outbuf[3] = 1 << GESN_MEDIA; /* supported events */
1068	if (notification_class_request & (1 << GESN_MEDIA)) {
1069	outbuf[2] = GESN_MEDIA;
1070	size += scsi_event_status_media(s, &outbuf[size]);
1071	} else {
1072	outbuf[2] = 0x80;
1073	}
1074	stw_be_p(outbuf, size - 4);
1075	return size;
1076	}
1077
1078	static int scsi_get_configuration(SCSIDiskState s, uint8_t outbuf)
1079	{
1080	int current;
1081
1082	if (s->qdev.type != TYPE_ROM) {
1083	return -1;
1084	}
1085
1086	if (media_is_dvd(s)) {
1087	current = MMC_PROFILE_DVD_ROM;
1088	} else if (media_is_cd(s)) {
1089	current = MMC_PROFILE_CD_ROM;
1090	} else {
1091	current = MMC_PROFILE_NONE;
1092	}
1093
1094	memset(outbuf, 0, 40);
1095	stl_be_p(&outbuf[0], 36); /* Bytes after the data length field */
1096	stw_be_p(&outbuf[6], current);
1097	/* outbuf[8] - outbuf[19]: Feature 0 - Profile list */
1098	outbuf[10] = 0x03; /* persistent, current */
1099	outbuf[11] = 8; /* two profiles */
1100	stw_be_p(&outbuf[12], MMC_PROFILE_DVD_ROM);
1101	outbuf[14] = (current == MMC_PROFILE_DVD_ROM);
1102	stw_be_p(&outbuf[16], MMC_PROFILE_CD_ROM);
1103	outbuf[18] = (current == MMC_PROFILE_CD_ROM);
1104	/* outbuf[20] - outbuf[31]: Feature 1 - Core feature */
1105	stw_be_p(&outbuf[20], 1);
1106	outbuf[22] = 0x08 \| 0x03; /* version 2, persistent, current */
1107	outbuf[23] = 8;
1108	stl_be_p(&outbuf[24], 1); /* SCSI */
1109	outbuf[28] = 1; /* DBE = 1, mandatory */
1110	/* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */
1111	stw_be_p(&outbuf[32], 3);
1112	outbuf[34] = 0x08 \| 0x03; /* version 2, persistent, current */
1113	outbuf[35] = 4;
1114	outbuf[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */
1115	/* TODO: Random readable, CD read, DVD read, drive serial number,
1116	power management */
1117	return 40;
1118	}
1119
1120	static int scsi_emulate_mechanism_status(SCSIDiskState s, uint8_t outbuf)
1121	{
1122	if (s->qdev.type != TYPE_ROM) {
1123	return -1;
1124	}
1125	memset(outbuf, 0, 8);
1126	outbuf[5] = 1; /* CD-ROM */
1127	return 8;
1128	}
1129
1130	static int mode_sense_page(SCSIDiskState s, int page, uint8_t *p_outbuf,
1131	int page_control)
1132	{
1133	static const int mode_sense_valid[0x3f] = {
1134	[MODE_PAGE_VENDOR_SPECIFIC] = (1 << TYPE_DISK) \| (1 << TYPE_ROM),
1135	[MODE_PAGE_HD_GEOMETRY] = (1 << TYPE_DISK),
1136	[MODE_PAGE_FLEXIBLE_DISK_GEOMETRY] = (1 << TYPE_DISK),
1137	[MODE_PAGE_CACHING] = (1 << TYPE_DISK) \| (1 << TYPE_ROM),
1138	[MODE_PAGE_R_W_ERROR] = (1 << TYPE_DISK) \| (1 << TYPE_ROM),
1139	[MODE_PAGE_AUDIO_CTL] = (1 << TYPE_ROM),
1140	[MODE_PAGE_CAPABILITIES] = (1 << TYPE_ROM),
1141	[MODE_PAGE_APPLE_VENDOR] = (1 << TYPE_ROM),
1142	};
1143
1144	uint8_t p = p_outbuf + 2;
1145	int length;
1146
1147	assert(page < ARRAY_SIZE(mode_sense_valid));
1148	if ((mode_sense_valid[page] & (1 << s->qdev.type)) == 0) {
1149	return -1;
1150	}
1151
1152	/*
1153	* If Changeable Values are requested, a mask denoting those mode parameters
1154	* that are changeable shall be returned. As we currently don't support
1155	* parameter changes via MODE_SELECT all bits are returned set to zero.
1156	* The buffer was already menset to zero by the caller of this function.
1157	*
1158	* The offsets here are off by two compared to the descriptions in the
1159	* SCSI specs, because those include a 2-byte header. This is unfortunate,
1160	* but it is done so that offsets are consistent within our implementation
1161	* of MODE SENSE and MODE SELECT. MODE SELECT has to deal with both
1162	* 2-byte and 4-byte headers.
1163	*/
1164	switch (page) {
1165	case MODE_PAGE_HD_GEOMETRY:
1166	length = 0x16;
1167	if (page_control == 1) { /* Changeable Values */
1168	break;
1169	}
1170	/* if a geometry hint is available, use it */
1171	p[0] = (s->qdev.conf.cyls >> 16) & 0xff;
1172	p[1] = (s->qdev.conf.cyls >> 8) & 0xff;
1173	p[2] = s->qdev.conf.cyls & 0xff;
1174	p[3] = s->qdev.conf.heads & 0xff;
1175	/* Write precomp start cylinder, disabled */
1176	p[4] = (s->qdev.conf.cyls >> 16) & 0xff;
1177	p[5] = (s->qdev.conf.cyls >> 8) & 0xff;
1178	p[6] = s->qdev.conf.cyls & 0xff;
1179	/* Reduced current start cylinder, disabled */
1180	p[7] = (s->qdev.conf.cyls >> 16) & 0xff;
1181	p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
1182	p[9] = s->qdev.conf.cyls & 0xff;
1183	/* Device step rate [ns], 200ns */
1184	p[10] = 0;
1185	p[11] = 200;
1186	/* Landing zone cylinder */
1187	p[12] = 0xff;
1188	p[13] = 0xff;
1189	p[14] = 0xff;
1190	/* Medium rotation rate [rpm], 5400 rpm */
1191	p[18] = (5400 >> 8) & 0xff;
1192	p[19] = 5400 & 0xff;
1193	break;
1194
1195	case MODE_PAGE_FLEXIBLE_DISK_GEOMETRY:
1196	length = 0x1e;
1197	if (page_control == 1) { /* Changeable Values */
1198	break;
1199	}
1200	/* Transfer rate [kbit/s], 5Mbit/s */
1201	p[0] = 5000 >> 8;
1202	p[1] = 5000 & 0xff;
1203	/* if a geometry hint is available, use it */
1204	p[2] = s->qdev.conf.heads & 0xff;
1205	p[3] = s->qdev.conf.secs & 0xff;
1206	p[4] = s->qdev.blocksize >> 8;
1207	p[6] = (s->qdev.conf.cyls >> 8) & 0xff;
1208	p[7] = s->qdev.conf.cyls & 0xff;
1209	/* Write precomp start cylinder, disabled */
1210	p[8] = (s->qdev.conf.cyls >> 8) & 0xff;
1211	p[9] = s->qdev.conf.cyls & 0xff;
1212	/* Reduced current start cylinder, disabled */
1213	p[10] = (s->qdev.conf.cyls >> 8) & 0xff;
1214	p[11] = s->qdev.conf.cyls & 0xff;
1215	/* Device step rate [100us], 100us */
1216	p[12] = 0;
1217	p[13] = 1;
1218	/* Device step pulse width [us], 1us */
1219	p[14] = 1;
1220	/* Device head settle delay [100us], 100us */
1221	p[15] = 0;
1222	p[16] = 1;
1223	/* Motor on delay [0.1s], 0.1s */
1224	p[17] = 1;
1225	/* Motor off delay [0.1s], 0.1s */
1226	p[18] = 1;
1227	/* Medium rotation rate [rpm], 5400 rpm */
1228	p[26] = (5400 >> 8) & 0xff;
1229	p[27] = 5400 & 0xff;
1230	break;
1231
1232	case MODE_PAGE_CACHING:
1233	length = 0x12;
1234	if (page_control == 1 \|\| /* Changeable Values */
1235	blk_enable_write_cache(s->qdev.conf.blk)) {
1236	p[0] = 4; /* WCE */
1237	}
1238	break;
1239
1240	case MODE_PAGE_R_W_ERROR:
1241	length = 10;
1242	if (page_control == 1) { /* Changeable Values */
1243	if (s->qdev.type == TYPE_ROM) {
1244	/* Automatic Write Reallocation Enabled */
1245	p[0] = 0x80;
1246	}
1247	break;
1248	}
1249	p[0] = 0x80; /* Automatic Write Reallocation Enabled */
1250	if (s->qdev.type == TYPE_ROM) {
1251	p[1] = 0x20; /* Read Retry Count */
1252	}
1253	break;
1254
1255	case MODE_PAGE_AUDIO_CTL:
1256	length = 14;
1257	break;
1258
1259	case MODE_PAGE_CAPABILITIES:
1260	length = 0x14;
1261	if (page_control == 1) { /* Changeable Values */
1262	break;
1263	}
1264
1265	p[0] = 0x3b; /* CD-R & CD-RW read */
1266	p[1] = 0; /* Writing not supported */
1267	p[2] = 0x7f; /* Audio, composite, digital out,
1268	mode 2 form 1&2, multi session */
1269	p[3] = 0xff; /* CD DA, DA accurate, RW supported,
1270	RW corrected, C2 errors, ISRC,
1271	UPC, Bar code */
1272	p[4] = 0x2d \| (s->tray_locked ? 2 : 0);
1273	/* Locking supported, jumper present, eject, tray */
1274	p[5] = 0; /* no volume & mute control, no
1275	changer */
1276	p[6] = (50 * 176) >> 8; /* 50x read speed */
1277	p[7] = (50 * 176) & 0xff;
1278	p[8] = 2 >> 8; /* Two volume levels */
1279	p[9] = 2 & 0xff;
1280	p[10] = 2048 >> 8; /* 2M buffer */
1281	p[11] = 2048 & 0xff;
1282	p[12] = (16 * 176) >> 8; /* 16x read speed current */
1283	p[13] = (16 * 176) & 0xff;
1284	p[16] = (16 * 176) >> 8; /* 16x write speed */
1285	p[17] = (16 * 176) & 0xff;
1286	p[18] = (16 * 176) >> 8; /* 16x write speed current */
1287	p[19] = (16 * 176) & 0xff;
1288	break;
1289
1290	case MODE_PAGE_APPLE_VENDOR:
1291	if (s->quirks & (1 << SCSI_DISK_QUIRK_MODE_PAGE_APPLE_VENDOR)) {
1292	length = 0x1e;
1293	if (page_control == 1) { /* Changeable Values */
1294	break;
1295	}
1296
1297	memset(p, 0, length);
1298	strcpy((char *)p + 8, "APPLE COMPUTER, INC ");
1299	break;
1300	} else {
1301	return -1;
1302	}
1303
1304	case MODE_PAGE_VENDOR_SPECIFIC:
1305	if (s->qdev.type == TYPE_DISK && (s->quirks &
1306	(1 << SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE))) {
1307	length = 0x2;
1308	if (page_control == 1) { /* Changeable Values */
1309	p[0] = 0xff;
1310	p[1] = 0xff;
1311	break;
1312	}
1313	p[0] = 0;
1314	p[1] = 0;
1315	break;
1316	} else {
1317	return -1;
1318	}
1319
1320	default:
1321	return -1;
1322	}
1323
1324	assert(length + 2 <= SCSI_MAX_MODE_LEN);
1325	(*p_outbuf)[0] = page;
1326	(*p_outbuf)[1] = length;
1327	*p_outbuf += length + 2;
1328	return length + 2;
1329	}
1330
1331	static int scsi_disk_emulate_mode_sense(SCSIDiskReq r, uint8_t outbuf)
1332	{
1333	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1334	uint64_t nb_sectors;
1335	bool dbd;
1336	int page, buflen, ret, page_control;
1337	uint8_t *p;
1338	uint8_t dev_specific_param;
1339
1340	dbd = (r->req.cmd.buf[1] & 0x8) != 0;
1341	page = r->req.cmd.buf[2] & 0x3f;
1342	page_control = (r->req.cmd.buf[2] & 0xc0) >> 6;
1343
1344	trace_scsi_disk_emulate_mode_sense((r->req.cmd.buf[0] == MODE_SENSE) ? 6 :
1345	10, page, r->req.cmd.xfer, page_control);
1346	memset(outbuf, 0, r->req.cmd.xfer);
1347	p = outbuf;
1348
1349	if (s->qdev.type == TYPE_DISK) {
1350	dev_specific_param = s->features & (1 << SCSI_DISK_F_DPOFUA) ? 0x10 : 0;
1351	if (!blk_is_writable(s->qdev.conf.blk)) {
1352	dev_specific_param \|= 0x80; /* Readonly. */
1353	}
1354	} else {
1355	if (s->quirks & (1 << SCSI_DISK_QUIRK_MODE_SENSE_ROM_USE_DBD)) {
1356	/* Use DBD from the request... */
1357	dev_specific_param = 0x00;
1358
1359	/*
1360	* ... unless we receive a request for MODE_PAGE_APPLE_VENDOR
1361	* which should never return a block descriptor even though DBD is
1362	* not set, otherwise CDROM detection fails in MacOS
1363	*/
1364	if (s->quirks & (1 << SCSI_DISK_QUIRK_MODE_PAGE_APPLE_VENDOR) &&
1365	page == MODE_PAGE_APPLE_VENDOR) {
1366	dbd = true;
1367	}
1368	} else {
1369	/*
1370	* MMC prescribes that CD/DVD drives have no block descriptors,
1371	* and defines no device-specific parameter.
1372	*/
1373	dev_specific_param = 0x00;
1374	dbd = true;
1375	}
1376	}
1377
1378	if (r->req.cmd.buf[0] == MODE_SENSE) {
1379	p[1] = 0; /* Default media type. */
1380	p[2] = dev_specific_param;
1381	p[3] = 0; /* Block descriptor length. */
1382	p += 4;
1383	} else { /* MODE_SENSE_10 */
1384	p[2] = 0; /* Default media type. */
1385	p[3] = dev_specific_param;
1386	p[6] = p[7] = 0; /* Block descriptor length. */
1387	p += 8;
1388	}
1389
1390	blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
1391	if (!dbd && nb_sectors) {
1392	if (r->req.cmd.buf[0] == MODE_SENSE) {
1393	outbuf[3] = 8; /* Block descriptor length */
1394	} else { /* MODE_SENSE_10 */
1395	outbuf[7] = 8; /* Block descriptor length */
1396	}
1397	nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1398	if (nb_sectors > 0xffffff) {
1399	nb_sectors = 0;
1400	}
1401	p[0] = 0; /* media density code */
1402	p[1] = (nb_sectors >> 16) & 0xff;
1403	p[2] = (nb_sectors >> 8) & 0xff;
1404	p[3] = nb_sectors & 0xff;
1405	p[4] = 0; /* reserved */
1406	p[5] = 0; /* bytes 5-7 are the sector size in bytes */
1407	p[6] = s->qdev.blocksize >> 8;
1408	p[7] = 0;
1409	p += 8;
1410	}
1411
1412	if (page_control == 3) {
1413	/* Saved Values */
1414	scsi_check_condition(r, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED));
1415	return -1;
1416	}
1417
1418	if (page == 0x3f) {
1419	for (page = 0; page <= 0x3e; page++) {
1420	mode_sense_page(s, page, &p, page_control);
1421	}
1422	} else {
1423	ret = mode_sense_page(s, page, &p, page_control);
1424	if (ret == -1) {
1425	return -1;
1426	}
1427	}
1428
1429	buflen = p - outbuf;
1430	/*
1431	* The mode data length field specifies the length in bytes of the
1432	* following data that is available to be transferred. The mode data
1433	* length does not include itself.
1434	*/
1435	if (r->req.cmd.buf[0] == MODE_SENSE) {
1436	outbuf[0] = buflen - 1;
1437	} else { /* MODE_SENSE_10 */
1438	outbuf[0] = ((buflen - 2) >> 8) & 0xff;
1439	outbuf[1] = (buflen - 2) & 0xff;
1440	}
1441	return buflen;
1442	}
1443
1444	static int scsi_disk_emulate_read_toc(SCSIRequest req, uint8_t outbuf)
1445	{
1446	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1447	int start_track, format, msf, toclen;
1448	uint64_t nb_sectors;
1449
1450	msf = req->cmd.buf[1] & 2;
1451	format = req->cmd.buf[2] & 0xf;
1452	start_track = req->cmd.buf[6];
1453	blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
1454	trace_scsi_disk_emulate_read_toc(start_track, format, msf >> 1);
1455	nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
1456	switch (format) {
1457	case 0:
1458	toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
1459	break;
1460	case 1:
1461	/* multi session : only a single session defined */
1462	toclen = 12;
1463	memset(outbuf, 0, 12);
1464	outbuf[1] = 0x0a;
1465	outbuf[2] = 0x01;
1466	outbuf[3] = 0x01;
1467	break;
1468	case 2:
1469	toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
1470	break;
1471	default:
1472	return -1;
1473	}
1474	return toclen;
1475	}
1476
1477	static int scsi_disk_emulate_start_stop(SCSIDiskReq *r)
1478	{
1479	SCSIRequest *req = &r->req;
1480	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1481	bool start = req->cmd.buf[4] & 1;
1482	bool loej = req->cmd.buf[4] & 2; /* load on start, eject on !start */
1483	int pwrcnd = req->cmd.buf[4] & 0xf0;
1484
1485	if (pwrcnd) {
1486	/* eject/load only happens for power condition == 0 */
1487	return 0;
1488	}
1489
1490	if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) && loej) {
1491	if (!start && !s->tray_open && s->tray_locked) {
1492	scsi_check_condition(r,
1493	blk_is_inserted(s->qdev.conf.blk)
1494	? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED)
1495	: SENSE_CODE(NOT_READY_REMOVAL_PREVENTED));
1496	return -1;
1497	}
1498
1499	if (s->tray_open != !start) {
1500	blk_eject(s->qdev.conf.blk, !start);
1501	s->tray_open = !start;
1502	}
1503	}
1504	return 0;
1505	}
1506
1507	static void scsi_disk_emulate_read_data(SCSIRequest *req)
1508	{
1509	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1510	int buflen = r->iov.iov_len;
1511
1512	if (buflen) {
1513	trace_scsi_disk_emulate_read_data(buflen);
1514	r->iov.iov_len = 0;
1515	r->started = true;
1516	scsi_req_data(&r->req, buflen);
1517	return;
1518	}
1519
1520	/* This also clears the sense buffer for REQUEST SENSE. */
1521	scsi_req_complete(&r->req, GOOD);
1522	}
1523
1524	static int scsi_disk_check_mode_select(SCSIDiskState *s, int page,
1525	uint8_t *inbuf, int inlen)
1526	{
1527	uint8_t mode_current[SCSI_MAX_MODE_LEN] = { 0 };
1528	uint8_t mode_changeable[SCSI_MAX_MODE_LEN];
1529	uint8_t *p;
1530	int len, expected_len, changeable_len, i;
1531
1532	/* The input buffer does not include the page header, so it is
1533	* off by 2 bytes.
1534	*/
1535	expected_len = inlen + 2;
1536	if (expected_len > SCSI_MAX_MODE_LEN) {
1537	return -1;
1538	}
1539
1540	/* MODE_PAGE_ALLS is only valid for MODE SENSE commands */
1541	if (page == MODE_PAGE_ALLS) {
1542	return -1;
1543	}
1544
1545	p = mode_current;
1546	len = mode_sense_page(s, page, &p, 0);
1547	/* The guest may send a truncated page, but not a longer one. */
1548	if (len < 0 \|\| expected_len > len) {
1549	return -1;
1550	}
1551
1552	p = mode_changeable;
1553	memset(mode_changeable, 0, len);
1554	changeable_len = mode_sense_page(s, page, &p, 1);
1555	assert(changeable_len == len);
1556
1557	/* Check that unchangeable bits are the same as what MODE SENSE
1558	* would return.
1559	*/
1560	for (i = 2; i < expected_len; i++) {
1561	if (((mode_current[i] ^ inbuf[i - 2]) & ~mode_changeable[i]) != 0) {
1562	return -1;
1563	}
1564	}
1565	return 0;
1566	}
1567
1568	/* Note p may be truncated, so check any bytes you access against len. */
1569	static void scsi_disk_apply_mode_select(SCSIDiskState *s, int page,
1570	uint8_t *p, int len)
1571	{
1572	switch (page) {
1573	case MODE_PAGE_CACHING:
1574	if (len > 0) {
1575	blk_set_enable_write_cache(s->qdev.conf.blk, (p[0] & 4) != 0);
1576	}
1577	break;
1578
1579	default:
1580	break;
1581	}
1582	}
1583
1584	static int mode_select_pages(SCSIDiskReq r, uint8_t p, int len, bool change)
1585	{
1586	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1587
1588	while (len > 0) {
1589	int page, subpage, page_len;
1590
1591	/* Parse both possible formats for the mode page headers. */
1592	page = p[0] & 0x3f;
1593	if (p[0] & 0x40) {
1594	if (len < 4) {
1595	goto invalid_param_len;
1596	}
1597	subpage = p[1];
1598	page_len = lduw_be_p(&p[2]);
1599	p += 4;
1600	len -= 4;
1601	} else {
1602	if (len < 2) {
1603	goto invalid_param_len;
1604	}
1605	subpage = 0;
1606	page_len = p[1];
1607	p += 2;
1608	len -= 2;
1609	}
1610
1611	if (subpage) {
1612	goto invalid_param;
1613	}
1614	if (page_len > len) {
1615	if (!(s->quirks & SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED)) {
1616	goto invalid_param_len;
1617	}
1618	trace_scsi_disk_mode_select_page_truncated(page, page_len, len);
1619	page_len = len;
1620	}
1621
1622	if (!change) {
1623	if (scsi_disk_check_mode_select(s, page, p, page_len) < 0) {
1624	goto invalid_param;
1625	}
1626	} else {
1627	scsi_disk_apply_mode_select(s, page, p, page_len);
1628	}
1629
1630	p += page_len;
1631	len -= page_len;
1632	}
1633	return 0;
1634
1635	invalid_param:
1636	scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1637	return -1;
1638
1639	invalid_param_len:
1640	scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1641	return -1;
1642	}
1643
1644	static void scsi_disk_emulate_mode_select(SCSIDiskReq r, uint8_t inbuf)
1645	{
1646	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1647	uint8_t *p = inbuf;
1648	int cmd = r->req.cmd.buf[0];
1649	int len = r->req.cmd.xfer;
1650	int hdr_len = (cmd == MODE_SELECT ? 4 : 8);
1651	int bd_len, bs;
1652	int pass;
1653
1654	if ((r->req.cmd.buf[1] & 0x11) != 0x10) {
1655	if (!(s->quirks &
1656	(1 << SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE))) {
1657	/* We only support PF=1, SP=0. */
1658	goto invalid_field;
1659	}
1660	}
1661
1662	if (len < hdr_len) {
1663	goto invalid_param_len;
1664	}
1665
1666	bd_len = (cmd == MODE_SELECT ? p[3] : lduw_be_p(&p[6]));
1667	len -= hdr_len;
1668	p += hdr_len;
1669	if (len < bd_len) {
1670	goto invalid_param_len;
1671	}
1672	if (bd_len != 0 && bd_len != 8) {
1673	goto invalid_param;
1674	}
1675
1676	/*
1677	* Allow changing the block size only if the quirk is enabled for it.
1678	* Writing s->qdev.blocksize is not thread safe!
1679	*/
1680	if (bd_len && (s->quirks &
1681	(1 << SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE))) {
1682	bs = p[5] << 16 \| p[6] << 8 \| p[7];
1683
1684	/*
1685	* Since the existing code only checks/updates bits 8-15 of the block
1686	* size, restrict ourselves to the same requirement for now to ensure
1687	* that a block size set by a block descriptor and then read back by
1688	* a subsequent SCSI command will be the same. Also disallow a block
1689	* size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE.
1690	*/
1691	if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) {
1692	s->qdev.blocksize = bs;
1693	trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize);
1694	}
1695	}
1696
1697	len -= bd_len;
1698	p += bd_len;
1699
1700	/* Ensure no change is made if there is an error! */
1701	for (pass = 0; pass < 2; pass++) {
1702	if (mode_select_pages(r, p, len, pass == 1) < 0) {
1703	assert(pass == 0);
1704	return;
1705	}
1706	}
1707	if (!blk_enable_write_cache(s->qdev.conf.blk)) {
1708	/* The request is used as the AIO opaque value, so add a ref. */
1709	scsi_req_ref(&r->req);
1710	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
1711	BLOCK_ACCT_FLUSH);
1712	r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
1713	return;
1714	}
1715
1716	scsi_req_complete(&r->req, GOOD);
1717	return;
1718
1719	invalid_param:
1720	scsi_check_condition(r, SENSE_CODE(INVALID_PARAM));
1721	return;
1722
1723	invalid_param_len:
1724	scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1725	return;
1726
1727	invalid_field:
1728	scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1729	}
1730
1731	/* sector_num and nb_sectors expected to be in qdev blocksize */
1732	static inline bool check_lba_range(SCSIDiskState *s,
1733	uint64_t sector_num, uint32_t nb_sectors)
1734	{
1735	/*
1736	* The first line tests that no overflow happens when computing the last
1737	* sector. The second line tests that the last accessed sector is in
1738	* range.
1739	*
1740	* Careful, the computations should not underflow for nb_sectors == 0,
1741	* and a 0-block read to the first LBA beyond the end of device is
1742	* valid.
1743	*/
1744	return (sector_num <= sector_num + nb_sectors &&
1745	sector_num + nb_sectors <= s->qdev.max_lba + 1);
1746	}
1747
1748	typedef struct UnmapCBData {
1749	SCSIDiskReq *r;
1750	uint8_t *inbuf;
1751	int count;
1752	} UnmapCBData;
1753
1754	static void scsi_unmap_complete(void *opaque, int ret);
1755
1756	static void scsi_unmap_complete_noio(UnmapCBData *data, int ret)
1757	{
1758	SCSIDiskReq *r = data->r;
1759	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1760
1761	assert(r->req.aiocb == NULL);
1762
1763	if (data->count > 0) {
1764	uint64_t sector_num = ldq_be_p(&data->inbuf[0]);
1765	uint32_t nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
1766	r->sector = sector_num * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1767	r->sector_count = nb_sectors * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1768
1769	if (!check_lba_range(s, sector_num, nb_sectors)) {
1770	block_acct_invalid(blk_get_stats(s->qdev.conf.blk),
1771	BLOCK_ACCT_UNMAP);
1772	scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1773	goto done;
1774	}
1775
1776	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1777	r->sector_count * BDRV_SECTOR_SIZE,
1778	BLOCK_ACCT_UNMAP);
1779
1780	r->req.aiocb = blk_aio_pdiscard(s->qdev.conf.blk,
1781	r->sector * BDRV_SECTOR_SIZE,
1782	r->sector_count * BDRV_SECTOR_SIZE,
1783	scsi_unmap_complete, data);
1784	data->count--;
1785	data->inbuf += 16;
1786	return;
1787	}
1788
1789	scsi_req_complete(&r->req, GOOD);
1790
1791	done:
1792	scsi_req_unref(&r->req);
1793	g_free(data);
1794	}
1795
1796	static void scsi_unmap_complete(void *opaque, int ret)
1797	{
1798	UnmapCBData *data = opaque;
1799	SCSIDiskReq *r = data->r;
1800	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1801
1802	assert(r->req.aiocb != NULL);
1803	r->req.aiocb = NULL;
1804
1805	if (scsi_disk_req_check_error(r, ret, true)) {
1806	scsi_req_unref(&r->req);
1807	g_free(data);
1808	} else {
1809	block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
1810	scsi_unmap_complete_noio(data, ret);
1811	}
1812	}
1813
1814	static void scsi_disk_emulate_unmap(SCSIDiskReq r, uint8_t inbuf)
1815	{
1816	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1817	uint8_t *p = inbuf;
1818	int len = r->req.cmd.xfer;
1819	UnmapCBData *data;
1820
1821	/* Reject ANCHOR=1. */
1822	if (r->req.cmd.buf[1] & 0x1) {
1823	goto invalid_field;
1824	}
1825
1826	if (len < 8) {
1827	goto invalid_param_len;
1828	}
1829	if (len < lduw_be_p(&p[0]) + 2) {
1830	goto invalid_param_len;
1831	}
1832	if (len < lduw_be_p(&p[2]) + 8) {
1833	goto invalid_param_len;
1834	}
1835	if (lduw_be_p(&p[2]) & 15) {
1836	goto invalid_param_len;
1837	}
1838
1839	if (!blk_is_writable(s->qdev.conf.blk)) {
1840	block_acct_invalid(blk_get_stats(s->qdev.conf.blk), BLOCK_ACCT_UNMAP);
1841	scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1842	return;
1843	}
1844
1845	data = g_new0(UnmapCBData, 1);
1846	data->r = r;
1847	data->inbuf = &p[8];
1848	data->count = lduw_be_p(&p[2]) >> 4;
1849
1850	/* The matching unref is in scsi_unmap_complete, before data is freed. */
1851	scsi_req_ref(&r->req);
1852	scsi_unmap_complete_noio(data, 0);
1853	return;
1854
1855	invalid_param_len:
1856	block_acct_invalid(blk_get_stats(s->qdev.conf.blk), BLOCK_ACCT_UNMAP);
1857	scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN));
1858	return;
1859
1860	invalid_field:
1861	block_acct_invalid(blk_get_stats(s->qdev.conf.blk), BLOCK_ACCT_UNMAP);
1862	scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1863	}
1864
1865	typedef struct WriteSameCBData {
1866	SCSIDiskReq *r;
1867	int64_t sector;
1868	int nb_sectors;
1869	QEMUIOVector qiov;
1870	struct iovec iov;
1871	} WriteSameCBData;
1872
1873	static void scsi_write_same_complete(void *opaque, int ret)
1874	{
1875	WriteSameCBData *data = opaque;
1876	SCSIDiskReq *r = data->r;
1877	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
1878
1879	assert(r->req.aiocb != NULL);
1880	r->req.aiocb = NULL;
1881
1882	if (scsi_disk_req_check_error(r, ret, true)) {
1883	goto done;
1884	}
1885
1886	block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
1887
1888	data->nb_sectors -= data->iov.iov_len / BDRV_SECTOR_SIZE;
1889	data->sector += data->iov.iov_len / BDRV_SECTOR_SIZE;
1890	data->iov.iov_len = MIN(data->nb_sectors * BDRV_SECTOR_SIZE,
1891	data->iov.iov_len);
1892	if (data->iov.iov_len) {
1893	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1894	data->iov.iov_len, BLOCK_ACCT_WRITE);
1895	/* Reinitialize qiov, to handle unaligned WRITE SAME request
1896	* where final qiov may need smaller size */
1897	qemu_iovec_init_external(&data->qiov, &data->iov, 1);
1898	r->req.aiocb = blk_aio_pwritev(s->qdev.conf.blk,
1899	data->sector << BDRV_SECTOR_BITS,
1900	&data->qiov, 0,
1901	scsi_write_same_complete, data);
1902	return;
1903	}
1904
1905	scsi_req_complete(&r->req, GOOD);
1906
1907	done:
1908	scsi_req_unref(&r->req);
1909	qemu_vfree(data->iov.iov_base);
1910	g_free(data);
1911	}
1912
1913	static void scsi_disk_emulate_write_same(SCSIDiskReq r, uint8_t inbuf)
1914	{
1915	SCSIRequest *req = &r->req;
1916	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
1917	uint32_t nb_sectors = scsi_data_cdb_xfer(r->req.cmd.buf);
1918	uint32_t buflen = MIN(s->qdev.blocksize, r->buflen);
1919	WriteSameCBData *data;
1920	uint8_t *buf;
1921	int i, l;
1922
1923	/* Fail if PBDATA=1 or LBDATA=1 or ANCHOR=1. */
1924	if (nb_sectors == 0 \|\| (req->cmd.buf[1] & 0x16)) {
1925	scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
1926	return;
1927	}
1928
1929	if (!blk_is_writable(s->qdev.conf.blk)) {
1930	scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
1931	return;
1932	}
1933	if (!check_lba_range(s, r->req.cmd.lba, nb_sectors)) {
1934	scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
1935	return;
1936	}
1937
1938	if ((req->cmd.buf[1] & 0x1) \|\| buffer_is_zero(inbuf, buflen)) {
1939	int flags = (req->cmd.buf[1] & 0x8) ? BDRV_REQ_MAY_UNMAP : 0;
1940
1941	/* The request is used as the AIO opaque value, so add a ref. */
1942	scsi_req_ref(&r->req);
1943	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1944	nb_sectors * s->qdev.blocksize,
1945	BLOCK_ACCT_WRITE);
1946	r->req.aiocb = blk_aio_pwrite_zeroes(s->qdev.conf.blk,
1947	r->req.cmd.lba * s->qdev.blocksize,
1948	nb_sectors * s->qdev.blocksize,
1949	flags, scsi_aio_complete, r);
1950	return;
1951	}
1952
1953	data = g_new0(WriteSameCBData, 1);
1954	data->r = r;
1955	data->sector = r->req.cmd.lba * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1956	data->nb_sectors = nb_sectors * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
1957	data->iov.iov_len = MIN(data->nb_sectors * BDRV_SECTOR_SIZE,
1958	SCSI_WRITE_SAME_MAX);
1959	data->iov.iov_base = buf = blk_blockalign(s->qdev.conf.blk,
1960	data->iov.iov_len);
1961	qemu_iovec_init_external(&data->qiov, &data->iov, 1);
1962
1963	for (i = 0; i < data->iov.iov_len; i += l) {
1964	l = MIN(buflen, data->iov.iov_len - i);
1965	memcpy(&buf[i], inbuf, l);
1966	}
1967
1968	scsi_req_ref(&r->req);
1969	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,
1970	data->iov.iov_len, BLOCK_ACCT_WRITE);
1971	r->req.aiocb = blk_aio_pwritev(s->qdev.conf.blk,
1972	data->sector << BDRV_SECTOR_BITS,
1973	&data->qiov, 0,
1974	scsi_write_same_complete, data);
1975	}
1976
1977	static void scsi_disk_emulate_write_data(SCSIRequest *req)
1978	{
1979	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
1980
1981	if (r->iov.iov_len) {
1982	int buflen = r->iov.iov_len;
1983	trace_scsi_disk_emulate_write_data(buflen);
1984	r->iov.iov_len = 0;
1985	scsi_req_data(&r->req, buflen);
1986	return;
1987	}
1988
1989	switch (req->cmd.buf[0]) {
1990	case MODE_SELECT:
1991	case MODE_SELECT_10:
1992	/* This also clears the sense buffer for REQUEST SENSE. */
1993	scsi_disk_emulate_mode_select(r, r->iov.iov_base);
1994	break;
1995
1996	case UNMAP:
1997	scsi_disk_emulate_unmap(r, r->iov.iov_base);
1998	break;
1999
2000	case VERIFY_10:
2001	case VERIFY_12:
2002	case VERIFY_16:
2003	if (r->req.status == -1) {
2004	scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
2005	}
2006	break;
2007
2008	case WRITE_SAME_10:
2009	case WRITE_SAME_16:
2010	scsi_disk_emulate_write_same(r, r->iov.iov_base);
2011	break;
2012
2013	case FORMAT_UNIT:
2014	scsi_req_complete(&r->req, GOOD);
2015	break;
2016
2017	default:
2018	abort();
2019	}
2020	}
2021
2022	static int32_t scsi_disk_emulate_command(SCSIRequest req, uint8_t buf)
2023	{
2024	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
2025	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
2026	uint64_t nb_sectors;
2027	uint8_t *outbuf;
2028	int buflen;
2029
2030	switch (req->cmd.buf[0]) {
2031	case INQUIRY:
2032	case MODE_SENSE:
2033	case MODE_SENSE_10:
2034	case RESERVE:
2035	case RESERVE_10:
2036	case RELEASE:
2037	case RELEASE_10:
2038	case START_STOP:
2039	case ALLOW_MEDIUM_REMOVAL:
2040	case GET_CONFIGURATION:
2041	case GET_EVENT_STATUS_NOTIFICATION:
2042	case MECHANISM_STATUS:
2043	case REQUEST_SENSE:
2044	break;
2045
2046	default:
2047	if (!blk_is_available(s->qdev.conf.blk)) {
2048	scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
2049	return 0;
2050	}
2051	break;
2052	}
2053
2054	/*
2055	* FIXME: we shouldn't return anything bigger than 4k, but the code
2056	* requires the buffer to be as big as req->cmd.xfer in several
2057	* places. So, do not allow CDBs with a very large ALLOCATION
2058	* LENGTH. The real fix would be to modify scsi_read_data and
2059	* dma_buf_read, so that they return data beyond the buflen
2060	* as all zeros.
2061	*/
2062	if (req->cmd.xfer > 65536) {
2063	goto illegal_request;
2064	}
2065	r->buflen = MAX(4096, req->cmd.xfer);
2066
2067	if (!r->iov.iov_base) {
2068	r->iov.iov_base = blk_blockalign(s->qdev.conf.blk, r->buflen);
2069	}
2070
2071	outbuf = r->iov.iov_base;
2072	memset(outbuf, 0, r->buflen);
2073	switch (req->cmd.buf[0]) {
2074	case TEST_UNIT_READY:
2075	assert(blk_is_available(s->qdev.conf.blk));
2076	break;
2077	case INQUIRY:
2078	buflen = scsi_disk_emulate_inquiry(req, outbuf);
2079	if (buflen < 0) {
2080	goto illegal_request;
2081	}
2082	break;
2083	case MODE_SENSE:
2084	case MODE_SENSE_10:
2085	buflen = scsi_disk_emulate_mode_sense(r, outbuf);
2086	if (buflen < 0) {
2087	goto illegal_request;
2088	}
2089	break;
2090	case READ_TOC:
2091	buflen = scsi_disk_emulate_read_toc(req, outbuf);
2092	if (buflen < 0) {
2093	goto illegal_request;
2094	}
2095	break;
2096	case RESERVE:
2097	if (req->cmd.buf[1] & 1) {
2098	goto illegal_request;
2099	}
2100	break;
2101	case RESERVE_10:
2102	if (req->cmd.buf[1] & 3) {
2103	goto illegal_request;
2104	}
2105	break;
2106	case RELEASE:
2107	if (req->cmd.buf[1] & 1) {
2108	goto illegal_request;
2109	}
2110	break;
2111	case RELEASE_10:
2112	if (req->cmd.buf[1] & 3) {
2113	goto illegal_request;
2114	}
2115	break;
2116	case START_STOP:
2117	if (scsi_disk_emulate_start_stop(r) < 0) {
2118	return 0;
2119	}
2120	break;
2121	case ALLOW_MEDIUM_REMOVAL:
2122	s->tray_locked = req->cmd.buf[4] & 1;
2123	blk_lock_medium(s->qdev.conf.blk, req->cmd.buf[4] & 1);
2124	break;
2125	case READ_CAPACITY_10:
2126	/* The normal LEN field for this command is zero. */
2127	memset(outbuf, 0, 8);
2128	blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
2129	if (!nb_sectors) {
2130	scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
2131	return 0;
2132	}
2133	if ((req->cmd.buf[8] & 1) == 0 && req->cmd.lba) {
2134	goto illegal_request;
2135	}
2136	nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
2137	/* Returned value is the address of the last sector. */
2138	nb_sectors--;
2139	/* Remember the new size for read/write sanity checking. */
2140	s->qdev.max_lba = nb_sectors;
2141	/* Clip to 2TB, instead of returning capacity modulo 2TB. */
2142	if (nb_sectors > UINT32_MAX) {
2143	nb_sectors = UINT32_MAX;
2144	}
2145	outbuf[0] = (nb_sectors >> 24) & 0xff;
2146	outbuf[1] = (nb_sectors >> 16) & 0xff;
2147	outbuf[2] = (nb_sectors >> 8) & 0xff;
2148	outbuf[3] = nb_sectors & 0xff;
2149	outbuf[4] = 0;
2150	outbuf[5] = 0;
2151	outbuf[6] = s->qdev.blocksize >> 8;
2152	outbuf[7] = 0;
2153	break;
2154	case REQUEST_SENSE:
2155	/* Just return "NO SENSE". */
2156	buflen = scsi_convert_sense(NULL, 0, outbuf, r->buflen,
2157	(req->cmd.buf[1] & 1) == 0);
2158	if (buflen < 0) {
2159	goto illegal_request;
2160	}
2161	break;
2162	case MECHANISM_STATUS:
2163	buflen = scsi_emulate_mechanism_status(s, outbuf);
2164	if (buflen < 0) {
2165	goto illegal_request;
2166	}
2167	break;
2168	case GET_CONFIGURATION:
2169	buflen = scsi_get_configuration(s, outbuf);
2170	if (buflen < 0) {
2171	goto illegal_request;
2172	}
2173	break;
2174	case GET_EVENT_STATUS_NOTIFICATION:
2175	buflen = scsi_get_event_status_notification(s, r, outbuf);
2176	if (buflen < 0) {
2177	goto illegal_request;
2178	}
2179	break;
2180	case READ_DISC_INFORMATION:
2181	buflen = scsi_read_disc_information(s, r, outbuf);
2182	if (buflen < 0) {
2183	goto illegal_request;
2184	}
2185	break;
2186	case READ_DVD_STRUCTURE:
2187	buflen = scsi_read_dvd_structure(s, r, outbuf);
2188	if (buflen < 0) {
2189	goto illegal_request;
2190	}
2191	break;
2192	case SERVICE_ACTION_IN_16:
2193	/* Service Action In subcommands. */
2194	if ((req->cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) {
2195	trace_scsi_disk_emulate_command_SAI_16();
2196	memset(outbuf, 0, req->cmd.xfer);
2197	blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
2198	if (!nb_sectors) {
2199	scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
2200	return 0;
2201	}
2202	if ((req->cmd.buf[14] & 1) == 0 && req->cmd.lba) {
2203	goto illegal_request;
2204	}
2205	nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
2206	/* Returned value is the address of the last sector. */
2207	nb_sectors--;
2208	/* Remember the new size for read/write sanity checking. */
2209	s->qdev.max_lba = nb_sectors;
2210	outbuf[0] = (nb_sectors >> 56) & 0xff;
2211	outbuf[1] = (nb_sectors >> 48) & 0xff;
2212	outbuf[2] = (nb_sectors >> 40) & 0xff;
2213	outbuf[3] = (nb_sectors >> 32) & 0xff;
2214	outbuf[4] = (nb_sectors >> 24) & 0xff;
2215	outbuf[5] = (nb_sectors >> 16) & 0xff;
2216	outbuf[6] = (nb_sectors >> 8) & 0xff;
2217	outbuf[7] = nb_sectors & 0xff;
2218	outbuf[8] = 0;
2219	outbuf[9] = 0;
2220	outbuf[10] = s->qdev.blocksize >> 8;
2221	outbuf[11] = 0;
2222	outbuf[12] = 0;
2223	outbuf[13] = get_physical_block_exp(&s->qdev.conf);
2224
2225	/* set TPE bit if the format supports discard */
2226	if (s->qdev.conf.discard_granularity) {
2227	outbuf[14] = 0x80;
2228	}
2229
2230	/* Protection, exponent and lowest lba field left blank. */
2231	break;
2232	}
2233	trace_scsi_disk_emulate_command_SAI_unsupported();
2234	goto illegal_request;
2235	case SYNCHRONIZE_CACHE:
2236	/* The request is used as the AIO opaque value, so add a ref. */
2237	scsi_req_ref(&r->req);
2238	block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, 0,
2239	BLOCK_ACCT_FLUSH);
2240	r->req.aiocb = blk_aio_flush(s->qdev.conf.blk, scsi_aio_complete, r);
2241	return 0;
2242	case SEEK_10:
2243	trace_scsi_disk_emulate_command_SEEK_10(r->req.cmd.lba);
2244	if (r->req.cmd.lba > s->qdev.max_lba) {
2245	goto illegal_lba;
2246	}
2247	break;
2248	case MODE_SELECT:
2249	trace_scsi_disk_emulate_command_MODE_SELECT(r->req.cmd.xfer);
2250	break;
2251	case MODE_SELECT_10:
2252	trace_scsi_disk_emulate_command_MODE_SELECT_10(r->req.cmd.xfer);
2253	break;
2254	case UNMAP:
2255	trace_scsi_disk_emulate_command_UNMAP(r->req.cmd.xfer);
2256	break;
2257	case VERIFY_10:
2258	case VERIFY_12:
2259	case VERIFY_16:
2260	trace_scsi_disk_emulate_command_VERIFY((req->cmd.buf[1] >> 1) & 3);
2261	if (req->cmd.buf[1] & 6) {
2262	goto illegal_request;
2263	}
2264	break;
2265	case WRITE_SAME_10:
2266	case WRITE_SAME_16:
2267	trace_scsi_disk_emulate_command_WRITE_SAME(
2268	req->cmd.buf[0] == WRITE_SAME_10 ? 10 : 16, r->req.cmd.xfer);
2269	break;
2270	case FORMAT_UNIT:
2271	trace_scsi_disk_emulate_command_FORMAT_UNIT(r->req.cmd.xfer);
2272	break;
2273	default:
2274	trace_scsi_disk_emulate_command_UNKNOWN(buf[0],
2275	scsi_command_name(buf[0]));
2276	scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE));
2277	return 0;
2278	}
2279	assert(!r->req.aiocb);
2280	r->iov.iov_len = MIN(r->buflen, req->cmd.xfer);
2281	if (r->iov.iov_len == 0) {
2282	scsi_req_complete(&r->req, GOOD);
2283	}
2284	if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
2285	assert(r->iov.iov_len == req->cmd.xfer);
2286	return -r->iov.iov_len;
2287	} else {
2288	return r->iov.iov_len;
2289	}
2290
2291	illegal_request:
2292	if (r->req.status == -1) {
2293	scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
2294	}
2295	return 0;
2296
2297	illegal_lba:
2298	scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
2299	return 0;
2300	}
2301
2302	/* Execute a scsi command. Returns the length of the data expected by the
2303	command. This will be Positive for data transfers from the device
2304	(eg. disk reads), negative for transfers to the device (eg. disk writes),
2305	and zero if the command does not transfer any data. */
2306
2307	static int32_t scsi_disk_dma_command(SCSIRequest req, uint8_t buf)
2308	{
2309	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
2310	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
2311	SCSIDiskClass sdc = (SCSIDiskClass ) object_get_class(OBJECT(s));
2312	uint32_t len;
2313	uint8_t command;
2314
2315	command = buf[0];
2316
2317	if (!blk_is_available(s->qdev.conf.blk)) {
2318	scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
2319	return 0;
2320	}
2321
2322	len = scsi_data_cdb_xfer(r->req.cmd.buf);
2323	switch (command) {
2324	case READ_6:
2325	case READ_10:
2326	case READ_12:
2327	case READ_16:
2328	trace_scsi_disk_dma_command_READ(r->req.cmd.lba, len);
2329	/* Protection information is not supported. For SCSI versions 2 and
2330	* older (as determined by snooping the guest's INQUIRY commands),
2331	* there is no RD/WR/VRPROTECT, so skip this check in these versions.
2332	*/
2333	if (s->qdev.scsi_version > 2 && (r->req.cmd.buf[1] & 0xe0)) {
2334	goto illegal_request;
2335	}
2336	if (!check_lba_range(s, r->req.cmd.lba, len)) {
2337	goto illegal_lba;
2338	}
2339	r->sector = r->req.cmd.lba * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
2340	r->sector_count = len * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
2341	break;
2342	case WRITE_6:
2343	case WRITE_10:
2344	case WRITE_12:
2345	case WRITE_16:
2346	case WRITE_VERIFY_10:
2347	case WRITE_VERIFY_12:
2348	case WRITE_VERIFY_16:
2349	if (!blk_is_writable(s->qdev.conf.blk)) {
2350	scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
2351	return 0;
2352	}
2353	trace_scsi_disk_dma_command_WRITE(
2354	(command & 0xe) == 0xe ? "And Verify " : "",
2355	r->req.cmd.lba, len);
2356	/* fall through */
2357	case VERIFY_10:
2358	case VERIFY_12:
2359	case VERIFY_16:
2360	/* We get here only for BYTCHK == 0x01 and only for scsi-block.
2361	* As far as DMA is concerned, we can treat it the same as a write;
2362	* scsi_block_do_sgio will send VERIFY commands.
2363	*/
2364	if (s->qdev.scsi_version > 2 && (r->req.cmd.buf[1] & 0xe0)) {
2365	goto illegal_request;
2366	}
2367	if (!check_lba_range(s, r->req.cmd.lba, len)) {
2368	goto illegal_lba;
2369	}
2370	r->sector = r->req.cmd.lba * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
2371	r->sector_count = len * (s->qdev.blocksize / BDRV_SECTOR_SIZE);
2372	break;
2373	default:
2374	abort();
2375	illegal_request:
2376	scsi_check_condition(r, SENSE_CODE(INVALID_FIELD));
2377	return 0;
2378	illegal_lba:
2379	scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
2380	return 0;
2381	}
2382	r->need_fua = sdc->need_fua(&r->req.cmd);
2383	if (r->sector_count == 0) {
2384	scsi_req_complete(&r->req, GOOD);
2385	}
2386	assert(r->iov.iov_len == 0);
2387	if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
2388	return -r->sector_count * BDRV_SECTOR_SIZE;
2389	} else {
2390	return r->sector_count * BDRV_SECTOR_SIZE;
2391	}
2392	}
2393
2394	static void scsi_disk_reset(DeviceState *dev)
2395	{
2396	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev.qdev, dev);
2397	uint64_t nb_sectors;
2398
2399	scsi_device_purge_requests(&s->qdev, SENSE_CODE(RESET));
2400
2401	blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
2402
2403	nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
2404	if (nb_sectors) {
2405	nb_sectors--;
2406	}
2407	s->qdev.max_lba = nb_sectors;
2408	/* reset tray statuses */
2409	s->tray_locked = 0;
2410	s->tray_open = 0;
2411
2412	s->qdev.scsi_version = s->qdev.default_scsi_version;
2413	}
2414
2415	static void scsi_disk_drained_begin(void *opaque)
2416	{
2417	SCSIDiskState *s = opaque;
2418
2419	scsi_device_drained_begin(&s->qdev);
2420	}
2421
2422	static void scsi_disk_drained_end(void *opaque)
2423	{
2424	SCSIDiskState *s = opaque;
2425
2426	scsi_device_drained_end(&s->qdev);
2427	}
2428
2429	static void scsi_disk_resize_cb(void *opaque)
2430	{
2431	SCSIDiskState *s = opaque;
2432
2433	/* SPC lists this sense code as available only for
2434	* direct-access devices.
2435	*/
2436	if (s->qdev.type == TYPE_DISK) {
2437	scsi_device_report_change(&s->qdev, SENSE_CODE(CAPACITY_CHANGED));
2438	}
2439	}
2440
2441	static void scsi_cd_change_media_cb(void opaque, bool load, Error *errp)
2442	{
2443	SCSIDiskState *s = opaque;
2444
2445	/*
2446	* When a CD gets changed, we have to report an ejected state and
2447	* then a loaded state to guests so that they detect tray
2448	* open/close and media change events. Guests that do not use
2449	* GET_EVENT_STATUS_NOTIFICATION to detect such tray open/close
2450	* states rely on this behavior.
2451	*
2452	* media_changed governs the state machine used for unit attention
2453	* report. media_event is used by GET EVENT STATUS NOTIFICATION.
2454	*/
2455	s->media_changed = load;
2456	s->tray_open = !load;
2457	scsi_device_set_ua(&s->qdev, SENSE_CODE(UNIT_ATTENTION_NO_MEDIUM));
2458	s->media_event = true;
2459	s->eject_request = false;
2460	}
2461
2462	static void scsi_cd_eject_request_cb(void *opaque, bool force)
2463	{
2464	SCSIDiskState *s = opaque;
2465
2466	s->eject_request = true;
2467	if (force) {
2468	s->tray_locked = false;
2469	}
2470	}
2471
2472	static bool scsi_cd_is_tray_open(void *opaque)
2473	{
2474	return ((SCSIDiskState *)opaque)->tray_open;
2475	}
2476
2477	static bool scsi_cd_is_medium_locked(void *opaque)
2478	{
2479	return ((SCSIDiskState *)opaque)->tray_locked;
2480	}
2481
2482	static const BlockDevOps scsi_disk_removable_block_ops = {
2483	.change_media_cb = scsi_cd_change_media_cb,
2484	.drained_begin = scsi_disk_drained_begin,
2485	.drained_end = scsi_disk_drained_end,
2486	.eject_request_cb = scsi_cd_eject_request_cb,
2487	.is_medium_locked = scsi_cd_is_medium_locked,
2488	.is_tray_open = scsi_cd_is_tray_open,
2489	.resize_cb = scsi_disk_resize_cb,
2490	};
2491
2492	static const BlockDevOps scsi_disk_block_ops = {
2493	.drained_begin = scsi_disk_drained_begin,
2494	.drained_end = scsi_disk_drained_end,
2495	.resize_cb = scsi_disk_resize_cb,
2496	};
2497
2498	static void scsi_disk_unit_attention_reported(SCSIDevice *dev)
2499	{
2500	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2501	if (s->media_changed) {
2502	s->media_changed = false;
2503	scsi_device_set_ua(&s->qdev, SENSE_CODE(MEDIUM_CHANGED));
2504	}
2505	}
2506
2507	static void scsi_realize(SCSIDevice dev, Error *errp)
2508	{
2509	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2510	bool read_only;
2511
2512	if (!s->qdev.conf.blk) {
2513	error_setg(errp, "drive property not set");
2514	return;
2515	}
2516
2517	if (!(s->features & (1 << SCSI_DISK_F_REMOVABLE)) &&
2518	!blk_is_inserted(s->qdev.conf.blk)) {
2519	error_setg(errp, "Device needs media, but drive is empty");
2520	return;
2521	}
2522
2523	if (!blkconf_blocksizes(&s->qdev.conf, errp)) {
2524	return;
2525	}
2526
2527	if (blk_get_aio_context(s->qdev.conf.blk) != qemu_get_aio_context() &&
2528	!s->qdev.hba_supports_iothread)
2529	{
2530	error_setg(errp, "HBA does not support iothreads");
2531	return;
2532	}
2533
2534	if (dev->type == TYPE_DISK) {
2535	if (!blkconf_geometry(&dev->conf, NULL, 65535, 255, 255, errp)) {
2536	return;
2537	}
2538	}
2539
2540	read_only = !blk_supports_write_perm(s->qdev.conf.blk);
2541	if (dev->type == TYPE_ROM) {
2542	read_only = true;
2543	}
2544
2545	if (!blkconf_apply_backend_options(&dev->conf, read_only,
2546	dev->type == TYPE_DISK, errp)) {
2547	return;
2548	}
2549
2550	if (s->qdev.conf.discard_granularity == -1) {
2551	s->qdev.conf.discard_granularity =
2552	MAX(s->qdev.conf.logical_block_size, DEFAULT_DISCARD_GRANULARITY);
2553	}
2554
2555	if (!s->version) {
2556	s->version = g_strdup(QEMU_HW_VERSION);
2557	}
2558	if (!s->vendor) {
2559	s->vendor = g_strdup("QEMU");
2560	}
2561	if (s->serial && strlen(s->serial) > MAX_SERIAL_LEN) {
2562	error_setg(errp, "The serial number can't be longer than %d characters",
2563	MAX_SERIAL_LEN);
2564	return;
2565	}
2566	if (!s->device_id) {
2567	if (s->serial) {
2568	if (strlen(s->serial) > MAX_SERIAL_LEN_FOR_DEVID) {
2569	error_setg(errp, "The serial number can't be longer than %d "
2570	"characters when it is also used as the default for "
2571	"device_id", MAX_SERIAL_LEN_FOR_DEVID);
2572	return;
2573	}
2574	s->device_id = g_strdup(s->serial);
2575	} else {
2576	const char *str = blk_name(s->qdev.conf.blk);
2577	if (str && *str) {
2578	s->device_id = g_strdup(str);
2579	}
2580	}
2581	}
2582
2583	if (blk_is_sg(s->qdev.conf.blk)) {
2584	error_setg(errp, "unwanted /dev/sg*");
2585	return;
2586	}
2587
2588	if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) &&
2589	!(s->features & (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS))) {
2590	blk_set_dev_ops(s->qdev.conf.blk, &scsi_disk_removable_block_ops, s);
2591	} else {
2592	blk_set_dev_ops(s->qdev.conf.blk, &scsi_disk_block_ops, s);
2593	}
2594
2595	blk_iostatus_enable(s->qdev.conf.blk);
2596
2597	add_boot_device_lchs(&dev->qdev, NULL,
2598	dev->conf.lcyls,
2599	dev->conf.lheads,
2600	dev->conf.lsecs);
2601	}
2602
2603	static void scsi_unrealize(SCSIDevice *dev)
2604	{
2605	del_boot_device_lchs(&dev->qdev, NULL);
2606	}
2607
2608	static void scsi_hd_realize(SCSIDevice dev, Error *errp)
2609	{
2610	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2611
2612	/* can happen for devices without drive. The error message for missing
2613	* backend will be issued in scsi_realize
2614	*/
2615	if (s->qdev.conf.blk) {
2616	if (!blkconf_blocksizes(&s->qdev.conf, errp)) {
2617	return;
2618	}
2619	}
2620	s->qdev.blocksize = s->qdev.conf.logical_block_size;
2621	s->qdev.type = TYPE_DISK;
2622	if (!s->product) {
2623	s->product = g_strdup("QEMU HARDDISK");
2624	}
2625	scsi_realize(&s->qdev, errp);
2626	}
2627
2628	static void scsi_cd_realize(SCSIDevice dev, Error *errp)
2629	{
2630	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2631	int ret;
2632	uint32_t blocksize = 2048;
2633
2634	if (!dev->conf.blk) {
2635	/* Anonymous BlockBackend for an empty drive. As we put it into
2636	* dev->conf, qdev takes care of detaching on unplug. */
2637	dev->conf.blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
2638	ret = blk_attach_dev(dev->conf.blk, &dev->qdev);
2639	assert(ret == 0);
2640	}
2641
2642	if (dev->conf.physical_block_size != 0) {
2643	blocksize = dev->conf.physical_block_size;
2644	}
2645
2646	s->qdev.blocksize = blocksize;
2647	s->qdev.type = TYPE_ROM;
2648	s->features \|= 1 << SCSI_DISK_F_REMOVABLE;
2649	if (!s->product) {
2650	s->product = g_strdup("QEMU CD-ROM");
2651	}
2652	scsi_realize(&s->qdev, errp);
2653	}
2654
2655
2656	static const SCSIReqOps scsi_disk_emulate_reqops = {
2657	.size = sizeof(SCSIDiskReq),
2658	.free_req = scsi_free_request,
2659	.send_command = scsi_disk_emulate_command,
2660	.read_data = scsi_disk_emulate_read_data,
2661	.write_data = scsi_disk_emulate_write_data,
2662	.get_buf = scsi_get_buf,
2663	.load_request = scsi_disk_emulate_load_request,
2664	.save_request = scsi_disk_emulate_save_request,
2665	};
2666
2667	static const SCSIReqOps scsi_disk_dma_reqops = {
2668	.size = sizeof(SCSIDiskReq),
2669	.free_req = scsi_free_request,
2670	.send_command = scsi_disk_dma_command,
2671	.read_data = scsi_read_data,
2672	.write_data = scsi_write_data,
2673	.get_buf = scsi_get_buf,
2674	.load_request = scsi_disk_load_request,
2675	.save_request = scsi_disk_save_request,
2676	};
2677
2678	static const SCSIReqOps *const scsi_disk_reqops_dispatch[256] = {
2679	[TEST_UNIT_READY] = &scsi_disk_emulate_reqops,
2680	[INQUIRY] = &scsi_disk_emulate_reqops,
2681	[MODE_SENSE] = &scsi_disk_emulate_reqops,
2682	[MODE_SENSE_10] = &scsi_disk_emulate_reqops,
2683	[START_STOP] = &scsi_disk_emulate_reqops,
2684	[ALLOW_MEDIUM_REMOVAL] = &scsi_disk_emulate_reqops,
2685	[READ_CAPACITY_10] = &scsi_disk_emulate_reqops,
2686	[READ_TOC] = &scsi_disk_emulate_reqops,
2687	[READ_DVD_STRUCTURE] = &scsi_disk_emulate_reqops,
2688	[READ_DISC_INFORMATION] = &scsi_disk_emulate_reqops,
2689	[GET_CONFIGURATION] = &scsi_disk_emulate_reqops,
2690	[GET_EVENT_STATUS_NOTIFICATION] = &scsi_disk_emulate_reqops,
2691	[MECHANISM_STATUS] = &scsi_disk_emulate_reqops,
2692	[SERVICE_ACTION_IN_16] = &scsi_disk_emulate_reqops,
2693	[REQUEST_SENSE] = &scsi_disk_emulate_reqops,
2694	[SYNCHRONIZE_CACHE] = &scsi_disk_emulate_reqops,
2695	[SEEK_10] = &scsi_disk_emulate_reqops,
2696	[MODE_SELECT] = &scsi_disk_emulate_reqops,
2697	[MODE_SELECT_10] = &scsi_disk_emulate_reqops,
2698	[UNMAP] = &scsi_disk_emulate_reqops,
2699	[WRITE_SAME_10] = &scsi_disk_emulate_reqops,
2700	[WRITE_SAME_16] = &scsi_disk_emulate_reqops,
2701	[VERIFY_10] = &scsi_disk_emulate_reqops,
2702	[VERIFY_12] = &scsi_disk_emulate_reqops,
2703	[VERIFY_16] = &scsi_disk_emulate_reqops,
2704	[FORMAT_UNIT] = &scsi_disk_emulate_reqops,
2705
2706	[READ_6] = &scsi_disk_dma_reqops,
2707	[READ_10] = &scsi_disk_dma_reqops,
2708	[READ_12] = &scsi_disk_dma_reqops,
2709	[READ_16] = &scsi_disk_dma_reqops,
2710	[WRITE_6] = &scsi_disk_dma_reqops,
2711	[WRITE_10] = &scsi_disk_dma_reqops,
2712	[WRITE_12] = &scsi_disk_dma_reqops,
2713	[WRITE_16] = &scsi_disk_dma_reqops,
2714	[WRITE_VERIFY_10] = &scsi_disk_dma_reqops,
2715	[WRITE_VERIFY_12] = &scsi_disk_dma_reqops,
2716	[WRITE_VERIFY_16] = &scsi_disk_dma_reqops,
2717	};
2718
2719	static void scsi_disk_new_request_dump(uint32_t lun, uint32_t tag, uint8_t *buf)
2720	{
2721	int len = scsi_cdb_length(buf);
2722	g_autoptr(GString) str = NULL;
2723
2724	assert(len > 0 && len <= 16);
2725	str = qemu_hexdump_line(NULL, buf, len, 1, 0);
2726	trace_scsi_disk_new_request(lun, tag, str->str);
2727	}
2728
2729	static SCSIRequest scsi_new_request(SCSIDevice d, uint32_t tag, uint32_t lun,
2730	uint8_t buf, void hba_private)
2731	{
2732	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
2733	SCSIRequest *req;
2734	const SCSIReqOps *ops;
2735	uint8_t command;
2736
2737	command = buf[0];
2738	ops = scsi_disk_reqops_dispatch[command];
2739	if (!ops) {
2740	ops = &scsi_disk_emulate_reqops;
2741	}
2742	req = scsi_req_alloc(ops, &s->qdev, tag, lun, hba_private);
2743
2744	if (trace_event_get_state_backends(TRACE_SCSI_DISK_NEW_REQUEST)) {
2745	scsi_disk_new_request_dump(lun, tag, buf);
2746	}
2747
2748	return req;
2749	}
2750
2751	#ifdef __linux__
2752	/*
2753	* Preempt on the SCSI Persistent Reservation on the source when migration
2754	* fails because the destination may have already preempted and we need to get
2755	* the reservation back.
2756	*/
2757	static int scsi_block_migration_notifier(NotifierWithReturn *notifier,
2758	MigrationEvent e, Error *errp)
2759	{
2760	if (e->type == MIG_EVENT_FAILED) {
2761	SCSIDiskState *s =
2762	container_of(notifier, SCSIDiskState, migration_notifier);
2763	SCSIDevice *d = &s->qdev;
2764	Error *local_err = NULL;
2765
2766	if (!scsi_generic_pr_state_preempt(d, &local_err)) {
2767	/* MIG_EVENT_FAILED cannot fail, so just warn */
2768	error_prepend(&local_err, "scsi-block migration rollback: ");
2769	warn_report_err(local_err);
2770	}
2771	}
2772	return 0;
2773	}
2774
2775	static int get_device_type(SCSIDiskState *s)
2776	{
2777	uint8_t cmd[16];
2778	uint8_t buf[36];
2779	int ret;
2780
2781	memset(cmd, 0, sizeof(cmd));
2782	memset(buf, 0, sizeof(buf));
2783	cmd[0] = INQUIRY;
2784	cmd[4] = sizeof(buf);
2785
2786	ret = scsi_SG_IO(s->qdev.conf.blk, SG_DXFER_FROM_DEV, cmd, sizeof(cmd),
2787	buf, sizeof(buf), s->qdev.io_timeout, NULL);
2788	if (ret < 0) {
2789	return -1;
2790	}
2791	s->qdev.type = buf[0];
2792	if (buf[1] & 0x80) {
2793	s->features \|= 1 << SCSI_DISK_F_REMOVABLE;
2794	}
2795	return 0;
2796	}
2797
2798	static void scsi_block_realize(SCSIDevice dev, Error *errp)
2799	{
2800	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2801	int sg_version;
2802	int rc;
2803
2804	if (!s->qdev.conf.blk) {
2805	error_setg(errp, "drive property not set");
2806	return;
2807	}
2808
2809	if (s->rotation_rate) {
2810	error_report_once("rotation_rate is specified for scsi-block but is "
2811	"not implemented. This option is deprecated and will "
2812	"be removed in a future version");
2813	}
2814
2815	/* check we are using a driver managing SG_IO (version 3 and after) */
2816	rc = blk_ioctl(s->qdev.conf.blk, SG_GET_VERSION_NUM, &sg_version);
2817	if (rc < 0) {
2818	error_setg_errno(errp, -rc, "cannot get SG_IO version number");
2819	if (rc != -EPERM) {
2820	error_append_hint(errp, "Is this a SCSI device?\n");
2821	}
2822	return;
2823	}
2824	if (sg_version < 30000) {
2825	error_setg(errp, "scsi generic interface too old");
2826	return;
2827	}
2828
2829	/* get device type from INQUIRY data */
2830	rc = get_device_type(s);
2831	if (rc < 0) {
2832	error_setg(errp, "INQUIRY failed");
2833	return;
2834	}
2835
2836	/* Make a guess for the block size, we'll fix it when the guest sends.
2837	* READ CAPACITY. If they don't, they likely would assume these sizes
2838	* anyway. (TODO: check in /sys).
2839	*/
2840	if (s->qdev.type == TYPE_ROM \|\| s->qdev.type == TYPE_WORM) {
2841	s->qdev.blocksize = 2048;
2842	} else {
2843	s->qdev.blocksize = 512;
2844	}
2845
2846	/* Makes the scsi-block device not removable by using HMP and QMP eject
2847	* command.
2848	*/
2849	s->features \|= (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS);
2850
2851	scsi_realize(&s->qdev, errp);
2852	scsi_generic_read_device_inquiry(&s->qdev);
2853
2854	migration_add_notifier(&s->migration_notifier,
2855	scsi_block_migration_notifier);
2856	}
2857
2858	static void scsi_block_unrealize(SCSIDevice *dev)
2859	{
2860	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
2861
2862	migration_remove_notifier(&s->migration_notifier);
2863	}
2864
2865	typedef struct SCSIBlockReq {
2866	SCSIDiskReq req;
2867	sg_io_hdr_t io_header;
2868
2869	/* Selected bytes of the original CDB, copied into our own CDB. */
2870	uint8_t cmd, cdb1, group_number;
2871
2872	/* CDB passed to SG_IO. */
2873	uint8_t cdb[16];
2874	BlockCompletionFunc *cb;
2875	void *cb_opaque;
2876	} SCSIBlockReq;
2877
2878	static void scsi_block_sgio_complete(void *opaque, int ret)
2879	{
2880	SCSIBlockReq req = (SCSIBlockReq )opaque;
2881	SCSIDiskReq *r = &req->req;
2882	sg_io_hdr_t *io_hdr = &req->io_header;
2883
2884	if (ret == 0) {
2885	if (io_hdr->host_status != SCSI_HOST_OK) {
2886	r->req.host_status = io_hdr->host_status;
2887	ret = -ENODEV;
2888	} else if (io_hdr->driver_status & SG_ERR_DRIVER_TIMEOUT) {
2889	ret = BUSY;
2890	} else {
2891	ret = io_hdr->status;
2892	}
2893	}
2894
2895	req->cb(req->cb_opaque, ret);
2896	}
2897
2898	static BlockAIOCB scsi_block_do_sgio(SCSIBlockReq req,
2899	int64_t offset, QEMUIOVector *iov,
2900	int direction,
2901	BlockCompletionFunc cb, void opaque)
2902	{
2903	sg_io_hdr_t *io_header = &req->io_header;
2904	SCSIDiskReq *r = &req->req;
2905	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
2906	int nb_logical_blocks;
2907	uint64_t lba;
2908	BlockAIOCB *aiocb;
2909
2910	/* This is not supported yet. It can only happen if the guest does
2911	* reads and writes that are not aligned to one logical sectors
2912	* _and_ cover multiple MemoryRegions.
2913	*/
2914	assert(offset % s->qdev.blocksize == 0);
2915	assert(iov->size % s->qdev.blocksize == 0);
2916
2917	io_header->interface_id = 'S';
2918
2919	/* The data transfer comes from the QEMUIOVector. */
2920	io_header->dxfer_direction = direction;
2921	io_header->dxfer_len = iov->size;
2922	io_header->dxferp = (void *)iov->iov;
2923	io_header->iovec_count = iov->niov;
2924	assert(io_header->iovec_count == iov->niov); /* no overflow! */
2925
2926	/* Build a new CDB with the LBA and length patched in, in case
2927	* DMA helpers split the transfer in multiple segments. Do not
2928	* build a CDB smaller than what the guest wanted, and only build
2929	* a larger one if strictly necessary.
2930	*/
2931	io_header->cmdp = req->cdb;
2932	lba = offset / s->qdev.blocksize;
2933	nb_logical_blocks = io_header->dxfer_len / s->qdev.blocksize;
2934
2935	if ((req->cmd >> 5) == 0 && lba <= 0x1ffff) {
2936	/* 6-byte CDB */
2937	stl_be_p(&req->cdb[0], lba \| (req->cmd << 24));
2938	req->cdb[4] = nb_logical_blocks;
2939	req->cdb[5] = 0;
2940	io_header->cmd_len = 6;
2941	} else if ((req->cmd >> 5) <= 1 && lba <= 0xffffffffULL) {
2942	/* 10-byte CDB */
2943	req->cdb[0] = (req->cmd & 0x1f) \| 0x20;
2944	req->cdb[1] = req->cdb1;
2945	stl_be_p(&req->cdb[2], lba);
2946	req->cdb[6] = req->group_number;
2947	stw_be_p(&req->cdb[7], nb_logical_blocks);
2948	req->cdb[9] = 0;
2949	io_header->cmd_len = 10;
2950	} else if ((req->cmd >> 5) != 4 && lba <= 0xffffffffULL) {
2951	/* 12-byte CDB */
2952	req->cdb[0] = (req->cmd & 0x1f) \| 0xA0;
2953	req->cdb[1] = req->cdb1;
2954	stl_be_p(&req->cdb[2], lba);
2955	stl_be_p(&req->cdb[6], nb_logical_blocks);
2956	req->cdb[10] = req->group_number;
2957	req->cdb[11] = 0;
2958	io_header->cmd_len = 12;
2959	} else {
2960	/* 16-byte CDB */
2961	req->cdb[0] = (req->cmd & 0x1f) \| 0x80;
2962	req->cdb[1] = req->cdb1;
2963	stq_be_p(&req->cdb[2], lba);
2964	stl_be_p(&req->cdb[10], nb_logical_blocks);
2965	req->cdb[14] = req->group_number;
2966	req->cdb[15] = 0;
2967	io_header->cmd_len = 16;
2968	}
2969
2970	/* The rest is as in scsi-generic.c. */
2971	io_header->mx_sb_len = sizeof(r->req.sense);
2972	io_header->sbp = r->req.sense;
2973	io_header->timeout = s->qdev.io_timeout * 1000;
2974	io_header->usr_ptr = r;
2975	io_header->flags \|= SG_FLAG_DIRECT_IO;
2976	req->cb = cb;
2977	req->cb_opaque = opaque;
2978	trace_scsi_disk_aio_sgio_command(r->req.tag, req->cdb[0], lba,
2979	nb_logical_blocks, io_header->timeout);
2980	aiocb = blk_aio_ioctl(s->qdev.conf.blk, SG_IO, io_header, scsi_block_sgio_complete, req);
2981	assert(aiocb != NULL);
2982	return aiocb;
2983	}
2984
2985	static bool scsi_block_no_fua(SCSICommand *cmd)
2986	{
2987	return false;
2988	}
2989
2990	static BlockAIOCB *scsi_block_dma_readv(int64_t offset,
2991	QEMUIOVector *iov,
2992	BlockCompletionFunc cb, void cb_opaque,
2993	void *opaque)
2994	{
2995	SCSIBlockReq *r = opaque;
2996	return scsi_block_do_sgio(r, offset, iov,
2997	SG_DXFER_FROM_DEV, cb, cb_opaque);
2998	}
2999
3000	static BlockAIOCB *scsi_block_dma_writev(int64_t offset,
3001	QEMUIOVector *iov,
3002	BlockCompletionFunc cb, void cb_opaque,
3003	void *opaque)
3004	{
3005	SCSIBlockReq *r = opaque;
3006	return scsi_block_do_sgio(r, offset, iov,
3007	SG_DXFER_TO_DEV, cb, cb_opaque);
3008	}
3009
3010	static bool scsi_block_is_passthrough(SCSIDiskState s, uint8_t buf)
3011	{
3012	switch (buf[0]) {
3013	case VERIFY_10:
3014	case VERIFY_12:
3015	case VERIFY_16:
3016	/* Check if BYTCHK == 0x01 (data-out buffer contains data
3017	* for the number of logical blocks specified in the length
3018	* field). For other modes, do not use scatter/gather operation.
3019	*/
3020	if ((buf[1] & 6) == 2) {
3021	return false;
3022	}
3023	break;
3024
3025	case READ_6:
3026	case READ_10:
3027	case READ_12:
3028	case READ_16:
3029	case WRITE_6:
3030	case WRITE_10:
3031	case WRITE_12:
3032	case WRITE_16:
3033	case WRITE_VERIFY_10:
3034	case WRITE_VERIFY_12:
3035	case WRITE_VERIFY_16:
3036	/* MMC writing cannot be done via DMA helpers, because it sometimes
3037	* involves writing beyond the maximum LBA or to negative LBA (lead-in).
3038	* We might use scsi_block_dma_reqops as long as no writing commands are
3039	* seen, but performance usually isn't paramount on optical media. So,
3040	* just make scsi-block operate the same as scsi-generic for them.
3041	*/
3042	if (s->qdev.type != TYPE_ROM) {
3043	return false;
3044	}
3045	break;
3046
3047	default:
3048	break;
3049	}
3050
3051	return true;
3052	}
3053
3054
3055	static int32_t scsi_block_dma_command(SCSIRequest req, uint8_t buf)
3056	{
3057	SCSIBlockReq r = (SCSIBlockReq )req;
3058	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
3059
3060	r->cmd = req->cmd.buf[0];
3061	switch (r->cmd >> 5) {
3062	case 0:
3063	/* 6-byte CDB. */
3064	r->cdb1 = r->group_number = 0;
3065	break;
3066	case 1:
3067	/* 10-byte CDB. */
3068	r->cdb1 = req->cmd.buf[1];
3069	r->group_number = req->cmd.buf[6];
3070	break;
3071	case 4:
3072	/* 12-byte CDB. */
3073	r->cdb1 = req->cmd.buf[1];
3074	r->group_number = req->cmd.buf[10];
3075	break;
3076	case 5:
3077	/* 16-byte CDB. */
3078	r->cdb1 = req->cmd.buf[1];
3079	r->group_number = req->cmd.buf[14];
3080	break;
3081	default:
3082	abort();
3083	}
3084
3085	/* Protection information is not supported. For SCSI versions 2 and
3086	* older (as determined by snooping the guest's INQUIRY commands),
3087	* there is no RD/WR/VRPROTECT, so skip this check in these versions.
3088	*/
3089	if (s->qdev.scsi_version > 2 && (req->cmd.buf[1] & 0xe0)) {
3090	scsi_check_condition(&r->req, SENSE_CODE(INVALID_FIELD));
3091	return 0;
3092	}
3093
3094	return scsi_disk_dma_command(req, buf);
3095	}
3096
3097	static const SCSIReqOps scsi_block_dma_reqops = {
3098	.size = sizeof(SCSIBlockReq),
3099	.free_req = scsi_free_request,
3100	.send_command = scsi_block_dma_command,
3101	.read_data = scsi_read_data,
3102	.write_data = scsi_write_data,
3103	.get_buf = scsi_get_buf,
3104	.load_request = scsi_disk_load_request,
3105	.save_request = scsi_disk_save_request,
3106	};
3107
3108	static SCSIRequest scsi_block_new_request(SCSIDevice d, uint32_t tag,
3109	uint32_t lun, uint8_t *buf,
3110	void *hba_private)
3111	{
3112	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
3113
3114	if (scsi_block_is_passthrough(s, buf)) {
3115	return scsi_req_alloc(&scsi_generic_req_ops, &s->qdev, tag, lun,
3116	hba_private);
3117	} else {
3118	return scsi_req_alloc(&scsi_block_dma_reqops, &s->qdev, tag, lun,
3119	hba_private);
3120	}
3121	}
3122
3123	static int scsi_block_parse_cdb(SCSIDevice d, SCSICommand cmd,
3124	uint8_t *buf, size_t buf_len,
3125	void *hba_private)
3126	{
3127	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);
3128
3129	if (scsi_block_is_passthrough(s, buf)) {
3130	return scsi_bus_parse_cdb(&s->qdev, cmd, buf, buf_len, hba_private);
3131	} else {
3132	return scsi_req_parse_cdb(&s->qdev, cmd, buf, buf_len);
3133	}
3134	}
3135
3136	static void scsi_block_update_sense(SCSIRequest *req)
3137	{
3138	SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
3139	SCSIBlockReq *br = DO_UPCAST(SCSIBlockReq, req, r);
3140	r->req.sense_len = MIN(br->io_header.sb_len_wr, sizeof(r->req.sense));
3141	}
3142	#endif
3143
3144	static
3145	BlockAIOCB scsi_dma_readv(int64_t offset, QEMUIOVector iov,
3146	BlockCompletionFunc cb, void cb_opaque,
3147	void *opaque)
3148	{
3149	SCSIDiskReq *r = opaque;
3150	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
3151	return blk_aio_preadv(s->qdev.conf.blk, offset, iov, 0, cb, cb_opaque);
3152	}
3153
3154	static
3155	BlockAIOCB scsi_dma_writev(int64_t offset, QEMUIOVector iov,
3156	BlockCompletionFunc cb, void cb_opaque,
3157	void *opaque)
3158	{
3159	SCSIDiskReq *r = opaque;
3160	SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
3161	int flags = r->need_fua ? BDRV_REQ_FUA : 0;
3162	return blk_aio_pwritev(s->qdev.conf.blk, offset, iov, flags, cb, cb_opaque);
3163	}
3164
3165	static char scsi_property_get_loadparm(Object obj, Error **errp)
3166	{
3167	return g_strdup(SCSI_DISK_BASE(obj)->loadparm);
3168	}
3169
3170	static void scsi_property_set_loadparm(Object obj, const char value,
3171	Error **errp)
3172	{
3173	void *lp_str;
3174
3175	if (object_property_get_int(obj, "bootindex", NULL) < 0) {
3176	error_setg(errp, "'loadparm' is only valid for boot devices");
3177	return;
3178	}
3179
3180	lp_str = g_malloc0(strlen(value) + 1);
3181	if (!qdev_prop_sanitize_s390x_loadparm(lp_str, value, errp)) {
3182	g_free(lp_str);
3183	return;
3184	}
3185	SCSI_DISK_BASE(obj)->loadparm = lp_str;
3186	}
3187
3188	static void scsi_property_add_specifics(DeviceClass *dc)
3189	{
3190	ObjectClass *oc = OBJECT_CLASS(dc);
3191
3192	/* The loadparm property is only supported on s390x */
3193	if (target_s390x()) {
3194	object_class_property_add_str(oc, "loadparm",
3195	scsi_property_get_loadparm,
3196	scsi_property_set_loadparm);
3197	object_class_property_set_description(oc, "loadparm",
3198	"load parameter (s390x only)");
3199	}
3200	}
3201
3202	static void scsi_disk_base_class_initfn(ObjectClass klass, const void data)
3203	{
3204	DeviceClass *dc = DEVICE_CLASS(klass);
3205	SCSIDiskClass *sdc = SCSI_DISK_BASE_CLASS(klass);
3206
3207	dc->fw_name = "disk";
3208	device_class_set_legacy_reset(dc, scsi_disk_reset);
3209	sdc->dma_readv = scsi_dma_readv;
3210	sdc->dma_writev = scsi_dma_writev;
3211	sdc->need_fua = scsi_is_cmd_fua;
3212	}
3213
3214	static const TypeInfo scsi_disk_base_info = {
3215	.name = TYPE_SCSI_DISK_BASE,
3216	.parent = TYPE_SCSI_DEVICE,
3217	.class_init = scsi_disk_base_class_initfn,
3218	.instance_size = sizeof(SCSIDiskState),
3219	.class_size = sizeof(SCSIDiskClass),
3220	.abstract = true,
3221	};
3222
3223	#define DEFINE_SCSI_DISK_PROPERTIES() \
3224	DEFINE_PROP_DRIVE_IOTHREAD("drive", SCSIDiskState, qdev.conf.blk), \
3225	DEFINE_BLOCK_PROPERTIES_BASE(SCSIDiskState, qdev.conf), \
3226	DEFINE_BLOCK_ERROR_PROPERTIES(SCSIDiskState, qdev.conf), \
3227	DEFINE_PROP_STRING("ver", SCSIDiskState, version), \
3228	DEFINE_PROP_STRING("serial", SCSIDiskState, serial), \
3229	DEFINE_PROP_STRING("vendor", SCSIDiskState, vendor), \
3230	DEFINE_PROP_STRING("product", SCSIDiskState, product), \
3231	DEFINE_PROP_STRING("device_id", SCSIDiskState, device_id), \
3232	DEFINE_PROP_BOOL("migrate-emulated-scsi-request", SCSIDiskState, migrate_emulated_scsi_request, true)
3233
3234
3235	static const Property scsi_hd_properties[] = {
3236	DEFINE_SCSI_DISK_PROPERTIES(),
3237	DEFINE_PROP_BIT("removable", SCSIDiskState, features,
3238	SCSI_DISK_F_REMOVABLE, false),
3239	DEFINE_PROP_BIT("dpofua", SCSIDiskState, features,
3240	SCSI_DISK_F_DPOFUA, true),
3241	DEFINE_PROP_UINT64("wwn", SCSIDiskState, qdev.wwn, 0),
3242	DEFINE_PROP_UINT64("port_wwn", SCSIDiskState, qdev.port_wwn, 0),
3243	DEFINE_PROP_UINT16("port_index", SCSIDiskState, port_index, 0),
3244	DEFINE_PROP_UINT64("max_unmap_size", SCSIDiskState, max_unmap_size,
3245	DEFAULT_MAX_UNMAP_SIZE),
3246	DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
3247	DEFAULT_MAX_IO_SIZE),
3248	DEFINE_PROP_UINT16("rotation_rate", SCSIDiskState, rotation_rate, 0),
3249	DEFINE_PROP_INT32("scsi_version", SCSIDiskState, qdev.default_scsi_version,
3250	5),
3251	DEFINE_PROP_BIT("quirk_mode_page_vendor_specific_apple", SCSIDiskState,
3252	quirks, SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE,
3253	0),
3254	DEFINE_PROP_BIT("quirk_mode_page_set_block_size", SCSIDiskState,
3255	quirks, SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE, 0),
3256	DEFINE_BLOCK_CHS_PROPERTIES(SCSIDiskState, qdev.conf),
3257	};
3258
3259	#ifdef __linux__
3260	static bool scsi_disk_pr_state_post_load_errp(void *opaque, int version_id,
3261	Error **errp)
3262	{
3263	SCSIDiskState *s = opaque;
3264	SCSIDevice *dev = &s->qdev;
3265
3266	return scsi_generic_pr_state_preempt(dev, errp);
3267	}
3268
3269	static bool scsi_disk_pr_state_needed(void *opaque)
3270	{
3271	SCSIDiskState *s = opaque;
3272	SCSIPRState *pr_state = &s->qdev.pr_state;
3273	bool ret;
3274
3275	if (!s->qdev.migrate_pr) {
3276	return false;
3277	}
3278
3279	/* A reservation requires a key, so checking this field is enough */
3280	WITH_QEMU_LOCK_GUARD(&pr_state->mutex) {
3281	ret = pr_state->key;
3282	}
3283	return ret;
3284	}
3285
3286	static const VMStateDescription vmstate_scsi_disk_pr_state = {
3287	.name = "scsi-disk/pr",
3288	.version_id = 1,
3289	.minimum_version_id = 1,
3290	.post_load_errp = scsi_disk_pr_state_post_load_errp,
3291	.needed = scsi_disk_pr_state_needed,
3292	.fields = (const VMStateField[]) {
3293	VMSTATE_UINT64(qdev.pr_state.key, SCSIDiskState),
3294	VMSTATE_UINT8(qdev.pr_state.resv_type, SCSIDiskState),
3295	VMSTATE_END_OF_LIST()
3296	}
3297	};
3298	#endif /* __linux__ */
3299
3300	static const VMStateDescription vmstate_scsi_disk_state = {
3301	.name = "scsi-disk",
3302	.version_id = 1,
3303	.minimum_version_id = 1,
3304	.fields = (const VMStateField[]) {
3305	VMSTATE_SCSI_DEVICE(qdev, SCSIDiskState),
3306	VMSTATE_BOOL(media_changed, SCSIDiskState),
3307	VMSTATE_BOOL(media_event, SCSIDiskState),
3308	VMSTATE_BOOL(eject_request, SCSIDiskState),
3309	VMSTATE_BOOL(tray_open, SCSIDiskState),
3310	VMSTATE_BOOL(tray_locked, SCSIDiskState),
3311	VMSTATE_END_OF_LIST()
3312	},
3313	.subsections = (const VMStateDescription * const []) {
3314	#ifdef __linux__
3315	&vmstate_scsi_disk_pr_state,
3316	#endif
3317	NULL
3318	},
3319	};
3320
3321	static void scsi_hd_class_initfn(ObjectClass klass, const void data)
3322	{
3323	DeviceClass *dc = DEVICE_CLASS(klass);
3324	SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
3325
3326	sc->realize = scsi_hd_realize;
3327	sc->unrealize = scsi_unrealize;
3328	sc->alloc_req = scsi_new_request;
3329	sc->unit_attention_reported = scsi_disk_unit_attention_reported;
3330	dc->desc = "virtual SCSI disk";
3331	device_class_set_props(dc, scsi_hd_properties);
3332	dc->vmsd = &vmstate_scsi_disk_state;
3333
3334	scsi_property_add_specifics(dc);
3335	}
3336
3337	static const TypeInfo scsi_hd_info = {
3338	.name = "scsi-hd",
3339	.parent = TYPE_SCSI_DISK_BASE,
3340	.class_init = scsi_hd_class_initfn,
3341	};
3342
3343	static const Property scsi_cd_properties[] = {
3344	DEFINE_SCSI_DISK_PROPERTIES(),
3345	DEFINE_PROP_UINT64("wwn", SCSIDiskState, qdev.wwn, 0),
3346	DEFINE_PROP_UINT64("port_wwn", SCSIDiskState, qdev.port_wwn, 0),
3347	DEFINE_PROP_UINT16("port_index", SCSIDiskState, port_index, 0),
3348	DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
3349	DEFAULT_MAX_IO_SIZE),
3350	DEFINE_PROP_INT32("scsi_version", SCSIDiskState, qdev.default_scsi_version,
3351	5),
3352	DEFINE_PROP_BIT("quirk_mode_page_apple_vendor", SCSIDiskState, quirks,
3353	SCSI_DISK_QUIRK_MODE_PAGE_APPLE_VENDOR, 0),
3354	DEFINE_PROP_BIT("quirk_mode_sense_rom_use_dbd", SCSIDiskState, quirks,
3355	SCSI_DISK_QUIRK_MODE_SENSE_ROM_USE_DBD, 0),
3356	DEFINE_PROP_BIT("quirk_mode_page_vendor_specific_apple", SCSIDiskState,
3357	quirks, SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE,
3358	0),
3359	DEFINE_PROP_BIT("quirk_mode_page_truncated", SCSIDiskState, quirks,
3360	SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED, 0),
3361	DEFINE_PROP_BIT("quirk_mode_page_set_block_size", SCSIDiskState,
3362	quirks, SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE, 0),
3363	};
3364
3365	static void scsi_cd_class_initfn(ObjectClass klass, const void data)
3366	{
3367	DeviceClass *dc = DEVICE_CLASS(klass);
3368	SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
3369
3370	sc->realize = scsi_cd_realize;
3371	sc->alloc_req = scsi_new_request;
3372	sc->unit_attention_reported = scsi_disk_unit_attention_reported;
3373	dc->desc = "virtual SCSI CD-ROM";
3374	device_class_set_props(dc, scsi_cd_properties);
3375	dc->vmsd = &vmstate_scsi_disk_state;
3376
3377	scsi_property_add_specifics(dc);
3378	}
3379
3380	static const TypeInfo scsi_cd_info = {
3381	.name = "scsi-cd",
3382	.parent = TYPE_SCSI_DISK_BASE,
3383	.class_init = scsi_cd_class_initfn,
3384	};
3385
3386	#ifdef __linux__
3387	static const Property scsi_block_properties[] = {
3388	DEFINE_BLOCK_ERROR_PROPERTIES(SCSIDiskState, qdev.conf),
3389	DEFINE_PROP_DRIVE("drive", SCSIDiskState, qdev.conf.blk),
3390	DEFINE_PROP_BOOL("share-rw", SCSIDiskState, qdev.conf.share_rw, false),
3391	DEFINE_PROP_UINT16("rotation_rate", SCSIDiskState, rotation_rate, 0),
3392	DEFINE_PROP_UINT64("max_unmap_size", SCSIDiskState, max_unmap_size,
3393	DEFAULT_MAX_UNMAP_SIZE),
3394	DEFINE_PROP_UINT64("max_io_size", SCSIDiskState, max_io_size,
3395	DEFAULT_MAX_IO_SIZE),
3396	DEFINE_PROP_INT32("scsi_version", SCSIDiskState, qdev.default_scsi_version,
3397	-1),
3398	DEFINE_PROP_UINT32("io_timeout", SCSIDiskState, qdev.io_timeout,
3399	DEFAULT_IO_TIMEOUT),
3400	DEFINE_PROP_BOOL("migrate-pr", SCSIDiskState, qdev.migrate_pr, true),
3401	};
3402
3403	static void scsi_block_class_initfn(ObjectClass klass, const void data)
3404	{
3405	DeviceClass *dc = DEVICE_CLASS(klass);
3406	SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);
3407	SCSIDiskClass *sdc = SCSI_DISK_BASE_CLASS(klass);
3408
3409	sc->realize = scsi_block_realize;
3410	sc->unrealize = scsi_block_unrealize;
3411	sc->alloc_req = scsi_block_new_request;
3412	sc->parse_cdb = scsi_block_parse_cdb;
3413	sdc->dma_readv = scsi_block_dma_readv;
3414	sdc->dma_writev = scsi_block_dma_writev;
3415	sdc->update_sense = scsi_block_update_sense;
3416	sdc->need_fua = scsi_block_no_fua;
3417	dc->desc = "SCSI block device passthrough";
3418	device_class_set_props(dc, scsi_block_properties);
3419	dc->vmsd = &vmstate_scsi_disk_state;
3420	}
3421
3422	static const TypeInfo scsi_block_info = {
3423	.name = "scsi-block",
3424	.parent = TYPE_SCSI_DISK_BASE,
3425	.class_init = scsi_block_class_initfn,
3426	};
3427	#endif
3428
3429	static void scsi_disk_register_types(void)
3430	{
3431	type_register_static(&scsi_disk_base_info);
3432	type_register_static(&scsi_hd_info);
3433	type_register_static(&scsi_cd_info);
3434	#ifdef __linux__
3435	type_register_static(&scsi_block_info);
3436	#endif
3437	}
3438
3439	type_init(scsi_disk_register_types)