[qemu.git] / hw / scsi-generic.c

/*
 * Generic SCSI Device support
 *
 * Copyright (c) 2007 Bull S.A.S.
 * Based on code by Paul Brook
 * Based on code by Fabrice Bellard
 *
 * Written by Laurent Vivier <[email protected]>
 *
 * This code is licenced under the LGPL.
 *
 */

#include "qemu-common.h"
#include "qemu-error.h"
#include "block.h"
#include "scsi.h"

#ifdef __linux__

//#define DEBUG_SCSI

#ifdef DEBUG_SCSI
#define DPRINTF(fmt, ...) \
do { printf("scsi-generic: " fmt , ## __VA_ARGS__); } while (0)
#else
#define DPRINTF(fmt, ...) do {} while(0)
#endif

#define BADF(fmt, ...) \
do { fprintf(stderr, "scsi-generic: " fmt , ## __VA_ARGS__); } while (0)

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <scsi/sg.h>
#include "scsi-defs.h"

#define SCSI_SENSE_BUF_SIZE 96

#define SG_ERR_DRIVER_TIMEOUT 0x06
#define SG_ERR_DRIVER_SENSE 0x08

#ifndef MAX_UINT
#define MAX_UINT ((unsigned int)-1)
#endif

typedef struct SCSIGenericState SCSIGenericState;

typedef struct SCSIGenericReq {
    SCSIRequest req;
    uint8_t *buf;
    int buflen;
    int len;
    sg_io_hdr_t io_header;
} SCSIGenericReq;

struct SCSIGenericState
{
    SCSIDevice qdev;
    BlockDriverState *bs;
    int lun;
    int driver_status;
    uint8_t sensebuf[SCSI_SENSE_BUF_SIZE];
    uint8_t senselen;
};

static SCSIGenericReq *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun)
{
    SCSIRequest *req;

    req = scsi_req_alloc(sizeof(SCSIGenericReq), d, tag, lun);
    return DO_UPCAST(SCSIGenericReq, req, req);
}

static void scsi_remove_request(SCSIGenericReq *r)
{
    qemu_free(r->buf);
    scsi_req_free(&r->req);
}

static SCSIGenericReq *scsi_find_request(SCSIGenericState *s, uint32_t tag)
{
    return DO_UPCAST(SCSIGenericReq, req, scsi_req_find(&s->qdev, tag));
}

/* Helper function for command completion.  */
static void scsi_command_complete(void *opaque, int ret)
{
    SCSIGenericReq *r = (SCSIGenericReq *)opaque;
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev);

    s->driver_status = r->io_header.driver_status;
    if (s->driver_status & SG_ERR_DRIVER_SENSE)
        s->senselen = r->io_header.sb_len_wr;

    if (ret != 0)
        r->req.status = BUSY << 1;
    else {
        if (s->driver_status & SG_ERR_DRIVER_TIMEOUT) {
            r->req.status = BUSY << 1;
            BADF("Driver Timeout\n");
        } else if (r->io_header.status)
            r->req.status = r->io_header.status;
        else if (s->driver_status & SG_ERR_DRIVER_SENSE)
            r->req.status = CHECK_CONDITION << 1;
        else
            r->req.status = GOOD << 1;
    }
    DPRINTF("Command complete 0x%p tag=0x%x status=%d\n",
            r, r->req.tag, r->req.status);

    scsi_req_complete(&r->req);
    scsi_remove_request(r);
}

/* Cancel a pending data transfer.  */
static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
{
    DPRINTF("scsi_cancel_io 0x%x\n", tag);
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
    SCSIGenericReq *r;
    DPRINTF("Cancel tag=0x%x\n", tag);
    r = scsi_find_request(s, tag);
    if (r) {
        if (r->req.aiocb)
            bdrv_aio_cancel(r->req.aiocb);
        r->req.aiocb = NULL;
        scsi_remove_request(r);
    }
}

static int execute_command(BlockDriverState *bdrv,
                           SCSIGenericReq *r, int direction,
			   BlockDriverCompletionFunc *complete)
{
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev);

    r->io_header.interface_id = 'S';
    r->io_header.dxfer_direction = direction;
    r->io_header.dxferp = r->buf;
    r->io_header.dxfer_len = r->buflen;
    r->io_header.cmdp = r->req.cmd.buf;
    r->io_header.cmd_len = r->req.cmd.len;
    r->io_header.mx_sb_len = sizeof(s->sensebuf);
    r->io_header.sbp = s->sensebuf;
    r->io_header.timeout = MAX_UINT;
    r->io_header.usr_ptr = r;
    r->io_header.flags |= SG_FLAG_DIRECT_IO;

    r->req.aiocb = bdrv_aio_ioctl(bdrv, SG_IO, &r->io_header, complete, r);
    if (r->req.aiocb == NULL) {
        BADF("execute_command: read failed !\n");
        return -1;
    }

    return 0;
}

static void scsi_read_complete(void * opaque, int ret)
{
    SCSIGenericReq *r = (SCSIGenericReq *)opaque;
    int len;

    if (ret) {
        DPRINTF("IO error\n");
        scsi_command_complete(r, ret);
        return;
    }
    len = r->io_header.dxfer_len - r->io_header.resid;
    DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, len);

    r->len = -1;
    r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);
    if (len == 0)
        scsi_command_complete(r, 0);
}

/* Read more data from scsi device into buffer.  */
static void scsi_read_data(SCSIDevice *d, uint32_t tag)
{
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
    SCSIGenericReq *r;
    int ret;

    DPRINTF("scsi_read_data 0x%x\n", tag);
    r = scsi_find_request(s, tag);
    if (!r) {
        BADF("Bad read tag 0x%x\n", tag);
        /* ??? This is the wrong error.  */
        scsi_command_complete(r, -EINVAL);
        return;
    }

    if (r->len == -1) {
        scsi_command_complete(r, 0);
        return;
    }

    if (r->req.cmd.buf[0] == REQUEST_SENSE && s->driver_status & SG_ERR_DRIVER_SENSE)
    {
        s->senselen = MIN(r->len, s->senselen);
        memcpy(r->buf, s->sensebuf, s->senselen);
        r->io_header.driver_status = 0;
        r->io_header.status = 0;
        r->io_header.dxfer_len  = s->senselen;
        r->len = -1;
        DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, s->senselen);
        DPRINTF("Sense: %d %d %d %d %d %d %d %d\n",
                r->buf[0], r->buf[1], r->buf[2], r->buf[3],
                r->buf[4], r->buf[5], r->buf[6], r->buf[7]);
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, s->senselen);
        return;
    }

    ret = execute_command(s->bs, r, SG_DXFER_FROM_DEV, scsi_read_complete);
    if (ret == -1) {
        scsi_command_complete(r, -EINVAL);
        return;
    }
}

static void scsi_write_complete(void * opaque, int ret)
{
    SCSIGenericReq *r = (SCSIGenericReq *)opaque;
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev);

    DPRINTF("scsi_write_complete() ret = %d\n", ret);
    if (ret) {
        DPRINTF("IO error\n");
        scsi_command_complete(r, ret);
        return;
    }

    if (r->req.cmd.buf[0] == MODE_SELECT && r->req.cmd.buf[4] == 12 &&
        s->qdev.type == TYPE_TAPE) {
        s->qdev.blocksize = (r->buf[9] << 16) | (r->buf[10] << 8) | r->buf[11];
        DPRINTF("block size %d\n", s->blocksize);
    }

    scsi_command_complete(r, ret);
}

/* Write data to a scsi device.  Returns nonzero on failure.
   The transfer may complete asynchronously.  */
static int scsi_write_data(SCSIDevice *d, uint32_t tag)
{
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
    SCSIGenericReq *r;
    int ret;

    DPRINTF("scsi_write_data 0x%x\n", tag);
    r = scsi_find_request(s, tag);
    if (!r) {
        BADF("Bad write tag 0x%x\n", tag);
        /* ??? This is the wrong error.  */
        scsi_command_complete(r, -EINVAL);
        return 0;
    }

    if (r->len == 0) {
        r->len = r->buflen;
        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, r->len);
        return 0;
    }

    ret = execute_command(s->bs, r, SG_DXFER_TO_DEV, scsi_write_complete);
    if (ret == -1) {
        scsi_command_complete(r, -EINVAL);
        return 1;
    }

    return 0;
}

/* Return a pointer to the data buffer.  */
static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
{
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
    SCSIGenericReq *r;
    r = scsi_find_request(s, tag);
    if (!r) {
        BADF("Bad buffer tag 0x%x\n", tag);
        return NULL;
    }
    return r->buf;
}

static void scsi_req_fixup(SCSIRequest *req)
{
    switch(req->cmd.buf[0]) {
    case WRITE_10:
        req->cmd.buf[1] &= ~0x08;	/* disable FUA */
        break;
    case READ_10:
        req->cmd.buf[1] &= ~0x08;	/* disable FUA */
        break;
    case REWIND:
    case START_STOP:
        if (req->dev->type == TYPE_TAPE) {
            /* force IMMED, otherwise qemu waits end of command */
            req->cmd.buf[1] = 0x01;
        }
        break;
    }
}

/* Execute a scsi command.  Returns the length of the data expected by the
   command.  This will be Positive for data transfers from the device
   (eg. disk reads), negative for transfers to the device (eg. disk writes),
   and zero if the command does not transfer any data.  */

static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
                                 uint8_t *cmd, int lun)
{
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
    SCSIGenericReq *r;
    SCSIBus *bus;
    int ret;

    if (cmd[0] != REQUEST_SENSE &&
        (lun != s->lun || (cmd[1] >> 5) != s->lun)) {
        DPRINTF("Unimplemented LUN %d\n", lun ? lun : cmd[1] >> 5);

        s->sensebuf[0] = 0x70;
        s->sensebuf[1] = 0x00;
        s->sensebuf[2] = ILLEGAL_REQUEST;
        s->sensebuf[3] = 0x00;
        s->sensebuf[4] = 0x00;
        s->sensebuf[5] = 0x00;
        s->sensebuf[6] = 0x00;
        s->senselen = 7;
        s->driver_status = SG_ERR_DRIVER_SENSE;
        bus = scsi_bus_from_device(d);
        bus->complete(bus, SCSI_REASON_DONE, tag, CHECK_CONDITION << 1);
        return 0;
    }

    r = scsi_find_request(s, tag);
    if (r) {
        BADF("Tag 0x%x already in use %p\n", tag, r);
        scsi_cancel_io(d, tag);
    }
    r = scsi_new_request(d, tag, lun);

    if (-1 == scsi_req_parse(&r->req, cmd)) {
        BADF("Unsupported command length, command %x\n", cmd[0]);
        scsi_remove_request(r);
        return 0;
    }
    scsi_req_fixup(&r->req);

    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x len %d\n", lun, tag,
            cmd[0], r->req.cmd.xfer);

    if (r->req.cmd.xfer == 0) {
        if (r->buf != NULL)
            qemu_free(r->buf);
        r->buflen = 0;
        r->buf = NULL;
        ret = execute_command(s->bs, r, SG_DXFER_NONE, scsi_command_complete);
        if (ret == -1) {
            scsi_command_complete(r, -EINVAL);
            return 0;
        }
        return 0;
    }

    if (r->buflen != r->req.cmd.xfer) {
        if (r->buf != NULL)
            qemu_free(r->buf);
        r->buf = qemu_malloc(r->req.cmd.xfer);
        r->buflen = r->req.cmd.xfer;
    }

    memset(r->buf, 0, r->buflen);
    r->len = r->req.cmd.xfer;
    if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
        r->len = 0;
        return -r->req.cmd.xfer;
    }

    return r->req.cmd.xfer;
}

static int get_blocksize(BlockDriverState *bdrv)
{
    uint8_t cmd[10];
    uint8_t buf[8];
    uint8_t sensebuf[8];
    sg_io_hdr_t io_header;
    int ret;

    memset(cmd, 0, sizeof(cmd));
    memset(buf, 0, sizeof(buf));
    cmd[0] = READ_CAPACITY;

    memset(&io_header, 0, sizeof(io_header));
    io_header.interface_id = 'S';
    io_header.dxfer_direction = SG_DXFER_FROM_DEV;
    io_header.dxfer_len = sizeof(buf);
    io_header.dxferp = buf;
    io_header.cmdp = cmd;
    io_header.cmd_len = sizeof(cmd);
    io_header.mx_sb_len = sizeof(sensebuf);
    io_header.sbp = sensebuf;
    io_header.timeout = 6000; /* XXX */

    ret = bdrv_ioctl(bdrv, SG_IO, &io_header);
    if (ret < 0)
        return -1;

    return (buf[4] << 24) | (buf[5] << 16) | (buf[6] << 8) | buf[7];
}

static int get_stream_blocksize(BlockDriverState *bdrv)
{
    uint8_t cmd[6];
    uint8_t buf[12];
    uint8_t sensebuf[8];
    sg_io_hdr_t io_header;
    int ret;

    memset(cmd, 0, sizeof(cmd));
    memset(buf, 0, sizeof(buf));
    cmd[0] = MODE_SENSE;
    cmd[4] = sizeof(buf);

    memset(&io_header, 0, sizeof(io_header));
    io_header.interface_id = 'S';
    io_header.dxfer_direction = SG_DXFER_FROM_DEV;
    io_header.dxfer_len = sizeof(buf);
    io_header.dxferp = buf;
    io_header.cmdp = cmd;
    io_header.cmd_len = sizeof(cmd);
    io_header.mx_sb_len = sizeof(sensebuf);
    io_header.sbp = sensebuf;
    io_header.timeout = 6000; /* XXX */

    ret = bdrv_ioctl(bdrv, SG_IO, &io_header);
    if (ret < 0)
        return -1;

    return (buf[9] << 16) | (buf[10] << 8) | buf[11];
}

static void scsi_destroy(SCSIDevice *d)
{
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
    SCSIGenericReq *r;

    while (!QTAILQ_EMPTY(&s->qdev.requests)) {
        r = DO_UPCAST(SCSIGenericReq, req, QTAILQ_FIRST(&s->qdev.requests));
        scsi_remove_request(r);
    }
    drive_uninit(s->qdev.conf.dinfo);
}

static int scsi_generic_initfn(SCSIDevice *dev)
{
    SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, dev);
    int sg_version;
    struct sg_scsi_id scsiid;

    if (!s->qdev.conf.dinfo || !s->qdev.conf.dinfo->bdrv) {
        qemu_error("scsi-generic: drive property not set\n");
        return -1;
    }
    s->bs = s->qdev.conf.dinfo->bdrv;

    /* check we are really using a /dev/sg* file */
    if (!bdrv_is_sg(s->bs)) {
        qemu_error("scsi-generic: not /dev/sg*\n");
        return -1;
    }

    /* check we are using a driver managing SG_IO (version 3 and after */
    if (bdrv_ioctl(s->bs, SG_GET_VERSION_NUM, &sg_version) < 0 ||
        sg_version < 30000) {
        qemu_error("scsi-generic: scsi generic interface too old\n");
        return -1;
    }

    /* get LUN of the /dev/sg? */
    if (bdrv_ioctl(s->bs, SG_GET_SCSI_ID, &scsiid)) {
        qemu_error("scsi-generic: SG_GET_SCSI_ID ioctl failed\n");
        return -1;
    }

    /* define device state */
    s->lun = scsiid.lun;
    DPRINTF("LUN %d\n", s->lun);
    s->qdev.type = scsiid.scsi_type;
    DPRINTF("device type %d\n", s->qdev.type);
    if (s->qdev.type == TYPE_TAPE) {
        s->qdev.blocksize = get_stream_blocksize(s->bs);
        if (s->qdev.blocksize == -1)
            s->qdev.blocksize = 0;
    } else {
        s->qdev.blocksize = get_blocksize(s->bs);
        /* removable media returns 0 if not present */
        if (s->qdev.blocksize <= 0) {
            if (s->qdev.type == TYPE_ROM || s->qdev.type  == TYPE_WORM)
                s->qdev.blocksize = 2048;
            else
                s->qdev.blocksize = 512;
        }
    }
    DPRINTF("block size %d\n", s->qdev.blocksize);
    s->driver_status = 0;
    memset(s->sensebuf, 0, sizeof(s->sensebuf));
    return 0;
}

static SCSIDeviceInfo scsi_generic_info = {
    .qdev.name    = "scsi-generic",
    .qdev.desc    = "pass through generic scsi device (/dev/sg*)",
    .qdev.size    = sizeof(SCSIGenericState),
    .init         = scsi_generic_initfn,
    .destroy      = scsi_destroy,
    .send_command = scsi_send_command,
    .read_data    = scsi_read_data,
    .write_data   = scsi_write_data,
    .cancel_io    = scsi_cancel_io,
    .get_buf      = scsi_get_buf,
    .qdev.props   = (Property[]) {
        DEFINE_BLOCK_PROPERTIES(SCSIGenericState, qdev.conf),
        DEFINE_PROP_END_OF_LIST(),
    },
};

static void scsi_generic_register_devices(void)
{
    scsi_qdev_register(&scsi_generic_info);
}
device_init(scsi_generic_register_devices)

#endif /* __linux__ */
Commit	Line	Data
2cc977e2 TS	1	/*
	2	* Generic SCSI Device support
	3	*
	4	* Copyright (c) 2007 Bull S.A.S.
	5	* Based on code by Paul Brook
	6	* Based on code by Fabrice Bellard
	7	*
	8	* Written by Laurent Vivier <[email protected]>
	9	*
	10	* This code is licenced under the LGPL.
	11	*
	12	*/
	13
	14	#include "qemu-common.h"
2f792016	15	#include "qemu-error.h"
2cc977e2	16	#include "block.h"
43b443b6	17	#include "scsi.h"
2cc977e2	18
d52affa7	19	#ifdef __linux__
2cc977e2 TS	20
	21	//#define DEBUG_SCSI
	22
	23	#ifdef DEBUG_SCSI
001faf32 BS	24	#define DPRINTF(fmt, ...) \
001faf32 BS	25	do { printf("scsi-generic: " fmt , ## __VA_ARGS__); } while (0)
2cc977e2	26	#else
001faf32	27	#define DPRINTF(fmt, ...) do {} while(0)
2cc977e2 TS	28	#endif
2cc977e2 TS	29
001faf32 BS	30	#define BADF(fmt, ...) \
001faf32 BS	31	do { fprintf(stderr, "scsi-generic: " fmt , ## __VA_ARGS__); } while (0)
2cc977e2 TS	32
	33	#include <stdio.h>
	34	#include <sys/types.h>
	35	#include <sys/stat.h>
	36	#include <unistd.h>
	37	#include <scsi/sg.h>
0d65e1f8	38	#include "scsi-defs.h"
2cc977e2	39
a9dd6843	40	#define SCSI_SENSE_BUF_SIZE 96
2cc977e2 TS	41
	42	#define SG_ERR_DRIVER_TIMEOUT 0x06
	43	#define SG_ERR_DRIVER_SENSE 0x08
	44
	45	#ifndef MAX_UINT
	46	#define MAX_UINT ((unsigned int)-1)
	47	#endif
	48
d52affa7 GH	49	typedef struct SCSIGenericState SCSIGenericState;
d52affa7 GH	50
4c41d2ef GH	51	typedef struct SCSIGenericReq {
4c41d2ef GH	52	SCSIRequest req;
2cc977e2 TS	53	uint8_t *buf;
	54	int buflen;
	55	int len;
	56	sg_io_hdr_t io_header;
4c41d2ef	57	} SCSIGenericReq;
2cc977e2	58
d52affa7	59	struct SCSIGenericState
2cc977e2	60	{
d52affa7	61	SCSIDevice qdev;
428c149b	62	BlockDriverState *bs;
2cc977e2	63	int lun;
2cc977e2 TS	64	int driver_status;
2cc977e2 TS	65	uint8_t sensebuf[SCSI_SENSE_BUF_SIZE];
89c0f643	66	uint8_t senselen;
2cc977e2 TS	67	};
2cc977e2 TS	68
89b08ae1	69	static SCSIGenericReq scsi_new_request(SCSIDevice d, uint32_t tag, uint32_t lun)
2cc977e2	70	{
89b08ae1	71	SCSIRequest *req;
2cc977e2	72
89b08ae1 GH	73	req = scsi_req_alloc(sizeof(SCSIGenericReq), d, tag, lun);
89b08ae1 GH	74	return DO_UPCAST(SCSIGenericReq, req, req);
2cc977e2 TS	75	}
2cc977e2 TS	76
4c41d2ef	77	static void scsi_remove_request(SCSIGenericReq *r)
2cc977e2	78	{
9af99d98	79	qemu_free(r->buf);
89b08ae1	80	scsi_req_free(&r->req);
2cc977e2 TS	81	}
2cc977e2 TS	82
4c41d2ef	83	static SCSIGenericReq scsi_find_request(SCSIGenericState s, uint32_t tag)
2cc977e2	84	{
89b08ae1	85	return DO_UPCAST(SCSIGenericReq, req, scsi_req_find(&s->qdev, tag));
2cc977e2 TS	86	}
	87
	88	/* Helper function for command completion. */
	89	static void scsi_command_complete(void *opaque, int ret)
	90	{
4c41d2ef GH	91	SCSIGenericReq r = (SCSIGenericReq )opaque;
4c41d2ef GH	92	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev);
2cc977e2 TS	93
2cc977e2 TS	94	s->driver_status = r->io_header.driver_status;
89c0f643 AJ	95	if (s->driver_status & SG_ERR_DRIVER_SENSE)
	96	s->senselen = r->io_header.sb_len_wr;
	97
2cc977e2	98	if (ret != 0)
ed3a34a3	99	r->req.status = BUSY << 1;
2cc977e2 TS	100	else {
2cc977e2 TS	101	if (s->driver_status & SG_ERR_DRIVER_TIMEOUT) {
ed3a34a3	102	r->req.status = BUSY << 1;
2cc977e2	103	BADF("Driver Timeout\n");
89c0f643	104	} else if (r->io_header.status)
ed3a34a3	105	r->req.status = r->io_header.status;
89c0f643	106	else if (s->driver_status & SG_ERR_DRIVER_SENSE)
ed3a34a3	107	r->req.status = CHECK_CONDITION << 1;
2cc977e2	108	else
ed3a34a3	109	r->req.status = GOOD << 1;
2cc977e2	110	}
89c0f643	111	DPRINTF("Command complete 0x%p tag=0x%x status=%d\n",
ed3a34a3 GH	112	r, r->req.tag, r->req.status);
	113
	114	scsi_req_complete(&r->req);
89b08ae1	115	scsi_remove_request(r);
2cc977e2 TS	116	}
	117
	118	/* Cancel a pending data transfer. */
	119	static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
	120	{
	121	DPRINTF("scsi_cancel_io 0x%x\n", tag);
d52affa7	122	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
4c41d2ef	123	SCSIGenericReq *r;
2cc977e2 TS	124	DPRINTF("Cancel tag=0x%x\n", tag);
	125	r = scsi_find_request(s, tag);
	126	if (r) {
4c41d2ef GH	127	if (r->req.aiocb)
	128	bdrv_aio_cancel(r->req.aiocb);
	129	r->req.aiocb = NULL;
2cc977e2 TS	130	scsi_remove_request(r);
	131	}
	132	}
	133
	134	static int execute_command(BlockDriverState *bdrv,
4c41d2ef	135	SCSIGenericReq *r, int direction,
2cc977e2 TS	136	BlockDriverCompletionFunc *complete)
2cc977e2 TS	137	{
4c41d2ef GH	138	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev);
4c41d2ef GH	139
2cc977e2 TS	140	r->io_header.interface_id = 'S';
	141	r->io_header.dxfer_direction = direction;
	142	r->io_header.dxferp = r->buf;
	143	r->io_header.dxfer_len = r->buflen;
29362ebe GH	144	r->io_header.cmdp = r->req.cmd.buf;
29362ebe GH	145	r->io_header.cmd_len = r->req.cmd.len;
4c41d2ef GH	146	r->io_header.mx_sb_len = sizeof(s->sensebuf);
4c41d2ef GH	147	r->io_header.sbp = s->sensebuf;
2cc977e2 TS	148	r->io_header.timeout = MAX_UINT;
	149	r->io_header.usr_ptr = r;
	150	r->io_header.flags \|= SG_FLAG_DIRECT_IO;
	151
4c41d2ef GH	152	r->req.aiocb = bdrv_aio_ioctl(bdrv, SG_IO, &r->io_header, complete, r);
4c41d2ef GH	153	if (r->req.aiocb == NULL) {
2cc977e2 TS	154	BADF("execute_command: read failed !\n");
	155	return -1;
	156	}
	157
	158	return 0;
	159	}
	160
	161	static void scsi_read_complete(void * opaque, int ret)
	162	{
4c41d2ef	163	SCSIGenericReq r = (SCSIGenericReq )opaque;
2cc977e2 TS	164	int len;
	165
	166	if (ret) {
	167	DPRINTF("IO error\n");
	168	scsi_command_complete(r, ret);
	169	return;
	170	}
	171	len = r->io_header.dxfer_len - r->io_header.resid;
4c41d2ef	172	DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, len);
2cc977e2 TS	173
2cc977e2 TS	174	r->len = -1;
4c41d2ef	175	r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);
89c0f643 AJ	176	if (len == 0)
89c0f643 AJ	177	scsi_command_complete(r, 0);
2cc977e2 TS	178	}
	179
	180	/* Read more data from scsi device into buffer. */
	181	static void scsi_read_data(SCSIDevice *d, uint32_t tag)
	182	{
d52affa7	183	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
4c41d2ef	184	SCSIGenericReq *r;
2cc977e2 TS	185	int ret;
	186
	187	DPRINTF("scsi_read_data 0x%x\n", tag);
	188	r = scsi_find_request(s, tag);
	189	if (!r) {
	190	BADF("Bad read tag 0x%x\n", tag);
	191	/* ??? This is the wrong error. */
	192	scsi_command_complete(r, -EINVAL);
	193	return;
	194	}
	195
	196	if (r->len == -1) {
	197	scsi_command_complete(r, 0);
	198	return;
	199	}
	200
29362ebe	201	if (r->req.cmd.buf[0] == REQUEST_SENSE && s->driver_status & SG_ERR_DRIVER_SENSE)
2cc977e2	202	{
89c0f643 AJ	203	s->senselen = MIN(r->len, s->senselen);
89c0f643 AJ	204	memcpy(r->buf, s->sensebuf, s->senselen);
2cc977e2	205	r->io_header.driver_status = 0;
89c0f643 AJ	206	r->io_header.status = 0;
89c0f643 AJ	207	r->io_header.dxfer_len = s->senselen;
2cc977e2	208	r->len = -1;
4c41d2ef	209	DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, s->senselen);
a9dd6843 AL	210	DPRINTF("Sense: %d %d %d %d %d %d %d %d\n",
	211	r->buf[0], r->buf[1], r->buf[2], r->buf[3],
	212	r->buf[4], r->buf[5], r->buf[6], r->buf[7]);
4c41d2ef	213	r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, s->senselen);
2cc977e2 TS	214	return;
	215	}
	216
428c149b	217	ret = execute_command(s->bs, r, SG_DXFER_FROM_DEV, scsi_read_complete);
2cc977e2 TS	218	if (ret == -1) {
	219	scsi_command_complete(r, -EINVAL);
	220	return;
	221	}
	222	}
	223
	224	static void scsi_write_complete(void * opaque, int ret)
	225	{
4c41d2ef GH	226	SCSIGenericReq r = (SCSIGenericReq )opaque;
4c41d2ef GH	227	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev);
2cc977e2 TS	228
	229	DPRINTF("scsi_write_complete() ret = %d\n", ret);
	230	if (ret) {
	231	DPRINTF("IO error\n");
	232	scsi_command_complete(r, ret);
	233	return;
	234	}
	235
29362ebe	236	if (r->req.cmd.buf[0] == MODE_SELECT && r->req.cmd.buf[4] == 12 &&
91376656	237	s->qdev.type == TYPE_TAPE) {
b07995e3	238	s->qdev.blocksize = (r->buf[9] << 16) \| (r->buf[10] << 8) \| r->buf[11];
4c41d2ef	239	DPRINTF("block size %d\n", s->blocksize);
89c0f643 AJ	240	}
89c0f643 AJ	241
2cc977e2 TS	242	scsi_command_complete(r, ret);
	243	}
	244
	245	/* Write data to a scsi device. Returns nonzero on failure.
	246	The transfer may complete asynchronously. */
	247	static int scsi_write_data(SCSIDevice *d, uint32_t tag)
	248	{
d52affa7	249	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
4c41d2ef	250	SCSIGenericReq *r;
2cc977e2 TS	251	int ret;
	252
	253	DPRINTF("scsi_write_data 0x%x\n", tag);
	254	r = scsi_find_request(s, tag);
	255	if (!r) {
	256	BADF("Bad write tag 0x%x\n", tag);
	257	/* ??? This is the wrong error. */
	258	scsi_command_complete(r, -EINVAL);
	259	return 0;
	260	}
	261
	262	if (r->len == 0) {
	263	r->len = r->buflen;
4c41d2ef	264	r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, r->len);
2cc977e2 TS	265	return 0;
	266	}
	267
428c149b	268	ret = execute_command(s->bs, r, SG_DXFER_TO_DEV, scsi_write_complete);
2cc977e2 TS	269	if (ret == -1) {
	270	scsi_command_complete(r, -EINVAL);
	271	return 1;
	272	}
	273
	274	return 0;
	275	}
	276
	277	/* Return a pointer to the data buffer. */
	278	static uint8_t scsi_get_buf(SCSIDevice d, uint32_t tag)
	279	{
d52affa7	280	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
4c41d2ef	281	SCSIGenericReq *r;
2cc977e2 TS	282	r = scsi_find_request(s, tag);
	283	if (!r) {
	284	BADF("Bad buffer tag 0x%x\n", tag);
	285	return NULL;
	286	}
	287	return r->buf;
	288	}
	289
2ec749cb	290	static void scsi_req_fixup(SCSIRequest *req)
2cc977e2	291	{
2ec749cb	292	switch(req->cmd.buf[0]) {
2cc977e2	293	case WRITE_10:
2ec749cb	294	req->cmd.buf[1] &= ~0x08; /* disable FUA */
2cc977e2 TS	295	break;
2cc977e2 TS	296	case READ_10:
2ec749cb	297	req->cmd.buf[1] &= ~0x08; /* disable FUA */
a9dd6843 AL	298	break;
	299	case REWIND:
	300	case START_STOP:
2ec749cb GH	301	if (req->dev->type == TYPE_TAPE) {
	302	/* force IMMED, otherwise qemu waits end of command */
	303	req->cmd.buf[1] = 0x01;
	304	}
a9dd6843	305	break;
a9dd6843	306	}
a9dd6843 AL	307	}
a9dd6843 AL	308
2cc977e2 TS	309	/* Execute a scsi command. Returns the length of the data expected by the
	310	command. This will be Positive for data transfers from the device
	311	(eg. disk reads), negative for transfers to the device (eg. disk writes),
	312	and zero if the command does not transfer any data. */
	313
	314	static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
	315	uint8_t *cmd, int lun)
	316	{
d52affa7	317	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
4c41d2ef	318	SCSIGenericReq *r;
d52affa7	319	SCSIBus *bus;
2cc977e2 TS	320	int ret;
2cc977e2 TS	321
89c0f643 AJ	322	if (cmd[0] != REQUEST_SENSE &&
	323	(lun != s->lun \|\| (cmd[1] >> 5) != s->lun)) {
	324	DPRINTF("Unimplemented LUN %d\n", lun ? lun : cmd[1] >> 5);
	325
	326	s->sensebuf[0] = 0x70;
	327	s->sensebuf[1] = 0x00;
	328	s->sensebuf[2] = ILLEGAL_REQUEST;
	329	s->sensebuf[3] = 0x00;
	330	s->sensebuf[4] = 0x00;
	331	s->sensebuf[5] = 0x00;
	332	s->sensebuf[6] = 0x00;
	333	s->senselen = 7;
	334	s->driver_status = SG_ERR_DRIVER_SENSE;
d52affa7 GH	335	bus = scsi_bus_from_device(d);
d52affa7 GH	336	bus->complete(bus, SCSI_REASON_DONE, tag, CHECK_CONDITION << 1);
89c0f643 AJ	337	return 0;
	338	}
	339
2cc977e2 TS	340	r = scsi_find_request(s, tag);
	341	if (r) {
	342	BADF("Tag 0x%x already in use %p\n", tag, r);
	343	scsi_cancel_io(d, tag);
	344	}
89b08ae1	345	r = scsi_new_request(d, tag, lun);
2cc977e2	346
2ec749cb GH	347	if (-1 == scsi_req_parse(&r->req, cmd)) {
	348	BADF("Unsupported command length, command %x\n", cmd[0]);
	349	scsi_remove_request(r);
	350	return 0;
	351	}
	352	scsi_req_fixup(&r->req);
	353
	354	DPRINTF("Command: lun=%d tag=0x%x data=0x%02x len %d\n", lun, tag,
	355	cmd[0], r->req.cmd.xfer);
2cc977e2	356
2ec749cb	357	if (r->req.cmd.xfer == 0) {
2cc977e2	358	if (r->buf != NULL)
e3c916e6	359	qemu_free(r->buf);
2cc977e2 TS	360	r->buflen = 0;
2cc977e2 TS	361	r->buf = NULL;
428c149b	362	ret = execute_command(s->bs, r, SG_DXFER_NONE, scsi_command_complete);
2cc977e2 TS	363	if (ret == -1) {
	364	scsi_command_complete(r, -EINVAL);
	365	return 0;
	366	}
	367	return 0;
	368	}
	369
2ec749cb	370	if (r->buflen != r->req.cmd.xfer) {
2cc977e2	371	if (r->buf != NULL)
e3c916e6	372	qemu_free(r->buf);
2ec749cb GH	373	r->buf = qemu_malloc(r->req.cmd.xfer);
2ec749cb GH	374	r->buflen = r->req.cmd.xfer;
2cc977e2 TS	375	}
	376
	377	memset(r->buf, 0, r->buflen);
2ec749cb	378	r->len = r->req.cmd.xfer;
97a06435	379	if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
2cc977e2	380	r->len = 0;
2ec749cb	381	return -r->req.cmd.xfer;
2cc977e2 TS	382	}
2cc977e2 TS	383
2ec749cb	384	return r->req.cmd.xfer;
2cc977e2 TS	385	}
	386
	387	static int get_blocksize(BlockDriverState *bdrv)
	388	{
	389	uint8_t cmd[10];
	390	uint8_t buf[8];
	391	uint8_t sensebuf[8];
	392	sg_io_hdr_t io_header;
	393	int ret;
	394
4f26a486 AL	395	memset(cmd, 0, sizeof(cmd));
4f26a486 AL	396	memset(buf, 0, sizeof(buf));
2cc977e2 TS	397	cmd[0] = READ_CAPACITY;
	398
	399	memset(&io_header, 0, sizeof(io_header));
	400	io_header.interface_id = 'S';
	401	io_header.dxfer_direction = SG_DXFER_FROM_DEV;
	402	io_header.dxfer_len = sizeof(buf);
	403	io_header.dxferp = buf;
	404	io_header.cmdp = cmd;
	405	io_header.cmd_len = sizeof(cmd);
	406	io_header.mx_sb_len = sizeof(sensebuf);
	407	io_header.sbp = sensebuf;
	408	io_header.timeout = 6000; /* XXX */
	409
221f715d	410	ret = bdrv_ioctl(bdrv, SG_IO, &io_header);
7d780669	411	if (ret < 0)
2cc977e2 TS	412	return -1;
	413
	414	return (buf[4] << 24) \| (buf[5] << 16) \| (buf[6] << 8) \| buf[7];
	415	}
	416
89c0f643 AJ	417	static int get_stream_blocksize(BlockDriverState *bdrv)
	418	{
	419	uint8_t cmd[6];
	420	uint8_t buf[12];
	421	uint8_t sensebuf[8];
	422	sg_io_hdr_t io_header;
	423	int ret;
	424
	425	memset(cmd, 0, sizeof(cmd));
	426	memset(buf, 0, sizeof(buf));
	427	cmd[0] = MODE_SENSE;
	428	cmd[4] = sizeof(buf);
	429
	430	memset(&io_header, 0, sizeof(io_header));
	431	io_header.interface_id = 'S';
	432	io_header.dxfer_direction = SG_DXFER_FROM_DEV;
	433	io_header.dxfer_len = sizeof(buf);
	434	io_header.dxferp = buf;
	435	io_header.cmdp = cmd;
	436	io_header.cmd_len = sizeof(cmd);
	437	io_header.mx_sb_len = sizeof(sensebuf);
	438	io_header.sbp = sensebuf;
	439	io_header.timeout = 6000; /* XXX */
	440
221f715d	441	ret = bdrv_ioctl(bdrv, SG_IO, &io_header);
7d780669	442	if (ret < 0)
89c0f643 AJ	443	return -1;
	444
	445	return (buf[9] << 16) \| (buf[10] << 8) \| buf[11];
	446	}
	447
2cc977e2 TS	448	static void scsi_destroy(SCSIDevice *d)
2cc977e2 TS	449	{
d52affa7	450	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);
9af99d98	451	SCSIGenericReq *r;
2cc977e2	452
9af99d98 GH	453	while (!QTAILQ_EMPTY(&s->qdev.requests)) {
	454	r = DO_UPCAST(SCSIGenericReq, req, QTAILQ_FIRST(&s->qdev.requests));
	455	scsi_remove_request(r);
2cc977e2	456	}
428c149b	457	drive_uninit(s->qdev.conf.dinfo);
2cc977e2 TS	458	}
2cc977e2 TS	459
d52affa7	460	static int scsi_generic_initfn(SCSIDevice *dev)
2cc977e2	461	{
d52affa7	462	SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, dev);
2cc977e2	463	int sg_version;
2cc977e2 TS	464	struct sg_scsi_id scsiid;
2cc977e2 TS	465
428c149b	466	if (!s->qdev.conf.dinfo \|\| !s->qdev.conf.dinfo->bdrv) {
d52affa7 GH	467	qemu_error("scsi-generic: drive property not set\n");
	468	return -1;
	469	}
428c149b	470	s->bs = s->qdev.conf.dinfo->bdrv;
2cc977e2	471
d52affa7	472	/* check we are really using a /dev/sg* file */
428c149b	473	if (!bdrv_is_sg(s->bs)) {
d52affa7 GH	474	qemu_error("scsi-generic: not /dev/sg*\n");
	475	return -1;
	476	}
2cc977e2 TS	477
2cc977e2 TS	478	/* check we are using a driver managing SG_IO (version 3 and after */
428c149b	479	if (bdrv_ioctl(s->bs, SG_GET_VERSION_NUM, &sg_version) < 0 \|\|
d52affa7 GH	480	sg_version < 30000) {
	481	qemu_error("scsi-generic: scsi generic interface too old\n");
	482	return -1;
	483	}
2cc977e2 TS	484
2cc977e2 TS	485	/* get LUN of the /dev/sg? */
428c149b	486	if (bdrv_ioctl(s->bs, SG_GET_SCSI_ID, &scsiid)) {
d52affa7 GH	487	qemu_error("scsi-generic: SG_GET_SCSI_ID ioctl failed\n");
	488	return -1;
	489	}
2cc977e2 TS	490
2cc977e2 TS	491	/* define device state */
2cc977e2	492	s->lun = scsiid.lun;
89c0f643	493	DPRINTF("LUN %d\n", s->lun);
91376656 GH	494	s->qdev.type = scsiid.scsi_type;
	495	DPRINTF("device type %d\n", s->qdev.type);
	496	if (s->qdev.type == TYPE_TAPE) {
428c149b	497	s->qdev.blocksize = get_stream_blocksize(s->bs);
b07995e3 GH	498	if (s->qdev.blocksize == -1)
b07995e3 GH	499	s->qdev.blocksize = 0;
89c0f643	500	} else {
428c149b	501	s->qdev.blocksize = get_blocksize(s->bs);
89c0f643	502	/* removable media returns 0 if not present */
b07995e3	503	if (s->qdev.blocksize <= 0) {
91376656	504	if (s->qdev.type == TYPE_ROM \|\| s->qdev.type == TYPE_WORM)
b07995e3	505	s->qdev.blocksize = 2048;
89c0f643	506	else
b07995e3	507	s->qdev.blocksize = 512;
89c0f643 AJ	508	}
89c0f643 AJ	509	}
b07995e3	510	DPRINTF("block size %d\n", s->qdev.blocksize);
2cc977e2 TS	511	s->driver_status = 0;
2cc977e2 TS	512	memset(s->sensebuf, 0, sizeof(s->sensebuf));
d52affa7 GH	513	return 0;
d52affa7 GH	514	}
2cc977e2	515
d52affa7 GH	516	static SCSIDeviceInfo scsi_generic_info = {
	517	.qdev.name = "scsi-generic",
	518	.qdev.desc = "pass through generic scsi device (/dev/sg*)",
	519	.qdev.size = sizeof(SCSIGenericState),
	520	.init = scsi_generic_initfn,
	521	.destroy = scsi_destroy,
	522	.send_command = scsi_send_command,
	523	.read_data = scsi_read_data,
	524	.write_data = scsi_write_data,
	525	.cancel_io = scsi_cancel_io,
	526	.get_buf = scsi_get_buf,
	527	.qdev.props = (Property[]) {
428c149b	528	DEFINE_BLOCK_PROPERTIES(SCSIGenericState, qdev.conf),
d52affa7 GH	529	DEFINE_PROP_END_OF_LIST(),
	530	},
	531	};
2cc977e2	532
d52affa7 GH	533	static void scsi_generic_register_devices(void)
	534	{
	535	scsi_qdev_register(&scsi_generic_info);
2cc977e2	536	}
d52affa7 GH	537	device_init(scsi_generic_register_devices)
d52affa7 GH	538
2cc977e2	539	#endif /* __linux__ */