if (ret == -1) {        scsi_command_complete(r, -EINVAL);        return 1;    }    return 0;}/* Return a pointer to the data buffer.  */static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag){    SCSIDeviceState *s = d->state;    SCSIRequest *r;    r = scsi_find_request(s, tag);    if (!r) {        BADF("Bad buffer tag 0x%x\n", tag);        return NULL;    }    return r->buf;}static int scsi_length(uint8_t *cmd, int blocksize, int *cmdlen, uint32_t *len){    switch (cmd[0] >> 5) {    case 0:        *len = cmd[4];        *cmdlen = 6;        break;    case 1:    case 2:        *len = cmd[8] | (cmd[7] << 8);        *cmdlen = 10;        break;    case 4:        *len = cmd[13] | (cmd[12] << 8) | (cmd[11] << 16) | (cmd[10] << 24);        *cmdlen = 16;        break;    case 5:        *len = cmd[9] | (cmd[8] << 8) | (cmd[7] << 16) | (cmd[6] << 24);        *cmdlen = 12;        break;    default:        return -1;    }    switch(cmd[0]) {    case TEST_UNIT_READY:    case REZERO_UNIT:    case START_STOP:    case SEEK_6:    case WRITE_FILEMARKS:    case SPACE:    case ERASE:    case ALLOW_MEDIUM_REMOVAL:    case VERIFY:    case SEEK_10:    case SYNCHRONIZE_CACHE:    case LOCK_UNLOCK_CACHE:    case LOAD_UNLOAD:    case SET_CD_SPEED:    case SET_LIMITS:    case WRITE_LONG:    case MOVE_MEDIUM:    case UPDATE_BLOCK:        *len = 0;        break;    case MODE_SENSE:        break;    case WRITE_SAME:        *len = 1;        break;    case READ_CAPACITY:        *len = 8;        break;    case READ_BLOCK_LIMITS:        *len = 6;        break;    case READ_POSITION:        *len = 20;        break;    case SEND_VOLUME_TAG:        *len *= 40;        break;    case MEDIUM_SCAN:        *len *= 8;        break;    case WRITE_10:        cmd[1] &= ~0x08;	/* disable FUA */    case WRITE_VERIFY:    case WRITE_6:    case WRITE_12:    case WRITE_VERIFY_12:        *len *= blocksize;        break;    case READ_10:        cmd[1] &= ~0x08;	/* disable FUA */    case READ_6:    case READ_REVERSE:    case RECOVER_BUFFERED_DATA:    case READ_12:        *len *= blocksize;        break;    }    return 0;}static int is_write(int command){    switch (command) {    case COPY:    case COPY_VERIFY:    case COMPARE:    case CHANGE_DEFINITION:    case LOG_SELECT:    case MODE_SELECT:    case MODE_SELECT_10:    case SEND_DIAGNOSTIC:    case WRITE_BUFFER:    case FORMAT_UNIT:    case REASSIGN_BLOCKS:    case RESERVE:    case SEARCH_EQUAL:    case SEARCH_HIGH:    case SEARCH_LOW:    case WRITE_6:    case WRITE_10:    case WRITE_VERIFY:    case UPDATE_BLOCK:    case WRITE_LONG:    case WRITE_SAME:    case SEARCH_HIGH_12:    case SEARCH_EQUAL_12:    case SEARCH_LOW_12:    case WRITE_12:    case WRITE_VERIFY_12:    case SET_WINDOW:    case MEDIUM_SCAN:    case SEND_VOLUME_TAG:    case WRITE_LONG_2:        return 1;    }    return 0;}/* Execute a scsi command.  Returns the length of the data expected by the   command.  This will be Positive for data transfers from the device   (eg. disk reads), negative for transfers to the device (eg. disk writes),   and zero if the command does not transfer any data.  */static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,                                 uint8_t *cmd, int lun){    SCSIDeviceState *s = d->state;    uint32_t len;    int cmdlen;    SCSIRequest *r;    int ret;    /* ??? Tags are not unique for different luns.  We only implement a       single lun, so this should not matter.  */    if (lun != s->lun || (cmd[1] >> 5) != s->lun) {        DPRINTF("Unimplemented LUN %d\n", lun ? lun : cmd[1] >> 5);        s->completion(s->opaque, SCSI_REASON_DONE, tag, ILLEGAL_REQUEST);        return 0;    }    if (scsi_length(cmd, s->blocksize, &cmdlen, &len) == -1) {        BADF("Unsupported command length, command %x\n", cmd[0]);        return 0;    }    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x len %d\n", lun, tag,            cmd[0], len);    r = scsi_find_request(s, tag);    if (r) {        BADF("Tag 0x%x already in use %p\n", tag, r);        scsi_cancel_io(d, tag);    }    r = scsi_new_request(s, tag);    memcpy(r->cmd, cmd, cmdlen);    r->cmdlen = cmdlen;    if (len == 0) {        if (r->buf != NULL)            free(r->buf);        r->buflen = 0;        r->buf = NULL;        ret = execute_command(s->bdrv, r, SG_DXFER_NONE, scsi_command_complete);        if (ret == -1) {            scsi_command_complete(r, -EINVAL);            return 0;        }        return 0;    }    if (r->buflen != len) {        if (r->buf != NULL)            free(r->buf);        r->buf = qemu_malloc(len);        r->buflen = len;    }    memset(r->buf, 0, r->buflen);    r->len = len;    if (is_write(cmd[0])) {        r->len = 0;        return -len;    }    return len;}static int get_blocksize(BlockDriverState *bdrv){    uint8_t cmd[10];    uint8_t buf[8];    uint8_t sensebuf[8];    sg_io_hdr_t io_header;    int ret;    memset(cmd, sizeof(cmd), 0);    memset(buf, sizeof(buf), 0);    cmd[0] = READ_CAPACITY;    memset(&io_header, 0, sizeof(io_header));    io_header.interface_id = 'S';    io_header.dxfer_direction = SG_DXFER_FROM_DEV;    io_header.dxfer_len = sizeof(buf);    io_header.dxferp = buf;    io_header.cmdp = cmd;    io_header.cmd_len = sizeof(cmd);    io_header.mx_sb_len = sizeof(sensebuf);    io_header.sbp = sensebuf;    io_header.timeout = 6000; /* XXX */    ret = bdrv_pwrite(bdrv, -1, &io_header, sizeof(io_header));    if (ret == -1)        return -1;    while ((ret = bdrv_pread(bdrv, -1, &io_header, sizeof(io_header))) == -1 &&           errno == EINTR);    if (ret == -1)        return -1;    return (buf[4] << 24) | (buf[5] << 16) | (buf[6] << 8) | buf[7];}static void scsi_destroy(SCSIDevice *d){    SCSIRequest *r, *n;    r = d->state->requests;    while (r) {        n = r->next;        qemu_free(r);        r = n;    }    r = free_requests;    while (r) {        n = r->next;        qemu_free(r);        r = n;    }    qemu_free(d->state);    qemu_free(d);}SCSIDevice *scsi_generic_init(BlockDriverState *bdrv, int tcq,                              scsi_completionfn completion, void *opaque){    int sg_version;    SCSIDevice *d;    SCSIDeviceState *s;    struct sg_scsi_id scsiid;    /* check we are really using a /dev/sg* file */    if (!bdrv_is_sg(bdrv))        return NULL;    /* check we are using a driver managing SG_IO (version 3 and after */    if (bdrv_ioctl(bdrv, SG_GET_VERSION_NUM, &sg_version) < 0 ||        sg_version < 30000)        return NULL;    /* get LUN of the /dev/sg? */    if (bdrv_ioctl(bdrv, SG_GET_SCSI_ID, &scsiid))        return NULL;    /* define device state */    s = (SCSIDeviceState *)qemu_mallocz(sizeof(SCSIDeviceState));    s->bdrv = bdrv;    s->requests = NULL;    s->completion = completion;    s->opaque = opaque;    s->lun = scsiid.lun;    s->blocksize = get_blocksize(s->bdrv);    s->driver_status = 0;    memset(s->sensebuf, 0, sizeof(s->sensebuf));    /* removable media returns 0 if not present */    if (s->blocksize <= 0)        s->blocksize = 2048;    /* define function to manage device */    d = (SCSIDevice *)qemu_mallocz(sizeof(SCSIDevice));    d->state = s;    d->destroy = scsi_destroy;    d->send_command = scsi_send_command;    d->read_data = scsi_read_data;    d->write_data = scsi_write_data;    d->cancel_io = scsi_cancel_io;    d->get_buf = scsi_get_buf;    return d;}#endif /* __linux__ */