qemu/hw/scsi/virtio-scsi.c
<<
>>
Prefs
   1/*
   2 * Virtio SCSI HBA
   3 *
   4 * Copyright IBM, Corp. 2010
   5 * Copyright Red Hat, Inc. 2011
   6 *
   7 * Authors:
   8 *   Stefan Hajnoczi    <stefanha@linux.vnet.ibm.com>
   9 *   Paolo Bonzini      <pbonzini@redhat.com>
  10 *
  11 * This work is licensed under the terms of the GNU GPL, version 2 or later.
  12 * See the COPYING file in the top-level directory.
  13 *
  14 */
  15
  16#include "qemu/osdep.h"
  17#include "qapi/error.h"
  18#include "standard-headers/linux/virtio_ids.h"
  19#include "hw/virtio/virtio-scsi.h"
  20#include "qemu/error-report.h"
  21#include "qemu/iov.h"
  22#include "sysemu/block-backend.h"
  23#include "hw/scsi/scsi.h"
  24#include "scsi/constants.h"
  25#include "hw/virtio/virtio-bus.h"
  26#include "hw/virtio/virtio-access.h"
  27
  28static inline int virtio_scsi_get_lun(uint8_t *lun)
  29{
  30    return ((lun[2] << 8) | lun[3]) & 0x3FFF;
  31}
  32
  33static inline SCSIDevice *virtio_scsi_device_find(VirtIOSCSI *s, uint8_t *lun)
  34{
  35    if (lun[0] != 1) {
  36        return NULL;
  37    }
  38    if (lun[2] != 0 && !(lun[2] >= 0x40 && lun[2] < 0x80)) {
  39        return NULL;
  40    }
  41    return scsi_device_find(&s->bus, 0, lun[1], virtio_scsi_get_lun(lun));
  42}
  43
  44void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req)
  45{
  46    VirtIODevice *vdev = VIRTIO_DEVICE(s);
  47    const size_t zero_skip =
  48        offsetof(VirtIOSCSIReq, resp_iov) + sizeof(req->resp_iov);
  49
  50    req->vq = vq;
  51    req->dev = s;
  52    qemu_sglist_init(&req->qsgl, DEVICE(s), 8, vdev->dma_as);
  53    qemu_iovec_init(&req->resp_iov, 1);
  54    memset((uint8_t *)req + zero_skip, 0, sizeof(*req) - zero_skip);
  55}
  56
  57void virtio_scsi_free_req(VirtIOSCSIReq *req)
  58{
  59    qemu_iovec_destroy(&req->resp_iov);
  60    qemu_sglist_destroy(&req->qsgl);
  61    g_free(req);
  62}
  63
  64static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
  65{
  66    VirtIOSCSI *s = req->dev;
  67    VirtQueue *vq = req->vq;
  68    VirtIODevice *vdev = VIRTIO_DEVICE(s);
  69
  70    qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size);
  71    virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
  72    if (s->dataplane_started && !s->dataplane_fenced) {
  73        virtio_notify_irqfd(vdev, vq);
  74    } else {
  75        virtio_notify(vdev, vq);
  76    }
  77
  78    if (req->sreq) {
  79        req->sreq->hba_private = NULL;
  80        scsi_req_unref(req->sreq);
  81    }
  82    virtio_scsi_free_req(req);
  83}
  84
  85static void virtio_scsi_bad_req(VirtIOSCSIReq *req)
  86{
  87    virtio_error(VIRTIO_DEVICE(req->dev), "wrong size for virtio-scsi headers");
  88    virtqueue_detach_element(req->vq, &req->elem, 0);
  89    virtio_scsi_free_req(req);
  90}
  91
  92static size_t qemu_sgl_concat(VirtIOSCSIReq *req, struct iovec *iov,
  93                              hwaddr *addr, int num, size_t skip)
  94{
  95    QEMUSGList *qsgl = &req->qsgl;
  96    size_t copied = 0;
  97
  98    while (num) {
  99        if (skip >= iov->iov_len) {
 100            skip -= iov->iov_len;
 101        } else {
 102            qemu_sglist_add(qsgl, *addr + skip, iov->iov_len - skip);
 103            copied += iov->iov_len - skip;
 104            skip = 0;
 105        }
 106        iov++;
 107        addr++;
 108        num--;
 109    }
 110
 111    assert(skip == 0);
 112    return copied;
 113}
 114
 115static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
 116                                 unsigned req_size, unsigned resp_size)
 117{
 118    VirtIODevice *vdev = (VirtIODevice *) req->dev;
 119    size_t in_size, out_size;
 120
 121    if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 122                   &req->req, req_size) < req_size) {
 123        return -EINVAL;
 124    }
 125
 126    if (qemu_iovec_concat_iov(&req->resp_iov,
 127                              req->elem.in_sg, req->elem.in_num, 0,
 128                              resp_size) < resp_size) {
 129        return -EINVAL;
 130    }
 131
 132    req->resp_size = resp_size;
 133
 134    /* Old BIOSes left some padding by mistake after the req_size/resp_size.
 135     * As a workaround, always consider the first buffer as the virtio-scsi
 136     * request/response, making the payload start at the second element
 137     * of the iovec.
 138     *
 139     * The actual length of the response header, stored in req->resp_size,
 140     * does not change.
 141     *
 142     * TODO: always disable this workaround for virtio 1.0 devices.
 143     */
 144    if (!virtio_vdev_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
 145        if (req->elem.out_num) {
 146            req_size = req->elem.out_sg[0].iov_len;
 147        }
 148        if (req->elem.in_num) {
 149            resp_size = req->elem.in_sg[0].iov_len;
 150        }
 151    }
 152
 153    out_size = qemu_sgl_concat(req, req->elem.out_sg,
 154                               &req->elem.out_addr[0], req->elem.out_num,
 155                               req_size);
 156    in_size = qemu_sgl_concat(req, req->elem.in_sg,
 157                              &req->elem.in_addr[0], req->elem.in_num,
 158                              resp_size);
 159
 160    if (out_size && in_size) {
 161        return -ENOTSUP;
 162    }
 163
 164    if (out_size) {
 165        req->mode = SCSI_XFER_TO_DEV;
 166    } else if (in_size) {
 167        req->mode = SCSI_XFER_FROM_DEV;
 168    }
 169
 170    return 0;
 171}
 172
 173static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
 174{
 175    VirtIOSCSICommon *vs = (VirtIOSCSICommon *)s;
 176    VirtIOSCSIReq *req;
 177
 178    req = virtqueue_pop(vq, sizeof(VirtIOSCSIReq) + vs->cdb_size);
 179    if (!req) {
 180        return NULL;
 181    }
 182    virtio_scsi_init_req(s, vq, req);
 183    return req;
 184}
 185
 186static void virtio_scsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 187{
 188    VirtIOSCSIReq *req = sreq->hba_private;
 189    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(req->dev);
 190    uint32_t n = virtio_get_queue_index(req->vq) - 2;
 191
 192    assert(n < vs->conf.num_queues);
 193    qemu_put_be32s(f, &n);
 194    qemu_put_virtqueue_element(f, &req->elem);
 195}
 196
 197static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 198{
 199    SCSIBus *bus = sreq->bus;
 200    VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 201    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 202    VirtIODevice *vdev = VIRTIO_DEVICE(s);
 203    VirtIOSCSIReq *req;
 204    uint32_t n;
 205
 206    qemu_get_be32s(f, &n);
 207    assert(n < vs->conf.num_queues);
 208    req = qemu_get_virtqueue_element(vdev, f,
 209                                     sizeof(VirtIOSCSIReq) + vs->cdb_size);
 210    virtio_scsi_init_req(s, vs->cmd_vqs[n], req);
 211
 212    if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 213                              sizeof(VirtIOSCSICmdResp) + vs->sense_size) < 0) {
 214        error_report("invalid SCSI request migration data");
 215        exit(1);
 216    }
 217
 218    scsi_req_ref(sreq);
 219    req->sreq = sreq;
 220    if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
 221        assert(req->sreq->cmd.mode == req->mode);
 222    }
 223    return req;
 224}
 225
 226typedef struct {
 227    Notifier        notifier;
 228    VirtIOSCSIReq  *tmf_req;
 229} VirtIOSCSICancelNotifier;
 230
 231static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
 232{
 233    VirtIOSCSICancelNotifier *n = container_of(notifier,
 234                                               VirtIOSCSICancelNotifier,
 235                                               notifier);
 236
 237    if (--n->tmf_req->remaining == 0) {
 238        virtio_scsi_complete_req(n->tmf_req);
 239    }
 240    g_free(n);
 241}
 242
 243static inline void virtio_scsi_ctx_check(VirtIOSCSI *s, SCSIDevice *d)
 244{
 245    if (s->dataplane_started && d && blk_is_available(d->conf.blk)) {
 246        assert(blk_get_aio_context(d->conf.blk) == s->ctx);
 247    }
 248}
 249
 250/* Return 0 if the request is ready to be completed and return to guest;
 251 * -EINPROGRESS if the request is submitted and will be completed later, in the
 252 *  case of async cancellation. */
 253static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 254{
 255    SCSIDevice *d = virtio_scsi_device_find(s, req->req.tmf.lun);
 256    SCSIRequest *r, *next;
 257    BusChild *kid;
 258    int target;
 259    int ret = 0;
 260
 261    virtio_scsi_ctx_check(s, d);
 262    /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
 263    req->resp.tmf.response = VIRTIO_SCSI_S_OK;
 264
 265    virtio_tswap32s(VIRTIO_DEVICE(s), &req->req.tmf.subtype);
 266    switch (req->req.tmf.subtype) {
 267    case VIRTIO_SCSI_T_TMF_ABORT_TASK:
 268    case VIRTIO_SCSI_T_TMF_QUERY_TASK:
 269        if (!d) {
 270            goto fail;
 271        }
 272        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 273            goto incorrect_lun;
 274        }
 275        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 276            VirtIOSCSIReq *cmd_req = r->hba_private;
 277            if (cmd_req && cmd_req->req.cmd.tag == req->req.tmf.tag) {
 278                break;
 279            }
 280        }
 281        if (r) {
 282            /*
 283             * Assert that the request has not been completed yet, we
 284             * check for it in the loop above.
 285             */
 286            assert(r->hba_private);
 287            if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK) {
 288                /* "If the specified command is present in the task set, then
 289                 * return a service response set to FUNCTION SUCCEEDED".
 290                 */
 291                req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 292            } else {
 293                VirtIOSCSICancelNotifier *notifier;
 294
 295                req->remaining = 1;
 296                notifier = g_new(VirtIOSCSICancelNotifier, 1);
 297                notifier->tmf_req = req;
 298                notifier->notifier.notify = virtio_scsi_cancel_notify;
 299                scsi_req_cancel_async(r, &notifier->notifier);
 300                ret = -EINPROGRESS;
 301            }
 302        }
 303        break;
 304
 305    case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
 306        if (!d) {
 307            goto fail;
 308        }
 309        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 310            goto incorrect_lun;
 311        }
 312        s->resetting++;
 313        qdev_reset_all(&d->qdev);
 314        s->resetting--;
 315        break;
 316
 317    case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
 318    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
 319    case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
 320        if (!d) {
 321            goto fail;
 322        }
 323        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 324            goto incorrect_lun;
 325        }
 326
 327        /* Add 1 to "remaining" until virtio_scsi_do_tmf returns.
 328         * This way, if the bus starts calling back to the notifiers
 329         * even before we finish the loop, virtio_scsi_cancel_notify
 330         * will not complete the TMF too early.
 331         */
 332        req->remaining = 1;
 333        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 334            if (r->hba_private) {
 335                if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK_SET) {
 336                    /* "If there is any command present in the task set, then
 337                     * return a service response set to FUNCTION SUCCEEDED".
 338                     */
 339                    req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 340                    break;
 341                } else {
 342                    VirtIOSCSICancelNotifier *notifier;
 343
 344                    req->remaining++;
 345                    notifier = g_new(VirtIOSCSICancelNotifier, 1);
 346                    notifier->notifier.notify = virtio_scsi_cancel_notify;
 347                    notifier->tmf_req = req;
 348                    scsi_req_cancel_async(r, &notifier->notifier);
 349                }
 350            }
 351        }
 352        if (--req->remaining > 0) {
 353            ret = -EINPROGRESS;
 354        }
 355        break;
 356
 357    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
 358        target = req->req.tmf.lun[1];
 359        s->resetting++;
 360        QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 361             d = SCSI_DEVICE(kid->child);
 362             if (d->channel == 0 && d->id == target) {
 363                qdev_reset_all(&d->qdev);
 364             }
 365        }
 366        s->resetting--;
 367        break;
 368
 369    case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
 370    default:
 371        req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
 372        break;
 373    }
 374
 375    return ret;
 376
 377incorrect_lun:
 378    req->resp.tmf.response = VIRTIO_SCSI_S_INCORRECT_LUN;
 379    return ret;
 380
 381fail:
 382    req->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
 383    return ret;
 384}
 385
 386static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
 387{
 388    VirtIODevice *vdev = (VirtIODevice *)s;
 389    uint32_t type;
 390    int r = 0;
 391
 392    if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 393                &type, sizeof(type)) < sizeof(type)) {
 394        virtio_scsi_bad_req(req);
 395        return;
 396    }
 397
 398    virtio_tswap32s(vdev, &type);
 399    if (type == VIRTIO_SCSI_T_TMF) {
 400        if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
 401                    sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
 402            virtio_scsi_bad_req(req);
 403            return;
 404        } else {
 405            r = virtio_scsi_do_tmf(s, req);
 406        }
 407
 408    } else if (type == VIRTIO_SCSI_T_AN_QUERY ||
 409               type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
 410        if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),
 411                    sizeof(VirtIOSCSICtrlANResp)) < 0) {
 412            virtio_scsi_bad_req(req);
 413            return;
 414        } else {
 415            req->resp.an.event_actual = 0;
 416            req->resp.an.response = VIRTIO_SCSI_S_OK;
 417        }
 418    }
 419    if (r == 0) {
 420        virtio_scsi_complete_req(req);
 421    } else {
 422        assert(r == -EINPROGRESS);
 423    }
 424}
 425
 426bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
 427{
 428    VirtIOSCSIReq *req;
 429    bool progress = false;
 430
 431    while ((req = virtio_scsi_pop_req(s, vq))) {
 432        progress = true;
 433        virtio_scsi_handle_ctrl_req(s, req);
 434    }
 435    return progress;
 436}
 437
 438static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
 439{
 440    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 441
 442    if (s->ctx) {
 443        virtio_device_start_ioeventfd(vdev);
 444        if (!s->dataplane_fenced) {
 445            return;
 446        }
 447    }
 448    virtio_scsi_acquire(s);
 449    virtio_scsi_handle_ctrl_vq(s, vq);
 450    virtio_scsi_release(s);
 451}
 452
 453static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
 454{
 455    /* Sense data is not in req->resp and is copied separately
 456     * in virtio_scsi_command_complete.
 457     */
 458    req->resp_size = sizeof(VirtIOSCSICmdResp);
 459    virtio_scsi_complete_req(req);
 460}
 461
 462static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,
 463                                         size_t resid)
 464{
 465    VirtIOSCSIReq *req = r->hba_private;
 466    uint8_t sense[SCSI_SENSE_BUF_SIZE];
 467    uint32_t sense_len;
 468    VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
 469
 470    if (r->io_canceled) {
 471        return;
 472    }
 473
 474    req->resp.cmd.response = VIRTIO_SCSI_S_OK;
 475    req->resp.cmd.status = status;
 476    if (req->resp.cmd.status == GOOD) {
 477        req->resp.cmd.resid = virtio_tswap32(vdev, resid);
 478    } else {
 479        req->resp.cmd.resid = 0;
 480        sense_len = scsi_req_get_sense(r, sense, sizeof(sense));
 481        sense_len = MIN(sense_len, req->resp_iov.size - sizeof(req->resp.cmd));
 482        qemu_iovec_from_buf(&req->resp_iov, sizeof(req->resp.cmd),
 483                            sense, sense_len);
 484        req->resp.cmd.sense_len = virtio_tswap32(vdev, sense_len);
 485    }
 486    virtio_scsi_complete_cmd_req(req);
 487}
 488
 489static int virtio_scsi_parse_cdb(SCSIDevice *dev, SCSICommand *cmd,
 490                                 uint8_t *buf, void *hba_private)
 491{
 492    VirtIOSCSIReq *req = hba_private;
 493
 494    if (cmd->len == 0) {
 495        cmd->len = MIN(VIRTIO_SCSI_CDB_DEFAULT_SIZE, SCSI_CMD_BUF_SIZE);
 496        memcpy(cmd->buf, buf, cmd->len);
 497    }
 498
 499    /* Extract the direction and mode directly from the request, for
 500     * host device passthrough.
 501     */
 502    cmd->xfer = req->qsgl.size;
 503    cmd->mode = req->mode;
 504    return 0;
 505}
 506
 507static QEMUSGList *virtio_scsi_get_sg_list(SCSIRequest *r)
 508{
 509    VirtIOSCSIReq *req = r->hba_private;
 510
 511    return &req->qsgl;
 512}
 513
 514static void virtio_scsi_request_cancelled(SCSIRequest *r)
 515{
 516    VirtIOSCSIReq *req = r->hba_private;
 517
 518    if (!req) {
 519        return;
 520    }
 521    if (req->dev->resetting) {
 522        req->resp.cmd.response = VIRTIO_SCSI_S_RESET;
 523    } else {
 524        req->resp.cmd.response = VIRTIO_SCSI_S_ABORTED;
 525    }
 526    virtio_scsi_complete_cmd_req(req);
 527}
 528
 529static void virtio_scsi_fail_cmd_req(VirtIOSCSIReq *req)
 530{
 531    req->resp.cmd.response = VIRTIO_SCSI_S_FAILURE;
 532    virtio_scsi_complete_cmd_req(req);
 533}
 534
 535static int virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
 536{
 537    VirtIOSCSICommon *vs = &s->parent_obj;
 538    SCSIDevice *d;
 539    int rc;
 540
 541    rc = virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 542                               sizeof(VirtIOSCSICmdResp) + vs->sense_size);
 543    if (rc < 0) {
 544        if (rc == -ENOTSUP) {
 545            virtio_scsi_fail_cmd_req(req);
 546            return -ENOTSUP;
 547        } else {
 548            virtio_scsi_bad_req(req);
 549            return -EINVAL;
 550        }
 551    }
 552
 553    d = virtio_scsi_device_find(s, req->req.cmd.lun);
 554    if (!d) {
 555        req->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
 556        virtio_scsi_complete_cmd_req(req);
 557        return -ENOENT;
 558    }
 559    virtio_scsi_ctx_check(s, d);
 560    req->sreq = scsi_req_new(d, req->req.cmd.tag,
 561                             virtio_scsi_get_lun(req->req.cmd.lun),
 562                             req->req.cmd.cdb, req);
 563
 564    if (req->sreq->cmd.mode != SCSI_XFER_NONE
 565        && (req->sreq->cmd.mode != req->mode ||
 566            req->sreq->cmd.xfer > req->qsgl.size)) {
 567        req->resp.cmd.response = VIRTIO_SCSI_S_OVERRUN;
 568        virtio_scsi_complete_cmd_req(req);
 569        return -ENOBUFS;
 570    }
 571    scsi_req_ref(req->sreq);
 572    blk_io_plug(d->conf.blk);
 573    return 0;
 574}
 575
 576static void virtio_scsi_handle_cmd_req_submit(VirtIOSCSI *s, VirtIOSCSIReq *req)
 577{
 578    SCSIRequest *sreq = req->sreq;
 579    if (scsi_req_enqueue(sreq)) {
 580        scsi_req_continue(sreq);
 581    }
 582    blk_io_unplug(sreq->dev->conf.blk);
 583    scsi_req_unref(sreq);
 584}
 585
 586bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
 587{
 588    VirtIOSCSIReq *req, *next;
 589    int ret = 0;
 590    bool progress = false;
 591
 592    QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
 593
 594    do {
 595        virtio_queue_set_notification(vq, 0);
 596
 597        while ((req = virtio_scsi_pop_req(s, vq))) {
 598            progress = true;
 599            ret = virtio_scsi_handle_cmd_req_prepare(s, req);
 600            if (!ret) {
 601                QTAILQ_INSERT_TAIL(&reqs, req, next);
 602            } else if (ret == -EINVAL) {
 603                /* The device is broken and shouldn't process any request */
 604                while (!QTAILQ_EMPTY(&reqs)) {
 605                    req = QTAILQ_FIRST(&reqs);
 606                    QTAILQ_REMOVE(&reqs, req, next);
 607                    blk_io_unplug(req->sreq->dev->conf.blk);
 608                    scsi_req_unref(req->sreq);
 609                    virtqueue_detach_element(req->vq, &req->elem, 0);
 610                    virtio_scsi_free_req(req);
 611                }
 612            }
 613        }
 614
 615        virtio_queue_set_notification(vq, 1);
 616    } while (ret != -EINVAL && !virtio_queue_empty(vq));
 617
 618    QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
 619        virtio_scsi_handle_cmd_req_submit(s, req);
 620    }
 621    return progress;
 622}
 623
 624static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
 625{
 626    /* use non-QOM casts in the data path */
 627    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 628
 629    if (s->ctx) {
 630        virtio_device_start_ioeventfd(vdev);
 631        if (!s->dataplane_fenced) {
 632            return;
 633        }
 634    }
 635    virtio_scsi_acquire(s);
 636    virtio_scsi_handle_cmd_vq(s, vq);
 637    virtio_scsi_release(s);
 638}
 639
 640static void virtio_scsi_get_config(VirtIODevice *vdev,
 641                                   uint8_t *config)
 642{
 643    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 644    VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(vdev);
 645
 646    virtio_stl_p(vdev, &scsiconf->num_queues, s->conf.num_queues);
 647    virtio_stl_p(vdev, &scsiconf->seg_max, 128 - 2);
 648    virtio_stl_p(vdev, &scsiconf->max_sectors, s->conf.max_sectors);
 649    virtio_stl_p(vdev, &scsiconf->cmd_per_lun, s->conf.cmd_per_lun);
 650    virtio_stl_p(vdev, &scsiconf->event_info_size, sizeof(VirtIOSCSIEvent));
 651    virtio_stl_p(vdev, &scsiconf->sense_size, s->sense_size);
 652    virtio_stl_p(vdev, &scsiconf->cdb_size, s->cdb_size);
 653    virtio_stw_p(vdev, &scsiconf->max_channel, VIRTIO_SCSI_MAX_CHANNEL);
 654    virtio_stw_p(vdev, &scsiconf->max_target, VIRTIO_SCSI_MAX_TARGET);
 655    virtio_stl_p(vdev, &scsiconf->max_lun, VIRTIO_SCSI_MAX_LUN);
 656}
 657
 658static void virtio_scsi_set_config(VirtIODevice *vdev,
 659                                   const uint8_t *config)
 660{
 661    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 662    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 663
 664    if ((uint32_t) virtio_ldl_p(vdev, &scsiconf->sense_size) >= 65536 ||
 665        (uint32_t) virtio_ldl_p(vdev, &scsiconf->cdb_size) >= 256) {
 666        virtio_error(vdev,
 667                     "bad data written to virtio-scsi configuration space");
 668        return;
 669    }
 670
 671    vs->sense_size = virtio_ldl_p(vdev, &scsiconf->sense_size);
 672    vs->cdb_size = virtio_ldl_p(vdev, &scsiconf->cdb_size);
 673}
 674
 675static uint64_t virtio_scsi_get_features(VirtIODevice *vdev,
 676                                         uint64_t requested_features,
 677                                         Error **errp)
 678{
 679    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 680
 681    /* Firstly sync all virtio-scsi possible supported features */
 682    requested_features |= s->host_features;
 683    return requested_features;
 684}
 685
 686static void virtio_scsi_reset(VirtIODevice *vdev)
 687{
 688    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 689    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 690
 691    assert(!s->dataplane_started);
 692    s->resetting++;
 693    qbus_reset_all(&s->bus.qbus);
 694    s->resetting--;
 695
 696    vs->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 697    vs->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 698    s->events_dropped = false;
 699}
 700
 701void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
 702                            uint32_t event, uint32_t reason)
 703{
 704    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 705    VirtIOSCSIReq *req;
 706    VirtIOSCSIEvent *evt;
 707    VirtIODevice *vdev = VIRTIO_DEVICE(s);
 708
 709    if (!(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
 710        return;
 711    }
 712
 713    req = virtio_scsi_pop_req(s, vs->event_vq);
 714    if (!req) {
 715        s->events_dropped = true;
 716        return;
 717    }
 718
 719    if (s->events_dropped) {
 720        event |= VIRTIO_SCSI_T_EVENTS_MISSED;
 721        s->events_dropped = false;
 722    }
 723
 724    if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
 725        virtio_scsi_bad_req(req);
 726        return;
 727    }
 728
 729    evt = &req->resp.event;
 730    memset(evt, 0, sizeof(VirtIOSCSIEvent));
 731    evt->event = virtio_tswap32(vdev, event);
 732    evt->reason = virtio_tswap32(vdev, reason);
 733    if (!dev) {
 734        assert(event == VIRTIO_SCSI_T_EVENTS_MISSED);
 735    } else {
 736        evt->lun[0] = 1;
 737        evt->lun[1] = dev->id;
 738
 739        /* Linux wants us to keep the same encoding we use for REPORT LUNS.  */
 740        if (dev->lun >= 256) {
 741            evt->lun[2] = (dev->lun >> 8) | 0x40;
 742        }
 743        evt->lun[3] = dev->lun & 0xFF;
 744    }
 745    virtio_scsi_complete_req(req);
 746}
 747
 748bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
 749{
 750    if (s->events_dropped) {
 751        virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
 752        return true;
 753    }
 754    return false;
 755}
 756
 757static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
 758{
 759    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 760
 761    if (s->ctx) {
 762        virtio_device_start_ioeventfd(vdev);
 763        if (!s->dataplane_fenced) {
 764            return;
 765        }
 766    }
 767    virtio_scsi_acquire(s);
 768    virtio_scsi_handle_event_vq(s, vq);
 769    virtio_scsi_release(s);
 770}
 771
 772static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)
 773{
 774    VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 775    VirtIODevice *vdev = VIRTIO_DEVICE(s);
 776
 777    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_CHANGE) &&
 778        dev->type != TYPE_ROM) {
 779        virtio_scsi_acquire(s);
 780        virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_PARAM_CHANGE,
 781                               sense.asc | (sense.ascq << 8));
 782        virtio_scsi_release(s);
 783    }
 784}
 785
 786static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 787                                Error **errp)
 788{
 789    VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 790    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 791    SCSIDevice *sd = SCSI_DEVICE(dev);
 792
 793    if (s->ctx && !s->dataplane_fenced) {
 794        if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
 795            return;
 796        }
 797        virtio_scsi_acquire(s);
 798        blk_set_aio_context(sd->conf.blk, s->ctx);
 799        virtio_scsi_release(s);
 800
 801    }
 802
 803    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 804        virtio_scsi_acquire(s);
 805        virtio_scsi_push_event(s, sd,
 806                               VIRTIO_SCSI_T_TRANSPORT_RESET,
 807                               VIRTIO_SCSI_EVT_RESET_RESCAN);
 808        virtio_scsi_release(s);
 809    }
 810}
 811
 812static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 813                                  Error **errp)
 814{
 815    VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 816    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 817    SCSIDevice *sd = SCSI_DEVICE(dev);
 818
 819    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 820        virtio_scsi_acquire(s);
 821        virtio_scsi_push_event(s, sd,
 822                               VIRTIO_SCSI_T_TRANSPORT_RESET,
 823                               VIRTIO_SCSI_EVT_RESET_REMOVED);
 824        virtio_scsi_release(s);
 825    }
 826
 827    qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
 828}
 829
 830static struct SCSIBusInfo virtio_scsi_scsi_info = {
 831    .tcq = true,
 832    .max_channel = VIRTIO_SCSI_MAX_CHANNEL,
 833    .max_target = VIRTIO_SCSI_MAX_TARGET,
 834    .max_lun = VIRTIO_SCSI_MAX_LUN,
 835
 836    .complete = virtio_scsi_command_complete,
 837    .cancel = virtio_scsi_request_cancelled,
 838    .change = virtio_scsi_change,
 839    .parse_cdb = virtio_scsi_parse_cdb,
 840    .get_sg_list = virtio_scsi_get_sg_list,
 841    .save_request = virtio_scsi_save_request,
 842    .load_request = virtio_scsi_load_request,
 843};
 844
 845void virtio_scsi_common_realize(DeviceState *dev,
 846                                VirtIOHandleOutput ctrl,
 847                                VirtIOHandleOutput evt,
 848                                VirtIOHandleOutput cmd,
 849                                Error **errp)
 850{
 851    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 852    VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(dev);
 853    int i;
 854
 855    virtio_init(vdev, "virtio-scsi", VIRTIO_ID_SCSI,
 856                sizeof(VirtIOSCSIConfig));
 857
 858    if (s->conf.num_queues == 0 ||
 859            s->conf.num_queues > VIRTIO_QUEUE_MAX - 2) {
 860        error_setg(errp, "Invalid number of queues (= %" PRIu32 "), "
 861                         "must be a positive integer less than %d.",
 862                   s->conf.num_queues, VIRTIO_QUEUE_MAX - 2);
 863        virtio_cleanup(vdev);
 864        return;
 865    }
 866    s->cmd_vqs = g_new0(VirtQueue *, s->conf.num_queues);
 867    s->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 868    s->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 869
 870    s->ctrl_vq = virtio_add_queue(vdev, s->conf.virtqueue_size, ctrl);
 871    s->event_vq = virtio_add_queue(vdev, s->conf.virtqueue_size, evt);
 872    for (i = 0; i < s->conf.num_queues; i++) {
 873        s->cmd_vqs[i] = virtio_add_queue(vdev, s->conf.virtqueue_size, cmd);
 874    }
 875}
 876
 877static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
 878{
 879    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 880    VirtIOSCSI *s = VIRTIO_SCSI(dev);
 881    Error *err = NULL;
 882
 883    virtio_scsi_common_realize(dev,
 884                               virtio_scsi_handle_ctrl,
 885                               virtio_scsi_handle_event,
 886                               virtio_scsi_handle_cmd,
 887                               &err);
 888    if (err != NULL) {
 889        error_propagate(errp, err);
 890        return;
 891    }
 892
 893    scsi_bus_new(&s->bus, sizeof(s->bus), dev,
 894                 &virtio_scsi_scsi_info, vdev->bus_name);
 895    /* override default SCSI bus hotplug-handler, with virtio-scsi's one */
 896    qbus_set_hotplug_handler(BUS(&s->bus), dev, &error_abort);
 897
 898    virtio_scsi_dataplane_setup(s, errp);
 899}
 900
 901void virtio_scsi_common_unrealize(DeviceState *dev, Error **errp)
 902{
 903    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 904    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(dev);
 905
 906    g_free(vs->cmd_vqs);
 907    virtio_cleanup(vdev);
 908}
 909
 910static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp)
 911{
 912    VirtIOSCSI *s = VIRTIO_SCSI(dev);
 913
 914    qbus_set_hotplug_handler(BUS(&s->bus), NULL, &error_abort);
 915    virtio_scsi_common_unrealize(dev, errp);
 916}
 917
 918static Property virtio_scsi_properties[] = {
 919    DEFINE_PROP_UINT32("num_queues", VirtIOSCSI, parent_obj.conf.num_queues, 1),
 920    DEFINE_PROP_UINT32("virtqueue_size", VirtIOSCSI,
 921                                         parent_obj.conf.virtqueue_size, 128),
 922    DEFINE_PROP_UINT32("max_sectors", VirtIOSCSI, parent_obj.conf.max_sectors,
 923                                                  0xFFFF),
 924    DEFINE_PROP_UINT32("cmd_per_lun", VirtIOSCSI, parent_obj.conf.cmd_per_lun,
 925                                                  128),
 926    DEFINE_PROP_BIT("hotplug", VirtIOSCSI, host_features,
 927                                           VIRTIO_SCSI_F_HOTPLUG, true),
 928    DEFINE_PROP_BIT("param_change", VirtIOSCSI, host_features,
 929                                                VIRTIO_SCSI_F_CHANGE, true),
 930    DEFINE_PROP_LINK("iothread", VirtIOSCSI, parent_obj.conf.iothread,
 931                     TYPE_IOTHREAD, IOThread *),
 932    DEFINE_PROP_END_OF_LIST(),
 933};
 934
 935static const VMStateDescription vmstate_virtio_scsi = {
 936    .name = "virtio-scsi",
 937    .minimum_version_id = 1,
 938    .version_id = 1,
 939    .fields = (VMStateField[]) {
 940        VMSTATE_VIRTIO_DEVICE,
 941        VMSTATE_END_OF_LIST()
 942    },
 943};
 944
 945static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
 946{
 947    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 948    DeviceClass *dc = DEVICE_CLASS(klass);
 949
 950    vdc->get_config = virtio_scsi_get_config;
 951    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 952}
 953
 954static void virtio_scsi_class_init(ObjectClass *klass, void *data)
 955{
 956    DeviceClass *dc = DEVICE_CLASS(klass);
 957    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 958    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
 959
 960    dc->props = virtio_scsi_properties;
 961    dc->vmsd = &vmstate_virtio_scsi;
 962    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 963    vdc->realize = virtio_scsi_device_realize;
 964    vdc->unrealize = virtio_scsi_device_unrealize;
 965    vdc->set_config = virtio_scsi_set_config;
 966    vdc->get_features = virtio_scsi_get_features;
 967    vdc->reset = virtio_scsi_reset;
 968    vdc->start_ioeventfd = virtio_scsi_dataplane_start;
 969    vdc->stop_ioeventfd = virtio_scsi_dataplane_stop;
 970    hc->plug = virtio_scsi_hotplug;
 971    hc->unplug = virtio_scsi_hotunplug;
 972}
 973
 974static const TypeInfo virtio_scsi_common_info = {
 975    .name = TYPE_VIRTIO_SCSI_COMMON,
 976    .parent = TYPE_VIRTIO_DEVICE,
 977    .instance_size = sizeof(VirtIOSCSICommon),
 978    .abstract = true,
 979    .class_init = virtio_scsi_common_class_init,
 980};
 981
 982static const TypeInfo virtio_scsi_info = {
 983    .name = TYPE_VIRTIO_SCSI,
 984    .parent = TYPE_VIRTIO_SCSI_COMMON,
 985    .instance_size = sizeof(VirtIOSCSI),
 986    .class_init = virtio_scsi_class_init,
 987    .interfaces = (InterfaceInfo[]) {
 988        { TYPE_HOTPLUG_HANDLER },
 989        { }
 990    }
 991};
 992
 993static void virtio_register_types(void)
 994{
 995    type_register_static(&virtio_scsi_common_info);
 996    type_register_static(&virtio_scsi_info);
 997}
 998
 999type_init(virtio_register_types)
1000