qemu/hw/scsi/virtio-scsi.c
<<
>>
Prefs
   1/*
   2 * Virtio SCSI HBA
   3 *
   4 * Copyright IBM, Corp. 2010
   5 * Copyright Red Hat, Inc. 2011
   6 *
   7 * Authors:
   8 *   Stefan Hajnoczi    <stefanha@linux.vnet.ibm.com>
   9 *   Paolo Bonzini      <pbonzini@redhat.com>
  10 *
  11 * This work is licensed under the terms of the GNU GPL, version 2 or later.
  12 * See the COPYING file in the top-level directory.
  13 *
  14 */
  15
  16#include "standard-headers/linux/virtio_ids.h"
  17#include "hw/virtio/virtio-scsi.h"
  18#include "qemu/error-report.h"
  19#include "qemu/iov.h"
  20#include "sysemu/block-backend.h"
  21#include <hw/scsi/scsi.h>
  22#include <block/scsi.h>
  23#include <hw/virtio/virtio-bus.h>
  24#include "hw/virtio/virtio-access.h"
  25#include "migration/migration.h"
  26
  27static inline int virtio_scsi_get_lun(uint8_t *lun)
  28{
  29    return ((lun[2] << 8) | lun[3]) & 0x3FFF;
  30}
  31
  32static inline SCSIDevice *virtio_scsi_device_find(VirtIOSCSI *s, uint8_t *lun)
  33{
  34    if (lun[0] != 1) {
  35        return NULL;
  36    }
  37    if (lun[2] != 0 && !(lun[2] >= 0x40 && lun[2] < 0x80)) {
  38        return NULL;
  39    }
  40    return scsi_device_find(&s->bus, 0, lun[1], virtio_scsi_get_lun(lun));
  41}
  42
  43VirtIOSCSIReq *virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq)
  44{
  45    VirtIOSCSIReq *req;
  46    VirtIOSCSICommon *vs = (VirtIOSCSICommon *)s;
  47    const size_t zero_skip = offsetof(VirtIOSCSIReq, elem)
  48                             + sizeof(VirtQueueElement);
  49
  50    req = g_malloc(sizeof(*req) + vs->cdb_size);
  51    req->vq = vq;
  52    req->dev = s;
  53    qemu_sglist_init(&req->qsgl, DEVICE(s), 8, &address_space_memory);
  54    qemu_iovec_init(&req->resp_iov, 1);
  55    memset((uint8_t *)req + zero_skip, 0, sizeof(*req) - zero_skip);
  56    return req;
  57}
  58
  59void virtio_scsi_free_req(VirtIOSCSIReq *req)
  60{
  61    qemu_iovec_destroy(&req->resp_iov);
  62    qemu_sglist_destroy(&req->qsgl);
  63    g_free(req);
  64}
  65
  66static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
  67{
  68    VirtIOSCSI *s = req->dev;
  69    VirtQueue *vq = req->vq;
  70    VirtIODevice *vdev = VIRTIO_DEVICE(s);
  71
  72    qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size);
  73    if (req->vring) {
  74        assert(req->vq == NULL);
  75        virtio_scsi_vring_push_notify(req);
  76    } else {
  77        virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
  78        virtio_notify(vdev, vq);
  79    }
  80
  81    if (req->sreq) {
  82        req->sreq->hba_private = NULL;
  83        scsi_req_unref(req->sreq);
  84    }
  85    virtio_scsi_free_req(req);
  86}
  87
  88static void virtio_scsi_bad_req(void)
  89{
  90    error_report("wrong size for virtio-scsi headers");
  91    exit(1);
  92}
  93
  94static size_t qemu_sgl_concat(VirtIOSCSIReq *req, struct iovec *iov,
  95                              hwaddr *addr, int num, size_t skip)
  96{
  97    QEMUSGList *qsgl = &req->qsgl;
  98    size_t copied = 0;
  99
 100    while (num) {
 101        if (skip >= iov->iov_len) {
 102            skip -= iov->iov_len;
 103        } else {
 104            qemu_sglist_add(qsgl, *addr + skip, iov->iov_len - skip);
 105            copied += iov->iov_len - skip;
 106            skip = 0;
 107        }
 108        iov++;
 109        addr++;
 110        num--;
 111    }
 112
 113    assert(skip == 0);
 114    return copied;
 115}
 116
 117static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
 118                                 unsigned req_size, unsigned resp_size)
 119{
 120    VirtIODevice *vdev = (VirtIODevice *) req->dev;
 121    size_t in_size, out_size;
 122
 123    if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 124                   &req->req, req_size) < req_size) {
 125        return -EINVAL;
 126    }
 127
 128    if (qemu_iovec_concat_iov(&req->resp_iov,
 129                              req->elem.in_sg, req->elem.in_num, 0,
 130                              resp_size) < resp_size) {
 131        return -EINVAL;
 132    }
 133
 134    req->resp_size = resp_size;
 135
 136    /* Old BIOSes left some padding by mistake after the req_size/resp_size.
 137     * As a workaround, always consider the first buffer as the virtio-scsi
 138     * request/response, making the payload start at the second element
 139     * of the iovec.
 140     *
 141     * The actual length of the response header, stored in req->resp_size,
 142     * does not change.
 143     *
 144     * TODO: always disable this workaround for virtio 1.0 devices.
 145     */
 146    if (!virtio_vdev_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
 147        if (req->elem.out_num) {
 148            req_size = req->elem.out_sg[0].iov_len;
 149        }
 150        if (req->elem.in_num) {
 151            resp_size = req->elem.in_sg[0].iov_len;
 152        }
 153    }
 154
 155    out_size = qemu_sgl_concat(req, req->elem.out_sg,
 156                               &req->elem.out_addr[0], req->elem.out_num,
 157                               req_size);
 158    in_size = qemu_sgl_concat(req, req->elem.in_sg,
 159                              &req->elem.in_addr[0], req->elem.in_num,
 160                              resp_size);
 161
 162    if (out_size && in_size) {
 163        return -ENOTSUP;
 164    }
 165
 166    if (out_size) {
 167        req->mode = SCSI_XFER_TO_DEV;
 168    } else if (in_size) {
 169        req->mode = SCSI_XFER_FROM_DEV;
 170    }
 171
 172    return 0;
 173}
 174
 175static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
 176{
 177    VirtIOSCSIReq *req = virtio_scsi_init_req(s, vq);
 178    if (!virtqueue_pop(vq, &req->elem)) {
 179        virtio_scsi_free_req(req);
 180        return NULL;
 181    }
 182    return req;
 183}
 184
 185static void virtio_scsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 186{
 187    VirtIOSCSIReq *req = sreq->hba_private;
 188    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(req->dev);
 189    uint32_t n = virtio_queue_get_id(req->vq) - 2;
 190
 191    assert(n < vs->conf.num_queues);
 192    qemu_put_be32s(f, &n);
 193    qemu_put_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 194}
 195
 196static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 197{
 198    SCSIBus *bus = sreq->bus;
 199    VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 200    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 201    VirtIOSCSIReq *req;
 202    uint32_t n;
 203
 204    qemu_get_be32s(f, &n);
 205    assert(n < vs->conf.num_queues);
 206    req = virtio_scsi_init_req(s, vs->cmd_vqs[n]);
 207    qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 208
 209    virtqueue_map(&req->elem);
 210
 211    if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 212                              sizeof(VirtIOSCSICmdResp) + vs->sense_size) < 0) {
 213        error_report("invalid SCSI request migration data");
 214        exit(1);
 215    }
 216
 217    scsi_req_ref(sreq);
 218    req->sreq = sreq;
 219    if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
 220        assert(req->sreq->cmd.mode == req->mode);
 221    }
 222    return req;
 223}
 224
 225typedef struct {
 226    Notifier        notifier;
 227    VirtIOSCSIReq  *tmf_req;
 228} VirtIOSCSICancelNotifier;
 229
 230static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
 231{
 232    VirtIOSCSICancelNotifier *n = container_of(notifier,
 233                                               VirtIOSCSICancelNotifier,
 234                                               notifier);
 235
 236    if (--n->tmf_req->remaining == 0) {
 237        virtio_scsi_complete_req(n->tmf_req);
 238    }
 239    g_free(n);
 240}
 241
 242/* Return 0 if the request is ready to be completed and return to guest;
 243 * -EINPROGRESS if the request is submitted and will be completed later, in the
 244 *  case of async cancellation. */
 245static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 246{
 247    SCSIDevice *d = virtio_scsi_device_find(s, req->req.tmf.lun);
 248    SCSIRequest *r, *next;
 249    BusChild *kid;
 250    int target;
 251    int ret = 0;
 252
 253    if (s->dataplane_started && d) {
 254        assert(blk_get_aio_context(d->conf.blk) == s->ctx);
 255    }
 256    /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
 257    req->resp.tmf.response = VIRTIO_SCSI_S_OK;
 258
 259    virtio_tswap32s(VIRTIO_DEVICE(s), &req->req.tmf.subtype);
 260    switch (req->req.tmf.subtype) {
 261    case VIRTIO_SCSI_T_TMF_ABORT_TASK:
 262    case VIRTIO_SCSI_T_TMF_QUERY_TASK:
 263        if (!d) {
 264            goto fail;
 265        }
 266        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 267            goto incorrect_lun;
 268        }
 269        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 270            VirtIOSCSIReq *cmd_req = r->hba_private;
 271            if (cmd_req && cmd_req->req.cmd.tag == req->req.tmf.tag) {
 272                break;
 273            }
 274        }
 275        if (r) {
 276            /*
 277             * Assert that the request has not been completed yet, we
 278             * check for it in the loop above.
 279             */
 280            assert(r->hba_private);
 281            if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK) {
 282                /* "If the specified command is present in the task set, then
 283                 * return a service response set to FUNCTION SUCCEEDED".
 284                 */
 285                req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 286            } else {
 287                VirtIOSCSICancelNotifier *notifier;
 288
 289                req->remaining = 1;
 290                notifier = g_new(VirtIOSCSICancelNotifier, 1);
 291                notifier->tmf_req = req;
 292                notifier->notifier.notify = virtio_scsi_cancel_notify;
 293                scsi_req_cancel_async(r, &notifier->notifier);
 294                ret = -EINPROGRESS;
 295            }
 296        }
 297        break;
 298
 299    case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
 300        if (!d) {
 301            goto fail;
 302        }
 303        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 304            goto incorrect_lun;
 305        }
 306        s->resetting++;
 307        qdev_reset_all(&d->qdev);
 308        s->resetting--;
 309        break;
 310
 311    case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
 312    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
 313    case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
 314        if (!d) {
 315            goto fail;
 316        }
 317        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 318            goto incorrect_lun;
 319        }
 320
 321        /* Add 1 to "remaining" until virtio_scsi_do_tmf returns.
 322         * This way, if the bus starts calling back to the notifiers
 323         * even before we finish the loop, virtio_scsi_cancel_notify
 324         * will not complete the TMF too early.
 325         */
 326        req->remaining = 1;
 327        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 328            if (r->hba_private) {
 329                if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK_SET) {
 330                    /* "If there is any command present in the task set, then
 331                     * return a service response set to FUNCTION SUCCEEDED".
 332                     */
 333                    req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 334                    break;
 335                } else {
 336                    VirtIOSCSICancelNotifier *notifier;
 337
 338                    req->remaining++;
 339                    notifier = g_new(VirtIOSCSICancelNotifier, 1);
 340                    notifier->notifier.notify = virtio_scsi_cancel_notify;
 341                    notifier->tmf_req = req;
 342                    scsi_req_cancel_async(r, &notifier->notifier);
 343                }
 344            }
 345        }
 346        if (--req->remaining > 0) {
 347            ret = -EINPROGRESS;
 348        }
 349        break;
 350
 351    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
 352        target = req->req.tmf.lun[1];
 353        s->resetting++;
 354        QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 355             d = DO_UPCAST(SCSIDevice, qdev, kid->child);
 356             if (d->channel == 0 && d->id == target) {
 357                qdev_reset_all(&d->qdev);
 358             }
 359        }
 360        s->resetting--;
 361        break;
 362
 363    case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
 364    default:
 365        req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
 366        break;
 367    }
 368
 369    return ret;
 370
 371incorrect_lun:
 372    req->resp.tmf.response = VIRTIO_SCSI_S_INCORRECT_LUN;
 373    return ret;
 374
 375fail:
 376    req->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
 377    return ret;
 378}
 379
 380void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
 381{
 382    VirtIODevice *vdev = (VirtIODevice *)s;
 383    uint32_t type;
 384    int r = 0;
 385
 386    if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 387                &type, sizeof(type)) < sizeof(type)) {
 388        virtio_scsi_bad_req();
 389        return;
 390    }
 391
 392    virtio_tswap32s(vdev, &type);
 393    if (type == VIRTIO_SCSI_T_TMF) {
 394        if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
 395                    sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
 396            virtio_scsi_bad_req();
 397        } else {
 398            r = virtio_scsi_do_tmf(s, req);
 399        }
 400
 401    } else if (type == VIRTIO_SCSI_T_AN_QUERY ||
 402               type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
 403        if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),
 404                    sizeof(VirtIOSCSICtrlANResp)) < 0) {
 405            virtio_scsi_bad_req();
 406        } else {
 407            req->resp.an.event_actual = 0;
 408            req->resp.an.response = VIRTIO_SCSI_S_OK;
 409        }
 410    }
 411    if (r == 0) {
 412        virtio_scsi_complete_req(req);
 413    } else {
 414        assert(r == -EINPROGRESS);
 415    }
 416}
 417
 418static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
 419{
 420    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 421    VirtIOSCSIReq *req;
 422
 423    if (s->ctx && !s->dataplane_disabled) {
 424        virtio_scsi_dataplane_start(s);
 425        return;
 426    }
 427    while ((req = virtio_scsi_pop_req(s, vq))) {
 428        virtio_scsi_handle_ctrl_req(s, req);
 429    }
 430}
 431
 432static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
 433{
 434    /* Sense data is not in req->resp and is copied separately
 435     * in virtio_scsi_command_complete.
 436     */
 437    req->resp_size = sizeof(VirtIOSCSICmdResp);
 438    virtio_scsi_complete_req(req);
 439}
 440
 441static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,
 442                                         size_t resid)
 443{
 444    VirtIOSCSIReq *req = r->hba_private;
 445    uint8_t sense[SCSI_SENSE_BUF_SIZE];
 446    uint32_t sense_len;
 447    VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
 448
 449    if (r->io_canceled) {
 450        return;
 451    }
 452
 453    req->resp.cmd.response = VIRTIO_SCSI_S_OK;
 454    req->resp.cmd.status = status;
 455    if (req->resp.cmd.status == GOOD) {
 456        req->resp.cmd.resid = virtio_tswap32(vdev, resid);
 457    } else {
 458        req->resp.cmd.resid = 0;
 459        sense_len = scsi_req_get_sense(r, sense, sizeof(sense));
 460        sense_len = MIN(sense_len, req->resp_iov.size - sizeof(req->resp.cmd));
 461        qemu_iovec_from_buf(&req->resp_iov, sizeof(req->resp.cmd),
 462                            sense, sense_len);
 463        req->resp.cmd.sense_len = virtio_tswap32(vdev, sense_len);
 464    }
 465    virtio_scsi_complete_cmd_req(req);
 466}
 467
 468static int virtio_scsi_parse_cdb(SCSIDevice *dev, SCSICommand *cmd,
 469                                 uint8_t *buf, void *hba_private)
 470{
 471    VirtIOSCSIReq *req = hba_private;
 472
 473    if (cmd->len == 0) {
 474        cmd->len = MIN(VIRTIO_SCSI_CDB_DEFAULT_SIZE, SCSI_CMD_BUF_SIZE);
 475        memcpy(cmd->buf, buf, cmd->len);
 476    }
 477
 478    /* Extract the direction and mode directly from the request, for
 479     * host device passthrough.
 480     */
 481    cmd->xfer = req->qsgl.size;
 482    cmd->mode = req->mode;
 483    return 0;
 484}
 485
 486static QEMUSGList *virtio_scsi_get_sg_list(SCSIRequest *r)
 487{
 488    VirtIOSCSIReq *req = r->hba_private;
 489
 490    return &req->qsgl;
 491}
 492
 493static void virtio_scsi_request_cancelled(SCSIRequest *r)
 494{
 495    VirtIOSCSIReq *req = r->hba_private;
 496
 497    if (!req) {
 498        return;
 499    }
 500    if (req->dev->resetting) {
 501        req->resp.cmd.response = VIRTIO_SCSI_S_RESET;
 502    } else {
 503        req->resp.cmd.response = VIRTIO_SCSI_S_ABORTED;
 504    }
 505    virtio_scsi_complete_cmd_req(req);
 506}
 507
 508static void virtio_scsi_fail_cmd_req(VirtIOSCSIReq *req)
 509{
 510    req->resp.cmd.response = VIRTIO_SCSI_S_FAILURE;
 511    virtio_scsi_complete_cmd_req(req);
 512}
 513
 514bool virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
 515{
 516    VirtIOSCSICommon *vs = &s->parent_obj;
 517    SCSIDevice *d;
 518    int rc;
 519
 520    rc = virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 521                               sizeof(VirtIOSCSICmdResp) + vs->sense_size);
 522    if (rc < 0) {
 523        if (rc == -ENOTSUP) {
 524            virtio_scsi_fail_cmd_req(req);
 525        } else {
 526            virtio_scsi_bad_req();
 527        }
 528        return false;
 529    }
 530
 531    d = virtio_scsi_device_find(s, req->req.cmd.lun);
 532    if (!d) {
 533        req->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
 534        virtio_scsi_complete_cmd_req(req);
 535        return false;
 536    }
 537    if (s->dataplane_started) {
 538        assert(blk_get_aio_context(d->conf.blk) == s->ctx);
 539    }
 540    req->sreq = scsi_req_new(d, req->req.cmd.tag,
 541                             virtio_scsi_get_lun(req->req.cmd.lun),
 542                             req->req.cmd.cdb, req);
 543
 544    if (req->sreq->cmd.mode != SCSI_XFER_NONE
 545        && (req->sreq->cmd.mode != req->mode ||
 546            req->sreq->cmd.xfer > req->qsgl.size)) {
 547        req->resp.cmd.response = VIRTIO_SCSI_S_OVERRUN;
 548        virtio_scsi_complete_cmd_req(req);
 549        return false;
 550    }
 551    scsi_req_ref(req->sreq);
 552    blk_io_plug(d->conf.blk);
 553    return true;
 554}
 555
 556void virtio_scsi_handle_cmd_req_submit(VirtIOSCSI *s, VirtIOSCSIReq *req)
 557{
 558    SCSIRequest *sreq = req->sreq;
 559    if (scsi_req_enqueue(sreq)) {
 560        scsi_req_continue(sreq);
 561    }
 562    blk_io_unplug(sreq->dev->conf.blk);
 563    scsi_req_unref(sreq);
 564}
 565
 566static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
 567{
 568    /* use non-QOM casts in the data path */
 569    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 570    VirtIOSCSIReq *req, *next;
 571    QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
 572
 573    if (s->ctx && !s->dataplane_disabled) {
 574        virtio_scsi_dataplane_start(s);
 575        return;
 576    }
 577    while ((req = virtio_scsi_pop_req(s, vq))) {
 578        if (virtio_scsi_handle_cmd_req_prepare(s, req)) {
 579            QTAILQ_INSERT_TAIL(&reqs, req, next);
 580        }
 581    }
 582
 583    QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
 584        virtio_scsi_handle_cmd_req_submit(s, req);
 585    }
 586}
 587
 588static void virtio_scsi_get_config(VirtIODevice *vdev,
 589                                   uint8_t *config)
 590{
 591    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 592    VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(vdev);
 593
 594    virtio_stl_p(vdev, &scsiconf->num_queues, s->conf.num_queues);
 595    virtio_stl_p(vdev, &scsiconf->seg_max, 128 - 2);
 596    virtio_stl_p(vdev, &scsiconf->max_sectors, s->conf.max_sectors);
 597    virtio_stl_p(vdev, &scsiconf->cmd_per_lun, s->conf.cmd_per_lun);
 598    virtio_stl_p(vdev, &scsiconf->event_info_size, sizeof(VirtIOSCSIEvent));
 599    virtio_stl_p(vdev, &scsiconf->sense_size, s->sense_size);
 600    virtio_stl_p(vdev, &scsiconf->cdb_size, s->cdb_size);
 601    virtio_stw_p(vdev, &scsiconf->max_channel, VIRTIO_SCSI_MAX_CHANNEL);
 602    virtio_stw_p(vdev, &scsiconf->max_target, VIRTIO_SCSI_MAX_TARGET);
 603    virtio_stl_p(vdev, &scsiconf->max_lun, VIRTIO_SCSI_MAX_LUN);
 604}
 605
 606static void virtio_scsi_set_config(VirtIODevice *vdev,
 607                                   const uint8_t *config)
 608{
 609    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 610    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 611
 612    if ((uint32_t) virtio_ldl_p(vdev, &scsiconf->sense_size) >= 65536 ||
 613        (uint32_t) virtio_ldl_p(vdev, &scsiconf->cdb_size) >= 256) {
 614        error_report("bad data written to virtio-scsi configuration space");
 615        exit(1);
 616    }
 617
 618    vs->sense_size = virtio_ldl_p(vdev, &scsiconf->sense_size);
 619    vs->cdb_size = virtio_ldl_p(vdev, &scsiconf->cdb_size);
 620}
 621
 622static uint64_t virtio_scsi_get_features(VirtIODevice *vdev,
 623                                         uint64_t requested_features,
 624                                         Error **errp)
 625{
 626    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 627
 628    /* Firstly sync all virtio-scsi possible supported features */
 629    requested_features |= s->host_features;
 630    return requested_features;
 631}
 632
 633static void virtio_scsi_reset(VirtIODevice *vdev)
 634{
 635    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 636    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 637
 638    if (s->ctx) {
 639        virtio_scsi_dataplane_stop(s);
 640    }
 641    s->resetting++;
 642    qbus_reset_all(&s->bus.qbus);
 643    s->resetting--;
 644
 645    vs->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 646    vs->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 647    s->events_dropped = false;
 648}
 649
 650/* The device does not have anything to save beyond the virtio data.
 651 * Request data is saved with callbacks from SCSI devices.
 652 */
 653static void virtio_scsi_save(QEMUFile *f, void *opaque)
 654{
 655    VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
 656    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 657
 658    if (s->dataplane_started) {
 659        virtio_scsi_dataplane_stop(s);
 660    }
 661    virtio_save(vdev, f);
 662}
 663
 664static int virtio_scsi_load(QEMUFile *f, void *opaque, int version_id)
 665{
 666    VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
 667    int ret;
 668
 669    ret = virtio_load(vdev, f, version_id);
 670    if (ret) {
 671        return ret;
 672    }
 673    return 0;
 674}
 675
 676void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
 677                            uint32_t event, uint32_t reason)
 678{
 679    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 680    VirtIOSCSIReq *req;
 681    VirtIOSCSIEvent *evt;
 682    VirtIODevice *vdev = VIRTIO_DEVICE(s);
 683
 684    if (!(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
 685        return;
 686    }
 687
 688    if (s->dataplane_started) {
 689        assert(s->ctx);
 690        aio_context_acquire(s->ctx);
 691    }
 692
 693    if (s->dataplane_started) {
 694        req = virtio_scsi_pop_req_vring(s, s->event_vring);
 695    } else {
 696        req = virtio_scsi_pop_req(s, vs->event_vq);
 697    }
 698    if (!req) {
 699        s->events_dropped = true;
 700        goto out;
 701    }
 702
 703    if (s->events_dropped) {
 704        event |= VIRTIO_SCSI_T_EVENTS_MISSED;
 705        s->events_dropped = false;
 706    }
 707
 708    if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
 709        virtio_scsi_bad_req();
 710    }
 711
 712    evt = &req->resp.event;
 713    memset(evt, 0, sizeof(VirtIOSCSIEvent));
 714    evt->event = virtio_tswap32(vdev, event);
 715    evt->reason = virtio_tswap32(vdev, reason);
 716    if (!dev) {
 717        assert(event == VIRTIO_SCSI_T_EVENTS_MISSED);
 718    } else {
 719        evt->lun[0] = 1;
 720        evt->lun[1] = dev->id;
 721
 722        /* Linux wants us to keep the same encoding we use for REPORT LUNS.  */
 723        if (dev->lun >= 256) {
 724            evt->lun[2] = (dev->lun >> 8) | 0x40;
 725        }
 726        evt->lun[3] = dev->lun & 0xFF;
 727    }
 728    virtio_scsi_complete_req(req);
 729out:
 730    if (s->dataplane_started) {
 731        aio_context_release(s->ctx);
 732    }
 733}
 734
 735static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
 736{
 737    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 738
 739    if (s->ctx && !s->dataplane_disabled) {
 740        virtio_scsi_dataplane_start(s);
 741        return;
 742    }
 743    if (s->events_dropped) {
 744        virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
 745    }
 746}
 747
 748static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)
 749{
 750    VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 751    VirtIODevice *vdev = VIRTIO_DEVICE(s);
 752
 753    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_CHANGE) &&
 754        dev->type != TYPE_ROM) {
 755        virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_PARAM_CHANGE,
 756                               sense.asc | (sense.ascq << 8));
 757    }
 758}
 759
 760static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 761                                Error **errp)
 762{
 763    VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 764    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 765    SCSIDevice *sd = SCSI_DEVICE(dev);
 766
 767    if (s->ctx && !s->dataplane_disabled) {
 768        if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
 769            return;
 770        }
 771        blk_op_block_all(sd->conf.blk, s->blocker);
 772        aio_context_acquire(s->ctx);
 773        blk_set_aio_context(sd->conf.blk, s->ctx);
 774        aio_context_release(s->ctx);
 775    }
 776
 777    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 778        virtio_scsi_push_event(s, sd,
 779                               VIRTIO_SCSI_T_TRANSPORT_RESET,
 780                               VIRTIO_SCSI_EVT_RESET_RESCAN);
 781    }
 782}
 783
 784static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 785                                  Error **errp)
 786{
 787    VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 788    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 789    SCSIDevice *sd = SCSI_DEVICE(dev);
 790
 791    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 792        virtio_scsi_push_event(s, sd,
 793                               VIRTIO_SCSI_T_TRANSPORT_RESET,
 794                               VIRTIO_SCSI_EVT_RESET_REMOVED);
 795    }
 796
 797    if (s->ctx) {
 798        blk_op_unblock_all(sd->conf.blk, s->blocker);
 799    }
 800    qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
 801}
 802
 803static struct SCSIBusInfo virtio_scsi_scsi_info = {
 804    .tcq = true,
 805    .max_channel = VIRTIO_SCSI_MAX_CHANNEL,
 806    .max_target = VIRTIO_SCSI_MAX_TARGET,
 807    .max_lun = VIRTIO_SCSI_MAX_LUN,
 808
 809    .complete = virtio_scsi_command_complete,
 810    .cancel = virtio_scsi_request_cancelled,
 811    .change = virtio_scsi_change,
 812    .parse_cdb = virtio_scsi_parse_cdb,
 813    .get_sg_list = virtio_scsi_get_sg_list,
 814    .save_request = virtio_scsi_save_request,
 815    .load_request = virtio_scsi_load_request,
 816};
 817
 818void virtio_scsi_common_realize(DeviceState *dev, Error **errp,
 819                                HandleOutput ctrl, HandleOutput evt,
 820                                HandleOutput cmd)
 821{
 822    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 823    VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(dev);
 824    int i;
 825
 826    virtio_init(vdev, "virtio-scsi", VIRTIO_ID_SCSI,
 827                sizeof(VirtIOSCSIConfig));
 828
 829    if (s->conf.num_queues == 0 ||
 830            s->conf.num_queues > VIRTIO_QUEUE_MAX - 2) {
 831        error_setg(errp, "Invalid number of queues (= %" PRIu32 "), "
 832                         "must be a positive integer less than %d.",
 833                   s->conf.num_queues, VIRTIO_QUEUE_MAX - 2);
 834        virtio_cleanup(vdev);
 835        return;
 836    }
 837    s->cmd_vqs = g_new0(VirtQueue *, s->conf.num_queues);
 838    s->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 839    s->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 840
 841    s->ctrl_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 842                                  ctrl);
 843    s->event_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 844                                   evt);
 845    for (i = 0; i < s->conf.num_queues; i++) {
 846        s->cmd_vqs[i] = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 847                                         cmd);
 848    }
 849
 850    if (s->conf.iothread) {
 851        virtio_scsi_set_iothread(VIRTIO_SCSI(s), s->conf.iothread);
 852    }
 853}
 854
 855/* Disable dataplane thread during live migration since it does not
 856 * update the dirty memory bitmap yet.
 857 */
 858static void virtio_scsi_migration_state_changed(Notifier *notifier, void *data)
 859{
 860    VirtIOSCSI *s = container_of(notifier, VirtIOSCSI,
 861                                 migration_state_notifier);
 862    MigrationState *mig = data;
 863
 864    if (migration_in_setup(mig)) {
 865        if (!s->dataplane_started) {
 866            return;
 867        }
 868        virtio_scsi_dataplane_stop(s);
 869        s->dataplane_disabled = true;
 870    } else if (migration_has_finished(mig) ||
 871               migration_has_failed(mig)) {
 872        if (s->dataplane_started) {
 873            return;
 874        }
 875        blk_drain_all(); /* complete in-flight non-dataplane requests */
 876        s->dataplane_disabled = false;
 877    }
 878}
 879
 880static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
 881{
 882    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 883    VirtIOSCSI *s = VIRTIO_SCSI(dev);
 884    static int virtio_scsi_id;
 885    Error *err = NULL;
 886
 887    virtio_scsi_common_realize(dev, &err, virtio_scsi_handle_ctrl,
 888                               virtio_scsi_handle_event,
 889                               virtio_scsi_handle_cmd);
 890    if (err != NULL) {
 891        error_propagate(errp, err);
 892        return;
 893    }
 894
 895    scsi_bus_new(&s->bus, sizeof(s->bus), dev,
 896                 &virtio_scsi_scsi_info, vdev->bus_name);
 897    /* override default SCSI bus hotplug-handler, with virtio-scsi's one */
 898    qbus_set_hotplug_handler(BUS(&s->bus), dev, &error_abort);
 899
 900    if (!dev->hotplugged) {
 901        scsi_bus_legacy_handle_cmdline(&s->bus, &err);
 902        if (err != NULL) {
 903            error_propagate(errp, err);
 904            return;
 905        }
 906    }
 907
 908    register_savevm(dev, "virtio-scsi", virtio_scsi_id++, 1,
 909                    virtio_scsi_save, virtio_scsi_load, s);
 910    s->migration_state_notifier.notify = virtio_scsi_migration_state_changed;
 911    add_migration_state_change_notifier(&s->migration_state_notifier);
 912
 913    error_setg(&s->blocker, "block device is in use by data plane");
 914}
 915
 916static void virtio_scsi_instance_init(Object *obj)
 917{
 918    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(obj);
 919
 920    object_property_add_link(obj, "iothread", TYPE_IOTHREAD,
 921                             (Object **)&vs->conf.iothread,
 922                             qdev_prop_allow_set_link_before_realize,
 923                             OBJ_PROP_LINK_UNREF_ON_RELEASE, &error_abort);
 924}
 925
 926void virtio_scsi_common_unrealize(DeviceState *dev, Error **errp)
 927{
 928    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 929    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(dev);
 930
 931    g_free(vs->cmd_vqs);
 932    virtio_cleanup(vdev);
 933}
 934
 935static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp)
 936{
 937    VirtIOSCSI *s = VIRTIO_SCSI(dev);
 938
 939    error_free(s->blocker);
 940
 941    unregister_savevm(dev, "virtio-scsi", s);
 942    remove_migration_state_change_notifier(&s->migration_state_notifier);
 943
 944    virtio_scsi_common_unrealize(dev, errp);
 945}
 946
 947static Property virtio_scsi_properties[] = {
 948    DEFINE_PROP_UINT32("num_queues", VirtIOSCSI, parent_obj.conf.num_queues, 1),
 949    DEFINE_PROP_UINT32("max_sectors", VirtIOSCSI, parent_obj.conf.max_sectors,
 950                                                  0xFFFF),
 951    DEFINE_PROP_UINT32("cmd_per_lun", VirtIOSCSI, parent_obj.conf.cmd_per_lun,
 952                                                  128),
 953    DEFINE_PROP_BIT("hotplug", VirtIOSCSI, host_features,
 954                                           VIRTIO_SCSI_F_HOTPLUG, true),
 955    DEFINE_PROP_BIT("param_change", VirtIOSCSI, host_features,
 956                                                VIRTIO_SCSI_F_CHANGE, true),
 957    DEFINE_PROP_END_OF_LIST(),
 958};
 959
 960static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
 961{
 962    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 963    DeviceClass *dc = DEVICE_CLASS(klass);
 964
 965    vdc->get_config = virtio_scsi_get_config;
 966    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 967}
 968
 969static void virtio_scsi_class_init(ObjectClass *klass, void *data)
 970{
 971    DeviceClass *dc = DEVICE_CLASS(klass);
 972    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 973    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
 974
 975    dc->props = virtio_scsi_properties;
 976    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 977    vdc->realize = virtio_scsi_device_realize;
 978    vdc->unrealize = virtio_scsi_device_unrealize;
 979    vdc->set_config = virtio_scsi_set_config;
 980    vdc->get_features = virtio_scsi_get_features;
 981    vdc->reset = virtio_scsi_reset;
 982    hc->plug = virtio_scsi_hotplug;
 983    hc->unplug = virtio_scsi_hotunplug;
 984}
 985
 986static const TypeInfo virtio_scsi_common_info = {
 987    .name = TYPE_VIRTIO_SCSI_COMMON,
 988    .parent = TYPE_VIRTIO_DEVICE,
 989    .instance_size = sizeof(VirtIOSCSICommon),
 990    .abstract = true,
 991    .class_init = virtio_scsi_common_class_init,
 992};
 993
 994static const TypeInfo virtio_scsi_info = {
 995    .name = TYPE_VIRTIO_SCSI,
 996    .parent = TYPE_VIRTIO_SCSI_COMMON,
 997    .instance_size = sizeof(VirtIOSCSI),
 998    .instance_init = virtio_scsi_instance_init,
 999    .class_init = virtio_scsi_class_init,
1000    .interfaces = (InterfaceInfo[]) {
1001        { TYPE_HOTPLUG_HANDLER },
1002        { }
1003    }
1004};
1005
1006static void virtio_register_types(void)
1007{
1008    type_register_static(&virtio_scsi_common_info);
1009    type_register_static(&virtio_scsi_info);
1010}
1011
1012type_init(virtio_register_types)
1013