qemu/hw/scsi/virtio-scsi.c
<<
>>
Prefs
   1/*
   2 * Virtio SCSI HBA
   3 *
   4 * Copyright IBM, Corp. 2010
   5 * Copyright Red Hat, Inc. 2011
   6 *
   7 * Authors:
   8 *   Stefan Hajnoczi    <stefanha@linux.vnet.ibm.com>
   9 *   Paolo Bonzini      <pbonzini@redhat.com>
  10 *
  11 * This work is licensed under the terms of the GNU GPL, version 2 or later.
  12 * See the COPYING file in the top-level directory.
  13 *
  14 */
  15
  16#include "qemu/osdep.h"
  17#include "qapi/error.h"
  18#include "standard-headers/linux/virtio_ids.h"
  19#include "hw/virtio/virtio-scsi.h"
  20#include "qemu/error-report.h"
  21#include "qemu/iov.h"
  22#include "qemu/module.h"
  23#include "sysemu/block-backend.h"
  24#include "hw/scsi/scsi.h"
  25#include "scsi/constants.h"
  26#include "hw/virtio/virtio-bus.h"
  27#include "hw/virtio/virtio-access.h"
  28
  29static inline int virtio_scsi_get_lun(uint8_t *lun)
  30{
  31    return ((lun[2] << 8) | lun[3]) & 0x3FFF;
  32}
  33
  34static inline SCSIDevice *virtio_scsi_device_find(VirtIOSCSI *s, uint8_t *lun)
  35{
  36    if (lun[0] != 1) {
  37        return NULL;
  38    }
  39    if (lun[2] != 0 && !(lun[2] >= 0x40 && lun[2] < 0x80)) {
  40        return NULL;
  41    }
  42    return scsi_device_find(&s->bus, 0, lun[1], virtio_scsi_get_lun(lun));
  43}
  44
  45void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req)
  46{
  47    VirtIODevice *vdev = VIRTIO_DEVICE(s);
  48    const size_t zero_skip =
  49        offsetof(VirtIOSCSIReq, resp_iov) + sizeof(req->resp_iov);
  50
  51    req->vq = vq;
  52    req->dev = s;
  53    qemu_sglist_init(&req->qsgl, DEVICE(s), 8, vdev->dma_as);
  54    qemu_iovec_init(&req->resp_iov, 1);
  55    memset((uint8_t *)req + zero_skip, 0, sizeof(*req) - zero_skip);
  56}
  57
  58void virtio_scsi_free_req(VirtIOSCSIReq *req)
  59{
  60    qemu_iovec_destroy(&req->resp_iov);
  61    qemu_sglist_destroy(&req->qsgl);
  62    g_free(req);
  63}
  64
  65static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
  66{
  67    VirtIOSCSI *s = req->dev;
  68    VirtQueue *vq = req->vq;
  69    VirtIODevice *vdev = VIRTIO_DEVICE(s);
  70
  71    qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size);
  72    virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
  73    if (s->dataplane_started && !s->dataplane_fenced) {
  74        virtio_notify_irqfd(vdev, vq);
  75    } else {
  76        virtio_notify(vdev, vq);
  77    }
  78
  79    if (req->sreq) {
  80        req->sreq->hba_private = NULL;
  81        scsi_req_unref(req->sreq);
  82    }
  83    virtio_scsi_free_req(req);
  84}
  85
  86static void virtio_scsi_bad_req(VirtIOSCSIReq *req)
  87{
  88    virtio_error(VIRTIO_DEVICE(req->dev), "wrong size for virtio-scsi headers");
  89    virtqueue_detach_element(req->vq, &req->elem, 0);
  90    virtio_scsi_free_req(req);
  91}
  92
  93static size_t qemu_sgl_concat(VirtIOSCSIReq *req, struct iovec *iov,
  94                              hwaddr *addr, int num, size_t skip)
  95{
  96    QEMUSGList *qsgl = &req->qsgl;
  97    size_t copied = 0;
  98
  99    while (num) {
 100        if (skip >= iov->iov_len) {
 101            skip -= iov->iov_len;
 102        } else {
 103            qemu_sglist_add(qsgl, *addr + skip, iov->iov_len - skip);
 104            copied += iov->iov_len - skip;
 105            skip = 0;
 106        }
 107        iov++;
 108        addr++;
 109        num--;
 110    }
 111
 112    assert(skip == 0);
 113    return copied;
 114}
 115
 116static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
 117                                 unsigned req_size, unsigned resp_size)
 118{
 119    VirtIODevice *vdev = (VirtIODevice *) req->dev;
 120    size_t in_size, out_size;
 121
 122    if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 123                   &req->req, req_size) < req_size) {
 124        return -EINVAL;
 125    }
 126
 127    if (qemu_iovec_concat_iov(&req->resp_iov,
 128                              req->elem.in_sg, req->elem.in_num, 0,
 129                              resp_size) < resp_size) {
 130        return -EINVAL;
 131    }
 132
 133    req->resp_size = resp_size;
 134
 135    /* Old BIOSes left some padding by mistake after the req_size/resp_size.
 136     * As a workaround, always consider the first buffer as the virtio-scsi
 137     * request/response, making the payload start at the second element
 138     * of the iovec.
 139     *
 140     * The actual length of the response header, stored in req->resp_size,
 141     * does not change.
 142     *
 143     * TODO: always disable this workaround for virtio 1.0 devices.
 144     */
 145    if (!virtio_vdev_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
 146        if (req->elem.out_num) {
 147            req_size = req->elem.out_sg[0].iov_len;
 148        }
 149        if (req->elem.in_num) {
 150            resp_size = req->elem.in_sg[0].iov_len;
 151        }
 152    }
 153
 154    out_size = qemu_sgl_concat(req, req->elem.out_sg,
 155                               &req->elem.out_addr[0], req->elem.out_num,
 156                               req_size);
 157    in_size = qemu_sgl_concat(req, req->elem.in_sg,
 158                              &req->elem.in_addr[0], req->elem.in_num,
 159                              resp_size);
 160
 161    if (out_size && in_size) {
 162        return -ENOTSUP;
 163    }
 164
 165    if (out_size) {
 166        req->mode = SCSI_XFER_TO_DEV;
 167    } else if (in_size) {
 168        req->mode = SCSI_XFER_FROM_DEV;
 169    }
 170
 171    return 0;
 172}
 173
 174static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
 175{
 176    VirtIOSCSICommon *vs = (VirtIOSCSICommon *)s;
 177    VirtIOSCSIReq *req;
 178
 179    req = virtqueue_pop(vq, sizeof(VirtIOSCSIReq) + vs->cdb_size);
 180    if (!req) {
 181        return NULL;
 182    }
 183    virtio_scsi_init_req(s, vq, req);
 184    return req;
 185}
 186
 187static void virtio_scsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 188{
 189    VirtIOSCSIReq *req = sreq->hba_private;
 190    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(req->dev);
 191    uint32_t n = virtio_get_queue_index(req->vq) - 2;
 192
 193    assert(n < vs->conf.num_queues);
 194    qemu_put_be32s(f, &n);
 195    qemu_put_virtqueue_element(f, &req->elem);
 196}
 197
 198static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 199{
 200    SCSIBus *bus = sreq->bus;
 201    VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 202    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 203    VirtIODevice *vdev = VIRTIO_DEVICE(s);
 204    VirtIOSCSIReq *req;
 205    uint32_t n;
 206
 207    qemu_get_be32s(f, &n);
 208    assert(n < vs->conf.num_queues);
 209    req = qemu_get_virtqueue_element(vdev, f,
 210                                     sizeof(VirtIOSCSIReq) + vs->cdb_size);
 211    virtio_scsi_init_req(s, vs->cmd_vqs[n], req);
 212
 213    if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 214                              sizeof(VirtIOSCSICmdResp) + vs->sense_size) < 0) {
 215        error_report("invalid SCSI request migration data");
 216        exit(1);
 217    }
 218
 219    scsi_req_ref(sreq);
 220    req->sreq = sreq;
 221    if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
 222        assert(req->sreq->cmd.mode == req->mode);
 223    }
 224    return req;
 225}
 226
 227typedef struct {
 228    Notifier        notifier;
 229    VirtIOSCSIReq  *tmf_req;
 230} VirtIOSCSICancelNotifier;
 231
 232static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
 233{
 234    VirtIOSCSICancelNotifier *n = container_of(notifier,
 235                                               VirtIOSCSICancelNotifier,
 236                                               notifier);
 237
 238    if (--n->tmf_req->remaining == 0) {
 239        virtio_scsi_complete_req(n->tmf_req);
 240    }
 241    g_free(n);
 242}
 243
 244static inline void virtio_scsi_ctx_check(VirtIOSCSI *s, SCSIDevice *d)
 245{
 246    if (s->dataplane_started && d && blk_is_available(d->conf.blk)) {
 247        assert(blk_get_aio_context(d->conf.blk) == s->ctx);
 248    }
 249}
 250
 251/* Return 0 if the request is ready to be completed and return to guest;
 252 * -EINPROGRESS if the request is submitted and will be completed later, in the
 253 *  case of async cancellation. */
 254static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 255{
 256    SCSIDevice *d = virtio_scsi_device_find(s, req->req.tmf.lun);
 257    SCSIRequest *r, *next;
 258    BusChild *kid;
 259    int target;
 260    int ret = 0;
 261
 262    virtio_scsi_ctx_check(s, d);
 263    /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
 264    req->resp.tmf.response = VIRTIO_SCSI_S_OK;
 265
 266    /*
 267     * req->req.tmf has the QEMU_PACKED attribute. Don't use virtio_tswap32s()
 268     * to avoid compiler errors.
 269     */
 270    req->req.tmf.subtype =
 271        virtio_tswap32(VIRTIO_DEVICE(s), req->req.tmf.subtype);
 272
 273    switch (req->req.tmf.subtype) {
 274    case VIRTIO_SCSI_T_TMF_ABORT_TASK:
 275    case VIRTIO_SCSI_T_TMF_QUERY_TASK:
 276        if (!d) {
 277            goto fail;
 278        }
 279        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 280            goto incorrect_lun;
 281        }
 282        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 283            VirtIOSCSIReq *cmd_req = r->hba_private;
 284            if (cmd_req && cmd_req->req.cmd.tag == req->req.tmf.tag) {
 285                break;
 286            }
 287        }
 288        if (r) {
 289            /*
 290             * Assert that the request has not been completed yet, we
 291             * check for it in the loop above.
 292             */
 293            assert(r->hba_private);
 294            if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK) {
 295                /* "If the specified command is present in the task set, then
 296                 * return a service response set to FUNCTION SUCCEEDED".
 297                 */
 298                req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 299            } else {
 300                VirtIOSCSICancelNotifier *notifier;
 301
 302                req->remaining = 1;
 303                notifier = g_new(VirtIOSCSICancelNotifier, 1);
 304                notifier->tmf_req = req;
 305                notifier->notifier.notify = virtio_scsi_cancel_notify;
 306                scsi_req_cancel_async(r, &notifier->notifier);
 307                ret = -EINPROGRESS;
 308            }
 309        }
 310        break;
 311
 312    case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
 313        if (!d) {
 314            goto fail;
 315        }
 316        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 317            goto incorrect_lun;
 318        }
 319        s->resetting++;
 320        qdev_reset_all(&d->qdev);
 321        s->resetting--;
 322        break;
 323
 324    case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
 325    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
 326    case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
 327        if (!d) {
 328            goto fail;
 329        }
 330        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 331            goto incorrect_lun;
 332        }
 333
 334        /* Add 1 to "remaining" until virtio_scsi_do_tmf returns.
 335         * This way, if the bus starts calling back to the notifiers
 336         * even before we finish the loop, virtio_scsi_cancel_notify
 337         * will not complete the TMF too early.
 338         */
 339        req->remaining = 1;
 340        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 341            if (r->hba_private) {
 342                if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK_SET) {
 343                    /* "If there is any command present in the task set, then
 344                     * return a service response set to FUNCTION SUCCEEDED".
 345                     */
 346                    req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 347                    break;
 348                } else {
 349                    VirtIOSCSICancelNotifier *notifier;
 350
 351                    req->remaining++;
 352                    notifier = g_new(VirtIOSCSICancelNotifier, 1);
 353                    notifier->notifier.notify = virtio_scsi_cancel_notify;
 354                    notifier->tmf_req = req;
 355                    scsi_req_cancel_async(r, &notifier->notifier);
 356                }
 357            }
 358        }
 359        if (--req->remaining > 0) {
 360            ret = -EINPROGRESS;
 361        }
 362        break;
 363
 364    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
 365        target = req->req.tmf.lun[1];
 366        s->resetting++;
 367        QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 368             d = SCSI_DEVICE(kid->child);
 369             if (d->channel == 0 && d->id == target) {
 370                qdev_reset_all(&d->qdev);
 371             }
 372        }
 373        s->resetting--;
 374        break;
 375
 376    case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
 377    default:
 378        req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
 379        break;
 380    }
 381
 382    return ret;
 383
 384incorrect_lun:
 385    req->resp.tmf.response = VIRTIO_SCSI_S_INCORRECT_LUN;
 386    return ret;
 387
 388fail:
 389    req->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
 390    return ret;
 391}
 392
 393static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
 394{
 395    VirtIODevice *vdev = (VirtIODevice *)s;
 396    uint32_t type;
 397    int r = 0;
 398
 399    if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 400                &type, sizeof(type)) < sizeof(type)) {
 401        virtio_scsi_bad_req(req);
 402        return;
 403    }
 404
 405    virtio_tswap32s(vdev, &type);
 406    if (type == VIRTIO_SCSI_T_TMF) {
 407        if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
 408                    sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
 409            virtio_scsi_bad_req(req);
 410            return;
 411        } else {
 412            r = virtio_scsi_do_tmf(s, req);
 413        }
 414
 415    } else if (type == VIRTIO_SCSI_T_AN_QUERY ||
 416               type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
 417        if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),
 418                    sizeof(VirtIOSCSICtrlANResp)) < 0) {
 419            virtio_scsi_bad_req(req);
 420            return;
 421        } else {
 422            req->resp.an.event_actual = 0;
 423            req->resp.an.response = VIRTIO_SCSI_S_OK;
 424        }
 425    }
 426    if (r == 0) {
 427        virtio_scsi_complete_req(req);
 428    } else {
 429        assert(r == -EINPROGRESS);
 430    }
 431}
 432
 433bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
 434{
 435    VirtIOSCSIReq *req;
 436    bool progress = false;
 437
 438    while ((req = virtio_scsi_pop_req(s, vq))) {
 439        progress = true;
 440        virtio_scsi_handle_ctrl_req(s, req);
 441    }
 442    return progress;
 443}
 444
 445static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
 446{
 447    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 448
 449    if (s->ctx) {
 450        virtio_device_start_ioeventfd(vdev);
 451        if (!s->dataplane_fenced) {
 452            return;
 453        }
 454    }
 455    virtio_scsi_acquire(s);
 456    virtio_scsi_handle_ctrl_vq(s, vq);
 457    virtio_scsi_release(s);
 458}
 459
 460static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
 461{
 462    /* Sense data is not in req->resp and is copied separately
 463     * in virtio_scsi_command_complete.
 464     */
 465    req->resp_size = sizeof(VirtIOSCSICmdResp);
 466    virtio_scsi_complete_req(req);
 467}
 468
 469static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,
 470                                         size_t resid)
 471{
 472    VirtIOSCSIReq *req = r->hba_private;
 473    uint8_t sense[SCSI_SENSE_BUF_SIZE];
 474    uint32_t sense_len;
 475    VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
 476
 477    if (r->io_canceled) {
 478        return;
 479    }
 480
 481    req->resp.cmd.response = VIRTIO_SCSI_S_OK;
 482    req->resp.cmd.status = status;
 483    if (req->resp.cmd.status == GOOD) {
 484        req->resp.cmd.resid = virtio_tswap32(vdev, resid);
 485    } else {
 486        req->resp.cmd.resid = 0;
 487        sense_len = scsi_req_get_sense(r, sense, sizeof(sense));
 488        sense_len = MIN(sense_len, req->resp_iov.size - sizeof(req->resp.cmd));
 489        qemu_iovec_from_buf(&req->resp_iov, sizeof(req->resp.cmd),
 490                            sense, sense_len);
 491        req->resp.cmd.sense_len = virtio_tswap32(vdev, sense_len);
 492    }
 493    virtio_scsi_complete_cmd_req(req);
 494}
 495
 496static int virtio_scsi_parse_cdb(SCSIDevice *dev, SCSICommand *cmd,
 497                                 uint8_t *buf, void *hba_private)
 498{
 499    VirtIOSCSIReq *req = hba_private;
 500
 501    if (cmd->len == 0) {
 502        cmd->len = MIN(VIRTIO_SCSI_CDB_DEFAULT_SIZE, SCSI_CMD_BUF_SIZE);
 503        memcpy(cmd->buf, buf, cmd->len);
 504    }
 505
 506    /* Extract the direction and mode directly from the request, for
 507     * host device passthrough.
 508     */
 509    cmd->xfer = req->qsgl.size;
 510    cmd->mode = req->mode;
 511    return 0;
 512}
 513
 514static QEMUSGList *virtio_scsi_get_sg_list(SCSIRequest *r)
 515{
 516    VirtIOSCSIReq *req = r->hba_private;
 517
 518    return &req->qsgl;
 519}
 520
 521static void virtio_scsi_request_cancelled(SCSIRequest *r)
 522{
 523    VirtIOSCSIReq *req = r->hba_private;
 524
 525    if (!req) {
 526        return;
 527    }
 528    if (req->dev->resetting) {
 529        req->resp.cmd.response = VIRTIO_SCSI_S_RESET;
 530    } else {
 531        req->resp.cmd.response = VIRTIO_SCSI_S_ABORTED;
 532    }
 533    virtio_scsi_complete_cmd_req(req);
 534}
 535
 536static void virtio_scsi_fail_cmd_req(VirtIOSCSIReq *req)
 537{
 538    req->resp.cmd.response = VIRTIO_SCSI_S_FAILURE;
 539    virtio_scsi_complete_cmd_req(req);
 540}
 541
 542static int virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
 543{
 544    VirtIOSCSICommon *vs = &s->parent_obj;
 545    SCSIDevice *d;
 546    int rc;
 547
 548    rc = virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 549                               sizeof(VirtIOSCSICmdResp) + vs->sense_size);
 550    if (rc < 0) {
 551        if (rc == -ENOTSUP) {
 552            virtio_scsi_fail_cmd_req(req);
 553            return -ENOTSUP;
 554        } else {
 555            virtio_scsi_bad_req(req);
 556            return -EINVAL;
 557        }
 558    }
 559
 560    d = virtio_scsi_device_find(s, req->req.cmd.lun);
 561    if (!d) {
 562        req->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
 563        virtio_scsi_complete_cmd_req(req);
 564        return -ENOENT;
 565    }
 566    virtio_scsi_ctx_check(s, d);
 567    req->sreq = scsi_req_new(d, req->req.cmd.tag,
 568                             virtio_scsi_get_lun(req->req.cmd.lun),
 569                             req->req.cmd.cdb, req);
 570
 571    if (req->sreq->cmd.mode != SCSI_XFER_NONE
 572        && (req->sreq->cmd.mode != req->mode ||
 573            req->sreq->cmd.xfer > req->qsgl.size)) {
 574        req->resp.cmd.response = VIRTIO_SCSI_S_OVERRUN;
 575        virtio_scsi_complete_cmd_req(req);
 576        return -ENOBUFS;
 577    }
 578    scsi_req_ref(req->sreq);
 579    blk_io_plug(d->conf.blk);
 580    return 0;
 581}
 582
 583static void virtio_scsi_handle_cmd_req_submit(VirtIOSCSI *s, VirtIOSCSIReq *req)
 584{
 585    SCSIRequest *sreq = req->sreq;
 586    if (scsi_req_enqueue(sreq)) {
 587        scsi_req_continue(sreq);
 588    }
 589    blk_io_unplug(sreq->dev->conf.blk);
 590    scsi_req_unref(sreq);
 591}
 592
 593bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
 594{
 595    VirtIOSCSIReq *req, *next;
 596    int ret = 0;
 597    bool progress = false;
 598
 599    QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
 600
 601    do {
 602        virtio_queue_set_notification(vq, 0);
 603
 604        while ((req = virtio_scsi_pop_req(s, vq))) {
 605            progress = true;
 606            ret = virtio_scsi_handle_cmd_req_prepare(s, req);
 607            if (!ret) {
 608                QTAILQ_INSERT_TAIL(&reqs, req, next);
 609            } else if (ret == -EINVAL) {
 610                /* The device is broken and shouldn't process any request */
 611                while (!QTAILQ_EMPTY(&reqs)) {
 612                    req = QTAILQ_FIRST(&reqs);
 613                    QTAILQ_REMOVE(&reqs, req, next);
 614                    blk_io_unplug(req->sreq->dev->conf.blk);
 615                    scsi_req_unref(req->sreq);
 616                    virtqueue_detach_element(req->vq, &req->elem, 0);
 617                    virtio_scsi_free_req(req);
 618                }
 619            }
 620        }
 621
 622        virtio_queue_set_notification(vq, 1);
 623    } while (ret != -EINVAL && !virtio_queue_empty(vq));
 624
 625    QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
 626        virtio_scsi_handle_cmd_req_submit(s, req);
 627    }
 628    return progress;
 629}
 630
 631static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
 632{
 633    /* use non-QOM casts in the data path */
 634    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 635
 636    if (s->ctx) {
 637        virtio_device_start_ioeventfd(vdev);
 638        if (!s->dataplane_fenced) {
 639            return;
 640        }
 641    }
 642    virtio_scsi_acquire(s);
 643    virtio_scsi_handle_cmd_vq(s, vq);
 644    virtio_scsi_release(s);
 645}
 646
 647static void virtio_scsi_get_config(VirtIODevice *vdev,
 648                                   uint8_t *config)
 649{
 650    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 651    VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(vdev);
 652
 653    virtio_stl_p(vdev, &scsiconf->num_queues, s->conf.num_queues);
 654    virtio_stl_p(vdev, &scsiconf->seg_max, 128 - 2);
 655    virtio_stl_p(vdev, &scsiconf->max_sectors, s->conf.max_sectors);
 656    virtio_stl_p(vdev, &scsiconf->cmd_per_lun, s->conf.cmd_per_lun);
 657    virtio_stl_p(vdev, &scsiconf->event_info_size, sizeof(VirtIOSCSIEvent));
 658    virtio_stl_p(vdev, &scsiconf->sense_size, s->sense_size);
 659    virtio_stl_p(vdev, &scsiconf->cdb_size, s->cdb_size);
 660    virtio_stw_p(vdev, &scsiconf->max_channel, VIRTIO_SCSI_MAX_CHANNEL);
 661    virtio_stw_p(vdev, &scsiconf->max_target, VIRTIO_SCSI_MAX_TARGET);
 662    virtio_stl_p(vdev, &scsiconf->max_lun, VIRTIO_SCSI_MAX_LUN);
 663}
 664
 665static void virtio_scsi_set_config(VirtIODevice *vdev,
 666                                   const uint8_t *config)
 667{
 668    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 669    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 670
 671    if ((uint32_t) virtio_ldl_p(vdev, &scsiconf->sense_size) >= 65536 ||
 672        (uint32_t) virtio_ldl_p(vdev, &scsiconf->cdb_size) >= 256) {
 673        virtio_error(vdev,
 674                     "bad data written to virtio-scsi configuration space");
 675        return;
 676    }
 677
 678    vs->sense_size = virtio_ldl_p(vdev, &scsiconf->sense_size);
 679    vs->cdb_size = virtio_ldl_p(vdev, &scsiconf->cdb_size);
 680}
 681
 682static uint64_t virtio_scsi_get_features(VirtIODevice *vdev,
 683                                         uint64_t requested_features,
 684                                         Error **errp)
 685{
 686    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 687
 688    /* Firstly sync all virtio-scsi possible supported features */
 689    requested_features |= s->host_features;
 690    return requested_features;
 691}
 692
 693static void virtio_scsi_reset(VirtIODevice *vdev)
 694{
 695    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 696    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 697
 698    assert(!s->dataplane_started);
 699    s->resetting++;
 700    qbus_reset_all(BUS(&s->bus));
 701    s->resetting--;
 702
 703    vs->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 704    vs->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 705    s->events_dropped = false;
 706}
 707
 708void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
 709                            uint32_t event, uint32_t reason)
 710{
 711    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 712    VirtIOSCSIReq *req;
 713    VirtIOSCSIEvent *evt;
 714    VirtIODevice *vdev = VIRTIO_DEVICE(s);
 715
 716    if (!(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
 717        return;
 718    }
 719
 720    req = virtio_scsi_pop_req(s, vs->event_vq);
 721    if (!req) {
 722        s->events_dropped = true;
 723        return;
 724    }
 725
 726    if (s->events_dropped) {
 727        event |= VIRTIO_SCSI_T_EVENTS_MISSED;
 728        s->events_dropped = false;
 729    }
 730
 731    if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
 732        virtio_scsi_bad_req(req);
 733        return;
 734    }
 735
 736    evt = &req->resp.event;
 737    memset(evt, 0, sizeof(VirtIOSCSIEvent));
 738    evt->event = virtio_tswap32(vdev, event);
 739    evt->reason = virtio_tswap32(vdev, reason);
 740    if (!dev) {
 741        assert(event == VIRTIO_SCSI_T_EVENTS_MISSED);
 742    } else {
 743        evt->lun[0] = 1;
 744        evt->lun[1] = dev->id;
 745
 746        /* Linux wants us to keep the same encoding we use for REPORT LUNS.  */
 747        if (dev->lun >= 256) {
 748            evt->lun[2] = (dev->lun >> 8) | 0x40;
 749        }
 750        evt->lun[3] = dev->lun & 0xFF;
 751    }
 752    virtio_scsi_complete_req(req);
 753}
 754
 755bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
 756{
 757    if (s->events_dropped) {
 758        virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
 759        return true;
 760    }
 761    return false;
 762}
 763
 764static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
 765{
 766    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 767
 768    if (s->ctx) {
 769        virtio_device_start_ioeventfd(vdev);
 770        if (!s->dataplane_fenced) {
 771            return;
 772        }
 773    }
 774    virtio_scsi_acquire(s);
 775    virtio_scsi_handle_event_vq(s, vq);
 776    virtio_scsi_release(s);
 777}
 778
 779static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)
 780{
 781    VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 782    VirtIODevice *vdev = VIRTIO_DEVICE(s);
 783
 784    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_CHANGE) &&
 785        dev->type != TYPE_ROM) {
 786        virtio_scsi_acquire(s);
 787        virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_PARAM_CHANGE,
 788                               sense.asc | (sense.ascq << 8));
 789        virtio_scsi_release(s);
 790    }
 791}
 792
 793static void virtio_scsi_pre_hotplug(HotplugHandler *hotplug_dev,
 794                                    DeviceState *dev, Error **errp)
 795{
 796    SCSIDevice *sd = SCSI_DEVICE(dev);
 797    sd->hba_supports_iothread = true;
 798}
 799
 800static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 801                                Error **errp)
 802{
 803    VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 804    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 805    SCSIDevice *sd = SCSI_DEVICE(dev);
 806    int ret;
 807
 808    if (s->ctx && !s->dataplane_fenced) {
 809        if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
 810            return;
 811        }
 812        virtio_scsi_acquire(s);
 813        ret = blk_set_aio_context(sd->conf.blk, s->ctx, errp);
 814        virtio_scsi_release(s);
 815        if (ret < 0) {
 816            return;
 817        }
 818    }
 819
 820    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 821        virtio_scsi_acquire(s);
 822        virtio_scsi_push_event(s, sd,
 823                               VIRTIO_SCSI_T_TRANSPORT_RESET,
 824                               VIRTIO_SCSI_EVT_RESET_RESCAN);
 825        virtio_scsi_release(s);
 826    }
 827}
 828
 829static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 830                                  Error **errp)
 831{
 832    VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 833    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 834    SCSIDevice *sd = SCSI_DEVICE(dev);
 835    AioContext *ctx = s->ctx ?: qemu_get_aio_context();
 836
 837    if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 838        virtio_scsi_acquire(s);
 839        virtio_scsi_push_event(s, sd,
 840                               VIRTIO_SCSI_T_TRANSPORT_RESET,
 841                               VIRTIO_SCSI_EVT_RESET_REMOVED);
 842        virtio_scsi_release(s);
 843    }
 844
 845    aio_disable_external(ctx);
 846    qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
 847    aio_enable_external(ctx);
 848
 849    if (s->ctx) {
 850        virtio_scsi_acquire(s);
 851        /* If other users keep the BlockBackend in the iothread, that's ok */
 852        blk_set_aio_context(sd->conf.blk, qemu_get_aio_context(), NULL);
 853        virtio_scsi_release(s);
 854    }
 855}
 856
 857static struct SCSIBusInfo virtio_scsi_scsi_info = {
 858    .tcq = true,
 859    .max_channel = VIRTIO_SCSI_MAX_CHANNEL,
 860    .max_target = VIRTIO_SCSI_MAX_TARGET,
 861    .max_lun = VIRTIO_SCSI_MAX_LUN,
 862
 863    .complete = virtio_scsi_command_complete,
 864    .cancel = virtio_scsi_request_cancelled,
 865    .change = virtio_scsi_change,
 866    .parse_cdb = virtio_scsi_parse_cdb,
 867    .get_sg_list = virtio_scsi_get_sg_list,
 868    .save_request = virtio_scsi_save_request,
 869    .load_request = virtio_scsi_load_request,
 870};
 871
 872void virtio_scsi_common_realize(DeviceState *dev,
 873                                VirtIOHandleOutput ctrl,
 874                                VirtIOHandleOutput evt,
 875                                VirtIOHandleOutput cmd,
 876                                Error **errp)
 877{
 878    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 879    VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(dev);
 880    int i;
 881
 882    virtio_init(vdev, "virtio-scsi", VIRTIO_ID_SCSI,
 883                sizeof(VirtIOSCSIConfig));
 884
 885    if (s->conf.num_queues == 0 ||
 886            s->conf.num_queues > VIRTIO_QUEUE_MAX - 2) {
 887        error_setg(errp, "Invalid number of queues (= %" PRIu32 "), "
 888                         "must be a positive integer less than %d.",
 889                   s->conf.num_queues, VIRTIO_QUEUE_MAX - 2);
 890        virtio_cleanup(vdev);
 891        return;
 892    }
 893    s->cmd_vqs = g_new0(VirtQueue *, s->conf.num_queues);
 894    s->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 895    s->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 896
 897    s->ctrl_vq = virtio_add_queue(vdev, s->conf.virtqueue_size, ctrl);
 898    s->event_vq = virtio_add_queue(vdev, s->conf.virtqueue_size, evt);
 899    for (i = 0; i < s->conf.num_queues; i++) {
 900        s->cmd_vqs[i] = virtio_add_queue(vdev, s->conf.virtqueue_size, cmd);
 901    }
 902}
 903
 904static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
 905{
 906    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 907    VirtIOSCSI *s = VIRTIO_SCSI(dev);
 908    Error *err = NULL;
 909
 910    virtio_scsi_common_realize(dev,
 911                               virtio_scsi_handle_ctrl,
 912                               virtio_scsi_handle_event,
 913                               virtio_scsi_handle_cmd,
 914                               &err);
 915    if (err != NULL) {
 916        error_propagate(errp, err);
 917        return;
 918    }
 919
 920    scsi_bus_new(&s->bus, sizeof(s->bus), dev,
 921                 &virtio_scsi_scsi_info, vdev->bus_name);
 922    /* override default SCSI bus hotplug-handler, with virtio-scsi's one */
 923    qbus_set_hotplug_handler(BUS(&s->bus), OBJECT(dev), &error_abort);
 924
 925    virtio_scsi_dataplane_setup(s, errp);
 926}
 927
 928void virtio_scsi_common_unrealize(DeviceState *dev)
 929{
 930    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 931    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(dev);
 932
 933    g_free(vs->cmd_vqs);
 934    virtio_cleanup(vdev);
 935}
 936
 937static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp)
 938{
 939    VirtIOSCSI *s = VIRTIO_SCSI(dev);
 940
 941    qbus_set_hotplug_handler(BUS(&s->bus), NULL, &error_abort);
 942    virtio_scsi_common_unrealize(dev);
 943}
 944
 945static Property virtio_scsi_properties[] = {
 946    DEFINE_PROP_UINT32("num_queues", VirtIOSCSI, parent_obj.conf.num_queues, 1),
 947    DEFINE_PROP_UINT32("virtqueue_size", VirtIOSCSI,
 948                                         parent_obj.conf.virtqueue_size, 128),
 949    DEFINE_PROP_UINT32("max_sectors", VirtIOSCSI, parent_obj.conf.max_sectors,
 950                                                  0xFFFF),
 951    DEFINE_PROP_UINT32("cmd_per_lun", VirtIOSCSI, parent_obj.conf.cmd_per_lun,
 952                                                  128),
 953    DEFINE_PROP_BIT("hotplug", VirtIOSCSI, host_features,
 954                                           VIRTIO_SCSI_F_HOTPLUG, true),
 955    DEFINE_PROP_BIT("param_change", VirtIOSCSI, host_features,
 956                                                VIRTIO_SCSI_F_CHANGE, true),
 957    DEFINE_PROP_LINK("iothread", VirtIOSCSI, parent_obj.conf.iothread,
 958                     TYPE_IOTHREAD, IOThread *),
 959    DEFINE_PROP_END_OF_LIST(),
 960};
 961
 962static const VMStateDescription vmstate_virtio_scsi = {
 963    .name = "virtio-scsi",
 964    .minimum_version_id = 1,
 965    .version_id = 1,
 966    .fields = (VMStateField[]) {
 967        VMSTATE_VIRTIO_DEVICE,
 968        VMSTATE_END_OF_LIST()
 969    },
 970};
 971
 972static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
 973{
 974    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 975    DeviceClass *dc = DEVICE_CLASS(klass);
 976
 977    vdc->get_config = virtio_scsi_get_config;
 978    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 979}
 980
 981static void virtio_scsi_class_init(ObjectClass *klass, void *data)
 982{
 983    DeviceClass *dc = DEVICE_CLASS(klass);
 984    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 985    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
 986
 987    dc->props = virtio_scsi_properties;
 988    dc->vmsd = &vmstate_virtio_scsi;
 989    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 990    vdc->realize = virtio_scsi_device_realize;
 991    vdc->unrealize = virtio_scsi_device_unrealize;
 992    vdc->set_config = virtio_scsi_set_config;
 993    vdc->get_features = virtio_scsi_get_features;
 994    vdc->reset = virtio_scsi_reset;
 995    vdc->start_ioeventfd = virtio_scsi_dataplane_start;
 996    vdc->stop_ioeventfd = virtio_scsi_dataplane_stop;
 997    hc->pre_plug = virtio_scsi_pre_hotplug;
 998    hc->plug = virtio_scsi_hotplug;
 999    hc->unplug = virtio_scsi_hotunplug;
1000}
1001
1002static const TypeInfo virtio_scsi_common_info = {
1003    .name = TYPE_VIRTIO_SCSI_COMMON,
1004    .parent = TYPE_VIRTIO_DEVICE,
1005    .instance_size = sizeof(VirtIOSCSICommon),
1006    .abstract = true,
1007    .class_init = virtio_scsi_common_class_init,
1008};
1009
1010static const TypeInfo virtio_scsi_info = {
1011    .name = TYPE_VIRTIO_SCSI,
1012    .parent = TYPE_VIRTIO_SCSI_COMMON,
1013    .instance_size = sizeof(VirtIOSCSI),
1014    .class_init = virtio_scsi_class_init,
1015    .interfaces = (InterfaceInfo[]) {
1016        { TYPE_HOTPLUG_HANDLER },
1017        { }
1018    }
1019};
1020
1021static void virtio_register_types(void)
1022{
1023    type_register_static(&virtio_scsi_common_info);
1024    type_register_static(&virtio_scsi_info);
1025}
1026
1027type_init(virtio_register_types)
1028