hw/scsi/virtio-scsi.c

   1 /*
   2  * Virtio SCSI HBA
   3  *
   4  * Copyright IBM, Corp. 2010
   5  * Copyright Red Hat, Inc. 2011
   6  *
   7  * Authors:
   8  *   Stefan Hajnoczi    <stefanha@linux.vnet.ibm.com>
   9  *   Paolo Bonzini      <pbonzini@redhat.com>
  10  *
  11  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  12  * See the COPYING file in the top-level directory.
  13  *
  14  */
  15
  16 #include "standard-headers/linux/virtio_ids.h"
  17 #include "hw/virtio/virtio-scsi.h"
  18 #include "qemu/error-report.h"
  19 #include "qemu/iov.h"
  20 #include "sysemu/block-backend.h"
  21 #include <hw/scsi/scsi.h>
  22 #include <block/scsi.h>
  23 #include <hw/virtio/virtio-bus.h>
  24 #include "hw/virtio/virtio-access.h"
  25 #include "migration/migration.h"
  26
  27 static inline int virtio_scsi_get_lun(uint8_t *lun)
  28 {
  29     return ((lun[2] << 8) | lun[3]) & 0x3FFF;
  30 }
  31
  32 static inline SCSIDevice *virtio_scsi_device_find(VirtIOSCSI *s, uint8_t *lun)
  33 {
  34     if (lun[0] != 1) {
  35         return NULL;
  36     }
  37     if (lun[2] != 0 && !(lun[2] >= 0x40 && lun[2] < 0x80)) {
  38         return NULL;
  39     }
  40     return scsi_device_find(&s->bus, 0, lun[1], virtio_scsi_get_lun(lun));
  41 }
  42
  43 VirtIOSCSIReq *virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq)
  44 {
  45     VirtIOSCSIReq *req;
  46     VirtIOSCSICommon *vs = (VirtIOSCSICommon *)s;
  47     const size_t zero_skip = offsetof(VirtIOSCSIReq, elem)
  48                              + sizeof(VirtQueueElement);
  49
  50     req = g_malloc(sizeof(*req) + vs->cdb_size);
  51     req->vq = vq;
  52     req->dev = s;
  53     qemu_sglist_init(&req->qsgl, DEVICE(s), 8, &address_space_memory);
  54     qemu_iovec_init(&req->resp_iov, 1);
  55     memset((uint8_t *)req + zero_skip, 0, sizeof(*req) - zero_skip);
  56     return req;
  57 }
  58
  59 void virtio_scsi_free_req(VirtIOSCSIReq *req)
  60 {
  61     qemu_iovec_destroy(&req->resp_iov);
  62     qemu_sglist_destroy(&req->qsgl);
  63     g_free(req);
  64 }
  65
  66 static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
  67 {
  68     VirtIOSCSI *s = req->dev;
  69     VirtQueue *vq = req->vq;
  70     VirtIODevice *vdev = VIRTIO_DEVICE(s);
  71
  72     qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size);
  73     if (req->vring) {
  74         assert(req->vq == NULL);
  75         virtio_scsi_vring_push_notify(req);
  76     } else {
  77         virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
  78         virtio_notify(vdev, vq);
  79     }
  80
  81     if (req->sreq) {
  82         req->sreq->hba_private = NULL;
  83         scsi_req_unref(req->sreq);
  84     }
  85     virtio_scsi_free_req(req);
  86 }
  87
  88 static void virtio_scsi_bad_req(void)
  89 {
  90     error_report("wrong size for virtio-scsi headers");
  91     exit(1);
  92 }
  93
  94 static size_t qemu_sgl_concat(VirtIOSCSIReq *req, struct iovec *iov,
  95                               hwaddr *addr, int num, size_t skip)
  96 {
  97     QEMUSGList *qsgl = &req->qsgl;
  98     size_t copied = 0;
  99
 100     while (num) {
 101         if (skip >= iov->iov_len) {
 102             skip -= iov->iov_len;
 103         } else {
 104             qemu_sglist_add(qsgl, *addr + skip, iov->iov_len - skip);
 105             copied += iov->iov_len - skip;
 106             skip = 0;
 107         }
 108         iov++;
 109         addr++;
 110         num--;
 111     }
 112
 113     assert(skip == 0);
 114     return copied;
 115 }
 116
 117 static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
 118                                  unsigned req_size, unsigned resp_size)
 119 {
 120     VirtIODevice *vdev = (VirtIODevice *) req->dev;
 121     size_t in_size, out_size;
 122
 123     if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 124                    &req->req, req_size) < req_size) {
 125         return -EINVAL;
 126     }
 127
 128     if (qemu_iovec_concat_iov(&req->resp_iov,
 129                               req->elem.in_sg, req->elem.in_num, 0,
 130                               resp_size) < resp_size) {
 131         return -EINVAL;
 132     }
 133
 134     req->resp_size = resp_size;
 135
 136     /* Old BIOSes left some padding by mistake after the req_size/resp_size.
 137      * As a workaround, always consider the first buffer as the virtio-scsi
 138      * request/response, making the payload start at the second element
 139      * of the iovec.
 140      *
 141      * The actual length of the response header, stored in req->resp_size,
 142      * does not change.
 143      *
 144      * TODO: always disable this workaround for virtio 1.0 devices.
 145      */
 146     if (!virtio_vdev_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
 147         if (req->elem.out_num) {
 148             req_size = req->elem.out_sg[0].iov_len;
 149         }
 150         if (req->elem.in_num) {
 151             resp_size = req->elem.in_sg[0].iov_len;
 152         }
 153     }
 154
 155     out_size = qemu_sgl_concat(req, req->elem.out_sg,
 156                                &req->elem.out_addr[0], req->elem.out_num,
 157                                req_size);
 158     in_size = qemu_sgl_concat(req, req->elem.in_sg,
 159                               &req->elem.in_addr[0], req->elem.in_num,
 160                               resp_size);
 161
 162     if (out_size && in_size) {
 163         return -ENOTSUP;
 164     }
 165
 166     if (out_size) {
 167         req->mode = SCSI_XFER_TO_DEV;
 168     } else if (in_size) {
 169         req->mode = SCSI_XFER_FROM_DEV;
 170     }
 171
 172     return 0;
 173 }
 174
 175 static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
 176 {
 177     VirtIOSCSIReq *req = virtio_scsi_init_req(s, vq);
 178     if (!virtqueue_pop(vq, &req->elem)) {
 179         virtio_scsi_free_req(req);
 180         return NULL;
 181     }
 182     return req;
 183 }
 184
 185 static void virtio_scsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 186 {
 187     VirtIOSCSIReq *req = sreq->hba_private;
 188     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(req->dev);
 189     uint32_t n = virtio_queue_get_id(req->vq) - 2;
 190
 191     assert(n < vs->conf.num_queues);
 192     qemu_put_be32s(f, &n);
 193     qemu_put_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 194 }
 195
 196 static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 197 {
 198     SCSIBus *bus = sreq->bus;
 199     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 200     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 201     VirtIOSCSIReq *req;
 202     uint32_t n;
 203
 204     qemu_get_be32s(f, &n);
 205     assert(n < vs->conf.num_queues);
 206     req = virtio_scsi_init_req(s, vs->cmd_vqs[n]);
 207     qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 208
 209     virtqueue_map(&req->elem);
 210
 211     if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 212                               sizeof(VirtIOSCSICmdResp) + vs->sense_size) < 0) {
 213         error_report("invalid SCSI request migration data");
 214         exit(1);
 215     }
 216
 217     scsi_req_ref(sreq);
 218     req->sreq = sreq;
 219     if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
 220         assert(req->sreq->cmd.mode == req->mode);
 221     }
 222     return req;
 223 }
 224
 225 typedef struct {
 226     Notifier        notifier;
 227     VirtIOSCSIReq  *tmf_req;
 228 } VirtIOSCSICancelNotifier;
 229
 230 static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
 231 {
 232     VirtIOSCSICancelNotifier *n = container_of(notifier,
 233                                                VirtIOSCSICancelNotifier,
 234                                                notifier);
 235
 236     if (--n->tmf_req->remaining == 0) {
 237         virtio_scsi_complete_req(n->tmf_req);
 238     }
 239     g_free(n);
 240 }
 241
 242 /* Return 0 if the request is ready to be completed and return to guest;
 243  * -EINPROGRESS if the request is submitted and will be completed later, in the
 244  *  case of async cancellation. */
 245 static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 246 {
 247     SCSIDevice *d = virtio_scsi_device_find(s, req->req.tmf.lun);
 248     SCSIRequest *r, *next;
 249     BusChild *kid;
 250     int target;
 251     int ret = 0;
 252
 253     if (s->dataplane_started && d) {
 254         assert(blk_get_aio_context(d->conf.blk) == s->ctx);
 255     }
 256     /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
 257     req->resp.tmf.response = VIRTIO_SCSI_S_OK;
 258
 259     virtio_tswap32s(VIRTIO_DEVICE(s), &req->req.tmf.subtype);
 260     switch (req->req.tmf.subtype) {
 261     case VIRTIO_SCSI_T_TMF_ABORT_TASK:
 262     case VIRTIO_SCSI_T_TMF_QUERY_TASK:
 263         if (!d) {
 264             goto fail;
 265         }
 266         if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 267             goto incorrect_lun;
 268         }
 269         QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 270             VirtIOSCSIReq *cmd_req = r->hba_private;
 271             if (cmd_req && cmd_req->req.cmd.tag == req->req.tmf.tag) {
 272                 break;
 273             }
 274         }
 275         if (r) {
 276             /*
 277              * Assert that the request has not been completed yet, we
 278              * check for it in the loop above.
 279              */
 280             assert(r->hba_private);
 281             if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK) {
 282                 /* "If the specified command is present in the task set, then
 283                  * return a service response set to FUNCTION SUCCEEDED".
 284                  */
 285                 req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 286             } else {
 287                 VirtIOSCSICancelNotifier *notifier;
 288
 289                 req->remaining = 1;
 290                 notifier = g_new(VirtIOSCSICancelNotifier, 1);
 291                 notifier->tmf_req = req;
 292                 notifier->notifier.notify = virtio_scsi_cancel_notify;
 293                 scsi_req_cancel_async(r, &notifier->notifier);
 294                 ret = -EINPROGRESS;
 295             }
 296         }
 297         break;
 298
 299     case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
 300         if (!d) {
 301             goto fail;
 302         }
 303         if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 304             goto incorrect_lun;
 305         }
 306         s->resetting++;
 307         qdev_reset_all(&d->qdev);
 308         s->resetting--;
 309         break;
 310
 311     case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
 312     case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
 313     case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
 314         if (!d) {
 315             goto fail;
 316         }
 317         if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 318             goto incorrect_lun;
 319         }
 320
 321         /* Add 1 to "remaining" until virtio_scsi_do_tmf returns.
 322          * This way, if the bus starts calling back to the notifiers
 323          * even before we finish the loop, virtio_scsi_cancel_notify
 324          * will not complete the TMF too early.
 325          */
 326         req->remaining = 1;
 327         QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 328             if (r->hba_private) {
 329                 if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK_SET) {
 330                     /* "If there is any command present in the task set, then
 331                      * return a service response set to FUNCTION SUCCEEDED".
 332                      */
 333                     req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 334                     break;
 335                 } else {
 336                     VirtIOSCSICancelNotifier *notifier;
 337
 338                     req->remaining++;
 339                     notifier = g_new(VirtIOSCSICancelNotifier, 1);
 340                     notifier->notifier.notify = virtio_scsi_cancel_notify;
 341                     notifier->tmf_req = req;
 342                     scsi_req_cancel_async(r, &notifier->notifier);
 343                 }
 344             }
 345         }
 346         if (--req->remaining > 0) {
 347             ret = -EINPROGRESS;
 348         }
 349         break;
 350
 351     case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
 352         target = req->req.tmf.lun[1];
 353         s->resetting++;
 354         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 355              d = DO_UPCAST(SCSIDevice, qdev, kid->child);
 356              if (d->channel == 0 && d->id == target) {
 357                 qdev_reset_all(&d->qdev);
 358              }
 359         }
 360         s->resetting--;
 361         break;
 362
 363     case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
 364     default:
 365         req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
 366         break;
 367     }
 368
 369     return ret;
 370
 371 incorrect_lun:
 372     req->resp.tmf.response = VIRTIO_SCSI_S_INCORRECT_LUN;
 373     return ret;
 374
 375 fail:
 376     req->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
 377     return ret;
 378 }
 379
 380 void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
 381 {
 382     VirtIODevice *vdev = (VirtIODevice *)s;
 383     uint32_t type;
 384     int r = 0;
 385
 386     if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 387                 &type, sizeof(type)) < sizeof(type)) {
 388         virtio_scsi_bad_req();
 389         return;
 390     }
 391
 392     virtio_tswap32s(vdev, &type);
 393     if (type == VIRTIO_SCSI_T_TMF) {
 394         if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
 395                     sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
 396             virtio_scsi_bad_req();
 397         } else {
 398             r = virtio_scsi_do_tmf(s, req);
 399         }
 400
 401     } else if (type == VIRTIO_SCSI_T_AN_QUERY ||
 402                type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
 403         if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),
 404                     sizeof(VirtIOSCSICtrlANResp)) < 0) {
 405             virtio_scsi_bad_req();
 406         } else {
 407             req->resp.an.event_actual = 0;
 408             req->resp.an.response = VIRTIO_SCSI_S_OK;
 409         }
 410     }
 411     if (r == 0) {
 412         virtio_scsi_complete_req(req);
 413     } else {
 414         assert(r == -EINPROGRESS);
 415     }
 416 }
 417
 418 static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
 419 {
 420     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 421     VirtIOSCSIReq *req;
 422
 423     if (s->ctx && !s->dataplane_disabled) {
 424         virtio_scsi_dataplane_start(s);
 425         return;
 426     }
 427     while ((req = virtio_scsi_pop_req(s, vq))) {
 428         virtio_scsi_handle_ctrl_req(s, req);
 429     }
 430 }
 431
 432 static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
 433 {
 434     /* Sense data is not in req->resp and is copied separately
 435      * in virtio_scsi_command_complete.
 436      */
 437     req->resp_size = sizeof(VirtIOSCSICmdResp);
 438     virtio_scsi_complete_req(req);
 439 }
 440
 441 static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,
 442                                          size_t resid)
 443 {
 444     VirtIOSCSIReq *req = r->hba_private;
 445     uint8_t sense[SCSI_SENSE_BUF_SIZE];
 446     uint32_t sense_len;
 447     VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
 448
 449     if (r->io_canceled) {
 450         return;
 451     }
 452
 453     req->resp.cmd.response = VIRTIO_SCSI_S_OK;
 454     req->resp.cmd.status = status;
 455     if (req->resp.cmd.status == GOOD) {
 456         req->resp.cmd.resid = virtio_tswap32(vdev, resid);
 457     } else {
 458         req->resp.cmd.resid = 0;
 459         sense_len = scsi_req_get_sense(r, sense, sizeof(sense));
 460         sense_len = MIN(sense_len, req->resp_iov.size - sizeof(req->resp.cmd));
 461         qemu_iovec_from_buf(&req->resp_iov, sizeof(req->resp.cmd),
 462                             sense, sense_len);
 463         req->resp.cmd.sense_len = virtio_tswap32(vdev, sense_len);
 464     }
 465     virtio_scsi_complete_cmd_req(req);
 466 }
 467
 468 static int virtio_scsi_parse_cdb(SCSIDevice *dev, SCSICommand *cmd,
 469                                  uint8_t *buf, void *hba_private)
 470 {
 471     VirtIOSCSIReq *req = hba_private;
 472
 473     if (cmd->len == 0) {
 474         cmd->len = MIN(VIRTIO_SCSI_CDB_DEFAULT_SIZE, SCSI_CMD_BUF_SIZE);
 475         memcpy(cmd->buf, buf, cmd->len);
 476     }
 477
 478     /* Extract the direction and mode directly from the request, for
 479      * host device passthrough.
 480      */
 481     cmd->xfer = req->qsgl.size;
 482     cmd->mode = req->mode;
 483     return 0;
 484 }
 485
 486 static QEMUSGList *virtio_scsi_get_sg_list(SCSIRequest *r)
 487 {
 488     VirtIOSCSIReq *req = r->hba_private;
 489
 490     return &req->qsgl;
 491 }
 492
 493 static void virtio_scsi_request_cancelled(SCSIRequest *r)
 494 {
 495     VirtIOSCSIReq *req = r->hba_private;
 496
 497     if (!req) {
 498         return;
 499     }
 500     if (req->dev->resetting) {
 501         req->resp.cmd.response = VIRTIO_SCSI_S_RESET;
 502     } else {
 503         req->resp.cmd.response = VIRTIO_SCSI_S_ABORTED;
 504     }
 505     virtio_scsi_complete_cmd_req(req);
 506 }
 507
 508 static void virtio_scsi_fail_cmd_req(VirtIOSCSIReq *req)
 509 {
 510     req->resp.cmd.response = VIRTIO_SCSI_S_FAILURE;
 511     virtio_scsi_complete_cmd_req(req);
 512 }
 513
 514 bool virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
 515 {
 516     VirtIOSCSICommon *vs = &s->parent_obj;
 517     SCSIDevice *d;
 518     int rc;
 519
 520     rc = virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 521                                sizeof(VirtIOSCSICmdResp) + vs->sense_size);
 522     if (rc < 0) {
 523         if (rc == -ENOTSUP) {
 524             virtio_scsi_fail_cmd_req(req);
 525         } else {
 526             virtio_scsi_bad_req();
 527         }
 528         return false;
 529     }
 530
 531     d = virtio_scsi_device_find(s, req->req.cmd.lun);
 532     if (!d) {
 533         req->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
 534         virtio_scsi_complete_cmd_req(req);
 535         return false;
 536     }
 537     if (s->dataplane_started) {
 538         assert(blk_get_aio_context(d->conf.blk) == s->ctx);
 539     }
 540     req->sreq = scsi_req_new(d, req->req.cmd.tag,
 541                              virtio_scsi_get_lun(req->req.cmd.lun),
 542                              req->req.cmd.cdb, req);
 543
 544     if (req->sreq->cmd.mode != SCSI_XFER_NONE
 545         && (req->sreq->cmd.mode != req->mode ||
 546             req->sreq->cmd.xfer > req->qsgl.size)) {
 547         req->resp.cmd.response = VIRTIO_SCSI_S_OVERRUN;
 548         virtio_scsi_complete_cmd_req(req);
 549         return false;
 550     }
 551     scsi_req_ref(req->sreq);
 552     blk_io_plug(d->conf.blk);
 553     return true;
 554 }
 555
 556 void virtio_scsi_handle_cmd_req_submit(VirtIOSCSI *s, VirtIOSCSIReq *req)
 557 {
 558     SCSIRequest *sreq = req->sreq;
 559     if (scsi_req_enqueue(sreq)) {
 560         scsi_req_continue(sreq);
 561     }
 562     blk_io_unplug(sreq->dev->conf.blk);
 563     scsi_req_unref(sreq);
 564 }
 565
 566 static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
 567 {
 568     /* use non-QOM casts in the data path */
 569     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 570     VirtIOSCSIReq *req, *next;
 571     QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
 572
 573     if (s->ctx && !s->dataplane_disabled) {
 574         virtio_scsi_dataplane_start(s);
 575         return;
 576     }
 577     while ((req = virtio_scsi_pop_req(s, vq))) {
 578         if (virtio_scsi_handle_cmd_req_prepare(s, req)) {
 579             QTAILQ_INSERT_TAIL(&reqs, req, next);
 580         }
 581     }
 582
 583     QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
 584         virtio_scsi_handle_cmd_req_submit(s, req);
 585     }
 586 }
 587
 588 static void virtio_scsi_get_config(VirtIODevice *vdev,
 589                                    uint8_t *config)
 590 {
 591     VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 592     VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(vdev);
 593
 594     virtio_stl_p(vdev, &scsiconf->num_queues, s->conf.num_queues);
 595     virtio_stl_p(vdev, &scsiconf->seg_max, 128 - 2);
 596     virtio_stl_p(vdev, &scsiconf->max_sectors, s->conf.max_sectors);
 597     virtio_stl_p(vdev, &scsiconf->cmd_per_lun, s->conf.cmd_per_lun);
 598     virtio_stl_p(vdev, &scsiconf->event_info_size, sizeof(VirtIOSCSIEvent));
 599     virtio_stl_p(vdev, &scsiconf->sense_size, s->sense_size);
 600     virtio_stl_p(vdev, &scsiconf->cdb_size, s->cdb_size);
 601     virtio_stw_p(vdev, &scsiconf->max_channel, VIRTIO_SCSI_MAX_CHANNEL);
 602     virtio_stw_p(vdev, &scsiconf->max_target, VIRTIO_SCSI_MAX_TARGET);
 603     virtio_stl_p(vdev, &scsiconf->max_lun, VIRTIO_SCSI_MAX_LUN);
 604 }
 605
 606 static void virtio_scsi_set_config(VirtIODevice *vdev,
 607                                    const uint8_t *config)
 608 {
 609     VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 610     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 611
 612     if ((uint32_t) virtio_ldl_p(vdev, &scsiconf->sense_size) >= 65536 ||
 613         (uint32_t) virtio_ldl_p(vdev, &scsiconf->cdb_size) >= 256) {
 614         error_report("bad data written to virtio-scsi configuration space");
 615         exit(1);
 616     }
 617
 618     vs->sense_size = virtio_ldl_p(vdev, &scsiconf->sense_size);
 619     vs->cdb_size = virtio_ldl_p(vdev, &scsiconf->cdb_size);
 620 }
 621
 622 static uint64_t virtio_scsi_get_features(VirtIODevice *vdev,
 623                                          uint64_t requested_features,
 624                                          Error **errp)
 625 {
 626     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 627
 628     /* Firstly sync all virtio-scsi possible supported features */
 629     requested_features |= s->host_features;
 630     return requested_features;
 631 }
 632
 633 static void virtio_scsi_reset(VirtIODevice *vdev)
 634 {
 635     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 636     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 637
 638     if (s->ctx) {
 639         virtio_scsi_dataplane_stop(s);
 640     }
 641     s->resetting++;
 642     qbus_reset_all(&s->bus.qbus);
 643     s->resetting--;
 644
 645     vs->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 646     vs->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 647     s->events_dropped = false;
 648 }
 649
 650 /* The device does not have anything to save beyond the virtio data.
 651  * Request data is saved with callbacks from SCSI devices.
 652  */
 653 static void virtio_scsi_save(QEMUFile *f, void *opaque)
 654 {
 655     VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
 656     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 657
 658     if (s->dataplane_started) {
 659         virtio_scsi_dataplane_stop(s);
 660     }
 661     virtio_save(vdev, f);
 662 }
 663
 664 static int virtio_scsi_load(QEMUFile *f, void *opaque, int version_id)
 665 {
 666     VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
 667     int ret;
 668
 669     ret = virtio_load(vdev, f, version_id);
 670     if (ret) {
 671         return ret;
 672     }
 673     return 0;
 674 }
 675
 676 void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
 677                             uint32_t event, uint32_t reason)
 678 {
 679     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 680     VirtIOSCSIReq *req;
 681     VirtIOSCSIEvent *evt;
 682     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 683
 684     if (!(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
 685         return;
 686     }
 687
 688     if (s->dataplane_started) {
 689         assert(s->ctx);
 690         aio_context_acquire(s->ctx);
 691     }
 692
 693     if (s->dataplane_started) {
 694         req = virtio_scsi_pop_req_vring(s, s->event_vring);
 695     } else {
 696         req = virtio_scsi_pop_req(s, vs->event_vq);
 697     }
 698     if (!req) {
 699         s->events_dropped = true;
 700         goto out;
 701     }
 702
 703     if (s->events_dropped) {
 704         event |= VIRTIO_SCSI_T_EVENTS_MISSED;
 705         s->events_dropped = false;
 706     }
 707
 708     if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
 709         virtio_scsi_bad_req();
 710     }
 711
 712     evt = &req->resp.event;
 713     memset(evt, 0, sizeof(VirtIOSCSIEvent));
 714     evt->event = virtio_tswap32(vdev, event);
 715     evt->reason = virtio_tswap32(vdev, reason);
 716     if (!dev) {
 717         assert(event == VIRTIO_SCSI_T_EVENTS_MISSED);
 718     } else {
 719         evt->lun[0] = 1;
 720         evt->lun[1] = dev->id;
 721
 722         /* Linux wants us to keep the same encoding we use for REPORT LUNS.  */
 723         if (dev->lun >= 256) {
 724             evt->lun[2] = (dev->lun >> 8) | 0x40;
 725         }
 726         evt->lun[3] = dev->lun & 0xFF;
 727     }
 728     virtio_scsi_complete_req(req);
 729 out:
 730     if (s->dataplane_started) {
 731         aio_context_release(s->ctx);
 732     }
 733 }
 734
 735 static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
 736 {
 737     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 738
 739     if (s->ctx && !s->dataplane_disabled) {
 740         virtio_scsi_dataplane_start(s);
 741         return;
 742     }
 743     if (s->events_dropped) {
 744         virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
 745     }
 746 }
 747
 748 static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)
 749 {
 750     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 751     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 752
 753     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_CHANGE) &&
 754         dev->type != TYPE_ROM) {
 755         virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_PARAM_CHANGE,
 756                                sense.asc | (sense.ascq << 8));
 757     }
 758 }
 759
 760 static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 761                                 Error **errp)
 762 {
 763     VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 764     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 765     SCSIDevice *sd = SCSI_DEVICE(dev);
 766
 767     if (s->ctx && !s->dataplane_disabled) {
 768         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
 769             return;
 770         }
 771         blk_op_block_all(sd->conf.blk, s->blocker);
 772         aio_context_acquire(s->ctx);
 773         blk_set_aio_context(sd->conf.blk, s->ctx);
 774         aio_context_release(s->ctx);
 775     }
 776
 777     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 778         virtio_scsi_push_event(s, sd,
 779                                VIRTIO_SCSI_T_TRANSPORT_RESET,
 780                                VIRTIO_SCSI_EVT_RESET_RESCAN);
 781     }
 782 }
 783
 784 static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 785                                   Error **errp)
 786 {
 787     VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 788     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 789     SCSIDevice *sd = SCSI_DEVICE(dev);
 790
 791     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 792         virtio_scsi_push_event(s, sd,
 793                                VIRTIO_SCSI_T_TRANSPORT_RESET,
 794                                VIRTIO_SCSI_EVT_RESET_REMOVED);
 795     }
 796
 797     if (s->ctx) {
 798         blk_op_unblock_all(sd->conf.blk, s->blocker);
 799     }
 800     qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
 801 }
 802
 803 static struct SCSIBusInfo virtio_scsi_scsi_info = {
 804     .tcq = true,
 805     .max_channel = VIRTIO_SCSI_MAX_CHANNEL,
 806     .max_target = VIRTIO_SCSI_MAX_TARGET,
 807     .max_lun = VIRTIO_SCSI_MAX_LUN,
 808
 809     .complete = virtio_scsi_command_complete,
 810     .cancel = virtio_scsi_request_cancelled,
 811     .change = virtio_scsi_change,
 812     .parse_cdb = virtio_scsi_parse_cdb,
 813     .get_sg_list = virtio_scsi_get_sg_list,
 814     .save_request = virtio_scsi_save_request,
 815     .load_request = virtio_scsi_load_request,
 816 };
 817
 818 void virtio_scsi_common_realize(DeviceState *dev, Error **errp,
 819                                 HandleOutput ctrl, HandleOutput evt,
 820                                 HandleOutput cmd)
 821 {
 822     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 823     VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(dev);
 824     int i;
 825
 826     virtio_init(vdev, "virtio-scsi", VIRTIO_ID_SCSI,
 827                 sizeof(VirtIOSCSIConfig));
 828
 829     if (s->conf.num_queues == 0 ||
 830             s->conf.num_queues > VIRTIO_QUEUE_MAX - 2) {
 831         error_setg(errp, "Invalid number of queues (= %" PRIu32 "), "
 832                          "must be a positive integer less than %d.",
 833                    s->conf.num_queues, VIRTIO_QUEUE_MAX - 2);
 834         virtio_cleanup(vdev);
 835         return;
 836     }
 837     s->cmd_vqs = g_new0(VirtQueue *, s->conf.num_queues);
 838     s->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 839     s->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 840
 841     s->ctrl_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 842                                   ctrl);
 843     s->event_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 844                                    evt);
 845     for (i = 0; i < s->conf.num_queues; i++) {
 846         s->cmd_vqs[i] = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 847                                          cmd);
 848     }
 849
 850     if (s->conf.iothread) {
 851         virtio_scsi_set_iothread(VIRTIO_SCSI(s), s->conf.iothread);
 852     }
 853 }
 854
 855 /* Disable dataplane thread during live migration since it does not
 856  * update the dirty memory bitmap yet.
 857  */
 858 static void virtio_scsi_migration_state_changed(Notifier *notifier, void *data)
 859 {
 860     VirtIOSCSI *s = container_of(notifier, VirtIOSCSI,
 861                                  migration_state_notifier);
 862     MigrationState *mig = data;
 863
 864     if (migration_in_setup(mig)) {
 865         if (!s->dataplane_started) {
 866             return;
 867         }
 868         virtio_scsi_dataplane_stop(s);
 869         s->dataplane_disabled = true;
 870     } else if (migration_has_finished(mig) ||
 871                migration_has_failed(mig)) {
 872         if (s->dataplane_started) {
 873             return;
 874         }
 875         blk_drain_all(); /* complete in-flight non-dataplane requests */
 876         s->dataplane_disabled = false;
 877     }
 878 }
 879
 880 static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
 881 {
 882     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 883     VirtIOSCSI *s = VIRTIO_SCSI(dev);
 884     static int virtio_scsi_id;
 885     Error *err = NULL;
 886
 887     virtio_scsi_common_realize(dev, &err, virtio_scsi_handle_ctrl,
 888                                virtio_scsi_handle_event,
 889                                virtio_scsi_handle_cmd);
 890     if (err != NULL) {
 891         error_propagate(errp, err);
 892         return;
 893     }
 894
 895     scsi_bus_new(&s->bus, sizeof(s->bus), dev,
 896                  &virtio_scsi_scsi_info, vdev->bus_name);
 897     /* override default SCSI bus hotplug-handler, with virtio-scsi's one */
 898     qbus_set_hotplug_handler(BUS(&s->bus), dev, &error_abort);
 899
 900     if (!dev->hotplugged) {
 901         scsi_bus_legacy_handle_cmdline(&s->bus, &err);
 902         if (err != NULL) {
 903             error_propagate(errp, err);
 904             return;
 905         }
 906     }
 907
 908     register_savevm(dev, "virtio-scsi", virtio_scsi_id++, 1,
 909                     virtio_scsi_save, virtio_scsi_load, s);
 910     s->migration_state_notifier.notify = virtio_scsi_migration_state_changed;
 911     add_migration_state_change_notifier(&s->migration_state_notifier);
 912
 913     error_setg(&s->blocker, "block device is in use by data plane");
 914 }
 915
 916 static void virtio_scsi_instance_init(Object *obj)
 917 {
 918     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(obj);
 919
 920     object_property_add_link(obj, "iothread", TYPE_IOTHREAD,
 921                              (Object **)&vs->conf.iothread,
 922                              qdev_prop_allow_set_link_before_realize,
 923                              OBJ_PROP_LINK_UNREF_ON_RELEASE, &error_abort);
 924 }
 925
 926 void virtio_scsi_common_unrealize(DeviceState *dev, Error **errp)
 927 {
 928     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 929     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(dev);
 930
 931     g_free(vs->cmd_vqs);
 932     virtio_cleanup(vdev);
 933 }
 934
 935 static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp)
 936 {
 937     VirtIOSCSI *s = VIRTIO_SCSI(dev);
 938
 939     error_free(s->blocker);
 940
 941     unregister_savevm(dev, "virtio-scsi", s);
 942     remove_migration_state_change_notifier(&s->migration_state_notifier);
 943
 944     virtio_scsi_common_unrealize(dev, errp);
 945 }
 946
 947 static Property virtio_scsi_properties[] = {
 948     DEFINE_PROP_UINT32("num_queues", VirtIOSCSI, parent_obj.conf.num_queues, 1),
 949     DEFINE_PROP_UINT32("max_sectors", VirtIOSCSI, parent_obj.conf.max_sectors,
 950                                                   0xFFFF),
 951     DEFINE_PROP_UINT32("cmd_per_lun", VirtIOSCSI, parent_obj.conf.cmd_per_lun,
 952                                                   128),
 953     DEFINE_PROP_BIT("hotplug", VirtIOSCSI, host_features,
 954                                            VIRTIO_SCSI_F_HOTPLUG, true),
 955     DEFINE_PROP_BIT("param_change", VirtIOSCSI, host_features,
 956                                                 VIRTIO_SCSI_F_CHANGE, true),
 957     DEFINE_PROP_END_OF_LIST(),
 958 };
 959
 960 static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
 961 {
 962     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 963     DeviceClass *dc = DEVICE_CLASS(klass);
 964
 965     vdc->get_config = virtio_scsi_get_config;
 966     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 967 }
 968
 969 static void virtio_scsi_class_init(ObjectClass *klass, void *data)
 970 {
 971     DeviceClass *dc = DEVICE_CLASS(klass);
 972     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 973     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
 974
 975     dc->props = virtio_scsi_properties;
 976     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 977     vdc->realize = virtio_scsi_device_realize;
 978     vdc->unrealize = virtio_scsi_device_unrealize;
 979     vdc->set_config = virtio_scsi_set_config;
 980     vdc->get_features = virtio_scsi_get_features;
 981     vdc->reset = virtio_scsi_reset;
 982     hc->plug = virtio_scsi_hotplug;
 983     hc->unplug = virtio_scsi_hotunplug;
 984 }
 985
 986 static const TypeInfo virtio_scsi_common_info = {
 987     .name = TYPE_VIRTIO_SCSI_COMMON,
 988     .parent = TYPE_VIRTIO_DEVICE,
 989     .instance_size = sizeof(VirtIOSCSICommon),
 990     .abstract = true,
 991     .class_init = virtio_scsi_common_class_init,
 992 };
 993
 994 static const TypeInfo virtio_scsi_info = {
 995     .name = TYPE_VIRTIO_SCSI,
 996     .parent = TYPE_VIRTIO_SCSI_COMMON,
 997     .instance_size = sizeof(VirtIOSCSI),
 998     .instance_init = virtio_scsi_instance_init,
 999     .class_init = virtio_scsi_class_init,
1000     .interfaces = (InterfaceInfo[]) {
1001         { TYPE_HOTPLUG_HANDLER },
1002         { }
1003     }
1004 };
1005
1006 static void virtio_register_types(void)
1007 {
1008     type_register_static(&virtio_scsi_common_info);
1009     type_register_static(&virtio_scsi_info);
1010 }
1011
1012 type_init(virtio_register_types)