hw/virtio-scsi.c

   1 /*
   2  * Virtio SCSI HBA
   3  *
   4  * Copyright IBM, Corp. 2010
   5  * Copyright Red Hat, Inc. 2011
   6  *
   7  * Authors:
   8  *   Stefan Hajnoczi    <stefanha@linux.vnet.ibm.com>
   9  *   Paolo Bonzini      <pbonzini@redhat.com>
  10  *
  11  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  12  * See the COPYING file in the top-level directory.
  13  *
  14  */
  15
  16 #include "virtio-scsi.h"
  17 #include <hw/scsi.h>
  18 #include <hw/scsi-defs.h>
  19
  20 #define VIRTIO_SCSI_VQ_SIZE     128
  21 #define VIRTIO_SCSI_CDB_SIZE    32
  22 #define VIRTIO_SCSI_SENSE_SIZE  96
  23 #define VIRTIO_SCSI_MAX_CHANNEL 0
  24 #define VIRTIO_SCSI_MAX_TARGET  255
  25 #define VIRTIO_SCSI_MAX_LUN     16383
  26
  27 /* Feature Bits */
  28 #define VIRTIO_SCSI_F_INOUT                    0
  29 #define VIRTIO_SCSI_F_HOTPLUG                  1
  30
  31 /* Response codes */
  32 #define VIRTIO_SCSI_S_OK                       0
  33 #define VIRTIO_SCSI_S_OVERRUN                  1
  34 #define VIRTIO_SCSI_S_ABORTED                  2
  35 #define VIRTIO_SCSI_S_BAD_TARGET               3
  36 #define VIRTIO_SCSI_S_RESET                    4
  37 #define VIRTIO_SCSI_S_BUSY                     5
  38 #define VIRTIO_SCSI_S_TRANSPORT_FAILURE        6
  39 #define VIRTIO_SCSI_S_TARGET_FAILURE           7
  40 #define VIRTIO_SCSI_S_NEXUS_FAILURE            8
  41 #define VIRTIO_SCSI_S_FAILURE                  9
  42 #define VIRTIO_SCSI_S_FUNCTION_SUCCEEDED       10
  43 #define VIRTIO_SCSI_S_FUNCTION_REJECTED        11
  44 #define VIRTIO_SCSI_S_INCORRECT_LUN            12
  45
  46 /* Controlq type codes.  */
  47 #define VIRTIO_SCSI_T_TMF                      0
  48 #define VIRTIO_SCSI_T_AN_QUERY                 1
  49 #define VIRTIO_SCSI_T_AN_SUBSCRIBE             2
  50
  51 /* Valid TMF subtypes.  */
  52 #define VIRTIO_SCSI_T_TMF_ABORT_TASK           0
  53 #define VIRTIO_SCSI_T_TMF_ABORT_TASK_SET       1
  54 #define VIRTIO_SCSI_T_TMF_CLEAR_ACA            2
  55 #define VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET       3
  56 #define VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET      4
  57 #define VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET   5
  58 #define VIRTIO_SCSI_T_TMF_QUERY_TASK           6
  59 #define VIRTIO_SCSI_T_TMF_QUERY_TASK_SET       7
  60
  61 /* Events.  */
  62 #define VIRTIO_SCSI_T_EVENTS_MISSED            0x80000000
  63 #define VIRTIO_SCSI_T_NO_EVENT                 0
  64 #define VIRTIO_SCSI_T_TRANSPORT_RESET          1
  65 #define VIRTIO_SCSI_T_ASYNC_NOTIFY             2
  66
  67 /* Reasons for transport reset event */
  68 #define VIRTIO_SCSI_EVT_RESET_HARD             0
  69 #define VIRTIO_SCSI_EVT_RESET_RESCAN           1
  70 #define VIRTIO_SCSI_EVT_RESET_REMOVED          2
  71
  72 /* SCSI command request, followed by data-out */
  73 typedef struct {
  74     uint8_t lun[8];              /* Logical Unit Number */
  75     uint64_t tag;                /* Command identifier */
  76     uint8_t task_attr;           /* Task attribute */
  77     uint8_t prio;
  78     uint8_t crn;
  79     uint8_t cdb[];
  80 } QEMU_PACKED VirtIOSCSICmdReq;
  81
  82 /* Response, followed by sense data and data-in */
  83 typedef struct {
  84     uint32_t sense_len;          /* Sense data length */
  85     uint32_t resid;              /* Residual bytes in data buffer */
  86     uint16_t status_qualifier;   /* Status qualifier */
  87     uint8_t status;              /* Command completion status */
  88     uint8_t response;            /* Response values */
  89     uint8_t sense[];
  90 } QEMU_PACKED VirtIOSCSICmdResp;
  91
  92 /* Task Management Request */
  93 typedef struct {
  94     uint32_t type;
  95     uint32_t subtype;
  96     uint8_t lun[8];
  97     uint64_t tag;
  98 } QEMU_PACKED VirtIOSCSICtrlTMFReq;
  99
 100 typedef struct {
 101     uint8_t response;
 102 } QEMU_PACKED VirtIOSCSICtrlTMFResp;
 103
 104 /* Asynchronous notification query/subscription */
 105 typedef struct {
 106     uint32_t type;
 107     uint8_t lun[8];
 108     uint32_t event_requested;
 109 } QEMU_PACKED VirtIOSCSICtrlANReq;
 110
 111 typedef struct {
 112     uint32_t event_actual;
 113     uint8_t response;
 114 } QEMU_PACKED VirtIOSCSICtrlANResp;
 115
 116 typedef struct {
 117     uint32_t event;
 118     uint8_t lun[8];
 119     uint32_t reason;
 120 } QEMU_PACKED VirtIOSCSIEvent;
 121
 122 typedef struct {
 123     uint32_t num_queues;
 124     uint32_t seg_max;
 125     uint32_t max_sectors;
 126     uint32_t cmd_per_lun;
 127     uint32_t event_info_size;
 128     uint32_t sense_size;
 129     uint32_t cdb_size;
 130     uint16_t max_channel;
 131     uint16_t max_target;
 132     uint32_t max_lun;
 133 } QEMU_PACKED VirtIOSCSIConfig;
 134
 135 typedef struct {
 136     VirtIODevice vdev;
 137     DeviceState *qdev;
 138     VirtIOSCSIConf *conf;
 139
 140     SCSIBus bus;
 141     uint32_t sense_size;
 142     uint32_t cdb_size;
 143     int resetting;
 144     bool events_dropped;
 145     VirtQueue *ctrl_vq;
 146     VirtQueue *event_vq;
 147     VirtQueue *cmd_vqs[0];
 148 } VirtIOSCSI;
 149
 150 typedef struct VirtIOSCSIReq {
 151     VirtIOSCSI *dev;
 152     VirtQueue *vq;
 153     VirtQueueElement elem;
 154     QEMUSGList qsgl;
 155     SCSIRequest *sreq;
 156     union {
 157         char                  *buf;
 158         VirtIOSCSICmdReq      *cmd;
 159         VirtIOSCSICtrlTMFReq  *tmf;
 160         VirtIOSCSICtrlANReq   *an;
 161     } req;
 162     union {
 163         char                  *buf;
 164         VirtIOSCSICmdResp     *cmd;
 165         VirtIOSCSICtrlTMFResp *tmf;
 166         VirtIOSCSICtrlANResp  *an;
 167         VirtIOSCSIEvent       *event;
 168     } resp;
 169 } VirtIOSCSIReq;
 170
 171 static inline int virtio_scsi_get_lun(uint8_t *lun)
 172 {
 173     return ((lun[2] << 8) | lun[3]) & 0x3FFF;
 174 }
 175
 176 static inline SCSIDevice *virtio_scsi_device_find(VirtIOSCSI *s, uint8_t *lun)
 177 {
 178     if (lun[0] != 1) {
 179         return NULL;
 180     }
 181     if (lun[2] != 0 && !(lun[2] >= 0x40 && lun[2] < 0x80)) {
 182         return NULL;
 183     }
 184     return scsi_device_find(&s->bus, 0, lun[1], virtio_scsi_get_lun(lun));
 185 }
 186
 187 static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
 188 {
 189     VirtIOSCSI *s = req->dev;
 190     VirtQueue *vq = req->vq;
 191     virtqueue_push(vq, &req->elem, req->qsgl.size + req->elem.in_sg[0].iov_len);
 192     qemu_sglist_destroy(&req->qsgl);
 193     if (req->sreq) {
 194         req->sreq->hba_private = NULL;
 195         scsi_req_unref(req->sreq);
 196     }
 197     g_free(req);
 198     virtio_notify(&s->vdev, vq);
 199 }
 200
 201 static void virtio_scsi_bad_req(void)
 202 {
 203     error_report("wrong size for virtio-scsi headers");
 204     exit(1);
 205 }
 206
 207 static void qemu_sgl_init_external(QEMUSGList *qsgl, struct iovec *sg,
 208                                    target_phys_addr_t *addr, int num)
 209 {
 210     memset(qsgl, 0, sizeof(*qsgl));
 211     while (num--) {
 212         qemu_sglist_add(qsgl, *(addr++), (sg++)->iov_len);
 213     }
 214 }
 215
 216 static void virtio_scsi_parse_req(VirtIOSCSI *s, VirtQueue *vq,
 217                                   VirtIOSCSIReq *req)
 218 {
 219     assert(req->elem.in_num);
 220     req->vq = vq;
 221     req->dev = s;
 222     req->sreq = NULL;
 223     if (req->elem.out_num) {
 224         req->req.buf = req->elem.out_sg[0].iov_base;
 225     }
 226     req->resp.buf = req->elem.in_sg[0].iov_base;
 227
 228     if (req->elem.out_num > 1) {
 229         qemu_sgl_init_external(&req->qsgl, &req->elem.out_sg[1],
 230                                &req->elem.out_addr[1],
 231                                req->elem.out_num - 1);
 232     } else {
 233         qemu_sgl_init_external(&req->qsgl, &req->elem.in_sg[1],
 234                                &req->elem.in_addr[1],
 235                                req->elem.in_num - 1);
 236     }
 237 }
 238
 239 static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
 240 {
 241     VirtIOSCSIReq *req;
 242     req = g_malloc(sizeof(*req));
 243     if (!virtqueue_pop(vq, &req->elem)) {
 244         g_free(req);
 245         return NULL;
 246     }
 247
 248     virtio_scsi_parse_req(s, vq, req);
 249     return req;
 250 }
 251
 252 static void virtio_scsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 253 {
 254     VirtIOSCSIReq *req = sreq->hba_private;
 255     uint32_t n = virtio_queue_get_id(req->vq) - 2;
 256
 257     assert(n < req->dev->conf->num_queues);
 258     qemu_put_be32s(f, &n);
 259     qemu_put_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 260 }
 261
 262 static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 263 {
 264     SCSIBus *bus = sreq->bus;
 265     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 266     VirtIOSCSIReq *req;
 267     uint32_t n;
 268
 269     req = g_malloc(sizeof(*req));
 270     qemu_get_be32s(f, &n);
 271     assert(n < s->conf->num_queues);
 272     qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 273     virtio_scsi_parse_req(s, s->cmd_vqs[n], req);
 274
 275     scsi_req_ref(sreq);
 276     req->sreq = sreq;
 277     if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
 278         int req_mode =
 279             (req->elem.in_num > 1 ? SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV);
 280
 281         assert(req->sreq->cmd.mode == req_mode);
 282     }
 283     return req;
 284 }
 285
 286 static void virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 287 {
 288     SCSIDevice *d = virtio_scsi_device_find(s, req->req.tmf->lun);
 289     SCSIRequest *r, *next;
 290     BusChild *kid;
 291     int target;
 292
 293     /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
 294     req->resp.tmf->response = VIRTIO_SCSI_S_OK;
 295
 296     switch (req->req.tmf->subtype) {
 297     case VIRTIO_SCSI_T_TMF_ABORT_TASK:
 298     case VIRTIO_SCSI_T_TMF_QUERY_TASK:
 299         if (!d) {
 300             goto fail;
 301         }
 302         if (d->lun != virtio_scsi_get_lun(req->req.tmf->lun)) {
 303             goto incorrect_lun;
 304         }
 305         QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 306             if (r->tag == req->req.tmf->tag) {
 307                 break;
 308             }
 309         }
 310         if (r && r->hba_private) {
 311             if (req->req.tmf->subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK) {
 312                 /* "If the specified command is present in the task set, then
 313                  * return a service response set to FUNCTION SUCCEEDED".
 314                  */
 315                 req->resp.tmf->response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 316             } else {
 317                 scsi_req_cancel(r);
 318             }
 319         }
 320         break;
 321
 322     case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
 323         if (!d) {
 324             goto fail;
 325         }
 326         if (d->lun != virtio_scsi_get_lun(req->req.tmf->lun)) {
 327             goto incorrect_lun;
 328         }
 329         s->resetting++;
 330         qdev_reset_all(&d->qdev);
 331         s->resetting--;
 332         break;
 333
 334     case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
 335     case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
 336     case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
 337         if (!d) {
 338             goto fail;
 339         }
 340         if (d->lun != virtio_scsi_get_lun(req->req.tmf->lun)) {
 341             goto incorrect_lun;
 342         }
 343         QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 344             if (r->hba_private) {
 345                 if (req->req.tmf->subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK_SET) {
 346                     /* "If there is any command present in the task set, then
 347                      * return a service response set to FUNCTION SUCCEEDED".
 348                      */
 349                     req->resp.tmf->response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 350                     break;
 351                 } else {
 352                     scsi_req_cancel(r);
 353                 }
 354             }
 355         }
 356         break;
 357
 358     case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
 359         target = req->req.tmf->lun[1];
 360         s->resetting++;
 361         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 362              d = DO_UPCAST(SCSIDevice, qdev, kid->child);
 363              if (d->channel == 0 && d->id == target) {
 364                 qdev_reset_all(&d->qdev);
 365              }
 366         }
 367         s->resetting--;
 368         break;
 369
 370     case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
 371     default:
 372         req->resp.tmf->response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
 373         break;
 374     }
 375
 376     return;
 377
 378 incorrect_lun:
 379     req->resp.tmf->response = VIRTIO_SCSI_S_INCORRECT_LUN;
 380     return;
 381
 382 fail:
 383     req->resp.tmf->response = VIRTIO_SCSI_S_BAD_TARGET;
 384 }
 385
 386 static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
 387 {
 388     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 389     VirtIOSCSIReq *req;
 390
 391     while ((req = virtio_scsi_pop_req(s, vq))) {
 392         int out_size, in_size;
 393         if (req->elem.out_num < 1 || req->elem.in_num < 1) {
 394             virtio_scsi_bad_req();
 395             continue;
 396         }
 397
 398         out_size = req->elem.out_sg[0].iov_len;
 399         in_size = req->elem.in_sg[0].iov_len;
 400         if (req->req.tmf->type == VIRTIO_SCSI_T_TMF) {
 401             if (out_size < sizeof(VirtIOSCSICtrlTMFReq) ||
 402                 in_size < sizeof(VirtIOSCSICtrlTMFResp)) {
 403                 virtio_scsi_bad_req();
 404             }
 405             virtio_scsi_do_tmf(s, req);
 406
 407         } else if (req->req.tmf->type == VIRTIO_SCSI_T_AN_QUERY ||
 408                    req->req.tmf->type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
 409             if (out_size < sizeof(VirtIOSCSICtrlANReq) ||
 410                 in_size < sizeof(VirtIOSCSICtrlANResp)) {
 411                 virtio_scsi_bad_req();
 412             }
 413             req->resp.an->event_actual = 0;
 414             req->resp.an->response = VIRTIO_SCSI_S_OK;
 415         }
 416         virtio_scsi_complete_req(req);
 417     }
 418 }
 419
 420 static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,
 421                                          size_t resid)
 422 {
 423     VirtIOSCSIReq *req = r->hba_private;
 424
 425     req->resp.cmd->response = VIRTIO_SCSI_S_OK;
 426     req->resp.cmd->status = status;
 427     if (req->resp.cmd->status == GOOD) {
 428         req->resp.cmd->resid = resid;
 429     } else {
 430         req->resp.cmd->resid = 0;
 431         req->resp.cmd->sense_len =
 432             scsi_req_get_sense(r, req->resp.cmd->sense, VIRTIO_SCSI_SENSE_SIZE);
 433     }
 434     virtio_scsi_complete_req(req);
 435 }
 436
 437 static QEMUSGList *virtio_scsi_get_sg_list(SCSIRequest *r)
 438 {
 439     VirtIOSCSIReq *req = r->hba_private;
 440
 441     return &req->qsgl;
 442 }
 443
 444 static void virtio_scsi_request_cancelled(SCSIRequest *r)
 445 {
 446     VirtIOSCSIReq *req = r->hba_private;
 447
 448     if (!req) {
 449         return;
 450     }
 451     if (req->dev->resetting) {
 452         req->resp.cmd->response = VIRTIO_SCSI_S_RESET;
 453     } else {
 454         req->resp.cmd->response = VIRTIO_SCSI_S_ABORTED;
 455     }
 456     virtio_scsi_complete_req(req);
 457 }
 458
 459 static void virtio_scsi_fail_cmd_req(VirtIOSCSIReq *req)
 460 {
 461     req->resp.cmd->response = VIRTIO_SCSI_S_FAILURE;
 462     virtio_scsi_complete_req(req);
 463 }
 464
 465 static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
 466 {
 467     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 468     VirtIOSCSIReq *req;
 469     int n;
 470
 471     while ((req = virtio_scsi_pop_req(s, vq))) {
 472         SCSIDevice *d;
 473         int out_size, in_size;
 474         if (req->elem.out_num < 1 || req->elem.in_num < 1) {
 475             virtio_scsi_bad_req();
 476         }
 477
 478         out_size = req->elem.out_sg[0].iov_len;
 479         in_size = req->elem.in_sg[0].iov_len;
 480         if (out_size < sizeof(VirtIOSCSICmdReq) + s->cdb_size ||
 481             in_size < sizeof(VirtIOSCSICmdResp) + s->sense_size) {
 482             virtio_scsi_bad_req();
 483         }
 484
 485         if (req->elem.out_num > 1 && req->elem.in_num > 1) {
 486             virtio_scsi_fail_cmd_req(req);
 487             continue;
 488         }
 489
 490         d = virtio_scsi_device_find(s, req->req.cmd->lun);
 491         if (!d) {
 492             req->resp.cmd->response = VIRTIO_SCSI_S_BAD_TARGET;
 493             virtio_scsi_complete_req(req);
 494             continue;
 495         }
 496         req->sreq = scsi_req_new(d, req->req.cmd->tag,
 497                                  virtio_scsi_get_lun(req->req.cmd->lun),
 498                                  req->req.cmd->cdb, req);
 499
 500         if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
 501             int req_mode =
 502                 (req->elem.in_num > 1 ? SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV);
 503
 504             if (req->sreq->cmd.mode != req_mode ||
 505                 req->sreq->cmd.xfer > req->qsgl.size) {
 506                 req->resp.cmd->response = VIRTIO_SCSI_S_OVERRUN;
 507                 virtio_scsi_complete_req(req);
 508                 continue;
 509             }
 510         }
 511
 512         n = scsi_req_enqueue(req->sreq);
 513         if (n) {
 514             scsi_req_continue(req->sreq);
 515         }
 516     }
 517 }
 518
 519 static void virtio_scsi_get_config(VirtIODevice *vdev,
 520                                    uint8_t *config)
 521 {
 522     VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 523     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 524
 525     stl_raw(&scsiconf->num_queues, s->conf->num_queues);
 526     stl_raw(&scsiconf->seg_max, 128 - 2);
 527     stl_raw(&scsiconf->max_sectors, s->conf->max_sectors);
 528     stl_raw(&scsiconf->cmd_per_lun, s->conf->cmd_per_lun);
 529     stl_raw(&scsiconf->event_info_size, sizeof(VirtIOSCSIEvent));
 530     stl_raw(&scsiconf->sense_size, s->sense_size);
 531     stl_raw(&scsiconf->cdb_size, s->cdb_size);
 532     stl_raw(&scsiconf->max_channel, VIRTIO_SCSI_MAX_CHANNEL);
 533     stl_raw(&scsiconf->max_target, VIRTIO_SCSI_MAX_TARGET);
 534     stl_raw(&scsiconf->max_lun, VIRTIO_SCSI_MAX_LUN);
 535 }
 536
 537 static void virtio_scsi_set_config(VirtIODevice *vdev,
 538                                    const uint8_t *config)
 539 {
 540     VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 541     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 542
 543     if ((uint32_t) ldl_raw(&scsiconf->sense_size) >= 65536 ||
 544         (uint32_t) ldl_raw(&scsiconf->cdb_size) >= 256) {
 545         error_report("bad data written to virtio-scsi configuration space");
 546         exit(1);
 547     }
 548
 549     s->sense_size = ldl_raw(&scsiconf->sense_size);
 550     s->cdb_size = ldl_raw(&scsiconf->cdb_size);
 551 }
 552
 553 static uint32_t virtio_scsi_get_features(VirtIODevice *vdev,
 554                                          uint32_t requested_features)
 555 {
 556     requested_features |= (1UL << VIRTIO_SCSI_F_HOTPLUG);
 557     return requested_features;
 558 }
 559
 560 static void virtio_scsi_reset(VirtIODevice *vdev)
 561 {
 562     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 563
 564     s->sense_size = VIRTIO_SCSI_SENSE_SIZE;
 565     s->cdb_size = VIRTIO_SCSI_CDB_SIZE;
 566     s->events_dropped = false;
 567 }
 568
 569 /* The device does not have anything to save beyond the virtio data.
 570  * Request data is saved with callbacks from SCSI devices.
 571  */
 572 static void virtio_scsi_save(QEMUFile *f, void *opaque)
 573 {
 574     VirtIOSCSI *s = opaque;
 575     virtio_save(&s->vdev, f);
 576 }
 577
 578 static int virtio_scsi_load(QEMUFile *f, void *opaque, int version_id)
 579 {
 580     VirtIOSCSI *s = opaque;
 581     int ret;
 582
 583     ret = virtio_load(&s->vdev, f);
 584     if (ret) {
 585         return ret;
 586     }
 587     return 0;
 588 }
 589
 590 static void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
 591                                    uint32_t event, uint32_t reason)
 592 {
 593     VirtIOSCSIReq *req = virtio_scsi_pop_req(s, s->event_vq);
 594     VirtIOSCSIEvent *evt;
 595     int in_size;
 596
 597     if (!req) {
 598         s->events_dropped = true;
 599         return;
 600     }
 601
 602     if (req->elem.out_num || req->elem.in_num != 1) {
 603         virtio_scsi_bad_req();
 604     }
 605
 606     if (s->events_dropped) {
 607         event |= VIRTIO_SCSI_T_EVENTS_MISSED;
 608         s->events_dropped = false;
 609     }
 610
 611     in_size = req->elem.in_sg[0].iov_len;
 612     if (in_size < sizeof(VirtIOSCSIEvent)) {
 613         virtio_scsi_bad_req();
 614     }
 615
 616     evt = req->resp.event;
 617     memset(evt, 0, sizeof(VirtIOSCSIEvent));
 618     evt->event = event;
 619     evt->reason = reason;
 620     if (!dev) {
 621         assert(event == VIRTIO_SCSI_T_NO_EVENT);
 622     } else {
 623         evt->lun[0] = 1;
 624         evt->lun[1] = dev->id;
 625
 626         /* Linux wants us to keep the same encoding we use for REPORT LUNS.  */
 627         if (dev->lun >= 256) {
 628             evt->lun[2] = (dev->lun >> 8) | 0x40;
 629         }
 630         evt->lun[3] = dev->lun & 0xFF;
 631     }
 632     virtio_scsi_complete_req(req);
 633 }
 634
 635 static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
 636 {
 637     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 638
 639     if (s->events_dropped) {
 640         virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
 641     }
 642 }
 643
 644 static void virtio_scsi_hotplug(SCSIBus *bus, SCSIDevice *dev)
 645 {
 646     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 647
 648     if (((s->vdev.guest_features >> VIRTIO_SCSI_F_HOTPLUG) & 1) &&
 649         (s->vdev.status & VIRTIO_CONFIG_S_DRIVER_OK)) {
 650         virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_TRANSPORT_RESET,
 651                                VIRTIO_SCSI_EVT_RESET_RESCAN);
 652     }
 653 }
 654
 655 static void virtio_scsi_hot_unplug(SCSIBus *bus, SCSIDevice *dev)
 656 {
 657     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 658
 659     if ((s->vdev.guest_features >> VIRTIO_SCSI_F_HOTPLUG) & 1) {
 660         virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_TRANSPORT_RESET,
 661                                VIRTIO_SCSI_EVT_RESET_REMOVED);
 662     }
 663 }
 664
 665 static struct SCSIBusInfo virtio_scsi_scsi_info = {
 666     .tcq = true,
 667     .max_channel = VIRTIO_SCSI_MAX_CHANNEL,
 668     .max_target = VIRTIO_SCSI_MAX_TARGET,
 669     .max_lun = VIRTIO_SCSI_MAX_LUN,
 670
 671     .complete = virtio_scsi_command_complete,
 672     .cancel = virtio_scsi_request_cancelled,
 673     .hotplug = virtio_scsi_hotplug,
 674     .hot_unplug = virtio_scsi_hot_unplug,
 675     .get_sg_list = virtio_scsi_get_sg_list,
 676     .save_request = virtio_scsi_save_request,
 677     .load_request = virtio_scsi_load_request,
 678 };
 679
 680 VirtIODevice *virtio_scsi_init(DeviceState *dev, VirtIOSCSIConf *proxyconf)
 681 {
 682     VirtIOSCSI *s;
 683     static int virtio_scsi_id;
 684     size_t sz;
 685     int i;
 686
 687     sz = sizeof(VirtIOSCSI) + proxyconf->num_queues * sizeof(VirtQueue *);
 688     s = (VirtIOSCSI *)virtio_common_init("virtio-scsi", VIRTIO_ID_SCSI,
 689                                          sizeof(VirtIOSCSIConfig), sz);
 690
 691     s->qdev = dev;
 692     s->conf = proxyconf;
 693
 694     /* TODO set up vdev function pointers */
 695     s->vdev.get_config = virtio_scsi_get_config;
 696     s->vdev.set_config = virtio_scsi_set_config;
 697     s->vdev.get_features = virtio_scsi_get_features;
 698     s->vdev.reset = virtio_scsi_reset;
 699
 700     s->ctrl_vq = virtio_add_queue(&s->vdev, VIRTIO_SCSI_VQ_SIZE,
 701                                    virtio_scsi_handle_ctrl);
 702     s->event_vq = virtio_add_queue(&s->vdev, VIRTIO_SCSI_VQ_SIZE,
 703                                    virtio_scsi_handle_event);
 704     for (i = 0; i < s->conf->num_queues; i++) {
 705         s->cmd_vqs[i] = virtio_add_queue(&s->vdev, VIRTIO_SCSI_VQ_SIZE,
 706                                          virtio_scsi_handle_cmd);
 707     }
 708
 709     scsi_bus_new(&s->bus, dev, &virtio_scsi_scsi_info);
 710     if (!dev->hotplugged) {
 711         scsi_bus_legacy_handle_cmdline(&s->bus);
 712     }
 713
 714     register_savevm(dev, "virtio-scsi", virtio_scsi_id++, 1,
 715                     virtio_scsi_save, virtio_scsi_load, s);
 716
 717     return &s->vdev;
 718 }
 719
 720 void virtio_scsi_exit(VirtIODevice *vdev)
 721 {
 722     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 723     unregister_savevm(s->qdev, "virtio-scsi", s);
 724     virtio_cleanup(vdev);
 725 }