hw/scsi/virtio-scsi.c

   1 /*
   2  * Virtio SCSI HBA
   3  *
   4  * Copyright IBM, Corp. 2010
   5  * Copyright Red Hat, Inc. 2011
   6  *
   7  * Authors:
   8  *   Stefan Hajnoczi    <stefanha@linux.vnet.ibm.com>
   9  *   Paolo Bonzini      <pbonzini@redhat.com>
  10  *
  11  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  12  * See the COPYING file in the top-level directory.
  13  *
  14  */
  15
  16 #include "standard-headers/linux/virtio_ids.h"
  17 #include "hw/virtio/virtio-scsi.h"
  18 #include "qemu/error-report.h"
  19 #include "qemu/iov.h"
  20 #include "sysemu/block-backend.h"
  21 #include <hw/scsi/scsi.h>
  22 #include <block/scsi.h>
  23 #include <hw/virtio/virtio-bus.h>
  24 #include "hw/virtio/virtio-access.h"
  25 #include "migration/migration.h"
  26
  27 static inline int virtio_scsi_get_lun(uint8_t *lun)
  28 {
  29     return ((lun[2] << 8) | lun[3]) & 0x3FFF;
  30 }
  31
  32 static inline SCSIDevice *virtio_scsi_device_find(VirtIOSCSI *s, uint8_t *lun)
  33 {
  34     if (lun[0] != 1) {
  35         return NULL;
  36     }
  37     if (lun[2] != 0 && !(lun[2] >= 0x40 && lun[2] < 0x80)) {
  38         return NULL;
  39     }
  40     return scsi_device_find(&s->bus, 0, lun[1], virtio_scsi_get_lun(lun));
  41 }
  42
  43 VirtIOSCSIReq *virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq)
  44 {
  45     VirtIOSCSIReq *req;
  46     VirtIOSCSICommon *vs = (VirtIOSCSICommon *)s;
  47     const size_t zero_skip = offsetof(VirtIOSCSIReq, elem)
  48                              + sizeof(VirtQueueElement);
  49
  50     req = g_slice_alloc(sizeof(*req) + vs->cdb_size);
  51     req->vq = vq;
  52     req->dev = s;
  53     qemu_sglist_init(&req->qsgl, DEVICE(s), 8, &address_space_memory);
  54     qemu_iovec_init(&req->resp_iov, 1);
  55     memset((uint8_t *)req + zero_skip, 0, sizeof(*req) - zero_skip);
  56     return req;
  57 }
  58
  59 void virtio_scsi_free_req(VirtIOSCSIReq *req)
  60 {
  61     VirtIOSCSICommon *vs = (VirtIOSCSICommon *)req->dev;
  62
  63     qemu_iovec_destroy(&req->resp_iov);
  64     qemu_sglist_destroy(&req->qsgl);
  65     g_slice_free1(sizeof(*req) + vs->cdb_size, req);
  66 }
  67
  68 static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
  69 {
  70     VirtIOSCSI *s = req->dev;
  71     VirtQueue *vq = req->vq;
  72     VirtIODevice *vdev = VIRTIO_DEVICE(s);
  73
  74     qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size);
  75     if (req->vring) {
  76         assert(req->vq == NULL);
  77         virtio_scsi_vring_push_notify(req);
  78     } else {
  79         virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
  80         virtio_notify(vdev, vq);
  81     }
  82
  83     if (req->sreq) {
  84         req->sreq->hba_private = NULL;
  85         scsi_req_unref(req->sreq);
  86     }
  87     virtio_scsi_free_req(req);
  88 }
  89
  90 static void virtio_scsi_bad_req(void)
  91 {
  92     error_report("wrong size for virtio-scsi headers");
  93     exit(1);
  94 }
  95
  96 static size_t qemu_sgl_concat(VirtIOSCSIReq *req, struct iovec *iov,
  97                               hwaddr *addr, int num, size_t skip)
  98 {
  99     QEMUSGList *qsgl = &req->qsgl;
 100     size_t copied = 0;
 101
 102     while (num) {
 103         if (skip >= iov->iov_len) {
 104             skip -= iov->iov_len;
 105         } else {
 106             qemu_sglist_add(qsgl, *addr + skip, iov->iov_len - skip);
 107             copied += iov->iov_len - skip;
 108             skip = 0;
 109         }
 110         iov++;
 111         addr++;
 112         num--;
 113     }
 114
 115     assert(skip == 0);
 116     return copied;
 117 }
 118
 119 static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
 120                                  unsigned req_size, unsigned resp_size)
 121 {
 122     VirtIODevice *vdev = (VirtIODevice *) req->dev;
 123     size_t in_size, out_size;
 124
 125     if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 126                    &req->req, req_size) < req_size) {
 127         return -EINVAL;
 128     }
 129
 130     if (qemu_iovec_concat_iov(&req->resp_iov,
 131                               req->elem.in_sg, req->elem.in_num, 0,
 132                               resp_size) < resp_size) {
 133         return -EINVAL;
 134     }
 135
 136     req->resp_size = resp_size;
 137
 138     /* Old BIOSes left some padding by mistake after the req_size/resp_size.
 139      * As a workaround, always consider the first buffer as the virtio-scsi
 140      * request/response, making the payload start at the second element
 141      * of the iovec.
 142      *
 143      * The actual length of the response header, stored in req->resp_size,
 144      * does not change.
 145      *
 146      * TODO: always disable this workaround for virtio 1.0 devices.
 147      */
 148     if (!virtio_vdev_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
 149         if (req->elem.out_num) {
 150             req_size = req->elem.out_sg[0].iov_len;
 151         }
 152         if (req->elem.in_num) {
 153             resp_size = req->elem.in_sg[0].iov_len;
 154         }
 155     }
 156
 157     out_size = qemu_sgl_concat(req, req->elem.out_sg,
 158                                &req->elem.out_addr[0], req->elem.out_num,
 159                                req_size);
 160     in_size = qemu_sgl_concat(req, req->elem.in_sg,
 161                               &req->elem.in_addr[0], req->elem.in_num,
 162                               resp_size);
 163
 164     if (out_size && in_size) {
 165         return -ENOTSUP;
 166     }
 167
 168     if (out_size) {
 169         req->mode = SCSI_XFER_TO_DEV;
 170     } else if (in_size) {
 171         req->mode = SCSI_XFER_FROM_DEV;
 172     }
 173
 174     return 0;
 175 }
 176
 177 static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
 178 {
 179     VirtIOSCSIReq *req = virtio_scsi_init_req(s, vq);
 180     if (!virtqueue_pop(vq, &req->elem)) {
 181         virtio_scsi_free_req(req);
 182         return NULL;
 183     }
 184     return req;
 185 }
 186
 187 static void virtio_scsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 188 {
 189     VirtIOSCSIReq *req = sreq->hba_private;
 190     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(req->dev);
 191     uint32_t n = virtio_queue_get_id(req->vq) - 2;
 192
 193     assert(n < vs->conf.num_queues);
 194     qemu_put_be32s(f, &n);
 195     qemu_put_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 196 }
 197
 198 static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 199 {
 200     SCSIBus *bus = sreq->bus;
 201     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 202     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 203     VirtIOSCSIReq *req;
 204     uint32_t n;
 205
 206     qemu_get_be32s(f, &n);
 207     assert(n < vs->conf.num_queues);
 208     req = virtio_scsi_init_req(s, vs->cmd_vqs[n]);
 209     qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 210     /* TODO: add a way for SCSIBusInfo's load_request to fail,
 211      * and fail migration instead of asserting here.
 212      * When we do, we might be able to re-enable NDEBUG below.
 213      */
 214 #ifdef NDEBUG
 215 #error building with NDEBUG is not supported
 216 #endif
 217     assert(req->elem.in_num <= ARRAY_SIZE(req->elem.in_sg));
 218     assert(req->elem.out_num <= ARRAY_SIZE(req->elem.out_sg));
 219
 220     if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 221                               sizeof(VirtIOSCSICmdResp) + vs->sense_size) < 0) {
 222         error_report("invalid SCSI request migration data");
 223         exit(1);
 224     }
 225
 226     scsi_req_ref(sreq);
 227     req->sreq = sreq;
 228     if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
 229         assert(req->sreq->cmd.mode == req->mode);
 230     }
 231     return req;
 232 }
 233
 234 typedef struct {
 235     Notifier        notifier;
 236     VirtIOSCSIReq  *tmf_req;
 237 } VirtIOSCSICancelNotifier;
 238
 239 static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
 240 {
 241     VirtIOSCSICancelNotifier *n = container_of(notifier,
 242                                                VirtIOSCSICancelNotifier,
 243                                                notifier);
 244
 245     if (--n->tmf_req->remaining == 0) {
 246         virtio_scsi_complete_req(n->tmf_req);
 247     }
 248     g_slice_free(VirtIOSCSICancelNotifier, n);
 249 }
 250
 251 /* Return 0 if the request is ready to be completed and return to guest;
 252  * -EINPROGRESS if the request is submitted and will be completed later, in the
 253  *  case of async cancellation. */
 254 static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 255 {
 256     SCSIDevice *d = virtio_scsi_device_find(s, req->req.tmf.lun);
 257     SCSIRequest *r, *next;
 258     BusChild *kid;
 259     int target;
 260     int ret = 0;
 261
 262     if (s->dataplane_started) {
 263         assert(blk_get_aio_context(d->conf.blk) == s->ctx);
 264     }
 265     /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
 266     req->resp.tmf.response = VIRTIO_SCSI_S_OK;
 267
 268     virtio_tswap32s(VIRTIO_DEVICE(s), &req->req.tmf.subtype);
 269     switch (req->req.tmf.subtype) {
 270     case VIRTIO_SCSI_T_TMF_ABORT_TASK:
 271     case VIRTIO_SCSI_T_TMF_QUERY_TASK:
 272         if (!d) {
 273             goto fail;
 274         }
 275         if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 276             goto incorrect_lun;
 277         }
 278         QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 279             VirtIOSCSIReq *cmd_req = r->hba_private;
 280             if (cmd_req && cmd_req->req.cmd.tag == req->req.tmf.tag) {
 281                 break;
 282             }
 283         }
 284         if (r) {
 285             /*
 286              * Assert that the request has not been completed yet, we
 287              * check for it in the loop above.
 288              */
 289             assert(r->hba_private);
 290             if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK) {
 291                 /* "If the specified command is present in the task set, then
 292                  * return a service response set to FUNCTION SUCCEEDED".
 293                  */
 294                 req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 295             } else {
 296                 VirtIOSCSICancelNotifier *notifier;
 297
 298                 req->remaining = 1;
 299                 notifier = g_slice_new(VirtIOSCSICancelNotifier);
 300                 notifier->tmf_req = req;
 301                 notifier->notifier.notify = virtio_scsi_cancel_notify;
 302                 scsi_req_cancel_async(r, &notifier->notifier);
 303                 ret = -EINPROGRESS;
 304             }
 305         }
 306         break;
 307
 308     case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
 309         if (!d) {
 310             goto fail;
 311         }
 312         if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 313             goto incorrect_lun;
 314         }
 315         s->resetting++;
 316         qdev_reset_all(&d->qdev);
 317         s->resetting--;
 318         break;
 319
 320     case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
 321     case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
 322     case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
 323         if (!d) {
 324             goto fail;
 325         }
 326         if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 327             goto incorrect_lun;
 328         }
 329
 330         /* Add 1 to "remaining" until virtio_scsi_do_tmf returns.
 331          * This way, if the bus starts calling back to the notifiers
 332          * even before we finish the loop, virtio_scsi_cancel_notify
 333          * will not complete the TMF too early.
 334          */
 335         req->remaining = 1;
 336         QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
 337             if (r->hba_private) {
 338                 if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK_SET) {
 339                     /* "If there is any command present in the task set, then
 340                      * return a service response set to FUNCTION SUCCEEDED".
 341                      */
 342                     req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
 343                     break;
 344                 } else {
 345                     VirtIOSCSICancelNotifier *notifier;
 346
 347                     req->remaining++;
 348                     notifier = g_slice_new(VirtIOSCSICancelNotifier);
 349                     notifier->notifier.notify = virtio_scsi_cancel_notify;
 350                     notifier->tmf_req = req;
 351                     scsi_req_cancel_async(r, &notifier->notifier);
 352                 }
 353             }
 354         }
 355         if (--req->remaining > 0) {
 356             ret = -EINPROGRESS;
 357         }
 358         break;
 359
 360     case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
 361         target = req->req.tmf.lun[1];
 362         s->resetting++;
 363         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 364              d = DO_UPCAST(SCSIDevice, qdev, kid->child);
 365              if (d->channel == 0 && d->id == target) {
 366                 qdev_reset_all(&d->qdev);
 367              }
 368         }
 369         s->resetting--;
 370         break;
 371
 372     case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
 373     default:
 374         req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
 375         break;
 376     }
 377
 378     return ret;
 379
 380 incorrect_lun:
 381     req->resp.tmf.response = VIRTIO_SCSI_S_INCORRECT_LUN;
 382     return ret;
 383
 384 fail:
 385     req->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
 386     return ret;
 387 }
 388
 389 void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
 390 {
 391     VirtIODevice *vdev = (VirtIODevice *)s;
 392     uint32_t type;
 393     int r = 0;
 394
 395     if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
 396                 &type, sizeof(type)) < sizeof(type)) {
 397         virtio_scsi_bad_req();
 398         return;
 399     }
 400
 401     virtio_tswap32s(vdev, &type);
 402     if (type == VIRTIO_SCSI_T_TMF) {
 403         if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
 404                     sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
 405             virtio_scsi_bad_req();
 406         } else {
 407             r = virtio_scsi_do_tmf(s, req);
 408         }
 409
 410     } else if (type == VIRTIO_SCSI_T_AN_QUERY ||
 411                type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
 412         if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),
 413                     sizeof(VirtIOSCSICtrlANResp)) < 0) {
 414             virtio_scsi_bad_req();
 415         } else {
 416             req->resp.an.event_actual = 0;
 417             req->resp.an.response = VIRTIO_SCSI_S_OK;
 418         }
 419     }
 420     if (r == 0) {
 421         virtio_scsi_complete_req(req);
 422     } else {
 423         assert(r == -EINPROGRESS);
 424     }
 425 }
 426
 427 static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
 428 {
 429     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 430     VirtIOSCSIReq *req;
 431
 432     if (s->ctx && !s->dataplane_disabled) {
 433         virtio_scsi_dataplane_start(s);
 434         return;
 435     }
 436     while ((req = virtio_scsi_pop_req(s, vq))) {
 437         virtio_scsi_handle_ctrl_req(s, req);
 438     }
 439 }
 440
 441 static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
 442 {
 443     /* Sense data is not in req->resp and is copied separately
 444      * in virtio_scsi_command_complete.
 445      */
 446     req->resp_size = sizeof(VirtIOSCSICmdResp);
 447     virtio_scsi_complete_req(req);
 448 }
 449
 450 static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,
 451                                          size_t resid)
 452 {
 453     VirtIOSCSIReq *req = r->hba_private;
 454     uint8_t sense[SCSI_SENSE_BUF_SIZE];
 455     uint32_t sense_len;
 456     VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
 457
 458     if (r->io_canceled) {
 459         return;
 460     }
 461
 462     req->resp.cmd.response = VIRTIO_SCSI_S_OK;
 463     req->resp.cmd.status = status;
 464     if (req->resp.cmd.status == GOOD) {
 465         req->resp.cmd.resid = virtio_tswap32(vdev, resid);
 466     } else {
 467         req->resp.cmd.resid = 0;
 468         sense_len = scsi_req_get_sense(r, sense, sizeof(sense));
 469         sense_len = MIN(sense_len, req->resp_iov.size - sizeof(req->resp.cmd));
 470         qemu_iovec_from_buf(&req->resp_iov, sizeof(req->resp.cmd),
 471                             sense, sense_len);
 472         req->resp.cmd.sense_len = virtio_tswap32(vdev, sense_len);
 473     }
 474     virtio_scsi_complete_cmd_req(req);
 475 }
 476
 477 static int virtio_scsi_parse_cdb(SCSIDevice *dev, SCSICommand *cmd,
 478                                  uint8_t *buf, void *hba_private)
 479 {
 480     VirtIOSCSIReq *req = hba_private;
 481
 482     if (cmd->len == 0) {
 483         cmd->len = MIN(VIRTIO_SCSI_CDB_DEFAULT_SIZE, SCSI_CMD_BUF_SIZE);
 484         memcpy(cmd->buf, buf, cmd->len);
 485     }
 486
 487     /* Extract the direction and mode directly from the request, for
 488      * host device passthrough.
 489      */
 490     cmd->xfer = req->qsgl.size;
 491     cmd->mode = req->mode;
 492     return 0;
 493 }
 494
 495 static QEMUSGList *virtio_scsi_get_sg_list(SCSIRequest *r)
 496 {
 497     VirtIOSCSIReq *req = r->hba_private;
 498
 499     return &req->qsgl;
 500 }
 501
 502 static void virtio_scsi_request_cancelled(SCSIRequest *r)
 503 {
 504     VirtIOSCSIReq *req = r->hba_private;
 505
 506     if (!req) {
 507         return;
 508     }
 509     if (req->dev->resetting) {
 510         req->resp.cmd.response = VIRTIO_SCSI_S_RESET;
 511     } else {
 512         req->resp.cmd.response = VIRTIO_SCSI_S_ABORTED;
 513     }
 514     virtio_scsi_complete_cmd_req(req);
 515 }
 516
 517 static void virtio_scsi_fail_cmd_req(VirtIOSCSIReq *req)
 518 {
 519     req->resp.cmd.response = VIRTIO_SCSI_S_FAILURE;
 520     virtio_scsi_complete_cmd_req(req);
 521 }
 522
 523 bool virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
 524 {
 525     VirtIOSCSICommon *vs = &s->parent_obj;
 526     SCSIDevice *d;
 527     int rc;
 528
 529     rc = virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
 530                                sizeof(VirtIOSCSICmdResp) + vs->sense_size);
 531     if (rc < 0) {
 532         if (rc == -ENOTSUP) {
 533             virtio_scsi_fail_cmd_req(req);
 534         } else {
 535             virtio_scsi_bad_req();
 536         }
 537         return false;
 538     }
 539
 540     d = virtio_scsi_device_find(s, req->req.cmd.lun);
 541     if (!d) {
 542         req->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
 543         virtio_scsi_complete_cmd_req(req);
 544         return false;
 545     }
 546     if (s->dataplane_started) {
 547         assert(blk_get_aio_context(d->conf.blk) == s->ctx);
 548     }
 549     req->sreq = scsi_req_new(d, req->req.cmd.tag,
 550                              virtio_scsi_get_lun(req->req.cmd.lun),
 551                              req->req.cmd.cdb, req);
 552
 553     if (req->sreq->cmd.mode != SCSI_XFER_NONE
 554         && (req->sreq->cmd.mode != req->mode ||
 555             req->sreq->cmd.xfer > req->qsgl.size)) {
 556         req->resp.cmd.response = VIRTIO_SCSI_S_OVERRUN;
 557         virtio_scsi_complete_cmd_req(req);
 558         return false;
 559     }
 560     scsi_req_ref(req->sreq);
 561     blk_io_plug(d->conf.blk);
 562     return true;
 563 }
 564
 565 void virtio_scsi_handle_cmd_req_submit(VirtIOSCSI *s, VirtIOSCSIReq *req)
 566 {
 567     SCSIRequest *sreq = req->sreq;
 568     if (scsi_req_enqueue(sreq)) {
 569         scsi_req_continue(sreq);
 570     }
 571     blk_io_unplug(sreq->dev->conf.blk);
 572     scsi_req_unref(sreq);
 573 }
 574
 575 static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
 576 {
 577     /* use non-QOM casts in the data path */
 578     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 579     VirtIOSCSIReq *req, *next;
 580     QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
 581
 582     if (s->ctx && !s->dataplane_disabled) {
 583         virtio_scsi_dataplane_start(s);
 584         return;
 585     }
 586     while ((req = virtio_scsi_pop_req(s, vq))) {
 587         if (virtio_scsi_handle_cmd_req_prepare(s, req)) {
 588             QTAILQ_INSERT_TAIL(&reqs, req, next);
 589         }
 590     }
 591
 592     QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
 593         virtio_scsi_handle_cmd_req_submit(s, req);
 594     }
 595 }
 596
 597 static void virtio_scsi_get_config(VirtIODevice *vdev,
 598                                    uint8_t *config)
 599 {
 600     VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 601     VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(vdev);
 602
 603     virtio_stl_p(vdev, &scsiconf->num_queues, s->conf.num_queues);
 604     virtio_stl_p(vdev, &scsiconf->seg_max, 128 - 2);
 605     virtio_stl_p(vdev, &scsiconf->max_sectors, s->conf.max_sectors);
 606     virtio_stl_p(vdev, &scsiconf->cmd_per_lun, s->conf.cmd_per_lun);
 607     virtio_stl_p(vdev, &scsiconf->event_info_size, sizeof(VirtIOSCSIEvent));
 608     virtio_stl_p(vdev, &scsiconf->sense_size, s->sense_size);
 609     virtio_stl_p(vdev, &scsiconf->cdb_size, s->cdb_size);
 610     virtio_stw_p(vdev, &scsiconf->max_channel, VIRTIO_SCSI_MAX_CHANNEL);
 611     virtio_stw_p(vdev, &scsiconf->max_target, VIRTIO_SCSI_MAX_TARGET);
 612     virtio_stl_p(vdev, &scsiconf->max_lun, VIRTIO_SCSI_MAX_LUN);
 613 }
 614
 615 static void virtio_scsi_set_config(VirtIODevice *vdev,
 616                                    const uint8_t *config)
 617 {
 618     VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
 619     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 620
 621     if ((uint32_t) virtio_ldl_p(vdev, &scsiconf->sense_size) >= 65536 ||
 622         (uint32_t) virtio_ldl_p(vdev, &scsiconf->cdb_size) >= 256) {
 623         error_report("bad data written to virtio-scsi configuration space");
 624         exit(1);
 625     }
 626
 627     vs->sense_size = virtio_ldl_p(vdev, &scsiconf->sense_size);
 628     vs->cdb_size = virtio_ldl_p(vdev, &scsiconf->cdb_size);
 629 }
 630
 631 static uint64_t virtio_scsi_get_features(VirtIODevice *vdev,
 632                                          uint64_t requested_features,
 633                                          Error **errp)
 634 {
 635     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 636
 637     /* Firstly sync all virtio-scsi possible supported features */
 638     requested_features |= s->host_features;
 639     return requested_features;
 640 }
 641
 642 static void virtio_scsi_reset(VirtIODevice *vdev)
 643 {
 644     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 645     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 646
 647     if (s->ctx) {
 648         virtio_scsi_dataplane_stop(s);
 649     }
 650     s->resetting++;
 651     qbus_reset_all(&s->bus.qbus);
 652     s->resetting--;
 653
 654     vs->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 655     vs->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 656     s->events_dropped = false;
 657 }
 658
 659 /* The device does not have anything to save beyond the virtio data.
 660  * Request data is saved with callbacks from SCSI devices.
 661  */
 662 static void virtio_scsi_save(QEMUFile *f, void *opaque)
 663 {
 664     VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
 665     virtio_save(vdev, f);
 666 }
 667
 668 static int virtio_scsi_load(QEMUFile *f, void *opaque, int version_id)
 669 {
 670     VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
 671     int ret;
 672
 673     ret = virtio_load(vdev, f, version_id);
 674     if (ret) {
 675         return ret;
 676     }
 677     return 0;
 678 }
 679
 680 void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
 681                             uint32_t event, uint32_t reason)
 682 {
 683     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
 684     VirtIOSCSIReq *req;
 685     VirtIOSCSIEvent *evt;
 686     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 687
 688     if (!(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
 689         return;
 690     }
 691
 692     if (s->dataplane_started) {
 693         assert(s->ctx);
 694         aio_context_acquire(s->ctx);
 695     }
 696
 697     if (s->dataplane_started) {
 698         req = virtio_scsi_pop_req_vring(s, s->event_vring);
 699     } else {
 700         req = virtio_scsi_pop_req(s, vs->event_vq);
 701     }
 702     if (!req) {
 703         s->events_dropped = true;
 704         goto out;
 705     }
 706
 707     if (s->events_dropped) {
 708         event |= VIRTIO_SCSI_T_EVENTS_MISSED;
 709         s->events_dropped = false;
 710     }
 711
 712     if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
 713         virtio_scsi_bad_req();
 714     }
 715
 716     evt = &req->resp.event;
 717     memset(evt, 0, sizeof(VirtIOSCSIEvent));
 718     evt->event = virtio_tswap32(vdev, event);
 719     evt->reason = virtio_tswap32(vdev, reason);
 720     if (!dev) {
 721         assert(event == VIRTIO_SCSI_T_EVENTS_MISSED);
 722     } else {
 723         evt->lun[0] = 1;
 724         evt->lun[1] = dev->id;
 725
 726         /* Linux wants us to keep the same encoding we use for REPORT LUNS.  */
 727         if (dev->lun >= 256) {
 728             evt->lun[2] = (dev->lun >> 8) | 0x40;
 729         }
 730         evt->lun[3] = dev->lun & 0xFF;
 731     }
 732     virtio_scsi_complete_req(req);
 733 out:
 734     if (s->dataplane_started) {
 735         aio_context_release(s->ctx);
 736     }
 737 }
 738
 739 static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
 740 {
 741     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 742
 743     if (s->ctx && !s->dataplane_disabled) {
 744         virtio_scsi_dataplane_start(s);
 745         return;
 746     }
 747     if (s->events_dropped) {
 748         virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
 749     }
 750 }
 751
 752 static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)
 753 {
 754     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
 755     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 756
 757     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_CHANGE) &&
 758         dev->type != TYPE_ROM) {
 759         virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_PARAM_CHANGE,
 760                                sense.asc | (sense.ascq << 8));
 761     }
 762 }
 763
 764 static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 765                                 Error **errp)
 766 {
 767     VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 768     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 769     SCSIDevice *sd = SCSI_DEVICE(dev);
 770
 771     if (s->ctx && !s->dataplane_disabled) {
 772         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
 773             return;
 774         }
 775         blk_op_block_all(sd->conf.blk, s->blocker);
 776         aio_context_acquire(s->ctx);
 777         blk_set_aio_context(sd->conf.blk, s->ctx);
 778         aio_context_release(s->ctx);
 779     }
 780
 781     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 782         virtio_scsi_push_event(s, sd,
 783                                VIRTIO_SCSI_T_TRANSPORT_RESET,
 784                                VIRTIO_SCSI_EVT_RESET_RESCAN);
 785     }
 786 }
 787
 788 static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 789                                   Error **errp)
 790 {
 791     VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
 792     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
 793     SCSIDevice *sd = SCSI_DEVICE(dev);
 794
 795     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
 796         virtio_scsi_push_event(s, sd,
 797                                VIRTIO_SCSI_T_TRANSPORT_RESET,
 798                                VIRTIO_SCSI_EVT_RESET_REMOVED);
 799     }
 800
 801     if (s->ctx) {
 802         blk_op_unblock_all(sd->conf.blk, s->blocker);
 803     }
 804     qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
 805 }
 806
 807 static struct SCSIBusInfo virtio_scsi_scsi_info = {
 808     .tcq = true,
 809     .max_channel = VIRTIO_SCSI_MAX_CHANNEL,
 810     .max_target = VIRTIO_SCSI_MAX_TARGET,
 811     .max_lun = VIRTIO_SCSI_MAX_LUN,
 812
 813     .complete = virtio_scsi_command_complete,
 814     .cancel = virtio_scsi_request_cancelled,
 815     .change = virtio_scsi_change,
 816     .parse_cdb = virtio_scsi_parse_cdb,
 817     .get_sg_list = virtio_scsi_get_sg_list,
 818     .save_request = virtio_scsi_save_request,
 819     .load_request = virtio_scsi_load_request,
 820 };
 821
 822 void virtio_scsi_common_realize(DeviceState *dev, Error **errp,
 823                                 HandleOutput ctrl, HandleOutput evt,
 824                                 HandleOutput cmd)
 825 {
 826     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 827     VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(dev);
 828     int i;
 829
 830     virtio_init(vdev, "virtio-scsi", VIRTIO_ID_SCSI,
 831                 sizeof(VirtIOSCSIConfig));
 832
 833     if (s->conf.num_queues == 0 ||
 834             s->conf.num_queues > VIRTIO_QUEUE_MAX - 2) {
 835         error_setg(errp, "Invalid number of queues (= %" PRIu32 "), "
 836                          "must be a positive integer less than %d.",
 837                    s->conf.num_queues, VIRTIO_QUEUE_MAX - 2);
 838         virtio_cleanup(vdev);
 839         return;
 840     }
 841     s->cmd_vqs = g_new0(VirtQueue *, s->conf.num_queues);
 842     s->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
 843     s->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
 844
 845     s->ctrl_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 846                                   ctrl);
 847     s->event_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 848                                    evt);
 849     for (i = 0; i < s->conf.num_queues; i++) {
 850         s->cmd_vqs[i] = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
 851                                          cmd);
 852     }
 853
 854     if (s->conf.iothread) {
 855         virtio_scsi_set_iothread(VIRTIO_SCSI(s), s->conf.iothread);
 856     }
 857 }
 858
 859 /* Disable dataplane thread during live migration since it does not
 860  * update the dirty memory bitmap yet.
 861  */
 862 static void virtio_scsi_migration_state_changed(Notifier *notifier, void *data)
 863 {
 864     VirtIOSCSI *s = container_of(notifier, VirtIOSCSI,
 865                                  migration_state_notifier);
 866     MigrationState *mig = data;
 867
 868     if (migration_in_setup(mig)) {
 869         if (!s->dataplane_started) {
 870             return;
 871         }
 872         virtio_scsi_dataplane_stop(s);
 873         s->dataplane_disabled = true;
 874     } else if (migration_has_finished(mig) ||
 875                migration_has_failed(mig)) {
 876         if (s->dataplane_started) {
 877             return;
 878         }
 879         blk_drain_all(); /* complete in-flight non-dataplane requests */
 880         s->dataplane_disabled = false;
 881     }
 882 }
 883
 884 static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
 885 {
 886     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 887     VirtIOSCSI *s = VIRTIO_SCSI(dev);
 888     static int virtio_scsi_id;
 889     Error *err = NULL;
 890
 891     virtio_scsi_common_realize(dev, &err, virtio_scsi_handle_ctrl,
 892                                virtio_scsi_handle_event,
 893                                virtio_scsi_handle_cmd);
 894     if (err != NULL) {
 895         error_propagate(errp, err);
 896         return;
 897     }
 898
 899     scsi_bus_new(&s->bus, sizeof(s->bus), dev,
 900                  &virtio_scsi_scsi_info, vdev->bus_name);
 901     /* override default SCSI bus hotplug-handler, with virtio-scsi's one */
 902     qbus_set_hotplug_handler(BUS(&s->bus), dev, &error_abort);
 903
 904     if (!dev->hotplugged) {
 905         scsi_bus_legacy_handle_cmdline(&s->bus, &err);
 906         if (err != NULL) {
 907             error_propagate(errp, err);
 908             return;
 909         }
 910     }
 911
 912     register_savevm(dev, "virtio-scsi", virtio_scsi_id++, 1,
 913                     virtio_scsi_save, virtio_scsi_load, s);
 914     s->migration_state_notifier.notify = virtio_scsi_migration_state_changed;
 915     add_migration_state_change_notifier(&s->migration_state_notifier);
 916
 917     error_setg(&s->blocker, "block device is in use by data plane");
 918 }
 919
 920 static void virtio_scsi_instance_init(Object *obj)
 921 {
 922     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(obj);
 923
 924     object_property_add_link(obj, "iothread", TYPE_IOTHREAD,
 925                              (Object **)&vs->conf.iothread,
 926                              qdev_prop_allow_set_link_before_realize,
 927                              OBJ_PROP_LINK_UNREF_ON_RELEASE, &error_abort);
 928 }
 929
 930 void virtio_scsi_common_unrealize(DeviceState *dev, Error **errp)
 931 {
 932     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 933     VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(dev);
 934
 935     g_free(vs->cmd_vqs);
 936     virtio_cleanup(vdev);
 937 }
 938
 939 static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp)
 940 {
 941     VirtIOSCSI *s = VIRTIO_SCSI(dev);
 942
 943     error_free(s->blocker);
 944
 945     unregister_savevm(dev, "virtio-scsi", s);
 946     remove_migration_state_change_notifier(&s->migration_state_notifier);
 947
 948     virtio_scsi_common_unrealize(dev, errp);
 949 }
 950
 951 static Property virtio_scsi_properties[] = {
 952     DEFINE_PROP_UINT32("num_queues", VirtIOSCSI, parent_obj.conf.num_queues, 1),
 953     DEFINE_PROP_UINT32("max_sectors", VirtIOSCSI, parent_obj.conf.max_sectors,
 954                                                   0xFFFF),
 955     DEFINE_PROP_UINT32("cmd_per_lun", VirtIOSCSI, parent_obj.conf.cmd_per_lun,
 956                                                   128),
 957     DEFINE_PROP_BIT("hotplug", VirtIOSCSI, host_features,
 958                                            VIRTIO_SCSI_F_HOTPLUG, true),
 959     DEFINE_PROP_BIT("param_change", VirtIOSCSI, host_features,
 960                                                 VIRTIO_SCSI_F_CHANGE, true),
 961     DEFINE_PROP_END_OF_LIST(),
 962 };
 963
 964 static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
 965 {
 966     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 967     DeviceClass *dc = DEVICE_CLASS(klass);
 968
 969     vdc->get_config = virtio_scsi_get_config;
 970     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 971 }
 972
 973 static void virtio_scsi_class_init(ObjectClass *klass, void *data)
 974 {
 975     DeviceClass *dc = DEVICE_CLASS(klass);
 976     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 977     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
 978
 979     dc->props = virtio_scsi_properties;
 980     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 981     vdc->realize = virtio_scsi_device_realize;
 982     vdc->unrealize = virtio_scsi_device_unrealize;
 983     vdc->set_config = virtio_scsi_set_config;
 984     vdc->get_features = virtio_scsi_get_features;
 985     vdc->reset = virtio_scsi_reset;
 986     hc->plug = virtio_scsi_hotplug;
 987     hc->unplug = virtio_scsi_hotunplug;
 988 }
 989
 990 static const TypeInfo virtio_scsi_common_info = {
 991     .name = TYPE_VIRTIO_SCSI_COMMON,
 992     .parent = TYPE_VIRTIO_DEVICE,
 993     .instance_size = sizeof(VirtIOSCSICommon),
 994     .abstract = true,
 995     .class_init = virtio_scsi_common_class_init,
 996 };
 997
 998 static const TypeInfo virtio_scsi_info = {
 999     .name = TYPE_VIRTIO_SCSI,
1000     .parent = TYPE_VIRTIO_SCSI_COMMON,
1001     .instance_size = sizeof(VirtIOSCSI),
1002     .instance_init = virtio_scsi_instance_init,
1003     .class_init = virtio_scsi_class_init,
1004     .interfaces = (InterfaceInfo[]) {
1005         { TYPE_HOTPLUG_HANDLER },
1006         { }
1007     }
1008 };
1009
1010 static void virtio_register_types(void)
1011 {
1012     type_register_static(&virtio_scsi_common_info);
1013     type_register_static(&virtio_scsi_info);
1014 }
1015
1016 type_init(virtio_register_types)