hw/scsi/vmw_pvscsi.c

   1 /*
   2  * QEMU VMWARE PVSCSI paravirtual SCSI bus
   3  *
   4  * Copyright (c) 2012 Ravello Systems LTD (http://ravellosystems.com)
   5  *
   6  * Developed by Daynix Computing LTD (http://www.daynix.com)
   7  *
   8  * Based on implementation by Paolo Bonzini
   9  * http://lists.gnu.org/archive/html/qemu-devel/2011-08/msg00729.html
  10  *
  11  * Authors:
  12  * Paolo Bonzini <pbonzini@redhat.com>
  13  * Dmitry Fleytman <dmitry@daynix.com>
  14  * Yan Vugenfirer <yan@daynix.com>
  15  *
  16  * This work is licensed under the terms of the GNU GPL, version 2.
  17  * See the COPYING file in the top-level directory.
  18  *
  19  * NOTE about MSI-X:
  20  * MSI-X support has been removed for the moment because it leads Windows OS
  21  * to crash on startup. The crash happens because Windows driver requires
  22  * MSI-X shared memory to be part of the same BAR used for rings state
  23  * registers, etc. This is not supported by QEMU infrastructure so separate
  24  * BAR created from MSI-X purposes. Windows driver fails to deal with 2 BARs.
  25  *
  26  */
  27
  28 #include "hw/scsi/scsi.h"
  29 #include <block/scsi.h>
  30 #include "hw/pci/msi.h"
  31 #include "vmw_pvscsi.h"
  32 #include "trace.h"
  33
  34
  35 #define PVSCSI_MSI_OFFSET        (0x50)
  36 #define PVSCSI_USE_64BIT         (true)
  37 #define PVSCSI_PER_VECTOR_MASK   (false)
  38
  39 #define PVSCSI_MAX_DEVS                   (64)
  40 #define PVSCSI_MSIX_NUM_VECTORS           (1)
  41
  42 #define PVSCSI_MAX_CMD_DATA_WORDS \
  43     (sizeof(PVSCSICmdDescSetupRings)/sizeof(uint32_t))
  44
  45 #define RS_GET_FIELD(rs_pa, field) \
  46     (ldl_le_phys(&address_space_memory, \
  47                  rs_pa + offsetof(struct PVSCSIRingsState, field)))
  48 #define RS_SET_FIELD(rs_pa, field, val) \
  49     (stl_le_phys(&address_space_memory, \
  50                  rs_pa + offsetof(struct PVSCSIRingsState, field), val))
  51
  52 #define TYPE_PVSCSI "pvscsi"
  53 #define PVSCSI(obj) OBJECT_CHECK(PVSCSIState, (obj), TYPE_PVSCSI)
  54
  55 typedef struct PVSCSIRingInfo {
  56     uint64_t            rs_pa;
  57     uint32_t            txr_len_mask;
  58     uint32_t            rxr_len_mask;
  59     uint32_t            msg_len_mask;
  60     uint64_t            req_ring_pages_pa[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
  61     uint64_t            cmp_ring_pages_pa[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
  62     uint64_t            msg_ring_pages_pa[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
  63     uint64_t            consumed_ptr;
  64     uint64_t            filled_cmp_ptr;
  65     uint64_t            filled_msg_ptr;
  66 } PVSCSIRingInfo;
  67
  68 typedef struct PVSCSISGState {
  69     hwaddr elemAddr;
  70     hwaddr dataAddr;
  71     uint32_t resid;
  72 } PVSCSISGState;
  73
  74 typedef QTAILQ_HEAD(, PVSCSIRequest) PVSCSIRequestList;
  75
  76 typedef struct {
  77     PCIDevice parent_obj;
  78     MemoryRegion io_space;
  79     SCSIBus bus;
  80     QEMUBH *completion_worker;
  81     PVSCSIRequestList pending_queue;
  82     PVSCSIRequestList completion_queue;
  83
  84     uint64_t reg_interrupt_status;        /* Interrupt status register value */
  85     uint64_t reg_interrupt_enabled;       /* Interrupt mask register value   */
  86     uint64_t reg_command_status;          /* Command status register value   */
  87
  88     /* Command data adoption mechanism */
  89     uint64_t curr_cmd;                   /* Last command arrived             */
  90     uint32_t curr_cmd_data_cntr;         /* Amount of data for last command  */
  91
  92     /* Collector for current command data */
  93     uint32_t curr_cmd_data[PVSCSI_MAX_CMD_DATA_WORDS];
  94
  95     uint8_t rings_info_valid;            /* Whether data rings initialized   */
  96     uint8_t msg_ring_info_valid;         /* Whether message ring initialized */
  97     uint8_t use_msg;                     /* Whether to use message ring      */
  98
  99     uint8_t msi_used;    /* Whether MSI support was installed successfully   */
 100
 101     PVSCSIRingInfo rings;                /* Data transfer rings manager      */
 102     uint32_t resetting;                  /* Reset in progress                */
 103 } PVSCSIState;
 104
 105 typedef struct PVSCSIRequest {
 106     SCSIRequest *sreq;
 107     PVSCSIState *dev;
 108     uint8_t sense_key;
 109     uint8_t completed;
 110     int lun;
 111     QEMUSGList sgl;
 112     PVSCSISGState sg;
 113     struct PVSCSIRingReqDesc req;
 114     struct PVSCSIRingCmpDesc cmp;
 115     QTAILQ_ENTRY(PVSCSIRequest) next;
 116 } PVSCSIRequest;
 117
 118 /* Integer binary logarithm */
 119 static int
 120 pvscsi_log2(uint32_t input)
 121 {
 122     int log = 0;
 123     assert(input > 0);
 124     while (input >> ++log) {
 125     }
 126     return log;
 127 }
 128
 129 static void
 130 pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
 131 {
 132     int i;
 133     uint32_t txr_len_log2, rxr_len_log2;
 134     uint32_t req_ring_size, cmp_ring_size;
 135     m->rs_pa = ri->ringsStatePPN << VMW_PAGE_SHIFT;
 136
 137     req_ring_size = ri->reqRingNumPages * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
 138     cmp_ring_size = ri->cmpRingNumPages * PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
 139     txr_len_log2 = pvscsi_log2(req_ring_size - 1);
 140     rxr_len_log2 = pvscsi_log2(cmp_ring_size - 1);
 141
 142     m->txr_len_mask = MASK(txr_len_log2);
 143     m->rxr_len_mask = MASK(rxr_len_log2);
 144
 145     m->consumed_ptr = 0;
 146     m->filled_cmp_ptr = 0;
 147
 148     for (i = 0; i < ri->reqRingNumPages; i++) {
 149         m->req_ring_pages_pa[i] = ri->reqRingPPNs[i] << VMW_PAGE_SHIFT;
 150     }
 151
 152     for (i = 0; i < ri->cmpRingNumPages; i++) {
 153         m->cmp_ring_pages_pa[i] = ri->cmpRingPPNs[i] << VMW_PAGE_SHIFT;
 154     }
 155
 156     RS_SET_FIELD(m->rs_pa, reqProdIdx, 0);
 157     RS_SET_FIELD(m->rs_pa, reqConsIdx, 0);
 158     RS_SET_FIELD(m->rs_pa, reqNumEntriesLog2, txr_len_log2);
 159
 160     RS_SET_FIELD(m->rs_pa, cmpProdIdx, 0);
 161     RS_SET_FIELD(m->rs_pa, cmpConsIdx, 0);
 162     RS_SET_FIELD(m->rs_pa, cmpNumEntriesLog2, rxr_len_log2);
 163
 164     trace_pvscsi_ring_init_data(txr_len_log2, rxr_len_log2);
 165
 166     /* Flush ring state page changes */
 167     smp_wmb();
 168 }
 169
 170 static void
 171 pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
 172 {
 173     int i;
 174     uint32_t len_log2;
 175     uint32_t ring_size;
 176
 177     ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
 178     len_log2 = pvscsi_log2(ring_size - 1);
 179
 180     m->msg_len_mask = MASK(len_log2);
 181
 182     m->filled_msg_ptr = 0;
 183
 184     for (i = 0; i < ri->numPages; i++) {
 185         m->msg_ring_pages_pa[i] = ri->ringPPNs[i] << VMW_PAGE_SHIFT;
 186     }
 187
 188     RS_SET_FIELD(m->rs_pa, msgProdIdx, 0);
 189     RS_SET_FIELD(m->rs_pa, msgConsIdx, 0);
 190     RS_SET_FIELD(m->rs_pa, msgNumEntriesLog2, len_log2);
 191
 192     trace_pvscsi_ring_init_msg(len_log2);
 193
 194     /* Flush ring state page changes */
 195     smp_wmb();
 196 }
 197
 198 static void
 199 pvscsi_ring_cleanup(PVSCSIRingInfo *mgr)
 200 {
 201     mgr->rs_pa = 0;
 202     mgr->txr_len_mask = 0;
 203     mgr->rxr_len_mask = 0;
 204     mgr->msg_len_mask = 0;
 205     mgr->consumed_ptr = 0;
 206     mgr->filled_cmp_ptr = 0;
 207     mgr->filled_msg_ptr = 0;
 208     memset(mgr->req_ring_pages_pa, 0, sizeof(mgr->req_ring_pages_pa));
 209     memset(mgr->cmp_ring_pages_pa, 0, sizeof(mgr->cmp_ring_pages_pa));
 210     memset(mgr->msg_ring_pages_pa, 0, sizeof(mgr->msg_ring_pages_pa));
 211 }
 212
 213 static hwaddr
 214 pvscsi_ring_pop_req_descr(PVSCSIRingInfo *mgr)
 215 {
 216     uint32_t ready_ptr = RS_GET_FIELD(mgr->rs_pa, reqProdIdx);
 217
 218     if (ready_ptr != mgr->consumed_ptr) {
 219         uint32_t next_ready_ptr =
 220             mgr->consumed_ptr++ & mgr->txr_len_mask;
 221         uint32_t next_ready_page =
 222             next_ready_ptr / PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
 223         uint32_t inpage_idx =
 224             next_ready_ptr % PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
 225
 226         return mgr->req_ring_pages_pa[next_ready_page] +
 227                inpage_idx * sizeof(PVSCSIRingReqDesc);
 228     } else {
 229         return 0;
 230     }
 231 }
 232
 233 static void
 234 pvscsi_ring_flush_req(PVSCSIRingInfo *mgr)
 235 {
 236     RS_SET_FIELD(mgr->rs_pa, reqConsIdx, mgr->consumed_ptr);
 237 }
 238
 239 static hwaddr
 240 pvscsi_ring_pop_cmp_descr(PVSCSIRingInfo *mgr)
 241 {
 242     /*
 243      * According to Linux driver code it explicitly verifies that number
 244      * of requests being processed by device is less then the size of
 245      * completion queue, so device may omit completion queue overflow
 246      * conditions check. We assume that this is true for other (Windows)
 247      * drivers as well.
 248      */
 249
 250     uint32_t free_cmp_ptr =
 251         mgr->filled_cmp_ptr++ & mgr->rxr_len_mask;
 252     uint32_t free_cmp_page =
 253         free_cmp_ptr / PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
 254     uint32_t inpage_idx =
 255         free_cmp_ptr % PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
 256     return mgr->cmp_ring_pages_pa[free_cmp_page] +
 257            inpage_idx * sizeof(PVSCSIRingCmpDesc);
 258 }
 259
 260 static hwaddr
 261 pvscsi_ring_pop_msg_descr(PVSCSIRingInfo *mgr)
 262 {
 263     uint32_t free_msg_ptr =
 264         mgr->filled_msg_ptr++ & mgr->msg_len_mask;
 265     uint32_t free_msg_page =
 266         free_msg_ptr / PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
 267     uint32_t inpage_idx =
 268         free_msg_ptr % PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
 269     return mgr->msg_ring_pages_pa[free_msg_page] +
 270            inpage_idx * sizeof(PVSCSIRingMsgDesc);
 271 }
 272
 273 static void
 274 pvscsi_ring_flush_cmp(PVSCSIRingInfo *mgr)
 275 {
 276     /* Flush descriptor changes */
 277     smp_wmb();
 278
 279     trace_pvscsi_ring_flush_cmp(mgr->filled_cmp_ptr);
 280
 281     RS_SET_FIELD(mgr->rs_pa, cmpProdIdx, mgr->filled_cmp_ptr);
 282 }
 283
 284 static bool
 285 pvscsi_ring_msg_has_room(PVSCSIRingInfo *mgr)
 286 {
 287     uint32_t prodIdx = RS_GET_FIELD(mgr->rs_pa, msgProdIdx);
 288     uint32_t consIdx = RS_GET_FIELD(mgr->rs_pa, msgConsIdx);
 289
 290     return (prodIdx - consIdx) < (mgr->msg_len_mask + 1);
 291 }
 292
 293 static void
 294 pvscsi_ring_flush_msg(PVSCSIRingInfo *mgr)
 295 {
 296     /* Flush descriptor changes */
 297     smp_wmb();
 298
 299     trace_pvscsi_ring_flush_msg(mgr->filled_msg_ptr);
 300
 301     RS_SET_FIELD(mgr->rs_pa, msgProdIdx, mgr->filled_msg_ptr);
 302 }
 303
 304 static void
 305 pvscsi_reset_state(PVSCSIState *s)
 306 {
 307     s->curr_cmd = PVSCSI_CMD_FIRST;
 308     s->curr_cmd_data_cntr = 0;
 309     s->reg_command_status = PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 310     s->reg_interrupt_status = 0;
 311     pvscsi_ring_cleanup(&s->rings);
 312     s->rings_info_valid = FALSE;
 313     s->msg_ring_info_valid = FALSE;
 314     QTAILQ_INIT(&s->pending_queue);
 315     QTAILQ_INIT(&s->completion_queue);
 316 }
 317
 318 static void
 319 pvscsi_update_irq_status(PVSCSIState *s)
 320 {
 321     PCIDevice *d = PCI_DEVICE(s);
 322     bool should_raise = s->reg_interrupt_enabled & s->reg_interrupt_status;
 323
 324     trace_pvscsi_update_irq_level(should_raise, s->reg_interrupt_enabled,
 325                                   s->reg_interrupt_status);
 326
 327     if (s->msi_used && msi_enabled(d)) {
 328         if (should_raise) {
 329             trace_pvscsi_update_irq_msi();
 330             msi_notify(d, PVSCSI_VECTOR_COMPLETION);
 331         }
 332         return;
 333     }
 334
 335     pci_set_irq(d, !!should_raise);
 336 }
 337
 338 static void
 339 pvscsi_raise_completion_interrupt(PVSCSIState *s)
 340 {
 341     s->reg_interrupt_status |= PVSCSI_INTR_CMPL_0;
 342
 343     /* Memory barrier to flush interrupt status register changes*/
 344     smp_wmb();
 345
 346     pvscsi_update_irq_status(s);
 347 }
 348
 349 static void
 350 pvscsi_raise_message_interrupt(PVSCSIState *s)
 351 {
 352     s->reg_interrupt_status |= PVSCSI_INTR_MSG_0;
 353
 354     /* Memory barrier to flush interrupt status register changes*/
 355     smp_wmb();
 356
 357     pvscsi_update_irq_status(s);
 358 }
 359
 360 static void
 361 pvscsi_cmp_ring_put(PVSCSIState *s, struct PVSCSIRingCmpDesc *cmp_desc)
 362 {
 363     hwaddr cmp_descr_pa;
 364
 365     cmp_descr_pa = pvscsi_ring_pop_cmp_descr(&s->rings);
 366     trace_pvscsi_cmp_ring_put(cmp_descr_pa);
 367     cpu_physical_memory_write(cmp_descr_pa, (void *)cmp_desc,
 368                               sizeof(*cmp_desc));
 369 }
 370
 371 static void
 372 pvscsi_msg_ring_put(PVSCSIState *s, struct PVSCSIRingMsgDesc *msg_desc)
 373 {
 374     hwaddr msg_descr_pa;
 375
 376     msg_descr_pa = pvscsi_ring_pop_msg_descr(&s->rings);
 377     trace_pvscsi_msg_ring_put(msg_descr_pa);
 378     cpu_physical_memory_write(msg_descr_pa, (void *)msg_desc,
 379                               sizeof(*msg_desc));
 380 }
 381
 382 static void
 383 pvscsi_process_completion_queue(void *opaque)
 384 {
 385     PVSCSIState *s = opaque;
 386     PVSCSIRequest *pvscsi_req;
 387     bool has_completed = false;
 388
 389     while (!QTAILQ_EMPTY(&s->completion_queue)) {
 390         pvscsi_req = QTAILQ_FIRST(&s->completion_queue);
 391         QTAILQ_REMOVE(&s->completion_queue, pvscsi_req, next);
 392         pvscsi_cmp_ring_put(s, &pvscsi_req->cmp);
 393         g_free(pvscsi_req);
 394         has_completed = true;
 395     }
 396
 397     if (has_completed) {
 398         pvscsi_ring_flush_cmp(&s->rings);
 399         pvscsi_raise_completion_interrupt(s);
 400     }
 401 }
 402
 403 static void
 404 pvscsi_reset_adapter(PVSCSIState *s)
 405 {
 406     s->resetting++;
 407     qbus_reset_all_fn(&s->bus);
 408     s->resetting--;
 409     pvscsi_process_completion_queue(s);
 410     assert(QTAILQ_EMPTY(&s->pending_queue));
 411     pvscsi_reset_state(s);
 412 }
 413
 414 static void
 415 pvscsi_schedule_completion_processing(PVSCSIState *s)
 416 {
 417     /* Try putting more complete requests on the ring. */
 418     if (!QTAILQ_EMPTY(&s->completion_queue)) {
 419         qemu_bh_schedule(s->completion_worker);
 420     }
 421 }
 422
 423 static void
 424 pvscsi_complete_request(PVSCSIState *s, PVSCSIRequest *r)
 425 {
 426     assert(!r->completed);
 427
 428     trace_pvscsi_complete_request(r->cmp.context, r->cmp.dataLen,
 429                                   r->sense_key);
 430     if (r->sreq != NULL) {
 431         scsi_req_unref(r->sreq);
 432         r->sreq = NULL;
 433     }
 434     r->completed = 1;
 435     QTAILQ_REMOVE(&s->pending_queue, r, next);
 436     QTAILQ_INSERT_TAIL(&s->completion_queue, r, next);
 437     pvscsi_schedule_completion_processing(s);
 438 }
 439
 440 static QEMUSGList *pvscsi_get_sg_list(SCSIRequest *r)
 441 {
 442     PVSCSIRequest *req = r->hba_private;
 443
 444     trace_pvscsi_get_sg_list(req->sgl.nsg, req->sgl.size);
 445
 446     return &req->sgl;
 447 }
 448
 449 static void
 450 pvscsi_get_next_sg_elem(PVSCSISGState *sg)
 451 {
 452     struct PVSCSISGElement elem;
 453
 454     cpu_physical_memory_read(sg->elemAddr, (void *)&elem, sizeof(elem));
 455     if ((elem.flags & ~PVSCSI_KNOWN_FLAGS) != 0) {
 456         /*
 457             * There is PVSCSI_SGE_FLAG_CHAIN_ELEMENT flag described in
 458             * header file but its value is unknown. This flag requires
 459             * additional processing, so we put warning here to catch it
 460             * some day and make proper implementation
 461             */
 462         trace_pvscsi_get_next_sg_elem(elem.flags);
 463     }
 464
 465     sg->elemAddr += sizeof(elem);
 466     sg->dataAddr = elem.addr;
 467     sg->resid = elem.length;
 468 }
 469
 470 static void
 471 pvscsi_write_sense(PVSCSIRequest *r, uint8_t *sense, int len)
 472 {
 473     r->cmp.senseLen = MIN(r->req.senseLen, len);
 474     r->sense_key = sense[(sense[0] & 2) ? 1 : 2];
 475     cpu_physical_memory_write(r->req.senseAddr, sense, r->cmp.senseLen);
 476 }
 477
 478 static void
 479 pvscsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
 480 {
 481     PVSCSIRequest *pvscsi_req = req->hba_private;
 482     PVSCSIState *s = pvscsi_req->dev;
 483
 484     if (!pvscsi_req) {
 485         trace_pvscsi_command_complete_not_found(req->tag);
 486         return;
 487     }
 488
 489     if (resid) {
 490         /* Short transfer.  */
 491         trace_pvscsi_command_complete_data_run();
 492         pvscsi_req->cmp.hostStatus = BTSTAT_DATARUN;
 493     }
 494
 495     pvscsi_req->cmp.scsiStatus = status;
 496     if (pvscsi_req->cmp.scsiStatus == CHECK_CONDITION) {
 497         uint8_t sense[SCSI_SENSE_BUF_SIZE];
 498         int sense_len =
 499             scsi_req_get_sense(pvscsi_req->sreq, sense, sizeof(sense));
 500
 501         trace_pvscsi_command_complete_sense_len(sense_len);
 502         pvscsi_write_sense(pvscsi_req, sense, sense_len);
 503     }
 504     qemu_sglist_destroy(&pvscsi_req->sgl);
 505     pvscsi_complete_request(s, pvscsi_req);
 506 }
 507
 508 static void
 509 pvscsi_send_msg(PVSCSIState *s, SCSIDevice *dev, uint32_t msg_type)
 510 {
 511     if (s->msg_ring_info_valid && pvscsi_ring_msg_has_room(&s->rings)) {
 512         PVSCSIMsgDescDevStatusChanged msg = {0};
 513
 514         msg.type = msg_type;
 515         msg.bus = dev->channel;
 516         msg.target = dev->id;
 517         msg.lun[1] = dev->lun;
 518
 519         pvscsi_msg_ring_put(s, (PVSCSIRingMsgDesc *)&msg);
 520         pvscsi_ring_flush_msg(&s->rings);
 521         pvscsi_raise_message_interrupt(s);
 522     }
 523 }
 524
 525 static void
 526 pvscsi_hotplug(SCSIBus *bus, SCSIDevice *dev)
 527 {
 528     PVSCSIState *s = container_of(bus, PVSCSIState, bus);
 529     pvscsi_send_msg(s, dev, PVSCSI_MSG_DEV_ADDED);
 530 }
 531
 532 static void
 533 pvscsi_hot_unplug(SCSIBus *bus, SCSIDevice *dev)
 534 {
 535     PVSCSIState *s = container_of(bus, PVSCSIState, bus);
 536     pvscsi_send_msg(s, dev, PVSCSI_MSG_DEV_REMOVED);
 537 }
 538
 539 static void
 540 pvscsi_request_cancelled(SCSIRequest *req)
 541 {
 542     PVSCSIRequest *pvscsi_req = req->hba_private;
 543     PVSCSIState *s = pvscsi_req->dev;
 544
 545     if (pvscsi_req->completed) {
 546         return;
 547     }
 548
 549    if (pvscsi_req->dev->resetting) {
 550        pvscsi_req->cmp.hostStatus = BTSTAT_BUSRESET;
 551     } else {
 552        pvscsi_req->cmp.hostStatus = BTSTAT_ABORTQUEUE;
 553     }
 554
 555     pvscsi_complete_request(s, pvscsi_req);
 556 }
 557
 558 static SCSIDevice*
 559 pvscsi_device_find(PVSCSIState *s, int channel, int target,
 560                    uint8_t *requested_lun, uint8_t *target_lun)
 561 {
 562     if (requested_lun[0] || requested_lun[2] || requested_lun[3] ||
 563         requested_lun[4] || requested_lun[5] || requested_lun[6] ||
 564         requested_lun[7] || (target > PVSCSI_MAX_DEVS)) {
 565         return NULL;
 566     } else {
 567         *target_lun = requested_lun[1];
 568         return scsi_device_find(&s->bus, channel, target, *target_lun);
 569     }
 570 }
 571
 572 static PVSCSIRequest *
 573 pvscsi_queue_pending_descriptor(PVSCSIState *s, SCSIDevice **d,
 574                                 struct PVSCSIRingReqDesc *descr)
 575 {
 576     PVSCSIRequest *pvscsi_req;
 577     uint8_t lun;
 578
 579     pvscsi_req = g_malloc0(sizeof(*pvscsi_req));
 580     pvscsi_req->dev = s;
 581     pvscsi_req->req = *descr;
 582     pvscsi_req->cmp.context = pvscsi_req->req.context;
 583     QTAILQ_INSERT_TAIL(&s->pending_queue, pvscsi_req, next);
 584
 585     *d = pvscsi_device_find(s, descr->bus, descr->target, descr->lun, &lun);
 586     if (*d) {
 587         pvscsi_req->lun = lun;
 588     }
 589
 590     return pvscsi_req;
 591 }
 592
 593 static void
 594 pvscsi_convert_sglist(PVSCSIRequest *r)
 595 {
 596     int chunk_size;
 597     uint64_t data_length = r->req.dataLen;
 598     PVSCSISGState sg = r->sg;
 599     while (data_length) {
 600         while (!sg.resid) {
 601             pvscsi_get_next_sg_elem(&sg);
 602             trace_pvscsi_convert_sglist(r->req.context, r->sg.dataAddr,
 603                                         r->sg.resid);
 604         }
 605         assert(data_length > 0);
 606         chunk_size = MIN((unsigned) data_length, sg.resid);
 607         if (chunk_size) {
 608             qemu_sglist_add(&r->sgl, sg.dataAddr, chunk_size);
 609         }
 610
 611         sg.dataAddr += chunk_size;
 612         data_length -= chunk_size;
 613         sg.resid -= chunk_size;
 614     }
 615 }
 616
 617 static void
 618 pvscsi_build_sglist(PVSCSIState *s, PVSCSIRequest *r)
 619 {
 620     PCIDevice *d = PCI_DEVICE(s);
 621
 622     pci_dma_sglist_init(&r->sgl, d, 1);
 623     if (r->req.flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
 624         pvscsi_convert_sglist(r);
 625     } else {
 626         qemu_sglist_add(&r->sgl, r->req.dataAddr, r->req.dataLen);
 627     }
 628 }
 629
 630 static void
 631 pvscsi_process_request_descriptor(PVSCSIState *s,
 632                                   struct PVSCSIRingReqDesc *descr)
 633 {
 634     SCSIDevice *d;
 635     PVSCSIRequest *r = pvscsi_queue_pending_descriptor(s, &d, descr);
 636     int64_t n;
 637
 638     trace_pvscsi_process_req_descr(descr->cdb[0], descr->context);
 639
 640     if (!d) {
 641         r->cmp.hostStatus = BTSTAT_SELTIMEO;
 642         trace_pvscsi_process_req_descr_unknown_device();
 643         pvscsi_complete_request(s, r);
 644         return;
 645     }
 646
 647     if (descr->flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
 648         r->sg.elemAddr = descr->dataAddr;
 649     }
 650
 651     r->sreq = scsi_req_new(d, descr->context, r->lun, descr->cdb, r);
 652     if (r->sreq->cmd.mode == SCSI_XFER_FROM_DEV &&
 653         (descr->flags & PVSCSI_FLAG_CMD_DIR_TODEVICE)) {
 654         r->cmp.hostStatus = BTSTAT_BADMSG;
 655         trace_pvscsi_process_req_descr_invalid_dir();
 656         scsi_req_cancel(r->sreq);
 657         return;
 658     }
 659     if (r->sreq->cmd.mode == SCSI_XFER_TO_DEV &&
 660         (descr->flags & PVSCSI_FLAG_CMD_DIR_TOHOST)) {
 661         r->cmp.hostStatus = BTSTAT_BADMSG;
 662         trace_pvscsi_process_req_descr_invalid_dir();
 663         scsi_req_cancel(r->sreq);
 664         return;
 665     }
 666
 667     pvscsi_build_sglist(s, r);
 668     n = scsi_req_enqueue(r->sreq);
 669
 670     if (n) {
 671         scsi_req_continue(r->sreq);
 672     }
 673 }
 674
 675 static void
 676 pvscsi_process_io(PVSCSIState *s)
 677 {
 678     PVSCSIRingReqDesc descr;
 679     hwaddr next_descr_pa;
 680
 681     assert(s->rings_info_valid);
 682     while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
 683
 684         /* Only read after production index verification */
 685         smp_rmb();
 686
 687         trace_pvscsi_process_io(next_descr_pa);
 688         cpu_physical_memory_read(next_descr_pa, &descr, sizeof(descr));
 689         pvscsi_process_request_descriptor(s, &descr);
 690     }
 691
 692     pvscsi_ring_flush_req(&s->rings);
 693 }
 694
 695 static void
 696 pvscsi_dbg_dump_tx_rings_config(PVSCSICmdDescSetupRings *rc)
 697 {
 698     int i;
 699     trace_pvscsi_tx_rings_ppn("Rings State", rc->ringsStatePPN);
 700
 701     trace_pvscsi_tx_rings_num_pages("Request Ring", rc->reqRingNumPages);
 702     for (i = 0; i < rc->reqRingNumPages; i++) {
 703         trace_pvscsi_tx_rings_ppn("Request Ring", rc->reqRingPPNs[i]);
 704     }
 705
 706     trace_pvscsi_tx_rings_num_pages("Confirm Ring", rc->cmpRingNumPages);
 707     for (i = 0; i < rc->cmpRingNumPages; i++) {
 708         trace_pvscsi_tx_rings_ppn("Confirm Ring", rc->reqRingPPNs[i]);
 709     }
 710 }
 711
 712 static uint64_t
 713 pvscsi_on_cmd_config(PVSCSIState *s)
 714 {
 715     trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_CONFIG");
 716     return PVSCSI_COMMAND_PROCESSING_FAILED;
 717 }
 718
 719 static uint64_t
 720 pvscsi_on_cmd_unplug(PVSCSIState *s)
 721 {
 722     trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_DEVICE_UNPLUG");
 723     return PVSCSI_COMMAND_PROCESSING_FAILED;
 724 }
 725
 726 static uint64_t
 727 pvscsi_on_issue_scsi(PVSCSIState *s)
 728 {
 729     trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_ISSUE_SCSI");
 730     return PVSCSI_COMMAND_PROCESSING_FAILED;
 731 }
 732
 733 static uint64_t
 734 pvscsi_on_cmd_setup_rings(PVSCSIState *s)
 735 {
 736     PVSCSICmdDescSetupRings *rc =
 737         (PVSCSICmdDescSetupRings *) s->curr_cmd_data;
 738
 739     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_RINGS");
 740
 741     pvscsi_dbg_dump_tx_rings_config(rc);
 742     pvscsi_ring_init_data(&s->rings, rc);
 743     s->rings_info_valid = TRUE;
 744     return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 745 }
 746
 747 static uint64_t
 748 pvscsi_on_cmd_abort(PVSCSIState *s)
 749 {
 750     PVSCSICmdDescAbortCmd *cmd = (PVSCSICmdDescAbortCmd *) s->curr_cmd_data;
 751     PVSCSIRequest *r, *next;
 752
 753     trace_pvscsi_on_cmd_abort(cmd->context, cmd->target);
 754
 755     QTAILQ_FOREACH_SAFE(r, &s->pending_queue, next, next) {
 756         if (r->req.context == cmd->context) {
 757             break;
 758         }
 759     }
 760     if (r) {
 761         assert(!r->completed);
 762         r->cmp.hostStatus = BTSTAT_ABORTQUEUE;
 763         scsi_req_cancel(r->sreq);
 764     }
 765
 766     return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 767 }
 768
 769 static uint64_t
 770 pvscsi_on_cmd_unknown(PVSCSIState *s)
 771 {
 772     trace_pvscsi_on_cmd_unknown_data(s->curr_cmd_data[0]);
 773     return PVSCSI_COMMAND_PROCESSING_FAILED;
 774 }
 775
 776 static uint64_t
 777 pvscsi_on_cmd_reset_device(PVSCSIState *s)
 778 {
 779     uint8_t target_lun = 0;
 780     struct PVSCSICmdDescResetDevice *cmd =
 781         (struct PVSCSICmdDescResetDevice *) s->curr_cmd_data;
 782     SCSIDevice *sdev;
 783
 784     sdev = pvscsi_device_find(s, 0, cmd->target, cmd->lun, &target_lun);
 785
 786     trace_pvscsi_on_cmd_reset_dev(cmd->target, (int) target_lun, sdev);
 787
 788     if (sdev != NULL) {
 789         s->resetting++;
 790         device_reset(&sdev->qdev);
 791         s->resetting--;
 792         return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 793     }
 794
 795     return PVSCSI_COMMAND_PROCESSING_FAILED;
 796 }
 797
 798 static uint64_t
 799 pvscsi_on_cmd_reset_bus(PVSCSIState *s)
 800 {
 801     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_RESET_BUS");
 802
 803     s->resetting++;
 804     qbus_reset_all_fn(&s->bus);
 805     s->resetting--;
 806     return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 807 }
 808
 809 static uint64_t
 810 pvscsi_on_cmd_setup_msg_ring(PVSCSIState *s)
 811 {
 812     PVSCSICmdDescSetupMsgRing *rc =
 813         (PVSCSICmdDescSetupMsgRing *) s->curr_cmd_data;
 814
 815     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_MSG_RING");
 816
 817     if (!s->use_msg) {
 818         return PVSCSI_COMMAND_PROCESSING_FAILED;
 819     }
 820
 821     if (s->rings_info_valid) {
 822         pvscsi_ring_init_msg(&s->rings, rc);
 823         s->msg_ring_info_valid = TRUE;
 824     }
 825     return sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(uint32_t);
 826 }
 827
 828 static uint64_t
 829 pvscsi_on_cmd_adapter_reset(PVSCSIState *s)
 830 {
 831     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_ADAPTER_RESET");
 832
 833     pvscsi_reset_adapter(s);
 834     return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 835 }
 836
 837 static const struct {
 838     int       data_size;
 839     uint64_t  (*handler_fn)(PVSCSIState *s);
 840 } pvscsi_commands[] = {
 841     [PVSCSI_CMD_FIRST] = {
 842         .data_size = 0,
 843         .handler_fn = pvscsi_on_cmd_unknown,
 844     },
 845
 846     /* Not implemented, data size defined based on what arrives on windows */
 847     [PVSCSI_CMD_CONFIG] = {
 848         .data_size = 6 * sizeof(uint32_t),
 849         .handler_fn = pvscsi_on_cmd_config,
 850     },
 851
 852     /* Command not implemented, data size is unknown */
 853     [PVSCSI_CMD_ISSUE_SCSI] = {
 854         .data_size = 0,
 855         .handler_fn = pvscsi_on_issue_scsi,
 856     },
 857
 858     /* Command not implemented, data size is unknown */
 859     [PVSCSI_CMD_DEVICE_UNPLUG] = {
 860         .data_size = 0,
 861         .handler_fn = pvscsi_on_cmd_unplug,
 862     },
 863
 864     [PVSCSI_CMD_SETUP_RINGS] = {
 865         .data_size = sizeof(PVSCSICmdDescSetupRings),
 866         .handler_fn = pvscsi_on_cmd_setup_rings,
 867     },
 868
 869     [PVSCSI_CMD_RESET_DEVICE] = {
 870         .data_size = sizeof(struct PVSCSICmdDescResetDevice),
 871         .handler_fn = pvscsi_on_cmd_reset_device,
 872     },
 873
 874     [PVSCSI_CMD_RESET_BUS] = {
 875         .data_size = 0,
 876         .handler_fn = pvscsi_on_cmd_reset_bus,
 877     },
 878
 879     [PVSCSI_CMD_SETUP_MSG_RING] = {
 880         .data_size = sizeof(PVSCSICmdDescSetupMsgRing),
 881         .handler_fn = pvscsi_on_cmd_setup_msg_ring,
 882     },
 883
 884     [PVSCSI_CMD_ADAPTER_RESET] = {
 885         .data_size = 0,
 886         .handler_fn = pvscsi_on_cmd_adapter_reset,
 887     },
 888
 889     [PVSCSI_CMD_ABORT_CMD] = {
 890         .data_size = sizeof(struct PVSCSICmdDescAbortCmd),
 891         .handler_fn = pvscsi_on_cmd_abort,
 892     },
 893 };
 894
 895 static void
 896 pvscsi_do_command_processing(PVSCSIState *s)
 897 {
 898     size_t bytes_arrived = s->curr_cmd_data_cntr * sizeof(uint32_t);
 899
 900     assert(s->curr_cmd < PVSCSI_CMD_LAST);
 901     if (bytes_arrived >= pvscsi_commands[s->curr_cmd].data_size) {
 902         s->reg_command_status = pvscsi_commands[s->curr_cmd].handler_fn(s);
 903         s->curr_cmd = PVSCSI_CMD_FIRST;
 904         s->curr_cmd_data_cntr   = 0;
 905     }
 906 }
 907
 908 static void
 909 pvscsi_on_command_data(PVSCSIState *s, uint32_t value)
 910 {
 911     size_t bytes_arrived = s->curr_cmd_data_cntr * sizeof(uint32_t);
 912
 913     assert(bytes_arrived < sizeof(s->curr_cmd_data));
 914     s->curr_cmd_data[s->curr_cmd_data_cntr++] = value;
 915
 916     pvscsi_do_command_processing(s);
 917 }
 918
 919 static void
 920 pvscsi_on_command(PVSCSIState *s, uint64_t cmd_id)
 921 {
 922     if ((cmd_id > PVSCSI_CMD_FIRST) && (cmd_id < PVSCSI_CMD_LAST)) {
 923         s->curr_cmd = cmd_id;
 924     } else {
 925         s->curr_cmd = PVSCSI_CMD_FIRST;
 926         trace_pvscsi_on_cmd_unknown(cmd_id);
 927     }
 928
 929     s->curr_cmd_data_cntr = 0;
 930     s->reg_command_status = PVSCSI_COMMAND_NOT_ENOUGH_DATA;
 931
 932     pvscsi_do_command_processing(s);
 933 }
 934
 935 static void
 936 pvscsi_io_write(void *opaque, hwaddr addr,
 937                 uint64_t val, unsigned size)
 938 {
 939     PVSCSIState *s = opaque;
 940
 941     switch (addr) {
 942     case PVSCSI_REG_OFFSET_COMMAND:
 943         pvscsi_on_command(s, val);
 944         break;
 945
 946     case PVSCSI_REG_OFFSET_COMMAND_DATA:
 947         pvscsi_on_command_data(s, (uint32_t) val);
 948         break;
 949
 950     case PVSCSI_REG_OFFSET_INTR_STATUS:
 951         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_INTR_STATUS", val);
 952         s->reg_interrupt_status &= ~val;
 953         pvscsi_update_irq_status(s);
 954         pvscsi_schedule_completion_processing(s);
 955         break;
 956
 957     case PVSCSI_REG_OFFSET_INTR_MASK:
 958         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_INTR_MASK", val);
 959         s->reg_interrupt_enabled = val;
 960         pvscsi_update_irq_status(s);
 961         break;
 962
 963     case PVSCSI_REG_OFFSET_KICK_NON_RW_IO:
 964         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_KICK_NON_RW_IO", val);
 965         pvscsi_process_io(s);
 966         break;
 967
 968     case PVSCSI_REG_OFFSET_KICK_RW_IO:
 969         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_KICK_RW_IO", val);
 970         pvscsi_process_io(s);
 971         break;
 972
 973     case PVSCSI_REG_OFFSET_DEBUG:
 974         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_DEBUG", val);
 975         break;
 976
 977     default:
 978         trace_pvscsi_io_write_unknown(addr, size, val);
 979         break;
 980     }
 981
 982 }
 983
 984 static uint64_t
 985 pvscsi_io_read(void *opaque, hwaddr addr, unsigned size)
 986 {
 987     PVSCSIState *s = opaque;
 988
 989     switch (addr) {
 990     case PVSCSI_REG_OFFSET_INTR_STATUS:
 991         trace_pvscsi_io_read("PVSCSI_REG_OFFSET_INTR_STATUS",
 992                              s->reg_interrupt_status);
 993         return s->reg_interrupt_status;
 994
 995     case PVSCSI_REG_OFFSET_INTR_MASK:
 996         trace_pvscsi_io_read("PVSCSI_REG_OFFSET_INTR_MASK",
 997                              s->reg_interrupt_status);
 998         return s->reg_interrupt_enabled;
 999
1000     case PVSCSI_REG_OFFSET_COMMAND_STATUS:
1001         trace_pvscsi_io_read("PVSCSI_REG_OFFSET_COMMAND_STATUS",
1002                              s->reg_interrupt_status);
1003         return s->reg_command_status;
1004
1005     default:
1006         trace_pvscsi_io_read_unknown(addr, size);
1007         return 0;
1008     }
1009 }
1010
1011
1012 static bool
1013 pvscsi_init_msi(PVSCSIState *s)
1014 {
1015     int res;
1016     PCIDevice *d = PCI_DEVICE(s);
1017
1018     res = msi_init(d, PVSCSI_MSI_OFFSET, PVSCSI_MSIX_NUM_VECTORS,
1019                    PVSCSI_USE_64BIT, PVSCSI_PER_VECTOR_MASK);
1020     if (res < 0) {
1021         trace_pvscsi_init_msi_fail(res);
1022         s->msi_used = false;
1023     } else {
1024         s->msi_used = true;
1025     }
1026
1027     return s->msi_used;
1028 }
1029
1030 static void
1031 pvscsi_cleanup_msi(PVSCSIState *s)
1032 {
1033     PCIDevice *d = PCI_DEVICE(s);
1034
1035     if (s->msi_used) {
1036         msi_uninit(d);
1037     }
1038 }
1039
1040 static const MemoryRegionOps pvscsi_ops = {
1041         .read = pvscsi_io_read,
1042         .write = pvscsi_io_write,
1043         .endianness = DEVICE_LITTLE_ENDIAN,
1044         .impl = {
1045                 .min_access_size = 4,
1046                 .max_access_size = 4,
1047         },
1048 };
1049
1050 static const struct SCSIBusInfo pvscsi_scsi_info = {
1051         .tcq = true,
1052         .max_target = PVSCSI_MAX_DEVS,
1053         .max_channel = 0,
1054         .max_lun = 0,
1055
1056         .get_sg_list = pvscsi_get_sg_list,
1057         .complete = pvscsi_command_complete,
1058         .cancel = pvscsi_request_cancelled,
1059         .hotplug = pvscsi_hotplug,
1060         .hot_unplug = pvscsi_hot_unplug,
1061 };
1062
1063 static int
1064 pvscsi_init(PCIDevice *pci_dev)
1065 {
1066     PVSCSIState *s = PVSCSI(pci_dev);
1067
1068     trace_pvscsi_state("init");
1069
1070     /* PCI subsystem ID */
1071     pci_dev->config[PCI_SUBSYSTEM_ID] = 0x00;
1072     pci_dev->config[PCI_SUBSYSTEM_ID + 1] = 0x10;
1073
1074     /* PCI latency timer = 255 */
1075     pci_dev->config[PCI_LATENCY_TIMER] = 0xff;
1076
1077     /* Interrupt pin A */
1078     pci_config_set_interrupt_pin(pci_dev->config, 1);
1079
1080     memory_region_init_io(&s->io_space, OBJECT(s), &pvscsi_ops, s,
1081                           "pvscsi-io", PVSCSI_MEM_SPACE_SIZE);
1082     pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io_space);
1083
1084     pvscsi_init_msi(s);
1085
1086     s->completion_worker = qemu_bh_new(pvscsi_process_completion_queue, s);
1087     if (!s->completion_worker) {
1088         pvscsi_cleanup_msi(s);
1089         memory_region_destroy(&s->io_space);
1090         return -ENOMEM;
1091     }
1092
1093     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(pci_dev),
1094                  &pvscsi_scsi_info, NULL);
1095     pvscsi_reset_state(s);
1096
1097     return 0;
1098 }
1099
1100 static void
1101 pvscsi_uninit(PCIDevice *pci_dev)
1102 {
1103     PVSCSIState *s = PVSCSI(pci_dev);
1104
1105     trace_pvscsi_state("uninit");
1106     qemu_bh_delete(s->completion_worker);
1107
1108     pvscsi_cleanup_msi(s);
1109
1110     memory_region_destroy(&s->io_space);
1111 }
1112
1113 static void
1114 pvscsi_reset(DeviceState *dev)
1115 {
1116     PCIDevice *d = PCI_DEVICE(dev);
1117     PVSCSIState *s = PVSCSI(d);
1118
1119     trace_pvscsi_state("reset");
1120     pvscsi_reset_adapter(s);
1121 }
1122
1123 static void
1124 pvscsi_pre_save(void *opaque)
1125 {
1126     PVSCSIState *s = (PVSCSIState *) opaque;
1127
1128     trace_pvscsi_state("presave");
1129
1130     assert(QTAILQ_EMPTY(&s->pending_queue));
1131     assert(QTAILQ_EMPTY(&s->completion_queue));
1132 }
1133
1134 static int
1135 pvscsi_post_load(void *opaque, int version_id)
1136 {
1137     trace_pvscsi_state("postload");
1138     return 0;
1139 }
1140
1141 static const VMStateDescription vmstate_pvscsi = {
1142     .name = "pvscsi",
1143     .version_id = 0,
1144     .minimum_version_id = 0,
1145     .minimum_version_id_old = 0,
1146     .pre_save = pvscsi_pre_save,
1147     .post_load = pvscsi_post_load,
1148     .fields      = (VMStateField[]) {
1149         VMSTATE_PCI_DEVICE(parent_obj, PVSCSIState),
1150         VMSTATE_UINT8(msi_used, PVSCSIState),
1151         VMSTATE_UINT32(resetting, PVSCSIState),
1152         VMSTATE_UINT64(reg_interrupt_status, PVSCSIState),
1153         VMSTATE_UINT64(reg_interrupt_enabled, PVSCSIState),
1154         VMSTATE_UINT64(reg_command_status, PVSCSIState),
1155         VMSTATE_UINT64(curr_cmd, PVSCSIState),
1156         VMSTATE_UINT32(curr_cmd_data_cntr, PVSCSIState),
1157         VMSTATE_UINT32_ARRAY(curr_cmd_data, PVSCSIState,
1158                              ARRAY_SIZE(((PVSCSIState *)NULL)->curr_cmd_data)),
1159         VMSTATE_UINT8(rings_info_valid, PVSCSIState),
1160         VMSTATE_UINT8(msg_ring_info_valid, PVSCSIState),
1161         VMSTATE_UINT8(use_msg, PVSCSIState),
1162
1163         VMSTATE_UINT64(rings.rs_pa, PVSCSIState),
1164         VMSTATE_UINT32(rings.txr_len_mask, PVSCSIState),
1165         VMSTATE_UINT32(rings.rxr_len_mask, PVSCSIState),
1166         VMSTATE_UINT64_ARRAY(rings.req_ring_pages_pa, PVSCSIState,
1167                              PVSCSI_SETUP_RINGS_MAX_NUM_PAGES),
1168         VMSTATE_UINT64_ARRAY(rings.cmp_ring_pages_pa, PVSCSIState,
1169                              PVSCSI_SETUP_RINGS_MAX_NUM_PAGES),
1170         VMSTATE_UINT64(rings.consumed_ptr, PVSCSIState),
1171         VMSTATE_UINT64(rings.filled_cmp_ptr, PVSCSIState),
1172
1173         VMSTATE_END_OF_LIST()
1174     }
1175 };
1176
1177 static void
1178 pvscsi_write_config(PCIDevice *pci, uint32_t addr, uint32_t val, int len)
1179 {
1180     pci_default_write_config(pci, addr, val, len);
1181     msi_write_config(pci, addr, val, len);
1182 }
1183
1184 static Property pvscsi_properties[] = {
1185     DEFINE_PROP_UINT8("use_msg", PVSCSIState, use_msg, 1),
1186     DEFINE_PROP_END_OF_LIST(),
1187 };
1188
1189 static void pvscsi_class_init(ObjectClass *klass, void *data)
1190 {
1191     DeviceClass *dc = DEVICE_CLASS(klass);
1192     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1193
1194     k->init = pvscsi_init;
1195     k->exit = pvscsi_uninit;
1196     k->vendor_id = PCI_VENDOR_ID_VMWARE;
1197     k->device_id = PCI_DEVICE_ID_VMWARE_PVSCSI;
1198     k->class_id = PCI_CLASS_STORAGE_SCSI;
1199     k->subsystem_id = 0x1000;
1200     dc->reset = pvscsi_reset;
1201     dc->vmsd = &vmstate_pvscsi;
1202     dc->props = pvscsi_properties;
1203     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1204     k->config_write = pvscsi_write_config;
1205 }
1206
1207 static const TypeInfo pvscsi_info = {
1208     .name          = TYPE_PVSCSI,
1209     .parent        = TYPE_PCI_DEVICE,
1210     .instance_size = sizeof(PVSCSIState),
1211     .class_init    = pvscsi_class_init,
1212 };
1213
1214 static void
1215 pvscsi_register_types(void)
1216 {
1217     type_register_static(&pvscsi_info);
1218 }
1219
1220 type_init(pvscsi_register_types);