vmware_vga: fix out of bounds and invalid rects updating
[qemu/ar7.git] / hw / virtio-blk.c
blob34913ee40ee1e9478e8a1d10c0b1b92a11499477
1 /*
2 * Virtio Block Device
4 * Copyright IBM, Corp. 2007
6 * Authors:
7 * Anthony Liguori <aliguori@us.ibm.com>
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
14 #include "qemu-common.h"
15 #include "qemu/error-report.h"
16 #include "trace.h"
17 #include "hw/block-common.h"
18 #include "sysemu/blockdev.h"
19 #include "virtio-blk.h"
20 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
21 #include "hw/dataplane/virtio-blk.h"
22 #endif
23 #include "scsi-defs.h"
24 #ifdef __linux__
25 # include <scsi/sg.h>
26 #endif
28 typedef struct VirtIOBlock
30 VirtIODevice vdev;
31 BlockDriverState *bs;
32 VirtQueue *vq;
33 void *rq;
34 QEMUBH *bh;
35 BlockConf *conf;
36 VirtIOBlkConf *blk;
37 unsigned short sector_mask;
38 DeviceState *qdev;
39 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
40 VirtIOBlockDataPlane *dataplane;
41 #endif
42 } VirtIOBlock;
44 static VirtIOBlock *to_virtio_blk(VirtIODevice *vdev)
46 return (VirtIOBlock *)vdev;
49 typedef struct VirtIOBlockReq
51 VirtIOBlock *dev;
52 VirtQueueElement elem;
53 struct virtio_blk_inhdr *in;
54 struct virtio_blk_outhdr *out;
55 struct virtio_scsi_inhdr *scsi;
56 QEMUIOVector qiov;
57 struct VirtIOBlockReq *next;
58 BlockAcctCookie acct;
59 } VirtIOBlockReq;
61 static void virtio_blk_req_complete(VirtIOBlockReq *req, int status)
63 VirtIOBlock *s = req->dev;
65 trace_virtio_blk_req_complete(req, status);
67 stb_p(&req->in->status, status);
68 virtqueue_push(s->vq, &req->elem, req->qiov.size + sizeof(*req->in));
69 virtio_notify(&s->vdev, s->vq);
72 static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
73 bool is_read)
75 BlockErrorAction action = bdrv_get_error_action(req->dev->bs, is_read, error);
76 VirtIOBlock *s = req->dev;
78 if (action == BDRV_ACTION_STOP) {
79 req->next = s->rq;
80 s->rq = req;
81 } else if (action == BDRV_ACTION_REPORT) {
82 virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR);
83 bdrv_acct_done(s->bs, &req->acct);
84 g_free(req);
87 bdrv_error_action(s->bs, action, is_read, error);
88 return action != BDRV_ACTION_IGNORE;
91 static void virtio_blk_rw_complete(void *opaque, int ret)
93 VirtIOBlockReq *req = opaque;
95 trace_virtio_blk_rw_complete(req, ret);
97 if (ret) {
98 bool is_read = !(ldl_p(&req->out->type) & VIRTIO_BLK_T_OUT);
99 if (virtio_blk_handle_rw_error(req, -ret, is_read))
100 return;
103 virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
104 bdrv_acct_done(req->dev->bs, &req->acct);
105 g_free(req);
108 static void virtio_blk_flush_complete(void *opaque, int ret)
110 VirtIOBlockReq *req = opaque;
112 if (ret) {
113 if (virtio_blk_handle_rw_error(req, -ret, 0)) {
114 return;
118 virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
119 bdrv_acct_done(req->dev->bs, &req->acct);
120 g_free(req);
123 static VirtIOBlockReq *virtio_blk_alloc_request(VirtIOBlock *s)
125 VirtIOBlockReq *req = g_malloc(sizeof(*req));
126 req->dev = s;
127 req->qiov.size = 0;
128 req->next = NULL;
129 return req;
132 static VirtIOBlockReq *virtio_blk_get_request(VirtIOBlock *s)
134 VirtIOBlockReq *req = virtio_blk_alloc_request(s);
136 if (req != NULL) {
137 if (!virtqueue_pop(s->vq, &req->elem)) {
138 g_free(req);
139 return NULL;
143 return req;
146 static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
148 #ifdef __linux__
149 int ret;
150 int i;
151 #endif
152 int status = VIRTIO_BLK_S_OK;
155 * We require at least one output segment each for the virtio_blk_outhdr
156 * and the SCSI command block.
158 * We also at least require the virtio_blk_inhdr, the virtio_scsi_inhdr
159 * and the sense buffer pointer in the input segments.
161 if (req->elem.out_num < 2 || req->elem.in_num < 3) {
162 virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR);
163 g_free(req);
164 return;
168 * The scsi inhdr is placed in the second-to-last input segment, just
169 * before the regular inhdr.
171 req->scsi = (void *)req->elem.in_sg[req->elem.in_num - 2].iov_base;
173 if (!req->dev->blk->scsi) {
174 status = VIRTIO_BLK_S_UNSUPP;
175 goto fail;
179 * No support for bidirection commands yet.
181 if (req->elem.out_num > 2 && req->elem.in_num > 3) {
182 status = VIRTIO_BLK_S_UNSUPP;
183 goto fail;
186 #ifdef __linux__
187 struct sg_io_hdr hdr;
188 memset(&hdr, 0, sizeof(struct sg_io_hdr));
189 hdr.interface_id = 'S';
190 hdr.cmd_len = req->elem.out_sg[1].iov_len;
191 hdr.cmdp = req->elem.out_sg[1].iov_base;
192 hdr.dxfer_len = 0;
194 if (req->elem.out_num > 2) {
196 * If there are more than the minimally required 2 output segments
197 * there is write payload starting from the third iovec.
199 hdr.dxfer_direction = SG_DXFER_TO_DEV;
200 hdr.iovec_count = req->elem.out_num - 2;
202 for (i = 0; i < hdr.iovec_count; i++)
203 hdr.dxfer_len += req->elem.out_sg[i + 2].iov_len;
205 hdr.dxferp = req->elem.out_sg + 2;
207 } else if (req->elem.in_num > 3) {
209 * If we have more than 3 input segments the guest wants to actually
210 * read data.
212 hdr.dxfer_direction = SG_DXFER_FROM_DEV;
213 hdr.iovec_count = req->elem.in_num - 3;
214 for (i = 0; i < hdr.iovec_count; i++)
215 hdr.dxfer_len += req->elem.in_sg[i].iov_len;
217 hdr.dxferp = req->elem.in_sg;
218 } else {
220 * Some SCSI commands don't actually transfer any data.
222 hdr.dxfer_direction = SG_DXFER_NONE;
225 hdr.sbp = req->elem.in_sg[req->elem.in_num - 3].iov_base;
226 hdr.mx_sb_len = req->elem.in_sg[req->elem.in_num - 3].iov_len;
228 ret = bdrv_ioctl(req->dev->bs, SG_IO, &hdr);
229 if (ret) {
230 status = VIRTIO_BLK_S_UNSUPP;
231 goto fail;
235 * From SCSI-Generic-HOWTO: "Some lower level drivers (e.g. ide-scsi)
236 * clear the masked_status field [hence status gets cleared too, see
237 * block/scsi_ioctl.c] even when a CHECK_CONDITION or COMMAND_TERMINATED
238 * status has occurred. However they do set DRIVER_SENSE in driver_status
239 * field. Also a (sb_len_wr > 0) indicates there is a sense buffer.
241 if (hdr.status == 0 && hdr.sb_len_wr > 0) {
242 hdr.status = CHECK_CONDITION;
245 stl_p(&req->scsi->errors,
246 hdr.status | (hdr.msg_status << 8) |
247 (hdr.host_status << 16) | (hdr.driver_status << 24));
248 stl_p(&req->scsi->residual, hdr.resid);
249 stl_p(&req->scsi->sense_len, hdr.sb_len_wr);
250 stl_p(&req->scsi->data_len, hdr.dxfer_len);
252 virtio_blk_req_complete(req, status);
253 g_free(req);
254 return;
255 #else
256 abort();
257 #endif
259 fail:
260 /* Just put anything nonzero so that the ioctl fails in the guest. */
261 stl_p(&req->scsi->errors, 255);
262 virtio_blk_req_complete(req, status);
263 g_free(req);
266 typedef struct MultiReqBuffer {
267 BlockRequest blkreq[32];
268 unsigned int num_writes;
269 } MultiReqBuffer;
271 static void virtio_submit_multiwrite(BlockDriverState *bs, MultiReqBuffer *mrb)
273 int i, ret;
275 if (!mrb->num_writes) {
276 return;
279 ret = bdrv_aio_multiwrite(bs, mrb->blkreq, mrb->num_writes);
280 if (ret != 0) {
281 for (i = 0; i < mrb->num_writes; i++) {
282 if (mrb->blkreq[i].error) {
283 virtio_blk_rw_complete(mrb->blkreq[i].opaque, -EIO);
288 mrb->num_writes = 0;
291 static void virtio_blk_handle_flush(VirtIOBlockReq *req, MultiReqBuffer *mrb)
293 bdrv_acct_start(req->dev->bs, &req->acct, 0, BDRV_ACCT_FLUSH);
296 * Make sure all outstanding writes are posted to the backing device.
298 virtio_submit_multiwrite(req->dev->bs, mrb);
299 bdrv_aio_flush(req->dev->bs, virtio_blk_flush_complete, req);
302 static void virtio_blk_handle_write(VirtIOBlockReq *req, MultiReqBuffer *mrb)
304 BlockRequest *blkreq;
305 uint64_t sector;
307 sector = ldq_p(&req->out->sector);
309 bdrv_acct_start(req->dev->bs, &req->acct, req->qiov.size, BDRV_ACCT_WRITE);
311 trace_virtio_blk_handle_write(req, sector, req->qiov.size / 512);
313 if (sector & req->dev->sector_mask) {
314 virtio_blk_rw_complete(req, -EIO);
315 return;
317 if (req->qiov.size % req->dev->conf->logical_block_size) {
318 virtio_blk_rw_complete(req, -EIO);
319 return;
322 if (mrb->num_writes == 32) {
323 virtio_submit_multiwrite(req->dev->bs, mrb);
326 blkreq = &mrb->blkreq[mrb->num_writes];
327 blkreq->sector = sector;
328 blkreq->nb_sectors = req->qiov.size / BDRV_SECTOR_SIZE;
329 blkreq->qiov = &req->qiov;
330 blkreq->cb = virtio_blk_rw_complete;
331 blkreq->opaque = req;
332 blkreq->error = 0;
334 mrb->num_writes++;
337 static void virtio_blk_handle_read(VirtIOBlockReq *req)
339 uint64_t sector;
341 sector = ldq_p(&req->out->sector);
343 bdrv_acct_start(req->dev->bs, &req->acct, req->qiov.size, BDRV_ACCT_READ);
345 trace_virtio_blk_handle_read(req, sector, req->qiov.size / 512);
347 if (sector & req->dev->sector_mask) {
348 virtio_blk_rw_complete(req, -EIO);
349 return;
351 if (req->qiov.size % req->dev->conf->logical_block_size) {
352 virtio_blk_rw_complete(req, -EIO);
353 return;
355 bdrv_aio_readv(req->dev->bs, sector, &req->qiov,
356 req->qiov.size / BDRV_SECTOR_SIZE,
357 virtio_blk_rw_complete, req);
360 static void virtio_blk_handle_request(VirtIOBlockReq *req,
361 MultiReqBuffer *mrb)
363 uint32_t type;
365 if (req->elem.out_num < 1 || req->elem.in_num < 1) {
366 error_report("virtio-blk missing headers");
367 exit(1);
370 if (req->elem.out_sg[0].iov_len < sizeof(*req->out) ||
371 req->elem.in_sg[req->elem.in_num - 1].iov_len < sizeof(*req->in)) {
372 error_report("virtio-blk header not in correct element");
373 exit(1);
376 req->out = (void *)req->elem.out_sg[0].iov_base;
377 req->in = (void *)req->elem.in_sg[req->elem.in_num - 1].iov_base;
379 type = ldl_p(&req->out->type);
381 if (type & VIRTIO_BLK_T_FLUSH) {
382 virtio_blk_handle_flush(req, mrb);
383 } else if (type & VIRTIO_BLK_T_SCSI_CMD) {
384 virtio_blk_handle_scsi(req);
385 } else if (type & VIRTIO_BLK_T_GET_ID) {
386 VirtIOBlock *s = req->dev;
389 * NB: per existing s/n string convention the string is
390 * terminated by '\0' only when shorter than buffer.
392 strncpy(req->elem.in_sg[0].iov_base,
393 s->blk->serial ? s->blk->serial : "",
394 MIN(req->elem.in_sg[0].iov_len, VIRTIO_BLK_ID_BYTES));
395 virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
396 g_free(req);
397 } else if (type & VIRTIO_BLK_T_OUT) {
398 qemu_iovec_init_external(&req->qiov, &req->elem.out_sg[1],
399 req->elem.out_num - 1);
400 virtio_blk_handle_write(req, mrb);
401 } else if (type == VIRTIO_BLK_T_IN || type == VIRTIO_BLK_T_BARRIER) {
402 /* VIRTIO_BLK_T_IN is 0, so we can't just & it. */
403 qemu_iovec_init_external(&req->qiov, &req->elem.in_sg[0],
404 req->elem.in_num - 1);
405 virtio_blk_handle_read(req);
406 } else {
407 virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP);
408 g_free(req);
412 static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq)
414 VirtIOBlock *s = to_virtio_blk(vdev);
415 VirtIOBlockReq *req;
416 MultiReqBuffer mrb = {
417 .num_writes = 0,
420 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
421 /* Some guests kick before setting VIRTIO_CONFIG_S_DRIVER_OK so start
422 * dataplane here instead of waiting for .set_status().
424 if (s->dataplane) {
425 virtio_blk_data_plane_start(s->dataplane);
426 return;
428 #endif
430 while ((req = virtio_blk_get_request(s))) {
431 virtio_blk_handle_request(req, &mrb);
434 virtio_submit_multiwrite(s->bs, &mrb);
437 * FIXME: Want to check for completions before returning to guest mode,
438 * so cached reads and writes are reported as quickly as possible. But
439 * that should be done in the generic block layer.
443 static void virtio_blk_dma_restart_bh(void *opaque)
445 VirtIOBlock *s = opaque;
446 VirtIOBlockReq *req = s->rq;
447 MultiReqBuffer mrb = {
448 .num_writes = 0,
451 qemu_bh_delete(s->bh);
452 s->bh = NULL;
454 s->rq = NULL;
456 while (req) {
457 virtio_blk_handle_request(req, &mrb);
458 req = req->next;
461 virtio_submit_multiwrite(s->bs, &mrb);
464 static void virtio_blk_dma_restart_cb(void *opaque, int running,
465 RunState state)
467 VirtIOBlock *s = opaque;
469 if (!running) {
470 return;
473 if (!s->bh) {
474 s->bh = qemu_bh_new(virtio_blk_dma_restart_bh, s);
475 qemu_bh_schedule(s->bh);
479 static void virtio_blk_reset(VirtIODevice *vdev)
481 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
482 VirtIOBlock *s = to_virtio_blk(vdev);
484 if (s->dataplane) {
485 virtio_blk_data_plane_stop(s->dataplane);
487 #endif
490 * This should cancel pending requests, but can't do nicely until there
491 * are per-device request lists.
493 bdrv_drain_all();
496 /* coalesce internal state, copy to pci i/o region 0
498 static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
500 VirtIOBlock *s = to_virtio_blk(vdev);
501 struct virtio_blk_config blkcfg;
502 uint64_t capacity;
503 int blk_size = s->conf->logical_block_size;
505 bdrv_get_geometry(s->bs, &capacity);
506 memset(&blkcfg, 0, sizeof(blkcfg));
507 stq_raw(&blkcfg.capacity, capacity);
508 stl_raw(&blkcfg.seg_max, 128 - 2);
509 stw_raw(&blkcfg.cylinders, s->conf->cyls);
510 stl_raw(&blkcfg.blk_size, blk_size);
511 stw_raw(&blkcfg.min_io_size, s->conf->min_io_size / blk_size);
512 stw_raw(&blkcfg.opt_io_size, s->conf->opt_io_size / blk_size);
513 blkcfg.heads = s->conf->heads;
515 * We must ensure that the block device capacity is a multiple of
516 * the logical block size. If that is not the case, lets use
517 * sector_mask to adopt the geometry to have a correct picture.
518 * For those devices where the capacity is ok for the given geometry
519 * we dont touch the sector value of the geometry, since some devices
520 * (like s390 dasd) need a specific value. Here the capacity is already
521 * cyls*heads*secs*blk_size and the sector value is not block size
522 * divided by 512 - instead it is the amount of blk_size blocks
523 * per track (cylinder).
525 if (bdrv_getlength(s->bs) / s->conf->heads / s->conf->secs % blk_size) {
526 blkcfg.sectors = s->conf->secs & ~s->sector_mask;
527 } else {
528 blkcfg.sectors = s->conf->secs;
530 blkcfg.size_max = 0;
531 blkcfg.physical_block_exp = get_physical_block_exp(s->conf);
532 blkcfg.alignment_offset = 0;
533 blkcfg.wce = bdrv_enable_write_cache(s->bs);
534 memcpy(config, &blkcfg, sizeof(struct virtio_blk_config));
537 static void virtio_blk_set_config(VirtIODevice *vdev, const uint8_t *config)
539 VirtIOBlock *s = to_virtio_blk(vdev);
540 struct virtio_blk_config blkcfg;
542 memcpy(&blkcfg, config, sizeof(blkcfg));
543 bdrv_set_enable_write_cache(s->bs, blkcfg.wce != 0);
546 static uint32_t virtio_blk_get_features(VirtIODevice *vdev, uint32_t features)
548 VirtIOBlock *s = to_virtio_blk(vdev);
550 features |= (1 << VIRTIO_BLK_F_SEG_MAX);
551 features |= (1 << VIRTIO_BLK_F_GEOMETRY);
552 features |= (1 << VIRTIO_BLK_F_TOPOLOGY);
553 features |= (1 << VIRTIO_BLK_F_BLK_SIZE);
554 features |= (1 << VIRTIO_BLK_F_SCSI);
556 if (s->blk->config_wce) {
557 features |= (1 << VIRTIO_BLK_F_CONFIG_WCE);
559 if (bdrv_enable_write_cache(s->bs))
560 features |= (1 << VIRTIO_BLK_F_WCE);
562 if (bdrv_is_read_only(s->bs))
563 features |= 1 << VIRTIO_BLK_F_RO;
565 return features;
568 static void virtio_blk_set_status(VirtIODevice *vdev, uint8_t status)
570 VirtIOBlock *s = to_virtio_blk(vdev);
571 uint32_t features;
573 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
574 if (s->dataplane && !(status & (VIRTIO_CONFIG_S_DRIVER |
575 VIRTIO_CONFIG_S_DRIVER_OK))) {
576 virtio_blk_data_plane_stop(s->dataplane);
578 #endif
580 if (!(status & VIRTIO_CONFIG_S_DRIVER_OK)) {
581 return;
584 features = vdev->guest_features;
585 bdrv_set_enable_write_cache(s->bs, !!(features & (1 << VIRTIO_BLK_F_WCE)));
588 static void virtio_blk_save(QEMUFile *f, void *opaque)
590 VirtIOBlock *s = opaque;
591 VirtIOBlockReq *req = s->rq;
593 virtio_save(&s->vdev, f);
595 while (req) {
596 qemu_put_sbyte(f, 1);
597 qemu_put_buffer(f, (unsigned char*)&req->elem, sizeof(req->elem));
598 req = req->next;
600 qemu_put_sbyte(f, 0);
603 static int virtio_blk_load(QEMUFile *f, void *opaque, int version_id)
605 VirtIOBlock *s = opaque;
606 int ret;
608 if (version_id != 2)
609 return -EINVAL;
611 ret = virtio_load(&s->vdev, f);
612 if (ret) {
613 return ret;
616 while (qemu_get_sbyte(f)) {
617 VirtIOBlockReq *req = virtio_blk_alloc_request(s);
618 qemu_get_buffer(f, (unsigned char*)&req->elem, sizeof(req->elem));
619 req->next = s->rq;
620 s->rq = req;
622 virtqueue_map_sg(req->elem.in_sg, req->elem.in_addr,
623 req->elem.in_num, 1);
624 virtqueue_map_sg(req->elem.out_sg, req->elem.out_addr,
625 req->elem.out_num, 0);
628 return 0;
631 static void virtio_blk_resize(void *opaque)
633 VirtIOBlock *s = opaque;
635 virtio_notify_config(&s->vdev);
638 static const BlockDevOps virtio_block_ops = {
639 .resize_cb = virtio_blk_resize,
642 VirtIODevice *virtio_blk_init(DeviceState *dev, VirtIOBlkConf *blk)
644 VirtIOBlock *s;
645 static int virtio_blk_id;
647 if (!blk->conf.bs) {
648 error_report("drive property not set");
649 return NULL;
651 if (!bdrv_is_inserted(blk->conf.bs)) {
652 error_report("Device needs media, but drive is empty");
653 return NULL;
656 blkconf_serial(&blk->conf, &blk->serial);
657 if (blkconf_geometry(&blk->conf, NULL, 65535, 255, 255) < 0) {
658 return NULL;
661 s = (VirtIOBlock *)virtio_common_init("virtio-blk", VIRTIO_ID_BLOCK,
662 sizeof(struct virtio_blk_config),
663 sizeof(VirtIOBlock));
665 s->vdev.get_config = virtio_blk_update_config;
666 s->vdev.set_config = virtio_blk_set_config;
667 s->vdev.get_features = virtio_blk_get_features;
668 s->vdev.set_status = virtio_blk_set_status;
669 s->vdev.reset = virtio_blk_reset;
670 s->bs = blk->conf.bs;
671 s->conf = &blk->conf;
672 s->blk = blk;
673 s->rq = NULL;
674 s->sector_mask = (s->conf->logical_block_size / BDRV_SECTOR_SIZE) - 1;
676 s->vq = virtio_add_queue(&s->vdev, 128, virtio_blk_handle_output);
677 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
678 if (!virtio_blk_data_plane_create(&s->vdev, blk, &s->dataplane)) {
679 virtio_cleanup(&s->vdev);
680 return NULL;
682 #endif
684 qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s);
685 s->qdev = dev;
686 register_savevm(dev, "virtio-blk", virtio_blk_id++, 2,
687 virtio_blk_save, virtio_blk_load, s);
688 bdrv_set_dev_ops(s->bs, &virtio_block_ops, s);
689 bdrv_set_buffer_alignment(s->bs, s->conf->logical_block_size);
691 bdrv_iostatus_enable(s->bs);
692 add_boot_device_path(s->conf->bootindex, dev, "/disk@0,0");
694 return &s->vdev;
697 void virtio_blk_exit(VirtIODevice *vdev)
699 VirtIOBlock *s = to_virtio_blk(vdev);
701 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
702 virtio_blk_data_plane_destroy(s->dataplane);
703 s->dataplane = NULL;
704 #endif
705 unregister_savevm(s->qdev, "virtio-blk", s);
706 blockdev_mark_auto_del(s->bs);
707 virtio_cleanup(vdev);