master
c 1,467 lines 44.7 KB
Raw
1 /*
2 * Virtio SCSI HBA
3 *
4 * Copyright IBM, Corp. 2010
5 * Copyright Red Hat, Inc. 2011
6 *
7 * Authors:
8 * Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
9 * Paolo Bonzini <pbonzini@redhat.com>
10 *
11 * This work is licensed under the terms of the GNU GPL, version 2 or later.
12 * See the COPYING file in the top-level directory.
13 *
14 */
15
16 #include "qemu/osdep.h"
17 #include "qapi/error.h"
18 #include "standard-headers/linux/virtio_ids.h"
19 #include "hw/virtio/virtio-scsi.h"
20 #include "migration/qemu-file-types.h"
21 #include "qemu/defer-call.h"
22 #include "qemu/error-report.h"
23 #include "qemu/iov.h"
24 #include "qemu/module.h"
25 #include "system/block-backend.h"
26 #include "system/dma.h"
27 #include "hw/core/qdev-properties.h"
28 #include "hw/scsi/scsi.h"
29 #include "scsi/constants.h"
30 #include "hw/virtio/iothread-vq-mapping.h"
31 #include "hw/virtio/virtio-bus.h"
32 #include "hw/virtio/virtio-access.h"
33 #include "trace.h"
34
35 typedef struct VirtIOSCSIReq {
36 /*
37 * Note:
38 * - fields up to resp_iov are initialized by virtio_scsi_init_req;
39 * - fields starting at vring are zeroed by virtio_scsi_init_req.
40 */
41 VirtQueueElement elem;
42
43 VirtIOSCSI *dev;
44 VirtQueue *vq;
45 QEMUSGList qsgl;
46 QEMUIOVector resp_iov;
47
48 /* Used for two-stage request submission and TMFs deferred to BH */
49 QTAILQ_ENTRY(VirtIOSCSIReq) next;
50
51 /* Used for cancellation of request during TMFs. Atomic. */
52 int remaining;
53
54 SCSIRequest *sreq;
55 size_t resp_size;
56 enum SCSIXferMode mode;
57 union {
58 VirtIOSCSICmdResp cmd;
59 VirtIOSCSICtrlTMFResp tmf;
60 VirtIOSCSICtrlANResp an;
61 VirtIOSCSIEvent event;
62 } resp;
63 union {
64 VirtIOSCSICmdReq cmd;
65 VirtIOSCSICtrlTMFReq tmf;
66 VirtIOSCSICtrlANReq an;
67 } req;
68 } VirtIOSCSIReq;
69
70 static inline int virtio_scsi_get_lun(uint8_t *lun)
71 {
72 return ((lun[2] << 8) | lun[3]) & 0x3FFF;
73 }
74
75 static inline SCSIDevice *virtio_scsi_device_get(VirtIOSCSI *s, uint8_t *lun)
76 {
77 if (lun[0] != 1) {
78 return NULL;
79 }
80 if (lun[2] != 0 && !(lun[2] >= 0x40 && lun[2] < 0x80)) {
81 return NULL;
82 }
83 return scsi_device_get(&s->bus, 0, lun[1], virtio_scsi_get_lun(lun));
84 }
85
86 static void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req)
87 {
88 VirtIODevice *vdev = VIRTIO_DEVICE(s);
89 const size_t zero_skip =
90 offsetof(VirtIOSCSIReq, resp_iov) + sizeof(req->resp_iov);
91
92 req->vq = vq;
93 req->dev = s;
94 qemu_sglist_init(&req->qsgl, DEVICE(s), 8, vdev->dma_as);
95 qemu_iovec_init(&req->resp_iov, 1);
96 memset((uint8_t *)req + zero_skip, 0, sizeof(*req) - zero_skip);
97 }
98
99 static void virtio_scsi_free_req(VirtIOSCSIReq *req)
100 {
101 qemu_iovec_destroy(&req->resp_iov);
102 qemu_sglist_destroy(&req->qsgl);
103 g_free(req);
104 }
105
106 static void virtio_scsi_complete_req(VirtIOSCSIReq *req, QemuMutex *vq_lock)
107 {
108 VirtIOSCSI *s = req->dev;
109 VirtQueue *vq = req->vq;
110 VirtIODevice *vdev = VIRTIO_DEVICE(s);
111
112 qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size);
113
114 if (vq_lock) {
115 qemu_mutex_lock(vq_lock);
116 }
117
118 virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
119 virtio_notify(vdev, vq);
120
121 if (vq_lock) {
122 qemu_mutex_unlock(vq_lock);
123 }
124
125 if (req->sreq) {
126 req->sreq->hba_private = NULL;
127 scsi_req_unref(req->sreq);
128 }
129 virtio_scsi_free_req(req);
130 }
131
132 static void virtio_scsi_bad_req(VirtIOSCSIReq *req, QemuMutex *vq_lock)
133 {
134 virtio_error(VIRTIO_DEVICE(req->dev), "wrong size for virtio-scsi headers");
135
136 if (vq_lock) {
137 qemu_mutex_lock(vq_lock);
138 }
139
140 virtqueue_detach_element(req->vq, &req->elem, 0);
141
142 if (vq_lock) {
143 qemu_mutex_unlock(vq_lock);
144 }
145
146 virtio_scsi_free_req(req);
147 }
148
149 static size_t qemu_sgl_concat(VirtIOSCSIReq *req, struct iovec *iov,
150 hwaddr *addr, int num, size_t skip)
151 {
152 QEMUSGList *qsgl = &req->qsgl;
153 size_t copied = 0;
154
155 while (num) {
156 if (skip >= iov->iov_len) {
157 skip -= iov->iov_len;
158 } else {
159 qemu_sglist_add(qsgl, *addr + skip, iov->iov_len - skip);
160 copied += iov->iov_len - skip;
161 skip = 0;
162 }
163 iov++;
164 addr++;
165 num--;
166 }
167
168 assert(skip == 0);
169 return copied;
170 }
171
172 static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
173 unsigned req_size, unsigned resp_size)
174 {
175 VirtIODevice *vdev = (VirtIODevice *) req->dev;
176 size_t in_size, out_size;
177
178 if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
179 &req->req, req_size) < req_size) {
180 return -EINVAL;
181 }
182
183 if (qemu_iovec_concat_iov(&req->resp_iov,
184 req->elem.in_sg, req->elem.in_num, 0,
185 resp_size) < resp_size) {
186 return -EINVAL;
187 }
188
189 req->resp_size = resp_size;
190
191 /* Old BIOSes left some padding by mistake after the req_size/resp_size.
192 * As a workaround, always consider the first buffer as the virtio-scsi
193 * request/response, making the payload start at the second element
194 * of the iovec.
195 *
196 * The actual length of the response header, stored in req->resp_size,
197 * does not change.
198 *
199 * TODO: always disable this workaround for virtio 1.0 devices.
200 */
201 if (!virtio_vdev_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
202 if (req->elem.out_num) {
203 req_size = req->elem.out_sg[0].iov_len;
204 }
205 if (req->elem.in_num) {
206 resp_size = req->elem.in_sg[0].iov_len;
207 }
208 }
209
210 out_size = qemu_sgl_concat(req, req->elem.out_sg,
211 &req->elem.out_addr[0], req->elem.out_num,
212 req_size);
213 in_size = qemu_sgl_concat(req, req->elem.in_sg,
214 &req->elem.in_addr[0], req->elem.in_num,
215 resp_size);
216
217 if (out_size && in_size) {
218 return -ENOTSUP;
219 }
220
221 if (out_size) {
222 req->mode = SCSI_XFER_TO_DEV;
223 } else if (in_size) {
224 req->mode = SCSI_XFER_FROM_DEV;
225 }
226
227 return 0;
228 }
229
230 static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq, size_t extra_req_size,
231 QemuMutex *vq_lock)
232 {
233 VirtIOSCSIReq *req;
234
235 if (vq_lock) {
236 qemu_mutex_lock(vq_lock);
237 }
238
239 req = virtqueue_pop(vq, sizeof(VirtIOSCSIReq) + extra_req_size);
240
241 if (vq_lock) {
242 qemu_mutex_unlock(vq_lock);
243 }
244
245 if (!req) {
246 return NULL;
247 }
248 virtio_scsi_init_req(s, vq, req);
249 return req;
250 }
251
252 static void virtio_scsi_save_request(QEMUFile *f, SCSIRequest *sreq)
253 {
254 VirtIOSCSIReq *req = sreq->hba_private;
255 VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(req->dev);
256 VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
257 uint32_t n = virtio_get_queue_index(req->vq) - VIRTIO_SCSI_VQ_NUM_FIXED;
258
259 assert(n < vs->conf.num_queues);
260 qemu_put_be32s(f, &n);
261 qemu_put_virtqueue_element(vdev, f, &req->elem);
262 }
263
264 static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
265 {
266 SCSIBus *bus = sreq->bus;
267 VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
268 VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
269 VirtIODevice *vdev = VIRTIO_DEVICE(s);
270 VirtIOSCSIReq *req;
271 uint32_t n;
272
273 qemu_get_be32s(f, &n);
274 assert(n < vs->conf.num_queues);
275 req = qemu_get_virtqueue_element(vdev, f,
276 sizeof(VirtIOSCSIReq) + vs->cdb_size);
277 virtio_scsi_init_req(s, vs->cmd_vqs[n], req);
278
279 if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + vs->cdb_size,
280 sizeof(VirtIOSCSICmdResp) + vs->sense_size) < 0) {
281 error_report("invalid SCSI request migration data");
282 exit(1);
283 }
284
285 scsi_req_ref(sreq);
286 req->sreq = sreq;
287 if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
288 assert(req->sreq->cmd.mode == req->mode);
289 }
290 return req;
291 }
292
293 typedef struct {
294 Notifier notifier;
295 VirtIOSCSIReq *tmf_req;
296 } VirtIOSCSICancelNotifier;
297
298 static void virtio_scsi_tmf_dec_remaining(VirtIOSCSIReq *tmf)
299 {
300 if (qatomic_fetch_dec(&tmf->remaining) == 1) {
301 trace_virtio_scsi_tmf_resp(virtio_scsi_get_lun(tmf->req.tmf.lun),
302 tmf->req.tmf.tag, tmf->resp.tmf.response);
303
304 virtio_scsi_complete_req(tmf, &tmf->dev->ctrl_lock);
305 }
306 }
307
308 static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
309 {
310 VirtIOSCSICancelNotifier *n = container_of(notifier,
311 VirtIOSCSICancelNotifier,
312 notifier);
313
314 virtio_scsi_tmf_dec_remaining(n->tmf_req);
315 g_free(n);
316 }
317
318 static void virtio_scsi_tmf_cancel_req(VirtIOSCSIReq *tmf, SCSIRequest *r)
319 {
320 VirtIOSCSICancelNotifier *notifier;
321
322 assert(r->ctx == qemu_get_current_aio_context());
323
324 /* Decremented in virtio_scsi_cancel_notify() */
325 qatomic_inc(&tmf->remaining);
326
327 notifier = g_new(VirtIOSCSICancelNotifier, 1);
328 notifier->notifier.notify = virtio_scsi_cancel_notify;
329 notifier->tmf_req = tmf;
330 scsi_req_cancel_async(r, &notifier->notifier);
331 }
332
333 /* Execute a TMF on the requests in the current AioContext */
334 static void virtio_scsi_do_tmf_aio_context(void *opaque)
335 {
336 AioContext *ctx = qemu_get_current_aio_context();
337 VirtIOSCSIReq *tmf = opaque;
338 VirtIOSCSI *s = tmf->dev;
339 SCSIDevice *d = virtio_scsi_device_get(s, tmf->req.tmf.lun);
340 SCSIRequest *r;
341 bool match_tag;
342 g_autoptr(GList) reqs = NULL;
343
344 if (!d) {
345 tmf->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
346 virtio_scsi_tmf_dec_remaining(tmf);
347 return;
348 }
349
350 /*
351 * This function could handle other subtypes that need to be processed in
352 * the request's AioContext in the future, but for now only request
353 * cancelation subtypes are performed here.
354 */
355 switch (tmf->req.tmf.subtype) {
356 case VIRTIO_SCSI_T_TMF_ABORT_TASK:
357 match_tag = true;
358 break;
359 case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
360 case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
361 match_tag = false;
362 break;
363 default:
364 g_assert_not_reached();
365 }
366
367 WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
368 QTAILQ_FOREACH(r, &d->requests, next) {
369 VirtIOSCSIReq *cmd_req = r->hba_private;
370 assert(cmd_req); /* request has hba_private while enqueued */
371
372 if (r->ctx != ctx) {
373 continue;
374 }
375 if (match_tag && cmd_req->req.cmd.tag != tmf->req.tmf.tag) {
376 continue;
377 }
378 /*
379 * Cannot cancel directly, because scsi_req_dequeue() would deadlock
380 * when attempting to acquire the request_lock a second time. Taking
381 * a reference here is paired with an unref after cancelling below.
382 */
383 scsi_req_ref(r);
384 reqs = g_list_prepend(reqs, r);
385 }
386 }
387
388 for (GList *elem = g_list_first(reqs); elem; elem = g_list_next(elem)) {
389 virtio_scsi_tmf_cancel_req(tmf, elem->data);
390 scsi_req_unref(elem->data);
391 }
392
393 /* Incremented by virtio_scsi_do_tmf() */
394 virtio_scsi_tmf_dec_remaining(tmf);
395
396 object_unref(d);
397 }
398
399 static void dummy_bh(void *opaque)
400 {
401 /* Do nothing */
402 }
403
404 /*
405 * Wait for pending virtio_scsi_defer_tmf_to_aio_context() BHs.
406 */
407 static void virtio_scsi_flush_defer_tmf_to_aio_context(VirtIOSCSI *s)
408 {
409 GLOBAL_STATE_CODE();
410
411 assert(!s->dataplane_started);
412
413 for (uint32_t i = 0; i < s->parent_obj.conf.num_queues; i++) {
414 AioContext *ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i];
415
416 /* Our BH only runs after previously scheduled BHs */
417 aio_wait_bh_oneshot(ctx, dummy_bh, NULL);
418 }
419 }
420
421 /*
422 * Run the TMF in a specific AioContext, handling only requests in that
423 * AioContext. This is necessary because requests can run in different
424 * AioContext and it is only possible to cancel them from the AioContext where
425 * they are running.
426 */
427 static void virtio_scsi_defer_tmf_to_aio_context(VirtIOSCSIReq *tmf,
428 AioContext *ctx)
429 {
430 /* Decremented in virtio_scsi_do_tmf_aio_context() */
431 qatomic_inc(&tmf->remaining);
432
433 /* See virtio_scsi_flush_defer_tmf_to_aio_context() cleanup during reset */
434 aio_bh_schedule_oneshot(ctx, virtio_scsi_do_tmf_aio_context, tmf);
435 }
436
437 /*
438 * Returns the AioContext for a given TMF's tag field or NULL. Note that the
439 * request identified by the tag may have completed by the time you can execute
440 * a BH in the AioContext, so don't assume the request still exists in your BH.
441 */
442 static AioContext *find_aio_context_for_tmf_tag(SCSIDevice *d,
443 VirtIOSCSIReq *tmf)
444 {
445 WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
446 SCSIRequest *r;
447 SCSIRequest *next;
448
449 QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
450 VirtIOSCSIReq *cmd_req = r->hba_private;
451
452 /* hba_private is non-NULL while the request is enqueued */
453 assert(cmd_req);
454
455 if (cmd_req->req.cmd.tag == tmf->req.tmf.tag) {
456 return r->ctx;
457 }
458 }
459 }
460 return NULL;
461 }
462
463 /* Return 0 if the request is ready to be completed and return to guest;
464 * -EINPROGRESS if the request is submitted and will be completed later, in the
465 * case of async cancellation. */
466 static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
467 {
468 SCSIDevice *d = virtio_scsi_device_get(s, req->req.tmf.lun);
469 SCSIRequest *r, *next;
470 AioContext *ctx;
471 int ret = 0;
472
473 /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE". */
474 req->resp.tmf.response = VIRTIO_SCSI_S_OK;
475
476 /*
477 * req->req.tmf has the QEMU_PACKED attribute. Don't use virtio_tswap32s()
478 * to avoid compiler errors.
479 */
480 req->req.tmf.subtype =
481 virtio_tswap32(VIRTIO_DEVICE(s), req->req.tmf.subtype);
482
483 trace_virtio_scsi_tmf_req(virtio_scsi_get_lun(req->req.tmf.lun),
484 req->req.tmf.tag, req->req.tmf.subtype);
485
486 switch (req->req.tmf.subtype) {
487 case VIRTIO_SCSI_T_TMF_ABORT_TASK: {
488 if (!d) {
489 goto fail;
490 }
491 if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
492 goto incorrect_lun;
493 }
494
495 ctx = find_aio_context_for_tmf_tag(d, req);
496 if (ctx) {
497 virtio_scsi_defer_tmf_to_aio_context(req, ctx);
498 ret = -EINPROGRESS;
499 }
500 break;
501 }
502
503 case VIRTIO_SCSI_T_TMF_QUERY_TASK:
504 if (!d) {
505 goto fail;
506 }
507 if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
508 goto incorrect_lun;
509 }
510
511 WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
512 QTAILQ_FOREACH(r, &d->requests, next) {
513 VirtIOSCSIReq *cmd_req = r->hba_private;
514 assert(cmd_req); /* request has hba_private while enqueued */
515
516 if (cmd_req->req.cmd.tag == req->req.tmf.tag) {
517 /*
518 * "If the specified command is present in the task set,
519 * then return a service response set to FUNCTION
520 * SUCCEEDED".
521 */
522 req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
523 }
524 }
525 }
526 break;
527
528 case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
529 if (!d) {
530 goto fail;
531 }
532 if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
533 goto incorrect_lun;
534 }
535 qatomic_inc(&s->resetting);
536 device_cold_reset(&d->qdev);
537 qatomic_dec(&s->resetting);
538 break;
539
540 case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET: {
541 BusChild *kid;
542 int target = req->req.tmf.lun[1];
543 qatomic_inc(&s->resetting);
544
545 rcu_read_lock();
546 QTAILQ_FOREACH_RCU(kid, &s->bus.qbus.children, sibling) {
547 SCSIDevice *d1 = SCSI_DEVICE(kid->child);
548 if (d1->channel == 0 && d1->id == target) {
549 device_cold_reset(&d1->qdev);
550 }
551 }
552 rcu_read_unlock();
553
554 qatomic_dec(&s->resetting);
555 break;
556 }
557
558 case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
559 case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET: {
560 g_autoptr(GHashTable) aio_contexts = g_hash_table_new(NULL, NULL);
561
562 if (!d) {
563 goto fail;
564 }
565 if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
566 goto incorrect_lun;
567 }
568
569 qatomic_inc(&req->remaining);
570
571 for (uint32_t i = 0; i < s->parent_obj.conf.num_queues; i++) {
572 ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i];
573
574 if (!g_hash_table_add(aio_contexts, ctx)) {
575 continue; /* skip previously added AioContext */
576 }
577
578 virtio_scsi_defer_tmf_to_aio_context(req, ctx);
579 }
580
581 virtio_scsi_tmf_dec_remaining(req);
582 ret = -EINPROGRESS;
583 break;
584 }
585
586 case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
587 if (!d) {
588 goto fail;
589 }
590 if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
591 goto incorrect_lun;
592 }
593
594 WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
595 QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
596 /* Request has hba_private while enqueued */
597 assert(r->hba_private);
598
599 /*
600 * "If there is any command present in the task set, then
601 * return a service response set to FUNCTION SUCCEEDED".
602 */
603 req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
604 break;
605 }
606 }
607 break;
608
609 case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
610 default:
611 req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
612 break;
613 }
614
615 object_unref(OBJECT(d));
616 return ret;
617
618 incorrect_lun:
619 req->resp.tmf.response = VIRTIO_SCSI_S_INCORRECT_LUN;
620 object_unref(OBJECT(d));
621 return ret;
622
623 fail:
624 req->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
625 object_unref(OBJECT(d));
626 return ret;
627 }
628
629 static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
630 {
631 VirtIODevice *vdev = (VirtIODevice *)s;
632 uint32_t type;
633 int r = 0;
634
635 if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
636 &type, sizeof(type)) < sizeof(type)) {
637 virtio_scsi_bad_req(req, &s->ctrl_lock);
638 return;
639 }
640
641 virtio_tswap32s(vdev, &type);
642 if (type == VIRTIO_SCSI_T_TMF) {
643 if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
644 sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
645 virtio_scsi_bad_req(req, &s->ctrl_lock);
646 return;
647 } else {
648 r = virtio_scsi_do_tmf(s, req);
649 }
650
651 } else if (type == VIRTIO_SCSI_T_AN_QUERY ||
652 type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
653 if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),
654 sizeof(VirtIOSCSICtrlANResp)) < 0) {
655 virtio_scsi_bad_req(req, &s->ctrl_lock);
656 return;
657 } else {
658 req->req.an.event_requested =
659 virtio_tswap32(VIRTIO_DEVICE(s), req->req.an.event_requested);
660 trace_virtio_scsi_an_req(virtio_scsi_get_lun(req->req.an.lun),
661 req->req.an.event_requested);
662 req->resp.an.event_actual = 0;
663 req->resp.an.response = VIRTIO_SCSI_S_OK;
664 }
665 }
666 if (r == 0) {
667 if (type == VIRTIO_SCSI_T_TMF)
668 trace_virtio_scsi_tmf_resp(virtio_scsi_get_lun(req->req.tmf.lun),
669 req->req.tmf.tag,
670 req->resp.tmf.response);
671 else if (type == VIRTIO_SCSI_T_AN_QUERY ||
672 type == VIRTIO_SCSI_T_AN_SUBSCRIBE)
673 trace_virtio_scsi_an_resp(virtio_scsi_get_lun(req->req.an.lun),
674 req->resp.an.response);
675 virtio_scsi_complete_req(req, &s->ctrl_lock);
676 } else {
677 assert(r == -EINPROGRESS);
678 }
679 }
680
681 static void virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
682 {
683 VirtIOSCSIReq *req;
684
685 while ((req = virtio_scsi_pop_req(s, vq, 0, &s->ctrl_lock))) {
686 virtio_scsi_handle_ctrl_req(s, req);
687 }
688 }
689
690 /*
691 * If dataplane is configured but not yet started, do so now and return true on
692 * success.
693 *
694 * Dataplane is started by the core virtio code but virtqueue handler functions
695 * can also be invoked when a guest kicks before DRIVER_OK, so this helper
696 * function helps us deal with manually starting ioeventfd in that case.
697 */
698 static bool virtio_scsi_defer_to_dataplane(VirtIOSCSI *s)
699 {
700 if (s->dataplane_started) {
701 return false;
702 }
703 if (s->vq_aio_context[0] == qemu_get_aio_context()) {
704 return false; /* not using IOThreads */
705 }
706
707 virtio_device_start_ioeventfd(&s->parent_obj.parent_obj);
708 return !s->dataplane_fenced;
709 }
710
711 static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
712 {
713 VirtIOSCSI *s = (VirtIOSCSI *)vdev;
714
715 if (virtio_scsi_defer_to_dataplane(s)) {
716 return;
717 }
718
719 virtio_scsi_handle_ctrl_vq(s, vq);
720 }
721
722 static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
723 {
724 trace_virtio_scsi_cmd_resp(virtio_scsi_get_lun(req->req.cmd.lun),
725 req->req.cmd.tag,
726 req->resp.cmd.response,
727 req->resp.cmd.status);
728 /* Sense data is not in req->resp and is copied separately
729 * in virtio_scsi_command_complete.
730 */
731 req->resp_size = sizeof(VirtIOSCSICmdResp);
732 virtio_scsi_complete_req(req, NULL);
733 }
734
735 static void virtio_scsi_command_failed(SCSIRequest *r)
736 {
737 VirtIOSCSIReq *req = r->hba_private;
738
739 if (r->io_canceled) {
740 return;
741 }
742
743 req->resp.cmd.status = GOOD;
744 switch (r->host_status) {
745 case SCSI_HOST_NO_LUN:
746 req->resp.cmd.response = VIRTIO_SCSI_S_INCORRECT_LUN;
747 break;
748 case SCSI_HOST_BUSY:
749 req->resp.cmd.response = VIRTIO_SCSI_S_BUSY;
750 break;
751 case SCSI_HOST_TIME_OUT:
752 case SCSI_HOST_ABORTED:
753 req->resp.cmd.response = VIRTIO_SCSI_S_ABORTED;
754 break;
755 case SCSI_HOST_BAD_RESPONSE:
756 req->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
757 break;
758 case SCSI_HOST_RESET:
759 req->resp.cmd.response = VIRTIO_SCSI_S_RESET;
760 break;
761 case SCSI_HOST_TRANSPORT_DISRUPTED:
762 req->resp.cmd.response = VIRTIO_SCSI_S_TRANSPORT_FAILURE;
763 break;
764 case SCSI_HOST_TARGET_FAILURE:
765 req->resp.cmd.response = VIRTIO_SCSI_S_TARGET_FAILURE;
766 break;
767 case SCSI_HOST_RESERVATION_ERROR:
768 req->resp.cmd.response = VIRTIO_SCSI_S_NEXUS_FAILURE;
769 break;
770 case SCSI_HOST_ALLOCATION_FAILURE:
771 case SCSI_HOST_MEDIUM_ERROR:
772 case SCSI_HOST_ERROR:
773 default:
774 req->resp.cmd.response = VIRTIO_SCSI_S_FAILURE;
775 break;
776 }
777 virtio_scsi_complete_cmd_req(req);
778 }
779
780 static void virtio_scsi_command_complete(SCSIRequest *r, size_t resid)
781 {
782 VirtIOSCSIReq *req = r->hba_private;
783 uint8_t sense[SCSI_SENSE_BUF_SIZE];
784 uint32_t sense_len;
785 VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
786
787 if (r->io_canceled) {
788 return;
789 }
790
791 req->resp.cmd.response = VIRTIO_SCSI_S_OK;
792 req->resp.cmd.status = r->status;
793 if (req->resp.cmd.status == GOOD) {
794 req->resp.cmd.resid = virtio_tswap32(vdev, resid);
795 } else {
796 req->resp.cmd.resid = 0;
797 sense_len = scsi_req_get_sense(r, sense, sizeof(sense));
798 sense_len = MIN(sense_len, req->resp_iov.size - sizeof(req->resp.cmd));
799 qemu_iovec_from_buf(&req->resp_iov, sizeof(req->resp.cmd),
800 sense, sense_len);
801 req->resp.cmd.sense_len = virtio_tswap32(vdev, sense_len);
802 }
803 virtio_scsi_complete_cmd_req(req);
804 }
805
806 static int virtio_scsi_parse_cdb(SCSIDevice *dev, SCSICommand *cmd,
807 uint8_t *buf, size_t buf_len,
808 void *hba_private)
809 {
810 VirtIOSCSIReq *req = hba_private;
811
812 if (cmd->len == 0) {
813 cmd->len = MIN(VIRTIO_SCSI_CDB_DEFAULT_SIZE, SCSI_CMD_BUF_SIZE);
814 memcpy(cmd->buf, buf, cmd->len);
815 }
816
817 /* Extract the direction and mode directly from the request, for
818 * host device passthrough.
819 */
820 cmd->xfer = req->qsgl.size;
821 cmd->mode = req->mode;
822 return 0;
823 }
824
825 static QEMUSGList *virtio_scsi_get_sg_list(SCSIRequest *r)
826 {
827 VirtIOSCSIReq *req = r->hba_private;
828
829 return &req->qsgl;
830 }
831
832 static void virtio_scsi_request_cancelled(SCSIRequest *r)
833 {
834 VirtIOSCSIReq *req = r->hba_private;
835
836 if (!req) {
837 return;
838 }
839 if (qatomic_read(&req->dev->resetting)) {
840 req->resp.cmd.response = VIRTIO_SCSI_S_RESET;
841 } else {
842 req->resp.cmd.response = VIRTIO_SCSI_S_ABORTED;
843 }
844 virtio_scsi_complete_cmd_req(req);
845 }
846
847 static void virtio_scsi_fail_cmd_req(VirtIOSCSIReq *req)
848 {
849 req->resp.cmd.response = VIRTIO_SCSI_S_FAILURE;
850 virtio_scsi_complete_cmd_req(req);
851 }
852
853 static int virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req,
854 size_t cdb_size)
855 {
856 VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
857 SCSIDevice *d;
858 int rc;
859
860 rc = virtio_scsi_parse_req(req, sizeof(VirtIOSCSICmdReq) + cdb_size,
861 sizeof(VirtIOSCSICmdResp) + vs->sense_size);
862 if (rc < 0) {
863 if (rc == -ENOTSUP) {
864 virtio_scsi_fail_cmd_req(req);
865 return -ENOTSUP;
866 } else {
867 virtio_scsi_bad_req(req, NULL);
868 return -EINVAL;
869 }
870 }
871 trace_virtio_scsi_cmd_req(virtio_scsi_get_lun(req->req.cmd.lun),
872 req->req.cmd.tag, req->req.cmd.cdb[0]);
873
874 d = virtio_scsi_device_get(s, req->req.cmd.lun);
875 if (!d) {
876 req->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
877 virtio_scsi_complete_cmd_req(req);
878 return -ENOENT;
879 }
880 req->sreq = scsi_req_new(d, req->req.cmd.tag,
881 virtio_scsi_get_lun(req->req.cmd.lun),
882 req->req.cmd.cdb, cdb_size, req);
883
884 if (req->sreq->cmd.mode != SCSI_XFER_NONE
885 && (req->sreq->cmd.mode != req->mode ||
886 req->sreq->cmd.xfer > req->qsgl.size)) {
887 req->resp.cmd.response = VIRTIO_SCSI_S_OVERRUN;
888 virtio_scsi_complete_cmd_req(req);
889 object_unref(OBJECT(d));
890 return -ENOBUFS;
891 }
892 scsi_req_ref(req->sreq);
893 defer_call_begin();
894 object_unref(OBJECT(d));
895 return 0;
896 }
897
898 static void virtio_scsi_handle_cmd_req_submit(VirtIOSCSI *s, VirtIOSCSIReq *req)
899 {
900 SCSIRequest *sreq = req->sreq;
901 if (scsi_req_enqueue(sreq)) {
902 scsi_req_continue(sreq);
903 }
904 defer_call_end();
905 scsi_req_unref(sreq);
906 }
907
908 static void virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
909 {
910 VirtIOSCSIReq *req, *next;
911 int ret = 0;
912 bool suppress_notifications = virtio_queue_get_notification(vq);
913
914 QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
915
916 do {
917 VirtIOSCSICommon *vs = (VirtIOSCSICommon *)s;
918 size_t cdb_size = qatomic_read(&vs->cdb_size);
919
920 if (suppress_notifications) {
921 virtio_queue_set_notification(vq, 0);
922 }
923
924 while ((req = virtio_scsi_pop_req(s, vq, cdb_size, NULL))) {
925 ret = virtio_scsi_handle_cmd_req_prepare(s, req, cdb_size);
926 if (!ret) {
927 QTAILQ_INSERT_TAIL(&reqs, req, next);
928 } else if (ret == -EINVAL) {
929 /* The device is broken and shouldn't process any request */
930 while (!QTAILQ_EMPTY(&reqs)) {
931 req = QTAILQ_FIRST(&reqs);
932 QTAILQ_REMOVE(&reqs, req, next);
933 defer_call_end();
934 /* Drop both the ref from _prepare and the initial ref */
935 scsi_req_unref(req->sreq);
936 scsi_req_unref_detach_hba(req->sreq);
937 virtqueue_detach_element(req->vq, &req->elem, 0);
938 virtio_scsi_free_req(req);
939 }
940 }
941 }
942
943 if (suppress_notifications) {
944 virtio_queue_set_notification(vq, 1);
945 }
946 } while (ret != -EINVAL && !virtio_queue_empty(vq));
947
948 QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
949 virtio_scsi_handle_cmd_req_submit(s, req);
950 }
951 }
952
953 static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
954 {
955 /* use non-QOM casts in the data path */
956 VirtIOSCSI *s = (VirtIOSCSI *)vdev;
957
958 if (virtio_scsi_defer_to_dataplane(s)) {
959 return;
960 }
961
962 virtio_scsi_handle_cmd_vq(s, vq);
963 }
964
965 static void virtio_scsi_get_config(VirtIODevice *vdev,
966 uint8_t *config)
967 {
968 VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
969 VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(vdev);
970
971 virtio_stl_p(vdev, &scsiconf->num_queues, s->conf.num_queues);
972 virtio_stl_p(vdev, &scsiconf->seg_max,
973 s->conf.seg_max_adjust ? s->conf.virtqueue_size - 2 : 128 - 2);
974 virtio_stl_p(vdev, &scsiconf->max_sectors, s->conf.max_sectors);
975 virtio_stl_p(vdev, &scsiconf->cmd_per_lun, s->conf.cmd_per_lun);
976 virtio_stl_p(vdev, &scsiconf->event_info_size, sizeof(VirtIOSCSIEvent));
977 virtio_stl_p(vdev, &scsiconf->sense_size, s->sense_size);
978 virtio_stl_p(vdev, &scsiconf->cdb_size, s->cdb_size);
979 virtio_stw_p(vdev, &scsiconf->max_channel, VIRTIO_SCSI_MAX_CHANNEL);
980 virtio_stw_p(vdev, &scsiconf->max_target, VIRTIO_SCSI_MAX_TARGET);
981 virtio_stl_p(vdev, &scsiconf->max_lun, VIRTIO_SCSI_MAX_LUN);
982 }
983
984 static void virtio_scsi_set_config(VirtIODevice *vdev,
985 const uint8_t *config)
986 {
987 VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
988 VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
989
990 if ((uint32_t) virtio_ldl_p(vdev, &scsiconf->sense_size) >= 65536 ||
991 (uint32_t) virtio_ldl_p(vdev, &scsiconf->cdb_size) >= 256) {
992 virtio_error(vdev,
993 "bad data written to virtio-scsi configuration space");
994 return;
995 }
996
997 vs->sense_size = virtio_ldl_p(vdev, &scsiconf->sense_size);
998 qatomic_set(&vs->cdb_size, virtio_ldl_p(vdev, &scsiconf->cdb_size));
999 }
1000
1001 static uint64_t virtio_scsi_get_features(VirtIODevice *vdev,
1002 uint64_t requested_features,
1003 Error **errp)
1004 {
1005 VirtIOSCSI *s = VIRTIO_SCSI(vdev);
1006
1007 /* Firstly sync all virtio-scsi possible supported features */
1008 requested_features |= s->host_features;
1009 return requested_features;
1010 }
1011
1012 static void virtio_scsi_reset(VirtIODevice *vdev)
1013 {
1014 VirtIOSCSI *s = VIRTIO_SCSI(vdev);
1015 VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
1016
1017 assert(!s->dataplane_started);
1018
1019 virtio_scsi_flush_defer_tmf_to_aio_context(s);
1020
1021 qatomic_inc(&s->resetting);
1022 bus_cold_reset(BUS(&s->bus));
1023 qatomic_dec(&s->resetting);
1024
1025 vs->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
1026 vs->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
1027
1028 WITH_QEMU_LOCK_GUARD(&s->event_lock) {
1029 s->events_dropped = false;
1030 }
1031 }
1032
1033 typedef struct {
1034 uint32_t event;
1035 uint32_t reason;
1036 union {
1037 /* Used by messages specific to a device */
1038 struct {
1039 uint32_t id;
1040 uint32_t lun;
1041 } address;
1042 };
1043 } VirtIOSCSIEventInfo;
1044
1045 static void virtio_scsi_push_event(VirtIOSCSI *s,
1046 const VirtIOSCSIEventInfo *info)
1047 {
1048 VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
1049 VirtIOSCSIReq *req;
1050 VirtIOSCSIEvent *evt;
1051 VirtIODevice *vdev = VIRTIO_DEVICE(s);
1052 uint32_t event = info->event;
1053 uint32_t reason = info->reason;
1054
1055 if (!(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
1056 return;
1057 }
1058
1059 req = virtio_scsi_pop_req(s, vs->event_vq, 0, &s->event_lock);
1060 WITH_QEMU_LOCK_GUARD(&s->event_lock) {
1061 if (!req) {
1062 s->events_dropped = true;
1063 return;
1064 }
1065
1066 if (s->events_dropped) {
1067 event |= VIRTIO_SCSI_T_EVENTS_MISSED;
1068 s->events_dropped = false;
1069 }
1070 }
1071
1072 if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
1073 virtio_scsi_bad_req(req, &s->event_lock);
1074 return;
1075 }
1076
1077 evt = &req->resp.event;
1078 memset(evt, 0, sizeof(VirtIOSCSIEvent));
1079 evt->event = virtio_tswap32(vdev, event);
1080 evt->reason = virtio_tswap32(vdev, reason);
1081 if (event != VIRTIO_SCSI_T_EVENTS_MISSED) {
1082 evt->lun[0] = 1;
1083 evt->lun[1] = info->address.id;
1084
1085 /* Linux wants us to keep the same encoding we use for REPORT LUNS. */
1086 if (info->address.lun >= 256) {
1087 evt->lun[2] = (info->address.lun >> 8) | 0x40;
1088 }
1089 evt->lun[3] = info->address.lun & 0xFF;
1090 }
1091 trace_virtio_scsi_event(virtio_scsi_get_lun(evt->lun), event, reason);
1092
1093 virtio_scsi_complete_req(req, &s->event_lock);
1094 }
1095
1096 static void virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
1097 {
1098 bool events_dropped;
1099
1100 WITH_QEMU_LOCK_GUARD(&s->event_lock) {
1101 events_dropped = s->events_dropped;
1102 }
1103
1104 if (events_dropped) {
1105 VirtIOSCSIEventInfo info = {
1106 .event = VIRTIO_SCSI_T_NO_EVENT,
1107 };
1108 virtio_scsi_push_event(s, &info);
1109 }
1110 }
1111
1112 static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
1113 {
1114 VirtIOSCSI *s = VIRTIO_SCSI(vdev);
1115
1116 if (virtio_scsi_defer_to_dataplane(s)) {
1117 return;
1118 }
1119
1120 virtio_scsi_handle_event_vq(s, vq);
1121 }
1122
1123 static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)
1124 {
1125 VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
1126 VirtIODevice *vdev = VIRTIO_DEVICE(s);
1127
1128 if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_CHANGE) &&
1129 dev->type != TYPE_ROM) {
1130 VirtIOSCSIEventInfo info = {
1131 .event = VIRTIO_SCSI_T_PARAM_CHANGE,
1132 .reason = sense.asc | (sense.ascq << 8),
1133 .address = {
1134 .id = dev->id,
1135 .lun = dev->lun,
1136 },
1137 };
1138
1139 virtio_scsi_push_event(s, &info);
1140 }
1141 }
1142
1143 static void virtio_scsi_pre_hotplug(HotplugHandler *hotplug_dev,
1144 DeviceState *dev, Error **errp)
1145 {
1146 SCSIDevice *sd = SCSI_DEVICE(dev);
1147 sd->hba_supports_iothread = true;
1148 }
1149
1150 static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
1151 Error **errp)
1152 {
1153 VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
1154 VirtIOSCSI *s = VIRTIO_SCSI(vdev);
1155 AioContext *ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED];
1156 SCSIDevice *sd = SCSI_DEVICE(dev);
1157
1158 if (ctx != qemu_get_aio_context() && !s->dataplane_fenced) {
1159 /*
1160 * Try to make the BlockBackend's AioContext match ours. Ignore failure
1161 * because I/O will still work although block jobs and other users
1162 * might be slower when multiple AioContexts use a BlockBackend.
1163 */
1164 blk_set_aio_context(sd->conf.blk, ctx, NULL);
1165 }
1166
1167 if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
1168 VirtIOSCSIEventInfo info = {
1169 .event = VIRTIO_SCSI_T_TRANSPORT_RESET,
1170 .reason = VIRTIO_SCSI_EVT_RESET_RESCAN,
1171 .address = {
1172 .id = sd->id,
1173 .lun = sd->lun,
1174 },
1175 };
1176
1177 virtio_scsi_push_event(s, &info);
1178 scsi_bus_set_ua(&s->bus, SENSE_CODE(REPORTED_LUNS_CHANGED));
1179 }
1180 }
1181
1182 static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
1183 Error **errp)
1184 {
1185 VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
1186 VirtIOSCSI *s = VIRTIO_SCSI(vdev);
1187 SCSIDevice *sd = SCSI_DEVICE(dev);
1188 VirtIOSCSIEventInfo info = {
1189 .event = VIRTIO_SCSI_T_TRANSPORT_RESET,
1190 .reason = VIRTIO_SCSI_EVT_RESET_REMOVED,
1191 .address = {
1192 .id = sd->id,
1193 .lun = sd->lun,
1194 },
1195 };
1196
1197 qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
1198
1199 if (s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED] != qemu_get_aio_context()) {
1200 /* If other users keep the BlockBackend in the iothread, that's ok */
1201 blk_set_aio_context(sd->conf.blk, qemu_get_aio_context(), NULL);
1202 }
1203
1204 if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
1205 virtio_scsi_push_event(s, &info);
1206 scsi_bus_set_ua(&s->bus, SENSE_CODE(REPORTED_LUNS_CHANGED));
1207 }
1208 }
1209
1210 /* Suspend virtqueue ioeventfd processing during drain */
1211 static void virtio_scsi_drained_begin(SCSIBus *bus)
1212 {
1213 VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
1214 VirtIODevice *vdev = VIRTIO_DEVICE(s);
1215 uint32_t total_queues = VIRTIO_SCSI_VQ_NUM_FIXED +
1216 s->parent_obj.conf.num_queues;
1217
1218 /*
1219 * Drain is called when stopping dataplane but the host notifier has
1220 * already been detached. Detaching multiple times is a no-op if nothing
1221 * else is using the monitoring same file descriptor, but avoid it just in
1222 * case.
1223 *
1224 * Also, don't detach if dataplane has not even been started yet because
1225 * the host notifier isn't attached.
1226 */
1227 if (s->dataplane_stopping || !s->dataplane_started) {
1228 return;
1229 }
1230
1231 for (uint32_t i = 0; i < total_queues; i++) {
1232 VirtQueue *vq = virtio_get_queue(vdev, i);
1233 virtio_queue_aio_detach_host_notifier(vq, s->vq_aio_context[i]);
1234 }
1235 }
1236
1237 /* Resume virtqueue ioeventfd processing after drain */
1238 static void virtio_scsi_drained_end(SCSIBus *bus)
1239 {
1240 VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
1241 VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
1242 VirtIODevice *vdev = VIRTIO_DEVICE(s);
1243 uint32_t total_queues = VIRTIO_SCSI_VQ_NUM_FIXED +
1244 s->parent_obj.conf.num_queues;
1245
1246 /*
1247 * Drain is called when stopping dataplane. Keep the host notifier detached
1248 * so it's not left dangling after dataplane is stopped.
1249 *
1250 * Also, don't attach if dataplane has not even been started yet. We're not
1251 * ready.
1252 */
1253 if (s->dataplane_stopping || !s->dataplane_started) {
1254 return;
1255 }
1256
1257 for (uint32_t i = 0; i < total_queues; i++) {
1258 VirtQueue *vq = virtio_get_queue(vdev, i);
1259 AioContext *ctx = s->vq_aio_context[i];
1260
1261 if (vq == vs->event_vq) {
1262 virtio_queue_aio_attach_host_notifier_no_poll(vq, ctx);
1263 } else {
1264 virtio_queue_aio_attach_host_notifier(vq, ctx);
1265 }
1266 }
1267 }
1268
1269 static struct SCSIBusInfo virtio_scsi_scsi_info = {
1270 .tcq = true,
1271 .max_channel = VIRTIO_SCSI_MAX_CHANNEL,
1272 .max_target = VIRTIO_SCSI_MAX_TARGET,
1273 .max_lun = VIRTIO_SCSI_MAX_LUN,
1274
1275 .complete = virtio_scsi_command_complete,
1276 .fail = virtio_scsi_command_failed,
1277 .cancel = virtio_scsi_request_cancelled,
1278 .change = virtio_scsi_change,
1279 .parse_cdb = virtio_scsi_parse_cdb,
1280 .get_sg_list = virtio_scsi_get_sg_list,
1281 .save_request = virtio_scsi_save_request,
1282 .load_request = virtio_scsi_load_request,
1283 .drained_begin = virtio_scsi_drained_begin,
1284 .drained_end = virtio_scsi_drained_end,
1285 };
1286
1287 void virtio_scsi_common_realize(DeviceState *dev,
1288 VirtIOHandleOutput ctrl,
1289 VirtIOHandleOutput evt,
1290 VirtIOHandleOutput cmd,
1291 Error **errp)
1292 {
1293 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
1294 VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(dev);
1295 int i;
1296
1297 virtio_init(vdev, VIRTIO_ID_SCSI, sizeof(VirtIOSCSIConfig));
1298
1299 if (s->conf.num_queues == VIRTIO_SCSI_AUTO_NUM_QUEUES) {
1300 s->conf.num_queues = 1;
1301 }
1302 if (s->conf.num_queues == 0 ||
1303 s->conf.num_queues > VIRTIO_QUEUE_MAX - VIRTIO_SCSI_VQ_NUM_FIXED) {
1304 error_setg(errp, "Invalid number of queues (= %" PRIu32 "), "
1305 "must be a positive integer less than %d.",
1306 s->conf.num_queues,
1307 VIRTIO_QUEUE_MAX - VIRTIO_SCSI_VQ_NUM_FIXED);
1308 virtio_cleanup(vdev);
1309 return;
1310 }
1311 if (s->conf.virtqueue_size <= 2) {
1312 error_setg(errp, "invalid virtqueue_size property (= %" PRIu32 "), "
1313 "must be > 2", s->conf.virtqueue_size);
1314 return;
1315 }
1316 s->cmd_vqs = g_new0(VirtQueue *, s->conf.num_queues);
1317 s->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
1318 s->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
1319
1320 s->ctrl_vq = virtio_add_queue(vdev, s->conf.virtqueue_size, ctrl);
1321 s->event_vq = virtio_add_queue(vdev, s->conf.virtqueue_size, evt);
1322 for (i = 0; i < s->conf.num_queues; i++) {
1323 s->cmd_vqs[i] = virtio_add_queue(vdev, s->conf.virtqueue_size, cmd);
1324 }
1325 }
1326
1327 static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
1328 {
1329 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
1330 VirtIOSCSI *s = VIRTIO_SCSI(dev);
1331 Error *err = NULL;
1332
1333 qemu_mutex_init(&s->ctrl_lock);
1334 qemu_mutex_init(&s->event_lock);
1335
1336 virtio_scsi_common_realize(dev,
1337 virtio_scsi_handle_ctrl,
1338 virtio_scsi_handle_event,
1339 virtio_scsi_handle_cmd,
1340 &err);
1341 if (err != NULL) {
1342 error_propagate(errp, err);
1343 return;
1344 }
1345
1346 scsi_bus_init_named(&s->bus, sizeof(s->bus), dev,
1347 &virtio_scsi_scsi_info, vdev->bus_name);
1348 /* override default SCSI bus hotplug-handler, with virtio-scsi's one */
1349 qbus_set_hotplug_handler(BUS(&s->bus), OBJECT(dev));
1350
1351 virtio_scsi_dataplane_setup(s, errp);
1352 }
1353
1354 void virtio_scsi_common_unrealize(DeviceState *dev)
1355 {
1356 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
1357 VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(dev);
1358 int i;
1359
1360 virtio_delete_queue(vs->ctrl_vq);
1361 virtio_delete_queue(vs->event_vq);
1362 for (i = 0; i < vs->conf.num_queues; i++) {
1363 virtio_delete_queue(vs->cmd_vqs[i]);
1364 }
1365 g_free(vs->cmd_vqs);
1366 virtio_cleanup(vdev);
1367 }
1368
1369 /* main loop */
1370 static void virtio_scsi_device_unrealize(DeviceState *dev)
1371 {
1372 VirtIOSCSI *s = VIRTIO_SCSI(dev);
1373
1374 virtio_scsi_dataplane_cleanup(s);
1375 qbus_set_hotplug_handler(BUS(&s->bus), NULL);
1376 virtio_scsi_common_unrealize(dev);
1377 qemu_mutex_destroy(&s->event_lock);
1378 qemu_mutex_destroy(&s->ctrl_lock);
1379 }
1380
1381 static const Property virtio_scsi_properties[] = {
1382 DEFINE_PROP_UINT32("num_queues", VirtIOSCSI, parent_obj.conf.num_queues,
1383 VIRTIO_SCSI_AUTO_NUM_QUEUES),
1384 DEFINE_PROP_UINT32("virtqueue_size", VirtIOSCSI,
1385 parent_obj.conf.virtqueue_size, 256),
1386 DEFINE_PROP_BOOL("seg_max_adjust", VirtIOSCSI,
1387 parent_obj.conf.seg_max_adjust, true),
1388 DEFINE_PROP_UINT32("max_sectors", VirtIOSCSI, parent_obj.conf.max_sectors,
1389 0xFFFF),
1390 DEFINE_PROP_UINT32("cmd_per_lun", VirtIOSCSI, parent_obj.conf.cmd_per_lun,
1391 128),
1392 DEFINE_PROP_BIT("hotplug", VirtIOSCSI, host_features,
1393 VIRTIO_SCSI_F_HOTPLUG, true),
1394 DEFINE_PROP_BIT("param_change", VirtIOSCSI, host_features,
1395 VIRTIO_SCSI_F_CHANGE, true),
1396 DEFINE_PROP_LINK("iothread", VirtIOSCSI, parent_obj.conf.iothread,
1397 TYPE_IOTHREAD, IOThread *),
1398 DEFINE_PROP_IOTHREAD_VQ_MAPPING_LIST("iothread-vq-mapping", VirtIOSCSI,
1399 parent_obj.conf.iothread_vq_mapping_list),
1400 };
1401
1402 static const VMStateDescription vmstate_virtio_scsi = {
1403 .name = "virtio-scsi",
1404 .minimum_version_id = 1,
1405 .version_id = 1,
1406 .fields = (const VMStateField[]) {
1407 VMSTATE_VIRTIO_DEVICE,
1408 VMSTATE_END_OF_LIST()
1409 },
1410 };
1411
1412 static void virtio_scsi_common_class_init(ObjectClass *klass, const void *data)
1413 {
1414 VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
1415 DeviceClass *dc = DEVICE_CLASS(klass);
1416
1417 vdc->get_config = virtio_scsi_get_config;
1418 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1419 }
1420
1421 static void virtio_scsi_class_init(ObjectClass *klass, const void *data)
1422 {
1423 DeviceClass *dc = DEVICE_CLASS(klass);
1424 VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
1425 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
1426
1427 device_class_set_props(dc, virtio_scsi_properties);
1428 dc->vmsd = &vmstate_virtio_scsi;
1429 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1430 vdc->realize = virtio_scsi_device_realize;
1431 vdc->unrealize = virtio_scsi_device_unrealize;
1432 vdc->set_config = virtio_scsi_set_config;
1433 vdc->get_features = virtio_scsi_get_features;
1434 vdc->reset = virtio_scsi_reset;
1435 vdc->start_ioeventfd = virtio_scsi_dataplane_start;
1436 vdc->stop_ioeventfd = virtio_scsi_dataplane_stop;
1437 hc->pre_plug = virtio_scsi_pre_hotplug;
1438 hc->plug = virtio_scsi_hotplug;
1439 hc->unplug = virtio_scsi_hotunplug;
1440 }
1441
1442 static const TypeInfo virtio_scsi_common_info = {
1443 .name = TYPE_VIRTIO_SCSI_COMMON,
1444 .parent = TYPE_VIRTIO_DEVICE,
1445 .instance_size = sizeof(VirtIOSCSICommon),
1446 .abstract = true,
1447 .class_init = virtio_scsi_common_class_init,
1448 };
1449
1450 static const TypeInfo virtio_scsi_info = {
1451 .name = TYPE_VIRTIO_SCSI,
1452 .parent = TYPE_VIRTIO_SCSI_COMMON,
1453 .instance_size = sizeof(VirtIOSCSI),
1454 .class_init = virtio_scsi_class_init,
1455 .interfaces = (const InterfaceInfo[]) {
1456 { TYPE_HOTPLUG_HANDLER },
1457 { }
1458 }
1459 };
1460
1461 static void virtio_register_types(void)
1462 {
1463 type_register_static(&virtio_scsi_common_info);
1464 type_register_static(&virtio_scsi_info);
1465 }
1466
1467 type_init(virtio_register_types)