scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)
[qemu.git] / hw / scsi / vmw_pvscsi.c
1 /*
2 * QEMU VMWARE PVSCSI paravirtual SCSI bus
3 *
4 * Copyright (c) 2012 Ravello Systems LTD (http://ravellosystems.com)
5 *
6 * Developed by Daynix Computing LTD (http://www.daynix.com)
7 *
8 * Based on implementation by Paolo Bonzini
9 * http://lists.gnu.org/archive/html/qemu-devel/2011-08/msg00729.html
10 *
11 * Authors:
12 * Paolo Bonzini <pbonzini@redhat.com>
13 * Dmitry Fleytman <dmitry@daynix.com>
14 * Yan Vugenfirer <yan@daynix.com>
15 *
16 * This work is licensed under the terms of the GNU GPL, version 2.
17 * See the COPYING file in the top-level directory.
18 *
19 * NOTE about MSI-X:
20 * MSI-X support has been removed for the moment because it leads Windows OS
21 * to crash on startup. The crash happens because Windows driver requires
22 * MSI-X shared memory to be part of the same BAR used for rings state
23 * registers, etc. This is not supported by QEMU infrastructure so separate
24 * BAR created from MSI-X purposes. Windows driver fails to deal with 2 BARs.
25 *
26 */
27
28 #include "qemu/osdep.h"
29 #include "qapi/error.h"
30 #include "hw/scsi/scsi.h"
31 #include <block/scsi.h>
32 #include "hw/pci/msi.h"
33 #include "vmw_pvscsi.h"
34 #include "trace.h"
35
36
37 #define PVSCSI_USE_64BIT (true)
38 #define PVSCSI_PER_VECTOR_MASK (false)
39
40 #define PVSCSI_MAX_DEVS (64)
41 #define PVSCSI_MSIX_NUM_VECTORS (1)
42
43 #define PVSCSI_MAX_CMD_DATA_WORDS \
44 (sizeof(PVSCSICmdDescSetupRings)/sizeof(uint32_t))
45
46 #define RS_GET_FIELD(m, field) \
47 (ldl_le_pci_dma(&container_of(m, PVSCSIState, rings)->parent_obj, \
48 (m)->rs_pa + offsetof(struct PVSCSIRingsState, field)))
49 #define RS_SET_FIELD(m, field, val) \
50 (stl_le_pci_dma(&container_of(m, PVSCSIState, rings)->parent_obj, \
51 (m)->rs_pa + offsetof(struct PVSCSIRingsState, field), val))
52
53 typedef struct PVSCSIClass {
54 PCIDeviceClass parent_class;
55 DeviceRealize parent_dc_realize;
56 } PVSCSIClass;
57
58 #define TYPE_PVSCSI "pvscsi"
59 #define PVSCSI(obj) OBJECT_CHECK(PVSCSIState, (obj), TYPE_PVSCSI)
60
61 #define PVSCSI_DEVICE_CLASS(klass) \
62 OBJECT_CLASS_CHECK(PVSCSIClass, (klass), TYPE_PVSCSI)
63 #define PVSCSI_DEVICE_GET_CLASS(obj) \
64 OBJECT_GET_CLASS(PVSCSIClass, (obj), TYPE_PVSCSI)
65
66 /* Compatibility flags for migration */
67 #define PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT 0
68 #define PVSCSI_COMPAT_OLD_PCI_CONFIGURATION \
69 (1 << PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT)
70 #define PVSCSI_COMPAT_DISABLE_PCIE_BIT 1
71 #define PVSCSI_COMPAT_DISABLE_PCIE \
72 (1 << PVSCSI_COMPAT_DISABLE_PCIE_BIT)
73
74 #define PVSCSI_USE_OLD_PCI_CONFIGURATION(s) \
75 ((s)->compat_flags & PVSCSI_COMPAT_OLD_PCI_CONFIGURATION)
76 #define PVSCSI_MSI_OFFSET(s) \
77 (PVSCSI_USE_OLD_PCI_CONFIGURATION(s) ? 0x50 : 0x7c)
78 #define PVSCSI_EXP_EP_OFFSET (0x40)
79
80 typedef struct PVSCSIRingInfo {
81 uint64_t rs_pa;
82 uint32_t txr_len_mask;
83 uint32_t rxr_len_mask;
84 uint32_t msg_len_mask;
85 uint64_t req_ring_pages_pa[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
86 uint64_t cmp_ring_pages_pa[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
87 uint64_t msg_ring_pages_pa[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
88 uint64_t consumed_ptr;
89 uint64_t filled_cmp_ptr;
90 uint64_t filled_msg_ptr;
91 } PVSCSIRingInfo;
92
93 typedef struct PVSCSISGState {
94 hwaddr elemAddr;
95 hwaddr dataAddr;
96 uint32_t resid;
97 } PVSCSISGState;
98
99 typedef QTAILQ_HEAD(, PVSCSIRequest) PVSCSIRequestList;
100
101 typedef struct {
102 PCIDevice parent_obj;
103 MemoryRegion io_space;
104 SCSIBus bus;
105 QEMUBH *completion_worker;
106 PVSCSIRequestList pending_queue;
107 PVSCSIRequestList completion_queue;
108
109 uint64_t reg_interrupt_status; /* Interrupt status register value */
110 uint64_t reg_interrupt_enabled; /* Interrupt mask register value */
111 uint64_t reg_command_status; /* Command status register value */
112
113 /* Command data adoption mechanism */
114 uint64_t curr_cmd; /* Last command arrived */
115 uint32_t curr_cmd_data_cntr; /* Amount of data for last command */
116
117 /* Collector for current command data */
118 uint32_t curr_cmd_data[PVSCSI_MAX_CMD_DATA_WORDS];
119
120 uint8_t rings_info_valid; /* Whether data rings initialized */
121 uint8_t msg_ring_info_valid; /* Whether message ring initialized */
122 uint8_t use_msg; /* Whether to use message ring */
123
124 uint8_t msi_used; /* Whether MSI support was installed successfully */
125
126 PVSCSIRingInfo rings; /* Data transfer rings manager */
127 uint32_t resetting; /* Reset in progress */
128
129 uint32_t compat_flags;
130 } PVSCSIState;
131
132 typedef struct PVSCSIRequest {
133 SCSIRequest *sreq;
134 PVSCSIState *dev;
135 uint8_t sense_key;
136 uint8_t completed;
137 int lun;
138 QEMUSGList sgl;
139 PVSCSISGState sg;
140 struct PVSCSIRingReqDesc req;
141 struct PVSCSIRingCmpDesc cmp;
142 QTAILQ_ENTRY(PVSCSIRequest) next;
143 } PVSCSIRequest;
144
145 /* Integer binary logarithm */
146 static int
147 pvscsi_log2(uint32_t input)
148 {
149 int log = 0;
150 assert(input > 0);
151 while (input >> ++log) {
152 }
153 return log;
154 }
155
156 static int
157 pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
158 {
159 int i;
160 uint32_t txr_len_log2, rxr_len_log2;
161 uint32_t req_ring_size, cmp_ring_size;
162 m->rs_pa = ri->ringsStatePPN << VMW_PAGE_SHIFT;
163
164 if ((ri->reqRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES)
165 || (ri->cmpRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES)) {
166 return -1;
167 }
168 req_ring_size = ri->reqRingNumPages * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
169 cmp_ring_size = ri->cmpRingNumPages * PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
170 txr_len_log2 = pvscsi_log2(req_ring_size - 1);
171 rxr_len_log2 = pvscsi_log2(cmp_ring_size - 1);
172
173 m->txr_len_mask = MASK(txr_len_log2);
174 m->rxr_len_mask = MASK(rxr_len_log2);
175
176 m->consumed_ptr = 0;
177 m->filled_cmp_ptr = 0;
178
179 for (i = 0; i < ri->reqRingNumPages; i++) {
180 m->req_ring_pages_pa[i] = ri->reqRingPPNs[i] << VMW_PAGE_SHIFT;
181 }
182
183 for (i = 0; i < ri->cmpRingNumPages; i++) {
184 m->cmp_ring_pages_pa[i] = ri->cmpRingPPNs[i] << VMW_PAGE_SHIFT;
185 }
186
187 RS_SET_FIELD(m, reqProdIdx, 0);
188 RS_SET_FIELD(m, reqConsIdx, 0);
189 RS_SET_FIELD(m, reqNumEntriesLog2, txr_len_log2);
190
191 RS_SET_FIELD(m, cmpProdIdx, 0);
192 RS_SET_FIELD(m, cmpConsIdx, 0);
193 RS_SET_FIELD(m, cmpNumEntriesLog2, rxr_len_log2);
194
195 trace_pvscsi_ring_init_data(txr_len_log2, rxr_len_log2);
196
197 /* Flush ring state page changes */
198 smp_wmb();
199
200 return 0;
201 }
202
203 static int
204 pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
205 {
206 int i;
207 uint32_t len_log2;
208 uint32_t ring_size;
209
210 if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
211 return -1;
212 }
213 ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
214 len_log2 = pvscsi_log2(ring_size - 1);
215
216 m->msg_len_mask = MASK(len_log2);
217
218 m->filled_msg_ptr = 0;
219
220 for (i = 0; i < ri->numPages; i++) {
221 m->msg_ring_pages_pa[i] = ri->ringPPNs[i] << VMW_PAGE_SHIFT;
222 }
223
224 RS_SET_FIELD(m, msgProdIdx, 0);
225 RS_SET_FIELD(m, msgConsIdx, 0);
226 RS_SET_FIELD(m, msgNumEntriesLog2, len_log2);
227
228 trace_pvscsi_ring_init_msg(len_log2);
229
230 /* Flush ring state page changes */
231 smp_wmb();
232
233 return 0;
234 }
235
236 static void
237 pvscsi_ring_cleanup(PVSCSIRingInfo *mgr)
238 {
239 mgr->rs_pa = 0;
240 mgr->txr_len_mask = 0;
241 mgr->rxr_len_mask = 0;
242 mgr->msg_len_mask = 0;
243 mgr->consumed_ptr = 0;
244 mgr->filled_cmp_ptr = 0;
245 mgr->filled_msg_ptr = 0;
246 memset(mgr->req_ring_pages_pa, 0, sizeof(mgr->req_ring_pages_pa));
247 memset(mgr->cmp_ring_pages_pa, 0, sizeof(mgr->cmp_ring_pages_pa));
248 memset(mgr->msg_ring_pages_pa, 0, sizeof(mgr->msg_ring_pages_pa));
249 }
250
251 static hwaddr
252 pvscsi_ring_pop_req_descr(PVSCSIRingInfo *mgr)
253 {
254 uint32_t ready_ptr = RS_GET_FIELD(mgr, reqProdIdx);
255
256 if (ready_ptr != mgr->consumed_ptr) {
257 uint32_t next_ready_ptr =
258 mgr->consumed_ptr++ & mgr->txr_len_mask;
259 uint32_t next_ready_page =
260 next_ready_ptr / PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
261 uint32_t inpage_idx =
262 next_ready_ptr % PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
263
264 return mgr->req_ring_pages_pa[next_ready_page] +
265 inpage_idx * sizeof(PVSCSIRingReqDesc);
266 } else {
267 return 0;
268 }
269 }
270
271 static void
272 pvscsi_ring_flush_req(PVSCSIRingInfo *mgr)
273 {
274 RS_SET_FIELD(mgr, reqConsIdx, mgr->consumed_ptr);
275 }
276
277 static hwaddr
278 pvscsi_ring_pop_cmp_descr(PVSCSIRingInfo *mgr)
279 {
280 /*
281 * According to Linux driver code it explicitly verifies that number
282 * of requests being processed by device is less then the size of
283 * completion queue, so device may omit completion queue overflow
284 * conditions check. We assume that this is true for other (Windows)
285 * drivers as well.
286 */
287
288 uint32_t free_cmp_ptr =
289 mgr->filled_cmp_ptr++ & mgr->rxr_len_mask;
290 uint32_t free_cmp_page =
291 free_cmp_ptr / PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
292 uint32_t inpage_idx =
293 free_cmp_ptr % PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
294 return mgr->cmp_ring_pages_pa[free_cmp_page] +
295 inpage_idx * sizeof(PVSCSIRingCmpDesc);
296 }
297
298 static hwaddr
299 pvscsi_ring_pop_msg_descr(PVSCSIRingInfo *mgr)
300 {
301 uint32_t free_msg_ptr =
302 mgr->filled_msg_ptr++ & mgr->msg_len_mask;
303 uint32_t free_msg_page =
304 free_msg_ptr / PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
305 uint32_t inpage_idx =
306 free_msg_ptr % PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
307 return mgr->msg_ring_pages_pa[free_msg_page] +
308 inpage_idx * sizeof(PVSCSIRingMsgDesc);
309 }
310
311 static void
312 pvscsi_ring_flush_cmp(PVSCSIRingInfo *mgr)
313 {
314 /* Flush descriptor changes */
315 smp_wmb();
316
317 trace_pvscsi_ring_flush_cmp(mgr->filled_cmp_ptr);
318
319 RS_SET_FIELD(mgr, cmpProdIdx, mgr->filled_cmp_ptr);
320 }
321
322 static bool
323 pvscsi_ring_msg_has_room(PVSCSIRingInfo *mgr)
324 {
325 uint32_t prodIdx = RS_GET_FIELD(mgr, msgProdIdx);
326 uint32_t consIdx = RS_GET_FIELD(mgr, msgConsIdx);
327
328 return (prodIdx - consIdx) < (mgr->msg_len_mask + 1);
329 }
330
331 static void
332 pvscsi_ring_flush_msg(PVSCSIRingInfo *mgr)
333 {
334 /* Flush descriptor changes */
335 smp_wmb();
336
337 trace_pvscsi_ring_flush_msg(mgr->filled_msg_ptr);
338
339 RS_SET_FIELD(mgr, msgProdIdx, mgr->filled_msg_ptr);
340 }
341
342 static void
343 pvscsi_reset_state(PVSCSIState *s)
344 {
345 s->curr_cmd = PVSCSI_CMD_FIRST;
346 s->curr_cmd_data_cntr = 0;
347 s->reg_command_status = PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
348 s->reg_interrupt_status = 0;
349 pvscsi_ring_cleanup(&s->rings);
350 s->rings_info_valid = FALSE;
351 s->msg_ring_info_valid = FALSE;
352 QTAILQ_INIT(&s->pending_queue);
353 QTAILQ_INIT(&s->completion_queue);
354 }
355
356 static void
357 pvscsi_update_irq_status(PVSCSIState *s)
358 {
359 PCIDevice *d = PCI_DEVICE(s);
360 bool should_raise = s->reg_interrupt_enabled & s->reg_interrupt_status;
361
362 trace_pvscsi_update_irq_level(should_raise, s->reg_interrupt_enabled,
363 s->reg_interrupt_status);
364
365 if (s->msi_used && msi_enabled(d)) {
366 if (should_raise) {
367 trace_pvscsi_update_irq_msi();
368 msi_notify(d, PVSCSI_VECTOR_COMPLETION);
369 }
370 return;
371 }
372
373 pci_set_irq(d, !!should_raise);
374 }
375
376 static void
377 pvscsi_raise_completion_interrupt(PVSCSIState *s)
378 {
379 s->reg_interrupt_status |= PVSCSI_INTR_CMPL_0;
380
381 /* Memory barrier to flush interrupt status register changes*/
382 smp_wmb();
383
384 pvscsi_update_irq_status(s);
385 }
386
387 static void
388 pvscsi_raise_message_interrupt(PVSCSIState *s)
389 {
390 s->reg_interrupt_status |= PVSCSI_INTR_MSG_0;
391
392 /* Memory barrier to flush interrupt status register changes*/
393 smp_wmb();
394
395 pvscsi_update_irq_status(s);
396 }
397
398 static void
399 pvscsi_cmp_ring_put(PVSCSIState *s, struct PVSCSIRingCmpDesc *cmp_desc)
400 {
401 hwaddr cmp_descr_pa;
402
403 cmp_descr_pa = pvscsi_ring_pop_cmp_descr(&s->rings);
404 trace_pvscsi_cmp_ring_put(cmp_descr_pa);
405 cpu_physical_memory_write(cmp_descr_pa, (void *)cmp_desc,
406 sizeof(*cmp_desc));
407 }
408
409 static void
410 pvscsi_msg_ring_put(PVSCSIState *s, struct PVSCSIRingMsgDesc *msg_desc)
411 {
412 hwaddr msg_descr_pa;
413
414 msg_descr_pa = pvscsi_ring_pop_msg_descr(&s->rings);
415 trace_pvscsi_msg_ring_put(msg_descr_pa);
416 cpu_physical_memory_write(msg_descr_pa, (void *)msg_desc,
417 sizeof(*msg_desc));
418 }
419
420 static void
421 pvscsi_process_completion_queue(void *opaque)
422 {
423 PVSCSIState *s = opaque;
424 PVSCSIRequest *pvscsi_req;
425 bool has_completed = false;
426
427 while (!QTAILQ_EMPTY(&s->completion_queue)) {
428 pvscsi_req = QTAILQ_FIRST(&s->completion_queue);
429 QTAILQ_REMOVE(&s->completion_queue, pvscsi_req, next);
430 pvscsi_cmp_ring_put(s, &pvscsi_req->cmp);
431 g_free(pvscsi_req);
432 has_completed = true;
433 }
434
435 if (has_completed) {
436 pvscsi_ring_flush_cmp(&s->rings);
437 pvscsi_raise_completion_interrupt(s);
438 }
439 }
440
441 static void
442 pvscsi_reset_adapter(PVSCSIState *s)
443 {
444 s->resetting++;
445 qbus_reset_all_fn(&s->bus);
446 s->resetting--;
447 pvscsi_process_completion_queue(s);
448 assert(QTAILQ_EMPTY(&s->pending_queue));
449 pvscsi_reset_state(s);
450 }
451
452 static void
453 pvscsi_schedule_completion_processing(PVSCSIState *s)
454 {
455 /* Try putting more complete requests on the ring. */
456 if (!QTAILQ_EMPTY(&s->completion_queue)) {
457 qemu_bh_schedule(s->completion_worker);
458 }
459 }
460
461 static void
462 pvscsi_complete_request(PVSCSIState *s, PVSCSIRequest *r)
463 {
464 assert(!r->completed);
465
466 trace_pvscsi_complete_request(r->cmp.context, r->cmp.dataLen,
467 r->sense_key);
468 if (r->sreq != NULL) {
469 scsi_req_unref(r->sreq);
470 r->sreq = NULL;
471 }
472 r->completed = 1;
473 QTAILQ_REMOVE(&s->pending_queue, r, next);
474 QTAILQ_INSERT_TAIL(&s->completion_queue, r, next);
475 pvscsi_schedule_completion_processing(s);
476 }
477
478 static QEMUSGList *pvscsi_get_sg_list(SCSIRequest *r)
479 {
480 PVSCSIRequest *req = r->hba_private;
481
482 trace_pvscsi_get_sg_list(req->sgl.nsg, req->sgl.size);
483
484 return &req->sgl;
485 }
486
487 static void
488 pvscsi_get_next_sg_elem(PVSCSISGState *sg)
489 {
490 struct PVSCSISGElement elem;
491
492 cpu_physical_memory_read(sg->elemAddr, (void *)&elem, sizeof(elem));
493 if ((elem.flags & ~PVSCSI_KNOWN_FLAGS) != 0) {
494 /*
495 * There is PVSCSI_SGE_FLAG_CHAIN_ELEMENT flag described in
496 * header file but its value is unknown. This flag requires
497 * additional processing, so we put warning here to catch it
498 * some day and make proper implementation
499 */
500 trace_pvscsi_get_next_sg_elem(elem.flags);
501 }
502
503 sg->elemAddr += sizeof(elem);
504 sg->dataAddr = elem.addr;
505 sg->resid = elem.length;
506 }
507
508 static void
509 pvscsi_write_sense(PVSCSIRequest *r, uint8_t *sense, int len)
510 {
511 r->cmp.senseLen = MIN(r->req.senseLen, len);
512 r->sense_key = sense[(sense[0] & 2) ? 1 : 2];
513 cpu_physical_memory_write(r->req.senseAddr, sense, r->cmp.senseLen);
514 }
515
516 static void
517 pvscsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
518 {
519 PVSCSIRequest *pvscsi_req = req->hba_private;
520 PVSCSIState *s;
521
522 if (!pvscsi_req) {
523 trace_pvscsi_command_complete_not_found(req->tag);
524 return;
525 }
526 s = pvscsi_req->dev;
527
528 if (resid) {
529 /* Short transfer. */
530 trace_pvscsi_command_complete_data_run();
531 pvscsi_req->cmp.hostStatus = BTSTAT_DATARUN;
532 }
533
534 pvscsi_req->cmp.scsiStatus = status;
535 if (pvscsi_req->cmp.scsiStatus == CHECK_CONDITION) {
536 uint8_t sense[SCSI_SENSE_BUF_SIZE];
537 int sense_len =
538 scsi_req_get_sense(pvscsi_req->sreq, sense, sizeof(sense));
539
540 trace_pvscsi_command_complete_sense_len(sense_len);
541 pvscsi_write_sense(pvscsi_req, sense, sense_len);
542 }
543 qemu_sglist_destroy(&pvscsi_req->sgl);
544 pvscsi_complete_request(s, pvscsi_req);
545 }
546
547 static void
548 pvscsi_send_msg(PVSCSIState *s, SCSIDevice *dev, uint32_t msg_type)
549 {
550 if (s->msg_ring_info_valid && pvscsi_ring_msg_has_room(&s->rings)) {
551 PVSCSIMsgDescDevStatusChanged msg = {0};
552
553 msg.type = msg_type;
554 msg.bus = dev->channel;
555 msg.target = dev->id;
556 msg.lun[1] = dev->lun;
557
558 pvscsi_msg_ring_put(s, (PVSCSIRingMsgDesc *)&msg);
559 pvscsi_ring_flush_msg(&s->rings);
560 pvscsi_raise_message_interrupt(s);
561 }
562 }
563
564 static void
565 pvscsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev, Error **errp)
566 {
567 PVSCSIState *s = PVSCSI(hotplug_dev);
568
569 pvscsi_send_msg(s, SCSI_DEVICE(dev), PVSCSI_MSG_DEV_ADDED);
570 }
571
572 static void
573 pvscsi_hot_unplug(HotplugHandler *hotplug_dev, DeviceState *dev, Error **errp)
574 {
575 PVSCSIState *s = PVSCSI(hotplug_dev);
576
577 pvscsi_send_msg(s, SCSI_DEVICE(dev), PVSCSI_MSG_DEV_REMOVED);
578 qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
579 }
580
581 static void
582 pvscsi_request_cancelled(SCSIRequest *req)
583 {
584 PVSCSIRequest *pvscsi_req = req->hba_private;
585 PVSCSIState *s = pvscsi_req->dev;
586
587 if (pvscsi_req->completed) {
588 return;
589 }
590
591 if (pvscsi_req->dev->resetting) {
592 pvscsi_req->cmp.hostStatus = BTSTAT_BUSRESET;
593 } else {
594 pvscsi_req->cmp.hostStatus = BTSTAT_ABORTQUEUE;
595 }
596
597 pvscsi_complete_request(s, pvscsi_req);
598 }
599
600 static SCSIDevice*
601 pvscsi_device_find(PVSCSIState *s, int channel, int target,
602 uint8_t *requested_lun, uint8_t *target_lun)
603 {
604 if (requested_lun[0] || requested_lun[2] || requested_lun[3] ||
605 requested_lun[4] || requested_lun[5] || requested_lun[6] ||
606 requested_lun[7] || (target > PVSCSI_MAX_DEVS)) {
607 return NULL;
608 } else {
609 *target_lun = requested_lun[1];
610 return scsi_device_find(&s->bus, channel, target, *target_lun);
611 }
612 }
613
614 static PVSCSIRequest *
615 pvscsi_queue_pending_descriptor(PVSCSIState *s, SCSIDevice **d,
616 struct PVSCSIRingReqDesc *descr)
617 {
618 PVSCSIRequest *pvscsi_req;
619 uint8_t lun;
620
621 pvscsi_req = g_malloc0(sizeof(*pvscsi_req));
622 pvscsi_req->dev = s;
623 pvscsi_req->req = *descr;
624 pvscsi_req->cmp.context = pvscsi_req->req.context;
625 QTAILQ_INSERT_TAIL(&s->pending_queue, pvscsi_req, next);
626
627 *d = pvscsi_device_find(s, descr->bus, descr->target, descr->lun, &lun);
628 if (*d) {
629 pvscsi_req->lun = lun;
630 }
631
632 return pvscsi_req;
633 }
634
635 static void
636 pvscsi_convert_sglist(PVSCSIRequest *r)
637 {
638 int chunk_size;
639 uint64_t data_length = r->req.dataLen;
640 PVSCSISGState sg = r->sg;
641 while (data_length) {
642 while (!sg.resid) {
643 pvscsi_get_next_sg_elem(&sg);
644 trace_pvscsi_convert_sglist(r->req.context, r->sg.dataAddr,
645 r->sg.resid);
646 }
647 assert(data_length > 0);
648 chunk_size = MIN((unsigned) data_length, sg.resid);
649 if (chunk_size) {
650 qemu_sglist_add(&r->sgl, sg.dataAddr, chunk_size);
651 }
652
653 sg.dataAddr += chunk_size;
654 data_length -= chunk_size;
655 sg.resid -= chunk_size;
656 }
657 }
658
659 static void
660 pvscsi_build_sglist(PVSCSIState *s, PVSCSIRequest *r)
661 {
662 PCIDevice *d = PCI_DEVICE(s);
663
664 pci_dma_sglist_init(&r->sgl, d, 1);
665 if (r->req.flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
666 pvscsi_convert_sglist(r);
667 } else {
668 qemu_sglist_add(&r->sgl, r->req.dataAddr, r->req.dataLen);
669 }
670 }
671
672 static void
673 pvscsi_process_request_descriptor(PVSCSIState *s,
674 struct PVSCSIRingReqDesc *descr)
675 {
676 SCSIDevice *d;
677 PVSCSIRequest *r = pvscsi_queue_pending_descriptor(s, &d, descr);
678 int64_t n;
679
680 trace_pvscsi_process_req_descr(descr->cdb[0], descr->context);
681
682 if (!d) {
683 r->cmp.hostStatus = BTSTAT_SELTIMEO;
684 trace_pvscsi_process_req_descr_unknown_device();
685 pvscsi_complete_request(s, r);
686 return;
687 }
688
689 if (descr->flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
690 r->sg.elemAddr = descr->dataAddr;
691 }
692
693 r->sreq = scsi_req_new(d, descr->context, r->lun, descr->cdb, r);
694 if (r->sreq->cmd.mode == SCSI_XFER_FROM_DEV &&
695 (descr->flags & PVSCSI_FLAG_CMD_DIR_TODEVICE)) {
696 r->cmp.hostStatus = BTSTAT_BADMSG;
697 trace_pvscsi_process_req_descr_invalid_dir();
698 scsi_req_cancel(r->sreq);
699 return;
700 }
701 if (r->sreq->cmd.mode == SCSI_XFER_TO_DEV &&
702 (descr->flags & PVSCSI_FLAG_CMD_DIR_TOHOST)) {
703 r->cmp.hostStatus = BTSTAT_BADMSG;
704 trace_pvscsi_process_req_descr_invalid_dir();
705 scsi_req_cancel(r->sreq);
706 return;
707 }
708
709 pvscsi_build_sglist(s, r);
710 n = scsi_req_enqueue(r->sreq);
711
712 if (n) {
713 scsi_req_continue(r->sreq);
714 }
715 }
716
717 static void
718 pvscsi_process_io(PVSCSIState *s)
719 {
720 PVSCSIRingReqDesc descr;
721 hwaddr next_descr_pa;
722
723 assert(s->rings_info_valid);
724 while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
725
726 /* Only read after production index verification */
727 smp_rmb();
728
729 trace_pvscsi_process_io(next_descr_pa);
730 cpu_physical_memory_read(next_descr_pa, &descr, sizeof(descr));
731 pvscsi_process_request_descriptor(s, &descr);
732 }
733
734 pvscsi_ring_flush_req(&s->rings);
735 }
736
737 static void
738 pvscsi_dbg_dump_tx_rings_config(PVSCSICmdDescSetupRings *rc)
739 {
740 int i;
741 trace_pvscsi_tx_rings_ppn("Rings State", rc->ringsStatePPN);
742
743 trace_pvscsi_tx_rings_num_pages("Request Ring", rc->reqRingNumPages);
744 for (i = 0; i < rc->reqRingNumPages; i++) {
745 trace_pvscsi_tx_rings_ppn("Request Ring", rc->reqRingPPNs[i]);
746 }
747
748 trace_pvscsi_tx_rings_num_pages("Confirm Ring", rc->cmpRingNumPages);
749 for (i = 0; i < rc->cmpRingNumPages; i++) {
750 trace_pvscsi_tx_rings_ppn("Confirm Ring", rc->reqRingPPNs[i]);
751 }
752 }
753
754 static uint64_t
755 pvscsi_on_cmd_config(PVSCSIState *s)
756 {
757 trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_CONFIG");
758 return PVSCSI_COMMAND_PROCESSING_FAILED;
759 }
760
761 static uint64_t
762 pvscsi_on_cmd_unplug(PVSCSIState *s)
763 {
764 trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_DEVICE_UNPLUG");
765 return PVSCSI_COMMAND_PROCESSING_FAILED;
766 }
767
768 static uint64_t
769 pvscsi_on_issue_scsi(PVSCSIState *s)
770 {
771 trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_ISSUE_SCSI");
772 return PVSCSI_COMMAND_PROCESSING_FAILED;
773 }
774
775 static uint64_t
776 pvscsi_on_cmd_setup_rings(PVSCSIState *s)
777 {
778 PVSCSICmdDescSetupRings *rc =
779 (PVSCSICmdDescSetupRings *) s->curr_cmd_data;
780
781 trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_RINGS");
782
783 pvscsi_dbg_dump_tx_rings_config(rc);
784 if (pvscsi_ring_init_data(&s->rings, rc) < 0) {
785 return PVSCSI_COMMAND_PROCESSING_FAILED;
786 }
787
788 s->rings_info_valid = TRUE;
789 return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
790 }
791
792 static uint64_t
793 pvscsi_on_cmd_abort(PVSCSIState *s)
794 {
795 PVSCSICmdDescAbortCmd *cmd = (PVSCSICmdDescAbortCmd *) s->curr_cmd_data;
796 PVSCSIRequest *r, *next;
797
798 trace_pvscsi_on_cmd_abort(cmd->context, cmd->target);
799
800 QTAILQ_FOREACH_SAFE(r, &s->pending_queue, next, next) {
801 if (r->req.context == cmd->context) {
802 break;
803 }
804 }
805 if (r) {
806 assert(!r->completed);
807 r->cmp.hostStatus = BTSTAT_ABORTQUEUE;
808 scsi_req_cancel(r->sreq);
809 }
810
811 return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
812 }
813
814 static uint64_t
815 pvscsi_on_cmd_unknown(PVSCSIState *s)
816 {
817 trace_pvscsi_on_cmd_unknown_data(s->curr_cmd_data[0]);
818 return PVSCSI_COMMAND_PROCESSING_FAILED;
819 }
820
821 static uint64_t
822 pvscsi_on_cmd_reset_device(PVSCSIState *s)
823 {
824 uint8_t target_lun = 0;
825 struct PVSCSICmdDescResetDevice *cmd =
826 (struct PVSCSICmdDescResetDevice *) s->curr_cmd_data;
827 SCSIDevice *sdev;
828
829 sdev = pvscsi_device_find(s, 0, cmd->target, cmd->lun, &target_lun);
830
831 trace_pvscsi_on_cmd_reset_dev(cmd->target, (int) target_lun, sdev);
832
833 if (sdev != NULL) {
834 s->resetting++;
835 device_reset(&sdev->qdev);
836 s->resetting--;
837 return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
838 }
839
840 return PVSCSI_COMMAND_PROCESSING_FAILED;
841 }
842
843 static uint64_t
844 pvscsi_on_cmd_reset_bus(PVSCSIState *s)
845 {
846 trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_RESET_BUS");
847
848 s->resetting++;
849 qbus_reset_all_fn(&s->bus);
850 s->resetting--;
851 return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
852 }
853
854 static uint64_t
855 pvscsi_on_cmd_setup_msg_ring(PVSCSIState *s)
856 {
857 PVSCSICmdDescSetupMsgRing *rc =
858 (PVSCSICmdDescSetupMsgRing *) s->curr_cmd_data;
859
860 trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_MSG_RING");
861
862 if (!s->use_msg) {
863 return PVSCSI_COMMAND_PROCESSING_FAILED;
864 }
865
866 if (s->rings_info_valid) {
867 if (pvscsi_ring_init_msg(&s->rings, rc) < 0) {
868 return PVSCSI_COMMAND_PROCESSING_FAILED;
869 }
870 s->msg_ring_info_valid = TRUE;
871 }
872 return sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(uint32_t);
873 }
874
875 static uint64_t
876 pvscsi_on_cmd_adapter_reset(PVSCSIState *s)
877 {
878 trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_ADAPTER_RESET");
879
880 pvscsi_reset_adapter(s);
881 return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
882 }
883
884 static const struct {
885 int data_size;
886 uint64_t (*handler_fn)(PVSCSIState *s);
887 } pvscsi_commands[] = {
888 [PVSCSI_CMD_FIRST] = {
889 .data_size = 0,
890 .handler_fn = pvscsi_on_cmd_unknown,
891 },
892
893 /* Not implemented, data size defined based on what arrives on windows */
894 [PVSCSI_CMD_CONFIG] = {
895 .data_size = 6 * sizeof(uint32_t),
896 .handler_fn = pvscsi_on_cmd_config,
897 },
898
899 /* Command not implemented, data size is unknown */
900 [PVSCSI_CMD_ISSUE_SCSI] = {
901 .data_size = 0,
902 .handler_fn = pvscsi_on_issue_scsi,
903 },
904
905 /* Command not implemented, data size is unknown */
906 [PVSCSI_CMD_DEVICE_UNPLUG] = {
907 .data_size = 0,
908 .handler_fn = pvscsi_on_cmd_unplug,
909 },
910
911 [PVSCSI_CMD_SETUP_RINGS] = {
912 .data_size = sizeof(PVSCSICmdDescSetupRings),
913 .handler_fn = pvscsi_on_cmd_setup_rings,
914 },
915
916 [PVSCSI_CMD_RESET_DEVICE] = {
917 .data_size = sizeof(struct PVSCSICmdDescResetDevice),
918 .handler_fn = pvscsi_on_cmd_reset_device,
919 },
920
921 [PVSCSI_CMD_RESET_BUS] = {
922 .data_size = 0,
923 .handler_fn = pvscsi_on_cmd_reset_bus,
924 },
925
926 [PVSCSI_CMD_SETUP_MSG_RING] = {
927 .data_size = sizeof(PVSCSICmdDescSetupMsgRing),
928 .handler_fn = pvscsi_on_cmd_setup_msg_ring,
929 },
930
931 [PVSCSI_CMD_ADAPTER_RESET] = {
932 .data_size = 0,
933 .handler_fn = pvscsi_on_cmd_adapter_reset,
934 },
935
936 [PVSCSI_CMD_ABORT_CMD] = {
937 .data_size = sizeof(struct PVSCSICmdDescAbortCmd),
938 .handler_fn = pvscsi_on_cmd_abort,
939 },
940 };
941
942 static void
943 pvscsi_do_command_processing(PVSCSIState *s)
944 {
945 size_t bytes_arrived = s->curr_cmd_data_cntr * sizeof(uint32_t);
946
947 assert(s->curr_cmd < PVSCSI_CMD_LAST);
948 if (bytes_arrived >= pvscsi_commands[s->curr_cmd].data_size) {
949 s->reg_command_status = pvscsi_commands[s->curr_cmd].handler_fn(s);
950 s->curr_cmd = PVSCSI_CMD_FIRST;
951 s->curr_cmd_data_cntr = 0;
952 }
953 }
954
955 static void
956 pvscsi_on_command_data(PVSCSIState *s, uint32_t value)
957 {
958 size_t bytes_arrived = s->curr_cmd_data_cntr * sizeof(uint32_t);
959
960 assert(bytes_arrived < sizeof(s->curr_cmd_data));
961 s->curr_cmd_data[s->curr_cmd_data_cntr++] = value;
962
963 pvscsi_do_command_processing(s);
964 }
965
966 static void
967 pvscsi_on_command(PVSCSIState *s, uint64_t cmd_id)
968 {
969 if ((cmd_id > PVSCSI_CMD_FIRST) && (cmd_id < PVSCSI_CMD_LAST)) {
970 s->curr_cmd = cmd_id;
971 } else {
972 s->curr_cmd = PVSCSI_CMD_FIRST;
973 trace_pvscsi_on_cmd_unknown(cmd_id);
974 }
975
976 s->curr_cmd_data_cntr = 0;
977 s->reg_command_status = PVSCSI_COMMAND_NOT_ENOUGH_DATA;
978
979 pvscsi_do_command_processing(s);
980 }
981
982 static void
983 pvscsi_io_write(void *opaque, hwaddr addr,
984 uint64_t val, unsigned size)
985 {
986 PVSCSIState *s = opaque;
987
988 switch (addr) {
989 case PVSCSI_REG_OFFSET_COMMAND:
990 pvscsi_on_command(s, val);
991 break;
992
993 case PVSCSI_REG_OFFSET_COMMAND_DATA:
994 pvscsi_on_command_data(s, (uint32_t) val);
995 break;
996
997 case PVSCSI_REG_OFFSET_INTR_STATUS:
998 trace_pvscsi_io_write("PVSCSI_REG_OFFSET_INTR_STATUS", val);
999 s->reg_interrupt_status &= ~val;
1000 pvscsi_update_irq_status(s);
1001 pvscsi_schedule_completion_processing(s);
1002 break;
1003
1004 case PVSCSI_REG_OFFSET_INTR_MASK:
1005 trace_pvscsi_io_write("PVSCSI_REG_OFFSET_INTR_MASK", val);
1006 s->reg_interrupt_enabled = val;
1007 pvscsi_update_irq_status(s);
1008 break;
1009
1010 case PVSCSI_REG_OFFSET_KICK_NON_RW_IO:
1011 trace_pvscsi_io_write("PVSCSI_REG_OFFSET_KICK_NON_RW_IO", val);
1012 pvscsi_process_io(s);
1013 break;
1014
1015 case PVSCSI_REG_OFFSET_KICK_RW_IO:
1016 trace_pvscsi_io_write("PVSCSI_REG_OFFSET_KICK_RW_IO", val);
1017 pvscsi_process_io(s);
1018 break;
1019
1020 case PVSCSI_REG_OFFSET_DEBUG:
1021 trace_pvscsi_io_write("PVSCSI_REG_OFFSET_DEBUG", val);
1022 break;
1023
1024 default:
1025 trace_pvscsi_io_write_unknown(addr, size, val);
1026 break;
1027 }
1028
1029 }
1030
1031 static uint64_t
1032 pvscsi_io_read(void *opaque, hwaddr addr, unsigned size)
1033 {
1034 PVSCSIState *s = opaque;
1035
1036 switch (addr) {
1037 case PVSCSI_REG_OFFSET_INTR_STATUS:
1038 trace_pvscsi_io_read("PVSCSI_REG_OFFSET_INTR_STATUS",
1039 s->reg_interrupt_status);
1040 return s->reg_interrupt_status;
1041
1042 case PVSCSI_REG_OFFSET_INTR_MASK:
1043 trace_pvscsi_io_read("PVSCSI_REG_OFFSET_INTR_MASK",
1044 s->reg_interrupt_status);
1045 return s->reg_interrupt_enabled;
1046
1047 case PVSCSI_REG_OFFSET_COMMAND_STATUS:
1048 trace_pvscsi_io_read("PVSCSI_REG_OFFSET_COMMAND_STATUS",
1049 s->reg_interrupt_status);
1050 return s->reg_command_status;
1051
1052 default:
1053 trace_pvscsi_io_read_unknown(addr, size);
1054 return 0;
1055 }
1056 }
1057
1058
1059 static bool
1060 pvscsi_init_msi(PVSCSIState *s)
1061 {
1062 int res;
1063 PCIDevice *d = PCI_DEVICE(s);
1064
1065 res = msi_init(d, PVSCSI_MSI_OFFSET(s), PVSCSI_MSIX_NUM_VECTORS,
1066 PVSCSI_USE_64BIT, PVSCSI_PER_VECTOR_MASK);
1067 if (res < 0) {
1068 trace_pvscsi_init_msi_fail(res);
1069 s->msi_used = false;
1070 } else {
1071 s->msi_used = true;
1072 }
1073
1074 return s->msi_used;
1075 }
1076
1077 static void
1078 pvscsi_cleanup_msi(PVSCSIState *s)
1079 {
1080 PCIDevice *d = PCI_DEVICE(s);
1081
1082 if (s->msi_used) {
1083 msi_uninit(d);
1084 }
1085 }
1086
1087 static const MemoryRegionOps pvscsi_ops = {
1088 .read = pvscsi_io_read,
1089 .write = pvscsi_io_write,
1090 .endianness = DEVICE_LITTLE_ENDIAN,
1091 .impl = {
1092 .min_access_size = 4,
1093 .max_access_size = 4,
1094 },
1095 };
1096
1097 static const struct SCSIBusInfo pvscsi_scsi_info = {
1098 .tcq = true,
1099 .max_target = PVSCSI_MAX_DEVS,
1100 .max_channel = 0,
1101 .max_lun = 0,
1102
1103 .get_sg_list = pvscsi_get_sg_list,
1104 .complete = pvscsi_command_complete,
1105 .cancel = pvscsi_request_cancelled,
1106 };
1107
1108 static int
1109 pvscsi_init(PCIDevice *pci_dev)
1110 {
1111 PVSCSIState *s = PVSCSI(pci_dev);
1112
1113 trace_pvscsi_state("init");
1114
1115 /* PCI subsystem ID, subsystem vendor ID, revision */
1116 if (PVSCSI_USE_OLD_PCI_CONFIGURATION(s)) {
1117 pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID, 0x1000);
1118 } else {
1119 pci_set_word(pci_dev->config + PCI_SUBSYSTEM_VENDOR_ID,
1120 PCI_VENDOR_ID_VMWARE);
1121 pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID,
1122 PCI_DEVICE_ID_VMWARE_PVSCSI);
1123 pci_config_set_revision(pci_dev->config, 0x2);
1124 }
1125
1126 /* PCI latency timer = 255 */
1127 pci_dev->config[PCI_LATENCY_TIMER] = 0xff;
1128
1129 /* Interrupt pin A */
1130 pci_config_set_interrupt_pin(pci_dev->config, 1);
1131
1132 memory_region_init_io(&s->io_space, OBJECT(s), &pvscsi_ops, s,
1133 "pvscsi-io", PVSCSI_MEM_SPACE_SIZE);
1134 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io_space);
1135
1136 pvscsi_init_msi(s);
1137
1138 if (pci_is_express(pci_dev) && pci_bus_is_express(pci_dev->bus)) {
1139 pcie_endpoint_cap_init(pci_dev, PVSCSI_EXP_EP_OFFSET);
1140 }
1141
1142 s->completion_worker = qemu_bh_new(pvscsi_process_completion_queue, s);
1143 if (!s->completion_worker) {
1144 pvscsi_cleanup_msi(s);
1145 return -ENOMEM;
1146 }
1147
1148 scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(pci_dev),
1149 &pvscsi_scsi_info, NULL);
1150 /* override default SCSI bus hotplug-handler, with pvscsi's one */
1151 qbus_set_hotplug_handler(BUS(&s->bus), DEVICE(s), &error_abort);
1152 pvscsi_reset_state(s);
1153
1154 return 0;
1155 }
1156
1157 static void
1158 pvscsi_uninit(PCIDevice *pci_dev)
1159 {
1160 PVSCSIState *s = PVSCSI(pci_dev);
1161
1162 trace_pvscsi_state("uninit");
1163 qemu_bh_delete(s->completion_worker);
1164
1165 pvscsi_cleanup_msi(s);
1166 }
1167
1168 static void
1169 pvscsi_reset(DeviceState *dev)
1170 {
1171 PCIDevice *d = PCI_DEVICE(dev);
1172 PVSCSIState *s = PVSCSI(d);
1173
1174 trace_pvscsi_state("reset");
1175 pvscsi_reset_adapter(s);
1176 }
1177
1178 static void
1179 pvscsi_pre_save(void *opaque)
1180 {
1181 PVSCSIState *s = (PVSCSIState *) opaque;
1182
1183 trace_pvscsi_state("presave");
1184
1185 assert(QTAILQ_EMPTY(&s->pending_queue));
1186 assert(QTAILQ_EMPTY(&s->completion_queue));
1187 }
1188
1189 static int
1190 pvscsi_post_load(void *opaque, int version_id)
1191 {
1192 trace_pvscsi_state("postload");
1193 return 0;
1194 }
1195
1196 static bool pvscsi_vmstate_need_pcie_device(void *opaque)
1197 {
1198 PVSCSIState *s = PVSCSI(opaque);
1199
1200 return !(s->compat_flags & PVSCSI_COMPAT_DISABLE_PCIE);
1201 }
1202
1203 static bool pvscsi_vmstate_test_pci_device(void *opaque, int version_id)
1204 {
1205 return !pvscsi_vmstate_need_pcie_device(opaque);
1206 }
1207
1208 static const VMStateDescription vmstate_pvscsi_pcie_device = {
1209 .name = "pvscsi/pcie",
1210 .needed = pvscsi_vmstate_need_pcie_device,
1211 .fields = (VMStateField[]) {
1212 VMSTATE_PCIE_DEVICE(parent_obj, PVSCSIState),
1213 VMSTATE_END_OF_LIST()
1214 }
1215 };
1216
1217 static const VMStateDescription vmstate_pvscsi = {
1218 .name = "pvscsi",
1219 .version_id = 0,
1220 .minimum_version_id = 0,
1221 .pre_save = pvscsi_pre_save,
1222 .post_load = pvscsi_post_load,
1223 .fields = (VMStateField[]) {
1224 VMSTATE_STRUCT_TEST(parent_obj, PVSCSIState,
1225 pvscsi_vmstate_test_pci_device, 0,
1226 vmstate_pci_device, PCIDevice),
1227 VMSTATE_UINT8(msi_used, PVSCSIState),
1228 VMSTATE_UINT32(resetting, PVSCSIState),
1229 VMSTATE_UINT64(reg_interrupt_status, PVSCSIState),
1230 VMSTATE_UINT64(reg_interrupt_enabled, PVSCSIState),
1231 VMSTATE_UINT64(reg_command_status, PVSCSIState),
1232 VMSTATE_UINT64(curr_cmd, PVSCSIState),
1233 VMSTATE_UINT32(curr_cmd_data_cntr, PVSCSIState),
1234 VMSTATE_UINT32_ARRAY(curr_cmd_data, PVSCSIState,
1235 ARRAY_SIZE(((PVSCSIState *)NULL)->curr_cmd_data)),
1236 VMSTATE_UINT8(rings_info_valid, PVSCSIState),
1237 VMSTATE_UINT8(msg_ring_info_valid, PVSCSIState),
1238 VMSTATE_UINT8(use_msg, PVSCSIState),
1239
1240 VMSTATE_UINT64(rings.rs_pa, PVSCSIState),
1241 VMSTATE_UINT32(rings.txr_len_mask, PVSCSIState),
1242 VMSTATE_UINT32(rings.rxr_len_mask, PVSCSIState),
1243 VMSTATE_UINT64_ARRAY(rings.req_ring_pages_pa, PVSCSIState,
1244 PVSCSI_SETUP_RINGS_MAX_NUM_PAGES),
1245 VMSTATE_UINT64_ARRAY(rings.cmp_ring_pages_pa, PVSCSIState,
1246 PVSCSI_SETUP_RINGS_MAX_NUM_PAGES),
1247 VMSTATE_UINT64(rings.consumed_ptr, PVSCSIState),
1248 VMSTATE_UINT64(rings.filled_cmp_ptr, PVSCSIState),
1249
1250 VMSTATE_END_OF_LIST()
1251 },
1252 .subsections = (const VMStateDescription*[]) {
1253 &vmstate_pvscsi_pcie_device,
1254 NULL
1255 }
1256 };
1257
1258 static Property pvscsi_properties[] = {
1259 DEFINE_PROP_UINT8("use_msg", PVSCSIState, use_msg, 1),
1260 DEFINE_PROP_BIT("x-old-pci-configuration", PVSCSIState, compat_flags,
1261 PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT, false),
1262 DEFINE_PROP_BIT("x-disable-pcie", PVSCSIState, compat_flags,
1263 PVSCSI_COMPAT_DISABLE_PCIE_BIT, false),
1264 DEFINE_PROP_END_OF_LIST(),
1265 };
1266
1267 static void pvscsi_realize(DeviceState *qdev, Error **errp)
1268 {
1269 PVSCSIClass *pvs_c = PVSCSI_DEVICE_GET_CLASS(qdev);
1270 PCIDevice *pci_dev = PCI_DEVICE(qdev);
1271 PVSCSIState *s = PVSCSI(qdev);
1272
1273 if (!(s->compat_flags & PVSCSI_COMPAT_DISABLE_PCIE)) {
1274 pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
1275 }
1276
1277 pvs_c->parent_dc_realize(qdev, errp);
1278 }
1279
1280 static void pvscsi_class_init(ObjectClass *klass, void *data)
1281 {
1282 DeviceClass *dc = DEVICE_CLASS(klass);
1283 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1284 PVSCSIClass *pvs_k = PVSCSI_DEVICE_CLASS(klass);
1285 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
1286
1287 k->init = pvscsi_init;
1288 k->exit = pvscsi_uninit;
1289 k->vendor_id = PCI_VENDOR_ID_VMWARE;
1290 k->device_id = PCI_DEVICE_ID_VMWARE_PVSCSI;
1291 k->class_id = PCI_CLASS_STORAGE_SCSI;
1292 k->subsystem_id = 0x1000;
1293 pvs_k->parent_dc_realize = dc->realize;
1294 dc->realize = pvscsi_realize;
1295 dc->reset = pvscsi_reset;
1296 dc->vmsd = &vmstate_pvscsi;
1297 dc->props = pvscsi_properties;
1298 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1299 hc->unplug = pvscsi_hot_unplug;
1300 hc->plug = pvscsi_hotplug;
1301 }
1302
1303 static const TypeInfo pvscsi_info = {
1304 .name = TYPE_PVSCSI,
1305 .parent = TYPE_PCI_DEVICE,
1306 .class_size = sizeof(PVSCSIClass),
1307 .instance_size = sizeof(PVSCSIState),
1308 .class_init = pvscsi_class_init,
1309 .interfaces = (InterfaceInfo[]) {
1310 { TYPE_HOTPLUG_HANDLER },
1311 { }
1312 }
1313 };
1314
1315 static void
1316 pvscsi_register_types(void)
1317 {
1318 type_register_static(&pvscsi_info);
1319 }
1320
1321 type_init(pvscsi_register_types);