hw/scsi/vmw_pvscsi.c

   1 /*
   2  * QEMU VMWARE PVSCSI paravirtual SCSI bus
   3  *
   4  * Copyright (c) 2012 Ravello Systems LTD (http://ravellosystems.com)
   5  *
   6  * Developed by Daynix Computing LTD (http://www.daynix.com)
   7  *
   8  * Based on implementation by Paolo Bonzini
   9  * http://lists.gnu.org/archive/html/qemu-devel/2011-08/msg00729.html
  10  *
  11  * Authors:
  12  * Paolo Bonzini <[email protected]>
  13  * Dmitry Fleytman <[email protected]>
  14  * Yan Vugenfirer <[email protected]>
  15  *
  16  * This work is licensed under the terms of the GNU GPL, version 2.
  17  * See the COPYING file in the top-level directory.
  18  *
  19  * NOTE about MSI-X:
  20  * MSI-X support has been removed for the moment because it leads Windows OS
  21  * to crash on startup. The crash happens because Windows driver requires
  22  * MSI-X shared memory to be part of the same BAR used for rings state
  23  * registers, etc. This is not supported by QEMU infrastructure so separate
  24  * BAR created from MSI-X purposes. Windows driver fails to deal with 2 BARs.
  25  *
  26  */
  27
  28 #include "qemu/osdep.h"
  29 #include "qapi/error.h"
  30 #include "qemu/main-loop.h"
  31 #include "qemu/module.h"
  32 #include "hw/scsi/scsi.h"
  33 #include "migration/vmstate.h"
  34 #include "scsi/constants.h"
  35 #include "hw/pci/msi.h"
  36 #include "vmw_pvscsi.h"
  37 #include "trace.h"
  38
  39
  40 #define PVSCSI_USE_64BIT         (true)
  41 #define PVSCSI_PER_VECTOR_MASK   (false)
  42
  43 #define PVSCSI_MAX_DEVS                   (64)
  44 #define PVSCSI_MSIX_NUM_VECTORS           (1)
  45
  46 #define PVSCSI_MAX_SG_ELEM                2048
  47
  48 #define PVSCSI_MAX_CMD_DATA_WORDS \
  49     (sizeof(PVSCSICmdDescSetupRings)/sizeof(uint32_t))
  50
  51 #define RS_GET_FIELD(m, field) \
  52     (ldl_le_pci_dma(&container_of(m, PVSCSIState, rings)->parent_obj, \
  53                  (m)->rs_pa + offsetof(struct PVSCSIRingsState, field)))
  54 #define RS_SET_FIELD(m, field, val) \
  55     (stl_le_pci_dma(&container_of(m, PVSCSIState, rings)->parent_obj, \
  56                  (m)->rs_pa + offsetof(struct PVSCSIRingsState, field), val))
  57
  58 typedef struct PVSCSIClass {
  59     PCIDeviceClass parent_class;
  60     DeviceRealize parent_dc_realize;
  61 } PVSCSIClass;
  62
  63 #define TYPE_PVSCSI "pvscsi"
  64 #define PVSCSI(obj) OBJECT_CHECK(PVSCSIState, (obj), TYPE_PVSCSI)
  65
  66 #define PVSCSI_DEVICE_CLASS(klass) \
  67     OBJECT_CLASS_CHECK(PVSCSIClass, (klass), TYPE_PVSCSI)
  68 #define PVSCSI_DEVICE_GET_CLASS(obj) \
  69     OBJECT_GET_CLASS(PVSCSIClass, (obj), TYPE_PVSCSI)
  70
  71 /* Compatibility flags for migration */
  72 #define PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT 0
  73 #define PVSCSI_COMPAT_OLD_PCI_CONFIGURATION \
  74     (1 << PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT)
  75 #define PVSCSI_COMPAT_DISABLE_PCIE_BIT 1
  76 #define PVSCSI_COMPAT_DISABLE_PCIE \
  77     (1 << PVSCSI_COMPAT_DISABLE_PCIE_BIT)
  78
  79 #define PVSCSI_USE_OLD_PCI_CONFIGURATION(s) \
  80     ((s)->compat_flags & PVSCSI_COMPAT_OLD_PCI_CONFIGURATION)
  81 #define PVSCSI_MSI_OFFSET(s) \
  82     (PVSCSI_USE_OLD_PCI_CONFIGURATION(s) ? 0x50 : 0x7c)
  83 #define PVSCSI_EXP_EP_OFFSET (0x40)
  84
  85 typedef struct PVSCSIRingInfo {
  86     uint64_t            rs_pa;
  87     uint32_t            txr_len_mask;
  88     uint32_t            rxr_len_mask;
  89     uint32_t            msg_len_mask;
  90     uint64_t            req_ring_pages_pa[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
  91     uint64_t            cmp_ring_pages_pa[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
  92     uint64_t            msg_ring_pages_pa[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
  93     uint64_t            consumed_ptr;
  94     uint64_t            filled_cmp_ptr;
  95     uint64_t            filled_msg_ptr;
  96 } PVSCSIRingInfo;
  97
  98 typedef struct PVSCSISGState {
  99     hwaddr elemAddr;
 100     hwaddr dataAddr;
 101     uint32_t resid;
 102 } PVSCSISGState;
 103
 104 typedef QTAILQ_HEAD(, PVSCSIRequest) PVSCSIRequestList;
 105
 106 typedef struct {
 107     PCIDevice parent_obj;
 108     MemoryRegion io_space;
 109     SCSIBus bus;
 110     QEMUBH *completion_worker;
 111     PVSCSIRequestList pending_queue;
 112     PVSCSIRequestList completion_queue;
 113
 114     uint64_t reg_interrupt_status;        /* Interrupt status register value */
 115     uint64_t reg_interrupt_enabled;       /* Interrupt mask register value   */
 116     uint64_t reg_command_status;          /* Command status register value   */
 117
 118     /* Command data adoption mechanism */
 119     uint64_t curr_cmd;                   /* Last command arrived             */
 120     uint32_t curr_cmd_data_cntr;         /* Amount of data for last command  */
 121
 122     /* Collector for current command data */
 123     uint32_t curr_cmd_data[PVSCSI_MAX_CMD_DATA_WORDS];
 124
 125     uint8_t rings_info_valid;            /* Whether data rings initialized   */
 126     uint8_t msg_ring_info_valid;         /* Whether message ring initialized */
 127     uint8_t use_msg;                     /* Whether to use message ring      */
 128
 129     uint8_t msi_used;                    /* For migration compatibility      */
 130     PVSCSIRingInfo rings;                /* Data transfer rings manager      */
 131     uint32_t resetting;                  /* Reset in progress                */
 132
 133     uint32_t compat_flags;
 134 } PVSCSIState;
 135
 136 typedef struct PVSCSIRequest {
 137     SCSIRequest *sreq;
 138     PVSCSIState *dev;
 139     uint8_t sense_key;
 140     uint8_t completed;
 141     int lun;
 142     QEMUSGList sgl;
 143     PVSCSISGState sg;
 144     struct PVSCSIRingReqDesc req;
 145     struct PVSCSIRingCmpDesc cmp;
 146     QTAILQ_ENTRY(PVSCSIRequest) next;
 147 } PVSCSIRequest;
 148
 149 /* Integer binary logarithm */
 150 static int
 151 pvscsi_log2(uint32_t input)
 152 {
 153     int log = 0;
 154     assert(input > 0);
 155     while (input >> ++log) {
 156     }
 157     return log;
 158 }
 159
 160 static void
 161 pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
 162 {
 163     int i;
 164     uint32_t txr_len_log2, rxr_len_log2;
 165     uint32_t req_ring_size, cmp_ring_size;
 166     m->rs_pa = ri->ringsStatePPN << VMW_PAGE_SHIFT;
 167
 168     req_ring_size = ri->reqRingNumPages * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
 169     cmp_ring_size = ri->cmpRingNumPages * PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
 170     txr_len_log2 = pvscsi_log2(req_ring_size - 1);
 171     rxr_len_log2 = pvscsi_log2(cmp_ring_size - 1);
 172
 173     m->txr_len_mask = MASK(txr_len_log2);
 174     m->rxr_len_mask = MASK(rxr_len_log2);
 175
 176     m->consumed_ptr = 0;
 177     m->filled_cmp_ptr = 0;
 178
 179     for (i = 0; i < ri->reqRingNumPages; i++) {
 180         m->req_ring_pages_pa[i] = ri->reqRingPPNs[i] << VMW_PAGE_SHIFT;
 181     }
 182
 183     for (i = 0; i < ri->cmpRingNumPages; i++) {
 184         m->cmp_ring_pages_pa[i] = ri->cmpRingPPNs[i] << VMW_PAGE_SHIFT;
 185     }
 186
 187     RS_SET_FIELD(m, reqProdIdx, 0);
 188     RS_SET_FIELD(m, reqConsIdx, 0);
 189     RS_SET_FIELD(m, reqNumEntriesLog2, txr_len_log2);
 190
 191     RS_SET_FIELD(m, cmpProdIdx, 0);
 192     RS_SET_FIELD(m, cmpConsIdx, 0);
 193     RS_SET_FIELD(m, cmpNumEntriesLog2, rxr_len_log2);
 194
 195     trace_pvscsi_ring_init_data(txr_len_log2, rxr_len_log2);
 196
 197     /* Flush ring state page changes */
 198     smp_wmb();
 199 }
 200
 201 static int
 202 pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
 203 {
 204     int i;
 205     uint32_t len_log2;
 206     uint32_t ring_size;
 207
 208     if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
 209         return -1;
 210     }
 211     ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
 212     len_log2 = pvscsi_log2(ring_size - 1);
 213
 214     m->msg_len_mask = MASK(len_log2);
 215
 216     m->filled_msg_ptr = 0;
 217
 218     for (i = 0; i < ri->numPages; i++) {
 219         m->msg_ring_pages_pa[i] = ri->ringPPNs[i] << VMW_PAGE_SHIFT;
 220     }
 221
 222     RS_SET_FIELD(m, msgProdIdx, 0);
 223     RS_SET_FIELD(m, msgConsIdx, 0);
 224     RS_SET_FIELD(m, msgNumEntriesLog2, len_log2);
 225
 226     trace_pvscsi_ring_init_msg(len_log2);
 227
 228     /* Flush ring state page changes */
 229     smp_wmb();
 230
 231     return 0;
 232 }
 233
 234 static void
 235 pvscsi_ring_cleanup(PVSCSIRingInfo *mgr)
 236 {
 237     mgr->rs_pa = 0;
 238     mgr->txr_len_mask = 0;
 239     mgr->rxr_len_mask = 0;
 240     mgr->msg_len_mask = 0;
 241     mgr->consumed_ptr = 0;
 242     mgr->filled_cmp_ptr = 0;
 243     mgr->filled_msg_ptr = 0;
 244     memset(mgr->req_ring_pages_pa, 0, sizeof(mgr->req_ring_pages_pa));
 245     memset(mgr->cmp_ring_pages_pa, 0, sizeof(mgr->cmp_ring_pages_pa));
 246     memset(mgr->msg_ring_pages_pa, 0, sizeof(mgr->msg_ring_pages_pa));
 247 }
 248
 249 static hwaddr
 250 pvscsi_ring_pop_req_descr(PVSCSIRingInfo *mgr)
 251 {
 252     uint32_t ready_ptr = RS_GET_FIELD(mgr, reqProdIdx);
 253     uint32_t ring_size = PVSCSI_MAX_NUM_PAGES_REQ_RING
 254                             * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
 255
 256     if (ready_ptr != mgr->consumed_ptr
 257         && ready_ptr - mgr->consumed_ptr < ring_size) {
 258         uint32_t next_ready_ptr =
 259             mgr->consumed_ptr++ & mgr->txr_len_mask;
 260         uint32_t next_ready_page =
 261             next_ready_ptr / PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
 262         uint32_t inpage_idx =
 263             next_ready_ptr % PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
 264
 265         return mgr->req_ring_pages_pa[next_ready_page] +
 266                inpage_idx * sizeof(PVSCSIRingReqDesc);
 267     } else {
 268         return 0;
 269     }
 270 }
 271
 272 static void
 273 pvscsi_ring_flush_req(PVSCSIRingInfo *mgr)
 274 {
 275     RS_SET_FIELD(mgr, reqConsIdx, mgr->consumed_ptr);
 276 }
 277
 278 static hwaddr
 279 pvscsi_ring_pop_cmp_descr(PVSCSIRingInfo *mgr)
 280 {
 281     /*
 282      * According to Linux driver code it explicitly verifies that number
 283      * of requests being processed by device is less then the size of
 284      * completion queue, so device may omit completion queue overflow
 285      * conditions check. We assume that this is true for other (Windows)
 286      * drivers as well.
 287      */
 288
 289     uint32_t free_cmp_ptr =
 290         mgr->filled_cmp_ptr++ & mgr->rxr_len_mask;
 291     uint32_t free_cmp_page =
 292         free_cmp_ptr / PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
 293     uint32_t inpage_idx =
 294         free_cmp_ptr % PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
 295     return mgr->cmp_ring_pages_pa[free_cmp_page] +
 296            inpage_idx * sizeof(PVSCSIRingCmpDesc);
 297 }
 298
 299 static hwaddr
 300 pvscsi_ring_pop_msg_descr(PVSCSIRingInfo *mgr)
 301 {
 302     uint32_t free_msg_ptr =
 303         mgr->filled_msg_ptr++ & mgr->msg_len_mask;
 304     uint32_t free_msg_page =
 305         free_msg_ptr / PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
 306     uint32_t inpage_idx =
 307         free_msg_ptr % PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
 308     return mgr->msg_ring_pages_pa[free_msg_page] +
 309            inpage_idx * sizeof(PVSCSIRingMsgDesc);
 310 }
 311
 312 static void
 313 pvscsi_ring_flush_cmp(PVSCSIRingInfo *mgr)
 314 {
 315     /* Flush descriptor changes */
 316     smp_wmb();
 317
 318     trace_pvscsi_ring_flush_cmp(mgr->filled_cmp_ptr);
 319
 320     RS_SET_FIELD(mgr, cmpProdIdx, mgr->filled_cmp_ptr);
 321 }
 322
 323 static bool
 324 pvscsi_ring_msg_has_room(PVSCSIRingInfo *mgr)
 325 {
 326     uint32_t prodIdx = RS_GET_FIELD(mgr, msgProdIdx);
 327     uint32_t consIdx = RS_GET_FIELD(mgr, msgConsIdx);
 328
 329     return (prodIdx - consIdx) < (mgr->msg_len_mask + 1);
 330 }
 331
 332 static void
 333 pvscsi_ring_flush_msg(PVSCSIRingInfo *mgr)
 334 {
 335     /* Flush descriptor changes */
 336     smp_wmb();
 337
 338     trace_pvscsi_ring_flush_msg(mgr->filled_msg_ptr);
 339
 340     RS_SET_FIELD(mgr, msgProdIdx, mgr->filled_msg_ptr);
 341 }
 342
 343 static void
 344 pvscsi_reset_state(PVSCSIState *s)
 345 {
 346     s->curr_cmd = PVSCSI_CMD_FIRST;
 347     s->curr_cmd_data_cntr = 0;
 348     s->reg_command_status = PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 349     s->reg_interrupt_status = 0;
 350     pvscsi_ring_cleanup(&s->rings);
 351     s->rings_info_valid = FALSE;
 352     s->msg_ring_info_valid = FALSE;
 353     QTAILQ_INIT(&s->pending_queue);
 354     QTAILQ_INIT(&s->completion_queue);
 355 }
 356
 357 static void
 358 pvscsi_update_irq_status(PVSCSIState *s)
 359 {
 360     PCIDevice *d = PCI_DEVICE(s);
 361     bool should_raise = s->reg_interrupt_enabled & s->reg_interrupt_status;
 362
 363     trace_pvscsi_update_irq_level(should_raise, s->reg_interrupt_enabled,
 364                                   s->reg_interrupt_status);
 365
 366     if (msi_enabled(d)) {
 367         if (should_raise) {
 368             trace_pvscsi_update_irq_msi();
 369             msi_notify(d, PVSCSI_VECTOR_COMPLETION);
 370         }
 371         return;
 372     }
 373
 374     pci_set_irq(d, !!should_raise);
 375 }
 376
 377 static void
 378 pvscsi_raise_completion_interrupt(PVSCSIState *s)
 379 {
 380     s->reg_interrupt_status |= PVSCSI_INTR_CMPL_0;
 381
 382     /* Memory barrier to flush interrupt status register changes*/
 383     smp_wmb();
 384
 385     pvscsi_update_irq_status(s);
 386 }
 387
 388 static void
 389 pvscsi_raise_message_interrupt(PVSCSIState *s)
 390 {
 391     s->reg_interrupt_status |= PVSCSI_INTR_MSG_0;
 392
 393     /* Memory barrier to flush interrupt status register changes*/
 394     smp_wmb();
 395
 396     pvscsi_update_irq_status(s);
 397 }
 398
 399 static void
 400 pvscsi_cmp_ring_put(PVSCSIState *s, struct PVSCSIRingCmpDesc *cmp_desc)
 401 {
 402     hwaddr cmp_descr_pa;
 403
 404     cmp_descr_pa = pvscsi_ring_pop_cmp_descr(&s->rings);
 405     trace_pvscsi_cmp_ring_put(cmp_descr_pa);
 406     cpu_physical_memory_write(cmp_descr_pa, (void *)cmp_desc,
 407                               sizeof(*cmp_desc));
 408 }
 409
 410 static void
 411 pvscsi_msg_ring_put(PVSCSIState *s, struct PVSCSIRingMsgDesc *msg_desc)
 412 {
 413     hwaddr msg_descr_pa;
 414
 415     msg_descr_pa = pvscsi_ring_pop_msg_descr(&s->rings);
 416     trace_pvscsi_msg_ring_put(msg_descr_pa);
 417     cpu_physical_memory_write(msg_descr_pa, (void *)msg_desc,
 418                               sizeof(*msg_desc));
 419 }
 420
 421 static void
 422 pvscsi_process_completion_queue(void *opaque)
 423 {
 424     PVSCSIState *s = opaque;
 425     PVSCSIRequest *pvscsi_req;
 426     bool has_completed = false;
 427
 428     while (!QTAILQ_EMPTY(&s->completion_queue)) {
 429         pvscsi_req = QTAILQ_FIRST(&s->completion_queue);
 430         QTAILQ_REMOVE(&s->completion_queue, pvscsi_req, next);
 431         pvscsi_cmp_ring_put(s, &pvscsi_req->cmp);
 432         g_free(pvscsi_req);
 433         has_completed = true;
 434     }
 435
 436     if (has_completed) {
 437         pvscsi_ring_flush_cmp(&s->rings);
 438         pvscsi_raise_completion_interrupt(s);
 439     }
 440 }
 441
 442 static void
 443 pvscsi_reset_adapter(PVSCSIState *s)
 444 {
 445     s->resetting++;
 446     qbus_reset_all(BUS(&s->bus));
 447     s->resetting--;
 448     pvscsi_process_completion_queue(s);
 449     assert(QTAILQ_EMPTY(&s->pending_queue));
 450     pvscsi_reset_state(s);
 451 }
 452
 453 static void
 454 pvscsi_schedule_completion_processing(PVSCSIState *s)
 455 {
 456     /* Try putting more complete requests on the ring. */
 457     if (!QTAILQ_EMPTY(&s->completion_queue)) {
 458         qemu_bh_schedule(s->completion_worker);
 459     }
 460 }
 461
 462 static void
 463 pvscsi_complete_request(PVSCSIState *s, PVSCSIRequest *r)
 464 {
 465     assert(!r->completed);
 466
 467     trace_pvscsi_complete_request(r->cmp.context, r->cmp.dataLen,
 468                                   r->sense_key);
 469     if (r->sreq != NULL) {
 470         scsi_req_unref(r->sreq);
 471         r->sreq = NULL;
 472     }
 473     r->completed = 1;
 474     QTAILQ_REMOVE(&s->pending_queue, r, next);
 475     QTAILQ_INSERT_TAIL(&s->completion_queue, r, next);
 476     pvscsi_schedule_completion_processing(s);
 477 }
 478
 479 static QEMUSGList *pvscsi_get_sg_list(SCSIRequest *r)
 480 {
 481     PVSCSIRequest *req = r->hba_private;
 482
 483     trace_pvscsi_get_sg_list(req->sgl.nsg, req->sgl.size);
 484
 485     return &req->sgl;
 486 }
 487
 488 static void
 489 pvscsi_get_next_sg_elem(PVSCSISGState *sg)
 490 {
 491     struct PVSCSISGElement elem;
 492
 493     cpu_physical_memory_read(sg->elemAddr, (void *)&elem, sizeof(elem));
 494     if ((elem.flags & ~PVSCSI_KNOWN_FLAGS) != 0) {
 495         /*
 496             * There is PVSCSI_SGE_FLAG_CHAIN_ELEMENT flag described in
 497             * header file but its value is unknown. This flag requires
 498             * additional processing, so we put warning here to catch it
 499             * some day and make proper implementation
 500             */
 501         trace_pvscsi_get_next_sg_elem(elem.flags);
 502     }
 503
 504     sg->elemAddr += sizeof(elem);
 505     sg->dataAddr = elem.addr;
 506     sg->resid = elem.length;
 507 }
 508
 509 static void
 510 pvscsi_write_sense(PVSCSIRequest *r, uint8_t *sense, int len)
 511 {
 512     r->cmp.senseLen = MIN(r->req.senseLen, len);
 513     r->sense_key = sense[(sense[0] & 2) ? 1 : 2];
 514     cpu_physical_memory_write(r->req.senseAddr, sense, r->cmp.senseLen);
 515 }
 516
 517 static void
 518 pvscsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
 519 {
 520     PVSCSIRequest *pvscsi_req = req->hba_private;
 521     PVSCSIState *s;
 522
 523     if (!pvscsi_req) {
 524         trace_pvscsi_command_complete_not_found(req->tag);
 525         return;
 526     }
 527     s = pvscsi_req->dev;
 528
 529     if (resid) {
 530         /* Short transfer.  */
 531         trace_pvscsi_command_complete_data_run();
 532         pvscsi_req->cmp.hostStatus = BTSTAT_DATARUN;
 533     }
 534
 535     pvscsi_req->cmp.scsiStatus = status;
 536     if (pvscsi_req->cmp.scsiStatus == CHECK_CONDITION) {
 537         uint8_t sense[SCSI_SENSE_BUF_SIZE];
 538         int sense_len =
 539             scsi_req_get_sense(pvscsi_req->sreq, sense, sizeof(sense));
 540
 541         trace_pvscsi_command_complete_sense_len(sense_len);
 542         pvscsi_write_sense(pvscsi_req, sense, sense_len);
 543     }
 544     qemu_sglist_destroy(&pvscsi_req->sgl);
 545     pvscsi_complete_request(s, pvscsi_req);
 546 }
 547
 548 static void
 549 pvscsi_send_msg(PVSCSIState *s, SCSIDevice *dev, uint32_t msg_type)
 550 {
 551     if (s->msg_ring_info_valid && pvscsi_ring_msg_has_room(&s->rings)) {
 552         PVSCSIMsgDescDevStatusChanged msg = {0};
 553
 554         msg.type = msg_type;
 555         msg.bus = dev->channel;
 556         msg.target = dev->id;
 557         msg.lun[1] = dev->lun;
 558
 559         pvscsi_msg_ring_put(s, (PVSCSIRingMsgDesc *)&msg);
 560         pvscsi_ring_flush_msg(&s->rings);
 561         pvscsi_raise_message_interrupt(s);
 562     }
 563 }
 564
 565 static void
 566 pvscsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev, Error **errp)
 567 {
 568     PVSCSIState *s = PVSCSI(hotplug_dev);
 569
 570     pvscsi_send_msg(s, SCSI_DEVICE(dev), PVSCSI_MSG_DEV_ADDED);
 571 }
 572
 573 static void
 574 pvscsi_hot_unplug(HotplugHandler *hotplug_dev, DeviceState *dev, Error **errp)
 575 {
 576     PVSCSIState *s = PVSCSI(hotplug_dev);
 577
 578     pvscsi_send_msg(s, SCSI_DEVICE(dev), PVSCSI_MSG_DEV_REMOVED);
 579     qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
 580 }
 581
 582 static void
 583 pvscsi_request_cancelled(SCSIRequest *req)
 584 {
 585     PVSCSIRequest *pvscsi_req = req->hba_private;
 586     PVSCSIState *s = pvscsi_req->dev;
 587
 588     if (pvscsi_req->completed) {
 589         return;
 590     }
 591
 592    if (pvscsi_req->dev->resetting) {
 593        pvscsi_req->cmp.hostStatus = BTSTAT_BUSRESET;
 594     } else {
 595        pvscsi_req->cmp.hostStatus = BTSTAT_ABORTQUEUE;
 596     }
 597
 598     pvscsi_complete_request(s, pvscsi_req);
 599 }
 600
 601 static SCSIDevice*
 602 pvscsi_device_find(PVSCSIState *s, int channel, int target,
 603                    uint8_t *requested_lun, uint8_t *target_lun)
 604 {
 605     if (requested_lun[0] || requested_lun[2] || requested_lun[3] ||
 606         requested_lun[4] || requested_lun[5] || requested_lun[6] ||
 607         requested_lun[7] || (target > PVSCSI_MAX_DEVS)) {
 608         return NULL;
 609     } else {
 610         *target_lun = requested_lun[1];
 611         return scsi_device_find(&s->bus, channel, target, *target_lun);
 612     }
 613 }
 614
 615 static PVSCSIRequest *
 616 pvscsi_queue_pending_descriptor(PVSCSIState *s, SCSIDevice **d,
 617                                 struct PVSCSIRingReqDesc *descr)
 618 {
 619     PVSCSIRequest *pvscsi_req;
 620     uint8_t lun;
 621
 622     pvscsi_req = g_malloc0(sizeof(*pvscsi_req));
 623     pvscsi_req->dev = s;
 624     pvscsi_req->req = *descr;
 625     pvscsi_req->cmp.context = pvscsi_req->req.context;
 626     QTAILQ_INSERT_TAIL(&s->pending_queue, pvscsi_req, next);
 627
 628     *d = pvscsi_device_find(s, descr->bus, descr->target, descr->lun, &lun);
 629     if (*d) {
 630         pvscsi_req->lun = lun;
 631     }
 632
 633     return pvscsi_req;
 634 }
 635
 636 static void
 637 pvscsi_convert_sglist(PVSCSIRequest *r)
 638 {
 639     uint32_t chunk_size, elmcnt = 0;
 640     uint64_t data_length = r->req.dataLen;
 641     PVSCSISGState sg = r->sg;
 642     while (data_length && elmcnt < PVSCSI_MAX_SG_ELEM) {
 643         while (!sg.resid && elmcnt++ < PVSCSI_MAX_SG_ELEM) {
 644             pvscsi_get_next_sg_elem(&sg);
 645             trace_pvscsi_convert_sglist(r->req.context, r->sg.dataAddr,
 646                                         r->sg.resid);
 647         }
 648         chunk_size = MIN(data_length, sg.resid);
 649         if (chunk_size) {
 650             qemu_sglist_add(&r->sgl, sg.dataAddr, chunk_size);
 651         }
 652
 653         sg.dataAddr += chunk_size;
 654         data_length -= chunk_size;
 655         sg.resid -= chunk_size;
 656     }
 657 }
 658
 659 static void
 660 pvscsi_build_sglist(PVSCSIState *s, PVSCSIRequest *r)
 661 {
 662     PCIDevice *d = PCI_DEVICE(s);
 663
 664     pci_dma_sglist_init(&r->sgl, d, 1);
 665     if (r->req.flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
 666         pvscsi_convert_sglist(r);
 667     } else {
 668         qemu_sglist_add(&r->sgl, r->req.dataAddr, r->req.dataLen);
 669     }
 670 }
 671
 672 static void
 673 pvscsi_process_request_descriptor(PVSCSIState *s,
 674                                   struct PVSCSIRingReqDesc *descr)
 675 {
 676     SCSIDevice *d;
 677     PVSCSIRequest *r = pvscsi_queue_pending_descriptor(s, &d, descr);
 678     int64_t n;
 679
 680     trace_pvscsi_process_req_descr(descr->cdb[0], descr->context);
 681
 682     if (!d) {
 683         r->cmp.hostStatus = BTSTAT_SELTIMEO;
 684         trace_pvscsi_process_req_descr_unknown_device();
 685         pvscsi_complete_request(s, r);
 686         return;
 687     }
 688
 689     if (descr->flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
 690         r->sg.elemAddr = descr->dataAddr;
 691     }
 692
 693     r->sreq = scsi_req_new(d, descr->context, r->lun, descr->cdb, r);
 694     if (r->sreq->cmd.mode == SCSI_XFER_FROM_DEV &&
 695         (descr->flags & PVSCSI_FLAG_CMD_DIR_TODEVICE)) {
 696         r->cmp.hostStatus = BTSTAT_BADMSG;
 697         trace_pvscsi_process_req_descr_invalid_dir();
 698         scsi_req_cancel(r->sreq);
 699         return;
 700     }
 701     if (r->sreq->cmd.mode == SCSI_XFER_TO_DEV &&
 702         (descr->flags & PVSCSI_FLAG_CMD_DIR_TOHOST)) {
 703         r->cmp.hostStatus = BTSTAT_BADMSG;
 704         trace_pvscsi_process_req_descr_invalid_dir();
 705         scsi_req_cancel(r->sreq);
 706         return;
 707     }
 708
 709     pvscsi_build_sglist(s, r);
 710     n = scsi_req_enqueue(r->sreq);
 711
 712     if (n) {
 713         scsi_req_continue(r->sreq);
 714     }
 715 }
 716
 717 static void
 718 pvscsi_process_io(PVSCSIState *s)
 719 {
 720     PVSCSIRingReqDesc descr;
 721     hwaddr next_descr_pa;
 722
 723     assert(s->rings_info_valid);
 724     while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
 725
 726         /* Only read after production index verification */
 727         smp_rmb();
 728
 729         trace_pvscsi_process_io(next_descr_pa);
 730         cpu_physical_memory_read(next_descr_pa, &descr, sizeof(descr));
 731         pvscsi_process_request_descriptor(s, &descr);
 732     }
 733
 734     pvscsi_ring_flush_req(&s->rings);
 735 }
 736
 737 static void
 738 pvscsi_dbg_dump_tx_rings_config(PVSCSICmdDescSetupRings *rc)
 739 {
 740     int i;
 741     trace_pvscsi_tx_rings_ppn("Rings State", rc->ringsStatePPN);
 742
 743     trace_pvscsi_tx_rings_num_pages("Request Ring", rc->reqRingNumPages);
 744     for (i = 0; i < rc->reqRingNumPages; i++) {
 745         trace_pvscsi_tx_rings_ppn("Request Ring", rc->reqRingPPNs[i]);
 746     }
 747
 748     trace_pvscsi_tx_rings_num_pages("Confirm Ring", rc->cmpRingNumPages);
 749     for (i = 0; i < rc->cmpRingNumPages; i++) {
 750         trace_pvscsi_tx_rings_ppn("Confirm Ring", rc->cmpRingPPNs[i]);
 751     }
 752 }
 753
 754 static uint64_t
 755 pvscsi_on_cmd_config(PVSCSIState *s)
 756 {
 757     trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_CONFIG");
 758     return PVSCSI_COMMAND_PROCESSING_FAILED;
 759 }
 760
 761 static uint64_t
 762 pvscsi_on_cmd_unplug(PVSCSIState *s)
 763 {
 764     trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_DEVICE_UNPLUG");
 765     return PVSCSI_COMMAND_PROCESSING_FAILED;
 766 }
 767
 768 static uint64_t
 769 pvscsi_on_issue_scsi(PVSCSIState *s)
 770 {
 771     trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_ISSUE_SCSI");
 772     return PVSCSI_COMMAND_PROCESSING_FAILED;
 773 }
 774
 775 static uint64_t
 776 pvscsi_on_cmd_setup_rings(PVSCSIState *s)
 777 {
 778     PVSCSICmdDescSetupRings *rc =
 779         (PVSCSICmdDescSetupRings *) s->curr_cmd_data;
 780
 781     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_RINGS");
 782
 783     if (!rc->reqRingNumPages
 784         || rc->reqRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
 785         || !rc->cmpRingNumPages
 786         || rc->cmpRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES) {
 787         return PVSCSI_COMMAND_PROCESSING_FAILED;
 788     }
 789
 790     pvscsi_dbg_dump_tx_rings_config(rc);
 791     pvscsi_ring_init_data(&s->rings, rc);
 792
 793     s->rings_info_valid = TRUE;
 794     return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 795 }
 796
 797 static uint64_t
 798 pvscsi_on_cmd_abort(PVSCSIState *s)
 799 {
 800     PVSCSICmdDescAbortCmd *cmd = (PVSCSICmdDescAbortCmd *) s->curr_cmd_data;
 801     PVSCSIRequest *r, *next;
 802
 803     trace_pvscsi_on_cmd_abort(cmd->context, cmd->target);
 804
 805     QTAILQ_FOREACH_SAFE(r, &s->pending_queue, next, next) {
 806         if (r->req.context == cmd->context) {
 807             break;
 808         }
 809     }
 810     if (r) {
 811         assert(!r->completed);
 812         r->cmp.hostStatus = BTSTAT_ABORTQUEUE;
 813         scsi_req_cancel(r->sreq);
 814     }
 815
 816     return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 817 }
 818
 819 static uint64_t
 820 pvscsi_on_cmd_unknown(PVSCSIState *s)
 821 {
 822     trace_pvscsi_on_cmd_unknown_data(s->curr_cmd_data[0]);
 823     return PVSCSI_COMMAND_PROCESSING_FAILED;
 824 }
 825
 826 static uint64_t
 827 pvscsi_on_cmd_reset_device(PVSCSIState *s)
 828 {
 829     uint8_t target_lun = 0;
 830     struct PVSCSICmdDescResetDevice *cmd =
 831         (struct PVSCSICmdDescResetDevice *) s->curr_cmd_data;
 832     SCSIDevice *sdev;
 833
 834     sdev = pvscsi_device_find(s, 0, cmd->target, cmd->lun, &target_lun);
 835
 836     trace_pvscsi_on_cmd_reset_dev(cmd->target, (int) target_lun, sdev);
 837
 838     if (sdev != NULL) {
 839         s->resetting++;
 840         device_reset(&sdev->qdev);
 841         s->resetting--;
 842         return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 843     }
 844
 845     return PVSCSI_COMMAND_PROCESSING_FAILED;
 846 }
 847
 848 static uint64_t
 849 pvscsi_on_cmd_reset_bus(PVSCSIState *s)
 850 {
 851     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_RESET_BUS");
 852
 853     s->resetting++;
 854     qbus_reset_all(BUS(&s->bus));
 855     s->resetting--;
 856     return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 857 }
 858
 859 static uint64_t
 860 pvscsi_on_cmd_setup_msg_ring(PVSCSIState *s)
 861 {
 862     PVSCSICmdDescSetupMsgRing *rc =
 863         (PVSCSICmdDescSetupMsgRing *) s->curr_cmd_data;
 864
 865     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_MSG_RING");
 866
 867     if (!s->use_msg) {
 868         return PVSCSI_COMMAND_PROCESSING_FAILED;
 869     }
 870
 871     if (s->rings_info_valid) {
 872         if (pvscsi_ring_init_msg(&s->rings, rc) < 0) {
 873             return PVSCSI_COMMAND_PROCESSING_FAILED;
 874         }
 875         s->msg_ring_info_valid = TRUE;
 876     }
 877     return sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(uint32_t);
 878 }
 879
 880 static uint64_t
 881 pvscsi_on_cmd_adapter_reset(PVSCSIState *s)
 882 {
 883     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_ADAPTER_RESET");
 884
 885     pvscsi_reset_adapter(s);
 886     return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
 887 }
 888
 889 static const struct {
 890     int       data_size;
 891     uint64_t  (*handler_fn)(PVSCSIState *s);
 892 } pvscsi_commands[] = {
 893     [PVSCSI_CMD_FIRST] = {
 894         .data_size = 0,
 895         .handler_fn = pvscsi_on_cmd_unknown,
 896     },
 897
 898     /* Not implemented, data size defined based on what arrives on windows */
 899     [PVSCSI_CMD_CONFIG] = {
 900         .data_size = 6 * sizeof(uint32_t),
 901         .handler_fn = pvscsi_on_cmd_config,
 902     },
 903
 904     /* Command not implemented, data size is unknown */
 905     [PVSCSI_CMD_ISSUE_SCSI] = {
 906         .data_size = 0,
 907         .handler_fn = pvscsi_on_issue_scsi,
 908     },
 909
 910     /* Command not implemented, data size is unknown */
 911     [PVSCSI_CMD_DEVICE_UNPLUG] = {
 912         .data_size = 0,
 913         .handler_fn = pvscsi_on_cmd_unplug,
 914     },
 915
 916     [PVSCSI_CMD_SETUP_RINGS] = {
 917         .data_size = sizeof(PVSCSICmdDescSetupRings),
 918         .handler_fn = pvscsi_on_cmd_setup_rings,
 919     },
 920
 921     [PVSCSI_CMD_RESET_DEVICE] = {
 922         .data_size = sizeof(struct PVSCSICmdDescResetDevice),
 923         .handler_fn = pvscsi_on_cmd_reset_device,
 924     },
 925
 926     [PVSCSI_CMD_RESET_BUS] = {
 927         .data_size = 0,
 928         .handler_fn = pvscsi_on_cmd_reset_bus,
 929     },
 930
 931     [PVSCSI_CMD_SETUP_MSG_RING] = {
 932         .data_size = sizeof(PVSCSICmdDescSetupMsgRing),
 933         .handler_fn = pvscsi_on_cmd_setup_msg_ring,
 934     },
 935
 936     [PVSCSI_CMD_ADAPTER_RESET] = {
 937         .data_size = 0,
 938         .handler_fn = pvscsi_on_cmd_adapter_reset,
 939     },
 940
 941     [PVSCSI_CMD_ABORT_CMD] = {
 942         .data_size = sizeof(struct PVSCSICmdDescAbortCmd),
 943         .handler_fn = pvscsi_on_cmd_abort,
 944     },
 945 };
 946
 947 static void
 948 pvscsi_do_command_processing(PVSCSIState *s)
 949 {
 950     size_t bytes_arrived = s->curr_cmd_data_cntr * sizeof(uint32_t);
 951
 952     assert(s->curr_cmd < PVSCSI_CMD_LAST);
 953     if (bytes_arrived >= pvscsi_commands[s->curr_cmd].data_size) {
 954         s->reg_command_status = pvscsi_commands[s->curr_cmd].handler_fn(s);
 955         s->curr_cmd = PVSCSI_CMD_FIRST;
 956         s->curr_cmd_data_cntr   = 0;
 957     }
 958 }
 959
 960 static void
 961 pvscsi_on_command_data(PVSCSIState *s, uint32_t value)
 962 {
 963     size_t bytes_arrived = s->curr_cmd_data_cntr * sizeof(uint32_t);
 964
 965     assert(bytes_arrived < sizeof(s->curr_cmd_data));
 966     s->curr_cmd_data[s->curr_cmd_data_cntr++] = value;
 967
 968     pvscsi_do_command_processing(s);
 969 }
 970
 971 static void
 972 pvscsi_on_command(PVSCSIState *s, uint64_t cmd_id)
 973 {
 974     if ((cmd_id > PVSCSI_CMD_FIRST) && (cmd_id < PVSCSI_CMD_LAST)) {
 975         s->curr_cmd = cmd_id;
 976     } else {
 977         s->curr_cmd = PVSCSI_CMD_FIRST;
 978         trace_pvscsi_on_cmd_unknown(cmd_id);
 979     }
 980
 981     s->curr_cmd_data_cntr = 0;
 982     s->reg_command_status = PVSCSI_COMMAND_NOT_ENOUGH_DATA;
 983
 984     pvscsi_do_command_processing(s);
 985 }
 986
 987 static void
 988 pvscsi_io_write(void *opaque, hwaddr addr,
 989                 uint64_t val, unsigned size)
 990 {
 991     PVSCSIState *s = opaque;
 992
 993     switch (addr) {
 994     case PVSCSI_REG_OFFSET_COMMAND:
 995         pvscsi_on_command(s, val);
 996         break;
 997
 998     case PVSCSI_REG_OFFSET_COMMAND_DATA:
 999         pvscsi_on_command_data(s, (uint32_t) val);
1000         break;
1001
1002     case PVSCSI_REG_OFFSET_INTR_STATUS:
1003         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_INTR_STATUS", val);
1004         s->reg_interrupt_status &= ~val;
1005         pvscsi_update_irq_status(s);
1006         pvscsi_schedule_completion_processing(s);
1007         break;
1008
1009     case PVSCSI_REG_OFFSET_INTR_MASK:
1010         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_INTR_MASK", val);
1011         s->reg_interrupt_enabled = val;
1012         pvscsi_update_irq_status(s);
1013         break;
1014
1015     case PVSCSI_REG_OFFSET_KICK_NON_RW_IO:
1016         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_KICK_NON_RW_IO", val);
1017         pvscsi_process_io(s);
1018         break;
1019
1020     case PVSCSI_REG_OFFSET_KICK_RW_IO:
1021         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_KICK_RW_IO", val);
1022         pvscsi_process_io(s);
1023         break;
1024
1025     case PVSCSI_REG_OFFSET_DEBUG:
1026         trace_pvscsi_io_write("PVSCSI_REG_OFFSET_DEBUG", val);
1027         break;
1028
1029     default:
1030         trace_pvscsi_io_write_unknown(addr, size, val);
1031         break;
1032     }
1033
1034 }
1035
1036 static uint64_t
1037 pvscsi_io_read(void *opaque, hwaddr addr, unsigned size)
1038 {
1039     PVSCSIState *s = opaque;
1040
1041     switch (addr) {
1042     case PVSCSI_REG_OFFSET_INTR_STATUS:
1043         trace_pvscsi_io_read("PVSCSI_REG_OFFSET_INTR_STATUS",
1044                              s->reg_interrupt_status);
1045         return s->reg_interrupt_status;
1046
1047     case PVSCSI_REG_OFFSET_INTR_MASK:
1048         trace_pvscsi_io_read("PVSCSI_REG_OFFSET_INTR_MASK",
1049                              s->reg_interrupt_status);
1050         return s->reg_interrupt_enabled;
1051
1052     case PVSCSI_REG_OFFSET_COMMAND_STATUS:
1053         trace_pvscsi_io_read("PVSCSI_REG_OFFSET_COMMAND_STATUS",
1054                              s->reg_interrupt_status);
1055         return s->reg_command_status;
1056
1057     default:
1058         trace_pvscsi_io_read_unknown(addr, size);
1059         return 0;
1060     }
1061 }
1062
1063
1064 static void
1065 pvscsi_init_msi(PVSCSIState *s)
1066 {
1067     int res;
1068     PCIDevice *d = PCI_DEVICE(s);
1069
1070     res = msi_init(d, PVSCSI_MSI_OFFSET(s), PVSCSI_MSIX_NUM_VECTORS,
1071                    PVSCSI_USE_64BIT, PVSCSI_PER_VECTOR_MASK, NULL);
1072     if (res < 0) {
1073         trace_pvscsi_init_msi_fail(res);
1074         s->msi_used = false;
1075     } else {
1076         s->msi_used = true;
1077     }
1078 }
1079
1080 static void
1081 pvscsi_cleanup_msi(PVSCSIState *s)
1082 {
1083     PCIDevice *d = PCI_DEVICE(s);
1084
1085     msi_uninit(d);
1086 }
1087
1088 static const MemoryRegionOps pvscsi_ops = {
1089         .read = pvscsi_io_read,
1090         .write = pvscsi_io_write,
1091         .endianness = DEVICE_LITTLE_ENDIAN,
1092         .impl = {
1093                 .min_access_size = 4,
1094                 .max_access_size = 4,
1095         },
1096 };
1097
1098 static const struct SCSIBusInfo pvscsi_scsi_info = {
1099         .tcq = true,
1100         .max_target = PVSCSI_MAX_DEVS,
1101         .max_channel = 0,
1102         .max_lun = 0,
1103
1104         .get_sg_list = pvscsi_get_sg_list,
1105         .complete = pvscsi_command_complete,
1106         .cancel = pvscsi_request_cancelled,
1107 };
1108
1109 static void
1110 pvscsi_realizefn(PCIDevice *pci_dev, Error **errp)
1111 {
1112     PVSCSIState *s = PVSCSI(pci_dev);
1113
1114     trace_pvscsi_state("init");
1115
1116     /* PCI subsystem ID, subsystem vendor ID, revision */
1117     if (PVSCSI_USE_OLD_PCI_CONFIGURATION(s)) {
1118         pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID, 0x1000);
1119     } else {
1120         pci_set_word(pci_dev->config + PCI_SUBSYSTEM_VENDOR_ID,
1121                      PCI_VENDOR_ID_VMWARE);
1122         pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID,
1123                      PCI_DEVICE_ID_VMWARE_PVSCSI);
1124         pci_config_set_revision(pci_dev->config, 0x2);
1125     }
1126
1127     /* PCI latency timer = 255 */
1128     pci_dev->config[PCI_LATENCY_TIMER] = 0xff;
1129
1130     /* Interrupt pin A */
1131     pci_config_set_interrupt_pin(pci_dev->config, 1);
1132
1133     memory_region_init_io(&s->io_space, OBJECT(s), &pvscsi_ops, s,
1134                           "pvscsi-io", PVSCSI_MEM_SPACE_SIZE);
1135     pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io_space);
1136
1137     pvscsi_init_msi(s);
1138
1139     if (pci_is_express(pci_dev) && pci_bus_is_express(pci_get_bus(pci_dev))) {
1140         pcie_endpoint_cap_init(pci_dev, PVSCSI_EXP_EP_OFFSET);
1141     }
1142
1143     s->completion_worker = qemu_bh_new(pvscsi_process_completion_queue, s);
1144
1145     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(pci_dev),
1146                  &pvscsi_scsi_info, NULL);
1147     /* override default SCSI bus hotplug-handler, with pvscsi's one */
1148     qbus_set_hotplug_handler(BUS(&s->bus), OBJECT(s), &error_abort);
1149     pvscsi_reset_state(s);
1150 }
1151
1152 static void
1153 pvscsi_uninit(PCIDevice *pci_dev)
1154 {
1155     PVSCSIState *s = PVSCSI(pci_dev);
1156
1157     trace_pvscsi_state("uninit");
1158     qemu_bh_delete(s->completion_worker);
1159
1160     pvscsi_cleanup_msi(s);
1161 }
1162
1163 static void
1164 pvscsi_reset(DeviceState *dev)
1165 {
1166     PCIDevice *d = PCI_DEVICE(dev);
1167     PVSCSIState *s = PVSCSI(d);
1168
1169     trace_pvscsi_state("reset");
1170     pvscsi_reset_adapter(s);
1171 }
1172
1173 static int
1174 pvscsi_pre_save(void *opaque)
1175 {
1176     PVSCSIState *s = (PVSCSIState *) opaque;
1177
1178     trace_pvscsi_state("presave");
1179
1180     assert(QTAILQ_EMPTY(&s->pending_queue));
1181     assert(QTAILQ_EMPTY(&s->completion_queue));
1182
1183     return 0;
1184 }
1185
1186 static int
1187 pvscsi_post_load(void *opaque, int version_id)
1188 {
1189     trace_pvscsi_state("postload");
1190     return 0;
1191 }
1192
1193 static bool pvscsi_vmstate_need_pcie_device(void *opaque)
1194 {
1195     PVSCSIState *s = PVSCSI(opaque);
1196
1197     return !(s->compat_flags & PVSCSI_COMPAT_DISABLE_PCIE);
1198 }
1199
1200 static bool pvscsi_vmstate_test_pci_device(void *opaque, int version_id)
1201 {
1202     return !pvscsi_vmstate_need_pcie_device(opaque);
1203 }
1204
1205 static const VMStateDescription vmstate_pvscsi_pcie_device = {
1206     .name = "pvscsi/pcie",
1207     .needed = pvscsi_vmstate_need_pcie_device,
1208     .fields = (VMStateField[]) {
1209         VMSTATE_PCI_DEVICE(parent_obj, PVSCSIState),
1210         VMSTATE_END_OF_LIST()
1211     }
1212 };
1213
1214 static const VMStateDescription vmstate_pvscsi = {
1215     .name = "pvscsi",
1216     .version_id = 0,
1217     .minimum_version_id = 0,
1218     .pre_save = pvscsi_pre_save,
1219     .post_load = pvscsi_post_load,
1220     .fields = (VMStateField[]) {
1221         VMSTATE_STRUCT_TEST(parent_obj, PVSCSIState,
1222                             pvscsi_vmstate_test_pci_device, 0,
1223                             vmstate_pci_device, PCIDevice),
1224         VMSTATE_UINT8(msi_used, PVSCSIState),
1225         VMSTATE_UINT32(resetting, PVSCSIState),
1226         VMSTATE_UINT64(reg_interrupt_status, PVSCSIState),
1227         VMSTATE_UINT64(reg_interrupt_enabled, PVSCSIState),
1228         VMSTATE_UINT64(reg_command_status, PVSCSIState),
1229         VMSTATE_UINT64(curr_cmd, PVSCSIState),
1230         VMSTATE_UINT32(curr_cmd_data_cntr, PVSCSIState),
1231         VMSTATE_UINT32_ARRAY(curr_cmd_data, PVSCSIState,
1232                              ARRAY_SIZE(((PVSCSIState *)NULL)->curr_cmd_data)),
1233         VMSTATE_UINT8(rings_info_valid, PVSCSIState),
1234         VMSTATE_UINT8(msg_ring_info_valid, PVSCSIState),
1235         VMSTATE_UINT8(use_msg, PVSCSIState),
1236
1237         VMSTATE_UINT64(rings.rs_pa, PVSCSIState),
1238         VMSTATE_UINT32(rings.txr_len_mask, PVSCSIState),
1239         VMSTATE_UINT32(rings.rxr_len_mask, PVSCSIState),
1240         VMSTATE_UINT64_ARRAY(rings.req_ring_pages_pa, PVSCSIState,
1241                              PVSCSI_SETUP_RINGS_MAX_NUM_PAGES),
1242         VMSTATE_UINT64_ARRAY(rings.cmp_ring_pages_pa, PVSCSIState,
1243                              PVSCSI_SETUP_RINGS_MAX_NUM_PAGES),
1244         VMSTATE_UINT64(rings.consumed_ptr, PVSCSIState),
1245         VMSTATE_UINT64(rings.filled_cmp_ptr, PVSCSIState),
1246
1247         VMSTATE_END_OF_LIST()
1248     },
1249     .subsections = (const VMStateDescription*[]) {
1250         &vmstate_pvscsi_pcie_device,
1251         NULL
1252     }
1253 };
1254
1255 static Property pvscsi_properties[] = {
1256     DEFINE_PROP_UINT8("use_msg", PVSCSIState, use_msg, 1),
1257     DEFINE_PROP_BIT("x-old-pci-configuration", PVSCSIState, compat_flags,
1258                     PVSCSI_COMPAT_OLD_PCI_CONFIGURATION_BIT, false),
1259     DEFINE_PROP_BIT("x-disable-pcie", PVSCSIState, compat_flags,
1260                     PVSCSI_COMPAT_DISABLE_PCIE_BIT, false),
1261     DEFINE_PROP_END_OF_LIST(),
1262 };
1263
1264 static void pvscsi_realize(DeviceState *qdev, Error **errp)
1265 {
1266     PVSCSIClass *pvs_c = PVSCSI_DEVICE_GET_CLASS(qdev);
1267     PCIDevice *pci_dev = PCI_DEVICE(qdev);
1268     PVSCSIState *s = PVSCSI(qdev);
1269
1270     if (!(s->compat_flags & PVSCSI_COMPAT_DISABLE_PCIE)) {
1271         pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
1272     }
1273
1274     pvs_c->parent_dc_realize(qdev, errp);
1275 }
1276
1277 static void pvscsi_class_init(ObjectClass *klass, void *data)
1278 {
1279     DeviceClass *dc = DEVICE_CLASS(klass);
1280     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1281     PVSCSIClass *pvs_k = PVSCSI_DEVICE_CLASS(klass);
1282     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
1283
1284     k->realize = pvscsi_realizefn;
1285     k->exit = pvscsi_uninit;
1286     k->vendor_id = PCI_VENDOR_ID_VMWARE;
1287     k->device_id = PCI_DEVICE_ID_VMWARE_PVSCSI;
1288     k->class_id = PCI_CLASS_STORAGE_SCSI;
1289     k->subsystem_id = 0x1000;
1290     device_class_set_parent_realize(dc, pvscsi_realize,
1291                                     &pvs_k->parent_dc_realize);
1292     dc->reset = pvscsi_reset;
1293     dc->vmsd = &vmstate_pvscsi;
1294     dc->props = pvscsi_properties;
1295     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1296     hc->unplug = pvscsi_hot_unplug;
1297     hc->plug = pvscsi_hotplug;
1298 }
1299
1300 static const TypeInfo pvscsi_info = {
1301     .name          = TYPE_PVSCSI,
1302     .parent        = TYPE_PCI_DEVICE,
1303     .class_size    = sizeof(PVSCSIClass),
1304     .instance_size = sizeof(PVSCSIState),
1305     .class_init    = pvscsi_class_init,
1306     .interfaces = (InterfaceInfo[]) {
1307         { TYPE_HOTPLUG_HANDLER },
1308         { INTERFACE_PCIE_DEVICE },
1309         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
1310         { }
1311     }
1312 };
1313
1314 static void
1315 pvscsi_register_types(void)
1316 {
1317     type_register_static(&pvscsi_info);
1318 }
1319
1320 type_init(pvscsi_register_types);