[Qemu-devel] [PATCH 4/4] virtio-scsi: process control queue requests

[Paolo Bonzini]

Signed-off-by: Paolo Bonzini <address@hidden>
---
 hw/virtio-scsi.c |  111 ++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 files changed, 104 insertions(+), 7 deletions(-)

diff --git a/hw/virtio-scsi.c b/hw/virtio-scsi.c
index 5fc3c00..146ea6e 100644
--- a/hw/virtio-scsi.c
+++ b/hw/virtio-scsi.c
@@ -224,15 +224,88 @@ static VirtIOSCSIReq *virtio_scsi_parse_req(VirtIOSCSI 
*s, VirtQueue *vq)
     return req;
 }
 
-static void virtio_scsi_fail_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
+static void virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 {
-    if (req->req.tmf->type == VIRTIO_SCSI_T_TMF) {
-        req->resp.tmf->response = VIRTIO_SCSI_S_FAILURE;
-    } else {
-        req->resp.an->response = VIRTIO_SCSI_S_FAILURE;
+    SCSIDevice *d = virtio_scsi_device_find(s, req->req.cmd->lun);
+    SCSIRequest *r, *next;
+    DeviceState *qdev;
+    int target;
+
+    switch (req->req.tmf->subtype) {
+    case VIRTIO_SCSI_T_TMF_ABORT_TASK:
+    case VIRTIO_SCSI_T_TMF_QUERY_TASK:
+        d = virtio_scsi_device_find(s, req->req.cmd->lun);
+        if (!d) {
+            goto fail;
+        }
+
+        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
+            if (r->tag == req->req.cmd->tag) {
+                break;
+            }
+        }
+        if (r && r->hba_private) {
+            if (req->req.tmf->subtype == VIRTIO_SCSI_T_TMF_ABORT_TASK) {
+                scsi_req_cancel(r);
+            }
+            req->resp.tmf->response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
+        } else {
+            req->resp.tmf->response = VIRTIO_SCSI_S_OK;
+        }
+        break;
+
+    case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
+        d = virtio_scsi_device_find(s, req->req.cmd->lun);
+        if (!d) {
+            goto fail;
+        }
+        if (d->lun == virtio_scsi_get_lun(req->req.cmd->lun)) {
+            qdev_reset_all(&d->qdev);
+        }
+        break;
+
+    case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
+    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
+    case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
+        d = virtio_scsi_device_find(s, req->req.cmd->lun);
+        if (!d) {
+            goto fail;
+        }
+        if (d->lun != virtio_scsi_get_lun(req->req.cmd->lun)) {
+            req->resp.tmf->response = VIRTIO_SCSI_S_OK;
+            break;
+        }
+        req->resp.tmf->response = VIRTIO_SCSI_S_OK;
+        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
+            if (r->hba_private) {
+                if (req->req.tmf->subtype == VIRTIO_SCSI_T_TMF_ABORT_TASK) {
+                    scsi_req_cancel(r);
+                }
+                req->resp.tmf->response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
+            }
+        }
+        break;
+
+    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
+        target = req->req.cmd->lun[1];
+        QTAILQ_FOREACH(qdev, &s->bus.qbus.children, sibling) {
+             d = DO_UPCAST(SCSIDevice, qdev, qdev);
+             if (d->channel == 0 && d->id == target) {
+                qdev_reset_all(&d->qdev);
+             }
+        }
+        break;
+
+    case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
+    default:
+        req->resp.tmf->response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
+        break;
     }
 
-    virtio_scsi_complete_req(req);
+    return;
+
+fail:
+    req->resp.tmf->response = VIRTIO_SCSI_S_BAD_TARGET;
 }
 
 static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
@@ -241,7 +314,31 @@ static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, 
VirtQueue *vq)
     VirtIOSCSIReq *req;
 
     while ((req = virtio_scsi_parse_req(s, vq))) {
-        virtio_scsi_fail_ctrl_req(s, req);
+        int out_size, in_size;
+        if (req->elem.out_num < 1 || req->elem.in_num < 1) {
+            virtio_scsi_bad_req();
+            continue;
+        }
+
+        out_size = req->elem.out_sg[0].iov_len;
+        in_size = req->elem.in_sg[0].iov_len;
+        if (req->req.tmf->type == VIRTIO_SCSI_T_TMF) {
+            if (out_size < sizeof(VirtIOSCSICtrlTMFReq) ||
+                in_size < sizeof(VirtIOSCSICtrlTMFResp)) {
+                virtio_scsi_bad_req();
+            }
+            virtio_scsi_do_tmf(s, req);
+
+        } else if (req->req.tmf->type == VIRTIO_SCSI_T_AN_QUERY ||
+                   req->req.tmf->type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
+            if (out_size < sizeof(VirtIOSCSICtrlANReq) ||
+                in_size < sizeof(VirtIOSCSICtrlANResp)) {
+                virtio_scsi_bad_req();
+            }
+            req->resp.an->event_actual = 0;
+            req->resp.an->response = VIRTIO_SCSI_S_OK;
+        }
+        virtio_scsi_complete_req(req);
     }
 }
 
-- 
1.7.7.1