1 /* 2 * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator 3 * 4 * PAPR Virtual SCSI, aka ibmvscsi 5 * 6 * Copyright (c) 2010,2011 Benjamin Herrenschmidt, IBM Corporation. 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 * 26 * TODO: 27 * 28 * - Cleanups :-) 29 * - Sort out better how to assign devices to VSCSI instances 30 * - Fix residual counts 31 * - Add indirect descriptors support 32 * - Maybe do autosense (PAPR seems to mandate it, linux doesn't care) 33 */ 34 #include "hw/hw.h" 35 #include "hw/scsi/scsi.h" 36 #include "block/scsi.h" 37 #include "srp.h" 38 #include "hw/qdev.h" 39 #include "hw/ppc/spapr.h" 40 #include "hw/ppc/spapr_vio.h" 41 #include "viosrp.h" 42 43 #include <libfdt.h> 44 45 /*#define DEBUG_VSCSI*/ 46 47 #ifdef DEBUG_VSCSI 48 #define DPRINTF(fmt, ...) \ 49 do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0) 50 #else 51 #define DPRINTF(fmt, ...) \ 52 do { } while (0) 53 #endif 54 55 /* 56 * Virtual SCSI device 57 */ 58 59 /* Random numbers */ 60 #define VSCSI_MAX_SECTORS 4096 61 #define VSCSI_REQ_LIMIT 24 62 63 #define SRP_RSP_SENSE_DATA_LEN 18 64 65 typedef union vscsi_crq { 66 struct viosrp_crq s; 67 uint8_t raw[16]; 68 } vscsi_crq; 69 70 typedef struct vscsi_req { 71 vscsi_crq crq; 72 union viosrp_iu iu; 73 74 /* SCSI request tracking */ 75 SCSIRequest *sreq; 76 uint32_t qtag; /* qemu tag != srp tag */ 77 bool active; 78 uint32_t data_len; 79 bool writing; 80 uint32_t senselen; 81 uint8_t sense[SCSI_SENSE_BUF_SIZE]; 82 83 /* RDMA related bits */ 84 uint8_t dma_fmt; 85 uint16_t local_desc; 86 uint16_t total_desc; 87 uint16_t cdb_offset; 88 uint16_t cur_desc_num; 89 uint16_t cur_desc_offset; 90 } vscsi_req; 91 92 #define TYPE_VIO_SPAPR_VSCSI_DEVICE "spapr-vscsi" 93 #define VIO_SPAPR_VSCSI_DEVICE(obj) \ 94 OBJECT_CHECK(VSCSIState, (obj), TYPE_VIO_SPAPR_VSCSI_DEVICE) 95 96 typedef struct { 97 VIOsPAPRDevice vdev; 98 SCSIBus bus; 99 vscsi_req reqs[VSCSI_REQ_LIMIT]; 100 } VSCSIState; 101 102 static struct vscsi_req *vscsi_get_req(VSCSIState *s) 103 { 104 vscsi_req *req; 105 int i; 106 107 for (i = 0; i < VSCSI_REQ_LIMIT; i++) { 108 req = &s->reqs[i]; 109 if (!req->active) { 110 memset(req, 0, sizeof(*req)); 111 req->qtag = i; 112 req->active = 1; 113 return req; 114 } 115 } 116 return NULL; 117 } 118 119 static struct vscsi_req *vscsi_find_req(VSCSIState *s, uint64_t srp_tag) 120 { 121 vscsi_req *req; 122 int i; 123 124 for (i = 0; i < VSCSI_REQ_LIMIT; i++) { 125 req = &s->reqs[i]; 126 if (req->iu.srp.cmd.tag == srp_tag) { 127 return req; 128 } 129 } 130 return NULL; 131 } 132 133 static void vscsi_put_req(vscsi_req *req) 134 { 135 if (req->sreq != NULL) { 136 scsi_req_unref(req->sreq); 137 } 138 req->sreq = NULL; 139 req->active = 0; 140 } 141 142 static SCSIDevice *vscsi_device_find(SCSIBus *bus, uint64_t srp_lun, int *lun) 143 { 144 int channel = 0, id = 0; 145 146 retry: 147 switch (srp_lun >> 62) { 148 case 0: 149 if ((srp_lun >> 56) != 0) { 150 channel = (srp_lun >> 56) & 0x3f; 151 id = (srp_lun >> 48) & 0xff; 152 srp_lun <<= 16; 153 goto retry; 154 } 155 *lun = (srp_lun >> 48) & 0xff; 156 break; 157 158 case 1: 159 *lun = (srp_lun >> 48) & 0x3fff; 160 break; 161 case 2: 162 channel = (srp_lun >> 53) & 0x7; 163 id = (srp_lun >> 56) & 0x3f; 164 *lun = (srp_lun >> 48) & 0x1f; 165 break; 166 case 3: 167 *lun = -1; 168 return NULL; 169 default: 170 abort(); 171 } 172 173 return scsi_device_find(bus, channel, id, *lun); 174 } 175 176 static int vscsi_send_iu(VSCSIState *s, vscsi_req *req, 177 uint64_t length, uint8_t format) 178 { 179 long rc, rc1; 180 181 /* First copy the SRP */ 182 rc = spapr_vio_dma_write(&s->vdev, req->crq.s.IU_data_ptr, 183 &req->iu, length); 184 if (rc) { 185 fprintf(stderr, "vscsi_send_iu: DMA write failure !\n"); 186 } 187 188 req->crq.s.valid = 0x80; 189 req->crq.s.format = format; 190 req->crq.s.reserved = 0x00; 191 req->crq.s.timeout = cpu_to_be16(0x0000); 192 req->crq.s.IU_length = cpu_to_be16(length); 193 req->crq.s.IU_data_ptr = req->iu.srp.rsp.tag; /* right byte order */ 194 195 if (rc == 0) { 196 req->crq.s.status = 0x99; /* Just needs to be non-zero */ 197 } else { 198 req->crq.s.status = 0x00; 199 } 200 201 rc1 = spapr_vio_send_crq(&s->vdev, req->crq.raw); 202 if (rc1) { 203 fprintf(stderr, "vscsi_send_iu: Error sending response\n"); 204 return rc1; 205 } 206 207 return rc; 208 } 209 210 static void vscsi_makeup_sense(VSCSIState *s, vscsi_req *req, 211 uint8_t key, uint8_t asc, uint8_t ascq) 212 { 213 req->senselen = SRP_RSP_SENSE_DATA_LEN; 214 215 /* Valid bit and 'current errors' */ 216 req->sense[0] = (0x1 << 7 | 0x70); 217 /* Sense key */ 218 req->sense[2] = key; 219 /* Additional sense length */ 220 req->sense[7] = 0xa; /* 10 bytes */ 221 /* Additional sense code */ 222 req->sense[12] = asc; 223 req->sense[13] = ascq; 224 } 225 226 static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req, 227 uint8_t status, int32_t res_in, int32_t res_out) 228 { 229 union viosrp_iu *iu = &req->iu; 230 uint64_t tag = iu->srp.rsp.tag; 231 int total_len = sizeof(iu->srp.rsp); 232 uint8_t sol_not = iu->srp.cmd.sol_not; 233 234 DPRINTF("VSCSI: Sending resp status: 0x%x, " 235 "res_in: %d, res_out: %d\n", status, res_in, res_out); 236 237 memset(iu, 0, sizeof(struct srp_rsp)); 238 iu->srp.rsp.opcode = SRP_RSP; 239 iu->srp.rsp.req_lim_delta = cpu_to_be32(1); 240 iu->srp.rsp.tag = tag; 241 242 /* Handle residuals */ 243 if (res_in < 0) { 244 iu->srp.rsp.flags |= SRP_RSP_FLAG_DIUNDER; 245 res_in = -res_in; 246 } else if (res_in) { 247 iu->srp.rsp.flags |= SRP_RSP_FLAG_DIOVER; 248 } 249 if (res_out < 0) { 250 iu->srp.rsp.flags |= SRP_RSP_FLAG_DOUNDER; 251 res_out = -res_out; 252 } else if (res_out) { 253 iu->srp.rsp.flags |= SRP_RSP_FLAG_DOOVER; 254 } 255 iu->srp.rsp.data_in_res_cnt = cpu_to_be32(res_in); 256 iu->srp.rsp.data_out_res_cnt = cpu_to_be32(res_out); 257 258 /* We don't do response data */ 259 /* iu->srp.rsp.flags &= ~SRP_RSP_FLAG_RSPVALID; */ 260 iu->srp.rsp.resp_data_len = cpu_to_be32(0); 261 262 /* Handle success vs. failure */ 263 iu->srp.rsp.status = status; 264 if (status) { 265 iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2; 266 if (req->senselen) { 267 req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID; 268 req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen); 269 memcpy(req->iu.srp.rsp.data, req->sense, req->senselen); 270 total_len += req->senselen; 271 } 272 } else { 273 iu->srp.rsp.sol_not = (sol_not & 0x02) >> 1; 274 } 275 276 vscsi_send_iu(s, req, total_len, VIOSRP_SRP_FORMAT); 277 return 0; 278 } 279 280 static inline struct srp_direct_buf vscsi_swap_desc(struct srp_direct_buf desc) 281 { 282 desc.va = be64_to_cpu(desc.va); 283 desc.len = be32_to_cpu(desc.len); 284 return desc; 285 } 286 287 static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req, 288 unsigned n, unsigned buf_offset, 289 struct srp_direct_buf *ret) 290 { 291 struct srp_cmd *cmd = &req->iu.srp.cmd; 292 293 switch (req->dma_fmt) { 294 case SRP_NO_DATA_DESC: { 295 DPRINTF("VSCSI: no data descriptor\n"); 296 return 0; 297 } 298 case SRP_DATA_DESC_DIRECT: { 299 memcpy(ret, cmd->add_data + req->cdb_offset, sizeof(*ret)); 300 assert(req->cur_desc_num == 0); 301 DPRINTF("VSCSI: direct segment\n"); 302 break; 303 } 304 case SRP_DATA_DESC_INDIRECT: { 305 struct srp_indirect_buf *tmp = (struct srp_indirect_buf *) 306 (cmd->add_data + req->cdb_offset); 307 if (n < req->local_desc) { 308 *ret = tmp->desc_list[n]; 309 DPRINTF("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n", 310 req->qtag, n, req->local_desc); 311 312 } else if (n < req->total_desc) { 313 int rc; 314 struct srp_direct_buf tbl_desc = vscsi_swap_desc(tmp->table_desc); 315 unsigned desc_offset = n * sizeof(struct srp_direct_buf); 316 317 if (desc_offset >= tbl_desc.len) { 318 DPRINTF("VSCSI: #%d is ouf of range (%d bytes)\n", 319 n, desc_offset); 320 return -1; 321 } 322 rc = spapr_vio_dma_read(&s->vdev, tbl_desc.va + desc_offset, 323 ret, sizeof(struct srp_direct_buf)); 324 if (rc) { 325 DPRINTF("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n", 326 rc); 327 return -1; 328 } 329 DPRINTF("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n", 330 req->qtag, n, req->total_desc, tbl_desc.va, tbl_desc.len); 331 } else { 332 DPRINTF("VSCSI: Out of descriptors !\n"); 333 return 0; 334 } 335 break; 336 } 337 default: 338 fprintf(stderr, "VSCSI: Unknown format %x\n", req->dma_fmt); 339 return -1; 340 } 341 342 *ret = vscsi_swap_desc(*ret); 343 if (buf_offset > ret->len) { 344 DPRINTF(" offset=%x is out of a descriptor #%d boundary=%x\n", 345 buf_offset, req->cur_desc_num, ret->len); 346 return -1; 347 } 348 ret->va += buf_offset; 349 ret->len -= buf_offset; 350 351 DPRINTF(" cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n", 352 req->cur_desc_num, req->cur_desc_offset, ret->va, ret->len); 353 354 return ret->len ? 1 : 0; 355 } 356 357 static int vscsi_srp_direct_data(VSCSIState *s, vscsi_req *req, 358 uint8_t *buf, uint32_t len) 359 { 360 struct srp_direct_buf md; 361 uint32_t llen; 362 int rc = 0; 363 364 rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md); 365 if (rc < 0) { 366 return -1; 367 } else if (rc == 0) { 368 return 0; 369 } 370 371 llen = MIN(len, md.len); 372 if (llen) { 373 if (req->writing) { /* writing = to device = reading from memory */ 374 rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen); 375 } else { 376 rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen); 377 } 378 } 379 380 if (rc) { 381 return -1; 382 } 383 req->cur_desc_offset += llen; 384 385 return llen; 386 } 387 388 static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req, 389 uint8_t *buf, uint32_t len) 390 { 391 struct srp_direct_buf md; 392 int rc = 0; 393 uint32_t llen, total = 0; 394 395 DPRINTF("VSCSI: indirect segment 0x%x bytes\n", len); 396 397 /* While we have data ... */ 398 while (len) { 399 rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md); 400 if (rc < 0) { 401 return -1; 402 } else if (rc == 0) { 403 break; 404 } 405 406 /* Perform transfer */ 407 llen = MIN(len, md.len); 408 if (req->writing) { /* writing = to device = reading from memory */ 409 rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen); 410 } else { 411 rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen); 412 } 413 if (rc) { 414 DPRINTF("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc); 415 break; 416 } 417 DPRINTF("VSCSI: data: %02x %02x %02x %02x...\n", 418 buf[0], buf[1], buf[2], buf[3]); 419 420 len -= llen; 421 buf += llen; 422 423 total += llen; 424 425 /* Update current position in the current descriptor */ 426 req->cur_desc_offset += llen; 427 if (md.len == llen) { 428 /* Go to the next descriptor if the current one finished */ 429 ++req->cur_desc_num; 430 req->cur_desc_offset = 0; 431 } 432 } 433 434 return rc ? -1 : total; 435 } 436 437 static int vscsi_srp_transfer_data(VSCSIState *s, vscsi_req *req, 438 int writing, uint8_t *buf, uint32_t len) 439 { 440 int err = 0; 441 442 switch (req->dma_fmt) { 443 case SRP_NO_DATA_DESC: 444 DPRINTF("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len); 445 break; 446 case SRP_DATA_DESC_DIRECT: 447 err = vscsi_srp_direct_data(s, req, buf, len); 448 break; 449 case SRP_DATA_DESC_INDIRECT: 450 err = vscsi_srp_indirect_data(s, req, buf, len); 451 break; 452 } 453 return err; 454 } 455 456 /* Bits from linux srp */ 457 static int data_out_desc_size(struct srp_cmd *cmd) 458 { 459 int size = 0; 460 uint8_t fmt = cmd->buf_fmt >> 4; 461 462 switch (fmt) { 463 case SRP_NO_DATA_DESC: 464 break; 465 case SRP_DATA_DESC_DIRECT: 466 size = sizeof(struct srp_direct_buf); 467 break; 468 case SRP_DATA_DESC_INDIRECT: 469 size = sizeof(struct srp_indirect_buf) + 470 sizeof(struct srp_direct_buf)*cmd->data_out_desc_cnt; 471 break; 472 default: 473 break; 474 } 475 return size; 476 } 477 478 static int vscsi_preprocess_desc(vscsi_req *req) 479 { 480 struct srp_cmd *cmd = &req->iu.srp.cmd; 481 482 req->cdb_offset = cmd->add_cdb_len & ~3; 483 484 if (req->writing) { 485 req->dma_fmt = cmd->buf_fmt >> 4; 486 } else { 487 req->cdb_offset += data_out_desc_size(cmd); 488 req->dma_fmt = cmd->buf_fmt & ((1U << 4) - 1); 489 } 490 491 switch (req->dma_fmt) { 492 case SRP_NO_DATA_DESC: 493 break; 494 case SRP_DATA_DESC_DIRECT: 495 req->total_desc = req->local_desc = 1; 496 break; 497 case SRP_DATA_DESC_INDIRECT: { 498 struct srp_indirect_buf *ind_tmp = (struct srp_indirect_buf *) 499 (cmd->add_data + req->cdb_offset); 500 501 req->total_desc = be32_to_cpu(ind_tmp->table_desc.len) / 502 sizeof(struct srp_direct_buf); 503 req->local_desc = req->writing ? cmd->data_out_desc_cnt : 504 cmd->data_in_desc_cnt; 505 break; 506 } 507 default: 508 fprintf(stderr, 509 "vscsi_preprocess_desc: Unknown format %x\n", req->dma_fmt); 510 return -1; 511 } 512 513 return 0; 514 } 515 516 /* Callback to indicate that the SCSI layer has completed a transfer. */ 517 static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t len) 518 { 519 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(sreq->bus->qbus.parent); 520 vscsi_req *req = sreq->hba_private; 521 uint8_t *buf; 522 int rc = 0; 523 524 DPRINTF("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n", 525 sreq->tag, len, req); 526 if (req == NULL) { 527 fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag); 528 return; 529 } 530 531 if (len) { 532 buf = scsi_req_get_buf(sreq); 533 rc = vscsi_srp_transfer_data(s, req, req->writing, buf, len); 534 } 535 if (rc < 0) { 536 fprintf(stderr, "VSCSI: RDMA error rc=%d!\n", rc); 537 vscsi_makeup_sense(s, req, HARDWARE_ERROR, 0, 0); 538 scsi_req_abort(req->sreq, CHECK_CONDITION); 539 return; 540 } 541 542 /* Start next chunk */ 543 req->data_len -= rc; 544 scsi_req_continue(sreq); 545 } 546 547 /* Callback to indicate that the SCSI layer has completed a transfer. */ 548 static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t resid) 549 { 550 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(sreq->bus->qbus.parent); 551 vscsi_req *req = sreq->hba_private; 552 int32_t res_in = 0, res_out = 0; 553 554 DPRINTF("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n", 555 sreq->tag, status, req); 556 if (req == NULL) { 557 fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag); 558 return; 559 } 560 561 if (status == CHECK_CONDITION) { 562 req->senselen = scsi_req_get_sense(req->sreq, req->sense, 563 sizeof(req->sense)); 564 DPRINTF("VSCSI: Sense data, %d bytes:\n", req->senselen); 565 DPRINTF(" %02x %02x %02x %02x %02x %02x %02x %02x\n", 566 req->sense[0], req->sense[1], req->sense[2], req->sense[3], 567 req->sense[4], req->sense[5], req->sense[6], req->sense[7]); 568 DPRINTF(" %02x %02x %02x %02x %02x %02x %02x %02x\n", 569 req->sense[8], req->sense[9], req->sense[10], req->sense[11], 570 req->sense[12], req->sense[13], req->sense[14], req->sense[15]); 571 } 572 573 DPRINTF("VSCSI: Command complete err=%d\n", status); 574 if (status == 0) { 575 /* We handle overflows, not underflows for normal commands, 576 * but hopefully nobody cares 577 */ 578 if (req->writing) { 579 res_out = req->data_len; 580 } else { 581 res_in = req->data_len; 582 } 583 } 584 vscsi_send_rsp(s, req, status, res_in, res_out); 585 vscsi_put_req(req); 586 } 587 588 static void vscsi_request_cancelled(SCSIRequest *sreq) 589 { 590 vscsi_req *req = sreq->hba_private; 591 592 vscsi_put_req(req); 593 } 594 595 static const VMStateDescription vmstate_spapr_vscsi_req = { 596 .name = "spapr_vscsi_req", 597 .version_id = 1, 598 .minimum_version_id = 1, 599 .minimum_version_id_old = 1, 600 .fields = (VMStateField []) { 601 VMSTATE_BUFFER(crq.raw, vscsi_req), 602 VMSTATE_BUFFER(iu.srp.reserved, vscsi_req), 603 VMSTATE_UINT32(qtag, vscsi_req), 604 VMSTATE_BOOL(active, vscsi_req), 605 VMSTATE_UINT32(data_len, vscsi_req), 606 VMSTATE_BOOL(writing, vscsi_req), 607 VMSTATE_UINT32(senselen, vscsi_req), 608 VMSTATE_BUFFER(sense, vscsi_req), 609 VMSTATE_UINT8(dma_fmt, vscsi_req), 610 VMSTATE_UINT16(local_desc, vscsi_req), 611 VMSTATE_UINT16(total_desc, vscsi_req), 612 VMSTATE_UINT16(cdb_offset, vscsi_req), 613 /*Restart SCSI request from the beginning for now */ 614 /*VMSTATE_UINT16(cur_desc_num, vscsi_req), 615 VMSTATE_UINT16(cur_desc_offset, vscsi_req),*/ 616 VMSTATE_END_OF_LIST() 617 }, 618 }; 619 620 static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq) 621 { 622 vscsi_req *req = sreq->hba_private; 623 assert(req->active); 624 625 vmstate_save_state(f, &vmstate_spapr_vscsi_req, req); 626 627 DPRINTF("VSCSI: saving tag=%u, current desc#%d, offset=%x\n", 628 req->qtag, req->cur_desc_num, req->cur_desc_offset); 629 } 630 631 static void *vscsi_load_request(QEMUFile *f, SCSIRequest *sreq) 632 { 633 SCSIBus *bus = sreq->bus; 634 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(bus->qbus.parent); 635 vscsi_req *req; 636 int rc; 637 638 assert(sreq->tag < VSCSI_REQ_LIMIT); 639 req = &s->reqs[sreq->tag]; 640 assert(!req->active); 641 642 memset(req, 0, sizeof(*req)); 643 rc = vmstate_load_state(f, &vmstate_spapr_vscsi_req, req, 1); 644 if (rc) { 645 fprintf(stderr, "VSCSI: failed loading request tag#%u\n", sreq->tag); 646 return NULL; 647 } 648 assert(req->active); 649 650 req->sreq = scsi_req_ref(sreq); 651 652 DPRINTF("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n", 653 req->qtag, req->cur_desc_num, req->cur_desc_offset); 654 655 return req; 656 } 657 658 static void vscsi_process_login(VSCSIState *s, vscsi_req *req) 659 { 660 union viosrp_iu *iu = &req->iu; 661 struct srp_login_rsp *rsp = &iu->srp.login_rsp; 662 uint64_t tag = iu->srp.rsp.tag; 663 664 DPRINTF("VSCSI: Got login, sendin response !\n"); 665 666 /* TODO handle case that requested size is wrong and 667 * buffer format is wrong 668 */ 669 memset(iu, 0, sizeof(struct srp_login_rsp)); 670 rsp->opcode = SRP_LOGIN_RSP; 671 /* Don't advertise quite as many request as we support to 672 * keep room for management stuff etc... 673 */ 674 rsp->req_lim_delta = cpu_to_be32(VSCSI_REQ_LIMIT-2); 675 rsp->tag = tag; 676 rsp->max_it_iu_len = cpu_to_be32(sizeof(union srp_iu)); 677 rsp->max_ti_iu_len = cpu_to_be32(sizeof(union srp_iu)); 678 /* direct and indirect */ 679 rsp->buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT | SRP_BUF_FORMAT_INDIRECT); 680 681 vscsi_send_iu(s, req, sizeof(*rsp), VIOSRP_SRP_FORMAT); 682 } 683 684 static void vscsi_inquiry_no_target(VSCSIState *s, vscsi_req *req) 685 { 686 uint8_t *cdb = req->iu.srp.cmd.cdb; 687 uint8_t resp_data[36]; 688 int rc, len, alen; 689 690 /* We dont do EVPD. Also check that page_code is 0 */ 691 if ((cdb[1] & 0x01) || (cdb[1] & 0x01) || cdb[2] != 0) { 692 /* Send INVALID FIELD IN CDB */ 693 vscsi_makeup_sense(s, req, ILLEGAL_REQUEST, 0x24, 0); 694 vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0); 695 return; 696 } 697 alen = cdb[3]; 698 alen = (alen << 8) | cdb[4]; 699 len = MIN(alen, 36); 700 701 /* Fake up inquiry using PQ=3 */ 702 memset(resp_data, 0, 36); 703 resp_data[0] = 0x7f; /* Not capable of supporting a device here */ 704 resp_data[2] = 0x06; /* SPS-4 */ 705 resp_data[3] = 0x02; /* Resp data format */ 706 resp_data[4] = 36 - 5; /* Additional length */ 707 resp_data[7] = 0x10; /* Sync transfers */ 708 memcpy(&resp_data[16], "QEMU EMPTY ", 16); 709 memcpy(&resp_data[8], "QEMU ", 8); 710 711 req->writing = 0; 712 vscsi_preprocess_desc(req); 713 rc = vscsi_srp_transfer_data(s, req, 0, resp_data, len); 714 if (rc < 0) { 715 vscsi_makeup_sense(s, req, HARDWARE_ERROR, 0, 0); 716 vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0); 717 } else { 718 vscsi_send_rsp(s, req, 0, 36 - rc, 0); 719 } 720 } 721 722 static int vscsi_queue_cmd(VSCSIState *s, vscsi_req *req) 723 { 724 union srp_iu *srp = &req->iu.srp; 725 SCSIDevice *sdev; 726 int n, lun; 727 728 sdev = vscsi_device_find(&s->bus, be64_to_cpu(srp->cmd.lun), &lun); 729 if (!sdev) { 730 DPRINTF("VSCSI: Command for lun %08" PRIx64 " with no drive\n", 731 be64_to_cpu(srp->cmd.lun)); 732 if (srp->cmd.cdb[0] == INQUIRY) { 733 vscsi_inquiry_no_target(s, req); 734 } else { 735 vscsi_makeup_sense(s, req, ILLEGAL_REQUEST, 0x24, 0x00); 736 vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0); 737 } return 1; 738 } 739 740 req->sreq = scsi_req_new(sdev, req->qtag, lun, srp->cmd.cdb, req); 741 n = scsi_req_enqueue(req->sreq); 742 743 DPRINTF("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n", 744 req->qtag, srp->cmd.cdb[0], lun, n); 745 746 if (n) { 747 /* Transfer direction must be set before preprocessing the 748 * descriptors 749 */ 750 req->writing = (n < 1); 751 752 /* Preprocess RDMA descriptors */ 753 vscsi_preprocess_desc(req); 754 755 /* Get transfer direction and initiate transfer */ 756 if (n > 0) { 757 req->data_len = n; 758 } else if (n < 0) { 759 req->data_len = -n; 760 } 761 scsi_req_continue(req->sreq); 762 } 763 /* Don't touch req here, it may have been recycled already */ 764 765 return 0; 766 } 767 768 static int vscsi_process_tsk_mgmt(VSCSIState *s, vscsi_req *req) 769 { 770 union viosrp_iu *iu = &req->iu; 771 vscsi_req *tmpreq; 772 int i, lun = 0, resp = SRP_TSK_MGMT_COMPLETE; 773 SCSIDevice *d; 774 uint64_t tag = iu->srp.rsp.tag; 775 uint8_t sol_not = iu->srp.cmd.sol_not; 776 777 fprintf(stderr, "vscsi_process_tsk_mgmt %02x\n", 778 iu->srp.tsk_mgmt.tsk_mgmt_func); 779 780 d = vscsi_device_find(&s->bus, be64_to_cpu(req->iu.srp.tsk_mgmt.lun), &lun); 781 if (!d) { 782 resp = SRP_TSK_MGMT_FIELDS_INVALID; 783 } else { 784 switch (iu->srp.tsk_mgmt.tsk_mgmt_func) { 785 case SRP_TSK_ABORT_TASK: 786 if (d->lun != lun) { 787 resp = SRP_TSK_MGMT_FIELDS_INVALID; 788 break; 789 } 790 791 tmpreq = vscsi_find_req(s, req->iu.srp.tsk_mgmt.task_tag); 792 if (tmpreq && tmpreq->sreq) { 793 assert(tmpreq->sreq->hba_private); 794 scsi_req_cancel(tmpreq->sreq); 795 } 796 break; 797 798 case SRP_TSK_LUN_RESET: 799 if (d->lun != lun) { 800 resp = SRP_TSK_MGMT_FIELDS_INVALID; 801 break; 802 } 803 804 qdev_reset_all(&d->qdev); 805 break; 806 807 case SRP_TSK_ABORT_TASK_SET: 808 case SRP_TSK_CLEAR_TASK_SET: 809 if (d->lun != lun) { 810 resp = SRP_TSK_MGMT_FIELDS_INVALID; 811 break; 812 } 813 814 for (i = 0; i < VSCSI_REQ_LIMIT; i++) { 815 tmpreq = &s->reqs[i]; 816 if (tmpreq->iu.srp.cmd.lun != req->iu.srp.tsk_mgmt.lun) { 817 continue; 818 } 819 if (!tmpreq->active || !tmpreq->sreq) { 820 continue; 821 } 822 assert(tmpreq->sreq->hba_private); 823 scsi_req_cancel(tmpreq->sreq); 824 } 825 break; 826 827 case SRP_TSK_CLEAR_ACA: 828 resp = SRP_TSK_MGMT_NOT_SUPPORTED; 829 break; 830 831 default: 832 resp = SRP_TSK_MGMT_FIELDS_INVALID; 833 break; 834 } 835 } 836 837 /* Compose the response here as */ 838 memset(iu, 0, sizeof(struct srp_rsp) + 4); 839 iu->srp.rsp.opcode = SRP_RSP; 840 iu->srp.rsp.req_lim_delta = cpu_to_be32(1); 841 iu->srp.rsp.tag = tag; 842 iu->srp.rsp.flags |= SRP_RSP_FLAG_RSPVALID; 843 iu->srp.rsp.resp_data_len = cpu_to_be32(4); 844 if (resp) { 845 iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2; 846 } else { 847 iu->srp.rsp.sol_not = (sol_not & 0x02) >> 1; 848 } 849 850 iu->srp.rsp.status = GOOD; 851 iu->srp.rsp.data[3] = resp; 852 853 vscsi_send_iu(s, req, sizeof(iu->srp.rsp) + 4, VIOSRP_SRP_FORMAT); 854 855 return 1; 856 } 857 858 static int vscsi_handle_srp_req(VSCSIState *s, vscsi_req *req) 859 { 860 union srp_iu *srp = &req->iu.srp; 861 int done = 1; 862 uint8_t opcode = srp->rsp.opcode; 863 864 switch (opcode) { 865 case SRP_LOGIN_REQ: 866 vscsi_process_login(s, req); 867 break; 868 case SRP_TSK_MGMT: 869 done = vscsi_process_tsk_mgmt(s, req); 870 break; 871 case SRP_CMD: 872 done = vscsi_queue_cmd(s, req); 873 break; 874 case SRP_LOGIN_RSP: 875 case SRP_I_LOGOUT: 876 case SRP_T_LOGOUT: 877 case SRP_RSP: 878 case SRP_CRED_REQ: 879 case SRP_CRED_RSP: 880 case SRP_AER_REQ: 881 case SRP_AER_RSP: 882 fprintf(stderr, "VSCSI: Unsupported opcode %02x\n", opcode); 883 break; 884 default: 885 fprintf(stderr, "VSCSI: Unknown type %02x\n", opcode); 886 } 887 888 return done; 889 } 890 891 static int vscsi_send_adapter_info(VSCSIState *s, vscsi_req *req) 892 { 893 struct viosrp_adapter_info *sinfo; 894 struct mad_adapter_info_data info; 895 int rc; 896 897 sinfo = &req->iu.mad.adapter_info; 898 899 #if 0 /* What for ? */ 900 rc = spapr_vio_dma_read(&s->vdev, be64_to_cpu(sinfo->buffer), 901 &info, be16_to_cpu(sinfo->common.length)); 902 if (rc) { 903 fprintf(stderr, "vscsi_send_adapter_info: DMA read failure !\n"); 904 } 905 #endif 906 memset(&info, 0, sizeof(info)); 907 strcpy(info.srp_version, SRP_VERSION); 908 memcpy(info.partition_name, "qemu", sizeof("qemu")); 909 info.partition_number = cpu_to_be32(0); 910 info.mad_version = cpu_to_be32(1); 911 info.os_type = cpu_to_be32(2); 912 info.port_max_txu[0] = cpu_to_be32(VSCSI_MAX_SECTORS << 9); 913 914 rc = spapr_vio_dma_write(&s->vdev, be64_to_cpu(sinfo->buffer), 915 &info, be16_to_cpu(sinfo->common.length)); 916 if (rc) { 917 fprintf(stderr, "vscsi_send_adapter_info: DMA write failure !\n"); 918 } 919 920 sinfo->common.status = rc ? cpu_to_be32(1) : 0; 921 922 return vscsi_send_iu(s, req, sizeof(*sinfo), VIOSRP_MAD_FORMAT); 923 } 924 925 static int vscsi_send_capabilities(VSCSIState *s, vscsi_req *req) 926 { 927 struct viosrp_capabilities *vcap; 928 struct capabilities cap = { }; 929 uint16_t len, req_len; 930 uint64_t buffer; 931 int rc; 932 933 vcap = &req->iu.mad.capabilities; 934 req_len = len = be16_to_cpu(vcap->common.length); 935 buffer = be64_to_cpu(vcap->buffer); 936 if (len > sizeof(cap)) { 937 fprintf(stderr, "vscsi_send_capabilities: capabilities size mismatch !\n"); 938 939 /* 940 * Just read and populate the structure that is known. 941 * Zero rest of the structure. 942 */ 943 len = sizeof(cap); 944 } 945 rc = spapr_vio_dma_read(&s->vdev, buffer, &cap, len); 946 if (rc) { 947 fprintf(stderr, "vscsi_send_capabilities: DMA read failure !\n"); 948 } 949 950 /* 951 * Current implementation does not suppport any migration or 952 * reservation capabilities. Construct the response telling the 953 * guest not to use them. 954 */ 955 cap.flags = 0; 956 cap.migration.ecl = 0; 957 cap.reserve.type = 0; 958 cap.migration.common.server_support = 0; 959 cap.reserve.common.server_support = 0; 960 961 rc = spapr_vio_dma_write(&s->vdev, buffer, &cap, len); 962 if (rc) { 963 fprintf(stderr, "vscsi_send_capabilities: DMA write failure !\n"); 964 } 965 if (req_len > len) { 966 /* 967 * Being paranoid and lets not worry about the error code 968 * here. Actual write of the cap is done above. 969 */ 970 spapr_vio_dma_set(&s->vdev, (buffer + len), 0, (req_len - len)); 971 } 972 vcap->common.status = rc ? cpu_to_be32(1) : 0; 973 return vscsi_send_iu(s, req, sizeof(*vcap), VIOSRP_MAD_FORMAT); 974 } 975 976 static int vscsi_handle_mad_req(VSCSIState *s, vscsi_req *req) 977 { 978 union mad_iu *mad = &req->iu.mad; 979 bool request_handled = false; 980 uint64_t retlen = 0; 981 982 switch (be32_to_cpu(mad->empty_iu.common.type)) { 983 case VIOSRP_EMPTY_IU_TYPE: 984 fprintf(stderr, "Unsupported EMPTY MAD IU\n"); 985 retlen = sizeof(mad->empty_iu); 986 break; 987 case VIOSRP_ERROR_LOG_TYPE: 988 fprintf(stderr, "Unsupported ERROR LOG MAD IU\n"); 989 retlen = sizeof(mad->error_log); 990 break; 991 case VIOSRP_ADAPTER_INFO_TYPE: 992 vscsi_send_adapter_info(s, req); 993 request_handled = true; 994 break; 995 case VIOSRP_HOST_CONFIG_TYPE: 996 retlen = sizeof(mad->host_config); 997 break; 998 case VIOSRP_CAPABILITIES_TYPE: 999 vscsi_send_capabilities(s, req); 1000 request_handled = true; 1001 break; 1002 default: 1003 fprintf(stderr, "VSCSI: Unknown MAD type %02x\n", 1004 be32_to_cpu(mad->empty_iu.common.type)); 1005 /* 1006 * PAPR+ says that "The length field is set to the length 1007 * of the data structure(s) used in the command". 1008 * As we did not recognize the request type, put zero there. 1009 */ 1010 retlen = 0; 1011 } 1012 1013 if (!request_handled) { 1014 mad->empty_iu.common.status = cpu_to_be16(VIOSRP_MAD_NOT_SUPPORTED); 1015 vscsi_send_iu(s, req, retlen, VIOSRP_MAD_FORMAT); 1016 } 1017 1018 return 1; 1019 } 1020 1021 static void vscsi_got_payload(VSCSIState *s, vscsi_crq *crq) 1022 { 1023 vscsi_req *req; 1024 int done; 1025 1026 req = vscsi_get_req(s); 1027 if (req == NULL) { 1028 fprintf(stderr, "VSCSI: Failed to get a request !\n"); 1029 return; 1030 } 1031 1032 /* We only support a limited number of descriptors, we know 1033 * the ibmvscsi driver uses up to 10 max, so it should fit 1034 * in our 256 bytes IUs. If not we'll have to increase the size 1035 * of the structure. 1036 */ 1037 if (crq->s.IU_length > sizeof(union viosrp_iu)) { 1038 fprintf(stderr, "VSCSI: SRP IU too long (%d bytes) !\n", 1039 crq->s.IU_length); 1040 vscsi_put_req(req); 1041 return; 1042 } 1043 1044 /* XXX Handle failure differently ? */ 1045 if (spapr_vio_dma_read(&s->vdev, crq->s.IU_data_ptr, &req->iu, 1046 crq->s.IU_length)) { 1047 fprintf(stderr, "vscsi_got_payload: DMA read failure !\n"); 1048 vscsi_put_req(req); 1049 return; 1050 } 1051 memcpy(&req->crq, crq, sizeof(vscsi_crq)); 1052 1053 if (crq->s.format == VIOSRP_MAD_FORMAT) { 1054 done = vscsi_handle_mad_req(s, req); 1055 } else { 1056 done = vscsi_handle_srp_req(s, req); 1057 } 1058 1059 if (done) { 1060 vscsi_put_req(req); 1061 } 1062 } 1063 1064 1065 static int vscsi_do_crq(struct VIOsPAPRDevice *dev, uint8_t *crq_data) 1066 { 1067 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(dev); 1068 vscsi_crq crq; 1069 1070 memcpy(crq.raw, crq_data, 16); 1071 crq.s.timeout = be16_to_cpu(crq.s.timeout); 1072 crq.s.IU_length = be16_to_cpu(crq.s.IU_length); 1073 crq.s.IU_data_ptr = be64_to_cpu(crq.s.IU_data_ptr); 1074 1075 DPRINTF("VSCSI: do_crq %02x %02x ...\n", crq.raw[0], crq.raw[1]); 1076 1077 switch (crq.s.valid) { 1078 case 0xc0: /* Init command/response */ 1079 1080 /* Respond to initialization request */ 1081 if (crq.s.format == 0x01) { 1082 memset(crq.raw, 0, 16); 1083 crq.s.valid = 0xc0; 1084 crq.s.format = 0x02; 1085 spapr_vio_send_crq(dev, crq.raw); 1086 } 1087 1088 /* Note that in hotplug cases, we might get a 0x02 1089 * as a result of us emitting the init request 1090 */ 1091 1092 break; 1093 case 0xff: /* Link event */ 1094 1095 /* Not handled for now */ 1096 1097 break; 1098 case 0x80: /* Payloads */ 1099 switch (crq.s.format) { 1100 case VIOSRP_SRP_FORMAT: /* AKA VSCSI request */ 1101 case VIOSRP_MAD_FORMAT: /* AKA VSCSI response */ 1102 vscsi_got_payload(s, &crq); 1103 break; 1104 case VIOSRP_OS400_FORMAT: 1105 case VIOSRP_AIX_FORMAT: 1106 case VIOSRP_LINUX_FORMAT: 1107 case VIOSRP_INLINE_FORMAT: 1108 fprintf(stderr, "vscsi_do_srq: Unsupported payload format %02x\n", 1109 crq.s.format); 1110 break; 1111 default: 1112 fprintf(stderr, "vscsi_do_srq: Unknown payload format %02x\n", 1113 crq.s.format); 1114 } 1115 break; 1116 default: 1117 fprintf(stderr, "vscsi_do_crq: unknown CRQ %02x %02x ...\n", 1118 crq.raw[0], crq.raw[1]); 1119 }; 1120 1121 return 0; 1122 } 1123 1124 static const struct SCSIBusInfo vscsi_scsi_info = { 1125 .tcq = true, 1126 .max_channel = 7, /* logical unit addressing format */ 1127 .max_target = 63, 1128 .max_lun = 31, 1129 1130 .transfer_data = vscsi_transfer_data, 1131 .complete = vscsi_command_complete, 1132 .cancel = vscsi_request_cancelled, 1133 .save_request = vscsi_save_request, 1134 .load_request = vscsi_load_request, 1135 }; 1136 1137 static void spapr_vscsi_reset(VIOsPAPRDevice *dev) 1138 { 1139 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(dev); 1140 int i; 1141 1142 memset(s->reqs, 0, sizeof(s->reqs)); 1143 for (i = 0; i < VSCSI_REQ_LIMIT; i++) { 1144 s->reqs[i].qtag = i; 1145 } 1146 } 1147 1148 static int spapr_vscsi_init(VIOsPAPRDevice *dev) 1149 { 1150 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(dev); 1151 Error *err = NULL; 1152 1153 dev->crq.SendFunc = vscsi_do_crq; 1154 1155 scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev), 1156 &vscsi_scsi_info, NULL); 1157 if (!dev->qdev.hotplugged) { 1158 scsi_bus_legacy_handle_cmdline(&s->bus, &err); 1159 if (err != NULL) { 1160 error_free(err); 1161 return -1; 1162 } 1163 } 1164 1165 return 0; 1166 } 1167 1168 void spapr_vscsi_create(VIOsPAPRBus *bus) 1169 { 1170 DeviceState *dev; 1171 1172 dev = qdev_create(&bus->bus, "spapr-vscsi"); 1173 1174 qdev_init_nofail(dev); 1175 } 1176 1177 static int spapr_vscsi_devnode(VIOsPAPRDevice *dev, void *fdt, int node_off) 1178 { 1179 int ret; 1180 1181 ret = fdt_setprop_cell(fdt, node_off, "#address-cells", 2); 1182 if (ret < 0) { 1183 return ret; 1184 } 1185 1186 ret = fdt_setprop_cell(fdt, node_off, "#size-cells", 0); 1187 if (ret < 0) { 1188 return ret; 1189 } 1190 1191 return 0; 1192 } 1193 1194 static Property spapr_vscsi_properties[] = { 1195 DEFINE_SPAPR_PROPERTIES(VSCSIState, vdev), 1196 DEFINE_PROP_END_OF_LIST(), 1197 }; 1198 1199 static const VMStateDescription vmstate_spapr_vscsi = { 1200 .name = "spapr_vscsi", 1201 .version_id = 1, 1202 .minimum_version_id = 1, 1203 .minimum_version_id_old = 1, 1204 .fields = (VMStateField []) { 1205 VMSTATE_SPAPR_VIO(vdev, VSCSIState), 1206 /* VSCSI state */ 1207 /* ???? */ 1208 1209 VMSTATE_END_OF_LIST() 1210 }, 1211 }; 1212 1213 static void spapr_vscsi_class_init(ObjectClass *klass, void *data) 1214 { 1215 DeviceClass *dc = DEVICE_CLASS(klass); 1216 VIOsPAPRDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass); 1217 1218 k->init = spapr_vscsi_init; 1219 k->reset = spapr_vscsi_reset; 1220 k->devnode = spapr_vscsi_devnode; 1221 k->dt_name = "v-scsi"; 1222 k->dt_type = "vscsi"; 1223 k->dt_compatible = "IBM,v-scsi"; 1224 k->signal_mask = 0x00000001; 1225 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 1226 dc->props = spapr_vscsi_properties; 1227 k->rtce_window_size = 0x10000000; 1228 dc->vmsd = &vmstate_spapr_vscsi; 1229 } 1230 1231 static const TypeInfo spapr_vscsi_info = { 1232 .name = TYPE_VIO_SPAPR_VSCSI_DEVICE, 1233 .parent = TYPE_VIO_SPAPR_DEVICE, 1234 .instance_size = sizeof(VSCSIState), 1235 .class_init = spapr_vscsi_class_init, 1236 }; 1237 1238 static void spapr_vscsi_register_types(void) 1239 { 1240 type_register_static(&spapr_vscsi_info); 1241 } 1242 1243 type_init(spapr_vscsi_register_types) 1244