scsi: Change scsi sense buf size to 252
[qemu.git] / hw / scsi / spapr_vscsi.c
1 /*
2 * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
3 *
4 * PAPR Virtual SCSI, aka ibmvscsi
5 *
6 * Copyright (c) 2010,2011 Benjamin Herrenschmidt, IBM Corporation.
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 *
26 * TODO:
27 *
28 * - Cleanups :-)
29 * - Sort out better how to assign devices to VSCSI instances
30 * - Fix residual counts
31 * - Add indirect descriptors support
32 * - Maybe do autosense (PAPR seems to mandate it, linux doesn't care)
33 */
34 #include "hw/hw.h"
35 #include "hw/scsi/scsi.h"
36 #include "block/scsi.h"
37 #include "srp.h"
38 #include "hw/qdev.h"
39 #include "hw/ppc/spapr.h"
40 #include "hw/ppc/spapr_vio.h"
41 #include "viosrp.h"
42
43 #include <libfdt.h>
44
45 /*#define DEBUG_VSCSI*/
46
47 #ifdef DEBUG_VSCSI
48 #define DPRINTF(fmt, ...) \
49 do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
50 #else
51 #define DPRINTF(fmt, ...) \
52 do { } while (0)
53 #endif
54
55 /*
56 * Virtual SCSI device
57 */
58
59 /* Random numbers */
60 #define VSCSI_MAX_SECTORS 4096
61 #define VSCSI_REQ_LIMIT 24
62
63 #define SRP_RSP_SENSE_DATA_LEN 18
64
65 typedef union vscsi_crq {
66 struct viosrp_crq s;
67 uint8_t raw[16];
68 } vscsi_crq;
69
70 typedef struct vscsi_req {
71 vscsi_crq crq;
72 union viosrp_iu iu;
73
74 /* SCSI request tracking */
75 SCSIRequest *sreq;
76 uint32_t qtag; /* qemu tag != srp tag */
77 bool active;
78 uint32_t data_len;
79 bool writing;
80 uint32_t senselen;
81 uint8_t sense[SCSI_SENSE_BUF_SIZE];
82
83 /* RDMA related bits */
84 uint8_t dma_fmt;
85 uint16_t local_desc;
86 uint16_t total_desc;
87 uint16_t cdb_offset;
88 uint16_t cur_desc_num;
89 uint16_t cur_desc_offset;
90 } vscsi_req;
91
92 #define TYPE_VIO_SPAPR_VSCSI_DEVICE "spapr-vscsi"
93 #define VIO_SPAPR_VSCSI_DEVICE(obj) \
94 OBJECT_CHECK(VSCSIState, (obj), TYPE_VIO_SPAPR_VSCSI_DEVICE)
95
96 typedef struct {
97 VIOsPAPRDevice vdev;
98 SCSIBus bus;
99 vscsi_req reqs[VSCSI_REQ_LIMIT];
100 } VSCSIState;
101
102 static struct vscsi_req *vscsi_get_req(VSCSIState *s)
103 {
104 vscsi_req *req;
105 int i;
106
107 for (i = 0; i < VSCSI_REQ_LIMIT; i++) {
108 req = &s->reqs[i];
109 if (!req->active) {
110 memset(req, 0, sizeof(*req));
111 req->qtag = i;
112 req->active = 1;
113 return req;
114 }
115 }
116 return NULL;
117 }
118
119 static struct vscsi_req *vscsi_find_req(VSCSIState *s, uint64_t srp_tag)
120 {
121 vscsi_req *req;
122 int i;
123
124 for (i = 0; i < VSCSI_REQ_LIMIT; i++) {
125 req = &s->reqs[i];
126 if (req->iu.srp.cmd.tag == srp_tag) {
127 return req;
128 }
129 }
130 return NULL;
131 }
132
133 static void vscsi_put_req(vscsi_req *req)
134 {
135 if (req->sreq != NULL) {
136 scsi_req_unref(req->sreq);
137 }
138 req->sreq = NULL;
139 req->active = 0;
140 }
141
142 static SCSIDevice *vscsi_device_find(SCSIBus *bus, uint64_t srp_lun, int *lun)
143 {
144 int channel = 0, id = 0;
145
146 retry:
147 switch (srp_lun >> 62) {
148 case 0:
149 if ((srp_lun >> 56) != 0) {
150 channel = (srp_lun >> 56) & 0x3f;
151 id = (srp_lun >> 48) & 0xff;
152 srp_lun <<= 16;
153 goto retry;
154 }
155 *lun = (srp_lun >> 48) & 0xff;
156 break;
157
158 case 1:
159 *lun = (srp_lun >> 48) & 0x3fff;
160 break;
161 case 2:
162 channel = (srp_lun >> 53) & 0x7;
163 id = (srp_lun >> 56) & 0x3f;
164 *lun = (srp_lun >> 48) & 0x1f;
165 break;
166 case 3:
167 *lun = -1;
168 return NULL;
169 default:
170 abort();
171 }
172
173 return scsi_device_find(bus, channel, id, *lun);
174 }
175
176 static int vscsi_send_iu(VSCSIState *s, vscsi_req *req,
177 uint64_t length, uint8_t format)
178 {
179 long rc, rc1;
180
181 /* First copy the SRP */
182 rc = spapr_vio_dma_write(&s->vdev, req->crq.s.IU_data_ptr,
183 &req->iu, length);
184 if (rc) {
185 fprintf(stderr, "vscsi_send_iu: DMA write failure !\n");
186 }
187
188 req->crq.s.valid = 0x80;
189 req->crq.s.format = format;
190 req->crq.s.reserved = 0x00;
191 req->crq.s.timeout = cpu_to_be16(0x0000);
192 req->crq.s.IU_length = cpu_to_be16(length);
193 req->crq.s.IU_data_ptr = req->iu.srp.rsp.tag; /* right byte order */
194
195 if (rc == 0) {
196 req->crq.s.status = 0x99; /* Just needs to be non-zero */
197 } else {
198 req->crq.s.status = 0x00;
199 }
200
201 rc1 = spapr_vio_send_crq(&s->vdev, req->crq.raw);
202 if (rc1) {
203 fprintf(stderr, "vscsi_send_iu: Error sending response\n");
204 return rc1;
205 }
206
207 return rc;
208 }
209
210 static void vscsi_makeup_sense(VSCSIState *s, vscsi_req *req,
211 uint8_t key, uint8_t asc, uint8_t ascq)
212 {
213 req->senselen = SRP_RSP_SENSE_DATA_LEN;
214
215 /* Valid bit and 'current errors' */
216 req->sense[0] = (0x1 << 7 | 0x70);
217 /* Sense key */
218 req->sense[2] = key;
219 /* Additional sense length */
220 req->sense[7] = 0xa; /* 10 bytes */
221 /* Additional sense code */
222 req->sense[12] = asc;
223 req->sense[13] = ascq;
224 }
225
226 static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
227 uint8_t status, int32_t res_in, int32_t res_out)
228 {
229 union viosrp_iu *iu = &req->iu;
230 uint64_t tag = iu->srp.rsp.tag;
231 int total_len = sizeof(iu->srp.rsp);
232 uint8_t sol_not = iu->srp.cmd.sol_not;
233
234 DPRINTF("VSCSI: Sending resp status: 0x%x, "
235 "res_in: %d, res_out: %d\n", status, res_in, res_out);
236
237 memset(iu, 0, sizeof(struct srp_rsp));
238 iu->srp.rsp.opcode = SRP_RSP;
239 iu->srp.rsp.req_lim_delta = cpu_to_be32(1);
240 iu->srp.rsp.tag = tag;
241
242 /* Handle residuals */
243 if (res_in < 0) {
244 iu->srp.rsp.flags |= SRP_RSP_FLAG_DIUNDER;
245 res_in = -res_in;
246 } else if (res_in) {
247 iu->srp.rsp.flags |= SRP_RSP_FLAG_DIOVER;
248 }
249 if (res_out < 0) {
250 iu->srp.rsp.flags |= SRP_RSP_FLAG_DOUNDER;
251 res_out = -res_out;
252 } else if (res_out) {
253 iu->srp.rsp.flags |= SRP_RSP_FLAG_DOOVER;
254 }
255 iu->srp.rsp.data_in_res_cnt = cpu_to_be32(res_in);
256 iu->srp.rsp.data_out_res_cnt = cpu_to_be32(res_out);
257
258 /* We don't do response data */
259 /* iu->srp.rsp.flags &= ~SRP_RSP_FLAG_RSPVALID; */
260 iu->srp.rsp.resp_data_len = cpu_to_be32(0);
261
262 /* Handle success vs. failure */
263 iu->srp.rsp.status = status;
264 if (status) {
265 iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2;
266 if (req->senselen) {
267 req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID;
268 req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen);
269 memcpy(req->iu.srp.rsp.data, req->sense, req->senselen);
270 total_len += req->senselen;
271 }
272 } else {
273 iu->srp.rsp.sol_not = (sol_not & 0x02) >> 1;
274 }
275
276 vscsi_send_iu(s, req, total_len, VIOSRP_SRP_FORMAT);
277 return 0;
278 }
279
280 static inline struct srp_direct_buf vscsi_swap_desc(struct srp_direct_buf desc)
281 {
282 desc.va = be64_to_cpu(desc.va);
283 desc.len = be32_to_cpu(desc.len);
284 return desc;
285 }
286
287 static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
288 unsigned n, unsigned buf_offset,
289 struct srp_direct_buf *ret)
290 {
291 struct srp_cmd *cmd = &req->iu.srp.cmd;
292
293 switch (req->dma_fmt) {
294 case SRP_NO_DATA_DESC: {
295 DPRINTF("VSCSI: no data descriptor\n");
296 return 0;
297 }
298 case SRP_DATA_DESC_DIRECT: {
299 memcpy(ret, cmd->add_data + req->cdb_offset, sizeof(*ret));
300 assert(req->cur_desc_num == 0);
301 DPRINTF("VSCSI: direct segment\n");
302 break;
303 }
304 case SRP_DATA_DESC_INDIRECT: {
305 struct srp_indirect_buf *tmp = (struct srp_indirect_buf *)
306 (cmd->add_data + req->cdb_offset);
307 if (n < req->local_desc) {
308 *ret = tmp->desc_list[n];
309 DPRINTF("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
310 req->qtag, n, req->local_desc);
311
312 } else if (n < req->total_desc) {
313 int rc;
314 struct srp_direct_buf tbl_desc = vscsi_swap_desc(tmp->table_desc);
315 unsigned desc_offset = n * sizeof(struct srp_direct_buf);
316
317 if (desc_offset >= tbl_desc.len) {
318 DPRINTF("VSCSI: #%d is ouf of range (%d bytes)\n",
319 n, desc_offset);
320 return -1;
321 }
322 rc = spapr_vio_dma_read(&s->vdev, tbl_desc.va + desc_offset,
323 ret, sizeof(struct srp_direct_buf));
324 if (rc) {
325 DPRINTF("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
326 rc);
327 return -1;
328 }
329 DPRINTF("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n",
330 req->qtag, n, req->total_desc, tbl_desc.va, tbl_desc.len);
331 } else {
332 DPRINTF("VSCSI: Out of descriptors !\n");
333 return 0;
334 }
335 break;
336 }
337 default:
338 fprintf(stderr, "VSCSI: Unknown format %x\n", req->dma_fmt);
339 return -1;
340 }
341
342 *ret = vscsi_swap_desc(*ret);
343 if (buf_offset > ret->len) {
344 DPRINTF(" offset=%x is out of a descriptor #%d boundary=%x\n",
345 buf_offset, req->cur_desc_num, ret->len);
346 return -1;
347 }
348 ret->va += buf_offset;
349 ret->len -= buf_offset;
350
351 DPRINTF(" cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n",
352 req->cur_desc_num, req->cur_desc_offset, ret->va, ret->len);
353
354 return ret->len ? 1 : 0;
355 }
356
357 static int vscsi_srp_direct_data(VSCSIState *s, vscsi_req *req,
358 uint8_t *buf, uint32_t len)
359 {
360 struct srp_direct_buf md;
361 uint32_t llen;
362 int rc = 0;
363
364 rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md);
365 if (rc < 0) {
366 return -1;
367 } else if (rc == 0) {
368 return 0;
369 }
370
371 llen = MIN(len, md.len);
372 if (llen) {
373 if (req->writing) { /* writing = to device = reading from memory */
374 rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen);
375 } else {
376 rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
377 }
378 }
379
380 if (rc) {
381 return -1;
382 }
383 req->cur_desc_offset += llen;
384
385 return llen;
386 }
387
388 static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
389 uint8_t *buf, uint32_t len)
390 {
391 struct srp_direct_buf md;
392 int rc = 0;
393 uint32_t llen, total = 0;
394
395 DPRINTF("VSCSI: indirect segment 0x%x bytes\n", len);
396
397 /* While we have data ... */
398 while (len) {
399 rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md);
400 if (rc < 0) {
401 return -1;
402 } else if (rc == 0) {
403 break;
404 }
405
406 /* Perform transfer */
407 llen = MIN(len, md.len);
408 if (req->writing) { /* writing = to device = reading from memory */
409 rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen);
410 } else {
411 rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
412 }
413 if (rc) {
414 DPRINTF("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
415 break;
416 }
417 DPRINTF("VSCSI: data: %02x %02x %02x %02x...\n",
418 buf[0], buf[1], buf[2], buf[3]);
419
420 len -= llen;
421 buf += llen;
422
423 total += llen;
424
425 /* Update current position in the current descriptor */
426 req->cur_desc_offset += llen;
427 if (md.len == llen) {
428 /* Go to the next descriptor if the current one finished */
429 ++req->cur_desc_num;
430 req->cur_desc_offset = 0;
431 }
432 }
433
434 return rc ? -1 : total;
435 }
436
437 static int vscsi_srp_transfer_data(VSCSIState *s, vscsi_req *req,
438 int writing, uint8_t *buf, uint32_t len)
439 {
440 int err = 0;
441
442 switch (req->dma_fmt) {
443 case SRP_NO_DATA_DESC:
444 DPRINTF("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len);
445 break;
446 case SRP_DATA_DESC_DIRECT:
447 err = vscsi_srp_direct_data(s, req, buf, len);
448 break;
449 case SRP_DATA_DESC_INDIRECT:
450 err = vscsi_srp_indirect_data(s, req, buf, len);
451 break;
452 }
453 return err;
454 }
455
456 /* Bits from linux srp */
457 static int data_out_desc_size(struct srp_cmd *cmd)
458 {
459 int size = 0;
460 uint8_t fmt = cmd->buf_fmt >> 4;
461
462 switch (fmt) {
463 case SRP_NO_DATA_DESC:
464 break;
465 case SRP_DATA_DESC_DIRECT:
466 size = sizeof(struct srp_direct_buf);
467 break;
468 case SRP_DATA_DESC_INDIRECT:
469 size = sizeof(struct srp_indirect_buf) +
470 sizeof(struct srp_direct_buf)*cmd->data_out_desc_cnt;
471 break;
472 default:
473 break;
474 }
475 return size;
476 }
477
478 static int vscsi_preprocess_desc(vscsi_req *req)
479 {
480 struct srp_cmd *cmd = &req->iu.srp.cmd;
481
482 req->cdb_offset = cmd->add_cdb_len & ~3;
483
484 if (req->writing) {
485 req->dma_fmt = cmd->buf_fmt >> 4;
486 } else {
487 req->cdb_offset += data_out_desc_size(cmd);
488 req->dma_fmt = cmd->buf_fmt & ((1U << 4) - 1);
489 }
490
491 switch (req->dma_fmt) {
492 case SRP_NO_DATA_DESC:
493 break;
494 case SRP_DATA_DESC_DIRECT:
495 req->total_desc = req->local_desc = 1;
496 break;
497 case SRP_DATA_DESC_INDIRECT: {
498 struct srp_indirect_buf *ind_tmp = (struct srp_indirect_buf *)
499 (cmd->add_data + req->cdb_offset);
500
501 req->total_desc = be32_to_cpu(ind_tmp->table_desc.len) /
502 sizeof(struct srp_direct_buf);
503 req->local_desc = req->writing ? cmd->data_out_desc_cnt :
504 cmd->data_in_desc_cnt;
505 break;
506 }
507 default:
508 fprintf(stderr,
509 "vscsi_preprocess_desc: Unknown format %x\n", req->dma_fmt);
510 return -1;
511 }
512
513 return 0;
514 }
515
516 /* Callback to indicate that the SCSI layer has completed a transfer. */
517 static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t len)
518 {
519 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(sreq->bus->qbus.parent);
520 vscsi_req *req = sreq->hba_private;
521 uint8_t *buf;
522 int rc = 0;
523
524 DPRINTF("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
525 sreq->tag, len, req);
526 if (req == NULL) {
527 fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
528 return;
529 }
530
531 if (len) {
532 buf = scsi_req_get_buf(sreq);
533 rc = vscsi_srp_transfer_data(s, req, req->writing, buf, len);
534 }
535 if (rc < 0) {
536 fprintf(stderr, "VSCSI: RDMA error rc=%d!\n", rc);
537 vscsi_makeup_sense(s, req, HARDWARE_ERROR, 0, 0);
538 scsi_req_abort(req->sreq, CHECK_CONDITION);
539 return;
540 }
541
542 /* Start next chunk */
543 req->data_len -= rc;
544 scsi_req_continue(sreq);
545 }
546
547 /* Callback to indicate that the SCSI layer has completed a transfer. */
548 static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t resid)
549 {
550 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(sreq->bus->qbus.parent);
551 vscsi_req *req = sreq->hba_private;
552 int32_t res_in = 0, res_out = 0;
553
554 DPRINTF("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
555 sreq->tag, status, req);
556 if (req == NULL) {
557 fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
558 return;
559 }
560
561 if (status == CHECK_CONDITION) {
562 req->senselen = scsi_req_get_sense(req->sreq, req->sense,
563 sizeof(req->sense));
564 DPRINTF("VSCSI: Sense data, %d bytes:\n", req->senselen);
565 DPRINTF(" %02x %02x %02x %02x %02x %02x %02x %02x\n",
566 req->sense[0], req->sense[1], req->sense[2], req->sense[3],
567 req->sense[4], req->sense[5], req->sense[6], req->sense[7]);
568 DPRINTF(" %02x %02x %02x %02x %02x %02x %02x %02x\n",
569 req->sense[8], req->sense[9], req->sense[10], req->sense[11],
570 req->sense[12], req->sense[13], req->sense[14], req->sense[15]);
571 }
572
573 DPRINTF("VSCSI: Command complete err=%d\n", status);
574 if (status == 0) {
575 /* We handle overflows, not underflows for normal commands,
576 * but hopefully nobody cares
577 */
578 if (req->writing) {
579 res_out = req->data_len;
580 } else {
581 res_in = req->data_len;
582 }
583 }
584 vscsi_send_rsp(s, req, status, res_in, res_out);
585 vscsi_put_req(req);
586 }
587
588 static void vscsi_request_cancelled(SCSIRequest *sreq)
589 {
590 vscsi_req *req = sreq->hba_private;
591
592 vscsi_put_req(req);
593 }
594
595 static const VMStateDescription vmstate_spapr_vscsi_req = {
596 .name = "spapr_vscsi_req",
597 .version_id = 1,
598 .minimum_version_id = 1,
599 .minimum_version_id_old = 1,
600 .fields = (VMStateField []) {
601 VMSTATE_BUFFER(crq.raw, vscsi_req),
602 VMSTATE_BUFFER(iu.srp.reserved, vscsi_req),
603 VMSTATE_UINT32(qtag, vscsi_req),
604 VMSTATE_BOOL(active, vscsi_req),
605 VMSTATE_UINT32(data_len, vscsi_req),
606 VMSTATE_BOOL(writing, vscsi_req),
607 VMSTATE_UINT32(senselen, vscsi_req),
608 VMSTATE_BUFFER(sense, vscsi_req),
609 VMSTATE_UINT8(dma_fmt, vscsi_req),
610 VMSTATE_UINT16(local_desc, vscsi_req),
611 VMSTATE_UINT16(total_desc, vscsi_req),
612 VMSTATE_UINT16(cdb_offset, vscsi_req),
613 /*Restart SCSI request from the beginning for now */
614 /*VMSTATE_UINT16(cur_desc_num, vscsi_req),
615 VMSTATE_UINT16(cur_desc_offset, vscsi_req),*/
616 VMSTATE_END_OF_LIST()
617 },
618 };
619
620 static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq)
621 {
622 vscsi_req *req = sreq->hba_private;
623 assert(req->active);
624
625 vmstate_save_state(f, &vmstate_spapr_vscsi_req, req);
626
627 DPRINTF("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
628 req->qtag, req->cur_desc_num, req->cur_desc_offset);
629 }
630
631 static void *vscsi_load_request(QEMUFile *f, SCSIRequest *sreq)
632 {
633 SCSIBus *bus = sreq->bus;
634 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(bus->qbus.parent);
635 vscsi_req *req;
636 int rc;
637
638 assert(sreq->tag < VSCSI_REQ_LIMIT);
639 req = &s->reqs[sreq->tag];
640 assert(!req->active);
641
642 memset(req, 0, sizeof(*req));
643 rc = vmstate_load_state(f, &vmstate_spapr_vscsi_req, req, 1);
644 if (rc) {
645 fprintf(stderr, "VSCSI: failed loading request tag#%u\n", sreq->tag);
646 return NULL;
647 }
648 assert(req->active);
649
650 req->sreq = scsi_req_ref(sreq);
651
652 DPRINTF("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
653 req->qtag, req->cur_desc_num, req->cur_desc_offset);
654
655 return req;
656 }
657
658 static void vscsi_process_login(VSCSIState *s, vscsi_req *req)
659 {
660 union viosrp_iu *iu = &req->iu;
661 struct srp_login_rsp *rsp = &iu->srp.login_rsp;
662 uint64_t tag = iu->srp.rsp.tag;
663
664 DPRINTF("VSCSI: Got login, sendin response !\n");
665
666 /* TODO handle case that requested size is wrong and
667 * buffer format is wrong
668 */
669 memset(iu, 0, sizeof(struct srp_login_rsp));
670 rsp->opcode = SRP_LOGIN_RSP;
671 /* Don't advertise quite as many request as we support to
672 * keep room for management stuff etc...
673 */
674 rsp->req_lim_delta = cpu_to_be32(VSCSI_REQ_LIMIT-2);
675 rsp->tag = tag;
676 rsp->max_it_iu_len = cpu_to_be32(sizeof(union srp_iu));
677 rsp->max_ti_iu_len = cpu_to_be32(sizeof(union srp_iu));
678 /* direct and indirect */
679 rsp->buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT | SRP_BUF_FORMAT_INDIRECT);
680
681 vscsi_send_iu(s, req, sizeof(*rsp), VIOSRP_SRP_FORMAT);
682 }
683
684 static void vscsi_inquiry_no_target(VSCSIState *s, vscsi_req *req)
685 {
686 uint8_t *cdb = req->iu.srp.cmd.cdb;
687 uint8_t resp_data[36];
688 int rc, len, alen;
689
690 /* We dont do EVPD. Also check that page_code is 0 */
691 if ((cdb[1] & 0x01) || (cdb[1] & 0x01) || cdb[2] != 0) {
692 /* Send INVALID FIELD IN CDB */
693 vscsi_makeup_sense(s, req, ILLEGAL_REQUEST, 0x24, 0);
694 vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0);
695 return;
696 }
697 alen = cdb[3];
698 alen = (alen << 8) | cdb[4];
699 len = MIN(alen, 36);
700
701 /* Fake up inquiry using PQ=3 */
702 memset(resp_data, 0, 36);
703 resp_data[0] = 0x7f; /* Not capable of supporting a device here */
704 resp_data[2] = 0x06; /* SPS-4 */
705 resp_data[3] = 0x02; /* Resp data format */
706 resp_data[4] = 36 - 5; /* Additional length */
707 resp_data[7] = 0x10; /* Sync transfers */
708 memcpy(&resp_data[16], "QEMU EMPTY ", 16);
709 memcpy(&resp_data[8], "QEMU ", 8);
710
711 req->writing = 0;
712 vscsi_preprocess_desc(req);
713 rc = vscsi_srp_transfer_data(s, req, 0, resp_data, len);
714 if (rc < 0) {
715 vscsi_makeup_sense(s, req, HARDWARE_ERROR, 0, 0);
716 vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0);
717 } else {
718 vscsi_send_rsp(s, req, 0, 36 - rc, 0);
719 }
720 }
721
722 static int vscsi_queue_cmd(VSCSIState *s, vscsi_req *req)
723 {
724 union srp_iu *srp = &req->iu.srp;
725 SCSIDevice *sdev;
726 int n, lun;
727
728 sdev = vscsi_device_find(&s->bus, be64_to_cpu(srp->cmd.lun), &lun);
729 if (!sdev) {
730 DPRINTF("VSCSI: Command for lun %08" PRIx64 " with no drive\n",
731 be64_to_cpu(srp->cmd.lun));
732 if (srp->cmd.cdb[0] == INQUIRY) {
733 vscsi_inquiry_no_target(s, req);
734 } else {
735 vscsi_makeup_sense(s, req, ILLEGAL_REQUEST, 0x24, 0x00);
736 vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0);
737 } return 1;
738 }
739
740 req->sreq = scsi_req_new(sdev, req->qtag, lun, srp->cmd.cdb, req);
741 n = scsi_req_enqueue(req->sreq);
742
743 DPRINTF("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
744 req->qtag, srp->cmd.cdb[0], lun, n);
745
746 if (n) {
747 /* Transfer direction must be set before preprocessing the
748 * descriptors
749 */
750 req->writing = (n < 1);
751
752 /* Preprocess RDMA descriptors */
753 vscsi_preprocess_desc(req);
754
755 /* Get transfer direction and initiate transfer */
756 if (n > 0) {
757 req->data_len = n;
758 } else if (n < 0) {
759 req->data_len = -n;
760 }
761 scsi_req_continue(req->sreq);
762 }
763 /* Don't touch req here, it may have been recycled already */
764
765 return 0;
766 }
767
768 static int vscsi_process_tsk_mgmt(VSCSIState *s, vscsi_req *req)
769 {
770 union viosrp_iu *iu = &req->iu;
771 vscsi_req *tmpreq;
772 int i, lun = 0, resp = SRP_TSK_MGMT_COMPLETE;
773 SCSIDevice *d;
774 uint64_t tag = iu->srp.rsp.tag;
775 uint8_t sol_not = iu->srp.cmd.sol_not;
776
777 fprintf(stderr, "vscsi_process_tsk_mgmt %02x\n",
778 iu->srp.tsk_mgmt.tsk_mgmt_func);
779
780 d = vscsi_device_find(&s->bus, be64_to_cpu(req->iu.srp.tsk_mgmt.lun), &lun);
781 if (!d) {
782 resp = SRP_TSK_MGMT_FIELDS_INVALID;
783 } else {
784 switch (iu->srp.tsk_mgmt.tsk_mgmt_func) {
785 case SRP_TSK_ABORT_TASK:
786 if (d->lun != lun) {
787 resp = SRP_TSK_MGMT_FIELDS_INVALID;
788 break;
789 }
790
791 tmpreq = vscsi_find_req(s, req->iu.srp.tsk_mgmt.task_tag);
792 if (tmpreq && tmpreq->sreq) {
793 assert(tmpreq->sreq->hba_private);
794 scsi_req_cancel(tmpreq->sreq);
795 }
796 break;
797
798 case SRP_TSK_LUN_RESET:
799 if (d->lun != lun) {
800 resp = SRP_TSK_MGMT_FIELDS_INVALID;
801 break;
802 }
803
804 qdev_reset_all(&d->qdev);
805 break;
806
807 case SRP_TSK_ABORT_TASK_SET:
808 case SRP_TSK_CLEAR_TASK_SET:
809 if (d->lun != lun) {
810 resp = SRP_TSK_MGMT_FIELDS_INVALID;
811 break;
812 }
813
814 for (i = 0; i < VSCSI_REQ_LIMIT; i++) {
815 tmpreq = &s->reqs[i];
816 if (tmpreq->iu.srp.cmd.lun != req->iu.srp.tsk_mgmt.lun) {
817 continue;
818 }
819 if (!tmpreq->active || !tmpreq->sreq) {
820 continue;
821 }
822 assert(tmpreq->sreq->hba_private);
823 scsi_req_cancel(tmpreq->sreq);
824 }
825 break;
826
827 case SRP_TSK_CLEAR_ACA:
828 resp = SRP_TSK_MGMT_NOT_SUPPORTED;
829 break;
830
831 default:
832 resp = SRP_TSK_MGMT_FIELDS_INVALID;
833 break;
834 }
835 }
836
837 /* Compose the response here as */
838 memset(iu, 0, sizeof(struct srp_rsp) + 4);
839 iu->srp.rsp.opcode = SRP_RSP;
840 iu->srp.rsp.req_lim_delta = cpu_to_be32(1);
841 iu->srp.rsp.tag = tag;
842 iu->srp.rsp.flags |= SRP_RSP_FLAG_RSPVALID;
843 iu->srp.rsp.resp_data_len = cpu_to_be32(4);
844 if (resp) {
845 iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2;
846 } else {
847 iu->srp.rsp.sol_not = (sol_not & 0x02) >> 1;
848 }
849
850 iu->srp.rsp.status = GOOD;
851 iu->srp.rsp.data[3] = resp;
852
853 vscsi_send_iu(s, req, sizeof(iu->srp.rsp) + 4, VIOSRP_SRP_FORMAT);
854
855 return 1;
856 }
857
858 static int vscsi_handle_srp_req(VSCSIState *s, vscsi_req *req)
859 {
860 union srp_iu *srp = &req->iu.srp;
861 int done = 1;
862 uint8_t opcode = srp->rsp.opcode;
863
864 switch (opcode) {
865 case SRP_LOGIN_REQ:
866 vscsi_process_login(s, req);
867 break;
868 case SRP_TSK_MGMT:
869 done = vscsi_process_tsk_mgmt(s, req);
870 break;
871 case SRP_CMD:
872 done = vscsi_queue_cmd(s, req);
873 break;
874 case SRP_LOGIN_RSP:
875 case SRP_I_LOGOUT:
876 case SRP_T_LOGOUT:
877 case SRP_RSP:
878 case SRP_CRED_REQ:
879 case SRP_CRED_RSP:
880 case SRP_AER_REQ:
881 case SRP_AER_RSP:
882 fprintf(stderr, "VSCSI: Unsupported opcode %02x\n", opcode);
883 break;
884 default:
885 fprintf(stderr, "VSCSI: Unknown type %02x\n", opcode);
886 }
887
888 return done;
889 }
890
891 static int vscsi_send_adapter_info(VSCSIState *s, vscsi_req *req)
892 {
893 struct viosrp_adapter_info *sinfo;
894 struct mad_adapter_info_data info;
895 int rc;
896
897 sinfo = &req->iu.mad.adapter_info;
898
899 #if 0 /* What for ? */
900 rc = spapr_vio_dma_read(&s->vdev, be64_to_cpu(sinfo->buffer),
901 &info, be16_to_cpu(sinfo->common.length));
902 if (rc) {
903 fprintf(stderr, "vscsi_send_adapter_info: DMA read failure !\n");
904 }
905 #endif
906 memset(&info, 0, sizeof(info));
907 strcpy(info.srp_version, SRP_VERSION);
908 memcpy(info.partition_name, "qemu", sizeof("qemu"));
909 info.partition_number = cpu_to_be32(0);
910 info.mad_version = cpu_to_be32(1);
911 info.os_type = cpu_to_be32(2);
912 info.port_max_txu[0] = cpu_to_be32(VSCSI_MAX_SECTORS << 9);
913
914 rc = spapr_vio_dma_write(&s->vdev, be64_to_cpu(sinfo->buffer),
915 &info, be16_to_cpu(sinfo->common.length));
916 if (rc) {
917 fprintf(stderr, "vscsi_send_adapter_info: DMA write failure !\n");
918 }
919
920 sinfo->common.status = rc ? cpu_to_be32(1) : 0;
921
922 return vscsi_send_iu(s, req, sizeof(*sinfo), VIOSRP_MAD_FORMAT);
923 }
924
925 static int vscsi_send_capabilities(VSCSIState *s, vscsi_req *req)
926 {
927 struct viosrp_capabilities *vcap;
928 struct capabilities cap = { };
929 uint16_t len, req_len;
930 uint64_t buffer;
931 int rc;
932
933 vcap = &req->iu.mad.capabilities;
934 req_len = len = be16_to_cpu(vcap->common.length);
935 buffer = be64_to_cpu(vcap->buffer);
936 if (len > sizeof(cap)) {
937 fprintf(stderr, "vscsi_send_capabilities: capabilities size mismatch !\n");
938
939 /*
940 * Just read and populate the structure that is known.
941 * Zero rest of the structure.
942 */
943 len = sizeof(cap);
944 }
945 rc = spapr_vio_dma_read(&s->vdev, buffer, &cap, len);
946 if (rc) {
947 fprintf(stderr, "vscsi_send_capabilities: DMA read failure !\n");
948 }
949
950 /*
951 * Current implementation does not suppport any migration or
952 * reservation capabilities. Construct the response telling the
953 * guest not to use them.
954 */
955 cap.flags = 0;
956 cap.migration.ecl = 0;
957 cap.reserve.type = 0;
958 cap.migration.common.server_support = 0;
959 cap.reserve.common.server_support = 0;
960
961 rc = spapr_vio_dma_write(&s->vdev, buffer, &cap, len);
962 if (rc) {
963 fprintf(stderr, "vscsi_send_capabilities: DMA write failure !\n");
964 }
965 if (req_len > len) {
966 /*
967 * Being paranoid and lets not worry about the error code
968 * here. Actual write of the cap is done above.
969 */
970 spapr_vio_dma_set(&s->vdev, (buffer + len), 0, (req_len - len));
971 }
972 vcap->common.status = rc ? cpu_to_be32(1) : 0;
973 return vscsi_send_iu(s, req, sizeof(*vcap), VIOSRP_MAD_FORMAT);
974 }
975
976 static int vscsi_handle_mad_req(VSCSIState *s, vscsi_req *req)
977 {
978 union mad_iu *mad = &req->iu.mad;
979 bool request_handled = false;
980 uint64_t retlen = 0;
981
982 switch (be32_to_cpu(mad->empty_iu.common.type)) {
983 case VIOSRP_EMPTY_IU_TYPE:
984 fprintf(stderr, "Unsupported EMPTY MAD IU\n");
985 retlen = sizeof(mad->empty_iu);
986 break;
987 case VIOSRP_ERROR_LOG_TYPE:
988 fprintf(stderr, "Unsupported ERROR LOG MAD IU\n");
989 retlen = sizeof(mad->error_log);
990 break;
991 case VIOSRP_ADAPTER_INFO_TYPE:
992 vscsi_send_adapter_info(s, req);
993 request_handled = true;
994 break;
995 case VIOSRP_HOST_CONFIG_TYPE:
996 retlen = sizeof(mad->host_config);
997 break;
998 case VIOSRP_CAPABILITIES_TYPE:
999 vscsi_send_capabilities(s, req);
1000 request_handled = true;
1001 break;
1002 default:
1003 fprintf(stderr, "VSCSI: Unknown MAD type %02x\n",
1004 be32_to_cpu(mad->empty_iu.common.type));
1005 /*
1006 * PAPR+ says that "The length field is set to the length
1007 * of the data structure(s) used in the command".
1008 * As we did not recognize the request type, put zero there.
1009 */
1010 retlen = 0;
1011 }
1012
1013 if (!request_handled) {
1014 mad->empty_iu.common.status = cpu_to_be16(VIOSRP_MAD_NOT_SUPPORTED);
1015 vscsi_send_iu(s, req, retlen, VIOSRP_MAD_FORMAT);
1016 }
1017
1018 return 1;
1019 }
1020
1021 static void vscsi_got_payload(VSCSIState *s, vscsi_crq *crq)
1022 {
1023 vscsi_req *req;
1024 int done;
1025
1026 req = vscsi_get_req(s);
1027 if (req == NULL) {
1028 fprintf(stderr, "VSCSI: Failed to get a request !\n");
1029 return;
1030 }
1031
1032 /* We only support a limited number of descriptors, we know
1033 * the ibmvscsi driver uses up to 10 max, so it should fit
1034 * in our 256 bytes IUs. If not we'll have to increase the size
1035 * of the structure.
1036 */
1037 if (crq->s.IU_length > sizeof(union viosrp_iu)) {
1038 fprintf(stderr, "VSCSI: SRP IU too long (%d bytes) !\n",
1039 crq->s.IU_length);
1040 vscsi_put_req(req);
1041 return;
1042 }
1043
1044 /* XXX Handle failure differently ? */
1045 if (spapr_vio_dma_read(&s->vdev, crq->s.IU_data_ptr, &req->iu,
1046 crq->s.IU_length)) {
1047 fprintf(stderr, "vscsi_got_payload: DMA read failure !\n");
1048 vscsi_put_req(req);
1049 return;
1050 }
1051 memcpy(&req->crq, crq, sizeof(vscsi_crq));
1052
1053 if (crq->s.format == VIOSRP_MAD_FORMAT) {
1054 done = vscsi_handle_mad_req(s, req);
1055 } else {
1056 done = vscsi_handle_srp_req(s, req);
1057 }
1058
1059 if (done) {
1060 vscsi_put_req(req);
1061 }
1062 }
1063
1064
1065 static int vscsi_do_crq(struct VIOsPAPRDevice *dev, uint8_t *crq_data)
1066 {
1067 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(dev);
1068 vscsi_crq crq;
1069
1070 memcpy(crq.raw, crq_data, 16);
1071 crq.s.timeout = be16_to_cpu(crq.s.timeout);
1072 crq.s.IU_length = be16_to_cpu(crq.s.IU_length);
1073 crq.s.IU_data_ptr = be64_to_cpu(crq.s.IU_data_ptr);
1074
1075 DPRINTF("VSCSI: do_crq %02x %02x ...\n", crq.raw[0], crq.raw[1]);
1076
1077 switch (crq.s.valid) {
1078 case 0xc0: /* Init command/response */
1079
1080 /* Respond to initialization request */
1081 if (crq.s.format == 0x01) {
1082 memset(crq.raw, 0, 16);
1083 crq.s.valid = 0xc0;
1084 crq.s.format = 0x02;
1085 spapr_vio_send_crq(dev, crq.raw);
1086 }
1087
1088 /* Note that in hotplug cases, we might get a 0x02
1089 * as a result of us emitting the init request
1090 */
1091
1092 break;
1093 case 0xff: /* Link event */
1094
1095 /* Not handled for now */
1096
1097 break;
1098 case 0x80: /* Payloads */
1099 switch (crq.s.format) {
1100 case VIOSRP_SRP_FORMAT: /* AKA VSCSI request */
1101 case VIOSRP_MAD_FORMAT: /* AKA VSCSI response */
1102 vscsi_got_payload(s, &crq);
1103 break;
1104 case VIOSRP_OS400_FORMAT:
1105 case VIOSRP_AIX_FORMAT:
1106 case VIOSRP_LINUX_FORMAT:
1107 case VIOSRP_INLINE_FORMAT:
1108 fprintf(stderr, "vscsi_do_srq: Unsupported payload format %02x\n",
1109 crq.s.format);
1110 break;
1111 default:
1112 fprintf(stderr, "vscsi_do_srq: Unknown payload format %02x\n",
1113 crq.s.format);
1114 }
1115 break;
1116 default:
1117 fprintf(stderr, "vscsi_do_crq: unknown CRQ %02x %02x ...\n",
1118 crq.raw[0], crq.raw[1]);
1119 };
1120
1121 return 0;
1122 }
1123
1124 static const struct SCSIBusInfo vscsi_scsi_info = {
1125 .tcq = true,
1126 .max_channel = 7, /* logical unit addressing format */
1127 .max_target = 63,
1128 .max_lun = 31,
1129
1130 .transfer_data = vscsi_transfer_data,
1131 .complete = vscsi_command_complete,
1132 .cancel = vscsi_request_cancelled,
1133 .save_request = vscsi_save_request,
1134 .load_request = vscsi_load_request,
1135 };
1136
1137 static void spapr_vscsi_reset(VIOsPAPRDevice *dev)
1138 {
1139 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(dev);
1140 int i;
1141
1142 memset(s->reqs, 0, sizeof(s->reqs));
1143 for (i = 0; i < VSCSI_REQ_LIMIT; i++) {
1144 s->reqs[i].qtag = i;
1145 }
1146 }
1147
1148 static int spapr_vscsi_init(VIOsPAPRDevice *dev)
1149 {
1150 VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(dev);
1151 Error *err = NULL;
1152
1153 dev->crq.SendFunc = vscsi_do_crq;
1154
1155 scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
1156 &vscsi_scsi_info, NULL);
1157 if (!dev->qdev.hotplugged) {
1158 scsi_bus_legacy_handle_cmdline(&s->bus, &err);
1159 if (err != NULL) {
1160 error_free(err);
1161 return -1;
1162 }
1163 }
1164
1165 return 0;
1166 }
1167
1168 void spapr_vscsi_create(VIOsPAPRBus *bus)
1169 {
1170 DeviceState *dev;
1171
1172 dev = qdev_create(&bus->bus, "spapr-vscsi");
1173
1174 qdev_init_nofail(dev);
1175 }
1176
1177 static int spapr_vscsi_devnode(VIOsPAPRDevice *dev, void *fdt, int node_off)
1178 {
1179 int ret;
1180
1181 ret = fdt_setprop_cell(fdt, node_off, "#address-cells", 2);
1182 if (ret < 0) {
1183 return ret;
1184 }
1185
1186 ret = fdt_setprop_cell(fdt, node_off, "#size-cells", 0);
1187 if (ret < 0) {
1188 return ret;
1189 }
1190
1191 return 0;
1192 }
1193
1194 static Property spapr_vscsi_properties[] = {
1195 DEFINE_SPAPR_PROPERTIES(VSCSIState, vdev),
1196 DEFINE_PROP_END_OF_LIST(),
1197 };
1198
1199 static const VMStateDescription vmstate_spapr_vscsi = {
1200 .name = "spapr_vscsi",
1201 .version_id = 1,
1202 .minimum_version_id = 1,
1203 .minimum_version_id_old = 1,
1204 .fields = (VMStateField []) {
1205 VMSTATE_SPAPR_VIO(vdev, VSCSIState),
1206 /* VSCSI state */
1207 /* ???? */
1208
1209 VMSTATE_END_OF_LIST()
1210 },
1211 };
1212
1213 static void spapr_vscsi_class_init(ObjectClass *klass, void *data)
1214 {
1215 DeviceClass *dc = DEVICE_CLASS(klass);
1216 VIOsPAPRDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
1217
1218 k->init = spapr_vscsi_init;
1219 k->reset = spapr_vscsi_reset;
1220 k->devnode = spapr_vscsi_devnode;
1221 k->dt_name = "v-scsi";
1222 k->dt_type = "vscsi";
1223 k->dt_compatible = "IBM,v-scsi";
1224 k->signal_mask = 0x00000001;
1225 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1226 dc->props = spapr_vscsi_properties;
1227 k->rtce_window_size = 0x10000000;
1228 dc->vmsd = &vmstate_spapr_vscsi;
1229 }
1230
1231 static const TypeInfo spapr_vscsi_info = {
1232 .name = TYPE_VIO_SPAPR_VSCSI_DEVICE,
1233 .parent = TYPE_VIO_SPAPR_DEVICE,
1234 .instance_size = sizeof(VSCSIState),
1235 .class_init = spapr_vscsi_class_init,
1236 };
1237
1238 static void spapr_vscsi_register_types(void)
1239 {
1240 type_register_static(&spapr_vscsi_info);
1241 }
1242
1243 type_init(spapr_vscsi_register_types)