2 * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
4 * PAPR Virtual SCSI, aka ibmvscsi
6 * Copyright (c) 2010,2011 Benjamin Herrenschmidt, IBM Corporation.
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
29 * - Sort out better how to assign devices to VSCSI instances
30 * - Fix residual counts
31 * - Add indirect descriptors support
32 * - Maybe do autosense (PAPR seems to mandate it, linux doesn't care)
35 #include "hw/scsi/scsi.h"
36 #include "block/scsi.h"
39 #include "hw/ppc/spapr.h"
40 #include "hw/ppc/spapr_vio.h"
45 /*#define DEBUG_VSCSI*/
48 #define DPRINTF(fmt, ...) \
49 do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
51 #define DPRINTF(fmt, ...) \
60 #define VSCSI_MAX_SECTORS 4096
61 #define VSCSI_REQ_LIMIT 24
63 #define SCSI_SENSE_BUF_SIZE 96
64 #define SRP_RSP_SENSE_DATA_LEN 18
66 typedef union vscsi_crq
{
71 typedef struct vscsi_req
{
75 /* SCSI request tracking */
77 uint32_t qtag
; /* qemu tag != srp tag */
82 uint8_t sense
[SCSI_SENSE_BUF_SIZE
];
84 /* RDMA related bits */
89 uint16_t cur_desc_num
;
90 uint16_t cur_desc_offset
;
93 #define TYPE_VIO_SPAPR_VSCSI_DEVICE "spapr-vscsi"
94 #define VIO_SPAPR_VSCSI_DEVICE(obj) \
95 OBJECT_CHECK(VSCSIState, (obj), TYPE_VIO_SPAPR_VSCSI_DEVICE)
100 vscsi_req reqs
[VSCSI_REQ_LIMIT
];
103 static struct vscsi_req
*vscsi_get_req(VSCSIState
*s
)
108 for (i
= 0; i
< VSCSI_REQ_LIMIT
; i
++) {
111 memset(req
, 0, sizeof(*req
));
120 static struct vscsi_req
*vscsi_find_req(VSCSIState
*s
, uint64_t srp_tag
)
125 for (i
= 0; i
< VSCSI_REQ_LIMIT
; i
++) {
127 if (req
->iu
.srp
.cmd
.tag
== srp_tag
) {
134 static void vscsi_put_req(vscsi_req
*req
)
136 if (req
->sreq
!= NULL
) {
137 scsi_req_unref(req
->sreq
);
143 static SCSIDevice
*vscsi_device_find(SCSIBus
*bus
, uint64_t srp_lun
, int *lun
)
145 int channel
= 0, id
= 0;
148 switch (srp_lun
>> 62) {
150 if ((srp_lun
>> 56) != 0) {
151 channel
= (srp_lun
>> 56) & 0x3f;
152 id
= (srp_lun
>> 48) & 0xff;
156 *lun
= (srp_lun
>> 48) & 0xff;
160 *lun
= (srp_lun
>> 48) & 0x3fff;
163 channel
= (srp_lun
>> 53) & 0x7;
164 id
= (srp_lun
>> 56) & 0x3f;
165 *lun
= (srp_lun
>> 48) & 0x1f;
174 return scsi_device_find(bus
, channel
, id
, *lun
);
177 static int vscsi_send_iu(VSCSIState
*s
, vscsi_req
*req
,
178 uint64_t length
, uint8_t format
)
182 /* First copy the SRP */
183 rc
= spapr_vio_dma_write(&s
->vdev
, req
->crq
.s
.IU_data_ptr
,
186 fprintf(stderr
, "vscsi_send_iu: DMA write failure !\n");
189 req
->crq
.s
.valid
= 0x80;
190 req
->crq
.s
.format
= format
;
191 req
->crq
.s
.reserved
= 0x00;
192 req
->crq
.s
.timeout
= cpu_to_be16(0x0000);
193 req
->crq
.s
.IU_length
= cpu_to_be16(length
);
194 req
->crq
.s
.IU_data_ptr
= req
->iu
.srp
.rsp
.tag
; /* right byte order */
197 req
->crq
.s
.status
= 0x99; /* Just needs to be non-zero */
199 req
->crq
.s
.status
= 0x00;
202 rc1
= spapr_vio_send_crq(&s
->vdev
, req
->crq
.raw
);
204 fprintf(stderr
, "vscsi_send_iu: Error sending response\n");
211 static void vscsi_makeup_sense(VSCSIState
*s
, vscsi_req
*req
,
212 uint8_t key
, uint8_t asc
, uint8_t ascq
)
214 req
->senselen
= SRP_RSP_SENSE_DATA_LEN
;
216 /* Valid bit and 'current errors' */
217 req
->sense
[0] = (0x1 << 7 | 0x70);
220 /* Additional sense length */
221 req
->sense
[7] = 0xa; /* 10 bytes */
222 /* Additional sense code */
223 req
->sense
[12] = asc
;
224 req
->sense
[13] = ascq
;
227 static int vscsi_send_rsp(VSCSIState
*s
, vscsi_req
*req
,
228 uint8_t status
, int32_t res_in
, int32_t res_out
)
230 union viosrp_iu
*iu
= &req
->iu
;
231 uint64_t tag
= iu
->srp
.rsp
.tag
;
232 int total_len
= sizeof(iu
->srp
.rsp
);
233 uint8_t sol_not
= iu
->srp
.cmd
.sol_not
;
235 DPRINTF("VSCSI: Sending resp status: 0x%x, "
236 "res_in: %d, res_out: %d\n", status
, res_in
, res_out
);
238 memset(iu
, 0, sizeof(struct srp_rsp
));
239 iu
->srp
.rsp
.opcode
= SRP_RSP
;
240 iu
->srp
.rsp
.req_lim_delta
= cpu_to_be32(1);
241 iu
->srp
.rsp
.tag
= tag
;
243 /* Handle residuals */
245 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_DIUNDER
;
248 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_DIOVER
;
251 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_DOUNDER
;
253 } else if (res_out
) {
254 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_DOOVER
;
256 iu
->srp
.rsp
.data_in_res_cnt
= cpu_to_be32(res_in
);
257 iu
->srp
.rsp
.data_out_res_cnt
= cpu_to_be32(res_out
);
259 /* We don't do response data */
260 /* iu->srp.rsp.flags &= ~SRP_RSP_FLAG_RSPVALID; */
261 iu
->srp
.rsp
.resp_data_len
= cpu_to_be32(0);
263 /* Handle success vs. failure */
264 iu
->srp
.rsp
.status
= status
;
266 iu
->srp
.rsp
.sol_not
= (sol_not
& 0x04) >> 2;
268 req
->iu
.srp
.rsp
.flags
|= SRP_RSP_FLAG_SNSVALID
;
269 req
->iu
.srp
.rsp
.sense_data_len
= cpu_to_be32(req
->senselen
);
270 memcpy(req
->iu
.srp
.rsp
.data
, req
->sense
, req
->senselen
);
271 total_len
+= req
->senselen
;
274 iu
->srp
.rsp
.sol_not
= (sol_not
& 0x02) >> 1;
277 vscsi_send_iu(s
, req
, total_len
, VIOSRP_SRP_FORMAT
);
281 static inline struct srp_direct_buf
vscsi_swap_desc(struct srp_direct_buf desc
)
283 desc
.va
= be64_to_cpu(desc
.va
);
284 desc
.len
= be32_to_cpu(desc
.len
);
288 static int vscsi_fetch_desc(VSCSIState
*s
, struct vscsi_req
*req
,
289 unsigned n
, unsigned buf_offset
,
290 struct srp_direct_buf
*ret
)
292 struct srp_cmd
*cmd
= &req
->iu
.srp
.cmd
;
294 switch (req
->dma_fmt
) {
295 case SRP_NO_DATA_DESC
: {
296 DPRINTF("VSCSI: no data descriptor\n");
299 case SRP_DATA_DESC_DIRECT
: {
300 memcpy(ret
, cmd
->add_data
+ req
->cdb_offset
, sizeof(*ret
));
301 assert(req
->cur_desc_num
== 0);
302 DPRINTF("VSCSI: direct segment\n");
305 case SRP_DATA_DESC_INDIRECT
: {
306 struct srp_indirect_buf
*tmp
= (struct srp_indirect_buf
*)
307 (cmd
->add_data
+ req
->cdb_offset
);
308 if (n
< req
->local_desc
) {
309 *ret
= tmp
->desc_list
[n
];
310 DPRINTF("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
311 req
->qtag
, n
, req
->local_desc
);
313 } else if (n
< req
->total_desc
) {
315 struct srp_direct_buf tbl_desc
= vscsi_swap_desc(tmp
->table_desc
);
316 unsigned desc_offset
= n
* sizeof(struct srp_direct_buf
);
318 if (desc_offset
>= tbl_desc
.len
) {
319 DPRINTF("VSCSI: #%d is ouf of range (%d bytes)\n",
323 rc
= spapr_vio_dma_read(&s
->vdev
, tbl_desc
.va
+ desc_offset
,
324 ret
, sizeof(struct srp_direct_buf
));
326 DPRINTF("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
330 DPRINTF("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64
" len=%x }\n",
331 req
->qtag
, n
, req
->total_desc
, tbl_desc
.va
, tbl_desc
.len
);
333 DPRINTF("VSCSI: Out of descriptors !\n");
339 fprintf(stderr
, "VSCSI: Unknown format %x\n", req
->dma_fmt
);
343 *ret
= vscsi_swap_desc(*ret
);
344 if (buf_offset
> ret
->len
) {
345 DPRINTF(" offset=%x is out of a descriptor #%d boundary=%x\n",
346 buf_offset
, req
->cur_desc_num
, ret
->len
);
349 ret
->va
+= buf_offset
;
350 ret
->len
-= buf_offset
;
352 DPRINTF(" cur=%d offs=%x ret { va=%"PRIx64
" len=%x }\n",
353 req
->cur_desc_num
, req
->cur_desc_offset
, ret
->va
, ret
->len
);
355 return ret
->len
? 1 : 0;
358 static int vscsi_srp_direct_data(VSCSIState
*s
, vscsi_req
*req
,
359 uint8_t *buf
, uint32_t len
)
361 struct srp_direct_buf md
;
365 rc
= vscsi_fetch_desc(s
, req
, req
->cur_desc_num
, req
->cur_desc_offset
, &md
);
368 } else if (rc
== 0) {
372 llen
= MIN(len
, md
.len
);
374 if (req
->writing
) { /* writing = to device = reading from memory */
375 rc
= spapr_vio_dma_read(&s
->vdev
, md
.va
, buf
, llen
);
377 rc
= spapr_vio_dma_write(&s
->vdev
, md
.va
, buf
, llen
);
384 req
->cur_desc_offset
+= llen
;
389 static int vscsi_srp_indirect_data(VSCSIState
*s
, vscsi_req
*req
,
390 uint8_t *buf
, uint32_t len
)
392 struct srp_direct_buf md
;
394 uint32_t llen
, total
= 0;
396 DPRINTF("VSCSI: indirect segment 0x%x bytes\n", len
);
398 /* While we have data ... */
400 rc
= vscsi_fetch_desc(s
, req
, req
->cur_desc_num
, req
->cur_desc_offset
, &md
);
403 } else if (rc
== 0) {
407 /* Perform transfer */
408 llen
= MIN(len
, md
.len
);
409 if (req
->writing
) { /* writing = to device = reading from memory */
410 rc
= spapr_vio_dma_read(&s
->vdev
, md
.va
, buf
, llen
);
412 rc
= spapr_vio_dma_write(&s
->vdev
, md
.va
, buf
, llen
);
415 DPRINTF("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req
->writing
, rc
);
418 DPRINTF("VSCSI: data: %02x %02x %02x %02x...\n",
419 buf
[0], buf
[1], buf
[2], buf
[3]);
426 /* Update current position in the current descriptor */
427 req
->cur_desc_offset
+= llen
;
428 if (md
.len
== llen
) {
429 /* Go to the next descriptor if the current one finished */
431 req
->cur_desc_offset
= 0;
435 return rc
? -1 : total
;
438 static int vscsi_srp_transfer_data(VSCSIState
*s
, vscsi_req
*req
,
439 int writing
, uint8_t *buf
, uint32_t len
)
443 switch (req
->dma_fmt
) {
444 case SRP_NO_DATA_DESC
:
445 DPRINTF("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len
);
447 case SRP_DATA_DESC_DIRECT
:
448 err
= vscsi_srp_direct_data(s
, req
, buf
, len
);
450 case SRP_DATA_DESC_INDIRECT
:
451 err
= vscsi_srp_indirect_data(s
, req
, buf
, len
);
457 /* Bits from linux srp */
458 static int data_out_desc_size(struct srp_cmd
*cmd
)
461 uint8_t fmt
= cmd
->buf_fmt
>> 4;
464 case SRP_NO_DATA_DESC
:
466 case SRP_DATA_DESC_DIRECT
:
467 size
= sizeof(struct srp_direct_buf
);
469 case SRP_DATA_DESC_INDIRECT
:
470 size
= sizeof(struct srp_indirect_buf
) +
471 sizeof(struct srp_direct_buf
)*cmd
->data_out_desc_cnt
;
479 static int vscsi_preprocess_desc(vscsi_req
*req
)
481 struct srp_cmd
*cmd
= &req
->iu
.srp
.cmd
;
483 req
->cdb_offset
= cmd
->add_cdb_len
& ~3;
486 req
->dma_fmt
= cmd
->buf_fmt
>> 4;
488 req
->cdb_offset
+= data_out_desc_size(cmd
);
489 req
->dma_fmt
= cmd
->buf_fmt
& ((1U << 4) - 1);
492 switch (req
->dma_fmt
) {
493 case SRP_NO_DATA_DESC
:
495 case SRP_DATA_DESC_DIRECT
:
496 req
->total_desc
= req
->local_desc
= 1;
498 case SRP_DATA_DESC_INDIRECT
: {
499 struct srp_indirect_buf
*ind_tmp
= (struct srp_indirect_buf
*)
500 (cmd
->add_data
+ req
->cdb_offset
);
502 req
->total_desc
= be32_to_cpu(ind_tmp
->table_desc
.len
) /
503 sizeof(struct srp_direct_buf
);
504 req
->local_desc
= req
->writing
? cmd
->data_out_desc_cnt
:
505 cmd
->data_in_desc_cnt
;
510 "vscsi_preprocess_desc: Unknown format %x\n", req
->dma_fmt
);
517 /* Callback to indicate that the SCSI layer has completed a transfer. */
518 static void vscsi_transfer_data(SCSIRequest
*sreq
, uint32_t len
)
520 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(sreq
->bus
->qbus
.parent
);
521 vscsi_req
*req
= sreq
->hba_private
;
525 DPRINTF("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
526 sreq
->tag
, len
, req
);
528 fprintf(stderr
, "VSCSI: Can't find request for tag 0x%x\n", sreq
->tag
);
533 buf
= scsi_req_get_buf(sreq
);
534 rc
= vscsi_srp_transfer_data(s
, req
, req
->writing
, buf
, len
);
537 fprintf(stderr
, "VSCSI: RDMA error rc=%d!\n", rc
);
538 vscsi_makeup_sense(s
, req
, HARDWARE_ERROR
, 0, 0);
539 scsi_req_abort(req
->sreq
, CHECK_CONDITION
);
543 /* Start next chunk */
545 scsi_req_continue(sreq
);
548 /* Callback to indicate that the SCSI layer has completed a transfer. */
549 static void vscsi_command_complete(SCSIRequest
*sreq
, uint32_t status
, size_t resid
)
551 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(sreq
->bus
->qbus
.parent
);
552 vscsi_req
*req
= sreq
->hba_private
;
553 int32_t res_in
= 0, res_out
= 0;
555 DPRINTF("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
556 sreq
->tag
, status
, req
);
558 fprintf(stderr
, "VSCSI: Can't find request for tag 0x%x\n", sreq
->tag
);
562 if (status
== CHECK_CONDITION
) {
563 req
->senselen
= scsi_req_get_sense(req
->sreq
, req
->sense
,
565 DPRINTF("VSCSI: Sense data, %d bytes:\n", req
->senselen
);
566 DPRINTF(" %02x %02x %02x %02x %02x %02x %02x %02x\n",
567 req
->sense
[0], req
->sense
[1], req
->sense
[2], req
->sense
[3],
568 req
->sense
[4], req
->sense
[5], req
->sense
[6], req
->sense
[7]);
569 DPRINTF(" %02x %02x %02x %02x %02x %02x %02x %02x\n",
570 req
->sense
[8], req
->sense
[9], req
->sense
[10], req
->sense
[11],
571 req
->sense
[12], req
->sense
[13], req
->sense
[14], req
->sense
[15]);
574 DPRINTF("VSCSI: Command complete err=%d\n", status
);
576 /* We handle overflows, not underflows for normal commands,
577 * but hopefully nobody cares
580 res_out
= req
->data_len
;
582 res_in
= req
->data_len
;
585 vscsi_send_rsp(s
, req
, status
, res_in
, res_out
);
589 static void vscsi_request_cancelled(SCSIRequest
*sreq
)
591 vscsi_req
*req
= sreq
->hba_private
;
596 static const VMStateDescription vmstate_spapr_vscsi_req
= {
597 .name
= "spapr_vscsi_req",
599 .minimum_version_id
= 1,
600 .minimum_version_id_old
= 1,
601 .fields
= (VMStateField
[]) {
602 VMSTATE_BUFFER(crq
.raw
, vscsi_req
),
603 VMSTATE_BUFFER(iu
.srp
.reserved
, vscsi_req
),
604 VMSTATE_UINT32(qtag
, vscsi_req
),
605 VMSTATE_BOOL(active
, vscsi_req
),
606 VMSTATE_UINT32(data_len
, vscsi_req
),
607 VMSTATE_BOOL(writing
, vscsi_req
),
608 VMSTATE_UINT32(senselen
, vscsi_req
),
609 VMSTATE_BUFFER(sense
, vscsi_req
),
610 VMSTATE_UINT8(dma_fmt
, vscsi_req
),
611 VMSTATE_UINT16(local_desc
, vscsi_req
),
612 VMSTATE_UINT16(total_desc
, vscsi_req
),
613 VMSTATE_UINT16(cdb_offset
, vscsi_req
),
614 /*Restart SCSI request from the beginning for now */
615 /*VMSTATE_UINT16(cur_desc_num, vscsi_req),
616 VMSTATE_UINT16(cur_desc_offset, vscsi_req),*/
617 VMSTATE_END_OF_LIST()
621 static void vscsi_save_request(QEMUFile
*f
, SCSIRequest
*sreq
)
623 vscsi_req
*req
= sreq
->hba_private
;
626 vmstate_save_state(f
, &vmstate_spapr_vscsi_req
, req
);
628 DPRINTF("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
629 req
->qtag
, req
->cur_desc_num
, req
->cur_desc_offset
);
632 static void *vscsi_load_request(QEMUFile
*f
, SCSIRequest
*sreq
)
634 SCSIBus
*bus
= sreq
->bus
;
635 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(bus
->qbus
.parent
);
639 assert(sreq
->tag
< VSCSI_REQ_LIMIT
);
640 req
= &s
->reqs
[sreq
->tag
];
641 assert(!req
->active
);
643 memset(req
, 0, sizeof(*req
));
644 rc
= vmstate_load_state(f
, &vmstate_spapr_vscsi_req
, req
, 1);
646 fprintf(stderr
, "VSCSI: failed loading request tag#%u\n", sreq
->tag
);
651 req
->sreq
= scsi_req_ref(sreq
);
653 DPRINTF("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
654 req
->qtag
, req
->cur_desc_num
, req
->cur_desc_offset
);
659 static void vscsi_process_login(VSCSIState
*s
, vscsi_req
*req
)
661 union viosrp_iu
*iu
= &req
->iu
;
662 struct srp_login_rsp
*rsp
= &iu
->srp
.login_rsp
;
663 uint64_t tag
= iu
->srp
.rsp
.tag
;
665 DPRINTF("VSCSI: Got login, sendin response !\n");
667 /* TODO handle case that requested size is wrong and
668 * buffer format is wrong
670 memset(iu
, 0, sizeof(struct srp_login_rsp
));
671 rsp
->opcode
= SRP_LOGIN_RSP
;
672 /* Don't advertise quite as many request as we support to
673 * keep room for management stuff etc...
675 rsp
->req_lim_delta
= cpu_to_be32(VSCSI_REQ_LIMIT
-2);
677 rsp
->max_it_iu_len
= cpu_to_be32(sizeof(union srp_iu
));
678 rsp
->max_ti_iu_len
= cpu_to_be32(sizeof(union srp_iu
));
679 /* direct and indirect */
680 rsp
->buf_fmt
= cpu_to_be16(SRP_BUF_FORMAT_DIRECT
| SRP_BUF_FORMAT_INDIRECT
);
682 vscsi_send_iu(s
, req
, sizeof(*rsp
), VIOSRP_SRP_FORMAT
);
685 static void vscsi_inquiry_no_target(VSCSIState
*s
, vscsi_req
*req
)
687 uint8_t *cdb
= req
->iu
.srp
.cmd
.cdb
;
688 uint8_t resp_data
[36];
691 /* We dont do EVPD. Also check that page_code is 0 */
692 if ((cdb
[1] & 0x01) || (cdb
[1] & 0x01) || cdb
[2] != 0) {
693 /* Send INVALID FIELD IN CDB */
694 vscsi_makeup_sense(s
, req
, ILLEGAL_REQUEST
, 0x24, 0);
695 vscsi_send_rsp(s
, req
, CHECK_CONDITION
, 0, 0);
699 alen
= (alen
<< 8) | cdb
[4];
702 /* Fake up inquiry using PQ=3 */
703 memset(resp_data
, 0, 36);
704 resp_data
[0] = 0x7f; /* Not capable of supporting a device here */
705 resp_data
[2] = 0x06; /* SPS-4 */
706 resp_data
[3] = 0x02; /* Resp data format */
707 resp_data
[4] = 36 - 5; /* Additional length */
708 resp_data
[7] = 0x10; /* Sync transfers */
709 memcpy(&resp_data
[16], "QEMU EMPTY ", 16);
710 memcpy(&resp_data
[8], "QEMU ", 8);
713 vscsi_preprocess_desc(req
);
714 rc
= vscsi_srp_transfer_data(s
, req
, 0, resp_data
, len
);
716 vscsi_makeup_sense(s
, req
, HARDWARE_ERROR
, 0, 0);
717 vscsi_send_rsp(s
, req
, CHECK_CONDITION
, 0, 0);
719 vscsi_send_rsp(s
, req
, 0, 36 - rc
, 0);
723 static int vscsi_queue_cmd(VSCSIState
*s
, vscsi_req
*req
)
725 union srp_iu
*srp
= &req
->iu
.srp
;
729 sdev
= vscsi_device_find(&s
->bus
, be64_to_cpu(srp
->cmd
.lun
), &lun
);
731 DPRINTF("VSCSI: Command for lun %08" PRIx64
" with no drive\n",
732 be64_to_cpu(srp
->cmd
.lun
));
733 if (srp
->cmd
.cdb
[0] == INQUIRY
) {
734 vscsi_inquiry_no_target(s
, req
);
736 vscsi_makeup_sense(s
, req
, ILLEGAL_REQUEST
, 0x24, 0x00);
737 vscsi_send_rsp(s
, req
, CHECK_CONDITION
, 0, 0);
741 req
->sreq
= scsi_req_new(sdev
, req
->qtag
, lun
, srp
->cmd
.cdb
, req
);
742 n
= scsi_req_enqueue(req
->sreq
);
744 DPRINTF("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
745 req
->qtag
, srp
->cmd
.cdb
[0], lun
, n
);
748 /* Transfer direction must be set before preprocessing the
751 req
->writing
= (n
< 1);
753 /* Preprocess RDMA descriptors */
754 vscsi_preprocess_desc(req
);
756 /* Get transfer direction and initiate transfer */
762 scsi_req_continue(req
->sreq
);
764 /* Don't touch req here, it may have been recycled already */
769 static int vscsi_process_tsk_mgmt(VSCSIState
*s
, vscsi_req
*req
)
771 union viosrp_iu
*iu
= &req
->iu
;
773 int i
, lun
= 0, resp
= SRP_TSK_MGMT_COMPLETE
;
775 uint64_t tag
= iu
->srp
.rsp
.tag
;
776 uint8_t sol_not
= iu
->srp
.cmd
.sol_not
;
778 fprintf(stderr
, "vscsi_process_tsk_mgmt %02x\n",
779 iu
->srp
.tsk_mgmt
.tsk_mgmt_func
);
781 d
= vscsi_device_find(&s
->bus
, be64_to_cpu(req
->iu
.srp
.tsk_mgmt
.lun
), &lun
);
783 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
785 switch (iu
->srp
.tsk_mgmt
.tsk_mgmt_func
) {
786 case SRP_TSK_ABORT_TASK
:
788 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
792 tmpreq
= vscsi_find_req(s
, req
->iu
.srp
.tsk_mgmt
.task_tag
);
793 if (tmpreq
&& tmpreq
->sreq
) {
794 assert(tmpreq
->sreq
->hba_private
);
795 scsi_req_cancel(tmpreq
->sreq
);
799 case SRP_TSK_LUN_RESET
:
801 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
805 qdev_reset_all(&d
->qdev
);
808 case SRP_TSK_ABORT_TASK_SET
:
809 case SRP_TSK_CLEAR_TASK_SET
:
811 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
815 for (i
= 0; i
< VSCSI_REQ_LIMIT
; i
++) {
816 tmpreq
= &s
->reqs
[i
];
817 if (tmpreq
->iu
.srp
.cmd
.lun
!= req
->iu
.srp
.tsk_mgmt
.lun
) {
820 if (!tmpreq
->active
|| !tmpreq
->sreq
) {
823 assert(tmpreq
->sreq
->hba_private
);
824 scsi_req_cancel(tmpreq
->sreq
);
828 case SRP_TSK_CLEAR_ACA
:
829 resp
= SRP_TSK_MGMT_NOT_SUPPORTED
;
833 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
838 /* Compose the response here as */
839 memset(iu
, 0, sizeof(struct srp_rsp
) + 4);
840 iu
->srp
.rsp
.opcode
= SRP_RSP
;
841 iu
->srp
.rsp
.req_lim_delta
= cpu_to_be32(1);
842 iu
->srp
.rsp
.tag
= tag
;
843 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_RSPVALID
;
844 iu
->srp
.rsp
.resp_data_len
= cpu_to_be32(4);
846 iu
->srp
.rsp
.sol_not
= (sol_not
& 0x04) >> 2;
848 iu
->srp
.rsp
.sol_not
= (sol_not
& 0x02) >> 1;
851 iu
->srp
.rsp
.status
= GOOD
;
852 iu
->srp
.rsp
.data
[3] = resp
;
854 vscsi_send_iu(s
, req
, sizeof(iu
->srp
.rsp
) + 4, VIOSRP_SRP_FORMAT
);
859 static int vscsi_handle_srp_req(VSCSIState
*s
, vscsi_req
*req
)
861 union srp_iu
*srp
= &req
->iu
.srp
;
863 uint8_t opcode
= srp
->rsp
.opcode
;
867 vscsi_process_login(s
, req
);
870 done
= vscsi_process_tsk_mgmt(s
, req
);
873 done
= vscsi_queue_cmd(s
, req
);
883 fprintf(stderr
, "VSCSI: Unsupported opcode %02x\n", opcode
);
886 fprintf(stderr
, "VSCSI: Unknown type %02x\n", opcode
);
892 static int vscsi_send_adapter_info(VSCSIState
*s
, vscsi_req
*req
)
894 struct viosrp_adapter_info
*sinfo
;
895 struct mad_adapter_info_data info
;
898 sinfo
= &req
->iu
.mad
.adapter_info
;
900 #if 0 /* What for ? */
901 rc
= spapr_vio_dma_read(&s
->vdev
, be64_to_cpu(sinfo
->buffer
),
902 &info
, be16_to_cpu(sinfo
->common
.length
));
904 fprintf(stderr
, "vscsi_send_adapter_info: DMA read failure !\n");
907 memset(&info
, 0, sizeof(info
));
908 strcpy(info
.srp_version
, SRP_VERSION
);
909 memcpy(info
.partition_name
, "qemu", sizeof("qemu"));
910 info
.partition_number
= cpu_to_be32(0);
911 info
.mad_version
= cpu_to_be32(1);
912 info
.os_type
= cpu_to_be32(2);
913 info
.port_max_txu
[0] = cpu_to_be32(VSCSI_MAX_SECTORS
<< 9);
915 rc
= spapr_vio_dma_write(&s
->vdev
, be64_to_cpu(sinfo
->buffer
),
916 &info
, be16_to_cpu(sinfo
->common
.length
));
918 fprintf(stderr
, "vscsi_send_adapter_info: DMA write failure !\n");
921 sinfo
->common
.status
= rc
? cpu_to_be32(1) : 0;
923 return vscsi_send_iu(s
, req
, sizeof(*sinfo
), VIOSRP_MAD_FORMAT
);
926 static int vscsi_send_capabilities(VSCSIState
*s
, vscsi_req
*req
)
928 struct viosrp_capabilities
*vcap
;
929 struct capabilities cap
= { };
930 uint16_t len
, req_len
;
934 vcap
= &req
->iu
.mad
.capabilities
;
935 req_len
= len
= be16_to_cpu(vcap
->common
.length
);
936 buffer
= be64_to_cpu(vcap
->buffer
);
937 if (len
> sizeof(cap
)) {
938 fprintf(stderr
, "vscsi_send_capabilities: capabilities size mismatch !\n");
941 * Just read and populate the structure that is known.
942 * Zero rest of the structure.
946 rc
= spapr_vio_dma_read(&s
->vdev
, buffer
, &cap
, len
);
948 fprintf(stderr
, "vscsi_send_capabilities: DMA read failure !\n");
952 * Current implementation does not suppport any migration or
953 * reservation capabilities. Construct the response telling the
954 * guest not to use them.
957 cap
.migration
.ecl
= 0;
958 cap
.reserve
.type
= 0;
959 cap
.migration
.common
.server_support
= 0;
960 cap
.reserve
.common
.server_support
= 0;
962 rc
= spapr_vio_dma_write(&s
->vdev
, buffer
, &cap
, len
);
964 fprintf(stderr
, "vscsi_send_capabilities: DMA write failure !\n");
968 * Being paranoid and lets not worry about the error code
969 * here. Actual write of the cap is done above.
971 spapr_vio_dma_set(&s
->vdev
, (buffer
+ len
), 0, (req_len
- len
));
973 vcap
->common
.status
= rc
? cpu_to_be32(1) : 0;
974 return vscsi_send_iu(s
, req
, sizeof(*vcap
), VIOSRP_MAD_FORMAT
);
977 static int vscsi_handle_mad_req(VSCSIState
*s
, vscsi_req
*req
)
979 union mad_iu
*mad
= &req
->iu
.mad
;
980 bool request_handled
= false;
983 switch (be32_to_cpu(mad
->empty_iu
.common
.type
)) {
984 case VIOSRP_EMPTY_IU_TYPE
:
985 fprintf(stderr
, "Unsupported EMPTY MAD IU\n");
986 retlen
= sizeof(mad
->empty_iu
);
988 case VIOSRP_ERROR_LOG_TYPE
:
989 fprintf(stderr
, "Unsupported ERROR LOG MAD IU\n");
990 retlen
= sizeof(mad
->error_log
);
992 case VIOSRP_ADAPTER_INFO_TYPE
:
993 vscsi_send_adapter_info(s
, req
);
994 request_handled
= true;
996 case VIOSRP_HOST_CONFIG_TYPE
:
997 retlen
= sizeof(mad
->host_config
);
999 case VIOSRP_CAPABILITIES_TYPE
:
1000 vscsi_send_capabilities(s
, req
);
1001 request_handled
= true;
1004 fprintf(stderr
, "VSCSI: Unknown MAD type %02x\n",
1005 be32_to_cpu(mad
->empty_iu
.common
.type
));
1007 * PAPR+ says that "The length field is set to the length
1008 * of the data structure(s) used in the command".
1009 * As we did not recognize the request type, put zero there.
1014 if (!request_handled
) {
1015 mad
->empty_iu
.common
.status
= cpu_to_be16(VIOSRP_MAD_NOT_SUPPORTED
);
1016 vscsi_send_iu(s
, req
, retlen
, VIOSRP_MAD_FORMAT
);
1022 static void vscsi_got_payload(VSCSIState
*s
, vscsi_crq
*crq
)
1027 req
= vscsi_get_req(s
);
1029 fprintf(stderr
, "VSCSI: Failed to get a request !\n");
1033 /* We only support a limited number of descriptors, we know
1034 * the ibmvscsi driver uses up to 10 max, so it should fit
1035 * in our 256 bytes IUs. If not we'll have to increase the size
1038 if (crq
->s
.IU_length
> sizeof(union viosrp_iu
)) {
1039 fprintf(stderr
, "VSCSI: SRP IU too long (%d bytes) !\n",
1045 /* XXX Handle failure differently ? */
1046 if (spapr_vio_dma_read(&s
->vdev
, crq
->s
.IU_data_ptr
, &req
->iu
,
1047 crq
->s
.IU_length
)) {
1048 fprintf(stderr
, "vscsi_got_payload: DMA read failure !\n");
1052 memcpy(&req
->crq
, crq
, sizeof(vscsi_crq
));
1054 if (crq
->s
.format
== VIOSRP_MAD_FORMAT
) {
1055 done
= vscsi_handle_mad_req(s
, req
);
1057 done
= vscsi_handle_srp_req(s
, req
);
1066 static int vscsi_do_crq(struct VIOsPAPRDevice
*dev
, uint8_t *crq_data
)
1068 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(dev
);
1071 memcpy(crq
.raw
, crq_data
, 16);
1072 crq
.s
.timeout
= be16_to_cpu(crq
.s
.timeout
);
1073 crq
.s
.IU_length
= be16_to_cpu(crq
.s
.IU_length
);
1074 crq
.s
.IU_data_ptr
= be64_to_cpu(crq
.s
.IU_data_ptr
);
1076 DPRINTF("VSCSI: do_crq %02x %02x ...\n", crq
.raw
[0], crq
.raw
[1]);
1078 switch (crq
.s
.valid
) {
1079 case 0xc0: /* Init command/response */
1081 /* Respond to initialization request */
1082 if (crq
.s
.format
== 0x01) {
1083 memset(crq
.raw
, 0, 16);
1085 crq
.s
.format
= 0x02;
1086 spapr_vio_send_crq(dev
, crq
.raw
);
1089 /* Note that in hotplug cases, we might get a 0x02
1090 * as a result of us emitting the init request
1094 case 0xff: /* Link event */
1096 /* Not handled for now */
1099 case 0x80: /* Payloads */
1100 switch (crq
.s
.format
) {
1101 case VIOSRP_SRP_FORMAT
: /* AKA VSCSI request */
1102 case VIOSRP_MAD_FORMAT
: /* AKA VSCSI response */
1103 vscsi_got_payload(s
, &crq
);
1105 case VIOSRP_OS400_FORMAT
:
1106 case VIOSRP_AIX_FORMAT
:
1107 case VIOSRP_LINUX_FORMAT
:
1108 case VIOSRP_INLINE_FORMAT
:
1109 fprintf(stderr
, "vscsi_do_srq: Unsupported payload format %02x\n",
1113 fprintf(stderr
, "vscsi_do_srq: Unknown payload format %02x\n",
1118 fprintf(stderr
, "vscsi_do_crq: unknown CRQ %02x %02x ...\n",
1119 crq
.raw
[0], crq
.raw
[1]);
1125 static const struct SCSIBusInfo vscsi_scsi_info
= {
1127 .max_channel
= 7, /* logical unit addressing format */
1131 .transfer_data
= vscsi_transfer_data
,
1132 .complete
= vscsi_command_complete
,
1133 .cancel
= vscsi_request_cancelled
,
1134 .save_request
= vscsi_save_request
,
1135 .load_request
= vscsi_load_request
,
1138 static void spapr_vscsi_reset(VIOsPAPRDevice
*dev
)
1140 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(dev
);
1143 memset(s
->reqs
, 0, sizeof(s
->reqs
));
1144 for (i
= 0; i
< VSCSI_REQ_LIMIT
; i
++) {
1145 s
->reqs
[i
].qtag
= i
;
1149 static int spapr_vscsi_init(VIOsPAPRDevice
*dev
)
1151 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(dev
);
1154 dev
->crq
.SendFunc
= vscsi_do_crq
;
1156 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), DEVICE(dev
),
1157 &vscsi_scsi_info
, NULL
);
1158 if (!dev
->qdev
.hotplugged
) {
1159 scsi_bus_legacy_handle_cmdline(&s
->bus
, &err
);
1169 void spapr_vscsi_create(VIOsPAPRBus
*bus
)
1173 dev
= qdev_create(&bus
->bus
, "spapr-vscsi");
1175 qdev_init_nofail(dev
);
1178 static int spapr_vscsi_devnode(VIOsPAPRDevice
*dev
, void *fdt
, int node_off
)
1182 ret
= fdt_setprop_cell(fdt
, node_off
, "#address-cells", 2);
1187 ret
= fdt_setprop_cell(fdt
, node_off
, "#size-cells", 0);
1195 static Property spapr_vscsi_properties
[] = {
1196 DEFINE_SPAPR_PROPERTIES(VSCSIState
, vdev
),
1197 DEFINE_PROP_END_OF_LIST(),
1200 static const VMStateDescription vmstate_spapr_vscsi
= {
1201 .name
= "spapr_vscsi",
1203 .minimum_version_id
= 1,
1204 .minimum_version_id_old
= 1,
1205 .fields
= (VMStateField
[]) {
1206 VMSTATE_SPAPR_VIO(vdev
, VSCSIState
),
1210 VMSTATE_END_OF_LIST()
1214 static void spapr_vscsi_class_init(ObjectClass
*klass
, void *data
)
1216 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1217 VIOsPAPRDeviceClass
*k
= VIO_SPAPR_DEVICE_CLASS(klass
);
1219 k
->init
= spapr_vscsi_init
;
1220 k
->reset
= spapr_vscsi_reset
;
1221 k
->devnode
= spapr_vscsi_devnode
;
1222 k
->dt_name
= "v-scsi";
1223 k
->dt_type
= "vscsi";
1224 k
->dt_compatible
= "IBM,v-scsi";
1225 k
->signal_mask
= 0x00000001;
1226 dc
->props
= spapr_vscsi_properties
;
1227 k
->rtce_window_size
= 0x10000000;
1228 dc
->vmsd
= &vmstate_spapr_vscsi
;
1231 static const TypeInfo spapr_vscsi_info
= {
1232 .name
= TYPE_VIO_SPAPR_VSCSI_DEVICE
,
1233 .parent
= TYPE_VIO_SPAPR_DEVICE
,
1234 .instance_size
= sizeof(VSCSIState
),
1235 .class_init
= spapr_vscsi_class_init
,
1238 static void spapr_vscsi_register_types(void)
1240 type_register_static(&spapr_vscsi_info
);
1243 type_init(spapr_vscsi_register_types
)